xref: /titanic_50/usr/src/uts/common/io/ral/rt2560.c (revision 94d05f6c7f329fdf908da99ab50b37d3d33f9fe5)
1 /*
2  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
3  * Use is subject to license terms.
4  */
5 
6 /*
7  * Copyright (c) 2005, 2006
8  *	Damien Bergamini <damien.bergamini@free.fr>
9  *
10  * Permission to use, copy, modify, and distribute this software for any
11  * purpose with or without fee is hereby granted, provided that the above
12  * copyright notice and this permission notice appear in all copies.
13  *
14  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
15  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
16  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
17  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
18  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
20  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21  */
22 
23 /*
24  * Ralink Technology RT2560 chipset driver
25  * http://www.ralinktech.com/
26  */
27 
28 #include <sys/types.h>
29 #include <sys/byteorder.h>
30 #include <sys/conf.h>
31 #include <sys/cmn_err.h>
32 #include <sys/stat.h>
33 #include <sys/ddi.h>
34 #include <sys/sunddi.h>
35 #include <sys/strsubr.h>
36 #include <sys/ethernet.h>
37 #include <inet/common.h>
38 #include <inet/nd.h>
39 #include <inet/mi.h>
40 #include <sys/note.h>
41 #include <sys/stream.h>
42 #include <sys/strsun.h>
43 #include <sys/modctl.h>
44 #include <sys/devops.h>
45 #include <sys/dlpi.h>
46 #include <sys/mac.h>
47 #include <sys/mac_wifi.h>
48 #include <sys/net80211.h>
49 #include <sys/net80211_proto.h>
50 #include <sys/varargs.h>
51 #include <sys/policy.h>
52 #include <sys/pci.h>
53 #include <sys/crypto/common.h>
54 #include <sys/crypto/api.h>
55 #include <inet/wifi_ioctl.h>
56 
57 #include "ral_rate.h"
58 #include "rt2560_reg.h"
59 #include "rt2560_var.h"
60 
61 
62 static void *ral_soft_state_p = NULL;
63 
64 #define	RAL_TXBUF_SIZE  	(IEEE80211_MAX_LEN)
65 #define	RAL_RXBUF_SIZE  	(IEEE80211_MAX_LEN)
66 
67 /* quickly determine if a given rate is CCK or OFDM */
68 #define	RAL_RATE_IS_OFDM(rate)	((rate) >= 12 && (rate) != 22)
69 #define	RAL_ACK_SIZE		14	/* 10 + 4(FCS) */
70 #define	RAL_CTS_SIZE		14	/* 10 + 4(FCS) */
71 #define	RAL_SIFS		10	/* us */
72 #define	RT2560_TXRX_TURNAROUND	10	/* us */
73 
74 /*
75  * Supported rates for 802.11a/b/g modes (in 500Kbps unit).
76  */
77 static const struct ieee80211_rateset rt2560_rateset_11a =
78 	{ 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
79 
80 static const struct ieee80211_rateset rt2560_rateset_11b =
81 	{ 4, { 2, 4, 11, 22 } };
82 
83 static const struct ieee80211_rateset rt2560_rateset_11g =
84 	{ 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
85 
86 static const struct {
87 	uint32_t	reg;
88 	uint32_t	val;
89 } rt2560_def_mac[] = {
90 	RT2560_DEF_MAC
91 };
92 
93 static const struct {
94 	uint8_t	reg;
95 	uint8_t	val;
96 } rt2560_def_bbp[] = {
97 	RT2560_DEF_BBP
98 };
99 
100 static const uint32_t rt2560_rf2522_r2[]    = RT2560_RF2522_R2;
101 static const uint32_t rt2560_rf2523_r2[]    = RT2560_RF2523_R2;
102 static const uint32_t rt2560_rf2524_r2[]    = RT2560_RF2524_R2;
103 static const uint32_t rt2560_rf2525_r2[]    = RT2560_RF2525_R2;
104 static const uint32_t rt2560_rf2525_hi_r2[] = RT2560_RF2525_HI_R2;
105 static const uint32_t rt2560_rf2525e_r2[]   = RT2560_RF2525E_R2;
106 static const uint32_t rt2560_rf2526_r2[]    = RT2560_RF2526_R2;
107 static const uint32_t rt2560_rf2526_hi_r2[] = RT2560_RF2526_HI_R2;
108 
109 static const struct {
110 	uint8_t		chan;
111 	uint32_t	r1, r2, r4;
112 } rt2560_rf5222[] = {
113 	RT2560_RF5222
114 };
115 
116 /*
117  * PIO access attributes for registers
118  */
119 static ddi_device_acc_attr_t ral_csr_accattr = {
120 	DDI_DEVICE_ATTR_V0,
121 	DDI_STRUCTURE_LE_ACC,
122 	DDI_STRICTORDER_ACC
123 };
124 
125 /*
126  * DMA access attributes for descriptors: NOT to be byte swapped.
127  */
128 static ddi_device_acc_attr_t ral_desc_accattr = {
129 	DDI_DEVICE_ATTR_V0,
130 	DDI_STRUCTURE_LE_ACC,
131 	DDI_STRICTORDER_ACC
132 };
133 
134 /*
135  * Describes the chip's DMA engine
136  */
137 static ddi_dma_attr_t ral_dma_attr = {
138 	DMA_ATTR_V0,			/* dma_attr version */
139 	0x0000000000000000ull,		/* dma_attr_addr_lo */
140 	0xFFFFFFFF,			/* dma_attr_addr_hi */
141 	0x00000000FFFFFFFFull,		/* dma_attr_count_max */
142 	0x0000000000000001ull,		/* dma_attr_align */
143 	0x00000FFF,			/* dma_attr_burstsizes */
144 	0x00000001,			/* dma_attr_minxfer */
145 	0x000000000000FFFFull,		/* dma_attr_maxxfer */
146 	0xFFFFFFFFFFFFFFFFull,		/* dma_attr_seg */
147 	1,				/* dma_attr_sgllen */
148 	0x00000001,			/* dma_attr_granular */
149 	0				/* dma_attr_flags */
150 };
151 
152 /*
153  * device operations
154  */
155 static int rt2560_attach(dev_info_t *, ddi_attach_cmd_t);
156 static int rt2560_detach(dev_info_t *, ddi_detach_cmd_t);
157 static int32_t rt2560_quiesce(dev_info_t *);
158 
159 /*
160  * Module Loading Data & Entry Points
161  */
162 DDI_DEFINE_STREAM_OPS(ral_dev_ops, nulldev, nulldev, rt2560_attach,
163     rt2560_detach, nodev, NULL, D_MP, NULL, rt2560_quiesce);
164 
165 static struct modldrv ral_modldrv = {
166 	&mod_driverops,		/* Type of module.  This one is a driver */
167 	"Ralink RT2500 driver v1.6",	/* short description */
168 	&ral_dev_ops		/* driver specific ops */
169 };
170 
171 static struct modlinkage modlinkage = {
172 	MODREV_1,
173 	(void *)&ral_modldrv,
174 	NULL
175 };
176 
177 static int	rt2560_m_stat(void *,  uint_t, uint64_t *);
178 static int	rt2560_m_start(void *);
179 static void	rt2560_m_stop(void *);
180 static int	rt2560_m_promisc(void *, boolean_t);
181 static int	rt2560_m_multicst(void *, boolean_t, const uint8_t *);
182 static int	rt2560_m_unicst(void *, const uint8_t *);
183 static mblk_t	*rt2560_m_tx(void *, mblk_t *);
184 static void	rt2560_m_ioctl(void *, queue_t *, mblk_t *);
185 static int	rt2560_m_setprop(void *, const char *, mac_prop_id_t,
186     uint_t, const void *);
187 static int	rt2560_m_getprop(void *, const char *, mac_prop_id_t,
188     uint_t, uint_t, void *, uint_t *);
189 
190 static mac_callbacks_t rt2560_m_callbacks = {
191 	MC_IOCTL | MC_SETPROP | MC_GETPROP,
192 	rt2560_m_stat,
193 	rt2560_m_start,
194 	rt2560_m_stop,
195 	rt2560_m_promisc,
196 	rt2560_m_multicst,
197 	rt2560_m_unicst,
198 	rt2560_m_tx,
199 	NULL,		/* mc_resources; */
200 	rt2560_m_ioctl,
201 	NULL,		/* mc_getcapab */
202 	NULL,
203 	NULL,
204 	rt2560_m_setprop,
205 	rt2560_m_getprop
206 };
207 
208 uint32_t ral_dbg_flags = 0;
209 
210 void
211 ral_debug(uint32_t dbg_flags, const int8_t *fmt, ...)
212 {
213 	va_list args;
214 
215 	if (dbg_flags & ral_dbg_flags) {
216 		va_start(args, fmt);
217 		vcmn_err(CE_CONT, fmt, args);
218 		va_end(args);
219 	}
220 }
221 
222 static void
223 rt2560_set_basicrates(struct rt2560_softc *sc)
224 {
225 	struct ieee80211com *ic = &sc->sc_ic;
226 
227 	/* update basic rate set */
228 	if (ic->ic_curmode == IEEE80211_MODE_11B) {
229 		/* 11b basic rates: 1, 2Mbps */
230 		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x3);
231 	} else if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan)) {
232 		/* 11a basic rates: 6, 12, 24Mbps */
233 		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x150);
234 	} else {
235 		/* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
236 		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x15f);
237 	}
238 }
239 
240 static void
241 rt2560_update_led(struct rt2560_softc *sc, int led1, int led2)
242 {
243 	uint32_t tmp;
244 
245 	/* set ON period to 70ms and OFF period to 30ms */
246 	tmp = led1 << 16 | led2 << 17 | 70 << 8 | 30;
247 	RAL_WRITE(sc, RT2560_LEDCSR, tmp);
248 }
249 
250 static void
251 rt2560_set_bssid(struct rt2560_softc *sc, uint8_t *bssid)
252 {
253 	uint32_t tmp;
254 
255 	tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
256 	RAL_WRITE(sc, RT2560_CSR5, tmp);
257 
258 	tmp = bssid[4] | bssid[5] << 8;
259 	RAL_WRITE(sc, RT2560_CSR6, tmp);
260 
261 	RAL_DEBUG(RAL_DBG_HW, "setting BSSID to " MACSTR "\n", MAC2STR(bssid));
262 }
263 
264 
265 static void
266 rt2560_bbp_write(struct rt2560_softc *sc, uint8_t reg, uint8_t val)
267 {
268 	uint32_t tmp;
269 	int ntries;
270 
271 	for (ntries = 0; ntries < 100; ntries++) {
272 		if (!(RAL_READ(sc, RT2560_BBPCSR) & RT2560_BBP_BUSY))
273 			break;
274 		drv_usecwait(1);
275 	}
276 	if (ntries == 100) {
277 		RAL_DEBUG(RAL_DBG_HW, "could not write to BBP\n");
278 		return;
279 	}
280 
281 	tmp = RT2560_BBP_WRITE | RT2560_BBP_BUSY | reg << 8 | val;
282 	RAL_WRITE(sc, RT2560_BBPCSR, tmp);
283 
284 	RAL_DEBUG(RAL_DBG_HW, "BBP R%u <- 0x%02x\n", reg, val);
285 }
286 
287 static uint8_t
288 rt2560_bbp_read(struct rt2560_softc *sc, uint8_t reg)
289 {
290 	uint32_t val;
291 	int ntries;
292 
293 	val = RT2560_BBP_BUSY | reg << 8;
294 	RAL_WRITE(sc, RT2560_BBPCSR, val);
295 
296 	for (ntries = 0; ntries < 100; ntries++) {
297 		val = RAL_READ(sc, RT2560_BBPCSR);
298 		if (!(val & RT2560_BBP_BUSY))
299 			return (val & 0xff);
300 		drv_usecwait(1);
301 	}
302 
303 	RAL_DEBUG(RAL_DBG_HW, "could not read from BBP\n");
304 	return (0);
305 }
306 
307 static void
308 rt2560_rf_write(struct rt2560_softc *sc, uint8_t reg, uint32_t val)
309 {
310 	uint32_t tmp;
311 	int ntries;
312 
313 	for (ntries = 0; ntries < 100; ntries++) {
314 		if (!(RAL_READ(sc, RT2560_RFCSR) & RT2560_RF_BUSY))
315 			break;
316 		drv_usecwait(1);
317 	}
318 	if (ntries == 100) {
319 		RAL_DEBUG(RAL_DBG_HW, "could not write to RF\n");
320 		return;
321 	}
322 
323 	tmp = RT2560_RF_BUSY | RT2560_RF_20BIT | (val & 0xfffff) << 2 |
324 	    (reg & 0x3);
325 	RAL_WRITE(sc, RT2560_RFCSR, tmp);
326 
327 	/* remember last written value in sc */
328 	sc->rf_regs[reg] = val;
329 
330 	RAL_DEBUG(RAL_DBG_HW, "RF R[%u] <- 0x%05x\n", reg & 0x3, val & 0xfffff);
331 }
332 
333 static void
334 rt2560_set_chan(struct rt2560_softc *sc, struct ieee80211_channel *c)
335 {
336 	struct ieee80211com *ic = &sc->sc_ic;
337 	uint8_t power, tmp;
338 	uint_t i, chan;
339 
340 	chan = ieee80211_chan2ieee(ic, c);
341 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
342 		return;
343 
344 	if (IEEE80211_IS_CHAN_2GHZ(c))
345 		power = min(sc->txpow[chan - 1], 31);
346 	else
347 		power = 31;
348 
349 	/* adjust txpower using ifconfig settings */
350 	power -= (100 - ic->ic_txpowlimit) / 8;
351 
352 	RAL_DEBUG(RAL_DBG_CHAN, "setting channel to %u, txpower to %u\n",
353 	    chan, power);
354 
355 	switch (sc->rf_rev) {
356 	case RT2560_RF_2522:
357 		rt2560_rf_write(sc, RAL_RF1, 0x00814);
358 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2522_r2[chan - 1]);
359 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
360 		break;
361 
362 	case RT2560_RF_2523:
363 		rt2560_rf_write(sc, RAL_RF1, 0x08804);
364 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2523_r2[chan - 1]);
365 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x38044);
366 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
367 		break;
368 
369 	case RT2560_RF_2524:
370 		rt2560_rf_write(sc, RAL_RF1, 0x0c808);
371 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2524_r2[chan - 1]);
372 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
373 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
374 		break;
375 
376 	case RT2560_RF_2525:
377 		rt2560_rf_write(sc, RAL_RF1, 0x08808);
378 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525_hi_r2[chan - 1]);
379 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
380 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
381 
382 		rt2560_rf_write(sc, RAL_RF1, 0x08808);
383 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525_r2[chan - 1]);
384 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
385 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
386 		break;
387 
388 	case RT2560_RF_2525E:
389 		rt2560_rf_write(sc, RAL_RF1, 0x08808);
390 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525e_r2[chan - 1]);
391 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
392 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00286 : 0x00282);
393 		break;
394 
395 	case RT2560_RF_2526:
396 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2526_hi_r2[chan - 1]);
397 		rt2560_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
398 		rt2560_rf_write(sc, RAL_RF1, 0x08804);
399 
400 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2526_r2[chan - 1]);
401 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
402 		rt2560_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
403 		break;
404 
405 	/* dual-band RF */
406 	case RT2560_RF_5222:
407 		for (i = 0; rt2560_rf5222[i].chan != chan; i++) {
408 		}
409 
410 		rt2560_rf_write(sc, RAL_RF1, rt2560_rf5222[i].r1);
411 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf5222[i].r2);
412 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
413 		rt2560_rf_write(sc, RAL_RF4, rt2560_rf5222[i].r4);
414 		break;
415 	}
416 
417 	if (ic->ic_state != IEEE80211_S_SCAN) {
418 		/* set Japan filter bit for channel 14 */
419 		tmp = rt2560_bbp_read(sc, 70);
420 
421 		tmp &= ~RT2560_JAPAN_FILTER;
422 		if (chan == 14)
423 			tmp |= RT2560_JAPAN_FILTER;
424 
425 		rt2560_bbp_write(sc, 70, tmp);
426 
427 		/* clear CRC errors */
428 		(void) RAL_READ(sc, RT2560_CNT0);
429 	}
430 }
431 
432 /*
433  * Refer to IEEE Std 802.11-1999 pp. 123 for more information on TSF
434  * synchronization.
