xref: /illumos-gate/usr/src/uts/common/io/ral/rt2560.c (revision b424305435881ac456a9343be2898f1f86440f31)
1 /*
2  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
3  * Use is subject to license terms.
4  */
5 
6 /*
7  * Copyright (c) 2005, 2006
8  *	Damien Bergamini <damien.bergamini@free.fr>
9  *
10  * Permission to use, copy, modify, and distribute this software for any
11  * purpose with or without fee is hereby granted, provided that the above
12  * copyright notice and this permission notice appear in all copies.
13  *
14  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
15  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
16  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
17  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
18  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
20  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21  */
22 
23 /*
24  * Ralink Technology RT2560 chipset driver
25  * http://www.ralinktech.com/
26  */
27 
28 #include <sys/types.h>
29 #include <sys/byteorder.h>
30 #include <sys/conf.h>
31 #include <sys/cmn_err.h>
32 #include <sys/stat.h>
33 #include <sys/ddi.h>
34 #include <sys/sunddi.h>
35 #include <sys/strsubr.h>
36 #include <sys/ethernet.h>
37 #include <inet/common.h>
38 #include <inet/nd.h>
39 #include <inet/mi.h>
40 #include <sys/note.h>
41 #include <sys/stream.h>
42 #include <sys/strsun.h>
43 #include <sys/modctl.h>
44 #include <sys/devops.h>
45 #include <sys/dlpi.h>
46 #include <sys/mac_provider.h>
47 #include <sys/mac_wifi.h>
48 #include <sys/net80211.h>
49 #include <sys/net80211_proto.h>
50 #include <sys/varargs.h>
51 #include <sys/policy.h>
52 #include <sys/pci.h>
53 #include <sys/crypto/common.h>
54 #include <sys/crypto/api.h>
55 #include <inet/wifi_ioctl.h>
56 
57 #include "ral_rate.h"
58 #include "rt2560_reg.h"
59 #include "rt2560_var.h"
60 
61 
62 static void *ral_soft_state_p = NULL;
63 
64 #define	RAL_TXBUF_SIZE  	(IEEE80211_MAX_LEN)
65 #define	RAL_RXBUF_SIZE  	(IEEE80211_MAX_LEN)
66 
67 /* quickly determine if a given rate is CCK or OFDM */
68 #define	RAL_RATE_IS_OFDM(rate)	((rate) >= 12 && (rate) != 22)
69 #define	RAL_ACK_SIZE		14	/* 10 + 4(FCS) */
70 #define	RAL_CTS_SIZE		14	/* 10 + 4(FCS) */
71 #define	RAL_SIFS		10	/* us */
72 #define	RT2560_TXRX_TURNAROUND	10	/* us */
73 
74 /*
75  * Supported rates for 802.11a/b/g modes (in 500Kbps unit).
76  */
77 static const struct ieee80211_rateset rt2560_rateset_11a =
78 	{ 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
79 
80 static const struct ieee80211_rateset rt2560_rateset_11b =
81 	{ 4, { 2, 4, 11, 22 } };
82 
83 static const struct ieee80211_rateset rt2560_rateset_11g =
84 	{ 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
85 
86 static const struct {
87 	uint32_t	reg;
88 	uint32_t	val;
89 } rt2560_def_mac[] = {
90 	RT2560_DEF_MAC
91 };
92 
93 static const struct {
94 	uint8_t	reg;
95 	uint8_t	val;
96 } rt2560_def_bbp[] = {
97 	RT2560_DEF_BBP
98 };
99 
100 static const uint32_t rt2560_rf2522_r2[]    = RT2560_RF2522_R2;
101 static const uint32_t rt2560_rf2523_r2[]    = RT2560_RF2523_R2;
102 static const uint32_t rt2560_rf2524_r2[]    = RT2560_RF2524_R2;
103 static const uint32_t rt2560_rf2525_r2[]    = RT2560_RF2525_R2;
104 static const uint32_t rt2560_rf2525_hi_r2[] = RT2560_RF2525_HI_R2;
105 static const uint32_t rt2560_rf2525e_r2[]   = RT2560_RF2525E_R2;
106 static const uint32_t rt2560_rf2526_r2[]    = RT2560_RF2526_R2;
107 static const uint32_t rt2560_rf2526_hi_r2[] = RT2560_RF2526_HI_R2;
108 
109 static const struct {
110 	uint8_t		chan;
111 	uint32_t	r1, r2, r4;
112 } rt2560_rf5222[] = {
113 	RT2560_RF5222
114 };
115 
116 /*
117  * PIO access attributes for registers
118  */
119 static ddi_device_acc_attr_t ral_csr_accattr = {
120 	DDI_DEVICE_ATTR_V0,
121 	DDI_STRUCTURE_LE_ACC,
122 	DDI_STRICTORDER_ACC
123 };
124 
125 /*
126  * DMA access attributes for descriptors: NOT to be byte swapped.
127  */
128 static ddi_device_acc_attr_t ral_desc_accattr = {
129 	DDI_DEVICE_ATTR_V0,
130 	DDI_STRUCTURE_LE_ACC,
131 	DDI_STRICTORDER_ACC
132 };
133 
134 /*
135  * Describes the chip's DMA engine
136  */
137 static ddi_dma_attr_t ral_dma_attr = {
138 	DMA_ATTR_V0,			/* dma_attr version */
139 	0x0000000000000000ull,		/* dma_attr_addr_lo */
140 	0xFFFFFFFF,			/* dma_attr_addr_hi */
141 	0x00000000FFFFFFFFull,		/* dma_attr_count_max */
142 	0x0000000000000001ull,		/* dma_attr_align */
143 	0x00000FFF,			/* dma_attr_burstsizes */
144 	0x00000001,			/* dma_attr_minxfer */
145 	0x000000000000FFFFull,		/* dma_attr_maxxfer */
146 	0xFFFFFFFFFFFFFFFFull,		/* dma_attr_seg */
147 	1,				/* dma_attr_sgllen */
148 	0x00000001,			/* dma_attr_granular */
149 	0				/* dma_attr_flags */
150 };
151 
152 /*
153  * device operations
154  */
155 static int rt2560_attach(dev_info_t *, ddi_attach_cmd_t);
156 static int rt2560_detach(dev_info_t *, ddi_detach_cmd_t);
157 static int32_t rt2560_quiesce(dev_info_t *);
158 
159 /*
160  * Module Loading Data & Entry Points
161  */
162 DDI_DEFINE_STREAM_OPS(ral_dev_ops, nulldev, nulldev, rt2560_attach,
163     rt2560_detach, nodev, NULL, D_MP, NULL, rt2560_quiesce);
164 
165 static struct modldrv ral_modldrv = {
166 	&mod_driverops,		/* Type of module.  This one is a driver */
167 	"Ralink RT2500 driver v1.6",	/* short description */
168 	&ral_dev_ops		/* driver specific ops */
169 };
170 
171 static struct modlinkage modlinkage = {
172 	MODREV_1,
173 	(void *)&ral_modldrv,
174 	NULL
175 };
176 
177 static int	rt2560_m_stat(void *,  uint_t, uint64_t *);
178 static int	rt2560_m_start(void *);
179 static void	rt2560_m_stop(void *);
180 static int	rt2560_m_promisc(void *, boolean_t);
181 static int	rt2560_m_multicst(void *, boolean_t, const uint8_t *);
182 static int	rt2560_m_unicst(void *, const uint8_t *);
183 static mblk_t	*rt2560_m_tx(void *, mblk_t *);
184 static void	rt2560_m_ioctl(void *, queue_t *, mblk_t *);
185 static int	rt2560_m_setprop(void *, const char *, mac_prop_id_t,
186     uint_t, const void *);
187 static int	rt2560_m_getprop(void *, const char *, mac_prop_id_t,
188     uint_t, uint_t, void *, uint_t *);
189 
190 static mac_callbacks_t rt2560_m_callbacks = {
191 	MC_IOCTL | MC_SETPROP | MC_GETPROP,
192 	rt2560_m_stat,
193 	rt2560_m_start,
194 	rt2560_m_stop,
195 	rt2560_m_promisc,
196 	rt2560_m_multicst,
197 	rt2560_m_unicst,
198 	rt2560_m_tx,
199 	rt2560_m_ioctl,
200 	NULL,		/* mc_getcapab */
201 	NULL,
202 	NULL,
203 	rt2560_m_setprop,
204 	rt2560_m_getprop
205 };
206 
207 uint32_t ral_dbg_flags = 0;
208 
209 void
210 ral_debug(uint32_t dbg_flags, const int8_t *fmt, ...)
211 {
212 	va_list args;
213 
214 	if (dbg_flags & ral_dbg_flags) {
215 		va_start(args, fmt);
216 		vcmn_err(CE_CONT, fmt, args);
217 		va_end(args);
218 	}
219 }
220 
221 static void
222 rt2560_set_basicrates(struct rt2560_softc *sc)
223 {
224 	struct ieee80211com *ic = &sc->sc_ic;
225 
226 	/* update basic rate set */
227 	if (ic->ic_curmode == IEEE80211_MODE_11B) {
228 		/* 11b basic rates: 1, 2Mbps */
229 		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x3);
230 	} else if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan)) {
231 		/* 11a basic rates: 6, 12, 24Mbps */
232 		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x150);
233 	} else {
234 		/* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
235 		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x15f);
236 	}
237 }
238 
239 static void
240 rt2560_update_led(struct rt2560_softc *sc, int led1, int led2)
241 {
242 	uint32_t tmp;
243 
244 	/* set ON period to 70ms and OFF period to 30ms */
245 	tmp = led1 << 16 | led2 << 17 | 70 << 8 | 30;
246 	RAL_WRITE(sc, RT2560_LEDCSR, tmp);
247 }
248 
249 static void
250 rt2560_set_bssid(struct rt2560_softc *sc, uint8_t *bssid)
251 {
252 	uint32_t tmp;
253 
254 	tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
255 	RAL_WRITE(sc, RT2560_CSR5, tmp);
256 
257 	tmp = bssid[4] | bssid[5] << 8;
258 	RAL_WRITE(sc, RT2560_CSR6, tmp);
259 
260 	RAL_DEBUG(RAL_DBG_HW, "setting BSSID to " MACSTR "\n", MAC2STR(bssid));
261 }
262 
263 
264 static void
265 rt2560_bbp_write(struct rt2560_softc *sc, uint8_t reg, uint8_t val)
266 {
267 	uint32_t tmp;
268 	int ntries;
269 
270 	for (ntries = 0; ntries < 100; ntries++) {
271 		if (!(RAL_READ(sc, RT2560_BBPCSR) & RT2560_BBP_BUSY))
272 			break;
273 		drv_usecwait(1);
274 	}
275 	if (ntries == 100) {
276 		RAL_DEBUG(RAL_DBG_HW, "could not write to BBP\n");
277 		return;
278 	}
279 
280 	tmp = RT2560_BBP_WRITE | RT2560_BBP_BUSY | reg << 8 | val;
281 	RAL_WRITE(sc, RT2560_BBPCSR, tmp);
282 
283 	RAL_DEBUG(RAL_DBG_HW, "BBP R%u <- 0x%02x\n", reg, val);
284 }
285 
286 static uint8_t
287 rt2560_bbp_read(struct rt2560_softc *sc, uint8_t reg)
288 {
289 	uint32_t val;
290 	int ntries;
291 
292 	val = RT2560_BBP_BUSY | reg << 8;
293 	RAL_WRITE(sc, RT2560_BBPCSR, val);
294 
295 	for (ntries = 0; ntries < 100; ntries++) {
296 		val = RAL_READ(sc, RT2560_BBPCSR);
297 		if (!(val & RT2560_BBP_BUSY))
298 			return (val & 0xff);
299 		drv_usecwait(1);
300 	}
301 
302 	RAL_DEBUG(RAL_DBG_HW, "could not read from BBP\n");
303 	return (0);
304 }
305 
306 static void
307 rt2560_rf_write(struct rt2560_softc *sc, uint8_t reg, uint32_t val)
308 {
309 	uint32_t tmp;
310 	int ntries;
311 
312 	for (ntries = 0; ntries < 100; ntries++) {
313 		if (!(RAL_READ(sc, RT2560_RFCSR) & RT2560_RF_BUSY))
314 			break;
315 		drv_usecwait(1);
316 	}
317 	if (ntries == 100) {
318 		RAL_DEBUG(RAL_DBG_HW, "could not write to RF\n");
319 		return;
320 	}
321 
322 	tmp = RT2560_RF_BUSY | RT2560_RF_20BIT | (val & 0xfffff) << 2 |
323 	    (reg & 0x3);
324 	RAL_WRITE(sc, RT2560_RFCSR, tmp);
325 
326 	/* remember last written value in sc */
327 	sc->rf_regs[reg] = val;
328 
329 	RAL_DEBUG(RAL_DBG_HW, "RF R[%u] <- 0x%05x\n", reg & 0x3, val & 0xfffff);
330 }
331 
332 static void
333 rt2560_set_chan(struct rt2560_softc *sc, struct ieee80211_channel *c)
334 {
335 	struct ieee80211com *ic = &sc->sc_ic;
336 	uint8_t power, tmp;
337 	uint_t i, chan;
338 
339 	chan = ieee80211_chan2ieee(ic, c);
340 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
341 		return;
342 
343 	if (IEEE80211_IS_CHAN_2GHZ(c))
344 		power = min(sc->txpow[chan - 1], 31);
345 	else
346 		power = 31;
347 
348 	/* adjust txpower using ifconfig settings */
349 	power -= (100 - ic->ic_txpowlimit) / 8;
350 
351 	RAL_DEBUG(RAL_DBG_CHAN, "setting channel to %u, txpower to %u\n",
352 	    chan, power);
353 
354 	switch (sc->rf_rev) {
355 	case RT2560_RF_2522:
356 		rt2560_rf_write(sc, RAL_RF1, 0x00814);
357 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2522_r2[chan - 1]);
358 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
359 		break;
360 
361 	case RT2560_RF_2523:
362 		rt2560_rf_write(sc, RAL_RF1, 0x08804);
363 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2523_r2[chan - 1]);
364 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x38044);
365 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
366 		break;
367 
368 	case RT2560_RF_2524:
369 		rt2560_rf_write(sc, RAL_RF1, 0x0c808);
370 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2524_r2[chan - 1]);
371 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
372 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
373 		break;
374 
375 	case RT2560_RF_2525:
376 		rt2560_rf_write(sc, RAL_RF1, 0x08808);
377 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525_hi_r2[chan - 1]);
378 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
379 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
380 
381 		rt2560_rf_write(sc, RAL_RF1, 0x08808);
382 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525_r2[chan - 1]);
383 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
384 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
385 		break;
386 
387 	case RT2560_RF_2525E:
388 		rt2560_rf_write(sc, RAL_RF1, 0x08808);
389 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525e_r2[chan - 1]);
390 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
391 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00286 : 0x00282);
392 		break;
393 
394 	case RT2560_RF_2526:
395 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2526_hi_r2[chan - 1]);
396 		rt2560_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
397 		rt2560_rf_write(sc, RAL_RF1, 0x08804);
398 
399 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2526_r2[chan - 1]);
400 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
401 		rt2560_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
402 		break;
403 
404 	/* dual-band RF */
405 	case RT2560_RF_5222:
406 		for (i = 0; rt2560_rf5222[i].chan != chan; i++) {
407 		}
408 
409 		rt2560_rf_write(sc, RAL_RF1, rt2560_rf5222[i].r1);
410 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf5222[i].r2);
411 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
412 		rt2560_rf_write(sc, RAL_RF4, rt2560_rf5222[i].r4);
413 		break;
414 	}
415 
416 	if (ic->ic_state != IEEE80211_S_SCAN) {
417 		/* set Japan filter bit for channel 14 */
418 		tmp = rt2560_bbp_read(sc, 70);
419 
420 		tmp &= ~RT2560_JAPAN_FILTER;
421 		if (chan == 14)
422 			tmp |= RT2560_JAPAN_FILTER;
423 
424 		rt2560_bbp_write(sc, 70, tmp);
425 
426 		/* clear CRC errors */
427 		(void) RAL_READ(sc, RT2560_CNT0);
428 	}
429 }
430 
431 /*
432  * Refer to IEEE Std 802.11-1999 pp. 123 for more information on TSF
433  * synchronization.
