xref: /illumos-gate/usr/src/uts/common/io/ral/rt2560.c (revision ed093b41a93e8563e6e1e5dae0768dda2a7bcc27)
1 /*
2  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
3  * Use is subject to license terms.
4  */
5 
6 /*
7  * Copyright (c) 2005, 2006
8  *	Damien Bergamini <damien.bergamini@free.fr>
9  *
10  * Permission to use, copy, modify, and distribute this software for any
11  * purpose with or without fee is hereby granted, provided that the above
12  * copyright notice and this permission notice appear in all copies.
13  *
14  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
15  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
16  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
17  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
18  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
20  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21  */
22 
23 /*
24  * Ralink Technology RT2560 chipset driver
25  * http://www.ralinktech.com/
26  */
27 
28 #include <sys/types.h>
29 #include <sys/byteorder.h>
30 #include <sys/cmn_err.h>
31 #include <sys/stat.h>
32 #include <sys/pci.h>
33 #include <sys/ddi.h>
34 #include <sys/sunddi.h>
35 #include <sys/strsubr.h>
36 #include <inet/common.h>
37 #include <sys/note.h>
38 #include <sys/strsun.h>
39 #include <sys/modctl.h>
40 #include <sys/devops.h>
41 #include <sys/mac_provider.h>
42 #include <sys/mac_wifi.h>
43 #include <sys/net80211.h>
44 
45 #include "ral_rate.h"
46 #include "rt2560_reg.h"
47 #include "rt2560_var.h"
48 
49 static void *ral_soft_state_p = NULL;
50 
51 #define	RAL_TXBUF_SIZE  	(IEEE80211_MAX_LEN)
52 #define	RAL_RXBUF_SIZE  	(IEEE80211_MAX_LEN)
53 
54 /* quickly determine if a given rate is CCK or OFDM */
55 #define	RAL_RATE_IS_OFDM(rate)	((rate) >= 12 && (rate) != 22)
56 #define	RAL_ACK_SIZE		14	/* 10 + 4(FCS) */
57 #define	RAL_CTS_SIZE		14	/* 10 + 4(FCS) */
58 #define	RAL_SIFS		10	/* us */
59 #define	RT2560_TXRX_TURNAROUND	10	/* us */
60 
61 /*
62  * Supported rates for 802.11a/b/g modes (in 500Kbps unit).
63  */
64 static const struct ieee80211_rateset rt2560_rateset_11a =
65 	{ 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
66 
67 static const struct ieee80211_rateset rt2560_rateset_11b =
68 	{ 4, { 2, 4, 11, 22 } };
69 
70 static const struct ieee80211_rateset rt2560_rateset_11g =
71 	{ 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
72 
73 static const struct {
74 	uint32_t	reg;
75 	uint32_t	val;
76 } rt2560_def_mac[] = {
77 	RT2560_DEF_MAC
78 };
79 
80 static const struct {
81 	uint8_t	reg;
82 	uint8_t	val;
83 } rt2560_def_bbp[] = {
84 	RT2560_DEF_BBP
85 };
86 
87 static const uint32_t rt2560_rf2522_r2[]    = RT2560_RF2522_R2;
88 static const uint32_t rt2560_rf2523_r2[]    = RT2560_RF2523_R2;
89 static const uint32_t rt2560_rf2524_r2[]    = RT2560_RF2524_R2;
90 static const uint32_t rt2560_rf2525_r2[]    = RT2560_RF2525_R2;
91 static const uint32_t rt2560_rf2525_hi_r2[] = RT2560_RF2525_HI_R2;
92 static const uint32_t rt2560_rf2525e_r2[]   = RT2560_RF2525E_R2;
93 static const uint32_t rt2560_rf2526_r2[]    = RT2560_RF2526_R2;
94 static const uint32_t rt2560_rf2526_hi_r2[] = RT2560_RF2526_HI_R2;
95 
96 static const struct {
97 	uint8_t		chan;
98 	uint32_t	r1, r2, r4;
99 } rt2560_rf5222[] = {
100 	RT2560_RF5222
101 };
102 
103 /*
104  * PIO access attributes for registers
105  */
106 static ddi_device_acc_attr_t ral_csr_accattr = {
107 	DDI_DEVICE_ATTR_V0,
108 	DDI_STRUCTURE_LE_ACC,
109 	DDI_STRICTORDER_ACC
110 };
111 
112 /*
113  * DMA access attributes for descriptors: NOT to be byte swapped.
114  */
115 static ddi_device_acc_attr_t ral_desc_accattr = {
116 	DDI_DEVICE_ATTR_V0,
117 	DDI_STRUCTURE_LE_ACC,
118 	DDI_STRICTORDER_ACC
119 };
120 
121 /*
122  * Describes the chip's DMA engine
123  */
124 static ddi_dma_attr_t ral_dma_attr = {
125 	DMA_ATTR_V0,			/* dma_attr version */
126 	0x0000000000000000ull,		/* dma_attr_addr_lo */
127 	0xFFFFFFFF,			/* dma_attr_addr_hi */
128 	0x00000000FFFFFFFFull,		/* dma_attr_count_max */
129 	0x0000000000000001ull,		/* dma_attr_align */
130 	0x00000FFF,			/* dma_attr_burstsizes */
131 	0x00000001,			/* dma_attr_minxfer */
132 	0x000000000000FFFFull,		/* dma_attr_maxxfer */
133 	0xFFFFFFFFFFFFFFFFull,		/* dma_attr_seg */
134 	1,				/* dma_attr_sgllen */
135 	0x00000001,			/* dma_attr_granular */
136 	0				/* dma_attr_flags */
137 };
138 
139 /*
140  * device operations
141  */
142 static int rt2560_attach(dev_info_t *, ddi_attach_cmd_t);
143 static int rt2560_detach(dev_info_t *, ddi_detach_cmd_t);
144 static int32_t rt2560_quiesce(dev_info_t *);
145 
146 /*
147  * Module Loading Data & Entry Points
148  */
149 DDI_DEFINE_STREAM_OPS(ral_dev_ops, nulldev, nulldev, rt2560_attach,
150     rt2560_detach, nodev, NULL, D_MP, NULL, rt2560_quiesce);
151 
152 static struct modldrv ral_modldrv = {
153 	&mod_driverops,		/* Type of module.  This one is a driver */
154 	"Ralink RT2500 driver v1.6",	/* short description */
155 	&ral_dev_ops		/* driver specific ops */
156 };
157 
158 static struct modlinkage modlinkage = {
159 	MODREV_1,
160 	(void *)&ral_modldrv,
161 	NULL
162 };
163 
164 static int	rt2560_m_stat(void *,  uint_t, uint64_t *);
165 static int	rt2560_m_start(void *);
166 static void	rt2560_m_stop(void *);
167 static int	rt2560_m_promisc(void *, boolean_t);
168 static int	rt2560_m_multicst(void *, boolean_t, const uint8_t *);
169 static int	rt2560_m_unicst(void *, const uint8_t *);
170 static mblk_t	*rt2560_m_tx(void *, mblk_t *);
171 static void	rt2560_m_ioctl(void *, queue_t *, mblk_t *);
172 static int	rt2560_m_setprop(void *, const char *, mac_prop_id_t,
173     uint_t, const void *);
174 static int	rt2560_m_getprop(void *, const char *, mac_prop_id_t,
175     uint_t, void *);
176 static void	rt2560_m_propinfo(void *, const char *, mac_prop_id_t,
177     mac_prop_info_handle_t);
178 
179 static mac_callbacks_t rt2560_m_callbacks = {
180 	MC_IOCTL | MC_SETPROP | MC_GETPROP | MC_PROPINFO,
181 	rt2560_m_stat,
182 	rt2560_m_start,
183 	rt2560_m_stop,
184 	rt2560_m_promisc,
185 	rt2560_m_multicst,
186 	rt2560_m_unicst,
187 	rt2560_m_tx,
188 	NULL,
189 	rt2560_m_ioctl,
190 	NULL,		/* mc_getcapab */
191 	NULL,
192 	NULL,
193 	rt2560_m_setprop,
194 	rt2560_m_getprop,
195 	rt2560_m_propinfo
196 };
197 
198 uint32_t ral_dbg_flags = 0;
199 
200 void
201 ral_debug(uint32_t dbg_flags, const int8_t *fmt, ...)
202 {
203 	va_list args;
204 
205 	if (dbg_flags & ral_dbg_flags) {
206 		va_start(args, fmt);
207 		vcmn_err(CE_CONT, fmt, args);
208 		va_end(args);
209 	}
210 }
211 
212 static void
213 rt2560_set_basicrates(struct rt2560_softc *sc)
214 {
215 	struct ieee80211com *ic = &sc->sc_ic;
216 
217 	/* update basic rate set */
218 	if (ic->ic_curmode == IEEE80211_MODE_11B) {
219 		/* 11b basic rates: 1, 2Mbps */
220 		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x3);
221 	} else if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan)) {
222 		/* 11a basic rates: 6, 12, 24Mbps */
223 		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x150);
224 	} else {
225 		/* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
226 		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x15f);
227 	}
228 }
229 
230 static void
231 rt2560_update_led(struct rt2560_softc *sc, int led1, int led2)
232 {
233 	uint32_t tmp;
234 
235 	/* set ON period to 70ms and OFF period to 30ms */
236 	tmp = led1 << 16 | led2 << 17 | 70 << 8 | 30;
237 	RAL_WRITE(sc, RT2560_LEDCSR, tmp);
238 }
239 
240 static void
241 rt2560_set_bssid(struct rt2560_softc *sc, uint8_t *bssid)
242 {
243 	uint32_t tmp;
244 
245 	tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
246 	RAL_WRITE(sc, RT2560_CSR5, tmp);
247 
248 	tmp = bssid[4] | bssid[5] << 8;
249 	RAL_WRITE(sc, RT2560_CSR6, tmp);
250 
251 	ral_debug(RAL_DBG_HW, "setting BSSID to " MACSTR "\n", MAC2STR(bssid));
252 }
253 
254 
255 static void
256 rt2560_bbp_write(struct rt2560_softc *sc, uint8_t reg, uint8_t val)
257 {
258 	uint32_t tmp;
259 	int ntries;
260 
261 	for (ntries = 0; ntries < 100; ntries++) {
262 		if (!(RAL_READ(sc, RT2560_BBPCSR) & RT2560_BBP_BUSY))
263 			break;
264 		drv_usecwait(1);
265 	}
266 	if (ntries == 100) {
267 		ral_debug(RAL_DBG_HW, "could not write to BBP\n");
268 		return;
269 	}
270 
271 	tmp = RT2560_BBP_WRITE | RT2560_BBP_BUSY | reg << 8 | val;
272 	RAL_WRITE(sc, RT2560_BBPCSR, tmp);
273 
274 	ral_debug(RAL_DBG_HW, "BBP R%u <- 0x%02x\n", reg, val);
275 }
276 
277 static uint8_t
278 rt2560_bbp_read(struct rt2560_softc *sc, uint8_t reg)
279 {
280 	uint32_t val;
281 	int ntries;
282 
283 	val = RT2560_BBP_BUSY | reg << 8;
284 	RAL_WRITE(sc, RT2560_BBPCSR, val);
285 
286 	for (ntries = 0; ntries < 100; ntries++) {
287 		val = RAL_READ(sc, RT2560_BBPCSR);
288 		if (!(val & RT2560_BBP_BUSY))
289 			return (val & 0xff);
290 		drv_usecwait(1);
291 	}
292 
293 	ral_debug(RAL_DBG_HW, "could not read from BBP\n");
294 	return (0);
295 }
296 
297 static void
298 rt2560_rf_write(struct rt2560_softc *sc, uint8_t reg, uint32_t val)
299 {
300 	uint32_t tmp;
301 	int ntries;
302 
303 	for (ntries = 0; ntries < 100; ntries++) {
304 		if (!(RAL_READ(sc, RT2560_RFCSR) & RT2560_RF_BUSY))
305 			break;
306 		drv_usecwait(1);
307 	}
308 	if (ntries == 100) {
309 		ral_debug(RAL_DBG_HW, "could not write to RF\n");
310 		return;
311 	}
312 
313 	tmp = RT2560_RF_BUSY | RT2560_RF_20BIT | (val & 0xfffff) << 2 |
314 	    (reg & 0x3);
315 	RAL_WRITE(sc, RT2560_RFCSR, tmp);
316 
317 	/* remember last written value in sc */
318 	sc->rf_regs[reg] = val;
319 
320 	ral_debug(RAL_DBG_HW, "RF R[%u] <- 0x%05x\n", reg & 0x3, val & 0xfffff);
321 }
322 
323 static void
324 rt2560_set_chan(struct rt2560_softc *sc, struct ieee80211_channel *c)
325 {
326 	struct ieee80211com *ic = &sc->sc_ic;
327 	uint8_t power, tmp;
328 	uint_t i, chan;
329 
330 	chan = ieee80211_chan2ieee(ic, c);
331 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
332 		return;
333 
334 	if (IEEE80211_IS_CHAN_2GHZ(c))
335 		power = min(sc->txpow[chan - 1], 31);
336 	else
337 		power = 31;
338 
339 	/* adjust txpower using ifconfig settings */
340 	power -= (100 - ic->ic_txpowlimit) / 8;
341 
342 	ral_debug(RAL_DBG_CHAN, "setting channel to %u, txpower to %u\n",
343 	    chan, power);
344 
345 	switch (sc->rf_rev) {
346 	case RT2560_RF_2522:
347 		rt2560_rf_write(sc, RAL_RF1, 0x00814);
348 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2522_r2[chan - 1]);
349 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
350 		break;
351 
352 	case RT2560_RF_2523:
353 		rt2560_rf_write(sc, RAL_RF1, 0x08804);
354 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2523_r2[chan - 1]);
355 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x38044);
356 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
357 		break;
358 
359 	case RT2560_RF_2524:
360 		rt2560_rf_write(sc, RAL_RF1, 0x0c808);
361 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2524_r2[chan - 1]);
362 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
363 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
364 		break;
365 
366 	case RT2560_RF_2525:
367 		rt2560_rf_write(sc, RAL_RF1, 0x08808);
368 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525_hi_r2[chan - 1]);
369 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
370 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
371 
372 		rt2560_rf_write(sc, RAL_RF1, 0x08808);
373 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525_r2[chan - 1]);
374 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
375 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
376 		break;
377 
378 	case RT2560_RF_2525E:
379 		rt2560_rf_write(sc, RAL_RF1, 0x08808);
380 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525e_r2[chan - 1]);
381 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
382 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00286 : 0x00282);
383 		break;
384 
385 	case RT2560_RF_2526:
386 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2526_hi_r2[chan - 1]);
387 		rt2560_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
388 		rt2560_rf_write(sc, RAL_RF1, 0x08804);
389 
390 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2526_r2[chan - 1]);
391 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
392 		rt2560_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
393 		break;
394 
395 	/* dual-band RF */
396 	case RT2560_RF_5222:
397 		for (i = 0; rt2560_rf5222[i].chan != chan; i++) {
398 		}
399 
400 		rt2560_rf_write(sc, RAL_RF1, rt2560_rf5222[i].r1);
401 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf5222[i].r2);
402 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
403 		rt2560_rf_write(sc, RAL_RF4, rt2560_rf5222[i].r4);
404 		break;
405 	}
406 
407 	if (ic->ic_state != IEEE80211_S_SCAN) {
408 		/* set Japan filter bit for channel 14 */
409 		tmp = rt2560_bbp_read(sc, 70);
410 
411 		tmp &= ~RT2560_JAPAN_FILTER;
412 		if (chan == 14)
413 			tmp |= RT2560_JAPAN_FILTER;
414 
415 		rt2560_bbp_write(sc, 70, tmp);
416 
417 		/* clear CRC errors */
418 		(void) RAL_READ(sc, RT2560_CNT0);
419 	}
420 }
421 
422 /*
423  * Refer to IEEE Std 802.11-1999 pp. 123 for more information on TSF
424  * synchronization.
