xref: /dragonfly/sys/dev/netif/ral/rt2560.c (revision 8a7bdfea)
1 /*
2  * Copyright (c) 2005, 2006
3  *	Damien Bergamini <damien.bergamini@free.fr>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  *
17  * $FreeBSD: src/sys/dev/ral/rt2560.c,v 1.3 2006/03/21 21:15:43 damien Exp $
18  * $DragonFly: src/sys/dev/netif/ral/rt2560.c,v 1.35 2008/02/08 09:42:29 sephe Exp $
19  */
20 
21 /*
22  * Ralink Technology RT2560 chipset driver
23  * http://www.ralinktech.com/
24  */
25 
26 #include <sys/param.h>
27 #include <sys/bus.h>
28 #include <sys/endian.h>
29 #include <sys/kernel.h>
30 #include <sys/malloc.h>
31 #include <sys/mbuf.h>
32 #include <sys/module.h>
33 #include <sys/rman.h>
34 #include <sys/socket.h>
35 #include <sys/sockio.h>
36 #include <sys/sysctl.h>
37 #include <sys/serialize.h>
38 
39 #include <net/bpf.h>
40 #include <net/if.h>
41 #include <net/if_arp.h>
42 #include <net/ethernet.h>
43 #include <net/if_dl.h>
44 #include <net/if_media.h>
45 #include <net/ifq_var.h>
46 
47 #include <netproto/802_11/ieee80211_var.h>
48 #include <netproto/802_11/ieee80211_radiotap.h>
49 #include <netproto/802_11/wlan_ratectl/onoe/ieee80211_onoe_param.h>
50 #include <netproto/802_11/wlan_ratectl/sample/ieee80211_sample_param.h>
51 
52 #include <dev/netif/ral/rt2560reg.h>
53 #include <dev/netif/ral/rt2560var.h>
54 
55 #define RT2560_RSSI(sc, rssi)					\
56 	((rssi) > (RT2560_NOISE_FLOOR + (sc)->rssi_corr) ?	\
57 	 ((rssi) - RT2560_NOISE_FLOOR - (sc)->rssi_corr) : 0)
58 
59 #ifdef RAL_DEBUG
60 #define DPRINTF(sc, x)		\
61 	do { if ((sc)->sc_debug > 0) kprintf x; } while (0)
62 #define DPRINTFN(sc, n, x)	\
63 	do { if ((sc)->sc_debug >= (n)) kprintf x; } while (0)
64 #else
65 #define DPRINTF(sc, x)
66 #define DPRINTFN(sc, n, x)
67 #endif
68 
69 static void		rt2560_dma_map_addr(void *, bus_dma_segment_t *, int,
70 			    int);
71 static void		rt2560_dma_map_mbuf(void *, bus_dma_segment_t *, int,
72 					    bus_size_t, int);
73 static int		rt2560_alloc_tx_ring(struct rt2560_softc *,
74 			    struct rt2560_tx_ring *, int);
75 static void		rt2560_reset_tx_ring(struct rt2560_softc *,
76 			    struct rt2560_tx_ring *);
77 static void		rt2560_free_tx_ring(struct rt2560_softc *,
78 			    struct rt2560_tx_ring *);
79 static int		rt2560_alloc_rx_ring(struct rt2560_softc *,
80 			    struct rt2560_rx_ring *, int);
81 static void		rt2560_reset_rx_ring(struct rt2560_softc *,
82 			    struct rt2560_rx_ring *);
83 static void		rt2560_free_rx_ring(struct rt2560_softc *,
84 			    struct rt2560_rx_ring *);
85 static int		rt2560_media_change(struct ifnet *);
86 static void		rt2560_next_scan(void *);
87 static int		rt2560_newstate(struct ieee80211com *,
88 			    enum ieee80211_state, int);
89 static uint16_t		rt2560_eeprom_read(struct rt2560_softc *, uint8_t);
90 static void		rt2560_encryption_intr(struct rt2560_softc *);
91 static void		rt2560_tx_intr(struct rt2560_softc *);
92 static void		rt2560_prio_intr(struct rt2560_softc *);
93 static void		rt2560_decryption_intr(struct rt2560_softc *);
94 static void		rt2560_rx_intr(struct rt2560_softc *);
95 static void		rt2560_beacon_expire(struct rt2560_softc *);
96 static void		rt2560_wakeup_expire(struct rt2560_softc *);
97 static uint8_t		rt2560_rxrate(struct rt2560_rx_desc *);
98 static uint8_t		rt2560_plcp_signal(int);
99 static void		rt2560_setup_tx_desc(struct rt2560_softc *,
100 			    struct rt2560_tx_desc *, uint32_t, int, int, int,
101 			    bus_addr_t);
102 static int		rt2560_tx_bcn(struct rt2560_softc *, struct mbuf *,
103 			    struct ieee80211_node *);
104 static int		rt2560_tx_mgt(struct rt2560_softc *, struct mbuf *,
105 			    struct ieee80211_node *);
106 static struct		mbuf *rt2560_get_rts(struct rt2560_softc *,
107 			    struct ieee80211_frame *, uint16_t);
108 static int		rt2560_tx_data(struct rt2560_softc *, struct mbuf *,
109 			    struct ieee80211_node *);
110 static void		rt2560_start(struct ifnet *);
111 static void		rt2560_watchdog(struct ifnet *);
112 static int		rt2560_reset(struct ifnet *);
113 static int		rt2560_ioctl(struct ifnet *, u_long, caddr_t,
114 				     struct ucred *);
115 static void		rt2560_bbp_write(struct rt2560_softc *, uint8_t,
116 			    uint8_t);
117 static uint8_t		rt2560_bbp_read(struct rt2560_softc *, uint8_t);
118 static void		rt2560_rf_write(struct rt2560_softc *, uint8_t,
119 			    uint32_t);
120 static void		rt2560_set_chan(struct rt2560_softc *,
121 			    struct ieee80211_channel *);
122 static void		rt2560_enable_tsf_sync(struct rt2560_softc *);
123 static void		rt2560_update_plcp(struct rt2560_softc *);
124 static void		rt2560_update_slot(struct ifnet *);
125 static void		rt2560_set_basicrates(struct rt2560_softc *);
126 static void		rt2560_update_led(struct rt2560_softc *, int, int);
127 static void		rt2560_set_bssid(struct rt2560_softc *, uint8_t *);
128 static void		rt2560_set_macaddr(struct rt2560_softc *, uint8_t *);
129 static void		rt2560_get_macaddr(struct rt2560_softc *, uint8_t *);
130 static void		rt2560_update_promisc(struct rt2560_softc *);
131 static const char	*rt2560_get_rf(int);
132 static void		rt2560_read_config(struct rt2560_softc *);
133 static int		rt2560_bbp_init(struct rt2560_softc *);
134 static void		rt2560_set_txantenna(struct rt2560_softc *, int);
135 static void		rt2560_set_rxantenna(struct rt2560_softc *, int);
136 static void		rt2560_init(void *);
137 static void		rt2560_stop(void *);
138 static void		rt2560_intr(void *);
139 static void		*rt2560_ratectl_attach(struct ieee80211com *, u_int);
140 static void		rt2560_calibrate(void *);
141 static void		rt2560_calib_rxsensitivity(struct rt2560_softc *,
142 						   uint32_t);
143 static int		rt2560_sysctl_rxsns(SYSCTL_HANDLER_ARGS);
144 
145 /*
146  * Supported rates for 802.11a/b/g modes (in 500Kbps unit).
147  */
148 static const struct ieee80211_rateset rt2560_rateset_11a =
149 	{ 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
150 
151 static const struct ieee80211_rateset rt2560_rateset_11b =
152 	{ 4, { 2, 4, 11, 22 } };
153 
154 static const struct ieee80211_rateset rt2560_rateset_11g =
155 	{ 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
156 
157 static const struct {
158 	uint32_t	reg;
159 	uint32_t	val;
160 } rt2560_def_mac[] = {
161 	RT2560_DEF_MAC
162 };
163 
164 static const struct {
165 	uint8_t	reg;
166 	uint8_t	val;
167 } rt2560_def_bbp[] = {
168 	RT2560_DEF_BBP
169 };
170 
171 static const uint32_t rt2560_rf2522_r2[]    = RT2560_RF2522_R2;
172 static const uint32_t rt2560_rf2523_r2[]    = RT2560_RF2523_R2;
173 static const uint32_t rt2560_rf2524_r2[]    = RT2560_RF2524_R2;
174 static const uint32_t rt2560_rf2525_r2[]    = RT2560_RF2525_R2;
175 static const uint32_t rt2560_rf2525_hi_r2[] = RT2560_RF2525_HI_R2;
176 static const uint32_t rt2560_rf2525e_r2[]   = RT2560_RF2525E_R2;
177 static const uint32_t rt2560_rf2526_r2[]    = RT2560_RF2526_R2;
178 static const uint32_t rt2560_rf2526_hi_r2[] = RT2560_RF2526_HI_R2;
179 
180 static const struct {
181 	uint8_t		chan;
182 	uint32_t	r1, r2, r4;
183 } rt2560_rf5222[] = {
184 	RT2560_RF5222
185 };
186 
187 int
188 rt2560_attach(device_t dev, int id)
189 {
190 	struct rt2560_softc *sc = device_get_softc(dev);
191 	struct ieee80211com *ic = &sc->sc_ic;
192 	struct ifnet *ifp = &ic->ic_if;
193 	int error, i;
194 
195 	callout_init(&sc->scan_ch);
196 	callout_init(&sc->calib_ch);
197 #ifdef RAL_DEBUG
198 	sc->sc_debug = 1;
199 #endif
200 
201 	sc->sc_irq_rid = 0;
202 	sc->sc_irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &sc->sc_irq_rid,
203 					    RF_ACTIVE | RF_SHAREABLE);
204 	if (sc->sc_irq == NULL) {
205 		device_printf(dev, "could not allocate interrupt resource\n");
206 		return ENXIO;
207 	}
208 
209 	/* retrieve RT2560 rev. no */
210 	sc->asic_rev = RAL_READ(sc, RT2560_CSR0);
211 
212 	/* retrieve MAC address */
213 	rt2560_get_macaddr(sc, ic->ic_myaddr);
214 
215 	/* retrieve RF rev. no and various other things from EEPROM */
216 	rt2560_read_config(sc);
217 
218 	device_printf(dev, "MAC/BBP RT2560 (rev 0x%02x), RF %s\n",
219 	    sc->asic_rev, rt2560_get_rf(sc->rf_rev));
220 
221 	/*
222 	 * Allocate Tx and Rx rings.
223 	 */
224 	error = rt2560_alloc_tx_ring(sc, &sc->txq, RT2560_TX_RING_COUNT);
225 	if (error != 0) {
226 		device_printf(sc->sc_dev, "could not allocate Tx ring\n");
227 		goto fail;
228 	}
229 
230 	error = rt2560_alloc_tx_ring(sc, &sc->atimq, RT2560_ATIM_RING_COUNT);
231 	if (error != 0) {
232 		device_printf(sc->sc_dev, "could not allocate ATIM ring\n");
233 		goto fail;
234 	}
235 
236 	error = rt2560_alloc_tx_ring(sc, &sc->prioq, RT2560_PRIO_RING_COUNT);
237 	if (error != 0) {
238 		device_printf(sc->sc_dev, "could not allocate Prio ring\n");
239 		goto fail;
240 	}
241 
242 	error = rt2560_alloc_tx_ring(sc, &sc->bcnq, RT2560_BEACON_RING_COUNT);
243 	if (error != 0) {
244 		device_printf(sc->sc_dev, "could not allocate Beacon ring\n");
245 		goto fail;
246 	}
247 
248 	error = rt2560_alloc_rx_ring(sc, &sc->rxq, RT2560_RX_RING_COUNT);
249 	if (error != 0) {
250 		device_printf(sc->sc_dev, "could not allocate Rx ring\n");
251 		goto fail;
252 	}
253 
254 	sysctl_ctx_init(&sc->sysctl_ctx);
255 	sc->sysctl_tree = SYSCTL_ADD_NODE(&sc->sysctl_ctx,
256 					  SYSCTL_STATIC_CHILDREN(_hw),
257 					  OID_AUTO,
258 					  device_get_nameunit(dev),
259 					  CTLFLAG_RD, 0, "");
260 	if (sc->sysctl_tree == NULL) {
261 		device_printf(dev, "could not add sysctl node\n");
262 		error = ENXIO;
263 		goto fail;
264 	}
265 
266 	ifp->if_softc = sc;
267 	if_initname(ifp, device_get_name(dev), device_get_unit(dev));
268 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
269 	ifp->if_init = rt2560_init;
270 	ifp->if_ioctl = rt2560_ioctl;
271 	ifp->if_start = rt2560_start;
272 	ifp->if_watchdog = rt2560_watchdog;
273 	ifq_set_maxlen(&ifp->if_snd, IFQ_MAXLEN);
274 	ifq_set_ready(&ifp->if_snd);
275 
276 	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
277 	ic->ic_opmode = IEEE80211_M_STA; /* default to BSS mode */
278 	ic->ic_state = IEEE80211_S_INIT;
279 
280 	IEEE80211_ONOE_PARAM_SETUP(&sc->sc_onoe_param);
281 	IEEE80211_SAMPLE_PARAM_SETUP(&sc->sc_sample_param);
282 	ic->ic_ratectl.rc_st_ratectl_cap = IEEE80211_RATECTL_CAP_ONOE |
283 					   IEEE80211_RATECTL_CAP_SAMPLE;
284 	ic->ic_ratectl.rc_st_ratectl = IEEE80211_RATECTL_SAMPLE;
285 	ic->ic_ratectl.rc_st_attach = rt2560_ratectl_attach;
286 
287 	/* set device capabilities */
288 	ic->ic_caps =
289 	    IEEE80211_C_IBSS |		/* IBSS mode supported */
290 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
291 	    IEEE80211_C_HOSTAP |	/* HostAp mode supported */
292 	    IEEE80211_C_TXPMGT |	/* tx power management */
293 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
294 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
295 	    IEEE80211_C_WPA;		/* 802.11i */
296 
297 	if (sc->rf_rev == RT2560_RF_5222) {
298 		/* set supported .11a rates */
299 		ic->ic_sup_rates[IEEE80211_MODE_11A] = rt2560_rateset_11a;
300 
301 		/* set supported .11a channels */
302 		for (i = 36; i <= 64; i += 4) {
303 			ic->ic_channels[i].ic_freq =
304 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
305 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
306 		}
307 		for (i = 100; i <= 140; i += 4) {
308 			ic->ic_channels[i].ic_freq =
309 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
310 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
311 		}
312 		for (i = 149; i <= 161; i += 4) {
313 			ic->ic_channels[i].ic_freq =
314 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
315 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
316 		}
317 	}
318 
319 	/* set supported .11b and .11g rates */
320 	ic->ic_sup_rates[IEEE80211_MODE_11B] = rt2560_rateset_11b;
321 	ic->ic_sup_rates[IEEE80211_MODE_11G] = rt2560_rateset_11g;
322 
323 	/* set supported .11b and .11g channels (1 through 14) */
324 	for (i = 1; i <= 14; i++) {
325 		ic->ic_channels[i].ic_freq =
326 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
327 		ic->ic_channels[i].ic_flags =
328 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
329 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
330 	}
331 
332 	sc->sc_sifs = IEEE80211_DUR_SIFS;	/* Default SIFS */
333 
334 	ieee80211_ifattach(ic);
335 	ic->ic_updateslot = rt2560_update_slot;
336 	ic->ic_reset = rt2560_reset;
337 	/* enable s/w bmiss handling in sta mode */
338 	ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;
339 	ic->ic_txpowlimit = RT2560_DEFAULT_TXPOWER;
340 
341 	/* override state transition machine */
342 	sc->sc_newstate = ic->ic_newstate;
343 	ic->ic_newstate = rt2560_newstate;
344 	ieee80211_media_init(ic, rt2560_media_change, ieee80211_media_status);
345 
346 	bpfattach_dlt(ifp, DLT_IEEE802_11_RADIO,
347 	    sizeof (struct ieee80211_frame) + 64, &sc->sc_drvbpf);
348 
349 	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
350 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
351 	sc->sc_rxtap.wr_ihdr.it_present = htole32(RT2560_RX_RADIOTAP_PRESENT);
352 
353 	sc->sc_txtap_len = sizeof sc->sc_txtapu;
354 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
355 	sc->sc_txtap.wt_ihdr.it_present = htole32(RT2560_TX_RADIOTAP_PRESENT);
356 
357 	/*
358 	 * Add a few sysctl knobs.
