1 /*
   2  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
   3  * Use is subject to license terms.
   4  */
   5 
   6 /*
   7  * Copyright (c) 2005, 2006
   8  *      Damien Bergamini <damien.bergamini@free.fr>
   9  *
  10  * Permission to use, copy, modify, and distribute this software for any
  11  * purpose with or without fee is hereby granted, provided that the above
  12  * copyright notice and this permission notice appear in all copies.
  13  *
  14  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  15  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  16  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  17  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  18  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  19  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  20  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  21  */
  22 
  23 /*
  24  * Ralink Technology RT2560 chipset driver
  25  * http://www.ralinktech.com/
  26  */
  27 
  28 #include <sys/types.h>
  29 #include <sys/byteorder.h>
  30 #include <sys/cmn_err.h>
  31 #include <sys/stat.h>
  32 #include <sys/pci.h>
  33 #include <sys/ddi.h>
  34 #include <sys/sunddi.h>
  35 #include <sys/strsubr.h>
  36 #include <inet/common.h>
  37 #include <sys/note.h>
  38 #include <sys/strsun.h>
  39 #include <sys/modctl.h>
  40 #include <sys/devops.h>
  41 #include <sys/mac_provider.h>
  42 #include <sys/mac_wifi.h>
  43 #include <sys/net80211.h>
  44 
  45 #include "ral_rate.h"
  46 #include "rt2560_reg.h"
  47 #include "rt2560_var.h"
  48 
  49 static void *ral_soft_state_p = NULL;
  50 
  51 #define RAL_TXBUF_SIZE          (IEEE80211_MAX_LEN)
  52 #define RAL_RXBUF_SIZE          (IEEE80211_MAX_LEN)
  53 
  54 /* quickly determine if a given rate is CCK or OFDM */
  55 #define RAL_RATE_IS_OFDM(rate)  ((rate) >= 12 && (rate) != 22)
  56 #define RAL_ACK_SIZE            14      /* 10 + 4(FCS) */
  57 #define RAL_CTS_SIZE            14      /* 10 + 4(FCS) */
  58 #define RAL_SIFS                10      /* us */
  59 #define RT2560_TXRX_TURNAROUND  10      /* us */
  60 
  61 /*
  62  * Supported rates for 802.11a/b/g modes (in 500Kbps unit).
  63  */
  64 static const struct ieee80211_rateset rt2560_rateset_11a =
  65         { 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
  66 
  67 static const struct ieee80211_rateset rt2560_rateset_11b =
  68         { 4, { 2, 4, 11, 22 } };
  69 
  70 static const struct ieee80211_rateset rt2560_rateset_11g =
  71         { 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
  72 
  73 static const struct {
  74         uint32_t        reg;
  75         uint32_t        val;
  76 } rt2560_def_mac[] = {
  77         RT2560_DEF_MAC
  78 };
  79 
  80 static const struct {
  81         uint8_t reg;
  82         uint8_t val;
  83 } rt2560_def_bbp[] = {
  84         RT2560_DEF_BBP
  85 };
  86 
  87 static const uint32_t rt2560_rf2522_r2[]    = RT2560_RF2522_R2;
  88 static const uint32_t rt2560_rf2523_r2[]    = RT2560_RF2523_R2;
  89 static const uint32_t rt2560_rf2524_r2[]    = RT2560_RF2524_R2;
  90 static const uint32_t rt2560_rf2525_r2[]    = RT2560_RF2525_R2;
  91 static const uint32_t rt2560_rf2525_hi_r2[] = RT2560_RF2525_HI_R2;
  92 static const uint32_t rt2560_rf2525e_r2[]   = RT2560_RF2525E_R2;
  93 static const uint32_t rt2560_rf2526_r2[]    = RT2560_RF2526_R2;
  94 static const uint32_t rt2560_rf2526_hi_r2[] = RT2560_RF2526_HI_R2;
  95 
  96 static const struct {
  97         uint8_t         chan;
  98         uint32_t        r1, r2, r4;
  99 } rt2560_rf5222[] = {
 100         RT2560_RF5222
 101 };
 102 
 103 /*
 104  * PIO access attributes for registers
 105  */
 106 static ddi_device_acc_attr_t ral_csr_accattr = {
 107         DDI_DEVICE_ATTR_V0,
 108         DDI_STRUCTURE_LE_ACC,
 109         DDI_STRICTORDER_ACC
 110 };
 111 
 112 /*
 113  * DMA access attributes for descriptors: NOT to be byte swapped.
 114  */
 115 static ddi_device_acc_attr_t ral_desc_accattr = {
 116         DDI_DEVICE_ATTR_V0,
 117         DDI_STRUCTURE_LE_ACC,
 118         DDI_STRICTORDER_ACC
 119 };
 120 
 121 /*
 122  * Describes the chip's DMA engine
 123  */
 124 static ddi_dma_attr_t ral_dma_attr = {
 125         DMA_ATTR_V0,                    /* dma_attr version */
 126         0x0000000000000000ull,          /* dma_attr_addr_lo */
 127         0xFFFFFFFF,                     /* dma_attr_addr_hi */
 128         0x00000000FFFFFFFFull,          /* dma_attr_count_max */
 129         0x0000000000000001ull,          /* dma_attr_align */
 130         0x00000FFF,                     /* dma_attr_burstsizes */
 131         0x00000001,                     /* dma_attr_minxfer */
 132         0x000000000000FFFFull,          /* dma_attr_maxxfer */
 133         0xFFFFFFFFFFFFFFFFull,          /* dma_attr_seg */
 134         1,                              /* dma_attr_sgllen */
 135         0x00000001,                     /* dma_attr_granular */
 136         0                               /* dma_attr_flags */
 137 };
 138 
 139 /*
 140  * device operations
 141  */
 142 static int rt2560_attach(dev_info_t *, ddi_attach_cmd_t);
 143 static int rt2560_detach(dev_info_t *, ddi_detach_cmd_t);
 144 static int32_t rt2560_quiesce(dev_info_t *);
 145 
 146 /*
 147  * Module Loading Data & Entry Points
 148  */
 149 DDI_DEFINE_STREAM_OPS(ral_dev_ops, nulldev, nulldev, rt2560_attach,
 150     rt2560_detach, nodev, NULL, D_MP, NULL, rt2560_quiesce);
 151 
 152 static struct modldrv ral_modldrv = {
 153         &mod_driverops,             /* Type of module.  This one is a driver */
 154         "Ralink RT2500 driver v1.6",    /* short description */
 155         &ral_dev_ops                /* driver specific ops */
 156 };
 157 
 158 static struct modlinkage modlinkage = {
 159         MODREV_1,
 160         { (void *)&ral_modldrv, NULL }
 161 };
 162 
 163 static int      rt2560_m_stat(void *,  uint_t, uint64_t *);
 164 static int      rt2560_m_start(void *);
 165 static void     rt2560_m_stop(void *);
 166 static int      rt2560_m_promisc(void *, boolean_t);
 167 static int      rt2560_m_multicst(void *, boolean_t, const uint8_t *);
 168 static int      rt2560_m_unicst(void *, const uint8_t *);
 169 static mblk_t   *rt2560_m_tx(void *, mblk_t *);
 170 static void     rt2560_m_ioctl(void *, queue_t *, mblk_t *);
 171 static int      rt2560_m_setprop(void *, const char *, mac_prop_id_t,
 172     uint_t, const void *);
 173 static int      rt2560_m_getprop(void *, const char *, mac_prop_id_t,
 174     uint_t, void *);
 175 static void     rt2560_m_propinfo(void *, const char *, mac_prop_id_t,
 176     mac_prop_info_handle_t);
 177 
 178 static mac_callbacks_t rt2560_m_callbacks = {
 179         MC_IOCTL | MC_SETPROP | MC_GETPROP | MC_PROPINFO,
 180         rt2560_m_stat,
 181         rt2560_m_start,
 182         rt2560_m_stop,
 183         rt2560_m_promisc,
 184         rt2560_m_multicst,
 185         rt2560_m_unicst,
 186         rt2560_m_tx,
 187         NULL,
 188         rt2560_m_ioctl,
 189         NULL,           /* mc_getcapab */
 190         NULL,
 191         NULL,
 192         rt2560_m_setprop,
 193         rt2560_m_getprop,
 194         rt2560_m_propinfo
 195 };
 196 
 197 uint32_t ral_dbg_flags = 0;
 198 
 199 void
 200 ral_debug(uint32_t dbg_flags, const int8_t *fmt, ...)
 201 {
 202         va_list args;
 203 
 204         if (dbg_flags & ral_dbg_flags) {
 205                 va_start(args, fmt);
 206                 vcmn_err(CE_CONT, fmt, args);
 207                 va_end(args);
 208         }
 209 }
 210 
 211 static void
 212 rt2560_set_basicrates(struct rt2560_softc *sc)
 213 {
 214         struct ieee80211com *ic = &sc->sc_ic;
 215 
 216         /* update basic rate set */
 217         if (ic->ic_curmode == IEEE80211_MODE_11B) {
 218                 /* 11b basic rates: 1, 2Mbps */
 219                 RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x3);
 220         } else if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan)) {
 221                 /* 11a basic rates: 6, 12, 24Mbps */
 222                 RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x150);
 223         } else {
 224                 /* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
 225                 RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x15f);
 226         }
 227 }
 228 
 229 static void
 230 rt2560_update_led(struct rt2560_softc *sc, int led1, int led2)
 231 {
 232         uint32_t tmp;
 233 
 234         /* set ON period to 70ms and OFF period to 30ms */
 235         tmp = led1 << 16 | led2 << 17 | 70 << 8 | 30;
 236         RAL_WRITE(sc, RT2560_LEDCSR, tmp);
 237 }
 238 
 239 static void
 240 rt2560_set_bssid(struct rt2560_softc *sc, uint8_t *bssid)
 241 {
 242         uint32_t tmp;
 243 
 244         tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
 245         RAL_WRITE(sc, RT2560_CSR5, tmp);
 246 
 247         tmp = bssid[4] | bssid[5] << 8;
 248         RAL_WRITE(sc, RT2560_CSR6, tmp);
 249 
 250         ral_debug(RAL_DBG_HW, "setting BSSID to " MACSTR "\n", MAC2STR(bssid));
 251 }
 252 
 253 
 254 static void
 255 rt2560_bbp_write(struct rt2560_softc *sc, uint8_t reg, uint8_t val)
 256 {
 257         uint32_t tmp;
 258         int ntries;
 259 
 260         for (ntries = 0; ntries < 100; ntries++) {
 261                 if (!(RAL_READ(sc, RT2560_BBPCSR) & RT2560_BBP_BUSY))
 262                         break;
 263                 drv_usecwait(1);
 264         }
 265         if (ntries == 100) {
 266                 ral_debug(RAL_DBG_HW, "could not write to BBP\n");
 267                 return;
 268         }
 269 
 270         tmp = RT2560_BBP_WRITE | RT2560_BBP_BUSY | reg << 8 | val;
 271         RAL_WRITE(sc, RT2560_BBPCSR, tmp);
 272 
 273         ral_debug(RAL_DBG_HW, "BBP R%u <- 0x%02x\n", reg, val);
 274 }
 275 
 276 static uint8_t
 277 rt2560_bbp_read(struct rt2560_softc *sc, uint8_t reg)
 278 {
 279         uint32_t val;
 280         int ntries;
 281 
 282         val = RT2560_BBP_BUSY | reg << 8;
 283         RAL_WRITE(sc, RT2560_BBPCSR, val);
 284 
 285         for (ntries = 0; ntries < 100; ntries++) {
 286                 val = RAL_READ(sc, RT2560_BBPCSR);
 287                 if (!(val & RT2560_BBP_BUSY))
 288                         return (val & 0xff);
 289                 drv_usecwait(1);
 290         }
 291 
 292         ral_debug(RAL_DBG_HW, "could not read from BBP\n");
 293         return (0);
 294 }
 295 
 296 static void
 297 rt2560_rf_write(struct rt2560_softc *sc, uint8_t reg, uint32_t val)
 298 {
 299         uint32_t tmp;
 300         int ntries;
 301 
 302         for (ntries = 0; ntries < 100; ntries++) {
 303                 if (!(RAL_READ(sc, RT2560_RFCSR) & RT2560_RF_BUSY))
 304                         break;
 305                 drv_usecwait(1);
 306         }
 307         if (ntries == 100) {
 308                 ral_debug(RAL_DBG_HW, "could not write to RF\n");
 309                 return;
 310         }
 311 
 312         tmp = RT2560_RF_BUSY | RT2560_RF_20BIT | (val & 0xfffff) << 2 |
 313             (reg & 0x3);
 314         RAL_WRITE(sc, RT2560_RFCSR, tmp);
 315 
 316         /* remember last written value in sc */
 317         sc->rf_regs[reg] = val;
 318 
 319         ral_debug(RAL_DBG_HW, "RF R[%u] <- 0x%05x\n", reg & 0x3, val & 0xfffff);
 320 }
 321 
 322 static void
 323 rt2560_set_chan(struct rt2560_softc *sc, struct ieee80211_channel *c)
 324 {
 325         struct ieee80211com *ic = &sc->sc_ic;
 326         uint8_t power, tmp;
 327         uint_t i, chan;
 328 
 329         chan = ieee80211_chan2ieee(ic, c);
 330         if (chan == 0 || chan == IEEE80211_CHAN_ANY)
 331                 return;
 332 
 333         if (IEEE80211_IS_CHAN_2GHZ(c))
 334                 power = min(sc->txpow[chan - 1], 31);
 335         else
 336                 power = 31;
 337 
 338         /* adjust txpower using ifconfig settings */
 339         power -= (100 - ic->ic_txpowlimit) / 8;
 340 
 341         ral_debug(RAL_DBG_CHAN, "setting channel to %u, txpower to %u\n",
 342             chan, power);
 343 
 344         switch (sc->rf_rev) {
 345         case RT2560_RF_2522:
 346                 rt2560_rf_write(sc, RAL_RF1, 0x00814);
 347                 rt2560_rf_write(sc, RAL_RF2, rt2560_rf2522_r2[chan - 1]);
 348                 rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
 349                 break;
 350 
 351         case RT2560_RF_2523:
 352                 rt2560_rf_write(sc, RAL_RF1, 0x08804);
 353                 rt2560_rf_write(sc, RAL_RF2, rt2560_rf2523_r2[chan - 1]);
 354                 rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x38044);
 355                 rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
 356                 break;
 357 
 358         case RT2560_RF_2524:
 359                 rt2560_rf_write(sc, RAL_RF1, 0x0c808);
 360                 rt2560_rf_write(sc, RAL_RF2, rt2560_rf2524_r2[chan - 1]);
 361                 rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
 362                 rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
 363                 break;
 364 
 365         case RT2560_RF_2525:
 366                 rt2560_rf_write(sc, RAL_RF1, 0x08808);
 367                 rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525_hi_r2[chan - 1]);
 368                 rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
 369                 rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
 370 
 371                 rt2560_rf_write(sc, RAL_RF1, 0x08808);
 372                 rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525_r2[chan - 1]);
 373                 rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
 374                 rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
 375                 break;
 376 
 377         case RT2560_RF_2525E:
 378                 rt2560_rf_write(sc, RAL_RF1, 0x08808);
 379                 rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525e_r2[chan - 1]);
 380                 rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
 381                 rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00286 : 0x00282);
 382                 break;
 383 
 384         case RT2560_RF_2526:
 385                 rt2560_rf_write(sc, RAL_RF2, rt2560_rf2526_hi_r2[chan - 1]);
 386                 rt2560_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
 387                 rt2560_rf_write(sc, RAL_RF1, 0x08804);
 388 
 389                 rt2560_rf_write(sc, RAL_RF2, rt2560_rf2526_r2[chan - 1]);
 390                 rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
 391                 rt2560_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
 392                 break;
 393 
 394         /* dual-band RF */
 395         case RT2560_RF_5222:
 396                 for (i = 0; rt2560_rf5222[i].chan != chan; i++) {
 397                 }
 398 
 399                 rt2560_rf_write(sc, RAL_RF1, rt2560_rf5222[i].r1);
 400                 rt2560_rf_write(sc, RAL_RF2, rt2560_rf5222[i].r2);
 401                 rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
 402                 rt2560_rf_write(sc, RAL_RF4, rt2560_rf5222[i].r4);
 403                 break;
 404         }
 405 
 406         if (ic->ic_state != IEEE80211_S_SCAN) {
 407                 /* set Japan filter bit for channel 14 */
 408                 tmp = rt2560_bbp_read(sc, 70);
 409 
 410                 tmp &= ~RT2560_JAPAN_FILTER;
 411                 if (chan == 14)
 412                         tmp |= RT2560_JAPAN_FILTER;
 413 
 414                 rt2560_bbp_write(sc, 70, tmp);
 415 
 416                 /* clear CRC errors */
 417                 (void) RAL_READ(sc, RT2560_CNT0);
 418         }
 419 }
 420 
 421 /*
 422  * Refer to IEEE Std 802.11-1999 pp. 123 for more information on TSF
 423  * synchronization.