434  */
435 static void
436 rt2560_enable_tsf_sync(struct rt2560_softc *sc)
437 {
438 	struct ieee80211com *ic = &sc->sc_ic;
439 	uint16_t logcwmin, preload;
440 	uint32_t tmp;
441 
442 	/* first, disable TSF synchronization */
443 	RAL_WRITE(sc, RT2560_CSR14, 0);
444 
445 	tmp = 16 * ic->ic_bss->in_intval;
446 	RAL_WRITE(sc, RT2560_CSR12, tmp);
447 
448 	RAL_WRITE(sc, RT2560_CSR13, 0);
449 
450 	logcwmin = 5;
451 	preload = (ic->ic_opmode == IEEE80211_M_STA) ? 384 : 1024;
452 	tmp = logcwmin << 16 | preload;
453 	RAL_WRITE(sc, RT2560_BCNOCSR, tmp);
454 
455 	/* finally, enable TSF synchronization */
456 	tmp = RT2560_ENABLE_TSF | RT2560_ENABLE_TBCN;
457 	if (ic->ic_opmode == IEEE80211_M_STA)
458 		tmp |= RT2560_ENABLE_TSF_SYNC(1);
459 	else
460 		tmp |= RT2560_ENABLE_TSF_SYNC(2) |
461 		    RT2560_ENABLE_BEACON_GENERATOR;
462 	RAL_WRITE(sc, RT2560_CSR14, tmp);
463 
464 	RAL_DEBUG(RAL_DBG_HW, "enabling TSF synchronization\n");
465 }
466 
467 static void
468 rt2560_update_plcp(struct rt2560_softc *sc)
469 {
470 	struct ieee80211com *ic = &sc->sc_ic;
471 
472 	/* no short preamble for 1Mbps */
473 	RAL_WRITE(sc, RT2560_PLCP1MCSR, 0x00700400);
474 
475 	if (!(ic->ic_flags & IEEE80211_F_SHPREAMBLE)) {
476 		/* values taken from the reference driver */
477 		RAL_WRITE(sc, RT2560_PLCP2MCSR,   0x00380401);
478 		RAL_WRITE(sc, RT2560_PLCP5p5MCSR, 0x00150402);
479 		RAL_WRITE(sc, RT2560_PLCP11MCSR,  0x000b8403);
480 	} else {
481 		/* same values as above or'ed 0x8 */
482 		RAL_WRITE(sc, RT2560_PLCP2MCSR,   0x00380409);
483 		RAL_WRITE(sc, RT2560_PLCP5p5MCSR, 0x0015040a);
484 		RAL_WRITE(sc, RT2560_PLCP11MCSR,  0x000b840b);
485 	}
486 
487 	RAL_DEBUG(RAL_DBG_HW, "updating PLCP for %s preamble\n",
488 	    (ic->ic_flags & IEEE80211_F_SHPREAMBLE) ? "short" : "long");
489 }
490 
491 /*
492  * This function can be called by ieee80211_set_shortslottime(). Refer to
493  * IEEE Std 802.11-1999 pp. 85 to know how these values are computed.
494  */
495 void
496 rt2560_update_slot(struct ieee80211com *ic, int onoff)
497 {
498 	struct rt2560_softc *sc = (struct rt2560_softc *)ic;
499 	uint8_t slottime;
500 	uint16_t tx_sifs, tx_pifs, tx_difs, eifs;
501 	uint32_t tmp;
502 
503 	/* slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20; */
504 	slottime = (onoff ? 9 : 20);
505 
506 	/* update the MAC slot boundaries */
507 	tx_sifs = RAL_SIFS - RT2560_TXRX_TURNAROUND;
508 	tx_pifs = tx_sifs + slottime;
509 	tx_difs = tx_sifs + 2 * slottime;
510 	eifs = (ic->ic_curmode == IEEE80211_MODE_11B) ? 364 : 60;
511 
512 	tmp = RAL_READ(sc, RT2560_CSR11);
513 	tmp = (tmp & ~0x1f00) | slottime << 8;
514 	RAL_WRITE(sc, RT2560_CSR11, tmp);
515 
516 	tmp = tx_pifs << 16 | tx_sifs;
517 	RAL_WRITE(sc, RT2560_CSR18, tmp);
518 
519 	tmp = eifs << 16 | tx_difs;
520 	RAL_WRITE(sc, RT2560_CSR19, tmp);
521 
522 	RAL_DEBUG(RAL_DBG_HW, "setting slottime to %uus\n", slottime);
523 }
524 
525 int
526 ral_dma_region_alloc(struct rt2560_softc *sc, struct dma_region *dr,
527     size_t size, uint_t alloc_flags, uint_t bind_flags)
528 {
529 	dev_info_t *dip = sc->sc_dev;
530 	int err;
531 
532 	RAL_DEBUG(RAL_DBG_DMA, "ral_dma_region_alloc() size=%u\n", size);
533 
534 	err = ddi_dma_alloc_handle(dip, &ral_dma_attr, DDI_DMA_SLEEP, NULL,
535 	    &dr->dr_hnd);
536 	if (err != DDI_SUCCESS)
537 		goto fail1;
538 
539 	err = ddi_dma_mem_alloc(dr->dr_hnd, size, &ral_desc_accattr,
540 	    alloc_flags, DDI_DMA_SLEEP, NULL,
541 	    &dr->dr_base, &dr->dr_size, &dr->dr_acc);
542 	if (err != DDI_SUCCESS)
543 		goto fail2;
544 
545 	err = ddi_dma_addr_bind_handle(dr->dr_hnd, NULL,
546 	    dr->dr_base, dr->dr_size,
547 	    bind_flags, DDI_DMA_SLEEP, NULL, &dr->dr_cookie, &dr->dr_ccnt);
548 	if (err != DDI_SUCCESS)
549 		goto fail3;
550 
551 	if (dr->dr_ccnt != 1) {
552 		err = DDI_FAILURE;
553 		goto fail4;
554 	}
555 
556 	dr->dr_pbase = dr->dr_cookie.dmac_address;
557 	RAL_DEBUG(RAL_DBG_DMA, "get physical-base=0x%08x\n", dr->dr_pbase);
558 
559 	return (DDI_SUCCESS);
560 
561 fail4:
562 	(void) ddi_dma_unbind_handle(dr->dr_hnd);
563 fail3:
564 	ddi_dma_mem_free(&dr->dr_acc);
565 fail2:
566 	ddi_dma_free_handle(&dr->dr_hnd);
567 fail1:
568 	return (err);
569 }
570 
571 /* ARGSUSED */
572 void
573 ral_dma_region_free(struct rt2560_softc *sc, struct dma_region *dr)
574 {
575 	(void) ddi_dma_unbind_handle(dr->dr_hnd);
576 	ddi_dma_mem_free(&dr->dr_acc);
577 	ddi_dma_free_handle(&dr->dr_hnd);
578 }
579 
580 int
581 rt2560_alloc_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring,
582 	int count)
583 {
584 	int i, err;
585 	int size;
586 
587 	ring->count = count;
588 	ring->queued = 0;
589 	ring->cur = ring->next = 0;
590 	ring->cur_encrypt = ring->next_encrypt = 0;
591 
592 	ring->data = kmem_zalloc(count * (sizeof (struct rt2560_tx_data)),
593 	    KM_SLEEP);
594 	ring->dr_txbuf = kmem_zalloc(count * (sizeof (struct dma_region)),
595 	    KM_SLEEP);
596 
597 	err = ral_dma_region_alloc(sc, &ring->dr_desc,
598 	    count * (sizeof (struct rt2560_tx_desc)),
599 	    DDI_DMA_CONSISTENT, DDI_DMA_RDWR | DDI_DMA_CONSISTENT);
600 
601 	if (err != DDI_SUCCESS)
602 		goto fail1;
603 
604 	size = roundup(RAL_TXBUF_SIZE, sc->sc_cachelsz);
605 	for (i = 0; i < count; i++) {
606 		err = ral_dma_region_alloc(sc, &ring->dr_txbuf[i], size,
607 		    DDI_DMA_STREAMING, DDI_DMA_WRITE | DDI_DMA_STREAMING);
608 		if (err != DDI_SUCCESS) {
609 			while (i >= 0) {
610 				ral_dma_region_free(sc, &ring->dr_txbuf[i]);
611 				i--;
612 			}
613 			goto fail2;
614 		}
615 	}
616 
617 	ring->physaddr = LE_32(ring->dr_desc.dr_pbase);
618 	ring->desc = (struct rt2560_tx_desc *)ring->dr_desc.dr_base;
619 
620 	for (i = 0; i < count; i++) {
621 		ring->desc[i].physaddr = LE_32(ring->dr_txbuf[i].dr_pbase);
622 		ring->data[i].buf = ring->dr_txbuf[i].dr_base;
623 	}
624 
625 	return (DDI_SUCCESS);
626 fail2:
627 	ral_dma_region_free(sc, &ring->dr_desc);
628 fail1:
629 	return (err);
630 }
631 
632 /* ARGSUSED */
633 void
634 rt2560_reset_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring)
635 {
636 	struct rt2560_tx_desc *desc;
637 	struct rt2560_tx_data *data;
638 	int i;
639 
640 	for (i = 0; i < ring->count; i++) {
641 		desc = &ring->desc[i];
642 		data = &ring->data[i];
643 
644 		if (data->ni != NULL) {
645 			ieee80211_free_node(data->ni);
646 			data->ni = NULL;
647 		}
648 
649 		desc->flags = 0;
650 	}
651 
652 	(void) ddi_dma_sync(ring->dr_desc.dr_hnd, 0,
653 	    ring->count * sizeof (struct rt2560_tx_desc), DDI_DMA_SYNC_FORDEV);
654 
655 	ring->queued = 0;
656 	ring->cur = ring->next = 0;
657 	ring->cur_encrypt = ring->next_encrypt = 0;
658 }
659 
660 void
661 rt2560_free_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring)
662 {
663 	struct rt2560_tx_data *data;
664 	int i;
665 
666 	ral_dma_region_free(sc, &ring->dr_desc);
667 	/* tx buf */
668 	for (i = 0; i < ring->count; i++) {
669 		data = &ring->data[i];
670 		if (data->ni != NULL) {
671 			ieee80211_free_node(data->ni);
672 			data->ni = NULL;
673 		}
674 
675 		ral_dma_region_free(sc, &ring->dr_txbuf[i]);
676 	}
677 
678 	kmem_free(ring->data, ring->count * (sizeof (struct rt2560_tx_data)));
679 	kmem_free(ring->dr_txbuf, ring->count * (sizeof (struct dma_region)));
680 }
681 
682 void
683 rt2560_ring_hwsetup(struct rt2560_softc *sc)
684 {
685 	uint32_t tmp;
686 
687 	/* setup tx rings */
688 	tmp = ((uint32_t)RT2560_PRIO_RING_COUNT << 24) |
689 	    RT2560_ATIM_RING_COUNT << 16 |
690 	    RT2560_TX_RING_COUNT   <<  8 |
691 	    RT2560_TX_DESC_SIZE;
692 
693 	/* rings must be initialized in this exact order */
