1 /*
   2  * Copyright 2017 Gary Mills
   3  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
   4  * Use is subject to license terms.
   5  */
   6 
   7 /*
   8  * Copyright (c) 2007, 2008
   9  *      Damien Bergamini <damien.bergamini@free.fr>
  10  *
  11  * Permission to use, copy, modify, and distribute this software for any
  12  * purpose with or without fee is hereby granted, provided that the above
  13  * copyright notice and this permission notice appear in all copies.
  14  *
  15  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  16  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  17  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  18  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  19  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  20  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  21  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  22  */
  23 
  24 /*
  25  * Ralink Technology RT2860 chipset driver
  26  * http://www.ralinktech.com/
  27  */
  28 
  29 #include <sys/types.h>
  30 #include <sys/byteorder.h>
  31 #include <sys/conf.h>
  32 #include <sys/cmn_err.h>
  33 #include <sys/stat.h>
  34 #include <sys/ddi.h>
  35 #include <sys/sunddi.h>
  36 #include <sys/strsubr.h>
  37 #include <inet/common.h>
  38 #include <sys/note.h>
  39 #include <sys/stream.h>
  40 #include <sys/strsun.h>
  41 #include <sys/modctl.h>
  42 #include <sys/devops.h>
  43 #include <sys/mac_provider.h>
  44 #include <sys/mac_wifi.h>
  45 #include <sys/net80211.h>
  46 #include <sys/net80211_proto.h>
  47 #include <sys/varargs.h>
  48 #include <sys/pci.h>
  49 #include <sys/crypto/common.h>
  50 #include <sys/crypto/api.h>
  51 #include <inet/wifi_ioctl.h>
  52 
  53 #include "rt2860_reg.h"
  54 #include "rt2860_var.h"
  55 
  56 #define RT2860_DBG_80211        (1 << 0)
  57 #define RT2860_DBG_DMA          (1 << 1)
  58 #define RT2860_DBG_EEPROM       (1 << 2)
  59 #define RT2860_DBG_FW           (1 << 3)
  60 #define RT2860_DBG_HW           (1 << 4)
  61 #define RT2860_DBG_INTR         (1 << 5)
  62 #define RT2860_DBG_RX           (1 << 6)
  63 #define RT2860_DBG_SCAN         (1 << 7)
  64 #define RT2860_DBG_TX           (1 << 8)
  65 #define RT2860_DBG_RADIO        (1 << 9)
  66 #define RT2860_DBG_RESUME       (1 << 10)
  67 #define RT2860_DBG_MSG          (1 << 11)
  68 
  69 uint32_t rt2860_dbg_flags = 0x0;
  70 
  71 #ifdef DEBUG
  72 #define RWN_DEBUG \
  73         rt2860_debug
  74 #else
  75 #define RWN_DEBUG
  76 #endif
  77 
  78 static void *rt2860_soft_state_p = NULL;
  79 static uint8_t rt2860_fw_bin [] = {
  80 #include "fw-rt2860/rt2860.ucode"
  81 };
  82 
  83 static const struct ieee80211_rateset rt2860_rateset_11b =
  84         { 4, { 2, 4, 11, 22 } };
  85 
  86 static const struct ieee80211_rateset rt2860_rateset_11g =
  87         { 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
  88 
  89 static const struct {
  90         uint32_t        reg;
  91         uint32_t        val;
  92 } rt2860_def_mac[] = {
  93         RT2860_DEF_MAC
  94 };
  95 
  96 static const struct {
  97         uint8_t reg;
  98         uint8_t val;
  99 } rt2860_def_bbp[] = {
 100         RT2860_DEF_BBP
 101 };
 102 
 103 static const struct rfprog {
 104         uint8_t         chan;
 105         uint32_t        r1, r2, r3, r4;
 106 } rt2860_rf2850[] = {
 107         RT2860_RF2850
 108 };
 109 
 110 /*
 111  * PIO access attributes for registers
 112  */
 113 static ddi_device_acc_attr_t rwn_csr_accattr = {
 114         DDI_DEVICE_ATTR_V0,
 115         DDI_STRUCTURE_LE_ACC,
 116         DDI_STRICTORDER_ACC
 117 };
 118 
 119 /*
 120  * DMA access attributes for descriptors: NOT to be byte swapped.
 121  */
 122 static ddi_device_acc_attr_t rt2860_desc_accattr = {
 123         DDI_DEVICE_ATTR_V0,
 124         DDI_STRUCTURE_LE_ACC,
 125         DDI_STRICTORDER_ACC
 126 };
 127 
 128 static ddi_device_acc_attr_t rt2860_buf_accattr = {
 129         DDI_DEVICE_ATTR_V0,
 130         DDI_NEVERSWAP_ACC,
 131         DDI_STRICTORDER_ACC,
 132         DDI_DEFAULT_ACC
 133 };
 134 
 135 /*
 136  * Describes the chip's DMA engine
 137  */
 138 static ddi_dma_attr_t rt2860_dma_attr = {
 139         DMA_ATTR_V0,                    /* dma_attr version */
 140         0x0,                            /* dma_attr_addr_lo */
 141         0xffffffffU,                    /* dma_attr_addr_hi */
 142         0xffffffffU,                    /* dma_attr_count_max */
 143         16,                             /* dma_attr_align */
 144         0x00000fff,                     /* dma_attr_burstsizes */
 145         1,                              /* dma_attr_minxfer */
 146         0xffffffffU,                    /* dma_attr_maxxfer */
 147         0xffffffffU,                    /* dma_attr_seg */
 148         1,                              /* dma_attr_sgllen */
 149         1,                              /* dma_attr_granular */
 150         0                               /* dma_attr_flags */
 151 };
 152 
 153 static uint16_t rt2860_eeprom_read(struct rt2860_softc *, uint8_t);
 154 static int      rt2860_read_eeprom(struct rt2860_softc *);
 155 const char      *rt2860_get_rf(uint8_t);
 156 static int      rt2860_alloc_dma_mem(dev_info_t *, ddi_dma_attr_t *, size_t,
 157                     ddi_device_acc_attr_t *, uint_t, uint_t, struct dma_area *);
 158 static void     rt2860_free_dma_mem(struct dma_area *);
 159 static int      rt2860_alloc_tx_ring(struct rt2860_softc *,
 160                     struct rt2860_tx_ring *);
 161 static void     rt2860_free_tx_ring(struct rt2860_softc *,
 162                     struct rt2860_tx_ring *);
 163 static int      rt2860_alloc_rx_ring(struct rt2860_softc *,
 164                     struct rt2860_rx_ring *);
 165 static void     rt2860_free_rx_ring(struct rt2860_softc *,
 166                     struct rt2860_rx_ring *);
 167 static int      rt2860_alloc_tx_pool(struct rt2860_softc *);
 168 static void     rt2860_free_tx_pool(struct rt2860_softc *);
 169 static uint16_t rt2860_txtime(int, int, uint32_t);
 170 static int      rt2860_ack_rate(struct ieee80211com *, int);
 171 static int      rt2860_send(ieee80211com_t *, mblk_t *, uint8_t);
 172 static uint8_t  rt2860_maxrssi_chain(struct rt2860_softc *,
 173                     const struct rt2860_rxwi *);
 174 static void     rt2860_drain_stats_fifo(struct rt2860_softc *);
 175 static void     rt2860_tx_intr(struct rt2860_softc *, int);
 176 static void     rt2860_rx_intr(struct rt2860_softc *);
 177 static uint_t   rt2860_softintr(caddr_t);
 178 static uint_t   rt2860_intr(caddr_t);
 179 static void     rt2860_set_region_4(struct rt2860_softc *,
 180                     uint32_t, uint32_t, int);
 181 static int      rt2860_load_microcode(struct rt2860_softc *);
 182 static void     rt2860_set_macaddr(struct rt2860_softc *, const uint8_t *);
 183 static int      rt2860_bbp_init(struct rt2860_softc *);
 184 static uint8_t  rt2860_mcu_bbp_read(struct rt2860_softc *, uint8_t);
 185 static void     rt2860_mcu_bbp_write(struct rt2860_softc *, uint8_t, uint8_t);
 186 static int      rt2860_mcu_cmd(struct rt2860_softc *, uint8_t, uint16_t);
 187 static void     rt2860_rf_write(struct rt2860_softc *, uint8_t, uint32_t);
 188 static void     rt2860_select_chan_group(struct rt2860_softc *, int);
 189 static void     rt2860_set_chan(struct rt2860_softc *,
 190                     struct ieee80211_channel *);
 191 static void     rt2860_updateprot(struct ieee80211com *);
 192 static void     rt2860_set_leds(struct rt2860_softc *, uint16_t);
 193 static void     rt2860_next_scan(void *);
 194 static void     rt2860_iter_func(void *, struct ieee80211_node *);
 195 static void     rt2860_updateslot(struct rt2860_softc *);
 196 static uint8_t  rt2860_rate2mcs(uint8_t);
 197 static void     rt2860_enable_mrr(struct rt2860_softc *);
 198 static void     rt2860_set_txpreamble(struct rt2860_softc *);
 199 static void     rt2860_set_basicrates(struct rt2860_softc *);
 200 static void     rt2860_set_bssid(struct rt2860_softc *, const uint8_t *);
 201 static void     rt2860_amrr_node_init(const struct rt2860_amrr *,
 202                     struct rt2860_amrr_node *);
 203 static void     rt2860_amrr_choose(struct rt2860_amrr *,
 204                     struct ieee80211_node *, struct rt2860_amrr_node *);
 205 static void     rt2860_newassoc(struct ieee80211com *, struct ieee80211_node *,
 206                     int);
 207 static void     rt2860_enable_tsf_sync(struct rt2860_softc *);
 208 static int      rt2860_newstate(struct ieee80211com *,
 209                     enum ieee80211_state, int);
 210 static int      rt2860_init(struct rt2860_softc *);
 211 static void     rt2860_stop(struct rt2860_softc *);
 212 static int      rt2860_quiesce(dev_info_t *t);
 213 
 214 /*
 215  * device operations
 216  */
 217 static int rt2860_attach(dev_info_t *, ddi_attach_cmd_t);
 218 static int rt2860_detach(dev_info_t *, ddi_detach_cmd_t);
 219 
 220 /*
 221  * Module Loading Data & Entry Points
 222  */
 223 DDI_DEFINE_STREAM_OPS(rwn_dev_ops, nulldev, nulldev, rt2860_attach,
 224     rt2860_detach, nodev, NULL, D_MP, NULL, rt2860_quiesce);
 225 
 226 static struct modldrv rwn_modldrv = {
 227         &mod_driverops,             /* Type of module.  This one is a driver */
 228         "Ralink RT2700/2800 driver v1.2",       /* short description */
 229         &rwn_dev_ops                /* driver specific ops */
 230 };
 231 
 232 static struct modlinkage modlinkage = {
 233         MODREV_1,
 234         (void *)&rwn_modldrv,
 235         NULL
 236 };
 237 
 238 static int      rt2860_m_stat(void *,  uint_t, uint64_t *);
 239 static int      rt2860_m_start(void *);
 240 static void     rt2860_m_stop(void *);
 241 static int      rt2860_m_promisc(void *, boolean_t);
 242 static int      rt2860_m_multicst(void *, boolean_t, const uint8_t *);
 243 static int      rt2860_m_unicst(void *, const uint8_t *);
 244 static mblk_t   *rt2860_m_tx(void *, mblk_t *);
 245 static void     rt2860_m_ioctl(void *, queue_t *, mblk_t *);
 246 static int      rt2860_m_setprop(void *arg, const char *pr_name,
 247                     mac_prop_id_t wldp_pr_num,
 248                     uint_t wldp_length, const void *wldp_buf);
 249 static void     rt2860_m_propinfo(void *arg, const char *pr_name,
 250                     mac_prop_id_t wldp_pr_num, mac_prop_info_handle_t prh);
 251 static int      rt2860_m_getprop(void *arg, const char *pr_name,
 252                     mac_prop_id_t wldp_pr_num, uint_t wldp_length,
 253                     void *wldp_buf);
 254 
 255 static mac_callbacks_t rt2860_m_callbacks = {
 256         MC_IOCTL | MC_SETPROP | MC_GETPROP | MC_PROPINFO,
 257         rt2860_m_stat,
 258         rt2860_m_start,
 259         rt2860_m_stop,
 260         rt2860_m_promisc,
 261         rt2860_m_multicst,
 262         rt2860_m_unicst,
 263         rt2860_m_tx,
 264         NULL,
 265         rt2860_m_ioctl,
 266         NULL,
 267         NULL,
 268         NULL,
 269         rt2860_m_setprop,
 270         rt2860_m_getprop,
 271         rt2860_m_propinfo
 272 };
 273 
 274 #ifdef DEBUG
 275 void
 276 rt2860_debug(uint32_t dbg_flags, const int8_t *fmt, ...)
 277 {
 278         va_list args;
 279 
 280         if (dbg_flags & rt2860_dbg_flags) {
 281                 va_start(args, fmt);
 282                 vcmn_err(CE_CONT, fmt, args);
 283                 va_end(args);
 284         }
 285 }
 286 #endif
 287 
 288 const char *
 289 rt2860_get_rf(uint8_t rev)
 290 {
 291         switch (rev) {
 292         case RT2860_RF_2820:    return "RT2820";
 293         case RT2860_RF_2850:    return "RT2850";
 294         case RT2860_RF_2720:    return "RT2720";
 295         case RT2860_RF_2750:    return "RT2750";
 296         default:                return "unknown";
 297         }
 298 }
 299 
 300 /*
 301  * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46,
 302  * 93C66 or 93C86).
 303  */
 304 static uint16_t
 305 rt2860_eeprom_read(struct rt2860_softc *sc, uint8_t addr)
 306 {
 307         int             n;
 308         uint16_t        val;
 309         uint32_t        tmp;
 310 
 311         /* clock C once before the first command */
 312         RT2860_EEPROM_CTL(sc, 0);
 313 
 314         RT2860_EEPROM_CTL(sc, RT2860_S);
 315         RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_C);
 316         RT2860_EEPROM_CTL(sc, RT2860_S);
 317 
 318         /* write start bit (1) */
 319         RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_D);
 320         RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_D | RT2860_C);
 321 
 322         /* write READ opcode (10) */
 323         RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_D);
 324         RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_D | RT2860_C);
 325         RT2860_EEPROM_CTL(sc, RT2860_S);
 326         RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_C);
 327 
 328         /* write address (A5-A0 or A7-A0) */
 329         n = ((RT2860_READ(sc, RT2860_PCI_EECTRL) & 0x30) == 0) ? 5 : 7;
 330         for (; n >= 0; n--) {
 331                 RT2860_EEPROM_CTL(sc, RT2860_S |
 332                     (((addr >> n) & 1) << RT2860_SHIFT_D));
 333                 RT2860_EEPROM_CTL(sc, RT2860_S |
 334                     (((addr >> n) & 1) << RT2860_SHIFT_D) | RT2860_C);
 335         }
 336 
 337         RT2860_EEPROM_CTL(sc, RT2860_S);
 338 
 339         /* read data Q15-Q0 */
 340         val = 0;
 341         for (n = 15; n >= 0; n--) {
 342                 RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_C);
 343                 tmp = RT2860_READ(sc, RT2860_PCI_EECTRL);
 344                 val |= ((tmp & RT2860_Q) >> RT2860_SHIFT_Q) << n;
 345                 RT2860_EEPROM_CTL(sc, RT2860_S);
 346         }
 347 
 348         RT2860_EEPROM_CTL(sc, 0);
 349 
 350         /* clear Chip Select and clock C */
 351         RT2860_EEPROM_CTL(sc, RT2860_S);
 352         RT2860_EEPROM_CTL(sc, 0);
 353         RT2860_EEPROM_CTL(sc, RT2860_C);
 354 
 355         return (val);
 356 }
 357 
 358 /*
 359  * Add `delta' (signed) to each 4-bit sub-word of a 32-bit word.
 360  * Used to adjust per-rate Tx power registers.
