rt2560.c revision 1.56
1/*	$OpenBSD: rt2560.c,v 1.56 2010/09/06 19:20:21 deraadt Exp $  */
2
3/*-
4 * Copyright (c) 2005, 2006
5 *	Damien Bergamini <damien.bergamini@free.fr>
6 *
7 * Permission to use, copy, modify, and distribute this software for any
8 * purpose with or without fee is hereby granted, provided that the above
9 * copyright notice and this permission notice appear in all copies.
10 *
11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18 */
19
20/*-
21 * Ralink Technology RT2560 chipset driver
22 * http://www.ralinktech.com/
23 */
24
25#include "bpfilter.h"
26
27#include <sys/param.h>
28#include <sys/sockio.h>
29#include <sys/mbuf.h>
30#include <sys/kernel.h>
31#include <sys/socket.h>
32#include <sys/systm.h>
33#include <sys/malloc.h>
34#include <sys/timeout.h>
35#include <sys/conf.h>
36#include <sys/device.h>
37
38#include <machine/bus.h>
39#include <machine/endian.h>
40#include <machine/intr.h>
41
42#if NBPFILTER > 0
43#include <net/bpf.h>
44#endif
45#include <net/if.h>
46#include <net/if_arp.h>
47#include <net/if_dl.h>
48#include <net/if_media.h>
49#include <net/if_types.h>
50
51#include <netinet/in.h>
52#include <netinet/in_systm.h>
53#include <netinet/in_var.h>
54#include <netinet/if_ether.h>
55#include <netinet/ip.h>
56
57#include <net80211/ieee80211_var.h>
58#include <net80211/ieee80211_amrr.h>
59#include <net80211/ieee80211_radiotap.h>
60
61#include <dev/ic/rt2560reg.h>
62#include <dev/ic/rt2560var.h>
63
64#include <dev/pci/pcireg.h>
65#include <dev/pci/pcivar.h>
66#include <dev/pci/pcidevs.h>
67
68#ifdef RAL_DEBUG
69#define DPRINTF(x)	do { if (rt2560_debug > 0) printf x; } while (0)
70#define DPRINTFN(n, x)	do { if (rt2560_debug >= (n)) printf x; } while (0)
71int rt2560_debug = 1;
72#else
73#define DPRINTF(x)
74#define DPRINTFN(n, x)
75#endif
76
77int		rt2560_alloc_tx_ring(struct rt2560_softc *,
78		    struct rt2560_tx_ring *, int);
79void		rt2560_reset_tx_ring(struct rt2560_softc *,
80		    struct rt2560_tx_ring *);
81void		rt2560_free_tx_ring(struct rt2560_softc *,
82		    struct rt2560_tx_ring *);
83int		rt2560_alloc_rx_ring(struct rt2560_softc *,
84		    struct rt2560_rx_ring *, int);
85void		rt2560_reset_rx_ring(struct rt2560_softc *,
86		    struct rt2560_rx_ring *);
87void		rt2560_free_rx_ring(struct rt2560_softc *,
88		    struct rt2560_rx_ring *);
89struct		ieee80211_node *rt2560_node_alloc(struct ieee80211com *);
90int		rt2560_media_change(struct ifnet *);
91void		rt2560_next_scan(void *);
92void		rt2560_iter_func(void *, struct ieee80211_node *);
93void		rt2560_amrr_timeout(void *);
94void		rt2560_newassoc(struct ieee80211com *, struct ieee80211_node *,
95		    int);
96int		rt2560_newstate(struct ieee80211com *, enum ieee80211_state,
97		    int);
98uint16_t	rt2560_eeprom_read(struct rt2560_softc *, uint8_t);
99void		rt2560_encryption_intr(struct rt2560_softc *);
100void		rt2560_tx_intr(struct rt2560_softc *);
101void		rt2560_prio_intr(struct rt2560_softc *);
102void		rt2560_decryption_intr(struct rt2560_softc *);
103void		rt2560_rx_intr(struct rt2560_softc *);
104#ifndef IEEE80211_STA_ONLY
105void		rt2560_beacon_expire(struct rt2560_softc *);
106#endif
107void		rt2560_wakeup_expire(struct rt2560_softc *);
108#if NBPFILTER > 0
109uint8_t		rt2560_rxrate(const struct rt2560_rx_desc *);
110#endif
111int		rt2560_ack_rate(struct ieee80211com *, int);
112uint16_t	rt2560_txtime(int, int, uint32_t);
113uint8_t		rt2560_plcp_signal(int);
114void		rt2560_setup_tx_desc(struct rt2560_softc *,
115		    struct rt2560_tx_desc *, uint32_t, int, int, int,
116		    bus_addr_t);
117#ifndef IEEE80211_STA_ONLY
118int		rt2560_tx_bcn(struct rt2560_softc *, struct mbuf *,
119		    struct ieee80211_node *);
120#endif
121int		rt2560_tx_mgt(struct rt2560_softc *, struct mbuf *,
122		    struct ieee80211_node *);
123int		rt2560_tx_data(struct rt2560_softc *, struct mbuf *,
124		    struct ieee80211_node *);
125void		rt2560_start(struct ifnet *);
126void		rt2560_watchdog(struct ifnet *);
127int		rt2560_ioctl(struct ifnet *, u_long, caddr_t);
128void		rt2560_bbp_write(struct rt2560_softc *, uint8_t, uint8_t);
129uint8_t		rt2560_bbp_read(struct rt2560_softc *, uint8_t);
130void		rt2560_rf_write(struct rt2560_softc *, uint8_t, uint32_t);
131void		rt2560_set_chan(struct rt2560_softc *,
132		    struct ieee80211_channel *);
133void		rt2560_disable_rf_tune(struct rt2560_softc *);
134void		rt2560_enable_tsf_sync(struct rt2560_softc *);
135void		rt2560_update_plcp(struct rt2560_softc *);
136void		rt2560_updateslot(struct ieee80211com *);
137void		rt2560_set_slottime(struct rt2560_softc *);
138void		rt2560_set_basicrates(struct rt2560_softc *);
139void		rt2560_update_led(struct rt2560_softc *, int, int);
140void		rt2560_set_bssid(struct rt2560_softc *, uint8_t *);
141void		rt2560_set_macaddr(struct rt2560_softc *, uint8_t *);
142void		rt2560_get_macaddr(struct rt2560_softc *, uint8_t *);
143void		rt2560_update_promisc(struct rt2560_softc *);
144void		rt2560_set_txantenna(struct rt2560_softc *, int);
145void		rt2560_set_rxantenna(struct rt2560_softc *, int);
146const char	*rt2560_get_rf(int);
147void		rt2560_read_eeprom(struct rt2560_softc *);
148int		rt2560_bbp_init(struct rt2560_softc *);
149int		rt2560_init(struct ifnet *);
150void		rt2560_stop(struct ifnet *, int);
151void		rt2560_powerhook(int, void *);
152
153static const struct {
154	uint32_t	reg;
155	uint32_t	val;
156} rt2560_def_mac[] = {
157	RT2560_DEF_MAC
158};
159
160static const struct {
161	uint8_t	reg;
162	uint8_t	val;
163} rt2560_def_bbp[] = {
164	RT2560_DEF_BBP
165};
166
167static const uint32_t rt2560_rf2522_r2[]    = RT2560_RF2522_R2;
168static const uint32_t rt2560_rf2523_r2[]    = RT2560_RF2523_R2;
169static const uint32_t rt2560_rf2524_r2[]    = RT2560_RF2524_R2;
170static const uint32_t rt2560_rf2525_r2[]    = RT2560_RF2525_R2;
171static const uint32_t rt2560_rf2525_hi_r2[] = RT2560_RF2525_HI_R2;
172static const uint32_t rt2560_rf2525e_r2[]   = RT2560_RF2525E_R2;
173static const uint32_t rt2560_rf2526_r2[]    = RT2560_RF2526_R2;
174static const uint32_t rt2560_rf2526_hi_r2[] = RT2560_RF2526_HI_R2;
175
176int
177rt2560_attach(void *xsc, int id)
178{
179	struct rt2560_softc *sc = xsc;
180	struct ieee80211com *ic = &sc->sc_ic;
181	struct ifnet *ifp = &ic->ic_if;
182	int error, i;
183
184	sc->amrr.amrr_min_success_threshold =  1;
185	sc->amrr.amrr_max_success_threshold = 15;
186	timeout_set(&sc->amrr_to, rt2560_amrr_timeout, sc);
187	timeout_set(&sc->scan_to, rt2560_next_scan, sc);
188
189	/* retrieve RT2560 rev. no */
190	sc->asic_rev = RAL_READ(sc, RT2560_CSR0);
191
192	/* retrieve MAC address */
193	rt2560_get_macaddr(sc, ic->ic_myaddr);
194	printf(", address %s\n", ether_sprintf(ic->ic_myaddr));
195
196	/* retrieve RF rev. no and various other things from EEPROM */
197	rt2560_read_eeprom(sc);
198
199	printf("%s: MAC/BBP RT2560 (rev 0x%02x), RF %s\n", sc->sc_dev.dv_xname,
200	    sc->asic_rev, rt2560_get_rf(sc->rf_rev));
201
202	/*
203	 * Allocate Tx and Rx rings.
204	 */
205	error = rt2560_alloc_tx_ring(sc, &sc->txq, RT2560_TX_RING_COUNT);
206	if (error != 0) {
207		printf("%s: could not allocate Tx ring\n",
208		    sc->sc_dev.dv_xname);
209		goto fail1;
210	}
211	error = rt2560_alloc_tx_ring(sc, &sc->atimq, RT2560_ATIM_RING_COUNT);
212	if (error != 0) {
213		printf("%s: could not allocate ATIM ring\n",
214		    sc->sc_dev.dv_xname);
215		goto fail2;
216	}
217	error = rt2560_alloc_tx_ring(sc, &sc->prioq, RT2560_PRIO_RING_COUNT);
218	if (error != 0) {
219		printf("%s: could not allocate Prio ring\n",
220		    sc->sc_dev.dv_xname);
221		goto fail3;
222	}
223	error = rt2560_alloc_tx_ring(sc, &sc->bcnq, RT2560_BEACON_RING_COUNT);
224	if (error != 0) {
225		printf("%s: could not allocate Beacon ring\n",
226		    sc->sc_dev.dv_xname);
227		goto fail4;
228	}
229	error = rt2560_alloc_rx_ring(sc, &sc->rxq, RT2560_RX_RING_COUNT);
230	if (error != 0) {
231		printf("%s: could not allocate Rx ring\n",
232		    sc->sc_dev.dv_xname);
233		goto fail5;
234	}
235
236	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
237	ic->ic_opmode = IEEE80211_M_STA; /* default to BSS mode */
238	ic->ic_state = IEEE80211_S_INIT;
239
240	/* set device capabilities */
241	ic->ic_caps =
242	    IEEE80211_C_MONITOR |	/* monitor mode supported */
243#ifndef IEEE80211_STA_ONLY
244	    IEEE80211_C_IBSS |		/* IBSS mode supported */
245	    IEEE80211_C_HOSTAP |	/* HostAp mode supported */
246#endif
247	    IEEE80211_C_TXPMGT |	/* tx power management */
248	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
249	    IEEE80211_C_SHSLOT |	/* short slot time supported */
250	    IEEE80211_C_WEP |		/* s/w WEP */
251	    IEEE80211_C_RSN;		/* WPA/RSN */
252
253	/* set supported .11b and .11g rates */
254	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
255	ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g;
256
257	/* set supported .11b and .11g channels (1 through 14) */
258	for (i = 1; i <= 14; i++) {
259		ic->ic_channels[i].ic_freq =
260		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
261		ic->ic_channels[i].ic_flags =
262		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
263		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
264	}
265
266	ifp->if_softc = sc;
267	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
268	ifp->if_ioctl = rt2560_ioctl;
269	ifp->if_start = rt2560_start;
270	ifp->if_watchdog = rt2560_watchdog;
271	IFQ_SET_READY(&ifp->if_snd);
272	memcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
273
274	if_attach(ifp);
275	ieee80211_ifattach(ifp);
276	ic->ic_node_alloc = rt2560_node_alloc;
277	ic->ic_newassoc = rt2560_newassoc;
278	ic->ic_updateslot = rt2560_updateslot;
279
280	/* override state transition machine */
281	sc->sc_newstate = ic->ic_newstate;
282	ic->ic_newstate = rt2560_newstate;
283	ieee80211_media_init(ifp, rt2560_media_change, ieee80211_media_status);
284
285#if NBPFILTER > 0
286	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
287	    sizeof (struct ieee80211_frame) + 64);
288
289	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
290	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
291	sc->sc_rxtap.wr_ihdr.it_present = htole32(RT2560_RX_RADIOTAP_PRESENT);
292
293	sc->sc_txtap_len = sizeof sc->sc_txtapu;
294	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
295	sc->sc_txtap.wt_ihdr.it_present = htole32(RT2560_TX_RADIOTAP_PRESENT);
296#endif
297
298	sc->sc_powerhook = powerhook_establish(rt2560_powerhook, sc);
299	if (sc->sc_powerhook == NULL) {
300		printf("%s: WARNING: unable to establish power hook\n",
301		    sc->sc_dev.dv_xname);
302	}
