The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/dev/malo/if_malo.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (c) 2008 Weongyo Jeong <weongyo@freebsd.org>
    3  * Copyright (c) 2007 Marvell Semiconductor, Inc.
    4  * Copyright (c) 2007 Sam Leffler, Errno Consulting
    5  * All rights reserved.
    6  *
    7  * Redistribution and use in source and binary forms, with or without
    8  * modification, are permitted provided that the following conditions
    9  * are met:
   10  * 1. Redistributions of source code must retain the above copyright
   11  *    notice, this list of conditions and the following disclaimer,
   12  *    without modification.
   13  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
   14  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
   15  *    redistribution must be conditioned upon including a substantially
   16  *    similar Disclaimer requirement for further binary redistribution.
   17  *
   18  * NO WARRANTY
   19  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
   20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
   21  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
   22  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
   23  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
   24  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
   25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
   26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
   27  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
   28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
   29  * THE POSSIBILITY OF SUCH DAMAGES.
   30  */
   31 
   32 #include <sys/cdefs.h>
   33 #ifdef __FreeBSD__
   34 __FBSDID("$FreeBSD: releng/7.4/sys/dev/malo/if_malo.c 215368 2010-11-16 04:40:03Z sobomax $");
   35 #endif
   36 
   37 #include <sys/param.h>
   38 #include <sys/endian.h>
   39 #include <sys/kernel.h>
   40 #include <sys/socket.h>
   41 #include <sys/sockio.h>
   42 #include <sys/sysctl.h>
   43 #include <sys/taskqueue.h>
   44 
   45 #include <machine/bus.h>
   46 #include <sys/bus.h>
   47 
   48 #include <net/if.h>
   49 #include <net/if_dl.h>
   50 #include <net/if_media.h>
   51 #include <net/if_types.h>
   52 #include <net/ethernet.h>
   53 
   54 #include <net80211/ieee80211_var.h>
   55 #include <net80211/ieee80211_regdomain.h>
   56 
   57 #include <net/bpf.h>
   58 
   59 #include <dev/malo/if_malo.h>
   60 
   61 SYSCTL_NODE(_hw, OID_AUTO, malo, CTLFLAG_RD, 0,
   62     "Marvell 88w8335 driver parameters");
   63 
   64 static  int malo_txcoalesce = 8;        /* # tx pkts to q before poking f/w*/
   65 SYSCTL_INT(_hw_malo, OID_AUTO, txcoalesce, CTLFLAG_RW, &malo_txcoalesce,
   66             0, "tx buffers to send at once");
   67 TUNABLE_INT("hw.malo.txcoalesce", &malo_txcoalesce);
   68 static  int malo_rxbuf = MALO_RXBUF;            /* # rx buffers to allocate */
   69 SYSCTL_INT(_hw_malo, OID_AUTO, rxbuf, CTLFLAG_RW, &malo_rxbuf,
   70             0, "rx buffers allocated");
   71 TUNABLE_INT("hw.malo.rxbuf", &malo_rxbuf);
   72 static  int malo_rxquota = MALO_RXBUF;          /* # max buffers to process */
   73 SYSCTL_INT(_hw_malo, OID_AUTO, rxquota, CTLFLAG_RW, &malo_rxquota,
   74             0, "max rx buffers to process per interrupt");
   75 TUNABLE_INT("hw.malo.rxquota", &malo_rxquota);
   76 static  int malo_txbuf = MALO_TXBUF;            /* # tx buffers to allocate */
   77 SYSCTL_INT(_hw_malo, OID_AUTO, txbuf, CTLFLAG_RW, &malo_txbuf,
   78             0, "tx buffers allocated");
   79 TUNABLE_INT("hw.malo.txbuf", &malo_txbuf);
   80 
   81 #ifdef MALO_DEBUG
   82 static  int malo_debug = 0;
   83 SYSCTL_INT(_hw_malo, OID_AUTO, debug, CTLFLAG_RW, &malo_debug,
   84             0, "control debugging printfs");
   85 TUNABLE_INT("hw.malo.debug", &malo_debug);
   86 enum {
   87         MALO_DEBUG_XMIT         = 0x00000001,   /* basic xmit operation */
   88         MALO_DEBUG_XMIT_DESC    = 0x00000002,   /* xmit descriptors */
   89         MALO_DEBUG_RECV         = 0x00000004,   /* basic recv operation */
   90         MALO_DEBUG_RECV_DESC    = 0x00000008,   /* recv descriptors */
   91         MALO_DEBUG_RESET        = 0x00000010,   /* reset processing */
   92         MALO_DEBUG_INTR         = 0x00000040,   /* ISR */
   93         MALO_DEBUG_TX_PROC      = 0x00000080,   /* tx ISR proc */
   94         MALO_DEBUG_RX_PROC      = 0x00000100,   /* rx ISR proc */
   95         MALO_DEBUG_STATE        = 0x00000400,   /* 802.11 state transitions */
   96         MALO_DEBUG_NODE         = 0x00000800,   /* node management */
   97         MALO_DEBUG_RECV_ALL     = 0x00001000,   /* trace all frames (beacons) */
   98         MALO_DEBUG_FW           = 0x00008000,   /* firmware */
   99         MALO_DEBUG_ANY          = 0xffffffff
  100 };
  101 #define IS_BEACON(wh)                                                   \
  102         ((wh->i_fc[0] & (IEEE80211_FC0_TYPE_MASK |                      \
  103                 IEEE80211_FC0_SUBTYPE_MASK)) ==                         \
  104          (IEEE80211_FC0_TYPE_MGT|IEEE80211_FC0_SUBTYPE_BEACON))
  105 #define IFF_DUMPPKTS_RECV(sc, wh)                                       \
  106         (((sc->malo_debug & MALO_DEBUG_RECV) &&                         \
  107           ((sc->malo_debug & MALO_DEBUG_RECV_ALL) || !IS_BEACON(wh))) || \
  108          (sc->malo_ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==            \
  109           (IFF_DEBUG|IFF_LINK2))
  110 #define IFF_DUMPPKTS_XMIT(sc)                                           \
  111         ((sc->malo_debug & MALO_DEBUG_XMIT) ||                          \
  112          (sc->malo_ifp->if_flags & (IFF_DEBUG | IFF_LINK2)) ==          \
  113              (IFF_DEBUG | IFF_LINK2))
  114 #define DPRINTF(sc, m, fmt, ...) do {                           \
  115         if (sc->malo_debug & (m))                               \
  116                 printf(fmt, __VA_ARGS__);                       \
  117 } while (0)
  118 #else
  119 #define DPRINTF(sc, m, fmt, ...) do {                           \
  120         (void) sc;                                              \
  121 } while (0)
  122 #endif
  123 
  124 MALLOC_DEFINE(M_MALODEV, "malodev", "malo driver dma buffers");
  125 
  126 static  int     malo_dma_setup(struct malo_softc *);
  127 static  int     malo_setup_hwdma(struct malo_softc *);
  128 static  void    malo_txq_init(struct malo_softc *, struct malo_txq *, int);
  129 static  void    malo_tx_cleanupq(struct malo_softc *, struct malo_txq *);
  130 static  void    malo_start(struct ifnet *);
  131 static  void    malo_watchdog(struct ifnet *);
  132 static  int     malo_ioctl(struct ifnet *, u_long, caddr_t);
  133 static  void    malo_updateslot(struct ifnet *);
  134 static  int     malo_newstate(struct ieee80211com *, enum ieee80211_state, int);
  135 static  void    malo_scan_start(struct ieee80211com *);
  136 static  void    malo_scan_end(struct ieee80211com *);
  137 static  void    malo_set_channel(struct ieee80211com *);
  138 static  int     malo_raw_xmit(struct ieee80211_node *, struct mbuf *,
  139                     const struct ieee80211_bpf_params *);
  140 static  int     malo_media_change(struct ifnet *);
  141 static  void    malo_bpfattach(struct malo_softc *);
  142 static  void    malo_sysctlattach(struct malo_softc *);
  143 static  void    malo_announce(struct malo_softc *);
  144 static  void    malo_dma_cleanup(struct malo_softc *);
  145 static  void    malo_stop_locked(struct ifnet *, int);
  146 static  int     malo_chan_set(struct malo_softc *, struct ieee80211_channel *);
  147 static  int     malo_mode_init(struct malo_softc *);
  148 static  void    malo_tx_proc(void *, int);
  149 static  void    malo_rx_proc(void *, int);
  150 static  void    malo_init(void *);
  151 
  152 /*
  153  * Read/Write shorthands for accesses to BAR 0.  Note that all BAR 1
  154  * operations are done in the "hal" except getting H/W MAC address at
  155  * malo_attach and there should be no reference to them here.
  156  */
  157 static uint32_t
  158 malo_bar0_read4(struct malo_softc *sc, bus_size_t off)
  159 {
  160         return bus_space_read_4(sc->malo_io0t, sc->malo_io0h, off);
  161 }
  162 
  163 static void
  164 malo_bar0_write4(struct malo_softc *sc, bus_size_t off, uint32_t val)
  165 {
  166         DPRINTF(sc, MALO_DEBUG_FW, "%s: off 0x%x val 0x%x\n",
  167             __func__, off, val);
  168 
  169         bus_space_write_4(sc->malo_io0t, sc->malo_io0h, off, val);
  170 }
  171 
  172 static uint8_t
  173 malo_bar1_read1(struct malo_softc *sc, bus_size_t off)
  174 {
  175         return bus_space_read_1(sc->malo_io1t, sc->malo_io1h, off);
  176 }
  177 
  178 int
  179 malo_attach(uint16_t devid, struct malo_softc *sc)
  180 {
  181         int error, i;
  182         struct ieee80211com *ic = &sc->malo_ic;
  183         struct ifnet *ifp;
  184         struct malo_hal *mh;
  185         uint8_t bands;
  186 
  187         ifp = sc->malo_ifp = if_alloc(IFT_ETHER);
  188         if (ifp == NULL) {
  189                 device_printf(sc->malo_dev, "can not if_alloc()\n");
  190                 return ENOSPC;
  191         }
  192 
  193         MALO_LOCK_INIT(sc);
  194 
  195         /* set these up early for if_printf use */
  196         if_initname(ifp, device_get_name(sc->malo_dev),
  197             device_get_unit(sc->malo_dev));
  198 
  199         /*
  200          * NB: get mac address from hardware directly here before we set DMAs
  201          * for HAL because we don't want to disturb operations of HAL at BAR 1.
  202          */
  203         for (i = 0; i < IEEE80211_ADDR_LEN; i++) {
  204                 /* XXX remove a magic number but we don't have documents.  */
  205                 ic->ic_myaddr[i] = malo_bar1_read1(sc, 0xa528 + i);
  206                 DELAY(1000);
  207         }
  208 
  209         mh = malo_hal_attach(sc->malo_dev, devid,
  210             sc->malo_io1h, sc->malo_io1t, sc->malo_dmat);
  211         if (mh == NULL) {
  212                 if_printf(ifp, "unable to attach HAL\n");
  213                 error = EIO;
  214                 goto bad;
  215         }
  216         sc->malo_mh = mh;
  217 
  218         sc->malo_txantenna = 0x2;       /* h/w default */
  219         sc->malo_rxantenna = 0xffff;    /* h/w default */
  220 
  221         /*
  222          * Allocate tx + rx descriptors and populate the lists.
  223          * We immediately push the information to the firmware
  224          * as otherwise it gets upset.
  225          */
  226         error = malo_dma_setup(sc);
  227         if (error != 0) {
  228                 if_printf(ifp, "failed to setup descriptors: %d\n", error);
  229                 goto bad1;
  230         }
  231 
  232         sc->malo_tq = taskqueue_create_fast("malo_taskq", M_NOWAIT,
  233                 taskqueue_thread_enqueue, &sc->malo_tq);
  234         taskqueue_start_threads(&sc->malo_tq, 1, PI_NET,
  235                 "%s taskq", ifp->if_xname);
  236 
  237         TASK_INIT(&sc->malo_rxtask, 0, malo_rx_proc, sc);
  238         TASK_INIT(&sc->malo_txtask, 0, malo_tx_proc, sc);
  239 
  240         ifp->if_softc = sc;
  241         ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST;
  242         ifp->if_start = malo_start;
  243         ifp->if_watchdog = malo_watchdog;
  244         ifp->if_ioctl = malo_ioctl;
  245         ifp->if_init = malo_init;
  246         IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
  247         ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
  248         IFQ_SET_READY(&ifp->if_snd);
  249 
  250         /* NB: firmware looks that it does not export regdomain info API.  */
  251         bands = 0;
  252         setbit(&bands, IEEE80211_MODE_11B);
  253         setbit(&bands, IEEE80211_MODE_11G);
  254         ieee80211_init_channels(ic, 0, CTRY_DEFAULT, bands, 0, 1);
  255 
  256         ic->ic_ifp = ifp;
  257         /* XXX not right but it's not used anywhere important */
  258         ic->ic_phytype = IEEE80211_T_OFDM;
  259         ic->ic_opmode = IEEE80211_M_STA;
  260         ic->ic_caps =
  261               IEEE80211_C_BGSCAN                /* capable of bg scanning */
  262             | IEEE80211_C_MONITOR               /* monitor mode */
  263             | IEEE80211_C_SHPREAMBLE            /* short preamble supported */
  264             | IEEE80211_C_SHSLOT                /* short slot time supported */
  265             | IEEE80211_C_TXPMGT                /* capable of txpow mgt */
  266             | IEEE80211_C_WPA                   /* capable of WPA1+WPA2 */
  267             ;
  268 
  269         /*
  270          * Transmit requires space in the packet for a special format transmit
  271          * record and optional padding between this record and the payload.
