xref: /freebsd/sys/dev/ral/rt2560.c (revision 2be1a816b9ff69588e55be0a84cbe2a31efc0f2f)
1 /*	$FreeBSD$	*/
2 
3 /*-
4  * Copyright (c) 2005, 2006
5  *	Damien Bergamini <damien.bergamini@free.fr>
6  *
7  * Permission to use, copy, modify, and distribute this software for any
8  * purpose with or without fee is hereby granted, provided that the above
9  * copyright notice and this permission notice appear in all copies.
10  *
11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18  */
19 
20 #include <sys/cdefs.h>
21 __FBSDID("$FreeBSD$");
22 
23 /*-
24  * Ralink Technology RT2560 chipset driver
25  * http://www.ralinktech.com/
26  */
27 
28 #include <sys/param.h>
29 #include <sys/sysctl.h>
30 #include <sys/sockio.h>
31 #include <sys/mbuf.h>
32 #include <sys/kernel.h>
33 #include <sys/socket.h>
34 #include <sys/systm.h>
35 #include <sys/malloc.h>
36 #include <sys/lock.h>
37 #include <sys/mutex.h>
38 #include <sys/module.h>
39 #include <sys/bus.h>
40 #include <sys/endian.h>
41 
42 #include <machine/bus.h>
43 #include <machine/resource.h>
44 #include <sys/rman.h>
45 
46 #include <net/bpf.h>
47 #include <net/if.h>
48 #include <net/if_arp.h>
49 #include <net/ethernet.h>
50 #include <net/if_dl.h>
51 #include <net/if_media.h>
52 #include <net/if_types.h>
53 
54 #include <net80211/ieee80211_var.h>
55 #include <net80211/ieee80211_phy.h>
56 #include <net80211/ieee80211_radiotap.h>
57 #include <net80211/ieee80211_regdomain.h>
58 #include <net80211/ieee80211_amrr.h>
59 
60 #include <netinet/in.h>
61 #include <netinet/in_systm.h>
62 #include <netinet/in_var.h>
63 #include <netinet/ip.h>
64 #include <netinet/if_ether.h>
65 
66 #include <dev/ral/rt2560reg.h>
67 #include <dev/ral/rt2560var.h>
68 
69 #define RT2560_RSSI(sc, rssi)					\
70 	((rssi) > (RT2560_NOISE_FLOOR + (sc)->rssi_corr) ?	\
71 	 ((rssi) - RT2560_NOISE_FLOOR - (sc)->rssi_corr) : 0)
72 
73 #define RAL_DEBUG
74 #ifdef RAL_DEBUG
75 #define DPRINTF(sc, fmt, ...) do {				\
76 	if (sc->sc_debug > 0)					\
77 		printf(fmt, __VA_ARGS__);			\
78 } while (0)
79 #define DPRINTFN(sc, n, fmt, ...) do {				\
80 	if (sc->sc_debug >= (n))				\
81 		printf(fmt, __VA_ARGS__);			\
82 } while (0)
83 #else
84 #define DPRINTF(sc, fmt, ...)
85 #define DPRINTFN(sc, n, fmt, ...)
86 #endif
87 
88 static struct ieee80211vap *rt2560_vap_create(struct ieee80211com *,
89 			    const char name[IFNAMSIZ], int unit, int opmode,
90 			    int flags, const uint8_t bssid[IEEE80211_ADDR_LEN],
91 			    const uint8_t mac[IEEE80211_ADDR_LEN]);
92 static void		rt2560_vap_delete(struct ieee80211vap *);
93 static void		rt2560_dma_map_addr(void *, bus_dma_segment_t *, int,
94 			    int);
95 static int		rt2560_alloc_tx_ring(struct rt2560_softc *,
96 			    struct rt2560_tx_ring *, int);
97 static void		rt2560_reset_tx_ring(struct rt2560_softc *,
98 			    struct rt2560_tx_ring *);
99 static void		rt2560_free_tx_ring(struct rt2560_softc *,
100 			    struct rt2560_tx_ring *);
101 static int		rt2560_alloc_rx_ring(struct rt2560_softc *,
102 			    struct rt2560_rx_ring *, int);
103 static void		rt2560_reset_rx_ring(struct rt2560_softc *,
104 			    struct rt2560_rx_ring *);
105 static void		rt2560_free_rx_ring(struct rt2560_softc *,
106 			    struct rt2560_rx_ring *);
107 static struct		ieee80211_node *rt2560_node_alloc(
108 			    struct ieee80211_node_table *);
109 static void		rt2560_newassoc(struct ieee80211_node *, int);
110 static int		rt2560_newstate(struct ieee80211vap *,
111 			    enum ieee80211_state, int);
112 static uint16_t		rt2560_eeprom_read(struct rt2560_softc *, uint8_t);
113 static void		rt2560_encryption_intr(struct rt2560_softc *);
114 static void		rt2560_tx_intr(struct rt2560_softc *);
115 static void		rt2560_prio_intr(struct rt2560_softc *);
116 static void		rt2560_decryption_intr(struct rt2560_softc *);
117 static void		rt2560_rx_intr(struct rt2560_softc *);
118 static void		rt2560_beacon_update(struct ieee80211vap *, int item);
119 static void		rt2560_beacon_expire(struct rt2560_softc *);
120 static void		rt2560_wakeup_expire(struct rt2560_softc *);
121 static void		rt2560_scan_start(struct ieee80211com *);
122 static void		rt2560_scan_end(struct ieee80211com *);
123 static void		rt2560_set_channel(struct ieee80211com *);
124 static void		rt2560_setup_tx_desc(struct rt2560_softc *,
125 			    struct rt2560_tx_desc *, uint32_t, int, int, int,
126 			    bus_addr_t);
127 static int		rt2560_tx_bcn(struct rt2560_softc *, struct mbuf *,
128 			    struct ieee80211_node *);
129 static int		rt2560_tx_mgt(struct rt2560_softc *, struct mbuf *,
130 			    struct ieee80211_node *);
131 static int		rt2560_tx_data(struct rt2560_softc *, struct mbuf *,
132 			    struct ieee80211_node *);
133 static void		rt2560_start_locked(struct ifnet *);
134 static void		rt2560_start(struct ifnet *);
135 static void		rt2560_watchdog(void *);
136 static int		rt2560_ioctl(struct ifnet *, u_long, caddr_t);
137 static void		rt2560_bbp_write(struct rt2560_softc *, uint8_t,
138 			    uint8_t);
139 static uint8_t		rt2560_bbp_read(struct rt2560_softc *, uint8_t);
140 static void		rt2560_rf_write(struct rt2560_softc *, uint8_t,
141 			    uint32_t);
142 static void		rt2560_set_chan(struct rt2560_softc *,
143 			    struct ieee80211_channel *);
144 #if 0
145 static void		rt2560_disable_rf_tune(struct rt2560_softc *);
146 #endif
147 static void		rt2560_enable_tsf_sync(struct rt2560_softc *);
148 static void		rt2560_update_plcp(struct rt2560_softc *);
149 static void		rt2560_update_slot(struct ifnet *);
150 static void		rt2560_set_basicrates(struct rt2560_softc *);
151 static void		rt2560_update_led(struct rt2560_softc *, int, int);
152 static void		rt2560_set_bssid(struct rt2560_softc *, const uint8_t *);
153 static void		rt2560_set_macaddr(struct rt2560_softc *, uint8_t *);
154 static void		rt2560_get_macaddr(struct rt2560_softc *, uint8_t *);
155 static void		rt2560_update_promisc(struct ifnet *);
156 static const char	*rt2560_get_rf(int);
157 static void		rt2560_read_config(struct rt2560_softc *);
158 static int		rt2560_bbp_init(struct rt2560_softc *);
159 static void		rt2560_set_txantenna(struct rt2560_softc *, int);
160 static void		rt2560_set_rxantenna(struct rt2560_softc *, int);
161 static void		rt2560_init_locked(struct rt2560_softc *);
162 static void		rt2560_init(void *);
163 static void		rt2560_stop_locked(struct rt2560_softc *);
164 static int		rt2560_raw_xmit(struct ieee80211_node *, struct mbuf *,
165 				const struct ieee80211_bpf_params *);
166 
167 static const struct {
168 	uint32_t	reg;
169 	uint32_t	val;
170 } rt2560_def_mac[] = {
171 	RT2560_DEF_MAC
172 };
173 
174 static const struct {
175 	uint8_t	reg;
176 	uint8_t	val;
177 } rt2560_def_bbp[] = {
178 	RT2560_DEF_BBP
179 };
180 
181 static const uint32_t rt2560_rf2522_r2[]    = RT2560_RF2522_R2;
182 static const uint32_t rt2560_rf2523_r2[]    = RT2560_RF2523_R2;
183 static const uint32_t rt2560_rf2524_r2[]    = RT2560_RF2524_R2;
184 static const uint32_t rt2560_rf2525_r2[]    = RT2560_RF2525_R2;
185 static const uint32_t rt2560_rf2525_hi_r2[] = RT2560_RF2525_HI_R2;
186 static const uint32_t rt2560_rf2525e_r2[]   = RT2560_RF2525E_R2;
187 static const uint32_t rt2560_rf2526_r2[]    = RT2560_RF2526_R2;
188 static const uint32_t rt2560_rf2526_hi_r2[] = RT2560_RF2526_HI_R2;
189 
190 static const struct {
191 	uint8_t		chan;
192 	uint32_t	r1, r2, r4;
193 } rt2560_rf5222[] = {
194 	RT2560_RF5222
195 };
196 
197 int
198 rt2560_attach(device_t dev, int id)
199 {
200 	struct rt2560_softc *sc = device_get_softc(dev);
201 	struct ieee80211com *ic;
202 	struct ifnet *ifp;
203 	int error;
204 	uint8_t bands;
205 
206 	sc->sc_dev = dev;
207 
208 	mtx_init(&sc->sc_mtx, device_get_nameunit(dev), MTX_NETWORK_LOCK,
209 	    MTX_DEF | MTX_RECURSE);
210 
211 	callout_init_mtx(&sc->watchdog_ch, &sc->sc_mtx, 0);
212 
213 	/* retrieve RT2560 rev. no */
214 	sc->asic_rev = RAL_READ(sc, RT2560_CSR0);
215 
216 	/* retrieve RF rev. no and various other things from EEPROM */
217 	rt2560_read_config(sc);
218 
219 	device_printf(dev, "MAC/BBP RT2560 (rev 0x%02x), RF %s\n",
220 	    sc->asic_rev, rt2560_get_rf(sc->rf_rev));
221 
222 	/*
223 	 * Allocate Tx and Rx rings.
224 	 */
225 	error = rt2560_alloc_tx_ring(sc, &sc->txq, RT2560_TX_RING_COUNT);
226 	if (error != 0) {
227 		device_printf(sc->sc_dev, "could not allocate Tx ring\n");
228 		goto fail1;
229 	}
230 
231 	error = rt2560_alloc_tx_ring(sc, &sc->atimq, RT2560_ATIM_RING_COUNT);
232 	if (error != 0) {
233 		device_printf(sc->sc_dev, "could not allocate ATIM ring\n");
234 		goto fail2;
235 	}
236 
237 	error = rt2560_alloc_tx_ring(sc, &sc->prioq, RT2560_PRIO_RING_COUNT);
238 	if (error != 0) {
239 		device_printf(sc->sc_dev, "could not allocate Prio ring\n");
240 		goto fail3;
241 	}
242 
243 	error = rt2560_alloc_tx_ring(sc, &sc->bcnq, RT2560_BEACON_RING_COUNT);
244 	if (error != 0) {
245 		device_printf(sc->sc_dev, "could not allocate Beacon ring\n");
246 		goto fail4;
247 	}
248 
249 	error = rt2560_alloc_rx_ring(sc, &sc->rxq, RT2560_RX_RING_COUNT);
250 	if (error != 0) {
251 		device_printf(sc->sc_dev, "could not allocate Rx ring\n");
252 		goto fail5;
253 	}
254 
255 	ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
256 	if (ifp == NULL) {
257 		device_printf(sc->sc_dev, "can not if_alloc()\n");
258 		goto fail6;
259 	}
260 	ic = ifp->if_l2com;
261 
262 	/* retrieve MAC address */
263 	rt2560_get_macaddr(sc, ic->ic_myaddr);
264 
265 	ifp->if_softc = sc;
266 	if_initname(ifp, device_get_name(dev), device_get_unit(dev));
267 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
268 	ifp->if_init = rt2560_init;
269 	ifp->if_ioctl = rt2560_ioctl;
270 	ifp->if_start = rt2560_start;
271 	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
272 	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
273 	IFQ_SET_READY(&ifp->if_snd);
274 
275 	ic->ic_ifp = ifp;
276 	ic->ic_opmode = IEEE80211_M_STA;
277 	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
278 
279 	/* set device capabilities */
280 	ic->ic_caps =
281 		  IEEE80211_C_IBSS		/* ibss, nee adhoc, mode */
282 		| IEEE80211_C_HOSTAP		/* hostap mode */
283 		| IEEE80211_C_MONITOR		/* monitor mode */
284 		| IEEE80211_C_AHDEMO		/* adhoc demo mode */
285 		| IEEE80211_C_WDS		/* 4-address traffic works */
286 		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
287 		| IEEE80211_C_SHSLOT		/* short slot time supported */
288 		| IEEE80211_C_WPA		/* capable of WPA1+WPA2 */
289 		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
290 #ifdef notyet
291 		| IEEE80211_C_TXFRAG		/* handle tx frags */
292 #endif
293 		;
294 
295 	bands = 0;
296 	setbit(&bands, IEEE80211_MODE_11B);
297 	setbit(&bands, IEEE80211_MODE_11G);
298 	if (sc->rf_rev == RT2560_RF_5222)
299 		setbit(&bands, IEEE80211_MODE_11A);
300 	ieee80211_init_channels(ic, NULL, &bands);
301 
302 	ieee80211_ifattach(ic);
303 	ic->ic_newassoc = rt2560_newassoc;
304 	ic->ic_raw_xmit = rt2560_raw_xmit;
305 	ic->ic_updateslot = rt2560_update_slot;
306 	ic->ic_update_promisc = rt2560_update_promisc;
307 	ic->ic_node_alloc = rt2560_node_alloc;
308 	ic->ic_scan_start = rt2560_scan_start;
309 	ic->ic_scan_end = rt2560_scan_end;
310 	ic->ic_set_channel = rt2560_set_channel;
311 
312 	ic->ic_vap_create = rt2560_vap_create;
313 	ic->ic_vap_delete = rt2560_vap_delete;
314 
315 	bpfattach(ifp, DLT_IEEE802_11_RADIO,
316 	    sizeof (struct ieee80211_frame) + sizeof (sc->sc_txtap));
317 
318 	sc->sc_rxtap_len = sizeof sc->sc_rxtap;
319 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
320 	sc->sc_rxtap.wr_ihdr.it_present = htole32(RT2560_RX_RADIOTAP_PRESENT);
321 
322 	sc->sc_txtap_len = sizeof sc->sc_txtap;
323 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
324 	sc->sc_txtap.wt_ihdr.it_present = htole32(RT2560_TX_RADIOTAP_PRESENT);
325 
326 	/*
327 	 * Add a few sysctl knobs.
