rt2560.c revision 1.19
1/*	$OpenBSD: rt2560.c,v 1.19 2006/06/14 19:31:47 damien Exp $  */
2
3/*-
4 * Copyright (c) 2005, 2006
5 *	Damien Bergamini <damien.bergamini@free.fr>
6 *
7 * Permission to use, copy, modify, and distribute this software for any
8 * purpose with or without fee is hereby granted, provided that the above
9 * copyright notice and this permission notice appear in all copies.
10 *
11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18 */
19
20/*-
21 * Ralink Technology RT2560 chipset driver
22 * http://www.ralinktech.com/
23 */
24
25#include "bpfilter.h"
26
27#include <sys/param.h>
28#include <sys/sockio.h>
29#include <sys/sysctl.h>
30#include <sys/mbuf.h>
31#include <sys/kernel.h>
32#include <sys/socket.h>
33#include <sys/systm.h>
34#include <sys/malloc.h>
35#include <sys/timeout.h>
36#include <sys/conf.h>
37#include <sys/device.h>
38
39#include <machine/bus.h>
40#include <machine/endian.h>
41#include <machine/intr.h>
42
43#if NBPFILTER > 0
44#include <net/bpf.h>
45#endif
46#include <net/if.h>
47#include <net/if_arp.h>
48#include <net/if_dl.h>
49#include <net/if_media.h>
50#include <net/if_types.h>
51
52#include <netinet/in.h>
53#include <netinet/in_systm.h>
54#include <netinet/in_var.h>
55#include <netinet/if_ether.h>
56#include <netinet/ip.h>
57
58#include <net80211/ieee80211_var.h>
59#include <net80211/ieee80211_rssadapt.h>
60#include <net80211/ieee80211_radiotap.h>
61
62#include <dev/ic/rt2560reg.h>
63#include <dev/ic/rt2560var.h>
64
65#include <dev/pci/pcireg.h>
66#include <dev/pci/pcivar.h>
67#include <dev/pci/pcidevs.h>
68
69#ifdef RAL_DEBUG
70#define DPRINTF(x)	do { if (rt2560_debug > 0) printf x; } while (0)
71#define DPRINTFN(n, x)	do { if (rt2560_debug >= (n)) printf x; } while (0)
72int rt2560_debug = 1;
73#else
74#define DPRINTF(x)
75#define DPRINTFN(n, x)
76#endif
77
78int		rt2560_alloc_tx_ring(struct rt2560_softc *,
79		    struct rt2560_tx_ring *, int);
80void		rt2560_reset_tx_ring(struct rt2560_softc *,
81		    struct rt2560_tx_ring *);
82void		rt2560_free_tx_ring(struct rt2560_softc *,
83		    struct rt2560_tx_ring *);
84int		rt2560_alloc_rx_ring(struct rt2560_softc *,
85		    struct rt2560_rx_ring *, int);
86void		rt2560_reset_rx_ring(struct rt2560_softc *,
87		    struct rt2560_rx_ring *);
88void		rt2560_free_rx_ring(struct rt2560_softc *,
89		    struct rt2560_rx_ring *);
90struct		ieee80211_node *rt2560_node_alloc(struct ieee80211com *);
91void		rt2560_node_copy(struct ieee80211com *ic,
92		    struct ieee80211_node *, const struct ieee80211_node *);
93int		rt2560_media_change(struct ifnet *);
94void		rt2560_next_scan(void *);
95void		rt2560_iter_func(void *, struct ieee80211_node *);
96void		rt2560_rssadapt_updatestats(void *);
97int		rt2560_newstate(struct ieee80211com *, enum ieee80211_state,
98		    int);
99uint16_t	rt2560_eeprom_read(struct rt2560_softc *, uint8_t);
100void		rt2560_encryption_intr(struct rt2560_softc *);
101void		rt2560_tx_intr(struct rt2560_softc *);
102void		rt2560_prio_intr(struct rt2560_softc *);
103void		rt2560_decryption_intr(struct rt2560_softc *);
104void		rt2560_rx_intr(struct rt2560_softc *);
105void		rt2560_beacon_expire(struct rt2560_softc *);
106void		rt2560_wakeup_expire(struct rt2560_softc *);
107#if NBPFILTER > 0
108uint8_t		rt2560_rxrate(struct rt2560_rx_desc *);
109#endif
110int		rt2560_ack_rate(struct ieee80211com *, int);
111uint16_t	rt2560_txtime(int, int, uint32_t);
112uint8_t		rt2560_plcp_signal(int);
113void		rt2560_setup_tx_desc(struct rt2560_softc *,
114		    struct rt2560_tx_desc *, uint32_t, int, int, int,
115		    bus_addr_t);
116int		rt2560_tx_bcn(struct rt2560_softc *, struct mbuf *,
117		    struct ieee80211_node *);
118int		rt2560_tx_mgt(struct rt2560_softc *, struct mbuf *,
119		    struct ieee80211_node *);
120struct		mbuf *rt2560_get_rts(struct rt2560_softc *,
121		    struct ieee80211_frame *, uint16_t);
122int		rt2560_tx_data(struct rt2560_softc *, struct mbuf *,
123		    struct ieee80211_node *);
124void		rt2560_start(struct ifnet *);
125void		rt2560_watchdog(struct ifnet *);
126int		rt2560_ioctl(struct ifnet *, u_long, caddr_t);
127void		rt2560_bbp_write(struct rt2560_softc *, uint8_t, uint8_t);
128uint8_t		rt2560_bbp_read(struct rt2560_softc *, uint8_t);
129void		rt2560_rf_write(struct rt2560_softc *, uint8_t, uint32_t);
130void		rt2560_set_chan(struct rt2560_softc *,
131		    struct ieee80211_channel *);
132void		rt2560_disable_rf_tune(struct rt2560_softc *);
133void		rt2560_enable_tsf_sync(struct rt2560_softc *);
134void		rt2560_update_plcp(struct rt2560_softc *);
135void		rt2560_update_slot(struct rt2560_softc *);
136void		rt2560_set_basicrates(struct rt2560_softc *);
137void		rt2560_update_led(struct rt2560_softc *, int, int);
138void		rt2560_set_bssid(struct rt2560_softc *, uint8_t *);
139void		rt2560_set_macaddr(struct rt2560_softc *, uint8_t *);
140void		rt2560_get_macaddr(struct rt2560_softc *, uint8_t *);
141void		rt2560_update_promisc(struct rt2560_softc *);
142void		rt2560_set_txantenna(struct rt2560_softc *, int);
143void		rt2560_set_rxantenna(struct rt2560_softc *, int);
144const char	*rt2560_get_rf(int);
145void		rt2560_read_eeprom(struct rt2560_softc *);
146int		rt2560_bbp_init(struct rt2560_softc *);
147int		rt2560_init(struct ifnet *);
148void		rt2560_stop(struct ifnet *, int);
149void		rt2560_power(int, void *);
150
151/*
152 * Supported rates for 802.11a/b/g modes (in 500Kbps unit).
153 */
154static const struct ieee80211_rateset rt2560_rateset_11a =
155	{ 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
156
157static const struct ieee80211_rateset rt2560_rateset_11b =
158	{ 4, { 2, 4, 11, 22 } };
159
160static const struct ieee80211_rateset rt2560_rateset_11g =
161	{ 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
162
163static const struct {
164	uint32_t	reg;
165	uint32_t	val;
166} rt2560_def_mac[] = {
167	RT2560_DEF_MAC
168};
169
170static const struct {
171	uint8_t	reg;
172	uint8_t	val;
173} rt2560_def_bbp[] = {
174	RT2560_DEF_BBP
175};
176
177static const uint32_t rt2560_rf2522_r2[]    = RT2560_RF2522_R2;
178static const uint32_t rt2560_rf2523_r2[]    = RT2560_RF2523_R2;
179static const uint32_t rt2560_rf2524_r2[]    = RT2560_RF2524_R2;
180static const uint32_t rt2560_rf2525_r2[]    = RT2560_RF2525_R2;
181static const uint32_t rt2560_rf2525_hi_r2[] = RT2560_RF2525_HI_R2;
182static const uint32_t rt2560_rf2525e_r2[]   = RT2560_RF2525E_R2;
183static const uint32_t rt2560_rf2526_r2[]    = RT2560_RF2526_R2;
184static const uint32_t rt2560_rf2526_hi_r2[] = RT2560_RF2526_HI_R2;
185
186static const struct {
187	uint8_t		chan;
188	uint32_t	r1, r2, r4;
189} rt2560_rf5222[] = {
190	RT2560_RF5222
191};
192
193int
194rt2560_attach(void *xsc, int id)
195{
196	struct rt2560_softc *sc = xsc;
197	struct ieee80211com *ic = &sc->sc_ic;
198	struct ifnet *ifp = &ic->ic_if;
199	int error, i;
200
201	timeout_set(&sc->scan_ch, rt2560_next_scan, sc);
202	timeout_set(&sc->rssadapt_ch, rt2560_rssadapt_updatestats, sc);
203
204	/* retrieve RT2560 rev. no */
205	sc->asic_rev = RAL_READ(sc, RT2560_CSR0);
206
207	/* retrieve MAC address */
208	rt2560_get_macaddr(sc, ic->ic_myaddr);
209	printf(", address %s\n", ether_sprintf(ic->ic_myaddr));
210
211	/* retrieve RF rev. no and various other things from EEPROM */
212	rt2560_read_eeprom(sc);
213
214	printf("%s: MAC/BBP RT2560 (rev 0x%02x), RF %s\n", sc->sc_dev.dv_xname,
215	    sc->asic_rev, rt2560_get_rf(sc->rf_rev));
216
217	/*
218	 * Allocate Tx and Rx rings.
219	 */
220	error = rt2560_alloc_tx_ring(sc, &sc->txq, RT2560_TX_RING_COUNT);
221	if (error != 0) {
222		printf("%s: could not allocate Tx ring\n",
223		    sc->sc_dev.dv_xname);
224		goto fail1;
225	}
226
227	error = rt2560_alloc_tx_ring(sc, &sc->atimq, RT2560_ATIM_RING_COUNT);
228	if (error != 0) {
229		printf("%s: could not allocate ATIM ring\n",
230		    sc->sc_dev.dv_xname);
231		goto fail2;
232	}
233
234	error = rt2560_alloc_tx_ring(sc, &sc->prioq, RT2560_PRIO_RING_COUNT);
235	if (error != 0) {
236		printf("%s: could not allocate Prio ring\n",
237		    sc->sc_dev.dv_xname);
238		goto fail3;
239	}
240
241	error = rt2560_alloc_tx_ring(sc, &sc->bcnq, RT2560_BEACON_RING_COUNT);
242	if (error != 0) {
243		printf("%s: could not allocate Beacon ring\n",
244		    sc->sc_dev.dv_xname);
245		goto fail4;
246	}
247
248	error = rt2560_alloc_rx_ring(sc, &sc->rxq, RT2560_RX_RING_COUNT);
249	if (error != 0) {
250		printf("%s: could not allocate Rx ring\n",
251		    sc->sc_dev.dv_xname);
252		goto fail5;
253	}
254
255	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
256	ic->ic_opmode = IEEE80211_M_STA; /* default to BSS mode */
257	ic->ic_state = IEEE80211_S_INIT;
258
259	/* set device capabilities */
260	ic->ic_caps =
261	    IEEE80211_C_IBSS |		/* IBSS mode supported */
262	    IEEE80211_C_MONITOR |	/* monitor mode supported */
263	    IEEE80211_C_HOSTAP |	/* HostAp mode supported */
264	    IEEE80211_C_TXPMGT |	/* tx power management */
265	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
266	    IEEE80211_C_SHSLOT |	/* short slot time supported */
267	    IEEE80211_C_WEP;		/* s/w WEP */
268
269	if (sc->rf_rev == RT2560_RF_5222) {
270		/* set supported .11a rates */
271		ic->ic_sup_rates[IEEE80211_MODE_11A] = rt2560_rateset_11a;
272
273		/* set supported .11a channels */
274		for (i = 36; i <= 64; i += 4) {
275			ic->ic_channels[i].ic_freq =
276			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
277			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
278		}
279		for (i = 100; i <= 140; i += 4) {
280			ic->ic_channels[i].ic_freq =
281			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
282			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
283		}
284		for (i = 149; i <= 161; i += 4) {
285			ic->ic_channels[i].ic_freq =
286			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
287			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
288		}
289	}
290
291	/* set supported .11b and .11g rates */
292	ic->ic_sup_rates[IEEE80211_MODE_11B] = rt2560_rateset_11b;
293	ic->ic_sup_rates[IEEE80211_MODE_11G] = rt2560_rateset_11g;
294
295	/* set supported .11b and .11g channels (1 through 14) */
296	for (i = 1; i <= 14; i++) {
297		ic->ic_channels[i].ic_freq =
298		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
299		ic->ic_channels[i].ic_flags =
300		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
301		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
302	}
303
304	ifp->if_softc = sc;
305	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
306	ifp->if_init = rt2560_init;
307	ifp->if_ioctl = rt2560_ioctl;
308	ifp->if_start = rt2560_start;
309	ifp->if_watchdog = rt2560_watchdog;
310	IFQ_SET_READY(&ifp->if_snd);
311	memcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
312
313	if_attach(ifp);
314	ieee80211_ifattach(ifp);
315	ic->ic_node_alloc = rt2560_node_alloc;
316	ic->ic_node_copy = rt2560_node_copy;
317
318	/* override state transition machine */
319	sc->sc_newstate = ic->ic_newstate;
320	ic->ic_newstate = rt2560_newstate;
321	ieee80211_media_init(ifp, rt2560_media_change, ieee80211_media_status);
322
323#if NBPFILTER > 0
324	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
325	    sizeof (struct ieee80211_frame) + 64);
326
327	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
328	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
329	sc->sc_rxtap.wr_ihdr.it_present = htole32(RT2560_RX_RADIOTAP_PRESENT);
330
331	sc->sc_txtap_len = sizeof sc->sc_txtapu;
332	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
333	sc->sc_txtap.wt_ihdr.it_present = htole32(RT2560_TX_RADIOTAP_PRESENT);
334#endif
335
336	/*
337	 * Make sure the interface is shutdown during reboot.