359 	 */
360 	sc->sc_dwelltime = 200;	/* milliseconds */
361 	sc->sc_calib_rxsns = 1;	/* Enable */
362 	sc->sc_rxsns = sc->sc_bbp17_dynmax;
363 
364 	SYSCTL_ADD_INT(&sc->sysctl_ctx,
365 	    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO,
366 	    "txantenna", CTLFLAG_RW, &sc->tx_ant, 0, "tx antenna (0=auto)");
367 
368 	SYSCTL_ADD_INT(&sc->sysctl_ctx,
369 	    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO,
370 	    "rxantenna", CTLFLAG_RW, &sc->rx_ant, 0, "rx antenna (0=auto)");
371 
372 	SYSCTL_ADD_INT(&sc->sysctl_ctx,
373 	    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO, "dwell",
374 	    CTLFLAG_RW, &sc->sc_dwelltime, 0,
375 	    "channel dwell time (ms) for AP/station scanning");
376 
377 #ifdef RAL_DEBUG
378 	SYSCTL_ADD_INT(&sc->sysctl_ctx,
379 	    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO, "debug",
380 	    CTLFLAG_RW, &sc->sc_debug, 0, "debug level");
381 #endif
382 
383 	SYSCTL_ADD_PROC(&sc->sysctl_ctx,
384 			SYSCTL_CHILDREN(sc->sysctl_tree),
385 			OID_AUTO, "rx_sensitivity", CTLTYPE_INT | CTLFLAG_RW,
386 			sc, 0, rt2560_sysctl_rxsns, "I",
387 			"initial RX sensitivity");
388 
389 	if (sc->sc_flags & RT2560_FLAG_RXSNS) {
390 		SYSCTL_ADD_INT(&sc->sysctl_ctx,
391 		    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO, "calib_rxsns",
392 		    CTLFLAG_RW, &sc->sc_calib_rxsns, 0,
393 		    "calibrate RX sensitivity (sta mode)");
394 	}
395 
396 	error = bus_setup_intr(dev, sc->sc_irq, INTR_MPSAFE, rt2560_intr,
397 			       sc, &sc->sc_ih, ifp->if_serializer);
398 	if (error != 0) {
399 		device_printf(dev, "could not set up interrupt\n");
400 		bpfdetach(ifp);
401 		ieee80211_ifdetach(ic);
402 		goto fail;
403 	}
404 
405 	if (bootverbose)
406 		ieee80211_announce(ic);
407 	return 0;
408 fail:
409 	rt2560_detach(sc);
410 	return error;
411 }
412 
413 int
414 rt2560_detach(void *xsc)
415 {
416 	struct rt2560_softc *sc = xsc;
417 	struct ieee80211com *ic = &sc->sc_ic;
418 	struct ifnet *ifp = ic->ic_ifp;
419 
420 	if (device_is_attached(sc->sc_dev)) {
421 		lwkt_serialize_enter(ifp->if_serializer);
422 
423 		callout_stop(&sc->scan_ch);
424 
425 		rt2560_stop(sc);
426 		bus_teardown_intr(sc->sc_dev, sc->sc_irq, sc->sc_ih);
427 
428 		lwkt_serialize_exit(ifp->if_serializer);
429 
430 		bpfdetach(ifp);
431 		ieee80211_ifdetach(ic);
432 	}
433 
434 	rt2560_free_tx_ring(sc, &sc->txq);
435 	rt2560_free_tx_ring(sc, &sc->atimq);
436 	rt2560_free_tx_ring(sc, &sc->prioq);
437 	rt2560_free_tx_ring(sc, &sc->bcnq);
438 	rt2560_free_rx_ring(sc, &sc->rxq);
439 
440 	if (sc->sc_irq != NULL) {
441 		bus_release_resource(sc->sc_dev, SYS_RES_IRQ, sc->sc_irq_rid,
442 				     sc->sc_irq);
443 	}
444 
445 	if (sc->sysctl_tree != NULL)
446 		sysctl_ctx_free(&sc->sysctl_ctx);
447 
448 	return 0;
449 }
450 
451 void
452 rt2560_shutdown(void *xsc)
453 {
454 	struct rt2560_softc *sc = xsc;
455 	struct ifnet *ifp = &sc->sc_ic.ic_if;
456 
457 	lwkt_serialize_enter(ifp->if_serializer);
458 	rt2560_stop(sc);
459 	lwkt_serialize_exit(ifp->if_serializer);
460 }
461 
462 void
463 rt2560_suspend(void *xsc)
464 {
465 	struct rt2560_softc *sc = xsc;
466 	struct ifnet *ifp = &sc->sc_ic.ic_if;
467 
468 	lwkt_serialize_enter(ifp->if_serializer);
469 	rt2560_stop(sc);
470 	lwkt_serialize_exit(ifp->if_serializer);
471 }
472 
473 void
474 rt2560_resume(void *xsc)
475 {
476 	struct rt2560_softc *sc = xsc;
477 	struct ifnet *ifp = sc->sc_ic.ic_ifp;
478 
479 	lwkt_serialize_enter(ifp->if_serializer);
480 	if (ifp->if_flags & IFF_UP) {
481 		ifp->if_init(ifp->if_softc);
482 		if (ifp->if_flags & IFF_RUNNING)
483 			ifp->if_start(ifp);
484 	}
485 	lwkt_serialize_exit(ifp->if_serializer);
486 }
487 
488 static void
489 rt2560_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nseg, int error)
490 {
491 	if (error != 0)
492 		return;
493 
494 	KASSERT(nseg == 1, ("too many DMA segments, %d should be 1", nseg));
495 
496 	*(bus_addr_t *)arg = segs[0].ds_addr;
497 }
498 
499 static int
500 rt2560_alloc_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring,
501     int count)
502 {
503 	int i, error;
504 
505 	ring->count = count;
506 	ring->queued = 0;
507 	ring->cur = ring->next = 0;
508 	ring->cur_encrypt = ring->next_encrypt = 0;
509 
510 	error = bus_dma_tag_create(NULL, 4, 0, BUS_SPACE_MAXADDR_32BIT,
511 	    BUS_SPACE_MAXADDR, NULL, NULL, count * RT2560_TX_DESC_SIZE, 1,
512 	    count * RT2560_TX_DESC_SIZE, 0, &ring->desc_dmat);
513 	if (error != 0) {
514 		device_printf(sc->sc_dev, "could not create desc DMA tag\n");
515 		goto fail;
516 	}
517 
518 	error = bus_dmamem_alloc(ring->desc_dmat, (void **)&ring->desc,
519 	    BUS_DMA_WAITOK | BUS_DMA_ZERO, &ring->desc_map);
520 	if (error != 0) {
521 		device_printf(sc->sc_dev, "could not allocate DMA memory\n");
522 		goto fail;
523 	}
524 
525 	error = bus_dmamap_load(ring->desc_dmat, ring->desc_map, ring->desc,
526 	    			count * RT2560_TX_DESC_SIZE,
527 				rt2560_dma_map_addr, &ring->physaddr, 0);
528 	if (error != 0) {
529 		device_printf(sc->sc_dev, "could not load desc DMA map\n");
530 
531 		bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
532 		ring->desc = NULL;
533 		goto fail;
534 	}
535 
536 	ring->data = kmalloc(count * sizeof (struct rt2560_tx_data), M_DEVBUF,
537 	    M_WAITOK | M_ZERO);
538 
539 	error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
540 	    BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, RT2560_MAX_SCATTER,
541 	    MCLBYTES, 0, &ring->data_dmat);
542 	if (error != 0) {
543 		device_printf(sc->sc_dev, "could not create data DMA tag\n");
544 		goto fail;
545 	}
546 
547 	for (i = 0; i < count; i++) {
548 		error = bus_dmamap_create(ring->data_dmat, 0,
549 		    &ring->data[i].map);
550 		if (error != 0) {
551 			device_printf(sc->sc_dev, "could not create DMA map\n");
552 			goto fail;
553 		}
554 	}
555 	return 0;
556 
557 fail:	rt2560_free_tx_ring(sc, ring);
558 	return error;
559 }
560 
561 static void
562 rt2560_reset_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring)
563 {
564 	struct rt2560_tx_desc *desc;
565 	struct rt2560_tx_data *data;
566 	int i;
567 
568 	for (i = 0; i < ring->count; i++) {
569 		desc = &ring->desc[i];
570 		data = &ring->data[i];
571 
572 		if (data->m != NULL) {
573 			bus_dmamap_sync(ring->data_dmat, data->map,
574 			    BUS_DMASYNC_POSTWRITE);
575 			bus_dmamap_unload(ring->data_dmat, data->map);
576 			m_freem(data->m);
577 			data->m = NULL;
578 		}
579 
580 		if (data->ni != NULL) {
581 			ieee80211_free_node(data->ni);
582 			data->ni = NULL;
583 		}
584 
585 		desc->flags = 0;
586 	}
587 
588 	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
589 
590 	ring->queued = 0;
591 	ring->cur = ring->next = 0;
592 	ring->cur_encrypt = ring->next_encrypt = 0;
593 }
594 
595 static void
596 rt2560_free_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring)
597 {
598 	struct rt2560_tx_data *data;
599 	int i;
600 
601 	if (ring->desc != NULL) {
602 		bus_dmamap_sync(ring->desc_dmat, ring->desc_map,
603 		    BUS_DMASYNC_POSTWRITE);
604 		bus_dmamap_unload(ring->desc_dmat, ring->desc_map);
605 		bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
606 		ring->desc = NULL;
607 	}
608 
609 	if (ring->desc_dmat != NULL) {
610 		bus_dma_tag_destroy(ring->desc_dmat);
611 		ring->desc_dmat = NULL;
612 	}
613 
614 	if (ring->data != NULL) {
615 		for (i = 0; i < ring->count; i++) {
616 			data = &ring->data[i];
617 
618 			if (data->m != NULL) {
619 				bus_dmamap_sync(ring->data_dmat, data->map,
620 				    BUS_DMASYNC_POSTWRITE);
621 				bus_dmamap_unload(ring->data_dmat, data->map);
622 				m_freem(data->m);
623 				data->m = NULL;
624 			}
625 
626 			if (data->ni != NULL) {
627 				ieee80211_free_node(data->ni);
628 				data->ni = NULL;
629 			}
630 
631 			if (data->map != NULL) {
632 				bus_dmamap_destroy(ring->data_dmat, data->map);
633 				data->map = NULL;
634 			}
635 		}
636 
637 		kfree(ring->data, M_DEVBUF);
638 		ring->data = NULL;
639 	}
640 
641 	if (ring->data_dmat != NULL) {
642 		bus_dma_tag_destroy(ring->data_dmat);
643 		ring->data_dmat = NULL;
644 	}
645 }
646 
647 static int
648 rt2560_alloc_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring,
649     int count)
650 {
651 	struct rt2560_rx_desc *desc;
652 	struct rt2560_rx_data *data;
653 	bus_addr_t physaddr;
654 	int i, error;
655 
656 	ring->count = count;
657 	ring->cur = ring->next = 0;
658 	ring->cur_decrypt = 0;
659 
660 	error = bus_dma_tag_create(NULL, 4, 0, BUS_SPACE_MAXADDR_32BIT,
661 	    BUS_SPACE_MAXADDR, NULL, NULL, count * RT2560_RX_DESC_SIZE, 1,
662 	    count * RT2560_RX_DESC_SIZE, 0, &ring->desc_dmat);
663 	if (error != 0) {
664 		device_printf(sc->sc_dev, "could not create desc DMA tag\n");
665 		goto fail;
666 	}
667 
668 	error = bus_dmamem_alloc(ring->desc_dmat, (void **)&ring->desc,
669 	    BUS_DMA_WAITOK | BUS_DMA_ZERO, &ring->desc_map);
670 	if (error != 0) {
671 		device_printf(sc->sc_dev, "could not allocate DMA memory\n");
672 		goto fail;
673 	}
674 
675 	error = bus_dmamap_load(ring->desc_dmat, ring->desc_map, ring->desc,
676 				count * RT2560_RX_DESC_SIZE,
677 				rt2560_dma_map_addr, &ring->physaddr, 0);
678 	if (error != 0) {
679 		device_printf(sc->sc_dev, "could not load desc DMA map\n");
680 
681 		bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
682 		ring->desc = NULL;
683 		goto fail;
684 	}
685 
686 	ring->data = kmalloc(count * sizeof (struct rt2560_rx_data), M_DEVBUF,
687 	    M_WAITOK | M_ZERO);
688 
689 	/*
690 	 * Pre-allocate Rx buffers and populate Rx ring.
