1 /*
   2  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
   3  * Use is subject to license terms.
   4  */
   5 
   6 /*
   7  * Copyright (c) 2005, 2006
   8  *      Damien Bergamini <damien.bergamini@free.fr>
   9  *
  10  * Permission to use, copy, modify, and distribute this software for any
  11  * purpose with or without fee is hereby granted, provided that the above
  12  * copyright notice and this permission notice appear in all copies.
  13  *
  14  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  15  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  16  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  17  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  18  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  19  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  20  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  21  */
  22 
  23 /*
  24  * Ralink Technology RT2560 chipset driver
  25  * http://www.ralinktech.com/
  26  */
  27 
  28 #include <sys/types.h>
  29 #include <sys/byteorder.h>
  30 #include <sys/cmn_err.h>
  31 #include <sys/stat.h>
  32 #include <sys/pci.h>
  33 #include <sys/ddi.h>
  34 #include <sys/sunddi.h>
  35 #include <sys/strsubr.h>
  36 #include <inet/common.h>
  37 #include <sys/note.h>
  38 #include <sys/strsun.h>
  39 #include <sys/modctl.h>
  40 #include <sys/devops.h>
  41 #include <sys/mac_provider.h>
  42 #include <sys/mac_wifi.h>
  43 #include <sys/net80211.h>
  44 
  45 #include "ral_rate.h"
  46 #include "rt2560_reg.h"
  47 #include "rt2560_var.h"
  48 
  49 static void *ral_soft_state_p = NULL;
  50 
  51 #define RAL_TXBUF_SIZE          (IEEE80211_MAX_LEN)
  52 #define RAL_RXBUF_SIZE          (IEEE80211_MAX_LEN)
  53 
  54 /* quickly determine if a given rate is CCK or OFDM */
  55 #define RAL_RATE_IS_OFDM(rate)  ((rate) >= 12 && (rate) != 22)
  56 #define RAL_ACK_SIZE            14      /* 10 + 4(FCS) */
  57 #define RAL_CTS_SIZE            14      /* 10 + 4(FCS) */
  58 #define RAL_SIFS                10      /* us */
  59 #define RT2560_TXRX_TURNAROUND  10      /* us */
  60 
  61 /*
  62  * Supported rates for 802.11a/b/g modes (in 500Kbps unit).
  63  */
  64 static const struct ieee80211_rateset rt2560_rateset_11a =
  65         { 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
  66 
  67 static const struct ieee80211_rateset rt2560_rateset_11b =
  68         { 4, { 2, 4, 11, 22 } };
  69 
  70 static const struct ieee80211_rateset rt2560_rateset_11g =
  71         { 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
  72 
  73 static const struct {
  74         uint32_t        reg;
  75         uint32_t        val;
  76 } rt2560_def_mac[] = {
  77         RT2560_DEF_MAC
  78 };
  79 
  80 static const struct {
  81         uint8_t reg;
  82         uint8_t val;
  83 } rt2560_def_bbp[] = {
  84         RT2560_DEF_BBP
  85 };
  86 
  87 static const uint32_t rt2560_rf2522_r2[]    = RT2560_RF2522_R2;
  88 static const uint32_t rt2560_rf2523_r2[]    = RT2560_RF2523_R2;
  89 static const uint32_t rt2560_rf2524_r2[]    = RT2560_RF2524_R2;
  90 static const uint32_t rt2560_rf2525_r2[]    = RT2560_RF2525_R2;
  91 static const uint32_t rt2560_rf2525_hi_r2[] = RT2560_RF2525_HI_R2;
  92 static const uint32_t rt2560_rf2525e_r2[]   = RT2560_RF2525E_R2;
  93 static const uint32_t rt2560_rf2526_r2[]    = RT2560_RF2526_R2;
  94 static const uint32_t rt2560_rf2526_hi_r2[] = RT2560_RF2526_HI_R2;
  95 
  96 static const struct {
  97         uint8_t         chan;
  98         uint32_t        r1, r2, r4;
  99 } rt2560_rf5222[] = {
 100         RT2560_RF5222
 101 };
 102 
 103 /*
 104  * PIO access attributes for registers
 105  */
 106 static ddi_device_acc_attr_t ral_csr_accattr = {
 107         DDI_DEVICE_ATTR_V0,
 108         DDI_STRUCTURE_LE_ACC,
 109         DDI_STRICTORDER_ACC
 110 };
 111 
 112 /*
 113  * DMA access attributes for descriptors: NOT to be byte swapped.
 114  */
 115 static ddi_device_acc_attr_t ral_desc_accattr = {
 116         DDI_DEVICE_ATTR_V0,
 117         DDI_STRUCTURE_LE_ACC,
 118         DDI_STRICTORDER_ACC
 119 };
 120 
 121 /*
 122  * Describes the chip's DMA engine
 123  */
 124 static ddi_dma_attr_t ral_dma_attr = {
 125         DMA_ATTR_V0,                    /* dma_attr version */
 126         0x0000000000000000ull,          /* dma_attr_addr_lo */
 127         0xFFFFFFFF,                     /* dma_attr_addr_hi */
 128         0x00000000FFFFFFFFull,          /* dma_attr_count_max */
 129         0x0000000000000001ull,          /* dma_attr_align */
 130         0x00000FFF,                     /* dma_attr_burstsizes */
 131         0x00000001,                     /* dma_attr_minxfer */
 132         0x000000000000FFFFull,          /* dma_attr_maxxfer */
 133         0xFFFFFFFFFFFFFFFFull,          /* dma_attr_seg */
 134         1,                              /* dma_attr_sgllen */
 135         0x00000001,                     /* dma_attr_granular */
 136         0                               /* dma_attr_flags */
 137 };
 138 
 139 /*
 140  * device operations
 141  */
 142 static int rt2560_attach(dev_info_t *, ddi_attach_cmd_t);
 143 static int rt2560_detach(dev_info_t *, ddi_detach_cmd_t);
 144 static int32_t rt2560_quiesce(dev_info_t *);
 145 
 146 /*
 147  * Module Loading Data & Entry Points
 148  */
 149 DDI_DEFINE_STREAM_OPS(ral_dev_ops, nulldev, nulldev, rt2560_attach,
 150     rt2560_detach, nodev, NULL, D_MP, NULL, rt2560_quiesce);
 151 
 152 static struct modldrv ral_modldrv = {
 153         &mod_driverops,             /* Type of module.  This one is a driver */
 154         "Ralink RT2500 driver v1.6",    /* short description */
 155         &ral_dev_ops                /* driver specific ops */
 156 };
 157 
 158 static struct modlinkage modlinkage = {
 159         MODREV_1,
 160         (void *)&ral_modldrv,
 161         NULL
 162 };
 163 
 164 static int      rt2560_m_stat(void *,  uint_t, uint64_t *);
 165 static int      rt2560_m_start(void *);
 166 static void     rt2560_m_stop(void *);
 167 static int      rt2560_m_promisc(void *, boolean_t);
 168 static int      rt2560_m_multicst(void *, boolean_t, const uint8_t *);
 169 static int      rt2560_m_unicst(void *, const uint8_t *);
 170 static mblk_t   *rt2560_m_tx(void *, mblk_t *);
 171 static void     rt2560_m_ioctl(void *, queue_t *, mblk_t *);
 172 static int      rt2560_m_setprop(void *, const char *, mac_prop_id_t,
 173     uint_t, const void *);
 174 static int      rt2560_m_getprop(void *, const char *, mac_prop_id_t,
 175     uint_t, void *);
 176 static void     rt2560_m_propinfo(void *, const char *, mac_prop_id_t,
 177     mac_prop_info_handle_t);
 178 
 179 static mac_callbacks_t rt2560_m_callbacks = {
 180         MC_IOCTL | MC_SETPROP | MC_GETPROP | MC_PROPINFO,
 181         rt2560_m_stat,
 182         rt2560_m_start,
 183         rt2560_m_stop,
 184         rt2560_m_promisc,
 185         rt2560_m_multicst,
 186         rt2560_m_unicst,
 187         rt2560_m_tx,
 188         NULL,
 189         rt2560_m_ioctl,
 190         NULL,           /* mc_getcapab */
 191         NULL,
 192         NULL,
 193         rt2560_m_setprop,
 194         rt2560_m_getprop,
 195         rt2560_m_propinfo
 196 };
 197 
 198 uint32_t ral_dbg_flags = 0;
 199 
 200 void
 201 ral_debug(uint32_t dbg_flags, const int8_t *fmt, ...)
 202 {
 203         va_list args;
 204 
 205         if (dbg_flags & ral_dbg_flags) {
 206                 va_start(args, fmt);
 207                 vcmn_err(CE_CONT, fmt, args);
 208                 va_end(args);
 209         }
 210 }
 211 
 212 static void
 213 rt2560_set_basicrates(struct rt2560_softc *sc)
 214 {
 215         struct ieee80211com *ic = &sc->sc_ic;
 216 
 217         /* update basic rate set */
 218         if (ic->ic_curmode == IEEE80211_MODE_11B) {
 219                 /* 11b basic rates: 1, 2Mbps */
 220                 RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x3);
 221         } else if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan)) {
 222                 /* 11a basic rates: 6, 12, 24Mbps */
 223                 RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x150);
 224         } else {
 225                 /* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
 226                 RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x15f);
 227         }
 228 }
 229 
 230 static void
 231 rt2560_update_led(struct rt2560_softc *sc, int led1, int led2)
 232 {
 233         uint32_t tmp;
 234 
 235         /* set ON period to 70ms and OFF period to 30ms */
 236         tmp = led1 << 16 | led2 << 17 | 70 << 8 | 30;
 237         RAL_WRITE(sc, RT2560_LEDCSR, tmp);
 238 }
 239 
 240 static void
 241 rt2560_set_bssid(struct rt2560_softc *sc, uint8_t *bssid)
 242 {
 243         uint32_t tmp;
 244 
 245         tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
 246         RAL_WRITE(sc, RT2560_CSR5, tmp);
 247 
 248         tmp = bssid[4] | bssid[5] << 8;
 249         RAL_WRITE(sc, RT2560_CSR6, tmp);
 250 
 251         ral_debug(RAL_DBG_HW, "setting BSSID to " MACSTR "\n", MAC2STR(bssid));
 252 }
 253 
 254 
 255 static void
 256 rt2560_bbp_write(struct rt2560_softc *sc, uint8_t reg, uint8_t val)
 257 {
 258         uint32_t tmp;
 259         int ntries;
 260 
 261         for (ntries = 0; ntries < 100; ntries++) {
 262                 if (!(RAL_READ(sc, RT2560_BBPCSR) & RT2560_BBP_BUSY))
 263                         break;
 264                 drv_usecwait(1);
 265         }
 266         if (ntries == 100) {
 267                 ral_debug(RAL_DBG_HW, "could not write to BBP\n");
 268                 return;
 269         }
 270 
 271         tmp = RT2560_BBP_WRITE | RT2560_BBP_BUSY | reg << 8 | val;
 272         RAL_WRITE(sc, RT2560_BBPCSR, tmp);
 273 
 274         ral_debug(RAL_DBG_HW, "BBP R%u <- 0x%02x\n", reg, val);
 275 }
 276 
 277 static uint8_t
 278 rt2560_bbp_read(struct rt2560_softc *sc, uint8_t reg)
 279 {
 280         uint32_t val;
 281         int ntries;
 282 
 283         val = RT2560_BBP_BUSY | reg << 8;
 284         RAL_WRITE(sc, RT2560_BBPCSR, val);
 285 
 286         for (ntries = 0; ntries < 100; ntries++) {
 287                 val = RAL_READ(sc, RT2560_BBPCSR);
 288                 if (!(val & RT2560_BBP_BUSY))
 289                         return (val & 0xff);
 290                 drv_usecwait(1);
 291         }
 292 
 293         ral_debug(RAL_DBG_HW, "could not read from BBP\n");
 294         return (0);
 295 }
 296 
 297 static void
 298 rt2560_rf_write(struct rt2560_softc *sc, uint8_t reg, uint32_t val)
 299 {
 300         uint32_t tmp;
 301         int ntries;
 302 
 303         for (ntries = 0; ntries < 100; ntries++) {
 304                 if (!(RAL_READ(sc, RT2560_RFCSR) & RT2560_RF_BUSY))
 305                         break;
 306                 drv_usecwait(1);
 307         }
 308         if (ntries == 100) {
 309                 ral_debug(RAL_DBG_HW, "could not write to RF\n");
 310                 return;
 311         }
 312 
 313         tmp = RT2560_RF_BUSY | RT2560_RF_20BIT | (val & 0xfffff) << 2 |
 314             (reg & 0x3);
 315         RAL_WRITE(sc, RT2560_RFCSR, tmp);
 316 
 317         /* remember last written value in sc */
 318         sc->rf_regs[reg] = val;
 319 
 320         ral_debug(RAL_DBG_HW, "RF R[%u] <- 0x%05x\n", reg & 0x3, val & 0xfffff);
 321 }
 322 
 323 static void
 324 rt2560_set_chan(struct rt2560_softc *sc, struct ieee80211_channel *c)
 325 {
 326         struct ieee80211com *ic = &sc->sc_ic;
 327         uint8_t power, tmp;
 328         uint_t i, chan;
 329 
 330         chan = ieee80211_chan2ieee(ic, c);
 331         if (chan == 0 || chan == IEEE80211_CHAN_ANY)
 332                 return;
 333 
 334         if (IEEE80211_IS_CHAN_2GHZ(c))
 335                 power = min(sc->txpow[chan - 1], 31);
 336         else
 337                 power = 31;
 338 
 339         /* adjust txpower using ifconfig settings */
 340         power -= (100 - ic->ic_txpowlimit) / 8;
 341 
 342         ral_debug(RAL_DBG_CHAN, "setting channel to %u, txpower to %u\n",
 343             chan, power);
 344 
 345         switch (sc->rf_rev) {
 346         case RT2560_RF_2522:
 347                 rt2560_rf_write(sc, RAL_RF1, 0x00814);
 348                 rt2560_rf_write(sc, RAL_RF2, rt2560_rf2522_r2[chan - 1]);
 349                 rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
 350                 break;
 351 
 352         case RT2560_RF_2523:
 353                 rt2560_rf_write(sc, RAL_RF1, 0x08804);
 354                 rt2560_rf_write(sc, RAL_RF2, rt2560_rf2523_r2[chan - 1]);
 355                 rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x38044);
 356                 rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
 357                 break;
 358 
 359         case RT2560_RF_2524:
 360                 rt2560_rf_write(sc, RAL_RF1, 0x0c808);
 361                 rt2560_rf_write(sc, RAL_RF2, rt2560_rf2524_r2[chan - 1]);
 362                 rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
 363                 rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
 364                 break;
 365 
 366         case RT2560_RF_2525:
 367                 rt2560_rf_write(sc, RAL_RF1, 0x08808);
 368                 rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525_hi_r2[chan - 1]);
 369                 rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
 370                 rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
 371 
 372                 rt2560_rf_write(sc, RAL_RF1, 0x08808);
 373                 rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525_r2[chan - 1]);
 374                 rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
 375                 rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
 376                 break;
 377 
 378         case RT2560_RF_2525E:
 379                 rt2560_rf_write(sc, RAL_RF1, 0x08808);
 380                 rt2560_rf_write(sc, RAL_RF2, rt2560_rf2525e_r2[chan - 1]);
 381                 rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
 382                 rt2560_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00286 : 0x00282);
 383                 break;
 384 
 385         case RT2560_RF_2526:
 386                 rt2560_rf_write(sc, RAL_RF2, rt2560_rf2526_hi_r2[chan - 1]);
 387                 rt2560_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
 388                 rt2560_rf_write(sc, RAL_RF1, 0x08804);
 389 
 390                 rt2560_rf_write(sc, RAL_RF2, rt2560_rf2526_r2[chan - 1]);
 391                 rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
 392                 rt2560_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
 393                 break;
 394 
 395         /* dual-band RF */
 396         case RT2560_RF_5222:
 397                 for (i = 0; rt2560_rf5222[i].chan != chan; i++) {
 398                 }
 399 
 400                 rt2560_rf_write(sc, RAL_RF1, rt2560_rf5222[i].r1);
 401                 rt2560_rf_write(sc, RAL_RF2, rt2560_rf5222[i].r2);
 402                 rt2560_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
 403                 rt2560_rf_write(sc, RAL_RF4, rt2560_rf5222[i].r4);
 404                 break;
 405         }
 406 
 407         if (ic->ic_state != IEEE80211_S_SCAN) {
 408                 /* set Japan filter bit for channel 14 */
 409                 tmp = rt2560_bbp_read(sc, 70);
 410 
 411                 tmp &= ~RT2560_JAPAN_FILTER;
 412                 if (chan == 14)
 413                         tmp |= RT2560_JAPAN_FILTER;
 414 
 415                 rt2560_bbp_write(sc, 70, tmp);
 416 
 417                 /* clear CRC errors */
 418                 (void) RAL_READ(sc, RT2560_CNT0);
 419         }
 420 }
 421 
 422 /*
 423  * Refer to IEEE Std 802.11-1999 pp. 123 for more information on TSF
 424  * synchronization.