 424  */
 425 static void
 426 rt2560_enable_tsf_sync(struct rt2560_softc *sc)
 427 {
 428         struct ieee80211com *ic = &sc->sc_ic;
 429         uint16_t logcwmin, preload;
 430         uint32_t tmp;
 431 
 432         /* first, disable TSF synchronization */
 433         RAL_WRITE(sc, RT2560_CSR14, 0);
 434 
 435         tmp = 16 * ic->ic_bss->in_intval;
 436         RAL_WRITE(sc, RT2560_CSR12, tmp);
 437 
 438         RAL_WRITE(sc, RT2560_CSR13, 0);
 439 
 440         logcwmin = 5;
 441         preload = (ic->ic_opmode == IEEE80211_M_STA) ? 384 : 1024;
 442         tmp = logcwmin << 16 | preload;
 443         RAL_WRITE(sc, RT2560_BCNOCSR, tmp);
 444 
 445         /* finally, enable TSF synchronization */
 446         tmp = RT2560_ENABLE_TSF | RT2560_ENABLE_TBCN;
 447         if (ic->ic_opmode == IEEE80211_M_STA)
 448                 tmp |= RT2560_ENABLE_TSF_SYNC(1);
 449         else
 450                 tmp |= RT2560_ENABLE_TSF_SYNC(2) |
 451                     RT2560_ENABLE_BEACON_GENERATOR;
 452         RAL_WRITE(sc, RT2560_CSR14, tmp);
 453 
 454         ral_debug(RAL_DBG_HW, "enabling TSF synchronization\n");
 455 }
 456 
 457 static void
 458 rt2560_update_plcp(struct rt2560_softc *sc)
 459 {
 460         struct ieee80211com *ic = &sc->sc_ic;
 461 
 462         /* no short preamble for 1Mbps */
 463         RAL_WRITE(sc, RT2560_PLCP1MCSR, 0x00700400);
 464 
 465         if (!(ic->ic_flags & IEEE80211_F_SHPREAMBLE)) {
 466                 /* values taken from the reference driver */
 467                 RAL_WRITE(sc, RT2560_PLCP2MCSR,   0x00380401);
 468                 RAL_WRITE(sc, RT2560_PLCP5p5MCSR, 0x00150402);
 469                 RAL_WRITE(sc, RT2560_PLCP11MCSR,  0x000b8403);
 470         } else {
 471                 /* same values as above or'ed 0x8 */
 472                 RAL_WRITE(sc, RT2560_PLCP2MCSR,   0x00380409);
 473                 RAL_WRITE(sc, RT2560_PLCP5p5MCSR, 0x0015040a);
 474                 RAL_WRITE(sc, RT2560_PLCP11MCSR,  0x000b840b);
 475         }
 476 
 477         ral_debug(RAL_DBG_HW, "updating PLCP for %s preamble\n",
 478             (ic->ic_flags & IEEE80211_F_SHPREAMBLE) ? "short" : "long");
 479 }
 480 
 481 /*
 482  * This function can be called by ieee80211_set_shortslottime(). Refer to
 483  * IEEE Std 802.11-1999 pp. 85 to know how these values are computed.
 484  */
 485 void
 486 rt2560_update_slot(struct ieee80211com *ic, int onoff)
 487 {
 488         struct rt2560_softc *sc = (struct rt2560_softc *)ic;
 489         uint8_t slottime;
 490         uint16_t tx_sifs, tx_pifs, tx_difs, eifs;
 491         uint32_t tmp;
 492 
 493         /* slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20; */
 494         slottime = (onoff ? 9 : 20);
 495 
 496         /* update the MAC slot boundaries */
 497         tx_sifs = RAL_SIFS - RT2560_TXRX_TURNAROUND;
 498         tx_pifs = tx_sifs + slottime;
 499         tx_difs = tx_sifs + 2 * slottime;
 500         eifs = (ic->ic_curmode == IEEE80211_MODE_11B) ? 364 : 60;
 501 
 502         tmp = RAL_READ(sc, RT2560_CSR11);
 503         tmp = (tmp & ~0x1f00) | slottime << 8;
 504         RAL_WRITE(sc, RT2560_CSR11, tmp);
 505 
 506         tmp = tx_pifs << 16 | tx_sifs;
 507         RAL_WRITE(sc, RT2560_CSR18, tmp);
 508 
 509         tmp = eifs << 16 | tx_difs;
 510         RAL_WRITE(sc, RT2560_CSR19, tmp);
 511 
 512         ral_debug(RAL_DBG_HW, "setting slottime to %uus\n", slottime);
 513 }
 514 
 515 int
 516 ral_dma_region_alloc(struct rt2560_softc *sc, struct dma_region *dr,
 517     size_t size, uint_t alloc_flags, uint_t bind_flags)
 518 {
 519         dev_info_t *dip = sc->sc_dev;
 520         int err;
 521 
 522         err = ddi_dma_alloc_handle(dip, &ral_dma_attr, DDI_DMA_SLEEP, NULL,
 523             &dr->dr_hnd);
 524         if (err != DDI_SUCCESS)
 525                 goto fail1;
 526 
 527         err = ddi_dma_mem_alloc(dr->dr_hnd, size, &ral_desc_accattr,
 528             alloc_flags, DDI_DMA_SLEEP, NULL,
 529             &dr->dr_base, &dr->dr_size, &dr->dr_acc);
 530         if (err != DDI_SUCCESS)
 531                 goto fail2;
 532 
 533         err = ddi_dma_addr_bind_handle(dr->dr_hnd, NULL,
 534             dr->dr_base, dr->dr_size,
 535             bind_flags, DDI_DMA_SLEEP, NULL, &dr->dr_cookie, &dr->dr_ccnt);
 536         if (err != DDI_SUCCESS)
 537                 goto fail3;
 538 
 539         if (dr->dr_ccnt != 1) {
 540                 err = DDI_FAILURE;
 541                 goto fail4;
 542         }
 543 
 544         dr->dr_pbase = dr->dr_cookie.dmac_address;
 545         ral_debug(RAL_DBG_DMA, "get physical-base=0x%08x\n", dr->dr_pbase);
 546 
 547         return (DDI_SUCCESS);
 548 
 549 fail4:
 550         (void) ddi_dma_unbind_handle(dr->dr_hnd);
 551 fail3:
 552         ddi_dma_mem_free(&dr->dr_acc);
 553 fail2:
 554         ddi_dma_free_handle(&dr->dr_hnd);
 555 fail1:
 556         return (err);
 557 }
 558 
 559 /* ARGSUSED */
 560 void
 561 ral_dma_region_free(struct rt2560_softc *sc, struct dma_region *dr)
 562 {
 563         (void) ddi_dma_unbind_handle(dr->dr_hnd);
 564         ddi_dma_mem_free(&dr->dr_acc);
 565         ddi_dma_free_handle(&dr->dr_hnd);
 566 }
 567 
 568 int
 569 rt2560_alloc_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring,
 570         int count)
 571 {
 572         int i, err;
 573         int size;
 574 
 575         ring->count = count;
 576         ring->queued = 0;
 577         ring->cur = ring->next = 0;
 578         ring->cur_encrypt = ring->next_encrypt = 0;
 579 
 580         ring->data = kmem_zalloc(count * (sizeof (struct rt2560_tx_data)),
 581             KM_SLEEP);
 582         ring->dr_txbuf = kmem_zalloc(count * (sizeof (struct dma_region)),
 583             KM_SLEEP);
 584 
 585         err = ral_dma_region_alloc(sc, &ring->dr_desc,
 586             count * (sizeof (struct rt2560_tx_desc)),
 587             DDI_DMA_CONSISTENT, DDI_DMA_RDWR | DDI_DMA_CONSISTENT);
 588 
 589         if (err != DDI_SUCCESS)
 590                 goto fail1;
 591 
 592         size = roundup(RAL_TXBUF_SIZE, sc->sc_cachelsz);
 593         for (i = 0; i < count; i++) {
 594                 err = ral_dma_region_alloc(sc, &ring->dr_txbuf[i], size,
 595                     DDI_DMA_STREAMING, DDI_DMA_WRITE | DDI_DMA_STREAMING);
 596                 if (err != DDI_SUCCESS) {
 597                         while (i >= 0) {
 598                                 ral_dma_region_free(sc, &ring->dr_txbuf[i]);
 599                                 i--;
 600                         }
 601                         goto fail2;
 602                 }
 603         }
 604 
 605         ring->physaddr = LE_32(ring->dr_desc.dr_pbase);
 606         ring->desc = (struct rt2560_tx_desc *)ring->dr_desc.dr_base;
 607 
 608         for (i = 0; i < count; i++) {
 609                 ring->desc[i].physaddr = LE_32(ring->dr_txbuf[i].dr_pbase);
 610                 ring->data[i].buf = ring->dr_txbuf[i].dr_base;
 611         }
 612 
 613         return (DDI_SUCCESS);
 614 fail2:
 615         ral_dma_region_free(sc, &ring->dr_desc);
 616 fail1:
 617         return (err);
 618 }
 619 
 620 /* ARGSUSED */
 621 void
 622 rt2560_reset_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring)
 623 {
 624         struct rt2560_tx_desc *desc;
 625         struct rt2560_tx_data *data;
 626         int i;
 627 
 628         for (i = 0; i < ring->count; i++) {
 629                 desc = &ring->desc[i];
 630                 data = &ring->data[i];
 631 
 632                 if (data->ni != NULL) {
 633                         ieee80211_free_node(data->ni);
 634                         data->ni = NULL;
 635                 }
 636 
 637                 desc->flags = 0;
 638         }
 639 
 640         (void) ddi_dma_sync(ring->dr_desc.dr_hnd, 0,
 641             ring->count * sizeof (struct rt2560_tx_desc), DDI_DMA_SYNC_FORDEV);
 642 
 643         ring->queued = 0;
 644         ring->cur = ring->next = 0;
 645         ring->cur_encrypt = ring->next_encrypt = 0;
 646 }
 647 
 648 void
 649 rt2560_free_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring)
 650 {
 651         struct rt2560_tx_data *data;
 652         int i;
 653 
 654         ral_dma_region_free(sc, &ring->dr_desc);
 655         /* tx buf */
 656         for (i = 0; i < ring->count; i++) {
 657                 data = &ring->data[i];
 658                 if (data->ni != NULL) {
 659                         ieee80211_free_node(data->ni);
 660                         data->ni = NULL;
 661                 }
 662 
 663                 ral_dma_region_free(sc, &ring->dr_txbuf[i]);
 664         }
 665 
 666         kmem_free(ring->data, ring->count * (sizeof (struct rt2560_tx_data)));
 667         kmem_free(ring->dr_txbuf, ring->count * (sizeof (struct dma_region)));
 668 }
 669 
 670 void
 671 rt2560_ring_hwsetup(struct rt2560_softc *sc)
 672 {
 673         uint32_t tmp;
 674 
 675         /* setup tx rings */
 676         tmp = ((uint32_t)RT2560_PRIO_RING_COUNT << 24) |
 677             RT2560_ATIM_RING_COUNT << 16 |
 678             RT2560_TX_RING_COUNT   <<  8 |
 679             RT2560_TX_DESC_SIZE;
 680 
 681         /* rings must be initialized in this exact order */
