xref: /freebsd/sys/dev/malo/if_malo.c (revision 9fc5c47fa5c7fa58d61245f0408611943e613164)
1 /*-
2  * Copyright (c) 2008 Weongyo Jeong <weongyo@freebsd.org>
3  * Copyright (c) 2007 Marvell Semiconductor, Inc.
4  * Copyright (c) 2007 Sam Leffler, Errno Consulting
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer,
12  *    without modification.
13  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
14  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
15  *    redistribution must be conditioned upon including a substantially
16  *    similar Disclaimer requirement for further binary redistribution.
17  *
18  * NO WARRANTY
19  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
22  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
23  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
24  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
27  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
29  * THE POSSIBILITY OF SUCH DAMAGES.
30  */
31 
32 #include <sys/cdefs.h>
33 #ifdef __FreeBSD__
34 __FBSDID("$FreeBSD$");
35 #endif
36 
37 #include "opt_malo.h"
38 
39 #include <sys/param.h>
40 #include <sys/endian.h>
41 #include <sys/kernel.h>
42 #include <sys/socket.h>
43 #include <sys/sockio.h>
44 #include <sys/sysctl.h>
45 #include <sys/taskqueue.h>
46 
47 #include <machine/bus.h>
48 #include <sys/bus.h>
49 
50 #include <net/if.h>
51 #include <net/if_var.h>
52 #include <net/if_dl.h>
53 #include <net/if_media.h>
54 #include <net/if_types.h>
55 #include <net/ethernet.h>
56 
57 #include <net80211/ieee80211_var.h>
58 #include <net80211/ieee80211_regdomain.h>
59 
60 #include <net/bpf.h>
61 
62 #include <dev/malo/if_malo.h>
63 
64 SYSCTL_NODE(_hw, OID_AUTO, malo, CTLFLAG_RD, 0,
65     "Marvell 88w8335 driver parameters");
66 
67 static	int malo_txcoalesce = 8;	/* # tx pkts to q before poking f/w*/
68 SYSCTL_INT(_hw_malo, OID_AUTO, txcoalesce, CTLFLAG_RWTUN, &malo_txcoalesce,
69 	    0, "tx buffers to send at once");
70 static	int malo_rxbuf = MALO_RXBUF;		/* # rx buffers to allocate */
71 SYSCTL_INT(_hw_malo, OID_AUTO, rxbuf, CTLFLAG_RWTUN, &malo_rxbuf,
72 	    0, "rx buffers allocated");
73 static	int malo_rxquota = MALO_RXBUF;		/* # max buffers to process */
74 SYSCTL_INT(_hw_malo, OID_AUTO, rxquota, CTLFLAG_RWTUN, &malo_rxquota,
75 	    0, "max rx buffers to process per interrupt");
76 static	int malo_txbuf = MALO_TXBUF;		/* # tx buffers to allocate */
77 SYSCTL_INT(_hw_malo, OID_AUTO, txbuf, CTLFLAG_RWTUN, &malo_txbuf,
78 	    0, "tx buffers allocated");
79 
80 #ifdef MALO_DEBUG
81 static	int malo_debug = 0;
82 SYSCTL_INT(_hw_malo, OID_AUTO, debug, CTLFLAG_RWTUN, &malo_debug,
83 	    0, "control debugging printfs");
84 enum {
85 	MALO_DEBUG_XMIT		= 0x00000001,	/* basic xmit operation */
86 	MALO_DEBUG_XMIT_DESC	= 0x00000002,	/* xmit descriptors */
87 	MALO_DEBUG_RECV		= 0x00000004,	/* basic recv operation */
88 	MALO_DEBUG_RECV_DESC	= 0x00000008,	/* recv descriptors */
89 	MALO_DEBUG_RESET	= 0x00000010,	/* reset processing */
90 	MALO_DEBUG_INTR		= 0x00000040,	/* ISR */
91 	MALO_DEBUG_TX_PROC	= 0x00000080,	/* tx ISR proc */
92 	MALO_DEBUG_RX_PROC	= 0x00000100,	/* rx ISR proc */
93 	MALO_DEBUG_STATE	= 0x00000400,	/* 802.11 state transitions */
94 	MALO_DEBUG_NODE		= 0x00000800,	/* node management */
95 	MALO_DEBUG_RECV_ALL	= 0x00001000,	/* trace all frames (beacons) */
96 	MALO_DEBUG_FW		= 0x00008000,	/* firmware */
97 	MALO_DEBUG_ANY		= 0xffffffff
98 };
99 #define	IS_BEACON(wh)							\
100 	((wh->i_fc[0] & (IEEE80211_FC0_TYPE_MASK |			\
101 		IEEE80211_FC0_SUBTYPE_MASK)) ==				\
102 	 (IEEE80211_FC0_TYPE_MGT|IEEE80211_FC0_SUBTYPE_BEACON))
103 #define	IFF_DUMPPKTS_RECV(sc, wh)					\
104 	(((sc->malo_debug & MALO_DEBUG_RECV) &&				\
105 	  ((sc->malo_debug & MALO_DEBUG_RECV_ALL) || !IS_BEACON(wh))))
106 #define	IFF_DUMPPKTS_XMIT(sc)						\
107 	(sc->malo_debug & MALO_DEBUG_XMIT)
108 #define	DPRINTF(sc, m, fmt, ...) do {				\
109 	if (sc->malo_debug & (m))				\
110 		printf(fmt, __VA_ARGS__);			\
111 } while (0)
112 #else
113 #define	DPRINTF(sc, m, fmt, ...) do {				\
114 	(void) sc;						\
115 } while (0)
116 #endif
117 
118 static MALLOC_DEFINE(M_MALODEV, "malodev", "malo driver dma buffers");
119 
120 static struct ieee80211vap *malo_vap_create(struct ieee80211com *,
121 		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
122 		    const uint8_t [IEEE80211_ADDR_LEN],
123 		    const uint8_t [IEEE80211_ADDR_LEN]);
124 static  void	malo_vap_delete(struct ieee80211vap *);
125 static	int	malo_dma_setup(struct malo_softc *);
126 static	int	malo_setup_hwdma(struct malo_softc *);
127 static	void	malo_txq_init(struct malo_softc *, struct malo_txq *, int);
128 static	void	malo_tx_cleanupq(struct malo_softc *, struct malo_txq *);
129 static	void	malo_parent(struct ieee80211com *);
130 static	int	malo_transmit(struct ieee80211com *, struct mbuf *);
131 static	void	malo_start(struct malo_softc *);
132 static	void	malo_watchdog(void *);
133 static	void	malo_updateslot(struct ieee80211com *);
134 static	int	malo_newstate(struct ieee80211vap *, enum ieee80211_state, int);
135 static	void	malo_scan_start(struct ieee80211com *);
136 static	void	malo_scan_end(struct ieee80211com *);
137 static	void	malo_set_channel(struct ieee80211com *);
138 static	int	malo_raw_xmit(struct ieee80211_node *, struct mbuf *,
139 		    const struct ieee80211_bpf_params *);
140 static	void	malo_sysctlattach(struct malo_softc *);
141 static	void	malo_announce(struct malo_softc *);
142 static	void	malo_dma_cleanup(struct malo_softc *);
143 static	void	malo_stop(struct malo_softc *);
144 static	int	malo_chan_set(struct malo_softc *, struct ieee80211_channel *);
145 static	int	malo_mode_init(struct malo_softc *);
146 static	void	malo_tx_proc(void *, int);
147 static	void	malo_rx_proc(void *, int);
148 static	void	malo_init(void *);
149 
150 /*
151  * Read/Write shorthands for accesses to BAR 0.  Note that all BAR 1
152  * operations are done in the "hal" except getting H/W MAC address at
153  * malo_attach and there should be no reference to them here.
154  */
155 static uint32_t
156 malo_bar0_read4(struct malo_softc *sc, bus_size_t off)
157 {
158 	return bus_space_read_4(sc->malo_io0t, sc->malo_io0h, off);
159 }
160 
161 static void
162 malo_bar0_write4(struct malo_softc *sc, bus_size_t off, uint32_t val)
163 {
164 	DPRINTF(sc, MALO_DEBUG_FW, "%s: off 0x%jx val 0x%x\n",
165 	    __func__, (uintmax_t)off, val);
166 
167 	bus_space_write_4(sc->malo_io0t, sc->malo_io0h, off, val);
168 }
169 
170 int
171 malo_attach(uint16_t devid, struct malo_softc *sc)
172 {
173 	struct ieee80211com *ic = &sc->malo_ic;
174 	struct malo_hal *mh;
175 	int error;
176 	uint8_t bands;
177 
178 	MALO_LOCK_INIT(sc);
179 	callout_init_mtx(&sc->malo_watchdog_timer, &sc->malo_mtx, 0);
180 	mbufq_init(&sc->malo_snd, ifqmaxlen);
181 
182 	mh = malo_hal_attach(sc->malo_dev, devid,
183 	    sc->malo_io1h, sc->malo_io1t, sc->malo_dmat);
184 	if (mh == NULL) {
185 		device_printf(sc->malo_dev, "unable to attach HAL\n");
186 		error = EIO;
187 		goto bad;
188 	}
189 	sc->malo_mh = mh;
190 
191 	/*
192 	 * Load firmware so we can get setup.  We arbitrarily pick station
193 	 * firmware; we'll re-load firmware as needed so setting up
194 	 * the wrong mode isn't a big deal.
195 	 */
196 	error = malo_hal_fwload(mh, "malo8335-h", "malo8335-m");
197 	if (error != 0) {
198 		device_printf(sc->malo_dev, "unable to setup firmware\n");
199 		goto bad1;
200 	}
201 	/* XXX gethwspecs() extracts correct informations?  not maybe!  */
202 	error = malo_hal_gethwspecs(mh, &sc->malo_hwspecs);
203 	if (error != 0) {
204 		device_printf(sc->malo_dev, "unable to fetch h/w specs\n");
205 		goto bad1;
206 	}
207 
208 	DPRINTF(sc, MALO_DEBUG_FW,
209 	    "malo_hal_gethwspecs: hwversion 0x%x hostif 0x%x"
210 	    "maxnum_wcb 0x%x maxnum_mcaddr 0x%x maxnum_tx_wcb 0x%x"
211 	    "regioncode 0x%x num_antenna 0x%x fw_releasenum 0x%x"
212 	    "wcbbase0 0x%x rxdesc_read 0x%x rxdesc_write 0x%x"
213 	    "ul_fw_awakecookie 0x%x w[4] = %x %x %x %x",
214 	    sc->malo_hwspecs.hwversion,
215 	    sc->malo_hwspecs.hostinterface, sc->malo_hwspecs.maxnum_wcb,
216 	    sc->malo_hwspecs.maxnum_mcaddr, sc->malo_hwspecs.maxnum_tx_wcb,
217 	    sc->malo_hwspecs.regioncode, sc->malo_hwspecs.num_antenna,
218 	    sc->malo_hwspecs.fw_releasenum, sc->malo_hwspecs.wcbbase0,
219 	    sc->malo_hwspecs.rxdesc_read, sc->malo_hwspecs.rxdesc_write,
220 	    sc->malo_hwspecs.ul_fw_awakecookie,
221 	    sc->malo_hwspecs.wcbbase[0], sc->malo_hwspecs.wcbbase[1],
222 	    sc->malo_hwspecs.wcbbase[2], sc->malo_hwspecs.wcbbase[3]);
223 
224 	/* NB: firmware looks that it does not export regdomain info API.  */
225 	bands = 0;
226 	setbit(&bands, IEEE80211_MODE_11B);
227 	setbit(&bands, IEEE80211_MODE_11G);
228 	ieee80211_init_channels(ic, NULL, &bands);
229 
230 	sc->malo_txantenna = 0x2;	/* h/w default */
231 	sc->malo_rxantenna = 0xffff;	/* h/w default */
232 
233 	/*
234 	 * Allocate tx + rx descriptors and populate the lists.