303	return 0;
304
305fail5:	rt2560_free_tx_ring(sc, &sc->bcnq);
306fail4:	rt2560_free_tx_ring(sc, &sc->prioq);
307fail3:	rt2560_free_tx_ring(sc, &sc->atimq);
308fail2:	rt2560_free_tx_ring(sc, &sc->txq);
309fail1:	return ENXIO;
310}
311
312int
313rt2560_detach(void *xsc)
314{
315	struct rt2560_softc *sc = xsc;
316	struct ifnet *ifp = &sc->sc_ic.ic_if;
317
318	timeout_del(&sc->scan_to);
319	timeout_del(&sc->amrr_to);
320
321	if (sc->sc_powerhook != NULL)
322		powerhook_disestablish(sc->sc_powerhook);
323
324	ieee80211_ifdetach(ifp);	/* free all nodes */
325	if_detach(ifp);
326
327	rt2560_free_tx_ring(sc, &sc->txq);
328	rt2560_free_tx_ring(sc, &sc->atimq);
329	rt2560_free_tx_ring(sc, &sc->prioq);
330	rt2560_free_tx_ring(sc, &sc->bcnq);
331	rt2560_free_rx_ring(sc, &sc->rxq);
332
333	return 0;
334}
335
336void
337rt2560_suspend(void *xsc)
338{
339	struct rt2560_softc *sc = xsc;
340	struct ifnet *ifp = &sc->sc_ic.ic_if;
341
342	if (ifp->if_flags & IFF_RUNNING)
343		rt2560_stop(ifp, 1);
344}
345
346void
347rt2560_resume(void *xsc)
348{
349	struct rt2560_softc *sc = xsc;
350	struct ifnet *ifp = &sc->sc_ic.ic_if;
351
352	if (ifp->if_flags & IFF_UP)
353		rt2560_init(ifp);
354}
355
356int
357rt2560_alloc_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring,
358    int count)
359{
360	int i, nsegs, error;
361
362	ring->count = count;
363	ring->queued = 0;
364	ring->cur = ring->next = 0;
365	ring->cur_encrypt = ring->next_encrypt = 0;
366
367	error = bus_dmamap_create(sc->sc_dmat, count * RT2560_TX_DESC_SIZE, 1,
368	    count * RT2560_TX_DESC_SIZE, 0, BUS_DMA_NOWAIT, &ring->map);
369	if (error != 0) {
370		printf("%s: could not create desc DMA map\n",
371		    sc->sc_dev.dv_xname);
372		goto fail;
373	}
374
375	error = bus_dmamem_alloc(sc->sc_dmat, count * RT2560_TX_DESC_SIZE,
376	    PAGE_SIZE, 0, &ring->seg, 1, &nsegs, BUS_DMA_NOWAIT | BUS_DMA_ZERO);
377	if (error != 0) {
378		printf("%s: could not allocate DMA memory\n",
379		    sc->sc_dev.dv_xname);
380		goto fail;
381	}
382
383	error = bus_dmamem_map(sc->sc_dmat, &ring->seg, nsegs,
384	    count * RT2560_TX_DESC_SIZE, (caddr_t *)&ring->desc,
385	    BUS_DMA_NOWAIT);
386	if (error != 0) {
387		printf("%s: can't map desc DMA memory\n",
388		    sc->sc_dev.dv_xname);
389		goto fail;
390	}
391
392	error = bus_dmamap_load(sc->sc_dmat, ring->map, ring->desc,
393	    count * RT2560_TX_DESC_SIZE, NULL, BUS_DMA_NOWAIT);
394	if (error != 0) {
395		printf("%s: could not load desc DMA map\n",
396		    sc->sc_dev.dv_xname);
397		goto fail;
398	}
399
400	ring->physaddr = ring->map->dm_segs->ds_addr;
401
402	ring->data = malloc(count * sizeof (struct rt2560_tx_data), M_DEVBUF,
403	    M_NOWAIT | M_ZERO);
404	if (ring->data == NULL) {
405		printf("%s: could not allocate soft data\n",
406		    sc->sc_dev.dv_xname);
407		error = ENOMEM;
408		goto fail;
409	}
410
411	for (i = 0; i < count; i++) {
412		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,
413		    RT2560_MAX_SCATTER, MCLBYTES, 0, BUS_DMA_NOWAIT,
414		    &ring->data[i].map);
415		if (error != 0) {
416			printf("%s: could not create DMA map\n",
417			    sc->sc_dev.dv_xname);
418			goto fail;
419		}
420	}
421
422	return 0;
423
424fail:	rt2560_free_tx_ring(sc, ring);
425	return error;
426}
427
428void
429rt2560_reset_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring)
430{
431	int i;
432
433	for (i = 0; i < ring->count; i++) {
434		struct rt2560_tx_desc *desc = &ring->desc[i];
435		struct rt2560_tx_data *data = &ring->data[i];
436
437		if (data->m != NULL) {
438			bus_dmamap_sync(sc->sc_dmat, data->map, 0,
439			    data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
440			bus_dmamap_unload(sc->sc_dmat, data->map);
441			m_freem(data->m);
442			data->m = NULL;
443		}
444
445		/*
446		 * The node has already been freed at that point so don't call
447		 * ieee80211_release_node() here.
448		 */
449		data->ni = NULL;
450
451		desc->flags = 0;
452	}
453
454	bus_dmamap_sync(sc->sc_dmat, ring->map, 0, ring->map->dm_mapsize,
455	    BUS_DMASYNC_PREWRITE);
456
457	ring->queued = 0;
458	ring->cur = ring->next = 0;
459	ring->cur_encrypt = ring->next_encrypt = 0;
460}
461
462void
463rt2560_free_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring)
464{
465	int i;
466
467	if (ring->desc != NULL) {
468		bus_dmamap_sync(sc->sc_dmat, ring->map, 0,
469		    ring->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
470		bus_dmamap_unload(sc->sc_dmat, ring->map);
471		bus_dmamem_unmap(sc->sc_dmat, (caddr_t)ring->desc,
472		    ring->count * RT2560_TX_DESC_SIZE);
473		bus_dmamem_free(sc->sc_dmat, &ring->seg, 1);
474	}
475
476	if (ring->data != NULL) {
477		for (i = 0; i < ring->count; i++) {
478			struct rt2560_tx_data *data = &ring->data[i];
479
480			if (data->m != NULL) {
481				bus_dmamap_sync(sc->sc_dmat, data->map, 0,
482				    data->map->dm_mapsize,
483				    BUS_DMASYNC_POSTWRITE);
484				bus_dmamap_unload(sc->sc_dmat, data->map);
485				m_freem(data->m);
486			}
487
488			/*
489			 * The node has already been freed at that point so
490			 * don't call ieee80211_release_node() here.
491			 */
492			data->ni = NULL;
493
494			if (data->map != NULL)
495				bus_dmamap_destroy(sc->sc_dmat, data->map);
496		}
497		free(ring->data, M_DEVBUF);
498	}
499}
500
501int
502rt2560_alloc_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring,
503    int count)
504{
505	int i, nsegs, error;
506
507	ring->count = count;
508	ring->cur = ring->next = 0;
509	ring->cur_decrypt = 0;
510
511	error = bus_dmamap_create(sc->sc_dmat, count * RT2560_RX_DESC_SIZE, 1,
512	    count * RT2560_RX_DESC_SIZE, 0, BUS_DMA_NOWAIT, &ring->map);
513	if (error != 0) {
514		printf("%s: could not create desc DMA map\n",
515		    sc->sc_dev.dv_xname);
516		goto fail;
517	}
518
519	error = bus_dmamem_alloc(sc->sc_dmat, count * RT2560_RX_DESC_SIZE,
520	    PAGE_SIZE, 0, &ring->seg, 1, &nsegs, BUS_DMA_NOWAIT | BUS_DMA_ZERO);
521	if (error != 0) {
522		printf("%s: could not allocate DMA memory\n",
523		    sc->sc_dev.dv_xname);
524		goto fail;
525	}
526
527	error = bus_dmamem_map(sc->sc_dmat, &ring->seg, nsegs,
528	    count * RT2560_RX_DESC_SIZE, (caddr_t *)&ring->desc,
529	    BUS_DMA_NOWAIT);
530	if (error != 0) {
531		printf("%s: can't map desc DMA memory\n",
532		    sc->sc_dev.dv_xname);
533		goto fail;
534	}
535
536	error = bus_dmamap_load(sc->sc_dmat, ring->map, ring->desc,
537	    count * RT2560_RX_DESC_SIZE, NULL, BUS_DMA_NOWAIT);
538	if (error != 0) {
539		printf("%s: could not load desc DMA map\n",
540		    sc->sc_dev.dv_xname);
541		goto fail;
542	}
543
544	ring->physaddr = ring->map->dm_segs->ds_addr;
545
546	ring->data = malloc(count * sizeof (struct rt2560_rx_data), M_DEVBUF,
547	    M_NOWAIT | M_ZERO);
548	if (ring->data == NULL) {
549		printf("%s: could not allocate soft data\n",
550		    sc->sc_dev.dv_xname);
551		error = ENOMEM;
552		goto fail;
553	}
554
555	/*
556	 * Pre-allocate Rx buffers and populate Rx ring.
557	 */
558	for (i = 0; i < count; i++) {
559		struct rt2560_rx_desc *desc = &sc->rxq.desc[i];
560		struct rt2560_rx_data *data = &sc->rxq.data[i];
561
562		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
563		    0, BUS_DMA_NOWAIT, &data->map);
564		if (error != 0) {
565			printf("%s: could not create DMA map\n",
566			    sc->sc_dev.dv_xname);
567			goto fail;
568		}
569
570		MGETHDR(data->m, M_DONTWAIT, MT_DATA);
571		if (data->m == NULL) {
572			printf("%s: could not allocate rx mbuf\n",
573			    sc->sc_dev.dv_xname);
574			error = ENOMEM;
575			goto fail;
576		}
577		MCLGET(data->m, M_DONTWAIT);
578		if (!(data->m->m_flags & M_EXT)) {
579			printf("%s: could not allocate rx mbuf cluster\n",
580			    sc->sc_dev.dv_xname);
581			error = ENOMEM;
582			goto fail;
583		}
584
585		error = bus_dmamap_load(sc->sc_dmat, data->map,
586		    mtod(data->m, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
587		if (error != 0) {
588			printf("%s: could not load rx buf DMA map",
589			    sc->sc_dev.dv_xname);
590			goto fail;
591		}
592
593		desc->flags = htole32(RT2560_RX_BUSY);
594		desc->physaddr = htole32(data->map->dm_segs->ds_addr);
595	}
596
597	bus_dmamap_sync(sc->sc_dmat, ring->map, 0, ring->map->dm_mapsize,
598	    BUS_DMASYNC_PREWRITE);
599
600	return 0;
601
602fail:	rt2560_free_rx_ring(sc, ring);
603	return error;
604}
605
606void
607rt2560_reset_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring)
608{
609	int i;
610
611	for (i = 0; i < ring->count; i++) {
612		ring->desc[i].flags = htole32(RT2560_RX_BUSY);
613		ring->data[i].drop = 0;
614	}
615
616	bus_dmamap_sync(sc->sc_dmat, ring->map, 0, ring->map->dm_mapsize,
617	    BUS_DMASYNC_PREWRITE);
618
619	ring->cur = ring->next = 0;
620	ring->cur_decrypt = 0;
621}
622
623void
624rt2560_free_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring)
625{
626	int i;
627
628	if (ring->desc != NULL) {
629		bus_dmamap_sync(sc->sc_dmat, ring->map, 0,
630		    ring->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
631		bus_dmamap_unload(sc->sc_dmat, ring->map);
632		bus_dmamem_unmap(sc->sc_dmat, (caddr_t)ring->desc,
633		    ring->count * RT2560_RX_DESC_SIZE);
634		bus_dmamem_free(sc->sc_dmat, &ring->seg, 1);
635	}
636
637	if (ring->data != NULL) {
638		for (i = 0; i < ring->count; i++) {
639			struct rt2560_rx_data *data = &ring->data[i];
640
641			if (data->m != NULL) {
642				bus_dmamap_sync(sc->sc_dmat, data->map, 0,
643				    data->map->dm_mapsize,
644				    BUS_DMASYNC_POSTREAD);
645				bus_dmamap_unload(sc->sc_dmat, data->map);
646				m_freem(data->m);
647			}
648
649			if (data->map != NULL)
650				bus_dmamap_destroy(sc->sc_dmat, data->map);
651		}
652		free(ring->data, M_DEVBUF);
653	}
654}
655
656struct ieee80211_node *
657rt2560_node_alloc(struct ieee80211com *ic)
658{
659	return malloc(sizeof (struct rt2560_node), M_DEVBUF,
660	    M_NOWAIT | M_ZERO);
661}
662
663int
664rt2560_media_change(struct ifnet *ifp)
665{
666	int error;
667
668	error = ieee80211_media_change(ifp);
669	if (error != ENETRESET)
670		return error;
671
672	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
673		rt2560_init(ifp);
674
675	return 0;
676}
677
678/*
679 * This function is called periodically (every 200ms) during scanning to
680 * switch from one channel to another.
681 */
682void
683rt2560_next_scan(void *arg)
684{
685	struct rt2560_softc *sc = arg;
686	struct ieee80211com *ic = &sc->sc_ic;
687	struct ifnet *ifp = &ic->ic_if;
688	int s;
689
690	s = splnet();
691	if (ic->ic_state == IEEE80211_S_SCAN)
692		ieee80211_next_scan(ifp);
693	splx(s);
694}
695
696/*
697 * This function is called for each neighbor node.