338	 */
339	sc->sc_sdhook = shutdownhook_establish(rt2560_shutdown, sc);
340	if (sc->sc_sdhook == NULL)
341		printf(": WARNING: unable to establish shutdown hook\n");
342	sc->sc_powerhook = powerhook_establish(rt2560_power, sc);
343	if (sc->sc_powerhook == NULL)
344		printf(": WARNING: unable to establish power hook\n");
345
346	return 0;
347
348fail5:	rt2560_free_tx_ring(sc, &sc->bcnq);
349fail4:	rt2560_free_tx_ring(sc, &sc->prioq);
350fail3:	rt2560_free_tx_ring(sc, &sc->atimq);
351fail2:	rt2560_free_tx_ring(sc, &sc->txq);
352fail1:	return ENXIO;
353}
354
355int
356rt2560_detach(void *xsc)
357{
358	struct rt2560_softc *sc = xsc;
359	struct ifnet *ifp = &sc->sc_ic.ic_if;
360
361	timeout_del(&sc->scan_ch);
362	timeout_del(&sc->rssadapt_ch);
363
364	ieee80211_ifdetach(ifp);	/* free all nodes */
365	if_detach(ifp);
366
367	if (sc->sc_powerhook != NULL)
368		powerhook_disestablish(sc->sc_powerhook);
369	if (sc->sc_sdhook != NULL)
370		shutdownhook_disestablish(sc->sc_sdhook);
371
372	rt2560_free_tx_ring(sc, &sc->txq);
373	rt2560_free_tx_ring(sc, &sc->atimq);
374	rt2560_free_tx_ring(sc, &sc->prioq);
375	rt2560_free_tx_ring(sc, &sc->bcnq);
376	rt2560_free_rx_ring(sc, &sc->rxq);
377
378	return 0;
379}
380
381int
382rt2560_alloc_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring,
383    int count)
384{
385	int i, nsegs, error;
386
387	ring->count = count;
388	ring->queued = 0;
389	ring->cur = ring->next = 0;
390	ring->cur_encrypt = ring->next_encrypt = 0;
391
392	error = bus_dmamap_create(sc->sc_dmat, count * RT2560_TX_DESC_SIZE, 1,
393	    count * RT2560_TX_DESC_SIZE, 0, BUS_DMA_NOWAIT, &ring->map);
394	if (error != 0) {
395		printf("%s: could not create desc DMA map\n",
396		    sc->sc_dev.dv_xname);
397		goto fail;
398	}
399
400	error = bus_dmamem_alloc(sc->sc_dmat, count * RT2560_TX_DESC_SIZE,
401	    PAGE_SIZE, 0, &ring->seg, 1, &nsegs, BUS_DMA_NOWAIT);
402	if (error != 0) {
403		printf("%s: could not allocate DMA memory\n",
404		    sc->sc_dev.dv_xname);
405		goto fail;
406	}
407
408	error = bus_dmamem_map(sc->sc_dmat, &ring->seg, nsegs,
409	    count * RT2560_TX_DESC_SIZE, (caddr_t *)&ring->desc,
410	    BUS_DMA_NOWAIT);
411	if (error != 0) {
412		printf("%s: could not map desc DMA memory\n",
413		    sc->sc_dev.dv_xname);
414		goto fail;
415	}
416
417	error = bus_dmamap_load(sc->sc_dmat, ring->map, ring->desc,
418	    count * RT2560_TX_DESC_SIZE, NULL, BUS_DMA_NOWAIT);
419	if (error != 0) {
420		printf("%s: could not load desc DMA map\n",
421		    sc->sc_dev.dv_xname);
422		goto fail;
423	}
424
425	memset(ring->desc, 0, count * RT2560_TX_DESC_SIZE);
426	ring->physaddr = ring->map->dm_segs->ds_addr;
427
428	ring->data = malloc(count * sizeof (struct rt2560_tx_data), M_DEVBUF,
429	    M_NOWAIT);
430	if (ring->data == NULL) {
431		printf("%s: could not allocate soft data\n",
432		    sc->sc_dev.dv_xname);
433		error = ENOMEM;
434		goto fail;
435	}
436
437	memset(ring->data, 0, count * sizeof (struct rt2560_tx_data));
438	for (i = 0; i < count; i++) {
439		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,
440		    RT2560_MAX_SCATTER, MCLBYTES, 0, BUS_DMA_NOWAIT,
441		    &ring->data[i].map);
442		if (error != 0) {
443			printf("%s: could not create DMA map\n",
444			    sc->sc_dev.dv_xname);
445			goto fail;
446		}
447	}
448
449	return 0;
450
451fail:	rt2560_free_tx_ring(sc, ring);
452	return error;
453}
454
455void
456rt2560_reset_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring)
457{
458	struct rt2560_tx_desc *desc;
459	struct rt2560_tx_data *data;
460	int i;
461
462	for (i = 0; i < ring->count; i++) {
463		desc = &ring->desc[i];
464		data = &ring->data[i];
465
466		if (data->m != NULL) {
467			bus_dmamap_sync(sc->sc_dmat, data->map, 0,
468			    data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
469			bus_dmamap_unload(sc->sc_dmat, data->map);
470			m_freem(data->m);
471			data->m = NULL;
472		}
473
474		/*
475		 * The node has already been freed at that point so don't call
476		 * ieee80211_release_node() here.
477		 */
478		data->ni = NULL;
479
480		desc->flags = 0;
481	}
482
483	bus_dmamap_sync(sc->sc_dmat, ring->map, 0, ring->map->dm_mapsize,
484	    BUS_DMASYNC_PREWRITE);
485
486	ring->queued = 0;
487	ring->cur = ring->next = 0;
488	ring->cur_encrypt = ring->next_encrypt = 0;
489}
490
491void
492rt2560_free_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring)
493{
494	struct rt2560_tx_data *data;
495	int i;
496
497	if (ring->desc != NULL) {
498		bus_dmamap_sync(sc->sc_dmat, ring->map, 0,
499		    ring->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
500		bus_dmamap_unload(sc->sc_dmat, ring->map);
501		bus_dmamem_unmap(sc->sc_dmat, (caddr_t)ring->desc,
502		    ring->count * RT2560_TX_DESC_SIZE);
503		bus_dmamem_free(sc->sc_dmat, &ring->seg, 1);
504	}
505
506	if (ring->data != NULL) {
507		for (i = 0; i < ring->count; i++) {
508			data = &ring->data[i];
509
510			if (data->m != NULL) {
511				bus_dmamap_sync(sc->sc_dmat, data->map, 0,
512				    data->map->dm_mapsize,
513				    BUS_DMASYNC_POSTWRITE);
514				bus_dmamap_unload(sc->sc_dmat, data->map);
515				m_freem(data->m);
516			}
517
518			/*
519			 * The node has already been freed at that point so
520			 * don't call ieee80211_release_node() here.
521			 */
522			data->ni = NULL;
523
524			if (data->map != NULL)
525				bus_dmamap_destroy(sc->sc_dmat, data->map);
526		}
527		free(ring->data, M_DEVBUF);
528	}
529}
530
531int
532rt2560_alloc_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring,
533    int count)
534{
535	struct rt2560_rx_desc *desc;
536	struct rt2560_rx_data *data;
537	int i, nsegs, error;
538
539	ring->count = count;
540	ring->cur = ring->next = 0;
541	ring->cur_decrypt = 0;
542
543	error = bus_dmamap_create(sc->sc_dmat, count * RT2560_RX_DESC_SIZE, 1,
544	    count * RT2560_RX_DESC_SIZE, 0, BUS_DMA_NOWAIT, &ring->map);
545	if (error != 0) {
546		printf("%s: could not create desc DMA map\n",
547		    sc->sc_dev.dv_xname);
548		goto fail;
549	}
550
551	error = bus_dmamem_alloc(sc->sc_dmat, count * RT2560_RX_DESC_SIZE,
552	    PAGE_SIZE, 0, &ring->seg, 1, &nsegs, BUS_DMA_NOWAIT);
553	if (error != 0) {
554		printf("%s: could not allocate DMA memory\n",
555		    sc->sc_dev.dv_xname);
556		goto fail;
557	}
558
559	error = bus_dmamem_map(sc->sc_dmat, &ring->seg, nsegs,
560	    count * RT2560_RX_DESC_SIZE, (caddr_t *)&ring->desc,
561	    BUS_DMA_NOWAIT);
562	if (error != 0) {
563		printf("%s: could not map desc DMA memory\n",
564		    sc->sc_dev.dv_xname);
565		goto fail;
566	}
567
568	error = bus_dmamap_load(sc->sc_dmat, ring->map, ring->desc,
569	    count * RT2560_RX_DESC_SIZE, NULL, BUS_DMA_NOWAIT);
570	if (error != 0) {
571		printf("%s: could not load desc DMA map\n",
572		    sc->sc_dev.dv_xname);
573		goto fail;
574	}
575
576	memset(ring->desc, 0, count * RT2560_RX_DESC_SIZE);
577	ring->physaddr = ring->map->dm_segs->ds_addr;
578
579	ring->data = malloc(count * sizeof (struct rt2560_rx_data), M_DEVBUF,
580	    M_NOWAIT);
581	if (ring->data == NULL) {
582		printf("%s: could not allocate soft data\n",
583		    sc->sc_dev.dv_xname);
584		error = ENOMEM;
585		goto fail;
586	}
587
588	/*
589	 * Pre-allocate Rx buffers and populate Rx ring.
590	 */
591	memset(ring->data, 0, count * sizeof (struct rt2560_rx_data));
592	for (i = 0; i < count; i++) {
593		desc = &sc->rxq.desc[i];
594		data = &sc->rxq.data[i];
595
596		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
597		    0, BUS_DMA_NOWAIT, &data->map);
598		if (error != 0) {
599			printf("%s: could not create DMA map\n",
600			    sc->sc_dev.dv_xname);
601			goto fail;
602		}
603
604		MGETHDR(data->m, M_DONTWAIT, MT_DATA);
605		if (data->m == NULL) {
606			printf("%s: could not allocate rx mbuf\n",
607			    sc->sc_dev.dv_xname);
608			error = ENOMEM;
609			goto fail;
610		}
611
612		MCLGET(data->m, M_DONTWAIT);
613		if (!(data->m->m_flags & M_EXT)) {
614			printf("%s: could not allocate rx mbuf cluster\n",
615			    sc->sc_dev.dv_xname);
616			error = ENOMEM;
617			goto fail;
618		}
619
620		error = bus_dmamap_load(sc->sc_dmat, data->map,
621		    mtod(data->m, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
622		if (error != 0) {
623			printf("%s: could not load rx buf DMA map",
624			    sc->sc_dev.dv_xname);
625			goto fail;
626		}
627
628		desc->flags = htole32(RT2560_RX_BUSY);
629		desc->physaddr = htole32(data->map->dm_segs->ds_addr);
630	}
631
632	bus_dmamap_sync(sc->sc_dmat, ring->map, 0, ring->map->dm_mapsize,
633	    BUS_DMASYNC_PREWRITE);
634
635	return 0;
636
637fail:	rt2560_free_rx_ring(sc, ring);
638	return error;
639}
640
641void
642rt2560_reset_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring)
643{
644	int i;
645
646	for (i = 0; i < ring->count; i++) {
647		ring->desc[i].flags = htole32(RT2560_RX_BUSY);
648		ring->data[i].drop = 0;
649	}
650
651	bus_dmamap_sync(sc->sc_dmat, ring->map, 0, ring->map->dm_mapsize,
652	    BUS_DMASYNC_PREWRITE);
653
654	ring->cur = ring->next = 0;
655	ring->cur_decrypt = 0;
656}
657
658void
659rt2560_free_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring)
660{
661	struct rt2560_rx_data *data;
662	int i;
663
664	if (ring->desc != NULL) {
665		bus_dmamap_sync(sc->sc_dmat, ring->map, 0,
666		    ring->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
667		bus_dmamap_unload(sc->sc_dmat, ring->map);
668		bus_dmamem_unmap(sc->sc_dmat, (caddr_t)ring->desc,
669		    ring->count * RT2560_RX_DESC_SIZE);
670		bus_dmamem_free(sc->sc_dmat, &ring->seg, 1);
671	}
672
673	if (ring->data != NULL) {
674		for (i = 0; i < ring->count; i++) {
675			data = &ring->data[i];
676
677			if (data->m != NULL) {
678				bus_dmamap_sync(sc->sc_dmat, data->map, 0,
679				    data->map->dm_mapsize,
680				    BUS_DMASYNC_POSTREAD);
681				bus_dmamap_unload(sc->sc_dmat, data->map);
682				m_freem(data->m);
683			}
684
685			if (data->map != NULL)
686				bus_dmamap_destroy(sc->sc_dmat, data->map);
687		}
688		free(ring->data, M_DEVBUF);
689	}
690}
691
692struct ieee80211_node *
693rt2560_node_alloc(struct ieee80211com *ic)
694{
695	struct rt2560_node *rn;
696
697	rn = malloc(sizeof (struct rt2560_node), M_DEVBUF, M_NOWAIT);
698	if (rn == NULL)
699		return NULL;
700
701	memset(rn, 0, sizeof (struct rt2560_node));
702
703	return &rn->ni;
704}
705
706void
707rt2560_node_copy(struct ieee80211com *ic, struct ieee80211_node *dst,
708    const struct ieee80211_node *src)
709{
710	*(struct rt2560_node *)dst = *(const struct rt2560_node *)src;
711}
712
713int
714rt2560_media_change(struct ifnet *ifp)
715{
716	int error;
717
718	error = ieee80211_media_change(ifp);
719	if (error != ENETRESET)
720		return error;
721
722	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
723		rt2560_init(ifp);
724
725	return 0;
726}
727
728/*
729 * This function is called periodically (every 200ms) during scanning to
730 * switch from one channel to another.
