xref: /illumos-gate/usr/src/uts/common/io/ral/rt2560.c (revision 0bb073995ac5a95bd35f2dd790df1ea3d8c2d507)
1 /*
2  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
3  * Use is subject to license terms.
4  */
5 
6 /*
7  * Copyright (c) 2005, 2006
8  *	Damien Bergamini <damien.bergamini@free.fr>
9  *
10  * Permission to use, copy, modify, and distribute this software for any
11  * purpose with or without fee is hereby granted, provided that the above
12  * copyright notice and this permission notice appear in all copies.
13  *
14  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
15  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
16  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
17  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
18  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
20  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21  */
22 
23 /*
24  * Ralink Technology RT2560 chipset driver
25  * http://www.ralinktech.com/
26  */
27 
28 #include <sys/types.h>
29 #include <sys/byteorder.h>
30 #include <sys/conf.h>
31 #include <sys/cmn_err.h>
32 #include <sys/stat.h>
33 #include <sys/ddi.h>
34 #include <sys/sunddi.h>
35 #include <sys/strsubr.h>
36 #include <sys/ethernet.h>
37 #include <inet/common.h>
38 #include <inet/nd.h>
39 #include <inet/mi.h>
40 #include <sys/note.h>
41 #include <sys/stream.h>
42 #include <sys/strsun.h>
43 #include <sys/modctl.h>
44 #include <sys/devops.h>
45 #include <sys/dlpi.h>
46 #include <sys/mac.h>
47 #include <sys/mac_wifi.h>
48 #include <sys/net80211.h>
49 #include <sys/net80211_proto.h>
50 #include <sys/varargs.h>
51 #include <sys/policy.h>
52 #include <sys/pci.h>
53 #include <sys/crypto/common.h>
54 #include <sys/crypto/api.h>
55 #include <inet/wifi_ioctl.h>
56 
57 #include "ral_rate.h"
58 #include "rt2560_reg.h"
59 #include "rt2560_var.h"
60 
61 
62 static void *ral_soft_state_p = NULL;
63 
64 #define	RAL_TXBUF_SIZE  	(IEEE80211_MAX_LEN)
65 #define	RAL_RXBUF_SIZE  	(IEEE80211_MAX_LEN)
66 
67 /* quickly determine if a given rate is CCK or OFDM */
68 #define	RAL_RATE_IS_OFDM(rate)	((rate) >= 12 && (rate) != 22)
69 #define	RAL_ACK_SIZE		14	/* 10 + 4(FCS) */
70 #define	RAL_CTS_SIZE		14	/* 10 + 4(FCS) */
71 #define	RAL_SIFS		10	/* us */
72 #define	RT2560_TXRX_TURNAROUND	10	/* us */
73 
74 /*
75  * Supported rates for 802.11a/b/g modes (in 500Kbps unit).
76  */
77 static const struct ieee80211_rateset rt2560_rateset_11a =
78 	{ 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
79 
80 static const struct ieee80211_rateset rt2560_rateset_11b =
81 	{ 4, { 2, 4, 11, 22 } };
82 
83 static const struct ieee80211_rateset rt2560_rateset_11g =
84 	{ 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
85 
86 static const struct {
87 	uint32_t	reg;
88 	uint32_t	val;
89 } rt2560_def_mac[] = {
90 	RT2560_DEF_MAC
91 };
92 
93 static const struct {
94 	uint8_t	reg;
95 	uint8_t	val;
96 } rt2560_def_bbp[] = {
97 	RT2560_DEF_BBP
98 };
99 
100 static const uint32_t rt2560_rf2522_r2[]    = RT2560_RF2522_R2;
101 static const uint32_t rt2560_rf2523_r2[]    = RT2560_RF2523_R2;
102 static const uint32_t rt2560_rf2524_r2[]    = RT2560_RF2524_R2;
103 static const uint32_t rt2560_rf2525_r2[]    = RT2560_RF2525_R2;
104 static const uint32_t rt2560_rf2525_hi_r2[] = RT2560_RF2525_HI_R2;
105 static const uint32_t rt2560_rf2525e_r2[]   = RT2560_RF2525E_R2;
106 static const uint32_t rt2560_rf2526_r2[]    = RT2560_RF2526_R2;
107 static const uint32_t rt2560_rf2526_hi_r2[] = RT2560_RF2526_HI_R2;
108 
109 static const struct {
110 	uint8_t		chan;
111 	uint32_t	r1, r2, r4;
112 } rt2560_rf5222[] = {
113 	RT2560_RF5222
114 };
115 
116 /*
117  * PIO access attributes for registers
118  */
119 static ddi_device_acc_attr_t ral_csr_accattr = {
120 	DDI_DEVICE_ATTR_V0,
121 	DDI_STRUCTURE_LE_ACC,
122 	DDI_STRICTORDER_ACC
123 };
124 
125 /*
126  * DMA access attributes for descriptors: NOT to be byte swapped.
127  */
128 static ddi_device_acc_attr_t ral_desc_accattr = {
129 	DDI_DEVICE_ATTR_V0,
130 	DDI_STRUCTURE_LE_ACC,
131 	DDI_STRICTORDER_ACC
132 };
133 
134 /*
135  * Describes the chip's DMA engine
136  */
137 static ddi_dma_attr_t ral_dma_attr = {
138 	DMA_ATTR_V0,			/* dma_attr version */
139 	0x0000000000000000ull,		/* dma_attr_addr_lo */
140 	0xFFFFFFFF,			/* dma_attr_addr_hi */
141 	0x00000000FFFFFFFFull,		/* dma_attr_count_max */
142 	0x0000000000000001ull,		/* dma_attr_align */
143 	0x00000FFF,			/* dma_attr_burstsizes */
144 	0x00000001,			/* dma_attr_minxfer */
145 	0x000000000000FFFFull,		/* dma_attr_maxxfer */
146 	0xFFFFFFFFFFFFFFFFull,		/* dma_attr_seg */
147 	1,				/* dma_attr_sgllen */
148 	0x00000001,			/* dma_attr_granular */
149 	0				/* dma_attr_flags */
150 };
151 
152 /*
153  * device operations
154  */
155 static int rt2560_attach(dev_info_t *, ddi_attach_cmd_t);
156 static int rt2560_detach(dev_info_t *, ddi_detach_cmd_t);
157 static int rt2560_reset(dev_info_t *, ddi_reset_cmd_t);
158 
159 /*
160  * Module Loading Data & Entry Points
161  */
162 DDI_DEFINE_STREAM_OPS(ral_dev_ops, nulldev, nulldev, rt2560_attach,
163     rt2560_detach, rt2560_reset, NULL, D_MP, NULL, ddi_quiesce_not_supported);
164 
165 static struct modldrv ral_modldrv = {
166 	&mod_driverops,		/* Type of module.  This one is a driver */
167 	"Ralink RT2500 driver",	/* short description */
168 	&ral_dev_ops		/* driver specific ops */
169 };
170 
171 static struct modlinkage modlinkage = {
172 	MODREV_1,
173 	(void *)&ral_modldrv,
174 	NULL
175 };
176 
177 static int	rt2560_m_stat(void *,  uint_t, uint64_t *);
178 static int	rt2560_m_start(void *);
179 static void	rt2560_m_stop(void *);
180 static int	rt2560_m_promisc(void *, boolean_t);
181 static int	rt2560_m_multicst(void *, boolean_t, const uint8_t *);
182 static int	rt2560_m_unicst(void *, const uint8_t *);
183 static mblk_t	*rt2560_m_tx(void *, mblk_t *);
184 static void	rt2560_m_ioctl(void *, queue_t *, mblk_t *);
185 
186 static mac_callbacks_t rt2560_m_callbacks = {
187 	MC_IOCTL,
188 	rt2560_m_stat,
189 	rt2560_m_start,
190 	rt2560_m_stop,
191 	rt2560_m_promisc,
192 	rt2560_m_multicst,
193 	rt2560_m_unicst,
194 	rt2560_m_tx,
195 	NULL,		/* mc_resources; */
196 	rt2560_m_ioctl,
197 	NULL		/* mc_getcapab */
198 };
199 
200 uint32_t ral_dbg_flags = 0;
201 
202 void
203 ral_debug(uint32_t dbg_flags, const int8_t *fmt, ...)
204 {
205 	va_list args;
206 
207 	if (dbg_flags & ral_dbg_flags) {
208 		va_start(args, fmt);
209 		vcmn_err(CE_CONT, fmt, args);
210 		va_end(args);
211 	}
212 }
213 
214 static void
215 rt2560_set_basicrates(struct rt2560_softc *sc)
216 {
217 	struct ieee80211com *ic = &sc->sc_ic;
218 
219 	/* update basic rate set */
220 	if (ic->ic_curmode == IEEE80211_MODE_11B) {
221 		/* 11b basic rates: 1, 2Mbps */
222 		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x3);
223 	} else if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan)) {
224 		/* 11a basic rates: 6, 12, 24Mbps */
225 		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x150);
226 	} else {
227 		/* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
228 		RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x15f);
229 	}
230 }
231 
232 static void
233 rt2560_update_led(struct rt2560_softc *sc, int led1, int led2)
234 {
235 	uint32_t tmp;
236 
237 	/* set ON period to 70ms and OFF period to 30ms */
238 	tmp = led1 << 16 | led2 << 17 | 70 << 8 | 30;
239 	RAL_WRITE(sc, RT2560_LEDCSR, tmp);
240 }
241 
242 static void
243 rt2560_set_bssid(struct rt2560_softc *sc, uint8_t *bssid)
244 {
245 	uint32_t tmp;
246 
247 	tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
248 	RAL_WRITE(sc, RT2560_CSR5, tmp);
249 
250 	tmp = bssid[4] | bssid[5] << 8;
251 	RAL_WRITE(sc, RT2560_CSR6, tmp);
252 
253 	RAL_DEBUG(RAL_DBG_HW, "setting BSSID to " MACSTR "\n", MAC2STR(bssid));
254 }
255 
256 
257 static void
258 rt2560_bbp_write(struct rt2560_softc *sc, uint8_t reg, uint8_t val)
259 {
260 	uint32_t tmp;
261 	int ntries;
262 
263 	for (ntries = 0; ntries < 100; ntries++) {
264 		if (!(RAL_READ(sc, RT2560_BBPCSR) & RT2560_BBP_BUSY))
265 			break;
266 		drv_usecwait(1);
267 	}
268 	if (ntries == 100) {
269 		RAL_DEBUG(RAL_DBG_HW, "could not write to BBP\n");
270 		return;
271 	}
272 
273 	tmp = RT2560_BBP_WRITE | RT2560_BBP_BUSY | reg << 8 | val;
274 	RAL_WRITE(sc, RT2560_BBPCSR, tmp);
275 
276 	RAL_DEBUG(RAL_DBG_HW, "BBP R%u <- 0x%02x\n", reg, val);
277 }
278 
279 static uint8_t
280 rt2560_bbp_read(struct rt2560_softc *sc, uint8_t reg)
281 {
282 	uint32_t val;
283 	int ntries;
284 
285 	val = RT2560_BBP_BUSY | reg << 8;
286 	RAL_WRITE(sc, RT2560_BBPCSR, val);
287 
288 	for (ntries = 0; ntries < 100; ntries++) {
289 		val = RAL_READ(sc, RT2560_BBPCSR);
290 		if (!(val & RT2560_BBP_BUSY))
291 			return (val & 0xff);
292 		drv_usecwait(1);
293 	}
294 
295 	RAL_DEBUG(RAL_DBG_HW, "could not read from BBP\n");
296 	return (0);
297 }
298 
299 static void
300 rt2560_rf_write(struct rt2560_softc *sc, uint8_t reg, uint32_t val)
301 {
302 	uint32_t tmp;
303 	int ntries;
304 
305 	for (ntries = 0; ntries < 100; ntries++) {
306 		if (!(RAL_READ(sc, RT2560_RFCSR) & RT2560_RF_BUSY))
307 			break;
308 		drv_usecwait(1);
309 	}
310 	if (ntries == 100) {
311 		RAL_DEBUG(RAL_DBG_HW, "could not write to RF\n");
312 		return;
313 	}
314 
315 	tmp = RT2560_RF_BUSY | RT2560_RF_20BIT | (val & 0xfffff) << 2 |
316 	    (reg & 0x3);
317 	RAL_WRITE(sc, RT2560_RFCSR, tmp);
318 
319 	/* remember last written value in sc */
320 	sc->rf_regs[reg] = val;
321 
322 	RAL_DEBUG(RAL_DBG_HW, "RF R[%u] <- 0x%05x\n", reg & 0x3, val & 0xfffff);
323 }
324 
325 static void
326 rt2560_set_chan(struct rt2560_softc *sc, struct ieee80211_channel *c)
327 {
328 	struct ieee80211com *ic = &sc->sc_ic;
329 	uint8_t power, tmp;
330 	uint_t i, chan;
331 
332 	chan = ieee80211_chan2ieee(ic, c);
333 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
334 		return;
335 
336 	if (IEEE80211_IS_CHAN_2GHZ(c))
337 		power = min(sc->txpow[chan - 1], 31);
338 	else
339 		power = 31;
340 
341 	/* adjust txpower using ifconfig settings */
342 	power -= (100 - ic->ic_txpowlimit) / 8;
343 
344 	RAL_DEBUG(RAL_DBG_CHAN, "setting channel to %u, txpower to %u\n",
345 	    chan, power);
346 
347 	switch (sc->rf_rev) {
348 	case RT2560_RF_2522:
349 		rt2560_rf_write(sc, RAL_RF1, 0x00814);
350 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2522_r2[chan - 1]);
351 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
352 		break;
353 
354 	case RT2560_RF_2523:
355 		rt2560_rf_write(sc, RAL_RF1, 0x08804);
356 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2523_r2[chan - 1]);
357 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x38044);
358 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
359 		break;
360 
361 	case RT2560_RF_2524:
362 		rt2560_rf_write(sc, RAL_RF1, 0x0c808);
363 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2524_r2[chan - 1]);
364 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
365 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
366 		break;
367 
368 	case RT2560_RF_2525:
369 		rt2560_rf_write(sc, RAL_RF1, 0x08808);
370 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525_hi_r2[chan - 1]);
371 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
372 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
373 
374 		rt2560_rf_write(sc, RAL_RF1, 0x08808);
375 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525_r2[chan - 1]);
376 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
377 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
378 		break;
379 
380 	case RT2560_RF_2525E:
381 		rt2560_rf_write(sc, RAL_RF1, 0x08808);
382 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525e_r2[chan - 1]);
383 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
384 		rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00286 : 0x00282);
385 		break;
386 
387 	case RT2560_RF_2526:
388 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2526_hi_r2[chan - 1]);
389 		rt2560_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
390 		rt2560_rf_write(sc, RAL_RF1, 0x08804);
391 
392 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf2526_r2[chan - 1]);
393 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
394 		rt2560_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
395 		break;
396 
397 	/* dual-band RF */
398 	case RT2560_RF_5222:
399 		for (i = 0; rt2560_rf5222[i].chan != chan; i++) {
400 		}
401 
402 		rt2560_rf_write(sc, RAL_RF1, rt2560_rf5222[i].r1);
403 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf5222[i].r2);
404 		rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
405 		rt2560_rf_write(sc, RAL_RF4, rt2560_rf5222[i].r4);
406 		break;
407 	}
408 
409 	if (ic->ic_state != IEEE80211_S_SCAN) {
410 		/* set Japan filter bit for channel 14 */
411 		tmp = rt2560_bbp_read(sc, 70);
412 
413 		tmp &= ~RT2560_JAPAN_FILTER;
414 		if (chan == 14)
415 			tmp |= RT2560_JAPAN_FILTER;
416 
417 		rt2560_bbp_write(sc, 70, tmp);
418 
419 		/* clear CRC errors */
420 		(void) RAL_READ(sc, RT2560_CNT0);
421 	}
422 }
423 
424 /*
425  * Refer to IEEE Std 802.11-1999 pp. 123 for more information on TSF
426  * synchronization.