425  */
426 static void
427 rt2560_enable_tsf_sync(struct rt2560_softc *sc)
428 {
429 	struct ieee80211com *ic = &sc->sc_ic;
430 	uint16_t logcwmin, preload;
431 	uint32_t tmp;
432 
433 	/* first, disable TSF synchronization */
434 	RAL_WRITE(sc, RT2560_CSR14, 0);
435 
436 	tmp = 16 * ic->ic_bss->in_intval;
437 	RAL_WRITE(sc, RT2560_CSR12, tmp);
438 
439 	RAL_WRITE(sc, RT2560_CSR13, 0);
440 
441 	logcwmin = 5;
442 	preload = (ic->ic_opmode == IEEE80211_M_STA) ? 384 : 1024;
443 	tmp = logcwmin << 16 | preload;
444 	RAL_WRITE(sc, RT2560_BCNOCSR, tmp);
445 
446 	/* finally, enable TSF synchronization */
447 	tmp = RT2560_ENABLE_TSF | RT2560_ENABLE_TBCN;
448 	if (ic->ic_opmode == IEEE80211_M_STA)
449 		tmp |= RT2560_ENABLE_TSF_SYNC(1);
450 	else
451 		tmp |= RT2560_ENABLE_TSF_SYNC(2) |
452 		    RT2560_ENABLE_BEACON_GENERATOR;
453 	RAL_WRITE(sc, RT2560_CSR14, tmp);
454 
455 	ral_debug(RAL_DBG_HW, "enabling TSF synchronization\n");
456 }
457 
458 static void
459 rt2560_update_plcp(struct rt2560_softc *sc)
460 {
461 	struct ieee80211com *ic = &sc->sc_ic;
462 
463 	/* no short preamble for 1Mbps */
464 	RAL_WRITE(sc, RT2560_PLCP1MCSR, 0x00700400);
465 
466 	if (!(ic->ic_flags & IEEE80211_F_SHPREAMBLE)) {
467 		/* values taken from the reference driver */
468 		RAL_WRITE(sc, RT2560_PLCP2MCSR,   0x00380401);
469 		RAL_WRITE(sc, RT2560_PLCP5p5MCSR, 0x00150402);
470 		RAL_WRITE(sc, RT2560_PLCP11MCSR,  0x000b8403);
471 	} else {
472 		/* same values as above or'ed 0x8 */
473 		RAL_WRITE(sc, RT2560_PLCP2MCSR,   0x00380409);
474 		RAL_WRITE(sc, RT2560_PLCP5p5MCSR, 0x0015040a);
475 		RAL_WRITE(sc, RT2560_PLCP11MCSR,  0x000b840b);
476 	}
477 
478 	ral_debug(RAL_DBG_HW, "updating PLCP for %s preamble\n",
479 	    (ic->ic_flags & IEEE80211_F_SHPREAMBLE) ? "short" : "long");
480 }
481 
482 /*
483  * This function can be called by ieee80211_set_shortslottime(). Refer to
484  * IEEE Std 802.11-1999 pp. 85 to know how these values are computed.
485  */
486 void
487 rt2560_update_slot(struct ieee80211com *ic, int onoff)
488 {
489 	struct rt2560_softc *sc = (struct rt2560_softc *)ic;
490 	uint8_t slottime;
491 	uint16_t tx_sifs, tx_pifs, tx_difs, eifs;
492 	uint32_t tmp;
493 
494 	/* slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20; */
495 	slottime = (onoff ? 9 : 20);
496 
497 	/* update the MAC slot boundaries */
498 	tx_sifs = RAL_SIFS - RT2560_TXRX_TURNAROUND;
499 	tx_pifs = tx_sifs + slottime;
500 	tx_difs = tx_sifs + 2 * slottime;
501 	eifs = (ic->ic_curmode == IEEE80211_MODE_11B) ? 364 : 60;
502 
503 	tmp = RAL_READ(sc, RT2560_CSR11);
504 	tmp = (tmp & ~0x1f00) | slottime << 8;
505 	RAL_WRITE(sc, RT2560_CSR11, tmp);
506 
507 	tmp = tx_pifs << 16 | tx_sifs;
508 	RAL_WRITE(sc, RT2560_CSR18, tmp);
509 
510 	tmp = eifs << 16 | tx_difs;
511 	RAL_WRITE(sc, RT2560_CSR19, tmp);
512 
513 	ral_debug(RAL_DBG_HW, "setting slottime to %uus\n", slottime);
514 }
515 
516 int
517 ral_dma_region_alloc(struct rt2560_softc *sc, struct dma_region *dr,
518     size_t size, uint_t alloc_flags, uint_t bind_flags)
519 {
520 	dev_info_t *dip = sc->sc_dev;
521 	int err;
522 
523 	err = ddi_dma_alloc_handle(dip, &ral_dma_attr, DDI_DMA_SLEEP, NULL,
524 	    &dr->dr_hnd);
525 	if (err != DDI_SUCCESS)
526 		goto fail1;
527 
528 	err = ddi_dma_mem_alloc(dr->dr_hnd, size, &ral_desc_accattr,
529 	    alloc_flags, DDI_DMA_SLEEP, NULL,
530 	    &dr->dr_base, &dr->dr_size, &dr->dr_acc);
531 	if (err != DDI_SUCCESS)
532 		goto fail2;
533 
534 	err = ddi_dma_addr_bind_handle(dr->dr_hnd, NULL,
535 	    dr->dr_base, dr->dr_size,
536 	    bind_flags, DDI_DMA_SLEEP, NULL, &dr->dr_cookie, &dr->dr_ccnt);
537 	if (err != DDI_SUCCESS)
538 		goto fail3;
539 
540 	if (dr->dr_ccnt != 1) {
541 		err = DDI_FAILURE;
542 		goto fail4;
543 	}
544 
545 	dr->dr_pbase = dr->dr_cookie.dmac_address;
546 	ral_debug(RAL_DBG_DMA, "get physical-base=0x%08x\n", dr->dr_pbase);
547 
548 	return (DDI_SUCCESS);
549 
550 fail4:
551 	(void) ddi_dma_unbind_handle(dr->dr_hnd);
552 fail3:
553 	ddi_dma_mem_free(&dr->dr_acc);
554 fail2:
555 	ddi_dma_free_handle(&dr->dr_hnd);
556 fail1:
557 	return (err);
558 }
559 
560 /* ARGSUSED */
561 void
562 ral_dma_region_free(struct rt2560_softc *sc, struct dma_region *dr)
563 {
564 	(void) ddi_dma_unbind_handle(dr->dr_hnd);
565 	ddi_dma_mem_free(&dr->dr_acc);
566 	ddi_dma_free_handle(&dr->dr_hnd);
567 }
568 
569 int
570 rt2560_alloc_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring,
571 	int count)
572 {
573 	int i, err;
574 	int size;
575 
576 	ring->count = count;
577 	ring->queued = 0;
578 	ring->cur = ring->next = 0;
579 	ring->cur_encrypt = ring->next_encrypt = 0;
580 
581 	ring->data = kmem_zalloc(count * (sizeof (struct rt2560_tx_data)),
582 	    KM_SLEEP);
583 	ring->dr_txbuf = kmem_zalloc(count * (sizeof (struct dma_region)),
584 	    KM_SLEEP);
585 
586 	err = ral_dma_region_alloc(sc, &ring->dr_desc,
587 	    count * (sizeof (struct rt2560_tx_desc)),
588 	    DDI_DMA_CONSISTENT, DDI_DMA_RDWR | DDI_DMA_CONSISTENT);
589 
590 	if (err != DDI_SUCCESS)
591 		goto fail1;
592 
593 	size = roundup(RAL_TXBUF_SIZE, sc->sc_cachelsz);
594 	for (i = 0; i < count; i++) {
595 		err = ral_dma_region_alloc(sc, &ring->dr_txbuf[i], size,
596 		    DDI_DMA_STREAMING, DDI_DMA_WRITE | DDI_DMA_STREAMING);
597 		if (err != DDI_SUCCESS) {
598 			while (i >= 0) {
599 				ral_dma_region_free(sc, &ring->dr_txbuf[i]);
600 				i--;
601 			}
602 			goto fail2;
603 		}
604 	}
605 
606 	ring->physaddr = LE_32(ring->dr_desc.dr_pbase);
607 	ring->desc = (struct rt2560_tx_desc *)ring->dr_desc.dr_base;
608 
609 	for (i = 0; i < count; i++) {
610 		ring->desc[i].physaddr = LE_32(ring->dr_txbuf[i].dr_pbase);
611 		ring->data[i].buf = ring->dr_txbuf[i].dr_base;
612 	}
613 
614 	return (DDI_SUCCESS);
615 fail2:
616 	ral_dma_region_free(sc, &ring->dr_desc);
617 fail1:
618 	return (err);
619 }
620 
621 /* ARGSUSED */
622 void
623 rt2560_reset_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring)
624 {
625 	struct rt2560_tx_desc *desc;
626 	struct rt2560_tx_data *data;
627 	int i;
628 
629 	for (i = 0; i < ring->count; i++) {
630 		desc = &ring->desc[i];
631 		data = &ring->data[i];
632 
633 		if (data->ni != NULL) {
634 			ieee80211_free_node(data->ni);
635 			data->ni = NULL;
636 		}
637 
638 		desc->flags = 0;
639 	}
640 
641 	(void) ddi_dma_sync(ring->dr_desc.dr_hnd, 0,
642 	    ring->count * sizeof (struct rt2560_tx_desc), DDI_DMA_SYNC_FORDEV);
643 
644 	ring->queued = 0;
645 	ring->cur = ring->next = 0;
646 	ring->cur_encrypt = ring->next_encrypt = 0;
647 }
648 
649 void
650 rt2560_free_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring)
651 {
652 	struct rt2560_tx_data *data;
653 	int i;
654 
655 	ral_dma_region_free(sc, &ring->dr_desc);
656 	/* tx buf */
657 	for (i = 0; i < ring->count; i++) {
658 		data = &ring->data[i];
659 		if (data->ni != NULL) {
660 			ieee80211_free_node(data->ni);
661 			data->ni = NULL;
662 		}
663 
664 		ral_dma_region_free(sc, &ring->dr_txbuf[i]);
665 	}
666 
667 	kmem_free(ring->data, ring->count * (sizeof (struct rt2560_tx_data)));
668 	kmem_free(ring->dr_txbuf, ring->count * (sizeof (struct dma_region)));
669 }
670 
671 void
672 rt2560_ring_hwsetup(struct rt2560_softc *sc)
673 {
674 	uint32_t tmp;
675 
676 	/* setup tx rings */
677 	tmp = ((uint32_t)RT2560_PRIO_RING_COUNT << 24) |
678 	    RT2560_ATIM_RING_COUNT << 16 |
679 	    RT2560_TX_RING_COUNT   <<  8 |
