xref: /titanic_44/usr/src/uts/common/io/ral/rt2560.c (revision ead1f93ee620d7580f7e53350fe5a884fc4f158a)
1 /*
2  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
3  * Use is subject to license terms.
4  */
5 
6 /*
7  * Copyright (c) 2005, 2006
8  *	Damien Bergamini <damien.bergamini@free.fr>
9  *
10  * Permission to use, copy, modify, and distribute this software for any
11  * purpose with or without fee is hereby granted, provided that the above
12  * copyright notice and this permission notice appear in all copies.
13  *
14  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
15  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
16  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
17  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
18  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
20  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21  */
22 
23 /*
24  * Ralink Technology RT2560 chipset driver
25  * http://www.ralinktech.com/
26  */
27 
28 #include <sys/types.h>
29 #include <sys/byteorder.h>
30 #include <sys/cmn_err.h>
31 #include <sys/stat.h>
32 #include <sys/pci.h>
33 #include <sys/ddi.h>
34 #include <sys/sunddi.h>
35 #include <sys/strsubr.h>
36 #include <inet/common.h>
37 #include <sys/note.h>
38 #include <sys/strsun.h>
39 #include <sys/modctl.h>
40 #include <sys/devops.h>
41 #include <sys/mac_provider.h>
42 #include <sys/mac_wifi.h>
43 #include <sys/net80211.h>
44 
45 #include "ral_rate.h"
46 #include "rt2560_reg.h"
47 #include "rt2560_var.h"
48 
49 static void *ral_soft_state_p = NULL;
50 
51 #define	RAL_TXBUF_SIZE  	(IEEE80211_MAX_LEN)
52 #define	RAL_RXBUF_SIZE  	(IEEE80211_MAX_LEN)
53 
54 /* quickly determine if a given rate is CCK or OFDM */
55 #define	RAL_RATE_IS_OFDM(rate)	((rate) >= 12 && (rate) != 22)
56 #define	RAL_ACK_SIZE		14	/* 10 + 4(FCS) */
57 #define	RAL_CTS_SIZE		14	/* 10 + 4(FCS) */
58 #define	RAL_SIFS		10	/* us */
59 #define	RT2560_TXRX_TURNAROUND	10	/* us */
60 
61 /*
62  * Supported rates for 802.11a/b/g modes (in 500Kbps unit).
63  */
64 static const struct ieee80211_rateset rt2560_rateset_11a =
65 	{ 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
66 
67 static const struct ieee80211_rateset rt2560_rateset_11b =
68 	{ 4, { 2, 4, 11, 22 } };
69 
70 static const struct ieee80211_rateset rt2560_rateset_11g =
71 	{ 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
72 
73 static const struct {
74 	uint32_t	reg;
75 	uint32_t	val;
76 } rt2560_def_mac[] = {
77 	RT2560_DEF_MAC
78 };
79 
80 static const struct {
81 	uint8_t	reg;
82 	uint8_t	val;
83 } rt2560_def_bbp[] = {
84 	RT2560_DEF_BBP
85 };
86 
87 static const uint32_t rt2560_rf2522_r2[]    = RT2560_RF2522_R2;
88 static const uint32_t rt2560_rf2523_r2[]    = RT2560_RF2523_R2;
89 static const uint32_t rt2560_rf2524_r2[]    = RT2560_RF2524_R2;
90 static const uint32_t rt2560_rf2525_r2[]    = RT2560_RF2525_R2;
91 static const uint32_t rt2560_rf2525_hi_r2[] = RT2560_RF2525_HI_R2;
92 static const uint32_t rt2560_rf2525e_r2[]   = RT2560_RF2525E_R2;
93 static const uint32_t rt2560_rf2526_r2[]    = RT2560_RF2526_R2;
94 static const uint32_t rt2560_rf2526_hi_r2[] = RT2560_RF2526_HI_R2;
95 
96 static const struct {
97 	uint8_t		chan;
98 	uint32_t	r1, r2, r4;
99 } rt2560_rf5222[] = {
100 	RT2560_RF5222
101 };
102 
103 /*
104  * PIO access attributes for registers
105  */
106 static ddi_device_acc_attr_t ral_csr_accattr = {
107 	DDI_DEVICE_ATTR_V0,
108 	DDI_STRUCTURE_LE_ACC,
109 	DDI_STRICTORDER_ACC
110 };
111 
112 /*
113  * DMA access attributes for descriptors: NOT to be byte swapped.
114  */
115 static ddi_device_acc_attr_t ral_desc_accattr = {
116 	DDI_DEVICE_ATTR_V0,
117 	DDI_STRUCTURE_LE_ACC,
118 	DDI_STRICTORDER_ACC
119 };
120 
121 /*
122  * Describes the chip's DMA engine
123  */
124 static ddi_dma_attr_t ral_dma_attr = {
125 	DMA_ATTR_V0,			/* dma_attr version */
126 	0x0000000000000000ull,		/* dma_attr_addr_lo */
127 	0xFFFFFFFF,			/* dma_attr_addr_hi */
128 	0x00000000FFFFFFFFull,		/* dma_attr_count_max */
129 	0x0000000000000001ull,		/* dma_attr_align */
130 	0x00000FFF,			/* dma_attr_burstsizes */
131 	0x00000001,			/* dma_attr_minxfer */
132 	0x000000000000FFFFull,		/* dma_attr_maxxfer */
133 	0xFFFFFFFFFFFFFFFFull,		/* dma_attr_seg */
134 	1,				/* dma_attr_sgllen */
135 	0x00000001,			/* dma_attr_granular */
136 	0				/* dma_attr_flags */
137 };
138 
139 /*
140  * device operations
141  */
142 static int rt2560_attach(dev_info_t *, ddi_attach_cmd_t);
143 static int rt2560_detach(dev_info_t *, ddi_detach_cmd_t);
144 static int32_t rt2560_quiesce(dev_info_t *);
145 
146 /*
147  * Module Loading Data & Entry Points
148  */
149 DDI_DEFINE_STREAM_OPS(ral_dev_ops, nulldev, nulldev, rt2560_attach,
150     rt2560_detach, nodev, NULL, D_MP, NULL, rt2560_quiesce);
151 
152 static struct modldrv ral_modldrv = {
153 	&mod_driverops,		/* Type of module.  This one is a driver */
154 	"Ralink RT2500 driver v1.6",	/* short description */
155 	&ral_dev_ops		/* driver specific ops */
156 };
157 
158 static struct modlinkage modlinkage = {
159 	MODREV_1,
160 	(void *)&ral_modldrv,
161 	NULL
162 };
163 
164 static int	rt2560_m_stat(void *,  uint_t, uint64_t *);
165 static int	rt2560_m_start(void *);
166 static void	rt2560_m_stop(void *);
167 static int	rt2560_m_promisc(void *, boolean_t);
168 static int	rt2560_m_multicst(void *, boolean_t, const uint8_t *);
169 static int	rt2560_m_unicst(void *, const uint8_t *);
170 static mblk_t	*rt2560_m_tx(void *, mblk_t *);
171 static void	rt2560_m_ioctl(void *, queue_t *, mblk_t *);
172 static int	rt2560_m_setprop(void *, const char *, mac_prop_id_t,
173     uint_t, const void *);
174 static int	rt2560_m_getprop(void *, const char *, mac_prop_id_t,
175     uint_t, uint_t, void *, uint_t *);
176 
177 static mac_callbacks_t rt2560_m_callbacks = {
178 	MC_IOCTL | MC_SETPROP | MC_GETPROP,
179 	rt2560_m_stat,
180 	rt2560_m_start,
181 	rt2560_m_stop,
182 	rt2560_m_promisc,
183 	rt2560_m_multicst,
184 	rt2560_m_unicst,
185 	rt2560_m_tx,
186 	rt2560_m_ioctl,
187 	NULL,		/* mc_getcapab */
188 	NULL,
189 	NULL,
190 	rt2560_m_setprop,
191 	rt2560_m_getprop
192 };
193 
194 uint32_t ral_dbg_flags = 0;
195 
196 void
197 ral_debug(uint32_t dbg_flags, const int8_t *fmt, ...)
198 {
199 	va_list args;
200 
201 	if (dbg_flags & ral_dbg_flags) {
202 		va_start(args, fmt);
203 		vcmn_err(CE_CONT, fmt, args);
204 		va_end(args);
205 	}
206 }
207 
208 static void
209 rt2560_set_basicrates(struct rt2560_softc *sc)
210 {
211 	struct ieee80211com *ic = &sc->sc_ic;
212 
213 	/* update basic rate set */
214 	if (ic->ic_curmode == IEEE80211_MODE_11B) {
215 		/* 11b basic rates: 1, 2Mbps */
216 		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x3);
217 	} else if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan)) {
218 		/* 11a basic rates: 6, 12, 24Mbps */
219 		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x150);
220 	} else {
221 		/* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
222 		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x15f);
223 	}
224 }
225 
226 static void
227 rt2560_update_led(struct rt2560_softc *sc, int led1, int led2)
228 {
229 	uint32_t tmp;
230 
231 	/* set ON period to 70ms and OFF period to 30ms */
232 	tmp = led1 << 16 | led2 << 17 | 70 << 8 | 30;
233 	RAL_WRITE(sc, RT2560_LEDCSR, tmp);
234 }
235 
236 static void
237 rt2560_set_bssid(struct rt2560_softc *sc, uint8_t *bssid)
238 {
239 	uint32_t tmp;
240 
241 	tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
242 	RAL_WRITE(sc, RT2560_CSR5, tmp);
243 
244 	tmp = bssid[4] | bssid[5] << 8;
245 	RAL_WRITE(sc, RT2560_CSR6, tmp);
246 
247 	ral_debug(RAL_DBG_HW, "setting BSSID to " MACSTR "\n", MAC2STR(bssid));
248 }
249 
250 
251 static void
252 rt2560_bbp_write(struct rt2560_softc *sc, uint8_t reg, uint8_t val)
253 {
254 	uint32_t tmp;
255 	int ntries;
256 
257 	for (ntries = 0; ntries < 100; ntries++) {
258 		if (!(RAL_READ(sc, RT2560_BBPCSR) & RT2560_BBP_BUSY))
259 			break;
260 		drv_usecwait(1);
261 	}
262 	if (ntries == 100) {
263 		ral_debug(RAL_DBG_HW, "could not write to BBP\n");
264 		return;
265 	}
266 
267 	tmp = RT2560_BBP_WRITE | RT2560_BBP_BUSY | reg << 8 | val;
268 	RAL_WRITE(sc, RT2560_BBPCSR, tmp);
269 
270 	ral_debug(RAL_DBG_HW, "BBP R%u <- 0x%02x\n", reg, val);
271 }
272 
273 static uint8_t
274 rt2560_bbp_read(struct rt2560_softc *sc, uint8_t reg)
275 {
276 	uint32_t val;
277 	int ntries;
278 
279 	val = RT2560_BBP_BUSY | reg << 8;
280 	RAL_WRITE(sc, RT2560_BBPCSR, val);
281 
282 	for (ntries = 0; ntries < 100; ntries++) {
283 		val = RAL_READ(sc, RT2560_BBPCSR);
284 		if (!(val & RT2560_BBP_BUSY))
285 			return (val & 0xff);
286 		drv_usecwait(1);
287 	}
288 
289 	ral_debug(RAL_DBG_HW, "could not read from BBP\n");
290 	return (0);
291 }
292 
293 static void
294 rt2560_rf_write(struct rt2560_softc *sc, uint8_t reg, uint32_t val)
295 {
296 	uint32_t tmp;
297 	int ntries;
298 
299 	for (ntries = 0; ntries < 100; ntries++) {
300 		if (!(RAL_READ(sc, RT2560_RFCSR) & RT2560_RF_BUSY))
301 			break;
302 		drv_usecwait(1);
303 	}
304 	if (ntries == 100) {
305 		ral_debug(RAL_DBG_HW, "could not write to RF\n");
306 		return;
307 	}
308 
309 	tmp = RT2560_RF_BUSY | RT2560_RF_20BIT | (val & 0xfffff) << 2 |
310 	    (reg & 0x3);
311 	RAL_WRITE(sc, RT2560_RFCSR, tmp);
312 
313 	/* remember last written value in sc */
314 	sc->rf_regs[reg] = val;
315 
316 	ral_debug(RAL_DBG_HW, "RF R[%u] <- 0x%05x\n", reg & 0x3, val & 0xfffff);
317 }
318 
319 static void
320 rt2560_set_chan(struct rt2560_softc *sc, struct ieee80211_channel *c)
321 {
322 	struct ieee80211com *ic = &sc->sc_ic;
323 	uint8_t power, tmp;
324 	uint_t i, chan;
325 
326 	chan = ieee80211_chan2ieee(ic, c);
327 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
328 		return;
329 
330 	if (IEEE80211_IS_CHAN_2GHZ(c))
331 		power = min(sc->txpow[chan - 1], 31);
332 	else
333 		power = 31;
334 
335 	/* adjust txpower using ifconfig settings */
336 	power -= (100 - ic->ic_txpowlimit) / 8;
337 
338 	ral_debug(RAL_DBG_CHAN, "setting channel to %u, txpower to %u\n",
339 	    chan, power);
340 
341 	switch (sc->rf_rev) {
342 	case RT2560_RF_2522:
343 		rt2560_rf_write(sc, RAL_RF1, 0x00814);
344 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2522_r2[chan - 1]);
345 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
346 		break;
347 
348 	case RT2560_RF_2523:
349 		rt2560_rf_write(sc, RAL_RF1, 0x08804);
350 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2523_r2[chan - 1]);
351 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x38044);
352 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
353 		break;
354 
355 	case RT2560_RF_2524:
356 		rt2560_rf_write(sc, RAL_RF1, 0x0c808);
357 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2524_r2[chan - 1]);
358 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
359 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
360 		break;
361 
362 	case RT2560_RF_2525:
363 		rt2560_rf_write(sc, RAL_RF1, 0x08808);
364 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525_hi_r2[chan - 1]);
365 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
366 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
367 
368 		rt2560_rf_write(sc, RAL_RF1, 0x08808);
369 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525_r2[chan - 1]);
370 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
371 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
372 		break;
373 
374 	case RT2560_RF_2525E:
375 		rt2560_rf_write(sc, RAL_RF1, 0x08808);
376 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525e_r2[chan - 1]);
377 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
378 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00286 : 0x00282);
379 		break;
380 
381 	case RT2560_RF_2526:
382 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2526_hi_r2[chan - 1]);
383 		rt2560_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
384 		rt2560_rf_write(sc, RAL_RF1, 0x08804);
385 
386 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2526_r2[chan - 1]);
387 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
388 		rt2560_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
389 		break;
390 
391 	/* dual-band RF */
392 	case RT2560_RF_5222:
393 		for (i = 0; rt2560_rf5222[i].chan != chan; i++) {
394 		}
395 
396 		rt2560_rf_write(sc, RAL_RF1, rt2560_rf5222[i].r1);
397 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf5222[i].r2);
398 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
399 		rt2560_rf_write(sc, RAL_RF4, rt2560_rf5222[i].r4);
400 		break;
401 	}
402 
403 	if (ic->ic_state != IEEE80211_S_SCAN) {
404 		/* set Japan filter bit for channel 14 */
405 		tmp = rt2560_bbp_read(sc, 70);
406 
407 		tmp &= ~RT2560_JAPAN_FILTER;
408 		if (chan == 14)
409 			tmp |= RT2560_JAPAN_FILTER;
410 
411 		rt2560_bbp_write(sc, 70, tmp);
412 
413 		/* clear CRC errors */
414 		(void) RAL_READ(sc, RT2560_CNT0);
415 	}
416 }
417 
418 /*
419  * Refer to IEEE Std 802.11-1999 pp. 123 for more information on TSF
420  * synchronization.