698 */
699void
700rt2560_iter_func(void *arg, struct ieee80211_node *ni)
701{
702	struct rt2560_softc *sc = arg;
703	struct rt2560_node *rn = (struct rt2560_node *)ni;
704
705	ieee80211_amrr_choose(&sc->amrr, ni, &rn->amn);
706}
707
708void
709rt2560_amrr_timeout(void *arg)
710{
711	struct rt2560_softc *sc = arg;
712	struct ieee80211com *ic = &sc->sc_ic;
713	int s;
714
715	s = splnet();
716	if (ic->ic_opmode == IEEE80211_M_STA)
717		rt2560_iter_func(sc, ic->ic_bss);
718#ifndef IEEE80211_STA_ONLY
719	else
720		ieee80211_iterate_nodes(ic, rt2560_iter_func, sc);
721#endif
722	splx(s);
723
724	timeout_add_msec(&sc->amrr_to, 500);
725}
726
727void
728rt2560_newassoc(struct ieee80211com *ic, struct ieee80211_node *ni, int isnew)
729{
730	struct rt2560_softc *sc = ic->ic_softc;
731	int i;
732
733	ieee80211_amrr_node_init(&sc->amrr, &((struct rt2560_node *)ni)->amn);
734
735	/* set rate to some reasonable initial value */
736	for (i = ni->ni_rates.rs_nrates - 1;
737	     i > 0 && (ni->ni_rates.rs_rates[i] & IEEE80211_RATE_VAL) > 72;
738	     i--);
739	ni->ni_txrate = i;
740}
741
742int
743rt2560_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
744{
745	struct rt2560_softc *sc = ic->ic_if.if_softc;
746	enum ieee80211_state ostate;
747	struct ieee80211_node *ni;
748	int error = 0;
749
750	ostate = ic->ic_state;
751	timeout_del(&sc->scan_to);
752	timeout_del(&sc->amrr_to);
753
754	switch (nstate) {
755	case IEEE80211_S_INIT:
756		if (ostate == IEEE80211_S_RUN) {
757			/* abort TSF synchronization */
758			RAL_WRITE(sc, RT2560_CSR14, 0);
759
760			/* turn association led off */
761			rt2560_update_led(sc, 0, 0);
762		}
763		break;
764
765	case IEEE80211_S_SCAN:
766		rt2560_set_chan(sc, ic->ic_bss->ni_chan);
767		timeout_add_msec(&sc->scan_to, 200);
768		break;
769
770	case IEEE80211_S_AUTH:
771		rt2560_set_chan(sc, ic->ic_bss->ni_chan);
772		break;
773
774	case IEEE80211_S_ASSOC:
775		rt2560_set_chan(sc, ic->ic_bss->ni_chan);
776		break;
777
778	case IEEE80211_S_RUN:
779		rt2560_set_chan(sc, ic->ic_bss->ni_chan);
780
781		ni = ic->ic_bss;
782
783		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
784			rt2560_update_plcp(sc);
785			rt2560_set_slottime(sc);
786			rt2560_set_basicrates(sc);
787			rt2560_set_bssid(sc, ni->ni_bssid);
788		}
789
790#ifndef IEEE80211_STA_ONLY
791		if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
792		    ic->ic_opmode == IEEE80211_M_IBSS) {
793			struct mbuf *m = ieee80211_beacon_alloc(ic, ni);
794			if (m == NULL) {
795				printf("%s: could not allocate beacon\n",
796				    sc->sc_dev.dv_xname);
797				error = ENOBUFS;
798				break;
799			}
800
801			error = rt2560_tx_bcn(sc, m, ni);
802			if (error != 0)
803				break;
804		}
805#endif
806
807		/* turn assocation led on */
808		rt2560_update_led(sc, 1, 0);
809
810		if (ic->ic_opmode == IEEE80211_M_STA) {
811			/* fake a join to init the tx rate */
812			rt2560_newassoc(ic, ni, 1);
813		}
814
815		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
816			/* start automatic rate control timer */
817			if (ic->ic_fixed_rate == -1)
818				timeout_add_msec(&sc->amrr_to, 500);
819
820			rt2560_enable_tsf_sync(sc);
821		}
822		break;
823	}
824
825	return (error != 0) ? error : sc->sc_newstate(ic, nstate, arg);
826}
827
828/*
829 * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46 or
830 * 93C66).
831 */
832uint16_t
833rt2560_eeprom_read(struct rt2560_softc *sc, uint8_t addr)
834{
835	uint32_t tmp;
836	uint16_t val;
837	int n;
838
839	/* clock C once before the first command */
840	RT2560_EEPROM_CTL(sc, 0);
841
842	RT2560_EEPROM_CTL(sc, RT2560_S);
843	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
844	RT2560_EEPROM_CTL(sc, RT2560_S);
845
846	/* write start bit (1) */
847	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D);
848	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D | RT2560_C);
849
850	/* write READ opcode (10) */
851	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D);
852	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D | RT2560_C);
853	RT2560_EEPROM_CTL(sc, RT2560_S);
854	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
855
856	/* write address (A5-A0 or A7-A0) */
857	n = (RAL_READ(sc, RT2560_CSR21) & RT2560_93C46) ? 5 : 7;
858	for (; n >= 0; n--) {
859		RT2560_EEPROM_CTL(sc, RT2560_S |
860		    (((addr >> n) & 1) << RT2560_SHIFT_D));
861		RT2560_EEPROM_CTL(sc, RT2560_S |
862		    (((addr >> n) & 1) << RT2560_SHIFT_D) | RT2560_C);
863	}
864
865	RT2560_EEPROM_CTL(sc, RT2560_S);
866
867	/* read data Q15-Q0 */
868	val = 0;
869	for (n = 15; n >= 0; n--) {
870		RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
871		tmp = RAL_READ(sc, RT2560_CSR21);
872		val |= ((tmp & RT2560_Q) >> RT2560_SHIFT_Q) << n;
873		RT2560_EEPROM_CTL(sc, RT2560_S);
874	}
875
876	RT2560_EEPROM_CTL(sc, 0);
877
878	/* clear Chip Select and clock C */
879	RT2560_EEPROM_CTL(sc, RT2560_S);
880	RT2560_EEPROM_CTL(sc, 0);
881	RT2560_EEPROM_CTL(sc, RT2560_C);
882
883	return val;
884}
885
886/*
887 * Some frames were processed by the hardware cipher engine and are ready for
888 * transmission.
889 */
890void
891rt2560_encryption_intr(struct rt2560_softc *sc)
892{
893	int hw;
894
895	/* retrieve last descriptor index processed by cipher engine */
896	hw = (RAL_READ(sc, RT2560_SECCSR1) - sc->txq.physaddr) /
897	    RT2560_TX_DESC_SIZE;
898
899	for (; sc->txq.next_encrypt != hw;) {
900		struct rt2560_tx_desc *desc =
901		    &sc->txq.desc[sc->txq.next_encrypt];
902
903		bus_dmamap_sync(sc->sc_dmat, sc->txq.map,
904		    sc->txq.next_encrypt * RT2560_TX_DESC_SIZE,
905		    RT2560_TX_DESC_SIZE, BUS_DMASYNC_POSTREAD);
906
907		if (letoh32(desc->flags) &
908		    (RT2560_TX_BUSY | RT2560_TX_CIPHER_BUSY))
909			break;
910
911		/* for TKIP, swap eiv field to fix a bug in ASIC */
912		if ((letoh32(desc->flags) & RT2560_TX_CIPHER_MASK) ==
913		    RT2560_TX_CIPHER_TKIP)
914			desc->eiv = swap32(desc->eiv);
915
916		/* mark the frame ready for transmission */
917		desc->flags |= htole32(RT2560_TX_BUSY | RT2560_TX_VALID);
918
919		bus_dmamap_sync(sc->sc_dmat, sc->txq.map,
920		    sc->txq.next_encrypt * RT2560_TX_DESC_SIZE,
921		    RT2560_TX_DESC_SIZE, BUS_DMASYNC_PREWRITE);
922
923		DPRINTFN(15, ("encryption done idx=%u\n",
924		    sc->txq.next_encrypt));
925
926		sc->txq.next_encrypt =
927		    (sc->txq.next_encrypt + 1) % RT2560_TX_RING_COUNT;
928	}
929
930	/* kick Tx */
931	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_TX);
932}
933
934void
935rt2560_tx_intr(struct rt2560_softc *sc)
936{
937	struct ieee80211com *ic = &sc->sc_ic;
938	struct ifnet *ifp = &ic->ic_if;
939
940	for (;;) {
941		struct rt2560_tx_desc *desc = &sc->txq.desc[sc->txq.next];
942		struct rt2560_tx_data *data = &sc->txq.data[sc->txq.next];
943		struct rt2560_node *rn;
944
945		bus_dmamap_sync(sc->sc_dmat, sc->txq.map,
946		    sc->txq.next * RT2560_TX_DESC_SIZE, RT2560_TX_DESC_SIZE,
947		    BUS_DMASYNC_POSTREAD);
948
949		if ((letoh32(desc->flags) & RT2560_TX_BUSY) ||
950		    (letoh32(desc->flags) & RT2560_TX_CIPHER_BUSY) ||
951		    !(letoh32(desc->flags) & RT2560_TX_VALID))
952			break;
953
954		rn = (struct rt2560_node *)data->ni;
955
956		switch (letoh32(desc->flags) & RT2560_TX_RESULT_MASK) {
957		case RT2560_TX_SUCCESS:
958			DPRINTFN(10, ("data frame sent successfully\n"));
959			rn->amn.amn_txcnt++;
960			ifp->if_opackets++;
961			break;
962
963		case RT2560_TX_SUCCESS_RETRY:
964			DPRINTFN(9, ("data frame sent after %u retries\n",
965			    (letoh32(desc->flags) >> 5) & 0x7));
966			rn->amn.amn_txcnt++;
967			rn->amn.amn_retrycnt++;
968			ifp->if_opackets++;
969			break;
970
971		case RT2560_TX_FAIL_RETRY:
972			DPRINTFN(9, ("sending data frame failed (too much "
973			    "retries)\n"));
974			rn->amn.amn_txcnt++;
975			rn->amn.amn_retrycnt++;
976			ifp->if_oerrors++;
977			break;
978
979		case RT2560_TX_FAIL_INVALID:
980		case RT2560_TX_FAIL_OTHER:
981		default:
982			printf("%s: sending data frame failed 0x%08x\n",
983			    sc->sc_dev.dv_xname, letoh32(desc->flags));
984			ifp->if_oerrors++;
985		}
986
987		bus_dmamap_sync(sc->sc_dmat, data->map, 0,
988		    data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
989		bus_dmamap_unload(sc->sc_dmat, data->map);
990		m_freem(data->m);
991		data->m = NULL;
992		ieee80211_release_node(ic, data->ni);
993		data->ni = NULL;
994
995		/* descriptor is no longer valid */
996		desc->flags &= ~htole32(RT2560_TX_VALID);
997
998		bus_dmamap_sync(sc->sc_dmat, sc->txq.map,
999		    sc->txq.next * RT2560_TX_DESC_SIZE, RT2560_TX_DESC_SIZE,
1000		    BUS_DMASYNC_PREWRITE);
1001
1002		DPRINTFN(15, ("tx done idx=%u\n", sc->txq.next));
1003
1004		sc->txq.queued--;
1005		sc->txq.next = (sc->txq.next + 1) % RT2560_TX_RING_COUNT;
1006	}
1007
1008	sc->sc_tx_timer = 0;
1009	ifp->if_flags &= ~IFF_OACTIVE;
1010	rt2560_start(ifp);
1011}
1012
1013void
1014rt2560_prio_intr(struct rt2560_softc *sc)
1015{
1016	struct ieee80211com *ic = &sc->sc_ic;
1017	struct ifnet *ifp = &ic->ic_if;
1018
1019	for (;;) {
1020		struct rt2560_tx_desc *desc = &sc->prioq.desc[sc->prioq.next];
1021		struct rt2560_tx_data *data = &sc->prioq.data[sc->prioq.next];
1022
1023		bus_dmamap_sync(sc->sc_dmat, sc->prioq.map,
1024		    sc->prioq.next * RT2560_TX_DESC_SIZE, RT2560_TX_DESC_SIZE,
1025		    BUS_DMASYNC_POSTREAD);
1026
1027		if ((letoh32(desc->flags) & RT2560_TX_BUSY) ||
1028		    !(letoh32(desc->flags) & RT2560_TX_VALID))
1029			break;
1030
1031		switch (letoh32(desc->flags) & RT2560_TX_RESULT_MASK) {
1032		case RT2560_TX_SUCCESS:
1033			DPRINTFN(10, ("mgt frame sent successfully\n"));
1034			break;
1035
1036		case RT2560_TX_SUCCESS_RETRY:
1037			DPRINTFN(9, ("mgt frame sent after %u retries\n",
1038			    (letoh32(desc->flags) >> 5) & 0x7));
1039			break;
1040
1041		case RT2560_TX_FAIL_RETRY:
1042			DPRINTFN(9, ("sending mgt frame failed (too much "
1043			    "retries)\n"));
1044			break;
1045
1046		case RT2560_TX_FAIL_INVALID:
1047		case RT2560_TX_FAIL_OTHER:
1048		default:
1049			printf("%s: sending mgt frame failed 0x%08x\n",
1050			    sc->sc_dev.dv_xname, letoh32(desc->flags));
1051		}
1052
1053		bus_dmamap_sync(sc->sc_dmat, data->map, 0,
1054		    data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
1055		bus_dmamap_unload(sc->sc_dmat, data->map);
1056		m_freem(data->m);
1057		data->m = NULL;
1058		ieee80211_release_node(ic, data->ni);
1059		data->ni = NULL;
1060
1061		/* descriptor is no longer valid */
1062		desc->flags &= ~htole32(RT2560_TX_VALID);
1063
1064		bus_dmamap_sync(sc->sc_dmat, sc->prioq.map,
1065		    sc->prioq.next * RT2560_TX_DESC_SIZE, RT2560_TX_DESC_SIZE,
1066		    BUS_DMASYNC_PREWRITE);
1067
1068		DPRINTFN(15, ("prio done idx=%u\n", sc->prioq.next));
1069
1070		sc->prioq.queued--;
1071		sc->prioq.next = (sc->prioq.next + 1) % RT2560_PRIO_RING_COUNT;
1072	}
1073
1074	sc->sc_tx_timer = 0;
1075	ifp->if_flags &= ~IFF_OACTIVE;
1076	rt2560_start(ifp);
1077}
1078
1079/*
1080 * Some frames were processed by the hardware cipher engine and are ready for
1081 * transmission to the IEEE802.11 layer.
