The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/dev/malo/if_malo.c

Version: -  FREEBSD  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-2  -  FREEBSD-11-1  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-4  -  FREEBSD-10-3  -  FREEBSD-10-2  -  FREEBSD-10-1  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-3  -  FREEBSD-9-2  -  FREEBSD-9-1  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-4  -  FREEBSD-8-3  -  FREEBSD-8-2  -  FREEBSD-8-1  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-4  -  FREEBSD-7-3  -  FREEBSD-7-2  -  FREEBSD-7-1  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-4  -  FREEBSD-6-3  -  FREEBSD-6-2  -  FREEBSD-6-1  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-5  -  FREEBSD-5-4  -  FREEBSD-5-3  -  FREEBSD-5-2  -  FREEBSD-5-1  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  linux-2.6  -  linux-2.4.22  -  MK83  -  MK84  -  PLAN9  -  DFBSD  -  NETBSD  -  NETBSD5  -  NETBSD4  -  NETBSD3  -  NETBSD20  -  OPENBSD  -  xnu-517  -  xnu-792  -  xnu-792.6.70  -  xnu-1228  -  xnu-1456.1.26  -  xnu-1699.24.8  -  xnu-2050.18.24  -  OPENSOLARIS  -  minix-3-1-1 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
    3  *
    4  * Copyright (c) 2008 Weongyo Jeong <weongyo@freebsd.org>
    5  * Copyright (c) 2007 Marvell Semiconductor, Inc.
    6  * Copyright (c) 2007 Sam Leffler, Errno Consulting
    7  * All rights reserved.
    8  *
    9  * Redistribution and use in source and binary forms, with or without
   10  * modification, are permitted provided that the following conditions
   11  * are met:
   12  * 1. Redistributions of source code must retain the above copyright
   13  *    notice, this list of conditions and the following disclaimer,
   14  *    without modification.
   15  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
   16  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
   17  *    redistribution must be conditioned upon including a substantially
   18  *    similar Disclaimer requirement for further binary redistribution.
   19  *
   20  * NO WARRANTY
   21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
   22  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
   23  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
   24  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
   25  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
   26  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
   27  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
   28  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
   29  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
   30  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
   31  * THE POSSIBILITY OF SUCH DAMAGES.
   32  */
   33 
   34 #include <sys/cdefs.h>
   35 #ifdef __FreeBSD__
   36 __FBSDID("$FreeBSD: stable/12/sys/dev/malo/if_malo.c 344969 2019-03-09 12:54:10Z avos $");
   37 #endif
   38 
   39 #include "opt_malo.h"
   40 
   41 #include <sys/param.h>
   42 #include <sys/endian.h>
   43 #include <sys/kernel.h>
   44 #include <sys/malloc.h>
   45 #include <sys/socket.h>
   46 #include <sys/sockio.h>
   47 #include <sys/sysctl.h>
   48 #include <sys/taskqueue.h>
   49 
   50 #include <machine/bus.h>
   51 #include <sys/bus.h>
   52 
   53 #include <net/if.h>
   54 #include <net/if_var.h>
   55 #include <net/if_dl.h>
   56 #include <net/if_media.h>
   57 #include <net/if_types.h>
   58 #include <net/ethernet.h>
   59 
   60 #include <net80211/ieee80211_var.h>
   61 #include <net80211/ieee80211_regdomain.h>
   62 
   63 #include <net/bpf.h>
   64 
   65 #include <dev/malo/if_malo.h>
   66 
   67 SYSCTL_NODE(_hw, OID_AUTO, malo, CTLFLAG_RD, 0,
   68     "Marvell 88w8335 driver parameters");
   69 
   70 static  int malo_txcoalesce = 8;        /* # tx pkts to q before poking f/w*/
   71 SYSCTL_INT(_hw_malo, OID_AUTO, txcoalesce, CTLFLAG_RWTUN, &malo_txcoalesce,
   72             0, "tx buffers to send at once");
   73 static  int malo_rxbuf = MALO_RXBUF;            /* # rx buffers to allocate */
   74 SYSCTL_INT(_hw_malo, OID_AUTO, rxbuf, CTLFLAG_RWTUN, &malo_rxbuf,
   75             0, "rx buffers allocated");
   76 static  int malo_rxquota = MALO_RXBUF;          /* # max buffers to process */
   77 SYSCTL_INT(_hw_malo, OID_AUTO, rxquota, CTLFLAG_RWTUN, &malo_rxquota,
   78             0, "max rx buffers to process per interrupt");
   79 static  int malo_txbuf = MALO_TXBUF;            /* # tx buffers to allocate */
   80 SYSCTL_INT(_hw_malo, OID_AUTO, txbuf, CTLFLAG_RWTUN, &malo_txbuf,
   81             0, "tx buffers allocated");
   82 
   83 #ifdef MALO_DEBUG
   84 static  int malo_debug = 0;
   85 SYSCTL_INT(_hw_malo, OID_AUTO, debug, CTLFLAG_RWTUN, &malo_debug,
   86             0, "control debugging printfs");
   87 enum {
   88         MALO_DEBUG_XMIT         = 0x00000001,   /* basic xmit operation */
   89         MALO_DEBUG_XMIT_DESC    = 0x00000002,   /* xmit descriptors */
   90         MALO_DEBUG_RECV         = 0x00000004,   /* basic recv operation */
   91         MALO_DEBUG_RECV_DESC    = 0x00000008,   /* recv descriptors */
   92         MALO_DEBUG_RESET        = 0x00000010,   /* reset processing */
   93         MALO_DEBUG_INTR         = 0x00000040,   /* ISR */
   94         MALO_DEBUG_TX_PROC      = 0x00000080,   /* tx ISR proc */
   95         MALO_DEBUG_RX_PROC      = 0x00000100,   /* rx ISR proc */
   96         MALO_DEBUG_STATE        = 0x00000400,   /* 802.11 state transitions */
   97         MALO_DEBUG_NODE         = 0x00000800,   /* node management */
   98         MALO_DEBUG_RECV_ALL     = 0x00001000,   /* trace all frames (beacons) */
   99         MALO_DEBUG_FW           = 0x00008000,   /* firmware */
  100         MALO_DEBUG_ANY          = 0xffffffff
  101 };
  102 #define IS_BEACON(wh)                                                   \
  103         ((wh->i_fc[0] & (IEEE80211_FC0_TYPE_MASK |                      \
  104                 IEEE80211_FC0_SUBTYPE_MASK)) ==                         \
  105          (IEEE80211_FC0_TYPE_MGT|IEEE80211_FC0_SUBTYPE_BEACON))
  106 #define IFF_DUMPPKTS_RECV(sc, wh)                                       \
  107         (((sc->malo_debug & MALO_DEBUG_RECV) &&                         \
  108           ((sc->malo_debug & MALO_DEBUG_RECV_ALL) || !IS_BEACON(wh))))
  109 #define IFF_DUMPPKTS_XMIT(sc)                                           \
  110         (sc->malo_debug & MALO_DEBUG_XMIT)
  111 #define DPRINTF(sc, m, fmt, ...) do {                           \
  112         if (sc->malo_debug & (m))                               \
  113                 printf(fmt, __VA_ARGS__);                       \
  114 } while (0)
  115 #else
  116 #define DPRINTF(sc, m, fmt, ...) do {                           \
  117         (void) sc;                                              \
  118 } while (0)
  119 #endif
  120 
  121 static MALLOC_DEFINE(M_MALODEV, "malodev", "malo driver dma buffers");
  122 
  123 static struct ieee80211vap *malo_vap_create(struct ieee80211com *,
  124                     const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
  125                     const uint8_t [IEEE80211_ADDR_LEN],
  126                     const uint8_t [IEEE80211_ADDR_LEN]);
  127 static  void    malo_vap_delete(struct ieee80211vap *);
  128 static  int     malo_dma_setup(struct malo_softc *);
  129 static  int     malo_setup_hwdma(struct malo_softc *);
  130 static  void    malo_txq_init(struct malo_softc *, struct malo_txq *, int);
  131 static  void    malo_tx_cleanupq(struct malo_softc *, struct malo_txq *);
  132 static  void    malo_parent(struct ieee80211com *);
  133 static  int     malo_transmit(struct ieee80211com *, struct mbuf *);
  134 static  void    malo_start(struct malo_softc *);
  135 static  void    malo_watchdog(void *);
  136 static  void    malo_updateslot(struct ieee80211com *);
  137 static  int     malo_newstate(struct ieee80211vap *, enum ieee80211_state, int);
  138 static  void    malo_scan_start(struct ieee80211com *);
  139 static  void    malo_scan_end(struct ieee80211com *);
  140 static  void    malo_set_channel(struct ieee80211com *);
  141 static  int     malo_raw_xmit(struct ieee80211_node *, struct mbuf *,
  142                     const struct ieee80211_bpf_params *);
  143 static  void    malo_sysctlattach(struct malo_softc *);
  144 static  void    malo_announce(struct malo_softc *);
  145 static  void    malo_dma_cleanup(struct malo_softc *);
  146 static  void    malo_stop(struct malo_softc *);
  147 static  int     malo_chan_set(struct malo_softc *, struct ieee80211_channel *);
  148 static  int     malo_mode_init(struct malo_softc *);
  149 static  void    malo_tx_proc(void *, int);
  150 static  void    malo_rx_proc(void *, int);
  151 static  void    malo_init(void *);
  152 
  153 /*
  154  * Read/Write shorthands for accesses to BAR 0.  Note that all BAR 1
  155  * operations are done in the "hal" except getting H/W MAC address at
  156  * malo_attach and there should be no reference to them here.
  157  */
  158 static uint32_t
  159 malo_bar0_read4(struct malo_softc *sc, bus_size_t off)
  160 {
  161         return bus_space_read_4(sc->malo_io0t, sc->malo_io0h, off);
  162 }
  163 
  164 static void
  165 malo_bar0_write4(struct malo_softc *sc, bus_size_t off, uint32_t val)
  166 {
  167         DPRINTF(sc, MALO_DEBUG_FW, "%s: off 0x%jx val 0x%x\n",
  168             __func__, (uintmax_t)off, val);
  169 
  170         bus_space_write_4(sc->malo_io0t, sc->malo_io0h, off, val);
  171 }
  172 
  173 int
  174 malo_attach(uint16_t devid, struct malo_softc *sc)
  175 {
  176         struct ieee80211com *ic = &sc->malo_ic;
  177         struct malo_hal *mh;
  178         int error;
  179         uint8_t bands[IEEE80211_MODE_BYTES];
  180 
  181         MALO_LOCK_INIT(sc);
  182         callout_init_mtx(&sc->malo_watchdog_timer, &sc->malo_mtx, 0);
  183         mbufq_init(&sc->malo_snd, ifqmaxlen);
  184 
  185         mh = malo_hal_attach(sc->malo_dev, devid,
  186             sc->malo_io1h, sc->malo_io1t, sc->malo_dmat);
  187         if (mh == NULL) {
  188                 device_printf(sc->malo_dev, "unable to attach HAL\n");
  189                 error = EIO;
  190                 goto bad;
  191         }
  192         sc->malo_mh = mh;
  193 
  194         /*
  195          * Load firmware so we can get setup.  We arbitrarily pick station
  196          * firmware; we'll re-load firmware as needed so setting up
  197          * the wrong mode isn't a big deal.