691 	 */
692 	error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
693 	    BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, 1, MCLBYTES, 0,
694 	    &ring->data_dmat);
695 	if (error != 0) {
696 		device_printf(sc->sc_dev, "could not create data DMA tag\n");
697 		goto fail;
698 	}
699 
700 	for (i = 0; i < count; i++) {
701 		desc = &sc->rxq.desc[i];
702 		data = &sc->rxq.data[i];
703 
704 		error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
705 		if (error != 0) {
706 			device_printf(sc->sc_dev, "could not create DMA map\n");
707 			goto fail;
708 		}
709 
710 		data->m = m_getcl(MB_WAIT, MT_DATA, M_PKTHDR);
711 		if (data->m == NULL) {
712 			device_printf(sc->sc_dev,
713 			    "could not allocate rx mbuf\n");
714 			error = ENOMEM;
715 			goto fail;
716 		}
717 
718 		error = bus_dmamap_load(ring->data_dmat, data->map,
719 		    mtod(data->m, void *), MCLBYTES, rt2560_dma_map_addr,
720 		    &physaddr, 0);
721 		if (error != 0) {
722 			device_printf(sc->sc_dev,
723 			    "could not load rx buf DMA map");
724 
725 			m_freem(data->m);
726 			data->m = NULL;
727 			goto fail;
728 		}
729 
730 		desc->flags = htole32(RT2560_RX_BUSY);
731 		desc->physaddr = htole32(physaddr);
732 	}
733 
734 	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
735 
736 	return 0;
737 
738 fail:	rt2560_free_rx_ring(sc, ring);
739 	return error;
740 }
741 
742 static void
743 rt2560_reset_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring)
744 {
745 	int i;
746 
747 	for (i = 0; i < ring->count; i++) {
748 		ring->desc[i].flags = htole32(RT2560_RX_BUSY);
749 		ring->data[i].drop = 0;
750 	}
751 
752 	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
753 
754 	ring->cur = ring->next = 0;
755 	ring->cur_decrypt = 0;
756 }
757 
758 static void
759 rt2560_free_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring)
760 {
761 	struct rt2560_rx_data *data;
762 
763 	if (ring->desc != NULL) {
764 		bus_dmamap_sync(ring->desc_dmat, ring->desc_map,
765 		    BUS_DMASYNC_POSTWRITE);
766 		bus_dmamap_unload(ring->desc_dmat, ring->desc_map);
767 		bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
768 		ring->desc = NULL;
769 	}
770 
771 	if (ring->desc_dmat != NULL) {
772 		bus_dma_tag_destroy(ring->desc_dmat);
773 		ring->desc_dmat = NULL;
774 	}
775 
776 	if (ring->data != NULL) {
777 		int i;
778 
779 		for (i = 0; i < ring->count; i++) {
780 			data = &ring->data[i];
781 
782 			if (data->m != NULL) {
783 				bus_dmamap_sync(ring->data_dmat, data->map,
784 				    BUS_DMASYNC_POSTREAD);
785 				bus_dmamap_unload(ring->data_dmat, data->map);
786 				m_freem(data->m);
787 				data->m = NULL;
788 			}
789 
790 			if (data->map != NULL) {
791 				bus_dmamap_destroy(ring->data_dmat, data->map);
792 				data->map = NULL;
793 			}
794 		}
795 
796 		kfree(ring->data, M_DEVBUF);
797 		ring->data = NULL;
798 	}
799 
800 	if (ring->data_dmat != NULL) {
801 		bus_dma_tag_destroy(ring->data_dmat);
802 		ring->data_dmat = NULL;
803 	}
804 }
805 
806 static int
807 rt2560_media_change(struct ifnet *ifp)
808 {
809 	struct rt2560_softc *sc = ifp->if_softc;
810 	int error;
811 
812 	error = ieee80211_media_change(ifp);
813 	if (error != ENETRESET)
814 		return error;
815 
816 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
817 		rt2560_init(sc);
818 	return 0;
819 }
820 
821 /*
822  * This function is called periodically (every 200ms) during scanning to
823  * switch from one channel to another.
824  */
825 static void
826 rt2560_next_scan(void *arg)
827 {
828 	struct rt2560_softc *sc = arg;
829 	struct ieee80211com *ic = &sc->sc_ic;
830 	struct ifnet *ifp = ic->ic_ifp;
831 
832 	lwkt_serialize_enter(ifp->if_serializer);
833 	if (ic->ic_state == IEEE80211_S_SCAN)
834 		ieee80211_next_scan(ic);
835 	lwkt_serialize_exit(ifp->if_serializer);
836 }
837 
838 static int
839 rt2560_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
840 {
841 	struct rt2560_softc *sc = ic->ic_ifp->if_softc;
842 	enum ieee80211_state ostate;
843 	struct ieee80211_node *ni;
844 	struct mbuf *m;
845 	int error = 0;
846 
847 	ostate = ic->ic_state;
848 	callout_stop(&sc->scan_ch);
849 	callout_stop(&sc->calib_ch);
850 	ieee80211_ratectl_newstate(ic, nstate);
851 
852 	switch (nstate) {
853 	case IEEE80211_S_INIT:
854 		if (ostate == IEEE80211_S_RUN) {
855 			/* abort TSF synchronization */
856 			RAL_WRITE(sc, RT2560_CSR14, 0);
857 
858 			/* turn association led off */
859 			rt2560_update_led(sc, 0, 0);
860 		}
861 		break;
862 
863 	case IEEE80211_S_SCAN:
864 		rt2560_set_chan(sc, ic->ic_curchan);
865 		callout_reset(&sc->scan_ch, (sc->sc_dwelltime * hz) / 1000,
866 		    rt2560_next_scan, sc);
867 		break;
868 
869 	case IEEE80211_S_AUTH:
870 		rt2560_set_chan(sc, ic->ic_curchan);
871 		break;
872 
873 	case IEEE80211_S_ASSOC:
874 		rt2560_set_chan(sc, ic->ic_curchan);
875 		break;
876 
877 	case IEEE80211_S_RUN:
878 		sc->sc_avgrssi = -1;
879 		rt2560_set_chan(sc, ic->ic_curchan);
880 
881 		ni = ic->ic_bss;
882 
883 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
884 			rt2560_update_plcp(sc);
885 			rt2560_set_basicrates(sc);
886 			rt2560_set_bssid(sc, ni->ni_bssid);
887 		}
888 
889 		if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
890 		    ic->ic_opmode == IEEE80211_M_IBSS) {
891 			m = ieee80211_beacon_alloc(ic, ni, &sc->sc_bo);
892 			if (m == NULL) {
893 				device_printf(sc->sc_dev,
894 				    "could not allocate beacon\n");
895 				error = ENOBUFS;
896 				break;
897 			}
898 
899 			ieee80211_ref_node(ni);
900 			error = rt2560_tx_bcn(sc, m, ni);
901 			if (error != 0)
902 				break;
903 		}
904 
905 		/* turn assocation led on */
906 		rt2560_update_led(sc, 1, 0);
907 
908 		if (ic->ic_opmode != IEEE80211_M_MONITOR)
909 			rt2560_enable_tsf_sync(sc);
910 		if (ic->ic_opmode == IEEE80211_M_STA) {
911 			/* Clear false CCA counter */
912 			RAL_READ(sc, RT2560_CNT3);
913 			callout_reset(&sc->calib_ch, hz, rt2560_calibrate, sc);
914 		}
915 		break;
916 	}
917 
918 	return (error != 0) ? error : sc->sc_newstate(ic, nstate, arg);
919 }
920 
921 /*
922  * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46 or
923  * 93C66).
924  */
925 static uint16_t
926 rt2560_eeprom_read(struct rt2560_softc *sc, uint8_t addr)
927 {
928 	uint32_t tmp;
929 	uint16_t val;
930 	int n;
931 
932 	/* clock C once before the first command */
933 	RT2560_EEPROM_CTL(sc, 0);
934 
935 	RT2560_EEPROM_CTL(sc, RT2560_S);
936 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
937 	RT2560_EEPROM_CTL(sc, RT2560_S);
938 
939 	/* write start bit (1) */
940 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D);
941 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D | RT2560_C);
942 
943 	/* write READ opcode (10) */
944 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D);
945 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D | RT2560_C);
946 	RT2560_EEPROM_CTL(sc, RT2560_S);
947 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
948 
949 	/* write address (A5-A0 or A7-A0) */
950 	n = (RAL_READ(sc, RT2560_CSR21) & RT2560_93C46) ? 5 : 7;
951 	for (; n >= 0; n--) {
952 		RT2560_EEPROM_CTL(sc, RT2560_S |
953 		    (((addr >> n) & 1) << RT2560_SHIFT_D));
954 		RT2560_EEPROM_CTL(sc, RT2560_S |
955 		    (((addr >> n) & 1) << RT2560_SHIFT_D) | RT2560_C);
956 	}
957 
958 	RT2560_EEPROM_CTL(sc, RT2560_S);
959 
960 	/* read data Q15-Q0 */
961 	val = 0;
962 	for (n = 15; n >= 0; n--) {
963 		RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
964 		tmp = RAL_READ(sc, RT2560_CSR21);
965 		val |= ((tmp & RT2560_Q) >> RT2560_SHIFT_Q) << n;
966 		RT2560_EEPROM_CTL(sc, RT2560_S);
967 	}
968 
969 	RT2560_EEPROM_CTL(sc, 0);
970 
971 	/* clear Chip Select and clock C */
972 	RT2560_EEPROM_CTL(sc, RT2560_S);
973 	RT2560_EEPROM_CTL(sc, 0);
974 	RT2560_EEPROM_CTL(sc, RT2560_C);
975 
976 	return val;
977 }
978 
979 /*
980  * Some frames were processed by the hardware cipher engine and are ready for
981  * transmission.
982  */
983 static void
984 rt2560_encryption_intr(struct rt2560_softc *sc)
985 {
986 	struct rt2560_tx_desc *desc;
987 	int hw;
988 
989 	/* retrieve last descriptor index processed by cipher engine */
990 	hw = RAL_READ(sc, RT2560_SECCSR1) - sc->txq.physaddr;
991 	hw /= RT2560_TX_DESC_SIZE;
992 
993 	bus_dmamap_sync(sc->txq.desc_dmat, sc->txq.desc_map,
994 	    BUS_DMASYNC_POSTREAD);
995 
996 	while (sc->txq.next_encrypt != hw) {
997 		if (sc->txq.next_encrypt == sc->txq.cur_encrypt) {
998 			kprintf("hw encrypt %d, cur_encrypt %d\n", hw,
999 				sc->txq.cur_encrypt);
1000 			break;
1001 		}
1002 
1003 		desc = &sc->txq.desc[sc->txq.next_encrypt];
1004 
1005 		if ((le32toh(desc->flags) & RT2560_TX_BUSY) ||
1006 		    (le32toh(desc->flags) & RT2560_TX_CIPHER_BUSY))
1007 			break;
1008 
1009 		/* for TKIP, swap eiv field to fix a bug in ASIC */
1010 		if ((le32toh(desc->flags) & RT2560_TX_CIPHER_MASK) ==
1011 		    RT2560_TX_CIPHER_TKIP)
1012 			desc->eiv = bswap32(desc->eiv);
1013 
1014 		/* mark the frame ready for transmission */
1015 		desc->flags |= htole32(RT2560_TX_VALID);
1016 		desc->flags |= htole32(RT2560_TX_BUSY);
1017 
1018 		DPRINTFN(sc, 15, ("encryption done idx=%u\n",
1019 		    sc->txq.next_encrypt));
1020 
1021 		sc->txq.next_encrypt =
1022 		    (sc->txq.next_encrypt + 1) % RT2560_TX_RING_COUNT;
1023 	}
1024 
1025 	bus_dmamap_sync(sc->txq.desc_dmat, sc->txq.desc_map,
1026 	    BUS_DMASYNC_PREWRITE);
1027 
1028 	/* kick Tx */
1029 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_TX);
1030 }
1031 
1032 static void
1033 rt2560_tx_intr(struct rt2560_softc *sc)
1034 {
1035 	struct ieee80211com *ic = &sc->sc_ic;
1036 	struct ifnet *ifp = ic->ic_ifp;
1037 
1038 	bus_dmamap_sync(sc->txq.desc_dmat, sc->txq.desc_map,
1039 	    BUS_DMASYNC_POSTREAD);
1040 
1041 	for (;;) {
1042 		struct rt2560_tx_desc *desc;
1043 		struct rt2560_tx_data *data;
1044 		struct ieee80211_node *ni;
1045 		int rateidx, data_retries, failed;
1046 		struct mbuf *m;
1047 		uint32_t flags;
1048 
1049 		desc = &sc->txq.desc[sc->txq.next];
1050 		data = &sc->txq.data[sc->txq.next];
1051 
1052 		flags = le32toh(desc->flags);
1053 
1054 		if ((flags & RT2560_TX_BUSY) ||
1055 		    (flags & RT2560_TX_CIPHER_BUSY) ||
1056 		    !(flags & RT2560_TX_VALID))
1057 			break;
1058 
1059 		rateidx = data->rateidx;
1060 		ni = data->ni;
1061 		m = data->m;
1062 
1063 		data->ni = NULL;
1064 		data->m = NULL;
1065 
1066 		failed = 0;
1067 		switch (flags & RT2560_TX_RESULT_MASK) {
1068 		case RT2560_TX_SUCCESS:
1069 			DPRINTFN(sc, 10, ("data frame sent successfully\n"));
1070 			ifp->if_opackets++;
1071 			data_retries = 0;
1072 			break;
1073 
1074 		case RT2560_TX_SUCCESS_RETRY:
1075 			data_retries = (flags >> 5) & 0x7;
1076 			DPRINTFN(sc, 9, ("data frame sent after %u retries\n",
1077 				 data_retries));
1078 			ifp->if_opackets++;
1079 			break;
1080 
1081 		case RT2560_TX_FAIL_RETRY:
1082 			DPRINTFN(sc, 9, ("sending data frame failed (too much "
1083 			    "retries)\n"));
1084 			ifp->if_oerrors++;
1085 			data_retries = 7;
1086 			failed = 1;
1087 			break;
1088 
1089 		case RT2560_TX_FAIL_INVALID:
1090 		case RT2560_TX_FAIL_OTHER:
1091 		default:
1092 			data_retries = 7;
1093 			failed = 1;
1094 			device_printf(sc->sc_dev, "sending data frame failed "
1095 			    "0x%08x\n", flags);
1096 			ifp->if_oerrors++;
1097 			break;
1098 		}
1099 
1100 		bus_dmamap_sync(sc->txq.data_dmat, data->map,
1101 		    BUS_DMASYNC_POSTWRITE);
1102 		bus_dmamap_unload(sc->txq.data_dmat, data->map);
1103 
1104 		if (rateidx >= 0) {
1105 			struct ieee80211_ratectl_res res;
1106 
1107 			res.rc_res_tries = data_retries + 1;
1108 			res.rc_res_rateidx = rateidx;
1109 			ieee80211_ratectl_tx_complete(ni, m->m_pkthdr.len,
1110 				&res, 1, data_retries, 0, failed);
1111 		}
1112 
1113 		m_freem(m);
1114 		ieee80211_free_node(ni);
1115 
1116 		/* descriptor is no longer valid */
1117 		desc->flags &= ~htole32(RT2560_TX_VALID);
1118 
1119 		DPRINTFN(sc, 15, ("tx done idx=%u\n", sc->txq.next));
1120 
1121 		sc->txq.queued--;
1122 		sc->txq.next = (sc->txq.next + 1) % RT2560_TX_RING_COUNT;
1123 	}
1124 
1125 	bus_dmamap_sync(sc->txq.desc_dmat, sc->txq.desc_map,
1126 	    BUS_DMASYNC_PREWRITE);
1127 
1128 	if (sc->txq.queued == 0 && sc->prioq.queued == 0)
1129 		sc->sc_tx_timer = 0;
1130 
1131 	if (sc->txq.queued < RT2560_TX_RING_COUNT - 1) {
1132 		sc->sc_flags &= ~RT2560_FLAG_DATA_OACT;
1133 		if ((sc->sc_flags &
1134 		     (RT2560_FLAG_DATA_OACT | RT2560_FLAG_PRIO_OACT)) == 0)
1135 			ifp->if_flags &= ~IFF_OACTIVE;
1136 		rt2560_start(ifp);
1137 	}
1138 }
1139 
1140 static void
1141 rt2560_prio_intr(struct rt2560_softc *sc)
1142 {
1143 	struct ieee80211com *ic = &sc->sc_ic;
1144 	struct ifnet *ifp = ic->ic_ifp;
1145 	struct rt2560_tx_desc *desc;
1146 	struct rt2560_tx_data *data;
1147 
1148 	bus_dmamap_sync(sc->prioq.desc_dmat, sc->prioq.desc_map,
1149 	    BUS_DMASYNC_POSTREAD);
1150 
1151 	for (;;) {
1152 		desc = &sc->prioq.desc[sc->prioq.next];
1153 		data = &sc->prioq.data[sc->prioq.next];
1154 
1155 		if ((le32toh(desc->flags) & RT2560_TX_BUSY) ||
1156 		    !(le32toh(desc->flags) & RT2560_TX_VALID))
1157 			break;
1158 
1159 		switch (le32toh(desc->flags) & RT2560_TX_RESULT_MASK) {
1160 		case RT2560_TX_SUCCESS:
1161 			DPRINTFN(sc, 10, ("mgt frame sent successfully\n"));
1162 			break;
1163 
1164 		case RT2560_TX_SUCCESS_RETRY:
1165 			DPRINTFN(sc, 9, ("mgt frame sent after %u retries\n",
1166 			    (le32toh(desc->flags) >> 5) & 0x7));
1167 			break;
1168 
1169 		case RT2560_TX_FAIL_RETRY:
1170 			DPRINTFN(sc, 9, ("sending mgt frame failed (too much "
1171 			    "retries)\n"));
1172 			break;
1173 
1174 		case RT2560_TX_FAIL_INVALID:
1175 		case RT2560_TX_FAIL_OTHER:
1176 		default:
1177 			device_printf(sc->sc_dev, "sending mgt frame failed "
1178 			    "0x%08x\n", le32toh(desc->flags));
1179 		}
1180 
1181 		bus_dmamap_sync(sc->prioq.data_dmat, data->map,
1182 		    BUS_DMASYNC_POSTWRITE);
1183 		bus_dmamap_unload(sc->prioq.data_dmat, data->map);
1184 		m_freem(data->m);
1185 		data->m = NULL;
1186 
1187 		KASSERT(data->ni == NULL, ("mgmt node is not empty\n"));
1188 
1189 		/* descriptor is no longer valid */
1190 		desc->flags &= ~htole32(RT2560_TX_VALID);
1191 
1192 		DPRINTFN(sc, 15, ("prio done idx=%u\n", sc->prioq.next));
1193 
1194 		sc->prioq.queued--;
1195 		sc->prioq.next = (sc->prioq.next + 1) % RT2560_PRIO_RING_COUNT;
1196 	}
1197 
1198 	bus_dmamap_sync(sc->prioq.desc_dmat, sc->prioq.desc_map,
1199 	    BUS_DMASYNC_PREWRITE);
1200 
1201 	if (sc->txq.queued == 0 && sc->prioq.queued == 0)
1202 		sc->sc_tx_timer = 0;
1203 
1204 	if (sc->prioq.queued < RT2560_PRIO_RING_COUNT) {
1205 		sc->sc_flags &= ~RT2560_FLAG_PRIO_OACT;
1206 		if ((sc->sc_flags &
1207 		     (RT2560_FLAG_DATA_OACT | RT2560_FLAG_PRIO_OACT)) == 0)
1208 			ifp->if_flags &= ~IFF_OACTIVE;
1209 		rt2560_start(ifp);
1210 	}
1211 }
1212 
1213 /*
1214  * Some frames were processed by the hardware cipher engine and are ready for
1215  * transmission to the IEEE802.11 layer.
