xref: /freebsd/sys/dev/ral/rt2560.c (revision a743df5c964d81a7c920cf257e87cb42ab993d58)
1 /*	$FreeBSD$	*/
2 
3 /*-
4  * Copyright (c) 2005, 2006
5  *	Damien Bergamini <damien.bergamini@free.fr>
6  *
7  * Permission to use, copy, modify, and distribute this software for any
8  * purpose with or without fee is hereby granted, provided that the above
9  * copyright notice and this permission notice appear in all copies.
10  *
11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18  */
19 
20 #include <sys/cdefs.h>
21 __FBSDID("$FreeBSD$");
22 
23 /*-
24  * Ralink Technology RT2560 chipset driver
25  * http://www.ralinktech.com/
26  */
27 
28 #include <sys/param.h>
29 #include <sys/sysctl.h>
30 #include <sys/sockio.h>
31 #include <sys/mbuf.h>
32 #include <sys/kernel.h>
33 #include <sys/socket.h>
34 #include <sys/systm.h>
35 #include <sys/malloc.h>
36 #include <sys/module.h>
37 #include <sys/bus.h>
38 #include <sys/endian.h>
39 
40 #include <machine/bus.h>
41 #include <machine/resource.h>
42 #include <sys/rman.h>
43 
44 #include <net/bpf.h>
45 #include <net/if.h>
46 #include <net/if_arp.h>
47 #include <net/ethernet.h>
48 #include <net/if_dl.h>
49 #include <net/if_media.h>
50 #include <net/if_types.h>
51 
52 #include <net80211/ieee80211_var.h>
53 #include <net80211/ieee80211_radiotap.h>
54 
55 #include <netinet/in.h>
56 #include <netinet/in_systm.h>
57 #include <netinet/in_var.h>
58 #include <netinet/ip.h>
59 #include <netinet/if_ether.h>
60 
61 #include <dev/ral/if_ralrate.h>
62 #include <dev/ral/rt2560reg.h>
63 #include <dev/ral/rt2560var.h>
64 
65 #ifdef RAL_DEBUG
66 #define DPRINTF(x)	do { if (ral_debug > 0) printf x; } while (0)
67 #define DPRINTFN(n, x)	do { if (ral_debug >= (n)) printf x; } while (0)
68 extern int ral_debug;
69 #else
70 #define DPRINTF(x)
71 #define DPRINTFN(n, x)
72 #endif
73 
74 static void		rt2560_dma_map_addr(void *, bus_dma_segment_t *, int,
75 			    int);
76 static int		rt2560_alloc_tx_ring(struct rt2560_softc *,
77 			    struct rt2560_tx_ring *, int);
78 static void		rt2560_reset_tx_ring(struct rt2560_softc *,
79 			    struct rt2560_tx_ring *);
80 static void		rt2560_free_tx_ring(struct rt2560_softc *,
81 			    struct rt2560_tx_ring *);
82 static int		rt2560_alloc_rx_ring(struct rt2560_softc *,
83 			    struct rt2560_rx_ring *, int);
84 static void		rt2560_reset_rx_ring(struct rt2560_softc *,
85 			    struct rt2560_rx_ring *);
86 static void		rt2560_free_rx_ring(struct rt2560_softc *,
87 			    struct rt2560_rx_ring *);
88 static struct		ieee80211_node *rt2560_node_alloc(
89 			    struct ieee80211_node_table *);
90 static int		rt2560_media_change(struct ifnet *);
91 static void		rt2560_next_scan(void *);
92 static void		rt2560_iter_func(void *, struct ieee80211_node *);
93 static void		rt2560_update_rssadapt(void *);
94 static int		rt2560_newstate(struct ieee80211com *,
95 			    enum ieee80211_state, int);
96 static uint16_t		rt2560_eeprom_read(struct rt2560_softc *, uint8_t);
97 static void		rt2560_encryption_intr(struct rt2560_softc *);
98 static void		rt2560_tx_intr(struct rt2560_softc *);
99 static void		rt2560_prio_intr(struct rt2560_softc *);
100 static void		rt2560_decryption_intr(struct rt2560_softc *);
101 static void		rt2560_rx_intr(struct rt2560_softc *);
102 static void		rt2560_beacon_expire(struct rt2560_softc *);
103 static void		rt2560_wakeup_expire(struct rt2560_softc *);
104 static uint8_t		rt2560_rxrate(struct rt2560_rx_desc *);
105 static int		rt2560_ack_rate(struct ieee80211com *, int);
106 static uint16_t		rt2560_txtime(int, int, uint32_t);
107 static uint8_t		rt2560_plcp_signal(int);
108 static void		rt2560_setup_tx_desc(struct rt2560_softc *,
109 			    struct rt2560_tx_desc *, uint32_t, int, int, int,
110 			    bus_addr_t);
111 static int		rt2560_tx_bcn(struct rt2560_softc *, struct mbuf *,
112 			    struct ieee80211_node *);
113 static int		rt2560_tx_mgt(struct rt2560_softc *, struct mbuf *,
114 			    struct ieee80211_node *);
115 static struct		mbuf *rt2560_get_rts(struct rt2560_softc *,
116 			    struct ieee80211_frame *, uint16_t);
117 static int		rt2560_tx_data(struct rt2560_softc *, struct mbuf *,
118 			    struct ieee80211_node *);
119 static void		rt2560_start(struct ifnet *);
120 static void		rt2560_watchdog(struct ifnet *);
121 static int		rt2560_reset(struct ifnet *);
122 static int		rt2560_ioctl(struct ifnet *, u_long, caddr_t);
123 static void		rt2560_bbp_write(struct rt2560_softc *, uint8_t,
124 			    uint8_t);
125 static uint8_t		rt2560_bbp_read(struct rt2560_softc *, uint8_t);
126 static void		rt2560_rf_write(struct rt2560_softc *, uint8_t,
127 			    uint32_t);
128 static void		rt2560_set_chan(struct rt2560_softc *,
129 			    struct ieee80211_channel *);
130 #if 0
131 static void		rt2560_disable_rf_tune(struct rt2560_softc *);
132 #endif
133 static void		rt2560_enable_tsf_sync(struct rt2560_softc *);
134 static void		rt2560_update_plcp(struct rt2560_softc *);
135 static void		rt2560_update_slot(struct ifnet *);
136 static void		rt2560_set_basicrates(struct rt2560_softc *);
137 static void		rt2560_update_led(struct rt2560_softc *, int, int);
138 static void		rt2560_set_bssid(struct rt2560_softc *, uint8_t *);
139 static void		rt2560_set_macaddr(struct rt2560_softc *, uint8_t *);
140 static void		rt2560_get_macaddr(struct rt2560_softc *, uint8_t *);
141 static void		rt2560_update_promisc(struct rt2560_softc *);
142 static const char	*rt2560_get_rf(int);
143 static void		rt2560_read_eeprom(struct rt2560_softc *);
144 static int		rt2560_bbp_init(struct rt2560_softc *);
145 static void		rt2560_set_txantenna(struct rt2560_softc *, int);
146 static void		rt2560_set_rxantenna(struct rt2560_softc *, int);
147 static void		rt2560_init(void *);
148 static void		rt2560_stop(void *);
149 
150 /*
151  * Supported rates for 802.11a/b/g modes (in 500Kbps unit).
152  */
153 static const struct ieee80211_rateset rt2560_rateset_11a =
154 	{ 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
155 
156 static const struct ieee80211_rateset rt2560_rateset_11b =
157 	{ 4, { 2, 4, 11, 22 } };
158 
159 static const struct ieee80211_rateset rt2560_rateset_11g =
160 	{ 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
161 
162 static const struct {
163 	uint32_t	reg;
164 	uint32_t	val;
165 } rt2560_def_mac[] = {
166 	RT2560_DEF_MAC
167 };
168 
169 static const struct {
170 	uint8_t	reg;
171 	uint8_t	val;
172 } rt2560_def_bbp[] = {
173 	RT2560_DEF_BBP
174 };
175 
176 static const uint32_t rt2560_rf2522_r2[]    = RT2560_RF2522_R2;
177 static const uint32_t rt2560_rf2523_r2[]    = RT2560_RF2523_R2;
178 static const uint32_t rt2560_rf2524_r2[]    = RT2560_RF2524_R2;
179 static const uint32_t rt2560_rf2525_r2[]    = RT2560_RF2525_R2;
180 static const uint32_t rt2560_rf2525_hi_r2[] = RT2560_RF2525_HI_R2;
181 static const uint32_t rt2560_rf2525e_r2[]   = RT2560_RF2525E_R2;
182 static const uint32_t rt2560_rf2526_r2[]    = RT2560_RF2526_R2;
183 static const uint32_t rt2560_rf2526_hi_r2[] = RT2560_RF2526_HI_R2;
184 
185 static const struct {
186 	uint8_t		chan;
187 	uint32_t	r1, r2, r4;
188 } rt2560_rf5222[] = {
189 	RT2560_RF5222
190 };
191 
192 int
193 rt2560_attach(device_t dev, int id)
194 {
195 	struct rt2560_softc *sc = device_get_softc(dev);
196 	struct ieee80211com *ic = &sc->sc_ic;
197 	struct ifnet *ifp;
198 	int error, i;
199 
200 	sc->sc_dev = dev;
201 
202 	mtx_init(&sc->sc_mtx, device_get_nameunit(dev), MTX_NETWORK_LOCK,
203 	    MTX_DEF | MTX_RECURSE);
204 
205 	callout_init(&sc->scan_ch, debug_mpsafenet ? CALLOUT_MPSAFE : 0);
206 	callout_init(&sc->rssadapt_ch, CALLOUT_MPSAFE);
207 
208 	/* retrieve RT2560 rev. no */
209 	sc->asic_rev = RAL_READ(sc, RT2560_CSR0);
210 
211 	/* retrieve MAC address */
212 	rt2560_get_macaddr(sc, ic->ic_myaddr);
213 
214 	/* retrieve RF rev. no and various other things from EEPROM */
215 	rt2560_read_eeprom(sc);
216 
217 	device_printf(dev, "MAC/BBP RT2560 (rev 0x%02x), RF %s\n",
218 	    sc->asic_rev, rt2560_get_rf(sc->rf_rev));
219 
220 	/*
221 	 * Allocate Tx and Rx rings.
222 	 */
223 	error = rt2560_alloc_tx_ring(sc, &sc->txq, RT2560_TX_RING_COUNT);
224 	if (error != 0) {
225 		device_printf(sc->sc_dev, "could not allocate Tx ring\n");
226 		goto fail1;
227 	}
228 
229 	error = rt2560_alloc_tx_ring(sc, &sc->atimq, RT2560_ATIM_RING_COUNT);
230 	if (error != 0) {
231 		device_printf(sc->sc_dev, "could not allocate ATIM ring\n");
232 		goto fail2;
233 	}
234 
235 	error = rt2560_alloc_tx_ring(sc, &sc->prioq, RT2560_PRIO_RING_COUNT);
236 	if (error != 0) {
237 		device_printf(sc->sc_dev, "could not allocate Prio ring\n");
238 		goto fail3;
239 	}
240 
241 	error = rt2560_alloc_tx_ring(sc, &sc->bcnq, RT2560_BEACON_RING_COUNT);
242 	if (error != 0) {
243 		device_printf(sc->sc_dev, "could not allocate Beacon ring\n");
244 		goto fail4;
245 	}
246 
247 	error = rt2560_alloc_rx_ring(sc, &sc->rxq, RT2560_RX_RING_COUNT);
248 	if (error != 0) {
249 		device_printf(sc->sc_dev, "could not allocate Rx ring\n");
250 		goto fail5;
251 	}
252 
253 	ifp = sc->sc_ifp = if_alloc(IFT_ETHER);
254 	if (ifp == NULL) {
255 		device_printf(sc->sc_dev, "can not if_alloc()\n");
256 		goto fail6;
257 	}
258 
259 	ifp->if_softc = sc;
260 	if_initname(ifp, device_get_name(dev), device_get_unit(dev));
261 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
262 	ifp->if_init = rt2560_init;
263 	ifp->if_ioctl = rt2560_ioctl;
264 	ifp->if_start = rt2560_start;
265 	ifp->if_watchdog = rt2560_watchdog;
266 	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
267 	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
268 	IFQ_SET_READY(&ifp->if_snd);
269 
270 	ic->ic_ifp = ifp;
271 	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
272 	ic->ic_opmode = IEEE80211_M_STA; /* default to BSS mode */
273 	ic->ic_state = IEEE80211_S_INIT;
274 
275 	/* set device capabilities */
276 	ic->ic_caps =
277 	    IEEE80211_C_IBSS |		/* IBSS mode supported */
278 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
279 	    IEEE80211_C_HOSTAP |	/* HostAp mode supported */
280 	    IEEE80211_C_TXPMGT |	/* tx power management */
281 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
282 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
283 	    IEEE80211_C_WPA;		/* 802.11i */
284 
285 	if (sc->rf_rev == RT2560_RF_5222) {
286 		/* set supported .11a rates */
287 		ic->ic_sup_rates[IEEE80211_MODE_11A] = rt2560_rateset_11a;
288 
289 		/* set supported .11a channels */
290 		for (i = 36; i <= 64; i += 4) {
291 			ic->ic_channels[i].ic_freq =
292 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
293 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
294 		}
295 		for (i = 100; i <= 140; i += 4) {
296 			ic->ic_channels[i].ic_freq =
297 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
298 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
299 		}
300 		for (i = 149; i <= 161; i += 4) {
301 			ic->ic_channels[i].ic_freq =
302 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
303 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
304 		}
305 	}
306 
307 	/* set supported .11b and .11g rates */
308 	ic->ic_sup_rates[IEEE80211_MODE_11B] = rt2560_rateset_11b;
309 	ic->ic_sup_rates[IEEE80211_MODE_11G] = rt2560_rateset_11g;
310 
311 	/* set supported .11b and .11g channels (1 through 14) */
312 	for (i = 1; i <= 14; i++) {
313 		ic->ic_channels[i].ic_freq =
314 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
315 		ic->ic_channels[i].ic_flags =
316 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
317 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
318 	}
319 
320 	ieee80211_ifattach(ic);
321 	ic->ic_node_alloc = rt2560_node_alloc;
322 	ic->ic_updateslot = rt2560_update_slot;
323 	ic->ic_reset = rt2560_reset;
324 	/* enable s/w bmiss handling in sta mode */
325 	ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;
326 
327 	/* override state transition machine */
328 	sc->sc_newstate = ic->ic_newstate;
329 	ic->ic_newstate = rt2560_newstate;
330 	ieee80211_media_init(ic, rt2560_media_change, ieee80211_media_status);
331 
332 	bpfattach2(ifp, DLT_IEEE802_11_RADIO,
333 	    sizeof (struct ieee80211_frame) + 64, &sc->sc_drvbpf);
334 
335 	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
336 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
337 	sc->sc_rxtap.wr_ihdr.it_present = htole32(RT2560_RX_RADIOTAP_PRESENT);
338 
339 	sc->sc_txtap_len = sizeof sc->sc_txtapu;
340 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
341 	sc->sc_txtap.wt_ihdr.it_present = htole32(RT2560_TX_RADIOTAP_PRESENT);
342 
343 	/*
344 	 * Add a few sysctl knobs.