  198          */
  199         error = malo_hal_fwload(mh, "malo8335-h", "malo8335-m");
  200         if (error != 0) {
  201                 device_printf(sc->malo_dev, "unable to setup firmware\n");
  202                 goto bad1;
  203         }
  204         /* XXX gethwspecs() extracts correct informations?  not maybe!  */
  205         error = malo_hal_gethwspecs(mh, &sc->malo_hwspecs);
  206         if (error != 0) {
  207                 device_printf(sc->malo_dev, "unable to fetch h/w specs\n");
  208                 goto bad1;
  209         }
  210 
  211         DPRINTF(sc, MALO_DEBUG_FW,
  212             "malo_hal_gethwspecs: hwversion 0x%x hostif 0x%x"
  213             "maxnum_wcb 0x%x maxnum_mcaddr 0x%x maxnum_tx_wcb 0x%x"
  214             "regioncode 0x%x num_antenna 0x%x fw_releasenum 0x%x"
  215             "wcbbase0 0x%x rxdesc_read 0x%x rxdesc_write 0x%x"
  216             "ul_fw_awakecookie 0x%x w[4] = %x %x %x %x",
  217             sc->malo_hwspecs.hwversion,
  218             sc->malo_hwspecs.hostinterface, sc->malo_hwspecs.maxnum_wcb,
  219             sc->malo_hwspecs.maxnum_mcaddr, sc->malo_hwspecs.maxnum_tx_wcb,
  220             sc->malo_hwspecs.regioncode, sc->malo_hwspecs.num_antenna,
  221             sc->malo_hwspecs.fw_releasenum, sc->malo_hwspecs.wcbbase0,
  222             sc->malo_hwspecs.rxdesc_read, sc->malo_hwspecs.rxdesc_write,
  223             sc->malo_hwspecs.ul_fw_awakecookie,
  224             sc->malo_hwspecs.wcbbase[0], sc->malo_hwspecs.wcbbase[1],
  225             sc->malo_hwspecs.wcbbase[2], sc->malo_hwspecs.wcbbase[3]);
  226 
  227         /* NB: firmware looks that it does not export regdomain info API.  */
  228         memset(bands, 0, sizeof(bands));
  229         setbit(bands, IEEE80211_MODE_11B);
  230         setbit(bands, IEEE80211_MODE_11G);
  231         ieee80211_init_channels(ic, NULL, bands);
  232 
  233         sc->malo_txantenna = 0x2;       /* h/w default */
  234         sc->malo_rxantenna = 0xffff;    /* h/w default */
  235 
  236         /*
  237          * Allocate tx + rx descriptors and populate the lists.
  238          * We immediately push the information to the firmware
  239          * as otherwise it gets upset.
  240          */
  241         error = malo_dma_setup(sc);
  242         if (error != 0) {
  243                 device_printf(sc->malo_dev,
  244                     "failed to setup descriptors: %d\n", error);
  245                 goto bad1;
  246         }
  247         error = malo_setup_hwdma(sc);   /* push to firmware */
  248         if (error != 0)                 /* NB: malo_setupdma prints msg */
  249                 goto bad2;
  250 
  251         sc->malo_tq = taskqueue_create_fast("malo_taskq", M_NOWAIT,
  252                 taskqueue_thread_enqueue, &sc->malo_tq);
  253         taskqueue_start_threads(&sc->malo_tq, 1, PI_NET,
  254                 "%s taskq", device_get_nameunit(sc->malo_dev));
  255 
  256         TASK_INIT(&sc->malo_rxtask, 0, malo_rx_proc, sc);
  257         TASK_INIT(&sc->malo_txtask, 0, malo_tx_proc, sc);
  258 
  259         ic->ic_softc = sc;
  260         ic->ic_name = device_get_nameunit(sc->malo_dev);
  261         /* XXX not right but it's not used anywhere important */
  262         ic->ic_phytype = IEEE80211_T_OFDM;
  263         ic->ic_opmode = IEEE80211_M_STA;
  264         ic->ic_caps =
  265               IEEE80211_C_STA                   /* station mode supported */
  266             | IEEE80211_C_BGSCAN                /* capable of bg scanning */
  267             | IEEE80211_C_MONITOR               /* monitor mode */
  268             | IEEE80211_C_SHPREAMBLE            /* short preamble supported */
  269             | IEEE80211_C_SHSLOT                /* short slot time supported */
  270             | IEEE80211_C_TXPMGT                /* capable of txpow mgt */
  271             | IEEE80211_C_WPA                   /* capable of WPA1+WPA2 */
  272             ;
  273         IEEE80211_ADDR_COPY(ic->ic_macaddr, sc->malo_hwspecs.macaddr);
  274 
  275         /*
  276          * Transmit requires space in the packet for a special format transmit
  277          * record and optional padding between this record and the payload.
  278          * Ask the net80211 layer to arrange this when encapsulating
  279          * packets so we can add it efficiently. 
  280          */
  281         ic->ic_headroom = sizeof(struct malo_txrec) -
  282                 sizeof(struct ieee80211_frame);
  283 
  284         /* call MI attach routine. */
  285         ieee80211_ifattach(ic);
  286         /* override default methods */
  287         ic->ic_vap_create = malo_vap_create;
  288         ic->ic_vap_delete = malo_vap_delete;
  289         ic->ic_raw_xmit = malo_raw_xmit;
  290         ic->ic_updateslot = malo_updateslot;
  291         ic->ic_scan_start = malo_scan_start;
  292         ic->ic_scan_end = malo_scan_end;
  293         ic->ic_set_channel = malo_set_channel;
  294         ic->ic_parent = malo_parent;
  295         ic->ic_transmit = malo_transmit;
  296 
  297         sc->malo_invalid = 0;           /* ready to go, enable int handling */
  298 
  299         ieee80211_radiotap_attach(ic,
  300             &sc->malo_tx_th.wt_ihdr, sizeof(sc->malo_tx_th),
  301                 MALO_TX_RADIOTAP_PRESENT,
  302             &sc->malo_rx_th.wr_ihdr, sizeof(sc->malo_rx_th),
  303                 MALO_RX_RADIOTAP_PRESENT);
  304 
  305         /*
  306          * Setup dynamic sysctl's.
  307          */
  308         malo_sysctlattach(sc);
  309 
  310         if (bootverbose)
  311                 ieee80211_announce(ic);
  312         malo_announce(sc);
  313 
  314         return 0;
  315 bad2:
  316         malo_dma_cleanup(sc);
  317 bad1:
  318         malo_hal_detach(mh);
  319 bad:
  320         sc->malo_invalid = 1;
  321 
  322         return error;
  323 }
  324 
  325 static struct ieee80211vap *
  326 malo_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
  327     enum ieee80211_opmode opmode, int flags,
  328     const uint8_t bssid[IEEE80211_ADDR_LEN],
  329     const uint8_t mac[IEEE80211_ADDR_LEN])
  330 {
  331         struct malo_softc *sc = ic->ic_softc;
  332         struct malo_vap *mvp;
  333         struct ieee80211vap *vap;
  334 
  335         if (!TAILQ_EMPTY(&ic->ic_vaps)) {
  336                 device_printf(sc->malo_dev, "multiple vaps not supported\n");
  337                 return NULL;
  338         }
  339         switch (opmode) {
  340         case IEEE80211_M_STA:
  341                 if (opmode == IEEE80211_M_STA)
  342                         flags |= IEEE80211_CLONE_NOBEACONS;
  343                 /* fall thru... */
  344         case IEEE80211_M_MONITOR:
  345                 break;
  346         default:
  347                 device_printf(sc->malo_dev, "%s mode not supported\n",
  348                     ieee80211_opmode_name[opmode]);
  349                 return NULL;            /* unsupported */
  350         }
  351         mvp = malloc(sizeof(struct malo_vap), M_80211_VAP, M_WAITOK | M_ZERO);
  352         vap = &mvp->malo_vap;
  353         ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
  354 
  355         /* override state transition machine */
  356         mvp->malo_newstate = vap->iv_newstate;
  357         vap->iv_newstate = malo_newstate;
  358 
  359         /* complete setup */
  360         ieee80211_vap_attach(vap,
  361             ieee80211_media_change, ieee80211_media_status, mac);
  362         ic->ic_opmode = opmode;
  363         return vap;
  364 }
  365 
  366 static void
  367 malo_vap_delete(struct ieee80211vap *vap)
  368 {
  369         struct malo_vap *mvp = MALO_VAP(vap);
  370 
  371         ieee80211_vap_detach(vap);
  372         free(mvp, M_80211_VAP);
  373 }
  374 
  375 int
  376 malo_intr(void *arg)
  377 {
  378         struct malo_softc *sc = arg;
  379         struct malo_hal *mh = sc->malo_mh;
  380         uint32_t status;
  381 
  382         if (sc->malo_invalid) {
  383                 /*
  384                  * The hardware is not ready/present, don't touch anything.
  385                  * Note this can happen early on if the IRQ is shared.
  386                  */
  387                 DPRINTF(sc, MALO_DEBUG_ANY, "%s: invalid; ignored\n", __func__);
  388                 return (FILTER_STRAY);
  389         }
  390 
  391         /*
  392          * Figure out the reason(s) for the interrupt.
  393          */
  394         malo_hal_getisr(mh, &status);           /* NB: clears ISR too */
  395         if (status == 0)                        /* must be a shared irq */
  396                 return (FILTER_STRAY);
  397 
  398         DPRINTF(sc, MALO_DEBUG_INTR, "%s: status 0x%x imask 0x%x\n",
  399             __func__, status, sc->malo_imask);
  400 
  401         if (status & MALO_A2HRIC_BIT_RX_RDY)
  402                 taskqueue_enqueue(sc->malo_tq, &sc->malo_rxtask);
  403         if (status & MALO_A2HRIC_BIT_TX_DONE)
  404                 taskqueue_enqueue(sc->malo_tq, &sc->malo_txtask);
  405         if (status & MALO_A2HRIC_BIT_OPC_DONE)
  406                 malo_hal_cmddone(mh);
  407         if (status & MALO_A2HRIC_BIT_MAC_EVENT)
  408                 ;
  409         if (status & MALO_A2HRIC_BIT_RX_PROBLEM)
  410                 ;
  411         if (status & MALO_A2HRIC_BIT_ICV_ERROR) {
  412                 /* TKIP ICV error */
  413                 sc->malo_stats.mst_rx_badtkipicv++;
  414         }
  415 #ifdef MALO_DEBUG
  416         if (((status | sc->malo_imask) ^ sc->malo_imask) != 0)
  417                 DPRINTF(sc, MALO_DEBUG_INTR,
  418                     "%s: can't handle interrupt status 0x%x\n",
  419                     __func__, status);
  420 #endif
  421         return (FILTER_HANDLED);
  422 }
  423 
  424 static void
  425 malo_load_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
  426 {
  427         bus_addr_t *paddr = (bus_addr_t*) arg;
  428 
  429         KASSERT(error == 0, ("error %u on bus_dma callback", error));
  430 
  431         *paddr = segs->ds_addr;
  432 }
  433 
  434 static int
  435 malo_desc_setup(struct malo_softc *sc, const char *name,
  436     struct malo_descdma *dd,
  437     int nbuf, size_t bufsize, int ndesc, size_t descsize)
  438 {
  439         int error;
  440         uint8_t *ds;
  441 
  442         DPRINTF(sc, MALO_DEBUG_RESET,
  443             "%s: %s DMA: %u bufs (%ju) %u desc/buf (%ju)\n",
  444             __func__, name, nbuf, (uintmax_t) bufsize,
  445             ndesc, (uintmax_t) descsize);
  446         
  447         dd->dd_name = name;
  448         dd->dd_desc_len = nbuf * ndesc * descsize;
  449 
  450         /*
  451          * Setup DMA descriptor area.