1082 */
1083void
1084rt2560_decryption_intr(struct rt2560_softc *sc)
1085{
1086	struct ieee80211com *ic = &sc->sc_ic;
1087	struct ifnet *ifp = &ic->ic_if;
1088	struct ieee80211_frame *wh;
1089	struct ieee80211_rxinfo rxi;
1090	struct ieee80211_node *ni;
1091	struct mbuf *mnew, *m;
1092	int hw, error;
1093
1094	/* retrieve last decriptor index processed by cipher engine */
1095	hw = (RAL_READ(sc, RT2560_SECCSR0) - sc->rxq.physaddr) /
1096	    RT2560_RX_DESC_SIZE;
1097
1098	for (; sc->rxq.cur_decrypt != hw;) {
1099		struct rt2560_rx_desc *desc =
1100		    &sc->rxq.desc[sc->rxq.cur_decrypt];
1101		struct rt2560_rx_data *data =
1102		    &sc->rxq.data[sc->rxq.cur_decrypt];
1103
1104		bus_dmamap_sync(sc->sc_dmat, sc->rxq.map,
1105		    sc->rxq.cur_decrypt * RT2560_TX_DESC_SIZE,
1106		    RT2560_TX_DESC_SIZE, BUS_DMASYNC_POSTREAD);
1107
1108		if (letoh32(desc->flags) &
1109		    (RT2560_RX_BUSY | RT2560_RX_CIPHER_BUSY))
1110			break;
1111
1112		if (data->drop) {
1113			ifp->if_ierrors++;
1114			goto skip;
1115		}
1116
1117		if ((letoh32(desc->flags) & RT2560_RX_CIPHER_MASK) != 0 &&
1118		    (letoh32(desc->flags) & RT2560_RX_ICV_ERROR)) {
1119			ifp->if_ierrors++;
1120			goto skip;
1121		}
1122
1123		/*
1124		 * Try to allocate a new mbuf for this ring element and load it
1125		 * before processing the current mbuf.  If the ring element
1126		 * cannot be loaded, drop the received packet and reuse the old
1127		 * mbuf.  In the unlikely case that the old mbuf can't be
1128		 * reloaded either, explicitly panic.
1129		 */
1130		MGETHDR(mnew, M_DONTWAIT, MT_DATA);
1131		if (mnew == NULL) {
1132			ifp->if_ierrors++;
1133			goto skip;
1134		}
1135		MCLGET(mnew, M_DONTWAIT);
1136		if (!(mnew->m_flags & M_EXT)) {
1137			m_freem(mnew);
1138			ifp->if_ierrors++;
1139			goto skip;
1140		}
1141
1142		bus_dmamap_sync(sc->sc_dmat, data->map, 0,
1143		    data->map->dm_mapsize, BUS_DMASYNC_POSTREAD);
1144		bus_dmamap_unload(sc->sc_dmat, data->map);
1145
1146		error = bus_dmamap_load(sc->sc_dmat, data->map,
1147		    mtod(mnew, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
1148		if (error != 0) {
1149			m_freem(mnew);
1150
1151			/* try to reload the old mbuf */
1152			error = bus_dmamap_load(sc->sc_dmat, data->map,
1153			    mtod(data->m, void *), MCLBYTES, NULL,
1154			    BUS_DMA_NOWAIT);
1155			if (error != 0) {
1156				/* very unlikely that it will fail... */
1157				panic("%s: could not load old rx mbuf",
1158				    sc->sc_dev.dv_xname);
1159			}
1160			/* physical address may have changed */
1161			desc->physaddr = htole32(data->map->dm_segs->ds_addr);
1162			ifp->if_ierrors++;
1163			goto skip;
1164		}
1165
1166		/*
1167		 * New mbuf successfully loaded, update Rx ring and continue
1168		 * processing.
1169		 */
1170		m = data->m;
1171		data->m = mnew;
1172		desc->physaddr = htole32(data->map->dm_segs->ds_addr);
1173
1174		/* finalize mbuf */
1175		m->m_pkthdr.rcvif = ifp;
1176		m->m_pkthdr.len = m->m_len =
1177		    (letoh32(desc->flags) >> 16) & 0xfff;
1178
1179#if NBPFILTER > 0
1180		if (sc->sc_drvbpf != NULL) {
1181			struct mbuf mb;
1182			struct rt2560_rx_radiotap_header *tap = &sc->sc_rxtap;
1183			uint32_t tsf_lo, tsf_hi;
1184
1185			/* get timestamp (low and high 32 bits) */
1186			tsf_hi = RAL_READ(sc, RT2560_CSR17);
1187			tsf_lo = RAL_READ(sc, RT2560_CSR16);
1188
1189			tap->wr_tsf =
1190			    htole64(((uint64_t)tsf_hi << 32) | tsf_lo);
1191			tap->wr_flags = 0;
1192			tap->wr_rate = rt2560_rxrate(desc);
1193			tap->wr_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
1194			tap->wr_chan_flags =
1195			    htole16(ic->ic_ibss_chan->ic_flags);
1196			tap->wr_antenna = sc->rx_ant;
1197			tap->wr_antsignal = desc->rssi;
1198
1199			mb.m_data = (caddr_t)tap;
1200			mb.m_len = sc->sc_txtap_len;
1201			mb.m_next = m;
1202			mb.m_nextpkt = NULL;
1203			mb.m_type = 0;
1204			mb.m_flags = 0;
1205			bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
1206		}
1207#endif
1208		wh = mtod(m, struct ieee80211_frame *);
1209		ni = ieee80211_find_rxnode(ic, wh);
1210
1211		/* send the frame to the 802.11 layer */
1212		rxi.rxi_flags = 0;
1213		rxi.rxi_rssi = desc->rssi;
1214		rxi.rxi_tstamp = 0;	/* unused */
1215		ieee80211_input(ifp, m, ni, &rxi);
1216
1217		/* node is no longer needed */
1218		ieee80211_release_node(ic, ni);
1219
1220skip:		desc->flags = htole32(RT2560_RX_BUSY);
1221
1222		bus_dmamap_sync(sc->sc_dmat, sc->rxq.map,
1223		    sc->rxq.cur_decrypt * RT2560_TX_DESC_SIZE,
1224		    RT2560_TX_DESC_SIZE, BUS_DMASYNC_PREWRITE);
1225
1226		DPRINTFN(15, ("decryption done idx=%u\n", sc->rxq.cur_decrypt));
1227
1228		sc->rxq.cur_decrypt =
1229		    (sc->rxq.cur_decrypt + 1) % RT2560_RX_RING_COUNT;
1230	}
1231}
1232
1233/*
1234 * Some frames were received. Pass them to the hardware cipher engine before
1235 * sending them to the 802.11 layer.
1236 */
1237void
1238rt2560_rx_intr(struct rt2560_softc *sc)
1239{
1240	for (;;) {
1241		struct rt2560_rx_desc *desc = &sc->rxq.desc[sc->rxq.cur];
1242		struct rt2560_rx_data *data = &sc->rxq.data[sc->rxq.cur];
1243
1244		bus_dmamap_sync(sc->sc_dmat, sc->rxq.map,
1245		    sc->rxq.cur * RT2560_RX_DESC_SIZE, RT2560_RX_DESC_SIZE,
1246		    BUS_DMASYNC_POSTREAD);
1247
1248		if (letoh32(desc->flags) &
1249		    (RT2560_RX_BUSY | RT2560_RX_CIPHER_BUSY))
1250			break;
1251
1252		data->drop = 0;
1253
1254		if (letoh32(desc->flags) &
1255		    (RT2560_RX_PHY_ERROR | RT2560_RX_CRC_ERROR)) {
1256			/*
1257			 * This should not happen since we did not request
1258			 * to receive those frames when we filled RXCSR0.
1259			 */
1260			DPRINTFN(5, ("PHY or CRC error flags 0x%08x\n",
1261			    letoh32(desc->flags)));
1262			data->drop = 1;
1263		}
1264
1265		if (((letoh32(desc->flags) >> 16) & 0xfff) > MCLBYTES) {
1266			DPRINTFN(5, ("bad length\n"));
1267			data->drop = 1;
1268		}
1269
1270		/* mark the frame for decryption */
1271		desc->flags |= htole32(RT2560_RX_CIPHER_BUSY);
1272
1273		bus_dmamap_sync(sc->sc_dmat, sc->rxq.map,
1274		    sc->rxq.cur * RT2560_RX_DESC_SIZE, RT2560_RX_DESC_SIZE,
1275		    BUS_DMASYNC_PREWRITE);
1276
1277		DPRINTFN(15, ("rx done idx=%u\n", sc->rxq.cur));
1278
1279		sc->rxq.cur = (sc->rxq.cur + 1) % RT2560_RX_RING_COUNT;
1280	}
1281
1282	/* kick decrypt */
1283	RAL_WRITE(sc, RT2560_SECCSR0, RT2560_KICK_DECRYPT);
1284}
1285
1286#ifndef IEEE80211_STA_ONLY
1287/*
1288 * This function is called in HostAP or IBSS modes when it's time to send a
1289 * new beacon (every ni_intval milliseconds).
1290 */
1291void
1292rt2560_beacon_expire(struct rt2560_softc *sc)
1293{
1294	struct ieee80211com *ic = &sc->sc_ic;
1295	struct rt2560_tx_data *data;
1296
1297	if (ic->ic_opmode != IEEE80211_M_IBSS &&
1298	    ic->ic_opmode != IEEE80211_M_HOSTAP)
1299		return;
1300
1301	data = &sc->bcnq.data[sc->bcnq.next];
1302
1303	if (sc->sc_flags & RT2560_UPDATE_SLOT) {
1304		sc->sc_flags &= ~RT2560_UPDATE_SLOT;
1305		sc->sc_flags |= RT2560_SET_SLOTTIME;
1306	} else if (sc->sc_flags & RT2560_SET_SLOTTIME) {
1307		sc->sc_flags &= ~RT2560_SET_SLOTTIME;
1308		rt2560_set_slottime(sc);
1309	}
1310
1311	if (ic->ic_curmode == IEEE80211_MODE_11G) {
1312		/* update ERP Information Element */
1313		*sc->erp = ic->ic_bss->ni_erp;
1314		bus_dmamap_sync(sc->sc_dmat, data->map, 0,
1315		    data->map->dm_mapsize, BUS_DMASYNC_PREWRITE);
1316	}
1317
1318#if defined(RT2560_DEBUG) && NBPFILTER > 0
1319	if (ic->ic_rawbpf != NULL)
1320		bpf_mtap(ic->ic_rawbpf, data->m, BPF_DIRECTION_OUT);
1321#endif
1322
1323	DPRINTFN(15, ("beacon expired\n"));
1324}
1325#endif
1326
1327void
1328rt2560_wakeup_expire(struct rt2560_softc *sc)
1329{
1330	DPRINTFN(15, ("wakeup expired\n"));
1331}
1332
1333int
1334rt2560_intr(void *arg)
1335{
1336	struct rt2560_softc *sc = arg;
1337	struct ifnet *ifp = &sc->sc_ic.ic_if;
1338	uint32_t r;
1339
1340	r = RAL_READ(sc, RT2560_CSR7);
1341	if (__predict_false(r == 0xffffffff))
1342		return 0;	/* device likely went away */
1343	if (r == 0)
1344		return 0;	/* not for us */
1345
1346	/* disable interrupts */
1347	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
1348
1349	/* acknowledge interrupts */
1350	RAL_WRITE(sc, RT2560_CSR7, r);
1351
1352	/* don't re-enable interrupts if we're shutting down */
1353	if (!(ifp->if_flags & IFF_RUNNING))
1354		return 0;
1355
1356#ifndef IEEE80211_STA_ONLY
1357	if (r & RT2560_BEACON_EXPIRE)
1358		rt2560_beacon_expire(sc);
1359#endif
1360
1361	if (r & RT2560_WAKEUP_EXPIRE)
1362		rt2560_wakeup_expire(sc);
1363
1364	if (r & RT2560_ENCRYPTION_DONE)
1365		rt2560_encryption_intr(sc);
1366
1367	if (r & RT2560_TX_DONE)
1368		rt2560_tx_intr(sc);
1369
1370	if (r & RT2560_PRIO_DONE)
1371		rt2560_prio_intr(sc);
1372
1373	if (r & RT2560_DECRYPTION_DONE)
1374		rt2560_decryption_intr(sc);
1375
1376	if (r & RT2560_RX_DONE)
1377		rt2560_rx_intr(sc);
1378
1379	/* re-enable interrupts */
1380	RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
1381
1382	return 1;
1383}
1384
1385/* quickly determine if a given rate is CCK or OFDM */
1386#define RAL_RATE_IS_OFDM(rate) ((rate) >= 12 && (rate) != 22)
1387
1388#define RAL_ACK_SIZE	14	/* 10 + 4(FCS) */
1389#define RAL_CTS_SIZE	14	/* 10 + 4(FCS) */
1390
1391#define RAL_SIFS		10	/* us */
1392
1393#define RT2560_RXTX_TURNAROUND	10	/* us */
1394
1395/*
1396 * This function is only used by the Rx radiotap code. It returns the rate at
1397 * which a given frame was received.