 682         RAL_WRITE(sc, RT2560_TXCSR2, tmp);
 683         RAL_WRITE(sc, RT2560_TXCSR3, sc->txq.physaddr);
 684         RAL_WRITE(sc, RT2560_TXCSR5, sc->prioq.physaddr);
 685 
 686         /* setup rx ring */
 687         tmp = RT2560_RX_RING_COUNT << 8 | RT2560_RX_DESC_SIZE;
 688 
 689         RAL_WRITE(sc, RT2560_RXCSR1, tmp);
 690         RAL_WRITE(sc, RT2560_RXCSR2, sc->rxq.physaddr);
 691 }
 692 
 693 int
 694 rt2560_alloc_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring,
 695         int count)
 696 {
 697         struct rt2560_rx_desc *desc;
 698         struct rt2560_rx_data *data;
 699         int i, err;
 700         int size;
 701 
 702         ring->count = count;
 703         ring->cur = ring->next = 0;
 704         ring->cur_decrypt = 0;
 705 
 706         ring->data = kmem_zalloc(count * (sizeof (struct rt2560_rx_data)),
 707             KM_SLEEP);
 708         ring->dr_rxbuf = kmem_zalloc(count * (sizeof (struct dma_region)),
 709             KM_SLEEP);
 710 
 711         err = ral_dma_region_alloc(sc, &ring->dr_desc,
 712             count * (sizeof (struct rt2560_rx_desc)),
 713             DDI_DMA_CONSISTENT, DDI_DMA_RDWR | DDI_DMA_CONSISTENT);
 714 
 715         if (err != DDI_SUCCESS)
 716                 goto fail1;
 717 
 718         size = roundup(RAL_RXBUF_SIZE, sc->sc_cachelsz);
 719         for (i = 0; i < count; i++) {
 720                 err = ral_dma_region_alloc(sc, &ring->dr_rxbuf[i], size,
 721                     DDI_DMA_STREAMING, DDI_DMA_READ | DDI_DMA_STREAMING);
 722                 if (err != DDI_SUCCESS) {
 723                         while (i >= 0) {
 724                                 ral_dma_region_free(sc, &ring->dr_rxbuf[i]);
 725                                 i--;
 726                         }
 727                         goto fail2;
 728                 }
 729         }
 730 
 731         ring->physaddr = ring->dr_desc.dr_pbase;
 732         ring->desc = (struct rt2560_rx_desc *)ring->dr_desc.dr_base;
 733 
 734         for (i = 0; i < count; i++) {
 735                 desc = &ring->desc[i];
 736                 data = &ring->data[i];
 737 
 738                 desc->physaddr = LE_32(ring->dr_rxbuf[i].dr_pbase);
 739                 desc->flags = LE_32(RT2560_RX_BUSY);
 740 
 741                 data->buf = ring->dr_rxbuf[i].dr_base;
 742         }
 743 
 744         return (DDI_SUCCESS);
 745 fail2:
 746         ral_dma_region_free(sc, &ring->dr_desc);
 747 fail1:
 748         return (err);
 749 }
 750 
 751 /* ARGSUSED */
 752 static void
 753 rt2560_reset_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring)
 754 {
 755         int i;
 756 
 757         for (i = 0; i < ring->count; i++) {
 758                 ring->desc[i].flags = LE_32(RT2560_RX_BUSY);
 759                 ring->data[i].drop = 0;
 760         }
 761 
 762         (void) ddi_dma_sync(ring->dr_desc.dr_hnd, 0,
 763             ring->count * sizeof (struct rt2560_rx_desc),
 764             DDI_DMA_SYNC_FORKERNEL);
 765 
 766         ring->cur = ring->next = 0;
 767         ring->cur_decrypt = 0;
 768 }
 769 
 770 static void
 771 rt2560_free_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring)
 772 {
 773         int i;
 774 
 775         ral_dma_region_free(sc, &ring->dr_desc);
 776         /* rx buf */
 777         for (i = 0; i < ring->count; i++)
 778                 ral_dma_region_free(sc, &ring->dr_rxbuf[i]);
 779 
 780         kmem_free(ring->data, ring->count * (sizeof (struct rt2560_rx_data)));
 781         kmem_free(ring->dr_rxbuf, ring->count * (sizeof (struct dma_region)));
 782 }
 783 
 784 /* ARGSUSED */
 785 static struct ieee80211_node *
 786 rt2560_node_alloc(ieee80211com_t *ic)
 787 {
 788         struct rt2560_node *rn;
 789 
 790         rn = kmem_zalloc(sizeof (struct rt2560_node), KM_SLEEP);
 791         return ((rn != NULL) ? &rn->ni : NULL);
 792 }
 793 
 794 static void
 795 rt2560_node_free(struct ieee80211_node *in)
 796 {
 797         ieee80211com_t *ic = in->in_ic;
 798 
 799         ic->ic_node_cleanup(in);
 800         if (in->in_wpa_ie != NULL)
 801                 ieee80211_free(in->in_wpa_ie);
 802         kmem_free(in, sizeof (struct rt2560_node));
 803 }
 804 
 805 /*
 806  * This function is called periodically (every 200ms) during scanning to
 807  * switch from one channel to another.
 808  */
 809 static void
 810 rt2560_next_scan(void *arg)
 811 {
 812         struct rt2560_softc *sc = arg;
 813         struct ieee80211com *ic = &sc->sc_ic;
 814 
 815         if (ic->ic_state == IEEE80211_S_SCAN)
 816                 (void) ieee80211_next_scan(ic);
 817 }
 818 
 819 /*
 820  * This function is called for each node present in the node station table.
 821  */
 822 /* ARGSUSED */
 823 static void
 824 rt2560_iter_func(void *arg, struct ieee80211_node *ni)
 825 {
 826         struct rt2560_node *rn = (struct rt2560_node *)ni;
 827 
 828         ral_rssadapt_updatestats(&rn->rssadapt);
 829 }
 830 
 831 /*
 832  * This function is called periodically (every 100ms) in RUN state to update
 833  * the rate adaptation statistics.
 834  */
 835 static void
 836 rt2560_update_rssadapt(void *arg)
 837 {
 838         struct rt2560_softc *sc = arg;
 839         struct ieee80211com *ic = &sc->sc_ic;
 840 
 841         ieee80211_iterate_nodes(&ic->ic_sta, rt2560_iter_func, arg);
 842         sc->sc_rssadapt_id = timeout(rt2560_update_rssadapt, (void *)sc,
 843             drv_usectohz(100 * 1000));
 844 }
 845 
 846 static void
 847 rt2560_statedog(void *arg)
 848 {
 849         struct rt2560_softc *sc = arg;
 850         struct ieee80211com *ic = &sc->sc_ic;
 851         enum ieee80211_state state;
 852 
 853         RAL_LOCK(sc);
 854 
 855         sc->sc_state_id = 0;
 856         state = ic->ic_state;
 857         ic->ic_state = sc->sc_ostate;
 858 
 859         RAL_UNLOCK(sc);
 860 
 861         ieee80211_new_state(ic, state, -1);
 862 
 863 }
 864 
 865 static int
 866 rt2560_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
 867 {
 868         struct rt2560_softc *sc = (struct rt2560_softc *)ic;
 869         enum ieee80211_state ostate;
 870         struct ieee80211_node *ni;
 871         int err;
 872 
 873         RAL_LOCK(sc);
 874 
 875         ostate = ic->ic_state;
 876         sc->sc_ostate = ostate;
 877 
 878         if (sc->sc_scan_id != 0) {
 879                 (void) untimeout(sc->sc_scan_id);
 880                 sc->sc_scan_id = 0;
 881         }
 882 
 883         if (sc->sc_rssadapt_id != 0) {
 884                 (void) untimeout(sc->sc_rssadapt_id);
 885                 sc->sc_rssadapt_id = 0;
 886         }
 887 
 888         if (sc->sc_state_id != 0) {
 889                 (void) untimeout(sc->sc_state_id);
 890                 sc->sc_state_id = 0;
 891         }
 892 
 893         switch (nstate) {
 894         case IEEE80211_S_INIT:
 895                 if (ostate == IEEE80211_S_RUN) {
 896                         /* abort TSF synchronization */
 897                         RAL_WRITE(sc, RT2560_CSR14, 0);
 898                         /* turn association led off */
 899                         rt2560_update_led(sc, 0, 0);
 900                 }
 901                 break;
 902 
 903         case IEEE80211_S_SCAN:
 904                 rt2560_set_chan(sc, ic->ic_curchan);
 905                 sc->sc_scan_id = timeout(rt2560_next_scan, (void *)sc,
 906                     drv_usectohz(sc->dwelltime * 1000));
 907                 break;
 908 
 909         case IEEE80211_S_AUTH:
 910                 rt2560_set_chan(sc, ic->ic_curchan);
 911                 break;
 912 
 913         case IEEE80211_S_ASSOC:
 914                 rt2560_set_chan(sc, ic->ic_curchan);
 915 
 916                 drv_usecwait(10 * 1000);        /* dlink */
 917                 sc->sc_state_id = timeout(rt2560_statedog, (void *)sc,
 918                     drv_usectohz(300 * 1000));  /* ap7-3 */
 919                 break;
 920 
 921         case IEEE80211_S_RUN:
 922                 rt2560_set_chan(sc, ic->ic_curchan);
 923 
 924                 ni = ic->ic_bss;
 925 
 926                 if (ic->ic_opmode != IEEE80211_M_MONITOR) {
 927                         rt2560_update_plcp(sc);
 928                         rt2560_set_basicrates(sc);
 929                         rt2560_set_bssid(sc, ni->in_bssid);
 930                 }
 931 
 932                 /* turn assocation led on */
 933                 rt2560_update_led(sc, 1, 0);
 934                 if (ic->ic_opmode != IEEE80211_M_MONITOR) {
 935                         sc->sc_rssadapt_id = timeout(rt2560_update_rssadapt,
 936                             (void *)sc, drv_usectohz(100 * 1000));
 937                         rt2560_enable_tsf_sync(sc);
 938                 }
 939                 break;
 940         }
 941 
 942         RAL_UNLOCK(sc);
 943 
 944         err = sc->sc_newstate(ic, nstate, arg);
 945         /*
 946          * Finally, start any timers.
 947          */
 948         if (nstate == IEEE80211_S_RUN)
 949                 ieee80211_start_watchdog(ic, 1);
 950 
 951         return (err);
 952 }
 953 
 954 /*
 955  * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46 or
 956  * 93C66).