 361  */
 362 static inline uint32_t
 363 b4inc(uint32_t b32, int8_t delta)
 364 {
 365         int8_t i, b4;
 366 
 367         for (i = 0; i < 8; i++) {
 368                 b4 = b32 & 0xf;
 369                 b4 += delta;
 370                 if (b4 < 0)
 371                         b4 = 0;
 372                 else if (b4 > 0xf)
 373                         b4 = 0xf;
 374                 b32 = b32 >> 4 | b4 << 28;
 375         }
 376         return (b32);
 377 }
 378 
 379 static int
 380 rt2860_read_eeprom(struct rt2860_softc *sc)
 381 {
 382         struct ieee80211com     *ic = &sc->sc_ic;
 383         int                     ridx, ant, i;
 384         int8_t                  delta_2ghz, delta_5ghz;
 385         uint16_t                val;
 386 
 387         /* read EEPROM version */
 388         val = rt2860_eeprom_read(sc, RT2860_EEPROM_VERSION);
 389         RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
 390             "EEPROM rev=%d, FAE=%d\n",
 391             val & 0xff, val >> 8);
 392 
 393         /* read MAC address */
 394         val = rt2860_eeprom_read(sc, RT2860_EEPROM_MAC01);
 395         ic->ic_macaddr[0] = val & 0xff;
 396         ic->ic_macaddr[1] = val >> 8;
 397         val = rt2860_eeprom_read(sc, RT2860_EEPROM_MAC23);
 398         ic->ic_macaddr[2] = val & 0xff;
 399         ic->ic_macaddr[3] = val >> 8;
 400         val = rt2860_eeprom_read(sc, RT2860_EEPROM_MAC45);
 401         ic->ic_macaddr[4] = val & 0xff;
 402         ic->ic_macaddr[5] = val >> 8;
 403         RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
 404             "MAC address is: %x:%x:%x:%x:%x:%x\n",
 405             ic->ic_macaddr[0], ic->ic_macaddr[1],
 406             ic->ic_macaddr[2], ic->ic_macaddr[3],
 407             ic->ic_macaddr[4], ic->ic_macaddr[5]);
 408 
 409         /* read country code */
 410         val = rt2860_eeprom_read(sc, RT2860_EEPROM_COUNTRY);
 411         RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
 412             "EEPROM region code=0x%04x\n", val);
 413 
 414         /* read default BBP settings */
 415         for (i = 0; i < 8; i++) {
 416                 val = rt2860_eeprom_read(sc, RT2860_EEPROM_BBP_BASE + i);
 417                 sc->bbp[i].val = val & 0xff;
 418                 sc->bbp[i].reg = val >> 8;
 419                 RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
 420                     "BBP%d=0x%02x\n",
 421                     sc->bbp[i].reg, sc->bbp[i].val);
 422         }
 423 
 424         /* read RF frequency offset from EEPROM */
 425         val = rt2860_eeprom_read(sc, RT2860_EEPROM_FREQ_LEDS);
 426         sc->freq = ((val & 0xff) != 0xff) ? val & 0xff : 0;
 427         RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
 428             "EEPROM freq offset %d\n", sc->freq & 0xff);
 429 
 430         if ((sc->leds = val >> 8) != 0xff) {
 431                 /* read LEDs operating mode */
 432                 sc->led[0] = rt2860_eeprom_read(sc, RT2860_EEPROM_LED1);
 433                 sc->led[1] = rt2860_eeprom_read(sc, RT2860_EEPROM_LED2);
 434                 sc->led[2] = rt2860_eeprom_read(sc, RT2860_EEPROM_LED3);
 435         } else {
 436                 /* broken EEPROM, use default settings */
 437                 sc->leds = 0x01;
 438                 sc->led[0] = 0x5555;
 439                 sc->led[1] = 0x2221;
 440                 sc->led[2] = 0xa9f8;
 441         }
 442         RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
 443             "EEPROM LED mode=0x%02x, LEDs=0x%04x/0x%04x/0x%04x\n",
 444             sc->leds, sc->led[0], sc->led[1], sc->led[2]);
 445 
 446         /* read RF information */
 447         val = rt2860_eeprom_read(sc, RT2860_EEPROM_ANTENNA);
 448         if (val == 0xffff) {
 449                 /* broken EEPROM, default to RF2820 1T2R */
 450                 RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
 451                     "invalid EEPROM antenna info, using default\n");
 452                 sc->rf_rev = RT2860_RF_2820;
 453                 sc->ntxchains = 1;
 454                 sc->nrxchains = 2;
 455         } else {
 456                 sc->rf_rev = (val >> 8) & 0xf;
 457                 sc->ntxchains = (val >> 4) & 0xf;
 458                 sc->nrxchains = val & 0xf;
 459         }
 460         RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
 461             "EEPROM RF rev=0x%02x chains=%dT%dR\n",
 462             sc->rf_rev, sc->ntxchains, sc->nrxchains);
 463 
 464         /* check if RF supports automatic Tx access gain control */
 465         val = rt2860_eeprom_read(sc, RT2860_EEPROM_CONFIG);
 466         RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
 467             "EEPROM CFG 0x%04x\n", val);
 468         if ((val & 0xff) != 0xff)
 469                 sc->calib_2ghz = sc->calib_5ghz = 0; /* XXX (val >> 1) & 1 */;
 470 
 471         if (sc->sc_flags & RT2860_ADVANCED_PS) {
 472                 /* read PCIe power save level */
 473                 val = rt2860_eeprom_read(sc, RT2860_EEPROM_PCIE_PSLEVEL);
 474                 if ((val & 0xff) != 0xff) {
 475                         sc->pslevel = val & 0x3;
 476                         val = rt2860_eeprom_read(sc, RT2860_EEPROM_REV);
 477                         if (val >> 8 != 0x92 || !(val & 0x80))
 478                                 sc->pslevel = MIN(sc->pslevel, 1);
 479                         RWN_DEBUG(RT2860_DBG_EEPROM,
 480                             "rwn: rt2860_read_eeprom(): "
 481                             "EEPROM PCIe PS Level=%d\n",
 482                             sc->pslevel);
 483                 }
 484         }
 485         /* read power settings for 2GHz channels */
 486         for (i = 0; i < 14; i += 2) {
 487                 val = rt2860_eeprom_read(sc,
 488                     RT2860_EEPROM_PWR2GHZ_BASE1 + i / 2);
 489                 sc->txpow1[i + 0] = (int8_t)(val & 0xff);
 490                 sc->txpow1[i + 1] = (int8_t)(val >> 8);
 491 
 492                 val = rt2860_eeprom_read(sc,
 493                     RT2860_EEPROM_PWR2GHZ_BASE2 + i / 2);
 494                 sc->txpow2[i + 0] = (int8_t)(val & 0xff);
 495                 sc->txpow2[i + 1] = (int8_t)(val >> 8);
 496         }
 497         /* fix broken Tx power entries */
 498         for (i = 0; i < 14; i++) {
 499                 if (sc->txpow1[i] < 0 || sc->txpow1[i] > 31)
 500                         sc->txpow1[i] = 5;
 501                 if (sc->txpow2[i] < 0 || sc->txpow2[i] > 31)
 502                         sc->txpow2[i] = 5;
 503                 RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
 504                     "chan %d: power1=%d, power2=%d\n",
 505                     rt2860_rf2850[i].chan, sc->txpow1[i], sc->txpow2[i]);
 506         }
 507         /* read power settings for 5GHz channels */
 508         for (i = 0; i < 36; i += 2) {
 509                 val = rt2860_eeprom_read(sc,
 510                     RT2860_EEPROM_PWR5GHZ_BASE1 + i / 2);
 511                 sc->txpow1[i + 14] = (int8_t)(val & 0xff);
 512                 sc->txpow1[i + 15] = (int8_t)(val >> 8);
 513 
 514                 val = rt2860_eeprom_read(sc,
 515                     RT2860_EEPROM_PWR5GHZ_BASE2 + i / 2);
 516                 sc->txpow2[i + 14] = (int8_t)(val & 0xff);
 517                 sc->txpow2[i + 15] = (int8_t)(val >> 8);
 518         }
 519         /* fix broken Tx power entries */
 520         for (i = 0; i < 35; i++) {
 521                 if (sc->txpow1[14 + i] < -7 || sc->txpow1[14 + i] > 15)
 522                         sc->txpow1[14 + i] = 5;
 523                 if (sc->txpow2[14 + i] < -7 || sc->txpow2[14 + i] > 15)
 524                         sc->txpow2[14 + i] = 5;
 525                 RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
 526                     "chan %d: power1=%d, power2=%d\n",
 527                     rt2860_rf2850[14 + i].chan, sc->txpow1[14 + i],
 528                     sc->txpow2[14 + i]);
 529         }
 530 
 531         /* read Tx power compensation for each Tx rate */
 532         val = rt2860_eeprom_read(sc, RT2860_EEPROM_DELTAPWR);
 533         delta_2ghz = delta_5ghz = 0;
 534         if ((val & 0xff) != 0xff && (val & 0x80)) {
 535                 delta_2ghz = val & 0xf;
 536                 if (!(val & 0x40))  /* negative number */
 537                         delta_2ghz = -delta_2ghz;
 538         }
 539         val >>= 8;
 540         if ((val & 0xff) != 0xff && (val & 0x80)) {
 541                 delta_5ghz = val & 0xf;
 542                 if (!(val & 0x40))  /* negative number */
 543                         delta_5ghz = -delta_5ghz;
 544         }
 545         RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
 546             "power compensation=%d (2GHz), %d (5GHz) \n",
 547             delta_2ghz, delta_5ghz);
 548 
 549         for (ridx = 0; ridx < 5; ridx++) {
 550                 uint32_t        reg;
 551 
 552                 val = rt2860_eeprom_read(sc, RT2860_EEPROM_RPWR + ridx);
 553                 reg = (uint32_t)val << 16;
 554                 val = rt2860_eeprom_read(sc, RT2860_EEPROM_RPWR + ridx + 1);
 555                 reg |= val;
 556 
 557                 sc->txpow20mhz[ridx] = reg;
 558                 sc->txpow40mhz_2ghz[ridx] = b4inc(reg, delta_2ghz);
 559                 sc->txpow40mhz_5ghz[ridx] = b4inc(reg, delta_5ghz);
 560 
 561                 RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
 562                     "ridx %d: power 20MHz=0x%08x, 40MHz/2GHz=0x%08x, "
 563                     "40MHz/5GHz=0x%08x\n", ridx, sc->txpow20mhz[ridx],
 564                     sc->txpow40mhz_2ghz[ridx], sc->txpow40mhz_5ghz[ridx]);
 565         }
 566 
 567         /* read factory-calibrated samples for temperature compensation */
 568         val = rt2860_eeprom_read(sc, RT2860_EEPROM_TSSI1_2GHZ);
 569         sc->tssi_2ghz[0] = val & 0xff;   /* [-4] */
 570         sc->tssi_2ghz[1] = val >> 8;   /* [-3] */
 571         val = rt2860_eeprom_read(sc, RT2860_EEPROM_TSSI2_2GHZ);
 572         sc->tssi_2ghz[2] = val & 0xff;   /* [-2] */
 573         sc->tssi_2ghz[3] = val >> 8;   /* [-1] */
 574         val = rt2860_eeprom_read(sc, RT2860_EEPROM_TSSI3_2GHZ);
 575         sc->tssi_2ghz[4] = val & 0xff;   /* [+0] */
 576         sc->tssi_2ghz[5] = val >> 8;   /* [+1] */
 577         val = rt2860_eeprom_read(sc, RT2860_EEPROM_TSSI4_2GHZ);
 578         sc->tssi_2ghz[6] = val & 0xff;   /* [+2] */
 579         sc->tssi_2ghz[7] = val >> 8;   /* [+3] */
 580         val = rt2860_eeprom_read(sc, RT2860_EEPROM_TSSI5_2GHZ);
 581         sc->tssi_2ghz[8] = val & 0xff;   /* [+4] */
 582         sc->step_2ghz = val >> 8;
 583         RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
 584             "TSSI 2GHz: 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x "
 585             "0x%02x 0x%02x step=%d\n", sc->tssi_2ghz[0], sc->tssi_2ghz[1],
 586             sc->tssi_2ghz[2], sc->tssi_2ghz[3], sc->tssi_2ghz[4],
 587             sc->tssi_2ghz[5], sc->tssi_2ghz[6], sc->tssi_2ghz[7],
 588             sc->tssi_2ghz[8], sc->step_2ghz);
 589         /* check that ref value is correct, otherwise disable calibration */
 590         if (sc->tssi_2ghz[4] == 0xff)
 591                 sc->calib_2ghz = 0;
 592 
 593         val = rt2860_eeprom_read(sc, RT2860_EEPROM_TSSI1_5GHZ);
 594         sc->tssi_5ghz[0] = val & 0xff;   /* [-4] */
 595         sc->tssi_5ghz[1] = val >> 8;   /* [-3] */
 596         val = rt2860_eeprom_read(sc, RT2860_EEPROM_TSSI2_5GHZ);
 597         sc->tssi_5ghz[2] = val & 0xff;   /* [-2] */
 598         sc->tssi_5ghz[3] = val >> 8;   /* [-1] */
 599         val = rt2860_eeprom_read(sc, RT2860_EEPROM_TSSI3_5GHZ);
 600         sc->tssi_5ghz[4] = val & 0xff;   /* [+0] */
 601         sc->tssi_5ghz[5] = val >> 8;   /* [+1] */
 602         val = rt2860_eeprom_read(sc, RT2860_EEPROM_TSSI4_5GHZ);
 603         sc->tssi_5ghz[6] = val & 0xff;   /* [+2] */
 604         sc->tssi_5ghz[7] = val >> 8;   /* [+3] */
 605         val = rt2860_eeprom_read(sc, RT2860_EEPROM_TSSI5_5GHZ);
 606         sc->tssi_5ghz[8] = val & 0xff;   /* [+4] */
 607         sc->step_5ghz = val >> 8;
 608         RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
 609             "TSSI 5GHz: 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x "
 610             "0x%02x 0x%02x step=%d\n", sc->tssi_5ghz[0], sc->tssi_5ghz[1],
 611             sc->tssi_5ghz[2], sc->tssi_5ghz[3], sc->tssi_5ghz[4],
 612             sc->tssi_5ghz[5], sc->tssi_5ghz[6], sc->tssi_5ghz[7],
 613             sc->tssi_5ghz[8], sc->step_5ghz);
 614         /* check that ref value is correct, otherwise disable calibration */
 615         if (sc->tssi_5ghz[4] == 0xff)
 616                 sc->calib_5ghz = 0;
 617 
 618         /* read RSSI offsets and LNA gains from EEPROM */
 619         val = rt2860_eeprom_read(sc, RT2860_EEPROM_RSSI1_2GHZ);
 620         sc->rssi_2ghz[0] = val & 0xff;   /* Ant A */
 621         sc->rssi_2ghz[1] = val >> 8;   /* Ant B */
 622         val = rt2860_eeprom_read(sc, RT2860_EEPROM_RSSI2_2GHZ);
 623         sc->rssi_2ghz[2] = val & 0xff;   /* Ant C */
 624         sc->lna[2] = val >> 8;         /* channel group 2 */
 625 
 626         val = rt2860_eeprom_read(sc, RT2860_EEPROM_RSSI1_5GHZ);
 627         sc->rssi_5ghz[0] = val & 0xff;   /* Ant A */
 628         sc->rssi_5ghz[1] = val >> 8;   /* Ant B */
 629         val = rt2860_eeprom_read(sc, RT2860_EEPROM_RSSI2_5GHZ);
 630         sc->rssi_5ghz[2] = val & 0xff;   /* Ant C */
 631         sc->lna[3] = val >> 8;         /* channel group 3 */
 632 
 633         val = rt2860_eeprom_read(sc, RT2860_EEPROM_LNA);
 634         sc->lna[0] = val & 0xff; /* channel group 0 */
 635         sc->lna[1] = val >> 8;         /* channel group 1 */
 636 
 637         /* fix broken 5GHz LNA entries */
 638         if (sc->lna[2] == 0 || sc->lna[2] == 0xff) {
 639                 RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
 640                     "invalid LNA for channel group %d\n", 2);
 641                 sc->lna[2] = sc->lna[1];
 642         }
 643         if (sc->lna[3] == 0 || sc->lna[3] == 0xff) {
 644                 RWN_DEBUG(RT2860_DBG_EEPROM, "rwn: rt2860_read_eeprom(): "
 645                     "invalid LNA for channel group %d\n", 3);
 646                 sc->lna[3] = sc->lna[1];
 647         }
 648 
 649         /* fix broken RSSI offset entries */
 650         for (ant = 0; ant < 3; ant++) {
 651                 if (sc->rssi_2ghz[ant] < -10 || sc->rssi_2ghz[ant] > 10) {
 652                         RWN_DEBUG(RT2860_DBG_EEPROM,
 653                             "rwn: rt2860_read_eeprom(): "
 654                             "invalid RSSI%d offset: %d (2GHz)\n",
 655                             ant + 1, sc->rssi_2ghz[ant]);
 656                         sc->rssi_2ghz[ant] = 0;
 657                 }
 658                 if (sc->rssi_5ghz[ant] < -10 || sc->rssi_5ghz[ant] > 10) {
 659                         RWN_DEBUG(RT2860_DBG_EEPROM,
 660                             "rwn: rt2860_read_eeprom(): "
 661                             "invalid RSSI%d offset: %d (2GHz)\n",
 662                             ant + 1, sc->rssi_5ghz[ant]);
 663                         sc->rssi_5ghz[ant] = 0;
 664                 }
 665         }
 666 
 667         return (RT2860_SUCCESS);
 668 }
 669 
 670 /*
 671  * Allocate an DMA memory and a DMA handle for accessing it
 672  */
 673 static int
 674 rt2860_alloc_dma_mem(dev_info_t *devinfo, ddi_dma_attr_t *dma_attr,
 675         size_t memsize, ddi_device_acc_attr_t *attr_p, uint_t alloc_flags,
 676         uint_t bind_flags, struct dma_area *dma_p)
 677 {
 678         int     err;
 679 
 680         /*
 681          * Allocate handle
 682          */
 683         err = ddi_dma_alloc_handle(devinfo, dma_attr,
 684             DDI_DMA_SLEEP, NULL, &dma_p->dma_hdl);
 685         if (err != DDI_SUCCESS) {
 686                 RWN_DEBUG(RT2860_DBG_DMA, "rwn: rwn_allo_dma_mem(): "
 687                     "failed to alloc handle\n");
 688                 goto fail1;
 689         }
 690 
 691         /*
 692          * Allocate memory
 693          */
 694         err = ddi_dma_mem_alloc(dma_p->dma_hdl, memsize, attr_p,
 695             alloc_flags, DDI_DMA_SLEEP, NULL, &dma_p->mem_va,
 696             &dma_p->alength, &dma_p->acc_hdl);
 697         if (err != DDI_SUCCESS) {
 698                 RWN_DEBUG(RT2860_DBG_DMA, "rwn: rwn_alloc_dma_mem(): "
 699                     "failed to alloc mem\n");
 700                 goto fail2;
 701         }
 702 
 703         /*
 704          * Bind the two together
 705          */
 706         err = ddi_dma_addr_bind_handle(dma_p->dma_hdl, NULL,
 707             dma_p->mem_va, dma_p->alength, bind_flags,
