1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2008 Weongyo Jeong <weongyo@freebsd.org>
5 * Copyright (c) 2007 Marvell Semiconductor, Inc.
6 * Copyright (c) 2007 Sam Leffler, Errno Consulting
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer,
14 * without modification.
15 * 2. Redistributions in binary form must reproduce at minimum a disclaimer
16 * similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
17 * redistribution must be conditioned upon including a substantially
18 * similar Disclaimer requirement for further binary redistribution.
19 *
20 * NO WARRANTY
21 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23 * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
24 * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
25 * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
26 * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
27 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
28 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
29 * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
30 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
31 * THE POSSIBILITY OF SUCH DAMAGES.
32 */
33
34 #include "opt_malo.h"
35
36 #include <sys/param.h>
37 #include <sys/endian.h>
38 #include <sys/kernel.h>
39 #include <sys/malloc.h>
40 #include <sys/socket.h>
41 #include <sys/sockio.h>
42 #include <sys/sysctl.h>
43 #include <sys/taskqueue.h>
44
45 #include <machine/bus.h>
46 #include <sys/bus.h>
47
48 #include <net/if.h>
49 #include <net/if_var.h>
50 #include <net/if_dl.h>
51 #include <net/if_media.h>
52 #include <net/if_types.h>
53 #include <net/ethernet.h>
54
55 #include <net80211/ieee80211_var.h>
56 #include <net80211/ieee80211_regdomain.h>
57
58 #include <net/bpf.h>
59
60 #include <dev/malo/if_malo.h>
61
62 SYSCTL_NODE(_hw, OID_AUTO, malo, CTLFLAG_RD | CTLFLAG_MPSAFE, 0,
63 "Marvell 88w8335 driver parameters");
64
65 static int malo_txcoalesce = 8; /* # tx pkts to q before poking f/w*/
66 SYSCTL_INT(_hw_malo, OID_AUTO, txcoalesce, CTLFLAG_RWTUN, &malo_txcoalesce,
67 0, "tx buffers to send at once");
68 static int malo_rxbuf = MALO_RXBUF; /* # rx buffers to allocate */
69 SYSCTL_INT(_hw_malo, OID_AUTO, rxbuf, CTLFLAG_RWTUN, &malo_rxbuf,
70 0, "rx buffers allocated");
71 static int malo_rxquota = MALO_RXBUF; /* # max buffers to process */
72 SYSCTL_INT(_hw_malo, OID_AUTO, rxquota, CTLFLAG_RWTUN, &malo_rxquota,
73 0, "max rx buffers to process per interrupt");
74 static int malo_txbuf = MALO_TXBUF; /* # tx buffers to allocate */
75 SYSCTL_INT(_hw_malo, OID_AUTO, txbuf, CTLFLAG_RWTUN, &malo_txbuf,
76 0, "tx buffers allocated");
77
78 #ifdef MALO_DEBUG
79 static int malo_debug = 0;
80 SYSCTL_INT(_hw_malo, OID_AUTO, debug, CTLFLAG_RWTUN, &malo_debug,
81 0, "control debugging printfs");
82 enum {
83 MALO_DEBUG_XMIT = 0x00000001, /* basic xmit operation */
84 MALO_DEBUG_XMIT_DESC = 0x00000002, /* xmit descriptors */
85 MALO_DEBUG_RECV = 0x00000004, /* basic recv operation */
86 MALO_DEBUG_RECV_DESC = 0x00000008, /* recv descriptors */
87 MALO_DEBUG_RESET = 0x00000010, /* reset processing */
88 MALO_DEBUG_INTR = 0x00000040, /* ISR */
89 MALO_DEBUG_TX_PROC = 0x00000080, /* tx ISR proc */
90 MALO_DEBUG_RX_PROC = 0x00000100, /* rx ISR proc */
91 MALO_DEBUG_STATE = 0x00000400, /* 802.11 state transitions */
92 MALO_DEBUG_NODE = 0x00000800, /* node management */
93 MALO_DEBUG_RECV_ALL = 0x00001000, /* trace all frames (beacons) */
94 MALO_DEBUG_FW = 0x00008000, /* firmware */
95 MALO_DEBUG_ANY = 0xffffffff
96 };
97 #define IFF_DUMPPKTS_RECV(sc, wh) \
98 (((sc->malo_debug & MALO_DEBUG_RECV) && \
99 ((sc->malo_debug & MALO_DEBUG_RECV_ALL) || !IEEE80211_IS_MGMT_BEACON(wh))))
100 #define IFF_DUMPPKTS_XMIT(sc) \
101 (sc->malo_debug & MALO_DEBUG_XMIT)
102 #define DPRINTF(sc, m, fmt, ...) do { \
103 if (sc->malo_debug & (m)) \
104 printf(fmt, __VA_ARGS__); \
105 } while (0)
106 #else
107 #define DPRINTF(sc, m, fmt, ...) do { \
108 (void) sc; \
109 } while (0)
110 #endif
111
112 static MALLOC_DEFINE(M_MALODEV, "malodev", "malo driver dma buffers");
113
114 static struct ieee80211vap *malo_vap_create(struct ieee80211com *,
115 const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
116 const uint8_t [IEEE80211_ADDR_LEN],
117 const uint8_t [IEEE80211_ADDR_LEN]);
118 static void malo_vap_delete(struct ieee80211vap *);
119 static int malo_dma_setup(struct malo_softc *);
120 static int malo_setup_hwdma(struct malo_softc *);
121 static void malo_txq_init(struct malo_softc *, struct malo_txq *, int);
122 static void malo_tx_cleanupq(struct malo_softc *, struct malo_txq *);
123 static void malo_parent(struct ieee80211com *);
124 static int malo_transmit(struct ieee80211com *, struct mbuf *);
125 static void malo_start(struct malo_softc *);
126 static void malo_watchdog(void *);
127 static void malo_updateslot(struct ieee80211com *);
128 static int malo_newstate(struct ieee80211vap *, enum ieee80211_state, int);
129 static void malo_scan_start(struct ieee80211com *);
130 static void malo_scan_end(struct ieee80211com *);
131 static void malo_set_channel(struct ieee80211com *);
132 static int malo_raw_xmit(struct ieee80211_node *, struct mbuf *,
133 const struct ieee80211_bpf_params *);
134 static void malo_sysctlattach(struct malo_softc *);
135 static void malo_announce(struct malo_softc *);
136 static void malo_dma_cleanup(struct malo_softc *);
137 static void malo_stop(struct malo_softc *);
138 static int malo_chan_set(struct malo_softc *, struct ieee80211_channel *);
139 static int malo_mode_init(struct malo_softc *);
140 static void malo_tx_proc(void *, int);
141 static void malo_rx_proc(void *, int);
142 static void malo_init(void *);
143
144 /*
145 * Read/Write shorthands for accesses to BAR 0. Note that all BAR 1
146 * operations are done in the "hal" except getting H/W MAC address at
147 * malo_attach and there should be no reference to them here.
148 */
149 static uint32_t
malo_bar0_read4(struct malo_softc * sc,bus_size_t off)150 malo_bar0_read4(struct malo_softc *sc, bus_size_t off)
151 {
152 return bus_space_read_4(sc->malo_io0t, sc->malo_io0h, off);
153 }
154
155 static void
malo_bar0_write4(struct malo_softc * sc,bus_size_t off,uint32_t val)156 malo_bar0_write4(struct malo_softc *sc, bus_size_t off, uint32_t val)
157 {
158 DPRINTF(sc, MALO_DEBUG_FW, "%s: off 0x%jx val 0x%x\n",
159 __func__, (uintmax_t)off, val);
160
161 bus_space_write_4(sc->malo_io0t, sc->malo_io0h, off, val);
162 }
163
164 int
malo_attach(uint16_t devid,struct malo_softc * sc)165 malo_attach(uint16_t devid, struct malo_softc *sc)
166 {
167 struct ieee80211com *ic = &sc->malo_ic;
168 struct malo_hal *mh;
169 int error;
170 uint8_t bands[IEEE80211_MODE_BYTES];
171
172 MALO_LOCK_INIT(sc);
173 callout_init_mtx(&sc->malo_watchdog_timer, &sc->malo_mtx, 0);
174 mbufq_init(&sc->malo_snd, ifqmaxlen);
175
176 mh = malo_hal_attach(sc->malo_dev, devid,
177 sc->malo_io1h, sc->malo_io1t, sc->malo_dmat);
178 if (mh == NULL) {
179 device_printf(sc->malo_dev, "unable to attach HAL\n");
180 error = EIO;
181 goto bad;
182 }
183 sc->malo_mh = mh;
184
185 /*
186 * Load firmware so we can get setup. We arbitrarily pick station
187 * firmware; we'll re-load firmware as needed so setting up
188 * the wrong mode isn't a big deal.
189 */
190 error = malo_hal_fwload(mh, "malo8335-h", "malo8335-m");
191 if (error != 0) {
192 device_printf(sc->malo_dev, "unable to setup firmware\n");
193 goto bad1;
194 }
195 /* XXX gethwspecs() extracts correct informations? not maybe! */
196 error = malo_hal_gethwspecs(mh, &sc->malo_hwspecs);
197 if (error != 0) {
198 device_printf(sc->malo_dev, "unable to fetch h/w specs\n");
199 goto bad1;
200 }
201
202 DPRINTF(sc, MALO_DEBUG_FW,
203 "malo_hal_gethwspecs: hwversion 0x%x hostif 0x%x"
204 "maxnum_wcb 0x%x maxnum_mcaddr 0x%x maxnum_tx_wcb 0x%x"
205 "regioncode 0x%x num_antenna 0x%x fw_releasenum 0x%x"
206 "wcbbase0 0x%x rxdesc_read 0x%x rxdesc_write 0x%x"
207 "ul_fw_awakecookie 0x%x w[4] = %x %x %x %x",
208 sc->malo_hwspecs.hwversion,
209 sc->malo_hwspecs.hostinterface, sc->malo_hwspecs.maxnum_wcb,
210 sc->malo_hwspecs.maxnum_mcaddr, sc->malo_hwspecs.maxnum_tx_wcb,
211 sc->malo_hwspecs.regioncode, sc->malo_hwspecs.num_antenna,
212 sc->malo_hwspecs.fw_releasenum, sc->malo_hwspecs.wcbbase0,
213 sc->malo_hwspecs.rxdesc_read, sc->malo_hwspecs.rxdesc_write,
214 sc->malo_hwspecs.ul_fw_awakecookie,
215 sc->malo_hwspecs.wcbbase[0], sc->malo_hwspecs.wcbbase[1],
216 sc->malo_hwspecs.wcbbase[2], sc->malo_hwspecs.wcbbase[3]);
217
218 /* NB: firmware looks that it does not export regdomain info API. */
219 memset(bands, 0, sizeof(bands));
220 setbit(bands, IEEE80211_MODE_11B);
221 setbit(bands, IEEE80211_MODE_11G);
222 ieee80211_init_channels(ic, NULL, bands);
223
224 sc->malo_txantenna = 0x2; /* h/w default */
225 sc->malo_rxantenna = 0xffff; /* h/w default */
226
227 /*
228 * Allocate tx + rx descriptors and populate the lists.
229 * We immediately push the information to the firmware
230 * as otherwise it gets upset.
