xref: /openbsd-src/sys/dev/ic/rt2560.c (revision a28daedfc357b214be5c701aa8ba8adb29a7f1c2)
1 /*	$OpenBSD: rt2560.c,v 1.43 2009/03/29 21:53:52 sthen Exp $  */
2 
3 /*-
4  * Copyright (c) 2005, 2006
5  *	Damien Bergamini <damien.bergamini@free.fr>
6  *
7  * Permission to use, copy, modify, and distribute this software for any
8  * purpose with or without fee is hereby granted, provided that the above
9  * copyright notice and this permission notice appear in all copies.
10  *
11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18  */
19 
20 /*-
21  * Ralink Technology RT2560 chipset driver
22  * http://www.ralinktech.com/
23  */
24 
25 #include "bpfilter.h"
26 
27 #include <sys/param.h>
28 #include <sys/sockio.h>
29 #include <sys/sysctl.h>
30 #include <sys/mbuf.h>
31 #include <sys/kernel.h>
32 #include <sys/socket.h>
33 #include <sys/systm.h>
34 #include <sys/malloc.h>
35 #include <sys/timeout.h>
36 #include <sys/conf.h>
37 #include <sys/device.h>
38 
39 #include <machine/bus.h>
40 #include <machine/endian.h>
41 #include <machine/intr.h>
42 
43 #if NBPFILTER > 0
44 #include <net/bpf.h>
45 #endif
46 #include <net/if.h>
47 #include <net/if_arp.h>
48 #include <net/if_dl.h>
49 #include <net/if_media.h>
50 #include <net/if_types.h>
51 
52 #include <netinet/in.h>
53 #include <netinet/in_systm.h>
54 #include <netinet/in_var.h>
55 #include <netinet/if_ether.h>
56 #include <netinet/ip.h>
57 
58 #include <net80211/ieee80211_var.h>
59 #include <net80211/ieee80211_amrr.h>
60 #include <net80211/ieee80211_radiotap.h>
61 
62 #include <dev/ic/rt2560reg.h>
63 #include <dev/ic/rt2560var.h>
64 
65 #include <dev/pci/pcireg.h>
66 #include <dev/pci/pcivar.h>
67 #include <dev/pci/pcidevs.h>
68 
69 #ifdef RAL_DEBUG
70 #define DPRINTF(x)	do { if (rt2560_debug > 0) printf x; } while (0)
71 #define DPRINTFN(n, x)	do { if (rt2560_debug >= (n)) printf x; } while (0)
72 int rt2560_debug = 1;
73 #else
74 #define DPRINTF(x)
75 #define DPRINTFN(n, x)
76 #endif
77 
78 int		rt2560_alloc_tx_ring(struct rt2560_softc *,
79 		    struct rt2560_tx_ring *, int);
80 void		rt2560_reset_tx_ring(struct rt2560_softc *,
81 		    struct rt2560_tx_ring *);
82 void		rt2560_free_tx_ring(struct rt2560_softc *,
83 		    struct rt2560_tx_ring *);
84 int		rt2560_alloc_rx_ring(struct rt2560_softc *,
85 		    struct rt2560_rx_ring *, int);
86 void		rt2560_reset_rx_ring(struct rt2560_softc *,
87 		    struct rt2560_rx_ring *);
88 void		rt2560_free_rx_ring(struct rt2560_softc *,
89 		    struct rt2560_rx_ring *);
90 struct		ieee80211_node *rt2560_node_alloc(struct ieee80211com *);
91 int		rt2560_media_change(struct ifnet *);
92 void		rt2560_next_scan(void *);
93 void		rt2560_iter_func(void *, struct ieee80211_node *);
94 void		rt2560_amrr_timeout(void *);
95 void		rt2560_newassoc(struct ieee80211com *, struct ieee80211_node *,
96 		    int);
97 int		rt2560_newstate(struct ieee80211com *, enum ieee80211_state,
98 		    int);
99 uint16_t	rt2560_eeprom_read(struct rt2560_softc *, uint8_t);
100 void		rt2560_encryption_intr(struct rt2560_softc *);
101 void		rt2560_tx_intr(struct rt2560_softc *);
102 void		rt2560_prio_intr(struct rt2560_softc *);
103 void		rt2560_decryption_intr(struct rt2560_softc *);
104 void		rt2560_rx_intr(struct rt2560_softc *);
105 #ifndef IEEE80211_STA_ONLY
106 void		rt2560_beacon_expire(struct rt2560_softc *);
107 #endif
108 void		rt2560_wakeup_expire(struct rt2560_softc *);
109 #if NBPFILTER > 0
110 uint8_t		rt2560_rxrate(const struct rt2560_rx_desc *);
111 #endif
112 int		rt2560_ack_rate(struct ieee80211com *, int);
113 uint16_t	rt2560_txtime(int, int, uint32_t);
114 uint8_t		rt2560_plcp_signal(int);
115 void		rt2560_setup_tx_desc(struct rt2560_softc *,
116 		    struct rt2560_tx_desc *, uint32_t, int, int, int,
117 		    bus_addr_t);
118 #ifndef IEEE80211_STA_ONLY
119 int		rt2560_tx_bcn(struct rt2560_softc *, struct mbuf *,
120 		    struct ieee80211_node *);
121 #endif
122 int		rt2560_tx_mgt(struct rt2560_softc *, struct mbuf *,
123 		    struct ieee80211_node *);
124 int		rt2560_tx_data(struct rt2560_softc *, struct mbuf *,
125 		    struct ieee80211_node *);
126 void		rt2560_start(struct ifnet *);
127 void		rt2560_watchdog(struct ifnet *);
128 int		rt2560_ioctl(struct ifnet *, u_long, caddr_t);
129 void		rt2560_bbp_write(struct rt2560_softc *, uint8_t, uint8_t);
130 uint8_t		rt2560_bbp_read(struct rt2560_softc *, uint8_t);
131 void		rt2560_rf_write(struct rt2560_softc *, uint8_t, uint32_t);
132 void		rt2560_set_chan(struct rt2560_softc *,
133 		    struct ieee80211_channel *);
134 void		rt2560_disable_rf_tune(struct rt2560_softc *);
135 void		rt2560_enable_tsf_sync(struct rt2560_softc *);
136 void		rt2560_update_plcp(struct rt2560_softc *);
137 void		rt2560_updateslot(struct ieee80211com *);
138 void		rt2560_set_slottime(struct rt2560_softc *);
139 void		rt2560_set_basicrates(struct rt2560_softc *);
140 void		rt2560_update_led(struct rt2560_softc *, int, int);
141 void		rt2560_set_bssid(struct rt2560_softc *, uint8_t *);
142 void		rt2560_set_macaddr(struct rt2560_softc *, uint8_t *);
143 void		rt2560_get_macaddr(struct rt2560_softc *, uint8_t *);
144 void		rt2560_update_promisc(struct rt2560_softc *);
145 void		rt2560_set_txantenna(struct rt2560_softc *, int);
146 void		rt2560_set_rxantenna(struct rt2560_softc *, int);
147 const char	*rt2560_get_rf(int);
148 void		rt2560_read_eeprom(struct rt2560_softc *);
149 int		rt2560_bbp_init(struct rt2560_softc *);
150 int		rt2560_init(struct ifnet *);
151 void		rt2560_stop(struct ifnet *, int);
152 void		rt2560_power(int, void *);
153 
154 static const struct {
155 	uint32_t	reg;
156 	uint32_t	val;
157 } rt2560_def_mac[] = {
158 	RT2560_DEF_MAC
159 };
160 
161 static const struct {
162 	uint8_t	reg;
163 	uint8_t	val;
164 } rt2560_def_bbp[] = {
165 	RT2560_DEF_BBP
166 };
167 
168 static const uint32_t rt2560_rf2522_r2[]    = RT2560_RF2522_R2;
169 static const uint32_t rt2560_rf2523_r2[]    = RT2560_RF2523_R2;
170 static const uint32_t rt2560_rf2524_r2[]    = RT2560_RF2524_R2;
171 static const uint32_t rt2560_rf2525_r2[]    = RT2560_RF2525_R2;
172 static const uint32_t rt2560_rf2525_hi_r2[] = RT2560_RF2525_HI_R2;
173 static const uint32_t rt2560_rf2525e_r2[]   = RT2560_RF2525E_R2;
174 static const uint32_t rt2560_rf2526_r2[]    = RT2560_RF2526_R2;
175 static const uint32_t rt2560_rf2526_hi_r2[] = RT2560_RF2526_HI_R2;
176 
177 int
178 rt2560_attach(void *xsc, int id)
179 {
180 	struct rt2560_softc *sc = xsc;
181 	struct ieee80211com *ic = &sc->sc_ic;
182 	struct ifnet *ifp = &ic->ic_if;
183 	int error, i;
184 
185 	sc->amrr.amrr_min_success_threshold =  1;
186 	sc->amrr.amrr_max_success_threshold = 15;
187 	timeout_set(&sc->amrr_to, rt2560_amrr_timeout, sc);
188 	timeout_set(&sc->scan_to, rt2560_next_scan, sc);
189 
190 	/* retrieve RT2560 rev. no */
191 	sc->asic_rev = RAL_READ(sc, RT2560_CSR0);
192 
193 	/* retrieve MAC address */
194 	rt2560_get_macaddr(sc, ic->ic_myaddr);
195 	printf(", address %s\n", ether_sprintf(ic->ic_myaddr));
196 
197 	/* retrieve RF rev. no and various other things from EEPROM */
198 	rt2560_read_eeprom(sc);
199 
200 	printf("%s: MAC/BBP RT2560 (rev 0x%02x), RF %s\n", sc->sc_dev.dv_xname,
201 	    sc->asic_rev, rt2560_get_rf(sc->rf_rev));
202 
203 	/*
204 	 * Allocate Tx and Rx rings.
205 	 */
206 	error = rt2560_alloc_tx_ring(sc, &sc->txq, RT2560_TX_RING_COUNT);
207 	if (error != 0) {
208 		printf("%s: could not allocate Tx ring\n",
209 		    sc->sc_dev.dv_xname);
210 		goto fail1;
211 	}
212 	error = rt2560_alloc_tx_ring(sc, &sc->atimq, RT2560_ATIM_RING_COUNT);
213 	if (error != 0) {
214 		printf("%s: could not allocate ATIM ring\n",
215 		    sc->sc_dev.dv_xname);
216 		goto fail2;
217 	}
218 	error = rt2560_alloc_tx_ring(sc, &sc->prioq, RT2560_PRIO_RING_COUNT);
219 	if (error != 0) {
220 		printf("%s: could not allocate Prio ring\n",
221 		    sc->sc_dev.dv_xname);
222 		goto fail3;
223 	}
224 	error = rt2560_alloc_tx_ring(sc, &sc->bcnq, RT2560_BEACON_RING_COUNT);
225 	if (error != 0) {
226 		printf("%s: could not allocate Beacon ring\n",
227 		    sc->sc_dev.dv_xname);
228 		goto fail4;
229 	}
230 	error = rt2560_alloc_rx_ring(sc, &sc->rxq, RT2560_RX_RING_COUNT);
231 	if (error != 0) {
232 		printf("%s: could not allocate Rx ring\n",
233 		    sc->sc_dev.dv_xname);
234 		goto fail5;
235 	}
236 
237 	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
238 	ic->ic_opmode = IEEE80211_M_STA; /* default to BSS mode */
239 	ic->ic_state = IEEE80211_S_INIT;
240 
241 	/* set device capabilities */
242 	ic->ic_caps =
243 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
244 #ifndef IEEE80211_STA_ONLY
245 	    IEEE80211_C_IBSS |		/* IBSS mode supported */
246 	    IEEE80211_C_HOSTAP |	/* HostAp mode supported */
247 #endif
248 	    IEEE80211_C_TXPMGT |	/* tx power management */
249 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
250 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
251 	    IEEE80211_C_WEP |		/* s/w WEP */
252 	    IEEE80211_C_RSN;		/* WPA/RSN */
253 
254 	/* set supported .11b and .11g rates */
255 	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
256 	ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g;
257 
258 	/* set supported .11b and .11g channels (1 through 14) */
259 	for (i = 1; i <= 14; i++) {
260 		ic->ic_channels[i].ic_freq =
261 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
262 		ic->ic_channels[i].ic_flags =
263 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
264 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
265 	}
266 
267 	ifp->if_softc = sc;
268 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
269 	ifp->if_init = rt2560_init;
270 	ifp->if_ioctl = rt2560_ioctl;
271 	ifp->if_start = rt2560_start;
272 	ifp->if_watchdog = rt2560_watchdog;
273 	IFQ_SET_READY(&ifp->if_snd);
274 	memcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
275 
276 	if_attach(ifp);
277 	ieee80211_ifattach(ifp);
278 	ic->ic_node_alloc = rt2560_node_alloc;
279 	ic->ic_newassoc = rt2560_newassoc;
280 	ic->ic_updateslot = rt2560_updateslot;
281 
282 	/* override state transition machine */
283 	sc->sc_newstate = ic->ic_newstate;
284 	ic->ic_newstate = rt2560_newstate;
285 	ieee80211_media_init(ifp, rt2560_media_change, ieee80211_media_status);
286 
287 #if NBPFILTER > 0
288 	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
289 	    sizeof (struct ieee80211_frame) + 64);
290 
291 	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
292 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
293 	sc->sc_rxtap.wr_ihdr.it_present = htole32(RT2560_RX_RADIOTAP_PRESENT);
294 
295 	sc->sc_txtap_len = sizeof sc->sc_txtapu;
296 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
297 	sc->sc_txtap.wt_ihdr.it_present = htole32(RT2560_TX_RADIOTAP_PRESENT);
298 #endif
299 
300 	/*
301 	 * Make sure the interface is shutdown during reboot.
