xref: /titanic_51/usr/src/uts/common/io/ral/rt2560.c (revision e61a481d2b9ca0c0f387e11b15dcabfc982bb464)
1 /*
2  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
3  * Use is subject to license terms.
4  */
5 
6 /*
7  * Copyright (c) 2005, 2006
8  *	Damien Bergamini <damien.bergamini@free.fr>
9  *
10  * Permission to use, copy, modify, and distribute this software for any
11  * purpose with or without fee is hereby granted, provided that the above
12  * copyright notice and this permission notice appear in all copies.
13  *
14  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
15  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
16  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
17  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
18  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
20  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21  */
22 
23 /*
24  * Ralink Technology RT2560 chipset driver
25  * http://www.ralinktech.com/
26  */
27 
28 #pragma ident	"%Z%%M%	%I%	%E% SMI"
29 
30 #include <sys/types.h>
31 #include <sys/byteorder.h>
32 #include <sys/conf.h>
33 #include <sys/cmn_err.h>
34 #include <sys/stat.h>
35 #include <sys/ddi.h>
36 #include <sys/sunddi.h>
37 #include <sys/strsubr.h>
38 #include <sys/ethernet.h>
39 #include <inet/common.h>
40 #include <inet/nd.h>
41 #include <inet/mi.h>
42 #include <sys/note.h>
43 #include <sys/stream.h>
44 #include <sys/strsun.h>
45 #include <sys/modctl.h>
46 #include <sys/devops.h>
47 #include <sys/dlpi.h>
48 #include <sys/mac.h>
49 #include <sys/mac_wifi.h>
50 #include <sys/net80211.h>
51 #include <sys/net80211_proto.h>
52 #include <sys/varargs.h>
53 #include <sys/policy.h>
54 #include <sys/pci.h>
55 #include <sys/crypto/common.h>
56 #include <sys/crypto/api.h>
57 #include <inet/wifi_ioctl.h>
58 
59 #include "ral_rate.h"
60 #include "rt2560_reg.h"
61 #include "rt2560_var.h"
62 
63 
64 static void *ral_soft_state_p = NULL;
65 
66 #define	RAL_TXBUF_SIZE  	(IEEE80211_MAX_LEN)
67 #define	RAL_RXBUF_SIZE  	(IEEE80211_MAX_LEN)
68 
69 /* quickly determine if a given rate is CCK or OFDM */
70 #define	RAL_RATE_IS_OFDM(rate)	((rate) >= 12 && (rate) != 22)
71 #define	RAL_ACK_SIZE		14	/* 10 + 4(FCS) */
72 #define	RAL_CTS_SIZE		14	/* 10 + 4(FCS) */
73 #define	RAL_SIFS		10	/* us */
74 #define	RT2560_TXRX_TURNAROUND	10	/* us */
75 
76 /*
77  * Supported rates for 802.11a/b/g modes (in 500Kbps unit).
78  */
79 static const struct ieee80211_rateset rt2560_rateset_11a =
80 	{ 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
81 
82 static const struct ieee80211_rateset rt2560_rateset_11b =
83 	{ 4, { 2, 4, 11, 22 } };
84 
85 static const struct ieee80211_rateset rt2560_rateset_11g =
86 	{ 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
87 
88 static const struct {
89 	uint32_t	reg;
90 	uint32_t	val;
91 } rt2560_def_mac[] = {
92 	RT2560_DEF_MAC
93 };
94 
95 static const struct {
96 	uint8_t	reg;
97 	uint8_t	val;
98 } rt2560_def_bbp[] = {
99 	RT2560_DEF_BBP
100 };
101 
102 static const uint32_t rt2560_rf2522_r2[]    = RT2560_RF2522_R2;
103 static const uint32_t rt2560_rf2523_r2[]    = RT2560_RF2523_R2;
104 static const uint32_t rt2560_rf2524_r2[]    = RT2560_RF2524_R2;
105 static const uint32_t rt2560_rf2525_r2[]    = RT2560_RF2525_R2;
106 static const uint32_t rt2560_rf2525_hi_r2[] = RT2560_RF2525_HI_R2;
107 static const uint32_t rt2560_rf2525e_r2[]   = RT2560_RF2525E_R2;
108 static const uint32_t rt2560_rf2526_r2[]    = RT2560_RF2526_R2;
109 static const uint32_t rt2560_rf2526_hi_r2[] = RT2560_RF2526_HI_R2;
110 
111 static const struct {
112 	uint8_t		chan;
113 	uint32_t	r1, r2, r4;
114 } rt2560_rf5222[] = {
115 	RT2560_RF5222
116 };
117 
118 /*
119  * PIO access attributes for registers
120  */
121 static ddi_device_acc_attr_t ral_csr_accattr = {
122 	DDI_DEVICE_ATTR_V0,
123 	DDI_STRUCTURE_LE_ACC,
124 	DDI_STRICTORDER_ACC
125 };
126 
127 /*
128  * DMA access attributes for descriptors: NOT to be byte swapped.
129  */
130 static ddi_device_acc_attr_t ral_desc_accattr = {
131 	DDI_DEVICE_ATTR_V0,
132 	DDI_STRUCTURE_LE_ACC,
133 	DDI_STRICTORDER_ACC
134 };
135 
136 /*
137  * Describes the chip's DMA engine
138  */
139 static ddi_dma_attr_t ral_dma_attr = {
140 	DMA_ATTR_V0,			/* dma_attr version */
141 	0x0000000000000000ull,		/* dma_attr_addr_lo */
142 	0xFFFFFFFF,			/* dma_attr_addr_hi */
143 	0x00000000FFFFFFFFull,		/* dma_attr_count_max */
144 	0x0000000000000001ull,		/* dma_attr_align */
145 	0x00000FFF,			/* dma_attr_burstsizes */
146 	0x00000001,			/* dma_attr_minxfer */
147 	0x000000000000FFFFull,		/* dma_attr_maxxfer */
148 	0xFFFFFFFFFFFFFFFFull,		/* dma_attr_seg */
149 	1,				/* dma_attr_sgllen */
150 	0x00000001,			/* dma_attr_granular */
151 	0				/* dma_attr_flags */
152 };
153 
154 /*
155  * device operations
156  */
157 static int rt2560_attach(dev_info_t *, ddi_attach_cmd_t);
158 static int rt2560_detach(dev_info_t *, ddi_detach_cmd_t);
159 static int rt2560_reset(dev_info_t *, ddi_reset_cmd_t);
160 
161 /*
162  * Module Loading Data & Entry Points
163  */
164 DDI_DEFINE_STREAM_OPS(ral_dev_ops, nulldev, nulldev, rt2560_attach,
165     rt2560_detach, rt2560_reset, NULL, D_MP, NULL);
166 
167 static struct modldrv ral_modldrv = {
168 	&mod_driverops,		/* Type of module.  This one is a driver */
169 	"Ralink RT2500 driver v%I%",	/* short description */
170 	&ral_dev_ops		/* driver specific ops */
171 };
172 
173 static struct modlinkage modlinkage = {
174 	MODREV_1,
175 	(void *)&ral_modldrv,
176 	NULL
177 };
178 
179 static int	rt2560_m_stat(void *,  uint_t, uint64_t *);
180 static int	rt2560_m_start(void *);
181 static void	rt2560_m_stop(void *);
182 static int	rt2560_m_promisc(void *, boolean_t);
183 static int	rt2560_m_multicst(void *, boolean_t, const uint8_t *);
184 static int	rt2560_m_unicst(void *, const uint8_t *);
185 static mblk_t	*rt2560_m_tx(void *, mblk_t *);
186 static void	rt2560_m_ioctl(void *, queue_t *, mblk_t *);
187 
188 static mac_callbacks_t rt2560_m_callbacks = {
189 	MC_IOCTL,
190 	rt2560_m_stat,
191 	rt2560_m_start,
192 	rt2560_m_stop,
193 	rt2560_m_promisc,
194 	rt2560_m_multicst,
195 	rt2560_m_unicst,
196 	rt2560_m_tx,
197 	NULL,		/* mc_resources; */
198 	rt2560_m_ioctl,
199 	NULL		/* mc_getcapab */
200 };
201 
202 uint32_t ral_dbg_flags = 0;
203 
204 void
205 ral_debug(uint32_t dbg_flags, const int8_t *fmt, ...)
206 {
207 	va_list args;
208 
209 	if (dbg_flags & ral_dbg_flags) {
210 		va_start(args, fmt);
211 		vcmn_err(CE_CONT, fmt, args);
212 		va_end(args);
213 	}
214 }
215 
216 static void
217 rt2560_set_basicrates(struct rt2560_softc *sc)
218 {
219 	struct ieee80211com *ic = &sc->sc_ic;
220 
221 	/* update basic rate set */
222 	if (ic->ic_curmode == IEEE80211_MODE_11B) {
223 		/* 11b basic rates: 1, 2Mbps */
224 		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x3);
225 	} else if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan)) {
226 		/* 11a basic rates: 6, 12, 24Mbps */
227 		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x150);
228 	} else {
229 		/* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
230 		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x15f);
231 	}
232 }
233 
234 static void
235 rt2560_update_led(struct rt2560_softc *sc, int led1, int led2)
236 {
237 	uint32_t tmp;
238 
239 	/* set ON period to 70ms and OFF period to 30ms */
240 	tmp = led1 << 16 | led2 << 17 | 70 << 8 | 30;
241 	RAL_WRITE(sc, RT2560_LEDCSR, tmp);
242 }
243 
244 static void
245 rt2560_set_bssid(struct rt2560_softc *sc, uint8_t *bssid)
246 {
247 	uint32_t tmp;
248 
249 	tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
250 	RAL_WRITE(sc, RT2560_CSR5, tmp);
251 
252 	tmp = bssid[4] | bssid[5] << 8;
253 	RAL_WRITE(sc, RT2560_CSR6, tmp);
254 
255 	RAL_DEBUG(RAL_DBG_HW, "setting BSSID to " MACSTR "\n", MAC2STR(bssid));
256 }
257 
258 
259 static void
260 rt2560_bbp_write(struct rt2560_softc *sc, uint8_t reg, uint8_t val)
261 {
262 	uint32_t tmp;
263 	int ntries;
264 
265 	for (ntries = 0; ntries < 100; ntries++) {
266 		if (!(RAL_READ(sc, RT2560_BBPCSR) & RT2560_BBP_BUSY))
267 			break;
268 		drv_usecwait(1);
269 	}
270 	if (ntries == 100) {
271 		RAL_DEBUG(RAL_DBG_HW, "could not write to BBP\n");
272 		return;
273 	}
274 
275 	tmp = RT2560_BBP_WRITE | RT2560_BBP_BUSY | reg << 8 | val;
276 	RAL_WRITE(sc, RT2560_BBPCSR, tmp);
277 
278 	RAL_DEBUG(RAL_DBG_HW, "BBP R%u <- 0x%02x\n", reg, val);
279 }
280 
281 static uint8_t
282 rt2560_bbp_read(struct rt2560_softc *sc, uint8_t reg)
283 {
284 	uint32_t val;
285 	int ntries;
286 
287 	val = RT2560_BBP_BUSY | reg << 8;
288 	RAL_WRITE(sc, RT2560_BBPCSR, val);
289 
290 	for (ntries = 0; ntries < 100; ntries++) {
291 		val = RAL_READ(sc, RT2560_BBPCSR);
292 		if (!(val & RT2560_BBP_BUSY))
293 			return (val & 0xff);
294 		drv_usecwait(1);
295 	}
296 
297 	RAL_DEBUG(RAL_DBG_HW, "could not read from BBP\n");
298 	return (0);
299 }
300 
301 static void
302 rt2560_rf_write(struct rt2560_softc *sc, uint8_t reg, uint32_t val)
303 {
304 	uint32_t tmp;
305 	int ntries;
306 
307 	for (ntries = 0; ntries < 100; ntries++) {
308 		if (!(RAL_READ(sc, RT2560_RFCSR) & RT2560_RF_BUSY))
309 			break;
310 		drv_usecwait(1);
311 	}
312 	if (ntries == 100) {
313 		RAL_DEBUG(RAL_DBG_HW, "could not write to RF\n");
314 		return;
315 	}
316 
317 	tmp = RT2560_RF_BUSY | RT2560_RF_20BIT | (val & 0xfffff) << 2 |
318 	    (reg & 0x3);
319 	RAL_WRITE(sc, RT2560_RFCSR, tmp);
320 
321 	/* remember last written value in sc */
322 	sc->rf_regs[reg] = val;
323 
324 	RAL_DEBUG(RAL_DBG_HW, "RF R[%u] <- 0x%05x\n", reg & 0x3, val & 0xfffff);
325 }
326 
327 static void
328 rt2560_set_chan(struct rt2560_softc *sc, struct ieee80211_channel *c)
329 {
330 	struct ieee80211com *ic = &sc->sc_ic;
331 	uint8_t power, tmp;
332 	uint_t i, chan;
333 
334 	chan = ieee80211_chan2ieee(ic, c);
335 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
336 		return;
337 
338 	if (IEEE80211_IS_CHAN_2GHZ(c))
339 		power = min(sc->txpow[chan - 1], 31);
340 	else
341 		power = 31;
342 
343 	/* adjust txpower using ifconfig settings */
344 	power -= (100 - ic->ic_txpowlimit) / 8;
345 
346 	RAL_DEBUG(RAL_DBG_CHAN, "setting channel to %u, txpower to %u\n",
347 	    chan, power);
348 
349 	switch (sc->rf_rev) {
350 	case RT2560_RF_2522:
351 		rt2560_rf_write(sc, RAL_RF1, 0x00814);
352 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2522_r2[chan - 1]);
353 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
354 		break;
355 
356 	case RT2560_RF_2523:
357 		rt2560_rf_write(sc, RAL_RF1, 0x08804);
358 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2523_r2[chan - 1]);
359 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x38044);
360 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
361 		break;
362 
363 	case RT2560_RF_2524:
364 		rt2560_rf_write(sc, RAL_RF1, 0x0c808);
365 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2524_r2[chan - 1]);
366 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
367 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
368 		break;
369 
370 	case RT2560_RF_2525:
371 		rt2560_rf_write(sc, RAL_RF1, 0x08808);
372 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525_hi_r2[chan - 1]);
373 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
374 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
375 
376 		rt2560_rf_write(sc, RAL_RF1, 0x08808);
377 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525_r2[chan - 1]);
378 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
379 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
380 		break;
381 
382 	case RT2560_RF_2525E:
383 		rt2560_rf_write(sc, RAL_RF1, 0x08808);
384 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525e_r2[chan - 1]);
385 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
386 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00286 : 0x00282);
387 		break;
388 
389 	case RT2560_RF_2526:
390 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2526_hi_r2[chan - 1]);
391 		rt2560_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
392 		rt2560_rf_write(sc, RAL_RF1, 0x08804);
393 
394 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2526_r2[chan - 1]);
395 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
396 		rt2560_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
397 		break;
398 
399 	/* dual-band RF */
400 	case RT2560_RF_5222:
401 		for (i = 0; rt2560_rf5222[i].chan != chan; i++) {
402 		}
403 
404 		rt2560_rf_write(sc, RAL_RF1, rt2560_rf5222[i].r1);
405 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf5222[i].r2);
406 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
407 		rt2560_rf_write(sc, RAL_RF4, rt2560_rf5222[i].r4);
408 		break;
409 	}
410 
411 	if (ic->ic_state != IEEE80211_S_SCAN) {
412 		/* set Japan filter bit for channel 14 */
413 		tmp = rt2560_bbp_read(sc, 70);
414 
415 		tmp &= ~RT2560_JAPAN_FILTER;
416 		if (chan == 14)
417 			tmp |= RT2560_JAPAN_FILTER;
418 
419 		rt2560_bbp_write(sc, 70, tmp);
420 
421 		/* clear CRC errors */
422 		(void) RAL_READ(sc, RT2560_CNT0);
423 	}
424 }
425 
426 /*
427  * Refer to IEEE Std 802.11-1999 pp. 123 for more information on TSF
428  * synchronization.