231 */
232 error = malo_dma_setup(sc);
233 if (error != 0) {
234 device_printf(sc->malo_dev,
235 "failed to setup descriptors: %d\n", error);
236 goto bad1;
237 }
238 error = malo_setup_hwdma(sc); /* push to firmware */
239 if (error != 0) /* NB: malo_setupdma prints msg */
240 goto bad2;
241
242 sc->malo_tq = taskqueue_create_fast("malo_taskq", M_NOWAIT,
243 taskqueue_thread_enqueue, &sc->malo_tq);
244 taskqueue_start_threads(&sc->malo_tq, 1, PI_NET,
245 "%s taskq", device_get_nameunit(sc->malo_dev));
246
247 NET_TASK_INIT(&sc->malo_rxtask, 0, malo_rx_proc, sc);
248 TASK_INIT(&sc->malo_txtask, 0, malo_tx_proc, sc);
249
250 ic->ic_softc = sc;
251 ic->ic_name = device_get_nameunit(sc->malo_dev);
252 /* XXX not right but it's not used anywhere important */
253 ic->ic_phytype = IEEE80211_T_OFDM;
254 ic->ic_opmode = IEEE80211_M_STA;
255 ic->ic_caps =
256 IEEE80211_C_STA /* station mode supported */
257 | IEEE80211_C_BGSCAN /* capable of bg scanning */
258 | IEEE80211_C_MONITOR /* monitor mode */
259 | IEEE80211_C_SHPREAMBLE /* short preamble supported */
260 | IEEE80211_C_SHSLOT /* short slot time supported */
261 | IEEE80211_C_TXPMGT /* capable of txpow mgt */
262 | IEEE80211_C_WPA /* capable of WPA1+WPA2 */
263 ;
264 IEEE80211_ADDR_COPY(ic->ic_macaddr, sc->malo_hwspecs.macaddr);
265
266 ic->ic_flags_ext |= IEEE80211_FEXT_SEQNO_OFFLOAD;
267
268 /*
269 * Transmit requires space in the packet for a special format transmit
270 * record and optional padding between this record and the payload.
271 * Ask the net80211 layer to arrange this when encapsulating
272 * packets so we can add it efficiently.
273 */
274 ic->ic_headroom = sizeof(struct malo_txrec) -
275 sizeof(struct ieee80211_frame);
276
277 /* call MI attach routine. */
278 ieee80211_ifattach(ic);
279 /* override default methods */
280 ic->ic_vap_create = malo_vap_create;
281 ic->ic_vap_delete = malo_vap_delete;
282 ic->ic_raw_xmit = malo_raw_xmit;
283 ic->ic_updateslot = malo_updateslot;
284 ic->ic_scan_start = malo_scan_start;
285 ic->ic_scan_end = malo_scan_end;
286 ic->ic_set_channel = malo_set_channel;
287 ic->ic_parent = malo_parent;
288 ic->ic_transmit = malo_transmit;
289
290 sc->malo_invalid = 0; /* ready to go, enable int handling */
291
292 ieee80211_radiotap_attach(ic,
293 &sc->malo_tx_th.wt_ihdr, sizeof(sc->malo_tx_th),
294 MALO_TX_RADIOTAP_PRESENT,
295 &sc->malo_rx_th.wr_ihdr, sizeof(sc->malo_rx_th),
296 MALO_RX_RADIOTAP_PRESENT);
297
298 /*
299 * Setup dynamic sysctl's.
300 */
301 malo_sysctlattach(sc);
302
303 if (bootverbose)
304 ieee80211_announce(ic);
305 malo_announce(sc);
306
307 return 0;
308 bad2:
309 malo_dma_cleanup(sc);
310 bad1:
311 malo_hal_detach(mh);
312 bad:
313 sc->malo_invalid = 1;
314
315 return error;
316 }
317
318 static struct ieee80211vap *
malo_vap_create(struct ieee80211com * ic,const char name[IFNAMSIZ],int unit,enum ieee80211_opmode opmode,int flags,const uint8_t bssid[IEEE80211_ADDR_LEN],const uint8_t mac[IEEE80211_ADDR_LEN])319 malo_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
320 enum ieee80211_opmode opmode, int flags,
321 const uint8_t bssid[IEEE80211_ADDR_LEN],
322 const uint8_t mac[IEEE80211_ADDR_LEN])
323 {
324 struct malo_softc *sc = ic->ic_softc;
325 struct malo_vap *mvp;
326 struct ieee80211vap *vap;
327
328 if (!TAILQ_EMPTY(&ic->ic_vaps)) {
329 device_printf(sc->malo_dev, "multiple vaps not supported\n");
330 return NULL;
331 }
332 switch (opmode) {
333 case IEEE80211_M_STA:
334 if (opmode == IEEE80211_M_STA)
335 flags |= IEEE80211_CLONE_NOBEACONS;
336 /* fall thru... */
337 case IEEE80211_M_MONITOR:
338 break;
339 default:
340 device_printf(sc->malo_dev, "%s mode not supported\n",
341 ieee80211_opmode_name[opmode]);
342 return NULL; /* unsupported */
343 }
344 mvp = malloc(sizeof(struct malo_vap), M_80211_VAP, M_WAITOK | M_ZERO);
345 vap = &mvp->malo_vap;
346 ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
347
348 /* override state transition machine */
349 mvp->malo_newstate = vap->iv_newstate;
350 vap->iv_newstate = malo_newstate;
351
352 /* complete setup */
353 ieee80211_vap_attach(vap,
354 ieee80211_media_change, ieee80211_media_status, mac);
355 ic->ic_opmode = opmode;
356 return vap;
357 }
358
359 static void
malo_vap_delete(struct ieee80211vap * vap)360 malo_vap_delete(struct ieee80211vap *vap)
361 {
362 struct malo_vap *mvp = MALO_VAP(vap);
363
364 ieee80211_vap_detach(vap);
365 free(mvp, M_80211_VAP);
366 }
367
368 int
malo_intr(void * arg)369 malo_intr(void *arg)
370 {
371 struct malo_softc *sc = arg;
372 struct malo_hal *mh = sc->malo_mh;
373 uint32_t status;
374
375 if (sc->malo_invalid) {
376 /*
377 * The hardware is not ready/present, don't touch anything.
378 * Note this can happen early on if the IRQ is shared.
379 */
380 DPRINTF(sc, MALO_DEBUG_ANY, "%s: invalid; ignored\n", __func__);
381 return (FILTER_STRAY);
382 }
383
384 /*
385 * Figure out the reason(s) for the interrupt.
386 */
387 malo_hal_getisr(mh, &status); /* NB: clears ISR too */
388 if (status == 0) /* must be a shared irq */
389 return (FILTER_STRAY);
390
391 DPRINTF(sc, MALO_DEBUG_INTR, "%s: status 0x%x imask 0x%x\n",
392 __func__, status, sc->malo_imask);
393
394 if (status & MALO_A2HRIC_BIT_RX_RDY)
395 taskqueue_enqueue(sc->malo_tq, &sc->malo_rxtask);
396 if (status & MALO_A2HRIC_BIT_TX_DONE)
397 taskqueue_enqueue(sc->malo_tq, &sc->malo_txtask);
398 if (status & MALO_A2HRIC_BIT_OPC_DONE)
399 malo_hal_cmddone(mh);
400 if (status & MALO_A2HRIC_BIT_MAC_EVENT)
401 ;
402 if (status & MALO_A2HRIC_BIT_RX_PROBLEM)
403 ;
404 if (status & MALO_A2HRIC_BIT_ICV_ERROR) {
405 /* TKIP ICV error */
406 sc->malo_stats.mst_rx_badtkipicv++;
407 }
408 #ifdef MALO_DEBUG
409 if (((status | sc->malo_imask) ^ sc->malo_imask) != 0)
410 DPRINTF(sc, MALO_DEBUG_INTR,
411 "%s: can't handle interrupt status 0x%x\n",
412 __func__, status);
413 #endif
414 return (FILTER_HANDLED);
415 }
416
417 static void
malo_load_cb(void * arg,bus_dma_segment_t * segs,int nsegs,int error)418 malo_load_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
419 {
420 bus_addr_t *paddr = (bus_addr_t*) arg;
421
422 KASSERT(error == 0, ("error %u on bus_dma callback", error));
423
424 *paddr = segs->ds_addr;
425 }
426
427 static int
malo_desc_setup(struct malo_softc * sc,const char * name,struct malo_descdma * dd,int nbuf,size_t bufsize,int ndesc,size_t descsize)428 malo_desc_setup(struct malo_softc *sc, const char *name,
429 struct malo_descdma *dd,
430 int nbuf, size_t bufsize, int ndesc, size_t descsize)
431 {
432 int error;
433 uint8_t *ds;
434
435 DPRINTF(sc, MALO_DEBUG_RESET,
436 "%s: %s DMA: %u bufs (%ju) %u desc/buf (%ju)\n",
437 __func__, name, nbuf, (uintmax_t) bufsize,
438 ndesc, (uintmax_t) descsize);
439
440 dd->dd_name = name;
441 dd->dd_desc_len = nbuf * ndesc * descsize;
442
443 /*
444 * Setup DMA descriptor area.
445 */
446 error = bus_dma_tag_create(bus_get_dma_tag(sc->malo_dev),/* parent */
447 PAGE_SIZE, 0, /* alignment, bounds */
448 BUS_SPACE_MAXADDR_32BIT, /* lowaddr */
449 BUS_SPACE_MAXADDR, /* highaddr */
450 NULL, NULL, /* filter, filterarg */
451 dd->dd_desc_len, /* maxsize */
452 1, /* nsegments */
453 dd->dd_desc_len, /* maxsegsize */
454 BUS_DMA_ALLOCNOW, /* flags */
455 NULL, /* lockfunc */
456 NULL, /* lockarg */
457 &dd->dd_dmat);
458 if (error != 0) {
459 device_printf(sc->malo_dev, "cannot allocate %s DMA tag\n",
460 dd->dd_name);
461 return error;
462 }
463
464 /* allocate descriptors */
465 error = bus_dmamem_alloc(dd->dd_dmat, (void**) &dd->dd_desc,
466 BUS_DMA_NOWAIT | BUS_DMA_COHERENT, &dd->dd_dmamap);
467 if (error != 0) {
468 device_printf(sc->malo_dev,
469 "unable to alloc memory for %u %s descriptors, "
470 "error %u\n", nbuf * ndesc, dd->dd_name, error);
471 goto fail1;
472 }
473
474 error = bus_dmamap_load(dd->dd_dmat, dd->dd_dmamap,
475 dd->dd_desc, dd->dd_desc_len,
476 malo_load_cb, &dd->dd_desc_paddr, BUS_DMA_NOWAIT);
477 if (error != 0) {
478 device_printf(sc->malo_dev,
479 "unable to map %s descriptors, error %u\n",
480 dd->dd_name, error);
481 goto fail2;
482 }
483
484 ds = dd->dd_desc;
485 memset(ds, 0, dd->dd_desc_len);
486 DPRINTF(sc, MALO_DEBUG_RESET,
487 "%s: %s DMA map: %p (%lu) -> 0x%jx (%lu)\n",
488 __func__, dd->dd_name, ds, (u_long) dd->dd_desc_len,
489 (uintmax_t) dd->dd_desc_paddr, /*XXX*/ (u_long) dd->dd_desc_len);
490
491 return 0;
492 fail2:
493 bus_dmamem_free(dd->dd_dmat, dd->dd_desc, dd->dd_dmamap);
494 fail1:
495 bus_dma_tag_destroy(dd->dd_dmat);
496 memset(dd, 0, sizeof(*dd));
497 return error;
498 }
499
500 #define DS2PHYS(_dd, _ds) \
501 ((_dd)->dd_desc_paddr + ((caddr_t)(_ds) - (caddr_t)(_dd)->dd_desc))
502
503 static int
malo_rxdma_setup(struct malo_softc * sc)504 malo_rxdma_setup(struct malo_softc *sc)
505 {
506 int error, bsize, i;
507 struct malo_rxbuf *bf;
508 struct malo_rxdesc *ds;
509
510 error = malo_desc_setup(sc, "rx", &sc->malo_rxdma,
511 malo_rxbuf, sizeof(struct malo_rxbuf),
512 1, sizeof(struct malo_rxdesc));
513 if (error != 0)
514 return error;
515
516 /*
517 * Allocate rx buffers and set them up.
