xref: /dragonfly/sys/dev/netif/ral/rt2560.c (revision 9b5a9965)
1 /*
2  * Copyright (c) 2005, 2006
3  *	Damien Bergamini <damien.bergamini@free.fr>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  *
17  * $FreeBSD: src/sys/dev/ral/rt2560.c,v 1.3 2006/03/21 21:15:43 damien Exp $
18  * $DragonFly: src/sys/dev/netif/ral/rt2560.c,v 1.15 2007/04/12 12:54:07 sephe Exp $
19  */
20 
21 /*
22  * Ralink Technology RT2560 chipset driver
23  * http://www.ralinktech.com/
24  */
25 
26 #include <sys/param.h>
27 #include <sys/bus.h>
28 #include <sys/endian.h>
29 #include <sys/kernel.h>
30 #include <sys/malloc.h>
31 #include <sys/mbuf.h>
32 #include <sys/module.h>
33 #include <sys/rman.h>
34 #include <sys/socket.h>
35 #include <sys/sockio.h>
36 #include <sys/sysctl.h>
37 #include <sys/serialize.h>
38 
39 #include <net/bpf.h>
40 #include <net/if.h>
41 #include <net/if_arp.h>
42 #include <net/ethernet.h>
43 #include <net/if_dl.h>
44 #include <net/if_media.h>
45 #include <net/ifq_var.h>
46 
47 #include <netproto/802_11/ieee80211_var.h>
48 #include <netproto/802_11/ieee80211_radiotap.h>
49 
50 #include <dev/netif/ral/rt2560reg.h>
51 #include <dev/netif/ral/rt2560var.h>
52 
53 #define RT2560_RSSI(sc, rssi)					\
54 	((rssi) > (RT2560_NOISE_FLOOR + (sc)->rssi_corr) ?	\
55 	 ((rssi) - RT2560_NOISE_FLOOR - (sc)->rssi_corr) : 0)
56 
57 #ifdef RAL_DEBUG
58 #define DPRINTF(x)	do { if (ral_debug > 0) kprintf x; } while (0)
59 #define DPRINTFN(n, x)	do { if (ral_debug >= (n)) kprintf x; } while (0)
60 extern int ral_debug;
61 #else
62 #define DPRINTF(x)
63 #define DPRINTFN(n, x)
64 #endif
65 
66 static void		rt2560_dma_map_addr(void *, bus_dma_segment_t *, int,
67 			    int);
68 static void		rt2560_dma_map_mbuf(void *, bus_dma_segment_t *, int,
69 					    bus_size_t, int);
70 static int		rt2560_alloc_tx_ring(struct rt2560_softc *,
71 			    struct rt2560_tx_ring *, int);
72 static void		rt2560_reset_tx_ring(struct rt2560_softc *,
73 			    struct rt2560_tx_ring *);
74 static void		rt2560_free_tx_ring(struct rt2560_softc *,
75 			    struct rt2560_tx_ring *);
76 static int		rt2560_alloc_rx_ring(struct rt2560_softc *,
77 			    struct rt2560_rx_ring *, int);
78 static void		rt2560_reset_rx_ring(struct rt2560_softc *,
79 			    struct rt2560_rx_ring *);
80 static void		rt2560_free_rx_ring(struct rt2560_softc *,
81 			    struct rt2560_rx_ring *);
82 static int		rt2560_media_change(struct ifnet *);
83 static void		rt2560_next_scan(void *);
84 static int		rt2560_newstate(struct ieee80211com *,
85 			    enum ieee80211_state, int);
86 static uint16_t		rt2560_eeprom_read(struct rt2560_softc *, uint8_t);
87 static void		rt2560_encryption_intr(struct rt2560_softc *);
88 static void		rt2560_tx_intr(struct rt2560_softc *);
89 static void		rt2560_prio_intr(struct rt2560_softc *);
90 static void		rt2560_decryption_intr(struct rt2560_softc *);
91 static void		rt2560_rx_intr(struct rt2560_softc *);
92 static void		rt2560_beacon_expire(struct rt2560_softc *);
93 static void		rt2560_wakeup_expire(struct rt2560_softc *);
94 static uint8_t		rt2560_rxrate(struct rt2560_rx_desc *);
95 static uint8_t		rt2560_plcp_signal(int);
96 static void		rt2560_setup_tx_desc(struct rt2560_softc *,
97 			    struct rt2560_tx_desc *, uint32_t, int, int, int,
98 			    bus_addr_t);
99 static int		rt2560_tx_bcn(struct rt2560_softc *, struct mbuf *,
100 			    struct ieee80211_node *);
101 static int		rt2560_tx_mgt(struct rt2560_softc *, struct mbuf *,
102 			    struct ieee80211_node *);
103 static struct		mbuf *rt2560_get_rts(struct rt2560_softc *,
104 			    struct ieee80211_frame *, uint16_t);
105 static int		rt2560_tx_data(struct rt2560_softc *, struct mbuf *,
106 			    struct ieee80211_node *);
107 static void		rt2560_start(struct ifnet *);
108 static void		rt2560_watchdog(struct ifnet *);
109 static int		rt2560_reset(struct ifnet *);
110 static int		rt2560_ioctl(struct ifnet *, u_long, caddr_t,
111 				     struct ucred *);
112 static void		rt2560_bbp_write(struct rt2560_softc *, uint8_t,
113 			    uint8_t);
114 static uint8_t		rt2560_bbp_read(struct rt2560_softc *, uint8_t);
115 static void		rt2560_rf_write(struct rt2560_softc *, uint8_t,
116 			    uint32_t);
117 static void		rt2560_set_chan(struct rt2560_softc *,
118 			    struct ieee80211_channel *);
119 #if 0
120 static void		rt2560_disable_rf_tune(struct rt2560_softc *);
121 #endif
122 static void		rt2560_enable_tsf_sync(struct rt2560_softc *);
123 static void		rt2560_update_plcp(struct rt2560_softc *);
124 static void		rt2560_update_slot(struct ifnet *);
125 static void		rt2560_set_basicrates(struct rt2560_softc *);
126 static void		rt2560_update_led(struct rt2560_softc *, int, int);
127 static void		rt2560_set_bssid(struct rt2560_softc *, uint8_t *);
128 static void		rt2560_set_macaddr(struct rt2560_softc *, uint8_t *);
129 static void		rt2560_get_macaddr(struct rt2560_softc *, uint8_t *);
130 static void		rt2560_update_promisc(struct rt2560_softc *);
131 static const char	*rt2560_get_rf(int);
132 static void		rt2560_read_eeprom(struct rt2560_softc *);
133 static int		rt2560_bbp_init(struct rt2560_softc *);
134 static void		rt2560_set_txantenna(struct rt2560_softc *, int);
135 static void		rt2560_set_rxantenna(struct rt2560_softc *, int);
136 static void		rt2560_init(void *);
137 static void		rt2560_stop(void *);
138 static void		rt2560_intr(void *);
139 
140 /*
141  * Supported rates for 802.11a/b/g modes (in 500Kbps unit).
142  */
143 static const struct ieee80211_rateset rt2560_rateset_11a =
144 	{ 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
145 
146 static const struct ieee80211_rateset rt2560_rateset_11b =
147 	{ 4, { 2, 4, 11, 22 } };
148 
149 static const struct ieee80211_rateset rt2560_rateset_11g =
150 	{ 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
151 
152 static const struct {
153 	uint32_t	reg;
154 	uint32_t	val;
155 } rt2560_def_mac[] = {
156 	RT2560_DEF_MAC
157 };
158 
159 static const struct {
160 	uint8_t	reg;
161 	uint8_t	val;
162 } rt2560_def_bbp[] = {
163 	RT2560_DEF_BBP
164 };
165 
166 static const uint32_t rt2560_rf2522_r2[]    = RT2560_RF2522_R2;
167 static const uint32_t rt2560_rf2523_r2[]    = RT2560_RF2523_R2;
168 static const uint32_t rt2560_rf2524_r2[]    = RT2560_RF2524_R2;
169 static const uint32_t rt2560_rf2525_r2[]    = RT2560_RF2525_R2;
170 static const uint32_t rt2560_rf2525_hi_r2[] = RT2560_RF2525_HI_R2;
171 static const uint32_t rt2560_rf2525e_r2[]   = RT2560_RF2525E_R2;
172 static const uint32_t rt2560_rf2526_r2[]    = RT2560_RF2526_R2;
173 static const uint32_t rt2560_rf2526_hi_r2[] = RT2560_RF2526_HI_R2;
174 
175 static const struct {
176 	uint8_t		chan;
177 	uint32_t	r1, r2, r4;
178 } rt2560_rf5222[] = {
179 	RT2560_RF5222
180 };
181 
182 int
183 rt2560_attach(device_t dev, int id)
184 {
185 	struct rt2560_softc *sc = device_get_softc(dev);
186 	struct ieee80211com *ic = &sc->sc_ic;
187 	struct ifnet *ifp = &ic->ic_if;
188 	int error, i;
189 
190 	callout_init(&sc->scan_ch);
191 
192 	sc->sc_irq_rid = 0;
193 	sc->sc_irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &sc->sc_irq_rid,
194 					    RF_ACTIVE | RF_SHAREABLE);
195 	if (sc->sc_irq == NULL) {
196 		device_printf(dev, "could not allocate interrupt resource\n");
197 		return ENXIO;
198 	}
199 
200 	/* retrieve RT2560 rev. no */
201 	sc->asic_rev = RAL_READ(sc, RT2560_CSR0);
202 
203 	/* retrieve MAC address */
204 	rt2560_get_macaddr(sc, ic->ic_myaddr);
205 
206 	/* retrieve RF rev. no and various other things from EEPROM */
207 	rt2560_read_eeprom(sc);
208 
209 	device_printf(dev, "MAC/BBP RT2560 (rev 0x%02x), RF %s\n",
210 	    sc->asic_rev, rt2560_get_rf(sc->rf_rev));
211 
212 	/*
213 	 * Allocate Tx and Rx rings.
214 	 */
215 	error = rt2560_alloc_tx_ring(sc, &sc->txq, RT2560_TX_RING_COUNT);
216 	if (error != 0) {
217 		device_printf(sc->sc_dev, "could not allocate Tx ring\n");
218 		goto fail;
219 	}
220 
221 	error = rt2560_alloc_tx_ring(sc, &sc->atimq, RT2560_ATIM_RING_COUNT);
222 	if (error != 0) {
223 		device_printf(sc->sc_dev, "could not allocate ATIM ring\n");
224 		goto fail;
225 	}
226 
227 	error = rt2560_alloc_tx_ring(sc, &sc->prioq, RT2560_PRIO_RING_COUNT);
228 	if (error != 0) {
229 		device_printf(sc->sc_dev, "could not allocate Prio ring\n");
230 		goto fail;
231 	}
232 
233 	error = rt2560_alloc_tx_ring(sc, &sc->bcnq, RT2560_BEACON_RING_COUNT);
234 	if (error != 0) {
235 		device_printf(sc->sc_dev, "could not allocate Beacon ring\n");
236 		goto fail;
237 	}
238 
239 	error = rt2560_alloc_rx_ring(sc, &sc->rxq, RT2560_RX_RING_COUNT);
240 	if (error != 0) {
241 		device_printf(sc->sc_dev, "could not allocate Rx ring\n");
242 		goto fail;
243 	}
244 
245 	sysctl_ctx_init(&sc->sysctl_ctx);
246 	sc->sysctl_tree = SYSCTL_ADD_NODE(&sc->sysctl_ctx,
247 					  SYSCTL_STATIC_CHILDREN(_hw),
248 					  OID_AUTO,
249 					  device_get_nameunit(dev),
250 					  CTLFLAG_RD, 0, "");
251 	if (sc->sysctl_tree == NULL) {
252 		device_printf(dev, "could not add sysctl node\n");
253 		error = ENXIO;
254 		goto fail;
255 	}
256 
257 	ifp->if_softc = sc;
258 	if_initname(ifp, device_get_name(dev), device_get_unit(dev));
259 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
260 	ifp->if_init = rt2560_init;
261 	ifp->if_ioctl = rt2560_ioctl;
262 	ifp->if_start = rt2560_start;
263 	ifp->if_watchdog = rt2560_watchdog;
264 	ifq_set_maxlen(&ifp->if_snd, IFQ_MAXLEN);
265 	ifq_set_ready(&ifp->if_snd);
266 
267 	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
268 	ic->ic_opmode = IEEE80211_M_STA; /* default to BSS mode */
269 	ic->ic_state = IEEE80211_S_INIT;
270 
271 	ic->ic_ratectl.rc_st_ratectl_cap = IEEE80211_RATECTL_CAP_ONOE |
272 					   IEEE80211_RATECTL_CAP_SAMPLE;
273 	ic->ic_ratectl.rc_st_ratectl = IEEE80211_RATECTL_SAMPLE;
274 
275 	/* set device capabilities */
276 	ic->ic_caps =
277 	    IEEE80211_C_IBSS |		/* IBSS mode supported */
278 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
279 	    IEEE80211_C_HOSTAP |	/* HostAp mode supported */
280 	    IEEE80211_C_TXPMGT |	/* tx power management */
281 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
282 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
283 	    IEEE80211_C_WEP |		/* WEP */
284 	    IEEE80211_C_WPA;		/* 802.11i */
285 
286 	if (sc->rf_rev == RT2560_RF_5222) {
287 		/* set supported .11a rates */
288 		ic->ic_sup_rates[IEEE80211_MODE_11A] = rt2560_rateset_11a;
289 
290 		/* set supported .11a channels */
291 		for (i = 36; i <= 64; i += 4) {
292 			ic->ic_channels[i].ic_freq =
293 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
294 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
295 		}
296 		for (i = 100; i <= 140; i += 4) {
297 			ic->ic_channels[i].ic_freq =
298 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
299 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
300 		}
301 		for (i = 149; i <= 161; i += 4) {
302 			ic->ic_channels[i].ic_freq =
303 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
304 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
305 		}
306 	}
307 
308 	/* set supported .11b and .11g rates */
309 	ic->ic_sup_rates[IEEE80211_MODE_11B] = rt2560_rateset_11b;
310 	ic->ic_sup_rates[IEEE80211_MODE_11G] = rt2560_rateset_11g;
311 
312 	/* set supported .11b and .11g channels (1 through 14) */
313 	for (i = 1; i <= 14; i++) {
314 		ic->ic_channels[i].ic_freq =
315 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
316 		ic->ic_channels[i].ic_flags =
317 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
318 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
319 	}
320 
321 	sc->sc_sifs = IEEE80211_DUR_SIFS;	/* Default SIFS */
322 
323 	ieee80211_ifattach(ic);
324 	ic->ic_updateslot = rt2560_update_slot;
325 	ic->ic_reset = rt2560_reset;
326 	/* enable s/w bmiss handling in sta mode */
327 	ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;
328 
329 	/* override state transition machine */
330 	sc->sc_newstate = ic->ic_newstate;
331 	ic->ic_newstate = rt2560_newstate;
332 	ieee80211_media_init(ic, rt2560_media_change, ieee80211_media_status);
333 
334 	bpfattach_dlt(ifp, DLT_IEEE802_11_RADIO,
335 	    sizeof (struct ieee80211_frame) + 64, &sc->sc_drvbpf);
336 
337 	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
338 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
339 	sc->sc_rxtap.wr_ihdr.it_present = htole32(RT2560_RX_RADIOTAP_PRESENT);
340 
341 	sc->sc_txtap_len = sizeof sc->sc_txtapu;
342 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
343 	sc->sc_txtap.wt_ihdr.it_present = htole32(RT2560_TX_RADIOTAP_PRESENT);
344 
345 	/*
346 	 * Add a few sysctl knobs.