 425  */
 426 static void
 427 rt2560_enable_tsf_sync(struct rt2560_softc *sc)
 428 {
 429         struct ieee80211com *ic = &sc->sc_ic;
 430         uint16_t logcwmin, preload;
 431         uint32_t tmp;
 432 
 433         /* first, disable TSF synchronization */
 434         RAL_WRITE(sc, RT2560_CSR14, 0);
 435 
 436         tmp = 16 * ic->ic_bss->in_intval;
 437         RAL_WRITE(sc, RT2560_CSR12, tmp);
 438 
 439         RAL_WRITE(sc, RT2560_CSR13, 0);
 440 
 441         logcwmin = 5;
 442         preload = (ic->ic_opmode == IEEE80211_M_STA) ? 384 : 1024;
 443         tmp = logcwmin << 16 | preload;
 444         RAL_WRITE(sc, RT2560_BCNOCSR, tmp);
 445 
 446         /* finally, enable TSF synchronization */
 447         tmp = RT2560_ENABLE_TSF | RT2560_ENABLE_TBCN;
 448         if (ic->ic_opmode == IEEE80211_M_STA)
 449                 tmp |= RT2560_ENABLE_TSF_SYNC(1);
 450         else
 451                 tmp |= RT2560_ENABLE_TSF_SYNC(2) |
 452                     RT2560_ENABLE_BEACON_GENERATOR;
 453         RAL_WRITE(sc, RT2560_CSR14, tmp);
 454 
 455         ral_debug(RAL_DBG_HW, "enabling TSF synchronization\n");
 456 }
 457 
 458 static void
 459 rt2560_update_plcp(struct rt2560_softc *sc)
 460 {
 461         struct ieee80211com *ic = &sc->sc_ic;
 462 
 463         /* no short preamble for 1Mbps */
 464         RAL_WRITE(sc, RT2560_PLCP1MCSR, 0x00700400);
 465 
 466         if (!(ic->ic_flags & IEEE80211_F_SHPREAMBLE)) {
 467                 /* values taken from the reference driver */
 468                 RAL_WRITE(sc, RT2560_PLCP2MCSR,   0x00380401);
 469                 RAL_WRITE(sc, RT2560_PLCP5p5MCSR, 0x00150402);
 470                 RAL_WRITE(sc, RT2560_PLCP11MCSR,  0x000b8403);
 471         } else {
 472                 /* same values as above or'ed 0x8 */
 473                 RAL_WRITE(sc, RT2560_PLCP2MCSR,   0x00380409);
 474                 RAL_WRITE(sc, RT2560_PLCP5p5MCSR, 0x0015040a);
 475                 RAL_WRITE(sc, RT2560_PLCP11MCSR,  0x000b840b);
 476         }
 477 
 478         ral_debug(RAL_DBG_HW, "updating PLCP for %s preamble\n",
 479             (ic->ic_flags & IEEE80211_F_SHPREAMBLE) ? "short" : "long");
 480 }
 481 
 482 /*
 483  * This function can be called by ieee80211_set_shortslottime(). Refer to
 484  * IEEE Std 802.11-1999 pp. 85 to know how these values are computed.
 485  */
 486 void
 487 rt2560_update_slot(struct ieee80211com *ic, int onoff)
 488 {
 489         struct rt2560_softc *sc = (struct rt2560_softc *)ic;
 490         uint8_t slottime;
 491         uint16_t tx_sifs, tx_pifs, tx_difs, eifs;
 492         uint32_t tmp;
 493 
 494         /* slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20; */
 495         slottime = (onoff ? 9 : 20);
 496 
 497         /* update the MAC slot boundaries */
 498         tx_sifs = RAL_SIFS - RT2560_TXRX_TURNAROUND;
 499         tx_pifs = tx_sifs + slottime;
 500         tx_difs = tx_sifs + 2 * slottime;
 501         eifs = (ic->ic_curmode == IEEE80211_MODE_11B) ? 364 : 60;
 502 
 503         tmp = RAL_READ(sc, RT2560_CSR11);
 504         tmp = (tmp & ~0x1f00) | slottime << 8;
 505         RAL_WRITE(sc, RT2560_CSR11, tmp);
 506 
 507         tmp = tx_pifs << 16 | tx_sifs;
 508         RAL_WRITE(sc, RT2560_CSR18, tmp);
 509 
 510         tmp = eifs << 16 | tx_difs;
 511         RAL_WRITE(sc, RT2560_CSR19, tmp);
 512 
 513         ral_debug(RAL_DBG_HW, "setting slottime to %uus\n", slottime);
 514 }
 515 
 516 int
 517 ral_dma_region_alloc(struct rt2560_softc *sc, struct dma_region *dr,
 518     size_t size, uint_t alloc_flags, uint_t bind_flags)
 519 {
 520         dev_info_t *dip = sc->sc_dev;
 521         int err;
 522 
 523         err = ddi_dma_alloc_handle(dip, &ral_dma_attr, DDI_DMA_SLEEP, NULL,
 524             &dr->dr_hnd);
 525         if (err != DDI_SUCCESS)
 526                 goto fail1;
 527 
 528         err = ddi_dma_mem_alloc(dr->dr_hnd, size, &ral_desc_accattr,
 529             alloc_flags, DDI_DMA_SLEEP, NULL,
 530             &dr->dr_base, &dr->dr_size, &dr->dr_acc);
 531         if (err != DDI_SUCCESS)
 532                 goto fail2;
 533 
 534         err = ddi_dma_addr_bind_handle(dr->dr_hnd, NULL,
 535             dr->dr_base, dr->dr_size,
 536             bind_flags, DDI_DMA_SLEEP, NULL, &dr->dr_cookie, &dr->dr_ccnt);
 537         if (err != DDI_SUCCESS)
 538                 goto fail3;
 539 
 540         if (dr->dr_ccnt != 1) {
 541                 err = DDI_FAILURE;
 542                 goto fail4;
 543         }
 544 
 545         dr->dr_pbase = dr->dr_cookie.dmac_address;
 546         ral_debug(RAL_DBG_DMA, "get physical-base=0x%08x\n", dr->dr_pbase);
 547 
 548         return (DDI_SUCCESS);
 549 
 550 fail4:
 551         (void) ddi_dma_unbind_handle(dr->dr_hnd);
 552 fail3:
 553         ddi_dma_mem_free(&dr->dr_acc);
 554 fail2:
 555         ddi_dma_free_handle(&dr->dr_hnd);
 556 fail1:
 557         return (err);
 558 }
 559 
 560 /* ARGSUSED */
 561 void
 562 ral_dma_region_free(struct rt2560_softc *sc, struct dma_region *dr)
 563 {
 564         (void) ddi_dma_unbind_handle(dr->dr_hnd);
 565         ddi_dma_mem_free(&dr->dr_acc);
 566         ddi_dma_free_handle(&dr->dr_hnd);
 567 }
 568 
 569 int
 570 rt2560_alloc_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring,
 571         int count)
 572 {
 573         int i, err;
 574         int size;
 575 
 576         ring->count = count;
 577         ring->queued = 0;
 578         ring->cur = ring->next = 0;
 579         ring->cur_encrypt = ring->next_encrypt = 0;
 580 
 581         ring->data = kmem_zalloc(count * (sizeof (struct rt2560_tx_data)),
 582             KM_SLEEP);
 583         ring->dr_txbuf = kmem_zalloc(count * (sizeof (struct dma_region)),
 584             KM_SLEEP);
 585 
 586         err = ral_dma_region_alloc(sc, &ring->dr_desc,
 587             count * (sizeof (struct rt2560_tx_desc)),
 588             DDI_DMA_CONSISTENT, DDI_DMA_RDWR | DDI_DMA_CONSISTENT);
 589 
 590         if (err != DDI_SUCCESS)
 591                 goto fail1;
 592 
 593         size = roundup(RAL_TXBUF_SIZE, sc->sc_cachelsz);
 594         for (i = 0; i < count; i++) {
 595                 err = ral_dma_region_alloc(sc, &ring->dr_txbuf[i], size,
 596                     DDI_DMA_STREAMING, DDI_DMA_WRITE | DDI_DMA_STREAMING);
 597                 if (err != DDI_SUCCESS) {
 598                         while (i >= 0) {
 599                                 ral_dma_region_free(sc, &ring->dr_txbuf[i]);
 600                                 i--;
 601                         }
 602                         goto fail2;
 603                 }
 604         }
 605 
 606         ring->physaddr = LE_32(ring->dr_desc.dr_pbase);
 607         ring->desc = (struct rt2560_tx_desc *)ring->dr_desc.dr_base;
 608 
 609         for (i = 0; i < count; i++) {
 610                 ring->desc[i].physaddr = LE_32(ring->dr_txbuf[i].dr_pbase);
 611                 ring->data[i].buf = ring->dr_txbuf[i].dr_base;
 612         }
 613 
 614         return (DDI_SUCCESS);
 615 fail2:
 616         ral_dma_region_free(sc, &ring->dr_desc);
 617 fail1:
 618         return (err);
 619 }
 620 
 621 /* ARGSUSED */
 622 void
 623 rt2560_reset_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring)
 624 {
 625         struct rt2560_tx_desc *desc;
 626         struct rt2560_tx_data *data;
 627         int i;
 628 
 629         for (i = 0; i < ring->count; i++) {
 630                 desc = &ring->desc[i];
 631                 data = &ring->data[i];
 632 
 633                 if (data->ni != NULL) {
 634                         ieee80211_free_node(data->ni);
 635                         data->ni = NULL;
 636                 }
 637 
 638                 desc->flags = 0;
 639         }
 640 
 641         (void) ddi_dma_sync(ring->dr_desc.dr_hnd, 0,
 642             ring->count * sizeof (struct rt2560_tx_desc), DDI_DMA_SYNC_FORDEV);
 643 
 644         ring->queued = 0;
 645         ring->cur = ring->next = 0;
 646         ring->cur_encrypt = ring->next_encrypt = 0;
 647 }
 648 
 649 void
 650 rt2560_free_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring)
 651 {
 652         struct rt2560_tx_data *data;
 653         int i;
 654 
 655         ral_dma_region_free(sc, &ring->dr_desc);
 656         /* tx buf */
 657         for (i = 0; i < ring->count; i++) {
 658                 data = &ring->data[i];
 659                 if (data->ni != NULL) {
 660                         ieee80211_free_node(data->ni);
 661                         data->ni = NULL;
 662                 }
 663 
 664                 ral_dma_region_free(sc, &ring->dr_txbuf[i]);
 665         }
 666 
 667         kmem_free(ring->data, ring->count * (sizeof (struct rt2560_tx_data)));
 668         kmem_free(ring->dr_txbuf, ring->count * (sizeof (struct dma_region)));
 669 }
 670 
 671 void
 672 rt2560_ring_hwsetup(struct rt2560_softc *sc)
 673 {
 674         uint32_t tmp;
 675 
 676         /* setup tx rings */
 677         tmp = ((uint32_t)RT2560_PRIO_RING_COUNT << 24) |
 678             RT2560_ATIM_RING_COUNT << 16 |
 679             RT2560_TX_RING_COUNT   <<  8 |
 680             RT2560_TX_DESC_SIZE;
 681 
 682         /* rings must be initialized in this exact order */