680 	    RT2560_TX_DESC_SIZE;
681 
682 	/* rings must be initialized in this exact order */
683 	RAL_WRITE(sc, RT2560_TXCSR2, tmp);
684 	RAL_WRITE(sc, RT2560_TXCSR3, sc->txq.physaddr);
685 	RAL_WRITE(sc, RT2560_TXCSR5, sc->prioq.physaddr);
686 
687 	/* setup rx ring */
688 	tmp = RT2560_RX_RING_COUNT << 8 | RT2560_RX_DESC_SIZE;
689 
690 	RAL_WRITE(sc, RT2560_RXCSR1, tmp);
691 	RAL_WRITE(sc, RT2560_RXCSR2, sc->rxq.physaddr);
692 }
693 
694 int
695 rt2560_alloc_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring,
696 	int count)
697 {
698 	struct rt2560_rx_desc *desc;
699 	struct rt2560_rx_data *data;
700 	int i, err;
701 	int size;
702 
703 	ring->count = count;
704 	ring->cur = ring->next = 0;
705 	ring->cur_decrypt = 0;
706 
707 	ring->data = kmem_zalloc(count * (sizeof (struct rt2560_rx_data)),
708 	    KM_SLEEP);
709 	ring->dr_rxbuf = kmem_zalloc(count * (sizeof (struct dma_region)),
710 	    KM_SLEEP);
711 
712 	err = ral_dma_region_alloc(sc, &ring->dr_desc,
713 	    count * (sizeof (struct rt2560_rx_desc)),
714 	    DDI_DMA_CONSISTENT, DDI_DMA_RDWR | DDI_DMA_CONSISTENT);
715 
716 	if (err != DDI_SUCCESS)
717 		goto fail1;
718 
719 	size = roundup(RAL_RXBUF_SIZE, sc->sc_cachelsz);
720 	for (i = 0; i < count; i++) {
721 		err = ral_dma_region_alloc(sc, &ring->dr_rxbuf[i], size,
722 		    DDI_DMA_STREAMING, DDI_DMA_READ | DDI_DMA_STREAMING);
723 		if (err != DDI_SUCCESS) {
724 			while (i >= 0) {
725 				ral_dma_region_free(sc, &ring->dr_rxbuf[i]);
726 				i--;
727 			}
728 			goto fail2;
729 		}
730 	}
731 
732 	ring->physaddr = ring->dr_desc.dr_pbase;
733 	ring->desc = (struct rt2560_rx_desc *)ring->dr_desc.dr_base;
734 
735 	for (i = 0; i < count; i++) {
736 		desc = &ring->desc[i];
737 		data = &ring->data[i];
738 
739 		desc->physaddr = LE_32(ring->dr_rxbuf[i].dr_pbase);
740 		desc->flags = LE_32(RT2560_RX_BUSY);
741 
742 		data->buf = ring->dr_rxbuf[i].dr_base;
743 	}
744 
745 	return (DDI_SUCCESS);
746 fail2:
747 	ral_dma_region_free(sc, &ring->dr_desc);
748 fail1:
749 	return (err);
750 }
751 
752 /* ARGSUSED */
753 static void
754 rt2560_reset_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring)
755 {
756 	int i;
757 
758 	for (i = 0; i < ring->count; i++) {
759 		ring->desc[i].flags = LE_32(RT2560_RX_BUSY);
760 		ring->data[i].drop = 0;
761 	}
762 
763 	(void) ddi_dma_sync(ring->dr_desc.dr_hnd, 0,
764 	    ring->count * sizeof (struct rt2560_rx_desc),
765 	    DDI_DMA_SYNC_FORKERNEL);
766 
767 	ring->cur = ring->next = 0;
768 	ring->cur_decrypt = 0;
769 }
770 
771 static void
772 rt2560_free_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring)
773 {
774 	int i;
775 
776 	ral_dma_region_free(sc, &ring->dr_desc);
777 	/* rx buf */
778 	for (i = 0; i < ring->count; i++)
779 		ral_dma_region_free(sc, &ring->dr_rxbuf[i]);
780 
781 	kmem_free(ring->data, ring->count * (sizeof (struct rt2560_rx_data)));
782 	kmem_free(ring->dr_rxbuf, ring->count * (sizeof (struct dma_region)));
783 }
784 
785 /* ARGSUSED */
786 static struct ieee80211_node *
787 rt2560_node_alloc(ieee80211com_t *ic)
788 {
789 	struct rt2560_node *rn;
790 
791 	rn = kmem_zalloc(sizeof (struct rt2560_node), KM_SLEEP);
792 	return ((rn != NULL) ? &rn->ni : NULL);
793 }
794 
795 static void
796 rt2560_node_free(struct ieee80211_node *in)
797 {
798 	ieee80211com_t *ic = in->in_ic;
799 
800 	ic->ic_node_cleanup(in);
801 	if (in->in_wpa_ie != NULL)
802 		ieee80211_free(in->in_wpa_ie);
803 	kmem_free(in, sizeof (struct rt2560_node));
804 }
805 
806 /*
807  * This function is called periodically (every 200ms) during scanning to
808  * switch from one channel to another.
809  */
810 static void
811 rt2560_next_scan(void *arg)
812 {
813 	struct rt2560_softc *sc = arg;
814 	struct ieee80211com *ic = &sc->sc_ic;
815 
816 	if (ic->ic_state == IEEE80211_S_SCAN)
817 		(void) ieee80211_next_scan(ic);
818 }
819 
820 /*
821  * This function is called for each node present in the node station table.
822  */
823 /* ARGSUSED */
824 static void
825 rt2560_iter_func(void *arg, struct ieee80211_node *ni)
826 {
827 	struct rt2560_node *rn = (struct rt2560_node *)ni;
828 
829 	ral_rssadapt_updatestats(&rn->rssadapt);
830 }
831 
832 /*
833  * This function is called periodically (every 100ms) in RUN state to update
834  * the rate adaptation statistics.
835  */
836 static void
837 rt2560_update_rssadapt(void *arg)
838 {
839 	struct rt2560_softc *sc = arg;
840 	struct ieee80211com *ic = &sc->sc_ic;
841 
842 	ieee80211_iterate_nodes(&ic->ic_sta, rt2560_iter_func, arg);
843 	sc->sc_rssadapt_id = timeout(rt2560_update_rssadapt, (void *)sc,
844 	    drv_usectohz(100 * 1000));
845 }
846 
847 static void
848 rt2560_statedog(void *arg)
849 {
850 	struct rt2560_softc *sc = arg;
851 	struct ieee80211com *ic = &sc->sc_ic;
852 	enum ieee80211_state state;
853 
854 	RAL_LOCK(sc);
855 
856 	sc->sc_state_id = 0;
857 	state = ic->ic_state;
858 	ic->ic_state = sc->sc_ostate;
859 
860 	RAL_UNLOCK(sc);
861 
862 	ieee80211_new_state(ic, state, -1);
863 
864 }
865 
866 static int
867 rt2560_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
868 {
869 	struct rt2560_softc *sc = (struct rt2560_softc *)ic;
870 	enum ieee80211_state ostate;
871 	struct ieee80211_node *ni;
872 	int err;
873 
874 	RAL_LOCK(sc);
875 
876 	ostate = ic->ic_state;
877 	sc->sc_ostate = ostate;
878 
879 	if (sc->sc_scan_id != 0) {
880 		(void) untimeout(sc->sc_scan_id);
881 		sc->sc_scan_id = 0;
882 	}
883 
884 	if (sc->sc_rssadapt_id != 0) {
885 		(void) untimeout(sc->sc_rssadapt_id);
886 		sc->sc_rssadapt_id = 0;
887 	}
888 
889 	if (sc->sc_state_id != 0) {
890 		(void) untimeout(sc->sc_state_id);
891 		sc->sc_state_id = 0;
892 	}
893 
894 	switch (nstate) {
895 	case IEEE80211_S_INIT:
896 		if (ostate == IEEE80211_S_RUN) {
897 			/* abort TSF synchronization */
898 			RAL_WRITE(sc, RT2560_CSR14, 0);
899 			/* turn association led off */
900 			rt2560_update_led(sc, 0, 0);
901 		}
902 		break;
903 
904 	case IEEE80211_S_SCAN:
905 		rt2560_set_chan(sc, ic->ic_curchan);
906 		sc->sc_scan_id = timeout(rt2560_next_scan, (void *)sc,
907 		    drv_usectohz(sc->dwelltime * 1000));
908 		break;
909 
910 	case IEEE80211_S_AUTH:
911 		rt2560_set_chan(sc, ic->ic_curchan);
912 		break;
913 
914 	case IEEE80211_S_ASSOC:
915 		rt2560_set_chan(sc, ic->ic_curchan);
916 
917 		drv_usecwait(10 * 1000);	/* dlink */
918 		sc->sc_state_id = timeout(rt2560_statedog, (void *)sc,
919 		    drv_usectohz(300 * 1000));	/* ap7-3 */
920 		break;
921 
922 	case IEEE80211_S_RUN:
923 		rt2560_set_chan(sc, ic->ic_curchan);
924 
925 		ni = ic->ic_bss;
926 
927 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
928 			rt2560_update_plcp(sc);
929 			rt2560_set_basicrates(sc);
930 			rt2560_set_bssid(sc, ni->in_bssid);
931 		}
932 
933 		/* turn assocation led on */
934 		rt2560_update_led(sc, 1, 0);
935 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
936 			sc->sc_rssadapt_id = timeout(rt2560_update_rssadapt,
937 			    (void *)sc, drv_usectohz(100 * 1000));
938 			rt2560_enable_tsf_sync(sc);
939 		}
940 		break;
941 	}
942 
943 	RAL_UNLOCK(sc);
944 
945 	err = sc->sc_newstate(ic, nstate, arg);
946 	/*
947 	 * Finally, start any timers.
948 	 */
949 	if (nstate == IEEE80211_S_RUN)
950 		ieee80211_start_watchdog(ic, 1);
951 
952 	return (err);
953 }
954 
955 /*
956  * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46 or
957  * 93C66).