1398 */
1399#if NBPFILTER > 0
1400uint8_t
1401rt2560_rxrate(const struct rt2560_rx_desc *desc)
1402{
1403	if (letoh32(desc->flags) & RT2560_RX_OFDM) {
1404		/* reverse function of rt2560_plcp_signal */
1405		switch (desc->rate) {
1406		case 0xb:	return 12;
1407		case 0xf:	return 18;
1408		case 0xa:	return 24;
1409		case 0xe:	return 36;
1410		case 0x9:	return 48;
1411		case 0xd:	return 72;
1412		case 0x8:	return 96;
1413		case 0xc:	return 108;
1414		}
1415	} else {
1416		if (desc->rate == 10)
1417			return 2;
1418		if (desc->rate == 20)
1419			return 4;
1420		if (desc->rate == 55)
1421			return 11;
1422		if (desc->rate == 110)
1423			return 22;
1424	}
1425	return 2;	/* should not get there */
1426}
1427#endif
1428
1429/*
1430 * Return the expected ack rate for a frame transmitted at rate `rate'.
1431 */
1432int
1433rt2560_ack_rate(struct ieee80211com *ic, int rate)
1434{
1435	switch (rate) {
1436	/* CCK rates */
1437	case 2:
1438		return 2;
1439	case 4:
1440	case 11:
1441	case 22:
1442		return (ic->ic_curmode == IEEE80211_MODE_11B) ? 4 : rate;
1443
1444	/* OFDM rates */
1445	case 12:
1446	case 18:
1447		return 12;
1448	case 24:
1449	case 36:
1450		return 24;
1451	case 48:
1452	case 72:
1453	case 96:
1454	case 108:
1455		return 48;
1456	}
1457
1458	/* default to 1Mbps */
1459	return 2;
1460}
1461
1462/*
1463 * Compute the duration (in us) needed to transmit `len' bytes at rate `rate'.
1464 * The function automatically determines the operating mode depending on the
1465 * given rate. `flags' indicates whether short preamble is in use or not.
1466 */
1467uint16_t
1468rt2560_txtime(int len, int rate, uint32_t flags)
1469{
1470	uint16_t txtime;
1471
1472	if (RAL_RATE_IS_OFDM(rate)) {
1473		/* IEEE Std 802.11g-2003, pp. 44 */
1474		txtime = (8 + 4 * len + 3 + rate - 1) / rate;
1475		txtime = 16 + 4 + 4 * txtime + 6;
1476	} else {
1477		/* IEEE Std 802.11b-1999, pp. 28 */
1478		txtime = (16 * len + rate - 1) / rate;
1479		if (rate != 2 && (flags & IEEE80211_F_SHPREAMBLE))
1480			txtime +=  72 + 24;
1481		else
1482			txtime += 144 + 48;
1483	}
1484	return txtime;
1485}
1486
1487uint8_t
1488rt2560_plcp_signal(int rate)
1489{
1490	switch (rate) {
1491	/* CCK rates (returned values are device-dependent) */
1492	case 2:		return 0x0;
1493	case 4:		return 0x1;
1494	case 11:	return 0x2;
1495	case 22:	return 0x3;
1496
1497	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1498	case 12:	return 0xb;
1499	case 18:	return 0xf;
1500	case 24:	return 0xa;
1501	case 36:	return 0xe;
1502	case 48:	return 0x9;
1503	case 72:	return 0xd;
1504	case 96:	return 0x8;
1505	case 108:	return 0xc;
1506
1507	/* unsupported rates (should not get there) */
1508	default:	return 0xff;
1509	}
1510}
1511
1512void
1513rt2560_setup_tx_desc(struct rt2560_softc *sc, struct rt2560_tx_desc *desc,
1514    uint32_t flags, int len, int rate, int encrypt, bus_addr_t physaddr)
1515{
1516	struct ieee80211com *ic = &sc->sc_ic;
1517	uint16_t plcp_length;
1518	int remainder;
1519
1520	desc->flags = htole32(flags);
1521	desc->flags |= htole32(len << 16);
1522	desc->flags |= encrypt ? htole32(RT2560_TX_CIPHER_BUSY) :
1523	    htole32(RT2560_TX_BUSY | RT2560_TX_VALID);
1524
1525	desc->physaddr = htole32(physaddr);
1526	desc->wme = htole16(
1527	    RT2560_AIFSN(2) |
1528	    RT2560_LOGCWMIN(3) |
1529	    RT2560_LOGCWMAX(8));
1530
1531	/* setup PLCP fields */
1532	desc->plcp_signal  = rt2560_plcp_signal(rate);
1533	desc->plcp_service = 4;
1534
1535	len += IEEE80211_CRC_LEN;
1536	if (RAL_RATE_IS_OFDM(rate)) {
1537		desc->flags |= htole32(RT2560_TX_OFDM);
1538
1539		plcp_length = len & 0xfff;
1540		desc->plcp_length_hi = plcp_length >> 6;
1541		desc->plcp_length_lo = plcp_length & 0x3f;
1542	} else {
1543		plcp_length = (16 * len + rate - 1) / rate;
1544		if (rate == 22) {
1545			remainder = (16 * len) % 22;
1546			if (remainder != 0 && remainder < 7)
1547				desc->plcp_service |= RT2560_PLCP_LENGEXT;
1548		}
1549		desc->plcp_length_hi = plcp_length >> 8;
1550		desc->plcp_length_lo = plcp_length & 0xff;
1551
1552		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1553			desc->plcp_signal |= 0x08;
1554	}
1555}
1556
1557#ifndef IEEE80211_STA_ONLY
1558int
1559rt2560_tx_bcn(struct rt2560_softc *sc, struct mbuf *m0,
1560    struct ieee80211_node *ni)
1561{
1562	struct ieee80211com *ic = &sc->sc_ic;
1563	struct rt2560_tx_desc *desc;
1564	struct rt2560_tx_data *data;
1565	int rate = 2, error;
1566
1567	desc = &sc->bcnq.desc[sc->bcnq.cur];
1568	data = &sc->bcnq.data[sc->bcnq.cur];
1569
1570	error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
1571	    BUS_DMA_NOWAIT);
1572	if (error != 0) {
1573		printf("%s: can't map mbuf (error %d)\n",
1574		    sc->sc_dev.dv_xname, error);
1575		m_freem(m0);
1576		return error;
1577	}
1578
1579	data->m = m0;
1580	data->ni = ni;
1581
1582	rt2560_setup_tx_desc(sc, desc, RT2560_TX_IFS_NEWBACKOFF |
1583	    RT2560_TX_TIMESTAMP, m0->m_pkthdr.len, rate, 0,
1584	    data->map->dm_segs->ds_addr);
1585
1586	bus_dmamap_sync(sc->sc_dmat, data->map, 0, data->map->dm_mapsize,
1587	    BUS_DMASYNC_PREWRITE);
1588	bus_dmamap_sync(sc->sc_dmat, sc->bcnq.map,
1589	    sc->bcnq.cur * RT2560_TX_DESC_SIZE, RT2560_TX_DESC_SIZE,
1590	    BUS_DMASYNC_PREWRITE);
1591
1592	/*
1593	 * Store pointer to ERP Information Element so that we can update it
1594	 * dynamically when the slot time changes.
1595	 * XXX: this is ugly since it depends on how net80211 builds beacon
1596	 * frames but ieee80211_beacon_alloc() don't store offsets for us.
1597	 */
1598	if (ic->ic_curmode == IEEE80211_MODE_11G) {
1599		sc->erp =
1600		    mtod(m0, uint8_t *) +
1601		    sizeof (struct ieee80211_frame) +
1602		    8 + 2 + 2 +
1603		    ((ic->ic_flags & IEEE80211_F_HIDENWID) ?
1604			1 : 2 + ni->ni_esslen) +
1605		    2 + min(ni->ni_rates.rs_nrates, IEEE80211_RATE_SIZE) +
1606		    2 + 1 +
1607		    ((ic->ic_opmode == IEEE80211_M_IBSS) ? 4 : 6) +
1608		    2;
1609	}
1610
1611	return 0;
1612}
1613#endif
1614
1615int
1616rt2560_tx_mgt(struct rt2560_softc *sc, struct mbuf *m0,
1617    struct ieee80211_node *ni)
1618{
1619	struct ieee80211com *ic = &sc->sc_ic;
1620	struct rt2560_tx_desc *desc;
1621	struct rt2560_tx_data *data;
1622	struct ieee80211_frame *wh;
1623	uint16_t dur;
1624	uint32_t flags = 0;
1625	int rate = 2, error;
1626
1627	desc = &sc->prioq.desc[sc->prioq.cur];
1628	data = &sc->prioq.data[sc->prioq.cur];
1629
1630	error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
1631	    BUS_DMA_NOWAIT);
1632	if (error != 0) {
1633		printf("%s: can't map mbuf (error %d)\n",
1634		    sc->sc_dev.dv_xname, error);
1635		m_freem(m0);
1636		return error;
1637	}
1638
1639#if NBPFILTER > 0
1640	if (sc->sc_drvbpf != NULL) {
1641		struct mbuf mb;
1642		struct rt2560_tx_radiotap_header *tap = &sc->sc_txtap;
1643
1644		tap->wt_flags = 0;
1645		tap->wt_rate = rate;
1646		tap->wt_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
1647		tap->wt_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
1648		tap->wt_antenna = sc->tx_ant;
1649
1650		mb.m_data = (caddr_t)tap;
1651		mb.m_len = sc->sc_txtap_len;
1652		mb.m_next = m0;
1653		mb.m_nextpkt = NULL;
1654		mb.m_type = 0;
1655		mb.m_flags = 0;
1656		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
1657	}
1658#endif
1659
1660	data->m = m0;
1661	data->ni = ni;
1662
1663	wh = mtod(m0, struct ieee80211_frame *);
1664
1665	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1666		flags |= RT2560_TX_NEED_ACK;
1667
1668		dur = rt2560_txtime(RAL_ACK_SIZE, rate, ic->ic_flags) +
1669		    RAL_SIFS;
1670		*(uint16_t *)wh->i_dur = htole16(dur);
1671
1672#ifndef IEEE80211_STA_ONLY
1673		/* tell hardware to set timestamp for probe responses */
1674		if ((wh->i_fc[0] &
1675		    (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
1676		    (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
1677			flags |= RT2560_TX_TIMESTAMP;
1678#endif
1679	}
1680
1681	rt2560_setup_tx_desc(sc, desc, flags, m0->m_pkthdr.len, rate, 0,
1682	    data->map->dm_segs->ds_addr);
1683
1684	bus_dmamap_sync(sc->sc_dmat, data->map, 0, data->map->dm_mapsize,
1685	    BUS_DMASYNC_PREWRITE);
1686	bus_dmamap_sync(sc->sc_dmat, sc->prioq.map,
1687	    sc->prioq.cur * RT2560_TX_DESC_SIZE, RT2560_TX_DESC_SIZE,
1688	    BUS_DMASYNC_PREWRITE);
1689
1690	DPRINTFN(10, ("sending mgt frame len=%u idx=%u rate=%u\n",
1691	    m0->m_pkthdr.len, sc->prioq.cur, rate));
1692
1693	/* kick prio */
1694	sc->prioq.queued++;
1695	sc->prioq.cur = (sc->prioq.cur + 1) % RT2560_PRIO_RING_COUNT;
1696	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_PRIO);
1697
1698	return 0;
1699}
1700
1701int
1702rt2560_tx_data(struct rt2560_softc *sc, struct mbuf *m0,
1703    struct ieee80211_node *ni)
1704{
1705	struct ieee80211com *ic = &sc->sc_ic;
1706	struct rt2560_tx_ring *txq = &sc->txq;
1707	struct rt2560_tx_desc *desc;
1708	struct rt2560_tx_data *data;
1709	struct ieee80211_frame *wh;
1710	struct ieee80211_key *k;
1711	struct mbuf *m1;
1712	uint16_t dur;
1713	uint32_t flags = 0;
1714	int pktlen, rate, needcts = 0, needrts = 0, error;
1715
1716	wh = mtod(m0, struct ieee80211_frame *);
1717
1718	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1719		k = ieee80211_get_txkey(ic, wh, ni);
1720
1721		if ((m0 = ieee80211_encrypt(ic, m0, k)) == NULL)
1722			return ENOBUFS;
1723
1724		/* packet header may have moved, reset our local pointer */
1725		wh = mtod(m0, struct ieee80211_frame *);
1726	}
1727
1728	/* compute actual packet length (including CRC and crypto overhead) */
1729	pktlen = m0->m_pkthdr.len + IEEE80211_CRC_LEN;
1730
1731	/* pickup a rate */
1732	if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
1733	    ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1734	     IEEE80211_FC0_TYPE_MGT)) {
1735		/* mgmt/multicast frames are sent at the lowest avail. rate */
1736		rate = ni->ni_rates.rs_rates[0];
1737	} else if (ic->ic_fixed_rate != -1) {
1738		rate = ic->ic_sup_rates[ic->ic_curmode].