 708             DDI_DMA_SLEEP, NULL, &dma_p->cookie, &dma_p->ncookies);
 709         if (err != DDI_DMA_MAPPED) {
 710                 RWN_DEBUG(RT2860_DBG_DMA, "rwn: rwn_alloc_dma_mem(): "
 711                     "failed to bind handle\n");
 712                 goto fail3;
 713         }
 714 
 715         if (dma_p->ncookies != 1) {
 716                 RWN_DEBUG(RT2860_DBG_DMA, "rwn: rwn_alloc_dma_mem(): "
 717                     "failed to alloc cookies\n");
 718                 goto fail4;
 719         }
 720 
 721         dma_p->nslots = ~0U;
 722         dma_p->size = ~0U;
 723         dma_p->token = ~0U;
 724         dma_p->offset = 0;
 725         return (DDI_SUCCESS);
 726 
 727 fail4:
 728         (void) ddi_dma_unbind_handle(dma_p->dma_hdl);
 729 fail3:
 730         ddi_dma_mem_free(&dma_p->acc_hdl);
 731 fail2:
 732         ddi_dma_free_handle(&dma_p->dma_hdl);
 733 fail1:
 734         return (err);
 735 }
 736 
 737 static void
 738 rt2860_free_dma_mem(struct dma_area *dma_p)
 739 {
 740         if (dma_p->dma_hdl != NULL) {
 741                 (void) ddi_dma_unbind_handle(dma_p->dma_hdl);
 742                 if (dma_p->acc_hdl != NULL) {
 743                         ddi_dma_mem_free(&dma_p->acc_hdl);
 744                         dma_p->acc_hdl = NULL;
 745                 }
 746                 ddi_dma_free_handle(&dma_p->dma_hdl);
 747                 dma_p->ncookies = 0;
 748                 dma_p->dma_hdl = NULL;
 749         }
 750 }
 751 
 752 /*ARGSUSED*/
 753 static int
 754 rt2860_alloc_tx_ring(struct rt2860_softc *sc, struct rt2860_tx_ring *ring)
 755 {
 756         int     size, err;
 757 
 758         size = RT2860_TX_RING_COUNT * sizeof (struct rt2860_txd);
 759 
 760         err = rt2860_alloc_dma_mem(sc->sc_dev, &rt2860_dma_attr, size,
 761             &rt2860_desc_accattr, DDI_DMA_CONSISTENT,
 762             DDI_DMA_RDWR | DDI_DMA_CONSISTENT,
 763             &ring->txdesc_dma);
 764         if (err != DDI_SUCCESS) {
 765                 RWN_DEBUG(RT2860_DBG_DMA, "rwn: rt2860_alloc_tx_ring(): "
 766                     "failed to alloc dma mem\n");
 767                 goto fail1;
 768         }
 769 
 770         ring->txd = (struct rt2860_txd *)ring->txdesc_dma.mem_va;
 771         ring->paddr = ring->txdesc_dma.cookie.dmac_address;
 772 
 773         ring->cur = 0;
 774         ring->next = 0;
 775         ring->queued = 0;
 776 
 777         (void) bzero(ring->txd, size);
 778         RT2860_DMA_SYNC(ring->txdesc_dma, DDI_DMA_SYNC_FORDEV);
 779         return (DDI_SUCCESS);
 780 fail1:
 781         return (err);
 782 }
 783 
 784 void
 785 rt2860_reset_tx_ring(struct rt2860_softc *sc, struct rt2860_tx_ring *ring)
 786 {
 787         struct rt2860_tx_data *data;
 788         int i;
 789 
 790         for (i = 0; i < RT2860_TX_RING_COUNT; i++) {
 791                 ring->txd[i].sdl0 &= ~LE_16(RT2860_TX_DDONE);
 792 
 793                 if ((data = ring->data[i]) == NULL)
 794                         continue;       /* nothing mapped in this slot */
 795 
 796                 /* by pass if it's quiesced */
 797                 if (!(sc->sc_flags & RT2860_F_QUIESCE))
 798                         RT2860_DMA_SYNC(data->txbuf_dma, DDI_DMA_SYNC_FORDEV);
 799 
 800                 if (data->ni != NULL) {
 801                         ieee80211_free_node(data->ni);
 802                         data->ni = NULL;     /* node already freed */
 803                 }
 804 
 805                 SLIST_INSERT_HEAD(&sc->data_pool, data, next);
 806                 ring->data[i] = NULL;
 807         }
 808 
 809         /* by pass if it's quiesced */
 810         if (!(sc->sc_flags & RT2860_F_QUIESCE))
 811                 RT2860_DMA_SYNC(ring->txdesc_dma, DDI_DMA_SYNC_FORDEV);
 812 
 813         ring->queued = 0;
 814         ring->cur = ring->next = 0;
 815 }
 816 
 817 /*ARGSUSED*/
 818 static void
 819 rt2860_free_tx_ring(struct rt2860_softc *sc, struct rt2860_tx_ring *ring)
 820 {
 821         if (ring->txd != NULL) {
 822                 rt2860_free_dma_mem(&ring->txdesc_dma);
 823         }
 824 }
 825 
 826 static int
 827 rt2860_alloc_rx_ring(struct rt2860_softc *sc, struct rt2860_rx_ring *ring)
 828 {
 829         struct rt2860_rx_data   *data;
 830         struct rt2860_rxd       *rxd;
 831         int                     i, err, size, datalen;
 832 
 833         size = RT2860_RX_RING_COUNT * sizeof (struct rt2860_rxd);
 834 
 835         err = rt2860_alloc_dma_mem(sc->sc_dev, &rt2860_dma_attr, size,
 836             &rt2860_desc_accattr, DDI_DMA_CONSISTENT,
 837             DDI_DMA_RDWR | DDI_DMA_CONSISTENT,
 838             &ring->rxdesc_dma);
 839         if (err != DDI_SUCCESS) {
 840                 RWN_DEBUG(RT2860_DBG_DMA, "rwn: rt2860_alloc_rx_ring(): "
 841                     "failed to alloc dma mem\n");
 842                 goto fail1;
 843         }
 844 
 845         ring->rxd = (struct rt2860_rxd *)ring->rxdesc_dma.mem_va;
 846         ring->paddr = ring->rxdesc_dma.cookie.dmac_address;
 847         bzero(ring->rxd, size);
 848 
 849         /*
 850          * Pre-allocate Rx buffers and populate Rx ring.
 851          */
 852         datalen = RT2860_RX_RING_COUNT * sizeof (struct rt2860_rx_data);
 853         bzero(ring->data, datalen);
 854         for (i = 0; i < RT2860_RX_RING_COUNT; i++) {
 855                 rxd = &ring->rxd[i];
 856                 data = &ring->data[i];
 857                 /* alloc DMA memory */
 858                 (void) rt2860_alloc_dma_mem(sc->sc_dev, &rt2860_dma_attr,
 859                     sc->sc_dmabuf_size,
 860                     &rt2860_buf_accattr,
 861                     DDI_DMA_STREAMING,
 862                     DDI_DMA_READ | DDI_DMA_STREAMING,
 863                     &data->rxbuf_dma);
 864                 rxd->sdp0 = LE_32(data->rxbuf_dma.cookie.dmac_address);
 865                 rxd->sdl0 = LE_16(sc->sc_dmabuf_size);
 866         }
 867 
 868         ring->cur = 0;
 869 
 870         RT2860_DMA_SYNC(ring->rxdesc_dma, DDI_DMA_SYNC_FORDEV);
 871         return (DDI_SUCCESS);
 872 fail2:
 873         rt2860_free_dma_mem(&ring->rxdesc_dma);
 874 fail1:
 875         return (err);
 876 }
 877 
 878 /*ARGSUSED*/
 879 void
 880 rt2860_reset_rx_ring(struct rt2860_softc *sc, struct rt2860_rx_ring *ring)
 881 {
 882         int i;
 883 
 884         for (i = 0; i < RT2860_RX_RING_COUNT; i++)
 885                 ring->rxd[i].sdl0 &= ~LE_16(RT2860_RX_DDONE);
 886 
 887         RT2860_DMA_SYNC(ring->rxdesc_dma, DDI_DMA_SYNC_FORDEV);
 888 
 889         ring->cur = 0;
 890 }
 891 
 892 /*ARGSUSED*/
 893 static void
 894 rt2860_free_rx_ring(struct rt2860_softc *sc, struct rt2860_rx_ring *ring)
 895 {
 896         struct rt2860_rx_data   *data;
 897         int                     i, count;
 898 
 899         if (ring->rxd != NULL)
 900                 rt2860_free_dma_mem(&ring->rxdesc_dma);
 901 
 902         count = RT2860_RX_RING_COUNT;
 903         if (ring->data != NULL) {
 904                 for (i = 0; i < count; i++) {
 905                         data = &ring->data[i];
 906                         rt2860_free_dma_mem(&data->rxbuf_dma);
 907                 }
 908         }
 909 }
 910 
 911 static int
 912 rt2860_alloc_tx_pool(struct rt2860_softc *sc)
 913 {
 914         struct rt2860_tx_data   *data;
 915         int                     i, err, size;
 916 
 917         size = RT2860_TX_POOL_COUNT * sizeof (struct rt2860_txwi);
 918 
 919         /* init data_pool early in case of failure.. */
 920         SLIST_INIT(&sc->data_pool);
 921 
 922         err = rt2860_alloc_dma_mem(sc->sc_dev, &rt2860_dma_attr, size,
 923             &rt2860_desc_accattr, DDI_DMA_CONSISTENT,
 924             DDI_DMA_RDWR | DDI_DMA_CONSISTENT,
 925             &sc->txpool_dma);
 926         if (err != DDI_SUCCESS) {
 927                 RWN_DEBUG(RT2860_DBG_DMA, "rwn: rt2860_alloc_tx_pool(): "
 928                     "failed to alloc dma mem\n");
 929                 goto fail1;
 930         }
 931 
 932         sc->txwi = (struct rt2860_txwi *)sc->txpool_dma.mem_va;
 933         (void) bzero(sc->txwi, size);
 934         RT2860_DMA_SYNC(sc->txpool_dma, DDI_DMA_SYNC_FORDEV);
 935 
 936         for (i = 0; i < RT2860_TX_POOL_COUNT; i++) {
 937                 data = &sc->data[i];
 938 
 939                 err = rt2860_alloc_dma_mem(sc->sc_dev, &rt2860_dma_attr,
 940                     sc->sc_dmabuf_size,
 941                     &rt2860_buf_accattr, DDI_DMA_CONSISTENT,
 942                     DDI_DMA_RDWR | DDI_DMA_CONSISTENT,
 943                     &data->txbuf_dma);
 944                 if (err != DDI_SUCCESS) {
 945                         RWN_DEBUG(RT2860_DBG_DMA,
 946                             "rwn: rt2860_alloc_tx_pool(): "
 947                             "failed to alloc dma mem\n");
 948                         goto fail2;
 949                 }
 950                 data->txwi = &sc->txwi[i];
 951                 data->paddr = sc->txpool_dma.cookie.dmac_address +
 952                     i * sizeof (struct rt2860_txwi);
 953 
 954                 SLIST_INSERT_HEAD(&sc->data_pool, data, next);
 955         }
 956         return (DDI_SUCCESS);
 957 fail2:
 958         rt2860_free_dma_mem(&sc->txpool_dma);
 959 fail1:
 960         return (err);
 961 }
 962 
 963 static void
 964 rt2860_free_tx_pool(struct rt2860_softc *sc)
 965 {
 966         struct rt2860_tx_data   *data;
 967         int     i;
 968 
 969         if (sc->txwi != NULL) {
 970                 rt2860_free_dma_mem(&sc->txpool_dma);
 971         }
 972 
 973         for (i = 0; i < RT2860_TX_POOL_COUNT; i++) {
 974                 data = &sc->data[i];
 975                 rt2860_free_dma_mem(&data->txbuf_dma);
 976         }
 977 }
 978 
 979 /* quickly determine if a given rate is CCK or OFDM */
 980 #define RT2860_RATE_IS_OFDM(rate) ((rate) >= 12 && (rate) != 22)
 981 
 982 #define RT2860_ACK_SIZE         14      /* 10 + 4(FCS) */
 983 #define RT2860_SIFS_TIME        10
 984 
 985 static uint8_t
 986 rt2860_rate2mcs(uint8_t rate)
 987 {
 988         switch (rate) {
 989         /* CCK rates */
 990         case 2:
 991                 return (0);
 992         case 4:
 993                 return (1);
 994         case 11:
 995                 return (2);
 996         case 22:
 997                 return (3);
 998         /* OFDM rates */
 999         case 12:
1000                 return (0);
1001         case 18:
1002                 return (1);
1003         case 24:
1004                 return (2);
1005         case 36:
1006                 return (3);
1007         case 48:
1008                 return (4);
1009         case 72:
1010                 return (5);
1011         case 96:
1012                 return (6);
1013         case 108:
1014                 return (7);
1015         }
1016 
1017         return (0);     /* shouldn't get there */
1018 }
1019 
1020 /*
1021  * Return the expected ack rate for a frame transmitted at rate `rate'.
1022  */
1023 static int
1024 rt2860_ack_rate(struct ieee80211com *ic, int rate)
1025 {
1026         switch (rate) {
1027         /* CCK rates */
1028         case 2:
1029                 return (2);
1030         case 4:
1031         case 11:
1032         case 22:
1033                 return ((ic->ic_curmode == IEEE80211_MODE_11B) ? 4 : rate);
1034 
1035         /* OFDM rates */
1036         case 12:
1037         case 18:
1038                 return (12);
1039         case 24:
1040         case 36:
1041                 return (24);
1042         case 48:
1043         case 72:
1044         case 96:
1045         case 108:
1046                 return (48);
1047         }
1048 
1049         /* default to 1Mbps */
1050         return (2);
1051 }
1052 
1053 
1054 /*
1055  * Compute the duration (in us) needed to transmit `len' bytes at rate `rate'.
1056  * The function automatically determines the operating mode depending on the
1057  * given rate. `flags' indicates whether short preamble is in use or not.
1058  */
1059 static uint16_t
1060 rt2860_txtime(int len, int rate, uint32_t flags)
1061 {
1062         uint16_t        txtime;
1063 
1064         if (RT2860_RATE_IS_OFDM(rate)) {
1065                 /* IEEE Std 802.11g-2003, pp. 44 */
1066                 txtime = (8 + 4 * len + 3 + rate - 1) / rate;
1067                 txtime = 16 + 4 + 4 * txtime + 6;
1068         } else {
1069                 /* IEEE Std 802.11b-1999, pp. 28 */
1070                 txtime = (16 * len + rate - 1) / rate;
1071                 if (rate != 2 && (flags & IEEE80211_F_SHPREAMBLE))
1072                         txtime +=  72 + 24;
1073                 else
1074                         txtime += 144 + 48;
1075         }
1076         return (txtime);
1077 }
1078 
1079 static int
1080 rt2860_send(ieee80211com_t *ic, mblk_t *mp, uint8_t type)
1081 {
1082         struct rt2860_softc     *sc = (struct rt2860_softc *)ic;
1083         struct rt2860_tx_ring   *ring;
1084         struct rt2860_tx_data   *data;
1085         struct rt2860_txd       *txd;
1086         struct rt2860_txwi      *txwi;
1087         struct ieee80211_frame  *wh;
1088         struct ieee80211_node   *ni;
1089         int                     qid, off, rate, err;
1090         int                     mblen, pktlen;
1091         uint_t                  hdrlen;
1092         uint8_t                 mcs, pid, qsel;
1093         uint16_t                dur;
1094         mblk_t                  *m, *m0;
1095 
1096         err = DDI_SUCCESS;
1097 
1098         mutex_enter(&sc->sc_txlock);
1099         if (RT2860_IS_SUSPEND(sc)) {
1100                 err = ENXIO;
1101                 goto fail1;
1102         }
1103 
1104         if ((type & IEEE80211_FC0_TYPE_MASK) !=
1105             IEEE80211_FC0_TYPE_DATA)
1106                 qid = sc->mgtqid;
1107         else
1108                 qid = EDCA_AC_BE;
1109         ring = &sc->txq[qid];
1110 
1111         if (SLIST_EMPTY(&sc->data_pool) || (ring->queued > 15)) {
1112                 sc->sc_need_sched = 1;
1113                 sc->sc_tx_nobuf++;
1114                 err = ENOMEM;
1115                 goto fail1;
1116         }
1117 
1118         /* the data pool contains at least one element, pick the first */
1119         data = SLIST_FIRST(&sc->data_pool);
1120 
1121         m = allocb(msgdsize(mp) + 32, BPRI_MED);
1122         if (m == NULL) {
1123                 RWN_DEBUG(RT2860_DBG_TX, "rwn: rt2860_send():"
1124                     "rt2860_mgmt_send: can't alloc mblk.\n");
1125                 err = DDI_FAILURE;
1126                 goto fail1;
1127         }
1128 
1129         for (off = 0, m0 = mp; m0 != NULL; m0 = m0->b_cont) {
1130                 mblen = MBLKL(m0);
1131                 (void) bcopy(m0->b_rptr, m->b_rptr + off, mblen);
1132                 off += mblen;
1133         }
1134         m->b_wptr += off;
1135 
1136         wh = (struct ieee80211_frame *)m->b_rptr;
1137         ni = ieee80211_find_txnode(ic, wh->i_addr1);
1138         if (ni == NULL) {
1139                 err = DDI_FAILURE;
1140                 sc->sc_tx_err++;
1141                 goto fail2;
1142         }
1143 
1144         if ((type & IEEE80211_FC0_TYPE_MASK) ==
1145             IEEE80211_FC0_TYPE_DATA)
1146                 (void) ieee80211_encap(ic, m, ni);
1147 
1148         if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1149                 struct ieee80211_key *k;
1150                 k = ieee80211_crypto_encap(ic, m);
1151                 if (k == NULL) {
1152                         sc->sc_tx_err++;
1153                         err = DDI_FAILURE;
1154                         goto fail3;
1155                 }
1156                 /* packet header may have moved, reset our local pointer */
1157                 wh = (struct ieee80211_frame *)m->b_rptr;
1158         }
1159         pktlen = msgdsize(m);
1160         hdrlen = sizeof (*wh);
1161 
1162         /* pickup a rate */
1163         if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
1164             ((type & IEEE80211_FC0_TYPE_MASK) !=
1165             IEEE80211_FC0_TYPE_DATA))
1166                 rate = ni->in_rates.ir_rates[0];
1167         else {
1168                 if (ic->ic_fixed_rate != IEEE80211_FIXED_RATE_NONE)
1169                         rate = ic->ic_fixed_rate;
1170                 else
1171                         rate = ni->in_rates.ir_rates[ni->in_txrate];
1172         }
1173         rate &= IEEE80211_RATE_VAL;
1174 
1175         /* get MCS code from rate */
1176         mcs = rt2860_rate2mcs(rate);
1177 
1178         /* setup TX Wireless Information */
1179         txwi = data->txwi;
1180         (void) bzero(txwi, sizeof (struct rt2860_txwi));
1181         txwi->wcid = (type == IEEE80211_FC0_TYPE_DATA) ?
