xref: /freebsd/sys/dev/malo/if_malo.c (revision a223d3ed90bfe313ce5987d468a25a915d7d1254)
1 /*-
2  * Copyright (c) 2008 Weongyo Jeong <weongyo@freebsd.org>
3  * Copyright (c) 2007 Marvell Semiconductor, Inc.
4  * Copyright (c) 2007 Sam Leffler, Errno Consulting
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer,
12  *    without modification.
13  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
14  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
15  *    redistribution must be conditioned upon including a substantially
16  *    similar Disclaimer requirement for further binary redistribution.
17  *
18  * NO WARRANTY
19  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
22  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
23  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
24  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
27  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
29  * THE POSSIBILITY OF SUCH DAMAGES.
30  */
31 
32 #include <sys/cdefs.h>
33 #ifdef __FreeBSD__
34 __FBSDID("$FreeBSD$");
35 #endif
36 
37 #include "opt_malo.h"
38 
39 #include <sys/param.h>
40 #include <sys/endian.h>
41 #include <sys/kernel.h>
42 #include <sys/socket.h>
43 #include <sys/sockio.h>
44 #include <sys/sysctl.h>
45 #include <sys/taskqueue.h>
46 
47 #include <machine/bus.h>
48 #include <sys/bus.h>
49 
50 #include <net/if.h>
51 #include <net/if_var.h>
52 #include <net/if_dl.h>
53 #include <net/if_media.h>
54 #include <net/if_types.h>
55 #include <net/ethernet.h>
56 
57 #include <net80211/ieee80211_var.h>
58 #include <net80211/ieee80211_regdomain.h>
59 
60 #include <net/bpf.h>
61 
62 #include <dev/malo/if_malo.h>
63 
64 SYSCTL_NODE(_hw, OID_AUTO, malo, CTLFLAG_RD, 0,
65     "Marvell 88w8335 driver parameters");
66 
67 static	int malo_txcoalesce = 8;	/* # tx pkts to q before poking f/w*/
68 SYSCTL_INT(_hw_malo, OID_AUTO, txcoalesce, CTLFLAG_RW, &malo_txcoalesce,
69 	    0, "tx buffers to send at once");
70 TUNABLE_INT("hw.malo.txcoalesce", &malo_txcoalesce);
71 static	int malo_rxbuf = MALO_RXBUF;		/* # rx buffers to allocate */
72 SYSCTL_INT(_hw_malo, OID_AUTO, rxbuf, CTLFLAG_RW, &malo_rxbuf,
73 	    0, "rx buffers allocated");
74 TUNABLE_INT("hw.malo.rxbuf", &malo_rxbuf);
75 static	int malo_rxquota = MALO_RXBUF;		/* # max buffers to process */
76 SYSCTL_INT(_hw_malo, OID_AUTO, rxquota, CTLFLAG_RW, &malo_rxquota,
77 	    0, "max rx buffers to process per interrupt");
78 TUNABLE_INT("hw.malo.rxquota", &malo_rxquota);
79 static	int malo_txbuf = MALO_TXBUF;		/* # tx buffers to allocate */
80 SYSCTL_INT(_hw_malo, OID_AUTO, txbuf, CTLFLAG_RW, &malo_txbuf,
81 	    0, "tx buffers allocated");
82 TUNABLE_INT("hw.malo.txbuf", &malo_txbuf);
83 
84 #ifdef MALO_DEBUG
85 static	int malo_debug = 0;
86 SYSCTL_INT(_hw_malo, OID_AUTO, debug, CTLFLAG_RW, &malo_debug,
87 	    0, "control debugging printfs");
88 TUNABLE_INT("hw.malo.debug", &malo_debug);
89 enum {
90 	MALO_DEBUG_XMIT		= 0x00000001,	/* basic xmit operation */
91 	MALO_DEBUG_XMIT_DESC	= 0x00000002,	/* xmit descriptors */
92 	MALO_DEBUG_RECV		= 0x00000004,	/* basic recv operation */
93 	MALO_DEBUG_RECV_DESC	= 0x00000008,	/* recv descriptors */
94 	MALO_DEBUG_RESET	= 0x00000010,	/* reset processing */
95 	MALO_DEBUG_INTR		= 0x00000040,	/* ISR */
96 	MALO_DEBUG_TX_PROC	= 0x00000080,	/* tx ISR proc */
97 	MALO_DEBUG_RX_PROC	= 0x00000100,	/* rx ISR proc */
98 	MALO_DEBUG_STATE	= 0x00000400,	/* 802.11 state transitions */
99 	MALO_DEBUG_NODE		= 0x00000800,	/* node management */
100 	MALO_DEBUG_RECV_ALL	= 0x00001000,	/* trace all frames (beacons) */
101 	MALO_DEBUG_FW		= 0x00008000,	/* firmware */
102 	MALO_DEBUG_ANY		= 0xffffffff
103 };
104 #define	IS_BEACON(wh)							\
105 	((wh->i_fc[0] & (IEEE80211_FC0_TYPE_MASK |			\
106 		IEEE80211_FC0_SUBTYPE_MASK)) ==				\
107 	 (IEEE80211_FC0_TYPE_MGT|IEEE80211_FC0_SUBTYPE_BEACON))
108 #define	IFF_DUMPPKTS_RECV(sc, wh)					\
109 	(((sc->malo_debug & MALO_DEBUG_RECV) &&				\
110 	  ((sc->malo_debug & MALO_DEBUG_RECV_ALL) || !IS_BEACON(wh))) || \
111 	 (sc->malo_ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==		\
112 	  (IFF_DEBUG|IFF_LINK2))
113 #define	IFF_DUMPPKTS_XMIT(sc)						\
114 	((sc->malo_debug & MALO_DEBUG_XMIT) ||				\
115 	 (sc->malo_ifp->if_flags & (IFF_DEBUG | IFF_LINK2)) ==		\
116 	     (IFF_DEBUG | IFF_LINK2))
117 #define	DPRINTF(sc, m, fmt, ...) do {				\
118 	if (sc->malo_debug & (m))				\
119 		printf(fmt, __VA_ARGS__);			\
120 } while (0)
121 #else
122 #define	DPRINTF(sc, m, fmt, ...) do {				\
123 	(void) sc;						\
124 } while (0)
125 #endif
126 
127 static MALLOC_DEFINE(M_MALODEV, "malodev", "malo driver dma buffers");
128 
129 static struct ieee80211vap *malo_vap_create(struct ieee80211com *,
130 		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
131 		    const uint8_t [IEEE80211_ADDR_LEN],
132 		    const uint8_t [IEEE80211_ADDR_LEN]);
133 static  void	malo_vap_delete(struct ieee80211vap *);
134 static	int	malo_dma_setup(struct malo_softc *);
135 static	int	malo_setup_hwdma(struct malo_softc *);
136 static	void	malo_txq_init(struct malo_softc *, struct malo_txq *, int);
137 static	void	malo_tx_cleanupq(struct malo_softc *, struct malo_txq *);
138 static	void	malo_start(struct ifnet *);
139 static	void	malo_watchdog(void *);
140 static	int	malo_ioctl(struct ifnet *, u_long, caddr_t);
141 static	void	malo_updateslot(struct ifnet *);
142 static	int	malo_newstate(struct ieee80211vap *, enum ieee80211_state, int);
143 static	void	malo_scan_start(struct ieee80211com *);
144 static	void	malo_scan_end(struct ieee80211com *);
145 static	void	malo_set_channel(struct ieee80211com *);
146 static	int	malo_raw_xmit(struct ieee80211_node *, struct mbuf *,
147 		    const struct ieee80211_bpf_params *);
148 static	void	malo_sysctlattach(struct malo_softc *);
149 static	void	malo_announce(struct malo_softc *);
150 static	void	malo_dma_cleanup(struct malo_softc *);
151 static	void	malo_stop_locked(struct ifnet *, int);
152 static	int	malo_chan_set(struct malo_softc *, struct ieee80211_channel *);
153 static	int	malo_mode_init(struct malo_softc *);
154 static	void	malo_tx_proc(void *, int);
155 static	void	malo_rx_proc(void *, int);
156 static	void	malo_init(void *);
157 
158 /*
159  * Read/Write shorthands for accesses to BAR 0.  Note that all BAR 1
160  * operations are done in the "hal" except getting H/W MAC address at
161  * malo_attach and there should be no reference to them here.
162  */
163 static uint32_t
164 malo_bar0_read4(struct malo_softc *sc, bus_size_t off)
165 {
166 	return bus_space_read_4(sc->malo_io0t, sc->malo_io0h, off);
167 }
168 
169 static void
170 malo_bar0_write4(struct malo_softc *sc, bus_size_t off, uint32_t val)
171 {
172 	DPRINTF(sc, MALO_DEBUG_FW, "%s: off 0x%jx val 0x%x\n",
173 	    __func__, (intmax_t)off, val);
174 
175 	bus_space_write_4(sc->malo_io0t, sc->malo_io0h, off, val);
176 }
177 
178 int
179 malo_attach(uint16_t devid, struct malo_softc *sc)
180 {
181 	int error;
182 	struct ieee80211com *ic;
183 	struct ifnet *ifp;
184 	struct malo_hal *mh;
185 	uint8_t bands;
186 
187 	ifp = sc->malo_ifp = if_alloc(IFT_IEEE80211);
188 	if (ifp == NULL) {
189 		device_printf(sc->malo_dev, "can not if_alloc()\n");
190 		return ENOSPC;
191 	}
192 	ic = ifp->if_l2com;
193 
194 	MALO_LOCK_INIT(sc);
195 	callout_init_mtx(&sc->malo_watchdog_timer, &sc->malo_mtx, 0);
196 
197 	/* set these up early for if_printf use */
198 	if_initname(ifp, device_get_name(sc->malo_dev),
199 	    device_get_unit(sc->malo_dev));
200 
201 	mh = malo_hal_attach(sc->malo_dev, devid,
202 	    sc->malo_io1h, sc->malo_io1t, sc->malo_dmat);
203 	if (mh == NULL) {
204 		if_printf(ifp, "unable to attach HAL\n");
205 		error = EIO;
206 		goto bad;
207 	}
208 	sc->malo_mh = mh;
209 
210 	/*
211 	 * Load firmware so we can get setup.  We arbitrarily pick station
212 	 * firmware; we'll re-load firmware as needed so setting up
213 	 * the wrong mode isn't a big deal.
214 	 */
215 	error = malo_hal_fwload(mh, "malo8335-h", "malo8335-m");
216 	if (error != 0) {
217 		if_printf(ifp, "unable to setup firmware\n");
218 		goto bad1;
219 	}
220 	/* XXX gethwspecs() extracts correct informations?  not maybe!  */
221 	error = malo_hal_gethwspecs(mh, &sc->malo_hwspecs);
222 	if (error != 0) {
223 		if_printf(ifp, "unable to fetch h/w specs\n");
224 		goto bad1;
225 	}
226 
227 	DPRINTF(sc, MALO_DEBUG_FW,
228 	    "malo_hal_gethwspecs: hwversion 0x%x hostif 0x%x"
229 	    "maxnum_wcb 0x%x maxnum_mcaddr 0x%x maxnum_tx_wcb 0x%x"
230 	    "regioncode 0x%x num_antenna 0x%x fw_releasenum 0x%x"
231 	    "wcbbase0 0x%x rxdesc_read 0x%x rxdesc_write 0x%x"
232 	    "ul_fw_awakecookie 0x%x w[4] = %x %x %x %x",
233 	    sc->malo_hwspecs.hwversion,
234 	    sc->malo_hwspecs.hostinterface, sc->malo_hwspecs.maxnum_wcb,
235 	    sc->malo_hwspecs.maxnum_mcaddr, sc->malo_hwspecs.maxnum_tx_wcb,
236 	    sc->malo_hwspecs.regioncode, sc->malo_hwspecs.num_antenna,
237 	    sc->malo_hwspecs.fw_releasenum, sc->malo_hwspecs.wcbbase0,
238 	    sc->malo_hwspecs.rxdesc_read, sc->malo_hwspecs.rxdesc_write,
239 	    sc->malo_hwspecs.ul_fw_awakecookie,
240 	    sc->malo_hwspecs.wcbbase[0], sc->malo_hwspecs.wcbbase[1],
241 	    sc->malo_hwspecs.wcbbase[2], sc->malo_hwspecs.wcbbase[3]);
242 
243 	/* NB: firmware looks that it does not export regdomain info API.  */
244 	bands = 0;
245 	setbit(&bands, IEEE80211_MODE_11B);
246 	setbit(&bands, IEEE80211_MODE_11G);
247 	ieee80211_init_channels(ic, NULL, &bands);
248 
249 	sc->malo_txantenna = 0x2;	/* h/w default */
250 	sc->malo_rxantenna = 0xffff;	/* h/w default */
251 
252 	/*
253 	 * Allocate tx + rx descriptors and populate the lists.