958  */
959 static uint16_t
960 rt2560_eeprom_read(struct rt2560_softc *sc, uint8_t addr)
961 {
962 	uint32_t tmp;
963 	uint16_t val;
964 	int n;
965 
966 	/* clock C once before the first command */
967 	RT2560_EEPROM_CTL(sc, 0);
968 
969 	RT2560_EEPROM_CTL(sc, RT2560_S);
970 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
971 	RT2560_EEPROM_CTL(sc, RT2560_S);
972 
973 	/* write start bit (1) */
974 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D);
975 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D | RT2560_C);
976 
977 	/* write READ opcode (10) */
978 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D);
979 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D | RT2560_C);
980 	RT2560_EEPROM_CTL(sc, RT2560_S);
981 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
982 
983 	/* write address (A5-A0 or A7-A0) */
984 	n = (RAL_READ(sc, RT2560_CSR21) & RT2560_93C46) ? 5 : 7;
985 	for (; n >= 0; n--) {
986 		RT2560_EEPROM_CTL(sc, RT2560_S |
987 		    (((addr >> n) & 1) << RT2560_SHIFT_D));
988 		RT2560_EEPROM_CTL(sc, RT2560_S |
989 		    (((addr >> n) & 1) << RT2560_SHIFT_D) | RT2560_C);
990 	}
991 
992 	RT2560_EEPROM_CTL(sc, RT2560_S);
993 
994 	/* read data Q15-Q0 */
995 	val = 0;
996 	for (n = 15; n >= 0; n--) {
997 		RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
998 		tmp = RAL_READ(sc, RT2560_CSR21);
999 		val |= ((tmp & RT2560_Q) >> RT2560_SHIFT_Q) << n;
1000 		RT2560_EEPROM_CTL(sc, RT2560_S);
1001 	}
1002 
1003 	RT2560_EEPROM_CTL(sc, 0);
1004 
1005 	/* clear Chip Select and clock C */
1006 	RT2560_EEPROM_CTL(sc, RT2560_S);
1007 	RT2560_EEPROM_CTL(sc, 0);
1008 	RT2560_EEPROM_CTL(sc, RT2560_C);
1009 
1010 	return (val);
1011 }
1012 
1013 static void
1014 rt2560_tx_intr(struct rt2560_softc *sc)
1015 {
1016 	struct ieee80211com *ic = &sc->sc_ic;
1017 	struct rt2560_tx_desc *desc;
1018 	struct rt2560_tx_data *data;
1019 	struct rt2560_node *rn;
1020 
1021 	struct dma_region *dr;
1022 	int count;
1023 
1024 	dr = &sc->txq.dr_desc;
1025 	count = sc->txq.count;
1026 
1027 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1028 	    DDI_DMA_SYNC_FORKERNEL);
1029 
1030 	mutex_enter(&sc->txq.tx_lock);
1031 
1032 	for (;;) {
1033 		desc = &sc->txq.desc[sc->txq.next];
1034 		data = &sc->txq.data[sc->txq.next];
1035 
1036 		if ((LE_32(desc->flags) & RT2560_TX_BUSY) ||
1037 		    (LE_32(desc->flags) & RT2560_TX_CIPHER_BUSY) ||
1038 		    !(LE_32(desc->flags) & RT2560_TX_VALID))
1039 			break;
1040 
1041 		rn = (struct rt2560_node *)data->ni;
1042 
1043 		switch (LE_32(desc->flags) & RT2560_TX_RESULT_MASK) {
1044 		case RT2560_TX_SUCCESS:
1045 			ral_debug(RAL_DBG_INTR, "data frame sent success\n");
1046 			if (data->id.id_node != NULL) {
1047 				ral_rssadapt_raise_rate(ic, &rn->rssadapt,
1048 				    &data->id);
1049 			}
1050 			break;
1051 
1052 		case RT2560_TX_SUCCESS_RETRY:
1053 			ral_debug(RAL_DBG_INTR,
1054 			    "data frame sent after %u retries\n",
1055 			    (LE_32(desc->flags) >> 5) & 0x7);
1056 			sc->sc_tx_retries++;
1057 			break;
1058 
1059 		case RT2560_TX_FAIL_RETRY:
1060 			ral_debug(RAL_DBG_INTR,
1061 			    "sending data frame failed (too much retries)\n");
1062 			if (data->id.id_node != NULL) {
1063 				ral_rssadapt_lower_rate(ic, data->ni,
1064 				    &rn->rssadapt, &data->id);
1065 			}
1066 			break;
1067 
1068 		case RT2560_TX_FAIL_INVALID:
1069 		case RT2560_TX_FAIL_OTHER:
1070 		default:
1071 			ral_debug(RAL_DBG_INTR, "sending data frame failed "
1072 			    "0x%08x\n", LE_32(desc->flags));
1073 			break;
1074 		}
1075 
1076 		ieee80211_free_node(data->ni);
1077 		data->ni = NULL;
1078 
1079 		/* descriptor is no longer valid */
1080 		desc->flags &= ~LE_32(RT2560_TX_VALID);
1081 
1082 		ral_debug(RAL_DBG_INTR, "tx done idx=%u\n", sc->txq.next);
1083 
1084 		sc->txq.queued--;
1085 		sc->txq.next = (sc->txq.next + 1) % RT2560_TX_RING_COUNT;
1086 
1087 		if (sc->sc_need_sched &&
1088 		    sc->txq.queued < (RT2560_TX_RING_COUNT - 32)) {
1089 			sc->sc_need_sched = 0;
1090 			mac_tx_update(ic->ic_mach);
1091 		}
1092 	}
1093 
1094 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1095 	    DDI_DMA_SYNC_FORDEV);
1096 
1097 	sc->sc_tx_timer = 0;
1098 	mutex_exit(&sc->txq.tx_lock);
1099 }
1100 
1101 static void
1102 rt2560_prio_intr(struct rt2560_softc *sc)
1103 {
1104 	struct rt2560_tx_desc *desc;
1105 	struct rt2560_tx_data *data;
1106 
1107 	struct dma_region *dr;
1108 	int count;
1109 
1110 	dr = &sc->prioq.dr_desc;
1111 	count = sc->prioq.count;
1112 
1113 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1114 	    DDI_DMA_SYNC_FORKERNEL);
1115 
1116 	mutex_enter(&sc->prioq.tx_lock);
1117 
1118 	for (;;) {
1119 		desc = &sc->prioq.desc[sc->prioq.next];
1120 		data = &sc->prioq.data[sc->prioq.next];
1121 
1122 		if ((LE_32(desc->flags) & RT2560_TX_BUSY) ||
1123 		    !(LE_32(desc->flags) & RT2560_TX_VALID))
1124 			break;
1125 
1126 		switch (LE_32(desc->flags) & RT2560_TX_RESULT_MASK) {
1127 		case RT2560_TX_SUCCESS:
1128 			ral_debug(RAL_DBG_INTR, "mgt frame sent success\n");
1129 			break;
1130 
1131 		case RT2560_TX_SUCCESS_RETRY:
1132 			ral_debug(RAL_DBG_INTR,
1133 			    "mgt frame sent after %u retries\n",
1134 			    (LE_32(desc->flags) >> 5) & 0x7);
1135 			break;
1136 
1137 		case RT2560_TX_FAIL_RETRY:
1138 			ral_debug(RAL_DBG_INTR,
1139 			    "sending mgt frame failed (too much " "retries)\n");
1140 			break;
1141 
1142 		case RT2560_TX_FAIL_INVALID:
1143 		case RT2560_TX_FAIL_OTHER:
1144 		default:
1145 			ral_debug(RAL_DBG_INTR, "sending mgt frame failed "
1146 			    "0x%08x\n", LE_32(desc->flags));
1147 		}
1148 
1149 		ieee80211_free_node(data->ni);
1150 		data->ni = NULL;
1151 
1152 		/* descriptor is no longer valid */
1153 		desc->flags &= ~LE_32(RT2560_TX_VALID);
1154 
1155 		ral_debug(RAL_DBG_INTR, "prio done idx=%u\n", sc->prioq.next);
1156 
1157 		sc->prioq.queued--;
1158 		sc->prioq.next = (sc->prioq.next + 1) % RT2560_PRIO_RING_COUNT;
1159 	}
1160 
1161 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1162 	    DDI_DMA_SYNC_FORDEV);
1163 
1164 	sc->sc_tx_timer = 0;
1165 	mutex_exit(&sc->prioq.tx_lock);
1166 }
1167 
1168 /*
1169  * Some frames were received. Pass them to the hardware cipher engine before
1170  * sending them to the 802.11 layer.
1171  */
1172 void
1173 rt2560_rx_intr(struct rt2560_softc *sc)
1174 {
1175 	struct ieee80211com *ic = &sc->sc_ic;
1176 	struct rt2560_rx_desc *desc;
1177 	struct rt2560_rx_data *data;
1178 	struct ieee80211_frame *wh;
1179 	struct ieee80211_node *ni;
1180 	struct rt2560_node *rn;
1181 
1182 	mblk_t *m;
1183 	uint32_t len;
1184 	char *rxbuf;
1185 
1186 	struct dma_region *dr, *dr_bf;
1187 	int count;
1188 
1189 	dr = &sc->rxq.dr_desc;
1190 	count = sc->rxq.count;
1191 
1192 	mutex_enter(&sc->rxq.rx_lock);
1193 
1194 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_RX_DESC_SIZE,
1195 	    DDI_DMA_SYNC_FORKERNEL);
1196 
1197 	for (;;) {
1198 		desc = &sc->rxq.desc[sc->rxq.cur];
1199 		data = &sc->rxq.data[sc->rxq.cur];
1200 
1201 		if ((LE_32(desc->flags) & RT2560_RX_BUSY) ||
1202 		    (LE_32(desc->flags) & RT2560_RX_CIPHER_BUSY))
1203 			break;
1204 
1205 		data->drop = 0;
1206 
1207 		if ((LE_32(desc->flags) & RT2560_RX_PHY_ERROR) ||
1208 		    (LE_32(desc->flags) & RT2560_RX_CRC_ERROR)) {
1209 			/*
1210 			 * This should not happen since we did not request
1211 			 * to receive those frames when we filled RXCSR0.
1212 			 */
1213 			ral_debug(RAL_DBG_RX, "PHY or CRC error flags 0x%08x\n",
1214 			    LE_32(desc->flags));
1215 			data->drop = 1;
1216 		}
1217 
1218 		if (((LE_32(desc->flags) >> 16) & 0xfff) > RAL_RXBUF_SIZE) {
1219 			ral_debug(RAL_DBG_RX, "bad length\n");
1220 			data->drop = 1;
1221 		}
1222 
1223 		if (data->drop) {
1224 			sc->sc_rx_err++;
1225 			goto skip;
1226 		}
1227 
1228 		rxbuf = data->buf;
1229 		len = (LE_32(desc->flags) >> 16) & 0xfff;
1230 
1231 		if ((len < sizeof (struct ieee80211_frame_min)) ||
1232 		    (len > RAL_RXBUF_SIZE)) {
1233 			ral_debug(RAL_DBG_RX, "bad frame length=%u\n", len);
1234 			sc->sc_rx_err++;
1235 			goto skip;
1236 		}
1237 
1238 		if ((m = allocb(len, BPRI_MED)) == NULL) {
1239 			ral_debug(RAL_DBG_RX, "rt2560_rx_intr():"
1240 			    " allocate mblk failed.\n");
1241 			sc->sc_rx_nobuf++;
1242 			goto skip;
1243 		}
1244 
1245 		dr_bf = &sc->rxq.dr_rxbuf[sc->rxq.cur];
1246 		(void) ddi_dma_sync(dr_bf->dr_hnd, 0, dr_bf->dr_size,
1247 		    DDI_DMA_SYNC_FORCPU);
1248 
1249 		bcopy(rxbuf, m->b_rptr, len);
1250 		m->b_wptr += len;
1251 
1252 		wh = (struct ieee80211_frame *)m->b_rptr;
1253 		ni = ieee80211_find_rxnode(ic, wh);
1254 
1255 		/* give rssi to the rate adatation algorithm */
1256 		rn = (struct rt2560_node *)ni;
1257 		ral_rssadapt_input(ic, ni, &rn->rssadapt, desc->rssi);
1258 
1259 		/* send the frame to the 802.11 layer */
1260 		(void) ieee80211_input(ic, m, ni, desc->rssi, 0);
1261 
1262 		/* node is no longer needed */
1263 		ieee80211_free_node(ni);
1264 
1265 skip:		desc->flags = LE_32(RT2560_RX_BUSY);
1266 		ral_debug(RAL_DBG_RX, "rx done idx=%u\n", sc->rxq.cur);
1267 
1268 		sc->rxq.cur = (sc->rxq.cur + 1) % RT2560_RX_RING_COUNT;
1269 	}
1270 	mutex_exit(&sc->rxq.rx_lock);
1271 
1272 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1273 	    DDI_DMA_SYNC_FORDEV);
1274 }
1275 
1276 uint_t
1277 ral_softint_handler(caddr_t data)
1278 {
1279 	/* LINTED E_BAD_PTR_CAST_ALIGN */
1280 	struct rt2560_softc *sc = (struct rt2560_softc *)data;
1281 
1282 	/*
1283 	 * Check if the soft interrupt is triggered by another
1284 	 * driver at the same level.
1285 	 */
1286 	RAL_LOCK(sc);
1287 	if (sc->sc_rx_pend) {
1288 		sc->sc_rx_pend = 0;
1289 		RAL_UNLOCK(sc);
1290 		rt2560_rx_intr(sc);
1291 		return (DDI_INTR_CLAIMED);
1292 	}
1293 	RAL_UNLOCK(sc);
1294 	return (DDI_INTR_UNCLAIMED);
1295 }
1296 
1297 /*
1298  * Return the expected ack rate for a frame transmitted at rate `rate'.
1299  * XXX: this should depend on the destination node basic rate set.
1300  */
1301 static int
1302 rt2560_ack_rate(struct ieee80211com *ic, int rate)
1303 {
1304 	switch (rate) {
1305 	/* CCK rates */
1306 	case 2:
1307 		return (2);
1308 	case 4:
1309 	case 11:
1310 	case 22:
1311 		return ((ic->ic_curmode == IEEE80211_MODE_11B) ? 4 : rate);
1312 
1313 	/* OFDM rates */
1314 	case 12:
1315 	case 18:
1316 		return (12);
1317 	case 24:
1318 	case 36:
1319 		return (24);
1320 	case 48:
1321 	case 72:
1322 	case 96:
1323 	case 108:
1324 		return (48);
1325 	}
1326 
1327 	/* default to 1Mbps */
1328 	return (2);
1329 }
1330 
1331 /*
1332  * Compute the duration (in us) needed to transmit `len' bytes at rate `rate'.
1333  * The function automatically determines the operating mode depending on the
1334  * given rate. `flags' indicates whether short preamble is in use or not.