1182             RT2860_AID2WCID(ni->in_associd) : 0xff;
1183         txwi->len = LE_16(pktlen);
1184         if (!RT2860_RATE_IS_OFDM(rate)) {
1185                 txwi->phy = LE_16(RT2860_PHY_CCK);
1186                 if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1187                         mcs |= RT2860_PHY_SHPRE;
1188         } else
1189                 txwi->phy = LE_16(RT2860_PHY_OFDM);
1190         txwi->phy |= LE_16(mcs);
1191 
1192         /*
1193          * We store the MCS code into the driver-private PacketID field.
1194          * The PacketID is latched into TX_STAT_FIFO when Tx completes so
1195          * that we know at which initial rate the frame was transmitted.
1196          * We add 1 to the MCS code because setting the PacketID field to
1197          * 0 means that we don't want feedback in TX_STAT_FIFO.
1198          */
1199         pid = (mcs + 1) & 0xf;
1200         txwi->len |= LE_16(pid << RT2860_TX_PID_SHIFT);
1201 
1202         /* check if RTS/CTS or CTS-to-self protection is required */
1203         if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1204             (pktlen + IEEE80211_CRC_LEN > ic->ic_rtsthreshold ||
1205             ((ic->ic_flags &
1206             IEEE80211_F_USEPROT) && RT2860_RATE_IS_OFDM(rate))))
1207                 txwi->txop = RT2860_TX_TXOP_HT;
1208         else
1209                 txwi->txop = RT2860_TX_TXOP_BACKOFF;
1210 
1211         if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1212                 txwi->xflags |= RT2860_TX_ACK;
1213 
1214                 dur = rt2860_txtime(RT2860_ACK_SIZE, rt2860_ack_rate(ic, rate),
1215                     ic->ic_flags) + sc->sifs;
1216                 *(uint16_t *)wh->i_dur = LE_16(dur);
1217         }
1218 
1219         /* copy and trim 802.11 header */
1220         bcopy(wh, &txwi->wh, hdrlen);
1221         m->b_rptr += hdrlen;
1222         bcopy(m->b_rptr, data->txbuf_dma.mem_va, pktlen - hdrlen);
1223 
1224         qsel = (qid < EDCA_NUM_AC) ? RT2860_TX_QSEL_EDCA : RT2860_TX_QSEL_MGMT;
1225 
1226         /* first segment is TXWI + 802.11 header */
1227         txd = &ring->txd[ring->cur];
1228         txd->sdp0 = LE_32(data->paddr);
1229         txd->sdl0 = LE_16(16 + hdrlen);
1230         txd->flags = qsel;
1231 
1232         /* finalize last segment */
1233         txd->sdp1 = LE_32(data->txbuf_dma.cookie.dmac_address);
1234         txd->sdl1 = LE_16(pktlen - hdrlen | RT2860_TX_LS1);
1235 
1236         /* remove from the free pool and link it into the SW Tx slot */
1237         SLIST_REMOVE_HEAD(&sc->data_pool, next);
1238         data->ni = ieee80211_ref_node(ni);
1239         ring->data[ring->cur] = data;
1240 
1241         (void) ddi_dma_sync(sc->txpool_dma.dma_hdl,
1242             _PTRDIFF(txwi, sc->txwi),
1243             (hdrlen + 16 + 2),
1244             DDI_DMA_SYNC_FORDEV);
1245         RT2860_DMA_SYNC(data->txbuf_dma, DDI_DMA_SYNC_FORDEV);
1246         RT2860_DMA_SYNC(ring->txdesc_dma, DDI_DMA_SYNC_FORDEV);
1247 
1248         RWN_DEBUG(RT2860_DBG_TX, "rwn: rt2860_send():"
1249             "sending frame qid=%d wcid=%d rate=%d cur = %x\n",
1250             qid, txwi->wcid, rate, ring->cur);
1251 
1252         ring->queued++;
1253         ring->cur = (ring->cur + 1) % RT2860_TX_RING_COUNT;
1254 
1255         /* kick Tx */
1256         RT2860_WRITE(sc, RT2860_TX_CTX_IDX(qid), ring->cur);
1257 
1258         sc->sc_tx_timer = 5;
1259 
1260         ic->ic_stats.is_tx_frags++;
1261         ic->ic_stats.is_tx_bytes += pktlen;
1262 
1263 fail3:
1264         ieee80211_free_node(ni);
1265 fail2:
1266         freemsg(m);
1267 fail1:
1268         if ((type & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_DATA ||
1269             err == DDI_SUCCESS)
1270                 freemsg(mp);
1271         mutex_exit(&sc->sc_txlock);
1272         return (err);
1273 }
1274 
1275 /*
1276  * This function is called periodically (every 200ms) during scanning to
1277  * switch from one channel to another.
1278  */
1279 static void
1280 rt2860_next_scan(void *arg)
1281 {
1282         struct rt2860_softc *sc = (struct rt2860_softc *)arg;
1283         struct ieee80211com *ic = &sc->sc_ic;
1284 
1285         if (ic->ic_state == IEEE80211_S_SCAN)
1286                 (void) ieee80211_next_scan(ic);
1287 }
1288 
1289 static void
1290 rt2860_updateslot(struct rt2860_softc *sc)
1291 {
1292         struct ieee80211com *ic = &sc->sc_ic;
1293         uint32_t tmp;
1294 
1295         tmp = RT2860_READ(sc, RT2860_BKOFF_SLOT_CFG);
1296         tmp &= ~0xff;
1297         tmp |= (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
1298         RT2860_WRITE(sc, RT2860_BKOFF_SLOT_CFG, tmp);
1299 }
1300 
1301 static void
1302 rt2860_iter_func(void *arg, struct ieee80211_node *ni)
1303 {
1304         struct rt2860_softc *sc = (struct rt2860_softc *)arg;
1305         uint8_t wcid;
1306 
1307         wcid = RT2860_AID2WCID(ni->in_associd);
1308         rt2860_amrr_choose(&sc->amrr, ni, &sc->amn[wcid]);
1309 }
1310 
1311 static void
1312 rt2860_updatestats(void *arg)
1313 {
1314         struct rt2860_softc *sc = (struct rt2860_softc *)arg;
1315         struct ieee80211com *ic = &sc->sc_ic;
1316 
1317         if (ic->ic_opmode == IEEE80211_M_STA)
1318                 rt2860_iter_func(sc, ic->ic_bss);
1319         else
1320                 ieee80211_iterate_nodes(&ic->ic_sta, rt2860_iter_func, arg);
1321 
1322         sc->sc_rssadapt_id = timeout(rt2860_updatestats, (void *)sc,
1323             drv_usectohz(500 * 1000));
1324 }
1325 
1326 static void
1327 rt2860_enable_mrr(struct rt2860_softc *sc)
1328 {
1329 #define CCK(mcs)        (mcs)
1330 #define OFDM(mcs)       ((uint32_t)1 << 3 | (mcs))
1331         RT2860_WRITE(sc, RT2860_LG_FBK_CFG0,
1332             OFDM(6) << 28 |       /* 54->48 */
1333             OFDM(5) << 24 |       /* 48->36 */
1334             OFDM(4) << 20 |       /* 36->24 */
1335             OFDM(3) << 16 |       /* 24->18 */
1336             OFDM(2) << 12 |       /* 18->12 */
1337             OFDM(1) <<  8 |       /* 12-> 9 */
1338             OFDM(0) <<  4 |       /*  9-> 6 */
1339             OFDM(0));           /*  6-> 6 */
1340 
1341         RT2860_WRITE(sc, RT2860_LG_FBK_CFG1,
1342             CCK(2) << 12 |        /* 11->5.5 */
1343             CCK(1) <<  8 |        /* 5.5-> 2 */
1344             CCK(0) <<  4 |        /*   2-> 1 */
1345             CCK(0));            /*   1-> 1 */
1346 #undef OFDM
1347 #undef CCK
1348 }
1349 
1350 static void
1351 rt2860_set_txpreamble(struct rt2860_softc *sc)
1352 {
1353         uint32_t tmp;
1354 
1355         tmp = RT2860_READ(sc, RT2860_AUTO_RSP_CFG);
1356         tmp &= ~RT2860_CCK_SHORT_EN;
1357         if (sc->sc_ic.ic_flags & IEEE80211_F_SHPREAMBLE)
1358                 tmp |= RT2860_CCK_SHORT_EN;
1359         RT2860_WRITE(sc, RT2860_AUTO_RSP_CFG, tmp);
1360 }
1361 
1362 static void
1363 rt2860_set_bssid(struct rt2860_softc *sc, const uint8_t *bssid)
1364 {
1365         RT2860_WRITE(sc, RT2860_MAC_BSSID_DW0,
1366             bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24);
1367         RT2860_WRITE(sc, RT2860_MAC_BSSID_DW1,
1368             bssid[4] | bssid[5] << 8);
1369 }
1370 
1371 static void
1372 rt2860_set_basicrates(struct rt2860_softc *sc)
1373 {
1374         struct ieee80211com *ic = &sc->sc_ic;
1375 
1376         /* set basic rates mask */
1377         if (ic->ic_curmode == IEEE80211_MODE_11B)
1378                 RT2860_WRITE(sc, RT2860_LEGACY_BASIC_RATE, 0x003);
1379         else if (ic->ic_curmode == IEEE80211_MODE_11A)
1380                 RT2860_WRITE(sc, RT2860_LEGACY_BASIC_RATE, 0x150);
1381         else    /* 11g */
1382                 RT2860_WRITE(sc, RT2860_LEGACY_BASIC_RATE, 0x15f);
1383 }
1384 
1385 static void
1386 rt2860_amrr_node_init(const struct rt2860_amrr *amrr,
1387     struct rt2860_amrr_node *amn)
1388 {
1389         amn->amn_success = 0;
1390         amn->amn_recovery = 0;
1391         amn->amn_txcnt = amn->amn_retrycnt = 0;
1392         amn->amn_success_threshold = amrr->amrr_min_success_threshold;
1393 }
1394 
1395 static void
1396 rt2860_amrr_choose(struct rt2860_amrr *amrr, struct ieee80211_node *ni,
1397     struct rt2860_amrr_node *amn)
1398 {
1399 #define RV(rate)        ((rate) & IEEE80211_RATE_VAL)
1400 #define is_success(amn) \
1401         ((amn)->amn_retrycnt < (amn)->amn_txcnt / 10)
1402 #define is_failure(amn) \
1403         ((amn)->amn_retrycnt > (amn)->amn_txcnt / 3)
1404 #define is_enough(amn)          \
1405         ((amn)->amn_txcnt > 10)
1406 #define is_min_rate(ni)         \
1407         ((ni)->in_txrate == 0)
1408 #define is_max_rate(ni)         \
1409         ((ni)->in_txrate == (ni)->in_rates.ir_nrates - 1)
1410 #define increase_rate(ni)       \
1411         ((ni)->in_txrate++)
1412 #define decrease_rate(ni)       \
1413         ((ni)->in_txrate--)
1414 #define reset_cnt(amn)          \
1415         { (amn)->amn_txcnt = (amn)->amn_retrycnt = 0; }
1416 
1417         int need_change = 0;
1418 
1419         if (is_success(amn) && is_enough(amn)) {
1420                 amn->amn_success++;
1421                 if (amn->amn_success >= amn->amn_success_threshold &&
1422                     !is_max_rate(ni)) {
1423                         amn->amn_recovery = 1;
1424                         amn->amn_success = 0;
1425                         increase_rate(ni);
1426                         RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_amrr_choose(): "
1427                             "increase rate = %d, #tx = %d, #retries = %d\n",
1428                             RV(ni->in_rates.ir_rates[ni->in_txrate]),
1429                             amn->amn_txcnt, amn->amn_retrycnt);
1430                         need_change = 1;
1431                 } else {
1432                         amn->amn_recovery = 0;
1433                 }
1434         } else if (is_failure(amn)) {
1435                 amn->amn_success = 0;
1436                 if (!is_min_rate(ni)) {
1437                         if (amn->amn_recovery) {
1438                                 amn->amn_success_threshold *= 2;
1439                                 if (amn->amn_success_threshold >
1440                                     amrr->amrr_max_success_threshold)
1441                                         amn->amn_success_threshold =
1442                                             amrr->amrr_max_success_threshold;
1443                         } else {
1444                                 amn->amn_success_threshold =
1445                                     amrr->amrr_min_success_threshold;
1446                         }
1447                         decrease_rate(ni);
1448                         RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_amrr_choose(): "
1449                             "decrease rate = %d, #tx = %d, #retries = %d\n",
1450                             RV(ni->in_rates.ir_rates[ni->in_txrate]),
1451                             amn->amn_txcnt, amn->amn_retrycnt);
1452                         need_change = 1;
1453                 }
1454                 amn->amn_recovery = 0;
1455         }
1456 
1457         if (is_enough(amn) || need_change)
1458                 reset_cnt(amn);
1459 #undef RV
1460 }
1461 
1462 static void
1463 rt2860_newassoc(struct ieee80211com *ic, struct ieee80211_node *in, int isnew)
1464 {
1465         struct rt2860_softc *sc = (struct rt2860_softc *)ic;
1466         uint32_t off;
1467         uint8_t *fptr, wcid = 0;
1468         int i;
1469 
1470         if (isnew && in->in_associd != 0) {
1471                 /* only interested in true associations */
1472                 wcid = RT2860_AID2WCID(in->in_associd);
1473 
1474                 /* init WCID table entry */
1475                 off = RT2860_WCID_ENTRY(wcid);
1476                 fptr = in->in_macaddr;
1477                 for (i = 0; i < IEEE80211_ADDR_LEN; i++)
1478                         rt2860_mem_write1(sc, off++, *fptr++);
1479         }
1480         rt2860_amrr_node_init(&sc->amrr, &sc->amn[wcid]);
1481 
1482         /* set rate to some reasonable initial value */
1483         i = in->in_rates.ir_nrates - 1;
1484         for (; i > 0 && (in->in_rates.ir_rates[i] & IEEE80211_RATE_VAL) > 72; )
1485                 i--;
1486         in->in_txrate = i;
1487 
1488         RWN_DEBUG(RT2860_DBG_80211, "rwn: rt2860_newassoc(): "
1489             "new assoc isnew=%d WCID=%d, initial rate=%d\n",
1490             isnew, wcid,
1491             in->in_rates.ir_rates[i] & IEEE80211_RATE_VAL);
1492         RWN_DEBUG(RT2860_DBG_80211, "rwn: rt2860_newassoc(): "
1493             "addr=%x:%x:%x:%x:%x:%x\n",
1494             in->in_macaddr[0], in->in_macaddr[1], in->in_macaddr[2],
1495             in->in_macaddr[3], in->in_macaddr[4], in->in_macaddr[5]);
1496 }
1497 
1498 void
1499 rt2860_enable_tsf_sync(struct rt2860_softc *sc)
1500 {
1501         struct ieee80211com *ic = &sc->sc_ic;
1502         uint32_t tmp;
1503 
1504         tmp = RT2860_READ(sc, RT2860_BCN_TIME_CFG);
1505 
1506         tmp &= ~0x1fffff;
1507         tmp |= ic->ic_bss->in_intval * 16;
1508         tmp |= RT2860_TSF_TIMER_EN | RT2860_TBTT_TIMER_EN;
1509         if (ic->ic_opmode == IEEE80211_M_STA) {
1510                 /*
1511                  * Local TSF is always updated with remote TSF on beacon
1512                  * reception.
1513                  */
1514                 tmp |= 1 << RT2860_TSF_SYNC_MODE_SHIFT;
1515         }
1516 
1517         RT2860_WRITE(sc, RT2860_BCN_TIME_CFG, tmp);
1518 }
1519 
1520 static int
1521 rt2860_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
1522 {
1523         struct rt2860_softc     *sc = (struct rt2860_softc *)ic;
1524         enum ieee80211_state    ostate;
1525         int                     err;
1526         uint32_t                tmp;
1527 
1528         ostate = ic->ic_state;
1529         RWN_DEBUG(RT2860_DBG_80211, "rwn: rt2860_newstate(): "
1530             "%x -> %x!\n", ostate, nstate);
1531 
1532         RT2860_GLOCK(sc);
1533         if (sc->sc_scan_id != 0) {
1534                 (void) untimeout(sc->sc_scan_id);
1535                 sc->sc_scan_id = 0;
1536         }
1537         if (sc->sc_rssadapt_id != 0) {
1538                 (void) untimeout(sc->sc_rssadapt_id);
1539                 sc->sc_rssadapt_id = 0;
1540         }
1541         if (ostate == IEEE80211_S_RUN) {
1542                 /* turn link LED off */
1543                 rt2860_set_leds(sc, RT2860_LED_RADIO);
1544         }
1545 
1546         switch (nstate) {
1547         case IEEE80211_S_INIT:
1548                 if (ostate == IEEE80211_S_RUN) {
1549                         /* abort TSF synchronization */
1550                         tmp = RT2860_READ(sc, RT2860_BCN_TIME_CFG);
1551                         RT2860_WRITE(sc, RT2860_BCN_TIME_CFG,
1552                             tmp & ~(RT2860_BCN_TX_EN | RT2860_TSF_TIMER_EN |
1553                             RT2860_TBTT_TIMER_EN));
1554                 }
1555                 break;
1556 
1557         case IEEE80211_S_SCAN:
1558                 rt2860_set_chan(sc, ic->ic_curchan);
1559                 sc->sc_scan_id = timeout(rt2860_next_scan, (void *)sc,
1560                     drv_usectohz(200000));
1561                 break;
1562 
1563         case IEEE80211_S_AUTH:
1564         case IEEE80211_S_ASSOC:
1565                 rt2860_set_chan(sc, ic->ic_curchan);
1566                 break;
1567 
1568         case IEEE80211_S_RUN:
1569                 rt2860_set_chan(sc, ic->ic_curchan);
1570 
1571                 if (ic->ic_opmode != IEEE80211_M_MONITOR) {
1572                         rt2860_updateslot(sc);
1573                         rt2860_enable_mrr(sc);
1574                         rt2860_set_txpreamble(sc);
1575                         rt2860_set_basicrates(sc);
1576                         rt2860_set_bssid(sc, ic->ic_bss->in_bssid);
1577                 }
1578                 if (ic->ic_opmode == IEEE80211_M_STA) {
1579                         /* fake a join to init the tx rate */
1580                         rt2860_newassoc(ic, ic->ic_bss, 1);
1581                 }
1582 
1583                 if (ic->ic_opmode != IEEE80211_M_MONITOR) {
1584                         rt2860_enable_tsf_sync(sc);
1585                         sc->sc_rssadapt_id = timeout(rt2860_updatestats,
1586                             (void *)sc, drv_usectohz(500 * 1000));
1587                 }
1588 
1589                 /* turn link LED on */
1590                 rt2860_set_leds(sc, RT2860_LED_RADIO |
1591                     (IEEE80211_IS_CHAN_2GHZ(ic->ic_curchan) ?