254 	 * We immediately push the information to the firmware
255 	 * as otherwise it gets upset.
256 	 */
257 	error = malo_dma_setup(sc);
258 	if (error != 0) {
259 		if_printf(ifp, "failed to setup descriptors: %d\n", error);
260 		goto bad1;
261 	}
262 	error = malo_setup_hwdma(sc);	/* push to firmware */
263 	if (error != 0)			/* NB: malo_setupdma prints msg */
264 		goto bad2;
265 
266 	sc->malo_tq = taskqueue_create_fast("malo_taskq", M_NOWAIT,
267 		taskqueue_thread_enqueue, &sc->malo_tq);
268 	taskqueue_start_threads(&sc->malo_tq, 1, PI_NET,
269 		"%s taskq", ifp->if_xname);
270 
271 	TASK_INIT(&sc->malo_rxtask, 0, malo_rx_proc, sc);
272 	TASK_INIT(&sc->malo_txtask, 0, malo_tx_proc, sc);
273 
274 	ifp->if_softc = sc;
275 	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST;
276 	ifp->if_start = malo_start;
277 	ifp->if_ioctl = malo_ioctl;
278 	ifp->if_init = malo_init;
279 	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
280 	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
281 	IFQ_SET_READY(&ifp->if_snd);
282 
283 	ic->ic_ifp = ifp;
284 	/* XXX not right but it's not used anywhere important */
285 	ic->ic_phytype = IEEE80211_T_OFDM;
286 	ic->ic_opmode = IEEE80211_M_STA;
287 	ic->ic_caps =
288 	      IEEE80211_C_STA			/* station mode supported */
289 	    | IEEE80211_C_BGSCAN		/* capable of bg scanning */
290 	    | IEEE80211_C_MONITOR		/* monitor mode */
291 	    | IEEE80211_C_SHPREAMBLE		/* short preamble supported */
292 	    | IEEE80211_C_SHSLOT		/* short slot time supported */
293 	    | IEEE80211_C_TXPMGT		/* capable of txpow mgt */
294 	    | IEEE80211_C_WPA			/* capable of WPA1+WPA2 */
295 	    ;
296 
297 	/*
298 	 * Transmit requires space in the packet for a special format transmit
299 	 * record and optional padding between this record and the payload.
300 	 * Ask the net80211 layer to arrange this when encapsulating
301 	 * packets so we can add it efficiently.
302 	 */
303 	ic->ic_headroom = sizeof(struct malo_txrec) -
304 		sizeof(struct ieee80211_frame);
305 
306 	/* call MI attach routine. */
307 	ieee80211_ifattach(ic, sc->malo_hwspecs.macaddr);
308 	/* override default methods */
309 	ic->ic_vap_create = malo_vap_create;
310 	ic->ic_vap_delete = malo_vap_delete;
311 	ic->ic_raw_xmit = malo_raw_xmit;
312 	ic->ic_updateslot = malo_updateslot;
313 
314 	ic->ic_scan_start = malo_scan_start;
315 	ic->ic_scan_end = malo_scan_end;
316 	ic->ic_set_channel = malo_set_channel;
317 
318 	sc->malo_invalid = 0;		/* ready to go, enable int handling */
319 
320 	ieee80211_radiotap_attach(ic,
321 	    &sc->malo_tx_th.wt_ihdr, sizeof(sc->malo_tx_th),
322 		MALO_TX_RADIOTAP_PRESENT,
323 	    &sc->malo_rx_th.wr_ihdr, sizeof(sc->malo_rx_th),
324 		MALO_RX_RADIOTAP_PRESENT);
325 
326 	/*
327 	 * Setup dynamic sysctl's.
328 	 */
329 	malo_sysctlattach(sc);
330 
331 	if (bootverbose)
332 		ieee80211_announce(ic);
333 	malo_announce(sc);
334 
335 	return 0;
336 bad2:
337 	malo_dma_cleanup(sc);
338 bad1:
339 	malo_hal_detach(mh);
340 bad:
341 	if_free(ifp);
342 	sc->malo_invalid = 1;
343 
344 	return error;
345 }
346 
347 static struct ieee80211vap *
348 malo_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
349     enum ieee80211_opmode opmode, int flags,
350     const uint8_t bssid[IEEE80211_ADDR_LEN],
351     const uint8_t mac[IEEE80211_ADDR_LEN])
352 {
353 	struct ifnet *ifp = ic->ic_ifp;
354 	struct malo_vap *mvp;
355 	struct ieee80211vap *vap;
356 
357 	if (!TAILQ_EMPTY(&ic->ic_vaps)) {
358 		if_printf(ifp, "multiple vaps not supported\n");
359 		return NULL;
360 	}
361 	switch (opmode) {
362 	case IEEE80211_M_STA:
363 		if (opmode == IEEE80211_M_STA)
364 			flags |= IEEE80211_CLONE_NOBEACONS;
365 		/* fall thru... */
366 	case IEEE80211_M_MONITOR:
367 		break;
368 	default:
369 		if_printf(ifp, "%s mode not supported\n",
370 		    ieee80211_opmode_name[opmode]);
371 		return NULL;		/* unsupported */
372 	}
373 	mvp = (struct malo_vap *) malloc(sizeof(struct malo_vap),
374 	    M_80211_VAP, M_NOWAIT | M_ZERO);
375 	if (mvp == NULL) {
376 		if_printf(ifp, "cannot allocate vap state block\n");
377 		return NULL;
378 	}
379 	vap = &mvp->malo_vap;
380 	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid, mac);
381 
382 	/* override state transition machine */
383 	mvp->malo_newstate = vap->iv_newstate;
384 	vap->iv_newstate = malo_newstate;
385 
386 	/* complete setup */
387 	ieee80211_vap_attach(vap,
388 	    ieee80211_media_change, ieee80211_media_status);
389 	ic->ic_opmode = opmode;
390 	return vap;
391 }
392 
393 static void
394 malo_vap_delete(struct ieee80211vap *vap)
395 {
396 	struct malo_vap *mvp = MALO_VAP(vap);
397 
398 	ieee80211_vap_detach(vap);
399 	free(mvp, M_80211_VAP);
400 }
401 
402 int
403 malo_intr(void *arg)
404 {
405 	struct malo_softc *sc = arg;
406 	struct malo_hal *mh = sc->malo_mh;
407 	uint32_t status;
408 
409 	if (sc->malo_invalid) {
410 		/*
411 		 * The hardware is not ready/present, don't touch anything.
412 		 * Note this can happen early on if the IRQ is shared.
413 		 */
414 		DPRINTF(sc, MALO_DEBUG_ANY, "%s: invalid; ignored\n", __func__);
415 		return (FILTER_STRAY);
416 	}
417 
418 	/*
419 	 * Figure out the reason(s) for the interrupt.
420 	 */
421 	malo_hal_getisr(mh, &status);		/* NB: clears ISR too */
422 	if (status == 0)			/* must be a shared irq */
423 		return (FILTER_STRAY);
424 
425 	DPRINTF(sc, MALO_DEBUG_INTR, "%s: status 0x%x imask 0x%x\n",
426 	    __func__, status, sc->malo_imask);
427 
428 	if (status & MALO_A2HRIC_BIT_RX_RDY)
429 		taskqueue_enqueue_fast(sc->malo_tq, &sc->malo_rxtask);
430 	if (status & MALO_A2HRIC_BIT_TX_DONE)
431 		taskqueue_enqueue_fast(sc->malo_tq, &sc->malo_txtask);
432 	if (status & MALO_A2HRIC_BIT_OPC_DONE)
433 		malo_hal_cmddone(mh);
434 	if (status & MALO_A2HRIC_BIT_MAC_EVENT)
435 		;
436 	if (status & MALO_A2HRIC_BIT_RX_PROBLEM)
437 		;
438 	if (status & MALO_A2HRIC_BIT_ICV_ERROR) {
439 		/* TKIP ICV error */
440 		sc->malo_stats.mst_rx_badtkipicv++;
441 	}
442 #ifdef MALO_DEBUG
443 	if (((status | sc->malo_imask) ^ sc->malo_imask) != 0)
444 		DPRINTF(sc, MALO_DEBUG_INTR,
445 		    "%s: can't handle interrupt status 0x%x\n",
446 		    __func__, status);
447 #endif
448 	return (FILTER_HANDLED);
449 }
450 
451 static void
452 malo_load_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
453 {
454 	bus_addr_t *paddr = (bus_addr_t*) arg;
455 
456 	KASSERT(error == 0, ("error %u on bus_dma callback", error));
457 
458 	*paddr = segs->ds_addr;
459 }
460 
461 static int
462 malo_desc_setup(struct malo_softc *sc, const char *name,
463     struct malo_descdma *dd,
464     int nbuf, size_t bufsize, int ndesc, size_t descsize)
465 {
466 	int error;
467 	struct ifnet *ifp = sc->malo_ifp;
468 	uint8_t *ds;
469 
470 	DPRINTF(sc, MALO_DEBUG_RESET,
471 	    "%s: %s DMA: %u bufs (%ju) %u desc/buf (%ju)\n",
472 	    __func__, name, nbuf, (uintmax_t) bufsize,
473 	    ndesc, (uintmax_t) descsize);
474 
475 	dd->dd_name = name;
476 	dd->dd_desc_len = nbuf * ndesc * descsize;
477 
478 	/*
479 	 * Setup DMA descriptor area.
480 	 */
481 	error = bus_dma_tag_create(bus_get_dma_tag(sc->malo_dev),/* parent */
482 		       PAGE_SIZE, 0,		/* alignment, bounds */
483 		       BUS_SPACE_MAXADDR_32BIT,	/* lowaddr */
484 		       BUS_SPACE_MAXADDR,	/* highaddr */
485 		       NULL, NULL,		/* filter, filterarg */
486 		       dd->dd_desc_len,		/* maxsize */
487 		       1,			/* nsegments */
488 		       dd->dd_desc_len,		/* maxsegsize */
489 		       BUS_DMA_ALLOCNOW,	/* flags */
490 		       NULL,			/* lockfunc */
491 		       NULL,			/* lockarg */
492 		       &dd->dd_dmat);
493 	if (error != 0) {
494 		if_printf(ifp, "cannot allocate %s DMA tag\n", dd->dd_name);
495 		return error;
496 	}
497 
498 	/* allocate descriptors */
499 	error = bus_dmamem_alloc(dd->dd_dmat, (void**) &dd->dd_desc,
500 	    BUS_DMA_NOWAIT | BUS_DMA_COHERENT, &dd->dd_dmamap);
501 	if (error != 0) {
502 		if_printf(ifp, "unable to alloc memory for %u %s descriptors, "
503 		    "error %u\n", nbuf * ndesc, dd->dd_name, error);
504 		goto fail1;
505 	}
506 
507 	error = bus_dmamap_load(dd->dd_dmat, dd->dd_dmamap,
508 	    dd->dd_desc, dd->dd_desc_len,
509 	    malo_load_cb, &dd->dd_desc_paddr, BUS_DMA_NOWAIT);
510 	if (error != 0) {
511 		if_printf(ifp, "unable to map %s descriptors, error %u\n",
512 		    dd->dd_name, error);
513 		goto fail2;
514 	}
515 
516 	ds = dd->dd_desc;
517 	memset(ds, 0, dd->dd_desc_len);
518 	DPRINTF(sc, MALO_DEBUG_RESET, "%s: %s DMA map: %p (%lu) -> %p (%lu)\n",
519 	    __func__, dd->dd_name, ds, (u_long) dd->dd_desc_len,
520 	    (caddr_t) dd->dd_desc_paddr, /*XXX*/ (u_long) dd->dd_desc_len);
521 
522 	return 0;
523 fail2:
524 	bus_dmamem_free(dd->dd_dmat, dd->dd_desc, dd->dd_dmamap);
525 fail1:
526 	bus_dma_tag_destroy(dd->dd_dmat);
527 	memset(dd, 0, sizeof(*dd));
528 	return error;
529 }
530 
531 #define	DS2PHYS(_dd, _ds) \
532 	((_dd)->dd_desc_paddr + ((caddr_t)(_ds) - (caddr_t)(_dd)->dd_desc))
533 
534 static int
535 malo_rxdma_setup(struct malo_softc *sc)
536 {
537 	struct ifnet *ifp = sc->malo_ifp;
538 	int error, bsize, i;
539 	struct malo_rxbuf *bf;
540 	struct malo_rxdesc *ds;
541 
542 	error = malo_desc_setup(sc, "rx", &sc->malo_rxdma,
543 	    malo_rxbuf, sizeof(struct malo_rxbuf),
544 	    1, sizeof(struct malo_rxdesc));
545 	if (error != 0)
546 		return error;
547 
548 	/*
549 	 * Allocate rx buffers and set them up.