435  */
436 static void
437 rt2560_enable_tsf_sync(struct rt2560_softc *sc)
438 {
439 	struct ieee80211com *ic = &sc->sc_ic;
440 	uint16_t logcwmin, preload;
441 	uint32_t tmp;
442 
443 	/* first, disable TSF synchronization */
444 	RAL_WRITE(sc, RT2560_CSR14, 0);
445 
446 	tmp = 16 * ic->ic_bss->in_intval;
447 	RAL_WRITE(sc, RT2560_CSR12, tmp);
448 
449 	RAL_WRITE(sc, RT2560_CSR13, 0);
450 
451 	logcwmin = 5;
452 	preload = (ic->ic_opmode == IEEE80211_M_STA) ? 384 : 1024;
453 	tmp = logcwmin << 16 | preload;
454 	RAL_WRITE(sc, RT2560_BCNOCSR, tmp);
455 
456 	/* finally, enable TSF synchronization */
457 	tmp = RT2560_ENABLE_TSF | RT2560_ENABLE_TBCN;
458 	if (ic->ic_opmode == IEEE80211_M_STA)
459 		tmp |= RT2560_ENABLE_TSF_SYNC(1);
460 	else
461 		tmp |= RT2560_ENABLE_TSF_SYNC(2) |
462 		    RT2560_ENABLE_BEACON_GENERATOR;
463 	RAL_WRITE(sc, RT2560_CSR14, tmp);
464 
465 	RAL_DEBUG(RAL_DBG_HW, "enabling TSF synchronization\n");
466 }
467 
468 static void
469 rt2560_update_plcp(struct rt2560_softc *sc)
470 {
471 	struct ieee80211com *ic = &sc->sc_ic;
472 
473 	/* no short preamble for 1Mbps */
474 	RAL_WRITE(sc, RT2560_PLCP1MCSR, 0x00700400);
475 
476 	if (!(ic->ic_flags & IEEE80211_F_SHPREAMBLE)) {
477 		/* values taken from the reference driver */
478 		RAL_WRITE(sc, RT2560_PLCP2MCSR,   0x00380401);
479 		RAL_WRITE(sc, RT2560_PLCP5p5MCSR, 0x00150402);
480 		RAL_WRITE(sc, RT2560_PLCP11MCSR,  0x000b8403);
481 	} else {
482 		/* same values as above or'ed 0x8 */
483 		RAL_WRITE(sc, RT2560_PLCP2MCSR,   0x00380409);
484 		RAL_WRITE(sc, RT2560_PLCP5p5MCSR, 0x0015040a);
485 		RAL_WRITE(sc, RT2560_PLCP11MCSR,  0x000b840b);
486 	}
487 
488 	RAL_DEBUG(RAL_DBG_HW, "updating PLCP for %s preamble\n",
489 	    (ic->ic_flags & IEEE80211_F_SHPREAMBLE) ? "short" : "long");
490 }
491 
492 /*
493  * This function can be called by ieee80211_set_shortslottime(). Refer to
494  * IEEE Std 802.11-1999 pp. 85 to know how these values are computed.
495  */
496 void
497 rt2560_update_slot(struct ieee80211com *ic, int onoff)
498 {
499 	struct rt2560_softc *sc = (struct rt2560_softc *)ic;
500 	uint8_t slottime;
501 	uint16_t tx_sifs, tx_pifs, tx_difs, eifs;
502 	uint32_t tmp;
503 
504 	/* slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20; */
505 	slottime = (onoff ? 9 : 20);
506 
507 	/* update the MAC slot boundaries */
508 	tx_sifs = RAL_SIFS - RT2560_TXRX_TURNAROUND;
509 	tx_pifs = tx_sifs + slottime;
510 	tx_difs = tx_sifs + 2 * slottime;
511 	eifs = (ic->ic_curmode == IEEE80211_MODE_11B) ? 364 : 60;
512 
513 	tmp = RAL_READ(sc, RT2560_CSR11);
514 	tmp = (tmp & ~0x1f00) | slottime << 8;
515 	RAL_WRITE(sc, RT2560_CSR11, tmp);
516 
517 	tmp = tx_pifs << 16 | tx_sifs;
518 	RAL_WRITE(sc, RT2560_CSR18, tmp);
519 
520 	tmp = eifs << 16 | tx_difs;
521 	RAL_WRITE(sc, RT2560_CSR19, tmp);
522 
523 	RAL_DEBUG(RAL_DBG_HW, "setting slottime to %uus\n", slottime);
524 }
525 
526 int
527 ral_dma_region_alloc(struct rt2560_softc *sc, struct dma_region *dr,
528     size_t size, uint_t alloc_flags, uint_t bind_flags)
529 {
530 	dev_info_t *dip = sc->sc_dev;
531 	int err;
532 
533 	RAL_DEBUG(RAL_DBG_DMA, "ral_dma_region_alloc() size=%u\n", size);
534 
535 	err = ddi_dma_alloc_handle(dip, &ral_dma_attr, DDI_DMA_SLEEP, NULL,
536 	    &dr->dr_hnd);
537 	if (err != DDI_SUCCESS)
538 		goto fail1;
539 
540 	err = ddi_dma_mem_alloc(dr->dr_hnd, size, &ral_desc_accattr,
541 	    alloc_flags, DDI_DMA_SLEEP, NULL,
542 	    &dr->dr_base, &dr->dr_size, &dr->dr_acc);
543 	if (err != DDI_SUCCESS)
544 		goto fail2;
545 
546 	err = ddi_dma_addr_bind_handle(dr->dr_hnd, NULL,
547 	    dr->dr_base, dr->dr_size,
548 	    bind_flags, DDI_DMA_SLEEP, NULL, &dr->dr_cookie, &dr->dr_ccnt);
549 	if (err != DDI_SUCCESS)
550 		goto fail3;
551 
552 	if (dr->dr_ccnt != 1) {
553 		err = DDI_FAILURE;
554 		goto fail4;
555 	}
556 
557 	dr->dr_pbase = dr->dr_cookie.dmac_address;
558 	RAL_DEBUG(RAL_DBG_DMA, "get physical-base=0x%08x\n", dr->dr_pbase);
559 
560 	return (DDI_SUCCESS);
561 
562 fail4:
563 	(void) ddi_dma_unbind_handle(dr->dr_hnd);
564 fail3:
565 	ddi_dma_mem_free(&dr->dr_acc);
566 fail2:
567 	ddi_dma_free_handle(&dr->dr_hnd);
568 fail1:
569 	return (err);
570 }
571 
572 /* ARGSUSED */
573 void
574 ral_dma_region_free(struct rt2560_softc *sc, struct dma_region *dr)
575 {
576 	(void) ddi_dma_unbind_handle(dr->dr_hnd);
577 	ddi_dma_mem_free(&dr->dr_acc);
578 	ddi_dma_free_handle(&dr->dr_hnd);
579 }
580 
581 int
582 rt2560_alloc_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring,
583 	int count)
584 {
585 	int i, err;
586 	int size;
587 
588 	ring->count = count;
589 	ring->queued = 0;
590 	ring->cur = ring->next = 0;
591 	ring->cur_encrypt = ring->next_encrypt = 0;
592 
593 	ring->data = kmem_zalloc(count * (sizeof (struct rt2560_tx_data)),
594 	    KM_SLEEP);
595 	ring->dr_txbuf = kmem_zalloc(count * (sizeof (struct dma_region)),
596 	    KM_SLEEP);
597 
598 	err = ral_dma_region_alloc(sc, &ring->dr_desc,
599 	    count * (sizeof (struct rt2560_tx_desc)),
600 	    DDI_DMA_CONSISTENT, DDI_DMA_RDWR | DDI_DMA_CONSISTENT);
601 
602 	if (err != DDI_SUCCESS)
603 		goto fail1;
604 
605 	size = roundup(RAL_TXBUF_SIZE, sc->sc_cachelsz);
606 	for (i = 0; i < count; i++) {
607 		err = ral_dma_region_alloc(sc, &ring->dr_txbuf[i], size,
608 		    DDI_DMA_STREAMING, DDI_DMA_WRITE | DDI_DMA_STREAMING);
609 		if (err != DDI_SUCCESS) {
610 			while (i >= 0) {
611 				ral_dma_region_free(sc, &ring->dr_txbuf[i]);
612 				i--;
613 			}
614 			goto fail2;
615 		}
616 	}
617 
618 	ring->physaddr = LE_32(ring->dr_desc.dr_pbase);
619 	ring->desc = (struct rt2560_tx_desc *)ring->dr_desc.dr_base;
620 
621 	for (i = 0; i < count; i++) {
622 		ring->desc[i].physaddr = LE_32(ring->dr_txbuf[i].dr_pbase);
623 		ring->data[i].buf = ring->dr_txbuf[i].dr_base;
624 	}
625 
626 	return (DDI_SUCCESS);
627 fail2:
628 	ral_dma_region_free(sc, &ring->dr_desc);
629 fail1:
630 	return (err);
631 }
632 
633 /* ARGSUSED */
634 void
635 rt2560_reset_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring)
636 {
637 	struct rt2560_tx_desc *desc;
638 	struct rt2560_tx_data *data;
639 	int i;
640 
641 	for (i = 0; i < ring->count; i++) {
642 		desc = &ring->desc[i];
643 		data = &ring->data[i];
644 
645 		if (data->ni != NULL) {
646 			ieee80211_free_node(data->ni);
647 			data->ni = NULL;
648 		}
649 
650 		desc->flags = 0;
651 	}
652 
653 	(void) ddi_dma_sync(ring->dr_desc.dr_hnd, 0,
654 	    ring->count * sizeof (struct rt2560_tx_desc), DDI_DMA_SYNC_FORDEV);
655 
656 	ring->queued = 0;
657 	ring->cur = ring->next = 0;
658 	ring->cur_encrypt = ring->next_encrypt = 0;
659 }
660 
661 void
662 rt2560_free_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring)
663 {
664 	struct rt2560_tx_data *data;
665 	int i;
666 
667 	ral_dma_region_free(sc, &ring->dr_desc);
668 	/* tx buf */
669 	for (i = 0; i < ring->count; i++) {
670 		data = &ring->data[i];
671 		if (data->ni != NULL) {
672 			ieee80211_free_node(data->ni);
673 			data->ni = NULL;
674 		}
675 
676 		ral_dma_region_free(sc, &ring->dr_txbuf[i]);
677 	}
678 
679 	kmem_free(ring->data, ring->count * (sizeof (struct rt2560_tx_data)));
680 	kmem_free(ring->dr_txbuf, ring->count * (sizeof (struct dma_region)));
681 }
682 
683 void
684 rt2560_ring_hwsetup(struct rt2560_softc *sc)
685 {
686 	uint32_t tmp;
687 
688 	/* setup tx rings */
689 	tmp = ((uint32_t)RT2560_PRIO_RING_COUNT << 24) |
690 	    RT2560_ATIM_RING_COUNT << 16 |
691 	    RT2560_TX_RING_COUNT   <<  8 |
692 	    RT2560_TX_DESC_SIZE;
693 
694 	/* rings must be initialized in this exact order */