1592                     RT2860_LED_LINK_2GHZ : RT2860_LED_LINK_5GHZ));
1593                 break;
1594         }
1595 
1596         RT2860_GUNLOCK(sc);
1597 
1598         err = sc->sc_newstate(ic, nstate, arg);
1599 
1600         return (err);
1601 }
1602 
1603 /*
1604  * Return the Rx chain with the highest RSSI for a given frame.
1605  */
1606 static uint8_t
1607 rt2860_maxrssi_chain(struct rt2860_softc *sc, const struct rt2860_rxwi *rxwi)
1608 {
1609         uint8_t rxchain = 0;
1610 
1611         if (sc->nrxchains > 1)
1612                 if (rxwi->rssi[1] > rxwi->rssi[rxchain])
1613                         rxchain = 1;
1614         if (sc->nrxchains > 2)
1615                 if (rxwi->rssi[2] > rxwi->rssi[rxchain])
1616                         rxchain = 2;
1617 
1618         return (rxchain);
1619 }
1620 
1621 static void
1622 rt2860_drain_stats_fifo(struct rt2860_softc *sc)
1623 {
1624         struct rt2860_amrr_node *amn;
1625         uint32_t stat;
1626         uint8_t wcid, mcs, pid;
1627 
1628         /* drain Tx status FIFO (maxsize = 16) */
1629         while ((stat = RT2860_READ(sc, RT2860_TX_STAT_FIFO)) & RT2860_TXQ_VLD) {
1630                 RWN_DEBUG(RT2860_DBG_TX, "rwn: rt2860_drain_stats_fifo(): "
1631                     "tx stat 0x%08\n", stat);
1632 
1633                 wcid = (stat >> 8) & 0xff;
1634 
1635                 /* if no ACK was requested, no feedback is available */
1636                 if (!(stat & RT2860_TXQ_ACKREQ) || wcid == 0xff)
1637                         continue;
1638                 /* update per-STA AMRR stats */
1639                 amn = &sc->amn[wcid];
1640                 amn->amn_txcnt++;
1641                 if (stat & RT2860_TXQ_OK) {
1642                         /*
1643                          * Check if there were retries, ie if the Tx success
1644                          * rate is different from the requested rate.  Note
1645                          * that it works only because we do not allow rate
1646                          * fallback from OFDM to CCK.
1647                          */
1648                         mcs = (stat >> RT2860_TXQ_MCS_SHIFT) & 0x7f;
1649                         pid = (stat >> RT2860_TXQ_PID_SHIFT) & 0xf;
1650                         if (mcs + 1 != pid)
1651                                 amn->amn_retrycnt++;
1652                 } else
1653                         amn->amn_retrycnt++;
1654         }
1655 }
1656 
1657 /*ARGSUSED*/
1658 static void
1659 rt2860_tx_intr(struct rt2860_softc *sc, int qid)
1660 {
1661         struct rt2860_tx_ring   *ring = &sc->txq[qid];
1662         struct ieee80211com     *ic = &sc->sc_ic;
1663         uint32_t hw;
1664 
1665         rt2860_drain_stats_fifo(sc);
1666 
1667         mutex_enter(&sc->sc_txlock);
1668         hw = RT2860_READ(sc, RT2860_TX_DTX_IDX(qid));
1669         RWN_DEBUG(RT2860_DBG_TX, "rwn: rwn_tx_intr():"
1670             "hw = %x, ring->next = %x, queued = %d\n",
1671             hw, ring->next, ring->queued);
1672         while (ring->next != hw) {
1673                 struct rt2860_txd *txd = &ring->txd[ring->next];
1674                 struct rt2860_tx_data *data = ring->data[ring->next];
1675 
1676                 if (data != NULL) {
1677                         RT2860_DMA_SYNC(data->txbuf_dma, DDI_DMA_SYNC_FORDEV);
1678                         if (data->ni != NULL) {
1679                                 ieee80211_free_node(data->ni);
1680                                 data->ni = NULL;
1681                         }
1682                         SLIST_INSERT_HEAD(&sc->data_pool, data, next);
1683                         ring->data[ring->next] = NULL;
1684                 }
1685 
1686                 txd->sdl0 &= ~LE_16(RT2860_TX_DDONE);
1687 
1688                 (void) ddi_dma_sync(ring->txdesc_dma.dma_hdl,
1689                     ring->next * sizeof (struct rt2860_txd),
1690                     sizeof (struct rt2860_txd),
1691                     DDI_DMA_SYNC_FORDEV);
1692 
1693                 ring->queued--;
1694                 ring->next = (ring->next + 1) % RT2860_TX_RING_COUNT;
1695 
1696                 if (sc->sc_need_sched &&
1697                     (ring->queued < RT2860_TX_RING_COUNT)) {
1698                         sc->sc_need_sched = 0;
1699                         mac_tx_update(ic->ic_mach);
1700                 }
1701         }
1702         sc->sc_tx_timer = 0;
1703         mutex_exit(&sc->sc_txlock);
1704 }
1705 
1706 static void
1707 rt2860_rx_intr(struct rt2860_softc *sc)
1708 {
1709         struct ieee80211com     *ic = &sc->sc_ic;
1710         struct ieee80211_node   *ni;
1711         struct ieee80211_frame  *wh;
1712         int     pktlen;
1713         uint8_t ant, rssi, *rxbuf;
1714         mblk_t  *mp0;
1715 
1716         mutex_enter(&sc->sc_rxlock);
1717         for (;;) {
1718                 struct rt2860_rx_data *data = &sc->rxq.data[sc->rxq.cur];
1719                 struct rt2860_rxd *rxd = &sc->rxq.rxd[sc->rxq.cur];
1720                 struct rt2860_rxwi *rxwi;
1721 
1722                 (void) ddi_dma_sync(sc->rxq.rxdesc_dma.dma_hdl,
1723                     sc->rxq.cur * sizeof (struct rt2860_rxd),
1724                     sizeof (struct rt2860_rxd),
1725                     DDI_DMA_SYNC_FORKERNEL);
1726 
1727                 if (!(rxd->sdl0 & LE_16(RT2860_RX_DDONE))) {
1728                         RWN_DEBUG(RT2860_DBG_RX, "rwn: rt2860_rx_intr(): "
1729                             "rx done!\n");
1730                         break;
1731                 }
1732 
1733                 if (rxd->flags &
1734                     LE_32(RT2860_RX_CRCERR | RT2860_RX_ICVERR)) {
1735                         RWN_DEBUG(RT2860_DBG_RX, "rwn: rt2860_rx_intr(): "
1736                             "rx crc error & rx icv error!\n");
1737                         sc->sc_rx_err++;
1738                         goto skip;
1739                 }
1740 
1741                 if (rxd->flags & LE_32(RT2860_RX_MICERR)) {
1742                         RWN_DEBUG(RT2860_DBG_RX, "rwn: rt2860_rx_intr(): "
1743                             "rx mic error!\n");
1744                         sc->sc_rx_err++;
1745                         goto skip;
1746                 }
1747 
1748                 (void) ddi_dma_sync(data->rxbuf_dma.dma_hdl,
1749                     data->rxbuf_dma.offset,
1750                     data->rxbuf_dma.alength,
1751                     DDI_DMA_SYNC_FORCPU);
1752 
1753                 rxbuf = (uint8_t *)data->rxbuf_dma.mem_va;
1754                 rxd->sdp0 = LE_32(data->rxbuf_dma.cookie.dmac_address);
1755                 rxwi = (struct rt2860_rxwi *)rxbuf;
1756                 rxbuf = (uint8_t *)(rxwi + 1);
1757                 pktlen = LE_16(rxwi->len) & 0xfff;
1758 
1759                 mp0 = allocb(sc->sc_dmabuf_size, BPRI_MED);
1760                 if (mp0 == NULL) {
1761                         RWN_DEBUG(RT2860_DBG_RX, "rwn: rt2860_rx_intr():"
1762                             "alloc mblk error\n");
1763                         sc->sc_rx_nobuf++;
1764                         goto skip;
1765                 }
1766                 bcopy(rxbuf, mp0->b_rptr, pktlen);
1767                 mp0->b_wptr += pktlen;
1768 
1769                 wh = (struct ieee80211_frame *)mp0->b_rptr;
1770 
1771                 /* HW may insert 2 padding bytes after 802.11 header */
1772                 if (rxd->flags & LE_32(RT2860_RX_L2PAD)) {
1773                         RWN_DEBUG(RT2860_DBG_RX, "rwn: rt2860_rx_intr():"
1774                             "2 padding bytes after 80211 header!\n");
1775                 }
1776 
1777                 ant = rt2860_maxrssi_chain(sc, rxwi);
1778                 rssi = RT2860_RSSI_OFFSET - rxwi->rssi[ant];
1779                 /* grab a reference to the source node */
1780                 ni = ieee80211_find_rxnode(ic, wh);
1781 
1782                 (void) ieee80211_input(ic, mp0, ni, rssi, 0);
1783 
1784                 /* node is no longer needed */
1785                 ieee80211_free_node(ni);
1786 skip:
1787                 rxd->sdl0 &= ~LE_16(RT2860_RX_DDONE);
1788 
1789                 (void) ddi_dma_sync(sc->rxq.rxdesc_dma.dma_hdl,
1790                     sc->rxq.cur * sizeof (struct rt2860_rxd),
1791                     sizeof (struct rt2860_rxd),
1792                     DDI_DMA_SYNC_FORDEV);
1793 
1794                 sc->rxq.cur = (sc->rxq.cur + 1) % RT2860_RX_RING_COUNT;
1795         }
1796         mutex_exit(&sc->sc_rxlock);
1797 
1798         /* tell HW what we have processed */
1799         RT2860_WRITE(sc, RT2860_RX_CALC_IDX,
1800             (sc->rxq.cur - 1) % RT2860_RX_RING_COUNT);
1801 }
1802 
1803 static uint_t
1804 rt2860_softintr(caddr_t data)
1805 {
1806         struct rt2860_softc *sc = (struct rt2860_softc *)data;
1807 
1808         /*
1809          * Check if the soft interrupt is triggered by another
1810          * driver at the same level.
1811          */
1812         RT2860_GLOCK(sc);
1813         if (sc->sc_rx_pend) {
1814                 sc->sc_rx_pend = 0;
1815                 RT2860_GUNLOCK(sc);
1816                 rt2860_rx_intr(sc);
1817                 return (DDI_INTR_CLAIMED);
1818         }
1819         RT2860_GUNLOCK(sc);
1820 
1821         return (DDI_INTR_UNCLAIMED);
1822 }
1823 
1824 static uint_t
1825 rt2860_intr(caddr_t arg)
1826 {
1827         struct rt2860_softc     *sc = (struct rt2860_softc *)arg;
1828         uint32_t                r;
1829 
1830         RT2860_GLOCK(sc);
1831 
1832         if ((!RT2860_IS_RUNNING(sc)) || RT2860_IS_SUSPEND(sc)) {
1833                 /*
1834                  * The hardware is not ready/present, don't touch anything.
1835                  * Note this can happen early on if the IRQ is shared.
1836                  */
1837                 RT2860_GUNLOCK(sc);
1838                 return (DDI_INTR_UNCLAIMED);
1839         }
1840 
1841         r = RT2860_READ(sc, RT2860_INT_STATUS);
1842         if (r == 0xffffffff) {
1843                 RT2860_GUNLOCK(sc);
1844                 return (DDI_INTR_UNCLAIMED);
1845         }
1846         if (r == 0) {
1847                 RT2860_GUNLOCK(sc);
1848                 return (DDI_INTR_UNCLAIMED);
1849         }
1850 
1851         /* acknowledge interrupts */
1852         RT2860_WRITE(sc, RT2860_INT_STATUS, r);
1853 
1854         if (r & RT2860_TX_COHERENT)
1855                 RWN_DEBUG(RT2860_DBG_INTR, "rwn: rt2860_intr()"
1856                     "RT2860_TX_COHERENT\n");
1857 
1858         if (r & RT2860_RX_COHERENT)
1859                 RWN_DEBUG(RT2860_DBG_INTR, "rwn: rt2860_intr()"
1860                     "RT2860_RX_COHERENT\n");
1861 
1862         if (r & RT2860_MAC_INT_2) {
1863                 RWN_DEBUG(RT2860_DBG_INTR, "rwn: rt2860_intr(): "
1864                     "RT2860_MAC_INT_2\n");
1865                 rt2860_drain_stats_fifo(sc);
1866         }
1867 
1868         if (r & RT2860_TX_DONE_INT5) {
1869                 RWN_DEBUG(RT2860_DBG_INTR, "rwn: rt2860_intr(): "
1870                     "RT2860_TX_DONE_INT5\n");
1871                 rt2860_tx_intr(sc, 5);
1872         }
1873 
1874         if (r & RT2860_RX_DONE_INT) {
1875                 RWN_DEBUG(RT2860_DBG_INTR, "rwn: rt2860_intr()"
1876                     "RT2860_RX_INT\n");
1877                 sc->sc_rx_pend = 1;
1878                 ddi_trigger_softintr(sc->sc_softintr_hdl);
1879         }
1880 
1881         if (r & RT2860_TX_DONE_INT4) {
1882                 RWN_DEBUG(RT2860_DBG_INTR, "rwn: rt2860_intr(): "
1883                     "RT2860_TX_DONE_INT4\n");
1884                 rt2860_tx_intr(sc, 4);
1885         }
1886 
1887         if (r & RT2860_TX_DONE_INT3) {
1888                 RWN_DEBUG(RT2860_DBG_INTR, "rwn: rt2860_intr(): "
1889                     "RT2860_TX_DONE_INT3\n");
1890                 rt2860_tx_intr(sc, 3);
1891         }
1892 
1893         if (r & RT2860_TX_DONE_INT2) {
1894                 RWN_DEBUG(RT2860_DBG_INTR, "rwn: rt2860_intr(): "
1895                     "RT2860_TX_DONE_INT2\n");
1896                 rt2860_tx_intr(sc, 2);
1897         }
1898 
1899         if (r & RT2860_TX_DONE_INT1) {
1900                 RWN_DEBUG(RT2860_DBG_INTR, "rwn: rt2860_intr(): "
1901                     "RT2860_TX_DONE_INT1\n");
1902                 rt2860_tx_intr(sc, 1);
1903         }
1904 
1905         if (r & RT2860_TX_DONE_INT0) {
1906                 RWN_DEBUG(RT2860_DBG_INTR, "rwn: rt2860_intr(): "
1907                     "RT2860_TX_DONE_INT0\n");
1908                 rt2860_tx_intr(sc, 0);
1909         }
1910 
1911         if (r & RT2860_MAC_INT_0) {
1912                 RWN_DEBUG(RT2860_DBG_INTR, "rwn: rt2860_intr(): "
1913                     "RT2860_MAC_INT_0\n");
1914                 struct ieee80211com *ic = &sc->sc_ic;
1915                 /* check if protection mode has changed */
1916                 if ((sc->sc_ic_flags ^ ic->ic_flags) & IEEE80211_F_USEPROT) {
1917                         rt2860_updateprot(ic);
1918                         sc->sc_ic_flags = ic->ic_flags;
1919                 }
1920         }
1921 
1922         if (r & RT2860_MAC_INT_3)
1923                 RWN_DEBUG(RT2860_DBG_INTR, "rwn: rt2860_intr(): "
1924                     "RT2860_MAC_INT_3\n");
1925 
1926         RT2860_GUNLOCK(sc);
1927 
1928         return (DDI_INTR_CLAIMED);
1929 }
1930 
1931 static void
1932 rt2860_set_region_4(struct rt2860_softc *sc,
1933     uint32_t addr, uint32_t data, int size)
1934 {
1935         for (; size > 0; size--, data++, addr += 4)
1936                 ddi_put32((sc)->sc_io_handle,
1937                     (uint32_t *)((uintptr_t)(sc)->sc_io_base + addr), data);
1938 }
1939 
1940 static int
1941 rt2860_load_microcode(struct rt2860_softc *sc)
1942 {
1943         int             ntries;
1944         size_t          size;
1945         uint8_t         *ucode, *fptr;
1946         uint32_t        off, i;
1947 
1948         ucode = rt2860_fw_bin;
1949         size = sizeof (rt2860_fw_bin);
1950         RWN_DEBUG(RT2860_DBG_FW, "rwn: rt2860_load_microcode(): "
1951             "The size of ucode is: %x\n", size);
1952 
1953         /* set "host program ram write selection" bit */
1954         RT2860_WRITE(sc, RT2860_SYS_CTRL, RT2860_HST_PM_SEL);
1955         /* write microcode image */
1956         fptr = ucode;
1957         off = RT2860_FW_BASE;
1958         for (i = 0; i < size; i++) {
1959                 rt2860_mem_write1(sc, off++, *fptr++);
1960         }
1961         /* kick microcontroller unit */
1962         RT2860_WRITE(sc, RT2860_SYS_CTRL, 0);
1963         RT2860_WRITE(sc, RT2860_SYS_CTRL, RT2860_MCU_RESET);
1964 
1965         RT2860_WRITE(sc, RT2860_H2M_BBPAGENT, 0);
1966         RT2860_WRITE(sc, RT2860_H2M_MAILBOX, 0);
1967 
1968         /* wait until microcontroller is ready */
1969         for (ntries = 0; ntries < 1000; ntries++) {
1970                 if (RT2860_READ(sc, RT2860_SYS_CTRL) & RT2860_MCU_READY)
1971                         break;
1972                 DELAY(1000);
1973         }
1974         if (ntries == 1000) {
1975                 RWN_DEBUG(RT2860_DBG_FW, "rwn: rt2860_load_microcode(): "
1976                     "timeout waiting for MCU to initialie\n");
1977                 return (ETIMEDOUT);
1978         }
1979 
1980         return (0);
1981 }
1982 
1983 static void
1984 rt2860_set_macaddr(struct rt2860_softc *sc, const uint8_t *addr)
1985 {
1986         RT2860_WRITE(sc, RT2860_MAC_ADDR_DW0,
1987             addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24);
1988         RT2860_WRITE(sc, RT2860_MAC_ADDR_DW1,
1989             addr[4] | addr[5] << 8);
1990 }
1991 
1992 /*
1993  * Send a command to the 8051 microcontroller unit.