731 */
732void
733rt2560_next_scan(void *arg)
734{
735	struct rt2560_softc *sc = arg;
736	struct ieee80211com *ic = &sc->sc_ic;
737	struct ifnet *ifp = &ic->ic_if;
738
739	if (ic->ic_state == IEEE80211_S_SCAN)
740		ieee80211_next_scan(ifp);
741}
742
743/*
744 * This function is called for each neighbor node.
745 */
746void
747rt2560_iter_func(void *arg, struct ieee80211_node *ni)
748{
749	struct rt2560_node *rn = (struct rt2560_node *)ni;
750
751	ieee80211_rssadapt_updatestats(&rn->rssadapt);
752}
753
754/*
755 * This function is called periodically (every 100ms) in RUN state to update
756 * the rate control statistics.
757 */
758void
759rt2560_rssadapt_updatestats(void *arg)
760{
761	struct rt2560_softc *sc = arg;
762	struct ieee80211com *ic = &sc->sc_ic;
763
764	ieee80211_iterate_nodes(ic, rt2560_iter_func, arg);
765
766	timeout_add(&sc->rssadapt_ch, hz / 10);
767}
768
769int
770rt2560_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
771{
772	struct rt2560_softc *sc = ic->ic_if.if_softc;
773	enum ieee80211_state ostate;
774	struct ieee80211_node *ni;
775	struct mbuf *m;
776	int error = 0;
777
778	ostate = ic->ic_state;
779	timeout_del(&sc->scan_ch);
780
781	switch (nstate) {
782	case IEEE80211_S_INIT:
783		timeout_del(&sc->rssadapt_ch);
784
785		if (ostate == IEEE80211_S_RUN) {
786			/* abort TSF synchronization */
787			RAL_WRITE(sc, RT2560_CSR14, 0);
788
789			/* turn association led off */
790			rt2560_update_led(sc, 0, 0);
791		}
792		break;
793
794	case IEEE80211_S_SCAN:
795		rt2560_set_chan(sc, ic->ic_bss->ni_chan);
796		timeout_add(&sc->scan_ch, hz / 5);
797		break;
798
799	case IEEE80211_S_AUTH:
800		rt2560_set_chan(sc, ic->ic_bss->ni_chan);
801		break;
802
803	case IEEE80211_S_ASSOC:
804		rt2560_set_chan(sc, ic->ic_bss->ni_chan);
805		break;
806
807	case IEEE80211_S_RUN:
808		rt2560_set_chan(sc, ic->ic_bss->ni_chan);
809
810		ni = ic->ic_bss;
811
812		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
813			rt2560_update_slot(sc);
814			rt2560_set_basicrates(sc);
815			rt2560_set_bssid(sc, ni->ni_bssid);
816		}
817
818		if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
819		    ic->ic_opmode == IEEE80211_M_IBSS) {
820			m = ieee80211_beacon_alloc(ic, ni);
821			if (m == NULL) {
822				printf("%s: could not allocate beacon\n",
823				    sc->sc_dev.dv_xname);
824				error = ENOBUFS;
825				break;
826			}
827
828			error = rt2560_tx_bcn(sc, m, ni);
829			if (error != 0)
830				break;
831		}
832
833		/* turn assocation led on */
834		rt2560_update_led(sc, 1, 0);
835
836		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
837			timeout_add(&sc->rssadapt_ch, hz / 10);
838			rt2560_enable_tsf_sync(sc);
839		}
840		break;
841	}
842
843	return (error != 0) ? error : sc->sc_newstate(ic, nstate, arg);
844}
845
846/*
847 * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46 or
848 * 93C66).
849 */
850uint16_t
851rt2560_eeprom_read(struct rt2560_softc *sc, uint8_t addr)
852{
853	uint32_t tmp;
854	uint16_t val;
855	int n;
856
857	/* clock C once before the first command */
858	RT2560_EEPROM_CTL(sc, 0);
859
860	RT2560_EEPROM_CTL(sc, RT2560_S);
861	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
862	RT2560_EEPROM_CTL(sc, RT2560_S);
863
864	/* write start bit (1) */
865	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D);
866	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D | RT2560_C);
867
868	/* write READ opcode (10) */
869	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D);
870	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D | RT2560_C);
871	RT2560_EEPROM_CTL(sc, RT2560_S);
872	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
873
874	/* write address (A5-A0 or A7-A0) */
875	n = (RAL_READ(sc, RT2560_CSR21) & RT2560_93C46) ? 5 : 7;
876	for (; n >= 0; n--) {
877		RT2560_EEPROM_CTL(sc, RT2560_S |
878		    (((addr >> n) & 1) << RT2560_SHIFT_D));
879		RT2560_EEPROM_CTL(sc, RT2560_S |
880		    (((addr >> n) & 1) << RT2560_SHIFT_D) | RT2560_C);
881	}
882
883	RT2560_EEPROM_CTL(sc, RT2560_S);
884
885	/* read data Q15-Q0 */
886	val = 0;
887	for (n = 15; n >= 0; n--) {
888		RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
889		tmp = RAL_READ(sc, RT2560_CSR21);
890		val |= ((tmp & RT2560_Q) >> RT2560_SHIFT_Q) << n;
891		RT2560_EEPROM_CTL(sc, RT2560_S);
892	}
893
894	RT2560_EEPROM_CTL(sc, 0);
895
896	/* clear Chip Select and clock C */
897	RT2560_EEPROM_CTL(sc, RT2560_S);
898	RT2560_EEPROM_CTL(sc, 0);
899	RT2560_EEPROM_CTL(sc, RT2560_C);
900
901	return val;
902}
903
904/*
905 * Some frames were processed by the hardware cipher engine and are ready for
906 * transmission.
907 */
908void
909rt2560_encryption_intr(struct rt2560_softc *sc)
910{
911	struct rt2560_tx_desc *desc;
912	int hw;
913
914	/* retrieve last descriptor index processed by cipher engine */
915	hw = (RAL_READ(sc, RT2560_SECCSR1) - sc->txq.physaddr) /
916	    RT2560_TX_DESC_SIZE;
917
918	for (; sc->txq.next_encrypt != hw;) {
919		desc = &sc->txq.desc[sc->txq.next_encrypt];
920
921		bus_dmamap_sync(sc->sc_dmat, sc->txq.map,
922		    sc->txq.next_encrypt * RT2560_TX_DESC_SIZE,
923		    RT2560_TX_DESC_SIZE, BUS_DMASYNC_POSTREAD);
924
925		if (letoh32(desc->flags) &
926		    (RT2560_TX_BUSY | RT2560_TX_CIPHER_BUSY))
927			break;
928
929		/* for TKIP, swap eiv field to fix a bug in ASIC */
930		if ((letoh32(desc->flags) & RT2560_TX_CIPHER_MASK) ==
931		    RT2560_TX_CIPHER_TKIP)
932			desc->eiv = swap32(desc->eiv);
933
934		/* mark the frame ready for transmission */
935		desc->flags |= htole32(RT2560_TX_BUSY | RT2560_TX_VALID);
936
937		bus_dmamap_sync(sc->sc_dmat, sc->txq.map,
938		    sc->txq.next_encrypt * RT2560_TX_DESC_SIZE,
939		    RT2560_TX_DESC_SIZE, BUS_DMASYNC_PREWRITE);
940
941		DPRINTFN(15, ("encryption done idx=%u\n",
942		    sc->txq.next_encrypt));
943
944		sc->txq.next_encrypt =
945		    (sc->txq.next_encrypt + 1) % RT2560_TX_RING_COUNT;
946	}
947
948	/* kick Tx */
949	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_TX);
950}
951
952void
953rt2560_tx_intr(struct rt2560_softc *sc)
954{
955	struct ieee80211com *ic = &sc->sc_ic;
956	struct ifnet *ifp = &ic->ic_if;
957	struct rt2560_tx_desc *desc;
958	struct rt2560_tx_data *data;
959	struct rt2560_node *rn;
960
961	for (;;) {
962		desc = &sc->txq.desc[sc->txq.next];
963		data = &sc->txq.data[sc->txq.next];
964
965		bus_dmamap_sync(sc->sc_dmat, sc->txq.map,
966		    sc->txq.next * RT2560_TX_DESC_SIZE, RT2560_TX_DESC_SIZE,
967		    BUS_DMASYNC_POSTREAD);
968
969		if ((letoh32(desc->flags) & RT2560_TX_BUSY) ||
970		    (letoh32(desc->flags) & RT2560_TX_CIPHER_BUSY) ||
971		    !(letoh32(desc->flags) & RT2560_TX_VALID))
972			break;
973
974		rn = (struct rt2560_node *)data->ni;
975
976		switch (letoh32(desc->flags) & RT2560_TX_RESULT_MASK) {
977		case RT2560_TX_SUCCESS:
978			DPRINTFN(10, ("data frame sent successfully\n"));
979			if (data->id.id_node != NULL) {
980				ieee80211_rssadapt_raise_rate(ic,
981				    &rn->rssadapt, &data->id);
982			}
983			ifp->if_opackets++;
984			break;
985
986		case RT2560_TX_SUCCESS_RETRY:
987			DPRINTFN(9, ("data frame sent after %u retries\n",
988			    (letoh32(desc->flags) >> 5) & 0x7));
989			ifp->if_opackets++;
990			break;
991
992		case RT2560_TX_FAIL_RETRY:
993			DPRINTFN(9, ("sending data frame failed (too much "
994			    "retries)\n"));
995			if (data->id.id_node != NULL) {
996				ieee80211_rssadapt_lower_rate(ic, data->ni,
997				    &rn->rssadapt, &data->id);
998			}
999			ifp->if_oerrors++;
1000			break;
1001
1002		case RT2560_TX_FAIL_INVALID:
1003		case RT2560_TX_FAIL_OTHER:
1004		default:
1005			printf("%s: sending data frame failed 0x%08x\n",
1006			    sc->sc_dev.dv_xname, letoh32(desc->flags));
1007			ifp->if_oerrors++;
1008		}
1009
1010		bus_dmamap_sync(sc->sc_dmat, data->map, 0,
1011		    data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
1012		bus_dmamap_unload(sc->sc_dmat, data->map);
1013		m_freem(data->m);
1014		data->m = NULL;
1015		ieee80211_release_node(ic, data->ni);
1016		data->ni = NULL;
1017
1018		/* descriptor is no longer valid */
1019		desc->flags &= ~htole32(RT2560_TX_VALID);
1020
1021		bus_dmamap_sync(sc->sc_dmat, sc->txq.map,
1022		    sc->txq.next * RT2560_TX_DESC_SIZE, RT2560_TX_DESC_SIZE,
1023		    BUS_DMASYNC_PREWRITE);
1024
1025		DPRINTFN(15, ("tx done idx=%u\n", sc->txq.next));
1026
1027		sc->txq.queued--;
1028		sc->txq.next = (sc->txq.next + 1) % RT2560_TX_RING_COUNT;
1029	}
1030
1031	sc->sc_tx_timer = 0;
1032	ifp->if_flags &= ~IFF_OACTIVE;
1033	rt2560_start(ifp);
1034}
1035
1036void
1037rt2560_prio_intr(struct rt2560_softc *sc)
1038{
1039	struct ieee80211com *ic = &sc->sc_ic;
1040	struct ifnet *ifp = &ic->ic_if;
1041	struct rt2560_tx_desc *desc;
1042	struct rt2560_tx_data *data;
1043
1044	for (;;) {
1045		desc = &sc->prioq.desc[sc->prioq.next];
1046		data = &sc->prioq.data[sc->prioq.next];
1047
1048		bus_dmamap_sync(sc->sc_dmat, sc->prioq.map,
1049		    sc->prioq.next * RT2560_TX_DESC_SIZE, RT2560_TX_DESC_SIZE,
1050		    BUS_DMASYNC_POSTREAD);
1051
1052		if ((letoh32(desc->flags) & RT2560_TX_BUSY) ||
1053		    !(letoh32(desc->flags) & RT2560_TX_VALID))
1054			break;
1055
1056		switch (letoh32(desc->flags) & RT2560_TX_RESULT_MASK) {
1057		case RT2560_TX_SUCCESS:
1058			DPRINTFN(10, ("mgt frame sent successfully\n"));
1059			break;
1060
1061		case RT2560_TX_SUCCESS_RETRY:
1062			DPRINTFN(9, ("mgt frame sent after %u retries\n",
1063			    (letoh32(desc->flags) >> 5) & 0x7));
1064			break;
1065
1066		case RT2560_TX_FAIL_RETRY:
1067			DPRINTFN(9, ("sending mgt frame failed (too much "
1068			    "retries)\n"));
1069			break;
1070
1071		case RT2560_TX_FAIL_INVALID:
1072		case RT2560_TX_FAIL_OTHER:
1073		default:
1074			printf("%s: sending mgt frame failed 0x%08x\n",
1075			    sc->sc_dev.dv_xname, letoh32(desc->flags));
1076		}
1077
1078		bus_dmamap_sync(sc->sc_dmat, data->map, 0,
1079		    data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
1080		bus_dmamap_unload(sc->sc_dmat, data->map);
1081		m_freem(data->m);
1082		data->m = NULL;
1083		ieee80211_release_node(ic, data->ni);
1084		data->ni = NULL;
1085
1086		/* descriptor is no longer valid */
1087		desc->flags &= ~htole32(RT2560_TX_VALID);
1088
1089		bus_dmamap_sync(sc->sc_dmat, sc->prioq.map,
1090		    sc->prioq.next * RT2560_TX_DESC_SIZE, RT2560_TX_DESC_SIZE,
1091		    BUS_DMASYNC_PREWRITE);
1092
1093		DPRINTFN(15, ("prio done idx=%u\n", sc->prioq.next));
1094
1095		sc->prioq.queued--;
1096		sc->prioq.next = (sc->prioq.next + 1) % RT2560_PRIO_RING_COUNT;
1097	}
1098
1099	sc->sc_tx_timer = 0;
1100	ifp->if_flags &= ~IFF_OACTIVE;
1101	rt2560_start(ifp);
1102}
1103
1104/*
1105 * Some frames were processed by the hardware cipher engine and are ready for
1106 * transmission to the IEEE802.11 layer.
