xref: /titanic_44/usr/src/uts/common/io/rwn/rt2860.c (revision b695575577bae0337af339d76949713bfe1c9013)
1 /*
2  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
3  * Use is subject to license terms.
4  */
5 
6 /*
7  * Copyright (c) 2007, 2008
8  *	Damien Bergamini <damien.bergamini@free.fr>
9  *
10  * Permission to use, copy, modify, and distribute this software for any
11  * purpose with or without fee is hereby granted, provided that the above
12  * copyright notice and this permission notice appear in all copies.
13  *
14  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
15  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
16  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
17  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
18  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
20  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21  */
22 
23 /*
24  * Ralink Technology RT2860 chipset driver
25  * http://www.ralinktech.com/
26  */
27 
28 #include <sys/types.h>
29 #include <sys/byteorder.h>
30 #include <sys/conf.h>
31 #include <sys/cmn_err.h>
32 #include <sys/stat.h>
33 #include <sys/ddi.h>
34 #include <sys/sunddi.h>
35 #include <sys/strsubr.h>
36 #include <inet/common.h>
37 #include <sys/note.h>
38 #include <sys/stream.h>
39 #include <sys/strsun.h>
40 #include <sys/modctl.h>
41 #include <sys/devops.h>
42 #include <sys/mac_provider.h>
43 #include <sys/mac_wifi.h>
44 #include <sys/net80211.h>
45 #include <sys/net80211_proto.h>
46 #include <sys/varargs.h>
47 #include <sys/pci.h>
48 #include <sys/crypto/common.h>
49 #include <sys/crypto/api.h>
50 #include <inet/wifi_ioctl.h>
51 
52 #include "rt2860_reg.h"
53 #include "rt2860_var.h"
54 
55 #define	RT2860_DBG_80211	(1 << 0)
56 #define	RT2860_DBG_DMA		(1 << 1)
57 #define	RT2860_DBG_EEPROM	(1 << 2)
58 #define	RT2860_DBG_FW		(1 << 3)
59 #define	RT2860_DBG_HW		(1 << 4)
60 #define	RT2860_DBG_INTR		(1 << 5)
61 #define	RT2860_DBG_RX		(1 << 6)
62 #define	RT2860_DBG_SCAN		(1 << 7)
63 #define	RT2860_DBG_TX		(1 << 8)
64 #define	RT2860_DBG_RADIO	(1 << 9)
65 #define	RT2860_DBG_RESUME	(1 << 10)
66 #define	RT2860_DBG_MSG		(1 << 11)
67 
68 uint32_t rt2860_dbg_flags = 0x0;
69 
70 #ifdef DEBUG
71 #define	RWN_DEBUG \
72 	rt2860_debug
73 #else
74 #define	RWN_DEBUG
75 #endif
76 
77 static void *rt2860_soft_state_p = NULL;
78 static uint8_t rt2860_fw_bin [] = {
79 #include "fw-rt2860/rt2860.ucode"
80 };
81 
82 static const struct ieee80211_rateset rt2560_rateset_11b =
83 	{ 4, { 2, 4, 11, 22 } };
84 
85 static const struct ieee80211_rateset rt2560_rateset_11g =
86 	{ 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
87 
88 static const struct {
89 	uint32_t	reg;
90 	uint32_t	val;
91 } rt2860_def_mac[] = {
92 	RT2860_DEF_MAC
93 };
94 
95 static const struct {
96 	uint8_t	reg;
97 	uint8_t	val;
98 } rt2860_def_bbp[] = {
99 	RT2860_DEF_BBP
100 };
101 
102 static const struct rfprog {
103 	uint8_t		chan;
104 	uint32_t	r1, r2, r3, r4;
105 } rt2860_rf2850[] = {
106 	RT2860_RF2850
107 };
108 
109 /*
110  * PIO access attributes for registers
111  */
112 static ddi_device_acc_attr_t rwn_csr_accattr = {
113 	DDI_DEVICE_ATTR_V0,
114 	DDI_STRUCTURE_LE_ACC,
115 	DDI_STRICTORDER_ACC
116 };
117 
118 /*
119  * DMA access attributes for descriptors: NOT to be byte swapped.
120  */
121 static ddi_device_acc_attr_t rt2860_desc_accattr = {
122 	DDI_DEVICE_ATTR_V0,
123 	DDI_STRUCTURE_LE_ACC,
124 	DDI_STRICTORDER_ACC
125 };
126 
127 static ddi_device_acc_attr_t rt2860_buf_accattr = {
128 	DDI_DEVICE_ATTR_V0,
129 	DDI_NEVERSWAP_ACC,
130 	DDI_STRICTORDER_ACC,
131 	DDI_DEFAULT_ACC
132 };
133 
134 /*
135  * Describes the chip's DMA engine
136  */
137 static ddi_dma_attr_t rt2860_dma_attr = {
138 	DMA_ATTR_V0,			/* dma_attr version */
139 	0x0,				/* dma_attr_addr_lo */
140 	0xffffffffU,			/* dma_attr_addr_hi */
141 	0xffffffffU,			/* dma_attr_count_max */
142 	16,				/* dma_attr_align */
143 	0x00000fff,			/* dma_attr_burstsizes */
144 	1,				/* dma_attr_minxfer */
145 	0xffffffffU,			/* dma_attr_maxxfer */
146 	0xffffffffU,			/* dma_attr_seg */
147 	1,				/* dma_attr_sgllen */
148 	1,				/* dma_attr_granular */
149 	0				/* dma_attr_flags */
150 };
151 
152 static uint16_t	rt2860_eeprom_read(struct rt2860_softc *, uint8_t);
153 static int 	rt2860_read_eeprom(struct rt2860_softc *);
154 const char	*rt2860_get_rf(uint8_t);
155 static int	rt2860_alloc_dma_mem(dev_info_t *, ddi_dma_attr_t *, size_t,
156 		    ddi_device_acc_attr_t *, uint_t, uint_t, struct dma_area *);
157 static void	rt2860_free_dma_mem(struct dma_area *);
158 static int	rt2860_alloc_tx_ring(struct rt2860_softc *,
159 		    struct rt2860_tx_ring *);
160 static void	rt2860_free_tx_ring(struct rt2860_softc *,
161 		    struct rt2860_tx_ring *);
162 static int	rt2860_alloc_rx_ring(struct rt2860_softc *,
163 		    struct rt2860_rx_ring *);
164 static void	rt2860_free_rx_ring(struct rt2860_softc *,
165 		    struct rt2860_rx_ring *);
166 static int	rt2860_alloc_tx_pool(struct rt2860_softc *);
167 static void	rt2860_free_tx_pool(struct rt2860_softc *);
168 static uint16_t	rt2860_txtime(int, int, uint32_t);
169 static int	rt2860_ack_rate(struct ieee80211com *, int);
170 static int	rt2860_send(ieee80211com_t *, mblk_t *, uint8_t);
171 static uint8_t	rt2860_maxrssi_chain(struct rt2860_softc *,
172 		    const struct rt2860_rxwi *);
173 static void	rt2860_drain_stats_fifo(struct rt2860_softc *);
174 static void	rt2860_tx_intr(struct rt2860_softc *, int);
175 static void	rt2860_rx_intr(struct rt2860_softc *);
176 static uint_t	rt2860_softintr(caddr_t);
177 static uint_t	rt2860_intr(caddr_t);
178 static void	rt2860_set_region_4(struct rt2860_softc *,
179 		    uint32_t, uint32_t, int);
180 static int	rt2860_load_microcode(struct rt2860_softc *);
181 static void	rt2860_set_macaddr(struct rt2860_softc *, const uint8_t *);
182 static int	rt2860_bbp_init(struct rt2860_softc *);
183 static uint8_t	rt2860_mcu_bbp_read(struct rt2860_softc *, uint8_t);
184 static void	rt2860_mcu_bbp_write(struct rt2860_softc *, uint8_t, uint8_t);
185 static int	rt2860_mcu_cmd(struct rt2860_softc *, uint8_t, uint16_t);
186 static void	rt2860_rf_write(struct rt2860_softc *, uint8_t, uint32_t);
187 static void	rt2860_select_chan_group(struct rt2860_softc *, int);
188 static void	rt2860_set_chan(struct rt2860_softc *,
189 		    struct ieee80211_channel *);
190 static void	rt2860_updateprot(struct ieee80211com *);
191 static void	rt2860_set_leds(struct rt2860_softc *, uint16_t);
192 static void	rt2860_next_scan(void *);
193 static void	rt2860_iter_func(void *, struct ieee80211_node *);
194 static void	rt2860_updateslot(struct rt2860_softc *);
195 static uint8_t	rt2860_rate2mcs(uint8_t);
196 static void	rt2860_enable_mrr(struct rt2860_softc *);
197 static void	rt2860_set_txpreamble(struct rt2860_softc *);
198 static void	rt2860_set_basicrates(struct rt2860_softc *);
199 static void	rt2860_set_bssid(struct rt2860_softc *, const uint8_t *);
200 static void	rt2860_amrr_node_init(const struct rt2860_amrr *,
201 		    struct rt2860_amrr_node *);
202 static void	rt2860_amrr_choose(struct rt2860_amrr *,
203 		    struct ieee80211_node *, struct rt2860_amrr_node *);
204 static void	rt2860_newassoc(struct ieee80211com *, struct ieee80211_node *,
205 		    int);
206 static void	rt2860_enable_tsf_sync(struct rt2860_softc *);
207 static int	rt2860_newstate(struct ieee80211com *,
208 		    enum ieee80211_state, int);
209 static int	rt2860_init(struct rt2860_softc *);
210 static void	rt2860_stop(struct rt2860_softc *);
211 static int	rt2860_quiesce(dev_info_t *t);
212 
213 /*
214  * device operations
215  */
216 static int rt2860_attach(dev_info_t *, ddi_attach_cmd_t);
217 static int rt2860_detach(dev_info_t *, ddi_detach_cmd_t);
218 
219 /*
220  * Module Loading Data & Entry Points
221  */
222 DDI_DEFINE_STREAM_OPS(rwn_dev_ops, nulldev, nulldev, rt2860_attach,
223     rt2860_detach, nodev, NULL, D_MP, NULL, rt2860_quiesce);
224 
225 static struct modldrv rwn_modldrv = {
226 	&mod_driverops,		/* Type of module.  This one is a driver */
227 	"Ralink RT2700/2800 driver v1.1",	/* short description */
228 	&rwn_dev_ops		/* driver specific ops */
229 };
230 
231 static struct modlinkage modlinkage = {
232 	MODREV_1,
233 	(void *)&rwn_modldrv,
234 	NULL
235 };
236 
237 static int	rt2860_m_stat(void *,  uint_t, uint64_t *);
238 static int	rt2860_m_start(void *);
239 static void	rt2860_m_stop(void *);
240 static int	rt2860_m_promisc(void *, boolean_t);
241 static int	rt2860_m_multicst(void *, boolean_t, const uint8_t *);
242 static int	rt2860_m_unicst(void *, const uint8_t *);
243 static mblk_t	*rt2860_m_tx(void *, mblk_t *);
244 static void	rt2860_m_ioctl(void *, queue_t *, mblk_t *);
245 static int	rt2860_m_setprop(void *arg, const char *pr_name,
246 		    mac_prop_id_t wldp_pr_num,
247 		    uint_t wldp_length, const void *wldp_buf);
248 static int	rt2860_m_getprop(void *arg, const char *pr_name,
249 		    mac_prop_id_t wldp_pr_num, uint_t pr_flags,
250 		    uint_t wldp_length, void *wldp_buf, uint_t *);
251 
252 static mac_callbacks_t rt2860_m_callbacks = {
253 	MC_IOCTL | MC_SETPROP | MC_GETPROP,
254 	rt2860_m_stat,
255 	rt2860_m_start,
256 	rt2860_m_stop,
257 	rt2860_m_promisc,
258 	rt2860_m_multicst,
259 	rt2860_m_unicst,
260 	rt2860_m_tx,
261 	rt2860_m_ioctl,
262 	NULL,
263 	NULL,
264 	NULL,
265 	rt2860_m_setprop,
266 	rt2860_m_getprop
267 };
268 
269 #ifdef DEBUG
270 void
271 rt2860_debug(uint32_t dbg_flags, const int8_t *fmt, ...)
272 {
273 	va_list args;
274 
275 	if (dbg_flags & rt2860_dbg_flags) {
276 		va_start(args, fmt);
277 		vcmn_err(CE_CONT, fmt, args);
278 		va_end(args);
279 	}
280 }
281 #endif
282 
283 const char *
284 rt2860_get_rf(uint8_t rev)
285 {
286 	switch (rev) {
287 	case RT2860_RF_2820:	return "RT2820";
288 	case RT2860_RF_2850:	return "RT2850";
289 	case RT2860_RF_2720:	return "RT2720";
290 	case RT2860_RF_2750:	return "RT2750";
291 	default:		return "unknown";
292 	}
293 }
294 
295 /*
296  * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46,
297  * 93C66 or 93C86).
298  */
299 static uint16_t
300 rt2860_eeprom_read(struct rt2860_softc *sc, uint8_t addr)
301 {
302 	int		n;
303 	uint16_t	val;
304 	uint32_t	tmp;
305 
306 	/* clock C once before the first command */
307 	RT2860_EEPROM_CTL(sc, 0);
308 
309 	RT2860_EEPROM_CTL(sc, RT2860_S);
310 	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_C);
311 	RT2860_EEPROM_CTL(sc, RT2860_S);
312 
313 	/* write start bit (1) */
314 	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_D);
315 	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_D | RT2860_C);
316 
317 	/* write READ opcode (10) */
318 	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_D);
319 	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_D | RT2860_C);
320 	RT2860_EEPROM_CTL(sc, RT2860_S);
321 	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_C);
322 
323 	/* write address (A5-A0 or A7-A0) */
324 	n = ((RT2860_READ(sc, RT2860_PCI_EECTRL) & 0x30) == 0) ? 5 : 7;
325 	for (; n >= 0; n--) {
326 		RT2860_EEPROM_CTL(sc, RT2860_S |
327 		    (((addr >> n) & 1) << RT2860_SHIFT_D));
328 		RT2860_EEPROM_CTL(sc, RT2860_S |
329 		    (((addr >> n) & 1) << RT2860_SHIFT_D) | RT2860_C);
330 	}
331 
332 	RT2860_EEPROM_CTL(sc, RT2860_S);
333 
334 	/* read data Q15-Q0 */
335 	val = 0;
336 	for (n = 15; n >= 0; n--) {
337 		RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_C);
338 		tmp = RT2860_READ(sc, RT2860_PCI_EECTRL);
339 		val |= ((tmp & RT2860_Q) >> RT2860_SHIFT_Q) << n;
340 		RT2860_EEPROM_CTL(sc, RT2860_S);
341 	}
342 
343 	RT2860_EEPROM_CTL(sc, 0);
344 
345 	/* clear Chip Select and clock C */
346 	RT2860_EEPROM_CTL(sc, RT2860_S);
347 	RT2860_EEPROM_CTL(sc, 0);
348 	RT2860_EEPROM_CTL(sc, RT2860_C);
349 
350 	return (val);
351 }
352 
353 /*
354  * Add `delta' (signed) to each 4-bit sub-word of a 32-bit word.
355  * Used to adjust per-rate Tx power registers.