694 	RAL_WRITE(sc, RT2560_TXCSR2, tmp);
695 	RAL_WRITE(sc, RT2560_TXCSR3, sc->txq.physaddr);
696 	RAL_WRITE(sc, RT2560_TXCSR5, sc->prioq.physaddr);
697 
698 	/* setup rx ring */
699 	tmp = RT2560_RX_RING_COUNT << 8 | RT2560_RX_DESC_SIZE;
700 
701 	RAL_WRITE(sc, RT2560_RXCSR1, tmp);
702 	RAL_WRITE(sc, RT2560_RXCSR2, sc->rxq.physaddr);
703 }
704 
705 int
706 rt2560_alloc_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring,
707 	int count)
708 {
709 	struct rt2560_rx_desc *desc;
710 	struct rt2560_rx_data *data;
711 	int i, err;
712 	int size;
713 
714 	ring->count = count;
715 	ring->cur = ring->next = 0;
716 	ring->cur_decrypt = 0;
717 
718 	ring->data = kmem_zalloc(count * (sizeof (struct rt2560_rx_data)),
719 	    KM_SLEEP);
720 	ring->dr_rxbuf = kmem_zalloc(count * (sizeof (struct dma_region)),
721 	    KM_SLEEP);
722 
723 	err = ral_dma_region_alloc(sc, &ring->dr_desc,
724 	    count * (sizeof (struct rt2560_rx_desc)),
725 	    DDI_DMA_CONSISTENT, DDI_DMA_RDWR | DDI_DMA_CONSISTENT);
726 
727 	if (err != DDI_SUCCESS)
728 		goto fail1;
729 
730 	size = roundup(RAL_RXBUF_SIZE, sc->sc_cachelsz);
731 	for (i = 0; i < count; i++) {
732 		err = ral_dma_region_alloc(sc, &ring->dr_rxbuf[i], size,
733 		    DDI_DMA_STREAMING, DDI_DMA_READ | DDI_DMA_STREAMING);
734 		if (err != DDI_SUCCESS) {
735 			while (i >= 0) {
736 				ral_dma_region_free(sc, &ring->dr_rxbuf[i]);
737 				i--;
738 			}
739 			goto fail2;
740 		}
741 	}
742 
743 	ring->physaddr = ring->dr_desc.dr_pbase;
744 	ring->desc = (struct rt2560_rx_desc *)ring->dr_desc.dr_base;
745 
746 	for (i = 0; i < count; i++) {
747 		desc = &ring->desc[i];
748 		data = &ring->data[i];
749 
750 		desc->physaddr = LE_32(ring->dr_rxbuf[i].dr_pbase);
751 		desc->flags = LE_32(RT2560_RX_BUSY);
752 
753 		data->buf = ring->dr_rxbuf[i].dr_base;
754 	}
755 
756 	return (DDI_SUCCESS);
757 fail2:
758 	ral_dma_region_free(sc, &ring->dr_desc);
759 fail1:
760 	return (err);
761 }
762 
763 /* ARGSUSED */
764 static void
765 rt2560_reset_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring)
766 {
767 	int i;
768 
769 	for (i = 0; i < ring->count; i++) {
770 		ring->desc[i].flags = LE_32(RT2560_RX_BUSY);
771 		ring->data[i].drop = 0;
772 	}
773 
774 	(void) ddi_dma_sync(ring->dr_desc.dr_hnd, 0,
775 	    ring->count * sizeof (struct rt2560_rx_desc),
776 	    DDI_DMA_SYNC_FORKERNEL);
777 
778 	ring->cur = ring->next = 0;
779 	ring->cur_decrypt = 0;
780 }
781 
782 static void
783 rt2560_free_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring)
784 {
785 	int i;
786 
787 	ral_dma_region_free(sc, &ring->dr_desc);
788 	/* rx buf */
789 	for (i = 0; i < ring->count; i++)
790 		ral_dma_region_free(sc, &ring->dr_rxbuf[i]);
791 
792 	kmem_free(ring->data, ring->count * (sizeof (struct rt2560_rx_data)));
793 	kmem_free(ring->dr_rxbuf, ring->count * (sizeof (struct dma_region)));
794 }
795 
796 /* ARGSUSED */
797 static struct ieee80211_node *
798 rt2560_node_alloc(ieee80211com_t *ic)
799 {
800 	struct rt2560_node *rn;
801 
802 	rn = kmem_zalloc(sizeof (struct rt2560_node), KM_SLEEP);
803 	return ((rn != NULL) ? &rn->ni : NULL);
804 }
805 
806 static void
807 rt2560_node_free(struct ieee80211_node *in)
808 {
809 	ieee80211com_t *ic = in->in_ic;
810 
811 	ic->ic_node_cleanup(in);
812 	if (in->in_wpa_ie != NULL)
813 		ieee80211_free(in->in_wpa_ie);
814 	kmem_free(in, sizeof (struct rt2560_node));
815 }
816 
817 /*
818  * This function is called periodically (every 200ms) during scanning to
819  * switch from one channel to another.
820  */
821 static void
822 rt2560_next_scan(void *arg)
823 {
824 	struct rt2560_softc *sc = arg;
825 	struct ieee80211com *ic = &sc->sc_ic;
826 
827 	if (ic->ic_state == IEEE80211_S_SCAN)
828 		(void) ieee80211_next_scan(ic);
829 }
830 
831 /*
832  * This function is called for each node present in the node station table.
833  */
834 /* ARGSUSED */
835 static void
836 rt2560_iter_func(void *arg, struct ieee80211_node *ni)
837 {
838 	struct rt2560_node *rn = (struct rt2560_node *)ni;
839 
840 	ral_rssadapt_updatestats(&rn->rssadapt);
841 }
842 
843 /*
844  * This function is called periodically (every 100ms) in RUN state to update
845  * the rate adaptation statistics.
846  */
847 static void
848 rt2560_update_rssadapt(void *arg)
849 {
850 	struct rt2560_softc *sc = arg;
851 	struct ieee80211com *ic = &sc->sc_ic;
852 
853 	ieee80211_iterate_nodes(&ic->ic_sta, rt2560_iter_func, arg);
854 	sc->sc_rssadapt_id = timeout(rt2560_update_rssadapt, (void *)sc,
855 	    drv_usectohz(100 * 1000));
856 }
857 
858 static void
859 rt2560_statedog(void *arg)
860 {
861 	struct rt2560_softc *sc = arg;
862 	struct ieee80211com *ic = &sc->sc_ic;
863 	enum ieee80211_state state;
864 
865 	RAL_LOCK(sc);
866 
867 	RAL_DEBUG(RAL_DBG_MSG, "rt2560_statedog(...)\n");
868 
869 	sc->sc_state_id = 0;
870 	state = ic->ic_state;
871 	ic->ic_state = sc->sc_ostate;
872 
873 	RAL_UNLOCK(sc);
874 
875 	ieee80211_new_state(ic, state, -1);
876 
877 }
878 
879 static int
880 rt2560_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
881 {
882 	struct rt2560_softc *sc = (struct rt2560_softc *)ic;
883 	enum ieee80211_state ostate;
884 	struct ieee80211_node *ni;
885 	int err;
886 
887 	RAL_LOCK(sc);
888 
889 	ostate = ic->ic_state;
890 	sc->sc_ostate = ostate;
891 
892 	if (sc->sc_scan_id != 0) {
893 		(void) untimeout(sc->sc_scan_id);
894 		sc->sc_scan_id = 0;
895 	}
896 
897 	if (sc->sc_rssadapt_id != 0) {
898 		(void) untimeout(sc->sc_rssadapt_id);
899 		sc->sc_rssadapt_id = 0;
900 	}
901 
902 	if (sc->sc_state_id != 0) {
903 		(void) untimeout(sc->sc_state_id);
904 		sc->sc_state_id = 0;
905 	}
906 
907 	switch (nstate) {
908 	case IEEE80211_S_INIT:
909 		if (ostate == IEEE80211_S_RUN) {
910 			/* abort TSF synchronization */
911 			RAL_WRITE(sc, RT2560_CSR14, 0);
912 			/* turn association led off */
913 			rt2560_update_led(sc, 0, 0);
914 		}
915 		break;
916 
917 	case IEEE80211_S_SCAN:
918 		rt2560_set_chan(sc, ic->ic_curchan);
919 		sc->sc_scan_id = timeout(rt2560_next_scan, (void *)sc,
920 		    drv_usectohz(sc->dwelltime * 1000));
921 		break;
922 
923 	case IEEE80211_S_AUTH:
924 		RAL_DEBUG(RAL_DBG_STATE, "-> IEEE80211_S_AUTH ...\n");
925 		rt2560_set_chan(sc, ic->ic_curchan);
926 		break;
927 
928 	case IEEE80211_S_ASSOC:
929 		RAL_DEBUG(RAL_DBG_STATE, "-> IEEE80211_S_ASSOC ...\n");
930 		rt2560_set_chan(sc, ic->ic_curchan);
931 
932 		drv_usecwait(10 * 1000);	/* dlink */
933 		sc->sc_state_id = timeout(rt2560_statedog, (void *)sc,
934 		    drv_usectohz(300 * 1000));	/* ap7-3 */
935 		break;
936 
937 	case IEEE80211_S_RUN:
938 		RAL_DEBUG(RAL_DBG_STATE, "-> IEEE80211_S_RUN ...\n");
939 		rt2560_set_chan(sc, ic->ic_curchan);
940 
941 		ni = ic->ic_bss;
942 
943 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
944 			rt2560_update_plcp(sc);
945 			rt2560_set_basicrates(sc);
946 			rt2560_set_bssid(sc, ni->in_bssid);
947 		}
948 
949 		/* turn assocation led on */
950 		rt2560_update_led(sc, 1, 0);
951 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
952 			sc->sc_rssadapt_id = timeout(rt2560_update_rssadapt,
953 			    (void *)sc, drv_usectohz(100 * 1000));
954 			rt2560_enable_tsf_sync(sc);
955 		}
956 		break;
957 	}
958 
959 	RAL_UNLOCK(sc);
960 
961 	err = sc->sc_newstate(ic, nstate, arg);
962 	/*
963 	 * Finally, start any timers.
964 	 */
965 	if (nstate == IEEE80211_S_RUN)
966 		ieee80211_start_watchdog(ic, 1);
967 
968 	return (err);
969 }
970 
971 /*
972  * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46 or
973  * 93C66).