1216  */
1217 static void
1218 rt2560_decryption_intr(struct rt2560_softc *sc)
1219 {
1220 	struct ieee80211com *ic = &sc->sc_ic;
1221 	struct ifnet *ifp = ic->ic_ifp;
1222 	struct rt2560_rx_desc *desc;
1223 	struct rt2560_rx_data *data;
1224 	bus_addr_t physaddr;
1225 	struct ieee80211_frame *wh;
1226 	struct ieee80211_node *ni;
1227 	struct mbuf *mnew, *m;
1228 	int hw, error;
1229 
1230 	/* retrieve last decriptor index processed by cipher engine */
1231 	hw = RAL_READ(sc, RT2560_SECCSR0) - sc->rxq.physaddr;
1232 	hw /= RT2560_RX_DESC_SIZE;
1233 
1234 	bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
1235 	    BUS_DMASYNC_POSTREAD);
1236 
1237 	for (; sc->rxq.cur_decrypt != hw;) {
1238 		int rssi;
1239 
1240 		desc = &sc->rxq.desc[sc->rxq.cur_decrypt];
1241 		data = &sc->rxq.data[sc->rxq.cur_decrypt];
1242 
1243 		if ((le32toh(desc->flags) & RT2560_RX_BUSY) ||
1244 		    (le32toh(desc->flags) & RT2560_RX_CIPHER_BUSY))
1245 			break;
1246 
1247 		if (data->drop) {
1248 			ifp->if_ierrors++;
1249 			goto skip;
1250 		}
1251 
1252 		if ((le32toh(desc->flags) & RT2560_RX_CIPHER_MASK) != 0 &&
1253 		    (le32toh(desc->flags) & RT2560_RX_ICV_ERROR)) {
1254 			ifp->if_ierrors++;
1255 			goto skip;
1256 		}
1257 
1258 		/*
1259 		 * Try to allocate a new mbuf for this ring element and load it
1260 		 * before processing the current mbuf. If the ring element
1261 		 * cannot be loaded, drop the received packet and reuse the old
1262 		 * mbuf. In the unlikely case that the old mbuf can't be
1263 		 * reloaded either, explicitly panic.
1264 		 */
1265 		mnew = m_getcl(MB_DONTWAIT, MT_DATA, M_PKTHDR);
1266 		if (mnew == NULL) {
1267 			ifp->if_ierrors++;
1268 			goto skip;
1269 		}
1270 
1271 		bus_dmamap_sync(sc->rxq.data_dmat, data->map,
1272 		    BUS_DMASYNC_POSTREAD);
1273 		bus_dmamap_unload(sc->rxq.data_dmat, data->map);
1274 
1275 		error = bus_dmamap_load(sc->rxq.data_dmat, data->map,
1276 		    mtod(mnew, void *), MCLBYTES, rt2560_dma_map_addr,
1277 		    &physaddr, 0);
1278 		if (error != 0) {
1279 			m_freem(mnew);
1280 
1281 			/* try to reload the old mbuf */
1282 			error = bus_dmamap_load(sc->rxq.data_dmat, data->map,
1283 			    mtod(data->m, void *), MCLBYTES,
1284 			    rt2560_dma_map_addr, &physaddr, 0);
1285 			if (error != 0) {
1286 				/* very unlikely that it will fail... */
1287 				panic("%s: could not load old rx mbuf",
1288 				    device_get_name(sc->sc_dev));
1289 			}
1290 			ifp->if_ierrors++;
1291 			goto skip;
1292 		}
1293 
1294 		/*
1295 	 	 * New mbuf successfully loaded, update Rx ring and continue
1296 		 * processing.
1297 		 */
1298 		m = data->m;
1299 		data->m = mnew;
1300 		desc->physaddr = htole32(physaddr);
1301 
1302 		/* finalize mbuf */
1303 		m->m_pkthdr.rcvif = ifp;
1304 		m->m_pkthdr.len = m->m_len =
1305 		    (le32toh(desc->flags) >> 16) & 0xfff;
1306 
1307 		rssi = RT2560_RSSI(sc, desc->rssi);
1308 		if (sc->sc_avgrssi < 0)
1309 			sc->sc_avgrssi = rssi;
1310 		else
1311 			sc->sc_avgrssi = ((sc->sc_avgrssi * 7) + rssi) >> 3;
1312 
1313 		if (sc->sc_drvbpf != NULL) {
1314 			struct rt2560_rx_radiotap_header *tap = &sc->sc_rxtap;
1315 			uint32_t tsf_lo, tsf_hi;
1316 
1317 			/* get timestamp (low and high 32 bits) */
1318 			tsf_hi = RAL_READ(sc, RT2560_CSR17);
1319 			tsf_lo = RAL_READ(sc, RT2560_CSR16);
1320 
1321 			tap->wr_tsf =
1322 			    htole64(((uint64_t)tsf_hi << 32) | tsf_lo);
1323 			tap->wr_flags = 0;
1324 			tap->wr_rate = rt2560_rxrate(desc);
1325 			tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
1326 			tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
1327 			tap->wr_antenna = sc->rx_ant;
1328 			tap->wr_antsignal = rssi;
1329 
1330 			bpf_ptap(sc->sc_drvbpf, m, tap, sc->sc_rxtap_len);
1331 		}
1332 
1333 		wh = mtod(m, struct ieee80211_frame *);
1334 		ni = ieee80211_find_rxnode(ic,
1335 		    (struct ieee80211_frame_min *)wh);
1336 
1337 		/* send the frame to the 802.11 layer */
1338 		ieee80211_input(ic, m, ni, rssi, 0);
1339 
1340 		/* node is no longer needed */
1341 		ieee80211_free_node(ni);
1342 
1343 skip:		desc->flags = htole32(RT2560_RX_BUSY);
1344 
1345 		DPRINTFN(sc, 15, ("decryption done idx=%u\n",
1346 			 sc->rxq.cur_decrypt));
1347 
1348 		sc->rxq.cur_decrypt =
1349 		    (sc->rxq.cur_decrypt + 1) % RT2560_RX_RING_COUNT;
1350 	}
1351 
1352 	bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
1353 	    BUS_DMASYNC_PREWRITE);
1354 }
1355 
1356 /*
1357  * Some frames were received. Pass them to the hardware cipher engine before
1358  * sending them to the 802.11 layer.
1359  */
1360 static void
1361 rt2560_rx_intr(struct rt2560_softc *sc)
1362 {
1363 	struct rt2560_rx_desc *desc;
1364 	struct rt2560_rx_data *data;
1365 
1366 	bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
1367 	    BUS_DMASYNC_POSTREAD);
1368 
1369 	for (;;) {
1370 		desc = &sc->rxq.desc[sc->rxq.cur];
1371 		data = &sc->rxq.data[sc->rxq.cur];
1372 
1373 		if ((le32toh(desc->flags) & RT2560_RX_BUSY) ||
1374 		    (le32toh(desc->flags) & RT2560_RX_CIPHER_BUSY))
1375 			break;
1376 
1377 		data->drop = 0;
1378 
1379 		if ((le32toh(desc->flags) & RT2560_RX_PHY_ERROR) ||
1380 		    (le32toh(desc->flags) & RT2560_RX_CRC_ERROR)) {
1381 			/*
1382 			 * This should not happen since we did not request
1383 			 * to receive those frames when we filled RXCSR0.
1384 			 */
1385 			DPRINTFN(sc, 5, ("PHY or CRC error flags 0x%08x\n",
1386 			    le32toh(desc->flags)));
1387 			data->drop = 1;
1388 		}
1389 
1390 		if (((le32toh(desc->flags) >> 16) & 0xfff) > MCLBYTES) {
1391 			DPRINTFN(sc, 5, ("bad length\n"));
1392 			data->drop = 1;
1393 		}
1394 
1395 		/* mark the frame for decryption */
1396 		desc->flags |= htole32(RT2560_RX_CIPHER_BUSY);
1397 
1398 		DPRINTFN(sc, 15, ("rx done idx=%u\n", sc->rxq.cur));
1399 
1400 		sc->rxq.cur = (sc->rxq.cur + 1) % RT2560_RX_RING_COUNT;
1401 	}
1402 
1403 	bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
1404 	    BUS_DMASYNC_PREWRITE);
1405 
1406 	/* kick decrypt */
1407 	RAL_WRITE(sc, RT2560_SECCSR0, RT2560_KICK_DECRYPT);
1408 }
1409 
1410 /*
1411  * This function is called periodically in IBSS mode when a new beacon must be
1412  * sent out.
1413  */
1414 static void
1415 rt2560_beacon_expire(struct rt2560_softc *sc)
1416 {
1417 	struct ieee80211com *ic = &sc->sc_ic;
1418 	struct rt2560_tx_data *data;
1419 
1420 	if (ic->ic_opmode != IEEE80211_M_IBSS &&
1421 	    ic->ic_opmode != IEEE80211_M_HOSTAP)
1422 		return;
1423 
1424 	data = &sc->bcnq.data[sc->bcnq.next];
1425 
1426 	bus_dmamap_sync(sc->bcnq.data_dmat, data->map, BUS_DMASYNC_POSTWRITE);
1427 	bus_dmamap_unload(sc->bcnq.data_dmat, data->map);
1428 
1429 	ieee80211_beacon_update(ic, data->ni, &sc->sc_bo, data->m, 1);
1430 
1431 	if (ic->ic_rawbpf != NULL)
1432 		bpf_mtap(ic->ic_rawbpf, data->m);
1433 
1434 	rt2560_tx_bcn(sc, data->m, data->ni);
1435 
1436 	DPRINTFN(sc, 15, ("beacon expired\n"));
1437 
1438 	sc->bcnq.next = (sc->bcnq.next + 1) % RT2560_BEACON_RING_COUNT;
1439 }
1440 
1441 /* ARGSUSED */
1442 static void
1443 rt2560_wakeup_expire(struct rt2560_softc *sc)
1444 {
1445 	DPRINTFN(sc, 2, ("wakeup expired\n"));
1446 }
1447 
1448 static void
1449 rt2560_intr(void *arg)
1450 {
1451 	struct rt2560_softc *sc = arg;
1452 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1453 	uint32_t r;
1454 
1455 	/* disable interrupts */
1456 	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
1457 
1458 	/* don't re-enable interrupts if we're shutting down */
1459 	if (!(ifp->if_flags & IFF_RUNNING))
1460 		return;
1461 
1462 	r = RAL_READ(sc, RT2560_CSR7);
1463 	RAL_WRITE(sc, RT2560_CSR7, r);
1464 
1465 	if (r & RT2560_BEACON_EXPIRE)
1466 		rt2560_beacon_expire(sc);
1467 
1468 	if (r & RT2560_WAKEUP_EXPIRE)
1469 		rt2560_wakeup_expire(sc);
1470 
1471 	if (r & RT2560_PRIO_DONE)
1472 		rt2560_prio_intr(sc);
1473 
1474 	if (r & (RT2560_RX_DONE | RT2560_TX_DONE | RT2560_ENCRYPTION_DONE)) {
1475 		int i;
1476 
1477 		for (i = 0; i < 2; ++i) {
1478 			rt2560_tx_intr(sc);
1479 			rt2560_encryption_intr(sc);
1480 		}
1481 	}
1482 
1483 	if (r & (RT2560_DECRYPTION_DONE | RT2560_RX_DONE)) {
1484 		int i;
1485 
1486 		for (i = 0; i < 2; ++i) {
1487 			rt2560_decryption_intr(sc);
1488 			rt2560_rx_intr(sc);
1489 		}
1490 	}
1491 
1492 	/* re-enable interrupts */
1493 	RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
1494 }
1495 
1496 /* quickly determine if a given rate is CCK or OFDM */
1497 #define RAL_RATE_IS_OFDM(rate) ((rate) >= 12 && (rate) != 22)
1498 
1499 #define RAL_ACK_SIZE	(sizeof(struct ieee80211_frame_ack) + IEEE80211_CRC_LEN)
1500 #define RAL_CTS_SIZE	(sizeof(struct ieee80211_frame_cts) + IEEE80211_CRC_LEN)
1501 
1502 #define RT2560_TXRX_TURNAROUND	10	/* us */
1503 
1504 /*
1505  * This function is only used by the Rx radiotap code.