429  */
430 static void
431 rt2560_enable_tsf_sync(struct rt2560_softc *sc)
432 {
433 	struct ieee80211com *ic = &sc->sc_ic;
434 	uint16_t logcwmin, preload;
435 	uint32_t tmp;
436 
437 	/* first, disable TSF synchronization */
438 	RAL_WRITE(sc, RT2560_CSR14, 0);
439 
440 	tmp = 16 * ic->ic_bss->in_intval;
441 	RAL_WRITE(sc, RT2560_CSR12, tmp);
442 
443 	RAL_WRITE(sc, RT2560_CSR13, 0);
444 
445 	logcwmin = 5;
446 	preload = (ic->ic_opmode == IEEE80211_M_STA) ? 384 : 1024;
447 	tmp = logcwmin << 16 | preload;
448 	RAL_WRITE(sc, RT2560_BCNOCSR, tmp);
449 
450 	/* finally, enable TSF synchronization */
451 	tmp = RT2560_ENABLE_TSF | RT2560_ENABLE_TBCN;
452 	if (ic->ic_opmode == IEEE80211_M_STA)
453 		tmp |= RT2560_ENABLE_TSF_SYNC(1);
454 	else
455 		tmp |= RT2560_ENABLE_TSF_SYNC(2) |
456 		    RT2560_ENABLE_BEACON_GENERATOR;
457 	RAL_WRITE(sc, RT2560_CSR14, tmp);
458 
459 	RAL_DEBUG(RAL_DBG_HW, "enabling TSF synchronization\n");
460 }
461 
462 static void
463 rt2560_update_plcp(struct rt2560_softc *sc)
464 {
465 	struct ieee80211com *ic = &sc->sc_ic;
466 
467 	/* no short preamble for 1Mbps */
468 	RAL_WRITE(sc, RT2560_PLCP1MCSR, 0x00700400);
469 
470 	if (!(ic->ic_flags & IEEE80211_F_SHPREAMBLE)) {
471 		/* values taken from the reference driver */
472 		RAL_WRITE(sc, RT2560_PLCP2MCSR,   0x00380401);
473 		RAL_WRITE(sc, RT2560_PLCP5p5MCSR, 0x00150402);
474 		RAL_WRITE(sc, RT2560_PLCP11MCSR,  0x000b8403);
475 	} else {
476 		/* same values as above or'ed 0x8 */
477 		RAL_WRITE(sc, RT2560_PLCP2MCSR,   0x00380409);
478 		RAL_WRITE(sc, RT2560_PLCP5p5MCSR, 0x0015040a);
479 		RAL_WRITE(sc, RT2560_PLCP11MCSR,  0x000b840b);
480 	}
481 
482 	RAL_DEBUG(RAL_DBG_HW, "updating PLCP for %s preamble\n",
483 	    (ic->ic_flags & IEEE80211_F_SHPREAMBLE) ? "short" : "long");
484 }
485 
486 /*
487  * This function can be called by ieee80211_set_shortslottime(). Refer to
488  * IEEE Std 802.11-1999 pp. 85 to know how these values are computed.
489  */
490 void
491 rt2560_update_slot(struct ieee80211com *ic, int onoff)
492 {
493 	struct rt2560_softc *sc = (struct rt2560_softc *)ic;
494 	uint8_t slottime;
495 	uint16_t tx_sifs, tx_pifs, tx_difs, eifs;
496 	uint32_t tmp;
497 
498 	/* slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20; */
499 	slottime = (onoff ? 9 : 20);
500 
501 	/* update the MAC slot boundaries */
502 	tx_sifs = RAL_SIFS - RT2560_TXRX_TURNAROUND;
503 	tx_pifs = tx_sifs + slottime;
504 	tx_difs = tx_sifs + 2 * slottime;
505 	eifs = (ic->ic_curmode == IEEE80211_MODE_11B) ? 364 : 60;
506 
507 	tmp = RAL_READ(sc, RT2560_CSR11);
508 	tmp = (tmp & ~0x1f00) | slottime << 8;
509 	RAL_WRITE(sc, RT2560_CSR11, tmp);
510 
511 	tmp = tx_pifs << 16 | tx_sifs;
512 	RAL_WRITE(sc, RT2560_CSR18, tmp);
513 
514 	tmp = eifs << 16 | tx_difs;
515 	RAL_WRITE(sc, RT2560_CSR19, tmp);
516 
517 	RAL_DEBUG(RAL_DBG_HW, "setting slottime to %uus\n", slottime);
518 }
519 
520 int
521 ral_dma_region_alloc(struct rt2560_softc *sc, struct dma_region *dr,
522     size_t size, uint_t alloc_flags, uint_t bind_flags)
523 {
524 	dev_info_t *dip = sc->sc_dev;
525 	int err;
526 
527 	RAL_DEBUG(RAL_DBG_DMA, "ral_dma_region_alloc() size=%u\n", size);
528 
529 	err = ddi_dma_alloc_handle(dip, &ral_dma_attr, DDI_DMA_SLEEP, NULL,
530 	    &dr->dr_hnd);
531 	if (err != DDI_SUCCESS)
532 		goto fail1;
533 
534 	err = ddi_dma_mem_alloc(dr->dr_hnd, size, &ral_desc_accattr,
535 	    alloc_flags, DDI_DMA_SLEEP, NULL,
536 	    &dr->dr_base, &dr->dr_size, &dr->dr_acc);
537 	if (err != DDI_SUCCESS)
538 		goto fail2;
539 
540 	err = ddi_dma_addr_bind_handle(dr->dr_hnd, NULL,
541 	    dr->dr_base, dr->dr_size,
542 	    bind_flags, DDI_DMA_SLEEP, NULL, &dr->dr_cookie, &dr->dr_ccnt);
543 	if (err != DDI_SUCCESS)
544 		goto fail3;
545 
546 	if (dr->dr_ccnt != 1) {
547 		err = DDI_FAILURE;
548 		goto fail4;
549 	}
550 
551 	dr->dr_pbase = dr->dr_cookie.dmac_address;
552 	RAL_DEBUG(RAL_DBG_DMA, "get physical-base=0x%08x\n", dr->dr_pbase);
553 
554 	return (DDI_SUCCESS);
555 
556 fail4:
557 	(void) ddi_dma_unbind_handle(dr->dr_hnd);
558 fail3:
559 	ddi_dma_mem_free(&dr->dr_acc);
560 fail2:
561 	ddi_dma_free_handle(&dr->dr_hnd);
562 fail1:
563 	return (err);
564 }
565 
566 /* ARGSUSED */
567 void
568 ral_dma_region_free(struct rt2560_softc *sc, struct dma_region *dr)
569 {
570 	(void) ddi_dma_unbind_handle(dr->dr_hnd);
571 	ddi_dma_mem_free(&dr->dr_acc);
572 	ddi_dma_free_handle(&dr->dr_hnd);
573 }
574 
575 int
576 rt2560_alloc_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring,
577 	int count)
578 {
579 	int i, err;
580 	int size;
581 
582 	ring->count = count;
583 	ring->queued = 0;
584 	ring->cur = ring->next = 0;
585 	ring->cur_encrypt = ring->next_encrypt = 0;
586 
587 	ring->data = kmem_zalloc(count * (sizeof (struct rt2560_tx_data)),
588 	    KM_SLEEP);
589 	ring->dr_txbuf = kmem_zalloc(count * (sizeof (struct dma_region)),
590 	    KM_SLEEP);
591 
592 	err = ral_dma_region_alloc(sc, &ring->dr_desc,
593 	    count * (sizeof (struct rt2560_tx_desc)),
594 	    DDI_DMA_CONSISTENT, DDI_DMA_RDWR | DDI_DMA_CONSISTENT);
595 
596 	if (err != DDI_SUCCESS)
597 		goto fail1;
598 
599 	size = roundup(RAL_TXBUF_SIZE, sc->sc_cachelsz);
600 	for (i = 0; i < count; i++) {
601 		err = ral_dma_region_alloc(sc, &ring->dr_txbuf[i], size,
602 		    DDI_DMA_STREAMING, DDI_DMA_WRITE | DDI_DMA_STREAMING);
603 		if (err != DDI_SUCCESS) {
604 			while (i >= 0) {
605 				ral_dma_region_free(sc, &ring->dr_txbuf[i]);
606 				i--;
607 			}
608 			goto fail2;
609 		}
610 	}
611 
612 	ring->physaddr = LE_32(ring->dr_desc.dr_pbase);
613 	ring->desc = (struct rt2560_tx_desc *)ring->dr_desc.dr_base;
614 
615 	for (i = 0; i < count; i++) {
616 		ring->desc[i].physaddr = LE_32(ring->dr_txbuf[i].dr_pbase);
617 		ring->data[i].buf = ring->dr_txbuf[i].dr_base;
618 	}
619 
620 	return (DDI_SUCCESS);
621 fail2:
622 	ral_dma_region_free(sc, &ring->dr_desc);
623 fail1:
624 	return (err);
625 }
626 
627 /* ARGSUSED */
628 void
629 rt2560_reset_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring)
630 {
631 	struct rt2560_tx_desc *desc;
632 	struct rt2560_tx_data *data;
633 	int i;
634 
635 	for (i = 0; i < ring->count; i++) {
636 		desc = &ring->desc[i];
637 		data = &ring->data[i];
638 
639 		if (data->ni != NULL) {
640 			ieee80211_free_node(data->ni);
641 			data->ni = NULL;
642 		}
643 
644 		desc->flags = 0;
645 	}
646 
647 	(void) ddi_dma_sync(ring->dr_desc.dr_hnd, 0,
648 	    ring->count * sizeof (struct rt2560_tx_desc), DDI_DMA_SYNC_FORDEV);
649 
650 	ring->queued = 0;
651 	ring->cur = ring->next = 0;
652 	ring->cur_encrypt = ring->next_encrypt = 0;
653 }
654 
655 void
656 rt2560_free_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring)
657 {
658 	struct rt2560_tx_data *data;
659 	int i;
660 
661 	ral_dma_region_free(sc, &ring->dr_desc);
662 	/* tx buf */
663 	for (i = 0; i < ring->count; i++) {
664 		data = &ring->data[i];
665 		if (data->ni != NULL) {
666 			ieee80211_free_node(data->ni);
667 			data->ni = NULL;
668 		}
669 
670 		ral_dma_region_free(sc, &ring->dr_txbuf[i]);
671 	}
672 
673 	kmem_free(ring->data, ring->count * (sizeof (struct rt2560_tx_data)));
674 	kmem_free(ring->dr_txbuf, ring->count * (sizeof (struct dma_region)));
675 }
676 
677 void
678 rt2560_ring_hwsetup(struct rt2560_softc *sc)
679 {
680 	uint32_t tmp;
681 
682 	/* setup tx rings */
683 	tmp = ((uint32_t)RT2560_PRIO_RING_COUNT << 24) |
684 	    RT2560_ATIM_RING_COUNT << 16 |
685 	    RT2560_TX_RING_COUNT   <<  8 |
686 	    RT2560_TX_DESC_SIZE;
687 
688 	/* rings must be initialized in this exact order */