302 	 */
303 	sc->sc_sdhook = shutdownhook_establish(rt2560_shutdown, sc);
304 	if (sc->sc_sdhook == NULL) {
305 		printf("%s: WARNING: unable to establish shutdown hook\n",
306 		    sc->sc_dev.dv_xname);
307 	}
308 	sc->sc_powerhook = powerhook_establish(rt2560_power, sc);
309 	if (sc->sc_powerhook == NULL) {
310 		printf("%s: WARNING: unable to establish power hook\n",
311 		    sc->sc_dev.dv_xname);
312 	}
313 	return 0;
314 
315 fail5:	rt2560_free_tx_ring(sc, &sc->bcnq);
316 fail4:	rt2560_free_tx_ring(sc, &sc->prioq);
317 fail3:	rt2560_free_tx_ring(sc, &sc->atimq);
318 fail2:	rt2560_free_tx_ring(sc, &sc->txq);
319 fail1:	return ENXIO;
320 }
321 
322 int
323 rt2560_detach(void *xsc)
324 {
325 	struct rt2560_softc *sc = xsc;
326 	struct ifnet *ifp = &sc->sc_ic.ic_if;
327 
328 	timeout_del(&sc->scan_to);
329 	timeout_del(&sc->amrr_to);
330 
331 	ieee80211_ifdetach(ifp);	/* free all nodes */
332 	if_detach(ifp);
333 
334 	if (sc->sc_powerhook != NULL)
335 		powerhook_disestablish(sc->sc_powerhook);
336 	if (sc->sc_sdhook != NULL)
337 		shutdownhook_disestablish(sc->sc_sdhook);
338 
339 	rt2560_free_tx_ring(sc, &sc->txq);
340 	rt2560_free_tx_ring(sc, &sc->atimq);
341 	rt2560_free_tx_ring(sc, &sc->prioq);
342 	rt2560_free_tx_ring(sc, &sc->bcnq);
343 	rt2560_free_rx_ring(sc, &sc->rxq);
344 
345 	return 0;
346 }
347 
348 int
349 rt2560_alloc_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring,
350     int count)
351 {
352 	int i, nsegs, error;
353 
354 	ring->count = count;
355 	ring->queued = 0;
356 	ring->cur = ring->next = 0;
357 	ring->cur_encrypt = ring->next_encrypt = 0;
358 
359 	error = bus_dmamap_create(sc->sc_dmat, count * RT2560_TX_DESC_SIZE, 1,
360 	    count * RT2560_TX_DESC_SIZE, 0, BUS_DMA_NOWAIT, &ring->map);
361 	if (error != 0) {
362 		printf("%s: could not create desc DMA map\n",
363 		    sc->sc_dev.dv_xname);
364 		goto fail;
365 	}
366 
367 	error = bus_dmamem_alloc(sc->sc_dmat, count * RT2560_TX_DESC_SIZE,
368 	    PAGE_SIZE, 0, &ring->seg, 1, &nsegs, BUS_DMA_NOWAIT);
369 	if (error != 0) {
370 		printf("%s: could not allocate DMA memory\n",
371 		    sc->sc_dev.dv_xname);
372 		goto fail;
373 	}
374 
375 	error = bus_dmamem_map(sc->sc_dmat, &ring->seg, nsegs,
376 	    count * RT2560_TX_DESC_SIZE, (caddr_t *)&ring->desc,
377 	    BUS_DMA_NOWAIT);
378 	if (error != 0) {
379 		printf("%s: can't map desc DMA memory\n",
380 		    sc->sc_dev.dv_xname);
381 		goto fail;
382 	}
383 
384 	error = bus_dmamap_load(sc->sc_dmat, ring->map, ring->desc,
385 	    count * RT2560_TX_DESC_SIZE, NULL, BUS_DMA_NOWAIT);
386 	if (error != 0) {
387 		printf("%s: could not load desc DMA map\n",
388 		    sc->sc_dev.dv_xname);
389 		goto fail;
390 	}
391 
392 	memset(ring->desc, 0, count * RT2560_TX_DESC_SIZE);
393 	ring->physaddr = ring->map->dm_segs->ds_addr;
394 
395 	ring->data = malloc(count * sizeof (struct rt2560_tx_data), M_DEVBUF,
396 	    M_NOWAIT | M_ZERO);
397 	if (ring->data == NULL) {
398 		printf("%s: could not allocate soft data\n",
399 		    sc->sc_dev.dv_xname);
400 		error = ENOMEM;
401 		goto fail;
402 	}
403 
404 	for (i = 0; i < count; i++) {
405 		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,
406 		    RT2560_MAX_SCATTER, MCLBYTES, 0, BUS_DMA_NOWAIT,
407 		    &ring->data[i].map);
408 		if (error != 0) {
409 			printf("%s: could not create DMA map\n",
410 			    sc->sc_dev.dv_xname);
411 			goto fail;
412 		}
413 	}
414 
415 	return 0;
416 
417 fail:	rt2560_free_tx_ring(sc, ring);
418 	return error;
419 }
420 
421 void
422 rt2560_reset_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring)
423 {
424 	int i;
425 
426 	for (i = 0; i < ring->count; i++) {
427 		struct rt2560_tx_desc *desc = &ring->desc[i];
428 		struct rt2560_tx_data *data = &ring->data[i];
429 
430 		if (data->m != NULL) {
431 			bus_dmamap_sync(sc->sc_dmat, data->map, 0,
432 			    data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
433 			bus_dmamap_unload(sc->sc_dmat, data->map);
434 			m_freem(data->m);
435 			data->m = NULL;
436 		}
437 
438 		/*
439 		 * The node has already been freed at that point so don't call
440 		 * ieee80211_release_node() here.
441 		 */
442 		data->ni = NULL;
443 
444 		desc->flags = 0;
445 	}
446 
447 	bus_dmamap_sync(sc->sc_dmat, ring->map, 0, ring->map->dm_mapsize,
448 	    BUS_DMASYNC_PREWRITE);
449 
450 	ring->queued = 0;
451 	ring->cur = ring->next = 0;
452 	ring->cur_encrypt = ring->next_encrypt = 0;
453 }
454 
455 void
456 rt2560_free_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring)
457 {
458 	int i;
459 
460 	if (ring->desc != NULL) {
461 		bus_dmamap_sync(sc->sc_dmat, ring->map, 0,
462 		    ring->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
463 		bus_dmamap_unload(sc->sc_dmat, ring->map);
464 		bus_dmamem_unmap(sc->sc_dmat, (caddr_t)ring->desc,
465 		    ring->count * RT2560_TX_DESC_SIZE);
466 		bus_dmamem_free(sc->sc_dmat, &ring->seg, 1);
467 	}
468 
469 	if (ring->data != NULL) {
470 		for (i = 0; i < ring->count; i++) {
471 			struct rt2560_tx_data *data = &ring->data[i];
472 
473 			if (data->m != NULL) {
474 				bus_dmamap_sync(sc->sc_dmat, data->map, 0,
475 				    data->map->dm_mapsize,
476 				    BUS_DMASYNC_POSTWRITE);
477 				bus_dmamap_unload(sc->sc_dmat, data->map);
478 				m_freem(data->m);
479 			}
480 
481 			/*
482 			 * The node has already been freed at that point so
483 			 * don't call ieee80211_release_node() here.
484 			 */
485 			data->ni = NULL;
486 
487 			if (data->map != NULL)
488 				bus_dmamap_destroy(sc->sc_dmat, data->map);
489 		}
490 		free(ring->data, M_DEVBUF);
491 	}
492 }
493 
494 int
495 rt2560_alloc_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring,
496     int count)
497 {
498 	int i, nsegs, error;
499 
500 	ring->count = count;
501 	ring->cur = ring->next = 0;
502 	ring->cur_decrypt = 0;
503 
504 	error = bus_dmamap_create(sc->sc_dmat, count * RT2560_RX_DESC_SIZE, 1,
505 	    count * RT2560_RX_DESC_SIZE, 0, BUS_DMA_NOWAIT, &ring->map);
506 	if (error != 0) {
507 		printf("%s: could not create desc DMA map\n",
508 		    sc->sc_dev.dv_xname);
509 		goto fail;
510 	}
511 
512 	error = bus_dmamem_alloc(sc->sc_dmat, count * RT2560_RX_DESC_SIZE,
513 	    PAGE_SIZE, 0, &ring->seg, 1, &nsegs, BUS_DMA_NOWAIT);
514 	if (error != 0) {
515 		printf("%s: could not allocate DMA memory\n",
516 		    sc->sc_dev.dv_xname);
517 		goto fail;
518 	}
519 
520 	error = bus_dmamem_map(sc->sc_dmat, &ring->seg, nsegs,
521 	    count * RT2560_RX_DESC_SIZE, (caddr_t *)&ring->desc,
522 	    BUS_DMA_NOWAIT);
523 	if (error != 0) {
524 		printf("%s: can't map desc DMA memory\n",
525 		    sc->sc_dev.dv_xname);
526 		goto fail;
527 	}
528 
529 	error = bus_dmamap_load(sc->sc_dmat, ring->map, ring->desc,
530 	    count * RT2560_RX_DESC_SIZE, NULL, BUS_DMA_NOWAIT);
531 	if (error != 0) {
532 		printf("%s: could not load desc DMA map\n",
533 		    sc->sc_dev.dv_xname);
534 		goto fail;
535 	}
536 
537 	memset(ring->desc, 0, count * RT2560_RX_DESC_SIZE);
538 	ring->physaddr = ring->map->dm_segs->ds_addr;
539 
540 	ring->data = malloc(count * sizeof (struct rt2560_rx_data), M_DEVBUF,
541 	    M_NOWAIT | M_ZERO);
542 	if (ring->data == NULL) {
543 		printf("%s: could not allocate soft data\n",
544 		    sc->sc_dev.dv_xname);
545 		error = ENOMEM;
546 		goto fail;
547 	}
548 
549 	/*
550 	 * Pre-allocate Rx buffers and populate Rx ring.
551 	 */
552 	for (i = 0; i < count; i++) {
553 		struct rt2560_rx_desc *desc = &sc->rxq.desc[i];
554 		struct rt2560_rx_data *data = &sc->rxq.data[i];
555 
556 		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
557 		    0, BUS_DMA_NOWAIT, &data->map);
558 		if (error != 0) {
559 			printf("%s: could not create DMA map\n",
560 			    sc->sc_dev.dv_xname);
561 			goto fail;
562 		}
563 
564 		MGETHDR(data->m, M_DONTWAIT, MT_DATA);
565 		if (data->m == NULL) {
566 			printf("%s: could not allocate rx mbuf\n",
567 			    sc->sc_dev.dv_xname);
568 			error = ENOMEM;
569 			goto fail;
570 		}
571 		MCLGET(data->m, M_DONTWAIT);
572 		if (!(data->m->m_flags & M_EXT)) {
573 			printf("%s: could not allocate rx mbuf cluster\n",
574 			    sc->sc_dev.dv_xname);
575 			error = ENOMEM;
576 			goto fail;
577 		}
578 
579 		error = bus_dmamap_load(sc->sc_dmat, data->map,
580 		    mtod(data->m, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
581 		if (error != 0) {
582 			printf("%s: could not load rx buf DMA map",
583 			    sc->sc_dev.dv_xname);
584 			goto fail;
585 		}
586 
587 		desc->flags = htole32(RT2560_RX_BUSY);
588 		desc->physaddr = htole32(data->map->dm_segs->ds_addr);
589 	}
590 
591 	bus_dmamap_sync(sc->sc_dmat, ring->map, 0, ring->map->dm_mapsize,
592 	    BUS_DMASYNC_PREWRITE);
593 
594 	return 0;
595 
596 fail:	rt2560_free_rx_ring(sc, ring);
597 	return error;
598 }
599 
600 void
601 rt2560_reset_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring)
602 {
603 	int i;
604 
605 	for (i = 0; i < ring->count; i++) {
606 		ring->desc[i].flags = htole32(RT2560_RX_BUSY);
607 		ring->data[i].drop = 0;
608 	}
609 
610 	bus_dmamap_sync(sc->sc_dmat, ring->map, 0, ring->map->dm_mapsize,
611 	    BUS_DMASYNC_PREWRITE);
612 
613 	ring->cur = ring->next = 0;
614 	ring->cur_decrypt = 0;
615 }
616 
617 void
618 rt2560_free_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring)
619 {
620 	int i;
621 
622 	if (ring->desc != NULL) {
623 		bus_dmamap_sync(sc->sc_dmat, ring->map, 0,
624 		    ring->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
625 		bus_dmamap_unload(sc->sc_dmat, ring->map);
626 		bus_dmamem_unmap(sc->sc_dmat, (caddr_t)ring->desc,
627 		    ring->count * RT2560_RX_DESC_SIZE);
628 		bus_dmamem_free(sc->sc_dmat, &ring->seg, 1);
629 	}
630 
631 	if (ring->data != NULL) {
632 		for (i = 0; i < ring->count; i++) {
633 			struct rt2560_rx_data *data = &ring->data[i];
634 
635 			if (data->m != NULL) {
636 				bus_dmamap_sync(sc->sc_dmat, data->map, 0,
637 				    data->map->dm_mapsize,
638 				    BUS_DMASYNC_POSTREAD);
639 				bus_dmamap_unload(sc->sc_dmat, data->map);
640 				m_freem(data->m);
641 			}
642 
643 			if (data->map != NULL)
644 				bus_dmamap_destroy(sc->sc_dmat, data->map);
645 		}
646 		free(ring->data, M_DEVBUF);
647 	}
648 }
649 
650 struct ieee80211_node *
651 rt2560_node_alloc(struct ieee80211com *ic)
652 {
653 	return malloc(sizeof (struct rt2560_node), M_DEVBUF,
654 	    M_NOWAIT | M_ZERO);
655 }
656 
657 int
658 rt2560_media_change(struct ifnet *ifp)
659 {
660 	int error;
661 
662 	error = ieee80211_media_change(ifp);
663 	if (error != ENETRESET)
664 		return error;
665 
666 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
667 		rt2560_init(ifp);
668 
669 	return 0;
670 }
671 
672 /*
673  * This function is called periodically (every 200ms) during scanning to
674  * switch from one channel to another.
675  */
676 void
677 rt2560_next_scan(void *arg)
678 {
679 	struct rt2560_softc *sc = arg;
680 	struct ieee80211com *ic = &sc->sc_ic;
681 	struct ifnet *ifp = &ic->ic_if;
682 	int s;
683 
684 	s = splnet();
685 	if (ic->ic_state == IEEE80211_S_SCAN)
686 		ieee80211_next_scan(ifp);
687 	splx(s);
688 }
689 
690 /*
691  * This function is called for each neighbor node.