328 	 */
329 #ifdef RAL_DEBUG
330 	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
331 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
332 	    "debug", CTLFLAG_RW, &sc->sc_debug, 0, "debug msgs");
333 #endif
334 	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
335 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
336 	    "txantenna", CTLFLAG_RW, &sc->tx_ant, 0, "tx antenna (0=auto)");
337 
338 	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
339 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
340 	    "rxantenna", CTLFLAG_RW, &sc->rx_ant, 0, "rx antenna (0=auto)");
341 
342 	if (bootverbose)
343 		ieee80211_announce(ic);
344 
345 	return 0;
346 
347 fail6:	rt2560_free_rx_ring(sc, &sc->rxq);
348 fail5:	rt2560_free_tx_ring(sc, &sc->bcnq);
349 fail4:	rt2560_free_tx_ring(sc, &sc->prioq);
350 fail3:	rt2560_free_tx_ring(sc, &sc->atimq);
351 fail2:	rt2560_free_tx_ring(sc, &sc->txq);
352 fail1:	mtx_destroy(&sc->sc_mtx);
353 
354 	return ENXIO;
355 }
356 
357 int
358 rt2560_detach(void *xsc)
359 {
360 	struct rt2560_softc *sc = xsc;
361 	struct ifnet *ifp = sc->sc_ifp;
362 	struct ieee80211com *ic = ifp->if_l2com;
363 
364 	rt2560_stop(sc);
365 
366 	bpfdetach(ifp);
367 	ieee80211_ifdetach(ic);
368 
369 	rt2560_free_tx_ring(sc, &sc->txq);
370 	rt2560_free_tx_ring(sc, &sc->atimq);
371 	rt2560_free_tx_ring(sc, &sc->prioq);
372 	rt2560_free_tx_ring(sc, &sc->bcnq);
373 	rt2560_free_rx_ring(sc, &sc->rxq);
374 
375 	if_free(ifp);
376 
377 	mtx_destroy(&sc->sc_mtx);
378 
379 	return 0;
380 }
381 
382 static struct ieee80211vap *
383 rt2560_vap_create(struct ieee80211com *ic,
384 	const char name[IFNAMSIZ], int unit, int opmode, int flags,
385 	const uint8_t bssid[IEEE80211_ADDR_LEN],
386 	const uint8_t mac[IEEE80211_ADDR_LEN])
387 {
388 	struct ifnet *ifp = ic->ic_ifp;
389 	struct rt2560_vap *rvp;
390 	struct ieee80211vap *vap;
391 
392 	switch (opmode) {
393 	case IEEE80211_M_STA:
394 	case IEEE80211_M_IBSS:
395 	case IEEE80211_M_AHDEMO:
396 	case IEEE80211_M_MONITOR:
397 	case IEEE80211_M_HOSTAP:
398 		if (!TAILQ_EMPTY(&ic->ic_vaps)) {
399 			if_printf(ifp, "only 1 vap supported\n");
400 			return NULL;
401 		}
402 		if (opmode == IEEE80211_M_STA)
403 			flags |= IEEE80211_CLONE_NOBEACONS;
404 		break;
405 	case IEEE80211_M_WDS:
406 		if (TAILQ_EMPTY(&ic->ic_vaps) ||
407 		    ic->ic_opmode != IEEE80211_M_HOSTAP) {
408 			if_printf(ifp, "wds only supported in ap mode\n");
409 			return NULL;
410 		}
411 		/*
412 		 * Silently remove any request for a unique
413 		 * bssid; WDS vap's always share the local
414 		 * mac address.
415 		 */
416 		flags &= ~IEEE80211_CLONE_BSSID;
417 		break;
418 	default:
419 		if_printf(ifp, "unknown opmode %d\n", opmode);
420 		return NULL;
421 	}
422 	rvp = (struct rt2560_vap *) malloc(sizeof(struct rt2560_vap),
423 	    M_80211_VAP, M_NOWAIT | M_ZERO);
424 	if (rvp == NULL)
425 		return NULL;
426 	vap = &rvp->ral_vap;
427 	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid, mac);
428 
429 	/* override state transition machine */
430 	rvp->ral_newstate = vap->iv_newstate;
431 	vap->iv_newstate = rt2560_newstate;
432 	vap->iv_update_beacon = rt2560_beacon_update;
433 
434 	ieee80211_amrr_init(&rvp->amrr, vap,
435 	    IEEE80211_AMRR_MIN_SUCCESS_THRESHOLD,
436 	    IEEE80211_AMRR_MAX_SUCCESS_THRESHOLD,
437 	    500 /* ms */);
438 
439 	/* complete setup */
440 	ieee80211_vap_attach(vap, ieee80211_media_change, ieee80211_media_status);
441 	if (TAILQ_FIRST(&ic->ic_vaps) == vap)
442 		ic->ic_opmode = opmode;
443 	return vap;
444 }
445 
446 static void
447 rt2560_vap_delete(struct ieee80211vap *vap)
448 {
449 	struct rt2560_vap *rvp = RT2560_VAP(vap);
450 
451 	ieee80211_amrr_cleanup(&rvp->amrr);
452 	ieee80211_vap_detach(vap);
453 	free(rvp, M_80211_VAP);
454 }
455 
456 void
457 rt2560_resume(void *xsc)
458 {
459 	struct rt2560_softc *sc = xsc;
460 	struct ifnet *ifp = sc->sc_ifp;
461 
462 	if (ifp->if_flags & IFF_UP)
463 		rt2560_init(sc);
464 }
465 
466 static void
467 rt2560_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nseg, int error)
468 {
469 	if (error != 0)
470 		return;
471 
472 	KASSERT(nseg == 1, ("too many DMA segments, %d should be 1", nseg));
473 
474 	*(bus_addr_t *)arg = segs[0].ds_addr;
475 }
476 
477 static int
478 rt2560_alloc_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring,
479     int count)
480 {
481 	int i, error;
482 
483 	ring->count = count;
484 	ring->queued = 0;
485 	ring->cur = ring->next = 0;
486 	ring->cur_encrypt = ring->next_encrypt = 0;
487 
488 	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 4, 0,
489 	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
490 	    count * RT2560_TX_DESC_SIZE, 1, count * RT2560_TX_DESC_SIZE,
491 	    0, NULL, NULL, &ring->desc_dmat);
492 	if (error != 0) {
493 		device_printf(sc->sc_dev, "could not create desc DMA tag\n");
494 		goto fail;
495 	}
496 
497 	error = bus_dmamem_alloc(ring->desc_dmat, (void **)&ring->desc,
498 	    BUS_DMA_NOWAIT | BUS_DMA_ZERO, &ring->desc_map);
499 	if (error != 0) {
500 		device_printf(sc->sc_dev, "could not allocate DMA memory\n");
501 		goto fail;
502 	}
503 
504 	error = bus_dmamap_load(ring->desc_dmat, ring->desc_map, ring->desc,
505 	    count * RT2560_TX_DESC_SIZE, rt2560_dma_map_addr, &ring->physaddr,
506 	    0);
507 	if (error != 0) {
508 		device_printf(sc->sc_dev, "could not load desc DMA map\n");
509 		goto fail;
510 	}
511 
512 	ring->data = malloc(count * sizeof (struct rt2560_tx_data), M_DEVBUF,
513 	    M_NOWAIT | M_ZERO);
514 	if (ring->data == NULL) {
515 		device_printf(sc->sc_dev, "could not allocate soft data\n");
516 		error = ENOMEM;
517 		goto fail;
518 	}
519 
520 	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
521 	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
522 	    MCLBYTES, RT2560_MAX_SCATTER, MCLBYTES, 0, NULL, NULL,
523 	    &ring->data_dmat);
524 	if (error != 0) {
525 		device_printf(sc->sc_dev, "could not create data DMA tag\n");
526 		goto fail;
527 	}
528 
529 	for (i = 0; i < count; i++) {
530 		error = bus_dmamap_create(ring->data_dmat, 0,
531 		    &ring->data[i].map);
532 		if (error != 0) {
533 			device_printf(sc->sc_dev, "could not create DMA map\n");
534 			goto fail;
535 		}
536 	}
537 
538 	return 0;
539 
540 fail:	rt2560_free_tx_ring(sc, ring);
541 	return error;
542 }
543 
544 static void
545 rt2560_reset_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring)
546 {
547 	struct rt2560_tx_desc *desc;
548 	struct rt2560_tx_data *data;
549 	int i;
550 
551 	for (i = 0; i < ring->count; i++) {
552 		desc = &ring->desc[i];
553 		data = &ring->data[i];
554 
555 		if (data->m != NULL) {
556 			bus_dmamap_sync(ring->data_dmat, data->map,
557 			    BUS_DMASYNC_POSTWRITE);
558 			bus_dmamap_unload(ring->data_dmat, data->map);
559 			m_freem(data->m);
560 			data->m = NULL;
561 		}
562 
563 		if (data->ni != NULL) {
564 			ieee80211_free_node(data->ni);
565 			data->ni = NULL;
566 		}
567 
568 		desc->flags = 0;
569 	}
570 
571 	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
572 
573 	ring->queued = 0;
574 	ring->cur = ring->next = 0;
575 	ring->cur_encrypt = ring->next_encrypt = 0;
576 }
577 
578 static void
579 rt2560_free_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring)
580 {
581 	struct rt2560_tx_data *data;
582 	int i;
583 
584 	if (ring->desc != NULL) {
585 		bus_dmamap_sync(ring->desc_dmat, ring->desc_map,
586 		    BUS_DMASYNC_POSTWRITE);
587 		bus_dmamap_unload(ring->desc_dmat, ring->desc_map);
588 		bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
589 	}
590 
591 	if (ring->desc_dmat != NULL)
592 		bus_dma_tag_destroy(ring->desc_dmat);
593 
594 	if (ring->data != NULL) {
595 		for (i = 0; i < ring->count; i++) {
596 			data = &ring->data[i];
597 
598 			if (data->m != NULL) {
599 				bus_dmamap_sync(ring->data_dmat, data->map,
600 				    BUS_DMASYNC_POSTWRITE);
601 				bus_dmamap_unload(ring->data_dmat, data->map);
602 				m_freem(data->m);
603 			}
604 
605 			if (data->ni != NULL)
606 				ieee80211_free_node(data->ni);
607 
608 			if (data->map != NULL)
609 				bus_dmamap_destroy(ring->data_dmat, data->map);
610 		}
611 
612 		free(ring->data, M_DEVBUF);
613 	}
614 
615 	if (ring->data_dmat != NULL)
616 		bus_dma_tag_destroy(ring->data_dmat);
617 }
618 
619 static int
620 rt2560_alloc_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring,
621     int count)
622 {
623 	struct rt2560_rx_desc *desc;
624 	struct rt2560_rx_data *data;
625 	bus_addr_t physaddr;
626 	int i, error;
627 
628 	ring->count = count;
629 	ring->cur = ring->next = 0;
630 	ring->cur_decrypt = 0;
631 
632 	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 4, 0,
633 	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
634 	    count * RT2560_RX_DESC_SIZE, 1, count * RT2560_RX_DESC_SIZE,
635 	    0, NULL, NULL, &ring->desc_dmat);
636 	if (error != 0) {
637 		device_printf(sc->sc_dev, "could not create desc DMA tag\n");
638 		goto fail;
639 	}
640 
641 	error = bus_dmamem_alloc(ring->desc_dmat, (void **)&ring->desc,
642 	    BUS_DMA_NOWAIT | BUS_DMA_ZERO, &ring->desc_map);
643 	if (error != 0) {
644 		device_printf(sc->sc_dev, "could not allocate DMA memory\n");
645 		goto fail;
646 	}
647 
648 	error = bus_dmamap_load(ring->desc_dmat, ring->desc_map, ring->desc,
649 	    count * RT2560_RX_DESC_SIZE, rt2560_dma_map_addr, &ring->physaddr,
650 	    0);
651 	if (error != 0) {
652 		device_printf(sc->sc_dev, "could not load desc DMA map\n");
653 		goto fail;
654 	}
655 
656 	ring->data = malloc(count * sizeof (struct rt2560_rx_data), M_DEVBUF,
657 	    M_NOWAIT | M_ZERO);
658 	if (ring->data == NULL) {
659 		device_printf(sc->sc_dev, "could not allocate soft data\n");
660 		error = ENOMEM;
661 		goto fail;
662 	}
663 
664 	/*
665 	 * Pre-allocate Rx buffers and populate Rx ring.