695 	RAL_WRITE(sc, RT2560_TXCSR2, tmp);
696 	RAL_WRITE(sc, RT2560_TXCSR3, sc->txq.physaddr);
697 	RAL_WRITE(sc, RT2560_TXCSR5, sc->prioq.physaddr);
698 
699 	/* setup rx ring */
700 	tmp = RT2560_RX_RING_COUNT << 8 | RT2560_RX_DESC_SIZE;
701 
702 	RAL_WRITE(sc, RT2560_RXCSR1, tmp);
703 	RAL_WRITE(sc, RT2560_RXCSR2, sc->rxq.physaddr);
704 }
705 
706 int
707 rt2560_alloc_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring,
708 	int count)
709 {
710 	struct rt2560_rx_desc *desc;
711 	struct rt2560_rx_data *data;
712 	int i, err;
713 	int size;
714 
715 	ring->count = count;
716 	ring->cur = ring->next = 0;
717 	ring->cur_decrypt = 0;
718 
719 	ring->data = kmem_zalloc(count * (sizeof (struct rt2560_rx_data)),
720 	    KM_SLEEP);
721 	ring->dr_rxbuf = kmem_zalloc(count * (sizeof (struct dma_region)),
722 	    KM_SLEEP);
723 
724 	err = ral_dma_region_alloc(sc, &ring->dr_desc,
725 	    count * (sizeof (struct rt2560_rx_desc)),
726 	    DDI_DMA_CONSISTENT, DDI_DMA_RDWR | DDI_DMA_CONSISTENT);
727 
728 	if (err != DDI_SUCCESS)
729 		goto fail1;
730 
731 	size = roundup(RAL_RXBUF_SIZE, sc->sc_cachelsz);
732 	for (i = 0; i < count; i++) {
733 		err = ral_dma_region_alloc(sc, &ring->dr_rxbuf[i], size,
734 		    DDI_DMA_STREAMING, DDI_DMA_READ | DDI_DMA_STREAMING);
735 		if (err != DDI_SUCCESS) {
736 			while (i >= 0) {
737 				ral_dma_region_free(sc, &ring->dr_rxbuf[i]);
738 				i--;
739 			}
740 			goto fail2;
741 		}
742 	}
743 
744 	ring->physaddr = ring->dr_desc.dr_pbase;
745 	ring->desc = (struct rt2560_rx_desc *)ring->dr_desc.dr_base;
746 
747 	for (i = 0; i < count; i++) {
748 		desc = &ring->desc[i];
749 		data = &ring->data[i];
750 
751 		desc->physaddr = LE_32(ring->dr_rxbuf[i].dr_pbase);
752 		desc->flags = LE_32(RT2560_RX_BUSY);
753 
754 		data->buf = ring->dr_rxbuf[i].dr_base;
755 	}
756 
757 	return (DDI_SUCCESS);
758 fail2:
759 	ral_dma_region_free(sc, &ring->dr_desc);
760 fail1:
761 	return (err);
762 }
763 
764 /* ARGSUSED */
765 static void
766 rt2560_reset_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring)
767 {
768 	int i;
769 
770 	for (i = 0; i < ring->count; i++) {
771 		ring->desc[i].flags = LE_32(RT2560_RX_BUSY);
772 		ring->data[i].drop = 0;
773 	}
774 
775 	(void) ddi_dma_sync(ring->dr_desc.dr_hnd, 0,
776 	    ring->count * sizeof (struct rt2560_rx_desc),
777 	    DDI_DMA_SYNC_FORKERNEL);
778 
779 	ring->cur = ring->next = 0;
780 	ring->cur_decrypt = 0;
781 }
782 
783 static void
784 rt2560_free_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring)
785 {
786 	int i;
787 
788 	ral_dma_region_free(sc, &ring->dr_desc);
789 	/* rx buf */
790 	for (i = 0; i < ring->count; i++)
791 		ral_dma_region_free(sc, &ring->dr_rxbuf[i]);
792 
793 	kmem_free(ring->data, ring->count * (sizeof (struct rt2560_rx_data)));
794 	kmem_free(ring->dr_rxbuf, ring->count * (sizeof (struct dma_region)));
795 }
796 
797 /* ARGSUSED */
798 static struct ieee80211_node *
799 rt2560_node_alloc(ieee80211com_t *ic)
800 {
801 	struct rt2560_node *rn;
802 
803 	rn = kmem_zalloc(sizeof (struct rt2560_node), KM_SLEEP);
804 	return ((rn != NULL) ? &rn->ni : NULL);
805 }
806 
807 static void
808 rt2560_node_free(struct ieee80211_node *in)
809 {
810 	ieee80211com_t *ic = in->in_ic;
811 
812 	ic->ic_node_cleanup(in);
813 	if (in->in_wpa_ie != NULL)
814 		ieee80211_free(in->in_wpa_ie);
815 	kmem_free(in, sizeof (struct rt2560_node));
816 }
817 
818 /*
819  * This function is called periodically (every 200ms) during scanning to
820  * switch from one channel to another.
821  */
822 static void
823 rt2560_next_scan(void *arg)
824 {
825 	struct rt2560_softc *sc = arg;
826 	struct ieee80211com *ic = &sc->sc_ic;
827 
828 	if (ic->ic_state == IEEE80211_S_SCAN)
829 		(void) ieee80211_next_scan(ic);
830 }
831 
832 /*
833  * This function is called for each node present in the node station table.
834  */
835 /* ARGSUSED */
836 static void
837 rt2560_iter_func(void *arg, struct ieee80211_node *ni)
838 {
839 	struct rt2560_node *rn = (struct rt2560_node *)ni;
840 
841 	ral_rssadapt_updatestats(&rn->rssadapt);
842 }
843 
844 /*
845  * This function is called periodically (every 100ms) in RUN state to update
846  * the rate adaptation statistics.
847  */
848 static void
849 rt2560_update_rssadapt(void *arg)
850 {
851 	struct rt2560_softc *sc = arg;
852 	struct ieee80211com *ic = &sc->sc_ic;
853 
854 	ieee80211_iterate_nodes(&ic->ic_sta, rt2560_iter_func, arg);
855 	sc->sc_rssadapt_id = timeout(rt2560_update_rssadapt, (void *)sc,
856 	    drv_usectohz(100 * 1000));
857 }
858 
859 static void
860 rt2560_statedog(void *arg)
861 {
862 	struct rt2560_softc *sc = arg;
863 	struct ieee80211com *ic = &sc->sc_ic;
864 	enum ieee80211_state state;
865 
866 	RAL_LOCK(sc);
867 
868 	RAL_DEBUG(RAL_DBG_MSG, "rt2560_statedog(...)\n");
869 
870 	sc->sc_state_id = 0;
871 	state = ic->ic_state;
872 	ic->ic_state = sc->sc_ostate;
873 
874 	RAL_UNLOCK(sc);
875 
876 	ieee80211_new_state(ic, state, -1);
877 
878 }
879 
880 static int
881 rt2560_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
882 {
883 	struct rt2560_softc *sc = (struct rt2560_softc *)ic;
884 	enum ieee80211_state ostate;
885 	struct ieee80211_node *ni;
886 	int err;
887 
888 	RAL_LOCK(sc);
889 
890 	ostate = ic->ic_state;
891 	sc->sc_ostate = ostate;
892 
893 	if (sc->sc_scan_id != 0) {
894 		(void) untimeout(sc->sc_scan_id);
895 		sc->sc_scan_id = 0;
896 	}
897 
898 	if (sc->sc_rssadapt_id != 0) {
899 		(void) untimeout(sc->sc_rssadapt_id);
900 		sc->sc_rssadapt_id = 0;
901 	}
902 
903 	if (sc->sc_state_id != 0) {
904 		(void) untimeout(sc->sc_state_id);
905 		sc->sc_state_id = 0;
906 	}
907 
908 	switch (nstate) {
909 	case IEEE80211_S_INIT:
910 		if (ostate == IEEE80211_S_RUN) {
911 			/* abort TSF synchronization */
912 			RAL_WRITE(sc, RT2560_CSR14, 0);
913 			/* turn association led off */
914 			rt2560_update_led(sc, 0, 0);
915 		}
916 		break;
917 
918 	case IEEE80211_S_SCAN:
919 		rt2560_set_chan(sc, ic->ic_curchan);
920 		sc->sc_scan_id = timeout(rt2560_next_scan, (void *)sc,
921 		    drv_usectohz(sc->dwelltime * 1000));
922 		break;
923 
924 	case IEEE80211_S_AUTH:
925 		RAL_DEBUG(RAL_DBG_STATE, "-> IEEE80211_S_AUTH ...\n");
926 		rt2560_set_chan(sc, ic->ic_curchan);
927 		break;
928 
929 	case IEEE80211_S_ASSOC:
930 		RAL_DEBUG(RAL_DBG_STATE, "-> IEEE80211_S_ASSOC ...\n");
931 		rt2560_set_chan(sc, ic->ic_curchan);
932 
933 		drv_usecwait(10 * 1000);	/* dlink */
934 		sc->sc_state_id = timeout(rt2560_statedog, (void *)sc,
935 		    drv_usectohz(300 * 1000));	/* ap7-3 */
936 		break;
937 
938 	case IEEE80211_S_RUN:
939 		RAL_DEBUG(RAL_DBG_STATE, "-> IEEE80211_S_RUN ...\n");
940 		rt2560_set_chan(sc, ic->ic_curchan);
941 
942 		ni = ic->ic_bss;
943 
944 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
945 			rt2560_update_plcp(sc);
946 			rt2560_set_basicrates(sc);
947 			rt2560_set_bssid(sc, ni->in_bssid);
948 		}
949 
950 		/* turn assocation led on */
951 		rt2560_update_led(sc, 1, 0);
952 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
953 			sc->sc_rssadapt_id = timeout(rt2560_update_rssadapt,
954 			    (void *)sc, drv_usectohz(100 * 1000));
955 			rt2560_enable_tsf_sync(sc);
956 		}
957 		break;
958 	}
959 
960 	RAL_UNLOCK(sc);
961 
962 	err = sc->sc_newstate(ic, nstate, arg);
963 	/*
964 	 * Finally, start any timers.
965 	 */
966 	if (nstate == IEEE80211_S_RUN)
967 		ieee80211_start_watchdog(ic, 1);
968 
969 	return (err);
970 }
971 
972 /*
973  * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46 or
974  * 93C66).