692  */
693 void
694 rt2560_iter_func(void *arg, struct ieee80211_node *ni)
695 {
696 	struct rt2560_softc *sc = arg;
697 	struct rt2560_node *rn = (struct rt2560_node *)ni;
698 
699 	ieee80211_amrr_choose(&sc->amrr, ni, &rn->amn);
700 }
701 
702 void
703 rt2560_amrr_timeout(void *arg)
704 {
705 	struct rt2560_softc *sc = arg;
706 	struct ieee80211com *ic = &sc->sc_ic;
707 	int s;
708 
709 	s = splnet();
710 	if (ic->ic_opmode == IEEE80211_M_STA)
711 		rt2560_iter_func(sc, ic->ic_bss);
712 #ifndef IEEE80211_STA_ONLY
713 	else
714 		ieee80211_iterate_nodes(ic, rt2560_iter_func, sc);
715 #endif
716 	splx(s);
717 
718 	timeout_add(&sc->amrr_to, hz / 2);
719 }
720 
721 void
722 rt2560_newassoc(struct ieee80211com *ic, struct ieee80211_node *ni, int isnew)
723 {
724 	struct rt2560_softc *sc = ic->ic_softc;
725 	int i;
726 
727 	ieee80211_amrr_node_init(&sc->amrr, &((struct rt2560_node *)ni)->amn);
728 
729 	/* set rate to some reasonable initial value */
730 	for (i = ni->ni_rates.rs_nrates - 1;
731 	     i > 0 && (ni->ni_rates.rs_rates[i] & IEEE80211_RATE_VAL) > 72;
732 	     i--);
733 	ni->ni_txrate = i;
734 }
735 
736 int
737 rt2560_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
738 {
739 	struct rt2560_softc *sc = ic->ic_if.if_softc;
740 	enum ieee80211_state ostate;
741 	struct ieee80211_node *ni;
742 	int error = 0;
743 
744 	ostate = ic->ic_state;
745 	timeout_del(&sc->scan_to);
746 	timeout_del(&sc->amrr_to);
747 
748 	switch (nstate) {
749 	case IEEE80211_S_INIT:
750 		if (ostate == IEEE80211_S_RUN) {
751 			/* abort TSF synchronization */
752 			RAL_WRITE(sc, RT2560_CSR14, 0);
753 
754 			/* turn association led off */
755 			rt2560_update_led(sc, 0, 0);
756 		}
757 		break;
758 
759 	case IEEE80211_S_SCAN:
760 		rt2560_set_chan(sc, ic->ic_bss->ni_chan);
761 		timeout_add(&sc->scan_to, hz / 5);
762 		break;
763 
764 	case IEEE80211_S_AUTH:
765 		rt2560_set_chan(sc, ic->ic_bss->ni_chan);
766 		break;
767 
768 	case IEEE80211_S_ASSOC:
769 		rt2560_set_chan(sc, ic->ic_bss->ni_chan);
770 		break;
771 
772 	case IEEE80211_S_RUN:
773 		rt2560_set_chan(sc, ic->ic_bss->ni_chan);
774 
775 		ni = ic->ic_bss;
776 
777 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
778 			rt2560_update_plcp(sc);
779 			rt2560_set_slottime(sc);
780 			rt2560_set_basicrates(sc);
781 			rt2560_set_bssid(sc, ni->ni_bssid);
782 		}
783 
784 #ifndef IEEE80211_STA_ONLY
785 		if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
786 		    ic->ic_opmode == IEEE80211_M_IBSS) {
787 			struct mbuf *m = ieee80211_beacon_alloc(ic, ni);
788 			if (m == NULL) {
789 				printf("%s: could not allocate beacon\n",
790 				    sc->sc_dev.dv_xname);
791 				error = ENOBUFS;
792 				break;
793 			}
794 
795 			error = rt2560_tx_bcn(sc, m, ni);
796 			if (error != 0)
797 				break;
798 		}
799 #endif
800 
801 		/* turn assocation led on */
802 		rt2560_update_led(sc, 1, 0);
803 
804 		if (ic->ic_opmode == IEEE80211_M_STA) {
805 			/* fake a join to init the tx rate */
806 			rt2560_newassoc(ic, ni, 1);
807 		}
808 
809 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
810 			/* start automatic rate control timer */
811 			if (ic->ic_fixed_rate == -1)
812 				timeout_add(&sc->amrr_to, hz / 2);
813 
814 			rt2560_enable_tsf_sync(sc);
815 		}
816 		break;
817 	}
818 
819 	return (error != 0) ? error : sc->sc_newstate(ic, nstate, arg);
820 }
821 
822 /*
823  * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46 or
824  * 93C66).
825  */
826 uint16_t
827 rt2560_eeprom_read(struct rt2560_softc *sc, uint8_t addr)
828 {
829 	uint32_t tmp;
830 	uint16_t val;
831 	int n;
832 
833 	/* clock C once before the first command */
834 	RT2560_EEPROM_CTL(sc, 0);
835 
836 	RT2560_EEPROM_CTL(sc, RT2560_S);
837 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
838 	RT2560_EEPROM_CTL(sc, RT2560_S);
839 
840 	/* write start bit (1) */
841 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D);
842 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D | RT2560_C);
843 
844 	/* write READ opcode (10) */
845 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D);
846 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D | RT2560_C);
847 	RT2560_EEPROM_CTL(sc, RT2560_S);
848 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
849 
850 	/* write address (A5-A0 or A7-A0) */
851 	n = (RAL_READ(sc, RT2560_CSR21) & RT2560_93C46) ? 5 : 7;
852 	for (; n >= 0; n--) {
853 		RT2560_EEPROM_CTL(sc, RT2560_S |
854 		    (((addr >> n) & 1) << RT2560_SHIFT_D));
855 		RT2560_EEPROM_CTL(sc, RT2560_S |
856 		    (((addr >> n) & 1) << RT2560_SHIFT_D) | RT2560_C);
857 	}
858 
859 	RT2560_EEPROM_CTL(sc, RT2560_S);
860 
861 	/* read data Q15-Q0 */
862 	val = 0;
863 	for (n = 15; n >= 0; n--) {
864 		RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
865 		tmp = RAL_READ(sc, RT2560_CSR21);
866 		val |= ((tmp & RT2560_Q) >> RT2560_SHIFT_Q) << n;
867 		RT2560_EEPROM_CTL(sc, RT2560_S);
868 	}
869 
870 	RT2560_EEPROM_CTL(sc, 0);
871 
872 	/* clear Chip Select and clock C */
873 	RT2560_EEPROM_CTL(sc, RT2560_S);
874 	RT2560_EEPROM_CTL(sc, 0);
875 	RT2560_EEPROM_CTL(sc, RT2560_C);
876 
877 	return val;
878 }
879 
880 /*
881  * Some frames were processed by the hardware cipher engine and are ready for
882  * transmission.
883  */
884 void
885 rt2560_encryption_intr(struct rt2560_softc *sc)
886 {
887 	int hw;
888 
889 	/* retrieve last descriptor index processed by cipher engine */
890 	hw = (RAL_READ(sc, RT2560_SECCSR1) - sc->txq.physaddr) /
891 	    RT2560_TX_DESC_SIZE;
892 
893 	for (; sc->txq.next_encrypt != hw;) {
894 		struct rt2560_tx_desc *desc =
895 		    &sc->txq.desc[sc->txq.next_encrypt];
896 
897 		bus_dmamap_sync(sc->sc_dmat, sc->txq.map,
898 		    sc->txq.next_encrypt * RT2560_TX_DESC_SIZE,
899 		    RT2560_TX_DESC_SIZE, BUS_DMASYNC_POSTREAD);
900 
901 		if (letoh32(desc->flags) &
902 		    (RT2560_TX_BUSY | RT2560_TX_CIPHER_BUSY))
903 			break;
904 
905 		/* for TKIP, swap eiv field to fix a bug in ASIC */
906 		if ((letoh32(desc->flags) & RT2560_TX_CIPHER_MASK) ==
907 		    RT2560_TX_CIPHER_TKIP)
908 			desc->eiv = swap32(desc->eiv);
909 
910 		/* mark the frame ready for transmission */
911 		desc->flags |= htole32(RT2560_TX_BUSY | RT2560_TX_VALID);
912 
913 		bus_dmamap_sync(sc->sc_dmat, sc->txq.map,
914 		    sc->txq.next_encrypt * RT2560_TX_DESC_SIZE,
915 		    RT2560_TX_DESC_SIZE, BUS_DMASYNC_PREWRITE);
916 
917 		DPRINTFN(15, ("encryption done idx=%u\n",
918 		    sc->txq.next_encrypt));
919 
920 		sc->txq.next_encrypt =
921 		    (sc->txq.next_encrypt + 1) % RT2560_TX_RING_COUNT;
922 	}
923 
924 	/* kick Tx */
925 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_TX);
926 }
927 
928 void
929 rt2560_tx_intr(struct rt2560_softc *sc)
930 {
931 	struct ieee80211com *ic = &sc->sc_ic;
932 	struct ifnet *ifp = &ic->ic_if;
933 
934 	for (;;) {
935 		struct rt2560_tx_desc *desc = &sc->txq.desc[sc->txq.next];
936 		struct rt2560_tx_data *data = &sc->txq.data[sc->txq.next];
937 		struct rt2560_node *rn;
938 
939 		bus_dmamap_sync(sc->sc_dmat, sc->txq.map,
940 		    sc->txq.next * RT2560_TX_DESC_SIZE, RT2560_TX_DESC_SIZE,
941 		    BUS_DMASYNC_POSTREAD);
942 
943 		if ((letoh32(desc->flags) & RT2560_TX_BUSY) ||
944 		    (letoh32(desc->flags) & RT2560_TX_CIPHER_BUSY) ||
945 		    !(letoh32(desc->flags) & RT2560_TX_VALID))
946 			break;
947 
948 		rn = (struct rt2560_node *)data->ni;
949 
950 		switch (letoh32(desc->flags) & RT2560_TX_RESULT_MASK) {
951 		case RT2560_TX_SUCCESS:
952 			DPRINTFN(10, ("data frame sent successfully\n"));
953 			rn->amn.amn_txcnt++;
954 			ifp->if_opackets++;
955 			break;
956 
957 		case RT2560_TX_SUCCESS_RETRY:
958 			DPRINTFN(9, ("data frame sent after %u retries\n",
959 			    (letoh32(desc->flags) >> 5) & 0x7));
960 			rn->amn.amn_txcnt++;
961 			rn->amn.amn_retrycnt++;
962 			ifp->if_opackets++;
963 			break;
964 
965 		case RT2560_TX_FAIL_RETRY:
966 			DPRINTFN(9, ("sending data frame failed (too much "
967 			    "retries)\n"));
968 			rn->amn.amn_txcnt++;
969 			rn->amn.amn_retrycnt++;
970 			ifp->if_oerrors++;
971 			break;
972 
973 		case RT2560_TX_FAIL_INVALID:
974 		case RT2560_TX_FAIL_OTHER:
975 		default:
976 			printf("%s: sending data frame failed 0x%08x\n",
977 			    sc->sc_dev.dv_xname, letoh32(desc->flags));
978 			ifp->if_oerrors++;
979 		}
980 
981 		bus_dmamap_sync(sc->sc_dmat, data->map, 0,
982 		    data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
983 		bus_dmamap_unload(sc->sc_dmat, data->map);
984 		m_freem(data->m);
985 		data->m = NULL;
986 		ieee80211_release_node(ic, data->ni);
987 		data->ni = NULL;
988 
989 		/* descriptor is no longer valid */
990 		desc->flags &= ~htole32(RT2560_TX_VALID);
991 
992 		bus_dmamap_sync(sc->sc_dmat, sc->txq.map,
993 		    sc->txq.next * RT2560_TX_DESC_SIZE, RT2560_TX_DESC_SIZE,
994 		    BUS_DMASYNC_PREWRITE);
995 
996 		DPRINTFN(15, ("tx done idx=%u\n", sc->txq.next));
997 
998 		sc->txq.queued--;
999 		sc->txq.next = (sc->txq.next + 1) % RT2560_TX_RING_COUNT;
1000 	}
1001 
1002 	sc->sc_tx_timer = 0;
1003 	ifp->if_flags &= ~IFF_OACTIVE;
1004 	rt2560_start(ifp);
1005 }
1006 
1007 void
1008 rt2560_prio_intr(struct rt2560_softc *sc)
1009 {
1010 	struct ieee80211com *ic = &sc->sc_ic;
1011 	struct ifnet *ifp = &ic->ic_if;
1012 
1013 	for (;;) {
1014 		struct rt2560_tx_desc *desc = &sc->prioq.desc[sc->prioq.next];
1015 		struct rt2560_tx_data *data = &sc->prioq.data[sc->prioq.next];
1016 
1017 		bus_dmamap_sync(sc->sc_dmat, sc->prioq.map,
1018 		    sc->prioq.next * RT2560_TX_DESC_SIZE, RT2560_TX_DESC_SIZE,
1019 		    BUS_DMASYNC_POSTREAD);
1020 
1021 		if ((letoh32(desc->flags) & RT2560_TX_BUSY) ||
1022 		    !(letoh32(desc->flags) & RT2560_TX_VALID))
1023 			break;
1024 
1025 		switch (letoh32(desc->flags) & RT2560_TX_RESULT_MASK) {
1026 		case RT2560_TX_SUCCESS:
1027 			DPRINTFN(10, ("mgt frame sent successfully\n"));
1028 			break;
1029 
1030 		case RT2560_TX_SUCCESS_RETRY:
1031 			DPRINTFN(9, ("mgt frame sent after %u retries\n",
1032 			    (letoh32(desc->flags) >> 5) & 0x7));
1033 			break;
1034 
1035 		case RT2560_TX_FAIL_RETRY:
1036 			DPRINTFN(9, ("sending mgt frame failed (too much "
1037 			    "retries)\n"));
1038 			break;
1039 
1040 		case RT2560_TX_FAIL_INVALID:
1041 		case RT2560_TX_FAIL_OTHER:
1042 		default:
1043 			printf("%s: sending mgt frame failed 0x%08x\n",
1044 			    sc->sc_dev.dv_xname, letoh32(desc->flags));
1045 		}
1046 
1047 		bus_dmamap_sync(sc->sc_dmat, data->map, 0,
1048 		    data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
1049 		bus_dmamap_unload(sc->sc_dmat, data->map);
1050 		m_freem(data->m);
1051 		data->m = NULL;
1052 		ieee80211_release_node(ic, data->ni);
1053 		data->ni = NULL;
1054 
1055 		/* descriptor is no longer valid */
1056 		desc->flags &= ~htole32(RT2560_TX_VALID);
1057 
1058 		bus_dmamap_sync(sc->sc_dmat, sc->prioq.map,
1059 		    sc->prioq.next * RT2560_TX_DESC_SIZE, RT2560_TX_DESC_SIZE,
1060 		    BUS_DMASYNC_PREWRITE);
1061 
1062 		DPRINTFN(15, ("prio done idx=%u\n", sc->prioq.next));
1063 
1064 		sc->prioq.queued--;
1065 		sc->prioq.next = (sc->prioq.next + 1) % RT2560_PRIO_RING_COUNT;
1066 	}
1067 
1068 	sc->sc_tx_timer = 0;
1069 	ifp->if_flags &= ~IFF_OACTIVE;
1070 	rt2560_start(ifp);
1071 }
1072 
1073 /*
1074  * Some frames were processed by the hardware cipher engine and are ready for
1075  * transmission to the IEEE802.11 layer.