356  */
357 static inline uint32_t
358 b4inc(uint32_t b32, int8_t delta)
359 {
360 	int8_t i, b4;
361 
362 	for (i = 0; i < 8; i++) {
363 		b4 = b32 & 0xf;
364 		b4 += delta;
365 		if (b4 < 0)
366 			b4 = 0;
367 		else if (b4 > 0xf)
368 			b4 = 0xf;
369 		b32 = b32 >> 4 | b4 << 28;
370 	}
371 	return (b32);
372 }
373 
374 static int
375 rt2860_read_eeprom(struct rt2860_softc *sc)
376 {
377 	struct ieee80211com	*ic = &sc->sc_ic;
378 	int			ridx, ant, i;
379 	int8_t			delta_2ghz, delta_5ghz;
380 	uint16_t		val;
381 
382 	/* read EEPROM version */
383 	val = rt2860_eeprom_read(sc, RT2860_EEPROM_VERSION);
384 	RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
385 	    "EEPROM rev=%d, FAE=%d\n",
386 	    val & 0xff, val >> 8);
387 
388 	/* read MAC address */
389 	val = rt2860_eeprom_read(sc, RT2860_EEPROM_MAC01);
390 	ic->ic_macaddr[0] = val & 0xff;
391 	ic->ic_macaddr[1] = val >> 8;
392 	val = rt2860_eeprom_read(sc, RT2860_EEPROM_MAC23);
393 	ic->ic_macaddr[2] = val & 0xff;
394 	ic->ic_macaddr[3] = val >> 8;
395 	val = rt2860_eeprom_read(sc, RT2860_EEPROM_MAC45);
396 	ic->ic_macaddr[4] = val & 0xff;
397 	ic->ic_macaddr[5] = val >> 8;
398 	RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
399 	    "MAC address is: %x:%x:%x:%x:%x:%x\n",
400 	    ic->ic_macaddr[0], ic->ic_macaddr[1],
401 	    ic->ic_macaddr[2], ic->ic_macaddr[3],
402 	    ic->ic_macaddr[4], ic->ic_macaddr[5]);
403 
404 	/* read country code */
405 	val = rt2860_eeprom_read(sc, RT2860_EEPROM_COUNTRY);
406 	RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
407 	    "EEPROM region code=0x%04x\n", val);
408 
409 	/* read default BBP settings */
410 	for (i = 0; i < 8; i++) {
411 		val = rt2860_eeprom_read(sc, RT2860_EEPROM_BBP_BASE + i);
412 		sc->bbp[i].val = val & 0xff;
413 		sc->bbp[i].reg = val >> 8;
414 		RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
415 		    "BBP%d=0x%02x\n",
416 		    sc->bbp[i].reg, sc->bbp[i].val);
417 	}
418 
419 	/* read RF frequency offset from EEPROM */
420 	val = rt2860_eeprom_read(sc, RT2860_EEPROM_FREQ_LEDS);
421 	sc->freq = ((val & 0xff) != 0xff) ? val & 0xff : 0;
422 	RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
423 	    "EEPROM freq offset %d\n", sc->freq & 0xff);
424 
425 	if ((sc->leds = val >> 8) != 0xff) {
426 		/* read LEDs operating mode */
427 		sc->led[0] = rt2860_eeprom_read(sc, RT2860_EEPROM_LED1);
428 		sc->led[1] = rt2860_eeprom_read(sc, RT2860_EEPROM_LED2);
429 		sc->led[2] = rt2860_eeprom_read(sc, RT2860_EEPROM_LED3);
430 	} else {
431 		/* broken EEPROM, use default settings */
432 		sc->leds = 0x01;
433 		sc->led[0] = 0x5555;
434 		sc->led[1] = 0x2221;
435 		sc->led[2] = 0xa9f8;
436 	}
437 	RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
438 	    "EEPROM LED mode=0x%02x, LEDs=0x%04x/0x%04x/0x%04x\n",
439 	    sc->leds, sc->led[0], sc->led[1], sc->led[2]);
440 
441 	/* read RF information */
442 	val = rt2860_eeprom_read(sc, RT2860_EEPROM_ANTENNA);
443 	if (val == 0xffff) {
444 		/* broken EEPROM, default to RF2820 1T2R */
445 		RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
446 		    "invalid EEPROM antenna info, using default\n");
447 		sc->rf_rev = RT2860_RF_2820;
448 		sc->ntxchains = 1;
449 		sc->nrxchains = 2;
450 	} else {
451 		sc->rf_rev = (val >> 8) & 0xf;
452 		sc->ntxchains = (val >> 4) & 0xf;
453 		sc->nrxchains = val & 0xf;
454 	}
455 	RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
456 	    "EEPROM RF rev=0x%02x chains=%dT%dR\n",
457 	    sc->rf_rev, sc->ntxchains, sc->nrxchains);
458 
459 	/* check if RF supports automatic Tx access gain control */
460 	val = rt2860_eeprom_read(sc, RT2860_EEPROM_CONFIG);
461 	RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
462 	    "EEPROM CFG 0x%04x\n", val);
463 	if ((val & 0xff) != 0xff)
464 		sc->calib_2ghz = sc->calib_5ghz = 0; /* XXX (val >> 1) & 1 */;
465 
466 	if (sc->sc_flags & RT2860_ADVANCED_PS) {
467 		/* read PCIe power save level */
468 		val = rt2860_eeprom_read(sc, RT2860_EEPROM_PCIE_PSLEVEL);
469 		if ((val & 0xff) != 0xff) {
470 			sc->pslevel = val & 0x3;
471 			val = rt2860_eeprom_read(sc, RT2860_EEPROM_REV);
472 			if (val >> 8 != 0x92 || !(val & 0x80))
473 				sc->pslevel = MIN(sc->pslevel, 1);
474 			RWN_DEBUG(RT2860_DBG_EEPROM,
475 			    "rwn: rt2860_read_eeprom(): "
476 			    "EEPROM PCIe PS Level=%d\n",
477 			    sc->pslevel);
478 		}
479 	}
480 	/* read power settings for 2GHz channels */
481 	for (i = 0; i < 14; i += 2) {
482 		val = rt2860_eeprom_read(sc,
483 		    RT2860_EEPROM_PWR2GHZ_BASE1 + i / 2);
484 		sc->txpow1[i + 0] = (int8_t)(val & 0xff);
485 		sc->txpow1[i + 1] = (int8_t)(val >> 8);
486 
487 		val = rt2860_eeprom_read(sc,
488 		    RT2860_EEPROM_PWR2GHZ_BASE2 + i / 2);
489 		sc->txpow2[i + 0] = (int8_t)(val & 0xff);
490 		sc->txpow2[i + 1] = (int8_t)(val >> 8);
491 	}
492 	/* fix broken Tx power entries */
493 	for (i = 0; i < 14; i++) {
494 		if (sc->txpow1[i] < 0 || sc->txpow1[i] > 31)
495 			sc->txpow1[i] = 5;
496 		if (sc->txpow2[i] < 0 || sc->txpow2[i] > 31)
497 			sc->txpow2[i] = 5;
498 		RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
499 		    "chan %d: power1=%d, power2=%d\n",
500 		    rt2860_rf2850[i].chan, sc->txpow1[i], sc->txpow2[i]);
501 	}
502 	/* read power settings for 5GHz channels */
503 	for (i = 0; i < 36; i += 2) {
504 		val = rt2860_eeprom_read(sc,
505 		    RT2860_EEPROM_PWR5GHZ_BASE1 + i / 2);
506 		sc->txpow1[i + 14] = (int8_t)(val & 0xff);
507 		sc->txpow1[i + 15] = (int8_t)(val >> 8);
508 
509 		val = rt2860_eeprom_read(sc,
510 		    RT2860_EEPROM_PWR5GHZ_BASE2 + i / 2);
511 		sc->txpow2[i + 14] = (int8_t)(val & 0xff);
512 		sc->txpow2[i + 15] = (int8_t)(val >> 8);
513 	}
514 	/* fix broken Tx power entries */
515 	for (i = 0; i < 36; i++) {
516 		if (sc->txpow1[14 + i] < -7 || sc->txpow1[14 + i] > 15)
517 			sc->txpow1[14 + i] = 5;
518 		if (sc->txpow2[14 + i] < -7 || sc->txpow2[14 + i] > 15)
519 			sc->txpow2[14 + i] = 5;
520 		RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
521 		    "chan %d: power1=%d, power2=%d\n",
522 		    rt2860_rf2850[14 + i].chan, sc->txpow1[14 + i],
523 		    sc->txpow2[14 + i]);
524 	}
525 
526 	/* read Tx power compensation for each Tx rate */
527 	val = rt2860_eeprom_read(sc, RT2860_EEPROM_DELTAPWR);
528 	delta_2ghz = delta_5ghz = 0;
529 	if ((val & 0xff) != 0xff && (val & 0x80)) {
530 		delta_2ghz = val & 0xf;
531 		if (!(val & 0x40))	/* negative number */
532 			delta_2ghz = -delta_2ghz;
533 	}
534 	val >>= 8;
535 	if ((val & 0xff) != 0xff && (val & 0x80)) {
536 		delta_5ghz = val & 0xf;
537 		if (!(val & 0x40))	/* negative number */
538 			delta_5ghz = -delta_5ghz;
539 	}
540 	RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
541 	    "power compensation=%d (2GHz), %d (5GHz) \n",
542 	    delta_2ghz, delta_5ghz);
543 
544 	for (ridx = 0; ridx < 5; ridx++) {
545 		uint32_t	reg;
546 
547 		val = rt2860_eeprom_read(sc, RT2860_EEPROM_RPWR + ridx);
548 		reg = (uint32_t)val << 16;
549 		val = rt2860_eeprom_read(sc, RT2860_EEPROM_RPWR + ridx + 1);
550 		reg |= val;
551 
552 		sc->txpow20mhz[ridx] = reg;
553 		sc->txpow40mhz_2ghz[ridx] = b4inc(reg, delta_2ghz);
554 		sc->txpow40mhz_5ghz[ridx] = b4inc(reg, delta_5ghz);
555 
556 		RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
557 		    "ridx %d: power 20MHz=0x%08x, 40MHz/2GHz=0x%08x, "
558 		    "40MHz/5GHz=0x%08x\n", ridx, sc->txpow20mhz[ridx],
559 		    sc->txpow40mhz_2ghz[ridx], sc->txpow40mhz_5ghz[ridx]);
560 	}
561 
562 	/* read factory-calibrated samples for temperature compensation */
563 	val = rt2860_eeprom_read(sc, RT2860_EEPROM_TSSI1_2GHZ);
564 	sc->tssi_2ghz[0] = val & 0xff;	/* [-4] */
565 	sc->tssi_2ghz[1] = val >> 8;	/* [-3] */
566 	val = rt2860_eeprom_read(sc, RT2860_EEPROM_TSSI2_2GHZ);
567 	sc->tssi_2ghz[2] = val & 0xff;	/* [-2] */
568 	sc->tssi_2ghz[3] = val >> 8;	/* [-1] */
569 	val = rt2860_eeprom_read(sc, RT2860_EEPROM_TSSI3_2GHZ);
570 	sc->tssi_2ghz[4] = val & 0xff;	/* [+0] */
571 	sc->tssi_2ghz[5] = val >> 8;	/* [+1] */
572 	val = rt2860_eeprom_read(sc, RT2860_EEPROM_TSSI4_2GHZ);
573 	sc->tssi_2ghz[6] = val & 0xff;	/* [+2] */
574 	sc->tssi_2ghz[7] = val >> 8;	/* [+3] */
575 	val = rt2860_eeprom_read(sc, RT2860_EEPROM_TSSI5_2GHZ);
576 	sc->tssi_2ghz[8] = val & 0xff;	/* [+4] */
577 	sc->step_2ghz = val >> 8;
578 	RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
579 	    "TSSI 2GHz: 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x "
580 	    "0x%02x 0x%02x step=%d\n", sc->tssi_2ghz[0], sc->tssi_2ghz[1],
581 	    sc->tssi_2ghz[2], sc->tssi_2ghz[3], sc->tssi_2ghz[4],
582 	    sc->tssi_2ghz[5], sc->tssi_2ghz[6], sc->tssi_2ghz[7],
583 	    sc->tssi_2ghz[8], sc->step_2ghz);
584 	/* check that ref value is correct, otherwise disable calibration */
585 	if (sc->tssi_2ghz[4] == 0xff)
586 		sc->calib_2ghz = 0;
587 
588 	val = rt2860_eeprom_read(sc, RT2860_EEPROM_TSSI1_5GHZ);
589 	sc->tssi_5ghz[0] = val & 0xff;	/* [-4] */
590 	sc->tssi_5ghz[1] = val >> 8;	/* [-3] */
591 	val = rt2860_eeprom_read(sc, RT2860_EEPROM_TSSI2_5GHZ);
592 	sc->tssi_5ghz[2] = val & 0xff;	/* [-2] */
593 	sc->tssi_5ghz[3] = val >> 8;	/* [-1] */
594 	val = rt2860_eeprom_read(sc, RT2860_EEPROM_TSSI3_5GHZ);
595 	sc->tssi_5ghz[4] = val & 0xff;	/* [+0] */
596 	sc->tssi_5ghz[5] = val >> 8;	/* [+1] */
597 	val = rt2860_eeprom_read(sc, RT2860_EEPROM_TSSI4_5GHZ);
598 	sc->tssi_5ghz[6] = val & 0xff;	/* [+2] */
599 	sc->tssi_5ghz[7] = val >> 8;	/* [+3] */
600 	val = rt2860_eeprom_read(sc, RT2860_EEPROM_TSSI5_5GHZ);
601 	sc->tssi_5ghz[8] = val & 0xff;	/* [+4] */
602 	sc->step_5ghz = val >> 8;
603 	RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
604 	    "TSSI 5GHz: 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x "
605 	    "0x%02x 0x%02x step=%d\n", sc->tssi_5ghz[0], sc->tssi_5ghz[1],
606 	    sc->tssi_5ghz[2], sc->tssi_5ghz[3], sc->tssi_5ghz[4],
607 	    sc->tssi_5ghz[5], sc->tssi_5ghz[6], sc->tssi_5ghz[7],
608 	    sc->tssi_5ghz[8], sc->step_5ghz);
609 	/* check that ref value is correct, otherwise disable calibration */
610 	if (sc->tssi_5ghz[4] == 0xff)
611 		sc->calib_5ghz = 0;
612 
613 	/* read RSSI offsets and LNA gains from EEPROM */
614 	val = rt2860_eeprom_read(sc, RT2860_EEPROM_RSSI1_2GHZ);
615 	sc->rssi_2ghz[0] = val & 0xff;	/* Ant A */
616 	sc->rssi_2ghz[1] = val >> 8;	/* Ant B */
617 	val = rt2860_eeprom_read(sc, RT2860_EEPROM_RSSI2_2GHZ);
618 	sc->rssi_2ghz[2] = val & 0xff;	/* Ant C */
619 	sc->lna[2] = val >> 8;		/* channel group 2 */
620 
621 	val = rt2860_eeprom_read(sc, RT2860_EEPROM_RSSI1_5GHZ);
622 	sc->rssi_5ghz[0] = val & 0xff;	/* Ant A */
623 	sc->rssi_5ghz[1] = val >> 8;	/* Ant B */
624 	val = rt2860_eeprom_read(sc, RT2860_EEPROM_RSSI2_5GHZ);
625 	sc->rssi_5ghz[2] = val & 0xff;	/* Ant C */
626 	sc->lna[3] = val >> 8;		/* channel group 3 */
627 
628 	val = rt2860_eeprom_read(sc, RT2860_EEPROM_LNA);
629 	sc->lna[0] = val & 0xff;	/* channel group 0 */
630 	sc->lna[1] = val >> 8;		/* channel group 1 */
631 
632 	/* fix broken 5GHz LNA entries */
633 	if (sc->lna[2] == 0 || sc->lna[2] == 0xff) {
634 		RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
635 		    "invalid LNA for channel group %d\n", 2);
636 		sc->lna[2] = sc->lna[1];
637 	}
638 	if (sc->lna[3] == 0 || sc->lna[3] == 0xff) {
639 		RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
640 		    "invalid LNA for channel group %d\n", 3);
641 		sc->lna[3] = sc->lna[1];
642 	}
643 
644 	/* fix broken RSSI offset entries */
645 	for (ant = 0; ant < 3; ant++) {
646 		if (sc->rssi_2ghz[ant] < -10 || sc->rssi_2ghz[ant] > 10) {
647 			RWN_DEBUG(RT2860_DBG_EEPROM,
648 			    "rwn: rt2860_read_eeprom(): "
649 			    "invalid RSSI%d offset: %d (2GHz)\n",
650 			    ant + 1, sc->rssi_2ghz[ant]);
651 			sc->rssi_2ghz[ant] = 0;
652 		}
653 		if (sc->rssi_5ghz[ant] < -10 || sc->rssi_5ghz[ant] > 10) {
654 			RWN_DEBUG(RT2860_DBG_EEPROM,
655 			    "rwn: rt2860_read_eeprom(): "
656 			    "invalid RSSI%d offset: %d (2GHz)\n",
657 			    ant + 1, sc->rssi_5ghz[ant]);
658 			sc->rssi_5ghz[ant] = 0;
659 		}
660 	}
661 
662 	return (RT2860_SUCCESS);
663 }
664 
665 /*
666  * Allocate an DMA memory and a DMA handle for accessing it
667  */
668 static int
669 rt2860_alloc_dma_mem(dev_info_t *devinfo, ddi_dma_attr_t *dma_attr,
670 	size_t memsize, ddi_device_acc_attr_t *attr_p, uint_t alloc_flags,
671 	uint_t bind_flags, struct dma_area *dma_p)
672 {
673 	int	err;
674 
675 	/*
676 	 * Allocate handle
677 	 */
678 	err = ddi_dma_alloc_handle(devinfo, dma_attr,
679 	    DDI_DMA_SLEEP, NULL, &dma_p->dma_hdl);
680 	if (err != DDI_SUCCESS) {
681 		RWN_DEBUG(RT2860_DBG_DMA, "rwn: rwn_allo_dma_mem(): "
682 		    "failed to alloc handle\n");
683 		goto fail1;
684 	}
685 
686 	/*
687 	 * Allocate memory
688 	 */
689 	err = ddi_dma_mem_alloc(dma_p->dma_hdl, memsize, attr_p,
690 	    alloc_flags, DDI_DMA_SLEEP, NULL, &dma_p->mem_va,
691 	    &dma_p->alength, &dma_p->acc_hdl);
692 	if (err != DDI_SUCCESS) {
693 		RWN_DEBUG(RT2860_DBG_DMA, "rwn: rwn_alloc_dma_mem(): "
694 		    "failed to alloc mem\n");
695 		goto fail2;
696 	}
697 
698 	/*
699 	 * Bind the two together
700 	 */
701 	err = ddi_dma_addr_bind_handle(dma_p->dma_hdl, NULL,
702 	    dma_p->mem_va, dma_p->alength, bind_flags,
703 	    DDI_DMA_SLEEP, NULL, &dma_p->cookie, &dma_p->ncookies);
704 	if (err != DDI_DMA_MAPPED) {
705 		RWN_DEBUG(RT2860_DBG_DMA, "rwn: rwn_alloc_dma_mem(): "
706 		    "failed to bind handle\n");
707 		goto fail3;
708 	}
709 
710 	if (dma_p->ncookies != 1) {
711 		RWN_DEBUG(RT2860_DBG_DMA, "rwn: rwn_alloc_dma_mem(): "
712 		    "failed to alloc cookies\n");
713 		goto fail4;
714 	}
715 
716 	dma_p->nslots = ~0U;
717 	dma_p->size = ~0U;
718 	dma_p->token = ~0U;
719 	dma_p->offset = 0;
720 	return (DDI_SUCCESS);
721 
722 fail4:
723 	(void) ddi_dma_unbind_handle(dma_p->dma_hdl);
724 fail3:
725 	ddi_dma_mem_free(&dma_p->acc_hdl);
726 fail2:
727 	ddi_dma_free_handle(&dma_p->dma_hdl);
728 fail1:
729 	return (err);
730 }
731 
732 static void
733 rt2860_free_dma_mem(struct dma_area *dma_p)
734 {
735 	if (dma_p->dma_hdl != NULL) {
736 		(void) ddi_dma_unbind_handle(dma_p->dma_hdl);
737 		if (dma_p->acc_hdl != NULL) {
738 			ddi_dma_mem_free(&dma_p->acc_hdl);
739 			dma_p->acc_hdl = NULL;
740 		}
741 		ddi_dma_free_handle(&dma_p->dma_hdl);
742 		dma_p->ncookies = 0;
743 		dma_p->dma_hdl = NULL;
744 	}
745 }
746 
747 /*ARGSUSED*/
748 static int
749 rt2860_alloc_tx_ring(struct rt2860_softc *sc, struct rt2860_tx_ring *ring)
750 {
751 	int	size, err;
752 
753 	size = RT2860_TX_RING_COUNT * sizeof (struct rt2860_txd);
754 
755 	err = rt2860_alloc_dma_mem(sc->sc_dev, &rt2860_dma_attr, size,
756 	    &rt2860_desc_accattr, DDI_DMA_CONSISTENT,
757 	    DDI_DMA_RDWR | DDI_DMA_CONSISTENT,
758 	    &ring->txdesc_dma);
759 	if (err != DDI_SUCCESS) {
760 		RWN_DEBUG(RT2860_DBG_DMA, "rwn: rt2860_alloc_tx_ring(): "
761 		    "failed to alloc dma mem\n");
762 		goto fail1;
763 	}
764 
765 	ring->txd = (struct rt2860_txd *)ring->txdesc_dma.mem_va;
766 	ring->paddr = ring->txdesc_dma.cookie.dmac_address;
767 
768 	ring->cur = 0;
769 	ring->next = 0;
770 	ring->queued = 0;
771 
772 	(void) bzero(ring->txd, size);
773 	RT2860_DMA_SYNC(ring->txdesc_dma, DDI_DMA_SYNC_FORDEV);
774 	return (DDI_SUCCESS);
775 fail1:
776 	return (err);
777 }
778 
779 void
780 rt2860_reset_tx_ring(struct rt2860_softc *sc, struct rt2860_tx_ring *ring)
781 {
782 	struct rt2860_tx_data *data;
783 	int i;
784 
785 	for (i = 0; i < RT2860_TX_RING_COUNT; i++) {
786 		ring->txd[i].sdl0 &= ~LE_16(RT2860_TX_DDONE);
787 
788 		if ((data = ring->data[i]) == NULL)
789 			continue;	/* nothing mapped in this slot */
790 
791 		/* by pass if it's quiesced */
792 		if (!(sc->sc_flags & RT2860_F_QUIESCE))
793 			RT2860_DMA_SYNC(data->txbuf_dma, DDI_DMA_SYNC_FORDEV);
794 
795 		if (data->ni != NULL) {
796 			ieee80211_free_node(data->ni);
797 			data->ni = NULL;	/* node already freed */
798 		}
799 
800 		SLIST_INSERT_HEAD(&sc->data_pool, data, next);
801 		ring->data[i] = NULL;
802 	}
803 
804 	/* by pass if it's quiesced */
805 	if (!(sc->sc_flags & RT2860_F_QUIESCE))
806 		RT2860_DMA_SYNC(ring->txdesc_dma, DDI_DMA_SYNC_FORDEV);
807 
808 	ring->queued = 0;
809 	ring->cur = ring->next = 0;
810 }
811 
812 /*ARGSUSED*/
813 static void
814 rt2860_free_tx_ring(struct rt2860_softc *sc, struct rt2860_tx_ring *ring)
815 {
816 	if (ring->txd != NULL) {
817 		rt2860_free_dma_mem(&ring->txdesc_dma);
818 	}
819 }
820 
821 static int
822 rt2860_alloc_rx_ring(struct rt2860_softc *sc, struct rt2860_rx_ring *ring)
823 {
824 	struct rt2860_rx_data	*data;
825 	struct rt2860_rxd	*rxd;
826 	int			i, err, size, datalen;
827 
828 	size = RT2860_RX_RING_COUNT * sizeof (struct rt2860_rxd);
829 
830 	err = rt2860_alloc_dma_mem(sc->sc_dev, &rt2860_dma_attr, size,
831 	    &rt2860_desc_accattr, DDI_DMA_CONSISTENT,
832 	    DDI_DMA_RDWR | DDI_DMA_CONSISTENT,
833 	    &ring->rxdesc_dma);
834 	if (err != DDI_SUCCESS) {
835 		RWN_DEBUG(RT2860_DBG_DMA, "rwn: rt2860_alloc_rx_ring(): "
836 		    "failed to alloc dma mem\n");
837 		goto fail1;
838 	}
839 
840 	ring->rxd = (struct rt2860_rxd *)ring->rxdesc_dma.mem_va;
841 	ring->paddr = ring->rxdesc_dma.cookie.dmac_address;
842 	bzero(ring->rxd, size);
843 
844 	/*
845 	 * Pre-allocate Rx buffers and populate Rx ring.