666 	 */
667 	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
668 	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES,
669 	    1, MCLBYTES, 0, NULL, NULL, &ring->data_dmat);
670 	if (error != 0) {
671 		device_printf(sc->sc_dev, "could not create data DMA tag\n");
672 		goto fail;
673 	}
674 
675 	for (i = 0; i < count; i++) {
676 		desc = &sc->rxq.desc[i];
677 		data = &sc->rxq.data[i];
678 
679 		error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
680 		if (error != 0) {
681 			device_printf(sc->sc_dev, "could not create DMA map\n");
682 			goto fail;
683 		}
684 
685 		data->m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
686 		if (data->m == NULL) {
687 			device_printf(sc->sc_dev,
688 			    "could not allocate rx mbuf\n");
689 			error = ENOMEM;
690 			goto fail;
691 		}
692 
693 		error = bus_dmamap_load(ring->data_dmat, data->map,
694 		    mtod(data->m, void *), MCLBYTES, rt2560_dma_map_addr,
695 		    &physaddr, 0);
696 		if (error != 0) {
697 			device_printf(sc->sc_dev,
698 			    "could not load rx buf DMA map");
699 			goto fail;
700 		}
701 
702 		desc->flags = htole32(RT2560_RX_BUSY);
703 		desc->physaddr = htole32(physaddr);
704 	}
705 
706 	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
707 
708 	return 0;
709 
710 fail:	rt2560_free_rx_ring(sc, ring);
711 	return error;
712 }
713 
714 static void
715 rt2560_reset_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring)
716 {
717 	int i;
718 
719 	for (i = 0; i < ring->count; i++) {
720 		ring->desc[i].flags = htole32(RT2560_RX_BUSY);
721 		ring->data[i].drop = 0;
722 	}
723 
724 	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
725 
726 	ring->cur = ring->next = 0;
727 	ring->cur_decrypt = 0;
728 }
729 
730 static void
731 rt2560_free_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring)
732 {
733 	struct rt2560_rx_data *data;
734 	int i;
735 
736 	if (ring->desc != NULL) {
737 		bus_dmamap_sync(ring->desc_dmat, ring->desc_map,
738 		    BUS_DMASYNC_POSTWRITE);
739 		bus_dmamap_unload(ring->desc_dmat, ring->desc_map);
740 		bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
741 	}
742 
743 	if (ring->desc_dmat != NULL)
744 		bus_dma_tag_destroy(ring->desc_dmat);
745 
746 	if (ring->data != NULL) {
747 		for (i = 0; i < ring->count; i++) {
748 			data = &ring->data[i];
749 
750 			if (data->m != NULL) {
751 				bus_dmamap_sync(ring->data_dmat, data->map,
752 				    BUS_DMASYNC_POSTREAD);
753 				bus_dmamap_unload(ring->data_dmat, data->map);
754 				m_freem(data->m);
755 			}
756 
757 			if (data->map != NULL)
758 				bus_dmamap_destroy(ring->data_dmat, data->map);
759 		}
760 
761 		free(ring->data, M_DEVBUF);
762 	}
763 
764 	if (ring->data_dmat != NULL)
765 		bus_dma_tag_destroy(ring->data_dmat);
766 }
767 
768 static struct ieee80211_node *
769 rt2560_node_alloc(struct ieee80211_node_table *nt)
770 {
771 	struct rt2560_node *rn;
772 
773 	rn = malloc(sizeof (struct rt2560_node), M_80211_NODE,
774 	    M_NOWAIT | M_ZERO);
775 
776 	return (rn != NULL) ? &rn->ni : NULL;
777 }
778 
779 static void
780 rt2560_newassoc(struct ieee80211_node *ni, int isnew)
781 {
782 	struct ieee80211vap *vap = ni->ni_vap;
783 
784 	ieee80211_amrr_node_init(&RT2560_VAP(vap)->amrr,
785 	    &RT2560_NODE(ni)->amrr, ni);
786 }
787 
788 static int
789 rt2560_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
790 {
791 	struct rt2560_vap *rvp = RT2560_VAP(vap);
792 	struct ifnet *ifp = vap->iv_ic->ic_ifp;
793 	struct rt2560_softc *sc = ifp->if_softc;
794 	int error;
795 
796 	if (nstate == IEEE80211_S_INIT && vap->iv_state == IEEE80211_S_RUN) {
797 		/* abort TSF synchronization */
798 		RAL_WRITE(sc, RT2560_CSR14, 0);
799 
800 		/* turn association led off */
801 		rt2560_update_led(sc, 0, 0);
802 	}
803 
804 	error = rvp->ral_newstate(vap, nstate, arg);
805 
806 	if (error == 0 && nstate == IEEE80211_S_RUN) {
807 		struct ieee80211_node *ni = vap->iv_bss;
808 		struct mbuf *m;
809 
810 		if (vap->iv_opmode != IEEE80211_M_MONITOR) {
811 			rt2560_update_plcp(sc);
812 			rt2560_set_basicrates(sc);
813 			rt2560_set_bssid(sc, ni->ni_bssid);
814 		}
815 
816 		if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
817 		    vap->iv_opmode == IEEE80211_M_IBSS) {
818 			m = ieee80211_beacon_alloc(ni, &rvp->ral_bo);
819 			if (m == NULL) {
820 				if_printf(ifp, "could not allocate beacon\n");
821 				return ENOBUFS;
822 			}
823 			ieee80211_ref_node(ni);
824 			error = rt2560_tx_bcn(sc, m, ni);
825 			if (error != 0)
826 				return error;
827 		}
828 
829 		/* turn assocation led on */
830 		rt2560_update_led(sc, 1, 0);
831 
832 		if (vap->iv_opmode != IEEE80211_M_MONITOR) {
833 			if (vap->iv_opmode == IEEE80211_M_STA) {
834 				/* fake a join to init the tx rate */
835 				rt2560_newassoc(ni, 1);
836 			}
837 			rt2560_enable_tsf_sync(sc);
838 		}
839 	}
840 	return error;
841 }
842 
843 /*
844  * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46 or
845  * 93C66).
846  */
847 static uint16_t
848 rt2560_eeprom_read(struct rt2560_softc *sc, uint8_t addr)
849 {
850 	uint32_t tmp;
851 	uint16_t val;
852 	int n;
853 
854 	/* clock C once before the first command */
855 	RT2560_EEPROM_CTL(sc, 0);
856 
857 	RT2560_EEPROM_CTL(sc, RT2560_S);
858 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
859 	RT2560_EEPROM_CTL(sc, RT2560_S);
860 
861 	/* write start bit (1) */
862 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D);
863 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D | RT2560_C);
864 
865 	/* write READ opcode (10) */
866 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D);
867 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D | RT2560_C);
868 	RT2560_EEPROM_CTL(sc, RT2560_S);
869 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
870 
871 	/* write address (A5-A0 or A7-A0) */
872 	n = (RAL_READ(sc, RT2560_CSR21) & RT2560_93C46) ? 5 : 7;
873 	for (; n >= 0; n--) {
874 		RT2560_EEPROM_CTL(sc, RT2560_S |
875 		    (((addr >> n) & 1) << RT2560_SHIFT_D));
876 		RT2560_EEPROM_CTL(sc, RT2560_S |
877 		    (((addr >> n) & 1) << RT2560_SHIFT_D) | RT2560_C);
878 	}
879 
880 	RT2560_EEPROM_CTL(sc, RT2560_S);
881 
882 	/* read data Q15-Q0 */
883 	val = 0;
884 	for (n = 15; n >= 0; n--) {
885 		RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
886 		tmp = RAL_READ(sc, RT2560_CSR21);
887 		val |= ((tmp & RT2560_Q) >> RT2560_SHIFT_Q) << n;
888 		RT2560_EEPROM_CTL(sc, RT2560_S);
889 	}
890 
891 	RT2560_EEPROM_CTL(sc, 0);
892 
893 	/* clear Chip Select and clock C */
894 	RT2560_EEPROM_CTL(sc, RT2560_S);
895 	RT2560_EEPROM_CTL(sc, 0);
896 	RT2560_EEPROM_CTL(sc, RT2560_C);
897 
898 	return val;
899 }
900 
901 /*
902  * Some frames were processed by the hardware cipher engine and are ready for
903  * transmission.
904  */
905 static void
906 rt2560_encryption_intr(struct rt2560_softc *sc)
907 {
908 	struct rt2560_tx_desc *desc;
909 	int hw;
910 
911 	/* retrieve last descriptor index processed by cipher engine */
912 	hw = RAL_READ(sc, RT2560_SECCSR1) - sc->txq.physaddr;
913 	hw /= RT2560_TX_DESC_SIZE;
914 
915 	bus_dmamap_sync(sc->txq.desc_dmat, sc->txq.desc_map,
916 	    BUS_DMASYNC_POSTREAD);
917 
918 	while (sc->txq.next_encrypt != hw) {
919 		if (sc->txq.next_encrypt == sc->txq.cur_encrypt) {
920 			printf("hw encrypt %d, cur_encrypt %d\n", hw,
921 			    sc->txq.cur_encrypt);
922 			break;
923 		}
924 
925 		desc = &sc->txq.desc[sc->txq.next_encrypt];
926 
927 		if ((le32toh(desc->flags) & RT2560_TX_BUSY) ||
928 		    (le32toh(desc->flags) & RT2560_TX_CIPHER_BUSY))
929 			break;
930 
931 		/* for TKIP, swap eiv field to fix a bug in ASIC */
932 		if ((le32toh(desc->flags) & RT2560_TX_CIPHER_MASK) ==
933 		    RT2560_TX_CIPHER_TKIP)
934 			desc->eiv = bswap32(desc->eiv);
935 
936 		/* mark the frame ready for transmission */
937 		desc->flags |= htole32(RT2560_TX_VALID);
938 		desc->flags |= htole32(RT2560_TX_BUSY);
939 
940 		DPRINTFN(sc, 15, "encryption done idx=%u\n",
941 		    sc->txq.next_encrypt);
942 
943 		sc->txq.next_encrypt =
944 		    (sc->txq.next_encrypt + 1) % RT2560_TX_RING_COUNT;
945 	}
946 
947 	bus_dmamap_sync(sc->txq.desc_dmat, sc->txq.desc_map,
948 	    BUS_DMASYNC_PREWRITE);
949 
950 	/* kick Tx */
951 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_TX);
952 }
953 
954 static void
955 rt2560_tx_intr(struct rt2560_softc *sc)
956 {
957 	struct ifnet *ifp = sc->sc_ifp;
958 	struct rt2560_tx_desc *desc;
959 	struct rt2560_tx_data *data;
960 	struct rt2560_node *rn;
961 	struct mbuf *m;
962 	uint32_t flags;
963 	int retrycnt;
964 
965 	bus_dmamap_sync(sc->txq.desc_dmat, sc->txq.desc_map,
966 	    BUS_DMASYNC_POSTREAD);
967 
968 	for (;;) {
969 		desc = &sc->txq.desc[sc->txq.next];
970 		data = &sc->txq.data[sc->txq.next];
971 
972 		flags = le32toh(desc->flags);
973 		if ((flags & RT2560_TX_BUSY) ||
974 		    (flags & RT2560_TX_CIPHER_BUSY) ||
975 		    !(flags & RT2560_TX_VALID))
976 			break;
977 
978 		rn = (struct rt2560_node *)data->ni;
979 		m = data->m;
980 
981 		switch (flags & RT2560_TX_RESULT_MASK) {
982 		case RT2560_TX_SUCCESS:
983 			DPRINTFN(sc, 10, "%s\n", "data frame sent successfully");
984 			if (data->rix != IEEE80211_FIXED_RATE_NONE)
985 				ieee80211_amrr_tx_complete(&rn->amrr,
986 				    IEEE80211_AMRR_SUCCESS, 0);
987 			ifp->if_opackets++;
988 			break;
989 
990 		case RT2560_TX_SUCCESS_RETRY:
991 			retrycnt = RT2560_TX_RETRYCNT(flags);
992 
993 			DPRINTFN(sc, 9, "data frame sent after %u retries\n",
994 			    retrycnt);
995 			if (data->rix != IEEE80211_FIXED_RATE_NONE)
996 				ieee80211_amrr_tx_complete(&rn->amrr,
997 				    IEEE80211_AMRR_SUCCESS, retrycnt);
998 			ifp->if_opackets++;
999 			break;
1000 
1001 		case RT2560_TX_FAIL_RETRY:
1002 			retrycnt = RT2560_TX_RETRYCNT(flags);
1003 
1004 			DPRINTFN(sc, 9, "data frame failed after %d retries\n",
1005 			    retrycnt);
1006 			if (data->rix != IEEE80211_FIXED_RATE_NONE)
1007 				ieee80211_amrr_tx_complete(&rn->amrr,
1008 				    IEEE80211_AMRR_FAILURE, retrycnt);
1009 			ifp->if_oerrors++;
1010 			break;
1011 
1012 		case RT2560_TX_FAIL_INVALID:
1013 		case RT2560_TX_FAIL_OTHER:
1014 		default:
1015 			device_printf(sc->sc_dev, "sending data frame failed "
1016 			    "0x%08x\n", flags);
1017 			ifp->if_oerrors++;
1018 		}
1019 
1020 		bus_dmamap_sync(sc->txq.data_dmat, data->map,
1021 		    BUS_DMASYNC_POSTWRITE);
1022 		bus_dmamap_unload(sc->txq.data_dmat, data->map);
1023 		m_freem(m);
1024 		data->m = NULL;
1025 		ieee80211_free_node(data->ni);
1026 		data->ni = NULL;
1027 
1028 		/* descriptor is no longer valid */
1029 		desc->flags &= ~htole32(RT2560_TX_VALID);
1030 
1031 		DPRINTFN(sc, 15, "tx done idx=%u\n", sc->txq.next);
1032 
1033 		sc->txq.queued--;
1034 		sc->txq.next = (sc->txq.next + 1) % RT2560_TX_RING_COUNT;
1035 	}
1036 
1037 	bus_dmamap_sync(sc->txq.desc_dmat, sc->txq.desc_map,
1038 	    BUS_DMASYNC_PREWRITE);
1039 
1040 	if (sc->prioq.queued == 0 && sc->txq.queued == 0)
1041 		sc->sc_tx_timer = 0;
1042 
1043 	if (sc->txq.queued < RT2560_TX_RING_COUNT - 1) {
1044 		sc->sc_flags &= ~RT2560_F_DATA_OACTIVE;
1045 		if ((sc->sc_flags &
1046 		     (RT2560_F_DATA_OACTIVE | RT2560_F_PRIO_OACTIVE)) == 0)
1047 			ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1048 		rt2560_start_locked(ifp);
1049 	}
1050 }
1051 
1052 static void
1053 rt2560_prio_intr(struct rt2560_softc *sc)
1054 {
1055 	struct ifnet *ifp = sc->sc_ifp;
1056 	struct rt2560_tx_desc *desc;
1057 	struct rt2560_tx_data *data;
1058 	struct ieee80211_node *ni;
1059 	struct mbuf *m;
1060 	int flags;
1061 
1062 	bus_dmamap_sync(sc->prioq.desc_dmat, sc->prioq.desc_map,
1063 	    BUS_DMASYNC_POSTREAD);
1064 
1065 	for (;;) {
1066 		desc = &sc->prioq.desc[sc->prioq.next];
1067 		data = &sc->prioq.data[sc->prioq.next];
1068 
1069 		flags = le32toh(desc->flags);
1070 		if ((flags & RT2560_TX_BUSY) || (flags & RT2560_TX_VALID) == 0)
1071 			break;
1072 
1073 		switch (flags & RT2560_TX_RESULT_MASK) {
1074 		case RT2560_TX_SUCCESS:
1075 			DPRINTFN(sc, 10, "%s\n", "mgt frame sent successfully");
1076 			break;
1077 
1078 		case RT2560_TX_SUCCESS_RETRY:
1079 			DPRINTFN(sc, 9, "mgt frame sent after %u retries\n",
1080 			    (flags >> 5) & 0x7);
1081 			break;
1082 
1083 		case RT2560_TX_FAIL_RETRY:
1084 			DPRINTFN(sc, 9, "%s\n",
1085 			    "sending mgt frame failed (too much retries)");
1086 			break;
1087 
1088 		case RT2560_TX_FAIL_INVALID:
1089 		case RT2560_TX_FAIL_OTHER:
1090 		default:
1091 			device_printf(sc->sc_dev, "sending mgt frame failed "
1092 			    "0x%08x\n", flags);
1093 			break;
1094 		}
1095 
1096 		bus_dmamap_sync(sc->prioq.data_dmat, data->map,
1097 		    BUS_DMASYNC_POSTWRITE);
1098 		bus_dmamap_unload(sc->prioq.data_dmat, data->map);
1099 
1100 		m = data->m;
1101 		data->m = NULL;
1102 		ni = data->ni;
1103 		data->ni = NULL;
1104 
1105 		/* descriptor is no longer valid */
1106 		desc->flags &= ~htole32(RT2560_TX_VALID);
1107 
1108 		DPRINTFN(sc, 15, "prio done idx=%u\n", sc->prioq.next);
1109 
1110 		sc->prioq.queued--;
1111 		sc->prioq.next = (sc->prioq.next + 1) % RT2560_PRIO_RING_COUNT;
1112 
1113 		if (m->m_flags & M_TXCB)
1114 			ieee80211_process_callback(ni, m,
1115 				(flags & RT2560_TX_RESULT_MASK) &~
1116 				(RT2560_TX_SUCCESS | RT2560_TX_SUCCESS_RETRY));
1117 		m_freem(m);
1118 		ieee80211_free_node(ni);
1119 	}
1120 
1121 	bus_dmamap_sync(sc->prioq.desc_dmat, sc->prioq.desc_map,
1122 	    BUS_DMASYNC_PREWRITE);
1123 
1124 	if (sc->prioq.queued == 0 && sc->txq.queued == 0)
1125 		sc->sc_tx_timer = 0;
1126 
1127 	if (sc->prioq.queued < RT2560_PRIO_RING_COUNT) {
1128 		sc->sc_flags &= ~RT2560_F_PRIO_OACTIVE;
1129 		if ((sc->sc_flags &
1130 		     (RT2560_F_DATA_OACTIVE | RT2560_F_PRIO_OACTIVE)) == 0)
1131 			ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1132 		rt2560_start_locked(ifp);
1133 	}
1134 }
1135 
1136 /*
1137  * Some frames were processed by the hardware cipher engine and are ready for
1138  * handoff to the IEEE802.11 layer.