1506  */
1507 static uint8_t
1508 rt2560_rxrate(struct rt2560_rx_desc *desc)
1509 {
1510 	if (le32toh(desc->flags) & RT2560_RX_OFDM) {
1511 		/* reverse function of rt2560_plcp_signal */
1512 		switch (desc->rate) {
1513 		case 0xb:	return 12;
1514 		case 0xf:	return 18;
1515 		case 0xa:	return 24;
1516 		case 0xe:	return 36;
1517 		case 0x9:	return 48;
1518 		case 0xd:	return 72;
1519 		case 0x8:	return 96;
1520 		case 0xc:	return 108;
1521 		}
1522 	} else {
1523 		if (desc->rate == 10)
1524 			return 2;
1525 		if (desc->rate == 20)
1526 			return 4;
1527 		if (desc->rate == 55)
1528 			return 11;
1529 		if (desc->rate == 110)
1530 			return 22;
1531 	}
1532 	return 2;	/* should not get there */
1533 }
1534 
1535 static uint8_t
1536 rt2560_plcp_signal(int rate)
1537 {
1538 	switch (rate) {
1539 	/* CCK rates (returned values are device-dependent) */
1540 	case 2:		return 0x0;
1541 	case 4:		return 0x1;
1542 	case 11:	return 0x2;
1543 	case 22:	return 0x3;
1544 
1545 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1546 	case 12:	return 0xb;
1547 	case 18:	return 0xf;
1548 	case 24:	return 0xa;
1549 	case 36:	return 0xe;
1550 	case 48:	return 0x9;
1551 	case 72:	return 0xd;
1552 	case 96:	return 0x8;
1553 	case 108:	return 0xc;
1554 
1555 	/* unsupported rates (should not get there) */
1556 	default:	return 0xff;
1557 	}
1558 }
1559 
1560 static void
1561 rt2560_setup_tx_desc(struct rt2560_softc *sc, struct rt2560_tx_desc *desc,
1562     uint32_t flags, int len, int rate, int encrypt, bus_addr_t physaddr)
1563 {
1564 	struct ieee80211com *ic = &sc->sc_ic;
1565 	uint16_t plcp_length;
1566 	int remainder;
1567 
1568 	desc->flags = htole32(flags);
1569 	desc->flags |= htole32(len << 16);
1570 
1571 	desc->physaddr = htole32(physaddr);
1572 	desc->wme = htole16(
1573 	    RT2560_AIFSN(2) |
1574 	    RT2560_LOGCWMIN(3) |
1575 	    RT2560_LOGCWMAX(8));
1576 
1577 	/* setup PLCP fields */
1578 	desc->plcp_signal  = rt2560_plcp_signal(rate);
1579 	desc->plcp_service = 4;
1580 
1581 	len += IEEE80211_CRC_LEN;
1582 	if (RAL_RATE_IS_OFDM(rate)) {
1583 		desc->flags |= htole32(RT2560_TX_OFDM);
1584 
1585 		plcp_length = len & 0xfff;
1586 		desc->plcp_length_hi = plcp_length >> 6;
1587 		desc->plcp_length_lo = plcp_length & 0x3f;
1588 	} else {
1589 		plcp_length = (16 * len + rate - 1) / rate;
1590 		if (rate == 22) {
1591 			remainder = (16 * len) % 22;
1592 			if (remainder != 0 && remainder < 7)
1593 				desc->plcp_service |= RT2560_PLCP_LENGEXT;
1594 		}
1595 		desc->plcp_length_hi = plcp_length >> 8;
1596 		desc->plcp_length_lo = plcp_length & 0xff;
1597 
1598 		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1599 			desc->plcp_signal |= 0x08;
1600 	}
1601 
1602 	if (!encrypt)
1603 		desc->flags |= htole32(RT2560_TX_VALID);
1604 	desc->flags |= encrypt ? htole32(RT2560_TX_CIPHER_BUSY)
1605 			       : htole32(RT2560_TX_BUSY);
1606 }
1607 
1608 static int
1609 rt2560_tx_bcn(struct rt2560_softc *sc, struct mbuf *m0,
1610     struct ieee80211_node *ni)
1611 {
1612 	struct ieee80211com *ic = &sc->sc_ic;
1613 	struct rt2560_tx_desc *desc;
1614 	struct rt2560_tx_data *data;
1615 	bus_addr_t paddr;
1616 	int rate, error;
1617 
1618 	desc = &sc->bcnq.desc[sc->bcnq.cur];
1619 	data = &sc->bcnq.data[sc->bcnq.cur];
1620 
1621 	rate = IEEE80211_IS_CHAN_5GHZ(ni->ni_chan) ? 12 : 2;
1622 
1623 	error = bus_dmamap_load_mbuf(sc->bcnq.data_dmat, data->map, m0,
1624 				     rt2560_dma_map_mbuf, &paddr,
1625 				     BUS_DMA_NOWAIT);
1626 	if (error != 0) {
1627 		device_printf(sc->sc_dev, "could not map mbuf (error %d)\n",
1628 		    error);
1629 		m_freem(m0);
1630 		return error;
1631 	}
1632 
1633 	if (sc->sc_drvbpf != NULL) {
1634 		struct rt2560_tx_radiotap_header *tap = &sc->sc_txtap;
1635 
1636 		tap->wt_flags = 0;
1637 		tap->wt_rate = rate;
1638 		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1639 		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1640 		tap->wt_antenna = sc->tx_ant;
1641 
1642 		bpf_ptap(sc->sc_drvbpf, m0, tap, sc->sc_txtap_len);
1643 	}
1644 
1645 	data->m = m0;
1646 	data->ni = ni;
1647 
1648 	rt2560_setup_tx_desc(sc, desc, RT2560_TX_IFS_NEWBACKOFF |
1649 	    RT2560_TX_TIMESTAMP, m0->m_pkthdr.len, rate, 0, paddr);
1650 
1651 	DPRINTFN(sc, 10, ("sending beacon frame len=%u idx=%u rate=%u\n",
1652 	    m0->m_pkthdr.len, sc->bcnq.cur, rate));
1653 
1654 	bus_dmamap_sync(sc->bcnq.data_dmat, data->map, BUS_DMASYNC_PREWRITE);
1655 	bus_dmamap_sync(sc->bcnq.desc_dmat, sc->bcnq.desc_map,
1656 	    BUS_DMASYNC_PREWRITE);
1657 
1658 	sc->bcnq.cur = (sc->bcnq.cur + 1) % RT2560_BEACON_RING_COUNT;
1659 
1660 	return 0;
1661 }
1662 
1663 static int
1664 rt2560_tx_mgt(struct rt2560_softc *sc, struct mbuf *m0,
1665     struct ieee80211_node *ni)
1666 {
1667 	struct ieee80211com *ic = &sc->sc_ic;
1668 	struct rt2560_tx_desc *desc;
1669 	struct rt2560_tx_data *data;
1670 	struct ieee80211_frame *wh;
1671 	bus_addr_t paddr;
1672 	uint16_t dur;
1673 	uint32_t flags = 0;
1674 	int rate, error;
1675 
1676 	desc = &sc->prioq.desc[sc->prioq.cur];
1677 	data = &sc->prioq.data[sc->prioq.cur];
1678 
1679 	rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
1680 
1681 	error = bus_dmamap_load_mbuf(sc->prioq.data_dmat, data->map, m0,
1682 				     rt2560_dma_map_mbuf, &paddr, 0);
1683 	if (error != 0) {
1684 		device_printf(sc->sc_dev, "could not map mbuf (error %d)\n",
1685 		    error);
1686 		ieee80211_free_node(ni);
1687 		m_freem(m0);
1688 		return error;
1689 	}
1690 
1691 	if (sc->sc_drvbpf != NULL) {
1692 		struct rt2560_tx_radiotap_header *tap = &sc->sc_txtap;
1693 
1694 		tap->wt_flags = 0;
1695 		tap->wt_rate = rate;
1696 		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1697 		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1698 		tap->wt_antenna = sc->tx_ant;
1699 
1700 		bpf_ptap(sc->sc_drvbpf, m0, tap, sc->sc_txtap_len);
1701 	}
1702 
1703 	data->m = m0;
1704 	data->ni = NULL;
1705 
1706 	wh = mtod(m0, struct ieee80211_frame *);
1707 
1708 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1709 		flags |= RT2560_TX_ACK;
1710 
1711 		dur = ieee80211_txtime(ni, RAL_ACK_SIZE, rate, ic->ic_flags) +
1712 		      sc->sc_sifs;
1713 		*(uint16_t *)wh->i_dur = htole16(dur);
1714 
1715 		/* tell hardware to add timestamp for probe responses */
1716 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1717 		    IEEE80211_FC0_TYPE_MGT &&
1718 		    (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1719 		    IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1720 			flags |= RT2560_TX_TIMESTAMP;
1721 	}
1722 
1723 	rt2560_setup_tx_desc(sc, desc, flags, m0->m_pkthdr.len, rate, 0, paddr);
1724 
1725 	bus_dmamap_sync(sc->prioq.data_dmat, data->map, BUS_DMASYNC_PREWRITE);
1726 	bus_dmamap_sync(sc->prioq.desc_dmat, sc->prioq.desc_map,
1727 	    BUS_DMASYNC_PREWRITE);
1728 
1729 	DPRINTFN(sc, 10, ("sending mgt frame len=%u idx=%u rate=%u\n",
1730 	    m0->m_pkthdr.len, sc->prioq.cur, rate));
1731 
1732 	/* kick prio */
1733 	sc->prioq.queued++;
1734 	sc->prioq.cur = (sc->prioq.cur + 1) % RT2560_PRIO_RING_COUNT;
1735 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_PRIO);
1736 
1737 	ieee80211_free_node(ni);
1738 
1739 	return 0;
1740 }
1741 
1742 /*
1743  * Build a RTS control frame.
1744  */
1745 static struct mbuf *
1746 rt2560_get_rts(struct rt2560_softc *sc, struct ieee80211_frame *wh,
1747     uint16_t dur)
1748 {
1749 	struct ieee80211_frame_rts *rts;
1750 	struct mbuf *m;
1751 
1752 	MGETHDR(m, MB_DONTWAIT, MT_DATA);
1753 	if (m == NULL) {
1754 		sc->sc_ic.ic_stats.is_tx_nobuf++;
1755 		device_printf(sc->sc_dev, "could not allocate RTS frame\n");
1756 		return NULL;
1757 	}
1758 
1759 	rts = mtod(m, struct ieee80211_frame_rts *);
1760 
1761 	rts->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_CTL |
1762 	    IEEE80211_FC0_SUBTYPE_RTS;
1763 	rts->i_fc[1] = IEEE80211_FC1_DIR_NODS;
1764 	*(uint16_t *)rts->i_dur = htole16(dur);
1765 	IEEE80211_ADDR_COPY(rts->i_ra, wh->i_addr1);
1766 	IEEE80211_ADDR_COPY(rts->i_ta, wh->i_addr2);
1767 
1768 	m->m_pkthdr.len = m->m_len = sizeof(struct ieee80211_frame_rts);
1769 
1770 	return m;
1771 }
1772 
1773 static int
1774 rt2560_tx_data(struct rt2560_softc *sc, struct mbuf *m0,
1775     struct ieee80211_node *ni)
1776 {
1777 	struct ieee80211com *ic = &sc->sc_ic;
1778 	struct rt2560_tx_desc *desc;
1779 	struct rt2560_tx_data *data;
1780 	struct ieee80211_frame *wh;
1781 	struct ieee80211_key *k;
1782 	struct mbuf *mnew;
1783 	bus_addr_t paddr;
1784 	uint16_t dur;
1785 	uint32_t flags = 0;
1786 	int rate, error, ackrate, rateidx;
1787 
1788 	wh = mtod(m0, struct ieee80211_frame *);
1789 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1790 		k = ieee80211_crypto_encap(ic, ni, m0);
1791 		if (k == NULL) {
1792 			m_freem(m0);
1793 			return ENOBUFS;
1794 		}
1795 
1796 		/* packet header may have moved, reset our local pointer */
1797 		wh = mtod(m0, struct ieee80211_frame *);
1798 	}
1799 
1800 	ieee80211_ratectl_findrate(ni, m0->m_pkthdr.len, &rateidx, 1);
1801 	rate = IEEE80211_RS_RATE(&ni->ni_rates, rateidx);
1802 
1803 	ackrate = ieee80211_ack_rate(ni, rate);
1804 
1805 	/*
1806 	 * IEEE Std 802.11-1999, pp 82: "A STA shall use an RTS/CTS exchange
1807 	 * for directed frames only when the length of the MPDU is greater
1808 	 * than the length threshold indicated by [...]" ic_rtsthreshold.
1809 	 */
1810 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1811 	    m0->m_pkthdr.len > ic->ic_rtsthreshold) {
1812 		struct mbuf *m;
1813 		uint16_t dur;
1814 		int rtsrate;
1815 
1816 		rtsrate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
1817 		dur = ieee80211_txtime(ni, m0->m_pkthdr.len + IEEE80211_CRC_LEN,
1818 				       rate, ic->ic_flags) +
1819 		      ieee80211_txtime(ni, RAL_CTS_SIZE, rtsrate, ic->ic_flags)+
1820 		      ieee80211_txtime(ni, RAL_ACK_SIZE, ackrate, ic->ic_flags)+
1821 		      3 * sc->sc_sifs;
1822 
1823 		m = rt2560_get_rts(sc, wh, dur);
1824 
1825 		desc = &sc->txq.desc[sc->txq.cur_encrypt];
1826 		data = &sc->txq.data[sc->txq.cur_encrypt];
1827 
1828 		error = bus_dmamap_load_mbuf(sc->txq.data_dmat, data->map,
1829 					     m, rt2560_dma_map_mbuf, &paddr, 0);
1830 		if (error != 0) {
1831 			device_printf(sc->sc_dev,
1832 			    "could not map mbuf (error %d)\n", error);
1833 			m_freem(m);
1834 			m_freem(m0);
1835 			return error;
1836 		}
1837 
1838 		/* avoid multiple free() of the same node for each fragment */
1839 		ieee80211_ref_node(ni);
1840 
1841 		data->m = m;
1842 		data->ni = ni;
1843 		data->rateidx = -1;	/* don't count RTS */
1844 
1845 		rt2560_setup_tx_desc(sc, desc, RT2560_TX_ACK |
1846 		    RT2560_TX_MORE_FRAG, m->m_pkthdr.len, rtsrate, 1, paddr);
1847 
1848 		bus_dmamap_sync(sc->txq.data_dmat, data->map,
1849 		    BUS_DMASYNC_PREWRITE);
1850 
1851 		sc->txq.queued++;
1852 		sc->txq.cur_encrypt =
1853 		    (sc->txq.cur_encrypt + 1) % RT2560_TX_RING_COUNT;
1854 
1855 		/*
1856 		 * IEEE Std 802.11-1999: when an RTS/CTS exchange is used, the
1857 		 * asynchronous data frame shall be transmitted after the CTS
1858 		 * frame and a SIFS period.