347 	 */
348 	sc->dwelltime = 200;
349 
350 	SYSCTL_ADD_INT(&sc->sysctl_ctx,
351 	    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO,
352 	    "txantenna", CTLFLAG_RW, &sc->tx_ant, 0, "tx antenna (0=auto)");
353 
354 	SYSCTL_ADD_INT(&sc->sysctl_ctx,
355 	    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO,
356 	    "rxantenna", CTLFLAG_RW, &sc->rx_ant, 0, "rx antenna (0=auto)");
357 
358 	SYSCTL_ADD_INT(&sc->sysctl_ctx,
359 	    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO, "dwell",
360 	    CTLFLAG_RW, &sc->dwelltime, 0,
361 	    "channel dwell time (ms) for AP/station scanning");
362 
363 	error = bus_setup_intr(dev, sc->sc_irq, INTR_MPSAFE, rt2560_intr,
364 			       sc, &sc->sc_ih, ifp->if_serializer);
365 	if (error != 0) {
366 		device_printf(dev, "could not set up interrupt\n");
367 		bpfdetach(ifp);
368 		ieee80211_ifdetach(ic);
369 		goto fail;
370 	}
371 
372 	if (bootverbose)
373 		ieee80211_announce(ic);
374 	return 0;
375 fail:
376 	rt2560_detach(sc);
377 	return error;
378 }
379 
380 int
381 rt2560_detach(void *xsc)
382 {
383 	struct rt2560_softc *sc = xsc;
384 	struct ieee80211com *ic = &sc->sc_ic;
385 	struct ifnet *ifp = ic->ic_ifp;
386 
387 	if (device_is_attached(sc->sc_dev)) {
388 		lwkt_serialize_enter(ifp->if_serializer);
389 
390 		callout_stop(&sc->scan_ch);
391 
392 		rt2560_stop(sc);
393 		bus_teardown_intr(sc->sc_dev, sc->sc_irq, sc->sc_ih);
394 
395 		lwkt_serialize_exit(ifp->if_serializer);
396 
397 		bpfdetach(ifp);
398 		ieee80211_ifdetach(ic);
399 	}
400 
401 	rt2560_free_tx_ring(sc, &sc->txq);
402 	rt2560_free_tx_ring(sc, &sc->atimq);
403 	rt2560_free_tx_ring(sc, &sc->prioq);
404 	rt2560_free_tx_ring(sc, &sc->bcnq);
405 	rt2560_free_rx_ring(sc, &sc->rxq);
406 
407 	if (sc->sc_irq != NULL) {
408 		bus_release_resource(sc->sc_dev, SYS_RES_IRQ, sc->sc_irq_rid,
409 				     sc->sc_irq);
410 	}
411 
412 	if (sc->sysctl_tree != NULL)
413 		sysctl_ctx_free(&sc->sysctl_ctx);
414 
415 	return 0;
416 }
417 
418 void
419 rt2560_shutdown(void *xsc)
420 {
421 	struct rt2560_softc *sc = xsc;
422 	struct ifnet *ifp = &sc->sc_ic.ic_if;
423 
424 	lwkt_serialize_enter(ifp->if_serializer);
425 	rt2560_stop(sc);
426 	lwkt_serialize_exit(ifp->if_serializer);
427 }
428 
429 void
430 rt2560_suspend(void *xsc)
431 {
432 	struct rt2560_softc *sc = xsc;
433 	struct ifnet *ifp = &sc->sc_ic.ic_if;
434 
435 	lwkt_serialize_enter(ifp->if_serializer);
436 	rt2560_stop(sc);
437 	lwkt_serialize_exit(ifp->if_serializer);
438 }
439 
440 void
441 rt2560_resume(void *xsc)
442 {
443 	struct rt2560_softc *sc = xsc;
444 	struct ifnet *ifp = sc->sc_ic.ic_ifp;
445 
446 	lwkt_serialize_enter(ifp->if_serializer);
447 	if (ifp->if_flags & IFF_UP) {
448 		ifp->if_init(ifp->if_softc);
449 		if (ifp->if_flags & IFF_RUNNING)
450 			ifp->if_start(ifp);
451 	}
452 	lwkt_serialize_exit(ifp->if_serializer);
453 }
454 
455 static void
456 rt2560_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nseg, int error)
457 {
458 	if (error != 0)
459 		return;
460 
461 	KASSERT(nseg == 1, ("too many DMA segments, %d should be 1", nseg));
462 
463 	*(bus_addr_t *)arg = segs[0].ds_addr;
464 }
465 
466 static int
467 rt2560_alloc_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring,
468     int count)
469 {
470 	int i, error;
471 
472 	ring->count = count;
473 	ring->queued = 0;
474 	ring->cur = ring->next = 0;
475 	ring->cur_encrypt = ring->next_encrypt = 0;
476 
477 	error = bus_dma_tag_create(NULL, 4, 0, BUS_SPACE_MAXADDR_32BIT,
478 	    BUS_SPACE_MAXADDR, NULL, NULL, count * RT2560_TX_DESC_SIZE, 1,
479 	    count * RT2560_TX_DESC_SIZE, 0, &ring->desc_dmat);
480 	if (error != 0) {
481 		device_printf(sc->sc_dev, "could not create desc DMA tag\n");
482 		goto fail;
483 	}
484 
485 	error = bus_dmamem_alloc(ring->desc_dmat, (void **)&ring->desc,
486 	    BUS_DMA_WAITOK | BUS_DMA_ZERO, &ring->desc_map);
487 	if (error != 0) {
488 		device_printf(sc->sc_dev, "could not allocate DMA memory\n");
489 		goto fail;
490 	}
491 
492 	error = bus_dmamap_load(ring->desc_dmat, ring->desc_map, ring->desc,
493 	    			count * RT2560_TX_DESC_SIZE,
494 				rt2560_dma_map_addr, &ring->physaddr, 0);
495 	if (error != 0) {
496 		device_printf(sc->sc_dev, "could not load desc DMA map\n");
497 
498 		bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
499 		ring->desc = NULL;
500 		goto fail;
501 	}
502 
503 	ring->data = kmalloc(count * sizeof (struct rt2560_tx_data), M_DEVBUF,
504 	    M_WAITOK | M_ZERO);
505 
506 	error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
507 	    BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, RT2560_MAX_SCATTER,
508 	    MCLBYTES, 0, &ring->data_dmat);
509 	if (error != 0) {
510 		device_printf(sc->sc_dev, "could not create data DMA tag\n");
511 		goto fail;
512 	}
513 
514 	for (i = 0; i < count; i++) {
515 		error = bus_dmamap_create(ring->data_dmat, 0,
516 		    &ring->data[i].map);
517 		if (error != 0) {
518 			device_printf(sc->sc_dev, "could not create DMA map\n");
519 			goto fail;
520 		}
521 	}
522 	return 0;
523 
524 fail:	rt2560_free_tx_ring(sc, ring);
525 	return error;
526 }
527 
528 static void
529 rt2560_reset_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring)
530 {
531 	struct rt2560_tx_desc *desc;
532 	struct rt2560_tx_data *data;
533 	int i;
534 
535 	for (i = 0; i < ring->count; i++) {
536 		desc = &ring->desc[i];
537 		data = &ring->data[i];
538 
539 		if (data->m != NULL) {
540 			bus_dmamap_sync(ring->data_dmat, data->map,
541 			    BUS_DMASYNC_POSTWRITE);
542 			bus_dmamap_unload(ring->data_dmat, data->map);
543 			m_freem(data->m);
544 			data->m = NULL;
545 		}
546 
547 		if (data->ni != NULL) {
548 			ieee80211_free_node(data->ni);
549 			data->ni = NULL;
550 		}
551 
552 		desc->flags = 0;
553 	}
554 
555 	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
556 
557 	ring->queued = 0;
558 	ring->cur = ring->next = 0;
559 	ring->cur_encrypt = ring->next_encrypt = 0;
560 }
561 
562 static void
563 rt2560_free_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring)
564 {
565 	struct rt2560_tx_data *data;
566 	int i;
567 
568 	if (ring->desc != NULL) {
569 		bus_dmamap_sync(ring->desc_dmat, ring->desc_map,
570 		    BUS_DMASYNC_POSTWRITE);
571 		bus_dmamap_unload(ring->desc_dmat, ring->desc_map);
572 		bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
573 		ring->desc = NULL;
574 	}
575 
576 	if (ring->desc_dmat != NULL) {
577 		bus_dma_tag_destroy(ring->desc_dmat);
578 		ring->desc_dmat = NULL;
579 	}
580 
581 	if (ring->data != NULL) {
582 		for (i = 0; i < ring->count; i++) {
583 			data = &ring->data[i];
584 
585 			if (data->m != NULL) {
586 				bus_dmamap_sync(ring->data_dmat, data->map,
587 				    BUS_DMASYNC_POSTWRITE);
588 				bus_dmamap_unload(ring->data_dmat, data->map);
589 				m_freem(data->m);
590 				data->m = NULL;
591 			}
592 
593 			if (data->ni != NULL) {
594 				ieee80211_free_node(data->ni);
595 				data->ni = NULL;
596 			}
597 
598 			if (data->map != NULL) {
599 				bus_dmamap_destroy(ring->data_dmat, data->map);
600 				data->map = NULL;
601 			}
602 		}
603 
604 		kfree(ring->data, M_DEVBUF);
605 		ring->data = NULL;
606 	}
607 
608 	if (ring->data_dmat != NULL) {
609 		bus_dma_tag_destroy(ring->data_dmat);
610 		ring->data_dmat = NULL;
611 	}
612 }
613 
614 static int
615 rt2560_alloc_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring,
616     int count)
617 {
618 	struct rt2560_rx_desc *desc;
619 	struct rt2560_rx_data *data;
620 	bus_addr_t physaddr;
621 	int i, error;
622 
623 	ring->count = count;
624 	ring->cur = ring->next = 0;
625 	ring->cur_decrypt = 0;
626 
627 	error = bus_dma_tag_create(NULL, 4, 0, BUS_SPACE_MAXADDR_32BIT,
628 	    BUS_SPACE_MAXADDR, NULL, NULL, count * RT2560_RX_DESC_SIZE, 1,
629 	    count * RT2560_RX_DESC_SIZE, 0, &ring->desc_dmat);
630 	if (error != 0) {
631 		device_printf(sc->sc_dev, "could not create desc DMA tag\n");
632 		goto fail;
633 	}
634 
635 	error = bus_dmamem_alloc(ring->desc_dmat, (void **)&ring->desc,
636 	    BUS_DMA_WAITOK | BUS_DMA_ZERO, &ring->desc_map);
637 	if (error != 0) {
638 		device_printf(sc->sc_dev, "could not allocate DMA memory\n");
639 		goto fail;
640 	}
641 
642 	error = bus_dmamap_load(ring->desc_dmat, ring->desc_map, ring->desc,
643 				count * RT2560_RX_DESC_SIZE,
644 				rt2560_dma_map_addr, &ring->physaddr, 0);
645 	if (error != 0) {
646 		device_printf(sc->sc_dev, "could not load desc DMA map\n");
647 
648 		bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
649 		ring->desc = NULL;
650 		goto fail;
651 	}
652 
653 	ring->data = kmalloc(count * sizeof (struct rt2560_rx_data), M_DEVBUF,
654 	    M_WAITOK | M_ZERO);
655 
656 	/*
657 	 * Pre-allocate Rx buffers and populate Rx ring.