427  */
428 static void
429 rt2560_enable_tsf_sync(struct rt2560_softc *sc)
430 {
431 	struct ieee80211com *ic = &sc->sc_ic;
432 	uint16_t logcwmin, preload;
433 	uint32_t tmp;
434 
435 	/* first, disable TSF synchronization */
436 	RAL_WRITE(sc, RT2560_CSR14, 0);
437 
438 	tmp = 16 * ic->ic_bss->in_intval;
439 	RAL_WRITE(sc, RT2560_CSR12, tmp);
440 
441 	RAL_WRITE(sc, RT2560_CSR13, 0);
442 
443 	logcwmin = 5;
444 	preload = (ic->ic_opmode == IEEE80211_M_STA) ? 384 : 1024;
445 	tmp = logcwmin << 16 | preload;
446 	RAL_WRITE(sc, RT2560_BCNOCSR, tmp);
447 
448 	/* finally, enable TSF synchronization */
449 	tmp = RT2560_ENABLE_TSF | RT2560_ENABLE_TBCN;
450 	if (ic->ic_opmode == IEEE80211_M_STA)
451 		tmp |= RT2560_ENABLE_TSF_SYNC(1);
452 	else
453 		tmp |= RT2560_ENABLE_TSF_SYNC(2) |
454 		    RT2560_ENABLE_BEACON_GENERATOR;
455 	RAL_WRITE(sc, RT2560_CSR14, tmp);
456 
457 	RAL_DEBUG(RAL_DBG_HW, "enabling TSF synchronization\n");
458 }
459 
460 static void
461 rt2560_update_plcp(struct rt2560_softc *sc)
462 {
463 	struct ieee80211com *ic = &sc->sc_ic;
464 
465 	/* no short preamble for 1Mbps */
466 	RAL_WRITE(sc, RT2560_PLCP1MCSR, 0x00700400);
467 
468 	if (!(ic->ic_flags & IEEE80211_F_SHPREAMBLE)) {
469 		/* values taken from the reference driver */
470 		RAL_WRITE(sc, RT2560_PLCP2MCSR,   0x00380401);
471 		RAL_WRITE(sc, RT2560_PLCP5p5MCSR, 0x00150402);
472 		RAL_WRITE(sc, RT2560_PLCP11MCSR,  0x000b8403);
473 	} else {
474 		/* same values as above or'ed 0x8 */
475 		RAL_WRITE(sc, RT2560_PLCP2MCSR,   0x00380409);
476 		RAL_WRITE(sc, RT2560_PLCP5p5MCSR, 0x0015040a);
477 		RAL_WRITE(sc, RT2560_PLCP11MCSR,  0x000b840b);
478 	}
479 
480 	RAL_DEBUG(RAL_DBG_HW, "updating PLCP for %s preamble\n",
481 	    (ic->ic_flags & IEEE80211_F_SHPREAMBLE) ? "short" : "long");
482 }
483 
484 /*
485  * This function can be called by ieee80211_set_shortslottime(). Refer to
486  * IEEE Std 802.11-1999 pp. 85 to know how these values are computed.
487  */
488 void
489 rt2560_update_slot(struct ieee80211com *ic, int onoff)
490 {
491 	struct rt2560_softc *sc = (struct rt2560_softc *)ic;
492 	uint8_t slottime;
493 	uint16_t tx_sifs, tx_pifs, tx_difs, eifs;
494 	uint32_t tmp;
495 
496 	/* slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20; */
497 	slottime = (onoff ? 9 : 20);
498 
499 	/* update the MAC slot boundaries */
500 	tx_sifs = RAL_SIFS - RT2560_TXRX_TURNAROUND;
501 	tx_pifs = tx_sifs + slottime;
502 	tx_difs = tx_sifs + 2 * slottime;
503 	eifs = (ic->ic_curmode == IEEE80211_MODE_11B) ? 364 : 60;
504 
505 	tmp = RAL_READ(sc, RT2560_CSR11);
506 	tmp = (tmp & ~0x1f00) | slottime << 8;
507 	RAL_WRITE(sc, RT2560_CSR11, tmp);
508 
509 	tmp = tx_pifs << 16 | tx_sifs;
510 	RAL_WRITE(sc, RT2560_CSR18, tmp);
511 
512 	tmp = eifs << 16 | tx_difs;
513 	RAL_WRITE(sc, RT2560_CSR19, tmp);
514 
515 	RAL_DEBUG(RAL_DBG_HW, "setting slottime to %uus\n", slottime);
516 }
517 
518 int
519 ral_dma_region_alloc(struct rt2560_softc *sc, struct dma_region *dr,
520     size_t size, uint_t alloc_flags, uint_t bind_flags)
521 {
522 	dev_info_t *dip = sc->sc_dev;
523 	int err;
524 
525 	RAL_DEBUG(RAL_DBG_DMA, "ral_dma_region_alloc() size=%u\n", size);
526 
527 	err = ddi_dma_alloc_handle(dip, &ral_dma_attr, DDI_DMA_SLEEP, NULL,
528 	    &dr->dr_hnd);
529 	if (err != DDI_SUCCESS)
530 		goto fail1;
531 
532 	err = ddi_dma_mem_alloc(dr->dr_hnd, size, &ral_desc_accattr,
533 	    alloc_flags, DDI_DMA_SLEEP, NULL,
534 	    &dr->dr_base, &dr->dr_size, &dr->dr_acc);
535 	if (err != DDI_SUCCESS)
536 		goto fail2;
537 
538 	err = ddi_dma_addr_bind_handle(dr->dr_hnd, NULL,
539 	    dr->dr_base, dr->dr_size,
540 	    bind_flags, DDI_DMA_SLEEP, NULL, &dr->dr_cookie, &dr->dr_ccnt);
541 	if (err != DDI_SUCCESS)
542 		goto fail3;
543 
544 	if (dr->dr_ccnt != 1) {
545 		err = DDI_FAILURE;
546 		goto fail4;
547 	}
548 
549 	dr->dr_pbase = dr->dr_cookie.dmac_address;
550 	RAL_DEBUG(RAL_DBG_DMA, "get physical-base=0x%08x\n", dr->dr_pbase);
551 
552 	return (DDI_SUCCESS);
553 
554 fail4:
555 	(void) ddi_dma_unbind_handle(dr->dr_hnd);
556 fail3:
557 	ddi_dma_mem_free(&dr->dr_acc);
558 fail2:
559 	ddi_dma_free_handle(&dr->dr_hnd);
560 fail1:
561 	return (err);
562 }
563 
564 /* ARGSUSED */
565 void
566 ral_dma_region_free(struct rt2560_softc *sc, struct dma_region *dr)
567 {
568 	(void) ddi_dma_unbind_handle(dr->dr_hnd);
569 	ddi_dma_mem_free(&dr->dr_acc);
570 	ddi_dma_free_handle(&dr->dr_hnd);
571 }
572 
573 int
574 rt2560_alloc_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring,
575 	int count)
576 {
577 	int i, err;
578 	int size;
579 
580 	ring->count = count;
581 	ring->queued = 0;
582 	ring->cur = ring->next = 0;
583 	ring->cur_encrypt = ring->next_encrypt = 0;
584 
585 	ring->data = kmem_zalloc(count * (sizeof (struct rt2560_tx_data)),
586 	    KM_SLEEP);
587 	ring->dr_txbuf = kmem_zalloc(count * (sizeof (struct dma_region)),
588 	    KM_SLEEP);
589 
590 	err = ral_dma_region_alloc(sc, &ring->dr_desc,
591 	    count * (sizeof (struct rt2560_tx_desc)),
592 	    DDI_DMA_CONSISTENT, DDI_DMA_RDWR | DDI_DMA_CONSISTENT);
593 
594 	if (err != DDI_SUCCESS)
595 		goto fail1;
596 
597 	size = roundup(RAL_TXBUF_SIZE, sc->sc_cachelsz);
598 	for (i = 0; i < count; i++) {
599 		err = ral_dma_region_alloc(sc, &ring->dr_txbuf[i], size,
600 		    DDI_DMA_STREAMING, DDI_DMA_WRITE | DDI_DMA_STREAMING);
601 		if (err != DDI_SUCCESS) {
602 			while (i >= 0) {
603 				ral_dma_region_free(sc, &ring->dr_txbuf[i]);
604 				i--;
605 			}
606 			goto fail2;
607 		}
608 	}
609 
610 	ring->physaddr = LE_32(ring->dr_desc.dr_pbase);
611 	ring->desc = (struct rt2560_tx_desc *)ring->dr_desc.dr_base;
612 
613 	for (i = 0; i < count; i++) {
614 		ring->desc[i].physaddr = LE_32(ring->dr_txbuf[i].dr_pbase);
615 		ring->data[i].buf = ring->dr_txbuf[i].dr_base;
616 	}
617 
618 	return (DDI_SUCCESS);
619 fail2:
620 	ral_dma_region_free(sc, &ring->dr_desc);
621 fail1:
622 	return (err);
623 }
624 
625 /* ARGSUSED */
626 void
627 rt2560_reset_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring)
628 {
629 	struct rt2560_tx_desc *desc;
630 	struct rt2560_tx_data *data;
631 	int i;
632 
633 	for (i = 0; i < ring->count; i++) {
634 		desc = &ring->desc[i];
635 		data = &ring->data[i];
636 
637 		if (data->ni != NULL) {
638 			ieee80211_free_node(data->ni);
639 			data->ni = NULL;
640 		}
641 
642 		desc->flags = 0;
643 	}
644 
645 	(void) ddi_dma_sync(ring->dr_desc.dr_hnd, 0,
646 	    ring->count * sizeof (struct rt2560_tx_desc), DDI_DMA_SYNC_FORDEV);
647 
648 	ring->queued = 0;
649 	ring->cur = ring->next = 0;
650 	ring->cur_encrypt = ring->next_encrypt = 0;
651 }
652 
653 void
654 rt2560_free_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring)
655 {
656 	struct rt2560_tx_data *data;
657 	int i;
658 
659 	ral_dma_region_free(sc, &ring->dr_desc);
660 	/* tx buf */
661 	for (i = 0; i < ring->count; i++) {
662 		data = &ring->data[i];
663 		if (data->ni != NULL) {
664 			ieee80211_free_node(data->ni);
665 			data->ni = NULL;
666 		}
667 
668 		ral_dma_region_free(sc, &ring->dr_txbuf[i]);
669 	}
670 
671 	kmem_free(ring->data, ring->count * (sizeof (struct rt2560_tx_data)));
672 	kmem_free(ring->dr_txbuf, ring->count * (sizeof (struct dma_region)));
673 }
674 
675 void
676 rt2560_ring_hwsetup(struct rt2560_softc *sc)
677 {
678 	uint32_t tmp;
679 
680 	/* setup tx rings */
681 	tmp = ((uint32_t)RT2560_PRIO_RING_COUNT << 24) |
682 	    RT2560_ATIM_RING_COUNT << 16 |
683 	    RT2560_TX_RING_COUNT   <<  8 |
684 	    RT2560_TX_DESC_SIZE;
685 
686 	/* rings must be initialized in this exact order */