689 	RAL_WRITE(sc, RT2560_TXCSR2, tmp);
690 	RAL_WRITE(sc, RT2560_TXCSR3, sc->txq.physaddr);
691 	RAL_WRITE(sc, RT2560_TXCSR5, sc->prioq.physaddr);
692 
693 	/* setup rx ring */
694 	tmp = RT2560_RX_RING_COUNT << 8 | RT2560_RX_DESC_SIZE;
695 
696 	RAL_WRITE(sc, RT2560_RXCSR1, tmp);
697 	RAL_WRITE(sc, RT2560_RXCSR2, sc->rxq.physaddr);
698 }
699 
700 int
701 rt2560_alloc_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring,
702 	int count)
703 {
704 	struct rt2560_rx_desc *desc;
705 	struct rt2560_rx_data *data;
706 	int i, err;
707 	int size;
708 
709 	ring->count = count;
710 	ring->cur = ring->next = 0;
711 	ring->cur_decrypt = 0;
712 
713 	ring->data = kmem_zalloc(count * (sizeof (struct rt2560_rx_data)),
714 	    KM_SLEEP);
715 	ring->dr_rxbuf = kmem_zalloc(count * (sizeof (struct dma_region)),
716 	    KM_SLEEP);
717 
718 	err = ral_dma_region_alloc(sc, &ring->dr_desc,
719 	    count * (sizeof (struct rt2560_rx_desc)),
720 	    DDI_DMA_CONSISTENT, DDI_DMA_RDWR | DDI_DMA_CONSISTENT);
721 
722 	if (err != DDI_SUCCESS)
723 		goto fail1;
724 
725 	size = roundup(RAL_RXBUF_SIZE, sc->sc_cachelsz);
726 	for (i = 0; i < count; i++) {
727 		err = ral_dma_region_alloc(sc, &ring->dr_rxbuf[i], size,
728 		    DDI_DMA_STREAMING, DDI_DMA_READ | DDI_DMA_STREAMING);
729 		if (err != DDI_SUCCESS) {
730 			while (i >= 0) {
731 				ral_dma_region_free(sc, &ring->dr_rxbuf[i]);
732 				i--;
733 			}
734 			goto fail2;
735 		}
736 	}
737 
738 	ring->physaddr = ring->dr_desc.dr_pbase;
739 	ring->desc = (struct rt2560_rx_desc *)ring->dr_desc.dr_base;
740 
741 	for (i = 0; i < count; i++) {
742 		desc = &ring->desc[i];
743 		data = &ring->data[i];
744 
745 		desc->physaddr = LE_32(ring->dr_rxbuf[i].dr_pbase);
746 		desc->flags = LE_32(RT2560_RX_BUSY);
747 
748 		data->buf = ring->dr_rxbuf[i].dr_base;
749 	}
750 
751 	return (DDI_SUCCESS);
752 fail2:
753 	ral_dma_region_free(sc, &ring->dr_desc);
754 fail1:
755 	return (err);
756 }
757 
758 /* ARGSUSED */
759 static void
760 rt2560_reset_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring)
761 {
762 	int i;
763 
764 	for (i = 0; i < ring->count; i++) {
765 		ring->desc[i].flags = LE_32(RT2560_RX_BUSY);
766 		ring->data[i].drop = 0;
767 	}
768 
769 	(void) ddi_dma_sync(ring->dr_desc.dr_hnd, 0,
770 	    ring->count * sizeof (struct rt2560_rx_desc),
771 	    DDI_DMA_SYNC_FORKERNEL);
772 
773 	ring->cur = ring->next = 0;
774 	ring->cur_decrypt = 0;
775 }
776 
777 static void
778 rt2560_free_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring)
779 {
780 	int i;
781 
782 	ral_dma_region_free(sc, &ring->dr_desc);
783 	/* rx buf */
784 	for (i = 0; i < ring->count; i++)
785 		ral_dma_region_free(sc, &ring->dr_rxbuf[i]);
786 
787 	kmem_free(ring->data, ring->count * (sizeof (struct rt2560_rx_data)));
788 	kmem_free(ring->dr_rxbuf, ring->count * (sizeof (struct dma_region)));
789 }
790 
791 /* ARGSUSED */
792 static struct ieee80211_node *
793 rt2560_node_alloc(ieee80211com_t *ic)
794 {
795 	struct rt2560_node *rn;
796 
797 	rn = kmem_zalloc(sizeof (struct rt2560_node), KM_SLEEP);
798 	return ((rn != NULL) ? &rn->ni : NULL);
799 }
800 
801 static void
802 rt2560_node_free(struct ieee80211_node *in)
803 {
804 	ieee80211com_t *ic = in->in_ic;
805 
806 	ic->ic_node_cleanup(in);
807 	if (in->in_wpa_ie != NULL)
808 		ieee80211_free(in->in_wpa_ie);
809 	kmem_free(in, sizeof (struct rt2560_node));
810 }
811 
812 /*
813  * This function is called periodically (every 200ms) during scanning to
814  * switch from one channel to another.
815  */
816 static void
817 rt2560_next_scan(void *arg)
818 {
819 	struct rt2560_softc *sc = arg;
820 	struct ieee80211com *ic = &sc->sc_ic;
821 
822 	if (ic->ic_state == IEEE80211_S_SCAN)
823 		(void) ieee80211_next_scan(ic);
824 }
825 
826 /*
827  * This function is called for each node present in the node station table.
828  */
829 /* ARGSUSED */
830 static void
831 rt2560_iter_func(void *arg, struct ieee80211_node *ni)
832 {
833 	struct rt2560_node *rn = (struct rt2560_node *)ni;
834 
835 	ral_rssadapt_updatestats(&rn->rssadapt);
836 }
837 
838 /*
839  * This function is called periodically (every 100ms) in RUN state to update
840  * the rate adaptation statistics.
841  */
842 static void
843 rt2560_update_rssadapt(void *arg)
844 {
845 	struct rt2560_softc *sc = arg;
846 	struct ieee80211com *ic = &sc->sc_ic;
847 
848 	ieee80211_iterate_nodes(&ic->ic_sta, rt2560_iter_func, arg);
849 	sc->sc_rssadapt_id = timeout(rt2560_update_rssadapt, (void *)sc,
850 	    drv_usectohz(100 * 1000));
851 }
852 
853 static void
854 rt2560_statedog(void *arg)
855 {
856 	struct rt2560_softc *sc = arg;
857 	struct ieee80211com *ic = &sc->sc_ic;
858 	enum ieee80211_state state;
859 
860 	RAL_LOCK(sc);
861 
862 	RAL_DEBUG(RAL_DBG_MSG, "rt2560_statedog(...)\n");
863 
864 	sc->sc_state_id = 0;
865 	state = ic->ic_state;
866 	ic->ic_state = sc->sc_ostate;
867 
868 	RAL_UNLOCK(sc);
869 
870 	ieee80211_new_state(ic, state, -1);
871 
872 }
873 
874 static int
875 rt2560_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
876 {
877 	struct rt2560_softc *sc = (struct rt2560_softc *)ic;
878 	enum ieee80211_state ostate;
879 	struct ieee80211_node *ni;
880 	int err;
881 
882 	RAL_LOCK(sc);
883 
884 	ostate = ic->ic_state;
885 	sc->sc_ostate = ostate;
886 
887 	if (sc->sc_scan_id != 0) {
888 		(void) untimeout(sc->sc_scan_id);
889 		sc->sc_scan_id = 0;
890 	}
891 
892 	if (sc->sc_rssadapt_id != 0) {
893 		(void) untimeout(sc->sc_rssadapt_id);
894 		sc->sc_rssadapt_id = 0;
895 	}
896 
897 	if (sc->sc_state_id != 0) {
898 		(void) untimeout(sc->sc_state_id);
899 		sc->sc_state_id = 0;
900 	}
901 
902 	switch (nstate) {
903 	case IEEE80211_S_INIT:
904 		if (ostate == IEEE80211_S_RUN) {
905 			/* abort TSF synchronization */
906 			RAL_WRITE(sc, RT2560_CSR14, 0);
907 			/* turn association led off */
908 			rt2560_update_led(sc, 0, 0);
909 		}
910 		break;
911 
912 	case IEEE80211_S_SCAN:
913 		rt2560_set_chan(sc, ic->ic_curchan);
914 		sc->sc_scan_id = timeout(rt2560_next_scan, (void *)sc,
915 		    drv_usectohz(sc->dwelltime * 1000));
916 		break;
917 
918 	case IEEE80211_S_AUTH:
919 		RAL_DEBUG(RAL_DBG_STATE, "-> IEEE80211_S_AUTH ...\n");
920 		rt2560_set_chan(sc, ic->ic_curchan);
921 		break;
922 
923 	case IEEE80211_S_ASSOC:
924 		RAL_DEBUG(RAL_DBG_STATE, "-> IEEE80211_S_ASSOC ...\n");
925 		rt2560_set_chan(sc, ic->ic_curchan);
926 
927 		drv_usecwait(10 * 1000);	/* dlink */
928 		sc->sc_state_id = timeout(rt2560_statedog, (void *)sc,
929 		    drv_usectohz(300 * 1000));	/* ap7-3 */
930 		break;
931 
932 	case IEEE80211_S_RUN:
933 		RAL_DEBUG(RAL_DBG_STATE, "-> IEEE80211_S_RUN ...\n");
934 		rt2560_set_chan(sc, ic->ic_curchan);
935 
936 		ni = ic->ic_bss;
937 
938 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
939 			rt2560_update_plcp(sc);
940 			rt2560_set_basicrates(sc);
941 			rt2560_set_bssid(sc, ni->in_bssid);
942 		}
943 
944 		/* turn assocation led on */
945 		rt2560_update_led(sc, 1, 0);
946 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
947 			sc->sc_rssadapt_id = timeout(rt2560_update_rssadapt,
948 			    (void *)sc, drv_usectohz(100 * 1000));
949 			rt2560_enable_tsf_sync(sc);
950 		}
951 		break;
952 	}
953 
954 	RAL_UNLOCK(sc);
955 
956 	err = sc->sc_newstate(ic, nstate, arg);
957 	/*
958 	 * Finally, start any timers.
959 	 */
960 	if (nstate == IEEE80211_S_RUN)
961 		ieee80211_start_watchdog(ic, 1);
962 
963 	return (err);
964 }
965 
966 /*
967  * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46 or
968  * 93C66).