1139  */
1140 static void
1141 rt2560_decryption_intr(struct rt2560_softc *sc)
1142 {
1143 	struct ifnet *ifp = sc->sc_ifp;
1144 	struct ieee80211com *ic = ifp->if_l2com;
1145 	struct rt2560_rx_desc *desc;
1146 	struct rt2560_rx_data *data;
1147 	bus_addr_t physaddr;
1148 	struct ieee80211_frame *wh;
1149 	struct ieee80211_node *ni;
1150 	struct mbuf *mnew, *m;
1151 	int hw, error;
1152 
1153 	/* retrieve last decriptor index processed by cipher engine */
1154 	hw = RAL_READ(sc, RT2560_SECCSR0) - sc->rxq.physaddr;
1155 	hw /= RT2560_RX_DESC_SIZE;
1156 
1157 	bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
1158 	    BUS_DMASYNC_POSTREAD);
1159 
1160 	for (; sc->rxq.cur_decrypt != hw;) {
1161 		desc = &sc->rxq.desc[sc->rxq.cur_decrypt];
1162 		data = &sc->rxq.data[sc->rxq.cur_decrypt];
1163 
1164 		if ((le32toh(desc->flags) & RT2560_RX_BUSY) ||
1165 		    (le32toh(desc->flags) & RT2560_RX_CIPHER_BUSY))
1166 			break;
1167 
1168 		if (data->drop) {
1169 			ifp->if_ierrors++;
1170 			goto skip;
1171 		}
1172 
1173 		if ((le32toh(desc->flags) & RT2560_RX_CIPHER_MASK) != 0 &&
1174 		    (le32toh(desc->flags) & RT2560_RX_ICV_ERROR)) {
1175 			ifp->if_ierrors++;
1176 			goto skip;
1177 		}
1178 
1179 		/*
1180 		 * Try to allocate a new mbuf for this ring element and load it
1181 		 * before processing the current mbuf. If the ring element
1182 		 * cannot be loaded, drop the received packet and reuse the old
1183 		 * mbuf. In the unlikely case that the old mbuf can't be
1184 		 * reloaded either, explicitly panic.
1185 		 */
1186 		mnew = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
1187 		if (mnew == NULL) {
1188 			ifp->if_ierrors++;
1189 			goto skip;
1190 		}
1191 
1192 		bus_dmamap_sync(sc->rxq.data_dmat, data->map,
1193 		    BUS_DMASYNC_POSTREAD);
1194 		bus_dmamap_unload(sc->rxq.data_dmat, data->map);
1195 
1196 		error = bus_dmamap_load(sc->rxq.data_dmat, data->map,
1197 		    mtod(mnew, void *), MCLBYTES, rt2560_dma_map_addr,
1198 		    &physaddr, 0);
1199 		if (error != 0) {
1200 			m_freem(mnew);
1201 
1202 			/* try to reload the old mbuf */
1203 			error = bus_dmamap_load(sc->rxq.data_dmat, data->map,
1204 			    mtod(data->m, void *), MCLBYTES,
1205 			    rt2560_dma_map_addr, &physaddr, 0);
1206 			if (error != 0) {
1207 				/* very unlikely that it will fail... */
1208 				panic("%s: could not load old rx mbuf",
1209 				    device_get_name(sc->sc_dev));
1210 			}
1211 			ifp->if_ierrors++;
1212 			goto skip;
1213 		}
1214 
1215 		/*
1216 	 	 * New mbuf successfully loaded, update Rx ring and continue
1217 		 * processing.
1218 		 */
1219 		m = data->m;
1220 		data->m = mnew;
1221 		desc->physaddr = htole32(physaddr);
1222 
1223 		/* finalize mbuf */
1224 		m->m_pkthdr.rcvif = ifp;
1225 		m->m_pkthdr.len = m->m_len =
1226 		    (le32toh(desc->flags) >> 16) & 0xfff;
1227 
1228 		if (bpf_peers_present(ifp->if_bpf)) {
1229 			struct rt2560_rx_radiotap_header *tap = &sc->sc_rxtap;
1230 			uint32_t tsf_lo, tsf_hi;
1231 
1232 			/* get timestamp (low and high 32 bits) */
1233 			tsf_hi = RAL_READ(sc, RT2560_CSR17);
1234 			tsf_lo = RAL_READ(sc, RT2560_CSR16);
1235 
1236 			tap->wr_tsf =
1237 			    htole64(((uint64_t)tsf_hi << 32) | tsf_lo);
1238 			tap->wr_flags = 0;
1239 			tap->wr_rate = ieee80211_plcp2rate(desc->rate,
1240 			    le32toh(desc->flags) & RT2560_RX_OFDM);
1241 			tap->wr_antenna = sc->rx_ant;
1242 			tap->wr_antsignal = RT2560_RSSI(sc, desc->rssi);
1243 
1244 			bpf_mtap2(ifp->if_bpf, tap, sc->sc_rxtap_len, m);
1245 		}
1246 
1247 		sc->sc_flags |= RT2560_F_INPUT_RUNNING;
1248 		RAL_UNLOCK(sc);
1249 		wh = mtod(m, struct ieee80211_frame *);
1250 		ni = ieee80211_find_rxnode(ic,
1251 		    (struct ieee80211_frame_min *)wh);
1252 		if (ni != NULL) {
1253 			(void) ieee80211_input(ni, m,
1254 			    RT2560_RSSI(sc, desc->rssi), RT2560_NOISE_FLOOR, 0);
1255 			ieee80211_free_node(ni);
1256 		} else
1257 			(void) ieee80211_input_all(ic, m,
1258 			    RT2560_RSSI(sc, desc->rssi), RT2560_NOISE_FLOOR, 0);
1259 
1260 		RAL_LOCK(sc);
1261 		sc->sc_flags &= ~RT2560_F_INPUT_RUNNING;
1262 skip:		desc->flags = htole32(RT2560_RX_BUSY);
1263 
1264 		DPRINTFN(sc, 15, "decryption done idx=%u\n", sc->rxq.cur_decrypt);
1265 
1266 		sc->rxq.cur_decrypt =
1267 		    (sc->rxq.cur_decrypt + 1) % RT2560_RX_RING_COUNT;
1268 	}
1269 
1270 	bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
1271 	    BUS_DMASYNC_PREWRITE);
1272 }
1273 
1274 /*
1275  * Some frames were received. Pass them to the hardware cipher engine before
1276  * sending them to the 802.11 layer.
1277  */
1278 static void
1279 rt2560_rx_intr(struct rt2560_softc *sc)
1280 {
1281 	struct rt2560_rx_desc *desc;
1282 	struct rt2560_rx_data *data;
1283 
1284 	bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
1285 	    BUS_DMASYNC_POSTREAD);
1286 
1287 	for (;;) {
1288 		desc = &sc->rxq.desc[sc->rxq.cur];
1289 		data = &sc->rxq.data[sc->rxq.cur];
1290 
1291 		if ((le32toh(desc->flags) & RT2560_RX_BUSY) ||
1292 		    (le32toh(desc->flags) & RT2560_RX_CIPHER_BUSY))
1293 			break;
1294 
1295 		data->drop = 0;
1296 
1297 		if ((le32toh(desc->flags) & RT2560_RX_PHY_ERROR) ||
1298 		    (le32toh(desc->flags) & RT2560_RX_CRC_ERROR)) {
1299 			/*
1300 			 * This should not happen since we did not request
1301 			 * to receive those frames when we filled RXCSR0.
1302 			 */
1303 			DPRINTFN(sc, 5, "PHY or CRC error flags 0x%08x\n",
1304 			    le32toh(desc->flags));
1305 			data->drop = 1;
1306 		}
1307 
1308 		if (((le32toh(desc->flags) >> 16) & 0xfff) > MCLBYTES) {
1309 			DPRINTFN(sc, 5, "%s\n", "bad length");
1310 			data->drop = 1;
1311 		}
1312 
1313 		/* mark the frame for decryption */
1314 		desc->flags |= htole32(RT2560_RX_CIPHER_BUSY);
1315 
1316 		DPRINTFN(sc, 15, "rx done idx=%u\n", sc->rxq.cur);
1317 
1318 		sc->rxq.cur = (sc->rxq.cur + 1) % RT2560_RX_RING_COUNT;
1319 	}
1320 
1321 	bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
1322 	    BUS_DMASYNC_PREWRITE);
1323 
1324 	/* kick decrypt */
1325 	RAL_WRITE(sc, RT2560_SECCSR0, RT2560_KICK_DECRYPT);
1326 }
1327 
1328 static void
1329 rt2560_beacon_update(struct ieee80211vap *vap, int item)
1330 {
1331 	struct rt2560_vap *rvp = RT2560_VAP(vap);
1332 	struct ieee80211_beacon_offsets *bo = &rvp->ral_bo;
1333 
1334 	setbit(bo->bo_flags, item);
1335 }
1336 
1337 /*
1338  * This function is called periodically in IBSS mode when a new beacon must be
1339  * sent out.