1076  */
1077 void
1078 rt2560_decryption_intr(struct rt2560_softc *sc)
1079 {
1080 	struct ieee80211com *ic = &sc->sc_ic;
1081 	struct ifnet *ifp = &ic->ic_if;
1082 	struct ieee80211_frame *wh;
1083 	struct ieee80211_rxinfo rxi;
1084 	struct ieee80211_node *ni;
1085 	struct mbuf *mnew, *m;
1086 	int hw, error;
1087 
1088 	/* retrieve last decriptor index processed by cipher engine */
1089 	hw = (RAL_READ(sc, RT2560_SECCSR0) - sc->rxq.physaddr) /
1090 	    RT2560_RX_DESC_SIZE;
1091 
1092 	for (; sc->rxq.cur_decrypt != hw;) {
1093 		struct rt2560_rx_desc *desc =
1094 		    &sc->rxq.desc[sc->rxq.cur_decrypt];
1095 		struct rt2560_rx_data *data =
1096 		    &sc->rxq.data[sc->rxq.cur_decrypt];
1097 
1098 		bus_dmamap_sync(sc->sc_dmat, sc->rxq.map,
1099 		    sc->rxq.cur_decrypt * RT2560_TX_DESC_SIZE,
1100 		    RT2560_TX_DESC_SIZE, BUS_DMASYNC_POSTREAD);
1101 
1102 		if (letoh32(desc->flags) &
1103 		    (RT2560_RX_BUSY | RT2560_RX_CIPHER_BUSY))
1104 			break;
1105 
1106 		if (data->drop) {
1107 			ifp->if_ierrors++;
1108 			goto skip;
1109 		}
1110 
1111 		if ((letoh32(desc->flags) & RT2560_RX_CIPHER_MASK) != 0 &&
1112 		    (letoh32(desc->flags) & RT2560_RX_ICV_ERROR)) {
1113 			ifp->if_ierrors++;
1114 			goto skip;
1115 		}
1116 
1117 		/*
1118 		 * Try to allocate a new mbuf for this ring element and load it
1119 		 * before processing the current mbuf.  If the ring element
1120 		 * cannot be loaded, drop the received packet and reuse the old
1121 		 * mbuf.  In the unlikely case that the old mbuf can't be
1122 		 * reloaded either, explicitly panic.
1123 		 */
1124 		MGETHDR(mnew, M_DONTWAIT, MT_DATA);
1125 		if (mnew == NULL) {
1126 			ifp->if_ierrors++;
1127 			goto skip;
1128 		}
1129 		MCLGET(mnew, M_DONTWAIT);
1130 		if (!(mnew->m_flags & M_EXT)) {
1131 			m_freem(mnew);
1132 			ifp->if_ierrors++;
1133 			goto skip;
1134 		}
1135 
1136 		bus_dmamap_sync(sc->sc_dmat, data->map, 0,
1137 		    data->map->dm_mapsize, BUS_DMASYNC_POSTREAD);
1138 		bus_dmamap_unload(sc->sc_dmat, data->map);
1139 
1140 		error = bus_dmamap_load(sc->sc_dmat, data->map,
1141 		    mtod(mnew, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
1142 		if (error != 0) {
1143 			m_freem(mnew);
1144 
1145 			/* try to reload the old mbuf */
1146 			error = bus_dmamap_load(sc->sc_dmat, data->map,
1147 			    mtod(data->m, void *), MCLBYTES, NULL,
1148 			    BUS_DMA_NOWAIT);
1149 			if (error != 0) {
1150 				/* very unlikely that it will fail... */
1151 				panic("%s: could not load old rx mbuf",
1152 				    sc->sc_dev.dv_xname);
1153 			}
1154 			/* physical address may have changed */
1155 			desc->physaddr = htole32(data->map->dm_segs->ds_addr);
1156 			ifp->if_ierrors++;
1157 			goto skip;
1158 		}
1159 
1160 		/*
1161 		 * New mbuf successfully loaded, update Rx ring and continue
1162 		 * processing.
1163 		 */
1164 		m = data->m;
1165 		data->m = mnew;
1166 		desc->physaddr = htole32(data->map->dm_segs->ds_addr);
1167 
1168 		/* finalize mbuf */
1169 		m->m_pkthdr.rcvif = ifp;
1170 		m->m_pkthdr.len = m->m_len =
1171 		    (letoh32(desc->flags) >> 16) & 0xfff;
1172 
1173 #if NBPFILTER > 0
1174 		if (sc->sc_drvbpf != NULL) {
1175 			struct mbuf mb;
1176 			struct rt2560_rx_radiotap_header *tap = &sc->sc_rxtap;
1177 			uint32_t tsf_lo, tsf_hi;
1178 
1179 			/* get timestamp (low and high 32 bits) */
1180 			tsf_hi = RAL_READ(sc, RT2560_CSR17);
1181 			tsf_lo = RAL_READ(sc, RT2560_CSR16);
1182 
1183 			tap->wr_tsf =
1184 			    htole64(((uint64_t)tsf_hi << 32) | tsf_lo);
1185 			tap->wr_flags = 0;
1186 			tap->wr_rate = rt2560_rxrate(desc);
1187 			tap->wr_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
1188 			tap->wr_chan_flags =
1189 			    htole16(ic->ic_ibss_chan->ic_flags);
1190 			tap->wr_antenna = sc->rx_ant;
1191 			tap->wr_antsignal = desc->rssi;
1192 
1193 			mb.m_data = (caddr_t)tap;
1194 			mb.m_len = sc->sc_txtap_len;
1195 			mb.m_next = m;
1196 			mb.m_nextpkt = NULL;
1197 			mb.m_type = 0;
1198 			mb.m_flags = 0;
1199 			bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
1200 		}
1201 #endif
1202 		wh = mtod(m, struct ieee80211_frame *);
1203 		ni = ieee80211_find_rxnode(ic, wh);
1204 
1205 		/* send the frame to the 802.11 layer */
1206 		rxi.rxi_flags = 0;
1207 		rxi.rxi_rssi = desc->rssi;
1208 		rxi.rxi_tstamp = 0;	/* unused */
1209 		ieee80211_input(ifp, m, ni, &rxi);
1210 
1211 		/* node is no longer needed */
1212 		ieee80211_release_node(ic, ni);
1213 
1214 skip:		desc->flags = htole32(RT2560_RX_BUSY);
1215 
1216 		bus_dmamap_sync(sc->sc_dmat, sc->rxq.map,
1217 		    sc->rxq.cur_decrypt * RT2560_TX_DESC_SIZE,
1218 		    RT2560_TX_DESC_SIZE, BUS_DMASYNC_PREWRITE);
1219 
1220 		DPRINTFN(15, ("decryption done idx=%u\n", sc->rxq.cur_decrypt));
1221 
1222 		sc->rxq.cur_decrypt =
1223 		    (sc->rxq.cur_decrypt + 1) % RT2560_RX_RING_COUNT;
1224 	}
1225 }
1226 
1227 /*
1228  * Some frames were received. Pass them to the hardware cipher engine before
1229  * sending them to the 802.11 layer.
1230  */
1231 void
1232 rt2560_rx_intr(struct rt2560_softc *sc)
1233 {
1234 	for (;;) {
1235 		struct rt2560_rx_desc *desc = &sc->rxq.desc[sc->rxq.cur];
1236 		struct rt2560_rx_data *data = &sc->rxq.data[sc->rxq.cur];
1237 
1238 		bus_dmamap_sync(sc->sc_dmat, sc->rxq.map,
1239 		    sc->rxq.cur * RT2560_RX_DESC_SIZE, RT2560_RX_DESC_SIZE,
1240 		    BUS_DMASYNC_POSTREAD);
1241 
1242 		if (letoh32(desc->flags) &
1243 		    (RT2560_RX_BUSY | RT2560_RX_CIPHER_BUSY))
1244 			break;
1245 
1246 		data->drop = 0;
1247 
1248 		if (letoh32(desc->flags) &
1249 		    (RT2560_RX_PHY_ERROR | RT2560_RX_CRC_ERROR)) {
1250 			/*
1251 			 * This should not happen since we did not request
1252 			 * to receive those frames when we filled RXCSR0.
1253 			 */
1254 			DPRINTFN(5, ("PHY or CRC error flags 0x%08x\n",
1255 			    letoh32(desc->flags)));
1256 			data->drop = 1;
1257 		}
1258 
1259 		if (((letoh32(desc->flags) >> 16) & 0xfff) > MCLBYTES) {
1260 			DPRINTFN(5, ("bad length\n"));
1261 			data->drop = 1;
1262 		}
1263 
1264 		/* mark the frame for decryption */
1265 		desc->flags |= htole32(RT2560_RX_CIPHER_BUSY);
1266 
1267 		bus_dmamap_sync(sc->sc_dmat, sc->rxq.map,
1268 		    sc->rxq.cur * RT2560_RX_DESC_SIZE, RT2560_RX_DESC_SIZE,
1269 		    BUS_DMASYNC_PREWRITE);
1270 
1271 		DPRINTFN(15, ("rx done idx=%u\n", sc->rxq.cur));
1272 
1273 		sc->rxq.cur = (sc->rxq.cur + 1) % RT2560_RX_RING_COUNT;
1274 	}
1275 
1276 	/* kick decrypt */
1277 	RAL_WRITE(sc, RT2560_SECCSR0, RT2560_KICK_DECRYPT);
1278 }
1279 
1280 #ifndef IEEE80211_STA_ONLY
1281 /*
1282  * This function is called in HostAP or IBSS modes when it's time to send a
1283  * new beacon (every ni_intval milliseconds).
1284  */
1285 void
1286 rt2560_beacon_expire(struct rt2560_softc *sc)
1287 {
1288 	struct ieee80211com *ic = &sc->sc_ic;
1289 	struct rt2560_tx_data *data;
1290 
1291 	if (ic->ic_opmode != IEEE80211_M_IBSS &&
1292 	    ic->ic_opmode != IEEE80211_M_HOSTAP)
1293 		return;
1294 
1295 	data = &sc->bcnq.data[sc->bcnq.next];
1296 
1297 	if (sc->sc_flags & RT2560_UPDATE_SLOT) {
1298 		sc->sc_flags &= ~RT2560_UPDATE_SLOT;
1299 		sc->sc_flags |= RT2560_SET_SLOTTIME;
1300 	} else if (sc->sc_flags & RT2560_SET_SLOTTIME) {
1301 		sc->sc_flags &= ~RT2560_SET_SLOTTIME;
1302 		rt2560_set_slottime(sc);
1303 	}
1304 
1305 	if (ic->ic_curmode == IEEE80211_MODE_11G) {
1306 		/* update ERP Information Element */
1307 		*sc->erp = ic->ic_bss->ni_erp;
1308 		bus_dmamap_sync(sc->sc_dmat, data->map, 0,
1309 		    data->map->dm_mapsize, BUS_DMASYNC_PREWRITE);
1310 	}
1311 
1312 #if defined(RT2560_DEBUG) && NBPFILTER > 0
1313 	if (ic->ic_rawbpf != NULL)
1314 		bpf_mtap(ic->ic_rawbpf, data->m, BPF_DIRECTION_OUT);
1315 #endif
1316 
1317 	DPRINTFN(15, ("beacon expired\n"));
1318 }
1319 #endif
1320 
1321 void
1322 rt2560_wakeup_expire(struct rt2560_softc *sc)
1323 {
1324 	DPRINTFN(15, ("wakeup expired\n"));
1325 }
1326 
1327 int
1328 rt2560_intr(void *arg)
1329 {
1330 	struct rt2560_softc *sc = arg;
1331 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1332 	uint32_t r;
1333 
1334 	if ((r = RAL_READ(sc, RT2560_CSR7)) == 0)
1335 		return 0;	/* not for us */
1336 
1337 	/* disable interrupts */
1338 	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
1339 
1340 	/* acknowledge interrupts */
1341 	RAL_WRITE(sc, RT2560_CSR7, r);
1342 
1343 	/* don't re-enable interrupts if we're shutting down */
1344 	if (!(ifp->if_flags & IFF_RUNNING))
1345 		return 0;
1346 
1347 #ifndef IEEE80211_STA_ONLY
1348 	if (r & RT2560_BEACON_EXPIRE)
1349 		rt2560_beacon_expire(sc);
1350 #endif
1351 
1352 	if (r & RT2560_WAKEUP_EXPIRE)
1353 		rt2560_wakeup_expire(sc);
1354 
1355 	if (r & RT2560_ENCRYPTION_DONE)
1356 		rt2560_encryption_intr(sc);
1357 
1358 	if (r & RT2560_TX_DONE)
1359 		rt2560_tx_intr(sc);
1360 
1361 	if (r & RT2560_PRIO_DONE)
1362 		rt2560_prio_intr(sc);
1363 
1364 	if (r & RT2560_DECRYPTION_DONE)
1365 		rt2560_decryption_intr(sc);
1366 
1367 	if (r & RT2560_RX_DONE)
1368 		rt2560_rx_intr(sc);
1369 
1370 	/* re-enable interrupts */
1371 	RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
1372 
1373 	return 1;
1374 }
1375 
1376 /* quickly determine if a given rate is CCK or OFDM */
1377 #define RAL_RATE_IS_OFDM(rate) ((rate) >= 12 && (rate) != 22)
1378 
1379 #define RAL_ACK_SIZE	14	/* 10 + 4(FCS) */
1380 #define RAL_CTS_SIZE	14	/* 10 + 4(FCS) */
1381 
1382 #define RAL_SIFS		10	/* us */
1383 
1384 #define RT2560_RXTX_TURNAROUND	10	/* us */
1385 
1386 /*
1387  * This function is only used by the Rx radiotap code. It returns the rate at
1388  * which a given frame was received.