345 	 */
346 	sc->dwelltime = 200;
347 
348 	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
349 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
350 	    "txantenna", CTLFLAG_RW, &sc->tx_ant, 0, "tx antenna (0=auto)");
351 
352 	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
353 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
354 	    "rxantenna", CTLFLAG_RW, &sc->rx_ant, 0, "rx antenna (0=auto)");
355 
356 	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
357 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO, "dwell",
358 	    CTLFLAG_RW, &sc->dwelltime, 0,
359 	    "channel dwell time (ms) for AP/station scanning");
360 
361 	if (bootverbose)
362 		ieee80211_announce(ic);
363 
364 	return 0;
365 
366 fail6:	rt2560_free_rx_ring(sc, &sc->rxq);
367 fail5:	rt2560_free_tx_ring(sc, &sc->bcnq);
368 fail4:	rt2560_free_tx_ring(sc, &sc->prioq);
369 fail3:	rt2560_free_tx_ring(sc, &sc->atimq);
370 fail2:	rt2560_free_tx_ring(sc, &sc->txq);
371 fail1:	mtx_destroy(&sc->sc_mtx);
372 
373 	return ENXIO;
374 }
375 
376 int
377 rt2560_detach(void *xsc)
378 {
379 	struct rt2560_softc *sc = xsc;
380 	struct ieee80211com *ic = &sc->sc_ic;
381 	struct ifnet *ifp = ic->ic_ifp;
382 
383 	rt2560_stop(sc);
384 	callout_stop(&sc->scan_ch);
385 	callout_stop(&sc->rssadapt_ch);
386 
387 	bpfdetach(ifp);
388 	ieee80211_ifdetach(ic);
389 
390 	rt2560_free_tx_ring(sc, &sc->txq);
391 	rt2560_free_tx_ring(sc, &sc->atimq);
392 	rt2560_free_tx_ring(sc, &sc->prioq);
393 	rt2560_free_tx_ring(sc, &sc->bcnq);
394 	rt2560_free_rx_ring(sc, &sc->rxq);
395 
396 	if_free(ifp);
397 
398 	mtx_destroy(&sc->sc_mtx);
399 
400 	return 0;
401 }
402 
403 void
404 rt2560_shutdown(void *xsc)
405 {
406 	struct rt2560_softc *sc = xsc;
407 
408 	rt2560_stop(sc);
409 }
410 
411 void
412 rt2560_suspend(void *xsc)
413 {
414 	struct rt2560_softc *sc = xsc;
415 
416 	rt2560_stop(sc);
417 }
418 
419 void
420 rt2560_resume(void *xsc)
421 {
422 	struct rt2560_softc *sc = xsc;
423 	struct ifnet *ifp = sc->sc_ic.ic_ifp;
424 
425 	if (ifp->if_flags & IFF_UP) {
426 		ifp->if_init(ifp->if_softc);
427 		if (ifp->if_drv_flags & IFF_DRV_RUNNING)
428 			ifp->if_start(ifp);
429 	}
430 }
431 
432 static void
433 rt2560_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nseg, int error)
434 {
435 	if (error != 0)
436 		return;
437 
438 	KASSERT(nseg == 1, ("too many DMA segments, %d should be 1", nseg));
439 
440 	*(bus_addr_t *)arg = segs[0].ds_addr;
441 }
442 
443 static int
444 rt2560_alloc_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring,
445     int count)
446 {
447 	int i, error;
448 
449 	ring->count = count;
450 	ring->queued = 0;
451 	ring->cur = ring->next = 0;
452 	ring->cur_encrypt = ring->next_encrypt = 0;
453 
454 	error = bus_dma_tag_create(NULL, 4, 0, BUS_SPACE_MAXADDR_32BIT,
455 	    BUS_SPACE_MAXADDR, NULL, NULL, count * RT2560_TX_DESC_SIZE, 1,
456 	    count * RT2560_TX_DESC_SIZE, 0, NULL, NULL, &ring->desc_dmat);
457 	if (error != 0) {
458 		device_printf(sc->sc_dev, "could not create desc DMA tag\n");
459 		goto fail;
460 	}
461 
462 	error = bus_dmamem_alloc(ring->desc_dmat, (void **)&ring->desc,
463 	    BUS_DMA_NOWAIT | BUS_DMA_ZERO, &ring->desc_map);
464 	if (error != 0) {
465 		device_printf(sc->sc_dev, "could not allocate DMA memory\n");
466 		goto fail;
467 	}
468 
469 	error = bus_dmamap_load(ring->desc_dmat, ring->desc_map, ring->desc,
470 	    count * RT2560_TX_DESC_SIZE, rt2560_dma_map_addr, &ring->physaddr,
471 	    0);
472 	if (error != 0) {
473 		device_printf(sc->sc_dev, "could not load desc DMA map\n");
474 		goto fail;
475 	}
476 
477 	ring->data = malloc(count * sizeof (struct rt2560_tx_data), M_DEVBUF,
478 	    M_NOWAIT | M_ZERO);
479 	if (ring->data == NULL) {
480 		device_printf(sc->sc_dev, "could not allocate soft data\n");
481 		error = ENOMEM;
482 		goto fail;
483 	}
484 
485 	error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
486 	    BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, RT2560_MAX_SCATTER,
487 	    MCLBYTES, 0, NULL, NULL, &ring->data_dmat);
488 	if (error != 0) {
489 		device_printf(sc->sc_dev, "could not create data DMA tag\n");
490 		goto fail;
491 	}
492 
493 	for (i = 0; i < count; i++) {
494 		error = bus_dmamap_create(ring->data_dmat, 0,
495 		    &ring->data[i].map);
496 		if (error != 0) {
497 			device_printf(sc->sc_dev, "could not create DMA map\n");
498 			goto fail;
499 		}
500 	}
501 
502 	return 0;
503 
504 fail:	rt2560_free_tx_ring(sc, ring);
505 	return error;
506 }
507 
508 static void
509 rt2560_reset_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring)
510 {
511 	struct rt2560_tx_desc *desc;
512 	struct rt2560_tx_data *data;
513 	int i;
514 
515 	for (i = 0; i < ring->count; i++) {
516 		desc = &ring->desc[i];
517 		data = &ring->data[i];
518 
519 		if (data->m != NULL) {
520 			bus_dmamap_sync(ring->data_dmat, data->map,
521 			    BUS_DMASYNC_POSTWRITE);
522 			bus_dmamap_unload(ring->data_dmat, data->map);
523 			m_freem(data->m);
524 			data->m = NULL;
525 		}
526 
527 		if (data->ni != NULL) {
528 			ieee80211_free_node(data->ni);
529 			data->ni = NULL;
530 		}
531 
532 		desc->flags = 0;
533 	}
534 
535 	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
536 
537 	ring->queued = 0;
538 	ring->cur = ring->next = 0;
539 	ring->cur_encrypt = ring->next_encrypt = 0;
540 }
541 
542 static void
543 rt2560_free_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring)
544 {
545 	struct rt2560_tx_data *data;
546 	int i;
547 
548 	if (ring->desc != NULL) {
549 		bus_dmamap_sync(ring->desc_dmat, ring->desc_map,
550 		    BUS_DMASYNC_POSTWRITE);
551 		bus_dmamap_unload(ring->desc_dmat, ring->desc_map);
552 		bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
553 	}
554 
555 	if (ring->desc_dmat != NULL)
556 		bus_dma_tag_destroy(ring->desc_dmat);
557 
558 	if (ring->data != NULL) {
559 		for (i = 0; i < ring->count; i++) {
560 			data = &ring->data[i];
561 
562 			if (data->m != NULL) {
563 				bus_dmamap_sync(ring->data_dmat, data->map,
564 				    BUS_DMASYNC_POSTWRITE);
565 				bus_dmamap_unload(ring->data_dmat, data->map);
566 				m_freem(data->m);
567 			}
568 
569 			if (data->ni != NULL)
570 				ieee80211_free_node(data->ni);
571 
572 			if (data->map != NULL)
573 				bus_dmamap_destroy(ring->data_dmat, data->map);
574 		}
575 
576 		free(ring->data, M_DEVBUF);
577 	}
578 
579 	if (ring->data_dmat != NULL)
580 		bus_dma_tag_destroy(ring->data_dmat);
581 }
582 
583 static int
584 rt2560_alloc_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring,
585     int count)
586 {
587 	struct rt2560_rx_desc *desc;
588 	struct rt2560_rx_data *data;
589 	bus_addr_t physaddr;
590 	int i, error;
591 
592 	ring->count = count;
593 	ring->cur = ring->next = 0;
594 	ring->cur_decrypt = 0;
595 
596 	error = bus_dma_tag_create(NULL, 4, 0, BUS_SPACE_MAXADDR_32BIT,
597 	    BUS_SPACE_MAXADDR, NULL, NULL, count * RT2560_RX_DESC_SIZE, 1,
598 	    count * RT2560_RX_DESC_SIZE, 0, NULL, NULL, &ring->desc_dmat);
599 	if (error != 0) {
600 		device_printf(sc->sc_dev, "could not create desc DMA tag\n");
601 		goto fail;
602 	}
603 
604 	error = bus_dmamem_alloc(ring->desc_dmat, (void **)&ring->desc,
605 	    BUS_DMA_NOWAIT | BUS_DMA_ZERO, &ring->desc_map);
606 	if (error != 0) {
607 		device_printf(sc->sc_dev, "could not allocate DMA memory\n");
608 		goto fail;
609 	}
610 
611 	error = bus_dmamap_load(ring->desc_dmat, ring->desc_map, ring->desc,
612 	    count * RT2560_RX_DESC_SIZE, rt2560_dma_map_addr, &ring->physaddr,
613 	    0);
614 	if (error != 0) {
615 		device_printf(sc->sc_dev, "could not load desc DMA map\n");
616 		goto fail;
617 	}
618 
619 	ring->data = malloc(count * sizeof (struct rt2560_rx_data), M_DEVBUF,
620 	    M_NOWAIT | M_ZERO);
621 	if (ring->data == NULL) {
622 		device_printf(sc->sc_dev, "could not allocate soft data\n");
623 		error = ENOMEM;
624 		goto fail;
625 	}
626 
627 	/*
628 	 * Pre-allocate Rx buffers and populate Rx ring.