975  */
976 static uint16_t
977 rt2560_eeprom_read(struct rt2560_softc *sc, uint8_t addr)
978 {
979 	uint32_t tmp;
980 	uint16_t val;
981 	int n;
982 
983 	/* clock C once before the first command */
984 	RT2560_EEPROM_CTL(sc, 0);
985 
986 	RT2560_EEPROM_CTL(sc, RT2560_S);
987 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
988 	RT2560_EEPROM_CTL(sc, RT2560_S);
989 
990 	/* write start bit (1) */
991 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D);
992 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D | RT2560_C);
993 
994 	/* write READ opcode (10) */
995 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D);
996 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D | RT2560_C);
997 	RT2560_EEPROM_CTL(sc, RT2560_S);
998 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
999 
1000 	/* write address (A5-A0 or A7-A0) */
1001 	n = (RAL_READ(sc, RT2560_CSR21) & RT2560_93C46) ? 5 : 7;
1002 	for (; n >= 0; n--) {
1003 		RT2560_EEPROM_CTL(sc, RT2560_S |
1004 		    (((addr >> n) & 1) << RT2560_SHIFT_D));
1005 		RT2560_EEPROM_CTL(sc, RT2560_S |
1006 		    (((addr >> n) & 1) << RT2560_SHIFT_D) | RT2560_C);
1007 	}
1008 
1009 	RT2560_EEPROM_CTL(sc, RT2560_S);
1010 
1011 	/* read data Q15-Q0 */
1012 	val = 0;
1013 	for (n = 15; n >= 0; n--) {
1014 		RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
1015 		tmp = RAL_READ(sc, RT2560_CSR21);
1016 		val |= ((tmp & RT2560_Q) >> RT2560_SHIFT_Q) << n;
1017 		RT2560_EEPROM_CTL(sc, RT2560_S);
1018 	}
1019 
1020 	RT2560_EEPROM_CTL(sc, 0);
1021 
1022 	/* clear Chip Select and clock C */
1023 	RT2560_EEPROM_CTL(sc, RT2560_S);
1024 	RT2560_EEPROM_CTL(sc, 0);
1025 	RT2560_EEPROM_CTL(sc, RT2560_C);
1026 
1027 	return (val);
1028 }
1029 
1030 static void
1031 rt2560_tx_intr(struct rt2560_softc *sc)
1032 {
1033 	struct ieee80211com *ic = &sc->sc_ic;
1034 	struct rt2560_tx_desc *desc;
1035 	struct rt2560_tx_data *data;
1036 	struct rt2560_node *rn;
1037 
1038 	struct dma_region *dr;
1039 	int count;
1040 
1041 	dr = &sc->txq.dr_desc;
1042 	count = sc->txq.count;
1043 
1044 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1045 	    DDI_DMA_SYNC_FORKERNEL);
1046 
1047 	mutex_enter(&sc->txq.tx_lock);
1048 
1049 	for (;;) {
1050 		desc = &sc->txq.desc[sc->txq.next];
1051 		data = &sc->txq.data[sc->txq.next];
1052 
1053 		if ((LE_32(desc->flags) & RT2560_TX_BUSY) ||
1054 		    (LE_32(desc->flags) & RT2560_TX_CIPHER_BUSY) ||
1055 		    !(LE_32(desc->flags) & RT2560_TX_VALID))
1056 			break;
1057 
1058 		rn = (struct rt2560_node *)data->ni;
1059 
1060 		switch (LE_32(desc->flags) & RT2560_TX_RESULT_MASK) {
1061 		case RT2560_TX_SUCCESS:
1062 			RAL_DEBUG(RAL_DBG_INTR, "data frame sent success\n");
1063 			if (data->id.id_node != NULL) {
1064 				ral_rssadapt_raise_rate(ic, &rn->rssadapt,
1065 				    &data->id);
1066 			}
1067 			break;
1068 
1069 		case RT2560_TX_SUCCESS_RETRY:
1070 			RAL_DEBUG(RAL_DBG_INTR,
1071 			    "data frame sent after %u retries\n",
1072 			    (LE_32(desc->flags) >> 5) & 0x7);
1073 			sc->sc_tx_retries++;
1074 			break;
1075 
1076 		case RT2560_TX_FAIL_RETRY:
1077 			RAL_DEBUG(RAL_DBG_INTR,
1078 			    "sending data frame failed (too much retries)\n");
1079 			if (data->id.id_node != NULL) {
1080 				ral_rssadapt_lower_rate(ic, data->ni,
1081 				    &rn->rssadapt, &data->id);
1082 			}
1083 			break;
1084 
1085 		case RT2560_TX_FAIL_INVALID:
1086 		case RT2560_TX_FAIL_OTHER:
1087 		default:
1088 			RAL_DEBUG(RAL_DBG_INTR, "sending data frame failed "
1089 			    "0x%08x\n", LE_32(desc->flags));
1090 			break;
1091 		}
1092 
1093 		ieee80211_free_node(data->ni);
1094 		data->ni = NULL;
1095 
1096 		/* descriptor is no longer valid */
1097 		desc->flags &= ~LE_32(RT2560_TX_VALID);
1098 
1099 		RAL_DEBUG(RAL_DBG_INTR, "tx done idx=%u\n", sc->txq.next);
1100 
1101 		sc->txq.queued--;
1102 		sc->txq.next = (sc->txq.next + 1) % RT2560_TX_RING_COUNT;
1103 
1104 		if (sc->sc_need_sched &&
1105 		    sc->txq.queued < (RT2560_TX_RING_COUNT - 32)) {
1106 			sc->sc_need_sched = 0;
1107 			mac_tx_update(ic->ic_mach);
1108 		}
1109 	}
1110 
1111 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1112 	    DDI_DMA_SYNC_FORDEV);
1113 
1114 	sc->sc_tx_timer = 0;
1115 	mutex_exit(&sc->txq.tx_lock);
1116 }
1117 
1118 static void
1119 rt2560_prio_intr(struct rt2560_softc *sc)
1120 {
1121 	struct rt2560_tx_desc *desc;
1122 	struct rt2560_tx_data *data;
1123 
1124 	struct dma_region *dr;
1125 	int count;
1126 
1127 	dr = &sc->prioq.dr_desc;
1128 	count = sc->prioq.count;
1129 
1130 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1131 	    DDI_DMA_SYNC_FORKERNEL);
1132 
1133 	mutex_enter(&sc->prioq.tx_lock);
1134 
1135 	for (;;) {
1136 		desc = &sc->prioq.desc[sc->prioq.next];
1137 		data = &sc->prioq.data[sc->prioq.next];
1138 
1139 		if ((LE_32(desc->flags) & RT2560_TX_BUSY) ||
1140 		    !(LE_32(desc->flags) & RT2560_TX_VALID))
1141 			break;
1142 
1143 		switch (LE_32(desc->flags) & RT2560_TX_RESULT_MASK) {
1144 		case RT2560_TX_SUCCESS:
1145 			RAL_DEBUG(RAL_DBG_INTR, "mgt frame sent success\n");
1146 			break;
1147 
1148 		case RT2560_TX_SUCCESS_RETRY:
1149 			RAL_DEBUG(RAL_DBG_INTR,
1150 			    "mgt frame sent after %u retries\n",
1151 			    (LE_32(desc->flags) >> 5) & 0x7);
1152 			break;
1153 
1154 		case RT2560_TX_FAIL_RETRY:
1155 			RAL_DEBUG(RAL_DBG_INTR,
1156 			    "sending mgt frame failed (too much " "retries)\n");
1157 			break;
1158 
1159 		case RT2560_TX_FAIL_INVALID:
1160 		case RT2560_TX_FAIL_OTHER:
1161 		default:
1162 			RAL_DEBUG(RAL_DBG_INTR, "sending mgt frame failed "
1163 			    "0x%08x\n", LE_32(desc->flags));
1164 		}
1165 
1166 		ieee80211_free_node(data->ni);
1167 		data->ni = NULL;
1168 
1169 		/* descriptor is no longer valid */
1170 		desc->flags &= ~LE_32(RT2560_TX_VALID);
1171 
1172 		RAL_DEBUG(RAL_DBG_INTR, "prio done idx=%u\n", sc->prioq.next);
1173 
1174 		sc->prioq.queued--;
1175 		sc->prioq.next = (sc->prioq.next + 1) % RT2560_PRIO_RING_COUNT;
1176 	}
1177 
1178 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1179 	    DDI_DMA_SYNC_FORDEV);
1180 
1181 	sc->sc_tx_timer = 0;
1182 	mutex_exit(&sc->prioq.tx_lock);
1183 }
1184 
1185 /*
1186  * Some frames were received. Pass them to the hardware cipher engine before
1187  * sending them to the 802.11 layer.
1188  */
1189 void
1190 rt2560_rx_intr(struct rt2560_softc *sc)
1191 {
1192 	struct ieee80211com *ic = &sc->sc_ic;
1193 	struct rt2560_rx_desc *desc;
1194 	struct rt2560_rx_data *data;
1195 	struct ieee80211_frame *wh;
1196 	struct ieee80211_node *ni;
1197 	struct rt2560_node *rn;
1198 
1199 	mblk_t *m;
1200 	uint32_t len;
1201 	char *rxbuf;
1202 
1203 	struct dma_region *dr, *dr_bf;
1204 	int count;
1205 
1206 	dr = &sc->rxq.dr_desc;
1207 	count = sc->rxq.count;
1208 
1209 	mutex_enter(&sc->rxq.rx_lock);
1210 
1211 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_RX_DESC_SIZE,
1212 	    DDI_DMA_SYNC_FORKERNEL);
1213 
1214 	for (;;) {
1215 		desc = &sc->rxq.desc[sc->rxq.cur];
1216 		data = &sc->rxq.data[sc->rxq.cur];
1217 
1218 		if ((LE_32(desc->flags) & RT2560_RX_BUSY) ||
1219 		    (LE_32(desc->flags) & RT2560_RX_CIPHER_BUSY))
1220 			break;
1221 
1222 		data->drop = 0;
1223 
1224 		if ((LE_32(desc->flags) & RT2560_RX_PHY_ERROR) ||
1225 		    (LE_32(desc->flags) & RT2560_RX_CRC_ERROR)) {
1226 			/*
1227 			 * This should not happen since we did not request
1228 			 * to receive those frames when we filled RXCSR0.
1229 			 */
1230 			RAL_DEBUG(RAL_DBG_RX, "PHY or CRC error flags 0x%08x\n",
1231 			    LE_32(desc->flags));
1232 			data->drop = 1;
1233 		}
1234 
1235 		if (((LE_32(desc->flags) >> 16) & 0xfff) > RAL_RXBUF_SIZE) {
1236 			RAL_DEBUG(RAL_DBG_RX, "bad length\n");
1237 			data->drop = 1;
1238 		}
1239 
1240 		if (data->drop) {
1241 			sc->sc_rx_err++;
1242 			goto skip;
1243 		}
1244 
1245 		rxbuf = data->buf;
1246 		len = (LE_32(desc->flags) >> 16) & 0xfff;
1247 
1248 		if ((len < sizeof (struct ieee80211_frame_min)) ||
1249 		    (len > RAL_RXBUF_SIZE)) {
1250 			RAL_DEBUG(RAL_DBG_RX, "bad frame length=%u\n", len);
1251 			sc->sc_rx_err++;
1252 			goto skip;
1253 		}
1254 
1255 		if ((m = allocb(len, BPRI_MED)) == NULL) {
1256 			RAL_DEBUG(RAL_DBG_RX, "rt2560_rx_intr():"
1257 			    " allocate mblk failed.\n");
1258 			sc->sc_rx_nobuf++;
1259 			goto skip;
1260 		}
1261 
1262 		dr_bf = &sc->rxq.dr_rxbuf[sc->rxq.cur];
1263 		(void) ddi_dma_sync(dr_bf->dr_hnd, 0, dr_bf->dr_size,
1264 		    DDI_DMA_SYNC_FORCPU);
1265 
1266 		bcopy(rxbuf, m->b_rptr, len);
1267 		m->b_wptr += len;
1268 
1269 		wh = (struct ieee80211_frame *)m->b_rptr;
1270 		ni = ieee80211_find_rxnode(ic, wh);
1271 
1272 		/* give rssi to the rate adatation algorithm */
1273 		rn = (struct rt2560_node *)ni;
1274 		ral_rssadapt_input(ic, ni, &rn->rssadapt, desc->rssi);
1275 
1276 		/* send the frame to the 802.11 layer */
1277 		(void) ieee80211_input(ic, m, ni, desc->rssi, 0);
1278 
1279 		/* node is no longer needed */
1280 		ieee80211_free_node(ni);
1281 
1282 skip:		desc->flags = LE_32(RT2560_RX_BUSY);
1283 		RAL_DEBUG(RAL_DBG_RX, "rx done idx=%u\n", sc->rxq.cur);
1284 
1285 		sc->rxq.cur = (sc->rxq.cur + 1) % RT2560_RX_RING_COUNT;
1286 	}
1287 	mutex_exit(&sc->rxq.rx_lock);
1288 
1289 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1290 	    DDI_DMA_SYNC_FORDEV);
1291 }
1292 
1293 uint_t
1294 ral_softint_handler(caddr_t data)
1295 {
1296 	/* LINTED E_BAD_PTR_CAST_ALIGN */
1297 	struct rt2560_softc *sc = (struct rt2560_softc *)data;
1298 
1299 	/*
1300 	 * Check if the soft interrupt is triggered by another
1301 	 * driver at the same level.
1302 	 */
1303 	RAL_LOCK(sc);
1304 	if (sc->sc_rx_pend) {
1305 		sc->sc_rx_pend = 0;
1306 		RAL_UNLOCK(sc);
1307 		rt2560_rx_intr(sc);
1308 		return (DDI_INTR_CLAIMED);
1309 	}
1310 	RAL_UNLOCK(sc);
1311 	return (DDI_INTR_UNCLAIMED);
1312 }
1313 
1314 /*
1315  * Return the expected ack rate for a frame transmitted at rate `rate'.
1316  * XXX: this should depend on the destination node basic rate set.
1317  */
1318 static int
1319 rt2560_ack_rate(struct ieee80211com *ic, int rate)
1320 {
1321 	switch (rate) {
1322 	/* CCK rates */
1323 	case 2:
1324 		return (2);
1325 	case 4:
1326 	case 11:
1327 	case 22:
1328 		return ((ic->ic_curmode == IEEE80211_MODE_11B) ? 4 : rate);
1329 
1330 	/* OFDM rates */
1331 	case 12:
1332 	case 18:
1333 		return (12);
1334 	case 24:
1335 	case 36:
1336 		return (24);
1337 	case 48:
1338 	case 72:
1339 	case 96:
1340 	case 108:
1341 		return (48);
1342 	}
1343 
1344 	/* default to 1Mbps */
1345 	return (2);
1346 }
1347 
1348 /*
1349  * Compute the duration (in us) needed to transmit `len' bytes at rate `rate'.
1350  * The function automatically determines the operating mode depending on the
1351  * given rate. `flags' indicates whether short preamble is in use or not.