235 	 * We immediately push the information to the firmware
236 	 * as otherwise it gets upset.
237 	 */
238 	error = malo_dma_setup(sc);
239 	if (error != 0) {
240 		device_printf(sc->malo_dev,
241 		    "failed to setup descriptors: %d\n", error);
242 		goto bad1;
243 	}
244 	error = malo_setup_hwdma(sc);	/* push to firmware */
245 	if (error != 0)			/* NB: malo_setupdma prints msg */
246 		goto bad2;
247 
248 	sc->malo_tq = taskqueue_create_fast("malo_taskq", M_NOWAIT,
249 		taskqueue_thread_enqueue, &sc->malo_tq);
250 	taskqueue_start_threads(&sc->malo_tq, 1, PI_NET,
251 		"%s taskq", device_get_nameunit(sc->malo_dev));
252 
253 	TASK_INIT(&sc->malo_rxtask, 0, malo_rx_proc, sc);
254 	TASK_INIT(&sc->malo_txtask, 0, malo_tx_proc, sc);
255 
256 	ic->ic_softc = sc;
257 	ic->ic_name = device_get_nameunit(sc->malo_dev);
258 	/* XXX not right but it's not used anywhere important */
259 	ic->ic_phytype = IEEE80211_T_OFDM;
260 	ic->ic_opmode = IEEE80211_M_STA;
261 	ic->ic_caps =
262 	      IEEE80211_C_STA			/* station mode supported */
263 	    | IEEE80211_C_BGSCAN		/* capable of bg scanning */
264 	    | IEEE80211_C_MONITOR		/* monitor mode */
265 	    | IEEE80211_C_SHPREAMBLE		/* short preamble supported */
266 	    | IEEE80211_C_SHSLOT		/* short slot time supported */
267 	    | IEEE80211_C_TXPMGT		/* capable of txpow mgt */
268 	    | IEEE80211_C_WPA			/* capable of WPA1+WPA2 */
269 	    ;
270 	IEEE80211_ADDR_COPY(ic->ic_macaddr, sc->malo_hwspecs.macaddr);
271 
272 	/*
273 	 * Transmit requires space in the packet for a special format transmit
274 	 * record and optional padding between this record and the payload.
275 	 * Ask the net80211 layer to arrange this when encapsulating
276 	 * packets so we can add it efficiently.
277 	 */
278 	ic->ic_headroom = sizeof(struct malo_txrec) -
279 		sizeof(struct ieee80211_frame);
280 
281 	/* call MI attach routine. */
282 	ieee80211_ifattach(ic);
283 	/* override default methods */
284 	ic->ic_vap_create = malo_vap_create;
285 	ic->ic_vap_delete = malo_vap_delete;
286 	ic->ic_raw_xmit = malo_raw_xmit;
287 	ic->ic_updateslot = malo_updateslot;
288 	ic->ic_scan_start = malo_scan_start;
289 	ic->ic_scan_end = malo_scan_end;
290 	ic->ic_set_channel = malo_set_channel;
291 	ic->ic_parent = malo_parent;
292 	ic->ic_transmit = malo_transmit;
293 
294 	sc->malo_invalid = 0;		/* ready to go, enable int handling */
295 
296 	ieee80211_radiotap_attach(ic,
297 	    &sc->malo_tx_th.wt_ihdr, sizeof(sc->malo_tx_th),
298 		MALO_TX_RADIOTAP_PRESENT,
299 	    &sc->malo_rx_th.wr_ihdr, sizeof(sc->malo_rx_th),
300 		MALO_RX_RADIOTAP_PRESENT);
301 
302 	/*
303 	 * Setup dynamic sysctl's.
304 	 */
305 	malo_sysctlattach(sc);
306 
307 	if (bootverbose)
308 		ieee80211_announce(ic);
309 	malo_announce(sc);
310 
311 	return 0;
312 bad2:
313 	malo_dma_cleanup(sc);
314 bad1:
315 	malo_hal_detach(mh);
316 bad:
317 	sc->malo_invalid = 1;
318 
319 	return error;
320 }
321 
322 static struct ieee80211vap *
323 malo_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
324     enum ieee80211_opmode opmode, int flags,
325     const uint8_t bssid[IEEE80211_ADDR_LEN],
326     const uint8_t mac[IEEE80211_ADDR_LEN])
327 {
328 	struct malo_softc *sc = ic->ic_softc;
329 	struct malo_vap *mvp;
330 	struct ieee80211vap *vap;
331 
332 	if (!TAILQ_EMPTY(&ic->ic_vaps)) {
333 		device_printf(sc->malo_dev, "multiple vaps not supported\n");
334 		return NULL;
335 	}
336 	switch (opmode) {
337 	case IEEE80211_M_STA:
338 		if (opmode == IEEE80211_M_STA)
339 			flags |= IEEE80211_CLONE_NOBEACONS;
340 		/* fall thru... */
341 	case IEEE80211_M_MONITOR:
342 		break;
343 	default:
344 		device_printf(sc->malo_dev, "%s mode not supported\n",
345 		    ieee80211_opmode_name[opmode]);
346 		return NULL;		/* unsupported */
347 	}
348 	mvp = malloc(sizeof(struct malo_vap), M_80211_VAP, M_WAITOK | M_ZERO);
349 	vap = &mvp->malo_vap;
350 	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
351 
352 	/* override state transition machine */
353 	mvp->malo_newstate = vap->iv_newstate;
354 	vap->iv_newstate = malo_newstate;
355 
356 	/* complete setup */
357 	ieee80211_vap_attach(vap,
358 	    ieee80211_media_change, ieee80211_media_status, mac);
359 	ic->ic_opmode = opmode;
360 	return vap;
361 }
362 
363 static void
364 malo_vap_delete(struct ieee80211vap *vap)
365 {
366 	struct malo_vap *mvp = MALO_VAP(vap);
367 
368 	ieee80211_vap_detach(vap);
369 	free(mvp, M_80211_VAP);
370 }
371 
372 int
373 malo_intr(void *arg)
374 {
375 	struct malo_softc *sc = arg;
376 	struct malo_hal *mh = sc->malo_mh;
377 	uint32_t status;
378 
379 	if (sc->malo_invalid) {
380 		/*
381 		 * The hardware is not ready/present, don't touch anything.
382 		 * Note this can happen early on if the IRQ is shared.
383 		 */
384 		DPRINTF(sc, MALO_DEBUG_ANY, "%s: invalid; ignored\n", __func__);
385 		return (FILTER_STRAY);
386 	}
387 
388 	/*
389 	 * Figure out the reason(s) for the interrupt.
390 	 */
391 	malo_hal_getisr(mh, &status);		/* NB: clears ISR too */
392 	if (status == 0)			/* must be a shared irq */
393 		return (FILTER_STRAY);
394 
395 	DPRINTF(sc, MALO_DEBUG_INTR, "%s: status 0x%x imask 0x%x\n",
396 	    __func__, status, sc->malo_imask);
397 
398 	if (status & MALO_A2HRIC_BIT_RX_RDY)
399 		taskqueue_enqueue_fast(sc->malo_tq, &sc->malo_rxtask);
400 	if (status & MALO_A2HRIC_BIT_TX_DONE)
401 		taskqueue_enqueue_fast(sc->malo_tq, &sc->malo_txtask);
402 	if (status & MALO_A2HRIC_BIT_OPC_DONE)
403 		malo_hal_cmddone(mh);
404 	if (status & MALO_A2HRIC_BIT_MAC_EVENT)
405 		;
406 	if (status & MALO_A2HRIC_BIT_RX_PROBLEM)
407 		;
408 	if (status & MALO_A2HRIC_BIT_ICV_ERROR) {
409 		/* TKIP ICV error */
410 		sc->malo_stats.mst_rx_badtkipicv++;
411 	}
412 #ifdef MALO_DEBUG
413 	if (((status | sc->malo_imask) ^ sc->malo_imask) != 0)
414 		DPRINTF(sc, MALO_DEBUG_INTR,
415 		    "%s: can't handle interrupt status 0x%x\n",
416 		    __func__, status);
417 #endif
418 	return (FILTER_HANDLED);
419 }
420 
421 static void
422 malo_load_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
423 {
424 	bus_addr_t *paddr = (bus_addr_t*) arg;
425 
426 	KASSERT(error == 0, ("error %u on bus_dma callback", error));
427 
428 	*paddr = segs->ds_addr;
429 }
430 
431 static int
432 malo_desc_setup(struct malo_softc *sc, const char *name,
433     struct malo_descdma *dd,
434     int nbuf, size_t bufsize, int ndesc, size_t descsize)
435 {
436 	int error;
437 	uint8_t *ds;
438 
439 	DPRINTF(sc, MALO_DEBUG_RESET,
440 	    "%s: %s DMA: %u bufs (%ju) %u desc/buf (%ju)\n",
441 	    __func__, name, nbuf, (uintmax_t) bufsize,
442 	    ndesc, (uintmax_t) descsize);
443 
444 	dd->dd_name = name;
445 	dd->dd_desc_len = nbuf * ndesc * descsize;
446 
447 	/*
448 	 * Setup DMA descriptor area.
449 	 */
450 	error = bus_dma_tag_create(bus_get_dma_tag(sc->malo_dev),/* parent */
451 		       PAGE_SIZE, 0,		/* alignment, bounds */
452 		       BUS_SPACE_MAXADDR_32BIT,	/* lowaddr */
453 		       BUS_SPACE_MAXADDR,	/* highaddr */
454 		       NULL, NULL,		/* filter, filterarg */
455 		       dd->dd_desc_len,		/* maxsize */
456 		       1,			/* nsegments */
457 		       dd->dd_desc_len,		/* maxsegsize */
458 		       BUS_DMA_ALLOCNOW,	/* flags */
459 		       NULL,			/* lockfunc */
460 		       NULL,			/* lockarg */
461 		       &dd->dd_dmat);
462 	if (error != 0) {
463 		device_printf(sc->malo_dev, "cannot allocate %s DMA tag\n",
464 		    dd->dd_name);
465 		return error;
466 	}
467 
468 	/* allocate descriptors */
469 	error = bus_dmamem_alloc(dd->dd_dmat, (void**) &dd->dd_desc,
470 	    BUS_DMA_NOWAIT | BUS_DMA_COHERENT, &dd->dd_dmamap);
471 	if (error != 0) {
472 		device_printf(sc->malo_dev,
473 		    "unable to alloc memory for %u %s descriptors, "
474 		    "error %u\n", nbuf * ndesc, dd->dd_name, error);
475 		goto fail1;
476 	}
477 
478 	error = bus_dmamap_load(dd->dd_dmat, dd->dd_dmamap,
479 	    dd->dd_desc, dd->dd_desc_len,
480 	    malo_load_cb, &dd->dd_desc_paddr, BUS_DMA_NOWAIT);
481 	if (error != 0) {
482 		device_printf(sc->malo_dev,
483 		    "unable to map %s descriptors, error %u\n",
484 		    dd->dd_name, error);
485 		goto fail2;
486 	}
487 
488 	ds = dd->dd_desc;
489 	memset(ds, 0, dd->dd_desc_len);
490 	DPRINTF(sc, MALO_DEBUG_RESET,
491 	    "%s: %s DMA map: %p (%lu) -> 0x%jx (%lu)\n",
492 	    __func__, dd->dd_name, ds, (u_long) dd->dd_desc_len,
493 	    (uintmax_t) dd->dd_desc_paddr, /*XXX*/ (u_long) dd->dd_desc_len);
494 
495 	return 0;
496 fail2:
497 	bus_dmamem_free(dd->dd_dmat, dd->dd_desc, dd->dd_dmamap);
498 fail1:
499 	bus_dma_tag_destroy(dd->dd_dmat);
500 	memset(dd, 0, sizeof(*dd));
501 	return error;
502 }
503 
504 #define	DS2PHYS(_dd, _ds) \
505 	((_dd)->dd_desc_paddr + ((caddr_t)(_ds) - (caddr_t)(_dd)->dd_desc))
506 
507 static int
508 malo_rxdma_setup(struct malo_softc *sc)
509 {
510 	int error, bsize, i;
511 	struct malo_rxbuf *bf;
512 	struct malo_rxdesc *ds;
513 
514 	error = malo_desc_setup(sc, "rx", &sc->malo_rxdma,
515 	    malo_rxbuf, sizeof(struct malo_rxbuf),
516 	    1, sizeof(struct malo_rxdesc));
517 	if (error != 0)
518 		return error;
519 
520 	/*
521 	 * Allocate rx buffers and set them up.