1859 		 */
1860 		flags |= RT2560_TX_LONG_RETRY | RT2560_TX_IFS_SIFS;
1861 	}
1862 
1863 	data = &sc->txq.data[sc->txq.cur_encrypt];
1864 	desc = &sc->txq.desc[sc->txq.cur_encrypt];
1865 
1866 	error = bus_dmamap_load_mbuf(sc->txq.data_dmat, data->map, m0,
1867 				     rt2560_dma_map_mbuf, &paddr, 0);
1868 	if (error != 0 && error != EFBIG) {
1869 		device_printf(sc->sc_dev, "could not map mbuf (error %d)\n",
1870 		    error);
1871 		m_freem(m0);
1872 		return error;
1873 	}
1874 	if (error != 0) {
1875 		mnew = m_defrag(m0, MB_DONTWAIT);
1876 		if (mnew == NULL) {
1877 			device_printf(sc->sc_dev,
1878 			    "could not defragment mbuf\n");
1879 			m_freem(m0);
1880 			return ENOBUFS;
1881 		}
1882 		m0 = mnew;
1883 
1884 		error = bus_dmamap_load_mbuf(sc->txq.data_dmat, data->map,
1885 					     m0, rt2560_dma_map_mbuf, &paddr,
1886 					     0);
1887 		if (error != 0) {
1888 			device_printf(sc->sc_dev,
1889 			    "could not map mbuf (error %d)\n", error);
1890 			m_freem(m0);
1891 			return error;
1892 		}
1893 
1894 		/* packet header may have moved, reset our local pointer */
1895 		wh = mtod(m0, struct ieee80211_frame *);
1896 	}
1897 
1898 	if (sc->sc_drvbpf != NULL) {
1899 		struct rt2560_tx_radiotap_header *tap = &sc->sc_txtap;
1900 
1901 		tap->wt_flags = 0;
1902 		tap->wt_rate = rate;
1903 		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1904 		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1905 		tap->wt_antenna = sc->tx_ant;
1906 
1907 		bpf_ptap(sc->sc_drvbpf, m0, tap, sc->sc_txtap_len);
1908 	}
1909 
1910 	data->m = m0;
1911 	data->ni = ni;
1912 	data->rateidx = rateidx;
1913 
1914 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1915 		flags |= RT2560_TX_ACK;
1916 		dur = ieee80211_txtime(ni, RAL_ACK_SIZE, ackrate, ic->ic_flags)+
1917 		      sc->sc_sifs;
1918 		*(uint16_t *)wh->i_dur = htole16(dur);
1919 	}
1920 
1921 	rt2560_setup_tx_desc(sc, desc, flags, m0->m_pkthdr.len, rate, 1, paddr);
1922 
1923 	bus_dmamap_sync(sc->txq.data_dmat, data->map, BUS_DMASYNC_PREWRITE);
1924 	bus_dmamap_sync(sc->txq.desc_dmat, sc->txq.desc_map,
1925 	    BUS_DMASYNC_PREWRITE);
1926 
1927 	DPRINTFN(sc, 10, ("sending data frame len=%u idx=%u rate=%u\n",
1928 	    m0->m_pkthdr.len, sc->txq.cur_encrypt, rate));
1929 
1930 	/* kick encrypt */
1931 	sc->txq.queued++;
1932 	sc->txq.cur_encrypt = (sc->txq.cur_encrypt + 1) % RT2560_TX_RING_COUNT;
1933 	RAL_WRITE(sc, RT2560_SECCSR1, RT2560_KICK_ENCRYPT);
1934 
1935 	return 0;
1936 }
1937 
1938 static void
1939 rt2560_start(struct ifnet *ifp)
1940 {
1941 	struct rt2560_softc *sc = ifp->if_softc;
1942 	struct ieee80211com *ic = &sc->sc_ic;
1943 	struct mbuf *m0;
1944 	struct ether_header *eh;
1945 	struct ieee80211_node *ni;
1946 
1947 	/* prevent management frames from being sent if we're not ready */
1948 	if (!(ifp->if_flags & IFF_RUNNING))
1949 		return;
1950 
1951 	for (;;) {
1952 		IF_POLL(&ic->ic_mgtq, m0);
1953 		if (m0 != NULL) {
1954 			if (sc->prioq.queued >= RT2560_PRIO_RING_COUNT) {
1955 				ifp->if_flags |= IFF_OACTIVE;
1956 				sc->sc_flags |= RT2560_FLAG_PRIO_OACT;
1957 				break;
1958 			}
1959 			IF_DEQUEUE(&ic->ic_mgtq, m0);
1960 
1961 			ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
1962 			m0->m_pkthdr.rcvif = NULL;
1963 
1964 			if (ic->ic_rawbpf != NULL)
1965 				bpf_mtap(ic->ic_rawbpf, m0);
1966 
1967 			if (rt2560_tx_mgt(sc, m0, ni) != 0)
1968 				break;
1969 
1970 		} else {
1971 			if (ic->ic_state != IEEE80211_S_RUN)
1972 				break;
1973 			m0 = ifq_poll(&ifp->if_snd);
1974 			if (m0 == NULL)
1975 				break;
1976 			if (sc->txq.queued >= RT2560_TX_RING_COUNT - 1) {
1977 				ifp->if_flags |= IFF_OACTIVE;
1978 				sc->sc_flags |= RT2560_FLAG_DATA_OACT;
1979 				break;
1980 			}
1981 			m0 = ifq_dequeue(&ifp->if_snd, m0);
1982 
1983 			if (m0->m_len < sizeof (struct ether_header) &&
1984 			    !(m0 = m_pullup(m0, sizeof (struct ether_header))))
1985 				continue;
1986 
1987 			eh = mtod(m0, struct ether_header *);
1988 			ni = ieee80211_find_txnode(ic, eh->ether_dhost);
1989 			if (ni == NULL) {
1990 				m_freem(m0);
1991 				continue;
1992 			}
1993 			BPF_MTAP(ifp, m0);
1994 
1995 			m0 = ieee80211_encap(ic, m0, ni);
1996 			if (m0 == NULL) {
1997 				ieee80211_free_node(ni);
1998 				continue;
1999 			}
2000 
2001 			if (ic->ic_rawbpf != NULL)
2002 				bpf_mtap(ic->ic_rawbpf, m0);
2003 
2004 			if (rt2560_tx_data(sc, m0, ni) != 0) {
2005 				ieee80211_free_node(ni);
2006 				ifp->if_oerrors++;
2007 				break;
2008 			}
2009 		}
2010 
2011 		sc->sc_tx_timer = 5;
2012 		ifp->if_timer = 1;
2013 	}
2014 }
2015 
2016 static void
2017 rt2560_watchdog(struct ifnet *ifp)
2018 {
2019 	struct rt2560_softc *sc = ifp->if_softc;
2020 	struct ieee80211com *ic = &sc->sc_ic;
2021 
2022 	ifp->if_timer = 0;
2023 
2024 	if (sc->sc_tx_timer > 0) {
2025 		if (--sc->sc_tx_timer == 0) {
2026 			device_printf(sc->sc_dev, "device timeout\n");
2027 			rt2560_init(sc);
2028 			ifp->if_oerrors++;
2029 			return;
2030 		}
2031 		ifp->if_timer = 1;
2032 	}
2033 
2034 	ieee80211_watchdog(ic);
2035 }
2036 
2037 /*
2038  * This function allows for fast channel switching in monitor mode (used by
2039  * net-mgmt/kismet). In IBSS mode, we must explicitly reset the interface to
2040  * generate a new beacon frame.
2041  */
2042 static int
2043 rt2560_reset(struct ifnet *ifp)
2044 {
2045 	struct rt2560_softc *sc = ifp->if_softc;
2046 	struct ieee80211com *ic = &sc->sc_ic;
2047 
2048 	if (ic->ic_opmode != IEEE80211_M_MONITOR)
2049 		return ENETRESET;
2050 
2051 	rt2560_set_chan(sc, ic->ic_curchan);
2052 
2053 	return 0;
2054 }
2055 
2056 static int
2057 rt2560_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
2058 {
2059 	struct rt2560_softc *sc = ifp->if_softc;
2060 	struct ieee80211com *ic = &sc->sc_ic;
2061 	int error = 0;
2062 
2063 	switch (cmd) {
2064 	case SIOCSIFFLAGS:
2065 		if (ifp->if_flags & IFF_UP) {
2066 			if (ifp->if_flags & IFF_RUNNING)
2067 				rt2560_update_promisc(sc);
2068 			else
2069 				rt2560_init(sc);
2070 		} else {
2071 			if (ifp->if_flags & IFF_RUNNING)
2072 				rt2560_stop(sc);
2073 		}
2074 		break;
2075 
2076 	default:
2077 		error = ieee80211_ioctl(ic, cmd, data, cr);
2078 	}
2079 
2080 	if (error == ENETRESET) {
2081 		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
2082 		    (IFF_UP | IFF_RUNNING) &&
2083 		    (ic->ic_roaming != IEEE80211_ROAMING_MANUAL))
2084 			rt2560_init(sc);
2085 		error = 0;
2086 	}
2087 
2088 	return error;
2089 }
2090 
2091 static void
2092 rt2560_bbp_write(struct rt2560_softc *sc, uint8_t reg, uint8_t val)
2093 {
2094 	uint32_t tmp;
2095 	int ntries;
2096 
2097 	for (ntries = 0; ntries < 100; ntries++) {
2098 		if (!(RAL_READ(sc, RT2560_BBPCSR) & RT2560_BBP_BUSY))
2099 			break;
2100 		DELAY(1);
2101 	}
2102 	if (ntries == 100) {
2103 		device_printf(sc->sc_dev, "could not write to BBP\n");
2104 		return;
2105 	}
2106 
2107 	tmp = RT2560_BBP_WRITE | RT2560_BBP_BUSY | reg << 8 | val;
2108 	RAL_WRITE(sc, RT2560_BBPCSR, tmp);
2109 
2110 	DPRINTFN(sc, 15, ("BBP R%u <- 0x%02x\n", reg, val));
2111 
2112 	/* XXX */
2113 	if (reg == 17) {
2114 		DPRINTF(sc, ("%s record bbp17 %#x\n", __func__, val));
2115 		sc->sc_bbp17 = val;
2116 	}
2117 }
2118 
2119 static uint8_t
2120 rt2560_bbp_read(struct rt2560_softc *sc, uint8_t reg)
2121 {
2122 	uint32_t val;
2123 	int ntries;
2124 
2125 	for (ntries = 0; ntries < 100; ntries++) {
2126 		if (!(RAL_READ(sc, RT2560_BBPCSR) & RT2560_BBP_BUSY))
2127 			break;
2128 		DELAY(1);
2129 	}
2130 	if (ntries == 100) {
2131 		device_printf(sc->sc_dev, "could not read from BBP\n");
2132 		return 0;
2133 	}
2134 
2135 	val = RT2560_BBP_BUSY | reg << 8;
2136 	RAL_WRITE(sc, RT2560_BBPCSR, val);
2137 
2138 	for (ntries = 0; ntries < 100; ntries++) {
2139 		val = RAL_READ(sc, RT2560_BBPCSR);
2140 		if (!(val & RT2560_BBP_BUSY))
2141 			return val & 0xff;
2142 		DELAY(1);
2143 	}
2144 
2145 	device_printf(sc->sc_dev, "could not read from BBP\n");
2146 	return 0;
2147 }
2148 
2149 static void
2150 rt2560_rf_write(struct rt2560_softc *sc, uint8_t reg, uint32_t val)
2151 {
2152 	uint32_t tmp;
2153 	int ntries;
2154 
2155 	for (ntries = 0; ntries < 100; ntries++) {
2156 		if (!(RAL_READ(sc, RT2560_RFCSR) & RT2560_RF_BUSY))
2157 			break;
2158 		DELAY(1);
2159 	}
2160 	if (ntries == 100) {
2161 		device_printf(sc->sc_dev, "could not write to RF\n");
2162 		return;
2163 	}
2164 
2165 	tmp = RT2560_RF_BUSY | RT2560_RF_20BIT | (val & 0xfffff) << 2 |
2166 	    (reg & 0x3);
2167 	RAL_WRITE(sc, RT2560_RFCSR, tmp);
2168 
2169 	/* remember last written value in sc */
2170 	sc->rf_regs[reg] = val;
2171 
2172 	DPRINTFN(sc, 15, ("RF R[%u] <- 0x%05x\n", reg & 0x3, val & 0xfffff));
2173 }
2174 
2175 static void
2176 rt2560_set_chan(struct rt2560_softc *sc, struct ieee80211_channel *c)
2177 {
2178 	struct ieee80211com *ic = &sc->sc_ic;
2179 	uint8_t power, tmp;
2180 	u_int i, chan;
2181 
2182 	chan = ieee80211_chan2ieee(ic, c);
2183 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
2184 		return;
2185 
2186 	if (IEEE80211_IS_CHAN_2GHZ(c))
2187 		sc->sc_curtxpow = sc->txpow[chan - 1];
2188 	else
2189 		sc->sc_curtxpow = 31;
2190 
2191 	if (ic->ic_txpowlimit > sc->sc_curtxpow)
2192 		ic->ic_txpowlimit = sc->sc_curtxpow;
2193 	else
2194 		sc->sc_curtxpow = ic->ic_txpowlimit;
2195 	ic->ic_bss->ni_txpower = sc->sc_curtxpow;
2196 
2197 	power = sc->sc_curtxpow;
2198 
2199 	DPRINTFN(sc, 2, ("setting channel to %u, txpower to %u\n",
2200 		 chan, power));
2201 
2202 	switch (sc->rf_rev) {
2203 	case RT2560_RF_2522:
2204 		rt2560_rf_write(sc, RAL_RF1, 0x00814);
2205 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2522_r2[chan - 1]);
2206 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
2207 		break;
2208 
2209 	case RT2560_RF_2523:
2210 		rt2560_rf_write(sc, RAL_RF1, 0x08804);
2211 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2523_r2[chan - 1]);
2212 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x38044);
2213 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
2214 		break;
2215 
2216 	case RT2560_RF_2524:
2217 		rt2560_rf_write(sc, RAL_RF1, 0x0c808);
2218 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2524_r2[chan - 1]);
2219 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
2220 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
2221 		break;
2222 
2223 	case RT2560_RF_2525:
2224 		rt2560_rf_write(sc, RAL_RF1, 0x08808);
2225 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525_hi_r2[chan - 1]);
2226 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
2227 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
2228 
2229 		rt2560_rf_write(sc, RAL_RF1, 0x08808);
2230 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525_r2[chan - 1]);
2231 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
2232 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
2233 		break;
2234 
2235 	case RT2560_RF_2525E:
2236 		rt2560_rf_write(sc, RAL_RF1, 0x08808);
2237 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525e_r2[chan - 1]);
2238 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
2239 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00286 : 0x00282);
2240 		break;
2241 
2242 	case RT2560_RF_2526:
2243 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2526_hi_r2[chan - 1]);
2244 		rt2560_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
2245 		rt2560_rf_write(sc, RAL_RF1, 0x08804);
2246 
2247 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2526_r2[chan - 1]);
2248 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
2249 		rt2560_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
2250 		break;
2251 
2252 	/* dual-band RF */
2253 	case RT2560_RF_5222:
2254 		for (i = 0; rt2560_rf5222[i].chan != chan; i++);
2255 
2256 		rt2560_rf_write(sc, RAL_RF1, rt2560_rf5222[i].r1);
2257 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf5222[i].r2);
2258 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
2259 		rt2560_rf_write(sc, RAL_RF4, rt2560_rf5222[i].r4);
2260 		break;
2261 	}
2262 
2263 	if (ic->ic_state != IEEE80211_S_SCAN) {
2264 		/* set Japan filter bit for channel 14 */
2265 		tmp = rt2560_bbp_read(sc, 70);
2266 
2267 		tmp &= ~RT2560_JAPAN_FILTER;
2268 		if (chan == 14)
2269 			tmp |= RT2560_JAPAN_FILTER;
2270 
2271 		rt2560_bbp_write(sc, 70, tmp);
2272 
2273 		/* clear CRC errors */
2274 		RAL_READ(sc, RT2560_CNT0);
2275 	}
2276 
2277 	sc->sc_sifs = IEEE80211_IS_CHAN_5GHZ(c) ? IEEE80211_DUR_OFDM_SIFS
2278 						: IEEE80211_DUR_SIFS;
2279 }
2280 
2281 /*
2282  * Refer to IEEE Std 802.11-1999 pp. 123 for more information on TSF
2283  * synchronization.