  452          */
  453         error = bus_dma_tag_create(bus_get_dma_tag(sc->malo_dev),/* parent */
  454                        PAGE_SIZE, 0,            /* alignment, bounds */
  455                        BUS_SPACE_MAXADDR_32BIT, /* lowaddr */
  456                        BUS_SPACE_MAXADDR,       /* highaddr */
  457                        NULL, NULL,              /* filter, filterarg */
  458                        dd->dd_desc_len,         /* maxsize */
  459                        1,                       /* nsegments */
  460                        dd->dd_desc_len,         /* maxsegsize */
  461                        BUS_DMA_ALLOCNOW,        /* flags */
  462                        NULL,                    /* lockfunc */
  463                        NULL,                    /* lockarg */
  464                        &dd->dd_dmat);
  465         if (error != 0) {
  466                 device_printf(sc->malo_dev, "cannot allocate %s DMA tag\n",
  467                     dd->dd_name);
  468                 return error;
  469         }
  470         
  471         /* allocate descriptors */
  472         error = bus_dmamem_alloc(dd->dd_dmat, (void**) &dd->dd_desc,
  473             BUS_DMA_NOWAIT | BUS_DMA_COHERENT, &dd->dd_dmamap);
  474         if (error != 0) {
  475                 device_printf(sc->malo_dev,
  476                     "unable to alloc memory for %u %s descriptors, "
  477                     "error %u\n", nbuf * ndesc, dd->dd_name, error);
  478                 goto fail1;
  479         }
  480 
  481         error = bus_dmamap_load(dd->dd_dmat, dd->dd_dmamap,
  482             dd->dd_desc, dd->dd_desc_len,
  483             malo_load_cb, &dd->dd_desc_paddr, BUS_DMA_NOWAIT);
  484         if (error != 0) {
  485                 device_printf(sc->malo_dev,
  486                     "unable to map %s descriptors, error %u\n",
  487                     dd->dd_name, error);
  488                 goto fail2;
  489         }
  490         
  491         ds = dd->dd_desc;
  492         memset(ds, 0, dd->dd_desc_len);
  493         DPRINTF(sc, MALO_DEBUG_RESET,
  494             "%s: %s DMA map: %p (%lu) -> 0x%jx (%lu)\n",
  495             __func__, dd->dd_name, ds, (u_long) dd->dd_desc_len,
  496             (uintmax_t) dd->dd_desc_paddr, /*XXX*/ (u_long) dd->dd_desc_len);
  497 
  498         return 0;
  499 fail2:
  500         bus_dmamem_free(dd->dd_dmat, dd->dd_desc, dd->dd_dmamap);
  501 fail1:
  502         bus_dma_tag_destroy(dd->dd_dmat);
  503         memset(dd, 0, sizeof(*dd));
  504         return error;
  505 }
  506 
  507 #define DS2PHYS(_dd, _ds) \
  508         ((_dd)->dd_desc_paddr + ((caddr_t)(_ds) - (caddr_t)(_dd)->dd_desc))
  509 
  510 static int
  511 malo_rxdma_setup(struct malo_softc *sc)
  512 {
  513         int error, bsize, i;
  514         struct malo_rxbuf *bf;
  515         struct malo_rxdesc *ds;
  516 
  517         error = malo_desc_setup(sc, "rx", &sc->malo_rxdma,
  518             malo_rxbuf, sizeof(struct malo_rxbuf),
  519             1, sizeof(struct malo_rxdesc));
  520         if (error != 0)
  521                 return error;
  522 
  523         /*
  524          * Allocate rx buffers and set them up.
  525          */
  526         bsize = malo_rxbuf * sizeof(struct malo_rxbuf);
  527         bf = malloc(bsize, M_MALODEV, M_NOWAIT | M_ZERO);
  528         if (bf == NULL) {
  529                 device_printf(sc->malo_dev,
  530                     "malloc of %u rx buffers failed\n", bsize);
  531                 return error;
  532         }
  533         sc->malo_rxdma.dd_bufptr = bf;
  534         
  535         STAILQ_INIT(&sc->malo_rxbuf);
  536         ds = sc->malo_rxdma.dd_desc;
  537         for (i = 0; i < malo_rxbuf; i++, bf++, ds++) {
  538                 bf->bf_desc = ds;
  539                 bf->bf_daddr = DS2PHYS(&sc->malo_rxdma, ds);
  540                 error = bus_dmamap_create(sc->malo_dmat, BUS_DMA_NOWAIT,
  541                     &bf->bf_dmamap);
  542                 if (error != 0) {
  543                         device_printf(sc->malo_dev,
  544                             "%s: unable to dmamap for rx buffer, error %d\n",
  545                             __func__, error);
  546                         return error;
  547                 }
  548                 /* NB: tail is intentional to preserve descriptor order */
  549                 STAILQ_INSERT_TAIL(&sc->malo_rxbuf, bf, bf_list);
  550         }
  551         return 0;
  552 }
  553 
  554 static int
  555 malo_txdma_setup(struct malo_softc *sc, struct malo_txq *txq)
  556 {
  557         int error, bsize, i;
  558         struct malo_txbuf *bf;
  559         struct malo_txdesc *ds;
  560 
  561         error = malo_desc_setup(sc, "tx", &txq->dma,
  562             malo_txbuf, sizeof(struct malo_txbuf),
  563             MALO_TXDESC, sizeof(struct malo_txdesc));
  564         if (error != 0)
  565                 return error;
  566         
  567         /* allocate and setup tx buffers */
  568         bsize = malo_txbuf * sizeof(struct malo_txbuf);
  569         bf = malloc(bsize, M_MALODEV, M_NOWAIT | M_ZERO);
  570         if (bf == NULL) {
  571                 device_printf(sc->malo_dev, "malloc of %u tx buffers failed\n",
  572                     malo_txbuf);
  573                 return ENOMEM;
  574         }
  575         txq->dma.dd_bufptr = bf;
  576         
  577         STAILQ_INIT(&txq->free);
  578         txq->nfree = 0;
  579         ds = txq->dma.dd_desc;
  580         for (i = 0; i < malo_txbuf; i++, bf++, ds += MALO_TXDESC) {
  581                 bf->bf_desc = ds;
  582                 bf->bf_daddr = DS2PHYS(&txq->dma, ds);
  583                 error = bus_dmamap_create(sc->malo_dmat, BUS_DMA_NOWAIT,
  584                     &bf->bf_dmamap);
  585                 if (error != 0) {
  586                         device_printf(sc->malo_dev,
  587                             "unable to create dmamap for tx "
  588                             "buffer %u, error %u\n", i, error);
  589                         return error;
  590                 }
  591                 STAILQ_INSERT_TAIL(&txq->free, bf, bf_list);
  592                 txq->nfree++;
  593         }
  594 
  595         return 0;
  596 }
  597 
  598 static void
  599 malo_desc_cleanup(struct malo_softc *sc, struct malo_descdma *dd)
  600 {
  601         bus_dmamap_unload(dd->dd_dmat, dd->dd_dmamap);
  602         bus_dmamem_free(dd->dd_dmat, dd->dd_desc, dd->dd_dmamap);
  603         bus_dma_tag_destroy(dd->dd_dmat);
  604 
  605         memset(dd, 0, sizeof(*dd));
  606 }
  607 
  608 static void
  609 malo_rxdma_cleanup(struct malo_softc *sc)
  610 {
  611         struct malo_rxbuf *bf;
  612 
  613         STAILQ_FOREACH(bf, &sc->malo_rxbuf, bf_list) {
  614                 if (bf->bf_m != NULL) {
  615                         m_freem(bf->bf_m);
  616                         bf->bf_m = NULL;
  617                 }
  618                 if (bf->bf_dmamap != NULL) {
  619                         bus_dmamap_destroy(sc->malo_dmat, bf->bf_dmamap);
  620                         bf->bf_dmamap = NULL;
  621                 }
  622         }
  623         STAILQ_INIT(&sc->malo_rxbuf);
  624         if (sc->malo_rxdma.dd_bufptr != NULL) {
  625                 free(sc->malo_rxdma.dd_bufptr, M_MALODEV);
  626                 sc->malo_rxdma.dd_bufptr = NULL;
  627         }
  628         if (sc->malo_rxdma.dd_desc_len != 0)
  629                 malo_desc_cleanup(sc, &sc->malo_rxdma);
  630 }
  631 
  632 static void
  633 malo_txdma_cleanup(struct malo_softc *sc, struct malo_txq *txq)
  634 {
  635         struct malo_txbuf *bf;
  636         struct ieee80211_node *ni;
  637 
  638         STAILQ_FOREACH(bf, &txq->free, bf_list) {
  639                 if (bf->bf_m != NULL) {
  640                         m_freem(bf->bf_m);
  641                         bf->bf_m = NULL;
  642                 }
  643                 ni = bf->bf_node;
  644                 bf->bf_node = NULL;
  645                 if (ni != NULL) {
  646                         /*
  647                          * Reclaim node reference.
  648                          */
  649                         ieee80211_free_node(ni);
  650                 }
  651                 if (bf->bf_dmamap != NULL) {
  652                         bus_dmamap_destroy(sc->malo_dmat, bf->bf_dmamap);
  653                         bf->bf_dmamap = NULL;
  654                 }
  655         }
  656         STAILQ_INIT(&txq->free);
  657         txq->nfree = 0;
  658         if (txq->dma.dd_bufptr != NULL) {
  659                 free(txq->dma.dd_bufptr, M_MALODEV);
  660                 txq->dma.dd_bufptr = NULL;
  661         }
  662         if (txq->dma.dd_desc_len != 0)
  663                 malo_desc_cleanup(sc, &txq->dma);
  664 }
  665 
  666 static void
  667 malo_dma_cleanup(struct malo_softc *sc)
  668 {
  669         int i;
  670 
  671         for (i = 0; i < MALO_NUM_TX_QUEUES; i++)
  672                 malo_txdma_cleanup(sc, &sc->malo_txq[i]);
  673 
  674         malo_rxdma_cleanup(sc);
  675 }
  676 
  677 static int
  678 malo_dma_setup(struct malo_softc *sc)
  679 {
  680         int error, i;
  681 
  682         /* rxdma initializing.  */
  683         error = malo_rxdma_setup(sc);
  684         if (error != 0)
  685                 return error;
  686 
  687         /* NB: we just have 1 tx queue now.  */
  688         for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
  689                 error = malo_txdma_setup(sc, &sc->malo_txq[i]);
  690                 if (error != 0) {
  691                         malo_dma_cleanup(sc);
  692 
  693                         return error;
  694                 }
  695 
  696                 malo_txq_init(sc, &sc->malo_txq[i], i);
  697         }
  698 
  699         return 0;
  700 }
  701 
  702 static void
  703 malo_hal_set_rxtxdma(struct malo_softc *sc)
  704 {
  705         int i;
  706 
  707         malo_bar0_write4(sc, sc->malo_hwspecs.rxdesc_read,
  708             sc->malo_hwdma.rxdesc_read);
  709         malo_bar0_write4(sc, sc->malo_hwspecs.rxdesc_write,
  710             sc->malo_hwdma.rxdesc_read);
  711 
  712         for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
  713                 malo_bar0_write4(sc,
  714                     sc->malo_hwspecs.wcbbase[i], sc->malo_hwdma.wcbbase[i]);
  715         }
  716 }
  717 
  718 /*
  719  * Inform firmware of our tx/rx dma setup.  The BAR 0 writes below are
  720  * for compatibility with older firmware.  For current firmware we send
  721  * this information with a cmd block via malo_hal_sethwdma.
  722  */
  723 static int
  724 malo_setup_hwdma(struct malo_softc *sc)
  725 {
  726         int i;
  727         struct malo_txq *txq;
  728 
  729         sc->malo_hwdma.rxdesc_read = sc->malo_rxdma.dd_desc_paddr;
  730 
  731         for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
  732                 txq = &sc->malo_txq[i];
  733                 sc->malo_hwdma.wcbbase[i] = txq->dma.dd_desc_paddr;
  734         }
  735         sc->malo_hwdma.maxnum_txwcb = malo_txbuf;
  736         sc->malo_hwdma.maxnum_wcb = MALO_NUM_TX_QUEUES;
  737 
  738         malo_hal_set_rxtxdma(sc);
  739 
  740         return 0;
  741 }
  742 
  743 static void
  744 malo_txq_init(struct malo_softc *sc, struct malo_txq *txq, int qnum)
  745 {
  746         struct malo_txbuf *bf, *bn;
  747         struct malo_txdesc *ds;
  748 
  749         MALO_TXQ_LOCK_INIT(sc, txq);
  750         txq->qnum = qnum;
  751         txq->txpri = 0; /* XXX */
  752 
  753         STAILQ_FOREACH(bf, &txq->free, bf_list) {
  754                 bf->bf_txq = txq;
  755 
  756                 ds = bf->bf_desc;
  757                 bn = STAILQ_NEXT(bf, bf_list);
  758                 if (bn == NULL)
  759                         bn = STAILQ_FIRST(&txq->free);
  760                 ds->physnext = htole32(bn->bf_daddr);
  761         }
  762         STAILQ_INIT(&txq->active);
  763 }
  764 
  765 /*
  766  * Reclaim resources for a setup queue.
