xref: /freebsd/sys/dev/malo/if_malo.c (revision 39beb93c3f8bdbf72a61fda42300b5ebed7390c8)
1 /*-
2  * Copyright (c) 2008 Weongyo Jeong <weongyo@freebsd.org>
3  * Copyright (c) 2007 Marvell Semiconductor, Inc.
4  * Copyright (c) 2007 Sam Leffler, Errno Consulting
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer,
12  *    without modification.
13  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
14  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
15  *    redistribution must be conditioned upon including a substantially
16  *    similar Disclaimer requirement for further binary redistribution.
17  *
18  * NO WARRANTY
19  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
22  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
23  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
24  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
27  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
29  * THE POSSIBILITY OF SUCH DAMAGES.
30  */
31 
32 #include <sys/cdefs.h>
33 #ifdef __FreeBSD__
34 __FBSDID("$FreeBSD$");
35 #endif
36 
37 #include "opt_malo.h"
38 
39 #include <sys/param.h>
40 #include <sys/endian.h>
41 #include <sys/kernel.h>
42 #include <sys/socket.h>
43 #include <sys/sockio.h>
44 #include <sys/sysctl.h>
45 #include <sys/taskqueue.h>
46 
47 #include <machine/bus.h>
48 #include <sys/bus.h>
49 
50 #include <net/if.h>
51 #include <net/if_dl.h>
52 #include <net/if_media.h>
53 #include <net/if_types.h>
54 #include <net/ethernet.h>
55 
56 #include <net80211/ieee80211_var.h>
57 #include <net80211/ieee80211_regdomain.h>
58 
59 #include <net/bpf.h>
60 
61 #include <dev/malo/if_malo.h>
62 
63 SYSCTL_NODE(_hw, OID_AUTO, malo, CTLFLAG_RD, 0,
64     "Marvell 88w8335 driver parameters");
65 
66 static	int malo_txcoalesce = 8;	/* # tx pkts to q before poking f/w*/
67 SYSCTL_INT(_hw_malo, OID_AUTO, txcoalesce, CTLFLAG_RW, &malo_txcoalesce,
68 	    0, "tx buffers to send at once");
69 TUNABLE_INT("hw.malo.txcoalesce", &malo_txcoalesce);
70 static	int malo_rxbuf = MALO_RXBUF;		/* # rx buffers to allocate */
71 SYSCTL_INT(_hw_malo, OID_AUTO, rxbuf, CTLFLAG_RW, &malo_rxbuf,
72 	    0, "rx buffers allocated");
73 TUNABLE_INT("hw.malo.rxbuf", &malo_rxbuf);
74 static	int malo_rxquota = MALO_RXBUF;		/* # max buffers to process */
75 SYSCTL_INT(_hw_malo, OID_AUTO, rxquota, CTLFLAG_RW, &malo_rxquota,
76 	    0, "max rx buffers to process per interrupt");
77 TUNABLE_INT("hw.malo.rxquota", &malo_rxquota);
78 static	int malo_txbuf = MALO_TXBUF;		/* # tx buffers to allocate */
79 SYSCTL_INT(_hw_malo, OID_AUTO, txbuf, CTLFLAG_RW, &malo_txbuf,
80 	    0, "tx buffers allocated");
81 TUNABLE_INT("hw.malo.txbuf", &malo_txbuf);
82 
83 #ifdef MALO_DEBUG
84 static	int malo_debug = 0;
85 SYSCTL_INT(_hw_malo, OID_AUTO, debug, CTLFLAG_RW, &malo_debug,
86 	    0, "control debugging printfs");
87 TUNABLE_INT("hw.malo.debug", &malo_debug);
88 enum {
89 	MALO_DEBUG_XMIT		= 0x00000001,	/* basic xmit operation */
90 	MALO_DEBUG_XMIT_DESC	= 0x00000002,	/* xmit descriptors */
91 	MALO_DEBUG_RECV		= 0x00000004,	/* basic recv operation */
92 	MALO_DEBUG_RECV_DESC	= 0x00000008,	/* recv descriptors */
93 	MALO_DEBUG_RESET	= 0x00000010,	/* reset processing */
94 	MALO_DEBUG_INTR		= 0x00000040,	/* ISR */
95 	MALO_DEBUG_TX_PROC	= 0x00000080,	/* tx ISR proc */
96 	MALO_DEBUG_RX_PROC	= 0x00000100,	/* rx ISR proc */
97 	MALO_DEBUG_STATE	= 0x00000400,	/* 802.11 state transitions */
98 	MALO_DEBUG_NODE		= 0x00000800,	/* node management */
99 	MALO_DEBUG_RECV_ALL	= 0x00001000,	/* trace all frames (beacons) */
100 	MALO_DEBUG_FW		= 0x00008000,	/* firmware */
101 	MALO_DEBUG_ANY		= 0xffffffff
102 };
103 #define	IS_BEACON(wh)							\
104 	((wh->i_fc[0] & (IEEE80211_FC0_TYPE_MASK |			\
105 		IEEE80211_FC0_SUBTYPE_MASK)) ==				\
106 	 (IEEE80211_FC0_TYPE_MGT|IEEE80211_FC0_SUBTYPE_BEACON))
107 #define	IFF_DUMPPKTS_RECV(sc, wh)					\
108 	(((sc->malo_debug & MALO_DEBUG_RECV) &&				\
109 	  ((sc->malo_debug & MALO_DEBUG_RECV_ALL) || !IS_BEACON(wh))) || \
110 	 (sc->malo_ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==		\
111 	  (IFF_DEBUG|IFF_LINK2))
112 #define	IFF_DUMPPKTS_XMIT(sc)						\
113 	((sc->malo_debug & MALO_DEBUG_XMIT) ||				\
114 	 (sc->malo_ifp->if_flags & (IFF_DEBUG | IFF_LINK2)) ==		\
115 	     (IFF_DEBUG | IFF_LINK2))
116 #define	DPRINTF(sc, m, fmt, ...) do {				\
117 	if (sc->malo_debug & (m))				\
118 		printf(fmt, __VA_ARGS__);			\
119 } while (0)
120 #else
121 #define	DPRINTF(sc, m, fmt, ...) do {				\
122 	(void) sc;						\
123 } while (0)
124 #endif
125 
126 MALLOC_DEFINE(M_MALODEV, "malodev", "malo driver dma buffers");
127 
128 static struct ieee80211vap *malo_vap_create(struct ieee80211com *ic,
129 	const char name[IFNAMSIZ], int unit, int opmode, int flags,
130 	const uint8_t bssid[IEEE80211_ADDR_LEN],
131 	const uint8_t mac[IEEE80211_ADDR_LEN]);
132 static  void	malo_vap_delete(struct ieee80211vap *);
133 static	int	malo_dma_setup(struct malo_softc *);
134 static	int	malo_setup_hwdma(struct malo_softc *);
135 static	void	malo_txq_init(struct malo_softc *, struct malo_txq *, int);
136 static	void	malo_tx_cleanupq(struct malo_softc *, struct malo_txq *);
137 static	void	malo_start(struct ifnet *);
138 static	void	malo_watchdog(struct ifnet *);
139 static	int	malo_ioctl(struct ifnet *, u_long, caddr_t);
140 static	void	malo_updateslot(struct ifnet *);
141 static	int	malo_newstate(struct ieee80211vap *, enum ieee80211_state, int);
142 static	void	malo_scan_start(struct ieee80211com *);
143 static	void	malo_scan_end(struct ieee80211com *);
144 static	void	malo_set_channel(struct ieee80211com *);
145 static	int	malo_raw_xmit(struct ieee80211_node *, struct mbuf *,
146 		    const struct ieee80211_bpf_params *);
147 static	void	malo_bpfattach(struct malo_softc *);
148 static	void	malo_sysctlattach(struct malo_softc *);
149 static	void	malo_announce(struct malo_softc *);
150 static	void	malo_dma_cleanup(struct malo_softc *);
151 static	void	malo_stop_locked(struct ifnet *, int);
152 static	int	malo_chan_set(struct malo_softc *, struct ieee80211_channel *);
153 static	int	malo_mode_init(struct malo_softc *);
154 static	void	malo_tx_proc(void *, int);
155 static	void	malo_rx_proc(void *, int);
156 static	void	malo_init(void *);
157 
158 /*
159  * Read/Write shorthands for accesses to BAR 0.  Note that all BAR 1
160  * operations are done in the "hal" except getting H/W MAC address at
161  * malo_attach and there should be no reference to them here.
162  */
163 static uint32_t
164 malo_bar0_read4(struct malo_softc *sc, bus_size_t off)
165 {
166 	return bus_space_read_4(sc->malo_io0t, sc->malo_io0h, off);
167 }
168 
169 static void
170 malo_bar0_write4(struct malo_softc *sc, bus_size_t off, uint32_t val)
171 {
172 	DPRINTF(sc, MALO_DEBUG_FW, "%s: off 0x%zx val 0x%x\n",
173 	    __func__, off, val);
174 
175 	bus_space_write_4(sc->malo_io0t, sc->malo_io0h, off, val);
176 }
177 
178 static uint8_t
179 malo_bar1_read1(struct malo_softc *sc, bus_size_t off)
180 {
181 	return bus_space_read_1(sc->malo_io1t, sc->malo_io1h, off);
182 }
183 
184 int
185 malo_attach(uint16_t devid, struct malo_softc *sc)
186 {
187 	int error, i;
188 	struct ieee80211com *ic;
189 	struct ifnet *ifp;
190 	struct malo_hal *mh;
191 	uint8_t bands;
192 
193 	ifp = sc->malo_ifp = if_alloc(IFT_IEEE80211);
194 	if (ifp == NULL) {
195 		device_printf(sc->malo_dev, "can not if_alloc()\n");
196 		return ENOSPC;
197 	}
198 	ic = ifp->if_l2com;
199 
200 	MALO_LOCK_INIT(sc);
201 
202 	/* set these up early for if_printf use */
203 	if_initname(ifp, device_get_name(sc->malo_dev),
204 	    device_get_unit(sc->malo_dev));
205 
206 	/*
207 	 * NB: get mac address from hardware directly here before we set DMAs
208 	 * for HAL because we don't want to disturb operations of HAL at BAR 1.
209 	 */
210 	for (i = 0; i < IEEE80211_ADDR_LEN; i++) {
211 		/* XXX remove a magic number but we don't have documents.  */
212 		ic->ic_myaddr[i] = malo_bar1_read1(sc, 0xa528 + i);
213 		DELAY(1000);
214 	}
215 
216 	mh = malo_hal_attach(sc->malo_dev, devid,
217 	    sc->malo_io1h, sc->malo_io1t, sc->malo_dmat);
218 	if (mh == NULL) {
219 		if_printf(ifp, "unable to attach HAL\n");
220 		error = EIO;
221 		goto bad;
222 	}
223 	sc->malo_mh = mh;
224 
225 	/*
226 	 * Load firmware so we can get setup.  We arbitrarily pick station
227 	 * firmware; we'll re-load firmware as needed so setting up
228 	 * the wrong mode isn't a big deal.
229 	 */
230 	error = malo_hal_fwload(mh, "malo8335-h", "malo8335-m");
231 	if (error != 0) {
232 		if_printf(ifp, "unable to setup firmware\n");
233 		goto bad1;
234 	}
235 	/* XXX gethwspecs() extracts correct informations?  not maybe!  */
236 	error = malo_hal_gethwspecs(mh, &sc->malo_hwspecs);
237 	if (error != 0) {
238 		if_printf(ifp, "unable to fetch h/w specs\n");
239 		goto bad1;
240 	}
241 
242 	DPRINTF(sc, MALO_DEBUG_FW,
243 	    "malo_hal_gethwspecs: hwversion 0x%x hostif 0x%x"
244 	    "maxnum_wcb 0x%x maxnum_mcaddr 0x%x maxnum_tx_wcb 0x%x"
245 	    "regioncode 0x%x num_antenna 0x%x fw_releasenum 0x%x"
246 	    "wcbbase0 0x%x rxdesc_read 0x%x rxdesc_write 0x%x"
247 	    "ul_fw_awakecookie 0x%x w[4] = %x %x %x %x",
248 	    sc->malo_hwspecs.hwversion,
249 	    sc->malo_hwspecs.hostinterface, sc->malo_hwspecs.maxnum_wcb,
250 	    sc->malo_hwspecs.maxnum_mcaddr, sc->malo_hwspecs.maxnum_tx_wcb,
251 	    sc->malo_hwspecs.regioncode, sc->malo_hwspecs.num_antenna,
252 	    sc->malo_hwspecs.fw_releasenum, sc->malo_hwspecs.wcbbase0,
253 	    sc->malo_hwspecs.rxdesc_read, sc->malo_hwspecs.rxdesc_write,
254 	    sc->malo_hwspecs.ul_fw_awakecookie,
255 	    sc->malo_hwspecs.wcbbase[0], sc->malo_hwspecs.wcbbase[1],
256 	    sc->malo_hwspecs.wcbbase[2], sc->malo_hwspecs.wcbbase[3]);
257 
258 	/* NB: firmware looks that it does not export regdomain info API.  */
259 	bands = 0;
260 	setbit(&bands, IEEE80211_MODE_11B);
261 	setbit(&bands, IEEE80211_MODE_11G);
262 	ieee80211_init_channels(ic, NULL, &bands);
263 
264 	sc->malo_txantenna = 0x2;	/* h/w default */
265 	sc->malo_rxantenna = 0xffff;	/* h/w default */
266 
267 	/*
268 	 * Allocate tx + rx descriptors and populate the lists.