1107 */
1108void
1109rt2560_decryption_intr(struct rt2560_softc *sc)
1110{
1111	struct ieee80211com *ic = &sc->sc_ic;
1112	struct ifnet *ifp = &ic->ic_if;
1113	struct rt2560_rx_desc *desc;
1114	struct rt2560_rx_data *data;
1115	struct rt2560_node *rn;
1116	struct ieee80211_frame *wh;
1117	struct ieee80211_node *ni;
1118	struct mbuf *mnew, *m;
1119	int hw, error;
1120
1121	/* retrieve last decriptor index processed by cipher engine */
1122	hw = (RAL_READ(sc, RT2560_SECCSR0) - sc->rxq.physaddr) /
1123	    RT2560_RX_DESC_SIZE;
1124
1125	for (; sc->rxq.cur_decrypt != hw;) {
1126		desc = &sc->rxq.desc[sc->rxq.cur_decrypt];
1127		data = &sc->rxq.data[sc->rxq.cur_decrypt];
1128
1129		bus_dmamap_sync(sc->sc_dmat, sc->rxq.map,
1130		    sc->rxq.cur_decrypt * RT2560_TX_DESC_SIZE,
1131		    RT2560_TX_DESC_SIZE, BUS_DMASYNC_POSTREAD);
1132
1133		if (letoh32(desc->flags) &
1134		    (RT2560_RX_BUSY | RT2560_RX_CIPHER_BUSY))
1135			break;
1136
1137		if (data->drop) {
1138			ifp->if_ierrors++;
1139			goto skip;
1140		}
1141
1142		if ((letoh32(desc->flags) & RT2560_RX_CIPHER_MASK) != 0 &&
1143		    (letoh32(desc->flags) & RT2560_RX_ICV_ERROR)) {
1144			ifp->if_ierrors++;
1145			goto skip;
1146		}
1147
1148		/*
1149		 * Try to allocate a new mbuf for this ring element and load it
1150		 * before processing the current mbuf.  If the ring element
1151		 * cannot be loaded, drop the received packet and reuse the old
1152		 * mbuf.  In the unlikely case that the old mbuf can't be
1153		 * reloaded either, explicitly panic.
1154		 */
1155		MGETHDR(mnew, M_DONTWAIT, MT_DATA);
1156		if (mnew == NULL) {
1157			ifp->if_ierrors++;
1158			goto skip;
1159		}
1160
1161		MCLGET(mnew, M_DONTWAIT);
1162		if (!(mnew->m_flags & M_EXT)) {
1163			m_freem(mnew);
1164			ifp->if_ierrors++;
1165			goto skip;
1166		}
1167
1168		bus_dmamap_sync(sc->sc_dmat, data->map, 0,
1169		    data->map->dm_mapsize, BUS_DMASYNC_POSTREAD);
1170		bus_dmamap_unload(sc->sc_dmat, data->map);
1171
1172		error = bus_dmamap_load(sc->sc_dmat, data->map,
1173		    mtod(mnew, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
1174		if (error != 0) {
1175			m_freem(mnew);
1176
1177			/* try to reload the old mbuf */
1178			error = bus_dmamap_load(sc->sc_dmat, data->map,
1179			    mtod(data->m, void *), MCLBYTES, NULL,
1180			    BUS_DMA_NOWAIT);
1181			if (error != 0) {
1182				/* very unlikely that it will fail... */
1183				panic("%s: could not load old rx mbuf",
1184				    sc->sc_dev.dv_xname);
1185			}
1186			ifp->if_ierrors++;
1187			goto skip;
1188		}
1189
1190		/*
1191		 * New mbuf successfully loaded, update Rx ring and continue
1192		 * processing.
1193		 */
1194		m = data->m;
1195		data->m = mnew;
1196		desc->physaddr = htole32(data->map->dm_segs->ds_addr);
1197
1198		/* finalize mbuf */
1199		m->m_pkthdr.rcvif = ifp;
1200		m->m_pkthdr.len = m->m_len =
1201		    (letoh32(desc->flags) >> 16) & 0xfff;
1202
1203#if NBPFILTER > 0
1204		if (sc->sc_drvbpf != NULL) {
1205			struct mbuf mb;
1206			struct rt2560_rx_radiotap_header *tap = &sc->sc_rxtap;
1207			uint32_t tsf_lo, tsf_hi;
1208
1209			/* get timestamp (low and high 32 bits) */
1210			tsf_hi = RAL_READ(sc, RT2560_CSR17);
1211			tsf_lo = RAL_READ(sc, RT2560_CSR16);
1212
1213			tap->wr_tsf =
1214			    htole64(((uint64_t)tsf_hi << 32) | tsf_lo);
1215			tap->wr_flags = 0;
1216			tap->wr_rate = rt2560_rxrate(desc);
1217			tap->wr_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
1218			tap->wr_chan_flags =
1219			    htole16(ic->ic_ibss_chan->ic_flags);
1220			tap->wr_antenna = sc->rx_ant;
1221			tap->wr_antsignal = desc->rssi;
1222
1223			M_DUP_PKTHDR(&mb, m);
1224			mb.m_data = (caddr_t)tap;
1225			mb.m_len = sc->sc_txtap_len;
1226			mb.m_next = m;
1227			mb.m_pkthdr.len += mb.m_len;
1228			bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
1229		}
1230#endif
1231
1232		wh = mtod(m, struct ieee80211_frame *);
1233		ni = ieee80211_find_rxnode(ic, wh);
1234
1235		/* send the frame to the 802.11 layer */
1236		ieee80211_input(ifp, m, ni, desc->rssi, 0);
1237
1238		/* give rssi to the rate control algorithm */
1239		rn = (struct rt2560_node *)ni;
1240		ieee80211_rssadapt_input(ic, ni, &rn->rssadapt, desc->rssi);
1241
1242		/* node is no longer needed */
1243		ieee80211_release_node(ic, ni);
1244
1245skip:		desc->flags = htole32(RT2560_RX_BUSY);
1246
1247		bus_dmamap_sync(sc->sc_dmat, sc->rxq.map,
1248		    sc->rxq.cur_decrypt * RT2560_TX_DESC_SIZE,
1249		    RT2560_TX_DESC_SIZE, BUS_DMASYNC_PREWRITE);
1250
1251		DPRINTFN(15, ("decryption done idx=%u\n", sc->rxq.cur_decrypt));
1252
1253		sc->rxq.cur_decrypt =
1254		    (sc->rxq.cur_decrypt + 1) % RT2560_RX_RING_COUNT;
1255	}
1256
1257	/*
1258	 * In HostAP mode, ieee80211_input() will enqueue packets in if_snd
1259	 * without calling if_start().
1260	 */
1261	if (!IFQ_IS_EMPTY(&ifp->if_snd) && !(ifp->if_flags & IFF_OACTIVE))
1262		rt2560_start(ifp);
1263}
1264
1265/*
1266 * Some frames were received. Pass them to the hardware cipher engine before
1267 * sending them to the 802.11 layer.
1268 */
1269void
1270rt2560_rx_intr(struct rt2560_softc *sc)
1271{
1272	struct rt2560_rx_desc *desc;
1273	struct rt2560_rx_data *data;
1274
1275	for (;;) {
1276		desc = &sc->rxq.desc[sc->rxq.cur];
1277		data = &sc->rxq.data[sc->rxq.cur];
1278
1279		bus_dmamap_sync(sc->sc_dmat, sc->rxq.map,
1280		    sc->rxq.cur * RT2560_RX_DESC_SIZE, RT2560_RX_DESC_SIZE,
1281		    BUS_DMASYNC_POSTREAD);
1282
1283		if (letoh32(desc->flags) &
1284		    (RT2560_RX_BUSY | RT2560_RX_CIPHER_BUSY))
1285			break;
1286
1287		data->drop = 0;
1288
1289		if (letoh32(desc->flags) &
1290		    (RT2560_RX_PHY_ERROR | RT2560_RX_CRC_ERROR)) {
1291			/*
1292			 * This should not happen since we did not request
1293			 * to receive those frames when we filled RXCSR0.
1294			 */
1295			DPRINTFN(5, ("PHY or CRC error flags 0x%08x\n",
1296			    letoh32(desc->flags)));
1297			data->drop = 1;
1298		}
1299
1300		if (((letoh32(desc->flags) >> 16) & 0xfff) > MCLBYTES) {
1301			DPRINTFN(5, ("bad length\n"));
1302			data->drop = 1;
1303		}
1304
1305		/* mark the frame for decryption */
1306		desc->flags |= htole32(RT2560_RX_CIPHER_BUSY);
1307
1308		bus_dmamap_sync(sc->sc_dmat, sc->rxq.map,
1309		    sc->rxq.cur * RT2560_RX_DESC_SIZE, RT2560_RX_DESC_SIZE,
1310		    BUS_DMASYNC_PREWRITE);
1311
1312		DPRINTFN(15, ("rx done idx=%u\n", sc->rxq.cur));
1313
1314		sc->rxq.cur = (sc->rxq.cur + 1) % RT2560_RX_RING_COUNT;
1315	}
1316
1317	/* kick decrypt */
1318	RAL_WRITE(sc, RT2560_SECCSR0, RT2560_KICK_DECRYPT);
1319}
1320
1321/*
1322 * This function is called periodically in IBSS mode when a new beacon must be
1323 * sent out.
1324 */
1325void
1326rt2560_beacon_expire(struct rt2560_softc *sc)
1327{
1328	struct ieee80211com *ic = &sc->sc_ic;
1329	struct rt2560_tx_data *data;
1330
1331	if (ic->ic_opmode != IEEE80211_M_IBSS &&
1332	    ic->ic_opmode != IEEE80211_M_HOSTAP)
1333		return;
1334
1335	data = &sc->bcnq.data[sc->bcnq.next];
1336
1337#if NBPFILTER > 0
1338	if (ic->ic_rawbpf != NULL)
1339		bpf_mtap(ic->ic_rawbpf, data->m, BPF_DIRECTION_OUT);
1340#endif
1341
1342	DPRINTFN(15, ("beacon expired\n"));
1343}
1344
1345void
1346rt2560_wakeup_expire(struct rt2560_softc *sc)
1347{
1348	DPRINTFN(15, ("wakeup expired\n"));
1349}
1350
1351int
1352rt2560_intr(void *arg)
1353{
1354	struct rt2560_softc *sc = arg;
1355	struct ifnet *ifp = &sc->sc_ic.ic_if;
1356	uint32_t r;
1357
1358	/* disable interrupts */
1359	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
1360
1361	/* don't re-enable interrupts if we're shutting down */
1362	if (!(ifp->if_flags & IFF_RUNNING))
1363		return 0;
1364
1365	r = RAL_READ(sc, RT2560_CSR7);
1366	RAL_WRITE(sc, RT2560_CSR7, r);
1367
1368	if (r & RT2560_BEACON_EXPIRE)
1369		rt2560_beacon_expire(sc);
1370
1371	if (r & RT2560_WAKEUP_EXPIRE)
1372		rt2560_wakeup_expire(sc);
1373
1374	if (r & RT2560_ENCRYPTION_DONE)
1375		rt2560_encryption_intr(sc);
1376
1377	if (r & RT2560_TX_DONE)
1378		rt2560_tx_intr(sc);
1379
1380	if (r & RT2560_PRIO_DONE)
1381		rt2560_prio_intr(sc);
1382
1383	if (r & RT2560_DECRYPTION_DONE)
1384		rt2560_decryption_intr(sc);
1385
1386	if (r & RT2560_RX_DONE)
1387		rt2560_rx_intr(sc);
1388
1389	/* re-enable interrupts */
1390	RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
1391
1392	return 1;
1393}
1394
1395/* quickly determine if a given rate is CCK or OFDM */
1396#define RAL_RATE_IS_OFDM(rate) ((rate) >= 12 && (rate) != 22)
1397
1398#define RAL_ACK_SIZE	14	/* 10 + 4(FCS) */
1399#define RAL_CTS_SIZE	14	/* 10 + 4(FCS) */
1400
1401#define RAL_SIFS		10	/* us */
1402
1403#define RT2560_RXTX_TURNAROUND	10	/* us */
1404
1405/*
1406 * This function is only used by the Rx radiotap code. It returns the rate at
1407 * which a given frame was received.
1408 */
1409#if NBPFILTER > 0
1410uint8_t
1411rt2560_rxrate(struct rt2560_rx_desc *desc)
1412{
1413	if (letoh32(desc->flags) & RT2560_RX_OFDM) {
1414		/* reverse function of rt2560_plcp_signal */
1415		switch (desc->rate) {
1416		case 0xb:	return 12;
1417		case 0xf:	return 18;
1418		case 0xa:	return 24;
1419		case 0xe:	return 36;
1420		case 0x9:	return 48;
1421		case 0xd:	return 72;
1422		case 0x8:	return 96;
1423		case 0xc:	return 108;
1424		}
1425	} else {
1426		if (desc->rate == 10)
1427			return 2;
1428		if (desc->rate == 20)
1429			return 4;
1430		if (desc->rate == 55)
1431			return 11;
1432		if (desc->rate == 110)
1433			return 22;
1434	}
1435	return 2;	/* should not get there */
1436}
1437#endif
1438
1439/*
1440 * Return the expected ack rate for a frame transmitted at rate `rate'.