687 	RAL_WRITE(sc, RT2560_TXCSR2, tmp);
688 	RAL_WRITE(sc, RT2560_TXCSR3, sc->txq.physaddr);
689 	RAL_WRITE(sc, RT2560_TXCSR5, sc->prioq.physaddr);
690 
691 	/* setup rx ring */
692 	tmp = RT2560_RX_RING_COUNT << 8 | RT2560_RX_DESC_SIZE;
693 
694 	RAL_WRITE(sc, RT2560_RXCSR1, tmp);
695 	RAL_WRITE(sc, RT2560_RXCSR2, sc->rxq.physaddr);
696 }
697 
698 int
699 rt2560_alloc_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring,
700 	int count)
701 {
702 	struct rt2560_rx_desc *desc;
703 	struct rt2560_rx_data *data;
704 	int i, err;
705 	int size;
706 
707 	ring->count = count;
708 	ring->cur = ring->next = 0;
709 	ring->cur_decrypt = 0;
710 
711 	ring->data = kmem_zalloc(count * (sizeof (struct rt2560_rx_data)),
712 	    KM_SLEEP);
713 	ring->dr_rxbuf = kmem_zalloc(count * (sizeof (struct dma_region)),
714 	    KM_SLEEP);
715 
716 	err = ral_dma_region_alloc(sc, &ring->dr_desc,
717 	    count * (sizeof (struct rt2560_rx_desc)),
718 	    DDI_DMA_CONSISTENT, DDI_DMA_RDWR | DDI_DMA_CONSISTENT);
719 
720 	if (err != DDI_SUCCESS)
721 		goto fail1;
722 
723 	size = roundup(RAL_RXBUF_SIZE, sc->sc_cachelsz);
724 	for (i = 0; i < count; i++) {
725 		err = ral_dma_region_alloc(sc, &ring->dr_rxbuf[i], size,
726 		    DDI_DMA_STREAMING, DDI_DMA_READ | DDI_DMA_STREAMING);
727 		if (err != DDI_SUCCESS) {
728 			while (i >= 0) {
729 				ral_dma_region_free(sc, &ring->dr_rxbuf[i]);
730 				i--;
731 			}
732 			goto fail2;
733 		}
734 	}
735 
736 	ring->physaddr = ring->dr_desc.dr_pbase;
737 	ring->desc = (struct rt2560_rx_desc *)ring->dr_desc.dr_base;
738 
739 	for (i = 0; i < count; i++) {
740 		desc = &ring->desc[i];
741 		data = &ring->data[i];
742 
743 		desc->physaddr = LE_32(ring->dr_rxbuf[i].dr_pbase);
744 		desc->flags = LE_32(RT2560_RX_BUSY);
745 
746 		data->buf = ring->dr_rxbuf[i].dr_base;
747 	}
748 
749 	return (DDI_SUCCESS);
750 fail2:
751 	ral_dma_region_free(sc, &ring->dr_desc);
752 fail1:
753 	return (err);
754 }
755 
756 /* ARGSUSED */
757 static void
758 rt2560_reset_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring)
759 {
760 	int i;
761 
762 	for (i = 0; i < ring->count; i++) {
763 		ring->desc[i].flags = LE_32(RT2560_RX_BUSY);
764 		ring->data[i].drop = 0;
765 	}
766 
767 	(void) ddi_dma_sync(ring->dr_desc.dr_hnd, 0,
768 	    ring->count * sizeof (struct rt2560_rx_desc),
769 	    DDI_DMA_SYNC_FORKERNEL);
770 
771 	ring->cur = ring->next = 0;
772 	ring->cur_decrypt = 0;
773 }
774 
775 static void
776 rt2560_free_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring)
777 {
778 	int i;
779 
780 	ral_dma_region_free(sc, &ring->dr_desc);
781 	/* rx buf */
782 	for (i = 0; i < ring->count; i++)
783 		ral_dma_region_free(sc, &ring->dr_rxbuf[i]);
784 
785 	kmem_free(ring->data, ring->count * (sizeof (struct rt2560_rx_data)));
786 	kmem_free(ring->dr_rxbuf, ring->count * (sizeof (struct dma_region)));
787 }
788 
789 /* ARGSUSED */
790 static struct ieee80211_node *
791 rt2560_node_alloc(ieee80211com_t *ic)
792 {
793 	struct rt2560_node *rn;
794 
795 	rn = kmem_zalloc(sizeof (struct rt2560_node), KM_SLEEP);
796 	return ((rn != NULL) ? &rn->ni : NULL);
797 }
798 
799 static void
800 rt2560_node_free(struct ieee80211_node *in)
801 {
802 	ieee80211com_t *ic = in->in_ic;
803 
804 	ic->ic_node_cleanup(in);
805 	if (in->in_wpa_ie != NULL)
806 		ieee80211_free(in->in_wpa_ie);
807 	kmem_free(in, sizeof (struct rt2560_node));
808 }
809 
810 /*
811  * This function is called periodically (every 200ms) during scanning to
812  * switch from one channel to another.
813  */
814 static void
815 rt2560_next_scan(void *arg)
816 {
817 	struct rt2560_softc *sc = arg;
818 	struct ieee80211com *ic = &sc->sc_ic;
819 
820 	if (ic->ic_state == IEEE80211_S_SCAN)
821 		(void) ieee80211_next_scan(ic);
822 }
823 
824 /*
825  * This function is called for each node present in the node station table.
826  */
827 /* ARGSUSED */
828 static void
829 rt2560_iter_func(void *arg, struct ieee80211_node *ni)
830 {
831 	struct rt2560_node *rn = (struct rt2560_node *)ni;
832 
833 	ral_rssadapt_updatestats(&rn->rssadapt);
834 }
835 
836 /*
837  * This function is called periodically (every 100ms) in RUN state to update
838  * the rate adaptation statistics.
839  */
840 static void
841 rt2560_update_rssadapt(void *arg)
842 {
843 	struct rt2560_softc *sc = arg;
844 	struct ieee80211com *ic = &sc->sc_ic;
845 
846 	ieee80211_iterate_nodes(&ic->ic_sta, rt2560_iter_func, arg);
847 	sc->sc_rssadapt_id = timeout(rt2560_update_rssadapt, (void *)sc,
848 	    drv_usectohz(100 * 1000));
849 }
850 
851 static void
852 rt2560_statedog(void *arg)
853 {
854 	struct rt2560_softc *sc = arg;
855 	struct ieee80211com *ic = &sc->sc_ic;
856 	enum ieee80211_state state;
857 
858 	RAL_LOCK(sc);
859 
860 	RAL_DEBUG(RAL_DBG_MSG, "rt2560_statedog(...)\n");
861 
862 	sc->sc_state_id = 0;
863 	state = ic->ic_state;
864 	ic->ic_state = sc->sc_ostate;
865 
866 	RAL_UNLOCK(sc);
867 
868 	ieee80211_new_state(ic, state, -1);
869 
870 }
871 
872 static int
873 rt2560_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
874 {
875 	struct rt2560_softc *sc = (struct rt2560_softc *)ic;
876 	enum ieee80211_state ostate;
877 	struct ieee80211_node *ni;
878 	int err;
879 
880 	RAL_LOCK(sc);
881 
882 	ostate = ic->ic_state;
883 	sc->sc_ostate = ostate;
884 
885 	if (sc->sc_scan_id != 0) {
886 		(void) untimeout(sc->sc_scan_id);
887 		sc->sc_scan_id = 0;
888 	}
889 
890 	if (sc->sc_rssadapt_id != 0) {
891 		(void) untimeout(sc->sc_rssadapt_id);
892 		sc->sc_rssadapt_id = 0;
893 	}
894 
895 	if (sc->sc_state_id != 0) {
896 		(void) untimeout(sc->sc_state_id);
897 		sc->sc_state_id = 0;
898 	}
899 
900 	switch (nstate) {
901 	case IEEE80211_S_INIT:
902 		if (ostate == IEEE80211_S_RUN) {
903 			/* abort TSF synchronization */
904 			RAL_WRITE(sc, RT2560_CSR14, 0);
905 			/* turn association led off */
906 			rt2560_update_led(sc, 0, 0);
907 		}
908 		break;
909 
910 	case IEEE80211_S_SCAN:
911 		rt2560_set_chan(sc, ic->ic_curchan);
912 		sc->sc_scan_id = timeout(rt2560_next_scan, (void *)sc,
913 		    drv_usectohz(sc->dwelltime * 1000));
914 		break;
915 
916 	case IEEE80211_S_AUTH:
917 		RAL_DEBUG(RAL_DBG_STATE, "-> IEEE80211_S_AUTH ...\n");
918 		rt2560_set_chan(sc, ic->ic_curchan);
919 		break;
920 
921 	case IEEE80211_S_ASSOC:
922 		RAL_DEBUG(RAL_DBG_STATE, "-> IEEE80211_S_ASSOC ...\n");
923 		rt2560_set_chan(sc, ic->ic_curchan);
924 
925 		drv_usecwait(10 * 1000);	/* dlink */
926 		sc->sc_state_id = timeout(rt2560_statedog, (void *)sc,
927 		    drv_usectohz(300 * 1000));	/* ap7-3 */
928 		break;
929 
930 	case IEEE80211_S_RUN:
931 		RAL_DEBUG(RAL_DBG_STATE, "-> IEEE80211_S_RUN ...\n");
932 		rt2560_set_chan(sc, ic->ic_curchan);
933 
934 		ni = ic->ic_bss;
935 
936 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
937 			rt2560_update_plcp(sc);
938 			rt2560_set_basicrates(sc);
939 			rt2560_set_bssid(sc, ni->in_bssid);
940 		}
941 
942 		/* turn assocation led on */
943 		rt2560_update_led(sc, 1, 0);
944 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
945 			sc->sc_rssadapt_id = timeout(rt2560_update_rssadapt,
946 			    (void *)sc, drv_usectohz(100 * 1000));
947 			rt2560_enable_tsf_sync(sc);
948 		}
949 		break;
950 	}
951 
952 	RAL_UNLOCK(sc);
953 
954 	err = sc->sc_newstate(ic, nstate, arg);
955 	/*
956 	 * Finally, start any timers.
957 	 */
958 	if (nstate == IEEE80211_S_RUN)
959 		ieee80211_start_watchdog(ic, 1);
960 
961 	return (err);
962 }
963 
964 /*
965  * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46 or
966  * 93C66).