1335  */
1336 static uint16_t
1337 rt2560_txtime(int len, int rate, uint32_t flags)
1338 {
1339 	uint16_t txtime;
1340 
1341 	if (RAL_RATE_IS_OFDM(rate)) {
1342 		/* IEEE Std 802.11a-1999, pp. 37 */
1343 		txtime = (8 + 4 * len + 3 + rate - 1) / rate;
1344 		txtime = 16 + 4 + 4 * txtime + 6;
1345 	} else {
1346 		/* IEEE Std 802.11b-1999, pp. 28 */
1347 		txtime = (16 * len + rate - 1) / rate;
1348 		if (rate != 2 && (flags & IEEE80211_F_SHPREAMBLE))
1349 			txtime +=  72 + 24;
1350 		else
1351 			txtime += 144 + 48;
1352 	}
1353 
1354 	return (txtime);
1355 }
1356 
1357 static uint8_t
1358 rt2560_plcp_signal(int rate)
1359 {
1360 	switch (rate) {
1361 	/* CCK rates (returned values are device-dependent) */
1362 	case 2:		return (0x0);
1363 	case 4:		return (0x1);
1364 	case 11:	return (0x2);
1365 	case 22:	return (0x3);
1366 
1367 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1368 	case 12:	return (0xb);
1369 	case 18:	return (0xf);
1370 	case 24:	return (0xa);
1371 	case 36:	return (0xe);
1372 	case 48:	return (0x9);
1373 	case 72:	return (0xd);
1374 	case 96:	return (0x8);
1375 	case 108:	return (0xc);
1376 
1377 	/* unsupported rates (should not get there) */
1378 	default:	return (0xff);
1379 	}
1380 }
1381 
1382 void
1383 rt2560_setup_tx_desc(struct rt2560_softc *sc, struct rt2560_tx_desc *desc,
1384     uint32_t flags, int len, int rate, int encrypt)
1385 {
1386 	struct ieee80211com *ic = &sc->sc_ic;
1387 	uint16_t plcp_length;
1388 	int remainder;
1389 
1390 	desc->flags = LE_32(flags);
1391 	desc->flags |= LE_32(len << 16);
1392 	desc->flags |= encrypt ? LE_32(RT2560_TX_CIPHER_BUSY) :
1393 	    LE_32(RT2560_TX_BUSY | RT2560_TX_VALID);
1394 
1395 	desc->wme = LE_16(
1396 	    RT2560_AIFSN(2) |
1397 	    RT2560_LOGCWMIN(3) |
1398 	    RT2560_LOGCWMAX(8));
1399 
1400 	/* setup PLCP fields */
1401 	desc->plcp_signal  = rt2560_plcp_signal(rate);
1402 	desc->plcp_service = 4;
1403 
1404 	len += IEEE80211_CRC_LEN;
1405 	if (RAL_RATE_IS_OFDM(rate)) {
1406 		desc->flags |= LE_32(RT2560_TX_OFDM);
1407 
1408 		plcp_length = len & 0xfff;
1409 		desc->plcp_length_hi = plcp_length >> 6;
1410 		desc->plcp_length_lo = plcp_length & 0x3f;
1411 	} else {
1412 		plcp_length = (16 * len + rate - 1) / rate;
1413 		if (rate == 22) {
1414 			remainder = (16 * len) % 22;
1415 			if (remainder != 0 && remainder < 7)
1416 				desc->plcp_service |= RT2560_PLCP_LENGEXT;
1417 		}
1418 		desc->plcp_length_hi = plcp_length >> 8;
1419 		desc->plcp_length_lo = plcp_length & 0xff;
1420 
1421 		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1422 			desc->plcp_signal |= 0x08;
1423 	}
1424 }
1425 
1426 /* ARGSUSED */
1427 int
1428 rt2560_mgmt_send(ieee80211com_t *ic, mblk_t *mp, uint8_t type)
1429 {
1430 	struct rt2560_softc *sc = (struct rt2560_softc *)ic;
1431 	struct rt2560_tx_desc *desc;
1432 	struct rt2560_tx_data *data;
1433 	struct ieee80211_frame *wh;
1434 	uint16_t dur;
1435 	uint32_t flags = 0;
1436 	int rate, err = DDI_SUCCESS;
1437 
1438 	int off, pktlen, mblen;
1439 	caddr_t dest;
1440 	mblk_t *m, *m0;
1441 
1442 	struct dma_region *dr;
1443 	uint32_t idx;
1444 	struct ieee80211_node *ni;
1445 	struct ieee80211_key *k;
1446 
1447 	mutex_enter(&sc->prioq.tx_lock);
1448 
1449 	if (!RAL_IS_RUNNING(sc)) {
1450 		err = ENXIO;
1451 		goto fail1;
1452 	}
1453 
1454 	if (sc->prioq.queued >= RT2560_PRIO_RING_COUNT) {
1455 		err = ENOMEM;
1456 		sc->sc_tx_nobuf++;
1457 		goto fail1;
1458 	}
1459 
1460 	m = allocb(msgdsize(mp) + 32, BPRI_MED);
1461 	if (m == NULL) {
1462 		ral_debug(RAL_DBG_TX, "rt2560_mgmt_send: can't alloc mblk.\n");
1463 		err = DDI_FAILURE;
1464 		goto fail1;
1465 	}
1466 
1467 	for (off = 0, m0 = mp; m0 != NULL; m0 = m0->b_cont) {
1468 		mblen = MBLKL(m0);
1469 		(void) memcpy(m->b_rptr + off, m0->b_rptr, mblen);
1470 		off += mblen;
1471 	}
1472 	m->b_wptr += off;
1473 
1474 	wh = (struct ieee80211_frame *)m->b_rptr;
1475 	ni = ieee80211_find_txnode(ic, wh->i_addr1);
1476 
1477 	if (ni == NULL) {
1478 		err = DDI_FAILURE;
1479 		sc->sc_tx_err++;
1480 		goto fail2;
1481 	}
1482 
1483 	/* to support shared_key auth mode */
1484 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1485 		k = ieee80211_crypto_encap(ic, m);
1486 		if (k == NULL) {
1487 			err = DDI_FAILURE;
1488 			sc->sc_tx_err++;
1489 			goto fail3;
1490 		}
1491 		/* packet header may have moved, reset our local pointer */
1492 		wh = (struct ieee80211_frame *)m->b_rptr;
1493 	}
1494 
1495 	desc = &sc->prioq.desc[sc->prioq.cur];
1496 	data = &sc->prioq.data[sc->prioq.cur];
1497 
1498 	rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
1499 	data->ni = ieee80211_ref_node(ni);
1500 
1501 	pktlen = msgdsize(m);
1502 	dest = data->buf;
1503 	bcopy(m->b_rptr, dest, pktlen);
1504 
1505 	wh = (struct ieee80211_frame *)m->b_rptr;
1506 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1507 		flags |= RT2560_TX_ACK;
1508 
1509 		dur = rt2560_txtime(RAL_ACK_SIZE, rate, ic->ic_flags) +
1510 		    RAL_SIFS;
1511 		/* LINTED E_BAD_PTR_CAST_ALIGN */
1512 		*(uint16_t *)wh->i_dur = LE_16(dur);
1513 
1514 		/* tell hardware to add timestamp for probe responses */
1515 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1516 		    IEEE80211_FC0_TYPE_MGT &&
1517 		    (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1518 		    IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1519 			flags |= RT2560_TX_TIMESTAMP;
1520 	}
1521 
1522 	rt2560_setup_tx_desc(sc, desc, flags, pktlen, rate, 0);
1523 
1524 	idx = sc->prioq.cur;
1525 
1526 	dr = &sc->prioq.dr_txbuf[idx];
1527 	(void) ddi_dma_sync(dr->dr_hnd, 0, RAL_TXBUF_SIZE, DDI_DMA_SYNC_FORDEV);
1528 
1529 	dr = &sc->prioq.dr_desc;
1530 	(void) ddi_dma_sync(dr->dr_hnd, idx * RT2560_TX_DESC_SIZE,
1531 	    RT2560_TX_DESC_SIZE, DDI_DMA_SYNC_FORDEV);
1532 
1533 	ral_debug(RAL_DBG_MGMT, "sending mgt frame len=%u idx=%u rate=%u\n",
1534 	    pktlen, sc->prioq.cur, rate);
1535 
1536 	/* kick prio */
1537 	sc->prioq.queued++; /* IF > RT2560_PRIO_RING_COUNT? FULL */
1538 	sc->prioq.cur = (sc->prioq.cur + 1) % RT2560_PRIO_RING_COUNT;
1539 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_PRIO);
1540 
1541 	sc->sc_tx_timer = 5;
1542 
1543 	ic->ic_stats.is_tx_frags++;
1544 	ic->ic_stats.is_tx_bytes += pktlen;
1545 
1546 fail3:
1547 	ieee80211_free_node(ni);
1548 fail2:
1549 	freemsg(m);
1550 fail1:
1551 	freemsg(mp);
1552 	mutex_exit(&sc->prioq.tx_lock);
1553 
1554 	return (err);
1555 }
1556 
1557 static int
1558 rt2560_send(ieee80211com_t *ic, mblk_t *mp)
1559 {
1560 	struct rt2560_softc *sc = (struct rt2560_softc *)ic;
1561 	struct rt2560_tx_desc *desc;
1562 	struct rt2560_tx_data *data;
1563 	struct rt2560_node *rn;
1564 	struct ieee80211_rateset *rs;
1565 	struct ieee80211_frame *wh;
1566 	struct ieee80211_key *k;
1567 	uint16_t dur;
1568 	uint32_t flags = 0;
1569 	int rate, err = DDI_SUCCESS;
1570 
1571 	struct ieee80211_node *ni;
1572 	mblk_t *m, *m0;
1573 	int off, mblen, pktlen;
1574 	caddr_t dest;
1575 
1576 	struct dma_region *dr;
1577 	uint32_t idx;
1578 
1579 	mutex_enter(&sc->txq.tx_lock);
1580 
1581 	if (sc->txq.queued >= RT2560_TX_RING_COUNT - 1) {
1582 		ral_debug(RAL_DBG_TX, "ral: rt2560_tx_data(): "
1583 		    "no TX DMA buffer available!\n");
1584 		sc->sc_need_sched = 1;
1585 		sc->sc_tx_nobuf++;
1586 		err = ENOMEM;
1587 		goto fail1;
1588 	}
1589 
1590 	m = allocb(msgdsize(mp) + 32, BPRI_MED);
1591 	if (m == NULL) {
1592 		ral_debug(RAL_DBG_TX, "rt2560_xmit(): can't alloc mblk.\n");
1593 		err = DDI_FAILURE;
1594 		goto fail1;
1595 	}
1596 
1597 	for (off = 0, m0 = mp; m0 != NULL; m0 = m0->b_cont) {
1598 		mblen = MBLKL(m0);
1599 		(void) memcpy(m->b_rptr + off, m0->b_rptr, mblen);
1600 		off += mblen;
1601 	}
1602 	m->b_wptr += off;
1603 
1604 	wh = (struct ieee80211_frame *)m->b_rptr;
1605 	ni = ieee80211_find_txnode(ic, wh->i_addr1);
1606 
1607 	if (ni == NULL) {
1608 		err = DDI_FAILURE;
1609 		sc->sc_tx_err++;
1610 		goto fail2;
1611 	}
1612 
1613 	(void) ieee80211_encap(ic, m, ni);
1614 
1615 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1616 		k = ieee80211_crypto_encap(ic, m);
1617 		if (k == NULL) {
1618 			sc->sc_tx_err++;
1619 			err = DDI_FAILURE;
1620 			goto fail3;
1621 		}
1622 		/* packet header may have moved, reset our local pointer */
1623 		wh = (struct ieee80211_frame *)m->b_rptr;
1624 	}
1625 
1626 	/*
1627 	 * RTS/CTS exchange ignore, since the max packet will less than
1628 	 * the rtsthreshold (2346)
1629 	 * Unnecessary codes deleted.
1630 	 */
1631 
1632 	data = &sc->txq.data[sc->txq.cur];
1633 	desc = &sc->txq.desc[sc->txq.cur];
1634 
1635 	data->ni = ieee80211_ref_node(ni);
1636 
1637 	pktlen = msgdsize(m);
1638 	dest = data->buf;
1639 	bcopy(m->b_rptr, dest, pktlen);
1640 
1641 	if (ic->ic_fixed_rate != IEEE80211_FIXED_RATE_NONE) {
1642 		rs = &ic->ic_sup_rates[ic->ic_curmode];
1643 		rate = rs->ir_rates[ic->ic_fixed_rate];
1644 	} else {
1645 		rs = &ni->in_rates;
1646 		rn = (struct rt2560_node *)ni;
1647 		ni->in_txrate = ral_rssadapt_choose(&rn->rssadapt, rs, wh,
1648 		    pktlen, NULL, 0);
1649 		rate = rs->ir_rates[ni->in_txrate];
1650 	}
1651 
1652 	rate &= IEEE80211_RATE_VAL;
1653 	if (rate <= 0) {
1654 		rate = 2;	/* basic rate */
1655 	}
1656 
1657 	/* remember link conditions for rate adaptation algorithm */
1658 	if (ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE) {
1659 		data->id.id_len = pktlen;
1660 		data->id.id_rateidx = ni->in_txrate;
1661 		data->id.id_node = ni;
1662 		data->id.id_rssi = ni->in_rssi;
1663 	} else
1664 		data->id.id_node = NULL;
1665 
1666 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1667 		flags |= RT2560_TX_ACK;
1668 
1669 		dur = rt2560_txtime(RAL_ACK_SIZE, rt2560_ack_rate(ic, rate),
1670 		    ic->ic_flags) + RAL_SIFS;
1671 		/* LINTED E_BAD_PTR_CAST_ALIGN */
1672 		*(uint16_t *)wh->i_dur = LE_16(dur);
1673 	}
1674 
1675 	/* flags |= RT2560_TX_CIPHER_NONE; */
1676 	rt2560_setup_tx_desc(sc, desc, flags, pktlen, rate, 0);
1677 
1678 	idx = sc->txq.cur;
1679 
1680 	dr = &sc->txq.dr_txbuf[idx];
1681 	(void) ddi_dma_sync(dr->dr_hnd, 0, RAL_TXBUF_SIZE, DDI_DMA_SYNC_FORDEV);
1682 
1683 	dr = &sc->txq.dr_desc;
1684 	(void) ddi_dma_sync(dr->dr_hnd, idx * RT2560_TX_DESC_SIZE,
1685 	    RT2560_TX_DESC_SIZE, DDI_DMA_SYNC_FORDEV);
1686 
1687 	ral_debug(RAL_DBG_TX, "sending data frame len=%u idx=%u rate=%u\n",
1688 	    pktlen, sc->txq.cur, rate);
1689 
1690 	/* kick tx */
1691 	sc->txq.queued++;
1692 	sc->txq.cur = (sc->txq.cur + 1) % RT2560_TX_RING_COUNT;
1693 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_TX);
1694 
1695 	sc->sc_tx_timer = 5;
1696 
1697 	ic->ic_stats.is_tx_frags++;
1698 	ic->ic_stats.is_tx_bytes += pktlen;
1699 
1700 	freemsg(mp);
1701 fail3:
1702 	ieee80211_free_node(ni);
1703 fail2:
1704 	freemsg(m);
1705 fail1:
1706 	mutex_exit(&sc->txq.tx_lock);
1707 	return (err);
1708 }
1709 
1710 static mblk_t *
1711 rt2560_m_tx(void *arg, mblk_t *mp)
1712 {
1713 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
1714 	struct ieee80211com *ic = &sc->sc_ic;
1715 	mblk_t *next;
1716 
1717 	if (!RAL_IS_RUNNING(sc)) {
1718 		freemsgchain(mp);
1719 		return (NULL);
1720 	}
1721 	/*
1722 	 * No data frames go out unless we're associated; this
1723 	 * should not happen as the 802.11 layer does not enable
1724 	 * the xmit queue until we enter the RUN state.
