xref: /freebsd/sys/dev/malo/if_malo.c (revision dabf006a638fdc44cdcf69731de8ac83959db731)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 2008 Weongyo Jeong <weongyo@freebsd.org>
5  * Copyright (c) 2007 Marvell Semiconductor, Inc.
6  * Copyright (c) 2007 Sam Leffler, Errno Consulting
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer,
14  *    without modification.
15  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
16  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
17  *    redistribution must be conditioned upon including a substantially
18  *    similar Disclaimer requirement for further binary redistribution.
19  *
20  * NO WARRANTY
21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
24  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
25  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
26  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
27  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
28  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
29  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
30  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
31  * THE POSSIBILITY OF SUCH DAMAGES.
32  */
33 
34 #include "opt_malo.h"
35 
36 #include <sys/param.h>
37 #include <sys/endian.h>
38 #include <sys/kernel.h>
39 #include <sys/malloc.h>
40 #include <sys/socket.h>
41 #include <sys/sockio.h>
42 #include <sys/sysctl.h>
43 #include <sys/taskqueue.h>
44 
45 #include <machine/bus.h>
46 #include <sys/bus.h>
47 
48 #include <net/if.h>
49 #include <net/if_var.h>
50 #include <net/if_dl.h>
51 #include <net/if_media.h>
52 #include <net/if_types.h>
53 #include <net/ethernet.h>
54 
55 #include <net80211/ieee80211_var.h>
56 #include <net80211/ieee80211_regdomain.h>
57 
58 #include <net/bpf.h>
59 
60 #include <dev/malo/if_malo.h>
61 
62 SYSCTL_NODE(_hw, OID_AUTO, malo, CTLFLAG_RD | CTLFLAG_MPSAFE, 0,
63     "Marvell 88w8335 driver parameters");
64 
65 static	int malo_txcoalesce = 8;	/* # tx pkts to q before poking f/w*/
66 SYSCTL_INT(_hw_malo, OID_AUTO, txcoalesce, CTLFLAG_RWTUN, &malo_txcoalesce,
67 	    0, "tx buffers to send at once");
68 static	int malo_rxbuf = MALO_RXBUF;		/* # rx buffers to allocate */
69 SYSCTL_INT(_hw_malo, OID_AUTO, rxbuf, CTLFLAG_RWTUN, &malo_rxbuf,
70 	    0, "rx buffers allocated");
71 static	int malo_rxquota = MALO_RXBUF;		/* # max buffers to process */
72 SYSCTL_INT(_hw_malo, OID_AUTO, rxquota, CTLFLAG_RWTUN, &malo_rxquota,
73 	    0, "max rx buffers to process per interrupt");
74 static	int malo_txbuf = MALO_TXBUF;		/* # tx buffers to allocate */
75 SYSCTL_INT(_hw_malo, OID_AUTO, txbuf, CTLFLAG_RWTUN, &malo_txbuf,
76 	    0, "tx buffers allocated");
77 
78 #ifdef MALO_DEBUG
79 static	int malo_debug = 0;
80 SYSCTL_INT(_hw_malo, OID_AUTO, debug, CTLFLAG_RWTUN, &malo_debug,
81 	    0, "control debugging printfs");
82 enum {
83 	MALO_DEBUG_XMIT		= 0x00000001,	/* basic xmit operation */
84 	MALO_DEBUG_XMIT_DESC	= 0x00000002,	/* xmit descriptors */
85 	MALO_DEBUG_RECV		= 0x00000004,	/* basic recv operation */
86 	MALO_DEBUG_RECV_DESC	= 0x00000008,	/* recv descriptors */
87 	MALO_DEBUG_RESET	= 0x00000010,	/* reset processing */
88 	MALO_DEBUG_INTR		= 0x00000040,	/* ISR */
89 	MALO_DEBUG_TX_PROC	= 0x00000080,	/* tx ISR proc */
90 	MALO_DEBUG_RX_PROC	= 0x00000100,	/* rx ISR proc */
91 	MALO_DEBUG_STATE	= 0x00000400,	/* 802.11 state transitions */
92 	MALO_DEBUG_NODE		= 0x00000800,	/* node management */
93 	MALO_DEBUG_RECV_ALL	= 0x00001000,	/* trace all frames (beacons) */
94 	MALO_DEBUG_FW		= 0x00008000,	/* firmware */
95 	MALO_DEBUG_ANY		= 0xffffffff
96 };
97 #define	IFF_DUMPPKTS_RECV(sc, wh)					\
98 	(((sc->malo_debug & MALO_DEBUG_RECV) &&				\
99 	  ((sc->malo_debug & MALO_DEBUG_RECV_ALL) || !IEEE80211_IS_MGMT_BEACON(wh))))
100 #define	IFF_DUMPPKTS_XMIT(sc)						\
101 	(sc->malo_debug & MALO_DEBUG_XMIT)
102 #define	DPRINTF(sc, m, fmt, ...) do {				\
103 	if (sc->malo_debug & (m))				\
104 		printf(fmt, __VA_ARGS__);			\
105 } while (0)
106 #else
107 #define	DPRINTF(sc, m, fmt, ...) do {				\
108 	(void) sc;						\
109 } while (0)
110 #endif
111 
112 static MALLOC_DEFINE(M_MALODEV, "malodev", "malo driver dma buffers");
113 
114 static struct ieee80211vap *malo_vap_create(struct ieee80211com *,
115 		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
116 		    const uint8_t [IEEE80211_ADDR_LEN],
117 		    const uint8_t [IEEE80211_ADDR_LEN]);
118 static  void	malo_vap_delete(struct ieee80211vap *);
119 static	int	malo_dma_setup(struct malo_softc *);
120 static	int	malo_setup_hwdma(struct malo_softc *);
121 static	void	malo_txq_init(struct malo_softc *, struct malo_txq *, int);
122 static	void	malo_tx_cleanupq(struct malo_softc *, struct malo_txq *);
123 static	void	malo_parent(struct ieee80211com *);
124 static	int	malo_transmit(struct ieee80211com *, struct mbuf *);
125 static	void	malo_start(struct malo_softc *);
126 static	void	malo_watchdog(void *);
127 static	void	malo_updateslot(struct ieee80211com *);
128 static	int	malo_newstate(struct ieee80211vap *, enum ieee80211_state, int);
129 static	void	malo_scan_start(struct ieee80211com *);
130 static	void	malo_scan_end(struct ieee80211com *);
131 static	void	malo_set_channel(struct ieee80211com *);
132 static	int	malo_raw_xmit(struct ieee80211_node *, struct mbuf *,
133 		    const struct ieee80211_bpf_params *);
134 static	void	malo_sysctlattach(struct malo_softc *);
135 static	void	malo_announce(struct malo_softc *);
136 static	void	malo_dma_cleanup(struct malo_softc *);
137 static	void	malo_stop(struct malo_softc *);
138 static	int	malo_chan_set(struct malo_softc *, struct ieee80211_channel *);
139 static	int	malo_mode_init(struct malo_softc *);
140 static	void	malo_tx_proc(void *, int);
141 static	void	malo_rx_proc(void *, int);
142 static	void	malo_init(void *);
143 
144 /*
145  * Read/Write shorthands for accesses to BAR 0.  Note that all BAR 1
146  * operations are done in the "hal" except getting H/W MAC address at
147  * malo_attach and there should be no reference to them here.
148  */
149 static uint32_t
150 malo_bar0_read4(struct malo_softc *sc, bus_size_t off)
151 {
152 	return bus_space_read_4(sc->malo_io0t, sc->malo_io0h, off);
153 }
154 
155 static void
156 malo_bar0_write4(struct malo_softc *sc, bus_size_t off, uint32_t val)
157 {
158 	DPRINTF(sc, MALO_DEBUG_FW, "%s: off 0x%jx val 0x%x\n",
159 	    __func__, (uintmax_t)off, val);
160 
161 	bus_space_write_4(sc->malo_io0t, sc->malo_io0h, off, val);
162 }
163 
164 int
165 malo_attach(uint16_t devid, struct malo_softc *sc)
166 {
167 	struct ieee80211com *ic = &sc->malo_ic;
168 	struct malo_hal *mh;
169 	int error;
170 	uint8_t bands[IEEE80211_MODE_BYTES];
171 
172 	MALO_LOCK_INIT(sc);
173 	callout_init_mtx(&sc->malo_watchdog_timer, &sc->malo_mtx, 0);
174 	mbufq_init(&sc->malo_snd, ifqmaxlen);
175 
176 	mh = malo_hal_attach(sc->malo_dev, devid,
177 	    sc->malo_io1h, sc->malo_io1t, sc->malo_dmat);
178 	if (mh == NULL) {
179 		device_printf(sc->malo_dev, "unable to attach HAL\n");
180 		error = EIO;
181 		goto bad;
182 	}
183 	sc->malo_mh = mh;
184 
185 	/*
186 	 * Load firmware so we can get setup.  We arbitrarily pick station
187 	 * firmware; we'll re-load firmware as needed so setting up
188 	 * the wrong mode isn't a big deal.
189 	 */
190 	error = malo_hal_fwload(mh, "malo8335-h", "malo8335-m");
191 	if (error != 0) {
192 		device_printf(sc->malo_dev, "unable to setup firmware\n");
193 		goto bad1;
194 	}
195 	/* XXX gethwspecs() extracts correct informations?  not maybe!  */
196 	error = malo_hal_gethwspecs(mh, &sc->malo_hwspecs);
197 	if (error != 0) {
198 		device_printf(sc->malo_dev, "unable to fetch h/w specs\n");
199 		goto bad1;
200 	}
201 
202 	DPRINTF(sc, MALO_DEBUG_FW,
203 	    "malo_hal_gethwspecs: hwversion 0x%x hostif 0x%x"
204 	    "maxnum_wcb 0x%x maxnum_mcaddr 0x%x maxnum_tx_wcb 0x%x"
205 	    "regioncode 0x%x num_antenna 0x%x fw_releasenum 0x%x"
206 	    "wcbbase0 0x%x rxdesc_read 0x%x rxdesc_write 0x%x"
207 	    "ul_fw_awakecookie 0x%x w[4] = %x %x %x %x",
208 	    sc->malo_hwspecs.hwversion,
209 	    sc->malo_hwspecs.hostinterface, sc->malo_hwspecs.maxnum_wcb,
210 	    sc->malo_hwspecs.maxnum_mcaddr, sc->malo_hwspecs.maxnum_tx_wcb,
211 	    sc->malo_hwspecs.regioncode, sc->malo_hwspecs.num_antenna,
212 	    sc->malo_hwspecs.fw_releasenum, sc->malo_hwspecs.wcbbase0,
213 	    sc->malo_hwspecs.rxdesc_read, sc->malo_hwspecs.rxdesc_write,
214 	    sc->malo_hwspecs.ul_fw_awakecookie,
215 	    sc->malo_hwspecs.wcbbase[0], sc->malo_hwspecs.wcbbase[1],
216 	    sc->malo_hwspecs.wcbbase[2], sc->malo_hwspecs.wcbbase[3]);
217 
218 	/* NB: firmware looks that it does not export regdomain info API.  */
219 	memset(bands, 0, sizeof(bands));
220 	setbit(bands, IEEE80211_MODE_11B);
221 	setbit(bands, IEEE80211_MODE_11G);
222 	ieee80211_init_channels(ic, NULL, bands);
223 
224 	sc->malo_txantenna = 0x2;	/* h/w default */
225 	sc->malo_rxantenna = 0xffff;	/* h/w default */
226 
227 	/*
228 	 * Allocate tx + rx descriptors and populate the lists.
