rt2560.c revision 1.49
1/*	$OpenBSD: rt2560.c,v 1.49 2010/08/04 19:48:33 damien Exp $  */
2
3/*-
4 * Copyright (c) 2005, 2006
5 *	Damien Bergamini <damien.bergamini@free.fr>
6 *
7 * Permission to use, copy, modify, and distribute this software for any
8 * purpose with or without fee is hereby granted, provided that the above
9 * copyright notice and this permission notice appear in all copies.
10 *
11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18 */
19
20/*-
21 * Ralink Technology RT2560 chipset driver
22 * http://www.ralinktech.com/
23 */
24
25#include "bpfilter.h"
26
27#include <sys/param.h>
28#include <sys/sockio.h>
29#include <sys/mbuf.h>
30#include <sys/kernel.h>
31#include <sys/socket.h>
32#include <sys/systm.h>
33#include <sys/malloc.h>
34#include <sys/timeout.h>
35#include <sys/conf.h>
36#include <sys/device.h>
37
38#include <machine/bus.h>
39#include <machine/endian.h>
40#include <machine/intr.h>
41
42#if NBPFILTER > 0
43#include <net/bpf.h>
44#endif
45#include <net/if.h>
46#include <net/if_arp.h>
47#include <net/if_dl.h>
48#include <net/if_media.h>
49#include <net/if_types.h>
50
51#include <netinet/in.h>
52#include <netinet/in_systm.h>
53#include <netinet/in_var.h>
54#include <netinet/if_ether.h>
55#include <netinet/ip.h>
56
57#include <net80211/ieee80211_var.h>
58#include <net80211/ieee80211_amrr.h>
59#include <net80211/ieee80211_radiotap.h>
60
61#include <dev/ic/rt2560reg.h>
62#include <dev/ic/rt2560var.h>
63
64#include <dev/pci/pcireg.h>
65#include <dev/pci/pcivar.h>
66#include <dev/pci/pcidevs.h>
67
68#ifdef RAL_DEBUG
69#define DPRINTF(x)	do { if (rt2560_debug > 0) printf x; } while (0)
70#define DPRINTFN(n, x)	do { if (rt2560_debug >= (n)) printf x; } while (0)
71int rt2560_debug = 1;
72#else
73#define DPRINTF(x)
74#define DPRINTFN(n, x)
75#endif
76
77int		rt2560_alloc_tx_ring(struct rt2560_softc *,
78		    struct rt2560_tx_ring *, int);
79void		rt2560_reset_tx_ring(struct rt2560_softc *,
80		    struct rt2560_tx_ring *);
81void		rt2560_free_tx_ring(struct rt2560_softc *,
82		    struct rt2560_tx_ring *);
83int		rt2560_alloc_rx_ring(struct rt2560_softc *,
84		    struct rt2560_rx_ring *, int);
85void		rt2560_reset_rx_ring(struct rt2560_softc *,
86		    struct rt2560_rx_ring *);
87void		rt2560_free_rx_ring(struct rt2560_softc *,
88		    struct rt2560_rx_ring *);
89struct		ieee80211_node *rt2560_node_alloc(struct ieee80211com *);
90int		rt2560_media_change(struct ifnet *);
91void		rt2560_next_scan(void *);
92void		rt2560_iter_func(void *, struct ieee80211_node *);
93void		rt2560_amrr_timeout(void *);
94void		rt2560_newassoc(struct ieee80211com *, struct ieee80211_node *,
95		    int);
96int		rt2560_newstate(struct ieee80211com *, enum ieee80211_state,
97		    int);
98uint16_t	rt2560_eeprom_read(struct rt2560_softc *, uint8_t);
99void		rt2560_encryption_intr(struct rt2560_softc *);
100void		rt2560_tx_intr(struct rt2560_softc *);
101void		rt2560_prio_intr(struct rt2560_softc *);
102void		rt2560_decryption_intr(struct rt2560_softc *);
103void		rt2560_rx_intr(struct rt2560_softc *);
104#ifndef IEEE80211_STA_ONLY
105void		rt2560_beacon_expire(struct rt2560_softc *);
106#endif
107void		rt2560_wakeup_expire(struct rt2560_softc *);
108#if NBPFILTER > 0
109uint8_t		rt2560_rxrate(const struct rt2560_rx_desc *);
110#endif
111int		rt2560_ack_rate(struct ieee80211com *, int);
112uint16_t	rt2560_txtime(int, int, uint32_t);
113uint8_t		rt2560_plcp_signal(int);
114void		rt2560_setup_tx_desc(struct rt2560_softc *,
115		    struct rt2560_tx_desc *, uint32_t, int, int, int,
116		    bus_addr_t);
117#ifndef IEEE80211_STA_ONLY
118int		rt2560_tx_bcn(struct rt2560_softc *, struct mbuf *,
119		    struct ieee80211_node *);
120#endif
121int		rt2560_tx_mgt(struct rt2560_softc *, struct mbuf *,
122		    struct ieee80211_node *);
123int		rt2560_tx_data(struct rt2560_softc *, struct mbuf *,
124		    struct ieee80211_node *);
125void		rt2560_start(struct ifnet *);
126void		rt2560_watchdog(struct ifnet *);
127int		rt2560_ioctl(struct ifnet *, u_long, caddr_t);
128void		rt2560_bbp_write(struct rt2560_softc *, uint8_t, uint8_t);
129uint8_t		rt2560_bbp_read(struct rt2560_softc *, uint8_t);
130void		rt2560_rf_write(struct rt2560_softc *, uint8_t, uint32_t);
131void		rt2560_set_chan(struct rt2560_softc *,
132		    struct ieee80211_channel *);
133void		rt2560_disable_rf_tune(struct rt2560_softc *);
134void		rt2560_enable_tsf_sync(struct rt2560_softc *);
135void		rt2560_update_plcp(struct rt2560_softc *);
136void		rt2560_updateslot(struct ieee80211com *);
137void		rt2560_set_slottime(struct rt2560_softc *);
138void		rt2560_set_basicrates(struct rt2560_softc *);
139void		rt2560_update_led(struct rt2560_softc *, int, int);
140void		rt2560_set_bssid(struct rt2560_softc *, uint8_t *);
141void		rt2560_set_macaddr(struct rt2560_softc *, uint8_t *);
142void		rt2560_get_macaddr(struct rt2560_softc *, uint8_t *);
143void		rt2560_update_promisc(struct rt2560_softc *);
144void		rt2560_set_txantenna(struct rt2560_softc *, int);
145void		rt2560_set_rxantenna(struct rt2560_softc *, int);
146const char	*rt2560_get_rf(int);
147void		rt2560_read_eeprom(struct rt2560_softc *);
148int		rt2560_bbp_init(struct rt2560_softc *);
149int		rt2560_init(struct ifnet *);
150void		rt2560_stop(struct ifnet *, int);
151void		rt2560_power(int, void *);
152
153static const struct {
154	uint32_t	reg;
155	uint32_t	val;
156} rt2560_def_mac[] = {
157	RT2560_DEF_MAC
158};
159
160static const struct {
161	uint8_t	reg;
162	uint8_t	val;
163} rt2560_def_bbp[] = {
164	RT2560_DEF_BBP
165};
166
167static const uint32_t rt2560_rf2522_r2[]    = RT2560_RF2522_R2;
168static const uint32_t rt2560_rf2523_r2[]    = RT2560_RF2523_R2;
169static const uint32_t rt2560_rf2524_r2[]    = RT2560_RF2524_R2;
170static const uint32_t rt2560_rf2525_r2[]    = RT2560_RF2525_R2;
171static const uint32_t rt2560_rf2525_hi_r2[] = RT2560_RF2525_HI_R2;
172static const uint32_t rt2560_rf2525e_r2[]   = RT2560_RF2525E_R2;
173static const uint32_t rt2560_rf2526_r2[]    = RT2560_RF2526_R2;
174static const uint32_t rt2560_rf2526_hi_r2[] = RT2560_RF2526_HI_R2;
175
176int
177rt2560_attach(void *xsc, int id)
178{
179	struct rt2560_softc *sc = xsc;
180	struct ieee80211com *ic = &sc->sc_ic;
181	struct ifnet *ifp = &ic->ic_if;
182	int error, i;
183
184	sc->amrr.amrr_min_success_threshold =  1;
185	sc->amrr.amrr_max_success_threshold = 15;
186	timeout_set(&sc->amrr_to, rt2560_amrr_timeout, sc);
187	timeout_set(&sc->scan_to, rt2560_next_scan, sc);
188
189	/* retrieve RT2560 rev. no */
190	sc->asic_rev = RAL_READ(sc, RT2560_CSR0);
191
192	/* retrieve MAC address */
193	rt2560_get_macaddr(sc, ic->ic_myaddr);
194	printf(", address %s\n", ether_sprintf(ic->ic_myaddr));
195
196	/* retrieve RF rev. no and various other things from EEPROM */
197	rt2560_read_eeprom(sc);
198
199	printf("%s: MAC/BBP RT2560 (rev 0x%02x), RF %s\n", sc->sc_dev.dv_xname,
200	    sc->asic_rev, rt2560_get_rf(sc->rf_rev));
201
202	/*
203	 * Allocate Tx and Rx rings.
204	 */
205	error = rt2560_alloc_tx_ring(sc, &sc->txq, RT2560_TX_RING_COUNT);
206	if (error != 0) {
207		printf("%s: could not allocate Tx ring\n",
208		    sc->sc_dev.dv_xname);
209		goto fail1;
210	}
211	error = rt2560_alloc_tx_ring(sc, &sc->atimq, RT2560_ATIM_RING_COUNT);
212	if (error != 0) {
213		printf("%s: could not allocate ATIM ring\n",
214		    sc->sc_dev.dv_xname);
215		goto fail2;
216	}
217	error = rt2560_alloc_tx_ring(sc, &sc->prioq, RT2560_PRIO_RING_COUNT);
218	if (error != 0) {
219		printf("%s: could not allocate Prio ring\n",
220		    sc->sc_dev.dv_xname);
221		goto fail3;
222	}
223	error = rt2560_alloc_tx_ring(sc, &sc->bcnq, RT2560_BEACON_RING_COUNT);
224	if (error != 0) {
225		printf("%s: could not allocate Beacon ring\n",
226		    sc->sc_dev.dv_xname);
227		goto fail4;
228	}
229	error = rt2560_alloc_rx_ring(sc, &sc->rxq, RT2560_RX_RING_COUNT);
230	if (error != 0) {
231		printf("%s: could not allocate Rx ring\n",
232		    sc->sc_dev.dv_xname);
233		goto fail5;
234	}
235
236	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
237	ic->ic_opmode = IEEE80211_M_STA; /* default to BSS mode */
238	ic->ic_state = IEEE80211_S_INIT;
239
240	/* set device capabilities */
241	ic->ic_caps =
242	    IEEE80211_C_MONITOR |	/* monitor mode supported */
243#ifndef IEEE80211_STA_ONLY
244	    IEEE80211_C_IBSS |		/* IBSS mode supported */
245	    IEEE80211_C_HOSTAP |	/* HostAp mode supported */
246#endif
247	    IEEE80211_C_TXPMGT |	/* tx power management */
248	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
249	    IEEE80211_C_SHSLOT |	/* short slot time supported */
250	    IEEE80211_C_WEP |		/* s/w WEP */
251	    IEEE80211_C_RSN;		/* WPA/RSN */
252
253	/* set supported .11b and .11g rates */
254	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
255	ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g;
256
257	/* set supported .11b and .11g channels (1 through 14) */
258	for (i = 1; i <= 14; i++) {
259		ic->ic_channels[i].ic_freq =
260		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
261		ic->ic_channels[i].ic_flags =
262		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
263		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
264	}
265
266	ifp->if_softc = sc;
267	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
268	ifp->if_init = rt2560_init;
269	ifp->if_ioctl = rt2560_ioctl;
270	ifp->if_start = rt2560_start;
271	ifp->if_watchdog = rt2560_watchdog;
272	IFQ_SET_READY(&ifp->if_snd);
273	memcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
274
275	if_attach(ifp);
276	ieee80211_ifattach(ifp);
277	ic->ic_node_alloc = rt2560_node_alloc;
278	ic->ic_newassoc = rt2560_newassoc;
279	ic->ic_updateslot = rt2560_updateslot;
280
281	/* override state transition machine */
282	sc->sc_newstate = ic->ic_newstate;
283	ic->ic_newstate = rt2560_newstate;
284	ieee80211_media_init(ifp, rt2560_media_change, ieee80211_media_status);
285
286#if NBPFILTER > 0
287	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
288	    sizeof (struct ieee80211_frame) + 64);
289
290	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
291	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
292	sc->sc_rxtap.wr_ihdr.it_present = htole32(RT2560_RX_RADIOTAP_PRESENT);
293
294	sc->sc_txtap_len = sizeof sc->sc_txtapu;
295	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
296	sc->sc_txtap.wt_ihdr.it_present = htole32(RT2560_TX_RADIOTAP_PRESENT);
297#endif
298
299	sc->sc_powerhook = powerhook_establish(rt2560_power, sc);
300	if (sc->sc_powerhook == NULL) {
301		printf("%s: WARNING: unable to establish power hook\n",