269 	 * We immediately push the information to the firmware
270 	 * as otherwise it gets upset.
271 	 */
272 	error = malo_dma_setup(sc);
273 	if (error != 0) {
274 		if_printf(ifp, "failed to setup descriptors: %d\n", error);
275 		goto bad1;
276 	}
277 	error = malo_setup_hwdma(sc);	/* push to firmware */
278 	if (error != 0)			/* NB: malo_setupdma prints msg */
279 		goto bad1;
280 
281 	sc->malo_tq = taskqueue_create_fast("malo_taskq", M_NOWAIT,
282 		taskqueue_thread_enqueue, &sc->malo_tq);
283 	taskqueue_start_threads(&sc->malo_tq, 1, PI_NET,
284 		"%s taskq", ifp->if_xname);
285 
286 	TASK_INIT(&sc->malo_rxtask, 0, malo_rx_proc, sc);
287 	TASK_INIT(&sc->malo_txtask, 0, malo_tx_proc, sc);
288 
289 	ifp->if_softc = sc;
290 	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST;
291 	ifp->if_start = malo_start;
292 	ifp->if_watchdog = malo_watchdog;
293 	ifp->if_ioctl = malo_ioctl;
294 	ifp->if_init = malo_init;
295 	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
296 	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
297 	IFQ_SET_READY(&ifp->if_snd);
298 
299 	ic->ic_ifp = ifp;
300 	/* XXX not right but it's not used anywhere important */
301 	ic->ic_phytype = IEEE80211_T_OFDM;
302 	ic->ic_opmode = IEEE80211_M_STA;
303 	ic->ic_caps =
304 	      IEEE80211_C_STA			/* station mode supported */
305 	    | IEEE80211_C_BGSCAN		/* capable of bg scanning */
306 	    | IEEE80211_C_MONITOR		/* monitor mode */
307 	    | IEEE80211_C_SHPREAMBLE		/* short preamble supported */
308 	    | IEEE80211_C_SHSLOT		/* short slot time supported */
309 	    | IEEE80211_C_TXPMGT		/* capable of txpow mgt */
310 	    | IEEE80211_C_WPA			/* capable of WPA1+WPA2 */
311 	    ;
312 
313 	/*
314 	 * Transmit requires space in the packet for a special format transmit
315 	 * record and optional padding between this record and the payload.
316 	 * Ask the net80211 layer to arrange this when encapsulating
317 	 * packets so we can add it efficiently.
318 	 */
319 	ic->ic_headroom = sizeof(struct malo_txrec) -
320 		sizeof(struct ieee80211_frame);
321 
322 	/* get mac address from hardware */
323 	IEEE80211_ADDR_COPY(ic->ic_myaddr, sc->malo_hwspecs.macaddr);
324 
325 	/* call MI attach routine. */
326 	ieee80211_ifattach(ic);
327 	/* override default methods */
328 	ic->ic_vap_create = malo_vap_create;
329 	ic->ic_vap_delete = malo_vap_delete;
330 	ic->ic_raw_xmit = malo_raw_xmit;
331 	ic->ic_updateslot = malo_updateslot;
332 
333 	ic->ic_scan_start = malo_scan_start;
334 	ic->ic_scan_end = malo_scan_end;
335 	ic->ic_set_channel = malo_set_channel;
336 
337 	sc->malo_invalid = 0;		/* ready to go, enable int handling */
338 
339 	malo_bpfattach(sc);
340 
341 	/*
342 	 * Setup dynamic sysctl's.
343 	 */
344 	malo_sysctlattach(sc);
345 
346 	if (bootverbose)
347 		ieee80211_announce(ic);
348 	malo_announce(sc);
349 
350 	return 0;
351 bad1:
352 	malo_hal_detach(mh);
353 bad:
354 	if_free(ifp);
355 	sc->malo_invalid = 1;
356 
357 	return error;
358 }
359 
360 static struct ieee80211vap *
361 malo_vap_create(struct ieee80211com *ic,
362 	const char name[IFNAMSIZ], int unit, int opmode, int flags,
363 	const uint8_t bssid[IEEE80211_ADDR_LEN],
364 	const uint8_t mac[IEEE80211_ADDR_LEN])
365 {
366 	struct ifnet *ifp = ic->ic_ifp;
367 	struct malo_vap *mvp;
368 	struct ieee80211vap *vap;
369 
370 	if (!TAILQ_EMPTY(&ic->ic_vaps)) {
371 		if_printf(ifp, "multiple vaps not supported\n");
372 		return NULL;
373 	}
374 	switch (opmode) {
375 	case IEEE80211_M_STA:
376 		if (opmode == IEEE80211_M_STA)
377 			flags |= IEEE80211_CLONE_NOBEACONS;
378 		/* fall thru... */
379 	case IEEE80211_M_MONITOR:
380 		break;
381 	default:
382 		if_printf(ifp, "%s mode not supported\n",
383 		    ieee80211_opmode_name[opmode]);
384 		return NULL;		/* unsupported */
385 	}
386 	mvp = (struct malo_vap *) malloc(sizeof(struct malo_vap),
387 	    M_80211_VAP, M_NOWAIT | M_ZERO);
388 	if (mvp == NULL) {
389 		if_printf(ifp, "cannot allocate vap state block\n");
390 		return NULL;
391 	}
392 	vap = &mvp->malo_vap;
393 	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid, mac);
394 
395 	/* override state transition machine */
396 	mvp->malo_newstate = vap->iv_newstate;
397 	vap->iv_newstate = malo_newstate;
398 
399 	/* complete setup */
400 	ieee80211_vap_attach(vap,
401 	    ieee80211_media_change, ieee80211_media_status);
402 	ic->ic_opmode = opmode;
403 	return vap;
404 }
405 
406 static void
407 malo_vap_delete(struct ieee80211vap *vap)
408 {
409 	struct malo_vap *mvp = MALO_VAP(vap);
410 
411 	ieee80211_vap_detach(vap);
412 	free(mvp, M_80211_VAP);
413 }
414 
415 int
416 malo_intr(void *arg)
417 {
418 	struct malo_softc *sc = arg;
419 	struct malo_hal *mh = sc->malo_mh;
420 	uint32_t status;
421 
422 	if (sc->malo_invalid) {
423 		/*
424 		 * The hardware is not ready/present, don't touch anything.
425 		 * Note this can happen early on if the IRQ is shared.
426 		 */
427 		DPRINTF(sc, MALO_DEBUG_ANY, "%s: invalid; ignored\n", __func__);
428 		return (FILTER_STRAY);
429 	}
430 
431 	/*
432 	 * Figure out the reason(s) for the interrupt.
433 	 */
434 	malo_hal_getisr(mh, &status);		/* NB: clears ISR too */
435 	if (status == 0)			/* must be a shared irq */
436 		return (FILTER_STRAY);
437 
438 	DPRINTF(sc, MALO_DEBUG_INTR, "%s: status 0x%x imask 0x%x\n",
439 	    __func__, status, sc->malo_imask);
440 
441 	if (status & MALO_A2HRIC_BIT_RX_RDY)
442 		taskqueue_enqueue_fast(sc->malo_tq, &sc->malo_rxtask);
443 	if (status & MALO_A2HRIC_BIT_TX_DONE)
444 		taskqueue_enqueue_fast(sc->malo_tq, &sc->malo_txtask);
445 	if (status & MALO_A2HRIC_BIT_OPC_DONE)
446 		malo_hal_cmddone(mh);
447 	if (status & MALO_A2HRIC_BIT_MAC_EVENT)
448 		;
449 	if (status & MALO_A2HRIC_BIT_RX_PROBLEM)
450 		;
451 	if (status & MALO_A2HRIC_BIT_ICV_ERROR) {
452 		/* TKIP ICV error */
453 		sc->malo_stats.mst_rx_badtkipicv++;
454 	}
455 #ifdef MALO_DEBUG
456 	if (((status | sc->malo_imask) ^ sc->malo_imask) != 0)
457 		DPRINTF(sc, MALO_DEBUG_INTR,
458 		    "%s: can't handle interrupt status 0x%x\n",
459 		    __func__, status);
460 #endif
461 	return (FILTER_HANDLED);
462 }
463 
464 static void
465 malo_load_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
466 {
467 	bus_addr_t *paddr = (bus_addr_t*) arg;
468 
469 	KASSERT(error == 0, ("error %u on bus_dma callback", error));
470 
471 	*paddr = segs->ds_addr;
472 }
473 
474 static int
475 malo_desc_setup(struct malo_softc *sc, const char *name,
476     struct malo_descdma *dd,
477     int nbuf, size_t bufsize, int ndesc, size_t descsize)
478 {
479 	int error;
480 	struct ifnet *ifp = sc->malo_ifp;
481 	uint8_t *ds;
482 
483 	DPRINTF(sc, MALO_DEBUG_RESET,
484 	    "%s: %s DMA: %u bufs (%ju) %u desc/buf (%ju)\n",
485 	    __func__, name, nbuf, (uintmax_t) bufsize,
486 	    ndesc, (uintmax_t) descsize);
487 
488 	dd->dd_name = name;
489 	dd->dd_desc_len = nbuf * ndesc * descsize;
490 
491 	/*
492 	 * Setup DMA descriptor area.
493 	 */
494 	error = bus_dma_tag_create(bus_get_dma_tag(sc->malo_dev),/* parent */
495 		       PAGE_SIZE, 0,		/* alignment, bounds */
496 		       BUS_SPACE_MAXADDR_32BIT,	/* lowaddr */
497 		       BUS_SPACE_MAXADDR,	/* highaddr */
498 		       NULL, NULL,		/* filter, filterarg */
499 		       dd->dd_desc_len,		/* maxsize */
500 		       1,			/* nsegments */
501 		       dd->dd_desc_len,		/* maxsegsize */
502 		       BUS_DMA_ALLOCNOW,	/* flags */
503 		       NULL,			/* lockfunc */
504 		       NULL,			/* lockarg */
505 		       &dd->dd_dmat);
506 	if (error != 0) {
507 		if_printf(ifp, "cannot allocate %s DMA tag\n", dd->dd_name);
508 		return error;
509 	}
510 
511 	/* allocate descriptors */
512 	error = bus_dmamap_create(dd->dd_dmat, BUS_DMA_NOWAIT, &dd->dd_dmamap);
513 	if (error != 0) {
514 		if_printf(ifp, "unable to create dmamap for %s descriptors, "
515 		    "error %u\n", dd->dd_name, error);
516 		goto fail0;
517 	}
518 
519 	error = bus_dmamem_alloc(dd->dd_dmat, (void**) &dd->dd_desc,
520 	    BUS_DMA_NOWAIT | BUS_DMA_COHERENT, &dd->dd_dmamap);
521 	if (error != 0) {
522 		if_printf(ifp, "unable to alloc memory for %u %s descriptors, "
523 		    "error %u\n", nbuf * ndesc, dd->dd_name, error);
524 		goto fail1;
525 	}
526 
527 	error = bus_dmamap_load(dd->dd_dmat, dd->dd_dmamap,
528 	    dd->dd_desc, dd->dd_desc_len,
529 	    malo_load_cb, &dd->dd_desc_paddr, BUS_DMA_NOWAIT);
530 	if (error != 0) {
531 		if_printf(ifp, "unable to map %s descriptors, error %u\n",
532 		    dd->dd_name, error);
533 		goto fail2;
534 	}
535 
536 	ds = dd->dd_desc;
537 	memset(ds, 0, dd->dd_desc_len);
538 	DPRINTF(sc, MALO_DEBUG_RESET, "%s: %s DMA map: %p (%lu) -> %p (%lu)\n",
539 	    __func__, dd->dd_name, ds, (u_long) dd->dd_desc_len,
540 	    (caddr_t) dd->dd_desc_paddr, /*XXX*/ (u_long) dd->dd_desc_len);
541 
542 	return 0;
543 fail2:
544 	bus_dmamem_free(dd->dd_dmat, dd->dd_desc, dd->dd_dmamap);
545 fail1:
546 	bus_dmamap_destroy(dd->dd_dmat, dd->dd_dmamap);
547 fail0:
548 	bus_dma_tag_destroy(dd->dd_dmat);
549 	memset(dd, 0, sizeof(*dd));
550 	return error;
551 }
552 
553 #define	DS2PHYS(_dd, _ds) \
554 	((_dd)->dd_desc_paddr + ((caddr_t)(_ds) - (caddr_t)(_dd)->dd_desc))
555 
556 static int
557 malo_rxdma_setup(struct malo_softc *sc)
558 {
559 	struct ifnet *ifp = sc->malo_ifp;
560 	int error, bsize, i;
561 	struct malo_rxbuf *bf;
562 	struct malo_rxdesc *ds;
563 
564 	error = malo_desc_setup(sc, "rx", &sc->malo_rxdma,
565 	    malo_rxbuf, sizeof(struct malo_rxbuf),
566 	    1, sizeof(struct malo_rxdesc));
567 	if (error != 0)
568 		return error;
569 
570 	/*
571 	 * Allocate rx buffers and set them up.