 957  */
 958 static uint16_t
 959 rt2560_eeprom_read(struct rt2560_softc *sc, uint8_t addr)
 960 {
 961         uint32_t tmp;
 962         uint16_t val;
 963         int n;
 964 
 965         /* clock C once before the first command */
 966         RT2560_EEPROM_CTL(sc, 0);
 967 
 968         RT2560_EEPROM_CTL(sc, RT2560_S);
 969         RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
 970         RT2560_EEPROM_CTL(sc, RT2560_S);
 971 
 972         /* write start bit (1) */
 973         RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D);
 974         RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D | RT2560_C);
 975 
 976         /* write READ opcode (10) */
 977         RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D);
 978         RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D | RT2560_C);
 979         RT2560_EEPROM_CTL(sc, RT2560_S);
 980         RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
 981 
 982         /* write address (A5-A0 or A7-A0) */
 983         n = (RAL_READ(sc, RT2560_CSR21) & RT2560_93C46) ? 5 : 7;
 984         for (; n >= 0; n--) {
 985                 RT2560_EEPROM_CTL(sc, RT2560_S |
 986                     (((addr >> n) & 1) << RT2560_SHIFT_D));
 987                 RT2560_EEPROM_CTL(sc, RT2560_S |
 988                     (((addr >> n) & 1) << RT2560_SHIFT_D) | RT2560_C);
 989         }
 990 
 991         RT2560_EEPROM_CTL(sc, RT2560_S);
 992 
 993         /* read data Q15-Q0 */
 994         val = 0;
 995         for (n = 15; n >= 0; n--) {
 996                 RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
 997                 tmp = RAL_READ(sc, RT2560_CSR21);
 998                 val |= ((tmp & RT2560_Q) >> RT2560_SHIFT_Q) << n;
 999                 RT2560_EEPROM_CTL(sc, RT2560_S);
1000         }
1001 
1002         RT2560_EEPROM_CTL(sc, 0);
1003 
1004         /* clear Chip Select and clock C */
1005         RT2560_EEPROM_CTL(sc, RT2560_S);
1006         RT2560_EEPROM_CTL(sc, 0);
1007         RT2560_EEPROM_CTL(sc, RT2560_C);
1008 
1009         return (val);
1010 }
1011 
1012 static void
1013 rt2560_tx_intr(struct rt2560_softc *sc)
1014 {
1015         struct ieee80211com *ic = &sc->sc_ic;
1016         struct rt2560_tx_desc *desc;
1017         struct rt2560_tx_data *data;
1018         struct rt2560_node *rn;
1019 
1020         struct dma_region *dr;
1021         int count;
1022 
1023         dr = &sc->txq.dr_desc;
1024         count = sc->txq.count;
1025 
1026         (void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1027             DDI_DMA_SYNC_FORKERNEL);
1028 
1029         mutex_enter(&sc->txq.tx_lock);
1030 
1031         for (;;) {
1032                 desc = &sc->txq.desc[sc->txq.next];
1033                 data = &sc->txq.data[sc->txq.next];
1034 
1035                 if ((LE_32(desc->flags) & RT2560_TX_BUSY) ||
1036                     (LE_32(desc->flags) & RT2560_TX_CIPHER_BUSY) ||
1037                     !(LE_32(desc->flags) & RT2560_TX_VALID))
1038                         break;
1039 
1040                 rn = (struct rt2560_node *)data->ni;
1041 
1042                 switch (LE_32(desc->flags) & RT2560_TX_RESULT_MASK) {
1043                 case RT2560_TX_SUCCESS:
1044                         ral_debug(RAL_DBG_INTR, "data frame sent success\n");
1045                         if (data->id.id_node != NULL) {
1046                                 ral_rssadapt_raise_rate(ic, &rn->rssadapt,
1047                                     &data->id);
1048                         }
1049                         break;
1050 
1051                 case RT2560_TX_SUCCESS_RETRY:
1052                         ral_debug(RAL_DBG_INTR,
1053                             "data frame sent after %u retries\n",
1054                             (LE_32(desc->flags) >> 5) & 0x7);
1055                         sc->sc_tx_retries++;
1056                         break;
1057 
1058                 case RT2560_TX_FAIL_RETRY:
1059                         ral_debug(RAL_DBG_INTR,
1060                             "sending data frame failed (too much retries)\n");
1061                         if (data->id.id_node != NULL) {
1062                                 ral_rssadapt_lower_rate(ic, data->ni,
1063                                     &rn->rssadapt, &data->id);
1064                         }
1065                         break;
1066 
1067                 case RT2560_TX_FAIL_INVALID:
1068                 case RT2560_TX_FAIL_OTHER:
1069                 default:
1070                         ral_debug(RAL_DBG_INTR, "sending data frame failed "
1071                             "0x%08x\n", LE_32(desc->flags));
1072                         break;
1073                 }
1074 
1075                 ieee80211_free_node(data->ni);
1076                 data->ni = NULL;
1077 
1078                 /* descriptor is no longer valid */
1079                 desc->flags &= ~LE_32(RT2560_TX_VALID);
1080 
1081                 ral_debug(RAL_DBG_INTR, "tx done idx=%u\n", sc->txq.next);
1082 
1083                 sc->txq.queued--;
1084                 sc->txq.next = (sc->txq.next + 1) % RT2560_TX_RING_COUNT;
1085 
1086                 if (sc->sc_need_sched &&
1087                     sc->txq.queued < (RT2560_TX_RING_COUNT - 32)) {
1088                         sc->sc_need_sched = 0;
1089                         mac_tx_update(ic->ic_mach);
1090                 }
1091         }
1092 
1093         (void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1094             DDI_DMA_SYNC_FORDEV);
1095 
1096         sc->sc_tx_timer = 0;
1097         mutex_exit(&sc->txq.tx_lock);
1098 }
1099 
1100 static void
1101 rt2560_prio_intr(struct rt2560_softc *sc)
1102 {
1103         struct rt2560_tx_desc *desc;
1104         struct rt2560_tx_data *data;
1105 
1106         struct dma_region *dr;
1107         int count;
1108 
1109         dr = &sc->prioq.dr_desc;
1110         count = sc->prioq.count;
1111 
1112         (void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1113             DDI_DMA_SYNC_FORKERNEL);
1114 
1115         mutex_enter(&sc->prioq.tx_lock);
1116 
1117         for (;;) {
1118                 desc = &sc->prioq.desc[sc->prioq.next];
1119                 data = &sc->prioq.data[sc->prioq.next];
1120 
1121                 if ((LE_32(desc->flags) & RT2560_TX_BUSY) ||
1122                     !(LE_32(desc->flags) & RT2560_TX_VALID))
1123                         break;
1124 
1125                 switch (LE_32(desc->flags) & RT2560_TX_RESULT_MASK) {
1126                 case RT2560_TX_SUCCESS:
1127                         ral_debug(RAL_DBG_INTR, "mgt frame sent success\n");
1128                         break;
1129 
1130                 case RT2560_TX_SUCCESS_RETRY:
1131                         ral_debug(RAL_DBG_INTR,
1132                             "mgt frame sent after %u retries\n",
1133                             (LE_32(desc->flags) >> 5) & 0x7);
1134                         break;
1135 
1136                 case RT2560_TX_FAIL_RETRY:
1137                         ral_debug(RAL_DBG_INTR,
1138                             "sending mgt frame failed (too much " "retries)\n");
1139                         break;
1140 
1141                 case RT2560_TX_FAIL_INVALID:
1142                 case RT2560_TX_FAIL_OTHER:
1143                 default:
1144                         ral_debug(RAL_DBG_INTR, "sending mgt frame failed "
1145                             "0x%08x\n", LE_32(desc->flags));
1146                 }
1147 
1148                 ieee80211_free_node(data->ni);
1149                 data->ni = NULL;
1150 
1151                 /* descriptor is no longer valid */
1152                 desc->flags &= ~LE_32(RT2560_TX_VALID);
1153 
1154                 ral_debug(RAL_DBG_INTR, "prio done idx=%u\n", sc->prioq.next);
1155 
1156                 sc->prioq.queued--;
1157                 sc->prioq.next = (sc->prioq.next + 1) % RT2560_PRIO_RING_COUNT;
1158         }
1159 
1160         (void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1161             DDI_DMA_SYNC_FORDEV);
1162 
1163         sc->sc_tx_timer = 0;
1164         mutex_exit(&sc->prioq.tx_lock);
1165 }
1166 
1167 /*
1168  * Some frames were received. Pass them to the hardware cipher engine before
1169  * sending them to the 802.11 layer.
1170  */
1171 void
1172 rt2560_rx_intr(struct rt2560_softc *sc)
1173 {
1174         struct ieee80211com *ic = &sc->sc_ic;
1175         struct rt2560_rx_desc *desc;
1176         struct rt2560_rx_data *data;
1177         struct ieee80211_frame *wh;
1178         struct ieee80211_node *ni;
1179         struct rt2560_node *rn;
1180 
1181         mblk_t *m;
1182         uint32_t len;
1183         char *rxbuf;
1184 
1185         struct dma_region *dr, *dr_bf;
1186         int count;
1187 
1188         dr = &sc->rxq.dr_desc;
1189         count = sc->rxq.count;
1190 
1191         mutex_enter(&sc->rxq.rx_lock);
1192 
1193         (void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_RX_DESC_SIZE,
1194             DDI_DMA_SYNC_FORKERNEL);
1195 
1196         for (;;) {
1197                 desc = &sc->rxq.desc[sc->rxq.cur];
1198                 data = &sc->rxq.data[sc->rxq.cur];
1199 
1200                 if ((LE_32(desc->flags) & RT2560_RX_BUSY) ||
1201                     (LE_32(desc->flags) & RT2560_RX_CIPHER_BUSY))
1202                         break;
1203 
1204                 data->drop = 0;
1205 
1206                 if ((LE_32(desc->flags) & RT2560_RX_PHY_ERROR) ||
1207                     (LE_32(desc->flags) & RT2560_RX_CRC_ERROR)) {
1208                         /*
1209                          * This should not happen since we did not request
1210                          * to receive those frames when we filled RXCSR0.
1211                          */
1212                         ral_debug(RAL_DBG_RX, "PHY or CRC error flags 0x%08x\n",
1213                             LE_32(desc->flags));
1214                         data->drop = 1;
1215                 }
1216 
1217                 if (((LE_32(desc->flags) >> 16) & 0xfff) > RAL_RXBUF_SIZE) {
1218                         ral_debug(RAL_DBG_RX, "bad length\n");
1219                         data->drop = 1;
1220                 }
1221 
1222                 if (data->drop) {
1223                         sc->sc_rx_err++;
1224                         goto skip;
1225                 }
1226 
1227                 rxbuf = data->buf;
1228                 len = (LE_32(desc->flags) >> 16) & 0xfff;
1229 
1230                 if ((len < sizeof (struct ieee80211_frame_min)) ||
1231                     (len > RAL_RXBUF_SIZE)) {
1232                         ral_debug(RAL_DBG_RX, "bad frame length=%u\n", len);
1233                         sc->sc_rx_err++;
1234                         goto skip;
1235                 }
1236 
1237                 if ((m = allocb(len, BPRI_MED)) == NULL) {
1238                         ral_debug(RAL_DBG_RX, "rt2560_rx_intr():"
1239                             " allocate mblk failed.\n");
1240                         sc->sc_rx_nobuf++;
1241                         goto skip;
1242                 }
1243 
1244                 dr_bf = &sc->rxq.dr_rxbuf[sc->rxq.cur];
1245                 (void) ddi_dma_sync(dr_bf->dr_hnd, 0, dr_bf->dr_size,
1246                     DDI_DMA_SYNC_FORCPU);
1247 
1248                 bcopy(rxbuf, m->b_rptr, len);
1249                 m->b_wptr += len;
1250 
1251                 wh = (struct ieee80211_frame *)m->b_rptr;
1252                 ni = ieee80211_find_rxnode(ic, wh);
1253 
1254                 /* give rssi to the rate adatation algorithm */
1255                 rn = (struct rt2560_node *)ni;
1256                 ral_rssadapt_input(ic, ni, &rn->rssadapt, desc->rssi);
1257 
1258                 /* send the frame to the 802.11 layer */
1259                 (void) ieee80211_input(ic, m, ni, desc->rssi, 0);
1260 
1261                 /* node is no longer needed */
1262                 ieee80211_free_node(ni);
1263 
1264 skip:           desc->flags = LE_32(RT2560_RX_BUSY);
1265                 ral_debug(RAL_DBG_RX, "rx done idx=%u\n", sc->rxq.cur);
1266 
1267                 sc->rxq.cur = (sc->rxq.cur + 1) % RT2560_RX_RING_COUNT;
1268         }
1269         mutex_exit(&sc->rxq.rx_lock);
1270 
1271         (void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1272             DDI_DMA_SYNC_FORDEV);
1273 }
1274 
1275 uint_t
1276 ral_softint_handler(caddr_t data)
1277 {
1278         /* LINTED E_BAD_PTR_CAST_ALIGN */
1279         struct rt2560_softc *sc = (struct rt2560_softc *)data;
1280 
1281         /*
1282          * Check if the soft interrupt is triggered by another
1283          * driver at the same level.
1284          */
1285         RAL_LOCK(sc);
1286         if (sc->sc_rx_pend) {
1287                 sc->sc_rx_pend = 0;
1288                 RAL_UNLOCK(sc);
1289                 rt2560_rx_intr(sc);
1290                 return (DDI_INTR_CLAIMED);
1291         }
1292         RAL_UNLOCK(sc);
1293         return (DDI_INTR_UNCLAIMED);
1294 }
1295 
1296 /*
1297  * Return the expected ack rate for a frame transmitted at rate `rate'.
1298  * XXX: this should depend on the destination node basic rate set.
1299  */
1300 static int
1301 rt2560_ack_rate(struct ieee80211com *ic, int rate)
1302 {
1303         switch (rate) {
1304         /* CCK rates */
1305         case 2:
1306                 return (2);
1307         case 4:
1308         case 11:
1309         case 22:
1310                 return ((ic->ic_curmode == IEEE80211_MODE_11B) ? 4 : rate);
1311 
1312         /* OFDM rates */
1313         case 12:
1314         case 18:
1315                 return (12);
1316         case 24:
1317         case 36:
1318                 return (24);
1319         case 48:
1320         case 72:
1321         case 96:
1322         case 108:
1323                 return (48);
1324         }
1325 
1326         /* default to 1Mbps */
1327         return (2);
1328 }
1329 
1330 /*
1331  * Compute the duration (in us) needed to transmit `len' bytes at rate `rate'.
1332  * The function automatically determines the operating mode depending on the
1333  * given rate. `flags' indicates whether short preamble is in use or not.