421  */
422 static void
423 rt2560_enable_tsf_sync(struct rt2560_softc *sc)
424 {
425 	struct ieee80211com *ic = &sc->sc_ic;
426 	uint16_t logcwmin, preload;
427 	uint32_t tmp;
428 
429 	/* first, disable TSF synchronization */
430 	RAL_WRITE(sc, RT2560_CSR14, 0);
431 
432 	tmp = 16 * ic->ic_bss->in_intval;
433 	RAL_WRITE(sc, RT2560_CSR12, tmp);
434 
435 	RAL_WRITE(sc, RT2560_CSR13, 0);
436 
437 	logcwmin = 5;
438 	preload = (ic->ic_opmode == IEEE80211_M_STA) ? 384 : 1024;
439 	tmp = logcwmin << 16 | preload;
440 	RAL_WRITE(sc, RT2560_BCNOCSR, tmp);
441 
442 	/* finally, enable TSF synchronization */
443 	tmp = RT2560_ENABLE_TSF | RT2560_ENABLE_TBCN;
444 	if (ic->ic_opmode == IEEE80211_M_STA)
445 		tmp |= RT2560_ENABLE_TSF_SYNC(1);
446 	else
447 		tmp |= RT2560_ENABLE_TSF_SYNC(2) |
448 		    RT2560_ENABLE_BEACON_GENERATOR;
449 	RAL_WRITE(sc, RT2560_CSR14, tmp);
450 
451 	ral_debug(RAL_DBG_HW, "enabling TSF synchronization\n");
452 }
453 
454 static void
455 rt2560_update_plcp(struct rt2560_softc *sc)
456 {
457 	struct ieee80211com *ic = &sc->sc_ic;
458 
459 	/* no short preamble for 1Mbps */
460 	RAL_WRITE(sc, RT2560_PLCP1MCSR, 0x00700400);
461 
462 	if (!(ic->ic_flags & IEEE80211_F_SHPREAMBLE)) {
463 		/* values taken from the reference driver */
464 		RAL_WRITE(sc, RT2560_PLCP2MCSR,   0x00380401);
465 		RAL_WRITE(sc, RT2560_PLCP5p5MCSR, 0x00150402);
466 		RAL_WRITE(sc, RT2560_PLCP11MCSR,  0x000b8403);
467 	} else {
468 		/* same values as above or'ed 0x8 */
469 		RAL_WRITE(sc, RT2560_PLCP2MCSR,   0x00380409);
470 		RAL_WRITE(sc, RT2560_PLCP5p5MCSR, 0x0015040a);
471 		RAL_WRITE(sc, RT2560_PLCP11MCSR,  0x000b840b);
472 	}
473 
474 	ral_debug(RAL_DBG_HW, "updating PLCP for %s preamble\n",
475 	    (ic->ic_flags & IEEE80211_F_SHPREAMBLE) ? "short" : "long");
476 }
477 
478 /*
479  * This function can be called by ieee80211_set_shortslottime(). Refer to
480  * IEEE Std 802.11-1999 pp. 85 to know how these values are computed.
481  */
482 void
483 rt2560_update_slot(struct ieee80211com *ic, int onoff)
484 {
485 	struct rt2560_softc *sc = (struct rt2560_softc *)ic;
486 	uint8_t slottime;
487 	uint16_t tx_sifs, tx_pifs, tx_difs, eifs;
488 	uint32_t tmp;
489 
490 	/* slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20; */
491 	slottime = (onoff ? 9 : 20);
492 
493 	/* update the MAC slot boundaries */
494 	tx_sifs = RAL_SIFS - RT2560_TXRX_TURNAROUND;
495 	tx_pifs = tx_sifs + slottime;
496 	tx_difs = tx_sifs + 2 * slottime;
497 	eifs = (ic->ic_curmode == IEEE80211_MODE_11B) ? 364 : 60;
498 
499 	tmp = RAL_READ(sc, RT2560_CSR11);
500 	tmp = (tmp & ~0x1f00) | slottime << 8;
501 	RAL_WRITE(sc, RT2560_CSR11, tmp);
502 
503 	tmp = tx_pifs << 16 | tx_sifs;
504 	RAL_WRITE(sc, RT2560_CSR18, tmp);
505 
506 	tmp = eifs << 16 | tx_difs;
507 	RAL_WRITE(sc, RT2560_CSR19, tmp);
508 
509 	ral_debug(RAL_DBG_HW, "setting slottime to %uus\n", slottime);
510 }
511 
512 int
513 ral_dma_region_alloc(struct rt2560_softc *sc, struct dma_region *dr,
514     size_t size, uint_t alloc_flags, uint_t bind_flags)
515 {
516 	dev_info_t *dip = sc->sc_dev;
517 	int err;
518 
519 	err = ddi_dma_alloc_handle(dip, &ral_dma_attr, DDI_DMA_SLEEP, NULL,
520 	    &dr->dr_hnd);
521 	if (err != DDI_SUCCESS)
522 		goto fail1;
523 
524 	err = ddi_dma_mem_alloc(dr->dr_hnd, size, &ral_desc_accattr,
525 	    alloc_flags, DDI_DMA_SLEEP, NULL,
526 	    &dr->dr_base, &dr->dr_size, &dr->dr_acc);
527 	if (err != DDI_SUCCESS)
528 		goto fail2;
529 
530 	err = ddi_dma_addr_bind_handle(dr->dr_hnd, NULL,
531 	    dr->dr_base, dr->dr_size,
532 	    bind_flags, DDI_DMA_SLEEP, NULL, &dr->dr_cookie, &dr->dr_ccnt);
533 	if (err != DDI_SUCCESS)
534 		goto fail3;
535 
536 	if (dr->dr_ccnt != 1) {
537 		err = DDI_FAILURE;
538 		goto fail4;
539 	}
540 
541 	dr->dr_pbase = dr->dr_cookie.dmac_address;
542 	ral_debug(RAL_DBG_DMA, "get physical-base=0x%08x\n", dr->dr_pbase);
543 
544 	return (DDI_SUCCESS);
545 
546 fail4:
547 	(void) ddi_dma_unbind_handle(dr->dr_hnd);
548 fail3:
549 	ddi_dma_mem_free(&dr->dr_acc);
550 fail2:
551 	ddi_dma_free_handle(&dr->dr_hnd);
552 fail1:
553 	return (err);
554 }
555 
556 /* ARGSUSED */
557 void
558 ral_dma_region_free(struct rt2560_softc *sc, struct dma_region *dr)
559 {
560 	(void) ddi_dma_unbind_handle(dr->dr_hnd);
561 	ddi_dma_mem_free(&dr->dr_acc);
562 	ddi_dma_free_handle(&dr->dr_hnd);
563 }
564 
565 int
566 rt2560_alloc_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring,
567 	int count)
568 {
569 	int i, err;
570 	int size;
571 
572 	ring->count = count;
573 	ring->queued = 0;
574 	ring->cur = ring->next = 0;
575 	ring->cur_encrypt = ring->next_encrypt = 0;
576 
577 	ring->data = kmem_zalloc(count * (sizeof (struct rt2560_tx_data)),
578 	    KM_SLEEP);
579 	ring->dr_txbuf = kmem_zalloc(count * (sizeof (struct dma_region)),
580 	    KM_SLEEP);
581 
582 	err = ral_dma_region_alloc(sc, &ring->dr_desc,
583 	    count * (sizeof (struct rt2560_tx_desc)),
584 	    DDI_DMA_CONSISTENT, DDI_DMA_RDWR | DDI_DMA_CONSISTENT);
585 
586 	if (err != DDI_SUCCESS)
587 		goto fail1;
588 
589 	size = roundup(RAL_TXBUF_SIZE, sc->sc_cachelsz);
590 	for (i = 0; i < count; i++) {
591 		err = ral_dma_region_alloc(sc, &ring->dr_txbuf[i], size,
592 		    DDI_DMA_STREAMING, DDI_DMA_WRITE | DDI_DMA_STREAMING);
593 		if (err != DDI_SUCCESS) {
594 			while (i >= 0) {
595 				ral_dma_region_free(sc, &ring->dr_txbuf[i]);
596 				i--;
597 			}
598 			goto fail2;
599 		}
600 	}
601 
602 	ring->physaddr = LE_32(ring->dr_desc.dr_pbase);
603 	ring->desc = (struct rt2560_tx_desc *)ring->dr_desc.dr_base;
604 
605 	for (i = 0; i < count; i++) {
606 		ring->desc[i].physaddr = LE_32(ring->dr_txbuf[i].dr_pbase);
607 		ring->data[i].buf = ring->dr_txbuf[i].dr_base;
608 	}
609 
610 	return (DDI_SUCCESS);
611 fail2:
612 	ral_dma_region_free(sc, &ring->dr_desc);
613 fail1:
614 	return (err);
615 }
616 
617 /* ARGSUSED */
618 void
619 rt2560_reset_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring)
620 {
621 	struct rt2560_tx_desc *desc;
622 	struct rt2560_tx_data *data;
623 	int i;
624 
625 	for (i = 0; i < ring->count; i++) {
626 		desc = &ring->desc[i];
627 		data = &ring->data[i];
628 
629 		if (data->ni != NULL) {
630 			ieee80211_free_node(data->ni);
631 			data->ni = NULL;
632 		}
633 
634 		desc->flags = 0;
635 	}
636 
637 	(void) ddi_dma_sync(ring->dr_desc.dr_hnd, 0,
638 	    ring->count * sizeof (struct rt2560_tx_desc), DDI_DMA_SYNC_FORDEV);
639 
640 	ring->queued = 0;
641 	ring->cur = ring->next = 0;
642 	ring->cur_encrypt = ring->next_encrypt = 0;
643 }
644 
645 void
646 rt2560_free_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring)
647 {
648 	struct rt2560_tx_data *data;
649 	int i;
650 
651 	ral_dma_region_free(sc, &ring->dr_desc);
652 	/* tx buf */
653 	for (i = 0; i < ring->count; i++) {
654 		data = &ring->data[i];
655 		if (data->ni != NULL) {
656 			ieee80211_free_node(data->ni);
657 			data->ni = NULL;
658 		}
659 
660 		ral_dma_region_free(sc, &ring->dr_txbuf[i]);
661 	}
662 
663 	kmem_free(ring->data, ring->count * (sizeof (struct rt2560_tx_data)));
664 	kmem_free(ring->dr_txbuf, ring->count * (sizeof (struct dma_region)));
665 }
666 
667 void
668 rt2560_ring_hwsetup(struct rt2560_softc *sc)
669 {
670 	uint32_t tmp;
671 
672 	/* setup tx rings */
673 	tmp = ((uint32_t)RT2560_PRIO_RING_COUNT << 24) |
674 	    RT2560_ATIM_RING_COUNT << 16 |
675 	    RT2560_TX_RING_COUNT   <<  8 |