572 	 */
573 	bsize = malo_rxbuf * sizeof(struct malo_rxbuf);
574 	bf = malloc(bsize, M_MALODEV, M_NOWAIT | M_ZERO);
575 	if (bf == NULL) {
576 		if_printf(ifp, "malloc of %u rx buffers failed\n", bsize);
577 		return error;
578 	}
579 	sc->malo_rxdma.dd_bufptr = bf;
580 
581 	STAILQ_INIT(&sc->malo_rxbuf);
582 	ds = sc->malo_rxdma.dd_desc;
583 	for (i = 0; i < malo_rxbuf; i++, bf++, ds++) {
584 		bf->bf_desc = ds;
585 		bf->bf_daddr = DS2PHYS(&sc->malo_rxdma, ds);
586 		error = bus_dmamap_create(sc->malo_dmat, BUS_DMA_NOWAIT,
587 		    &bf->bf_dmamap);
588 		if (error != 0) {
589 			if_printf(ifp, "%s: unable to dmamap for rx buffer, "
590 			    "error %d\n", __func__, error);
591 			return error;
592 		}
593 		/* NB: tail is intentional to preserve descriptor order */
594 		STAILQ_INSERT_TAIL(&sc->malo_rxbuf, bf, bf_list);
595 	}
596 	return 0;
597 }
598 
599 static int
600 malo_txdma_setup(struct malo_softc *sc, struct malo_txq *txq)
601 {
602 	struct ifnet *ifp = sc->malo_ifp;
603 	int error, bsize, i;
604 	struct malo_txbuf *bf;
605 	struct malo_txdesc *ds;
606 
607 	error = malo_desc_setup(sc, "tx", &txq->dma,
608 	    malo_txbuf, sizeof(struct malo_txbuf),
609 	    MALO_TXDESC, sizeof(struct malo_txdesc));
610 	if (error != 0)
611 		return error;
612 
613 	/* allocate and setup tx buffers */
614 	bsize = malo_txbuf * sizeof(struct malo_txbuf);
615 	bf = malloc(bsize, M_MALODEV, M_NOWAIT | M_ZERO);
616 	if (bf == NULL) {
617 		if_printf(ifp, "malloc of %u tx buffers failed\n",
618 		    malo_txbuf);
619 		return ENOMEM;
620 	}
621 	txq->dma.dd_bufptr = bf;
622 
623 	STAILQ_INIT(&txq->free);
624 	txq->nfree = 0;
625 	ds = txq->dma.dd_desc;
626 	for (i = 0; i < malo_txbuf; i++, bf++, ds += MALO_TXDESC) {
627 		bf->bf_desc = ds;
628 		bf->bf_daddr = DS2PHYS(&txq->dma, ds);
629 		error = bus_dmamap_create(sc->malo_dmat, BUS_DMA_NOWAIT,
630 		    &bf->bf_dmamap);
631 		if (error != 0) {
632 			if_printf(ifp, "unable to create dmamap for tx "
633 			    "buffer %u, error %u\n", i, error);
634 			return error;
635 		}
636 		STAILQ_INSERT_TAIL(&txq->free, bf, bf_list);
637 		txq->nfree++;
638 	}
639 
640 	return 0;
641 }
642 
643 static void
644 malo_desc_cleanup(struct malo_softc *sc, struct malo_descdma *dd)
645 {
646 	bus_dmamap_unload(dd->dd_dmat, dd->dd_dmamap);
647 	bus_dmamem_free(dd->dd_dmat, dd->dd_desc, dd->dd_dmamap);
648 	bus_dmamap_destroy(dd->dd_dmat, dd->dd_dmamap);
649 	bus_dma_tag_destroy(dd->dd_dmat);
650 
651 	memset(dd, 0, sizeof(*dd));
652 }
653 
654 static void
655 malo_rxdma_cleanup(struct malo_softc *sc)
656 {
657 	struct malo_rxbuf *bf;
658 
659 	STAILQ_FOREACH(bf, &sc->malo_rxbuf, bf_list) {
660 		if (bf->bf_m != NULL) {
661 			m_freem(bf->bf_m);
662 			bf->bf_m = NULL;
663 		}
664 		if (bf->bf_dmamap != NULL) {
665 			bus_dmamap_destroy(sc->malo_dmat, bf->bf_dmamap);
666 			bf->bf_dmamap = NULL;
667 		}
668 	}
669 	STAILQ_INIT(&sc->malo_rxbuf);
670 	if (sc->malo_rxdma.dd_bufptr != NULL) {
671 		free(sc->malo_rxdma.dd_bufptr, M_MALODEV);
672 		sc->malo_rxdma.dd_bufptr = NULL;
673 	}
674 	if (sc->malo_rxdma.dd_desc_len != 0)
675 		malo_desc_cleanup(sc, &sc->malo_rxdma);
676 }
677 
678 static void
679 malo_txdma_cleanup(struct malo_softc *sc, struct malo_txq *txq)
680 {
681 	struct malo_txbuf *bf;
682 	struct ieee80211_node *ni;
683 
684 	STAILQ_FOREACH(bf, &txq->free, bf_list) {
685 		if (bf->bf_m != NULL) {
686 			m_freem(bf->bf_m);
687 			bf->bf_m = NULL;
688 		}
689 		ni = bf->bf_node;
690 		bf->bf_node = NULL;
691 		if (ni != NULL) {
692 			/*
693 			 * Reclaim node reference.
694 			 */
695 			ieee80211_free_node(ni);
696 		}
697 		if (bf->bf_dmamap != NULL) {
698 			bus_dmamap_destroy(sc->malo_dmat, bf->bf_dmamap);
699 			bf->bf_dmamap = NULL;
700 		}
701 	}
702 	STAILQ_INIT(&txq->free);
703 	txq->nfree = 0;
704 	if (txq->dma.dd_bufptr != NULL) {
705 		free(txq->dma.dd_bufptr, M_MALODEV);
706 		txq->dma.dd_bufptr = NULL;
707 	}
708 	if (txq->dma.dd_desc_len != 0)
709 		malo_desc_cleanup(sc, &txq->dma);
710 }
711 
712 static void
713 malo_dma_cleanup(struct malo_softc *sc)
714 {
715 	int i;
716 
717 	for (i = 0; i < MALO_NUM_TX_QUEUES; i++)
718 		malo_txdma_cleanup(sc, &sc->malo_txq[i]);
719 
720 	malo_rxdma_cleanup(sc);
721 }
722 
723 static int
724 malo_dma_setup(struct malo_softc *sc)
725 {
726 	int error, i;
727 
728 	/* rxdma initializing.  */
729 	error = malo_rxdma_setup(sc);
730 	if (error != 0)
731 		return error;
732 
733 	/* NB: we just have 1 tx queue now.  */
734 	for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
735 		error = malo_txdma_setup(sc, &sc->malo_txq[i]);
736 		if (error != 0) {
737 			malo_dma_cleanup(sc);
738 
739 			return error;
740 		}
741 
742 		malo_txq_init(sc, &sc->malo_txq[i], i);
743 	}
744 
745 	return 0;
746 }
747 
748 static void
749 malo_hal_set_rxtxdma(struct malo_softc *sc)
750 {
751 	int i;
752 
753 	malo_bar0_write4(sc, sc->malo_hwspecs.rxdesc_read,
754 	    sc->malo_hwdma.rxdesc_read);
755 	malo_bar0_write4(sc, sc->malo_hwspecs.rxdesc_write,
756 	    sc->malo_hwdma.rxdesc_read);
757 
758 	for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
759 		malo_bar0_write4(sc,
760 		    sc->malo_hwspecs.wcbbase[i], sc->malo_hwdma.wcbbase[i]);
761 	}
762 }
763 
764 /*
765  * Inform firmware of our tx/rx dma setup.  The BAR 0 writes below are
766  * for compatibility with older firmware.  For current firmware we send
767  * this information with a cmd block via malo_hal_sethwdma.
768  */
769 static int
770 malo_setup_hwdma(struct malo_softc *sc)
771 {
772 	int i;
773 	struct malo_txq *txq;
774 
775 	sc->malo_hwdma.rxdesc_read = sc->malo_rxdma.dd_desc_paddr;
776 
777 	for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
778 		txq = &sc->malo_txq[i];
779 		sc->malo_hwdma.wcbbase[i] = txq->dma.dd_desc_paddr;
780 	}
781 	sc->malo_hwdma.maxnum_txwcb = malo_txbuf;
782 	sc->malo_hwdma.maxnum_wcb = MALO_NUM_TX_QUEUES;
783 
784 	malo_hal_set_rxtxdma(sc);
785 
786 	return 0;
787 }
788 
789 static void
790 malo_txq_init(struct malo_softc *sc, struct malo_txq *txq, int qnum)
791 {
792 	struct malo_txbuf *bf, *bn;
793 	struct malo_txdesc *ds;
794 
795 	MALO_TXQ_LOCK_INIT(sc, txq);
796 	txq->qnum = qnum;
797 	txq->txpri = 0;	/* XXX */
798 
799 	STAILQ_FOREACH(bf, &txq->free, bf_list) {
800 		bf->bf_txq = txq;
801 
802 		ds = bf->bf_desc;
803 		bn = STAILQ_NEXT(bf, bf_list);
804 		if (bn == NULL)
805 			bn = STAILQ_FIRST(&txq->free);
806 		ds->physnext = htole32(bn->bf_daddr);
807 	}
808 	STAILQ_INIT(&txq->active);
809 }
810 
811 /*
812  * Reclaim resources for a setup queue.
813  */
814 static void
815 malo_tx_cleanupq(struct malo_softc *sc, struct malo_txq *txq)
816 {
817 	/* XXX hal work? */
818 	MALO_TXQ_LOCK_DESTROY(txq);
819 }
820 
821 /*
822  * Allocate a tx buffer for sending a frame.
823  */
824 static struct malo_txbuf *
825 malo_getbuf(struct malo_softc *sc, struct malo_txq *txq)
826 {
827 	struct malo_txbuf *bf;
828 
829 	MALO_TXQ_LOCK(txq);
830 	bf = STAILQ_FIRST(&txq->free);
831 	if (bf != NULL) {
832 		STAILQ_REMOVE_HEAD(&txq->free, bf_list);
833 		txq->nfree--;
834 	}
835 	MALO_TXQ_UNLOCK(txq);
836 	if (bf == NULL) {
837 		DPRINTF(sc, MALO_DEBUG_XMIT,
838 		    "%s: out of xmit buffers on q %d\n", __func__, txq->qnum);
839 		sc->malo_stats.mst_tx_qstop++;
840 	}
841 	return bf;
842 }
843 
844 static int
845 malo_tx_dmasetup(struct malo_softc *sc, struct malo_txbuf *bf, struct mbuf *m0)
846 {
847 	struct mbuf *m;
848 	int error;
849 
850 	/*
851 	 * Load the DMA map so any coalescing is done.  This also calculates
852 	 * the number of descriptors we need.
853 	 */
854 	error = bus_dmamap_load_mbuf_sg(sc->malo_dmat, bf->bf_dmamap, m0,
855 				     bf->bf_segs, &bf->bf_nseg,
856 				     BUS_DMA_NOWAIT);
857 	if (error == EFBIG) {
858 		/* XXX packet requires too many descriptors */
859 		bf->bf_nseg = MALO_TXDESC + 1;
860 	} else if (error != 0) {
861 		sc->malo_stats.mst_tx_busdma++;
862 		m_freem(m0);
863 		return error;
864 	}
865 	/*
866 	 * Discard null packets and check for packets that require too many
867 	 * TX descriptors.  We try to convert the latter to a cluster.