1352  */
1353 static uint16_t
1354 rt2560_txtime(int len, int rate, uint32_t flags)
1355 {
1356 	uint16_t txtime;
1357 
1358 	if (RAL_RATE_IS_OFDM(rate)) {
1359 		/* IEEE Std 802.11a-1999, pp. 37 */
1360 		txtime = (8 + 4 * len + 3 + rate - 1) / rate;
1361 		txtime = 16 + 4 + 4 * txtime + 6;
1362 	} else {
1363 		/* IEEE Std 802.11b-1999, pp. 28 */
1364 		txtime = (16 * len + rate - 1) / rate;
1365 		if (rate != 2 && (flags & IEEE80211_F_SHPREAMBLE))
1366 			txtime +=  72 + 24;
1367 		else
1368 			txtime += 144 + 48;
1369 	}
1370 
1371 	return (txtime);
1372 }
1373 
1374 static uint8_t
1375 rt2560_plcp_signal(int rate)
1376 {
1377 	switch (rate) {
1378 	/* CCK rates (returned values are device-dependent) */
1379 	case 2:		return (0x0);
1380 	case 4:		return (0x1);
1381 	case 11:	return (0x2);
1382 	case 22:	return (0x3);
1383 
1384 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1385 	case 12:	return (0xb);
1386 	case 18:	return (0xf);
1387 	case 24:	return (0xa);
1388 	case 36:	return (0xe);
1389 	case 48:	return (0x9);
1390 	case 72:	return (0xd);
1391 	case 96:	return (0x8);
1392 	case 108:	return (0xc);
1393 
1394 	/* unsupported rates (should not get there) */
1395 	default:	return (0xff);
1396 	}
1397 }
1398 
1399 void
1400 rt2560_setup_tx_desc(struct rt2560_softc *sc, struct rt2560_tx_desc *desc,
1401     uint32_t flags, int len, int rate, int encrypt)
1402 {
1403 	struct ieee80211com *ic = &sc->sc_ic;
1404 	uint16_t plcp_length;
1405 	int remainder;
1406 
1407 	desc->flags = LE_32(flags);
1408 	desc->flags |= LE_32(len << 16);
1409 	desc->flags |= encrypt ? LE_32(RT2560_TX_CIPHER_BUSY) :
1410 	    LE_32(RT2560_TX_BUSY | RT2560_TX_VALID);
1411 
1412 	desc->wme = LE_16(
1413 	    RT2560_AIFSN(2) |
1414 	    RT2560_LOGCWMIN(3) |
1415 	    RT2560_LOGCWMAX(8));
1416 
1417 	/* setup PLCP fields */
1418 	desc->plcp_signal  = rt2560_plcp_signal(rate);
1419 	desc->plcp_service = 4;
1420 
1421 	len += IEEE80211_CRC_LEN;
1422 	if (RAL_RATE_IS_OFDM(rate)) {
1423 		desc->flags |= LE_32(RT2560_TX_OFDM);
1424 
1425 		plcp_length = len & 0xfff;
1426 		desc->plcp_length_hi = plcp_length >> 6;
1427 		desc->plcp_length_lo = plcp_length & 0x3f;
1428 	} else {
1429 		plcp_length = (16 * len + rate - 1) / rate;
1430 		if (rate == 22) {
1431 			remainder = (16 * len) % 22;
1432 			if (remainder != 0 && remainder < 7)
1433 				desc->plcp_service |= RT2560_PLCP_LENGEXT;
1434 		}
1435 		desc->plcp_length_hi = plcp_length >> 8;
1436 		desc->plcp_length_lo = plcp_length & 0xff;
1437 
1438 		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1439 			desc->plcp_signal |= 0x08;
1440 	}
1441 }
1442 
1443 /* ARGSUSED */
1444 int
1445 rt2560_mgmt_send(ieee80211com_t *ic, mblk_t *mp, uint8_t type)
1446 {
1447 	struct rt2560_softc *sc = (struct rt2560_softc *)ic;
1448 	struct rt2560_tx_desc *desc;
1449 	struct rt2560_tx_data *data;
1450 	struct ieee80211_frame *wh;
1451 	uint16_t dur;
1452 	uint32_t flags = 0;
1453 	int rate, err = DDI_SUCCESS;
1454 
1455 	int off, pktlen, mblen;
1456 	caddr_t dest;
1457 	mblk_t *m, *m0;
1458 
1459 	struct dma_region *dr;
1460 	uint32_t idx;
1461 	struct ieee80211_node *ni;
1462 	struct ieee80211_key *k;
1463 
1464 	mutex_enter(&sc->prioq.tx_lock);
1465 
1466 	if (!RAL_IS_RUNNING(sc)) {
1467 		err = ENXIO;
1468 		goto fail1;
1469 	}
1470 
1471 	if (sc->prioq.queued >= RT2560_PRIO_RING_COUNT) {
1472 		err = ENOMEM;
1473 		sc->sc_tx_nobuf++;
1474 		goto fail1;
1475 	}
1476 
1477 	m = allocb(msgdsize(mp) + 32, BPRI_MED);
1478 	if (m == NULL) {
1479 		RAL_DEBUG(RAL_DBG_TX, "rt2560_mgmt_send: can't alloc mblk.\n");
1480 		err = DDI_FAILURE;
1481 		goto fail1;
1482 	}
1483 
1484 	for (off = 0, m0 = mp; m0 != NULL; m0 = m0->b_cont) {
1485 		mblen = MBLKL(m0);
1486 		(void) memcpy(m->b_rptr + off, m0->b_rptr, mblen);
1487 		off += mblen;
1488 	}
1489 	m->b_wptr += off;
1490 
1491 	wh = (struct ieee80211_frame *)m->b_rptr;
1492 	ni = ieee80211_find_txnode(ic, wh->i_addr1);
1493 
1494 	if (ni == NULL) {
1495 		err = DDI_FAILURE;
1496 		sc->sc_tx_err++;
1497 		goto fail2;
1498 	}
1499 
1500 	/* to support shared_key auth mode */
1501 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1502 		k = ieee80211_crypto_encap(ic, m);
1503 		if (k == NULL) {
1504 			err = DDI_FAILURE;
1505 			sc->sc_tx_err++;
1506 			goto fail3;
1507 		}
1508 		/* packet header may have moved, reset our local pointer */
1509 		wh = (struct ieee80211_frame *)m->b_rptr;
1510 	}
1511 
1512 	desc = &sc->prioq.desc[sc->prioq.cur];
1513 	data = &sc->prioq.data[sc->prioq.cur];
1514 
1515 	rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
1516 	data->ni = ieee80211_ref_node(ni);
1517 
1518 	pktlen = msgdsize(m);
1519 	dest = data->buf;
1520 	bcopy(m->b_rptr, dest, pktlen);
1521 
1522 	wh = (struct ieee80211_frame *)m->b_rptr;
1523 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1524 		flags |= RT2560_TX_ACK;
1525 
1526 		dur = rt2560_txtime(RAL_ACK_SIZE, rate, ic->ic_flags) +
1527 		    RAL_SIFS;
1528 		/* LINTED E_BAD_PTR_CAST_ALIGN */
1529 		*(uint16_t *)wh->i_dur = LE_16(dur);
1530 
1531 		/* tell hardware to add timestamp for probe responses */
1532 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1533 		    IEEE80211_FC0_TYPE_MGT &&
1534 		    (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1535 		    IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1536 			flags |= RT2560_TX_TIMESTAMP;
1537 	}
1538 
1539 	rt2560_setup_tx_desc(sc, desc, flags, pktlen, rate, 0);
1540 
1541 	idx = sc->prioq.cur;
1542 
1543 	dr = &sc->prioq.dr_txbuf[idx];
1544 	(void) ddi_dma_sync(dr->dr_hnd, 0, RAL_TXBUF_SIZE, DDI_DMA_SYNC_FORDEV);
1545 
1546 	dr = &sc->prioq.dr_desc;
1547 	(void) ddi_dma_sync(dr->dr_hnd, idx * RT2560_TX_DESC_SIZE,
1548 	    RT2560_TX_DESC_SIZE, DDI_DMA_SYNC_FORDEV);
1549 
1550 	RAL_DEBUG(RAL_DBG_MGMT, "sending mgt frame len=%u idx=%u rate=%u\n",
1551 	    pktlen, sc->prioq.cur, rate);
1552 
1553 	/* kick prio */
1554 	sc->prioq.queued++; /* IF > RT2560_PRIO_RING_COUNT? FULL */
1555 	sc->prioq.cur = (sc->prioq.cur + 1) % RT2560_PRIO_RING_COUNT;
1556 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_PRIO);
1557 
1558 	sc->sc_tx_timer = 5;
1559 
1560 	ic->ic_stats.is_tx_frags++;
1561 	ic->ic_stats.is_tx_bytes += pktlen;
1562 
1563 fail3:
1564 	ieee80211_free_node(ni);
1565 fail2:
1566 	freemsg(m);
1567 fail1:
1568 	freemsg(mp);
1569 	mutex_exit(&sc->prioq.tx_lock);
1570 
1571 	return (err);
1572 }
1573 
1574 static int
1575 rt2560_send(ieee80211com_t *ic, mblk_t *mp)
1576 {
1577 	struct rt2560_softc *sc = (struct rt2560_softc *)ic;
1578 	struct rt2560_tx_desc *desc;
1579 	struct rt2560_tx_data *data;
1580 	struct rt2560_node *rn;
1581 	struct ieee80211_rateset *rs;
1582 	struct ieee80211_frame *wh;
1583 	struct ieee80211_key *k;
1584 	uint16_t dur;
1585 	uint32_t flags = 0;
1586 	int rate, err = DDI_SUCCESS;
1587 
1588 	struct ieee80211_node *ni;
1589 	mblk_t *m, *m0;
1590 	int off, mblen, pktlen;
1591 	caddr_t dest;
1592 
1593 	struct dma_region *dr;
1594 	uint32_t idx;
1595 
1596 	mutex_enter(&sc->txq.tx_lock);
1597 
1598 	if (sc->txq.queued >= RT2560_TX_RING_COUNT - 1) {
1599 		RAL_DEBUG(RAL_DBG_TX, "ral: rt2560_tx_data(): "
1600 		    "no TX DMA buffer available!\n");
1601 		sc->sc_need_sched = 1;
1602 		sc->sc_tx_nobuf++;
1603 		err = ENOMEM;
1604 		goto fail1;
1605 	}
1606 
1607 	m = allocb(msgdsize(mp) + 32, BPRI_MED);
1608 	if (m == NULL) {
1609 		RAL_DEBUG(RAL_DBG_TX, "rt2560_xmit(): can't alloc mblk.\n");
1610 		err = DDI_FAILURE;
1611 		goto fail1;
1612 	}
1613 
1614 	for (off = 0, m0 = mp; m0 != NULL; m0 = m0->b_cont) {
1615 		mblen = MBLKL(m0);
1616 		(void) memcpy(m->b_rptr + off, m0->b_rptr, mblen);
1617 		off += mblen;
1618 	}
1619 	m->b_wptr += off;
1620 
1621 	wh = (struct ieee80211_frame *)m->b_rptr;
1622 	ni = ieee80211_find_txnode(ic, wh->i_addr1);
1623 
1624 	if (ni == NULL) {
1625 		err = DDI_FAILURE;
1626 		sc->sc_tx_err++;
1627 		goto fail2;
1628 	}
1629 
1630 	(void) ieee80211_encap(ic, m, ni);
1631 
1632 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1633 		k = ieee80211_crypto_encap(ic, m);
1634 		if (k == NULL) {
1635 			sc->sc_tx_err++;
1636 			err = DDI_FAILURE;
1637 			goto fail3;
1638 		}
1639 		/* packet header may have moved, reset our local pointer */
1640 		wh = (struct ieee80211_frame *)m->b_rptr;
1641 	}
1642 
1643 	/*
1644 	 * RTS/CTS exchange ignore, since the max packet will less than
1645 	 * the rtsthreshold (2346)
1646 	 * Unnecessary codes deleted.
1647 	 */
1648 
1649 	data = &sc->txq.data[sc->txq.cur];
1650 	desc = &sc->txq.desc[sc->txq.cur];
1651 
1652 	data->ni = ieee80211_ref_node(ni);
1653 
1654 	pktlen = msgdsize(m);
1655 	dest = data->buf;
1656 	bcopy(m->b_rptr, dest, pktlen);
1657 
1658 	if (ic->ic_fixed_rate != IEEE80211_FIXED_RATE_NONE) {
1659 		rs = &ic->ic_sup_rates[ic->ic_curmode];
1660 		rate = rs->ir_rates[ic->ic_fixed_rate];
1661 	} else {
1662 		rs = &ni->in_rates;
1663 		rn = (struct rt2560_node *)ni;
1664 		ni->in_txrate = ral_rssadapt_choose(&rn->rssadapt, rs, wh,
1665 		    pktlen, NULL, 0);
1666 		rate = rs->ir_rates[ni->in_txrate];
1667 	}
1668 
1669 	rate &= IEEE80211_RATE_VAL;
1670 	if (rate <= 0) {
1671 		rate = 2;	/* basic rate */
1672 	}
1673 
1674 	/* remember link conditions for rate adaptation algorithm */
1675 	if (ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE) {
1676 		data->id.id_len = pktlen;
1677 		data->id.id_rateidx = ni->in_txrate;
1678 		data->id.id_node = ni;
1679 		data->id.id_rssi = ni->in_rssi;
1680 	} else
1681 		data->id.id_node = NULL;
1682 
1683 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1684 		flags |= RT2560_TX_ACK;
1685 
1686 		dur = rt2560_txtime(RAL_ACK_SIZE, rt2560_ack_rate(ic, rate),
1687 		    ic->ic_flags) + RAL_SIFS;
1688 		/* LINTED E_BAD_PTR_CAST_ALIGN */
1689 		*(uint16_t *)wh->i_dur = LE_16(dur);
1690 	}
1691 
1692 	/* flags |= RT2560_TX_CIPHER_NONE; */
1693 	rt2560_setup_tx_desc(sc, desc, flags, pktlen, rate, 0);
1694 
1695 	idx = sc->txq.cur;
1696 
1697 	dr = &sc->txq.dr_txbuf[idx];
1698 	(void) ddi_dma_sync(dr->dr_hnd, 0, RAL_TXBUF_SIZE, DDI_DMA_SYNC_FORDEV);
1699 
1700 	dr = &sc->txq.dr_desc;
1701 	(void) ddi_dma_sync(dr->dr_hnd, idx * RT2560_TX_DESC_SIZE,
1702 	    RT2560_TX_DESC_SIZE, DDI_DMA_SYNC_FORDEV);
1703 
1704 	RAL_DEBUG(RAL_DBG_TX, "sending data frame len=%u idx=%u rate=%u\n",
1705 	    pktlen, sc->txq.cur, rate);
1706 
1707 	/* kick tx */
1708 	sc->txq.queued++;
1709 	sc->txq.cur = (sc->txq.cur + 1) % RT2560_TX_RING_COUNT;
1710 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_TX);
1711 
1712 	sc->sc_tx_timer = 5;
1713 
1714 	ic->ic_stats.is_tx_frags++;
1715 	ic->ic_stats.is_tx_bytes += pktlen;
1716 
1717 	freemsg(mp);
1718 fail3:
1719 	ieee80211_free_node(ni);
1720 fail2:
1721 	freemsg(m);
1722 fail1:
1723 	mutex_exit(&sc->txq.tx_lock);
1724 	return (err);
1725 }
1726 
1727 static mblk_t *
1728 rt2560_m_tx(void *arg, mblk_t *mp)
1729 {
1730 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
1731 	struct ieee80211com *ic = &sc->sc_ic;
1732 	mblk_t *next;
1733 
1734 	if (!RAL_IS_RUNNING(sc)) {
1735 		freemsgchain(mp);
1736 		return (NULL);
1737 	}
1738 	/*
1739 	 * No data frames go out unless we're associated; this
1740 	 * should not happen as the 802.11 layer does not enable
1741 	 * the xmit queue until we enter the RUN state.