1994  */
1995 static int
1996 rt2860_mcu_cmd(struct rt2860_softc *sc, uint8_t cmd, uint16_t arg)
1997 {
1998         int     ntries;
1999 
2000         for (ntries = 0; ntries < 100; ntries++) {
2001                 if (!(RT2860_READ(sc, RT2860_H2M_MAILBOX) & RT2860_H2M_BUSY))
2002                         break;
2003                 DELAY(2);
2004         }
2005         if (ntries == 100)
2006                 return (EIO);
2007 
2008         RT2860_WRITE(sc, RT2860_H2M_MAILBOX,
2009             RT2860_H2M_BUSY | RT2860_TOKEN_NO_INTR << 16 | arg);
2010         RT2860_WRITE(sc, RT2860_HOST_CMD, cmd);
2011 
2012         return (RT2860_SUCCESS);
2013 }
2014 
2015 /*
2016  * Reading and writing from/to the BBP is different from RT2560 and RT2661.
2017  * We access the BBP through the 8051 microcontroller unit which means that
2018  * the microcode must be loaded first.
2019  */
2020 static uint8_t
2021 rt2860_mcu_bbp_read(struct rt2860_softc *sc, uint8_t reg)
2022 {
2023         uint32_t val;
2024         int ntries;
2025 
2026         for (ntries = 0; ntries < 100; ntries++) {
2027                 if (!(RT2860_READ(sc,
2028                     RT2860_H2M_BBPAGENT) & RT2860_BBP_CSR_KICK))
2029                         break;
2030                 DELAY(1);
2031         }
2032         if (ntries == 100) {
2033                 RWN_DEBUG(RT2860_DBG_FW, "rwn: rt2860_mcu_bbp_read():"
2034                     "could not read from BBP through MCU\n");
2035                 return (0);
2036         }
2037 
2038         RT2860_WRITE(sc, RT2860_H2M_BBPAGENT, RT2860_BBP_RW_PARALLEL |
2039             RT2860_BBP_CSR_KICK | RT2860_BBP_CSR_READ | reg << 8);
2040 
2041         (void) rt2860_mcu_cmd(sc, RT2860_MCU_CMD_BBP, 0);
2042         DELAY(1000);
2043 
2044         for (ntries = 0; ntries < 100; ntries++) {
2045                 val = RT2860_READ(sc, RT2860_H2M_BBPAGENT);
2046                 if (!(val & RT2860_BBP_CSR_KICK))
2047                         return (val & 0xff);
2048                 DELAY(1);
2049         }
2050         RWN_DEBUG(RT2860_DBG_FW, "rwn: rt2860_mcu_bbp_read():"
2051             "could not read from BBP through MCU\n");
2052 
2053         return (0);
2054 }
2055 
2056 static void
2057 rt2860_mcu_bbp_write(struct rt2860_softc *sc, uint8_t reg, uint8_t val)
2058 {
2059         int ntries;
2060 
2061         for (ntries = 0; ntries < 100; ntries++) {
2062                 if (!(RT2860_READ(sc,
2063                     RT2860_H2M_BBPAGENT) & RT2860_BBP_CSR_KICK))
2064                         break;
2065                 DELAY(1);
2066         }
2067         if (ntries == 100) {
2068                 RWN_DEBUG(RT2860_DBG_FW, "rwn: rt2860_mcu_bbp_write():"
2069                     "could not write to BBP through MCU\n");
2070                 return;
2071         }
2072 
2073         RT2860_WRITE(sc, RT2860_H2M_BBPAGENT, RT2860_BBP_RW_PARALLEL |
2074             RT2860_BBP_CSR_KICK | reg << 8 | val);
2075 
2076         (void) rt2860_mcu_cmd(sc, RT2860_MCU_CMD_BBP, 0);
2077         DELAY(1000);
2078 }
2079 
2080 static int
2081 rt2860_bbp_init(struct rt2860_softc *sc)
2082 {
2083         int i, ntries;
2084 
2085         /* wait for BBP to wake up */
2086         for (ntries = 0; ntries < 20; ntries++) {
2087                 uint8_t bbp0 = rt2860_mcu_bbp_read(sc, 0);
2088                 if (bbp0 != 0 && bbp0 != 0xff)
2089                         break;
2090         }
2091         if (ntries == 20) {
2092                 RWN_DEBUG(RT2860_DBG_FW, "rwn: rt2860_bbp_init():"
2093                     "timeout waiting for BBP to wake up\n");
2094                 return (ETIMEDOUT);
2095         }
2096 
2097         /* initialize BBP registers to default values */
2098         for (i = 0; i < 12; i++) {
2099                 rt2860_mcu_bbp_write(sc, rt2860_def_bbp[i].reg,
2100                     rt2860_def_bbp[i].val);
2101         }
2102 
2103         /* fix BBP69 and BBP73 for RT2860C */
2104         if (sc->mac_rev == 0x28600100) {
2105                 rt2860_mcu_bbp_write(sc, 69, 0x16);
2106                 rt2860_mcu_bbp_write(sc, 73, 0x12);
2107         }
2108 
2109         return (0);
2110 }
2111 
2112 static void
2113 rt2860_rf_write(struct rt2860_softc *sc, uint8_t reg, uint32_t val)
2114 {
2115         uint32_t tmp;
2116         int ntries;
2117 
2118         for (ntries = 0; ntries < 100; ntries++) {
2119                 if (!(RT2860_READ(sc, RT2860_RF_CSR_CFG0) & RT2860_RF_REG_CTRL))
2120                         break;
2121                 DELAY(1);
2122         }
2123         if (ntries == 100) {
2124                 RWN_DEBUG(RT2860_DBG_FW, "rwn: rwn_init()"
2125                     "could not write to RF\n");
2126                 return;
2127         }
2128 
2129         /* RF registers are 24-bit on the RT2860 */
2130         tmp = RT2860_RF_REG_CTRL | 24 << RT2860_RF_REG_WIDTH_SHIFT |
2131             (val & 0x3fffff) << 2 | (reg & 3);
2132         RT2860_WRITE(sc, RT2860_RF_CSR_CFG0, tmp);
2133 }
2134 
2135 static void
2136 rt2860_select_chan_group(struct rt2860_softc *sc, int group)
2137 {
2138         uint32_t tmp;
2139 
2140         rt2860_mcu_bbp_write(sc, 62, 0x37 - sc->lna[group]);
2141         rt2860_mcu_bbp_write(sc, 63, 0x37 - sc->lna[group]);
2142         rt2860_mcu_bbp_write(sc, 64, 0x37 - sc->lna[group]);
2143         rt2860_mcu_bbp_write(sc, 82, (group == 0) ? 0x62 : 0xf2);
2144 
2145         tmp = RT2860_READ(sc, RT2860_TX_BAND_CFG);
2146         tmp &= ~(RT2860_5G_BAND_SEL_N | RT2860_5G_BAND_SEL_P);
2147         tmp |= (group == 0) ? RT2860_5G_BAND_SEL_N : RT2860_5G_BAND_SEL_P;
2148         RT2860_WRITE(sc, RT2860_TX_BAND_CFG, tmp);
2149 
2150         /* enable appropriate Power Amplifiers and Low Noise Amplifiers */
2151         tmp = RT2860_RFTR_EN | RT2860_TRSW_EN;
2152         if (group == 0) {       /* 2GHz */
2153                 tmp |= RT2860_PA_PE_G0_EN | RT2860_LNA_PE_G0_EN;
2154                 if (sc->ntxchains > 1)
2155                         tmp |= RT2860_PA_PE_G1_EN;
2156                 if (sc->nrxchains > 1)
2157                         tmp |= RT2860_LNA_PE_G1_EN;
2158         } else {                /* 5GHz */
2159                 tmp |= RT2860_PA_PE_A0_EN | RT2860_LNA_PE_A0_EN;
2160                 if (sc->ntxchains > 1)
2161                         tmp |= RT2860_PA_PE_A1_EN;
2162                 if (sc->nrxchains > 1)
2163                         tmp |= RT2860_LNA_PE_A1_EN;
2164         }
2165         RT2860_WRITE(sc, RT2860_TX_PIN_CFG, tmp);
2166 
2167         rt2860_mcu_bbp_write(sc, 66, 0x2e + sc->lna[group]);
2168 }
2169 static void
2170 rt2860_set_chan(struct rt2860_softc *sc, struct ieee80211_channel *c)
2171 {
2172         struct ieee80211com     *ic = &sc->sc_ic;
2173         const struct rfprog     *rfprog = rt2860_rf2850;
2174         uint_t                  i, chan, group;
2175         uint8_t                 txpow1, txpow2;
2176         uint32_t                r2, r3, r4;
2177 
2178         chan = ieee80211_chan2ieee(ic, c);
2179         if (chan == 0 || chan == IEEE80211_CHAN_ANY) {
2180                 RWN_DEBUG(RT2860_DBG_FW, "Unkonwn channel!\n");
2181                 return;
2182         }
2183 
2184         /* find the settings for this channel (we know it exists) */
2185         for (i = 0; rfprog[i].chan != chan; )
2186                 i++;
2187 
2188         r2 = rfprog[i].r2;
2189         if (sc->ntxchains == 1)
2190                 r2 |= 1 << 12;            /* 1T: disable Tx chain 2 */
2191         if (sc->nrxchains == 1)
2192                 r2 |= 1 << 15 | 1 << 4;     /* 1R: disable Rx chains 2 & 3 */
2193         else if (sc->nrxchains == 2)
2194                 r2 |= 1 << 4;             /* 2R: disable Rx chain 3 */
2195 
2196         /* use Tx power values from EEPROM */
2197         txpow1 = sc->txpow1[i];
2198         txpow2 = sc->txpow2[i];
2199         if (IEEE80211_IS_CHAN_5GHZ(c)) {
2200                 txpow1 = txpow1 << 1 | 1;
2201                 txpow2 = txpow2 << 1 | 1;
2202         }
2203         r3 = rfprog[i].r3 | txpow1 << 7;
2204         r4 = rfprog[i].r4 | sc->freq << 13 | txpow2 << 4;
2205 
2206         rt2860_rf_write(sc, RAL_RF1, rfprog[i].r1);
2207         rt2860_rf_write(sc, RAL_RF2, r2);
2208         rt2860_rf_write(sc, RAL_RF3, r3);
2209         rt2860_rf_write(sc, RAL_RF4, r4);
2210 
2211         DELAY(200);
2212 
2213         rt2860_rf_write(sc, RAL_RF1, rfprog[i].r1);
2214         rt2860_rf_write(sc, RAL_RF2, r2);
2215         rt2860_rf_write(sc, RAL_RF3, r3 | 1);
2216         rt2860_rf_write(sc, RAL_RF4, r4);
2217 
2218         DELAY(200);
2219 
2220         rt2860_rf_write(sc, RAL_RF1, rfprog[i].r1);
2221         rt2860_rf_write(sc, RAL_RF2, r2);
2222         rt2860_rf_write(sc, RAL_RF3, r3);
2223         rt2860_rf_write(sc, RAL_RF4, r4);
2224 
2225         /* 802.11a uses a 16 microseconds short interframe space */
2226         sc->sifs = IEEE80211_IS_CHAN_5GHZ(c) ? 16 : 10;
2227 
2228         /* determine channel group */
2229         if (chan <= 14)
2230                 group = 0;
2231         else if (chan <= 64)
2232                 group = 1;
2233         else if (chan <= 128)
2234                 group = 2;
2235         else
2236                 group = 3;
2237 
2238         /* XXX necessary only when group has changed! */
2239         rt2860_select_chan_group(sc, group);
2240 
2241         DELAY(1000);
2242 }
2243 
2244 static void
2245 rt2860_updateprot(struct ieee80211com *ic)
2246 {
2247         struct rt2860_softc *sc = (struct rt2860_softc *)ic;
2248         uint32_t tmp;
2249 
2250         tmp = RT2860_RTSTH_EN | RT2860_PROT_NAV_SHORT | RT2860_TXOP_ALLOW_ALL;
2251         /* setup protection frame rate (MCS code) */
2252         tmp |= (ic->ic_curmode == IEEE80211_MODE_11A) ? 0 : 3;
2253 
2254         /* CCK frames don't require protection */
2255         RT2860_WRITE(sc, RT2860_CCK_PROT_CFG, tmp);
2256 
2257         if (ic->ic_flags & IEEE80211_F_USEPROT) {
2258                 if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
2259                         tmp |= RT2860_PROT_CTRL_RTS_CTS;
2260                 else if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
2261                         tmp |= RT2860_PROT_CTRL_CTS;
2262         }
2263         RT2860_WRITE(sc, RT2860_OFDM_PROT_CFG, tmp);
2264 }
2265 
2266 static void
2267 rt2860_set_leds(struct rt2860_softc *sc, uint16_t which)
2268 {
2269         (void) rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LEDS,
2270             which | (sc->leds & 0x7f));
2271 }
2272 
2273 static int
2274 rt2860_init(struct rt2860_softc *sc)
2275 {
2276 #define N(a)    (sizeof (a) / sizeof ((a)[0]))
2277         struct ieee80211com     *ic;
2278         int                     i, err, qid, ridx, ntries;
2279         uint8_t                 bbp1, bbp3;
2280         uint32_t                tmp;
2281 
2282         ic = &sc->sc_ic;
2283 
2284         rt2860_stop(sc);
2285         tmp = RT2860_READ(sc, RT2860_WPDMA_GLO_CFG);
2286         tmp &= 0xff0;
2287         RT2860_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp | RT2860_TX_WB_DDONE);
2288 
2289         RT2860_WRITE(sc, RT2860_WPDMA_RST_IDX, 0xffffffff);
2290 
2291         /* PBF hardware reset */
2292         RT2860_WRITE(sc, RT2860_SYS_CTRL, 0xe1f);
2293         RT2860_WRITE(sc, RT2860_SYS_CTRL, 0xe00);
2294 
2295         if (!(sc->sc_flags & RT2860_FWLOADED)) {
2296                 if ((err = rt2860_load_microcode(sc)) != 0) {
2297                         RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_init(): "
2298                             "could not load 8051 microcode\n");
2299                         rt2860_stop(sc);
2300                         return (err);
2301                 }
2302                 RT2860_GLOCK(sc);
2303                 sc->sc_flags |= RT2860_FWLOADED;
2304                 RT2860_GUNLOCK(sc);
2305         }
2306 
2307         rt2860_set_macaddr(sc, ic->ic_macaddr);
2308 
2309         /* init Tx power for all Tx rates (from EEPROM) */
2310         for (ridx = 0; ridx < 5; ridx++) {
2311                 if (sc->txpow20mhz[ridx] == 0xffffffff)
2312                         continue;
2313                 RT2860_WRITE(sc, RT2860_TX_PWR_CFG(ridx), sc->txpow20mhz[ridx]);
2314         }
2315 
2316         for (ntries = 0; ntries < 100; ntries++) {
2317                 tmp = RT2860_READ(sc, RT2860_WPDMA_GLO_CFG);
2318                 if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
2319                         break;
2320                 DELAY(1000);
2321         }
2322         if (ntries == 100) {
2323                 RWN_DEBUG(RT2860_DBG_DMA, "rwn: rt2860_init():"
2324                     "timeout waiting for DMA engine\n");
2325                 rt2860_stop(sc);
2326                 return (ETIMEDOUT);
2327         }
2328         tmp &= 0xff0;
2329         RT2860_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp | RT2860_TX_WB_DDONE);
2330 
2331         /* reset Rx ring and all 6 Tx rings */
2332         RT2860_WRITE(sc, RT2860_WPDMA_RST_IDX, 0x1003f);
2333 
2334         /* PBF hardware reset */
2335         RT2860_WRITE(sc, RT2860_SYS_CTRL, 0xe1f);
2336         RT2860_WRITE(sc, RT2860_SYS_CTRL, 0xe00);
2337 
2338         RT2860_WRITE(sc, RT2860_MAC_SYS_CTRL,
2339             RT2860_BBP_HRST | RT2860_MAC_SRST);
2340         RT2860_WRITE(sc, RT2860_MAC_SYS_CTRL, 0);
2341 
2342         for (i = 0; i < N(rt2860_def_mac); i++)
2343                 RT2860_WRITE(sc, rt2860_def_mac[i].reg, rt2860_def_mac[i].val);
2344 
2345         /* wait while MAC is busy */
2346         for (ntries = 0; ntries < 100; ntries++) {
2347                 if (!(RT2860_READ(sc, RT2860_MAC_STATUS_REG) &
2348                     (RT2860_RX_STATUS_BUSY | RT2860_TX_STATUS_BUSY)))
2349                         break;
2350                 DELAY(1000);
2351         }
2352         if (ntries == 100) {
2353                 RWN_DEBUG(RT2860_DBG_FW, "rwn: rt2860_init():"
2354                     "timeout waiting for MAC\n");
2355                 rt2860_stop(sc);
2356                 return (ETIMEDOUT);
2357         }
2358 
2359         /* clear Host to MCU mailbox */
2360         RT2860_WRITE(sc, RT2860_H2M_BBPAGENT, 0);
2361         RT2860_WRITE(sc, RT2860_H2M_MAILBOX, 0);
2362 
2363         if ((err = rt2860_bbp_init(sc)) != 0) {
2364                 rt2860_stop(sc);
2365                 return (err);
2366         }
2367 
2368         /* init Tx rings (4 EDCAs + HCCA + Mgt) */
2369         for (qid = 0; qid < 6; qid++) {
2370                 RT2860_WRITE(sc, RT2860_TX_BASE_PTR(qid), sc->txq[qid].paddr);