846 	 */
847 	datalen = RT2860_RX_RING_COUNT * sizeof (struct rt2860_rx_data);
848 	bzero(ring->data, datalen);
849 	for (i = 0; i < RT2860_RX_RING_COUNT; i++) {
850 		rxd = &ring->rxd[i];
851 		data = &ring->data[i];
852 		/* alloc DMA memory */
853 		(void) rt2860_alloc_dma_mem(sc->sc_dev, &rt2860_dma_attr,
854 		    sc->sc_dmabuf_size,
855 		    &rt2860_buf_accattr,
856 		    DDI_DMA_STREAMING,
857 		    DDI_DMA_READ | DDI_DMA_STREAMING,
858 		    &data->rxbuf_dma);
859 		rxd->sdp0 = LE_32(data->rxbuf_dma.cookie.dmac_address);
860 		rxd->sdl0 = LE_16(sc->sc_dmabuf_size);
861 	}
862 
863 	ring->cur = 0;
864 
865 	RT2860_DMA_SYNC(ring->rxdesc_dma, DDI_DMA_SYNC_FORDEV);
866 	return (DDI_SUCCESS);
867 fail2:
868 	rt2860_free_dma_mem(&ring->rxdesc_dma);
869 fail1:
870 	return (err);
871 }
872 
873 /*ARGSUSED*/
874 void
875 rt2860_reset_rx_ring(struct rt2860_softc *sc, struct rt2860_rx_ring *ring)
876 {
877 	int i;
878 
879 	for (i = 0; i < RT2860_RX_RING_COUNT; i++)
880 		ring->rxd[i].sdl0 &= ~LE_16(RT2860_RX_DDONE);
881 
882 	RT2860_DMA_SYNC(ring->rxdesc_dma, DDI_DMA_SYNC_FORDEV);
883 
884 	ring->cur = 0;
885 }
886 
887 /*ARGSUSED*/
888 static void
889 rt2860_free_rx_ring(struct rt2860_softc *sc, struct rt2860_rx_ring *ring)
890 {
891 	struct rt2860_rx_data	*data;
892 	int			i, count;
893 
894 	if (ring->rxd != NULL)
895 		rt2860_free_dma_mem(&ring->rxdesc_dma);
896 
897 	count = RT2860_RX_RING_COUNT;
898 	if (ring->data != NULL) {
899 		for (i = 0; i < count; i++) {
900 			data = &ring->data[i];
901 			rt2860_free_dma_mem(&data->rxbuf_dma);
902 		}
903 	}
904 }
905 
906 static int
907 rt2860_alloc_tx_pool(struct rt2860_softc *sc)
908 {
909 	struct rt2860_tx_data	*data;
910 	int			i, err, size;
911 
912 	size = RT2860_TX_POOL_COUNT * sizeof (struct rt2860_txwi);
913 
914 	/* init data_pool early in case of failure.. */
915 	SLIST_INIT(&sc->data_pool);
916 
917 	err = rt2860_alloc_dma_mem(sc->sc_dev, &rt2860_dma_attr, size,
918 	    &rt2860_desc_accattr, DDI_DMA_CONSISTENT,
919 	    DDI_DMA_RDWR | DDI_DMA_CONSISTENT,
920 	    &sc->txpool_dma);
921 	if (err != DDI_SUCCESS) {
922 		RWN_DEBUG(RT2860_DBG_DMA, "rwn: rt2860_alloc_tx_pool(): "
923 		    "failed to alloc dma mem\n");
924 		goto fail1;
925 	}
926 
927 	sc->txwi = (struct rt2860_txwi *)sc->txpool_dma.mem_va;
928 	(void) bzero(sc->txwi, size);
929 	RT2860_DMA_SYNC(sc->txpool_dma, DDI_DMA_SYNC_FORDEV);
930 
931 	for (i = 0; i < RT2860_TX_POOL_COUNT; i++) {
932 		data = &sc->data[i];
933 
934 		err = rt2860_alloc_dma_mem(sc->sc_dev, &rt2860_dma_attr,
935 		    sc->sc_dmabuf_size,
936 		    &rt2860_buf_accattr, DDI_DMA_CONSISTENT,
937 		    DDI_DMA_RDWR | DDI_DMA_CONSISTENT,
938 		    &data->txbuf_dma);
939 		if (err != DDI_SUCCESS) {
940 			RWN_DEBUG(RT2860_DBG_DMA,
941 			    "rwn: rt2860_alloc_tx_pool(): "
942 			    "failed to alloc dma mem\n");
943 			goto fail2;
944 		}
945 		data->txwi = &sc->txwi[i];
946 		data->paddr = sc->txpool_dma.cookie.dmac_address +
947 		    i * sizeof (struct rt2860_txwi);
948 
949 		SLIST_INSERT_HEAD(&sc->data_pool, data, next);
950 	}
951 	return (DDI_SUCCESS);
952 fail2:
953 	rt2860_free_dma_mem(&sc->txpool_dma);
954 fail1:
955 	return (err);
956 }
957 
958 static void
959 rt2860_free_tx_pool(struct rt2860_softc *sc)
960 {
961 	struct rt2860_tx_data	*data;
962 	int	i;
963 
964 	if (sc->txwi != NULL) {
965 		rt2860_free_dma_mem(&sc->txpool_dma);
966 	}
967 
968 	for (i = 0; i < RT2860_TX_POOL_COUNT; i++) {
969 		data = &sc->data[i];
970 		rt2860_free_dma_mem(&data->txbuf_dma);
971 	}
972 }
973 
974 /* quickly determine if a given rate is CCK or OFDM */
975 #define	RT2860_RATE_IS_OFDM(rate) ((rate) >= 12 && (rate) != 22)
976 
977 #define	RT2860_ACK_SIZE		14	/* 10 + 4(FCS) */
978 #define	RT2860_SIFS_TIME	10
979 
980 static uint8_t
981 rt2860_rate2mcs(uint8_t rate)
982 {
983 	switch (rate) {
984 	/* CCK rates */
985 	case 2:
986 		return (0);
987 	case 4:
988 		return (1);
989 	case 11:
990 		return (2);
991 	case 22:
992 		return (3);
993 	/* OFDM rates */
994 	case 12:
995 		return (0);
996 	case 18:
997 		return (1);
998 	case 24:
999 		return (2);
1000 	case 36:
1001 		return (3);
1002 	case 48:
1003 		return (4);
1004 	case 72:
1005 		return (5);
1006 	case 96:
1007 		return (6);
1008 	case 108:
1009 		return (7);
1010 	}
1011 
1012 	return (0);	/* shouldn't get there */
1013 }
1014 
1015 /*
1016  * Return the expected ack rate for a frame transmitted at rate `rate'.
1017  */
1018 static int
1019 rt2860_ack_rate(struct ieee80211com *ic, int rate)
1020 {
1021 	switch (rate) {
1022 	/* CCK rates */
1023 	case 2:
1024 		return (2);
1025 	case 4:
1026 	case 11:
1027 	case 22:
1028 		return ((ic->ic_curmode == IEEE80211_MODE_11B) ? 4 : rate);
1029 
1030 	/* OFDM rates */
1031 	case 12:
1032 	case 18:
1033 		return (12);
1034 	case 24:
1035 	case 36:
1036 		return (24);
1037 	case 48:
1038 	case 72:
1039 	case 96:
1040 	case 108:
1041 		return (48);
1042 	}
1043 
1044 	/* default to 1Mbps */
1045 	return (2);
1046 }
1047 
1048 
1049 /*
1050  * Compute the duration (in us) needed to transmit `len' bytes at rate `rate'.
1051  * The function automatically determines the operating mode depending on the
1052  * given rate. `flags' indicates whether short preamble is in use or not.
1053  */
1054 static uint16_t
1055 rt2860_txtime(int len, int rate, uint32_t flags)
1056 {
1057 	uint16_t	txtime;
1058 
1059 	if (RT2860_RATE_IS_OFDM(rate)) {
1060 		/* IEEE Std 802.11g-2003, pp. 44 */
1061 		txtime = (8 + 4 * len + 3 + rate - 1) / rate;
1062 		txtime = 16 + 4 + 4 * txtime + 6;
1063 	} else {
1064 		/* IEEE Std 802.11b-1999, pp. 28 */
1065 		txtime = (16 * len + rate - 1) / rate;
1066 		if (rate != 2 && (flags & IEEE80211_F_SHPREAMBLE))
1067 			txtime +=  72 + 24;
1068 		else
1069 			txtime += 144 + 48;
1070 	}
1071 	return (txtime);
1072 }
1073 
1074 static int
1075 rt2860_send(ieee80211com_t *ic, mblk_t *mp, uint8_t type)
1076 {
1077 	struct rt2860_softc	*sc = (struct rt2860_softc *)ic;
1078 	struct rt2860_tx_ring	*ring;
1079 	struct rt2860_tx_data	*data;
1080 	struct rt2860_txd	*txd;
1081 	struct rt2860_txwi	*txwi;
1082 	struct ieee80211_frame	*wh;
1083 	struct ieee80211_node	*ni;
1084 	int			qid, off, rate, err;
1085 	int			mblen, pktlen;
1086 	uint_t			hdrlen;
1087 	uint8_t			mcs, pid, qsel;
1088 	uint16_t		dur;
1089 	mblk_t			*m, *m0;
1090 
1091 	err = DDI_SUCCESS;
1092 
1093 	mutex_enter(&sc->sc_txlock);
1094 	if (RT2860_IS_SUSPEND(sc)) {
1095 		err = ENXIO;
1096 		goto fail1;
1097 	}
1098 
1099 	if ((type & IEEE80211_FC0_TYPE_MASK) !=
1100 	    IEEE80211_FC0_TYPE_DATA)
1101 		qid = sc->mgtqid;
1102 	else
1103 		qid = EDCA_AC_BE;
1104 	ring = &sc->txq[qid];
1105 
1106 	if (SLIST_EMPTY(&sc->data_pool) || (ring->queued > 15)) {
1107 		sc->sc_need_sched = 1;
1108 		sc->sc_tx_nobuf++;
1109 		err = ENOMEM;
1110 		goto fail1;
1111 	}
1112 
1113 	/* the data pool contains at least one element, pick the first */
1114 	data = SLIST_FIRST(&sc->data_pool);
1115 
1116 	m = allocb(msgdsize(mp) + 32, BPRI_MED);
1117 	if (m == NULL) {
1118 		RWN_DEBUG(RT2860_DBG_TX, "rwn: rt2860_send():"
1119 		    "rt2560_mgmt_send: can't alloc mblk.\n");
1120 		err = DDI_FAILURE;
1121 		goto fail1;
1122 	}
1123 
1124 	for (off = 0, m0 = mp; m0 != NULL; m0 = m0->b_cont) {
1125 		mblen = MBLKL(m0);
1126 		(void) bcopy(m0->b_rptr, m->b_rptr + off, mblen);
1127 		off += mblen;
1128 	}
1129 	m->b_wptr += off;
1130 
1131 	wh = (struct ieee80211_frame *)m->b_rptr;
1132 	ni = ieee80211_find_txnode(ic, wh->i_addr1);
1133 	if (ni == NULL) {
1134 		err = DDI_FAILURE;
1135 		sc->sc_tx_err++;
1136 		goto fail2;
1137 	}
1138 
1139 	if ((type & IEEE80211_FC0_TYPE_MASK) ==
1140 	    IEEE80211_FC0_TYPE_DATA)
1141 		(void) ieee80211_encap(ic, m, ni);
1142 
1143 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1144 		struct ieee80211_key *k;
1145 		k = ieee80211_crypto_encap(ic, m);
1146 		if (k == NULL) {
1147 			sc->sc_tx_err++;
1148 			err = DDI_FAILURE;
1149 			goto fail3;
1150 		}
1151 		/* packet header may have moved, reset our local pointer */
1152 		wh = (struct ieee80211_frame *)m->b_rptr;
1153 	}
1154 	pktlen = msgdsize(m);
1155 	hdrlen = sizeof (*wh);
1156 
1157 	/* pickup a rate */
1158 	if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
1159 	    ((type & IEEE80211_FC0_TYPE_MASK) !=
1160 	    IEEE80211_FC0_TYPE_DATA))
1161 		rate = ni->in_rates.ir_rates[0];
1162 	else {
1163 		if (ic->ic_fixed_rate != IEEE80211_FIXED_RATE_NONE)
1164 			rate = ic->ic_fixed_rate;
1165 		else
1166 			rate = ni->in_rates.ir_rates[ni->in_txrate];
1167 	}
1168 	rate &= IEEE80211_RATE_VAL;
1169 
1170 	/* get MCS code from rate */
1171 	mcs = rt2860_rate2mcs(rate);
1172 
1173 	/* setup TX Wireless Information */
1174 	txwi = data->txwi;
1175 	(void) bzero(txwi, sizeof (struct rt2860_txwi));
1176 	txwi->wcid = (type == IEEE80211_FC0_TYPE_DATA) ?
1177 	    RT2860_AID2WCID(ni->in_associd) : 0xff;
1178 	txwi->len = LE_16(pktlen);
1179 	if (!RT2860_RATE_IS_OFDM(rate)) {
1180 		txwi->phy = LE_16(RT2860_PHY_CCK);
1181 		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1182 			mcs |= RT2860_PHY_SHPRE;
1183 	} else
1184 		txwi->phy = LE_16(RT2860_PHY_OFDM);
1185 	txwi->phy |= LE_16(mcs);
1186 
1187 	/*
1188 	 * We store the MCS code into the driver-private PacketID field.
1189 	 * The PacketID is latched into TX_STAT_FIFO when Tx completes so
1190 	 * that we know at which initial rate the frame was transmitted.
1191 	 * We add 1 to the MCS code because setting the PacketID field to
1192 	 * 0 means that we don't want feedback in TX_STAT_FIFO.