1334  */
1335 static uint16_t
1336 rt2560_txtime(int len, int rate, uint32_t flags)
1337 {
1338         uint16_t txtime;
1339 
1340         if (RAL_RATE_IS_OFDM(rate)) {
1341                 /* IEEE Std 802.11a-1999, pp. 37 */
1342                 txtime = (8 + 4 * len + 3 + rate - 1) / rate;
1343                 txtime = 16 + 4 + 4 * txtime + 6;
1344         } else {
1345                 /* IEEE Std 802.11b-1999, pp. 28 */
1346                 txtime = (16 * len + rate - 1) / rate;
1347                 if (rate != 2 && (flags & IEEE80211_F_SHPREAMBLE))
1348                         txtime +=  72 + 24;
1349                 else
1350                         txtime += 144 + 48;
1351         }
1352 
1353         return (txtime);
1354 }
1355 
1356 static uint8_t
1357 rt2560_plcp_signal(int rate)
1358 {
1359         switch (rate) {
1360         /* CCK rates (returned values are device-dependent) */
1361         case 2:         return (0x0);
1362         case 4:         return (0x1);
1363         case 11:        return (0x2);
1364         case 22:        return (0x3);
1365 
1366         /* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1367         case 12:        return (0xb);
1368         case 18:        return (0xf);
1369         case 24:        return (0xa);
1370         case 36:        return (0xe);
1371         case 48:        return (0x9);
1372         case 72:        return (0xd);
1373         case 96:        return (0x8);
1374         case 108:       return (0xc);
1375 
1376         /* unsupported rates (should not get there) */
1377         default:        return (0xff);
1378         }
1379 }
1380 
1381 void
1382 rt2560_setup_tx_desc(struct rt2560_softc *sc, struct rt2560_tx_desc *desc,
1383     uint32_t flags, int len, int rate, int encrypt)
1384 {
1385         struct ieee80211com *ic = &sc->sc_ic;
1386         uint16_t plcp_length;
1387         int remainder;
1388 
1389         desc->flags = LE_32(flags);
1390         desc->flags |= LE_32(len << 16);
1391         desc->flags |= encrypt ? LE_32(RT2560_TX_CIPHER_BUSY) :
1392             LE_32(RT2560_TX_BUSY | RT2560_TX_VALID);
1393 
1394         desc->wme = LE_16(
1395             RT2560_AIFSN(2) |
1396             RT2560_LOGCWMIN(3) |
1397             RT2560_LOGCWMAX(8));
1398 
1399         /* setup PLCP fields */
1400         desc->plcp_signal  = rt2560_plcp_signal(rate);
1401         desc->plcp_service = 4;
1402 
1403         len += IEEE80211_CRC_LEN;
1404         if (RAL_RATE_IS_OFDM(rate)) {
1405                 desc->flags |= LE_32(RT2560_TX_OFDM);
1406 
1407                 plcp_length = len & 0xfff;
1408                 desc->plcp_length_hi = plcp_length >> 6;
1409                 desc->plcp_length_lo = plcp_length & 0x3f;
1410         } else {
1411                 plcp_length = (16 * len + rate - 1) / rate;
1412                 if (rate == 22) {
1413                         remainder = (16 * len) % 22;
1414                         if (remainder != 0 && remainder < 7)
1415                                 desc->plcp_service |= RT2560_PLCP_LENGEXT;
1416                 }
1417                 desc->plcp_length_hi = plcp_length >> 8;
1418                 desc->plcp_length_lo = plcp_length & 0xff;
1419 
1420                 if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1421                         desc->plcp_signal |= 0x08;
1422         }
1423 }
1424 
1425 /* ARGSUSED */
1426 int
1427 rt2560_mgmt_send(ieee80211com_t *ic, mblk_t *mp, uint8_t type)
1428 {
1429         struct rt2560_softc *sc = (struct rt2560_softc *)ic;
1430         struct rt2560_tx_desc *desc;
1431         struct rt2560_tx_data *data;
1432         struct ieee80211_frame *wh;
1433         uint16_t dur;
1434         uint32_t flags = 0;
1435         int rate, err = DDI_SUCCESS;
1436 
1437         int off, pktlen, mblen;
1438         caddr_t dest;
1439         mblk_t *m, *m0;
1440 
1441         struct dma_region *dr;
1442         uint32_t idx;
1443         struct ieee80211_node *ni;
1444         struct ieee80211_key *k;
1445 
1446         mutex_enter(&sc->prioq.tx_lock);
1447 
1448         if (!RAL_IS_RUNNING(sc)) {
1449                 err = ENXIO;
1450                 goto fail1;
1451         }
1452 
1453         if (sc->prioq.queued >= RT2560_PRIO_RING_COUNT) {
1454                 err = ENOMEM;
1455                 sc->sc_tx_nobuf++;
1456                 goto fail1;
1457         }
1458 
1459         m = allocb(msgdsize(mp) + 32, BPRI_MED);
1460         if (m == NULL) {
1461                 ral_debug(RAL_DBG_TX, "rt2560_mgmt_send: can't alloc mblk.\n");
1462                 err = DDI_FAILURE;
1463                 goto fail1;
1464         }
1465 
1466         for (off = 0, m0 = mp; m0 != NULL; m0 = m0->b_cont) {
1467                 mblen = MBLKL(m0);
1468                 (void) memcpy(m->b_rptr + off, m0->b_rptr, mblen);
1469                 off += mblen;
1470         }
1471         m->b_wptr += off;
1472 
1473         wh = (struct ieee80211_frame *)m->b_rptr;
1474         ni = ieee80211_find_txnode(ic, wh->i_addr1);
1475 
1476         if (ni == NULL) {
1477                 err = DDI_FAILURE;
1478                 sc->sc_tx_err++;
1479                 goto fail2;
1480         }
1481 
1482         /* to support shared_key auth mode */
1483         if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1484                 k = ieee80211_crypto_encap(ic, m);
1485                 if (k == NULL) {
1486                         err = DDI_FAILURE;
1487                         sc->sc_tx_err++;
1488                         goto fail3;
1489                 }
1490                 /* packet header may have moved, reset our local pointer */
1491                 wh = (struct ieee80211_frame *)m->b_rptr;
1492         }
1493 
1494         desc = &sc->prioq.desc[sc->prioq.cur];
1495         data = &sc->prioq.data[sc->prioq.cur];
1496 
1497         rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
1498         data->ni = ieee80211_ref_node(ni);
1499 
1500         pktlen = msgdsize(m);
1501         dest = data->buf;
1502         bcopy(m->b_rptr, dest, pktlen);
1503 
1504         wh = (struct ieee80211_frame *)m->b_rptr;
1505         if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1506                 flags |= RT2560_TX_ACK;
1507 
1508                 dur = rt2560_txtime(RAL_ACK_SIZE, rate, ic->ic_flags) +
1509                     RAL_SIFS;
1510                 /* LINTED E_BAD_PTR_CAST_ALIGN */
1511                 *(uint16_t *)wh->i_dur = LE_16(dur);
1512 
1513                 /* tell hardware to add timestamp for probe responses */
1514                 if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1515                     IEEE80211_FC0_TYPE_MGT &&
1516                     (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1517                     IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1518                         flags |= RT2560_TX_TIMESTAMP;
1519         }
1520 
1521         rt2560_setup_tx_desc(sc, desc, flags, pktlen, rate, 0);
1522 
1523         idx = sc->prioq.cur;
1524 
1525         dr = &sc->prioq.dr_txbuf[idx];
1526         (void) ddi_dma_sync(dr->dr_hnd, 0, RAL_TXBUF_SIZE, DDI_DMA_SYNC_FORDEV);
1527 
1528         dr = &sc->prioq.dr_desc;
1529         (void) ddi_dma_sync(dr->dr_hnd, idx * RT2560_TX_DESC_SIZE,
1530             RT2560_TX_DESC_SIZE, DDI_DMA_SYNC_FORDEV);
1531 
1532         ral_debug(RAL_DBG_MGMT, "sending mgt frame len=%u idx=%u rate=%u\n",
1533             pktlen, sc->prioq.cur, rate);
1534 
1535         /* kick prio */
1536         sc->prioq.queued++; /* IF > RT2560_PRIO_RING_COUNT? FULL */
1537         sc->prioq.cur = (sc->prioq.cur + 1) % RT2560_PRIO_RING_COUNT;
1538         RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_PRIO);
1539 
1540         sc->sc_tx_timer = 5;
1541 
1542         ic->ic_stats.is_tx_frags++;
1543         ic->ic_stats.is_tx_bytes += pktlen;
1544 
1545 fail3:
1546         ieee80211_free_node(ni);
1547 fail2:
1548         freemsg(m);
1549 fail1:
1550         freemsg(mp);
1551         mutex_exit(&sc->prioq.tx_lock);
1552 
1553         return (err);
1554 }
1555 
1556 static int
1557 rt2560_send(ieee80211com_t *ic, mblk_t *mp)
1558 {
1559         struct rt2560_softc *sc = (struct rt2560_softc *)ic;
1560         struct rt2560_tx_desc *desc;
1561         struct rt2560_tx_data *data;
1562         struct rt2560_node *rn;
1563         struct ieee80211_rateset *rs;
1564         struct ieee80211_frame *wh;
1565         struct ieee80211_key *k;
1566         uint16_t dur;
1567         uint32_t flags = 0;
1568         int rate, err = DDI_SUCCESS;
1569 
1570         struct ieee80211_node *ni;
1571         mblk_t *m, *m0;
1572         int off, mblen, pktlen;
1573         caddr_t dest;
1574 
1575         struct dma_region *dr;
1576         uint32_t idx;
1577 
1578         mutex_enter(&sc->txq.tx_lock);
1579 
1580         if (sc->txq.queued >= RT2560_TX_RING_COUNT - 1) {
1581                 ral_debug(RAL_DBG_TX, "ral: rt2560_tx_data(): "
1582                     "no TX DMA buffer available!\n");
1583                 sc->sc_need_sched = 1;
1584                 sc->sc_tx_nobuf++;
1585                 err = ENOMEM;
1586                 goto fail1;
1587         }
1588 
1589         m = allocb(msgdsize(mp) + 32, BPRI_MED);
1590         if (m == NULL) {
1591                 ral_debug(RAL_DBG_TX, "rt2560_xmit(): can't alloc mblk.\n");
1592                 err = DDI_FAILURE;
1593                 goto fail1;
1594         }
1595 
1596         for (off = 0, m0 = mp; m0 != NULL; m0 = m0->b_cont) {
1597                 mblen = MBLKL(m0);
1598                 (void) memcpy(m->b_rptr + off, m0->b_rptr, mblen);
1599                 off += mblen;
1600         }
1601         m->b_wptr += off;
1602 
1603         wh = (struct ieee80211_frame *)m->b_rptr;
1604         ni = ieee80211_find_txnode(ic, wh->i_addr1);
1605 
1606         if (ni == NULL) {
1607                 err = DDI_FAILURE;
1608                 sc->sc_tx_err++;
1609                 goto fail2;
1610         }
1611 
1612         (void) ieee80211_encap(ic, m, ni);
1613 
1614         if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1615                 k = ieee80211_crypto_encap(ic, m);
1616                 if (k == NULL) {
1617                         sc->sc_tx_err++;
1618                         err = DDI_FAILURE;
1619                         goto fail3;
1620                 }
1621                 /* packet header may have moved, reset our local pointer */
1622                 wh = (struct ieee80211_frame *)m->b_rptr;
1623         }
1624 
1625         /*
1626          * RTS/CTS exchange ignore, since the max packet will less than
1627          * the rtsthreshold (2346)
1628          * Unnecessary codes deleted.
1629          */
1630 
1631         data = &sc->txq.data[sc->txq.cur];
1632         desc = &sc->txq.desc[sc->txq.cur];
1633 
1634         data->ni = ieee80211_ref_node(ni);
1635 
1636         pktlen = msgdsize(m);
1637         dest = data->buf;
1638         bcopy(m->b_rptr, dest, pktlen);
1639 
1640         if (ic->ic_fixed_rate != IEEE80211_FIXED_RATE_NONE) {
1641                 rs = &ic->ic_sup_rates[ic->ic_curmode];
1642                 rate = rs->ir_rates[ic->ic_fixed_rate];
1643         } else {
1644                 rs = &ni->in_rates;
1645                 rn = (struct rt2560_node *)ni;
1646                 ni->in_txrate = ral_rssadapt_choose(&rn->rssadapt, rs, wh,
1647                     pktlen, NULL, 0);
1648                 rate = rs->ir_rates[ni->in_txrate];
1649         }
1650 
1651         rate &= IEEE80211_RATE_VAL;
1652         if (rate <= 0) {
1653                 rate = 2;       /* basic rate */
1654         }
1655 
1656         /* remember link conditions for rate adaptation algorithm */
1657         if (ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE) {
1658                 data->id.id_len = pktlen;
1659                 data->id.id_rateidx = ni->in_txrate;
1660                 data->id.id_node = ni;
1661                 data->id.id_rssi = ni->in_rssi;
1662         } else
1663                 data->id.id_node = NULL;
1664 
1665         if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1666                 flags |= RT2560_TX_ACK;
1667 
1668                 dur = rt2560_txtime(RAL_ACK_SIZE, rt2560_ack_rate(ic, rate),
1669                     ic->ic_flags) + RAL_SIFS;
1670                 /* LINTED E_BAD_PTR_CAST_ALIGN */
1671                 *(uint16_t *)wh->i_dur = LE_16(dur);
1672         }
1673 
1674         /* flags |= RT2560_TX_CIPHER_NONE; */
1675         rt2560_setup_tx_desc(sc, desc, flags, pktlen, rate, 0);
1676 
1677         idx = sc->txq.cur;
1678 
1679         dr = &sc->txq.dr_txbuf[idx];
1680         (void) ddi_dma_sync(dr->dr_hnd, 0, RAL_TXBUF_SIZE, DDI_DMA_SYNC_FORDEV);
1681 
1682         dr = &sc->txq.dr_desc;
1683         (void) ddi_dma_sync(dr->dr_hnd, idx * RT2560_TX_DESC_SIZE,
1684             RT2560_TX_DESC_SIZE, DDI_DMA_SYNC_FORDEV);
1685 
1686         ral_debug(RAL_DBG_TX, "sending data frame len=%u idx=%u rate=%u\n",
1687             pktlen, sc->txq.cur, rate);
1688 
1689         /* kick tx */
1690         sc->txq.queued++;
1691         sc->txq.cur = (sc->txq.cur + 1) % RT2560_TX_RING_COUNT;
1692         RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_TX);
1693 
1694         sc->sc_tx_timer = 5;
1695 
1696         ic->ic_stats.is_tx_frags++;
1697         ic->ic_stats.is_tx_bytes += pktlen;
1698 
1699         freemsg(mp);
1700 fail3:
1701         ieee80211_free_node(ni);
1702 fail2:
1703         freemsg(m);
1704 fail1:
1705         mutex_exit(&sc->txq.tx_lock);
1706         return (err);
1707 }
1708 
1709 static mblk_t *
1710 rt2560_m_tx(void *arg, mblk_t *mp)
1711 {
1712         struct rt2560_softc *sc = (struct rt2560_softc *)arg;
1713         struct ieee80211com *ic = &sc->sc_ic;
1714         mblk_t *next;
1715 
1716         if (!RAL_IS_RUNNING(sc)) {
1717                 freemsgchain(mp);
1718                 return (NULL);
1719         }
1720         /*
1721          * No data frames go out unless we're associated; this
1722          * should not happen as the 802.11 layer does not enable
1723          * the xmit queue until we enter the RUN state.