302		    sc->sc_dev.dv_xname);
303	}
304	return 0;
305
306fail5:	rt2560_free_tx_ring(sc, &sc->bcnq);
307fail4:	rt2560_free_tx_ring(sc, &sc->prioq);
308fail3:	rt2560_free_tx_ring(sc, &sc->atimq);
309fail2:	rt2560_free_tx_ring(sc, &sc->txq);
310fail1:	return ENXIO;
311}
312
313int
314rt2560_detach(void *xsc)
315{
316	struct rt2560_softc *sc = xsc;
317	struct ifnet *ifp = &sc->sc_ic.ic_if;
318
319	timeout_del(&sc->scan_to);
320	timeout_del(&sc->amrr_to);
321
322	if (sc->sc_powerhook != NULL)
323		powerhook_disestablish(sc->sc_powerhook);
324
325	ieee80211_ifdetach(ifp);	/* free all nodes */
326	if_detach(ifp);
327
328	rt2560_free_tx_ring(sc, &sc->txq);
329	rt2560_free_tx_ring(sc, &sc->atimq);
330	rt2560_free_tx_ring(sc, &sc->prioq);
331	rt2560_free_tx_ring(sc, &sc->bcnq);
332	rt2560_free_rx_ring(sc, &sc->rxq);
333
334	return 0;
335}
336
337void
338rt2560_suspend(void *xsc)
339{
340	struct rt2560_softc *sc = xsc;
341	struct ifnet *ifp = &sc->sc_ic.ic_if;
342
343	if (ifp->if_flags & IFF_RUNNING)
344		rt2560_stop(ifp, 0);
345}
346
347void
348rt2560_resume(void *xsc)
349{
350	struct rt2560_softc *sc = xsc;
351
352	rt2560_power(PWR_RESUME, sc);
353}
354
355int
356rt2560_alloc_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring,
357    int count)
358{
359	int i, nsegs, error;
360
361	ring->count = count;
362	ring->queued = 0;
363	ring->cur = ring->next = 0;
364	ring->cur_encrypt = ring->next_encrypt = 0;
365
366	error = bus_dmamap_create(sc->sc_dmat, count * RT2560_TX_DESC_SIZE, 1,
367	    count * RT2560_TX_DESC_SIZE, 0, BUS_DMA_NOWAIT, &ring->map);
368	if (error != 0) {
369		printf("%s: could not create desc DMA map\n",
370		    sc->sc_dev.dv_xname);
371		goto fail;
372	}
373
374	error = bus_dmamem_alloc(sc->sc_dmat, count * RT2560_TX_DESC_SIZE,
375	    PAGE_SIZE, 0, &ring->seg, 1, &nsegs, BUS_DMA_NOWAIT | BUS_DMA_ZERO);
376	if (error != 0) {
377		printf("%s: could not allocate DMA memory\n",
378		    sc->sc_dev.dv_xname);
379		goto fail;
380	}
381
382	error = bus_dmamem_map(sc->sc_dmat, &ring->seg, nsegs,
383	    count * RT2560_TX_DESC_SIZE, (caddr_t *)&ring->desc,
384	    BUS_DMA_NOWAIT);
385	if (error != 0) {
386		printf("%s: can't map desc DMA memory\n",
387		    sc->sc_dev.dv_xname);
388		goto fail;
389	}
390
391	error = bus_dmamap_load(sc->sc_dmat, ring->map, ring->desc,
392	    count * RT2560_TX_DESC_SIZE, NULL, BUS_DMA_NOWAIT);
393	if (error != 0) {
394		printf("%s: could not load desc DMA map\n",
395		    sc->sc_dev.dv_xname);
396		goto fail;
397	}
398
399	ring->physaddr = ring->map->dm_segs->ds_addr;
400
401	ring->data = malloc(count * sizeof (struct rt2560_tx_data), M_DEVBUF,
402	    M_NOWAIT | M_ZERO);
403	if (ring->data == NULL) {
404		printf("%s: could not allocate soft data\n",
405		    sc->sc_dev.dv_xname);
406		error = ENOMEM;
407		goto fail;
408	}
409
410	for (i = 0; i < count; i++) {
411		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,
412		    RT2560_MAX_SCATTER, MCLBYTES, 0, BUS_DMA_NOWAIT,
413		    &ring->data[i].map);
414		if (error != 0) {
415			printf("%s: could not create DMA map\n",
416			    sc->sc_dev.dv_xname);
417			goto fail;
418		}
419	}
420
421	return 0;
422
423fail:	rt2560_free_tx_ring(sc, ring);
424	return error;
425}
426
427void
428rt2560_reset_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring)
429{
430	int i;
431
432	for (i = 0; i < ring->count; i++) {
433		struct rt2560_tx_desc *desc = &ring->desc[i];
434		struct rt2560_tx_data *data = &ring->data[i];
435
436		if (data->m != NULL) {
437			bus_dmamap_sync(sc->sc_dmat, data->map, 0,
438			    data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
439			bus_dmamap_unload(sc->sc_dmat, data->map);
440			m_freem(data->m);
441			data->m = NULL;
442		}
443
444		/*
445		 * The node has already been freed at that point so don't call
446		 * ieee80211_release_node() here.
447		 */
448		data->ni = NULL;
449
450		desc->flags = 0;
451	}
452
453	bus_dmamap_sync(sc->sc_dmat, ring->map, 0, ring->map->dm_mapsize,
454	    BUS_DMASYNC_PREWRITE);
455
456	ring->queued = 0;
457	ring->cur = ring->next = 0;
458	ring->cur_encrypt = ring->next_encrypt = 0;
459}
460
461void
462rt2560_free_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring)
463{
464	int i;
465
466	if (ring->desc != NULL) {
467		bus_dmamap_sync(sc->sc_dmat, ring->map, 0,
468		    ring->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
469		bus_dmamap_unload(sc->sc_dmat, ring->map);
470		bus_dmamem_unmap(sc->sc_dmat, (caddr_t)ring->desc,
471		    ring->count * RT2560_TX_DESC_SIZE);
472		bus_dmamem_free(sc->sc_dmat, &ring->seg, 1);
473	}
474
475	if (ring->data != NULL) {
476		for (i = 0; i < ring->count; i++) {
477			struct rt2560_tx_data *data = &ring->data[i];
478
479			if (data->m != NULL) {
480				bus_dmamap_sync(sc->sc_dmat, data->map, 0,
481				    data->map->dm_mapsize,
482				    BUS_DMASYNC_POSTWRITE);
483				bus_dmamap_unload(sc->sc_dmat, data->map);
484				m_freem(data->m);
485			}
486
487			/*
488			 * The node has already been freed at that point so
489			 * don't call ieee80211_release_node() here.
490			 */
491			data->ni = NULL;
492
493			if (data->map != NULL)
494				bus_dmamap_destroy(sc->sc_dmat, data->map);
495		}
496		free(ring->data, M_DEVBUF);
497	}
498}
499
500int
501rt2560_alloc_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring,
502    int count)
503{
504	int i, nsegs, error;
505
506	ring->count = count;
507	ring->cur = ring->next = 0;
508	ring->cur_decrypt = 0;
509
510	error = bus_dmamap_create(sc->sc_dmat, count * RT2560_RX_DESC_SIZE, 1,
511	    count * RT2560_RX_DESC_SIZE, 0, BUS_DMA_NOWAIT, &ring->map);
512	if (error != 0) {
513		printf("%s: could not create desc DMA map\n",
514		    sc->sc_dev.dv_xname);
515		goto fail;
516	}
517
518	error = bus_dmamem_alloc(sc->sc_dmat, count * RT2560_RX_DESC_SIZE,
519	    PAGE_SIZE, 0, &ring->seg, 1, &nsegs, BUS_DMA_NOWAIT | BUS_DMA_ZERO);
520	if (error != 0) {
521		printf("%s: could not allocate DMA memory\n",
522		    sc->sc_dev.dv_xname);
523		goto fail;
524	}
525
526	error = bus_dmamem_map(sc->sc_dmat, &ring->seg, nsegs,
527	    count * RT2560_RX_DESC_SIZE, (caddr_t *)&ring->desc,
528	    BUS_DMA_NOWAIT);
529	if (error != 0) {
530		printf("%s: can't map desc DMA memory\n",
531		    sc->sc_dev.dv_xname);
532		goto fail;
533	}
534
535	error = bus_dmamap_load(sc->sc_dmat, ring->map, ring->desc,
536	    count * RT2560_RX_DESC_SIZE, NULL, BUS_DMA_NOWAIT);
537	if (error != 0) {
538		printf("%s: could not load desc DMA map\n",
539		    sc->sc_dev.dv_xname);
540		goto fail;
541	}
542
543	ring->physaddr = ring->map->dm_segs->ds_addr;
544
545	ring->data = malloc(count * sizeof (struct rt2560_rx_data), M_DEVBUF,
546	    M_NOWAIT | M_ZERO);
547	if (ring->data == NULL) {
548		printf("%s: could not allocate soft data\n",
549		    sc->sc_dev.dv_xname);
550		error = ENOMEM;
551		goto fail;
552	}
553
554	/*
555	 * Pre-allocate Rx buffers and populate Rx ring.
556	 */
557	for (i = 0; i < count; i++) {
558		struct rt2560_rx_desc *desc = &sc->rxq.desc[i];
559		struct rt2560_rx_data *data = &sc->rxq.data[i];
560
561		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
562		    0, BUS_DMA_NOWAIT, &data->map);
563		if (error != 0) {
564			printf("%s: could not create DMA map\n",
565			    sc->sc_dev.dv_xname);
566			goto fail;
567		}
568
569		MGETHDR(data->m, M_DONTWAIT, MT_DATA);
570		if (data->m == NULL) {
571			printf("%s: could not allocate rx mbuf\n",
572			    sc->sc_dev.dv_xname);
573			error = ENOMEM;
574			goto fail;
575		}
576		MCLGET(data->m, M_DONTWAIT);
577		if (!(data->m->m_flags & M_EXT)) {
578			printf("%s: could not allocate rx mbuf cluster\n",
579			    sc->sc_dev.dv_xname);
580			error = ENOMEM;
581			goto fail;
582		}
583
584		error = bus_dmamap_load(sc->sc_dmat, data->map,
585		    mtod(data->m, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
586		if (error != 0) {
587			printf("%s: could not load rx buf DMA map",
588			    sc->sc_dev.dv_xname);
589			goto fail;
590		}
591
592		desc->flags = htole32(RT2560_RX_BUSY);
593		desc->physaddr = htole32(data->map->dm_segs->ds_addr);
594	}
595
596	bus_dmamap_sync(sc->sc_dmat, ring->map, 0, ring->map->dm_mapsize,
597	    BUS_DMASYNC_PREWRITE);
598
599	return 0;
600
601fail:	rt2560_free_rx_ring(sc, ring);
602	return error;
603}
604
605void
606rt2560_reset_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring)
607{
608	int i;
609
610	for (i = 0; i < ring->count; i++) {
611		ring->desc[i].flags = htole32(RT2560_RX_BUSY);
612		ring->data[i].drop = 0;
613	}
614
615	bus_dmamap_sync(sc->sc_dmat, ring->map, 0, ring->map->dm_mapsize,
616	    BUS_DMASYNC_PREWRITE);
617
618	ring->cur = ring->next = 0;
619	ring->cur_decrypt = 0;
620}
621
622void
623rt2560_free_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring)
624{
625	int i;
626
627	if (ring->desc != NULL) {
628		bus_dmamap_sync(sc->sc_dmat, ring->map, 0,
629		    ring->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
630		bus_dmamap_unload(sc->sc_dmat, ring->map);
631		bus_dmamem_unmap(sc->sc_dmat, (caddr_t)ring->desc,
632		    ring->count * RT2560_RX_DESC_SIZE);
633		bus_dmamem_free(sc->sc_dmat, &ring->seg, 1);
634	}
635
636	if (ring->data != NULL) {
637		for (i = 0; i < ring->count; i++) {
638			struct rt2560_rx_data *data = &ring->data[i];
639
640			if (data->m != NULL) {
641				bus_dmamap_sync(sc->sc_dmat, data->map, 0,
642				    data->map->dm_mapsize,
643				    BUS_DMASYNC_POSTREAD);
644				bus_dmamap_unload(sc->sc_dmat, data->map);
645				m_freem(data->m);
646			}
647
648			if (data->map != NULL)
649				bus_dmamap_destroy(sc->sc_dmat, data->map);
650		}
651		free(ring->data, M_DEVBUF);
652	}
653}
654
655struct ieee80211_node *
656rt2560_node_alloc(struct ieee80211com *ic)
657{
658	return malloc(sizeof (struct rt2560_node), M_DEVBUF,
659	    M_NOWAIT | M_ZERO);
660}
661
662int
663rt2560_media_change(struct ifnet *ifp)
664{
665	int error;
666
667	error = ieee80211_media_change(ifp);
668	if (error != ENETRESET)
669		return error;
670
671	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
672		rt2560_init(ifp);
673
674	return 0;
675}
676
677/*
678 * This function is called periodically (every 200ms) during scanning to
679 * switch from one channel to another.
680 */
681void
682rt2560_next_scan(void *arg)
683{
684	struct rt2560_softc *sc = arg;
685	struct ieee80211com *ic = &sc->sc_ic;
686	struct ifnet *ifp = &ic->ic_if;
687	int s;
688
689	s = splnet();
690	if (ic->ic_state == IEEE80211_S_SCAN)
691		ieee80211_next_scan(ifp);
692	splx(s);
693}
694
695/*
696 * This function is called for each neighbor node.