518 */
519 bsize = malo_rxbuf * sizeof(struct malo_rxbuf);
520 bf = malloc(bsize, M_MALODEV, M_NOWAIT | M_ZERO);
521 if (bf == NULL) {
522 device_printf(sc->malo_dev,
523 "malloc of %u rx buffers failed\n", bsize);
524 return error;
525 }
526 sc->malo_rxdma.dd_bufptr = bf;
527
528 STAILQ_INIT(&sc->malo_rxbuf);
529 ds = sc->malo_rxdma.dd_desc;
530 for (i = 0; i < malo_rxbuf; i++, bf++, ds++) {
531 bf->bf_desc = ds;
532 bf->bf_daddr = DS2PHYS(&sc->malo_rxdma, ds);
533 error = bus_dmamap_create(sc->malo_dmat, BUS_DMA_NOWAIT,
534 &bf->bf_dmamap);
535 if (error != 0) {
536 device_printf(sc->malo_dev,
537 "%s: unable to dmamap for rx buffer, error %d\n",
538 __func__, error);
539 return error;
540 }
541 /* NB: tail is intentional to preserve descriptor order */
542 STAILQ_INSERT_TAIL(&sc->malo_rxbuf, bf, bf_list);
543 }
544 return 0;
545 }
546
547 static int
malo_txdma_setup(struct malo_softc * sc,struct malo_txq * txq)548 malo_txdma_setup(struct malo_softc *sc, struct malo_txq *txq)
549 {
550 int error, bsize, i;
551 struct malo_txbuf *bf;
552 struct malo_txdesc *ds;
553
554 error = malo_desc_setup(sc, "tx", &txq->dma,
555 malo_txbuf, sizeof(struct malo_txbuf),
556 MALO_TXDESC, sizeof(struct malo_txdesc));
557 if (error != 0)
558 return error;
559
560 /* allocate and setup tx buffers */
561 bsize = malo_txbuf * sizeof(struct malo_txbuf);
562 bf = malloc(bsize, M_MALODEV, M_NOWAIT | M_ZERO);
563 if (bf == NULL) {
564 device_printf(sc->malo_dev, "malloc of %u tx buffers failed\n",
565 malo_txbuf);
566 return ENOMEM;
567 }
568 txq->dma.dd_bufptr = bf;
569
570 STAILQ_INIT(&txq->free);
571 txq->nfree = 0;
572 ds = txq->dma.dd_desc;
573 for (i = 0; i < malo_txbuf; i++, bf++, ds += MALO_TXDESC) {
574 bf->bf_desc = ds;
575 bf->bf_daddr = DS2PHYS(&txq->dma, ds);
576 error = bus_dmamap_create(sc->malo_dmat, BUS_DMA_NOWAIT,
577 &bf->bf_dmamap);
578 if (error != 0) {
579 device_printf(sc->malo_dev,
580 "unable to create dmamap for tx "
581 "buffer %u, error %u\n", i, error);
582 return error;
583 }
584 STAILQ_INSERT_TAIL(&txq->free, bf, bf_list);
585 txq->nfree++;
586 }
587
588 return 0;
589 }
590
591 static void
malo_desc_cleanup(struct malo_softc * sc,struct malo_descdma * dd)592 malo_desc_cleanup(struct malo_softc *sc, struct malo_descdma *dd)
593 {
594 bus_dmamap_unload(dd->dd_dmat, dd->dd_dmamap);
595 bus_dmamem_free(dd->dd_dmat, dd->dd_desc, dd->dd_dmamap);
596 bus_dma_tag_destroy(dd->dd_dmat);
597
598 memset(dd, 0, sizeof(*dd));
599 }
600
601 static void
malo_rxdma_cleanup(struct malo_softc * sc)602 malo_rxdma_cleanup(struct malo_softc *sc)
603 {
604 struct malo_rxbuf *bf;
605
606 STAILQ_FOREACH(bf, &sc->malo_rxbuf, bf_list) {
607 if (bf->bf_m != NULL) {
608 m_freem(bf->bf_m);
609 bf->bf_m = NULL;
610 }
611 if (bf->bf_dmamap != NULL) {
612 bus_dmamap_destroy(sc->malo_dmat, bf->bf_dmamap);
613 bf->bf_dmamap = NULL;
614 }
615 }
616 STAILQ_INIT(&sc->malo_rxbuf);
617 if (sc->malo_rxdma.dd_bufptr != NULL) {
618 free(sc->malo_rxdma.dd_bufptr, M_MALODEV);
619 sc->malo_rxdma.dd_bufptr = NULL;
620 }
621 if (sc->malo_rxdma.dd_desc_len != 0)
622 malo_desc_cleanup(sc, &sc->malo_rxdma);
623 }
624
625 static void
malo_txdma_cleanup(struct malo_softc * sc,struct malo_txq * txq)626 malo_txdma_cleanup(struct malo_softc *sc, struct malo_txq *txq)
627 {
628 struct malo_txbuf *bf;
629 struct ieee80211_node *ni;
630
631 STAILQ_FOREACH(bf, &txq->free, bf_list) {
632 if (bf->bf_m != NULL) {
633 m_freem(bf->bf_m);
634 bf->bf_m = NULL;
635 }
636 ni = bf->bf_node;
637 bf->bf_node = NULL;
638 if (ni != NULL) {
639 /*
640 * Reclaim node reference.
641 */
642 ieee80211_free_node(ni);
643 }
644 if (bf->bf_dmamap != NULL) {
645 bus_dmamap_destroy(sc->malo_dmat, bf->bf_dmamap);
646 bf->bf_dmamap = NULL;
647 }
648 }
649 STAILQ_INIT(&txq->free);
650 txq->nfree = 0;
651 if (txq->dma.dd_bufptr != NULL) {
652 free(txq->dma.dd_bufptr, M_MALODEV);
653 txq->dma.dd_bufptr = NULL;
654 }
655 if (txq->dma.dd_desc_len != 0)
656 malo_desc_cleanup(sc, &txq->dma);
657 }
658
659 static void
malo_dma_cleanup(struct malo_softc * sc)660 malo_dma_cleanup(struct malo_softc *sc)
661 {
662 int i;
663
664 for (i = 0; i < MALO_NUM_TX_QUEUES; i++)
665 malo_txdma_cleanup(sc, &sc->malo_txq[i]);
666
667 malo_rxdma_cleanup(sc);
668 }
669
670 static int
malo_dma_setup(struct malo_softc * sc)671 malo_dma_setup(struct malo_softc *sc)
672 {
673 int error, i;
674
675 /* rxdma initializing. */
676 error = malo_rxdma_setup(sc);
677 if (error != 0)
678 return error;
679
680 /* NB: we just have 1 tx queue now. */
681 for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
682 error = malo_txdma_setup(sc, &sc->malo_txq[i]);
683 if (error != 0) {
684 malo_dma_cleanup(sc);
685
686 return error;
687 }
688
689 malo_txq_init(sc, &sc->malo_txq[i], i);
690 }
691
692 return 0;
693 }
694
695 static void
malo_hal_set_rxtxdma(struct malo_softc * sc)696 malo_hal_set_rxtxdma(struct malo_softc *sc)
697 {
698 int i;
699
700 malo_bar0_write4(sc, sc->malo_hwspecs.rxdesc_read,
701 sc->malo_hwdma.rxdesc_read);
702 malo_bar0_write4(sc, sc->malo_hwspecs.rxdesc_write,
703 sc->malo_hwdma.rxdesc_read);
704
705 for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
706 malo_bar0_write4(sc,
707 sc->malo_hwspecs.wcbbase[i], sc->malo_hwdma.wcbbase[i]);
708 }
709 }
710
711 /*
712 * Inform firmware of our tx/rx dma setup. The BAR 0 writes below are
713 * for compatibility with older firmware. For current firmware we send
714 * this information with a cmd block via malo_hal_sethwdma.
715 */
716 static int
malo_setup_hwdma(struct malo_softc * sc)717 malo_setup_hwdma(struct malo_softc *sc)
718 {
719 int i;
720 struct malo_txq *txq;
721
722 sc->malo_hwdma.rxdesc_read = sc->malo_rxdma.dd_desc_paddr;
723
724 for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
725 txq = &sc->malo_txq[i];
726 sc->malo_hwdma.wcbbase[i] = txq->dma.dd_desc_paddr;
727 }
728 sc->malo_hwdma.maxnum_txwcb = malo_txbuf;
729 sc->malo_hwdma.maxnum_wcb = MALO_NUM_TX_QUEUES;
730
731 malo_hal_set_rxtxdma(sc);
732
733 return 0;
734 }
735
736 static void
malo_txq_init(struct malo_softc * sc,struct malo_txq * txq,int qnum)737 malo_txq_init(struct malo_softc *sc, struct malo_txq *txq, int qnum)
738 {
739 struct malo_txbuf *bf, *bn;
740 struct malo_txdesc *ds;
741
742 MALO_TXQ_LOCK_INIT(sc, txq);
743 txq->qnum = qnum;
744 txq->txpri = 0; /* XXX */
745
746 STAILQ_FOREACH(bf, &txq->free, bf_list) {
747 bf->bf_txq = txq;
748
749 ds = bf->bf_desc;
750 bn = STAILQ_NEXT(bf, bf_list);
751 if (bn == NULL)
752 bn = STAILQ_FIRST(&txq->free);
753 ds->physnext = htole32(bn->bf_daddr);
754 }
755 STAILQ_INIT(&txq->active);
756 }
757
758 /*
759 * Reclaim resources for a setup queue.
760 */
761 static void
malo_tx_cleanupq(struct malo_softc * sc,struct malo_txq * txq)762 malo_tx_cleanupq(struct malo_softc *sc, struct malo_txq *txq)
763 {
764 /* XXX hal work? */
765 MALO_TXQ_LOCK_DESTROY(txq);
766 }
767
768 /*
769 * Allocate a tx buffer for sending a frame.