967  */
968 static uint16_t
969 rt2560_eeprom_read(struct rt2560_softc *sc, uint8_t addr)
970 {
971 	uint32_t tmp;
972 	uint16_t val;
973 	int n;
974 
975 	/* clock C once before the first command */
976 	RT2560_EEPROM_CTL(sc, 0);
977 
978 	RT2560_EEPROM_CTL(sc, RT2560_S);
979 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
980 	RT2560_EEPROM_CTL(sc, RT2560_S);
981 
982 	/* write start bit (1) */
983 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D);
984 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D | RT2560_C);
985 
986 	/* write READ opcode (10) */
987 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D);
988 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D | RT2560_C);
989 	RT2560_EEPROM_CTL(sc, RT2560_S);
990 	RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
991 
992 	/* write address (A5-A0 or A7-A0) */
993 	n = (RAL_READ(sc, RT2560_CSR21) & RT2560_93C46) ? 5 : 7;
994 	for (; n >= 0; n--) {
995 		RT2560_EEPROM_CTL(sc, RT2560_S |
996 		    (((addr >> n) & 1) << RT2560_SHIFT_D));
997 		RT2560_EEPROM_CTL(sc, RT2560_S |
998 		    (((addr >> n) & 1) << RT2560_SHIFT_D) | RT2560_C);
999 	}
1000 
1001 	RT2560_EEPROM_CTL(sc, RT2560_S);
1002 
1003 	/* read data Q15-Q0 */
1004 	val = 0;
1005 	for (n = 15; n >= 0; n--) {
1006 		RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
1007 		tmp = RAL_READ(sc, RT2560_CSR21);
1008 		val |= ((tmp & RT2560_Q) >> RT2560_SHIFT_Q) << n;
1009 		RT2560_EEPROM_CTL(sc, RT2560_S);
1010 	}
1011 
1012 	RT2560_EEPROM_CTL(sc, 0);
1013 
1014 	/* clear Chip Select and clock C */
1015 	RT2560_EEPROM_CTL(sc, RT2560_S);
1016 	RT2560_EEPROM_CTL(sc, 0);
1017 	RT2560_EEPROM_CTL(sc, RT2560_C);
1018 
1019 	return (val);
1020 }
1021 
1022 static void
1023 rt2560_tx_intr(struct rt2560_softc *sc)
1024 {
1025 	struct ieee80211com *ic = &sc->sc_ic;
1026 	struct rt2560_tx_desc *desc;
1027 	struct rt2560_tx_data *data;
1028 	struct rt2560_node *rn;
1029 
1030 	struct dma_region *dr;
1031 	int count;
1032 
1033 	dr = &sc->txq.dr_desc;
1034 	count = sc->txq.count;
1035 
1036 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1037 	    DDI_DMA_SYNC_FORKERNEL);
1038 
1039 	mutex_enter(&sc->txq.tx_lock);
1040 
1041 	for (;;) {
1042 		desc = &sc->txq.desc[sc->txq.next];
1043 		data = &sc->txq.data[sc->txq.next];
1044 
1045 		if ((LE_32(desc->flags) & RT2560_TX_BUSY) ||
1046 		    (LE_32(desc->flags) & RT2560_TX_CIPHER_BUSY) ||
1047 		    !(LE_32(desc->flags) & RT2560_TX_VALID))
1048 			break;
1049 
1050 		rn = (struct rt2560_node *)data->ni;
1051 
1052 		switch (LE_32(desc->flags) & RT2560_TX_RESULT_MASK) {
1053 		case RT2560_TX_SUCCESS:
1054 			RAL_DEBUG(RAL_DBG_INTR, "data frame sent success\n");
1055 			if (data->id.id_node != NULL) {
1056 				ral_rssadapt_raise_rate(ic, &rn->rssadapt,
1057 				    &data->id);
1058 			}
1059 			break;
1060 
1061 		case RT2560_TX_SUCCESS_RETRY:
1062 			RAL_DEBUG(RAL_DBG_INTR,
1063 			    "data frame sent after %u retries\n",
1064 			    (LE_32(desc->flags) >> 5) & 0x7);
1065 			sc->sc_tx_retries++;
1066 			break;
1067 
1068 		case RT2560_TX_FAIL_RETRY:
1069 			RAL_DEBUG(RAL_DBG_INTR,
1070 			    "sending data frame failed (too much retries)\n");
1071 			if (data->id.id_node != NULL) {
1072 				ral_rssadapt_lower_rate(ic, data->ni,
1073 				    &rn->rssadapt, &data->id);
1074 			}
1075 			break;
1076 
1077 		case RT2560_TX_FAIL_INVALID:
1078 		case RT2560_TX_FAIL_OTHER:
1079 		default:
1080 			RAL_DEBUG(RAL_DBG_INTR, "sending data frame failed "
1081 			    "0x%08x\n", LE_32(desc->flags));
1082 			break;
1083 		}
1084 
1085 		ieee80211_free_node(data->ni);
1086 		data->ni = NULL;
1087 
1088 		/* descriptor is no longer valid */
1089 		desc->flags &= ~LE_32(RT2560_TX_VALID);
1090 
1091 		RAL_DEBUG(RAL_DBG_INTR, "tx done idx=%u\n", sc->txq.next);
1092 
1093 		sc->txq.queued--;
1094 		sc->txq.next = (sc->txq.next + 1) % RT2560_TX_RING_COUNT;
1095 
1096 		if (sc->sc_need_sched &&
1097 		    sc->txq.queued < (RT2560_TX_RING_COUNT - 32)) {
1098 			sc->sc_need_sched = 0;
1099 			mac_tx_update(ic->ic_mach);
1100 		}
1101 	}
1102 
1103 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1104 	    DDI_DMA_SYNC_FORDEV);
1105 
1106 	sc->sc_tx_timer = 0;
1107 	mutex_exit(&sc->txq.tx_lock);
1108 }
1109 
1110 static void
1111 rt2560_prio_intr(struct rt2560_softc *sc)
1112 {
1113 	struct rt2560_tx_desc *desc;
1114 	struct rt2560_tx_data *data;
1115 
1116 	struct dma_region *dr;
1117 	int count;
1118 
1119 	dr = &sc->prioq.dr_desc;
1120 	count = sc->prioq.count;
1121 
1122 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1123 	    DDI_DMA_SYNC_FORKERNEL);
1124 
1125 	mutex_enter(&sc->prioq.tx_lock);
1126 
1127 	for (;;) {
1128 		desc = &sc->prioq.desc[sc->prioq.next];
1129 		data = &sc->prioq.data[sc->prioq.next];
1130 
1131 		if ((LE_32(desc->flags) & RT2560_TX_BUSY) ||
1132 		    !(LE_32(desc->flags) & RT2560_TX_VALID))
1133 			break;
1134 
1135 		switch (LE_32(desc->flags) & RT2560_TX_RESULT_MASK) {
1136 		case RT2560_TX_SUCCESS:
1137 			RAL_DEBUG(RAL_DBG_INTR, "mgt frame sent success\n");
1138 			break;
1139 
1140 		case RT2560_TX_SUCCESS_RETRY:
1141 			RAL_DEBUG(RAL_DBG_INTR,
1142 			    "mgt frame sent after %u retries\n",
1143 			    (LE_32(desc->flags) >> 5) & 0x7);
1144 			break;
1145 
1146 		case RT2560_TX_FAIL_RETRY:
1147 			RAL_DEBUG(RAL_DBG_INTR,
1148 			    "sending mgt frame failed (too much " "retries)\n");
1149 			break;
1150 
1151 		case RT2560_TX_FAIL_INVALID:
1152 		case RT2560_TX_FAIL_OTHER:
1153 		default:
1154 			RAL_DEBUG(RAL_DBG_INTR, "sending mgt frame failed "
1155 			    "0x%08x\n", LE_32(desc->flags));
1156 		}
1157 
1158 		ieee80211_free_node(data->ni);
1159 		data->ni = NULL;
1160 
1161 		/* descriptor is no longer valid */
1162 		desc->flags &= ~LE_32(RT2560_TX_VALID);
1163 
1164 		RAL_DEBUG(RAL_DBG_INTR, "prio done idx=%u\n", sc->prioq.next);
1165 
1166 		sc->prioq.queued--;
1167 		sc->prioq.next = (sc->prioq.next + 1) % RT2560_PRIO_RING_COUNT;
1168 	}
1169 
1170 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1171 	    DDI_DMA_SYNC_FORDEV);
1172 
1173 	sc->sc_tx_timer = 0;
1174 	mutex_exit(&sc->prioq.tx_lock);
1175 }
1176 
1177 /*
1178  * Some frames were received. Pass them to the hardware cipher engine before
1179  * sending them to the 802.11 layer.
1180  */
1181 void
1182 rt2560_rx_intr(struct rt2560_softc *sc)
1183 {
1184 	struct ieee80211com *ic = &sc->sc_ic;
1185 	struct rt2560_rx_desc *desc;
1186 	struct rt2560_rx_data *data;
1187 	struct ieee80211_frame *wh;
1188 	struct ieee80211_node *ni;
1189 	struct rt2560_node *rn;
1190 
1191 	mblk_t *m;
1192 	uint32_t len;
1193 	char *rxbuf;
1194 
1195 	struct dma_region *dr, *dr_bf;
1196 	int count;
1197 
1198 	dr = &sc->rxq.dr_desc;
1199 	count = sc->rxq.count;
1200 
1201 	mutex_enter(&sc->rxq.rx_lock);
1202 
1203 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_RX_DESC_SIZE,
1204 	    DDI_DMA_SYNC_FORKERNEL);
1205 
1206 	for (;;) {
1207 		desc = &sc->rxq.desc[sc->rxq.cur];
1208 		data = &sc->rxq.data[sc->rxq.cur];
1209 
1210 		if ((LE_32(desc->flags) & RT2560_RX_BUSY) ||
1211 		    (LE_32(desc->flags) & RT2560_RX_CIPHER_BUSY))
1212 			break;
1213 
1214 		data->drop = 0;
1215 
1216 		if ((LE_32(desc->flags) & RT2560_RX_PHY_ERROR) ||
1217 		    (LE_32(desc->flags) & RT2560_RX_CRC_ERROR)) {
1218 			/*
1219 			 * This should not happen since we did not request
1220 			 * to receive those frames when we filled RXCSR0.
1221 			 */
1222 			RAL_DEBUG(RAL_DBG_RX, "PHY or CRC error flags 0x%08x\n",
1223 			    LE_32(desc->flags));
1224 			data->drop = 1;
1225 		}
1226 
1227 		if (((LE_32(desc->flags) >> 16) & 0xfff) > RAL_RXBUF_SIZE) {
1228 			RAL_DEBUG(RAL_DBG_RX, "bad length\n");
1229 			data->drop = 1;
1230 		}
1231 
1232 		if (data->drop) {
1233 			sc->sc_rx_err++;
1234 			goto skip;
1235 		}
1236 
1237 		rxbuf = data->buf;
1238 		len = (LE_32(desc->flags) >> 16) & 0xfff;
1239 
1240 		if ((len < sizeof (struct ieee80211_frame_min)) ||
1241 		    (len > RAL_RXBUF_SIZE)) {
1242 			RAL_DEBUG(RAL_DBG_RX, "bad frame length=%u\n", len);
1243 			sc->sc_rx_err++;
1244 			goto skip;
1245 		}
1246 
1247 		if ((m = allocb(len, BPRI_MED)) == NULL) {
1248 			RAL_DEBUG(RAL_DBG_RX, "rt2560_rx_intr():"
1249 			    " allocate mblk failed.\n");
1250 			sc->sc_rx_nobuf++;
1251 			goto skip;
1252 		}
1253 
1254 		dr_bf = &sc->rxq.dr_rxbuf[sc->rxq.cur];
1255 		(void) ddi_dma_sync(dr_bf->dr_hnd, 0, dr_bf->dr_size,
1256 		    DDI_DMA_SYNC_FORCPU);
1257 
1258 		bcopy(rxbuf, m->b_rptr, len);
1259 		m->b_wptr += len;
1260 
1261 		wh = (struct ieee80211_frame *)m->b_rptr;
1262 		ni = ieee80211_find_rxnode(ic, wh);
1263 
1264 		/* give rssi to the rate adatation algorithm */
1265 		rn = (struct rt2560_node *)ni;
1266 		ral_rssadapt_input(ic, ni, &rn->rssadapt, desc->rssi);
1267 
1268 		/* send the frame to the 802.11 layer */
1269 		(void) ieee80211_input(ic, m, ni, desc->rssi, 0);
1270 
1271 		/* node is no longer needed */
1272 		ieee80211_free_node(ni);
1273 
1274 skip:		desc->flags = LE_32(RT2560_RX_BUSY);
1275 		RAL_DEBUG(RAL_DBG_RX, "rx done idx=%u\n", sc->rxq.cur);
1276 
1277 		sc->rxq.cur = (sc->rxq.cur + 1) % RT2560_RX_RING_COUNT;
1278 	}
1279 	mutex_exit(&sc->rxq.rx_lock);
1280 
1281 	(void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1282 	    DDI_DMA_SYNC_FORDEV);
1283 }
1284 
1285 uint_t
1286 ral_softint_handler(caddr_t data)
1287 {
1288 	/* LINTED E_BAD_PTR_CAST_ALIGN */
1289 	struct rt2560_softc *sc = (struct rt2560_softc *)data;
1290 
1291 	/*
1292 	 * Check if the soft interrupt is triggered by another
1293 	 * driver at the same level.
1294 	 */
1295 	RAL_LOCK(sc);
1296 	if (sc->sc_rx_pend) {
1297 		sc->sc_rx_pend = 0;
1298 		RAL_UNLOCK(sc);
1299 		rt2560_rx_intr(sc);
1300 		return (DDI_INTR_CLAIMED);
1301 	}
1302 	RAL_UNLOCK(sc);
1303 	return (DDI_INTR_UNCLAIMED);
1304 }
1305 
1306 /*
1307  * Return the expected ack rate for a frame transmitted at rate `rate'.
1308  * XXX: this should depend on the destination node basic rate set.
1309  */
1310 static int
1311 rt2560_ack_rate(struct ieee80211com *ic, int rate)
1312 {
1313 	switch (rate) {
1314 	/* CCK rates */
1315 	case 2:
1316 		return (2);
1317 	case 4:
1318 	case 11:
1319 	case 22:
1320 		return ((ic->ic_curmode == IEEE80211_MODE_11B) ? 4 : rate);
1321 
1322 	/* OFDM rates */
1323 	case 12:
1324 	case 18:
1325 		return (12);
1326 	case 24:
1327 	case 36:
1328 		return (24);
1329 	case 48:
1330 	case 72:
1331 	case 96:
1332 	case 108:
1333 		return (48);
1334 	}
1335 
1336 	/* default to 1Mbps */
1337 	return (2);
1338 }
1339 
1340 /*
1341  * Compute the duration (in us) needed to transmit `len' bytes at rate `rate'.
1342  * The function automatically determines the operating mode depending on the
1343  * given rate. `flags' indicates whether short preamble is in use or not.