 683         RAL_WRITE(sc, RT2560_TXCSR2, tmp);
 684         RAL_WRITE(sc, RT2560_TXCSR3, sc->txq.physaddr);
 685         RAL_WRITE(sc, RT2560_TXCSR5, sc->prioq.physaddr);
 686 
 687         /* setup rx ring */
 688         tmp = RT2560_RX_RING_COUNT << 8 | RT2560_RX_DESC_SIZE;
 689 
 690         RAL_WRITE(sc, RT2560_RXCSR1, tmp);
 691         RAL_WRITE(sc, RT2560_RXCSR2, sc->rxq.physaddr);
 692 }
 693 
 694 int
 695 rt2560_alloc_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring,
 696         int count)
 697 {
 698         struct rt2560_rx_desc *desc;
 699         struct rt2560_rx_data *data;
 700         int i, err;
 701         int size;
 702 
 703         ring->count = count;
 704         ring->cur = ring->next = 0;
 705         ring->cur_decrypt = 0;
 706 
 707         ring->data = kmem_zalloc(count * (sizeof (struct rt2560_rx_data)),
 708             KM_SLEEP);
 709         ring->dr_rxbuf = kmem_zalloc(count * (sizeof (struct dma_region)),
 710             KM_SLEEP);
 711 
 712         err = ral_dma_region_alloc(sc, &ring->dr_desc,
 713             count * (sizeof (struct rt2560_rx_desc)),
 714             DDI_DMA_CONSISTENT, DDI_DMA_RDWR | DDI_DMA_CONSISTENT);
 715 
 716         if (err != DDI_SUCCESS)
 717                 goto fail1;
 718 
 719         size = roundup(RAL_RXBUF_SIZE, sc->sc_cachelsz);
 720         for (i = 0; i < count; i++) {
 721                 err = ral_dma_region_alloc(sc, &ring->dr_rxbuf[i], size,
 722                     DDI_DMA_STREAMING, DDI_DMA_READ | DDI_DMA_STREAMING);
 723                 if (err != DDI_SUCCESS) {
 724                         while (i >= 0) {
 725                                 ral_dma_region_free(sc, &ring->dr_rxbuf[i]);
 726                                 i--;
 727                         }
 728                         goto fail2;
 729                 }
 730         }
 731 
 732         ring->physaddr = ring->dr_desc.dr_pbase;
 733         ring->desc = (struct rt2560_rx_desc *)ring->dr_desc.dr_base;
 734 
 735         for (i = 0; i < count; i++) {
 736                 desc = &ring->desc[i];
 737                 data = &ring->data[i];
 738 
 739                 desc->physaddr = LE_32(ring->dr_rxbuf[i].dr_pbase);
 740                 desc->flags = LE_32(RT2560_RX_BUSY);
 741 
 742                 data->buf = ring->dr_rxbuf[i].dr_base;
 743         }
 744 
 745         return (DDI_SUCCESS);
 746 fail2:
 747         ral_dma_region_free(sc, &ring->dr_desc);
 748 fail1:
 749         return (err);
 750 }
 751 
 752 /* ARGSUSED */
 753 static void
 754 rt2560_reset_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring)
 755 {
 756         int i;
 757 
 758         for (i = 0; i < ring->count; i++) {
 759                 ring->desc[i].flags = LE_32(RT2560_RX_BUSY);
 760                 ring->data[i].drop = 0;
 761         }
 762 
 763         (void) ddi_dma_sync(ring->dr_desc.dr_hnd, 0,
 764             ring->count * sizeof (struct rt2560_rx_desc),
 765             DDI_DMA_SYNC_FORKERNEL);
 766 
 767         ring->cur = ring->next = 0;
 768         ring->cur_decrypt = 0;
 769 }
 770 
 771 static void
 772 rt2560_free_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring)
 773 {
 774         int i;
 775 
 776         ral_dma_region_free(sc, &ring->dr_desc);
 777         /* rx buf */
 778         for (i = 0; i < ring->count; i++)
 779                 ral_dma_region_free(sc, &ring->dr_rxbuf[i]);
 780 
 781         kmem_free(ring->data, ring->count * (sizeof (struct rt2560_rx_data)));
 782         kmem_free(ring->dr_rxbuf, ring->count * (sizeof (struct dma_region)));
 783 }
 784 
 785 /* ARGSUSED */
 786 static struct ieee80211_node *
 787 rt2560_node_alloc(ieee80211com_t *ic)
 788 {
 789         struct rt2560_node *rn;
 790 
 791         rn = kmem_zalloc(sizeof (struct rt2560_node), KM_SLEEP);
 792         return ((rn != NULL) ? &rn->ni : NULL);
 793 }
 794 
 795 static void
 796 rt2560_node_free(struct ieee80211_node *in)
 797 {
 798         ieee80211com_t *ic = in->in_ic;
 799 
 800         ic->ic_node_cleanup(in);
 801         if (in->in_wpa_ie != NULL)
 802                 ieee80211_free(in->in_wpa_ie);
 803         kmem_free(in, sizeof (struct rt2560_node));
 804 }
 805 
 806 /*
 807  * This function is called periodically (every 200ms) during scanning to
 808  * switch from one channel to another.
 809  */
 810 static void
 811 rt2560_next_scan(void *arg)
 812 {
 813         struct rt2560_softc *sc = arg;
 814         struct ieee80211com *ic = &sc->sc_ic;
 815 
 816         if (ic->ic_state == IEEE80211_S_SCAN)
 817                 (void) ieee80211_next_scan(ic);
 818 }
 819 
 820 /*
 821  * This function is called for each node present in the node station table.
 822  */
 823 /* ARGSUSED */
 824 static void
 825 rt2560_iter_func(void *arg, struct ieee80211_node *ni)
 826 {
 827         struct rt2560_node *rn = (struct rt2560_node *)ni;
 828 
 829         ral_rssadapt_updatestats(&rn->rssadapt);
 830 }
 831 
 832 /*
 833  * This function is called periodically (every 100ms) in RUN state to update
 834  * the rate adaptation statistics.
 835  */
 836 static void
 837 rt2560_update_rssadapt(void *arg)
 838 {
 839         struct rt2560_softc *sc = arg;
 840         struct ieee80211com *ic = &sc->sc_ic;
 841 
 842         ieee80211_iterate_nodes(&ic->ic_sta, rt2560_iter_func, arg);
 843         sc->sc_rssadapt_id = timeout(rt2560_update_rssadapt, (void *)sc,
 844             drv_usectohz(100 * 1000));
 845 }
 846 
 847 static void
 848 rt2560_statedog(void *arg)
 849 {
 850         struct rt2560_softc *sc = arg;
 851         struct ieee80211com *ic = &sc->sc_ic;
 852         enum ieee80211_state state;
 853 
 854         RAL_LOCK(sc);
 855 
 856         sc->sc_state_id = 0;
 857         state = ic->ic_state;
 858         ic->ic_state = sc->sc_ostate;
 859 
 860         RAL_UNLOCK(sc);
 861 
 862         ieee80211_new_state(ic, state, -1);
 863 
 864 }
 865 
 866 static int
 867 rt2560_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
 868 {
 869         struct rt2560_softc *sc = (struct rt2560_softc *)ic;
 870         enum ieee80211_state ostate;
 871         struct ieee80211_node *ni;
 872         int err;
 873 
 874         RAL_LOCK(sc);
 875 
 876         ostate = ic->ic_state;
 877         sc->sc_ostate = ostate;
 878 
 879         if (sc->sc_scan_id != 0) {
 880                 (void) untimeout(sc->sc_scan_id);
 881                 sc->sc_scan_id = 0;
 882         }
 883 
 884         if (sc->sc_rssadapt_id != 0) {
 885                 (void) untimeout(sc->sc_rssadapt_id);
 886                 sc->sc_rssadapt_id = 0;
 887         }
 888 
 889         if (sc->sc_state_id != 0) {
 890                 (void) untimeout(sc->sc_state_id);
 891                 sc->sc_state_id = 0;
 892         }
 893 
 894         switch (nstate) {
 895         case IEEE80211_S_INIT:
 896                 if (ostate == IEEE80211_S_RUN) {
 897                         /* abort TSF synchronization */
 898                         RAL_WRITE(sc, RT2560_CSR14, 0);
 899                         /* turn association led off */
 900                         rt2560_update_led(sc, 0, 0);
 901                 }
 902                 break;
 903 
 904         case IEEE80211_S_SCAN:
 905                 rt2560_set_chan(sc, ic->ic_curchan);
 906                 sc->sc_scan_id = timeout(rt2560_next_scan, (void *)sc,
 907                     drv_usectohz(sc->dwelltime * 1000));
 908                 break;
 909 
 910         case IEEE80211_S_AUTH:
 911                 rt2560_set_chan(sc, ic->ic_curchan);
 912                 break;
 913 
 914         case IEEE80211_S_ASSOC:
 915                 rt2560_set_chan(sc, ic->ic_curchan);
 916 
 917                 drv_usecwait(10 * 1000);        /* dlink */
 918                 sc->sc_state_id = timeout(rt2560_statedog, (void *)sc,
 919                     drv_usectohz(300 * 1000));  /* ap7-3 */
 920                 break;
 921 
 922         case IEEE80211_S_RUN:
 923                 rt2560_set_chan(sc, ic->ic_curchan);
 924 
 925                 ni = ic->ic_bss;
 926 
 927                 if (ic->ic_opmode != IEEE80211_M_MONITOR) {
 928                         rt2560_update_plcp(sc);
 929                         rt2560_set_basicrates(sc);
 930                         rt2560_set_bssid(sc, ni->in_bssid);
 931                 }
 932 
 933                 /* turn assocation led on */
 934                 rt2560_update_led(sc, 1, 0);
 935                 if (ic->ic_opmode != IEEE80211_M_MONITOR) {
 936                         sc->sc_rssadapt_id = timeout(rt2560_update_rssadapt,
 937                             (void *)sc, drv_usectohz(100 * 1000));
 938                         rt2560_enable_tsf_sync(sc);
 939                 }
 940                 break;
 941         }
 942 
 943         RAL_UNLOCK(sc);
 944 
 945         err = sc->sc_newstate(ic, nstate, arg);
 946         /*
 947          * Finally, start any timers.
 948          */
 949         if (nstate == IEEE80211_S_RUN)
 950                 ieee80211_start_watchdog(ic, 1);
 951 
 952         return (err);
 953 }
 954 
 955 /*
 956  * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46 or
 957  * 93C66).