  767  */
  768 static void
  769 malo_tx_cleanupq(struct malo_softc *sc, struct malo_txq *txq)
  770 {
  771         /* XXX hal work? */
  772         MALO_TXQ_LOCK_DESTROY(txq);
  773 }
  774 
  775 /*
  776  * Allocate a tx buffer for sending a frame.
  777  */
  778 static struct malo_txbuf *
  779 malo_getbuf(struct malo_softc *sc, struct malo_txq *txq)
  780 {
  781         struct malo_txbuf *bf;
  782 
  783         MALO_TXQ_LOCK(txq);
  784         bf = STAILQ_FIRST(&txq->free);
  785         if (bf != NULL) {
  786                 STAILQ_REMOVE_HEAD(&txq->free, bf_list);
  787                 txq->nfree--;
  788         }
  789         MALO_TXQ_UNLOCK(txq);
  790         if (bf == NULL) {
  791                 DPRINTF(sc, MALO_DEBUG_XMIT,
  792                     "%s: out of xmit buffers on q %d\n", __func__, txq->qnum);
  793                 sc->malo_stats.mst_tx_qstop++;
  794         }
  795         return bf;
  796 }
  797 
  798 static int
  799 malo_tx_dmasetup(struct malo_softc *sc, struct malo_txbuf *bf, struct mbuf *m0)
  800 {
  801         struct mbuf *m;
  802         int error;
  803 
  804         /*
  805          * Load the DMA map so any coalescing is done.  This also calculates
  806          * the number of descriptors we need.
  807          */
  808         error = bus_dmamap_load_mbuf_sg(sc->malo_dmat, bf->bf_dmamap, m0,
  809                                      bf->bf_segs, &bf->bf_nseg,
  810                                      BUS_DMA_NOWAIT);
  811         if (error == EFBIG) {
  812                 /* XXX packet requires too many descriptors */
  813                 bf->bf_nseg = MALO_TXDESC + 1;
  814         } else if (error != 0) {
  815                 sc->malo_stats.mst_tx_busdma++;
  816                 m_freem(m0);
  817                 return error;
  818         }
  819         /*
  820          * Discard null packets and check for packets that require too many
  821          * TX descriptors.  We try to convert the latter to a cluster.
  822          */
  823         if (error == EFBIG) {           /* too many desc's, linearize */
  824                 sc->malo_stats.mst_tx_linear++;
  825                 m = m_defrag(m0, M_NOWAIT);
  826                 if (m == NULL) {
  827                         m_freem(m0);
  828                         sc->malo_stats.mst_tx_nombuf++;
  829                         return ENOMEM;
  830                 }
  831                 m0 = m;
  832                 error = bus_dmamap_load_mbuf_sg(sc->malo_dmat, bf->bf_dmamap, m0,
  833                                              bf->bf_segs, &bf->bf_nseg,
  834                                              BUS_DMA_NOWAIT);
  835                 if (error != 0) {
  836                         sc->malo_stats.mst_tx_busdma++;
  837                         m_freem(m0);
  838                         return error;
  839                 }
  840                 KASSERT(bf->bf_nseg <= MALO_TXDESC,
  841                     ("too many segments after defrag; nseg %u", bf->bf_nseg));
  842         } else if (bf->bf_nseg == 0) {          /* null packet, discard */
  843                 sc->malo_stats.mst_tx_nodata++;
  844                 m_freem(m0);
  845                 return EIO;
  846         }
  847         DPRINTF(sc, MALO_DEBUG_XMIT, "%s: m %p len %u\n",
  848                 __func__, m0, m0->m_pkthdr.len);
  849         bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
  850         bf->bf_m = m0;
  851 
  852         return 0;
  853 }
  854 
  855 #ifdef MALO_DEBUG
  856 static void
  857 malo_printrxbuf(const struct malo_rxbuf *bf, u_int ix)
  858 {
  859         const struct malo_rxdesc *ds = bf->bf_desc;
  860         uint32_t status = le32toh(ds->status);
  861         
  862         printf("R[%2u] (DS.V:%p DS.P:0x%jx) NEXT:%08x DATA:%08x RC:%02x%s\n"
  863             "      STAT:%02x LEN:%04x SNR:%02x NF:%02x CHAN:%02x"
  864             " RATE:%02x QOS:%04x\n", ix, ds, (uintmax_t)bf->bf_daddr,
  865             le32toh(ds->physnext), le32toh(ds->physbuffdata),
  866             ds->rxcontrol, 
  867             ds->rxcontrol != MALO_RXD_CTRL_DRIVER_OWN ?
  868                 "" : (status & MALO_RXD_STATUS_OK) ? " *" : " !",
  869             ds->status, le16toh(ds->pktlen), ds->snr, ds->nf, ds->channel,
  870             ds->rate, le16toh(ds->qosctrl));
  871 }
  872 
  873 static void
  874 malo_printtxbuf(const struct malo_txbuf *bf, u_int qnum, u_int ix)
  875 {
  876         const struct malo_txdesc *ds = bf->bf_desc;
  877         uint32_t status = le32toh(ds->status);
  878         
  879         printf("Q%u[%3u]", qnum, ix);
  880         printf(" (DS.V:%p DS.P:0x%jx)\n", ds, (uintmax_t)bf->bf_daddr);
  881         printf("    NEXT:%08x DATA:%08x LEN:%04x STAT:%08x%s\n",
  882             le32toh(ds->physnext),
  883             le32toh(ds->pktptr), le16toh(ds->pktlen), status,
  884             status & MALO_TXD_STATUS_USED ?
  885             "" : (status & 3) != 0 ? " *" : " !");
  886         printf("    RATE:%02x PRI:%x QOS:%04x SAP:%08x FORMAT:%04x\n",
  887             ds->datarate, ds->txpriority, le16toh(ds->qosctrl),
  888             le32toh(ds->sap_pktinfo), le16toh(ds->format));
  889 #if 0
  890         {
  891                 const uint8_t *cp = (const uint8_t *) ds;
  892                 int i;
  893                 for (i = 0; i < sizeof(struct malo_txdesc); i++) {
  894                         printf("%02x ", cp[i]);
  895                         if (((i+1) % 16) == 0)
  896                                 printf("\n");
  897                 }
  898                 printf("\n");
  899         }
  900 #endif
  901 }
  902 #endif /* MALO_DEBUG */
  903 
  904 static __inline void
  905 malo_updatetxrate(struct ieee80211_node *ni, int rix)
  906 {
  907         static const int ieeerates[] =
  908             { 2, 4, 11, 22, 44, 12, 18, 24, 36, 48, 96, 108 };
  909         if (rix < nitems(ieeerates))
  910                 ni->ni_txrate = ieeerates[rix];
  911 }
  912 
  913 static int
  914 malo_fix2rate(int fix_rate)
  915 {
  916         static const int rates[] =
  917             { 2, 4, 11, 22, 12, 18, 24, 36, 48, 96, 108 };
  918         return (fix_rate < nitems(rates) ? rates[fix_rate] : 0);
  919 }
  920 
  921 /* idiomatic shorthands: MS = mask+shift, SM = shift+mask */
  922 #define MS(v,x)                 (((v) & x) >> x##_S)
  923 #define SM(v,x)                 (((v) << x##_S) & x)
  924 
  925 /*
  926  * Process completed xmit descriptors from the specified queue.
  927  */
  928 static int
  929 malo_tx_processq(struct malo_softc *sc, struct malo_txq *txq)
  930 {
  931         struct malo_txbuf *bf;
  932         struct malo_txdesc *ds;
  933         struct ieee80211_node *ni;
  934         int nreaped;
  935         uint32_t status;
  936 
  937         DPRINTF(sc, MALO_DEBUG_TX_PROC, "%s: tx queue %u\n",
  938             __func__, txq->qnum);
  939         for (nreaped = 0;; nreaped++) {
  940                 MALO_TXQ_LOCK(txq);
  941                 bf = STAILQ_FIRST(&txq->active);
  942                 if (bf == NULL) {
  943                         MALO_TXQ_UNLOCK(txq);
  944                         break;
  945                 }
  946                 ds = bf->bf_desc;
  947                 MALO_TXDESC_SYNC(txq, ds,
  948                     BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
  949                 if (ds->status & htole32(MALO_TXD_STATUS_FW_OWNED)) {
  950                         MALO_TXQ_UNLOCK(txq);
  951                         break;
  952                 }
  953                 STAILQ_REMOVE_HEAD(&txq->active, bf_list);
  954                 MALO_TXQ_UNLOCK(txq);
  955 
  956 #ifdef MALO_DEBUG
  957                 if (sc->malo_debug & MALO_DEBUG_XMIT_DESC)
  958                         malo_printtxbuf(bf, txq->qnum, nreaped);
  959 #endif
  960                 ni = bf->bf_node;
  961                 if (ni != NULL) {
  962                         status = le32toh(ds->status);
  963                         if (status & MALO_TXD_STATUS_OK) {
  964                                 uint16_t format = le16toh(ds->format);
  965                                 uint8_t txant = MS(format, MALO_TXD_ANTENNA);
  966 
  967                                 sc->malo_stats.mst_ant_tx[txant]++;
  968                                 if (status & MALO_TXD_STATUS_OK_RETRY)
  969                                         sc->malo_stats.mst_tx_retries++;
  970                                 if (status & MALO_TXD_STATUS_OK_MORE_RETRY)
  971                                         sc->malo_stats.mst_tx_mretries++;
  972                                 malo_updatetxrate(ni, ds->datarate);
  973                                 sc->malo_stats.mst_tx_rate = ds->datarate;
  974                         } else {
  975                                 if (status & MALO_TXD_STATUS_FAILED_LINK_ERROR)
  976                                         sc->malo_stats.mst_tx_linkerror++;
  977                                 if (status & MALO_TXD_STATUS_FAILED_XRETRY)
  978                                         sc->malo_stats.mst_tx_xretries++;
  979                                 if (status & MALO_TXD_STATUS_FAILED_AGING)
  980                                         sc->malo_stats.mst_tx_aging++;
  981                         }
  982                         /* XXX strip fw len in case header inspected */
  983                         m_adj(bf->bf_m, sizeof(uint16_t));
  984                         ieee80211_tx_complete(ni, bf->bf_m, 
  985                             (status & MALO_TXD_STATUS_OK) == 0);
  986                 } else
  987                         m_freem(bf->bf_m);
  988 
  989                 ds->status = htole32(MALO_TXD_STATUS_IDLE);
  990                 ds->pktlen = htole32(0);
  991 
  992                 bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap,
  993                     BUS_DMASYNC_POSTWRITE);
  994                 bus_dmamap_unload(sc->malo_dmat, bf->bf_dmamap);
  995                 bf->bf_m = NULL;
  996                 bf->bf_node = NULL;
  997 
  998                 MALO_TXQ_LOCK(txq);
  999                 STAILQ_INSERT_TAIL(&txq->free, bf, bf_list);
 1000                 txq->nfree++;
 1001                 MALO_TXQ_UNLOCK(txq);
 1002         }
 1003         return nreaped;
 1004 }
 1005 
 1006 /*
 1007  * Deferred processing of transmit interrupt.
 1008  */
 1009 static void
 1010 malo_tx_proc(void *arg, int npending)
 1011 {
 1012         struct malo_softc *sc = arg;
 1013         int i, nreaped;
 1014 
 1015         /*
 1016          * Process each active queue.