658 	 */
659 	error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
660 	    BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, 1, MCLBYTES, 0,
661 	    &ring->data_dmat);
662 	if (error != 0) {
663 		device_printf(sc->sc_dev, "could not create data DMA tag\n");
664 		goto fail;
665 	}
666 
667 	for (i = 0; i < count; i++) {
668 		desc = &sc->rxq.desc[i];
669 		data = &sc->rxq.data[i];
670 
671 		error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
672 		if (error != 0) {
673 			device_printf(sc->sc_dev, "could not create DMA map\n");
674 			goto fail;
675 		}
676 
677 		data->m = m_getcl(MB_WAIT, MT_DATA, M_PKTHDR);
678 		if (data->m == NULL) {
679 			device_printf(sc->sc_dev,
680 			    "could not allocate rx mbuf\n");
681 			error = ENOMEM;
682 			goto fail;
683 		}
684 
685 		error = bus_dmamap_load(ring->data_dmat, data->map,
686 		    mtod(data->m, void *), MCLBYTES, rt2560_dma_map_addr,
687 		    &physaddr, 0);
688 		if (error != 0) {
689 			device_printf(sc->sc_dev,
690 			    "could not load rx buf DMA map");
691 
692 			m_freem(data->m);
693 			data->m = NULL;
694 			goto fail;
695 		}
696 
697 		desc->flags = htole32(RT2560_RX_BUSY);
698 		desc->physaddr = htole32(physaddr);
699 	}
700 
701 	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
702 
703 	return 0;
704 
705 fail:	rt2560_free_rx_ring(sc, ring);
706 	return error;
707 }
708 
709 static void
710 rt2560_reset_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring)
711 {
712 	int i;
713 
714 	for (i = 0; i < ring->count; i++) {
715 		ring->desc[i].flags = htole32(RT2560_RX_BUSY);
716 		ring->data[i].drop = 0;
717 	}
718 
719 	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
720 
721 	ring->cur = ring->next = 0;
722 	ring->cur_decrypt = 0;
723 }
724 
725 static void
726 rt2560_free_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring)
727 {
728 	struct rt2560_rx_data *data;
729 
730 	if (ring->desc != NULL) {
731 		bus_dmamap_sync(ring->desc_dmat, ring->desc_map,
732 		    BUS_DMASYNC_POSTWRITE);
733 		bus_dmamap_unload(ring->desc_dmat, ring->desc_map);
734 		bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
735 		ring->desc = NULL;
736 	}
737 
738 	if (ring->desc_dmat != NULL) {
739 		bus_dma_tag_destroy(ring->desc_dmat);
740 		ring->desc_dmat = NULL;
741 	}
742 
743 	if (ring->data != NULL) {
744 		int i;
745 
746 		for (i = 0; i < ring->count; i++) {
747 			data = &ring->data[i];
748 
749 			if (data->m != NULL) {
750 				bus_dmamap_sync(ring->data_dmat, data->map,
751 				    BUS_DMASYNC_POSTREAD);
752 				bus_dmamap_unload(ring->data_dmat, data->map);
753 				m_freem(data->m);
754 				data->m = NULL;
755 			}
756 
757 			if (data->map != NULL) {
758 				bus_dmamap_destroy(ring->data_dmat, data->map);
759 				data->map = NULL;
760 			}
761 		}
762 
763 		kfree(ring->data, M_DEVBUF);
764 		ring->data = NULL;
765 	}
766 
767 	if (ring->data_dmat != NULL) {
768 		bus_dma_tag_destroy(ring->data_dmat);
769 		ring->data_dmat = NULL;
770 	}
771 }
772 
773 static int
774 rt2560_media_change(struct ifnet *ifp)
775 {
776 	struct rt2560_softc *sc = ifp->if_softc;
777 	int error;
778 
779 	error = ieee80211_media_change(ifp);
780 	if (error != ENETRESET)
781 		return error;
782 
783 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
784 		rt2560_init(sc);
785 	return 0;
786 }
787 
788 /*
789  * This function is called periodically (every 200ms) during scanning to
790  * switch from one channel to another.
791  */
792 static void
793 rt2560_next_scan(void *arg)
794 {
795 	struct rt2560_softc *sc = arg;
796 	struct ieee80211com *ic = &sc->sc_ic;
797 	struct ifnet *ifp = ic->ic_ifp;
798 
799 	lwkt_serialize_enter(ifp->if_serializer);
800 	if (ic->ic_state == IEEE80211_S_SCAN)
801 		ieee80211_next_scan(ic);
802 	lwkt_serialize_exit(ifp->if_serializer);
803 }
804 
805 static int
806 rt2560_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
807 {
808 	struct rt2560_softc *sc = ic->ic_ifp->if_softc;
809 	enum ieee80211_state ostate;
810 	struct ieee80211_node *ni;
811 	struct mbuf *m;
812 	int error = 0;
813 
814 	ostate = ic->ic_state;
815 	callout_stop(&sc->scan_ch);
816 	ieee80211_ratectl_newstate(ic, nstate);
817 
818 	switch (nstate) {
819 	case IEEE80211_S_INIT:
820 		if (ostate == IEEE80211_S_RUN) {
821 			/* abort TSF synchronization */
822 			RAL_WRITE(sc, RT2560_CSR14, 0);
823 
824 			/* turn association led off */
825 			rt2560_update_led(sc, 0, 0);
826 		}
827 		break;
828 
829 	case IEEE80211_S_SCAN:
830 		rt2560_set_chan(sc, ic->ic_curchan);
831 		callout_reset(&sc->scan_ch, (sc->dwelltime * hz) / 1000,
832 		    rt2560_next_scan, sc);
833 		break;
834 
835 	case IEEE80211_S_AUTH:
836 		rt2560_set_chan(sc, ic->ic_curchan);
837 		break;
838 
839 	case IEEE80211_S_ASSOC:
840 		rt2560_set_chan(sc, ic->ic_curchan);
841 		break;
842 
843 	case IEEE80211_S_RUN:
844 		rt2560_set_chan(sc, ic->ic_curchan);
845 
846 		ni = ic->ic_bss;
847 
848 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
849 			rt2560_update_plcp(sc);
850 			rt2560_set_basicrates(sc);
851 			rt2560_set_bssid(sc, ni->ni_bssid);
852 		}
853 
854 		if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
855 		    ic->ic_opmode == IEEE80211_M_IBSS) {
856 			m = ieee80211_beacon_alloc(ic, ni, &sc->sc_bo);
857 			if (m == NULL) {
858 				device_printf(sc->sc_dev,
859 				    "could not allocate beacon\n");
860 				error = ENOBUFS;
861 				break;
862 			}
863 
864 			ieee80211_ref_node(ni);
865 			error = rt2560_tx_bcn(sc, m, ni);
866 			if (error != 0)
867 				break;
868 		}
869 
870 		/* turn assocation led on */
871 		rt2560_update_led(sc, 1, 0);
872 
873 		if (ic->ic_opmode != IEEE80211_M_MONITOR)
874 			rt2560_enable_tsf_sync(sc);
875 		break;
876 	}
877 
878 	return (error != 0) ? error : sc->sc_newstate(ic, nstate, arg);
879 }
880 
881 /*
882  * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46 or
883  * 93C66).
884  */
885 static uint16_t
886 rt2560_eeprom_read(struct rt2560_softc *sc, uint8_t addr)
887 {
888 	uint32_t tmp;
889 	uint16_t val;
890 	int n;
891 
892 	/* clock C once before the first command */
893 	RT2560_EEPROM_CTL(sc, 0);
894 
895 	RT2560_EEPROM_CTL(sc, RT2560_S);
896 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
897 	RT2560_EEPROM_CTL(sc, RT2560_S);
898 
899 	/* write start bit (1) */
900 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D);
901 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D | RT2560_C);
902 
903 	/* write READ opcode (10) */
904 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D);
905 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D | RT2560_C);
906 	RT2560_EEPROM_CTL(sc, RT2560_S);
907 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
908 
909 	/* write address (A5-A0 or A7-A0) */
910 	n = (RAL_READ(sc, RT2560_CSR21) & RT2560_93C46) ? 5 : 7;
911 	for (; n >= 0; n--) {
912 		RT2560_EEPROM_CTL(sc, RT2560_S |
913 		    (((addr >> n) & 1) << RT2560_SHIFT_D));
914 		RT2560_EEPROM_CTL(sc, RT2560_S |
915 		    (((addr >> n) & 1) << RT2560_SHIFT_D) | RT2560_C);
916 	}
917 
918 	RT2560_EEPROM_CTL(sc, RT2560_S);
919 
920 	/* read data Q15-Q0 */
921 	val = 0;
922 	for (n = 15; n >= 0; n--) {
923 		RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
924 		tmp = RAL_READ(sc, RT2560_CSR21);
925 		val |= ((tmp & RT2560_Q) >> RT2560_SHIFT_Q) << n;
926 		RT2560_EEPROM_CTL(sc, RT2560_S);
927 	}
928 
929 	RT2560_EEPROM_CTL(sc, 0);
930 
931 	/* clear Chip Select and clock C */
932 	RT2560_EEPROM_CTL(sc, RT2560_S);
933 	RT2560_EEPROM_CTL(sc, 0);
934 	RT2560_EEPROM_CTL(sc, RT2560_C);
935 
936 	return val;
937 }
938 
939 /*
940  * Some frames were processed by the hardware cipher engine and are ready for
941  * transmission.
942  */
943 static void
944 rt2560_encryption_intr(struct rt2560_softc *sc)
945 {
946 	struct rt2560_tx_desc *desc;
947 	int hw;
948 
949 	/* retrieve last descriptor index processed by cipher engine */
950 	hw = RAL_READ(sc, RT2560_SECCSR1) - sc->txq.physaddr;
951 	hw /= RT2560_TX_DESC_SIZE;
952 
953 	bus_dmamap_sync(sc->txq.desc_dmat, sc->txq.desc_map,
954 	    BUS_DMASYNC_POSTREAD);
955 
956 	for (; sc->txq.next_encrypt != hw;) {
957 		desc = &sc->txq.desc[sc->txq.next_encrypt];
958 
959 		if ((le32toh(desc->flags) & RT2560_TX_BUSY) ||
960 		    (le32toh(desc->flags) & RT2560_TX_CIPHER_BUSY))
961 			break;
962 
963 		/* for TKIP, swap eiv field to fix a bug in ASIC */
964 		if ((le32toh(desc->flags) & RT2560_TX_CIPHER_MASK) ==
965 		    RT2560_TX_CIPHER_TKIP)
966 			desc->eiv = bswap32(desc->eiv);
967 
968 		/* mark the frame ready for transmission */
969 		desc->flags |= htole32(RT2560_TX_VALID);
970 		desc->flags |= htole32(RT2560_TX_BUSY);
971 
972 		DPRINTFN(15, ("encryption done idx=%u\n",
973 		    sc->txq.next_encrypt));
974 
975 		sc->txq.next_encrypt =
976 		    (sc->txq.next_encrypt + 1) % RT2560_TX_RING_COUNT;
977 	}
978 
979 	bus_dmamap_sync(sc->txq.desc_dmat, sc->txq.desc_map,
980 	    BUS_DMASYNC_PREWRITE);
981 
982 	/* kick Tx */
983 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_TX);
984 }
985 
986 static void
987 rt2560_tx_intr(struct rt2560_softc *sc)
988 {
989 	struct ieee80211com *ic = &sc->sc_ic;
990 	struct ifnet *ifp = ic->ic_ifp;
991 
992 	bus_dmamap_sync(sc->txq.desc_dmat, sc->txq.desc_map,
993 	    BUS_DMASYNC_POSTREAD);
994 
995 	for (;;) {
996 		struct rt2560_tx_desc *desc;
997 		struct rt2560_tx_data *data;
998 		struct ieee80211_node *ni;
999 		int rateidx, data_retries, failed;
1000 		struct mbuf *m;
1001 		uint32_t flags;
1002 
1003 		desc = &sc->txq.desc[sc->txq.next];
1004 		data = &sc->txq.data[sc->txq.next];
1005 
1006 		flags = le32toh(desc->flags);
1007 
1008 		if ((flags & RT2560_TX_BUSY) ||
1009 		    (flags & RT2560_TX_CIPHER_BUSY) ||
1010 		    !(flags & RT2560_TX_VALID))
1011 			break;
1012 
1013 		rateidx = data->rateidx;
1014 		ni = data->ni;
1015 		m = data->m;
1016 
1017 		data->ni = NULL;
1018 		data->m = NULL;
1019 
1020 		failed = 0;
1021 		switch (flags & RT2560_TX_RESULT_MASK) {