676 	    RT2560_TX_DESC_SIZE;
677 
678 	/* rings must be initialized in this exact order */
679 	RAL_WRITE(sc, RT2560_TXCSR2, tmp);
680 	RAL_WRITE(sc, RT2560_TXCSR3, sc->txq.physaddr);
681 	RAL_WRITE(sc, RT2560_TXCSR5, sc->prioq.physaddr);
682 
683 	/* setup rx ring */
684 	tmp = RT2560_RX_RING_COUNT << 8 | RT2560_RX_DESC_SIZE;
685 
686 	RAL_WRITE(sc, RT2560_RXCSR1, tmp);
687 	RAL_WRITE(sc, RT2560_RXCSR2, sc->rxq.physaddr);
688 }
689 
690 int
691 rt2560_alloc_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring,
692 	int count)
693 {
694 	struct rt2560_rx_desc *desc;
695 	struct rt2560_rx_data *data;
696 	int i, err;
697 	int size;
698 
699 	ring->count = count;
700 	ring->cur = ring->next = 0;
701 	ring->cur_decrypt = 0;
702 
703 	ring->data = kmem_zalloc(count * (sizeof (struct rt2560_rx_data)),
704 	    KM_SLEEP);
705 	ring->dr_rxbuf = kmem_zalloc(count * (sizeof (struct dma_region)),
706 	    KM_SLEEP);
707 
708 	err = ral_dma_region_alloc(sc, &ring->dr_desc,
709 	    count * (sizeof (struct rt2560_rx_desc)),
710 	    DDI_DMA_CONSISTENT, DDI_DMA_RDWR | DDI_DMA_CONSISTENT);
711 
712 	if (err != DDI_SUCCESS)
713 		goto fail1;
714 
715 	size = roundup(RAL_RXBUF_SIZE, sc->sc_cachelsz);
716 	for (i = 0; i < count; i++) {
717 		err = ral_dma_region_alloc(sc, &ring->dr_rxbuf[i], size,
718 		    DDI_DMA_STREAMING, DDI_DMA_READ | DDI_DMA_STREAMING);
719 		if (err != DDI_SUCCESS) {
720 			while (i >= 0) {
721 				ral_dma_region_free(sc, &ring->dr_rxbuf[i]);
722 				i--;
723 			}
724 			goto fail2;
725 		}
726 	}
727 
728 	ring->physaddr = ring->dr_desc.dr_pbase;
729 	ring->desc = (struct rt2560_rx_desc *)ring->dr_desc.dr_base;
730 
731 	for (i = 0; i < count; i++) {
732 		desc = &ring->desc[i];
733 		data = &ring->data[i];
734 
735 		desc->physaddr = LE_32(ring->dr_rxbuf[i].dr_pbase);
736 		desc->flags = LE_32(RT2560_RX_BUSY);
737 
738 		data->buf = ring->dr_rxbuf[i].dr_base;
739 	}
740 
741 	return (DDI_SUCCESS);
742 fail2:
743 	ral_dma_region_free(sc, &ring->dr_desc);
744 fail1:
745 	return (err);
746 }
747 
748 /* ARGSUSED */
749 static void
750 rt2560_reset_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring)
751 {
752 	int i;
753 
754 	for (i = 0; i < ring->count; i++) {
755 		ring->desc[i].flags = LE_32(RT2560_RX_BUSY);
756 		ring->data[i].drop = 0;
757 	}
758 
759 	(void) ddi_dma_sync(ring->dr_desc.dr_hnd, 0,
760 	    ring->count * sizeof (struct rt2560_rx_desc),
761 	    DDI_DMA_SYNC_FORKERNEL);
762 
763 	ring->cur = ring->next = 0;
764 	ring->cur_decrypt = 0;
765 }
766 
767 static void
768 rt2560_free_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring)
769 {
770 	int i;
771 
772 	ral_dma_region_free(sc, &ring->dr_desc);
773 	/* rx buf */
774 	for (i = 0; i < ring->count; i++)
775 		ral_dma_region_free(sc, &ring->dr_rxbuf[i]);
776 
777 	kmem_free(ring->data, ring->count * (sizeof (struct rt2560_rx_data)));
778 	kmem_free(ring->dr_rxbuf, ring->count * (sizeof (struct dma_region)));
779 }
780 
781 /* ARGSUSED */
782 static struct ieee80211_node *
783 rt2560_node_alloc(ieee80211com_t *ic)
784 {
785 	struct rt2560_node *rn;
786 
787 	rn = kmem_zalloc(sizeof (struct rt2560_node), KM_SLEEP);
788 	return ((rn != NULL) ? &rn->ni : NULL);
789 }
790 
791 static void
792 rt2560_node_free(struct ieee80211_node *in)
793 {
794 	ieee80211com_t *ic = in->in_ic;
795 
796 	ic->ic_node_cleanup(in);
797 	if (in->in_wpa_ie != NULL)
798 		ieee80211_free(in->in_wpa_ie);
799 	kmem_free(in, sizeof (struct rt2560_node));
800 }
801 
802 /*
803  * This function is called periodically (every 200ms) during scanning to
804  * switch from one channel to another.
805  */
806 static void
807 rt2560_next_scan(void *arg)
808 {
809 	struct rt2560_softc *sc = arg;
810 	struct ieee80211com *ic = &sc->sc_ic;
811 
812 	if (ic->ic_state == IEEE80211_S_SCAN)
813 		(void) ieee80211_next_scan(ic);
814 }
815 
816 /*
817  * This function is called for each node present in the node station table.
818  */
819 /* ARGSUSED */
820 static void
821 rt2560_iter_func(void *arg, struct ieee80211_node *ni)
822 {
823 	struct rt2560_node *rn = (struct rt2560_node *)ni;
824 
825 	ral_rssadapt_updatestats(&rn->rssadapt);
826 }
827 
828 /*
829  * This function is called periodically (every 100ms) in RUN state to update
830  * the rate adaptation statistics.
831  */
832 static void
833 rt2560_update_rssadapt(void *arg)
834 {
835 	struct rt2560_softc *sc = arg;
836 	struct ieee80211com *ic = &sc->sc_ic;
837 
838 	ieee80211_iterate_nodes(&ic->ic_sta, rt2560_iter_func, arg);
839 	sc->sc_rssadapt_id = timeout(rt2560_update_rssadapt, (void *)sc,
840 	    drv_usectohz(100 * 1000));
841 }
842 
843 static void
844 rt2560_statedog(void *arg)
845 {
846 	struct rt2560_softc *sc = arg;
847 	struct ieee80211com *ic = &sc->sc_ic;
848 	enum ieee80211_state state;
849 
850 	RAL_LOCK(sc);
851 
852 	sc->sc_state_id = 0;
853 	state = ic->ic_state;
854 	ic->ic_state = sc->sc_ostate;
855 
856 	RAL_UNLOCK(sc);
857 
858 	ieee80211_new_state(ic, state, -1);
859 
860 }
861 
862 static int
863 rt2560_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
864 {
865 	struct rt2560_softc *sc = (struct rt2560_softc *)ic;
866 	enum ieee80211_state ostate;
867 	struct ieee80211_node *ni;
868 	int err;
869 
870 	RAL_LOCK(sc);
871 
872 	ostate = ic->ic_state;
873 	sc->sc_ostate = ostate;
874 
875 	if (sc->sc_scan_id != 0) {
876 		(void) untimeout(sc->sc_scan_id);
877 		sc->sc_scan_id = 0;
878 	}
879 
880 	if (sc->sc_rssadapt_id != 0) {
881 		(void) untimeout(sc->sc_rssadapt_id);
882 		sc->sc_rssadapt_id = 0;
883 	}
884 
885 	if (sc->sc_state_id != 0) {
886 		(void) untimeout(sc->sc_state_id);
887 		sc->sc_state_id = 0;
888 	}
889 
890 	switch (nstate) {
891 	case IEEE80211_S_INIT:
892 		if (ostate == IEEE80211_S_RUN) {
893 			/* abort TSF synchronization */
894 			RAL_WRITE(sc, RT2560_CSR14, 0);
895 			/* turn association led off */
896 			rt2560_update_led(sc, 0, 0);
897 		}
898 		break;
899 
900 	case IEEE80211_S_SCAN:
901 		rt2560_set_chan(sc, ic->ic_curchan);
902 		sc->sc_scan_id = timeout(rt2560_next_scan, (void *)sc,
903 		    drv_usectohz(sc->dwelltime * 1000));
904 		break;
905 
906 	case IEEE80211_S_AUTH:
907 		rt2560_set_chan(sc, ic->ic_curchan);
908 		break;
909 
910 	case IEEE80211_S_ASSOC:
911 		rt2560_set_chan(sc, ic->ic_curchan);
912 
913 		drv_usecwait(10 * 1000);	/* dlink */
914 		sc->sc_state_id = timeout(rt2560_statedog, (void *)sc,
915 		    drv_usectohz(300 * 1000));	/* ap7-3 */
916 		break;
917 
918 	case IEEE80211_S_RUN:
919 		rt2560_set_chan(sc, ic->ic_curchan);
920 
921 		ni = ic->ic_bss;
922 
923 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
924 			rt2560_update_plcp(sc);
925 			rt2560_set_basicrates(sc);
926 			rt2560_set_bssid(sc, ni->in_bssid);
927 		}
928 
929 		/* turn assocation led on */
930 		rt2560_update_led(sc, 1, 0);
931 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
932 			sc->sc_rssadapt_id = timeout(rt2560_update_rssadapt,
933 			    (void *)sc, drv_usectohz(100 * 1000));
934 			rt2560_enable_tsf_sync(sc);
935 		}
936 		break;
937 	}
938 
939 	RAL_UNLOCK(sc);
940 
941 	err = sc->sc_newstate(ic, nstate, arg);
942 	/*
943 	 * Finally, start any timers.
944 	 */
945 	if (nstate == IEEE80211_S_RUN)
946 		ieee80211_start_watchdog(ic, 1);
947 
948 	return (err);
949 }
950 
951 /*
952  * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46 or
953  * 93C66).