969  */
970 static uint16_t
971 rt2560_eeprom_read(struct rt2560_softc *sc, uint8_t addr)
972 {
973 	uint32_t tmp;
974 	uint16_t val;
975 	int n;
976 
977 	/* clock C once before the first command */
978 	RT2560_EEPROM_CTL(sc, 0);
979 
980 	RT2560_EEPROM_CTL(sc, RT2560_S);
981 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
982 	RT2560_EEPROM_CTL(sc, RT2560_S);
983 
984 	/* write start bit (1) */
985 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D);
986 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D | RT2560_C);
987 
988 	/* write READ opcode (10) */
989 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D);
990 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D | RT2560_C);
991 	RT2560_EEPROM_CTL(sc, RT2560_S);
992 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
993 
994 	/* write address (A5-A0 or A7-A0) */
995 	n = (RAL_READ(sc, RT2560_CSR21) & RT2560_93C46) ? 5 : 7;
996 	for (; n >= 0; n--) {
997 		RT2560_EEPROM_CTL(sc, RT2560_S |
998 		    (((addr >> n) & 1) << RT2560_SHIFT_D));
999 		RT2560_EEPROM_CTL(sc, RT2560_S |
1000 		    (((addr >> n) & 1) << RT2560_SHIFT_D) | RT2560_C);
1001 	}
1002 
1003 	RT2560_EEPROM_CTL(sc, RT2560_S);
1004 
1005 	/* read data Q15-Q0 */
1006 	val = 0;
1007 	for (n = 15; n >= 0; n--) {
1008 		RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
1009 		tmp = RAL_READ(sc, RT2560_CSR21);
1010 		val |= ((tmp & RT2560_Q) >> RT2560_SHIFT_Q) << n;
1011 		RT2560_EEPROM_CTL(sc, RT2560_S);
1012 	}
1013 
1014 	RT2560_EEPROM_CTL(sc, 0);
1015 
1016 	/* clear Chip Select and clock C */
1017 	RT2560_EEPROM_CTL(sc, RT2560_S);
1018 	RT2560_EEPROM_CTL(sc, 0);
1019 	RT2560_EEPROM_CTL(sc, RT2560_C);
1020 
1021 	return (val);
1022 }
1023 
1024 static void
1025 rt2560_tx_intr(struct rt2560_softc *sc)
1026 {
1027 	struct ieee80211com *ic = &sc->sc_ic;
1028 	struct rt2560_tx_desc *desc;
1029 	struct rt2560_tx_data *data;
1030 	struct rt2560_node *rn;
1031 
1032 	struct dma_region *dr;
1033 	int count;
1034 
1035 	dr = &sc->txq.dr_desc;
1036 	count = sc->txq.count;
1037 
1038 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1039 	    DDI_DMA_SYNC_FORKERNEL);
1040 
1041 	mutex_enter(&sc->txq.tx_lock);
1042 
1043 	for (;;) {
1044 		desc = &sc->txq.desc[sc->txq.next];
1045 		data = &sc->txq.data[sc->txq.next];
1046 
1047 		if ((LE_32(desc->flags) & RT2560_TX_BUSY) ||
1048 		    (LE_32(desc->flags) & RT2560_TX_CIPHER_BUSY) ||
1049 		    !(LE_32(desc->flags) & RT2560_TX_VALID))
1050 			break;
1051 
1052 		rn = (struct rt2560_node *)data->ni;
1053 
1054 		switch (LE_32(desc->flags) & RT2560_TX_RESULT_MASK) {
1055 		case RT2560_TX_SUCCESS:
1056 			RAL_DEBUG(RAL_DBG_INTR, "data frame sent success\n");
1057 			if (data->id.id_node != NULL) {
1058 				ral_rssadapt_raise_rate(ic, &rn->rssadapt,
1059 				    &data->id);
1060 			}
1061 			break;
1062 
1063 		case RT2560_TX_SUCCESS_RETRY:
1064 			RAL_DEBUG(RAL_DBG_INTR,
1065 			    "data frame sent after %u retries\n",
1066 			    (LE_32(desc->flags) >> 5) & 0x7);
1067 			sc->sc_tx_retries++;
1068 			break;
1069 
1070 		case RT2560_TX_FAIL_RETRY:
1071 			RAL_DEBUG(RAL_DBG_INTR,
1072 			    "sending data frame failed (too much retries)\n");
1073 			if (data->id.id_node != NULL) {
1074 				ral_rssadapt_lower_rate(ic, data->ni,
1075 				    &rn->rssadapt, &data->id);
1076 			}
1077 			break;
1078 
1079 		case RT2560_TX_FAIL_INVALID:
1080 		case RT2560_TX_FAIL_OTHER:
1081 		default:
1082 			RAL_DEBUG(RAL_DBG_INTR, "sending data frame failed "
1083 			    "0x%08x\n", LE_32(desc->flags));
1084 			break;
1085 		}
1086 
1087 		ieee80211_free_node(data->ni);
1088 		data->ni = NULL;
1089 
1090 		/* descriptor is no longer valid */
1091 		desc->flags &= ~LE_32(RT2560_TX_VALID);
1092 
1093 		RAL_DEBUG(RAL_DBG_INTR, "tx done idx=%u\n", sc->txq.next);
1094 
1095 		sc->txq.queued--;
1096 		sc->txq.next = (sc->txq.next + 1) % RT2560_TX_RING_COUNT;
1097 
1098 		if (sc->sc_need_sched &&
1099 		    sc->txq.queued < (RT2560_TX_RING_COUNT - 32)) {
1100 			sc->sc_need_sched = 0;
1101 			mac_tx_update(ic->ic_mach);
1102 		}
1103 	}
1104 
1105 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1106 	    DDI_DMA_SYNC_FORDEV);
1107 
1108 	sc->sc_tx_timer = 0;
1109 	mutex_exit(&sc->txq.tx_lock);
1110 }
1111 
1112 static void
1113 rt2560_prio_intr(struct rt2560_softc *sc)
1114 {
1115 	struct rt2560_tx_desc *desc;
1116 	struct rt2560_tx_data *data;
1117 
1118 	struct dma_region *dr;
1119 	int count;
1120 
1121 	dr = &sc->prioq.dr_desc;
1122 	count = sc->prioq.count;
1123 
1124 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1125 	    DDI_DMA_SYNC_FORKERNEL);
1126 
1127 	mutex_enter(&sc->prioq.tx_lock);
1128 
1129 	for (;;) {
1130 		desc = &sc->prioq.desc[sc->prioq.next];
1131 		data = &sc->prioq.data[sc->prioq.next];
1132 
1133 		if ((LE_32(desc->flags) & RT2560_TX_BUSY) ||
1134 		    !(LE_32(desc->flags) & RT2560_TX_VALID))
1135 			break;
1136 
1137 		switch (LE_32(desc->flags) & RT2560_TX_RESULT_MASK) {
1138 		case RT2560_TX_SUCCESS:
1139 			RAL_DEBUG(RAL_DBG_INTR, "mgt frame sent success\n");
1140 			break;
1141 
1142 		case RT2560_TX_SUCCESS_RETRY:
1143 			RAL_DEBUG(RAL_DBG_INTR,
1144 			    "mgt frame sent after %u retries\n",
1145 			    (LE_32(desc->flags) >> 5) & 0x7);
1146 			break;
1147 
1148 		case RT2560_TX_FAIL_RETRY:
1149 			RAL_DEBUG(RAL_DBG_INTR,
1150 			    "sending mgt frame failed (too much " "retries)\n");
1151 			break;
1152 
1153 		case RT2560_TX_FAIL_INVALID:
1154 		case RT2560_TX_FAIL_OTHER:
1155 		default:
1156 			RAL_DEBUG(RAL_DBG_INTR, "sending mgt frame failed "
1157 			    "0x%08x\n", LE_32(desc->flags));
1158 		}
1159 
1160 		ieee80211_free_node(data->ni);
1161 		data->ni = NULL;
1162 
1163 		/* descriptor is no longer valid */
1164 		desc->flags &= ~LE_32(RT2560_TX_VALID);
1165 
1166 		RAL_DEBUG(RAL_DBG_INTR, "prio done idx=%u\n", sc->prioq.next);
1167 
1168 		sc->prioq.queued--;
1169 		sc->prioq.next = (sc->prioq.next + 1) % RT2560_PRIO_RING_COUNT;
1170 	}
1171 
1172 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1173 	    DDI_DMA_SYNC_FORDEV);
1174 
1175 	sc->sc_tx_timer = 0;
1176 	mutex_exit(&sc->prioq.tx_lock);
1177 }
1178 
1179 /*
1180  * Some frames were received. Pass them to the hardware cipher engine before
1181  * sending them to the 802.11 layer.
1182  */
1183 void
1184 rt2560_rx_intr(struct rt2560_softc *sc)
1185 {
1186 	struct ieee80211com *ic = &sc->sc_ic;
1187 	struct rt2560_rx_desc *desc;
1188 	struct rt2560_rx_data *data;
1189 	struct ieee80211_frame *wh;
1190 	struct ieee80211_node *ni;
1191 	struct rt2560_node *rn;
1192 
1193 	mblk_t *m;
1194 	uint32_t len;
1195 	char *rxbuf;
1196 
1197 	struct dma_region *dr, *dr_bf;
1198 	int count;
1199 
1200 	dr = &sc->rxq.dr_desc;
1201 	count = sc->rxq.count;
1202 
1203 	mutex_enter(&sc->rxq.rx_lock);
1204 
1205 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_RX_DESC_SIZE,
1206 	    DDI_DMA_SYNC_FORKERNEL);
1207 
1208 	for (;;) {
1209 		desc = &sc->rxq.desc[sc->rxq.cur];
1210 		data = &sc->rxq.data[sc->rxq.cur];
1211 
1212 		if ((LE_32(desc->flags) & RT2560_RX_BUSY) ||
1213 		    (LE_32(desc->flags) & RT2560_RX_CIPHER_BUSY))
1214 			break;
1215 
1216 		data->drop = 0;
1217 
1218 		if ((LE_32(desc->flags) & RT2560_RX_PHY_ERROR) ||
1219 		    (LE_32(desc->flags) & RT2560_RX_CRC_ERROR)) {
1220 			/*
1221 			 * This should not happen since we did not request
1222 			 * to receive those frames when we filled RXCSR0.
1223 			 */
1224 			RAL_DEBUG(RAL_DBG_RX, "PHY or CRC error flags 0x%08x\n",
1225 			    LE_32(desc->flags));
1226 			data->drop = 1;
1227 		}
1228 
1229 		if (((LE_32(desc->flags) >> 16) & 0xfff) > RAL_RXBUF_SIZE) {
1230 			RAL_DEBUG(RAL_DBG_RX, "bad length\n");
1231 			data->drop = 1;
1232 		}
1233 
1234 		if (data->drop) {
1235 			sc->sc_rx_err++;
1236 			goto skip;
1237 		}
1238 
1239 		rxbuf = data->buf;
1240 		len = (LE_32(desc->flags) >> 16) & 0xfff;
1241 
1242 		if ((len < sizeof (struct ieee80211_frame_min)) ||
1243 		    (len > RAL_RXBUF_SIZE)) {
1244 			RAL_DEBUG(RAL_DBG_RX, "bad frame length=%u\n", len);
1245 			sc->sc_rx_err++;
1246 			goto skip;
1247 		}
1248 
1249 		if ((m = allocb(len, BPRI_MED)) == NULL) {
1250 			RAL_DEBUG(RAL_DBG_RX, "rt2560_rx_intr():"
1251 			    " allocate mblk failed.\n");
1252 			sc->sc_rx_nobuf++;
1253 			goto skip;
1254 		}
1255 
1256 		dr_bf = &sc->rxq.dr_rxbuf[sc->rxq.cur];
1257 		(void) ddi_dma_sync(dr_bf->dr_hnd, 0, dr_bf->dr_size,
1258 		    DDI_DMA_SYNC_FORCPU);
1259 
1260 		bcopy(rxbuf, m->b_rptr, len);
1261 		m->b_wptr += len;
1262 
1263 		wh = (struct ieee80211_frame *)m->b_rptr;
1264 		ni = ieee80211_find_rxnode(ic, wh);
1265 
1266 		/* give rssi to the rate adatation algorithm */
1267 		rn = (struct rt2560_node *)ni;
1268 		ral_rssadapt_input(ic, ni, &rn->rssadapt, desc->rssi);
1269 
1270 		/* send the frame to the 802.11 layer */
1271 		(void) ieee80211_input(ic, m, ni, desc->rssi, 0);
1272 
1273 		/* node is no longer needed */
1274 		ieee80211_free_node(ni);
1275 
1276 skip:		desc->flags = LE_32(RT2560_RX_BUSY);
1277 		RAL_DEBUG(RAL_DBG_RX, "rx done idx=%u\n", sc->rxq.cur);
1278 
1279 		sc->rxq.cur = (sc->rxq.cur + 1) % RT2560_RX_RING_COUNT;
1280 	}
1281 	mutex_exit(&sc->rxq.rx_lock);
1282 
1283 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1284 	    DDI_DMA_SYNC_FORDEV);
1285 }
1286 
1287 uint_t
1288 ral_softint_handler(caddr_t data)
1289 {
1290 	/* LINTED E_BAD_PTR_CAST_ALIGN */
1291 	struct rt2560_softc *sc = (struct rt2560_softc *)data;
1292 
1293 	/*
1294 	 * Check if the soft interrupt is triggered by another
1295 	 * driver at the same level.
1296 	 */
1297 	RAL_LOCK(sc);
1298 	if (sc->sc_rx_pend) {
1299 		sc->sc_rx_pend = 0;
1300 		RAL_UNLOCK(sc);
1301 		rt2560_rx_intr(sc);
1302 		return (DDI_INTR_CLAIMED);
1303 	}
1304 	RAL_UNLOCK(sc);
1305 	return (DDI_INTR_UNCLAIMED);
1306 }
1307 
1308 /*
1309  * Return the expected ack rate for a frame transmitted at rate `rate'.
1310  * XXX: this should depend on the destination node basic rate set.
1311  */
1312 static int
1313 rt2560_ack_rate(struct ieee80211com *ic, int rate)
1314 {
1315 	switch (rate) {
1316 	/* CCK rates */
1317 	case 2:
1318 		return (2);
1319 	case 4:
1320 	case 11:
1321 	case 22:
1322 		return ((ic->ic_curmode == IEEE80211_MODE_11B) ? 4 : rate);
1323 
1324 	/* OFDM rates */
1325 	case 12:
1326 	case 18:
1327 		return (12);
1328 	case 24:
1329 	case 36:
1330 		return (24);
1331 	case 48:
1332 	case 72:
1333 	case 96:
1334 	case 108:
1335 		return (48);
1336 	}
1337 
1338 	/* default to 1Mbps */
1339 	return (2);
1340 }
1341 
1342 /*
1343  * Compute the duration (in us) needed to transmit `len' bytes at rate `rate'.
1344  * The function automatically determines the operating mode depending on the
1345  * given rate. `flags' indicates whether short preamble is in use or not.