 958  */
 959 static uint16_t
 960 rt2560_eeprom_read(struct rt2560_softc *sc, uint8_t addr)
 961 {
 962         uint32_t tmp;
 963         uint16_t val;
 964         int n;
 965 
 966         /* clock C once before the first command */
 967         RT2560_EEPROM_CTL(sc, 0);
 968 
 969         RT2560_EEPROM_CTL(sc, RT2560_S);
 970         RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
 971         RT2560_EEPROM_CTL(sc, RT2560_S);
 972 
 973         /* write start bit (1) */
 974         RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D);
 975         RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D | RT2560_C);
 976 
 977         /* write READ opcode (10) */
 978         RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D);
 979         RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_D | RT2560_C);
 980         RT2560_EEPROM_CTL(sc, RT2560_S);
 981         RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
 982 
 983         /* write address (A5-A0 or A7-A0) */
 984         n = (RAL_READ(sc, RT2560_CSR21) & RT2560_93C46) ? 5 : 7;
 985         for (; n >= 0; n--) {
 986                 RT2560_EEPROM_CTL(sc, RT2560_S |
 987                     (((addr >> n) & 1) << RT2560_SHIFT_D));
 988                 RT2560_EEPROM_CTL(sc, RT2560_S |
 989                     (((addr >> n) & 1) << RT2560_SHIFT_D) | RT2560_C);
 990         }
 991 
 992         RT2560_EEPROM_CTL(sc, RT2560_S);
 993 
 994         /* read data Q15-Q0 */
 995         val = 0;
 996         for (n = 15; n >= 0; n--) {
 997                 RT2560_EEPROM_CTL(sc, RT2560_S | RT2560_C);
 998                 tmp = RAL_READ(sc, RT2560_CSR21);
 999                 val |= ((tmp & RT2560_Q) >> RT2560_SHIFT_Q) << n;
1000                 RT2560_EEPROM_CTL(sc, RT2560_S);
1001         }
1002 
1003         RT2560_EEPROM_CTL(sc, 0);
1004 
1005         /* clear Chip Select and clock C */
1006         RT2560_EEPROM_CTL(sc, RT2560_S);
1007         RT2560_EEPROM_CTL(sc, 0);
1008         RT2560_EEPROM_CTL(sc, RT2560_C);
1009 
1010         return (val);
1011 }
1012 
1013 static void
1014 rt2560_tx_intr(struct rt2560_softc *sc)
1015 {
1016         struct ieee80211com *ic = &sc->sc_ic;
1017         struct rt2560_tx_desc *desc;
1018         struct rt2560_tx_data *data;
1019         struct rt2560_node *rn;
1020 
1021         struct dma_region *dr;
1022         int count;
1023 
1024         dr = &sc->txq.dr_desc;
1025         count = sc->txq.count;
1026 
1027         (void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1028             DDI_DMA_SYNC_FORKERNEL);
1029 
1030         mutex_enter(&sc->txq.tx_lock);
1031 
1032         for (;;) {
1033                 desc = &sc->txq.desc[sc->txq.next];
1034                 data = &sc->txq.data[sc->txq.next];
1035 
1036                 if ((LE_32(desc->flags) & RT2560_TX_BUSY) ||
1037                     (LE_32(desc->flags) & RT2560_TX_CIPHER_BUSY) ||
1038                     !(LE_32(desc->flags) & RT2560_TX_VALID))
1039                         break;
1040 
1041                 rn = (struct rt2560_node *)data->ni;
1042 
1043                 switch (LE_32(desc->flags) & RT2560_TX_RESULT_MASK) {
1044                 case RT2560_TX_SUCCESS:
1045                         ral_debug(RAL_DBG_INTR, "data frame sent success\n");
1046                         if (data->id.id_node != NULL) {
1047                                 ral_rssadapt_raise_rate(ic, &rn->rssadapt,
1048                                     &data->id);
1049                         }
1050                         break;
1051 
1052                 case RT2560_TX_SUCCESS_RETRY:
1053                         ral_debug(RAL_DBG_INTR,
1054                             "data frame sent after %u retries\n",
1055                             (LE_32(desc->flags) >> 5) & 0x7);
1056                         sc->sc_tx_retries++;
1057                         break;
1058 
1059                 case RT2560_TX_FAIL_RETRY:
1060                         ral_debug(RAL_DBG_INTR,
1061                             "sending data frame failed (too much retries)\n");
1062                         if (data->id.id_node != NULL) {
1063                                 ral_rssadapt_lower_rate(ic, data->ni,
1064                                     &rn->rssadapt, &data->id);
1065                         }
1066                         break;
1067 
1068                 case RT2560_TX_FAIL_INVALID:
1069                 case RT2560_TX_FAIL_OTHER:
1070                 default:
1071                         ral_debug(RAL_DBG_INTR, "sending data frame failed "
1072                             "0x%08x\n", LE_32(desc->flags));
1073                         break;
1074                 }
1075 
1076                 ieee80211_free_node(data->ni);
1077                 data->ni = NULL;
1078 
1079                 /* descriptor is no longer valid */
1080                 desc->flags &= ~LE_32(RT2560_TX_VALID);
1081 
1082                 ral_debug(RAL_DBG_INTR, "tx done idx=%u\n", sc->txq.next);
1083 
1084                 sc->txq.queued--;
1085                 sc->txq.next = (sc->txq.next + 1) % RT2560_TX_RING_COUNT;
1086 
1087                 if (sc->sc_need_sched &&
1088                     sc->txq.queued < (RT2560_TX_RING_COUNT - 32)) {
1089                         sc->sc_need_sched = 0;
1090                         mac_tx_update(ic->ic_mach);
1091                 }
1092         }
1093 
1094         (void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1095             DDI_DMA_SYNC_FORDEV);
1096 
1097         sc->sc_tx_timer = 0;
1098         mutex_exit(&sc->txq.tx_lock);
1099 }
1100 
1101 static void
1102 rt2560_prio_intr(struct rt2560_softc *sc)
1103 {
1104         struct rt2560_tx_desc *desc;
1105         struct rt2560_tx_data *data;
1106 
1107         struct dma_region *dr;
1108         int count;
1109 
1110         dr = &sc->prioq.dr_desc;
1111         count = sc->prioq.count;
1112 
1113         (void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1114             DDI_DMA_SYNC_FORKERNEL);
1115 
1116         mutex_enter(&sc->prioq.tx_lock);
1117 
1118         for (;;) {
1119                 desc = &sc->prioq.desc[sc->prioq.next];
1120                 data = &sc->prioq.data[sc->prioq.next];
1121 
1122                 if ((LE_32(desc->flags) & RT2560_TX_BUSY) ||
1123                     !(LE_32(desc->flags) & RT2560_TX_VALID))
1124                         break;
1125 
1126                 switch (LE_32(desc->flags) & RT2560_TX_RESULT_MASK) {
1127                 case RT2560_TX_SUCCESS:
1128                         ral_debug(RAL_DBG_INTR, "mgt frame sent success\n");
1129                         break;
1130 
1131                 case RT2560_TX_SUCCESS_RETRY:
1132                         ral_debug(RAL_DBG_INTR,
1133                             "mgt frame sent after %u retries\n",
1134                             (LE_32(desc->flags) >> 5) & 0x7);
1135                         break;
1136 
1137                 case RT2560_TX_FAIL_RETRY:
1138                         ral_debug(RAL_DBG_INTR,
1139                             "sending mgt frame failed (too much " "retries)\n");
1140                         break;
1141 
1142                 case RT2560_TX_FAIL_INVALID:
1143                 case RT2560_TX_FAIL_OTHER:
1144                 default:
1145                         ral_debug(RAL_DBG_INTR, "sending mgt frame failed "
1146                             "0x%08x\n", LE_32(desc->flags));
1147                 }
1148 
1149                 ieee80211_free_node(data->ni);
1150                 data->ni = NULL;
1151 
1152                 /* descriptor is no longer valid */
1153                 desc->flags &= ~LE_32(RT2560_TX_VALID);
1154 
1155                 ral_debug(RAL_DBG_INTR, "prio done idx=%u\n", sc->prioq.next);
1156 
1157                 sc->prioq.queued--;
1158                 sc->prioq.next = (sc->prioq.next + 1) % RT2560_PRIO_RING_COUNT;
1159         }
1160 
1161         (void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1162             DDI_DMA_SYNC_FORDEV);
1163 
1164         sc->sc_tx_timer = 0;
1165         mutex_exit(&sc->prioq.tx_lock);
1166 }
1167 
1168 /*
1169  * Some frames were received. Pass them to the hardware cipher engine before
1170  * sending them to the 802.11 layer.
1171  */
1172 void
1173 rt2560_rx_intr(struct rt2560_softc *sc)
1174 {
1175         struct ieee80211com *ic = &sc->sc_ic;
1176         struct rt2560_rx_desc *desc;
1177         struct rt2560_rx_data *data;
1178         struct ieee80211_frame *wh;
1179         struct ieee80211_node *ni;
1180         struct rt2560_node *rn;
1181 
1182         mblk_t *m;
1183         uint32_t len;
1184         char *rxbuf;
1185 
1186         struct dma_region *dr, *dr_bf;
1187         int count;
1188 
1189         dr = &sc->rxq.dr_desc;
1190         count = sc->rxq.count;
1191 
1192         mutex_enter(&sc->rxq.rx_lock);
1193 
1194         (void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_RX_DESC_SIZE,
1195             DDI_DMA_SYNC_FORKERNEL);
1196 
1197         for (;;) {
1198                 desc = &sc->rxq.desc[sc->rxq.cur];
1199                 data = &sc->rxq.data[sc->rxq.cur];
1200 
1201                 if ((LE_32(desc->flags) & RT2560_RX_BUSY) ||
1202                     (LE_32(desc->flags) & RT2560_RX_CIPHER_BUSY))
1203                         break;
1204 
1205                 data->drop = 0;
1206 
1207                 if ((LE_32(desc->flags) & RT2560_RX_PHY_ERROR) ||
1208                     (LE_32(desc->flags) & RT2560_RX_CRC_ERROR)) {
1209                         /*
1210                          * This should not happen since we did not request
1211                          * to receive those frames when we filled RXCSR0.
1212                          */
1213                         ral_debug(RAL_DBG_RX, "PHY or CRC error flags 0x%08x\n",
1214                             LE_32(desc->flags));
1215                         data->drop = 1;
1216                 }
1217 
1218                 if (((LE_32(desc->flags) >> 16) & 0xfff) > RAL_RXBUF_SIZE) {
1219                         ral_debug(RAL_DBG_RX, "bad length\n");
1220                         data->drop = 1;
1221                 }
1222 
1223                 if (data->drop) {
1224                         sc->sc_rx_err++;
1225                         goto skip;
1226                 }
1227 
1228                 rxbuf = data->buf;
1229                 len = (LE_32(desc->flags) >> 16) & 0xfff;
1230 
1231                 if ((len < sizeof (struct ieee80211_frame_min)) ||
1232                     (len > RAL_RXBUF_SIZE)) {
1233                         ral_debug(RAL_DBG_RX, "bad frame length=%u\n", len);
1234                         sc->sc_rx_err++;
1235                         goto skip;
1236                 }
1237 
1238                 if ((m = allocb(len, BPRI_MED)) == NULL) {
1239                         ral_debug(RAL_DBG_RX, "rt2560_rx_intr():"
1240                             " allocate mblk failed.\n");
1241                         sc->sc_rx_nobuf++;
1242                         goto skip;
1243                 }
1244 
1245                 dr_bf = &sc->rxq.dr_rxbuf[sc->rxq.cur];
1246                 (void) ddi_dma_sync(dr_bf->dr_hnd, 0, dr_bf->dr_size,
1247                     DDI_DMA_SYNC_FORCPU);
1248 
1249                 bcopy(rxbuf, m->b_rptr, len);
1250                 m->b_wptr += len;
1251 
1252                 wh = (struct ieee80211_frame *)m->b_rptr;
1253                 ni = ieee80211_find_rxnode(ic, wh);
1254 
1255                 /* give rssi to the rate adatation algorithm */
1256                 rn = (struct rt2560_node *)ni;
1257                 ral_rssadapt_input(ic, ni, &rn->rssadapt, desc->rssi);
1258 
1259                 /* send the frame to the 802.11 layer */
1260                 (void) ieee80211_input(ic, m, ni, desc->rssi, 0);
1261 
1262                 /* node is no longer needed */
1263                 ieee80211_free_node(ni);
1264 
1265 skip:           desc->flags = LE_32(RT2560_RX_BUSY);
1266                 ral_debug(RAL_DBG_RX, "rx done idx=%u\n", sc->rxq.cur);
1267 
1268                 sc->rxq.cur = (sc->rxq.cur + 1) % RT2560_RX_RING_COUNT;
1269         }
1270         mutex_exit(&sc->rxq.rx_lock);
1271 
1272         (void) ddi_dma_sync(dr->dr_hnd, 0, count * RT2560_TX_DESC_SIZE,
1273             DDI_DMA_SYNC_FORDEV);
1274 }
1275 
1276 uint_t
1277 ral_softint_handler(caddr_t data)
1278 {
1279         /* LINTED E_BAD_PTR_CAST_ALIGN */
1280         struct rt2560_softc *sc = (struct rt2560_softc *)data;
1281 
1282         /*
1283          * Check if the soft interrupt is triggered by another
1284          * driver at the same level.
1285          */
1286         RAL_LOCK(sc);
1287         if (sc->sc_rx_pend) {
1288                 sc->sc_rx_pend = 0;
1289                 RAL_UNLOCK(sc);
1290                 rt2560_rx_intr(sc);
1291                 return (DDI_INTR_CLAIMED);
1292         }
1293         RAL_UNLOCK(sc);
1294         return (DDI_INTR_UNCLAIMED);
1295 }
1296 
1297 /*
1298  * Return the expected ack rate for a frame transmitted at rate `rate'.
1299  * XXX: this should depend on the destination node basic rate set.
1300  */
1301 static int
1302 rt2560_ack_rate(struct ieee80211com *ic, int rate)
1303 {
1304         switch (rate) {
1305         /* CCK rates */
1306         case 2:
1307                 return (2);
1308         case 4:
1309         case 11:
1310         case 22:
1311                 return ((ic->ic_curmode == IEEE80211_MODE_11B) ? 4 : rate);
1312 
1313         /* OFDM rates */
1314         case 12:
1315         case 18:
1316                 return (12);
1317         case 24:
1318         case 36:
1319                 return (24);
1320         case 48:
1321         case 72:
1322         case 96:
1323         case 108:
1324                 return (48);
1325         }
1326 
1327         /* default to 1Mbps */
1328         return (2);
1329 }
1330 
1331 /*
1332  * Compute the duration (in us) needed to transmit `len' bytes at rate `rate'.
1333  * The function automatically determines the operating mode depending on the
1334  * given rate. `flags' indicates whether short preamble is in use or not.