770 */
771 static struct malo_txbuf *
malo_getbuf(struct malo_softc * sc,struct malo_txq * txq)772 malo_getbuf(struct malo_softc *sc, struct malo_txq *txq)
773 {
774 struct malo_txbuf *bf;
775
776 MALO_TXQ_LOCK(txq);
777 bf = STAILQ_FIRST(&txq->free);
778 if (bf != NULL) {
779 STAILQ_REMOVE_HEAD(&txq->free, bf_list);
780 txq->nfree--;
781 }
782 MALO_TXQ_UNLOCK(txq);
783 if (bf == NULL) {
784 DPRINTF(sc, MALO_DEBUG_XMIT,
785 "%s: out of xmit buffers on q %d\n", __func__, txq->qnum);
786 sc->malo_stats.mst_tx_qstop++;
787 }
788 return bf;
789 }
790
791 static int
malo_tx_dmasetup(struct malo_softc * sc,struct malo_txbuf * bf,struct mbuf * m0)792 malo_tx_dmasetup(struct malo_softc *sc, struct malo_txbuf *bf, struct mbuf *m0)
793 {
794 struct mbuf *m;
795 int error;
796
797 /*
798 * Load the DMA map so any coalescing is done. This also calculates
799 * the number of descriptors we need.
800 */
801 error = bus_dmamap_load_mbuf_sg(sc->malo_dmat, bf->bf_dmamap, m0,
802 bf->bf_segs, &bf->bf_nseg,
803 BUS_DMA_NOWAIT);
804 if (error == EFBIG) {
805 /* XXX packet requires too many descriptors */
806 bf->bf_nseg = MALO_TXDESC + 1;
807 } else if (error != 0) {
808 sc->malo_stats.mst_tx_busdma++;
809 m_freem(m0);
810 return error;
811 }
812 /*
813 * Discard null packets and check for packets that require too many
814 * TX descriptors. We try to convert the latter to a cluster.
815 */
816 if (error == EFBIG) { /* too many desc's, linearize */
817 sc->malo_stats.mst_tx_linear++;
818 m = m_defrag(m0, M_NOWAIT);
819 if (m == NULL) {
820 m_freem(m0);
821 sc->malo_stats.mst_tx_nombuf++;
822 return ENOMEM;
823 }
824 m0 = m;
825 error = bus_dmamap_load_mbuf_sg(sc->malo_dmat, bf->bf_dmamap, m0,
826 bf->bf_segs, &bf->bf_nseg,
827 BUS_DMA_NOWAIT);
828 if (error != 0) {
829 sc->malo_stats.mst_tx_busdma++;
830 m_freem(m0);
831 return error;
832 }
833 KASSERT(bf->bf_nseg <= MALO_TXDESC,
834 ("too many segments after defrag; nseg %u", bf->bf_nseg));
835 } else if (bf->bf_nseg == 0) { /* null packet, discard */
836 sc->malo_stats.mst_tx_nodata++;
837 m_freem(m0);
838 return EIO;
839 }
840 DPRINTF(sc, MALO_DEBUG_XMIT, "%s: m %p len %u\n",
841 __func__, m0, m0->m_pkthdr.len);
842 bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
843 bf->bf_m = m0;
844
845 return 0;
846 }
847
848 #ifdef MALO_DEBUG
849 static void
malo_printrxbuf(const struct malo_rxbuf * bf,u_int ix)850 malo_printrxbuf(const struct malo_rxbuf *bf, u_int ix)
851 {
852 const struct malo_rxdesc *ds = bf->bf_desc;
853 uint32_t status = le32toh(ds->status);
854
855 printf("R[%2u] (DS.V:%p DS.P:0x%jx) NEXT:%08x DATA:%08x RC:%02x%s\n"
856 " STAT:%02x LEN:%04x SNR:%02x NF:%02x CHAN:%02x"
857 " RATE:%02x QOS:%04x\n", ix, ds, (uintmax_t)bf->bf_daddr,
858 le32toh(ds->physnext), le32toh(ds->physbuffdata),
859 ds->rxcontrol,
860 ds->rxcontrol != MALO_RXD_CTRL_DRIVER_OWN ?
861 "" : (status & MALO_RXD_STATUS_OK) ? " *" : " !",
862 ds->status, le16toh(ds->pktlen), ds->snr, ds->nf, ds->channel,
863 ds->rate, le16toh(ds->qosctrl));
864 }
865
866 static void
malo_printtxbuf(const struct malo_txbuf * bf,u_int qnum,u_int ix)867 malo_printtxbuf(const struct malo_txbuf *bf, u_int qnum, u_int ix)
868 {
869 const struct malo_txdesc *ds = bf->bf_desc;
870 uint32_t status = le32toh(ds->status);
871
872 printf("Q%u[%3u]", qnum, ix);
873 printf(" (DS.V:%p DS.P:0x%jx)\n", ds, (uintmax_t)bf->bf_daddr);
874 printf(" NEXT:%08x DATA:%08x LEN:%04x STAT:%08x%s\n",
875 le32toh(ds->physnext),
876 le32toh(ds->pktptr), le16toh(ds->pktlen), status,
877 status & MALO_TXD_STATUS_USED ?
878 "" : (status & 3) != 0 ? " *" : " !");
879 printf(" RATE:%02x PRI:%x QOS:%04x SAP:%08x FORMAT:%04x\n",
880 ds->datarate, ds->txpriority, le16toh(ds->qosctrl),
881 le32toh(ds->sap_pktinfo), le16toh(ds->format));
882 #if 0
883 {
884 const uint8_t *cp = (const uint8_t *) ds;
885 int i;
886 for (i = 0; i < sizeof(struct malo_txdesc); i++) {
887 printf("%02x ", cp[i]);
888 if (((i+1) % 16) == 0)
889 printf("\n");
890 }
891 printf("\n");
892 }
893 #endif
894 }
895 #endif /* MALO_DEBUG */
896
897 static __inline void
malo_updatetxrate(struct ieee80211_node * ni,int rix)898 malo_updatetxrate(struct ieee80211_node *ni, int rix)
899 {
900 static const int ieeerates[] =
901 { 2, 4, 11, 22, 44, 12, 18, 24, 36, 48, 96, 108 };
902 if (rix < nitems(ieeerates))
903 ieee80211_node_set_txrate_dot11rate(ni, ieeerates[rix]);
904 }
905
906 static int
malo_fix2rate(int fix_rate)907 malo_fix2rate(int fix_rate)
908 {
909 static const int rates[] =
910 { 2, 4, 11, 22, 12, 18, 24, 36, 48, 96, 108 };
911 return (fix_rate < nitems(rates) ? rates[fix_rate] : 0);
912 }
913
914 /*
915 * Process completed xmit descriptors from the specified queue.
916 */
917 static int
malo_tx_processq(struct malo_softc * sc,struct malo_txq * txq)918 malo_tx_processq(struct malo_softc *sc, struct malo_txq *txq)
919 {
920 struct malo_txbuf *bf;
921 struct malo_txdesc *ds;
922 struct ieee80211_node *ni;
923 int nreaped;
924 uint32_t status;
925
926 DPRINTF(sc, MALO_DEBUG_TX_PROC, "%s: tx queue %u\n",
927 __func__, txq->qnum);
928 for (nreaped = 0;; nreaped++) {
929 MALO_TXQ_LOCK(txq);
930 bf = STAILQ_FIRST(&txq->active);
931 if (bf == NULL) {
932 MALO_TXQ_UNLOCK(txq);
933 break;
934 }
935 ds = bf->bf_desc;
936 MALO_TXDESC_SYNC(txq, ds,
937 BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
938 if (ds->status & htole32(MALO_TXD_STATUS_FW_OWNED)) {
939 MALO_TXQ_UNLOCK(txq);
940 break;
941 }
942 STAILQ_REMOVE_HEAD(&txq->active, bf_list);
943 MALO_TXQ_UNLOCK(txq);
944
945 #ifdef MALO_DEBUG
946 if (sc->malo_debug & MALO_DEBUG_XMIT_DESC)
947 malo_printtxbuf(bf, txq->qnum, nreaped);
948 #endif
949 ni = bf->bf_node;
950 if (ni != NULL) {
951 status = le32toh(ds->status);
952 if (status & MALO_TXD_STATUS_OK) {
953 uint16_t format = le16toh(ds->format);
954 uint8_t txant =_IEEE80211_MASKSHIFT(
955 format, MALO_TXD_ANTENNA);
956
957 sc->malo_stats.mst_ant_tx[txant]++;
958 if (status & MALO_TXD_STATUS_OK_RETRY)
959 sc->malo_stats.mst_tx_retries++;
960 if (status & MALO_TXD_STATUS_OK_MORE_RETRY)
961 sc->malo_stats.mst_tx_mretries++;
962 malo_updatetxrate(ni, ds->datarate);
963 sc->malo_stats.mst_tx_rate = ds->datarate;
964 } else {
965 if (status & MALO_TXD_STATUS_FAILED_LINK_ERROR)
966 sc->malo_stats.mst_tx_linkerror++;
967 if (status & MALO_TXD_STATUS_FAILED_XRETRY)
968 sc->malo_stats.mst_tx_xretries++;
969 if (status & MALO_TXD_STATUS_FAILED_AGING)
970 sc->malo_stats.mst_tx_aging++;
971 }
972 /* XXX strip fw len in case header inspected */
973 m_adj(bf->bf_m, sizeof(uint16_t));
974 ieee80211_tx_complete(ni, bf->bf_m,
975 (status & MALO_TXD_STATUS_OK) == 0);
976 } else
977 m_freem(bf->bf_m);
978
979 ds->status = htole32(MALO_TXD_STATUS_IDLE);
980 ds->pktlen = htole32(0);
981
982 bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap,
983 BUS_DMASYNC_POSTWRITE);
984 bus_dmamap_unload(sc->malo_dmat, bf->bf_dmamap);
985 bf->bf_m = NULL;
986 bf->bf_node = NULL;
987
988 MALO_TXQ_LOCK(txq);
989 STAILQ_INSERT_TAIL(&txq->free, bf, bf_list);
990 txq->nfree++;
991 MALO_TXQ_UNLOCK(txq);
992 }
993 return nreaped;
994 }
995
996 /*
997 * Deferred processing of transmit interrupt.
998 */
999 static void
malo_tx_proc(void * arg,int npending)1000 malo_tx_proc(void *arg, int npending)
1001 {
1002 struct malo_softc *sc = arg;
1003 int i, nreaped;
1004
1005 /*
1006 * Process each active queue.
1007 */
1008 nreaped = 0;
1009 MALO_LOCK(sc);
1010 for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
1011 if (!STAILQ_EMPTY(&sc->malo_txq[i].active))
1012 nreaped += malo_tx_processq(sc, &sc->malo_txq[i]);
1013 }
1014
1015 if (nreaped != 0) {
1016 sc->malo_timer = 0;
1017 malo_start(sc);
1018 }
1019 MALO_UNLOCK(sc);
1020 }
1021
1022 static int
malo_tx_start(struct malo_softc * sc,struct ieee80211_node * ni,struct malo_txbuf * bf,struct mbuf * m0)1023 malo_tx_start(struct malo_softc *sc, struct ieee80211_node *ni,
1024 struct malo_txbuf *bf, struct mbuf *m0)
1025 {
1026 int error, iswep;
1027 int hdrlen, pktlen;
1028 struct ieee80211_frame *wh;
1029 struct ieee80211com *ic = &sc->malo_ic;
1030 struct ieee80211vap *vap = ni->ni_vap;
1031 struct malo_txdesc *ds;
1032 struct malo_txrec *tr;
1033 struct malo_txq *txq;
1034 uint16_t qos;
1035
1036 wh = mtod(m0, struct ieee80211_frame *);
1037 iswep = wh->i_fc[1] & IEEE80211_FC1_PROTECTED;
1038 hdrlen = ieee80211_anyhdrsize(wh);
1039 pktlen = m0->m_pkthdr.len;
1040 if (IEEE80211_QOS_HAS_SEQ(wh)) {
1041 qos = *(uint16_t *)ieee80211_getqos(wh);
1042 } else
1043 qos = 0;
1044
1045 ieee80211_output_seqno_assign(ni, -1, m0);
1046
1047 if (iswep) {
1048 struct ieee80211_key *k;
1049
1050 /*
1051 * Construct the 802.11 header+trailer for an encrypted
1052 * frame. The only reason this can fail is because of an
1053 * unknown or unsupported cipher/key type.