1346  */
1347 static uint16_t
1348 rt2560_txtime(int len, int rate, uint32_t flags)
1349 {
1350 	uint16_t txtime;
1351 
1352 	if (RAL_RATE_IS_OFDM(rate)) {
1353 		/* IEEE Std 802.11a-1999, pp. 37 */
1354 		txtime = (8 + 4 * len + 3 + rate - 1) / rate;
1355 		txtime = 16 + 4 + 4 * txtime + 6;
1356 	} else {
1357 		/* IEEE Std 802.11b-1999, pp. 28 */
1358 		txtime = (16 * len + rate - 1) / rate;
1359 		if (rate != 2 && (flags & IEEE80211_F_SHPREAMBLE))
1360 			txtime +=  72 + 24;
1361 		else
1362 			txtime += 144 + 48;
1363 	}
1364 
1365 	return (txtime);
1366 }
1367 
1368 static uint8_t
1369 rt2560_plcp_signal(int rate)
1370 {
1371 	switch (rate) {
1372 	/* CCK rates (returned values are device-dependent) */
1373 	case 2:		return (0x0);
1374 	case 4:		return (0x1);
1375 	case 11:	return (0x2);
1376 	case 22:	return (0x3);
1377 
1378 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1379 	case 12:	return (0xb);
1380 	case 18:	return (0xf);
1381 	case 24:	return (0xa);
1382 	case 36:	return (0xe);
1383 	case 48:	return (0x9);
1384 	case 72:	return (0xd);
1385 	case 96:	return (0x8);
1386 	case 108:	return (0xc);
1387 
1388 	/* unsupported rates (should not get there) */
1389 	default:	return (0xff);
1390 	}
1391 }
1392 
1393 void
1394 rt2560_setup_tx_desc(struct rt2560_softc *sc, struct rt2560_tx_desc *desc,
1395     uint32_t flags, int len, int rate, int encrypt)
1396 {
1397 	struct ieee80211com *ic = &sc->sc_ic;
1398 	uint16_t plcp_length;
1399 	int remainder;
1400 
1401 	desc->flags = LE_32(flags);
1402 	desc->flags |= LE_32(len << 16);
1403 	desc->flags |= encrypt ? LE_32(RT2560_TX_CIPHER_BUSY) :
1404 	    LE_32(RT2560_TX_BUSY | RT2560_TX_VALID);
1405 
1406 	desc->wme = LE_16(
1407 	    RT2560_AIFSN(2) |
1408 	    RT2560_LOGCWMIN(3) |
1409 	    RT2560_LOGCWMAX(8));
1410 
1411 	/* setup PLCP fields */
1412 	desc->plcp_signal  = rt2560_plcp_signal(rate);
1413 	desc->plcp_service = 4;
1414 
1415 	len += IEEE80211_CRC_LEN;
1416 	if (RAL_RATE_IS_OFDM(rate)) {
1417 		desc->flags |= LE_32(RT2560_TX_OFDM);
1418 
1419 		plcp_length = len & 0xfff;
1420 		desc->plcp_length_hi = plcp_length >> 6;
1421 		desc->plcp_length_lo = plcp_length & 0x3f;
1422 	} else {
1423 		plcp_length = (16 * len + rate - 1) / rate;
1424 		if (rate == 22) {
1425 			remainder = (16 * len) % 22;
1426 			if (remainder != 0 && remainder < 7)
1427 				desc->plcp_service |= RT2560_PLCP_LENGEXT;
1428 		}
1429 		desc->plcp_length_hi = plcp_length >> 8;
1430 		desc->plcp_length_lo = plcp_length & 0xff;
1431 
1432 		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1433 			desc->plcp_signal |= 0x08;
1434 	}
1435 }
1436 
1437 /* ARGSUSED */
1438 int
1439 rt2560_mgmt_send(ieee80211com_t *ic, mblk_t *mp, uint8_t type)
1440 {
1441 	struct rt2560_softc *sc = (struct rt2560_softc *)ic;
1442 	struct rt2560_tx_desc *desc;
1443 	struct rt2560_tx_data *data;
1444 	struct ieee80211_frame *wh;
1445 	uint16_t dur;
1446 	uint32_t flags = 0;
1447 	int rate, err = DDI_SUCCESS;
1448 
1449 	int off, pktlen, mblen;
1450 	caddr_t dest;
1451 	mblk_t *m, *m0;
1452 
1453 	struct dma_region *dr;
1454 	uint32_t idx;
1455 	struct ieee80211_node *ni;
1456 	struct ieee80211_key *k;
1457 
1458 	mutex_enter(&sc->prioq.tx_lock);
1459 
1460 	if (sc->prioq.queued >= RT2560_PRIO_RING_COUNT) {
1461 		err = ENOMEM;
1462 		sc->sc_tx_nobuf++;
1463 		goto fail1;
1464 	}
1465 
1466 	m = allocb(msgdsize(mp) + 32, BPRI_MED);
1467 	if (m == NULL) {
1468 		RAL_DEBUG(RAL_DBG_TX, "rt2560_mgmt_send: can't alloc mblk.\n");
1469 		err = DDI_FAILURE;
1470 		goto fail1;
1471 	}
1472 
1473 	for (off = 0, m0 = mp; m0 != NULL; m0 = m0->b_cont) {
1474 		mblen = MBLKL(m0);
1475 		(void) memcpy(m->b_rptr + off, m0->b_rptr, mblen);
1476 		off += mblen;
1477 	}
1478 	m->b_wptr += off;
1479 
1480 	wh = (struct ieee80211_frame *)m->b_rptr;
1481 	ni = ieee80211_find_txnode(ic, wh->i_addr1);
1482 
1483 	if (ni == NULL) {
1484 		err = DDI_FAILURE;
1485 		sc->sc_tx_err++;
1486 		goto fail2;
1487 	}
1488 
1489 	/* to support shared_key auth mode */
1490 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1491 		k = ieee80211_crypto_encap(ic, m);
1492 		if (k == NULL) {
1493 			err = DDI_FAILURE;
1494 			sc->sc_tx_err++;
1495 			goto fail3;
1496 		}
1497 		/* packet header may have moved, reset our local pointer */
1498 		wh = (struct ieee80211_frame *)m->b_rptr;
1499 	}
1500 
1501 	desc = &sc->prioq.desc[sc->prioq.cur];
1502 	data = &sc->prioq.data[sc->prioq.cur];
1503 
1504 	rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
1505 	data->ni = ieee80211_ref_node(ni);
1506 
1507 	pktlen = msgdsize(m);
1508 	dest = data->buf;
1509 	bcopy(m->b_rptr, dest, pktlen);
1510 
1511 	wh = (struct ieee80211_frame *)m->b_rptr;
1512 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1513 		flags |= RT2560_TX_ACK;
1514 
1515 		dur = rt2560_txtime(RAL_ACK_SIZE, rate, ic->ic_flags) +
1516 		    RAL_SIFS;
1517 		/* LINTED E_BAD_PTR_CAST_ALIGN */
1518 		*(uint16_t *)wh->i_dur = LE_16(dur);
1519 
1520 		/* tell hardware to add timestamp for probe responses */
1521 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1522 		    IEEE80211_FC0_TYPE_MGT &&
1523 		    (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1524 		    IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1525 			flags |= RT2560_TX_TIMESTAMP;
1526 	}
1527 
1528 	rt2560_setup_tx_desc(sc, desc, flags, pktlen, rate, 0);
1529 
1530 	idx = sc->prioq.cur;
1531 
1532 	dr = &sc->prioq.dr_txbuf[idx];
1533 	(void) ddi_dma_sync(dr->dr_hnd, 0, RAL_TXBUF_SIZE, DDI_DMA_SYNC_FORDEV);
1534 
1535 	dr = &sc->prioq.dr_desc;
1536 	(void) ddi_dma_sync(dr->dr_hnd, idx * RT2560_TX_DESC_SIZE,
1537 	    RT2560_TX_DESC_SIZE, DDI_DMA_SYNC_FORDEV);
1538 
1539 	RAL_DEBUG(RAL_DBG_MGMT, "sending mgt frame len=%u idx=%u rate=%u\n",
1540 	    pktlen, sc->prioq.cur, rate);
1541 
1542 	/* kick prio */
1543 	sc->prioq.queued++; /* IF > RT2560_PRIO_RING_COUNT? FULL */
1544 	sc->prioq.cur = (sc->prioq.cur + 1) % RT2560_PRIO_RING_COUNT;
1545 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_PRIO);
1546 
1547 	sc->sc_tx_timer = 5;
1548 
1549 	ic->ic_stats.is_tx_frags++;
1550 	ic->ic_stats.is_tx_bytes += pktlen;
1551 
1552 fail3:
1553 	ieee80211_free_node(ni);
1554 fail2:
1555 	freemsg(m);
1556 fail1:
1557 	freemsg(mp);
1558 	mutex_exit(&sc->prioq.tx_lock);
1559 
1560 	return (err);
1561 }
1562 
1563 static int
1564 rt2560_send(ieee80211com_t *ic, mblk_t *mp)
1565 {
1566 	struct rt2560_softc *sc = (struct rt2560_softc *)ic;
1567 	struct rt2560_tx_desc *desc;
1568 	struct rt2560_tx_data *data;
1569 	struct rt2560_node *rn;
1570 	struct ieee80211_rateset *rs;
1571 	struct ieee80211_frame *wh;
1572 	struct ieee80211_key *k;
1573 	uint16_t dur;
1574 	uint32_t flags = 0;
1575 	int rate, err = DDI_SUCCESS;
1576 
1577 	struct ieee80211_node *ni;
1578 	mblk_t *m, *m0;
1579 	int off, mblen, pktlen;
1580 	caddr_t dest;
1581 
1582 	struct dma_region *dr;
1583 	uint32_t idx;
1584 
1585 	mutex_enter(&sc->txq.tx_lock);
1586 
1587 	if (sc->txq.queued >= RT2560_TX_RING_COUNT - 1) {
1588 		RAL_DEBUG(RAL_DBG_TX, "ral: rt2560_tx_data(): "
1589 		    "no TX DMA buffer available!\n");
1590 		sc->sc_need_sched = 1;
1591 		sc->sc_tx_nobuf++;
1592 		err = ENOMEM;
1593 		goto fail1;
1594 	}
1595 
1596 	m = allocb(msgdsize(mp) + 32, BPRI_MED);
1597 	if (m == NULL) {
1598 		RAL_DEBUG(RAL_DBG_TX, "rt2560_xmit(): can't alloc mblk.\n");
1599 		err = DDI_FAILURE;
1600 		goto fail1;
1601 	}
1602 
1603 	for (off = 0, m0 = mp; m0 != NULL; m0 = m0->b_cont) {
1604 		mblen = MBLKL(m0);
1605 		(void) memcpy(m->b_rptr + off, m0->b_rptr, mblen);
1606 		off += mblen;
1607 	}
1608 	m->b_wptr += off;
1609 
1610 	wh = (struct ieee80211_frame *)m->b_rptr;
1611 	ni = ieee80211_find_txnode(ic, wh->i_addr1);
1612 
1613 	if (ni == NULL) {
1614 		err = DDI_FAILURE;
1615 		sc->sc_tx_err++;
1616 		goto fail2;
1617 	}
1618 
1619 	(void) ieee80211_encap(ic, m, ni);
1620 
1621 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1622 		k = ieee80211_crypto_encap(ic, m);
1623 		if (k == NULL) {
1624 			sc->sc_tx_err++;
1625 			err = DDI_FAILURE;
1626 			goto fail3;
1627 		}
1628 		/* packet header may have moved, reset our local pointer */
1629 		wh = (struct ieee80211_frame *)m->b_rptr;
1630 	}
1631 
1632 	/*
1633 	 * RTS/CTS exchange ignore, since the max packet will less than
1634 	 * the rtsthreshold (2346)
1635 	 * Unnecessary codes deleted.
1636 	 */
1637 
1638 	data = &sc->txq.data[sc->txq.cur];
1639 	desc = &sc->txq.desc[sc->txq.cur];
1640 
1641 	data->ni = ieee80211_ref_node(ni);
1642 
1643 	pktlen = msgdsize(m);
1644 	dest = data->buf;
1645 	bcopy(m->b_rptr, dest, pktlen);
1646 
1647 	if (ic->ic_fixed_rate != IEEE80211_FIXED_RATE_NONE) {
1648 		rs = &ic->ic_sup_rates[ic->ic_curmode];
1649 		rate = rs->ir_rates[ic->ic_fixed_rate];
1650 	} else {
1651 		rs = &ni->in_rates;
1652 		rn = (struct rt2560_node *)ni;
1653 		ni->in_txrate = ral_rssadapt_choose(&rn->rssadapt, rs, wh,
1654 		    pktlen, NULL, 0);
1655 		rate = rs->ir_rates[ni->in_txrate];
1656 	}
1657 
1658 	rate &= IEEE80211_RATE_VAL;
1659 	if (rate <= 0) {
1660 		rate = 2;	/* basic rate */
1661 	}
1662 
1663 	/* remember link conditions for rate adaptation algorithm */
1664 	if (ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE) {
1665 		data->id.id_len = pktlen;
1666 		data->id.id_rateidx = ni->in_txrate;
1667 		data->id.id_node = ni;
1668 		data->id.id_rssi = ni->in_rssi;
1669 	} else
1670 		data->id.id_node = NULL;
1671 
1672 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1673 		flags |= RT2560_TX_ACK;
1674 
1675 		dur = rt2560_txtime(RAL_ACK_SIZE, rt2560_ack_rate(ic, rate),
1676 		    ic->ic_flags) + RAL_SIFS;
1677 		/* LINTED E_BAD_PTR_CAST_ALIGN */
1678 		*(uint16_t *)wh->i_dur = LE_16(dur);
1679 	}
1680 
1681 	/* flags |= RT2560_TX_CIPHER_NONE; */
1682 	rt2560_setup_tx_desc(sc, desc, flags, pktlen, rate, 0);
1683 
1684 	idx = sc->txq.cur;
1685 
1686 	dr = &sc->txq.dr_txbuf[idx];
1687 	(void) ddi_dma_sync(dr->dr_hnd, 0, RAL_TXBUF_SIZE, DDI_DMA_SYNC_FORDEV);
1688 
1689 	dr = &sc->txq.dr_desc;
1690 	(void) ddi_dma_sync(dr->dr_hnd, idx * RT2560_TX_DESC_SIZE,
1691 	    RT2560_TX_DESC_SIZE, DDI_DMA_SYNC_FORDEV);
1692 
1693 	RAL_DEBUG(RAL_DBG_TX, "sending data frame len=%u idx=%u rate=%u\n",
1694 	    pktlen, sc->txq.cur, rate);
1695 
1696 	/* kick tx */
1697 	sc->txq.queued++;
1698 	sc->txq.cur = (sc->txq.cur + 1) % RT2560_TX_RING_COUNT;
1699 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_TX);
1700 
1701 	sc->sc_tx_timer = 5;
1702 
1703 	ic->ic_stats.is_tx_frags++;
1704 	ic->ic_stats.is_tx_bytes += pktlen;
1705 
1706 	freemsg(mp);
1707 fail3:
1708 	ieee80211_free_node(ni);
1709 fail2:
1710 	freemsg(m);
1711 fail1:
1712 	mutex_exit(&sc->txq.tx_lock);
1713 	return (err);
1714 }
1715 
1716 static mblk_t *
1717 rt2560_m_tx(void *arg, mblk_t *mp)
1718 {
1719 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
1720 	struct ieee80211com *ic = &sc->sc_ic;
1721 	mblk_t *next;
1722 
1723 	/*
1724 	 * No data frames go out unless we're associated; this
1725 	 * should not happen as the 802.11 layer does not enable
1726 	 * the xmit queue until we enter the RUN state.