629 	 */
630 	error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
631 	    BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, 1, MCLBYTES, 0, NULL,
632 	    NULL, &ring->data_dmat);
633 	if (error != 0) {
634 		device_printf(sc->sc_dev, "could not create data DMA tag\n");
635 		goto fail;
636 	}
637 
638 	for (i = 0; i < count; i++) {
639 		desc = &sc->rxq.desc[i];
640 		data = &sc->rxq.data[i];
641 
642 		error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
643 		if (error != 0) {
644 			device_printf(sc->sc_dev, "could not create DMA map\n");
645 			goto fail;
646 		}
647 
648 		data->m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
649 		if (data->m == NULL) {
650 			device_printf(sc->sc_dev,
651 			    "could not allocate rx mbuf\n");
652 			error = ENOMEM;
653 			goto fail;
654 		}
655 
656 		error = bus_dmamap_load(ring->data_dmat, data->map,
657 		    mtod(data->m, void *), MCLBYTES, rt2560_dma_map_addr,
658 		    &physaddr, 0);
659 		if (error != 0) {
660 			device_printf(sc->sc_dev,
661 			    "could not load rx buf DMA map");
662 			goto fail;
663 		}
664 
665 		desc->flags = htole32(RT2560_RX_BUSY);
666 		desc->physaddr = htole32(physaddr);
667 	}
668 
669 	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
670 
671 	return 0;
672 
673 fail:	rt2560_free_rx_ring(sc, ring);
674 	return error;
675 }
676 
677 static void
678 rt2560_reset_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring)
679 {
680 	int i;
681 
682 	for (i = 0; i < ring->count; i++) {
683 		ring->desc[i].flags = htole32(RT2560_RX_BUSY);
684 		ring->data[i].drop = 0;
685 	}
686 
687 	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
688 
689 	ring->cur = ring->next = 0;
690 	ring->cur_decrypt = 0;
691 }
692 
693 static void
694 rt2560_free_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring)
695 {
696 	struct rt2560_rx_data *data;
697 	int i;
698 
699 	if (ring->desc != NULL) {
700 		bus_dmamap_sync(ring->desc_dmat, ring->desc_map,
701 		    BUS_DMASYNC_POSTWRITE);
702 		bus_dmamap_unload(ring->desc_dmat, ring->desc_map);
703 		bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
704 	}
705 
706 	if (ring->desc_dmat != NULL)
707 		bus_dma_tag_destroy(ring->desc_dmat);
708 
709 	if (ring->data != NULL) {
710 		for (i = 0; i < ring->count; i++) {
711 			data = &ring->data[i];
712 
713 			if (data->m != NULL) {
714 				bus_dmamap_sync(ring->data_dmat, data->map,
715 				    BUS_DMASYNC_POSTREAD);
716 				bus_dmamap_unload(ring->data_dmat, data->map);
717 				m_freem(data->m);
718 			}
719 
720 			if (data->map != NULL)
721 				bus_dmamap_destroy(ring->data_dmat, data->map);
722 		}
723 
724 		free(ring->data, M_DEVBUF);
725 	}
726 
727 	if (ring->data_dmat != NULL)
728 		bus_dma_tag_destroy(ring->data_dmat);
729 }
730 
731 static struct ieee80211_node *
732 rt2560_node_alloc(struct ieee80211_node_table *nt)
733 {
734 	struct rt2560_node *rn;
735 
736 	rn = malloc(sizeof (struct rt2560_node), M_80211_NODE,
737 	    M_NOWAIT | M_ZERO);
738 
739 	return (rn != NULL) ? &rn->ni : NULL;
740 }
741 
742 static int
743 rt2560_media_change(struct ifnet *ifp)
744 {
745 	struct rt2560_softc *sc = ifp->if_softc;
746 	int error;
747 
748 	error = ieee80211_media_change(ifp);
749 	if (error != ENETRESET)
750 		return error;
751 
752 	if ((ifp->if_flags & IFF_UP) &&
753 	    (ifp->if_drv_flags & IFF_DRV_RUNNING))
754 		rt2560_init(sc);
755 
756 	return 0;
757 }
758 
759 /*
760  * This function is called periodically (every 200ms) during scanning to
761  * switch from one channel to another.
762  */
763 static void
764 rt2560_next_scan(void *arg)
765 {
766 	struct rt2560_softc *sc = arg;
767 	struct ieee80211com *ic = &sc->sc_ic;
768 
769 	if (ic->ic_state == IEEE80211_S_SCAN)
770 		ieee80211_next_scan(ic);
771 }
772 
773 /*
774  * This function is called for each node present in the node station table.
775  */
776 static void
777 rt2560_iter_func(void *arg, struct ieee80211_node *ni)
778 {
779 	struct rt2560_node *rn = (struct rt2560_node *)ni;
780 
781 	ral_rssadapt_updatestats(&rn->rssadapt);
782 }
783 
784 /*
785  * This function is called periodically (every 100ms) in RUN state to update
786  * the rate adaptation statistics.
787  */
788 static void
789 rt2560_update_rssadapt(void *arg)
790 {
791 	struct rt2560_softc *sc = arg;
792 	struct ieee80211com *ic = &sc->sc_ic;
793 
794 	RAL_LOCK(sc);
795 
796 	ieee80211_iterate_nodes(&ic->ic_sta, rt2560_iter_func, arg);
797 	callout_reset(&sc->rssadapt_ch, hz / 10, rt2560_update_rssadapt, sc);
798 
799 	RAL_UNLOCK(sc);
800 }
801 
802 static int
803 rt2560_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
804 {
805 	struct rt2560_softc *sc = ic->ic_ifp->if_softc;
806 	enum ieee80211_state ostate;
807 	struct ieee80211_node *ni;
808 	struct mbuf *m;
809 	int error = 0;
810 
811 	ostate = ic->ic_state;
812 	callout_stop(&sc->scan_ch);
813 
814 	switch (nstate) {
815 	case IEEE80211_S_INIT:
816 		callout_stop(&sc->rssadapt_ch);
817 
818 		if (ostate == IEEE80211_S_RUN) {
819 			/* abort TSF synchronization */
820 			RAL_WRITE(sc, RT2560_CSR14, 0);
821 
822 			/* turn association led off */
823 			rt2560_update_led(sc, 0, 0);
824 		}
825 		break;
826 
827 	case IEEE80211_S_SCAN:
828 		rt2560_set_chan(sc, ic->ic_curchan);
829 		callout_reset(&sc->scan_ch, (sc->dwelltime * hz) / 1000,
830 		    rt2560_next_scan, sc);
831 		break;
832 
833 	case IEEE80211_S_AUTH:
834 		rt2560_set_chan(sc, ic->ic_curchan);
835 		break;
836 
837 	case IEEE80211_S_ASSOC:
838 		rt2560_set_chan(sc, ic->ic_curchan);
839 		break;
840 
841 	case IEEE80211_S_RUN:
842 		rt2560_set_chan(sc, ic->ic_curchan);
843 
844 		ni = ic->ic_bss;
845 
846 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
847 			rt2560_update_plcp(sc);
848 			rt2560_set_basicrates(sc);
849 			rt2560_set_bssid(sc, ni->ni_bssid);
850 		}
851 
852 		if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
853 		    ic->ic_opmode == IEEE80211_M_IBSS) {
854 			m = ieee80211_beacon_alloc(ic, ni, &sc->sc_bo);
855 			if (m == NULL) {
856 				device_printf(sc->sc_dev,
857 				    "could not allocate beacon\n");
858 				error = ENOBUFS;
859 				break;
860 			}
861 
862 			ieee80211_ref_node(ni);
863 			error = rt2560_tx_bcn(sc, m, ni);
864 			if (error != 0)
865 				break;
866 		}
867 
868 		/* turn assocation led on */
869 		rt2560_update_led(sc, 1, 0);
870 
871 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
872 			callout_reset(&sc->rssadapt_ch, hz / 10,
873 			    rt2560_update_rssadapt, sc);
874 
875 			rt2560_enable_tsf_sync(sc);
876 		}
877 		break;
878 	}
879 
880 	return (error != 0) ? error : sc->sc_newstate(ic, nstate, arg);
881 }
882 
883 /*
884  * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46 or
885  * 93C66).
886  */
887 static uint16_t
888 rt2560_eeprom_read(struct rt2560_softc *sc, uint8_t addr)
889 {
890 	uint32_t tmp;
891 	uint16_t val;
892 	int n;
893 
894 	/* clock C once before the first command */
895 	RT2560_EEPROM_CTL(sc, 0);
896 
897 	RT2560_EEPROM_CTL(sc, RT2560_S);
898 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
899 	RT2560_EEPROM_CTL(sc, RT2560_S);
900 
901 	/* write start bit (1) */
902 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D);
903 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D | RT2560_C);
904 
905 	/* write READ opcode (10) */
906 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D);
907 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D | RT2560_C);
908 	RT2560_EEPROM_CTL(sc, RT2560_S);
909 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
910 
911 	/* write address (A5-A0 or A7-A0) */
912 	n = (RAL_READ(sc, RT2560_CSR21) & RT2560_93C46) ? 5 : 7;
913 	for (; n >= 0; n--) {
914 		RT2560_EEPROM_CTL(sc, RT2560_S |
915 		    (((addr >> n) & 1) << RT2560_SHIFT_D));
916 		RT2560_EEPROM_CTL(sc, RT2560_S |
917 		    (((addr >> n) & 1) << RT2560_SHIFT_D) | RT2560_C);
918 	}
919 
920 	RT2560_EEPROM_CTL(sc, RT2560_S);
921 
922 	/* read data Q15-Q0 */
923 	val = 0;
924 	for (n = 15; n >= 0; n--) {
925 		RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
926 		tmp = RAL_READ(sc, RT2560_CSR21);
927 		val |= ((tmp & RT2560_Q) >> RT2560_SHIFT_Q) << n;
928 		RT2560_EEPROM_CTL(sc, RT2560_S);
929 	}
930 
931 	RT2560_EEPROM_CTL(sc, 0);
932 
933 	/* clear Chip Select and clock C */
934 	RT2560_EEPROM_CTL(sc, RT2560_S);
935 	RT2560_EEPROM_CTL(sc, 0);
936 	RT2560_EEPROM_CTL(sc, RT2560_C);
937 
938 	return val;
939 }
940 
941 /*
942  * Some frames were processed by the hardware cipher engine and are ready for
943  * transmission.
944  */
945 static void
946 rt2560_encryption_intr(struct rt2560_softc *sc)
947 {
948 	struct rt2560_tx_desc *desc;
949 	int hw;
950 
951 	/* retrieve last descriptor index processed by cipher engine */
952 	hw = RAL_READ(sc, RT2560_SECCSR1) - sc->txq.physaddr;
953 	hw /= RT2560_TX_DESC_SIZE;
954 
955 	bus_dmamap_sync(sc->txq.desc_dmat, sc->txq.desc_map,
956 	    BUS_DMASYNC_POSTREAD);
957 
958 	for (; sc->txq.next_encrypt != hw;) {
959 		desc = &sc->txq.desc[sc->txq.next_encrypt];
960 
961 		if ((le32toh(desc->flags) & RT2560_TX_BUSY) ||
962 		    (le32toh(desc->flags) & RT2560_TX_CIPHER_BUSY))
963 			break;
964 
965 		/* for TKIP, swap eiv field to fix a bug in ASIC */
966 		if ((le32toh(desc->flags) & RT2560_TX_CIPHER_MASK) ==
967 		    RT2560_TX_CIPHER_TKIP)
968 			desc->eiv = bswap32(desc->eiv);
969 
970 		/* mark the frame ready for transmission */
971 		desc->flags |= htole32(RT2560_TX_BUSY | RT2560_TX_VALID);
972 
973 		DPRINTFN(15, ("encryption done idx=%u\n",
974 		    sc->txq.next_encrypt));
975 
976 		sc->txq.next_encrypt =
977 		    (sc->txq.next_encrypt + 1) % RT2560_TX_RING_COUNT;
978 	}
979 
980 	bus_dmamap_sync(sc->txq.desc_dmat, sc->txq.desc_map,
981 	    BUS_DMASYNC_PREWRITE);
982 
983 	/* kick Tx */
984 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_TX);
985 }
986 
987 static void
988 rt2560_tx_intr(struct rt2560_softc *sc)
989 {
990 	struct ieee80211com *ic = &sc->sc_ic;
991 	struct ifnet *ifp = ic->ic_ifp;
992 	struct rt2560_tx_desc *desc;
993 	struct rt2560_tx_data *data;
994 	struct rt2560_node *rn;
995 
996 	bus_dmamap_sync(sc->txq.desc_dmat, sc->txq.desc_map,
997 	    BUS_DMASYNC_POSTREAD);
998 
999 	for (;;) {
1000 		desc = &sc->txq.desc[sc->txq.next];
1001 		data = &sc->txq.data[sc->txq.next];
1002 
1003 		if ((le32toh(desc->flags) & RT2560_TX_BUSY) ||
1004 		    (le32toh(desc->flags) & RT2560_TX_CIPHER_BUSY) ||
1005 		    !(le32toh(desc->flags) & RT2560_TX_VALID))
1006 			break;
1007 
1008 		rn = (struct rt2560_node *)data->ni;
1009 
1010 		switch (le32toh(desc->flags) & RT2560_TX_RESULT_MASK) {
1011 		case RT2560_TX_SUCCESS:
1012 			DPRINTFN(10, ("data frame sent successfully\n"));
1013 			if (data->id.id_node != NULL) {
1014 				ral_rssadapt_raise_rate(ic, &rn->rssadapt,
1015 				    &data->id);
1016 			}
1017 			ifp->if_opackets++;
1018 			break;
1019 
1020 		case RT2560_TX_SUCCESS_RETRY:
1021 			DPRINTFN(9, ("data frame sent after %u retries\n",
1022 			    (le32toh(desc->flags) >> 5) & 0x7));
1023 			ifp->if_opackets++;
1024 			break;
1025 
1026 		case RT2560_TX_FAIL_RETRY:
1027 			DPRINTFN(9, ("sending data frame failed (too much "
1028 			    "retries)\n"));
1029 			if (data->id.id_node != NULL) {
1030 				ral_rssadapt_lower_rate(ic, data->ni,
1031 				    &rn->rssadapt, &data->id);
1032 			}
1033 			ifp->if_oerrors++;
1034 			break;
1035 
1036 		case RT2560_TX_FAIL_INVALID:
1037 		case RT2560_TX_FAIL_OTHER:
1038 		default:
1039 			device_printf(sc->sc_dev, "sending data frame failed "
1040 			    "0x%08x\n", le32toh(desc->flags));
1041 			ifp->if_oerrors++;
1042 		}
1043 
1044 		bus_dmamap_sync(sc->txq.data_dmat, data->map,
1045 		    BUS_DMASYNC_POSTWRITE);
1046 		bus_dmamap_unload(sc->txq.data_dmat, data->map);
1047 		m_freem(data->m);
1048 		data->m = NULL;
1049 		ieee80211_free_node(data->ni);
1050 		data->ni = NULL;
1051 
1052 		/* descriptor is no longer valid */
1053 		desc->flags &= ~htole32(RT2560_TX_VALID);
1054 
1055 		DPRINTFN(15, ("tx done idx=%u\n", sc->txq.next));
1056 
1057 		sc->txq.queued--;
1058 		sc->txq.next = (sc->txq.next + 1) % RT2560_TX_RING_COUNT;
1059 	}
1060 
1061 	bus_dmamap_sync(sc->txq.desc_dmat, sc->txq.desc_map,
1062 	    BUS_DMASYNC_PREWRITE);
1063 
1064 	sc->sc_tx_timer = 0;
1065 	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1066 	rt2560_start(ifp);
1067 }
1068 
1069 static void
1070 rt2560_prio_intr(struct rt2560_softc *sc)
1071 {
1072 	struct ieee80211com *ic = &sc->sc_ic;
1073 	struct ifnet *ifp = ic->ic_ifp;
1074 	struct rt2560_tx_desc *desc;
1075 	struct rt2560_tx_data *data;
1076 
1077 	bus_dmamap_sync(sc->prioq.desc_dmat, sc->prioq.desc_map,
1078 	    BUS_DMASYNC_POSTREAD);
1079 
1080 	for (;;) {
1081 		desc = &sc->prioq.desc[sc->prioq.next];
1082 		data = &sc->prioq.data[sc->prioq.next];
1083 
1084 		if ((le32toh(desc->flags) & RT2560_TX_BUSY) ||
1085 		    !(le32toh(desc->flags) & RT2560_TX_VALID))
1086 			break;
1087 
1088 		switch (le32toh(desc->flags) & RT2560_TX_RESULT_MASK) {
1089 		case RT2560_TX_SUCCESS:
1090 			DPRINTFN(10, ("mgt frame sent successfully\n"));
1091 			break;
1092 
1093 		case RT2560_TX_SUCCESS_RETRY:
1094 			DPRINTFN(9, ("mgt frame sent after %u retries\n",
1095 			    (le32toh(desc->flags) >> 5) & 0x7));
1096 			break;
1097 
1098 		case RT2560_TX_FAIL_RETRY:
1099 			DPRINTFN(9, ("sending mgt frame failed (too much "
1100 			    "retries)\n"));
1101 			break;
1102 
1103 		case RT2560_TX_FAIL_INVALID:
1104 		case RT2560_TX_FAIL_OTHER:
1105 		default:
1106 			device_printf(sc->sc_dev, "sending mgt frame failed "
1107 			    "0x%08x\n", le32toh(desc->flags));
1108 		}
1109 
1110 		bus_dmamap_sync(sc->prioq.data_dmat, data->map,
1111 		    BUS_DMASYNC_POSTWRITE);
1112 		bus_dmamap_unload(sc->prioq.data_dmat, data->map);
1113 		m_freem(data->m);
1114 		data->m = NULL;
1115 		ieee80211_free_node(data->ni);
1116 		data->ni = NULL;
1117 
1118 		/* descriptor is no longer valid */
1119 		desc->flags &= ~htole32(RT2560_TX_VALID);
1120 
1121 		DPRINTFN(15, ("prio done idx=%u\n", sc->prioq.next));
1122 
1123 		sc->prioq.queued--;
1124 		sc->prioq.next = (sc->prioq.next + 1) % RT2560_PRIO_RING_COUNT;
1125 	}
1126 
1127 	bus_dmamap_sync(sc->prioq.desc_dmat, sc->prioq.desc_map,
1128 	    BUS_DMASYNC_PREWRITE);
1129 
1130 	sc->sc_tx_timer = 0;
1131 	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1132 	rt2560_start(ifp);
1133 }
1134 
1135 /*
1136  * Some frames were processed by the hardware cipher engine and are ready for
1137  * transmission to the IEEE802.11 layer.