1742 	 */
1743 	if (ic->ic_state != IEEE80211_S_RUN) {
1744 		RAL_DEBUG(RAL_DBG_TX, "ral: rt2560_m_tx(): "
1745 		    "discard, state %u\n", ic->ic_state);
1746 		freemsgchain(mp);
1747 		return (NULL);
1748 	}
1749 
1750 	while (mp != NULL) {
1751 		next = mp->b_next;
1752 		mp->b_next = NULL;
1753 		if (rt2560_send(ic, mp) != DDI_SUCCESS) {
1754 			mp->b_next = next;
1755 			freemsgchain(mp);
1756 			return (NULL);
1757 		}
1758 		mp = next;
1759 	}
1760 	return (mp);
1761 }
1762 
1763 static void
1764 rt2560_set_macaddr(struct rt2560_softc *sc, uint8_t *addr)
1765 {
1766 	uint32_t tmp;
1767 
1768 	tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
1769 	RAL_WRITE(sc, RT2560_CSR3, tmp);
1770 
1771 	tmp = addr[4] | addr[5] << 8;
1772 	RAL_WRITE(sc, RT2560_CSR4, tmp);
1773 
1774 	RAL_DEBUG(RAL_DBG_HW,
1775 	    "setting MAC address to " MACSTR "\n", MAC2STR(addr));
1776 }
1777 
1778 static void
1779 rt2560_get_macaddr(struct rt2560_softc *sc, uint8_t *addr)
1780 {
1781 	uint32_t tmp;
1782 
1783 	tmp = RAL_READ(sc, RT2560_CSR3);
1784 	addr[0] = tmp & 0xff;
1785 	addr[1] = (tmp >>  8) & 0xff;
1786 	addr[2] = (tmp >> 16) & 0xff;
1787 	addr[3] = (tmp >> 24);
1788 
1789 	tmp = RAL_READ(sc, RT2560_CSR4);
1790 	addr[4] = tmp & 0xff;
1791 	addr[5] = (tmp >> 8) & 0xff;
1792 }
1793 
1794 static void
1795 rt2560_update_promisc(struct rt2560_softc *sc)
1796 {
1797 	uint32_t tmp;
1798 
1799 	tmp = RAL_READ(sc, RT2560_RXCSR0);
1800 	tmp &= ~RT2560_DROP_NOT_TO_ME;
1801 	if (!(sc->sc_rcr & RAL_RCR_PROMISC))
1802 		tmp |= RT2560_DROP_NOT_TO_ME;
1803 
1804 	RAL_WRITE(sc, RT2560_RXCSR0, tmp);
1805 	RAL_DEBUG(RAL_DBG_HW, "%s promiscuous mode\n",
1806 	    (sc->sc_rcr & RAL_RCR_PROMISC) ?  "entering" : "leaving");
1807 }
1808 
1809 static const char *
1810 rt2560_get_rf(int rev)
1811 {
1812 	switch (rev) {
1813 	case RT2560_RF_2522:	return ("RT2522");
1814 	case RT2560_RF_2523:	return ("RT2523");
1815 	case RT2560_RF_2524:	return ("RT2524");
1816 	case RT2560_RF_2525:	return ("RT2525");
1817 	case RT2560_RF_2525E:	return ("RT2525e");
1818 	case RT2560_RF_2526:	return ("RT2526");
1819 	case RT2560_RF_5222:	return ("RT5222");
1820 	default:		return ("unknown");
1821 	}
1822 }
1823 
1824 static void
1825 rt2560_read_eeprom(struct rt2560_softc *sc)
1826 {
1827 	uint16_t val;
1828 	int i;
1829 
1830 	val = rt2560_eeprom_read(sc, RT2560_EEPROM_CONFIG0);
1831 	sc->rf_rev =   (val >> 11) & 0x7;
1832 	sc->hw_radio = (val >> 10) & 0x1;
1833 	sc->led_mode = (val >> 6)  & 0x7;
1834 	sc->rx_ant =   (val >> 4)  & 0x3;
1835 	sc->tx_ant =   (val >> 2)  & 0x3;
1836 	sc->nb_ant =   val & 0x3;
1837 
1838 	/* read default values for BBP registers */
1839 	for (i = 0; i < 16; i++) {
1840 		val = rt2560_eeprom_read(sc, RT2560_EEPROM_BBP_BASE + i);
1841 		sc->bbp_prom[i].reg = val >> 8;
1842 		sc->bbp_prom[i].val = val & 0xff;
1843 	}
1844 
1845 	/* read Tx power for all b/g channels */
1846 	for (i = 0; i < 14 / 2; i++) {
1847 		val = rt2560_eeprom_read(sc, RT2560_EEPROM_TXPOWER + i);
1848 		sc->txpow[i * 2] = val >> 8;
1849 		sc->txpow[i * 2 + 1] = val & 0xff;
1850 	}
1851 }
1852 
1853 static int
1854 rt2560_bbp_init(struct rt2560_softc *sc)
1855 {
1856 #define	N(a)	(sizeof (a) / sizeof ((a)[0]))
1857 	int i, ntries;
1858 
1859 	/* wait for BBP to be ready */
1860 	for (ntries = 0; ntries < 100; ntries++) {
1861 		if (rt2560_bbp_read(sc, RT2560_BBP_VERSION) != 0)
1862 			break;
1863 		drv_usecwait(1);
1864 	}
1865 	if (ntries == 100) {
1866 		RAL_DEBUG(RAL_DBG_HW, "timeout waiting for BBP\n");
1867 		return (EIO);
1868 	}
1869 	/* initialize BBP registers to default values */
1870 	for (i = 0; i < N(rt2560_def_bbp); i++) {
1871 		rt2560_bbp_write(sc, rt2560_def_bbp[i].reg,
1872 		    rt2560_def_bbp[i].val);
1873 	}
1874 
1875 	return (0);
1876 #undef N
1877 }
1878 
1879 static void
1880 rt2560_set_txantenna(struct rt2560_softc *sc, int antenna)
1881 {
1882 	uint32_t tmp;
1883 	uint8_t tx;
1884 
1885 	tx = rt2560_bbp_read(sc, RT2560_BBP_TX) & ~RT2560_BBP_ANTMASK;
1886 	if (antenna == 1)
1887 		tx |= RT2560_BBP_ANTA;
1888 	else if (antenna == 2)
1889 		tx |= RT2560_BBP_ANTB;
1890 	else
1891 		tx |= RT2560_BBP_DIVERSITY;
1892 
1893 	/* need to force I/Q flip for RF 2525e, 2526 and 5222 */
1894 	if (sc->rf_rev == RT2560_RF_2525E || sc->rf_rev == RT2560_RF_2526 ||
1895 	    sc->rf_rev == RT2560_RF_5222)
1896 		tx |= RT2560_BBP_FLIPIQ;
1897 
1898 	rt2560_bbp_write(sc, RT2560_BBP_TX, tx);
1899 
1900 	/* update values for CCK and OFDM in BBPCSR1 */
1901 	tmp = RAL_READ(sc, RT2560_BBPCSR1) & ~0x00070007;
1902 	tmp |= (tx & 0x7) << 16 | (tx & 0x7);
1903 	RAL_WRITE(sc, RT2560_BBPCSR1, tmp);
1904 }
1905 
1906 static void
1907 rt2560_set_rxantenna(struct rt2560_softc *sc, int antenna)
1908 {
1909 	uint8_t rx;
1910 
1911 	rx = rt2560_bbp_read(sc, RT2560_BBP_RX) & ~RT2560_BBP_ANTMASK;
1912 	if (antenna == 1)
1913 		rx |= RT2560_BBP_ANTA;
1914 	else if (antenna == 2)
1915 		rx |= RT2560_BBP_ANTB;
1916 	else
1917 		rx |= RT2560_BBP_DIVERSITY;
1918 
1919 	/* need to force no I/Q flip for RF 2525e and 2526 */
1920 	if (sc->rf_rev == RT2560_RF_2525E || sc->rf_rev == RT2560_RF_2526)
1921 		rx &= ~RT2560_BBP_FLIPIQ;
1922 
1923 	rt2560_bbp_write(sc, RT2560_BBP_RX, rx);
1924 }
1925 
1926 static void
1927 rt2560_stop(struct rt2560_softc *sc)
1928 {
1929 	struct ieee80211com *ic = &sc->sc_ic;
1930 
1931 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
1932 	ieee80211_stop_watchdog(ic);	/* stop the watchdog */
1933 
1934 	RAL_LOCK(sc);
1935 	sc->sc_tx_timer = 0;
1936 
1937 	/* abort Tx */
1938 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_ABORT_TX);
1939 
1940 	/* disable Rx */
1941 	RAL_WRITE(sc, RT2560_RXCSR0, RT2560_DISABLE_RX);
1942 
1943 	/* reset ASIC (imply reset BBP) */
1944 	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
1945 	RAL_WRITE(sc, RT2560_CSR1, 0);
1946 
1947 	/* disable interrupts */
1948 	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
1949 
1950 	/* reset Tx and Rx rings */
1951 	rt2560_reset_tx_ring(sc, &sc->txq);
1952 	rt2560_reset_tx_ring(sc, &sc->prioq);
1953 	rt2560_reset_rx_ring(sc, &sc->rxq);
1954 	RAL_UNLOCK(sc);
1955 }
1956 
1957 static int
1958 rt2560_init(struct rt2560_softc *sc)
1959 {
1960 #define	N(a)	(sizeof (a) / sizeof ((a)[0]))
1961 	/* struct rt2560_softc *sc = priv; */
1962 	struct ieee80211com *ic = &sc->sc_ic;
1963 	uint32_t tmp;
1964 	int i;
1965 
1966 	rt2560_stop(sc);
1967 
1968 	RAL_LOCK(sc);
1969 	/* setup tx/rx ring */
1970 	rt2560_ring_hwsetup(sc);
1971 
1972 	/* initialize MAC registers to default values */
1973 	for (i = 0; i < N(rt2560_def_mac); i++)
1974 		RAL_WRITE(sc, rt2560_def_mac[i].reg, rt2560_def_mac[i].val);
1975 
1976 	rt2560_set_macaddr(sc, ic->ic_macaddr);
1977 
1978 	/* set basic rate set (will be updated later) */
1979 	RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x153);
1980 
1981 	rt2560_set_txantenna(sc, sc->tx_ant);
1982 	rt2560_set_rxantenna(sc, sc->rx_ant);
1983 	rt2560_update_slot(ic, 1);
1984 	rt2560_update_plcp(sc);
1985 	rt2560_update_led(sc, 0, 0);
1986 
1987 	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
1988 	RAL_WRITE(sc, RT2560_CSR1, RT2560_HOST_READY);
1989 
1990 	if (rt2560_bbp_init(sc) != 0) {
1991 		RAL_UNLOCK(sc);
1992 		rt2560_stop(sc);
1993 		return (DDI_FAILURE);
1994 	}
1995 
1996 	/* set default BSS channel */
1997 	rt2560_set_chan(sc, ic->ic_curchan);
1998 
1999 	/* kick Rx */
2000 	tmp = RT2560_DROP_PHY_ERROR | RT2560_DROP_CRC_ERROR;
2001 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2002 		tmp |= RT2560_DROP_CTL | RT2560_DROP_VERSION_ERROR;
2003 		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
2004 			tmp |= RT2560_DROP_TODS;
2005 		if (!(sc->sc_rcr & RAL_RCR_PROMISC))
2006 			tmp |= RT2560_DROP_NOT_TO_ME;
2007 
2008 	}
2009 	RAL_WRITE(sc, RT2560_RXCSR0, tmp);
2010 
2011 	/* clear old FCS and Rx FIFO errors */
2012 	(void) RAL_READ(sc, RT2560_CNT0);
2013 	(void) RAL_READ(sc, RT2560_CNT4);
2014 
2015 	/* clear any pending interrupts */
2016 	RAL_WRITE(sc, RT2560_CSR7, 0xffffffff);
2017 	/* enable interrupts */
2018 	RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
2019 
2020 	RAL_UNLOCK(sc);
2021 #undef N
2022 	return (DDI_SUCCESS);
2023 }
2024 
2025 void
2026 rt2560_watchdog(void *arg)
2027 {
2028 	struct rt2560_softc *sc = arg;
2029 	struct ieee80211com *ic = &sc->sc_ic;
2030 	int ntimer = 0;
2031 
2032 	RAL_LOCK(sc);
2033 	ic->ic_watchdog_timer = 0;
2034 
2035 	if (!RAL_IS_RUNNING(sc)) {
2036 		RAL_UNLOCK(sc);
2037 		return;
2038 	}
2039 
2040 	if (sc->sc_tx_timer > 0) {
2041 		if (--sc->sc_tx_timer == 0) {
2042 			RAL_DEBUG(RAL_DBG_MSG, "tx timer timeout\n");
2043 			RAL_UNLOCK(sc);
2044 			(void) rt2560_init(sc);
2045 			(void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2046 			return;
2047 		}
2048 	}
2049 
2050 	if (ic->ic_state == IEEE80211_S_RUN)
2051 		ntimer = 1;
2052 
2053 	RAL_UNLOCK(sc);
2054 
2055 	ieee80211_watchdog(ic);
2056 
2057 	if (ntimer)
2058 		ieee80211_start_watchdog(ic, ntimer);
2059 }
2060 
2061 static int
2062 rt2560_m_start(void *arg)
2063 {
2064 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2065 	crypto_mech_type_t type;
2066 	int err;
2067 
2068 
2069 	type = crypto_mech2id(SUN_CKM_RC4); /* load rc4 module into kernel */
2070 	RAL_DEBUG(RAL_DBG_GLD, "enter rt2560_m_start(%d)\n", type);
2071 
2072 	/*
2073 	 * initialize rt2560 hardware
2074 	 */
2075 	err = rt2560_init(sc);
2076 	if (err != DDI_SUCCESS) {
2077 		RAL_DEBUG(RAL_DBG_GLD, "device configuration failed\n");
2078 		goto fail;
2079 	}
2080 	sc->sc_flags |= RAL_FLAG_RUNNING;	/* RUNNING */