1441 * XXX: this should depend on the destination node basic rate set.
1442 */
1443int
1444rt2560_ack_rate(struct ieee80211com *ic, int rate)
1445{
1446	switch (rate) {
1447	/* CCK rates */
1448	case 2:
1449		return 2;
1450	case 4:
1451	case 11:
1452	case 22:
1453		return (ic->ic_curmode == IEEE80211_MODE_11B) ? 4 : rate;
1454
1455	/* OFDM rates */
1456	case 12:
1457	case 18:
1458		return 12;
1459	case 24:
1460	case 36:
1461		return 24;
1462	case 48:
1463	case 72:
1464	case 96:
1465	case 108:
1466		return 48;
1467	}
1468
1469	/* default to 1Mbps */
1470	return 2;
1471}
1472
1473/*
1474 * Compute the duration (in us) needed to transmit `len' bytes at rate `rate'.
1475 * The function automatically determines the operating mode depending on the
1476 * given rate. `flags' indicates whether short preamble is in use or not.
1477 */
1478uint16_t
1479rt2560_txtime(int len, int rate, uint32_t flags)
1480{
1481	uint16_t txtime;
1482
1483	if (RAL_RATE_IS_OFDM(rate)) {
1484		/* IEEE Std 802.11a-1999, pp. 37 */
1485		txtime = (8 + 4 * len + 3 + rate - 1) / rate;
1486		txtime = 16 + 4 + 4 * txtime + 6;
1487	} else {
1488		/* IEEE Std 802.11b-1999, pp. 28 */
1489		txtime = (16 * len + rate - 1) / rate;
1490		if (rate != 2 && (flags & IEEE80211_F_SHPREAMBLE))
1491			txtime +=  72 + 24;
1492		else
1493			txtime += 144 + 48;
1494	}
1495	return txtime;
1496}
1497
1498uint8_t
1499rt2560_plcp_signal(int rate)
1500{
1501	switch (rate) {
1502	/* CCK rates (returned values are device-dependent) */
1503	case 2:		return 0x0;
1504	case 4:		return 0x1;
1505	case 11:	return 0x2;
1506	case 22:	return 0x3;
1507
1508	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1509	case 12:	return 0xb;
1510	case 18:	return 0xf;
1511	case 24:	return 0xa;
1512	case 36:	return 0xe;
1513	case 48:	return 0x9;
1514	case 72:	return 0xd;
1515	case 96:	return 0x8;
1516	case 108:	return 0xc;
1517
1518	/* unsupported rates (should not get there) */
1519	default:	return 0xff;
1520	}
1521}
1522
1523void
1524rt2560_setup_tx_desc(struct rt2560_softc *sc, struct rt2560_tx_desc *desc,
1525    uint32_t flags, int len, int rate, int encrypt, bus_addr_t physaddr)
1526{
1527	struct ieee80211com *ic = &sc->sc_ic;
1528	uint16_t plcp_length;
1529	int remainder;
1530
1531	desc->flags = htole32(flags);
1532	desc->flags |= htole32(len << 16);
1533	desc->flags |= encrypt ? htole32(RT2560_TX_CIPHER_BUSY) :
1534	    htole32(RT2560_TX_BUSY | RT2560_TX_VALID);
1535
1536	desc->physaddr = htole32(physaddr);
1537	desc->wme = htole16(
1538	    RT2560_AIFSN(2) |
1539	    RT2560_LOGCWMIN(3) |
1540	    RT2560_LOGCWMAX(8));
1541
1542	/* setup PLCP fields */
1543	desc->plcp_signal  = rt2560_plcp_signal(rate);
1544	desc->plcp_service = 4;
1545
1546	len += IEEE80211_CRC_LEN;
1547	if (RAL_RATE_IS_OFDM(rate)) {
1548		desc->flags |= htole32(RT2560_TX_OFDM);
1549
1550		plcp_length = len & 0xfff;
1551		desc->plcp_length_hi = plcp_length >> 6;
1552		desc->plcp_length_lo = plcp_length & 0x3f;
1553	} else {
1554		plcp_length = (16 * len + rate - 1) / rate;
1555		if (rate == 22) {
1556			remainder = (16 * len) % 22;
1557			if (remainder != 0 && remainder < 7)
1558				desc->plcp_service |= RT2560_PLCP_LENGEXT;
1559		}
1560		desc->plcp_length_hi = plcp_length >> 8;
1561		desc->plcp_length_lo = plcp_length & 0xff;
1562
1563		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1564			desc->plcp_signal |= 0x08;
1565	}
1566}
1567
1568int
1569rt2560_tx_bcn(struct rt2560_softc *sc, struct mbuf *m0,
1570    struct ieee80211_node *ni)
1571{
1572	struct rt2560_tx_desc *desc;
1573	struct rt2560_tx_data *data;
1574	int rate, error;
1575
1576	desc = &sc->bcnq.desc[sc->bcnq.cur];
1577	data = &sc->bcnq.data[sc->bcnq.cur];
1578
1579	rate = IEEE80211_IS_CHAN_5GHZ(ni->ni_chan) ? 12 : 2;
1580
1581	error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
1582	    BUS_DMA_NOWAIT);
1583	if (error != 0) {
1584		printf("%s: could not map mbuf (error %d)\n",
1585		    sc->sc_dev.dv_xname, error);
1586		m_freem(m0);
1587		return error;
1588	}
1589
1590	data->m = m0;
1591	data->ni = ni;
1592
1593	rt2560_setup_tx_desc(sc, desc, RT2560_TX_IFS_NEWBACKOFF |
1594	    RT2560_TX_TIMESTAMP, m0->m_pkthdr.len, rate, 0,
1595	    data->map->dm_segs->ds_addr);
1596
1597	bus_dmamap_sync(sc->sc_dmat, data->map, 0, data->map->dm_mapsize,
1598	    BUS_DMASYNC_PREWRITE);
1599	bus_dmamap_sync(sc->sc_dmat, sc->bcnq.map,
1600	    sc->bcnq.cur * RT2560_TX_DESC_SIZE, RT2560_TX_DESC_SIZE,
1601	    BUS_DMASYNC_PREWRITE);
1602
1603	return 0;
1604}
1605
1606int
1607rt2560_tx_mgt(struct rt2560_softc *sc, struct mbuf *m0,
1608    struct ieee80211_node *ni)
1609{
1610	struct ieee80211com *ic = &sc->sc_ic;
1611	struct ifnet *ifp = &ic->ic_if;
1612	struct rt2560_tx_desc *desc;
1613	struct rt2560_tx_data *data;
1614	struct ieee80211_frame *wh;
1615	uint16_t dur;
1616	uint32_t flags = 0;
1617	int rate, error;
1618
1619	desc = &sc->prioq.desc[sc->prioq.cur];
1620	data = &sc->prioq.data[sc->prioq.cur];
1621
1622	rate = IEEE80211_IS_CHAN_5GHZ(ni->ni_chan) ? 12 : 2;
1623
1624	wh = mtod(m0, struct ieee80211_frame *);
1625
1626	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1627		m0 = ieee80211_wep_crypt(ifp, m0, 1);
1628		if (m0 == NULL)
1629			return ENOBUFS;
1630
1631		/* packet header may have moved, reset our local pointer */
1632		wh = mtod(m0, struct ieee80211_frame *);
1633	}
1634
1635	error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
1636	    BUS_DMA_NOWAIT);
1637	if (error != 0) {
1638		printf("%s: could not map mbuf (error %d)\n",
1639		    sc->sc_dev.dv_xname, error);
1640		m_freem(m0);
1641		return error;
1642	}
1643
1644#if NBPFILTER > 0
1645	if (sc->sc_drvbpf != NULL) {
1646		struct mbuf mb;
1647		struct rt2560_tx_radiotap_header *tap = &sc->sc_txtap;
1648
1649		tap->wt_flags = 0;
1650		tap->wt_rate = rate;
1651		tap->wt_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
1652		tap->wt_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
1653		tap->wt_antenna = sc->tx_ant;
1654
1655		M_DUP_PKTHDR(&mb, m0);
1656		mb.m_data = (caddr_t)tap;
1657		mb.m_len = sc->sc_txtap_len;
1658		mb.m_next = m0;
1659		mb.m_pkthdr.len += mb.m_len;
1660		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
1661	}
1662#endif
1663
1664	data->m = m0;
1665	data->ni = ni;
1666
1667	wh = mtod(m0, struct ieee80211_frame *);
1668
1669	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1670		flags |= RT2560_TX_ACK;
1671
1672		dur = rt2560_txtime(RAL_ACK_SIZE, rate, ic->ic_flags) +
1673		    RAL_SIFS;
1674		*(uint16_t *)wh->i_dur = htole16(dur);
1675
1676		/* tell hardware to set timestamp for probe responses */
1677		if ((wh->i_fc[0] &
1678		    (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
1679		    (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
1680			flags |= RT2560_TX_TIMESTAMP;
1681	}
1682
1683	rt2560_setup_tx_desc(sc, desc, flags, m0->m_pkthdr.len, rate, 0,
1684	    data->map->dm_segs->ds_addr);
1685
1686	bus_dmamap_sync(sc->sc_dmat, data->map, 0, data->map->dm_mapsize,
1687	    BUS_DMASYNC_PREWRITE);
1688	bus_dmamap_sync(sc->sc_dmat, sc->prioq.map,
1689	    sc->prioq.cur * RT2560_TX_DESC_SIZE, RT2560_TX_DESC_SIZE,
1690	    BUS_DMASYNC_PREWRITE);
1691
1692	DPRINTFN(10, ("sending mgt frame len=%u idx=%u rate=%u\n",
1693	    m0->m_pkthdr.len, sc->prioq.cur, rate));
1694
1695	/* kick prio */
1696	sc->prioq.queued++;
1697	sc->prioq.cur = (sc->prioq.cur + 1) % RT2560_PRIO_RING_COUNT;
1698	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_PRIO);
1699
1700	return 0;
1701}
1702
1703/*
1704 * Build a RTS control frame.
1705 */
1706struct mbuf *
1707rt2560_get_rts(struct rt2560_softc *sc, struct ieee80211_frame *wh,
1708    uint16_t dur)
1709{
1710	struct ieee80211_frame_rts *rts;
1711	struct mbuf *m;
1712
1713	MGETHDR(m, M_DONTWAIT, MT_DATA);
1714	if (m == NULL) {
1715		sc->sc_ic.ic_stats.is_tx_nombuf++;
1716		printf("%s: could not allocate RTS frame\n",
1717		    sc->sc_dev.dv_xname);
1718		return NULL;
1719	}
1720
1721	rts = mtod(m, struct ieee80211_frame_rts *);
1722
1723	rts->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_CTL |
1724	    IEEE80211_FC0_SUBTYPE_RTS;
1725	rts->i_fc[1] = IEEE80211_FC1_DIR_NODS;
1726	*(uint16_t *)rts->i_dur = htole16(dur);
1727	IEEE80211_ADDR_COPY(rts->i_ra, wh->i_addr1);
1728	IEEE80211_ADDR_COPY(rts->i_ta, wh->i_addr2);
1729
1730	m->m_pkthdr.len = m->m_len = sizeof (struct ieee80211_frame_rts);
1731
1732	return m;
1733}
1734
1735int
1736rt2560_tx_data(struct rt2560_softc *sc, struct mbuf *m0,
1737    struct ieee80211_node *ni)
1738{
1739	struct ieee80211com *ic = &sc->sc_ic;
1740	struct ifnet *ifp = &ic->ic_if;
1741	struct rt2560_tx_desc *desc;
1742	struct rt2560_tx_data *data;
1743	struct rt2560_node *rn;
1744	struct ieee80211_rateset *rs;
1745	struct ieee80211_frame *wh;
1746	struct mbuf *mnew;
1747	uint16_t dur;
1748	uint32_t flags = 0;
1749	int rate, useprot, error;
1750
1751	wh = mtod(m0, struct ieee80211_frame *);
1752
1753	/* XXX this should be reworked! */
1754	if (ic->ic_fixed_rate != -1) {
1755		if (ic->ic_curmode != IEEE80211_MODE_AUTO)
1756			rs = &ic->ic_sup_rates[ic->ic_curmode];
1757		else
1758			rs = &ic->ic_sup_rates[IEEE80211_MODE_11G];
1759
1760		rate = rs->rs_rates[ic->ic_fixed_rate];
1761	} else {
1762		rs = &ni->ni_rates;
1763		rn = (struct rt2560_node *)ni;
1764		ni->ni_txrate = ieee80211_rssadapt_choose(&rn->rssadapt, rs,
1765		    wh, m0->m_pkthdr.len, -1, NULL, 0);
1766		rate = rs->rs_rates[ni->ni_txrate];
1767	}
1768	rate &= IEEE80211_RATE_VAL;
1769	if (rate == 0)
1770		rate = 2;	/* fallback to 1Mbps; should not happen */
1771
1772	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1773		m0 = ieee80211_wep_crypt(ifp, m0, 1);
1774		if (m0 == NULL)
1775			return ENOBUFS;
1776
1777		/* packet header may have moved, reset our local pointer */
1778		wh = mtod(m0, struct ieee80211_frame *);
1779	}
1780
1781	/*-
1782	 * IEEE Std 802.11-1999, pp 82: "A STA shall use an RTS/CTS exchange
1783	 * for directed frames only when the length of the MPDU is greater
1784	 * than the length threshold indicated by" ic_rtsthreshold.
1785	 *
1786	 * IEEE Std 802.11-2003g, pp 13: "ERP STAs shall use protection
1787	 * mechanism (such as RTS/CTS or CTS-to-self) for ERP-OFDM MPDUs of
1788	 * type Data or an MMPDU".