1335  */
1336 static uint16_t
1337 rt2560_txtime(int len, int rate, uint32_t flags)
1338 {
1339         uint16_t txtime;
1340 
1341         if (RAL_RATE_IS_OFDM(rate)) {
1342                 /* IEEE Std 802.11a-1999, pp. 37 */
1343                 txtime = (8 + 4 * len + 3 + rate - 1) / rate;
1344                 txtime = 16 + 4 + 4 * txtime + 6;
1345         } else {
1346                 /* IEEE Std 802.11b-1999, pp. 28 */
1347                 txtime = (16 * len + rate - 1) / rate;
1348                 if (rate != 2 && (flags & IEEE80211_F_SHPREAMBLE))
1349                         txtime +=  72 + 24;
1350                 else
1351                         txtime += 144 + 48;
1352         }
1353 
1354         return (txtime);
1355 }
1356 
1357 static uint8_t
1358 rt2560_plcp_signal(int rate)
1359 {
1360         switch (rate) {
1361         /* CCK rates (returned values are device-dependent) */
1362         case 2:         return (0x0);
1363         case 4:         return (0x1);
1364         case 11:        return (0x2);
1365         case 22:        return (0x3);
1366 
1367         /* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1368         case 12:        return (0xb);
1369         case 18:        return (0xf);
1370         case 24:        return (0xa);
1371         case 36:        return (0xe);
1372         case 48:        return (0x9);
1373         case 72:        return (0xd);
1374         case 96:        return (0x8);
1375         case 108:       return (0xc);
1376 
1377         /* unsupported rates (should not get there) */
1378         default:        return (0xff);
1379         }
1380 }
1381 
1382 void
1383 rt2560_setup_tx_desc(struct rt2560_softc *sc, struct rt2560_tx_desc *desc,
1384     uint32_t flags, int len, int rate, int encrypt)
1385 {
1386         struct ieee80211com *ic = &sc->sc_ic;
1387         uint16_t plcp_length;
1388         int remainder;
1389 
1390         desc->flags = LE_32(flags);
1391         desc->flags |= LE_32(len << 16);
1392         desc->flags |= encrypt ? LE_32(RT2560_TX_CIPHER_BUSY) :
1393             LE_32(RT2560_TX_BUSY | RT2560_TX_VALID);
1394 
1395         desc->wme = LE_16(
1396             RT2560_AIFSN(2) |
1397             RT2560_LOGCWMIN(3) |
1398             RT2560_LOGCWMAX(8));
1399 
1400         /* setup PLCP fields */
1401         desc->plcp_signal  = rt2560_plcp_signal(rate);
1402         desc->plcp_service = 4;
1403 
1404         len += IEEE80211_CRC_LEN;
1405         if (RAL_RATE_IS_OFDM(rate)) {
1406                 desc->flags |= LE_32(RT2560_TX_OFDM);
1407 
1408                 plcp_length = len & 0xfff;
1409                 desc->plcp_length_hi = plcp_length >> 6;
1410                 desc->plcp_length_lo = plcp_length & 0x3f;
1411         } else {
1412                 plcp_length = (16 * len + rate - 1) / rate;
1413                 if (rate == 22) {
1414                         remainder = (16 * len) % 22;
1415                         if (remainder != 0 && remainder < 7)
1416                                 desc->plcp_service |= RT2560_PLCP_LENGEXT;
1417                 }
1418                 desc->plcp_length_hi = plcp_length >> 8;
1419                 desc->plcp_length_lo = plcp_length & 0xff;
1420 
1421                 if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1422                         desc->plcp_signal |= 0x08;
1423         }
1424 }
1425 
1426 /* ARGSUSED */
1427 int
1428 rt2560_mgmt_send(ieee80211com_t *ic, mblk_t *mp, uint8_t type)
1429 {
1430         struct rt2560_softc *sc = (struct rt2560_softc *)ic;
1431         struct rt2560_tx_desc *desc;
1432         struct rt2560_tx_data *data;
1433         struct ieee80211_frame *wh;
1434         uint16_t dur;
1435         uint32_t flags = 0;
1436         int rate, err = DDI_SUCCESS;
1437 
1438         int off, pktlen, mblen;
1439         caddr_t dest;
1440         mblk_t *m, *m0;
1441 
1442         struct dma_region *dr;
1443         uint32_t idx;
1444         struct ieee80211_node *ni;
1445         struct ieee80211_key *k;
1446 
1447         mutex_enter(&sc->prioq.tx_lock);
1448 
1449         if (!RAL_IS_RUNNING(sc)) {
1450                 err = ENXIO;
1451                 goto fail1;
1452         }
1453 
1454         if (sc->prioq.queued >= RT2560_PRIO_RING_COUNT) {
1455                 err = ENOMEM;
1456                 sc->sc_tx_nobuf++;
1457                 goto fail1;
1458         }
1459 
1460         m = allocb(msgdsize(mp) + 32, BPRI_MED);
1461         if (m == NULL) {
1462                 ral_debug(RAL_DBG_TX, "rt2560_mgmt_send: can't alloc mblk.\n");
1463                 err = DDI_FAILURE;
1464                 goto fail1;
1465         }
1466 
1467         for (off = 0, m0 = mp; m0 != NULL; m0 = m0->b_cont) {
1468                 mblen = MBLKL(m0);
1469                 (void) memcpy(m->b_rptr + off, m0->b_rptr, mblen);
1470                 off += mblen;
1471         }
1472         m->b_wptr += off;
1473 
1474         wh = (struct ieee80211_frame *)m->b_rptr;
1475         ni = ieee80211_find_txnode(ic, wh->i_addr1);
1476 
1477         if (ni == NULL) {
1478                 err = DDI_FAILURE;
1479                 sc->sc_tx_err++;
1480                 goto fail2;
1481         }
1482 
1483         /* to support shared_key auth mode */
1484         if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1485                 k = ieee80211_crypto_encap(ic, m);
1486                 if (k == NULL) {
1487                         err = DDI_FAILURE;
1488                         sc->sc_tx_err++;
1489                         goto fail3;
1490                 }
1491                 /* packet header may have moved, reset our local pointer */
1492                 wh = (struct ieee80211_frame *)m->b_rptr;
1493         }
1494 
1495         desc = &sc->prioq.desc[sc->prioq.cur];
1496         data = &sc->prioq.data[sc->prioq.cur];
1497 
1498         rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
1499         data->ni = ieee80211_ref_node(ni);
1500 
1501         pktlen = msgdsize(m);
1502         dest = data->buf;
1503         bcopy(m->b_rptr, dest, pktlen);
1504 
1505         wh = (struct ieee80211_frame *)m->b_rptr;
1506         if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1507                 flags |= RT2560_TX_ACK;
1508 
1509                 dur = rt2560_txtime(RAL_ACK_SIZE, rate, ic->ic_flags) +
1510                     RAL_SIFS;
1511                 /* LINTED E_BAD_PTR_CAST_ALIGN */
1512                 *(uint16_t *)wh->i_dur = LE_16(dur);
1513 
1514                 /* tell hardware to add timestamp for probe responses */
1515                 if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1516                     IEEE80211_FC0_TYPE_MGT &&
1517                     (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1518                     IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1519                         flags |= RT2560_TX_TIMESTAMP;
1520         }
1521 
1522         rt2560_setup_tx_desc(sc, desc, flags, pktlen, rate, 0);
1523 
1524         idx = sc->prioq.cur;
1525 
1526         dr = &sc->prioq.dr_txbuf[idx];
1527         (void) ddi_dma_sync(dr->dr_hnd, 0, RAL_TXBUF_SIZE, DDI_DMA_SYNC_FORDEV);
1528 
1529         dr = &sc->prioq.dr_desc;
1530         (void) ddi_dma_sync(dr->dr_hnd, idx * RT2560_TX_DESC_SIZE,
1531             RT2560_TX_DESC_SIZE, DDI_DMA_SYNC_FORDEV);
1532 
1533         ral_debug(RAL_DBG_MGMT, "sending mgt frame len=%u idx=%u rate=%u\n",
1534             pktlen, sc->prioq.cur, rate);
1535 
1536         /* kick prio */
1537         sc->prioq.queued++; /* IF > RT2560_PRIO_RING_COUNT? FULL */
1538         sc->prioq.cur = (sc->prioq.cur + 1) % RT2560_PRIO_RING_COUNT;
1539         RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_PRIO);
1540 
1541         sc->sc_tx_timer = 5;
1542 
1543         ic->ic_stats.is_tx_frags++;
1544         ic->ic_stats.is_tx_bytes += pktlen;
1545 
1546 fail3:
1547         ieee80211_free_node(ni);
1548 fail2:
1549         freemsg(m);
1550 fail1:
1551         freemsg(mp);
1552         mutex_exit(&sc->prioq.tx_lock);
1553 
1554         return (err);
1555 }
1556 
1557 static int
1558 rt2560_send(ieee80211com_t *ic, mblk_t *mp)
1559 {
1560         struct rt2560_softc *sc = (struct rt2560_softc *)ic;
1561         struct rt2560_tx_desc *desc;
1562         struct rt2560_tx_data *data;
1563         struct rt2560_node *rn;
1564         struct ieee80211_rateset *rs;
1565         struct ieee80211_frame *wh;
1566         struct ieee80211_key *k;
1567         uint16_t dur;
1568         uint32_t flags = 0;
1569         int rate, err = DDI_SUCCESS;
1570 
1571         struct ieee80211_node *ni;
1572         mblk_t *m, *m0;
1573         int off, mblen, pktlen;
1574         caddr_t dest;
1575 
1576         struct dma_region *dr;
1577         uint32_t idx;
1578 
1579         mutex_enter(&sc->txq.tx_lock);
1580 
1581         if (sc->txq.queued >= RT2560_TX_RING_COUNT - 1) {
1582                 ral_debug(RAL_DBG_TX, "ral: rt2560_tx_data(): "
1583                     "no TX DMA buffer available!\n");
1584                 sc->sc_need_sched = 1;
1585                 sc->sc_tx_nobuf++;
1586                 err = ENOMEM;
1587                 goto fail1;
1588         }
1589 
1590         m = allocb(msgdsize(mp) + 32, BPRI_MED);
1591         if (m == NULL) {
1592                 ral_debug(RAL_DBG_TX, "rt2560_xmit(): can't alloc mblk.\n");
1593                 err = DDI_FAILURE;
1594                 goto fail1;
1595         }
1596 
1597         for (off = 0, m0 = mp; m0 != NULL; m0 = m0->b_cont) {
1598                 mblen = MBLKL(m0);
1599                 (void) memcpy(m->b_rptr + off, m0->b_rptr, mblen);
1600                 off += mblen;
1601         }
1602         m->b_wptr += off;
1603 
1604         wh = (struct ieee80211_frame *)m->b_rptr;
1605         ni = ieee80211_find_txnode(ic, wh->i_addr1);
1606 
1607         if (ni == NULL) {
1608                 err = DDI_FAILURE;
1609                 sc->sc_tx_err++;
1610                 goto fail2;
1611         }
1612 
1613         (void) ieee80211_encap(ic, m, ni);
1614 
1615         if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1616                 k = ieee80211_crypto_encap(ic, m);
1617                 if (k == NULL) {
1618                         sc->sc_tx_err++;
1619                         err = DDI_FAILURE;
1620                         goto fail3;
1621                 }
1622                 /* packet header may have moved, reset our local pointer */
1623                 wh = (struct ieee80211_frame *)m->b_rptr;
1624         }
1625 
1626         /*
1627          * RTS/CTS exchange ignore, since the max packet will less than
1628          * the rtsthreshold (2346)
1629          * Unnecessary codes deleted.
1630          */
1631 
1632         data = &sc->txq.data[sc->txq.cur];
1633         desc = &sc->txq.desc[sc->txq.cur];
1634 
1635         data->ni = ieee80211_ref_node(ni);
1636 
1637         pktlen = msgdsize(m);
1638         dest = data->buf;
1639         bcopy(m->b_rptr, dest, pktlen);
1640 
1641         if (ic->ic_fixed_rate != IEEE80211_FIXED_RATE_NONE) {
1642                 rs = &ic->ic_sup_rates[ic->ic_curmode];
1643                 rate = rs->ir_rates[ic->ic_fixed_rate];
1644         } else {
1645                 rs = &ni->in_rates;
1646                 rn = (struct rt2560_node *)ni;
1647                 ni->in_txrate = ral_rssadapt_choose(&rn->rssadapt, rs, wh,
1648                     pktlen, NULL, 0);
1649                 rate = rs->ir_rates[ni->in_txrate];
1650         }
1651 
1652         rate &= IEEE80211_RATE_VAL;
1653         if (rate <= 0) {
1654                 rate = 2;       /* basic rate */
1655         }
1656 
1657         /* remember link conditions for rate adaptation algorithm */
1658         if (ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE) {
1659                 data->id.id_len = pktlen;
1660                 data->id.id_rateidx = ni->in_txrate;
1661                 data->id.id_node = ni;
1662                 data->id.id_rssi = ni->in_rssi;
1663         } else
1664                 data->id.id_node = NULL;
1665 
1666         if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1667                 flags |= RT2560_TX_ACK;
1668 
1669                 dur = rt2560_txtime(RAL_ACK_SIZE, rt2560_ack_rate(ic, rate),
1670                     ic->ic_flags) + RAL_SIFS;
1671                 /* LINTED E_BAD_PTR_CAST_ALIGN */
1672                 *(uint16_t *)wh->i_dur = LE_16(dur);
1673         }
1674 
1675         /* flags |= RT2560_TX_CIPHER_NONE; */
1676         rt2560_setup_tx_desc(sc, desc, flags, pktlen, rate, 0);
1677 
1678         idx = sc->txq.cur;
1679 
1680         dr = &sc->txq.dr_txbuf[idx];
1681         (void) ddi_dma_sync(dr->dr_hnd, 0, RAL_TXBUF_SIZE, DDI_DMA_SYNC_FORDEV);
1682 
1683         dr = &sc->txq.dr_desc;
1684         (void) ddi_dma_sync(dr->dr_hnd, idx * RT2560_TX_DESC_SIZE,
1685             RT2560_TX_DESC_SIZE, DDI_DMA_SYNC_FORDEV);
1686 
1687         ral_debug(RAL_DBG_TX, "sending data frame len=%u idx=%u rate=%u\n",
1688             pktlen, sc->txq.cur, rate);
1689 
1690         /* kick tx */
1691         sc->txq.queued++;
1692         sc->txq.cur = (sc->txq.cur + 1) % RT2560_TX_RING_COUNT;
1693         RAL_WRITE(sc, RT2560_TXCSR0, RT2560_KICK_TX);
1694 
1695         sc->sc_tx_timer = 5;
1696 
1697         ic->ic_stats.is_tx_frags++;
1698         ic->ic_stats.is_tx_bytes += pktlen;
1699 
1700         freemsg(mp);
1701 fail3:
1702         ieee80211_free_node(ni);
1703 fail2:
1704         freemsg(m);
1705 fail1:
1706         mutex_exit(&sc->txq.tx_lock);
1707         return (err);
1708 }
1709 
1710 static mblk_t *
1711 rt2560_m_tx(void *arg, mblk_t *mp)
1712 {
1713         struct rt2560_softc *sc = (struct rt2560_softc *)arg;
1714         struct ieee80211com *ic = &sc->sc_ic;
1715         mblk_t *next;
1716 
1717         if (!RAL_IS_RUNNING(sc)) {
1718                 freemsgchain(mp);
1719                 return (NULL);
1720         }
1721         /*
1722          * No data frames go out unless we're associated; this
1723          * should not happen as the 802.11 layer does not enable
1724          * the xmit queue until we enter the RUN state.