1340  */
1341 static void
1342 rt2560_beacon_expire(struct rt2560_softc *sc)
1343 {
1344 	struct ifnet *ifp = sc->sc_ifp;
1345 	struct ieee80211com *ic = ifp->if_l2com;
1346 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1347 	struct rt2560_vap *rvp = RT2560_VAP(vap);
1348 	struct rt2560_tx_data *data;
1349 
1350 	if (ic->ic_opmode != IEEE80211_M_IBSS &&
1351 	    ic->ic_opmode != IEEE80211_M_HOSTAP)
1352 		return;
1353 
1354 	data = &sc->bcnq.data[sc->bcnq.next];
1355 	/*
1356 	 * Don't send beacon if bsschan isn't set
1357 	 */
1358 	if (data->ni == NULL)
1359 	        return;
1360 
1361 	bus_dmamap_sync(sc->bcnq.data_dmat, data->map, BUS_DMASYNC_POSTWRITE);
1362 	bus_dmamap_unload(sc->bcnq.data_dmat, data->map);
1363 
1364 	/* XXX 1 =>'s mcast frames which means all PS sta's will wakeup! */
1365 	ieee80211_beacon_update(data->ni, &rvp->ral_bo, data->m, 1);
1366 
1367 	rt2560_tx_bcn(sc, data->m, data->ni);
1368 
1369 	DPRINTFN(sc, 15, "%s", "beacon expired\n");
1370 
1371 	sc->bcnq.next = (sc->bcnq.next + 1) % RT2560_BEACON_RING_COUNT;
1372 }
1373 
1374 /* ARGSUSED */
1375 static void
1376 rt2560_wakeup_expire(struct rt2560_softc *sc)
1377 {
1378 	DPRINTFN(sc, 2, "%s", "wakeup expired\n");
1379 }
1380 
1381 void
1382 rt2560_intr(void *arg)
1383 {
1384 	struct rt2560_softc *sc = arg;
1385 	struct ifnet *ifp = sc->sc_ifp;
1386 	uint32_t r;
1387 
1388 	RAL_LOCK(sc);
1389 
1390 	/* disable interrupts */
1391 	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
1392 
1393 	/* don't re-enable interrupts if we're shutting down */
1394 	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
1395 		RAL_UNLOCK(sc);
1396 		return;
1397 	}
1398 
1399 	r = RAL_READ(sc, RT2560_CSR7);
1400 	RAL_WRITE(sc, RT2560_CSR7, r);
1401 
1402 	if (r & RT2560_BEACON_EXPIRE)
1403 		rt2560_beacon_expire(sc);
1404 
1405 	if (r & RT2560_WAKEUP_EXPIRE)
1406 		rt2560_wakeup_expire(sc);
1407 
1408 	if (r & RT2560_ENCRYPTION_DONE)
1409 		rt2560_encryption_intr(sc);
1410 
1411 	if (r & RT2560_TX_DONE)
1412 		rt2560_tx_intr(sc);
1413 
1414 	if (r & RT2560_PRIO_DONE)
1415 		rt2560_prio_intr(sc);
1416 
1417 	if (r & RT2560_DECRYPTION_DONE)
1418 		rt2560_decryption_intr(sc);
1419 
1420 	if (r & RT2560_RX_DONE) {
1421 		rt2560_rx_intr(sc);
1422 		rt2560_encryption_intr(sc);
1423 	}
1424 
1425 	/* re-enable interrupts */
1426 	RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
1427 
1428 	RAL_UNLOCK(sc);
1429 }
1430 
1431 #define RAL_SIFS		10	/* us */
1432 
1433 #define RT2560_TXRX_TURNAROUND	10	/* us */
1434 
1435 static void
1436 rt2560_setup_tx_desc(struct rt2560_softc *sc, struct rt2560_tx_desc *desc,
1437     uint32_t flags, int len, int rate, int encrypt, bus_addr_t physaddr)
1438 {
1439 	struct ifnet *ifp = sc->sc_ifp;
1440 	struct ieee80211com *ic = ifp->if_l2com;
1441 	uint16_t plcp_length;
1442 	int remainder;
1443 
1444 	desc->flags = htole32(flags);
1445 	desc->flags |= htole32(len << 16);
1446 
1447 	desc->physaddr = htole32(physaddr);
1448 	desc->wme = htole16(
1449 	    RT2560_AIFSN(2) |
1450 	    RT2560_LOGCWMIN(3) |
1451 	    RT2560_LOGCWMAX(8));
1452 
1453 	/* setup PLCP fields */
1454 	desc->plcp_signal  = ieee80211_rate2plcp(rate);
1455 	desc->plcp_service = 4;
1456 
1457 	len += IEEE80211_CRC_LEN;
1458 	if (ieee80211_rate2phytype(sc->sc_rates, rate) == IEEE80211_T_OFDM) {
1459 		desc->flags |= htole32(RT2560_TX_OFDM);
1460 
1461 		plcp_length = len & 0xfff;
1462 		desc->plcp_length_hi = plcp_length >> 6;
1463 		desc->plcp_length_lo = plcp_length & 0x3f;
1464 	} else {
1465 		plcp_length = (16 * len + rate - 1) / rate;
1466 		if (rate == 22) {
1467 			remainder = (16 * len) % 22;
1468 			if (remainder != 0 && remainder < 7)
1469 				desc->plcp_service |= RT2560_PLCP_LENGEXT;
1470 		}
1471 		desc->plcp_length_hi = plcp_length >> 8;
1472 		desc->plcp_length_lo = plcp_length & 0xff;
1473 
1474 		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1475 			desc->plcp_signal |= 0x08;
1476 	}
1477 
1478 	if (!encrypt)
1479 		desc->flags |= htole32(RT2560_TX_VALID);
1480 	desc->flags |= encrypt ? htole32(RT2560_TX_CIPHER_BUSY)
1481 			       : htole32(RT2560_TX_BUSY);
1482 }
1483 
1484 static int
1485 rt2560_tx_bcn(struct rt2560_softc *sc, struct mbuf *m0,
1486     struct ieee80211_node *ni)
1487 {
1488 	struct ieee80211vap *vap = ni->ni_vap;
1489 	struct ieee80211com *ic = ni->ni_ic;
1490 	struct ifnet *ifp = sc->sc_ifp;
1491 	struct rt2560_tx_desc *desc;
1492 	struct rt2560_tx_data *data;
1493 	bus_dma_segment_t segs[RT2560_MAX_SCATTER];
1494 	int nsegs, rate, error;
1495 
1496 	desc = &sc->bcnq.desc[sc->bcnq.cur];
1497 	data = &sc->bcnq.data[sc->bcnq.cur];
1498 
1499 	/* XXX maybe a separate beacon rate? */
1500 	rate = vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)].mgmtrate;
1501 
1502 	error = bus_dmamap_load_mbuf_sg(sc->bcnq.data_dmat, data->map, m0,
1503 	    segs, &nsegs, BUS_DMA_NOWAIT);
1504 	if (error != 0) {
1505 		device_printf(sc->sc_dev, "could not map mbuf (error %d)\n",
1506 		    error);
1507 		m_freem(m0);
1508 		return error;
1509 	}
1510 
1511 	if (bpf_peers_present(ifp->if_bpf)) {
1512 		struct rt2560_tx_radiotap_header *tap = &sc->sc_txtap;
1513 
1514 		tap->wt_flags = 0;
1515 		tap->wt_rate = rate;
1516 		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1517 		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1518 		tap->wt_antenna = sc->tx_ant;
1519 
1520 		bpf_mtap2(ifp->if_bpf, tap, sc->sc_txtap_len, m0);
1521 	}
1522 
1523 	data->m = m0;
1524 	data->ni = ni;
1525 
1526 	rt2560_setup_tx_desc(sc, desc, RT2560_TX_IFS_NEWBACKOFF |
1527 	    RT2560_TX_TIMESTAMP, m0->m_pkthdr.len, rate, 0, segs->ds_addr);
1528 
1529 	DPRINTFN(sc, 10, "sending beacon frame len=%u idx=%u rate=%u\n",
1530 	    m0->m_pkthdr.len, sc->bcnq.cur, rate);
1531 
1532 	bus_dmamap_sync(sc->bcnq.data_dmat, data->map, BUS_DMASYNC_PREWRITE);
1533 	bus_dmamap_sync(sc->bcnq.desc_dmat, sc->bcnq.desc_map,
1534 	    BUS_DMASYNC_PREWRITE);
1535 
1536 	sc->bcnq.cur = (sc->bcnq.cur + 1) % RT2560_BEACON_RING_COUNT;
1537 
1538 	return 0;
1539 }
1540 
1541 static int
1542 rt2560_tx_mgt(struct rt2560_softc *sc, struct mbuf *m0,
1543     struct ieee80211_node *ni)
1544 {
1545 	struct ieee80211vap *vap = ni->ni_vap;
1546 	struct ieee80211com *ic = ni->ni_ic;
1547 	struct ifnet *ifp = sc->sc_ifp;
1548 	struct rt2560_tx_desc *desc;
1549 	struct rt2560_tx_data *data;
1550 	struct ieee80211_frame *wh;
1551 	struct ieee80211_key *k;
1552 	bus_dma_segment_t segs[RT2560_MAX_SCATTER];
1553 	uint16_t dur;
1554 	uint32_t flags = 0;
1555 	int nsegs, rate, error;
1556 
1557 	desc = &sc->prioq.desc[sc->prioq.cur];
1558 	data = &sc->prioq.data[sc->prioq.cur];
1559 
1560 	rate = vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)].mgmtrate;
1561 
1562 	wh = mtod(m0, struct ieee80211_frame *);
1563 
1564 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1565 		k = ieee80211_crypto_encap(ni, m0);
1566 		if (k == NULL) {
1567 			m_freem(m0);
1568 			return ENOBUFS;
1569 		}
1570 	}
1571 
1572 	error = bus_dmamap_load_mbuf_sg(sc->prioq.data_dmat, data->map, m0,
1573 	    segs, &nsegs, 0);
1574 	if (error != 0) {
1575 		device_printf(sc->sc_dev, "could not map mbuf (error %d)\n",
1576 		    error);
1577 		m_freem(m0);
1578 		return error;
1579 	}
1580 
1581 	if (bpf_peers_present(ifp->if_bpf)) {
1582 		struct rt2560_tx_radiotap_header *tap = &sc->sc_txtap;
1583 
1584 		tap->wt_flags = 0;
1585 		tap->wt_rate = rate;
1586 		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1587 		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1588 		tap->wt_antenna = sc->tx_ant;
1589 
1590 		bpf_mtap2(ifp->if_bpf, tap, sc->sc_txtap_len, m0);
1591 	}
1592 
1593 	data->m = m0;
1594 	data->ni = ni;
1595 	/* management frames are not taken into account for amrr */
1596 	data->rix = IEEE80211_FIXED_RATE_NONE;
1597 
1598 	wh = mtod(m0, struct ieee80211_frame *);
1599 
1600 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1601 		flags |= RT2560_TX_ACK;
1602 
1603 		dur = ieee80211_ack_duration(sc->sc_rates,
1604 		    rate, ic->ic_flags & IEEE80211_F_SHPREAMBLE);
1605 		*(uint16_t *)wh->i_dur = htole16(dur);
1606 
1607 		/* tell hardware to add timestamp for probe responses */
1608 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1609 		    IEEE80211_FC0_TYPE_MGT &&
1610 		    (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1611 		    IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1612 			flags |= RT2560_TX_TIMESTAMP;
1613 	}
1614 
1615 	rt2560_setup_tx_desc(sc, desc, flags, m0->m_pkthdr.len, rate, 0,
1616 	    segs->ds_addr);
1617 
1618 	bus_dmamap_sync(sc->prioq.data_dmat, data->map, BUS_DMASYNC_PREWRITE);
1619 	bus_dmamap_sync(sc->prioq.desc_dmat, sc->prioq.desc_map,
1620 	    BUS_DMASYNC_PREWRITE);
1621 
1622 	DPRINTFN(sc, 10, "sending mgt frame len=%u idx=%u rate=%u\n",
1623 	    m0->m_pkthdr.len, sc->prioq.cur, rate);
1624 
1625 	/* kick prio */
1626 	sc->prioq.queued++;
1627 	sc->prioq.cur = (sc->prioq.cur + 1) % RT2560_PRIO_RING_COUNT;
1628 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_PRIO);
1629 
1630 	return 0;
1631 }
1632 
1633 static int
1634 rt2560_sendprot(struct rt2560_softc *sc,
1635     const struct mbuf *m, struct ieee80211_node *ni, int prot, int rate)
1636 {
1637 	struct ieee80211com *ic = ni->ni_ic;
1638 	const struct ieee80211_frame *wh;
1639 	struct rt2560_tx_desc *desc;
1640 	struct rt2560_tx_data *data;
1641 	struct mbuf *mprot;
1642 	int protrate, ackrate, pktlen, flags, isshort, error;
1643 	uint16_t dur;
1644 	bus_dma_segment_t segs[RT2560_MAX_SCATTER];
1645 	int nsegs;
1646 
1647 	KASSERT(prot == IEEE80211_PROT_RTSCTS || prot == IEEE80211_PROT_CTSONLY,
1648 	    ("protection %d", prot));
1649 
1650 	wh = mtod(m, const struct ieee80211_frame *);
1651 	pktlen = m->m_pkthdr.len + IEEE80211_CRC_LEN;
1652 
1653 	protrate = ieee80211_ctl_rate(sc->sc_rates, rate);
1654 	ackrate = ieee80211_ack_rate(sc->sc_rates, rate);
1655 
1656 	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
1657 	dur = ieee80211_compute_duration(sc->sc_rates, pktlen, rate, isshort);
1658 	    + ieee80211_ack_duration(sc->sc_rates, rate, isshort);
1659 	flags = RT2560_TX_MORE_FRAG;
1660 	if (prot == IEEE80211_PROT_RTSCTS) {
1661 		/* NB: CTS is the same size as an ACK */
1662 		dur += ieee80211_ack_duration(sc->sc_rates, rate, isshort);
1663 		flags |= RT2560_TX_ACK;
1664 		mprot = ieee80211_alloc_rts(ic, wh->i_addr1, wh->i_addr2, dur);
1665 	} else {
1666 		mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr, dur);
1667 	}
1668 	if (mprot == NULL) {
1669 		/* XXX stat + msg */
1670 		return ENOBUFS;
1671 	}
1672 
1673 	desc = &sc->txq.desc[sc->txq.cur_encrypt];
1674 	data = &sc->txq.data[sc->txq.cur_encrypt];
1675 
1676 	error = bus_dmamap_load_mbuf_sg(sc->txq.data_dmat, data->map,
1677 	    mprot, segs, &nsegs, 0);
1678 	if (error != 0) {
1679 		device_printf(sc->sc_dev,
1680 		    "could not map mbuf (error %d)\n", error);
1681 		m_freem(mprot);
1682 		return error;
1683 	}
1684 
1685 	data->m = mprot;
1686 	data->ni = ieee80211_ref_node(ni);
1687 	/* ctl frames are not taken into account for amrr */
1688 	data->rix = IEEE80211_FIXED_RATE_NONE;
1689 
1690 	rt2560_setup_tx_desc(sc, desc, flags, mprot->m_pkthdr.len, protrate, 1,
1691 	    segs->ds_addr);
1692 
1693 	bus_dmamap_sync(sc->txq.data_dmat, data->map,
1694 	    BUS_DMASYNC_PREWRITE);
1695 
1696 	sc->txq.queued++;
1697 	sc->txq.cur_encrypt = (sc->txq.cur_encrypt + 1) % RT2560_TX_RING_COUNT;
1698 
1699 	return 0;
1700 }
1701 
1702 static int
1703 rt2560_tx_raw(struct rt2560_softc *sc, struct mbuf *m0,
1704     struct ieee80211_node *ni, const struct ieee80211_bpf_params *params)
1705 {
1706 	struct ifnet *ifp = sc->sc_ifp;
1707 	struct ieee80211com *ic = ifp->if_l2com;
1708 	struct rt2560_tx_desc *desc;
1709 	struct rt2560_tx_data *data;
1710 	bus_dma_segment_t segs[RT2560_MAX_SCATTER];
1711 	uint32_t flags;
1712 	int nsegs, rate, error;
1713 
1714 	desc = &sc->prioq.desc[sc->prioq.cur];
1715 	data = &sc->prioq.data[sc->prioq.cur];
1716 
1717 	rate = params->ibp_rate0 & IEEE80211_RATE_VAL;
1718 	/* XXX validate */
1719 	if (rate == 0) {
1720 		/* XXX fall back to mcast/mgmt rate? */
1721 		m_freem(m0);
1722 		return EINVAL;
1723 	}
1724 
1725 	flags = 0;
1726 	if ((params->ibp_flags & IEEE80211_BPF_NOACK) == 0)
1727 		flags |= RT2560_TX_ACK;
1728 	if (params->ibp_flags & (IEEE80211_BPF_RTS|IEEE80211_BPF_CTS)) {
1729 		error = rt2560_sendprot(sc, m0, ni,
1730 		    params->ibp_flags & IEEE80211_BPF_RTS ?