522 	 */
523 	bsize = malo_rxbuf * sizeof(struct malo_rxbuf);
524 	bf = malloc(bsize, M_MALODEV, M_NOWAIT | M_ZERO);
525 	if (bf == NULL) {
526 		device_printf(sc->malo_dev,
527 		    "malloc of %u rx buffers failed\n", bsize);
528 		return error;
529 	}
530 	sc->malo_rxdma.dd_bufptr = bf;
531 
532 	STAILQ_INIT(&sc->malo_rxbuf);
533 	ds = sc->malo_rxdma.dd_desc;
534 	for (i = 0; i < malo_rxbuf; i++, bf++, ds++) {
535 		bf->bf_desc = ds;
536 		bf->bf_daddr = DS2PHYS(&sc->malo_rxdma, ds);
537 		error = bus_dmamap_create(sc->malo_dmat, BUS_DMA_NOWAIT,
538 		    &bf->bf_dmamap);
539 		if (error != 0) {
540 			device_printf(sc->malo_dev,
541 			    "%s: unable to dmamap for rx buffer, error %d\n",
542 			    __func__, error);
543 			return error;
544 		}
545 		/* NB: tail is intentional to preserve descriptor order */
546 		STAILQ_INSERT_TAIL(&sc->malo_rxbuf, bf, bf_list);
547 	}
548 	return 0;
549 }
550 
551 static int
552 malo_txdma_setup(struct malo_softc *sc, struct malo_txq *txq)
553 {
554 	int error, bsize, i;
555 	struct malo_txbuf *bf;
556 	struct malo_txdesc *ds;
557 
558 	error = malo_desc_setup(sc, "tx", &txq->dma,
559 	    malo_txbuf, sizeof(struct malo_txbuf),
560 	    MALO_TXDESC, sizeof(struct malo_txdesc));
561 	if (error != 0)
562 		return error;
563 
564 	/* allocate and setup tx buffers */
565 	bsize = malo_txbuf * sizeof(struct malo_txbuf);
566 	bf = malloc(bsize, M_MALODEV, M_NOWAIT | M_ZERO);
567 	if (bf == NULL) {
568 		device_printf(sc->malo_dev, "malloc of %u tx buffers failed\n",
569 		    malo_txbuf);
570 		return ENOMEM;
571 	}
572 	txq->dma.dd_bufptr = bf;
573 
574 	STAILQ_INIT(&txq->free);
575 	txq->nfree = 0;
576 	ds = txq->dma.dd_desc;
577 	for (i = 0; i < malo_txbuf; i++, bf++, ds += MALO_TXDESC) {
578 		bf->bf_desc = ds;
579 		bf->bf_daddr = DS2PHYS(&txq->dma, ds);
580 		error = bus_dmamap_create(sc->malo_dmat, BUS_DMA_NOWAIT,
581 		    &bf->bf_dmamap);
582 		if (error != 0) {
583 			device_printf(sc->malo_dev,
584 			    "unable to create dmamap for tx "
585 			    "buffer %u, error %u\n", i, error);
586 			return error;
587 		}
588 		STAILQ_INSERT_TAIL(&txq->free, bf, bf_list);
589 		txq->nfree++;
590 	}
591 
592 	return 0;
593 }
594 
595 static void
596 malo_desc_cleanup(struct malo_softc *sc, struct malo_descdma *dd)
597 {
598 	bus_dmamap_unload(dd->dd_dmat, dd->dd_dmamap);
599 	bus_dmamem_free(dd->dd_dmat, dd->dd_desc, dd->dd_dmamap);
600 	bus_dma_tag_destroy(dd->dd_dmat);
601 
602 	memset(dd, 0, sizeof(*dd));
603 }
604 
605 static void
606 malo_rxdma_cleanup(struct malo_softc *sc)
607 {
608 	struct malo_rxbuf *bf;
609 
610 	STAILQ_FOREACH(bf, &sc->malo_rxbuf, bf_list) {
611 		if (bf->bf_m != NULL) {
612 			m_freem(bf->bf_m);
613 			bf->bf_m = NULL;
614 		}
615 		if (bf->bf_dmamap != NULL) {
616 			bus_dmamap_destroy(sc->malo_dmat, bf->bf_dmamap);
617 			bf->bf_dmamap = NULL;
618 		}
619 	}
620 	STAILQ_INIT(&sc->malo_rxbuf);
621 	if (sc->malo_rxdma.dd_bufptr != NULL) {
622 		free(sc->malo_rxdma.dd_bufptr, M_MALODEV);
623 		sc->malo_rxdma.dd_bufptr = NULL;
624 	}
625 	if (sc->malo_rxdma.dd_desc_len != 0)
626 		malo_desc_cleanup(sc, &sc->malo_rxdma);
627 }
628 
629 static void
630 malo_txdma_cleanup(struct malo_softc *sc, struct malo_txq *txq)
631 {
632 	struct malo_txbuf *bf;
633 	struct ieee80211_node *ni;
634 
635 	STAILQ_FOREACH(bf, &txq->free, bf_list) {
636 		if (bf->bf_m != NULL) {
637 			m_freem(bf->bf_m);
638 			bf->bf_m = NULL;
639 		}
640 		ni = bf->bf_node;
641 		bf->bf_node = NULL;
642 		if (ni != NULL) {
643 			/*
644 			 * Reclaim node reference.
645 			 */
646 			ieee80211_free_node(ni);
647 		}
648 		if (bf->bf_dmamap != NULL) {
649 			bus_dmamap_destroy(sc->malo_dmat, bf->bf_dmamap);
650 			bf->bf_dmamap = NULL;
651 		}
652 	}
653 	STAILQ_INIT(&txq->free);
654 	txq->nfree = 0;
655 	if (txq->dma.dd_bufptr != NULL) {
656 		free(txq->dma.dd_bufptr, M_MALODEV);
657 		txq->dma.dd_bufptr = NULL;
658 	}
659 	if (txq->dma.dd_desc_len != 0)
660 		malo_desc_cleanup(sc, &txq->dma);
661 }
662 
663 static void
664 malo_dma_cleanup(struct malo_softc *sc)
665 {
666 	int i;
667 
668 	for (i = 0; i < MALO_NUM_TX_QUEUES; i++)
669 		malo_txdma_cleanup(sc, &sc->malo_txq[i]);
670 
671 	malo_rxdma_cleanup(sc);
672 }
673 
674 static int
675 malo_dma_setup(struct malo_softc *sc)
676 {
677 	int error, i;
678 
679 	/* rxdma initializing.  */
680 	error = malo_rxdma_setup(sc);
681 	if (error != 0)
682 		return error;
683 
684 	/* NB: we just have 1 tx queue now.  */
685 	for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
686 		error = malo_txdma_setup(sc, &sc->malo_txq[i]);
687 		if (error != 0) {
688 			malo_dma_cleanup(sc);
689 
690 			return error;
691 		}
692 
693 		malo_txq_init(sc, &sc->malo_txq[i], i);
694 	}
695 
696 	return 0;
697 }
698 
699 static void
700 malo_hal_set_rxtxdma(struct malo_softc *sc)
701 {
702 	int i;
703 
704 	malo_bar0_write4(sc, sc->malo_hwspecs.rxdesc_read,
705 	    sc->malo_hwdma.rxdesc_read);
706 	malo_bar0_write4(sc, sc->malo_hwspecs.rxdesc_write,
707 	    sc->malo_hwdma.rxdesc_read);
708 
709 	for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
710 		malo_bar0_write4(sc,
711 		    sc->malo_hwspecs.wcbbase[i], sc->malo_hwdma.wcbbase[i]);
712 	}
713 }
714 
715 /*
716  * Inform firmware of our tx/rx dma setup.  The BAR 0 writes below are
717  * for compatibility with older firmware.  For current firmware we send
718  * this information with a cmd block via malo_hal_sethwdma.
719  */
720 static int
721 malo_setup_hwdma(struct malo_softc *sc)
722 {
723 	int i;
724 	struct malo_txq *txq;
725 
726 	sc->malo_hwdma.rxdesc_read = sc->malo_rxdma.dd_desc_paddr;
727 
728 	for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
729 		txq = &sc->malo_txq[i];
730 		sc->malo_hwdma.wcbbase[i] = txq->dma.dd_desc_paddr;
731 	}
732 	sc->malo_hwdma.maxnum_txwcb = malo_txbuf;
733 	sc->malo_hwdma.maxnum_wcb = MALO_NUM_TX_QUEUES;
734 
735 	malo_hal_set_rxtxdma(sc);
736 
737 	return 0;
738 }
739 
740 static void
741 malo_txq_init(struct malo_softc *sc, struct malo_txq *txq, int qnum)
742 {
743 	struct malo_txbuf *bf, *bn;
744 	struct malo_txdesc *ds;
745 
746 	MALO_TXQ_LOCK_INIT(sc, txq);
747 	txq->qnum = qnum;
748 	txq->txpri = 0;	/* XXX */
749 
750 	STAILQ_FOREACH(bf, &txq->free, bf_list) {
751 		bf->bf_txq = txq;
752 
753 		ds = bf->bf_desc;
754 		bn = STAILQ_NEXT(bf, bf_list);
755 		if (bn == NULL)
756 			bn = STAILQ_FIRST(&txq->free);
757 		ds->physnext = htole32(bn->bf_daddr);
758 	}
759 	STAILQ_INIT(&txq->active);
760 }
761 
762 /*
763  * Reclaim resources for a setup queue.
764  */
765 static void
766 malo_tx_cleanupq(struct malo_softc *sc, struct malo_txq *txq)
767 {
768 	/* XXX hal work? */
769 	MALO_TXQ_LOCK_DESTROY(txq);
770 }
771 
772 /*
773  * Allocate a tx buffer for sending a frame.
774  */
775 static struct malo_txbuf *
776 malo_getbuf(struct malo_softc *sc, struct malo_txq *txq)
777 {
778 	struct malo_txbuf *bf;
779 
780 	MALO_TXQ_LOCK(txq);
781 	bf = STAILQ_FIRST(&txq->free);
782 	if (bf != NULL) {
783 		STAILQ_REMOVE_HEAD(&txq->free, bf_list);
784 		txq->nfree--;
785 	}
786 	MALO_TXQ_UNLOCK(txq);
787 	if (bf == NULL) {
788 		DPRINTF(sc, MALO_DEBUG_XMIT,
789 		    "%s: out of xmit buffers on q %d\n", __func__, txq->qnum);
790 		sc->malo_stats.mst_tx_qstop++;
791 	}
792 	return bf;
793 }
794 
795 static int
796 malo_tx_dmasetup(struct malo_softc *sc, struct malo_txbuf *bf, struct mbuf *m0)
797 {
798 	struct mbuf *m;
799 	int error;
800 
801 	/*
802 	 * Load the DMA map so any coalescing is done.  This also calculates
803 	 * the number of descriptors we need.