  272          * Ask the net80211 layer to arrange this when encapsulating
  273          * packets so we can add it efficiently. 
  274          */
  275         ic->ic_headroom = sizeof(struct malo_txrec) -
  276             sizeof(struct ieee80211_frame);
  277 
  278         /* call MI attach routine. */
  279         ieee80211_ifattach(ic);
  280         /* override default methods */
  281         ic->ic_updateslot = malo_updateslot;
  282         ic->ic_raw_xmit = malo_raw_xmit;
  283 
  284         sc->malo_newstate = ic->ic_newstate;
  285         ic->ic_newstate = malo_newstate;
  286 
  287         ic->ic_scan_start = malo_scan_start;
  288         ic->ic_scan_end = malo_scan_end;
  289         ic->ic_set_channel = malo_set_channel;
  290 
  291         /* complete initialization */
  292         ieee80211_media_init(ic, malo_media_change, ieee80211_media_status);
  293 
  294         sc->malo_invalid = 0;           /* ready to go, enable int handling */
  295 
  296         malo_bpfattach(sc);
  297 
  298         /*
  299          * Setup dynamic sysctl's.
  300          */
  301         malo_sysctlattach(sc);
  302 
  303         if (bootverbose)
  304                 ieee80211_announce(ic);
  305 
  306         return 0;
  307 bad1:
  308         malo_hal_detach(mh);
  309 bad:
  310         if_free(ifp);
  311         sc->malo_invalid = 1;
  312 
  313         return error;
  314 }
  315 
  316 int
  317 malo_intr(void *arg)
  318 {
  319         struct malo_softc *sc = arg;
  320         struct malo_hal *mh = sc->malo_mh;
  321         uint32_t status;
  322 
  323         if (sc->malo_invalid) {
  324                 /*
  325                  * The hardware is not ready/present, don't touch anything.
  326                  * Note this can happen early on if the IRQ is shared.
  327                  */
  328                 DPRINTF(sc, MALO_DEBUG_ANY, "%s: invalid; ignored\n", __func__);
  329                 return (FILTER_STRAY);
  330         }
  331 
  332         /*
  333          * Figure out the reason(s) for the interrupt.
  334          */
  335         malo_hal_getisr(mh, &status);           /* NB: clears ISR too */
  336         if (status == 0)                        /* must be a shared irq */
  337                 return (FILTER_STRAY);
  338 
  339         DPRINTF(sc, MALO_DEBUG_INTR, "%s: status 0x%x imask 0x%x\n",
  340             __func__, status, sc->malo_imask);
  341 
  342         if (status & MALO_A2HRIC_BIT_RX_RDY)
  343                 taskqueue_enqueue_fast(sc->malo_tq, &sc->malo_rxtask);
  344         if (status & MALO_A2HRIC_BIT_TX_DONE)
  345                 taskqueue_enqueue_fast(sc->malo_tq, &sc->malo_txtask);
  346         if (status & MALO_A2HRIC_BIT_OPC_DONE)
  347                 malo_hal_cmddone(mh);
  348         if (status & MALO_A2HRIC_BIT_MAC_EVENT)
  349                 ;
  350         if (status & MALO_A2HRIC_BIT_RX_PROBLEM)
  351                 ;
  352         if (status & MALO_A2HRIC_BIT_ICV_ERROR) {
  353                 /* TKIP ICV error */
  354                 sc->malo_stats.mst_rx_badtkipicv++;
  355         }
  356 
  357 #ifdef MALO_DEBUG
  358         if (((status | sc->malo_imask) ^ sc->malo_imask) != 0)
  359                 DPRINTF(sc, MALO_DEBUG_INTR,
  360                     "%s: can't handle interrupt status 0x%x\n",
  361                     __func__, status);
  362 #endif
  363 
  364         return (FILTER_HANDLED);
  365 }
  366 
  367 static void
  368 malo_load_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
  369 {
  370         bus_addr_t *paddr = (bus_addr_t*) arg;
  371 
  372         KASSERT(error == 0, ("error %u on bus_dma callback", error));
  373 
  374         *paddr = segs->ds_addr;
  375 }
  376 
  377 static int
  378 malo_desc_setup(struct malo_softc *sc, const char *name,
  379     struct malo_descdma *dd,
  380     int nbuf, size_t bufsize, int ndesc, size_t descsize)
  381 {
  382         int error;
  383         struct ifnet *ifp = sc->malo_ifp;
  384         uint8_t *ds;
  385 
  386         DPRINTF(sc, MALO_DEBUG_RESET,
  387             "%s: %s DMA: %u bufs (%ju) %u desc/buf (%ju)\n",
  388             __func__, name, nbuf, (uintmax_t) bufsize,
  389             ndesc, (uintmax_t) descsize);
  390         
  391         dd->dd_name = name;
  392         dd->dd_desc_len = nbuf * ndesc * descsize;
  393 
  394         /*
  395          * Setup DMA descriptor area.
  396          */
  397         error = bus_dma_tag_create(bus_get_dma_tag(sc->malo_dev),/* parent */
  398                        PAGE_SIZE, 0,            /* alignment, bounds */
  399                        BUS_SPACE_MAXADDR_32BIT, /* lowaddr */
  400                        BUS_SPACE_MAXADDR,       /* highaddr */
  401                        NULL, NULL,              /* filter, filterarg */
  402                        dd->dd_desc_len,         /* maxsize */
  403                        1,                       /* nsegments */
  404                        dd->dd_desc_len,         /* maxsegsize */
  405                        BUS_DMA_ALLOCNOW,        /* flags */
  406                        NULL,                    /* lockfunc */
  407                        NULL,                    /* lockarg */
  408                        &dd->dd_dmat);
  409         if (error != 0) {
  410                 if_printf(ifp, "cannot allocate %s DMA tag\n", dd->dd_name);
  411                 return error;
  412         }
  413         
  414         /* allocate descriptors */
  415         error = bus_dmamap_create(dd->dd_dmat, BUS_DMA_NOWAIT, &dd->dd_dmamap);
  416         if (error != 0) {
  417                 if_printf(ifp, "unable to create dmamap for %s descriptors, "
  418                     "error %u\n", dd->dd_name, error);
  419                 goto fail0;
  420         }
  421         
  422         error = bus_dmamem_alloc(dd->dd_dmat, (void**) &dd->dd_desc,
  423             BUS_DMA_NOWAIT | BUS_DMA_COHERENT, &dd->dd_dmamap);
  424         if (error != 0) {
  425                 if_printf(ifp, "unable to alloc memory for %u %s descriptors, "
  426                     "error %u\n", nbuf * ndesc, dd->dd_name, error);
  427                 goto fail1;
  428         }
  429 
  430         error = bus_dmamap_load(dd->dd_dmat, dd->dd_dmamap,
  431             dd->dd_desc, dd->dd_desc_len,
  432             malo_load_cb, &dd->dd_desc_paddr, BUS_DMA_NOWAIT);
  433         if (error != 0) {
  434                 if_printf(ifp, "unable to map %s descriptors, error %u\n",
  435                     dd->dd_name, error);
  436                 goto fail2;
  437         }
  438         
  439         ds = dd->dd_desc;
  440         memset(ds, 0, dd->dd_desc_len);
  441         DPRINTF(sc, MALO_DEBUG_RESET, "%s: %s DMA map: %p (%lu) -> %p (%lu)\n",
  442             __func__, dd->dd_name, ds, (u_long) dd->dd_desc_len,
  443             (caddr_t) dd->dd_desc_paddr, /*XXX*/ (u_long) dd->dd_desc_len);
  444 
  445         return 0;
  446 fail2:
  447         bus_dmamem_free(dd->dd_dmat, dd->dd_desc, dd->dd_dmamap);
  448 fail1:
  449         bus_dmamap_destroy(dd->dd_dmat, dd->dd_dmamap);
  450 fail0:
  451         bus_dma_tag_destroy(dd->dd_dmat);
  452         memset(dd, 0, sizeof(*dd));
  453         return error;
  454 }
  455 
  456 #define DS2PHYS(_dd, _ds) \
  457         ((_dd)->dd_desc_paddr + ((caddr_t)(_ds) - (caddr_t)(_dd)->dd_desc))
  458 
  459 static int
  460 malo_rxdma_setup(struct malo_softc *sc)
  461 {
  462         struct ifnet *ifp = sc->malo_ifp;
  463         int error, bsize, i;
  464         struct malo_rxbuf *bf;
  465         struct malo_rxdesc *ds;
  466 
  467         error = malo_desc_setup(sc, "rx", &sc->malo_rxdma,
  468             malo_rxbuf, sizeof(struct malo_rxbuf),
  469             1, sizeof(struct malo_rxdesc));
  470         if (error != 0)
  471                 return error;
  472 
  473         /*
  474          * Allocate rx buffers and set them up.
  475          */
  476         bsize = malo_rxbuf * sizeof(struct malo_rxbuf);
  477         bf = malloc(bsize, M_MALODEV, M_NOWAIT | M_ZERO);
  478         if (bf == NULL) {
  479                 if_printf(ifp, "malloc of %u rx buffers failed\n", bsize);
  480                 return error;
  481         }
  482         sc->malo_rxdma.dd_bufptr = bf;
  483         
  484         STAILQ_INIT(&sc->malo_rxbuf);
  485         ds = sc->malo_rxdma.dd_desc;
  486         for (i = 0; i < malo_rxbuf; i++, bf++, ds++) {
  487                 bf->bf_desc = ds;
  488                 bf->bf_daddr = DS2PHYS(&sc->malo_rxdma, ds);
  489                 error = bus_dmamap_create(sc->malo_dmat, BUS_DMA_NOWAIT,
  490                     &bf->bf_dmamap);
  491                 if (error != 0) {
  492                         if_printf(ifp, "%s: unable to dmamap for rx buffer, "
  493                             "error %d\n", __func__, error);
  494                         return error;
  495                 }
  496                 /* NB: tail is intentional to preserve descriptor order */
  497                 STAILQ_INSERT_TAIL(&sc->malo_rxbuf, bf, bf_list);
  498         }
  499         return 0;
  500 }
  501 
  502 static int
  503 malo_txdma_setup(struct malo_softc *sc, struct malo_txq *txq)
  504 {
  505         struct ifnet *ifp = sc->malo_ifp;
  506         int error, bsize, i;
  507         struct malo_txbuf *bf;
  508         struct malo_txdesc *ds;
  509 
  510         error = malo_desc_setup(sc, "tx", &txq->dma,
  511             malo_txbuf, sizeof(struct malo_txbuf),
  512             MALO_TXDESC, sizeof(struct malo_txdesc));
  513         if (error != 0)
  514                 return error;
  515         
  516         /* allocate and setup tx buffers */
  517         bsize = malo_txbuf * sizeof(struct malo_txbuf);
  518         bf = malloc(bsize, M_MALODEV, M_NOWAIT | M_ZERO);
  519         if (bf == NULL) {
  520                 if_printf(ifp, "malloc of %u tx buffers failed\n",
  521                     malo_txbuf);
  522                 return ENOMEM;
  523         }
  524         txq->dma.dd_bufptr = bf;
  525         
  526         STAILQ_INIT(&txq->free);
  527         txq->nfree = 0;
  528         ds = txq->dma.dd_desc;
  529         for (i = 0; i < malo_txbuf; i++, bf++, ds += MALO_TXDESC) {
  530                 bf->bf_desc = ds;
  531                 bf->bf_daddr = DS2PHYS(&txq->dma, ds);
  532                 error = bus_dmamap_create(sc->malo_dmat, BUS_DMA_NOWAIT,
  533                     &bf->bf_dmamap);
  534                 if (error != 0) {
  535                         if_printf(ifp, "unable to create dmamap for tx "
  536                             "buffer %u, error %u\n", i, error);
  537                         return error;
  538                 }
  539                 STAILQ_INSERT_TAIL(&txq->free, bf, bf_list);
  540                 txq->nfree++;
  541         }
  542 
  543         return 0;
  544 }
  545 
  546 static void
  547 malo_desc_cleanup(struct malo_softc *sc, struct malo_descdma *dd)
  548 {
  549         bus_dmamap_unload(dd->dd_dmat, dd->dd_dmamap);
  550         bus_dmamem_free(dd->dd_dmat, dd->dd_desc, dd->dd_dmamap);
  551         bus_dmamap_destroy(dd->dd_dmat, dd->dd_dmamap);
  552         bus_dma_tag_destroy(dd->dd_dmat);
  553 
  554         memset(dd, 0, sizeof(*dd));
  555 }
  556 
  557 static void
  558 malo_rxdma_cleanup(struct malo_softc *sc)
  559 {
  560         struct malo_rxbuf *bf;
  561 
  562         STAILQ_FOREACH(bf, &sc->malo_rxbuf, bf_list) {
  563                 if (bf->bf_m != NULL) {
  564                         m_freem(bf->bf_m);
  565                         bf->bf_m = NULL;
  566                 }
  567                 if (bf->bf_dmamap != NULL) {
  568                         bus_dmamap_destroy(sc->malo_dmat, bf->bf_dmamap);
  569                         bf->bf_dmamap = NULL;
  570                 }
  571         }
  572         STAILQ_INIT(&sc->malo_rxbuf);
  573         if (sc->malo_rxdma.dd_bufptr != NULL) {
  574                 free(sc->malo_rxdma.dd_bufptr, M_MALODEV);
  575                 sc->malo_rxdma.dd_bufptr = NULL;
  576         }
  577         if (sc->malo_rxdma.dd_desc_len != 0)
  578                 malo_desc_cleanup(sc, &sc->malo_rxdma);
  579 }
  580 
  581 static void
  582 malo_txdma_cleanup(struct malo_softc *sc, struct malo_txq *txq)
  583 {
  584         struct malo_txbuf *bf;
  585         struct ieee80211_node *ni;
  586 
  587         STAILQ_FOREACH(bf, &txq->free, bf_list) {
  588                 if (bf->bf_m != NULL) {
  589                         m_freem(bf->bf_m);
  590                         bf->bf_m = NULL;
  591                 }
  592                 ni = bf->bf_node;
  593                 bf->bf_node = NULL;
  594                 if (ni != NULL) {
  595                         /*
  596                          * Reclaim node reference.