1725          */
1726         if (ic->ic_state != IEEE80211_S_RUN) {
1727                 ral_debug(RAL_DBG_TX, "ral: rt2560_m_tx(): "
1728                     "discard, state %u\n", ic->ic_state);
1729                 freemsgchain(mp);
1730                 return (NULL);
1731         }
1732 
1733         while (mp != NULL) {
1734                 next = mp->b_next;
1735                 mp->b_next = NULL;
1736                 if (rt2560_send(ic, mp) != DDI_SUCCESS) {
1737                         mp->b_next = next;
1738                         freemsgchain(mp);
1739                         return (NULL);
1740                 }
1741                 mp = next;
1742         }
1743         return (mp);
1744 }
1745 
1746 static void
1747 rt2560_set_macaddr(struct rt2560_softc *sc, uint8_t *addr)
1748 {
1749         uint32_t tmp;
1750 
1751         tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
1752         RAL_WRITE(sc, RT2560_CSR3, tmp);
1753 
1754         tmp = addr[4] | addr[5] << 8;
1755         RAL_WRITE(sc, RT2560_CSR4, tmp);
1756 
1757         ral_debug(RAL_DBG_HW,
1758             "setting MAC address to " MACSTR "\n", MAC2STR(addr));
1759 }
1760 
1761 static void
1762 rt2560_get_macaddr(struct rt2560_softc *sc, uint8_t *addr)
1763 {
1764         uint32_t tmp;
1765 
1766         tmp = RAL_READ(sc, RT2560_CSR3);
1767         addr[0] = tmp & 0xff;
1768         addr[1] = (tmp >>  8) & 0xff;
1769         addr[2] = (tmp >> 16) & 0xff;
1770         addr[3] = (tmp >> 24);
1771 
1772         tmp = RAL_READ(sc, RT2560_CSR4);
1773         addr[4] = tmp & 0xff;
1774         addr[5] = (tmp >> 8) & 0xff;
1775 }
1776 
1777 static void
1778 rt2560_update_promisc(struct rt2560_softc *sc)
1779 {
1780         uint32_t tmp;
1781 
1782         tmp = RAL_READ(sc, RT2560_RXCSR0);
1783         tmp &= ~RT2560_DROP_NOT_TO_ME;
1784         if (!(sc->sc_rcr & RAL_RCR_PROMISC))
1785                 tmp |= RT2560_DROP_NOT_TO_ME;
1786 
1787         RAL_WRITE(sc, RT2560_RXCSR0, tmp);
1788         ral_debug(RAL_DBG_HW, "%s promiscuous mode\n",
1789             (sc->sc_rcr & RAL_RCR_PROMISC) ?  "entering" : "leaving");
1790 }
1791 
1792 static const char *
1793 rt2560_get_rf(int rev)
1794 {
1795         switch (rev) {
1796         case RT2560_RF_2522:    return ("RT2522");
1797         case RT2560_RF_2523:    return ("RT2523");
1798         case RT2560_RF_2524:    return ("RT2524");
1799         case RT2560_RF_2525:    return ("RT2525");
1800         case RT2560_RF_2525E:   return ("RT2525e");
1801         case RT2560_RF_2526:    return ("RT2526");
1802         case RT2560_RF_5222:    return ("RT5222");
1803         default:                return ("unknown");
1804         }
1805 }
1806 
1807 static void
1808 rt2560_read_eeprom(struct rt2560_softc *sc)
1809 {
1810         uint16_t val;
1811         int i;
1812 
1813         val = rt2560_eeprom_read(sc, RT2560_EEPROM_CONFIG0);
1814         sc->rf_rev =   (val >> 11) & 0x7;
1815         sc->hw_radio = (val >> 10) & 0x1;
1816         sc->led_mode = (val >> 6)  & 0x7;
1817         sc->rx_ant =   (val >> 4)  & 0x3;
1818         sc->tx_ant =   (val >> 2)  & 0x3;
1819         sc->nb_ant =   val & 0x3;
1820 
1821         /* read default values for BBP registers */
1822         for (i = 0; i < 16; i++) {
1823                 val = rt2560_eeprom_read(sc, RT2560_EEPROM_BBP_BASE + i);
1824                 sc->bbp_prom[i].reg = val >> 8;
1825                 sc->bbp_prom[i].val = val & 0xff;
1826         }
1827 
1828         /* read Tx power for all b/g channels */
1829         for (i = 0; i < 14 / 2; i++) {
1830                 val = rt2560_eeprom_read(sc, RT2560_EEPROM_TXPOWER + i);
1831                 sc->txpow[i * 2] = val >> 8;
1832                 sc->txpow[i * 2 + 1] = val & 0xff;
1833         }
1834 }
1835 
1836 static int
1837 rt2560_bbp_init(struct rt2560_softc *sc)
1838 {
1839 #define N(a)    (sizeof (a) / sizeof ((a)[0]))
1840         int i, ntries;
1841 
1842         /* wait for BBP to be ready */
1843         for (ntries = 0; ntries < 100; ntries++) {
1844                 if (rt2560_bbp_read(sc, RT2560_BBP_VERSION) != 0)
1845                         break;
1846                 drv_usecwait(1);
1847         }
1848         if (ntries == 100) {
1849                 ral_debug(RAL_DBG_HW, "timeout waiting for BBP\n");
1850                 return (EIO);
1851         }
1852         /* initialize BBP registers to default values */
1853         for (i = 0; i < N(rt2560_def_bbp); i++) {
1854                 rt2560_bbp_write(sc, rt2560_def_bbp[i].reg,
1855                     rt2560_def_bbp[i].val);
1856         }
1857 
1858         return (0);
1859 #undef N
1860 }
1861 
1862 static void
1863 rt2560_set_txantenna(struct rt2560_softc *sc, int antenna)
1864 {
1865         uint32_t tmp;
1866         uint8_t tx;
1867 
1868         tx = rt2560_bbp_read(sc, RT2560_BBP_TX) & ~RT2560_BBP_ANTMASK;
1869         if (antenna == 1)
1870                 tx |= RT2560_BBP_ANTA;
1871         else if (antenna == 2)
1872                 tx |= RT2560_BBP_ANTB;
1873         else
1874                 tx |= RT2560_BBP_DIVERSITY;
1875 
1876         /* need to force I/Q flip for RF 2525e, 2526 and 5222 */
1877         if (sc->rf_rev == RT2560_RF_2525E || sc->rf_rev == RT2560_RF_2526 ||
1878             sc->rf_rev == RT2560_RF_5222)
1879                 tx |= RT2560_BBP_FLIPIQ;
1880 
1881         rt2560_bbp_write(sc, RT2560_BBP_TX, tx);
1882 
1883         /* update values for CCK and OFDM in BBPCSR1 */
1884         tmp = RAL_READ(sc, RT2560_BBPCSR1) & ~0x00070007;
1885         tmp |= (tx & 0x7) << 16 | (tx & 0x7);
1886         RAL_WRITE(sc, RT2560_BBPCSR1, tmp);
1887 }
1888 
1889 static void
1890 rt2560_set_rxantenna(struct rt2560_softc *sc, int antenna)
1891 {
1892         uint8_t rx;
1893 
1894         rx = rt2560_bbp_read(sc, RT2560_BBP_RX) & ~RT2560_BBP_ANTMASK;
1895         if (antenna == 1)
1896                 rx |= RT2560_BBP_ANTA;
1897         else if (antenna == 2)
1898                 rx |= RT2560_BBP_ANTB;
1899         else
1900                 rx |= RT2560_BBP_DIVERSITY;
1901 
1902         /* need to force no I/Q flip for RF 2525e and 2526 */
1903         if (sc->rf_rev == RT2560_RF_2525E || sc->rf_rev == RT2560_RF_2526)
1904                 rx &= ~RT2560_BBP_FLIPIQ;
1905 
1906         rt2560_bbp_write(sc, RT2560_BBP_RX, rx);
1907 }
1908 
1909 static void
1910 rt2560_stop(struct rt2560_softc *sc)
1911 {
1912         struct ieee80211com *ic = &sc->sc_ic;
1913 
1914         ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
1915         ieee80211_stop_watchdog(ic);    /* stop the watchdog */
1916 
1917         RAL_LOCK(sc);
1918         sc->sc_tx_timer = 0;
1919 
1920         /* abort Tx */
1921         RAL_WRITE(sc, RT2560_TXCSR0, RT2560_ABORT_TX);
1922 
1923         /* disable Rx */
1924         RAL_WRITE(sc, RT2560_RXCSR0, RT2560_DISABLE_RX);
1925 
1926         /* reset ASIC (imply reset BBP) */
1927         RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
1928         RAL_WRITE(sc, RT2560_CSR1, 0);
1929 
1930         /* disable interrupts */
1931         RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
1932 
1933         /* reset Tx and Rx rings */
1934         rt2560_reset_tx_ring(sc, &sc->txq);
1935         rt2560_reset_tx_ring(sc, &sc->prioq);
1936         rt2560_reset_rx_ring(sc, &sc->rxq);
1937         RAL_UNLOCK(sc);
1938 }
1939 
1940 static int
1941 rt2560_init(struct rt2560_softc *sc)
1942 {
1943 #define N(a)    (sizeof (a) / sizeof ((a)[0]))
1944         /* struct rt2560_softc *sc = priv; */
1945         struct ieee80211com *ic = &sc->sc_ic;
1946         uint32_t tmp;
1947         int i;
1948 
1949         rt2560_stop(sc);
1950 
1951         RAL_LOCK(sc);
1952         /* setup tx/rx ring */
1953         rt2560_ring_hwsetup(sc);
1954 
1955         /* initialize MAC registers to default values */
1956         for (i = 0; i < N(rt2560_def_mac); i++)
1957                 RAL_WRITE(sc, rt2560_def_mac[i].reg, rt2560_def_mac[i].val);
1958 
1959         rt2560_set_macaddr(sc, ic->ic_macaddr);
1960 
1961         /* set basic rate set (will be updated later) */
1962         RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x153);
1963 
1964         rt2560_set_txantenna(sc, sc->tx_ant);
1965         rt2560_set_rxantenna(sc, sc->rx_ant);
1966         rt2560_update_slot(ic, 1);
1967         rt2560_update_plcp(sc);
1968         rt2560_update_led(sc, 0, 0);
1969 
1970         RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
1971         RAL_WRITE(sc, RT2560_CSR1, RT2560_HOST_READY);
1972 
1973         if (rt2560_bbp_init(sc) != 0) {
1974                 RAL_UNLOCK(sc);
1975                 rt2560_stop(sc);
1976                 return (DDI_FAILURE);
1977         }
1978 
1979         /* set default BSS channel */
1980         rt2560_set_chan(sc, ic->ic_curchan);
1981 
1982         /* kick Rx */
1983         tmp = RT2560_DROP_PHY_ERROR | RT2560_DROP_CRC_ERROR;
1984         if (ic->ic_opmode != IEEE80211_M_MONITOR) {
1985                 tmp |= RT2560_DROP_CTL | RT2560_DROP_VERSION_ERROR;
1986                 if (ic->ic_opmode != IEEE80211_M_HOSTAP)
1987                         tmp |= RT2560_DROP_TODS;
1988                 if (!(sc->sc_rcr & RAL_RCR_PROMISC))
1989                         tmp |= RT2560_DROP_NOT_TO_ME;
1990 
1991         }
1992         RAL_WRITE(sc, RT2560_RXCSR0, tmp);
1993 
1994         /* clear old FCS and Rx FIFO errors */
1995         (void) RAL_READ(sc, RT2560_CNT0);
1996         (void) RAL_READ(sc, RT2560_CNT4);
1997 
1998         /* clear any pending interrupts */
1999         RAL_WRITE(sc, RT2560_CSR7, 0xffffffff);
2000         /* enable interrupts */
2001         RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
2002 
2003         RAL_UNLOCK(sc);
2004 #undef N
2005         return (DDI_SUCCESS);
2006 }
2007 
2008 void
2009 rt2560_watchdog(void *arg)
2010 {
2011         struct rt2560_softc *sc = arg;
2012         struct ieee80211com *ic = &sc->sc_ic;
2013         int ntimer = 0;
2014 
2015         RAL_LOCK(sc);
2016         ic->ic_watchdog_timer = 0;
2017 
2018         if (!RAL_IS_RUNNING(sc)) {
2019                 RAL_UNLOCK(sc);
2020                 return;
2021         }
2022 
2023         if (sc->sc_tx_timer > 0) {
2024                 if (--sc->sc_tx_timer == 0) {
2025                         ral_debug(RAL_DBG_MSG, "tx timer timeout\n");
2026                         RAL_UNLOCK(sc);
2027                         (void) rt2560_init(sc);
2028                         (void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2029                         return;
2030                 }
2031         }
2032 
2033         if (ic->ic_state == IEEE80211_S_RUN)
2034                 ntimer = 1;
2035 
2036         RAL_UNLOCK(sc);
2037 
2038         ieee80211_watchdog(ic);
2039 
2040         if (ntimer)
2041                 ieee80211_start_watchdog(ic, ntimer);
2042 }
2043 
2044 static int
2045 rt2560_m_start(void *arg)
2046 {
2047         struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2048         int err;
2049 
2050         /*
2051          * initialize rt2560 hardware
2052          */
2053         err = rt2560_init(sc);
2054         if (err != DDI_SUCCESS) {
2055                 ral_debug(RAL_DBG_GLD, "device configuration failed\n");
2056                 goto fail;
2057         }
2058         sc->sc_flags |= RAL_FLAG_RUNNING;    /* RUNNING */
2059         return (err);
2060 
2061 fail:
2062         rt2560_stop(sc);
2063         return (err);
2064 }
2065 
2066 static void
2067 rt2560_m_stop(void *arg)