1054 *
1055 * NB: we do this even though the firmware will ignore
1056 * what we've done for WEP and TKIP as we need the
1057 * ExtIV filled in for CCMP and this also adjusts
1058 * the headers which simplifies our work below.
1059 */
1060 k = ieee80211_crypto_encap(ni, m0);
1061 if (k == NULL) {
1062 /*
1063 * This can happen when the key is yanked after the
1064 * frame was queued. Just discard the frame; the
1065 * 802.11 layer counts failures and provides
1066 * debugging/diagnostics.
1067 */
1068 m_freem(m0);
1069 return EIO;
1070 }
1071
1072 /*
1073 * Adjust the packet length for the crypto additions
1074 * done during encap and any other bits that the f/w
1075 * will add later on.
1076 */
1077 pktlen = m0->m_pkthdr.len;
1078
1079 /* packet header may have moved, reset our local pointer */
1080 wh = mtod(m0, struct ieee80211_frame *);
1081 }
1082
1083 if (ieee80211_radiotap_active_vap(vap)) {
1084 sc->malo_tx_th.wt_flags = 0; /* XXX */
1085 if (iswep)
1086 sc->malo_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
1087 sc->malo_tx_th.wt_txpower = ni->ni_txpower;
1088 sc->malo_tx_th.wt_antenna = sc->malo_txantenna;
1089
1090 ieee80211_radiotap_tx(vap, m0);
1091 }
1092
1093 /*
1094 * Copy up/down the 802.11 header; the firmware requires
1095 * we present a 2-byte payload length followed by a
1096 * 4-address header (w/o QoS), followed (optionally) by
1097 * any WEP/ExtIV header (but only filled in for CCMP).
1098 * We are assured the mbuf has sufficient headroom to
1099 * prepend in-place by the setup of ic_headroom in
1100 * malo_attach.
1101 */
1102 if (hdrlen < sizeof(struct malo_txrec)) {
1103 const int space = sizeof(struct malo_txrec) - hdrlen;
1104 if (M_LEADINGSPACE(m0) < space) {
1105 /* NB: should never happen */
1106 device_printf(sc->malo_dev,
1107 "not enough headroom, need %d found %zd, "
1108 "m_flags 0x%x m_len %d\n",
1109 space, M_LEADINGSPACE(m0), m0->m_flags, m0->m_len);
1110 ieee80211_dump_pkt(ic,
1111 mtod(m0, const uint8_t *), m0->m_len, 0, -1);
1112 m_freem(m0);
1113 /* XXX stat */
1114 return EIO;
1115 }
1116 M_PREPEND(m0, space, M_NOWAIT);
1117 }
1118 tr = mtod(m0, struct malo_txrec *);
1119 if (wh != (struct ieee80211_frame *) &tr->wh)
1120 ovbcopy(wh, &tr->wh, hdrlen);
1121 /*
1122 * Note: the "firmware length" is actually the length of the fully
1123 * formed "802.11 payload". That is, it's everything except for
1124 * the 802.11 header. In particular this includes all crypto
1125 * material including the MIC!
1126 */
1127 tr->fwlen = htole16(pktlen - hdrlen);
1128
1129 /*
1130 * Load the DMA map so any coalescing is done. This
1131 * also calculates the number of descriptors we need.
1132 */
1133 error = malo_tx_dmasetup(sc, bf, m0);
1134 if (error != 0)
1135 return error;
1136 bf->bf_node = ni; /* NB: held reference */
1137 m0 = bf->bf_m; /* NB: may have changed */
1138 tr = mtod(m0, struct malo_txrec *);
1139 wh = (struct ieee80211_frame *)&tr->wh;
1140
1141 /*
1142 * Formulate tx descriptor.
1143 */
1144 ds = bf->bf_desc;
1145 txq = bf->bf_txq;
1146
1147 ds->qosctrl = qos; /* NB: already little-endian */
1148 ds->pktptr = htole32(bf->bf_segs[0].ds_addr);
1149 ds->pktlen = htole16(bf->bf_segs[0].ds_len);
1150 /* NB: pPhysNext setup once, don't touch */
1151 ds->datarate = IEEE80211_IS_DATA(wh) ? 1 : 0;
1152 ds->sap_pktinfo = 0;
1153 ds->format = 0;
1154
1155 /*
1156 * Select transmit rate.
1157 */
1158 switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
1159 case IEEE80211_FC0_TYPE_MGT:
1160 sc->malo_stats.mst_tx_mgmt++;
1161 /* fall thru... */
1162 case IEEE80211_FC0_TYPE_CTL:
1163 ds->txpriority = 1;
1164 break;
1165 case IEEE80211_FC0_TYPE_DATA:
1166 ds->txpriority = txq->qnum;
1167 break;
1168 default:
1169 device_printf(sc->malo_dev, "bogus frame type 0x%x (%s)\n",
1170 wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK, __func__);
1171 /* XXX statistic */
1172 m_freem(m0);
1173 return EIO;
1174 }
1175
1176 #ifdef MALO_DEBUG
1177 if (IFF_DUMPPKTS_XMIT(sc))
1178 ieee80211_dump_pkt(ic,
1179 mtod(m0, const uint8_t *)+sizeof(uint16_t),
1180 m0->m_len - sizeof(uint16_t), ds->datarate, -1);
1181 #endif
1182
1183 MALO_TXQ_LOCK(txq);
1184 if (!IEEE80211_IS_DATA(wh))
1185 ds->status |= htole32(1);
1186 ds->status |= htole32(MALO_TXD_STATUS_FW_OWNED);
1187 STAILQ_INSERT_TAIL(&txq->active, bf, bf_list);
1188 MALO_TXDESC_SYNC(txq, ds, BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
1189
1190 sc->malo_timer = 5;
1191 MALO_TXQ_UNLOCK(txq);
1192 return 0;
1193 }
1194
1195 static int
malo_transmit(struct ieee80211com * ic,struct mbuf * m)1196 malo_transmit(struct ieee80211com *ic, struct mbuf *m)
1197 {
1198 struct malo_softc *sc = ic->ic_softc;
1199 int error;
1200
1201 MALO_LOCK(sc);
1202 if (!sc->malo_running) {
1203 MALO_UNLOCK(sc);
1204 return (ENXIO);
1205 }
1206 error = mbufq_enqueue(&sc->malo_snd, m);
1207 if (error) {
1208 MALO_UNLOCK(sc);
1209 return (error);
1210 }
1211 malo_start(sc);
1212 MALO_UNLOCK(sc);
1213 return (0);
1214 }
1215
1216 static void
malo_start(struct malo_softc * sc)1217 malo_start(struct malo_softc *sc)
1218 {
1219 struct ieee80211_node *ni;
1220 struct malo_txq *txq = &sc->malo_txq[0];
1221 struct malo_txbuf *bf = NULL;
1222 struct mbuf *m;
1223 int nqueued = 0;
1224
1225 MALO_LOCK_ASSERT(sc);
1226
1227 if (!sc->malo_running || sc->malo_invalid)
1228 return;
1229
1230 while ((m = mbufq_dequeue(&sc->malo_snd)) != NULL) {
1231 ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
1232 bf = malo_getbuf(sc, txq);
1233 if (bf == NULL) {
1234 mbufq_prepend(&sc->malo_snd, m);
1235 sc->malo_stats.mst_tx_qstop++;
1236 break;
1237 }
1238 /*
1239 * Pass the frame to the h/w for transmission.
1240 */
1241 if (malo_tx_start(sc, ni, bf, m)) {
1242 if_inc_counter(ni->ni_vap->iv_ifp,
1243 IFCOUNTER_OERRORS, 1);
1244 if (bf != NULL) {
1245 bf->bf_m = NULL;
1246 bf->bf_node = NULL;
1247 MALO_TXQ_LOCK(txq);
1248 STAILQ_INSERT_HEAD(&txq->free, bf, bf_list);
1249 MALO_TXQ_UNLOCK(txq);
1250 }
1251 ieee80211_free_node(ni);
1252 continue;
1253 }
1254 nqueued++;
1255
1256 if (nqueued >= malo_txcoalesce) {
1257 /*
1258 * Poke the firmware to process queued frames;
1259 * see below about (lack of) locking.
1260 */
1261 nqueued = 0;
1262 malo_hal_txstart(sc->malo_mh, 0/*XXX*/);
1263 }
1264 }
1265
1266 if (nqueued) {
1267 /*
1268 * NB: We don't need to lock against tx done because
1269 * this just prods the firmware to check the transmit
1270 * descriptors. The firmware will also start fetching
1271 * descriptors by itself if it notices new ones are
1272 * present when it goes to deliver a tx done interrupt
1273 * to the host. So if we race with tx done processing
1274 * it's ok. Delivering the kick here rather than in
1275 * malo_tx_start is an optimization to avoid poking the
1276 * firmware for each packet.
1277 *
1278 * NB: the queue id isn't used so 0 is ok.
1279 */
1280 malo_hal_txstart(sc->malo_mh, 0/*XXX*/);
1281 }
1282 }
1283
1284 static void
malo_watchdog(void * arg)1285 malo_watchdog(void *arg)
1286 {
1287 struct malo_softc *sc = arg;
1288
1289 callout_reset(&sc->malo_watchdog_timer, hz, malo_watchdog, sc);
1290 if (sc->malo_timer == 0 || --sc->malo_timer > 0)
1291 return;
1292
1293 if (sc->malo_running && !sc->malo_invalid) {
1294 device_printf(sc->malo_dev, "watchdog timeout\n");
1295
1296 /* XXX no way to reset h/w. now */
1297
1298 counter_u64_add(sc->malo_ic.ic_oerrors, 1);
1299 sc->malo_stats.mst_watchdog++;
1300 }
1301 }
1302
1303 static int
malo_hal_reset(struct malo_softc * sc)1304 malo_hal_reset(struct malo_softc *sc)
1305 {
1306 static int first = 0;
1307 struct ieee80211com *ic = &sc->malo_ic;
1308 struct malo_hal *mh = sc->malo_mh;
1309
1310 if (first == 0) {
1311 /*
1312 * NB: when the device firstly is initialized, sometimes
1313 * firmware could override rx/tx dma registers so we re-set
1314 * these values once.