697 */
698void
699rt2560_iter_func(void *arg, struct ieee80211_node *ni)
700{
701	struct rt2560_softc *sc = arg;
702	struct rt2560_node *rn = (struct rt2560_node *)ni;
703
704	ieee80211_amrr_choose(&sc->amrr, ni, &rn->amn);
705}
706
707void
708rt2560_amrr_timeout(void *arg)
709{
710	struct rt2560_softc *sc = arg;
711	struct ieee80211com *ic = &sc->sc_ic;
712	int s;
713
714	s = splnet();
715	if (ic->ic_opmode == IEEE80211_M_STA)
716		rt2560_iter_func(sc, ic->ic_bss);
717#ifndef IEEE80211_STA_ONLY
718	else
719		ieee80211_iterate_nodes(ic, rt2560_iter_func, sc);
720#endif
721	splx(s);
722
723	timeout_add_msec(&sc->amrr_to, 500);
724}
725
726void
727rt2560_newassoc(struct ieee80211com *ic, struct ieee80211_node *ni, int isnew)
728{
729	struct rt2560_softc *sc = ic->ic_softc;
730	int i;
731
732	ieee80211_amrr_node_init(&sc->amrr, &((struct rt2560_node *)ni)->amn);
733
734	/* set rate to some reasonable initial value */
735	for (i = ni->ni_rates.rs_nrates - 1;
736	     i > 0 && (ni->ni_rates.rs_rates[i] & IEEE80211_RATE_VAL) > 72;
737	     i--);
738	ni->ni_txrate = i;
739}
740
741int
742rt2560_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
743{
744	struct rt2560_softc *sc = ic->ic_if.if_softc;
745	enum ieee80211_state ostate;
746	struct ieee80211_node *ni;
747	int error = 0;
748
749	ostate = ic->ic_state;
750	timeout_del(&sc->scan_to);
751	timeout_del(&sc->amrr_to);
752
753	switch (nstate) {
754	case IEEE80211_S_INIT:
755		if (ostate == IEEE80211_S_RUN) {
756			/* abort TSF synchronization */
757			RAL_WRITE(sc, RT2560_CSR14, 0);
758
759			/* turn association led off */
760			rt2560_update_led(sc, 0, 0);
761		}
762		break;
763
764	case IEEE80211_S_SCAN:
765		rt2560_set_chan(sc, ic->ic_bss->ni_chan);
766		timeout_add_msec(&sc->scan_to, 200);
767		break;
768
769	case IEEE80211_S_AUTH:
770		rt2560_set_chan(sc, ic->ic_bss->ni_chan);
771		break;
772
773	case IEEE80211_S_ASSOC:
774		rt2560_set_chan(sc, ic->ic_bss->ni_chan);
775		break;
776
777	case IEEE80211_S_RUN:
778		rt2560_set_chan(sc, ic->ic_bss->ni_chan);
779
780		ni = ic->ic_bss;
781
782		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
783			rt2560_update_plcp(sc);
784			rt2560_set_slottime(sc);
785			rt2560_set_basicrates(sc);
786			rt2560_set_bssid(sc, ni->ni_bssid);
787		}
788
789#ifndef IEEE80211_STA_ONLY
790		if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
791		    ic->ic_opmode == IEEE80211_M_IBSS) {
792			struct mbuf *m = ieee80211_beacon_alloc(ic, ni);
793			if (m == NULL) {
794				printf("%s: could not allocate beacon\n",
795				    sc->sc_dev.dv_xname);
796				error = ENOBUFS;
797				break;
798			}
799
800			error = rt2560_tx_bcn(sc, m, ni);
801			if (error != 0)
802				break;
803		}
804#endif
805
806		/* turn assocation led on */
807		rt2560_update_led(sc, 1, 0);
808
809		if (ic->ic_opmode == IEEE80211_M_STA) {
810			/* fake a join to init the tx rate */
811			rt2560_newassoc(ic, ni, 1);
812		}
813
814		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
815			/* start automatic rate control timer */
816			if (ic->ic_fixed_rate == -1)
817				timeout_add_msec(&sc->amrr_to, 500);
818
819			rt2560_enable_tsf_sync(sc);
820		}
821		break;
822	}
823
824	return (error != 0) ? error : sc->sc_newstate(ic, nstate, arg);
825}
826
827/*
828 * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46 or
829 * 93C66).
830 */
831uint16_t
832rt2560_eeprom_read(struct rt2560_softc *sc, uint8_t addr)
833{
834	uint32_t tmp;
835	uint16_t val;
836	int n;
837
838	/* clock C once before the first command */
839	RT2560_EEPROM_CTL(sc, 0);
840
841	RT2560_EEPROM_CTL(sc, RT2560_S);
842	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
843	RT2560_EEPROM_CTL(sc, RT2560_S);
844
845	/* write start bit (1) */
846	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D);
847	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D | RT2560_C);
848
849	/* write READ opcode (10) */
850	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D);
851	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D | RT2560_C);
852	RT2560_EEPROM_CTL(sc, RT2560_S);
853	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
854
855	/* write address (A5-A0 or A7-A0) */
856	n = (RAL_READ(sc, RT2560_CSR21) & RT2560_93C46) ? 5 : 7;
857	for (; n >= 0; n--) {
858		RT2560_EEPROM_CTL(sc, RT2560_S |
859		    (((addr >> n) & 1) << RT2560_SHIFT_D));
860		RT2560_EEPROM_CTL(sc, RT2560_S |
861		    (((addr >> n) & 1) << RT2560_SHIFT_D) | RT2560_C);
862	}
863
864	RT2560_EEPROM_CTL(sc, RT2560_S);
865
866	/* read data Q15-Q0 */
867	val = 0;
868	for (n = 15; n >= 0; n--) {
869		RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
870		tmp = RAL_READ(sc, RT2560_CSR21);
871		val |= ((tmp & RT2560_Q) >> RT2560_SHIFT_Q) << n;
872		RT2560_EEPROM_CTL(sc, RT2560_S);
873	}
874
875	RT2560_EEPROM_CTL(sc, 0);
876
877	/* clear Chip Select and clock C */
878	RT2560_EEPROM_CTL(sc, RT2560_S);
879	RT2560_EEPROM_CTL(sc, 0);
880	RT2560_EEPROM_CTL(sc, RT2560_C);
881
882	return val;
883}
884
885/*
886 * Some frames were processed by the hardware cipher engine and are ready for
887 * transmission.
888 */
889void
890rt2560_encryption_intr(struct rt2560_softc *sc)
891{
892	int hw;
893
894	/* retrieve last descriptor index processed by cipher engine */
895	hw = (RAL_READ(sc, RT2560_SECCSR1) - sc->txq.physaddr) /
896	    RT2560_TX_DESC_SIZE;
897
898	for (; sc->txq.next_encrypt != hw;) {
899		struct rt2560_tx_desc *desc =
900		    &sc->txq.desc[sc->txq.next_encrypt];
901
902		bus_dmamap_sync(sc->sc_dmat, sc->txq.map,
903		    sc->txq.next_encrypt * RT2560_TX_DESC_SIZE,
904		    RT2560_TX_DESC_SIZE, BUS_DMASYNC_POSTREAD);
905
906		if (letoh32(desc->flags) &
907		    (RT2560_TX_BUSY | RT2560_TX_CIPHER_BUSY))
908			break;
909
910		/* for TKIP, swap eiv field to fix a bug in ASIC */
911		if ((letoh32(desc->flags) & RT2560_TX_CIPHER_MASK) ==
912		    RT2560_TX_CIPHER_TKIP)
913			desc->eiv = swap32(desc->eiv);
914
915		/* mark the frame ready for transmission */
916		desc->flags |= htole32(RT2560_TX_BUSY | RT2560_TX_VALID);
917
918		bus_dmamap_sync(sc->sc_dmat, sc->txq.map,
919		    sc->txq.next_encrypt * RT2560_TX_DESC_SIZE,
920		    RT2560_TX_DESC_SIZE, BUS_DMASYNC_PREWRITE);
921
922		DPRINTFN(15, ("encryption done idx=%u\n",
923		    sc->txq.next_encrypt));
924
925		sc->txq.next_encrypt =
926		    (sc->txq.next_encrypt + 1) % RT2560_TX_RING_COUNT;
927	}
928
929	/* kick Tx */
930	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_TX);
931}
932
933void
934rt2560_tx_intr(struct rt2560_softc *sc)
935{
936	struct ieee80211com *ic = &sc->sc_ic;
937	struct ifnet *ifp = &ic->ic_if;
938
939	for (;;) {
940		struct rt2560_tx_desc *desc = &sc->txq.desc[sc->txq.next];
941		struct rt2560_tx_data *data = &sc->txq.data[sc->txq.next];
942		struct rt2560_node *rn;
943
944		bus_dmamap_sync(sc->sc_dmat, sc->txq.map,
945		    sc->txq.next * RT2560_TX_DESC_SIZE, RT2560_TX_DESC_SIZE,
946		    BUS_DMASYNC_POSTREAD);
947
948		if ((letoh32(desc->flags) & RT2560_TX_BUSY) ||
949		    (letoh32(desc->flags) & RT2560_TX_CIPHER_BUSY) ||
950		    !(letoh32(desc->flags) & RT2560_TX_VALID))
951			break;
952
953		rn = (struct rt2560_node *)data->ni;
954
955		switch (letoh32(desc->flags) & RT2560_TX_RESULT_MASK) {
956		case RT2560_TX_SUCCESS:
957			DPRINTFN(10, ("data frame sent successfully\n"));
958			rn->amn.amn_txcnt++;
959			ifp->if_opackets++;
960			break;
961
962		case RT2560_TX_SUCCESS_RETRY:
963			DPRINTFN(9, ("data frame sent after %u retries\n",
964			    (letoh32(desc->flags) >> 5) & 0x7));
965			rn->amn.amn_txcnt++;
966			rn->amn.amn_retrycnt++;
967			ifp->if_opackets++;
968			break;
969
970		case RT2560_TX_FAIL_RETRY:
971			DPRINTFN(9, ("sending data frame failed (too much "
972			    "retries)\n"));
973			rn->amn.amn_txcnt++;
974			rn->amn.amn_retrycnt++;
975			ifp->if_oerrors++;
976			break;
977
978		case RT2560_TX_FAIL_INVALID:
979		case RT2560_TX_FAIL_OTHER:
980		default:
981			printf("%s: sending data frame failed 0x%08x\n",
982			    sc->sc_dev.dv_xname, letoh32(desc->flags));
983			ifp->if_oerrors++;
984		}
985
986		bus_dmamap_sync(sc->sc_dmat, data->map, 0,
987		    data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
988		bus_dmamap_unload(sc->sc_dmat, data->map);
989		m_freem(data->m);
990		data->m = NULL;
991		ieee80211_release_node(ic, data->ni);
992		data->ni = NULL;
993
994		/* descriptor is no longer valid */
995		desc->flags &= ~htole32(RT2560_TX_VALID);
996
997		bus_dmamap_sync(sc->sc_dmat, sc->txq.map,
998		    sc->txq.next * RT2560_TX_DESC_SIZE, RT2560_TX_DESC_SIZE,
999		    BUS_DMASYNC_PREWRITE);
1000
1001		DPRINTFN(15, ("tx done idx=%u\n", sc->txq.next));
1002
1003		sc->txq.queued--;
1004		sc->txq.next = (sc->txq.next + 1) % RT2560_TX_RING_COUNT;
1005	}
1006
1007	sc->sc_tx_timer = 0;
1008	ifp->if_flags &= ~IFF_OACTIVE;
1009	rt2560_start(ifp);
1010}
1011
1012void
1013rt2560_prio_intr(struct rt2560_softc *sc)
1014{
1015	struct ieee80211com *ic = &sc->sc_ic;
1016	struct ifnet *ifp = &ic->ic_if;
1017
1018	for (;;) {
1019		struct rt2560_tx_desc *desc = &sc->prioq.desc[sc->prioq.next];
1020		struct rt2560_tx_data *data = &sc->prioq.data[sc->prioq.next];
1021
1022		bus_dmamap_sync(sc->sc_dmat, sc->prioq.map,
1023		    sc->prioq.next * RT2560_TX_DESC_SIZE, RT2560_TX_DESC_SIZE,
1024		    BUS_DMASYNC_POSTREAD);
1025
1026		if ((letoh32(desc->flags) & RT2560_TX_BUSY) ||
1027		    !(letoh32(desc->flags) & RT2560_TX_VALID))
1028			break;
1029
1030		switch (letoh32(desc->flags) & RT2560_TX_RESULT_MASK) {
1031		case RT2560_TX_SUCCESS:
1032			DPRINTFN(10, ("mgt frame sent successfully\n"));
1033			break;
1034
1035		case RT2560_TX_SUCCESS_RETRY:
1036			DPRINTFN(9, ("mgt frame sent after %u retries\n",
1037			    (letoh32(desc->flags) >> 5) & 0x7));
1038			break;
1039
1040		case RT2560_TX_FAIL_RETRY:
1041			DPRINTFN(9, ("sending mgt frame failed (too much "
1042			    "retries)\n"));
1043			break;
1044
1045		case RT2560_TX_FAIL_INVALID:
1046		case RT2560_TX_FAIL_OTHER:
1047		default:
1048			printf("%s: sending mgt frame failed 0x%08x\n",
1049			    sc->sc_dev.dv_xname, letoh32(desc->flags));
1050		}
1051
1052		bus_dmamap_sync(sc->sc_dmat, data->map, 0,
1053		    data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
1054		bus_dmamap_unload(sc->sc_dmat, data->map);
1055		m_freem(data->m);
1056		data->m = NULL;
1057		ieee80211_release_node(ic, data->ni);
1058		data->ni = NULL;
1059
1060		/* descriptor is no longer valid */
1061		desc->flags &= ~htole32(RT2560_TX_VALID);
1062
1063		bus_dmamap_sync(sc->sc_dmat, sc->prioq.map,
1064		    sc->prioq.next * RT2560_TX_DESC_SIZE, RT2560_TX_DESC_SIZE,
1065		    BUS_DMASYNC_PREWRITE);
1066
1067		DPRINTFN(15, ("prio done idx=%u\n", sc->prioq.next));
1068
1069		sc->prioq.queued--;
1070		sc->prioq.next = (sc->prioq.next + 1) % RT2560_PRIO_RING_COUNT;
1071	}
1072
1073	sc->sc_tx_timer = 0;
1074	ifp->if_flags &= ~IFF_OACTIVE;
1075	rt2560_start(ifp);
1076}
1077
1078/*
1079 * Some frames were processed by the hardware cipher engine and are ready for
1080 * transmission to the IEEE802.11 layer.