  597                          */
  598                         ieee80211_free_node(ni);
  599                 }
  600                 if (bf->bf_dmamap != NULL) {
  601                         bus_dmamap_destroy(sc->malo_dmat, bf->bf_dmamap);
  602                         bf->bf_dmamap = NULL;
  603                 }
  604         }
  605         STAILQ_INIT(&txq->free);
  606         txq->nfree = 0;
  607         if (txq->dma.dd_bufptr != NULL) {
  608                 free(txq->dma.dd_bufptr, M_MALODEV);
  609                 txq->dma.dd_bufptr = NULL;
  610         }
  611         if (txq->dma.dd_desc_len != 0)
  612                 malo_desc_cleanup(sc, &txq->dma);
  613 }
  614 
  615 static void
  616 malo_dma_cleanup(struct malo_softc *sc)
  617 {
  618         int i;
  619 
  620         for (i = 0; i < MALO_NUM_TX_QUEUES; i++)
  621                 malo_txdma_cleanup(sc, &sc->malo_txq[i]);
  622 
  623         malo_rxdma_cleanup(sc);
  624 }
  625 
  626 static int
  627 malo_dma_setup(struct malo_softc *sc)
  628 {
  629         int error, i;
  630 
  631         /* rxdma initializing.  */
  632         error = malo_rxdma_setup(sc);
  633         if (error != 0)
  634                 return error;
  635 
  636         /* NB: we just have 1 tx queue now.  */
  637         for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
  638                 error = malo_txdma_setup(sc, &sc->malo_txq[i]);
  639                 if (error != 0) {
  640                         malo_dma_cleanup(sc);
  641 
  642                         return error;
  643                 }
  644 
  645                 malo_txq_init(sc, &sc->malo_txq[i], i);
  646         }
  647 
  648         return 0;
  649 }
  650 
  651 static void
  652 malo_hal_set_rxtxdma(struct malo_softc *sc)
  653 {
  654         int i;
  655 
  656         malo_bar0_write4(sc, sc->malo_hwspecs.rxdesc_read,
  657             sc->malo_hwdma.rxdesc_read);
  658         malo_bar0_write4(sc, sc->malo_hwspecs.rxdesc_write,
  659             sc->malo_hwdma.rxdesc_read);
  660 
  661         for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
  662                 malo_bar0_write4(sc,
  663                     sc->malo_hwspecs.wcbbase[i], sc->malo_hwdma.wcbbase[i]);
  664         }
  665 }
  666 
  667 /*
  668  * Inform firmware of our tx/rx dma setup.  The BAR 0 writes below are
  669  * for compatibility with older firmware.  For current firmware we send
  670  * this information with a cmd block via malo_hal_sethwdma.
  671  */
  672 static int
  673 malo_setup_hwdma(struct malo_softc *sc)
  674 {
  675         int i;
  676         struct malo_txq *txq;
  677 
  678         sc->malo_hwdma.rxdesc_read = sc->malo_rxdma.dd_desc_paddr;
  679 
  680         for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
  681                 txq = &sc->malo_txq[i];
  682                 sc->malo_hwdma.wcbbase[i] = txq->dma.dd_desc_paddr;
  683         }
  684         sc->malo_hwdma.maxnum_txwcb = malo_txbuf;
  685         sc->malo_hwdma.maxnum_wcb = MALO_NUM_TX_QUEUES;
  686 
  687         malo_hal_set_rxtxdma(sc);
  688 
  689         return 0;
  690 }
  691 
  692 static void
  693 malo_txq_init(struct malo_softc *sc, struct malo_txq *txq, int qnum)
  694 {
  695         struct malo_txbuf *bf, *bn;
  696         struct malo_txdesc *ds;
  697 
  698         MALO_TXQ_LOCK_INIT(sc, txq);
  699         txq->qnum = qnum;
  700         txq->txpri = 0; /* XXX */
  701 
  702         STAILQ_FOREACH(bf, &txq->free, bf_list) {
  703                 bf->bf_txq = txq;
  704 
  705                 ds = bf->bf_desc;
  706                 bn = STAILQ_NEXT(bf, bf_list);
  707                 if (bn == NULL)
  708                         bn = STAILQ_FIRST(&txq->free);
  709                 ds->physnext = htole32(bn->bf_daddr);
  710         }
  711         STAILQ_INIT(&txq->active);
  712 }
  713 
  714 /*
  715  * Reclaim resources for a setup queue.
  716  */
  717 static void
  718 malo_tx_cleanupq(struct malo_softc *sc, struct malo_txq *txq)
  719 {
  720         /* XXX hal work? */
  721         MALO_TXQ_LOCK_DESTROY(txq);
  722 }
  723 
  724 /*
  725  * Allocate a tx buffer for sending a frame.
  726  */
  727 static struct malo_txbuf *
  728 malo_getbuf(struct malo_softc *sc, struct malo_txq *txq)
  729 {
  730         struct malo_txbuf *bf;
  731 
  732         MALO_TXQ_LOCK(txq);
  733         bf = STAILQ_FIRST(&txq->free);
  734         if (bf != NULL) {
  735                 STAILQ_REMOVE_HEAD(&txq->free, bf_list);
  736                 txq->nfree--;
  737         }
  738         MALO_TXQ_UNLOCK(txq);
  739         if (bf == NULL) {
  740                 DPRINTF(sc, MALO_DEBUG_XMIT,
  741                     "%s: out of xmit buffers on q %d\n", __func__, txq->qnum);
  742                 sc->malo_stats.mst_tx_qstop++;
  743         }
  744         return bf;
  745 }
  746 
  747 static int
  748 malo_tx_dmasetup(struct malo_softc *sc, struct malo_txbuf *bf, struct mbuf *m0)
  749 {
  750         struct mbuf *m;
  751         int error;
  752 
  753         /*
  754          * Load the DMA map so any coalescing is done.  This also calculates
  755          * the number of descriptors we need.
  756          */
  757         error = bus_dmamap_load_mbuf_sg(sc->malo_dmat, bf->bf_dmamap, m0,
  758                                      bf->bf_segs, &bf->bf_nseg,
  759                                      BUS_DMA_NOWAIT);
  760         if (error == EFBIG) {
  761                 /* XXX packet requires too many descriptors */
  762                 bf->bf_nseg = MALO_TXDESC + 1;
  763         } else if (error != 0) {
  764                 sc->malo_stats.mst_tx_busdma++;
  765                 m_freem(m0);
  766                 return error;
  767         }
  768         /*
  769          * Discard null packets and check for packets that require too many
  770          * TX descriptors.  We try to convert the latter to a cluster.
  771          */
  772         if (error == EFBIG) {           /* too many desc's, linearize */
  773                 sc->malo_stats.mst_tx_linear++;
  774                 m = m_defrag(m0, M_DONTWAIT);
  775                 if (m == NULL) {
  776                         m_freem(m0);
  777                         sc->malo_stats.mst_tx_nombuf++;
  778                         return ENOMEM;
  779                 }
  780                 m0 = m;
  781                 error = bus_dmamap_load_mbuf_sg(sc->malo_dmat, bf->bf_dmamap, m0,
  782                                              bf->bf_segs, &bf->bf_nseg,
  783                                              BUS_DMA_NOWAIT);
  784                 if (error != 0) {
  785                         sc->malo_stats.mst_tx_busdma++;
  786                         m_freem(m0);
  787                         return error;
  788                 }
  789                 KASSERT(bf->bf_nseg <= MALO_TXDESC,
  790                     ("too many segments after defrag; nseg %u", bf->bf_nseg));
  791         } else if (bf->bf_nseg == 0) {          /* null packet, discard */
  792                 sc->malo_stats.mst_tx_nodata++;
  793                 m_freem(m0);
  794                 return EIO;
  795         }
  796         DPRINTF(sc, MALO_DEBUG_XMIT, "%s: m %p len %u\n",
  797                 __func__, m0, m0->m_pkthdr.len);
  798         bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
  799         bf->bf_m = m0;
  800 
  801         return 0;
  802 }
  803 
  804 #ifdef MALO_DEBUG
  805 static void
  806 malo_printrxbuf(const struct malo_rxbuf *bf, u_int ix)
  807 {
  808         const struct malo_rxdesc *ds = bf->bf_desc;
  809         uint32_t status = le32toh(ds->status);
  810         
  811         printf("R[%2u] (DS.V:%p DS.P:%p) NEXT:%08x DATA:%08x RC:%02x%s\n"
  812             "      STAT:%02x LEN:%04x SNR:%02x NF:%02x CHAN:%02x"
  813             " RATE:%02x QOS:%04x\n",
  814             ix, ds, (const struct malo_desc *)bf->bf_daddr,
  815             le32toh(ds->physnext), le32toh(ds->physbuffdata),
  816             ds->rxcontrol, 
  817             ds->rxcontrol != MALO_RXD_CTRL_DRIVER_OWN ?
  818                 "" : (status & MALO_RXD_STATUS_OK) ? " *" : " !",
  819             ds->status, le16toh(ds->pktlen), ds->snr, ds->nf, ds->channel,
  820             ds->rate, le16toh(ds->qosctrl));
  821 }
  822 
  823 static void
  824 malo_printtxbuf(const struct malo_txbuf *bf, u_int qnum, u_int ix)
  825 {
  826         const struct malo_txdesc *ds = bf->bf_desc;
  827         uint32_t status = le32toh(ds->status);
  828         
  829         printf("Q%u[%3u]", qnum, ix);
  830         printf(" (DS.V:%p DS.P:%p)\n",
  831             ds, (const struct malo_txdesc *)bf->bf_daddr);
  832         printf("    NEXT:%08x DATA:%08x LEN:%04x STAT:%08x%s\n",
  833             le32toh(ds->physnext),
  834             le32toh(ds->pktptr), le16toh(ds->pktlen), status,
  835             status & MALO_TXD_STATUS_USED ?