1789	 */
1790	useprot = !IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1791	    (m0->m_pkthdr.len + IEEE80211_CRC_LEN > ic->ic_rtsthreshold ||
1792	     ((ic->ic_flags & IEEE80211_F_USEPROT) && RAL_RATE_IS_OFDM(rate)));
1793	if (useprot) {
1794		struct mbuf *m;
1795		uint16_t dur;
1796		int rtsrate, ackrate;
1797
1798		rtsrate = IEEE80211_IS_CHAN_5GHZ(ni->ni_chan) ? 12 : 2;
1799		ackrate = rt2560_ack_rate(ic, rate);
1800
1801		dur = rt2560_txtime(m0->m_pkthdr.len + 4, rate, ic->ic_flags) +
1802		      rt2560_txtime(RAL_CTS_SIZE, rtsrate, ic->ic_flags) +
1803		      rt2560_txtime(RAL_ACK_SIZE, ackrate, ic->ic_flags) +
1804		      3 * RAL_SIFS;
1805
1806		m = rt2560_get_rts(sc, wh, dur);
1807		if (m == NULL) {
1808			printf("%s: could not allocate RTS frame\n",
1809			    sc->sc_dev.dv_xname);
1810			m_freem(m0);
1811			return ENOBUFS;
1812		}
1813
1814		desc = &sc->txq.desc[sc->txq.cur_encrypt];
1815		data = &sc->txq.data[sc->txq.cur_encrypt];
1816
1817		error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m,
1818		    BUS_DMA_NOWAIT);
1819		if (error != 0) {
1820			printf("%s: could not map mbuf (error %d)\n",
1821			    sc->sc_dev.dv_xname, error);
1822			m_freem(m);
1823			m_freem(m0);
1824			return error;
1825		}
1826
1827		/* avoid multiple free() of the same node for each fragment */
1828		ieee80211_ref_node(ni);
1829
1830		data->m = m;
1831		data->ni = ni;
1832
1833		/* RTS frames are not taken into account for rssadapt */
1834		data->id.id_node = NULL;
1835
1836		rt2560_setup_tx_desc(sc, desc, RT2560_TX_ACK |
1837		    RT2560_TX_MORE_FRAG, m->m_pkthdr.len, rtsrate, 1,
1838		    data->map->dm_segs->ds_addr);
1839
1840		bus_dmamap_sync(sc->sc_dmat, data->map, 0,
1841		    data->map->dm_mapsize, BUS_DMASYNC_PREWRITE);
1842		bus_dmamap_sync(sc->sc_dmat, sc->txq.map,
1843		    sc->txq.cur_encrypt * RT2560_TX_DESC_SIZE,
1844		    RT2560_TX_DESC_SIZE, BUS_DMASYNC_PREWRITE);
1845
1846		sc->txq.queued++;
1847		sc->txq.cur_encrypt =
1848		    (sc->txq.cur_encrypt + 1) % RT2560_TX_RING_COUNT;
1849
1850		/*
1851		 * IEEE Std 802.11-1999: "when an RTS/CTS exchange is used, the
1852		 * asynchronous data frame shall be transmitted after the CTS
1853		 * frame and a SIFS period".
1854		 */
1855		flags |= RT2560_TX_LONG_RETRY | RT2560_TX_IFS_SIFS;
1856	}
1857
1858	data = &sc->txq.data[sc->txq.cur_encrypt];
1859	desc = &sc->txq.desc[sc->txq.cur_encrypt];
1860
1861	error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
1862	    BUS_DMA_NOWAIT);
1863	if (error != 0 && error != EFBIG) {
1864		printf("%s: could not map mbuf (error %d)\n",
1865		    sc->sc_dev.dv_xname, error);
1866		m_freem(m0);
1867		return error;
1868	}
1869	if (error != 0) {
1870		/* too many fragments, linearize */
1871
1872		MGETHDR(mnew, M_DONTWAIT, MT_DATA);
1873		if (mnew == NULL) {
1874			m_freem(m0);
1875			return ENOMEM;
1876		}
1877
1878		M_DUP_PKTHDR(mnew, m0);
1879		if (m0->m_pkthdr.len > MHLEN) {
1880			MCLGET(mnew, M_DONTWAIT);
1881			if (!(mnew->m_flags & M_EXT)) {
1882				m_freem(m0);
1883				m_freem(mnew);
1884				return ENOMEM;
1885			}
1886		}
1887
1888		m_copydata(m0, 0, m0->m_pkthdr.len, mtod(mnew, caddr_t));
1889		m_freem(m0);
1890		mnew->m_len = mnew->m_pkthdr.len;
1891		m0 = mnew;
1892
1893		error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
1894		    BUS_DMA_NOWAIT);
1895		if (error != 0) {
1896			printf("%s: could not map mbuf (error %d)\n",
1897			    sc->sc_dev.dv_xname, error);
1898			m_freem(m0);
1899			return error;
1900		}
1901
1902		/* packet header have moved, reset our local pointer */
1903		wh = mtod(m0, struct ieee80211_frame *);
1904	}
1905
1906#if NBPFILTER > 0
1907	if (sc->sc_drvbpf != NULL) {
1908		struct mbuf mb;
1909		struct rt2560_tx_radiotap_header *tap = &sc->sc_txtap;
1910
1911		tap->wt_flags = 0;
1912		tap->wt_rate = rate;
1913		tap->wt_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
1914		tap->wt_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
1915		tap->wt_antenna = sc->tx_ant;
1916
1917		M_DUP_PKTHDR(&mb, m0);
1918		mb.m_data = (caddr_t)tap;
1919		mb.m_len = sc->sc_txtap_len;
1920		mb.m_next = m0;
1921		mb.m_pkthdr.len += mb.m_len;
1922		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
1923	}
1924#endif
1925
1926	data->m = m0;
1927	data->ni = ni;
1928
1929	/* remember link conditions for rate adaptation algorithm */
1930	if (ic->ic_fixed_rate == -1) {
1931		data->id.id_len = m0->m_pkthdr.len;
1932		data->id.id_rateidx = ni->ni_txrate;
1933		data->id.id_node = ni;
1934		data->id.id_rssi = ni->ni_rssi;
1935	} else
1936		data->id.id_node = NULL;
1937
1938	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1939		flags |= RT2560_TX_ACK;
1940
1941		dur = rt2560_txtime(RAL_ACK_SIZE, rt2560_ack_rate(ic, rate),
1942		    ic->ic_flags) + RAL_SIFS;
1943		*(uint16_t *)wh->i_dur = htole16(dur);
1944	}
1945
1946	rt2560_setup_tx_desc(sc, desc, flags, m0->m_pkthdr.len, rate, 1,
1947	    data->map->dm_segs->ds_addr);
1948
1949	bus_dmamap_sync(sc->sc_dmat, data->map, 0, data->map->dm_mapsize,
1950	    BUS_DMASYNC_PREWRITE);
1951	bus_dmamap_sync(sc->sc_dmat, sc->txq.map,
1952	    sc->txq.cur_encrypt * RT2560_TX_DESC_SIZE, RT2560_TX_DESC_SIZE,
1953	    BUS_DMASYNC_PREWRITE);
1954
1955	DPRINTFN(10, ("sending data frame len=%u idx=%u rate=%u\n",
1956	    m0->m_pkthdr.len, sc->txq.cur_encrypt, rate));
1957
1958	/* kick encrypt */
1959	sc->txq.queued++;
1960	sc->txq.cur_encrypt = (sc->txq.cur_encrypt + 1) % RT2560_TX_RING_COUNT;
1961	RAL_WRITE(sc, RT2560_SECCSR1, RT2560_KICK_ENCRYPT);
1962
1963	return 0;
1964}
1965
1966void
1967rt2560_start(struct ifnet *ifp)
1968{
1969	struct rt2560_softc *sc = ifp->if_softc;
1970	struct ieee80211com *ic = &sc->sc_ic;
1971	struct mbuf *m0;
1972	struct ieee80211_node *ni;
1973
1974	/*
1975	 * net80211 may still try to send management frames even if the
1976	 * IFF_RUNNING flag is not set...
1977	 */
1978	if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
1979		return;
1980
1981	for (;;) {
1982		IF_POLL(&ic->ic_mgtq, m0);
1983		if (m0 != NULL) {
1984			if (sc->prioq.queued >= RT2560_PRIO_RING_COUNT) {
1985				ifp->if_flags |= IFF_OACTIVE;
1986				break;
1987			}
1988			IF_DEQUEUE(&ic->ic_mgtq, m0);
1989
1990			ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
1991			m0->m_pkthdr.rcvif = NULL;
1992#if NBPFILTER > 0
1993			if (ic->ic_rawbpf != NULL)
1994				bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
1995#endif
1996			if (rt2560_tx_mgt(sc, m0, ni) != 0)
1997				break;
1998
1999		} else {
2000			if (ic->ic_state != IEEE80211_S_RUN)
2001				break;
2002			IFQ_DEQUEUE(&ifp->if_snd, m0);
2003			if (m0 == NULL)
2004				break;
2005			if (sc->txq.queued >= RT2560_TX_RING_COUNT - 1) {
2006				IF_PREPEND(&ifp->if_snd, m0);
2007				ifp->if_flags |= IFF_OACTIVE;
2008				break;
2009			}
2010#if NBPFILTER > 0
2011			if (ifp->if_bpf != NULL)
2012				bpf_mtap(ifp->if_bpf, m0, BPF_DIRECTION_OUT);
2013#endif
2014			m0 = ieee80211_encap(ifp, m0, &ni);
2015			if (m0 == NULL)
2016				continue;
2017#if NBPFILTER > 0
2018			if (ic->ic_rawbpf != NULL)
2019				bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
2020#endif
2021			if (rt2560_tx_data(sc, m0, ni) != 0) {
2022				if (ni != NULL)
2023					ieee80211_release_node(ic, ni);
2024				ifp->if_oerrors++;
2025				break;
2026			}
2027		}
2028
2029		sc->sc_tx_timer = 5;
2030		ifp->if_timer = 1;
2031	}
2032}
2033
2034void
2035rt2560_watchdog(struct ifnet *ifp)
2036{
2037	struct rt2560_softc *sc = ifp->if_softc;
2038
2039	ifp->if_timer = 0;
2040
2041	if (sc->sc_tx_timer > 0) {
2042		if (--sc->sc_tx_timer == 0) {
2043			printf("%s: device timeout\n", sc->sc_dev.dv_xname);
2044			rt2560_init(ifp);
2045			ifp->if_oerrors++;
2046			return;
2047		}
2048		ifp->if_timer = 1;
2049	}
2050
2051	ieee80211_watchdog(ifp);
2052}
2053
2054int
2055rt2560_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
2056{
2057	struct rt2560_softc *sc = ifp->if_softc;
2058	struct ieee80211com *ic = &sc->sc_ic;
2059	struct ifaddr *ifa;
2060	struct ifreq *ifr;
2061	int s, error = 0;
2062
2063	s = splnet();
2064
2065	switch (cmd) {
2066	case SIOCSIFADDR:
2067		ifa = (struct ifaddr *)data;
2068		ifp->if_flags |= IFF_UP;
2069#ifdef INET
2070		if (ifa->ifa_addr->sa_family == AF_INET)
2071			arp_ifinit(&ic->ic_ac, ifa);
2072#endif
2073		/* FALLTHROUGH */
2074	case SIOCSIFFLAGS:
2075		if (ifp->if_flags & IFF_UP) {
2076			if (ifp->if_flags & IFF_RUNNING)
2077				rt2560_update_promisc(sc);
2078			else
2079				rt2560_init(ifp);
2080		} else {
2081			if (ifp->if_flags & IFF_RUNNING)
2082				rt2560_stop(ifp, 1);
2083		}
2084		break;
2085
2086	case SIOCADDMULTI:
2087	case SIOCDELMULTI:
2088		ifr = (struct ifreq *)data;
2089		error = (cmd == SIOCADDMULTI) ?
2090		    ether_addmulti(ifr, &ic->ic_ac) :
2091		    ether_delmulti(ifr, &ic->ic_ac);
2092
2093		if (error == ENETRESET)
2094			error = 0;
2095		break;
2096
2097	case SIOCS80211CHANNEL:
2098		/*
2099		 * This allows for fast channel switching in monitor mode
2100		 * (used by kismet). In IBSS mode, we must explicitly reset
2101		 * the interface to generate a new beacon frame.