1724          */
1725         if (ic->ic_state != IEEE80211_S_RUN) {
1726                 ral_debug(RAL_DBG_TX, "ral: rt2560_m_tx(): "
1727                     "discard, state %u\n", ic->ic_state);
1728                 freemsgchain(mp);
1729                 return (NULL);
1730         }
1731 
1732         while (mp != NULL) {
1733                 next = mp->b_next;
1734                 mp->b_next = NULL;
1735                 if (rt2560_send(ic, mp) != DDI_SUCCESS) {
1736                         mp->b_next = next;
1737                         freemsgchain(mp);
1738                         return (NULL);
1739                 }
1740                 mp = next;
1741         }
1742         return (mp);
1743 }
1744 
1745 static void
1746 rt2560_set_macaddr(struct rt2560_softc *sc, uint8_t *addr)
1747 {
1748         uint32_t tmp;
1749 
1750         tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
1751         RAL_WRITE(sc, RT2560_CSR3, tmp);
1752 
1753         tmp = addr[4] | addr[5] << 8;
1754         RAL_WRITE(sc, RT2560_CSR4, tmp);
1755 
1756         ral_debug(RAL_DBG_HW,
1757             "setting MAC address to " MACSTR "\n", MAC2STR(addr));
1758 }
1759 
1760 static void
1761 rt2560_get_macaddr(struct rt2560_softc *sc, uint8_t *addr)
1762 {
1763         uint32_t tmp;
1764 
1765         tmp = RAL_READ(sc, RT2560_CSR3);
1766         addr[0] = tmp & 0xff;
1767         addr[1] = (tmp >>  8) & 0xff;
1768         addr[2] = (tmp >> 16) & 0xff;
1769         addr[3] = (tmp >> 24);
1770 
1771         tmp = RAL_READ(sc, RT2560_CSR4);
1772         addr[4] = tmp & 0xff;
1773         addr[5] = (tmp >> 8) & 0xff;
1774 }
1775 
1776 static void
1777 rt2560_update_promisc(struct rt2560_softc *sc)
1778 {
1779         uint32_t tmp;
1780 
1781         tmp = RAL_READ(sc, RT2560_RXCSR0);
1782         tmp &= ~RT2560_DROP_NOT_TO_ME;
1783         if (!(sc->sc_rcr & RAL_RCR_PROMISC))
1784                 tmp |= RT2560_DROP_NOT_TO_ME;
1785 
1786         RAL_WRITE(sc, RT2560_RXCSR0, tmp);
1787         ral_debug(RAL_DBG_HW, "%s promiscuous mode\n",
1788             (sc->sc_rcr & RAL_RCR_PROMISC) ?  "entering" : "leaving");
1789 }
1790 
1791 static const char *
1792 rt2560_get_rf(int rev)
1793 {
1794         switch (rev) {
1795         case RT2560_RF_2522:    return ("RT2522");
1796         case RT2560_RF_2523:    return ("RT2523");
1797         case RT2560_RF_2524:    return ("RT2524");
1798         case RT2560_RF_2525:    return ("RT2525");
1799         case RT2560_RF_2525E:   return ("RT2525e");
1800         case RT2560_RF_2526:    return ("RT2526");
1801         case RT2560_RF_5222:    return ("RT5222");
1802         default:                return ("unknown");
1803         }
1804 }
1805 
1806 static void
1807 rt2560_read_eeprom(struct rt2560_softc *sc)
1808 {
1809         uint16_t val;
1810         int i;
1811 
1812         val = rt2560_eeprom_read(sc, RT2560_EEPROM_CONFIG0);
1813         sc->rf_rev =   (val >> 11) & 0x7;
1814         sc->hw_radio = (val >> 10) & 0x1;
1815         sc->led_mode = (val >> 6)  & 0x7;
1816         sc->rx_ant =   (val >> 4)  & 0x3;
1817         sc->tx_ant =   (val >> 2)  & 0x3;
1818         sc->nb_ant =   val & 0x3;
1819 
1820         /* read default values for BBP registers */
1821         for (i = 0; i < 16; i++) {
1822                 val = rt2560_eeprom_read(sc, RT2560_EEPROM_BBP_BASE + i);
1823                 sc->bbp_prom[i].reg = val >> 8;
1824                 sc->bbp_prom[i].val = val & 0xff;
1825         }
1826 
1827         /* read Tx power for all b/g channels */
1828         for (i = 0; i < 14 / 2; i++) {
1829                 val = rt2560_eeprom_read(sc, RT2560_EEPROM_TXPOWER + i);
1830                 sc->txpow[i * 2] = val >> 8;
1831                 sc->txpow[i * 2 + 1] = val & 0xff;
1832         }
1833 }
1834 
1835 static int
1836 rt2560_bbp_init(struct rt2560_softc *sc)
1837 {
1838 #define N(a)    (sizeof (a) / sizeof ((a)[0]))
1839         int i, ntries;
1840 
1841         /* wait for BBP to be ready */
1842         for (ntries = 0; ntries < 100; ntries++) {
1843                 if (rt2560_bbp_read(sc, RT2560_BBP_VERSION) != 0)
1844                         break;
1845                 drv_usecwait(1);
1846         }
1847         if (ntries == 100) {
1848                 ral_debug(RAL_DBG_HW, "timeout waiting for BBP\n");
1849                 return (EIO);
1850         }
1851         /* initialize BBP registers to default values */
1852         for (i = 0; i < N(rt2560_def_bbp); i++) {
1853                 rt2560_bbp_write(sc, rt2560_def_bbp[i].reg,
1854                     rt2560_def_bbp[i].val);
1855         }
1856 
1857         return (0);
1858 #undef N
1859 }
1860 
1861 static void
1862 rt2560_set_txantenna(struct rt2560_softc *sc, int antenna)
1863 {
1864         uint32_t tmp;
1865         uint8_t tx;
1866 
1867         tx = rt2560_bbp_read(sc, RT2560_BBP_TX) & ~RT2560_BBP_ANTMASK;
1868         if (antenna == 1)
1869                 tx |= RT2560_BBP_ANTA;
1870         else if (antenna == 2)
1871                 tx |= RT2560_BBP_ANTB;
1872         else
1873                 tx |= RT2560_BBP_DIVERSITY;
1874 
1875         /* need to force I/Q flip for RF 2525e, 2526 and 5222 */
1876         if (sc->rf_rev == RT2560_RF_2525E || sc->rf_rev == RT2560_RF_2526 ||
1877             sc->rf_rev == RT2560_RF_5222)
1878                 tx |= RT2560_BBP_FLIPIQ;
1879 
1880         rt2560_bbp_write(sc, RT2560_BBP_TX, tx);
1881 
1882         /* update values for CCK and OFDM in BBPCSR1 */
1883         tmp = RAL_READ(sc, RT2560_BBPCSR1) & ~0x00070007;
1884         tmp |= (tx & 0x7) << 16 | (tx & 0x7);
1885         RAL_WRITE(sc, RT2560_BBPCSR1, tmp);
1886 }
1887 
1888 static void
1889 rt2560_set_rxantenna(struct rt2560_softc *sc, int antenna)
1890 {
1891         uint8_t rx;
1892 
1893         rx = rt2560_bbp_read(sc, RT2560_BBP_RX) & ~RT2560_BBP_ANTMASK;
1894         if (antenna == 1)
1895                 rx |= RT2560_BBP_ANTA;
1896         else if (antenna == 2)
1897                 rx |= RT2560_BBP_ANTB;
1898         else
1899                 rx |= RT2560_BBP_DIVERSITY;
1900 
1901         /* need to force no I/Q flip for RF 2525e and 2526 */
1902         if (sc->rf_rev == RT2560_RF_2525E || sc->rf_rev == RT2560_RF_2526)
1903                 rx &= ~RT2560_BBP_FLIPIQ;
1904 
1905         rt2560_bbp_write(sc, RT2560_BBP_RX, rx);
1906 }
1907 
1908 static void
1909 rt2560_stop(struct rt2560_softc *sc)
1910 {
1911         struct ieee80211com *ic = &sc->sc_ic;
1912 
1913         ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
1914         ieee80211_stop_watchdog(ic);    /* stop the watchdog */
1915 
1916         RAL_LOCK(sc);
1917         sc->sc_tx_timer = 0;
1918 
1919         /* abort Tx */
1920         RAL_WRITE(sc, RT2560_TXCSR0, RT2560_ABORT_TX);
1921 
1922         /* disable Rx */
1923         RAL_WRITE(sc, RT2560_RXCSR0, RT2560_DISABLE_RX);
1924 
1925         /* reset ASIC (imply reset BBP) */
1926         RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
1927         RAL_WRITE(sc, RT2560_CSR1, 0);
1928 
1929         /* disable interrupts */
1930         RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
1931 
1932         /* reset Tx and Rx rings */
1933         rt2560_reset_tx_ring(sc, &sc->txq);
1934         rt2560_reset_tx_ring(sc, &sc->prioq);
1935         rt2560_reset_rx_ring(sc, &sc->rxq);
1936         RAL_UNLOCK(sc);
1937 }
1938 
1939 static int
1940 rt2560_init(struct rt2560_softc *sc)
1941 {
1942 #define N(a)    (sizeof (a) / sizeof ((a)[0]))
1943         /* struct rt2560_softc *sc = priv; */
1944         struct ieee80211com *ic = &sc->sc_ic;
1945         uint32_t tmp;
1946         int i;
1947 
1948         rt2560_stop(sc);
1949 
1950         RAL_LOCK(sc);
1951         /* setup tx/rx ring */
1952         rt2560_ring_hwsetup(sc);
1953 
1954         /* initialize MAC registers to default values */
1955         for (i = 0; i < N(rt2560_def_mac); i++)
1956                 RAL_WRITE(sc, rt2560_def_mac[i].reg, rt2560_def_mac[i].val);
1957 
1958         rt2560_set_macaddr(sc, ic->ic_macaddr);
1959 
1960         /* set basic rate set (will be updated later) */
1961         RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x153);
1962 
1963         rt2560_set_txantenna(sc, sc->tx_ant);
1964         rt2560_set_rxantenna(sc, sc->rx_ant);
1965         rt2560_update_slot(ic, 1);
1966         rt2560_update_plcp(sc);
1967         rt2560_update_led(sc, 0, 0);
1968 
1969         RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
1970         RAL_WRITE(sc, RT2560_CSR1, RT2560_HOST_READY);
1971 
1972         if (rt2560_bbp_init(sc) != 0) {
1973                 RAL_UNLOCK(sc);
1974                 rt2560_stop(sc);
1975                 return (DDI_FAILURE);
1976         }
1977 
1978         /* set default BSS channel */
1979         rt2560_set_chan(sc, ic->ic_curchan);
1980 
1981         /* kick Rx */
1982         tmp = RT2560_DROP_PHY_ERROR | RT2560_DROP_CRC_ERROR;
1983         if (ic->ic_opmode != IEEE80211_M_MONITOR) {
1984                 tmp |= RT2560_DROP_CTL | RT2560_DROP_VERSION_ERROR;
1985                 if (ic->ic_opmode != IEEE80211_M_HOSTAP)
1986                         tmp |= RT2560_DROP_TODS;
1987                 if (!(sc->sc_rcr & RAL_RCR_PROMISC))
1988                         tmp |= RT2560_DROP_NOT_TO_ME;
1989 
1990         }
1991         RAL_WRITE(sc, RT2560_RXCSR0, tmp);
1992 
1993         /* clear old FCS and Rx FIFO errors */
1994         (void) RAL_READ(sc, RT2560_CNT0);
1995         (void) RAL_READ(sc, RT2560_CNT4);
1996 
1997         /* clear any pending interrupts */
1998         RAL_WRITE(sc, RT2560_CSR7, 0xffffffff);
1999         /* enable interrupts */
2000         RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
2001 
2002         RAL_UNLOCK(sc);
2003 #undef N
2004         return (DDI_SUCCESS);
2005 }
2006 
2007 void
2008 rt2560_watchdog(void *arg)
2009 {
2010         struct rt2560_softc *sc = arg;
2011         struct ieee80211com *ic = &sc->sc_ic;
2012         int ntimer = 0;
2013 
2014         RAL_LOCK(sc);
2015         ic->ic_watchdog_timer = 0;
2016 
2017         if (!RAL_IS_RUNNING(sc)) {
2018                 RAL_UNLOCK(sc);
2019                 return;
2020         }
2021 
2022         if (sc->sc_tx_timer > 0) {
2023                 if (--sc->sc_tx_timer == 0) {
2024                         ral_debug(RAL_DBG_MSG, "tx timer timeout\n");
2025                         RAL_UNLOCK(sc);
2026                         (void) rt2560_init(sc);
2027                         (void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2028                         return;
2029                 }
2030         }
2031 
2032         if (ic->ic_state == IEEE80211_S_RUN)
2033                 ntimer = 1;
2034 
2035         RAL_UNLOCK(sc);
2036 
2037         ieee80211_watchdog(ic);
2038 
2039         if (ntimer)
2040                 ieee80211_start_watchdog(ic, ntimer);
2041 }
2042 
2043 static int
2044 rt2560_m_start(void *arg)
2045 {
2046         struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2047         int err;
2048 
2049         /*
2050          * initialize rt2560 hardware
2051          */
2052         err = rt2560_init(sc);
2053         if (err != DDI_SUCCESS) {
2054                 ral_debug(RAL_DBG_GLD, "device configuration failed\n");
2055                 goto fail;
2056         }
2057         sc->sc_flags |= RAL_FLAG_RUNNING;    /* RUNNING */
2058         return (err);
2059 
2060 fail:
2061         rt2560_stop(sc);
2062         return (err);
2063 }
2064 
2065 static void
2066 rt2560_m_stop(void *arg)