1389  */
1390 #if NBPFILTER > 0
1391 uint8_t
1392 rt2560_rxrate(const struct rt2560_rx_desc *desc)
1393 {
1394 	if (letoh32(desc->flags) & RT2560_RX_OFDM) {
1395 		/* reverse function of rt2560_plcp_signal */
1396 		switch (desc->rate) {
1397 		case 0xb:	return 12;
1398 		case 0xf:	return 18;
1399 		case 0xa:	return 24;
1400 		case 0xe:	return 36;
1401 		case 0x9:	return 48;
1402 		case 0xd:	return 72;
1403 		case 0x8:	return 96;
1404 		case 0xc:	return 108;
1405 		}
1406 	} else {
1407 		if (desc->rate == 10)
1408 			return 2;
1409 		if (desc->rate == 20)
1410 			return 4;
1411 		if (desc->rate == 55)
1412 			return 11;
1413 		if (desc->rate == 110)
1414 			return 22;
1415 	}
1416 	return 2;	/* should not get there */
1417 }
1418 #endif
1419 
1420 /*
1421  * Return the expected ack rate for a frame transmitted at rate `rate'.
1422  */
1423 int
1424 rt2560_ack_rate(struct ieee80211com *ic, int rate)
1425 {
1426 	switch (rate) {
1427 	/* CCK rates */
1428 	case 2:
1429 		return 2;
1430 	case 4:
1431 	case 11:
1432 	case 22:
1433 		return (ic->ic_curmode == IEEE80211_MODE_11B) ? 4 : rate;
1434 
1435 	/* OFDM rates */
1436 	case 12:
1437 	case 18:
1438 		return 12;
1439 	case 24:
1440 	case 36:
1441 		return 24;
1442 	case 48:
1443 	case 72:
1444 	case 96:
1445 	case 108:
1446 		return 48;
1447 	}
1448 
1449 	/* default to 1Mbps */
1450 	return 2;
1451 }
1452 
1453 /*
1454  * Compute the duration (in us) needed to transmit `len' bytes at rate `rate'.
1455  * The function automatically determines the operating mode depending on the
1456  * given rate. `flags' indicates whether short preamble is in use or not.
1457  */
1458 uint16_t
1459 rt2560_txtime(int len, int rate, uint32_t flags)
1460 {
1461 	uint16_t txtime;
1462 
1463 	if (RAL_RATE_IS_OFDM(rate)) {
1464 		/* IEEE Std 802.11g-2003, pp. 44 */
1465 		txtime = (8 + 4 * len + 3 + rate - 1) / rate;
1466 		txtime = 16 + 4 + 4 * txtime + 6;
1467 	} else {
1468 		/* IEEE Std 802.11b-1999, pp. 28 */
1469 		txtime = (16 * len + rate - 1) / rate;
1470 		if (rate != 2 && (flags & IEEE80211_F_SHPREAMBLE))
1471 			txtime +=  72 + 24;
1472 		else
1473 			txtime += 144 + 48;
1474 	}
1475 	return txtime;
1476 }
1477 
1478 uint8_t
1479 rt2560_plcp_signal(int rate)
1480 {
1481 	switch (rate) {
1482 	/* CCK rates (returned values are device-dependent) */
1483 	case 2:		return 0x0;
1484 	case 4:		return 0x1;
1485 	case 11:	return 0x2;
1486 	case 22:	return 0x3;
1487 
1488 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1489 	case 12:	return 0xb;
1490 	case 18:	return 0xf;
1491 	case 24:	return 0xa;
1492 	case 36:	return 0xe;
1493 	case 48:	return 0x9;
1494 	case 72:	return 0xd;
1495 	case 96:	return 0x8;
1496 	case 108:	return 0xc;
1497 
1498 	/* unsupported rates (should not get there) */
1499 	default:	return 0xff;
1500 	}
1501 }
1502 
1503 void
1504 rt2560_setup_tx_desc(struct rt2560_softc *sc, struct rt2560_tx_desc *desc,
1505     uint32_t flags, int len, int rate, int encrypt, bus_addr_t physaddr)
1506 {
1507 	struct ieee80211com *ic = &sc->sc_ic;
1508 	uint16_t plcp_length;
1509 	int remainder;
1510 
1511 	desc->flags = htole32(flags);
1512 	desc->flags |= htole32(len << 16);
1513 	desc->flags |= encrypt ? htole32(RT2560_TX_CIPHER_BUSY) :
1514 	    htole32(RT2560_TX_BUSY | RT2560_TX_VALID);
1515 
1516 	desc->physaddr = htole32(physaddr);
1517 	desc->wme = htole16(
1518 	    RT2560_AIFSN(2) |
1519 	    RT2560_LOGCWMIN(3) |
1520 	    RT2560_LOGCWMAX(8));
1521 
1522 	/* setup PLCP fields */
1523 	desc->plcp_signal  = rt2560_plcp_signal(rate);
1524 	desc->plcp_service = 4;
1525 
1526 	len += IEEE80211_CRC_LEN;
1527 	if (RAL_RATE_IS_OFDM(rate)) {
1528 		desc->flags |= htole32(RT2560_TX_OFDM);
1529 
1530 		plcp_length = len & 0xfff;
1531 		desc->plcp_length_hi = plcp_length >> 6;
1532 		desc->plcp_length_lo = plcp_length & 0x3f;
1533 	} else {
1534 		plcp_length = (16 * len + rate - 1) / rate;
1535 		if (rate == 22) {
1536 			remainder = (16 * len) % 22;
1537 			if (remainder != 0 && remainder < 7)
1538 				desc->plcp_service |= RT2560_PLCP_LENGEXT;
1539 		}
1540 		desc->plcp_length_hi = plcp_length >> 8;
1541 		desc->plcp_length_lo = plcp_length & 0xff;
1542 
1543 		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1544 			desc->plcp_signal |= 0x08;
1545 	}
1546 }
1547 
1548 #ifndef IEEE80211_STA_ONLY
1549 int
1550 rt2560_tx_bcn(struct rt2560_softc *sc, struct mbuf *m0,
1551     struct ieee80211_node *ni)
1552 {
1553 	struct ieee80211com *ic = &sc->sc_ic;
1554 	struct rt2560_tx_desc *desc;
1555 	struct rt2560_tx_data *data;
1556 	int rate = 2, error;
1557 
1558 	desc = &sc->bcnq.desc[sc->bcnq.cur];
1559 	data = &sc->bcnq.data[sc->bcnq.cur];
1560 
1561 	error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
1562 	    BUS_DMA_NOWAIT);
1563 	if (error != 0) {
1564 		printf("%s: can't map mbuf (error %d)\n",
1565 		    sc->sc_dev.dv_xname, error);
1566 		m_freem(m0);
1567 		return error;
1568 	}
1569 
1570 	data->m = m0;
1571 	data->ni = ni;
1572 
1573 	rt2560_setup_tx_desc(sc, desc, RT2560_TX_IFS_NEWBACKOFF |
1574 	    RT2560_TX_TIMESTAMP, m0->m_pkthdr.len, rate, 0,
1575 	    data->map->dm_segs->ds_addr);
1576 
1577 	bus_dmamap_sync(sc->sc_dmat, data->map, 0, data->map->dm_mapsize,
1578 	    BUS_DMASYNC_PREWRITE);
1579 	bus_dmamap_sync(sc->sc_dmat, sc->bcnq.map,
1580 	    sc->bcnq.cur * RT2560_TX_DESC_SIZE, RT2560_TX_DESC_SIZE,
1581 	    BUS_DMASYNC_PREWRITE);
1582 
1583 	/*
1584 	 * Store pointer to ERP Information Element so that we can update it
1585 	 * dynamically when the slot time changes.
1586 	 * XXX: this is ugly since it depends on how net80211 builds beacon
1587 	 * frames but ieee80211_beacon_alloc() don't store offsets for us.
1588 	 */
1589 	if (ic->ic_curmode == IEEE80211_MODE_11G) {
1590 		sc->erp =
1591 		    mtod(m0, uint8_t *) +
1592 		    sizeof (struct ieee80211_frame) +
1593 		    8 + 2 + 2 +
1594 		    ((ic->ic_flags & IEEE80211_F_HIDENWID) ?
1595 			1 : 2 + ni->ni_esslen) +
1596 		    2 + min(ni->ni_rates.rs_nrates, IEEE80211_RATE_SIZE) +
1597 		    2 + 1 +
1598 		    ((ic->ic_opmode == IEEE80211_M_IBSS) ? 4 : 6) +
1599 		    2;
1600 	}
1601 
1602 	return 0;
1603 }
1604 #endif
1605 
1606 int
1607 rt2560_tx_mgt(struct rt2560_softc *sc, struct mbuf *m0,
1608     struct ieee80211_node *ni)
1609 {
1610 	struct ieee80211com *ic = &sc->sc_ic;
1611 	struct rt2560_tx_desc *desc;
1612 	struct rt2560_tx_data *data;
1613 	struct ieee80211_frame *wh;
1614 	uint16_t dur;
1615 	uint32_t flags = 0;
1616 	int rate = 2, error;
1617 
1618 	desc = &sc->prioq.desc[sc->prioq.cur];
1619 	data = &sc->prioq.data[sc->prioq.cur];
1620 
1621 	error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
1622 	    BUS_DMA_NOWAIT);
1623 	if (error != 0) {
1624 		printf("%s: can't map mbuf (error %d)\n",
1625 		    sc->sc_dev.dv_xname, error);
1626 		m_freem(m0);
1627 		return error;
1628 	}
1629 
1630 #if NBPFILTER > 0
1631 	if (sc->sc_drvbpf != NULL) {
1632 		struct mbuf mb;
1633 		struct rt2560_tx_radiotap_header *tap = &sc->sc_txtap;
1634 
1635 		tap->wt_flags = 0;
1636 		tap->wt_rate = rate;
1637 		tap->wt_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
1638 		tap->wt_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
1639 		tap->wt_antenna = sc->tx_ant;
1640 
1641 		mb.m_data = (caddr_t)tap;
1642 		mb.m_len = sc->sc_txtap_len;
1643 		mb.m_next = m0;
1644 		mb.m_nextpkt = NULL;
1645 		mb.m_type = 0;
1646 		mb.m_flags = 0;
1647 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
1648 	}
1649 #endif
1650 
1651 	data->m = m0;
1652 	data->ni = ni;
1653 
1654 	wh = mtod(m0, struct ieee80211_frame *);
1655 
1656 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1657 		flags |= RT2560_TX_NEED_ACK;
1658 
1659 		dur = rt2560_txtime(RAL_ACK_SIZE, rate, ic->ic_flags) +
1660 		    RAL_SIFS;
1661 		*(uint16_t *)wh->i_dur = htole16(dur);
1662 
1663 #ifndef IEEE80211_STA_ONLY
1664 		/* tell hardware to set timestamp for probe responses */
1665 		if ((wh->i_fc[0] &
1666 		    (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
1667 		    (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
1668 			flags |= RT2560_TX_TIMESTAMP;
1669 #endif
1670 	}
1671 
1672 	rt2560_setup_tx_desc(sc, desc, flags, m0->m_pkthdr.len, rate, 0,
1673 	    data->map->dm_segs->ds_addr);
1674 
1675 	bus_dmamap_sync(sc->sc_dmat, data->map, 0, data->map->dm_mapsize,
1676 	    BUS_DMASYNC_PREWRITE);
1677 	bus_dmamap_sync(sc->sc_dmat, sc->prioq.map,
1678 	    sc->prioq.cur * RT2560_TX_DESC_SIZE, RT2560_TX_DESC_SIZE,
1679 	    BUS_DMASYNC_PREWRITE);
1680 
1681 	DPRINTFN(10, ("sending mgt frame len=%u idx=%u rate=%u\n",
1682 	    m0->m_pkthdr.len, sc->prioq.cur, rate));
1683 
1684 	/* kick prio */
1685 	sc->prioq.queued++;
1686 	sc->prioq.cur = (sc->prioq.cur + 1) % RT2560_PRIO_RING_COUNT;
1687 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_PRIO);
1688 
1689 	return 0;
1690 }
1691 
1692 int
1693 rt2560_tx_data(struct rt2560_softc *sc, struct mbuf *m0,
1694     struct ieee80211_node *ni)
1695 {
1696 	struct ieee80211com *ic = &sc->sc_ic;
1697 	struct rt2560_tx_ring *txq = &sc->txq;
1698 	struct rt2560_tx_desc *desc;
1699 	struct rt2560_tx_data *data;
1700 	struct ieee80211_frame *wh;
1701 	struct ieee80211_key *k;
1702 	struct mbuf *m1;
1703 	uint16_t dur;
1704 	uint32_t flags = 0;
1705 	int pktlen, rate, needcts = 0, needrts = 0, error;
1706 
1707 	wh = mtod(m0, struct ieee80211_frame *);
1708 
1709 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1710 		k = ieee80211_get_txkey(ic, wh, ni);
1711 
1712 		if ((m0 = ieee80211_encrypt(ic, m0, k)) == NULL)
1713 			return ENOBUFS;
1714 
1715 		/* packet header may have moved, reset our local pointer */
1716 		wh = mtod(m0, struct ieee80211_frame *);
1717 	}
1718 
1719 	/* compute actual packet length (including CRC and crypto overhead) */
1720 	pktlen = m0->m_pkthdr.len + IEEE80211_CRC_LEN;
1721 
1722 	/* pickup a rate */
1723 	if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
1724 	    ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1725 	     IEEE80211_FC0_TYPE_MGT)) {
1726 		/* mgmt/multicast frames are sent at the lowest avail. rate */
1727 		rate = ni->ni_rates.rs_rates[0];
1728 	} else if (ic->ic_fixed_rate != -1) {
1729 		rate = ic->ic_sup_rates[ic->ic_curmode].
1730 		    rs_rates[ic->ic_fixed_rate];
1731 	} else
1732 		rate = ni->ni_rates.rs_rates[ni->ni_txrate];
1733 	if (rate == 0)
1734 		rate = 2;	/* XXX should not happen */
1735 	rate &= IEEE80211_RATE_VAL;
1736 
1737 	/*
1738 	 * Packet Bursting: backoff after ppb=8 frames to give other STAs a
1739 	 * chance to contend for the wireless medium.