2102		 */
2103		error = ieee80211_ioctl(ifp, cmd, data);
2104		if (error == ENETRESET &&
2105		    ic->ic_opmode == IEEE80211_M_MONITOR) {
2106			rt2560_set_chan(sc, ic->ic_ibss_chan);
2107			error = 0;
2108		}
2109		break;
2110
2111	default:
2112		error = ieee80211_ioctl(ifp, cmd, data);
2113	}
2114
2115	if (error == ENETRESET) {
2116		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
2117		    (IFF_UP | IFF_RUNNING))
2118			rt2560_init(ifp);
2119		error = 0;
2120	}
2121
2122	splx(s);
2123
2124	return error;
2125}
2126
2127void
2128rt2560_bbp_write(struct rt2560_softc *sc, uint8_t reg, uint8_t val)
2129{
2130	uint32_t tmp;
2131	int ntries;
2132
2133	for (ntries = 0; ntries < 100; ntries++) {
2134		if (!(RAL_READ(sc, RT2560_BBPCSR) & RT2560_BBP_BUSY))
2135			break;
2136		DELAY(1);
2137	}
2138	if (ntries == 100) {
2139		printf("%s: could not write to BBP\n", sc->sc_dev.dv_xname);
2140		return;
2141	}
2142
2143	tmp = RT2560_BBP_WRITE | RT2560_BBP_BUSY | reg << 8 | val;
2144	RAL_WRITE(sc, RT2560_BBPCSR, tmp);
2145
2146	DPRINTFN(15, ("BBP R%u <- 0x%02x\n", reg, val));
2147}
2148
2149uint8_t
2150rt2560_bbp_read(struct rt2560_softc *sc, uint8_t reg)
2151{
2152	uint32_t val;
2153	int ntries;
2154
2155	val = RT2560_BBP_BUSY | reg << 8;
2156	RAL_WRITE(sc, RT2560_BBPCSR, val);
2157
2158	for (ntries = 0; ntries < 100; ntries++) {
2159		val = RAL_READ(sc, RT2560_BBPCSR);
2160		if (!(val & RT2560_BBP_BUSY))
2161			return val & 0xff;
2162		DELAY(1);
2163	}
2164
2165	printf("%s: could not read from BBP\n", sc->sc_dev.dv_xname);
2166	return 0;
2167}
2168
2169void
2170rt2560_rf_write(struct rt2560_softc *sc, uint8_t reg, uint32_t val)
2171{
2172	uint32_t tmp;
2173	int ntries;
2174
2175	for (ntries = 0; ntries < 100; ntries++) {
2176		if (!(RAL_READ(sc, RT2560_RFCSR) & RT2560_RF_BUSY))
2177			break;
2178		DELAY(1);
2179	}
2180	if (ntries == 100) {
2181		printf("%s: could not write to RF\n", sc->sc_dev.dv_xname);
2182		return;
2183	}
2184
2185	tmp = RT2560_RF_BUSY | RT2560_RF_20BIT | (val & 0xfffff) << 2 |
2186	    (reg & 0x3);
2187	RAL_WRITE(sc, RT2560_RFCSR, tmp);
2188
2189	/* remember last written value in sc */
2190	sc->rf_regs[reg] = val;
2191
2192	DPRINTFN(15, ("RF R[%u] <- 0x%05x\n", reg & 0x3, val & 0xfffff));
2193}
2194
2195void
2196rt2560_set_chan(struct rt2560_softc *sc, struct ieee80211_channel *c)
2197{
2198	struct ieee80211com *ic = &sc->sc_ic;
2199	uint8_t power, tmp;
2200	u_int i, chan;
2201
2202	chan = ieee80211_chan2ieee(ic, c);
2203	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
2204		return;
2205
2206	if (IEEE80211_IS_CHAN_2GHZ(c))
2207		power = min(sc->txpow[chan - 1], 31);
2208	else
2209		power = 31;
2210
2211	DPRINTFN(2, ("setting channel to %u, txpower to %u\n", chan, power));
2212
2213	switch (sc->rf_rev) {
2214	case RT2560_RF_2522:
2215		rt2560_rf_write(sc, RT2560_RF1, 0x00814);
2216		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf2522_r2[chan - 1]);
2217		rt2560_rf_write(sc, RT2560_RF3, power << 7 | 0x00040);
2218		break;
2219
2220	case RT2560_RF_2523:
2221		rt2560_rf_write(sc, RT2560_RF1, 0x08804);
2222		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf2523_r2[chan - 1]);
2223		rt2560_rf_write(sc, RT2560_RF3, power << 7 | 0x38044);
2224		rt2560_rf_write(sc, RT2560_RF4,
2225		    (chan == 14) ? 0x00280 : 0x00286);
2226		break;
2227
2228	case RT2560_RF_2524:
2229		rt2560_rf_write(sc, RT2560_RF1, 0x0c808);
2230		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf2524_r2[chan - 1]);
2231		rt2560_rf_write(sc, RT2560_RF3, power << 7 | 0x00040);
2232		rt2560_rf_write(sc, RT2560_RF4,
2233		    (chan == 14) ? 0x00280 : 0x00286);
2234		break;
2235
2236	case RT2560_RF_2525:
2237		rt2560_rf_write(sc, RT2560_RF1, 0x08808);
2238		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf2525_hi_r2[chan - 1]);
2239		rt2560_rf_write(sc, RT2560_RF3, power << 7 | 0x18044);
2240		rt2560_rf_write(sc, RT2560_RF4,
2241		    (chan == 14) ? 0x00280 : 0x00286);
2242
2243		rt2560_rf_write(sc, RT2560_RF1, 0x08808);
2244		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf2525_r2[chan - 1]);
2245		rt2560_rf_write(sc, RT2560_RF3, power << 7 | 0x18044);
2246		rt2560_rf_write(sc, RT2560_RF4,
2247		    (chan == 14) ? 0x00280 : 0x00286);
2248		break;
2249
2250	case RT2560_RF_2525E:
2251		rt2560_rf_write(sc, RT2560_RF1, 0x08808);
2252		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf2525e_r2[chan - 1]);
2253		rt2560_rf_write(sc, RT2560_RF3, power << 7 | 0x18044);
2254		rt2560_rf_write(sc, RT2560_RF4,
2255		    (chan == 14) ? 0x00286 : 0x00282);
2256		break;
2257
2258	case RT2560_RF_2526:
2259		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf2526_hi_r2[chan - 1]);
2260		rt2560_rf_write(sc, RT2560_RF4,
2261		   (chan & 1) ? 0x00386 : 0x00381);
2262		rt2560_rf_write(sc, RT2560_RF1, 0x08804);
2263
2264		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf2526_r2[chan - 1]);
2265		rt2560_rf_write(sc, RT2560_RF3, power << 7 | 0x18044);
2266		rt2560_rf_write(sc, RT2560_RF4,
2267		    (chan & 1) ? 0x00386 : 0x00381);
2268		break;
2269
2270	/* dual-band RF */
2271	case RT2560_RF_5222:
2272		for (i = 0; rt2560_rf5222[i].chan != chan; i++);
2273
2274		rt2560_rf_write(sc, RT2560_RF1, rt2560_rf5222[i].r1);
2275		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf5222[i].r2);
2276		rt2560_rf_write(sc, RT2560_RF3, power << 7 | 0x00040);
2277		rt2560_rf_write(sc, RT2560_RF4, rt2560_rf5222[i].r4);
2278		break;
2279	}
2280
2281	if (ic->ic_opmode != IEEE80211_M_MONITOR &&
2282	    ic->ic_state != IEEE80211_S_SCAN) {
2283		/* set Japan filter bit for channel 14 */
2284		tmp = rt2560_bbp_read(sc, 70);
2285
2286		tmp &= ~RT2560_JAPAN_FILTER;
2287		if (chan == 14)
2288			tmp |= RT2560_JAPAN_FILTER;
2289
2290		rt2560_bbp_write(sc, 70, tmp);
2291
2292		DELAY(1000); /* RF needs a 1ms delay here */
2293		rt2560_disable_rf_tune(sc);
2294
2295		/* clear CRC errors */
2296		RAL_READ(sc, RT2560_CNT0);
2297	}
2298}
2299
2300/*
2301 * Disable RF auto-tuning.
2302 */
2303void
2304rt2560_disable_rf_tune(struct rt2560_softc *sc)
2305{
2306	uint32_t tmp;
2307
2308	if (sc->rf_rev != RT2560_RF_2523) {
2309		tmp = sc->rf_regs[RT2560_RF1] & ~RT2560_RF1_AUTOTUNE;
2310		rt2560_rf_write(sc, RT2560_RF1, tmp);
2311	}
2312
2313	tmp = sc->rf_regs[RT2560_RF3] & ~RT2560_RF3_AUTOTUNE;
2314	rt2560_rf_write(sc, RT2560_RF3, tmp);
2315
2316	DPRINTFN(2, ("disabling RF autotune\n"));
2317}
2318
2319/*
2320 * Refer to IEEE Std 802.11-1999 pp. 123 for more information on TSF
2321 * synchronization.
2322 */
2323void
2324rt2560_enable_tsf_sync(struct rt2560_softc *sc)
2325{
2326	struct ieee80211com *ic = &sc->sc_ic;
2327	uint16_t logcwmin, preload;
2328	uint32_t tmp;
2329
2330	/* first, disable TSF synchronization */
2331	RAL_WRITE(sc, RT2560_CSR14, 0);
2332
2333	tmp = 16 * ic->ic_bss->ni_intval;
2334	RAL_WRITE(sc, RT2560_CSR12, tmp);
2335
2336	RAL_WRITE(sc, RT2560_CSR13, 0);
2337
2338	logcwmin = 5;
2339	preload = (ic->ic_opmode == IEEE80211_M_STA) ? 384 : 1024;
2340	tmp = logcwmin << 16 | preload;
2341	RAL_WRITE(sc, RT2560_BCNOCSR, tmp);
2342
2343	/* finally, enable TSF synchronization */
2344	tmp = RT2560_ENABLE_TSF | RT2560_ENABLE_TBCN;
2345	if (ic->ic_opmode == IEEE80211_M_STA)
2346		tmp |= RT2560_ENABLE_TSF_SYNC(1);
2347	else
2348		tmp |= RT2560_ENABLE_TSF_SYNC(2) |
2349		       RT2560_ENABLE_BEACON_GENERATOR;
2350	RAL_WRITE(sc, RT2560_CSR14, tmp);
2351
2352	DPRINTF(("enabling TSF synchronization\n"));
2353}
2354
2355void
2356rt2560_update_plcp(struct rt2560_softc *sc)
2357{
2358	struct ieee80211com *ic = &sc->sc_ic;
2359
2360	/* no short preamble for 1Mbps */
2361	RAL_WRITE(sc, RT2560_PLCP1MCSR, 0x00700400);
2362
2363	if (!(ic->ic_flags & IEEE80211_F_SHPREAMBLE)) {
2364		/* values taken from the reference driver */
2365		RAL_WRITE(sc, RT2560_PLCP2MCSR,   0x00380401);
2366		RAL_WRITE(sc, RT2560_PLCP5p5MCSR, 0x00150402);
2367		RAL_WRITE(sc, RT2560_PLCP11MCSR,  0x000b8403);
2368	} else {
2369		/* same values as above or'ed 0x8 */
2370		RAL_WRITE(sc, RT2560_PLCP2MCSR,   0x00380409);
2371		RAL_WRITE(sc, RT2560_PLCP5p5MCSR, 0x0015040a);
2372		RAL_WRITE(sc, RT2560_PLCP11MCSR,  0x000b840b);
2373	}
2374
2375	DPRINTF(("updating PLCP for %s preamble\n",
2376	    (ic->ic_flags & IEEE80211_F_SHPREAMBLE) ? "short" : "long"));
2377}
2378
2379/*
2380 * IEEE 802.11a uses short slot time. Refer to IEEE Std 802.11-1999 pp. 85 to
2381 * know how these values are computed.