1138  */
1139 static void
1140 rt2560_decryption_intr(struct rt2560_softc *sc)
1141 {
1142 	struct ieee80211com *ic = &sc->sc_ic;
1143 	struct ifnet *ifp = ic->ic_ifp;
1144 	struct rt2560_rx_desc *desc;
1145 	struct rt2560_rx_data *data;
1146 	bus_addr_t physaddr;
1147 	struct ieee80211_frame *wh;
1148 	struct ieee80211_node *ni;
1149 	struct rt2560_node *rn;
1150 	struct mbuf *mnew, *m;
1151 	int hw, error;
1152 
1153 	/* retrieve last decriptor index processed by cipher engine */
1154 	hw = RAL_READ(sc, RT2560_SECCSR0) - sc->rxq.physaddr;
1155 	hw /= RT2560_RX_DESC_SIZE;
1156 
1157 	bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
1158 	    BUS_DMASYNC_POSTREAD);
1159 
1160 	for (; sc->rxq.cur_decrypt != hw;) {
1161 		desc = &sc->rxq.desc[sc->rxq.cur_decrypt];
1162 		data = &sc->rxq.data[sc->rxq.cur_decrypt];
1163 
1164 		if ((le32toh(desc->flags) & RT2560_RX_BUSY) ||
1165 		    (le32toh(desc->flags) & RT2560_RX_CIPHER_BUSY))
1166 			break;
1167 
1168 		if (data->drop) {
1169 			ifp->if_ierrors++;
1170 			goto skip;
1171 		}
1172 
1173 		if ((le32toh(desc->flags) & RT2560_RX_CIPHER_MASK) != 0 &&
1174 		    (le32toh(desc->flags) & RT2560_RX_ICV_ERROR)) {
1175 			ifp->if_ierrors++;
1176 			goto skip;
1177 		}
1178 
1179 		/*
1180 		 * Try to allocate a new mbuf for this ring element and load it
1181 		 * before processing the current mbuf. If the ring element
1182 		 * cannot be loaded, drop the received packet and reuse the old
1183 		 * mbuf. In the unlikely case that the old mbuf can't be
1184 		 * reloaded either, explicitly panic.
1185 		 */
1186 		mnew = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
1187 		if (mnew == NULL) {
1188 			ifp->if_ierrors++;
1189 			goto skip;
1190 		}
1191 
1192 		bus_dmamap_sync(sc->rxq.data_dmat, data->map,
1193 		    BUS_DMASYNC_POSTREAD);
1194 		bus_dmamap_unload(sc->rxq.data_dmat, data->map);
1195 
1196 		error = bus_dmamap_load(sc->rxq.data_dmat, data->map,
1197 		    mtod(mnew, void *), MCLBYTES, rt2560_dma_map_addr,
1198 		    &physaddr, 0);
1199 		if (error != 0) {
1200 			m_freem(mnew);
1201 
1202 			/* try to reload the old mbuf */
1203 			error = bus_dmamap_load(sc->rxq.data_dmat, data->map,
1204 			    mtod(data->m, void *), MCLBYTES,
1205 			    rt2560_dma_map_addr, &physaddr, 0);
1206 			if (error != 0) {
1207 				/* very unlikely that it will fail... */
1208 				panic("%s: could not load old rx mbuf",
1209 				    device_get_name(sc->sc_dev));
1210 			}
1211 			ifp->if_ierrors++;
1212 			goto skip;
1213 		}
1214 
1215 		/*
1216 	 	 * New mbuf successfully loaded, update Rx ring and continue
1217 		 * processing.
1218 		 */
1219 		m = data->m;
1220 		data->m = mnew;
1221 		desc->physaddr = htole32(physaddr);
1222 
1223 		/* finalize mbuf */
1224 		m->m_pkthdr.rcvif = ifp;
1225 		m->m_pkthdr.len = m->m_len =
1226 		    (le32toh(desc->flags) >> 16) & 0xfff;
1227 
1228 		if (bpf_peers_present(sc->sc_drvbpf)) {
1229 			struct rt2560_rx_radiotap_header *tap = &sc->sc_rxtap;
1230 			uint32_t tsf_lo, tsf_hi;
1231 
1232 			/* get timestamp (low and high 32 bits) */
1233 			tsf_hi = RAL_READ(sc, RT2560_CSR17);
1234 			tsf_lo = RAL_READ(sc, RT2560_CSR16);
1235 
1236 			tap->wr_tsf =
1237 			    htole64(((uint64_t)tsf_hi << 32) | tsf_lo);
1238 			tap->wr_flags = 0;
1239 			tap->wr_rate = rt2560_rxrate(desc);
1240 			tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
1241 			tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
1242 			tap->wr_antenna = sc->rx_ant;
1243 			tap->wr_antsignal = desc->rssi;
1244 
1245 			bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_rxtap_len, m);
1246 		}
1247 
1248 		wh = mtod(m, struct ieee80211_frame *);
1249 		ni = ieee80211_find_rxnode(ic,
1250 		    (struct ieee80211_frame_min *)wh);
1251 
1252 		/* send the frame to the 802.11 layer */
1253 		ieee80211_input(ic, m, ni, desc->rssi, 0);
1254 
1255 		/* give rssi to the rate adatation algorithm */
1256 		rn = (struct rt2560_node *)ni;
1257 		ral_rssadapt_input(ic, ni, &rn->rssadapt, desc->rssi);
1258 
1259 		/* node is no longer needed */
1260 		ieee80211_free_node(ni);
1261 
1262 skip:		desc->flags = htole32(RT2560_RX_BUSY);
1263 
1264 		DPRINTFN(15, ("decryption done idx=%u\n", sc->rxq.cur_decrypt));
1265 
1266 		sc->rxq.cur_decrypt =
1267 		    (sc->rxq.cur_decrypt + 1) % RT2560_RX_RING_COUNT;
1268 	}
1269 
1270 	bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
1271 	    BUS_DMASYNC_PREWRITE);
1272 }
1273 
1274 /*
1275  * Some frames were received. Pass them to the hardware cipher engine before
1276  * sending them to the 802.11 layer.
1277  */
1278 static void
1279 rt2560_rx_intr(struct rt2560_softc *sc)
1280 {
1281 	struct rt2560_rx_desc *desc;
1282 	struct rt2560_rx_data *data;
1283 
1284 	bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
1285 	    BUS_DMASYNC_POSTREAD);
1286 
1287 	for (;;) {
1288 		desc = &sc->rxq.desc[sc->rxq.cur];
1289 		data = &sc->rxq.data[sc->rxq.cur];
1290 
1291 		if ((le32toh(desc->flags) & RT2560_RX_BUSY) ||
1292 		    (le32toh(desc->flags) & RT2560_RX_CIPHER_BUSY))
1293 			break;
1294 
1295 		data->drop = 0;
1296 
1297 		if ((le32toh(desc->flags) & RT2560_RX_PHY_ERROR) ||
1298 		    (le32toh(desc->flags) & RT2560_RX_CRC_ERROR)) {
1299 			/*
1300 			 * This should not happen since we did not request
1301 			 * to receive those frames when we filled RXCSR0.
1302 			 */
1303 			DPRINTFN(5, ("PHY or CRC error flags 0x%08x\n",
1304 			    le32toh(desc->flags)));
1305 			data->drop = 1;
1306 		}
1307 
1308 		if (((le32toh(desc->flags) >> 16) & 0xfff) > MCLBYTES) {
1309 			DPRINTFN(5, ("bad length\n"));
1310 			data->drop = 1;
1311 		}
1312 
1313 		/* mark the frame for decryption */
1314 		desc->flags |= htole32(RT2560_RX_CIPHER_BUSY);
1315 
1316 		DPRINTFN(15, ("rx done idx=%u\n", sc->rxq.cur));
1317 
1318 		sc->rxq.cur = (sc->rxq.cur + 1) % RT2560_RX_RING_COUNT;
1319 	}
1320 
1321 	bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
1322 	    BUS_DMASYNC_PREWRITE);
1323 
1324 	/* kick decrypt */
1325 	RAL_WRITE(sc, RT2560_SECCSR0, RT2560_KICK_DECRYPT);
1326 }
1327 
1328 /*
1329  * This function is called periodically in IBSS mode when a new beacon must be
1330  * sent out.
1331  */
1332 static void
1333 rt2560_beacon_expire(struct rt2560_softc *sc)
1334 {
1335 	struct ieee80211com *ic = &sc->sc_ic;
1336 	struct rt2560_tx_data *data;
1337 
1338 	if (ic->ic_opmode != IEEE80211_M_IBSS &&
1339 	    ic->ic_opmode != IEEE80211_M_HOSTAP)
1340 		return;
1341 
1342 	data = &sc->bcnq.data[sc->bcnq.next];
1343 
1344 	bus_dmamap_sync(sc->bcnq.data_dmat, data->map, BUS_DMASYNC_POSTWRITE);
1345 	bus_dmamap_unload(sc->bcnq.data_dmat, data->map);
1346 
1347 	ieee80211_beacon_update(ic, data->ni, &sc->sc_bo, data->m, 1);
1348 
1349 	if (bpf_peers_present(ic->ic_rawbpf))
1350 		bpf_mtap(ic->ic_rawbpf, data->m);
1351 
1352 	rt2560_tx_bcn(sc, data->m, data->ni);
1353 
1354 	DPRINTFN(15, ("beacon expired\n"));
1355 
1356 	sc->bcnq.next = (sc->bcnq.next + 1) % RT2560_BEACON_RING_COUNT;
1357 }
1358 
1359 /* ARGSUSED */
1360 static void
1361 rt2560_wakeup_expire(struct rt2560_softc *sc)
1362 {
1363 	DPRINTFN(2, ("wakeup expired\n"));
1364 }
1365 
1366 void
1367 rt2560_intr(void *arg)
1368 {
1369 	struct rt2560_softc *sc = arg;
1370 	struct ifnet *ifp = sc->sc_ifp;
1371 	uint32_t r;
1372 
1373 	RAL_LOCK(sc);
1374 
1375 	/* disable interrupts */
1376 	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
1377 
1378 	/* don't re-enable interrupts if we're shutting down */
1379 	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
1380 		RAL_UNLOCK(sc);
1381 		return;
1382 	}
1383 
1384 	r = RAL_READ(sc, RT2560_CSR7);
1385 	RAL_WRITE(sc, RT2560_CSR7, r);
1386 
1387 	if (r & RT2560_BEACON_EXPIRE)
1388 		rt2560_beacon_expire(sc);
1389 
1390 	if (r & RT2560_WAKEUP_EXPIRE)
1391 		rt2560_wakeup_expire(sc);
1392 
1393 	if (r & RT2560_ENCRYPTION_DONE)
1394 		rt2560_encryption_intr(sc);
1395 
1396 	if (r & RT2560_TX_DONE)
1397 		rt2560_tx_intr(sc);
1398 
1399 	if (r & RT2560_PRIO_DONE)
1400 		rt2560_prio_intr(sc);
1401 
1402 	if (r & RT2560_DECRYPTION_DONE)
1403 		rt2560_decryption_intr(sc);
1404 
1405 	if (r & RT2560_RX_DONE)
1406 		rt2560_rx_intr(sc);
1407 
1408 	/* re-enable interrupts */
1409 	RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
1410 
1411 	RAL_UNLOCK(sc);
1412 }
1413 
1414 /* quickly determine if a given rate is CCK or OFDM */
1415 #define RAL_RATE_IS_OFDM(rate) ((rate) >= 12 && (rate) != 22)
1416 
1417 #define RAL_ACK_SIZE	14	/* 10 + 4(FCS) */
1418 #define RAL_CTS_SIZE	14	/* 10 + 4(FCS) */
1419 
1420 #define RAL_SIFS		10	/* us */
1421 
1422 #define RT2560_TXRX_TURNAROUND	10	/* us */
1423 
1424 /*
1425  * This function is only used by the Rx radiotap code.