1739		    rs_rates[ic->ic_fixed_rate];
1740	} else
1741		rate = ni->ni_rates.rs_rates[ni->ni_txrate];
1742	if (rate == 0)
1743		rate = 2;	/* XXX should not happen */
1744	rate &= IEEE80211_RATE_VAL;
1745
1746	/*
1747	 * Packet Bursting: backoff after ppb=8 frames to give other STAs a
1748	 * chance to contend for the wireless medium.
1749	 */
1750	if (ic->ic_opmode == IEEE80211_M_STA && (ni->ni_txseq & 7))
1751		flags |= RT2560_TX_IFS_SIFS;
1752
1753	/* check if RTS/CTS or CTS-to-self protection must be used */
1754	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1755		/* multicast frames are not sent at OFDM rates in 802.11b/g */
1756		if (pktlen > ic->ic_rtsthreshold) {
1757			needrts = 1;	/* RTS/CTS based on frame length */
1758		} else if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
1759		    RAL_RATE_IS_OFDM(rate)) {
1760			if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
1761				needcts = 1;	/* CTS-to-self */
1762			else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
1763				needrts = 1;	/* RTS/CTS */
1764		}
1765	}
1766	if (needrts || needcts) {
1767		struct mbuf *mprot;
1768		int protrate, ackrate;
1769
1770		protrate = 2;	/* XXX */
1771		ackrate  = rt2560_ack_rate(ic, rate);
1772
1773		dur = rt2560_txtime(pktlen, rate, ic->ic_flags) +
1774		      rt2560_txtime(RAL_ACK_SIZE, ackrate, ic->ic_flags) +
1775		      2 * RAL_SIFS;
1776		if (needrts) {
1777			dur += rt2560_txtime(RAL_CTS_SIZE, rt2560_ack_rate(ic,
1778			    protrate), ic->ic_flags) + RAL_SIFS;
1779			mprot = ieee80211_get_rts(ic, wh, dur);
1780		} else {
1781			mprot = ieee80211_get_cts_to_self(ic, dur);
1782		}
1783		if (mprot == NULL) {
1784			printf("%s: could not allocate protection frame\n",
1785			    sc->sc_dev.dv_xname);
1786			m_freem(m0);
1787			return ENOBUFS;
1788		}
1789
1790		desc = &txq->desc[txq->cur_encrypt];
1791		data = &txq->data[txq->cur_encrypt];
1792
1793		error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, mprot,
1794		    BUS_DMA_NOWAIT);
1795		if (error != 0) {
1796			printf("%s: can't map mbuf (error %d)\n",
1797			    sc->sc_dev.dv_xname, error);
1798			m_freem(mprot);
1799			m_freem(m0);
1800			return error;
1801		}
1802
1803		data->m = mprot;
1804		/* avoid multiple free() of the same node for each fragment */
1805		data->ni = ieee80211_ref_node(ni);
1806
1807		/* XXX may want to pass the protection frame to BPF */
1808
1809		rt2560_setup_tx_desc(sc, desc,
1810		    (needrts ? RT2560_TX_NEED_ACK : 0) | RT2560_TX_MORE_FRAG,
1811		    mprot->m_pkthdr.len, protrate, 1,
1812		    data->map->dm_segs->ds_addr);
1813
1814		bus_dmamap_sync(sc->sc_dmat, data->map, 0,
1815		    data->map->dm_mapsize, BUS_DMASYNC_PREWRITE);
1816		bus_dmamap_sync(sc->sc_dmat, txq->map,
1817		    txq->cur_encrypt * RT2560_TX_DESC_SIZE,
1818		    RT2560_TX_DESC_SIZE, BUS_DMASYNC_PREWRITE);
1819
1820		txq->queued++;
1821		if (++txq->cur_encrypt >= txq->count)
1822			txq->cur_encrypt = 0;
1823
1824		flags |= RT2560_TX_LONG_RETRY | RT2560_TX_IFS_SIFS;
1825	}
1826
1827	data = &txq->data[txq->cur_encrypt];
1828	desc = &txq->desc[txq->cur_encrypt];
1829
1830	error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
1831	    BUS_DMA_NOWAIT);
1832	if (error != 0 && error != EFBIG) {
1833		printf("%s: can't map mbuf (error %d)\n",
1834		    sc->sc_dev.dv_xname, error);
1835		m_freem(m0);
1836		return error;
1837	}
1838	if (error != 0) {
1839		/* too many fragments, linearize */
1840		MGETHDR(m1, M_DONTWAIT, MT_DATA);
1841		if (m1 == NULL) {
1842			m_freem(m0);
1843			return ENOBUFS;
1844		}
1845		if (m0->m_pkthdr.len > MHLEN) {
1846			MCLGET(m1, M_DONTWAIT);
1847			if (!(m1->m_flags & M_EXT)) {
1848				m_freem(m0);
1849				m_freem(m1);
1850				return ENOBUFS;
1851			}
1852		}
1853		m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m1, caddr_t));
1854		m1->m_pkthdr.len = m1->m_len = m0->m_pkthdr.len;
1855		m_freem(m0);
1856		m0 = m1;
1857
1858		error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
1859		    BUS_DMA_NOWAIT);
1860		if (error != 0) {
1861			printf("%s: can't map mbuf (error %d)\n",
1862			    sc->sc_dev.dv_xname, error);
1863			m_freem(m0);
1864			return error;
1865		}
1866
1867		/* packet header have moved, reset our local pointer */
1868		wh = mtod(m0, struct ieee80211_frame *);
1869	}
1870
1871#if NBPFILTER > 0
1872	if (sc->sc_drvbpf != NULL) {
1873		struct mbuf mb;
1874		struct rt2560_tx_radiotap_header *tap = &sc->sc_txtap;
1875
1876		tap->wt_flags = 0;
1877		tap->wt_rate = rate;
1878		tap->wt_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
1879		tap->wt_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
1880		tap->wt_antenna = sc->tx_ant;
1881
1882		mb.m_data = (caddr_t)tap;
1883		mb.m_len = sc->sc_txtap_len;
1884		mb.m_next = m0;
1885		mb.m_nextpkt = NULL;
1886		mb.m_type = 0;
1887		mb.m_flags = 0;
1888		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
1889	}
1890#endif
1891
1892	data->m = m0;
1893	data->ni = ni;
1894
1895	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1896		flags |= RT2560_TX_NEED_ACK;
1897
1898		dur = rt2560_txtime(RAL_ACK_SIZE, rt2560_ack_rate(ic, rate),
1899		    ic->ic_flags) + RAL_SIFS;
1900		*(uint16_t *)wh->i_dur = htole16(dur);
1901	}
1902
1903	rt2560_setup_tx_desc(sc, desc, flags, m0->m_pkthdr.len, rate, 1,
1904	    data->map->dm_segs->ds_addr);
1905
1906	bus_dmamap_sync(sc->sc_dmat, data->map, 0, data->map->dm_mapsize,
1907	    BUS_DMASYNC_PREWRITE);
1908	bus_dmamap_sync(sc->sc_dmat, txq->map,
1909	    txq->cur_encrypt * RT2560_TX_DESC_SIZE, RT2560_TX_DESC_SIZE,
1910	    BUS_DMASYNC_PREWRITE);
1911
1912	DPRINTFN(10, ("sending frame len=%u idx=%u rate=%u\n",
1913	    m0->m_pkthdr.len, txq->cur_encrypt, rate));
1914
1915	/* kick encrypt */
1916	txq->queued++;
1917	if (++txq->cur_encrypt >= txq->count)
1918		txq->cur_encrypt = 0;
1919	RAL_WRITE(sc, RT2560_SECCSR1, RT2560_KICK_ENCRYPT);
1920
1921	return 0;
1922}
1923
1924void
1925rt2560_start(struct ifnet *ifp)
1926{
1927	struct rt2560_softc *sc = ifp->if_softc;
1928	struct ieee80211com *ic = &sc->sc_ic;
1929	struct mbuf *m0;
1930	struct ieee80211_node *ni;
1931
1932	/*
1933	 * net80211 may still try to send management frames even if the
1934	 * IFF_RUNNING flag is not set...
1935	 */
1936	if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
1937		return;
1938
1939	for (;;) {
1940		IF_POLL(&ic->ic_mgtq, m0);
1941		if (m0 != NULL) {
1942			if (sc->prioq.queued >= RT2560_PRIO_RING_COUNT) {
1943				ifp->if_flags |= IFF_OACTIVE;
1944				break;
1945			}
1946			IF_DEQUEUE(&ic->ic_mgtq, m0);
1947
1948			ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
1949			m0->m_pkthdr.rcvif = NULL;
1950#if NBPFILTER > 0
1951			if (ic->ic_rawbpf != NULL)
1952				bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
1953#endif
1954			if (rt2560_tx_mgt(sc, m0, ni) != 0)
1955				break;
1956
1957		} else {
1958			if (ic->ic_state != IEEE80211_S_RUN)
1959				break;
1960			IFQ_POLL(&ifp->if_snd, m0);
1961			if (m0 == NULL)
1962				break;
1963			if (sc->txq.queued >= RT2560_TX_RING_COUNT - 1) {
1964				ifp->if_flags |= IFF_OACTIVE;
1965				break;
1966			}
1967			IFQ_DEQUEUE(&ifp->if_snd, m0);
1968#if NBPFILTER > 0
1969			if (ifp->if_bpf != NULL)
1970				bpf_mtap(ifp->if_bpf, m0, BPF_DIRECTION_OUT);
1971#endif
1972			m0 = ieee80211_encap(ifp, m0, &ni);
1973			if (m0 == NULL)
1974				continue;
1975#if NBPFILTER > 0
1976			if (ic->ic_rawbpf != NULL)
1977				bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
1978#endif
1979			if (rt2560_tx_data(sc, m0, ni) != 0) {
1980				if (ni != NULL)
1981					ieee80211_release_node(ic, ni);
1982				ifp->if_oerrors++;
1983				break;
1984			}
1985		}
1986
1987		sc->sc_tx_timer = 5;
1988		ifp->if_timer = 1;
1989	}
1990}
1991
1992void
1993rt2560_watchdog(struct ifnet *ifp)
1994{
1995	struct rt2560_softc *sc = ifp->if_softc;
1996
1997	ifp->if_timer = 0;
1998
1999	if (sc->sc_tx_timer > 0) {
2000		if (--sc->sc_tx_timer == 0) {
2001			printf("%s: device timeout\n", sc->sc_dev.dv_xname);
2002			rt2560_init(ifp);
2003			ifp->if_oerrors++;
2004			return;
2005		}
2006		ifp->if_timer = 1;
2007	}
2008
2009	ieee80211_watchdog(ifp);
2010}
2011
2012int
2013rt2560_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
2014{
2015	struct rt2560_softc *sc = ifp->if_softc;
2016	struct ieee80211com *ic = &sc->sc_ic;
2017	struct ifaddr *ifa;
2018	struct ifreq *ifr;
2019	int s, error = 0;
2020
2021	s = splnet();
2022
2023	switch (cmd) {
2024	case SIOCSIFADDR:
2025		ifa = (struct ifaddr *)data;
2026		ifp->if_flags |= IFF_UP;
2027#ifdef INET
2028		if (ifa->ifa_addr->sa_family == AF_INET)
2029			arp_ifinit(&ic->ic_ac, ifa);
2030#endif
2031		/* FALLTHROUGH */
2032	case SIOCSIFFLAGS:
2033		if (ifp->if_flags & IFF_UP) {
2034			if (ifp->if_flags & IFF_RUNNING)
2035				rt2560_update_promisc(sc);
2036			else
2037				rt2560_init(ifp);
2038		} else {
2039			if (ifp->if_flags & IFF_RUNNING)
2040				rt2560_stop(ifp, 1);
2041		}
2042		break;
2043
2044	case SIOCADDMULTI:
2045	case SIOCDELMULTI:
2046		ifr = (struct ifreq *)data;
2047		error = (cmd == SIOCADDMULTI) ?
2048		    ether_addmulti(ifr, &ic->ic_ac) :
2049		    ether_delmulti(ifr, &ic->ic_ac);
2050
2051		if (error == ENETRESET)
2052			error = 0;
2053		break;
2054
2055	case SIOCS80211CHANNEL:
2056		/*
2057		 * This allows for fast channel switching in monitor mode
2058		 * (used by kismet). In IBSS mode, we must explicitly reset
2059		 * the interface to generate a new beacon frame.