868 	 */
869 	if (error == EFBIG) {		/* too many desc's, linearize */
870 		sc->malo_stats.mst_tx_linear++;
871 		m = m_defrag(m0, M_DONTWAIT);
872 		if (m == NULL) {
873 			m_freem(m0);
874 			sc->malo_stats.mst_tx_nombuf++;
875 			return ENOMEM;
876 		}
877 		m0 = m;
878 		error = bus_dmamap_load_mbuf_sg(sc->malo_dmat, bf->bf_dmamap, m0,
879 					     bf->bf_segs, &bf->bf_nseg,
880 					     BUS_DMA_NOWAIT);
881 		if (error != 0) {
882 			sc->malo_stats.mst_tx_busdma++;
883 			m_freem(m0);
884 			return error;
885 		}
886 		KASSERT(bf->bf_nseg <= MALO_TXDESC,
887 		    ("too many segments after defrag; nseg %u", bf->bf_nseg));
888 	} else if (bf->bf_nseg == 0) {		/* null packet, discard */
889 		sc->malo_stats.mst_tx_nodata++;
890 		m_freem(m0);
891 		return EIO;
892 	}
893 	DPRINTF(sc, MALO_DEBUG_XMIT, "%s: m %p len %u\n",
894 		__func__, m0, m0->m_pkthdr.len);
895 	bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
896 	bf->bf_m = m0;
897 
898 	return 0;
899 }
900 
901 #ifdef MALO_DEBUG
902 static void
903 malo_printrxbuf(const struct malo_rxbuf *bf, u_int ix)
904 {
905 	const struct malo_rxdesc *ds = bf->bf_desc;
906 	uint32_t status = le32toh(ds->status);
907 
908 	printf("R[%2u] (DS.V:%p DS.P:%p) NEXT:%08x DATA:%08x RC:%02x%s\n"
909 	    "      STAT:%02x LEN:%04x SNR:%02x NF:%02x CHAN:%02x"
910 	    " RATE:%02x QOS:%04x\n",
911 	    ix, ds, (const struct malo_desc *)bf->bf_daddr,
912 	    le32toh(ds->physnext), le32toh(ds->physbuffdata),
913 	    ds->rxcontrol,
914 	    ds->rxcontrol != MALO_RXD_CTRL_DRIVER_OWN ?
915 	        "" : (status & MALO_RXD_STATUS_OK) ? " *" : " !",
916 	    ds->status, le16toh(ds->pktlen), ds->snr, ds->nf, ds->channel,
917 	    ds->rate, le16toh(ds->qosctrl));
918 }
919 
920 static void
921 malo_printtxbuf(const struct malo_txbuf *bf, u_int qnum, u_int ix)
922 {
923 	const struct malo_txdesc *ds = bf->bf_desc;
924 	uint32_t status = le32toh(ds->status);
925 
926 	printf("Q%u[%3u]", qnum, ix);
927 	printf(" (DS.V:%p DS.P:%p)\n",
928 	    ds, (const struct malo_txdesc *)bf->bf_daddr);
929 	printf("    NEXT:%08x DATA:%08x LEN:%04x STAT:%08x%s\n",
930 	    le32toh(ds->physnext),
931 	    le32toh(ds->pktptr), le16toh(ds->pktlen), status,
932 	    status & MALO_TXD_STATUS_USED ?
933 	    "" : (status & 3) != 0 ? " *" : " !");
934 	printf("    RATE:%02x PRI:%x QOS:%04x SAP:%08x FORMAT:%04x\n",
935 	    ds->datarate, ds->txpriority, le16toh(ds->qosctrl),
936 	    le32toh(ds->sap_pktinfo), le16toh(ds->format));
937 #if 0
938 	{
939 		const uint8_t *cp = (const uint8_t *) ds;
940 		int i;
941 		for (i = 0; i < sizeof(struct malo_txdesc); i++) {
942 			printf("%02x ", cp[i]);
943 			if (((i+1) % 16) == 0)
944 				printf("\n");
945 		}
946 		printf("\n");
947 	}
948 #endif
949 }
950 #endif /* MALO_DEBUG */
951 
952 static __inline void
953 malo_updatetxrate(struct ieee80211_node *ni, int rix)
954 {
955 #define	N(x)	(sizeof(x)/sizeof(x[0]))
956 	static const int ieeerates[] =
957 	    { 2, 4, 11, 22, 44, 12, 18, 24, 36, 48, 96, 108 };
958 	if (rix < N(ieeerates))
959 		ni->ni_txrate = ieeerates[rix];
960 #undef N
961 }
962 
963 static int
964 malo_fix2rate(int fix_rate)
965 {
966 #define	N(x)	(sizeof(x)/sizeof(x[0]))
967 	static const int rates[] =
968 	    { 2, 4, 11, 22, 12, 18, 24, 36, 48, 96, 108 };
969 	return (fix_rate < N(rates) ? rates[fix_rate] : 0);
970 #undef N
971 }
972 
973 /* idiomatic shorthands: MS = mask+shift, SM = shift+mask */
974 #define	MS(v,x)			(((v) & x) >> x##_S)
975 #define	SM(v,x)			(((v) << x##_S) & x)
976 
977 /*
978  * Process completed xmit descriptors from the specified queue.
979  */
980 static int
981 malo_tx_processq(struct malo_softc *sc, struct malo_txq *txq)
982 {
983 	struct malo_txbuf *bf;
984 	struct malo_txdesc *ds;
985 	struct ieee80211_node *ni;
986 	int nreaped;
987 	uint32_t status;
988 
989 	DPRINTF(sc, MALO_DEBUG_TX_PROC, "%s: tx queue %u\n",
990 	    __func__, txq->qnum);
991 	for (nreaped = 0;; nreaped++) {
992 		MALO_TXQ_LOCK(txq);
993 		bf = STAILQ_FIRST(&txq->active);
994 		if (bf == NULL) {
995 			MALO_TXQ_UNLOCK(txq);
996 			break;
997 		}
998 		ds = bf->bf_desc;
999 		MALO_TXDESC_SYNC(txq, ds,
1000 		    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
1001 		if (ds->status & htole32(MALO_TXD_STATUS_FW_OWNED)) {
1002 			MALO_TXQ_UNLOCK(txq);
1003 			break;
1004 		}
1005 		STAILQ_REMOVE_HEAD(&txq->active, bf_list);
1006 		MALO_TXQ_UNLOCK(txq);
1007 
1008 #ifdef MALO_DEBUG
1009 		if (sc->malo_debug & MALO_DEBUG_XMIT_DESC)
1010 			malo_printtxbuf(bf, txq->qnum, nreaped);
1011 #endif
1012 		ni = bf->bf_node;
1013 		if (ni != NULL) {
1014 			status = le32toh(ds->status);
1015 			if (status & MALO_TXD_STATUS_OK) {
1016 				uint16_t format = le16toh(ds->format);
1017 				uint8_t txant = MS(format, MALO_TXD_ANTENNA);
1018 
1019 				sc->malo_stats.mst_ant_tx[txant]++;
1020 				if (status & MALO_TXD_STATUS_OK_RETRY)
1021 					sc->malo_stats.mst_tx_retries++;
1022 				if (status & MALO_TXD_STATUS_OK_MORE_RETRY)
1023 					sc->malo_stats.mst_tx_mretries++;
1024 				malo_updatetxrate(ni, ds->datarate);
1025 				sc->malo_stats.mst_tx_rate = ds->datarate;
1026 			} else {
1027 				if (status & MALO_TXD_STATUS_FAILED_LINK_ERROR)
1028 					sc->malo_stats.mst_tx_linkerror++;
1029 				if (status & MALO_TXD_STATUS_FAILED_XRETRY)
1030 					sc->malo_stats.mst_tx_xretries++;
1031 				if (status & MALO_TXD_STATUS_FAILED_AGING)
1032 					sc->malo_stats.mst_tx_aging++;
1033 			}
1034 			/*
1035 			 * Do any tx complete callback.  Note this must
1036 			 * be done before releasing the node reference.
1037 			 * XXX no way to figure out if frame was ACK'd
1038 			 */
1039 			if (bf->bf_m->m_flags & M_TXCB) {
1040 				/* XXX strip fw len in case header inspected */
1041 				m_adj(bf->bf_m, sizeof(uint16_t));
1042 				ieee80211_process_callback(ni, bf->bf_m,
1043 					(status & MALO_TXD_STATUS_OK) == 0);
1044 			}
1045 			/*
1046 			 * Reclaim reference to node.
1047 			 *
1048 			 * NB: the node may be reclaimed here if, for example
1049 			 *     this is a DEAUTH message that was sent and the
1050 			 *     node was timed out due to inactivity.
1051 			 */
1052 			ieee80211_free_node(ni);
1053 		}
1054 		ds->status = htole32(MALO_TXD_STATUS_IDLE);
1055 		ds->pktlen = htole32(0);
1056 
1057 		bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap,
1058 		    BUS_DMASYNC_POSTWRITE);
1059 		bus_dmamap_unload(sc->malo_dmat, bf->bf_dmamap);
1060 		m_freem(bf->bf_m);
1061 		bf->bf_m = NULL;
1062 		bf->bf_node = NULL;
1063 
1064 		MALO_TXQ_LOCK(txq);
1065 		STAILQ_INSERT_TAIL(&txq->free, bf, bf_list);
1066 		txq->nfree++;
1067 		MALO_TXQ_UNLOCK(txq);
1068 	}
1069 	return nreaped;
1070 }
1071 
1072 /*
1073  * Deferred processing of transmit interrupt.
1074  */
1075 static void
1076 malo_tx_proc(void *arg, int npending)
1077 {
1078 	struct malo_softc *sc = arg;
1079 	struct ifnet *ifp = sc->malo_ifp;
1080 	int i, nreaped;
1081 
1082 	/*
1083 	 * Process each active queue.
1084 	 */
1085 	nreaped = 0;
1086 	for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
1087 		if (!STAILQ_EMPTY(&sc->malo_txq[i].active))
1088 			nreaped += malo_tx_processq(sc, &sc->malo_txq[i]);
1089 	}
1090 
1091 	if (nreaped != 0) {
1092 		ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1093 		ifp->if_timer = 0;
1094 		malo_start(ifp);
1095 	}
1096 }
1097 
1098 static int
1099 malo_tx_start(struct malo_softc *sc, struct ieee80211_node *ni,
1100     struct malo_txbuf *bf, struct mbuf *m0)
1101 {
1102 #define	IEEE80211_DIR_DSTODS(wh) \
1103 	((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS)
1104 #define	IS_DATA_FRAME(wh)						\
1105 	((wh->i_fc[0] & (IEEE80211_FC0_TYPE_MASK)) == IEEE80211_FC0_TYPE_DATA)
1106 	int error, ismcast, iswep;
1107 	int copyhdrlen, hdrlen, pktlen;
1108 	struct ieee80211_frame *wh;
1109 	struct ifnet *ifp = sc->malo_ifp;
1110 	struct ieee80211com *ic = ifp->if_l2com;
1111 	struct malo_txdesc *ds;
1112 	struct malo_txrec *tr;
1113 	struct malo_txq *txq;
1114 	uint16_t qos;
1115 
1116 	wh = mtod(m0, struct ieee80211_frame *);
1117 	iswep = wh->i_fc[1] & IEEE80211_FC1_WEP;
1118 	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
1119 	copyhdrlen = hdrlen = ieee80211_anyhdrsize(wh);
1120 	pktlen = m0->m_pkthdr.len;
1121 	if (IEEE80211_QOS_HAS_SEQ(wh)) {
1122 		if (IEEE80211_DIR_DSTODS(wh)) {
1123 			qos = *(uint16_t *)
1124 			    (((struct ieee80211_qosframe_addr4 *) wh)->i_qos);
1125 			copyhdrlen -= sizeof(qos);
1126 		} else
1127 			qos = *(uint16_t *)
1128 			    (((struct ieee80211_qosframe *) wh)->i_qos);
1129 	} else
1130 		qos = 0;
1131 
1132 	if (iswep) {
1133 		struct ieee80211_key *k;
1134 
1135 		/*
1136 		 * Construct the 802.11 header+trailer for an encrypted
1137 		 * frame. The only reason this can fail is because of an
1138 		 * unknown or unsupported cipher/key type.
1139 		 *
1140 		 * NB: we do this even though the firmware will ignore
1141 		 *     what we've done for WEP and TKIP as we need the
1142 		 *     ExtIV filled in for CCMP and this also adjusts
1143 		 *     the headers which simplifies our work below.