1426  */
1427 static uint8_t
1428 rt2560_rxrate(struct rt2560_rx_desc *desc)
1429 {
1430 	if (le32toh(desc->flags) & RT2560_RX_OFDM) {
1431 		/* reverse function of rt2560_plcp_signal */
1432 		switch (desc->rate) {
1433 		case 0xb:	return 12;
1434 		case 0xf:	return 18;
1435 		case 0xa:	return 24;
1436 		case 0xe:	return 36;
1437 		case 0x9:	return 48;
1438 		case 0xd:	return 72;
1439 		case 0x8:	return 96;
1440 		case 0xc:	return 108;
1441 		}
1442 	} else {
1443 		if (desc->rate == 10)
1444 			return 2;
1445 		if (desc->rate == 20)
1446 			return 4;
1447 		if (desc->rate == 55)
1448 			return 11;
1449 		if (desc->rate == 110)
1450 			return 22;
1451 	}
1452 	return 2;	/* should not get there */
1453 }
1454 
1455 /*
1456  * Return the expected ack rate for a frame transmitted at rate `rate'.
1457  * XXX: this should depend on the destination node basic rate set.
1458  */
1459 static int
1460 rt2560_ack_rate(struct ieee80211com *ic, int rate)
1461 {
1462 	switch (rate) {
1463 	/* CCK rates */
1464 	case 2:
1465 		return 2;
1466 	case 4:
1467 	case 11:
1468 	case 22:
1469 		return (ic->ic_curmode == IEEE80211_MODE_11B) ? 4 : rate;
1470 
1471 	/* OFDM rates */
1472 	case 12:
1473 	case 18:
1474 		return 12;
1475 	case 24:
1476 	case 36:
1477 		return 24;
1478 	case 48:
1479 	case 72:
1480 	case 96:
1481 	case 108:
1482 		return 48;
1483 	}
1484 
1485 	/* default to 1Mbps */
1486 	return 2;
1487 }
1488 
1489 /*
1490  * Compute the duration (in us) needed to transmit `len' bytes at rate `rate'.
1491  * The function automatically determines the operating mode depending on the
1492  * given rate. `flags' indicates whether short preamble is in use or not.
1493  */
1494 static uint16_t
1495 rt2560_txtime(int len, int rate, uint32_t flags)
1496 {
1497 	uint16_t txtime;
1498 
1499 	if (RAL_RATE_IS_OFDM(rate)) {
1500 		/* IEEE Std 802.11a-1999, pp. 37 */
1501 		txtime = (8 + 4 * len + 3 + rate - 1) / rate;
1502 		txtime = 16 + 4 + 4 * txtime + 6;
1503 	} else {
1504 		/* IEEE Std 802.11b-1999, pp. 28 */
1505 		txtime = (16 * len + rate - 1) / rate;
1506 		if (rate != 2 && (flags & IEEE80211_F_SHPREAMBLE))
1507 			txtime +=  72 + 24;
1508 		else
1509 			txtime += 144 + 48;
1510 	}
1511 
1512 	return txtime;
1513 }
1514 
1515 static uint8_t
1516 rt2560_plcp_signal(int rate)
1517 {
1518 	switch (rate) {
1519 	/* CCK rates (returned values are device-dependent) */
1520 	case 2:		return 0x0;
1521 	case 4:		return 0x1;
1522 	case 11:	return 0x2;
1523 	case 22:	return 0x3;
1524 
1525 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1526 	case 12:	return 0xb;
1527 	case 18:	return 0xf;
1528 	case 24:	return 0xa;
1529 	case 36:	return 0xe;
1530 	case 48:	return 0x9;
1531 	case 72:	return 0xd;
1532 	case 96:	return 0x8;
1533 	case 108:	return 0xc;
1534 
1535 	/* unsupported rates (should not get there) */
1536 	default:	return 0xff;
1537 	}
1538 }
1539 
1540 static void
1541 rt2560_setup_tx_desc(struct rt2560_softc *sc, struct rt2560_tx_desc *desc,
1542     uint32_t flags, int len, int rate, int encrypt, bus_addr_t physaddr)
1543 {
1544 	struct ieee80211com *ic = &sc->sc_ic;
1545 	uint16_t plcp_length;
1546 	int remainder;
1547 
1548 	desc->flags = htole32(flags);
1549 	desc->flags |= htole32(len << 16);
1550 	desc->flags |= encrypt ? htole32(RT2560_TX_CIPHER_BUSY) :
1551 	    htole32(RT2560_TX_BUSY | RT2560_TX_VALID);
1552 
1553 	desc->physaddr = htole32(physaddr);
1554 	desc->wme = htole16(
1555 	    RT2560_AIFSN(2) |
1556 	    RT2560_LOGCWMIN(3) |
1557 	    RT2560_LOGCWMAX(8));
1558 
1559 	/* setup PLCP fields */
1560 	desc->plcp_signal  = rt2560_plcp_signal(rate);
1561 	desc->plcp_service = 4;
1562 
1563 	len += IEEE80211_CRC_LEN;
1564 	if (RAL_RATE_IS_OFDM(rate)) {
1565 		desc->flags |= htole32(RT2560_TX_OFDM);
1566 
1567 		plcp_length = len & 0xfff;
1568 		desc->plcp_length_hi = plcp_length >> 6;
1569 		desc->plcp_length_lo = plcp_length & 0x3f;
1570 	} else {
1571 		plcp_length = (16 * len + rate - 1) / rate;
1572 		if (rate == 22) {
1573 			remainder = (16 * len) % 22;
1574 			if (remainder != 0 && remainder < 7)
1575 				desc->plcp_service |= RT2560_PLCP_LENGEXT;
1576 		}
1577 		desc->plcp_length_hi = plcp_length >> 8;
1578 		desc->plcp_length_lo = plcp_length & 0xff;
1579 
1580 		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1581 			desc->plcp_signal |= 0x08;
1582 	}
1583 }
1584 
1585 static int
1586 rt2560_tx_bcn(struct rt2560_softc *sc, struct mbuf *m0,
1587     struct ieee80211_node *ni)
1588 {
1589 	struct ieee80211com *ic = &sc->sc_ic;
1590 	struct rt2560_tx_desc *desc;
1591 	struct rt2560_tx_data *data;
1592 	bus_dma_segment_t segs[RT2560_MAX_SCATTER];
1593 	int nsegs, rate, error;
1594 
1595 	desc = &sc->bcnq.desc[sc->bcnq.cur];
1596 	data = &sc->bcnq.data[sc->bcnq.cur];
1597 
1598 	rate = IEEE80211_IS_CHAN_5GHZ(ni->ni_chan) ? 12 : 2;
1599 
1600 	error = bus_dmamap_load_mbuf_sg(sc->bcnq.data_dmat, data->map, m0,
1601 	    segs, &nsegs, BUS_DMA_NOWAIT);
1602 	if (error != 0) {
1603 		device_printf(sc->sc_dev, "could not map mbuf (error %d)\n",
1604 		    error);
1605 		m_freem(m0);
1606 		return error;
1607 	}
1608 
1609 	if (bpf_peers_present(sc->sc_drvbpf)) {
1610 		struct rt2560_tx_radiotap_header *tap = &sc->sc_txtap;
1611 
1612 		tap->wt_flags = 0;
1613 		tap->wt_rate = rate;
1614 		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1615 		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1616 		tap->wt_antenna = sc->tx_ant;
1617 
1618 		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m0);
1619 	}
1620 
1621 	data->m = m0;
1622 	data->ni = ni;
1623 
1624 	rt2560_setup_tx_desc(sc, desc, RT2560_TX_IFS_NEWBACKOFF |
1625 	    RT2560_TX_TIMESTAMP, m0->m_pkthdr.len, rate, 0, segs->ds_addr);
1626 
1627 	DPRINTFN(10, ("sending beacon frame len=%u idx=%u rate=%u\n",
1628 	    m0->m_pkthdr.len, sc->bcnq.cur, rate));
1629 
1630 	bus_dmamap_sync(sc->bcnq.data_dmat, data->map, BUS_DMASYNC_PREWRITE);
1631 	bus_dmamap_sync(sc->bcnq.desc_dmat, sc->bcnq.desc_map,
1632 	    BUS_DMASYNC_PREWRITE);
1633 
1634 	sc->bcnq.cur = (sc->bcnq.cur + 1) % RT2560_BEACON_RING_COUNT;
1635 
1636 	return 0;
1637 }
1638 
1639 static int
1640 rt2560_tx_mgt(struct rt2560_softc *sc, struct mbuf *m0,
1641     struct ieee80211_node *ni)
1642 {
1643 	struct ieee80211com *ic = &sc->sc_ic;
1644 	struct rt2560_tx_desc *desc;
1645 	struct rt2560_tx_data *data;
1646 	struct ieee80211_frame *wh;
1647 	bus_dma_segment_t segs[RT2560_MAX_SCATTER];
1648 	uint16_t dur;
1649 	uint32_t flags = 0;
1650 	int nsegs, rate, error;
1651 
1652 	desc = &sc->prioq.desc[sc->prioq.cur];
1653 	data = &sc->prioq.data[sc->prioq.cur];
1654 
1655 	rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
1656 
1657 	error = bus_dmamap_load_mbuf_sg(sc->prioq.data_dmat, data->map, m0,
1658 	    segs, &nsegs, 0);
1659 	if (error != 0) {
1660 		device_printf(sc->sc_dev, "could not map mbuf (error %d)\n",
1661 		    error);
1662 		m_freem(m0);
1663 		return error;
1664 	}
1665 
1666 	if (bpf_peers_present(sc->sc_drvbpf)) {
1667 		struct rt2560_tx_radiotap_header *tap = &sc->sc_txtap;
1668 
1669 		tap->wt_flags = 0;
1670 		tap->wt_rate = rate;
1671 		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1672 		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1673 		tap->wt_antenna = sc->tx_ant;
1674 
1675 		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m0);
1676 	}
1677 
1678 	data->m = m0;
1679 	data->ni = ni;
1680 
1681 	wh = mtod(m0, struct ieee80211_frame *);
1682 
1683 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1684 		flags |= RT2560_TX_ACK;
1685 
1686 		dur = rt2560_txtime(RAL_ACK_SIZE, rate, ic->ic_flags) +
1687 		      RAL_SIFS;
1688 		*(uint16_t *)wh->i_dur = htole16(dur);
1689 
1690 		/* tell hardware to add timestamp for probe responses */
1691 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1692 		    IEEE80211_FC0_TYPE_MGT &&
1693 		    (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1694 		    IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1695 			flags |= RT2560_TX_TIMESTAMP;
1696 	}
1697 
1698 	rt2560_setup_tx_desc(sc, desc, flags, m0->m_pkthdr.len, rate, 0,
1699 	    segs->ds_addr);
1700 
1701 	bus_dmamap_sync(sc->prioq.data_dmat, data->map, BUS_DMASYNC_PREWRITE);
1702 	bus_dmamap_sync(sc->prioq.desc_dmat, sc->prioq.desc_map,
1703 	    BUS_DMASYNC_PREWRITE);
1704 
1705 	DPRINTFN(10, ("sending mgt frame len=%u idx=%u rate=%u\n",
1706 	    m0->m_pkthdr.len, sc->prioq.cur, rate));
1707 
1708 	/* kick prio */
1709 	sc->prioq.queued++;
1710 	sc->prioq.cur = (sc->prioq.cur + 1) % RT2560_PRIO_RING_COUNT;
1711 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_PRIO);
1712 
1713 	return 0;
1714 }
1715 
1716 /*
1717  * Build a RTS control frame.