2068 {
2069         struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2070 
2071         (void) rt2560_stop(sc);
2072         sc->sc_flags &= ~RAL_FLAG_RUNNING;       /* STOP */
2073 }
2074 
2075 static int
2076 rt2560_m_unicst(void *arg, const uint8_t *macaddr)
2077 {
2078         struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2079         struct ieee80211com *ic = &sc->sc_ic;
2080 
2081         ral_debug(RAL_DBG_GLD, "rt2560_m_unicst(): " MACSTR "\n",
2082             MAC2STR(macaddr));
2083 
2084         IEEE80211_ADDR_COPY(ic->ic_macaddr, macaddr);
2085         (void) rt2560_set_macaddr(sc, (uint8_t *)macaddr);
2086         (void) rt2560_init(sc);
2087 
2088         return (0);
2089 }
2090 
2091 /*ARGSUSED*/
2092 static int
2093 rt2560_m_multicst(void *arg, boolean_t add, const uint8_t *mca)
2094 {
2095         return (0);
2096 }
2097 
2098 static int
2099 rt2560_m_promisc(void *arg, boolean_t on)
2100 {
2101         struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2102 
2103         if (on) {
2104                 sc->sc_rcr |= RAL_RCR_PROMISC;
2105                 sc->sc_rcr |= RAL_RCR_MULTI;
2106         } else {
2107                 sc->sc_rcr &= ~RAL_RCR_PROMISC;
2108                 sc->sc_rcr &= ~RAL_RCR_PROMISC;
2109         }
2110 
2111         rt2560_update_promisc(sc);
2112         return (0);
2113 }
2114 
2115 /*
2116  * callback functions for /get/set properties
2117  */
2118 static int
2119 rt2560_m_setprop(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
2120     uint_t wldp_length, const void *wldp_buf)
2121 {
2122         struct rt2560_softc *sc = arg;
2123         struct ieee80211com *ic = &sc->sc_ic;
2124         int err;
2125 
2126         err = ieee80211_setprop(ic, pr_name, wldp_pr_num,
2127             wldp_length, wldp_buf);
2128         RAL_LOCK(sc);
2129         if (err == ENETRESET) {
2130                 if (RAL_IS_RUNNING(sc)) {
2131                         RAL_UNLOCK(sc);
2132                         (void) rt2560_init(sc);
2133                         (void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2134                         RAL_LOCK(sc);
2135                 }
2136                 err = 0;
2137         }
2138         RAL_UNLOCK(sc);
2139 
2140         return (err);
2141 }
2142 
2143 static int
2144 rt2560_m_getprop(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
2145     uint_t wldp_length, void *wldp_buf)
2146 {
2147         struct rt2560_softc *sc = arg;
2148         int err;
2149 
2150         err = ieee80211_getprop(&sc->sc_ic, pr_name, wldp_pr_num,
2151             wldp_length, wldp_buf);
2152 
2153         return (err);
2154 }
2155 
2156 static void
2157 rt2560_m_propinfo(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
2158     mac_prop_info_handle_t prh)
2159 {
2160         struct rt2560_softc *sc = arg;
2161 
2162         ieee80211_propinfo(&sc->sc_ic, pr_name, wldp_pr_num, prh);
2163 }
2164 
2165 static void
2166 rt2560_m_ioctl(void* arg, queue_t *wq, mblk_t *mp)
2167 {
2168         struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2169         struct ieee80211com *ic = &sc->sc_ic;
2170         int err;
2171 
2172         err = ieee80211_ioctl(ic, wq, mp);
2173         RAL_LOCK(sc);
2174         if (err == ENETRESET) {
2175                 if (RAL_IS_RUNNING(sc)) {
2176                         RAL_UNLOCK(sc);
2177                         (void) rt2560_init(sc);
2178                         (void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2179                         RAL_LOCK(sc);
2180                 }
2181         }
2182         RAL_UNLOCK(sc);
2183 }
2184 
2185 static int
2186 rt2560_m_stat(void *arg, uint_t stat, uint64_t *val)
2187 {
2188         struct rt2560_softc *sc  = (struct rt2560_softc *)arg;
2189         ieee80211com_t  *ic = &sc->sc_ic;
2190         ieee80211_node_t *ni = ic->ic_bss;
2191         struct ieee80211_rateset *rs = &ni->in_rates;
2192 
2193         RAL_LOCK(sc);
2194         switch (stat) {
2195         case MAC_STAT_IFSPEED:
2196                 *val = ((ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE) ?
2197                     (rs->ir_rates[ni->in_txrate] & IEEE80211_RATE_VAL)
2198                     : ic->ic_fixed_rate) / 2 * 1000000;
2199                 break;
2200         case MAC_STAT_NOXMTBUF:
2201                 *val = sc->sc_tx_nobuf;
2202                 break;
2203         case MAC_STAT_NORCVBUF:
2204                 *val = sc->sc_rx_nobuf;
2205                 break;
2206         case MAC_STAT_IERRORS:
2207                 *val = sc->sc_rx_err;
2208                 break;
2209         case MAC_STAT_RBYTES:
2210                 *val = ic->ic_stats.is_rx_bytes;
2211                 break;
2212         case MAC_STAT_IPACKETS:
2213                 *val = ic->ic_stats.is_rx_frags;
2214                 break;
2215         case MAC_STAT_OBYTES:
2216                 *val = ic->ic_stats.is_tx_bytes;
2217                 break;
2218         case MAC_STAT_OPACKETS:
2219                 *val = ic->ic_stats.is_tx_frags;
2220                 break;
2221         case MAC_STAT_OERRORS:
2222         case WIFI_STAT_TX_FAILED:
2223                 *val = sc->sc_tx_err;
2224                 break;
2225         case WIFI_STAT_TX_RETRANS:
2226                 *val = sc->sc_tx_retries;
2227                 break;
2228         case WIFI_STAT_FCS_ERRORS:
2229         case WIFI_STAT_WEP_ERRORS:
2230         case WIFI_STAT_TX_FRAGS:
2231         case WIFI_STAT_MCAST_TX:
2232         case WIFI_STAT_RTS_SUCCESS:
2233         case WIFI_STAT_RTS_FAILURE:
2234         case WIFI_STAT_ACK_FAILURE:
2235         case WIFI_STAT_RX_FRAGS:
2236         case WIFI_STAT_MCAST_RX:
2237         case WIFI_STAT_RX_DUPS:
2238                 RAL_UNLOCK(sc);
2239                 return (ieee80211_stat(ic, stat, val));
2240         default:
2241                 RAL_UNLOCK(sc);
2242                 return (ENOTSUP);
2243         }
2244         RAL_UNLOCK(sc);
2245 
2246         return (0);
2247 }
2248 
2249 static uint_t
2250 rt2560_intr(caddr_t arg)
2251 {
2252         /* LINTED E_BAD_PTR_CAST_ALIGN */
2253         struct rt2560_softc *sc = (struct rt2560_softc *)arg;
2254         uint32_t r;
2255 
2256         RAL_LOCK(sc);
2257 
2258         if (!RAL_IS_RUNNING(sc)) {
2259                 /*
2260                  * The hardware is not ready/present, don't touch anything.
2261                  * Note this can happen early on if the IRQ is shared.
2262                  */
2263                 RAL_UNLOCK(sc);
2264                 return (DDI_INTR_UNCLAIMED);
2265         }
2266 
2267         r = RAL_READ(sc, RT2560_CSR7);
2268         RAL_WRITE(sc, RT2560_CSR7, r);
2269 
2270         if (r == 0xffffffff) {
2271                 RAL_UNLOCK(sc);
2272                 return (DDI_INTR_UNCLAIMED);
2273         }
2274 
2275         if (!(r & RT2560_INTR_ALL)) {
2276                 RAL_UNLOCK(sc);
2277                 return (DDI_INTR_UNCLAIMED);
2278         }
2279 
2280         /* disable interrupts */
2281         RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
2282 
2283         if (r & RT2560_TX_DONE) {
2284                 RAL_UNLOCK(sc);
2285                 rt2560_tx_intr(sc);
2286                 RAL_LOCK(sc);
2287         }
2288 
2289         if (r & RT2560_PRIO_DONE) {
2290                 RAL_UNLOCK(sc);
2291                 rt2560_prio_intr(sc);
2292                 RAL_LOCK(sc);
2293         }
2294 
2295         if (r & RT2560_RX_DONE) {
2296                 sc->sc_rx_pend = 1;
2297                 ddi_trigger_softintr(sc->sc_softint_id);
2298         }
2299 
2300         /* re-enable interrupts */
2301         RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
2302         RAL_UNLOCK(sc);
2303 
2304         return (DDI_INTR_CLAIMED);
2305 }
2306 
2307 /*
2308  * quiesce(9E) entry point.
2309  *
2310  * This function is called when the system is single-threaded at high
2311  * PIL with preemption disabled. Therefore, this function must not be
2312  * blocked.
2313  *
2314  * This function returns DDI_SUCCESS on success, or DDI_FAILURE on failure.
2315  * DDI_FAILURE indicates an error condition and should almost never happen.
2316  */
2317 static int32_t
2318 rt2560_quiesce(dev_info_t *devinfo)
2319 {
2320         struct rt2560_softc *sc;
2321 
2322         sc = ddi_get_soft_state(ral_soft_state_p, ddi_get_instance(devinfo));
2323         if (sc == NULL)
2324                 return (DDI_FAILURE);
2325 
2326         /* abort Tx */
2327         RAL_WRITE(sc, RT2560_TXCSR0, RT2560_ABORT_TX);
2328 
2329         /* disable Rx */
2330         RAL_WRITE(sc, RT2560_RXCSR0, RT2560_DISABLE_RX);
2331 
2332         /* reset ASIC (imply reset BBP) */
2333         RAL_WRITE(sc, RT2560_CSR1, RT2560_RESET_ASIC);
2334         RAL_WRITE(sc, RT2560_CSR1, 0);
2335 
2336         /* disable interrupts */
2337         RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);
2338 
2339         return (DDI_SUCCESS);
2340 }
2341 
2342 static int
2343 rt2560_attach(dev_info_t *devinfo, ddi_attach_cmd_t cmd)
2344 {
2345         struct rt2560_softc *sc;
2346         struct ieee80211com *ic;
2347         int err, i;
2348         int instance;
2349 
2350         ddi_acc_handle_t ioh;
2351         caddr_t regs;
2352         uint16_t vendor_id, device_id, command;
2353         uint8_t cachelsz;
2354         char strbuf[32];
2355 
2356         wifi_data_t wd = { 0 };
2357         mac_register_t *macp;
2358 
2359         switch (cmd) {
2360         case DDI_ATTACH:
2361                 break;
2362         case DDI_RESUME:
2363                 sc = ddi_get_soft_state(ral_soft_state_p,
2364                     ddi_get_instance(devinfo));
2365                 sc->sc_flags &= ~RAL_FLAG_SUSPENDING;
2366                 if (RAL_IS_INITED(sc))
2367                         (void) rt2560_init(sc);
2368                 return (DDI_SUCCESS);
2369         default:
2370                 return (DDI_FAILURE);
2371         }
2372 
2373         instance = ddi_get_instance(devinfo);
2374 
2375         if (ddi_soft_state_zalloc(ral_soft_state_p, instance) != DDI_SUCCESS) {
2376                 ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2377                     "unable to alloc soft_state_p\n");
2378                 return (DDI_FAILURE);
2379         }
2380 
2381         sc = ddi_get_soft_state(ral_soft_state_p, instance);
2382         ic = (ieee80211com_t *)&sc->sc_ic;
2383         sc->sc_dev = devinfo;
2384 
2385         /* pci configuration */
2386         err = ddi_regs_map_setup(devinfo, 0, &regs, 0, 0, &ral_csr_accattr,
2387             &ioh);
2388         if (err != DDI_SUCCESS) {
2389                 ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2390                     "ddi_regs_map_setup() failed");
2391                 goto fail1;
2392         }
2393 
2394         cachelsz = ddi_get8(ioh, (uint8_t *)(regs + PCI_CONF_CACHE_LINESZ));
2395         if (cachelsz == 0)
2396                 cachelsz = 0x10;
2397         sc->sc_cachelsz = cachelsz << 2;
2398 
2399         vendor_id = ddi_get16(ioh,
2400             (uint16_t *)((uintptr_t)regs + PCI_CONF_VENID));
2401         device_id = ddi_get16(ioh,
2402             (uint16_t *)((uintptr_t)regs + PCI_CONF_DEVID));
2403 
2404         ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): vendor 0x%x, "
2405             "device id 0x%x, cache size %d\n", vendor_id, device_id, cachelsz);
2406 
2407         /*
2408          * Enable response to memory space accesses,
2409          * and enabe bus master.