  836             "" : (status & 3) != 0 ? " *" : " !");
  837         printf("    RATE:%02x PRI:%x QOS:%04x SAP:%08x FORMAT:%04x\n",
  838             ds->datarate, ds->txpriority, le16toh(ds->qosctrl),
  839             le32toh(ds->sap_pktinfo), le16toh(ds->format));
  840 #if 0
  841         {
  842                 const uint8_t *cp = (const uint8_t *) ds;
  843                 int i;
  844                 for (i = 0; i < sizeof(struct malo_txdesc); i++) {
  845                         printf("%02x ", cp[i]);
  846                         if (((i+1) % 16) == 0)
  847                                 printf("\n");
  848                 }
  849                 printf("\n");
  850         }
  851 #endif
  852 }
  853 #endif /* MALO_DEBUG */
  854 
  855 static __inline void
  856 malo_updatetxrate(struct ieee80211_node *ni, int rix)
  857 {
  858 #define N(x)    (sizeof(x)/sizeof(x[0]))
  859         static const int ieeerates[] =
  860             { 2, 4, 11, 22, 44, 12, 18, 24, 36, 48, 96, 108 };
  861         if (rix < N(ieeerates))
  862                 ni->ni_txrate = ieeerates[rix];
  863 #undef N
  864 }
  865 
  866 static int
  867 malo_fix2rate(int fix_rate)
  868 {
  869 #define N(x)    (sizeof(x)/sizeof(x[0]))
  870         static const int rates[] =
  871             { 2, 4, 11, 22, 12, 18, 24, 36, 48, 96, 108 };
  872         return (fix_rate < N(rates) ? rates[fix_rate] : 0);
  873 #undef N
  874 }
  875 
  876 /* idiomatic shorthands: MS = mask+shift, SM = shift+mask */
  877 #define MS(v,x)                 (((v) & x) >> x##_S)
  878 #define SM(v,x)                 (((v) << x##_S) & x)
  879 
  880 /*
  881  * Process completed xmit descriptors from the specified queue.
  882  */
  883 static int
  884 malo_tx_processq(struct malo_softc *sc, struct malo_txq *txq)
  885 {
  886         struct malo_txbuf *bf;
  887         struct malo_txdesc *ds;
  888         struct ieee80211_node *ni;
  889         int nreaped;
  890         uint32_t status;
  891 
  892         DPRINTF(sc, MALO_DEBUG_TX_PROC, "%s: tx queue %u\n",
  893             __func__, txq->qnum);
  894         for (nreaped = 0;; nreaped++) {
  895                 MALO_TXQ_LOCK(txq);
  896                 bf = STAILQ_FIRST(&txq->active);
  897                 if (bf == NULL) {
  898                         MALO_TXQ_UNLOCK(txq);
  899                         break;
  900                 }
  901                 ds = bf->bf_desc;
  902                 MALO_TXDESC_SYNC(txq, ds,
  903                     BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
  904                 if (ds->status & htole32(MALO_TXD_STATUS_FW_OWNED)) {
  905                         MALO_TXQ_UNLOCK(txq);
  906                         break;
  907                 }
  908                 STAILQ_REMOVE_HEAD(&txq->active, bf_list);
  909                 MALO_TXQ_UNLOCK(txq);
  910 
  911 #ifdef MALO_DEBUG
  912                 if (sc->malo_debug & MALO_DEBUG_XMIT_DESC)
  913                         malo_printtxbuf(bf, txq->qnum, nreaped);
  914 #endif
  915                 ni = bf->bf_node;
  916                 if (ni != NULL) {
  917                         status = le32toh(ds->status);
  918                         if (status & MALO_TXD_STATUS_OK) {
  919                                 uint16_t format = le16toh(ds->format);
  920                                 uint8_t txant = MS(format, MALO_TXD_ANTENNA);
  921 
  922                                 sc->malo_stats.mst_ant_tx[txant]++;
  923                                 if (status & MALO_TXD_STATUS_OK_RETRY)
  924                                         sc->malo_stats.mst_tx_retries++;
  925                                 if (status & MALO_TXD_STATUS_OK_MORE_RETRY)
  926                                         sc->malo_stats.mst_tx_mretries++;
  927                                 malo_updatetxrate(ni, ds->datarate);
  928                                 sc->malo_stats.mst_tx_rate = ds->datarate;
  929                         } else {
  930                                 if (status & MALO_TXD_STATUS_FAILED_LINK_ERROR)
  931                                         sc->malo_stats.mst_tx_linkerror++;
  932                                 if (status & MALO_TXD_STATUS_FAILED_XRETRY)
  933                                         sc->malo_stats.mst_tx_xretries++;
  934                                 if (status & MALO_TXD_STATUS_FAILED_AGING)
  935                                         sc->malo_stats.mst_tx_aging++;
  936                         }
  937                         /*
  938                          * Do any tx complete callback.  Note this must
  939                          * be done before releasing the node reference.
  940                          * XXX no way to figure out if frame was ACK'd
  941                          */
  942                         if (bf->bf_m->m_flags & M_TXCB) {
  943                                 /* XXX strip fw len in case header inspected */
  944                                 m_adj(bf->bf_m, sizeof(uint16_t));
  945                                 ieee80211_process_callback(ni, bf->bf_m,
  946                                         (status & MALO_TXD_STATUS_OK) == 0);
  947                         }
  948                         /*
  949                          * Reclaim reference to node.
  950                          *
  951                          * NB: the node may be reclaimed here if, for example
  952                          *     this is a DEAUTH message that was sent and the
  953                          *     node was timed out due to inactivity.
  954                          */
  955                         ieee80211_free_node(ni);
  956                 }
  957                 ds->status = htole32(MALO_TXD_STATUS_IDLE);
  958                 ds->pktlen = htole32(0);
  959 
  960                 bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap,
  961                     BUS_DMASYNC_POSTWRITE);
  962                 bus_dmamap_unload(sc->malo_dmat, bf->bf_dmamap);
  963                 m_freem(bf->bf_m);
  964                 bf->bf_m = NULL;
  965                 bf->bf_node = NULL;
  966 
  967                 MALO_TXQ_LOCK(txq);
  968                 STAILQ_INSERT_TAIL(&txq->free, bf, bf_list);
  969                 txq->nfree++;
  970                 MALO_TXQ_UNLOCK(txq);
  971         }
  972         return nreaped;
  973 }
  974 
  975 /*
  976  * Deferred processing of transmit interrupt.
  977  */
  978 static void
  979 malo_tx_proc(void *arg, int npending)
  980 {
  981         struct malo_softc *sc = arg;
  982         struct ifnet *ifp = sc->malo_ifp;
  983         int i, nreaped;
  984 
  985         /*
  986          * Process each active queue.
  987          */
  988         nreaped = 0;
  989         for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
  990                 if (!STAILQ_EMPTY(&sc->malo_txq[i].active))
  991                         nreaped += malo_tx_processq(sc, &sc->malo_txq[i]);
  992         }
  993 
  994         if (nreaped != 0) {
  995                 ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
  996                 ifp->if_timer = 0;
  997                 malo_start(ifp);
  998         }
  999 }
 1000 
 1001 static int
 1002 malo_tx_start(struct malo_softc *sc, struct ieee80211_node *ni,
 1003     struct malo_txbuf *bf, struct mbuf *m0)
 1004 {
 1005 #define IEEE80211_DIR_DSTODS(wh) \
 1006         ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS)
 1007 #define IS_DATA_FRAME(wh)                                               \
 1008         ((wh->i_fc[0] & (IEEE80211_FC0_TYPE_MASK)) == IEEE80211_FC0_TYPE_DATA)
 1009         int error, ismcast, iswep;
 1010         int copyhdrlen, hdrlen, pktlen;
 1011         struct ieee80211_frame *wh;
 1012         struct ieee80211com *ic = &sc->malo_ic;
 1013         struct ifnet *ifp = sc->malo_ifp;
 1014         struct malo_txdesc *ds;
 1015         struct malo_txrec *tr;
 1016         struct malo_txq *txq;
 1017         uint16_t qos;
 1018 
 1019         wh = mtod(m0, struct ieee80211_frame *);
 1020         iswep = wh->i_fc[1] & IEEE80211_FC1_WEP;
 1021         ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
 1022         copyhdrlen = hdrlen = ieee80211_anyhdrsize(wh);
 1023         pktlen = m0->m_pkthdr.len;
 1024         if (IEEE80211_QOS_HAS_SEQ(wh)) {
 1025                 if (IEEE80211_DIR_DSTODS(wh)) {
 1026                         qos = *(uint16_t *)
 1027                             (((struct ieee80211_qosframe_addr4 *) wh)->i_qos);
 1028                         copyhdrlen -= sizeof(qos);
 1029                 } else
 1030                         qos = *(uint16_t *)
 1031                             (((struct ieee80211_qosframe *) wh)->i_qos);
 1032         } else
 1033                 qos = 0;
 1034 
 1035         if (iswep) {
 1036                 struct ieee80211_key *k;
 1037 
 1038                 /*
 1039                  * Construct the 802.11 header+trailer for an encrypted
 1040                  * frame. The only reason this can fail is because of an
 1041                  * unknown or unsupported cipher/key type.
 1042                  *
 1043                  * NB: we do this even though the firmware will ignore
 1044                  *     what we've done for WEP and TKIP as we need the
 1045                  *     ExtIV filled in for CCMP and this also adjusts
 1046                  *     the headers which simplifies our work below.
 1047                  */
 1048                 k = ieee80211_crypto_encap(ic, ni, m0);
 1049                 if (k == NULL) {
 1050                         /*
 1051                          * This can happen when the key is yanked after the
 1052                          * frame was queued.  Just discard the frame; the
 1053                          * 802.11 layer counts failures and provides
 1054                          * debugging/diagnostics.
 1055                          */
 1056                         m_freem(m0);
 1057                         return EIO;
 1058                 }
 1059 
 1060                 /*
 1061                  * Adjust the packet length for the crypto additions
 1062                  * done during encap and any other bits that the f/w
 1063                  * will add later on.
 1064                  */
 1065                 pktlen = m0->m_pkthdr.len;
 1066 
 1067                 /* packet header may have moved, reset our local pointer */
 1068                 wh = mtod(m0, struct ieee80211_frame *);
 1069         }
 1070 
 1071         if (bpf_peers_present(sc->malo_drvbpf)) {
 1072                 sc->malo_tx_th.wt_flags = 0;    /* XXX */
 1073                 if (iswep)
 1074                         sc->malo_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
 1075                 sc->malo_tx_th.wt_txpower = ni->ni_txpower;
 1076                 sc->malo_tx_th.wt_antenna = sc->malo_txantenna;
 1077 
 1078                 bpf_mtap2(sc->malo_drvbpf,
 1079                         &sc->malo_tx_th, sc->malo_tx_th_len, m0);
 1080         }
 1081 
 1082         /*
 1083          * Copy up/down the 802.11 header; the firmware requires
 1084          * we present a 2-byte payload length followed by a
 1085          * 4-address header (w/o QoS), followed (optionally) by
 1086          * any WEP/ExtIV header (but only filled in for CCMP).
 1087          * We are assured the mbuf has sufficient headroom to
 1088          * prepend in-place by the setup of ic_headroom in
 1089          * malo_attach.
 1090          */
 1091         if (hdrlen < sizeof(struct malo_txrec)) {
 1092                 const int space = sizeof(struct malo_txrec) - hdrlen;
 1093                 if (M_LEADINGSPACE(m0) < space) {
 1094                         /* NB: should never happen */
 1095                         device_printf(sc->malo_dev,
 1096                             "not enough headroom, need %d found %zd, "
 1097                             "m_flags 0x%x m_len %d\n",
 1098                             space, M_LEADINGSPACE(m0), m0->m_flags, m0->m_len);
 1099                         ieee80211_dump_pkt(ic,
 1100                             mtod(m0, const uint8_t *), m0->m_len, 0, -1);
 1101                         m_freem(m0);
 1102                         /* XXX stat */
 1103                         return EIO;
 1104                 }
 1105                 M_PREPEND(m0, space, M_NOWAIT);
 1106         }
 1107         tr = mtod(m0, struct malo_txrec *);
 1108         if (wh != (struct ieee80211_frame *) &tr->wh)
 1109                 ovbcopy(wh, &tr->wh, hdrlen);
 1110         /*
 1111          * Note: the "firmware length" is actually the length of the fully
 1112          * formed "802.11 payload".  That is, it's everything except for
 1113          * the 802.11 header.  In particular this includes all crypto
 1114          * material including the MIC!
 1115          */
 1116         tr->fwlen = htole16(pktlen - hdrlen);
 1117 
 1118         /*
 1119          * Load the DMA map so any coalescing is done.  This
 1120          * also calculates the number of descriptors we need.