804 	 */
805 	error = bus_dmamap_load_mbuf_sg(sc->malo_dmat, bf->bf_dmamap, m0,
806 				     bf->bf_segs, &bf->bf_nseg,
807 				     BUS_DMA_NOWAIT);
808 	if (error == EFBIG) {
809 		/* XXX packet requires too many descriptors */
810 		bf->bf_nseg = MALO_TXDESC + 1;
811 	} else if (error != 0) {
812 		sc->malo_stats.mst_tx_busdma++;
813 		m_freem(m0);
814 		return error;
815 	}
816 	/*
817 	 * Discard null packets and check for packets that require too many
818 	 * TX descriptors.  We try to convert the latter to a cluster.
819 	 */
820 	if (error == EFBIG) {		/* too many desc's, linearize */
821 		sc->malo_stats.mst_tx_linear++;
822 		m = m_defrag(m0, M_NOWAIT);
823 		if (m == NULL) {
824 			m_freem(m0);
825 			sc->malo_stats.mst_tx_nombuf++;
826 			return ENOMEM;
827 		}
828 		m0 = m;
829 		error = bus_dmamap_load_mbuf_sg(sc->malo_dmat, bf->bf_dmamap, m0,
830 					     bf->bf_segs, &bf->bf_nseg,
831 					     BUS_DMA_NOWAIT);
832 		if (error != 0) {
833 			sc->malo_stats.mst_tx_busdma++;
834 			m_freem(m0);
835 			return error;
836 		}
837 		KASSERT(bf->bf_nseg <= MALO_TXDESC,
838 		    ("too many segments after defrag; nseg %u", bf->bf_nseg));
839 	} else if (bf->bf_nseg == 0) {		/* null packet, discard */
840 		sc->malo_stats.mst_tx_nodata++;
841 		m_freem(m0);
842 		return EIO;
843 	}
844 	DPRINTF(sc, MALO_DEBUG_XMIT, "%s: m %p len %u\n",
845 		__func__, m0, m0->m_pkthdr.len);
846 	bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
847 	bf->bf_m = m0;
848 
849 	return 0;
850 }
851 
852 #ifdef MALO_DEBUG
853 static void
854 malo_printrxbuf(const struct malo_rxbuf *bf, u_int ix)
855 {
856 	const struct malo_rxdesc *ds = bf->bf_desc;
857 	uint32_t status = le32toh(ds->status);
858 
859 	printf("R[%2u] (DS.V:%p DS.P:0x%jx) NEXT:%08x DATA:%08x RC:%02x%s\n"
860 	    "      STAT:%02x LEN:%04x SNR:%02x NF:%02x CHAN:%02x"
861 	    " RATE:%02x QOS:%04x\n", ix, ds, (uintmax_t)bf->bf_daddr,
862 	    le32toh(ds->physnext), le32toh(ds->physbuffdata),
863 	    ds->rxcontrol,
864 	    ds->rxcontrol != MALO_RXD_CTRL_DRIVER_OWN ?
865 	        "" : (status & MALO_RXD_STATUS_OK) ? " *" : " !",
866 	    ds->status, le16toh(ds->pktlen), ds->snr, ds->nf, ds->channel,
867 	    ds->rate, le16toh(ds->qosctrl));
868 }
869 
870 static void
871 malo_printtxbuf(const struct malo_txbuf *bf, u_int qnum, u_int ix)
872 {
873 	const struct malo_txdesc *ds = bf->bf_desc;
874 	uint32_t status = le32toh(ds->status);
875 
876 	printf("Q%u[%3u]", qnum, ix);
877 	printf(" (DS.V:%p DS.P:0x%jx)\n", ds, (uintmax_t)bf->bf_daddr);
878 	printf("    NEXT:%08x DATA:%08x LEN:%04x STAT:%08x%s\n",
879 	    le32toh(ds->physnext),
880 	    le32toh(ds->pktptr), le16toh(ds->pktlen), status,
881 	    status & MALO_TXD_STATUS_USED ?
882 	    "" : (status & 3) != 0 ? " *" : " !");
883 	printf("    RATE:%02x PRI:%x QOS:%04x SAP:%08x FORMAT:%04x\n",
884 	    ds->datarate, ds->txpriority, le16toh(ds->qosctrl),
885 	    le32toh(ds->sap_pktinfo), le16toh(ds->format));
886 #if 0
887 	{
888 		const uint8_t *cp = (const uint8_t *) ds;
889 		int i;
890 		for (i = 0; i < sizeof(struct malo_txdesc); i++) {
891 			printf("%02x ", cp[i]);
892 			if (((i+1) % 16) == 0)
893 				printf("\n");
894 		}
895 		printf("\n");
896 	}
897 #endif
898 }
899 #endif /* MALO_DEBUG */
900 
901 static __inline void
902 malo_updatetxrate(struct ieee80211_node *ni, int rix)
903 {
904 #define	N(x)	(sizeof(x)/sizeof(x[0]))
905 	static const int ieeerates[] =
906 	    { 2, 4, 11, 22, 44, 12, 18, 24, 36, 48, 96, 108 };
907 	if (rix < N(ieeerates))
908 		ni->ni_txrate = ieeerates[rix];
909 #undef N
910 }
911 
912 static int
913 malo_fix2rate(int fix_rate)
914 {
915 #define	N(x)	(sizeof(x)/sizeof(x[0]))
916 	static const int rates[] =
917 	    { 2, 4, 11, 22, 12, 18, 24, 36, 48, 96, 108 };
918 	return (fix_rate < N(rates) ? rates[fix_rate] : 0);
919 #undef N
920 }
921 
922 /* idiomatic shorthands: MS = mask+shift, SM = shift+mask */
923 #define	MS(v,x)			(((v) & x) >> x##_S)
924 #define	SM(v,x)			(((v) << x##_S) & x)
925 
926 /*
927  * Process completed xmit descriptors from the specified queue.
928  */
929 static int
930 malo_tx_processq(struct malo_softc *sc, struct malo_txq *txq)
931 {
932 	struct malo_txbuf *bf;
933 	struct malo_txdesc *ds;
934 	struct ieee80211_node *ni;
935 	int nreaped;
936 	uint32_t status;
937 
938 	DPRINTF(sc, MALO_DEBUG_TX_PROC, "%s: tx queue %u\n",
939 	    __func__, txq->qnum);
940 	for (nreaped = 0;; nreaped++) {
941 		MALO_TXQ_LOCK(txq);
942 		bf = STAILQ_FIRST(&txq->active);
943 		if (bf == NULL) {
944 			MALO_TXQ_UNLOCK(txq);
945 			break;
946 		}
947 		ds = bf->bf_desc;
948 		MALO_TXDESC_SYNC(txq, ds,
949 		    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
950 		if (ds->status & htole32(MALO_TXD_STATUS_FW_OWNED)) {
951 			MALO_TXQ_UNLOCK(txq);
952 			break;
953 		}
954 		STAILQ_REMOVE_HEAD(&txq->active, bf_list);
955 		MALO_TXQ_UNLOCK(txq);
956 
957 #ifdef MALO_DEBUG
958 		if (sc->malo_debug & MALO_DEBUG_XMIT_DESC)
959 			malo_printtxbuf(bf, txq->qnum, nreaped);
960 #endif
961 		ni = bf->bf_node;
962 		if (ni != NULL) {
963 			status = le32toh(ds->status);
964 			if (status & MALO_TXD_STATUS_OK) {
965 				uint16_t format = le16toh(ds->format);
966 				uint8_t txant = MS(format, MALO_TXD_ANTENNA);
967 
968 				sc->malo_stats.mst_ant_tx[txant]++;
969 				if (status & MALO_TXD_STATUS_OK_RETRY)
970 					sc->malo_stats.mst_tx_retries++;
971 				if (status & MALO_TXD_STATUS_OK_MORE_RETRY)
972 					sc->malo_stats.mst_tx_mretries++;
973 				malo_updatetxrate(ni, ds->datarate);
974 				sc->malo_stats.mst_tx_rate = ds->datarate;
975 			} else {
976 				if (status & MALO_TXD_STATUS_FAILED_LINK_ERROR)
977 					sc->malo_stats.mst_tx_linkerror++;
978 				if (status & MALO_TXD_STATUS_FAILED_XRETRY)
979 					sc->malo_stats.mst_tx_xretries++;
980 				if (status & MALO_TXD_STATUS_FAILED_AGING)
981 					sc->malo_stats.mst_tx_aging++;
982 			}
983 			/* XXX strip fw len in case header inspected */
984 			m_adj(bf->bf_m, sizeof(uint16_t));
985 			ieee80211_tx_complete(ni, bf->bf_m,
986 			    (status & MALO_TXD_STATUS_OK) == 0);
987 		} else
988 			m_freem(bf->bf_m);
989 
990 		ds->status = htole32(MALO_TXD_STATUS_IDLE);
991 		ds->pktlen = htole32(0);
992 
993 		bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap,
994 		    BUS_DMASYNC_POSTWRITE);
995 		bus_dmamap_unload(sc->malo_dmat, bf->bf_dmamap);
996 		bf->bf_m = NULL;
997 		bf->bf_node = NULL;
998 
999 		MALO_TXQ_LOCK(txq);
1000 		STAILQ_INSERT_TAIL(&txq->free, bf, bf_list);
1001 		txq->nfree++;
1002 		MALO_TXQ_UNLOCK(txq);
1003 	}
1004 	return nreaped;
1005 }
1006 
1007 /*
1008  * Deferred processing of transmit interrupt.
1009  */
1010 static void
1011 malo_tx_proc(void *arg, int npending)
1012 {
1013 	struct malo_softc *sc = arg;
1014 	int i, nreaped;
1015 
1016 	/*
1017 	 * Process each active queue.
1018 	 */
1019 	nreaped = 0;
1020 	MALO_LOCK(sc);
1021 	for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
1022 		if (!STAILQ_EMPTY(&sc->malo_txq[i].active))
1023 			nreaped += malo_tx_processq(sc, &sc->malo_txq[i]);
1024 	}
1025 
1026 	if (nreaped != 0) {
1027 		sc->malo_timer = 0;
1028 		malo_start(sc);
1029 	}
1030 	MALO_UNLOCK(sc);
1031 }
1032 
1033 static int
1034 malo_tx_start(struct malo_softc *sc, struct ieee80211_node *ni,
1035     struct malo_txbuf *bf, struct mbuf *m0)
1036 {
1037 #define	IEEE80211_DIR_DSTODS(wh) \
1038 	((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS)
1039 #define	IS_DATA_FRAME(wh)						\
1040 	((wh->i_fc[0] & (IEEE80211_FC0_TYPE_MASK)) == IEEE80211_FC0_TYPE_DATA)
1041 	int error, ismcast, iswep;
1042 	int copyhdrlen, hdrlen, pktlen;
1043 	struct ieee80211_frame *wh;
1044 	struct ieee80211com *ic = &sc->malo_ic;
1045 	struct ieee80211vap *vap = ni->ni_vap;
1046 	struct malo_txdesc *ds;
1047 	struct malo_txrec *tr;
1048 	struct malo_txq *txq;
1049 	uint16_t qos;
1050 
1051 	wh = mtod(m0, struct ieee80211_frame *);
1052 	iswep = wh->i_fc[1] & IEEE80211_FC1_PROTECTED;
1053 	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
1054 	copyhdrlen = hdrlen = ieee80211_anyhdrsize(wh);
1055 	pktlen = m0->m_pkthdr.len;
1056 	if (IEEE80211_QOS_HAS_SEQ(wh)) {
1057 		if (IEEE80211_DIR_DSTODS(wh)) {
1058 			qos = *(uint16_t *)
1059 			    (((struct ieee80211_qosframe_addr4 *) wh)->i_qos);
1060 			copyhdrlen -= sizeof(qos);
1061 		} else
1062 			qos = *(uint16_t *)
1063 			    (((struct ieee80211_qosframe *) wh)->i_qos);
1064 	} else
1065 		qos = 0;
1066 
1067 	if (iswep) {
1068 		struct ieee80211_key *k;
1069 
1070 		/*
1071 		 * Construct the 802.11 header+trailer for an encrypted
1072 		 * frame. The only reason this can fail is because of an
1073 		 * unknown or unsupported cipher/key type.