1193 	 */
1194 	pid = (mcs + 1) & 0xf;
1195 	txwi->len |= LE_16(pid << RT2860_TX_PID_SHIFT);
1196 
1197 	/* check if RTS/CTS or CTS-to-self protection is required */
1198 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1199 	    (pktlen + IEEE80211_CRC_LEN > ic->ic_rtsthreshold ||
1200 	    ((ic->ic_flags &
1201 	    IEEE80211_F_USEPROT) && RT2860_RATE_IS_OFDM(rate))))
1202 		txwi->txop = RT2860_TX_TXOP_HT;
1203 	else
1204 		txwi->txop = RT2860_TX_TXOP_BACKOFF;
1205 
1206 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1207 		txwi->xflags |= RT2860_TX_ACK;
1208 
1209 		dur = rt2860_txtime(RT2860_ACK_SIZE, rt2860_ack_rate(ic, rate),
1210 		    ic->ic_flags) + sc->sifs;
1211 		*(uint16_t *)wh->i_dur = LE_16(dur);
1212 	}
1213 
1214 	/* copy and trim 802.11 header */
1215 	bcopy(wh, &txwi->wh, hdrlen);
1216 	m->b_rptr += hdrlen;
1217 	bcopy(m->b_rptr, data->txbuf_dma.mem_va, pktlen - hdrlen);
1218 
1219 	qsel = (qid < EDCA_NUM_AC) ? RT2860_TX_QSEL_EDCA : RT2860_TX_QSEL_MGMT;
1220 
1221 	/* first segment is TXWI + 802.11 header */
1222 	txd = &ring->txd[ring->cur];
1223 	txd->sdp0 = LE_32(data->paddr);
1224 	txd->sdl0 = LE_16(16 + hdrlen);
1225 	txd->flags = qsel;
1226 
1227 	/* finalize last segment */
1228 	txd->sdp1 = LE_32(data->txbuf_dma.cookie.dmac_address);
1229 	txd->sdl1 = LE_16(pktlen - hdrlen | RT2860_TX_LS1);
1230 
1231 	/* remove from the free pool and link it into the SW Tx slot */
1232 	SLIST_REMOVE_HEAD(&sc->data_pool, next);
1233 	data->ni = ieee80211_ref_node(ni);
1234 	ring->data[ring->cur] = data;
1235 
1236 	(void) ddi_dma_sync(sc->txpool_dma.dma_hdl,
1237 	    _PTRDIFF(txwi, sc->txwi),
1238 	    (hdrlen + 16 + 2),
1239 	    DDI_DMA_SYNC_FORDEV);
1240 	RT2860_DMA_SYNC(data->txbuf_dma, DDI_DMA_SYNC_FORDEV);
1241 	RT2860_DMA_SYNC(ring->txdesc_dma, DDI_DMA_SYNC_FORDEV);
1242 
1243 	RWN_DEBUG(RT2860_DBG_TX, "rwn: rt2860_send():"
1244 	    "sending frame qid=%d wcid=%d rate=%d cur = %x\n",
1245 	    qid, txwi->wcid, rate, ring->cur);
1246 
1247 	ring->queued++;
1248 	ring->cur = (ring->cur + 1) % RT2860_TX_RING_COUNT;
1249 
1250 	/* kick Tx */
1251 	RT2860_WRITE(sc, RT2860_TX_CTX_IDX(qid), ring->cur);
1252 
1253 	sc->sc_tx_timer = 5;
1254 
1255 	ic->ic_stats.is_tx_frags++;
1256 	ic->ic_stats.is_tx_bytes += pktlen;
1257 
1258 fail3:
1259 	ieee80211_free_node(ni);
1260 fail2:
1261 	freemsg(m);
1262 fail1:
1263 	if ((type & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_DATA ||
1264 	    err == DDI_SUCCESS)
1265 		freemsg(mp);
1266 	mutex_exit(&sc->sc_txlock);
1267 	return (err);
1268 }
1269 
1270 /*
1271  * This function is called periodically (every 200ms) during scanning to
1272  * switch from one channel to another.
1273  */
1274 static void
1275 rt2860_next_scan(void *arg)
1276 {
1277 	struct rt2860_softc *sc = (struct rt2860_softc *)arg;
1278 	struct ieee80211com *ic = &sc->sc_ic;
1279 
1280 	if (ic->ic_state == IEEE80211_S_SCAN)
1281 		(void) ieee80211_next_scan(ic);
1282 }
1283 
1284 static void
1285 rt2860_updateslot(struct rt2860_softc *sc)
1286 {
1287 	struct ieee80211com *ic = &sc->sc_ic;
1288 	uint32_t tmp;
1289 
1290 	tmp = RT2860_READ(sc, RT2860_BKOFF_SLOT_CFG);
1291 	tmp &= ~0xff;
1292 	tmp |= (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
1293 	RT2860_WRITE(sc, RT2860_BKOFF_SLOT_CFG, tmp);
1294 }
1295 
1296 static void
1297 rt2860_iter_func(void *arg, struct ieee80211_node *ni)
1298 {
1299 	struct rt2860_softc *sc = (struct rt2860_softc *)arg;
1300 	uint8_t wcid;
1301 
1302 	wcid = RT2860_AID2WCID(ni->in_associd);
1303 	rt2860_amrr_choose(&sc->amrr, ni, &sc->amn[wcid]);
1304 }
1305 
1306 static void
1307 rt2860_updatestats(void *arg)
1308 {
1309 	struct rt2860_softc *sc = (struct rt2860_softc *)arg;
1310 	struct ieee80211com *ic = &sc->sc_ic;
1311 
1312 	if (ic->ic_opmode == IEEE80211_M_STA)
1313 		rt2860_iter_func(sc, ic->ic_bss);
1314 	else
1315 		ieee80211_iterate_nodes(&ic->ic_sta, rt2860_iter_func, arg);
1316 
1317 	sc->sc_rssadapt_id = timeout(rt2860_updatestats, (void *)sc,
1318 	    drv_usectohz(500 * 1000));
1319 }
1320 
1321 static void
1322 rt2860_enable_mrr(struct rt2860_softc *sc)
1323 {
1324 #define	CCK(mcs)	(mcs)
1325 #define	OFDM(mcs)	((uint32_t)1 << 3 | (mcs))
1326 	RT2860_WRITE(sc, RT2860_LG_FBK_CFG0,
1327 	    OFDM(6) << 28 |	/* 54->48 */
1328 	    OFDM(5) << 24 |	/* 48->36 */
1329 	    OFDM(4) << 20 |	/* 36->24 */
1330 	    OFDM(3) << 16 |	/* 24->18 */
1331 	    OFDM(2) << 12 |	/* 18->12 */
1332 	    OFDM(1) <<  8 |	/* 12-> 9 */
1333 	    OFDM(0) <<  4 |	/*  9-> 6 */
1334 	    OFDM(0));		/*  6-> 6 */
1335 
1336 	RT2860_WRITE(sc, RT2860_LG_FBK_CFG1,
1337 	    CCK(2) << 12 |	/* 11->5.5 */
1338 	    CCK(1) <<  8 |	/* 5.5-> 2 */
1339 	    CCK(0) <<  4 |	/*   2-> 1 */
1340 	    CCK(0));		/*   1-> 1 */
1341 #undef OFDM
1342 #undef CCK
1343 }
1344 
1345 static void
1346 rt2860_set_txpreamble(struct rt2860_softc *sc)
1347 {
1348 	uint32_t tmp;
1349 
1350 	tmp = RT2860_READ(sc, RT2860_AUTO_RSP_CFG);
1351 	tmp &= ~RT2860_CCK_SHORT_EN;
1352 	if (sc->sc_ic.ic_flags & IEEE80211_F_SHPREAMBLE)
1353 		tmp |= RT2860_CCK_SHORT_EN;
1354 	RT2860_WRITE(sc, RT2860_AUTO_RSP_CFG, tmp);
1355 }
1356 
1357 static void
1358 rt2860_set_bssid(struct rt2860_softc *sc, const uint8_t *bssid)
1359 {
1360 	RT2860_WRITE(sc, RT2860_MAC_BSSID_DW0,
1361 	    bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24);
1362 	RT2860_WRITE(sc, RT2860_MAC_BSSID_DW1,
1363 	    bssid[4] | bssid[5] << 8);
1364 }
1365 
1366 static void
1367 rt2860_set_basicrates(struct rt2860_softc *sc)
1368 {
1369 	struct ieee80211com *ic = &sc->sc_ic;
1370 
1371 	/* set basic rates mask */
1372 	if (ic->ic_curmode == IEEE80211_MODE_11B)
1373 		RT2860_WRITE(sc, RT2860_LEGACY_BASIC_RATE, 0x003);
1374 	else if (ic->ic_curmode == IEEE80211_MODE_11A)
1375 		RT2860_WRITE(sc, RT2860_LEGACY_BASIC_RATE, 0x150);
1376 	else	/* 11g */
1377 		RT2860_WRITE(sc, RT2860_LEGACY_BASIC_RATE, 0x15f);
1378 }
1379 
1380 static void
1381 rt2860_amrr_node_init(const struct rt2860_amrr *amrr,
1382     struct rt2860_amrr_node *amn)
1383 {
1384 	amn->amn_success = 0;
1385 	amn->amn_recovery = 0;
1386 	amn->amn_txcnt = amn->amn_retrycnt = 0;
1387 	amn->amn_success_threshold = amrr->amrr_min_success_threshold;
1388 }
1389 
1390 static void
1391 rt2860_amrr_choose(struct rt2860_amrr *amrr, struct ieee80211_node *ni,
1392     struct rt2860_amrr_node *amn)
1393 {
1394 #define	RV(rate)	((rate) & IEEE80211_RATE_VAL)
1395 #define	is_success(amn)	\
1396 	((amn)->amn_retrycnt < (amn)->amn_txcnt / 10)
1397 #define	is_failure(amn)	\
1398 	((amn)->amn_retrycnt > (amn)->amn_txcnt / 3)
1399 #define	is_enough(amn)		\
1400 	((amn)->amn_txcnt > 10)
1401 #define	is_min_rate(ni)		\
1402 	((ni)->in_txrate == 0)
1403 #define	is_max_rate(ni)		\
1404 	((ni)->in_txrate == (ni)->in_rates.ir_nrates - 1)
1405 #define	increase_rate(ni)	\
1406 	((ni)->in_txrate++)
1407 #define	decrease_rate(ni)	\
1408 	((ni)->in_txrate--)
1409 #define	reset_cnt(amn)		\
1410 	{ (amn)->amn_txcnt = (amn)->amn_retrycnt = 0; }
1411 
1412 	int need_change = 0;
1413 
1414 	if (is_success(amn) && is_enough(amn)) {
1415 		amn->amn_success++;
1416 		if (amn->amn_success >= amn->amn_success_threshold &&
1417 		    !is_max_rate(ni)) {
1418 			amn->amn_recovery = 1;
1419 			amn->amn_success = 0;
1420 			increase_rate(ni);
1421 			RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_amrr_choose(): "
1422 			    "increase rate = %d, #tx = %d, #retries = %d\n",
1423 			    RV(ni->in_rates.ir_rates[ni->in_txrate]),
1424 			    amn->amn_txcnt, amn->amn_retrycnt);
1425 			need_change = 1;
1426 		} else {
1427 			amn->amn_recovery = 0;
1428 		}
1429 	} else if (is_failure(amn)) {
1430 		amn->amn_success = 0;
1431 		if (!is_min_rate(ni)) {
1432 			if (amn->amn_recovery) {
1433 				amn->amn_success_threshold *= 2;
1434 				if (amn->amn_success_threshold >
1435 				    amrr->amrr_max_success_threshold)
1436 					amn->amn_success_threshold =
1437 					    amrr->amrr_max_success_threshold;
1438 			} else {
1439 				amn->amn_success_threshold =
1440 				    amrr->amrr_min_success_threshold;
1441 			}
1442 			decrease_rate(ni);
1443 			RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_amrr_choose(): "
1444 			    "decrease rate = %d, #tx = %d, #retries = %d\n",
1445 			    RV(ni->in_rates.ir_rates[ni->in_txrate]),
1446 			    amn->amn_txcnt, amn->amn_retrycnt);
1447 			need_change = 1;
1448 		}
1449 		amn->amn_recovery = 0;
1450 	}
1451 
1452 	if (is_enough(amn) || need_change)
1453 		reset_cnt(amn);
1454 #undef RV
1455 }
1456 
1457 static void
1458 rt2860_newassoc(struct ieee80211com *ic, struct ieee80211_node *in, int isnew)
1459 {
1460 	struct rt2860_softc *sc = (struct rt2860_softc *)ic;
1461 	uint32_t off;
1462 	uint8_t *fptr, wcid = 0;
1463 	int i;
1464 
1465 	if (isnew && in->in_associd != 0) {
1466 		/* only interested in true associations */
1467 		wcid = RT2860_AID2WCID(in->in_associd);
1468 
1469 		/* init WCID table entry */
1470 		off = RT2860_WCID_ENTRY(wcid);
1471 		fptr = in->in_macaddr;
1472 		for (i = 0; i < IEEE80211_ADDR_LEN; i++)
1473 			rt2860_mem_write1(sc, off++, *fptr++);
1474 	}
1475 	rt2860_amrr_node_init(&sc->amrr, &sc->amn[wcid]);
1476 
1477 	/* set rate to some reasonable initial value */
1478 	i = in->in_rates.ir_nrates - 1;
1479 	for (; i > 0 && (in->in_rates.ir_rates[i] & IEEE80211_RATE_VAL) > 72; )
1480 		i--;
1481 	in->in_txrate = i;
1482 
1483 	RWN_DEBUG(RT2860_DBG_80211, "rwn: rt2860_newassoc(): "
1484 	    "new assoc isnew=%d WCID=%d, initial rate=%d\n",
1485 	    isnew, wcid,
1486 	    in->in_rates.ir_rates[i] & IEEE80211_RATE_VAL);
1487 	RWN_DEBUG(RT2860_DBG_80211, "rwn: rt2860_newassoc(): "
1488 	    "addr=%x:%x:%x:%x:%x:%x\n",
1489 	    in->in_macaddr[0], in->in_macaddr[1], in->in_macaddr[2],
1490 	    in->in_macaddr[3], in->in_macaddr[4], in->in_macaddr[5]);
1491 }
1492 
1493 void
1494 rt2860_enable_tsf_sync(struct rt2860_softc *sc)
1495 {
1496 	struct ieee80211com *ic = &sc->sc_ic;
1497 	uint32_t tmp;
1498 
1499 	tmp = RT2860_READ(sc, RT2860_BCN_TIME_CFG);
1500 
1501 	tmp &= ~0x1fffff;
1502 	tmp |= ic->ic_bss->in_intval * 16;
1503 	tmp |= RT2860_TSF_TIMER_EN | RT2860_TBTT_TIMER_EN;
1504 	if (ic->ic_opmode == IEEE80211_M_STA) {
1505 		/*
1506 		 * Local TSF is always updated with remote TSF on beacon
1507 		 * reception.
1508 		 */
1509 		tmp |= 1 << RT2860_TSF_SYNC_MODE_SHIFT;
1510 	}
1511 
1512 	RT2860_WRITE(sc, RT2860_BCN_TIME_CFG, tmp);
1513 }
1514 
1515 static int
1516 rt2860_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
1517 {
1518 	struct rt2860_softc	*sc = (struct rt2860_softc *)ic;
1519 	enum ieee80211_state	ostate;
1520 	int			err;
1521 	uint32_t		tmp;
1522 
1523 	ostate = ic->ic_state;
1524 	RWN_DEBUG(RT2860_DBG_80211, "rwn: rt2860_newstate(): "
1525 	    "%x -> %x!\n", ostate, nstate);
1526 
1527 	RT2860_GLOCK(sc);
1528 	if (sc->sc_scan_id != 0) {
1529 		(void) untimeout(sc->sc_scan_id);
1530 		sc->sc_scan_id = 0;
1531 	}
1532 	if (sc->sc_rssadapt_id != 0) {
1533 		(void) untimeout(sc->sc_rssadapt_id);
1534 		sc->sc_rssadapt_id = 0;
1535 	}
1536 	if (ostate == IEEE80211_S_RUN) {
1537 		/* turn link LED off */
1538 		rt2860_set_leds(sc, RT2860_LED_RADIO);
1539 	}
1540 
1541 	switch (nstate) {
1542 	case IEEE80211_S_INIT:
1543 		if (ostate == IEEE80211_S_RUN) {
1544 			/* abort TSF synchronization */
1545 			tmp = RT2860_READ(sc, RT2860_BCN_TIME_CFG);
1546 			RT2860_WRITE(sc, RT2860_BCN_TIME_CFG,
1547 			    tmp & ~(RT2860_BCN_TX_EN | RT2860_TSF_TIMER_EN |
1548 			    RT2860_TBTT_TIMER_EN));
1549 		}
1550 		break;
1551 
1552 	case IEEE80211_S_SCAN:
1553 		rt2860_set_chan(sc, ic->ic_curchan);
1554 		sc->sc_scan_id = timeout(rt2860_next_scan, (void *)sc,
1555 		    drv_usectohz(200000));
1556 		break;
1557 
1558 	case IEEE80211_S_AUTH:
1559 	case IEEE80211_S_ASSOC:
1560 		rt2860_set_chan(sc, ic->ic_curchan);
1561 		break;
1562 
1563 	case IEEE80211_S_RUN:
1564 		rt2860_set_chan(sc, ic->ic_curchan);
1565 
1566 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
1567 			rt2860_updateslot(sc);
1568 			rt2860_enable_mrr(sc);
1569 			rt2860_set_txpreamble(sc);
1570 			rt2860_set_basicrates(sc);
1571 			rt2860_set_bssid(sc, ic->ic_bss->in_bssid);
1572 		}
1573 		if (ic->ic_opmode == IEEE80211_M_STA) {
1574 			/* fake a join to init the tx rate */
1575 			rt2860_newassoc(ic, ic->ic_bss, 1);
1576 		}
1577 
1578 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
1579 			rt2860_enable_tsf_sync(sc);
1580 			sc->sc_rssadapt_id = timeout(rt2860_updatestats,
1581 			    (void *)sc, drv_usectohz(500 * 1000));
1582 		}
1583 
1584 		/* turn link LED on */
1585 		rt2860_set_leds(sc, RT2860_LED_RADIO |
1586 		    (IEEE80211_IS_CHAN_2GHZ(ic->ic_curchan) ?