229 	 * We immediately push the information to the firmware
230 	 * as otherwise it gets upset.
231 	 */
232 	error = malo_dma_setup(sc);
233 	if (error != 0) {
234 		device_printf(sc->malo_dev,
235 		    "failed to setup descriptors: %d\n", error);
236 		goto bad1;
237 	}
238 	error = malo_setup_hwdma(sc);	/* push to firmware */
239 	if (error != 0)			/* NB: malo_setupdma prints msg */
240 		goto bad2;
241 
242 	sc->malo_tq = taskqueue_create_fast("malo_taskq", M_NOWAIT,
243 		taskqueue_thread_enqueue, &sc->malo_tq);
244 	taskqueue_start_threads(&sc->malo_tq, 1, PI_NET,
245 		"%s taskq", device_get_nameunit(sc->malo_dev));
246 
247 	NET_TASK_INIT(&sc->malo_rxtask, 0, malo_rx_proc, sc);
248 	TASK_INIT(&sc->malo_txtask, 0, malo_tx_proc, sc);
249 
250 	ic->ic_softc = sc;
251 	ic->ic_name = device_get_nameunit(sc->malo_dev);
252 	/* XXX not right but it's not used anywhere important */
253 	ic->ic_phytype = IEEE80211_T_OFDM;
254 	ic->ic_opmode = IEEE80211_M_STA;
255 	ic->ic_caps =
256 	      IEEE80211_C_STA			/* station mode supported */
257 	    | IEEE80211_C_BGSCAN		/* capable of bg scanning */
258 	    | IEEE80211_C_MONITOR		/* monitor mode */
259 	    | IEEE80211_C_SHPREAMBLE		/* short preamble supported */
260 	    | IEEE80211_C_SHSLOT		/* short slot time supported */
261 	    | IEEE80211_C_TXPMGT		/* capable of txpow mgt */
262 	    | IEEE80211_C_WPA			/* capable of WPA1+WPA2 */
263 	    ;
264 	IEEE80211_ADDR_COPY(ic->ic_macaddr, sc->malo_hwspecs.macaddr);
265 
266 	/*
267 	 * Transmit requires space in the packet for a special format transmit
268 	 * record and optional padding between this record and the payload.
269 	 * Ask the net80211 layer to arrange this when encapsulating
270 	 * packets so we can add it efficiently.
271 	 */
272 	ic->ic_headroom = sizeof(struct malo_txrec) -
273 		sizeof(struct ieee80211_frame);
274 
275 	/* call MI attach routine. */
276 	ieee80211_ifattach(ic);
277 	/* override default methods */
278 	ic->ic_vap_create = malo_vap_create;
279 	ic->ic_vap_delete = malo_vap_delete;
280 	ic->ic_raw_xmit = malo_raw_xmit;
281 	ic->ic_updateslot = malo_updateslot;
282 	ic->ic_scan_start = malo_scan_start;
283 	ic->ic_scan_end = malo_scan_end;
284 	ic->ic_set_channel = malo_set_channel;
285 	ic->ic_parent = malo_parent;
286 	ic->ic_transmit = malo_transmit;
287 
288 	sc->malo_invalid = 0;		/* ready to go, enable int handling */
289 
290 	ieee80211_radiotap_attach(ic,
291 	    &sc->malo_tx_th.wt_ihdr, sizeof(sc->malo_tx_th),
292 		MALO_TX_RADIOTAP_PRESENT,
293 	    &sc->malo_rx_th.wr_ihdr, sizeof(sc->malo_rx_th),
294 		MALO_RX_RADIOTAP_PRESENT);
295 
296 	/*
297 	 * Setup dynamic sysctl's.
298 	 */
299 	malo_sysctlattach(sc);
300 
301 	if (bootverbose)
302 		ieee80211_announce(ic);
303 	malo_announce(sc);
304 
305 	return 0;
306 bad2:
307 	malo_dma_cleanup(sc);
308 bad1:
309 	malo_hal_detach(mh);
310 bad:
311 	sc->malo_invalid = 1;
312 
313 	return error;
314 }
315 
316 static struct ieee80211vap *
317 malo_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
318     enum ieee80211_opmode opmode, int flags,
319     const uint8_t bssid[IEEE80211_ADDR_LEN],
320     const uint8_t mac[IEEE80211_ADDR_LEN])
321 {
322 	struct malo_softc *sc = ic->ic_softc;
323 	struct malo_vap *mvp;
324 	struct ieee80211vap *vap;
325 
326 	if (!TAILQ_EMPTY(&ic->ic_vaps)) {
327 		device_printf(sc->malo_dev, "multiple vaps not supported\n");
328 		return NULL;
329 	}
330 	switch (opmode) {
331 	case IEEE80211_M_STA:
332 		if (opmode == IEEE80211_M_STA)
333 			flags |= IEEE80211_CLONE_NOBEACONS;
334 		/* fall thru... */
335 	case IEEE80211_M_MONITOR:
336 		break;
337 	default:
338 		device_printf(sc->malo_dev, "%s mode not supported\n",
339 		    ieee80211_opmode_name[opmode]);
340 		return NULL;		/* unsupported */
341 	}
342 	mvp = malloc(sizeof(struct malo_vap), M_80211_VAP, M_WAITOK | M_ZERO);
343 	vap = &mvp->malo_vap;
344 	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
345 
346 	/* override state transition machine */
347 	mvp->malo_newstate = vap->iv_newstate;
348 	vap->iv_newstate = malo_newstate;
349 
350 	/* complete setup */
351 	ieee80211_vap_attach(vap,
352 	    ieee80211_media_change, ieee80211_media_status, mac);
353 	ic->ic_opmode = opmode;
354 	return vap;
355 }
356 
357 static void
358 malo_vap_delete(struct ieee80211vap *vap)
359 {
360 	struct malo_vap *mvp = MALO_VAP(vap);
361 
362 	ieee80211_vap_detach(vap);
363 	free(mvp, M_80211_VAP);
364 }
365 
366 int
367 malo_intr(void *arg)
368 {
369 	struct malo_softc *sc = arg;
370 	struct malo_hal *mh = sc->malo_mh;
371 	uint32_t status;
372 
373 	if (sc->malo_invalid) {
374 		/*
375 		 * The hardware is not ready/present, don't touch anything.
376 		 * Note this can happen early on if the IRQ is shared.
377 		 */
378 		DPRINTF(sc, MALO_DEBUG_ANY, "%s: invalid; ignored\n", __func__);
379 		return (FILTER_STRAY);
380 	}
381 
382 	/*
383 	 * Figure out the reason(s) for the interrupt.
384 	 */
385 	malo_hal_getisr(mh, &status);		/* NB: clears ISR too */
386 	if (status == 0)			/* must be a shared irq */
387 		return (FILTER_STRAY);
388 
389 	DPRINTF(sc, MALO_DEBUG_INTR, "%s: status 0x%x imask 0x%x\n",
390 	    __func__, status, sc->malo_imask);
391 
392 	if (status & MALO_A2HRIC_BIT_RX_RDY)
393 		taskqueue_enqueue(sc->malo_tq, &sc->malo_rxtask);
394 	if (status & MALO_A2HRIC_BIT_TX_DONE)
395 		taskqueue_enqueue(sc->malo_tq, &sc->malo_txtask);
396 	if (status & MALO_A2HRIC_BIT_OPC_DONE)
397 		malo_hal_cmddone(mh);
398 	if (status & MALO_A2HRIC_BIT_MAC_EVENT)
399 		;
400 	if (status & MALO_A2HRIC_BIT_RX_PROBLEM)
401 		;
402 	if (status & MALO_A2HRIC_BIT_ICV_ERROR) {
403 		/* TKIP ICV error */
404 		sc->malo_stats.mst_rx_badtkipicv++;
405 	}
406 #ifdef MALO_DEBUG
407 	if (((status | sc->malo_imask) ^ sc->malo_imask) != 0)
408 		DPRINTF(sc, MALO_DEBUG_INTR,
409 		    "%s: can't handle interrupt status 0x%x\n",
410 		    __func__, status);
411 #endif
412 	return (FILTER_HANDLED);
413 }
414 
415 static void
416 malo_load_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
417 {
418 	bus_addr_t *paddr = (bus_addr_t*) arg;
419 
420 	KASSERT(error == 0, ("error %u on bus_dma callback", error));
421 
422 	*paddr = segs->ds_addr;
423 }
424 
425 static int
426 malo_desc_setup(struct malo_softc *sc, const char *name,
427     struct malo_descdma *dd,
428     int nbuf, size_t bufsize, int ndesc, size_t descsize)
429 {
430 	int error;
431 	uint8_t *ds;
432 
433 	DPRINTF(sc, MALO_DEBUG_RESET,
434 	    "%s: %s DMA: %u bufs (%ju) %u desc/buf (%ju)\n",
435 	    __func__, name, nbuf, (uintmax_t) bufsize,
436 	    ndesc, (uintmax_t) descsize);
437 
438 	dd->dd_name = name;
439 	dd->dd_desc_len = nbuf * ndesc * descsize;
440 
441 	/*
442 	 * Setup DMA descriptor area.
443 	 */
444 	error = bus_dma_tag_create(bus_get_dma_tag(sc->malo_dev),/* parent */
445 		       PAGE_SIZE, 0,		/* alignment, bounds */
446 		       BUS_SPACE_MAXADDR_32BIT,	/* lowaddr */
447 		       BUS_SPACE_MAXADDR,	/* highaddr */
448 		       NULL, NULL,		/* filter, filterarg */
449 		       dd->dd_desc_len,		/* maxsize */
450 		       1,			/* nsegments */
451 		       dd->dd_desc_len,		/* maxsegsize */
452 		       BUS_DMA_ALLOCNOW,	/* flags */
453 		       NULL,			/* lockfunc */
454 		       NULL,			/* lockarg */
455 		       &dd->dd_dmat);
456 	if (error != 0) {
457 		device_printf(sc->malo_dev, "cannot allocate %s DMA tag\n",
458 		    dd->dd_name);
459 		return error;
460 	}
461 
462 	/* allocate descriptors */
463 	error = bus_dmamem_alloc(dd->dd_dmat, (void**) &dd->dd_desc,
464 	    BUS_DMA_NOWAIT | BUS_DMA_COHERENT, &dd->dd_dmamap);
465 	if (error != 0) {
466 		device_printf(sc->malo_dev,
467 		    "unable to alloc memory for %u %s descriptors, "
468 		    "error %u\n", nbuf * ndesc, dd->dd_name, error);
469 		goto fail1;
470 	}
471 
472 	error = bus_dmamap_load(dd->dd_dmat, dd->dd_dmamap,
473 	    dd->dd_desc, dd->dd_desc_len,
474 	    malo_load_cb, &dd->dd_desc_paddr, BUS_DMA_NOWAIT);
475 	if (error != 0) {
476 		device_printf(sc->malo_dev,
477 		    "unable to map %s descriptors, error %u\n",
478 		    dd->dd_name, error);
479 		goto fail2;
480 	}
481 
482 	ds = dd->dd_desc;
483 	memset(ds, 0, dd->dd_desc_len);
484 	DPRINTF(sc, MALO_DEBUG_RESET,
485 	    "%s: %s DMA map: %p (%lu) -> 0x%jx (%lu)\n",
486 	    __func__, dd->dd_name, ds, (u_long) dd->dd_desc_len,
487 	    (uintmax_t) dd->dd_desc_paddr, /*XXX*/ (u_long) dd->dd_desc_len);
488 
489 	return 0;
490 fail2:
491 	bus_dmamem_free(dd->dd_dmat, dd->dd_desc, dd->dd_dmamap);
492 fail1:
493 	bus_dma_tag_destroy(dd->dd_dmat);
494 	memset(dd, 0, sizeof(*dd));
495 	return error;
496 }
497 
498 #define	DS2PHYS(_dd, _ds) \
499 	((_dd)->dd_desc_paddr + ((caddr_t)(_ds) - (caddr_t)(_dd)->dd_desc))
500 
501 static int
502 malo_rxdma_setup(struct malo_softc *sc)
503 {
504 	int error, bsize, i;
505 	struct malo_rxbuf *bf;
506 	struct malo_rxdesc *ds;
507 
508 	error = malo_desc_setup(sc, "rx", &sc->malo_rxdma,
509 	    malo_rxbuf, sizeof(struct malo_rxbuf),
510 	    1, sizeof(struct malo_rxdesc));
511 	if (error != 0)
512 		return error;
513 
514 	/*
515 	 * Allocate rx buffers and set them up.