1315 */
1316 malo_hal_set_rxtxdma(sc);
1317 first = 1;
1318 }
1319
1320 malo_hal_setantenna(mh, MHA_ANTENNATYPE_RX, sc->malo_rxantenna);
1321 malo_hal_setantenna(mh, MHA_ANTENNATYPE_TX, sc->malo_txantenna);
1322 malo_hal_setradio(mh, 1, MHP_AUTO_PREAMBLE);
1323 malo_chan_set(sc, ic->ic_curchan);
1324
1325 /* XXX needs other stuffs? */
1326
1327 return 1;
1328 }
1329
1330 static __inline struct mbuf *
malo_getrxmbuf(struct malo_softc * sc,struct malo_rxbuf * bf)1331 malo_getrxmbuf(struct malo_softc *sc, struct malo_rxbuf *bf)
1332 {
1333 struct mbuf *m;
1334 bus_addr_t paddr;
1335 int error;
1336
1337 /* XXX don't need mbuf, just dma buffer */
1338 m = m_getjcl(M_NOWAIT, MT_DATA, M_PKTHDR, MJUMPAGESIZE);
1339 if (m == NULL) {
1340 sc->malo_stats.mst_rx_nombuf++; /* XXX */
1341 return NULL;
1342 }
1343 error = bus_dmamap_load(sc->malo_dmat, bf->bf_dmamap,
1344 mtod(m, caddr_t), MJUMPAGESIZE,
1345 malo_load_cb, &paddr, BUS_DMA_NOWAIT);
1346 if (error != 0) {
1347 device_printf(sc->malo_dev,
1348 "%s: bus_dmamap_load failed, error %d\n", __func__, error);
1349 m_freem(m);
1350 return NULL;
1351 }
1352 bf->bf_data = paddr;
1353 bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
1354
1355 return m;
1356 }
1357
1358 static int
malo_rxbuf_init(struct malo_softc * sc,struct malo_rxbuf * bf)1359 malo_rxbuf_init(struct malo_softc *sc, struct malo_rxbuf *bf)
1360 {
1361 struct malo_rxdesc *ds;
1362
1363 ds = bf->bf_desc;
1364 if (bf->bf_m == NULL) {
1365 bf->bf_m = malo_getrxmbuf(sc, bf);
1366 if (bf->bf_m == NULL) {
1367 /* mark descriptor to be skipped */
1368 ds->rxcontrol = MALO_RXD_CTRL_OS_OWN;
1369 /* NB: don't need PREREAD */
1370 MALO_RXDESC_SYNC(sc, ds, BUS_DMASYNC_PREWRITE);
1371 return ENOMEM;
1372 }
1373 }
1374
1375 /*
1376 * Setup descriptor.
1377 */
1378 ds->qosctrl = 0;
1379 ds->snr = 0;
1380 ds->status = MALO_RXD_STATUS_IDLE;
1381 ds->channel = 0;
1382 ds->pktlen = htole16(MALO_RXSIZE);
1383 ds->nf = 0;
1384 ds->physbuffdata = htole32(bf->bf_data);
1385 /* NB: don't touch pPhysNext, set once */
1386 ds->rxcontrol = MALO_RXD_CTRL_DRIVER_OWN;
1387 MALO_RXDESC_SYNC(sc, ds, BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
1388
1389 return 0;
1390 }
1391
1392 /*
1393 * Setup the rx data structures. This should only be done once or we may get
1394 * out of sync with the firmware.
1395 */
1396 static int
malo_startrecv(struct malo_softc * sc)1397 malo_startrecv(struct malo_softc *sc)
1398 {
1399 struct malo_rxbuf *bf, *prev;
1400 struct malo_rxdesc *ds;
1401
1402 if (sc->malo_recvsetup == 1) {
1403 malo_mode_init(sc); /* set filters, etc. */
1404 return 0;
1405 }
1406
1407 prev = NULL;
1408 STAILQ_FOREACH(bf, &sc->malo_rxbuf, bf_list) {
1409 int error = malo_rxbuf_init(sc, bf);
1410 if (error != 0) {
1411 DPRINTF(sc, MALO_DEBUG_RECV,
1412 "%s: malo_rxbuf_init failed %d\n",
1413 __func__, error);
1414 return error;
1415 }
1416 if (prev != NULL) {
1417 ds = prev->bf_desc;
1418 ds->physnext = htole32(bf->bf_daddr);
1419 }
1420 prev = bf;
1421 }
1422 if (prev != NULL) {
1423 ds = prev->bf_desc;
1424 ds->physnext =
1425 htole32(STAILQ_FIRST(&sc->malo_rxbuf)->bf_daddr);
1426 }
1427
1428 sc->malo_recvsetup = 1;
1429
1430 malo_mode_init(sc); /* set filters, etc. */
1431
1432 return 0;
1433 }
1434
1435 static void
malo_init_locked(struct malo_softc * sc)1436 malo_init_locked(struct malo_softc *sc)
1437 {
1438 struct malo_hal *mh = sc->malo_mh;
1439 int error;
1440
1441 MALO_LOCK_ASSERT(sc);
1442
1443 /*
1444 * Stop anything previously setup. This is safe whether this is
1445 * the first time through or not.
1446 */
1447 malo_stop(sc);
1448
1449 /*
1450 * Push state to the firmware.
1451 */
1452 if (!malo_hal_reset(sc)) {
1453 device_printf(sc->malo_dev,
1454 "%s: unable to reset hardware\n", __func__);
1455 return;
1456 }
1457
1458 /*
1459 * Setup recv (once); transmit is already good to go.
1460 */
1461 error = malo_startrecv(sc);
1462 if (error != 0) {
1463 device_printf(sc->malo_dev,
1464 "%s: unable to start recv logic, error %d\n",
1465 __func__, error);
1466 return;
1467 }
1468
1469 /*
1470 * Enable interrupts.
1471 */
1472 sc->malo_imask = MALO_A2HRIC_BIT_RX_RDY
1473 | MALO_A2HRIC_BIT_TX_DONE
1474 | MALO_A2HRIC_BIT_OPC_DONE
1475 | MALO_A2HRIC_BIT_MAC_EVENT
1476 | MALO_A2HRIC_BIT_RX_PROBLEM
1477 | MALO_A2HRIC_BIT_ICV_ERROR
1478 | MALO_A2HRIC_BIT_RADAR_DETECT
1479 | MALO_A2HRIC_BIT_CHAN_SWITCH;
1480
1481 sc->malo_running = 1;
1482 malo_hal_intrset(mh, sc->malo_imask);
1483 callout_reset(&sc->malo_watchdog_timer, hz, malo_watchdog, sc);
1484 }
1485
1486 static void
malo_init(void * arg)1487 malo_init(void *arg)
1488 {
1489 struct malo_softc *sc = (struct malo_softc *) arg;
1490 struct ieee80211com *ic = &sc->malo_ic;
1491
1492 MALO_LOCK(sc);
1493 malo_init_locked(sc);
1494 MALO_UNLOCK(sc);
1495
1496 if (sc->malo_running)
1497 ieee80211_start_all(ic); /* start all vap's */
1498 }
1499
1500 struct malo_copy_maddr_ctx {
1501 uint8_t macs[IEEE80211_ADDR_LEN * MALO_HAL_MCAST_MAX];
1502 int nmc;
1503 };
1504
1505 static u_int
malo_copy_maddr(void * arg,struct sockaddr_dl * sdl,u_int nmc)1506 malo_copy_maddr(void *arg, struct sockaddr_dl *sdl, u_int nmc)
1507 {
1508 struct malo_copy_maddr_ctx *ctx = arg;
1509
1510 if (ctx->nmc == MALO_HAL_MCAST_MAX)
1511 return (0);
1512
1513 IEEE80211_ADDR_COPY(ctx->macs + (ctx->nmc * IEEE80211_ADDR_LEN),
1514 LLADDR(sdl));
1515 ctx->nmc++;
1516
1517 return (1);
1518 }
1519
1520 /*
1521 * Set the multicast filter contents into the hardware.
1522 */
1523 static void
malo_setmcastfilter(struct malo_softc * sc)1524 malo_setmcastfilter(struct malo_softc *sc)
1525 {
1526 struct malo_copy_maddr_ctx ctx;
1527 struct ieee80211com *ic = &sc->malo_ic;
1528 struct ieee80211vap *vap;
1529
1530
1531 if (ic->ic_opmode == IEEE80211_M_MONITOR || ic->ic_allmulti > 0 ||
1532 ic->ic_promisc > 0)
1533 goto all;
1534
1535 ctx.nmc = 0;
1536 TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
1537 if_foreach_llmaddr(vap->iv_ifp, malo_copy_maddr, &ctx);
1538
1539 malo_hal_setmcast(sc->malo_mh, ctx.nmc, ctx.macs);
1540
1541 all:
1542 /*
1543 * XXX we don't know how to set the f/w for supporting
1544 * IFF_ALLMULTI | IFF_PROMISC cases
1545 */
1546 return;
1547 }
1548
1549 static int
malo_mode_init(struct malo_softc * sc)1550 malo_mode_init(struct malo_softc *sc)
1551 {
1552 struct ieee80211com *ic = &sc->malo_ic;
1553 struct malo_hal *mh = sc->malo_mh;
1554
1555 malo_hal_setpromisc(mh, ic->ic_promisc > 0);
1556 malo_setmcastfilter(sc);
1557
1558 return ENXIO;
1559 }
1560
1561 static void
malo_tx_draintxq(struct malo_softc * sc,struct malo_txq * txq)1562 malo_tx_draintxq(struct malo_softc *sc, struct malo_txq *txq)
1563 {
1564 struct ieee80211_node *ni;
1565 struct malo_txbuf *bf;
1566 u_int ix __unused;
1567
1568 /*
1569 * NB: this assumes output has been stopped and
1570 * we do not need to block malo_tx_tasklet
1571 */
1572 for (ix = 0;; ix++) {
1573 MALO_TXQ_LOCK(txq);
1574 bf = STAILQ_FIRST(&txq->active);
1575 if (bf == NULL) {
1576 MALO_TXQ_UNLOCK(txq);
1577 break;
1578 }
1579 STAILQ_REMOVE_HEAD(&txq->active, bf_list);
1580 MALO_TXQ_UNLOCK(txq);
1581 #ifdef MALO_DEBUG
1582 if (sc->malo_debug & MALO_DEBUG_RESET) {
1583 struct ieee80211com *ic = &sc->malo_ic;
1584 const struct malo_txrec *tr =
1585 mtod(bf->bf_m, const struct malo_txrec *);
1586 malo_printtxbuf(bf, txq->qnum, ix);
1587 ieee80211_dump_pkt(ic, (const uint8_t *)&tr->wh,
1588 bf->bf_m->m_len - sizeof(tr->fwlen), 0, -1);
1589 }
1590 #endif /* MALO_DEBUG */
1591 bus_dmamap_unload(sc->malo_dmat, bf->bf_dmamap);
1592 ni = bf->bf_node;
1593 bf->bf_node = NULL;
1594 if (ni != NULL) {
1595 /*
1596 * Reclaim node reference.