1022 		case RT2560_TX_SUCCESS:
1023 			DPRINTFN(10, ("data frame sent successfully\n"));
1024 			ifp->if_opackets++;
1025 			data_retries = 0;
1026 			break;
1027 
1028 		case RT2560_TX_SUCCESS_RETRY:
1029 			data_retries = (flags >> 5) & 0x7;
1030 			DPRINTFN(9, ("data frame sent after %u retries\n",
1031 				 data_retries));
1032 			ifp->if_opackets++;
1033 			break;
1034 
1035 		case RT2560_TX_FAIL_RETRY:
1036 			DPRINTFN(9, ("sending data frame failed (too much "
1037 			    "retries)\n"));
1038 			ifp->if_oerrors++;
1039 			data_retries = 7;
1040 			failed = 1;
1041 			break;
1042 
1043 		case RT2560_TX_FAIL_INVALID:
1044 		case RT2560_TX_FAIL_OTHER:
1045 		default:
1046 			data_retries = 7;
1047 			failed = 1;
1048 			device_printf(sc->sc_dev, "sending data frame failed "
1049 			    "0x%08x\n", flags);
1050 			ifp->if_oerrors++;
1051 			break;
1052 		}
1053 
1054 		bus_dmamap_sync(sc->txq.data_dmat, data->map,
1055 		    BUS_DMASYNC_POSTWRITE);
1056 		bus_dmamap_unload(sc->txq.data_dmat, data->map);
1057 
1058 		if (rateidx >= 0) {
1059 			struct ieee80211_ratectl_res res;
1060 
1061 			res.rc_res_tries = data_retries + 1;
1062 			res.rc_res_rateidx = rateidx;
1063 			ieee80211_ratectl_tx_complete(ni, m->m_pkthdr.len,
1064 				&res, 1, data_retries, 0, failed);
1065 		}
1066 
1067 		m_freem(m);
1068 		ieee80211_free_node(ni);
1069 
1070 		/* descriptor is no longer valid */
1071 		desc->flags &= ~htole32(RT2560_TX_VALID);
1072 
1073 		DPRINTFN(15, ("tx done idx=%u\n", sc->txq.next));
1074 
1075 		sc->txq.queued--;
1076 		sc->txq.next = (sc->txq.next + 1) % RT2560_TX_RING_COUNT;
1077 	}
1078 
1079 	bus_dmamap_sync(sc->txq.desc_dmat, sc->txq.desc_map,
1080 	    BUS_DMASYNC_PREWRITE);
1081 
1082 	sc->sc_tx_timer = 0;
1083 	ifp->if_flags &= ~IFF_OACTIVE;
1084 	rt2560_start(ifp);
1085 }
1086 
1087 static void
1088 rt2560_prio_intr(struct rt2560_softc *sc)
1089 {
1090 	struct ieee80211com *ic = &sc->sc_ic;
1091 	struct ifnet *ifp = ic->ic_ifp;
1092 	struct rt2560_tx_desc *desc;
1093 	struct rt2560_tx_data *data;
1094 
1095 	bus_dmamap_sync(sc->prioq.desc_dmat, sc->prioq.desc_map,
1096 	    BUS_DMASYNC_POSTREAD);
1097 
1098 	for (;;) {
1099 		desc = &sc->prioq.desc[sc->prioq.next];
1100 		data = &sc->prioq.data[sc->prioq.next];
1101 
1102 		if ((le32toh(desc->flags) & RT2560_TX_BUSY) ||
1103 		    !(le32toh(desc->flags) & RT2560_TX_VALID))
1104 			break;
1105 
1106 		switch (le32toh(desc->flags) & RT2560_TX_RESULT_MASK) {
1107 		case RT2560_TX_SUCCESS:
1108 			DPRINTFN(10, ("mgt frame sent successfully\n"));
1109 			break;
1110 
1111 		case RT2560_TX_SUCCESS_RETRY:
1112 			DPRINTFN(9, ("mgt frame sent after %u retries\n",
1113 			    (le32toh(desc->flags) >> 5) & 0x7));
1114 			break;
1115 
1116 		case RT2560_TX_FAIL_RETRY:
1117 			DPRINTFN(9, ("sending mgt frame failed (too much "
1118 			    "retries)\n"));
1119 			break;
1120 
1121 		case RT2560_TX_FAIL_INVALID:
1122 		case RT2560_TX_FAIL_OTHER:
1123 		default:
1124 			device_printf(sc->sc_dev, "sending mgt frame failed "
1125 			    "0x%08x\n", le32toh(desc->flags));
1126 		}
1127 
1128 		bus_dmamap_sync(sc->prioq.data_dmat, data->map,
1129 		    BUS_DMASYNC_POSTWRITE);
1130 		bus_dmamap_unload(sc->prioq.data_dmat, data->map);
1131 		m_freem(data->m);
1132 		data->m = NULL;
1133 
1134 		KASSERT(data->ni == NULL, ("mgmt node is not empty\n"));
1135 
1136 		/* descriptor is no longer valid */
1137 		desc->flags &= ~htole32(RT2560_TX_VALID);
1138 
1139 		DPRINTFN(15, ("prio done idx=%u\n", sc->prioq.next));
1140 
1141 		sc->prioq.queued--;
1142 		sc->prioq.next = (sc->prioq.next + 1) % RT2560_PRIO_RING_COUNT;
1143 	}
1144 
1145 	bus_dmamap_sync(sc->prioq.desc_dmat, sc->prioq.desc_map,
1146 	    BUS_DMASYNC_PREWRITE);
1147 
1148 	sc->sc_tx_timer = 0;
1149 	ifp->if_flags &= ~IFF_OACTIVE;
1150 	rt2560_start(ifp);
1151 }
1152 
1153 /*
1154  * Some frames were processed by the hardware cipher engine and are ready for
1155  * transmission to the IEEE802.11 layer.
1156  */
1157 static void
1158 rt2560_decryption_intr(struct rt2560_softc *sc)
1159 {
1160 	struct ieee80211com *ic = &sc->sc_ic;
1161 	struct ifnet *ifp = ic->ic_ifp;
1162 	struct rt2560_rx_desc *desc;
1163 	struct rt2560_rx_data *data;
1164 	bus_addr_t physaddr;
1165 	struct ieee80211_frame *wh;
1166 	struct ieee80211_node *ni;
1167 	struct mbuf *mnew, *m;
1168 	int hw, error;
1169 
1170 	/* retrieve last decriptor index processed by cipher engine */
1171 	hw = RAL_READ(sc, RT2560_SECCSR0) - sc->rxq.physaddr;
1172 	hw /= RT2560_RX_DESC_SIZE;
1173 
1174 	bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
1175 	    BUS_DMASYNC_POSTREAD);
1176 
1177 	for (; sc->rxq.cur_decrypt != hw;) {
1178 		desc = &sc->rxq.desc[sc->rxq.cur_decrypt];
1179 		data = &sc->rxq.data[sc->rxq.cur_decrypt];
1180 
1181 		if ((le32toh(desc->flags) & RT2560_RX_BUSY) ||
1182 		    (le32toh(desc->flags) & RT2560_RX_CIPHER_BUSY))
1183 			break;
1184 
1185 		if (data->drop) {
1186 			ifp->if_ierrors++;
1187 			goto skip;
1188 		}
1189 
1190 		if ((le32toh(desc->flags) & RT2560_RX_CIPHER_MASK) != 0 &&
1191 		    (le32toh(desc->flags) & RT2560_RX_ICV_ERROR)) {
1192 			ifp->if_ierrors++;
1193 			goto skip;
1194 		}
1195 
1196 		/*
1197 		 * Try to allocate a new mbuf for this ring element and load it
1198 		 * before processing the current mbuf. If the ring element
1199 		 * cannot be loaded, drop the received packet and reuse the old
1200 		 * mbuf. In the unlikely case that the old mbuf can't be
1201 		 * reloaded either, explicitly panic.
1202 		 */
1203 		mnew = m_getcl(MB_DONTWAIT, MT_DATA, M_PKTHDR);
1204 		if (mnew == NULL) {
1205 			ifp->if_ierrors++;
1206 			goto skip;
1207 		}
1208 
1209 		bus_dmamap_sync(sc->rxq.data_dmat, data->map,
1210 		    BUS_DMASYNC_POSTREAD);
1211 		bus_dmamap_unload(sc->rxq.data_dmat, data->map);
1212 
1213 		error = bus_dmamap_load(sc->rxq.data_dmat, data->map,
1214 		    mtod(mnew, void *), MCLBYTES, rt2560_dma_map_addr,
1215 		    &physaddr, 0);
1216 		if (error != 0) {
1217 			m_freem(mnew);
1218 
1219 			/* try to reload the old mbuf */
1220 			error = bus_dmamap_load(sc->rxq.data_dmat, data->map,
1221 			    mtod(data->m, void *), MCLBYTES,
1222 			    rt2560_dma_map_addr, &physaddr, 0);
1223 			if (error != 0) {
1224 				/* very unlikely that it will fail... */
1225 				panic("%s: could not load old rx mbuf",
1226 				    device_get_name(sc->sc_dev));
1227 			}
1228 			ifp->if_ierrors++;
1229 			goto skip;
1230 		}
1231 
1232 		/*
1233 	 	 * New mbuf successfully loaded, update Rx ring and continue
1234 		 * processing.
1235 		 */
1236 		m = data->m;
1237 		data->m = mnew;
1238 		desc->physaddr = htole32(physaddr);
1239 
1240 		/* finalize mbuf */
1241 		m->m_pkthdr.rcvif = ifp;
1242 		m->m_pkthdr.len = m->m_len =
1243 		    (le32toh(desc->flags) >> 16) & 0xfff;
1244 
1245 		if (sc->sc_drvbpf != NULL) {
1246 			struct rt2560_rx_radiotap_header *tap = &sc->sc_rxtap;
1247 			uint32_t tsf_lo, tsf_hi;
1248 
1249 			/* get timestamp (low and high 32 bits) */
1250 			tsf_hi = RAL_READ(sc, RT2560_CSR17);
1251 			tsf_lo = RAL_READ(sc, RT2560_CSR16);
1252 
1253 			tap->wr_tsf =
1254 			    htole64(((uint64_t)tsf_hi << 32) | tsf_lo);
1255 			tap->wr_flags = 0;
1256 			tap->wr_rate = rt2560_rxrate(desc);
1257 			tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
1258 			tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
1259 			tap->wr_antenna = sc->rx_ant;
1260 			tap->wr_antsignal = RT2560_RSSI(sc, desc->rssi);
1261 
1262 			bpf_ptap(sc->sc_drvbpf, m, tap, sc->sc_rxtap_len);
1263 		}
1264 
1265 		wh = mtod(m, struct ieee80211_frame *);
1266 		ni = ieee80211_find_rxnode(ic,
1267 		    (struct ieee80211_frame_min *)wh);
1268 
1269 		/* send the frame to the 802.11 layer */
1270 		ieee80211_input(ic, m, ni, RT2560_RSSI(sc, desc->rssi), 0);
1271 
1272 		/* node is no longer needed */
1273 		ieee80211_free_node(ni);
1274 
1275 skip:		desc->flags = htole32(RT2560_RX_BUSY);
1276 
1277 		DPRINTFN(15, ("decryption done idx=%u\n", sc->rxq.cur_decrypt));
1278 
1279 		sc->rxq.cur_decrypt =
1280 		    (sc->rxq.cur_decrypt + 1) % RT2560_RX_RING_COUNT;
1281 	}
1282 
1283 	bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
1284 	    BUS_DMASYNC_PREWRITE);
1285 }
1286 
1287 /*
1288  * Some frames were received. Pass them to the hardware cipher engine before
1289  * sending them to the 802.11 layer.
1290  */
1291 static void
1292 rt2560_rx_intr(struct rt2560_softc *sc)
1293 {
1294 	struct rt2560_rx_desc *desc;
1295 	struct rt2560_rx_data *data;
1296 
1297 	bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
1298 	    BUS_DMASYNC_POSTREAD);
1299 
1300 	for (;;) {
1301 		desc = &sc->rxq.desc[sc->rxq.cur];
1302 		data = &sc->rxq.data[sc->rxq.cur];
1303 
1304 		if ((le32toh(desc->flags) & RT2560_RX_BUSY) ||
1305 		    (le32toh(desc->flags) & RT2560_RX_CIPHER_BUSY))
1306 			break;
1307 
1308 		data->drop = 0;
1309 
1310 		if ((le32toh(desc->flags) & RT2560_RX_PHY_ERROR) ||
1311 		    (le32toh(desc->flags) & RT2560_RX_CRC_ERROR)) {
1312 			/*
1313 			 * This should not happen since we did not request
1314 			 * to receive those frames when we filled RXCSR0.
1315 			 */
1316 			DPRINTFN(5, ("PHY or CRC error flags 0x%08x\n",
1317 			    le32toh(desc->flags)));
1318 			data->drop = 1;
1319 		}
1320 
1321 		if (((le32toh(desc->flags) >> 16) & 0xfff) > MCLBYTES) {
1322 			DPRINTFN(5, ("bad length\n"));
1323 			data->drop = 1;
1324 		}
1325 
1326 		/* mark the frame for decryption */
1327 		desc->flags |= htole32(RT2560_RX_CIPHER_BUSY);
1328 
1329 		DPRINTFN(15, ("rx done idx=%u\n", sc->rxq.cur));
1330 
1331 		sc->rxq.cur = (sc->rxq.cur + 1) % RT2560_RX_RING_COUNT;
1332 	}
1333 
1334 	bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
1335 	    BUS_DMASYNC_PREWRITE);
1336 
1337 	/* kick decrypt */
1338 	RAL_WRITE(sc, RT2560_SECCSR0, RT2560_KICK_DECRYPT);
1339 }
1340 
1341 /*
1342  * This function is called periodically in IBSS mode when a new beacon must be
1343  * sent out.