1074 		 *
1075 		 * NB: we do this even though the firmware will ignore
1076 		 *     what we've done for WEP and TKIP as we need the
1077 		 *     ExtIV filled in for CCMP and this also adjusts
1078 		 *     the headers which simplifies our work below.
1079 		 */
1080 		k = ieee80211_crypto_encap(ni, m0);
1081 		if (k == NULL) {
1082 			/*
1083 			 * This can happen when the key is yanked after the
1084 			 * frame was queued.  Just discard the frame; the
1085 			 * 802.11 layer counts failures and provides
1086 			 * debugging/diagnostics.
1087 			 */
1088 			m_freem(m0);
1089 			return EIO;
1090 		}
1091 
1092 		/*
1093 		 * Adjust the packet length for the crypto additions
1094 		 * done during encap and any other bits that the f/w
1095 		 * will add later on.
1096 		 */
1097 		pktlen = m0->m_pkthdr.len;
1098 
1099 		/* packet header may have moved, reset our local pointer */
1100 		wh = mtod(m0, struct ieee80211_frame *);
1101 	}
1102 
1103 	if (ieee80211_radiotap_active_vap(vap)) {
1104 		sc->malo_tx_th.wt_flags = 0;	/* XXX */
1105 		if (iswep)
1106 			sc->malo_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
1107 		sc->malo_tx_th.wt_txpower = ni->ni_txpower;
1108 		sc->malo_tx_th.wt_antenna = sc->malo_txantenna;
1109 
1110 		ieee80211_radiotap_tx(vap, m0);
1111 	}
1112 
1113 	/*
1114 	 * Copy up/down the 802.11 header; the firmware requires
1115 	 * we present a 2-byte payload length followed by a
1116 	 * 4-address header (w/o QoS), followed (optionally) by
1117 	 * any WEP/ExtIV header (but only filled in for CCMP).
1118 	 * We are assured the mbuf has sufficient headroom to
1119 	 * prepend in-place by the setup of ic_headroom in
1120 	 * malo_attach.
1121 	 */
1122 	if (hdrlen < sizeof(struct malo_txrec)) {
1123 		const int space = sizeof(struct malo_txrec) - hdrlen;
1124 		if (M_LEADINGSPACE(m0) < space) {
1125 			/* NB: should never happen */
1126 			device_printf(sc->malo_dev,
1127 			    "not enough headroom, need %d found %zd, "
1128 			    "m_flags 0x%x m_len %d\n",
1129 			    space, M_LEADINGSPACE(m0), m0->m_flags, m0->m_len);
1130 			ieee80211_dump_pkt(ic,
1131 			    mtod(m0, const uint8_t *), m0->m_len, 0, -1);
1132 			m_freem(m0);
1133 			/* XXX stat */
1134 			return EIO;
1135 		}
1136 		M_PREPEND(m0, space, M_NOWAIT);
1137 	}
1138 	tr = mtod(m0, struct malo_txrec *);
1139 	if (wh != (struct ieee80211_frame *) &tr->wh)
1140 		ovbcopy(wh, &tr->wh, hdrlen);
1141 	/*
1142 	 * Note: the "firmware length" is actually the length of the fully
1143 	 * formed "802.11 payload".  That is, it's everything except for
1144 	 * the 802.11 header.  In particular this includes all crypto
1145 	 * material including the MIC!
1146 	 */
1147 	tr->fwlen = htole16(pktlen - hdrlen);
1148 
1149 	/*
1150 	 * Load the DMA map so any coalescing is done.  This
1151 	 * also calculates the number of descriptors we need.
1152 	 */
1153 	error = malo_tx_dmasetup(sc, bf, m0);
1154 	if (error != 0)
1155 		return error;
1156 	bf->bf_node = ni;			/* NB: held reference */
1157 	m0 = bf->bf_m;				/* NB: may have changed */
1158 	tr = mtod(m0, struct malo_txrec *);
1159 	wh = (struct ieee80211_frame *)&tr->wh;
1160 
1161 	/*
1162 	 * Formulate tx descriptor.
1163 	 */
1164 	ds = bf->bf_desc;
1165 	txq = bf->bf_txq;
1166 
1167 	ds->qosctrl = qos;			/* NB: already little-endian */
1168 	ds->pktptr = htole32(bf->bf_segs[0].ds_addr);
1169 	ds->pktlen = htole16(bf->bf_segs[0].ds_len);
1170 	/* NB: pPhysNext setup once, don't touch */
1171 	ds->datarate = IS_DATA_FRAME(wh) ? 1 : 0;
1172 	ds->sap_pktinfo = 0;
1173 	ds->format = 0;
1174 
1175 	/*
1176 	 * Select transmit rate.
1177 	 */
1178 	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
1179 	case IEEE80211_FC0_TYPE_MGT:
1180 		sc->malo_stats.mst_tx_mgmt++;
1181 		/* fall thru... */
1182 	case IEEE80211_FC0_TYPE_CTL:
1183 		ds->txpriority = 1;
1184 		break;
1185 	case IEEE80211_FC0_TYPE_DATA:
1186 		ds->txpriority = txq->qnum;
1187 		break;
1188 	default:
1189 		device_printf(sc->malo_dev, "bogus frame type 0x%x (%s)\n",
1190 			wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK, __func__);
1191 		/* XXX statistic */
1192 		m_freem(m0);
1193 		return EIO;
1194 	}
1195 
1196 #ifdef MALO_DEBUG
1197 	if (IFF_DUMPPKTS_XMIT(sc))
1198 		ieee80211_dump_pkt(ic,
1199 		    mtod(m0, const uint8_t *)+sizeof(uint16_t),
1200 		    m0->m_len - sizeof(uint16_t), ds->datarate, -1);
1201 #endif
1202 
1203 	MALO_TXQ_LOCK(txq);
1204 	if (!IS_DATA_FRAME(wh))
1205 		ds->status |= htole32(1);
1206 	ds->status |= htole32(MALO_TXD_STATUS_FW_OWNED);
1207 	STAILQ_INSERT_TAIL(&txq->active, bf, bf_list);
1208 	MALO_TXDESC_SYNC(txq, ds, BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
1209 
1210 	sc->malo_timer = 5;
1211 	MALO_TXQ_UNLOCK(txq);
1212 	return 0;
1213 #undef IEEE80211_DIR_DSTODS
1214 }
1215 
1216 static int
1217 malo_transmit(struct ieee80211com *ic, struct mbuf *m)
1218 {
1219 	struct malo_softc *sc = ic->ic_softc;
1220 	int error;
1221 
1222 	MALO_LOCK(sc);
1223 	if (!sc->malo_running) {
1224 		MALO_UNLOCK(sc);
1225 		return (ENXIO);
1226 	}
1227 	error = mbufq_enqueue(&sc->malo_snd, m);
1228 	if (error) {
1229 		MALO_UNLOCK(sc);
1230 		return (error);
1231 	}
1232 	malo_start(sc);
1233 	MALO_UNLOCK(sc);
1234 	return (0);
1235 }
1236 
1237 static void
1238 malo_start(struct malo_softc *sc)
1239 {
1240 	struct ieee80211_node *ni;
1241 	struct malo_txq *txq = &sc->malo_txq[0];
1242 	struct malo_txbuf *bf = NULL;
1243 	struct mbuf *m;
1244 	int nqueued = 0;
1245 
1246 	MALO_LOCK_ASSERT(sc);
1247 
1248 	if (!sc->malo_running || sc->malo_invalid)
1249 		return;
1250 
1251 	while ((m = mbufq_dequeue(&sc->malo_snd)) != NULL) {
1252 		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
1253 		bf = malo_getbuf(sc, txq);
1254 		if (bf == NULL) {
1255 			mbufq_prepend(&sc->malo_snd, m);
1256 			sc->malo_stats.mst_tx_qstop++;
1257 			break;
1258 		}
1259 		/*
1260 		 * Pass the frame to the h/w for transmission.
1261 		 */
1262 		if (malo_tx_start(sc, ni, bf, m)) {
1263 			if_inc_counter(ni->ni_vap->iv_ifp,
1264 			    IFCOUNTER_OERRORS, 1);
1265 			if (bf != NULL) {
1266 				bf->bf_m = NULL;
1267 				bf->bf_node = NULL;
1268 				MALO_TXQ_LOCK(txq);
1269 				STAILQ_INSERT_HEAD(&txq->free, bf, bf_list);
1270 				MALO_TXQ_UNLOCK(txq);
1271 			}
1272 			ieee80211_free_node(ni);
1273 			continue;
1274 		}
1275 		nqueued++;
1276 
1277 		if (nqueued >= malo_txcoalesce) {
1278 			/*
1279 			 * Poke the firmware to process queued frames;
1280 			 * see below about (lack of) locking.
1281 			 */
1282 			nqueued = 0;
1283 			malo_hal_txstart(sc->malo_mh, 0/*XXX*/);
1284 		}
1285 	}
1286 
1287 	if (nqueued) {
1288 		/*
1289 		 * NB: We don't need to lock against tx done because
1290 		 * this just prods the firmware to check the transmit
1291 		 * descriptors.  The firmware will also start fetching
1292 		 * descriptors by itself if it notices new ones are
1293 		 * present when it goes to deliver a tx done interrupt
1294 		 * to the host. So if we race with tx done processing
1295 		 * it's ok.  Delivering the kick here rather than in
1296 		 * malo_tx_start is an optimization to avoid poking the
1297 		 * firmware for each packet.
1298 		 *
1299 		 * NB: the queue id isn't used so 0 is ok.
1300 		 */
1301 		malo_hal_txstart(sc->malo_mh, 0/*XXX*/);
1302 	}
1303 }
1304 
1305 static void
1306 malo_watchdog(void *arg)
1307 {
1308 	struct malo_softc *sc = arg;
1309 
1310 	callout_reset(&sc->malo_watchdog_timer, hz, malo_watchdog, sc);
1311 	if (sc->malo_timer == 0 || --sc->malo_timer > 0)
1312 		return;
1313 
1314 	if (sc->malo_running && !sc->malo_invalid) {
1315 		device_printf(sc->malo_dev, "watchdog timeout\n");
1316 
1317 		/* XXX no way to reset h/w. now  */
1318 
1319 		counter_u64_add(sc->malo_ic.ic_oerrors, 1);
1320 		sc->malo_stats.mst_watchdog++;
1321 	}
1322 }
1323 
1324 static int
1325 malo_hal_reset(struct malo_softc *sc)
1326 {
1327 	static int first = 0;
1328 	struct ieee80211com *ic = &sc->malo_ic;
1329 	struct malo_hal *mh = sc->malo_mh;
1330 
1331 	if (first == 0) {
1332 		/*
1333 		 * NB: when the device firstly is initialized, sometimes
1334 		 * firmware could override rx/tx dma registers so we re-set
1335 		 * these values once.