974  */
975 static uint16_t
976 rt2560_eeprom_read(struct rt2560_softc *sc, uint8_t addr)
977 {
978 	uint32_t tmp;
979 	uint16_t val;
980 	int n;
981 
982 	/* clock C once before the first command */
983 	RT2560_EEPROM_CTL(sc, 0);
984 
985 	RT2560_EEPROM_CTL(sc, RT2560_S);
986 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
987 	RT2560_EEPROM_CTL(sc, RT2560_S);
988 
989 	/* write start bit (1) */
990 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D);
991 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D | RT2560_C);
992 
993 	/* write READ opcode (10) */
994 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D);
995 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D | RT2560_C);
996 	RT2560_EEPROM_CTL(sc, RT2560_S);
997 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
998 
999 	/* write address (A5-A0 or A7-A0) */
1000 	n = (RAL_READ(sc, RT2560_CSR21) & RT2560_93C46) ? 5 : 7;
1001 	for (; n >= 0; n--) {
1002 		RT2560_EEPROM_CTL(sc, RT2560_S |
1003 		    (((addr >> n) & 1) << RT2560_SHIFT_D));
1004 		RT2560_EEPROM_CTL(sc, RT2560_S |
1005 		    (((addr >> n) & 1) << RT2560_SHIFT_D) | RT2560_C);
1006 	}
1007 
1008 	RT2560_EEPROM_CTL(sc, RT2560_S);
1009 
1010 	/* read data Q15-Q0 */
1011 	val = 0;
1012 	for (n = 15; n >= 0; n--) {
1013 		RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
1014 		tmp = RAL_READ(sc, RT2560_CSR21);
1015 		val |= ((tmp & RT2560_Q) >> RT2560_SHIFT_Q) << n;
1016 		RT2560_EEPROM_CTL(sc, RT2560_S);
1017 	}
1018 
1019 	RT2560_EEPROM_CTL(sc, 0);
1020 
1021 	/* clear Chip Select and clock C */
1022 	RT2560_EEPROM_CTL(sc, RT2560_S);
1023 	RT2560_EEPROM_CTL(sc, 0);
1024 	RT2560_EEPROM_CTL(sc, RT2560_C);
1025 
1026 	return (val);
1027 }
1028 
1029 static void
1030 rt2560_tx_intr(struct rt2560_softc *sc)
1031 {
1032 	struct ieee80211com *ic = &sc->sc_ic;
1033 	struct rt2560_tx_desc *desc;
1034 	struct rt2560_tx_data *data;
1035 	struct rt2560_node *rn;
1036 
1037 	struct dma_region *dr;
1038 	int count;
1039 
1040 	dr = &sc->txq.dr_desc;
1041 	count = sc->txq.count;
1042 
1043 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1044 	    DDI_DMA_SYNC_FORKERNEL);
1045 
1046 	mutex_enter(&sc->txq.tx_lock);
1047 
1048 	for (;;) {
1049 		desc = &sc->txq.desc[sc->txq.next];
1050 		data = &sc->txq.data[sc->txq.next];
1051 
1052 		if ((LE_32(desc->flags) & RT2560_TX_BUSY) ||
1053 		    (LE_32(desc->flags) & RT2560_TX_CIPHER_BUSY) ||
1054 		    !(LE_32(desc->flags) & RT2560_TX_VALID))
1055 			break;
1056 
1057 		rn = (struct rt2560_node *)data->ni;
1058 
1059 		switch (LE_32(desc->flags) & RT2560_TX_RESULT_MASK) {
1060 		case RT2560_TX_SUCCESS:
1061 			RAL_DEBUG(RAL_DBG_INTR, "data frame sent success\n");
1062 			if (data->id.id_node != NULL) {
1063 				ral_rssadapt_raise_rate(ic, &rn->rssadapt,
1064 				    &data->id);
1065 			}
1066 			break;
1067 
1068 		case RT2560_TX_SUCCESS_RETRY:
1069 			RAL_DEBUG(RAL_DBG_INTR,
1070 			    "data frame sent after %u retries\n",
1071 			    (LE_32(desc->flags) >> 5) & 0x7);
1072 			sc->sc_tx_retries++;
1073 			break;
1074 
1075 		case RT2560_TX_FAIL_RETRY:
1076 			RAL_DEBUG(RAL_DBG_INTR,
1077 			    "sending data frame failed (too much retries)\n");
1078 			if (data->id.id_node != NULL) {
1079 				ral_rssadapt_lower_rate(ic, data->ni,
1080 				    &rn->rssadapt, &data->id);
1081 			}
1082 			break;
1083 
1084 		case RT2560_TX_FAIL_INVALID:
1085 		case RT2560_TX_FAIL_OTHER:
1086 		default:
1087 			RAL_DEBUG(RAL_DBG_INTR, "sending data frame failed "
1088 			    "0x%08x\n", LE_32(desc->flags));
1089 			break;
1090 		}
1091 
1092 		ieee80211_free_node(data->ni);
1093 		data->ni = NULL;
1094 
1095 		/* descriptor is no longer valid */
1096 		desc->flags &= ~LE_32(RT2560_TX_VALID);
1097 
1098 		RAL_DEBUG(RAL_DBG_INTR, "tx done idx=%u\n", sc->txq.next);
1099 
1100 		sc->txq.queued--;
1101 		sc->txq.next = (sc->txq.next + 1) % RT2560_TX_RING_COUNT;
1102 
1103 		if (sc->sc_need_sched &&
1104 		    sc->txq.queued < (RT2560_TX_RING_COUNT - 32)) {
1105 			sc->sc_need_sched = 0;
1106 			mac_tx_update(ic->ic_mach);
1107 		}
1108 	}
1109 
1110 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1111 	    DDI_DMA_SYNC_FORDEV);
1112 
1113 	sc->sc_tx_timer = 0;
1114 	mutex_exit(&sc->txq.tx_lock);
1115 }
1116 
1117 static void
1118 rt2560_prio_intr(struct rt2560_softc *sc)
1119 {
1120 	struct rt2560_tx_desc *desc;
1121 	struct rt2560_tx_data *data;
1122 
1123 	struct dma_region *dr;
1124 	int count;
1125 
1126 	dr = &sc->prioq.dr_desc;
1127 	count = sc->prioq.count;
1128 
1129 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1130 	    DDI_DMA_SYNC_FORKERNEL);
1131 
1132 	mutex_enter(&sc->prioq.tx_lock);
1133 
1134 	for (;;) {
1135 		desc = &sc->prioq.desc[sc->prioq.next];
1136 		data = &sc->prioq.data[sc->prioq.next];
1137 
1138 		if ((LE_32(desc->flags) & RT2560_TX_BUSY) ||
1139 		    !(LE_32(desc->flags) & RT2560_TX_VALID))
1140 			break;
1141 
1142 		switch (LE_32(desc->flags) & RT2560_TX_RESULT_MASK) {
1143 		case RT2560_TX_SUCCESS:
1144 			RAL_DEBUG(RAL_DBG_INTR, "mgt frame sent success\n");
1145 			break;
1146 
1147 		case RT2560_TX_SUCCESS_RETRY:
1148 			RAL_DEBUG(RAL_DBG_INTR,
1149 			    "mgt frame sent after %u retries\n",
1150 			    (LE_32(desc->flags) >> 5) & 0x7);
1151 			break;
1152 
1153 		case RT2560_TX_FAIL_RETRY:
1154 			RAL_DEBUG(RAL_DBG_INTR,
1155 			    "sending mgt frame failed (too much " "retries)\n");
1156 			break;
1157 
1158 		case RT2560_TX_FAIL_INVALID:
1159 		case RT2560_TX_FAIL_OTHER:
1160 		default:
1161 			RAL_DEBUG(RAL_DBG_INTR, "sending mgt frame failed "
1162 			    "0x%08x\n", LE_32(desc->flags));
1163 		}
1164 
1165 		ieee80211_free_node(data->ni);
1166 		data->ni = NULL;
1167 
1168 		/* descriptor is no longer valid */
1169 		desc->flags &= ~LE_32(RT2560_TX_VALID);
1170 
1171 		RAL_DEBUG(RAL_DBG_INTR, "prio done idx=%u\n", sc->prioq.next);
1172 
1173 		sc->prioq.queued--;
1174 		sc->prioq.next = (sc->prioq.next + 1) % RT2560_PRIO_RING_COUNT;
1175 	}
1176 
1177 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1178 	    DDI_DMA_SYNC_FORDEV);
1179 
1180 	sc->sc_tx_timer = 0;
1181 	mutex_exit(&sc->prioq.tx_lock);
1182 }
1183 
1184 /*
1185  * Some frames were received. Pass them to the hardware cipher engine before
1186  * sending them to the 802.11 layer.
1187  */
1188 void
1189 rt2560_rx_intr(struct rt2560_softc *sc)
1190 {
1191 	struct ieee80211com *ic = &sc->sc_ic;
1192 	struct rt2560_rx_desc *desc;
1193 	struct rt2560_rx_data *data;
1194 	struct ieee80211_frame *wh;
1195 	struct ieee80211_node *ni;
1196 	struct rt2560_node *rn;
1197 
1198 	mblk_t *m;
1199 	uint32_t len;
1200 	char *rxbuf;
1201 
1202 	struct dma_region *dr, *dr_bf;
1203 	int count;
1204 
1205 	dr = &sc->rxq.dr_desc;
1206 	count = sc->rxq.count;
1207 
1208 	mutex_enter(&sc->rxq.rx_lock);
1209 
1210 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_RX_DESC_SIZE,
1211 	    DDI_DMA_SYNC_FORKERNEL);
1212 
1213 	for (;;) {
1214 		desc = &sc->rxq.desc[sc->rxq.cur];
1215 		data = &sc->rxq.data[sc->rxq.cur];
1216 
1217 		if ((LE_32(desc->flags) & RT2560_RX_BUSY) ||
1218 		    (LE_32(desc->flags) & RT2560_RX_CIPHER_BUSY))
1219 			break;
1220 
1221 		data->drop = 0;
1222 
1223 		if ((LE_32(desc->flags) & RT2560_RX_PHY_ERROR) ||
1224 		    (LE_32(desc->flags) & RT2560_RX_CRC_ERROR)) {
1225 			/*
1226 			 * This should not happen since we did not request
1227 			 * to receive those frames when we filled RXCSR0.
1228 			 */
1229 			RAL_DEBUG(RAL_DBG_RX, "PHY or CRC error flags 0x%08x\n",
1230 			    LE_32(desc->flags));
1231 			data->drop = 1;
1232 		}
1233 
1234 		if (((LE_32(desc->flags) >> 16) & 0xfff) > RAL_RXBUF_SIZE) {
1235 			RAL_DEBUG(RAL_DBG_RX, "bad length\n");
1236 			data->drop = 1;
1237 		}
1238 
1239 		if (data->drop) {
1240 			sc->sc_rx_err++;
1241 			goto skip;
1242 		}
1243 
1244 		rxbuf = data->buf;
1245 		len = (LE_32(desc->flags) >> 16) & 0xfff;
1246 
1247 		if ((len < sizeof (struct ieee80211_frame_min)) ||
1248 		    (len > RAL_RXBUF_SIZE)) {
1249 			RAL_DEBUG(RAL_DBG_RX, "bad frame length=%u\n", len);
1250 			sc->sc_rx_err++;
1251 			goto skip;
1252 		}
1253 
1254 		if ((m = allocb(len, BPRI_MED)) == NULL) {
1255 			RAL_DEBUG(RAL_DBG_RX, "rt2560_rx_intr():"
1256 			    " allocate mblk failed.\n");
1257 			sc->sc_rx_nobuf++;
1258 			goto skip;
1259 		}
1260 
1261 		dr_bf = &sc->rxq.dr_rxbuf[sc->rxq.cur];
1262 		(void) ddi_dma_sync(dr_bf->dr_hnd, 0, dr_bf->dr_size,
1263 		    DDI_DMA_SYNC_FORCPU);
1264 
1265 		bcopy(rxbuf, m->b_rptr, len);
1266 		m->b_wptr += len;
1267 
1268 		wh = (struct ieee80211_frame *)m->b_rptr;
1269 		ni = ieee80211_find_rxnode(ic, wh);
1270 
1271 		/* give rssi to the rate adatation algorithm */
1272 		rn = (struct rt2560_node *)ni;
1273 		ral_rssadapt_input(ic, ni, &rn->rssadapt, desc->rssi);
1274 
1275 		/* send the frame to the 802.11 layer */
1276 		(void) ieee80211_input(ic, m, ni, desc->rssi, 0);
1277 
1278 		/* node is no longer needed */
1279 		ieee80211_free_node(ni);
1280 
1281 skip:		desc->flags = LE_32(RT2560_RX_BUSY);
1282 		RAL_DEBUG(RAL_DBG_RX, "rx done idx=%u\n", sc->rxq.cur);
1283 
1284 		sc->rxq.cur = (sc->rxq.cur + 1) % RT2560_RX_RING_COUNT;
1285 	}
1286 	mutex_exit(&sc->rxq.rx_lock);
1287 
1288 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1289 	    DDI_DMA_SYNC_FORDEV);
1290 }
1291 
1292 uint_t
1293 ral_softint_handler(caddr_t data)
1294 {
1295 	/* LINTED E_BAD_PTR_CAST_ALIGN */
1296 	struct rt2560_softc *sc = (struct rt2560_softc *)data;
1297 
1298 	/*
1299 	 * Check if the soft interrupt is triggered by another
1300 	 * driver at the same level.
1301 	 */
1302 	RAL_LOCK(sc);
1303 	if (sc->sc_rx_pend) {
1304 		sc->sc_rx_pend = 0;
1305 		RAL_UNLOCK(sc);
1306 		rt2560_rx_intr(sc);
1307 		return (DDI_INTR_CLAIMED);
1308 	}
1309 	RAL_UNLOCK(sc);
1310 	return (DDI_INTR_UNCLAIMED);
1311 }
1312 
1313 /*
1314  * Return the expected ack rate for a frame transmitted at rate `rate'.
1315  * XXX: this should depend on the destination node basic rate set.
1316  */
1317 static int
1318 rt2560_ack_rate(struct ieee80211com *ic, int rate)
1319 {
1320 	switch (rate) {
1321 	/* CCK rates */
1322 	case 2:
1323 		return (2);
1324 	case 4:
1325 	case 11:
1326 	case 22:
1327 		return ((ic->ic_curmode == IEEE80211_MODE_11B) ? 4 : rate);
1328 
1329 	/* OFDM rates */
1330 	case 12:
1331 	case 18:
1332 		return (12);
1333 	case 24:
1334 	case 36:
1335 		return (24);
1336 	case 48:
1337 	case 72:
1338 	case 96:
1339 	case 108:
1340 		return (48);
1341 	}
1342 
1343 	/* default to 1Mbps */
1344 	return (2);
1345 }
1346 
1347 /*
1348  * Compute the duration (in us) needed to transmit `len' bytes at rate `rate'.
1349  * The function automatically determines the operating mode depending on the
1350  * given rate. `flags' indicates whether short preamble is in use or not.