2284  */
2285 static void
2286 rt2560_enable_tsf_sync(struct rt2560_softc *sc)
2287 {
2288 	struct ieee80211com *ic = &sc->sc_ic;
2289 	uint16_t logcwmin, preload;
2290 	uint32_t tmp;
2291 
2292 	/* first, disable TSF synchronization */
2293 	RAL_WRITE(sc, RT2560_CSR14, 0);
2294 
2295 	tmp = 16 * ic->ic_bss->ni_intval;
2296 	RAL_WRITE(sc, RT2560_CSR12, tmp);
2297 
2298 	RAL_WRITE(sc, RT2560_CSR13, 0);
2299 
2300 	logcwmin = 5;
2301 	preload = (ic->ic_opmode == IEEE80211_M_STA) ? 384 : 1024;
2302 	tmp = logcwmin << 16 | preload;
2303 	RAL_WRITE(sc, RT2560_BCNOCSR, tmp);
2304 
2305 	/* finally, enable TSF synchronization */
2306 	tmp = RT2560_ENABLE_TSF | RT2560_ENABLE_TBCN;
2307 	if (ic->ic_opmode == IEEE80211_M_STA)
2308 		tmp |= RT2560_ENABLE_TSF_SYNC(1);
2309 	else
2310 		tmp |= RT2560_ENABLE_TSF_SYNC(2) |
2311 		       RT2560_ENABLE_BEACON_GENERATOR;
2312 	RAL_WRITE(sc, RT2560_CSR14, tmp);
2313 
2314 	DPRINTF(sc, ("enabling TSF synchronization\n"));
2315 }
2316 
2317 static void
2318 rt2560_update_plcp(struct rt2560_softc *sc)
2319 {
2320 	struct ieee80211com *ic = &sc->sc_ic;
2321 
2322 	/* no short preamble for 1Mbps */
2323 	RAL_WRITE(sc, RT2560_PLCP1MCSR, 0x00700400);
2324 
2325 	if (!(ic->ic_flags & IEEE80211_F_SHPREAMBLE)) {
2326 		/* values taken from the reference driver */
2327 		RAL_WRITE(sc, RT2560_PLCP2MCSR,   0x00380401);
2328 		RAL_WRITE(sc, RT2560_PLCP5p5MCSR, 0x00150402);
2329 		RAL_WRITE(sc, RT2560_PLCP11MCSR,  0x000b8403);
2330 	} else {
2331 		/* same values as above or'ed 0x8 */
2332 		RAL_WRITE(sc, RT2560_PLCP2MCSR,   0x00380409);
2333 		RAL_WRITE(sc, RT2560_PLCP5p5MCSR, 0x0015040a);
2334 		RAL_WRITE(sc, RT2560_PLCP11MCSR,  0x000b840b);
2335 	}
2336 
2337 	DPRINTF(sc, ("updating PLCP for %s preamble\n",
2338 	    (ic->ic_flags & IEEE80211_F_SHPREAMBLE) ? "short" : "long"));
2339 }
2340 
2341 /*
2342  * This function can be called by ieee80211_set_shortslottime(). Refer to
2343  * IEEE Std 802.11-1999 pp. 85 to know how these values are computed.
2344  */
2345 static void
2346 rt2560_update_slot(struct ifnet *ifp)
2347 {
2348 	struct rt2560_softc *sc = ifp->if_softc;
2349 	struct ieee80211com *ic = &sc->sc_ic;
2350 	uint8_t slottime;
2351 	uint16_t tx_sifs, tx_pifs, tx_difs, eifs;
2352 	uint32_t tmp;
2353 
2354 #ifdef foo
2355 	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
2356 #else
2357 	/*
2358 	 * Setting slot time according to "short slot time" capability
2359 	 * in beacon/probe_resp seems to cause problem to acknowledge
2360 	 * certain AP's data frames transimitted at CCK/DS rates: the
2361 	 * problematic AP keeps retransmitting data frames, probably
2362 	 * because MAC level acks are not received by hardware.
2363 	 * So we cheat a little bit here by claiming we are capable of
2364 	 * "short slot time" but setting hardware slot time to the normal
2365 	 * slot time.  ral(4) does not seem to have trouble to receive
2366 	 * frames transmitted using short slot time even if hardware
2367 	 * slot time is set to normal slot time.  If we didn't use this
2368 	 * trick, we would have to claim that short slot time is not
2369 	 * supported; this would give relative poor TX performance
2370 	 * (-1Mb~-2Mb lower) and the _whole_ BSS would stop using short
2371 	 * slot time.
2372 	 */
2373 	slottime = (ic->ic_curmode == IEEE80211_MODE_11A) ? 9 : 20;
2374 #endif
2375 
2376 	/* update the MAC slot boundaries */
2377 	tx_sifs = sc->sc_sifs - RT2560_TXRX_TURNAROUND;
2378 	tx_pifs = tx_sifs + slottime;
2379 	tx_difs = tx_sifs + 2 * slottime;
2380 	eifs = (ic->ic_curmode == IEEE80211_MODE_11B) ? 364 : 60;
2381 
2382 	tmp = RAL_READ(sc, RT2560_CSR11);
2383 	tmp = (tmp & ~0x1f00) | slottime << 8;
2384 	RAL_WRITE(sc, RT2560_CSR11, tmp);
2385 
2386 	tmp = tx_pifs << 16 | tx_sifs;
2387 	RAL_WRITE(sc, RT2560_CSR18, tmp);
2388 
2389 	tmp = eifs << 16 | tx_difs;
2390 	RAL_WRITE(sc, RT2560_CSR19, tmp);
2391 
2392 	DPRINTF(sc, ("setting slottime to %uus\n", slottime));
2393 }
2394 
2395 static void
2396 rt2560_set_basicrates(struct rt2560_softc *sc)
2397 {
2398 	struct ieee80211com *ic = &sc->sc_ic;
2399 
2400 	/* update basic rate set */
2401 	if (ic->ic_curmode == IEEE80211_MODE_11B) {
2402 		/* 11b basic rates: 1, 2Mbps */
2403 		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x3);
2404 	} else if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan)) {
2405 		/* 11a basic rates: 6, 12, 24Mbps */
2406 		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x150);
2407 	} else {
2408 		/* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
2409 		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x15f);
2410 	}
2411 }
2412 
2413 static void
2414 rt2560_update_led(struct rt2560_softc *sc, int led1, int led2)
2415 {
2416 	uint32_t tmp;
2417 
2418 	/* set ON period to 70ms and OFF period to 30ms */
2419 	tmp = led1 << 16 | led2 << 17 | 70 << 8 | 30;
2420 	RAL_WRITE(sc, RT2560_LEDCSR, tmp);
2421 }
2422 
2423 static void
2424 rt2560_set_bssid(struct rt2560_softc *sc, uint8_t *bssid)
2425 {
2426 	uint32_t tmp;
2427 
2428 	tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
2429 	RAL_WRITE(sc, RT2560_CSR5, tmp);
2430 
2431 	tmp = bssid[4] | bssid[5] << 8;
2432 	RAL_WRITE(sc, RT2560_CSR6, tmp);
2433 
2434 	DPRINTF(sc, ("setting BSSID to %6D\n", bssid, ":"));
2435 }
2436 
2437 static void
2438 rt2560_set_macaddr(struct rt2560_softc *sc, uint8_t *addr)
2439 {
2440 	uint32_t tmp;
2441 
2442 	tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
2443 	RAL_WRITE(sc, RT2560_CSR3, tmp);
2444 
2445 	tmp = addr[4] | addr[5] << 8;
2446 	RAL_WRITE(sc, RT2560_CSR4, tmp);
2447 
2448 	DPRINTF(sc, ("setting MAC address to %6D\n", addr, ":"));
2449 }
2450 
2451 static void
2452 rt2560_get_macaddr(struct rt2560_softc *sc, uint8_t *addr)
2453 {
2454 	uint32_t tmp;
2455 
2456 	tmp = RAL_READ(sc, RT2560_CSR3);
2457 	addr[0] = tmp & 0xff;
2458 	addr[1] = (tmp >>  8) & 0xff;
2459 	addr[2] = (tmp >> 16) & 0xff;
2460 	addr[3] = (tmp >> 24);
2461 
2462 	tmp = RAL_READ(sc, RT2560_CSR4);
2463 	addr[4] = tmp & 0xff;
2464 	addr[5] = (tmp >> 8) & 0xff;
2465 }
2466 
2467 static void
2468 rt2560_update_promisc(struct rt2560_softc *sc)
2469 {
2470 	struct ifnet *ifp = sc->sc_ic.ic_ifp;
2471 	uint32_t tmp;
2472 
2473 	tmp = RAL_READ(sc, RT2560_RXCSR0);
2474 
2475 	tmp &= ~RT2560_DROP_NOT_TO_ME;
2476 	if (!(ifp->if_flags & IFF_PROMISC))
2477 		tmp |= RT2560_DROP_NOT_TO_ME;
2478 
2479 	RAL_WRITE(sc, RT2560_RXCSR0, tmp);
2480 
2481 	DPRINTF(sc, ("%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
2482 	    "entering" : "leaving"));
2483 }
2484 
2485 static const char *
2486 rt2560_get_rf(int rev)
2487 {
2488 	switch (rev) {
2489 	case RT2560_RF_2522:	return "RT2522";
2490 	case RT2560_RF_2523:	return "RT2523";
2491 	case RT2560_RF_2524:	return "RT2524";
2492 	case RT2560_RF_2525:	return "RT2525";
2493 	case RT2560_RF_2525E:	return "RT2525e";
2494 	case RT2560_RF_2526:	return "RT2526";
2495 	case RT2560_RF_5222:	return "RT5222";
2496 	default:		return "unknown";
2497 	}
2498 }
2499 
2500 static void
2501 rt2560_read_config(struct rt2560_softc *sc)
2502 {
2503 	uint16_t val;
2504 	int i, find_bbp17 = 0;
2505 
2506 	val = rt2560_eeprom_read(sc, RT2560_EEPROM_CONFIG0);
2507 	sc->rf_rev =   (val >> 11) & 0x7;
2508 	sc->hw_radio = (val >> 10) & 0x1;
2509 	sc->led_mode = (val >> 6)  & 0x7;
2510 	sc->rx_ant =   (val >> 4)  & 0x3;
2511 	sc->tx_ant =   (val >> 2)  & 0x3;
2512 	sc->nb_ant =   val & 0x3;
2513 
2514 	/* read default values for BBP registers */
2515 	for (i = 0; i < 16; i++) {
2516 		val = rt2560_eeprom_read(sc, RT2560_EEPROM_BBP_BASE + i);
2517 		if (val == 0xffff || val == 0)
2518 			continue;
2519 		sc->bbp_prom[i].reg = val >> 8;
2520 		sc->bbp_prom[i].val = val & 0xff;
2521 		DPRINTF(sc, ("rom bbp reg:%u val:%#x\n",
2522 			 sc->bbp_prom[i].reg, sc->bbp_prom[i].val));
2523 
2524 		if (sc->bbp_prom[i].reg == 17) {
2525 			if (sc->bbp_prom[i].val > 6)
2526 				sc->sc_bbp17_dynmin = sc->bbp_prom[i].val - 6;
2527 			else
2528 				sc->sc_bbp17_dynmin = 0;
2529 			find_bbp17 = 1;
2530 		}
2531 	}
2532 
2533 	sc->sc_bbp17_dynmax = RT2560_RXSNS_DYNMAX;
2534 	if (!find_bbp17)
2535 		sc->sc_bbp17_dynmin = sc->sc_bbp17_dynmax - 6;
2536 
2537 	/* read Tx power for all b/g channels */
2538 	for (i = 0; i < 14 / 2; i++) {
2539 		val = rt2560_eeprom_read(sc, RT2560_EEPROM_TXPOWER + i);
2540 		sc->txpow[i * 2] = val & 0xff;
2541 		sc->txpow[i * 2 + 1] = val >> 8;
2542 	}
2543 	for (i = 0; i < 14; ++i) {
2544 		if (sc->txpow[i] > 31)
2545 			sc->txpow[i] = RT2560_DEFAULT_TXPOWER;
2546 		DPRINTF(sc, ("tx power chan %d: %u\n", i + 1, sc->txpow[i]));
2547 	}
2548 
2549 	val = rt2560_eeprom_read(sc, RT2560_EEPROM_CALIBRATE);
2550 	if ((val & 0xff) == 0xff)
2551 		sc->rssi_corr = RT2560_DEFAULT_RSSI_CORR;
2552 	else
2553 		sc->rssi_corr = val & 0xff;
2554 	DPRINTF(sc, ("rssi correction %d, calibrate 0x%02x\n",
2555 		 sc->rssi_corr, val));
2556 
2557 	val = rt2560_eeprom_read(sc, RT2560_EEPROM_CONFIG1);
2558 	if (val == 0xffff)
2559 		val = 0;
2560 	if ((val & 0x2) == 0 && sc->asic_rev >= RT2560_ASICREV_D) {
2561 		DPRINTF(sc, ("capable of RX sensitivity calibration\n"));
2562 		sc->sc_flags |= RT2560_FLAG_RXSNS;
2563 	}
2564 }
2565 
2566 static int
2567 rt2560_bbp_init(struct rt2560_softc *sc)
2568 {
2569 #define N(a)	(sizeof (a) / sizeof ((a)[0]))
2570 	int i, ntries;
2571 
2572 	/* wait for BBP to be ready */
2573 	for (ntries = 0; ntries < 100; ntries++) {
2574 		if (rt2560_bbp_read(sc, RT2560_BBP_VERSION) != 0)
2575 			break;
2576 		DELAY(1);
2577 	}
2578 	if (ntries == 100) {
2579 		device_printf(sc->sc_dev, "timeout waiting for BBP\n");
2580 		return EIO;
2581 	}
2582 
2583 	/* initialize BBP registers to default values */
2584 	for (i = 0; i < N(rt2560_def_bbp); i++) {
2585 		rt2560_bbp_write(sc, rt2560_def_bbp[i].reg,
2586 		    rt2560_def_bbp[i].val);
2587 	}
2588 
2589 	/* initialize BBP registers to values stored in EEPROM */
2590 	for (i = 0; i < 16; i++) {
2591 		if (sc->bbp_prom[i].reg == 0 && sc->bbp_prom[i].val == 0)
2592 			break;
2593 		rt2560_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