 1121          */
 1122         error = malo_tx_dmasetup(sc, bf, m0);
 1123         if (error != 0)
 1124                 return error;
 1125         bf->bf_node = ni;                       /* NB: held reference */
 1126         m0 = bf->bf_m;                          /* NB: may have changed */
 1127         tr = mtod(m0, struct malo_txrec *);
 1128         wh = (struct ieee80211_frame *)&tr->wh;
 1129 
 1130         /*
 1131          * Formulate tx descriptor.
 1132          */
 1133         ds = bf->bf_desc;
 1134         txq = bf->bf_txq;
 1135 
 1136         ds->qosctrl = qos;                      /* NB: already little-endian */
 1137         ds->pktptr = htole32(bf->bf_segs[0].ds_addr);
 1138         ds->pktlen = htole16(bf->bf_segs[0].ds_len);
 1139         /* NB: pPhysNext setup once, don't touch */
 1140         ds->datarate = IS_DATA_FRAME(wh) ? 1 : 0;
 1141         ds->sap_pktinfo = 0;
 1142         ds->format = 0;
 1143 
 1144         /*
 1145          * Select transmit rate.
 1146          */
 1147         switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
 1148         case IEEE80211_FC0_TYPE_MGT:
 1149                 sc->malo_stats.mst_tx_mgmt++;
 1150                 /* fall thru... */
 1151         case IEEE80211_FC0_TYPE_CTL:
 1152                 ds->txpriority = 1;
 1153                 break;
 1154         case IEEE80211_FC0_TYPE_DATA:
 1155                 ds->txpriority = txq->qnum;
 1156                 break;
 1157         default:
 1158                 if_printf(ifp, "bogus frame type 0x%x (%s)\n",
 1159                         wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK, __func__);
 1160                 /* XXX statistic */
 1161                 m_freem(m0);
 1162                 return EIO;
 1163         }
 1164 
 1165 #ifdef MALO_DEBUG
 1166         if (IFF_DUMPPKTS_XMIT(sc))
 1167                 ieee80211_dump_pkt(ic,
 1168                     mtod(m0, const uint8_t *)+sizeof(uint16_t),
 1169                     m0->m_len - sizeof(uint16_t), ds->datarate, -1);
 1170 #endif
 1171 
 1172         MALO_TXQ_LOCK(txq);
 1173         if (!IS_DATA_FRAME(wh))
 1174                 ds->status |= htole32(1);
 1175         ds->status |= htole32(MALO_TXD_STATUS_FW_OWNED);
 1176         STAILQ_INSERT_TAIL(&txq->active, bf, bf_list);
 1177         MALO_TXDESC_SYNC(txq, ds, BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
 1178 
 1179         ifp->if_opackets++;
 1180         ifp->if_timer = 5;
 1181         MALO_TXQ_UNLOCK(txq);
 1182         return 0;
 1183 #undef IEEE80211_DIR_DSTODS
 1184 }
 1185 
 1186 static void
 1187 malo_start(struct ifnet *ifp)
 1188 {
 1189         int nqueued = 0;
 1190         struct ether_header *eh;
 1191         struct malo_softc *sc = ifp->if_softc;
 1192         struct ieee80211_frame *wh;
 1193         struct ieee80211_node *ni;
 1194         struct ieee80211com *ic = &sc->malo_ic;
 1195         struct malo_txbuf *bf = NULL;
 1196         struct malo_txq *txq = NULL;
 1197         struct mbuf *m;
 1198 
 1199         if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0 || sc->malo_invalid)
 1200                 return;
 1201 
 1202         for (;;) {
 1203                 /*
 1204                  * Poll the management queue for frames; they
 1205                  * have priority over normal data frames.
 1206                  */
 1207                 IF_DEQUEUE(&ic->ic_mgtq, m);
 1208                 if (m == NULL) {
 1209                         /*
 1210                          * No data frames go out unless we're associated.
 1211                          */
 1212                         if (ic->ic_state != IEEE80211_S_RUN) {
 1213                                 DPRINTF(sc, MALO_DEBUG_XMIT,
 1214                                     "%s: discard data packet, state %s\n",
 1215                                     __func__,
 1216                                     ieee80211_state_name[ic->ic_state]);
 1217                                 sc->malo_stats.mst_tx_discard++;
 1218                                 break;
 1219                         }
 1220                         IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
 1221                         if (m == NULL)
 1222                                 break;
 1223                         /*
 1224                          * Cancel any background scan.
 1225                          */
 1226                         if (ic->ic_flags & IEEE80211_F_SCAN)
 1227                                 ieee80211_cancel_scan(ic);
 1228 
 1229                         /*
 1230                          * Find the node for the destination so we can do
 1231                          * things like power save and fast frames aggregation.
 1232                          */
 1233                         if (m->m_len < sizeof(struct ether_header) &&
 1234                            (m = m_pullup(m, sizeof(struct ether_header))) ==
 1235                             NULL) {
 1236                                 ic->ic_stats.is_tx_nobuf++;     /* XXX */
 1237                                 ni = NULL;
 1238                                 goto bad;
 1239                         }
 1240                         eh = mtod(m, struct ether_header *);
 1241                         ni = ieee80211_find_txnode(ic, eh->ether_dhost);
 1242                         if (ni == NULL) {
 1243                                 /* NB: ieee80211_find_txnode does stat+msg */
 1244                                 m_freem(m);
 1245                                 goto bad;
 1246                         }
 1247                         /* calculate priority so we can find the tx queue */
 1248                         if (ieee80211_classify(ic, m, ni)) {
 1249                                 DPRINTF(sc, MALO_DEBUG_XMIT,
 1250                                         "%s: discard, classification failure\n",
 1251                                         __func__);
 1252                                 m_freem(m);
 1253                                 goto bad;
 1254                         }
 1255 
 1256                         txq = &sc->malo_txq[0];
 1257 
 1258                         bf = malo_getbuf(sc, txq);
 1259                         if (bf == NULL) {
 1260                                 IFQ_DRV_PREPEND(&ifp->if_snd, m);
 1261                                 ieee80211_free_node(ni);
 1262 
 1263                                 /* XXX blocks other traffic */
 1264                                 ifp->if_drv_flags |= IFF_DRV_OACTIVE;
 1265                                 sc->malo_stats.mst_tx_qstop++;
 1266                                 break;
 1267                         }
 1268                         ifp->if_opackets++;
 1269 
 1270                         if (bpf_peers_present(ifp->if_bpf))
 1271                                 bpf_mtap(ifp->if_bpf, m);
 1272 
 1273                         /*
 1274                          * Encapsulate the packet in prep for transmission.
 1275                          */
 1276                         m = ieee80211_encap(ic, m, ni);
 1277                         if (m == NULL) {
 1278                                 DPRINTF(sc, MALO_DEBUG_XMIT,
 1279                                     "%s: encapsulation failure\n", __func__);
 1280                                 sc->malo_stats.mst_tx_encap++;
 1281                                 goto bad;
 1282                         }
 1283                 } else {
 1284                         /*
 1285                          * Grab a TX buffer and associated resources.
 1286                          * Note that we depend on the classification
 1287                          * by the 802.11 layer to get to the right h/w
 1288                          * queue.  Management frames must ALWAYS go on
 1289                          * queue 1 but we cannot just force that here
 1290                          * because we may receive non-mgt frames through
 1291                          * the ic_mgtq (e.g. null data frames).
 1292                          */
 1293                         txq = &sc->malo_txq[0];
 1294                         bf = malo_getbuf(sc, txq);
 1295                         if (bf == NULL) {
 1296                                 IF_PREPEND(&ic->ic_mgtq, m);
 1297                                 /* XXX stat */
 1298                                 break;
 1299                         }
 1300 
 1301                         /*
 1302                          * Hack!  The referenced node pointer is in the
 1303                          * rcvif field of the packet header.  This is
 1304                          * placed there by ieee80211_mgmt_output because
 1305                          * we need to hold the reference with the frame
 1306                          * and there's no other way (other than packet
 1307                          * tags which we consider too expensive to use)
 1308                          * to pass it along.
 1309                          */
 1310                         ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
 1311                         m->m_pkthdr.rcvif = NULL;
 1312 
 1313                         wh = mtod(m, struct ieee80211_frame *);
 1314                         sc->malo_stats.mst_tx_mgmt++;
 1315 
 1316                         if (bpf_peers_present(ic->ic_rawbpf))
 1317                                 bpf_mtap(ic->ic_rawbpf, m);
 1318                 }
 1319 
 1320                 /*
 1321                  * Pass the frame to the h/w for transmission.
 1322                  */
 1323                 if (malo_tx_start(sc, ni, bf, m)) {
 1324         bad:
 1325                         ifp->if_oerrors++;
 1326                         if (bf != NULL) {
 1327                                 bf->bf_m = NULL;
 1328                                 bf->bf_node = NULL;
 1329                                 MALO_TXQ_LOCK(txq);
 1330                                 STAILQ_INSERT_HEAD(&txq->free, bf, bf_list);
 1331                                 MALO_TXQ_UNLOCK(txq);
 1332                         }
 1333                         ieee80211_free_node(ni);
 1334                         continue;
 1335                 }
 1336                 nqueued++;
 1337 
 1338                 if (nqueued >= malo_txcoalesce) {
 1339                         /*
 1340                          * Poke the firmware to process queued frames;
 1341                          * see below about (lack of) locking.
 1342                          */
 1343                         nqueued = 0;
 1344                         malo_hal_txstart(sc->malo_mh, 0/*XXX*/);
 1345                 }
 1346         }
 1347 
 1348         if (nqueued) {
 1349                 /*
 1350                  * NB: We don't need to lock against tx done because
 1351                  * this just prods the firmware to check the transmit
 1352                  * descriptors.  The firmware will also start fetching
 1353                  * descriptors by itself if it notices new ones are
 1354                  * present when it goes to deliver a tx done interrupt
 1355                  * to the host. So if we race with tx done processing
 1356                  * it's ok.  Delivering the kick here rather than in
 1357                  * malo_tx_start is an optimization to avoid poking the
 1358                  * firmware for each packet.
 1359                  *
 1360                  * NB: the queue id isn't used so 0 is ok.
 1361                  */
 1362                 malo_hal_txstart(sc->malo_mh, 0/*XXX*/);
 1363         }
 1364 }
 1365 
 1366 static void
 1367 malo_watchdog(struct ifnet *ifp)
 1368 {
 1369         struct malo_softc *sc = ifp->if_softc;
 1370 
 1371         if ((ifp->if_drv_flags & IFF_DRV_RUNNING) && !sc->malo_invalid) {
 1372                 if_printf(ifp, "watchdog timeout\n");
 1373 
 1374                 /* XXX no way to reset h/w. now  */
 1375 
 1376                 ifp->if_oerrors++;
 1377                 sc->malo_stats.mst_watchdog++;
 1378         }
 1379 }
 1380 
 1381 static int
 1382 malo_hal_reset(struct malo_softc *sc)
 1383 {
 1384         static int first = 0;
 1385         struct ieee80211com *ic = &sc->malo_ic;
 1386         struct malo_hal *mh = sc->malo_mh;
 1387 
 1388         if (first == 0) {
 1389                 /*
 1390                  * NB: when the device firstly is initialized, sometimes
 1391                  * firmware could override rx/tx dma registers so we re-set
 1392                  * these values once.
 1393                  */
 1394                 malo_hal_set_rxtxdma(sc);
 1395                 first = 1;
 1396         }
 1397 
 1398         malo_hal_setantenna(mh, MHA_ANTENNATYPE_RX, sc->malo_rxantenna);
 1399         malo_hal_setantenna(mh, MHA_ANTENNATYPE_TX, sc->malo_txantenna);
 1400         malo_hal_setradio(mh, 1, MHP_AUTO_PREAMBLE);
 1401         malo_chan_set(sc, ic->ic_curchan);
 1402 
 1403         /* XXX needs other stuffs?  */
 1404 
 1405         return 1;
 1406 }
 1407 
 1408 static __inline struct mbuf *
 1409 malo_getrxmbuf(struct malo_softc *sc, struct malo_rxbuf *bf)
 1410 {
 1411         struct mbuf *m;
 1412         bus_addr_t paddr;
 1413         int error;
 1414 
 1415         /* XXX don't need mbuf, just dma buffer */
 1416         m = m_getjcl(M_DONTWAIT, MT_DATA, M_PKTHDR, MJUMPAGESIZE);
 1417         if (m == NULL) {
 1418                 sc->malo_stats.mst_rx_nombuf++; /* XXX */
 1419                 return NULL;
 1420         }
 1421         error = bus_dmamap_load(sc->malo_dmat, bf->bf_dmamap,
 1422             mtod(m, caddr_t), MJUMPAGESIZE,
 1423             malo_load_cb, &paddr, BUS_DMA_NOWAIT);
 1424         if (error != 0) {
 1425                 if_printf(sc->malo_ifp,
 1426                     "%s: bus_dmamap_load failed, error %d\n", __func__, error);
 1427                 m_freem(m);
 1428                 return NULL;
 1429         }
 1430         bf->bf_data = paddr;
 1431         bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
 1432 
 1433         return m;
 1434 }
 1435 
 1436 static int
 1437 malo_rxbuf_init(struct malo_softc *sc, struct malo_rxbuf *bf)
 1438 {
 1439         struct malo_rxdesc *ds;
 1440 
 1441         ds = bf->bf_desc;
 1442         if (bf->bf_m == NULL) {
 1443                 bf->bf_m = malo_getrxmbuf(sc, bf);
 1444                 if (bf->bf_m == NULL) {
 1445                         /* mark descriptor to be skipped */
 1446                         ds->rxcontrol = MALO_RXD_CTRL_OS_OWN;
 1447                         /* NB: don't need PREREAD */
 1448                         MALO_RXDESC_SYNC(sc, ds, BUS_DMASYNC_PREWRITE);
 1449                         return ENOMEM;
 1450                 }
 1451         }
 1452 
 1453         /*
 1454          * Setup descriptor.