516 	 */
517 	bsize = malo_rxbuf * sizeof(struct malo_rxbuf);
518 	bf = malloc(bsize, M_MALODEV, M_NOWAIT | M_ZERO);
519 	if (bf == NULL) {
520 		device_printf(sc->malo_dev,
521 		    "malloc of %u rx buffers failed\n", bsize);
522 		return error;
523 	}
524 	sc->malo_rxdma.dd_bufptr = bf;
525 
526 	STAILQ_INIT(&sc->malo_rxbuf);
527 	ds = sc->malo_rxdma.dd_desc;
528 	for (i = 0; i < malo_rxbuf; i++, bf++, ds++) {
529 		bf->bf_desc = ds;
530 		bf->bf_daddr = DS2PHYS(&sc->malo_rxdma, ds);
531 		error = bus_dmamap_create(sc->malo_dmat, BUS_DMA_NOWAIT,
532 		    &bf->bf_dmamap);
533 		if (error != 0) {
534 			device_printf(sc->malo_dev,
535 			    "%s: unable to dmamap for rx buffer, error %d\n",
536 			    __func__, error);
537 			return error;
538 		}
539 		/* NB: tail is intentional to preserve descriptor order */
540 		STAILQ_INSERT_TAIL(&sc->malo_rxbuf, bf, bf_list);
541 	}
542 	return 0;
543 }
544 
545 static int
546 malo_txdma_setup(struct malo_softc *sc, struct malo_txq *txq)
547 {
548 	int error, bsize, i;
549 	struct malo_txbuf *bf;
550 	struct malo_txdesc *ds;
551 
552 	error = malo_desc_setup(sc, "tx", &txq->dma,
553 	    malo_txbuf, sizeof(struct malo_txbuf),
554 	    MALO_TXDESC, sizeof(struct malo_txdesc));
555 	if (error != 0)
556 		return error;
557 
558 	/* allocate and setup tx buffers */
559 	bsize = malo_txbuf * sizeof(struct malo_txbuf);
560 	bf = malloc(bsize, M_MALODEV, M_NOWAIT | M_ZERO);
561 	if (bf == NULL) {
562 		device_printf(sc->malo_dev, "malloc of %u tx buffers failed\n",
563 		    malo_txbuf);
564 		return ENOMEM;
565 	}
566 	txq->dma.dd_bufptr = bf;
567 
568 	STAILQ_INIT(&txq->free);
569 	txq->nfree = 0;
570 	ds = txq->dma.dd_desc;
571 	for (i = 0; i < malo_txbuf; i++, bf++, ds += MALO_TXDESC) {
572 		bf->bf_desc = ds;
573 		bf->bf_daddr = DS2PHYS(&txq->dma, ds);
574 		error = bus_dmamap_create(sc->malo_dmat, BUS_DMA_NOWAIT,
575 		    &bf->bf_dmamap);
576 		if (error != 0) {
577 			device_printf(sc->malo_dev,
578 			    "unable to create dmamap for tx "
579 			    "buffer %u, error %u\n", i, error);
580 			return error;
581 		}
582 		STAILQ_INSERT_TAIL(&txq->free, bf, bf_list);
583 		txq->nfree++;
584 	}
585 
586 	return 0;
587 }
588 
589 static void
590 malo_desc_cleanup(struct malo_softc *sc, struct malo_descdma *dd)
591 {
592 	bus_dmamap_unload(dd->dd_dmat, dd->dd_dmamap);
593 	bus_dmamem_free(dd->dd_dmat, dd->dd_desc, dd->dd_dmamap);
594 	bus_dma_tag_destroy(dd->dd_dmat);
595 
596 	memset(dd, 0, sizeof(*dd));
597 }
598 
599 static void
600 malo_rxdma_cleanup(struct malo_softc *sc)
601 {
602 	struct malo_rxbuf *bf;
603 
604 	STAILQ_FOREACH(bf, &sc->malo_rxbuf, bf_list) {
605 		if (bf->bf_m != NULL) {
606 			m_freem(bf->bf_m);
607 			bf->bf_m = NULL;
608 		}
609 		if (bf->bf_dmamap != NULL) {
610 			bus_dmamap_destroy(sc->malo_dmat, bf->bf_dmamap);
611 			bf->bf_dmamap = NULL;
612 		}
613 	}
614 	STAILQ_INIT(&sc->malo_rxbuf);
615 	if (sc->malo_rxdma.dd_bufptr != NULL) {
616 		free(sc->malo_rxdma.dd_bufptr, M_MALODEV);
617 		sc->malo_rxdma.dd_bufptr = NULL;
618 	}
619 	if (sc->malo_rxdma.dd_desc_len != 0)
620 		malo_desc_cleanup(sc, &sc->malo_rxdma);
621 }
622 
623 static void
624 malo_txdma_cleanup(struct malo_softc *sc, struct malo_txq *txq)
625 {
626 	struct malo_txbuf *bf;
627 	struct ieee80211_node *ni;
628 
629 	STAILQ_FOREACH(bf, &txq->free, bf_list) {
630 		if (bf->bf_m != NULL) {
631 			m_freem(bf->bf_m);
632 			bf->bf_m = NULL;
633 		}
634 		ni = bf->bf_node;
635 		bf->bf_node = NULL;
636 		if (ni != NULL) {
637 			/*
638 			 * Reclaim node reference.
639 			 */
640 			ieee80211_free_node(ni);
641 		}
642 		if (bf->bf_dmamap != NULL) {
643 			bus_dmamap_destroy(sc->malo_dmat, bf->bf_dmamap);
644 			bf->bf_dmamap = NULL;
645 		}
646 	}
647 	STAILQ_INIT(&txq->free);
648 	txq->nfree = 0;
649 	if (txq->dma.dd_bufptr != NULL) {
650 		free(txq->dma.dd_bufptr, M_MALODEV);
651 		txq->dma.dd_bufptr = NULL;
652 	}
653 	if (txq->dma.dd_desc_len != 0)
654 		malo_desc_cleanup(sc, &txq->dma);
655 }
656 
657 static void
658 malo_dma_cleanup(struct malo_softc *sc)
659 {
660 	int i;
661 
662 	for (i = 0; i < MALO_NUM_TX_QUEUES; i++)
663 		malo_txdma_cleanup(sc, &sc->malo_txq[i]);
664 
665 	malo_rxdma_cleanup(sc);
666 }
667 
668 static int
669 malo_dma_setup(struct malo_softc *sc)
670 {
671 	int error, i;
672 
673 	/* rxdma initializing.  */
674 	error = malo_rxdma_setup(sc);
675 	if (error != 0)
676 		return error;
677 
678 	/* NB: we just have 1 tx queue now.  */
679 	for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
680 		error = malo_txdma_setup(sc, &sc->malo_txq[i]);
681 		if (error != 0) {
682 			malo_dma_cleanup(sc);
683 
684 			return error;
685 		}
686 
687 		malo_txq_init(sc, &sc->malo_txq[i], i);
688 	}
689 
690 	return 0;
691 }
692 
693 static void
694 malo_hal_set_rxtxdma(struct malo_softc *sc)
695 {
696 	int i;
697 
698 	malo_bar0_write4(sc, sc->malo_hwspecs.rxdesc_read,
699 	    sc->malo_hwdma.rxdesc_read);
700 	malo_bar0_write4(sc, sc->malo_hwspecs.rxdesc_write,
701 	    sc->malo_hwdma.rxdesc_read);
702 
703 	for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
704 		malo_bar0_write4(sc,
705 		    sc->malo_hwspecs.wcbbase[i], sc->malo_hwdma.wcbbase[i]);
706 	}
707 }
708 
709 /*
710  * Inform firmware of our tx/rx dma setup.  The BAR 0 writes below are
711  * for compatibility with older firmware.  For current firmware we send
712  * this information with a cmd block via malo_hal_sethwdma.
713  */
714 static int
715 malo_setup_hwdma(struct malo_softc *sc)
716 {
717 	int i;
718 	struct malo_txq *txq;
719 
720 	sc->malo_hwdma.rxdesc_read = sc->malo_rxdma.dd_desc_paddr;
721 
722 	for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
723 		txq = &sc->malo_txq[i];
724 		sc->malo_hwdma.wcbbase[i] = txq->dma.dd_desc_paddr;
725 	}
726 	sc->malo_hwdma.maxnum_txwcb = malo_txbuf;
727 	sc->malo_hwdma.maxnum_wcb = MALO_NUM_TX_QUEUES;
728 
729 	malo_hal_set_rxtxdma(sc);
730 
731 	return 0;
732 }
733 
734 static void
735 malo_txq_init(struct malo_softc *sc, struct malo_txq *txq, int qnum)
736 {
737 	struct malo_txbuf *bf, *bn;
738 	struct malo_txdesc *ds;
739 
740 	MALO_TXQ_LOCK_INIT(sc, txq);
741 	txq->qnum = qnum;
742 	txq->txpri = 0;	/* XXX */
743 
744 	STAILQ_FOREACH(bf, &txq->free, bf_list) {
745 		bf->bf_txq = txq;
746 
747 		ds = bf->bf_desc;
748 		bn = STAILQ_NEXT(bf, bf_list);
749 		if (bn == NULL)
750 			bn = STAILQ_FIRST(&txq->free);
751 		ds->physnext = htole32(bn->bf_daddr);
752 	}
753 	STAILQ_INIT(&txq->active);
754 }
755 
756 /*
757  * Reclaim resources for a setup queue.
758  */
759 static void
760 malo_tx_cleanupq(struct malo_softc *sc, struct malo_txq *txq)
761 {
762 	/* XXX hal work? */
763 	MALO_TXQ_LOCK_DESTROY(txq);
764 }
765 
766 /*
767  * Allocate a tx buffer for sending a frame.