2410          */
2411         command = PCI_COMM_MAE | PCI_COMM_ME;
2412         ddi_put16(ioh, (uint16_t *)((uintptr_t)regs + PCI_CONF_COMM), command);
2413         ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2414             "set command reg to 0x%x \n", command);
2415 
2416         ddi_put8(ioh, (uint8_t *)(regs + PCI_CONF_LATENCY_TIMER), 0xa8);
2417         ddi_put8(ioh, (uint8_t *)(regs + PCI_CONF_ILINE), 0x10);
2418         ddi_regs_map_free(&ioh);
2419 
2420         /* pci i/o space */
2421         err = ddi_regs_map_setup(devinfo, 1,
2422             &sc->sc_rbase, 0, 0, &ral_csr_accattr, &sc->sc_ioh);
2423         ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2424             "regs map1 = %x err=%d\n", regs, err);
2425         if (err != DDI_SUCCESS) {
2426                 ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2427                     "ddi_regs_map_setup() failed");
2428                 goto fail1;
2429         }
2430 
2431         /* initialize the ral rate */
2432         ral_rate_init();
2433 
2434         /* retrieve RT2560 rev. no */
2435         sc->asic_rev = RAL_READ(sc, RT2560_CSR0);
2436 
2437         /* retrieve MAC address */
2438         rt2560_get_macaddr(sc, ic->ic_macaddr);
2439 
2440         /* retrieve RF rev. no and various other things from EEPROM */
2441         rt2560_read_eeprom(sc);
2442 
2443         ral_debug(RAL_DBG_GLD, "MAC/BBP RT2560 (rev 0x%02x), RF %s\n",
2444             sc->asic_rev, rt2560_get_rf(sc->rf_rev));
2445 
2446         /*
2447          * Allocate Tx and Rx rings.
2448          */
2449         err = rt2560_alloc_tx_ring(sc, &sc->txq, RT2560_TX_RING_COUNT);
2450         if (err != DDI_SUCCESS) {
2451                 ral_debug(RAL_DBG_GLD, "could not allocate Tx ring\n");
2452                 goto fail2;
2453         }
2454         err = rt2560_alloc_tx_ring(sc, &sc->prioq, RT2560_PRIO_RING_COUNT);
2455         if (err != DDI_SUCCESS) {
2456                 ral_debug(RAL_DBG_GLD, "could not allocate Prio ring\n");
2457                 goto fail3;
2458         }
2459         err = rt2560_alloc_rx_ring(sc, &sc->rxq, RT2560_RX_RING_COUNT);
2460         if (err != DDI_SUCCESS) {
2461                 ral_debug(RAL_DBG_GLD, "could not allocate Rx ring\n");
2462                 goto fail4;
2463         }
2464 
2465         mutex_init(&sc->sc_genlock, NULL, MUTEX_DRIVER, NULL);
2466         mutex_init(&sc->txq.tx_lock, NULL, MUTEX_DRIVER, NULL);
2467         mutex_init(&sc->prioq.tx_lock, NULL, MUTEX_DRIVER, NULL);
2468         mutex_init(&sc->rxq.rx_lock, NULL, MUTEX_DRIVER, NULL);
2469 
2470 
2471         ic->ic_phytype = IEEE80211_T_OFDM;   /* not only, but not used */
2472         ic->ic_opmode = IEEE80211_M_STA;     /* default to BSS mode */
2473         ic->ic_state = IEEE80211_S_INIT;
2474 
2475         ic->ic_maxrssi = 63;
2476         ic->ic_set_shortslot = rt2560_update_slot;
2477         ic->ic_xmit = rt2560_mgmt_send;
2478 
2479         /* set device capabilities */
2480         ic->ic_caps =
2481             IEEE80211_C_TXPMGT |        /* tx power management */
2482             IEEE80211_C_SHPREAMBLE |    /* short preamble supported */
2483             IEEE80211_C_SHSLOT;         /* short slot time supported */
2484 
2485         ic->ic_caps |= IEEE80211_C_WPA; /* Support WPA/WPA2 */
2486 
2487 #define IEEE80211_CHAN_A        \
2488         (IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_OFDM)
2489 
2490         if (sc->rf_rev == RT2560_RF_5222) {
2491                 /* set supported .11a rates */
2492                 ic->ic_sup_rates[IEEE80211_MODE_11A] = rt2560_rateset_11a;
2493 
2494                 /* set supported .11a channels */
2495                 for (i = 36; i <= 64; i += 4) {
2496                         ic->ic_sup_channels[i].ich_freq =
2497                             ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2498                         ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2499                 }
2500                 for (i = 100; i <= 140; i += 4) {
2501                         ic->ic_sup_channels[i].ich_freq =
2502                             ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2503                         ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2504                 }
2505                 for (i = 149; i <= 161; i += 4) {
2506                         ic->ic_sup_channels[i].ich_freq =
2507                             ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2508                         ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2509                 }
2510         }
2511 
2512         /* set supported .11b and .11g rates */
2513         ic->ic_sup_rates[IEEE80211_MODE_11B] = rt2560_rateset_11b;
2514         ic->ic_sup_rates[IEEE80211_MODE_11G] = rt2560_rateset_11g;
2515 
2516         /* set supported .11b and .11g channels (1 through 14) */
2517         for (i = 1; i <= 14; i++) {
2518                 ic->ic_sup_channels[i].ich_freq =
2519                     ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
2520                 ic->ic_sup_channels[i].ich_flags =
2521                     IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
2522                     IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
2523         }
2524 
2525         ieee80211_attach(ic);
2526 
2527         /* register WPA door */
2528         ieee80211_register_door(ic, ddi_driver_name(devinfo),
2529             ddi_get_instance(devinfo));
2530 
2531         ic->ic_node_alloc = rt2560_node_alloc;
2532         ic->ic_node_free = rt2560_node_free;
2533 
2534         /* override state transition machine */
2535         sc->sc_newstate = ic->ic_newstate;
2536         ic->ic_newstate = rt2560_newstate;
2537         ic->ic_watchdog = rt2560_watchdog;
2538         ieee80211_media_init(ic);
2539         ic->ic_def_txkey = 0;
2540 
2541         sc->sc_rcr = 0;
2542         sc->sc_rx_pend = 0;
2543         sc->dwelltime = 300;
2544         sc->sc_flags &= ~RAL_FLAG_RUNNING;
2545 
2546         err = ddi_add_softintr(devinfo, DDI_SOFTINT_LOW,
2547             &sc->sc_softint_id, NULL, 0, ral_softint_handler, (caddr_t)sc);
2548         if (err != DDI_SUCCESS) {
2549                 ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2550                     "ddi_add_softintr() failed");
2551                 goto fail5;
2552         }
2553 
2554         err = ddi_get_iblock_cookie(devinfo, 0, &sc->sc_iblock);
2555         if (err != DDI_SUCCESS) {
2556                 ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2557                     "Can not get iblock cookie for INT\n");
2558                 goto fail6;
2559         }
2560 
2561         err = ddi_add_intr(devinfo, 0, NULL, NULL, rt2560_intr, (caddr_t)sc);
2562         if (err != DDI_SUCCESS) {
2563                 ral_debug(RAL_DBG_GLD,
2564                     "unable to add device interrupt handler\n");
2565                 goto fail6;
2566         }
2567 
2568         /*
2569          * Provide initial settings for the WiFi plugin; whenever this
2570          * information changes, we need to call mac_plugindata_update()
2571          */
2572         wd.wd_opmode = ic->ic_opmode;
2573         wd.wd_secalloc = WIFI_SEC_NONE;
2574         IEEE80211_ADDR_COPY(wd.wd_bssid, ic->ic_bss->in_bssid);
2575 
2576         if ((macp = mac_alloc(MAC_VERSION)) == NULL) {
2577                 ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2578                     "MAC version mismatch\n");
2579                 goto fail7;
2580         }
2581 
2582         macp->m_type_ident   = MAC_PLUGIN_IDENT_WIFI;
2583         macp->m_driver               = sc;
2584         macp->m_dip          = devinfo;
2585         macp->m_src_addr     = ic->ic_macaddr;
2586         macp->m_callbacks    = &rt2560_m_callbacks;
2587         macp->m_min_sdu              = 0;
2588         macp->m_max_sdu              = IEEE80211_MTU;
2589         macp->m_pdata                = &wd;
2590         macp->m_pdata_size   = sizeof (wd);
2591 
2592         err = mac_register(macp, &ic->ic_mach);
2593         mac_free(macp);
2594         if (err != 0) {
2595                 ral_debug(RAL_DBG_GLD, "ral: rt2560_attach(): "
2596                     "mac_register err %x\n", err);
2597                 goto fail7;
2598         }
2599 
2600         /*
2601          * Create minor node of type DDI_NT_NET_WIFI
2602          */
2603         (void) snprintf(strbuf, sizeof (strbuf), "%s%d",
2604             "ral", instance);
2605         err = ddi_create_minor_node(devinfo, strbuf, S_IFCHR,
2606             instance + 1, DDI_NT_NET_WIFI, 0);
2607 
2608         if (err != DDI_SUCCESS)
2609                 ral_debug(RAL_DBG_GLD, "ddi_create_minor_node() failed\n");
2610 
2611         /*
2612          * Notify link is down now
2613          */
2614         mac_link_update(ic->ic_mach, LINK_STATE_DOWN);
2615 
2616         return (DDI_SUCCESS);
2617 fail7:
2618         ddi_remove_intr(devinfo, 0, sc->sc_iblock);
2619 fail6:
2620         ddi_remove_softintr(sc->sc_softint_id);
2621 fail5:
2622         mutex_destroy(&sc->sc_genlock);
2623         mutex_destroy(&sc->txq.tx_lock);
2624         mutex_destroy(&sc->prioq.tx_lock);
2625         mutex_destroy(&sc->rxq.rx_lock);
2626 
2627         rt2560_free_rx_ring(sc, &sc->rxq);
2628 fail4:
2629         rt2560_free_tx_ring(sc, &sc->prioq);
2630 fail3:
2631         rt2560_free_tx_ring(sc, &sc->txq);
2632 fail2:
2633         ddi_regs_map_free(&sc->sc_ioh);
2634 fail1:
2635         ddi_soft_state_free(ral_soft_state_p, ddi_get_instance(devinfo));
2636 
2637         return (DDI_FAILURE);
2638 }
2639 
2640 static int
2641 rt2560_detach(dev_info_t *devinfo, ddi_detach_cmd_t cmd)
2642 {
2643         struct rt2560_softc *sc;
2644 
2645         sc = ddi_get_soft_state(ral_soft_state_p, ddi_get_instance(devinfo));
2646         ASSERT(sc != NULL);
2647 
2648         switch (cmd) {
2649         case DDI_DETACH:
2650                 break;
2651         case DDI_SUSPEND:
2652                 if (RAL_IS_INITED(sc))
2653                         (void) rt2560_stop(sc);
2654                 sc->sc_flags |= RAL_FLAG_SUSPENDING;
2655                 return (DDI_SUCCESS);
2656         default:
2657                 return (DDI_FAILURE);
2658         }
2659 
2660         if (mac_disable(sc->sc_ic.ic_mach) != 0)
2661                 return (DDI_FAILURE);
2662 
2663         rt2560_stop(sc);
2664 
2665         /*
2666          * Unregister from the MAC layer subsystem
2667          */
2668         (void) mac_unregister(sc->sc_ic.ic_mach);
2669 
2670         ddi_remove_intr(devinfo, 0, sc->sc_iblock);
2671         ddi_remove_softintr(sc->sc_softint_id);
2672 
2673         /*
2674          * detach ieee80211 layer
2675          */
2676         ieee80211_detach(&sc->sc_ic);
2677 
2678         rt2560_free_tx_ring(sc, &sc->txq);
2679         rt2560_free_tx_ring(sc, &sc->prioq);
2680         rt2560_free_rx_ring(sc, &sc->rxq);
2681 
2682         ddi_regs_map_free(&sc->sc_ioh);
2683 
2684         mutex_destroy(&sc->sc_genlock);
2685         mutex_destroy(&sc->txq.tx_lock);
2686         mutex_destroy(&sc->prioq.tx_lock);
2687         mutex_destroy(&sc->rxq.rx_lock);
2688 
2689         ddi_remove_minor_node(devinfo, NULL);
2690         ddi_soft_state_free(ral_soft_state_p, ddi_get_instance(devinfo));
2691 
2692         return (DDI_SUCCESS);
2693 }
2694 
2695 int
2696 _info(struct modinfo *modinfop)
2697 {
2698         return (mod_info(&modlinkage, modinfop));
2699 }
2700 
2701 int
2702 _init(void)
2703 {
2704         int status;
2705 
2706         status = ddi_soft_state_init(&ral_soft_state_p,
2707             sizeof (struct rt2560_softc), 1);
2708         if (status != 0)
2709                 return (status);
2710 
2711         mac_init_ops(&ral_dev_ops, "ral");
2712         status = mod_install(&modlinkage);
2713         if (status != 0) {
2714                 mac_fini_ops(&ral_dev_ops);
2715                 ddi_soft_state_fini(&ral_soft_state_p);
2716         }
2717         return (status);
2718 }
2719 
2720 int
2721 _fini(void)
2722 {
2723         int status;
2724 
2725         status = mod_remove(&modlinkage);
2726         if (status == 0) {
2727                 mac_fini_ops(&ral_dev_ops);
2728                 ddi_soft_state_fini(&ral_soft_state_p);
2729         }
2730         return (status);
2731 }