550 	 */
551 	bsize = malo_rxbuf * sizeof(struct malo_rxbuf);
552 	bf = malloc(bsize, M_MALODEV, M_NOWAIT | M_ZERO);
553 	if (bf == NULL) {
554 		if_printf(ifp, "malloc of %u rx buffers failed\n", bsize);
555 		return error;
556 	}
557 	sc->malo_rxdma.dd_bufptr = bf;
558 
559 	STAILQ_INIT(&sc->malo_rxbuf);
560 	ds = sc->malo_rxdma.dd_desc;
561 	for (i = 0; i < malo_rxbuf; i++, bf++, ds++) {
562 		bf->bf_desc = ds;
563 		bf->bf_daddr = DS2PHYS(&sc->malo_rxdma, ds);
564 		error = bus_dmamap_create(sc->malo_dmat, BUS_DMA_NOWAIT,
565 		    &bf->bf_dmamap);
566 		if (error != 0) {
567 			if_printf(ifp, "%s: unable to dmamap for rx buffer, "
568 			    "error %d\n", __func__, error);
569 			return error;
570 		}
571 		/* NB: tail is intentional to preserve descriptor order */
572 		STAILQ_INSERT_TAIL(&sc->malo_rxbuf, bf, bf_list);
573 	}
574 	return 0;
575 }
576 
577 static int
578 malo_txdma_setup(struct malo_softc *sc, struct malo_txq *txq)
579 {
580 	struct ifnet *ifp = sc->malo_ifp;
581 	int error, bsize, i;
582 	struct malo_txbuf *bf;
583 	struct malo_txdesc *ds;
584 
585 	error = malo_desc_setup(sc, "tx", &txq->dma,
586 	    malo_txbuf, sizeof(struct malo_txbuf),
587 	    MALO_TXDESC, sizeof(struct malo_txdesc));
588 	if (error != 0)
589 		return error;
590 
591 	/* allocate and setup tx buffers */
592 	bsize = malo_txbuf * sizeof(struct malo_txbuf);
593 	bf = malloc(bsize, M_MALODEV, M_NOWAIT | M_ZERO);
594 	if (bf == NULL) {
595 		if_printf(ifp, "malloc of %u tx buffers failed\n",
596 		    malo_txbuf);
597 		return ENOMEM;
598 	}
599 	txq->dma.dd_bufptr = bf;
600 
601 	STAILQ_INIT(&txq->free);
602 	txq->nfree = 0;
603 	ds = txq->dma.dd_desc;
604 	for (i = 0; i < malo_txbuf; i++, bf++, ds += MALO_TXDESC) {
605 		bf->bf_desc = ds;
606 		bf->bf_daddr = DS2PHYS(&txq->dma, ds);
607 		error = bus_dmamap_create(sc->malo_dmat, BUS_DMA_NOWAIT,
608 		    &bf->bf_dmamap);
609 		if (error != 0) {
610 			if_printf(ifp, "unable to create dmamap for tx "
611 			    "buffer %u, error %u\n", i, error);
612 			return error;
613 		}
614 		STAILQ_INSERT_TAIL(&txq->free, bf, bf_list);
615 		txq->nfree++;
616 	}
617 
618 	return 0;
619 }
620 
621 static void
622 malo_desc_cleanup(struct malo_softc *sc, struct malo_descdma *dd)
623 {
624 	bus_dmamap_unload(dd->dd_dmat, dd->dd_dmamap);
625 	bus_dmamem_free(dd->dd_dmat, dd->dd_desc, dd->dd_dmamap);
626 	bus_dma_tag_destroy(dd->dd_dmat);
627 
628 	memset(dd, 0, sizeof(*dd));
629 }
630 
631 static void
632 malo_rxdma_cleanup(struct malo_softc *sc)
633 {
634 	struct malo_rxbuf *bf;
635 
636 	STAILQ_FOREACH(bf, &sc->malo_rxbuf, bf_list) {
637 		if (bf->bf_m != NULL) {
638 			m_freem(bf->bf_m);
639 			bf->bf_m = NULL;
640 		}
641 		if (bf->bf_dmamap != NULL) {
642 			bus_dmamap_destroy(sc->malo_dmat, bf->bf_dmamap);
643 			bf->bf_dmamap = NULL;
644 		}
645 	}
646 	STAILQ_INIT(&sc->malo_rxbuf);
647 	if (sc->malo_rxdma.dd_bufptr != NULL) {
648 		free(sc->malo_rxdma.dd_bufptr, M_MALODEV);
649 		sc->malo_rxdma.dd_bufptr = NULL;
650 	}
651 	if (sc->malo_rxdma.dd_desc_len != 0)
652 		malo_desc_cleanup(sc, &sc->malo_rxdma);
653 }
654 
655 static void
656 malo_txdma_cleanup(struct malo_softc *sc, struct malo_txq *txq)
657 {
658 	struct malo_txbuf *bf;
659 	struct ieee80211_node *ni;
660 
661 	STAILQ_FOREACH(bf, &txq->free, bf_list) {
662 		if (bf->bf_m != NULL) {
663 			m_freem(bf->bf_m);
664 			bf->bf_m = NULL;
665 		}
666 		ni = bf->bf_node;
667 		bf->bf_node = NULL;
668 		if (ni != NULL) {
669 			/*
670 			 * Reclaim node reference.
671 			 */
672 			ieee80211_free_node(ni);
673 		}
674 		if (bf->bf_dmamap != NULL) {
675 			bus_dmamap_destroy(sc->malo_dmat, bf->bf_dmamap);
676 			bf->bf_dmamap = NULL;
677 		}
678 	}
679 	STAILQ_INIT(&txq->free);
680 	txq->nfree = 0;
681 	if (txq->dma.dd_bufptr != NULL) {
682 		free(txq->dma.dd_bufptr, M_MALODEV);
683 		txq->dma.dd_bufptr = NULL;
684 	}
685 	if (txq->dma.dd_desc_len != 0)
686 		malo_desc_cleanup(sc, &txq->dma);
687 }
688 
689 static void
690 malo_dma_cleanup(struct malo_softc *sc)
691 {
692 	int i;
693 
694 	for (i = 0; i < MALO_NUM_TX_QUEUES; i++)
695 		malo_txdma_cleanup(sc, &sc->malo_txq[i]);
696 
697 	malo_rxdma_cleanup(sc);
698 }
699 
700 static int
701 malo_dma_setup(struct malo_softc *sc)
702 {
703 	int error, i;
704 
705 	/* rxdma initializing.  */
706 	error = malo_rxdma_setup(sc);
707 	if (error != 0)
708 		return error;
709 
710 	/* NB: we just have 1 tx queue now.  */
711 	for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
712 		error = malo_txdma_setup(sc, &sc->malo_txq[i]);
713 		if (error != 0) {
714 			malo_dma_cleanup(sc);
715 
716 			return error;
717 		}
718 
719 		malo_txq_init(sc, &sc->malo_txq[i], i);
720 	}
721 
722 	return 0;
723 }
724 
725 static void
726 malo_hal_set_rxtxdma(struct malo_softc *sc)
727 {
728 	int i;
729 
730 	malo_bar0_write4(sc, sc->malo_hwspecs.rxdesc_read,
731 	    sc->malo_hwdma.rxdesc_read);
732 	malo_bar0_write4(sc, sc->malo_hwspecs.rxdesc_write,
733 	    sc->malo_hwdma.rxdesc_read);
734 
735 	for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
736 		malo_bar0_write4(sc,
737 		    sc->malo_hwspecs.wcbbase[i], sc->malo_hwdma.wcbbase[i]);
738 	}
739 }
740 
741 /*
742  * Inform firmware of our tx/rx dma setup.  The BAR 0 writes below are
743  * for compatibility with older firmware.  For current firmware we send
744  * this information with a cmd block via malo_hal_sethwdma.
745  */
746 static int
747 malo_setup_hwdma(struct malo_softc *sc)
748 {
749 	int i;
750 	struct malo_txq *txq;
751 
752 	sc->malo_hwdma.rxdesc_read = sc->malo_rxdma.dd_desc_paddr;
753 
754 	for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
755 		txq = &sc->malo_txq[i];
756 		sc->malo_hwdma.wcbbase[i] = txq->dma.dd_desc_paddr;
757 	}
758 	sc->malo_hwdma.maxnum_txwcb = malo_txbuf;
759 	sc->malo_hwdma.maxnum_wcb = MALO_NUM_TX_QUEUES;
760 
761 	malo_hal_set_rxtxdma(sc);
762 
763 	return 0;
764 }
765 
766 static void
767 malo_txq_init(struct malo_softc *sc, struct malo_txq *txq, int qnum)
768 {
769 	struct malo_txbuf *bf, *bn;
770 	struct malo_txdesc *ds;
771 
772 	MALO_TXQ_LOCK_INIT(sc, txq);
773 	txq->qnum = qnum;
774 	txq->txpri = 0;	/* XXX */
775 
776 	STAILQ_FOREACH(bf, &txq->free, bf_list) {
777 		bf->bf_txq = txq;
778 
779 		ds = bf->bf_desc;
780 		bn = STAILQ_NEXT(bf, bf_list);
781 		if (bn == NULL)
782 			bn = STAILQ_FIRST(&txq->free);
783 		ds->physnext = htole32(bn->bf_daddr);
784 	}
785 	STAILQ_INIT(&txq->active);
786 }
787 
788 /*
789  * Reclaim resources for a setup queue.
790  */
791 static void
792 malo_tx_cleanupq(struct malo_softc *sc, struct malo_txq *txq)
793 {
794 	/* XXX hal work? */
795 	MALO_TXQ_LOCK_DESTROY(txq);
796 }
797 
798 /*
799  * Allocate a tx buffer for sending a frame.
800  */
801 static struct malo_txbuf *
802 malo_getbuf(struct malo_softc *sc, struct malo_txq *txq)
803 {
804 	struct malo_txbuf *bf;
805 
806 	MALO_TXQ_LOCK(txq);
807 	bf = STAILQ_FIRST(&txq->free);
808 	if (bf != NULL) {
809 		STAILQ_REMOVE_HEAD(&txq->free, bf_list);
810 		txq->nfree--;
811 	}
812 	MALO_TXQ_UNLOCK(txq);
813 	if (bf == NULL) {
814 		DPRINTF(sc, MALO_DEBUG_XMIT,
815 		    "%s: out of xmit buffers on q %d\n", __func__, txq->qnum);
816 		sc->malo_stats.mst_tx_qstop++;
817 	}
818 	return bf;
819 }
820 
821 static int
822 malo_tx_dmasetup(struct malo_softc *sc, struct malo_txbuf *bf, struct mbuf *m0)
823 {
824 	struct mbuf *m;
825 	int error;
826 
827 	/*
828 	 * Load the DMA map so any coalescing is done.  This also calculates
829 	 * the number of descriptors we need.
830 	 */
831 	error = bus_dmamap_load_mbuf_sg(sc->malo_dmat, bf->bf_dmamap, m0,
832 				     bf->bf_segs, &bf->bf_nseg,
833 				     BUS_DMA_NOWAIT);
834 	if (error == EFBIG) {
835 		/* XXX packet requires too many descriptors */
836 		bf->bf_nseg = MALO_TXDESC + 1;
837 	} else if (error != 0) {
838 		sc->malo_stats.mst_tx_busdma++;
839 		m_freem(m0);
840 		return error;
841 	}
842 	/*
843 	 * Discard null packets and check for packets that require too many
844 	 * TX descriptors.  We try to convert the latter to a cluster.