1081 */
1082void
1083rt2560_decryption_intr(struct rt2560_softc *sc)
1084{
1085	struct ieee80211com *ic = &sc->sc_ic;
1086	struct ifnet *ifp = &ic->ic_if;
1087	struct ieee80211_frame *wh;
1088	struct ieee80211_rxinfo rxi;
1089	struct ieee80211_node *ni;
1090	struct mbuf *mnew, *m;
1091	int hw, error;
1092
1093	/* retrieve last decriptor index processed by cipher engine */
1094	hw = (RAL_READ(sc, RT2560_SECCSR0) - sc->rxq.physaddr) /
1095	    RT2560_RX_DESC_SIZE;
1096
1097	for (; sc->rxq.cur_decrypt != hw;) {
1098		struct rt2560_rx_desc *desc =
1099		    &sc->rxq.desc[sc->rxq.cur_decrypt];
1100		struct rt2560_rx_data *data =
1101		    &sc->rxq.data[sc->rxq.cur_decrypt];
1102
1103		bus_dmamap_sync(sc->sc_dmat, sc->rxq.map,
1104		    sc->rxq.cur_decrypt * RT2560_TX_DESC_SIZE,
1105		    RT2560_TX_DESC_SIZE, BUS_DMASYNC_POSTREAD);
1106
1107		if (letoh32(desc->flags) &
1108		    (RT2560_RX_BUSY | RT2560_RX_CIPHER_BUSY))
1109			break;
1110
1111		if (data->drop) {
1112			ifp->if_ierrors++;
1113			goto skip;
1114		}
1115
1116		if ((letoh32(desc->flags) & RT2560_RX_CIPHER_MASK) != 0 &&
1117		    (letoh32(desc->flags) & RT2560_RX_ICV_ERROR)) {
1118			ifp->if_ierrors++;
1119			goto skip;
1120		}
1121
1122		/*
1123		 * Try to allocate a new mbuf for this ring element and load it
1124		 * before processing the current mbuf.  If the ring element
1125		 * cannot be loaded, drop the received packet and reuse the old
1126		 * mbuf.  In the unlikely case that the old mbuf can't be
1127		 * reloaded either, explicitly panic.
1128		 */
1129		MGETHDR(mnew, M_DONTWAIT, MT_DATA);
1130		if (mnew == NULL) {
1131			ifp->if_ierrors++;
1132			goto skip;
1133		}
1134		MCLGET(mnew, M_DONTWAIT);
1135		if (!(mnew->m_flags & M_EXT)) {
1136			m_freem(mnew);
1137			ifp->if_ierrors++;
1138			goto skip;
1139		}
1140
1141		bus_dmamap_sync(sc->sc_dmat, data->map, 0,
1142		    data->map->dm_mapsize, BUS_DMASYNC_POSTREAD);
1143		bus_dmamap_unload(sc->sc_dmat, data->map);
1144
1145		error = bus_dmamap_load(sc->sc_dmat, data->map,
1146		    mtod(mnew, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
1147		if (error != 0) {
1148			m_freem(mnew);
1149
1150			/* try to reload the old mbuf */
1151			error = bus_dmamap_load(sc->sc_dmat, data->map,
1152			    mtod(data->m, void *), MCLBYTES, NULL,
1153			    BUS_DMA_NOWAIT);
1154			if (error != 0) {
1155				/* very unlikely that it will fail... */
1156				panic("%s: could not load old rx mbuf",
1157				    sc->sc_dev.dv_xname);
1158			}
1159			/* physical address may have changed */
1160			desc->physaddr = htole32(data->map->dm_segs->ds_addr);
1161			ifp->if_ierrors++;
1162			goto skip;
1163		}
1164
1165		/*
1166		 * New mbuf successfully loaded, update Rx ring and continue
1167		 * processing.
1168		 */
1169		m = data->m;
1170		data->m = mnew;
1171		desc->physaddr = htole32(data->map->dm_segs->ds_addr);
1172
1173		/* finalize mbuf */
1174		m->m_pkthdr.rcvif = ifp;
1175		m->m_pkthdr.len = m->m_len =
1176		    (letoh32(desc->flags) >> 16) & 0xfff;
1177
1178#if NBPFILTER > 0
1179		if (sc->sc_drvbpf != NULL) {
1180			struct mbuf mb;
1181			struct rt2560_rx_radiotap_header *tap = &sc->sc_rxtap;
1182			uint32_t tsf_lo, tsf_hi;
1183
1184			/* get timestamp (low and high 32 bits) */
1185			tsf_hi = RAL_READ(sc, RT2560_CSR17);
1186			tsf_lo = RAL_READ(sc, RT2560_CSR16);
1187
1188			tap->wr_tsf =
1189			    htole64(((uint64_t)tsf_hi << 32) | tsf_lo);
1190			tap->wr_flags = 0;
1191			tap->wr_rate = rt2560_rxrate(desc);
1192			tap->wr_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
1193			tap->wr_chan_flags =
1194			    htole16(ic->ic_ibss_chan->ic_flags);
1195			tap->wr_antenna = sc->rx_ant;
1196			tap->wr_antsignal = desc->rssi;
1197
1198			mb.m_data = (caddr_t)tap;
1199			mb.m_len = sc->sc_txtap_len;
1200			mb.m_next = m;
1201			mb.m_nextpkt = NULL;
1202			mb.m_type = 0;
1203			mb.m_flags = 0;
1204			bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
1205		}
1206#endif
1207		wh = mtod(m, struct ieee80211_frame *);
1208		ni = ieee80211_find_rxnode(ic, wh);
1209
1210		/* send the frame to the 802.11 layer */
1211		rxi.rxi_flags = 0;
1212		rxi.rxi_rssi = desc->rssi;
1213		rxi.rxi_tstamp = 0;	/* unused */
1214		ieee80211_input(ifp, m, ni, &rxi);
1215
1216		/* node is no longer needed */
1217		ieee80211_release_node(ic, ni);
1218
1219skip:		desc->flags = htole32(RT2560_RX_BUSY);
1220
1221		bus_dmamap_sync(sc->sc_dmat, sc->rxq.map,
1222		    sc->rxq.cur_decrypt * RT2560_TX_DESC_SIZE,
1223		    RT2560_TX_DESC_SIZE, BUS_DMASYNC_PREWRITE);
1224
1225		DPRINTFN(15, ("decryption done idx=%u\n", sc->rxq.cur_decrypt));
1226
1227		sc->rxq.cur_decrypt =
1228		    (sc->rxq.cur_decrypt + 1) % RT2560_RX_RING_COUNT;
1229	}
1230}
1231
1232/*
1233 * Some frames were received. Pass them to the hardware cipher engine before
1234 * sending them to the 802.11 layer.
1235 */
1236void
1237rt2560_rx_intr(struct rt2560_softc *sc)
1238{
1239	for (;;) {
1240		struct rt2560_rx_desc *desc = &sc->rxq.desc[sc->rxq.cur];
1241		struct rt2560_rx_data *data = &sc->rxq.data[sc->rxq.cur];
1242
1243		bus_dmamap_sync(sc->sc_dmat, sc->rxq.map,
1244		    sc->rxq.cur * RT2560_RX_DESC_SIZE, RT2560_RX_DESC_SIZE,
1245		    BUS_DMASYNC_POSTREAD);
1246
1247		if (letoh32(desc->flags) &
1248		    (RT2560_RX_BUSY | RT2560_RX_CIPHER_BUSY))
1249			break;
1250
1251		data->drop = 0;
1252
1253		if (letoh32(desc->flags) &
1254		    (RT2560_RX_PHY_ERROR | RT2560_RX_CRC_ERROR)) {
1255			/*
1256			 * This should not happen since we did not request
1257			 * to receive those frames when we filled RXCSR0.
1258			 */
1259			DPRINTFN(5, ("PHY or CRC error flags 0x%08x\n",
1260			    letoh32(desc->flags)));
1261			data->drop = 1;
1262		}
1263
1264		if (((letoh32(desc->flags) >> 16) & 0xfff) > MCLBYTES) {
1265			DPRINTFN(5, ("bad length\n"));
1266			data->drop = 1;
1267		}
1268
1269		/* mark the frame for decryption */
1270		desc->flags |= htole32(RT2560_RX_CIPHER_BUSY);
1271
1272		bus_dmamap_sync(sc->sc_dmat, sc->rxq.map,
1273		    sc->rxq.cur * RT2560_RX_DESC_SIZE, RT2560_RX_DESC_SIZE,
1274		    BUS_DMASYNC_PREWRITE);
1275
1276		DPRINTFN(15, ("rx done idx=%u\n", sc->rxq.cur));
1277
1278		sc->rxq.cur = (sc->rxq.cur + 1) % RT2560_RX_RING_COUNT;
1279	}
1280
1281	/* kick decrypt */
1282	RAL_WRITE(sc, RT2560_SECCSR0, RT2560_KICK_DECRYPT);
1283}
1284
1285#ifndef IEEE80211_STA_ONLY
1286/*
1287 * This function is called in HostAP or IBSS modes when it's time to send a
1288 * new beacon (every ni_intval milliseconds).
1289 */
1290void
1291rt2560_beacon_expire(struct rt2560_softc *sc)
1292{
1293	struct ieee80211com *ic = &sc->sc_ic;
1294	struct rt2560_tx_data *data;
1295
1296	if (ic->ic_opmode != IEEE80211_M_IBSS &&
1297	    ic->ic_opmode != IEEE80211_M_HOSTAP)
1298		return;
1299
1300	data = &sc->bcnq.data[sc->bcnq.next];
1301
1302	if (sc->sc_flags & RT2560_UPDATE_SLOT) {
1303		sc->sc_flags &= ~RT2560_UPDATE_SLOT;
1304		sc->sc_flags |= RT2560_SET_SLOTTIME;
1305	} else if (sc->sc_flags & RT2560_SET_SLOTTIME) {
1306		sc->sc_flags &= ~RT2560_SET_SLOTTIME;
1307		rt2560_set_slottime(sc);
1308	}
1309
1310	if (ic->ic_curmode == IEEE80211_MODE_11G) {
1311		/* update ERP Information Element */
1312		*sc->erp = ic->ic_bss->ni_erp;
1313		bus_dmamap_sync(sc->sc_dmat, data->map, 0,
1314		    data->map->dm_mapsize, BUS_DMASYNC_PREWRITE);
1315	}
1316
1317#if defined(RT2560_DEBUG) && NBPFILTER > 0
1318	if (ic->ic_rawbpf != NULL)
1319		bpf_mtap(ic->ic_rawbpf, data->m, BPF_DIRECTION_OUT);
1320#endif
1321
1322	DPRINTFN(15, ("beacon expired\n"));
1323}
1324#endif
1325
1326void
1327rt2560_wakeup_expire(struct rt2560_softc *sc)
1328{
1329	DPRINTFN(15, ("wakeup expired\n"));
1330}
1331
1332int
1333rt2560_intr(void *arg)
1334{
1335	struct rt2560_softc *sc = arg;
1336	struct ifnet *ifp = &sc->sc_ic.ic_if;
1337	uint32_t r;
1338
1339	if ((r = RAL_READ(sc, RT2560_CSR7)) == 0)
1340		return 0;	/* not for us */
1341
1342	/* disable interrupts */
1343	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
1344
1345	/* acknowledge interrupts */
1346	RAL_WRITE(sc, RT2560_CSR7, r);
1347
1348	/* don't re-enable interrupts if we're shutting down */
1349	if (!(ifp->if_flags & IFF_RUNNING))
1350		return 0;
1351
1352#ifndef IEEE80211_STA_ONLY
1353	if (r & RT2560_BEACON_EXPIRE)
1354		rt2560_beacon_expire(sc);
1355#endif
1356
1357	if (r & RT2560_WAKEUP_EXPIRE)
1358		rt2560_wakeup_expire(sc);
1359
1360	if (r & RT2560_ENCRYPTION_DONE)
1361		rt2560_encryption_intr(sc);
1362
1363	if (r & RT2560_TX_DONE)
1364		rt2560_tx_intr(sc);
1365
1366	if (r & RT2560_PRIO_DONE)
1367		rt2560_prio_intr(sc);
1368
1369	if (r & RT2560_DECRYPTION_DONE)
1370		rt2560_decryption_intr(sc);
1371
1372	if (r & RT2560_RX_DONE)
1373		rt2560_rx_intr(sc);
1374
1375	/* re-enable interrupts */
1376	RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
1377
1378	return 1;
1379}
1380
1381/* quickly determine if a given rate is CCK or OFDM */
1382#define RAL_RATE_IS_OFDM(rate) ((rate) >= 12 && (rate) != 22)
1383
1384#define RAL_ACK_SIZE	14	/* 10 + 4(FCS) */
1385#define RAL_CTS_SIZE	14	/* 10 + 4(FCS) */
1386
1387#define RAL_SIFS		10	/* us */
1388
1389#define RT2560_RXTX_TURNAROUND	10	/* us */
1390
1391/*
1392 * This function is only used by the Rx radiotap code. It returns the rate at
1393 * which a given frame was received.