2081 	return (err);
2082 
2083 fail:
2084 	rt2560_stop(sc);
2085 	return (err);
2086 }
2087 
2088 static void
2089 rt2560_m_stop(void *arg)
2090 {
2091 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2092 
2093 	RAL_DEBUG(RAL_DBG_GLD, "enter rt2560_m_stop()\n");
2094 
2095 	(void) rt2560_stop(sc);
2096 	sc->sc_flags &= ~RAL_FLAG_RUNNING;	/* STOP */
2097 }
2098 
2099 static int
2100 rt2560_m_unicst(void *arg, const uint8_t *macaddr)
2101 {
2102 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2103 	struct ieee80211com *ic = &sc->sc_ic;
2104 
2105 	RAL_DEBUG(RAL_DBG_GLD, "rt2560_m_unicst(): " MACSTR "\n",
2106 	    MAC2STR(macaddr));
2107 
2108 	IEEE80211_ADDR_COPY(ic->ic_macaddr, macaddr);
2109 	(void) rt2560_set_macaddr(sc, (uint8_t *)macaddr);
2110 	(void) rt2560_init(sc);
2111 
2112 	return (0);
2113 }
2114 
2115 /*ARGSUSED*/
2116 static int
2117 rt2560_m_multicst(void *arg, boolean_t add, const uint8_t *mca)
2118 {
2119 	return (0);
2120 }
2121 
2122 static int
2123 rt2560_m_promisc(void *arg, boolean_t on)
2124 {
2125 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2126 
2127 	RAL_DEBUG(RAL_DBG_GLD, "rt2560_m_promisc()\n");
2128 
2129 	if (on) {
2130 		sc->sc_rcr |= RAL_RCR_PROMISC;
2131 		sc->sc_rcr |= RAL_RCR_MULTI;
2132 	} else {
2133 		sc->sc_rcr &= ~RAL_RCR_PROMISC;
2134 		sc->sc_rcr &= ~RAL_RCR_PROMISC;
2135 	}
2136 
2137 	rt2560_update_promisc(sc);
2138 	return (0);
2139 }
2140 
2141 /*
2142  * callback functions for /get/set properties
2143  */
2144 static int
2145 rt2560_m_setprop(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
2146     uint_t wldp_length, const void *wldp_buf)
2147 {
2148 	struct rt2560_softc *sc = arg;
2149 	struct ieee80211com *ic = &sc->sc_ic;
2150 	int err;
2151 
2152 	err = ieee80211_setprop(ic, pr_name, wldp_pr_num,
2153 	    wldp_length, wldp_buf);
2154 	RAL_LOCK(sc);
2155 	if (err == ENETRESET) {
2156 		if (RAL_IS_RUNNING(sc)) {
2157 			RAL_UNLOCK(sc);
2158 			(void) rt2560_init(sc);
2159 			(void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2160 			RAL_LOCK(sc);
2161 		}
2162 		err = 0;
2163 	}
2164 	RAL_UNLOCK(sc);
2165 
2166 	return (err);
2167 }
2168 
2169 static int
2170 rt2560_m_getprop(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
2171     uint_t pr_flags, uint_t wldp_length, void *wldp_buf, uint_t *perm)
2172 {
2173 	struct rt2560_softc *sc = arg;
2174 	int err;
2175 
2176 	err = ieee80211_getprop(&sc->sc_ic, pr_name, wldp_pr_num,
2177 	    pr_flags, wldp_length, wldp_buf, perm);
2178 
2179 	return (err);
2180 }
2181 
2182 static void
2183 rt2560_m_ioctl(void* arg, queue_t *wq, mblk_t *mp)
2184 {
2185 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2186 	struct ieee80211com *ic = &sc->sc_ic;
2187 	int err;
2188 
2189 	err = ieee80211_ioctl(ic, wq, mp);
2190 	RAL_LOCK(sc);
2191 	if (err == ENETRESET) {
2192 		if (RAL_IS_RUNNING(sc)) {
2193 			RAL_UNLOCK(sc);
2194 			(void) rt2560_init(sc);
2195 			(void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2196 			RAL_LOCK(sc);
2197 		}
2198 	}
2199 	RAL_UNLOCK(sc);
2200 }
2201 
2202 static int
2203 rt2560_m_stat(void *arg, uint_t stat, uint64_t *val)
2204 {
2205 	struct rt2560_softc *sc  = (struct rt2560_softc *)arg;
2206 	ieee80211com_t	*ic = &sc->sc_ic;
2207 	ieee80211_node_t *ni = ic->ic_bss;
2208 	struct ieee80211_rateset *rs = &ni->in_rates;
2209 
2210 	RAL_LOCK(sc);
2211 	switch (stat) {
2212 	case MAC_STAT_IFSPEED:
2213 		*val = ((ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE) ?
2214 		    (rs->ir_rates[ni->in_txrate] & IEEE80211_RATE_VAL)
2215 		    : ic->ic_fixed_rate) / 2 * 1000000;
2216 		break;
2217 	case MAC_STAT_NOXMTBUF:
2218 		*val = sc->sc_tx_nobuf;
2219 		break;
2220 	case MAC_STAT_NORCVBUF:
2221 		*val = sc->sc_rx_nobuf;
2222 		break;
2223 	case MAC_STAT_IERRORS:
2224 		*val = sc->sc_rx_err;
2225 		break;
2226 	case MAC_STAT_RBYTES:
2227 		*val = ic->ic_stats.is_rx_bytes;
2228 		break;
2229 	case MAC_STAT_IPACKETS:
2230 		*val = ic->ic_stats.is_rx_frags;
2231 		break;
2232 	case MAC_STAT_OBYTES:
2233 		*val = ic->ic_stats.is_tx_bytes;
2234 		break;
2235 	case MAC_STAT_OPACKETS:
2236 		*val = ic->ic_stats.is_tx_frags;
2237 		break;
2238 	case MAC_STAT_OERRORS:
2239 	case WIFI_STAT_TX_FAILED:
2240 		*val = sc->sc_tx_err;
2241 		break;
2242 	case WIFI_STAT_TX_RETRANS:
2243 		*val = sc->sc_tx_retries;
2244 		break;
2245 	case WIFI_STAT_FCS_ERRORS:
2246 	case WIFI_STAT_WEP_ERRORS:
2247 	case WIFI_STAT_TX_FRAGS:
2248 	case WIFI_STAT_MCAST_TX:
2249 	case WIFI_STAT_RTS_SUCCESS:
2250 	case WIFI_STAT_RTS_FAILURE:
2251 	case WIFI_STAT_ACK_FAILURE:
2252 	case WIFI_STAT_RX_FRAGS:
2253 	case WIFI_STAT_MCAST_RX:
2254 	case WIFI_STAT_RX_DUPS:
2255 		RAL_UNLOCK(sc);
2256 		return (ieee80211_stat(ic, stat, val));
2257 	default:
2258 		RAL_UNLOCK(sc);
2259 		return (ENOTSUP);
2260 	}
2261 	RAL_UNLOCK(sc);
2262 
2263 	return (0);
2264 }
2265 
2266 static uint_t
2267 rt2560_intr(caddr_t arg)
2268 {
2269 	/* LINTED E_BAD_PTR_CAST_ALIGN */
2270 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2271 	uint32_t r;
2272 
2273 	RAL_LOCK(sc);
2274 
2275 	if (!RAL_IS_RUNNING(sc)) {
2276 		/*
2277 		 * The hardware is not ready/present, don't touch anything.
2278 		 * Note this can happen early on if the IRQ is shared.
2279 		 */
2280 		RAL_UNLOCK(sc);
2281 		return (DDI_INTR_UNCLAIMED);
2282 	}
2283 
2284 	r = RAL_READ(sc, RT2560_CSR7);
2285 	RAL_WRITE(sc, RT2560_CSR7, r);
2286 
2287 	if (r == 0xffffffff) {
2288 		RAL_UNLOCK(sc);
2289 		return (DDI_INTR_UNCLAIMED);
2290 	}
2291 
2292 	if (!(r & RT2560_INTR_ALL)) {
2293 		RAL_UNLOCK(sc);
2294 		return (DDI_INTR_UNCLAIMED);
2295 	}
2296 
2297 	/* disable interrupts */
2298 	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
2299 
2300 	if (r & RT2560_TX_DONE) {
2301 		RAL_UNLOCK(sc);
2302 		rt2560_tx_intr(sc);
2303 		RAL_LOCK(sc);
2304 	}
2305 
2306 	if (r & RT2560_PRIO_DONE) {
2307 		RAL_UNLOCK(sc);
2308 		rt2560_prio_intr(sc);
2309 		RAL_LOCK(sc);
2310 	}
2311 
2312 	if (r & RT2560_RX_DONE) {
2313 		sc->sc_rx_pend = 1;
2314 		ddi_trigger_softintr(sc->sc_softint_id);
2315 	}
2316 
2317 	/* re-enable interrupts */
2318 	RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
2319 	RAL_UNLOCK(sc);
2320 
2321 	return (DDI_INTR_CLAIMED);
2322 }
2323 
2324 /*
2325  * quiesce(9E) entry point.
2326  *
2327  * This function is called when the system is single-threaded at high
2328  * PIL with preemption disabled. Therefore, this function must not be
2329  * blocked.
2330  *
2331  * This function returns DDI_SUCCESS on success, or DDI_FAILURE on failure.
2332  * DDI_FAILURE indicates an error condition and should almost never happen.
2333  */
2334 static int32_t
2335 rt2560_quiesce(dev_info_t *devinfo)
2336 {
2337 	struct rt2560_softc *sc;
2338 
2339 	sc = ddi_get_soft_state(ral_soft_state_p, ddi_get_instance(devinfo));
2340 	if (sc == NULL)
2341 		return (DDI_FAILURE);
2342 
2343 	/* abort Tx */
2344 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_ABORT_TX);
2345 
2346 	/* disable Rx */
2347 	RAL_WRITE(sc, RT2560_RXCSR0, RT2560_DISABLE_RX);
2348 
2349 	/* reset ASIC (imply reset BBP) */
2350 	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
2351 	RAL_WRITE(sc, RT2560_CSR1, 0);
2352 
2353 	/* disable interrupts */
2354 	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
2355 
2356 	return (DDI_SUCCESS);
2357 }
2358 
2359 static int
2360 rt2560_attach(dev_info_t *devinfo, ddi_attach_cmd_t cmd)
2361 {
2362 	struct rt2560_softc *sc;
2363 	struct ieee80211com *ic;
2364 	int err, i;
2365 	int instance;
2366 
2367 	ddi_acc_handle_t ioh;
2368 	caddr_t regs;
2369 	uint16_t vendor_id, device_id, command;
2370 	uint8_t cachelsz;
2371 	char strbuf[32];
2372 
2373 	wifi_data_t wd = { 0 };
2374 	mac_register_t *macp;
2375 
2376 	RAL_DEBUG(RAL_DBG_GLD, "enter rt2560_attach()\n");
2377 
2378 	switch (cmd) {
2379 	case DDI_ATTACH:
2380 		break;
2381 	case DDI_RESUME:
2382 		sc = ddi_get_soft_state(ral_soft_state_p,
2383 		    ddi_get_instance(devinfo));
2384 		sc->sc_flags &= ~RAL_FLAG_SUSPENDING;
2385 		if (RAL_IS_INITED(sc))
2386 			(void) rt2560_init(sc);
2387 		RAL_DEBUG(RAL_DBG_SUSPEND, "ral resume ...\n");
2388 		return (DDI_SUCCESS);
2389 	default:
2390 		return (DDI_FAILURE);
2391 	}
2392 
2393 	instance = ddi_get_instance(devinfo);
2394 
2395 	if (ddi_soft_state_zalloc(ral_soft_state_p, instance) != DDI_SUCCESS) {
2396 		RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2397 		    "unable to alloc soft_state_p\n");
2398 		return (DDI_FAILURE);
2399 	}
2400 
2401 	sc = ddi_get_soft_state(ral_soft_state_p, instance);
2402 	ic = (ieee80211com_t *)&sc->sc_ic;
2403 	sc->sc_dev = devinfo;
2404 
2405 	/* pci configuration */
2406 	err = ddi_regs_map_setup(devinfo, 0, &regs, 0, 0, &ral_csr_accattr,
2407 	    &ioh);
2408 	if (err != DDI_SUCCESS) {
2409 		RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2410 		    "ddi_regs_map_setup() failed");
2411 		goto fail1;
2412 	}
2413 
2414 	cachelsz = ddi_get8(ioh, (uint8_t *)(regs + PCI_CONF_CACHE_LINESZ));
2415 	if (cachelsz == 0)
2416 		cachelsz = 0x10;
2417 	sc->sc_cachelsz = cachelsz << 2;
2418 
2419 	vendor_id = ddi_get16(ioh,
2420 	    (uint16_t *)((uintptr_t)regs + PCI_CONF_VENID));
2421 	device_id = ddi_get16(ioh,
2422 	    (uint16_t *)((uintptr_t)regs + PCI_CONF_DEVID));
2423 
2424 	RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): vendor 0x%x, "
2425 	    "device id 0x%x, cache size %d\n", vendor_id, device_id, cachelsz);
2426 
2427 	/*
2428 	 * Enable response to memory space accesses,
2429 	 * and enabe bus master.