845 	 */
846 	if (error == EFBIG) {		/* too many desc's, linearize */
847 		sc->malo_stats.mst_tx_linear++;
848 		m = m_defrag(m0, M_NOWAIT);
849 		if (m == NULL) {
850 			m_freem(m0);
851 			sc->malo_stats.mst_tx_nombuf++;
852 			return ENOMEM;
853 		}
854 		m0 = m;
855 		error = bus_dmamap_load_mbuf_sg(sc->malo_dmat, bf->bf_dmamap, m0,
856 					     bf->bf_segs, &bf->bf_nseg,
857 					     BUS_DMA_NOWAIT);
858 		if (error != 0) {
859 			sc->malo_stats.mst_tx_busdma++;
860 			m_freem(m0);
861 			return error;
862 		}
863 		KASSERT(bf->bf_nseg <= MALO_TXDESC,
864 		    ("too many segments after defrag; nseg %u", bf->bf_nseg));
865 	} else if (bf->bf_nseg == 0) {		/* null packet, discard */
866 		sc->malo_stats.mst_tx_nodata++;
867 		m_freem(m0);
868 		return EIO;
869 	}
870 	DPRINTF(sc, MALO_DEBUG_XMIT, "%s: m %p len %u\n",
871 		__func__, m0, m0->m_pkthdr.len);
872 	bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
873 	bf->bf_m = m0;
874 
875 	return 0;
876 }
877 
878 #ifdef MALO_DEBUG
879 static void
880 malo_printrxbuf(const struct malo_rxbuf *bf, u_int ix)
881 {
882 	const struct malo_rxdesc *ds = bf->bf_desc;
883 	uint32_t status = le32toh(ds->status);
884 
885 	printf("R[%2u] (DS.V:%p DS.P:%p) NEXT:%08x DATA:%08x RC:%02x%s\n"
886 	    "      STAT:%02x LEN:%04x SNR:%02x NF:%02x CHAN:%02x"
887 	    " RATE:%02x QOS:%04x\n",
888 	    ix, ds, (const struct malo_desc *)bf->bf_daddr,
889 	    le32toh(ds->physnext), le32toh(ds->physbuffdata),
890 	    ds->rxcontrol,
891 	    ds->rxcontrol != MALO_RXD_CTRL_DRIVER_OWN ?
892 	        "" : (status & MALO_RXD_STATUS_OK) ? " *" : " !",
893 	    ds->status, le16toh(ds->pktlen), ds->snr, ds->nf, ds->channel,
894 	    ds->rate, le16toh(ds->qosctrl));
895 }
896 
897 static void
898 malo_printtxbuf(const struct malo_txbuf *bf, u_int qnum, u_int ix)
899 {
900 	const struct malo_txdesc *ds = bf->bf_desc;
901 	uint32_t status = le32toh(ds->status);
902 
903 	printf("Q%u[%3u]", qnum, ix);
904 	printf(" (DS.V:%p DS.P:%p)\n",
905 	    ds, (const struct malo_txdesc *)bf->bf_daddr);
906 	printf("    NEXT:%08x DATA:%08x LEN:%04x STAT:%08x%s\n",
907 	    le32toh(ds->physnext),
908 	    le32toh(ds->pktptr), le16toh(ds->pktlen), status,
909 	    status & MALO_TXD_STATUS_USED ?
910 	    "" : (status & 3) != 0 ? " *" : " !");
911 	printf("    RATE:%02x PRI:%x QOS:%04x SAP:%08x FORMAT:%04x\n",
912 	    ds->datarate, ds->txpriority, le16toh(ds->qosctrl),
913 	    le32toh(ds->sap_pktinfo), le16toh(ds->format));
914 #if 0
915 	{
916 		const uint8_t *cp = (const uint8_t *) ds;
917 		int i;
918 		for (i = 0; i < sizeof(struct malo_txdesc); i++) {
919 			printf("%02x ", cp[i]);
920 			if (((i+1) % 16) == 0)
921 				printf("\n");
922 		}
923 		printf("\n");
924 	}
925 #endif
926 }
927 #endif /* MALO_DEBUG */
928 
929 static __inline void
930 malo_updatetxrate(struct ieee80211_node *ni, int rix)
931 {
932 #define	N(x)	(sizeof(x)/sizeof(x[0]))
933 	static const int ieeerates[] =
934 	    { 2, 4, 11, 22, 44, 12, 18, 24, 36, 48, 96, 108 };
935 	if (rix < N(ieeerates))
936 		ni->ni_txrate = ieeerates[rix];
937 #undef N
938 }
939 
940 static int
941 malo_fix2rate(int fix_rate)
942 {
943 #define	N(x)	(sizeof(x)/sizeof(x[0]))
944 	static const int rates[] =
945 	    { 2, 4, 11, 22, 12, 18, 24, 36, 48, 96, 108 };
946 	return (fix_rate < N(rates) ? rates[fix_rate] : 0);
947 #undef N
948 }
949 
950 /* idiomatic shorthands: MS = mask+shift, SM = shift+mask */
951 #define	MS(v,x)			(((v) & x) >> x##_S)
952 #define	SM(v,x)			(((v) << x##_S) & x)
953 
954 /*
955  * Process completed xmit descriptors from the specified queue.
956  */
957 static int
958 malo_tx_processq(struct malo_softc *sc, struct malo_txq *txq)
959 {
960 	struct malo_txbuf *bf;
961 	struct malo_txdesc *ds;
962 	struct ieee80211_node *ni;
963 	int nreaped;
964 	uint32_t status;
965 
966 	DPRINTF(sc, MALO_DEBUG_TX_PROC, "%s: tx queue %u\n",
967 	    __func__, txq->qnum);
968 	for (nreaped = 0;; nreaped++) {
969 		MALO_TXQ_LOCK(txq);
970 		bf = STAILQ_FIRST(&txq->active);
971 		if (bf == NULL) {
972 			MALO_TXQ_UNLOCK(txq);
973 			break;
974 		}
975 		ds = bf->bf_desc;
976 		MALO_TXDESC_SYNC(txq, ds,
977 		    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
978 		if (ds->status & htole32(MALO_TXD_STATUS_FW_OWNED)) {
979 			MALO_TXQ_UNLOCK(txq);
980 			break;
981 		}
982 		STAILQ_REMOVE_HEAD(&txq->active, bf_list);
983 		MALO_TXQ_UNLOCK(txq);
984 
985 #ifdef MALO_DEBUG
986 		if (sc->malo_debug & MALO_DEBUG_XMIT_DESC)
987 			malo_printtxbuf(bf, txq->qnum, nreaped);
988 #endif
989 		ni = bf->bf_node;
990 		if (ni != NULL) {
991 			status = le32toh(ds->status);
992 			if (status & MALO_TXD_STATUS_OK) {
993 				uint16_t format = le16toh(ds->format);
994 				uint8_t txant = MS(format, MALO_TXD_ANTENNA);
995 
996 				sc->malo_stats.mst_ant_tx[txant]++;
997 				if (status & MALO_TXD_STATUS_OK_RETRY)
998 					sc->malo_stats.mst_tx_retries++;
999 				if (status & MALO_TXD_STATUS_OK_MORE_RETRY)
1000 					sc->malo_stats.mst_tx_mretries++;
1001 				malo_updatetxrate(ni, ds->datarate);
1002 				sc->malo_stats.mst_tx_rate = ds->datarate;
1003 			} else {
1004 				if (status & MALO_TXD_STATUS_FAILED_LINK_ERROR)
1005 					sc->malo_stats.mst_tx_linkerror++;
1006 				if (status & MALO_TXD_STATUS_FAILED_XRETRY)
1007 					sc->malo_stats.mst_tx_xretries++;
1008 				if (status & MALO_TXD_STATUS_FAILED_AGING)
1009 					sc->malo_stats.mst_tx_aging++;
1010 			}
1011 			/*
1012 			 * Do any tx complete callback.  Note this must
1013 			 * be done before releasing the node reference.
1014 			 * XXX no way to figure out if frame was ACK'd
1015 			 */
1016 			if (bf->bf_m->m_flags & M_TXCB) {
1017 				/* XXX strip fw len in case header inspected */
1018 				m_adj(bf->bf_m, sizeof(uint16_t));
1019 				ieee80211_process_callback(ni, bf->bf_m,
1020 					(status & MALO_TXD_STATUS_OK) == 0);
1021 			}
1022 			/*
1023 			 * Reclaim reference to node.
1024 			 *
1025 			 * NB: the node may be reclaimed here if, for example
1026 			 *     this is a DEAUTH message that was sent and the
1027 			 *     node was timed out due to inactivity.
1028 			 */
1029 			ieee80211_free_node(ni);
1030 		}
1031 		ds->status = htole32(MALO_TXD_STATUS_IDLE);
1032 		ds->pktlen = htole32(0);
1033 
1034 		bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap,
1035 		    BUS_DMASYNC_POSTWRITE);
1036 		bus_dmamap_unload(sc->malo_dmat, bf->bf_dmamap);
1037 		m_freem(bf->bf_m);
1038 		bf->bf_m = NULL;
1039 		bf->bf_node = NULL;
1040 
1041 		MALO_TXQ_LOCK(txq);
1042 		STAILQ_INSERT_TAIL(&txq->free, bf, bf_list);
1043 		txq->nfree++;
1044 		MALO_TXQ_UNLOCK(txq);
1045 	}
1046 	return nreaped;
1047 }
1048 
1049 /*
1050  * Deferred processing of transmit interrupt.
1051  */
1052 static void
1053 malo_tx_proc(void *arg, int npending)
1054 {
1055 	struct malo_softc *sc = arg;
1056 	struct ifnet *ifp = sc->malo_ifp;
1057 	int i, nreaped;
1058 
1059 	/*
1060 	 * Process each active queue.
1061 	 */
1062 	nreaped = 0;
1063 	for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
1064 		if (!STAILQ_EMPTY(&sc->malo_txq[i].active))
1065 			nreaped += malo_tx_processq(sc, &sc->malo_txq[i]);
1066 	}
1067 
1068 	if (nreaped != 0) {
1069 		ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1070 		sc->malo_timer = 0;
1071 		malo_start(ifp);
1072 	}
1073 }
1074 
1075 static int
1076 malo_tx_start(struct malo_softc *sc, struct ieee80211_node *ni,
1077     struct malo_txbuf *bf, struct mbuf *m0)
1078 {
1079 #define	IEEE80211_DIR_DSTODS(wh) \
1080 	((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS)
1081 #define	IS_DATA_FRAME(wh)						\
1082 	((wh->i_fc[0] & (IEEE80211_FC0_TYPE_MASK)) == IEEE80211_FC0_TYPE_DATA)
1083 	int error, ismcast, iswep;
1084 	int copyhdrlen, hdrlen, pktlen;
1085 	struct ieee80211_frame *wh;
1086 	struct ifnet *ifp = sc->malo_ifp;
1087 	struct ieee80211com *ic = ifp->if_l2com;
1088 	struct ieee80211vap *vap = ni->ni_vap;
1089 	struct malo_txdesc *ds;
1090 	struct malo_txrec *tr;
1091 	struct malo_txq *txq;
1092 	uint16_t qos;
1093 
1094 	wh = mtod(m0, struct ieee80211_frame *);
1095 	iswep = wh->i_fc[1] & IEEE80211_FC1_PROTECTED;
1096 	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
1097 	copyhdrlen = hdrlen = ieee80211_anyhdrsize(wh);
1098 	pktlen = m0->m_pkthdr.len;
1099 	if (IEEE80211_QOS_HAS_SEQ(wh)) {
1100 		if (IEEE80211_DIR_DSTODS(wh)) {
1101 			qos = *(uint16_t *)
1102 			    (((struct ieee80211_qosframe_addr4 *) wh)->i_qos);
1103 			copyhdrlen -= sizeof(qos);
1104 		} else
1105 			qos = *(uint16_t *)
1106 			    (((struct ieee80211_qosframe *) wh)->i_qos);
1107 	} else
1108 		qos = 0;
1109 
1110 	if (iswep) {
1111 		struct ieee80211_key *k;
1112 
1113 		/*
1114 		 * Construct the 802.11 header+trailer for an encrypted
1115 		 * frame. The only reason this can fail is because of an
1116 		 * unknown or unsupported cipher/key type.