1351  */
1352 static uint16_t
1353 rt2560_txtime(int len, int rate, uint32_t flags)
1354 {
1355 	uint16_t txtime;
1356 
1357 	if (RAL_RATE_IS_OFDM(rate)) {
1358 		/* IEEE Std 802.11a-1999, pp. 37 */
1359 		txtime = (8 + 4 * len + 3 + rate - 1) / rate;
1360 		txtime = 16 + 4 + 4 * txtime + 6;
1361 	} else {
1362 		/* IEEE Std 802.11b-1999, pp. 28 */
1363 		txtime = (16 * len + rate - 1) / rate;
1364 		if (rate != 2 && (flags & IEEE80211_F_SHPREAMBLE))
1365 			txtime +=  72 + 24;
1366 		else
1367 			txtime += 144 + 48;
1368 	}
1369 
1370 	return (txtime);
1371 }
1372 
1373 static uint8_t
1374 rt2560_plcp_signal(int rate)
1375 {
1376 	switch (rate) {
1377 	/* CCK rates (returned values are device-dependent) */
1378 	case 2:		return (0x0);
1379 	case 4:		return (0x1);
1380 	case 11:	return (0x2);
1381 	case 22:	return (0x3);
1382 
1383 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1384 	case 12:	return (0xb);
1385 	case 18:	return (0xf);
1386 	case 24:	return (0xa);
1387 	case 36:	return (0xe);
1388 	case 48:	return (0x9);
1389 	case 72:	return (0xd);
1390 	case 96:	return (0x8);
1391 	case 108:	return (0xc);
1392 
1393 	/* unsupported rates (should not get there) */
1394 	default:	return (0xff);
1395 	}
1396 }
1397 
1398 void
1399 rt2560_setup_tx_desc(struct rt2560_softc *sc, struct rt2560_tx_desc *desc,
1400     uint32_t flags, int len, int rate, int encrypt)
1401 {
1402 	struct ieee80211com *ic = &sc->sc_ic;
1403 	uint16_t plcp_length;
1404 	int remainder;
1405 
1406 	desc->flags = LE_32(flags);
1407 	desc->flags |= LE_32(len << 16);
1408 	desc->flags |= encrypt ? LE_32(RT2560_TX_CIPHER_BUSY) :
1409 	    LE_32(RT2560_TX_BUSY | RT2560_TX_VALID);
1410 
1411 	desc->wme = LE_16(
1412 	    RT2560_AIFSN(2) |
1413 	    RT2560_LOGCWMIN(3) |
1414 	    RT2560_LOGCWMAX(8));
1415 
1416 	/* setup PLCP fields */
1417 	desc->plcp_signal  = rt2560_plcp_signal(rate);
1418 	desc->plcp_service = 4;
1419 
1420 	len += IEEE80211_CRC_LEN;
1421 	if (RAL_RATE_IS_OFDM(rate)) {
1422 		desc->flags |= LE_32(RT2560_TX_OFDM);
1423 
1424 		plcp_length = len & 0xfff;
1425 		desc->plcp_length_hi = plcp_length >> 6;
1426 		desc->plcp_length_lo = plcp_length & 0x3f;
1427 	} else {
1428 		plcp_length = (16 * len + rate - 1) / rate;
1429 		if (rate == 22) {
1430 			remainder = (16 * len) % 22;
1431 			if (remainder != 0 && remainder < 7)
1432 				desc->plcp_service |= RT2560_PLCP_LENGEXT;
1433 		}
1434 		desc->plcp_length_hi = plcp_length >> 8;
1435 		desc->plcp_length_lo = plcp_length & 0xff;
1436 
1437 		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1438 			desc->plcp_signal |= 0x08;
1439 	}
1440 }
1441 
1442 /* ARGSUSED */
1443 int
1444 rt2560_mgmt_send(ieee80211com_t *ic, mblk_t *mp, uint8_t type)
1445 {
1446 	struct rt2560_softc *sc = (struct rt2560_softc *)ic;
1447 	struct rt2560_tx_desc *desc;
1448 	struct rt2560_tx_data *data;
1449 	struct ieee80211_frame *wh;
1450 	uint16_t dur;
1451 	uint32_t flags = 0;
1452 	int rate, err = DDI_SUCCESS;
1453 
1454 	int off, pktlen, mblen;
1455 	caddr_t dest;
1456 	mblk_t *m, *m0;
1457 
1458 	struct dma_region *dr;
1459 	uint32_t idx;
1460 	struct ieee80211_node *ni;
1461 	struct ieee80211_key *k;
1462 
1463 	mutex_enter(&sc->prioq.tx_lock);
1464 
1465 	if (!RAL_IS_RUNNING(sc)) {
1466 		err = ENXIO;
1467 		goto fail1;
1468 	}
1469 
1470 	if (sc->prioq.queued >= RT2560_PRIO_RING_COUNT) {
1471 		err = ENOMEM;
1472 		sc->sc_tx_nobuf++;
1473 		goto fail1;
1474 	}
1475 
1476 	m = allocb(msgdsize(mp) + 32, BPRI_MED);
1477 	if (m == NULL) {
1478 		RAL_DEBUG(RAL_DBG_TX, "rt2560_mgmt_send: can't alloc mblk.\n");
1479 		err = DDI_FAILURE;
1480 		goto fail1;
1481 	}
1482 
1483 	for (off = 0, m0 = mp; m0 != NULL; m0 = m0->b_cont) {
1484 		mblen = MBLKL(m0);
1485 		(void) memcpy(m->b_rptr + off, m0->b_rptr, mblen);
1486 		off += mblen;
1487 	}
1488 	m->b_wptr += off;
1489 
1490 	wh = (struct ieee80211_frame *)m->b_rptr;
1491 	ni = ieee80211_find_txnode(ic, wh->i_addr1);
1492 
1493 	if (ni == NULL) {
1494 		err = DDI_FAILURE;
1495 		sc->sc_tx_err++;
1496 		goto fail2;
1497 	}
1498 
1499 	/* to support shared_key auth mode */
1500 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1501 		k = ieee80211_crypto_encap(ic, m);
1502 		if (k == NULL) {
1503 			err = DDI_FAILURE;
1504 			sc->sc_tx_err++;
1505 			goto fail3;
1506 		}
1507 		/* packet header may have moved, reset our local pointer */
1508 		wh = (struct ieee80211_frame *)m->b_rptr;
1509 	}
1510 
1511 	desc = &sc->prioq.desc[sc->prioq.cur];
1512 	data = &sc->prioq.data[sc->prioq.cur];
1513 
1514 	rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
1515 	data->ni = ieee80211_ref_node(ni);
1516 
1517 	pktlen = msgdsize(m);
1518 	dest = data->buf;
1519 	bcopy(m->b_rptr, dest, pktlen);
1520 
1521 	wh = (struct ieee80211_frame *)m->b_rptr;
1522 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1523 		flags |= RT2560_TX_ACK;
1524 
1525 		dur = rt2560_txtime(RAL_ACK_SIZE, rate, ic->ic_flags) +
1526 		    RAL_SIFS;
1527 		/* LINTED E_BAD_PTR_CAST_ALIGN */
1528 		*(uint16_t *)wh->i_dur = LE_16(dur);
1529 
1530 		/* tell hardware to add timestamp for probe responses */
1531 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1532 		    IEEE80211_FC0_TYPE_MGT &&
1533 		    (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1534 		    IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1535 			flags |= RT2560_TX_TIMESTAMP;
1536 	}
1537 
1538 	rt2560_setup_tx_desc(sc, desc, flags, pktlen, rate, 0);
1539 
1540 	idx = sc->prioq.cur;
1541 
1542 	dr = &sc->prioq.dr_txbuf[idx];
1543 	(void) ddi_dma_sync(dr->dr_hnd, 0, RAL_TXBUF_SIZE, DDI_DMA_SYNC_FORDEV);
1544 
1545 	dr = &sc->prioq.dr_desc;
1546 	(void) ddi_dma_sync(dr->dr_hnd, idx * RT2560_TX_DESC_SIZE,
1547 	    RT2560_TX_DESC_SIZE, DDI_DMA_SYNC_FORDEV);
1548 
1549 	RAL_DEBUG(RAL_DBG_MGMT, "sending mgt frame len=%u idx=%u rate=%u\n",
1550 	    pktlen, sc->prioq.cur, rate);
1551 
1552 	/* kick prio */
1553 	sc->prioq.queued++; /* IF > RT2560_PRIO_RING_COUNT? FULL */
1554 	sc->prioq.cur = (sc->prioq.cur + 1) % RT2560_PRIO_RING_COUNT;
1555 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_PRIO);
1556 
1557 	sc->sc_tx_timer = 5;
1558 
1559 	ic->ic_stats.is_tx_frags++;
1560 	ic->ic_stats.is_tx_bytes += pktlen;
1561 
1562 fail3:
1563 	ieee80211_free_node(ni);
1564 fail2:
1565 	freemsg(m);
1566 fail1:
1567 	freemsg(mp);
1568 	mutex_exit(&sc->prioq.tx_lock);
1569 
1570 	return (err);
1571 }
1572 
1573 static int
1574 rt2560_send(ieee80211com_t *ic, mblk_t *mp)
1575 {
1576 	struct rt2560_softc *sc = (struct rt2560_softc *)ic;
1577 	struct rt2560_tx_desc *desc;
1578 	struct rt2560_tx_data *data;
1579 	struct rt2560_node *rn;
1580 	struct ieee80211_rateset *rs;
1581 	struct ieee80211_frame *wh;
1582 	struct ieee80211_key *k;
1583 	uint16_t dur;
1584 	uint32_t flags = 0;
1585 	int rate, err = DDI_SUCCESS;
1586 
1587 	struct ieee80211_node *ni;
1588 	mblk_t *m, *m0;
1589 	int off, mblen, pktlen;
1590 	caddr_t dest;
1591 
1592 	struct dma_region *dr;
1593 	uint32_t idx;
1594 
1595 	mutex_enter(&sc->txq.tx_lock);
1596 
1597 	if (sc->txq.queued >= RT2560_TX_RING_COUNT - 1) {
1598 		RAL_DEBUG(RAL_DBG_TX, "ral: rt2560_tx_data(): "
1599 		    "no TX DMA buffer available!\n");
1600 		sc->sc_need_sched = 1;
1601 		sc->sc_tx_nobuf++;
1602 		err = ENOMEM;
1603 		goto fail1;
1604 	}
1605 
1606 	m = allocb(msgdsize(mp) + 32, BPRI_MED);
1607 	if (m == NULL) {
1608 		RAL_DEBUG(RAL_DBG_TX, "rt2560_xmit(): can't alloc mblk.\n");
1609 		err = DDI_FAILURE;
1610 		goto fail1;
1611 	}
1612 
1613 	for (off = 0, m0 = mp; m0 != NULL; m0 = m0->b_cont) {
1614 		mblen = MBLKL(m0);
1615 		(void) memcpy(m->b_rptr + off, m0->b_rptr, mblen);
1616 		off += mblen;
1617 	}
1618 	m->b_wptr += off;
1619 
1620 	wh = (struct ieee80211_frame *)m->b_rptr;
1621 	ni = ieee80211_find_txnode(ic, wh->i_addr1);
1622 
1623 	if (ni == NULL) {
1624 		err = DDI_FAILURE;
1625 		sc->sc_tx_err++;
1626 		goto fail2;
1627 	}
1628 
1629 	(void) ieee80211_encap(ic, m, ni);
1630 
1631 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1632 		k = ieee80211_crypto_encap(ic, m);
1633 		if (k == NULL) {
1634 			sc->sc_tx_err++;
1635 			err = DDI_FAILURE;
1636 			goto fail3;
1637 		}
1638 		/* packet header may have moved, reset our local pointer */
1639 		wh = (struct ieee80211_frame *)m->b_rptr;
1640 	}
1641 
1642 	/*
1643 	 * RTS/CTS exchange ignore, since the max packet will less than
1644 	 * the rtsthreshold (2346)
1645 	 * Unnecessary codes deleted.
1646 	 */
1647 
1648 	data = &sc->txq.data[sc->txq.cur];
1649 	desc = &sc->txq.desc[sc->txq.cur];
1650 
1651 	data->ni = ieee80211_ref_node(ni);
1652 
1653 	pktlen = msgdsize(m);
1654 	dest = data->buf;
1655 	bcopy(m->b_rptr, dest, pktlen);
1656 
1657 	if (ic->ic_fixed_rate != IEEE80211_FIXED_RATE_NONE) {
1658 		rs = &ic->ic_sup_rates[ic->ic_curmode];
1659 		rate = rs->ir_rates[ic->ic_fixed_rate];
1660 	} else {
1661 		rs = &ni->in_rates;
1662 		rn = (struct rt2560_node *)ni;
1663 		ni->in_txrate = ral_rssadapt_choose(&rn->rssadapt, rs, wh,
1664 		    pktlen, NULL, 0);
1665 		rate = rs->ir_rates[ni->in_txrate];
1666 	}
1667 
1668 	rate &= IEEE80211_RATE_VAL;
1669 	if (rate <= 0) {
1670 		rate = 2;	/* basic rate */
1671 	}
1672 
1673 	/* remember link conditions for rate adaptation algorithm */
1674 	if (ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE) {
1675 		data->id.id_len = pktlen;
1676 		data->id.id_rateidx = ni->in_txrate;
1677 		data->id.id_node = ni;
1678 		data->id.id_rssi = ni->in_rssi;
1679 	} else
1680 		data->id.id_node = NULL;
1681 
1682 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1683 		flags |= RT2560_TX_ACK;
1684 
1685 		dur = rt2560_txtime(RAL_ACK_SIZE, rt2560_ack_rate(ic, rate),
1686 		    ic->ic_flags) + RAL_SIFS;
1687 		/* LINTED E_BAD_PTR_CAST_ALIGN */
1688 		*(uint16_t *)wh->i_dur = LE_16(dur);
1689 	}
1690 
1691 	/* flags |= RT2560_TX_CIPHER_NONE; */
1692 	rt2560_setup_tx_desc(sc, desc, flags, pktlen, rate, 0);
1693 
1694 	idx = sc->txq.cur;
1695 
1696 	dr = &sc->txq.dr_txbuf[idx];
1697 	(void) ddi_dma_sync(dr->dr_hnd, 0, RAL_TXBUF_SIZE, DDI_DMA_SYNC_FORDEV);
1698 
1699 	dr = &sc->txq.dr_desc;
1700 	(void) ddi_dma_sync(dr->dr_hnd, idx * RT2560_TX_DESC_SIZE,
1701 	    RT2560_TX_DESC_SIZE, DDI_DMA_SYNC_FORDEV);
1702 
1703 	RAL_DEBUG(RAL_DBG_TX, "sending data frame len=%u idx=%u rate=%u\n",
1704 	    pktlen, sc->txq.cur, rate);
1705 
1706 	/* kick tx */
1707 	sc->txq.queued++;
1708 	sc->txq.cur = (sc->txq.cur + 1) % RT2560_TX_RING_COUNT;
1709 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_TX);
1710 
1711 	sc->sc_tx_timer = 5;
1712 
1713 	ic->ic_stats.is_tx_frags++;
1714 	ic->ic_stats.is_tx_bytes += pktlen;
1715 
1716 	freemsg(mp);
1717 fail3:
1718 	ieee80211_free_node(ni);
1719 fail2:
1720 	freemsg(m);
1721 fail1:
1722 	mutex_exit(&sc->txq.tx_lock);
1723 	return (err);
1724 }
1725 
1726 static mblk_t *
1727 rt2560_m_tx(void *arg, mblk_t *mp)
1728 {
1729 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
1730 	struct ieee80211com *ic = &sc->sc_ic;
1731 	mblk_t *next;
1732 
1733 	if (!RAL_IS_RUNNING(sc)) {
1734 		freemsgchain(mp);
1735 		return (NULL);
1736 	}
1737 	/*
1738 	 * No data frames go out unless we're associated; this
1739 	 * should not happen as the 802.11 layer does not enable
1740 	 * the xmit queue until we enter the RUN state.