1731 			 IEEE80211_PROT_RTSCTS : IEEE80211_PROT_CTSONLY,
1732 		    rate);
1733 		if (error) {
1734 			m_freem(m0);
1735 			return error;
1736 		}
1737 		flags |= RT2560_TX_LONG_RETRY | RT2560_TX_IFS_SIFS;
1738 	}
1739 
1740 	error = bus_dmamap_load_mbuf_sg(sc->prioq.data_dmat, data->map, m0,
1741 	    segs, &nsegs, 0);
1742 	if (error != 0) {
1743 		device_printf(sc->sc_dev, "could not map mbuf (error %d)\n",
1744 		    error);
1745 		m_freem(m0);
1746 		return error;
1747 	}
1748 
1749 	if (bpf_peers_present(ifp->if_bpf)) {
1750 		struct rt2560_tx_radiotap_header *tap = &sc->sc_txtap;
1751 
1752 		tap->wt_flags = 0;
1753 		tap->wt_rate = rate;
1754 		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1755 		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1756 		tap->wt_antenna = sc->tx_ant;
1757 
1758 		bpf_mtap2(ifp->if_bpf, tap, sc->sc_txtap_len, m0);
1759 	}
1760 
1761 	data->m = m0;
1762 	data->ni = ni;
1763 
1764 	/* XXX need to setup descriptor ourself */
1765 	rt2560_setup_tx_desc(sc, desc, flags, m0->m_pkthdr.len,
1766 	    rate, (params->ibp_flags & IEEE80211_BPF_CRYPTO) != 0,
1767 	    segs->ds_addr);
1768 
1769 	bus_dmamap_sync(sc->prioq.data_dmat, data->map, BUS_DMASYNC_PREWRITE);
1770 	bus_dmamap_sync(sc->prioq.desc_dmat, sc->prioq.desc_map,
1771 	    BUS_DMASYNC_PREWRITE);
1772 
1773 	DPRINTFN(sc, 10, "sending raw frame len=%u idx=%u rate=%u\n",
1774 	    m0->m_pkthdr.len, sc->prioq.cur, rate);
1775 
1776 	/* kick prio */
1777 	sc->prioq.queued++;
1778 	sc->prioq.cur = (sc->prioq.cur + 1) % RT2560_PRIO_RING_COUNT;
1779 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_PRIO);
1780 
1781 	return 0;
1782 }
1783 
1784 static int
1785 rt2560_tx_data(struct rt2560_softc *sc, struct mbuf *m0,
1786     struct ieee80211_node *ni)
1787 {
1788 	struct ieee80211vap *vap = ni->ni_vap;
1789 	struct ieee80211com *ic = ni->ni_ic;
1790 	struct ifnet *ifp = sc->sc_ifp;
1791 	struct rt2560_tx_desc *desc;
1792 	struct rt2560_tx_data *data;
1793 	struct ieee80211_frame *wh;
1794 	const struct ieee80211_txparam *tp;
1795 	struct ieee80211_key *k;
1796 	struct mbuf *mnew;
1797 	bus_dma_segment_t segs[RT2560_MAX_SCATTER];
1798 	uint16_t dur;
1799 	uint32_t flags;
1800 	int nsegs, rate, error;
1801 
1802 	wh = mtod(m0, struct ieee80211_frame *);
1803 
1804 	tp = &vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)];
1805 	if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1806 		rate = tp->mcastrate;
1807 	} else if (m0->m_flags & M_EAPOL) {
1808 		rate = tp->mgmtrate;
1809 	} else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE) {
1810 		rate = tp->ucastrate;
1811 	} else {
1812 		(void) ieee80211_amrr_choose(ni, &RT2560_NODE(ni)->amrr);
1813 		rate = ni->ni_txrate;
1814 	}
1815 
1816 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1817 		k = ieee80211_crypto_encap(ni, m0);
1818 		if (k == NULL) {
1819 			m_freem(m0);
1820 			return ENOBUFS;
1821 		}
1822 
1823 		/* packet header may have moved, reset our local pointer */
1824 		wh = mtod(m0, struct ieee80211_frame *);
1825 	}
1826 
1827 	flags = 0;
1828 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1829 		int prot = IEEE80211_PROT_NONE;
1830 		if (m0->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
1831 			prot = IEEE80211_PROT_RTSCTS;
1832 		else if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
1833 		    ieee80211_rate2phytype(sc->sc_rates, rate) == IEEE80211_T_OFDM)
1834 			prot = ic->ic_protmode;
1835 		if (prot != IEEE80211_PROT_NONE) {
1836 			error = rt2560_sendprot(sc, m0, ni, prot, rate);
1837 			if (error) {
1838 				m_freem(m0);
1839 				return error;
1840 			}
1841 			flags |= RT2560_TX_LONG_RETRY | RT2560_TX_IFS_SIFS;
1842 		}
1843 	}
1844 
1845 	data = &sc->txq.data[sc->txq.cur_encrypt];
1846 	desc = &sc->txq.desc[sc->txq.cur_encrypt];
1847 
1848 	error = bus_dmamap_load_mbuf_sg(sc->txq.data_dmat, data->map, m0,
1849 	    segs, &nsegs, 0);
1850 	if (error != 0 && error != EFBIG) {
1851 		device_printf(sc->sc_dev, "could not map mbuf (error %d)\n",
1852 		    error);
1853 		m_freem(m0);
1854 		return error;
1855 	}
1856 	if (error != 0) {
1857 		mnew = m_defrag(m0, M_DONTWAIT);
1858 		if (mnew == NULL) {
1859 			device_printf(sc->sc_dev,
1860 			    "could not defragment mbuf\n");
1861 			m_freem(m0);
1862 			return ENOBUFS;
1863 		}
1864 		m0 = mnew;
1865 
1866 		error = bus_dmamap_load_mbuf_sg(sc->txq.data_dmat, data->map,
1867 		    m0, segs, &nsegs, 0);
1868 		if (error != 0) {
1869 			device_printf(sc->sc_dev,
1870 			    "could not map mbuf (error %d)\n", error);
1871 			m_freem(m0);
1872 			return error;
1873 		}
1874 
1875 		/* packet header may have moved, reset our local pointer */
1876 		wh = mtod(m0, struct ieee80211_frame *);
1877 	}
1878 
1879 	if (bpf_peers_present(ifp->if_bpf)) {
1880 		struct rt2560_tx_radiotap_header *tap = &sc->sc_txtap;
1881 
1882 		tap->wt_flags = 0;
1883 		tap->wt_rate = rate;
1884 		tap->wt_antenna = sc->tx_ant;
1885 
1886 		bpf_mtap2(ifp->if_bpf, tap, sc->sc_txtap_len, m0);
1887 	}
1888 
1889 	data->m = m0;
1890 	data->ni = ni;
1891 
1892 	/* remember link conditions for rate adaptation algorithm */
1893 	if (tp->ucastrate == IEEE80211_FIXED_RATE_NONE) {
1894 		data->rix = ni->ni_txrate;
1895 		/* XXX probably need last rssi value and not avg */
1896 		data->rssi = ic->ic_node_getrssi(ni);
1897 	} else
1898 		data->rix = IEEE80211_FIXED_RATE_NONE;
1899 
1900 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1901 		flags |= RT2560_TX_ACK;
1902 
1903 		dur = ieee80211_ack_duration(sc->sc_rates,
1904 		    rate, ic->ic_flags & IEEE80211_F_SHPREAMBLE);
1905 		*(uint16_t *)wh->i_dur = htole16(dur);
1906 	}
1907 
1908 	rt2560_setup_tx_desc(sc, desc, flags, m0->m_pkthdr.len, rate, 1,
1909 	    segs->ds_addr);
1910 
1911 	bus_dmamap_sync(sc->txq.data_dmat, data->map, BUS_DMASYNC_PREWRITE);
1912 	bus_dmamap_sync(sc->txq.desc_dmat, sc->txq.desc_map,
1913 	    BUS_DMASYNC_PREWRITE);
1914 
1915 	DPRINTFN(sc, 10, "sending data frame len=%u idx=%u rate=%u\n",
1916 	    m0->m_pkthdr.len, sc->txq.cur_encrypt, rate);
1917 
1918 	/* kick encrypt */
1919 	sc->txq.queued++;
1920 	sc->txq.cur_encrypt = (sc->txq.cur_encrypt + 1) % RT2560_TX_RING_COUNT;
1921 	RAL_WRITE(sc, RT2560_SECCSR1, RT2560_KICK_ENCRYPT);
1922 
1923 	return 0;
1924 }
1925 
1926 static void
1927 rt2560_start_locked(struct ifnet *ifp)
1928 {
1929 	struct rt2560_softc *sc = ifp->if_softc;
1930 	struct mbuf *m;
1931 	struct ieee80211_node *ni;
1932 
1933 	RAL_LOCK_ASSERT(sc);
1934 
1935 	for (;;) {
1936 		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
1937 		if (m == NULL)
1938 			break;
1939 		if (sc->txq.queued >= RT2560_TX_RING_COUNT - 1) {
1940 			IFQ_DRV_PREPEND(&ifp->if_snd, m);
1941 			ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1942 			sc->sc_flags |= RT2560_F_DATA_OACTIVE;
1943 			break;
1944 		}
1945 
1946 		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
1947 		m = ieee80211_encap(ni, m);
1948 		if (m == NULL) {
1949 			ieee80211_free_node(ni);
1950 			ifp->if_oerrors++;
1951 			continue;
1952 		}
1953 
1954 		if (rt2560_tx_data(sc, m, ni) != 0) {
1955 			ieee80211_free_node(ni);
1956 			ifp->if_oerrors++;
1957 			break;
1958 		}
1959 
1960 		sc->sc_tx_timer = 5;
1961 	}
1962 }
1963 
1964 static void
1965 rt2560_start(struct ifnet *ifp)
1966 {
1967 	struct rt2560_softc *sc = ifp->if_softc;
1968 
1969 	RAL_LOCK(sc);
1970 	rt2560_start_locked(ifp);
1971 	RAL_UNLOCK(sc);
1972 }
1973 
1974 static void
1975 rt2560_watchdog(void *arg)
1976 {
1977 	struct rt2560_softc *sc = arg;
1978 	struct ifnet *ifp = sc->sc_ifp;
1979 
1980 	RAL_LOCK_ASSERT(sc);
1981 
1982 	KASSERT(ifp->if_drv_flags & IFF_DRV_RUNNING, ("not running"));
1983 
1984 	if (sc->sc_invalid)		/* card ejected */
1985 		return;
1986 
1987 	rt2560_encryption_intr(sc);
1988 	rt2560_tx_intr(sc);
1989 
1990 	if (sc->sc_tx_timer > 0 && --sc->sc_tx_timer == 0) {
1991 		if_printf(ifp, "device timeout\n");
1992 		rt2560_init_locked(sc);
1993 		ifp->if_oerrors++;
1994 		/* NB: callout is reset in rt2560_init() */
1995 		return;
1996 	}
1997 	callout_reset(&sc->watchdog_ch, hz, rt2560_watchdog, sc);
1998 }
1999 
2000 static int
2001 rt2560_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
2002 {
2003 	struct rt2560_softc *sc = ifp->if_softc;
2004 	struct ieee80211com *ic = ifp->if_l2com;
2005 	struct ifreq *ifr = (struct ifreq *) data;
2006 	int error = 0, startall = 0;
2007 
2008 	RAL_LOCK(sc);
2009 	switch (cmd) {
2010 	case SIOCSIFFLAGS:
2011 		if (ifp->if_flags & IFF_UP) {
2012 			if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
2013 				rt2560_init_locked(sc);
2014 				startall = 1;
2015 			} else
2016 				rt2560_update_promisc(ifp);
2017 		} else {
2018 			if (ifp->if_drv_flags & IFF_DRV_RUNNING)
2019 				rt2560_stop_locked(sc);
2020 		}
2021 		break;
2022 	case SIOCGIFMEDIA:
2023 	case SIOCSIFMEDIA:
2024 		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
2025 		break;
2026 	default:
2027 		error = ether_ioctl(ifp, cmd, data);
2028 		break;
2029 	}
2030 	RAL_UNLOCK(sc);
2031 
2032 	if (startall)
2033 		ieee80211_start_all(ic);
2034 	return error;
2035 }
2036 
2037 static void
2038 rt2560_bbp_write(struct rt2560_softc *sc, uint8_t reg, uint8_t val)
2039 {
2040 	uint32_t tmp;
2041 	int ntries;
2042 
2043 	for (ntries = 0; ntries < 100; ntries++) {
2044 		if (!(RAL_READ(sc, RT2560_BBPCSR) & RT2560_BBP_BUSY))
2045 			break;
2046 		DELAY(1);
2047 	}
2048 	if (ntries == 100) {
2049 		device_printf(sc->sc_dev, "could not write to BBP\n");
2050 		return;
2051 	}
2052 
2053 	tmp = RT2560_BBP_WRITE | RT2560_BBP_BUSY | reg << 8 | val;
2054 	RAL_WRITE(sc, RT2560_BBPCSR, tmp);
2055 
2056 	DPRINTFN(sc, 15, "BBP R%u <- 0x%02x\n", reg, val);
2057 }
2058 
2059 static uint8_t
2060 rt2560_bbp_read(struct rt2560_softc *sc, uint8_t reg)
2061 {
2062 	uint32_t val;
2063 	int ntries;
2064 
2065 	for (ntries = 0; ntries < 100; ntries++) {
2066 		if (!(RAL_READ(sc, RT2560_BBPCSR) & RT2560_BBP_BUSY))
2067 			break;
2068 		DELAY(1);
2069 	}
2070 	if (ntries == 100) {
2071 		device_printf(sc->sc_dev, "could not read from BBP\n");
2072 		return 0;
2073 	}
2074 
2075 	val = RT2560_BBP_BUSY | reg << 8;
2076 	RAL_WRITE(sc, RT2560_BBPCSR, val);
2077 
2078 	for (ntries = 0; ntries < 100; ntries++) {
2079 		val = RAL_READ(sc, RT2560_BBPCSR);
2080 		if (!(val & RT2560_BBP_BUSY))
2081 			return val & 0xff;
2082 		DELAY(1);
2083 	}
2084 
2085 	device_printf(sc->sc_dev, "could not read from BBP\n");
2086 	return 0;
2087 }
2088 
2089 static void
2090 rt2560_rf_write(struct rt2560_softc *sc, uint8_t reg, uint32_t val)
2091 {
2092 	uint32_t tmp;
2093 	int ntries;
2094 
2095 	for (ntries = 0; ntries < 100; ntries++) {
2096 		if (!(RAL_READ(sc, RT2560_RFCSR) & RT2560_RF_BUSY))
2097 			break;
2098 		DELAY(1);
2099 	}
2100 	if (ntries == 100) {
2101 		device_printf(sc->sc_dev, "could not write to RF\n");
2102 		return;
2103 	}
2104 
2105 	tmp = RT2560_RF_BUSY | RT2560_RF_20BIT | (val & 0xfffff) << 2 |
2106 	    (reg & 0x3);
2107 	RAL_WRITE(sc, RT2560_RFCSR, tmp);
2108 
2109 	/* remember last written value in sc */
2110 	sc->rf_regs[reg] = val;
2111 
2112 	DPRINTFN(sc, 15, "RF R[%u] <- 0x%05x\n", reg & 0x3, val & 0xfffff);
2113 }
2114 
2115 static void
2116 rt2560_set_chan(struct rt2560_softc *sc, struct ieee80211_channel *c)
2117 {
2118 	struct ifnet *ifp = sc->sc_ifp;
2119 	struct ieee80211com *ic = ifp->if_l2com;
2120 	uint8_t power, tmp;
2121 	u_int i, chan;
2122 
2123 	chan = ieee80211_chan2ieee(ic, c);
2124 	KASSERT(chan != 0 && chan != IEEE80211_CHAN_ANY, ("chan 0x%x", chan));
2125 
2126 	sc->sc_rates = ieee80211_get_ratetable(c);
2127 
2128 	if (IEEE80211_IS_CHAN_2GHZ(c))
2129 		power = min(sc->txpow[chan - 1], 31);
2130 	else
2131 		power = 31;
2132 
2133 	/* adjust txpower using ifconfig settings */
2134 	power -= (100 - ic->ic_txpowlimit) / 8;
2135 
2136 	DPRINTFN(sc, 2, "setting channel to %u, txpower to %u\n", chan, power);
2137 
2138 	switch (sc->rf_rev) {
2139 	case RT2560_RF_2522:
2140 		rt2560_rf_write(sc, RAL_RF1, 0x00814);
2141 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2522_r2[chan - 1]);
2142 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
2143 		break;
2144 
2145 	case RT2560_RF_2523:
2146 		rt2560_rf_write(sc, RAL_RF1, 0x08804);
2147 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2523_r2[chan - 1]);
2148 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x38044);
2149 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
2150 		break;
2151 
2152 	case RT2560_RF_2524:
2153 		rt2560_rf_write(sc, RAL_RF1, 0x0c808);
2154 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2524_r2[chan - 1]);
2155 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
2156 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
2157 		break;
2158 
2159 	case RT2560_RF_2525:
2160 		rt2560_rf_write(sc, RAL_RF1, 0x08808);
2161 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525_hi_r2[chan - 1]);
2162 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
2163 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
2164 
2165 		rt2560_rf_write(sc, RAL_RF1, 0x08808);
2166 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525_r2[chan - 1]);
2167 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
2168 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
2169 		break;
2170 
2171 	case RT2560_RF_2525E:
2172 		rt2560_rf_write(sc, RAL_RF1, 0x08808);
2173 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525e_r2[chan - 1]);
2174 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
2175 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00286 : 0x00282);
2176 		break;
2177 
2178 	case RT2560_RF_2526:
2179 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2526_hi_r2[chan - 1]);
2180 		rt2560_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
2181 		rt2560_rf_write(sc, RAL_RF1, 0x08804);
2182 
2183 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2526_r2[chan - 1]);
2184 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
2185 		rt2560_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
2186 		break;
2187 
2188 	/* dual-band RF */
2189 	case RT2560_RF_5222:
2190 		for (i = 0; rt2560_rf5222[i].chan != chan; i++);
2191 
2192 		rt2560_rf_write(sc, RAL_RF1, rt2560_rf5222[i].r1);
2193 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf5222[i].r2);
2194 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
2195 		rt2560_rf_write(sc, RAL_RF4, rt2560_rf5222[i].r4);
2196 		break;
2197 	default:
2198  	        printf("unknown ral rev=%d\n", sc->rf_rev);
2199 	}
2200 
2201 	/* XXX */
2202 	if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
2203 		/* set Japan filter bit for channel 14 */
2204 		tmp = rt2560_bbp_read(sc, 70);
2205 
2206 		tmp &= ~RT2560_JAPAN_FILTER;
2207 		if (chan == 14)
2208 			tmp |= RT2560_JAPAN_FILTER;
2209 
2210 		rt2560_bbp_write(sc, 70, tmp);
2211 
2212 		/* clear CRC errors */
2213 		RAL_READ(sc, RT2560_CNT0);
2214 	}
2215 }
2216 
2217 static void
2218 rt2560_set_channel(struct ieee80211com *ic)
2219 {
2220 	struct ifnet *ifp = ic->ic_ifp;
2221 	struct rt2560_softc *sc = ifp->if_softc;
2222 
2223 	RAL_LOCK(sc);
2224 	rt2560_set_chan(sc, ic->ic_curchan);
2225 
2226 	sc->sc_txtap.wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
2227 	sc->sc_txtap.wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
2228 	sc->sc_rxtap.wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
2229 	sc->sc_rxtap.wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
2230 	RAL_UNLOCK(sc);
2231 
2232 }
2233 
2234 #if 0
2235 /*
2236  * Disable RF auto-tuning.