1394 */
1395#if NBPFILTER > 0
1396uint8_t
1397rt2560_rxrate(const struct rt2560_rx_desc *desc)
1398{
1399	if (letoh32(desc->flags) & RT2560_RX_OFDM) {
1400		/* reverse function of rt2560_plcp_signal */
1401		switch (desc->rate) {
1402		case 0xb:	return 12;
1403		case 0xf:	return 18;
1404		case 0xa:	return 24;
1405		case 0xe:	return 36;
1406		case 0x9:	return 48;
1407		case 0xd:	return 72;
1408		case 0x8:	return 96;
1409		case 0xc:	return 108;
1410		}
1411	} else {
1412		if (desc->rate == 10)
1413			return 2;
1414		if (desc->rate == 20)
1415			return 4;
1416		if (desc->rate == 55)
1417			return 11;
1418		if (desc->rate == 110)
1419			return 22;
1420	}
1421	return 2;	/* should not get there */
1422}
1423#endif
1424
1425/*
1426 * Return the expected ack rate for a frame transmitted at rate `rate'.
1427 */
1428int
1429rt2560_ack_rate(struct ieee80211com *ic, int rate)
1430{
1431	switch (rate) {
1432	/* CCK rates */
1433	case 2:
1434		return 2;
1435	case 4:
1436	case 11:
1437	case 22:
1438		return (ic->ic_curmode == IEEE80211_MODE_11B) ? 4 : rate;
1439
1440	/* OFDM rates */
1441	case 12:
1442	case 18:
1443		return 12;
1444	case 24:
1445	case 36:
1446		return 24;
1447	case 48:
1448	case 72:
1449	case 96:
1450	case 108:
1451		return 48;
1452	}
1453
1454	/* default to 1Mbps */
1455	return 2;
1456}
1457
1458/*
1459 * Compute the duration (in us) needed to transmit `len' bytes at rate `rate'.
1460 * The function automatically determines the operating mode depending on the
1461 * given rate. `flags' indicates whether short preamble is in use or not.
1462 */
1463uint16_t
1464rt2560_txtime(int len, int rate, uint32_t flags)
1465{
1466	uint16_t txtime;
1467
1468	if (RAL_RATE_IS_OFDM(rate)) {
1469		/* IEEE Std 802.11g-2003, pp. 44 */
1470		txtime = (8 + 4 * len + 3 + rate - 1) / rate;
1471		txtime = 16 + 4 + 4 * txtime + 6;
1472	} else {
1473		/* IEEE Std 802.11b-1999, pp. 28 */
1474		txtime = (16 * len + rate - 1) / rate;
1475		if (rate != 2 && (flags & IEEE80211_F_SHPREAMBLE))
1476			txtime +=  72 + 24;
1477		else
1478			txtime += 144 + 48;
1479	}
1480	return txtime;
1481}
1482
1483uint8_t
1484rt2560_plcp_signal(int rate)
1485{
1486	switch (rate) {
1487	/* CCK rates (returned values are device-dependent) */
1488	case 2:		return 0x0;
1489	case 4:		return 0x1;
1490	case 11:	return 0x2;
1491	case 22:	return 0x3;
1492
1493	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1494	case 12:	return 0xb;
1495	case 18:	return 0xf;
1496	case 24:	return 0xa;
1497	case 36:	return 0xe;
1498	case 48:	return 0x9;
1499	case 72:	return 0xd;
1500	case 96:	return 0x8;
1501	case 108:	return 0xc;
1502
1503	/* unsupported rates (should not get there) */
1504	default:	return 0xff;
1505	}
1506}
1507
1508void
1509rt2560_setup_tx_desc(struct rt2560_softc *sc, struct rt2560_tx_desc *desc,
1510    uint32_t flags, int len, int rate, int encrypt, bus_addr_t physaddr)
1511{
1512	struct ieee80211com *ic = &sc->sc_ic;
1513	uint16_t plcp_length;
1514	int remainder;
1515
1516	desc->flags = htole32(flags);
1517	desc->flags |= htole32(len << 16);
1518	desc->flags |= encrypt ? htole32(RT2560_TX_CIPHER_BUSY) :
1519	    htole32(RT2560_TX_BUSY | RT2560_TX_VALID);
1520
1521	desc->physaddr = htole32(physaddr);
1522	desc->wme = htole16(
1523	    RT2560_AIFSN(2) |
1524	    RT2560_LOGCWMIN(3) |
1525	    RT2560_LOGCWMAX(8));
1526
1527	/* setup PLCP fields */
1528	desc->plcp_signal  = rt2560_plcp_signal(rate);
1529	desc->plcp_service = 4;
1530
1531	len += IEEE80211_CRC_LEN;
1532	if (RAL_RATE_IS_OFDM(rate)) {
1533		desc->flags |= htole32(RT2560_TX_OFDM);
1534
1535		plcp_length = len & 0xfff;
1536		desc->plcp_length_hi = plcp_length >> 6;
1537		desc->plcp_length_lo = plcp_length & 0x3f;
1538	} else {
1539		plcp_length = (16 * len + rate - 1) / rate;
1540		if (rate == 22) {
1541			remainder = (16 * len) % 22;
1542			if (remainder != 0 && remainder < 7)
1543				desc->plcp_service |= RT2560_PLCP_LENGEXT;
1544		}
1545		desc->plcp_length_hi = plcp_length >> 8;
1546		desc->plcp_length_lo = plcp_length & 0xff;
1547
1548		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1549			desc->plcp_signal |= 0x08;
1550	}
1551}
1552
1553#ifndef IEEE80211_STA_ONLY
1554int
1555rt2560_tx_bcn(struct rt2560_softc *sc, struct mbuf *m0,
1556    struct ieee80211_node *ni)
1557{
1558	struct ieee80211com *ic = &sc->sc_ic;
1559	struct rt2560_tx_desc *desc;
1560	struct rt2560_tx_data *data;
1561	int rate = 2, error;
1562
1563	desc = &sc->bcnq.desc[sc->bcnq.cur];
1564	data = &sc->bcnq.data[sc->bcnq.cur];
1565
1566	error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
1567	    BUS_DMA_NOWAIT);
1568	if (error != 0) {
1569		printf("%s: can't map mbuf (error %d)\n",
1570		    sc->sc_dev.dv_xname, error);
1571		m_freem(m0);
1572		return error;
1573	}
1574
1575	data->m = m0;
1576	data->ni = ni;
1577
1578	rt2560_setup_tx_desc(sc, desc, RT2560_TX_IFS_NEWBACKOFF |
1579	    RT2560_TX_TIMESTAMP, m0->m_pkthdr.len, rate, 0,
1580	    data->map->dm_segs->ds_addr);
1581
1582	bus_dmamap_sync(sc->sc_dmat, data->map, 0, data->map->dm_mapsize,
1583	    BUS_DMASYNC_PREWRITE);
1584	bus_dmamap_sync(sc->sc_dmat, sc->bcnq.map,
1585	    sc->bcnq.cur * RT2560_TX_DESC_SIZE, RT2560_TX_DESC_SIZE,
1586	    BUS_DMASYNC_PREWRITE);
1587
1588	/*
1589	 * Store pointer to ERP Information Element so that we can update it
1590	 * dynamically when the slot time changes.
1591	 * XXX: this is ugly since it depends on how net80211 builds beacon
1592	 * frames but ieee80211_beacon_alloc() don't store offsets for us.
1593	 */
1594	if (ic->ic_curmode == IEEE80211_MODE_11G) {
1595		sc->erp =
1596		    mtod(m0, uint8_t *) +
1597		    sizeof (struct ieee80211_frame) +
1598		    8 + 2 + 2 +
1599		    ((ic->ic_flags & IEEE80211_F_HIDENWID) ?
1600			1 : 2 + ni->ni_esslen) +
1601		    2 + min(ni->ni_rates.rs_nrates, IEEE80211_RATE_SIZE) +
1602		    2 + 1 +
1603		    ((ic->ic_opmode == IEEE80211_M_IBSS) ? 4 : 6) +
1604		    2;
1605	}
1606
1607	return 0;
1608}
1609#endif
1610
1611int
1612rt2560_tx_mgt(struct rt2560_softc *sc, struct mbuf *m0,
1613    struct ieee80211_node *ni)
1614{
1615	struct ieee80211com *ic = &sc->sc_ic;
1616	struct rt2560_tx_desc *desc;
1617	struct rt2560_tx_data *data;
1618	struct ieee80211_frame *wh;
1619	uint16_t dur;
1620	uint32_t flags = 0;
1621	int rate = 2, error;
1622
1623	desc = &sc->prioq.desc[sc->prioq.cur];
1624	data = &sc->prioq.data[sc->prioq.cur];
1625
1626	error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
1627	    BUS_DMA_NOWAIT);
1628	if (error != 0) {
1629		printf("%s: can't map mbuf (error %d)\n",
1630		    sc->sc_dev.dv_xname, error);
1631		m_freem(m0);
1632		return error;
1633	}
1634
1635#if NBPFILTER > 0
1636	if (sc->sc_drvbpf != NULL) {
1637		struct mbuf mb;
1638		struct rt2560_tx_radiotap_header *tap = &sc->sc_txtap;
1639
1640		tap->wt_flags = 0;
1641		tap->wt_rate = rate;
1642		tap->wt_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
1643		tap->wt_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
1644		tap->wt_antenna = sc->tx_ant;
1645
1646		mb.m_data = (caddr_t)tap;
1647		mb.m_len = sc->sc_txtap_len;
1648		mb.m_next = m0;
1649		mb.m_nextpkt = NULL;
1650		mb.m_type = 0;
1651		mb.m_flags = 0;
1652		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
1653	}
1654#endif
1655
1656	data->m = m0;
1657	data->ni = ni;
1658
1659	wh = mtod(m0, struct ieee80211_frame *);
1660
1661	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1662		flags |= RT2560_TX_NEED_ACK;
1663
1664		dur = rt2560_txtime(RAL_ACK_SIZE, rate, ic->ic_flags) +
1665		    RAL_SIFS;
1666		*(uint16_t *)wh->i_dur = htole16(dur);
1667
1668#ifndef IEEE80211_STA_ONLY
1669		/* tell hardware to set timestamp for probe responses */
1670		if ((wh->i_fc[0] &
1671		    (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
1672		    (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
1673			flags |= RT2560_TX_TIMESTAMP;
1674#endif
1675	}
1676
1677	rt2560_setup_tx_desc(sc, desc, flags, m0->m_pkthdr.len, rate, 0,
1678	    data->map->dm_segs->ds_addr);
1679
1680	bus_dmamap_sync(sc->sc_dmat, data->map, 0, data->map->dm_mapsize,
1681	    BUS_DMASYNC_PREWRITE);
1682	bus_dmamap_sync(sc->sc_dmat, sc->prioq.map,
1683	    sc->prioq.cur * RT2560_TX_DESC_SIZE, RT2560_TX_DESC_SIZE,
1684	    BUS_DMASYNC_PREWRITE);
1685
1686	DPRINTFN(10, ("sending mgt frame len=%u idx=%u rate=%u\n",
1687	    m0->m_pkthdr.len, sc->prioq.cur, rate));
1688
1689	/* kick prio */
1690	sc->prioq.queued++;
1691	sc->prioq.cur = (sc->prioq.cur + 1) % RT2560_PRIO_RING_COUNT;
1692	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_PRIO);
1693
1694	return 0;
1695}
1696
1697int
1698rt2560_tx_data(struct rt2560_softc *sc, struct mbuf *m0,
1699    struct ieee80211_node *ni)
1700{
1701	struct ieee80211com *ic = &sc->sc_ic;
1702	struct rt2560_tx_ring *txq = &sc->txq;
1703	struct rt2560_tx_desc *desc;
1704	struct rt2560_tx_data *data;
1705	struct ieee80211_frame *wh;
1706	struct ieee80211_key *k;
1707	struct mbuf *m1;
1708	uint16_t dur;
1709	uint32_t flags = 0;
1710	int pktlen, rate, needcts = 0, needrts = 0, error;
1711
1712	wh = mtod(m0, struct ieee80211_frame *);
1713
1714	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1715		k = ieee80211_get_txkey(ic, wh, ni);
1716
1717		if ((m0 = ieee80211_encrypt(ic, m0, k)) == NULL)
1718			return ENOBUFS;
1719
1720		/* packet header may have moved, reset our local pointer */
1721		wh = mtod(m0, struct ieee80211_frame *);
1722	}
1723
1724	/* compute actual packet length (including CRC and crypto overhead) */
1725	pktlen = m0->m_pkthdr.len + IEEE80211_CRC_LEN;
1726
1727	/* pickup a rate */
1728	if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
1729	    ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1730	     IEEE80211_FC0_TYPE_MGT)) {
1731		/* mgmt/multicast frames are sent at the lowest avail. rate */
1732		rate = ni->ni_rates.rs_rates[0];
1733	} else if (ic->ic_fixed_rate != -1) {
1734		rate = ic->ic_sup_rates[ic->ic_curmode].