1344  */
1345 static void
1346 rt2560_beacon_expire(struct rt2560_softc *sc)
1347 {
1348 	struct ieee80211com *ic = &sc->sc_ic;
1349 	struct rt2560_tx_data *data;
1350 
1351 	if (ic->ic_opmode != IEEE80211_M_IBSS &&
1352 	    ic->ic_opmode != IEEE80211_M_HOSTAP)
1353 		return;
1354 
1355 	data = &sc->bcnq.data[sc->bcnq.next];
1356 
1357 	bus_dmamap_sync(sc->bcnq.data_dmat, data->map, BUS_DMASYNC_POSTWRITE);
1358 	bus_dmamap_unload(sc->bcnq.data_dmat, data->map);
1359 
1360 	ieee80211_beacon_update(ic, data->ni, &sc->sc_bo, data->m, 1);
1361 
1362 	if (ic->ic_rawbpf != NULL)
1363 		bpf_mtap(ic->ic_rawbpf, data->m);
1364 
1365 	rt2560_tx_bcn(sc, data->m, data->ni);
1366 
1367 	DPRINTFN(15, ("beacon expired\n"));
1368 
1369 	sc->bcnq.next = (sc->bcnq.next + 1) % RT2560_BEACON_RING_COUNT;
1370 }
1371 
1372 /* ARGSUSED */
1373 static void
1374 rt2560_wakeup_expire(struct rt2560_softc *sc)
1375 {
1376 	DPRINTFN(2, ("wakeup expired\n"));
1377 }
1378 
1379 static void
1380 rt2560_intr(void *arg)
1381 {
1382 	struct rt2560_softc *sc = arg;
1383 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1384 	uint32_t r;
1385 
1386 	/* disable interrupts */
1387 	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
1388 
1389 	/* don't re-enable interrupts if we're shutting down */
1390 	if (!(ifp->if_flags & IFF_RUNNING))
1391 		return;
1392 
1393 	r = RAL_READ(sc, RT2560_CSR7);
1394 	RAL_WRITE(sc, RT2560_CSR7, r);
1395 
1396 	if (r & RT2560_BEACON_EXPIRE)
1397 		rt2560_beacon_expire(sc);
1398 
1399 	if (r & RT2560_WAKEUP_EXPIRE)
1400 		rt2560_wakeup_expire(sc);
1401 
1402 	if (r & RT2560_PRIO_DONE)
1403 		rt2560_prio_intr(sc);
1404 
1405 	if (r & (RT2560_TX_DONE | RT2560_ENCRYPTION_DONE)) {
1406 		int i;
1407 
1408 		for (i = 0; i < 2; ++i) {
1409 			rt2560_tx_intr(sc);
1410 			rt2560_encryption_intr(sc);
1411 		}
1412 	}
1413 
1414 	if (r & (RT2560_DECRYPTION_DONE | RT2560_RX_DONE)) {
1415 		int i;
1416 
1417 		for (i = 0; i < 2; ++i) {
1418 			rt2560_decryption_intr(sc);
1419 			rt2560_rx_intr(sc);
1420 		}
1421 	}
1422 
1423 	/* re-enable interrupts */
1424 	RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
1425 }
1426 
1427 /* quickly determine if a given rate is CCK or OFDM */
1428 #define RAL_RATE_IS_OFDM(rate) ((rate) >= 12 && (rate) != 22)
1429 
1430 #define RAL_ACK_SIZE	(sizeof(struct ieee80211_frame_ack) + IEEE80211_FCS_LEN)
1431 #define RAL_CTS_SIZE	(sizeof(struct ieee80211_frame_cts) + IEEE80211_FCS_LEN)
1432 
1433 #define RT2560_TXRX_TURNAROUND	10	/* us */
1434 
1435 /*
1436  * This function is only used by the Rx radiotap code.
1437  */
1438 static uint8_t
1439 rt2560_rxrate(struct rt2560_rx_desc *desc)
1440 {
1441 	if (le32toh(desc->flags) & RT2560_RX_OFDM) {
1442 		/* reverse function of rt2560_plcp_signal */
1443 		switch (desc->rate) {
1444 		case 0xb:	return 12;
1445 		case 0xf:	return 18;
1446 		case 0xa:	return 24;
1447 		case 0xe:	return 36;
1448 		case 0x9:	return 48;
1449 		case 0xd:	return 72;
1450 		case 0x8:	return 96;
1451 		case 0xc:	return 108;
1452 		}
1453 	} else {
1454 		if (desc->rate == 10)
1455 			return 2;
1456 		if (desc->rate == 20)
1457 			return 4;
1458 		if (desc->rate == 55)
1459 			return 11;
1460 		if (desc->rate == 110)
1461 			return 22;
1462 	}
1463 	return 2;	/* should not get there */
1464 }
1465 
1466 static uint8_t
1467 rt2560_plcp_signal(int rate)
1468 {
1469 	switch (rate) {
1470 	/* CCK rates (returned values are device-dependent) */
1471 	case 2:		return 0x0;
1472 	case 4:		return 0x1;
1473 	case 11:	return 0x2;
1474 	case 22:	return 0x3;
1475 
1476 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1477 	case 12:	return 0xb;
1478 	case 18:	return 0xf;
1479 	case 24:	return 0xa;
1480 	case 36:	return 0xe;
1481 	case 48:	return 0x9;
1482 	case 72:	return 0xd;
1483 	case 96:	return 0x8;
1484 	case 108:	return 0xc;
1485 
1486 	/* unsupported rates (should not get there) */
1487 	default:	return 0xff;
1488 	}
1489 }
1490 
1491 static void
1492 rt2560_setup_tx_desc(struct rt2560_softc *sc, struct rt2560_tx_desc *desc,
1493     uint32_t flags, int len, int rate, int encrypt, bus_addr_t physaddr)
1494 {
1495 	struct ieee80211com *ic = &sc->sc_ic;
1496 	uint16_t plcp_length;
1497 	int remainder;
1498 
1499 	desc->flags = htole32(flags);
1500 	desc->flags |= htole32(len << 16);
1501 	if (!encrypt)
1502 		desc->flags |= htole32(RT2560_TX_VALID);
1503 
1504 	desc->physaddr = htole32(physaddr);
1505 	desc->wme = htole16(
1506 	    RT2560_AIFSN(2) |
1507 	    RT2560_LOGCWMIN(3) |
1508 	    RT2560_LOGCWMAX(8));
1509 
1510 	/* setup PLCP fields */
1511 	desc->plcp_signal  = rt2560_plcp_signal(rate);
1512 	desc->plcp_service = 4;
1513 
1514 	len += IEEE80211_CRC_LEN;
1515 	if (RAL_RATE_IS_OFDM(rate)) {
1516 		desc->flags |= htole32(RT2560_TX_OFDM);
1517 
1518 		plcp_length = len & 0xfff;
1519 		desc->plcp_length_hi = plcp_length >> 6;
1520 		desc->plcp_length_lo = plcp_length & 0x3f;
1521 	} else {
1522 		plcp_length = (16 * len + rate - 1) / rate;
1523 		if (rate == 22) {
1524 			remainder = (16 * len) % 22;
1525 			if (remainder != 0 && remainder < 7)
1526 				desc->plcp_service |= RT2560_PLCP_LENGEXT;
1527 		}
1528 		desc->plcp_length_hi = plcp_length >> 8;
1529 		desc->plcp_length_lo = plcp_length & 0xff;
1530 
1531 		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1532 			desc->plcp_signal |= 0x08;
1533 	}
1534 
1535 	desc->flags |= encrypt ? htole32(RT2560_TX_CIPHER_BUSY)
1536 			       : htole32(RT2560_TX_BUSY);
1537 }
1538 
1539 static int
1540 rt2560_tx_bcn(struct rt2560_softc *sc, struct mbuf *m0,
1541     struct ieee80211_node *ni)
1542 {
1543 	struct ieee80211com *ic = &sc->sc_ic;
1544 	struct rt2560_tx_desc *desc;
1545 	struct rt2560_tx_data *data;
1546 	bus_addr_t paddr;
1547 	int rate, error;
1548 
1549 	desc = &sc->bcnq.desc[sc->bcnq.cur];
1550 	data = &sc->bcnq.data[sc->bcnq.cur];
1551 
1552 	rate = IEEE80211_IS_CHAN_5GHZ(ni->ni_chan) ? 12 : 2;
1553 
1554 	error = bus_dmamap_load_mbuf(sc->bcnq.data_dmat, data->map, m0,
1555 				     rt2560_dma_map_mbuf, &paddr,
1556 				     BUS_DMA_NOWAIT);
1557 	if (error != 0) {
1558 		device_printf(sc->sc_dev, "could not map mbuf (error %d)\n",
1559 		    error);
1560 		m_freem(m0);
1561 		return error;
1562 	}
1563 
1564 	if (sc->sc_drvbpf != NULL) {
1565 		struct rt2560_tx_radiotap_header *tap = &sc->sc_txtap;
1566 
1567 		tap->wt_flags = 0;
1568 		tap->wt_rate = rate;
1569 		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1570 		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1571 		tap->wt_antenna = sc->tx_ant;
1572 
1573 		bpf_ptap(sc->sc_drvbpf, m0, tap, sc->sc_txtap_len);
1574 	}
1575 
1576 	data->m = m0;
1577 	data->ni = ni;
1578 
1579 	rt2560_setup_tx_desc(sc, desc, RT2560_TX_IFS_NEWBACKOFF |
1580 	    RT2560_TX_TIMESTAMP, m0->m_pkthdr.len, rate, 0, paddr);
1581 
1582 	DPRINTFN(10, ("sending beacon frame len=%u idx=%u rate=%u\n",
1583 	    m0->m_pkthdr.len, sc->bcnq.cur, rate));
1584 
1585 	bus_dmamap_sync(sc->bcnq.data_dmat, data->map, BUS_DMASYNC_PREWRITE);
1586 	bus_dmamap_sync(sc->bcnq.desc_dmat, sc->bcnq.desc_map,
1587 	    BUS_DMASYNC_PREWRITE);
1588 
1589 	sc->bcnq.cur = (sc->bcnq.cur + 1) % RT2560_BEACON_RING_COUNT;
1590 
1591 	return 0;
1592 }
1593 
1594 static int
1595 rt2560_tx_mgt(struct rt2560_softc *sc, struct mbuf *m0,
1596     struct ieee80211_node *ni)
1597 {
1598 	struct ieee80211com *ic = &sc->sc_ic;
1599 	struct rt2560_tx_desc *desc;
1600 	struct rt2560_tx_data *data;
1601 	struct ieee80211_frame *wh;
1602 	bus_addr_t paddr;
1603 	uint16_t dur;
1604 	uint32_t flags = 0;
1605 	int rate, error;
1606 
1607 	desc = &sc->prioq.desc[sc->prioq.cur];
1608 	data = &sc->prioq.data[sc->prioq.cur];
1609 
1610 	rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
1611 
1612 	error = bus_dmamap_load_mbuf(sc->prioq.data_dmat, data->map, m0,
1613 				     rt2560_dma_map_mbuf, &paddr, 0);
1614 	if (error != 0) {
1615 		device_printf(sc->sc_dev, "could not map mbuf (error %d)\n",
1616 		    error);
1617 		ieee80211_free_node(ni);
1618 		m_freem(m0);
1619 		return error;
1620 	}
1621 
1622 	if (sc->sc_drvbpf != NULL) {
1623 		struct rt2560_tx_radiotap_header *tap = &sc->sc_txtap;
1624 
1625 		tap->wt_flags = 0;
1626 		tap->wt_rate = rate;
1627 		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1628 		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1629 		tap->wt_antenna = sc->tx_ant;
1630 
1631 		bpf_ptap(sc->sc_drvbpf, m0, tap, sc->sc_txtap_len);
1632 	}
1633 
1634 	data->m = m0;
1635 	data->ni = NULL;
1636 
1637 	wh = mtod(m0, struct ieee80211_frame *);
1638 
1639 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1640 		flags |= RT2560_TX_ACK;
1641 
1642 		dur = ieee80211_txtime(ni, RAL_ACK_SIZE, rate, ic->ic_flags) +
1643 		      sc->sc_sifs;
1644 		*(uint16_t *)wh->i_dur = htole16(dur);
1645 
1646 		/* tell hardware to add timestamp for probe responses */
1647 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1648 		    IEEE80211_FC0_TYPE_MGT &&
1649 		    (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1650 		    IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1651 			flags |= RT2560_TX_TIMESTAMP;
1652 	}
1653 
1654 	rt2560_setup_tx_desc(sc, desc, flags, m0->m_pkthdr.len, rate, 0, paddr);
1655 
1656 	bus_dmamap_sync(sc->prioq.data_dmat, data->map, BUS_DMASYNC_PREWRITE);
1657 	bus_dmamap_sync(sc->prioq.desc_dmat, sc->prioq.desc_map,
1658 	    BUS_DMASYNC_PREWRITE);
1659 
1660 	DPRINTFN(10, ("sending mgt frame len=%u idx=%u rate=%u\n",
1661 	    m0->m_pkthdr.len, sc->prioq.cur, rate));
1662 
1663 	/* kick prio */
1664 	sc->prioq.queued++;
1665 	sc->prioq.cur = (sc->prioq.cur + 1) % RT2560_PRIO_RING_COUNT;
1666 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_PRIO);
1667 
1668 	ieee80211_free_node(ni);
1669 
1670 	return 0;
1671 }
1672 
1673 /*
1674  * Build a RTS control frame.