954  */
955 static uint16_t
956 rt2560_eeprom_read(struct rt2560_softc *sc, uint8_t addr)
957 {
958 	uint32_t tmp;
959 	uint16_t val;
960 	int n;
961 
962 	/* clock C once before the first command */
963 	RT2560_EEPROM_CTL(sc, 0);
964 
965 	RT2560_EEPROM_CTL(sc, RT2560_S);
966 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
967 	RT2560_EEPROM_CTL(sc, RT2560_S);
968 
969 	/* write start bit (1) */
970 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D);
971 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D | RT2560_C);
972 
973 	/* write READ opcode (10) */
974 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D);
975 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D | RT2560_C);
976 	RT2560_EEPROM_CTL(sc, RT2560_S);
977 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
978 
979 	/* write address (A5-A0 or A7-A0) */
980 	n = (RAL_READ(sc, RT2560_CSR21) & RT2560_93C46) ? 5 : 7;
981 	for (; n >= 0; n--) {
982 		RT2560_EEPROM_CTL(sc, RT2560_S |
983 		    (((addr >> n) & 1) << RT2560_SHIFT_D));
984 		RT2560_EEPROM_CTL(sc, RT2560_S |
985 		    (((addr >> n) & 1) << RT2560_SHIFT_D) | RT2560_C);
986 	}
987 
988 	RT2560_EEPROM_CTL(sc, RT2560_S);
989 
990 	/* read data Q15-Q0 */
991 	val = 0;
992 	for (n = 15; n >= 0; n--) {
993 		RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
994 		tmp = RAL_READ(sc, RT2560_CSR21);
995 		val |= ((tmp & RT2560_Q) >> RT2560_SHIFT_Q) << n;
996 		RT2560_EEPROM_CTL(sc, RT2560_S);
997 	}
998 
999 	RT2560_EEPROM_CTL(sc, 0);
1000 
1001 	/* clear Chip Select and clock C */
1002 	RT2560_EEPROM_CTL(sc, RT2560_S);
1003 	RT2560_EEPROM_CTL(sc, 0);
1004 	RT2560_EEPROM_CTL(sc, RT2560_C);
1005 
1006 	return (val);
1007 }
1008 
1009 static void
1010 rt2560_tx_intr(struct rt2560_softc *sc)
1011 {
1012 	struct ieee80211com *ic = &sc->sc_ic;
1013 	struct rt2560_tx_desc *desc;
1014 	struct rt2560_tx_data *data;
1015 	struct rt2560_node *rn;
1016 
1017 	struct dma_region *dr;
1018 	int count;
1019 
1020 	dr = &sc->txq.dr_desc;
1021 	count = sc->txq.count;
1022 
1023 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1024 	    DDI_DMA_SYNC_FORKERNEL);
1025 
1026 	mutex_enter(&sc->txq.tx_lock);
1027 
1028 	for (;;) {
1029 		desc = &sc->txq.desc[sc->txq.next];
1030 		data = &sc->txq.data[sc->txq.next];
1031 
1032 		if ((LE_32(desc->flags) & RT2560_TX_BUSY) ||
1033 		    (LE_32(desc->flags) & RT2560_TX_CIPHER_BUSY) ||
1034 		    !(LE_32(desc->flags) & RT2560_TX_VALID))
1035 			break;
1036 
1037 		rn = (struct rt2560_node *)data->ni;
1038 
1039 		switch (LE_32(desc->flags) & RT2560_TX_RESULT_MASK) {
1040 		case RT2560_TX_SUCCESS:
1041 			ral_debug(RAL_DBG_INTR, "data frame sent success\n");
1042 			if (data->id.id_node != NULL) {
1043 				ral_rssadapt_raise_rate(ic, &rn->rssadapt,
1044 				    &data->id);
1045 			}
1046 			break;
1047 
1048 		case RT2560_TX_SUCCESS_RETRY:
1049 			ral_debug(RAL_DBG_INTR,
1050 			    "data frame sent after %u retries\n",
1051 			    (LE_32(desc->flags) >> 5) & 0x7);
1052 			sc->sc_tx_retries++;
1053 			break;
1054 
1055 		case RT2560_TX_FAIL_RETRY:
1056 			ral_debug(RAL_DBG_INTR,
1057 			    "sending data frame failed (too much retries)\n");
1058 			if (data->id.id_node != NULL) {
1059 				ral_rssadapt_lower_rate(ic, data->ni,
1060 				    &rn->rssadapt, &data->id);
1061 			}
1062 			break;
1063 
1064 		case RT2560_TX_FAIL_INVALID:
1065 		case RT2560_TX_FAIL_OTHER:
1066 		default:
1067 			ral_debug(RAL_DBG_INTR, "sending data frame failed "
1068 			    "0x%08x\n", LE_32(desc->flags));
1069 			break;
1070 		}
1071 
1072 		ieee80211_free_node(data->ni);
1073 		data->ni = NULL;
1074 
1075 		/* descriptor is no longer valid */
1076 		desc->flags &= ~LE_32(RT2560_TX_VALID);
1077 
1078 		ral_debug(RAL_DBG_INTR, "tx done idx=%u\n", sc->txq.next);
1079 
1080 		sc->txq.queued--;
1081 		sc->txq.next = (sc->txq.next + 1) % RT2560_TX_RING_COUNT;
1082 
1083 		if (sc->sc_need_sched &&
1084 		    sc->txq.queued < (RT2560_TX_RING_COUNT - 32)) {
1085 			sc->sc_need_sched = 0;
1086 			mac_tx_update(ic->ic_mach);
1087 		}
1088 	}
1089 
1090 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1091 	    DDI_DMA_SYNC_FORDEV);
1092 
1093 	sc->sc_tx_timer = 0;
1094 	mutex_exit(&sc->txq.tx_lock);
1095 }
1096 
1097 static void
1098 rt2560_prio_intr(struct rt2560_softc *sc)
1099 {
1100 	struct rt2560_tx_desc *desc;
1101 	struct rt2560_tx_data *data;
1102 
1103 	struct dma_region *dr;
1104 	int count;
1105 
1106 	dr = &sc->prioq.dr_desc;
1107 	count = sc->prioq.count;
1108 
1109 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1110 	    DDI_DMA_SYNC_FORKERNEL);
1111 
1112 	mutex_enter(&sc->prioq.tx_lock);
1113 
1114 	for (;;) {
1115 		desc = &sc->prioq.desc[sc->prioq.next];
1116 		data = &sc->prioq.data[sc->prioq.next];
1117 
1118 		if ((LE_32(desc->flags) & RT2560_TX_BUSY) ||
1119 		    !(LE_32(desc->flags) & RT2560_TX_VALID))
1120 			break;
1121 
1122 		switch (LE_32(desc->flags) & RT2560_TX_RESULT_MASK) {
1123 		case RT2560_TX_SUCCESS:
1124 			ral_debug(RAL_DBG_INTR, "mgt frame sent success\n");
1125 			break;
1126 
1127 		case RT2560_TX_SUCCESS_RETRY:
1128 			ral_debug(RAL_DBG_INTR,
1129 			    "mgt frame sent after %u retries\n",
1130 			    (LE_32(desc->flags) >> 5) & 0x7);
1131 			break;
1132 
1133 		case RT2560_TX_FAIL_RETRY:
1134 			ral_debug(RAL_DBG_INTR,
1135 			    "sending mgt frame failed (too much " "retries)\n");
1136 			break;
1137 
1138 		case RT2560_TX_FAIL_INVALID:
1139 		case RT2560_TX_FAIL_OTHER:
1140 		default:
1141 			ral_debug(RAL_DBG_INTR, "sending mgt frame failed "
1142 			    "0x%08x\n", LE_32(desc->flags));
1143 		}
1144 
1145 		ieee80211_free_node(data->ni);
1146 		data->ni = NULL;
1147 
1148 		/* descriptor is no longer valid */
1149 		desc->flags &= ~LE_32(RT2560_TX_VALID);
1150 
1151 		ral_debug(RAL_DBG_INTR, "prio done idx=%u\n", sc->prioq.next);
1152 
1153 		sc->prioq.queued--;
1154 		sc->prioq.next = (sc->prioq.next + 1) % RT2560_PRIO_RING_COUNT;
1155 	}
1156 
1157 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1158 	    DDI_DMA_SYNC_FORDEV);
1159 
1160 	sc->sc_tx_timer = 0;
1161 	mutex_exit(&sc->prioq.tx_lock);
1162 }
1163 
1164 /*
1165  * Some frames were received. Pass them to the hardware cipher engine before
1166  * sending them to the 802.11 layer.
1167  */
1168 void
1169 rt2560_rx_intr(struct rt2560_softc *sc)
1170 {
1171 	struct ieee80211com *ic = &sc->sc_ic;
1172 	struct rt2560_rx_desc *desc;
1173 	struct rt2560_rx_data *data;
1174 	struct ieee80211_frame *wh;
1175 	struct ieee80211_node *ni;
1176 	struct rt2560_node *rn;
1177 
1178 	mblk_t *m;
1179 	uint32_t len;
1180 	char *rxbuf;
1181 
1182 	struct dma_region *dr, *dr_bf;
1183 	int count;
1184 
1185 	dr = &sc->rxq.dr_desc;
1186 	count = sc->rxq.count;
1187 
1188 	mutex_enter(&sc->rxq.rx_lock);
1189 
1190 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_RX_DESC_SIZE,
1191 	    DDI_DMA_SYNC_FORKERNEL);
1192 
1193 	for (;;) {
1194 		desc = &sc->rxq.desc[sc->rxq.cur];
1195 		data = &sc->rxq.data[sc->rxq.cur];
1196 
1197 		if ((LE_32(desc->flags) & RT2560_RX_BUSY) ||
1198 		    (LE_32(desc->flags) & RT2560_RX_CIPHER_BUSY))
1199 			break;
1200 
1201 		data->drop = 0;
1202 
1203 		if ((LE_32(desc->flags) & RT2560_RX_PHY_ERROR) ||
1204 		    (LE_32(desc->flags) & RT2560_RX_CRC_ERROR)) {
1205 			/*
1206 			 * This should not happen since we did not request
1207 			 * to receive those frames when we filled RXCSR0.
1208 			 */
1209 			ral_debug(RAL_DBG_RX, "PHY or CRC error flags 0x%08x\n",
1210 			    LE_32(desc->flags));
1211 			data->drop = 1;
1212 		}
1213 
1214 		if (((LE_32(desc->flags) >> 16) & 0xfff) > RAL_RXBUF_SIZE) {
1215 			ral_debug(RAL_DBG_RX, "bad length\n");
1216 			data->drop = 1;
1217 		}
1218 
1219 		if (data->drop) {
1220 			sc->sc_rx_err++;
1221 			goto skip;
1222 		}
1223 
1224 		rxbuf = data->buf;
1225 		len = (LE_32(desc->flags) >> 16) & 0xfff;
1226 
1227 		if ((len < sizeof (struct ieee80211_frame_min)) ||
1228 		    (len > RAL_RXBUF_SIZE)) {
1229 			ral_debug(RAL_DBG_RX, "bad frame length=%u\n", len);
1230 			sc->sc_rx_err++;
1231 			goto skip;
1232 		}
1233 
1234 		if ((m = allocb(len, BPRI_MED)) == NULL) {
1235 			ral_debug(RAL_DBG_RX, "rt2560_rx_intr():"
1236 			    " allocate mblk failed.\n");
1237 			sc->sc_rx_nobuf++;
1238 			goto skip;
1239 		}
1240 
1241 		dr_bf = &sc->rxq.dr_rxbuf[sc->rxq.cur];
1242 		(void) ddi_dma_sync(dr_bf->dr_hnd, 0, dr_bf->dr_size,
1243 		    DDI_DMA_SYNC_FORCPU);
1244 
1245 		bcopy(rxbuf, m->b_rptr, len);
1246 		m->b_wptr += len;
1247 
1248 		wh = (struct ieee80211_frame *)m->b_rptr;
1249 		ni = ieee80211_find_rxnode(ic, wh);
1250 
1251 		/* give rssi to the rate adatation algorithm */
1252 		rn = (struct rt2560_node *)ni;
1253 		ral_rssadapt_input(ic, ni, &rn->rssadapt, desc->rssi);
1254 
1255 		/* send the frame to the 802.11 layer */
1256 		(void) ieee80211_input(ic, m, ni, desc->rssi, 0);
1257 
1258 		/* node is no longer needed */
1259 		ieee80211_free_node(ni);
1260 
1261 skip:		desc->flags = LE_32(RT2560_RX_BUSY);
1262 		ral_debug(RAL_DBG_RX, "rx done idx=%u\n", sc->rxq.cur);
1263 
1264 		sc->rxq.cur = (sc->rxq.cur + 1) % RT2560_RX_RING_COUNT;
1265 	}
1266 	mutex_exit(&sc->rxq.rx_lock);
1267 
1268 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1269 	    DDI_DMA_SYNC_FORDEV);
1270 }
1271 
1272 uint_t
1273 ral_softint_handler(caddr_t data)
1274 {
1275 	/* LINTED E_BAD_PTR_CAST_ALIGN */
1276 	struct rt2560_softc *sc = (struct rt2560_softc *)data;
1277 
1278 	/*
1279 	 * Check if the soft interrupt is triggered by another
1280 	 * driver at the same level.
1281 	 */
1282 	RAL_LOCK(sc);
1283 	if (sc->sc_rx_pend) {
1284 		sc->sc_rx_pend = 0;
1285 		RAL_UNLOCK(sc);
1286 		rt2560_rx_intr(sc);
1287 		return (DDI_INTR_CLAIMED);
1288 	}
1289 	RAL_UNLOCK(sc);
1290 	return (DDI_INTR_UNCLAIMED);
1291 }
1292 
1293 /*
1294  * Return the expected ack rate for a frame transmitted at rate `rate'.
1295  * XXX: this should depend on the destination node basic rate set.
1296  */
1297 static int
1298 rt2560_ack_rate(struct ieee80211com *ic, int rate)
1299 {
1300 	switch (rate) {
1301 	/* CCK rates */
1302 	case 2:
1303 		return (2);
1304 	case 4:
1305 	case 11:
1306 	case 22:
1307 		return ((ic->ic_curmode == IEEE80211_MODE_11B) ? 4 : rate);
1308 
1309 	/* OFDM rates */
1310 	case 12:
1311 	case 18:
1312 		return (12);
1313 	case 24:
1314 	case 36:
1315 		return (24);
1316 	case 48:
1317 	case 72:
1318 	case 96:
1319 	case 108:
1320 		return (48);
1321 	}
1322 
1323 	/* default to 1Mbps */
1324 	return (2);
1325 }
1326 
1327 /*
1328  * Compute the duration (in us) needed to transmit `len' bytes at rate `rate'.
1329  * The function automatically determines the operating mode depending on the
1330  * given rate. `flags' indicates whether short preamble is in use or not.