1735		    rs_rates[ic->ic_fixed_rate];
1736	} else
1737		rate = ni->ni_rates.rs_rates[ni->ni_txrate];
1738	if (rate == 0)
1739		rate = 2;	/* XXX should not happen */
1740	rate &= IEEE80211_RATE_VAL;
1741
1742	/*
1743	 * Packet Bursting: backoff after ppb=8 frames to give other STAs a
1744	 * chance to contend for the wireless medium.
1745	 */
1746	if (ic->ic_opmode == IEEE80211_M_STA && (ni->ni_txseq & 7))
1747		flags |= RT2560_TX_IFS_SIFS;
1748
1749	/* check if RTS/CTS or CTS-to-self protection must be used */
1750	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1751		/* multicast frames are not sent at OFDM rates in 802.11b/g */
1752		if (pktlen > ic->ic_rtsthreshold) {
1753			needrts = 1;	/* RTS/CTS based on frame length */
1754		} else if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
1755		    RAL_RATE_IS_OFDM(rate)) {
1756			if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
1757				needcts = 1;	/* CTS-to-self */
1758			else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
1759				needrts = 1;	/* RTS/CTS */
1760		}
1761	}
1762	if (needrts || needcts) {
1763		struct mbuf *mprot;
1764		int protrate, ackrate;
1765
1766		protrate = 2;	/* XXX */
1767		ackrate  = rt2560_ack_rate(ic, rate);
1768
1769		dur = rt2560_txtime(pktlen, rate, ic->ic_flags) +
1770		      rt2560_txtime(RAL_ACK_SIZE, ackrate, ic->ic_flags) +
1771		      2 * RAL_SIFS;
1772		if (needrts) {
1773			dur += rt2560_txtime(RAL_CTS_SIZE, rt2560_ack_rate(ic,
1774			    protrate), ic->ic_flags) + RAL_SIFS;
1775			mprot = ieee80211_get_rts(ic, wh, dur);
1776		} else {
1777			mprot = ieee80211_get_cts_to_self(ic, dur);
1778		}
1779		if (mprot == NULL) {
1780			printf("%s: could not allocate protection frame\n",
1781			    sc->sc_dev.dv_xname);
1782			m_freem(m0);
1783			return ENOBUFS;
1784		}
1785
1786		desc = &txq->desc[txq->cur_encrypt];
1787		data = &txq->data[txq->cur_encrypt];
1788
1789		error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, mprot,
1790		    BUS_DMA_NOWAIT);
1791		if (error != 0) {
1792			printf("%s: can't map mbuf (error %d)\n",
1793			    sc->sc_dev.dv_xname, error);
1794			m_freem(mprot);
1795			m_freem(m0);
1796			return error;
1797		}
1798
1799		data->m = mprot;
1800		/* avoid multiple free() of the same node for each fragment */
1801		data->ni = ieee80211_ref_node(ni);
1802
1803		/* XXX may want to pass the protection frame to BPF */
1804
1805		rt2560_setup_tx_desc(sc, desc,
1806		    (needrts ? RT2560_TX_NEED_ACK : 0) | RT2560_TX_MORE_FRAG,
1807		    mprot->m_pkthdr.len, protrate, 1,
1808		    data->map->dm_segs->ds_addr);
1809
1810		bus_dmamap_sync(sc->sc_dmat, data->map, 0,
1811		    data->map->dm_mapsize, BUS_DMASYNC_PREWRITE);
1812		bus_dmamap_sync(sc->sc_dmat, txq->map,
1813		    txq->cur_encrypt * RT2560_TX_DESC_SIZE,
1814		    RT2560_TX_DESC_SIZE, BUS_DMASYNC_PREWRITE);
1815
1816		txq->queued++;
1817		if (++txq->cur_encrypt >= txq->count)
1818			txq->cur_encrypt = 0;
1819
1820		flags |= RT2560_TX_LONG_RETRY | RT2560_TX_IFS_SIFS;
1821	}
1822
1823	data = &txq->data[txq->cur_encrypt];
1824	desc = &txq->desc[txq->cur_encrypt];
1825
1826	error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
1827	    BUS_DMA_NOWAIT);
1828	if (error != 0 && error != EFBIG) {
1829		printf("%s: can't map mbuf (error %d)\n",
1830		    sc->sc_dev.dv_xname, error);
1831		m_freem(m0);
1832		return error;
1833	}
1834	if (error != 0) {
1835		/* too many fragments, linearize */
1836		MGETHDR(m1, M_DONTWAIT, MT_DATA);
1837		if (m1 == NULL) {
1838			m_freem(m0);
1839			return ENOBUFS;
1840		}
1841		if (m0->m_pkthdr.len > MHLEN) {
1842			MCLGET(m1, M_DONTWAIT);
1843			if (!(m1->m_flags & M_EXT)) {
1844				m_freem(m0);
1845				m_freem(m1);
1846				return ENOBUFS;
1847			}
1848		}
1849		m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m1, caddr_t));
1850		m1->m_pkthdr.len = m1->m_len = m0->m_pkthdr.len;
1851		m_freem(m0);
1852		m0 = m1;
1853
1854		error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
1855		    BUS_DMA_NOWAIT);
1856		if (error != 0) {
1857			printf("%s: can't map mbuf (error %d)\n",
1858			    sc->sc_dev.dv_xname, error);
1859			m_freem(m0);
1860			return error;
1861		}
1862
1863		/* packet header have moved, reset our local pointer */
1864		wh = mtod(m0, struct ieee80211_frame *);
1865	}
1866
1867#if NBPFILTER > 0
1868	if (sc->sc_drvbpf != NULL) {
1869		struct mbuf mb;
1870		struct rt2560_tx_radiotap_header *tap = &sc->sc_txtap;
1871
1872		tap->wt_flags = 0;
1873		tap->wt_rate = rate;
1874		tap->wt_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
1875		tap->wt_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
1876		tap->wt_antenna = sc->tx_ant;
1877
1878		mb.m_data = (caddr_t)tap;
1879		mb.m_len = sc->sc_txtap_len;
1880		mb.m_next = m0;
1881		mb.m_nextpkt = NULL;
1882		mb.m_type = 0;
1883		mb.m_flags = 0;
1884		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
1885	}
1886#endif
1887
1888	data->m = m0;
1889	data->ni = ni;
1890
1891	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1892		flags |= RT2560_TX_NEED_ACK;
1893
1894		dur = rt2560_txtime(RAL_ACK_SIZE, rt2560_ack_rate(ic, rate),
1895		    ic->ic_flags) + RAL_SIFS;
1896		*(uint16_t *)wh->i_dur = htole16(dur);
1897	}
1898
1899	rt2560_setup_tx_desc(sc, desc, flags, m0->m_pkthdr.len, rate, 1,
1900	    data->map->dm_segs->ds_addr);
1901
1902	bus_dmamap_sync(sc->sc_dmat, data->map, 0, data->map->dm_mapsize,
1903	    BUS_DMASYNC_PREWRITE);
1904	bus_dmamap_sync(sc->sc_dmat, txq->map,
1905	    txq->cur_encrypt * RT2560_TX_DESC_SIZE, RT2560_TX_DESC_SIZE,
1906	    BUS_DMASYNC_PREWRITE);
1907
1908	DPRINTFN(10, ("sending frame len=%u idx=%u rate=%u\n",
1909	    m0->m_pkthdr.len, txq->cur_encrypt, rate));
1910
1911	/* kick encrypt */
1912	txq->queued++;
1913	if (++txq->cur_encrypt >= txq->count)
1914		txq->cur_encrypt = 0;
1915	RAL_WRITE(sc, RT2560_SECCSR1, RT2560_KICK_ENCRYPT);
1916
1917	return 0;
1918}
1919
1920void
1921rt2560_start(struct ifnet *ifp)
1922{
1923	struct rt2560_softc *sc = ifp->if_softc;
1924	struct ieee80211com *ic = &sc->sc_ic;
1925	struct mbuf *m0;
1926	struct ieee80211_node *ni;
1927
1928	/*
1929	 * net80211 may still try to send management frames even if the
1930	 * IFF_RUNNING flag is not set...
1931	 */
1932	if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
1933		return;
1934
1935	for (;;) {
1936		IF_POLL(&ic->ic_mgtq, m0);
1937		if (m0 != NULL) {
1938			if (sc->prioq.queued >= RT2560_PRIO_RING_COUNT) {
1939				ifp->if_flags |= IFF_OACTIVE;
1940				break;
1941			}
1942			IF_DEQUEUE(&ic->ic_mgtq, m0);
1943
1944			ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
1945			m0->m_pkthdr.rcvif = NULL;
1946#if NBPFILTER > 0
1947			if (ic->ic_rawbpf != NULL)
1948				bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
1949#endif
1950			if (rt2560_tx_mgt(sc, m0, ni) != 0)
1951				break;
1952
1953		} else {
1954			if (ic->ic_state != IEEE80211_S_RUN)
1955				break;
1956			IFQ_POLL(&ifp->if_snd, m0);
1957			if (m0 == NULL)
1958				break;
1959			if (sc->txq.queued >= RT2560_TX_RING_COUNT - 1) {
1960				ifp->if_flags |= IFF_OACTIVE;
1961				break;
1962			}
1963			IFQ_DEQUEUE(&ifp->if_snd, m0);
1964#if NBPFILTER > 0
1965			if (ifp->if_bpf != NULL)
1966				bpf_mtap(ifp->if_bpf, m0, BPF_DIRECTION_OUT);
1967#endif
1968			m0 = ieee80211_encap(ifp, m0, &ni);
1969			if (m0 == NULL)
1970				continue;
1971#if NBPFILTER > 0
1972			if (ic->ic_rawbpf != NULL)
1973				bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
1974#endif
1975			if (rt2560_tx_data(sc, m0, ni) != 0) {
1976				if (ni != NULL)
1977					ieee80211_release_node(ic, ni);
1978				ifp->if_oerrors++;
1979				break;
1980			}
1981		}
1982
1983		sc->sc_tx_timer = 5;
1984		ifp->if_timer = 1;
1985	}
1986}
1987
1988void
1989rt2560_watchdog(struct ifnet *ifp)
1990{
1991	struct rt2560_softc *sc = ifp->if_softc;
1992
1993	ifp->if_timer = 0;
1994
1995	if (sc->sc_tx_timer > 0) {
1996		if (--sc->sc_tx_timer == 0) {
1997			printf("%s: device timeout\n", sc->sc_dev.dv_xname);
1998			rt2560_init(ifp);
1999			ifp->if_oerrors++;
2000			return;
2001		}
2002		ifp->if_timer = 1;
2003	}
2004
2005	ieee80211_watchdog(ifp);
2006}
2007
2008int
2009rt2560_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
2010{
2011	struct rt2560_softc *sc = ifp->if_softc;
2012	struct ieee80211com *ic = &sc->sc_ic;
2013	struct ifaddr *ifa;
2014	struct ifreq *ifr;
2015	int s, error = 0;
2016
2017	s = splnet();
2018
2019	switch (cmd) {
2020	case SIOCSIFADDR:
2021		ifa = (struct ifaddr *)data;
2022		ifp->if_flags |= IFF_UP;
2023#ifdef INET
2024		if (ifa->ifa_addr->sa_family == AF_INET)
2025			arp_ifinit(&ic->ic_ac, ifa);
2026#endif
2027		/* FALLTHROUGH */
2028	case SIOCSIFFLAGS:
2029		if (ifp->if_flags & IFF_UP) {
2030			if (ifp->if_flags & IFF_RUNNING)
2031				rt2560_update_promisc(sc);
2032			else
2033				rt2560_init(ifp);
2034		} else {
2035			if (ifp->if_flags & IFF_RUNNING)
2036				rt2560_stop(ifp, 1);
2037		}
2038		break;
2039
2040	case SIOCADDMULTI:
2041	case SIOCDELMULTI:
2042		ifr = (struct ifreq *)data;
2043		error = (cmd == SIOCADDMULTI) ?
2044		    ether_addmulti(ifr, &ic->ic_ac) :
2045		    ether_delmulti(ifr, &ic->ic_ac);
2046
2047		if (error == ENETRESET)
2048			error = 0;
2049		break;
2050
2051	case SIOCS80211CHANNEL:
2052		/*
2053		 * This allows for fast channel switching in monitor mode
2054		 * (used by kismet). In IBSS mode, we must explicitly reset
2055		 * the interface to generate a new beacon frame.