 1017          */
 1018         nreaped = 0;
 1019         MALO_LOCK(sc);
 1020         for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
 1021                 if (!STAILQ_EMPTY(&sc->malo_txq[i].active))
 1022                         nreaped += malo_tx_processq(sc, &sc->malo_txq[i]);
 1023         }
 1024 
 1025         if (nreaped != 0) {
 1026                 sc->malo_timer = 0;
 1027                 malo_start(sc);
 1028         }
 1029         MALO_UNLOCK(sc);
 1030 }
 1031 
 1032 static int
 1033 malo_tx_start(struct malo_softc *sc, struct ieee80211_node *ni,
 1034     struct malo_txbuf *bf, struct mbuf *m0)
 1035 {
 1036 #define IS_DATA_FRAME(wh)                                               \
 1037         ((wh->i_fc[0] & (IEEE80211_FC0_TYPE_MASK)) == IEEE80211_FC0_TYPE_DATA)
 1038         int error, ismcast, iswep;
 1039         int copyhdrlen, hdrlen, pktlen;
 1040         struct ieee80211_frame *wh;
 1041         struct ieee80211com *ic = &sc->malo_ic;
 1042         struct ieee80211vap *vap = ni->ni_vap;
 1043         struct malo_txdesc *ds;
 1044         struct malo_txrec *tr;
 1045         struct malo_txq *txq;
 1046         uint16_t qos;
 1047 
 1048         wh = mtod(m0, struct ieee80211_frame *);
 1049         iswep = wh->i_fc[1] & IEEE80211_FC1_PROTECTED;
 1050         ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
 1051         copyhdrlen = hdrlen = ieee80211_anyhdrsize(wh);
 1052         pktlen = m0->m_pkthdr.len;
 1053         if (IEEE80211_QOS_HAS_SEQ(wh)) {
 1054                 qos = *(uint16_t *)ieee80211_getqos(wh);
 1055                 if (IEEE80211_IS_DSTODS(wh))
 1056                         copyhdrlen -= sizeof(qos);
 1057         } else
 1058                 qos = 0;
 1059 
 1060         if (iswep) {
 1061                 struct ieee80211_key *k;
 1062 
 1063                 /*
 1064                  * Construct the 802.11 header+trailer for an encrypted
 1065                  * frame. The only reason this can fail is because of an
 1066                  * unknown or unsupported cipher/key type.
 1067                  *
 1068                  * NB: we do this even though the firmware will ignore
 1069                  *     what we've done for WEP and TKIP as we need the
 1070                  *     ExtIV filled in for CCMP and this also adjusts
 1071                  *     the headers which simplifies our work below.
 1072                  */
 1073                 k = ieee80211_crypto_encap(ni, m0);
 1074                 if (k == NULL) {
 1075                         /*
 1076                          * This can happen when the key is yanked after the
 1077                          * frame was queued.  Just discard the frame; the
 1078                          * 802.11 layer counts failures and provides
 1079                          * debugging/diagnostics.
 1080                          */
 1081                         m_freem(m0);
 1082                         return EIO;
 1083                 }
 1084 
 1085                 /*
 1086                  * Adjust the packet length for the crypto additions
 1087                  * done during encap and any other bits that the f/w
 1088                  * will add later on.
 1089                  */
 1090                 pktlen = m0->m_pkthdr.len;
 1091 
 1092                 /* packet header may have moved, reset our local pointer */
 1093                 wh = mtod(m0, struct ieee80211_frame *);
 1094         }
 1095 
 1096         if (ieee80211_radiotap_active_vap(vap)) {
 1097                 sc->malo_tx_th.wt_flags = 0;    /* XXX */
 1098                 if (iswep)
 1099                         sc->malo_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
 1100                 sc->malo_tx_th.wt_txpower = ni->ni_txpower;
 1101                 sc->malo_tx_th.wt_antenna = sc->malo_txantenna;
 1102 
 1103                 ieee80211_radiotap_tx(vap, m0);
 1104         }
 1105 
 1106         /*
 1107          * Copy up/down the 802.11 header; the firmware requires
 1108          * we present a 2-byte payload length followed by a
 1109          * 4-address header (w/o QoS), followed (optionally) by
 1110          * any WEP/ExtIV header (but only filled in for CCMP).
 1111          * We are assured the mbuf has sufficient headroom to
 1112          * prepend in-place by the setup of ic_headroom in
 1113          * malo_attach.
 1114          */
 1115         if (hdrlen < sizeof(struct malo_txrec)) {
 1116                 const int space = sizeof(struct malo_txrec) - hdrlen;
 1117                 if (M_LEADINGSPACE(m0) < space) {
 1118                         /* NB: should never happen */
 1119                         device_printf(sc->malo_dev,
 1120                             "not enough headroom, need %d found %zd, "
 1121                             "m_flags 0x%x m_len %d\n",
 1122                             space, M_LEADINGSPACE(m0), m0->m_flags, m0->m_len);
 1123                         ieee80211_dump_pkt(ic,
 1124                             mtod(m0, const uint8_t *), m0->m_len, 0, -1);
 1125                         m_freem(m0);
 1126                         /* XXX stat */
 1127                         return EIO;
 1128                 }
 1129                 M_PREPEND(m0, space, M_NOWAIT);
 1130         }
 1131         tr = mtod(m0, struct malo_txrec *);
 1132         if (wh != (struct ieee80211_frame *) &tr->wh)
 1133                 ovbcopy(wh, &tr->wh, hdrlen);
 1134         /*
 1135          * Note: the "firmware length" is actually the length of the fully
 1136          * formed "802.11 payload".  That is, it's everything except for
 1137          * the 802.11 header.  In particular this includes all crypto
 1138          * material including the MIC!
 1139          */
 1140         tr->fwlen = htole16(pktlen - hdrlen);
 1141 
 1142         /*
 1143          * Load the DMA map so any coalescing is done.  This
 1144          * also calculates the number of descriptors we need.
 1145          */
 1146         error = malo_tx_dmasetup(sc, bf, m0);
 1147         if (error != 0)
 1148                 return error;
 1149         bf->bf_node = ni;                       /* NB: held reference */
 1150         m0 = bf->bf_m;                          /* NB: may have changed */
 1151         tr = mtod(m0, struct malo_txrec *);
 1152         wh = (struct ieee80211_frame *)&tr->wh;
 1153 
 1154         /*
 1155          * Formulate tx descriptor.
 1156          */
 1157         ds = bf->bf_desc;
 1158         txq = bf->bf_txq;
 1159 
 1160         ds->qosctrl = qos;                      /* NB: already little-endian */
 1161         ds->pktptr = htole32(bf->bf_segs[0].ds_addr);
 1162         ds->pktlen = htole16(bf->bf_segs[0].ds_len);
 1163         /* NB: pPhysNext setup once, don't touch */
 1164         ds->datarate = IS_DATA_FRAME(wh) ? 1 : 0;
 1165         ds->sap_pktinfo = 0;
 1166         ds->format = 0;
 1167 
 1168         /*
 1169          * Select transmit rate.
 1170          */
 1171         switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
 1172         case IEEE80211_FC0_TYPE_MGT:
 1173                 sc->malo_stats.mst_tx_mgmt++;
 1174                 /* fall thru... */
 1175         case IEEE80211_FC0_TYPE_CTL:
 1176                 ds->txpriority = 1;
 1177                 break;
 1178         case IEEE80211_FC0_TYPE_DATA:
 1179                 ds->txpriority = txq->qnum;
 1180                 break;
 1181         default:
 1182                 device_printf(sc->malo_dev, "bogus frame type 0x%x (%s)\n",
 1183                         wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK, __func__);
 1184                 /* XXX statistic */
 1185                 m_freem(m0);
 1186                 return EIO;
 1187         }
 1188 
 1189 #ifdef MALO_DEBUG
 1190         if (IFF_DUMPPKTS_XMIT(sc))
 1191                 ieee80211_dump_pkt(ic,
 1192                     mtod(m0, const uint8_t *)+sizeof(uint16_t),
 1193                     m0->m_len - sizeof(uint16_t), ds->datarate, -1);
 1194 #endif
 1195 
 1196         MALO_TXQ_LOCK(txq);
 1197         if (!IS_DATA_FRAME(wh))
 1198                 ds->status |= htole32(1);
 1199         ds->status |= htole32(MALO_TXD_STATUS_FW_OWNED);
 1200         STAILQ_INSERT_TAIL(&txq->active, bf, bf_list);
 1201         MALO_TXDESC_SYNC(txq, ds, BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
 1202 
 1203         sc->malo_timer = 5;
 1204         MALO_TXQ_UNLOCK(txq);
 1205         return 0;
 1206 }
 1207 
 1208 static int
 1209 malo_transmit(struct ieee80211com *ic, struct mbuf *m)
 1210 {
 1211         struct malo_softc *sc = ic->ic_softc;
 1212         int error;
 1213 
 1214         MALO_LOCK(sc);
 1215         if (!sc->malo_running) {
 1216                 MALO_UNLOCK(sc);
 1217                 return (ENXIO);
 1218         }
 1219         error = mbufq_enqueue(&sc->malo_snd, m);
 1220         if (error) {
 1221                 MALO_UNLOCK(sc);
 1222                 return (error);
 1223         }
 1224         malo_start(sc);
 1225         MALO_UNLOCK(sc);
 1226         return (0);
 1227 }
 1228 
 1229 static void
 1230 malo_start(struct malo_softc *sc)
 1231 {
 1232         struct ieee80211_node *ni;
 1233         struct malo_txq *txq = &sc->malo_txq[0];
 1234         struct malo_txbuf *bf = NULL;
 1235         struct mbuf *m;
 1236         int nqueued = 0;
 1237 
 1238         MALO_LOCK_ASSERT(sc);
 1239 
 1240         if (!sc->malo_running || sc->malo_invalid)
 1241                 return;
 1242 
 1243         while ((m = mbufq_dequeue(&sc->malo_snd)) != NULL) {
 1244                 ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
 1245                 bf = malo_getbuf(sc, txq);
 1246                 if (bf == NULL) {
 1247                         mbufq_prepend(&sc->malo_snd, m);
 1248                         sc->malo_stats.mst_tx_qstop++;
 1249                         break;
 1250                 }
 1251                 /*
 1252                  * Pass the frame to the h/w for transmission.
 1253                  */
 1254                 if (malo_tx_start(sc, ni, bf, m)) {
 1255                         if_inc_counter(ni->ni_vap->iv_ifp,
 1256                             IFCOUNTER_OERRORS, 1);
 1257                         if (bf != NULL) {
 1258                                 bf->bf_m = NULL;
 1259                                 bf->bf_node = NULL;
 1260                                 MALO_TXQ_LOCK(txq);
 1261                                 STAILQ_INSERT_HEAD(&txq->free, bf, bf_list);
 1262                                 MALO_TXQ_UNLOCK(txq);
 1263                         }
 1264                         ieee80211_free_node(ni);
 1265                         continue;
 1266                 }
 1267                 nqueued++;
 1268 
 1269                 if (nqueued >= malo_txcoalesce) {
 1270                         /*
 1271                          * Poke the firmware to process queued frames;
 1272                          * see below about (lack of) locking.
 1273                          */
 1274                         nqueued = 0;
 1275                         malo_hal_txstart(sc->malo_mh, 0/*XXX*/);
 1276                 }
 1277         }
 1278 
 1279         if (nqueued) {
 1280                 /*
 1281                  * NB: We don't need to lock against tx done because
 1282                  * this just prods the firmware to check the transmit
 1283                  * descriptors.  The firmware will also start fetching
 1284                  * descriptors by itself if it notices new ones are
 1285                  * present when it goes to deliver a tx done interrupt
 1286                  * to the host. So if we race with tx done processing
 1287                  * it's ok.  Delivering the kick here rather than in
 1288                  * malo_tx_start is an optimization to avoid poking the
 1289                  * firmware for each packet.
 1290                  *
 1291                  * NB: the queue id isn't used so 0 is ok.
 1292                  */
 1293                 malo_hal_txstart(sc->malo_mh, 0/*XXX*/);
 1294         }
 1295 }
 1296 
 1297 static void
 1298 malo_watchdog(void *arg)
 1299 {
 1300         struct malo_softc *sc = arg;
 1301 
 1302         callout_reset(&sc->malo_watchdog_timer, hz, malo_watchdog, sc);
 1303         if (sc->malo_timer == 0 || --sc->malo_timer > 0)
 1304                 return;
 1305 
 1306         if (sc->malo_running && !sc->malo_invalid) {
 1307                 device_printf(sc->malo_dev, "watchdog timeout\n");
 1308 
 1309                 /* XXX no way to reset h/w. now  */
 1310 
 1311                 counter_u64_add(sc->malo_ic.ic_oerrors, 1);
 1312                 sc->malo_stats.mst_watchdog++;
 1313         }
 1314 }
 1315 
 1316 static int
 1317 malo_hal_reset(struct malo_softc *sc)
 1318 {
 1319         static int first = 0;
 1320         struct ieee80211com *ic = &sc->malo_ic;
 1321         struct malo_hal *mh = sc->malo_mh;
 1322 
 1323         if (first == 0) {
 1324                 /*
 1325                  * NB: when the device firstly is initialized, sometimes
 1326                  * firmware could override rx/tx dma registers so we re-set
 1327                  * these values once.