1740 	 */
1741 	if (ic->ic_opmode == IEEE80211_M_STA && (ni->ni_txseq & 7))
1742 		flags |= RT2560_TX_IFS_SIFS;
1743 
1744 	/* check if RTS/CTS or CTS-to-self protection must be used */
1745 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1746 		/* multicast frames are not sent at OFDM rates in 802.11b/g */
1747 		if (pktlen > ic->ic_rtsthreshold) {
1748 			needrts = 1;	/* RTS/CTS based on frame length */
1749 		} else if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
1750 		    RAL_RATE_IS_OFDM(rate)) {
1751 			if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
1752 				needcts = 1;	/* CTS-to-self */
1753 			else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
1754 				needrts = 1;	/* RTS/CTS */
1755 		}
1756 	}
1757 	if (needrts || needcts) {
1758 		struct mbuf *mprot;
1759 		int protrate, ackrate;
1760 
1761 		protrate = 2;	/* XXX */
1762 		ackrate  = rt2560_ack_rate(ic, rate);
1763 
1764 		dur = rt2560_txtime(pktlen, rate, ic->ic_flags) +
1765 		      rt2560_txtime(RAL_ACK_SIZE, ackrate, ic->ic_flags) +
1766 		      2 * RAL_SIFS;
1767 		if (needrts) {
1768 			dur += rt2560_txtime(RAL_CTS_SIZE, rt2560_ack_rate(ic,
1769 			    protrate), ic->ic_flags) + RAL_SIFS;
1770 			mprot = ieee80211_get_rts(ic, wh, dur);
1771 		} else {
1772 			mprot = ieee80211_get_cts_to_self(ic, dur);
1773 		}
1774 		if (mprot == NULL) {
1775 			printf("%s: could not allocate protection frame\n",
1776 			    sc->sc_dev.dv_xname);
1777 			m_freem(m0);
1778 			return ENOBUFS;
1779 		}
1780 
1781 		desc = &txq->desc[txq->cur_encrypt];
1782 		data = &txq->data[txq->cur_encrypt];
1783 
1784 		error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, mprot,
1785 		    BUS_DMA_NOWAIT);
1786 		if (error != 0) {
1787 			printf("%s: can't map mbuf (error %d)\n",
1788 			    sc->sc_dev.dv_xname, error);
1789 			m_freem(mprot);
1790 			m_freem(m0);
1791 			return error;
1792 		}
1793 
1794 		data->m = mprot;
1795 		/* avoid multiple free() of the same node for each fragment */
1796 		data->ni = ieee80211_ref_node(ni);
1797 
1798 		/* XXX may want to pass the protection frame to BPF */
1799 
1800 		rt2560_setup_tx_desc(sc, desc,
1801 		    (needrts ? RT2560_TX_NEED_ACK : 0) | RT2560_TX_MORE_FRAG,
1802 		    mprot->m_pkthdr.len, protrate, 1,
1803 		    data->map->dm_segs->ds_addr);
1804 
1805 		bus_dmamap_sync(sc->sc_dmat, data->map, 0,
1806 		    data->map->dm_mapsize, BUS_DMASYNC_PREWRITE);
1807 		bus_dmamap_sync(sc->sc_dmat, txq->map,
1808 		    txq->cur_encrypt * RT2560_TX_DESC_SIZE,
1809 		    RT2560_TX_DESC_SIZE, BUS_DMASYNC_PREWRITE);
1810 
1811 		txq->queued++;
1812 		if (++txq->cur_encrypt >= txq->count)
1813 			txq->cur_encrypt = 0;
1814 
1815 		flags |= RT2560_TX_LONG_RETRY | RT2560_TX_IFS_SIFS;
1816 	}
1817 
1818 	data = &txq->data[txq->cur_encrypt];
1819 	desc = &txq->desc[txq->cur_encrypt];
1820 
1821 	error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
1822 	    BUS_DMA_NOWAIT);
1823 	if (error != 0 && error != EFBIG) {
1824 		printf("%s: can't map mbuf (error %d)\n",
1825 		    sc->sc_dev.dv_xname, error);
1826 		m_freem(m0);
1827 		return error;
1828 	}
1829 	if (error != 0) {
1830 		/* too many fragments, linearize */
1831 		MGETHDR(m1, M_DONTWAIT, MT_DATA);
1832 		if (m1 == NULL) {
1833 			m_freem(m0);
1834 			return ENOBUFS;
1835 		}
1836 		if (m0->m_pkthdr.len > MHLEN) {
1837 			MCLGET(m1, M_DONTWAIT);
1838 			if (!(m1->m_flags & M_EXT)) {
1839 				m_freem(m0);
1840 				m_freem(m1);
1841 				return ENOBUFS;
1842 			}
1843 		}
1844 		m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m1, caddr_t));
1845 		m1->m_pkthdr.len = m1->m_len = m0->m_pkthdr.len;
1846 		m_freem(m0);
1847 		m0 = m1;
1848 
1849 		error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
1850 		    BUS_DMA_NOWAIT);
1851 		if (error != 0) {
1852 			printf("%s: can't map mbuf (error %d)\n",
1853 			    sc->sc_dev.dv_xname, error);
1854 			m_freem(m0);
1855 			return error;
1856 		}
1857 
1858 		/* packet header have moved, reset our local pointer */
1859 		wh = mtod(m0, struct ieee80211_frame *);
1860 	}
1861 
1862 #if NBPFILTER > 0
1863 	if (sc->sc_drvbpf != NULL) {
1864 		struct mbuf mb;
1865 		struct rt2560_tx_radiotap_header *tap = &sc->sc_txtap;
1866 
1867 		tap->wt_flags = 0;
1868 		tap->wt_rate = rate;
1869 		tap->wt_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
1870 		tap->wt_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
1871 		tap->wt_antenna = sc->tx_ant;
1872 
1873 		mb.m_data = (caddr_t)tap;
1874 		mb.m_len = sc->sc_txtap_len;
1875 		mb.m_next = m0;
1876 		mb.m_nextpkt = NULL;
1877 		mb.m_type = 0;
1878 		mb.m_flags = 0;
1879 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
1880 	}
1881 #endif
1882 
1883 	data->m = m0;
1884 	data->ni = ni;
1885 
1886 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1887 		flags |= RT2560_TX_NEED_ACK;
1888 
1889 		dur = rt2560_txtime(RAL_ACK_SIZE, rt2560_ack_rate(ic, rate),
1890 		    ic->ic_flags) + RAL_SIFS;
1891 		*(uint16_t *)wh->i_dur = htole16(dur);
1892 	}
1893 
1894 	rt2560_setup_tx_desc(sc, desc, flags, m0->m_pkthdr.len, rate, 1,
1895 	    data->map->dm_segs->ds_addr);
1896 
1897 	bus_dmamap_sync(sc->sc_dmat, data->map, 0, data->map->dm_mapsize,
1898 	    BUS_DMASYNC_PREWRITE);
1899 	bus_dmamap_sync(sc->sc_dmat, txq->map,
1900 	    txq->cur_encrypt * RT2560_TX_DESC_SIZE, RT2560_TX_DESC_SIZE,
1901 	    BUS_DMASYNC_PREWRITE);
1902 
1903 	DPRINTFN(10, ("sending frame len=%u idx=%u rate=%u\n",
1904 	    m0->m_pkthdr.len, txq->cur_encrypt, rate));
1905 
1906 	/* kick encrypt */
1907 	txq->queued++;
1908 	if (++txq->cur_encrypt >= txq->count)
1909 		txq->cur_encrypt = 0;
1910 	RAL_WRITE(sc, RT2560_SECCSR1, RT2560_KICK_ENCRYPT);
1911 
1912 	return 0;
1913 }
1914 
1915 void
1916 rt2560_start(struct ifnet *ifp)
1917 {
1918 	struct rt2560_softc *sc = ifp->if_softc;
1919 	struct ieee80211com *ic = &sc->sc_ic;
1920 	struct mbuf *m0;
1921 	struct ieee80211_node *ni;
1922 
1923 	/*
1924 	 * net80211 may still try to send management frames even if the
1925 	 * IFF_RUNNING flag is not set...
1926 	 */
1927 	if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
1928 		return;
1929 
1930 	for (;;) {
1931 		IF_POLL(&ic->ic_mgtq, m0);
1932 		if (m0 != NULL) {
1933 			if (sc->prioq.queued >= RT2560_PRIO_RING_COUNT) {
1934 				ifp->if_flags |= IFF_OACTIVE;
1935 				break;
1936 			}
1937 			IF_DEQUEUE(&ic->ic_mgtq, m0);
1938 
1939 			ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
1940 			m0->m_pkthdr.rcvif = NULL;
1941 #if NBPFILTER > 0
1942 			if (ic->ic_rawbpf != NULL)
1943 				bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
1944 #endif
1945 			if (rt2560_tx_mgt(sc, m0, ni) != 0)
1946 				break;
1947 
1948 		} else {
1949 			if (ic->ic_state != IEEE80211_S_RUN)
1950 				break;
1951 			IFQ_POLL(&ifp->if_snd, m0);
1952 			if (m0 == NULL)
1953 				break;
1954 			if (sc->txq.queued >= RT2560_TX_RING_COUNT - 1) {
1955 				ifp->if_flags |= IFF_OACTIVE;
1956 				break;
1957 			}
1958 			IFQ_DEQUEUE(&ifp->if_snd, m0);
1959 #if NBPFILTER > 0
1960 			if (ifp->if_bpf != NULL)
1961 				bpf_mtap(ifp->if_bpf, m0, BPF_DIRECTION_OUT);
1962 #endif
1963 			m0 = ieee80211_encap(ifp, m0, &ni);
1964 			if (m0 == NULL)
1965 				continue;
1966 #if NBPFILTER > 0
1967 			if (ic->ic_rawbpf != NULL)
1968 				bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
1969 #endif
1970 			if (rt2560_tx_data(sc, m0, ni) != 0) {
1971 				if (ni != NULL)
1972 					ieee80211_release_node(ic, ni);
1973 				ifp->if_oerrors++;
1974 				break;
1975 			}
1976 		}
1977 
1978 		sc->sc_tx_timer = 5;
1979 		ifp->if_timer = 1;
1980 	}
1981 }
1982 
1983 void
1984 rt2560_watchdog(struct ifnet *ifp)
1985 {
1986 	struct rt2560_softc *sc = ifp->if_softc;
1987 
1988 	ifp->if_timer = 0;
1989 
1990 	if (sc->sc_tx_timer > 0) {
1991 		if (--sc->sc_tx_timer == 0) {
1992 			printf("%s: device timeout\n", sc->sc_dev.dv_xname);
1993 			rt2560_init(ifp);
1994 			ifp->if_oerrors++;
1995 			return;
1996 		}
1997 		ifp->if_timer = 1;
1998 	}
1999 
2000 	ieee80211_watchdog(ifp);
2001 }
2002 
2003 int
2004 rt2560_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
2005 {
2006 	struct rt2560_softc *sc = ifp->if_softc;
2007 	struct ieee80211com *ic = &sc->sc_ic;
2008 	struct ifaddr *ifa;
2009 	struct ifreq *ifr;
2010 	int s, error = 0;
2011 
2012 	s = splnet();
2013 
2014 	switch (cmd) {
2015 	case SIOCSIFADDR:
2016 		ifa = (struct ifaddr *)data;
2017 		ifp->if_flags |= IFF_UP;
2018 #ifdef INET
2019 		if (ifa->ifa_addr->sa_family == AF_INET)
2020 			arp_ifinit(&ic->ic_ac, ifa);
2021 #endif
2022 		/* FALLTHROUGH */
2023 	case SIOCSIFFLAGS:
2024 		if (ifp->if_flags & IFF_UP) {
2025 			if (ifp->if_flags & IFF_RUNNING)
2026 				rt2560_update_promisc(sc);
2027 			else
2028 				rt2560_init(ifp);
2029 		} else {
2030 			if (ifp->if_flags & IFF_RUNNING)
2031 				rt2560_stop(ifp, 1);
2032 		}
2033 		break;
2034 
2035 	case SIOCADDMULTI:
2036 	case SIOCDELMULTI:
2037 		ifr = (struct ifreq *)data;
2038 		error = (cmd == SIOCADDMULTI) ?
2039 		    ether_addmulti(ifr, &ic->ic_ac) :
2040 		    ether_delmulti(ifr, &ic->ic_ac);
2041 
2042 		if (error == ENETRESET)
2043 			error = 0;
2044 		break;
2045 
2046 	case SIOCS80211CHANNEL:
2047 		/*
2048 		 * This allows for fast channel switching in monitor mode
2049 		 * (used by kismet). In IBSS mode, we must explicitly reset
2050 		 * the interface to generate a new beacon frame.