2060		 */
2061		error = ieee80211_ioctl(ifp, cmd, data);
2062		if (error == ENETRESET &&
2063		    ic->ic_opmode == IEEE80211_M_MONITOR) {
2064			if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
2065			    (IFF_UP | IFF_RUNNING))
2066				rt2560_set_chan(sc, ic->ic_ibss_chan);
2067			error = 0;
2068		}
2069		break;
2070
2071	default:
2072		error = ieee80211_ioctl(ifp, cmd, data);
2073	}
2074
2075	if (error == ENETRESET) {
2076		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
2077		    (IFF_UP | IFF_RUNNING))
2078			rt2560_init(ifp);
2079		error = 0;
2080	}
2081
2082	splx(s);
2083
2084	return error;
2085}
2086
2087void
2088rt2560_bbp_write(struct rt2560_softc *sc, uint8_t reg, uint8_t val)
2089{
2090	uint32_t tmp;
2091	int ntries;
2092
2093	for (ntries = 0; ntries < 100; ntries++) {
2094		if (!(RAL_READ(sc, RT2560_BBPCSR) & RT2560_BBP_BUSY))
2095			break;
2096		DELAY(1);
2097	}
2098	if (ntries == 100) {
2099		printf("%s: could not write to BBP\n", sc->sc_dev.dv_xname);
2100		return;
2101	}
2102
2103	tmp = RT2560_BBP_WRITE | RT2560_BBP_BUSY | reg << 8 | val;
2104	RAL_WRITE(sc, RT2560_BBPCSR, tmp);
2105
2106	DPRINTFN(15, ("BBP R%u <- 0x%02x\n", reg, val));
2107}
2108
2109uint8_t
2110rt2560_bbp_read(struct rt2560_softc *sc, uint8_t reg)
2111{
2112	uint32_t val;
2113	int ntries;
2114
2115	val = RT2560_BBP_BUSY | reg << 8;
2116	RAL_WRITE(sc, RT2560_BBPCSR, val);
2117
2118	for (ntries = 0; ntries < 100; ntries++) {
2119		val = RAL_READ(sc, RT2560_BBPCSR);
2120		if (!(val & RT2560_BBP_BUSY))
2121			return val & 0xff;
2122		DELAY(1);
2123	}
2124
2125	printf("%s: could not read from BBP\n", sc->sc_dev.dv_xname);
2126	return 0;
2127}
2128
2129void
2130rt2560_rf_write(struct rt2560_softc *sc, uint8_t reg, uint32_t val)
2131{
2132	uint32_t tmp;
2133	int ntries;
2134
2135	for (ntries = 0; ntries < 100; ntries++) {
2136		if (!(RAL_READ(sc, RT2560_RFCSR) & RT2560_RF_BUSY))
2137			break;
2138		DELAY(1);
2139	}
2140	if (ntries == 100) {
2141		printf("%s: could not write to RF\n", sc->sc_dev.dv_xname);
2142		return;
2143	}
2144
2145	tmp = RT2560_RF_BUSY | RT2560_RF_20BIT | (val & 0xfffff) << 2 |
2146	    (reg & 0x3);
2147	RAL_WRITE(sc, RT2560_RFCSR, tmp);
2148
2149	/* remember last written value in sc */
2150	sc->rf_regs[reg] = val;
2151
2152	DPRINTFN(15, ("RF R[%u] <- 0x%05x\n", reg & 0x3, val & 0xfffff));
2153}
2154
2155void
2156rt2560_set_chan(struct rt2560_softc *sc, struct ieee80211_channel *c)
2157{
2158	struct ieee80211com *ic = &sc->sc_ic;
2159	uint8_t power, tmp;
2160	u_int chan;
2161
2162	chan = ieee80211_chan2ieee(ic, c);
2163	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
2164		return;
2165
2166	power = min(sc->txpow[chan - 1], 31);
2167
2168	DPRINTFN(2, ("setting channel to %u, txpower to %u\n", chan, power));
2169
2170	switch (sc->rf_rev) {
2171	case RT2560_RF_2522:
2172		rt2560_rf_write(sc, RT2560_RF1, 0x00814);
2173		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf2522_r2[chan - 1]);
2174		rt2560_rf_write(sc, RT2560_RF3, power << 7 | 0x00040);
2175		break;
2176
2177	case RT2560_RF_2523:
2178		rt2560_rf_write(sc, RT2560_RF1, 0x08804);
2179		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf2523_r2[chan - 1]);
2180		rt2560_rf_write(sc, RT2560_RF3, power << 7 | 0x38044);
2181		rt2560_rf_write(sc, RT2560_RF4,
2182		    (chan == 14) ? 0x00280 : 0x00286);
2183		break;
2184
2185	case RT2560_RF_2524:
2186		rt2560_rf_write(sc, RT2560_RF1, 0x0c808);
2187		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf2524_r2[chan - 1]);
2188		rt2560_rf_write(sc, RT2560_RF3, power << 7 | 0x00040);
2189		rt2560_rf_write(sc, RT2560_RF4,
2190		    (chan == 14) ? 0x00280 : 0x00286);
2191		break;
2192
2193	case RT2560_RF_2525:
2194		rt2560_rf_write(sc, RT2560_RF1, 0x08808);
2195		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf2525_hi_r2[chan - 1]);
2196		rt2560_rf_write(sc, RT2560_RF3, power << 7 | 0x18044);
2197		rt2560_rf_write(sc, RT2560_RF4,
2198		    (chan == 14) ? 0x00280 : 0x00286);
2199
2200		rt2560_rf_write(sc, RT2560_RF1, 0x08808);
2201		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf2525_r2[chan - 1]);
2202		rt2560_rf_write(sc, RT2560_RF3, power << 7 | 0x18044);
2203		rt2560_rf_write(sc, RT2560_RF4,
2204		    (chan == 14) ? 0x00280 : 0x00286);
2205		break;
2206
2207	case RT2560_RF_2525E:
2208		rt2560_rf_write(sc, RT2560_RF1, 0x08808);
2209		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf2525e_r2[chan - 1]);
2210		rt2560_rf_write(sc, RT2560_RF3, power << 7 | 0x18044);
2211		rt2560_rf_write(sc, RT2560_RF4,
2212		    (chan == 14) ? 0x00286 : 0x00282);
2213		break;
2214
2215	case RT2560_RF_2526:
2216		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf2526_hi_r2[chan - 1]);
2217		rt2560_rf_write(sc, RT2560_RF4,
2218		   (chan & 1) ? 0x00386 : 0x00381);
2219		rt2560_rf_write(sc, RT2560_RF1, 0x08804);
2220
2221		rt2560_rf_write(sc, RT2560_RF2, rt2560_rf2526_r2[chan - 1]);
2222		rt2560_rf_write(sc, RT2560_RF3, power << 7 | 0x18044);
2223		rt2560_rf_write(sc, RT2560_RF4,
2224		    (chan & 1) ? 0x00386 : 0x00381);
2225		break;
2226	}
2227
2228	if (ic->ic_opmode != IEEE80211_M_MONITOR &&
2229	    ic->ic_state != IEEE80211_S_SCAN) {
2230		/* set Japan filter bit for channel 14 */
2231		tmp = rt2560_bbp_read(sc, 70);
2232
2233		tmp &= ~RT2560_JAPAN_FILTER;
2234		if (chan == 14)
2235			tmp |= RT2560_JAPAN_FILTER;
2236
2237		rt2560_bbp_write(sc, 70, tmp);
2238
2239		DELAY(1000); /* RF needs a 1ms delay here */
2240		rt2560_disable_rf_tune(sc);
2241
2242		/* clear CRC errors */
2243		RAL_READ(sc, RT2560_CNT0);
2244	}
2245}
2246
2247/*
2248 * Disable RF auto-tuning.
2249 */
2250void
2251rt2560_disable_rf_tune(struct rt2560_softc *sc)
2252{
2253	uint32_t tmp;
2254
2255	if (sc->rf_rev != RT2560_RF_2523) {
2256		tmp = sc->rf_regs[RT2560_RF1] & ~RT2560_RF1_AUTOTUNE;
2257		rt2560_rf_write(sc, RT2560_RF1, tmp);
2258	}
2259
2260	tmp = sc->rf_regs[RT2560_RF3] & ~RT2560_RF3_AUTOTUNE;
2261	rt2560_rf_write(sc, RT2560_RF3, tmp);
2262
2263	DPRINTFN(2, ("disabling RF autotune\n"));
2264}
2265
2266/*
2267 * Refer to IEEE Std 802.11-1999 pp. 123 for more information on TSF
2268 * synchronization.
2269 */
2270void
2271rt2560_enable_tsf_sync(struct rt2560_softc *sc)
2272{
2273	struct ieee80211com *ic = &sc->sc_ic;
2274	uint16_t logcwmin, preload;
2275	uint32_t tmp;
2276
2277	/* first, disable TSF synchronization */
2278	RAL_WRITE(sc, RT2560_CSR14, 0);
2279
2280	tmp = 16 * ic->ic_bss->ni_intval;
2281	RAL_WRITE(sc, RT2560_CSR12, tmp);
2282
2283	RAL_WRITE(sc, RT2560_CSR13, 0);
2284
2285	logcwmin = 5;
2286	preload = (ic->ic_opmode == IEEE80211_M_STA) ? 384 : 1024;
2287	tmp = logcwmin << 16 | preload;
2288	RAL_WRITE(sc, RT2560_BCNOCSR, tmp);
2289
2290	/* finally, enable TSF synchronization */
2291	tmp = RT2560_ENABLE_TSF | RT2560_ENABLE_TBCN;
2292	if (ic->ic_opmode == IEEE80211_M_STA)
2293		tmp |= RT2560_ENABLE_TSF_SYNC(1);
2294#ifndef IEEE80211_STA_ONLY
2295	else
2296		tmp |= RT2560_ENABLE_TSF_SYNC(2) |
2297		       RT2560_ENABLE_BEACON_GENERATOR;
2298#endif
2299	RAL_WRITE(sc, RT2560_CSR14, tmp);
2300
2301	DPRINTF(("enabling TSF synchronization\n"));
2302}
2303
2304void
2305rt2560_update_plcp(struct rt2560_softc *sc)
2306{
2307	struct ieee80211com *ic = &sc->sc_ic;
2308
2309	/* no short preamble for 1Mbps */
2310	RAL_WRITE(sc, RT2560_PLCP1MCSR, 0x00700400);
2311
2312	if (!(ic->ic_flags & IEEE80211_F_SHPREAMBLE)) {
2313		/* values taken from the reference driver */
2314		RAL_WRITE(sc, RT2560_PLCP2MCSR,   0x00380401);
2315		RAL_WRITE(sc, RT2560_PLCP5p5MCSR, 0x00150402);
2316		RAL_WRITE(sc, RT2560_PLCP11MCSR,  0x000b8403);
2317	} else {
2318		/* same values as above or'ed 0x8 */
2319		RAL_WRITE(sc, RT2560_PLCP2MCSR,   0x00380409);
2320		RAL_WRITE(sc, RT2560_PLCP5p5MCSR, 0x0015040a);
2321		RAL_WRITE(sc, RT2560_PLCP11MCSR,  0x000b840b);
2322	}
2323
2324	DPRINTF(("updating PLCP for %s preamble\n",
2325	    (ic->ic_flags & IEEE80211_F_SHPREAMBLE) ? "short" : "long"));
2326}
2327
2328void
2329rt2560_updateslot(struct ieee80211com *ic)
2330{
2331	struct rt2560_softc *sc = ic->ic_if.if_softc;
2332
2333#ifndef IEEE80211_STA_ONLY
2334	if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
2335		/*
2336		 * In HostAP mode, we defer setting of new slot time until
2337		 * updated ERP Information Element has propagated to all
2338		 * associated STAs.
2339		 */
2340		sc->sc_flags |= RT2560_UPDATE_SLOT;
2341	} else
2342#endif
2343		rt2560_set_slottime(sc);
2344}
2345
2346/*
2347 * IEEE 802.11a (and possibly 802.11g) use short slot time. Refer to
2348 * IEEE Std 802.11-1999 pp. 85 to know how these values are computed.