1727 	 */
1728 	if (ic->ic_state != IEEE80211_S_RUN) {
1729 		RAL_DEBUG(RAL_DBG_TX, "ral: rt2560_tx_data(): "
1730 		    "discard, state %u\n", ic->ic_state);
1731 		freemsgchain(mp);
1732 		return (NULL);
1733 	}
1734 
1735 	while (mp != NULL) {
1736 		next = mp->b_next;
1737 		mp->b_next = NULL;
1738 		if (rt2560_send(ic, mp) != DDI_SUCCESS) {
1739 			mp->b_next = next;
1740 			freemsgchain(mp);
1741 			return (NULL);
1742 		}
1743 		mp = next;
1744 	}
1745 	return (mp);
1746 }
1747 
1748 static void
1749 rt2560_set_macaddr(struct rt2560_softc *sc, uint8_t *addr)
1750 {
1751 	uint32_t tmp;
1752 
1753 	tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
1754 	RAL_WRITE(sc, RT2560_CSR3, tmp);
1755 
1756 	tmp = addr[4] | addr[5] << 8;
1757 	RAL_WRITE(sc, RT2560_CSR4, tmp);
1758 
1759 	RAL_DEBUG(RAL_DBG_HW,
1760 	    "setting MAC address to " MACSTR "\n", MAC2STR(addr));
1761 }
1762 
1763 static void
1764 rt2560_get_macaddr(struct rt2560_softc *sc, uint8_t *addr)
1765 {
1766 	uint32_t tmp;
1767 
1768 	tmp = RAL_READ(sc, RT2560_CSR3);
1769 	addr[0] = tmp & 0xff;
1770 	addr[1] = (tmp >>  8) & 0xff;
1771 	addr[2] = (tmp >> 16) & 0xff;
1772 	addr[3] = (tmp >> 24);
1773 
1774 	tmp = RAL_READ(sc, RT2560_CSR4);
1775 	addr[4] = tmp & 0xff;
1776 	addr[5] = (tmp >> 8) & 0xff;
1777 }
1778 
1779 static void
1780 rt2560_update_promisc(struct rt2560_softc *sc)
1781 {
1782 	uint32_t tmp;
1783 
1784 	tmp = RAL_READ(sc, RT2560_RXCSR0);
1785 	tmp &= ~RT2560_DROP_NOT_TO_ME;
1786 	if (!(sc->sc_rcr & RAL_RCR_PROMISC))
1787 		tmp |= RT2560_DROP_NOT_TO_ME;
1788 
1789 	RAL_WRITE(sc, RT2560_RXCSR0, tmp);
1790 	RAL_DEBUG(RAL_DBG_HW, "%s promiscuous mode\n",
1791 	    (sc->sc_rcr & RAL_RCR_PROMISC) ?  "entering" : "leaving");
1792 }
1793 
1794 static const char *
1795 rt2560_get_rf(int rev)
1796 {
1797 	switch (rev) {
1798 	case RT2560_RF_2522:	return ("RT2522");
1799 	case RT2560_RF_2523:	return ("RT2523");
1800 	case RT2560_RF_2524:	return ("RT2524");
1801 	case RT2560_RF_2525:	return ("RT2525");
1802 	case RT2560_RF_2525E:	return ("RT2525e");
1803 	case RT2560_RF_2526:	return ("RT2526");
1804 	case RT2560_RF_5222:	return ("RT5222");
1805 	default:		return ("unknown");
1806 	}
1807 }
1808 
1809 static void
1810 rt2560_read_eeprom(struct rt2560_softc *sc)
1811 {
1812 	uint16_t val;
1813 	int i;
1814 
1815 	val = rt2560_eeprom_read(sc, RT2560_EEPROM_CONFIG0);
1816 	sc->rf_rev =   (val >> 11) & 0x7;
1817 	sc->hw_radio = (val >> 10) & 0x1;
1818 	sc->led_mode = (val >> 6)  & 0x7;
1819 	sc->rx_ant =   (val >> 4)  & 0x3;
1820 	sc->tx_ant =   (val >> 2)  & 0x3;
1821 	sc->nb_ant =   val & 0x3;
1822 
1823 	/* read default values for BBP registers */
1824 	for (i = 0; i < 16; i++) {
1825 		val = rt2560_eeprom_read(sc, RT2560_EEPROM_BBP_BASE + i);
1826 		sc->bbp_prom[i].reg = val >> 8;
1827 		sc->bbp_prom[i].val = val & 0xff;
1828 	}
1829 
1830 	/* read Tx power for all b/g channels */
1831 	for (i = 0; i < 14 / 2; i++) {
1832 		val = rt2560_eeprom_read(sc, RT2560_EEPROM_TXPOWER + i);
1833 		sc->txpow[i * 2] = val >> 8;
1834 		sc->txpow[i * 2 + 1] = val & 0xff;
1835 	}
1836 }
1837 
1838 static int
1839 rt2560_bbp_init(struct rt2560_softc *sc)
1840 {
1841 #define	N(a)	(sizeof (a) / sizeof ((a)[0]))
1842 	int i, ntries;
1843 
1844 	/* wait for BBP to be ready */
1845 	for (ntries = 0; ntries < 100; ntries++) {
1846 		if (rt2560_bbp_read(sc, RT2560_BBP_VERSION) != 0)
1847 			break;
1848 		drv_usecwait(1);
1849 	}
1850 	if (ntries == 100) {
1851 		RAL_DEBUG(RAL_DBG_HW, "timeout waiting for BBP\n");
1852 		return (EIO);
1853 	}
1854 	/* initialize BBP registers to default values */
1855 	for (i = 0; i < N(rt2560_def_bbp); i++) {
1856 		rt2560_bbp_write(sc, rt2560_def_bbp[i].reg,
1857 		    rt2560_def_bbp[i].val);
1858 	}
1859 
1860 	return (0);
1861 #undef N
1862 }
1863 
1864 static void
1865 rt2560_set_txantenna(struct rt2560_softc *sc, int antenna)
1866 {
1867 	uint32_t tmp;
1868 	uint8_t tx;
1869 
1870 	tx = rt2560_bbp_read(sc, RT2560_BBP_TX) & ~RT2560_BBP_ANTMASK;
1871 	if (antenna == 1)
1872 		tx |= RT2560_BBP_ANTA;
1873 	else if (antenna == 2)
1874 		tx |= RT2560_BBP_ANTB;
1875 	else
1876 		tx |= RT2560_BBP_DIVERSITY;
1877 
1878 	/* need to force I/Q flip for RF 2525e, 2526 and 5222 */
1879 	if (sc->rf_rev == RT2560_RF_2525E || sc->rf_rev == RT2560_RF_2526 ||
1880 	    sc->rf_rev == RT2560_RF_5222)
1881 		tx |= RT2560_BBP_FLIPIQ;
1882 
1883 	rt2560_bbp_write(sc, RT2560_BBP_TX, tx);
1884 
1885 	/* update values for CCK and OFDM in BBPCSR1 */
1886 	tmp = RAL_READ(sc, RT2560_BBPCSR1) & ~0x00070007;
1887 	tmp |= (tx & 0x7) << 16 | (tx & 0x7);
1888 	RAL_WRITE(sc, RT2560_BBPCSR1, tmp);
1889 }
1890 
1891 static void
1892 rt2560_set_rxantenna(struct rt2560_softc *sc, int antenna)
1893 {
1894 	uint8_t rx;
1895 
1896 	rx = rt2560_bbp_read(sc, RT2560_BBP_RX) & ~RT2560_BBP_ANTMASK;
1897 	if (antenna == 1)
1898 		rx |= RT2560_BBP_ANTA;
1899 	else if (antenna == 2)
1900 		rx |= RT2560_BBP_ANTB;
1901 	else
1902 		rx |= RT2560_BBP_DIVERSITY;
1903 
1904 	/* need to force no I/Q flip for RF 2525e and 2526 */
1905 	if (sc->rf_rev == RT2560_RF_2525E || sc->rf_rev == RT2560_RF_2526)
1906 		rx &= ~RT2560_BBP_FLIPIQ;
1907 
1908 	rt2560_bbp_write(sc, RT2560_BBP_RX, rx);
1909 }
1910 
1911 static void
1912 rt2560_stop(struct rt2560_softc *sc)
1913 {
1914 	struct ieee80211com *ic = &sc->sc_ic;
1915 
1916 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
1917 	ieee80211_stop_watchdog(ic);	/* stop the watchdog */
1918 
1919 	RAL_LOCK(sc);
1920 	sc->sc_tx_timer = 0;
1921 
1922 	/* abort Tx */
1923 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_ABORT_TX);
1924 
1925 	/* disable Rx */
1926 	RAL_WRITE(sc, RT2560_RXCSR0, RT2560_DISABLE_RX);
1927 
1928 	/* reset ASIC (imply reset BBP) */
1929 	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
1930 	RAL_WRITE(sc, RT2560_CSR1, 0);
1931 
1932 	/* disable interrupts */
1933 	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
1934 
1935 	/* reset Tx and Rx rings */
1936 	rt2560_reset_tx_ring(sc, &sc->txq);
1937 	rt2560_reset_tx_ring(sc, &sc->prioq);
1938 	rt2560_reset_rx_ring(sc, &sc->rxq);
1939 	RAL_UNLOCK(sc);
1940 }
1941 
1942 static int
1943 rt2560_init(struct rt2560_softc *sc)
1944 {
1945 #define	N(a)	(sizeof (a) / sizeof ((a)[0]))
1946 	/* struct rt2560_softc *sc = priv; */
1947 	struct ieee80211com *ic = &sc->sc_ic;
1948 	uint32_t tmp;
1949 	int i;
1950 
1951 	rt2560_stop(sc);
1952 
1953 	RAL_LOCK(sc);
1954 	/* setup tx/rx ring */
1955 	rt2560_ring_hwsetup(sc);
1956 
1957 	/* initialize MAC registers to default values */
1958 	for (i = 0; i < N(rt2560_def_mac); i++)
1959 		RAL_WRITE(sc, rt2560_def_mac[i].reg, rt2560_def_mac[i].val);
1960 
1961 	rt2560_set_macaddr(sc, ic->ic_macaddr);
1962 
1963 	/* set basic rate set (will be updated later) */
1964 	RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x153);
1965 
1966 	rt2560_set_txantenna(sc, sc->tx_ant);
1967 	rt2560_set_rxantenna(sc, sc->rx_ant);
1968 	rt2560_update_slot(ic, 1);
1969 	rt2560_update_plcp(sc);
1970 	rt2560_update_led(sc, 0, 0);
1971 
1972 	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
1973 	RAL_WRITE(sc, RT2560_CSR1, RT2560_HOST_READY);
1974 
1975 	if (rt2560_bbp_init(sc) != 0) {
1976 		RAL_UNLOCK(sc);
1977 		rt2560_stop(sc);
1978 		return (DDI_FAILURE);
1979 	}
1980 
1981 	/* set default BSS channel */
1982 	rt2560_set_chan(sc, ic->ic_curchan);
1983 
1984 	/* kick Rx */
1985 	tmp = RT2560_DROP_PHY_ERROR | RT2560_DROP_CRC_ERROR;
1986 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
1987 		tmp |= RT2560_DROP_CTL | RT2560_DROP_VERSION_ERROR;
1988 		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
1989 			tmp |= RT2560_DROP_TODS;
1990 		if (!(sc->sc_rcr & RAL_RCR_PROMISC))
1991 			tmp |= RT2560_DROP_NOT_TO_ME;
1992 
1993 	}
1994 	RAL_WRITE(sc, RT2560_RXCSR0, tmp);
1995 
1996 	/* clear old FCS and Rx FIFO errors */
1997 	(void) RAL_READ(sc, RT2560_CNT0);
1998 	(void) RAL_READ(sc, RT2560_CNT4);
1999 
2000 	/* clear any pending interrupts */
2001 	RAL_WRITE(sc, RT2560_CSR7, 0xffffffff);
2002 	/* enable interrupts */
2003 	RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
2004 
2005 	RAL_UNLOCK(sc);
2006 #undef N
2007 	return (DDI_SUCCESS);
2008 }
2009 
2010 void
2011 rt2560_watchdog(void *arg)
2012 {
2013 	struct rt2560_softc *sc = arg;
2014 	struct ieee80211com *ic = &sc->sc_ic;
2015 	int ntimer = 0;
2016 
2017 	RAL_LOCK(sc);
2018 	ic->ic_watchdog_timer = 0;
2019 
2020 	if (!RAL_IS_RUNNING(sc)) {
2021 		RAL_UNLOCK(sc);
2022 		return;
2023 	}
2024 
2025 	if (sc->sc_tx_timer > 0) {
2026 		if (--sc->sc_tx_timer == 0) {