1336 		 */
1337 		malo_hal_set_rxtxdma(sc);
1338 		first = 1;
1339 	}
1340 
1341 	malo_hal_setantenna(mh, MHA_ANTENNATYPE_RX, sc->malo_rxantenna);
1342 	malo_hal_setantenna(mh, MHA_ANTENNATYPE_TX, sc->malo_txantenna);
1343 	malo_hal_setradio(mh, 1, MHP_AUTO_PREAMBLE);
1344 	malo_chan_set(sc, ic->ic_curchan);
1345 
1346 	/* XXX needs other stuffs?  */
1347 
1348 	return 1;
1349 }
1350 
1351 static __inline struct mbuf *
1352 malo_getrxmbuf(struct malo_softc *sc, struct malo_rxbuf *bf)
1353 {
1354 	struct mbuf *m;
1355 	bus_addr_t paddr;
1356 	int error;
1357 
1358 	/* XXX don't need mbuf, just dma buffer */
1359 	m = m_getjcl(M_NOWAIT, MT_DATA, M_PKTHDR, MJUMPAGESIZE);
1360 	if (m == NULL) {
1361 		sc->malo_stats.mst_rx_nombuf++;	/* XXX */
1362 		return NULL;
1363 	}
1364 	error = bus_dmamap_load(sc->malo_dmat, bf->bf_dmamap,
1365 	    mtod(m, caddr_t), MJUMPAGESIZE,
1366 	    malo_load_cb, &paddr, BUS_DMA_NOWAIT);
1367 	if (error != 0) {
1368 		device_printf(sc->malo_dev,
1369 		    "%s: bus_dmamap_load failed, error %d\n", __func__, error);
1370 		m_freem(m);
1371 		return NULL;
1372 	}
1373 	bf->bf_data = paddr;
1374 	bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
1375 
1376 	return m;
1377 }
1378 
1379 static int
1380 malo_rxbuf_init(struct malo_softc *sc, struct malo_rxbuf *bf)
1381 {
1382 	struct malo_rxdesc *ds;
1383 
1384 	ds = bf->bf_desc;
1385 	if (bf->bf_m == NULL) {
1386 		bf->bf_m = malo_getrxmbuf(sc, bf);
1387 		if (bf->bf_m == NULL) {
1388 			/* mark descriptor to be skipped */
1389 			ds->rxcontrol = MALO_RXD_CTRL_OS_OWN;
1390 			/* NB: don't need PREREAD */
1391 			MALO_RXDESC_SYNC(sc, ds, BUS_DMASYNC_PREWRITE);
1392 			return ENOMEM;
1393 		}
1394 	}
1395 
1396 	/*
1397 	 * Setup descriptor.
1398 	 */
1399 	ds->qosctrl = 0;
1400 	ds->snr = 0;
1401 	ds->status = MALO_RXD_STATUS_IDLE;
1402 	ds->channel = 0;
1403 	ds->pktlen = htole16(MALO_RXSIZE);
1404 	ds->nf = 0;
1405 	ds->physbuffdata = htole32(bf->bf_data);
1406 	/* NB: don't touch pPhysNext, set once */
1407 	ds->rxcontrol = MALO_RXD_CTRL_DRIVER_OWN;
1408 	MALO_RXDESC_SYNC(sc, ds, BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
1409 
1410 	return 0;
1411 }
1412 
1413 /*
1414  * Setup the rx data structures.  This should only be done once or we may get
1415  * out of sync with the firmware.
1416  */
1417 static int
1418 malo_startrecv(struct malo_softc *sc)
1419 {
1420 	struct malo_rxbuf *bf, *prev;
1421 	struct malo_rxdesc *ds;
1422 
1423 	if (sc->malo_recvsetup == 1) {
1424 		malo_mode_init(sc);		/* set filters, etc. */
1425 		return 0;
1426 	}
1427 
1428 	prev = NULL;
1429 	STAILQ_FOREACH(bf, &sc->malo_rxbuf, bf_list) {
1430 		int error = malo_rxbuf_init(sc, bf);
1431 		if (error != 0) {
1432 			DPRINTF(sc, MALO_DEBUG_RECV,
1433 			    "%s: malo_rxbuf_init failed %d\n",
1434 			    __func__, error);
1435 			return error;
1436 		}
1437 		if (prev != NULL) {
1438 			ds = prev->bf_desc;
1439 			ds->physnext = htole32(bf->bf_daddr);
1440 		}
1441 		prev = bf;
1442 	}
1443 	if (prev != NULL) {
1444 		ds = prev->bf_desc;
1445 		ds->physnext =
1446 		    htole32(STAILQ_FIRST(&sc->malo_rxbuf)->bf_daddr);
1447 	}
1448 
1449 	sc->malo_recvsetup = 1;
1450 
1451 	malo_mode_init(sc);		/* set filters, etc. */
1452 
1453 	return 0;
1454 }
1455 
1456 static void
1457 malo_init_locked(struct malo_softc *sc)
1458 {
1459 	struct malo_hal *mh = sc->malo_mh;
1460 	int error;
1461 
1462 	MALO_LOCK_ASSERT(sc);
1463 
1464 	/*
1465 	 * Stop anything previously setup.  This is safe whether this is
1466 	 * the first time through or not.
1467 	 */
1468 	malo_stop(sc);
1469 
1470 	/*
1471 	 * Push state to the firmware.
1472 	 */
1473 	if (!malo_hal_reset(sc)) {
1474 		device_printf(sc->malo_dev,
1475 		    "%s: unable to reset hardware\n", __func__);
1476 		return;
1477 	}
1478 
1479 	/*
1480 	 * Setup recv (once); transmit is already good to go.
1481 	 */
1482 	error = malo_startrecv(sc);
1483 	if (error != 0) {
1484 		device_printf(sc->malo_dev,
1485 		    "%s: unable to start recv logic, error %d\n",
1486 		    __func__, error);
1487 		return;
1488 	}
1489 
1490 	/*
1491 	 * Enable interrupts.
1492 	 */
1493 	sc->malo_imask = MALO_A2HRIC_BIT_RX_RDY
1494 	    | MALO_A2HRIC_BIT_TX_DONE
1495 	    | MALO_A2HRIC_BIT_OPC_DONE
1496 	    | MALO_A2HRIC_BIT_MAC_EVENT
1497 	    | MALO_A2HRIC_BIT_RX_PROBLEM
1498 	    | MALO_A2HRIC_BIT_ICV_ERROR
1499 	    | MALO_A2HRIC_BIT_RADAR_DETECT
1500 	    | MALO_A2HRIC_BIT_CHAN_SWITCH;
1501 
1502 	sc->malo_running = 1;
1503 	malo_hal_intrset(mh, sc->malo_imask);
1504 	callout_reset(&sc->malo_watchdog_timer, hz, malo_watchdog, sc);
1505 }
1506 
1507 static void
1508 malo_init(void *arg)
1509 {
1510 	struct malo_softc *sc = (struct malo_softc *) arg;
1511 	struct ieee80211com *ic = &sc->malo_ic;
1512 
1513 	MALO_LOCK(sc);
1514 	malo_init_locked(sc);
1515 	MALO_UNLOCK(sc);
1516 
1517 	if (sc->malo_running)
1518 		ieee80211_start_all(ic);	/* start all vap's */
1519 }
1520 
1521 /*
1522  * Set the multicast filter contents into the hardware.
1523  */
1524 static void
1525 malo_setmcastfilter(struct malo_softc *sc)
1526 {
1527 	struct ieee80211com *ic = &sc->malo_ic;
1528 	struct ieee80211vap *vap;
1529 	uint8_t macs[IEEE80211_ADDR_LEN * MALO_HAL_MCAST_MAX];
1530 	uint8_t *mp;
1531 	int nmc;
1532 
1533 	mp = macs;
1534 	nmc = 0;
1535 
1536 	if (ic->ic_opmode == IEEE80211_M_MONITOR || ic->ic_allmulti > 0 ||
1537 	    ic->ic_promisc > 0)
1538 		goto all;
1539 
1540 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
1541 		struct ifnet *ifp;
1542 		struct ifmultiaddr *ifma;
1543 
1544 		ifp = vap->iv_ifp;
1545 		if_maddr_rlock(ifp);
1546 		TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
1547 			if (ifma->ifma_addr->sa_family != AF_LINK)
1548 				continue;
1549 
1550 			if (nmc == MALO_HAL_MCAST_MAX) {
1551 				ifp->if_flags |= IFF_ALLMULTI;
1552 				if_maddr_runlock(ifp);
1553 				goto all;
1554 			}
1555 			IEEE80211_ADDR_COPY(mp,
1556 			    LLADDR((struct sockaddr_dl *)ifma->ifma_addr));
1557 
1558 			mp += IEEE80211_ADDR_LEN, nmc++;
1559 		}
1560 		if_maddr_runlock(ifp);
1561 	}
1562 
1563 	malo_hal_setmcast(sc->malo_mh, nmc, macs);
1564 
1565 all:
1566 	/*
1567 	 * XXX we don't know how to set the f/w for supporting
1568 	 * IFF_ALLMULTI | IFF_PROMISC cases
1569 	 */
1570 	return;
1571 }
1572 
1573 static int
1574 malo_mode_init(struct malo_softc *sc)
1575 {
1576 	struct ieee80211com *ic = &sc->malo_ic;
1577 	struct malo_hal *mh = sc->malo_mh;
1578 
1579 	/*
1580 	 * NB: Ignore promisc in hostap mode; it's set by the
1581 	 * bridge.  This is wrong but we have no way to
1582 	 * identify internal requests (from the bridge)
1583 	 * versus external requests such as for tcpdump.
1584 	 */
1585 	malo_hal_setpromisc(mh, ic->ic_promisc > 0 &&
1586 	    ic->ic_opmode != IEEE80211_M_HOSTAP);
1587 	malo_setmcastfilter(sc);
1588 
1589 	return ENXIO;
1590 }
1591 
1592 static void
1593 malo_tx_draintxq(struct malo_softc *sc, struct malo_txq *txq)
1594 {
1595 	struct ieee80211_node *ni;
1596 	struct malo_txbuf *bf;
1597 	u_int ix;
1598 
1599 	/*
1600 	 * NB: this assumes output has been stopped and
1601 	 *     we do not need to block malo_tx_tasklet
1602 	 */
1603 	for (ix = 0;; ix++) {
1604 		MALO_TXQ_LOCK(txq);
1605 		bf = STAILQ_FIRST(&txq->active);
1606 		if (bf == NULL) {
1607 			MALO_TXQ_UNLOCK(txq);
1608 			break;
1609 		}
1610 		STAILQ_REMOVE_HEAD(&txq->active, bf_list);
1611 		MALO_TXQ_UNLOCK(txq);
1612 #ifdef MALO_DEBUG
1613 		if (sc->malo_debug & MALO_DEBUG_RESET) {
1614 			struct ieee80211com *ic = &sc->malo_ic;
1615 			const struct malo_txrec *tr =
1616 			    mtod(bf->bf_m, const struct malo_txrec *);
1617 			malo_printtxbuf(bf, txq->qnum, ix);
1618 			ieee80211_dump_pkt(ic, (const uint8_t *)&tr->wh,
1619 			    bf->bf_m->m_len - sizeof(tr->fwlen), 0, -1);
1620 		}
1621 #endif /* MALO_DEBUG */
1622 		bus_dmamap_unload(sc->malo_dmat, bf->bf_dmamap);
1623 		ni = bf->bf_node;
1624 		bf->bf_node = NULL;
1625 		if (ni != NULL) {
1626 			/*
1627 			 * Reclaim node reference.
1628 			 */
1629 			ieee80211_free_node(ni);
1630 		}
1631 		m_freem(bf->bf_m);
1632 		bf->bf_m = NULL;
1633 
1634 		MALO_TXQ_LOCK(txq);
1635 		STAILQ_INSERT_TAIL(&txq->free, bf, bf_list);
1636 		txq->nfree++;
1637 		MALO_TXQ_UNLOCK(txq);
1638 	}
1639 }
1640 
1641 static void
1642 malo_stop(struct malo_softc *sc)
1643 {
1644 	struct malo_hal *mh = sc->malo_mh;
1645 	int i;
1646 
1647 	DPRINTF(sc, MALO_DEBUG_ANY, "%s: invalid %u running %u\n",
1648 	    __func__, sc->malo_invalid, sc->malo_running);
1649 
1650 	MALO_LOCK_ASSERT(sc);
1651 
1652 	if (!sc->malo_running)
1653 		return;
1654 
1655 	/*
1656 	 * Shutdown the hardware and driver:
1657 	 *    disable interrupts
1658 	 *    turn off the radio
1659 	 *    drain and release tx queues
1660 	 *
1661 	 * Note that some of this work is not possible if the hardware
1662 	 * is gone (invalid).