1344  */
1345 static uint16_t
1346 rt2560_txtime(int len, int rate, uint32_t flags)
1347 {
1348 	uint16_t txtime;
1349 
1350 	if (RAL_RATE_IS_OFDM(rate)) {
1351 		/* IEEE Std 802.11a-1999, pp. 37 */
1352 		txtime = (8 + 4 * len + 3 + rate - 1) / rate;
1353 		txtime = 16 + 4 + 4 * txtime + 6;
1354 	} else {
1355 		/* IEEE Std 802.11b-1999, pp. 28 */
1356 		txtime = (16 * len + rate - 1) / rate;
1357 		if (rate != 2 && (flags & IEEE80211_F_SHPREAMBLE))
1358 			txtime +=  72 + 24;
1359 		else
1360 			txtime += 144 + 48;
1361 	}
1362 
1363 	return (txtime);
1364 }
1365 
1366 static uint8_t
1367 rt2560_plcp_signal(int rate)
1368 {
1369 	switch (rate) {
1370 	/* CCK rates (returned values are device-dependent) */
1371 	case 2:		return (0x0);
1372 	case 4:		return (0x1);
1373 	case 11:	return (0x2);
1374 	case 22:	return (0x3);
1375 
1376 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1377 	case 12:	return (0xb);
1378 	case 18:	return (0xf);
1379 	case 24:	return (0xa);
1380 	case 36:	return (0xe);
1381 	case 48:	return (0x9);
1382 	case 72:	return (0xd);
1383 	case 96:	return (0x8);
1384 	case 108:	return (0xc);
1385 
1386 	/* unsupported rates (should not get there) */
1387 	default:	return (0xff);
1388 	}
1389 }
1390 
1391 void
1392 rt2560_setup_tx_desc(struct rt2560_softc *sc, struct rt2560_tx_desc *desc,
1393     uint32_t flags, int len, int rate, int encrypt)
1394 {
1395 	struct ieee80211com *ic = &sc->sc_ic;
1396 	uint16_t plcp_length;
1397 	int remainder;
1398 
1399 	desc->flags = LE_32(flags);
1400 	desc->flags |= LE_32(len << 16);
1401 	desc->flags |= encrypt ? LE_32(RT2560_TX_CIPHER_BUSY) :
1402 	    LE_32(RT2560_TX_BUSY | RT2560_TX_VALID);
1403 
1404 	desc->wme = LE_16(
1405 	    RT2560_AIFSN(2) |
1406 	    RT2560_LOGCWMIN(3) |
1407 	    RT2560_LOGCWMAX(8));
1408 
1409 	/* setup PLCP fields */
1410 	desc->plcp_signal  = rt2560_plcp_signal(rate);
1411 	desc->plcp_service = 4;
1412 
1413 	len += IEEE80211_CRC_LEN;
1414 	if (RAL_RATE_IS_OFDM(rate)) {
1415 		desc->flags |= LE_32(RT2560_TX_OFDM);
1416 
1417 		plcp_length = len & 0xfff;
1418 		desc->plcp_length_hi = plcp_length >> 6;
1419 		desc->plcp_length_lo = plcp_length & 0x3f;
1420 	} else {
1421 		plcp_length = (16 * len + rate - 1) / rate;
1422 		if (rate == 22) {
1423 			remainder = (16 * len) % 22;
1424 			if (remainder != 0 && remainder < 7)
1425 				desc->plcp_service |= RT2560_PLCP_LENGEXT;
1426 		}
1427 		desc->plcp_length_hi = plcp_length >> 8;
1428 		desc->plcp_length_lo = plcp_length & 0xff;
1429 
1430 		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1431 			desc->plcp_signal |= 0x08;
1432 	}
1433 }
1434 
1435 /* ARGSUSED */
1436 int
1437 rt2560_mgmt_send(ieee80211com_t *ic, mblk_t *mp, uint8_t type)
1438 {
1439 	struct rt2560_softc *sc = (struct rt2560_softc *)ic;
1440 	struct rt2560_tx_desc *desc;
1441 	struct rt2560_tx_data *data;
1442 	struct ieee80211_frame *wh;
1443 	uint16_t dur;
1444 	uint32_t flags = 0;
1445 	int rate, err = DDI_SUCCESS;
1446 
1447 	int off, pktlen, mblen;
1448 	caddr_t dest;
1449 	mblk_t *m, *m0;
1450 
1451 	struct dma_region *dr;
1452 	uint32_t idx;
1453 	struct ieee80211_node *ni;
1454 	struct ieee80211_key *k;
1455 
1456 	mutex_enter(&sc->prioq.tx_lock);
1457 
1458 	if (sc->prioq.queued >= RT2560_PRIO_RING_COUNT) {
1459 		err = ENOMEM;
1460 		sc->sc_tx_nobuf++;
1461 		goto fail1;
1462 	}
1463 
1464 	m = allocb(msgdsize(mp) + 32, BPRI_MED);
1465 	if (m == NULL) {
1466 		RAL_DEBUG(RAL_DBG_TX, "rt2560_mgmt_send: can't alloc mblk.\n");
1467 		err = DDI_FAILURE;
1468 		goto fail1;
1469 	}
1470 
1471 	for (off = 0, m0 = mp; m0 != NULL; m0 = m0->b_cont) {
1472 		mblen = MBLKL(m0);
1473 		(void) memcpy(m->b_rptr + off, m0->b_rptr, mblen);
1474 		off += mblen;
1475 	}
1476 	m->b_wptr += off;
1477 
1478 	wh = (struct ieee80211_frame *)m->b_rptr;
1479 	ni = ieee80211_find_txnode(ic, wh->i_addr1);
1480 
1481 	if (ni == NULL) {
1482 		err = DDI_FAILURE;
1483 		sc->sc_tx_err++;
1484 		goto fail2;
1485 	}
1486 
1487 	/* to support shared_key auth mode */
1488 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1489 		k = ieee80211_crypto_encap(ic, m);
1490 		if (k == NULL) {
1491 			err = DDI_FAILURE;
1492 			sc->sc_tx_err++;
1493 			goto fail3;
1494 		}
1495 		/* packet header may have moved, reset our local pointer */
1496 		wh = (struct ieee80211_frame *)m->b_rptr;
1497 	}
1498 
1499 	desc = &sc->prioq.desc[sc->prioq.cur];
1500 	data = &sc->prioq.data[sc->prioq.cur];
1501 
1502 	rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
1503 	data->ni = ieee80211_ref_node(ni);
1504 
1505 	pktlen = msgdsize(m);
1506 	dest = data->buf;
1507 	bcopy(m->b_rptr, dest, pktlen);
1508 
1509 	wh = (struct ieee80211_frame *)m->b_rptr;
1510 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1511 		flags |= RT2560_TX_ACK;
1512 
1513 		dur = rt2560_txtime(RAL_ACK_SIZE, rate, ic->ic_flags) +
1514 		    RAL_SIFS;
1515 		/* LINTED E_BAD_PTR_CAST_ALIGN */
1516 		*(uint16_t *)wh->i_dur = LE_16(dur);
1517 
1518 		/* tell hardware to add timestamp for probe responses */
1519 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1520 		    IEEE80211_FC0_TYPE_MGT &&
1521 		    (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1522 		    IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1523 			flags |= RT2560_TX_TIMESTAMP;
1524 	}
1525 
1526 	rt2560_setup_tx_desc(sc, desc, flags, pktlen, rate, 0);
1527 
1528 	idx = sc->prioq.cur;
1529 
1530 	dr = &sc->prioq.dr_txbuf[idx];
1531 	(void) ddi_dma_sync(dr->dr_hnd, 0, RAL_TXBUF_SIZE, DDI_DMA_SYNC_FORDEV);
1532 
1533 	dr = &sc->prioq.dr_desc;
1534 	(void) ddi_dma_sync(dr->dr_hnd, idx * RT2560_TX_DESC_SIZE,
1535 	    RT2560_TX_DESC_SIZE, DDI_DMA_SYNC_FORDEV);
1536 
1537 	RAL_DEBUG(RAL_DBG_MGMT, "sending mgt frame len=%u idx=%u rate=%u\n",
1538 	    pktlen, sc->prioq.cur, rate);
1539 
1540 	/* kick prio */
1541 	sc->prioq.queued++; /* IF > RT2560_PRIO_RING_COUNT? FULL */
1542 	sc->prioq.cur = (sc->prioq.cur + 1) % RT2560_PRIO_RING_COUNT;
1543 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_PRIO);
1544 
1545 	sc->sc_tx_timer = 5;
1546 
1547 	ic->ic_stats.is_tx_frags++;
1548 	ic->ic_stats.is_tx_bytes += pktlen;
1549 
1550 fail3:
1551 	ieee80211_free_node(ni);
1552 fail2:
1553 	freemsg(m);
1554 fail1:
1555 	freemsg(mp);
1556 	mutex_exit(&sc->prioq.tx_lock);
1557 
1558 	return (err);
1559 }
1560 
1561 static int
1562 rt2560_send(ieee80211com_t *ic, mblk_t *mp)
1563 {
1564 	struct rt2560_softc *sc = (struct rt2560_softc *)ic;
1565 	struct rt2560_tx_desc *desc;
1566 	struct rt2560_tx_data *data;
1567 	struct rt2560_node *rn;
1568 	struct ieee80211_rateset *rs;
1569 	struct ieee80211_frame *wh;
1570 	struct ieee80211_key *k;
1571 	uint16_t dur;
1572 	uint32_t flags = 0;
1573 	int rate, err = DDI_SUCCESS;
1574 
1575 	struct ieee80211_node *ni;
1576 	mblk_t *m, *m0;
1577 	int off, mblen, pktlen;
1578 	caddr_t dest;
1579 
1580 	struct dma_region *dr;
1581 	uint32_t idx;
1582 
1583 	mutex_enter(&sc->txq.tx_lock);
1584 
1585 	if (sc->txq.queued >= RT2560_TX_RING_COUNT - 1) {
1586 		RAL_DEBUG(RAL_DBG_TX, "ral: rt2560_tx_data(): "
1587 		    "no TX DMA buffer available!\n");
1588 		sc->sc_need_sched = 1;
1589 		sc->sc_tx_nobuf++;
1590 		err = ENOMEM;
1591 		goto fail1;
1592 	}
1593 
1594 	m = allocb(msgdsize(mp) + 32, BPRI_MED);
1595 	if (m == NULL) {
1596 		RAL_DEBUG(RAL_DBG_TX, "rt2560_xmit(): can't alloc mblk.\n");
1597 		err = DDI_FAILURE;
1598 		goto fail1;
1599 	}
1600 
1601 	for (off = 0, m0 = mp; m0 != NULL; m0 = m0->b_cont) {
1602 		mblen = MBLKL(m0);
1603 		(void) memcpy(m->b_rptr + off, m0->b_rptr, mblen);
1604 		off += mblen;
1605 	}
1606 	m->b_wptr += off;
1607 
1608 	wh = (struct ieee80211_frame *)m->b_rptr;
1609 	ni = ieee80211_find_txnode(ic, wh->i_addr1);
1610 
1611 	if (ni == NULL) {
1612 		err = DDI_FAILURE;
1613 		sc->sc_tx_err++;
1614 		goto fail2;
1615 	}
1616 
1617 	(void) ieee80211_encap(ic, m, ni);
1618 
1619 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1620 		k = ieee80211_crypto_encap(ic, m);
1621 		if (k == NULL) {
1622 			sc->sc_tx_err++;
1623 			err = DDI_FAILURE;
1624 			goto fail3;
1625 		}
1626 		/* packet header may have moved, reset our local pointer */
1627 		wh = (struct ieee80211_frame *)m->b_rptr;
1628 	}
1629 
1630 	/*
1631 	 * RTS/CTS exchange ignore, since the max packet will less than
1632 	 * the rtsthreshold (2346)
1633 	 * Unnecessary codes deleted.
1634 	 */
1635 
1636 	data = &sc->txq.data[sc->txq.cur];
1637 	desc = &sc->txq.desc[sc->txq.cur];
1638 
1639 	data->ni = ieee80211_ref_node(ni);
1640 
1641 	pktlen = msgdsize(m);
1642 	dest = data->buf;
1643 	bcopy(m->b_rptr, dest, pktlen);
1644 
1645 	if (ic->ic_fixed_rate != IEEE80211_FIXED_RATE_NONE) {
1646 		rs = &ic->ic_sup_rates[ic->ic_curmode];
1647 		rate = rs->ir_rates[ic->ic_fixed_rate];
1648 	} else {
1649 		rs = &ni->in_rates;
1650 		rn = (struct rt2560_node *)ni;
1651 		ni->in_txrate = ral_rssadapt_choose(&rn->rssadapt, rs, wh,
1652 		    pktlen, NULL, 0);
1653 		rate = rs->ir_rates[ni->in_txrate];
1654 	}
1655 
1656 	rate &= IEEE80211_RATE_VAL;
1657 	if (rate <= 0) {
1658 		rate = 2;	/* basic rate */
1659 	}
1660 
1661 	/* remember link conditions for rate adaptation algorithm */
1662 	if (ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE) {
1663 		data->id.id_len = pktlen;
1664 		data->id.id_rateidx = ni->in_txrate;
1665 		data->id.id_node = ni;
1666 		data->id.id_rssi = ni->in_rssi;
1667 	} else
1668 		data->id.id_node = NULL;
1669 
1670 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1671 		flags |= RT2560_TX_ACK;
1672 
1673 		dur = rt2560_txtime(RAL_ACK_SIZE, rt2560_ack_rate(ic, rate),
1674 		    ic->ic_flags) + RAL_SIFS;
1675 		/* LINTED E_BAD_PTR_CAST_ALIGN */
1676 		*(uint16_t *)wh->i_dur = LE_16(dur);
1677 	}
1678 
1679 	/* flags |= RT2560_TX_CIPHER_NONE; */
1680 	rt2560_setup_tx_desc(sc, desc, flags, pktlen, rate, 0);
1681 
1682 	idx = sc->txq.cur;
1683 
1684 	dr = &sc->txq.dr_txbuf[idx];
1685 	(void) ddi_dma_sync(dr->dr_hnd, 0, RAL_TXBUF_SIZE, DDI_DMA_SYNC_FORDEV);
1686 
1687 	dr = &sc->txq.dr_desc;
1688 	(void) ddi_dma_sync(dr->dr_hnd, idx * RT2560_TX_DESC_SIZE,
1689 	    RT2560_TX_DESC_SIZE, DDI_DMA_SYNC_FORDEV);
1690 
1691 	RAL_DEBUG(RAL_DBG_TX, "sending data frame len=%u idx=%u rate=%u\n",
1692 	    pktlen, sc->txq.cur, rate);
1693 
1694 	/* kick tx */
1695 	sc->txq.queued++;
1696 	sc->txq.cur = (sc->txq.cur + 1) % RT2560_TX_RING_COUNT;
1697 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_TX);
1698 
1699 	sc->sc_tx_timer = 5;
1700 
1701 	ic->ic_stats.is_tx_frags++;
1702 	ic->ic_stats.is_tx_bytes += pktlen;
1703 
1704 	freemsg(mp);
1705 fail3:
1706 	ieee80211_free_node(ni);
1707 fail2:
1708 	freemsg(m);
1709 fail1:
1710 	mutex_exit(&sc->txq.tx_lock);
1711 	return (err);
1712 }
1713 
1714 static mblk_t *
1715 rt2560_m_tx(void *arg, mblk_t *mp)
1716 {
1717 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
1718 	struct ieee80211com *ic = &sc->sc_ic;
1719 	mblk_t *next;
1720 
1721 	/*
1722 	 * No data frames go out unless we're associated; this
1723 	 * should not happen as the 802.11 layer does not enable
1724 	 * the xmit queue until we enter the RUN state.