768  */
769 static struct malo_txbuf *
770 malo_getbuf(struct malo_softc *sc, struct malo_txq *txq)
771 {
772 	struct malo_txbuf *bf;
773 
774 	MALO_TXQ_LOCK(txq);
775 	bf = STAILQ_FIRST(&txq->free);
776 	if (bf != NULL) {
777 		STAILQ_REMOVE_HEAD(&txq->free, bf_list);
778 		txq->nfree--;
779 	}
780 	MALO_TXQ_UNLOCK(txq);
781 	if (bf == NULL) {
782 		DPRINTF(sc, MALO_DEBUG_XMIT,
783 		    "%s: out of xmit buffers on q %d\n", __func__, txq->qnum);
784 		sc->malo_stats.mst_tx_qstop++;
785 	}
786 	return bf;
787 }
788 
789 static int
790 malo_tx_dmasetup(struct malo_softc *sc, struct malo_txbuf *bf, struct mbuf *m0)
791 {
792 	struct mbuf *m;
793 	int error;
794 
795 	/*
796 	 * Load the DMA map so any coalescing is done.  This also calculates
797 	 * the number of descriptors we need.
798 	 */
799 	error = bus_dmamap_load_mbuf_sg(sc->malo_dmat, bf->bf_dmamap, m0,
800 				     bf->bf_segs, &bf->bf_nseg,
801 				     BUS_DMA_NOWAIT);
802 	if (error == EFBIG) {
803 		/* XXX packet requires too many descriptors */
804 		bf->bf_nseg = MALO_TXDESC + 1;
805 	} else if (error != 0) {
806 		sc->malo_stats.mst_tx_busdma++;
807 		m_freem(m0);
808 		return error;
809 	}
810 	/*
811 	 * Discard null packets and check for packets that require too many
812 	 * TX descriptors.  We try to convert the latter to a cluster.
813 	 */
814 	if (error == EFBIG) {		/* too many desc's, linearize */
815 		sc->malo_stats.mst_tx_linear++;
816 		m = m_defrag(m0, M_NOWAIT);
817 		if (m == NULL) {
818 			m_freem(m0);
819 			sc->malo_stats.mst_tx_nombuf++;
820 			return ENOMEM;
821 		}
822 		m0 = m;
823 		error = bus_dmamap_load_mbuf_sg(sc->malo_dmat, bf->bf_dmamap, m0,
824 					     bf->bf_segs, &bf->bf_nseg,
825 					     BUS_DMA_NOWAIT);
826 		if (error != 0) {
827 			sc->malo_stats.mst_tx_busdma++;
828 			m_freem(m0);
829 			return error;
830 		}
831 		KASSERT(bf->bf_nseg <= MALO_TXDESC,
832 		    ("too many segments after defrag; nseg %u", bf->bf_nseg));
833 	} else if (bf->bf_nseg == 0) {		/* null packet, discard */
834 		sc->malo_stats.mst_tx_nodata++;
835 		m_freem(m0);
836 		return EIO;
837 	}
838 	DPRINTF(sc, MALO_DEBUG_XMIT, "%s: m %p len %u\n",
839 		__func__, m0, m0->m_pkthdr.len);
840 	bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
841 	bf->bf_m = m0;
842 
843 	return 0;
844 }
845 
846 #ifdef MALO_DEBUG
847 static void
848 malo_printrxbuf(const struct malo_rxbuf *bf, u_int ix)
849 {
850 	const struct malo_rxdesc *ds = bf->bf_desc;
851 	uint32_t status = le32toh(ds->status);
852 
853 	printf("R[%2u] (DS.V:%p DS.P:0x%jx) NEXT:%08x DATA:%08x RC:%02x%s\n"
854 	    "      STAT:%02x LEN:%04x SNR:%02x NF:%02x CHAN:%02x"
855 	    " RATE:%02x QOS:%04x\n", ix, ds, (uintmax_t)bf->bf_daddr,
856 	    le32toh(ds->physnext), le32toh(ds->physbuffdata),
857 	    ds->rxcontrol,
858 	    ds->rxcontrol != MALO_RXD_CTRL_DRIVER_OWN ?
859 	        "" : (status & MALO_RXD_STATUS_OK) ? " *" : " !",
860 	    ds->status, le16toh(ds->pktlen), ds->snr, ds->nf, ds->channel,
861 	    ds->rate, le16toh(ds->qosctrl));
862 }
863 
864 static void
865 malo_printtxbuf(const struct malo_txbuf *bf, u_int qnum, u_int ix)
866 {
867 	const struct malo_txdesc *ds = bf->bf_desc;
868 	uint32_t status = le32toh(ds->status);
869 
870 	printf("Q%u[%3u]", qnum, ix);
871 	printf(" (DS.V:%p DS.P:0x%jx)\n", ds, (uintmax_t)bf->bf_daddr);
872 	printf("    NEXT:%08x DATA:%08x LEN:%04x STAT:%08x%s\n",
873 	    le32toh(ds->physnext),
874 	    le32toh(ds->pktptr), le16toh(ds->pktlen), status,
875 	    status & MALO_TXD_STATUS_USED ?
876 	    "" : (status & 3) != 0 ? " *" : " !");
877 	printf("    RATE:%02x PRI:%x QOS:%04x SAP:%08x FORMAT:%04x\n",
878 	    ds->datarate, ds->txpriority, le16toh(ds->qosctrl),
879 	    le32toh(ds->sap_pktinfo), le16toh(ds->format));
880 #if 0
881 	{
882 		const uint8_t *cp = (const uint8_t *) ds;
883 		int i;
884 		for (i = 0; i < sizeof(struct malo_txdesc); i++) {
885 			printf("%02x ", cp[i]);
886 			if (((i+1) % 16) == 0)
887 				printf("\n");
888 		}
889 		printf("\n");
890 	}
891 #endif
892 }
893 #endif /* MALO_DEBUG */
894 
895 static __inline void
896 malo_updatetxrate(struct ieee80211_node *ni, int rix)
897 {
898 	static const int ieeerates[] =
899 	    { 2, 4, 11, 22, 44, 12, 18, 24, 36, 48, 96, 108 };
900 	if (rix < nitems(ieeerates))
901 		ni->ni_txrate = ieeerates[rix];
902 }
903 
904 static int
905 malo_fix2rate(int fix_rate)
906 {
907 	static const int rates[] =
908 	    { 2, 4, 11, 22, 12, 18, 24, 36, 48, 96, 108 };
909 	return (fix_rate < nitems(rates) ? rates[fix_rate] : 0);
910 }
911 
912 /*
913  * Process completed xmit descriptors from the specified queue.
914  */
915 static int
916 malo_tx_processq(struct malo_softc *sc, struct malo_txq *txq)
917 {
918 	struct malo_txbuf *bf;
919 	struct malo_txdesc *ds;
920 	struct ieee80211_node *ni;
921 	int nreaped;
922 	uint32_t status;
923 
924 	DPRINTF(sc, MALO_DEBUG_TX_PROC, "%s: tx queue %u\n",
925 	    __func__, txq->qnum);
926 	for (nreaped = 0;; nreaped++) {
927 		MALO_TXQ_LOCK(txq);
928 		bf = STAILQ_FIRST(&txq->active);
929 		if (bf == NULL) {
930 			MALO_TXQ_UNLOCK(txq);
931 			break;
932 		}
933 		ds = bf->bf_desc;
934 		MALO_TXDESC_SYNC(txq, ds,
935 		    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
936 		if (ds->status & htole32(MALO_TXD_STATUS_FW_OWNED)) {
937 			MALO_TXQ_UNLOCK(txq);
938 			break;
939 		}
940 		STAILQ_REMOVE_HEAD(&txq->active, bf_list);
941 		MALO_TXQ_UNLOCK(txq);
942 
943 #ifdef MALO_DEBUG
944 		if (sc->malo_debug & MALO_DEBUG_XMIT_DESC)
945 			malo_printtxbuf(bf, txq->qnum, nreaped);
946 #endif
947 		ni = bf->bf_node;
948 		if (ni != NULL) {
949 			status = le32toh(ds->status);
950 			if (status & MALO_TXD_STATUS_OK) {
951 				uint16_t format = le16toh(ds->format);
952 				uint8_t txant =_IEEE80211_MASKSHIFT(
953 				    format, MALO_TXD_ANTENNA);
954 
955 				sc->malo_stats.mst_ant_tx[txant]++;
956 				if (status & MALO_TXD_STATUS_OK_RETRY)
957 					sc->malo_stats.mst_tx_retries++;
958 				if (status & MALO_TXD_STATUS_OK_MORE_RETRY)
959 					sc->malo_stats.mst_tx_mretries++;
960 				malo_updatetxrate(ni, ds->datarate);
961 				sc->malo_stats.mst_tx_rate = ds->datarate;
962 			} else {
963 				if (status & MALO_TXD_STATUS_FAILED_LINK_ERROR)
964 					sc->malo_stats.mst_tx_linkerror++;
965 				if (status & MALO_TXD_STATUS_FAILED_XRETRY)
966 					sc->malo_stats.mst_tx_xretries++;
967 				if (status & MALO_TXD_STATUS_FAILED_AGING)
968 					sc->malo_stats.mst_tx_aging++;
969 			}
970 			/* XXX strip fw len in case header inspected */
971 			m_adj(bf->bf_m, sizeof(uint16_t));
972 			ieee80211_tx_complete(ni, bf->bf_m,
973 			    (status & MALO_TXD_STATUS_OK) == 0);
974 		} else
975 			m_freem(bf->bf_m);
976 
977 		ds->status = htole32(MALO_TXD_STATUS_IDLE);
978 		ds->pktlen = htole32(0);
979 
980 		bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap,
981 		    BUS_DMASYNC_POSTWRITE);
982 		bus_dmamap_unload(sc->malo_dmat, bf->bf_dmamap);
983 		bf->bf_m = NULL;
984 		bf->bf_node = NULL;
985 
986 		MALO_TXQ_LOCK(txq);
987 		STAILQ_INSERT_TAIL(&txq->free, bf, bf_list);
988 		txq->nfree++;
989 		MALO_TXQ_UNLOCK(txq);
990 	}
991 	return nreaped;
992 }
993 
994 /*
995  * Deferred processing of transmit interrupt.
996  */
997 static void
998 malo_tx_proc(void *arg, int npending)
999 {
1000 	struct malo_softc *sc = arg;
1001 	int i, nreaped;
1002 
1003 	/*
1004 	 * Process each active queue.
1005 	 */
1006 	nreaped = 0;
1007 	MALO_LOCK(sc);
1008 	for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
1009 		if (!STAILQ_EMPTY(&sc->malo_txq[i].active))
1010 			nreaped += malo_tx_processq(sc, &sc->malo_txq[i]);
1011 	}
1012 
1013 	if (nreaped != 0) {
1014 		sc->malo_timer = 0;
1015 		malo_start(sc);
1016 	}
1017 	MALO_UNLOCK(sc);
1018 }
1019 
1020 static int
1021 malo_tx_start(struct malo_softc *sc, struct ieee80211_node *ni,
1022     struct malo_txbuf *bf, struct mbuf *m0)
1023 {
1024 	int error, iswep;
1025 	int hdrlen, pktlen;
1026 	struct ieee80211_frame *wh;
1027 	struct ieee80211com *ic = &sc->malo_ic;
1028 	struct ieee80211vap *vap = ni->ni_vap;
1029 	struct malo_txdesc *ds;
1030 	struct malo_txrec *tr;
1031 	struct malo_txq *txq;
1032 	uint16_t qos;
1033 
1034 	wh = mtod(m0, struct ieee80211_frame *);
1035 	iswep = wh->i_fc[1] & IEEE80211_FC1_PROTECTED;
1036 	hdrlen = ieee80211_anyhdrsize(wh);
1037 	pktlen = m0->m_pkthdr.len;
1038 	if (IEEE80211_QOS_HAS_SEQ(wh)) {
1039 		qos = *(uint16_t *)ieee80211_getqos(wh);
1040 	} else
1041 		qos = 0;
1042 
1043 	if (iswep) {
1044 		struct ieee80211_key *k;
1045 
1046 		/*
1047 		 * Construct the 802.11 header+trailer for an encrypted
1048 		 * frame. The only reason this can fail is because of an
1049 		 * unknown or unsupported cipher/key type.