1663 	 */
1664 	sc->malo_running = 0;
1665 	callout_stop(&sc->malo_watchdog_timer);
1666 	sc->malo_timer = 0;
1667 	/* disable interrupt.  */
1668 	malo_hal_intrset(mh, 0);
1669 	/* turn off the radio.  */
1670 	malo_hal_setradio(mh, 0, MHP_AUTO_PREAMBLE);
1671 
1672 	/* drain and release tx queues.  */
1673 	for (i = 0; i < MALO_NUM_TX_QUEUES; i++)
1674 		malo_tx_draintxq(sc, &sc->malo_txq[i]);
1675 }
1676 
1677 static void
1678 malo_parent(struct ieee80211com *ic)
1679 {
1680 	struct malo_softc *sc = ic->ic_softc;
1681 	int startall = 0;
1682 
1683 	MALO_LOCK(sc);
1684 	if (ic->ic_nrunning > 0) {
1685 		/*
1686 		 * Beware of being called during attach/detach
1687 		 * to reset promiscuous mode.  In that case we
1688 		 * will still be marked UP but not RUNNING.
1689 		 * However trying to re-init the interface
1690 		 * is the wrong thing to do as we've already
1691 		 * torn down much of our state.  There's
1692 		 * probably a better way to deal with this.
1693 		 */
1694 		if (!sc->malo_running && !sc->malo_invalid) {
1695 			malo_init(sc);
1696 			startall = 1;
1697 		}
1698 		/*
1699 		 * To avoid rescanning another access point,
1700 		 * do not call malo_init() here.  Instead,
1701 		 * only reflect promisc mode settings.
1702 		 */
1703 		malo_mode_init(sc);
1704 	} else if (sc->malo_running)
1705 		malo_stop(sc);
1706 	MALO_UNLOCK(sc);
1707 	if (startall)
1708 		ieee80211_start_all(ic);
1709 }
1710 
1711 /*
1712  * Callback from the 802.11 layer to update the slot time
1713  * based on the current setting.  We use it to notify the
1714  * firmware of ERP changes and the f/w takes care of things
1715  * like slot time and preamble.
1716  */
1717 static void
1718 malo_updateslot(struct ieee80211com *ic)
1719 {
1720 	struct malo_softc *sc = ic->ic_softc;
1721 	struct malo_hal *mh = sc->malo_mh;
1722 	int error;
1723 
1724 	/* NB: can be called early; suppress needless cmds */
1725 	if (!sc->malo_running)
1726 		return;
1727 
1728 	DPRINTF(sc, MALO_DEBUG_RESET,
1729 	    "%s: chan %u MHz/flags 0x%x %s slot, (ic_flags 0x%x)\n",
1730 	    __func__, ic->ic_curchan->ic_freq, ic->ic_curchan->ic_flags,
1731 	    ic->ic_flags & IEEE80211_F_SHSLOT ? "short" : "long", ic->ic_flags);
1732 
1733 	if (ic->ic_flags & IEEE80211_F_SHSLOT)
1734 		error = malo_hal_set_slot(mh, 1);
1735 	else
1736 		error = malo_hal_set_slot(mh, 0);
1737 
1738 	if (error != 0)
1739 		device_printf(sc->malo_dev, "setting %s slot failed\n",
1740 			ic->ic_flags & IEEE80211_F_SHSLOT ? "short" : "long");
1741 }
1742 
1743 static int
1744 malo_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1745 {
1746 	struct ieee80211com *ic = vap->iv_ic;
1747 	struct malo_softc *sc = ic->ic_softc;
1748 	struct malo_hal *mh = sc->malo_mh;
1749 	int error;
1750 
1751 	DPRINTF(sc, MALO_DEBUG_STATE, "%s: %s -> %s\n", __func__,
1752 	    ieee80211_state_name[vap->iv_state],
1753 	    ieee80211_state_name[nstate]);
1754 
1755 	/*
1756 	 * Invoke the net80211 layer first so iv_bss is setup.
1757 	 */
1758 	error = MALO_VAP(vap)->malo_newstate(vap, nstate, arg);
1759 	if (error != 0)
1760 		return error;
1761 
1762 	if (nstate == IEEE80211_S_RUN && vap->iv_state != IEEE80211_S_RUN) {
1763 		struct ieee80211_node *ni = vap->iv_bss;
1764 		enum ieee80211_phymode mode = ieee80211_chan2mode(ni->ni_chan);
1765 		const struct ieee80211_txparam *tp = &vap->iv_txparms[mode];
1766 
1767 		DPRINTF(sc, MALO_DEBUG_STATE,
1768 		    "%s: %s(RUN): iv_flags 0x%08x bintvl %d bssid %s "
1769 		    "capinfo 0x%04x chan %d associd 0x%x mode %d rate %d\n",
1770 		    vap->iv_ifp->if_xname, __func__, vap->iv_flags,
1771 		    ni->ni_intval, ether_sprintf(ni->ni_bssid), ni->ni_capinfo,
1772 		    ieee80211_chan2ieee(ic, ic->ic_curchan),
1773 		    ni->ni_associd, mode, tp->ucastrate);
1774 
1775 		malo_hal_setradio(mh, 1,
1776 		    (ic->ic_flags & IEEE80211_F_SHPREAMBLE) ?
1777 			MHP_SHORT_PREAMBLE : MHP_LONG_PREAMBLE);
1778 		malo_hal_setassocid(sc->malo_mh, ni->ni_bssid, ni->ni_associd);
1779 		malo_hal_set_rate(mh, mode,
1780 		   tp->ucastrate == IEEE80211_FIXED_RATE_NONE ?
1781 		       0 : malo_fix2rate(tp->ucastrate));
1782 	}
1783 	return 0;
1784 }
1785 
1786 static int
1787 malo_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1788 	const struct ieee80211_bpf_params *params)
1789 {
1790 	struct ieee80211com *ic = ni->ni_ic;
1791 	struct malo_softc *sc = ic->ic_softc;
1792 	struct malo_txbuf *bf;
1793 	struct malo_txq *txq;
1794 
1795 	if (!sc->malo_running || sc->malo_invalid) {
1796 		ieee80211_free_node(ni);
1797 		m_freem(m);
1798 		return ENETDOWN;
1799 	}
1800 
1801 	/*
1802 	 * Grab a TX buffer and associated resources.  Note that we depend
1803 	 * on the classification by the 802.11 layer to get to the right h/w
1804 	 * queue.  Management frames must ALWAYS go on queue 1 but we
1805 	 * cannot just force that here because we may receive non-mgt frames.
1806 	 */
1807 	txq = &sc->malo_txq[0];
1808 	bf = malo_getbuf(sc, txq);
1809 	if (bf == NULL) {
1810 		ieee80211_free_node(ni);
1811 		m_freem(m);
1812 		return ENOBUFS;
1813 	}
1814 
1815 	/*
1816 	 * Pass the frame to the h/w for transmission.
1817 	 */
1818 	if (malo_tx_start(sc, ni, bf, m) != 0) {
1819 		bf->bf_m = NULL;
1820 		bf->bf_node = NULL;
1821 		MALO_TXQ_LOCK(txq);
1822 		STAILQ_INSERT_HEAD(&txq->free, bf, bf_list);
1823 		txq->nfree++;
1824 		MALO_TXQ_UNLOCK(txq);
1825 
1826 		ieee80211_free_node(ni);
1827 		return EIO;		/* XXX */
1828 	}
1829 
1830 	/*
1831 	 * NB: We don't need to lock against tx done because this just
1832 	 * prods the firmware to check the transmit descriptors.  The firmware
1833 	 * will also start fetching descriptors by itself if it notices
1834 	 * new ones are present when it goes to deliver a tx done interrupt
1835 	 * to the host. So if we race with tx done processing it's ok.
1836 	 * Delivering the kick here rather than in malo_tx_start is
1837 	 * an optimization to avoid poking the firmware for each packet.
1838 	 *
1839 	 * NB: the queue id isn't used so 0 is ok.
1840 	 */
1841 	malo_hal_txstart(sc->malo_mh, 0/*XXX*/);
1842 
1843 	return 0;
1844 }
1845 
1846 static void
1847 malo_sysctlattach(struct malo_softc *sc)
1848 {
1849 #ifdef	MALO_DEBUG
1850 	struct sysctl_ctx_list *ctx = device_get_sysctl_ctx(sc->malo_dev);
1851 	struct sysctl_oid *tree = device_get_sysctl_tree(sc->malo_dev);
1852 
1853 	sc->malo_debug = malo_debug;
1854 	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
1855 		"debug", CTLFLAG_RW, &sc->malo_debug, 0,
1856 		"control debugging printfs");
1857 #endif
1858 }
1859 
1860 static void
1861 malo_announce(struct malo_softc *sc)
1862 {
1863 
1864 	device_printf(sc->malo_dev,
1865 		"versions [hw %d fw %d.%d.%d.%d] (regioncode %d)\n",
1866 		sc->malo_hwspecs.hwversion,
1867 		(sc->malo_hwspecs.fw_releasenum >> 24) & 0xff,
1868 		(sc->malo_hwspecs.fw_releasenum >> 16) & 0xff,
1869 		(sc->malo_hwspecs.fw_releasenum >> 8) & 0xff,
1870 		(sc->malo_hwspecs.fw_releasenum >> 0) & 0xff,
1871 		sc->malo_hwspecs.regioncode);
1872 
1873 	if (bootverbose || malo_rxbuf != MALO_RXBUF)
1874 		device_printf(sc->malo_dev,
1875 		    "using %u rx buffers\n", malo_rxbuf);
1876 	if (bootverbose || malo_txbuf != MALO_TXBUF)
1877 		device_printf(sc->malo_dev,
1878 		    "using %u tx buffers\n", malo_txbuf);
1879 }
1880 
1881 /*
1882  * Convert net80211 channel to a HAL channel.
1883  */
1884 static void
1885 malo_mapchan(struct malo_hal_channel *hc, const struct ieee80211_channel *chan)
1886 {
1887 	hc->channel = chan->ic_ieee;
1888 
1889 	*(uint32_t *)&hc->flags = 0;
1890 	if (IEEE80211_IS_CHAN_2GHZ(chan))
1891 		hc->flags.freqband = MALO_FREQ_BAND_2DOT4GHZ;
1892 }
1893 
1894 /*
1895  * Set/change channels.  If the channel is really being changed,
1896  * it's done by reseting the chip.  To accomplish this we must
1897  * first cleanup any pending DMA, then restart stuff after a la
1898  * malo_init.
1899  */
1900 static int
1901 malo_chan_set(struct malo_softc *sc, struct ieee80211_channel *chan)
1902 {
1903 	struct malo_hal *mh = sc->malo_mh;
1904 	struct malo_hal_channel hchan;
1905 
1906 	DPRINTF(sc, MALO_DEBUG_RESET, "%s: chan %u MHz/flags 0x%x\n",
1907 	    __func__, chan->ic_freq, chan->ic_flags);
1908 
1909 	/*
1910 	 * Convert to a HAL channel description with the flags constrained
1911 	 * to reflect the current operating mode.
1912 	 */
1913 	malo_mapchan(&hchan, chan);
1914 	malo_hal_intrset(mh, 0);		/* disable interrupts */
1915 	malo_hal_setchannel(mh, &hchan);
1916 	malo_hal_settxpower(mh, &hchan);
1917 
1918 	/*
1919 	 * Update internal state.