2056		 */
2057		error = ieee80211_ioctl(ifp, cmd, data);
2058		if (error == ENETRESET &&
2059		    ic->ic_opmode == IEEE80211_M_MONITOR) {
2060			if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
2061			    (IFF_UP | IFF_RUNNING))
2062				rt2560_set_chan(sc, ic->ic_ibss_chan);
2063			error = 0;
2064		}
2065		break;
2066
2067	default:
2068		error = ieee80211_ioctl(ifp, cmd, data);
2069	}
2070
2071	if (error == ENETRESET) {
2072		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
2073		    (IFF_UP | IFF_RUNNING))
2074			rt2560_init(ifp);
2075		error = 0;
2076	}
2077
2078	splx(s);
2079
2080	return error;
2081}
2082
2083void
2084rt2560_bbp_write(struct rt2560_softc *sc, uint8_t reg, uint8_t val)
2085{
2086	uint32_t tmp;
2087	int ntries;
2088
2089	for (ntries = 0; ntries < 100; ntries++) {
2090		if (!(RAL_READ(sc, RT2560_BBPCSR) & RT2560_BBP_BUSY))
2091			break;
2092		DELAY(1);
2093	}
2094	if (ntries == 100) {
2095		printf("%s: could not write to BBP\n", sc->sc_dev.dv_xname);
2096		return;
2097	}
2098
2099	tmp = RT2560_BBP_WRITE | RT2560_BBP_BUSY | reg << 8 | val;
2100	RAL_WRITE(sc, RT2560_BBPCSR, tmp);
2101
2102	DPRINTFN(15, ("BBP R%u <- 0x%02x\n", reg, val));
2103}
2104
2105uint8_t
2106rt2560_bbp_read(struct rt2560_softc *sc, uint8_t reg)
2107{
2108	uint32_t val;
2109	int ntries;
2110
2111	val = RT2560_BBP_BUSY | reg << 8;
2112	RAL_WRITE(sc, RT2560_BBPCSR, val);
2113
2114	for (ntries = 0; ntries < 100; ntries++) {
2115		val = RAL_READ(sc, RT2560_BBPCSR);
2116		if (!(val & RT2560_BBP_BUSY))
2117			return val & 0xff;
2118		DELAY(1);
2119	}
2120
2121	printf("%s: could not read from BBP\n", sc->sc_dev.dv_xname);
2122	return 0;
2123}
2124
2125void
2126rt2560_rf_write(struct rt2560_softc *sc, uint8_t reg, uint32_t val)
2127{
2128	uint32_t tmp;
2129	int ntries;
2130
2131	for (ntries = 0; ntries < 100; ntries++) {
2132		if (!(RAL_READ(sc, RT2560_RFCSR) & RT2560_RF_BUSY))
2133			break;
2134		DELAY(1);
2135	}
2136	if (ntries == 100) {
2137		printf("%s: could not write to RF\n", sc->sc_dev.dv_xname);
2138		return;
2139	}
2140
2141	tmp = RT2560_RF_BUSY | RT2560_RF_20BIT | (val & 0xfffff) << 2 |
2142	    (reg & 0x3);
2143	RAL_WRITE(sc, RT2560_RFCSR, tmp);
2144
2145	/* remember last written value in sc */
2146	sc->rf_regs[reg] = val;
2147
2148	DPRINTFN(15, ("RF R[%u] <- 0x%05x\n", reg & 0x3, val & 0xfffff));
2149}
2150
2151void
2152rt2560_set_chan(struct rt2560_softc *sc, struct ieee80211_channel *c)
2153{
2154	struct ieee80211com *ic = &sc->sc_ic;
2155	uint8_t power, tmp;
2156	u_int chan;
2157
2158	chan = ieee80211_chan2ieee(ic, c);
2159	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
2160		return;
2161
2162	power = min(sc->txpow[chan - 1], 31);
2163
2164	DPRINTFN(2, ("setting channel to %u, txpower to %u\n", chan, power));
2165
2166	switch (sc->rf_rev) {
2167	case RT2560_RF_2522:
2168		rt2560_rf_write(sc, RT2560_RF1, 0x00814);
2169		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf2522_r2[chan - 1]);
2170		rt2560_rf_write(sc, RT2560_RF3, power << 7 | 0x00040);
2171		break;
2172
2173	case RT2560_RF_2523:
2174		rt2560_rf_write(sc, RT2560_RF1, 0x08804);
2175		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf2523_r2[chan - 1]);
2176		rt2560_rf_write(sc, RT2560_RF3, power << 7 | 0x38044);
2177		rt2560_rf_write(sc, RT2560_RF4,
2178		    (chan == 14) ? 0x00280 : 0x00286);
2179		break;
2180
2181	case RT2560_RF_2524:
2182		rt2560_rf_write(sc, RT2560_RF1, 0x0c808);
2183		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf2524_r2[chan - 1]);
2184		rt2560_rf_write(sc, RT2560_RF3, power << 7 | 0x00040);
2185		rt2560_rf_write(sc, RT2560_RF4,
2186		    (chan == 14) ? 0x00280 : 0x00286);
2187		break;
2188
2189	case RT2560_RF_2525:
2190		rt2560_rf_write(sc, RT2560_RF1, 0x08808);
2191		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf2525_hi_r2[chan - 1]);
2192		rt2560_rf_write(sc, RT2560_RF3, power << 7 | 0x18044);
2193		rt2560_rf_write(sc, RT2560_RF4,
2194		    (chan == 14) ? 0x00280 : 0x00286);
2195
2196		rt2560_rf_write(sc, RT2560_RF1, 0x08808);
2197		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf2525_r2[chan - 1]);
2198		rt2560_rf_write(sc, RT2560_RF3, power << 7 | 0x18044);
2199		rt2560_rf_write(sc, RT2560_RF4,
2200		    (chan == 14) ? 0x00280 : 0x00286);
2201		break;
2202
2203	case RT2560_RF_2525E:
2204		rt2560_rf_write(sc, RT2560_RF1, 0x08808);
2205		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf2525e_r2[chan - 1]);
2206		rt2560_rf_write(sc, RT2560_RF3, power << 7 | 0x18044);
2207		rt2560_rf_write(sc, RT2560_RF4,
2208		    (chan == 14) ? 0x00286 : 0x00282);
2209		break;
2210
2211	case RT2560_RF_2526:
2212		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf2526_hi_r2[chan - 1]);
2213		rt2560_rf_write(sc, RT2560_RF4,
2214		   (chan & 1) ? 0x00386 : 0x00381);
2215		rt2560_rf_write(sc, RT2560_RF1, 0x08804);
2216
2217		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf2526_r2[chan - 1]);
2218		rt2560_rf_write(sc, RT2560_RF3, power << 7 | 0x18044);
2219		rt2560_rf_write(sc, RT2560_RF4,
2220		    (chan & 1) ? 0x00386 : 0x00381);
2221		break;
2222	}
2223
2224	if (ic->ic_opmode != IEEE80211_M_MONITOR &&
2225	    ic->ic_state != IEEE80211_S_SCAN) {
2226		/* set Japan filter bit for channel 14 */
2227		tmp = rt2560_bbp_read(sc, 70);
2228
2229		tmp &= ~RT2560_JAPAN_FILTER;
2230		if (chan == 14)
2231			tmp |= RT2560_JAPAN_FILTER;
2232
2233		rt2560_bbp_write(sc, 70, tmp);
2234
2235		DELAY(1000); /* RF needs a 1ms delay here */
2236		rt2560_disable_rf_tune(sc);
2237
2238		/* clear CRC errors */
2239		RAL_READ(sc, RT2560_CNT0);
2240	}
2241}
2242
2243/*
2244 * Disable RF auto-tuning.
2245 */
2246void
2247rt2560_disable_rf_tune(struct rt2560_softc *sc)
2248{
2249	uint32_t tmp;
2250
2251	if (sc->rf_rev != RT2560_RF_2523) {
2252		tmp = sc->rf_regs[RT2560_RF1] & ~RT2560_RF1_AUTOTUNE;
2253		rt2560_rf_write(sc, RT2560_RF1, tmp);
2254	}
2255
2256	tmp = sc->rf_regs[RT2560_RF3] & ~RT2560_RF3_AUTOTUNE;
2257	rt2560_rf_write(sc, RT2560_RF3, tmp);
2258
2259	DPRINTFN(2, ("disabling RF autotune\n"));
2260}
2261
2262/*
2263 * Refer to IEEE Std 802.11-1999 pp. 123 for more information on TSF
2264 * synchronization.
2265 */
2266void
2267rt2560_enable_tsf_sync(struct rt2560_softc *sc)
2268{
2269	struct ieee80211com *ic = &sc->sc_ic;
2270	uint16_t logcwmin, preload;
2271	uint32_t tmp;
2272
2273	/* first, disable TSF synchronization */
2274	RAL_WRITE(sc, RT2560_CSR14, 0);
2275
2276	tmp = 16 * ic->ic_bss->ni_intval;
2277	RAL_WRITE(sc, RT2560_CSR12, tmp);
2278
2279	RAL_WRITE(sc, RT2560_CSR13, 0);
2280
2281	logcwmin = 5;
2282	preload = (ic->ic_opmode == IEEE80211_M_STA) ? 384 : 1024;
2283	tmp = logcwmin << 16 | preload;
2284	RAL_WRITE(sc, RT2560_BCNOCSR, tmp);
2285
2286	/* finally, enable TSF synchronization */
2287	tmp = RT2560_ENABLE_TSF | RT2560_ENABLE_TBCN;
2288	if (ic->ic_opmode == IEEE80211_M_STA)
2289		tmp |= RT2560_ENABLE_TSF_SYNC(1);
2290#ifndef IEEE80211_STA_ONLY
2291	else
2292		tmp |= RT2560_ENABLE_TSF_SYNC(2) |
2293		       RT2560_ENABLE_BEACON_GENERATOR;
2294#endif
2295	RAL_WRITE(sc, RT2560_CSR14, tmp);
2296
2297	DPRINTF(("enabling TSF synchronization\n"));
2298}
2299
2300void
2301rt2560_update_plcp(struct rt2560_softc *sc)
2302{
2303	struct ieee80211com *ic = &sc->sc_ic;
2304
2305	/* no short preamble for 1Mbps */
2306	RAL_WRITE(sc, RT2560_PLCP1MCSR, 0x00700400);
2307
2308	if (!(ic->ic_flags & IEEE80211_F_SHPREAMBLE)) {
2309		/* values taken from the reference driver */
2310		RAL_WRITE(sc, RT2560_PLCP2MCSR,   0x00380401);
2311		RAL_WRITE(sc, RT2560_PLCP5p5MCSR, 0x00150402);
2312		RAL_WRITE(sc, RT2560_PLCP11MCSR,  0x000b8403);
2313	} else {
2314		/* same values as above or'ed 0x8 */
2315		RAL_WRITE(sc, RT2560_PLCP2MCSR,   0x00380409);
2316		RAL_WRITE(sc, RT2560_PLCP5p5MCSR, 0x0015040a);
2317		RAL_WRITE(sc, RT2560_PLCP11MCSR,  0x000b840b);
2318	}
2319
2320	DPRINTF(("updating PLCP for %s preamble\n",
2321	    (ic->ic_flags & IEEE80211_F_SHPREAMBLE) ? "short" : "long"));
2322}
2323
2324void
2325rt2560_updateslot(struct ieee80211com *ic)
2326{
2327	struct rt2560_softc *sc = ic->ic_if.if_softc;
2328
2329#ifndef IEEE80211_STA_ONLY
2330	if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
2331		/*
2332		 * In HostAP mode, we defer setting of new slot time until
2333		 * updated ERP Information Element has propagated to all
2334		 * associated STAs.
2335		 */
2336		sc->sc_flags |= RT2560_UPDATE_SLOT;
2337	} else
2338#endif
2339		rt2560_set_slottime(sc);
2340}
2341
2342/*
2343 * IEEE 802.11a (and possibly 802.11g) use short slot time. Refer to
2344 * IEEE Std 802.11-1999 pp. 85 to know how these values are computed.