1741 	 */
1742 	if (ic->ic_state != IEEE80211_S_RUN) {
1743 		RAL_DEBUG(RAL_DBG_TX, "ral: rt2560_m_tx(): "
1744 		    "discard, state %u\n", ic->ic_state);
1745 		freemsgchain(mp);
1746 		return (NULL);
1747 	}
1748 
1749 	while (mp != NULL) {
1750 		next = mp->b_next;
1751 		mp->b_next = NULL;
1752 		if (rt2560_send(ic, mp) != DDI_SUCCESS) {
1753 			mp->b_next = next;
1754 			freemsgchain(mp);
1755 			return (NULL);
1756 		}
1757 		mp = next;
1758 	}
1759 	return (mp);
1760 }
1761 
1762 static void
1763 rt2560_set_macaddr(struct rt2560_softc *sc, uint8_t *addr)
1764 {
1765 	uint32_t tmp;
1766 
1767 	tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
1768 	RAL_WRITE(sc, RT2560_CSR3, tmp);
1769 
1770 	tmp = addr[4] | addr[5] << 8;
1771 	RAL_WRITE(sc, RT2560_CSR4, tmp);
1772 
1773 	RAL_DEBUG(RAL_DBG_HW,
1774 	    "setting MAC address to " MACSTR "\n", MAC2STR(addr));
1775 }
1776 
1777 static void
1778 rt2560_get_macaddr(struct rt2560_softc *sc, uint8_t *addr)
1779 {
1780 	uint32_t tmp;
1781 
1782 	tmp = RAL_READ(sc, RT2560_CSR3);
1783 	addr[0] = tmp & 0xff;
1784 	addr[1] = (tmp >>  8) & 0xff;
1785 	addr[2] = (tmp >> 16) & 0xff;
1786 	addr[3] = (tmp >> 24);
1787 
1788 	tmp = RAL_READ(sc, RT2560_CSR4);
1789 	addr[4] = tmp & 0xff;
1790 	addr[5] = (tmp >> 8) & 0xff;
1791 }
1792 
1793 static void
1794 rt2560_update_promisc(struct rt2560_softc *sc)
1795 {
1796 	uint32_t tmp;
1797 
1798 	tmp = RAL_READ(sc, RT2560_RXCSR0);
1799 	tmp &= ~RT2560_DROP_NOT_TO_ME;
1800 	if (!(sc->sc_rcr & RAL_RCR_PROMISC))
1801 		tmp |= RT2560_DROP_NOT_TO_ME;
1802 
1803 	RAL_WRITE(sc, RT2560_RXCSR0, tmp);
1804 	RAL_DEBUG(RAL_DBG_HW, "%s promiscuous mode\n",
1805 	    (sc->sc_rcr & RAL_RCR_PROMISC) ?  "entering" : "leaving");
1806 }
1807 
1808 static const char *
1809 rt2560_get_rf(int rev)
1810 {
1811 	switch (rev) {
1812 	case RT2560_RF_2522:	return ("RT2522");
1813 	case RT2560_RF_2523:	return ("RT2523");
1814 	case RT2560_RF_2524:	return ("RT2524");
1815 	case RT2560_RF_2525:	return ("RT2525");
1816 	case RT2560_RF_2525E:	return ("RT2525e");
1817 	case RT2560_RF_2526:	return ("RT2526");
1818 	case RT2560_RF_5222:	return ("RT5222");
1819 	default:		return ("unknown");
1820 	}
1821 }
1822 
1823 static void
1824 rt2560_read_eeprom(struct rt2560_softc *sc)
1825 {
1826 	uint16_t val;
1827 	int i;
1828 
1829 	val = rt2560_eeprom_read(sc, RT2560_EEPROM_CONFIG0);
1830 	sc->rf_rev =   (val >> 11) & 0x7;
1831 	sc->hw_radio = (val >> 10) & 0x1;
1832 	sc->led_mode = (val >> 6)  & 0x7;
1833 	sc->rx_ant =   (val >> 4)  & 0x3;
1834 	sc->tx_ant =   (val >> 2)  & 0x3;
1835 	sc->nb_ant =   val & 0x3;
1836 
1837 	/* read default values for BBP registers */
1838 	for (i = 0; i < 16; i++) {
1839 		val = rt2560_eeprom_read(sc, RT2560_EEPROM_BBP_BASE + i);
1840 		sc->bbp_prom[i].reg = val >> 8;
1841 		sc->bbp_prom[i].val = val & 0xff;
1842 	}
1843 
1844 	/* read Tx power for all b/g channels */
1845 	for (i = 0; i < 14 / 2; i++) {
1846 		val = rt2560_eeprom_read(sc, RT2560_EEPROM_TXPOWER + i);
1847 		sc->txpow[i * 2] = val >> 8;
1848 		sc->txpow[i * 2 + 1] = val & 0xff;
1849 	}
1850 }
1851 
1852 static int
1853 rt2560_bbp_init(struct rt2560_softc *sc)
1854 {
1855 #define	N(a)	(sizeof (a) / sizeof ((a)[0]))
1856 	int i, ntries;
1857 
1858 	/* wait for BBP to be ready */
1859 	for (ntries = 0; ntries < 100; ntries++) {
1860 		if (rt2560_bbp_read(sc, RT2560_BBP_VERSION) != 0)
1861 			break;
1862 		drv_usecwait(1);
1863 	}
1864 	if (ntries == 100) {
1865 		RAL_DEBUG(RAL_DBG_HW, "timeout waiting for BBP\n");
1866 		return (EIO);
1867 	}
1868 	/* initialize BBP registers to default values */
1869 	for (i = 0; i < N(rt2560_def_bbp); i++) {
1870 		rt2560_bbp_write(sc, rt2560_def_bbp[i].reg,
1871 		    rt2560_def_bbp[i].val);
1872 	}
1873 
1874 	return (0);
1875 #undef N
1876 }
1877 
1878 static void
1879 rt2560_set_txantenna(struct rt2560_softc *sc, int antenna)
1880 {
1881 	uint32_t tmp;
1882 	uint8_t tx;
1883 
1884 	tx = rt2560_bbp_read(sc, RT2560_BBP_TX) & ~RT2560_BBP_ANTMASK;
1885 	if (antenna == 1)
1886 		tx |= RT2560_BBP_ANTA;
1887 	else if (antenna == 2)
1888 		tx |= RT2560_BBP_ANTB;
1889 	else
1890 		tx |= RT2560_BBP_DIVERSITY;
1891 
1892 	/* need to force I/Q flip for RF 2525e, 2526 and 5222 */
1893 	if (sc->rf_rev == RT2560_RF_2525E || sc->rf_rev == RT2560_RF_2526 ||
1894 	    sc->rf_rev == RT2560_RF_5222)
1895 		tx |= RT2560_BBP_FLIPIQ;
1896 
1897 	rt2560_bbp_write(sc, RT2560_BBP_TX, tx);
1898 
1899 	/* update values for CCK and OFDM in BBPCSR1 */
1900 	tmp = RAL_READ(sc, RT2560_BBPCSR1) & ~0x00070007;
1901 	tmp |= (tx & 0x7) << 16 | (tx & 0x7);
1902 	RAL_WRITE(sc, RT2560_BBPCSR1, tmp);
1903 }
1904 
1905 static void
1906 rt2560_set_rxantenna(struct rt2560_softc *sc, int antenna)
1907 {
1908 	uint8_t rx;
1909 
1910 	rx = rt2560_bbp_read(sc, RT2560_BBP_RX) & ~RT2560_BBP_ANTMASK;
1911 	if (antenna == 1)
1912 		rx |= RT2560_BBP_ANTA;
1913 	else if (antenna == 2)
1914 		rx |= RT2560_BBP_ANTB;
1915 	else
1916 		rx |= RT2560_BBP_DIVERSITY;
1917 
1918 	/* need to force no I/Q flip for RF 2525e and 2526 */
1919 	if (sc->rf_rev == RT2560_RF_2525E || sc->rf_rev == RT2560_RF_2526)
1920 		rx &= ~RT2560_BBP_FLIPIQ;
1921 
1922 	rt2560_bbp_write(sc, RT2560_BBP_RX, rx);
1923 }
1924 
1925 static void
1926 rt2560_stop(struct rt2560_softc *sc)
1927 {
1928 	struct ieee80211com *ic = &sc->sc_ic;
1929 
1930 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
1931 	ieee80211_stop_watchdog(ic);	/* stop the watchdog */
1932 
1933 	RAL_LOCK(sc);
1934 	sc->sc_tx_timer = 0;
1935 
1936 	/* abort Tx */
1937 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_ABORT_TX);
1938 
1939 	/* disable Rx */
1940 	RAL_WRITE(sc, RT2560_RXCSR0, RT2560_DISABLE_RX);
1941 
1942 	/* reset ASIC (imply reset BBP) */
1943 	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
1944 	RAL_WRITE(sc, RT2560_CSR1, 0);
1945 
1946 	/* disable interrupts */
1947 	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
1948 
1949 	/* reset Tx and Rx rings */
1950 	rt2560_reset_tx_ring(sc, &sc->txq);
1951 	rt2560_reset_tx_ring(sc, &sc->prioq);
1952 	rt2560_reset_rx_ring(sc, &sc->rxq);
1953 	RAL_UNLOCK(sc);
1954 }
1955 
1956 static int
1957 rt2560_init(struct rt2560_softc *sc)
1958 {
1959 #define	N(a)	(sizeof (a) / sizeof ((a)[0]))
1960 	/* struct rt2560_softc *sc = priv; */
1961 	struct ieee80211com *ic = &sc->sc_ic;
1962 	uint32_t tmp;
1963 	int i;
1964 
1965 	rt2560_stop(sc);
1966 
1967 	RAL_LOCK(sc);
1968 	/* setup tx/rx ring */
1969 	rt2560_ring_hwsetup(sc);
1970 
1971 	/* initialize MAC registers to default values */
1972 	for (i = 0; i < N(rt2560_def_mac); i++)
1973 		RAL_WRITE(sc, rt2560_def_mac[i].reg, rt2560_def_mac[i].val);
1974 
1975 	rt2560_set_macaddr(sc, ic->ic_macaddr);
1976 
1977 	/* set basic rate set (will be updated later) */
1978 	RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x153);
1979 
1980 	rt2560_set_txantenna(sc, sc->tx_ant);
1981 	rt2560_set_rxantenna(sc, sc->rx_ant);
1982 	rt2560_update_slot(ic, 1);
1983 	rt2560_update_plcp(sc);
1984 	rt2560_update_led(sc, 0, 0);
1985 
1986 	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
1987 	RAL_WRITE(sc, RT2560_CSR1, RT2560_HOST_READY);
1988 
1989 	if (rt2560_bbp_init(sc) != 0) {
1990 		RAL_UNLOCK(sc);
1991 		rt2560_stop(sc);
1992 		return (DDI_FAILURE);
1993 	}
1994 
1995 	/* set default BSS channel */
1996 	rt2560_set_chan(sc, ic->ic_curchan);
1997 
1998 	/* kick Rx */
1999 	tmp = RT2560_DROP_PHY_ERROR | RT2560_DROP_CRC_ERROR;
2000 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2001 		tmp |= RT2560_DROP_CTL | RT2560_DROP_VERSION_ERROR;
2002 		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
2003 			tmp |= RT2560_DROP_TODS;
2004 		if (!(sc->sc_rcr & RAL_RCR_PROMISC))
2005 			tmp |= RT2560_DROP_NOT_TO_ME;
2006 
2007 	}
2008 	RAL_WRITE(sc, RT2560_RXCSR0, tmp);
2009 
2010 	/* clear old FCS and Rx FIFO errors */
2011 	(void) RAL_READ(sc, RT2560_CNT0);
2012 	(void) RAL_READ(sc, RT2560_CNT4);
2013 
2014 	/* clear any pending interrupts */
2015 	RAL_WRITE(sc, RT2560_CSR7, 0xffffffff);
2016 	/* enable interrupts */
2017 	RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
2018 
2019 	RAL_UNLOCK(sc);
2020 #undef N
2021 	return (DDI_SUCCESS);
2022 }
2023 
2024 void
2025 rt2560_watchdog(void *arg)
2026 {
2027 	struct rt2560_softc *sc = arg;
2028 	struct ieee80211com *ic = &sc->sc_ic;
2029 	int ntimer = 0;
2030 
2031 	RAL_LOCK(sc);
2032 	ic->ic_watchdog_timer = 0;
2033 
2034 	if (!RAL_IS_RUNNING(sc)) {
2035 		RAL_UNLOCK(sc);
2036 		return;
2037 	}
2038 
2039 	if (sc->sc_tx_timer > 0) {
2040 		if (--sc->sc_tx_timer == 0) {
2041 			RAL_DEBUG(RAL_DBG_MSG, "tx timer timeout\n");
2042 			RAL_UNLOCK(sc);
2043 			(void) rt2560_init(sc);
2044 			(void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2045 			return;
2046 		}
2047 	}
2048 
2049 	if (ic->ic_state == IEEE80211_S_RUN)
2050 		ntimer = 1;
2051 
2052 	RAL_UNLOCK(sc);
2053 
2054 	ieee80211_watchdog(ic);
2055 
2056 	if (ntimer)
2057 		ieee80211_start_watchdog(ic, ntimer);
2058 }
2059 
2060 static int
2061 rt2560_m_start(void *arg)
2062 {
2063 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2064 	crypto_mech_type_t type;
2065 	int err;
2066 
2067 
2068 	type = crypto_mech2id(SUN_CKM_RC4); /* load rc4 module into kernel */
2069 	RAL_DEBUG(RAL_DBG_GLD, "enter rt2560_m_start(%d)\n", type);
2070 
2071 	/*
2072 	 * initialize rt2560 hardware
2073 	 */
2074 	err = rt2560_init(sc);
2075 	if (err != DDI_SUCCESS) {
2076 		RAL_DEBUG(RAL_DBG_GLD, "device configuration failed\n");
2077 		goto fail;
2078 	}
2079 	sc->sc_flags |= RAL_FLAG_RUNNING;	/* RUNNING */