1718  */
1719 static struct mbuf *
1720 rt2560_get_rts(struct rt2560_softc *sc, struct ieee80211_frame *wh,
1721     uint16_t dur)
1722 {
1723 	struct ieee80211_frame_rts *rts;
1724 	struct mbuf *m;
1725 
1726 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1727 	if (m == NULL) {
1728 		sc->sc_ic.ic_stats.is_tx_nobuf++;
1729 		device_printf(sc->sc_dev, "could not allocate RTS frame\n");
1730 		return NULL;
1731 	}
1732 
1733 	rts = mtod(m, struct ieee80211_frame_rts *);
1734 
1735 	rts->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_CTL |
1736 	    IEEE80211_FC0_SUBTYPE_RTS;
1737 	rts->i_fc[1] = IEEE80211_FC1_DIR_NODS;
1738 	*(uint16_t *)rts->i_dur = htole16(dur);
1739 	IEEE80211_ADDR_COPY(rts->i_ra, wh->i_addr1);
1740 	IEEE80211_ADDR_COPY(rts->i_ta, wh->i_addr2);
1741 
1742 	m->m_pkthdr.len = m->m_len = sizeof (struct ieee80211_frame_rts);
1743 
1744 	return m;
1745 }
1746 
1747 static int
1748 rt2560_tx_data(struct rt2560_softc *sc, struct mbuf *m0,
1749     struct ieee80211_node *ni)
1750 {
1751 	struct ieee80211com *ic = &sc->sc_ic;
1752 	struct rt2560_tx_desc *desc;
1753 	struct rt2560_tx_data *data;
1754 	struct rt2560_node *rn;
1755 	struct ieee80211_rateset *rs;
1756 	struct ieee80211_frame *wh;
1757 	struct ieee80211_key *k;
1758 	struct mbuf *mnew;
1759 	bus_dma_segment_t segs[RT2560_MAX_SCATTER];
1760 	uint16_t dur;
1761 	uint32_t flags = 0;
1762 	int nsegs, rate, error;
1763 
1764 	wh = mtod(m0, struct ieee80211_frame *);
1765 
1766 	if (ic->ic_fixed_rate != IEEE80211_FIXED_RATE_NONE) {
1767 		rs = &ic->ic_sup_rates[ic->ic_curmode];
1768 		rate = rs->rs_rates[ic->ic_fixed_rate];
1769 	} else {
1770 		rs = &ni->ni_rates;
1771 		rn = (struct rt2560_node *)ni;
1772 		ni->ni_txrate = ral_rssadapt_choose(&rn->rssadapt, rs, wh,
1773 		    m0->m_pkthdr.len, NULL, 0);
1774 		rate = rs->rs_rates[ni->ni_txrate];
1775 	}
1776 	rate &= IEEE80211_RATE_VAL;
1777 
1778 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1779 		k = ieee80211_crypto_encap(ic, ni, m0);
1780 		if (k == NULL) {
1781 			m_freem(m0);
1782 			return ENOBUFS;
1783 		}
1784 
1785 		/* packet header may have moved, reset our local pointer */
1786 		wh = mtod(m0, struct ieee80211_frame *);
1787 	}
1788 
1789 	/*
1790 	 * IEEE Std 802.11-1999, pp 82: "A STA shall use an RTS/CTS exchange
1791 	 * for directed frames only when the length of the MPDU is greater
1792 	 * than the length threshold indicated by [...]" ic_rtsthreshold.
1793 	 */
1794 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1795 	    m0->m_pkthdr.len > ic->ic_rtsthreshold) {
1796 		struct mbuf *m;
1797 		uint16_t dur;
1798 		int rtsrate, ackrate;
1799 
1800 		rtsrate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
1801 		ackrate = rt2560_ack_rate(ic, rate);
1802 
1803 		dur = rt2560_txtime(m0->m_pkthdr.len + 4, rate, ic->ic_flags) +
1804 		      rt2560_txtime(RAL_CTS_SIZE, rtsrate, ic->ic_flags) +
1805 		      rt2560_txtime(RAL_ACK_SIZE, ackrate, ic->ic_flags) +
1806 		      3 * RAL_SIFS;
1807 
1808 		m = rt2560_get_rts(sc, wh, dur);
1809 
1810 		desc = &sc->txq.desc[sc->txq.cur_encrypt];
1811 		data = &sc->txq.data[sc->txq.cur_encrypt];
1812 
1813 		error = bus_dmamap_load_mbuf_sg(sc->txq.data_dmat, data->map,
1814 		    m, segs, &nsegs, 0);
1815 		if (error != 0) {
1816 			device_printf(sc->sc_dev,
1817 			    "could not map mbuf (error %d)\n", error);
1818 			m_freem(m);
1819 			m_freem(m0);
1820 			return error;
1821 		}
1822 
1823 		/* avoid multiple free() of the same node for each fragment */
1824 		ieee80211_ref_node(ni);
1825 
1826 		data->m = m;
1827 		data->ni = ni;
1828 
1829 		/* RTS frames are not taken into account for rssadapt */
1830 		data->id.id_node = NULL;
1831 
1832 		rt2560_setup_tx_desc(sc, desc, RT2560_TX_ACK |
1833 		    RT2560_TX_MORE_FRAG, m->m_pkthdr.len, rtsrate, 1,
1834 		    segs->ds_addr);
1835 
1836 		bus_dmamap_sync(sc->txq.data_dmat, data->map,
1837 		    BUS_DMASYNC_PREWRITE);
1838 
1839 		sc->txq.queued++;
1840 		sc->txq.cur_encrypt =
1841 		    (sc->txq.cur_encrypt + 1) % RT2560_TX_RING_COUNT;
1842 
1843 		/*
1844 		 * IEEE Std 802.11-1999: when an RTS/CTS exchange is used, the
1845 		 * asynchronous data frame shall be transmitted after the CTS
1846 		 * frame and a SIFS period.
1847 		 */
1848 		flags |= RT2560_TX_LONG_RETRY | RT2560_TX_IFS_SIFS;
1849 	}
1850 
1851 	data = &sc->txq.data[sc->txq.cur_encrypt];
1852 	desc = &sc->txq.desc[sc->txq.cur_encrypt];
1853 
1854 	error = bus_dmamap_load_mbuf_sg(sc->txq.data_dmat, data->map, m0,
1855 	    segs, &nsegs, 0);
1856 	if (error != 0 && error != EFBIG) {
1857 		device_printf(sc->sc_dev, "could not map mbuf (error %d)\n",
1858 		    error);
1859 		m_freem(m0);
1860 		return error;
1861 	}
1862 	if (error != 0) {
1863 		mnew = m_defrag(m0, M_DONTWAIT);
1864 		if (mnew == NULL) {
1865 			device_printf(sc->sc_dev,
1866 			    "could not defragment mbuf\n");
1867 			m_freem(m0);
1868 			return ENOBUFS;
1869 		}
1870 		m0 = mnew;
1871 
1872 		error = bus_dmamap_load_mbuf_sg(sc->txq.data_dmat, data->map,
1873 		    m0, segs, &nsegs, 0);
1874 		if (error != 0) {
1875 			device_printf(sc->sc_dev,
1876 			    "could not map mbuf (error %d)\n", error);
1877 			m_freem(m0);
1878 			return error;
1879 		}
1880 
1881 		/* packet header may have moved, reset our local pointer */
1882 		wh = mtod(m0, struct ieee80211_frame *);
1883 	}
1884 
1885 	if (bpf_peers_present(sc->sc_drvbpf)) {
1886 		struct rt2560_tx_radiotap_header *tap = &sc->sc_txtap;
1887 
1888 		tap->wt_flags = 0;
1889 		tap->wt_rate = rate;
1890 		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1891 		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1892 		tap->wt_antenna = sc->tx_ant;
1893 
1894 		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m0);
1895 	}
1896 
1897 	data->m = m0;
1898 	data->ni = ni;
1899 
1900 	/* remember link conditions for rate adaptation algorithm */
1901 	if (ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE) {
1902 		data->id.id_len = m0->m_pkthdr.len;
1903 		data->id.id_rateidx = ni->ni_txrate;
1904 		data->id.id_node = ni;
1905 		data->id.id_rssi = ni->ni_rssi;
1906 	} else
1907 		data->id.id_node = NULL;
1908 
1909 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1910 		flags |= RT2560_TX_ACK;
1911 
1912 		dur = rt2560_txtime(RAL_ACK_SIZE, rt2560_ack_rate(ic, rate),
1913 		    ic->ic_flags) + RAL_SIFS;
1914 		*(uint16_t *)wh->i_dur = htole16(dur);
1915 	}
1916 
1917 	rt2560_setup_tx_desc(sc, desc, flags, m0->m_pkthdr.len, rate, 1,
1918 	    segs->ds_addr);
1919 
1920 	bus_dmamap_sync(sc->txq.data_dmat, data->map, BUS_DMASYNC_PREWRITE);
1921 	bus_dmamap_sync(sc->txq.desc_dmat, sc->txq.desc_map,
1922 	    BUS_DMASYNC_PREWRITE);
1923 
1924 	DPRINTFN(10, ("sending data frame len=%u idx=%u rate=%u\n",
1925 	    m0->m_pkthdr.len, sc->txq.cur_encrypt, rate));
1926 
1927 	/* kick encrypt */
1928 	sc->txq.queued++;
1929 	sc->txq.cur_encrypt = (sc->txq.cur_encrypt + 1) % RT2560_TX_RING_COUNT;
1930 	RAL_WRITE(sc, RT2560_SECCSR1, RT2560_KICK_ENCRYPT);
1931 
1932 	return 0;
1933 }
1934 
1935 static void
1936 rt2560_start(struct ifnet *ifp)
1937 {
1938 	struct rt2560_softc *sc = ifp->if_softc;
1939 	struct ieee80211com *ic = &sc->sc_ic;
1940 	struct mbuf *m0;
1941 	struct ether_header *eh;
1942 	struct ieee80211_node *ni;
1943 
1944 	RAL_LOCK(sc);
1945 
1946 	/* prevent management frames from being sent if we're not ready */
1947 	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
1948 		RAL_UNLOCK(sc);
1949 		return;
1950 	}
1951 
1952 	for (;;) {
1953 		IF_POLL(&ic->ic_mgtq, m0);
1954 		if (m0 != NULL) {
1955 			if (sc->prioq.queued >= RT2560_PRIO_RING_COUNT) {
1956 				ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1957 				break;
1958 			}
1959 			IF_DEQUEUE(&ic->ic_mgtq, m0);
1960 
1961 			ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
1962 			m0->m_pkthdr.rcvif = NULL;
1963 
1964 			if (bpf_peers_present(ic->ic_rawbpf))
1965 				bpf_mtap(ic->ic_rawbpf, m0);
1966 
1967 			if (rt2560_tx_mgt(sc, m0, ni) != 0)
1968 				break;
1969 
1970 		} else {
1971 			if (ic->ic_state != IEEE80211_S_RUN)
1972 				break;
1973 			IFQ_DRV_DEQUEUE(&ifp->if_snd, m0);
1974 			if (m0 == NULL)
1975 				break;
1976 			if (sc->txq.queued >= RT2560_TX_RING_COUNT - 1) {
1977 				IFQ_DRV_PREPEND(&ifp->if_snd, m0);
1978 				ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1979 				break;
1980 			}
1981 
1982 			if (m0->m_len < sizeof (struct ether_header) &&
1983 			    !(m0 = m_pullup(m0, sizeof (struct ether_header))))
1984 				continue;
1985 
1986 			eh = mtod(m0, struct ether_header *);
1987 			ni = ieee80211_find_txnode(ic, eh->ether_dhost);
1988 			if (ni == NULL) {
1989 				m_freem(m0);
1990 				continue;
1991 			}
1992 			BPF_MTAP(ifp, m0);
1993 
1994 			m0 = ieee80211_encap(ic, m0, ni);
1995 			if (m0 == NULL) {
1996 				ieee80211_free_node(ni);
1997 				continue;
1998 			}
1999 
2000 			if (bpf_peers_present(ic->ic_rawbpf))
2001 				bpf_mtap(ic->ic_rawbpf, m0);
2002 
2003 			if (rt2560_tx_data(sc, m0, ni) != 0) {
2004 				ieee80211_free_node(ni);
2005 				ifp->if_oerrors++;
2006 				break;
2007 			}
2008 		}
2009 
2010 		sc->sc_tx_timer = 5;
2011 		ifp->if_timer = 1;
2012 	}
2013 
2014 	RAL_UNLOCK(sc);
2015 }
2016 
2017 static void
2018 rt2560_watchdog(struct ifnet *ifp)
2019 {
2020 	struct rt2560_softc *sc = ifp->if_softc;
2021 	struct ieee80211com *ic = &sc->sc_ic;
2022 
2023 	RAL_LOCK(sc);
2024 
2025 	ifp->if_timer = 0;
2026 
2027 	if (sc->sc_tx_timer > 0) {
2028 		if (--sc->sc_tx_timer == 0) {
2029 			device_printf(sc->sc_dev, "device timeout\n");
2030 			rt2560_init(sc);
2031 			ifp->if_oerrors++;
2032 			RAL_UNLOCK(sc);
2033 			return;
2034 		}
2035 		ifp->if_timer = 1;
2036 	}
2037 
2038 	ieee80211_watchdog(ic);
2039 
2040 	RAL_UNLOCK(sc);
2041 }
2042 
2043 /*
2044  * This function allows for fast channel switching in monitor mode (used by
2045  * net-mgmt/kismet). In IBSS mode, we must explicitly reset the interface to
2046  * generate a new beacon frame.