1597 */
1598 ieee80211_free_node(ni);
1599 }
1600 m_freem(bf->bf_m);
1601 bf->bf_m = NULL;
1602
1603 MALO_TXQ_LOCK(txq);
1604 STAILQ_INSERT_TAIL(&txq->free, bf, bf_list);
1605 txq->nfree++;
1606 MALO_TXQ_UNLOCK(txq);
1607 }
1608 }
1609
1610 static void
malo_stop(struct malo_softc * sc)1611 malo_stop(struct malo_softc *sc)
1612 {
1613 struct malo_hal *mh = sc->malo_mh;
1614 int i;
1615
1616 DPRINTF(sc, MALO_DEBUG_ANY, "%s: invalid %u running %u\n",
1617 __func__, sc->malo_invalid, sc->malo_running);
1618
1619 MALO_LOCK_ASSERT(sc);
1620
1621 if (!sc->malo_running)
1622 return;
1623
1624 /*
1625 * Shutdown the hardware and driver:
1626 * disable interrupts
1627 * turn off the radio
1628 * drain and release tx queues
1629 *
1630 * Note that some of this work is not possible if the hardware
1631 * is gone (invalid).
1632 */
1633 sc->malo_running = 0;
1634 callout_stop(&sc->malo_watchdog_timer);
1635 sc->malo_timer = 0;
1636 /* disable interrupt. */
1637 malo_hal_intrset(mh, 0);
1638 /* turn off the radio. */
1639 malo_hal_setradio(mh, 0, MHP_AUTO_PREAMBLE);
1640
1641 /* drain and release tx queues. */
1642 for (i = 0; i < MALO_NUM_TX_QUEUES; i++)
1643 malo_tx_draintxq(sc, &sc->malo_txq[i]);
1644 }
1645
1646 static void
malo_parent(struct ieee80211com * ic)1647 malo_parent(struct ieee80211com *ic)
1648 {
1649 struct malo_softc *sc = ic->ic_softc;
1650 int startall = 0;
1651
1652 MALO_LOCK(sc);
1653 if (ic->ic_nrunning > 0) {
1654 /*
1655 * Beware of being called during attach/detach
1656 * to reset promiscuous mode. In that case we
1657 * will still be marked UP but not RUNNING.
1658 * However trying to re-init the interface
1659 * is the wrong thing to do as we've already
1660 * torn down much of our state. There's
1661 * probably a better way to deal with this.
1662 */
1663 if (!sc->malo_running && !sc->malo_invalid) {
1664 malo_init(sc);
1665 startall = 1;
1666 }
1667 /*
1668 * To avoid rescanning another access point,
1669 * do not call malo_init() here. Instead,
1670 * only reflect promisc mode settings.
1671 */
1672 malo_mode_init(sc);
1673 } else if (sc->malo_running)
1674 malo_stop(sc);
1675 MALO_UNLOCK(sc);
1676 if (startall)
1677 ieee80211_start_all(ic);
1678 }
1679
1680 /*
1681 * Callback from the 802.11 layer to update the slot time
1682 * based on the current setting. We use it to notify the
1683 * firmware of ERP changes and the f/w takes care of things
1684 * like slot time and preamble.
1685 */
1686 static void
malo_updateslot(struct ieee80211com * ic)1687 malo_updateslot(struct ieee80211com *ic)
1688 {
1689 struct malo_softc *sc = ic->ic_softc;
1690 struct malo_hal *mh = sc->malo_mh;
1691 int error;
1692
1693 /* NB: can be called early; suppress needless cmds */
1694 if (!sc->malo_running)
1695 return;
1696
1697 DPRINTF(sc, MALO_DEBUG_RESET,
1698 "%s: chan %u MHz/flags 0x%x %s slot, (ic_flags 0x%x)\n",
1699 __func__, ic->ic_curchan->ic_freq, ic->ic_curchan->ic_flags,
1700 ic->ic_flags & IEEE80211_F_SHSLOT ? "short" : "long", ic->ic_flags);
1701
1702 if (ic->ic_flags & IEEE80211_F_SHSLOT)
1703 error = malo_hal_set_slot(mh, 1);
1704 else
1705 error = malo_hal_set_slot(mh, 0);
1706
1707 if (error != 0)
1708 device_printf(sc->malo_dev, "setting %s slot failed\n",
1709 ic->ic_flags & IEEE80211_F_SHSLOT ? "short" : "long");
1710 }
1711
1712 static int
malo_newstate(struct ieee80211vap * vap,enum ieee80211_state nstate,int arg)1713 malo_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1714 {
1715 struct ieee80211com *ic = vap->iv_ic;
1716 struct malo_softc *sc = ic->ic_softc;
1717 struct malo_hal *mh = sc->malo_mh;
1718 int error;
1719
1720 DPRINTF(sc, MALO_DEBUG_STATE, "%s: %s -> %s\n", __func__,
1721 ieee80211_state_name[vap->iv_state],
1722 ieee80211_state_name[nstate]);
1723
1724 /*
1725 * Invoke the net80211 layer first so iv_bss is setup.
1726 */
1727 error = MALO_VAP(vap)->malo_newstate(vap, nstate, arg);
1728 if (error != 0)
1729 return error;
1730
1731 if (nstate == IEEE80211_S_RUN && vap->iv_state != IEEE80211_S_RUN) {
1732 struct ieee80211_node *ni = vap->iv_bss;
1733 enum ieee80211_phymode mode = ieee80211_chan2mode(ni->ni_chan);
1734 const struct ieee80211_txparam *tp = &vap->iv_txparms[mode];
1735
1736 DPRINTF(sc, MALO_DEBUG_STATE,
1737 "%s: %s(RUN): iv_flags 0x%08x bintvl %d bssid %s "
1738 "capinfo 0x%04x chan %d associd 0x%x mode %d rate %d\n",
1739 if_name(vap->iv_ifp), __func__, vap->iv_flags,
1740 ni->ni_intval, ether_sprintf(ni->ni_bssid), ni->ni_capinfo,
1741 ieee80211_chan2ieee(ic, ic->ic_curchan),
1742 ni->ni_associd, mode, tp->ucastrate);
1743
1744 malo_hal_setradio(mh, 1,
1745 (ic->ic_flags & IEEE80211_F_SHPREAMBLE) ?
1746 MHP_SHORT_PREAMBLE : MHP_LONG_PREAMBLE);
1747 malo_hal_setassocid(sc->malo_mh, ni->ni_bssid, ni->ni_associd);
1748 malo_hal_set_rate(mh, mode,
1749 tp->ucastrate == IEEE80211_FIXED_RATE_NONE ?
1750 0 : malo_fix2rate(tp->ucastrate));
1751 }
1752 return 0;
1753 }
1754
1755 static int
malo_raw_xmit(struct ieee80211_node * ni,struct mbuf * m,const struct ieee80211_bpf_params * params)1756 malo_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1757 const struct ieee80211_bpf_params *params)
1758 {
1759 struct ieee80211com *ic = ni->ni_ic;
1760 struct malo_softc *sc = ic->ic_softc;
1761 struct malo_txbuf *bf;
1762 struct malo_txq *txq;
1763
1764 if (!sc->malo_running || sc->malo_invalid) {
1765 m_freem(m);
1766 return ENETDOWN;
1767 }
1768
1769 /*
1770 * Grab a TX buffer and associated resources. Note that we depend
1771 * on the classification by the 802.11 layer to get to the right h/w
1772 * queue. Management frames must ALWAYS go on queue 1 but we
1773 * cannot just force that here because we may receive non-mgt frames.
1774 */
1775 txq = &sc->malo_txq[0];
1776 bf = malo_getbuf(sc, txq);
1777 if (bf == NULL) {
1778 m_freem(m);
1779 return ENOBUFS;
1780 }
1781
1782 /*
1783 * Pass the frame to the h/w for transmission.
1784 */
1785 if (malo_tx_start(sc, ni, bf, m) != 0) {
1786 bf->bf_m = NULL;
1787 bf->bf_node = NULL;
1788 MALO_TXQ_LOCK(txq);
1789 STAILQ_INSERT_HEAD(&txq->free, bf, bf_list);
1790 txq->nfree++;
1791 MALO_TXQ_UNLOCK(txq);
1792
1793 return EIO; /* XXX */
1794 }
1795
1796 /*
1797 * NB: We don't need to lock against tx done because this just
1798 * prods the firmware to check the transmit descriptors. The firmware
1799 * will also start fetching descriptors by itself if it notices
1800 * new ones are present when it goes to deliver a tx done interrupt
1801 * to the host. So if we race with tx done processing it's ok.
1802 * Delivering the kick here rather than in malo_tx_start is
1803 * an optimization to avoid poking the firmware for each packet.
1804 *
1805 * NB: the queue id isn't used so 0 is ok.
1806 */
1807 malo_hal_txstart(sc->malo_mh, 0/*XXX*/);
1808
1809 return 0;
1810 }
1811
1812 static void
malo_sysctlattach(struct malo_softc * sc)1813 malo_sysctlattach(struct malo_softc *sc)
1814 {
1815 #ifdef MALO_DEBUG
1816 struct sysctl_ctx_list *ctx = device_get_sysctl_ctx(sc->malo_dev);
1817 struct sysctl_oid *tree = device_get_sysctl_tree(sc->malo_dev);
1818
1819 sc->malo_debug = malo_debug;
1820 SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
1821 "debug", CTLFLAG_RW, &sc->malo_debug, 0,
1822 "control debugging printfs");
1823 #endif
1824 }
1825
1826 static void
malo_announce(struct malo_softc * sc)1827 malo_announce(struct malo_softc *sc)
1828 {
1829
1830 device_printf(sc->malo_dev,
1831 "versions [hw %d fw %d.%d.%d.%d] (regioncode %d)\n",
1832 sc->malo_hwspecs.hwversion,
1833 (sc->malo_hwspecs.fw_releasenum >> 24) & 0xff,
1834 (sc->malo_hwspecs.fw_releasenum >> 16) & 0xff,
1835 (sc->malo_hwspecs.fw_releasenum >> 8) & 0xff,
1836 (sc->malo_hwspecs.fw_releasenum >> 0) & 0xff,
1837 sc->malo_hwspecs.regioncode);
1838
1839 if (bootverbose || malo_rxbuf != MALO_RXBUF)
1840 device_printf(sc->malo_dev,
1841 "using %u rx buffers\n", malo_rxbuf);
1842 if (bootverbose || malo_txbuf != MALO_TXBUF)
1843 device_printf(sc->malo_dev,
1844 "using %u tx buffers\n", malo_txbuf);
1845 }
1846
1847 /*
1848 * Convert net80211 channel to a HAL channel.
1849 */
1850 static void
malo_mapchan(struct malo_hal_channel * hc,const struct ieee80211_channel * chan)1851 malo_mapchan(struct malo_hal_channel *hc, const struct ieee80211_channel *chan)
1852 {
1853 hc->channel = chan->ic_ieee;
1854
1855 *(uint32_t *)&hc->flags = 0;
1856 if (IEEE80211_IS_CHAN_2GHZ(chan))
1857 hc->flags.freqband = MALO_FREQ_BAND_2DOT4GHZ;
1858 }
1859
1860 /*
1861 * Set/change channels. If the channel is really being changed,
1862 * it's done by reseting the chip. To accomplish this we must
1863 * first cleanup any pending DMA, then restart stuff after a la
1864 * malo_init.
1865 */
1866 static int
malo_chan_set(struct malo_softc * sc,struct ieee80211_channel * chan)1867 malo_chan_set(struct malo_softc *sc, struct ieee80211_channel *chan)
1868 {
1869 struct malo_hal *mh = sc->malo_mh;
1870 struct malo_hal_channel hchan;
1871
1872 DPRINTF(sc, MALO_DEBUG_RESET, "%s: chan %u MHz/flags 0x%x\n",
1873 __func__, chan->ic_freq, chan->ic_flags);
1874
1875 /*
1876 * Convert to a HAL channel description with the flags constrained
1877 * to reflect the current operating mode.