 1455          */
 1456         ds->qosctrl = 0;
 1457         ds->snr = 0;
 1458         ds->status = MALO_RXD_STATUS_IDLE;
 1459         ds->channel = 0;
 1460         ds->pktlen = htole16(MALO_RXSIZE);
 1461         ds->nf = 0;
 1462         ds->physbuffdata = htole32(bf->bf_data);
 1463         /* NB: don't touch pPhysNext, set once */
 1464         ds->rxcontrol = MALO_RXD_CTRL_DRIVER_OWN;
 1465         MALO_RXDESC_SYNC(sc, ds, BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
 1466 
 1467         return 0;
 1468 }
 1469 
 1470 /*
 1471  * Setup the rx data structures.  This should only be done once or we may get
 1472  * out of sync with the firmware.
 1473  */
 1474 static int
 1475 malo_startrecv(struct malo_softc *sc)
 1476 {
 1477         struct malo_rxbuf *bf, *prev;
 1478         struct malo_rxdesc *ds;
 1479         
 1480         if (sc->malo_recvsetup == 1) {
 1481                 malo_mode_init(sc);             /* set filters, etc. */
 1482                 return 0;
 1483         }
 1484         
 1485         prev = NULL;
 1486         STAILQ_FOREACH(bf, &sc->malo_rxbuf, bf_list) {
 1487                 int error = malo_rxbuf_init(sc, bf);
 1488                 if (error != 0) {
 1489                         DPRINTF(sc, MALO_DEBUG_RECV,
 1490                             "%s: malo_rxbuf_init failed %d\n",
 1491                             __func__, error);
 1492                         return error;
 1493                 }
 1494                 if (prev != NULL) {
 1495                         ds = prev->bf_desc;
 1496                         ds->physnext = htole32(bf->bf_daddr);
 1497                 }
 1498                 prev = bf;
 1499         }
 1500         if (prev != NULL) {
 1501                 ds = prev->bf_desc;
 1502                 ds->physnext =
 1503                     htole32(STAILQ_FIRST(&sc->malo_rxbuf)->bf_daddr);
 1504         }
 1505 
 1506         sc->malo_recvsetup = 1;
 1507 
 1508         malo_mode_init(sc);             /* set filters, etc. */
 1509         
 1510         return 0;
 1511 }
 1512 
 1513 static void
 1514 malo_init(void *arg)
 1515 {
 1516         struct malo_softc *sc = (struct malo_softc *) arg;
 1517         struct ieee80211com *ic = &sc->malo_ic;
 1518         struct ifnet *ifp = sc->malo_ifp;
 1519         struct malo_hal *mh = sc->malo_mh;
 1520         int error;
 1521         
 1522         DPRINTF(sc, MALO_DEBUG_ANY, "%s: if_flags 0x%x\n",
 1523             __func__, ifp->if_flags);
 1524 
 1525         if (!sc->malo_fw_loaded) {
 1526                 /*
 1527                  * Load firmware so we can get setup.
 1528                  */
 1529                 error = malo_hal_fwload(mh, "malo8335-h", "malo8335-m");
 1530                 if (error != 0) {
 1531                         if_printf(ifp, "unable to setup firmware\n");
 1532                         return;
 1533                 }
 1534                 /* XXX gethwspecs() extracts correct informations? not maybe! */
 1535                 error = malo_hal_gethwspecs(mh, &sc->malo_hwspecs);
 1536                 if (error != 0) {
 1537                         if_printf(ifp, "unable to fetch h/w specs\n");
 1538                         return;
 1539                 }
 1540 
 1541                 DPRINTF(sc, MALO_DEBUG_FW,
 1542                     "malo_hal_gethwspecs: hwversion 0x%x hostif 0x%x"
 1543                     "maxnum_wcb 0x%x maxnum_mcaddr 0x%x maxnum_tx_wcb 0x%x"
 1544                     "regioncode 0x%x num_antenna 0x%x fw_releasenum 0x%x"
 1545                     "wcbbase0 0x%x rxdesc_read 0x%x rxdesc_write 0x%x"
 1546                     "ul_fw_awakecookie 0x%x w[4] = %x %x %x %x",
 1547                     sc->malo_hwspecs.hwversion,
 1548                     sc->malo_hwspecs.hostinterface, sc->malo_hwspecs.maxnum_wcb,
 1549                     sc->malo_hwspecs.maxnum_mcaddr,
 1550                     sc->malo_hwspecs.maxnum_tx_wcb,
 1551                     sc->malo_hwspecs.regioncode, sc->malo_hwspecs.num_antenna,
 1552                     sc->malo_hwspecs.fw_releasenum, sc->malo_hwspecs.wcbbase0,
 1553                     sc->malo_hwspecs.rxdesc_read, sc->malo_hwspecs.rxdesc_write,
 1554                     sc->malo_hwspecs.ul_fw_awakecookie,
 1555                     sc->malo_hwspecs.wcbbase[0], sc->malo_hwspecs.wcbbase[1],
 1556                     sc->malo_hwspecs.wcbbase[2], sc->malo_hwspecs.wcbbase[3]);
 1557                 
 1558                 error = malo_setup_hwdma(sc);   /* push to firmware */
 1559                 /* NB: malo_setupdma prints msg */
 1560                 if (error != 0) {
 1561                         if_printf(ifp, "%s: failed to set up h/w dma\n",
 1562                             __func__);
 1563                         return;
 1564                 }
 1565 
 1566                 /* set reddomain.  */
 1567                 ic->ic_regdomain = sc->malo_hwspecs.regioncode;
 1568 
 1569                 malo_announce(sc);
 1570 
 1571                 sc->malo_fw_loaded = 1;
 1572         }
 1573 
 1574         MALO_LOCK(sc);
 1575         
 1576         /*
 1577          * Stop anything previously setup.  This is safe whether this is
 1578          * the first time through or not.
 1579          */
 1580         malo_stop_locked(ifp, 0);
 1581 
 1582         /*
 1583          * Push state to the firmware.
 1584          */
 1585         if (!malo_hal_reset(sc)) {
 1586                 if_printf(ifp, "%s: unable to reset hardware\n", __func__);
 1587                 goto done;
 1588         }
 1589 
 1590         /*
 1591          * Setup recv (once); transmit is already good to go.
 1592          */
 1593         error = malo_startrecv(sc);
 1594         if (error != 0) {
 1595                 if_printf(ifp, "%s: unable to start recv logic, error %d\n",
 1596                     __func__, error);
 1597                 goto done;
 1598         }
 1599 
 1600         /*
 1601          * Enable interrupts.
 1602          */
 1603         sc->malo_imask = MALO_A2HRIC_BIT_RX_RDY
 1604             | MALO_A2HRIC_BIT_TX_DONE
 1605             | MALO_A2HRIC_BIT_OPC_DONE
 1606             | MALO_A2HRIC_BIT_MAC_EVENT
 1607             | MALO_A2HRIC_BIT_RX_PROBLEM
 1608             | MALO_A2HRIC_BIT_ICV_ERROR
 1609             | MALO_A2HRIC_BIT_RADAR_DETECT
 1610             | MALO_A2HRIC_BIT_CHAN_SWITCH;
 1611 
 1612         ifp->if_drv_flags |= IFF_DRV_RUNNING;
 1613         ic->ic_state = IEEE80211_S_INIT;
 1614         IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
 1615 
 1616         malo_hal_intrset(mh, sc->malo_imask);
 1617 
 1618         /*
 1619          * The hardware should be ready to go now so it's safe to kick
 1620          * the 802.11 state machine as it's likely to immediately call back
 1621          * to us to send mgmt frames.
 1622          */
 1623         if (ic->ic_opmode != IEEE80211_M_MONITOR) {
 1624                 if (ic->ic_roaming != IEEE80211_ROAMING_MANUAL)
 1625                         ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
 1626         } else
 1627                 ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
 1628 
 1629 done:
 1630         if (error != 0)
 1631                 if_printf(ifp,
 1632                     "error(%d) occurred during the initializing.\n", error);
 1633 
 1634         MALO_UNLOCK(sc);
 1635 
 1636         return;
 1637 }
 1638 
 1639 /*
 1640  * Set the multicast filter contents into the hardware.
 1641  */
 1642 static void
 1643 malo_setmcastfilter(struct malo_softc *sc)
 1644 {
 1645         struct ieee80211com *ic = &sc->malo_ic;
 1646         struct ifmultiaddr *ifma;
 1647         struct ifnet *ifp = sc->malo_ifp;
 1648         uint8_t macs[IEEE80211_ADDR_LEN * MALO_HAL_MCAST_MAX];
 1649         uint8_t *mp;
 1650         int nmc;
 1651 
 1652         mp = macs;
 1653         nmc = 0;
 1654 
 1655         if (ic->ic_opmode == IEEE80211_M_MONITOR ||
 1656             (ifp->if_flags & (IFF_ALLMULTI | IFF_PROMISC)))
 1657                 goto all;
 1658         
 1659         IF_ADDR_LOCK(ifp);
 1660         TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
 1661                 if (ifma->ifma_addr->sa_family != AF_LINK)
 1662                         continue;
 1663 
 1664                 if (nmc == MALO_HAL_MCAST_MAX) {
 1665                         ifp->if_flags |= IFF_ALLMULTI;
 1666                         IF_ADDR_UNLOCK(ifp);
 1667                         goto all;
 1668                 }
 1669                 IEEE80211_ADDR_COPY(mp,
 1670                     LLADDR((struct sockaddr_dl *)ifma->ifma_addr));
 1671 
 1672                 mp += IEEE80211_ADDR_LEN, nmc++;
 1673         }
 1674         IF_ADDR_UNLOCK(ifp);
 1675 
 1676         malo_hal_setmcast(sc->malo_mh, nmc, macs);
 1677 
 1678 all:
 1679         /*
 1680          * XXX we don't know how to set the f/w for supporting
 1681          * IFF_ALLMULTI | IFF_PROMISC cases
 1682          */
 1683         return;
 1684 }
 1685 
 1686 static int
 1687 malo_mode_init(struct malo_softc *sc)
 1688 {
 1689         struct ieee80211com *ic = &sc->malo_ic;
 1690         struct ifnet *ifp = ic->ic_ifp;
 1691         struct malo_hal *mh = sc->malo_mh;
 1692 
 1693         /*
 1694          * Handle any link-level address change.  Note that we only
 1695          * need to force ic_myaddr; any other addresses are handled
 1696          * as a byproduct of the ifnet code marking the interface
 1697          * down then up.
 1698          */
 1699         IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
 1700 
 1701         /*
 1702          * NB: Ignore promisc in hostap mode; it's set by the
 1703          * bridge.  This is wrong but we have no way to
 1704          * identify internal requests (from the bridge)
 1705          * versus external requests such as for tcpdump.