1331  */
1332 static uint16_t
1333 rt2560_txtime(int len, int rate, uint32_t flags)
1334 {
1335 	uint16_t txtime;
1336 
1337 	if (RAL_RATE_IS_OFDM(rate)) {
1338 		/* IEEE Std 802.11a-1999, pp. 37 */
1339 		txtime = (8 + 4 * len + 3 + rate - 1) / rate;
1340 		txtime = 16 + 4 + 4 * txtime + 6;
1341 	} else {
1342 		/* IEEE Std 802.11b-1999, pp. 28 */
1343 		txtime = (16 * len + rate - 1) / rate;
1344 		if (rate != 2 && (flags & IEEE80211_F_SHPREAMBLE))
1345 			txtime +=  72 + 24;
1346 		else
1347 			txtime += 144 + 48;
1348 	}
1349 
1350 	return (txtime);
1351 }
1352 
1353 static uint8_t
1354 rt2560_plcp_signal(int rate)
1355 {
1356 	switch (rate) {
1357 	/* CCK rates (returned values are device-dependent) */
1358 	case 2:		return (0x0);
1359 	case 4:		return (0x1);
1360 	case 11:	return (0x2);
1361 	case 22:	return (0x3);
1362 
1363 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1364 	case 12:	return (0xb);
1365 	case 18:	return (0xf);
1366 	case 24:	return (0xa);
1367 	case 36:	return (0xe);
1368 	case 48:	return (0x9);
1369 	case 72:	return (0xd);
1370 	case 96:	return (0x8);
1371 	case 108:	return (0xc);
1372 
1373 	/* unsupported rates (should not get there) */
1374 	default:	return (0xff);
1375 	}
1376 }
1377 
1378 void
1379 rt2560_setup_tx_desc(struct rt2560_softc *sc, struct rt2560_tx_desc *desc,
1380     uint32_t flags, int len, int rate, int encrypt)
1381 {
1382 	struct ieee80211com *ic = &sc->sc_ic;
1383 	uint16_t plcp_length;
1384 	int remainder;
1385 
1386 	desc->flags = LE_32(flags);
1387 	desc->flags |= LE_32(len << 16);
1388 	desc->flags |= encrypt ? LE_32(RT2560_TX_CIPHER_BUSY) :
1389 	    LE_32(RT2560_TX_BUSY | RT2560_TX_VALID);
1390 
1391 	desc->wme = LE_16(
1392 	    RT2560_AIFSN(2) |
1393 	    RT2560_LOGCWMIN(3) |
1394 	    RT2560_LOGCWMAX(8));
1395 
1396 	/* setup PLCP fields */
1397 	desc->plcp_signal  = rt2560_plcp_signal(rate);
1398 	desc->plcp_service = 4;
1399 
1400 	len += IEEE80211_CRC_LEN;
1401 	if (RAL_RATE_IS_OFDM(rate)) {
1402 		desc->flags |= LE_32(RT2560_TX_OFDM);
1403 
1404 		plcp_length = len & 0xfff;
1405 		desc->plcp_length_hi = plcp_length >> 6;
1406 		desc->plcp_length_lo = plcp_length & 0x3f;
1407 	} else {
1408 		plcp_length = (16 * len + rate - 1) / rate;
1409 		if (rate == 22) {
1410 			remainder = (16 * len) % 22;
1411 			if (remainder != 0 && remainder < 7)
1412 				desc->plcp_service |= RT2560_PLCP_LENGEXT;
1413 		}
1414 		desc->plcp_length_hi = plcp_length >> 8;
1415 		desc->plcp_length_lo = plcp_length & 0xff;
1416 
1417 		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1418 			desc->plcp_signal |= 0x08;
1419 	}
1420 }
1421 
1422 /* ARGSUSED */
1423 int
1424 rt2560_mgmt_send(ieee80211com_t *ic, mblk_t *mp, uint8_t type)
1425 {
1426 	struct rt2560_softc *sc = (struct rt2560_softc *)ic;
1427 	struct rt2560_tx_desc *desc;
1428 	struct rt2560_tx_data *data;
1429 	struct ieee80211_frame *wh;
1430 	uint16_t dur;
1431 	uint32_t flags = 0;
1432 	int rate, err = DDI_SUCCESS;
1433 
1434 	int off, pktlen, mblen;
1435 	caddr_t dest;
1436 	mblk_t *m, *m0;
1437 
1438 	struct dma_region *dr;
1439 	uint32_t idx;
1440 	struct ieee80211_node *ni;
1441 	struct ieee80211_key *k;
1442 
1443 	mutex_enter(&sc->prioq.tx_lock);
1444 
1445 	if (!RAL_IS_RUNNING(sc)) {
1446 		err = ENXIO;
1447 		goto fail1;
1448 	}
1449 
1450 	if (sc->prioq.queued >= RT2560_PRIO_RING_COUNT) {
1451 		err = ENOMEM;
1452 		sc->sc_tx_nobuf++;
1453 		goto fail1;
1454 	}
1455 
1456 	m = allocb(msgdsize(mp) + 32, BPRI_MED);
1457 	if (m == NULL) {
1458 		ral_debug(RAL_DBG_TX, "rt2560_mgmt_send: can't alloc mblk.\n");
1459 		err = DDI_FAILURE;
1460 		goto fail1;
1461 	}
1462 
1463 	for (off = 0, m0 = mp; m0 != NULL; m0 = m0->b_cont) {
1464 		mblen = MBLKL(m0);
1465 		(void) memcpy(m->b_rptr + off, m0->b_rptr, mblen);
1466 		off += mblen;
1467 	}
1468 	m->b_wptr += off;
1469 
1470 	wh = (struct ieee80211_frame *)m->b_rptr;
1471 	ni = ieee80211_find_txnode(ic, wh->i_addr1);
1472 
1473 	if (ni == NULL) {
1474 		err = DDI_FAILURE;
1475 		sc->sc_tx_err++;
1476 		goto fail2;
1477 	}
1478 
1479 	/* to support shared_key auth mode */
1480 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1481 		k = ieee80211_crypto_encap(ic, m);
1482 		if (k == NULL) {
1483 			err = DDI_FAILURE;
1484 			sc->sc_tx_err++;
1485 			goto fail3;
1486 		}
1487 		/* packet header may have moved, reset our local pointer */
1488 		wh = (struct ieee80211_frame *)m->b_rptr;
1489 	}
1490 
1491 	desc = &sc->prioq.desc[sc->prioq.cur];
1492 	data = &sc->prioq.data[sc->prioq.cur];
1493 
1494 	rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
1495 	data->ni = ieee80211_ref_node(ni);
1496 
1497 	pktlen = msgdsize(m);
1498 	dest = data->buf;
1499 	bcopy(m->b_rptr, dest, pktlen);
1500 
1501 	wh = (struct ieee80211_frame *)m->b_rptr;
1502 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1503 		flags |= RT2560_TX_ACK;
1504 
1505 		dur = rt2560_txtime(RAL_ACK_SIZE, rate, ic->ic_flags) +
1506 		    RAL_SIFS;
1507 		/* LINTED E_BAD_PTR_CAST_ALIGN */
1508 		*(uint16_t *)wh->i_dur = LE_16(dur);
1509 
1510 		/* tell hardware to add timestamp for probe responses */
1511 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1512 		    IEEE80211_FC0_TYPE_MGT &&
1513 		    (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1514 		    IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1515 			flags |= RT2560_TX_TIMESTAMP;
1516 	}
1517 
1518 	rt2560_setup_tx_desc(sc, desc, flags, pktlen, rate, 0);
1519 
1520 	idx = sc->prioq.cur;
1521 
1522 	dr = &sc->prioq.dr_txbuf[idx];
1523 	(void) ddi_dma_sync(dr->dr_hnd, 0, RAL_TXBUF_SIZE, DDI_DMA_SYNC_FORDEV);
1524 
1525 	dr = &sc->prioq.dr_desc;
1526 	(void) ddi_dma_sync(dr->dr_hnd, idx * RT2560_TX_DESC_SIZE,
1527 	    RT2560_TX_DESC_SIZE, DDI_DMA_SYNC_FORDEV);
1528 
1529 	ral_debug(RAL_DBG_MGMT, "sending mgt frame len=%u idx=%u rate=%u\n",
1530 	    pktlen, sc->prioq.cur, rate);
1531 
1532 	/* kick prio */
1533 	sc->prioq.queued++; /* IF > RT2560_PRIO_RING_COUNT? FULL */
1534 	sc->prioq.cur = (sc->prioq.cur + 1) % RT2560_PRIO_RING_COUNT;
1535 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_PRIO);
1536 
1537 	sc->sc_tx_timer = 5;
1538 
1539 	ic->ic_stats.is_tx_frags++;
1540 	ic->ic_stats.is_tx_bytes += pktlen;
1541 
1542 fail3:
1543 	ieee80211_free_node(ni);
1544 fail2:
1545 	freemsg(m);
1546 fail1:
1547 	freemsg(mp);
1548 	mutex_exit(&sc->prioq.tx_lock);
1549 
1550 	return (err);
1551 }
1552 
1553 static int
1554 rt2560_send(ieee80211com_t *ic, mblk_t *mp)
1555 {
1556 	struct rt2560_softc *sc = (struct rt2560_softc *)ic;
1557 	struct rt2560_tx_desc *desc;
1558 	struct rt2560_tx_data *data;
1559 	struct rt2560_node *rn;
1560 	struct ieee80211_rateset *rs;
1561 	struct ieee80211_frame *wh;
1562 	struct ieee80211_key *k;
1563 	uint16_t dur;
1564 	uint32_t flags = 0;
1565 	int rate, err = DDI_SUCCESS;
1566 
1567 	struct ieee80211_node *ni;
1568 	mblk_t *m, *m0;
1569 	int off, mblen, pktlen;
1570 	caddr_t dest;
1571 
1572 	struct dma_region *dr;
1573 	uint32_t idx;
1574 
1575 	mutex_enter(&sc->txq.tx_lock);
1576 
1577 	if (sc->txq.queued >= RT2560_TX_RING_COUNT - 1) {
1578 		ral_debug(RAL_DBG_TX, "ral: rt2560_tx_data(): "
1579 		    "no TX DMA buffer available!\n");
1580 		sc->sc_need_sched = 1;
1581 		sc->sc_tx_nobuf++;
1582 		err = ENOMEM;
1583 		goto fail1;
1584 	}
1585 
1586 	m = allocb(msgdsize(mp) + 32, BPRI_MED);
1587 	if (m == NULL) {
1588 		ral_debug(RAL_DBG_TX, "rt2560_xmit(): can't alloc mblk.\n");
1589 		err = DDI_FAILURE;
1590 		goto fail1;
1591 	}
1592 
1593 	for (off = 0, m0 = mp; m0 != NULL; m0 = m0->b_cont) {
1594 		mblen = MBLKL(m0);
1595 		(void) memcpy(m->b_rptr + off, m0->b_rptr, mblen);
1596 		off += mblen;
1597 	}
1598 	m->b_wptr += off;
1599 
1600 	wh = (struct ieee80211_frame *)m->b_rptr;
1601 	ni = ieee80211_find_txnode(ic, wh->i_addr1);
1602 
1603 	if (ni == NULL) {
1604 		err = DDI_FAILURE;
1605 		sc->sc_tx_err++;
1606 		goto fail2;
1607 	}
1608 
1609 	(void) ieee80211_encap(ic, m, ni);
1610 
1611 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1612 		k = ieee80211_crypto_encap(ic, m);
1613 		if (k == NULL) {
1614 			sc->sc_tx_err++;
1615 			err = DDI_FAILURE;
1616 			goto fail3;
1617 		}
1618 		/* packet header may have moved, reset our local pointer */
1619 		wh = (struct ieee80211_frame *)m->b_rptr;
1620 	}
1621 
1622 	/*
1623 	 * RTS/CTS exchange ignore, since the max packet will less than
1624 	 * the rtsthreshold (2346)
1625 	 * Unnecessary codes deleted.
1626 	 */
1627 
1628 	data = &sc->txq.data[sc->txq.cur];
1629 	desc = &sc->txq.desc[sc->txq.cur];
1630 
1631 	data->ni = ieee80211_ref_node(ni);
1632 
1633 	pktlen = msgdsize(m);
1634 	dest = data->buf;
1635 	bcopy(m->b_rptr, dest, pktlen);
1636 
1637 	if (ic->ic_fixed_rate != IEEE80211_FIXED_RATE_NONE) {
1638 		rs = &ic->ic_sup_rates[ic->ic_curmode];
1639 		rate = rs->ir_rates[ic->ic_fixed_rate];
1640 	} else {
1641 		rs = &ni->in_rates;
1642 		rn = (struct rt2560_node *)ni;
1643 		ni->in_txrate = ral_rssadapt_choose(&rn->rssadapt, rs, wh,
1644 		    pktlen, NULL, 0);
1645 		rate = rs->ir_rates[ni->in_txrate];
1646 	}
1647 
1648 	rate &= IEEE80211_RATE_VAL;
1649 	if (rate <= 0) {
1650 		rate = 2;	/* basic rate */
1651 	}
1652 
1653 	/* remember link conditions for rate adaptation algorithm */
1654 	if (ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE) {
1655 		data->id.id_len = pktlen;
1656 		data->id.id_rateidx = ni->in_txrate;
1657 		data->id.id_node = ni;
1658 		data->id.id_rssi = ni->in_rssi;
1659 	} else
1660 		data->id.id_node = NULL;
1661 
1662 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1663 		flags |= RT2560_TX_ACK;
1664 
1665 		dur = rt2560_txtime(RAL_ACK_SIZE, rt2560_ack_rate(ic, rate),
1666 		    ic->ic_flags) + RAL_SIFS;
1667 		/* LINTED E_BAD_PTR_CAST_ALIGN */
1668 		*(uint16_t *)wh->i_dur = LE_16(dur);
1669 	}
1670 
1671 	/* flags |= RT2560_TX_CIPHER_NONE; */
1672 	rt2560_setup_tx_desc(sc, desc, flags, pktlen, rate, 0);
1673 
1674 	idx = sc->txq.cur;
1675 
1676 	dr = &sc->txq.dr_txbuf[idx];
1677 	(void) ddi_dma_sync(dr->dr_hnd, 0, RAL_TXBUF_SIZE, DDI_DMA_SYNC_FORDEV);
1678 
1679 	dr = &sc->txq.dr_desc;
1680 	(void) ddi_dma_sync(dr->dr_hnd, idx * RT2560_TX_DESC_SIZE,
1681 	    RT2560_TX_DESC_SIZE, DDI_DMA_SYNC_FORDEV);
1682 
1683 	ral_debug(RAL_DBG_TX, "sending data frame len=%u idx=%u rate=%u\n",
1684 	    pktlen, sc->txq.cur, rate);
1685 
1686 	/* kick tx */
1687 	sc->txq.queued++;
1688 	sc->txq.cur = (sc->txq.cur + 1) % RT2560_TX_RING_COUNT;
1689 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_TX);
1690 
1691 	sc->sc_tx_timer = 5;
1692 
1693 	ic->ic_stats.is_tx_frags++;
1694 	ic->ic_stats.is_tx_bytes += pktlen;
1695 
1696 	freemsg(mp);
1697 fail3:
1698 	ieee80211_free_node(ni);
1699 fail2:
1700 	freemsg(m);
1701 fail1:
1702 	mutex_exit(&sc->txq.tx_lock);
1703 	return (err);
1704 }
1705 
1706 static mblk_t *
1707 rt2560_m_tx(void *arg, mblk_t *mp)
1708 {
1709 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
1710 	struct ieee80211com *ic = &sc->sc_ic;
1711 	mblk_t *next;
1712 
1713 	if (!RAL_IS_RUNNING(sc)) {
1714 		freemsgchain(mp);
1715 		return (NULL);
1716 	}
1717 	/*
1718 	 * No data frames go out unless we're associated; this
1719 	 * should not happen as the 802.11 layer does not enable
1720 	 * the xmit queue until we enter the RUN state.