2430 	 */
2431 	command = PCI_COMM_MAE | PCI_COMM_ME;
2432 	ddi_put16(ioh, (uint16_t *)((uintptr_t)regs + PCI_CONF_COMM), command);
2433 	RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2434 	    "set command reg to 0x%x \n", command);
2435 
2436 	ddi_put8(ioh, (uint8_t *)(regs + PCI_CONF_LATENCY_TIMER), 0xa8);
2437 	ddi_put8(ioh, (uint8_t *)(regs + PCI_CONF_ILINE), 0x10);
2438 	ddi_regs_map_free(&ioh);
2439 
2440 	/* pci i/o space */
2441 	err = ddi_regs_map_setup(devinfo, 1,
2442 	    &sc->sc_rbase, 0, 0, &ral_csr_accattr, &sc->sc_ioh);
2443 	RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2444 	    "regs map1 = %x err=%d\n", regs, err);
2445 	if (err != DDI_SUCCESS) {
2446 		RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2447 		    "ddi_regs_map_setup() failed");
2448 		goto fail1;
2449 	}
2450 
2451 	/* initialize the ral rate */
2452 	ral_rate_init();
2453 
2454 	/* retrieve RT2560 rev. no */
2455 	sc->asic_rev = RAL_READ(sc, RT2560_CSR0);
2456 
2457 	/* retrieve MAC address */
2458 	rt2560_get_macaddr(sc, ic->ic_macaddr);
2459 
2460 	/* retrieve RF rev. no and various other things from EEPROM */
2461 	rt2560_read_eeprom(sc);
2462 
2463 	RAL_DEBUG(RAL_DBG_GLD, "MAC/BBP RT2560 (rev 0x%02x), RF %s\n",
2464 	    sc->asic_rev, rt2560_get_rf(sc->rf_rev));
2465 
2466 	/*
2467 	 * Allocate Tx and Rx rings.
2468 	 */
2469 	err = rt2560_alloc_tx_ring(sc, &sc->txq, RT2560_TX_RING_COUNT);
2470 	if (err != DDI_SUCCESS) {
2471 		RAL_DEBUG(RAL_DBG_GLD, "could not allocate Tx ring\n");
2472 		goto fail2;
2473 	}
2474 	err = rt2560_alloc_tx_ring(sc, &sc->prioq, RT2560_PRIO_RING_COUNT);
2475 	if (err != DDI_SUCCESS) {
2476 		RAL_DEBUG(RAL_DBG_GLD, "could not allocate Prio ring\n");
2477 		goto fail3;
2478 	}
2479 	err = rt2560_alloc_rx_ring(sc, &sc->rxq, RT2560_RX_RING_COUNT);
2480 	if (err != DDI_SUCCESS) {
2481 		RAL_DEBUG(RAL_DBG_GLD, "could not allocate Rx ring\n");
2482 		goto fail4;
2483 	}
2484 
2485 	mutex_init(&sc->sc_genlock, NULL, MUTEX_DRIVER, NULL);
2486 	mutex_init(&sc->txq.tx_lock, NULL, MUTEX_DRIVER, NULL);
2487 	mutex_init(&sc->prioq.tx_lock, NULL, MUTEX_DRIVER, NULL);
2488 	mutex_init(&sc->rxq.rx_lock, NULL, MUTEX_DRIVER, NULL);
2489 
2490 
2491 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
2492 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
2493 	ic->ic_state = IEEE80211_S_INIT;
2494 
2495 	ic->ic_maxrssi = 63;
2496 	ic->ic_set_shortslot = rt2560_update_slot;
2497 	ic->ic_xmit = rt2560_mgmt_send;
2498 
2499 	/* set device capabilities */
2500 	ic->ic_caps =
2501 	    IEEE80211_C_TXPMGT |	/* tx power management */
2502 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
2503 	    IEEE80211_C_SHSLOT;		/* short slot time supported */
2504 
2505 	ic->ic_caps |= IEEE80211_C_WPA; /* Support WPA/WPA2 */
2506 
2507 #define	IEEE80211_CHAN_A	\
2508 	(IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_OFDM)
2509 
2510 	if (sc->rf_rev == RT2560_RF_5222) {
2511 		/* set supported .11a rates */
2512 		ic->ic_sup_rates[IEEE80211_MODE_11A] = rt2560_rateset_11a;
2513 
2514 		/* set supported .11a channels */
2515 		for (i = 36; i <= 64; i += 4) {
2516 			ic->ic_sup_channels[i].ich_freq =
2517 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2518 			ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2519 		}
2520 		for (i = 100; i <= 140; i += 4) {
2521 			ic->ic_sup_channels[i].ich_freq =
2522 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2523 			ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2524 		}
2525 		for (i = 149; i <= 161; i += 4) {
2526 			ic->ic_sup_channels[i].ich_freq =
2527 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2528 			ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2529 		}
2530 	}
2531 
2532 	/* set supported .11b and .11g rates */
2533 	ic->ic_sup_rates[IEEE80211_MODE_11B] = rt2560_rateset_11b;
2534 	ic->ic_sup_rates[IEEE80211_MODE_11G] = rt2560_rateset_11g;
2535 
2536 	/* set supported .11b and .11g channels (1 through 14) */
2537 	for (i = 1; i <= 14; i++) {
2538 		ic->ic_sup_channels[i].ich_freq =
2539 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
2540 		ic->ic_sup_channels[i].ich_flags =
2541 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
2542 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
2543 	}
2544 
2545 	ieee80211_attach(ic);
2546 
2547 	/* register WPA door */
2548 	ieee80211_register_door(ic, ddi_driver_name(devinfo),
2549 	    ddi_get_instance(devinfo));
2550 
2551 	ic->ic_node_alloc = rt2560_node_alloc;
2552 	ic->ic_node_free = rt2560_node_free;
2553 
2554 	/* override state transition machine */
2555 	sc->sc_newstate = ic->ic_newstate;
2556 	ic->ic_newstate = rt2560_newstate;
2557 	ic->ic_watchdog = rt2560_watchdog;
2558 	ieee80211_media_init(ic);
2559 	ic->ic_def_txkey = 0;
2560 
2561 	sc->sc_rcr = 0;
2562 	sc->sc_rx_pend = 0;
2563 	sc->dwelltime = 300;
2564 	sc->sc_flags &= ~RAL_FLAG_RUNNING;
2565 
2566 	err = ddi_add_softintr(devinfo, DDI_SOFTINT_LOW,
2567 	    &sc->sc_softint_id, NULL, 0, ral_softint_handler, (caddr_t)sc);
2568 	if (err != DDI_SUCCESS) {
2569 		RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2570 		    "ddi_add_softintr() failed");
2571 		goto fail5;
2572 	}
2573 
2574 	err = ddi_get_iblock_cookie(devinfo, 0, &sc->sc_iblock);
2575 	if (err != DDI_SUCCESS) {
2576 		RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2577 		    "Can not get iblock cookie for INT\n");
2578 		goto fail6;
2579 	}
2580 
2581 	err = ddi_add_intr(devinfo, 0, NULL, NULL, rt2560_intr, (caddr_t)sc);
2582 	if (err != DDI_SUCCESS) {
2583 		RAL_DEBUG(RAL_DBG_GLD,
2584 		    "unable to add device interrupt handler\n");
2585 		goto fail6;
2586 	}
2587 
2588 	/*
2589 	 * Provide initial settings for the WiFi plugin; whenever this
2590 	 * information changes, we need to call mac_plugindata_update()
2591 	 */
2592 	wd.wd_opmode = ic->ic_opmode;
2593 	wd.wd_secalloc = WIFI_SEC_NONE;
2594 	IEEE80211_ADDR_COPY(wd.wd_bssid, ic->ic_bss->in_bssid);
2595 
2596 	if ((macp = mac_alloc(MAC_VERSION)) == NULL) {
2597 		RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2598 		    "MAC version mismatch\n");
2599 		goto fail7;
2600 	}
2601 
2602 	macp->m_type_ident	= MAC_PLUGIN_IDENT_WIFI;
2603 	macp->m_driver		= sc;
2604 	macp->m_dip		= devinfo;
2605 	macp->m_src_addr	= ic->ic_macaddr;
2606 	macp->m_callbacks	= &rt2560_m_callbacks;
2607 	macp->m_min_sdu		= 0;
2608 	macp->m_max_sdu		= IEEE80211_MTU;
2609 	macp->m_pdata		= &wd;
2610 	macp->m_pdata_size	= sizeof (wd);
2611 
2612 	err = mac_register(macp, &ic->ic_mach);
2613 	mac_free(macp);
2614 	if (err != 0) {
2615 		RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2616 		    "mac_register err %x\n", err);
2617 		goto fail7;
2618 	}
2619 
2620 	/*
2621 	 * Create minor node of type DDI_NT_NET_WIFI
2622 	 */
2623 	(void) snprintf(strbuf, sizeof (strbuf), "%s%d",
2624 	    "ral", instance);
2625 	err = ddi_create_minor_node(devinfo, strbuf, S_IFCHR,
2626 	    instance + 1, DDI_NT_NET_WIFI, 0);
2627 
2628 	if (err != DDI_SUCCESS)
2629 		RAL_DEBUG(RAL_DBG_GLD, "ddi_create_minor_node() failed\n");
2630 
2631 	/*
2632 	 * Notify link is down now
2633 	 */
2634 	mac_link_update(ic->ic_mach, LINK_STATE_DOWN);
2635 
2636 	RAL_DEBUG(RAL_DBG_GLD, "rt2560_attach() exit successfully.\n");
2637 	return (DDI_SUCCESS);
2638 fail7:
2639 	ddi_remove_intr(devinfo, 0, sc->sc_iblock);
2640 fail6:
2641 	ddi_remove_softintr(sc->sc_softint_id);
2642 fail5:
2643 	mutex_destroy(&sc->sc_genlock);
2644 	mutex_destroy(&sc->txq.tx_lock);
2645 	mutex_destroy(&sc->prioq.tx_lock);
2646 	mutex_destroy(&sc->rxq.rx_lock);
2647 
2648 	rt2560_free_rx_ring(sc, &sc->rxq);
2649 fail4:
2650 	rt2560_free_tx_ring(sc, &sc->prioq);
2651 fail3:
2652 	rt2560_free_tx_ring(sc, &sc->txq);
2653 fail2:
2654 	ddi_regs_map_free(&sc->sc_ioh);
2655 fail1:
2656 	ddi_soft_state_free(ral_soft_state_p, ddi_get_instance(devinfo));
2657 
2658 	return (DDI_FAILURE);
2659 }
2660 
2661 static int
2662 rt2560_detach(dev_info_t *devinfo, ddi_detach_cmd_t cmd)
2663 {
2664 	struct rt2560_softc *sc;
2665 
2666 	RAL_DEBUG(RAL_DBG_GLD, "enter rt2560_detach()\n");
2667 	sc = ddi_get_soft_state(ral_soft_state_p, ddi_get_instance(devinfo));
2668 
2669 	switch (cmd) {
2670 	case DDI_DETACH:
2671 		break;
2672 	case DDI_SUSPEND:
2673 		if (RAL_IS_INITED(sc))
2674 			(void) rt2560_stop(sc);
2675 		sc->sc_flags |= RAL_FLAG_SUSPENDING;
2676 		RAL_DEBUG(RAL_DBG_SUSPEND, "ral suspend ...\n");
2677 		return (DDI_SUCCESS);
2678 	default:
2679 		return (DDI_FAILURE);
2680 	}
2681 
2682 	if (mac_disable(sc->sc_ic.ic_mach) != 0)
2683 		return (DDI_FAILURE);
2684 
2685 	rt2560_stop(sc);
2686 
2687 	/*
2688 	 * Unregister from the MAC layer subsystem
2689 	 */
2690 	(void) mac_unregister(sc->sc_ic.ic_mach);
2691 
2692 	ddi_remove_intr(devinfo, 0, sc->sc_iblock);
2693 	ddi_remove_softintr(sc->sc_softint_id);
2694 
2695 	/*
2696 	 * detach ieee80211 layer
2697 	 */
2698 	ieee80211_detach(&sc->sc_ic);
2699 
2700 	rt2560_free_tx_ring(sc, &sc->txq);
2701 	rt2560_free_tx_ring(sc, &sc->prioq);
2702 	rt2560_free_rx_ring(sc, &sc->rxq);
2703 
2704 	ddi_regs_map_free(&sc->sc_ioh);
2705 
2706 	mutex_destroy(&sc->sc_genlock);
2707 	mutex_destroy(&sc->txq.tx_lock);
2708 	mutex_destroy(&sc->prioq.tx_lock);
2709 	mutex_destroy(&sc->rxq.rx_lock);
2710 
2711 	ddi_remove_minor_node(devinfo, NULL);
2712 	ddi_soft_state_free(ral_soft_state_p, ddi_get_instance(devinfo));
2713 
2714 	return (DDI_SUCCESS);
2715 }
2716 
2717 int
2718 _info(struct modinfo *modinfop)
2719 {
2720 	return (mod_info(&modlinkage, modinfop));
2721 }
2722 
2723 int
2724 _init(void)
2725 {
2726 	int status;
2727 
2728 	status = ddi_soft_state_init(&ral_soft_state_p,
2729 	    sizeof (struct rt2560_softc), 1);
2730 	if (status != 0)
2731 		return (status);
2732 
2733 	mac_init_ops(&ral_dev_ops, "ral");
2734 	status = mod_install(&modlinkage);
2735 	if (status != 0) {
2736 		mac_fini_ops(&ral_dev_ops);
2737 		ddi_soft_state_fini(&ral_soft_state_p);
2738 	}
2739 	return (status);
2740 }
2741 
2742 int
2743 _fini(void)
2744 {
2745 	int status;
2746 
2747 	status = mod_remove(&modlinkage);
2748 	if (status == 0) {
2749 		mac_fini_ops(&ral_dev_ops);
2750 		ddi_soft_state_fini(&ral_soft_state_p);
2751 	}
2752 	return (status);
2753 }
2754