 1706          */
 1707         malo_hal_setpromisc(mh, (ifp->if_flags & IFF_PROMISC) &&
 1708             ic->ic_opmode != IEEE80211_M_HOSTAP);
 1709         malo_setmcastfilter(sc);
 1710 
 1711         return ENXIO;
 1712 }
 1713 
 1714 static void
 1715 malo_tx_draintxq(struct malo_softc *sc, struct malo_txq *txq)
 1716 {
 1717         struct ieee80211_node *ni;
 1718         struct malo_txbuf *bf;
 1719         u_int ix;
 1720         
 1721         /*
 1722          * NB: this assumes output has been stopped and
 1723          *     we do not need to block malo_tx_tasklet
 1724          */
 1725         for (ix = 0;; ix++) {
 1726                 MALO_TXQ_LOCK(txq);
 1727                 bf = STAILQ_FIRST(&txq->active);
 1728                 if (bf == NULL) {
 1729                         MALO_TXQ_UNLOCK(txq);
 1730                         break;
 1731                 }
 1732                 STAILQ_REMOVE_HEAD(&txq->active, bf_list);
 1733                 MALO_TXQ_UNLOCK(txq);
 1734 #ifdef MALO_DEBUG
 1735                 if (sc->malo_debug & MALO_DEBUG_RESET) {
 1736                         const struct malo_txrec *tr =
 1737                             mtod(bf->bf_m, const struct malo_txrec *);
 1738                         malo_printtxbuf(bf, txq->qnum, ix);
 1739                         ieee80211_dump_pkt(&sc->malo_ic,
 1740                             (const uint8_t *)&tr->wh,
 1741                             bf->bf_m->m_len - sizeof(tr->fwlen), 0, -1);
 1742                 }
 1743 #endif /* MALO_DEBUG */
 1744                 bus_dmamap_unload(sc->malo_dmat, bf->bf_dmamap);
 1745                 ni = bf->bf_node;
 1746                 bf->bf_node = NULL;
 1747                 if (ni != NULL) {
 1748                         /*
 1749                          * Reclaim node reference.
 1750                          */
 1751                         ieee80211_free_node(ni);
 1752                 }
 1753                 m_freem(bf->bf_m);
 1754                 bf->bf_m = NULL;
 1755                 
 1756                 MALO_TXQ_LOCK(txq);
 1757                 STAILQ_INSERT_TAIL(&txq->free, bf, bf_list);
 1758                 txq->nfree++;
 1759                 MALO_TXQ_UNLOCK(txq);
 1760         }
 1761 }
 1762 
 1763 static void
 1764 malo_stop_locked(struct ifnet *ifp, int disable)
 1765 {
 1766         int i;
 1767         struct malo_softc *sc = ifp->if_softc;
 1768         struct ieee80211com *ic = &sc->malo_ic;
 1769         struct malo_hal *mh = sc->malo_mh;
 1770 
 1771         DPRINTF(sc, MALO_DEBUG_ANY, "%s: invalid %u if_flags 0x%x\n",
 1772             __func__, sc->malo_invalid, ifp->if_flags);
 1773 
 1774         MALO_LOCK_ASSERT(sc);
 1775 
 1776         if (!(ifp->if_drv_flags & IFF_DRV_RUNNING))
 1777                 return;
 1778 
 1779         /*
 1780          * Shutdown the hardware and driver:
 1781          *    reset 802.11 state machine
 1782          *    turn off timers
 1783          *    disable interrupts
 1784          *    turn off the radio
 1785          *    clear transmit machinery
 1786          *    clear receive machinery
 1787          *    drain and release tx queues
 1788          *    reclaim beacon resources
 1789          *    power down hardware
 1790          *
 1791          * Note that some of this work is not possible if the hardware
 1792          * is gone (invalid).
 1793          */
 1794         ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
 1795         ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
 1796         ifp->if_timer = 0;
 1797         if (sc->malo_fw_loaded == 1) {
 1798                 /* diable interrupt.  */
 1799                 malo_hal_intrset(mh, 0);
 1800                 /* turn off the radio.  */
 1801                 malo_hal_setradio(mh, 0, MHP_AUTO_PREAMBLE);
 1802         }
 1803 
 1804         /* drain and release tx queues.  */
 1805         for (i = 0; i < MALO_NUM_TX_QUEUES; i++)
 1806                 malo_tx_draintxq(sc, &sc->malo_txq[i]);
 1807 }
 1808 
 1809 static int
 1810 malo_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 1811 {
 1812 #define MALO_IS_RUNNING(ifp) \
 1813         ((ifp->if_flags & IFF_UP) && (ifp->if_drv_flags & IFF_DRV_RUNNING))
 1814         struct malo_softc *sc = ifp->if_softc;
 1815         struct ieee80211com *ic = &sc->malo_ic;
 1816         int error = 0;
 1817 
 1818         MALO_LOCK(sc);
 1819 
 1820         switch (cmd) {
 1821         case SIOCSIFFLAGS:
 1822                 if (MALO_IS_RUNNING(ifp)) {
 1823                         /*
 1824                          * To avoid rescanning another access point,
 1825                          * do not call malo_init() here.  Instead,
 1826                          * only reflect promisc mode settings.
 1827                          */
 1828                         malo_mode_init(sc);
 1829                 } else if (ifp->if_flags & IFF_UP) {
 1830                         /*
 1831                          * Beware of being called during attach/detach
 1832                          * to reset promiscuous mode.  In that case we
 1833                          * will still be marked UP but not RUNNING.
 1834                          * However trying to re-init the interface
 1835                          * is the wrong thing to do as we've already
 1836                          * torn down much of our state.  There's
 1837                          * probably a better way to deal with this.
 1838                          */
 1839                         if (!sc->malo_invalid)
 1840                                 malo_init(sc);
 1841                 } else
 1842                         malo_stop_locked(ifp, 1);
 1843                 break;
 1844         case SIOCADDMULTI:
 1845         case SIOCDELMULTI:
 1846                 /*
 1847                  * The upper layer has already installed/removed
 1848                  * the multicast address(es), just recalculate the
 1849                  * multicast filter for the card.
 1850                  */
 1851                 if (ifp->if_drv_flags & IFF_DRV_RUNNING)
 1852                         malo_mode_init(sc);
 1853                 break;
 1854         default:
 1855                 error = ieee80211_ioctl(ic, cmd, data);
 1856                 if (error == ENETRESET) {
 1857                         if (MALO_IS_RUNNING(ifp) &&
 1858                             ic->ic_roaming != IEEE80211_ROAMING_MANUAL)
 1859                                 malo_init(sc);
 1860                         error = 0;
 1861                 }
 1862                 if (error == ERESTART) {
 1863                         /* XXX we need to reset the device here.  */
 1864                         error = 0;
 1865                 }
 1866                 break;
 1867         }
 1868 
 1869         MALO_UNLOCK(sc);
 1870 
 1871         return error;
 1872 #undef MALO_IS_RUNNING
 1873 }
 1874 
 1875 /*
 1876  * Callback from the 802.11 layer to update the slot time
 1877  * based on the current setting.  We use it to notify the
 1878  * firmware of ERP changes and the f/w takes care of things
 1879  * like slot time and preamble.
 1880  */
 1881 static void
 1882 malo_updateslot(struct ifnet *ifp)
 1883 {
 1884         struct malo_softc *sc = ifp->if_softc;
 1885         struct ieee80211com *ic = &sc->malo_ic;
 1886         struct malo_hal *mh = sc->malo_mh;
 1887         int error;
 1888         
 1889         /* NB: can be called early; suppress needless cmds */
 1890         if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
 1891                 return;
 1892 
 1893         DPRINTF(sc, MALO_DEBUG_RESET,
 1894             "%s: chan %u MHz/flags 0x%x %s slot, (ic_flags 0x%x)\n",
 1895             __func__, ic->ic_curchan->ic_freq, ic->ic_curchan->ic_flags,
 1896             ic->ic_flags & IEEE80211_F_SHSLOT ? "short" : "long", ic->ic_flags);
 1897 
 1898         if (ic->ic_flags & IEEE80211_F_SHSLOT)
 1899                 error = malo_hal_set_slot(mh, 1);
 1900         else
 1901                 error = malo_hal_set_slot(mh, 0);
 1902 
 1903         if (error != 0)
 1904                 device_printf(sc->malo_dev, "setting %s slot failed\n",
 1905                         ic->ic_flags & IEEE80211_F_SHSLOT ? "short" : "long");
 1906 }
 1907 
 1908 static int
 1909 malo_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
 1910 {
 1911         struct ieee80211_node *ni = ic->ic_bss;
 1912         struct ifnet *ifp = ic->ic_ifp;
 1913         struct malo_softc *sc = ifp->if_softc;
 1914         struct malo_hal *mh = sc->malo_mh;
 1915         int error;
 1916 
 1917         DPRINTF(sc, MALO_DEBUG_STATE, "%s: %s -> %s\n", __func__,
 1918             ieee80211_state_name[ic->ic_state],
 1919             ieee80211_state_name[nstate]);
 1920 
 1921         /*
 1922          * Carry out firmware actions per-state.
 1923          */
 1924         switch (nstate) {
 1925         case IEEE80211_S_INIT:
 1926         case IEEE80211_S_SCAN:
 1927         case IEEE80211_S_AUTH:
 1928                 /* NB: do nothing.  */
 1929                 break;
 1930         case IEEE80211_S_ASSOC:
 1931                 malo_hal_setradio(mh, 1,
 1932                     (ic->ic_flags & IEEE80211_F_SHPREAMBLE) ?
 1933                     MHP_SHORT_PREAMBLE : MHP_LONG_PREAMBLE);
 1934                 break;
 1935         case IEEE80211_S_RUN:
 1936                 DPRINTF(sc, MALO_DEBUG_STATE,
 1937                     "%s: %s(RUN): ic_flags 0x%08x bintvl %d bssid %s "
 1938                     "capinfo 0x%04x chan %d\n",
 1939                     ifp->if_xname, __func__, ic->ic_flags,
 1940                     ni->ni_intval, ether_sprintf(ni->ni_bssid), ni->ni_capinfo,
 1941                     ieee80211_chan2ieee(ic, ic->ic_curchan));
 1942 
 1943                 switch (ic->ic_opmode) {
 1944                 case IEEE80211_M_STA:
 1945                         DPRINTF(sc, MALO_DEBUG_STATE, "%s: %s: aid 0x%x\n",
 1946                             ic->ic_ifp->if_xname, __func__, ni->ni_associd);
 1947                         malo_hal_setassocid(sc->malo_mh,
 1948                             ni->ni_bssid, ni->ni_associd);
 1949 
 1950                         if (ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE)
 1951                                 /* automatic rate adaption */
 1952                                 malo_hal_set_rate(mh, ic->ic_curmode, 0);
 1953                         else
 1954                                 /* fixed rate */
 1955                                 malo_hal_set_rate(mh, ic->ic_curmode, 
 1956                                     malo_fix2rate(ic->ic_fixed_rate));
 1957                         break;
 1958                 default:
 1959                         break;
 1960                 }
 1961 
 1962                 break;
 1963         default:
 1964                 if_printf(ifp, "%s: can't handle state %s -> %s\n",
 1965                     __func__, ieee80211_state_name[ic->ic_state],
 1966                     ieee80211_state_name[nstate]);
 1967         }
 1968 
 1969         /*
 1970          * Invoke the parent method to complete the work.
 1971          */
 1972         error = sc->malo_newstate(ic, nstate, arg);
 1973 
 1974         return error;
 1975 }
 1976 
 1977 static int
 1978 malo_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 1979         const struct ieee80211_bpf_params *params)
 1980 {
 1981         struct ieee80211com *ic = ni->ni_ic;
 1982         struct ifnet *ifp = ic->ic_ifp;
 1983         struct malo_softc *sc = ifp->if_softc;
 1984         struct malo_txbuf *bf;
 1985         struct malo_txq *txq;
 1986 
 1987         if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0 || sc->malo_invalid) {
 1988                 ieee80211_free_node(ni);
 1989                 m_freem(m);
 1990                 return ENETDOWN;
 1991         }
 1992 
 1993         /*
 1994          * Grab a TX buffer and associated resources.  Note that we depend
 1995          * on the classification by the 802.11 layer to get to the right h/w
 1996          * queue.  Management frames must ALWAYS go on queue 1 but we
 1997          * cannot just force that here because we may receive non-mgt frames.
 1998          */
 1999         txq = &sc->malo_txq[0];
 2000         bf = malo_getbuf(sc, txq);
 2001         if (bf == NULL) {
 2002                 /* XXX blocks other traffic */
 2003                 ifp->if_drv_flags |= IFF_DRV_OACTIVE;
 2004                 ieee80211_free_node(ni);
 2005                 m_freem(m);
 2006                 return ENOBUFS;
 2007         }
 2008 
 2009         /*
 2010          * Pass the frame to the h/w for transmission.
 2011          */
 2012         if (malo_tx_start(sc, ni, bf, m) != 0) {
 2013                 ifp->if_oerrors++;
 2014                 bf->bf_m = NULL;
 2015                 bf->bf_node = NULL;
 2016                 MALO_TXQ_LOCK(txq);
 2017                 STAILQ_INSERT_HEAD(&txq->free, bf, bf_list);
 2018                 txq->nfree++;
 2019                 MALO_TXQ_UNLOCK(txq);
 2020 
 2021                 ieee80211_free_node(ni);
 2022                 return EIO;             /* XXX */
 2023         }
 2024 
 2025         /*
 2026          * NB: We don't need to lock against tx done because this just
 2027          * prods the firmware to check the transmit descriptors.  The firmware
 2028          * will also start fetching descriptors by itself if it notices
 2029          * new ones are present when it goes to deliver a tx done interrupt
 2030          * to the host. So if we race with tx done processing it's ok.