1721 	 */
1722 	if (ic->ic_state != IEEE80211_S_RUN) {
1723 		ral_debug(RAL_DBG_TX, "ral: rt2560_m_tx(): "
1724 		    "discard, state %u\n", ic->ic_state);
1725 		freemsgchain(mp);
1726 		return (NULL);
1727 	}
1728 
1729 	while (mp != NULL) {
1730 		next = mp->b_next;
1731 		mp->b_next = NULL;
1732 		if (rt2560_send(ic, mp) != DDI_SUCCESS) {
1733 			mp->b_next = next;
1734 			freemsgchain(mp);
1735 			return (NULL);
1736 		}
1737 		mp = next;
1738 	}
1739 	return (mp);
1740 }
1741 
1742 static void
1743 rt2560_set_macaddr(struct rt2560_softc *sc, uint8_t *addr)
1744 {
1745 	uint32_t tmp;
1746 
1747 	tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
1748 	RAL_WRITE(sc, RT2560_CSR3, tmp);
1749 
1750 	tmp = addr[4] | addr[5] << 8;
1751 	RAL_WRITE(sc, RT2560_CSR4, tmp);
1752 
1753 	ral_debug(RAL_DBG_HW,
1754 	    "setting MAC address to " MACSTR "\n", MAC2STR(addr));
1755 }
1756 
1757 static void
1758 rt2560_get_macaddr(struct rt2560_softc *sc, uint8_t *addr)
1759 {
1760 	uint32_t tmp;
1761 
1762 	tmp = RAL_READ(sc, RT2560_CSR3);
1763 	addr[0] = tmp & 0xff;
1764 	addr[1] = (tmp >>  8) & 0xff;
1765 	addr[2] = (tmp >> 16) & 0xff;
1766 	addr[3] = (tmp >> 24);
1767 
1768 	tmp = RAL_READ(sc, RT2560_CSR4);
1769 	addr[4] = tmp & 0xff;
1770 	addr[5] = (tmp >> 8) & 0xff;
1771 }
1772 
1773 static void
1774 rt2560_update_promisc(struct rt2560_softc *sc)
1775 {
1776 	uint32_t tmp;
1777 
1778 	tmp = RAL_READ(sc, RT2560_RXCSR0);
1779 	tmp &= ~RT2560_DROP_NOT_TO_ME;
1780 	if (!(sc->sc_rcr & RAL_RCR_PROMISC))
1781 		tmp |= RT2560_DROP_NOT_TO_ME;
1782 
1783 	RAL_WRITE(sc, RT2560_RXCSR0, tmp);
1784 	ral_debug(RAL_DBG_HW, "%s promiscuous mode\n",
1785 	    (sc->sc_rcr & RAL_RCR_PROMISC) ?  "entering" : "leaving");
1786 }
1787 
1788 static const char *
1789 rt2560_get_rf(int rev)
1790 {
1791 	switch (rev) {
1792 	case RT2560_RF_2522:	return ("RT2522");
1793 	case RT2560_RF_2523:	return ("RT2523");
1794 	case RT2560_RF_2524:	return ("RT2524");
1795 	case RT2560_RF_2525:	return ("RT2525");
1796 	case RT2560_RF_2525E:	return ("RT2525e");
1797 	case RT2560_RF_2526:	return ("RT2526");
1798 	case RT2560_RF_5222:	return ("RT5222");
1799 	default:		return ("unknown");
1800 	}
1801 }
1802 
1803 static void
1804 rt2560_read_eeprom(struct rt2560_softc *sc)
1805 {
1806 	uint16_t val;
1807 	int i;
1808 
1809 	val = rt2560_eeprom_read(sc, RT2560_EEPROM_CONFIG0);
1810 	sc->rf_rev =   (val >> 11) & 0x7;
1811 	sc->hw_radio = (val >> 10) & 0x1;
1812 	sc->led_mode = (val >> 6)  & 0x7;
1813 	sc->rx_ant =   (val >> 4)  & 0x3;
1814 	sc->tx_ant =   (val >> 2)  & 0x3;
1815 	sc->nb_ant =   val & 0x3;
1816 
1817 	/* read default values for BBP registers */
1818 	for (i = 0; i < 16; i++) {
1819 		val = rt2560_eeprom_read(sc, RT2560_EEPROM_BBP_BASE + i);
1820 		sc->bbp_prom[i].reg = val >> 8;
1821 		sc->bbp_prom[i].val = val & 0xff;
1822 	}
1823 
1824 	/* read Tx power for all b/g channels */
1825 	for (i = 0; i < 14 / 2; i++) {
1826 		val = rt2560_eeprom_read(sc, RT2560_EEPROM_TXPOWER + i);
1827 		sc->txpow[i * 2] = val >> 8;
1828 		sc->txpow[i * 2 + 1] = val & 0xff;
1829 	}
1830 }
1831 
1832 static int
1833 rt2560_bbp_init(struct rt2560_softc *sc)
1834 {
1835 #define	N(a)	(sizeof (a) / sizeof ((a)[0]))
1836 	int i, ntries;
1837 
1838 	/* wait for BBP to be ready */
1839 	for (ntries = 0; ntries < 100; ntries++) {
1840 		if (rt2560_bbp_read(sc, RT2560_BBP_VERSION) != 0)
1841 			break;
1842 		drv_usecwait(1);
1843 	}
1844 	if (ntries == 100) {
1845 		ral_debug(RAL_DBG_HW, "timeout waiting for BBP\n");
1846 		return (EIO);
1847 	}
1848 	/* initialize BBP registers to default values */
1849 	for (i = 0; i < N(rt2560_def_bbp); i++) {
1850 		rt2560_bbp_write(sc, rt2560_def_bbp[i].reg,
1851 		    rt2560_def_bbp[i].val);
1852 	}
1853 
1854 	return (0);
1855 #undef N
1856 }
1857 
1858 static void
1859 rt2560_set_txantenna(struct rt2560_softc *sc, int antenna)
1860 {
1861 	uint32_t tmp;
1862 	uint8_t tx;
1863 
1864 	tx = rt2560_bbp_read(sc, RT2560_BBP_TX) & ~RT2560_BBP_ANTMASK;
1865 	if (antenna == 1)
1866 		tx |= RT2560_BBP_ANTA;
1867 	else if (antenna == 2)
1868 		tx |= RT2560_BBP_ANTB;
1869 	else
1870 		tx |= RT2560_BBP_DIVERSITY;
1871 
1872 	/* need to force I/Q flip for RF 2525e, 2526 and 5222 */
1873 	if (sc->rf_rev == RT2560_RF_2525E || sc->rf_rev == RT2560_RF_2526 ||
1874 	    sc->rf_rev == RT2560_RF_5222)
1875 		tx |= RT2560_BBP_FLIPIQ;
1876 
1877 	rt2560_bbp_write(sc, RT2560_BBP_TX, tx);
1878 
1879 	/* update values for CCK and OFDM in BBPCSR1 */
1880 	tmp = RAL_READ(sc, RT2560_BBPCSR1) & ~0x00070007;
1881 	tmp |= (tx & 0x7) << 16 | (tx & 0x7);
1882 	RAL_WRITE(sc, RT2560_BBPCSR1, tmp);
1883 }
1884 
1885 static void
1886 rt2560_set_rxantenna(struct rt2560_softc *sc, int antenna)
1887 {
1888 	uint8_t rx;
1889 
1890 	rx = rt2560_bbp_read(sc, RT2560_BBP_RX) & ~RT2560_BBP_ANTMASK;
1891 	if (antenna == 1)
1892 		rx |= RT2560_BBP_ANTA;
1893 	else if (antenna == 2)
1894 		rx |= RT2560_BBP_ANTB;
1895 	else
1896 		rx |= RT2560_BBP_DIVERSITY;
1897 
1898 	/* need to force no I/Q flip for RF 2525e and 2526 */
1899 	if (sc->rf_rev == RT2560_RF_2525E || sc->rf_rev == RT2560_RF_2526)
1900 		rx &= ~RT2560_BBP_FLIPIQ;
1901 
1902 	rt2560_bbp_write(sc, RT2560_BBP_RX, rx);
1903 }
1904 
1905 static void
1906 rt2560_stop(struct rt2560_softc *sc)
1907 {
1908 	struct ieee80211com *ic = &sc->sc_ic;
1909 
1910 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
1911 	ieee80211_stop_watchdog(ic);	/* stop the watchdog */
1912 
1913 	RAL_LOCK(sc);
1914 	sc->sc_tx_timer = 0;
1915 
1916 	/* abort Tx */
1917 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_ABORT_TX);
1918 
1919 	/* disable Rx */
1920 	RAL_WRITE(sc, RT2560_RXCSR0, RT2560_DISABLE_RX);
1921 
1922 	/* reset ASIC (imply reset BBP) */
1923 	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
1924 	RAL_WRITE(sc, RT2560_CSR1, 0);
1925 
1926 	/* disable interrupts */
1927 	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
1928 
1929 	/* reset Tx and Rx rings */
1930 	rt2560_reset_tx_ring(sc, &sc->txq);
1931 	rt2560_reset_tx_ring(sc, &sc->prioq);
1932 	rt2560_reset_rx_ring(sc, &sc->rxq);
1933 	RAL_UNLOCK(sc);
1934 }
1935 
1936 static int
1937 rt2560_init(struct rt2560_softc *sc)
1938 {
1939 #define	N(a)	(sizeof (a) / sizeof ((a)[0]))
1940 	/* struct rt2560_softc *sc = priv; */
1941 	struct ieee80211com *ic = &sc->sc_ic;
1942 	uint32_t tmp;
1943 	int i;
1944 
1945 	rt2560_stop(sc);
1946 
1947 	RAL_LOCK(sc);
1948 	/* setup tx/rx ring */
1949 	rt2560_ring_hwsetup(sc);
1950 
1951 	/* initialize MAC registers to default values */
1952 	for (i = 0; i < N(rt2560_def_mac); i++)
1953 		RAL_WRITE(sc, rt2560_def_mac[i].reg, rt2560_def_mac[i].val);
1954 
1955 	rt2560_set_macaddr(sc, ic->ic_macaddr);
1956 
1957 	/* set basic rate set (will be updated later) */
1958 	RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x153);
1959 
1960 	rt2560_set_txantenna(sc, sc->tx_ant);
1961 	rt2560_set_rxantenna(sc, sc->rx_ant);
1962 	rt2560_update_slot(ic, 1);
1963 	rt2560_update_plcp(sc);
1964 	rt2560_update_led(sc, 0, 0);
1965 
1966 	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
1967 	RAL_WRITE(sc, RT2560_CSR1, RT2560_HOST_READY);
1968 
1969 	if (rt2560_bbp_init(sc) != 0) {
1970 		RAL_UNLOCK(sc);
1971 		rt2560_stop(sc);
1972 		return (DDI_FAILURE);
1973 	}
1974 
1975 	/* set default BSS channel */
1976 	rt2560_set_chan(sc, ic->ic_curchan);
1977 
1978 	/* kick Rx */
1979 	tmp = RT2560_DROP_PHY_ERROR | RT2560_DROP_CRC_ERROR;
1980 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
1981 		tmp |= RT2560_DROP_CTL | RT2560_DROP_VERSION_ERROR;
1982 		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
1983 			tmp |= RT2560_DROP_TODS;
1984 		if (!(sc->sc_rcr & RAL_RCR_PROMISC))
1985 			tmp |= RT2560_DROP_NOT_TO_ME;
1986 
1987 	}
1988 	RAL_WRITE(sc, RT2560_RXCSR0, tmp);
1989 
1990 	/* clear old FCS and Rx FIFO errors */
1991 	(void) RAL_READ(sc, RT2560_CNT0);
1992 	(void) RAL_READ(sc, RT2560_CNT4);
1993 
1994 	/* clear any pending interrupts */
1995 	RAL_WRITE(sc, RT2560_CSR7, 0xffffffff);
1996 	/* enable interrupts */
1997 	RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
1998 
1999 	RAL_UNLOCK(sc);
2000 #undef N
2001 	return (DDI_SUCCESS);
2002 }
2003 
2004 void
2005 rt2560_watchdog(void *arg)
2006 {
2007 	struct rt2560_softc *sc = arg;
2008 	struct ieee80211com *ic = &sc->sc_ic;
2009 	int ntimer = 0;
2010 
2011 	RAL_LOCK(sc);
2012 	ic->ic_watchdog_timer = 0;
2013 
2014 	if (!RAL_IS_RUNNING(sc)) {
2015 		RAL_UNLOCK(sc);
2016 		return;
2017 	}
2018 
2019 	if (sc->sc_tx_timer > 0) {
2020 		if (--sc->sc_tx_timer == 0) {
2021 			ral_debug(RAL_DBG_MSG, "tx timer timeout\n");
2022 			RAL_UNLOCK(sc);
2023 			(void) rt2560_init(sc);
2024 			(void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2025 			return;
2026 		}
2027 	}
2028 
2029 	if (ic->ic_state == IEEE80211_S_RUN)
2030 		ntimer = 1;
2031 
2032 	RAL_UNLOCK(sc);
2033 
2034 	ieee80211_watchdog(ic);
2035 
2036 	if (ntimer)
2037 		ieee80211_start_watchdog(ic, ntimer);
2038 }
2039 
2040 static int
2041 rt2560_m_start(void *arg)
2042 {
2043 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2044 	int err;
2045 
2046 	/*
2047 	 * initialize rt2560 hardware
2048 	 */
2049 	err = rt2560_init(sc);
2050 	if (err != DDI_SUCCESS) {
2051 		ral_debug(RAL_DBG_GLD, "device configuration failed\n");
2052 		goto fail;
2053 	}