2237  */
2238 static void
2239 rt2560_disable_rf_tune(struct rt2560_softc *sc)
2240 {
2241 	uint32_t tmp;
2242 
2243 	if (sc->rf_rev != RT2560_RF_2523) {
2244 		tmp = sc->rf_regs[RAL_RF1] & ~RAL_RF1_AUTOTUNE;
2245 		rt2560_rf_write(sc, RAL_RF1, tmp);
2246 	}
2247 
2248 	tmp = sc->rf_regs[RAL_RF3] & ~RAL_RF3_AUTOTUNE;
2249 	rt2560_rf_write(sc, RAL_RF3, tmp);
2250 
2251 	DPRINTFN(sc, 2, "%s", "disabling RF autotune\n");
2252 }
2253 #endif
2254 
2255 /*
2256  * Refer to IEEE Std 802.11-1999 pp. 123 for more information on TSF
2257  * synchronization.
2258  */
2259 static void
2260 rt2560_enable_tsf_sync(struct rt2560_softc *sc)
2261 {
2262 	struct ifnet *ifp = sc->sc_ifp;
2263 	struct ieee80211com *ic = ifp->if_l2com;
2264 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2265 	uint16_t logcwmin, preload;
2266 	uint32_t tmp;
2267 
2268 	/* first, disable TSF synchronization */
2269 	RAL_WRITE(sc, RT2560_CSR14, 0);
2270 
2271 	tmp = 16 * vap->iv_bss->ni_intval;
2272 	RAL_WRITE(sc, RT2560_CSR12, tmp);
2273 
2274 	RAL_WRITE(sc, RT2560_CSR13, 0);
2275 
2276 	logcwmin = 5;
2277 	preload = (vap->iv_opmode == IEEE80211_M_STA) ? 384 : 1024;
2278 	tmp = logcwmin << 16 | preload;
2279 	RAL_WRITE(sc, RT2560_BCNOCSR, tmp);
2280 
2281 	/* finally, enable TSF synchronization */
2282 	tmp = RT2560_ENABLE_TSF | RT2560_ENABLE_TBCN;
2283 	if (ic->ic_opmode == IEEE80211_M_STA)
2284 		tmp |= RT2560_ENABLE_TSF_SYNC(1);
2285 	else
2286 		tmp |= RT2560_ENABLE_TSF_SYNC(2) |
2287 		       RT2560_ENABLE_BEACON_GENERATOR;
2288 	RAL_WRITE(sc, RT2560_CSR14, tmp);
2289 
2290 	DPRINTF(sc, "%s", "enabling TSF synchronization\n");
2291 }
2292 
2293 static void
2294 rt2560_update_plcp(struct rt2560_softc *sc)
2295 {
2296 	struct ifnet *ifp = sc->sc_ifp;
2297 	struct ieee80211com *ic = ifp->if_l2com;
2298 
2299 	/* no short preamble for 1Mbps */
2300 	RAL_WRITE(sc, RT2560_PLCP1MCSR, 0x00700400);
2301 
2302 	if (!(ic->ic_flags & IEEE80211_F_SHPREAMBLE)) {
2303 		/* values taken from the reference driver */
2304 		RAL_WRITE(sc, RT2560_PLCP2MCSR,   0x00380401);
2305 		RAL_WRITE(sc, RT2560_PLCP5p5MCSR, 0x00150402);
2306 		RAL_WRITE(sc, RT2560_PLCP11MCSR,  0x000b8403);
2307 	} else {
2308 		/* same values as above or'ed 0x8 */
2309 		RAL_WRITE(sc, RT2560_PLCP2MCSR,   0x00380409);
2310 		RAL_WRITE(sc, RT2560_PLCP5p5MCSR, 0x0015040a);
2311 		RAL_WRITE(sc, RT2560_PLCP11MCSR,  0x000b840b);
2312 	}
2313 
2314 	DPRINTF(sc, "updating PLCP for %s preamble\n",
2315 	    (ic->ic_flags & IEEE80211_F_SHPREAMBLE) ? "short" : "long");
2316 }
2317 
2318 /*
2319  * This function can be called by ieee80211_set_shortslottime(). Refer to
2320  * IEEE Std 802.11-1999 pp. 85 to know how these values are computed.
2321  */
2322 static void
2323 rt2560_update_slot(struct ifnet *ifp)
2324 {
2325 	struct rt2560_softc *sc = ifp->if_softc;
2326 	struct ieee80211com *ic = ifp->if_l2com;
2327 	uint8_t slottime;
2328 	uint16_t tx_sifs, tx_pifs, tx_difs, eifs;
2329 	uint32_t tmp;
2330 
2331 #ifndef FORCE_SLOTTIME
2332 	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
2333 #else
2334 	/*
2335 	 * Setting slot time according to "short slot time" capability
2336 	 * in beacon/probe_resp seems to cause problem to acknowledge
2337 	 * certain AP's data frames transimitted at CCK/DS rates: the
2338 	 * problematic AP keeps retransmitting data frames, probably
2339 	 * because MAC level acks are not received by hardware.
2340 	 * So we cheat a little bit here by claiming we are capable of
2341 	 * "short slot time" but setting hardware slot time to the normal
2342 	 * slot time.  ral(4) does not seem to have trouble to receive
2343 	 * frames transmitted using short slot time even if hardware
2344 	 * slot time is set to normal slot time.  If we didn't use this
2345 	 * trick, we would have to claim that short slot time is not
2346 	 * supported; this would give relative poor RX performance
2347 	 * (-1Mb~-2Mb lower) and the _whole_ BSS would stop using short
2348 	 * slot time.
2349 	 */
2350 	slottime = 20;
2351 #endif
2352 
2353 	/* update the MAC slot boundaries */
2354 	tx_sifs = RAL_SIFS - RT2560_TXRX_TURNAROUND;
2355 	tx_pifs = tx_sifs + slottime;
2356 	tx_difs = tx_sifs + 2 * slottime;
2357 	eifs = (ic->ic_curmode == IEEE80211_MODE_11B) ? 364 : 60;
2358 
2359 	tmp = RAL_READ(sc, RT2560_CSR11);
2360 	tmp = (tmp & ~0x1f00) | slottime << 8;
2361 	RAL_WRITE(sc, RT2560_CSR11, tmp);
2362 
2363 	tmp = tx_pifs << 16 | tx_sifs;
2364 	RAL_WRITE(sc, RT2560_CSR18, tmp);
2365 
2366 	tmp = eifs << 16 | tx_difs;
2367 	RAL_WRITE(sc, RT2560_CSR19, tmp);
2368 
2369 	DPRINTF(sc, "setting slottime to %uus\n", slottime);
2370 }
2371 
2372 static void
2373 rt2560_set_basicrates(struct rt2560_softc *sc)
2374 {
2375 	struct ifnet *ifp = sc->sc_ifp;
2376 	struct ieee80211com *ic = ifp->if_l2com;
2377 
2378 	/* update basic rate set */
2379 	if (ic->ic_curmode == IEEE80211_MODE_11B) {
2380 		/* 11b basic rates: 1, 2Mbps */
2381 		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x3);
2382 	} else if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan)) {
2383 		/* 11a basic rates: 6, 12, 24Mbps */
2384 		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x150);
2385 	} else {
2386 		/* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
2387 		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x15f);
2388 	}
2389 }
2390 
2391 static void
2392 rt2560_update_led(struct rt2560_softc *sc, int led1, int led2)
2393 {
2394 	uint32_t tmp;
2395 
2396 	/* set ON period to 70ms and OFF period to 30ms */
2397 	tmp = led1 << 16 | led2 << 17 | 70 << 8 | 30;
2398 	RAL_WRITE(sc, RT2560_LEDCSR, tmp);
2399 }
2400 
2401 static void
2402 rt2560_set_bssid(struct rt2560_softc *sc, const uint8_t *bssid)
2403 {
2404 	uint32_t tmp;
2405 
2406 	tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
2407 	RAL_WRITE(sc, RT2560_CSR5, tmp);
2408 
2409 	tmp = bssid[4] | bssid[5] << 8;
2410 	RAL_WRITE(sc, RT2560_CSR6, tmp);
2411 
2412 	DPRINTF(sc, "setting BSSID to %6D\n", bssid, ":");
2413 }
2414 
2415 static void
2416 rt2560_set_macaddr(struct rt2560_softc *sc, uint8_t *addr)
2417 {
2418 	uint32_t tmp;
2419 
2420 	tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
2421 	RAL_WRITE(sc, RT2560_CSR3, tmp);
2422 
2423 	tmp = addr[4] | addr[5] << 8;
2424 	RAL_WRITE(sc, RT2560_CSR4, tmp);
2425 
2426 	DPRINTF(sc, "setting MAC address to %6D\n", addr, ":");
2427 }
2428 
2429 static void
2430 rt2560_get_macaddr(struct rt2560_softc *sc, uint8_t *addr)
2431 {
2432 	uint32_t tmp;
2433 
2434 	tmp = RAL_READ(sc, RT2560_CSR3);
2435 	addr[0] = tmp & 0xff;
2436 	addr[1] = (tmp >>  8) & 0xff;
2437 	addr[2] = (tmp >> 16) & 0xff;
2438 	addr[3] = (tmp >> 24);
2439 
2440 	tmp = RAL_READ(sc, RT2560_CSR4);
2441 	addr[4] = tmp & 0xff;
2442 	addr[5] = (tmp >> 8) & 0xff;
2443 }
2444 
2445 static void
2446 rt2560_update_promisc(struct ifnet *ifp)
2447 {
2448 	struct rt2560_softc *sc = ifp->if_softc;
2449 	uint32_t tmp;
2450 
2451 	tmp = RAL_READ(sc, RT2560_RXCSR0);
2452 
2453 	tmp &= ~RT2560_DROP_NOT_TO_ME;
2454 	if (!(ifp->if_flags & IFF_PROMISC))
2455 		tmp |= RT2560_DROP_NOT_TO_ME;
2456 
2457 	RAL_WRITE(sc, RT2560_RXCSR0, tmp);
2458 
2459 	DPRINTF(sc, "%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
2460 	    "entering" : "leaving");
2461 }
2462 
2463 static const char *
2464 rt2560_get_rf(int rev)
2465 {
2466 	switch (rev) {
2467 	case RT2560_RF_2522:	return "RT2522";
2468 	case RT2560_RF_2523:	return "RT2523";
2469 	case RT2560_RF_2524:	return "RT2524";
2470 	case RT2560_RF_2525:	return "RT2525";
2471 	case RT2560_RF_2525E:	return "RT2525e";
2472 	case RT2560_RF_2526:	return "RT2526";
2473 	case RT2560_RF_5222:	return "RT5222";
2474 	default:		return "unknown";
2475 	}
2476 }
2477 
2478 static void
2479 rt2560_read_config(struct rt2560_softc *sc)
2480 {
2481 	uint16_t val;
2482 	int i;
2483 
2484 	val = rt2560_eeprom_read(sc, RT2560_EEPROM_CONFIG0);
2485 	sc->rf_rev =   (val >> 11) & 0x7;
2486 	sc->hw_radio = (val >> 10) & 0x1;
2487 	sc->led_mode = (val >> 6)  & 0x7;
2488 	sc->rx_ant =   (val >> 4)  & 0x3;
2489 	sc->tx_ant =   (val >> 2)  & 0x3;
2490 	sc->nb_ant =   val & 0x3;
2491 
2492 	/* read default values for BBP registers */
2493 	for (i = 0; i < 16; i++) {
2494 		val = rt2560_eeprom_read(sc, RT2560_EEPROM_BBP_BASE + i);
2495 		if (val == 0 || val == 0xffff)
2496 			continue;
2497 
2498 		sc->bbp_prom[i].reg = val >> 8;
2499 		sc->bbp_prom[i].val = val & 0xff;
2500 	}
2501 
2502 	/* read Tx power for all b/g channels */
2503 	for (i = 0; i < 14 / 2; i++) {
2504 		val = rt2560_eeprom_read(sc, RT2560_EEPROM_TXPOWER + i);
2505 		sc->txpow[i * 2] = val & 0xff;
2506 		sc->txpow[i * 2 + 1] = val >> 8;
2507 	}
2508 	for (i = 0; i < 14; ++i) {
2509 		if (sc->txpow[i] > 31)
2510 			sc->txpow[i] = 24;
2511 	}
2512 
2513 	val = rt2560_eeprom_read(sc, RT2560_EEPROM_CALIBRATE);
2514 	if ((val & 0xff) == 0xff)
2515 		sc->rssi_corr = RT2560_DEFAULT_RSSI_CORR;
2516 	else
2517 		sc->rssi_corr = val & 0xff;
2518 	DPRINTF(sc, "rssi correction %d, calibrate 0x%02x\n",
2519 		 sc->rssi_corr, val);
2520 }
2521 
2522 
2523 static void
2524 rt2560_scan_start(struct ieee80211com *ic)