1878 */
1879 malo_mapchan(&hchan, chan);
1880 malo_hal_intrset(mh, 0); /* disable interrupts */
1881 malo_hal_setchannel(mh, &hchan);
1882 malo_hal_settxpower(mh, &hchan);
1883
1884 /*
1885 * Update internal state.
1886 */
1887 sc->malo_tx_th.wt_chan_freq = htole16(chan->ic_freq);
1888 sc->malo_rx_th.wr_chan_freq = htole16(chan->ic_freq);
1889 if (IEEE80211_IS_CHAN_ANYG(chan)) {
1890 sc->malo_tx_th.wt_chan_flags = htole16(IEEE80211_CHAN_G);
1891 sc->malo_rx_th.wr_chan_flags = htole16(IEEE80211_CHAN_G);
1892 } else {
1893 sc->malo_tx_th.wt_chan_flags = htole16(IEEE80211_CHAN_B);
1894 sc->malo_rx_th.wr_chan_flags = htole16(IEEE80211_CHAN_B);
1895 }
1896 sc->malo_curchan = hchan;
1897 malo_hal_intrset(mh, sc->malo_imask);
1898
1899 return 0;
1900 }
1901
1902 static void
malo_scan_start(struct ieee80211com * ic)1903 malo_scan_start(struct ieee80211com *ic)
1904 {
1905 struct malo_softc *sc = ic->ic_softc;
1906
1907 DPRINTF(sc, MALO_DEBUG_STATE, "%s\n", __func__);
1908 }
1909
1910 static void
malo_scan_end(struct ieee80211com * ic)1911 malo_scan_end(struct ieee80211com *ic)
1912 {
1913 struct malo_softc *sc = ic->ic_softc;
1914
1915 DPRINTF(sc, MALO_DEBUG_STATE, "%s\n", __func__);
1916 }
1917
1918 static void
malo_set_channel(struct ieee80211com * ic)1919 malo_set_channel(struct ieee80211com *ic)
1920 {
1921 struct malo_softc *sc = ic->ic_softc;
1922
1923 (void) malo_chan_set(sc, ic->ic_curchan);
1924 }
1925
1926 static void
malo_rx_proc(void * arg,int npending)1927 malo_rx_proc(void *arg, int npending)
1928 {
1929 struct malo_softc *sc = arg;
1930 struct ieee80211com *ic = &sc->malo_ic;
1931 struct malo_rxbuf *bf;
1932 struct malo_rxdesc *ds;
1933 struct mbuf *m, *mnew;
1934 struct ieee80211_qosframe *wh;
1935 struct ieee80211_node *ni;
1936 int off, len, hdrlen, pktlen, rssi, ntodo;
1937 uint8_t *data, status;
1938 uint32_t readptr, writeptr;
1939
1940 DPRINTF(sc, MALO_DEBUG_RX_PROC,
1941 "%s: pending %u rdptr(0x%x) 0x%x wrptr(0x%x) 0x%x\n",
1942 __func__, npending,
1943 sc->malo_hwspecs.rxdesc_read,
1944 malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_read),
1945 sc->malo_hwspecs.rxdesc_write,
1946 malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_write));
1947
1948 readptr = malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_read);
1949 writeptr = malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_write);
1950 if (readptr == writeptr)
1951 return;
1952
1953 bf = sc->malo_rxnext;
1954 for (ntodo = malo_rxquota; ntodo > 0 && readptr != writeptr; ntodo--) {
1955 if (bf == NULL) {
1956 bf = STAILQ_FIRST(&sc->malo_rxbuf);
1957 break;
1958 }
1959 ds = bf->bf_desc;
1960 if (bf->bf_m == NULL) {
1961 /*
1962 * If data allocation failed previously there
1963 * will be no buffer; try again to re-populate it.
1964 * Note the firmware will not advance to the next
1965 * descriptor with a dma buffer so we must mimic
1966 * this or we'll get out of sync.
1967 */
1968 DPRINTF(sc, MALO_DEBUG_ANY,
1969 "%s: rx buf w/o dma memory\n", __func__);
1970 (void)malo_rxbuf_init(sc, bf);
1971 break;
1972 }
1973 MALO_RXDESC_SYNC(sc, ds,
1974 BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
1975 if (ds->rxcontrol != MALO_RXD_CTRL_DMA_OWN)
1976 break;
1977
1978 readptr = le32toh(ds->physnext);
1979
1980 #ifdef MALO_DEBUG
1981 if (sc->malo_debug & MALO_DEBUG_RECV_DESC)
1982 malo_printrxbuf(bf, 0);
1983 #endif
1984 status = ds->status;
1985 if (status & MALO_RXD_STATUS_DECRYPT_ERR_MASK) {
1986 counter_u64_add(ic->ic_ierrors, 1);
1987 goto rx_next;
1988 }
1989 /*
1990 * Sync the data buffer.
1991 */
1992 len = le16toh(ds->pktlen);
1993 bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap,
1994 BUS_DMASYNC_POSTREAD);
1995 /*
1996 * The 802.11 header is provided all or in part at the front;
1997 * use it to calculate the true size of the header that we'll
1998 * construct below. We use this to figure out where to copy
1999 * payload prior to constructing the header.
2000 */
2001 m = bf->bf_m;
2002 data = mtod(m, uint8_t *);
2003 hdrlen = ieee80211_anyhdrsize(data + sizeof(uint16_t));
2004 off = sizeof(uint16_t) + sizeof(struct ieee80211_frame_addr4);
2005
2006 /*
2007 * Calculate RSSI. XXX wrong
2008 */
2009 rssi = 2 * ((int) ds->snr - ds->nf); /* NB: .5 dBm */
2010 if (rssi > 100)
2011 rssi = 100;
2012
2013 pktlen = hdrlen + (len - off);
2014 /*
2015 * NB: we know our frame is at least as large as
2016 * IEEE80211_MIN_LEN because there is a 4-address frame at
2017 * the front. Hence there's no need to vet the packet length.
2018 * If the frame in fact is too small it should be discarded
2019 * at the net80211 layer.
2020 */
2021
2022 /* XXX don't need mbuf, just dma buffer */
2023 mnew = malo_getrxmbuf(sc, bf);
2024 if (mnew == NULL) {
2025 counter_u64_add(ic->ic_ierrors, 1);
2026 goto rx_next;
2027 }
2028 /*
2029 * Attach the dma buffer to the mbuf; malo_rxbuf_init will
2030 * re-setup the rx descriptor using the replacement dma
2031 * buffer we just installed above.
2032 */
2033 bf->bf_m = mnew;
2034 m->m_data += off - hdrlen;
2035 m->m_pkthdr.len = m->m_len = pktlen;
2036
2037 /*
2038 * Piece 802.11 header together.
2039 */
2040 wh = mtod(m, struct ieee80211_qosframe *);
2041 /* NB: don't need to do this sometimes but ... */
2042 /* XXX special case so we can memcpy after m_devget? */
2043 ovbcopy(data + sizeof(uint16_t), wh, hdrlen);
2044 if (IEEE80211_QOS_HAS_SEQ(wh))
2045 *(uint16_t *)ieee80211_getqos(wh) = ds->qosctrl;
2046 if (ieee80211_radiotap_active(ic)) {
2047 sc->malo_rx_th.wr_flags = 0;
2048 sc->malo_rx_th.wr_rate = ds->rate;
2049 sc->malo_rx_th.wr_antsignal = rssi;
2050 sc->malo_rx_th.wr_antnoise = ds->nf;
2051 }
2052 #ifdef MALO_DEBUG
2053 if (IFF_DUMPPKTS_RECV(sc, wh)) {
2054 ieee80211_dump_pkt(ic, mtod(m, caddr_t),
2055 len, ds->rate, rssi);
2056 }
2057 #endif
2058 /* dispatch */
2059 ni = ieee80211_find_rxnode(ic,
2060 (struct ieee80211_frame_min *)wh);
2061 if (ni != NULL) {
2062 (void) ieee80211_input(ni, m, rssi, ds->nf);
2063 ieee80211_free_node(ni);
2064 } else
2065 (void) ieee80211_input_all(ic, m, rssi, ds->nf);
2066 rx_next:
2067 /* NB: ignore ENOMEM so we process more descriptors */
2068 (void) malo_rxbuf_init(sc, bf);
2069 bf = STAILQ_NEXT(bf, bf_list);
2070 }
2071
2072 malo_bar0_write4(sc, sc->malo_hwspecs.rxdesc_read, readptr);
2073 sc->malo_rxnext = bf;
2074
2075 if (mbufq_first(&sc->malo_snd) != NULL)
2076 malo_start(sc);
2077 }
2078
2079 /*
2080 * Reclaim all tx queue resources.
2081 */
2082 static void
malo_tx_cleanup(struct malo_softc * sc)2083 malo_tx_cleanup(struct malo_softc *sc)
2084 {
2085 int i;
2086
2087 for (i = 0; i < MALO_NUM_TX_QUEUES; i++)
2088 malo_tx_cleanupq(sc, &sc->malo_txq[i]);
2089 }
2090
2091 int
malo_detach(struct malo_softc * sc)2092 malo_detach(struct malo_softc *sc)
2093 {
2094 struct ieee80211com *ic = &sc->malo_ic;
2095
2096 malo_stop(sc);
2097
2098 if (sc->malo_tq != NULL) {
2099 taskqueue_drain(sc->malo_tq, &sc->malo_rxtask);
2100 taskqueue_drain(sc->malo_tq, &sc->malo_txtask);
2101 taskqueue_free(sc->malo_tq);
2102 sc->malo_tq = NULL;
2103 }
2104
2105 /*
2106 * NB: the order of these is important:
2107 * o call the 802.11 layer before detaching the hal to
2108 * insure callbacks into the driver to delete global
2109 * key cache entries can be handled
2110 * o reclaim the tx queue data structures after calling
2111 * the 802.11 layer as we'll get called back to reclaim
2112 * node state and potentially want to use them
2113 * o to cleanup the tx queues the hal is called, so detach
2114 * it last
2115 * Other than that, it's straightforward...
2116 */
2117 ieee80211_ifdetach(ic);
2118 callout_drain(&sc->malo_watchdog_timer);
2119 malo_dma_cleanup(sc);
2120 malo_tx_cleanup(sc);
2121 malo_hal_detach(sc->malo_mh);
2122 mbufq_drain(&sc->malo_snd);
2123 MALO_LOCK_DESTROY(sc);
2124
2125 return 0;
2126 }
2127
2128 void
malo_shutdown(struct malo_softc * sc)2129 malo_shutdown(struct malo_softc *sc)
2130 {
2131
2132 malo_stop(sc);
2133 }
2134
2135 void
malo_suspend(struct malo_softc * sc)2136 malo_suspend(struct malo_softc *sc)
2137 {
2138
2139 malo_stop(sc);
2140 }
2141
2142 void
malo_resume(struct malo_softc * sc)2143 malo_resume(struct malo_softc *sc)
2144 {
2145
2146 if (sc->malo_ic.ic_nrunning > 0)
2147 malo_init(sc);
2148 }
2149