1725 	 */
1726 	if (ic->ic_state != IEEE80211_S_RUN) {
1727 		ral_debug(RAL_DBG_TX, "ral: rt2560_m_tx(): "
1728 		    "discard, state %u\n", ic->ic_state);
1729 		freemsgchain(mp);
1730 		return (NULL);
1731 	}
1732 
1733 	while (mp != NULL) {
1734 		next = mp->b_next;
1735 		mp->b_next = NULL;
1736 		if (rt2560_send(ic, mp) != DDI_SUCCESS) {
1737 			mp->b_next = next;
1738 			freemsgchain(mp);
1739 			return (NULL);
1740 		}
1741 		mp = next;
1742 	}
1743 	return (mp);
1744 }
1745 
1746 static void
1747 rt2560_set_macaddr(struct rt2560_softc *sc, uint8_t *addr)
1748 {
1749 	uint32_t tmp;
1750 
1751 	tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
1752 	RAL_WRITE(sc, RT2560_CSR3, tmp);
1753 
1754 	tmp = addr[4] | addr[5] << 8;
1755 	RAL_WRITE(sc, RT2560_CSR4, tmp);
1756 
1757 	ral_debug(RAL_DBG_HW,
1758 	    "setting MAC address to " MACSTR "\n", MAC2STR(addr));
1759 }
1760 
1761 static void
1762 rt2560_get_macaddr(struct rt2560_softc *sc, uint8_t *addr)
1763 {
1764 	uint32_t tmp;
1765 
1766 	tmp = RAL_READ(sc, RT2560_CSR3);
1767 	addr[0] = tmp & 0xff;
1768 	addr[1] = (tmp >>  8) & 0xff;
1769 	addr[2] = (tmp >> 16) & 0xff;
1770 	addr[3] = (tmp >> 24);
1771 
1772 	tmp = RAL_READ(sc, RT2560_CSR4);
1773 	addr[4] = tmp & 0xff;
1774 	addr[5] = (tmp >> 8) & 0xff;
1775 }
1776 
1777 static void
1778 rt2560_update_promisc(struct rt2560_softc *sc)
1779 {
1780 	uint32_t tmp;
1781 
1782 	tmp = RAL_READ(sc, RT2560_RXCSR0);
1783 	tmp &= ~RT2560_DROP_NOT_TO_ME;
1784 	if (!(sc->sc_rcr & RAL_RCR_PROMISC))
1785 		tmp |= RT2560_DROP_NOT_TO_ME;
1786 
1787 	RAL_WRITE(sc, RT2560_RXCSR0, tmp);
1788 	ral_debug(RAL_DBG_HW, "%s promiscuous mode\n",
1789 	    (sc->sc_rcr & RAL_RCR_PROMISC) ?  "entering" : "leaving");
1790 }
1791 
1792 static const char *
1793 rt2560_get_rf(int rev)
1794 {
1795 	switch (rev) {
1796 	case RT2560_RF_2522:	return ("RT2522");
1797 	case RT2560_RF_2523:	return ("RT2523");
1798 	case RT2560_RF_2524:	return ("RT2524");
1799 	case RT2560_RF_2525:	return ("RT2525");
1800 	case RT2560_RF_2525E:	return ("RT2525e");
1801 	case RT2560_RF_2526:	return ("RT2526");
1802 	case RT2560_RF_5222:	return ("RT5222");
1803 	default:		return ("unknown");
1804 	}
1805 }
1806 
1807 static void
1808 rt2560_read_eeprom(struct rt2560_softc *sc)
1809 {
1810 	uint16_t val;
1811 	int i;
1812 
1813 	val = rt2560_eeprom_read(sc, RT2560_EEPROM_CONFIG0);
1814 	sc->rf_rev =   (val >> 11) & 0x7;
1815 	sc->hw_radio = (val >> 10) & 0x1;
1816 	sc->led_mode = (val >> 6)  & 0x7;
1817 	sc->rx_ant =   (val >> 4)  & 0x3;
1818 	sc->tx_ant =   (val >> 2)  & 0x3;
1819 	sc->nb_ant =   val & 0x3;
1820 
1821 	/* read default values for BBP registers */
1822 	for (i = 0; i < 16; i++) {
1823 		val = rt2560_eeprom_read(sc, RT2560_EEPROM_BBP_BASE + i);
1824 		sc->bbp_prom[i].reg = val >> 8;
1825 		sc->bbp_prom[i].val = val & 0xff;
1826 	}
1827 
1828 	/* read Tx power for all b/g channels */
1829 	for (i = 0; i < 14 / 2; i++) {
1830 		val = rt2560_eeprom_read(sc, RT2560_EEPROM_TXPOWER + i);
1831 		sc->txpow[i * 2] = val >> 8;
1832 		sc->txpow[i * 2 + 1] = val & 0xff;
1833 	}
1834 }
1835 
1836 static int
1837 rt2560_bbp_init(struct rt2560_softc *sc)
1838 {
1839 #define	N(a)	(sizeof (a) / sizeof ((a)[0]))
1840 	int i, ntries;
1841 
1842 	/* wait for BBP to be ready */
1843 	for (ntries = 0; ntries < 100; ntries++) {
1844 		if (rt2560_bbp_read(sc, RT2560_BBP_VERSION) != 0)
1845 			break;
1846 		drv_usecwait(1);
1847 	}
1848 	if (ntries == 100) {
1849 		ral_debug(RAL_DBG_HW, "timeout waiting for BBP\n");
1850 		return (EIO);
1851 	}
1852 	/* initialize BBP registers to default values */
1853 	for (i = 0; i < N(rt2560_def_bbp); i++) {
1854 		rt2560_bbp_write(sc, rt2560_def_bbp[i].reg,
1855 		    rt2560_def_bbp[i].val);
1856 	}
1857 
1858 	return (0);
1859 #undef N
1860 }
1861 
1862 static void
1863 rt2560_set_txantenna(struct rt2560_softc *sc, int antenna)
1864 {
1865 	uint32_t tmp;
1866 	uint8_t tx;
1867 
1868 	tx = rt2560_bbp_read(sc, RT2560_BBP_TX) & ~RT2560_BBP_ANTMASK;
1869 	if (antenna == 1)
1870 		tx |= RT2560_BBP_ANTA;
1871 	else if (antenna == 2)
1872 		tx |= RT2560_BBP_ANTB;
1873 	else
1874 		tx |= RT2560_BBP_DIVERSITY;
1875 
1876 	/* need to force I/Q flip for RF 2525e, 2526 and 5222 */
1877 	if (sc->rf_rev == RT2560_RF_2525E || sc->rf_rev == RT2560_RF_2526 ||
1878 	    sc->rf_rev == RT2560_RF_5222)
1879 		tx |= RT2560_BBP_FLIPIQ;
1880 
1881 	rt2560_bbp_write(sc, RT2560_BBP_TX, tx);
1882 
1883 	/* update values for CCK and OFDM in BBPCSR1 */
1884 	tmp = RAL_READ(sc, RT2560_BBPCSR1) & ~0x00070007;
1885 	tmp |= (tx & 0x7) << 16 | (tx & 0x7);
1886 	RAL_WRITE(sc, RT2560_BBPCSR1, tmp);
1887 }
1888 
1889 static void
1890 rt2560_set_rxantenna(struct rt2560_softc *sc, int antenna)
1891 {
1892 	uint8_t rx;
1893 
1894 	rx = rt2560_bbp_read(sc, RT2560_BBP_RX) & ~RT2560_BBP_ANTMASK;
1895 	if (antenna == 1)
1896 		rx |= RT2560_BBP_ANTA;
1897 	else if (antenna == 2)
1898 		rx |= RT2560_BBP_ANTB;
1899 	else
1900 		rx |= RT2560_BBP_DIVERSITY;
1901 
1902 	/* need to force no I/Q flip for RF 2525e and 2526 */
1903 	if (sc->rf_rev == RT2560_RF_2525E || sc->rf_rev == RT2560_RF_2526)
1904 		rx &= ~RT2560_BBP_FLIPIQ;
1905 
1906 	rt2560_bbp_write(sc, RT2560_BBP_RX, rx);
1907 }
1908 
1909 static void
1910 rt2560_stop(struct rt2560_softc *sc)
1911 {
1912 	struct ieee80211com *ic = &sc->sc_ic;
1913 
1914 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
1915 	ieee80211_stop_watchdog(ic);	/* stop the watchdog */
1916 
1917 	RAL_LOCK(sc);
1918 	sc->sc_tx_timer = 0;
1919 
1920 	/* abort Tx */
1921 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_ABORT_TX);
1922 
1923 	/* disable Rx */
1924 	RAL_WRITE(sc, RT2560_RXCSR0, RT2560_DISABLE_RX);
1925 
1926 	/* reset ASIC (imply reset BBP) */
1927 	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
1928 	RAL_WRITE(sc, RT2560_CSR1, 0);
1929 
1930 	/* disable interrupts */
1931 	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
1932 
1933 	/* reset Tx and Rx rings */
1934 	rt2560_reset_tx_ring(sc, &sc->txq);
1935 	rt2560_reset_tx_ring(sc, &sc->prioq);
1936 	rt2560_reset_rx_ring(sc, &sc->rxq);
1937 	RAL_UNLOCK(sc);
1938 }
1939 
1940 static int
1941 rt2560_init(struct rt2560_softc *sc)
1942 {
1943 #define	N(a)	(sizeof (a) / sizeof ((a)[0]))
1944 	/* struct rt2560_softc *sc = priv; */
1945 	struct ieee80211com *ic = &sc->sc_ic;
1946 	uint32_t tmp;
1947 	int i;
1948 
1949 	rt2560_stop(sc);
1950 
1951 	RAL_LOCK(sc);
1952 	/* setup tx/rx ring */
1953 	rt2560_ring_hwsetup(sc);
1954 
1955 	/* initialize MAC registers to default values */
1956 	for (i = 0; i < N(rt2560_def_mac); i++)
1957 		RAL_WRITE(sc, rt2560_def_mac[i].reg, rt2560_def_mac[i].val);
1958 
1959 	rt2560_set_macaddr(sc, ic->ic_macaddr);
1960 
1961 	/* set basic rate set (will be updated later) */
1962 	RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x153);
1963 
1964 	rt2560_set_txantenna(sc, sc->tx_ant);
1965 	rt2560_set_rxantenna(sc, sc->rx_ant);
1966 	rt2560_update_slot(ic, 1);
1967 	rt2560_update_plcp(sc);
1968 	rt2560_update_led(sc, 0, 0);
1969 
1970 	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
1971 	RAL_WRITE(sc, RT2560_CSR1, RT2560_HOST_READY);
1972 
1973 	if (rt2560_bbp_init(sc) != 0) {
1974 		RAL_UNLOCK(sc);
1975 		rt2560_stop(sc);
1976 		return (DDI_FAILURE);
1977 	}
1978 
1979 	/* set default BSS channel */
1980 	rt2560_set_chan(sc, ic->ic_curchan);
1981 
1982 	/* kick Rx */
1983 	tmp = RT2560_DROP_PHY_ERROR | RT2560_DROP_CRC_ERROR;
1984 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
1985 		tmp |= RT2560_DROP_CTL | RT2560_DROP_VERSION_ERROR;
1986 		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
1987 			tmp |= RT2560_DROP_TODS;
1988 		if (!(sc->sc_rcr & RAL_RCR_PROMISC))
1989 			tmp |= RT2560_DROP_NOT_TO_ME;
1990 
1991 	}
1992 	RAL_WRITE(sc, RT2560_RXCSR0, tmp);
1993 
1994 	/* clear old FCS and Rx FIFO errors */
1995 	(void) RAL_READ(sc, RT2560_CNT0);
1996 	(void) RAL_READ(sc, RT2560_CNT4);
1997 
1998 	/* clear any pending interrupts */
1999 	RAL_WRITE(sc, RT2560_CSR7, 0xffffffff);
2000 	/* enable interrupts */
2001 	RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
2002 
2003 	RAL_UNLOCK(sc);
2004 #undef N
2005 	return (DDI_SUCCESS);
2006 }
2007 
2008 void
2009 rt2560_watchdog(void *arg)
2010 {
2011 	struct rt2560_softc *sc = arg;
2012 	struct ieee80211com *ic = &sc->sc_ic;
2013 	int ntimer = 0;
2014 
2015 	RAL_LOCK(sc);
2016 	ic->ic_watchdog_timer = 0;
2017 
2018 	if (!RAL_IS_RUNNING(sc)) {
2019 		RAL_UNLOCK(sc);
2020 		return;
2021 	}
2022 
2023 	if (sc->sc_tx_timer > 0) {
2024 		if (--sc->sc_tx_timer == 0) {
2025 			ral_debug(RAL_DBG_MSG, "tx timer timeout\n");
2026 			RAL_UNLOCK(sc);
2027 			(void) rt2560_init(sc);
2028 			(void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2029 			return;
2030 		}
2031 	}
2032 
2033 	if (ic->ic_state == IEEE80211_S_RUN)
2034 		ntimer = 1;
2035 
2036 	RAL_UNLOCK(sc);
2037 
2038 	ieee80211_watchdog(ic);
2039 
2040 	if (ntimer)
2041 		ieee80211_start_watchdog(ic, ntimer);
2042 }
2043 
2044 static int
2045 rt2560_m_start(void *arg)
2046 {
2047 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2048 	int err;
2049 
2050 	/*
2051 	 * initialize rt2560 hardware
2052 	 */
2053 	err = rt2560_init(sc);
2054 	if (err != DDI_SUCCESS) {
2055 		ral_debug(RAL_DBG_GLD, "device configuration failed\n");
2056 		goto fail;
2057 	}
2058 	sc->sc_flags |= RAL_FLAG_RUNNING;	/* RUNNING */
2059 	return (err);
2060 
2061 fail:
2062 	rt2560_stop(sc);