 1328                  */
 1329                 malo_hal_set_rxtxdma(sc);
 1330                 first = 1;
 1331         }
 1332 
 1333         malo_hal_setantenna(mh, MHA_ANTENNATYPE_RX, sc->malo_rxantenna);
 1334         malo_hal_setantenna(mh, MHA_ANTENNATYPE_TX, sc->malo_txantenna);
 1335         malo_hal_setradio(mh, 1, MHP_AUTO_PREAMBLE);
 1336         malo_chan_set(sc, ic->ic_curchan);
 1337 
 1338         /* XXX needs other stuffs?  */
 1339 
 1340         return 1;
 1341 }
 1342 
 1343 static __inline struct mbuf *
 1344 malo_getrxmbuf(struct malo_softc *sc, struct malo_rxbuf *bf)
 1345 {
 1346         struct mbuf *m;
 1347         bus_addr_t paddr;
 1348         int error;
 1349 
 1350         /* XXX don't need mbuf, just dma buffer */
 1351         m = m_getjcl(M_NOWAIT, MT_DATA, M_PKTHDR, MJUMPAGESIZE);
 1352         if (m == NULL) {
 1353                 sc->malo_stats.mst_rx_nombuf++; /* XXX */
 1354                 return NULL;
 1355         }
 1356         error = bus_dmamap_load(sc->malo_dmat, bf->bf_dmamap,
 1357             mtod(m, caddr_t), MJUMPAGESIZE,
 1358             malo_load_cb, &paddr, BUS_DMA_NOWAIT);
 1359         if (error != 0) {
 1360                 device_printf(sc->malo_dev,
 1361                     "%s: bus_dmamap_load failed, error %d\n", __func__, error);
 1362                 m_freem(m);
 1363                 return NULL;
 1364         }
 1365         bf->bf_data = paddr;
 1366         bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
 1367 
 1368         return m;
 1369 }
 1370 
 1371 static int
 1372 malo_rxbuf_init(struct malo_softc *sc, struct malo_rxbuf *bf)
 1373 {
 1374         struct malo_rxdesc *ds;
 1375 
 1376         ds = bf->bf_desc;
 1377         if (bf->bf_m == NULL) {
 1378                 bf->bf_m = malo_getrxmbuf(sc, bf);
 1379                 if (bf->bf_m == NULL) {
 1380                         /* mark descriptor to be skipped */
 1381                         ds->rxcontrol = MALO_RXD_CTRL_OS_OWN;
 1382                         /* NB: don't need PREREAD */
 1383                         MALO_RXDESC_SYNC(sc, ds, BUS_DMASYNC_PREWRITE);
 1384                         return ENOMEM;
 1385                 }
 1386         }
 1387 
 1388         /*
 1389          * Setup descriptor.
 1390          */
 1391         ds->qosctrl = 0;
 1392         ds->snr = 0;
 1393         ds->status = MALO_RXD_STATUS_IDLE;
 1394         ds->channel = 0;
 1395         ds->pktlen = htole16(MALO_RXSIZE);
 1396         ds->nf = 0;
 1397         ds->physbuffdata = htole32(bf->bf_data);
 1398         /* NB: don't touch pPhysNext, set once */
 1399         ds->rxcontrol = MALO_RXD_CTRL_DRIVER_OWN;
 1400         MALO_RXDESC_SYNC(sc, ds, BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
 1401 
 1402         return 0;
 1403 }
 1404 
 1405 /*
 1406  * Setup the rx data structures.  This should only be done once or we may get
 1407  * out of sync with the firmware.
 1408  */
 1409 static int
 1410 malo_startrecv(struct malo_softc *sc)
 1411 {
 1412         struct malo_rxbuf *bf, *prev;
 1413         struct malo_rxdesc *ds;
 1414         
 1415         if (sc->malo_recvsetup == 1) {
 1416                 malo_mode_init(sc);             /* set filters, etc. */
 1417                 return 0;
 1418         }
 1419         
 1420         prev = NULL;
 1421         STAILQ_FOREACH(bf, &sc->malo_rxbuf, bf_list) {
 1422                 int error = malo_rxbuf_init(sc, bf);
 1423                 if (error != 0) {
 1424                         DPRINTF(sc, MALO_DEBUG_RECV,
 1425                             "%s: malo_rxbuf_init failed %d\n",
 1426                             __func__, error);
 1427                         return error;
 1428                 }
 1429                 if (prev != NULL) {
 1430                         ds = prev->bf_desc;
 1431                         ds->physnext = htole32(bf->bf_daddr);
 1432                 }
 1433                 prev = bf;
 1434         }
 1435         if (prev != NULL) {
 1436                 ds = prev->bf_desc;
 1437                 ds->physnext =
 1438                     htole32(STAILQ_FIRST(&sc->malo_rxbuf)->bf_daddr);
 1439         }
 1440 
 1441         sc->malo_recvsetup = 1;
 1442 
 1443         malo_mode_init(sc);             /* set filters, etc. */
 1444         
 1445         return 0;
 1446 }
 1447 
 1448 static void
 1449 malo_init_locked(struct malo_softc *sc)
 1450 {
 1451         struct malo_hal *mh = sc->malo_mh;
 1452         int error;
 1453         
 1454         MALO_LOCK_ASSERT(sc);
 1455         
 1456         /*
 1457          * Stop anything previously setup.  This is safe whether this is
 1458          * the first time through or not.
 1459          */
 1460         malo_stop(sc);
 1461 
 1462         /*
 1463          * Push state to the firmware.
 1464          */
 1465         if (!malo_hal_reset(sc)) {
 1466                 device_printf(sc->malo_dev,
 1467                     "%s: unable to reset hardware\n", __func__);
 1468                 return;
 1469         }
 1470 
 1471         /*
 1472          * Setup recv (once); transmit is already good to go.
 1473          */
 1474         error = malo_startrecv(sc);
 1475         if (error != 0) {
 1476                 device_printf(sc->malo_dev,
 1477                     "%s: unable to start recv logic, error %d\n",
 1478                     __func__, error);
 1479                 return;
 1480         }
 1481 
 1482         /*
 1483          * Enable interrupts.
 1484          */
 1485         sc->malo_imask = MALO_A2HRIC_BIT_RX_RDY
 1486             | MALO_A2HRIC_BIT_TX_DONE
 1487             | MALO_A2HRIC_BIT_OPC_DONE
 1488             | MALO_A2HRIC_BIT_MAC_EVENT
 1489             | MALO_A2HRIC_BIT_RX_PROBLEM
 1490             | MALO_A2HRIC_BIT_ICV_ERROR
 1491             | MALO_A2HRIC_BIT_RADAR_DETECT
 1492             | MALO_A2HRIC_BIT_CHAN_SWITCH;
 1493 
 1494         sc->malo_running = 1;
 1495         malo_hal_intrset(mh, sc->malo_imask);
 1496         callout_reset(&sc->malo_watchdog_timer, hz, malo_watchdog, sc);
 1497 }
 1498 
 1499 static void
 1500 malo_init(void *arg)
 1501 {
 1502         struct malo_softc *sc = (struct malo_softc *) arg;
 1503         struct ieee80211com *ic = &sc->malo_ic;
 1504         
 1505         MALO_LOCK(sc);
 1506         malo_init_locked(sc);
 1507         MALO_UNLOCK(sc);
 1508 
 1509         if (sc->malo_running)
 1510                 ieee80211_start_all(ic);        /* start all vap's */
 1511 }
 1512 
 1513 /*
 1514  * Set the multicast filter contents into the hardware.
 1515  */
 1516 static void
 1517 malo_setmcastfilter(struct malo_softc *sc)
 1518 {
 1519         struct ieee80211com *ic = &sc->malo_ic;
 1520         struct ieee80211vap *vap;
 1521         uint8_t macs[IEEE80211_ADDR_LEN * MALO_HAL_MCAST_MAX];
 1522         uint8_t *mp;
 1523         int nmc;
 1524 
 1525         mp = macs;
 1526         nmc = 0;
 1527 
 1528         if (ic->ic_opmode == IEEE80211_M_MONITOR || ic->ic_allmulti > 0 ||
 1529             ic->ic_promisc > 0)
 1530                 goto all;
 1531 
 1532         TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
 1533                 struct ifnet *ifp;
 1534                 struct ifmultiaddr *ifma;
 1535 
 1536                 ifp = vap->iv_ifp;
 1537                 if_maddr_rlock(ifp);
 1538                 CK_STAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
 1539                         if (ifma->ifma_addr->sa_family != AF_LINK)
 1540                                 continue;
 1541 
 1542                         if (nmc == MALO_HAL_MCAST_MAX) {
 1543                                 ifp->if_flags |= IFF_ALLMULTI;
 1544                                 if_maddr_runlock(ifp);
 1545                                 goto all;
 1546                         }
 1547                         IEEE80211_ADDR_COPY(mp,
 1548                             LLADDR((struct sockaddr_dl *)ifma->ifma_addr));
 1549 
 1550                         mp += IEEE80211_ADDR_LEN, nmc++;
 1551                 }
 1552                 if_maddr_runlock(ifp);
 1553         }
 1554 
 1555         malo_hal_setmcast(sc->malo_mh, nmc, macs);
 1556 
 1557 all:
 1558         /*
 1559          * XXX we don't know how to set the f/w for supporting
 1560          * IFF_ALLMULTI | IFF_PROMISC cases
 1561          */
 1562         return;
 1563 }
 1564 
 1565 static int
 1566 malo_mode_init(struct malo_softc *sc)
 1567 {
 1568         struct ieee80211com *ic = &sc->malo_ic;
 1569         struct malo_hal *mh = sc->malo_mh;
 1570 
 1571         malo_hal_setpromisc(mh, ic->ic_promisc > 0);
 1572         malo_setmcastfilter(sc);
 1573 
 1574         return ENXIO;
 1575 }
 1576 
 1577 static void
 1578 malo_tx_draintxq(struct malo_softc *sc, struct malo_txq *txq)
 1579 {
 1580         struct ieee80211_node *ni;
 1581         struct malo_txbuf *bf;
 1582         u_int ix;
 1583         
 1584         /*
 1585          * NB: this assumes output has been stopped and
 1586          *     we do not need to block malo_tx_tasklet
 1587          */
 1588         for (ix = 0;; ix++) {
 1589                 MALO_TXQ_LOCK(txq);
 1590                 bf = STAILQ_FIRST(&txq->active);
 1591                 if (bf == NULL) {
 1592                         MALO_TXQ_UNLOCK(txq);
 1593                         break;
 1594                 }
 1595                 STAILQ_REMOVE_HEAD(&txq->active, bf_list);
 1596                 MALO_TXQ_UNLOCK(txq);
 1597 #ifdef MALO_DEBUG
 1598                 if (sc->malo_debug & MALO_DEBUG_RESET) {
 1599                         struct ieee80211com *ic = &sc->malo_ic;
 1600                         const struct malo_txrec *tr =
 1601                             mtod(bf->bf_m, const struct malo_txrec *);
 1602                         malo_printtxbuf(bf, txq->qnum, ix);
 1603                         ieee80211_dump_pkt(ic, (const uint8_t *)&tr->wh,
 1604                             bf->bf_m->m_len - sizeof(tr->fwlen), 0, -1);
 1605                 }
 1606 #endif /* MALO_DEBUG */
 1607                 bus_dmamap_unload(sc->malo_dmat, bf->bf_dmamap);
 1608                 ni = bf->bf_node;
 1609                 bf->bf_node = NULL;
 1610                 if (ni != NULL) {
 1611                         /*
 1612                          * Reclaim node reference.