1117 		 *
1118 		 * NB: we do this even though the firmware will ignore
1119 		 *     what we've done for WEP and TKIP as we need the
1120 		 *     ExtIV filled in for CCMP and this also adjusts
1121 		 *     the headers which simplifies our work below.
1122 		 */
1123 		k = ieee80211_crypto_encap(ni, m0);
1124 		if (k == NULL) {
1125 			/*
1126 			 * This can happen when the key is yanked after the
1127 			 * frame was queued.  Just discard the frame; the
1128 			 * 802.11 layer counts failures and provides
1129 			 * debugging/diagnostics.
1130 			 */
1131 			m_freem(m0);
1132 			return EIO;
1133 		}
1134 
1135 		/*
1136 		 * Adjust the packet length for the crypto additions
1137 		 * done during encap and any other bits that the f/w
1138 		 * will add later on.
1139 		 */
1140 		pktlen = m0->m_pkthdr.len;
1141 
1142 		/* packet header may have moved, reset our local pointer */
1143 		wh = mtod(m0, struct ieee80211_frame *);
1144 	}
1145 
1146 	if (ieee80211_radiotap_active_vap(vap)) {
1147 		sc->malo_tx_th.wt_flags = 0;	/* XXX */
1148 		if (iswep)
1149 			sc->malo_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
1150 		sc->malo_tx_th.wt_txpower = ni->ni_txpower;
1151 		sc->malo_tx_th.wt_antenna = sc->malo_txantenna;
1152 
1153 		ieee80211_radiotap_tx(vap, m0);
1154 	}
1155 
1156 	/*
1157 	 * Copy up/down the 802.11 header; the firmware requires
1158 	 * we present a 2-byte payload length followed by a
1159 	 * 4-address header (w/o QoS), followed (optionally) by
1160 	 * any WEP/ExtIV header (but only filled in for CCMP).
1161 	 * We are assured the mbuf has sufficient headroom to
1162 	 * prepend in-place by the setup of ic_headroom in
1163 	 * malo_attach.
1164 	 */
1165 	if (hdrlen < sizeof(struct malo_txrec)) {
1166 		const int space = sizeof(struct malo_txrec) - hdrlen;
1167 		if (M_LEADINGSPACE(m0) < space) {
1168 			/* NB: should never happen */
1169 			device_printf(sc->malo_dev,
1170 			    "not enough headroom, need %d found %zd, "
1171 			    "m_flags 0x%x m_len %d\n",
1172 			    space, M_LEADINGSPACE(m0), m0->m_flags, m0->m_len);
1173 			ieee80211_dump_pkt(ic,
1174 			    mtod(m0, const uint8_t *), m0->m_len, 0, -1);
1175 			m_freem(m0);
1176 			/* XXX stat */
1177 			return EIO;
1178 		}
1179 		M_PREPEND(m0, space, M_NOWAIT);
1180 	}
1181 	tr = mtod(m0, struct malo_txrec *);
1182 	if (wh != (struct ieee80211_frame *) &tr->wh)
1183 		ovbcopy(wh, &tr->wh, hdrlen);
1184 	/*
1185 	 * Note: the "firmware length" is actually the length of the fully
1186 	 * formed "802.11 payload".  That is, it's everything except for
1187 	 * the 802.11 header.  In particular this includes all crypto
1188 	 * material including the MIC!
1189 	 */
1190 	tr->fwlen = htole16(pktlen - hdrlen);
1191 
1192 	/*
1193 	 * Load the DMA map so any coalescing is done.  This
1194 	 * also calculates the number of descriptors we need.
1195 	 */
1196 	error = malo_tx_dmasetup(sc, bf, m0);
1197 	if (error != 0)
1198 		return error;
1199 	bf->bf_node = ni;			/* NB: held reference */
1200 	m0 = bf->bf_m;				/* NB: may have changed */
1201 	tr = mtod(m0, struct malo_txrec *);
1202 	wh = (struct ieee80211_frame *)&tr->wh;
1203 
1204 	/*
1205 	 * Formulate tx descriptor.
1206 	 */
1207 	ds = bf->bf_desc;
1208 	txq = bf->bf_txq;
1209 
1210 	ds->qosctrl = qos;			/* NB: already little-endian */
1211 	ds->pktptr = htole32(bf->bf_segs[0].ds_addr);
1212 	ds->pktlen = htole16(bf->bf_segs[0].ds_len);
1213 	/* NB: pPhysNext setup once, don't touch */
1214 	ds->datarate = IS_DATA_FRAME(wh) ? 1 : 0;
1215 	ds->sap_pktinfo = 0;
1216 	ds->format = 0;
1217 
1218 	/*
1219 	 * Select transmit rate.
1220 	 */
1221 	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
1222 	case IEEE80211_FC0_TYPE_MGT:
1223 		sc->malo_stats.mst_tx_mgmt++;
1224 		/* fall thru... */
1225 	case IEEE80211_FC0_TYPE_CTL:
1226 		ds->txpriority = 1;
1227 		break;
1228 	case IEEE80211_FC0_TYPE_DATA:
1229 		ds->txpriority = txq->qnum;
1230 		break;
1231 	default:
1232 		if_printf(ifp, "bogus frame type 0x%x (%s)\n",
1233 			wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK, __func__);
1234 		/* XXX statistic */
1235 		m_freem(m0);
1236 		return EIO;
1237 	}
1238 
1239 #ifdef MALO_DEBUG
1240 	if (IFF_DUMPPKTS_XMIT(sc))
1241 		ieee80211_dump_pkt(ic,
1242 		    mtod(m0, const uint8_t *)+sizeof(uint16_t),
1243 		    m0->m_len - sizeof(uint16_t), ds->datarate, -1);
1244 #endif
1245 
1246 	MALO_TXQ_LOCK(txq);
1247 	if (!IS_DATA_FRAME(wh))
1248 		ds->status |= htole32(1);
1249 	ds->status |= htole32(MALO_TXD_STATUS_FW_OWNED);
1250 	STAILQ_INSERT_TAIL(&txq->active, bf, bf_list);
1251 	MALO_TXDESC_SYNC(txq, ds, BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
1252 
1253 	ifp->if_opackets++;
1254 	sc->malo_timer = 5;
1255 	MALO_TXQ_UNLOCK(txq);
1256 	return 0;
1257 #undef IEEE80211_DIR_DSTODS
1258 }
1259 
1260 static void
1261 malo_start(struct ifnet *ifp)
1262 {
1263 	struct malo_softc *sc = ifp->if_softc;
1264 	struct ieee80211_node *ni;
1265 	struct malo_txq *txq = &sc->malo_txq[0];
1266 	struct malo_txbuf *bf = NULL;
1267 	struct mbuf *m;
1268 	int nqueued = 0;
1269 
1270 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0 || sc->malo_invalid)
1271 		return;
1272 
1273 	for (;;) {
1274 		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
1275 		if (m == NULL)
1276 			break;
1277 		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
1278 		bf = malo_getbuf(sc, txq);
1279 		if (bf == NULL) {
1280 			IFQ_DRV_PREPEND(&ifp->if_snd, m);
1281 
1282 			/* XXX blocks other traffic */
1283 			ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1284 			sc->malo_stats.mst_tx_qstop++;
1285 			break;
1286 		}
1287 		/*
1288 		 * Pass the frame to the h/w for transmission.
1289 		 */
1290 		if (malo_tx_start(sc, ni, bf, m)) {
1291 			ifp->if_oerrors++;
1292 			if (bf != NULL) {
1293 				bf->bf_m = NULL;
1294 				bf->bf_node = NULL;
1295 				MALO_TXQ_LOCK(txq);
1296 				STAILQ_INSERT_HEAD(&txq->free, bf, bf_list);
1297 				MALO_TXQ_UNLOCK(txq);
1298 			}
1299 			ieee80211_free_node(ni);
1300 			continue;
1301 		}
1302 		nqueued++;
1303 
1304 		if (nqueued >= malo_txcoalesce) {
1305 			/*
1306 			 * Poke the firmware to process queued frames;
1307 			 * see below about (lack of) locking.
1308 			 */
1309 			nqueued = 0;
1310 			malo_hal_txstart(sc->malo_mh, 0/*XXX*/);
1311 		}
1312 	}
1313 
1314 	if (nqueued) {
1315 		/*
1316 		 * NB: We don't need to lock against tx done because
1317 		 * this just prods the firmware to check the transmit
1318 		 * descriptors.  The firmware will also start fetching
1319 		 * descriptors by itself if it notices new ones are
1320 		 * present when it goes to deliver a tx done interrupt
1321 		 * to the host. So if we race with tx done processing
1322 		 * it's ok.  Delivering the kick here rather than in
1323 		 * malo_tx_start is an optimization to avoid poking the
1324 		 * firmware for each packet.
1325 		 *
1326 		 * NB: the queue id isn't used so 0 is ok.
1327 		 */
1328 		malo_hal_txstart(sc->malo_mh, 0/*XXX*/);
1329 	}
1330 }
1331 
1332 static void
1333 malo_watchdog(void *arg)
1334 {
1335 	struct malo_softc *sc;
1336 	struct ifnet *ifp;
1337 
1338 	sc = arg;
1339 	callout_reset(&sc->malo_watchdog_timer, hz, malo_watchdog, sc);
1340 	if (sc->malo_timer == 0 || --sc->malo_timer > 0)
1341 		return;
1342 
1343 	ifp = sc->malo_ifp;
1344 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) && !sc->malo_invalid) {
1345 		if_printf(ifp, "watchdog timeout\n");
1346 
1347 		/* XXX no way to reset h/w. now  */
1348 
1349 		ifp->if_oerrors++;
1350 		sc->malo_stats.mst_watchdog++;
1351 	}
1352 }
1353 
1354 static int
1355 malo_hal_reset(struct malo_softc *sc)
1356 {
1357 	static int first = 0;
1358 	struct ifnet *ifp = sc->malo_ifp;
1359 	struct ieee80211com *ic = ifp->if_l2com;
1360 	struct malo_hal *mh = sc->malo_mh;
1361 
1362 	if (first == 0) {
1363 		/*
1364 		 * NB: when the device firstly is initialized, sometimes
1365 		 * firmware could override rx/tx dma registers so we re-set
1366 		 * these values once.
1367 		 */
1368 		malo_hal_set_rxtxdma(sc);
1369 		first = 1;
1370 	}
1371 
1372 	malo_hal_setantenna(mh, MHA_ANTENNATYPE_RX, sc->malo_rxantenna);
1373 	malo_hal_setantenna(mh, MHA_ANTENNATYPE_TX, sc->malo_txantenna);
1374 	malo_hal_setradio(mh, 1, MHP_AUTO_PREAMBLE);
1375 	malo_chan_set(sc, ic->ic_curchan);
1376 
1377 	/* XXX needs other stuffs?  */
1378 
1379 	return 1;
1380 }
1381 
1382 static __inline struct mbuf *
1383 malo_getrxmbuf(struct malo_softc *sc, struct malo_rxbuf *bf)
1384 {
1385 	struct mbuf *m;
1386 	bus_addr_t paddr;
1387 	int error;
1388 
1389 	/* XXX don't need mbuf, just dma buffer */
1390 	m = m_getjcl(M_NOWAIT, MT_DATA, M_PKTHDR, MJUMPAGESIZE);
1391 	if (m == NULL) {
1392 		sc->malo_stats.mst_rx_nombuf++;	/* XXX */
1393 		return NULL;
1394 	}
1395 	error = bus_dmamap_load(sc->malo_dmat, bf->bf_dmamap,
1396 	    mtod(m, caddr_t), MJUMPAGESIZE,
1397 	    malo_load_cb, &paddr, BUS_DMA_NOWAIT);
1398 	if (error != 0) {
1399 		if_printf(sc->malo_ifp,
1400 		    "%s: bus_dmamap_load failed, error %d\n", __func__, error);
1401 		m_freem(m);
1402 		return NULL;
1403 	}
1404 	bf->bf_data = paddr;
1405 	bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
1406 
1407 	return m;
1408 }
1409 
1410 static int
1411 malo_rxbuf_init(struct malo_softc *sc, struct malo_rxbuf *bf)
1412 {
1413 	struct malo_rxdesc *ds;
1414 
1415 	ds = bf->bf_desc;
1416 	if (bf->bf_m == NULL) {
1417 		bf->bf_m = malo_getrxmbuf(sc, bf);
1418 		if (bf->bf_m == NULL) {
1419 			/* mark descriptor to be skipped */
1420 			ds->rxcontrol = MALO_RXD_CTRL_OS_OWN;
1421 			/* NB: don't need PREREAD */
1422 			MALO_RXDESC_SYNC(sc, ds, BUS_DMASYNC_PREWRITE);
1423 			return ENOMEM;
1424 		}
1425 	}
1426 
1427 	/*
1428 	 * Setup descriptor.