2345 */
2346void
2347rt2560_set_slottime(struct rt2560_softc *sc)
2348{
2349	struct ieee80211com *ic = &sc->sc_ic;
2350	uint8_t slottime;
2351	uint16_t sifs, pifs, difs, eifs;
2352	uint32_t tmp;
2353
2354	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
2355
2356	/* define the MAC slot boundaries */
2357	sifs = RAL_SIFS - RT2560_RXTX_TURNAROUND;
2358	pifs = sifs + slottime;
2359	difs = sifs + 2 * slottime;
2360	eifs = (ic->ic_curmode == IEEE80211_MODE_11B) ? 364 : 60;
2361
2362	tmp = RAL_READ(sc, RT2560_CSR11);
2363	tmp = (tmp & ~0x1f00) | slottime << 8;
2364	RAL_WRITE(sc, RT2560_CSR11, tmp);
2365
2366	tmp = pifs << 16 | sifs;
2367	RAL_WRITE(sc, RT2560_CSR18, tmp);
2368
2369	tmp = eifs << 16 | difs;
2370	RAL_WRITE(sc, RT2560_CSR19, tmp);
2371
2372	DPRINTF(("setting slottime to %uus\n", slottime));
2373}
2374
2375void
2376rt2560_set_basicrates(struct rt2560_softc *sc)
2377{
2378	struct ieee80211com *ic = &sc->sc_ic;
2379
2380	/* update basic rate set */
2381	if (ic->ic_curmode == IEEE80211_MODE_11B) {
2382		/* 11b basic rates: 1, 2Mbps */
2383		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x3);
2384	} else {
2385		/* 11b/g basic rates: 1, 2, 5.5, 11Mbps */
2386		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0xf);
2387	}
2388}
2389
2390void
2391rt2560_update_led(struct rt2560_softc *sc, int led1, int led2)
2392{
2393	uint32_t tmp;
2394
2395	/* set ON period to 70ms and OFF period to 30ms */
2396	tmp = led1 << 16 | led2 << 17 | 70 << 8 | 30;
2397	RAL_WRITE(sc, RT2560_LEDCSR, tmp);
2398}
2399
2400void
2401rt2560_set_bssid(struct rt2560_softc *sc, uint8_t *bssid)
2402{
2403	uint32_t tmp;
2404
2405	tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
2406	RAL_WRITE(sc, RT2560_CSR5, tmp);
2407
2408	tmp = bssid[4] | bssid[5] << 8;
2409	RAL_WRITE(sc, RT2560_CSR6, tmp);
2410
2411	DPRINTF(("setting BSSID to %s\n", ether_sprintf(bssid)));
2412}
2413
2414void
2415rt2560_set_macaddr(struct rt2560_softc *sc, uint8_t *addr)
2416{
2417	uint32_t tmp;
2418
2419	tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
2420	RAL_WRITE(sc, RT2560_CSR3, tmp);
2421
2422	tmp = addr[4] | addr[5] << 8;
2423	RAL_WRITE(sc, RT2560_CSR4, tmp);
2424
2425	DPRINTF(("setting MAC address to %s\n", ether_sprintf(addr)));
2426}
2427
2428void
2429rt2560_get_macaddr(struct rt2560_softc *sc, uint8_t *addr)
2430{
2431	uint32_t tmp;
2432
2433	tmp = RAL_READ(sc, RT2560_CSR3);
2434	addr[0] = tmp & 0xff;
2435	addr[1] = (tmp >>  8) & 0xff;
2436	addr[2] = (tmp >> 16) & 0xff;
2437	addr[3] = (tmp >> 24);
2438
2439	tmp = RAL_READ(sc, RT2560_CSR4);
2440	addr[4] = tmp & 0xff;
2441	addr[5] = (tmp >> 8) & 0xff;
2442}
2443
2444void
2445rt2560_update_promisc(struct rt2560_softc *sc)
2446{
2447	struct ifnet *ifp = &sc->sc_ic.ic_if;
2448	uint32_t tmp;
2449
2450	tmp = RAL_READ(sc, RT2560_RXCSR0);
2451
2452	tmp &= ~RT2560_DROP_NOT_TO_ME;
2453	if (!(ifp->if_flags & IFF_PROMISC))
2454		tmp |= RT2560_DROP_NOT_TO_ME;
2455
2456	RAL_WRITE(sc, RT2560_RXCSR0, tmp);
2457
2458	DPRINTF(("%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
2459	    "entering" : "leaving"));
2460}
2461
2462void
2463rt2560_set_txantenna(struct rt2560_softc *sc, int antenna)
2464{
2465	uint32_t tmp;
2466	uint8_t tx;
2467
2468	tx = rt2560_bbp_read(sc, RT2560_BBP_TX) & ~RT2560_BBP_ANTMASK;
2469	if (antenna == 1)
2470		tx |= RT2560_BBP_ANTA;
2471	else if (antenna == 2)
2472		tx |= RT2560_BBP_ANTB;
2473	else
2474		tx |= RT2560_BBP_DIVERSITY;
2475
2476	/* need to force I/Q flip for RF 2525e, 2526 and 5222 */
2477	if (sc->rf_rev == RT2560_RF_2525E || sc->rf_rev == RT2560_RF_2526 ||
2478	    sc->rf_rev == RT2560_RF_5222)
2479		tx |= RT2560_BBP_FLIPIQ;
2480
2481	rt2560_bbp_write(sc, RT2560_BBP_TX, tx);
2482
2483	/* update values for CCK and OFDM in BBPCSR1 */
2484	tmp = RAL_READ(sc, RT2560_BBPCSR1) & ~0x00070007;
2485	tmp |= (tx & 0x7) << 16 | (tx & 0x7);
2486	RAL_WRITE(sc, RT2560_BBPCSR1, tmp);
2487}
2488
2489void
2490rt2560_set_rxantenna(struct rt2560_softc *sc, int antenna)
2491{
2492	uint8_t rx;
2493
2494	rx = rt2560_bbp_read(sc, RT2560_BBP_RX) & ~RT2560_BBP_ANTMASK;
2495	if (antenna == 1)
2496		rx |= RT2560_BBP_ANTA;
2497	else if (antenna == 2)
2498		rx |= RT2560_BBP_ANTB;
2499	else
2500		rx |= RT2560_BBP_DIVERSITY;
2501
2502	/* need to force no I/Q flip for RF 2525e and 2526 */
2503	if (sc->rf_rev == RT2560_RF_2525E || sc->rf_rev == RT2560_RF_2526)
2504		rx &= ~RT2560_BBP_FLIPIQ;
2505
2506	rt2560_bbp_write(sc, RT2560_BBP_RX, rx);
2507}
2508
2509const char *
2510rt2560_get_rf(int rev)
2511{
2512	switch (rev) {
2513	case RT2560_RF_2522:	return "RT2522";
2514	case RT2560_RF_2523:	return "RT2523";
2515	case RT2560_RF_2524:	return "RT2524";
2516	case RT2560_RF_2525:	return "RT2525";
2517	case RT2560_RF_2525E:	return "RT2525e";
2518	case RT2560_RF_2526:	return "RT2526";
2519	case RT2560_RF_5222:	return "RT5222";
2520	default:		return "unknown";
2521	}
2522}
2523
2524void
2525rt2560_read_eeprom(struct rt2560_softc *sc)
2526{
2527	uint16_t val;
2528	int i;
2529
2530	val = rt2560_eeprom_read(sc, RT2560_EEPROM_CONFIG0);
2531	sc->rf_rev =   (val >> 11) & 0x1f;
2532	sc->hw_radio = (val >> 10) & 0x1;
2533	sc->led_mode = (val >> 6)  & 0x7;
2534	sc->rx_ant =   (val >> 4)  & 0x3;
2535	sc->tx_ant =   (val >> 2)  & 0x3;
2536	sc->nb_ant =   val & 0x3;
2537
2538	/* read default values for BBP registers */
2539	for (i = 0; i < 16; i++) {
2540		val = rt2560_eeprom_read(sc, RT2560_EEPROM_BBP_BASE + i);
2541		sc->bbp_prom[i].reg = val >> 8;
2542		sc->bbp_prom[i].val = val & 0xff;
2543	}
2544
2545	/* read Tx power for all b/g channels */
2546	for (i = 0; i < 14 / 2; i++) {
2547		val = rt2560_eeprom_read(sc, RT2560_EEPROM_TXPOWER + i);
2548		sc->txpow[i * 2] = val >> 8;
2549		sc->txpow[i * 2 + 1] = val & 0xff;
2550	}
2551}
2552
2553int
2554rt2560_bbp_init(struct rt2560_softc *sc)
2555{
2556	int i, ntries;
2557
2558	/* wait for BBP to be ready */
2559	for (ntries = 0; ntries < 100; ntries++) {
2560		if (rt2560_bbp_read(sc, RT2560_BBP_VERSION) != 0)
2561			break;
2562		DELAY(1);
2563	}
2564	if (ntries == 100) {
2565		printf("%s: timeout waiting for BBP\n", sc->sc_dev.dv_xname);
2566		return EIO;
2567	}
2568
2569	/* initialize BBP registers to default values */
2570	for (i = 0; i < nitems(rt2560_def_bbp); i++) {
2571		rt2560_bbp_write(sc, rt2560_def_bbp[i].reg,
2572		    rt2560_def_bbp[i].val);
2573	}
2574#if 0
2575	/* initialize BBP registers to values stored in EEPROM */
2576	for (i = 0; i < 16; i++) {
2577		if (sc->bbp_prom[i].reg == 0xff)
2578			continue;
2579		rt2560_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
2580	}
2581#endif
2582
2583	return 0;
2584}
2585
2586int
2587rt2560_init(struct ifnet *ifp)
2588{
2589	struct rt2560_softc *sc = ifp->if_softc;
2590	struct ieee80211com *ic = &sc->sc_ic;
2591	uint32_t tmp;
2592	int i;
2593
2594	/* for CardBus, power on the socket */
2595	if (!(sc->sc_flags & RT2560_ENABLED)) {
2596		if (sc->sc_enable != NULL && (*sc->sc_enable)(sc) != 0) {
2597			printf("%s: could not enable device\n",
2598			    sc->sc_dev.dv_xname);
2599			return EIO;
2600		}
2601		sc->sc_flags |= RT2560_ENABLED;
2602	}
2603
2604	rt2560_stop(ifp, 0);
2605
2606	/* setup tx rings */
2607	tmp = RT2560_PRIO_RING_COUNT << 24 |
2608	      RT2560_ATIM_RING_COUNT << 16 |
2609	      RT2560_TX_RING_COUNT   <<  8 |
2610	      RT2560_TX_DESC_SIZE;
2611
2612	/* rings _must_ be initialized in this _exact_ order! */
2613	RAL_WRITE(sc, RT2560_TXCSR2, tmp);
2614	RAL_WRITE(sc, RT2560_TXCSR3, sc->txq.physaddr);
2615	RAL_WRITE(sc, RT2560_TXCSR5, sc->prioq.physaddr);
2616	RAL_WRITE(sc, RT2560_TXCSR4, sc->atimq.physaddr);
2617	RAL_WRITE(sc, RT2560_TXCSR6, sc->bcnq.physaddr);
2618
2619	/* setup rx ring */
2620	tmp = RT2560_RX_RING_COUNT << 8 | RT2560_RX_DESC_SIZE;
2621
2622	RAL_WRITE(sc, RT2560_RXCSR1, tmp);
2623	RAL_WRITE(sc, RT2560_RXCSR2, sc->rxq.physaddr);
2624
2625	/* initialize MAC registers to default values */
2626	for (i = 0; i < nitems(rt2560_def_mac); i++)
2627		RAL_WRITE(sc, rt2560_def_mac[i].reg, rt2560_def_mac[i].val);
2628
2629	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
2630	rt2560_set_macaddr(sc, ic->ic_myaddr);
2631
2632	/* set basic rate set (will be updated later) */
2633	RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x153);
2634
2635	rt2560_set_txantenna(sc, 1);
2636	rt2560_set_rxantenna(sc, 1);
2637	rt2560_set_slottime(sc);
2638	rt2560_update_plcp(sc);
2639	rt2560_update_led(sc, 0, 0);
2640
2641	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
2642	RAL_WRITE(sc, RT2560_CSR1, RT2560_HOST_READY);
2643
2644	if (rt2560_bbp_init(sc) != 0) {
2645		rt2560_stop(ifp, 1);
2646		return EIO;
2647	}
2648
2649	/* set default BSS channel */
2650	ic->ic_bss->ni_chan = ic->ic_ibss_chan;
2651	rt2560_set_chan(sc, ic->ic_bss->ni_chan);
2652
2653	/* kick Rx */
2654	tmp = RT2560_DROP_PHY_ERROR | RT2560_DROP_CRC_ERROR;
2655	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2656		tmp |= RT2560_DROP_CTL | RT2560_DROP_VERSION_ERROR;
2657#ifndef IEEE80211_STA_ONLY
2658		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
2659#endif
2660			tmp |= RT2560_DROP_TODS;
2661		if (!(ifp->if_flags & IFF_PROMISC))
2662			tmp |= RT2560_DROP_NOT_TO_ME;
2663	}
2664	RAL_WRITE(sc, RT2560_RXCSR0, tmp);
2665
2666	/* clear old FCS and Rx FIFO errors */
2667	RAL_READ(sc, RT2560_CNT0);
2668	RAL_READ(sc, RT2560_CNT4);
2669
2670	/* clear any pending interrupts */
2671	RAL_WRITE(sc, RT2560_CSR7, 0xffffffff);
2672
2673	/* enable interrupts */
2674	RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
2675
2676	ifp->if_flags &= ~IFF_OACTIVE;
2677	ifp->if_flags |= IFF_RUNNING;
2678
2679	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2680		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2681	else
2682		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2683
2684	return 0;
2685}
2686
2687void
2688rt2560_stop(struct ifnet *ifp, int disable)
2689{
2690	struct rt2560_softc *sc = ifp->if_softc;
2691	struct ieee80211com *ic = &sc->sc_ic;
2692
2693	sc->sc_tx_timer = 0;
2694	ifp->if_timer = 0;
2695	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2696
2697	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);	/* free all nodes */
2698
2699	/* abort Tx */
2700	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_ABORT_TX);
2701
2702	/* disable Rx */
2703	RAL_WRITE(sc, RT2560_RXCSR0, RT2560_DISABLE_RX);
2704
2705	/* reset ASIC (and thus, BBP) */
2706	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
2707	RAL_WRITE(sc, RT2560_CSR1, 0);
2708
2709	/* disable interrupts */
2710	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
2711
2712	/* clear any pending interrupt */
2713	RAL_WRITE(sc, RT2560_CSR7, 0xffffffff);
2714
2715	/* reset Tx and Rx rings */
2716	rt2560_reset_tx_ring(sc, &sc->txq);
2717	rt2560_reset_tx_ring(sc, &sc->atimq);
2718	rt2560_reset_tx_ring(sc, &sc->prioq);
2719	rt2560_reset_tx_ring(sc, &sc->bcnq);
2720	rt2560_reset_rx_ring(sc, &sc->rxq);
2721
2722	/* for CardBus, power down the socket */
2723	if (disable && sc->sc_disable != NULL) {
2724		if (sc->sc_flags & RT2560_ENABLED) {
2725			(*sc->sc_disable)(sc);
2726			sc->sc_flags &= ~RT2560_ENABLED;
2727		}
2728	}
2729}
2730
2731void
2732rt2560_power(int why, void *arg)
2733{
2734	struct rt2560_softc *sc = arg;
2735	struct ifnet *ifp = &sc->sc_ic.ic_if;
2736	int s;
2737
2738	s = splnet();
2739	switch (why) {
2740	case PWR_SUSPEND:
2741	case PWR_STANDBY:
2742		rt2560_stop(ifp, 0);
2743		if (sc->sc_power != NULL)
2744			(*sc->sc_power)(sc, why);
2745		break;
2746	case PWR_RESUME:
2747		if (ifp->if_flags & IFF_UP) {
2748			rt2560_init(ifp);
2749			if (sc->sc_power != NULL)
2750				(*sc->sc_power)(sc, why);
2751		}
2752		break;
2753	}
2754	splx(s);
2755}
2756
2757struct cfdriver ral_cd = {
2758	NULL, "ral", DV_IFNET
2759};
2760