1050 		 *
1051 		 * NB: we do this even though the firmware will ignore
1052 		 *     what we've done for WEP and TKIP as we need the
1053 		 *     ExtIV filled in for CCMP and this also adjusts
1054 		 *     the headers which simplifies our work below.
1055 		 */
1056 		k = ieee80211_crypto_encap(ni, m0);
1057 		if (k == NULL) {
1058 			/*
1059 			 * This can happen when the key is yanked after the
1060 			 * frame was queued.  Just discard the frame; the
1061 			 * 802.11 layer counts failures and provides
1062 			 * debugging/diagnostics.
1063 			 */
1064 			m_freem(m0);
1065 			return EIO;
1066 		}
1067 
1068 		/*
1069 		 * Adjust the packet length for the crypto additions
1070 		 * done during encap and any other bits that the f/w
1071 		 * will add later on.
1072 		 */
1073 		pktlen = m0->m_pkthdr.len;
1074 
1075 		/* packet header may have moved, reset our local pointer */
1076 		wh = mtod(m0, struct ieee80211_frame *);
1077 	}
1078 
1079 	if (ieee80211_radiotap_active_vap(vap)) {
1080 		sc->malo_tx_th.wt_flags = 0;	/* XXX */
1081 		if (iswep)
1082 			sc->malo_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
1083 		sc->malo_tx_th.wt_txpower = ni->ni_txpower;
1084 		sc->malo_tx_th.wt_antenna = sc->malo_txantenna;
1085 
1086 		ieee80211_radiotap_tx(vap, m0);
1087 	}
1088 
1089 	/*
1090 	 * Copy up/down the 802.11 header; the firmware requires
1091 	 * we present a 2-byte payload length followed by a
1092 	 * 4-address header (w/o QoS), followed (optionally) by
1093 	 * any WEP/ExtIV header (but only filled in for CCMP).
1094 	 * We are assured the mbuf has sufficient headroom to
1095 	 * prepend in-place by the setup of ic_headroom in
1096 	 * malo_attach.
1097 	 */
1098 	if (hdrlen < sizeof(struct malo_txrec)) {
1099 		const int space = sizeof(struct malo_txrec) - hdrlen;
1100 		if (M_LEADINGSPACE(m0) < space) {
1101 			/* NB: should never happen */
1102 			device_printf(sc->malo_dev,
1103 			    "not enough headroom, need %d found %zd, "
1104 			    "m_flags 0x%x m_len %d\n",
1105 			    space, M_LEADINGSPACE(m0), m0->m_flags, m0->m_len);
1106 			ieee80211_dump_pkt(ic,
1107 			    mtod(m0, const uint8_t *), m0->m_len, 0, -1);
1108 			m_freem(m0);
1109 			/* XXX stat */
1110 			return EIO;
1111 		}
1112 		M_PREPEND(m0, space, M_NOWAIT);
1113 	}
1114 	tr = mtod(m0, struct malo_txrec *);
1115 	if (wh != (struct ieee80211_frame *) &tr->wh)
1116 		ovbcopy(wh, &tr->wh, hdrlen);
1117 	/*
1118 	 * Note: the "firmware length" is actually the length of the fully
1119 	 * formed "802.11 payload".  That is, it's everything except for
1120 	 * the 802.11 header.  In particular this includes all crypto
1121 	 * material including the MIC!
1122 	 */
1123 	tr->fwlen = htole16(pktlen - hdrlen);
1124 
1125 	/*
1126 	 * Load the DMA map so any coalescing is done.  This
1127 	 * also calculates the number of descriptors we need.
1128 	 */
1129 	error = malo_tx_dmasetup(sc, bf, m0);
1130 	if (error != 0)
1131 		return error;
1132 	bf->bf_node = ni;			/* NB: held reference */
1133 	m0 = bf->bf_m;				/* NB: may have changed */
1134 	tr = mtod(m0, struct malo_txrec *);
1135 	wh = (struct ieee80211_frame *)&tr->wh;
1136 
1137 	/*
1138 	 * Formulate tx descriptor.
1139 	 */
1140 	ds = bf->bf_desc;
1141 	txq = bf->bf_txq;
1142 
1143 	ds->qosctrl = qos;			/* NB: already little-endian */
1144 	ds->pktptr = htole32(bf->bf_segs[0].ds_addr);
1145 	ds->pktlen = htole16(bf->bf_segs[0].ds_len);
1146 	/* NB: pPhysNext setup once, don't touch */
1147 	ds->datarate = IEEE80211_IS_DATA(wh) ? 1 : 0;
1148 	ds->sap_pktinfo = 0;
1149 	ds->format = 0;
1150 
1151 	/*
1152 	 * Select transmit rate.
1153 	 */
1154 	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
1155 	case IEEE80211_FC0_TYPE_MGT:
1156 		sc->malo_stats.mst_tx_mgmt++;
1157 		/* fall thru... */
1158 	case IEEE80211_FC0_TYPE_CTL:
1159 		ds->txpriority = 1;
1160 		break;
1161 	case IEEE80211_FC0_TYPE_DATA:
1162 		ds->txpriority = txq->qnum;
1163 		break;
1164 	default:
1165 		device_printf(sc->malo_dev, "bogus frame type 0x%x (%s)\n",
1166 			wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK, __func__);
1167 		/* XXX statistic */
1168 		m_freem(m0);
1169 		return EIO;
1170 	}
1171 
1172 #ifdef MALO_DEBUG
1173 	if (IFF_DUMPPKTS_XMIT(sc))
1174 		ieee80211_dump_pkt(ic,
1175 		    mtod(m0, const uint8_t *)+sizeof(uint16_t),
1176 		    m0->m_len - sizeof(uint16_t), ds->datarate, -1);
1177 #endif
1178 
1179 	MALO_TXQ_LOCK(txq);
1180 	if (!IEEE80211_IS_DATA(wh))
1181 		ds->status |= htole32(1);
1182 	ds->status |= htole32(MALO_TXD_STATUS_FW_OWNED);
1183 	STAILQ_INSERT_TAIL(&txq->active, bf, bf_list);
1184 	MALO_TXDESC_SYNC(txq, ds, BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
1185 
1186 	sc->malo_timer = 5;
1187 	MALO_TXQ_UNLOCK(txq);
1188 	return 0;
1189 }
1190 
1191 static int
1192 malo_transmit(struct ieee80211com *ic, struct mbuf *m)
1193 {
1194 	struct malo_softc *sc = ic->ic_softc;
1195 	int error;
1196 
1197 	MALO_LOCK(sc);
1198 	if (!sc->malo_running) {
1199 		MALO_UNLOCK(sc);
1200 		return (ENXIO);
1201 	}
1202 	error = mbufq_enqueue(&sc->malo_snd, m);
1203 	if (error) {
1204 		MALO_UNLOCK(sc);
1205 		return (error);
1206 	}
1207 	malo_start(sc);
1208 	MALO_UNLOCK(sc);
1209 	return (0);
1210 }
1211 
1212 static void
1213 malo_start(struct malo_softc *sc)
1214 {
1215 	struct ieee80211_node *ni;
1216 	struct malo_txq *txq = &sc->malo_txq[0];
1217 	struct malo_txbuf *bf = NULL;
1218 	struct mbuf *m;
1219 	int nqueued = 0;
1220 
1221 	MALO_LOCK_ASSERT(sc);
1222 
1223 	if (!sc->malo_running || sc->malo_invalid)
1224 		return;
1225 
1226 	while ((m = mbufq_dequeue(&sc->malo_snd)) != NULL) {
1227 		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
1228 		bf = malo_getbuf(sc, txq);
1229 		if (bf == NULL) {
1230 			mbufq_prepend(&sc->malo_snd, m);
1231 			sc->malo_stats.mst_tx_qstop++;
1232 			break;
1233 		}
1234 		/*
1235 		 * Pass the frame to the h/w for transmission.
1236 		 */
1237 		if (malo_tx_start(sc, ni, bf, m)) {
1238 			if_inc_counter(ni->ni_vap->iv_ifp,
1239 			    IFCOUNTER_OERRORS, 1);
1240 			if (bf != NULL) {
1241 				bf->bf_m = NULL;
1242 				bf->bf_node = NULL;
1243 				MALO_TXQ_LOCK(txq);
1244 				STAILQ_INSERT_HEAD(&txq->free, bf, bf_list);
1245 				MALO_TXQ_UNLOCK(txq);
1246 			}
1247 			ieee80211_free_node(ni);
1248 			continue;
1249 		}
1250 		nqueued++;
1251 
1252 		if (nqueued >= malo_txcoalesce) {
1253 			/*
1254 			 * Poke the firmware to process queued frames;
1255 			 * see below about (lack of) locking.
1256 			 */
1257 			nqueued = 0;
1258 			malo_hal_txstart(sc->malo_mh, 0/*XXX*/);
1259 		}
1260 	}
1261 
1262 	if (nqueued) {
1263 		/*
1264 		 * NB: We don't need to lock against tx done because
1265 		 * this just prods the firmware to check the transmit
1266 		 * descriptors.  The firmware will also start fetching
1267 		 * descriptors by itself if it notices new ones are
1268 		 * present when it goes to deliver a tx done interrupt
1269 		 * to the host. So if we race with tx done processing
1270 		 * it's ok.  Delivering the kick here rather than in
1271 		 * malo_tx_start is an optimization to avoid poking the
1272 		 * firmware for each packet.
1273 		 *
1274 		 * NB: the queue id isn't used so 0 is ok.
1275 		 */
1276 		malo_hal_txstart(sc->malo_mh, 0/*XXX*/);
1277 	}
1278 }
1279 
1280 static void
1281 malo_watchdog(void *arg)
1282 {
1283 	struct malo_softc *sc = arg;
1284 
1285 	callout_reset(&sc->malo_watchdog_timer, hz, malo_watchdog, sc);
1286 	if (sc->malo_timer == 0 || --sc->malo_timer > 0)
1287 		return;
1288 
1289 	if (sc->malo_running && !sc->malo_invalid) {
1290 		device_printf(sc->malo_dev, "watchdog timeout\n");
1291 
1292 		/* XXX no way to reset h/w. now  */
1293 
1294 		counter_u64_add(sc->malo_ic.ic_oerrors, 1);
1295 		sc->malo_stats.mst_watchdog++;
1296 	}
1297 }
1298 
1299 static int
1300 malo_hal_reset(struct malo_softc *sc)
1301 {
1302 	static int first = 0;
1303 	struct ieee80211com *ic = &sc->malo_ic;
1304 	struct malo_hal *mh = sc->malo_mh;
1305 
1306 	if (first == 0) {
1307 		/*
1308 		 * NB: when the device firstly is initialized, sometimes
1309 		 * firmware could override rx/tx dma registers so we re-set
1310 		 * these values once.