1725 	 */
1726 	if (ic->ic_state != IEEE80211_S_RUN) {
1727 		RAL_DEBUG(RAL_DBG_TX, "ral: rt2560_tx_data(): "
1728 		    "discard, state %u\n", ic->ic_state);
1729 		freemsgchain(mp);
1730 		return (NULL);
1731 	}
1732 
1733 	while (mp != NULL) {
1734 		next = mp->b_next;
1735 		mp->b_next = NULL;
1736 		if (rt2560_send(ic, mp) != DDI_SUCCESS) {
1737 			mp->b_next = next;
1738 			freemsgchain(mp);
1739 			return (NULL);
1740 		}
1741 		mp = next;
1742 	}
1743 	return (mp);
1744 }
1745 
1746 static void
1747 rt2560_set_macaddr(struct rt2560_softc *sc, uint8_t *addr)
1748 {
1749 	uint32_t tmp;
1750 
1751 	tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
1752 	RAL_WRITE(sc, RT2560_CSR3, tmp);
1753 
1754 	tmp = addr[4] | addr[5] << 8;
1755 	RAL_WRITE(sc, RT2560_CSR4, tmp);
1756 
1757 	RAL_DEBUG(RAL_DBG_HW,
1758 	    "setting MAC address to " MACSTR "\n", MAC2STR(addr));
1759 }
1760 
1761 static void
1762 rt2560_get_macaddr(struct rt2560_softc *sc, uint8_t *addr)
1763 {
1764 	uint32_t tmp;
1765 
1766 	tmp = RAL_READ(sc, RT2560_CSR3);
1767 	addr[0] = tmp & 0xff;
1768 	addr[1] = (tmp >>  8) & 0xff;
1769 	addr[2] = (tmp >> 16) & 0xff;
1770 	addr[3] = (tmp >> 24);
1771 
1772 	tmp = RAL_READ(sc, RT2560_CSR4);
1773 	addr[4] = tmp & 0xff;
1774 	addr[5] = (tmp >> 8) & 0xff;
1775 }
1776 
1777 static void
1778 rt2560_update_promisc(struct rt2560_softc *sc)
1779 {
1780 	uint32_t tmp;
1781 
1782 	tmp = RAL_READ(sc, RT2560_RXCSR0);
1783 	tmp &= ~RT2560_DROP_NOT_TO_ME;
1784 	if (!(sc->sc_rcr & RAL_RCR_PROMISC))
1785 		tmp |= RT2560_DROP_NOT_TO_ME;
1786 
1787 	RAL_WRITE(sc, RT2560_RXCSR0, tmp);
1788 	RAL_DEBUG(RAL_DBG_HW, "%s promiscuous mode\n",
1789 	    (sc->sc_rcr & RAL_RCR_PROMISC) ?  "entering" : "leaving");
1790 }
1791 
1792 static const char *
1793 rt2560_get_rf(int rev)
1794 {
1795 	switch (rev) {
1796 	case RT2560_RF_2522:	return ("RT2522");
1797 	case RT2560_RF_2523:	return ("RT2523");
1798 	case RT2560_RF_2524:	return ("RT2524");
1799 	case RT2560_RF_2525:	return ("RT2525");
1800 	case RT2560_RF_2525E:	return ("RT2525e");
1801 	case RT2560_RF_2526:	return ("RT2526");
1802 	case RT2560_RF_5222:	return ("RT5222");
1803 	default:		return ("unknown");
1804 	}
1805 }
1806 
1807 static void
1808 rt2560_read_eeprom(struct rt2560_softc *sc)
1809 {
1810 	uint16_t val;
1811 	int i;
1812 
1813 	val = rt2560_eeprom_read(sc, RT2560_EEPROM_CONFIG0);
1814 	sc->rf_rev =   (val >> 11) & 0x7;
1815 	sc->hw_radio = (val >> 10) & 0x1;
1816 	sc->led_mode = (val >> 6)  & 0x7;
1817 	sc->rx_ant =   (val >> 4)  & 0x3;
1818 	sc->tx_ant =   (val >> 2)  & 0x3;
1819 	sc->nb_ant =   val & 0x3;
1820 
1821 	/* read default values for BBP registers */
1822 	for (i = 0; i < 16; i++) {
1823 		val = rt2560_eeprom_read(sc, RT2560_EEPROM_BBP_BASE + i);
1824 		sc->bbp_prom[i].reg = val >> 8;
1825 		sc->bbp_prom[i].val = val & 0xff;
1826 	}
1827 
1828 	/* read Tx power for all b/g channels */
1829 	for (i = 0; i < 14 / 2; i++) {
1830 		val = rt2560_eeprom_read(sc, RT2560_EEPROM_TXPOWER + i);
1831 		sc->txpow[i * 2] = val >> 8;
1832 		sc->txpow[i * 2 + 1] = val & 0xff;
1833 	}
1834 }
1835 
1836 static int
1837 rt2560_bbp_init(struct rt2560_softc *sc)
1838 {
1839 #define	N(a)	(sizeof (a) / sizeof ((a)[0]))
1840 	int i, ntries;
1841 
1842 	/* wait for BBP to be ready */
1843 	for (ntries = 0; ntries < 100; ntries++) {
1844 		if (rt2560_bbp_read(sc, RT2560_BBP_VERSION) != 0)
1845 			break;
1846 		drv_usecwait(1);
1847 	}
1848 	if (ntries == 100) {
1849 		RAL_DEBUG(RAL_DBG_HW, "timeout waiting for BBP\n");
1850 		return (EIO);
1851 	}
1852 	/* initialize BBP registers to default values */
1853 	for (i = 0; i < N(rt2560_def_bbp); i++) {
1854 		rt2560_bbp_write(sc, rt2560_def_bbp[i].reg,
1855 		    rt2560_def_bbp[i].val);
1856 	}
1857 
1858 	return (0);
1859 #undef N
1860 }
1861 
1862 static void
1863 rt2560_set_txantenna(struct rt2560_softc *sc, int antenna)
1864 {
1865 	uint32_t tmp;
1866 	uint8_t tx;
1867 
1868 	tx = rt2560_bbp_read(sc, RT2560_BBP_TX) & ~RT2560_BBP_ANTMASK;
1869 	if (antenna == 1)
1870 		tx |= RT2560_BBP_ANTA;
1871 	else if (antenna == 2)
1872 		tx |= RT2560_BBP_ANTB;
1873 	else
1874 		tx |= RT2560_BBP_DIVERSITY;
1875 
1876 	/* need to force I/Q flip for RF 2525e, 2526 and 5222 */
1877 	if (sc->rf_rev == RT2560_RF_2525E || sc->rf_rev == RT2560_RF_2526 ||
1878 	    sc->rf_rev == RT2560_RF_5222)
1879 		tx |= RT2560_BBP_FLIPIQ;
1880 
1881 	rt2560_bbp_write(sc, RT2560_BBP_TX, tx);
1882 
1883 	/* update values for CCK and OFDM in BBPCSR1 */
1884 	tmp = RAL_READ(sc, RT2560_BBPCSR1) & ~0x00070007;
1885 	tmp |= (tx & 0x7) << 16 | (tx & 0x7);
1886 	RAL_WRITE(sc, RT2560_BBPCSR1, tmp);
1887 }
1888 
1889 static void
1890 rt2560_set_rxantenna(struct rt2560_softc *sc, int antenna)
1891 {
1892 	uint8_t rx;
1893 
1894 	rx = rt2560_bbp_read(sc, RT2560_BBP_RX) & ~RT2560_BBP_ANTMASK;
1895 	if (antenna == 1)
1896 		rx |= RT2560_BBP_ANTA;
1897 	else if (antenna == 2)
1898 		rx |= RT2560_BBP_ANTB;
1899 	else
1900 		rx |= RT2560_BBP_DIVERSITY;
1901 
1902 	/* need to force no I/Q flip for RF 2525e and 2526 */
1903 	if (sc->rf_rev == RT2560_RF_2525E || sc->rf_rev == RT2560_RF_2526)
1904 		rx &= ~RT2560_BBP_FLIPIQ;
1905 
1906 	rt2560_bbp_write(sc, RT2560_BBP_RX, rx);
1907 }
1908 
1909 static void
1910 rt2560_stop(struct rt2560_softc *sc)
1911 {
1912 	struct ieee80211com *ic = &sc->sc_ic;
1913 
1914 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
1915 	ieee80211_stop_watchdog(ic);	/* stop the watchdog */
1916 
1917 	RAL_LOCK(sc);
1918 	sc->sc_tx_timer = 0;
1919 
1920 	/* abort Tx */
1921 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_ABORT_TX);
1922 
1923 	/* disable Rx */
1924 	RAL_WRITE(sc, RT2560_RXCSR0, RT2560_DISABLE_RX);
1925 
1926 	/* reset ASIC (imply reset BBP) */
1927 	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
1928 	RAL_WRITE(sc, RT2560_CSR1, 0);
1929 
1930 	/* disable interrupts */
1931 	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
1932 
1933 	/* reset Tx and Rx rings */
1934 	rt2560_reset_tx_ring(sc, &sc->txq);
1935 	rt2560_reset_tx_ring(sc, &sc->prioq);
1936 	rt2560_reset_rx_ring(sc, &sc->rxq);
1937 	RAL_UNLOCK(sc);
1938 }
1939 
1940 static int
1941 rt2560_init(struct rt2560_softc *sc)
1942 {
1943 #define	N(a)	(sizeof (a) / sizeof ((a)[0]))
1944 	/* struct rt2560_softc *sc = priv; */
1945 	struct ieee80211com *ic = &sc->sc_ic;
1946 	uint32_t tmp;
1947 	int i;
1948 
1949 	rt2560_stop(sc);
1950 
1951 	RAL_LOCK(sc);
1952 	/* setup tx/rx ring */
1953 	rt2560_ring_hwsetup(sc);
1954 
1955 	/* initialize MAC registers to default values */
1956 	for (i = 0; i < N(rt2560_def_mac); i++)
1957 		RAL_WRITE(sc, rt2560_def_mac[i].reg, rt2560_def_mac[i].val);
1958 
1959 	rt2560_set_macaddr(sc, ic->ic_macaddr);
1960 
1961 	/* set basic rate set (will be updated later) */
1962 	RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x153);
1963 
1964 	rt2560_set_txantenna(sc, sc->tx_ant);
1965 	rt2560_set_rxantenna(sc, sc->rx_ant);
1966 	rt2560_update_slot(ic, 1);
1967 	rt2560_update_plcp(sc);
1968 	rt2560_update_led(sc, 0, 0);
1969 
1970 	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
1971 	RAL_WRITE(sc, RT2560_CSR1, RT2560_HOST_READY);
1972 
1973 	if (rt2560_bbp_init(sc) != 0) {
1974 		RAL_UNLOCK(sc);
1975 		rt2560_stop(sc);
1976 		return (DDI_FAILURE);
1977 	}
1978 
1979 	/* set default BSS channel */
1980 	rt2560_set_chan(sc, ic->ic_curchan);
1981 
1982 	/* kick Rx */
1983 	tmp = RT2560_DROP_PHY_ERROR | RT2560_DROP_CRC_ERROR;
1984 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
1985 		tmp |= RT2560_DROP_CTL | RT2560_DROP_VERSION_ERROR;
1986 		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
1987 			tmp |= RT2560_DROP_TODS;
1988 		if (!(sc->sc_rcr & RAL_RCR_PROMISC))
1989 			tmp |= RT2560_DROP_NOT_TO_ME;
1990 
1991 	}
1992 	RAL_WRITE(sc, RT2560_RXCSR0, tmp);
1993 
1994 	/* clear old FCS and Rx FIFO errors */
1995 	(void) RAL_READ(sc, RT2560_CNT0);
1996 	(void) RAL_READ(sc, RT2560_CNT4);
1997 
1998 	/* clear any pending interrupts */
1999 	RAL_WRITE(sc, RT2560_CSR7, 0xffffffff);
2000 	/* enable interrupts */
2001 	RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
2002 
2003 	RAL_UNLOCK(sc);
2004 #undef N
2005 	return (DDI_SUCCESS);
2006 }
2007 
2008 void
2009 rt2560_watchdog(void *arg)
2010 {
2011 	struct rt2560_softc *sc = arg;
2012 	struct ieee80211com *ic = &sc->sc_ic;
2013 	int ntimer = 0;
2014 
2015 	RAL_LOCK(sc);
2016 	ic->ic_watchdog_timer = 0;
2017 
2018 	if (!RAL_IS_RUNNING(sc)) {
2019 		RAL_UNLOCK(sc);
2020 		return;
2021 	}
2022 
2023 	if (sc->sc_tx_timer > 0) {
2024 		if (--sc->sc_tx_timer == 0) {