2067 {
2068         struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2069 
2070         (void) rt2560_stop(sc);
2071         sc->sc_flags &= ~RAL_FLAG_RUNNING;       /* STOP */
2072 }
2073 
2074 static int
2075 rt2560_m_unicst(void *arg, const uint8_t *macaddr)
2076 {
2077         struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2078         struct ieee80211com *ic = &sc->sc_ic;
2079 
2080         ral_debug(RAL_DBG_GLD, "rt2560_m_unicst(): " MACSTR "\n",
2081             MAC2STR(macaddr));
2082 
2083         IEEE80211_ADDR_COPY(ic->ic_macaddr, macaddr);
2084         (void) rt2560_set_macaddr(sc, (uint8_t *)macaddr);
2085         (void) rt2560_init(sc);
2086 
2087         return (0);
2088 }
2089 
2090 /*ARGSUSED*/
2091 static int
2092 rt2560_m_multicst(void *arg, boolean_t add, const uint8_t *mca)
2093 {
2094         return (0);
2095 }
2096 
2097 static int
2098 rt2560_m_promisc(void *arg, boolean_t on)
2099 {
2100         struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2101 
2102         if (on) {
2103                 sc->sc_rcr |= RAL_RCR_PROMISC;
2104                 sc->sc_rcr |= RAL_RCR_MULTI;
2105         } else {
2106                 sc->sc_rcr &= ~RAL_RCR_PROMISC;
2107                 sc->sc_rcr &= ~RAL_RCR_PROMISC;
2108         }
2109 
2110         rt2560_update_promisc(sc);
2111         return (0);
2112 }
2113 
2114 /*
2115  * callback functions for /get/set properties
2116  */
2117 static int
2118 rt2560_m_setprop(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
2119     uint_t wldp_length, const void *wldp_buf)
2120 {
2121         struct rt2560_softc *sc = arg;
2122         struct ieee80211com *ic = &sc->sc_ic;
2123         int err;
2124 
2125         err = ieee80211_setprop(ic, pr_name, wldp_pr_num,
2126             wldp_length, wldp_buf);
2127         RAL_LOCK(sc);
2128         if (err == ENETRESET) {
2129                 if (RAL_IS_RUNNING(sc)) {
2130                         RAL_UNLOCK(sc);
2131                         (void) rt2560_init(sc);
2132                         (void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2133                         RAL_LOCK(sc);
2134                 }
2135                 err = 0;
2136         }
2137         RAL_UNLOCK(sc);
2138 
2139         return (err);
2140 }
2141 
2142 static int
2143 rt2560_m_getprop(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
2144     uint_t wldp_length, void *wldp_buf)
2145 {
2146         struct rt2560_softc *sc = arg;
2147         int err;
2148 
2149         err = ieee80211_getprop(&sc->sc_ic, pr_name, wldp_pr_num,
2150             wldp_length, wldp_buf);
2151 
2152         return (err);
2153 }
2154 
2155 static void
2156 rt2560_m_propinfo(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
2157     mac_prop_info_handle_t prh)
2158 {
2159         struct rt2560_softc *sc = arg;
2160 
2161         ieee80211_propinfo(&sc->sc_ic, pr_name, wldp_pr_num, prh);
2162 }
2163 
2164 static void
2165 rt2560_m_ioctl(void* arg, queue_t *wq, mblk_t *mp)
2166 {
2167         struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2168         struct ieee80211com *ic = &sc->sc_ic;
2169         int err;
2170 
2171         err = ieee80211_ioctl(ic, wq, mp);
2172         RAL_LOCK(sc);
2173         if (err == ENETRESET) {
2174                 if (RAL_IS_RUNNING(sc)) {
2175                         RAL_UNLOCK(sc);
2176                         (void) rt2560_init(sc);
2177                         (void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2178                         RAL_LOCK(sc);
2179                 }
2180         }
2181         RAL_UNLOCK(sc);
2182 }
2183 
2184 static int
2185 rt2560_m_stat(void *arg, uint_t stat, uint64_t *val)
2186 {
2187         struct rt2560_softc *sc  = (struct rt2560_softc *)arg;
2188         ieee80211com_t  *ic = &sc->sc_ic;
2189         ieee80211_node_t *ni = ic->ic_bss;
2190         struct ieee80211_rateset *rs = &ni->in_rates;
2191 
2192         RAL_LOCK(sc);
2193         switch (stat) {
2194         case MAC_STAT_IFSPEED:
2195                 *val = ((ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE) ?
2196                     (rs->ir_rates[ni->in_txrate] & IEEE80211_RATE_VAL)
2197                     : ic->ic_fixed_rate) / 2 * 1000000;
2198                 break;
2199         case MAC_STAT_NOXMTBUF:
2200                 *val = sc->sc_tx_nobuf;
2201                 break;
2202         case MAC_STAT_NORCVBUF:
2203                 *val = sc->sc_rx_nobuf;
2204                 break;
2205         case MAC_STAT_IERRORS:
2206                 *val = sc->sc_rx_err;
2207                 break;
2208         case MAC_STAT_RBYTES:
2209                 *val = ic->ic_stats.is_rx_bytes;
2210                 break;
2211         case MAC_STAT_IPACKETS:
2212                 *val = ic->ic_stats.is_rx_frags;
2213                 break;
2214         case MAC_STAT_OBYTES:
2215                 *val = ic->ic_stats.is_tx_bytes;
2216                 break;
2217         case MAC_STAT_OPACKETS:
2218                 *val = ic->ic_stats.is_tx_frags;
2219                 break;
2220         case MAC_STAT_OERRORS:
2221         case WIFI_STAT_TX_FAILED:
2222                 *val = sc->sc_tx_err;
2223                 break;
2224         case WIFI_STAT_TX_RETRANS:
2225                 *val = sc->sc_tx_retries;
2226                 break;
2227         case WIFI_STAT_FCS_ERRORS:
2228         case WIFI_STAT_WEP_ERRORS:
2229         case WIFI_STAT_TX_FRAGS:
2230         case WIFI_STAT_MCAST_TX:
2231         case WIFI_STAT_RTS_SUCCESS:
2232         case WIFI_STAT_RTS_FAILURE:
2233         case WIFI_STAT_ACK_FAILURE:
2234         case WIFI_STAT_RX_FRAGS:
2235         case WIFI_STAT_MCAST_RX:
2236         case WIFI_STAT_RX_DUPS:
2237                 RAL_UNLOCK(sc);
2238                 return (ieee80211_stat(ic, stat, val));
2239         default:
2240                 RAL_UNLOCK(sc);
2241                 return (ENOTSUP);
2242         }
2243         RAL_UNLOCK(sc);
2244 
2245         return (0);
2246 }
2247 
2248 static uint_t
2249 rt2560_intr(caddr_t arg)
2250 {
2251         /* LINTED E_BAD_PTR_CAST_ALIGN */
2252         struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2253         uint32_t r;
2254 
2255         RAL_LOCK(sc);
2256 
2257         if (!RAL_IS_RUNNING(sc)) {
2258                 /*
2259                  * The hardware is not ready/present, don't touch anything.
2260                  * Note this can happen early on if the IRQ is shared.
2261                  */
2262                 RAL_UNLOCK(sc);
2263                 return (DDI_INTR_UNCLAIMED);
2264         }
2265 
2266         r = RAL_READ(sc, RT2560_CSR7);
2267         RAL_WRITE(sc, RT2560_CSR7, r);
2268 
2269         if (r == 0xffffffff) {
2270                 RAL_UNLOCK(sc);
2271                 return (DDI_INTR_UNCLAIMED);
2272         }
2273 
2274         if (!(r & RT2560_INTR_ALL)) {
2275                 RAL_UNLOCK(sc);
2276                 return (DDI_INTR_UNCLAIMED);
2277         }
2278 
2279         /* disable interrupts */
2280         RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
2281 
2282         if (r & RT2560_TX_DONE) {
2283                 RAL_UNLOCK(sc);
2284                 rt2560_tx_intr(sc);
2285                 RAL_LOCK(sc);
2286         }
2287 
2288         if (r & RT2560_PRIO_DONE) {
2289                 RAL_UNLOCK(sc);
2290                 rt2560_prio_intr(sc);
2291                 RAL_LOCK(sc);
2292         }
2293 
2294         if (r & RT2560_RX_DONE) {
2295                 sc->sc_rx_pend = 1;
2296                 ddi_trigger_softintr(sc->sc_softint_id);
2297         }
2298 
2299         /* re-enable interrupts */
2300         RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
2301         RAL_UNLOCK(sc);
2302 
2303         return (DDI_INTR_CLAIMED);
2304 }
2305 
2306 /*
2307  * quiesce(9E) entry point.
2308  *
2309  * This function is called when the system is single-threaded at high
2310  * PIL with preemption disabled. Therefore, this function must not be
2311  * blocked.
2312  *
2313  * This function returns DDI_SUCCESS on success, or DDI_FAILURE on failure.
2314  * DDI_FAILURE indicates an error condition and should almost never happen.
2315  */
2316 static int32_t
2317 rt2560_quiesce(dev_info_t *devinfo)
2318 {
2319         struct rt2560_softc *sc;
2320 
2321         sc = ddi_get_soft_state(ral_soft_state_p, ddi_get_instance(devinfo));
2322         if (sc == NULL)
2323                 return (DDI_FAILURE);
2324 
2325         /* abort Tx */
2326         RAL_WRITE(sc, RT2560_TXCSR0, RT2560_ABORT_TX);
2327 
2328         /* disable Rx */
2329         RAL_WRITE(sc, RT2560_RXCSR0, RT2560_DISABLE_RX);
2330 
2331         /* reset ASIC (imply reset BBP) */
2332         RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
2333         RAL_WRITE(sc, RT2560_CSR1, 0);
2334 
2335         /* disable interrupts */
2336         RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
2337 
2338         return (DDI_SUCCESS);
2339 }
2340 
2341 static int
2342 rt2560_attach(dev_info_t *devinfo, ddi_attach_cmd_t cmd)
2343 {
2344         struct rt2560_softc *sc;
2345         struct ieee80211com *ic;
2346         int err, i;
2347         int instance;
2348 
2349         ddi_acc_handle_t ioh;
2350         caddr_t regs;
2351         uint16_t vendor_id, device_id, command;
2352         uint8_t cachelsz;
2353         char strbuf[32];
2354 
2355         wifi_data_t wd = { 0 };
2356         mac_register_t *macp;
2357 
2358         switch (cmd) {
2359         case DDI_ATTACH:
2360                 break;
2361         case DDI_RESUME:
2362                 sc = ddi_get_soft_state(ral_soft_state_p,
2363                     ddi_get_instance(devinfo));
2364                 sc->sc_flags &= ~RAL_FLAG_SUSPENDING;
2365                 if (RAL_IS_INITED(sc))
2366                         (void) rt2560_init(sc);
2367                 return (DDI_SUCCESS);
2368         default:
2369                 return (DDI_FAILURE);
2370         }
2371 
2372         instance = ddi_get_instance(devinfo);
2373 
2374         if (ddi_soft_state_zalloc(ral_soft_state_p, instance) != DDI_SUCCESS) {
2375                 ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2376                     "unable to alloc soft_state_p\n");
2377                 return (DDI_FAILURE);
2378         }
2379 
2380         sc = ddi_get_soft_state(ral_soft_state_p, instance);
2381         ic = (ieee80211com_t *)&sc->sc_ic;
2382         sc->sc_dev = devinfo;
2383 
2384         /* pci configuration */
2385         err = ddi_regs_map_setup(devinfo, 0, &regs, 0, 0, &ral_csr_accattr,
2386             &ioh);
2387         if (err != DDI_SUCCESS) {
2388                 ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2389                     "ddi_regs_map_setup() failed");
2390                 goto fail1;
2391         }
2392 
2393         cachelsz = ddi_get8(ioh, (uint8_t *)(regs + PCI_CONF_CACHE_LINESZ));
2394         if (cachelsz == 0)
2395                 cachelsz = 0x10;
2396         sc->sc_cachelsz = cachelsz << 2;
2397 
2398         vendor_id = ddi_get16(ioh,
2399             (uint16_t *)((uintptr_t)regs + PCI_CONF_VENID));
2400         device_id = ddi_get16(ioh,
2401             (uint16_t *)((uintptr_t)regs + PCI_CONF_DEVID));
2402 
2403         ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): vendor 0x%x, "
2404             "device id 0x%x, cache size %d\n", vendor_id, device_id, cachelsz);
2405 
2406         /*
2407          * Enable response to memory space accesses,
2408          * and enabe bus master.