1311 		 */
1312 		malo_hal_set_rxtxdma(sc);
1313 		first = 1;
1314 	}
1315 
1316 	malo_hal_setantenna(mh, MHA_ANTENNATYPE_RX, sc->malo_rxantenna);
1317 	malo_hal_setantenna(mh, MHA_ANTENNATYPE_TX, sc->malo_txantenna);
1318 	malo_hal_setradio(mh, 1, MHP_AUTO_PREAMBLE);
1319 	malo_chan_set(sc, ic->ic_curchan);
1320 
1321 	/* XXX needs other stuffs?  */
1322 
1323 	return 1;
1324 }
1325 
1326 static __inline struct mbuf *
1327 malo_getrxmbuf(struct malo_softc *sc, struct malo_rxbuf *bf)
1328 {
1329 	struct mbuf *m;
1330 	bus_addr_t paddr;
1331 	int error;
1332 
1333 	/* XXX don't need mbuf, just dma buffer */
1334 	m = m_getjcl(M_NOWAIT, MT_DATA, M_PKTHDR, MJUMPAGESIZE);
1335 	if (m == NULL) {
1336 		sc->malo_stats.mst_rx_nombuf++;	/* XXX */
1337 		return NULL;
1338 	}
1339 	error = bus_dmamap_load(sc->malo_dmat, bf->bf_dmamap,
1340 	    mtod(m, caddr_t), MJUMPAGESIZE,
1341 	    malo_load_cb, &paddr, BUS_DMA_NOWAIT);
1342 	if (error != 0) {
1343 		device_printf(sc->malo_dev,
1344 		    "%s: bus_dmamap_load failed, error %d\n", __func__, error);
1345 		m_freem(m);
1346 		return NULL;
1347 	}
1348 	bf->bf_data = paddr;
1349 	bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
1350 
1351 	return m;
1352 }
1353 
1354 static int
1355 malo_rxbuf_init(struct malo_softc *sc, struct malo_rxbuf *bf)
1356 {
1357 	struct malo_rxdesc *ds;
1358 
1359 	ds = bf->bf_desc;
1360 	if (bf->bf_m == NULL) {
1361 		bf->bf_m = malo_getrxmbuf(sc, bf);
1362 		if (bf->bf_m == NULL) {
1363 			/* mark descriptor to be skipped */
1364 			ds->rxcontrol = MALO_RXD_CTRL_OS_OWN;
1365 			/* NB: don't need PREREAD */
1366 			MALO_RXDESC_SYNC(sc, ds, BUS_DMASYNC_PREWRITE);
1367 			return ENOMEM;
1368 		}
1369 	}
1370 
1371 	/*
1372 	 * Setup descriptor.
1373 	 */
1374 	ds->qosctrl = 0;
1375 	ds->snr = 0;
1376 	ds->status = MALO_RXD_STATUS_IDLE;
1377 	ds->channel = 0;
1378 	ds->pktlen = htole16(MALO_RXSIZE);
1379 	ds->nf = 0;
1380 	ds->physbuffdata = htole32(bf->bf_data);
1381 	/* NB: don't touch pPhysNext, set once */
1382 	ds->rxcontrol = MALO_RXD_CTRL_DRIVER_OWN;
1383 	MALO_RXDESC_SYNC(sc, ds, BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
1384 
1385 	return 0;
1386 }
1387 
1388 /*
1389  * Setup the rx data structures.  This should only be done once or we may get
1390  * out of sync with the firmware.
1391  */
1392 static int
1393 malo_startrecv(struct malo_softc *sc)
1394 {
1395 	struct malo_rxbuf *bf, *prev;
1396 	struct malo_rxdesc *ds;
1397 
1398 	if (sc->malo_recvsetup == 1) {
1399 		malo_mode_init(sc);		/* set filters, etc. */
1400 		return 0;
1401 	}
1402 
1403 	prev = NULL;
1404 	STAILQ_FOREACH(bf, &sc->malo_rxbuf, bf_list) {
1405 		int error = malo_rxbuf_init(sc, bf);
1406 		if (error != 0) {
1407 			DPRINTF(sc, MALO_DEBUG_RECV,
1408 			    "%s: malo_rxbuf_init failed %d\n",
1409 			    __func__, error);
1410 			return error;
1411 		}
1412 		if (prev != NULL) {
1413 			ds = prev->bf_desc;
1414 			ds->physnext = htole32(bf->bf_daddr);
1415 		}
1416 		prev = bf;
1417 	}
1418 	if (prev != NULL) {
1419 		ds = prev->bf_desc;
1420 		ds->physnext =
1421 		    htole32(STAILQ_FIRST(&sc->malo_rxbuf)->bf_daddr);
1422 	}
1423 
1424 	sc->malo_recvsetup = 1;
1425 
1426 	malo_mode_init(sc);		/* set filters, etc. */
1427 
1428 	return 0;
1429 }
1430 
1431 static void
1432 malo_init_locked(struct malo_softc *sc)
1433 {
1434 	struct malo_hal *mh = sc->malo_mh;
1435 	int error;
1436 
1437 	MALO_LOCK_ASSERT(sc);
1438 
1439 	/*
1440 	 * Stop anything previously setup.  This is safe whether this is
1441 	 * the first time through or not.
1442 	 */
1443 	malo_stop(sc);
1444 
1445 	/*
1446 	 * Push state to the firmware.
1447 	 */
1448 	if (!malo_hal_reset(sc)) {
1449 		device_printf(sc->malo_dev,
1450 		    "%s: unable to reset hardware\n", __func__);
1451 		return;
1452 	}
1453 
1454 	/*
1455 	 * Setup recv (once); transmit is already good to go.
1456 	 */
1457 	error = malo_startrecv(sc);
1458 	if (error != 0) {
1459 		device_printf(sc->malo_dev,
1460 		    "%s: unable to start recv logic, error %d\n",
1461 		    __func__, error);
1462 		return;
1463 	}
1464 
1465 	/*
1466 	 * Enable interrupts.
1467 	 */
1468 	sc->malo_imask = MALO_A2HRIC_BIT_RX_RDY
1469 	    | MALO_A2HRIC_BIT_TX_DONE
1470 	    | MALO_A2HRIC_BIT_OPC_DONE
1471 	    | MALO_A2HRIC_BIT_MAC_EVENT
1472 	    | MALO_A2HRIC_BIT_RX_PROBLEM
1473 	    | MALO_A2HRIC_BIT_ICV_ERROR
1474 	    | MALO_A2HRIC_BIT_RADAR_DETECT
1475 	    | MALO_A2HRIC_BIT_CHAN_SWITCH;
1476 
1477 	sc->malo_running = 1;
1478 	malo_hal_intrset(mh, sc->malo_imask);
1479 	callout_reset(&sc->malo_watchdog_timer, hz, malo_watchdog, sc);
1480 }
1481 
1482 static void
1483 malo_init(void *arg)
1484 {
1485 	struct malo_softc *sc = (struct malo_softc *) arg;
1486 	struct ieee80211com *ic = &sc->malo_ic;
1487 
1488 	MALO_LOCK(sc);
1489 	malo_init_locked(sc);
1490 	MALO_UNLOCK(sc);
1491 
1492 	if (sc->malo_running)
1493 		ieee80211_start_all(ic);	/* start all vap's */
1494 }
1495 
1496 struct malo_copy_maddr_ctx {
1497 	uint8_t macs[IEEE80211_ADDR_LEN * MALO_HAL_MCAST_MAX];
1498 	int nmc;
1499 };
1500 
1501 static u_int
1502 malo_copy_maddr(void *arg, struct sockaddr_dl *sdl, u_int nmc)
1503 {
1504 	struct malo_copy_maddr_ctx *ctx = arg;
1505 
1506 	if (ctx->nmc == MALO_HAL_MCAST_MAX)
1507 		return (0);
1508 
1509 	IEEE80211_ADDR_COPY(ctx->macs + (ctx->nmc * IEEE80211_ADDR_LEN),
1510 	    LLADDR(sdl));
1511 	ctx->nmc++;
1512 
1513 	return (1);
1514 }
1515 
1516 /*
1517  * Set the multicast filter contents into the hardware.
1518  */
1519 static void
1520 malo_setmcastfilter(struct malo_softc *sc)
1521 {
1522 	struct malo_copy_maddr_ctx ctx;
1523 	struct ieee80211com *ic = &sc->malo_ic;
1524 	struct ieee80211vap *vap;
1525 
1526 
1527 	if (ic->ic_opmode == IEEE80211_M_MONITOR || ic->ic_allmulti > 0 ||
1528 	    ic->ic_promisc > 0)
1529 		goto all;
1530 
1531 	ctx.nmc = 0;
1532 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
1533 		if_foreach_llmaddr(vap->iv_ifp, malo_copy_maddr, &ctx);
1534 
1535 	malo_hal_setmcast(sc->malo_mh, ctx.nmc, ctx.macs);
1536 
1537 all:
1538 	/*
1539 	 * XXX we don't know how to set the f/w for supporting
1540 	 * IFF_ALLMULTI | IFF_PROMISC cases
1541 	 */
1542 	return;
1543 }
1544 
1545 static int
1546 malo_mode_init(struct malo_softc *sc)
1547 {
1548 	struct ieee80211com *ic = &sc->malo_ic;
1549 	struct malo_hal *mh = sc->malo_mh;
1550 
1551 	malo_hal_setpromisc(mh, ic->ic_promisc > 0);
1552 	malo_setmcastfilter(sc);
1553 
1554 	return ENXIO;
1555 }
1556 
1557 static void
1558 malo_tx_draintxq(struct malo_softc *sc, struct malo_txq *txq)
1559 {
1560 	struct ieee80211_node *ni;
1561 	struct malo_txbuf *bf;
1562 	u_int ix __unused;
1563 
1564 	/*
1565 	 * NB: this assumes output has been stopped and
1566 	 *     we do not need to block malo_tx_tasklet
1567 	 */
1568 	for (ix = 0;; ix++) {
1569 		MALO_TXQ_LOCK(txq);
1570 		bf = STAILQ_FIRST(&txq->active);
1571 		if (bf == NULL) {
1572 			MALO_TXQ_UNLOCK(txq);
1573 			break;
1574 		}
1575 		STAILQ_REMOVE_HEAD(&txq->active, bf_list);
1576 		MALO_TXQ_UNLOCK(txq);
1577 #ifdef MALO_DEBUG
1578 		if (sc->malo_debug & MALO_DEBUG_RESET) {
1579 			struct ieee80211com *ic = &sc->malo_ic;
1580 			const struct malo_txrec *tr =
1581 			    mtod(bf->bf_m, const struct malo_txrec *);
1582 			malo_printtxbuf(bf, txq->qnum, ix);
1583 			ieee80211_dump_pkt(ic, (const uint8_t *)&tr->wh,
1584 			    bf->bf_m->m_len - sizeof(tr->fwlen), 0, -1);
1585 		}
1586 #endif /* MALO_DEBUG */
1587 		bus_dmamap_unload(sc->malo_dmat, bf->bf_dmamap);
1588 		ni = bf->bf_node;
1589 		bf->bf_node = NULL;
1590 		if (ni != NULL) {
1591 			/*
1592 			 * Reclaim node reference.