2382 */
2383void
2384rt2560_update_slot(struct rt2560_softc *sc)
2385{
2386	struct ieee80211com *ic = &sc->sc_ic;
2387	uint8_t slottime;
2388	uint16_t sifs, pifs, difs, eifs;
2389	uint32_t tmp;
2390
2391	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
2392
2393	/* define the MAC slot boundaries */
2394	sifs = RAL_SIFS - RT2560_RXTX_TURNAROUND;
2395	pifs = sifs + slottime;
2396	difs = sifs + 2 * slottime;
2397	eifs = (ic->ic_curmode == IEEE80211_MODE_11B) ? 364 : 60;
2398
2399	tmp = RAL_READ(sc, RT2560_CSR11);
2400	tmp = (tmp & ~0x1f00) | slottime << 8;
2401	RAL_WRITE(sc, RT2560_CSR11, tmp);
2402
2403	tmp = pifs << 16 | sifs;
2404	RAL_WRITE(sc, RT2560_CSR18, tmp);
2405
2406	tmp = eifs << 16 | difs;
2407	RAL_WRITE(sc, RT2560_CSR19, tmp);
2408
2409	DPRINTF(("setting slottime to %uus\n", slottime));
2410}
2411
2412void
2413rt2560_set_basicrates(struct rt2560_softc *sc)
2414{
2415	struct ieee80211com *ic = &sc->sc_ic;
2416
2417	/* update basic rate set */
2418	if (ic->ic_curmode == IEEE80211_MODE_11B) {
2419		/* 11b basic rates: 1, 2Mbps */
2420		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x3);
2421	} else if (IEEE80211_IS_CHAN_5GHZ(ic->ic_bss->ni_chan)) {
2422		/* 11a basic rates: 6, 12, 24Mbps */
2423		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x150);
2424	} else {
2425		/* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
2426		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x15f);
2427	}
2428}
2429
2430void
2431rt2560_update_led(struct rt2560_softc *sc, int led1, int led2)
2432{
2433	uint32_t tmp;
2434
2435	/* set ON period to 70ms and OFF period to 30ms */
2436	tmp = led1 << 16 | led2 << 17 | 70 << 8 | 30;
2437	RAL_WRITE(sc, RT2560_LEDCSR, tmp);
2438}
2439
2440void
2441rt2560_set_bssid(struct rt2560_softc *sc, uint8_t *bssid)
2442{
2443	uint32_t tmp;
2444
2445	tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
2446	RAL_WRITE(sc, RT2560_CSR5, tmp);
2447
2448	tmp = bssid[4] | bssid[5] << 8;
2449	RAL_WRITE(sc, RT2560_CSR6, tmp);
2450
2451	DPRINTF(("setting BSSID to %s\n", ether_sprintf(bssid)));
2452}
2453
2454void
2455rt2560_set_macaddr(struct rt2560_softc *sc, uint8_t *addr)
2456{
2457	uint32_t tmp;
2458
2459	tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
2460	RAL_WRITE(sc, RT2560_CSR3, tmp);
2461
2462	tmp = addr[4] | addr[5] << 8;
2463	RAL_WRITE(sc, RT2560_CSR4, tmp);
2464
2465	DPRINTF(("setting MAC address to %s\n", ether_sprintf(addr)));
2466}
2467
2468void
2469rt2560_get_macaddr(struct rt2560_softc *sc, uint8_t *addr)
2470{
2471	uint32_t tmp;
2472
2473	tmp = RAL_READ(sc, RT2560_CSR3);
2474	addr[0] = tmp & 0xff;
2475	addr[1] = (tmp >>  8) & 0xff;
2476	addr[2] = (tmp >> 16) & 0xff;
2477	addr[3] = (tmp >> 24);
2478
2479	tmp = RAL_READ(sc, RT2560_CSR4);
2480	addr[4] = tmp & 0xff;
2481	addr[5] = (tmp >> 8) & 0xff;
2482}
2483
2484void
2485rt2560_update_promisc(struct rt2560_softc *sc)
2486{
2487	struct ifnet *ifp = &sc->sc_ic.ic_if;
2488	uint32_t tmp;
2489
2490	tmp = RAL_READ(sc, RT2560_RXCSR0);
2491
2492	tmp &= ~RT2560_DROP_NOT_TO_ME;
2493	if (!(ifp->if_flags & IFF_PROMISC))
2494		tmp |= RT2560_DROP_NOT_TO_ME;
2495
2496	RAL_WRITE(sc, RT2560_RXCSR0, tmp);
2497
2498	DPRINTF(("%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
2499	    "entering" : "leaving"));
2500}
2501
2502void
2503rt2560_set_txantenna(struct rt2560_softc *sc, int antenna)
2504{
2505	uint32_t tmp;
2506	uint8_t tx;
2507
2508	tx = rt2560_bbp_read(sc, RT2560_BBP_TX) & ~RT2560_BBP_ANTMASK;
2509	if (antenna == 1)
2510		tx |= RT2560_BBP_ANTA;
2511	else if (antenna == 2)
2512		tx |= RT2560_BBP_ANTB;
2513	else
2514		tx |= RT2560_BBP_DIVERSITY;
2515
2516	/* need to force I/Q flip for RF 2525e, 2526 and 5222 */
2517	if (sc->rf_rev == RT2560_RF_2525E || sc->rf_rev == RT2560_RF_2526 ||
2518	    sc->rf_rev == RT2560_RF_5222)
2519		tx |= RT2560_BBP_FLIPIQ;
2520
2521	rt2560_bbp_write(sc, RT2560_BBP_TX, tx);
2522
2523	/* update values for CCK and OFDM in BBPCSR1 */
2524	tmp = RAL_READ(sc, RT2560_BBPCSR1) & ~0x00070007;
2525	tmp |= (tx & 0x7) << 16 | (tx & 0x7);
2526	RAL_WRITE(sc, RT2560_BBPCSR1, tmp);
2527}
2528
2529void
2530rt2560_set_rxantenna(struct rt2560_softc *sc, int antenna)
2531{
2532	uint8_t rx;
2533
2534	rx = rt2560_bbp_read(sc, RT2560_BBP_RX) & ~RT2560_BBP_ANTMASK;
2535	if (antenna == 1)
2536		rx |= RT2560_BBP_ANTA;
2537	else if (antenna == 2)
2538		rx |= RT2560_BBP_ANTB;
2539	else
2540		rx |= RT2560_BBP_DIVERSITY;
2541
2542	/* need to force no I/Q flip for RF 2525e and 2526 */
2543	if (sc->rf_rev == RT2560_RF_2525E || sc->rf_rev == RT2560_RF_2526)
2544		rx &= ~RT2560_BBP_FLIPIQ;
2545
2546	rt2560_bbp_write(sc, RT2560_BBP_RX, rx);
2547}
2548
2549const char *
2550rt2560_get_rf(int rev)
2551{
2552	switch (rev) {
2553	case RT2560_RF_2522:	return "RT2522";
2554	case RT2560_RF_2523:	return "RT2523";
2555	case RT2560_RF_2524:	return "RT2524";
2556	case RT2560_RF_2525:	return "RT2525";
2557	case RT2560_RF_2525E:	return "RT2525e";
2558	case RT2560_RF_2526:	return "RT2526";
2559	case RT2560_RF_5222:	return "RT5222";
2560	default:		return "unknown";
2561	}
2562}
2563
2564void
2565rt2560_read_eeprom(struct rt2560_softc *sc)
2566{
2567	uint16_t val;
2568	int i;
2569
2570	val = rt2560_eeprom_read(sc, RT2560_EEPROM_CONFIG0);
2571	sc->rf_rev =   (val >> 11) & 0x1f;
2572	sc->hw_radio = (val >> 10) & 0x1;
2573	sc->led_mode = (val >> 6)  & 0x7;
2574	sc->rx_ant =   (val >> 4)  & 0x3;
2575	sc->tx_ant =   (val >> 2)  & 0x3;
2576	sc->nb_ant =   val & 0x3;
2577
2578	/* read default values for BBP registers */
2579	for (i = 0; i < 16; i++) {
2580		val = rt2560_eeprom_read(sc, RT2560_EEPROM_BBP_BASE + i);
2581		sc->bbp_prom[i].reg = val >> 8;
2582		sc->bbp_prom[i].val = val & 0xff;
2583	}
2584
2585	/* read Tx power for all b/g channels */
2586	for (i = 0; i < 14 / 2; i++) {
2587		val = rt2560_eeprom_read(sc, RT2560_EEPROM_TXPOWER + i);
2588		sc->txpow[i * 2] = val >> 8;
2589		sc->txpow[i * 2 + 1] = val & 0xff;
2590	}
2591}
2592
2593int
2594rt2560_bbp_init(struct rt2560_softc *sc)
2595{
2596#define N(a)	(sizeof (a) / sizeof ((a)[0]))
2597	int i, ntries;
2598
2599	/* wait for BBP to be ready */
2600	for (ntries = 0; ntries < 100; ntries++) {
2601		if (rt2560_bbp_read(sc, RT2560_BBP_VERSION) != 0)
2602			break;
2603		DELAY(1);
2604	}
2605	if (ntries == 100) {
2606		printf("%s: timeout waiting for BBP\n", sc->sc_dev.dv_xname);
2607		return EIO;
2608	}
2609
2610	/* initialize BBP registers to default values */
2611	for (i = 0; i < N(rt2560_def_bbp); i++) {
2612		rt2560_bbp_write(sc, rt2560_def_bbp[i].reg,
2613		    rt2560_def_bbp[i].val);
2614	}
2615#if 0
2616	/* initialize BBP registers to values stored in EEPROM */
2617	for (i = 0; i < 16; i++) {
2618		if (sc->bbp_prom[i].reg == 0xff)
2619			continue;
2620		rt2560_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
2621	}
2622#endif
2623
2624	return 0;
2625#undef N
2626}
2627
2628int
2629rt2560_init(struct ifnet *ifp)
2630{
2631#define N(a)	(sizeof (a) / sizeof ((a)[0]))
2632	struct rt2560_softc *sc = ifp->if_softc;
2633	struct ieee80211com *ic = &sc->sc_ic;
2634	uint32_t tmp;
2635	int i;
2636
2637	/* for CardBus, power on the socket */
2638	if (!(sc->sc_flags & RT2560_ENABLED)) {
2639		if (sc->sc_enable != NULL && (*sc->sc_enable)(sc) != 0) {
2640			printf("%s: could not enable device\n",
2641			    sc->sc_dev.dv_xname);
2642			return EIO;
2643		}
2644		sc->sc_flags |= RT2560_ENABLED;
2645	}
2646
2647	rt2560_stop(ifp, 0);
2648
2649	/* setup tx rings */
2650	tmp = RT2560_PRIO_RING_COUNT << 24 |
2651	      RT2560_ATIM_RING_COUNT << 16 |
2652	      RT2560_TX_RING_COUNT   <<  8 |
2653	      RT2560_TX_DESC_SIZE;
2654
2655	/* rings _must_ be initialized in this _exact_ order! */
2656	RAL_WRITE(sc, RT2560_TXCSR2, tmp);
2657	RAL_WRITE(sc, RT2560_TXCSR3, sc->txq.physaddr);
2658	RAL_WRITE(sc, RT2560_TXCSR5, sc->prioq.physaddr);
2659	RAL_WRITE(sc, RT2560_TXCSR4, sc->atimq.physaddr);
2660	RAL_WRITE(sc, RT2560_TXCSR6, sc->bcnq.physaddr);
2661
2662	/* setup rx ring */
2663	tmp = RT2560_RX_RING_COUNT << 8 | RT2560_RX_DESC_SIZE;
2664
2665	RAL_WRITE(sc, RT2560_RXCSR1, tmp);
2666	RAL_WRITE(sc, RT2560_RXCSR2, sc->rxq.physaddr);
2667
2668	/* initialize MAC registers to default values */
2669	for (i = 0; i < N(rt2560_def_mac); i++)
2670		RAL_WRITE(sc, rt2560_def_mac[i].reg, rt2560_def_mac[i].val);
2671
2672	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
2673	rt2560_set_macaddr(sc, ic->ic_myaddr);
2674
2675	/* set basic rate set (will be updated later) */
2676	RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x153);
2677
2678	rt2560_set_txantenna(sc, 1);
2679	rt2560_set_rxantenna(sc, 1);
2680	rt2560_update_slot(sc);
2681	rt2560_update_plcp(sc);
2682	rt2560_update_led(sc, 0, 0);
2683
2684	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
2685	RAL_WRITE(sc, RT2560_CSR1, RT2560_HOST_READY);
2686
2687	if (rt2560_bbp_init(sc) != 0) {
2688		rt2560_stop(ifp, 1);
2689		return EIO;
2690	}
2691
2692	/* set default BSS channel */
2693	ic->ic_bss->ni_chan = ic->ic_ibss_chan;
2694	rt2560_set_chan(sc, ic->ic_bss->ni_chan);
2695
2696	/* kick Rx */
2697	tmp = RT2560_DROP_PHY_ERROR | RT2560_DROP_CRC_ERROR;
2698	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2699		tmp |= RT2560_DROP_CTL | RT2560_DROP_VERSION_ERROR;
2700		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
2701			tmp |= RT2560_DROP_TODS;
2702		if (!(ifp->if_flags & IFF_PROMISC))
2703			tmp |= RT2560_DROP_NOT_TO_ME;
2704	}
2705	RAL_WRITE(sc, RT2560_RXCSR0, tmp);
2706
2707	/* clear old FCS and Rx FIFO errors */
2708	RAL_READ(sc, RT2560_CNT0);
2709	RAL_READ(sc, RT2560_CNT4);
2710
2711	/* clear any pending interrupts */
2712	RAL_WRITE(sc, RT2560_CSR7, 0xffffffff);
2713
2714	/* enable interrupts */
2715	RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
2716
2717	ifp->if_flags &= ~IFF_OACTIVE;
2718	ifp->if_flags |= IFF_RUNNING;
2719
2720	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2721		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2722	else
2723		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2724
2725	return 0;
2726#undef N
2727}
2728
2729void
2730rt2560_stop(struct ifnet *ifp, int disable)
2731{
2732	struct rt2560_softc *sc = ifp->if_softc;
2733	struct ieee80211com *ic = &sc->sc_ic;
2734
2735	sc->sc_tx_timer = 0;
2736	ifp->if_timer = 0;
2737	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2738
2739	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);	/* free all nodes */
2740
2741	/* abort Tx */
2742	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_ABORT_TX);
2743
2744	/* disable Rx */
2745	RAL_WRITE(sc, RT2560_RXCSR0, RT2560_DISABLE_RX);
2746
2747	/* reset ASIC (and thus, BBP) */
2748	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
2749	RAL_WRITE(sc, RT2560_CSR1, 0);
2750
2751	/* disable interrupts */
2752	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
2753
2754	/* clear any pending interrupt */
2755	RAL_WRITE(sc, RT2560_CSR7, 0xffffffff);
2756
2757	/* reset Tx and Rx rings */
2758	rt2560_reset_tx_ring(sc, &sc->txq);
2759	rt2560_reset_tx_ring(sc, &sc->atimq);
2760	rt2560_reset_tx_ring(sc, &sc->prioq);
2761	rt2560_reset_tx_ring(sc, &sc->bcnq);
2762	rt2560_reset_rx_ring(sc, &sc->rxq);
2763
2764	/* for CardBus, power down the socket */
2765	if (disable && sc->sc_disable != NULL) {
2766		if (sc->sc_flags & RT2560_ENABLED) {
2767			(*sc->sc_disable)(sc);
2768			sc->sc_flags &= ~RT2560_ENABLED;
2769		}
2770	}
2771}
2772
2773void
2774rt2560_power(int why, void *arg)
2775{
2776	struct rt2560_softc *sc = arg;
2777	struct ifnet *ifp = &sc->sc_ic.ic_if;
2778	int s;
2779
2780	DPRINTF(("%s: rt2560_power(%d)\n", sc->sc_dev.dv_xname, why));
2781
2782	s = splnet();
2783	switch (why) {
2784	case PWR_SUSPEND:
2785	case PWR_STANDBY:
2786		rt2560_stop(ifp, 1);
2787		if (sc->sc_power != NULL)
2788			(*sc->sc_power)(sc, why);
2789		break;
2790	case PWR_RESUME:
2791		if (ifp->if_flags & IFF_UP) {
2792			rt2560_init(ifp);
2793			if (sc->sc_power != NULL)
2794				(*sc->sc_power)(sc, why);
2795			if (ifp->if_flags & IFF_RUNNING)
2796				rt2560_start(ifp);
2797		}
2798		break;
2799	}
2800	splx(s);
2801}
2802
2803void
2804rt2560_shutdown(void *arg)
2805{
2806	struct rt2560_softc *sc = arg;
2807
2808	rt2560_stop(&sc->sc_ic.ic_if, 1);
2809}
2810
2811struct cfdriver ral_cd = {
2812	NULL, "ral", DV_IFNET
2813};
2814