 1613                          */
 1614                         ieee80211_free_node(ni);
 1615                 }
 1616                 m_freem(bf->bf_m);
 1617                 bf->bf_m = NULL;
 1618                 
 1619                 MALO_TXQ_LOCK(txq);
 1620                 STAILQ_INSERT_TAIL(&txq->free, bf, bf_list);
 1621                 txq->nfree++;
 1622                 MALO_TXQ_UNLOCK(txq);
 1623         }
 1624 }
 1625 
 1626 static void
 1627 malo_stop(struct malo_softc *sc)
 1628 {
 1629         struct malo_hal *mh = sc->malo_mh;
 1630         int i;
 1631 
 1632         DPRINTF(sc, MALO_DEBUG_ANY, "%s: invalid %u running %u\n",
 1633             __func__, sc->malo_invalid, sc->malo_running);
 1634 
 1635         MALO_LOCK_ASSERT(sc);
 1636 
 1637         if (!sc->malo_running)
 1638                 return;
 1639 
 1640         /*
 1641          * Shutdown the hardware and driver:
 1642          *    disable interrupts
 1643          *    turn off the radio
 1644          *    drain and release tx queues
 1645          *
 1646          * Note that some of this work is not possible if the hardware
 1647          * is gone (invalid).
 1648          */
 1649         sc->malo_running = 0;
 1650         callout_stop(&sc->malo_watchdog_timer);
 1651         sc->malo_timer = 0;
 1652         /* disable interrupt.  */
 1653         malo_hal_intrset(mh, 0);
 1654         /* turn off the radio.  */
 1655         malo_hal_setradio(mh, 0, MHP_AUTO_PREAMBLE);
 1656 
 1657         /* drain and release tx queues.  */
 1658         for (i = 0; i < MALO_NUM_TX_QUEUES; i++)
 1659                 malo_tx_draintxq(sc, &sc->malo_txq[i]);
 1660 }
 1661 
 1662 static void
 1663 malo_parent(struct ieee80211com *ic)
 1664 {
 1665         struct malo_softc *sc = ic->ic_softc;
 1666         int startall = 0;
 1667 
 1668         MALO_LOCK(sc);
 1669         if (ic->ic_nrunning > 0) {
 1670                 /*
 1671                  * Beware of being called during attach/detach
 1672                  * to reset promiscuous mode.  In that case we
 1673                  * will still be marked UP but not RUNNING.
 1674                  * However trying to re-init the interface
 1675                  * is the wrong thing to do as we've already
 1676                  * torn down much of our state.  There's
 1677                  * probably a better way to deal with this.
 1678                  */
 1679                 if (!sc->malo_running && !sc->malo_invalid) {
 1680                         malo_init(sc);
 1681                         startall = 1;
 1682                 }
 1683                 /*
 1684                  * To avoid rescanning another access point,
 1685                  * do not call malo_init() here.  Instead,
 1686                  * only reflect promisc mode settings.
 1687                  */
 1688                 malo_mode_init(sc);
 1689         } else if (sc->malo_running)
 1690                 malo_stop(sc);
 1691         MALO_UNLOCK(sc);
 1692         if (startall)
 1693                 ieee80211_start_all(ic);
 1694 }
 1695 
 1696 /*
 1697  * Callback from the 802.11 layer to update the slot time
 1698  * based on the current setting.  We use it to notify the
 1699  * firmware of ERP changes and the f/w takes care of things
 1700  * like slot time and preamble.
 1701  */
 1702 static void
 1703 malo_updateslot(struct ieee80211com *ic)
 1704 {
 1705         struct malo_softc *sc = ic->ic_softc;
 1706         struct malo_hal *mh = sc->malo_mh;
 1707         int error;
 1708         
 1709         /* NB: can be called early; suppress needless cmds */
 1710         if (!sc->malo_running)
 1711                 return;
 1712 
 1713         DPRINTF(sc, MALO_DEBUG_RESET,
 1714             "%s: chan %u MHz/flags 0x%x %s slot, (ic_flags 0x%x)\n",
 1715             __func__, ic->ic_curchan->ic_freq, ic->ic_curchan->ic_flags,
 1716             ic->ic_flags & IEEE80211_F_SHSLOT ? "short" : "long", ic->ic_flags);
 1717 
 1718         if (ic->ic_flags & IEEE80211_F_SHSLOT)
 1719                 error = malo_hal_set_slot(mh, 1);
 1720         else
 1721                 error = malo_hal_set_slot(mh, 0);
 1722 
 1723         if (error != 0)
 1724                 device_printf(sc->malo_dev, "setting %s slot failed\n",
 1725                         ic->ic_flags & IEEE80211_F_SHSLOT ? "short" : "long");
 1726 }
 1727 
 1728 static int
 1729 malo_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
 1730 {
 1731         struct ieee80211com *ic = vap->iv_ic;
 1732         struct malo_softc *sc = ic->ic_softc;
 1733         struct malo_hal *mh = sc->malo_mh;
 1734         int error;
 1735 
 1736         DPRINTF(sc, MALO_DEBUG_STATE, "%s: %s -> %s\n", __func__,
 1737             ieee80211_state_name[vap->iv_state],
 1738             ieee80211_state_name[nstate]);
 1739 
 1740         /*
 1741          * Invoke the net80211 layer first so iv_bss is setup.
 1742          */
 1743         error = MALO_VAP(vap)->malo_newstate(vap, nstate, arg);
 1744         if (error != 0)
 1745                 return error;
 1746 
 1747         if (nstate == IEEE80211_S_RUN && vap->iv_state != IEEE80211_S_RUN) {
 1748                 struct ieee80211_node *ni = vap->iv_bss;
 1749                 enum ieee80211_phymode mode = ieee80211_chan2mode(ni->ni_chan);
 1750                 const struct ieee80211_txparam *tp = &vap->iv_txparms[mode];
 1751 
 1752                 DPRINTF(sc, MALO_DEBUG_STATE,
 1753                     "%s: %s(RUN): iv_flags 0x%08x bintvl %d bssid %s "
 1754                     "capinfo 0x%04x chan %d associd 0x%x mode %d rate %d\n",
 1755                     vap->iv_ifp->if_xname, __func__, vap->iv_flags,
 1756                     ni->ni_intval, ether_sprintf(ni->ni_bssid), ni->ni_capinfo,
 1757                     ieee80211_chan2ieee(ic, ic->ic_curchan),
 1758                     ni->ni_associd, mode, tp->ucastrate);
 1759 
 1760                 malo_hal_setradio(mh, 1,
 1761                     (ic->ic_flags & IEEE80211_F_SHPREAMBLE) ?
 1762                         MHP_SHORT_PREAMBLE : MHP_LONG_PREAMBLE);
 1763                 malo_hal_setassocid(sc->malo_mh, ni->ni_bssid, ni->ni_associd);
 1764                 malo_hal_set_rate(mh, mode, 
 1765                    tp->ucastrate == IEEE80211_FIXED_RATE_NONE ?
 1766                        0 : malo_fix2rate(tp->ucastrate));
 1767         }
 1768         return 0;
 1769 }
 1770 
 1771 static int
 1772 malo_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 1773         const struct ieee80211_bpf_params *params)
 1774 {
 1775         struct ieee80211com *ic = ni->ni_ic;
 1776         struct malo_softc *sc = ic->ic_softc;
 1777         struct malo_txbuf *bf;
 1778         struct malo_txq *txq;
 1779 
 1780         if (!sc->malo_running || sc->malo_invalid) {
 1781                 m_freem(m);
 1782                 return ENETDOWN;
 1783         }
 1784 
 1785         /*
 1786          * Grab a TX buffer and associated resources.  Note that we depend
 1787          * on the classification by the 802.11 layer to get to the right h/w
 1788          * queue.  Management frames must ALWAYS go on queue 1 but we
 1789          * cannot just force that here because we may receive non-mgt frames.
 1790          */
 1791         txq = &sc->malo_txq[0];
 1792         bf = malo_getbuf(sc, txq);
 1793         if (bf == NULL) {
 1794                 m_freem(m);
 1795                 return ENOBUFS;
 1796         }
 1797 
 1798         /*
 1799          * Pass the frame to the h/w for transmission.
 1800          */
 1801         if (malo_tx_start(sc, ni, bf, m) != 0) {
 1802                 bf->bf_m = NULL;
 1803                 bf->bf_node = NULL;
 1804                 MALO_TXQ_LOCK(txq);
 1805                 STAILQ_INSERT_HEAD(&txq->free, bf, bf_list);
 1806                 txq->nfree++;
 1807                 MALO_TXQ_UNLOCK(txq);
 1808 
 1809                 return EIO;             /* XXX */
 1810         }
 1811 
 1812         /*
 1813          * NB: We don't need to lock against tx done because this just
 1814          * prods the firmware to check the transmit descriptors.  The firmware
 1815          * will also start fetching descriptors by itself if it notices
 1816          * new ones are present when it goes to deliver a tx done interrupt
 1817          * to the host. So if we race with tx done processing it's ok.
 1818          * Delivering the kick here rather than in malo_tx_start is
 1819          * an optimization to avoid poking the firmware for each packet.
 1820          *
 1821          * NB: the queue id isn't used so 0 is ok.
 1822          */
 1823         malo_hal_txstart(sc->malo_mh, 0/*XXX*/);
 1824 
 1825         return 0;
 1826 }
 1827 
 1828 static void
 1829 malo_sysctlattach(struct malo_softc *sc)
 1830 {
 1831 #ifdef  MALO_DEBUG
 1832         struct sysctl_ctx_list *ctx = device_get_sysctl_ctx(sc->malo_dev);
 1833         struct sysctl_oid *tree = device_get_sysctl_tree(sc->malo_dev);
 1834 
 1835         sc->malo_debug = malo_debug;
 1836         SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
 1837                 "debug", CTLFLAG_RW, &sc->malo_debug, 0,
 1838                 "control debugging printfs");
 1839 #endif
 1840 }
 1841 
 1842 static void
 1843 malo_announce(struct malo_softc *sc)
 1844 {
 1845 
 1846         device_printf(sc->malo_dev,
 1847                 "versions [hw %d fw %d.%d.%d.%d] (regioncode %d)\n",
 1848                 sc->malo_hwspecs.hwversion,
 1849                 (sc->malo_hwspecs.fw_releasenum >> 24) & 0xff,
 1850                 (sc->malo_hwspecs.fw_releasenum >> 16) & 0xff,
 1851                 (sc->malo_hwspecs.fw_releasenum >> 8) & 0xff,
 1852                 (sc->malo_hwspecs.fw_releasenum >> 0) & 0xff,
 1853                 sc->malo_hwspecs.regioncode);
 1854 
 1855         if (bootverbose || malo_rxbuf != MALO_RXBUF)
 1856                 device_printf(sc->malo_dev,
 1857                     "using %u rx buffers\n", malo_rxbuf);
 1858         if (bootverbose || malo_txbuf != MALO_TXBUF)
 1859                 device_printf(sc->malo_dev,
 1860                     "using %u tx buffers\n", malo_txbuf);
 1861 }
 1862 
 1863 /*
 1864  * Convert net80211 channel to a HAL channel.
 1865  */
 1866 static void
 1867 malo_mapchan(struct malo_hal_channel *hc, const struct ieee80211_channel *chan)
 1868 {
 1869         hc->channel = chan->ic_ieee;
 1870 
 1871         *(uint32_t *)&hc->flags = 0;
 1872         if (IEEE80211_IS_CHAN_2GHZ(chan))
 1873                 hc->flags.freqband = MALO_FREQ_BAND_2DOT4GHZ;
 1874 }
 1875 
 1876 /*
 1877  * Set/change channels.  If the channel is really being changed,
 1878  * it's done by reseting the chip.  To accomplish this we must
 1879  * first cleanup any pending DMA, then restart stuff after a la
 1880  * malo_init.