2051 		 */
2052 		error = ieee80211_ioctl(ifp, cmd, data);
2053 		if (error == ENETRESET &&
2054 		    ic->ic_opmode == IEEE80211_M_MONITOR) {
2055 			if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
2056 			    (IFF_UP | IFF_RUNNING))
2057 				rt2560_set_chan(sc, ic->ic_ibss_chan);
2058 			error = 0;
2059 		}
2060 		break;
2061 
2062 	default:
2063 		error = ieee80211_ioctl(ifp, cmd, data);
2064 	}
2065 
2066 	if (error == ENETRESET) {
2067 		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
2068 		    (IFF_UP | IFF_RUNNING))
2069 			rt2560_init(ifp);
2070 		error = 0;
2071 	}
2072 
2073 	splx(s);
2074 
2075 	return error;
2076 }
2077 
2078 void
2079 rt2560_bbp_write(struct rt2560_softc *sc, uint8_t reg, uint8_t val)
2080 {
2081 	uint32_t tmp;
2082 	int ntries;
2083 
2084 	for (ntries = 0; ntries < 100; ntries++) {
2085 		if (!(RAL_READ(sc, RT2560_BBPCSR) & RT2560_BBP_BUSY))
2086 			break;
2087 		DELAY(1);
2088 	}
2089 	if (ntries == 100) {
2090 		printf("%s: could not write to BBP\n", sc->sc_dev.dv_xname);
2091 		return;
2092 	}
2093 
2094 	tmp = RT2560_BBP_WRITE | RT2560_BBP_BUSY | reg << 8 | val;
2095 	RAL_WRITE(sc, RT2560_BBPCSR, tmp);
2096 
2097 	DPRINTFN(15, ("BBP R%u <- 0x%02x\n", reg, val));
2098 }
2099 
2100 uint8_t
2101 rt2560_bbp_read(struct rt2560_softc *sc, uint8_t reg)
2102 {
2103 	uint32_t val;
2104 	int ntries;
2105 
2106 	val = RT2560_BBP_BUSY | reg << 8;
2107 	RAL_WRITE(sc, RT2560_BBPCSR, val);
2108 
2109 	for (ntries = 0; ntries < 100; ntries++) {
2110 		val = RAL_READ(sc, RT2560_BBPCSR);
2111 		if (!(val & RT2560_BBP_BUSY))
2112 			return val & 0xff;
2113 		DELAY(1);
2114 	}
2115 
2116 	printf("%s: could not read from BBP\n", sc->sc_dev.dv_xname);
2117 	return 0;
2118 }
2119 
2120 void
2121 rt2560_rf_write(struct rt2560_softc *sc, uint8_t reg, uint32_t val)
2122 {
2123 	uint32_t tmp;
2124 	int ntries;
2125 
2126 	for (ntries = 0; ntries < 100; ntries++) {
2127 		if (!(RAL_READ(sc, RT2560_RFCSR) & RT2560_RF_BUSY))
2128 			break;
2129 		DELAY(1);
2130 	}
2131 	if (ntries == 100) {
2132 		printf("%s: could not write to RF\n", sc->sc_dev.dv_xname);
2133 		return;
2134 	}
2135 
2136 	tmp = RT2560_RF_BUSY | RT2560_RF_20BIT | (val & 0xfffff) << 2 |
2137 	    (reg & 0x3);
2138 	RAL_WRITE(sc, RT2560_RFCSR, tmp);
2139 
2140 	/* remember last written value in sc */
2141 	sc->rf_regs[reg] = val;
2142 
2143 	DPRINTFN(15, ("RF R[%u] <- 0x%05x\n", reg & 0x3, val & 0xfffff));
2144 }
2145 
2146 void
2147 rt2560_set_chan(struct rt2560_softc *sc, struct ieee80211_channel *c)
2148 {
2149 	struct ieee80211com *ic = &sc->sc_ic;
2150 	uint8_t power, tmp;
2151 	u_int chan;
2152 
2153 	chan = ieee80211_chan2ieee(ic, c);
2154 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
2155 		return;
2156 
2157 	power = min(sc->txpow[chan - 1], 31);
2158 
2159 	DPRINTFN(2, ("setting channel to %u, txpower to %u\n", chan, power));
2160 
2161 	switch (sc->rf_rev) {
2162 	case RT2560_RF_2522:
2163 		rt2560_rf_write(sc, RT2560_RF1, 0x00814);
2164 		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf2522_r2[chan - 1]);
2165 		rt2560_rf_write(sc, RT2560_RF3, power << 7 | 0x00040);
2166 		break;
2167 
2168 	case RT2560_RF_2523:
2169 		rt2560_rf_write(sc, RT2560_RF1, 0x08804);
2170 		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf2523_r2[chan - 1]);
2171 		rt2560_rf_write(sc, RT2560_RF3, power << 7 | 0x38044);
2172 		rt2560_rf_write(sc, RT2560_RF4,
2173 		    (chan == 14) ? 0x00280 : 0x00286);
2174 		break;
2175 
2176 	case RT2560_RF_2524:
2177 		rt2560_rf_write(sc, RT2560_RF1, 0x0c808);
2178 		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf2524_r2[chan - 1]);
2179 		rt2560_rf_write(sc, RT2560_RF3, power << 7 | 0x00040);
2180 		rt2560_rf_write(sc, RT2560_RF4,
2181 		    (chan == 14) ? 0x00280 : 0x00286);
2182 		break;
2183 
2184 	case RT2560_RF_2525:
2185 		rt2560_rf_write(sc, RT2560_RF1, 0x08808);
2186 		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf2525_hi_r2[chan - 1]);
2187 		rt2560_rf_write(sc, RT2560_RF3, power << 7 | 0x18044);
2188 		rt2560_rf_write(sc, RT2560_RF4,
2189 		    (chan == 14) ? 0x00280 : 0x00286);
2190 
2191 		rt2560_rf_write(sc, RT2560_RF1, 0x08808);
2192 		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf2525_r2[chan - 1]);
2193 		rt2560_rf_write(sc, RT2560_RF3, power << 7 | 0x18044);
2194 		rt2560_rf_write(sc, RT2560_RF4,
2195 		    (chan == 14) ? 0x00280 : 0x00286);
2196 		break;
2197 
2198 	case RT2560_RF_2525E:
2199 		rt2560_rf_write(sc, RT2560_RF1, 0x08808);
2200 		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf2525e_r2[chan - 1]);
2201 		rt2560_rf_write(sc, RT2560_RF3, power << 7 | 0x18044);
2202 		rt2560_rf_write(sc, RT2560_RF4,
2203 		    (chan == 14) ? 0x00286 : 0x00282);
2204 		break;
2205 
2206 	case RT2560_RF_2526:
2207 		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf2526_hi_r2[chan - 1]);
2208 		rt2560_rf_write(sc, RT2560_RF4,
2209 		   (chan & 1) ? 0x00386 : 0x00381);
2210 		rt2560_rf_write(sc, RT2560_RF1, 0x08804);
2211 
2212 		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf2526_r2[chan - 1]);
2213 		rt2560_rf_write(sc, RT2560_RF3, power << 7 | 0x18044);
2214 		rt2560_rf_write(sc, RT2560_RF4,
2215 		    (chan & 1) ? 0x00386 : 0x00381);
2216 		break;
2217 	}
2218 
2219 	if (ic->ic_opmode != IEEE80211_M_MONITOR &&
2220 	    ic->ic_state != IEEE80211_S_SCAN) {
2221 		/* set Japan filter bit for channel 14 */
2222 		tmp = rt2560_bbp_read(sc, 70);
2223 
2224 		tmp &= ~RT2560_JAPAN_FILTER;
2225 		if (chan == 14)
2226 			tmp |= RT2560_JAPAN_FILTER;
2227 
2228 		rt2560_bbp_write(sc, 70, tmp);
2229 
2230 		DELAY(1000); /* RF needs a 1ms delay here */
2231 		rt2560_disable_rf_tune(sc);
2232 
2233 		/* clear CRC errors */
2234 		RAL_READ(sc, RT2560_CNT0);
2235 	}
2236 }
2237 
2238 /*
2239  * Disable RF auto-tuning.
2240  */
2241 void
2242 rt2560_disable_rf_tune(struct rt2560_softc *sc)
2243 {
2244 	uint32_t tmp;
2245 
2246 	if (sc->rf_rev != RT2560_RF_2523) {
2247 		tmp = sc->rf_regs[RT2560_RF1] & ~RT2560_RF1_AUTOTUNE;
2248 		rt2560_rf_write(sc, RT2560_RF1, tmp);
2249 	}
2250 
2251 	tmp = sc->rf_regs[RT2560_RF3] & ~RT2560_RF3_AUTOTUNE;
2252 	rt2560_rf_write(sc, RT2560_RF3, tmp);
2253 
2254 	DPRINTFN(2, ("disabling RF autotune\n"));
2255 }
2256 
2257 /*
2258  * Refer to IEEE Std 802.11-1999 pp. 123 for more information on TSF
2259  * synchronization.
2260  */
2261 void
2262 rt2560_enable_tsf_sync(struct rt2560_softc *sc)
2263 {
2264 	struct ieee80211com *ic = &sc->sc_ic;
2265 	uint16_t logcwmin, preload;
2266 	uint32_t tmp;
2267 
2268 	/* first, disable TSF synchronization */
2269 	RAL_WRITE(sc, RT2560_CSR14, 0);
2270 
2271 	tmp = 16 * ic->ic_bss->ni_intval;
2272 	RAL_WRITE(sc, RT2560_CSR12, tmp);
2273 
2274 	RAL_WRITE(sc, RT2560_CSR13, 0);
2275 
2276 	logcwmin = 5;
2277 	preload = (ic->ic_opmode == IEEE80211_M_STA) ? 384 : 1024;
2278 	tmp = logcwmin << 16 | preload;
2279 	RAL_WRITE(sc, RT2560_BCNOCSR, tmp);
2280 
2281 	/* finally, enable TSF synchronization */
2282 	tmp = RT2560_ENABLE_TSF | RT2560_ENABLE_TBCN;
2283 	if (ic->ic_opmode == IEEE80211_M_STA)
2284 		tmp |= RT2560_ENABLE_TSF_SYNC(1);
2285 #ifndef IEEE80211_STA_ONLY
2286 	else
2287 		tmp |= RT2560_ENABLE_TSF_SYNC(2) |
2288 		       RT2560_ENABLE_BEACON_GENERATOR;
2289 #endif
2290 	RAL_WRITE(sc, RT2560_CSR14, tmp);
2291 
2292 	DPRINTF(("enabling TSF synchronization\n"));
2293 }
2294 
2295 void
2296 rt2560_update_plcp(struct rt2560_softc *sc)
2297 {
2298 	struct ieee80211com *ic = &sc->sc_ic;
2299 
2300 	/* no short preamble for 1Mbps */
2301 	RAL_WRITE(sc, RT2560_PLCP1MCSR, 0x00700400);
2302 
2303 	if (!(ic->ic_flags & IEEE80211_F_SHPREAMBLE)) {
2304 		/* values taken from the reference driver */
2305 		RAL_WRITE(sc, RT2560_PLCP2MCSR,   0x00380401);
2306 		RAL_WRITE(sc, RT2560_PLCP5p5MCSR, 0x00150402);
2307 		RAL_WRITE(sc, RT2560_PLCP11MCSR,  0x000b8403);
2308 	} else {
2309 		/* same values as above or'ed 0x8 */
2310 		RAL_WRITE(sc, RT2560_PLCP2MCSR,   0x00380409);
2311 		RAL_WRITE(sc, RT2560_PLCP5p5MCSR, 0x0015040a);
2312 		RAL_WRITE(sc, RT2560_PLCP11MCSR,  0x000b840b);
2313 	}
2314 
2315 	DPRINTF(("updating PLCP for %s preamble\n",
2316 	    (ic->ic_flags & IEEE80211_F_SHPREAMBLE) ? "short" : "long"));
2317 }
2318 
2319 void
2320 rt2560_updateslot(struct ieee80211com *ic)
2321 {
2322 	struct rt2560_softc *sc = ic->ic_if.if_softc;
2323 
2324 #ifndef IEEE80211_STA_ONLY
2325 	if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
2326 		/*
2327 		 * In HostAP mode, we defer setting of new slot time until
2328 		 * updated ERP Information Element has propagated to all
2329 		 * associated STAs.
2330 		 */
2331 		sc->sc_flags |= RT2560_UPDATE_SLOT;
2332 	} else
2333 #endif
2334 		rt2560_set_slottime(sc);
2335 }
2336 
2337 /*
2338  * IEEE 802.11a (and possibly 802.11g) use short slot time. Refer to
2339  * IEEE Std 802.11-1999 pp. 85 to know how these values are computed.