1429 	 */
1430 	ds->qosctrl = 0;
1431 	ds->snr = 0;
1432 	ds->status = MALO_RXD_STATUS_IDLE;
1433 	ds->channel = 0;
1434 	ds->pktlen = htole16(MALO_RXSIZE);
1435 	ds->nf = 0;
1436 	ds->physbuffdata = htole32(bf->bf_data);
1437 	/* NB: don't touch pPhysNext, set once */
1438 	ds->rxcontrol = MALO_RXD_CTRL_DRIVER_OWN;
1439 	MALO_RXDESC_SYNC(sc, ds, BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
1440 
1441 	return 0;
1442 }
1443 
1444 /*
1445  * Setup the rx data structures.  This should only be done once or we may get
1446  * out of sync with the firmware.
1447  */
1448 static int
1449 malo_startrecv(struct malo_softc *sc)
1450 {
1451 	struct malo_rxbuf *bf, *prev;
1452 	struct malo_rxdesc *ds;
1453 
1454 	if (sc->malo_recvsetup == 1) {
1455 		malo_mode_init(sc);		/* set filters, etc. */
1456 		return 0;
1457 	}
1458 
1459 	prev = NULL;
1460 	STAILQ_FOREACH(bf, &sc->malo_rxbuf, bf_list) {
1461 		int error = malo_rxbuf_init(sc, bf);
1462 		if (error != 0) {
1463 			DPRINTF(sc, MALO_DEBUG_RECV,
1464 			    "%s: malo_rxbuf_init failed %d\n",
1465 			    __func__, error);
1466 			return error;
1467 		}
1468 		if (prev != NULL) {
1469 			ds = prev->bf_desc;
1470 			ds->physnext = htole32(bf->bf_daddr);
1471 		}
1472 		prev = bf;
1473 	}
1474 	if (prev != NULL) {
1475 		ds = prev->bf_desc;
1476 		ds->physnext =
1477 		    htole32(STAILQ_FIRST(&sc->malo_rxbuf)->bf_daddr);
1478 	}
1479 
1480 	sc->malo_recvsetup = 1;
1481 
1482 	malo_mode_init(sc);		/* set filters, etc. */
1483 
1484 	return 0;
1485 }
1486 
1487 static void
1488 malo_init_locked(struct malo_softc *sc)
1489 {
1490 	struct ifnet *ifp = sc->malo_ifp;
1491 	struct malo_hal *mh = sc->malo_mh;
1492 	int error;
1493 
1494 	DPRINTF(sc, MALO_DEBUG_ANY, "%s: if_flags 0x%x\n",
1495 	    __func__, ifp->if_flags);
1496 
1497 	MALO_LOCK_ASSERT(sc);
1498 
1499 	/*
1500 	 * Stop anything previously setup.  This is safe whether this is
1501 	 * the first time through or not.
1502 	 */
1503 	malo_stop_locked(ifp, 0);
1504 
1505 	/*
1506 	 * Push state to the firmware.
1507 	 */
1508 	if (!malo_hal_reset(sc)) {
1509 		if_printf(ifp, "%s: unable to reset hardware\n", __func__);
1510 		return;
1511 	}
1512 
1513 	/*
1514 	 * Setup recv (once); transmit is already good to go.
1515 	 */
1516 	error = malo_startrecv(sc);
1517 	if (error != 0) {
1518 		if_printf(ifp, "%s: unable to start recv logic, error %d\n",
1519 		    __func__, error);
1520 		return;
1521 	}
1522 
1523 	/*
1524 	 * Enable interrupts.
1525 	 */
1526 	sc->malo_imask = MALO_A2HRIC_BIT_RX_RDY
1527 	    | MALO_A2HRIC_BIT_TX_DONE
1528 	    | MALO_A2HRIC_BIT_OPC_DONE
1529 	    | MALO_A2HRIC_BIT_MAC_EVENT
1530 	    | MALO_A2HRIC_BIT_RX_PROBLEM
1531 	    | MALO_A2HRIC_BIT_ICV_ERROR
1532 	    | MALO_A2HRIC_BIT_RADAR_DETECT
1533 	    | MALO_A2HRIC_BIT_CHAN_SWITCH;
1534 
1535 	ifp->if_drv_flags |= IFF_DRV_RUNNING;
1536 	malo_hal_intrset(mh, sc->malo_imask);
1537 	callout_reset(&sc->malo_watchdog_timer, hz, malo_watchdog, sc);
1538 }
1539 
1540 static void
1541 malo_init(void *arg)
1542 {
1543 	struct malo_softc *sc = (struct malo_softc *) arg;
1544 	struct ifnet *ifp = sc->malo_ifp;
1545 	struct ieee80211com *ic = ifp->if_l2com;
1546 
1547 	DPRINTF(sc, MALO_DEBUG_ANY, "%s: if_flags 0x%x\n",
1548 	    __func__, ifp->if_flags);
1549 
1550 	MALO_LOCK(sc);
1551 	malo_init_locked(sc);
1552 
1553 	MALO_UNLOCK(sc);
1554 
1555 	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1556 		ieee80211_start_all(ic);	/* start all vap's */
1557 }
1558 
1559 /*
1560  * Set the multicast filter contents into the hardware.
1561  */
1562 static void
1563 malo_setmcastfilter(struct malo_softc *sc)
1564 {
1565 	struct ifnet *ifp = sc->malo_ifp;
1566 	struct ieee80211com *ic = ifp->if_l2com;
1567 	struct ifmultiaddr *ifma;
1568 	uint8_t macs[IEEE80211_ADDR_LEN * MALO_HAL_MCAST_MAX];
1569 	uint8_t *mp;
1570 	int nmc;
1571 
1572 	mp = macs;
1573 	nmc = 0;
1574 
1575 	if (ic->ic_opmode == IEEE80211_M_MONITOR ||
1576 	    (ifp->if_flags & (IFF_ALLMULTI | IFF_PROMISC)))
1577 		goto all;
1578 
1579 	if_maddr_rlock(ifp);
1580 	TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
1581 		if (ifma->ifma_addr->sa_family != AF_LINK)
1582 			continue;
1583 
1584 		if (nmc == MALO_HAL_MCAST_MAX) {
1585 			ifp->if_flags |= IFF_ALLMULTI;
1586 			if_maddr_runlock(ifp);
1587 			goto all;
1588 		}
1589 		IEEE80211_ADDR_COPY(mp,
1590 		    LLADDR((struct sockaddr_dl *)ifma->ifma_addr));
1591 
1592 		mp += IEEE80211_ADDR_LEN, nmc++;
1593 	}
1594 	if_maddr_runlock(ifp);
1595 
1596 	malo_hal_setmcast(sc->malo_mh, nmc, macs);
1597 
1598 all:
1599 	/*
1600 	 * XXX we don't know how to set the f/w for supporting
1601 	 * IFF_ALLMULTI | IFF_PROMISC cases
1602 	 */
1603 	return;
1604 }
1605 
1606 static int
1607 malo_mode_init(struct malo_softc *sc)
1608 {
1609 	struct ifnet *ifp = sc->malo_ifp;
1610 	struct ieee80211com *ic = ifp->if_l2com;
1611 	struct malo_hal *mh = sc->malo_mh;
1612 
1613 	/*
1614 	 * NB: Ignore promisc in hostap mode; it's set by the
1615 	 * bridge.  This is wrong but we have no way to
1616 	 * identify internal requests (from the bridge)
1617 	 * versus external requests such as for tcpdump.
1618 	 */
1619 	malo_hal_setpromisc(mh, (ifp->if_flags & IFF_PROMISC) &&
1620 	    ic->ic_opmode != IEEE80211_M_HOSTAP);
1621 	malo_setmcastfilter(sc);
1622 
1623 	return ENXIO;
1624 }
1625 
1626 static void
1627 malo_tx_draintxq(struct malo_softc *sc, struct malo_txq *txq)
1628 {
1629 	struct ieee80211_node *ni;
1630 	struct malo_txbuf *bf;
1631 	u_int ix;
1632 
1633 	/*
1634 	 * NB: this assumes output has been stopped and
1635 	 *     we do not need to block malo_tx_tasklet
1636 	 */
1637 	for (ix = 0;; ix++) {
1638 		MALO_TXQ_LOCK(txq);
1639 		bf = STAILQ_FIRST(&txq->active);
1640 		if (bf == NULL) {
1641 			MALO_TXQ_UNLOCK(txq);
1642 			break;
1643 		}
1644 		STAILQ_REMOVE_HEAD(&txq->active, bf_list);
1645 		MALO_TXQ_UNLOCK(txq);
1646 #ifdef MALO_DEBUG
1647 		if (sc->malo_debug & MALO_DEBUG_RESET) {
1648 			struct ifnet *ifp = sc->malo_ifp;
1649 			struct ieee80211com *ic = ifp->if_l2com;
1650 			const struct malo_txrec *tr =
1651 			    mtod(bf->bf_m, const struct malo_txrec *);
1652 			malo_printtxbuf(bf, txq->qnum, ix);
1653 			ieee80211_dump_pkt(ic, (const uint8_t *)&tr->wh,
1654 			    bf->bf_m->m_len - sizeof(tr->fwlen), 0, -1);
1655 		}
1656 #endif /* MALO_DEBUG */
1657 		bus_dmamap_unload(sc->malo_dmat, bf->bf_dmamap);
1658 		ni = bf->bf_node;
1659 		bf->bf_node = NULL;
1660 		if (ni != NULL) {
1661 			/*
1662 			 * Reclaim node reference.
1663 			 */
1664 			ieee80211_free_node(ni);
1665 		}
1666 		m_freem(bf->bf_m);
1667 		bf->bf_m = NULL;
1668 
1669 		MALO_TXQ_LOCK(txq);
1670 		STAILQ_INSERT_TAIL(&txq->free, bf, bf_list);
1671 		txq->nfree++;
1672 		MALO_TXQ_UNLOCK(txq);
1673 	}
1674 }
1675 
1676 static void
1677 malo_stop_locked(struct ifnet *ifp, int disable)
1678 {
1679 	struct malo_softc *sc = ifp->if_softc;
1680 	struct malo_hal *mh = sc->malo_mh;
1681 	int i;
1682 
1683 	DPRINTF(sc, MALO_DEBUG_ANY, "%s: invalid %u if_flags 0x%x\n",
1684 	    __func__, sc->malo_invalid, ifp->if_flags);
1685 
1686 	MALO_LOCK_ASSERT(sc);
1687 
1688 	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING))
1689 		return;
1690 
1691 	/*
1692 	 * Shutdown the hardware and driver:
1693 	 *    disable interrupts
1694 	 *    turn off the radio
1695 	 *    drain and release tx queues
1696 	 *
1697 	 * Note that some of this work is not possible if the hardware
1698 	 * is gone (invalid).
1699 	 */
1700 	ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
1701 	callout_stop(&sc->malo_watchdog_timer);
1702 	sc->malo_timer = 0;
1703 	/* diable interrupt.  */
1704 	malo_hal_intrset(mh, 0);
1705 	/* turn off the radio.  */
1706 	malo_hal_setradio(mh, 0, MHP_AUTO_PREAMBLE);
1707 
1708 	/* drain and release tx queues.  */
1709 	for (i = 0; i < MALO_NUM_TX_QUEUES; i++)
1710 		malo_tx_draintxq(sc, &sc->malo_txq[i]);
1711 }
1712 
1713 static int
1714 malo_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1715 {
1716 #define	MALO_IS_RUNNING(ifp) \
1717 	((ifp->if_flags & IFF_UP) && (ifp->if_drv_flags & IFF_DRV_RUNNING))
1718 	struct malo_softc *sc = ifp->if_softc;
1719 	struct ieee80211com *ic = ifp->if_l2com;
1720 	struct ifreq *ifr = (struct ifreq *) data;
1721 	int error = 0, startall = 0;
1722 
1723 	MALO_LOCK(sc);
1724 	switch (cmd) {
1725 	case SIOCSIFFLAGS:
1726 		if (MALO_IS_RUNNING(ifp)) {
1727 			/*
1728 			 * To avoid rescanning another access point,
1729 			 * do not call malo_init() here.  Instead,
1730 			 * only reflect promisc mode settings.