2409          */
2410         command = PCI_COMM_MAE | PCI_COMM_ME;
2411         ddi_put16(ioh, (uint16_t *)((uintptr_t)regs + PCI_CONF_COMM), command);
2412         ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2413             "set command reg to 0x%x \n", command);
2414 
2415         ddi_put8(ioh, (uint8_t *)(regs + PCI_CONF_LATENCY_TIMER), 0xa8);
2416         ddi_put8(ioh, (uint8_t *)(regs + PCI_CONF_ILINE), 0x10);
2417         ddi_regs_map_free(&ioh);
2418 
2419         /* pci i/o space */
2420         err = ddi_regs_map_setup(devinfo, 1,
2421             &sc->sc_rbase, 0, 0, &ral_csr_accattr, &sc->sc_ioh);
2422         ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2423             "regs map1 = %x err=%d\n", regs, err);
2424         if (err != DDI_SUCCESS) {
2425                 ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2426                     "ddi_regs_map_setup() failed");
2427                 goto fail1;
2428         }
2429 
2430         /* initialize the ral rate */
2431         ral_rate_init();
2432 
2433         /* retrieve RT2560 rev. no */
2434         sc->asic_rev = RAL_READ(sc, RT2560_CSR0);
2435 
2436         /* retrieve MAC address */
2437         rt2560_get_macaddr(sc, ic->ic_macaddr);
2438 
2439         /* retrieve RF rev. no and various other things from EEPROM */
2440         rt2560_read_eeprom(sc);
2441 
2442         ral_debug(RAL_DBG_GLD, "MAC/BBP RT2560 (rev 0x%02x), RF %s\n",
2443             sc->asic_rev, rt2560_get_rf(sc->rf_rev));
2444 
2445         /*
2446          * Allocate Tx and Rx rings.
2447          */
2448         err = rt2560_alloc_tx_ring(sc, &sc->txq, RT2560_TX_RING_COUNT);
2449         if (err != DDI_SUCCESS) {
2450                 ral_debug(RAL_DBG_GLD, "could not allocate Tx ring\n");
2451                 goto fail2;
2452         }
2453         err = rt2560_alloc_tx_ring(sc, &sc->prioq, RT2560_PRIO_RING_COUNT);
2454         if (err != DDI_SUCCESS) {
2455                 ral_debug(RAL_DBG_GLD, "could not allocate Prio ring\n");
2456                 goto fail3;
2457         }
2458         err = rt2560_alloc_rx_ring(sc, &sc->rxq, RT2560_RX_RING_COUNT);
2459         if (err != DDI_SUCCESS) {
2460                 ral_debug(RAL_DBG_GLD, "could not allocate Rx ring\n");
2461                 goto fail4;
2462         }
2463 
2464         mutex_init(&sc->sc_genlock, NULL, MUTEX_DRIVER, NULL);
2465         mutex_init(&sc->txq.tx_lock, NULL, MUTEX_DRIVER, NULL);
2466         mutex_init(&sc->prioq.tx_lock, NULL, MUTEX_DRIVER, NULL);
2467         mutex_init(&sc->rxq.rx_lock, NULL, MUTEX_DRIVER, NULL);
2468 
2469 
2470         ic->ic_phytype = IEEE80211_T_OFDM;   /* not only, but not used */
2471         ic->ic_opmode = IEEE80211_M_STA;     /* default to BSS mode */
2472         ic->ic_state = IEEE80211_S_INIT;
2473 
2474         ic->ic_maxrssi = 63;
2475         ic->ic_set_shortslot = rt2560_update_slot;
2476         ic->ic_xmit = rt2560_mgmt_send;
2477 
2478         /* set device capabilities */
2479         ic->ic_caps =
2480             IEEE80211_C_TXPMGT |        /* tx power management */
2481             IEEE80211_C_SHPREAMBLE |    /* short preamble supported */
2482             IEEE80211_C_SHSLOT;         /* short slot time supported */
2483 
2484         ic->ic_caps |= IEEE80211_C_WPA; /* Support WPA/WPA2 */
2485 
2486 #define IEEE80211_CHAN_A        \
2487         (IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_OFDM)
2488 
2489         if (sc->rf_rev == RT2560_RF_5222) {
2490                 /* set supported .11a rates */
2491                 ic->ic_sup_rates[IEEE80211_MODE_11A] = rt2560_rateset_11a;
2492 
2493                 /* set supported .11a channels */
2494                 for (i = 36; i <= 64; i += 4) {
2495                         ic->ic_sup_channels[i].ich_freq =
2496                             ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2497                         ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2498                 }
2499                 for (i = 100; i <= 140; i += 4) {
2500                         ic->ic_sup_channels[i].ich_freq =
2501                             ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2502                         ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2503                 }
2504                 for (i = 149; i <= 161; i += 4) {
2505                         ic->ic_sup_channels[i].ich_freq =
2506                             ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2507                         ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2508                 }
2509         }
2510 
2511         /* set supported .11b and .11g rates */
2512         ic->ic_sup_rates[IEEE80211_MODE_11B] = rt2560_rateset_11b;
2513         ic->ic_sup_rates[IEEE80211_MODE_11G] = rt2560_rateset_11g;
2514 
2515         /* set supported .11b and .11g channels (1 through 14) */
2516         for (i = 1; i <= 14; i++) {
2517                 ic->ic_sup_channels[i].ich_freq =
2518                     ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
2519                 ic->ic_sup_channels[i].ich_flags =
2520                     IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
2521                     IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
2522         }
2523 
2524         ieee80211_attach(ic);
2525 
2526         /* register WPA door */
2527         ieee80211_register_door(ic, ddi_driver_name(devinfo),
2528             ddi_get_instance(devinfo));
2529 
2530         ic->ic_node_alloc = rt2560_node_alloc;
2531         ic->ic_node_free = rt2560_node_free;
2532 
2533         /* override state transition machine */
2534         sc->sc_newstate = ic->ic_newstate;
2535         ic->ic_newstate = rt2560_newstate;
2536         ic->ic_watchdog = rt2560_watchdog;
2537         ieee80211_media_init(ic);
2538         ic->ic_def_txkey = 0;
2539 
2540         sc->sc_rcr = 0;
2541         sc->sc_rx_pend = 0;
2542         sc->dwelltime = 300;
2543         sc->sc_flags &= ~RAL_FLAG_RUNNING;
2544 
2545         err = ddi_add_softintr(devinfo, DDI_SOFTINT_LOW,
2546             &sc->sc_softint_id, NULL, 0, ral_softint_handler, (caddr_t)sc);
2547         if (err != DDI_SUCCESS) {
2548                 ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2549                     "ddi_add_softintr() failed");
2550                 goto fail5;
2551         }
2552 
2553         err = ddi_get_iblock_cookie(devinfo, 0, &sc->sc_iblock);
2554         if (err != DDI_SUCCESS) {
2555                 ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2556                     "Can not get iblock cookie for INT\n");
2557                 goto fail6;
2558         }
2559 
2560         err = ddi_add_intr(devinfo, 0, NULL, NULL, rt2560_intr, (caddr_t)sc);
2561         if (err != DDI_SUCCESS) {
2562                 ral_debug(RAL_DBG_GLD,
2563                     "unable to add device interrupt handler\n");
2564                 goto fail6;
2565         }
2566 
2567         /*
2568          * Provide initial settings for the WiFi plugin; whenever this
2569          * information changes, we need to call mac_plugindata_update()
2570          */
2571         wd.wd_opmode = ic->ic_opmode;
2572         wd.wd_secalloc = WIFI_SEC_NONE;
2573         IEEE80211_ADDR_COPY(wd.wd_bssid, ic->ic_bss->in_bssid);
2574 
2575         if ((macp = mac_alloc(MAC_VERSION)) == NULL) {
2576                 ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2577                     "MAC version mismatch\n");
2578                 goto fail7;
2579         }
2580 
2581         macp->m_type_ident   = MAC_PLUGIN_IDENT_WIFI;
2582         macp->m_driver               = sc;
2583         macp->m_dip          = devinfo;
2584         macp->m_src_addr     = ic->ic_macaddr;
2585         macp->m_callbacks    = &rt2560_m_callbacks;
2586         macp->m_min_sdu              = 0;
2587         macp->m_max_sdu              = IEEE80211_MTU;
2588         macp->m_pdata                = &wd;
2589         macp->m_pdata_size   = sizeof (wd);
2590 
2591         err = mac_register(macp, &ic->ic_mach);
2592         mac_free(macp);
2593         if (err != 0) {
2594                 ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2595                     "mac_register err %x\n", err);
2596                 goto fail7;
2597         }
2598 
2599         /*
2600          * Create minor node of type DDI_NT_NET_WIFI
2601          */
2602         (void) snprintf(strbuf, sizeof (strbuf), "%s%d",
2603             "ral", instance);
2604         err = ddi_create_minor_node(devinfo, strbuf, S_IFCHR,
2605             instance + 1, DDI_NT_NET_WIFI, 0);
2606 
2607         if (err != DDI_SUCCESS)
2608                 ral_debug(RAL_DBG_GLD, "ddi_create_minor_node() failed\n");
2609 
2610         /*
2611          * Notify link is down now
2612          */
2613         mac_link_update(ic->ic_mach, LINK_STATE_DOWN);
2614 
2615         return (DDI_SUCCESS);
2616 fail7:
2617         ddi_remove_intr(devinfo, 0, sc->sc_iblock);
2618 fail6:
2619         ddi_remove_softintr(sc->sc_softint_id);
2620 fail5:
2621         mutex_destroy(&sc->sc_genlock);
2622         mutex_destroy(&sc->txq.tx_lock);
2623         mutex_destroy(&sc->prioq.tx_lock);
2624         mutex_destroy(&sc->rxq.rx_lock);
2625 
2626         rt2560_free_rx_ring(sc, &sc->rxq);
2627 fail4:
2628         rt2560_free_tx_ring(sc, &sc->prioq);
2629 fail3:
2630         rt2560_free_tx_ring(sc, &sc->txq);
2631 fail2:
2632         ddi_regs_map_free(&sc->sc_ioh);
2633 fail1:
2634         ddi_soft_state_free(ral_soft_state_p, ddi_get_instance(devinfo));
2635 
2636         return (DDI_FAILURE);
2637 }
2638 
2639 static int
2640 rt2560_detach(dev_info_t *devinfo, ddi_detach_cmd_t cmd)
2641 {
2642         struct rt2560_softc *sc;
2643 
2644         sc = ddi_get_soft_state(ral_soft_state_p, ddi_get_instance(devinfo));
2645         ASSERT(sc != NULL);
2646 
2647         switch (cmd) {
2648         case DDI_DETACH:
2649                 break;
2650         case DDI_SUSPEND:
2651                 if (RAL_IS_INITED(sc))
2652                         (void) rt2560_stop(sc);
2653                 sc->sc_flags |= RAL_FLAG_SUSPENDING;
2654                 return (DDI_SUCCESS);
2655         default:
2656                 return (DDI_FAILURE);
2657         }
2658 
2659         if (mac_disable(sc->sc_ic.ic_mach) != 0)
2660                 return (DDI_FAILURE);
2661 
2662         rt2560_stop(sc);
2663 
2664         /*
2665          * Unregister from the MAC layer subsystem
2666          */
2667         (void) mac_unregister(sc->sc_ic.ic_mach);
2668 
2669         ddi_remove_intr(devinfo, 0, sc->sc_iblock);
2670         ddi_remove_softintr(sc->sc_softint_id);
2671 
2672         /*
2673          * detach ieee80211 layer
2674          */
2675         ieee80211_detach(&sc->sc_ic);
2676 
2677         rt2560_free_tx_ring(sc, &sc->txq);
2678         rt2560_free_tx_ring(sc, &sc->prioq);
2679         rt2560_free_rx_ring(sc, &sc->rxq);
2680 
2681         ddi_regs_map_free(&sc->sc_ioh);
2682 
2683         mutex_destroy(&sc->sc_genlock);
2684         mutex_destroy(&sc->txq.tx_lock);
2685         mutex_destroy(&sc->prioq.tx_lock);
2686         mutex_destroy(&sc->rxq.rx_lock);
2687 
2688         ddi_remove_minor_node(devinfo, NULL);
2689         ddi_soft_state_free(ral_soft_state_p, ddi_get_instance(devinfo));
2690 
2691         return (DDI_SUCCESS);
2692 }
2693 
2694 int
2695 _info(struct modinfo *modinfop)
2696 {
2697         return (mod_info(&modlinkage, modinfop));
2698 }
2699 
2700 int
2701 _init(void)
2702 {
2703         int status;
2704 
2705         status = ddi_soft_state_init(&ral_soft_state_p,
2706             sizeof (struct rt2560_softc), 1);
2707         if (status != 0)
2708                 return (status);
2709 
2710         mac_init_ops(&ral_dev_ops, "ral");
2711         status = mod_install(&modlinkage);
2712         if (status != 0) {
2713                 mac_fini_ops(&ral_dev_ops);
2714                 ddi_soft_state_fini(&ral_soft_state_p);
2715         }
2716         return (status);
2717 }
2718 
2719 int
2720 _fini(void)
2721 {
2722         int status;
2723 
2724         status = mod_remove(&modlinkage);
2725         if (status == 0) {
2726                 mac_fini_ops(&ral_dev_ops);
2727                 ddi_soft_state_fini(&ral_soft_state_p);
2728         }
2729         return (status);
2730 }