1587 		    RT2860_LED_LINK_2GHZ : RT2860_LED_LINK_5GHZ));
1588 		break;
1589 	}
1590 
1591 	RT2860_GUNLOCK(sc);
1592 
1593 	err = sc->sc_newstate(ic, nstate, arg);
1594 
1595 	return (err);
1596 }
1597 
1598 /*
1599  * Return the Rx chain with the highest RSSI for a given frame.
1600  */
1601 static uint8_t
1602 rt2860_maxrssi_chain(struct rt2860_softc *sc, const struct rt2860_rxwi *rxwi)
1603 {
1604 	uint8_t rxchain = 0;
1605 
1606 	if (sc->nrxchains > 1)
1607 		if (rxwi->rssi[1] > rxwi->rssi[rxchain])
1608 			rxchain = 1;
1609 	if (sc->nrxchains > 2)
1610 		if (rxwi->rssi[2] > rxwi->rssi[rxchain])
1611 			rxchain = 2;
1612 
1613 	return (rxchain);
1614 }
1615 
1616 static void
1617 rt2860_drain_stats_fifo(struct rt2860_softc *sc)
1618 {
1619 	struct rt2860_amrr_node *amn;
1620 	uint32_t stat;
1621 	uint8_t wcid, mcs, pid;
1622 
1623 	/* drain Tx status FIFO (maxsize = 16) */
1624 	while ((stat = RT2860_READ(sc, RT2860_TX_STAT_FIFO)) & RT2860_TXQ_VLD) {
1625 		RWN_DEBUG(RT2860_DBG_TX, "rwn: rt2860_drain_stats_fifo(): "
1626 		    "tx stat 0x%08\n", stat);
1627 
1628 		wcid = (stat >> 8) & 0xff;
1629 
1630 		/* if no ACK was requested, no feedback is available */
1631 		if (!(stat & RT2860_TXQ_ACKREQ) || wcid == 0xff)
1632 			continue;
1633 		/* update per-STA AMRR stats */
1634 		amn = &sc->amn[wcid];
1635 		amn->amn_txcnt++;
1636 		if (stat & RT2860_TXQ_OK) {
1637 			/*
1638 			 * Check if there were retries, ie if the Tx success
1639 			 * rate is different from the requested rate.  Note
1640 			 * that it works only because we do not allow rate
1641 			 * fallback from OFDM to CCK.
1642 			 */
1643 			mcs = (stat >> RT2860_TXQ_MCS_SHIFT) & 0x7f;
1644 			pid = (stat >> RT2860_TXQ_PID_SHIFT) & 0xf;
1645 			if (mcs + 1 != pid)
1646 				amn->amn_retrycnt++;
1647 		} else
1648 			amn->amn_retrycnt++;
1649 	}
1650 }
1651 
1652 /*ARGSUSED*/
1653 static void
1654 rt2860_tx_intr(struct rt2860_softc *sc, int qid)
1655 {
1656 	struct rt2860_tx_ring	*ring = &sc->txq[qid];
1657 	struct ieee80211com	*ic = &sc->sc_ic;
1658 	uint32_t hw;
1659 
1660 	rt2860_drain_stats_fifo(sc);
1661 
1662 	mutex_enter(&sc->sc_txlock);
1663 	hw = RT2860_READ(sc, RT2860_TX_DTX_IDX(qid));
1664 	RWN_DEBUG(RT2860_DBG_TX, "rwn: rwn_tx_intr():"
1665 	    "hw = %x, ring->next = %x, queued = %d\n",
1666 	    hw, ring->next, ring->queued);
1667 	while (ring->next != hw) {
1668 		struct rt2860_txd *txd = &ring->txd[ring->next];
1669 		struct rt2860_tx_data *data = ring->data[ring->next];
1670 
1671 		if (data != NULL) {
1672 			RT2860_DMA_SYNC(data->txbuf_dma, DDI_DMA_SYNC_FORDEV);
1673 			if (data->ni != NULL) {
1674 				ieee80211_free_node(data->ni);
1675 				data->ni = NULL;
1676 			}
1677 			SLIST_INSERT_HEAD(&sc->data_pool, data, next);
1678 			ring->data[ring->next] = NULL;
1679 		}
1680 
1681 		txd->sdl0 &= ~LE_16(RT2860_TX_DDONE);
1682 
1683 		(void) ddi_dma_sync(ring->txdesc_dma.dma_hdl,
1684 		    ring->next * sizeof (struct rt2860_txd),
1685 		    sizeof (struct rt2860_txd),
1686 		    DDI_DMA_SYNC_FORDEV);
1687 
1688 		ring->queued--;
1689 		ring->next = (ring->next + 1) % RT2860_TX_RING_COUNT;
1690 
1691 		if (sc->sc_need_sched &&
1692 		    (ring->queued < RT2860_TX_RING_COUNT)) {
1693 			sc->sc_need_sched = 0;
1694 			mac_tx_update(ic->ic_mach);
1695 		}
1696 	}
1697 	sc->sc_tx_timer = 0;
1698 	mutex_exit(&sc->sc_txlock);
1699 }
1700 static void
1701 rt2860_rx_intr(struct rt2860_softc *sc)
1702 {
1703 	struct ieee80211com	*ic = &sc->sc_ic;
1704 	struct ieee80211_node	*ni;
1705 	struct ieee80211_frame	*wh;
1706 	int	pktlen;
1707 	uint8_t ant, rssi, *rxbuf;
1708 	mblk_t	*mp0;
1709 
1710 	mutex_enter(&sc->sc_rxlock);
1711 	for (;;) {
1712 		struct rt2860_rx_data *data = &sc->rxq.data[sc->rxq.cur];
1713 		struct rt2860_rxd *rxd = &sc->rxq.rxd[sc->rxq.cur];
1714 		struct rt2860_rxwi *rxwi;
1715 
1716 		(void) ddi_dma_sync(sc->rxq.rxdesc_dma.dma_hdl,
1717 		    sc->rxq.cur * sizeof (struct rt2860_rxd),
1718 		    sizeof (struct rt2860_rxd),
1719 		    DDI_DMA_SYNC_FORKERNEL);
1720 
1721 		if (!(rxd->sdl0 & LE_16(RT2860_RX_DDONE))) {
1722 			RWN_DEBUG(RT2860_DBG_RX, "rwn: rt2860_rx_intr(): "
1723 			    "rx done!\n");
1724 			break;
1725 		}
1726 
1727 		if (rxd->flags &
1728 		    LE_32(RT2860_RX_CRCERR | RT2860_RX_ICVERR)) {
1729 			RWN_DEBUG(RT2860_DBG_RX, "rwn: rt2860_rx_intr(): "
1730 			    "rx crc error & rx icv error!\n");
1731 			sc->sc_rx_err++;
1732 			goto skip;
1733 		}
1734 
1735 		if (rxd->flags & LE_32(RT2860_RX_MICERR)) {
1736 			RWN_DEBUG(RT2860_DBG_RX, "rwn: rt2860_rx_intr(): "
1737 			    "rx mic error!\n");
1738 			sc->sc_rx_err++;
1739 			goto skip;
1740 		}
1741 
1742 		(void) ddi_dma_sync(data->rxbuf_dma.dma_hdl,
1743 		    data->rxbuf_dma.offset,
1744 		    data->rxbuf_dma.alength,
1745 		    DDI_DMA_SYNC_FORCPU);
1746 
1747 		rxbuf = (uint8_t *)data->rxbuf_dma.mem_va;
1748 		rxd->sdp0 = LE_32(data->rxbuf_dma.cookie.dmac_address);
1749 		rxwi = (struct rt2860_rxwi *)rxbuf;
1750 		rxbuf = (uint8_t *)(rxwi + 1);
1751 		pktlen = LE_16(rxwi->len) & 0xfff;
1752 
1753 		mp0 = allocb(sc->sc_dmabuf_size, BPRI_MED);
1754 		if (mp0 == NULL) {
1755 			RWN_DEBUG(RT2860_DBG_RX, "rwn: rt2860_rx_intr():"
1756 			    "alloc mblk error\n");
1757 			sc->sc_rx_nobuf++;
1758 			goto skip;
1759 		}
1760 		bcopy(rxbuf, mp0->b_rptr, pktlen);
1761 		mp0->b_wptr += pktlen;
1762 
1763 		wh = (struct ieee80211_frame *)mp0->b_rptr;
1764 
1765 		/* HW may insert 2 padding bytes after 802.11 header */
1766 		if (rxd->flags & LE_32(RT2860_RX_L2PAD)) {
1767 			RWN_DEBUG(RT2860_DBG_RX, "rwn: rt2860_rx_intr():"
1768 			    "2 padding bytes after 80211 header!\n");
1769 		}
1770 
1771 		ant = rt2860_maxrssi_chain(sc, rxwi);
1772 		rssi = rxwi->rssi[ant];
1773 		/* grab a reference to the source node */
1774 		ni = ieee80211_find_rxnode(ic, wh);
1775 
1776 		ieee80211_input(ic, mp0, ni, rssi, 0);
1777 
1778 		/* node is no longer needed */
1779 		ieee80211_free_node(ni);
1780 skip:
1781 		rxd->sdl0 &= ~LE_16(RT2860_RX_DDONE);
1782 
1783 		(void) ddi_dma_sync(sc->rxq.rxdesc_dma.dma_hdl,
1784 		    sc->rxq.cur * sizeof (struct rt2860_rxd),
1785 		    sizeof (struct rt2860_rxd),
1786 		    DDI_DMA_SYNC_FORDEV);
1787 
1788 		sc->rxq.cur = (sc->rxq.cur + 1) % RT2860_RX_RING_COUNT;
1789 	}
1790 	mutex_exit(&sc->sc_rxlock);
1791 
1792 	/* tell HW what we have processed */
1793 	RT2860_WRITE(sc, RT2860_RX_CALC_IDX,
1794 	    (sc->rxq.cur - 1) % RT2860_RX_RING_COUNT);
1795 }
1796 
1797 static uint_t
1798 rt2860_softintr(caddr_t data)
1799 {
1800 	struct rt2860_softc *sc = (struct rt2860_softc *)data;
1801 
1802 	/*
1803 	 * Check if the soft interrupt is triggered by another
1804 	 * driver at the same level.
1805 	 */
1806 	RT2860_GLOCK(sc);
1807 	if (sc->sc_rx_pend) {
1808 		sc->sc_rx_pend = 0;
1809 		RT2860_GUNLOCK(sc);
1810 		rt2860_rx_intr(sc);
1811 		return (DDI_INTR_CLAIMED);
1812 	}
1813 	RT2860_GUNLOCK(sc);
1814 
1815 	return (DDI_INTR_UNCLAIMED);
1816 }
1817 
1818 static uint_t
1819 rt2860_intr(caddr_t arg)
1820 {
1821 	struct rt2860_softc	*sc = (struct rt2860_softc *)arg;
1822 	uint32_t		r;
1823 
1824 	RT2860_GLOCK(sc);
1825 
1826 	if ((!RT2860_IS_RUNNING(sc)) || RT2860_IS_SUSPEND(sc)) {
1827 		/*
1828 		 * The hardware is not ready/present, don't touch anything.
1829 		 * Note this can happen early on if the IRQ is shared.
1830 		 */
1831 		RT2860_GUNLOCK(sc);
1832 		return (DDI_INTR_UNCLAIMED);
1833 	}
1834 
1835 	r = RT2860_READ(sc, RT2860_INT_STATUS);
1836 	if (r == 0xffffffff) {
1837 		RT2860_GUNLOCK(sc);
1838 		return (DDI_INTR_UNCLAIMED);
1839 	}
1840 	if (r == 0) {
1841 		RT2860_GUNLOCK(sc);
1842 		return (DDI_INTR_UNCLAIMED);
1843 	}
1844 
1845 	/* acknowledge interrupts */
1846 	RT2860_WRITE(sc, RT2860_INT_STATUS, r);
1847 
1848 	if (r & RT2860_TX_COHERENT)
1849 		RWN_DEBUG(RT2860_DBG_INTR, "rwn: rt2860_intr()"
1850 		    "RT2860_TX_COHERENT\n");
1851 
1852 	if (r & RT2860_RX_COHERENT)
1853 		RWN_DEBUG(RT2860_DBG_INTR, "rwn: rt2860_intr()"
1854 		    "RT2860_RX_COHERENT\n");
1855 
1856 	if (r & RT2860_MAC_INT_2) {
1857 		RWN_DEBUG(RT2860_DBG_INTR, "rwn: rt2860_intr(): "
1858 		    "RT2860_MAC_INT_2\n");
1859 		rt2860_drain_stats_fifo(sc);
1860 	}
1861 
1862 	if (r & RT2860_TX_DONE_INT5) {
1863 		RWN_DEBUG(RT2860_DBG_INTR, "rwn: rt2860_intr(): "
1864 		    "RT2860_TX_DONE_INT5\n");
1865 		rt2860_tx_intr(sc, 5);
1866 	}
1867 
1868 	if (r & RT2860_RX_DONE_INT) {
1869 		RWN_DEBUG(RT2860_DBG_INTR, "rwn: rt2860_intr()"
1870 		    "RT2860_RX_INT\n");
1871 		sc->sc_rx_pend = 1;
1872 		ddi_trigger_softintr(sc->sc_softintr_hdl);
1873 	}
1874 
1875 	if (r & RT2860_TX_DONE_INT4) {
1876 		RWN_DEBUG(RT2860_DBG_INTR, "rwn: rt2860_intr(): "
1877 		    "RT2860_TX_DONE_INT4\n");
1878 		rt2860_tx_intr(sc, 4);
1879 	}
1880 
1881 	if (r & RT2860_TX_DONE_INT3) {
1882 		RWN_DEBUG(RT2860_DBG_INTR, "rwn: rt2860_intr(): "
1883 		    "RT2860_TX_DONE_INT3\n");
1884 		rt2860_tx_intr(sc, 3);
1885 	}
1886 
1887 	if (r & RT2860_TX_DONE_INT2) {
1888 		RWN_DEBUG(RT2860_DBG_INTR, "rwn: rt2860_intr(): "
1889 		    "RT2860_TX_DONE_INT2\n");
1890 		rt2860_tx_intr(sc, 2);
1891 	}
1892 
1893 	if (r & RT2860_TX_DONE_INT1) {
1894 		RWN_DEBUG(RT2860_DBG_INTR, "rwn: rt2860_intr(): "
1895 		    "RT2860_TX_DONE_INT1\n");
1896 		rt2860_tx_intr(sc, 1);
1897 	}
1898 
1899 	if (r & RT2860_TX_DONE_INT0) {
1900 		RWN_DEBUG(RT2860_DBG_INTR, "rwn: rt2860_intr(): "
1901 		    "RT2860_TX_DONE_INT0\n");
1902 		rt2860_tx_intr(sc, 0);
1903 	}
1904 
1905 	if (r & RT2860_MAC_INT_0) {
1906 		RWN_DEBUG(RT2860_DBG_INTR, "rwn: rt2860_intr(): "
1907 		    "RT2860_MAC_INT_0\n");
1908 		struct ieee80211com *ic = &sc->sc_ic;
1909 		/* check if protection mode has changed */
1910 		if ((sc->sc_ic_flags ^ ic->ic_flags) & IEEE80211_F_USEPROT) {
1911 			rt2860_updateprot(ic);
1912 			sc->sc_ic_flags = ic->ic_flags;
1913 		}
1914 	}
1915 
1916 	if (r & RT2860_MAC_INT_3)
1917 		RWN_DEBUG(RT2860_DBG_INTR, "rwn: rt2860_intr(): "
1918 		    "RT2860_MAC_INT_3\n");
1919 
1920 	RT2860_GUNLOCK(sc);
1921 
1922 	return (DDI_INTR_CLAIMED);
1923 }
1924 
1925 static void
1926 rt2860_set_region_4(struct rt2860_softc *sc,
1927     uint32_t addr, uint32_t data, int size)
1928 {
1929 	for (; size > 0; size--, data++, addr += 4)
1930 		ddi_put32((sc)->sc_io_handle,
1931 		    (uint32_t *)((uintptr_t)(sc)->sc_io_base + addr), data);
1932 }
1933 
1934 static int
1935 rt2860_load_microcode(struct rt2860_softc *sc)
1936 {
1937 	int		ntries;
1938 	size_t		size;
1939 	uint8_t		*ucode, *fptr;
1940 	uint32_t	off, i;
1941 
1942 	ucode = rt2860_fw_bin;
1943 	size = sizeof (rt2860_fw_bin);
1944 	RWN_DEBUG(RT2860_DBG_FW, "rwn: rt2860_load_microcode(): "
1945 	    "The size of ucode is: %x\n", size);
1946 
1947 	/* set "host program ram write selection" bit */
1948 	RT2860_WRITE(sc, RT2860_SYS_CTRL, RT2860_HST_PM_SEL);
1949 	/* write microcode image */
1950 	fptr = ucode;
1951 	off = RT2860_FW_BASE;
1952 	for (i = 0; i < size; i++) {
1953 		rt2860_mem_write1(sc, off++, *fptr++);
1954 	}
1955 	/* kick microcontroller unit */
1956 	RT2860_WRITE(sc, RT2860_SYS_CTRL, 0);
1957 	RT2860_WRITE(sc, RT2860_SYS_CTRL, RT2860_MCU_RESET);
1958 
1959 	RT2860_WRITE(sc, RT2860_H2M_BBPAGENT, 0);
1960 	RT2860_WRITE(sc, RT2860_H2M_MAILBOX, 0);
1961 
1962 	/* wait until microcontroller is ready */
1963 	for (ntries = 0; ntries < 1000; ntries++) {
1964 		if (RT2860_READ(sc, RT2860_SYS_CTRL) & RT2860_MCU_READY)
1965 			break;
1966 		DELAY(1000);
1967 	}
1968 	if (ntries == 1000) {
1969 		RWN_DEBUG(RT2860_DBG_FW, "rwn: rt2860_load_microcode(): "
1970 		    "timeout waiting for MCU to initialie\n");
1971 		return (ETIMEDOUT);
1972 	}
1973 
1974 	return (0);
1975 }
1976 
1977 static void
1978 rt2860_set_macaddr(struct rt2860_softc *sc, const uint8_t *addr)
1979 {
1980 	RT2860_WRITE(sc, RT2860_MAC_ADDR_DW0,
1981 	    addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24);
1982 	RT2860_WRITE(sc, RT2860_MAC_ADDR_DW1,
1983 	    addr[4] | addr[5] << 8);
1984 }
1985 
1986 /*
1987  * Send a command to the 8051 microcontroller unit.