2027 			RAL_DEBUG(RAL_DBG_MSG, "tx timer timeout\n");
2028 			RAL_UNLOCK(sc);
2029 			(void) rt2560_init(sc);
2030 			(void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2031 			return;
2032 		}
2033 	}
2034 
2035 	if (ic->ic_state == IEEE80211_S_RUN)
2036 		ntimer = 1;
2037 
2038 	RAL_UNLOCK(sc);
2039 
2040 	ieee80211_watchdog(ic);
2041 
2042 	if (ntimer)
2043 		ieee80211_start_watchdog(ic, ntimer);
2044 }
2045 
2046 static int
2047 rt2560_m_start(void *arg)
2048 {
2049 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2050 	crypto_mech_type_t type;
2051 	int err;
2052 
2053 
2054 	type = crypto_mech2id(SUN_CKM_RC4); /* load rc4 module into kernel */
2055 	RAL_DEBUG(RAL_DBG_GLD, "enter rt2560_m_start(%d)\n", type);
2056 
2057 	/*
2058 	 * initialize rt2560 hardware
2059 	 */
2060 	err = rt2560_init(sc);
2061 	if (err != DDI_SUCCESS) {
2062 		RAL_DEBUG(RAL_DBG_GLD, "device configuration failed\n");
2063 		goto fail;
2064 	}
2065 	sc->sc_flags |= RAL_FLAG_RUNNING;	/* RUNNING */
2066 	return (err);
2067 
2068 fail:
2069 	rt2560_stop(sc);
2070 	return (err);
2071 }
2072 
2073 static void
2074 rt2560_m_stop(void *arg)
2075 {
2076 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2077 
2078 	RAL_DEBUG(RAL_DBG_GLD, "enter rt2560_m_stop()\n");
2079 
2080 	(void) rt2560_stop(sc);
2081 	sc->sc_flags &= ~RAL_FLAG_RUNNING;	/* STOP */
2082 }
2083 
2084 static int
2085 rt2560_m_unicst(void *arg, const uint8_t *macaddr)
2086 {
2087 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2088 	struct ieee80211com *ic = &sc->sc_ic;
2089 
2090 	RAL_DEBUG(RAL_DBG_GLD, "rt2560_m_unicst(): " MACSTR "\n",
2091 	    MAC2STR(macaddr));
2092 
2093 	IEEE80211_ADDR_COPY(ic->ic_macaddr, macaddr);
2094 	(void) rt2560_set_macaddr(sc, (uint8_t *)macaddr);
2095 	(void) rt2560_init(sc);
2096 
2097 	return (0);
2098 }
2099 
2100 /*ARGSUSED*/
2101 static int
2102 rt2560_m_multicst(void *arg, boolean_t add, const uint8_t *mca)
2103 {
2104 	return (0);
2105 }
2106 
2107 static int
2108 rt2560_m_promisc(void *arg, boolean_t on)
2109 {
2110 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2111 
2112 	RAL_DEBUG(RAL_DBG_GLD, "rt2560_m_promisc()\n");
2113 
2114 	if (on) {
2115 		sc->sc_rcr |= RAL_RCR_PROMISC;
2116 		sc->sc_rcr |= RAL_RCR_MULTI;
2117 	} else {
2118 		sc->sc_rcr &= ~RAL_RCR_PROMISC;
2119 		sc->sc_rcr &= ~RAL_RCR_PROMISC;
2120 	}
2121 
2122 	rt2560_update_promisc(sc);
2123 	return (0);
2124 }
2125 
2126 static void
2127 rt2560_m_ioctl(void* arg, queue_t *wq, mblk_t *mp)
2128 {
2129 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2130 	struct ieee80211com *ic = &sc->sc_ic;
2131 	int err;
2132 
2133 	err = ieee80211_ioctl(ic, wq, mp);
2134 	RAL_LOCK(sc);
2135 	if (err == ENETRESET) {
2136 		if (RAL_IS_RUNNING(sc)) {
2137 			RAL_UNLOCK(sc);
2138 			(void) rt2560_init(sc);
2139 			(void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2140 			RAL_LOCK(sc);
2141 		}
2142 	}
2143 	RAL_UNLOCK(sc);
2144 }
2145 
2146 static int
2147 rt2560_m_stat(void *arg, uint_t stat, uint64_t *val)
2148 {
2149 	struct rt2560_softc *sc  = (struct rt2560_softc *)arg;
2150 	ieee80211com_t	*ic = &sc->sc_ic;
2151 	ieee80211_node_t *ni = ic->ic_bss;
2152 	struct ieee80211_rateset *rs = &ni->in_rates;
2153 
2154 	RAL_LOCK(sc);
2155 	switch (stat) {
2156 	case MAC_STAT_IFSPEED:
2157 		*val = ((ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE) ?
2158 		    (rs->ir_rates[ni->in_txrate] & IEEE80211_RATE_VAL)
2159 		    : ic->ic_fixed_rate) / 2 * 1000000;
2160 		break;
2161 	case MAC_STAT_NOXMTBUF:
2162 		*val = sc->sc_tx_nobuf;
2163 		break;
2164 	case MAC_STAT_NORCVBUF:
2165 		*val = sc->sc_rx_nobuf;
2166 		break;
2167 	case MAC_STAT_IERRORS:
2168 		*val = sc->sc_rx_err;
2169 		break;
2170 	case MAC_STAT_RBYTES:
2171 		*val = ic->ic_stats.is_rx_bytes;
2172 		break;
2173 	case MAC_STAT_IPACKETS:
2174 		*val = ic->ic_stats.is_rx_frags;
2175 		break;
2176 	case MAC_STAT_OBYTES:
2177 		*val = ic->ic_stats.is_tx_bytes;
2178 		break;
2179 	case MAC_STAT_OPACKETS:
2180 		*val = ic->ic_stats.is_tx_frags;
2181 		break;
2182 	case MAC_STAT_OERRORS:
2183 	case WIFI_STAT_TX_FAILED:
2184 		*val = sc->sc_tx_err;
2185 		break;
2186 	case WIFI_STAT_TX_RETRANS:
2187 		*val = sc->sc_tx_retries;
2188 		break;
2189 	case WIFI_STAT_FCS_ERRORS:
2190 	case WIFI_STAT_WEP_ERRORS:
2191 	case WIFI_STAT_TX_FRAGS:
2192 	case WIFI_STAT_MCAST_TX:
2193 	case WIFI_STAT_RTS_SUCCESS:
2194 	case WIFI_STAT_RTS_FAILURE:
2195 	case WIFI_STAT_ACK_FAILURE:
2196 	case WIFI_STAT_RX_FRAGS:
2197 	case WIFI_STAT_MCAST_RX:
2198 	case WIFI_STAT_RX_DUPS:
2199 		RAL_UNLOCK(sc);
2200 		return (ieee80211_stat(ic, stat, val));
2201 	default:
2202 		RAL_UNLOCK(sc);
2203 		return (ENOTSUP);
2204 	}
2205 	RAL_UNLOCK(sc);
2206 
2207 	return (0);
2208 }
2209 
2210 static uint_t
2211 rt2560_intr(caddr_t arg)
2212 {
2213 	/* LINTED E_BAD_PTR_CAST_ALIGN */
2214 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2215 	uint32_t r;
2216 
2217 	RAL_LOCK(sc);
2218 
2219 	r = RAL_READ(sc, RT2560_CSR7);
2220 	RAL_WRITE(sc, RT2560_CSR7, r);
2221 
2222 	if (r == 0xffffffff) {
2223 		RAL_UNLOCK(sc);
2224 		return (DDI_INTR_UNCLAIMED);
2225 	}
2226 
2227 	if (!(r & RT2560_INTR_ALL)) {
2228 		RAL_UNLOCK(sc);
2229 		return (DDI_INTR_UNCLAIMED);
2230 	}
2231 
2232 	/* disable interrupts */
2233 	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
2234 
2235 	if (r & RT2560_TX_DONE) {
2236 		RAL_UNLOCK(sc);
2237 		rt2560_tx_intr(sc);
2238 		RAL_LOCK(sc);
2239 	}
2240 
2241 	if (r & RT2560_PRIO_DONE) {
2242 		RAL_UNLOCK(sc);
2243 		rt2560_prio_intr(sc);
2244 		RAL_LOCK(sc);
2245 	}
2246 
2247 	if (r & RT2560_RX_DONE) {
2248 		sc->sc_rx_pend = 1;
2249 		ddi_trigger_softintr(sc->sc_softint_id);
2250 	}
2251 
2252 	/* re-enable interrupts */
2253 	RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
2254 	RAL_UNLOCK(sc);
2255 
2256 	return (DDI_INTR_CLAIMED);
2257 }
2258 
2259 static int
2260 rt2560_reset(dev_info_t *devinfo, ddi_reset_cmd_t cmd)
2261 {
2262 	struct rt2560_softc *sc;
2263 
2264 	RAL_DEBUG(RAL_DBG_GLD, "rt2560_reset(0x%p)\n", (void *)devinfo);
2265 
2266 	if (cmd != DDI_RESET_FORCE)
2267 		return (DDI_FAILURE);
2268 
2269 	sc = ddi_get_soft_state(ral_soft_state_p, ddi_get_instance(devinfo));
2270 
2271 	/* abort Tx */
2272 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_ABORT_TX);
2273 
2274 	/* disable Rx */
2275 	RAL_WRITE(sc, RT2560_RXCSR0, RT2560_DISABLE_RX);
2276 
2277 	/* reset ASIC (imply reset BBP) */
2278 	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
2279 	RAL_WRITE(sc, RT2560_CSR1, 0);
2280 
2281 	/* disable interrupts */
2282 	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
2283 
2284 	return (DDI_SUCCESS);
2285 }
2286 
2287 static int
2288 rt2560_attach(dev_info_t *devinfo, ddi_attach_cmd_t cmd)
2289 {
2290 	struct rt2560_softc *sc;
2291 	struct ieee80211com *ic;
2292 	int err, i;
2293 	int instance;
2294 
2295 	ddi_acc_handle_t ioh;
2296 	caddr_t regs;
2297 	uint16_t vendor_id, device_id, command;
2298 	uint8_t cachelsz;
2299 	char strbuf[32];
2300 
2301 	wifi_data_t wd = { 0 };
2302 	mac_register_t *macp;
2303 
2304 	RAL_DEBUG(RAL_DBG_GLD, "enter rt2560_attach()\n");
2305 
2306 	if (cmd != DDI_ATTACH)
2307 		return (DDI_FAILURE);
2308 
2309 	instance = ddi_get_instance(devinfo);
2310 
2311 	if (ddi_soft_state_zalloc(ral_soft_state_p, instance) != DDI_SUCCESS) {
2312 		RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2313 		    "unable to alloc soft_state_p\n");
2314 		return (DDI_FAILURE);
2315 	}
2316 
2317 	sc = ddi_get_soft_state(ral_soft_state_p, instance);
2318 	ic = (ieee80211com_t *)&sc->sc_ic;
2319 	sc->sc_dev = devinfo;
2320 
2321 	/* pci configuration */
2322 	err = ddi_regs_map_setup(devinfo, 0, &regs, 0, 0, &ral_csr_accattr,
2323 	    &ioh);
2324 	if (err != DDI_SUCCESS) {
2325 		RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2326 		    "ddi_regs_map_setup() failed");
2327 		goto fail1;
2328 	}
2329 
2330 	cachelsz = ddi_get8(ioh, (uint8_t *)(regs + PCI_CONF_CACHE_LINESZ));
2331 	if (cachelsz == 0)
2332 		cachelsz = 0x10;
2333 	sc->sc_cachelsz = cachelsz << 2;
2334 
2335 	vendor_id = ddi_get16(ioh,
2336 	    (uint16_t *)((uintptr_t)regs + PCI_CONF_VENID));
2337 	device_id = ddi_get16(ioh,
2338 	    (uint16_t *)((uintptr_t)regs + PCI_CONF_DEVID));
2339 
2340 	RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): vendor 0x%x, "
2341 	    "device id 0x%x, cache size %d\n", vendor_id, device_id, cachelsz);
2342 
2343 	/*
2344 	 * Enable response to memory space accesses,
2345 	 * and enabe bus master.