2054 	sc->sc_flags |= RAL_FLAG_RUNNING;	/* RUNNING */
2055 	return (err);
2056 
2057 fail:
2058 	rt2560_stop(sc);
2059 	return (err);
2060 }
2061 
2062 static void
2063 rt2560_m_stop(void *arg)
2064 {
2065 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2066 
2067 	(void) rt2560_stop(sc);
2068 	sc->sc_flags &= ~RAL_FLAG_RUNNING;	/* STOP */
2069 }
2070 
2071 static int
2072 rt2560_m_unicst(void *arg, const uint8_t *macaddr)
2073 {
2074 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2075 	struct ieee80211com *ic = &sc->sc_ic;
2076 
2077 	ral_debug(RAL_DBG_GLD, "rt2560_m_unicst(): " MACSTR "\n",
2078 	    MAC2STR(macaddr));
2079 
2080 	IEEE80211_ADDR_COPY(ic->ic_macaddr, macaddr);
2081 	(void) rt2560_set_macaddr(sc, (uint8_t *)macaddr);
2082 	(void) rt2560_init(sc);
2083 
2084 	return (0);
2085 }
2086 
2087 /*ARGSUSED*/
2088 static int
2089 rt2560_m_multicst(void *arg, boolean_t add, const uint8_t *mca)
2090 {
2091 	return (0);
2092 }
2093 
2094 static int
2095 rt2560_m_promisc(void *arg, boolean_t on)
2096 {
2097 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2098 
2099 	if (on) {
2100 		sc->sc_rcr |= RAL_RCR_PROMISC;
2101 		sc->sc_rcr |= RAL_RCR_MULTI;
2102 	} else {
2103 		sc->sc_rcr &= ~RAL_RCR_PROMISC;
2104 		sc->sc_rcr &= ~RAL_RCR_PROMISC;
2105 	}
2106 
2107 	rt2560_update_promisc(sc);
2108 	return (0);
2109 }
2110 
2111 /*
2112  * callback functions for /get/set properties
2113  */
2114 static int
2115 rt2560_m_setprop(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
2116     uint_t wldp_length, const void *wldp_buf)
2117 {
2118 	struct rt2560_softc *sc = arg;
2119 	struct ieee80211com *ic = &sc->sc_ic;
2120 	int err;
2121 
2122 	err = ieee80211_setprop(ic, pr_name, wldp_pr_num,
2123 	    wldp_length, wldp_buf);
2124 	RAL_LOCK(sc);
2125 	if (err == ENETRESET) {
2126 		if (RAL_IS_RUNNING(sc)) {
2127 			RAL_UNLOCK(sc);
2128 			(void) rt2560_init(sc);
2129 			(void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2130 			RAL_LOCK(sc);
2131 		}
2132 		err = 0;
2133 	}
2134 	RAL_UNLOCK(sc);
2135 
2136 	return (err);
2137 }
2138 
2139 static int
2140 rt2560_m_getprop(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
2141     uint_t pr_flags, uint_t wldp_length, void *wldp_buf, uint_t *perm)
2142 {
2143 	struct rt2560_softc *sc = arg;
2144 	int err;
2145 
2146 	err = ieee80211_getprop(&sc->sc_ic, pr_name, wldp_pr_num,
2147 	    pr_flags, wldp_length, wldp_buf, perm);
2148 
2149 	return (err);
2150 }
2151 
2152 static void
2153 rt2560_m_ioctl(void* arg, queue_t *wq, mblk_t *mp)
2154 {
2155 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2156 	struct ieee80211com *ic = &sc->sc_ic;
2157 	int err;
2158 
2159 	err = ieee80211_ioctl(ic, wq, mp);
2160 	RAL_LOCK(sc);
2161 	if (err == ENETRESET) {
2162 		if (RAL_IS_RUNNING(sc)) {
2163 			RAL_UNLOCK(sc);
2164 			(void) rt2560_init(sc);
2165 			(void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2166 			RAL_LOCK(sc);
2167 		}
2168 	}
2169 	RAL_UNLOCK(sc);
2170 }
2171 
2172 static int
2173 rt2560_m_stat(void *arg, uint_t stat, uint64_t *val)
2174 {
2175 	struct rt2560_softc *sc  = (struct rt2560_softc *)arg;
2176 	ieee80211com_t	*ic = &sc->sc_ic;
2177 	ieee80211_node_t *ni = ic->ic_bss;
2178 	struct ieee80211_rateset *rs = &ni->in_rates;
2179 
2180 	RAL_LOCK(sc);
2181 	switch (stat) {
2182 	case MAC_STAT_IFSPEED:
2183 		*val = ((ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE) ?
2184 		    (rs->ir_rates[ni->in_txrate] & IEEE80211_RATE_VAL)
2185 		    : ic->ic_fixed_rate) / 2 * 1000000;
2186 		break;
2187 	case MAC_STAT_NOXMTBUF:
2188 		*val = sc->sc_tx_nobuf;
2189 		break;
2190 	case MAC_STAT_NORCVBUF:
2191 		*val = sc->sc_rx_nobuf;
2192 		break;
2193 	case MAC_STAT_IERRORS:
2194 		*val = sc->sc_rx_err;
2195 		break;
2196 	case MAC_STAT_RBYTES:
2197 		*val = ic->ic_stats.is_rx_bytes;
2198 		break;
2199 	case MAC_STAT_IPACKETS:
2200 		*val = ic->ic_stats.is_rx_frags;
2201 		break;
2202 	case MAC_STAT_OBYTES:
2203 		*val = ic->ic_stats.is_tx_bytes;
2204 		break;
2205 	case MAC_STAT_OPACKETS:
2206 		*val = ic->ic_stats.is_tx_frags;
2207 		break;
2208 	case MAC_STAT_OERRORS:
2209 	case WIFI_STAT_TX_FAILED:
2210 		*val = sc->sc_tx_err;
2211 		break;
2212 	case WIFI_STAT_TX_RETRANS:
2213 		*val = sc->sc_tx_retries;
2214 		break;
2215 	case WIFI_STAT_FCS_ERRORS:
2216 	case WIFI_STAT_WEP_ERRORS:
2217 	case WIFI_STAT_TX_FRAGS:
2218 	case WIFI_STAT_MCAST_TX:
2219 	case WIFI_STAT_RTS_SUCCESS:
2220 	case WIFI_STAT_RTS_FAILURE:
2221 	case WIFI_STAT_ACK_FAILURE:
2222 	case WIFI_STAT_RX_FRAGS:
2223 	case WIFI_STAT_MCAST_RX:
2224 	case WIFI_STAT_RX_DUPS:
2225 		RAL_UNLOCK(sc);
2226 		return (ieee80211_stat(ic, stat, val));
2227 	default:
2228 		RAL_UNLOCK(sc);
2229 		return (ENOTSUP);
2230 	}
2231 	RAL_UNLOCK(sc);
2232 
2233 	return (0);
2234 }
2235 
2236 static uint_t
2237 rt2560_intr(caddr_t arg)
2238 {
2239 	/* LINTED E_BAD_PTR_CAST_ALIGN */
2240 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2241 	uint32_t r;
2242 
2243 	RAL_LOCK(sc);
2244 
2245 	if (!RAL_IS_RUNNING(sc)) {
2246 		/*
2247 		 * The hardware is not ready/present, don't touch anything.
2248 		 * Note this can happen early on if the IRQ is shared.
2249 		 */
2250 		RAL_UNLOCK(sc);
2251 		return (DDI_INTR_UNCLAIMED);
2252 	}
2253 
2254 	r = RAL_READ(sc, RT2560_CSR7);
2255 	RAL_WRITE(sc, RT2560_CSR7, r);
2256 
2257 	if (r == 0xffffffff) {
2258 		RAL_UNLOCK(sc);
2259 		return (DDI_INTR_UNCLAIMED);
2260 	}
2261 
2262 	if (!(r & RT2560_INTR_ALL)) {
2263 		RAL_UNLOCK(sc);
2264 		return (DDI_INTR_UNCLAIMED);
2265 	}
2266 
2267 	/* disable interrupts */
2268 	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
2269 
2270 	if (r & RT2560_TX_DONE) {
2271 		RAL_UNLOCK(sc);
2272 		rt2560_tx_intr(sc);
2273 		RAL_LOCK(sc);
2274 	}
2275 
2276 	if (r & RT2560_PRIO_DONE) {
2277 		RAL_UNLOCK(sc);
2278 		rt2560_prio_intr(sc);
2279 		RAL_LOCK(sc);
2280 	}
2281 
2282 	if (r & RT2560_RX_DONE) {
2283 		sc->sc_rx_pend = 1;
2284 		ddi_trigger_softintr(sc->sc_softint_id);
2285 	}
2286 
2287 	/* re-enable interrupts */
2288 	RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
2289 	RAL_UNLOCK(sc);
2290 
2291 	return (DDI_INTR_CLAIMED);
2292 }
2293 
2294 /*
2295  * quiesce(9E) entry point.
2296  *
2297  * This function is called when the system is single-threaded at high
2298  * PIL with preemption disabled. Therefore, this function must not be
2299  * blocked.
2300  *
2301  * This function returns DDI_SUCCESS on success, or DDI_FAILURE on failure.
2302  * DDI_FAILURE indicates an error condition and should almost never happen.
2303  */
2304 static int32_t
2305 rt2560_quiesce(dev_info_t *devinfo)
2306 {
2307 	struct rt2560_softc *sc;
2308 
2309 	sc = ddi_get_soft_state(ral_soft_state_p, ddi_get_instance(devinfo));
2310 	if (sc == NULL)
2311 		return (DDI_FAILURE);
2312 
2313 	/* abort Tx */
2314 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_ABORT_TX);
2315 
2316 	/* disable Rx */
2317 	RAL_WRITE(sc, RT2560_RXCSR0, RT2560_DISABLE_RX);
2318 
2319 	/* reset ASIC (imply reset BBP) */
2320 	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
2321 	RAL_WRITE(sc, RT2560_CSR1, 0);
2322 
2323 	/* disable interrupts */
2324 	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
2325 
2326 	return (DDI_SUCCESS);
2327 }
2328 
2329 static int
2330 rt2560_attach(dev_info_t *devinfo, ddi_attach_cmd_t cmd)
2331 {
2332 	struct rt2560_softc *sc;
2333 	struct ieee80211com *ic;
2334 	int err, i;
2335 	int instance;
2336 
2337 	ddi_acc_handle_t ioh;
2338 	caddr_t regs;
2339 	uint16_t vendor_id, device_id, command;
2340 	uint8_t cachelsz;
2341 	char strbuf[32];
2342 
2343 	wifi_data_t wd = { 0 };
2344 	mac_register_t *macp;
2345 
2346 	switch (cmd) {
2347 	case DDI_ATTACH:
2348 		break;
2349 	case DDI_RESUME:
2350 		sc = ddi_get_soft_state(ral_soft_state_p,
2351 		    ddi_get_instance(devinfo));
2352 		sc->sc_flags &= ~RAL_FLAG_SUSPENDING;
2353 		if (RAL_IS_INITED(sc))
2354 			(void) rt2560_init(sc);
2355 		return (DDI_SUCCESS);
2356 	default:
2357 		return (DDI_FAILURE);
2358 	}
2359 
2360 	instance = ddi_get_instance(devinfo);
2361 
2362 	if (ddi_soft_state_zalloc(ral_soft_state_p, instance) != DDI_SUCCESS) {
2363 		ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2364 		    "unable to alloc soft_state_p\n");
2365 		return (DDI_FAILURE);
2366 	}
2367 
2368 	sc = ddi_get_soft_state(ral_soft_state_p, instance);
2369 	ic = (ieee80211com_t *)&sc->sc_ic;
2370 	sc->sc_dev = devinfo;
2371 
2372 	/* pci configuration */
2373 	err = ddi_regs_map_setup(devinfo, 0, &regs, 0, 0, &ral_csr_accattr,
2374 	    &ioh);
2375 	if (err != DDI_SUCCESS) {
2376 		ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2377 		    "ddi_regs_map_setup() failed");
2378 		goto fail1;
2379 	}
2380 
2381 	cachelsz = ddi_get8(ioh, (uint8_t *)(regs + PCI_CONF_CACHE_LINESZ));
2382 	if (cachelsz == 0)
2383 		cachelsz = 0x10;
2384 	sc->sc_cachelsz = cachelsz << 2;
2385 
2386 	vendor_id = ddi_get16(ioh,
2387 	    (uint16_t *)((uintptr_t)regs + PCI_CONF_VENID));
2388 	device_id = ddi_get16(ioh,
2389 	    (uint16_t *)((uintptr_t)regs + PCI_CONF_DEVID));
2390 
2391 	ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): vendor 0x%x, "
2392 	    "device id 0x%x, cache size %d\n", vendor_id, device_id, cachelsz);
2393 
2394 	/*
2395 	 * Enable response to memory space accesses,
2396 	 * and enabe bus master.