2525 {
2526 	struct ifnet *ifp = ic->ic_ifp;
2527 	struct rt2560_softc *sc = ifp->if_softc;
2528 
2529 	/* abort TSF synchronization */
2530 	RAL_WRITE(sc, RT2560_CSR14, 0);
2531 	rt2560_set_bssid(sc, ifp->if_broadcastaddr);
2532 }
2533 
2534 static void
2535 rt2560_scan_end(struct ieee80211com *ic)
2536 {
2537 	struct ifnet *ifp = ic->ic_ifp;
2538 	struct rt2560_softc *sc = ifp->if_softc;
2539 	struct ieee80211vap *vap = ic->ic_scan->ss_vap;
2540 
2541 	rt2560_enable_tsf_sync(sc);
2542 	/* XXX keep local copy */
2543 	rt2560_set_bssid(sc, vap->iv_bss->ni_bssid);
2544 }
2545 
2546 static int
2547 rt2560_bbp_init(struct rt2560_softc *sc)
2548 {
2549 #define N(a)	(sizeof (a) / sizeof ((a)[0]))
2550 	int i, ntries;
2551 
2552 	/* wait for BBP to be ready */
2553 	for (ntries = 0; ntries < 100; ntries++) {
2554 		if (rt2560_bbp_read(sc, RT2560_BBP_VERSION) != 0)
2555 			break;
2556 		DELAY(1);
2557 	}
2558 	if (ntries == 100) {
2559 		device_printf(sc->sc_dev, "timeout waiting for BBP\n");
2560 		return EIO;
2561 	}
2562 
2563 	/* initialize BBP registers to default values */
2564 	for (i = 0; i < N(rt2560_def_bbp); i++) {
2565 		rt2560_bbp_write(sc, rt2560_def_bbp[i].reg,
2566 		    rt2560_def_bbp[i].val);
2567 	}
2568 
2569 	/* initialize BBP registers to values stored in EEPROM */
2570 	for (i = 0; i < 16; i++) {
2571 		if (sc->bbp_prom[i].reg == 0 && sc->bbp_prom[i].val == 0)
2572 			break;
2573 		rt2560_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
2574 	}
2575 	rt2560_bbp_write(sc, 17, 0x48);	/* XXX restore bbp17 */
2576 
2577 	return 0;
2578 #undef N
2579 }
2580 
2581 static void
2582 rt2560_set_txantenna(struct rt2560_softc *sc, int antenna)
2583 {
2584 	uint32_t tmp;
2585 	uint8_t tx;
2586 
2587 	tx = rt2560_bbp_read(sc, RT2560_BBP_TX) & ~RT2560_BBP_ANTMASK;
2588 	if (antenna == 1)
2589 		tx |= RT2560_BBP_ANTA;
2590 	else if (antenna == 2)
2591 		tx |= RT2560_BBP_ANTB;
2592 	else
2593 		tx |= RT2560_BBP_DIVERSITY;
2594 
2595 	/* need to force I/Q flip for RF 2525e, 2526 and 5222 */
2596 	if (sc->rf_rev == RT2560_RF_2525E || sc->rf_rev == RT2560_RF_2526 ||
2597 	    sc->rf_rev == RT2560_RF_5222)
2598 		tx |= RT2560_BBP_FLIPIQ;
2599 
2600 	rt2560_bbp_write(sc, RT2560_BBP_TX, tx);
2601 
2602 	/* update values for CCK and OFDM in BBPCSR1 */
2603 	tmp = RAL_READ(sc, RT2560_BBPCSR1) & ~0x00070007;
2604 	tmp |= (tx & 0x7) << 16 | (tx & 0x7);
2605 	RAL_WRITE(sc, RT2560_BBPCSR1, tmp);
2606 }
2607 
2608 static void
2609 rt2560_set_rxantenna(struct rt2560_softc *sc, int antenna)
2610 {
2611 	uint8_t rx;
2612 
2613 	rx = rt2560_bbp_read(sc, RT2560_BBP_RX) & ~RT2560_BBP_ANTMASK;
2614 	if (antenna == 1)
2615 		rx |= RT2560_BBP_ANTA;
2616 	else if (antenna == 2)
2617 		rx |= RT2560_BBP_ANTB;
2618 	else
2619 		rx |= RT2560_BBP_DIVERSITY;
2620 
2621 	/* need to force no I/Q flip for RF 2525e and 2526 */
2622 	if (sc->rf_rev == RT2560_RF_2525E || sc->rf_rev == RT2560_RF_2526)
2623 		rx &= ~RT2560_BBP_FLIPIQ;
2624 
2625 	rt2560_bbp_write(sc, RT2560_BBP_RX, rx);
2626 }
2627 
2628 static void
2629 rt2560_init_locked(struct rt2560_softc *sc)
2630 {
2631 #define N(a)	(sizeof (a) / sizeof ((a)[0]))
2632 	struct ifnet *ifp = sc->sc_ifp;
2633 	struct ieee80211com *ic = ifp->if_l2com;
2634 	uint32_t tmp;
2635 	int i;
2636 
2637 	RAL_LOCK_ASSERT(sc);
2638 
2639 	rt2560_stop_locked(sc);
2640 
2641 	/* setup tx rings */
2642 	tmp = RT2560_PRIO_RING_COUNT << 24 |
2643 	      RT2560_ATIM_RING_COUNT << 16 |
2644 	      RT2560_TX_RING_COUNT   <<  8 |
2645 	      RT2560_TX_DESC_SIZE;
2646 
2647 	/* rings must be initialized in this exact order */
2648 	RAL_WRITE(sc, RT2560_TXCSR2, tmp);
2649 	RAL_WRITE(sc, RT2560_TXCSR3, sc->txq.physaddr);
2650 	RAL_WRITE(sc, RT2560_TXCSR5, sc->prioq.physaddr);
2651 	RAL_WRITE(sc, RT2560_TXCSR4, sc->atimq.physaddr);
2652 	RAL_WRITE(sc, RT2560_TXCSR6, sc->bcnq.physaddr);
2653 
2654 	/* setup rx ring */
2655 	tmp = RT2560_RX_RING_COUNT << 8 | RT2560_RX_DESC_SIZE;
2656 
2657 	RAL_WRITE(sc, RT2560_RXCSR1, tmp);
2658 	RAL_WRITE(sc, RT2560_RXCSR2, sc->rxq.physaddr);
2659 
2660 	/* initialize MAC registers to default values */
2661 	for (i = 0; i < N(rt2560_def_mac); i++)
2662 		RAL_WRITE(sc, rt2560_def_mac[i].reg, rt2560_def_mac[i].val);
2663 
2664 	IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
2665 	rt2560_set_macaddr(sc, ic->ic_myaddr);
2666 
2667 	/* set basic rate set (will be updated later) */
2668 	RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x153);
2669 
2670 	rt2560_update_slot(ifp);
2671 	rt2560_update_plcp(sc);
2672 	rt2560_update_led(sc, 0, 0);
2673 
2674 	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
2675 	RAL_WRITE(sc, RT2560_CSR1, RT2560_HOST_READY);
2676 
2677 	if (rt2560_bbp_init(sc) != 0) {
2678 		rt2560_stop(sc);
2679 		RAL_UNLOCK(sc);
2680 		return;
2681 	}
2682 
2683 	rt2560_set_txantenna(sc, sc->tx_ant);
2684 	rt2560_set_rxantenna(sc, sc->rx_ant);
2685 
2686 	/* set default BSS channel */
2687 	rt2560_set_chan(sc, ic->ic_curchan);
2688 
2689 	/* kick Rx */
2690 	tmp = RT2560_DROP_PHY_ERROR | RT2560_DROP_CRC_ERROR;
2691 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2692 		tmp |= RT2560_DROP_CTL | RT2560_DROP_VERSION_ERROR;
2693 		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
2694 			tmp |= RT2560_DROP_TODS;
2695 		if (!(ifp->if_flags & IFF_PROMISC))
2696 			tmp |= RT2560_DROP_NOT_TO_ME;
2697 	}
2698 	RAL_WRITE(sc, RT2560_RXCSR0, tmp);
2699 
2700 	/* clear old FCS and Rx FIFO errors */
2701 	RAL_READ(sc, RT2560_CNT0);
2702 	RAL_READ(sc, RT2560_CNT4);
2703 
2704 	/* clear any pending interrupts */
2705 	RAL_WRITE(sc, RT2560_CSR7, 0xffffffff);
2706 
2707 	/* enable interrupts */
2708 	RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
2709 
2710 	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
2711 	ifp->if_drv_flags |= IFF_DRV_RUNNING;
2712 
2713 	callout_reset(&sc->watchdog_ch, hz, rt2560_watchdog, sc);
2714 #undef N
2715 }
2716 
2717 static void
2718 rt2560_init(void *priv)
2719 {
2720 	struct rt2560_softc *sc = priv;
2721 	struct ifnet *ifp = sc->sc_ifp;
2722 	struct ieee80211com *ic = ifp->if_l2com;
2723 
2724 	RAL_LOCK(sc);
2725 	rt2560_init_locked(sc);
2726 	RAL_UNLOCK(sc);
2727 
2728 	ieee80211_start_all(ic);
2729 }
2730 
2731 static void
2732 rt2560_stop_locked(struct rt2560_softc *sc)
2733 {
2734 	struct ifnet *ifp = sc->sc_ifp;
2735 	volatile int *flags = &sc->sc_flags;
2736 
2737 	RAL_LOCK_ASSERT(sc);
2738 
2739 	while (*flags & RT2560_F_INPUT_RUNNING)
2740 		msleep(sc, &sc->sc_mtx, 0, "ralrunning", hz/10);
2741 
2742 	callout_stop(&sc->watchdog_ch);
2743 	sc->sc_tx_timer = 0;
2744 
2745 	if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
2746 		ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
2747 
2748 		/* abort Tx */
2749 		RAL_WRITE(sc, RT2560_TXCSR0, RT2560_ABORT_TX);
2750 
2751 		/* disable Rx */
2752 		RAL_WRITE(sc, RT2560_RXCSR0, RT2560_DISABLE_RX);
2753 
2754 		/* reset ASIC (imply reset BBP) */
2755 		RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
2756 		RAL_WRITE(sc, RT2560_CSR1, 0);
2757 
2758 		/* disable interrupts */
2759 		RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
2760 
2761 		/* reset Tx and Rx rings */
2762 		rt2560_reset_tx_ring(sc, &sc->txq);
2763 		rt2560_reset_tx_ring(sc, &sc->atimq);
2764 		rt2560_reset_tx_ring(sc, &sc->prioq);
2765 		rt2560_reset_tx_ring(sc, &sc->bcnq);
2766 		rt2560_reset_rx_ring(sc, &sc->rxq);
2767 	}
2768 	sc->sc_flags &= ~(RT2560_F_PRIO_OACTIVE | RT2560_F_DATA_OACTIVE);
2769 }
2770 
2771 void
2772 rt2560_stop(void *arg)
2773 {
2774 	struct rt2560_softc *sc = arg;
2775 
2776 	RAL_LOCK(sc);
2777 	rt2560_stop_locked(sc);
2778 	RAL_UNLOCK(sc);
2779 }
2780 
2781 static int
2782 rt2560_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
2783 	const struct ieee80211_bpf_params *params)
2784 {
2785 	struct ieee80211com *ic = ni->ni_ic;
2786 	struct ifnet *ifp = ic->ic_ifp;
2787 	struct rt2560_softc *sc = ifp->if_softc;
2788 
2789 	RAL_LOCK(sc);
2790 
2791 	/* prevent management frames from being sent if we're not ready */
2792 	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
2793 		RAL_UNLOCK(sc);
2794 		m_freem(m);
2795 		ieee80211_free_node(ni);
2796 		return ENETDOWN;
2797 	}
2798 	if (sc->prioq.queued >= RT2560_PRIO_RING_COUNT) {
2799 		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
2800 		sc->sc_flags |= RT2560_F_PRIO_OACTIVE;
2801 		RAL_UNLOCK(sc);
2802 		m_freem(m);
2803 		ieee80211_free_node(ni);
2804 		return ENOBUFS;		/* XXX */
2805 	}
2806 
2807 	ifp->if_opackets++;
2808 
2809 	if (params == NULL) {
2810 		/*
2811 		 * Legacy path; interpret frame contents to decide
2812 		 * precisely how to send the frame.
2813 		 */
2814 		if (rt2560_tx_mgt(sc, m, ni) != 0)
2815 			goto bad;
2816 	} else {
2817 		/*
2818 		 * Caller supplied explicit parameters to use in
2819 		 * sending the frame.
2820 		 */
2821 		if (rt2560_tx_raw(sc, m, ni, params))
2822 			goto bad;
2823 	}
2824 	sc->sc_tx_timer = 5;
2825 
2826 	RAL_UNLOCK(sc);
2827 
2828 	return 0;
2829 bad:
2830 	ifp->if_oerrors++;
2831 	ieee80211_free_node(ni);
2832 	RAL_UNLOCK(sc);
2833 	return EIO;		/* XXX */
2834 }
2835