1675  */
1676 static struct mbuf *
1677 rt2560_get_rts(struct rt2560_softc *sc, struct ieee80211_frame *wh,
1678     uint16_t dur)
1679 {
1680 	struct ieee80211_frame_rts *rts;
1681 	struct mbuf *m;
1682 
1683 	MGETHDR(m, MB_DONTWAIT, MT_DATA);
1684 	if (m == NULL) {
1685 		sc->sc_ic.ic_stats.is_tx_nobuf++;
1686 		device_printf(sc->sc_dev, "could not allocate RTS frame\n");
1687 		return NULL;
1688 	}
1689 
1690 	rts = mtod(m, struct ieee80211_frame_rts *);
1691 
1692 	rts->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_CTL |
1693 	    IEEE80211_FC0_SUBTYPE_RTS;
1694 	rts->i_fc[1] = IEEE80211_FC1_DIR_NODS;
1695 	*(uint16_t *)rts->i_dur = htole16(dur);
1696 	IEEE80211_ADDR_COPY(rts->i_ra, wh->i_addr1);
1697 	IEEE80211_ADDR_COPY(rts->i_ta, wh->i_addr2);
1698 
1699 	m->m_pkthdr.len = m->m_len = sizeof(struct ieee80211_frame_rts);
1700 
1701 	return m;
1702 }
1703 
1704 static int
1705 rt2560_tx_data(struct rt2560_softc *sc, struct mbuf *m0,
1706     struct ieee80211_node *ni)
1707 {
1708 	struct ieee80211com *ic = &sc->sc_ic;
1709 	struct rt2560_tx_desc *desc;
1710 	struct rt2560_tx_data *data;
1711 	struct ieee80211_frame *wh;
1712 	struct ieee80211_key *k;
1713 	struct mbuf *mnew;
1714 	bus_addr_t paddr;
1715 	uint16_t dur;
1716 	uint32_t flags = 0;
1717 	int rate, error, ackrate, rateidx;
1718 
1719 	wh = mtod(m0, struct ieee80211_frame *);
1720 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1721 		k = ieee80211_crypto_encap(ic, ni, m0);
1722 		if (k == NULL) {
1723 			m_freem(m0);
1724 			return ENOBUFS;
1725 		}
1726 
1727 		/* packet header may have moved, reset our local pointer */
1728 		wh = mtod(m0, struct ieee80211_frame *);
1729 	}
1730 
1731 	ieee80211_ratectl_findrate(ni, m0->m_pkthdr.len, &rateidx, 1);
1732 	rate = IEEE80211_RS_RATE(&ni->ni_rates, rateidx);
1733 
1734 	ackrate = ieee80211_ack_rate(ni, rate);
1735 
1736 	/*
1737 	 * IEEE Std 802.11-1999, pp 82: "A STA shall use an RTS/CTS exchange
1738 	 * for directed frames only when the length of the MPDU is greater
1739 	 * than the length threshold indicated by [...]" ic_rtsthreshold.
1740 	 */
1741 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1742 	    m0->m_pkthdr.len > ic->ic_rtsthreshold) {
1743 		struct mbuf *m;
1744 		uint16_t dur;
1745 		int rtsrate;
1746 
1747 		rtsrate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
1748 		dur = ieee80211_txtime(ni, m0->m_pkthdr.len + IEEE80211_FCS_LEN,
1749 				       rate, ic->ic_flags) +
1750 		      ieee80211_txtime(ni, RAL_CTS_SIZE, rtsrate, ic->ic_flags)+
1751 		      ieee80211_txtime(ni, RAL_ACK_SIZE, ackrate, ic->ic_flags)+
1752 		      3 * sc->sc_sifs;
1753 
1754 		m = rt2560_get_rts(sc, wh, dur);
1755 
1756 		desc = &sc->txq.desc[sc->txq.cur_encrypt];
1757 		data = &sc->txq.data[sc->txq.cur_encrypt];
1758 
1759 		error = bus_dmamap_load_mbuf(sc->txq.data_dmat, data->map,
1760 					     m, rt2560_dma_map_mbuf, &paddr, 0);
1761 		if (error != 0) {
1762 			device_printf(sc->sc_dev,
1763 			    "could not map mbuf (error %d)\n", error);
1764 			m_freem(m);
1765 			m_freem(m0);
1766 			return error;
1767 		}
1768 
1769 		/* avoid multiple free() of the same node for each fragment */
1770 		ieee80211_ref_node(ni);
1771 
1772 		data->m = m;
1773 		data->ni = ni;
1774 		data->rateidx = -1;	/* don't count RTS */
1775 
1776 		rt2560_setup_tx_desc(sc, desc, RT2560_TX_ACK |
1777 		    RT2560_TX_MORE_FRAG, m->m_pkthdr.len, rtsrate, 1, paddr);
1778 
1779 		bus_dmamap_sync(sc->txq.data_dmat, data->map,
1780 		    BUS_DMASYNC_PREWRITE);
1781 
1782 		sc->txq.queued++;
1783 		sc->txq.cur_encrypt =
1784 		    (sc->txq.cur_encrypt + 1) % RT2560_TX_RING_COUNT;
1785 
1786 		/*
1787 		 * IEEE Std 802.11-1999: when an RTS/CTS exchange is used, the
1788 		 * asynchronous data frame shall be transmitted after the CTS
1789 		 * frame and a SIFS period.
1790 		 */
1791 		flags |= RT2560_TX_LONG_RETRY | RT2560_TX_IFS_SIFS;
1792 	}
1793 
1794 	data = &sc->txq.data[sc->txq.cur_encrypt];
1795 	desc = &sc->txq.desc[sc->txq.cur_encrypt];
1796 
1797 	error = bus_dmamap_load_mbuf(sc->txq.data_dmat, data->map, m0,
1798 				     rt2560_dma_map_mbuf, &paddr, 0);
1799 	if (error != 0 && error != EFBIG) {
1800 		device_printf(sc->sc_dev, "could not map mbuf (error %d)\n",
1801 		    error);
1802 		m_freem(m0);
1803 		return error;
1804 	}
1805 	if (error != 0) {
1806 		mnew = m_defrag(m0, MB_DONTWAIT);
1807 		if (mnew == NULL) {
1808 			device_printf(sc->sc_dev,
1809 			    "could not defragment mbuf\n");
1810 			m_freem(m0);
1811 			return ENOBUFS;
1812 		}
1813 		m0 = mnew;
1814 
1815 		error = bus_dmamap_load_mbuf(sc->txq.data_dmat, data->map,
1816 					     m0, rt2560_dma_map_mbuf, &paddr,
1817 					     0);
1818 		if (error != 0) {
1819 			device_printf(sc->sc_dev,
1820 			    "could not map mbuf (error %d)\n", error);
1821 			m_freem(m0);
1822 			return error;
1823 		}
1824 
1825 		/* packet header may have moved, reset our local pointer */
1826 		wh = mtod(m0, struct ieee80211_frame *);
1827 	}
1828 
1829 	if (sc->sc_drvbpf != NULL) {
1830 		struct rt2560_tx_radiotap_header *tap = &sc->sc_txtap;
1831 
1832 		tap->wt_flags = 0;
1833 		tap->wt_rate = rate;
1834 		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1835 		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1836 		tap->wt_antenna = sc->tx_ant;
1837 
1838 		bpf_ptap(sc->sc_drvbpf, m0, tap, sc->sc_txtap_len);
1839 	}
1840 
1841 	data->m = m0;
1842 	data->ni = ni;
1843 	data->rateidx = rateidx;
1844 
1845 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1846 		flags |= RT2560_TX_ACK;
1847 		dur = ieee80211_txtime(ni, RAL_ACK_SIZE, ackrate, ic->ic_flags)+
1848 		      sc->sc_sifs;
1849 		*(uint16_t *)wh->i_dur = htole16(dur);
1850 	}
1851 
1852 	rt2560_setup_tx_desc(sc, desc, flags, m0->m_pkthdr.len, rate, 1, paddr);
1853 
1854 	bus_dmamap_sync(sc->txq.data_dmat, data->map, BUS_DMASYNC_PREWRITE);
1855 	bus_dmamap_sync(sc->txq.desc_dmat, sc->txq.desc_map,
1856 	    BUS_DMASYNC_PREWRITE);
1857 
1858 	DPRINTFN(10, ("sending data frame len=%u idx=%u rate=%u\n",
1859 	    m0->m_pkthdr.len, sc->txq.cur_encrypt, rate));
1860 
1861 	/* kick encrypt */
1862 	sc->txq.queued++;
1863 	sc->txq.cur_encrypt = (sc->txq.cur_encrypt + 1) % RT2560_TX_RING_COUNT;
1864 	RAL_WRITE(sc, RT2560_SECCSR1, RT2560_KICK_ENCRYPT);
1865 
1866 	return 0;
1867 }
1868 
1869 static void
1870 rt2560_start(struct ifnet *ifp)
1871 {
1872 	struct rt2560_softc *sc = ifp->if_softc;
1873 	struct ieee80211com *ic = &sc->sc_ic;
1874 	struct mbuf *m0;
1875 	struct ether_header *eh;
1876 	struct ieee80211_node *ni;
1877 
1878 	/* prevent management frames from being sent if we're not ready */
1879 	if (!(ifp->if_flags & IFF_RUNNING))
1880 		return;
1881 
1882 	for (;;) {
1883 		IF_POLL(&ic->ic_mgtq, m0);
1884 		if (m0 != NULL) {
1885 			if (sc->prioq.queued >= RT2560_PRIO_RING_COUNT) {
1886 				ifp->if_flags |= IFF_OACTIVE;
1887 				break;
1888 			}
1889 			IF_DEQUEUE(&ic->ic_mgtq, m0);
1890 
1891 			ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
1892 			m0->m_pkthdr.rcvif = NULL;
1893 
1894 			if (ic->ic_rawbpf != NULL)
1895 				bpf_mtap(ic->ic_rawbpf, m0);
1896 
1897 			if (rt2560_tx_mgt(sc, m0, ni) != 0)
1898 				break;
1899 
1900 		} else {
1901 			if (ic->ic_state != IEEE80211_S_RUN)
1902 				break;
1903 			m0 = ifq_poll(&ifp->if_snd);
1904 			if (m0 == NULL)
1905 				break;
1906 			if (sc->txq.queued >= RT2560_TX_RING_COUNT - 1) {
1907 				ifp->if_flags |= IFF_OACTIVE;
1908 				break;
1909 			}
1910 			m0 = ifq_dequeue(&ifp->if_snd, m0);
1911 
1912 			if (m0->m_len < sizeof (struct ether_header) &&
1913 			    !(m0 = m_pullup(m0, sizeof (struct ether_header))))
1914 				continue;
1915 
1916 			eh = mtod(m0, struct ether_header *);
1917 			ni = ieee80211_find_txnode(ic, eh->ether_dhost);
1918 			if (ni == NULL) {
1919 				m_freem(m0);
1920 				continue;
1921 			}
1922 			BPF_MTAP(ifp, m0);
1923 
1924 			m0 = ieee80211_encap(ic, m0, ni);
1925 			if (m0 == NULL) {
1926 				ieee80211_free_node(ni);
1927 				continue;
1928 			}
1929 
1930 			if (ic->ic_rawbpf != NULL)
1931 				bpf_mtap(ic->ic_rawbpf, m0);
1932 
1933 			if (rt2560_tx_data(sc, m0, ni) != 0) {
1934 				ieee80211_free_node(ni);
1935 				ifp->if_oerrors++;
1936 				break;
1937 			}
1938 		}
1939 
1940 		sc->sc_tx_timer = 5;
1941 		ifp->if_timer = 1;
1942 	}
1943 }
1944 
1945 static void
1946 rt2560_watchdog(struct ifnet *ifp)
1947 {
1948 	struct rt2560_softc *sc = ifp->if_softc;
1949 	struct ieee80211com *ic = &sc->sc_ic;
1950 
1951 	ifp->if_timer = 0;
1952 
1953 	if (sc->sc_tx_timer > 0) {
1954 		if (--sc->sc_tx_timer == 0) {
1955 			device_printf(sc->sc_dev, "device timeout\n");
1956 			rt2560_init(sc);
1957 			ifp->if_oerrors++;
1958 			return;
1959 		}
1960 		ifp->if_timer = 1;
1961 	}
1962 
1963 	ieee80211_watchdog(ic);
1964 }
1965 
1966 /*
1967  * This function allows for fast channel switching in monitor mode (used by
1968  * net-mgmt/kismet). In IBSS mode, we must explicitly reset the interface to
1969  * generate a new beacon frame.