1144 		 */
1145 		k = ieee80211_crypto_encap(ni, m0);
1146 		if (k == NULL) {
1147 			/*
1148 			 * This can happen when the key is yanked after the
1149 			 * frame was queued.  Just discard the frame; the
1150 			 * 802.11 layer counts failures and provides
1151 			 * debugging/diagnostics.
1152 			 */
1153 			m_freem(m0);
1154 			return EIO;
1155 		}
1156 
1157 		/*
1158 		 * Adjust the packet length for the crypto additions
1159 		 * done during encap and any other bits that the f/w
1160 		 * will add later on.
1161 		 */
1162 		pktlen = m0->m_pkthdr.len;
1163 
1164 		/* packet header may have moved, reset our local pointer */
1165 		wh = mtod(m0, struct ieee80211_frame *);
1166 	}
1167 
1168 	if (bpf_peers_present(ifp->if_bpf)) {
1169 		sc->malo_tx_th.wt_flags = 0;	/* XXX */
1170 		if (iswep)
1171 			sc->malo_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
1172 		sc->malo_tx_th.wt_txpower = ni->ni_txpower;
1173 		sc->malo_tx_th.wt_antenna = sc->malo_txantenna;
1174 
1175 		bpf_mtap2(ifp->if_bpf, &sc->malo_tx_th, sc->malo_tx_th_len, m0);
1176 	}
1177 
1178 	/*
1179 	 * Copy up/down the 802.11 header; the firmware requires
1180 	 * we present a 2-byte payload length followed by a
1181 	 * 4-address header (w/o QoS), followed (optionally) by
1182 	 * any WEP/ExtIV header (but only filled in for CCMP).
1183 	 * We are assured the mbuf has sufficient headroom to
1184 	 * prepend in-place by the setup of ic_headroom in
1185 	 * malo_attach.
1186 	 */
1187 	if (hdrlen < sizeof(struct malo_txrec)) {
1188 		const int space = sizeof(struct malo_txrec) - hdrlen;
1189 		if (M_LEADINGSPACE(m0) < space) {
1190 			/* NB: should never happen */
1191 			device_printf(sc->malo_dev,
1192 			    "not enough headroom, need %d found %zd, "
1193 			    "m_flags 0x%x m_len %d\n",
1194 			    space, M_LEADINGSPACE(m0), m0->m_flags, m0->m_len);
1195 			ieee80211_dump_pkt(ic,
1196 			    mtod(m0, const uint8_t *), m0->m_len, 0, -1);
1197 			m_freem(m0);
1198 			/* XXX stat */
1199 			return EIO;
1200 		}
1201 		M_PREPEND(m0, space, M_NOWAIT);
1202 	}
1203 	tr = mtod(m0, struct malo_txrec *);
1204 	if (wh != (struct ieee80211_frame *) &tr->wh)
1205 		ovbcopy(wh, &tr->wh, hdrlen);
1206 	/*
1207 	 * Note: the "firmware length" is actually the length of the fully
1208 	 * formed "802.11 payload".  That is, it's everything except for
1209 	 * the 802.11 header.  In particular this includes all crypto
1210 	 * material including the MIC!
1211 	 */
1212 	tr->fwlen = htole16(pktlen - hdrlen);
1213 
1214 	/*
1215 	 * Load the DMA map so any coalescing is done.  This
1216 	 * also calculates the number of descriptors we need.
1217 	 */
1218 	error = malo_tx_dmasetup(sc, bf, m0);
1219 	if (error != 0)
1220 		return error;
1221 	bf->bf_node = ni;			/* NB: held reference */
1222 	m0 = bf->bf_m;				/* NB: may have changed */
1223 	tr = mtod(m0, struct malo_txrec *);
1224 	wh = (struct ieee80211_frame *)&tr->wh;
1225 
1226 	/*
1227 	 * Formulate tx descriptor.
1228 	 */
1229 	ds = bf->bf_desc;
1230 	txq = bf->bf_txq;
1231 
1232 	ds->qosctrl = qos;			/* NB: already little-endian */
1233 	ds->pktptr = htole32(bf->bf_segs[0].ds_addr);
1234 	ds->pktlen = htole16(bf->bf_segs[0].ds_len);
1235 	/* NB: pPhysNext setup once, don't touch */
1236 	ds->datarate = IS_DATA_FRAME(wh) ? 1 : 0;
1237 	ds->sap_pktinfo = 0;
1238 	ds->format = 0;
1239 
1240 	/*
1241 	 * Select transmit rate.
1242 	 */
1243 	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
1244 	case IEEE80211_FC0_TYPE_MGT:
1245 		sc->malo_stats.mst_tx_mgmt++;
1246 		/* fall thru... */
1247 	case IEEE80211_FC0_TYPE_CTL:
1248 		ds->txpriority = 1;
1249 		break;
1250 	case IEEE80211_FC0_TYPE_DATA:
1251 		ds->txpriority = txq->qnum;
1252 		break;
1253 	default:
1254 		if_printf(ifp, "bogus frame type 0x%x (%s)\n",
1255 			wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK, __func__);
1256 		/* XXX statistic */
1257 		m_freem(m0);
1258 		return EIO;
1259 	}
1260 
1261 #ifdef MALO_DEBUG
1262 	if (IFF_DUMPPKTS_XMIT(sc))
1263 		ieee80211_dump_pkt(ic,
1264 		    mtod(m0, const uint8_t *)+sizeof(uint16_t),
1265 		    m0->m_len - sizeof(uint16_t), ds->datarate, -1);
1266 #endif
1267 
1268 	MALO_TXQ_LOCK(txq);
1269 	if (!IS_DATA_FRAME(wh))
1270 		ds->status |= htole32(1);
1271 	ds->status |= htole32(MALO_TXD_STATUS_FW_OWNED);
1272 	STAILQ_INSERT_TAIL(&txq->active, bf, bf_list);
1273 	MALO_TXDESC_SYNC(txq, ds, BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
1274 
1275 	ifp->if_opackets++;
1276 	ifp->if_timer = 5;
1277 	MALO_TXQ_UNLOCK(txq);
1278 	return 0;
1279 #undef IEEE80211_DIR_DSTODS
1280 }
1281 
1282 static void
1283 malo_start(struct ifnet *ifp)
1284 {
1285 	struct malo_softc *sc = ifp->if_softc;
1286 	struct ieee80211_node *ni;
1287 	struct malo_txq *txq = &sc->malo_txq[0];
1288 	struct malo_txbuf *bf = NULL;
1289 	struct mbuf *m;
1290 	int nqueued = 0;
1291 
1292 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0 || sc->malo_invalid)
1293 		return;
1294 
1295 	for (;;) {
1296 		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
1297 		if (m == NULL)
1298 			break;
1299 		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
1300 		bf = malo_getbuf(sc, txq);
1301 		if (bf == NULL) {
1302 			IFQ_DRV_PREPEND(&ifp->if_snd, m);
1303 
1304 			/* XXX blocks other traffic */
1305 			ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1306 			sc->malo_stats.mst_tx_qstop++;
1307 			break;
1308 		}
1309 		/*
1310 		 * Encapsulate the packet in prep for transmission.
1311 		 */
1312 		m = ieee80211_encap(ni, m);
1313 		if (m == NULL) {
1314 			DPRINTF(sc, MALO_DEBUG_XMIT,
1315 			    "%s: encapsulation failure\n", __func__);
1316 			sc->malo_stats.mst_tx_encap++;
1317 			goto bad;
1318 		}
1319 		/*
1320 		 * Pass the frame to the h/w for transmission.
1321 		 */
1322 		if (malo_tx_start(sc, ni, bf, m)) {
1323 	bad:
1324 			ifp->if_oerrors++;
1325 			if (bf != NULL) {
1326 				bf->bf_m = NULL;
1327 				bf->bf_node = NULL;
1328 				MALO_TXQ_LOCK(txq);
1329 				STAILQ_INSERT_HEAD(&txq->free, bf, bf_list);
1330 				MALO_TXQ_UNLOCK(txq);
1331 			}
1332 			ieee80211_free_node(ni);
1333 			continue;
1334 		}
1335 		nqueued++;
1336 
1337 		if (nqueued >= malo_txcoalesce) {
1338 			/*
1339 			 * Poke the firmware to process queued frames;
1340 			 * see below about (lack of) locking.
1341 			 */
1342 			nqueued = 0;
1343 			malo_hal_txstart(sc->malo_mh, 0/*XXX*/);
1344 		}
1345 	}
1346 
1347 	if (nqueued) {
1348 		/*
1349 		 * NB: We don't need to lock against tx done because
1350 		 * this just prods the firmware to check the transmit
1351 		 * descriptors.  The firmware will also start fetching
1352 		 * descriptors by itself if it notices new ones are
1353 		 * present when it goes to deliver a tx done interrupt
1354 		 * to the host. So if we race with tx done processing
1355 		 * it's ok.  Delivering the kick here rather than in
1356 		 * malo_tx_start is an optimization to avoid poking the
1357 		 * firmware for each packet.
1358 		 *
1359 		 * NB: the queue id isn't used so 0 is ok.
1360 		 */
1361 		malo_hal_txstart(sc->malo_mh, 0/*XXX*/);
1362 	}
1363 }
1364 
1365 static void
1366 malo_watchdog(struct ifnet *ifp)
1367 {
1368 	struct malo_softc *sc = ifp->if_softc;
1369 
1370 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) && !sc->malo_invalid) {
1371 		if_printf(ifp, "watchdog timeout\n");
1372 
1373 		/* XXX no way to reset h/w. now  */
1374 
1375 		ifp->if_oerrors++;
1376 		sc->malo_stats.mst_watchdog++;
1377 	}
1378 }
1379 
1380 static int
1381 malo_hal_reset(struct malo_softc *sc)
1382 {
1383 	static int first = 0;
1384 	struct ifnet *ifp = sc->malo_ifp;
1385 	struct ieee80211com *ic = ifp->if_l2com;
1386 	struct malo_hal *mh = sc->malo_mh;
1387 
1388 	if (first == 0) {
1389 		/*
1390 		 * NB: when the device firstly is initialized, sometimes
1391 		 * firmware could override rx/tx dma registers so we re-set
1392 		 * these values once.
1393 		 */
1394 		malo_hal_set_rxtxdma(sc);
1395 		first = 1;
1396 	}
1397 
1398 	malo_hal_setantenna(mh, MHA_ANTENNATYPE_RX, sc->malo_rxantenna);
1399 	malo_hal_setantenna(mh, MHA_ANTENNATYPE_TX, sc->malo_txantenna);
1400 	malo_hal_setradio(mh, 1, MHP_AUTO_PREAMBLE);
1401 	malo_chan_set(sc, ic->ic_curchan);
1402 
1403 	/* XXX needs other stuffs?  */
1404 
1405 	return 1;
1406 }
1407 
1408 static __inline struct mbuf *
1409 malo_getrxmbuf(struct malo_softc *sc, struct malo_rxbuf *bf)
1410 {
1411 	struct mbuf *m;
1412 	bus_addr_t paddr;
1413 	int error;
1414 
1415 	/* XXX don't need mbuf, just dma buffer */
1416 	m = m_getjcl(M_DONTWAIT, MT_DATA, M_PKTHDR, MJUMPAGESIZE);
1417 	if (m == NULL) {
1418 		sc->malo_stats.mst_rx_nombuf++;	/* XXX */
1419 		return NULL;
1420 	}
1421 	error = bus_dmamap_load(sc->malo_dmat, bf->bf_dmamap,
1422 	    mtod(m, caddr_t), MJUMPAGESIZE,
1423 	    malo_load_cb, &paddr, BUS_DMA_NOWAIT);
1424 	if (error != 0) {
1425 		if_printf(sc->malo_ifp,
1426 		    "%s: bus_dmamap_load failed, error %d\n", __func__, error);
1427 		m_freem(m);
1428 		return NULL;
1429 	}
1430 	bf->bf_data = paddr;
1431 	bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
1432 
1433 	return m;
1434 }
1435 
1436 static int
1437 malo_rxbuf_init(struct malo_softc *sc, struct malo_rxbuf *bf)
1438 {
1439 	struct malo_rxdesc *ds;
1440 
1441 	ds = bf->bf_desc;
1442 	if (bf->bf_m == NULL) {
1443 		bf->bf_m = malo_getrxmbuf(sc, bf);
1444 		if (bf->bf_m == NULL) {
1445 			/* mark descriptor to be skipped */
1446 			ds->rxcontrol = MALO_RXD_CTRL_OS_OWN;
1447 			/* NB: don't need PREREAD */
1448 			MALO_RXDESC_SYNC(sc, ds, BUS_DMASYNC_PREWRITE);
1449 			return ENOMEM;
1450 		}
1451 	}
1452 
1453 	/*
1454 	 * Setup descriptor.