2371                 RT2860_WRITE(sc, RT2860_TX_MAX_CNT(qid), RT2860_TX_RING_COUNT);
2372                 RT2860_WRITE(sc, RT2860_TX_CTX_IDX(qid), 0);
2373         }
2374 
2375         /* init Rx ring */
2376         RT2860_WRITE(sc, RT2860_RX_BASE_PTR, sc->rxq.paddr);
2377         RT2860_WRITE(sc, RT2860_RX_MAX_CNT, RT2860_RX_RING_COUNT);
2378         RT2860_WRITE(sc, RT2860_RX_CALC_IDX, RT2860_RX_RING_COUNT - 1);
2379 
2380         /* setup maximum buffer sizes */
2381         RT2860_WRITE(sc, RT2860_MAX_LEN_CFG, 1 << 12 |
2382             (sc->sc_dmabuf_size - sizeof (struct rt2860_rxwi) - 2));
2383 
2384         for (ntries = 0; ntries < 100; ntries++) {
2385                 tmp = RT2860_READ(sc, RT2860_WPDMA_GLO_CFG);
2386                 if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
2387                         break;
2388                 DELAY(1000);
2389         }
2390         if (ntries == 100) {
2391                 RWN_DEBUG(RT2860_DBG_DMA, "rwn: rt2860_init():"
2392                     "timeout waiting for DMA engine\n");
2393                 rt2860_stop(sc);
2394                 return (ETIMEDOUT);
2395         }
2396         tmp &= 0xff0;
2397         RT2860_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp | RT2860_TX_WB_DDONE);
2398 
2399         /* disable interrupts mitigation */
2400         RT2860_WRITE(sc, RT2860_DELAY_INT_CFG, 0);
2401 
2402         /* write vendor-specific BBP values (from EEPROM) */
2403         for (i = 0; i < 8; i++) {
2404                 if (sc->bbp[i].reg == 0 || sc->bbp[i].reg == 0xff)
2405                         continue;
2406                 rt2860_mcu_bbp_write(sc, sc->bbp[i].reg, sc->bbp[i].val);
2407         }
2408 
2409         /* send LEDs operating mode to microcontroller */
2410         (void) rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LED1, sc->led[0]);
2411         (void) rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LED2, sc->led[1]);
2412         (void) rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LED3, sc->led[2]);
2413 
2414         /* disable non-existing Rx chains */
2415         bbp3 = rt2860_mcu_bbp_read(sc, 3);
2416         bbp3 &= ~(1 << 3 | 1 << 4);
2417         if (sc->nrxchains == 2)
2418                 bbp3 |= 1 << 3;
2419         else if (sc->nrxchains == 3)
2420                 bbp3 |= 1 << 4;
2421         rt2860_mcu_bbp_write(sc, 3, bbp3);
2422 
2423         /* disable non-existing Tx chains */
2424         bbp1 = rt2860_mcu_bbp_read(sc, 1);
2425         if (sc->ntxchains == 1)
2426                 bbp1 &= ~(1 << 3 | 1 << 4);
2427         rt2860_mcu_bbp_write(sc, 1, bbp1);
2428 
2429         /* select default channel */
2430         rt2860_set_chan(sc, ic->ic_curchan);
2431 
2432         /* XXX not clear what the following 8051 command does.. */
2433         (void) rt2860_mcu_cmd(sc, RT2860_MCU_CMD_BOOT, 0);
2434 
2435         /* set RTS threshold */
2436         tmp = RT2860_READ(sc, RT2860_TX_RTS_CFG);
2437         tmp &= ~0xffff00;
2438         tmp |= ic->ic_rtsthreshold << 8;
2439 
2440         /* setup initial protection mode */
2441         sc->sc_ic_flags = ic->ic_flags;
2442         rt2860_updateprot(ic);
2443 
2444         /* enable Tx/Rx DMA engine */
2445         RT2860_WRITE(sc, RT2860_MAC_SYS_CTRL, RT2860_MAC_TX_EN);
2446         for (ntries = 0; ntries < 200; ntries++) {
2447                 tmp = RT2860_READ(sc, RT2860_WPDMA_GLO_CFG);
2448                 if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
2449                         break;
2450                 DELAY(1000);
2451         }
2452         if (ntries == 200) {
2453                 RWN_DEBUG(RT2860_DBG_DMA, "rwn: rt2860_int():"
2454                     "timeout waiting for DMA engine\n");
2455                 rt2860_stop(sc);
2456                 return (ETIMEDOUT);
2457         }
2458 
2459         DELAY(50);
2460 
2461         tmp |= RT2860_TX_WB_DDONE | RT2860_RX_DMA_EN | RT2860_TX_DMA_EN |
2462             RT2860_WPDMA_BT_SIZE64 << RT2860_WPDMA_BT_SIZE_SHIFT;
2463         RT2860_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp);
2464 
2465         /* turn radio LED on */
2466         rt2860_set_leds(sc, RT2860_LED_RADIO);
2467 
2468         /* set Rx filter */
2469         tmp = RT2860_DROP_CRC_ERR | RT2860_DROP_PHY_ERR;
2470         if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2471                 tmp |= RT2860_DROP_UC_NOME | RT2860_DROP_DUPL |
2472                     RT2860_DROP_CTS | RT2860_DROP_BA | RT2860_DROP_ACK |
2473                     RT2860_DROP_VER_ERR | RT2860_DROP_CTRL_RSV |
2474                     RT2860_DROP_CFACK | RT2860_DROP_CFEND;
2475                 if (ic->ic_opmode == IEEE80211_M_STA)
2476                         tmp |= RT2860_DROP_RTS | RT2860_DROP_PSPOLL;
2477         }
2478         RT2860_WRITE(sc, RT2860_RX_FILTR_CFG, tmp);
2479 
2480         RT2860_WRITE(sc, RT2860_MAC_SYS_CTRL,
2481             RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
2482 
2483         /* clear pending interrupts */
2484         RT2860_WRITE(sc, RT2860_INT_STATUS, 0xffffffff);
2485         /* enable interrupts */
2486         RT2860_WRITE(sc, RT2860_INT_MASK, 0x3fffc);
2487 
2488         if (sc->sc_flags & RT2860_ADVANCED_PS)
2489                 (void) rt2860_mcu_cmd(sc, RT2860_MCU_CMD_PSLEVEL, sc->pslevel);
2490 
2491         return (DDI_SUCCESS);
2492 }
2493 
2494 static int
2495 rt2860_quiesce(dev_info_t *dip)
2496 {
2497         struct rt2860_softc     *sc;
2498 
2499         sc = ddi_get_soft_state(rt2860_soft_state_p, ddi_get_instance(dip));
2500         if (sc == NULL)
2501                 return (DDI_FAILURE);
2502 
2503 #ifdef DEBUG
2504         rt2860_dbg_flags = 0;
2505 #endif
2506 
2507         /*
2508          * No more blocking is allowed while we are in quiesce(9E) entry point
2509          */
2510         sc->sc_flags |= RT2860_F_QUIESCE;
2511 
2512         /*
2513          * Disable and mask all interrupts
2514          */
2515         rt2860_stop(sc);
2516         return (DDI_SUCCESS);
2517 }
2518 
2519 static void
2520 rt2860_stop(struct rt2860_softc *sc)
2521 {
2522         int             qid;
2523         uint32_t        tmp;
2524 
2525         /* by pass if it's quiesced */
2526         if (!(sc->sc_flags & RT2860_F_QUIESCE))
2527                 RT2860_GLOCK(sc);
2528         if (sc->sc_flags == RT2860_F_RUNNING)
2529                 rt2860_set_leds(sc, 0); /* turn all LEDs off */
2530         sc->sc_tx_timer = 0;
2531         /* by pass if it's quiesced */
2532         if (!(sc->sc_flags & RT2860_F_QUIESCE))
2533                 RT2860_GUNLOCK(sc);
2534 
2535         /* clear RX WCID search table */
2536         rt2860_set_region_4(sc, RT2860_WCID_ENTRY(0), 0, 512);
2537         /* clear pairwise key table */
2538         rt2860_set_region_4(sc, RT2860_PKEY(0), 0, 2048);
2539         /* clear IV/EIV table */
2540         rt2860_set_region_4(sc, RT2860_IVEIV(0), 0, 512);
2541         /* clear WCID attribute table */
2542         rt2860_set_region_4(sc, RT2860_WCID_ATTR(0), 0, 256);
2543         /* clear shared key table */
2544         rt2860_set_region_4(sc, RT2860_SKEY(0, 0), 0, 8 * 32);
2545         /* clear shared key mode */
2546         rt2860_set_region_4(sc, RT2860_SKEY_MODE_0_7, 0, 4);
2547 
2548         /* disable interrupts */
2549         RT2860_WRITE(sc, RT2860_INT_MASK, 0);
2550 
2551         /* disable Rx */
2552         tmp = RT2860_READ(sc, RT2860_MAC_SYS_CTRL);
2553         tmp &= ~(RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
2554         RT2860_WRITE(sc, RT2860_MAC_SYS_CTRL, tmp);
2555 
2556         /* reset adapter */
2557         RT2860_WRITE(sc, RT2860_MAC_SYS_CTRL,
2558             RT2860_BBP_HRST | RT2860_MAC_SRST);
2559         RT2860_WRITE(sc, RT2860_MAC_SYS_CTRL, 0);
2560 
2561         /* reset Tx and Rx rings (and reclaim TXWIs) */
2562         for (qid = 0; qid < 6; qid++)
2563                 rt2860_reset_tx_ring(sc, &sc->txq[qid]);
2564         rt2860_reset_rx_ring(sc, &sc->rxq);
2565 
2566         /* by pass if it's quiesced */
2567         if (!(sc->sc_flags & RT2860_F_QUIESCE))
2568                 RT2860_GLOCK(sc);
2569         sc->sc_flags &= ~RT2860_UPD_BEACON;
2570         /* by pass if it's quiesced */
2571         if (!(sc->sc_flags & RT2860_F_QUIESCE))
2572                 RT2860_GUNLOCK(sc);
2573 }
2574 
2575 static int
2576 rt2860_m_start(void *arg)
2577 {
2578         struct rt2860_softc     *sc = (struct rt2860_softc *)arg;
2579         struct ieee80211com     *ic = &sc->sc_ic;
2580         int                     err;
2581 
2582         err = rt2860_init(sc);
2583         if (err != DDI_SUCCESS) {
2584                 RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_m_start():"
2585                     "Hardware initialization failed\n");
2586                 goto fail1;
2587         }
2588 
2589         ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2590 
2591         RT2860_GLOCK(sc);
2592         sc->sc_flags |= RT2860_F_RUNNING;
2593         RT2860_GUNLOCK(sc);
2594 
2595         return (err);
2596 fail1:
2597         rt2860_stop(sc);
2598         return (err);
2599 }
2600 
2601 static void
2602 rt2860_m_stop(void *arg)
2603 {
2604         struct rt2860_softc *sc = (struct rt2860_softc *)arg;
2605 
2606         (void) rt2860_stop(sc);
2607 
2608         ieee80211_new_state(&sc->sc_ic, IEEE80211_S_INIT, -1);
2609 
2610         RT2860_GLOCK(sc);
2611         sc->sc_flags &= ~RT2860_F_RUNNING;
2612         RT2860_GUNLOCK(sc);
2613 }
2614 
2615 static void
2616 rt2860_m_ioctl(void* arg, queue_t *wq, mblk_t *mp)
2617 {
2618         struct rt2860_softc     *sc = (struct rt2860_softc *)arg;
2619         struct ieee80211com     *ic = &sc->sc_ic;
2620         int                     err;
2621 
2622         err = ieee80211_ioctl(ic, wq, mp);
2623         RT2860_GLOCK(sc);
2624         if (err == ENETRESET) {
2625                 if (ic->ic_des_esslen) {
2626                         if (RT2860_IS_RUNNING(sc)) {
2627                                 RT2860_GUNLOCK(sc);
2628                                 (void) rt2860_init(sc);
2629                                 (void) ieee80211_new_state(ic,
2630                                     IEEE80211_S_SCAN, -1);
2631                                 RT2860_GLOCK(sc);
2632                         }
2633                 }
2634         }
2635         RT2860_GUNLOCK(sc);
2636 }
2637 
2638 /*
2639  * Call back function for get/set proporty
2640  */
2641 static int
2642 rt2860_m_getprop(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
2643     uint_t wldp_length, void *wldp_buf)
2644 {
2645         struct rt2860_softc     *sc = (struct rt2860_softc *)arg;
2646         int                     err = 0;
2647 
2648         err = ieee80211_getprop(&sc->sc_ic, pr_name, wldp_pr_num,
2649             wldp_length, wldp_buf);
2650 
2651         return (err);
2652 }
2653 
2654 static void
2655 rt2860_m_propinfo(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
2656     mac_prop_info_handle_t prh)
2657 {
2658         struct rt2860_softc     *sc = (struct rt2860_softc *)arg;
2659 
2660         ieee80211_propinfo(&sc->sc_ic, pr_name, wldp_pr_num, prh);
2661 }
2662 
2663 static int
2664 rt2860_m_setprop(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
2665     uint_t wldp_length, const void *wldp_buf)
2666 {
2667         struct rt2860_softc     *sc = (struct rt2860_softc *)arg;
2668         ieee80211com_t          *ic = &sc->sc_ic;
2669         int                     err;
2670 
2671         err = ieee80211_setprop(ic, pr_name, wldp_pr_num, wldp_length,
2672             wldp_buf);
2673         RT2860_GLOCK(sc);
2674         if (err == ENETRESET) {
2675                 if (ic->ic_des_esslen) {
2676                         if (RT2860_IS_RUNNING(sc)) {
2677                                 RT2860_GUNLOCK(sc);
2678                                 (void) rt2860_init(sc);
2679                                 (void) ieee80211_new_state(ic,
2680                                     IEEE80211_S_SCAN, -1);
2681                                 RT2860_GLOCK(sc);
2682                         }
2683                 }
2684                 err = 0;
2685         }
2686         RT2860_GUNLOCK(sc);
2687         return (err);
2688 }
2689 
2690 static mblk_t *
2691 rt2860_m_tx(void *arg, mblk_t *mp)
2692 {
2693         struct rt2860_softc     *sc = (struct rt2860_softc *)arg;
2694         struct ieee80211com     *ic = &sc->sc_ic;
2695         mblk_t                  *next;
2696 
2697         if (RT2860_IS_SUSPEND(sc)) {
2698                 freemsgchain(mp);
2699                 return (NULL);
2700         }
2701 
2702         /*
2703          * No data frames go out unless we're associated; this
2704          * should not happen as the 802.11 layer does not enable
2705          * the xmit queue until we enter the RUN state.
2706          */
2707         if (ic->ic_state != IEEE80211_S_RUN) {
2708                 RWN_DEBUG(RT2860_DBG_TX, "rwn: rt2860_tx_data(): "
2709                     "discard, state %u\n", ic->ic_state);
2710                 freemsgchain(mp);
2711                 return (NULL);
2712         }
2713 
2714         while (mp != NULL) {
2715                 next = mp->b_next;
2716                 mp->b_next = NULL;
2717                 if (rt2860_send(ic, mp, IEEE80211_FC0_TYPE_DATA) !=
2718                     DDI_SUCCESS) {
2719                         mp->b_next = next;
2720                         break;
2721                 }
2722                 mp = next;
2723         }
2724         return (mp);
2725 }
2726 
2727 /*ARGSUSED*/
2728 static int
2729 rt2860_m_unicst(void *arg, const uint8_t *macaddr)
2730 {
2731         return (ENOTSUP);
2732 }
2733 
2734 /*ARGSUSED*/
2735 static int
2736 rt2860_m_multicst(void *arg, boolean_t add, const uint8_t *mca)
2737 {
2738         return (ENOTSUP);
2739 }
2740 
2741 /*ARGSUSED*/
2742 static int
2743 rt2860_m_promisc(void *arg, boolean_t on)
2744 {
2745         return (0);
2746 }
2747 
2748 static int
2749 rt2860_m_stat(void *arg, uint_t stat, uint64_t *val)
2750 {
2751         struct rt2860_softc     *sc  = (struct rt2860_softc *)arg;
2752         ieee80211com_t          *ic = &sc->sc_ic;
2753         ieee80211_node_t        *ni = ic->ic_bss;
2754         struct ieee80211_rateset *rs = &ni->in_rates;
2755 
2756         RT2860_GLOCK(sc);
2757         switch (stat) {
2758         case MAC_STAT_IFSPEED:
2759                 *val = ((ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE) ?