2025 			RAL_DEBUG(RAL_DBG_MSG, "tx timer timeout\n");
2026 			RAL_UNLOCK(sc);
2027 			(void) rt2560_init(sc);
2028 			(void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2029 			return;
2030 		}
2031 	}
2032 
2033 	if (ic->ic_state == IEEE80211_S_RUN)
2034 		ntimer = 1;
2035 
2036 	RAL_UNLOCK(sc);
2037 
2038 	ieee80211_watchdog(ic);
2039 
2040 	if (ntimer)
2041 		ieee80211_start_watchdog(ic, ntimer);
2042 }
2043 
2044 static int
2045 rt2560_m_start(void *arg)
2046 {
2047 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2048 	crypto_mech_type_t type;
2049 	int err;
2050 
2051 
2052 	type = crypto_mech2id(SUN_CKM_RC4); /* load rc4 module into kernel */
2053 	RAL_DEBUG(RAL_DBG_GLD, "enter rt2560_m_start(%d)\n", type);
2054 
2055 	/*
2056 	 * initialize rt2560 hardware
2057 	 */
2058 	err = rt2560_init(sc);
2059 	if (err != DDI_SUCCESS) {
2060 		RAL_DEBUG(RAL_DBG_GLD, "device configuration failed\n");
2061 		goto fail;
2062 	}
2063 	sc->sc_flags |= RAL_FLAG_RUNNING;	/* RUNNING */
2064 	return (err);
2065 
2066 fail:
2067 	rt2560_stop(sc);
2068 	return (err);
2069 }
2070 
2071 static void
2072 rt2560_m_stop(void *arg)
2073 {
2074 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2075 
2076 	RAL_DEBUG(RAL_DBG_GLD, "enter rt2560_m_stop()\n");
2077 
2078 	(void) rt2560_stop(sc);
2079 	sc->sc_flags &= ~RAL_FLAG_RUNNING;	/* STOP */
2080 }
2081 
2082 static int
2083 rt2560_m_unicst(void *arg, const uint8_t *macaddr)
2084 {
2085 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2086 	struct ieee80211com *ic = &sc->sc_ic;
2087 
2088 	RAL_DEBUG(RAL_DBG_GLD, "rt2560_m_unicst(): " MACSTR "\n",
2089 	    MAC2STR(macaddr));
2090 
2091 	IEEE80211_ADDR_COPY(ic->ic_macaddr, macaddr);
2092 	(void) rt2560_set_macaddr(sc, (uint8_t *)macaddr);
2093 	(void) rt2560_init(sc);
2094 
2095 	return (0);
2096 }
2097 
2098 /*ARGSUSED*/
2099 static int
2100 rt2560_m_multicst(void *arg, boolean_t add, const uint8_t *mca)
2101 {
2102 	return (0);
2103 }
2104 
2105 static int
2106 rt2560_m_promisc(void *arg, boolean_t on)
2107 {
2108 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2109 
2110 	RAL_DEBUG(RAL_DBG_GLD, "rt2560_m_promisc()\n");
2111 
2112 	if (on) {
2113 		sc->sc_rcr |= RAL_RCR_PROMISC;
2114 		sc->sc_rcr |= RAL_RCR_MULTI;
2115 	} else {
2116 		sc->sc_rcr &= ~RAL_RCR_PROMISC;
2117 		sc->sc_rcr &= ~RAL_RCR_PROMISC;
2118 	}
2119 
2120 	rt2560_update_promisc(sc);
2121 	return (0);
2122 }
2123 
2124 static void
2125 rt2560_m_ioctl(void* arg, queue_t *wq, mblk_t *mp)
2126 {
2127 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2128 	struct ieee80211com *ic = &sc->sc_ic;
2129 	int err;
2130 
2131 	err = ieee80211_ioctl(ic, wq, mp);
2132 	RAL_LOCK(sc);
2133 	if (err == ENETRESET) {
2134 		if (RAL_IS_RUNNING(sc)) {
2135 			RAL_UNLOCK(sc);
2136 			(void) rt2560_init(sc);
2137 			(void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2138 			RAL_LOCK(sc);
2139 		}
2140 	}
2141 	RAL_UNLOCK(sc);
2142 }
2143 
2144 static int
2145 rt2560_m_stat(void *arg, uint_t stat, uint64_t *val)
2146 {
2147 	struct rt2560_softc *sc  = (struct rt2560_softc *)arg;
2148 	ieee80211com_t	*ic = &sc->sc_ic;
2149 	ieee80211_node_t *ni = ic->ic_bss;
2150 	struct ieee80211_rateset *rs = &ni->in_rates;
2151 
2152 	RAL_LOCK(sc);
2153 	switch (stat) {
2154 	case MAC_STAT_IFSPEED:
2155 		*val = ((ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE) ?
2156 		    (rs->ir_rates[ni->in_txrate] & IEEE80211_RATE_VAL)
2157 		    : ic->ic_fixed_rate) / 2 * 1000000;
2158 		break;
2159 	case MAC_STAT_NOXMTBUF:
2160 		*val = sc->sc_tx_nobuf;
2161 		break;
2162 	case MAC_STAT_NORCVBUF:
2163 		*val = sc->sc_rx_nobuf;
2164 		break;
2165 	case MAC_STAT_IERRORS:
2166 		*val = sc->sc_rx_err;
2167 		break;
2168 	case MAC_STAT_RBYTES:
2169 		*val = ic->ic_stats.is_rx_bytes;
2170 		break;
2171 	case MAC_STAT_IPACKETS:
2172 		*val = ic->ic_stats.is_rx_frags;
2173 		break;
2174 	case MAC_STAT_OBYTES:
2175 		*val = ic->ic_stats.is_tx_bytes;
2176 		break;
2177 	case MAC_STAT_OPACKETS:
2178 		*val = ic->ic_stats.is_tx_frags;
2179 		break;
2180 	case MAC_STAT_OERRORS:
2181 	case WIFI_STAT_TX_FAILED:
2182 		*val = sc->sc_tx_err;
2183 		break;
2184 	case WIFI_STAT_TX_RETRANS:
2185 		*val = sc->sc_tx_retries;
2186 		break;
2187 	case WIFI_STAT_FCS_ERRORS:
2188 	case WIFI_STAT_WEP_ERRORS:
2189 	case WIFI_STAT_TX_FRAGS:
2190 	case WIFI_STAT_MCAST_TX:
2191 	case WIFI_STAT_RTS_SUCCESS:
2192 	case WIFI_STAT_RTS_FAILURE:
2193 	case WIFI_STAT_ACK_FAILURE:
2194 	case WIFI_STAT_RX_FRAGS:
2195 	case WIFI_STAT_MCAST_RX:
2196 	case WIFI_STAT_RX_DUPS:
2197 		RAL_UNLOCK(sc);
2198 		return (ieee80211_stat(ic, stat, val));
2199 	default:
2200 		RAL_UNLOCK(sc);
2201 		return (ENOTSUP);
2202 	}
2203 	RAL_UNLOCK(sc);
2204 
2205 	return (0);
2206 }
2207 
2208 static uint_t
2209 rt2560_intr(caddr_t arg)
2210 {
2211 	/* LINTED E_BAD_PTR_CAST_ALIGN */
2212 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2213 	uint32_t r;
2214 
2215 	RAL_LOCK(sc);
2216 
2217 	r = RAL_READ(sc, RT2560_CSR7);
2218 	RAL_WRITE(sc, RT2560_CSR7, r);
2219 
2220 	if (r == 0xffffffff) {
2221 		RAL_UNLOCK(sc);
2222 		return (DDI_INTR_UNCLAIMED);
2223 	}
2224 
2225 	if (!(r & RT2560_INTR_ALL)) {
2226 		RAL_UNLOCK(sc);
2227 		return (DDI_INTR_UNCLAIMED);
2228 	}
2229 
2230 	/* disable interrupts */
2231 	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
2232 
2233 	if (r & RT2560_TX_DONE) {
2234 		RAL_UNLOCK(sc);
2235 		rt2560_tx_intr(sc);
2236 		RAL_LOCK(sc);
2237 	}
2238 
2239 	if (r & RT2560_PRIO_DONE) {
2240 		RAL_UNLOCK(sc);
2241 		rt2560_prio_intr(sc);
2242 		RAL_LOCK(sc);
2243 	}
2244 
2245 	if (r & RT2560_RX_DONE) {
2246 		sc->sc_rx_pend = 1;
2247 		ddi_trigger_softintr(sc->sc_softint_id);
2248 	}
2249 
2250 	/* re-enable interrupts */
2251 	RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
2252 	RAL_UNLOCK(sc);
2253 
2254 	return (DDI_INTR_CLAIMED);
2255 }
2256 
2257 static int
2258 rt2560_reset(dev_info_t *devinfo, ddi_reset_cmd_t cmd)
2259 {
2260 	struct rt2560_softc *sc;
2261 
2262 	RAL_DEBUG(RAL_DBG_GLD, "rt2560_reset(0x%p)\n", (void *)devinfo);
2263 
2264 	if (cmd != DDI_RESET_FORCE)
2265 		return (DDI_FAILURE);
2266 
2267 	sc = ddi_get_soft_state(ral_soft_state_p, ddi_get_instance(devinfo));
2268 
2269 	/* abort Tx */
2270 	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_ABORT_TX);
2271 
2272 	/* disable Rx */
2273 	RAL_WRITE(sc, RT2560_RXCSR0, RT2560_DISABLE_RX);
2274 
2275 	/* reset ASIC (imply reset BBP) */
2276 	RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
2277 	RAL_WRITE(sc, RT2560_CSR1, 0);
2278 
2279 	/* disable interrupts */
2280 	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
2281 
2282 	return (DDI_SUCCESS);
2283 }
2284 
2285 static int
2286 rt2560_attach(dev_info_t *devinfo, ddi_attach_cmd_t cmd)
2287 {
2288 	struct rt2560_softc *sc;
2289 	struct ieee80211com *ic;
2290 	int err, i;
2291 	int instance;
2292 
2293 	ddi_acc_handle_t ioh;
2294 	caddr_t regs;
2295 	uint16_t vendor_id, device_id, command;
2296 	uint8_t cachelsz;
2297 	char strbuf[32];
2298 
2299 	wifi_data_t wd = { 0 };
2300 	mac_register_t *macp;
2301 
2302 	RAL_DEBUG(RAL_DBG_GLD, "enter rt2560_attach()\n");
2303 
2304 	if (cmd != DDI_ATTACH)
2305 		return (DDI_FAILURE);
2306 
2307 	instance = ddi_get_instance(devinfo);
2308 
2309 	if (ddi_soft_state_zalloc(ral_soft_state_p, instance) != DDI_SUCCESS) {
2310 		RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2311 		    "unable to alloc soft_state_p\n");
2312 		return (DDI_FAILURE);
2313 	}
2314 
2315 	sc = ddi_get_soft_state(ral_soft_state_p, instance);
2316 	ic = (ieee80211com_t *)&sc->sc_ic;
2317 	sc->sc_dev = devinfo;
2318 
2319 	/* pci configuration */
2320 	err = ddi_regs_map_setup(devinfo, 0, &regs, 0, 0, &ral_csr_accattr,
2321 	    &ioh);
2322 	if (err != DDI_SUCCESS) {
2323 		RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2324 		    "ddi_regs_map_setup() failed");
2325 		goto fail1;
2326 	}
2327 
2328 	cachelsz = ddi_get8(ioh, (uint8_t *)(regs + PCI_CONF_CACHE_LINESZ));
2329 	if (cachelsz == 0)
2330 		cachelsz = 0x10;
2331 	sc->sc_cachelsz = cachelsz << 2;
2332 
2333 	vendor_id = ddi_get16(ioh,
2334 	    (uint16_t *)((uintptr_t)regs + PCI_CONF_VENID));
2335 	device_id = ddi_get16(ioh,
2336 	    (uint16_t *)((uintptr_t)regs + PCI_CONF_DEVID));
2337 
2338 	RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): vendor 0x%x, "
2339 	    "device id 0x%x, cache size %d\n", vendor_id, device_id, cachelsz);
2340 
2341 	/*
2342 	 * Enable response to memory space accesses,
2343 	 * and enabe bus master.