1731 			 */
1732 			malo_mode_init(sc);
1733 		} else if (ifp->if_flags & IFF_UP) {
1734 			/*
1735 			 * Beware of being called during attach/detach
1736 			 * to reset promiscuous mode.  In that case we
1737 			 * will still be marked UP but not RUNNING.
1738 			 * However trying to re-init the interface
1739 			 * is the wrong thing to do as we've already
1740 			 * torn down much of our state.  There's
1741 			 * probably a better way to deal with this.
1742 			 */
1743 			if (!sc->malo_invalid) {
1744 				malo_init_locked(sc);
1745 				startall = 1;
1746 			}
1747 		} else
1748 			malo_stop_locked(ifp, 1);
1749 		break;
1750 	case SIOCGIFMEDIA:
1751 	case SIOCSIFMEDIA:
1752 		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
1753 		break;
1754 	default:
1755 		error = ether_ioctl(ifp, cmd, data);
1756 		break;
1757 	}
1758 	MALO_UNLOCK(sc);
1759 
1760 	if (startall)
1761 		ieee80211_start_all(ic);
1762 	return error;
1763 #undef MALO_IS_RUNNING
1764 }
1765 
1766 /*
1767  * Callback from the 802.11 layer to update the slot time
1768  * based on the current setting.  We use it to notify the
1769  * firmware of ERP changes and the f/w takes care of things
1770  * like slot time and preamble.
1771  */
1772 static void
1773 malo_updateslot(struct ifnet *ifp)
1774 {
1775 	struct malo_softc *sc = ifp->if_softc;
1776 	struct ieee80211com *ic = ifp->if_l2com;
1777 	struct malo_hal *mh = sc->malo_mh;
1778 	int error;
1779 
1780 	/* NB: can be called early; suppress needless cmds */
1781 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1782 		return;
1783 
1784 	DPRINTF(sc, MALO_DEBUG_RESET,
1785 	    "%s: chan %u MHz/flags 0x%x %s slot, (ic_flags 0x%x)\n",
1786 	    __func__, ic->ic_curchan->ic_freq, ic->ic_curchan->ic_flags,
1787 	    ic->ic_flags & IEEE80211_F_SHSLOT ? "short" : "long", ic->ic_flags);
1788 
1789 	if (ic->ic_flags & IEEE80211_F_SHSLOT)
1790 		error = malo_hal_set_slot(mh, 1);
1791 	else
1792 		error = malo_hal_set_slot(mh, 0);
1793 
1794 	if (error != 0)
1795 		device_printf(sc->malo_dev, "setting %s slot failed\n",
1796 			ic->ic_flags & IEEE80211_F_SHSLOT ? "short" : "long");
1797 }
1798 
1799 static int
1800 malo_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1801 {
1802 	struct ieee80211com *ic = vap->iv_ic;
1803 	struct malo_softc *sc = ic->ic_ifp->if_softc;
1804 	struct malo_hal *mh = sc->malo_mh;
1805 	int error;
1806 
1807 	DPRINTF(sc, MALO_DEBUG_STATE, "%s: %s -> %s\n", __func__,
1808 	    ieee80211_state_name[vap->iv_state],
1809 	    ieee80211_state_name[nstate]);
1810 
1811 	/*
1812 	 * Invoke the net80211 layer first so iv_bss is setup.
1813 	 */
1814 	error = MALO_VAP(vap)->malo_newstate(vap, nstate, arg);
1815 	if (error != 0)
1816 		return error;
1817 
1818 	if (nstate == IEEE80211_S_RUN && vap->iv_state != IEEE80211_S_RUN) {
1819 		struct ieee80211_node *ni = vap->iv_bss;
1820 		enum ieee80211_phymode mode = ieee80211_chan2mode(ni->ni_chan);
1821 		const struct ieee80211_txparam *tp = &vap->iv_txparms[mode];
1822 
1823 		DPRINTF(sc, MALO_DEBUG_STATE,
1824 		    "%s: %s(RUN): iv_flags 0x%08x bintvl %d bssid %s "
1825 		    "capinfo 0x%04x chan %d associd 0x%x mode %d rate %d\n",
1826 		    vap->iv_ifp->if_xname, __func__, vap->iv_flags,
1827 		    ni->ni_intval, ether_sprintf(ni->ni_bssid), ni->ni_capinfo,
1828 		    ieee80211_chan2ieee(ic, ic->ic_curchan),
1829 		    ni->ni_associd, mode, tp->ucastrate);
1830 
1831 		malo_hal_setradio(mh, 1,
1832 		    (ic->ic_flags & IEEE80211_F_SHPREAMBLE) ?
1833 			MHP_SHORT_PREAMBLE : MHP_LONG_PREAMBLE);
1834 		malo_hal_setassocid(sc->malo_mh, ni->ni_bssid, ni->ni_associd);
1835 		malo_hal_set_rate(mh, mode,
1836 		   tp->ucastrate == IEEE80211_FIXED_RATE_NONE ?
1837 		       0 : malo_fix2rate(tp->ucastrate));
1838 	}
1839 	return 0;
1840 }
1841 
1842 static int
1843 malo_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1844 	const struct ieee80211_bpf_params *params)
1845 {
1846 	struct ieee80211com *ic = ni->ni_ic;
1847 	struct ifnet *ifp = ic->ic_ifp;
1848 	struct malo_softc *sc = ifp->if_softc;
1849 	struct malo_txbuf *bf;
1850 	struct malo_txq *txq;
1851 
1852 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0 || sc->malo_invalid) {
1853 		ieee80211_free_node(ni);
1854 		m_freem(m);
1855 		return ENETDOWN;
1856 	}
1857 
1858 	/*
1859 	 * Grab a TX buffer and associated resources.  Note that we depend
1860 	 * on the classification by the 802.11 layer to get to the right h/w
1861 	 * queue.  Management frames must ALWAYS go on queue 1 but we
1862 	 * cannot just force that here because we may receive non-mgt frames.
1863 	 */
1864 	txq = &sc->malo_txq[0];
1865 	bf = malo_getbuf(sc, txq);
1866 	if (bf == NULL) {
1867 		/* XXX blocks other traffic */
1868 		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1869 		ieee80211_free_node(ni);
1870 		m_freem(m);
1871 		return ENOBUFS;
1872 	}
1873 
1874 	/*
1875 	 * Pass the frame to the h/w for transmission.
1876 	 */
1877 	if (malo_tx_start(sc, ni, bf, m) != 0) {
1878 		ifp->if_oerrors++;
1879 		bf->bf_m = NULL;
1880 		bf->bf_node = NULL;
1881 		MALO_TXQ_LOCK(txq);
1882 		STAILQ_INSERT_HEAD(&txq->free, bf, bf_list);
1883 		txq->nfree++;
1884 		MALO_TXQ_UNLOCK(txq);
1885 
1886 		ieee80211_free_node(ni);
1887 		return EIO;		/* XXX */
1888 	}
1889 
1890 	/*
1891 	 * NB: We don't need to lock against tx done because this just
1892 	 * prods the firmware to check the transmit descriptors.  The firmware
1893 	 * will also start fetching descriptors by itself if it notices
1894 	 * new ones are present when it goes to deliver a tx done interrupt
1895 	 * to the host. So if we race with tx done processing it's ok.
1896 	 * Delivering the kick here rather than in malo_tx_start is
1897 	 * an optimization to avoid poking the firmware for each packet.
1898 	 *
1899 	 * NB: the queue id isn't used so 0 is ok.
1900 	 */
1901 	malo_hal_txstart(sc->malo_mh, 0/*XXX*/);
1902 
1903 	return 0;
1904 }
1905 
1906 static void
1907 malo_sysctlattach(struct malo_softc *sc)
1908 {
1909 #ifdef	MALO_DEBUG
1910 	struct sysctl_ctx_list *ctx = device_get_sysctl_ctx(sc->malo_dev);
1911 	struct sysctl_oid *tree = device_get_sysctl_tree(sc->malo_dev);
1912 
1913 	sc->malo_debug = malo_debug;
1914 	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
1915 		"debug", CTLFLAG_RW, &sc->malo_debug, 0,
1916 		"control debugging printfs");
1917 #endif
1918 }
1919 
1920 static void
1921 malo_announce(struct malo_softc *sc)
1922 {
1923 	struct ifnet *ifp = sc->malo_ifp;
1924 
1925 	if_printf(ifp, "versions [hw %d fw %d.%d.%d.%d] (regioncode %d)\n",
1926 		sc->malo_hwspecs.hwversion,
1927 		(sc->malo_hwspecs.fw_releasenum >> 24) & 0xff,
1928 		(sc->malo_hwspecs.fw_releasenum >> 16) & 0xff,
1929 		(sc->malo_hwspecs.fw_releasenum >> 8) & 0xff,
1930 		(sc->malo_hwspecs.fw_releasenum >> 0) & 0xff,
1931 		sc->malo_hwspecs.regioncode);
1932 
1933 	if (bootverbose || malo_rxbuf != MALO_RXBUF)
1934 		if_printf(ifp, "using %u rx buffers\n", malo_rxbuf);
1935 	if (bootverbose || malo_txbuf != MALO_TXBUF)
1936 		if_printf(ifp, "using %u tx buffers\n", malo_txbuf);
1937 }
1938 
1939 /*
1940  * Convert net80211 channel to a HAL channel.
1941  */
1942 static void
1943 malo_mapchan(struct malo_hal_channel *hc, const struct ieee80211_channel *chan)
1944 {
1945 	hc->channel = chan->ic_ieee;
1946 
1947 	*(uint32_t *)&hc->flags = 0;
1948 	if (IEEE80211_IS_CHAN_2GHZ(chan))
1949 		hc->flags.freqband = MALO_FREQ_BAND_2DOT4GHZ;
1950 }
1951 
1952 /*
1953  * Set/change channels.  If the channel is really being changed,
1954  * it's done by reseting the chip.  To accomplish this we must
1955  * first cleanup any pending DMA, then restart stuff after a la
1956  * malo_init.
1957  */
1958 static int
1959 malo_chan_set(struct malo_softc *sc, struct ieee80211_channel *chan)
1960 {
1961 	struct malo_hal *mh = sc->malo_mh;
1962 	struct malo_hal_channel hchan;
1963 
1964 	DPRINTF(sc, MALO_DEBUG_RESET, "%s: chan %u MHz/flags 0x%x\n",
1965 	    __func__, chan->ic_freq, chan->ic_flags);
1966 
1967 	/*
1968 	 * Convert to a HAL channel description with the flags constrained
1969 	 * to reflect the current operating mode.
1970 	 */
1971 	malo_mapchan(&hchan, chan);
1972 	malo_hal_intrset(mh, 0);		/* disable interrupts */
1973 	malo_hal_setchannel(mh, &hchan);
1974 	malo_hal_settxpower(mh, &hchan);
1975 
1976 	/*
1977 	 * Update internal state.