1970  */
1971 static int
1972 rt2560_reset(struct ifnet *ifp)
1973 {
1974 	struct rt2560_softc *sc = ifp->if_softc;
1975 	struct ieee80211com *ic = &sc->sc_ic;
1976 
1977 	if (ic->ic_opmode != IEEE80211_M_MONITOR)
1978 		return ENETRESET;
1979 
1980 	rt2560_set_chan(sc, ic->ic_curchan);
1981 
1982 	return 0;
1983 }
1984 
1985 static int
1986 rt2560_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
1987 {
1988 	struct rt2560_softc *sc = ifp->if_softc;
1989 	struct ieee80211com *ic = &sc->sc_ic;
1990 	int error = 0;
1991 
1992 	switch (cmd) {
1993 	case SIOCSIFFLAGS:
1994 		if (ifp->if_flags & IFF_UP) {
1995 			if (ifp->if_flags & IFF_RUNNING)
1996 				rt2560_update_promisc(sc);
1997 			else
1998 				rt2560_init(sc);
1999 		} else {
2000 			if (ifp->if_flags & IFF_RUNNING)
2001 				rt2560_stop(sc);
2002 		}
2003 		break;
2004 
2005 	default:
2006 		error = ieee80211_ioctl(ic, cmd, data, cr);
2007 	}
2008 
2009 	if (error == ENETRESET) {
2010 		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
2011 		    (IFF_UP | IFF_RUNNING) &&
2012 		    (ic->ic_roaming != IEEE80211_ROAMING_MANUAL))
2013 			rt2560_init(sc);
2014 		error = 0;
2015 	}
2016 
2017 	return error;
2018 }
2019 
2020 static void
2021 rt2560_bbp_write(struct rt2560_softc *sc, uint8_t reg, uint8_t val)
2022 {
2023 	uint32_t tmp;
2024 	int ntries;
2025 
2026 	for (ntries = 0; ntries < 100; ntries++) {
2027 		if (!(RAL_READ(sc, RT2560_BBPCSR) & RT2560_BBP_BUSY))
2028 			break;
2029 		DELAY(1);
2030 	}
2031 	if (ntries == 100) {
2032 		device_printf(sc->sc_dev, "could not write to BBP\n");
2033 		return;
2034 	}
2035 
2036 	tmp = RT2560_BBP_WRITE | RT2560_BBP_BUSY | reg << 8 | val;
2037 	RAL_WRITE(sc, RT2560_BBPCSR, tmp);
2038 
2039 	DPRINTFN(15, ("BBP R%u <- 0x%02x\n", reg, val));
2040 }
2041 
2042 static uint8_t
2043 rt2560_bbp_read(struct rt2560_softc *sc, uint8_t reg)
2044 {
2045 	uint32_t val;
2046 	int ntries;
2047 
2048 	for (ntries = 0; ntries < 100; ntries++) {
2049 		if (!(RAL_READ(sc, RT2560_BBPCSR) & RT2560_BBP_BUSY))
2050 			break;
2051 		DELAY(1);
2052 	}
2053 	if (ntries == 100) {
2054 		device_printf(sc->sc_dev, "could not read from BBP\n");
2055 		return 0;
2056 	}
2057 
2058 	val = RT2560_BBP_BUSY | reg << 8;
2059 	RAL_WRITE(sc, RT2560_BBPCSR, val);
2060 
2061 	for (ntries = 0; ntries < 100; ntries++) {
2062 		val = RAL_READ(sc, RT2560_BBPCSR);
2063 		if (!(val & RT2560_BBP_BUSY))
2064 			return val & 0xff;
2065 		DELAY(1);
2066 	}
2067 
2068 	device_printf(sc->sc_dev, "could not read from BBP\n");
2069 	return 0;
2070 }
2071 
2072 static void
2073 rt2560_rf_write(struct rt2560_softc *sc, uint8_t reg, uint32_t val)
2074 {
2075 	uint32_t tmp;
2076 	int ntries;
2077 
2078 	for (ntries = 0; ntries < 100; ntries++) {
2079 		if (!(RAL_READ(sc, RT2560_RFCSR) & RT2560_RF_BUSY))
2080 			break;
2081 		DELAY(1);
2082 	}
2083 	if (ntries == 100) {
2084 		device_printf(sc->sc_dev, "could not write to RF\n");
2085 		return;
2086 	}
2087 
2088 	tmp = RT2560_RF_BUSY | RT2560_RF_20BIT | (val & 0xfffff) << 2 |
2089 	    (reg & 0x3);
2090 	RAL_WRITE(sc, RT2560_RFCSR, tmp);
2091 
2092 	/* remember last written value in sc */
2093 	sc->rf_regs[reg] = val;
2094 
2095 	DPRINTFN(15, ("RF R[%u] <- 0x%05x\n", reg & 0x3, val & 0xfffff));
2096 }
2097 
2098 static void
2099 rt2560_set_chan(struct rt2560_softc *sc, struct ieee80211_channel *c)
2100 {
2101 	struct ieee80211com *ic = &sc->sc_ic;
2102 	uint8_t power, tmp;
2103 	u_int i, chan;
2104 
2105 	chan = ieee80211_chan2ieee(ic, c);
2106 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
2107 		return;
2108 
2109 	if (IEEE80211_IS_CHAN_2GHZ(c))
2110 		power = min(sc->txpow[chan - 1], 31);
2111 	else
2112 		power = 31;
2113 
2114 	/* adjust txpower using ifconfig settings */
2115 	power -= (100 - ic->ic_txpowlimit) / 8;
2116 
2117 	DPRINTFN(2, ("setting channel to %u, txpower to %u\n", chan, power));
2118 
2119 	switch (sc->rf_rev) {
2120 	case RT2560_RF_2522:
2121 		rt2560_rf_write(sc, RAL_RF1, 0x00814);
2122 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2522_r2[chan - 1]);
2123 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
2124 		break;
2125 
2126 	case RT2560_RF_2523:
2127 		rt2560_rf_write(sc, RAL_RF1, 0x08804);
2128 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2523_r2[chan - 1]);
2129 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x38044);
2130 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
2131 		break;
2132 
2133 	case RT2560_RF_2524:
2134 		rt2560_rf_write(sc, RAL_RF1, 0x0c808);
2135 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2524_r2[chan - 1]);
2136 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
2137 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
2138 		break;
2139 
2140 	case RT2560_RF_2525:
2141 		rt2560_rf_write(sc, RAL_RF1, 0x08808);
2142 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525_hi_r2[chan - 1]);
2143 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
2144 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
2145 
2146 		rt2560_rf_write(sc, RAL_RF1, 0x08808);
2147 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525_r2[chan - 1]);
2148 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
2149 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
2150 		break;
2151 
2152 	case RT2560_RF_2525E:
2153 		rt2560_rf_write(sc, RAL_RF1, 0x08808);
2154 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525e_r2[chan - 1]);
2155 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
2156 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00286 : 0x00282);
2157 		break;
2158 
2159 	case RT2560_RF_2526:
2160 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2526_hi_r2[chan - 1]);
2161 		rt2560_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
2162 		rt2560_rf_write(sc, RAL_RF1, 0x08804);
2163 
2164 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2526_r2[chan - 1]);
2165 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
2166 		rt2560_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
2167 		break;
2168 
2169 	/* dual-band RF */
2170 	case RT2560_RF_5222:
2171 		for (i = 0; rt2560_rf5222[i].chan != chan; i++);
2172 
2173 		rt2560_rf_write(sc, RAL_RF1, rt2560_rf5222[i].r1);
2174 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf5222[i].r2);
2175 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
2176 		rt2560_rf_write(sc, RAL_RF4, rt2560_rf5222[i].r4);
2177 		break;
2178 	}
2179 
2180 	if (ic->ic_state != IEEE80211_S_SCAN) {
2181 		/* set Japan filter bit for channel 14 */
2182 		tmp = rt2560_bbp_read(sc, 70);
2183 
2184 		tmp &= ~RT2560_JAPAN_FILTER;
2185 		if (chan == 14)
2186 			tmp |= RT2560_JAPAN_FILTER;
2187 
2188 		rt2560_bbp_write(sc, 70, tmp);
2189 
2190 		/* clear CRC errors */
2191 		RAL_READ(sc, RT2560_CNT0);
2192 	}
2193 
2194 	sc->sc_sifs = IEEE80211_IS_CHAN_5GHZ(c) ? IEEE80211_DUR_OFDM_SIFS
2195 						: IEEE80211_DUR_SIFS;
2196 }
2197 
2198 #if 0
2199 /*
2200  * Disable RF auto-tuning.
2201  */
2202 static void
2203 rt2560_disable_rf_tune(struct rt2560_softc *sc)
2204 {
2205 	uint32_t tmp;
2206 
2207 	if (sc->rf_rev != RT2560_RF_2523) {
2208 		tmp = sc->rf_regs[RAL_RF1] & ~RAL_RF1_AUTOTUNE;
2209 		rt2560_rf_write(sc, RAL_RF1, tmp);
2210 	}
2211 
2212 	tmp = sc->rf_regs[RAL_RF3] & ~RAL_RF3_AUTOTUNE;
2213 	rt2560_rf_write(sc, RAL_RF3, tmp);
2214 
2215 	DPRINTFN(2, ("disabling RF autotune\n"));
2216 }
2217 #endif
2218 
2219 /*
2220  * Refer to IEEE Std 802.11-1999 pp. 123 for more information on TSF
2221  * synchronization.
2222  */
2223 static void
2224 rt2560_enable_tsf_sync(struct rt2560_softc *sc)
2225 {
2226 	struct ieee80211com *ic = &sc->sc_ic;
2227 	uint16_t logcwmin, preload;
2228 	uint32_t tmp;
2229 
2230 	/* first, disable TSF synchronization */
2231 	RAL_WRITE(sc, RT2560_CSR14, 0);
2232 
2233 	tmp = 16 * ic->ic_bss->ni_intval;
2234 	RAL_WRITE(sc, RT2560_CSR12, tmp);
2235 
2236 	RAL_WRITE(sc, RT2560_CSR13, 0);
2237 
2238 	logcwmin = 5;
2239 	preload = (ic->ic_opmode == IEEE80211_M_STA) ? 384 : 1024;
2240 	tmp = logcwmin << 16 | preload;
2241 	RAL_WRITE(sc, RT2560_BCNOCSR, tmp);
2242 
2243 	/* finally, enable TSF synchronization */
2244 	tmp = RT2560_ENABLE_TSF | RT2560_ENABLE_TBCN;
2245 	if (ic->ic_opmode == IEEE80211_M_STA)
2246 		tmp |= RT2560_ENABLE_TSF_SYNC(1);
2247 	else
2248 		tmp |= RT2560_ENABLE_TSF_SYNC(2) |
2249 		       RT2560_ENABLE_BEACON_GENERATOR;
2250 	RAL_WRITE(sc, RT2560_CSR14, tmp);
2251 
2252 	DPRINTF(("enabling TSF synchronization\n"));
2253 }
2254 
2255 static void
2256 rt2560_update_plcp(struct rt2560_softc *sc)
2257 {
2258 	struct ieee80211com *ic = &sc->sc_ic;
2259 
2260 	/* no short preamble for 1Mbps */
2261 	RAL_WRITE(sc, RT2560_PLCP1MCSR, 0x00700400);
2262 
2263 	if (!(ic->ic_flags & IEEE80211_F_SHPREAMBLE)) {
2264 		/* values taken from the reference driver */
2265 		RAL_WRITE(sc, RT2560_PLCP2MCSR,   0x00380401);
2266 		RAL_WRITE(sc, RT2560_PLCP5p5MCSR, 0x00150402);
2267 		RAL_WRITE(sc, RT2560_PLCP11MCSR,  0x000b8403);
2268 	} else {
2269 		/* same values as above or'ed 0x8 */
2270 		RAL_WRITE(sc, RT2560_PLCP2MCSR,   0x00380409);
2271 		RAL_WRITE(sc, RT2560_PLCP5p5MCSR, 0x0015040a);
2272 		RAL_WRITE(sc, RT2560_PLCP11MCSR,  0x000b840b);
2273 	}
2274 
2275 	DPRINTF(("updating PLCP for %s preamble\n",
2276 	    (ic->ic_flags & IEEE80211_F_SHPREAMBLE) ? "short" : "long"));
2277 }
2278 
2279 /*
2280  * This function can be called by ieee80211_set_shortslottime(). Refer to
2281  * IEEE Std 802.11-1999 pp. 85 to know how these values are computed.