1988  */
1989 static int
1990 rt2860_mcu_cmd(struct rt2860_softc *sc, uint8_t cmd, uint16_t arg)
1991 {
1992 	int	ntries;
1993 
1994 	for (ntries = 0; ntries < 100; ntries++) {
1995 		if (!(RT2860_READ(sc, RT2860_H2M_MAILBOX) & RT2860_H2M_BUSY))
1996 			break;
1997 		DELAY(2);
1998 	}
1999 	if (ntries == 100)
2000 		return (EIO);
2001 
2002 	RT2860_WRITE(sc, RT2860_H2M_MAILBOX,
2003 	    RT2860_H2M_BUSY | RT2860_TOKEN_NO_INTR << 16 | arg);
2004 	RT2860_WRITE(sc, RT2860_HOST_CMD, cmd);
2005 
2006 	return (RT2860_SUCCESS);
2007 }
2008 
2009 /*
2010  * Reading and writing from/to the BBP is different from RT2560 and RT2661.
2011  * We access the BBP through the 8051 microcontroller unit which means that
2012  * the microcode must be loaded first.
2013  */
2014 static uint8_t
2015 rt2860_mcu_bbp_read(struct rt2860_softc *sc, uint8_t reg)
2016 {
2017 	uint32_t val;
2018 	int ntries;
2019 
2020 	for (ntries = 0; ntries < 100; ntries++) {
2021 		if (!(RT2860_READ(sc,
2022 		    RT2860_H2M_BBPAGENT) & RT2860_BBP_CSR_KICK))
2023 			break;
2024 		DELAY(1);
2025 	}
2026 	if (ntries == 100) {
2027 		RWN_DEBUG(RT2860_DBG_FW, "rwn: rt2860_mcu_bbp_read():"
2028 		    "could not read from BBP through MCU\n");
2029 		return (0);
2030 	}
2031 
2032 	RT2860_WRITE(sc, RT2860_H2M_BBPAGENT, RT2860_BBP_RW_PARALLEL |
2033 	    RT2860_BBP_CSR_KICK | RT2860_BBP_CSR_READ | reg << 8);
2034 
2035 	(void) rt2860_mcu_cmd(sc, RT2860_MCU_CMD_BBP, 0);
2036 	DELAY(1000);
2037 
2038 	for (ntries = 0; ntries < 100; ntries++) {
2039 		val = RT2860_READ(sc, RT2860_H2M_BBPAGENT);
2040 		if (!(val & RT2860_BBP_CSR_KICK))
2041 			return (val & 0xff);
2042 		DELAY(1);
2043 	}
2044 	RWN_DEBUG(RT2860_DBG_FW, "rwn: rt2860_mcu_bbp_read():"
2045 	    "could not read from BBP through MCU\n");
2046 
2047 	return (0);
2048 }
2049 
2050 static void
2051 rt2860_mcu_bbp_write(struct rt2860_softc *sc, uint8_t reg, uint8_t val)
2052 {
2053 	int ntries;
2054 
2055 	for (ntries = 0; ntries < 100; ntries++) {
2056 		if (!(RT2860_READ(sc,
2057 		    RT2860_H2M_BBPAGENT) & RT2860_BBP_CSR_KICK))
2058 			break;
2059 		DELAY(1);
2060 	}
2061 	if (ntries == 100) {
2062 		RWN_DEBUG(RT2860_DBG_FW, "rwn: rt2860_mcu_bbp_write():"
2063 		    "could not write to BBP through MCU\n");
2064 		return;
2065 	}
2066 
2067 	RT2860_WRITE(sc, RT2860_H2M_BBPAGENT, RT2860_BBP_RW_PARALLEL |
2068 	    RT2860_BBP_CSR_KICK | reg << 8 | val);
2069 
2070 	(void) rt2860_mcu_cmd(sc, RT2860_MCU_CMD_BBP, 0);
2071 	DELAY(1000);
2072 }
2073 
2074 static int
2075 rt2860_bbp_init(struct rt2860_softc *sc)
2076 {
2077 	int i, ntries;
2078 
2079 	/* wait for BBP to wake up */
2080 	for (ntries = 0; ntries < 20; ntries++) {
2081 		uint8_t bbp0 = rt2860_mcu_bbp_read(sc, 0);
2082 		if (bbp0 != 0 && bbp0 != 0xff)
2083 			break;
2084 	}
2085 	if (ntries == 20) {
2086 		RWN_DEBUG(RT2860_DBG_FW, "rwn: rt2860_bbp_init():"
2087 		    "timeout waiting for BBP to wake up\n");
2088 		return (ETIMEDOUT);
2089 	}
2090 
2091 	/* initialize BBP registers to default values */
2092 	for (i = 0; i < 12; i++) {
2093 		rt2860_mcu_bbp_write(sc, rt2860_def_bbp[i].reg,
2094 		    rt2860_def_bbp[i].val);
2095 	}
2096 
2097 	/* fix BBP69 and BBP73 for RT2860C */
2098 	if (sc->mac_rev == 0x28600100) {
2099 		rt2860_mcu_bbp_write(sc, 69, 0x16);
2100 		rt2860_mcu_bbp_write(sc, 73, 0x12);
2101 	}
2102 
2103 	return (0);
2104 }
2105 
2106 static void
2107 rt2860_rf_write(struct rt2860_softc *sc, uint8_t reg, uint32_t val)
2108 {
2109 	uint32_t tmp;
2110 	int ntries;
2111 
2112 	for (ntries = 0; ntries < 100; ntries++) {
2113 		if (!(RT2860_READ(sc, RT2860_RF_CSR_CFG0) & RT2860_RF_REG_CTRL))
2114 			break;
2115 		DELAY(1);
2116 	}
2117 	if (ntries == 100) {
2118 		RWN_DEBUG(RT2860_DBG_FW, "rwn: rwn_init()"
2119 		    "could not write to RF\n");
2120 		return;
2121 	}
2122 
2123 	/* RF registers are 24-bit on the RT2860 */
2124 	tmp = RT2860_RF_REG_CTRL | 24 << RT2860_RF_REG_WIDTH_SHIFT |
2125 	    (val & 0x3fffff) << 2 | (reg & 3);
2126 	RT2860_WRITE(sc, RT2860_RF_CSR_CFG0, tmp);
2127 }
2128 
2129 static void
2130 rt2860_select_chan_group(struct rt2860_softc *sc, int group)
2131 {
2132 	uint32_t tmp;
2133 
2134 	rt2860_mcu_bbp_write(sc, 62, 0x37 - sc->lna[group]);
2135 	rt2860_mcu_bbp_write(sc, 63, 0x37 - sc->lna[group]);
2136 	rt2860_mcu_bbp_write(sc, 64, 0x37 - sc->lna[group]);
2137 	rt2860_mcu_bbp_write(sc, 82, (group == 0) ? 0x62 : 0xf2);
2138 
2139 	tmp = RT2860_READ(sc, RT2860_TX_BAND_CFG);
2140 	tmp &= ~(RT2860_5G_BAND_SEL_N | RT2860_5G_BAND_SEL_P);
2141 	tmp |= (group == 0) ? RT2860_5G_BAND_SEL_N : RT2860_5G_BAND_SEL_P;
2142 	RT2860_WRITE(sc, RT2860_TX_BAND_CFG, tmp);
2143 
2144 	/* enable appropriate Power Amplifiers and Low Noise Amplifiers */
2145 	tmp = RT2860_RFTR_EN | RT2860_TRSW_EN;
2146 	if (group == 0) {	/* 2GHz */
2147 		tmp |= RT2860_PA_PE_G0_EN | RT2860_LNA_PE_G0_EN;
2148 		if (sc->ntxchains > 1)
2149 			tmp |= RT2860_PA_PE_G1_EN;
2150 		if (sc->nrxchains > 1)
2151 			tmp |= RT2860_LNA_PE_G1_EN;
2152 	} else {		/* 5GHz */
2153 		tmp |= RT2860_PA_PE_A0_EN | RT2860_LNA_PE_A0_EN;
2154 		if (sc->ntxchains > 1)
2155 			tmp |= RT2860_PA_PE_A1_EN;
2156 		if (sc->nrxchains > 1)
2157 			tmp |= RT2860_LNA_PE_A1_EN;
2158 	}
2159 	RT2860_WRITE(sc, RT2860_TX_PIN_CFG, tmp);
2160 
2161 	rt2860_mcu_bbp_write(sc, 66, 0x2e + sc->lna[group]);
2162 }
2163 static void
2164 rt2860_set_chan(struct rt2860_softc *sc, struct ieee80211_channel *c)
2165 {
2166 	struct ieee80211com	*ic = &sc->sc_ic;
2167 	const struct rfprog	*rfprog = rt2860_rf2850;
2168 	uint_t			i, chan, group;
2169 	uint8_t			txpow1, txpow2;
2170 	uint32_t		r2, r3, r4;
2171 
2172 	chan = ieee80211_chan2ieee(ic, c);
2173 	if (chan == 0 || chan == IEEE80211_CHAN_ANY) {
2174 		RWN_DEBUG(RT2860_DBG_FW, "Unkonwn channel!\n");
2175 		return;
2176 	}
2177 
2178 	/* find the settings for this channel (we know it exists) */
2179 	for (i = 0; rfprog[i].chan != chan; )
2180 		i++;
2181 
2182 	r2 = rfprog[i].r2;
2183 	if (sc->ntxchains == 1)
2184 		r2 |= 1 << 12;		/* 1T: disable Tx chain 2 */
2185 	if (sc->nrxchains == 1)
2186 		r2 |= 1 << 15 | 1 << 4;	/* 1R: disable Rx chains 2 & 3 */
2187 	else if (sc->nrxchains == 2)
2188 		r2 |= 1 << 4;		/* 2R: disable Rx chain 3 */
2189 
2190 	/* use Tx power values from EEPROM */
2191 	txpow1 = sc->txpow1[i];
2192 	txpow2 = sc->txpow2[i];
2193 	if (IEEE80211_IS_CHAN_5GHZ(c)) {
2194 		txpow1 = txpow1 << 1 | 1;
2195 		txpow2 = txpow2 << 1 | 1;
2196 	}
2197 	r3 = rfprog[i].r3 | txpow1 << 7;
2198 	r4 = rfprog[i].r4 | sc->freq << 13 | txpow2 << 4;
2199 
2200 	rt2860_rf_write(sc, RAL_RF1, rfprog[i].r1);
2201 	rt2860_rf_write(sc, RAL_RF2, r2);
2202 	rt2860_rf_write(sc, RAL_RF3, r3);
2203 	rt2860_rf_write(sc, RAL_RF4, r4);
2204 
2205 	DELAY(200);
2206 
2207 	rt2860_rf_write(sc, RAL_RF1, rfprog[i].r1);
2208 	rt2860_rf_write(sc, RAL_RF2, r2);
2209 	rt2860_rf_write(sc, RAL_RF3, r3 | 1);
2210 	rt2860_rf_write(sc, RAL_RF4, r4);
2211 
2212 	DELAY(200);
2213 
2214 	rt2860_rf_write(sc, RAL_RF1, rfprog[i].r1);
2215 	rt2860_rf_write(sc, RAL_RF2, r2);
2216 	rt2860_rf_write(sc, RAL_RF3, r3);
2217 	rt2860_rf_write(sc, RAL_RF4, r4);
2218 
2219 	/* 802.11a uses a 16 microseconds short interframe space */
2220 	sc->sifs = IEEE80211_IS_CHAN_5GHZ(c) ? 16 : 10;
2221 
2222 	/* determine channel group */
2223 	if (chan <= 14)
2224 		group = 0;
2225 	else if (chan <= 64)
2226 		group = 1;
2227 	else if (chan <= 128)
2228 		group = 2;
2229 	else
2230 		group = 3;
2231 
2232 	/* XXX necessary only when group has changed! */
2233 	rt2860_select_chan_group(sc, group);
2234 
2235 	DELAY(1000);
2236 }
2237 
2238 static void
2239 rt2860_updateprot(struct ieee80211com *ic)
2240 {
2241 	struct rt2860_softc *sc = (struct rt2860_softc *)ic;
2242 	uint32_t tmp;
2243 
2244 	tmp = RT2860_RTSTH_EN | RT2860_PROT_NAV_SHORT | RT2860_TXOP_ALLOW_ALL;
2245 	/* setup protection frame rate (MCS code) */
2246 	tmp |= (ic->ic_curmode == IEEE80211_MODE_11A) ? 0 : 3;
2247 
2248 	/* CCK frames don't require protection */
2249 	RT2860_WRITE(sc, RT2860_CCK_PROT_CFG, tmp);
2250 
2251 	if (ic->ic_flags & IEEE80211_F_USEPROT) {
2252 		if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
2253 			tmp |= RT2860_PROT_CTRL_RTS_CTS;
2254 		else if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
2255 			tmp |= RT2860_PROT_CTRL_CTS;
2256 	}
2257 	RT2860_WRITE(sc, RT2860_OFDM_PROT_CFG, tmp);
2258 }
2259 
2260 static void
2261 rt2860_set_leds(struct rt2860_softc *sc, uint16_t which)
2262 {
2263 	(void) rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LEDS,
2264 	    which | (sc->leds & 0x7f));
2265 }
2266 
2267 static int
2268 rt2860_init(struct rt2860_softc *sc)
2269 {
2270 #define	N(a)	(sizeof (a) / sizeof ((a)[0]))
2271 	struct ieee80211com	*ic;
2272 	int			i, err, qid, ridx, ntries;
2273 	uint8_t			bbp1, bbp3;
2274 	uint32_t		tmp;
2275 
2276 	ic = &sc->sc_ic;
2277 
2278 	rt2860_stop(sc);
2279 	tmp = RT2860_READ(sc, RT2860_WPDMA_GLO_CFG);
2280 	tmp &= 0xff0;
2281 	RT2860_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp | RT2860_TX_WB_DDONE);
2282 
2283 	RT2860_WRITE(sc, RT2860_WPDMA_RST_IDX, 0xffffffff);
2284 
2285 	/* PBF hardware reset */
2286 	RT2860_WRITE(sc, RT2860_SYS_CTRL, 0xe1f);
2287 	RT2860_WRITE(sc, RT2860_SYS_CTRL, 0xe00);
2288 
2289 	if (!(sc->sc_flags & RT2860_FWLOADED)) {
2290 		if ((err = rt2860_load_microcode(sc)) != 0) {
2291 			RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_init(): "
2292 			    "could not load 8051 microcode\n");
2293 			rt2860_stop(sc);
2294 			return (err);
2295 		}
2296 		RT2860_GLOCK(sc);
2297 		sc->sc_flags |= RT2860_FWLOADED;
2298 		RT2860_GUNLOCK(sc);
2299 	}
2300 
2301 	rt2860_set_macaddr(sc, ic->ic_macaddr);
2302 
2303 	/* init Tx power for all Tx rates (from EEPROM) */
2304 	for (ridx = 0; ridx < 5; ridx++) {
2305 		if (sc->txpow20mhz[ridx] == 0xffffffff)
2306 			continue;
2307 		RT2860_WRITE(sc, RT2860_TX_PWR_CFG(ridx), sc->txpow20mhz[ridx]);
2308 	}
2309 
2310 	for (ntries = 0; ntries < 100; ntries++) {
2311 		tmp = RT2860_READ(sc, RT2860_WPDMA_GLO_CFG);
2312 		if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
2313 			break;
2314 		DELAY(1000);
2315 	}
2316 	if (ntries == 100) {
2317 		RWN_DEBUG(RT2860_DBG_DMA, "rwn: rt2860_init():"
2318 		    "timeout waiting for DMA engine\n");
2319 		rt2860_stop(sc);
2320 		return (ETIMEDOUT);
2321 	}
2322 	tmp &= 0xff0;
2323 	RT2860_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp | RT2860_TX_WB_DDONE);
2324 
2325 	/* reset Rx ring and all 6 Tx rings */
2326 	RT2860_WRITE(sc, RT2860_WPDMA_RST_IDX, 0x1003f);
2327 
2328 	/* PBF hardware reset */
2329 	RT2860_WRITE(sc, RT2860_SYS_CTRL, 0xe1f);
2330 	RT2860_WRITE(sc, RT2860_SYS_CTRL, 0xe00);
2331 
2332 	RT2860_WRITE(sc, RT2860_MAC_SYS_CTRL,
2333 	    RT2860_BBP_HRST | RT2860_MAC_SRST);
2334 	RT2860_WRITE(sc, RT2860_MAC_SYS_CTRL, 0);
2335 
2336 	for (i = 0; i < N(rt2860_def_mac); i++)
2337 		RT2860_WRITE(sc, rt2860_def_mac[i].reg, rt2860_def_mac[i].val);
2338 
2339 	/* wait while MAC is busy */
2340 	for (ntries = 0; ntries < 100; ntries++) {
2341 		if (!(RT2860_READ(sc, RT2860_MAC_STATUS_REG) &
2342 		    (RT2860_RX_STATUS_BUSY | RT2860_TX_STATUS_BUSY)))
2343 			break;
2344 		DELAY(1000);
2345 	}
2346 	if (ntries == 100) {
2347 		RWN_DEBUG(RT2860_DBG_FW, "rwn: rt2860_init():"
2348 		    "timeout waiting for MAC\n");
2349 		rt2860_stop(sc);
2350 		return (ETIMEDOUT);
2351 	}
2352 
2353 	/* clear Host to MCU mailbox */
2354 	RT2860_WRITE(sc, RT2860_H2M_BBPAGENT, 0);
2355 	RT2860_WRITE(sc, RT2860_H2M_MAILBOX, 0);
2356 
2357 	if ((err = rt2860_bbp_init(sc)) != 0) {
2358 		rt2860_stop(sc);
2359 		return (err);
2360 	}
2361 
2362 	/* init Tx rings (4 EDCAs + HCCA + Mgt) */