2047  */
2048 static int
2049 rt2560_reset(struct ifnet *ifp)
2050 {
2051 	struct rt2560_softc *sc = ifp->if_softc;
2052 	struct ieee80211com *ic = &sc->sc_ic;
2053 
2054 	if (ic->ic_opmode != IEEE80211_M_MONITOR)
2055 		return ENETRESET;
2056 
2057 	rt2560_set_chan(sc, ic->ic_curchan);
2058 
2059 	return 0;
2060 }
2061 
2062 static int
2063 rt2560_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
2064 {
2065 	struct rt2560_softc *sc = ifp->if_softc;
2066 	struct ieee80211com *ic = &sc->sc_ic;
2067 	int error = 0;
2068 
2069 	RAL_LOCK(sc);
2070 
2071 	switch (cmd) {
2072 	case SIOCSIFFLAGS:
2073 		if (ifp->if_flags & IFF_UP) {
2074 			if (ifp->if_drv_flags & IFF_DRV_RUNNING)
2075 				rt2560_update_promisc(sc);
2076 			else
2077 				rt2560_init(sc);
2078 		} else {
2079 			if (ifp->if_drv_flags & IFF_DRV_RUNNING)
2080 				rt2560_stop(sc);
2081 		}
2082 		break;
2083 
2084 	default:
2085 		error = ieee80211_ioctl(ic, cmd, data);
2086 	}
2087 
2088 	if (error == ENETRESET) {
2089 		if ((ifp->if_flags & IFF_UP) &&
2090 		    (ifp->if_drv_flags & IFF_DRV_RUNNING) &&
2091 		    (ic->ic_roaming != IEEE80211_ROAMING_MANUAL))
2092 			rt2560_init(sc);
2093 		error = 0;
2094 	}
2095 
2096 	RAL_UNLOCK(sc);
2097 
2098 	return error;
2099 }
2100 
2101 static void
2102 rt2560_bbp_write(struct rt2560_softc *sc, uint8_t reg, uint8_t val)
2103 {
2104 	uint32_t tmp;
2105 	int ntries;
2106 
2107 	for (ntries = 0; ntries < 100; ntries++) {
2108 		if (!(RAL_READ(sc, RT2560_BBPCSR) & RT2560_BBP_BUSY))
2109 			break;
2110 		DELAY(1);
2111 	}
2112 	if (ntries == 100) {
2113 		device_printf(sc->sc_dev, "could not write to BBP\n");
2114 		return;
2115 	}
2116 
2117 	tmp = RT2560_BBP_WRITE | RT2560_BBP_BUSY | reg << 8 | val;
2118 	RAL_WRITE(sc, RT2560_BBPCSR, tmp);
2119 
2120 	DPRINTFN(15, ("BBP R%u <- 0x%02x\n", reg, val));
2121 }
2122 
2123 static uint8_t
2124 rt2560_bbp_read(struct rt2560_softc *sc, uint8_t reg)
2125 {
2126 	uint32_t val;
2127 	int ntries;
2128 
2129 	val = RT2560_BBP_BUSY | reg << 8;
2130 	RAL_WRITE(sc, RT2560_BBPCSR, val);
2131 
2132 	for (ntries = 0; ntries < 100; ntries++) {
2133 		val = RAL_READ(sc, RT2560_BBPCSR);
2134 		if (!(val & RT2560_BBP_BUSY))
2135 			return val & 0xff;
2136 		DELAY(1);
2137 	}
2138 
2139 	device_printf(sc->sc_dev, "could not read from BBP\n");
2140 	return 0;
2141 }
2142 
2143 static void
2144 rt2560_rf_write(struct rt2560_softc *sc, uint8_t reg, uint32_t val)
2145 {
2146 	uint32_t tmp;
2147 	int ntries;
2148 
2149 	for (ntries = 0; ntries < 100; ntries++) {
2150 		if (!(RAL_READ(sc, RT2560_RFCSR) & RT2560_RF_BUSY))
2151 			break;
2152 		DELAY(1);
2153 	}
2154 	if (ntries == 100) {
2155 		device_printf(sc->sc_dev, "could not write to RF\n");
2156 		return;
2157 	}
2158 
2159 	tmp = RT2560_RF_BUSY | RT2560_RF_20BIT | (val & 0xfffff) << 2 |
2160 	    (reg & 0x3);
2161 	RAL_WRITE(sc, RT2560_RFCSR, tmp);
2162 
2163 	/* remember last written value in sc */
2164 	sc->rf_regs[reg] = val;
2165 
2166 	DPRINTFN(15, ("RF R[%u] <- 0x%05x\n", reg & 0x3, val & 0xfffff));
2167 }
2168 
2169 static void
2170 rt2560_set_chan(struct rt2560_softc *sc, struct ieee80211_channel *c)
2171 {
2172 	struct ieee80211com *ic = &sc->sc_ic;
2173 	uint8_t power, tmp;
2174 	u_int i, chan;
2175 
2176 	chan = ieee80211_chan2ieee(ic, c);
2177 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
2178 		return;
2179 
2180 	if (IEEE80211_IS_CHAN_2GHZ(c))
2181 		power = min(sc->txpow[chan - 1], 31);
2182 	else
2183 		power = 31;
2184 
2185 	/* adjust txpower using ifconfig settings */
2186 	power -= (100 - ic->ic_txpowlimit) / 8;
2187 
2188 	DPRINTFN(2, ("setting channel to %u, txpower to %u\n", chan, power));
2189 
2190 	switch (sc->rf_rev) {
2191 	case RT2560_RF_2522:
2192 		rt2560_rf_write(sc, RAL_RF1, 0x00814);
2193 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2522_r2[chan - 1]);
2194 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
2195 		break;
2196 
2197 	case RT2560_RF_2523:
2198 		rt2560_rf_write(sc, RAL_RF1, 0x08804);
2199 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2523_r2[chan - 1]);
2200 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x38044);
2201 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
2202 		break;
2203 
2204 	case RT2560_RF_2524:
2205 		rt2560_rf_write(sc, RAL_RF1, 0x0c808);
2206 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2524_r2[chan - 1]);
2207 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
2208 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
2209 		break;
2210 
2211 	case RT2560_RF_2525:
2212 		rt2560_rf_write(sc, RAL_RF1, 0x08808);
2213 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525_hi_r2[chan - 1]);
2214 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
2215 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
2216 
2217 		rt2560_rf_write(sc, RAL_RF1, 0x08808);
2218 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525_r2[chan - 1]);
2219 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
2220 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
2221 		break;
2222 
2223 	case RT2560_RF_2525E:
2224 		rt2560_rf_write(sc, RAL_RF1, 0x08808);
2225 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525e_r2[chan - 1]);
2226 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
2227 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00286 : 0x00282);
2228 		break;
2229 
2230 	case RT2560_RF_2526:
2231 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2526_hi_r2[chan - 1]);
2232 		rt2560_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
2233 		rt2560_rf_write(sc, RAL_RF1, 0x08804);
2234 
2235 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2526_r2[chan - 1]);
2236 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
2237 		rt2560_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
2238 		break;
2239 
2240 	/* dual-band RF */
2241 	case RT2560_RF_5222:
2242 		for (i = 0; rt2560_rf5222[i].chan != chan; i++);
2243 
2244 		rt2560_rf_write(sc, RAL_RF1, rt2560_rf5222[i].r1);
2245 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf5222[i].r2);
2246 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
2247 		rt2560_rf_write(sc, RAL_RF4, rt2560_rf5222[i].r4);
2248 		break;
2249 	}
2250 
2251 	if (ic->ic_state != IEEE80211_S_SCAN) {
2252 		/* set Japan filter bit for channel 14 */
2253 		tmp = rt2560_bbp_read(sc, 70);
2254 
2255 		tmp &= ~RT2560_JAPAN_FILTER;
2256 		if (chan == 14)
2257 			tmp |= RT2560_JAPAN_FILTER;
2258 
2259 		rt2560_bbp_write(sc, 70, tmp);
2260 
2261 		/* clear CRC errors */
2262 		RAL_READ(sc, RT2560_CNT0);
2263 	}
2264 }
2265 
2266 #if 0
2267 /*
2268  * Disable RF auto-tuning.
2269  */
2270 static void
2271 rt2560_disable_rf_tune(struct rt2560_softc *sc)
2272 {
2273 	uint32_t tmp;
2274 
2275 	if (sc->rf_rev != RT2560_RF_2523) {
2276 		tmp = sc->rf_regs[RAL_RF1] & ~RAL_RF1_AUTOTUNE;
2277 		rt2560_rf_write(sc, RAL_RF1, tmp);
2278 	}
2279 
2280 	tmp = sc->rf_regs[RAL_RF3] & ~RAL_RF3_AUTOTUNE;
2281 	rt2560_rf_write(sc, RAL_RF3, tmp);
2282 
2283 	DPRINTFN(2, ("disabling RF autotune\n"));
2284 }
2285 #endif
2286 
2287 /*
2288  * Refer to IEEE Std 802.11-1999 pp. 123 for more information on TSF
2289  * synchronization.
2290  */
2291 static void
2292 rt2560_enable_tsf_sync(struct rt2560_softc *sc)
2293 {
2294 	struct ieee80211com *ic = &sc->sc_ic;
2295 	uint16_t logcwmin, preload;
2296 	uint32_t tmp;
2297 
2298 	/* first, disable TSF synchronization */
2299 	RAL_WRITE(sc, RT2560_CSR14, 0);
2300 
2301 	tmp = 16 * ic->ic_bss->ni_intval;
2302 	RAL_WRITE(sc, RT2560_CSR12, tmp);
2303 
2304 	RAL_WRITE(sc, RT2560_CSR13, 0);
2305 
2306 	logcwmin = 5;
2307 	preload = (ic->ic_opmode == IEEE80211_M_STA) ? 384 : 1024;
2308 	tmp = logcwmin << 16 | preload;
2309 	RAL_WRITE(sc, RT2560_BCNOCSR, tmp);
2310 
2311 	/* finally, enable TSF synchronization */
2312 	tmp = RT2560_ENABLE_TSF | RT2560_ENABLE_TBCN;
2313 	if (ic->ic_opmode == IEEE80211_M_STA)
2314 		tmp |= RT2560_ENABLE_TSF_SYNC(1);
2315 	else
2316 		tmp |= RT2560_ENABLE_TSF_SYNC(2) |
2317 		       RT2560_ENABLE_BEACON_GENERATOR;
2318 	RAL_WRITE(sc, RT2560_CSR14, tmp);
2319 
2320 	DPRINTF(("enabling TSF synchronization\n"));
2321 }
2322 
2323 static void
2324 rt2560_update_plcp(struct rt2560_softc *sc)
2325 {
2326 	struct ieee80211com *ic = &sc->sc_ic;
2327 
2328 	/* no short preamble for 1Mbps */
2329 	RAL_WRITE(sc, RT2560_PLCP1MCSR, 0x00700400);
2330 
2331 	if (!(ic->ic_flags & IEEE80211_F_SHPREAMBLE)) {
2332 		/* values taken from the reference driver */
2333 		RAL_WRITE(sc, RT2560_PLCP2MCSR,   0x00380401);
2334 		RAL_WRITE(sc, RT2560_PLCP5p5MCSR, 0x00150402);
2335 		RAL_WRITE(sc, RT2560_PLCP11MCSR,  0x000b8403);
2336 	} else {
2337 		/* same values as above or'ed 0x8 */
2338 		RAL_WRITE(sc, RT2560_PLCP2MCSR,   0x00380409);
2339 		RAL_WRITE(sc, RT2560_PLCP5p5MCSR, 0x0015040a);
2340 		RAL_WRITE(sc, RT2560_PLCP11MCSR,  0x000b840b);
2341 	}
2342 
2343 	DPRINTF(("updating PLCP for %s preamble\n",
2344 	    (ic->ic_flags & IEEE80211_F_SHPREAMBLE) ? "short" : "long"));
2345 }
2346 
2347 /*
2348  * This function can be called by ieee80211_set_shortslottime(). Refer to
2349  * IEEE Std 802.11-1999 pp. 85 to know how these values are computed.