1455 	 */
1456 	ds->qosctrl = 0;
1457 	ds->snr = 0;
1458 	ds->status = MALO_RXD_STATUS_IDLE;
1459 	ds->channel = 0;
1460 	ds->pktlen = htole16(MALO_RXSIZE);
1461 	ds->nf = 0;
1462 	ds->physbuffdata = htole32(bf->bf_data);
1463 	/* NB: don't touch pPhysNext, set once */
1464 	ds->rxcontrol = MALO_RXD_CTRL_DRIVER_OWN;
1465 	MALO_RXDESC_SYNC(sc, ds, BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
1466 
1467 	return 0;
1468 }
1469 
1470 /*
1471  * Setup the rx data structures.  This should only be done once or we may get
1472  * out of sync with the firmware.
1473  */
1474 static int
1475 malo_startrecv(struct malo_softc *sc)
1476 {
1477 	struct malo_rxbuf *bf, *prev;
1478 	struct malo_rxdesc *ds;
1479 
1480 	if (sc->malo_recvsetup == 1) {
1481 		malo_mode_init(sc);		/* set filters, etc. */
1482 		return 0;
1483 	}
1484 
1485 	prev = NULL;
1486 	STAILQ_FOREACH(bf, &sc->malo_rxbuf, bf_list) {
1487 		int error = malo_rxbuf_init(sc, bf);
1488 		if (error != 0) {
1489 			DPRINTF(sc, MALO_DEBUG_RECV,
1490 			    "%s: malo_rxbuf_init failed %d\n",
1491 			    __func__, error);
1492 			return error;
1493 		}
1494 		if (prev != NULL) {
1495 			ds = prev->bf_desc;
1496 			ds->physnext = htole32(bf->bf_daddr);
1497 		}
1498 		prev = bf;
1499 	}
1500 	if (prev != NULL) {
1501 		ds = prev->bf_desc;
1502 		ds->physnext =
1503 		    htole32(STAILQ_FIRST(&sc->malo_rxbuf)->bf_daddr);
1504 	}
1505 
1506 	sc->malo_recvsetup = 1;
1507 
1508 	malo_mode_init(sc);		/* set filters, etc. */
1509 
1510 	return 0;
1511 }
1512 
1513 static void
1514 malo_init_locked(struct malo_softc *sc)
1515 {
1516 	struct ifnet *ifp = sc->malo_ifp;
1517 	struct malo_hal *mh = sc->malo_mh;
1518 	int error;
1519 
1520 	DPRINTF(sc, MALO_DEBUG_ANY, "%s: if_flags 0x%x\n",
1521 	    __func__, ifp->if_flags);
1522 
1523 	MALO_LOCK_ASSERT(sc);
1524 
1525 	/*
1526 	 * Stop anything previously setup.  This is safe whether this is
1527 	 * the first time through or not.
1528 	 */
1529 	malo_stop_locked(ifp, 0);
1530 
1531 	/*
1532 	 * Push state to the firmware.
1533 	 */
1534 	if (!malo_hal_reset(sc)) {
1535 		if_printf(ifp, "%s: unable to reset hardware\n", __func__);
1536 		return;
1537 	}
1538 
1539 	/*
1540 	 * Setup recv (once); transmit is already good to go.
1541 	 */
1542 	error = malo_startrecv(sc);
1543 	if (error != 0) {
1544 		if_printf(ifp, "%s: unable to start recv logic, error %d\n",
1545 		    __func__, error);
1546 		return;
1547 	}
1548 
1549 	/*
1550 	 * Enable interrupts.
1551 	 */
1552 	sc->malo_imask = MALO_A2HRIC_BIT_RX_RDY
1553 	    | MALO_A2HRIC_BIT_TX_DONE
1554 	    | MALO_A2HRIC_BIT_OPC_DONE
1555 	    | MALO_A2HRIC_BIT_MAC_EVENT
1556 	    | MALO_A2HRIC_BIT_RX_PROBLEM
1557 	    | MALO_A2HRIC_BIT_ICV_ERROR
1558 	    | MALO_A2HRIC_BIT_RADAR_DETECT
1559 	    | MALO_A2HRIC_BIT_CHAN_SWITCH;
1560 
1561 	ifp->if_drv_flags |= IFF_DRV_RUNNING;
1562 	malo_hal_intrset(mh, sc->malo_imask);
1563 }
1564 
1565 static void
1566 malo_init(void *arg)
1567 {
1568 	struct malo_softc *sc = (struct malo_softc *) arg;
1569 	struct ifnet *ifp = sc->malo_ifp;
1570 	struct ieee80211com *ic = ifp->if_l2com;
1571 
1572 	DPRINTF(sc, MALO_DEBUG_ANY, "%s: if_flags 0x%x\n",
1573 	    __func__, ifp->if_flags);
1574 
1575 	MALO_LOCK(sc);
1576 	malo_init_locked(sc);
1577 
1578 	MALO_UNLOCK(sc);
1579 
1580 	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1581 		ieee80211_start_all(ic);	/* start all vap's */
1582 }
1583 
1584 /*
1585  * Set the multicast filter contents into the hardware.
1586  */
1587 static void
1588 malo_setmcastfilter(struct malo_softc *sc)
1589 {
1590 	struct ifnet *ifp = sc->malo_ifp;
1591 	struct ieee80211com *ic = ifp->if_l2com;
1592 	struct ifmultiaddr *ifma;
1593 	uint8_t macs[IEEE80211_ADDR_LEN * MALO_HAL_MCAST_MAX];
1594 	uint8_t *mp;
1595 	int nmc;
1596 
1597 	mp = macs;
1598 	nmc = 0;
1599 
1600 	if (ic->ic_opmode == IEEE80211_M_MONITOR ||
1601 	    (ifp->if_flags & (IFF_ALLMULTI | IFF_PROMISC)))
1602 		goto all;
1603 
1604 	IF_ADDR_LOCK(ifp);
1605 	TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
1606 		if (ifma->ifma_addr->sa_family != AF_LINK)
1607 			continue;
1608 
1609 		if (nmc == MALO_HAL_MCAST_MAX) {
1610 			ifp->if_flags |= IFF_ALLMULTI;
1611 			IF_ADDR_UNLOCK(ifp);
1612 			goto all;
1613 		}
1614 		IEEE80211_ADDR_COPY(mp,
1615 		    LLADDR((struct sockaddr_dl *)ifma->ifma_addr));
1616 
1617 		mp += IEEE80211_ADDR_LEN, nmc++;
1618 	}
1619 	IF_ADDR_UNLOCK(ifp);
1620 
1621 	malo_hal_setmcast(sc->malo_mh, nmc, macs);
1622 
1623 all:
1624 	/*
1625 	 * XXX we don't know how to set the f/w for supporting
1626 	 * IFF_ALLMULTI | IFF_PROMISC cases
1627 	 */
1628 	return;
1629 }
1630 
1631 static int
1632 malo_mode_init(struct malo_softc *sc)
1633 {
1634 	struct ifnet *ifp = sc->malo_ifp;
1635 	struct ieee80211com *ic = ifp->if_l2com;
1636 	struct malo_hal *mh = sc->malo_mh;
1637 
1638 	/*
1639 	 * Handle any link-level address change.  Note that we only
1640 	 * need to force ic_myaddr; any other addresses are handled
1641 	 * as a byproduct of the ifnet code marking the interface
1642 	 * down then up.
1643 	 */
1644 	IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
1645 
1646 	/*
1647 	 * NB: Ignore promisc in hostap mode; it's set by the
1648 	 * bridge.  This is wrong but we have no way to
1649 	 * identify internal requests (from the bridge)
1650 	 * versus external requests such as for tcpdump.
1651 	 */
1652 	malo_hal_setpromisc(mh, (ifp->if_flags & IFF_PROMISC) &&
1653 	    ic->ic_opmode != IEEE80211_M_HOSTAP);
1654 	malo_setmcastfilter(sc);
1655 
1656 	return ENXIO;
1657 }
1658 
1659 static void
1660 malo_tx_draintxq(struct malo_softc *sc, struct malo_txq *txq)
1661 {
1662 	struct ieee80211_node *ni;
1663 	struct malo_txbuf *bf;
1664 	u_int ix;
1665 
1666 	/*
1667 	 * NB: this assumes output has been stopped and
1668 	 *     we do not need to block malo_tx_tasklet
1669 	 */
1670 	for (ix = 0;; ix++) {
1671 		MALO_TXQ_LOCK(txq);
1672 		bf = STAILQ_FIRST(&txq->active);
1673 		if (bf == NULL) {
1674 			MALO_TXQ_UNLOCK(txq);
1675 			break;
1676 		}
1677 		STAILQ_REMOVE_HEAD(&txq->active, bf_list);
1678 		MALO_TXQ_UNLOCK(txq);
1679 #ifdef MALO_DEBUG
1680 		if (sc->malo_debug & MALO_DEBUG_RESET) {
1681 			struct ifnet *ifp = sc->malo_ifp;
1682 			struct ieee80211com *ic = ifp->if_l2com;
1683 			const struct malo_txrec *tr =
1684 			    mtod(bf->bf_m, const struct malo_txrec *);
1685 			malo_printtxbuf(bf, txq->qnum, ix);
1686 			ieee80211_dump_pkt(ic, (const uint8_t *)&tr->wh,
1687 			    bf->bf_m->m_len - sizeof(tr->fwlen), 0, -1);
1688 		}
1689 #endif /* MALO_DEBUG */
1690 		bus_dmamap_unload(sc->malo_dmat, bf->bf_dmamap);
1691 		ni = bf->bf_node;
1692 		bf->bf_node = NULL;
1693 		if (ni != NULL) {
1694 			/*
1695 			 * Reclaim node reference.
1696 			 */
1697 			ieee80211_free_node(ni);
1698 		}
1699 		m_freem(bf->bf_m);
1700 		bf->bf_m = NULL;
1701 
1702 		MALO_TXQ_LOCK(txq);
1703 		STAILQ_INSERT_TAIL(&txq->free, bf, bf_list);
1704 		txq->nfree++;
1705 		MALO_TXQ_UNLOCK(txq);
1706 	}
1707 }
1708 
1709 static void
1710 malo_stop_locked(struct ifnet *ifp, int disable)
1711 {
1712 	struct malo_softc *sc = ifp->if_softc;
1713 	struct malo_hal *mh = sc->malo_mh;
1714 	int i;
1715 
1716 	DPRINTF(sc, MALO_DEBUG_ANY, "%s: invalid %u if_flags 0x%x\n",
1717 	    __func__, sc->malo_invalid, ifp->if_flags);
1718 
1719 	MALO_LOCK_ASSERT(sc);
1720 
1721 	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING))
1722 		return;
1723 
1724 	/*
1725 	 * Shutdown the hardware and driver:
1726 	 *    disable interrupts
1727 	 *    turn off the radio
1728 	 *    drain and release tx queues
1729 	 *
1730 	 * Note that some of this work is not possible if the hardware
1731 	 * is gone (invalid).
1732 	 */
1733 	ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
1734 	ifp->if_timer = 0;
1735 	/* diable interrupt.  */
1736 	malo_hal_intrset(mh, 0);
1737 	/* turn off the radio.  */
1738 	malo_hal_setradio(mh, 0, MHP_AUTO_PREAMBLE);
1739 
1740 	/* drain and release tx queues.  */
1741 	for (i = 0; i < MALO_NUM_TX_QUEUES; i++)
1742 		malo_tx_draintxq(sc, &sc->malo_txq[i]);
1743 }
1744 
1745 static int
1746 malo_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1747 {
1748 #define	MALO_IS_RUNNING(ifp) \
1749 	((ifp->if_flags & IFF_UP) && (ifp->if_drv_flags & IFF_DRV_RUNNING))
1750 	struct malo_softc *sc = ifp->if_softc;
1751 	struct ieee80211com *ic = ifp->if_l2com;
1752 	struct ifreq *ifr = (struct ifreq *) data;
1753 	int error = 0, startall = 0;
1754 
1755 	MALO_LOCK(sc);
1756 	switch (cmd) {
1757 	case SIOCSIFFLAGS:
1758 		if (MALO_IS_RUNNING(ifp)) {
1759 			/*
1760 			 * To avoid rescanning another access point,
1761 			 * do not call malo_init() here.  Instead,
1762 			 * only reflect promisc mode settings.
1763 			 */
1764 			malo_mode_init(sc);
1765 		} else if (ifp->if_flags & IFF_UP) {
1766 			/*
1767 			 * Beware of being called during attach/detach
1768 			 * to reset promiscuous mode.  In that case we
1769 			 * will still be marked UP but not RUNNING.