2397 	 */
2398 	command = PCI_COMM_MAE | PCI_COMM_ME;
2399 	ddi_put16(ioh, (uint16_t *)((uintptr_t)regs + PCI_CONF_COMM), command);
2400 	ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2401 	    "set command reg to 0x%x \n", command);
2402 
2403 	ddi_put8(ioh, (uint8_t *)(regs + PCI_CONF_LATENCY_TIMER), 0xa8);
2404 	ddi_put8(ioh, (uint8_t *)(regs + PCI_CONF_ILINE), 0x10);
2405 	ddi_regs_map_free(&ioh);
2406 
2407 	/* pci i/o space */
2408 	err = ddi_regs_map_setup(devinfo, 1,
2409 	    &sc->sc_rbase, 0, 0, &ral_csr_accattr, &sc->sc_ioh);
2410 	ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2411 	    "regs map1 = %x err=%d\n", regs, err);
2412 	if (err != DDI_SUCCESS) {
2413 		ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2414 		    "ddi_regs_map_setup() failed");
2415 		goto fail1;
2416 	}
2417 
2418 	/* initialize the ral rate */
2419 	ral_rate_init();
2420 
2421 	/* retrieve RT2560 rev. no */
2422 	sc->asic_rev = RAL_READ(sc, RT2560_CSR0);
2423 
2424 	/* retrieve MAC address */
2425 	rt2560_get_macaddr(sc, ic->ic_macaddr);
2426 
2427 	/* retrieve RF rev. no and various other things from EEPROM */
2428 	rt2560_read_eeprom(sc);
2429 
2430 	ral_debug(RAL_DBG_GLD, "MAC/BBP RT2560 (rev 0x%02x), RF %s\n",
2431 	    sc->asic_rev, rt2560_get_rf(sc->rf_rev));
2432 
2433 	/*
2434 	 * Allocate Tx and Rx rings.
2435 	 */
2436 	err = rt2560_alloc_tx_ring(sc, &sc->txq, RT2560_TX_RING_COUNT);
2437 	if (err != DDI_SUCCESS) {
2438 		ral_debug(RAL_DBG_GLD, "could not allocate Tx ring\n");
2439 		goto fail2;
2440 	}
2441 	err = rt2560_alloc_tx_ring(sc, &sc->prioq, RT2560_PRIO_RING_COUNT);
2442 	if (err != DDI_SUCCESS) {
2443 		ral_debug(RAL_DBG_GLD, "could not allocate Prio ring\n");
2444 		goto fail3;
2445 	}
2446 	err = rt2560_alloc_rx_ring(sc, &sc->rxq, RT2560_RX_RING_COUNT);
2447 	if (err != DDI_SUCCESS) {
2448 		ral_debug(RAL_DBG_GLD, "could not allocate Rx ring\n");
2449 		goto fail4;
2450 	}
2451 
2452 	mutex_init(&sc->sc_genlock, NULL, MUTEX_DRIVER, NULL);
2453 	mutex_init(&sc->txq.tx_lock, NULL, MUTEX_DRIVER, NULL);
2454 	mutex_init(&sc->prioq.tx_lock, NULL, MUTEX_DRIVER, NULL);
2455 	mutex_init(&sc->rxq.rx_lock, NULL, MUTEX_DRIVER, NULL);
2456 
2457 
2458 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
2459 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
2460 	ic->ic_state = IEEE80211_S_INIT;
2461 
2462 	ic->ic_maxrssi = 63;
2463 	ic->ic_set_shortslot = rt2560_update_slot;
2464 	ic->ic_xmit = rt2560_mgmt_send;
2465 
2466 	/* set device capabilities */
2467 	ic->ic_caps =
2468 	    IEEE80211_C_TXPMGT |	/* tx power management */
2469 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
2470 	    IEEE80211_C_SHSLOT;		/* short slot time supported */
2471 
2472 	ic->ic_caps |= IEEE80211_C_WPA; /* Support WPA/WPA2 */
2473 
2474 #define	IEEE80211_CHAN_A	\
2475 	(IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_OFDM)
2476 
2477 	if (sc->rf_rev == RT2560_RF_5222) {
2478 		/* set supported .11a rates */
2479 		ic->ic_sup_rates[IEEE80211_MODE_11A] = rt2560_rateset_11a;
2480 
2481 		/* set supported .11a channels */
2482 		for (i = 36; i <= 64; i += 4) {
2483 			ic->ic_sup_channels[i].ich_freq =
2484 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2485 			ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2486 		}
2487 		for (i = 100; i <= 140; i += 4) {
2488 			ic->ic_sup_channels[i].ich_freq =
2489 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2490 			ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2491 		}
2492 		for (i = 149; i <= 161; i += 4) {
2493 			ic->ic_sup_channels[i].ich_freq =
2494 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2495 			ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2496 		}
2497 	}
2498 
2499 	/* set supported .11b and .11g rates */
2500 	ic->ic_sup_rates[IEEE80211_MODE_11B] = rt2560_rateset_11b;
2501 	ic->ic_sup_rates[IEEE80211_MODE_11G] = rt2560_rateset_11g;
2502 
2503 	/* set supported .11b and .11g channels (1 through 14) */
2504 	for (i = 1; i <= 14; i++) {
2505 		ic->ic_sup_channels[i].ich_freq =
2506 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
2507 		ic->ic_sup_channels[i].ich_flags =
2508 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
2509 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
2510 	}
2511 
2512 	ieee80211_attach(ic);
2513 
2514 	/* register WPA door */
2515 	ieee80211_register_door(ic, ddi_driver_name(devinfo),
2516 	    ddi_get_instance(devinfo));
2517 
2518 	ic->ic_node_alloc = rt2560_node_alloc;
2519 	ic->ic_node_free = rt2560_node_free;
2520 
2521 	/* override state transition machine */
2522 	sc->sc_newstate = ic->ic_newstate;
2523 	ic->ic_newstate = rt2560_newstate;
2524 	ic->ic_watchdog = rt2560_watchdog;
2525 	ieee80211_media_init(ic);
2526 	ic->ic_def_txkey = 0;
2527 
2528 	sc->sc_rcr = 0;
2529 	sc->sc_rx_pend = 0;
2530 	sc->dwelltime = 300;
2531 	sc->sc_flags &= ~RAL_FLAG_RUNNING;
2532 
2533 	err = ddi_add_softintr(devinfo, DDI_SOFTINT_LOW,
2534 	    &sc->sc_softint_id, NULL, 0, ral_softint_handler, (caddr_t)sc);
2535 	if (err != DDI_SUCCESS) {
2536 		ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2537 		    "ddi_add_softintr() failed");
2538 		goto fail5;
2539 	}
2540 
2541 	err = ddi_get_iblock_cookie(devinfo, 0, &sc->sc_iblock);
2542 	if (err != DDI_SUCCESS) {
2543 		ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2544 		    "Can not get iblock cookie for INT\n");
2545 		goto fail6;
2546 	}
2547 
2548 	err = ddi_add_intr(devinfo, 0, NULL, NULL, rt2560_intr, (caddr_t)sc);
2549 	if (err != DDI_SUCCESS) {
2550 		ral_debug(RAL_DBG_GLD,
2551 		    "unable to add device interrupt handler\n");
2552 		goto fail6;
2553 	}
2554 
2555 	/*
2556 	 * Provide initial settings for the WiFi plugin; whenever this
2557 	 * information changes, we need to call mac_plugindata_update()
2558 	 */
2559 	wd.wd_opmode = ic->ic_opmode;
2560 	wd.wd_secalloc = WIFI_SEC_NONE;
2561 	IEEE80211_ADDR_COPY(wd.wd_bssid, ic->ic_bss->in_bssid);
2562 
2563 	if ((macp = mac_alloc(MAC_VERSION)) == NULL) {
2564 		ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2565 		    "MAC version mismatch\n");
2566 		goto fail7;
2567 	}
2568 
2569 	macp->m_type_ident	= MAC_PLUGIN_IDENT_WIFI;
2570 	macp->m_driver		= sc;
2571 	macp->m_dip		= devinfo;
2572 	macp->m_src_addr	= ic->ic_macaddr;
2573 	macp->m_callbacks	= &rt2560_m_callbacks;
2574 	macp->m_min_sdu		= 0;
2575 	macp->m_max_sdu		= IEEE80211_MTU;
2576 	macp->m_pdata		= &wd;
2577 	macp->m_pdata_size	= sizeof (wd);
2578 
2579 	err = mac_register(macp, &ic->ic_mach);
2580 	mac_free(macp);
2581 	if (err != 0) {
2582 		ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2583 		    "mac_register err %x\n", err);
2584 		goto fail7;
2585 	}
2586 
2587 	/*
2588 	 * Create minor node of type DDI_NT_NET_WIFI
2589 	 */
2590 	(void) snprintf(strbuf, sizeof (strbuf), "%s%d",
2591 	    "ral", instance);
2592 	err = ddi_create_minor_node(devinfo, strbuf, S_IFCHR,
2593 	    instance + 1, DDI_NT_NET_WIFI, 0);
2594 
2595 	if (err != DDI_SUCCESS)
2596 		ral_debug(RAL_DBG_GLD, "ddi_create_minor_node() failed\n");
2597 
2598 	/*
2599 	 * Notify link is down now
2600 	 */
2601 	mac_link_update(ic->ic_mach, LINK_STATE_DOWN);
2602 
2603 	return (DDI_SUCCESS);
2604 fail7:
2605 	ddi_remove_intr(devinfo, 0, sc->sc_iblock);
2606 fail6:
2607 	ddi_remove_softintr(sc->sc_softint_id);
2608 fail5:
2609 	mutex_destroy(&sc->sc_genlock);
2610 	mutex_destroy(&sc->txq.tx_lock);
2611 	mutex_destroy(&sc->prioq.tx_lock);
2612 	mutex_destroy(&sc->rxq.rx_lock);
2613 
2614 	rt2560_free_rx_ring(sc, &sc->rxq);
2615 fail4:
2616 	rt2560_free_tx_ring(sc, &sc->prioq);
2617 fail3:
2618 	rt2560_free_tx_ring(sc, &sc->txq);
2619 fail2:
2620 	ddi_regs_map_free(&sc->sc_ioh);
2621 fail1:
2622 	ddi_soft_state_free(ral_soft_state_p, ddi_get_instance(devinfo));
2623 
2624 	return (DDI_FAILURE);
2625 }
2626 
2627 static int
2628 rt2560_detach(dev_info_t *devinfo, ddi_detach_cmd_t cmd)
2629 {
2630 	struct rt2560_softc *sc;
2631 
2632 	sc = ddi_get_soft_state(ral_soft_state_p, ddi_get_instance(devinfo));
2633 	ASSERT(sc != NULL);
2634 
2635 	switch (cmd) {
2636 	case DDI_DETACH:
2637 		break;
2638 	case DDI_SUSPEND:
2639 		if (RAL_IS_INITED(sc))
2640 			(void) rt2560_stop(sc);
2641 		sc->sc_flags |= RAL_FLAG_SUSPENDING;
2642 		return (DDI_SUCCESS);
2643 	default:
2644 		return (DDI_FAILURE);
2645 	}
2646 
2647 	if (mac_disable(sc->sc_ic.ic_mach) != 0)
2648 		return (DDI_FAILURE);
2649 
2650 	rt2560_stop(sc);
2651 
2652 	/*
2653 	 * Unregister from the MAC layer subsystem
2654 	 */
2655 	(void) mac_unregister(sc->sc_ic.ic_mach);
2656 
2657 	ddi_remove_intr(devinfo, 0, sc->sc_iblock);
2658 	ddi_remove_softintr(sc->sc_softint_id);
2659 
2660 	/*
2661 	 * detach ieee80211 layer
2662 	 */
2663 	ieee80211_detach(&sc->sc_ic);
2664 
2665 	rt2560_free_tx_ring(sc, &sc->txq);
2666 	rt2560_free_tx_ring(sc, &sc->prioq);
2667 	rt2560_free_rx_ring(sc, &sc->rxq);
2668 
2669 	ddi_regs_map_free(&sc->sc_ioh);
2670 
2671 	mutex_destroy(&sc->sc_genlock);
2672 	mutex_destroy(&sc->txq.tx_lock);
2673 	mutex_destroy(&sc->prioq.tx_lock);
2674 	mutex_destroy(&sc->rxq.rx_lock);
2675 
2676 	ddi_remove_minor_node(devinfo, NULL);
2677 	ddi_soft_state_free(ral_soft_state_p, ddi_get_instance(devinfo));
2678 
2679 	return (DDI_SUCCESS);
2680 }
2681 
2682 int
2683 _info(struct modinfo *modinfop)
2684 {
2685 	return (mod_info(&modlinkage, modinfop));
2686 }
2687 
2688 int
2689 _init(void)
2690 {
2691 	int status;
2692 
2693 	status = ddi_soft_state_init(&ral_soft_state_p,
2694 	    sizeof (struct rt2560_softc), 1);
2695 	if (status != 0)
2696 		return (status);
2697 
2698 	mac_init_ops(&ral_dev_ops, "ral");
2699 	status = mod_install(&modlinkage);
2700 	if (status != 0) {
2701 		mac_fini_ops(&ral_dev_ops);
2702 		ddi_soft_state_fini(&ral_soft_state_p);
2703 	}
2704 	return (status);
2705 }
2706 
2707 int
2708 _fini(void)
2709 {
2710 	int status;
2711 
2712 	status = mod_remove(&modlinkage);
2713 	if (status == 0) {
2714 		mac_fini_ops(&ral_dev_ops);
2715 		ddi_soft_state_fini(&ral_soft_state_p);
2716 	}
2717 	return (status);
2718 }
2719