1593 			 */
1594 			ieee80211_free_node(ni);
1595 		}
1596 		m_freem(bf->bf_m);
1597 		bf->bf_m = NULL;
1598 
1599 		MALO_TXQ_LOCK(txq);
1600 		STAILQ_INSERT_TAIL(&txq->free, bf, bf_list);
1601 		txq->nfree++;
1602 		MALO_TXQ_UNLOCK(txq);
1603 	}
1604 }
1605 
1606 static void
1607 malo_stop(struct malo_softc *sc)
1608 {
1609 	struct malo_hal *mh = sc->malo_mh;
1610 	int i;
1611 
1612 	DPRINTF(sc, MALO_DEBUG_ANY, "%s: invalid %u running %u\n",
1613 	    __func__, sc->malo_invalid, sc->malo_running);
1614 
1615 	MALO_LOCK_ASSERT(sc);
1616 
1617 	if (!sc->malo_running)
1618 		return;
1619 
1620 	/*
1621 	 * Shutdown the hardware and driver:
1622 	 *    disable interrupts
1623 	 *    turn off the radio
1624 	 *    drain and release tx queues
1625 	 *
1626 	 * Note that some of this work is not possible if the hardware
1627 	 * is gone (invalid).
1628 	 */
1629 	sc->malo_running = 0;
1630 	callout_stop(&sc->malo_watchdog_timer);
1631 	sc->malo_timer = 0;
1632 	/* disable interrupt.  */
1633 	malo_hal_intrset(mh, 0);
1634 	/* turn off the radio.  */
1635 	malo_hal_setradio(mh, 0, MHP_AUTO_PREAMBLE);
1636 
1637 	/* drain and release tx queues.  */
1638 	for (i = 0; i < MALO_NUM_TX_QUEUES; i++)
1639 		malo_tx_draintxq(sc, &sc->malo_txq[i]);
1640 }
1641 
1642 static void
1643 malo_parent(struct ieee80211com *ic)
1644 {
1645 	struct malo_softc *sc = ic->ic_softc;
1646 	int startall = 0;
1647 
1648 	MALO_LOCK(sc);
1649 	if (ic->ic_nrunning > 0) {
1650 		/*
1651 		 * Beware of being called during attach/detach
1652 		 * to reset promiscuous mode.  In that case we
1653 		 * will still be marked UP but not RUNNING.
1654 		 * However trying to re-init the interface
1655 		 * is the wrong thing to do as we've already
1656 		 * torn down much of our state.  There's
1657 		 * probably a better way to deal with this.
1658 		 */
1659 		if (!sc->malo_running && !sc->malo_invalid) {
1660 			malo_init(sc);
1661 			startall = 1;
1662 		}
1663 		/*
1664 		 * To avoid rescanning another access point,
1665 		 * do not call malo_init() here.  Instead,
1666 		 * only reflect promisc mode settings.
1667 		 */
1668 		malo_mode_init(sc);
1669 	} else if (sc->malo_running)
1670 		malo_stop(sc);
1671 	MALO_UNLOCK(sc);
1672 	if (startall)
1673 		ieee80211_start_all(ic);
1674 }
1675 
1676 /*
1677  * Callback from the 802.11 layer to update the slot time
1678  * based on the current setting.  We use it to notify the
1679  * firmware of ERP changes and the f/w takes care of things
1680  * like slot time and preamble.
1681  */
1682 static void
1683 malo_updateslot(struct ieee80211com *ic)
1684 {
1685 	struct malo_softc *sc = ic->ic_softc;
1686 	struct malo_hal *mh = sc->malo_mh;
1687 	int error;
1688 
1689 	/* NB: can be called early; suppress needless cmds */
1690 	if (!sc->malo_running)
1691 		return;
1692 
1693 	DPRINTF(sc, MALO_DEBUG_RESET,
1694 	    "%s: chan %u MHz/flags 0x%x %s slot, (ic_flags 0x%x)\n",
1695 	    __func__, ic->ic_curchan->ic_freq, ic->ic_curchan->ic_flags,
1696 	    ic->ic_flags & IEEE80211_F_SHSLOT ? "short" : "long", ic->ic_flags);
1697 
1698 	if (ic->ic_flags & IEEE80211_F_SHSLOT)
1699 		error = malo_hal_set_slot(mh, 1);
1700 	else
1701 		error = malo_hal_set_slot(mh, 0);
1702 
1703 	if (error != 0)
1704 		device_printf(sc->malo_dev, "setting %s slot failed\n",
1705 			ic->ic_flags & IEEE80211_F_SHSLOT ? "short" : "long");
1706 }
1707 
1708 static int
1709 malo_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1710 {
1711 	struct ieee80211com *ic = vap->iv_ic;
1712 	struct malo_softc *sc = ic->ic_softc;
1713 	struct malo_hal *mh = sc->malo_mh;
1714 	int error;
1715 
1716 	DPRINTF(sc, MALO_DEBUG_STATE, "%s: %s -> %s\n", __func__,
1717 	    ieee80211_state_name[vap->iv_state],
1718 	    ieee80211_state_name[nstate]);
1719 
1720 	/*
1721 	 * Invoke the net80211 layer first so iv_bss is setup.
1722 	 */
1723 	error = MALO_VAP(vap)->malo_newstate(vap, nstate, arg);
1724 	if (error != 0)
1725 		return error;
1726 
1727 	if (nstate == IEEE80211_S_RUN && vap->iv_state != IEEE80211_S_RUN) {
1728 		struct ieee80211_node *ni = vap->iv_bss;
1729 		enum ieee80211_phymode mode = ieee80211_chan2mode(ni->ni_chan);
1730 		const struct ieee80211_txparam *tp = &vap->iv_txparms[mode];
1731 
1732 		DPRINTF(sc, MALO_DEBUG_STATE,
1733 		    "%s: %s(RUN): iv_flags 0x%08x bintvl %d bssid %s "
1734 		    "capinfo 0x%04x chan %d associd 0x%x mode %d rate %d\n",
1735 		    if_name(vap->iv_ifp), __func__, vap->iv_flags,
1736 		    ni->ni_intval, ether_sprintf(ni->ni_bssid), ni->ni_capinfo,
1737 		    ieee80211_chan2ieee(ic, ic->ic_curchan),
1738 		    ni->ni_associd, mode, tp->ucastrate);
1739 
1740 		malo_hal_setradio(mh, 1,
1741 		    (ic->ic_flags & IEEE80211_F_SHPREAMBLE) ?
1742 			MHP_SHORT_PREAMBLE : MHP_LONG_PREAMBLE);
1743 		malo_hal_setassocid(sc->malo_mh, ni->ni_bssid, ni->ni_associd);
1744 		malo_hal_set_rate(mh, mode,
1745 		   tp->ucastrate == IEEE80211_FIXED_RATE_NONE ?
1746 		       0 : malo_fix2rate(tp->ucastrate));
1747 	}
1748 	return 0;
1749 }
1750 
1751 static int
1752 malo_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1753 	const struct ieee80211_bpf_params *params)
1754 {
1755 	struct ieee80211com *ic = ni->ni_ic;
1756 	struct malo_softc *sc = ic->ic_softc;
1757 	struct malo_txbuf *bf;
1758 	struct malo_txq *txq;
1759 
1760 	if (!sc->malo_running || sc->malo_invalid) {
1761 		m_freem(m);
1762 		return ENETDOWN;
1763 	}
1764 
1765 	/*
1766 	 * Grab a TX buffer and associated resources.  Note that we depend
1767 	 * on the classification by the 802.11 layer to get to the right h/w
1768 	 * queue.  Management frames must ALWAYS go on queue 1 but we
1769 	 * cannot just force that here because we may receive non-mgt frames.
1770 	 */
1771 	txq = &sc->malo_txq[0];
1772 	bf = malo_getbuf(sc, txq);
1773 	if (bf == NULL) {
1774 		m_freem(m);
1775 		return ENOBUFS;
1776 	}
1777 
1778 	/*
1779 	 * Pass the frame to the h/w for transmission.
1780 	 */
1781 	if (malo_tx_start(sc, ni, bf, m) != 0) {
1782 		bf->bf_m = NULL;
1783 		bf->bf_node = NULL;
1784 		MALO_TXQ_LOCK(txq);
1785 		STAILQ_INSERT_HEAD(&txq->free, bf, bf_list);
1786 		txq->nfree++;
1787 		MALO_TXQ_UNLOCK(txq);
1788 
1789 		return EIO;		/* XXX */
1790 	}
1791 
1792 	/*
1793 	 * NB: We don't need to lock against tx done because this just
1794 	 * prods the firmware to check the transmit descriptors.  The firmware
1795 	 * will also start fetching descriptors by itself if it notices
1796 	 * new ones are present when it goes to deliver a tx done interrupt
1797 	 * to the host. So if we race with tx done processing it's ok.
1798 	 * Delivering the kick here rather than in malo_tx_start is
1799 	 * an optimization to avoid poking the firmware for each packet.
1800 	 *
1801 	 * NB: the queue id isn't used so 0 is ok.
1802 	 */
1803 	malo_hal_txstart(sc->malo_mh, 0/*XXX*/);
1804 
1805 	return 0;
1806 }
1807 
1808 static void
1809 malo_sysctlattach(struct malo_softc *sc)
1810 {
1811 #ifdef	MALO_DEBUG
1812 	struct sysctl_ctx_list *ctx = device_get_sysctl_ctx(sc->malo_dev);
1813 	struct sysctl_oid *tree = device_get_sysctl_tree(sc->malo_dev);
1814 
1815 	sc->malo_debug = malo_debug;
1816 	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
1817 		"debug", CTLFLAG_RW, &sc->malo_debug, 0,
1818 		"control debugging printfs");
1819 #endif
1820 }
1821 
1822 static void
1823 malo_announce(struct malo_softc *sc)
1824 {
1825 
1826 	device_printf(sc->malo_dev,
1827 		"versions [hw %d fw %d.%d.%d.%d] (regioncode %d)\n",
1828 		sc->malo_hwspecs.hwversion,
1829 		(sc->malo_hwspecs.fw_releasenum >> 24) & 0xff,
1830 		(sc->malo_hwspecs.fw_releasenum >> 16) & 0xff,
1831 		(sc->malo_hwspecs.fw_releasenum >> 8) & 0xff,
1832 		(sc->malo_hwspecs.fw_releasenum >> 0) & 0xff,
1833 		sc->malo_hwspecs.regioncode);
1834 
1835 	if (bootverbose || malo_rxbuf != MALO_RXBUF)
1836 		device_printf(sc->malo_dev,
1837 		    "using %u rx buffers\n", malo_rxbuf);
1838 	if (bootverbose || malo_txbuf != MALO_TXBUF)
1839 		device_printf(sc->malo_dev,
1840 		    "using %u tx buffers\n", malo_txbuf);
1841 }
1842 
1843 /*
1844  * Convert net80211 channel to a HAL channel.
1845  */
1846 static void
1847 malo_mapchan(struct malo_hal_channel *hc, const struct ieee80211_channel *chan)
1848 {
1849 	hc->channel = chan->ic_ieee;
1850 
1851 	*(uint32_t *)&hc->flags = 0;
1852 	if (IEEE80211_IS_CHAN_2GHZ(chan))
1853 		hc->flags.freqband = MALO_FREQ_BAND_2DOT4GHZ;
1854 }
1855 
1856 /*
1857  * Set/change channels.  If the channel is really being changed,
1858  * it's done by reseting the chip.  To accomplish this we must
1859  * first cleanup any pending DMA, then restart stuff after a la
1860  * malo_init.
1861  */
1862 static int
1863 malo_chan_set(struct malo_softc *sc, struct ieee80211_channel *chan)
1864 {
1865 	struct malo_hal *mh = sc->malo_mh;
1866 	struct malo_hal_channel hchan;
1867 
1868 	DPRINTF(sc, MALO_DEBUG_RESET, "%s: chan %u MHz/flags 0x%x\n",
1869 	    __func__, chan->ic_freq, chan->ic_flags);
1870 
1871 	/*
1872 	 * Convert to a HAL channel description with the flags constrained
1873 	 * to reflect the current operating mode.