2063 	return (err);
2064 }
2065 
2066 static void
2067 rt2560_m_stop(void *arg)
2068 {
2069 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2070 
2071 	(void) rt2560_stop(sc);
2072 	sc->sc_flags &= ~RAL_FLAG_RUNNING;	/* STOP */
2073 }
2074 
2075 static int
2076 rt2560_m_unicst(void *arg, const uint8_t *macaddr)
2077 {
2078 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2079 	struct ieee80211com *ic = &sc->sc_ic;
2080 
2081 	ral_debug(RAL_DBG_GLD, "rt2560_m_unicst(): " MACSTR "\n",
2082 	    MAC2STR(macaddr));
2083 
2084 	IEEE80211_ADDR_COPY(ic->ic_macaddr, macaddr);
2085 	(void) rt2560_set_macaddr(sc, (uint8_t *)macaddr);
2086 	(void) rt2560_init(sc);
2087 
2088 	return (0);
2089 }
2090 
2091 /*ARGSUSED*/
2092 static int
2093 rt2560_m_multicst(void *arg, boolean_t add, const uint8_t *mca)
2094 {
2095 	return (0);
2096 }
2097 
2098 static int
2099 rt2560_m_promisc(void *arg, boolean_t on)
2100 {
2101 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2102 
2103 	if (on) {
2104 		sc->sc_rcr |= RAL_RCR_PROMISC;
2105 		sc->sc_rcr |= RAL_RCR_MULTI;
2106 	} else {
2107 		sc->sc_rcr &= ~RAL_RCR_PROMISC;
2108 		sc->sc_rcr &= ~RAL_RCR_PROMISC;
2109 	}
2110 
2111 	rt2560_update_promisc(sc);
2112 	return (0);
2113 }
2114 
2115 /*
2116  * callback functions for /get/set properties
2117  */
2118 static int
2119 rt2560_m_setprop(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
2120     uint_t wldp_length, const void *wldp_buf)
2121 {
2122 	struct rt2560_softc *sc = arg;
2123 	struct ieee80211com *ic = &sc->sc_ic;
2124 	int err;
2125 
2126 	err = ieee80211_setprop(ic, pr_name, wldp_pr_num,
2127 	    wldp_length, wldp_buf);
2128 	RAL_LOCK(sc);
2129 	if (err == ENETRESET) {
2130 		if (RAL_IS_RUNNING(sc)) {
2131 			RAL_UNLOCK(sc);
2132 			(void) rt2560_init(sc);
2133 			(void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2134 			RAL_LOCK(sc);
2135 		}
2136 		err = 0;
2137 	}
2138 	RAL_UNLOCK(sc);
2139 
2140 	return (err);
2141 }
2142 
2143 static int
2144 rt2560_m_getprop(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
2145     uint_t wldp_length, void *wldp_buf)
2146 {
2147 	struct rt2560_softc *sc = arg;
2148 	int err;
2149 
2150 	err = ieee80211_getprop(&sc->sc_ic, pr_name, wldp_pr_num,
2151 	    wldp_length, wldp_buf);
2152 
2153 	return (err);
2154 }
2155 
2156 static void
2157 rt2560_m_propinfo(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
2158     mac_prop_info_handle_t prh)
2159 {
2160 	struct rt2560_softc *sc = arg;
2161 
2162 	ieee80211_propinfo(&sc->sc_ic, pr_name, wldp_pr_num, prh);
2163 }
2164 
2165 static void
2166 rt2560_m_ioctl(void* arg, queue_t *wq, mblk_t *mp)
2167 {
2168 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2169 	struct ieee80211com *ic = &sc->sc_ic;
2170 	int err;
2171 
2172 	err = ieee80211_ioctl(ic, wq, mp);
2173 	RAL_LOCK(sc);
2174 	if (err == ENETRESET) {
2175 		if (RAL_IS_RUNNING(sc)) {
2176 			RAL_UNLOCK(sc);
2177 			(void) rt2560_init(sc);
2178 			(void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2179 			RAL_LOCK(sc);
2180 		}
2181 	}
2182 	RAL_UNLOCK(sc);
2183 }
2184 
2185 static int
2186 rt2560_m_stat(void *arg, uint_t stat, uint64_t *val)
2187 {
2188 	struct rt2560_softc *sc  = (struct rt2560_softc *)arg;
2189 	ieee80211com_t	*ic = &sc->sc_ic;
2190 	ieee80211_node_t *ni = ic->ic_bss;
2191 	struct ieee80211_rateset *rs = &ni->in_rates;
2192 
2193 	RAL_LOCK(sc);
2194 	switch (stat) {
2195 	case MAC_STAT_IFSPEED:
2196 		*val = ((ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE) ?
2197 		    (rs->ir_rates[ni->in_txrate] & IEEE80211_RATE_VAL)
2198 		    : ic->ic_fixed_rate) / 2 * 1000000;
2199 		break;
2200 	case MAC_STAT_NOXMTBUF:
2201 		*val = sc->sc_tx_nobuf;
2202 		break;
2203 	case MAC_STAT_NORCVBUF:
2204 		*val = sc->sc_rx_nobuf;
2205 		break;
2206 	case MAC_STAT_IERRORS:
2207 		*val = sc->sc_rx_err;
2208 		break;
2209 	case MAC_STAT_RBYTES:
2210 		*val = ic->ic_stats.is_rx_bytes;
2211 		break;
2212 	case MAC_STAT_IPACKETS:
2213 		*val = ic->ic_stats.is_rx_frags;
2214 		break;
2215 	case MAC_STAT_OBYTES:
2216 		*val = ic->ic_stats.is_tx_bytes;
2217 		break;
2218 	case MAC_STAT_OPACKETS:
2219 		*val = ic->ic_stats.is_tx_frags;
2220 		break;
2221 	case MAC_STAT_OERRORS:
2222 	case WIFI_STAT_TX_FAILED:
2223 		*val = sc->sc_tx_err;
2224 		break;
2225 	case WIFI_STAT_TX_RETRANS:
2226 		*val = sc->sc_tx_retries;
2227 		break;
2228 	case WIFI_STAT_FCS_ERRORS:
2229 	case WIFI_STAT_WEP_ERRORS:
2230 	case WIFI_STAT_TX_FRAGS:
2231 	case WIFI_STAT_MCAST_TX:
2232 	case WIFI_STAT_RTS_SUCCESS:
2233 	case WIFI_STAT_RTS_FAILURE:
2234 	case WIFI_STAT_ACK_FAILURE:
2235 	case WIFI_STAT_RX_FRAGS:
2236 	case WIFI_STAT_MCAST_RX:
2237 	case WIFI_STAT_RX_DUPS:
2238 		RAL_UNLOCK(sc);
2239 		return (ieee80211_stat(ic, stat, val));
2240 	default:
2241 		RAL_UNLOCK(sc);
2242 		return (ENOTSUP);
2243 	}
2244 	RAL_UNLOCK(sc);
2245 
2246 	return (0);
2247 }
2248 
2249 static uint_t
2250 rt2560_intr(caddr_t arg)
2251 {
2252 	/* LINTED E_BAD_PTR_CAST_ALIGN */
2253 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2254 	uint32_t r;
2255 
2256 	RAL_LOCK(sc);
2257 
2258 	if (!RAL_IS_RUNNING(sc)) {
2259 		/*
2260 		 * The hardware is not ready/present, don't touch anything.
2261 		 * Note this can happen early on if the IRQ is shared.
2262 		 */
2263 		RAL_UNLOCK(sc);
2264 		return (DDI_INTR_UNCLAIMED);
2265 	}
2266 
2267 	r = RAL_READ(sc, RT2560_CSR7);
2268 	RAL_WRITE(sc, RT2560_CSR7, r);
2269 
2270 	if (r == 0xffffffff) {
2271 		RAL_UNLOCK(sc);
2272 		return (DDI_INTR_UNCLAIMED);
2273 	}
2274 
2275 	if (!(r & RT2560_INTR_ALL)) {
2276 		RAL_UNLOCK(sc);
2277 		return (DDI_INTR_UNCLAIMED);
2278 	}
2279 
2280 	/* disable interrupts */
2281 	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
2282 
2283 	if (r & RT2560_TX_DONE) {
2284 		RAL_UNLOCK(sc);
2285 		rt2560_tx_intr(sc);
2286 		RAL_LOCK(sc);
2287 	}
2288 
2289 	if (r & RT2560_PRIO_DONE) {
2290 		RAL_UNLOCK(sc);
2291 		rt2560_prio_intr(sc);
2292 		RAL_LOCK(sc);
2293 	}
2294 
2295 	if (r & RT2560_RX_DONE) {
2296 		sc->sc_rx_pend = 1;
2297 		ddi_trigger_softintr(sc->sc_softint_id);
2298 	}
2299 
2300 	/* re-enable interrupts */
2301 	RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
2302 	RAL_UNLOCK(sc);
2303 
2304 	return (DDI_INTR_CLAIMED);
2305 }
2306 
2307 /*
2308  * quiesce(9E) entry point.
2309  *
2310  * This function is called when the system is single-threaded at high
2311  * PIL with preemption disabled. Therefore, this function must not be
2312  * blocked.
2313  *
2314  * This function returns DDI_SUCCESS on success, or DDI_FAILURE on failure.
2315  * DDI_FAILURE indicates an error condition and should almost never happen.
2316  */
2317 static int32_t
2318 rt2560_quiesce(dev_info_t *devinfo)
2319 {
2320 	struct rt2560_softc *sc;
2321 
2322 	sc = ddi_get_soft_state(ral_soft_state_p, ddi_get_instance(devinfo));
2323 	if (sc == NULL)
2324 		return (DDI_FAILURE);
2325 
2326 	/* abort Tx */
2327 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_ABORT_TX);
2328 
2329 	/* disable Rx */
2330 	RAL_WRITE(sc, RT2560_RXCSR0, RT2560_DISABLE_RX);
2331 
2332 	/* reset ASIC (imply reset BBP) */
2333 	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
2334 	RAL_WRITE(sc, RT2560_CSR1, 0);
2335 
2336 	/* disable interrupts */
2337 	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
2338 
2339 	return (DDI_SUCCESS);
2340 }
2341 
2342 static int
2343 rt2560_attach(dev_info_t *devinfo, ddi_attach_cmd_t cmd)
2344 {
2345 	struct rt2560_softc *sc;
2346 	struct ieee80211com *ic;
2347 	int err, i;
2348 	int instance;
2349 
2350 	ddi_acc_handle_t ioh;
2351 	caddr_t regs;
2352 	uint16_t vendor_id, device_id, command;
2353 	uint8_t cachelsz;
2354 	char strbuf[32];
2355 
2356 	wifi_data_t wd = { 0 };
2357 	mac_register_t *macp;
2358 
2359 	switch (cmd) {
2360 	case DDI_ATTACH:
2361 		break;
2362 	case DDI_RESUME:
2363 		sc = ddi_get_soft_state(ral_soft_state_p,
2364 		    ddi_get_instance(devinfo));
2365 		sc->sc_flags &= ~RAL_FLAG_SUSPENDING;
2366 		if (RAL_IS_INITED(sc))
2367 			(void) rt2560_init(sc);
2368 		return (DDI_SUCCESS);
2369 	default:
2370 		return (DDI_FAILURE);
2371 	}
2372 
2373 	instance = ddi_get_instance(devinfo);
2374 
2375 	if (ddi_soft_state_zalloc(ral_soft_state_p, instance) != DDI_SUCCESS) {
2376 		ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2377 		    "unable to alloc soft_state_p\n");
2378 		return (DDI_FAILURE);
2379 	}
2380 
2381 	sc = ddi_get_soft_state(ral_soft_state_p, instance);
2382 	ic = (ieee80211com_t *)&sc->sc_ic;
2383 	sc->sc_dev = devinfo;
2384 
2385 	/* pci configuration */
2386 	err = ddi_regs_map_setup(devinfo, 0, &regs, 0, 0, &ral_csr_accattr,
2387 	    &ioh);
2388 	if (err != DDI_SUCCESS) {
2389 		ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2390 		    "ddi_regs_map_setup() failed");
2391 		goto fail1;
2392 	}
2393 
2394 	cachelsz = ddi_get8(ioh, (uint8_t *)(regs + PCI_CONF_CACHE_LINESZ));
2395 	if (cachelsz == 0)
2396 		cachelsz = 0x10;
2397 	sc->sc_cachelsz = cachelsz << 2;
2398 
2399 	vendor_id = ddi_get16(ioh,
2400 	    (uint16_t *)((uintptr_t)regs + PCI_CONF_VENID));
2401 	device_id = ddi_get16(ioh,
2402 	    (uint16_t *)((uintptr_t)regs + PCI_CONF_DEVID));
2403 
2404 	ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): vendor 0x%x, "
2405 	    "device id 0x%x, cache size %d\n", vendor_id, device_id, cachelsz);
2406 
2407 	/*
2408 	 * Enable response to memory space accesses,
2409 	 * and enabe bus master.