2594 	}
2595 	/* Set rx sensitivity to user specified value */
2596 	rt2560_bbp_write(sc, 17, sc->sc_rxsns);
2597 
2598 	return 0;
2599 #undef N
2600 }
2601 
2602 static void
2603 rt2560_set_txantenna(struct rt2560_softc *sc, int antenna)
2604 {
2605 	uint32_t tmp;
2606 	uint8_t tx;
2607 
2608 	tx = rt2560_bbp_read(sc, RT2560_BBP_TX) & ~RT2560_BBP_ANTMASK;
2609 	if (antenna == 1)
2610 		tx |= RT2560_BBP_ANTA;
2611 	else if (antenna == 2)
2612 		tx |= RT2560_BBP_ANTB;
2613 	else
2614 		tx |= RT2560_BBP_DIVERSITY;
2615 
2616 	/* need to force I/Q flip for RF 2525e and 5222 */
2617 	if (sc->rf_rev == RT2560_RF_2525E || sc->rf_rev == RT2560_RF_5222)
2618 		tx |= RT2560_BBP_FLIPIQ;
2619 
2620 	rt2560_bbp_write(sc, RT2560_BBP_TX, tx);
2621 
2622 	/* update values for CCK and OFDM in BBPCSR1 */
2623 	tmp = RAL_READ(sc, RT2560_BBPCSR1) & ~0x00070007;
2624 	tmp |= (tx & 0x7) << 16 | (tx & 0x7);
2625 	RAL_WRITE(sc, RT2560_BBPCSR1, tmp);
2626 }
2627 
2628 static void
2629 rt2560_set_rxantenna(struct rt2560_softc *sc, int antenna)
2630 {
2631 	uint8_t rx;
2632 
2633 	rx = rt2560_bbp_read(sc, RT2560_BBP_RX) & ~RT2560_BBP_ANTMASK;
2634 	if (antenna == 1)
2635 		rx |= RT2560_BBP_ANTA;
2636 	else if (antenna == 2)
2637 		rx |= RT2560_BBP_ANTB;
2638 	else
2639 		rx |= RT2560_BBP_DIVERSITY;
2640 
2641 	/* need to force no I/Q flip for RF 2525e */
2642 	if (sc->rf_rev == RT2560_RF_2525E)
2643 		rx &= ~RT2560_BBP_FLIPIQ;
2644 
2645 	rt2560_bbp_write(sc, RT2560_BBP_RX, rx);
2646 }
2647 
2648 static void
2649 rt2560_init(void *priv)
2650 {
2651 #define N(a)	(sizeof (a) / sizeof ((a)[0]))
2652 	struct rt2560_softc *sc = priv;
2653 	struct ieee80211com *ic = &sc->sc_ic;
2654 	struct ifnet *ifp = ic->ic_ifp;
2655 	uint32_t tmp;
2656 	int i;
2657 
2658 	rt2560_stop(sc);
2659 
2660 	/* setup tx rings */
2661 	tmp = RT2560_PRIO_RING_COUNT << 24 |
2662 	      RT2560_ATIM_RING_COUNT << 16 |
2663 	      RT2560_TX_RING_COUNT   <<  8 |
2664 	      RT2560_TX_DESC_SIZE;
2665 
2666 	/* rings must be initialized in this exact order */
2667 	RAL_WRITE(sc, RT2560_TXCSR2, tmp);
2668 	RAL_WRITE(sc, RT2560_TXCSR3, sc->txq.physaddr);
2669 	RAL_WRITE(sc, RT2560_TXCSR5, sc->prioq.physaddr);
2670 	RAL_WRITE(sc, RT2560_TXCSR4, sc->atimq.physaddr);
2671 	RAL_WRITE(sc, RT2560_TXCSR6, sc->bcnq.physaddr);
2672 
2673 	/* setup rx ring */
2674 	tmp = RT2560_RX_RING_COUNT << 8 | RT2560_RX_DESC_SIZE;
2675 
2676 	RAL_WRITE(sc, RT2560_RXCSR1, tmp);
2677 	RAL_WRITE(sc, RT2560_RXCSR2, sc->rxq.physaddr);
2678 
2679 	/* initialize MAC registers to default values */
2680 	for (i = 0; i < N(rt2560_def_mac); i++)
2681 		RAL_WRITE(sc, rt2560_def_mac[i].reg, rt2560_def_mac[i].val);
2682 
2683 	IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
2684 	rt2560_set_macaddr(sc, ic->ic_myaddr);
2685 
2686 	/* set basic rate set (will be updated later) */
2687 	RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x153);
2688 
2689 	rt2560_update_slot(ifp);
2690 	rt2560_update_plcp(sc);
2691 	rt2560_update_led(sc, 0, 0);
2692 
2693 	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
2694 	RAL_WRITE(sc, RT2560_CSR1, RT2560_HOST_READY);
2695 
2696 	if (rt2560_bbp_init(sc) != 0) {
2697 		rt2560_stop(sc);
2698 		return;
2699 	}
2700 
2701 	rt2560_set_txantenna(sc, sc->tx_ant);
2702 	rt2560_set_rxantenna(sc, sc->rx_ant);
2703 
2704 	/* set default BSS channel */
2705 	rt2560_set_chan(sc, ic->ic_curchan);
2706 
2707 	/* kick Rx */
2708 	tmp = RT2560_DROP_PHY_ERROR | RT2560_DROP_CRC_ERROR;
2709 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2710 		tmp |= RT2560_DROP_CTL | RT2560_DROP_VERSION_ERROR;
2711 		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
2712 			tmp |= RT2560_DROP_TODS;
2713 		if (!(ifp->if_flags & IFF_PROMISC))
2714 			tmp |= RT2560_DROP_NOT_TO_ME;
2715 	}
2716 	RAL_WRITE(sc, RT2560_RXCSR0, tmp);
2717 
2718 	/* clear old FCS and Rx FIFO errors */
2719 	RAL_READ(sc, RT2560_CNT0);
2720 	RAL_READ(sc, RT2560_CNT4);
2721 
2722 	/* clear any pending interrupts */
2723 	RAL_WRITE(sc, RT2560_CSR7, 0xffffffff);
2724 
2725 	/* enable interrupts */
2726 	RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
2727 
2728 	ifp->if_flags &= ~IFF_OACTIVE;
2729 	ifp->if_flags |= IFF_RUNNING;
2730 
2731 	/* XXX */
2732 	if (ic->ic_flags & IEEE80211_F_PRIVACY) {
2733 		int i;
2734 
2735 		ic->ic_flags &= ~IEEE80211_F_DROPUNENC;
2736 		for (i = 0; i < IEEE80211_WEP_NKID; ++i) {
2737 			struct ieee80211_key *wk = &ic->ic_nw_keys[i];
2738 
2739 			if (wk->wk_keylen == 0)
2740 				continue;
2741 			if (wk->wk_flags & IEEE80211_KEY_XMIT)
2742 				wk->wk_flags |= IEEE80211_KEY_SWCRYPT;
2743 		}
2744 	}
2745 
2746 	sc->sc_avgrssi = -1;
2747 
2748 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2749 		if (ic->ic_roaming != IEEE80211_ROAMING_MANUAL)
2750 			ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2751 	} else {
2752 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2753 	}
2754 #undef N
2755 }
2756 
2757 void
2758 rt2560_stop(void *priv)
2759 {
2760 	struct rt2560_softc *sc = priv;
2761 	struct ieee80211com *ic = &sc->sc_ic;
2762 	struct ifnet *ifp = ic->ic_ifp;
2763 
2764 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2765 
2766 	sc->sc_tx_timer = 0;
2767 	sc->sc_flags &= ~(RT2560_FLAG_DATA_OACT | RT2560_FLAG_PRIO_OACT);
2768 	ifp->if_timer = 0;
2769 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2770 
2771 	/* abort Tx */
2772 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_ABORT_TX);
2773 
2774 	/* disable Rx */
2775 	RAL_WRITE(sc, RT2560_RXCSR0, RT2560_DISABLE_RX);
2776 
2777 	/* reset ASIC (imply reset BBP) */
2778 	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
2779 	RAL_WRITE(sc, RT2560_CSR1, 0);
2780 
2781 	/* disable interrupts */
2782 	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
2783 
2784 	/* reset Tx and Rx rings */
2785 	rt2560_reset_tx_ring(sc, &sc->txq);
2786 	rt2560_reset_tx_ring(sc, &sc->atimq);
2787 	rt2560_reset_tx_ring(sc, &sc->prioq);
2788 	rt2560_reset_tx_ring(sc, &sc->bcnq);
2789 	rt2560_reset_rx_ring(sc, &sc->rxq);
2790 }
2791 
2792 static void
2793 rt2560_dma_map_mbuf(void *arg, bus_dma_segment_t *seg, int nseg,
2794 		    bus_size_t map_size __unused, int error)
2795 {
2796 	if (error)
2797 		return;
2798 
2799 	KASSERT(nseg == 1, ("too many dma segments\n"));
2800 	*((bus_addr_t *)arg) = seg->ds_addr;
2801 }
2802 
2803 static void *
2804 rt2560_ratectl_attach(struct ieee80211com *ic, u_int rc)
2805 {
2806 	struct rt2560_softc *sc = ic->ic_if.if_softc;
2807 
2808 	switch (rc) {
2809 	case IEEE80211_RATECTL_SAMPLE:
2810 		return &sc->sc_sample_param;
2811 	case IEEE80211_RATECTL_ONOE:
2812 		return &sc->sc_onoe_param;
2813 	case IEEE80211_RATECTL_NONE:
2814 		/* This could only happen during detaching */
2815 		return NULL;
2816 	default:
2817 		panic("unknown rate control algo %u\n", rc);
2818 		return NULL;
2819 	}
2820 }
2821 
2822 static void
2823 rt2560_calib_rxsensitivity(struct rt2560_softc *sc, uint32_t false_cca)
2824 {
2825 #define MID_RX_SENSITIVITY	(RT2560_RXSNS_DYNMAX + 1)
2826 
2827 	int rssi_dbm;
2828 
2829 	if (sc->sc_ic.ic_state != IEEE80211_S_RUN)
2830 		return;
2831 
2832 	rssi_dbm = sc->sc_avgrssi + RT2560_NOISE_FLOOR;
2833 	DPRINTF(sc, ("rssi dbm %d\n", rssi_dbm));
2834 
2835 	/*
2836 	 * Rx sensitivity is reduced, if bbp17 is increased, and vice versa.
2837 	 * Lower rx sensitivity could do a better job of reducing false CCA,
2838 	 * but on the other hand roaming range is decreased.
2839 	 */
2840 
2841 	if (rssi_dbm < -80) {
2842 		/* Signal is too weak */
2843 		return;
2844 	} else if (rssi_dbm >= -74) {
2845 		uint8_t bbp17;
2846 
2847 		if (rssi_dbm >= -58)
2848 			bbp17 = RT2560_RXSNS_MAX;
2849 		else
2850 			bbp17 = MID_RX_SENSITIVITY;
2851 		if (sc->sc_bbp17 != bbp17)
2852 			rt2560_bbp_write(sc, 17, bbp17);
2853 		return;
2854 	}
2855 
2856 	/* RSSI is [-80,74)dBm, if we reach here */
2857 
2858 	if (sc->sc_bbp17 > MID_RX_SENSITIVITY) {
2859 		rt2560_bbp_write(sc, 17, MID_RX_SENSITIVITY);
2860 		return;
2861 	}
2862 
2863 	/*
2864 	 * Dynamic rx sensitivity tuning to keep balance between number
2865 	 * of false CCA per second and roaming range:
2866 	 * Reduce rx sensitivity if false CCA is too high.
2867 	 * If false CCA is relatively low, rx sensitivity is increased to
2868 	 * extend roaming range.
2869 	 */
2870 	if (false_cca > 512 && sc->sc_bbp17 < sc->sc_bbp17_dynmax)
2871 		rt2560_bbp_write(sc, 17, sc->sc_bbp17 + 1);
2872 	else if (false_cca < 100 && sc->sc_bbp17 > sc->sc_bbp17_dynmin)
2873 		rt2560_bbp_write(sc, 17, sc->sc_bbp17 - 1);
2874 
2875 #undef MID_RX_SENSITIVITY
2876 }
2877 
2878 static void
2879 rt2560_calibrate(void *xsc)
2880 {
2881 	struct rt2560_softc *sc = xsc;
2882 	struct ifnet *ifp = &sc->sc_ic.ic_if;
2883 	uint32_t false_cca;
2884 
2885 	lwkt_serialize_enter(ifp->if_serializer);
2886 
2887 	false_cca = RAL_READ(sc, RT2560_CNT3) & 0xffff;
2888 	DPRINTF(sc, ("false CCA %u\n", false_cca));
2889 
2890 	if (sc->sc_calib_rxsns)
2891 		rt2560_calib_rxsensitivity(sc, false_cca);
2892 
2893 	callout_reset(&sc->calib_ch, hz, rt2560_calibrate, sc);
2894 
2895 	lwkt_serialize_exit(ifp->if_serializer);
2896 }
2897 
2898 static int
2899 rt2560_sysctl_rxsns(SYSCTL_HANDLER_ARGS)
2900 {
2901 	struct rt2560_softc *sc = arg1;
2902 	struct ifnet *ifp = &sc->sc_ic.ic_if;
2903 	int error = 0, v;
2904 
2905 	lwkt_serialize_enter(ifp->if_serializer);
2906 
2907 	v = sc->sc_rxsns;
2908 	error = sysctl_handle_int(oidp, &v, 0, req);
2909 	if (error || req->newptr == NULL)
2910 		goto back;
2911 	if (v < sc->sc_bbp17_dynmin || v > RT2560_RXSNS_MAX) {
2912 		error = EINVAL;
2913 		goto back;
2914 	}
2915 
2916 	if (sc->sc_rxsns != v) {
2917 		/*
2918 		 * Adjust bbp17 iff ral(4) is up and running (i.e. hardware
2919 		 * is initialized)and rx sensitivity calibration is _not_
2920 		 * enabled.
2921 		 */
2922 		if ((ifp->if_flags & IFF_RUNNING) && !sc->sc_calib_rxsns)
2923 			rt2560_bbp_write(sc, 17, v);
2924 		sc->sc_rxsns = v;
2925 	}
2926 back:
2927 	lwkt_serialize_exit(ifp->if_serializer);
2928 	return error;
2929 }
2930