2340  */
2341 void
2342 rt2560_set_slottime(struct rt2560_softc *sc)
2343 {
2344 	struct ieee80211com *ic = &sc->sc_ic;
2345 	uint8_t slottime;
2346 	uint16_t sifs, pifs, difs, eifs;
2347 	uint32_t tmp;
2348 
2349 	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
2350 
2351 	/* define the MAC slot boundaries */
2352 	sifs = RAL_SIFS - RT2560_RXTX_TURNAROUND;
2353 	pifs = sifs + slottime;
2354 	difs = sifs + 2 * slottime;
2355 	eifs = (ic->ic_curmode == IEEE80211_MODE_11B) ? 364 : 60;
2356 
2357 	tmp = RAL_READ(sc, RT2560_CSR11);
2358 	tmp = (tmp & ~0x1f00) | slottime << 8;
2359 	RAL_WRITE(sc, RT2560_CSR11, tmp);
2360 
2361 	tmp = pifs << 16 | sifs;
2362 	RAL_WRITE(sc, RT2560_CSR18, tmp);
2363 
2364 	tmp = eifs << 16 | difs;
2365 	RAL_WRITE(sc, RT2560_CSR19, tmp);
2366 
2367 	DPRINTF(("setting slottime to %uus\n", slottime));
2368 }
2369 
2370 void
2371 rt2560_set_basicrates(struct rt2560_softc *sc)
2372 {
2373 	struct ieee80211com *ic = &sc->sc_ic;
2374 
2375 	/* update basic rate set */
2376 	if (ic->ic_curmode == IEEE80211_MODE_11B) {
2377 		/* 11b basic rates: 1, 2Mbps */
2378 		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x3);
2379 	} else {
2380 		/* 11b/g basic rates: 1, 2, 5.5, 11Mbps */
2381 		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0xf);
2382 	}
2383 }
2384 
2385 void
2386 rt2560_update_led(struct rt2560_softc *sc, int led1, int led2)
2387 {
2388 	uint32_t tmp;
2389 
2390 	/* set ON period to 70ms and OFF period to 30ms */
2391 	tmp = led1 << 16 | led2 << 17 | 70 << 8 | 30;
2392 	RAL_WRITE(sc, RT2560_LEDCSR, tmp);
2393 }
2394 
2395 void
2396 rt2560_set_bssid(struct rt2560_softc *sc, uint8_t *bssid)
2397 {
2398 	uint32_t tmp;
2399 
2400 	tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
2401 	RAL_WRITE(sc, RT2560_CSR5, tmp);
2402 
2403 	tmp = bssid[4] | bssid[5] << 8;
2404 	RAL_WRITE(sc, RT2560_CSR6, tmp);
2405 
2406 	DPRINTF(("setting BSSID to %s\n", ether_sprintf(bssid)));
2407 }
2408 
2409 void
2410 rt2560_set_macaddr(struct rt2560_softc *sc, uint8_t *addr)
2411 {
2412 	uint32_t tmp;
2413 
2414 	tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
2415 	RAL_WRITE(sc, RT2560_CSR3, tmp);
2416 
2417 	tmp = addr[4] | addr[5] << 8;
2418 	RAL_WRITE(sc, RT2560_CSR4, tmp);
2419 
2420 	DPRINTF(("setting MAC address to %s\n", ether_sprintf(addr)));
2421 }
2422 
2423 void
2424 rt2560_get_macaddr(struct rt2560_softc *sc, uint8_t *addr)
2425 {
2426 	uint32_t tmp;
2427 
2428 	tmp = RAL_READ(sc, RT2560_CSR3);
2429 	addr[0] = tmp & 0xff;
2430 	addr[1] = (tmp >>  8) & 0xff;
2431 	addr[2] = (tmp >> 16) & 0xff;
2432 	addr[3] = (tmp >> 24);
2433 
2434 	tmp = RAL_READ(sc, RT2560_CSR4);
2435 	addr[4] = tmp & 0xff;
2436 	addr[5] = (tmp >> 8) & 0xff;
2437 }
2438 
2439 void
2440 rt2560_update_promisc(struct rt2560_softc *sc)
2441 {
2442 	struct ifnet *ifp = &sc->sc_ic.ic_if;
2443 	uint32_t tmp;
2444 
2445 	tmp = RAL_READ(sc, RT2560_RXCSR0);
2446 
2447 	tmp &= ~RT2560_DROP_NOT_TO_ME;
2448 	if (!(ifp->if_flags & IFF_PROMISC))
2449 		tmp |= RT2560_DROP_NOT_TO_ME;
2450 
2451 	RAL_WRITE(sc, RT2560_RXCSR0, tmp);
2452 
2453 	DPRINTF(("%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
2454 	    "entering" : "leaving"));
2455 }
2456 
2457 void
2458 rt2560_set_txantenna(struct rt2560_softc *sc, int antenna)
2459 {
2460 	uint32_t tmp;
2461 	uint8_t tx;
2462 
2463 	tx = rt2560_bbp_read(sc, RT2560_BBP_TX) & ~RT2560_BBP_ANTMASK;
2464 	if (antenna == 1)
2465 		tx |= RT2560_BBP_ANTA;
2466 	else if (antenna == 2)
2467 		tx |= RT2560_BBP_ANTB;
2468 	else
2469 		tx |= RT2560_BBP_DIVERSITY;
2470 
2471 	/* need to force I/Q flip for RF 2525e, 2526 and 5222 */
2472 	if (sc->rf_rev == RT2560_RF_2525E || sc->rf_rev == RT2560_RF_2526 ||
2473 	    sc->rf_rev == RT2560_RF_5222)
2474 		tx |= RT2560_BBP_FLIPIQ;
2475 
2476 	rt2560_bbp_write(sc, RT2560_BBP_TX, tx);
2477 
2478 	/* update values for CCK and OFDM in BBPCSR1 */
2479 	tmp = RAL_READ(sc, RT2560_BBPCSR1) & ~0x00070007;
2480 	tmp |= (tx & 0x7) << 16 | (tx & 0x7);
2481 	RAL_WRITE(sc, RT2560_BBPCSR1, tmp);
2482 }
2483 
2484 void
2485 rt2560_set_rxantenna(struct rt2560_softc *sc, int antenna)
2486 {
2487 	uint8_t rx;
2488 
2489 	rx = rt2560_bbp_read(sc, RT2560_BBP_RX) & ~RT2560_BBP_ANTMASK;
2490 	if (antenna == 1)
2491 		rx |= RT2560_BBP_ANTA;
2492 	else if (antenna == 2)
2493 		rx |= RT2560_BBP_ANTB;
2494 	else
2495 		rx |= RT2560_BBP_DIVERSITY;
2496 
2497 	/* need to force no I/Q flip for RF 2525e and 2526 */
2498 	if (sc->rf_rev == RT2560_RF_2525E || sc->rf_rev == RT2560_RF_2526)
2499 		rx &= ~RT2560_BBP_FLIPIQ;
2500 
2501 	rt2560_bbp_write(sc, RT2560_BBP_RX, rx);
2502 }
2503 
2504 const char *
2505 rt2560_get_rf(int rev)
2506 {
2507 	switch (rev) {
2508 	case RT2560_RF_2522:	return "RT2522";
2509 	case RT2560_RF_2523:	return "RT2523";
2510 	case RT2560_RF_2524:	return "RT2524";
2511 	case RT2560_RF_2525:	return "RT2525";
2512 	case RT2560_RF_2525E:	return "RT2525e";
2513 	case RT2560_RF_2526:	return "RT2526";
2514 	case RT2560_RF_5222:	return "RT5222";
2515 	default:		return "unknown";
2516 	}
2517 }
2518 
2519 void
2520 rt2560_read_eeprom(struct rt2560_softc *sc)
2521 {
2522 	uint16_t val;
2523 	int i;
2524 
2525 	val = rt2560_eeprom_read(sc, RT2560_EEPROM_CONFIG0);
2526 	sc->rf_rev =   (val >> 11) & 0x1f;
2527 	sc->hw_radio = (val >> 10) & 0x1;
2528 	sc->led_mode = (val >> 6)  & 0x7;
2529 	sc->rx_ant =   (val >> 4)  & 0x3;
2530 	sc->tx_ant =   (val >> 2)  & 0x3;
2531 	sc->nb_ant =   val & 0x3;
2532 
2533 	/* read default values for BBP registers */
2534 	for (i = 0; i < 16; i++) {
2535 		val = rt2560_eeprom_read(sc, RT2560_EEPROM_BBP_BASE + i);
2536 		sc->bbp_prom[i].reg = val >> 8;
2537 		sc->bbp_prom[i].val = val & 0xff;
2538 	}
2539 
2540 	/* read Tx power for all b/g channels */
2541 	for (i = 0; i < 14 / 2; i++) {
2542 		val = rt2560_eeprom_read(sc, RT2560_EEPROM_TXPOWER + i);
2543 		sc->txpow[i * 2] = val >> 8;
2544 		sc->txpow[i * 2 + 1] = val & 0xff;
2545 	}
2546 }
2547 
2548 int
2549 rt2560_bbp_init(struct rt2560_softc *sc)
2550 {
2551 	int i, ntries;
2552 
2553 	/* wait for BBP to be ready */
2554 	for (ntries = 0; ntries < 100; ntries++) {
2555 		if (rt2560_bbp_read(sc, RT2560_BBP_VERSION) != 0)
2556 			break;
2557 		DELAY(1);
2558 	}
2559 	if (ntries == 100) {
2560 		printf("%s: timeout waiting for BBP\n", sc->sc_dev.dv_xname);
2561 		return EIO;
2562 	}
2563 
2564 	/* initialize BBP registers to default values */
2565 	for (i = 0; i < nitems(rt2560_def_bbp); i++) {
2566 		rt2560_bbp_write(sc, rt2560_def_bbp[i].reg,
2567 		    rt2560_def_bbp[i].val);
2568 	}
2569 #if 0
2570 	/* initialize BBP registers to values stored in EEPROM */
2571 	for (i = 0; i < 16; i++) {
2572 		if (sc->bbp_prom[i].reg == 0xff)
2573 			continue;
2574 		rt2560_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
2575 	}
2576 #endif
2577 
2578 	return 0;
2579 }
2580 
2581 int
2582 rt2560_init(struct ifnet *ifp)
2583 {
2584 	struct rt2560_softc *sc = ifp->if_softc;
2585 	struct ieee80211com *ic = &sc->sc_ic;
2586 	uint32_t tmp;
2587 	int i;
2588 
2589 	/* for CardBus, power on the socket */
2590 	if (!(sc->sc_flags & RT2560_ENABLED)) {
2591 		if (sc->sc_enable != NULL && (*sc->sc_enable)(sc) != 0) {
2592 			printf("%s: could not enable device\n",
2593 			    sc->sc_dev.dv_xname);
2594 			return EIO;
2595 		}
2596 		sc->sc_flags |= RT2560_ENABLED;
2597 	}
2598 
2599 	rt2560_stop(ifp, 0);
2600 
2601 	/* setup tx rings */
2602 	tmp = RT2560_PRIO_RING_COUNT << 24 |
2603 	      RT2560_ATIM_RING_COUNT << 16 |
2604 	      RT2560_TX_RING_COUNT   <<  8 |
2605 	      RT2560_TX_DESC_SIZE;
2606 
2607 	/* rings _must_ be initialized in this _exact_ order! */
2608 	RAL_WRITE(sc, RT2560_TXCSR2, tmp);
2609 	RAL_WRITE(sc, RT2560_TXCSR3, sc->txq.physaddr);
2610 	RAL_WRITE(sc, RT2560_TXCSR5, sc->prioq.physaddr);
2611 	RAL_WRITE(sc, RT2560_TXCSR4, sc->atimq.physaddr);
2612 	RAL_WRITE(sc, RT2560_TXCSR6, sc->bcnq.physaddr);
2613 
2614 	/* setup rx ring */
2615 	tmp = RT2560_RX_RING_COUNT << 8 | RT2560_RX_DESC_SIZE;
2616 
2617 	RAL_WRITE(sc, RT2560_RXCSR1, tmp);
2618 	RAL_WRITE(sc, RT2560_RXCSR2, sc->rxq.physaddr);
2619 
2620 	/* initialize MAC registers to default values */
2621 	for (i = 0; i < nitems(rt2560_def_mac); i++)
2622 		RAL_WRITE(sc, rt2560_def_mac[i].reg, rt2560_def_mac[i].val);
2623 
2624 	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
2625 	rt2560_set_macaddr(sc, ic->ic_myaddr);
2626 
2627 	/* set basic rate set (will be updated later) */
2628 	RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x153);
2629 
2630 	rt2560_set_txantenna(sc, 1);
2631 	rt2560_set_rxantenna(sc, 1);
2632 	rt2560_set_slottime(sc);
2633 	rt2560_update_plcp(sc);
2634 	rt2560_update_led(sc, 0, 0);
2635 
2636 	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
2637 	RAL_WRITE(sc, RT2560_CSR1, RT2560_HOST_READY);
2638 
2639 	if (rt2560_bbp_init(sc) != 0) {
2640 		rt2560_stop(ifp, 1);
2641 		return EIO;
2642 	}
2643 
2644 	/* set default BSS channel */
2645 	ic->ic_bss->ni_chan = ic->ic_ibss_chan;
2646 	rt2560_set_chan(sc, ic->ic_bss->ni_chan);
2647 
2648 	/* kick Rx */
2649 	tmp = RT2560_DROP_PHY_ERROR | RT2560_DROP_CRC_ERROR;
2650 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2651 		tmp |= RT2560_DROP_CTL | RT2560_DROP_VERSION_ERROR;
2652 #ifndef IEEE80211_STA_ONLY
2653 		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
2654 #endif
2655 			tmp |= RT2560_DROP_TODS;
2656 		if (!(ifp->if_flags & IFF_PROMISC))
2657 			tmp |= RT2560_DROP_NOT_TO_ME;
2658 	}
2659 	RAL_WRITE(sc, RT2560_RXCSR0, tmp);
2660 
2661 	/* clear old FCS and Rx FIFO errors */
2662 	RAL_READ(sc, RT2560_CNT0);
2663 	RAL_READ(sc, RT2560_CNT4);
2664 
2665 	/* clear any pending interrupts */
2666 	RAL_WRITE(sc, RT2560_CSR7, 0xffffffff);
2667 
2668 	/* enable interrupts */
2669 	RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
2670 
2671 	ifp->if_flags &= ~IFF_OACTIVE;
2672 	ifp->if_flags |= IFF_RUNNING;
2673 
2674 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2675 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2676 	else
2677 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2678 
2679 	return 0;
2680 }
2681 
2682 void
2683 rt2560_stop(struct ifnet *ifp, int disable)
2684 {
2685 	struct rt2560_softc *sc = ifp->if_softc;
2686 	struct ieee80211com *ic = &sc->sc_ic;
2687 
2688 	sc->sc_tx_timer = 0;
2689 	ifp->if_timer = 0;
2690 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2691 
2692 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);	/* free all nodes */
2693 
2694 	/* abort Tx */
2695 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_ABORT_TX);
2696 
2697 	/* disable Rx */
2698 	RAL_WRITE(sc, RT2560_RXCSR0, RT2560_DISABLE_RX);
2699 
2700 	/* reset ASIC (and thus, BBP) */
2701 	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
2702 	RAL_WRITE(sc, RT2560_CSR1, 0);
2703 
2704 	/* disable interrupts */
2705 	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
2706 
2707 	/* clear any pending interrupt */
2708 	RAL_WRITE(sc, RT2560_CSR7, 0xffffffff);
2709 
2710 	/* reset Tx and Rx rings */
2711 	rt2560_reset_tx_ring(sc, &sc->txq);
2712 	rt2560_reset_tx_ring(sc, &sc->atimq);
2713 	rt2560_reset_tx_ring(sc, &sc->prioq);
2714 	rt2560_reset_tx_ring(sc, &sc->bcnq);
2715 	rt2560_reset_rx_ring(sc, &sc->rxq);
2716 
2717 	/* for CardBus, power down the socket */
2718 	if (disable && sc->sc_disable != NULL) {
2719 		if (sc->sc_flags & RT2560_ENABLED) {
2720 			(*sc->sc_disable)(sc);
2721 			sc->sc_flags &= ~RT2560_ENABLED;
2722 		}
2723 	}
2724 }
2725 
2726 void
2727 rt2560_power(int why, void *arg)
2728 {
2729 	struct rt2560_softc *sc = arg;
2730 	struct ifnet *ifp = &sc->sc_ic.ic_if;
2731 	int s;
2732 
2733 	DPRINTF(("%s: rt2560_power(%d)\n", sc->sc_dev.dv_xname, why));
2734 
2735 	s = splnet();
2736 	switch (why) {
2737 	case PWR_SUSPEND:
2738 	case PWR_STANDBY:
2739 		rt2560_stop(ifp, 1);
2740 		if (sc->sc_power != NULL)
2741 			(*sc->sc_power)(sc, why);
2742 		break;
2743 	case PWR_RESUME:
2744 		if (ifp->if_flags & IFF_UP) {
2745 			rt2560_init(ifp);
2746 			if (sc->sc_power != NULL)
2747 				(*sc->sc_power)(sc, why);
2748 			if (ifp->if_flags & IFF_RUNNING)
2749 				rt2560_start(ifp);
2750 		}
2751 		break;
2752 	}
2753 	splx(s);
2754 }
2755 
2756 void
2757 rt2560_shutdown(void *arg)
2758 {
2759 	struct rt2560_softc *sc = arg;
2760 
2761 	rt2560_stop(&sc->sc_ic.ic_if, 1);
2762 }
2763 
2764 struct cfdriver ral_cd = {
2765 	NULL, "ral", DV_IFNET
2766 };
2767