2080 	return (err);
2081 
2082 fail:
2083 	rt2560_stop(sc);
2084 	return (err);
2085 }
2086 
2087 static void
2088 rt2560_m_stop(void *arg)
2089 {
2090 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2091 
2092 	RAL_DEBUG(RAL_DBG_GLD, "enter rt2560_m_stop()\n");
2093 
2094 	(void) rt2560_stop(sc);
2095 	sc->sc_flags &= ~RAL_FLAG_RUNNING;	/* STOP */
2096 }
2097 
2098 static int
2099 rt2560_m_unicst(void *arg, const uint8_t *macaddr)
2100 {
2101 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2102 	struct ieee80211com *ic = &sc->sc_ic;
2103 
2104 	RAL_DEBUG(RAL_DBG_GLD, "rt2560_m_unicst(): " MACSTR "\n",
2105 	    MAC2STR(macaddr));
2106 
2107 	IEEE80211_ADDR_COPY(ic->ic_macaddr, macaddr);
2108 	(void) rt2560_set_macaddr(sc, (uint8_t *)macaddr);
2109 	(void) rt2560_init(sc);
2110 
2111 	return (0);
2112 }
2113 
2114 /*ARGSUSED*/
2115 static int
2116 rt2560_m_multicst(void *arg, boolean_t add, const uint8_t *mca)
2117 {
2118 	return (0);
2119 }
2120 
2121 static int
2122 rt2560_m_promisc(void *arg, boolean_t on)
2123 {
2124 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2125 
2126 	RAL_DEBUG(RAL_DBG_GLD, "rt2560_m_promisc()\n");
2127 
2128 	if (on) {
2129 		sc->sc_rcr |= RAL_RCR_PROMISC;
2130 		sc->sc_rcr |= RAL_RCR_MULTI;
2131 	} else {
2132 		sc->sc_rcr &= ~RAL_RCR_PROMISC;
2133 		sc->sc_rcr &= ~RAL_RCR_PROMISC;
2134 	}
2135 
2136 	rt2560_update_promisc(sc);
2137 	return (0);
2138 }
2139 
2140 /*
2141  * callback functions for /get/set properties
2142  */
2143 static int
2144 rt2560_m_setprop(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
2145     uint_t wldp_length, const void *wldp_buf)
2146 {
2147 	struct rt2560_softc *sc = arg;
2148 	struct ieee80211com *ic = &sc->sc_ic;
2149 	int err;
2150 
2151 	err = ieee80211_setprop(ic, pr_name, wldp_pr_num,
2152 	    wldp_length, wldp_buf);
2153 	RAL_LOCK(sc);
2154 	if (err == ENETRESET) {
2155 		if (RAL_IS_RUNNING(sc)) {
2156 			RAL_UNLOCK(sc);
2157 			(void) rt2560_init(sc);
2158 			(void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2159 			RAL_LOCK(sc);
2160 		}
2161 		err = 0;
2162 	}
2163 	RAL_UNLOCK(sc);
2164 
2165 	return (err);
2166 }
2167 
2168 static int
2169 rt2560_m_getprop(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
2170     uint_t pr_flags, uint_t wldp_length, void *wldp_buf, uint_t *perm)
2171 {
2172 	struct rt2560_softc *sc = arg;
2173 	int err;
2174 
2175 	err = ieee80211_getprop(&sc->sc_ic, pr_name, wldp_pr_num,
2176 	    pr_flags, wldp_length, wldp_buf, perm);
2177 
2178 	return (err);
2179 }
2180 
2181 static void
2182 rt2560_m_ioctl(void* arg, queue_t *wq, mblk_t *mp)
2183 {
2184 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2185 	struct ieee80211com *ic = &sc->sc_ic;
2186 	int err;
2187 
2188 	err = ieee80211_ioctl(ic, wq, mp);
2189 	RAL_LOCK(sc);
2190 	if (err == ENETRESET) {
2191 		if (RAL_IS_RUNNING(sc)) {
2192 			RAL_UNLOCK(sc);
2193 			(void) rt2560_init(sc);
2194 			(void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2195 			RAL_LOCK(sc);
2196 		}
2197 	}
2198 	RAL_UNLOCK(sc);
2199 }
2200 
2201 static int
2202 rt2560_m_stat(void *arg, uint_t stat, uint64_t *val)
2203 {
2204 	struct rt2560_softc *sc  = (struct rt2560_softc *)arg;
2205 	ieee80211com_t	*ic = &sc->sc_ic;
2206 	ieee80211_node_t *ni = ic->ic_bss;
2207 	struct ieee80211_rateset *rs = &ni->in_rates;
2208 
2209 	RAL_LOCK(sc);
2210 	switch (stat) {
2211 	case MAC_STAT_IFSPEED:
2212 		*val = ((ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE) ?
2213 		    (rs->ir_rates[ni->in_txrate] & IEEE80211_RATE_VAL)
2214 		    : ic->ic_fixed_rate) / 2 * 1000000;
2215 		break;
2216 	case MAC_STAT_NOXMTBUF:
2217 		*val = sc->sc_tx_nobuf;
2218 		break;
2219 	case MAC_STAT_NORCVBUF:
2220 		*val = sc->sc_rx_nobuf;
2221 		break;
2222 	case MAC_STAT_IERRORS:
2223 		*val = sc->sc_rx_err;
2224 		break;
2225 	case MAC_STAT_RBYTES:
2226 		*val = ic->ic_stats.is_rx_bytes;
2227 		break;
2228 	case MAC_STAT_IPACKETS:
2229 		*val = ic->ic_stats.is_rx_frags;
2230 		break;
2231 	case MAC_STAT_OBYTES:
2232 		*val = ic->ic_stats.is_tx_bytes;
2233 		break;
2234 	case MAC_STAT_OPACKETS:
2235 		*val = ic->ic_stats.is_tx_frags;
2236 		break;
2237 	case MAC_STAT_OERRORS:
2238 	case WIFI_STAT_TX_FAILED:
2239 		*val = sc->sc_tx_err;
2240 		break;
2241 	case WIFI_STAT_TX_RETRANS:
2242 		*val = sc->sc_tx_retries;
2243 		break;
2244 	case WIFI_STAT_FCS_ERRORS:
2245 	case WIFI_STAT_WEP_ERRORS:
2246 	case WIFI_STAT_TX_FRAGS:
2247 	case WIFI_STAT_MCAST_TX:
2248 	case WIFI_STAT_RTS_SUCCESS:
2249 	case WIFI_STAT_RTS_FAILURE:
2250 	case WIFI_STAT_ACK_FAILURE:
2251 	case WIFI_STAT_RX_FRAGS:
2252 	case WIFI_STAT_MCAST_RX:
2253 	case WIFI_STAT_RX_DUPS:
2254 		RAL_UNLOCK(sc);
2255 		return (ieee80211_stat(ic, stat, val));
2256 	default:
2257 		RAL_UNLOCK(sc);
2258 		return (ENOTSUP);
2259 	}
2260 	RAL_UNLOCK(sc);
2261 
2262 	return (0);
2263 }
2264 
2265 static uint_t
2266 rt2560_intr(caddr_t arg)
2267 {
2268 	/* LINTED E_BAD_PTR_CAST_ALIGN */
2269 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2270 	uint32_t r;
2271 
2272 	RAL_LOCK(sc);
2273 
2274 	if (!RAL_IS_RUNNING(sc)) {
2275 		/*
2276 		 * The hardware is not ready/present, don't touch anything.
2277 		 * Note this can happen early on if the IRQ is shared.
2278 		 */
2279 		RAL_UNLOCK(sc);
2280 		return (DDI_INTR_UNCLAIMED);
2281 	}
2282 
2283 	r = RAL_READ(sc, RT2560_CSR7);
2284 	RAL_WRITE(sc, RT2560_CSR7, r);
2285 
2286 	if (r == 0xffffffff) {
2287 		RAL_UNLOCK(sc);
2288 		return (DDI_INTR_UNCLAIMED);
2289 	}
2290 
2291 	if (!(r & RT2560_INTR_ALL)) {
2292 		RAL_UNLOCK(sc);
2293 		return (DDI_INTR_UNCLAIMED);
2294 	}
2295 
2296 	/* disable interrupts */
2297 	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
2298 
2299 	if (r & RT2560_TX_DONE) {
2300 		RAL_UNLOCK(sc);
2301 		rt2560_tx_intr(sc);
2302 		RAL_LOCK(sc);
2303 	}
2304 
2305 	if (r & RT2560_PRIO_DONE) {
2306 		RAL_UNLOCK(sc);
2307 		rt2560_prio_intr(sc);
2308 		RAL_LOCK(sc);
2309 	}
2310 
2311 	if (r & RT2560_RX_DONE) {
2312 		sc->sc_rx_pend = 1;
2313 		ddi_trigger_softintr(sc->sc_softint_id);
2314 	}
2315 
2316 	/* re-enable interrupts */
2317 	RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
2318 	RAL_UNLOCK(sc);
2319 
2320 	return (DDI_INTR_CLAIMED);
2321 }
2322 
2323 /*
2324  * quiesce(9E) entry point.
2325  *
2326  * This function is called when the system is single-threaded at high
2327  * PIL with preemption disabled. Therefore, this function must not be
2328  * blocked.
2329  *
2330  * This function returns DDI_SUCCESS on success, or DDI_FAILURE on failure.
2331  * DDI_FAILURE indicates an error condition and should almost never happen.
2332  */
2333 static int32_t
2334 rt2560_quiesce(dev_info_t *devinfo)
2335 {
2336 	struct rt2560_softc *sc;
2337 
2338 	sc = ddi_get_soft_state(ral_soft_state_p, ddi_get_instance(devinfo));
2339 	if (sc == NULL)
2340 		return (DDI_FAILURE);
2341 
2342 	/* abort Tx */
2343 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_ABORT_TX);
2344 
2345 	/* disable Rx */
2346 	RAL_WRITE(sc, RT2560_RXCSR0, RT2560_DISABLE_RX);
2347 
2348 	/* reset ASIC (imply reset BBP) */
2349 	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
2350 	RAL_WRITE(sc, RT2560_CSR1, 0);
2351 
2352 	/* disable interrupts */
2353 	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
2354 
2355 	return (DDI_SUCCESS);
2356 }
2357 
2358 static int
2359 rt2560_attach(dev_info_t *devinfo, ddi_attach_cmd_t cmd)
2360 {
2361 	struct rt2560_softc *sc;
2362 	struct ieee80211com *ic;
2363 	int err, i;
2364 	int instance;
2365 
2366 	ddi_acc_handle_t ioh;
2367 	caddr_t regs;
2368 	uint16_t vendor_id, device_id, command;
2369 	uint8_t cachelsz;
2370 	char strbuf[32];
2371 
2372 	wifi_data_t wd = { 0 };
2373 	mac_register_t *macp;
2374 
2375 	RAL_DEBUG(RAL_DBG_GLD, "enter rt2560_attach()\n");
2376 
2377 	switch (cmd) {
2378 	case DDI_ATTACH:
2379 		break;
2380 	case DDI_RESUME:
2381 		sc = ddi_get_soft_state(ral_soft_state_p,
2382 		    ddi_get_instance(devinfo));
2383 		sc->sc_flags &= ~RAL_FLAG_SUSPENDING;
2384 		if (RAL_IS_INITED(sc))
2385 			(void) rt2560_init(sc);
2386 		RAL_DEBUG(RAL_DBG_SUSPEND, "ral resume ...\n");
2387 		return (DDI_SUCCESS);
2388 	default:
2389 		return (DDI_FAILURE);
2390 	}
2391 
2392 	instance = ddi_get_instance(devinfo);
2393 
2394 	if (ddi_soft_state_zalloc(ral_soft_state_p, instance) != DDI_SUCCESS) {
2395 		RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2396 		    "unable to alloc soft_state_p\n");
2397 		return (DDI_FAILURE);
2398 	}
2399 
2400 	sc = ddi_get_soft_state(ral_soft_state_p, instance);
2401 	ic = (ieee80211com_t *)&sc->sc_ic;
2402 	sc->sc_dev = devinfo;
2403 
2404 	/* pci configuration */
2405 	err = ddi_regs_map_setup(devinfo, 0, &regs, 0, 0, &ral_csr_accattr,
2406 	    &ioh);
2407 	if (err != DDI_SUCCESS) {
2408 		RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2409 		    "ddi_regs_map_setup() failed");
2410 		goto fail1;
2411 	}
2412 
2413 	cachelsz = ddi_get8(ioh, (uint8_t *)(regs + PCI_CONF_CACHE_LINESZ));
2414 	if (cachelsz == 0)
2415 		cachelsz = 0x10;
2416 	sc->sc_cachelsz = cachelsz << 2;
2417 
2418 	vendor_id = ddi_get16(ioh,
2419 	    (uint16_t *)((uintptr_t)regs + PCI_CONF_VENID));
2420 	device_id = ddi_get16(ioh,
2421 	    (uint16_t *)((uintptr_t)regs + PCI_CONF_DEVID));
2422 
2423 	RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): vendor 0x%x, "
2424 	    "device id 0x%x, cache size %d\n", vendor_id, device_id, cachelsz);
2425 
2426 	/*
2427 	 * Enable response to memory space accesses,
2428 	 * and enabe bus master.