2344 	 */
2345 	command = PCI_COMM_MAE | PCI_COMM_ME;
2346 	ddi_put16(ioh, (uint16_t *)((uintptr_t)regs + PCI_CONF_COMM), command);
2347 	RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2348 	    "set command reg to 0x%x \n", command);
2349 
2350 	ddi_put8(ioh, (uint8_t *)(regs + PCI_CONF_LATENCY_TIMER), 0xa8);
2351 	ddi_put8(ioh, (uint8_t *)(regs + PCI_CONF_ILINE), 0x10);
2352 	ddi_regs_map_free(&ioh);
2353 
2354 	/* pci i/o space */
2355 	err = ddi_regs_map_setup(devinfo, 1,
2356 	    &sc->sc_rbase, 0, 0, &ral_csr_accattr, &sc->sc_ioh);
2357 	RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2358 	    "regs map1 = %x err=%d\n", regs, err);
2359 	if (err != DDI_SUCCESS) {
2360 		RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2361 		    "ddi_regs_map_setup() failed");
2362 		goto fail1;
2363 	}
2364 
2365 	/* initialize the ral rate */
2366 	ral_rate_init();
2367 
2368 	/* retrieve RT2560 rev. no */
2369 	sc->asic_rev = RAL_READ(sc, RT2560_CSR0);
2370 
2371 	/* retrieve MAC address */
2372 	rt2560_get_macaddr(sc, ic->ic_macaddr);
2373 
2374 	/* retrieve RF rev. no and various other things from EEPROM */
2375 	rt2560_read_eeprom(sc);
2376 
2377 	RAL_DEBUG(RAL_DBG_GLD, "MAC/BBP RT2560 (rev 0x%02x), RF %s\n",
2378 	    sc->asic_rev, rt2560_get_rf(sc->rf_rev));
2379 
2380 	/*
2381 	 * Allocate Tx and Rx rings.
2382 	 */
2383 	err = rt2560_alloc_tx_ring(sc, &sc->txq, RT2560_TX_RING_COUNT);
2384 	if (err != DDI_SUCCESS) {
2385 		RAL_DEBUG(RAL_DBG_GLD, "could not allocate Tx ring\n");
2386 		goto fail2;
2387 	}
2388 	err = rt2560_alloc_tx_ring(sc, &sc->prioq, RT2560_PRIO_RING_COUNT);
2389 	if (err != DDI_SUCCESS) {
2390 		RAL_DEBUG(RAL_DBG_GLD, "could not allocate Prio ring\n");
2391 		goto fail3;
2392 	}
2393 	err = rt2560_alloc_rx_ring(sc, &sc->rxq, RT2560_RX_RING_COUNT);
2394 	if (err != DDI_SUCCESS) {
2395 		RAL_DEBUG(RAL_DBG_GLD, "could not allocate Rx ring\n");
2396 		goto fail4;
2397 	}
2398 
2399 	mutex_init(&sc->sc_genlock, NULL, MUTEX_DRIVER, NULL);
2400 	mutex_init(&sc->txq.tx_lock, NULL, MUTEX_DRIVER, NULL);
2401 	mutex_init(&sc->prioq.tx_lock, NULL, MUTEX_DRIVER, NULL);
2402 	mutex_init(&sc->rxq.rx_lock, NULL, MUTEX_DRIVER, NULL);
2403 
2404 
2405 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
2406 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
2407 	ic->ic_state = IEEE80211_S_INIT;
2408 
2409 	ic->ic_maxrssi = 63;
2410 	ic->ic_set_shortslot = rt2560_update_slot;
2411 	ic->ic_xmit = rt2560_mgmt_send;
2412 
2413 	/* set device capabilities */
2414 	ic->ic_caps =
2415 	    IEEE80211_C_TXPMGT |	/* tx power management */
2416 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
2417 	    IEEE80211_C_SHSLOT;		/* short slot time supported */
2418 
2419 	ic->ic_caps |= IEEE80211_C_WPA; /* Support WPA/WPA2 */
2420 
2421 #define	IEEE80211_CHAN_A	\
2422 	(IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_OFDM)
2423 
2424 	if (sc->rf_rev == RT2560_RF_5222) {
2425 		/* set supported .11a rates */
2426 		ic->ic_sup_rates[IEEE80211_MODE_11A] = rt2560_rateset_11a;
2427 
2428 		/* set supported .11a channels */
2429 		for (i = 36; i <= 64; i += 4) {
2430 			ic->ic_sup_channels[i].ich_freq =
2431 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2432 			ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2433 		}
2434 		for (i = 100; i <= 140; i += 4) {
2435 			ic->ic_sup_channels[i].ich_freq =
2436 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2437 			ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2438 		}
2439 		for (i = 149; i <= 161; i += 4) {
2440 			ic->ic_sup_channels[i].ich_freq =
2441 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2442 			ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2443 		}
2444 	}
2445 
2446 	/* set supported .11b and .11g rates */
2447 	ic->ic_sup_rates[IEEE80211_MODE_11B] = rt2560_rateset_11b;
2448 	ic->ic_sup_rates[IEEE80211_MODE_11G] = rt2560_rateset_11g;
2449 
2450 	/* set supported .11b and .11g channels (1 through 14) */
2451 	for (i = 1; i <= 14; i++) {
2452 		ic->ic_sup_channels[i].ich_freq =
2453 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
2454 		ic->ic_sup_channels[i].ich_flags =
2455 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
2456 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
2457 	}
2458 
2459 	ieee80211_attach(ic);
2460 
2461 	/* register WPA door */
2462 	ieee80211_register_door(ic, ddi_driver_name(devinfo),
2463 	    ddi_get_instance(devinfo));
2464 
2465 	ic->ic_node_alloc = rt2560_node_alloc;
2466 	ic->ic_node_free = rt2560_node_free;
2467 
2468 	/* override state transition machine */
2469 	sc->sc_newstate = ic->ic_newstate;
2470 	ic->ic_newstate = rt2560_newstate;
2471 	ic->ic_watchdog = rt2560_watchdog;
2472 	ieee80211_media_init(ic);
2473 	ic->ic_def_txkey = 0;
2474 
2475 	sc->sc_rcr = 0;
2476 	sc->sc_rx_pend = 0;
2477 	sc->dwelltime = 300;
2478 	sc->sc_flags &= ~RAL_FLAG_RUNNING;
2479 
2480 	err = ddi_add_softintr(devinfo, DDI_SOFTINT_LOW,
2481 	    &sc->sc_softint_id, NULL, 0, ral_softint_handler, (caddr_t)sc);
2482 	if (err != DDI_SUCCESS) {
2483 		RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2484 		    "ddi_add_softintr() failed");
2485 		goto fail5;
2486 	}
2487 
2488 	err = ddi_get_iblock_cookie(devinfo, 0, &sc->sc_iblock);
2489 	if (err != DDI_SUCCESS) {
2490 		RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2491 		    "Can not get iblock cookie for INT\n");
2492 		goto fail6;
2493 	}
2494 
2495 	err = ddi_add_intr(devinfo, 0, NULL, NULL, rt2560_intr, (caddr_t)sc);
2496 	if (err != DDI_SUCCESS) {
2497 		RAL_DEBUG(RAL_DBG_GLD,
2498 		    "unable to add device interrupt handler\n");
2499 		goto fail6;
2500 	}
2501 
2502 	/*
2503 	 * Provide initial settings for the WiFi plugin; whenever this
2504 	 * information changes, we need to call mac_plugindata_update()
2505 	 */
2506 	wd.wd_opmode = ic->ic_opmode;
2507 	wd.wd_secalloc = WIFI_SEC_NONE;
2508 	IEEE80211_ADDR_COPY(wd.wd_bssid, ic->ic_bss->in_bssid);
2509 
2510 	if ((macp = mac_alloc(MAC_VERSION)) == NULL) {
2511 		RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2512 		    "MAC version mismatch\n");
2513 		goto fail7;
2514 	}
2515 
2516 	macp->m_type_ident	= MAC_PLUGIN_IDENT_WIFI;
2517 	macp->m_driver		= sc;
2518 	macp->m_dip		= devinfo;
2519 	macp->m_src_addr	= ic->ic_macaddr;
2520 	macp->m_callbacks	= &rt2560_m_callbacks;
2521 	macp->m_min_sdu		= 0;
2522 	macp->m_max_sdu		= IEEE80211_MTU;
2523 	macp->m_pdata		= &wd;
2524 	macp->m_pdata_size	= sizeof (wd);
2525 
2526 	err = mac_register(macp, &ic->ic_mach);
2527 	mac_free(macp);
2528 	if (err != 0) {
2529 		RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
2530 		    "mac_register err %x\n", err);
2531 		goto fail7;
2532 	}
2533 
2534 	/*
2535 	 * Create minor node of type DDI_NT_NET_WIFI
2536 	 */
2537 	(void) snprintf(strbuf, sizeof (strbuf), "%s%d",
2538 	    "ral", instance);
2539 	err = ddi_create_minor_node(devinfo, strbuf, S_IFCHR,
2540 	    instance + 1, DDI_NT_NET_WIFI, 0);
2541 
2542 	if (err != DDI_SUCCESS)
2543 		RAL_DEBUG(RAL_DBG_GLD, "ddi_create_minor_node() failed\n");
2544 
2545 	/*
2546 	 * Notify link is down now
2547 	 */
2548 	mac_link_update(ic->ic_mach, LINK_STATE_DOWN);
2549 
2550 	RAL_DEBUG(RAL_DBG_GLD, "rt2560_attach() exit successfully.\n");
2551 	return (DDI_SUCCESS);
2552 fail7:
2553 	ddi_remove_intr(devinfo, 0, sc->sc_iblock);
2554 fail6:
2555 	ddi_remove_softintr(sc->sc_softint_id);
2556 fail5:
2557 	mutex_destroy(&sc->sc_genlock);
2558 	mutex_destroy(&sc->txq.tx_lock);
2559 	mutex_destroy(&sc->prioq.tx_lock);
2560 	mutex_destroy(&sc->rxq.rx_lock);
2561 
2562 	rt2560_free_rx_ring(sc, &sc->rxq);
2563 fail4:
2564 	rt2560_free_tx_ring(sc, &sc->prioq);
2565 fail3:
2566 	rt2560_free_tx_ring(sc, &sc->txq);
2567 fail2:
2568 	ddi_regs_map_free(&sc->sc_ioh);
2569 fail1:
2570 	ddi_soft_state_free(ral_soft_state_p, ddi_get_instance(devinfo));
2571 
2572 	return (DDI_FAILURE);
2573 }
2574 
2575 static int
2576 rt2560_detach(dev_info_t *devinfo, ddi_detach_cmd_t cmd)
2577 {
2578 	struct rt2560_softc *sc;
2579 
2580 	RAL_DEBUG(RAL_DBG_GLD, "enter rt2560_detach()\n");
2581 	sc = ddi_get_soft_state(ral_soft_state_p, ddi_get_instance(devinfo));
2582 
2583 	if (cmd != DDI_DETACH)
2584 		return (DDI_FAILURE);
2585 
2586 	if (mac_disable(sc->sc_ic.ic_mach) != 0)
2587 		return (DDI_FAILURE);
2588 
2589 	rt2560_stop(sc);
2590 
2591 	/*
2592 	 * Unregister from the MAC layer subsystem
2593 	 */
2594 	(void) mac_unregister(sc->sc_ic.ic_mach);
2595 
2596 	ddi_remove_intr(devinfo, 0, sc->sc_iblock);
2597 	ddi_remove_softintr(sc->sc_softint_id);
2598 
2599 	/*
2600 	 * detach ieee80211 layer
2601 	 */
2602 	ieee80211_detach(&sc->sc_ic);
2603 
2604 	rt2560_free_tx_ring(sc, &sc->txq);
2605 	rt2560_free_tx_ring(sc, &sc->prioq);
2606 	rt2560_free_rx_ring(sc, &sc->rxq);
2607 
2608 	ddi_regs_map_free(&sc->sc_ioh);
2609 
2610 	mutex_destroy(&sc->sc_genlock);
2611 	mutex_destroy(&sc->txq.tx_lock);
2612 	mutex_destroy(&sc->prioq.tx_lock);
2613 	mutex_destroy(&sc->rxq.rx_lock);
2614 
2615 	ddi_remove_minor_node(devinfo, NULL);
2616 	ddi_soft_state_free(ral_soft_state_p, ddi_get_instance(devinfo));
2617 
2618 	return (DDI_SUCCESS);
2619 }
2620 
2621 int
2622 _info(struct modinfo *modinfop)
2623 {
2624 	return (mod_info(&modlinkage, modinfop));
2625 }
2626 
2627 int
2628 _init(void)
2629 {
2630 	int status;
2631 
2632 	status = ddi_soft_state_init(&ral_soft_state_p,
2633 	    sizeof (struct rt2560_softc), 1);
2634 	if (status != 0)
2635 		return (status);
2636 
2637 	mac_init_ops(&ral_dev_ops, "ral");
2638 	status = mod_install(&modlinkage);
2639 	if (status != 0) {
2640 		mac_fini_ops(&ral_dev_ops);
2641 		ddi_soft_state_fini(&ral_soft_state_p);
2642 	}
2643 	return (status);
2644 }
2645 
2646 int
2647 _fini(void)
2648 {
2649 	int status;
2650 
2651 	status = mod_remove(&modlinkage);
2652 	if (status == 0) {
2653 		mac_fini_ops(&ral_dev_ops);
2654 		ddi_soft_state_fini(&ral_soft_state_p);
2655 	}
2656 	return (status);
2657 }
2658