2363 	for (qid = 0; qid < 6; qid++) {
2364 		RT2860_WRITE(sc, RT2860_TX_BASE_PTR(qid), sc->txq[qid].paddr);
2365 		RT2860_WRITE(sc, RT2860_TX_MAX_CNT(qid), RT2860_TX_RING_COUNT);
2366 		RT2860_WRITE(sc, RT2860_TX_CTX_IDX(qid), 0);
2367 	}
2368 
2369 	/* init Rx ring */
2370 	RT2860_WRITE(sc, RT2860_RX_BASE_PTR, sc->rxq.paddr);
2371 	RT2860_WRITE(sc, RT2860_RX_MAX_CNT, RT2860_RX_RING_COUNT);
2372 	RT2860_WRITE(sc, RT2860_RX_CALC_IDX, RT2860_RX_RING_COUNT - 1);
2373 
2374 	/* setup maximum buffer sizes */
2375 	RT2860_WRITE(sc, RT2860_MAX_LEN_CFG, 1 << 12 |
2376 	    (sc->sc_dmabuf_size - sizeof (struct rt2860_rxwi) - 2));
2377 
2378 	for (ntries = 0; ntries < 100; ntries++) {
2379 		tmp = RT2860_READ(sc, RT2860_WPDMA_GLO_CFG);
2380 		if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
2381 			break;
2382 		DELAY(1000);
2383 	}
2384 	if (ntries == 100) {
2385 		RWN_DEBUG(RT2860_DBG_DMA, "rwn: rt2860_init():"
2386 		    "timeout waiting for DMA engine\n");
2387 		rt2860_stop(sc);
2388 		return (ETIMEDOUT);
2389 	}
2390 	tmp &= 0xff0;
2391 	RT2860_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp | RT2860_TX_WB_DDONE);
2392 
2393 	/* disable interrupts mitigation */
2394 	RT2860_WRITE(sc, RT2860_DELAY_INT_CFG, 0);
2395 
2396 	/* write vendor-specific BBP values (from EEPROM) */
2397 	for (i = 0; i < 8; i++) {
2398 		if (sc->bbp[i].reg == 0 || sc->bbp[i].reg == 0xff)
2399 			continue;
2400 		rt2860_mcu_bbp_write(sc, sc->bbp[i].reg, sc->bbp[i].val);
2401 	}
2402 
2403 	/* send LEDs operating mode to microcontroller */
2404 	(void) rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LED1, sc->led[0]);
2405 	(void) rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LED2, sc->led[1]);
2406 	(void) rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LED3, sc->led[2]);
2407 
2408 	/* disable non-existing Rx chains */
2409 	bbp3 = rt2860_mcu_bbp_read(sc, 3);
2410 	bbp3 &= ~(1 << 3 | 1 << 4);
2411 	if (sc->nrxchains == 2)
2412 		bbp3 |= 1 << 3;
2413 	else if (sc->nrxchains == 3)
2414 		bbp3 |= 1 << 4;
2415 	rt2860_mcu_bbp_write(sc, 3, bbp3);
2416 
2417 	/* disable non-existing Tx chains */
2418 	bbp1 = rt2860_mcu_bbp_read(sc, 1);
2419 	if (sc->ntxchains == 1)
2420 		bbp1 &= ~(1 << 3 | 1 << 4);
2421 	rt2860_mcu_bbp_write(sc, 1, bbp1);
2422 
2423 	/* select default channel */
2424 	rt2860_set_chan(sc, ic->ic_curchan);
2425 
2426 	/* XXX not clear what the following 8051 command does.. */
2427 	(void) rt2860_mcu_cmd(sc, RT2860_MCU_CMD_BOOT, 0);
2428 
2429 	/* set RTS threshold */
2430 	tmp = RT2860_READ(sc, RT2860_TX_RTS_CFG);
2431 	tmp &= ~0xffff00;
2432 	tmp |= ic->ic_rtsthreshold << 8;
2433 
2434 	/* setup initial protection mode */
2435 	sc->sc_ic_flags = ic->ic_flags;
2436 	rt2860_updateprot(ic);
2437 
2438 	/* enable Tx/Rx DMA engine */
2439 	RT2860_WRITE(sc, RT2860_MAC_SYS_CTRL, RT2860_MAC_TX_EN);
2440 	for (ntries = 0; ntries < 200; ntries++) {
2441 		tmp = RT2860_READ(sc, RT2860_WPDMA_GLO_CFG);
2442 		if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
2443 			break;
2444 		DELAY(1000);
2445 	}
2446 	if (ntries == 200) {
2447 		RWN_DEBUG(RT2860_DBG_DMA, "rwn: rt2860_int():"
2448 		    "timeout waiting for DMA engine\n");
2449 		rt2860_stop(sc);
2450 		return (ETIMEDOUT);
2451 	}
2452 
2453 	DELAY(50);
2454 
2455 	tmp |= RT2860_TX_WB_DDONE | RT2860_RX_DMA_EN | RT2860_TX_DMA_EN |
2456 	    RT2860_WPDMA_BT_SIZE64 << RT2860_WPDMA_BT_SIZE_SHIFT;
2457 	RT2860_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp);
2458 
2459 	/* turn radio LED on */
2460 	rt2860_set_leds(sc, RT2860_LED_RADIO);
2461 
2462 	/* set Rx filter */
2463 	tmp = RT2860_DROP_CRC_ERR | RT2860_DROP_PHY_ERR;
2464 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2465 		tmp |= RT2860_DROP_UC_NOME | RT2860_DROP_DUPL |
2466 		    RT2860_DROP_CTS | RT2860_DROP_BA | RT2860_DROP_ACK |
2467 		    RT2860_DROP_VER_ERR | RT2860_DROP_CTRL_RSV |
2468 		    RT2860_DROP_CFACK | RT2860_DROP_CFEND;
2469 		if (ic->ic_opmode == IEEE80211_M_STA)
2470 			tmp |= RT2860_DROP_RTS | RT2860_DROP_PSPOLL;
2471 	}
2472 	RT2860_WRITE(sc, RT2860_RX_FILTR_CFG, tmp);
2473 
2474 	RT2860_WRITE(sc, RT2860_MAC_SYS_CTRL,
2475 	    RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
2476 
2477 	/* clear pending interrupts */
2478 	RT2860_WRITE(sc, RT2860_INT_STATUS, 0xffffffff);
2479 	/* enable interrupts */
2480 	RT2860_WRITE(sc, RT2860_INT_MASK, 0x3fffc);
2481 
2482 	if (sc->sc_flags & RT2860_ADVANCED_PS)
2483 		(void) rt2860_mcu_cmd(sc, RT2860_MCU_CMD_PSLEVEL, sc->pslevel);
2484 
2485 	return (DDI_SUCCESS);
2486 }
2487 
2488 static int
2489 rt2860_quiesce(dev_info_t *dip)
2490 {
2491 	struct rt2860_softc	*sc;
2492 
2493 	sc = ddi_get_soft_state(rt2860_soft_state_p, ddi_get_instance(dip));
2494 	if (sc == NULL)
2495 		return (DDI_FAILURE);
2496 
2497 #ifdef DEBUG
2498 	rt2860_dbg_flags = 0;
2499 #endif
2500 
2501 	/*
2502 	 * No more blocking is allowed while we are in quiesce(9E) entry point
2503 	 */
2504 	sc->sc_flags |= RT2860_F_QUIESCE;
2505 
2506 	/*
2507 	 * Disable and mask all interrupts
2508 	 */
2509 	rt2860_stop(sc);
2510 	return (DDI_SUCCESS);
2511 }
2512 
2513 static void
2514 rt2860_stop(struct rt2860_softc *sc)
2515 {
2516 	int		qid;
2517 	uint32_t	tmp;
2518 
2519 	/* by pass if it's quiesced */
2520 	if (!(sc->sc_flags & RT2860_F_QUIESCE))
2521 		RT2860_GLOCK(sc);
2522 	if (sc->sc_flags == RT2860_F_RUNNING)
2523 		rt2860_set_leds(sc, 0);	/* turn all LEDs off */
2524 	sc->sc_tx_timer = 0;
2525 	/* by pass if it's quiesced */
2526 	if (!(sc->sc_flags & RT2860_F_QUIESCE))
2527 		RT2860_GUNLOCK(sc);
2528 
2529 	/* clear RX WCID search table */
2530 	rt2860_set_region_4(sc, RT2860_WCID_ENTRY(0), 0, 512);
2531 	/* clear pairwise key table */
2532 	rt2860_set_region_4(sc, RT2860_PKEY(0), 0, 2048);
2533 	/* clear IV/EIV table */
2534 	rt2860_set_region_4(sc, RT2860_IVEIV(0), 0, 512);
2535 	/* clear WCID attribute table */
2536 	rt2860_set_region_4(sc, RT2860_WCID_ATTR(0), 0, 256);
2537 	/* clear shared key table */
2538 	rt2860_set_region_4(sc, RT2860_SKEY(0, 0), 0, 8 * 32);
2539 	/* clear shared key mode */
2540 	rt2860_set_region_4(sc, RT2860_SKEY_MODE_0_7, 0, 4);
2541 
2542 	/* disable interrupts */
2543 	RT2860_WRITE(sc, RT2860_INT_MASK, 0);
2544 
2545 	/* disable Rx */
2546 	tmp = RT2860_READ(sc, RT2860_MAC_SYS_CTRL);
2547 	tmp &= ~(RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
2548 	RT2860_WRITE(sc, RT2860_MAC_SYS_CTRL, tmp);
2549 
2550 	/* reset adapter */
2551 	RT2860_WRITE(sc, RT2860_MAC_SYS_CTRL,
2552 	    RT2860_BBP_HRST | RT2860_MAC_SRST);
2553 	RT2860_WRITE(sc, RT2860_MAC_SYS_CTRL, 0);
2554 
2555 	/* reset Tx and Rx rings (and reclaim TXWIs) */
2556 	for (qid = 0; qid < 6; qid++)
2557 		rt2860_reset_tx_ring(sc, &sc->txq[qid]);
2558 	rt2860_reset_rx_ring(sc, &sc->rxq);
2559 
2560 	/* by pass if it's quiesced */
2561 	if (!(sc->sc_flags & RT2860_F_QUIESCE))
2562 		RT2860_GLOCK(sc);
2563 	sc->sc_flags &= ~RT2860_UPD_BEACON;
2564 	/* by pass if it's quiesced */
2565 	if (!(sc->sc_flags & RT2860_F_QUIESCE))
2566 		RT2860_GUNLOCK(sc);
2567 }
2568 
2569 static int
2570 rt2860_m_start(void *arg)
2571 {
2572 	struct rt2860_softc	*sc = (struct rt2860_softc *)arg;
2573 	struct ieee80211com	*ic = &sc->sc_ic;
2574 	int			err;
2575 
2576 	err = rt2860_init(sc);
2577 	if (err != DDI_SUCCESS) {
2578 		RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_m_start():"
2579 		    "Hardware initialization failed\n");
2580 		goto fail1;
2581 	}
2582 
2583 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2584 
2585 	RT2860_GLOCK(sc);
2586 	sc->sc_flags |= RT2860_F_RUNNING;
2587 	RT2860_GUNLOCK(sc);
2588 
2589 	return (err);
2590 fail1:
2591 	rt2860_stop(sc);
2592 	return (err);
2593 }
2594 
2595 static void
2596 rt2860_m_stop(void *arg)
2597 {
2598 	struct rt2860_softc *sc = (struct rt2860_softc *)arg;
2599 
2600 	(void) rt2860_stop(sc);
2601 
2602 	ieee80211_new_state(&sc->sc_ic, IEEE80211_S_INIT, -1);
2603 
2604 	RT2860_GLOCK(sc);
2605 	sc->sc_flags &= ~RT2860_F_RUNNING;
2606 	RT2860_GUNLOCK(sc);
2607 }
2608 
2609 static void
2610 rt2860_m_ioctl(void* arg, queue_t *wq, mblk_t *mp)
2611 {
2612 	struct rt2860_softc	*sc = (struct rt2860_softc *)arg;
2613 	struct ieee80211com	*ic = &sc->sc_ic;
2614 	int			err;
2615 
2616 	err = ieee80211_ioctl(ic, wq, mp);
2617 	RT2860_GLOCK(sc);
2618 	if (err == ENETRESET) {
2619 		if (ic->ic_des_esslen) {
2620 			if (RT2860_IS_RUNNING(sc)) {
2621 				RT2860_GUNLOCK(sc);
2622 				(void) rt2860_init(sc);
2623 				(void) ieee80211_new_state(ic,
2624 				    IEEE80211_S_SCAN, -1);
2625 				RT2860_GLOCK(sc);
2626 			}
2627 		}
2628 	}
2629 	RT2860_GUNLOCK(sc);
2630 }
2631 
2632 /*
2633  * Call back function for get/set proporty
2634  */
2635 static int
2636 rt2860_m_getprop(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
2637     uint_t pr_flags, uint_t wldp_length, void *wldp_buf, uint_t *perm)
2638 {
2639 	struct rt2860_softc	*sc = (struct rt2860_softc *)arg;
2640 	int			err = 0;
2641 
2642 	err = ieee80211_getprop(&sc->sc_ic, pr_name, wldp_pr_num,
2643 	    pr_flags, wldp_length, wldp_buf, perm);
2644 
2645 	return (err);
2646 }
2647 
2648 static int
2649 rt2860_m_setprop(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
2650     uint_t wldp_length, const void *wldp_buf)
2651 {
2652 	struct rt2860_softc	*sc = (struct rt2860_softc *)arg;
2653 	ieee80211com_t		*ic = &sc->sc_ic;
2654 	int			err;
2655 
2656 	err = ieee80211_setprop(ic, pr_name, wldp_pr_num, wldp_length,
2657 	    wldp_buf);
2658 	RT2860_GLOCK(sc);
2659 	if (err == ENETRESET) {
2660 		if (ic->ic_des_esslen) {
2661 			if (RT2860_IS_RUNNING(sc)) {
2662 				RT2860_GUNLOCK(sc);
2663 				(void) rt2860_init(sc);
2664 				(void) ieee80211_new_state(ic,
2665 				    IEEE80211_S_SCAN, -1);
2666 				RT2860_GLOCK(sc);
2667 			}
2668 		}
2669 		err = 0;
2670 	}
2671 	RT2860_GUNLOCK(sc);
2672 	return (err);
2673 }
2674 
2675 static mblk_t *
2676 rt2860_m_tx(void *arg, mblk_t *mp)
2677 {
2678 	struct rt2860_softc	*sc = (struct rt2860_softc *)arg;
2679 	struct ieee80211com	*ic = &sc->sc_ic;
2680 	mblk_t			*next;
2681 
2682 	if (RT2860_IS_SUSPEND(sc)) {
2683 		freemsgchain(mp);
2684 		return (NULL);
2685 	}
2686 
2687 	/*
2688 	 * No data frames go out unless we're associated; this
2689 	 * should not happen as the 802.11 layer does not enable
2690 	 * the xmit queue until we enter the RUN state.
2691 	 */
2692 	if (ic->ic_state != IEEE80211_S_RUN) {
2693 		RWN_DEBUG(RT2860_DBG_TX, "rwn: rt2860_tx_data(): "
2694 		    "discard, state %u\n", ic->ic_state);
2695 		freemsgchain(mp);
2696 		return (NULL);
2697 	}
2698 
2699 	while (mp != NULL) {
2700 		next = mp->b_next;
2701 		mp->b_next = NULL;
2702 		if (rt2860_send(ic, mp, IEEE80211_FC0_TYPE_DATA) !=
2703 		    DDI_SUCCESS) {
2704 			mp->b_next = next;
2705 			break;
2706 		}
2707 		mp = next;
2708 	}
2709 	return (mp);
2710 }
2711 
2712 /*ARGSUSED*/
2713 static int
2714 rt2860_m_unicst(void *arg, const uint8_t *macaddr)
2715 {
2716 	return (ENOTSUP);
2717 }
2718 
2719 /*ARGSUSED*/
2720 static int
2721 rt2860_m_multicst(void *arg, boolean_t add, const uint8_t *mca)
2722 {
2723 	return (ENOTSUP);
2724 }
2725 
2726 /*ARGSUSED*/
2727 static int
2728 rt2860_m_promisc(void *arg, boolean_t on)
2729 {
2730 	return (0);
2731 }
2732 
2733 static int
2734 rt2860_m_stat(void *arg, uint_t stat, uint64_t *val)
2735 {
2736 	struct rt2860_softc	*sc  = (struct rt2860_softc *)arg;
2737 	ieee80211com_t		*ic = &sc->sc_ic;
2738 	ieee80211_node_t	*ni = ic->ic_bss;
2739 	struct ieee80211_rateset *rs = &ni->in_rates;
2740 
2741 	RT2860_GLOCK(sc);
2742 	switch (stat) {
2743 	case MAC_STAT_IFSPEED:
2744 		*val = ((ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE) ?