1874 	 */
1875 	malo_mapchan(&hchan, chan);
1876 	malo_hal_intrset(mh, 0);		/* disable interrupts */
1877 	malo_hal_setchannel(mh, &hchan);
1878 	malo_hal_settxpower(mh, &hchan);
1879 
1880 	/*
1881 	 * Update internal state.
1882 	 */
1883 	sc->malo_tx_th.wt_chan_freq = htole16(chan->ic_freq);
1884 	sc->malo_rx_th.wr_chan_freq = htole16(chan->ic_freq);
1885 	if (IEEE80211_IS_CHAN_ANYG(chan)) {
1886 		sc->malo_tx_th.wt_chan_flags = htole16(IEEE80211_CHAN_G);
1887 		sc->malo_rx_th.wr_chan_flags = htole16(IEEE80211_CHAN_G);
1888 	} else {
1889 		sc->malo_tx_th.wt_chan_flags = htole16(IEEE80211_CHAN_B);
1890 		sc->malo_rx_th.wr_chan_flags = htole16(IEEE80211_CHAN_B);
1891 	}
1892 	sc->malo_curchan = hchan;
1893 	malo_hal_intrset(mh, sc->malo_imask);
1894 
1895 	return 0;
1896 }
1897 
1898 static void
1899 malo_scan_start(struct ieee80211com *ic)
1900 {
1901 	struct malo_softc *sc = ic->ic_softc;
1902 
1903 	DPRINTF(sc, MALO_DEBUG_STATE, "%s\n", __func__);
1904 }
1905 
1906 static void
1907 malo_scan_end(struct ieee80211com *ic)
1908 {
1909 	struct malo_softc *sc = ic->ic_softc;
1910 
1911 	DPRINTF(sc, MALO_DEBUG_STATE, "%s\n", __func__);
1912 }
1913 
1914 static void
1915 malo_set_channel(struct ieee80211com *ic)
1916 {
1917 	struct malo_softc *sc = ic->ic_softc;
1918 
1919 	(void) malo_chan_set(sc, ic->ic_curchan);
1920 }
1921 
1922 static void
1923 malo_rx_proc(void *arg, int npending)
1924 {
1925 	struct malo_softc *sc = arg;
1926 	struct ieee80211com *ic = &sc->malo_ic;
1927 	struct malo_rxbuf *bf;
1928 	struct malo_rxdesc *ds;
1929 	struct mbuf *m, *mnew;
1930 	struct ieee80211_qosframe *wh;
1931 	struct ieee80211_node *ni;
1932 	int off, len, hdrlen, pktlen, rssi, ntodo;
1933 	uint8_t *data, status;
1934 	uint32_t readptr, writeptr;
1935 
1936 	DPRINTF(sc, MALO_DEBUG_RX_PROC,
1937 	    "%s: pending %u rdptr(0x%x) 0x%x wrptr(0x%x) 0x%x\n",
1938 	    __func__, npending,
1939 	    sc->malo_hwspecs.rxdesc_read,
1940 	    malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_read),
1941 	    sc->malo_hwspecs.rxdesc_write,
1942 	    malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_write));
1943 
1944 	readptr = malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_read);
1945 	writeptr = malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_write);
1946 	if (readptr == writeptr)
1947 		return;
1948 
1949 	bf = sc->malo_rxnext;
1950 	for (ntodo = malo_rxquota; ntodo > 0 && readptr != writeptr; ntodo--) {
1951 		if (bf == NULL) {
1952 			bf = STAILQ_FIRST(&sc->malo_rxbuf);
1953 			break;
1954 		}
1955 		ds = bf->bf_desc;
1956 		if (bf->bf_m == NULL) {
1957 			/*
1958 			 * If data allocation failed previously there
1959 			 * will be no buffer; try again to re-populate it.
1960 			 * Note the firmware will not advance to the next
1961 			 * descriptor with a dma buffer so we must mimic
1962 			 * this or we'll get out of sync.
1963 			 */
1964 			DPRINTF(sc, MALO_DEBUG_ANY,
1965 			    "%s: rx buf w/o dma memory\n", __func__);
1966 			(void)malo_rxbuf_init(sc, bf);
1967 			break;
1968 		}
1969 		MALO_RXDESC_SYNC(sc, ds,
1970 		    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
1971 		if (ds->rxcontrol != MALO_RXD_CTRL_DMA_OWN)
1972 			break;
1973 
1974 		readptr = le32toh(ds->physnext);
1975 
1976 #ifdef MALO_DEBUG
1977 		if (sc->malo_debug & MALO_DEBUG_RECV_DESC)
1978 			malo_printrxbuf(bf, 0);
1979 #endif
1980 		status = ds->status;
1981 		if (status & MALO_RXD_STATUS_DECRYPT_ERR_MASK) {
1982 			counter_u64_add(ic->ic_ierrors, 1);
1983 			goto rx_next;
1984 		}
1985 		/*
1986 		 * Sync the data buffer.
1987 		 */
1988 		len = le16toh(ds->pktlen);
1989 		bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap,
1990 		    BUS_DMASYNC_POSTREAD);
1991 		/*
1992 		 * The 802.11 header is provided all or in part at the front;
1993 		 * use it to calculate the true size of the header that we'll
1994 		 * construct below.  We use this to figure out where to copy
1995 		 * payload prior to constructing the header.
1996 		 */
1997 		m = bf->bf_m;
1998 		data = mtod(m, uint8_t *);
1999 		hdrlen = ieee80211_anyhdrsize(data + sizeof(uint16_t));
2000 		off = sizeof(uint16_t) + sizeof(struct ieee80211_frame_addr4);
2001 
2002 		/*
2003 		 * Calculate RSSI. XXX wrong
2004 		 */
2005 		rssi = 2 * ((int) ds->snr - ds->nf);	/* NB: .5 dBm  */
2006 		if (rssi > 100)
2007 			rssi = 100;
2008 
2009 		pktlen = hdrlen + (len - off);
2010 		/*
2011 		 * NB: we know our frame is at least as large as
2012 		 * IEEE80211_MIN_LEN because there is a 4-address frame at
2013 		 * the front.  Hence there's no need to vet the packet length.
2014 		 * If the frame in fact is too small it should be discarded
2015 		 * at the net80211 layer.
2016 		 */
2017 
2018 		/* XXX don't need mbuf, just dma buffer */
2019 		mnew = malo_getrxmbuf(sc, bf);
2020 		if (mnew == NULL) {
2021 			counter_u64_add(ic->ic_ierrors, 1);
2022 			goto rx_next;
2023 		}
2024 		/*
2025 		 * Attach the dma buffer to the mbuf; malo_rxbuf_init will
2026 		 * re-setup the rx descriptor using the replacement dma
2027 		 * buffer we just installed above.
2028 		 */
2029 		bf->bf_m = mnew;
2030 		m->m_data += off - hdrlen;
2031 		m->m_pkthdr.len = m->m_len = pktlen;
2032 
2033 		/*
2034 		 * Piece 802.11 header together.
2035 		 */
2036 		wh = mtod(m, struct ieee80211_qosframe *);
2037 		/* NB: don't need to do this sometimes but ... */
2038 		/* XXX special case so we can memcpy after m_devget? */
2039 		ovbcopy(data + sizeof(uint16_t), wh, hdrlen);
2040 		if (IEEE80211_QOS_HAS_SEQ(wh))
2041 			*(uint16_t *)ieee80211_getqos(wh) = ds->qosctrl;
2042 		if (ieee80211_radiotap_active(ic)) {
2043 			sc->malo_rx_th.wr_flags = 0;
2044 			sc->malo_rx_th.wr_rate = ds->rate;
2045 			sc->malo_rx_th.wr_antsignal = rssi;
2046 			sc->malo_rx_th.wr_antnoise = ds->nf;
2047 		}
2048 #ifdef MALO_DEBUG
2049 		if (IFF_DUMPPKTS_RECV(sc, wh)) {
2050 			ieee80211_dump_pkt(ic, mtod(m, caddr_t),
2051 			    len, ds->rate, rssi);
2052 		}
2053 #endif
2054 		/* dispatch */
2055 		ni = ieee80211_find_rxnode(ic,
2056 		    (struct ieee80211_frame_min *)wh);
2057 		if (ni != NULL) {
2058 			(void) ieee80211_input(ni, m, rssi, ds->nf);
2059 			ieee80211_free_node(ni);
2060 		} else
2061 			(void) ieee80211_input_all(ic, m, rssi, ds->nf);
2062 rx_next:
2063 		/* NB: ignore ENOMEM so we process more descriptors */
2064 		(void) malo_rxbuf_init(sc, bf);
2065 		bf = STAILQ_NEXT(bf, bf_list);
2066 	}
2067 
2068 	malo_bar0_write4(sc, sc->malo_hwspecs.rxdesc_read, readptr);
2069 	sc->malo_rxnext = bf;
2070 
2071 	if (mbufq_first(&sc->malo_snd) != NULL)
2072 		malo_start(sc);
2073 }
2074 
2075 /*
2076  * Reclaim all tx queue resources.
2077  */
2078 static void
2079 malo_tx_cleanup(struct malo_softc *sc)
2080 {
2081 	int i;
2082 
2083 	for (i = 0; i < MALO_NUM_TX_QUEUES; i++)
2084 		malo_tx_cleanupq(sc, &sc->malo_txq[i]);
2085 }
2086 
2087 int
2088 malo_detach(struct malo_softc *sc)
2089 {
2090 	struct ieee80211com *ic = &sc->malo_ic;
2091 
2092 	malo_stop(sc);
2093 
2094 	if (sc->malo_tq != NULL) {
2095 		taskqueue_drain(sc->malo_tq, &sc->malo_rxtask);
2096 		taskqueue_drain(sc->malo_tq, &sc->malo_txtask);
2097 		taskqueue_free(sc->malo_tq);
2098 		sc->malo_tq = NULL;
2099 	}
2100 
2101 	/*
2102 	 * NB: the order of these is important:
2103 	 * o call the 802.11 layer before detaching the hal to
2104 	 *   insure callbacks into the driver to delete global
2105 	 *   key cache entries can be handled
2106 	 * o reclaim the tx queue data structures after calling
2107 	 *   the 802.11 layer as we'll get called back to reclaim
2108 	 *   node state and potentially want to use them
2109 	 * o to cleanup the tx queues the hal is called, so detach
2110 	 *   it last
2111 	 * Other than that, it's straightforward...
2112 	 */
2113 	ieee80211_ifdetach(ic);
2114 	callout_drain(&sc->malo_watchdog_timer);
2115 	malo_dma_cleanup(sc);
2116 	malo_tx_cleanup(sc);
2117 	malo_hal_detach(sc->malo_mh);
2118 	mbufq_drain(&sc->malo_snd);
2119 	MALO_LOCK_DESTROY(sc);
2120 
2121 	return 0;
2122 }
2123 
2124 void
2125 malo_shutdown(struct malo_softc *sc)
2126 {
2127 
2128 	malo_stop(sc);
2129 }
2130 
2131 void
2132 malo_suspend(struct malo_softc *sc)
2133 {
2134 
2135 	malo_stop(sc);
2136 }
2137 
2138 void
2139 malo_resume(struct malo_softc *sc)
2140 {
2141 
2142 	if (sc->malo_ic.ic_nrunning > 0)
2143 		malo_init(sc);
2144 }
2145