1920 	 */
1921 	sc->malo_tx_th.wt_chan_freq = htole16(chan->ic_freq);
1922 	sc->malo_rx_th.wr_chan_freq = htole16(chan->ic_freq);
1923 	if (IEEE80211_IS_CHAN_ANYG(chan)) {
1924 		sc->malo_tx_th.wt_chan_flags = htole16(IEEE80211_CHAN_G);
1925 		sc->malo_rx_th.wr_chan_flags = htole16(IEEE80211_CHAN_G);
1926 	} else {
1927 		sc->malo_tx_th.wt_chan_flags = htole16(IEEE80211_CHAN_B);
1928 		sc->malo_rx_th.wr_chan_flags = htole16(IEEE80211_CHAN_B);
1929 	}
1930 	sc->malo_curchan = hchan;
1931 	malo_hal_intrset(mh, sc->malo_imask);
1932 
1933 	return 0;
1934 }
1935 
1936 static void
1937 malo_scan_start(struct ieee80211com *ic)
1938 {
1939 	struct malo_softc *sc = ic->ic_softc;
1940 
1941 	DPRINTF(sc, MALO_DEBUG_STATE, "%s\n", __func__);
1942 }
1943 
1944 static void
1945 malo_scan_end(struct ieee80211com *ic)
1946 {
1947 	struct malo_softc *sc = ic->ic_softc;
1948 
1949 	DPRINTF(sc, MALO_DEBUG_STATE, "%s\n", __func__);
1950 }
1951 
1952 static void
1953 malo_set_channel(struct ieee80211com *ic)
1954 {
1955 	struct malo_softc *sc = ic->ic_softc;
1956 
1957 	(void) malo_chan_set(sc, ic->ic_curchan);
1958 }
1959 
1960 static void
1961 malo_rx_proc(void *arg, int npending)
1962 {
1963 #define	IEEE80211_DIR_DSTODS(wh)					\
1964 	((((const struct ieee80211_frame *)wh)->i_fc[1] &		\
1965 	    IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS)
1966 	struct malo_softc *sc = arg;
1967 	struct ieee80211com *ic = &sc->malo_ic;
1968 	struct malo_rxbuf *bf;
1969 	struct malo_rxdesc *ds;
1970 	struct mbuf *m, *mnew;
1971 	struct ieee80211_qosframe *wh;
1972 	struct ieee80211_qosframe_addr4 *wh4;
1973 	struct ieee80211_node *ni;
1974 	int off, len, hdrlen, pktlen, rssi, ntodo;
1975 	uint8_t *data, status;
1976 	uint32_t readptr, writeptr;
1977 
1978 	DPRINTF(sc, MALO_DEBUG_RX_PROC,
1979 	    "%s: pending %u rdptr(0x%x) 0x%x wrptr(0x%x) 0x%x\n",
1980 	    __func__, npending,
1981 	    sc->malo_hwspecs.rxdesc_read,
1982 	    malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_read),
1983 	    sc->malo_hwspecs.rxdesc_write,
1984 	    malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_write));
1985 
1986 	readptr = malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_read);
1987 	writeptr = malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_write);
1988 	if (readptr == writeptr)
1989 		return;
1990 
1991 	bf = sc->malo_rxnext;
1992 	for (ntodo = malo_rxquota; ntodo > 0 && readptr != writeptr; ntodo--) {
1993 		if (bf == NULL) {
1994 			bf = STAILQ_FIRST(&sc->malo_rxbuf);
1995 			break;
1996 		}
1997 		ds = bf->bf_desc;
1998 		if (bf->bf_m == NULL) {
1999 			/*
2000 			 * If data allocation failed previously there
2001 			 * will be no buffer; try again to re-populate it.
2002 			 * Note the firmware will not advance to the next
2003 			 * descriptor with a dma buffer so we must mimic
2004 			 * this or we'll get out of sync.
2005 			 */
2006 			DPRINTF(sc, MALO_DEBUG_ANY,
2007 			    "%s: rx buf w/o dma memory\n", __func__);
2008 			(void)malo_rxbuf_init(sc, bf);
2009 			break;
2010 		}
2011 		MALO_RXDESC_SYNC(sc, ds,
2012 		    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
2013 		if (ds->rxcontrol != MALO_RXD_CTRL_DMA_OWN)
2014 			break;
2015 
2016 		readptr = le32toh(ds->physnext);
2017 
2018 #ifdef MALO_DEBUG
2019 		if (sc->malo_debug & MALO_DEBUG_RECV_DESC)
2020 			malo_printrxbuf(bf, 0);
2021 #endif
2022 		status = ds->status;
2023 		if (status & MALO_RXD_STATUS_DECRYPT_ERR_MASK) {
2024 			counter_u64_add(ic->ic_ierrors, 1);
2025 			goto rx_next;
2026 		}
2027 		/*
2028 		 * Sync the data buffer.
2029 		 */
2030 		len = le16toh(ds->pktlen);
2031 		bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap,
2032 		    BUS_DMASYNC_POSTREAD);
2033 		/*
2034 		 * The 802.11 header is provided all or in part at the front;
2035 		 * use it to calculate the true size of the header that we'll
2036 		 * construct below.  We use this to figure out where to copy
2037 		 * payload prior to constructing the header.
2038 		 */
2039 		m = bf->bf_m;
2040 		data = mtod(m, uint8_t *);
2041 		hdrlen = ieee80211_anyhdrsize(data + sizeof(uint16_t));
2042 		off = sizeof(uint16_t) + sizeof(struct ieee80211_frame_addr4);
2043 
2044 		/*
2045 		 * Calculate RSSI. XXX wrong
2046 		 */
2047 		rssi = 2 * ((int) ds->snr - ds->nf);	/* NB: .5 dBm  */
2048 		if (rssi > 100)
2049 			rssi = 100;
2050 
2051 		pktlen = hdrlen + (len - off);
2052 		/*
2053 		 * NB: we know our frame is at least as large as
2054 		 * IEEE80211_MIN_LEN because there is a 4-address frame at
2055 		 * the front.  Hence there's no need to vet the packet length.
2056 		 * If the frame in fact is too small it should be discarded
2057 		 * at the net80211 layer.
2058 		 */
2059 
2060 		/* XXX don't need mbuf, just dma buffer */
2061 		mnew = malo_getrxmbuf(sc, bf);
2062 		if (mnew == NULL) {
2063 			counter_u64_add(ic->ic_ierrors, 1);
2064 			goto rx_next;
2065 		}
2066 		/*
2067 		 * Attach the dma buffer to the mbuf; malo_rxbuf_init will
2068 		 * re-setup the rx descriptor using the replacement dma
2069 		 * buffer we just installed above.
2070 		 */
2071 		bf->bf_m = mnew;
2072 		m->m_data += off - hdrlen;
2073 		m->m_pkthdr.len = m->m_len = pktlen;
2074 
2075 		/*
2076 		 * Piece 802.11 header together.
2077 		 */
2078 		wh = mtod(m, struct ieee80211_qosframe *);
2079 		/* NB: don't need to do this sometimes but ... */
2080 		/* XXX special case so we can memcpy after m_devget? */
2081 		ovbcopy(data + sizeof(uint16_t), wh, hdrlen);
2082 		if (IEEE80211_QOS_HAS_SEQ(wh)) {
2083 			if (IEEE80211_DIR_DSTODS(wh)) {
2084 				wh4 = mtod(m,
2085 				    struct ieee80211_qosframe_addr4*);
2086 				*(uint16_t *)wh4->i_qos = ds->qosctrl;
2087 			} else {
2088 				*(uint16_t *)wh->i_qos = ds->qosctrl;
2089 			}
2090 		}
2091 		if (ieee80211_radiotap_active(ic)) {
2092 			sc->malo_rx_th.wr_flags = 0;
2093 			sc->malo_rx_th.wr_rate = ds->rate;
2094 			sc->malo_rx_th.wr_antsignal = rssi;
2095 			sc->malo_rx_th.wr_antnoise = ds->nf;
2096 		}
2097 #ifdef MALO_DEBUG
2098 		if (IFF_DUMPPKTS_RECV(sc, wh)) {
2099 			ieee80211_dump_pkt(ic, mtod(m, caddr_t),
2100 			    len, ds->rate, rssi);
2101 		}
2102 #endif
2103 		/* dispatch */
2104 		ni = ieee80211_find_rxnode(ic,
2105 		    (struct ieee80211_frame_min *)wh);
2106 		if (ni != NULL) {
2107 			(void) ieee80211_input(ni, m, rssi, ds->nf);
2108 			ieee80211_free_node(ni);
2109 		} else
2110 			(void) ieee80211_input_all(ic, m, rssi, ds->nf);
2111 rx_next:
2112 		/* NB: ignore ENOMEM so we process more descriptors */
2113 		(void) malo_rxbuf_init(sc, bf);
2114 		bf = STAILQ_NEXT(bf, bf_list);
2115 	}
2116 
2117 	malo_bar0_write4(sc, sc->malo_hwspecs.rxdesc_read, readptr);
2118 	sc->malo_rxnext = bf;
2119 
2120 	if (mbufq_first(&sc->malo_snd) != NULL)
2121 		malo_start(sc);
2122 #undef IEEE80211_DIR_DSTODS
2123 }
2124 
2125 /*
2126  * Reclaim all tx queue resources.
2127  */
2128 static void
2129 malo_tx_cleanup(struct malo_softc *sc)
2130 {
2131 	int i;
2132 
2133 	for (i = 0; i < MALO_NUM_TX_QUEUES; i++)
2134 		malo_tx_cleanupq(sc, &sc->malo_txq[i]);
2135 }
2136 
2137 int
2138 malo_detach(struct malo_softc *sc)
2139 {
2140 	struct ieee80211com *ic = &sc->malo_ic;
2141 
2142 	malo_stop(sc);
2143 
2144 	if (sc->malo_tq != NULL) {
2145 		taskqueue_drain(sc->malo_tq, &sc->malo_rxtask);
2146 		taskqueue_drain(sc->malo_tq, &sc->malo_txtask);
2147 		taskqueue_free(sc->malo_tq);
2148 		sc->malo_tq = NULL;
2149 	}
2150 
2151 	/*
2152 	 * NB: the order of these is important:
2153 	 * o call the 802.11 layer before detaching the hal to
2154 	 *   insure callbacks into the driver to delete global
2155 	 *   key cache entries can be handled
2156 	 * o reclaim the tx queue data structures after calling
2157 	 *   the 802.11 layer as we'll get called back to reclaim
2158 	 *   node state and potentially want to use them
2159 	 * o to cleanup the tx queues the hal is called, so detach
2160 	 *   it last
2161 	 * Other than that, it's straightforward...
2162 	 */
2163 	ieee80211_ifdetach(ic);
2164 	callout_drain(&sc->malo_watchdog_timer);
2165 	malo_dma_cleanup(sc);
2166 	malo_tx_cleanup(sc);
2167 	malo_hal_detach(sc->malo_mh);
2168 	mbufq_drain(&sc->malo_snd);
2169 	MALO_LOCK_DESTROY(sc);
2170 
2171 	return 0;
2172 }
2173 
2174 void
2175 malo_shutdown(struct malo_softc *sc)
2176 {
2177 
2178 	malo_stop(sc);
2179 }
2180 
2181 void
2182 malo_suspend(struct malo_softc *sc)
2183 {
2184 
2185 	malo_stop(sc);
2186 }
2187 
2188 void
2189 malo_resume(struct malo_softc *sc)
2190 {
2191 
2192 	if (sc->malo_ic.ic_nrunning > 0)
2193 		malo_init(sc);
2194 }
2195