2429 	 */
2430 	command = PCI_COMM_MAE | PCI_COMM_ME;
2431 	ddi_put16(ioh, (uint16_t *)((uintptr_t)regs + PCI_CONF_COMM), command);
2432 	RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2433 	    "set command reg to 0x%x \n", command);
2434 
2435 	ddi_put8(ioh, (uint8_t *)(regs + PCI_CONF_LATENCY_TIMER), 0xa8);
2436 	ddi_put8(ioh, (uint8_t *)(regs + PCI_CONF_ILINE), 0x10);
2437 	ddi_regs_map_free(&ioh);
2438 
2439 	/* pci i/o space */
2440 	err = ddi_regs_map_setup(devinfo, 1,
2441 	    &sc->sc_rbase, 0, 0, &ral_csr_accattr, &sc->sc_ioh);
2442 	RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2443 	    "regs map1 = %x err=%d\n", regs, err);
2444 	if (err != DDI_SUCCESS) {
2445 		RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2446 		    "ddi_regs_map_setup() failed");
2447 		goto fail1;
2448 	}
2449 
2450 	/* initialize the ral rate */
2451 	ral_rate_init();
2452 
2453 	/* retrieve RT2560 rev. no */
2454 	sc->asic_rev = RAL_READ(sc, RT2560_CSR0);
2455 
2456 	/* retrieve MAC address */
2457 	rt2560_get_macaddr(sc, ic->ic_macaddr);
2458 
2459 	/* retrieve RF rev. no and various other things from EEPROM */
2460 	rt2560_read_eeprom(sc);
2461 
2462 	RAL_DEBUG(RAL_DBG_GLD, "MAC/BBP RT2560 (rev 0x%02x), RF %s\n",
2463 	    sc->asic_rev, rt2560_get_rf(sc->rf_rev));
2464 
2465 	/*
2466 	 * Allocate Tx and Rx rings.
2467 	 */
2468 	err = rt2560_alloc_tx_ring(sc, &sc->txq, RT2560_TX_RING_COUNT);
2469 	if (err != DDI_SUCCESS) {
2470 		RAL_DEBUG(RAL_DBG_GLD, "could not allocate Tx ring\n");
2471 		goto fail2;
2472 	}
2473 	err = rt2560_alloc_tx_ring(sc, &sc->prioq, RT2560_PRIO_RING_COUNT);
2474 	if (err != DDI_SUCCESS) {
2475 		RAL_DEBUG(RAL_DBG_GLD, "could not allocate Prio ring\n");
2476 		goto fail3;
2477 	}
2478 	err = rt2560_alloc_rx_ring(sc, &sc->rxq, RT2560_RX_RING_COUNT);
2479 	if (err != DDI_SUCCESS) {
2480 		RAL_DEBUG(RAL_DBG_GLD, "could not allocate Rx ring\n");
2481 		goto fail4;
2482 	}
2483 
2484 	mutex_init(&sc->sc_genlock, NULL, MUTEX_DRIVER, NULL);
2485 	mutex_init(&sc->txq.tx_lock, NULL, MUTEX_DRIVER, NULL);
2486 	mutex_init(&sc->prioq.tx_lock, NULL, MUTEX_DRIVER, NULL);
2487 	mutex_init(&sc->rxq.rx_lock, NULL, MUTEX_DRIVER, NULL);
2488 
2489 
2490 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
2491 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
2492 	ic->ic_state = IEEE80211_S_INIT;
2493 
2494 	ic->ic_maxrssi = 63;
2495 	ic->ic_set_shortslot = rt2560_update_slot;
2496 	ic->ic_xmit = rt2560_mgmt_send;
2497 
2498 	/* set device capabilities */
2499 	ic->ic_caps =
2500 	    IEEE80211_C_TXPMGT |	/* tx power management */
2501 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
2502 	    IEEE80211_C_SHSLOT;		/* short slot time supported */
2503 
2504 	ic->ic_caps |= IEEE80211_C_WPA; /* Support WPA/WPA2 */
2505 
2506 #define	IEEE80211_CHAN_A	\
2507 	(IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_OFDM)
2508 
2509 	if (sc->rf_rev == RT2560_RF_5222) {
2510 		/* set supported .11a rates */
2511 		ic->ic_sup_rates[IEEE80211_MODE_11A] = rt2560_rateset_11a;
2512 
2513 		/* set supported .11a channels */
2514 		for (i = 36; i <= 64; i += 4) {
2515 			ic->ic_sup_channels[i].ich_freq =
2516 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2517 			ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2518 		}
2519 		for (i = 100; i <= 140; i += 4) {
2520 			ic->ic_sup_channels[i].ich_freq =
2521 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2522 			ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2523 		}
2524 		for (i = 149; i <= 161; i += 4) {
2525 			ic->ic_sup_channels[i].ich_freq =
2526 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2527 			ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2528 		}
2529 	}
2530 
2531 	/* set supported .11b and .11g rates */
2532 	ic->ic_sup_rates[IEEE80211_MODE_11B] = rt2560_rateset_11b;
2533 	ic->ic_sup_rates[IEEE80211_MODE_11G] = rt2560_rateset_11g;
2534 
2535 	/* set supported .11b and .11g channels (1 through 14) */
2536 	for (i = 1; i <= 14; i++) {
2537 		ic->ic_sup_channels[i].ich_freq =
2538 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
2539 		ic->ic_sup_channels[i].ich_flags =
2540 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
2541 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
2542 	}
2543 
2544 	ieee80211_attach(ic);
2545 
2546 	/* register WPA door */
2547 	ieee80211_register_door(ic, ddi_driver_name(devinfo),
2548 	    ddi_get_instance(devinfo));
2549 
2550 	ic->ic_node_alloc = rt2560_node_alloc;
2551 	ic->ic_node_free = rt2560_node_free;
2552 
2553 	/* override state transition machine */
2554 	sc->sc_newstate = ic->ic_newstate;
2555 	ic->ic_newstate = rt2560_newstate;
2556 	ic->ic_watchdog = rt2560_watchdog;
2557 	ieee80211_media_init(ic);
2558 	ic->ic_def_txkey = 0;
2559 
2560 	sc->sc_rcr = 0;
2561 	sc->sc_rx_pend = 0;
2562 	sc->dwelltime = 300;
2563 	sc->sc_flags &= ~RAL_FLAG_RUNNING;
2564 
2565 	err = ddi_add_softintr(devinfo, DDI_SOFTINT_LOW,
2566 	    &sc->sc_softint_id, NULL, 0, ral_softint_handler, (caddr_t)sc);
2567 	if (err != DDI_SUCCESS) {
2568 		RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2569 		    "ddi_add_softintr() failed");
2570 		goto fail5;
2571 	}
2572 
2573 	err = ddi_get_iblock_cookie(devinfo, 0, &sc->sc_iblock);
2574 	if (err != DDI_SUCCESS) {
2575 		RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2576 		    "Can not get iblock cookie for INT\n");
2577 		goto fail6;
2578 	}
2579 
2580 	err = ddi_add_intr(devinfo, 0, NULL, NULL, rt2560_intr, (caddr_t)sc);
2581 	if (err != DDI_SUCCESS) {
2582 		RAL_DEBUG(RAL_DBG_GLD,
2583 		    "unable to add device interrupt handler\n");
2584 		goto fail6;
2585 	}
2586 
2587 	/*
2588 	 * Provide initial settings for the WiFi plugin; whenever this
2589 	 * information changes, we need to call mac_plugindata_update()
2590 	 */
2591 	wd.wd_opmode = ic->ic_opmode;
2592 	wd.wd_secalloc = WIFI_SEC_NONE;
2593 	IEEE80211_ADDR_COPY(wd.wd_bssid, ic->ic_bss->in_bssid);
2594 
2595 	if ((macp = mac_alloc(MAC_VERSION)) == NULL) {
2596 		RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2597 		    "MAC version mismatch\n");
2598 		goto fail7;
2599 	}
2600 
2601 	macp->m_type_ident	= MAC_PLUGIN_IDENT_WIFI;
2602 	macp->m_driver		= sc;
2603 	macp->m_dip		= devinfo;
2604 	macp->m_src_addr	= ic->ic_macaddr;
2605 	macp->m_callbacks	= &rt2560_m_callbacks;
2606 	macp->m_min_sdu		= 0;
2607 	macp->m_max_sdu		= IEEE80211_MTU;
2608 	macp->m_pdata		= &wd;
2609 	macp->m_pdata_size	= sizeof (wd);
2610 
2611 	err = mac_register(macp, &ic->ic_mach);
2612 	mac_free(macp);
2613 	if (err != 0) {
2614 		RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2615 		    "mac_register err %x\n", err);
2616 		goto fail7;
2617 	}
2618 
2619 	/*
2620 	 * Create minor node of type DDI_NT_NET_WIFI
2621 	 */
2622 	(void) snprintf(strbuf, sizeof (strbuf), "%s%d",
2623 	    "ral", instance);
2624 	err = ddi_create_minor_node(devinfo, strbuf, S_IFCHR,
2625 	    instance + 1, DDI_NT_NET_WIFI, 0);
2626 
2627 	if (err != DDI_SUCCESS)
2628 		RAL_DEBUG(RAL_DBG_GLD, "ddi_create_minor_node() failed\n");
2629 
2630 	/*
2631 	 * Notify link is down now
2632 	 */
2633 	mac_link_update(ic->ic_mach, LINK_STATE_DOWN);
2634 
2635 	RAL_DEBUG(RAL_DBG_GLD, "rt2560_attach() exit successfully.\n");
2636 	return (DDI_SUCCESS);
2637 fail7:
2638 	ddi_remove_intr(devinfo, 0, sc->sc_iblock);
2639 fail6:
2640 	ddi_remove_softintr(sc->sc_softint_id);
2641 fail5:
2642 	mutex_destroy(&sc->sc_genlock);
2643 	mutex_destroy(&sc->txq.tx_lock);
2644 	mutex_destroy(&sc->prioq.tx_lock);
2645 	mutex_destroy(&sc->rxq.rx_lock);
2646 
2647 	rt2560_free_rx_ring(sc, &sc->rxq);
2648 fail4:
2649 	rt2560_free_tx_ring(sc, &sc->prioq);
2650 fail3:
2651 	rt2560_free_tx_ring(sc, &sc->txq);
2652 fail2:
2653 	ddi_regs_map_free(&sc->sc_ioh);
2654 fail1:
2655 	ddi_soft_state_free(ral_soft_state_p, ddi_get_instance(devinfo));
2656 
2657 	return (DDI_FAILURE);
2658 }
2659 
2660 static int
2661 rt2560_detach(dev_info_t *devinfo, ddi_detach_cmd_t cmd)
2662 {
2663 	struct rt2560_softc *sc;
2664 
2665 	RAL_DEBUG(RAL_DBG_GLD, "enter rt2560_detach()\n");
2666 	sc = ddi_get_soft_state(ral_soft_state_p, ddi_get_instance(devinfo));
2667 
2668 	switch (cmd) {
2669 	case DDI_DETACH:
2670 		break;
2671 	case DDI_SUSPEND:
2672 		if (RAL_IS_INITED(sc))
2673 			(void) rt2560_stop(sc);
2674 		sc->sc_flags |= RAL_FLAG_SUSPENDING;
2675 		RAL_DEBUG(RAL_DBG_SUSPEND, "ral suspend ...\n");
2676 		return (DDI_SUCCESS);
2677 	default:
2678 		return (DDI_FAILURE);
2679 	}
2680 
2681 	if (mac_disable(sc->sc_ic.ic_mach) != 0)
2682 		return (DDI_FAILURE);
2683 
2684 	rt2560_stop(sc);
2685 
2686 	/*
2687 	 * Unregister from the MAC layer subsystem
2688 	 */
2689 	(void) mac_unregister(sc->sc_ic.ic_mach);
2690 
2691 	ddi_remove_intr(devinfo, 0, sc->sc_iblock);
2692 	ddi_remove_softintr(sc->sc_softint_id);
2693 
2694 	/*
2695 	 * detach ieee80211 layer
2696 	 */
2697 	ieee80211_detach(&sc->sc_ic);
2698 
2699 	rt2560_free_tx_ring(sc, &sc->txq);
2700 	rt2560_free_tx_ring(sc, &sc->prioq);
2701 	rt2560_free_rx_ring(sc, &sc->rxq);
2702 
2703 	ddi_regs_map_free(&sc->sc_ioh);
2704 
2705 	mutex_destroy(&sc->sc_genlock);
2706 	mutex_destroy(&sc->txq.tx_lock);
2707 	mutex_destroy(&sc->prioq.tx_lock);
2708 	mutex_destroy(&sc->rxq.rx_lock);
2709 
2710 	ddi_remove_minor_node(devinfo, NULL);
2711 	ddi_soft_state_free(ral_soft_state_p, ddi_get_instance(devinfo));
2712 
2713 	return (DDI_SUCCESS);
2714 }
2715 
2716 int
2717 _info(struct modinfo *modinfop)
2718 {
2719 	return (mod_info(&modlinkage, modinfop));
2720 }
2721 
2722 int
2723 _init(void)
2724 {
2725 	int status;
2726 
2727 	status = ddi_soft_state_init(&ral_soft_state_p,
2728 	    sizeof (struct rt2560_softc), 1);
2729 	if (status != 0)
2730 		return (status);
2731 
2732 	mac_init_ops(&ral_dev_ops, "ral");
2733 	status = mod_install(&modlinkage);
2734 	if (status != 0) {
2735 		mac_fini_ops(&ral_dev_ops);
2736 		ddi_soft_state_fini(&ral_soft_state_p);
2737 	}
2738 	return (status);
2739 }
2740 
2741 int
2742 _fini(void)
2743 {
2744 	int status;
2745 
2746 	status = mod_remove(&modlinkage);
2747 	if (status == 0) {
2748 		mac_fini_ops(&ral_dev_ops);
2749 		ddi_soft_state_fini(&ral_soft_state_p);
2750 	}
2751 	return (status);
2752 }
2753