1770 			 * However trying to re-init the interface
1771 			 * is the wrong thing to do as we've already
1772 			 * torn down much of our state.  There's
1773 			 * probably a better way to deal with this.
1774 			 */
1775 			if (!sc->malo_invalid) {
1776 				malo_init_locked(sc);
1777 				startall = 1;
1778 			}
1779 		} else
1780 			malo_stop_locked(ifp, 1);
1781 		break;
1782 	case SIOCGIFMEDIA:
1783 	case SIOCSIFMEDIA:
1784 		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
1785 		break;
1786 	default:
1787 		error = ether_ioctl(ifp, cmd, data);
1788 		break;
1789 	}
1790 	MALO_UNLOCK(sc);
1791 
1792 	if (startall)
1793 		ieee80211_start_all(ic);
1794 	return error;
1795 #undef MALO_IS_RUNNING
1796 }
1797 
1798 /*
1799  * Callback from the 802.11 layer to update the slot time
1800  * based on the current setting.  We use it to notify the
1801  * firmware of ERP changes and the f/w takes care of things
1802  * like slot time and preamble.
1803  */
1804 static void
1805 malo_updateslot(struct ifnet *ifp)
1806 {
1807 	struct malo_softc *sc = ifp->if_softc;
1808 	struct ieee80211com *ic = ifp->if_l2com;
1809 	struct malo_hal *mh = sc->malo_mh;
1810 	int error;
1811 
1812 	/* NB: can be called early; suppress needless cmds */
1813 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1814 		return;
1815 
1816 	DPRINTF(sc, MALO_DEBUG_RESET,
1817 	    "%s: chan %u MHz/flags 0x%x %s slot, (ic_flags 0x%x)\n",
1818 	    __func__, ic->ic_curchan->ic_freq, ic->ic_curchan->ic_flags,
1819 	    ic->ic_flags & IEEE80211_F_SHSLOT ? "short" : "long", ic->ic_flags);
1820 
1821 	if (ic->ic_flags & IEEE80211_F_SHSLOT)
1822 		error = malo_hal_set_slot(mh, 1);
1823 	else
1824 		error = malo_hal_set_slot(mh, 0);
1825 
1826 	if (error != 0)
1827 		device_printf(sc->malo_dev, "setting %s slot failed\n",
1828 			ic->ic_flags & IEEE80211_F_SHSLOT ? "short" : "long");
1829 }
1830 
1831 static int
1832 malo_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1833 {
1834 	struct ieee80211com *ic = vap->iv_ic;
1835 	struct malo_softc *sc = ic->ic_ifp->if_softc;
1836 	struct malo_hal *mh = sc->malo_mh;
1837 	int error;
1838 
1839 	DPRINTF(sc, MALO_DEBUG_STATE, "%s: %s -> %s\n", __func__,
1840 	    ieee80211_state_name[vap->iv_state],
1841 	    ieee80211_state_name[nstate]);
1842 
1843 	/*
1844 	 * Invoke the net80211 layer first so iv_bss is setup.
1845 	 */
1846 	error = MALO_VAP(vap)->malo_newstate(vap, nstate, arg);
1847 	if (error != 0)
1848 		return error;
1849 
1850 	if (nstate == IEEE80211_S_RUN && vap->iv_state != IEEE80211_S_RUN) {
1851 		struct ieee80211_node *ni = vap->iv_bss;
1852 		enum ieee80211_phymode mode = ieee80211_chan2mode(ni->ni_chan);
1853 		const struct ieee80211_txparam *tp = &vap->iv_txparms[mode];
1854 
1855 		DPRINTF(sc, MALO_DEBUG_STATE,
1856 		    "%s: %s(RUN): iv_flags 0x%08x bintvl %d bssid %s "
1857 		    "capinfo 0x%04x chan %d associd 0x%x mode %d rate %d\n",
1858 		    vap->iv_ifp->if_xname, __func__, vap->iv_flags,
1859 		    ni->ni_intval, ether_sprintf(ni->ni_bssid), ni->ni_capinfo,
1860 		    ieee80211_chan2ieee(ic, ic->ic_curchan),
1861 		    ni->ni_associd, mode, tp->ucastrate);
1862 
1863 		malo_hal_setradio(mh, 1,
1864 		    (ic->ic_flags & IEEE80211_F_SHPREAMBLE) ?
1865 			MHP_SHORT_PREAMBLE : MHP_LONG_PREAMBLE);
1866 		malo_hal_setassocid(sc->malo_mh, ni->ni_bssid, ni->ni_associd);
1867 		malo_hal_set_rate(mh, mode,
1868 		   tp->ucastrate == IEEE80211_FIXED_RATE_NONE ?
1869 		       0 : malo_fix2rate(tp->ucastrate));
1870 	}
1871 	return 0;
1872 }
1873 
1874 static int
1875 malo_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1876 	const struct ieee80211_bpf_params *params)
1877 {
1878 	struct ieee80211com *ic = ni->ni_ic;
1879 	struct ifnet *ifp = ic->ic_ifp;
1880 	struct malo_softc *sc = ifp->if_softc;
1881 	struct malo_txbuf *bf;
1882 	struct malo_txq *txq;
1883 
1884 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0 || sc->malo_invalid) {
1885 		ieee80211_free_node(ni);
1886 		m_freem(m);
1887 		return ENETDOWN;
1888 	}
1889 
1890 	/*
1891 	 * Grab a TX buffer and associated resources.  Note that we depend
1892 	 * on the classification by the 802.11 layer to get to the right h/w
1893 	 * queue.  Management frames must ALWAYS go on queue 1 but we
1894 	 * cannot just force that here because we may receive non-mgt frames.
1895 	 */
1896 	txq = &sc->malo_txq[0];
1897 	bf = malo_getbuf(sc, txq);
1898 	if (bf == NULL) {
1899 		/* XXX blocks other traffic */
1900 		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1901 		ieee80211_free_node(ni);
1902 		m_freem(m);
1903 		return ENOBUFS;
1904 	}
1905 
1906 	/*
1907 	 * Pass the frame to the h/w for transmission.
1908 	 */
1909 	if (malo_tx_start(sc, ni, bf, m) != 0) {
1910 		ifp->if_oerrors++;
1911 		bf->bf_m = NULL;
1912 		bf->bf_node = NULL;
1913 		MALO_TXQ_LOCK(txq);
1914 		STAILQ_INSERT_HEAD(&txq->free, bf, bf_list);
1915 		txq->nfree++;
1916 		MALO_TXQ_UNLOCK(txq);
1917 
1918 		ieee80211_free_node(ni);
1919 		return EIO;		/* XXX */
1920 	}
1921 
1922 	/*
1923 	 * NB: We don't need to lock against tx done because this just
1924 	 * prods the firmware to check the transmit descriptors.  The firmware
1925 	 * will also start fetching descriptors by itself if it notices
1926 	 * new ones are present when it goes to deliver a tx done interrupt
1927 	 * to the host. So if we race with tx done processing it's ok.
1928 	 * Delivering the kick here rather than in malo_tx_start is
1929 	 * an optimization to avoid poking the firmware for each packet.
1930 	 *
1931 	 * NB: the queue id isn't used so 0 is ok.
1932 	 */
1933 	malo_hal_txstart(sc->malo_mh, 0/*XXX*/);
1934 
1935 	return 0;
1936 }
1937 
1938 static void
1939 malo_bpfattach(struct malo_softc *sc)
1940 {
1941 	struct ifnet *ifp = sc->malo_ifp;
1942 
1943 	bpfattach(ifp, DLT_IEEE802_11_RADIO,
1944 	    sizeof(struct ieee80211_frame) + sizeof(sc->malo_tx_th));
1945 
1946 	/*
1947 	 * Initialize constant fields.
1948 	 * XXX make header lengths a multiple of 32-bits so subsequent
1949 	 *     headers are properly aligned; this is a kludge to keep
1950 	 *     certain applications happy.
1951 	 *
1952 	 * NB: the channel is setup each time we transition to the
1953 	 *     RUN state to avoid filling it in for each frame.
1954 	 */
1955 	sc->malo_tx_th_len = roundup(sizeof(sc->malo_tx_th), sizeof(uint32_t));
1956 	sc->malo_tx_th.wt_ihdr.it_len = htole16(sc->malo_tx_th_len);
1957 	sc->malo_tx_th.wt_ihdr.it_present = htole32(MALO_TX_RADIOTAP_PRESENT);
1958 
1959 	sc->malo_rx_th_len = roundup(sizeof(sc->malo_rx_th), sizeof(uint32_t));
1960 	sc->malo_rx_th.wr_ihdr.it_len = htole16(sc->malo_rx_th_len);
1961 	sc->malo_rx_th.wr_ihdr.it_present = htole32(MALO_RX_RADIOTAP_PRESENT);
1962 }
1963 
1964 static void
1965 malo_sysctlattach(struct malo_softc *sc)
1966 {
1967 #ifdef	MALO_DEBUG
1968 	struct sysctl_ctx_list *ctx = device_get_sysctl_ctx(sc->malo_dev);
1969 	struct sysctl_oid *tree = device_get_sysctl_tree(sc->malo_dev);
1970 
1971 	sc->malo_debug = malo_debug;
1972 	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
1973 		"debug", CTLFLAG_RW, &sc->malo_debug, 0,
1974 		"control debugging printfs");
1975 #endif
1976 }
1977 
1978 static void
1979 malo_announce(struct malo_softc *sc)
1980 {
1981 	struct ifnet *ifp = sc->malo_ifp;
1982 
1983 	if_printf(ifp, "versions [hw %d fw %d.%d.%d.%d] (regioncode %d)\n",
1984 		sc->malo_hwspecs.hwversion,
1985 		(sc->malo_hwspecs.fw_releasenum >> 24) & 0xff,
1986 		(sc->malo_hwspecs.fw_releasenum >> 16) & 0xff,
1987 		(sc->malo_hwspecs.fw_releasenum >> 8) & 0xff,
1988 		(sc->malo_hwspecs.fw_releasenum >> 0) & 0xff,
1989 		sc->malo_hwspecs.regioncode);
1990 
1991 	if (bootverbose || malo_rxbuf != MALO_RXBUF)
1992 		if_printf(ifp, "using %u rx buffers\n", malo_rxbuf);
1993 	if (bootverbose || malo_txbuf != MALO_TXBUF)
1994 		if_printf(ifp, "using %u tx buffers\n", malo_txbuf);
1995 }
1996 
1997 /*
1998  * Convert net80211 channel to a HAL channel.
1999  */
2000 static void
2001 malo_mapchan(struct malo_hal_channel *hc, const struct ieee80211_channel *chan)
2002 {
2003 	hc->channel = chan->ic_ieee;
2004 
2005 	*(uint32_t *)&hc->flags = 0;
2006 	if (IEEE80211_IS_CHAN_2GHZ(chan))
2007 		hc->flags.freqband = MALO_FREQ_BAND_2DOT4GHZ;
2008 }
2009 
2010 /*
2011  * Set/change channels.  If the channel is really being changed,
2012  * it's done by reseting the chip.  To accomplish this we must
2013  * first cleanup any pending DMA, then restart stuff after a la
2014  * malo_init.
2015  */
2016 static int
2017 malo_chan_set(struct malo_softc *sc, struct ieee80211_channel *chan)
2018 {
2019 	struct malo_hal *mh = sc->malo_mh;
2020 	struct malo_hal_channel hchan;
2021 
2022 	DPRINTF(sc, MALO_DEBUG_RESET, "%s: chan %u MHz/flags 0x%x\n",
2023 	    __func__, chan->ic_freq, chan->ic_flags);
2024 
2025 	/*
2026 	 * Convert to a HAL channel description with the flags constrained
2027 	 * to reflect the current operating mode.
2028 	 */
2029 	malo_mapchan(&hchan, chan);
2030 	malo_hal_intrset(mh, 0);		/* disable interrupts */
2031 	malo_hal_setchannel(mh, &hchan);
2032 	malo_hal_settxpower(mh, &hchan);
2033 
2034 	/*
2035 	 * Update internal state.