 1881  */
 1882 static int
 1883 malo_chan_set(struct malo_softc *sc, struct ieee80211_channel *chan)
 1884 {
 1885         struct malo_hal *mh = sc->malo_mh;
 1886         struct malo_hal_channel hchan;
 1887 
 1888         DPRINTF(sc, MALO_DEBUG_RESET, "%s: chan %u MHz/flags 0x%x\n",
 1889             __func__, chan->ic_freq, chan->ic_flags);
 1890 
 1891         /*
 1892          * Convert to a HAL channel description with the flags constrained
 1893          * to reflect the current operating mode.
 1894          */
 1895         malo_mapchan(&hchan, chan);
 1896         malo_hal_intrset(mh, 0);                /* disable interrupts */
 1897         malo_hal_setchannel(mh, &hchan);
 1898         malo_hal_settxpower(mh, &hchan);
 1899 
 1900         /*
 1901          * Update internal state.
 1902          */
 1903         sc->malo_tx_th.wt_chan_freq = htole16(chan->ic_freq);
 1904         sc->malo_rx_th.wr_chan_freq = htole16(chan->ic_freq);
 1905         if (IEEE80211_IS_CHAN_ANYG(chan)) {
 1906                 sc->malo_tx_th.wt_chan_flags = htole16(IEEE80211_CHAN_G);
 1907                 sc->malo_rx_th.wr_chan_flags = htole16(IEEE80211_CHAN_G);
 1908         } else {
 1909                 sc->malo_tx_th.wt_chan_flags = htole16(IEEE80211_CHAN_B);
 1910                 sc->malo_rx_th.wr_chan_flags = htole16(IEEE80211_CHAN_B);
 1911         }
 1912         sc->malo_curchan = hchan;
 1913         malo_hal_intrset(mh, sc->malo_imask);
 1914 
 1915         return 0;
 1916 }
 1917 
 1918 static void
 1919 malo_scan_start(struct ieee80211com *ic)
 1920 {
 1921         struct malo_softc *sc = ic->ic_softc;
 1922 
 1923         DPRINTF(sc, MALO_DEBUG_STATE, "%s\n", __func__);
 1924 }
 1925 
 1926 static void
 1927 malo_scan_end(struct ieee80211com *ic)
 1928 {
 1929         struct malo_softc *sc = ic->ic_softc;
 1930 
 1931         DPRINTF(sc, MALO_DEBUG_STATE, "%s\n", __func__);
 1932 }
 1933 
 1934 static void
 1935 malo_set_channel(struct ieee80211com *ic)
 1936 {
 1937         struct malo_softc *sc = ic->ic_softc;
 1938 
 1939         (void) malo_chan_set(sc, ic->ic_curchan);
 1940 }
 1941 
 1942 static void
 1943 malo_rx_proc(void *arg, int npending)
 1944 {
 1945         struct malo_softc *sc = arg;
 1946         struct ieee80211com *ic = &sc->malo_ic;
 1947         struct malo_rxbuf *bf;
 1948         struct malo_rxdesc *ds;
 1949         struct mbuf *m, *mnew;
 1950         struct ieee80211_qosframe *wh;
 1951         struct ieee80211_node *ni;
 1952         int off, len, hdrlen, pktlen, rssi, ntodo;
 1953         uint8_t *data, status;
 1954         uint32_t readptr, writeptr;
 1955 
 1956         DPRINTF(sc, MALO_DEBUG_RX_PROC,
 1957             "%s: pending %u rdptr(0x%x) 0x%x wrptr(0x%x) 0x%x\n",
 1958             __func__, npending,
 1959             sc->malo_hwspecs.rxdesc_read,
 1960             malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_read),
 1961             sc->malo_hwspecs.rxdesc_write,
 1962             malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_write));
 1963 
 1964         readptr = malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_read);
 1965         writeptr = malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_write);
 1966         if (readptr == writeptr)
 1967                 return;
 1968 
 1969         bf = sc->malo_rxnext;
 1970         for (ntodo = malo_rxquota; ntodo > 0 && readptr != writeptr; ntodo--) {
 1971                 if (bf == NULL) {
 1972                         bf = STAILQ_FIRST(&sc->malo_rxbuf);
 1973                         break;
 1974                 }
 1975                 ds = bf->bf_desc;
 1976                 if (bf->bf_m == NULL) {
 1977                         /*
 1978                          * If data allocation failed previously there
 1979                          * will be no buffer; try again to re-populate it.
 1980                          * Note the firmware will not advance to the next
 1981                          * descriptor with a dma buffer so we must mimic
 1982                          * this or we'll get out of sync.
 1983                          */ 
 1984                         DPRINTF(sc, MALO_DEBUG_ANY,
 1985                             "%s: rx buf w/o dma memory\n", __func__);
 1986                         (void)malo_rxbuf_init(sc, bf);
 1987                         break;
 1988                 }
 1989                 MALO_RXDESC_SYNC(sc, ds,
 1990                     BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
 1991                 if (ds->rxcontrol != MALO_RXD_CTRL_DMA_OWN)
 1992                         break;
 1993 
 1994                 readptr = le32toh(ds->physnext);
 1995 
 1996 #ifdef MALO_DEBUG
 1997                 if (sc->malo_debug & MALO_DEBUG_RECV_DESC)
 1998                         malo_printrxbuf(bf, 0);
 1999 #endif
 2000                 status = ds->status;
 2001                 if (status & MALO_RXD_STATUS_DECRYPT_ERR_MASK) {
 2002                         counter_u64_add(ic->ic_ierrors, 1);
 2003                         goto rx_next;
 2004                 }
 2005                 /*
 2006                  * Sync the data buffer.
 2007                  */
 2008                 len = le16toh(ds->pktlen);
 2009                 bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap,
 2010                     BUS_DMASYNC_POSTREAD);
 2011                 /*
 2012                  * The 802.11 header is provided all or in part at the front;
 2013                  * use it to calculate the true size of the header that we'll
 2014                  * construct below.  We use this to figure out where to copy
 2015                  * payload prior to constructing the header.
 2016                  */
 2017                 m = bf->bf_m;
 2018                 data = mtod(m, uint8_t *);
 2019                 hdrlen = ieee80211_anyhdrsize(data + sizeof(uint16_t));
 2020                 off = sizeof(uint16_t) + sizeof(struct ieee80211_frame_addr4);
 2021 
 2022                 /*
 2023                  * Calculate RSSI. XXX wrong
 2024                  */
 2025                 rssi = 2 * ((int) ds->snr - ds->nf);    /* NB: .5 dBm  */
 2026                 if (rssi > 100)
 2027                         rssi = 100;
 2028 
 2029                 pktlen = hdrlen + (len - off);
 2030                 /*
 2031                  * NB: we know our frame is at least as large as
 2032                  * IEEE80211_MIN_LEN because there is a 4-address frame at
 2033                  * the front.  Hence there's no need to vet the packet length.
 2034                  * If the frame in fact is too small it should be discarded
 2035                  * at the net80211 layer.
 2036                  */
 2037 
 2038                 /* XXX don't need mbuf, just dma buffer */
 2039                 mnew = malo_getrxmbuf(sc, bf);
 2040                 if (mnew == NULL) {
 2041                         counter_u64_add(ic->ic_ierrors, 1);
 2042                         goto rx_next;
 2043                 }
 2044                 /*
 2045                  * Attach the dma buffer to the mbuf; malo_rxbuf_init will
 2046                  * re-setup the rx descriptor using the replacement dma
 2047                  * buffer we just installed above.
 2048                  */
 2049                 bf->bf_m = mnew;
 2050                 m->m_data += off - hdrlen;
 2051                 m->m_pkthdr.len = m->m_len = pktlen;
 2052 
 2053                 /*
 2054                  * Piece 802.11 header together.
 2055                  */
 2056                 wh = mtod(m, struct ieee80211_qosframe *);
 2057                 /* NB: don't need to do this sometimes but ... */
 2058                 /* XXX special case so we can memcpy after m_devget? */
 2059                 ovbcopy(data + sizeof(uint16_t), wh, hdrlen);
 2060                 if (IEEE80211_QOS_HAS_SEQ(wh))
 2061                         *(uint16_t *)ieee80211_getqos(wh) = ds->qosctrl;
 2062                 if (ieee80211_radiotap_active(ic)) {
 2063                         sc->malo_rx_th.wr_flags = 0;
 2064                         sc->malo_rx_th.wr_rate = ds->rate;
 2065                         sc->malo_rx_th.wr_antsignal = rssi;
 2066                         sc->malo_rx_th.wr_antnoise = ds->nf;
 2067                 }
 2068 #ifdef MALO_DEBUG
 2069                 if (IFF_DUMPPKTS_RECV(sc, wh)) {
 2070                         ieee80211_dump_pkt(ic, mtod(m, caddr_t),
 2071                             len, ds->rate, rssi);
 2072                 }
 2073 #endif
 2074                 /* dispatch */
 2075                 ni = ieee80211_find_rxnode(ic,
 2076                     (struct ieee80211_frame_min *)wh);
 2077                 if (ni != NULL) {
 2078                         (void) ieee80211_input(ni, m, rssi, ds->nf);
 2079                         ieee80211_free_node(ni);
 2080                 } else
 2081                         (void) ieee80211_input_all(ic, m, rssi, ds->nf);
 2082 rx_next:
 2083                 /* NB: ignore ENOMEM so we process more descriptors */
 2084                 (void) malo_rxbuf_init(sc, bf);
 2085                 bf = STAILQ_NEXT(bf, bf_list);
 2086         }
 2087         
 2088         malo_bar0_write4(sc, sc->malo_hwspecs.rxdesc_read, readptr);
 2089         sc->malo_rxnext = bf;
 2090 
 2091         if (mbufq_first(&sc->malo_snd) != NULL)
 2092                 malo_start(sc);
 2093 }
 2094 
 2095 /*
 2096  * Reclaim all tx queue resources.
 2097  */
 2098 static void
 2099 malo_tx_cleanup(struct malo_softc *sc)
 2100 {
 2101         int i;
 2102 
 2103         for (i = 0; i < MALO_NUM_TX_QUEUES; i++)
 2104                 malo_tx_cleanupq(sc, &sc->malo_txq[i]);
 2105 }
 2106 
 2107 int
 2108 malo_detach(struct malo_softc *sc)
 2109 {
 2110         struct ieee80211com *ic = &sc->malo_ic;
 2111 
 2112         malo_stop(sc);
 2113 
 2114         if (sc->malo_tq != NULL) {
 2115                 taskqueue_drain(sc->malo_tq, &sc->malo_rxtask);
 2116                 taskqueue_drain(sc->malo_tq, &sc->malo_txtask);
 2117                 taskqueue_free(sc->malo_tq);
 2118                 sc->malo_tq = NULL;
 2119         }
 2120 
 2121         /*
 2122          * NB: the order of these is important:
 2123          * o call the 802.11 layer before detaching the hal to
 2124          *   insure callbacks into the driver to delete global
 2125          *   key cache entries can be handled
 2126          * o reclaim the tx queue data structures after calling
 2127          *   the 802.11 layer as we'll get called back to reclaim
 2128          *   node state and potentially want to use them
 2129          * o to cleanup the tx queues the hal is called, so detach
 2130          *   it last
 2131          * Other than that, it's straightforward...
 2132          */
 2133         ieee80211_ifdetach(ic);
 2134         callout_drain(&sc->malo_watchdog_timer);
 2135         malo_dma_cleanup(sc);
 2136         malo_tx_cleanup(sc);
 2137         malo_hal_detach(sc->malo_mh);
 2138         mbufq_drain(&sc->malo_snd);
 2139         MALO_LOCK_DESTROY(sc);
 2140 
 2141         return 0;
 2142 }
 2143 
 2144 void
 2145 malo_shutdown(struct malo_softc *sc)
 2146 {
 2147 
 2148         malo_stop(sc);
 2149 }
 2150 
 2151 void
 2152 malo_suspend(struct malo_softc *sc)
 2153 {
 2154 
 2155         malo_stop(sc);
 2156 }
 2157 
 2158 void
 2159 malo_resume(struct malo_softc *sc)
 2160 {
 2161 
 2162         if (sc->malo_ic.ic_nrunning > 0)
 2163                 malo_init(sc);
 2164 }

Cache object: 3a2367eac0073da19c5f0420023ea99b


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.