2349 */
2350void
2351rt2560_set_slottime(struct rt2560_softc *sc)
2352{
2353	struct ieee80211com *ic = &sc->sc_ic;
2354	uint8_t slottime;
2355	uint16_t sifs, pifs, difs, eifs;
2356	uint32_t tmp;
2357
2358	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
2359
2360	/* define the MAC slot boundaries */
2361	sifs = RAL_SIFS - RT2560_RXTX_TURNAROUND;
2362	pifs = sifs + slottime;
2363	difs = sifs + 2 * slottime;
2364	eifs = (ic->ic_curmode == IEEE80211_MODE_11B) ? 364 : 60;
2365
2366	tmp = RAL_READ(sc, RT2560_CSR11);
2367	tmp = (tmp & ~0x1f00) | slottime << 8;
2368	RAL_WRITE(sc, RT2560_CSR11, tmp);
2369
2370	tmp = pifs << 16 | sifs;
2371	RAL_WRITE(sc, RT2560_CSR18, tmp);
2372
2373	tmp = eifs << 16 | difs;
2374	RAL_WRITE(sc, RT2560_CSR19, tmp);
2375
2376	DPRINTF(("setting slottime to %uus\n", slottime));
2377}
2378
2379void
2380rt2560_set_basicrates(struct rt2560_softc *sc)
2381{
2382	struct ieee80211com *ic = &sc->sc_ic;
2383
2384	/* update basic rate set */
2385	if (ic->ic_curmode == IEEE80211_MODE_11B) {
2386		/* 11b basic rates: 1, 2Mbps */
2387		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x3);
2388	} else {
2389		/* 11b/g basic rates: 1, 2, 5.5, 11Mbps */
2390		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0xf);
2391	}
2392}
2393
2394void
2395rt2560_update_led(struct rt2560_softc *sc, int led1, int led2)
2396{
2397	uint32_t tmp;
2398
2399	/* set ON period to 70ms and OFF period to 30ms */
2400	tmp = led1 << 16 | led2 << 17 | 70 << 8 | 30;
2401	RAL_WRITE(sc, RT2560_LEDCSR, tmp);
2402}
2403
2404void
2405rt2560_set_bssid(struct rt2560_softc *sc, uint8_t *bssid)
2406{
2407	uint32_t tmp;
2408
2409	tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
2410	RAL_WRITE(sc, RT2560_CSR5, tmp);
2411
2412	tmp = bssid[4] | bssid[5] << 8;
2413	RAL_WRITE(sc, RT2560_CSR6, tmp);
2414
2415	DPRINTF(("setting BSSID to %s\n", ether_sprintf(bssid)));
2416}
2417
2418void
2419rt2560_set_macaddr(struct rt2560_softc *sc, uint8_t *addr)
2420{
2421	uint32_t tmp;
2422
2423	tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
2424	RAL_WRITE(sc, RT2560_CSR3, tmp);
2425
2426	tmp = addr[4] | addr[5] << 8;
2427	RAL_WRITE(sc, RT2560_CSR4, tmp);
2428
2429	DPRINTF(("setting MAC address to %s\n", ether_sprintf(addr)));
2430}
2431
2432void
2433rt2560_get_macaddr(struct rt2560_softc *sc, uint8_t *addr)
2434{
2435	uint32_t tmp;
2436
2437	tmp = RAL_READ(sc, RT2560_CSR3);
2438	addr[0] = tmp & 0xff;
2439	addr[1] = (tmp >>  8) & 0xff;
2440	addr[2] = (tmp >> 16) & 0xff;
2441	addr[3] = (tmp >> 24);
2442
2443	tmp = RAL_READ(sc, RT2560_CSR4);
2444	addr[4] = tmp & 0xff;
2445	addr[5] = (tmp >> 8) & 0xff;
2446}
2447
2448void
2449rt2560_update_promisc(struct rt2560_softc *sc)
2450{
2451	struct ifnet *ifp = &sc->sc_ic.ic_if;
2452	uint32_t tmp;
2453
2454	tmp = RAL_READ(sc, RT2560_RXCSR0);
2455
2456	tmp &= ~RT2560_DROP_NOT_TO_ME;
2457	if (!(ifp->if_flags & IFF_PROMISC))
2458		tmp |= RT2560_DROP_NOT_TO_ME;
2459
2460	RAL_WRITE(sc, RT2560_RXCSR0, tmp);
2461
2462	DPRINTF(("%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
2463	    "entering" : "leaving"));
2464}
2465
2466void
2467rt2560_set_txantenna(struct rt2560_softc *sc, int antenna)
2468{
2469	uint32_t tmp;
2470	uint8_t tx;
2471
2472	tx = rt2560_bbp_read(sc, RT2560_BBP_TX) & ~RT2560_BBP_ANTMASK;
2473	if (antenna == 1)
2474		tx |= RT2560_BBP_ANTA;
2475	else if (antenna == 2)
2476		tx |= RT2560_BBP_ANTB;
2477	else
2478		tx |= RT2560_BBP_DIVERSITY;
2479
2480	/* need to force I/Q flip for RF 2525e, 2526 and 5222 */
2481	if (sc->rf_rev == RT2560_RF_2525E || sc->rf_rev == RT2560_RF_2526 ||
2482	    sc->rf_rev == RT2560_RF_5222)
2483		tx |= RT2560_BBP_FLIPIQ;
2484
2485	rt2560_bbp_write(sc, RT2560_BBP_TX, tx);
2486
2487	/* update values for CCK and OFDM in BBPCSR1 */
2488	tmp = RAL_READ(sc, RT2560_BBPCSR1) & ~0x00070007;
2489	tmp |= (tx & 0x7) << 16 | (tx & 0x7);
2490	RAL_WRITE(sc, RT2560_BBPCSR1, tmp);
2491}
2492
2493void
2494rt2560_set_rxantenna(struct rt2560_softc *sc, int antenna)
2495{
2496	uint8_t rx;
2497
2498	rx = rt2560_bbp_read(sc, RT2560_BBP_RX) & ~RT2560_BBP_ANTMASK;
2499	if (antenna == 1)
2500		rx |= RT2560_BBP_ANTA;
2501	else if (antenna == 2)
2502		rx |= RT2560_BBP_ANTB;
2503	else
2504		rx |= RT2560_BBP_DIVERSITY;
2505
2506	/* need to force no I/Q flip for RF 2525e and 2526 */
2507	if (sc->rf_rev == RT2560_RF_2525E || sc->rf_rev == RT2560_RF_2526)
2508		rx &= ~RT2560_BBP_FLIPIQ;
2509
2510	rt2560_bbp_write(sc, RT2560_BBP_RX, rx);
2511}
2512
2513const char *
2514rt2560_get_rf(int rev)
2515{
2516	switch (rev) {
2517	case RT2560_RF_2522:	return "RT2522";
2518	case RT2560_RF_2523:	return "RT2523";
2519	case RT2560_RF_2524:	return "RT2524";
2520	case RT2560_RF_2525:	return "RT2525";
2521	case RT2560_RF_2525E:	return "RT2525e";
2522	case RT2560_RF_2526:	return "RT2526";
2523	case RT2560_RF_5222:	return "RT5222";
2524	default:		return "unknown";
2525	}
2526}
2527
2528void
2529rt2560_read_eeprom(struct rt2560_softc *sc)
2530{
2531	uint16_t val;
2532	int i;
2533
2534	val = rt2560_eeprom_read(sc, RT2560_EEPROM_CONFIG0);
2535	sc->rf_rev =   (val >> 11) & 0x1f;
2536	sc->hw_radio = (val >> 10) & 0x1;
2537	sc->led_mode = (val >> 6)  & 0x7;
2538	sc->rx_ant =   (val >> 4)  & 0x3;
2539	sc->tx_ant =   (val >> 2)  & 0x3;
2540	sc->nb_ant =   val & 0x3;
2541
2542	/* read default values for BBP registers */
2543	for (i = 0; i < 16; i++) {
2544		val = rt2560_eeprom_read(sc, RT2560_EEPROM_BBP_BASE + i);
2545		sc->bbp_prom[i].reg = val >> 8;
2546		sc->bbp_prom[i].val = val & 0xff;
2547	}
2548
2549	/* read Tx power for all b/g channels */
2550	for (i = 0; i < 14 / 2; i++) {
2551		val = rt2560_eeprom_read(sc, RT2560_EEPROM_TXPOWER + i);
2552		sc->txpow[i * 2] = val >> 8;
2553		sc->txpow[i * 2 + 1] = val & 0xff;
2554	}
2555}
2556
2557int
2558rt2560_bbp_init(struct rt2560_softc *sc)
2559{
2560	int i, ntries;
2561
2562	/* wait for BBP to be ready */
2563	for (ntries = 0; ntries < 100; ntries++) {
2564		if (rt2560_bbp_read(sc, RT2560_BBP_VERSION) != 0)
2565			break;
2566		DELAY(1);
2567	}
2568	if (ntries == 100) {
2569		printf("%s: timeout waiting for BBP\n", sc->sc_dev.dv_xname);
2570		return EIO;
2571	}
2572
2573	/* initialize BBP registers to default values */
2574	for (i = 0; i < nitems(rt2560_def_bbp); i++) {
2575		rt2560_bbp_write(sc, rt2560_def_bbp[i].reg,
2576		    rt2560_def_bbp[i].val);
2577	}
2578#if 0
2579	/* initialize BBP registers to values stored in EEPROM */
2580	for (i = 0; i < 16; i++) {
2581		if (sc->bbp_prom[i].reg == 0xff)
2582			continue;
2583		rt2560_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
2584	}
2585#endif
2586
2587	return 0;
2588}
2589
2590int
2591rt2560_init(struct ifnet *ifp)
2592{
2593	struct rt2560_softc *sc = ifp->if_softc;
2594	struct ieee80211com *ic = &sc->sc_ic;
2595	uint32_t tmp;
2596	int i;
2597
2598	/* for CardBus, power on the socket */
2599	if (!(sc->sc_flags & RT2560_ENABLED)) {
2600		if (sc->sc_enable != NULL && (*sc->sc_enable)(sc) != 0) {
2601			printf("%s: could not enable device\n",
2602			    sc->sc_dev.dv_xname);
2603			return EIO;
2604		}
2605		sc->sc_flags |= RT2560_ENABLED;
2606	}
2607
2608	rt2560_stop(ifp, 0);
2609
2610	/* setup tx rings */
2611	tmp = RT2560_PRIO_RING_COUNT << 24 |
2612	      RT2560_ATIM_RING_COUNT << 16 |
2613	      RT2560_TX_RING_COUNT   <<  8 |
2614	      RT2560_TX_DESC_SIZE;
2615
2616	/* rings _must_ be initialized in this _exact_ order! */
2617	RAL_WRITE(sc, RT2560_TXCSR2, tmp);
2618	RAL_WRITE(sc, RT2560_TXCSR3, sc->txq.physaddr);
2619	RAL_WRITE(sc, RT2560_TXCSR5, sc->prioq.physaddr);
2620	RAL_WRITE(sc, RT2560_TXCSR4, sc->atimq.physaddr);
2621	RAL_WRITE(sc, RT2560_TXCSR6, sc->bcnq.physaddr);
2622
2623	/* setup rx ring */
2624	tmp = RT2560_RX_RING_COUNT << 8 | RT2560_RX_DESC_SIZE;
2625
2626	RAL_WRITE(sc, RT2560_RXCSR1, tmp);
2627	RAL_WRITE(sc, RT2560_RXCSR2, sc->rxq.physaddr);
2628
2629	/* initialize MAC registers to default values */
2630	for (i = 0; i < nitems(rt2560_def_mac); i++)
2631		RAL_WRITE(sc, rt2560_def_mac[i].reg, rt2560_def_mac[i].val);
2632
2633	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
2634	rt2560_set_macaddr(sc, ic->ic_myaddr);
2635
2636	/* set basic rate set (will be updated later) */
2637	RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x153);
2638
2639	rt2560_set_txantenna(sc, 1);
2640	rt2560_set_rxantenna(sc, 1);
2641	rt2560_set_slottime(sc);
2642	rt2560_update_plcp(sc);
2643	rt2560_update_led(sc, 0, 0);
2644
2645	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
2646	RAL_WRITE(sc, RT2560_CSR1, RT2560_HOST_READY);
2647
2648	if (rt2560_bbp_init(sc) != 0) {
2649		rt2560_stop(ifp, 1);
2650		return EIO;
2651	}
2652
2653	/* set default BSS channel */
2654	ic->ic_bss->ni_chan = ic->ic_ibss_chan;
2655	rt2560_set_chan(sc, ic->ic_bss->ni_chan);
2656
2657	/* kick Rx */
2658	tmp = RT2560_DROP_PHY_ERROR | RT2560_DROP_CRC_ERROR;
2659	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2660		tmp |= RT2560_DROP_CTL | RT2560_DROP_VERSION_ERROR;
2661#ifndef IEEE80211_STA_ONLY
2662		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
2663#endif
2664			tmp |= RT2560_DROP_TODS;
2665		if (!(ifp->if_flags & IFF_PROMISC))
2666			tmp |= RT2560_DROP_NOT_TO_ME;
2667	}
2668	RAL_WRITE(sc, RT2560_RXCSR0, tmp);
2669
2670	/* clear old FCS and Rx FIFO errors */
2671	RAL_READ(sc, RT2560_CNT0);
2672	RAL_READ(sc, RT2560_CNT4);
2673
2674	/* clear any pending interrupts */
2675	RAL_WRITE(sc, RT2560_CSR7, 0xffffffff);
2676
2677	/* enable interrupts */
2678	RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
2679
2680	ifp->if_flags &= ~IFF_OACTIVE;
2681	ifp->if_flags |= IFF_RUNNING;
2682
2683	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2684		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2685	else
2686		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2687
2688	return 0;
2689}
2690
2691void
2692rt2560_stop(struct ifnet *ifp, int disable)
2693{
2694	struct rt2560_softc *sc = ifp->if_softc;
2695	struct ieee80211com *ic = &sc->sc_ic;
2696
2697	sc->sc_tx_timer = 0;
2698	ifp->if_timer = 0;
2699	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2700
2701	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);	/* free all nodes */
2702
2703	/* abort Tx */
2704	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_ABORT_TX);
2705
2706	/* disable Rx */
2707	RAL_WRITE(sc, RT2560_RXCSR0, RT2560_DISABLE_RX);
2708
2709	/* reset ASIC (and thus, BBP) */
2710	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
2711	RAL_WRITE(sc, RT2560_CSR1, 0);
2712
2713	/* disable interrupts */
2714	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
2715
2716	/* clear any pending interrupt */
2717	RAL_WRITE(sc, RT2560_CSR7, 0xffffffff);
2718
2719	/* reset Tx and Rx rings */
2720	rt2560_reset_tx_ring(sc, &sc->txq);
2721	rt2560_reset_tx_ring(sc, &sc->atimq);
2722	rt2560_reset_tx_ring(sc, &sc->prioq);
2723	rt2560_reset_tx_ring(sc, &sc->bcnq);
2724	rt2560_reset_rx_ring(sc, &sc->rxq);
2725
2726	/* for CardBus, power down the socket */
2727	if (disable && sc->sc_disable != NULL) {
2728		if (sc->sc_flags & RT2560_ENABLED) {
2729			(*sc->sc_disable)(sc);
2730			sc->sc_flags &= ~RT2560_ENABLED;
2731		}
2732	}
2733}
2734
2735void
2736rt2560_powerhook(int why, void *arg)
2737{
2738	struct rt2560_softc *sc = arg;
2739	int s;
2740
2741	s = splnet();
2742	switch (why) {
2743	case DVACT_SUSPEND:
2744		rt2560_suspend(sc);
2745		break;
2746	case DVACT_RESUME:
2747		rt2560_resume(sc);
2748		break;
2749	}
2750	splx(s);
2751}
2752
2753struct cfdriver ral_cd = {
2754	NULL, "ral", DV_IFNET
2755};
2756