2282  */
2283 static void
2284 rt2560_update_slot(struct ifnet *ifp)
2285 {
2286 	struct rt2560_softc *sc = ifp->if_softc;
2287 	struct ieee80211com *ic = &sc->sc_ic;
2288 	uint8_t slottime;
2289 	uint16_t tx_sifs, tx_pifs, tx_difs, eifs;
2290 	uint32_t tmp;
2291 
2292 	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
2293 
2294 	/* update the MAC slot boundaries */
2295 	tx_sifs = sc->sc_sifs - RT2560_TXRX_TURNAROUND;
2296 	tx_pifs = tx_sifs + slottime;
2297 	tx_difs = tx_sifs + 2 * slottime;
2298 	eifs = (ic->ic_curmode == IEEE80211_MODE_11B) ? 364 : 60;
2299 
2300 	tmp = RAL_READ(sc, RT2560_CSR11);
2301 	tmp = (tmp & ~0x1f00) | slottime << 8;
2302 	RAL_WRITE(sc, RT2560_CSR11, tmp);
2303 
2304 	tmp = tx_pifs << 16 | tx_sifs;
2305 	RAL_WRITE(sc, RT2560_CSR18, tmp);
2306 
2307 	tmp = eifs << 16 | tx_difs;
2308 	RAL_WRITE(sc, RT2560_CSR19, tmp);
2309 
2310 	DPRINTF(("setting slottime to %uus\n", slottime));
2311 }
2312 
2313 static void
2314 rt2560_set_basicrates(struct rt2560_softc *sc)
2315 {
2316 	struct ieee80211com *ic = &sc->sc_ic;
2317 
2318 	/* update basic rate set */
2319 	if (ic->ic_curmode == IEEE80211_MODE_11B) {
2320 		/* 11b basic rates: 1, 2Mbps */
2321 		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x3);
2322 	} else if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan)) {
2323 		/* 11a basic rates: 6, 12, 24Mbps */
2324 		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x150);
2325 	} else {
2326 		/* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
2327 		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x15f);
2328 	}
2329 }
2330 
2331 static void
2332 rt2560_update_led(struct rt2560_softc *sc, int led1, int led2)
2333 {
2334 	uint32_t tmp;
2335 
2336 	/* set ON period to 70ms and OFF period to 30ms */
2337 	tmp = led1 << 16 | led2 << 17 | 70 << 8 | 30;
2338 	RAL_WRITE(sc, RT2560_LEDCSR, tmp);
2339 }
2340 
2341 static void
2342 rt2560_set_bssid(struct rt2560_softc *sc, uint8_t *bssid)
2343 {
2344 	uint32_t tmp;
2345 
2346 	tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
2347 	RAL_WRITE(sc, RT2560_CSR5, tmp);
2348 
2349 	tmp = bssid[4] | bssid[5] << 8;
2350 	RAL_WRITE(sc, RT2560_CSR6, tmp);
2351 
2352 	DPRINTF(("setting BSSID to %6D\n", bssid, ":"));
2353 }
2354 
2355 static void
2356 rt2560_set_macaddr(struct rt2560_softc *sc, uint8_t *addr)
2357 {
2358 	uint32_t tmp;
2359 
2360 	tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
2361 	RAL_WRITE(sc, RT2560_CSR3, tmp);
2362 
2363 	tmp = addr[4] | addr[5] << 8;
2364 	RAL_WRITE(sc, RT2560_CSR4, tmp);
2365 
2366 	DPRINTF(("setting MAC address to %6D\n", addr, ":"));
2367 }
2368 
2369 static void
2370 rt2560_get_macaddr(struct rt2560_softc *sc, uint8_t *addr)
2371 {
2372 	uint32_t tmp;
2373 
2374 	tmp = RAL_READ(sc, RT2560_CSR3);
2375 	addr[0] = tmp & 0xff;
2376 	addr[1] = (tmp >>  8) & 0xff;
2377 	addr[2] = (tmp >> 16) & 0xff;
2378 	addr[3] = (tmp >> 24);
2379 
2380 	tmp = RAL_READ(sc, RT2560_CSR4);
2381 	addr[4] = tmp & 0xff;
2382 	addr[5] = (tmp >> 8) & 0xff;
2383 }
2384 
2385 static void
2386 rt2560_update_promisc(struct rt2560_softc *sc)
2387 {
2388 	struct ifnet *ifp = sc->sc_ic.ic_ifp;
2389 	uint32_t tmp;
2390 
2391 	tmp = RAL_READ(sc, RT2560_RXCSR0);
2392 
2393 	tmp &= ~RT2560_DROP_NOT_TO_ME;
2394 	if (!(ifp->if_flags & IFF_PROMISC))
2395 		tmp |= RT2560_DROP_NOT_TO_ME;
2396 
2397 	RAL_WRITE(sc, RT2560_RXCSR0, tmp);
2398 
2399 	DPRINTF(("%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
2400 	    "entering" : "leaving"));
2401 }
2402 
2403 static const char *
2404 rt2560_get_rf(int rev)
2405 {
2406 	switch (rev) {
2407 	case RT2560_RF_2522:	return "RT2522";
2408 	case RT2560_RF_2523:	return "RT2523";
2409 	case RT2560_RF_2524:	return "RT2524";
2410 	case RT2560_RF_2525:	return "RT2525";
2411 	case RT2560_RF_2525E:	return "RT2525e";
2412 	case RT2560_RF_2526:	return "RT2526";
2413 	case RT2560_RF_5222:	return "RT5222";
2414 	default:		return "unknown";
2415 	}
2416 }
2417 
2418 static void
2419 rt2560_read_eeprom(struct rt2560_softc *sc)
2420 {
2421 	uint16_t val;
2422 	int i;
2423 
2424 	val = rt2560_eeprom_read(sc, RT2560_EEPROM_CONFIG0);
2425 	sc->rf_rev =   (val >> 11) & 0x7;
2426 	sc->hw_radio = (val >> 10) & 0x1;
2427 	sc->led_mode = (val >> 6)  & 0x7;
2428 	sc->rx_ant =   (val >> 4)  & 0x3;
2429 	sc->tx_ant =   (val >> 2)  & 0x3;
2430 	sc->nb_ant =   val & 0x3;
2431 
2432 	/* read default values for BBP registers */
2433 	for (i = 0; i < 16; i++) {
2434 		val = rt2560_eeprom_read(sc, RT2560_EEPROM_BBP_BASE + i);
2435 		sc->bbp_prom[i].reg = val >> 8;
2436 		sc->bbp_prom[i].val = val & 0xff;
2437 	}
2438 
2439 	/* read Tx power for all b/g channels */
2440 	for (i = 0; i < 14 / 2; i++) {
2441 		val = rt2560_eeprom_read(sc, RT2560_EEPROM_TXPOWER + i);
2442 		sc->txpow[i * 2] = val >> 8;
2443 		sc->txpow[i * 2 + 1] = val & 0xff;
2444 	}
2445 
2446 	val = rt2560_eeprom_read(sc, RT2560_EEPROM_CALIBRATE);
2447 	if ((val & 0xff) == 0xff)
2448 		sc->rssi_corr = RT2560_DEFAULT_RSSI_CORR;
2449 	else
2450 		sc->rssi_corr = val & 0xff;
2451 	DPRINTF(("rssi correction %d, calibrate 0x%02x\n",
2452 		 sc->rssi_corr, val));
2453 }
2454 
2455 static int
2456 rt2560_bbp_init(struct rt2560_softc *sc)
2457 {
2458 #define N(a)	(sizeof (a) / sizeof ((a)[0]))
2459 	int i, ntries;
2460 
2461 	/* wait for BBP to be ready */
2462 	for (ntries = 0; ntries < 100; ntries++) {
2463 		if (rt2560_bbp_read(sc, RT2560_BBP_VERSION) != 0)
2464 			break;
2465 		DELAY(1);
2466 	}
2467 	if (ntries == 100) {
2468 		device_printf(sc->sc_dev, "timeout waiting for BBP\n");
2469 		return EIO;
2470 	}
2471 
2472 	/* initialize BBP registers to default values */
2473 	for (i = 0; i < N(rt2560_def_bbp); i++) {
2474 		rt2560_bbp_write(sc, rt2560_def_bbp[i].reg,
2475 		    rt2560_def_bbp[i].val);
2476 	}
2477 
2478 #if 0
2479 	/* initialize BBP registers to values stored in EEPROM */
2480 	for (i = 0; i < 16; i++) {
2481 		if (sc->bbp_prom[i].reg == 0xff)
2482 			continue;
2483 		rt2560_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
2484 	}
2485 #endif
2486 
2487 	return 0;
2488 #undef N
2489 }
2490 
2491 static void
2492 rt2560_set_txantenna(struct rt2560_softc *sc, int antenna)
2493 {
2494 	uint32_t tmp;
2495 	uint8_t tx;
2496 
2497 	tx = rt2560_bbp_read(sc, RT2560_BBP_TX) & ~RT2560_BBP_ANTMASK;
2498 	if (antenna == 1)
2499 		tx |= RT2560_BBP_ANTA;
2500 	else if (antenna == 2)
2501 		tx |= RT2560_BBP_ANTB;
2502 	else
2503 		tx |= RT2560_BBP_DIVERSITY;
2504 
2505 	/* need to force I/Q flip for RF 2525e and 5222 */
2506 	if (sc->rf_rev == RT2560_RF_2525E || sc->rf_rev == RT2560_RF_5222)
2507 		tx |= RT2560_BBP_FLIPIQ;
2508 
2509 	rt2560_bbp_write(sc, RT2560_BBP_TX, tx);
2510 
2511 	/* update values for CCK and OFDM in BBPCSR1 */
2512 	tmp = RAL_READ(sc, RT2560_BBPCSR1) & ~0x00070007;
2513 	tmp |= (tx & 0x7) << 16 | (tx & 0x7);
2514 	RAL_WRITE(sc, RT2560_BBPCSR1, tmp);
2515 }
2516 
2517 static void
2518 rt2560_set_rxantenna(struct rt2560_softc *sc, int antenna)
2519 {
2520 	uint8_t rx;
2521 
2522 	rx = rt2560_bbp_read(sc, RT2560_BBP_RX) & ~RT2560_BBP_ANTMASK;
2523 	if (antenna == 1)
2524 		rx |= RT2560_BBP_ANTA;
2525 	else if (antenna == 2)
2526 		rx |= RT2560_BBP_ANTB;
2527 	else
2528 		rx |= RT2560_BBP_DIVERSITY;
2529 
2530 	/* need to force no I/Q flip for RF 2525e */
2531 	if (sc->rf_rev == RT2560_RF_2525E)
2532 		rx &= ~RT2560_BBP_FLIPIQ;
2533 
2534 	rt2560_bbp_write(sc, RT2560_BBP_RX, rx);
2535 }
2536 
2537 static void
2538 rt2560_init(void *priv)
2539 {
2540 #define N(a)	(sizeof (a) / sizeof ((a)[0]))
2541 	struct rt2560_softc *sc = priv;
2542 	struct ieee80211com *ic = &sc->sc_ic;
2543 	struct ifnet *ifp = ic->ic_ifp;
2544 	uint32_t tmp;
2545 	int i;
2546 
2547 	rt2560_stop(sc);
2548 
2549 	/* setup tx rings */
2550 	tmp = RT2560_PRIO_RING_COUNT << 24 |
2551 	      RT2560_ATIM_RING_COUNT << 16 |
2552 	      RT2560_TX_RING_COUNT   <<  8 |
2553 	      RT2560_TX_DESC_SIZE;
2554 
2555 	/* rings must be initialized in this exact order */
2556 	RAL_WRITE(sc, RT2560_TXCSR2, tmp);
2557 	RAL_WRITE(sc, RT2560_TXCSR3, sc->txq.physaddr);
2558 	RAL_WRITE(sc, RT2560_TXCSR5, sc->prioq.physaddr);
2559 	RAL_WRITE(sc, RT2560_TXCSR4, sc->atimq.physaddr);
2560 	RAL_WRITE(sc, RT2560_TXCSR6, sc->bcnq.physaddr);
2561 
2562 	/* setup rx ring */
2563 	tmp = RT2560_RX_RING_COUNT << 8 | RT2560_RX_DESC_SIZE;
2564 
2565 	RAL_WRITE(sc, RT2560_RXCSR1, tmp);
2566 	RAL_WRITE(sc, RT2560_RXCSR2, sc->rxq.physaddr);
2567 
2568 	/* initialize MAC registers to default values */
2569 	for (i = 0; i < N(rt2560_def_mac); i++)
2570 		RAL_WRITE(sc, rt2560_def_mac[i].reg, rt2560_def_mac[i].val);
2571 
2572 	IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
2573 	rt2560_set_macaddr(sc, ic->ic_myaddr);
2574 
2575 	/* set basic rate set (will be updated later) */
2576 	RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x153);
2577 
2578 	rt2560_update_slot(ifp);
2579 	rt2560_update_plcp(sc);
2580 	rt2560_update_led(sc, 0, 0);
2581 
2582 	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
2583 	RAL_WRITE(sc, RT2560_CSR1, RT2560_HOST_READY);
2584 
2585 	if (rt2560_bbp_init(sc) != 0) {
2586 		rt2560_stop(sc);
2587 		return;
2588 	}
2589 
2590 	rt2560_set_txantenna(sc, sc->tx_ant);
2591 	rt2560_set_rxantenna(sc, sc->rx_ant);
2592 
2593 	/* set default BSS channel */
2594 	rt2560_set_chan(sc, ic->ic_curchan);
2595 
2596 	/* kick Rx */
2597 	tmp = RT2560_DROP_PHY_ERROR | RT2560_DROP_CRC_ERROR;
2598 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2599 		tmp |= RT2560_DROP_CTL | RT2560_DROP_VERSION_ERROR;
2600 		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
2601 			tmp |= RT2560_DROP_TODS;
2602 		if (!(ifp->if_flags & IFF_PROMISC))
2603 			tmp |= RT2560_DROP_NOT_TO_ME;
2604 	}
2605 	RAL_WRITE(sc, RT2560_RXCSR0, tmp);
2606 
2607 	/* clear old FCS and Rx FIFO errors */
2608 	RAL_READ(sc, RT2560_CNT0);
2609 	RAL_READ(sc, RT2560_CNT4);
2610 
2611 	/* clear any pending interrupts */
2612 	RAL_WRITE(sc, RT2560_CSR7, 0xffffffff);
2613 
2614 	/* enable interrupts */
2615 	RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
2616 
2617 	ifp->if_flags &= ~IFF_OACTIVE;
2618 	ifp->if_flags |= IFF_RUNNING;
2619 
2620 	/* XXX */
2621 	if (ic->ic_flags & IEEE80211_F_PRIVACY) {
2622 		int i;
2623 
2624 		ic->ic_flags &= ~IEEE80211_F_DROPUNENC;
2625 		for (i = 0; i < IEEE80211_WEP_NKID; ++i) {
2626 			struct ieee80211_key *wk = &ic->ic_nw_keys[i];
2627 
2628 			if (wk->wk_keylen == 0)
2629 				continue;
2630 			if (wk->wk_flags & IEEE80211_KEY_XMIT)
2631 				wk->wk_flags |= IEEE80211_KEY_SWCRYPT;
2632 		}
2633 	}
2634 
2635 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2636 		if (ic->ic_roaming != IEEE80211_ROAMING_MANUAL)
2637 			ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2638 	} else
2639 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2640 #undef N
2641 }
2642 
2643 void
2644 rt2560_stop(void *priv)
2645 {
2646 	struct rt2560_softc *sc = priv;
2647 	struct ieee80211com *ic = &sc->sc_ic;
2648 	struct ifnet *ifp = ic->ic_ifp;
2649 
2650 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2651 
2652 	sc->sc_tx_timer = 0;
2653 	ifp->if_timer = 0;
2654 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2655 
2656 	/* abort Tx */
2657 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_ABORT_TX);
2658 
2659 	/* disable Rx */
2660 	RAL_WRITE(sc, RT2560_RXCSR0, RT2560_DISABLE_RX);
2661 
2662 	/* reset ASIC (imply reset BBP) */
2663 	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
2664 	RAL_WRITE(sc, RT2560_CSR1, 0);
2665 
2666 	/* disable interrupts */
2667 	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
2668 
2669 	/* reset Tx and Rx rings */
2670 	rt2560_reset_tx_ring(sc, &sc->txq);
2671 	rt2560_reset_tx_ring(sc, &sc->atimq);
2672 	rt2560_reset_tx_ring(sc, &sc->prioq);
2673 	rt2560_reset_tx_ring(sc, &sc->bcnq);
2674 	rt2560_reset_rx_ring(sc, &sc->rxq);
2675 }
2676 
2677 static void
2678 rt2560_dma_map_mbuf(void *arg, bus_dma_segment_t *seg, int nseg,
2679 		    bus_size_t map_size __unused, int error)
2680 {
2681 	if (error)
2682 		return;
2683 
2684 	KASSERT(nseg == 1, ("too many dma segments\n"));
2685 	*((bus_addr_t *)arg) = seg->ds_addr;
2686 }
2687