2350  */
2351 static void
2352 rt2560_update_slot(struct ifnet *ifp)
2353 {
2354 	struct rt2560_softc *sc = ifp->if_softc;
2355 	struct ieee80211com *ic = &sc->sc_ic;
2356 	uint8_t slottime;
2357 	uint16_t tx_sifs, tx_pifs, tx_difs, eifs;
2358 	uint32_t tmp;
2359 
2360 	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
2361 
2362 	/* update the MAC slot boundaries */
2363 	tx_sifs = RAL_SIFS - RT2560_TXRX_TURNAROUND;
2364 	tx_pifs = tx_sifs + slottime;
2365 	tx_difs = tx_sifs + 2 * slottime;
2366 	eifs = (ic->ic_curmode == IEEE80211_MODE_11B) ? 364 : 60;
2367 
2368 	tmp = RAL_READ(sc, RT2560_CSR11);
2369 	tmp = (tmp & ~0x1f00) | slottime << 8;
2370 	RAL_WRITE(sc, RT2560_CSR11, tmp);
2371 
2372 	tmp = tx_pifs << 16 | tx_sifs;
2373 	RAL_WRITE(sc, RT2560_CSR18, tmp);
2374 
2375 	tmp = eifs << 16 | tx_difs;
2376 	RAL_WRITE(sc, RT2560_CSR19, tmp);
2377 
2378 	DPRINTF(("setting slottime to %uus\n", slottime));
2379 }
2380 
2381 static void
2382 rt2560_set_basicrates(struct rt2560_softc *sc)
2383 {
2384 	struct ieee80211com *ic = &sc->sc_ic;
2385 
2386 	/* update basic rate set */
2387 	if (ic->ic_curmode == IEEE80211_MODE_11B) {
2388 		/* 11b basic rates: 1, 2Mbps */
2389 		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x3);
2390 	} else if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan)) {
2391 		/* 11a basic rates: 6, 12, 24Mbps */
2392 		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x150);
2393 	} else {
2394 		/* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
2395 		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x15f);
2396 	}
2397 }
2398 
2399 static void
2400 rt2560_update_led(struct rt2560_softc *sc, int led1, int led2)
2401 {
2402 	uint32_t tmp;
2403 
2404 	/* set ON period to 70ms and OFF period to 30ms */
2405 	tmp = led1 << 16 | led2 << 17 | 70 << 8 | 30;
2406 	RAL_WRITE(sc, RT2560_LEDCSR, tmp);
2407 }
2408 
2409 static void
2410 rt2560_set_bssid(struct rt2560_softc *sc, uint8_t *bssid)
2411 {
2412 	uint32_t tmp;
2413 
2414 	tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
2415 	RAL_WRITE(sc, RT2560_CSR5, tmp);
2416 
2417 	tmp = bssid[4] | bssid[5] << 8;
2418 	RAL_WRITE(sc, RT2560_CSR6, tmp);
2419 
2420 	DPRINTF(("setting BSSID to %6D\n", bssid, ":"));
2421 }
2422 
2423 static void
2424 rt2560_set_macaddr(struct rt2560_softc *sc, uint8_t *addr)
2425 {
2426 	uint32_t tmp;
2427 
2428 	tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
2429 	RAL_WRITE(sc, RT2560_CSR3, tmp);
2430 
2431 	tmp = addr[4] | addr[5] << 8;
2432 	RAL_WRITE(sc, RT2560_CSR4, tmp);
2433 
2434 	DPRINTF(("setting MAC address to %6D\n", addr, ":"));
2435 }
2436 
2437 static void
2438 rt2560_get_macaddr(struct rt2560_softc *sc, uint8_t *addr)
2439 {
2440 	uint32_t tmp;
2441 
2442 	tmp = RAL_READ(sc, RT2560_CSR3);
2443 	addr[0] = tmp & 0xff;
2444 	addr[1] = (tmp >>  8) & 0xff;
2445 	addr[2] = (tmp >> 16) & 0xff;
2446 	addr[3] = (tmp >> 24);
2447 
2448 	tmp = RAL_READ(sc, RT2560_CSR4);
2449 	addr[4] = tmp & 0xff;
2450 	addr[5] = (tmp >> 8) & 0xff;
2451 }
2452 
2453 static void
2454 rt2560_update_promisc(struct rt2560_softc *sc)
2455 {
2456 	struct ifnet *ifp = sc->sc_ic.ic_ifp;
2457 	uint32_t tmp;
2458 
2459 	tmp = RAL_READ(sc, RT2560_RXCSR0);
2460 
2461 	tmp &= ~RT2560_DROP_NOT_TO_ME;
2462 	if (!(ifp->if_flags & IFF_PROMISC))
2463 		tmp |= RT2560_DROP_NOT_TO_ME;
2464 
2465 	RAL_WRITE(sc, RT2560_RXCSR0, tmp);
2466 
2467 	DPRINTF(("%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
2468 	    "entering" : "leaving"));
2469 }
2470 
2471 static const char *
2472 rt2560_get_rf(int rev)
2473 {
2474 	switch (rev) {
2475 	case RT2560_RF_2522:	return "RT2522";
2476 	case RT2560_RF_2523:	return "RT2523";
2477 	case RT2560_RF_2524:	return "RT2524";
2478 	case RT2560_RF_2525:	return "RT2525";
2479 	case RT2560_RF_2525E:	return "RT2525e";
2480 	case RT2560_RF_2526:	return "RT2526";
2481 	case RT2560_RF_5222:	return "RT5222";
2482 	default:		return "unknown";
2483 	}
2484 }
2485 
2486 static void
2487 rt2560_read_eeprom(struct rt2560_softc *sc)
2488 {
2489 	uint16_t val;
2490 	int i;
2491 
2492 	val = rt2560_eeprom_read(sc, RT2560_EEPROM_CONFIG0);
2493 	sc->rf_rev =   (val >> 11) & 0x7;
2494 	sc->hw_radio = (val >> 10) & 0x1;
2495 	sc->led_mode = (val >> 6)  & 0x7;
2496 	sc->rx_ant =   (val >> 4)  & 0x3;
2497 	sc->tx_ant =   (val >> 2)  & 0x3;
2498 	sc->nb_ant =   val & 0x3;
2499 
2500 	/* read default values for BBP registers */
2501 	for (i = 0; i < 16; i++) {
2502 		val = rt2560_eeprom_read(sc, RT2560_EEPROM_BBP_BASE + i);
2503 		sc->bbp_prom[i].reg = val >> 8;
2504 		sc->bbp_prom[i].val = val & 0xff;
2505 	}
2506 
2507 	/* read Tx power for all b/g channels */
2508 	for (i = 0; i < 14 / 2; i++) {
2509 		val = rt2560_eeprom_read(sc, RT2560_EEPROM_TXPOWER + i);
2510 		sc->txpow[i * 2] = val >> 8;
2511 		sc->txpow[i * 2 + 1] = val & 0xff;
2512 	}
2513 }
2514 
2515 static int
2516 rt2560_bbp_init(struct rt2560_softc *sc)
2517 {
2518 #define N(a)	(sizeof (a) / sizeof ((a)[0]))
2519 	int i, ntries;
2520 
2521 	/* wait for BBP to be ready */
2522 	for (ntries = 0; ntries < 100; ntries++) {
2523 		if (rt2560_bbp_read(sc, RT2560_BBP_VERSION) != 0)
2524 			break;
2525 		DELAY(1);
2526 	}
2527 	if (ntries == 100) {
2528 		device_printf(sc->sc_dev, "timeout waiting for BBP\n");
2529 		return EIO;
2530 	}
2531 
2532 	/* initialize BBP registers to default values */
2533 	for (i = 0; i < N(rt2560_def_bbp); i++) {
2534 		rt2560_bbp_write(sc, rt2560_def_bbp[i].reg,
2535 		    rt2560_def_bbp[i].val);
2536 	}
2537 #if 0
2538 	/* initialize BBP registers to values stored in EEPROM */
2539 	for (i = 0; i < 16; i++) {
2540 		if (sc->bbp_prom[i].reg == 0xff)
2541 			continue;
2542 		rt2560_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
2543 	}
2544 #endif
2545 
2546 	return 0;
2547 #undef N
2548 }
2549 
2550 static void
2551 rt2560_set_txantenna(struct rt2560_softc *sc, int antenna)
2552 {
2553 	uint32_t tmp;
2554 	uint8_t tx;
2555 
2556 	tx = rt2560_bbp_read(sc, RT2560_BBP_TX) & ~RT2560_BBP_ANTMASK;
2557 	if (antenna == 1)
2558 		tx |= RT2560_BBP_ANTA;
2559 	else if (antenna == 2)
2560 		tx |= RT2560_BBP_ANTB;
2561 	else
2562 		tx |= RT2560_BBP_DIVERSITY;
2563 
2564 	/* need to force I/Q flip for RF 2525e, 2526 and 5222 */
2565 	if (sc->rf_rev == RT2560_RF_2525E || sc->rf_rev == RT2560_RF_2526 ||
2566 	    sc->rf_rev == RT2560_RF_5222)
2567 		tx |= RT2560_BBP_FLIPIQ;
2568 
2569 	rt2560_bbp_write(sc, RT2560_BBP_TX, tx);
2570 
2571 	/* update values for CCK and OFDM in BBPCSR1 */
2572 	tmp = RAL_READ(sc, RT2560_BBPCSR1) & ~0x00070007;
2573 	tmp |= (tx & 0x7) << 16 | (tx & 0x7);
2574 	RAL_WRITE(sc, RT2560_BBPCSR1, tmp);
2575 }
2576 
2577 static void
2578 rt2560_set_rxantenna(struct rt2560_softc *sc, int antenna)
2579 {
2580 	uint8_t rx;
2581 
2582 	rx = rt2560_bbp_read(sc, RT2560_BBP_RX) & ~RT2560_BBP_ANTMASK;
2583 	if (antenna == 1)
2584 		rx |= RT2560_BBP_ANTA;
2585 	else if (antenna == 2)
2586 		rx |= RT2560_BBP_ANTB;
2587 	else
2588 		rx |= RT2560_BBP_DIVERSITY;
2589 
2590 	/* need to force no I/Q flip for RF 2525e and 2526 */
2591 	if (sc->rf_rev == RT2560_RF_2525E || sc->rf_rev == RT2560_RF_2526)
2592 		rx &= ~RT2560_BBP_FLIPIQ;
2593 
2594 	rt2560_bbp_write(sc, RT2560_BBP_RX, rx);
2595 }
2596 
2597 static void
2598 rt2560_init(void *priv)
2599 {
2600 #define N(a)	(sizeof (a) / sizeof ((a)[0]))
2601 	struct rt2560_softc *sc = priv;
2602 	struct ieee80211com *ic = &sc->sc_ic;
2603 	struct ifnet *ifp = ic->ic_ifp;
2604 	uint32_t tmp;
2605 	int i;
2606 
2607 	RAL_LOCK(sc);
2608 
2609 	rt2560_stop(sc);
2610 
2611 	/* setup tx rings */
2612 	tmp = RT2560_PRIO_RING_COUNT << 24 |
2613 	      RT2560_ATIM_RING_COUNT << 16 |
2614 	      RT2560_TX_RING_COUNT   <<  8 |
2615 	      RT2560_TX_DESC_SIZE;
2616 
2617 	/* rings must be initialized in this exact order */
2618 	RAL_WRITE(sc, RT2560_TXCSR2, tmp);
2619 	RAL_WRITE(sc, RT2560_TXCSR3, sc->txq.physaddr);
2620 	RAL_WRITE(sc, RT2560_TXCSR5, sc->prioq.physaddr);
2621 	RAL_WRITE(sc, RT2560_TXCSR4, sc->atimq.physaddr);
2622 	RAL_WRITE(sc, RT2560_TXCSR6, sc->bcnq.physaddr);
2623 
2624 	/* setup rx ring */
2625 	tmp = RT2560_RX_RING_COUNT << 8 | RT2560_RX_DESC_SIZE;
2626 
2627 	RAL_WRITE(sc, RT2560_RXCSR1, tmp);
2628 	RAL_WRITE(sc, RT2560_RXCSR2, sc->rxq.physaddr);
2629 
2630 	/* initialize MAC registers to default values */
2631 	for (i = 0; i < N(rt2560_def_mac); i++)
2632 		RAL_WRITE(sc, rt2560_def_mac[i].reg, rt2560_def_mac[i].val);
2633 
2634 	IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
2635 	rt2560_set_macaddr(sc, ic->ic_myaddr);
2636 
2637 	/* set basic rate set (will be updated later) */
2638 	RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x153);
2639 
2640 	rt2560_set_txantenna(sc, sc->tx_ant);
2641 	rt2560_set_rxantenna(sc, sc->rx_ant);
2642 	rt2560_update_slot(ifp);
2643 	rt2560_update_plcp(sc);
2644 	rt2560_update_led(sc, 0, 0);
2645 
2646 	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
2647 	RAL_WRITE(sc, RT2560_CSR1, RT2560_HOST_READY);
2648 
2649 	if (rt2560_bbp_init(sc) != 0) {
2650 		rt2560_stop(sc);
2651 		RAL_UNLOCK(sc);
2652 		return;
2653 	}
2654 
2655 	/* set default BSS channel */
2656 	rt2560_set_chan(sc, ic->ic_curchan);
2657 
2658 	/* kick Rx */
2659 	tmp = RT2560_DROP_PHY_ERROR | RT2560_DROP_CRC_ERROR;
2660 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2661 		tmp |= RT2560_DROP_CTL | RT2560_DROP_VERSION_ERROR;
2662 		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
2663 			tmp |= RT2560_DROP_TODS;
2664 		if (!(ifp->if_flags & IFF_PROMISC))
2665 			tmp |= RT2560_DROP_NOT_TO_ME;
2666 	}
2667 	RAL_WRITE(sc, RT2560_RXCSR0, tmp);
2668 
2669 	/* clear old FCS and Rx FIFO errors */
2670 	RAL_READ(sc, RT2560_CNT0);
2671 	RAL_READ(sc, RT2560_CNT4);
2672 
2673 	/* clear any pending interrupts */
2674 	RAL_WRITE(sc, RT2560_CSR7, 0xffffffff);
2675 
2676 	/* enable interrupts */
2677 	RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
2678 
2679 	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
2680 	ifp->if_drv_flags |= IFF_DRV_RUNNING;
2681 
2682 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2683 		if (ic->ic_roaming != IEEE80211_ROAMING_MANUAL)
2684 			ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2685 	} else
2686 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2687 
2688 	RAL_UNLOCK(sc);
2689 #undef N
2690 }
2691 
2692 void
2693 rt2560_stop(void *priv)
2694 {
2695 	struct rt2560_softc *sc = priv;
2696 	struct ieee80211com *ic = &sc->sc_ic;
2697 	struct ifnet *ifp = ic->ic_ifp;
2698 
2699 	sc->sc_tx_timer = 0;
2700 	ifp->if_timer = 0;
2701 	ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
2702 
2703 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2704 
2705 	/* abort Tx */
2706 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_ABORT_TX);
2707 
2708 	/* disable Rx */
2709 	RAL_WRITE(sc, RT2560_RXCSR0, RT2560_DISABLE_RX);
2710 
2711 	/* reset ASIC (imply reset BBP) */
2712 	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
2713 	RAL_WRITE(sc, RT2560_CSR1, 0);
2714 
2715 	/* disable interrupts */
2716 	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
2717 
2718 	/* reset Tx and Rx rings */
2719 	rt2560_reset_tx_ring(sc, &sc->txq);
2720 	rt2560_reset_tx_ring(sc, &sc->atimq);
2721 	rt2560_reset_tx_ring(sc, &sc->prioq);
2722 	rt2560_reset_tx_ring(sc, &sc->bcnq);
2723 	rt2560_reset_rx_ring(sc, &sc->rxq);
2724 }
2725