2410 	 */
2411 	command = PCI_COMM_MAE | PCI_COMM_ME;
2412 	ddi_put16(ioh, (uint16_t *)((uintptr_t)regs + PCI_CONF_COMM), command);
2413 	ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2414 	    "set command reg to 0x%x \n", command);
2415 
2416 	ddi_put8(ioh, (uint8_t *)(regs + PCI_CONF_LATENCY_TIMER), 0xa8);
2417 	ddi_put8(ioh, (uint8_t *)(regs + PCI_CONF_ILINE), 0x10);
2418 	ddi_regs_map_free(&ioh);
2419 
2420 	/* pci i/o space */
2421 	err = ddi_regs_map_setup(devinfo, 1,
2422 	    &sc->sc_rbase, 0, 0, &ral_csr_accattr, &sc->sc_ioh);
2423 	ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2424 	    "regs map1 = %x err=%d\n", regs, err);
2425 	if (err != DDI_SUCCESS) {
2426 		ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2427 		    "ddi_regs_map_setup() failed");
2428 		goto fail1;
2429 	}
2430 
2431 	/* initialize the ral rate */
2432 	ral_rate_init();
2433 
2434 	/* retrieve RT2560 rev. no */
2435 	sc->asic_rev = RAL_READ(sc, RT2560_CSR0);
2436 
2437 	/* retrieve MAC address */
2438 	rt2560_get_macaddr(sc, ic->ic_macaddr);
2439 
2440 	/* retrieve RF rev. no and various other things from EEPROM */
2441 	rt2560_read_eeprom(sc);
2442 
2443 	ral_debug(RAL_DBG_GLD, "MAC/BBP RT2560 (rev 0x%02x), RF %s\n",
2444 	    sc->asic_rev, rt2560_get_rf(sc->rf_rev));
2445 
2446 	/*
2447 	 * Allocate Tx and Rx rings.
2448 	 */
2449 	err = rt2560_alloc_tx_ring(sc, &sc->txq, RT2560_TX_RING_COUNT);
2450 	if (err != DDI_SUCCESS) {
2451 		ral_debug(RAL_DBG_GLD, "could not allocate Tx ring\n");
2452 		goto fail2;
2453 	}
2454 	err = rt2560_alloc_tx_ring(sc, &sc->prioq, RT2560_PRIO_RING_COUNT);
2455 	if (err != DDI_SUCCESS) {
2456 		ral_debug(RAL_DBG_GLD, "could not allocate Prio ring\n");
2457 		goto fail3;
2458 	}
2459 	err = rt2560_alloc_rx_ring(sc, &sc->rxq, RT2560_RX_RING_COUNT);
2460 	if (err != DDI_SUCCESS) {
2461 		ral_debug(RAL_DBG_GLD, "could not allocate Rx ring\n");
2462 		goto fail4;
2463 	}
2464 
2465 	mutex_init(&sc->sc_genlock, NULL, MUTEX_DRIVER, NULL);
2466 	mutex_init(&sc->txq.tx_lock, NULL, MUTEX_DRIVER, NULL);
2467 	mutex_init(&sc->prioq.tx_lock, NULL, MUTEX_DRIVER, NULL);
2468 	mutex_init(&sc->rxq.rx_lock, NULL, MUTEX_DRIVER, NULL);
2469 
2470 
2471 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
2472 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
2473 	ic->ic_state = IEEE80211_S_INIT;
2474 
2475 	ic->ic_maxrssi = 63;
2476 	ic->ic_set_shortslot = rt2560_update_slot;
2477 	ic->ic_xmit = rt2560_mgmt_send;
2478 
2479 	/* set device capabilities */
2480 	ic->ic_caps =
2481 	    IEEE80211_C_TXPMGT |	/* tx power management */
2482 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
2483 	    IEEE80211_C_SHSLOT;		/* short slot time supported */
2484 
2485 	ic->ic_caps |= IEEE80211_C_WPA; /* Support WPA/WPA2 */
2486 
2487 #define	IEEE80211_CHAN_A	\
2488 	(IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_OFDM)
2489 
2490 	if (sc->rf_rev == RT2560_RF_5222) {
2491 		/* set supported .11a rates */
2492 		ic->ic_sup_rates[IEEE80211_MODE_11A] = rt2560_rateset_11a;
2493 
2494 		/* set supported .11a channels */
2495 		for (i = 36; i <= 64; i += 4) {
2496 			ic->ic_sup_channels[i].ich_freq =
2497 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2498 			ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2499 		}
2500 		for (i = 100; i <= 140; i += 4) {
2501 			ic->ic_sup_channels[i].ich_freq =
2502 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2503 			ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2504 		}
2505 		for (i = 149; i <= 161; i += 4) {
2506 			ic->ic_sup_channels[i].ich_freq =
2507 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2508 			ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2509 		}
2510 	}
2511 
2512 	/* set supported .11b and .11g rates */
2513 	ic->ic_sup_rates[IEEE80211_MODE_11B] = rt2560_rateset_11b;
2514 	ic->ic_sup_rates[IEEE80211_MODE_11G] = rt2560_rateset_11g;
2515 
2516 	/* set supported .11b and .11g channels (1 through 14) */
2517 	for (i = 1; i <= 14; i++) {
2518 		ic->ic_sup_channels[i].ich_freq =
2519 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
2520 		ic->ic_sup_channels[i].ich_flags =
2521 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
2522 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
2523 	}
2524 
2525 	ieee80211_attach(ic);
2526 
2527 	/* register WPA door */
2528 	ieee80211_register_door(ic, ddi_driver_name(devinfo),
2529 	    ddi_get_instance(devinfo));
2530 
2531 	ic->ic_node_alloc = rt2560_node_alloc;
2532 	ic->ic_node_free = rt2560_node_free;
2533 
2534 	/* override state transition machine */
2535 	sc->sc_newstate = ic->ic_newstate;
2536 	ic->ic_newstate = rt2560_newstate;
2537 	ic->ic_watchdog = rt2560_watchdog;
2538 	ieee80211_media_init(ic);
2539 	ic->ic_def_txkey = 0;
2540 
2541 	sc->sc_rcr = 0;
2542 	sc->sc_rx_pend = 0;
2543 	sc->dwelltime = 300;
2544 	sc->sc_flags &= ~RAL_FLAG_RUNNING;
2545 
2546 	err = ddi_add_softintr(devinfo, DDI_SOFTINT_LOW,
2547 	    &sc->sc_softint_id, NULL, 0, ral_softint_handler, (caddr_t)sc);
2548 	if (err != DDI_SUCCESS) {
2549 		ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2550 		    "ddi_add_softintr() failed");
2551 		goto fail5;
2552 	}
2553 
2554 	err = ddi_get_iblock_cookie(devinfo, 0, &sc->sc_iblock);
2555 	if (err != DDI_SUCCESS) {
2556 		ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2557 		    "Can not get iblock cookie for INT\n");
2558 		goto fail6;
2559 	}
2560 
2561 	err = ddi_add_intr(devinfo, 0, NULL, NULL, rt2560_intr, (caddr_t)sc);
2562 	if (err != DDI_SUCCESS) {
2563 		ral_debug(RAL_DBG_GLD,
2564 		    "unable to add device interrupt handler\n");
2565 		goto fail6;
2566 	}
2567 
2568 	/*
2569 	 * Provide initial settings for the WiFi plugin; whenever this
2570 	 * information changes, we need to call mac_plugindata_update()
2571 	 */
2572 	wd.wd_opmode = ic->ic_opmode;
2573 	wd.wd_secalloc = WIFI_SEC_NONE;
2574 	IEEE80211_ADDR_COPY(wd.wd_bssid, ic->ic_bss->in_bssid);
2575 
2576 	if ((macp = mac_alloc(MAC_VERSION)) == NULL) {
2577 		ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2578 		    "MAC version mismatch\n");
2579 		goto fail7;
2580 	}
2581 
2582 	macp->m_type_ident	= MAC_PLUGIN_IDENT_WIFI;
2583 	macp->m_driver		= sc;
2584 	macp->m_dip		= devinfo;
2585 	macp->m_src_addr	= ic->ic_macaddr;
2586 	macp->m_callbacks	= &rt2560_m_callbacks;
2587 	macp->m_min_sdu		= 0;
2588 	macp->m_max_sdu		= IEEE80211_MTU;
2589 	macp->m_pdata		= &wd;
2590 	macp->m_pdata_size	= sizeof (wd);
2591 
2592 	err = mac_register(macp, &ic->ic_mach);
2593 	mac_free(macp);
2594 	if (err != 0) {
2595 		ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2596 		    "mac_register err %x\n", err);
2597 		goto fail7;
2598 	}
2599 
2600 	/*
2601 	 * Create minor node of type DDI_NT_NET_WIFI
2602 	 */
2603 	(void) snprintf(strbuf, sizeof (strbuf), "%s%d",
2604 	    "ral", instance);
2605 	err = ddi_create_minor_node(devinfo, strbuf, S_IFCHR,
2606 	    instance + 1, DDI_NT_NET_WIFI, 0);
2607 
2608 	if (err != DDI_SUCCESS)
2609 		ral_debug(RAL_DBG_GLD, "ddi_create_minor_node() failed\n");
2610 
2611 	/*
2612 	 * Notify link is down now
2613 	 */
2614 	mac_link_update(ic->ic_mach, LINK_STATE_DOWN);
2615 
2616 	return (DDI_SUCCESS);
2617 fail7:
2618 	ddi_remove_intr(devinfo, 0, sc->sc_iblock);
2619 fail6:
2620 	ddi_remove_softintr(sc->sc_softint_id);
2621 fail5:
2622 	mutex_destroy(&sc->sc_genlock);
2623 	mutex_destroy(&sc->txq.tx_lock);
2624 	mutex_destroy(&sc->prioq.tx_lock);
2625 	mutex_destroy(&sc->rxq.rx_lock);
2626 
2627 	rt2560_free_rx_ring(sc, &sc->rxq);
2628 fail4:
2629 	rt2560_free_tx_ring(sc, &sc->prioq);
2630 fail3:
2631 	rt2560_free_tx_ring(sc, &sc->txq);
2632 fail2:
2633 	ddi_regs_map_free(&sc->sc_ioh);
2634 fail1:
2635 	ddi_soft_state_free(ral_soft_state_p, ddi_get_instance(devinfo));
2636 
2637 	return (DDI_FAILURE);
2638 }
2639 
2640 static int
2641 rt2560_detach(dev_info_t *devinfo, ddi_detach_cmd_t cmd)
2642 {
2643 	struct rt2560_softc *sc;
2644 
2645 	sc = ddi_get_soft_state(ral_soft_state_p, ddi_get_instance(devinfo));
2646 	ASSERT(sc != NULL);
2647 
2648 	switch (cmd) {
2649 	case DDI_DETACH:
2650 		break;
2651 	case DDI_SUSPEND:
2652 		if (RAL_IS_INITED(sc))
2653 			(void) rt2560_stop(sc);
2654 		sc->sc_flags |= RAL_FLAG_SUSPENDING;
2655 		return (DDI_SUCCESS);
2656 	default:
2657 		return (DDI_FAILURE);
2658 	}
2659 
2660 	if (mac_disable(sc->sc_ic.ic_mach) != 0)
2661 		return (DDI_FAILURE);
2662 
2663 	rt2560_stop(sc);
2664 
2665 	/*
2666 	 * Unregister from the MAC layer subsystem
2667 	 */
2668 	(void) mac_unregister(sc->sc_ic.ic_mach);
2669 
2670 	ddi_remove_intr(devinfo, 0, sc->sc_iblock);
2671 	ddi_remove_softintr(sc->sc_softint_id);
2672 
2673 	/*
2674 	 * detach ieee80211 layer
2675 	 */
2676 	ieee80211_detach(&sc->sc_ic);
2677 
2678 	rt2560_free_tx_ring(sc, &sc->txq);
2679 	rt2560_free_tx_ring(sc, &sc->prioq);
2680 	rt2560_free_rx_ring(sc, &sc->rxq);
2681 
2682 	ddi_regs_map_free(&sc->sc_ioh);
2683 
2684 	mutex_destroy(&sc->sc_genlock);
2685 	mutex_destroy(&sc->txq.tx_lock);
2686 	mutex_destroy(&sc->prioq.tx_lock);
2687 	mutex_destroy(&sc->rxq.rx_lock);
2688 
2689 	ddi_remove_minor_node(devinfo, NULL);
2690 	ddi_soft_state_free(ral_soft_state_p, ddi_get_instance(devinfo));
2691 
2692 	return (DDI_SUCCESS);
2693 }
2694 
2695 int
2696 _info(struct modinfo *modinfop)
2697 {
2698 	return (mod_info(&modlinkage, modinfop));
2699 }
2700 
2701 int
2702 _init(void)
2703 {
2704 	int status;
2705 
2706 	status = ddi_soft_state_init(&ral_soft_state_p,
2707 	    sizeof (struct rt2560_softc), 1);
2708 	if (status != 0)
2709 		return (status);
2710 
2711 	mac_init_ops(&ral_dev_ops, "ral");
2712 	status = mod_install(&modlinkage);
2713 	if (status != 0) {
2714 		mac_fini_ops(&ral_dev_ops);
2715 		ddi_soft_state_fini(&ral_soft_state_p);
2716 	}
2717 	return (status);
2718 }
2719 
2720 int
2721 _fini(void)
2722 {
2723 	int status;
2724 
2725 	status = mod_remove(&modlinkage);
2726 	if (status == 0) {
2727 		mac_fini_ops(&ral_dev_ops);
2728 		ddi_soft_state_fini(&ral_soft_state_p);
2729 	}
2730 	return (status);
2731 }
2732