2346 	 */
2347 	command = PCI_COMM_MAE | PCI_COMM_ME;
2348 	ddi_put16(ioh, (uint16_t *)((uintptr_t)regs + PCI_CONF_COMM), command);
2349 	RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2350 	    "set command reg to 0x%x \n", command);
2351 
2352 	ddi_put8(ioh, (uint8_t *)(regs + PCI_CONF_LATENCY_TIMER), 0xa8);
2353 	ddi_put8(ioh, (uint8_t *)(regs + PCI_CONF_ILINE), 0x10);
2354 	ddi_regs_map_free(&ioh);
2355 
2356 	/* pci i/o space */
2357 	err = ddi_regs_map_setup(devinfo, 1,
2358 	    &sc->sc_rbase, 0, 0, &ral_csr_accattr, &sc->sc_ioh);
2359 	RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2360 	    "regs map1 = %x err=%d\n", regs, err);
2361 	if (err != DDI_SUCCESS) {
2362 		RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2363 		    "ddi_regs_map_setup() failed");
2364 		goto fail1;
2365 	}
2366 
2367 	/* initialize the ral rate */
2368 	ral_rate_init();
2369 
2370 	/* retrieve RT2560 rev. no */
2371 	sc->asic_rev = RAL_READ(sc, RT2560_CSR0);
2372 
2373 	/* retrieve MAC address */
2374 	rt2560_get_macaddr(sc, ic->ic_macaddr);
2375 
2376 	/* retrieve RF rev. no and various other things from EEPROM */
2377 	rt2560_read_eeprom(sc);
2378 
2379 	RAL_DEBUG(RAL_DBG_GLD, "MAC/BBP RT2560 (rev 0x%02x), RF %s\n",
2380 	    sc->asic_rev, rt2560_get_rf(sc->rf_rev));
2381 
2382 	/*
2383 	 * Allocate Tx and Rx rings.
2384 	 */
2385 	err = rt2560_alloc_tx_ring(sc, &sc->txq, RT2560_TX_RING_COUNT);
2386 	if (err != DDI_SUCCESS) {
2387 		RAL_DEBUG(RAL_DBG_GLD, "could not allocate Tx ring\n");
2388 		goto fail2;
2389 	}
2390 	err = rt2560_alloc_tx_ring(sc, &sc->prioq, RT2560_PRIO_RING_COUNT);
2391 	if (err != DDI_SUCCESS) {
2392 		RAL_DEBUG(RAL_DBG_GLD, "could not allocate Prio ring\n");
2393 		goto fail3;
2394 	}
2395 	err = rt2560_alloc_rx_ring(sc, &sc->rxq, RT2560_RX_RING_COUNT);
2396 	if (err != DDI_SUCCESS) {
2397 		RAL_DEBUG(RAL_DBG_GLD, "could not allocate Rx ring\n");
2398 		goto fail4;
2399 	}
2400 
2401 	mutex_init(&sc->sc_genlock, NULL, MUTEX_DRIVER, NULL);
2402 	mutex_init(&sc->txq.tx_lock, NULL, MUTEX_DRIVER, NULL);
2403 	mutex_init(&sc->prioq.tx_lock, NULL, MUTEX_DRIVER, NULL);
2404 	mutex_init(&sc->rxq.rx_lock, NULL, MUTEX_DRIVER, NULL);
2405 
2406 
2407 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
2408 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
2409 	ic->ic_state = IEEE80211_S_INIT;
2410 
2411 	ic->ic_maxrssi = 63;
2412 	ic->ic_set_shortslot = rt2560_update_slot;
2413 	ic->ic_xmit = rt2560_mgmt_send;
2414 
2415 	/* set device capabilities */
2416 	ic->ic_caps =
2417 	    IEEE80211_C_TXPMGT |	/* tx power management */
2418 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
2419 	    IEEE80211_C_SHSLOT;		/* short slot time supported */
2420 
2421 	ic->ic_caps |= IEEE80211_C_WPA; /* Support WPA/WPA2 */
2422 
2423 #define	IEEE80211_CHAN_A	\
2424 	(IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_OFDM)
2425 
2426 	if (sc->rf_rev == RT2560_RF_5222) {
2427 		/* set supported .11a rates */
2428 		ic->ic_sup_rates[IEEE80211_MODE_11A] = rt2560_rateset_11a;
2429 
2430 		/* set supported .11a channels */
2431 		for (i = 36; i <= 64; i += 4) {
2432 			ic->ic_sup_channels[i].ich_freq =
2433 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2434 			ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2435 		}
2436 		for (i = 100; i <= 140; i += 4) {
2437 			ic->ic_sup_channels[i].ich_freq =
2438 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2439 			ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2440 		}
2441 		for (i = 149; i <= 161; i += 4) {
2442 			ic->ic_sup_channels[i].ich_freq =
2443 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2444 			ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2445 		}
2446 	}
2447 
2448 	/* set supported .11b and .11g rates */
2449 	ic->ic_sup_rates[IEEE80211_MODE_11B] = rt2560_rateset_11b;
2450 	ic->ic_sup_rates[IEEE80211_MODE_11G] = rt2560_rateset_11g;
2451 
2452 	/* set supported .11b and .11g channels (1 through 14) */
2453 	for (i = 1; i <= 14; i++) {
2454 		ic->ic_sup_channels[i].ich_freq =
2455 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
2456 		ic->ic_sup_channels[i].ich_flags =
2457 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
2458 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
2459 	}
2460 
2461 	ieee80211_attach(ic);
2462 
2463 	/* register WPA door */
2464 	ieee80211_register_door(ic, ddi_driver_name(devinfo),
2465 	    ddi_get_instance(devinfo));
2466 
2467 	ic->ic_node_alloc = rt2560_node_alloc;
2468 	ic->ic_node_free = rt2560_node_free;
2469 
2470 	/* override state transition machine */
2471 	sc->sc_newstate = ic->ic_newstate;
2472 	ic->ic_newstate = rt2560_newstate;
2473 	ic->ic_watchdog = rt2560_watchdog;
2474 	ieee80211_media_init(ic);
2475 	ic->ic_def_txkey = 0;
2476 
2477 	sc->sc_rcr = 0;
2478 	sc->sc_rx_pend = 0;
2479 	sc->dwelltime = 300;
2480 	sc->sc_flags &= ~RAL_FLAG_RUNNING;
2481 
2482 	err = ddi_add_softintr(devinfo, DDI_SOFTINT_LOW,
2483 	    &sc->sc_softint_id, NULL, 0, ral_softint_handler, (caddr_t)sc);
2484 	if (err != DDI_SUCCESS) {
2485 		RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2486 		    "ddi_add_softintr() failed");
2487 		goto fail5;
2488 	}
2489 
2490 	err = ddi_get_iblock_cookie(devinfo, 0, &sc->sc_iblock);
2491 	if (err != DDI_SUCCESS) {
2492 		RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2493 		    "Can not get iblock cookie for INT\n");
2494 		goto fail6;
2495 	}
2496 
2497 	err = ddi_add_intr(devinfo, 0, NULL, NULL, rt2560_intr, (caddr_t)sc);
2498 	if (err != DDI_SUCCESS) {
2499 		RAL_DEBUG(RAL_DBG_GLD,
2500 		    "unable to add device interrupt handler\n");
2501 		goto fail6;
2502 	}
2503 
2504 	/*
2505 	 * Provide initial settings for the WiFi plugin; whenever this
2506 	 * information changes, we need to call mac_plugindata_update()
2507 	 */
2508 	wd.wd_opmode = ic->ic_opmode;
2509 	wd.wd_secalloc = WIFI_SEC_NONE;
2510 	IEEE80211_ADDR_COPY(wd.wd_bssid, ic->ic_bss->in_bssid);
2511 
2512 	if ((macp = mac_alloc(MAC_VERSION)) == NULL) {
2513 		RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2514 		    "MAC version mismatch\n");
2515 		goto fail7;
2516 	}
2517 
2518 	macp->m_type_ident	= MAC_PLUGIN_IDENT_WIFI;
2519 	macp->m_driver		= sc;
2520 	macp->m_dip		= devinfo;
2521 	macp->m_src_addr	= ic->ic_macaddr;
2522 	macp->m_callbacks	= &rt2560_m_callbacks;
2523 	macp->m_min_sdu		= 0;
2524 	macp->m_max_sdu		= IEEE80211_MTU;
2525 	macp->m_pdata		= &wd;
2526 	macp->m_pdata_size	= sizeof (wd);
2527 
2528 	err = mac_register(macp, &ic->ic_mach);
2529 	mac_free(macp);
2530 	if (err != 0) {
2531 		RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2532 		    "mac_register err %x\n", err);
2533 		goto fail7;
2534 	}
2535 
2536 	/*
2537 	 * Create minor node of type DDI_NT_NET_WIFI
2538 	 */
2539 	(void) snprintf(strbuf, sizeof (strbuf), "%s%d",
2540 	    "ral", instance);
2541 	err = ddi_create_minor_node(devinfo, strbuf, S_IFCHR,
2542 	    instance + 1, DDI_NT_NET_WIFI, 0);
2543 
2544 	if (err != DDI_SUCCESS)
2545 		RAL_DEBUG(RAL_DBG_GLD, "ddi_create_minor_node() failed\n");
2546 
2547 	/*
2548 	 * Notify link is down now
2549 	 */
2550 	mac_link_update(ic->ic_mach, LINK_STATE_DOWN);
2551 
2552 	RAL_DEBUG(RAL_DBG_GLD, "rt2560_attach() exit successfully.\n");
2553 	return (DDI_SUCCESS);
2554 fail7:
2555 	ddi_remove_intr(devinfo, 0, sc->sc_iblock);
2556 fail6:
2557 	ddi_remove_softintr(sc->sc_softint_id);
2558 fail5:
2559 	mutex_destroy(&sc->sc_genlock);
2560 	mutex_destroy(&sc->txq.tx_lock);
2561 	mutex_destroy(&sc->prioq.tx_lock);
2562 	mutex_destroy(&sc->rxq.rx_lock);
2563 
2564 	rt2560_free_rx_ring(sc, &sc->rxq);
2565 fail4:
2566 	rt2560_free_tx_ring(sc, &sc->prioq);
2567 fail3:
2568 	rt2560_free_tx_ring(sc, &sc->txq);
2569 fail2:
2570 	ddi_regs_map_free(&sc->sc_ioh);
2571 fail1:
2572 	ddi_soft_state_free(ral_soft_state_p, ddi_get_instance(devinfo));
2573 
2574 	return (DDI_FAILURE);
2575 }
2576 
2577 static int
2578 rt2560_detach(dev_info_t *devinfo, ddi_detach_cmd_t cmd)
2579 {
2580 	struct rt2560_softc *sc;
2581 
2582 	RAL_DEBUG(RAL_DBG_GLD, "enter rt2560_detach()\n");
2583 	sc = ddi_get_soft_state(ral_soft_state_p, ddi_get_instance(devinfo));
2584 
2585 	if (cmd != DDI_DETACH)
2586 		return (DDI_FAILURE);
2587 
2588 	rt2560_stop(sc);
2589 
2590 	/*
2591 	 * Unregister from the MAC layer subsystem
2592 	 */
2593 	if (mac_unregister(sc->sc_ic.ic_mach) != 0)
2594 		return (DDI_FAILURE);
2595 
2596 	ddi_remove_intr(devinfo, 0, sc->sc_iblock);
2597 	ddi_remove_softintr(sc->sc_softint_id);
2598 
2599 	/*
2600 	 * detach ieee80211 layer
2601 	 */
2602 	ieee80211_detach(&sc->sc_ic);
2603 
2604 	rt2560_free_tx_ring(sc, &sc->txq);
2605 	rt2560_free_tx_ring(sc, &sc->prioq);
2606 	rt2560_free_rx_ring(sc, &sc->rxq);
2607 
2608 	ddi_regs_map_free(&sc->sc_ioh);
2609 
2610 	mutex_destroy(&sc->sc_genlock);
2611 	mutex_destroy(&sc->txq.tx_lock);
2612 	mutex_destroy(&sc->prioq.tx_lock);
2613 	mutex_destroy(&sc->rxq.rx_lock);
2614 
2615 	ddi_remove_minor_node(devinfo, NULL);
2616 	ddi_soft_state_free(ral_soft_state_p, ddi_get_instance(devinfo));
2617 
2618 	return (DDI_SUCCESS);
2619 }
2620 
2621 int
2622 _info(struct modinfo *modinfop)
2623 {
2624 	return (mod_info(&modlinkage, modinfop));
2625 }
2626 
2627 int
2628 _init(void)
2629 {
2630 	int status;
2631 
2632 	status = ddi_soft_state_init(&ral_soft_state_p,
2633 	    sizeof (struct rt2560_softc), 1);
2634 	if (status != 0)
2635 		return (status);
2636 
2637 	mac_init_ops(&ral_dev_ops, "ral");
2638 	status = mod_install(&modlinkage);
2639 	if (status != 0) {
2640 		mac_fini_ops(&ral_dev_ops);
2641 		ddi_soft_state_fini(&ral_soft_state_p);
2642 	}
2643 	return (status);
2644 }
2645 
2646 int
2647 _fini(void)
2648 {
2649 	int status;
2650 
2651 	status = mod_remove(&modlinkage);
2652 	if (status == 0) {
2653 		mac_fini_ops(&ral_dev_ops);
2654 		ddi_soft_state_fini(&ral_soft_state_p);
2655 	}
2656 	return (status);
2657 }
2658