2745 		    (rs->ir_rates[ni->in_txrate] & IEEE80211_RATE_VAL)
2746 		    : ic->ic_fixed_rate) / 2 * 1000000;
2747 		break;
2748 	case MAC_STAT_NOXMTBUF:
2749 		*val = sc->sc_tx_nobuf;
2750 		break;
2751 	case MAC_STAT_NORCVBUF:
2752 		*val = sc->sc_rx_nobuf;
2753 		break;
2754 	case MAC_STAT_IERRORS:
2755 		*val = sc->sc_rx_err;
2756 		break;
2757 	case MAC_STAT_RBYTES:
2758 		*val = ic->ic_stats.is_rx_bytes;
2759 		break;
2760 	case MAC_STAT_IPACKETS:
2761 		*val = ic->ic_stats.is_rx_frags;
2762 		break;
2763 	case MAC_STAT_OBYTES:
2764 		*val = ic->ic_stats.is_tx_bytes;
2765 		break;
2766 	case MAC_STAT_OPACKETS:
2767 		*val = ic->ic_stats.is_tx_frags;
2768 		break;
2769 	case MAC_STAT_OERRORS:
2770 	case WIFI_STAT_TX_FAILED:
2771 		*val = sc->sc_tx_err;
2772 		break;
2773 	case WIFI_STAT_TX_RETRANS:
2774 		*val = sc->sc_tx_retries;
2775 		break;
2776 	case WIFI_STAT_FCS_ERRORS:
2777 	case WIFI_STAT_WEP_ERRORS:
2778 	case WIFI_STAT_TX_FRAGS:
2779 	case WIFI_STAT_MCAST_TX:
2780 	case WIFI_STAT_RTS_SUCCESS:
2781 	case WIFI_STAT_RTS_FAILURE:
2782 	case WIFI_STAT_ACK_FAILURE:
2783 	case WIFI_STAT_RX_FRAGS:
2784 	case WIFI_STAT_MCAST_RX:
2785 	case WIFI_STAT_RX_DUPS:
2786 		RT2860_GUNLOCK(sc);
2787 		return (ieee80211_stat(ic, stat, val));
2788 	default:
2789 		RT2860_GUNLOCK(sc);
2790 		return (ENOTSUP);
2791 	}
2792 	RT2860_GUNLOCK(sc);
2793 
2794 	return (0);
2795 }
2796 
2797 static int
2798 rt2860_attach(dev_info_t *devinfo, ddi_attach_cmd_t cmd)
2799 {
2800 	struct rt2860_softc	*sc;
2801 	struct ieee80211com	*ic;
2802 	int			i, err, qid, ntries, instance;
2803 	uint8_t			cachelsz;
2804 	uint16_t		command, vendor_id, device_id;
2805 	char			strbuf[32];
2806 	wifi_data_t		wd = { 0 };
2807 	mac_register_t		*macp;
2808 
2809 	switch (cmd) {
2810 	case DDI_ATTACH:
2811 		break;
2812 	case DDI_RESUME:
2813 		sc = ddi_get_soft_state(rt2860_soft_state_p,
2814 		    ddi_get_instance(devinfo));
2815 		ASSERT(sc != NULL);
2816 		RT2860_GLOCK(sc);
2817 		sc->sc_flags &= ~RT2860_F_SUSPEND;
2818 		RT2860_GUNLOCK(sc);
2819 		if (RT2860_IS_RUNNING(sc))
2820 			(void) rt2860_init(sc);
2821 		RWN_DEBUG(RT2860_DBG_RESUME, "rwn: rt2860_attach(): "
2822 		    "resume now\n");
2823 		return (DDI_SUCCESS);
2824 	default:
2825 		return (DDI_FAILURE);
2826 	}
2827 
2828 	instance = ddi_get_instance(devinfo);
2829 
2830 	err = ddi_soft_state_zalloc(rt2860_soft_state_p, instance);
2831 	if (err != DDI_SUCCESS) {
2832 		RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach(): "
2833 		    "unable to alloc soft_state_p\n");
2834 		return (err);
2835 	}
2836 
2837 	sc = ddi_get_soft_state(rt2860_soft_state_p, instance);
2838 	ic = (ieee80211com_t *)&sc->sc_ic;
2839 	sc->sc_dev = devinfo;
2840 
2841 	/* pci configuration */
2842 	err = ddi_regs_map_setup(devinfo, 0, &sc->sc_cfg_base, 0, 0,
2843 	    &rwn_csr_accattr, &sc->sc_cfg_handle);
2844 	if (err != DDI_SUCCESS) {
2845 		RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach(): "
2846 		    "ddi_regs_map_setup() failed");
2847 		goto fail1;
2848 	}
2849 
2850 	cachelsz = ddi_get8(sc->sc_cfg_handle,
2851 	    (uint8_t *)(sc->sc_cfg_base + PCI_CONF_CACHE_LINESZ));
2852 	if (cachelsz == 0)
2853 		cachelsz = 0x10;
2854 	sc->sc_cachelsz = cachelsz << 2;
2855 	sc->sc_dmabuf_size = roundup(IEEE80211_MAX_LEN, sc->sc_cachelsz);
2856 
2857 	vendor_id = ddi_get16(sc->sc_cfg_handle,
2858 	    (uint16_t *)((uintptr_t)(sc->sc_cfg_base) + PCI_CONF_VENID));
2859 	device_id = ddi_get16(sc->sc_cfg_handle,
2860 	    (uint16_t *)((uintptr_t)(sc->sc_cfg_base) + PCI_CONF_DEVID));
2861 	RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach(): "
2862 	    "vendor 0x%x, device id 0x%x, cache size %d\n",
2863 	    vendor_id, device_id, cachelsz);
2864 
2865 	/*
2866 	 * Enable response to memory space accesses,
2867 	 * and enabe bus master.
2868 	 */
2869 	command = PCI_COMM_MAE | PCI_COMM_ME;
2870 	ddi_put16(sc->sc_cfg_handle,
2871 	    (uint16_t *)((uintptr_t)(sc->sc_cfg_base) + PCI_CONF_COMM),
2872 	    command);
2873 	ddi_put8(sc->sc_cfg_handle,
2874 	    (uint8_t *)(sc->sc_cfg_base + PCI_CONF_LATENCY_TIMER), 0xa8);
2875 	ddi_put8(sc->sc_cfg_handle,
2876 	    (uint8_t *)(sc->sc_cfg_base + PCI_CONF_ILINE), 0x10);
2877 
2878 	/* pci i/o space */
2879 	err = ddi_regs_map_setup(devinfo, 1,
2880 	    &sc->sc_io_base, 0, 0, &rwn_csr_accattr, &sc->sc_io_handle);
2881 	if (err != DDI_SUCCESS) {
2882 		RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach(): "
2883 		    "ddi_regs_map_setup() failed");
2884 		goto fail2;
2885 	}
2886 	RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach(): "
2887 	    "PCI configuration is done successfully\n");
2888 
2889 	/* wait for NIC to initialize */
2890 	for (ntries = 0; ntries < 100; ntries++) {
2891 		sc->mac_rev = RT2860_READ(sc, RT2860_ASIC_VER_ID);
2892 		if (sc->mac_rev != 0 && sc->mac_rev != 0xffffffff)
2893 			break;
2894 		DELAY(10);
2895 	}
2896 	if (ntries == 100) {
2897 		RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach(): "
2898 		    "timeout waiting for NIC initialize\n");
2899 		return (DDI_FAILURE);
2900 	}
2901 
2902 	if ((sc->mac_rev >> 16) != 0x2860 &&
2903 	    (device_id == PRODUCT_RALINK_RT2890 ||
2904 	    device_id == PRODUCT_RALINK_RT2790 ||
2905 	    device_id == PRODUCT_AWT_RT2890))
2906 		sc->sc_flags |= RT2860_ADVANCED_PS;
2907 
2908 	/* retrieve RF rev. no and various other things from EEPROM */
2909 	(void) rt2860_read_eeprom(sc);
2910 	RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach(): "
2911 	    "MAC/BBP RT%X (rev 0x%04X), RF %s (%dT%dR)\n",
2912 	    sc->mac_rev >> 16, sc->mac_rev & 0xffff,
2913 	    rt2860_get_rf(sc->rf_rev), sc->ntxchains, sc->nrxchains);
2914 
2915 	/*
2916 	 * Allocate Tx (4 EDCAs + HCCA + Mgt) and Rx rings.
2917 	 */
2918 	for (qid = 0; qid < 6; qid++) {
2919 		if ((err = rt2860_alloc_tx_ring(sc, &sc->txq[qid])) != 0) {
2920 			RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach(): "
2921 			    "could not allocate Tx ring %d\n", qid);
2922 			goto fail3;
2923 		}
2924 	}
2925 
2926 	if ((err = rt2860_alloc_rx_ring(sc, &sc->rxq)) != 0) {
2927 		RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach(): "
2928 		    "could not allocte Rx ring\n");
2929 		goto fail4;
2930 	}
2931 
2932 	if ((err = rt2860_alloc_tx_pool(sc)) != 0) {
2933 		RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach(): "
2934 		    "could not allocte Tx pool\n");
2935 		goto fail5;
2936 	}
2937 
2938 	mutex_init(&sc->sc_genlock, NULL, MUTEX_DRIVER, NULL);
2939 	mutex_init(&sc->sc_txlock, NULL, MUTEX_DRIVER, NULL);
2940 	mutex_init(&sc->sc_rxlock, NULL, MUTEX_DRIVER, NULL);
2941 
2942 	/* mgmt ring is broken on RT2860C, use EDCA AC VO ring instead */
2943 	sc->mgtqid = (sc->mac_rev == 0x28600100) ? EDCA_AC_VO : 5;
2944 	RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach():"
2945 	    "mgtqid = %x\n", sc->mgtqid);
2946 
2947 	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
2948 	ic->ic_opmode = IEEE80211_M_STA; /* default to BSS mode */
2949 	ic->ic_state = IEEE80211_S_INIT;
2950 
2951 	/* set device capabilities */
2952 	ic->ic_caps =
2953 	    IEEE80211_C_TXPMGT |	/* tx power management */
2954 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
2955 	    IEEE80211_C_SHSLOT;		/* short slot time supported */
2956 
2957 	/* WPA/WPA2 support */
2958 	ic->ic_caps |= IEEE80211_C_WPA; /* Support WPA/WPA2 */
2959 
2960 	/* set supported .11b and .11g rates */
2961 	ic->ic_sup_rates[IEEE80211_MODE_11B] = rt2560_rateset_11b;
2962 	ic->ic_sup_rates[IEEE80211_MODE_11G] = rt2560_rateset_11g;
2963 
2964 	/* set supported .11b and .11g channels (1 through 14) */
2965 	for (i = 1; i <= 14; i++) {
2966 		ic->ic_sup_channels[i].ich_freq =
2967 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
2968 		ic->ic_sup_channels[i].ich_flags =
2969 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
2970 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
2971 	}
2972 
2973 	ic->ic_xmit = rt2860_send;
2974 
2975 	ieee80211_attach(ic);
2976 
2977 	/* register WPA door */
2978 	ieee80211_register_door(ic, ddi_driver_name(devinfo),
2979 	    ddi_get_instance(devinfo));
2980 
2981 	/* override state transition machine */
2982 	sc->sc_newstate = ic->ic_newstate;
2983 	ic->ic_newstate = rt2860_newstate;
2984 	ieee80211_media_init(ic);
2985 	ic->ic_def_txkey = 0;
2986 
2987 	err = ddi_add_softintr(devinfo, DDI_SOFTINT_LOW,
2988 	    &sc->sc_softintr_hdl, NULL, 0, rt2860_softintr, (caddr_t)sc);
2989 	if (err != DDI_SUCCESS) {
2990 		RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach(): "
2991 		    "ddi_add_softintr() failed");
2992 		goto fail8;
2993 	}
2994 
2995 	err = ddi_get_iblock_cookie(devinfo, 0, &sc->sc_iblock);
2996 	if (err != DDI_SUCCESS) {
2997 		RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach(): "
2998 		    "Can not get iblock cookie for INT\n");
2999 		goto fail7;
3000 	}
3001 
3002 	err = ddi_add_intr(devinfo, 0, NULL, NULL, rt2860_intr, (caddr_t)sc);
3003 	if (err != DDI_SUCCESS) {
3004 		RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach(): "
3005 		    "unable to add device interrupt handler\n");
3006 		goto fail7;
3007 	}
3008 
3009 	/*
3010 	 * Provide initial settings for the WiFi plugin; whenever this
3011 	 * information changes, we need to call mac_plugindata_update()
3012 	 */
3013 	wd.wd_opmode = ic->ic_opmode;
3014 	wd.wd_secalloc = WIFI_SEC_NONE;
3015 	IEEE80211_ADDR_COPY(wd.wd_bssid, ic->ic_bss->in_bssid);
3016 
3017 	if ((macp = mac_alloc(MAC_VERSION)) == NULL) {
3018 		RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach(): "
3019 		    "MAC version mismatch\n");
3020 		goto fail9;
3021 	}
3022 
3023 	macp->m_type_ident	= MAC_PLUGIN_IDENT_WIFI;
3024 	macp->m_driver		= sc;
3025 	macp->m_dip		= devinfo;
3026 	macp->m_src_addr	= ic->ic_macaddr;
3027 	macp->m_callbacks	= &rt2860_m_callbacks;
3028 	macp->m_min_sdu		= 0;
3029 	macp->m_max_sdu		= IEEE80211_MTU;
3030 	macp->m_pdata		= &wd;
3031 	macp->m_pdata_size	= sizeof (wd);
3032 
3033 	err = mac_register(macp, &ic->ic_mach);
3034 	mac_free(macp);
3035 	if (err != 0) {
3036 		RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach(): "
3037 		    "mac_register err %x\n", err);
3038 		goto fail9;
3039 	}
3040 
3041 	/*
3042 	 * Create minor node of type DDI_NT_NET_WIFI
3043 	 */
3044 	(void) snprintf(strbuf, sizeof (strbuf), "%s%d",
3045 	    "rwn", instance);
3046 	err = ddi_create_minor_node(devinfo, strbuf, S_IFCHR,
3047 	    instance + 1, DDI_NT_NET_WIFI, 0);
3048 
3049 	/*
3050 	 * Notify link is down now
3051 	 */
3052 	mac_link_update(ic->ic_mach, LINK_STATE_DOWN);
3053 
3054 	sc->sc_flags &= ~RT2860_F_RUNNING;
3055 
3056 	RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach() successfully.\n");
3057 	return (DDI_SUCCESS);
3058 fail9:
3059 	ddi_remove_softintr(sc->sc_softintr_hdl);
3060 fail8:
3061 	ddi_remove_intr(devinfo, 0, sc->sc_iblock);
3062 fail7:
3063 	mutex_destroy(&sc->sc_genlock);
3064 	mutex_destroy(&sc->sc_txlock);
3065 	mutex_destroy(&sc->sc_rxlock);
3066 fail6:
3067 	rt2860_free_tx_pool(sc);
3068 fail5:
3069 	rt2860_free_rx_ring(sc, &sc->rxq);
3070 fail4:
3071 	while (--qid >= 0)
3072 		rt2860_free_tx_ring(sc, &sc->txq[qid]);
3073 
3074 fail3:
3075 	ddi_regs_map_free(&sc->sc_io_handle);
3076 fail2:
3077 	ddi_regs_map_free(&sc->sc_cfg_handle);
3078 fail1:
3079 	return (err);
3080 }
3081 
3082 static int
3083 rt2860_detach(dev_info_t *devinfo, ddi_detach_cmd_t cmd)
3084 {
3085 	struct rt2860_softc	*sc;
3086 	int			qid;
3087 
3088 	sc = ddi_get_soft_state(rt2860_soft_state_p, ddi_get_instance(devinfo));
3089 
3090 	switch (cmd) {
3091 	case DDI_DETACH:
3092 		break;
3093 	case DDI_SUSPEND:
3094 		if (RT2860_IS_RUNNING(sc))
3095 			rt2860_stop(sc);
3096 		RT2860_GLOCK(sc);
3097 		sc->sc_flags &= ~RT2860_FWLOADED;
3098 		sc->sc_flags |= RT2860_F_SUSPEND;
3099 		RT2860_GUNLOCK(sc);
3100 		RWN_DEBUG(RT2860_DBG_RESUME, "rwn: rt2860_detach(): "
3101 		    "suspend now\n");
3102 		return (DDI_SUCCESS);
3103 	default:
3104 		return (DDI_FAILURE);
3105 	}
3106 
3107 	if (mac_disable(sc->sc_ic.ic_mach) != 0)
3108 		return (DDI_FAILURE);
3109 
3110 	rt2860_stop(sc);
3111 
3112 	/*
3113 	 * Unregister from the MAC layer subsystem
3114 	 */
3115 	(void) mac_unregister(sc->sc_ic.ic_mach);
3116 
3117 	ddi_remove_intr(devinfo, 0, sc->sc_iblock);
3118 	ddi_remove_softintr(sc->sc_softintr_hdl);
3119 
3120 	/*
3121 	 * detach ieee80211 layer
3122 	 */
3123 	ieee80211_detach(&sc->sc_ic);
3124 
3125 	rt2860_free_tx_pool(sc);
3126 	rt2860_free_rx_ring(sc, &sc->rxq);
3127 	for (qid = 0; qid < 6; qid++)
3128 		rt2860_free_tx_ring(sc, &sc->txq[qid]);
3129 
3130 	ddi_regs_map_free(&sc->sc_io_handle);
3131 
3132 	mutex_destroy(&sc->sc_genlock);
3133 	mutex_destroy(&sc->sc_txlock);
3134 	mutex_destroy(&sc->sc_rxlock);
3135 
3136 	ddi_remove_minor_node(devinfo, NULL);
3137 	ddi_soft_state_free(rt2860_soft_state_p, ddi_get_instance(devinfo));
3138 
3139 	return (DDI_SUCCESS);
3140 }
3141 
3142 int
3143 _info(struct modinfo *modinfop)
3144 {
3145 	return (mod_info(&modlinkage, modinfop));
3146 }
3147 
3148 int
3149 _init(void)
3150 {
3151 	int status;
3152 
3153 	status = ddi_soft_state_init(&rt2860_soft_state_p,
3154 	    sizeof (struct rt2860_softc), 1);
3155 	if (status != 0)
3156 		return (status);
3157 
3158 	mac_init_ops(&rwn_dev_ops, "rwn");
3159 	status = mod_install(&modlinkage);
3160 	if (status != 0) {
3161 		mac_fini_ops(&rwn_dev_ops);
3162 		ddi_soft_state_fini(&rt2860_soft_state_p);
3163 	}
3164 	return (status);
3165 }
3166 
3167 int
3168 _fini(void)
3169 {
3170 	int status;
3171 
3172 	status = mod_remove(&modlinkage);
3173 	if (status == 0) {
3174 		mac_fini_ops(&rwn_dev_ops);
3175 		ddi_soft_state_fini(&rt2860_soft_state_p);
3176 	}
3177 	return (status);
3178 }
3179