2760                     (rs->ir_rates[ni->in_txrate] & IEEE80211_RATE_VAL)
2761                     : ic->ic_fixed_rate) / 2 * 1000000;
2762                 break;
2763         case MAC_STAT_NOXMTBUF:
2764                 *val = sc->sc_tx_nobuf;
2765                 break;
2766         case MAC_STAT_NORCVBUF:
2767                 *val = sc->sc_rx_nobuf;
2768                 break;
2769         case MAC_STAT_IERRORS:
2770                 *val = sc->sc_rx_err;
2771                 break;
2772         case MAC_STAT_RBYTES:
2773                 *val = ic->ic_stats.is_rx_bytes;
2774                 break;
2775         case MAC_STAT_IPACKETS:
2776                 *val = ic->ic_stats.is_rx_frags;
2777                 break;
2778         case MAC_STAT_OBYTES:
2779                 *val = ic->ic_stats.is_tx_bytes;
2780                 break;
2781         case MAC_STAT_OPACKETS:
2782                 *val = ic->ic_stats.is_tx_frags;
2783                 break;
2784         case MAC_STAT_OERRORS:
2785         case WIFI_STAT_TX_FAILED:
2786                 *val = sc->sc_tx_err;
2787                 break;
2788         case WIFI_STAT_TX_RETRANS:
2789                 *val = sc->sc_tx_retries;
2790                 break;
2791         case WIFI_STAT_FCS_ERRORS:
2792         case WIFI_STAT_WEP_ERRORS:
2793         case WIFI_STAT_TX_FRAGS:
2794         case WIFI_STAT_MCAST_TX:
2795         case WIFI_STAT_RTS_SUCCESS:
2796         case WIFI_STAT_RTS_FAILURE:
2797         case WIFI_STAT_ACK_FAILURE:
2798         case WIFI_STAT_RX_FRAGS:
2799         case WIFI_STAT_MCAST_RX:
2800         case WIFI_STAT_RX_DUPS:
2801                 RT2860_GUNLOCK(sc);
2802                 return (ieee80211_stat(ic, stat, val));
2803         default:
2804                 RT2860_GUNLOCK(sc);
2805                 return (ENOTSUP);
2806         }
2807         RT2860_GUNLOCK(sc);
2808 
2809         return (0);
2810 }
2811 
2812 static int
2813 rt2860_attach(dev_info_t *devinfo, ddi_attach_cmd_t cmd)
2814 {
2815         struct rt2860_softc     *sc;
2816         struct ieee80211com     *ic;
2817         int                     i, err, qid, ntries, instance;
2818         uint8_t                 cachelsz;
2819         uint16_t                command, vendor_id, device_id;
2820         char                    strbuf[32];
2821         wifi_data_t             wd = { 0 };
2822         mac_register_t          *macp;
2823 
2824         switch (cmd) {
2825         case DDI_ATTACH:
2826                 break;
2827         case DDI_RESUME:
2828                 sc = ddi_get_soft_state(rt2860_soft_state_p,
2829                     ddi_get_instance(devinfo));
2830                 ASSERT(sc != NULL);
2831                 RT2860_GLOCK(sc);
2832                 sc->sc_flags &= ~RT2860_F_SUSPEND;
2833                 RT2860_GUNLOCK(sc);
2834                 if (RT2860_IS_RUNNING(sc))
2835                         (void) rt2860_init(sc);
2836                 RWN_DEBUG(RT2860_DBG_RESUME, "rwn: rt2860_attach(): "
2837                     "resume now\n");
2838                 return (DDI_SUCCESS);
2839         default:
2840                 return (DDI_FAILURE);
2841         }
2842 
2843         instance = ddi_get_instance(devinfo);
2844 
2845         err = ddi_soft_state_zalloc(rt2860_soft_state_p, instance);
2846         if (err != DDI_SUCCESS) {
2847                 RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach(): "
2848                     "unable to alloc soft_state_p\n");
2849                 return (err);
2850         }
2851 
2852         sc = ddi_get_soft_state(rt2860_soft_state_p, instance);
2853         ic = (ieee80211com_t *)&sc->sc_ic;
2854         sc->sc_dev = devinfo;
2855 
2856         /* pci configuration */
2857         err = ddi_regs_map_setup(devinfo, 0, &sc->sc_cfg_base, 0, 0,
2858             &rwn_csr_accattr, &sc->sc_cfg_handle);
2859         if (err != DDI_SUCCESS) {
2860                 RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach(): "
2861                     "ddi_regs_map_setup() failed");
2862                 goto fail1;
2863         }
2864 
2865         cachelsz = ddi_get8(sc->sc_cfg_handle,
2866             (uint8_t *)(sc->sc_cfg_base + PCI_CONF_CACHE_LINESZ));
2867         if (cachelsz == 0)
2868                 cachelsz = 0x10;
2869         sc->sc_cachelsz = cachelsz << 2;
2870         sc->sc_dmabuf_size = roundup(IEEE80211_MAX_LEN, sc->sc_cachelsz);
2871 
2872         vendor_id = ddi_get16(sc->sc_cfg_handle,
2873             (uint16_t *)((uintptr_t)(sc->sc_cfg_base) + PCI_CONF_VENID));
2874         device_id = ddi_get16(sc->sc_cfg_handle,
2875             (uint16_t *)((uintptr_t)(sc->sc_cfg_base) + PCI_CONF_DEVID));
2876         RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach(): "
2877             "vendor 0x%x, device id 0x%x, cache size %d\n",
2878             vendor_id, device_id, cachelsz);
2879 
2880         /*
2881          * Enable response to memory space accesses,
2882          * and enabe bus master.
2883          */
2884         command = PCI_COMM_MAE | PCI_COMM_ME;
2885         ddi_put16(sc->sc_cfg_handle,
2886             (uint16_t *)((uintptr_t)(sc->sc_cfg_base) + PCI_CONF_COMM),
2887             command);
2888         ddi_put8(sc->sc_cfg_handle,
2889             (uint8_t *)(sc->sc_cfg_base + PCI_CONF_LATENCY_TIMER), 0xa8);
2890         ddi_put8(sc->sc_cfg_handle,
2891             (uint8_t *)(sc->sc_cfg_base + PCI_CONF_ILINE), 0x10);
2892 
2893         /* pci i/o space */
2894         err = ddi_regs_map_setup(devinfo, 1,
2895             &sc->sc_io_base, 0, 0, &rwn_csr_accattr, &sc->sc_io_handle);
2896         if (err != DDI_SUCCESS) {
2897                 RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach(): "
2898                     "ddi_regs_map_setup() failed");
2899                 goto fail2;
2900         }
2901         RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach(): "
2902             "PCI configuration is done successfully\n");
2903 
2904         sc->amrr.amrr_min_success_threshold =  1;
2905         sc->amrr.amrr_max_success_threshold = 15;
2906 
2907         /* wait for NIC to initialize */
2908         for (ntries = 0; ntries < 100; ntries++) {
2909                 sc->mac_rev = RT2860_READ(sc, RT2860_ASIC_VER_ID);
2910                 if (sc->mac_rev != 0 && sc->mac_rev != 0xffffffff)
2911                         break;
2912                 DELAY(10);
2913         }
2914         if (ntries == 100) {
2915                 RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach(): "
2916                     "timeout waiting for NIC initialize\n");
2917                 return (DDI_FAILURE);
2918         }
2919 
2920         if ((sc->mac_rev >> 16) != 0x2860 &&
2921             (device_id == PRODUCT_RALINK_RT2890 ||
2922             device_id == PRODUCT_RALINK_RT2790 ||
2923             device_id == PRODUCT_AWT_RT2890))
2924                 sc->sc_flags |= RT2860_ADVANCED_PS;
2925 
2926         /* retrieve RF rev. no and various other things from EEPROM */
2927         (void) rt2860_read_eeprom(sc);
2928         RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach(): "
2929             "MAC/BBP RT%X (rev 0x%04X), RF %s (%dT%dR)\n",
2930             sc->mac_rev >> 16, sc->mac_rev & 0xffff,
2931             rt2860_get_rf(sc->rf_rev), sc->ntxchains, sc->nrxchains);
2932 
2933         /*
2934          * Allocate Tx (4 EDCAs + HCCA + Mgt) and Rx rings.
2935          */
2936         for (qid = 0; qid < 6; qid++) {
2937                 if ((err = rt2860_alloc_tx_ring(sc, &sc->txq[qid])) != 0) {
2938                         RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach(): "
2939                             "could not allocate Tx ring %d\n", qid);
2940                         goto fail3;
2941                 }
2942         }
2943 
2944         if ((err = rt2860_alloc_rx_ring(sc, &sc->rxq)) != 0) {
2945                 RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach(): "
2946                     "could not allocte Rx ring\n");
2947                 goto fail4;
2948         }
2949 
2950         if ((err = rt2860_alloc_tx_pool(sc)) != 0) {
2951                 RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach(): "
2952                     "could not allocte Tx pool\n");
2953                 goto fail5;
2954         }
2955 
2956         mutex_init(&sc->sc_genlock, NULL, MUTEX_DRIVER, NULL);
2957         mutex_init(&sc->sc_txlock, NULL, MUTEX_DRIVER, NULL);
2958         mutex_init(&sc->sc_rxlock, NULL, MUTEX_DRIVER, NULL);
2959 
2960         /* mgmt ring is broken on RT2860C, use EDCA AC VO ring instead */
2961         sc->mgtqid = (sc->mac_rev == 0x28600100) ? EDCA_AC_VO : 5;
2962         RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach():"
2963             "mgtqid = %x\n", sc->mgtqid);
2964 
2965         ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
2966         ic->ic_opmode = IEEE80211_M_STA; /* default to BSS mode */
2967         ic->ic_state = IEEE80211_S_INIT;
2968 
2969         /* set device capabilities */
2970         ic->ic_caps =
2971             IEEE80211_C_TXPMGT |        /* tx power management */
2972             IEEE80211_C_SHPREAMBLE |    /* short preamble supported */
2973             IEEE80211_C_SHSLOT;         /* short slot time supported */
2974 
2975         /* WPA/WPA2 support */
2976         ic->ic_caps |= IEEE80211_C_WPA; /* Support WPA/WPA2 */
2977 
2978         /* set supported .11b and .11g rates */
2979         ic->ic_sup_rates[IEEE80211_MODE_11B] = rt2860_rateset_11b;
2980         ic->ic_sup_rates[IEEE80211_MODE_11G] = rt2860_rateset_11g;
2981 
2982         /* set supported .11b and .11g channels (1 through 14) */
2983         for (i = 1; i <= 14; i++) {
2984                 ic->ic_sup_channels[i].ich_freq =
2985                     ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
2986                 ic->ic_sup_channels[i].ich_flags =
2987                     IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
2988                     IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
2989         }
2990 
2991         ic->ic_maxrssi = 63;
2992         ic->ic_xmit = rt2860_send;
2993 
2994         ieee80211_attach(ic);
2995 
2996         /* register WPA door */
2997         ieee80211_register_door(ic, ddi_driver_name(devinfo),
2998             ddi_get_instance(devinfo));
2999 
3000         /* override state transition machine */
3001         sc->sc_newstate = ic->ic_newstate;
3002         ic->ic_newstate = rt2860_newstate;
3003         ieee80211_media_init(ic);
3004         ic->ic_def_txkey = 0;
3005 
3006         err = ddi_add_softintr(devinfo, DDI_SOFTINT_LOW,
3007             &sc->sc_softintr_hdl, NULL, 0, rt2860_softintr, (caddr_t)sc);
3008         if (err != DDI_SUCCESS) {
3009                 RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach(): "
3010                     "ddi_add_softintr() failed");
3011                 goto fail8;
3012         }
3013 
3014         err = ddi_get_iblock_cookie(devinfo, 0, &sc->sc_iblock);
3015         if (err != DDI_SUCCESS) {
3016                 RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach(): "
3017                     "Can not get iblock cookie for INT\n");
3018                 goto fail7;
3019         }
3020 
3021         err = ddi_add_intr(devinfo, 0, NULL, NULL, rt2860_intr, (caddr_t)sc);
3022         if (err != DDI_SUCCESS) {
3023                 RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach(): "
3024                     "unable to add device interrupt handler\n");
3025                 goto fail7;
3026         }
3027 
3028         /*
3029          * Provide initial settings for the WiFi plugin; whenever this
3030          * information changes, we need to call mac_plugindata_update()
3031          */
3032         wd.wd_opmode = ic->ic_opmode;
3033         wd.wd_secalloc = WIFI_SEC_NONE;
3034         IEEE80211_ADDR_COPY(wd.wd_bssid, ic->ic_bss->in_bssid);
3035 
3036         if ((macp = mac_alloc(MAC_VERSION)) == NULL) {
3037                 RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach(): "
3038                     "MAC version mismatch\n");
3039                 goto fail9;
3040         }
3041 
3042         macp->m_type_ident   = MAC_PLUGIN_IDENT_WIFI;
3043         macp->m_driver               = sc;
3044         macp->m_dip          = devinfo;
3045         macp->m_src_addr     = ic->ic_macaddr;
3046         macp->m_callbacks    = &rt2860_m_callbacks;
3047         macp->m_min_sdu              = 0;
3048         macp->m_max_sdu              = IEEE80211_MTU;
3049         macp->m_pdata                = &wd;
3050         macp->m_pdata_size   = sizeof (wd);
3051 
3052         err = mac_register(macp, &ic->ic_mach);
3053         mac_free(macp);
3054         if (err != 0) {
3055                 RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach(): "
3056                     "mac_register err %x\n", err);
3057                 goto fail9;
3058         }
3059 
3060         /*
3061          * Create minor node of type DDI_NT_NET_WIFI
3062          */
3063         (void) snprintf(strbuf, sizeof (strbuf), "%s%d",
3064             "rwn", instance);
3065         err = ddi_create_minor_node(devinfo, strbuf, S_IFCHR,
3066             instance + 1, DDI_NT_NET_WIFI, 0);
3067 
3068         /*
3069          * Notify link is down now
3070          */
3071         mac_link_update(ic->ic_mach, LINK_STATE_DOWN);
3072 
3073         sc->sc_flags &= ~RT2860_F_RUNNING;
3074 
3075         RWN_DEBUG(RT2860_DBG_MSG, "rwn: rt2860_attach() successfully.\n");
3076         return (DDI_SUCCESS);
3077 fail9:
3078         ddi_remove_softintr(sc->sc_softintr_hdl);
3079 fail8:
3080         ddi_remove_intr(devinfo, 0, sc->sc_iblock);
3081 fail7:
3082         mutex_destroy(&sc->sc_genlock);
3083         mutex_destroy(&sc->sc_txlock);
3084         mutex_destroy(&sc->sc_rxlock);
3085 fail6:
3086         rt2860_free_tx_pool(sc);
3087 fail5:
3088         rt2860_free_rx_ring(sc, &sc->rxq);
3089 fail4:
3090         while (--qid >= 0)
3091                 rt2860_free_tx_ring(sc, &sc->txq[qid]);
3092 fail3:
3093         ddi_regs_map_free(&sc->sc_io_handle);
3094 fail2:
3095         ddi_regs_map_free(&sc->sc_cfg_handle);
3096 fail1:
3097         return (err);
3098 }
3099 
3100 static int
3101 rt2860_detach(dev_info_t *devinfo, ddi_detach_cmd_t cmd)
3102 {
3103         struct rt2860_softc     *sc;
3104         int                     qid;
3105 
3106         sc = ddi_get_soft_state(rt2860_soft_state_p, ddi_get_instance(devinfo));
3107 
3108         switch (cmd) {
3109         case DDI_DETACH:
3110                 break;
3111         case DDI_SUSPEND:
3112                 if (RT2860_IS_RUNNING(sc))
3113                         rt2860_stop(sc);
3114                 RT2860_GLOCK(sc);
3115                 sc->sc_flags &= ~RT2860_FWLOADED;
3116                 sc->sc_flags |= RT2860_F_SUSPEND;
3117                 RT2860_GUNLOCK(sc);
3118                 RWN_DEBUG(RT2860_DBG_RESUME, "rwn: rt2860_detach(): "
3119                     "suspend now\n");
3120                 return (DDI_SUCCESS);
3121         default:
3122                 return (DDI_FAILURE);
3123         }
3124 
3125         if (mac_disable(sc->sc_ic.ic_mach) != 0)
3126                 return (DDI_FAILURE);
3127 
3128         rt2860_stop(sc);
3129 
3130         /*
3131          * Unregister from the MAC layer subsystem
3132          */
3133         (void) mac_unregister(sc->sc_ic.ic_mach);
3134 
3135         ddi_remove_intr(devinfo, 0, sc->sc_iblock);
3136         ddi_remove_softintr(sc->sc_softintr_hdl);
3137 
3138         /*
3139          * detach ieee80211 layer
3140          */
3141         ieee80211_detach(&sc->sc_ic);
3142 
3143         rt2860_free_tx_pool(sc);
3144         rt2860_free_rx_ring(sc, &sc->rxq);
3145         for (qid = 0; qid < 6; qid++)
3146                 rt2860_free_tx_ring(sc, &sc->txq[qid]);
3147 
3148         ddi_regs_map_free(&sc->sc_io_handle);
3149 
3150         mutex_destroy(&sc->sc_genlock);
3151         mutex_destroy(&sc->sc_txlock);
3152         mutex_destroy(&sc->sc_rxlock);
3153 
3154         ddi_remove_minor_node(devinfo, NULL);
3155         ddi_soft_state_free(rt2860_soft_state_p, ddi_get_instance(devinfo));
3156 
3157         return (DDI_SUCCESS);
3158 }
3159 
3160 int
3161 _info(struct modinfo *modinfop)
3162 {
3163         return (mod_info(&modlinkage, modinfop));
3164 }
3165 
3166 int
3167 _init(void)
3168 {
3169         int status;
3170 
3171         status = ddi_soft_state_init(&rt2860_soft_state_p,
3172             sizeof (struct rt2860_softc), 1);
3173         if (status != 0)
3174                 return (status);
3175 
3176         mac_init_ops(&rwn_dev_ops, "rwn");
3177         status = mod_install(&modlinkage);
3178         if (status != 0) {
3179                 mac_fini_ops(&rwn_dev_ops);
3180                 ddi_soft_state_fini(&rt2860_soft_state_p);
3181         }
3182         return (status);
3183 }
3184 
3185 int
3186 _fini(void)
3187 {
3188         int status;
3189 
3190         status = mod_remove(&modlinkage);
3191         if (status == 0) {
3192                 mac_fini_ops(&rwn_dev_ops);
3193                 ddi_soft_state_fini(&rt2860_soft_state_p);
3194         }
3195         return (status);
3196 }