1978 	 */
1979 	sc->malo_tx_th.wt_chan_freq = htole16(chan->ic_freq);
1980 	sc->malo_rx_th.wr_chan_freq = htole16(chan->ic_freq);
1981 	if (IEEE80211_IS_CHAN_ANYG(chan)) {
1982 		sc->malo_tx_th.wt_chan_flags = htole16(IEEE80211_CHAN_G);
1983 		sc->malo_rx_th.wr_chan_flags = htole16(IEEE80211_CHAN_G);
1984 	} else {
1985 		sc->malo_tx_th.wt_chan_flags = htole16(IEEE80211_CHAN_B);
1986 		sc->malo_rx_th.wr_chan_flags = htole16(IEEE80211_CHAN_B);
1987 	}
1988 	sc->malo_curchan = hchan;
1989 	malo_hal_intrset(mh, sc->malo_imask);
1990 
1991 	return 0;
1992 }
1993 
1994 static void
1995 malo_scan_start(struct ieee80211com *ic)
1996 {
1997 	struct ifnet *ifp = ic->ic_ifp;
1998 	struct malo_softc *sc = ifp->if_softc;
1999 
2000 	DPRINTF(sc, MALO_DEBUG_STATE, "%s\n", __func__);
2001 }
2002 
2003 static void
2004 malo_scan_end(struct ieee80211com *ic)
2005 {
2006 	struct ifnet *ifp = ic->ic_ifp;
2007 	struct malo_softc *sc = ifp->if_softc;
2008 
2009 	DPRINTF(sc, MALO_DEBUG_STATE, "%s\n", __func__);
2010 }
2011 
2012 static void
2013 malo_set_channel(struct ieee80211com *ic)
2014 {
2015 	struct ifnet *ifp = ic->ic_ifp;
2016 	struct malo_softc *sc = ifp->if_softc;
2017 
2018 	(void) malo_chan_set(sc, ic->ic_curchan);
2019 }
2020 
2021 static void
2022 malo_rx_proc(void *arg, int npending)
2023 {
2024 #define	IEEE80211_DIR_DSTODS(wh)					\
2025 	((((const struct ieee80211_frame *)wh)->i_fc[1] &		\
2026 	    IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS)
2027 	struct malo_softc *sc = arg;
2028 	struct ifnet *ifp = sc->malo_ifp;
2029 	struct ieee80211com *ic = ifp->if_l2com;
2030 	struct malo_rxbuf *bf;
2031 	struct malo_rxdesc *ds;
2032 	struct mbuf *m, *mnew;
2033 	struct ieee80211_qosframe *wh;
2034 	struct ieee80211_qosframe_addr4 *wh4;
2035 	struct ieee80211_node *ni;
2036 	int off, len, hdrlen, pktlen, rssi, ntodo;
2037 	uint8_t *data, status;
2038 	uint32_t readptr, writeptr;
2039 
2040 	DPRINTF(sc, MALO_DEBUG_RX_PROC,
2041 	    "%s: pending %u rdptr(0x%x) 0x%x wrptr(0x%x) 0x%x\n",
2042 	    __func__, npending,
2043 	    sc->malo_hwspecs.rxdesc_read,
2044 	    malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_read),
2045 	    sc->malo_hwspecs.rxdesc_write,
2046 	    malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_write));
2047 
2048 	readptr = malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_read);
2049 	writeptr = malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_write);
2050 	if (readptr == writeptr)
2051 		return;
2052 
2053 	bf = sc->malo_rxnext;
2054 	for (ntodo = malo_rxquota; ntodo > 0 && readptr != writeptr; ntodo--) {
2055 		if (bf == NULL) {
2056 			bf = STAILQ_FIRST(&sc->malo_rxbuf);
2057 			break;
2058 		}
2059 		ds = bf->bf_desc;
2060 		if (bf->bf_m == NULL) {
2061 			/*
2062 			 * If data allocation failed previously there
2063 			 * will be no buffer; try again to re-populate it.
2064 			 * Note the firmware will not advance to the next
2065 			 * descriptor with a dma buffer so we must mimic
2066 			 * this or we'll get out of sync.
2067 			 */
2068 			DPRINTF(sc, MALO_DEBUG_ANY,
2069 			    "%s: rx buf w/o dma memory\n", __func__);
2070 			(void)malo_rxbuf_init(sc, bf);
2071 			break;
2072 		}
2073 		MALO_RXDESC_SYNC(sc, ds,
2074 		    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
2075 		if (ds->rxcontrol != MALO_RXD_CTRL_DMA_OWN)
2076 			break;
2077 
2078 		readptr = le32toh(ds->physnext);
2079 
2080 #ifdef MALO_DEBUG
2081 		if (sc->malo_debug & MALO_DEBUG_RECV_DESC)
2082 			malo_printrxbuf(bf, 0);
2083 #endif
2084 		status = ds->status;
2085 		if (status & MALO_RXD_STATUS_DECRYPT_ERR_MASK) {
2086 			ifp->if_ierrors++;
2087 			goto rx_next;
2088 		}
2089 		/*
2090 		 * Sync the data buffer.
2091 		 */
2092 		len = le16toh(ds->pktlen);
2093 		bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap,
2094 		    BUS_DMASYNC_POSTREAD);
2095 		/*
2096 		 * The 802.11 header is provided all or in part at the front;
2097 		 * use it to calculate the true size of the header that we'll
2098 		 * construct below.  We use this to figure out where to copy
2099 		 * payload prior to constructing the header.
2100 		 */
2101 		m = bf->bf_m;
2102 		data = mtod(m, uint8_t *);
2103 		hdrlen = ieee80211_anyhdrsize(data + sizeof(uint16_t));
2104 		off = sizeof(uint16_t) + sizeof(struct ieee80211_frame_addr4);
2105 
2106 		/*
2107 		 * Calculate RSSI. XXX wrong
2108 		 */
2109 		rssi = 2 * ((int) ds->snr - ds->nf);	/* NB: .5 dBm  */
2110 		if (rssi > 100)
2111 			rssi = 100;
2112 
2113 		pktlen = hdrlen + (len - off);
2114 		/*
2115 		 * NB: we know our frame is at least as large as
2116 		 * IEEE80211_MIN_LEN because there is a 4-address frame at
2117 		 * the front.  Hence there's no need to vet the packet length.
2118 		 * If the frame in fact is too small it should be discarded
2119 		 * at the net80211 layer.
2120 		 */
2121 
2122 		/* XXX don't need mbuf, just dma buffer */
2123 		mnew = malo_getrxmbuf(sc, bf);
2124 		if (mnew == NULL) {
2125 			ifp->if_ierrors++;
2126 			goto rx_next;
2127 		}
2128 		/*
2129 		 * Attach the dma buffer to the mbuf; malo_rxbuf_init will
2130 		 * re-setup the rx descriptor using the replacement dma
2131 		 * buffer we just installed above.
2132 		 */
2133 		bf->bf_m = mnew;
2134 		m->m_data += off - hdrlen;
2135 		m->m_pkthdr.len = m->m_len = pktlen;
2136 		m->m_pkthdr.rcvif = ifp;
2137 
2138 		/*
2139 		 * Piece 802.11 header together.
2140 		 */
2141 		wh = mtod(m, struct ieee80211_qosframe *);
2142 		/* NB: don't need to do this sometimes but ... */
2143 		/* XXX special case so we can memcpy after m_devget? */
2144 		ovbcopy(data + sizeof(uint16_t), wh, hdrlen);
2145 		if (IEEE80211_QOS_HAS_SEQ(wh)) {
2146 			if (IEEE80211_DIR_DSTODS(wh)) {
2147 				wh4 = mtod(m,
2148 				    struct ieee80211_qosframe_addr4*);
2149 				*(uint16_t *)wh4->i_qos = ds->qosctrl;
2150 			} else {
2151 				*(uint16_t *)wh->i_qos = ds->qosctrl;
2152 			}
2153 		}
2154 		if (ieee80211_radiotap_active(ic)) {
2155 			sc->malo_rx_th.wr_flags = 0;
2156 			sc->malo_rx_th.wr_rate = ds->rate;
2157 			sc->malo_rx_th.wr_antsignal = rssi;
2158 			sc->malo_rx_th.wr_antnoise = ds->nf;
2159 		}
2160 #ifdef MALO_DEBUG
2161 		if (IFF_DUMPPKTS_RECV(sc, wh)) {
2162 			ieee80211_dump_pkt(ic, mtod(m, caddr_t),
2163 			    len, ds->rate, rssi);
2164 		}
2165 #endif
2166 		ifp->if_ipackets++;
2167 
2168 		/* dispatch */
2169 		ni = ieee80211_find_rxnode(ic,
2170 		    (struct ieee80211_frame_min *)wh);
2171 		if (ni != NULL) {
2172 			(void) ieee80211_input(ni, m, rssi, ds->nf);
2173 			ieee80211_free_node(ni);
2174 		} else
2175 			(void) ieee80211_input_all(ic, m, rssi, ds->nf);
2176 rx_next:
2177 		/* NB: ignore ENOMEM so we process more descriptors */
2178 		(void) malo_rxbuf_init(sc, bf);
2179 		bf = STAILQ_NEXT(bf, bf_list);
2180 	}
2181 
2182 	malo_bar0_write4(sc, sc->malo_hwspecs.rxdesc_read, readptr);
2183 	sc->malo_rxnext = bf;
2184 
2185 	if ((ifp->if_drv_flags & IFF_DRV_OACTIVE) == 0 &&
2186 	    !IFQ_IS_EMPTY(&ifp->if_snd))
2187 		malo_start(ifp);
2188 #undef IEEE80211_DIR_DSTODS
2189 }
2190 
2191 static void
2192 malo_stop(struct ifnet *ifp, int disable)
2193 {
2194 	struct malo_softc *sc = ifp->if_softc;
2195 
2196 	MALO_LOCK(sc);
2197 	malo_stop_locked(ifp, disable);
2198 	MALO_UNLOCK(sc);
2199 }
2200 
2201 /*
2202  * Reclaim all tx queue resources.
2203  */
2204 static void
2205 malo_tx_cleanup(struct malo_softc *sc)
2206 {
2207 	int i;
2208 
2209 	for (i = 0; i < MALO_NUM_TX_QUEUES; i++)
2210 		malo_tx_cleanupq(sc, &sc->malo_txq[i]);
2211 }
2212 
2213 int
2214 malo_detach(struct malo_softc *sc)
2215 {
2216 	struct ifnet *ifp = sc->malo_ifp;
2217 	struct ieee80211com *ic = ifp->if_l2com;
2218 
2219 	DPRINTF(sc, MALO_DEBUG_ANY, "%s: if_flags %x\n",
2220 		__func__, ifp->if_flags);
2221 
2222 	malo_stop(ifp, 1);
2223 
2224 	if (sc->malo_tq != NULL) {
2225 		taskqueue_drain(sc->malo_tq, &sc->malo_rxtask);
2226 		taskqueue_drain(sc->malo_tq, &sc->malo_txtask);
2227 		taskqueue_free(sc->malo_tq);
2228 		sc->malo_tq = NULL;
2229 	}
2230 
2231 	/*
2232 	 * NB: the order of these is important:
2233 	 * o call the 802.11 layer before detaching the hal to
2234 	 *   insure callbacks into the driver to delete global
2235 	 *   key cache entries can be handled
2236 	 * o reclaim the tx queue data structures after calling
2237 	 *   the 802.11 layer as we'll get called back to reclaim
2238 	 *   node state and potentially want to use them
2239 	 * o to cleanup the tx queues the hal is called, so detach
2240 	 *   it last
2241 	 * Other than that, it's straightforward...
2242 	 */
2243 	ieee80211_ifdetach(ic);
2244 	callout_drain(&sc->malo_watchdog_timer);
2245 	malo_dma_cleanup(sc);
2246 	malo_tx_cleanup(sc);
2247 	malo_hal_detach(sc->malo_mh);
2248 	if_free(ifp);
2249 
2250 	MALO_LOCK_DESTROY(sc);
2251 
2252 	return 0;
2253 }
2254 
2255 void
2256 malo_shutdown(struct malo_softc *sc)
2257 {
2258 	malo_stop(sc->malo_ifp, 1);
2259 }
2260 
2261 void
2262 malo_suspend(struct malo_softc *sc)
2263 {
2264 	struct ifnet *ifp = sc->malo_ifp;
2265 
2266 	DPRINTF(sc, MALO_DEBUG_ANY, "%s: if_flags %x\n",
2267 		__func__, ifp->if_flags);
2268 
2269 	malo_stop(ifp, 1);
2270 }
2271 
2272 void
2273 malo_resume(struct malo_softc *sc)
2274 {
2275 	struct ifnet *ifp = sc->malo_ifp;
2276 
2277 	DPRINTF(sc, MALO_DEBUG_ANY, "%s: if_flags %x\n",
2278 		__func__, ifp->if_flags);
2279 
2280 	if (ifp->if_flags & IFF_UP)
2281 		malo_init(sc);
2282 }
2283