2036 	 */
2037 	sc->malo_tx_th.wt_chan_freq = htole16(chan->ic_freq);
2038 	sc->malo_rx_th.wr_chan_freq = htole16(chan->ic_freq);
2039 	if (IEEE80211_IS_CHAN_ANYG(chan)) {
2040 		sc->malo_tx_th.wt_chan_flags = htole16(IEEE80211_CHAN_G);
2041 		sc->malo_rx_th.wr_chan_flags = htole16(IEEE80211_CHAN_G);
2042 	} else {
2043 		sc->malo_tx_th.wt_chan_flags = htole16(IEEE80211_CHAN_B);
2044 		sc->malo_rx_th.wr_chan_flags = htole16(IEEE80211_CHAN_B);
2045 	}
2046 	sc->malo_curchan = hchan;
2047 	malo_hal_intrset(mh, sc->malo_imask);
2048 
2049 	return 0;
2050 }
2051 
2052 static void
2053 malo_scan_start(struct ieee80211com *ic)
2054 {
2055 	struct ifnet *ifp = ic->ic_ifp;
2056 	struct malo_softc *sc = ifp->if_softc;
2057 
2058 	DPRINTF(sc, MALO_DEBUG_STATE, "%s\n", __func__);
2059 }
2060 
2061 static void
2062 malo_scan_end(struct ieee80211com *ic)
2063 {
2064 	struct ifnet *ifp = ic->ic_ifp;
2065 	struct malo_softc *sc = ifp->if_softc;
2066 
2067 	DPRINTF(sc, MALO_DEBUG_STATE, "%s\n", __func__);
2068 }
2069 
2070 static void
2071 malo_set_channel(struct ieee80211com *ic)
2072 {
2073 	struct ifnet *ifp = ic->ic_ifp;
2074 	struct malo_softc *sc = ifp->if_softc;
2075 
2076 	(void) malo_chan_set(sc, ic->ic_curchan);
2077 }
2078 
2079 static void
2080 malo_rx_proc(void *arg, int npending)
2081 {
2082 #define	IEEE80211_DIR_DSTODS(wh)					\
2083 	((((const struct ieee80211_frame *)wh)->i_fc[1] &		\
2084 	    IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS)
2085 	struct malo_softc *sc = arg;
2086 	struct ifnet *ifp = sc->malo_ifp;
2087 	struct ieee80211com *ic = ifp->if_l2com;
2088 	struct malo_rxbuf *bf;
2089 	struct malo_rxdesc *ds;
2090 	struct mbuf *m, *mnew;
2091 	struct ieee80211_qosframe *wh;
2092 	struct ieee80211_qosframe_addr4 *wh4;
2093 	struct ieee80211_node *ni;
2094 	int off, len, hdrlen, pktlen, rssi, ntodo;
2095 	uint8_t *data, status;
2096 	uint32_t readptr, writeptr;
2097 
2098 	DPRINTF(sc, MALO_DEBUG_RX_PROC,
2099 	    "%s: pending %u rdptr(0x%x) 0x%x wrptr(0x%x) 0x%x\n",
2100 	    __func__, npending,
2101 	    sc->malo_hwspecs.rxdesc_read,
2102 	    malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_read),
2103 	    sc->malo_hwspecs.rxdesc_write,
2104 	    malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_write));
2105 
2106 	readptr = malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_read);
2107 	writeptr = malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_write);
2108 	if (readptr == writeptr)
2109 		return;
2110 
2111 	bf = sc->malo_rxnext;
2112 	for (ntodo = malo_rxquota; ntodo > 0 && readptr != writeptr; ntodo--) {
2113 		if (bf == NULL) {
2114 			bf = STAILQ_FIRST(&sc->malo_rxbuf);
2115 			break;
2116 		}
2117 		ds = bf->bf_desc;
2118 		if (bf->bf_m == NULL) {
2119 			/*
2120 			 * If data allocation failed previously there
2121 			 * will be no buffer; try again to re-populate it.
2122 			 * Note the firmware will not advance to the next
2123 			 * descriptor with a dma buffer so we must mimic
2124 			 * this or we'll get out of sync.
2125 			 */
2126 			DPRINTF(sc, MALO_DEBUG_ANY,
2127 			    "%s: rx buf w/o dma memory\n", __func__);
2128 			(void)malo_rxbuf_init(sc, bf);
2129 			break;
2130 		}
2131 		MALO_RXDESC_SYNC(sc, ds,
2132 		    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
2133 		if (ds->rxcontrol != MALO_RXD_CTRL_DMA_OWN)
2134 			break;
2135 
2136 		readptr = le32toh(ds->physnext);
2137 
2138 #ifdef MALO_DEBUG
2139 		if (sc->malo_debug & MALO_DEBUG_RECV_DESC)
2140 			malo_printrxbuf(bf, 0);
2141 #endif
2142 		status = ds->status;
2143 		if (status & MALO_RXD_STATUS_DECRYPT_ERR_MASK) {
2144 			ifp->if_ierrors++;
2145 			goto rx_next;
2146 		}
2147 		/*
2148 		 * Sync the data buffer.
2149 		 */
2150 		len = le16toh(ds->pktlen);
2151 		bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap,
2152 		    BUS_DMASYNC_POSTREAD);
2153 		/*
2154 		 * The 802.11 header is provided all or in part at the front;
2155 		 * use it to calculate the true size of the header that we'll
2156 		 * construct below.  We use this to figure out where to copy
2157 		 * payload prior to constructing the header.
2158 		 */
2159 		m = bf->bf_m;
2160 		data = mtod(m, uint8_t *);;
2161 		hdrlen = ieee80211_anyhdrsize(data + sizeof(uint16_t));
2162 		off = sizeof(uint16_t) + sizeof(struct ieee80211_frame_addr4);
2163 
2164 		/*
2165 		 * Calculate RSSI. XXX wrong
2166 		 */
2167 		rssi = 2 * ((int) ds->snr - ds->nf);	/* NB: .5 dBm  */
2168 		if (rssi > 100)
2169 			rssi = 100;
2170 
2171 		pktlen = hdrlen + (len - off);
2172 		/*
2173 		 * NB: we know our frame is at least as large as
2174 		 * IEEE80211_MIN_LEN because there is a 4-address frame at
2175 		 * the front.  Hence there's no need to vet the packet length.
2176 		 * If the frame in fact is too small it should be discarded
2177 		 * at the net80211 layer.
2178 		 */
2179 
2180 		/* XXX don't need mbuf, just dma buffer */
2181 		mnew = malo_getrxmbuf(sc, bf);
2182 		if (mnew == NULL) {
2183 			ifp->if_ierrors++;
2184 			goto rx_next;
2185 		}
2186 		/*
2187 		 * Attach the dma buffer to the mbuf; malo_rxbuf_init will
2188 		 * re-setup the rx descriptor using the replacement dma
2189 		 * buffer we just installed above.
2190 		 */
2191 		bf->bf_m = mnew;
2192 		m->m_data += off - hdrlen;
2193 		m->m_pkthdr.len = m->m_len = pktlen;
2194 		m->m_pkthdr.rcvif = ifp;
2195 
2196 		/*
2197 		 * Piece 802.11 header together.
2198 		 */
2199 		wh = mtod(m, struct ieee80211_qosframe *);
2200 		/* NB: don't need to do this sometimes but ... */
2201 		/* XXX special case so we can memcpy after m_devget? */
2202 		ovbcopy(data + sizeof(uint16_t), wh, hdrlen);
2203 		if (IEEE80211_QOS_HAS_SEQ(wh)) {
2204 			if (IEEE80211_DIR_DSTODS(wh)) {
2205 				wh4 = mtod(m,
2206 				    struct ieee80211_qosframe_addr4*);
2207 				*(uint16_t *)wh4->i_qos = ds->qosctrl;
2208 			} else {
2209 				*(uint16_t *)wh->i_qos = ds->qosctrl;
2210 			}
2211 		}
2212 		if (sc->malo_drvbpf != NULL) {
2213 			sc->malo_rx_th.wr_flags = 0;
2214 			sc->malo_rx_th.wr_rate = ds->rate;
2215 			sc->malo_rx_th.wr_antsignal = rssi;
2216 			sc->malo_rx_th.wr_antnoise = ds->nf;
2217 
2218 			bpf_mtap2(ifp->if_bpf, &sc->malo_rx_th,
2219 			    sc->malo_rx_th_len, m);
2220 		}
2221 #ifdef MALO_DEBUG
2222 		if (IFF_DUMPPKTS_RECV(sc, wh)) {
2223 			ieee80211_dump_pkt(ic, mtod(m, caddr_t),
2224 			    len, ds->rate, rssi);
2225 		}
2226 #endif
2227 		ifp->if_ipackets++;
2228 
2229 		/* dispatch */
2230 		ni = ieee80211_find_rxnode(ic,
2231 		    (struct ieee80211_frame_min *)wh);
2232 		if (ni != NULL) {
2233 			(void) ieee80211_input(ni, m, rssi, ds->nf, 0);
2234 			ieee80211_free_node(ni);
2235 		} else
2236 			(void) ieee80211_input_all(ic, m, rssi, ds->nf, 0);
2237 rx_next:
2238 		/* NB: ignore ENOMEM so we process more descriptors */
2239 		(void) malo_rxbuf_init(sc, bf);
2240 		bf = STAILQ_NEXT(bf, bf_list);
2241 	}
2242 
2243 	malo_bar0_write4(sc, sc->malo_hwspecs.rxdesc_read, readptr);
2244 	sc->malo_rxnext = bf;
2245 
2246 	if ((ifp->if_drv_flags & IFF_DRV_OACTIVE) == 0 &&
2247 	    !IFQ_IS_EMPTY(&ifp->if_snd))
2248 		malo_start(ifp);
2249 #undef IEEE80211_DIR_DSTODS
2250 }
2251 
2252 static void
2253 malo_stop(struct ifnet *ifp, int disable)
2254 {
2255 	struct malo_softc *sc = ifp->if_softc;
2256 
2257 	MALO_LOCK(sc);
2258 	malo_stop_locked(ifp, disable);
2259 	MALO_UNLOCK(sc);
2260 }
2261 
2262 /*
2263  * Reclaim all tx queue resources.
2264  */
2265 static void
2266 malo_tx_cleanup(struct malo_softc *sc)
2267 {
2268 	int i;
2269 
2270 	for (i = 0; i < MALO_NUM_TX_QUEUES; i++)
2271 		malo_tx_cleanupq(sc, &sc->malo_txq[i]);
2272 }
2273 
2274 int
2275 malo_detach(struct malo_softc *sc)
2276 {
2277 	struct ifnet *ifp = sc->malo_ifp;
2278 	struct ieee80211com *ic = ifp->if_l2com;
2279 
2280 	DPRINTF(sc, MALO_DEBUG_ANY, "%s: if_flags %x\n",
2281 		__func__, ifp->if_flags);
2282 
2283 	malo_stop(ifp, 1);
2284 
2285 	if (sc->malo_tq != NULL) {
2286 		taskqueue_drain(sc->malo_tq, &sc->malo_rxtask);
2287 		taskqueue_drain(sc->malo_tq, &sc->malo_txtask);
2288 		taskqueue_free(sc->malo_tq);
2289 		sc->malo_tq = NULL;
2290 	}
2291 
2292 	bpfdetach(ifp);
2293 
2294 	/*
2295 	 * NB: the order of these is important:
2296 	 * o call the 802.11 layer before detaching the hal to
2297 	 *   insure callbacks into the driver to delete global
2298 	 *   key cache entries can be handled
2299 	 * o reclaim the tx queue data structures after calling
2300 	 *   the 802.11 layer as we'll get called back to reclaim
2301 	 *   node state and potentially want to use them
2302 	 * o to cleanup the tx queues the hal is called, so detach
2303 	 *   it last
2304 	 * Other than that, it's straightforward...
2305 	 */
2306 	ieee80211_ifdetach(ic);
2307 	malo_dma_cleanup(sc);
2308 	malo_tx_cleanup(sc);
2309 	malo_hal_detach(sc->malo_mh);
2310 	if_free(ifp);
2311 
2312 	MALO_LOCK_DESTROY(sc);
2313 
2314 	return 0;
2315 }
2316 
2317 void
2318 malo_shutdown(struct malo_softc *sc)
2319 {
2320 	malo_stop(sc->malo_ifp, 1);
2321 }
2322 
2323 void
2324 malo_suspend(struct malo_softc *sc)
2325 {
2326 	struct ifnet *ifp = sc->malo_ifp;
2327 
2328 	DPRINTF(sc, MALO_DEBUG_ANY, "%s: if_flags %x\n",
2329 		__func__, ifp->if_flags);
2330 
2331 	malo_stop(ifp, 1);
2332 }
2333 
2334 void
2335 malo_resume(struct malo_softc *sc)
2336 {
2337 	struct ifnet *ifp = sc->malo_ifp;
2338 
2339 	DPRINTF(sc, MALO_DEBUG_ANY, "%s: if_flags %x\n",
2340 		__func__, ifp->if_flags);
2341 
2342 	if (ifp->if_flags & IFF_UP)
2343 		malo_init(sc);
2344 }
2345