 2031          * Delivering the kick here rather than in malo_tx_start is
 2032          * an optimization to avoid poking the firmware for each packet.
 2033          *
 2034          * NB: the queue id isn't used so 0 is ok.
 2035          */
 2036         malo_hal_txstart(sc->malo_mh, 0/*XXX*/);
 2037 
 2038         return 0;
 2039 }
 2040 
 2041 static int
 2042 malo_media_change(struct ifnet *ifp)
 2043 {
 2044 #define IS_UP(ifp) \
 2045         ((ifp->if_flags & IFF_UP) && (ifp->if_drv_flags & IFF_DRV_RUNNING))
 2046         int error;
 2047 
 2048         error = ieee80211_media_change(ifp);
 2049         if (error == ENETRESET) {
 2050                 struct malo_softc *sc = ifp->if_softc;
 2051 
 2052                 if (IS_UP(ifp))
 2053                         malo_init(sc);
 2054                 error = 0;
 2055         }
 2056         return error;
 2057 #undef IS_UP
 2058 }
 2059 
 2060 static void
 2061 malo_bpfattach(struct malo_softc *sc)
 2062 {
 2063         struct ifnet *ifp = sc->malo_ifp;
 2064 
 2065         bpfattach2(ifp, DLT_IEEE802_11_RADIO,
 2066             sizeof(struct ieee80211_frame) + sizeof(sc->malo_tx_th),
 2067             &sc->malo_drvbpf);
 2068 
 2069         /*
 2070          * Initialize constant fields.
 2071          * XXX make header lengths a multiple of 32-bits so subsequent
 2072          *     headers are properly aligned; this is a kludge to keep
 2073          *     certain applications happy.
 2074          *
 2075          * NB: the channel is setup each time we transition to the
 2076          *     RUN state to avoid filling it in for each frame.
 2077          */
 2078         sc->malo_tx_th_len = roundup(sizeof(sc->malo_tx_th), sizeof(uint32_t));
 2079         sc->malo_tx_th.wt_ihdr.it_len = htole16(sc->malo_tx_th_len);
 2080         sc->malo_tx_th.wt_ihdr.it_present = htole32(MALO_TX_RADIOTAP_PRESENT);
 2081 
 2082         sc->malo_rx_th_len = roundup(sizeof(sc->malo_rx_th), sizeof(uint32_t));
 2083         sc->malo_rx_th.wr_ihdr.it_len = htole16(sc->malo_rx_th_len);
 2084         sc->malo_rx_th.wr_ihdr.it_present = htole32(MALO_RX_RADIOTAP_PRESENT);
 2085 }
 2086 
 2087 static void
 2088 malo_sysctlattach(struct malo_softc *sc)
 2089 {
 2090 #ifdef  MALO_DEBUG
 2091         struct sysctl_ctx_list *ctx = device_get_sysctl_ctx(sc->malo_dev);
 2092         struct sysctl_oid *tree = device_get_sysctl_tree(sc->malo_dev);
 2093 
 2094         sc->malo_debug = malo_debug;
 2095         SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
 2096                 "debug", CTLFLAG_RW, &sc->malo_debug, 0,
 2097                 "control debugging printfs");
 2098 #endif
 2099 }
 2100 
 2101 static void
 2102 malo_announce(struct malo_softc *sc)
 2103 {
 2104         struct ifnet *ifp = sc->malo_ifp;
 2105 
 2106         if_printf(ifp, "versions [hw %d fw %d.%d.%d.%d] (regioncode %d)\n",
 2107                 sc->malo_hwspecs.hwversion,
 2108                 (sc->malo_hwspecs.fw_releasenum >> 24) & 0xff,
 2109                 (sc->malo_hwspecs.fw_releasenum >> 16) & 0xff,
 2110                 (sc->malo_hwspecs.fw_releasenum >> 8) & 0xff,
 2111                 (sc->malo_hwspecs.fw_releasenum >> 0) & 0xff,
 2112                 sc->malo_hwspecs.regioncode);
 2113 
 2114         if (bootverbose || malo_rxbuf != MALO_RXBUF)
 2115                 if_printf(ifp, "using %u rx buffers\n", malo_rxbuf);
 2116         if (bootverbose || malo_txbuf != MALO_TXBUF)
 2117                 if_printf(ifp, "using %u tx buffers\n", malo_txbuf);
 2118 }
 2119 
 2120 /*
 2121  * Convert net80211 channel to a HAL channel.
 2122  */
 2123 static void
 2124 malo_mapchan(struct malo_hal_channel *hc, const struct ieee80211_channel *chan)
 2125 {
 2126         hc->channel = chan->ic_ieee;
 2127 
 2128         *(uint32_t *)&hc->flags = 0;
 2129         if (IEEE80211_IS_CHAN_2GHZ(chan))
 2130                 hc->flags.freqband = MALO_FREQ_BAND_2DOT4GHZ;
 2131 }
 2132 
 2133 /*
 2134  * Set/change channels.  If the channel is really being changed,
 2135  * it's done by reseting the chip.  To accomplish this we must
 2136  * first cleanup any pending DMA, then restart stuff after a la
 2137  * malo_init.
 2138  */
 2139 static int
 2140 malo_chan_set(struct malo_softc *sc, struct ieee80211_channel *chan)
 2141 {
 2142         struct malo_hal *mh = sc->malo_mh;
 2143         struct malo_hal_channel hchan;
 2144 
 2145         DPRINTF(sc, MALO_DEBUG_RESET, "%s: chan %u MHz/flags 0x%x\n",
 2146             __func__, chan->ic_freq, chan->ic_flags);
 2147 
 2148         /*
 2149          * Convert to a HAL channel description with the flags constrained
 2150          * to reflect the current operating mode.
 2151          */
 2152         malo_mapchan(&hchan, chan);
 2153         malo_hal_intrset(mh, 0);                /* disable interrupts */
 2154         malo_hal_setchannel(mh, &hchan);
 2155         malo_hal_settxpower(mh, &hchan);
 2156 
 2157         /*
 2158          * Update internal state.
 2159          */
 2160         sc->malo_tx_th.wt_chan_freq = htole16(chan->ic_freq);
 2161         sc->malo_rx_th.wr_chan_freq = htole16(chan->ic_freq);
 2162         if (IEEE80211_IS_CHAN_ANYG(chan)) {
 2163                 sc->malo_tx_th.wt_chan_flags = htole16(IEEE80211_CHAN_G);
 2164                 sc->malo_rx_th.wr_chan_flags = htole16(IEEE80211_CHAN_G);
 2165         } else {
 2166                 sc->malo_tx_th.wt_chan_flags = htole16(IEEE80211_CHAN_B);
 2167                 sc->malo_rx_th.wr_chan_flags = htole16(IEEE80211_CHAN_B);
 2168         }
 2169         sc->malo_curchan = hchan;
 2170         malo_hal_intrset(mh, sc->malo_imask);
 2171 
 2172         return 0;
 2173 }
 2174 
 2175 static void
 2176 malo_scan_start(struct ieee80211com *ic)
 2177 {
 2178         struct ifnet *ifp = ic->ic_ifp;
 2179         struct malo_softc *sc = ifp->if_softc;
 2180 
 2181         DPRINTF(sc, MALO_DEBUG_STATE, "%s\n", __func__);
 2182 }
 2183 
 2184 static void
 2185 malo_scan_end(struct ieee80211com *ic)
 2186 {
 2187         struct ifnet *ifp = ic->ic_ifp;
 2188         struct malo_softc *sc = ifp->if_softc;
 2189 
 2190         DPRINTF(sc, MALO_DEBUG_STATE, "%s\n", __func__);
 2191 }
 2192 
 2193 static void
 2194 malo_set_channel(struct ieee80211com *ic)
 2195 {
 2196         struct ifnet *ifp = ic->ic_ifp;
 2197         struct malo_softc *sc = ifp->if_softc;
 2198 
 2199         (void) malo_chan_set(sc, ic->ic_curchan);
 2200 }
 2201 
 2202 static void
 2203 malo_rx_proc(void *arg, int npending)
 2204 {
 2205 #define IEEE80211_DIR_DSTODS(wh)                                        \
 2206         ((((const struct ieee80211_frame *)wh)->i_fc[1] &               \
 2207             IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS)
 2208         struct malo_softc *sc = arg;
 2209         struct malo_rxbuf *bf;
 2210         struct ieee80211com *ic = &sc->malo_ic;
 2211         struct ifnet *ifp = sc->malo_ifp;
 2212         struct malo_rxdesc *ds;
 2213         struct mbuf *m, *mnew;
 2214         struct ieee80211_qosframe *wh;
 2215         struct ieee80211_qosframe_addr4 *wh4;
 2216         struct ieee80211_node *ni;
 2217         int off, len, hdrlen, pktlen, rssi, ntodo;
 2218         uint8_t *data, status;
 2219         uint32_t readptr, writeptr;
 2220 
 2221         DPRINTF(sc, MALO_DEBUG_RX_PROC,
 2222             "%s: pending %u rdptr(0x%x) 0x%x wrptr(0x%x) 0x%x\n",
 2223             __func__, npending,
 2224             sc->malo_hwspecs.rxdesc_read,
 2225             malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_read),
 2226             sc->malo_hwspecs.rxdesc_write,
 2227             malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_write));
 2228 
 2229         readptr = malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_read);
 2230         writeptr = malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_write);
 2231         if (readptr == writeptr)
 2232                 return;
 2233 
 2234         bf = sc->malo_rxnext;
 2235         for (ntodo = malo_rxquota; ntodo > 0 && (readptr != writeptr);
 2236              ntodo--) {
 2237                 if (bf == NULL) {
 2238                         bf = STAILQ_FIRST(&sc->malo_rxbuf);
 2239                         break;
 2240                 }
 2241                 ds = bf->bf_desc;
 2242                 if (bf->bf_m == NULL) {
 2243                         /*
 2244                          * If data allocation failed previously there
 2245                          * will be no buffer; try again to re-populate it.
 2246                          * Note the firmware will not advance to the next
 2247                          * descriptor with a dma buffer so we must mimic
 2248                          * this or we'll get out of sync.
 2249                          */ 
 2250                         DPRINTF(sc, MALO_DEBUG_ANY,
 2251                             "%s: rx buf w/o dma memory\n", __func__);
 2252                         (void)malo_rxbuf_init(sc, bf);
 2253                         break;
 2254                 }
 2255                 MALO_RXDESC_SYNC(sc, ds,
 2256                     BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
 2257                 if (ds->rxcontrol != MALO_RXD_CTRL_DMA_OWN)
 2258                         break;
 2259 
 2260                 readptr = le32toh(ds->physnext);
 2261 
 2262 #ifdef MALO_DEBUG
 2263                 if (sc->malo_debug & MALO_DEBUG_RECV_DESC)
 2264                         malo_printrxbuf(bf, 0);
 2265 #endif
 2266                 status = ds->status;
 2267                 if (status & MALO_RXD_STATUS_DECRYPT_ERR_MASK) {
 2268                         ifp->if_ierrors++;
 2269                         goto rx_next;
 2270                 }
 2271                 /*
 2272                  * Sync the data buffer.
 2273                  */
 2274                 len = le16toh(ds->pktlen);
 2275                 bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap,
 2276                     BUS_DMASYNC_POSTREAD);
 2277                 /*
 2278                  * The 802.11 header is provided all or in part at the front;
 2279                  * use it to calculate the true size of the header that we'll
 2280                  * construct below.  We use this to figure out where to copy
 2281                  * payload prior to constructing the header.
 2282                  */
 2283                 m = bf->bf_m;
 2284                 data = mtod(m, uint8_t *);
 2285                 hdrlen = ieee80211_anyhdrsize(data + sizeof(uint16_t));
 2286                 off = sizeof(uint16_t) + sizeof(struct ieee80211_frame_addr4);
 2287 
 2288                 /*
 2289                  * Calculate RSSI.  XXX wrong
 2290                  */
 2291                 rssi = 2 * ((int) ds->snr - ds->nf);    /* NB: .5 dBm  */
 2292                 if (rssi > 100)
 2293                         rssi = 100;
 2294 
 2295                 pktlen = hdrlen + (len - off);
 2296                 /*
 2297                  * NB: we know our frame is at least as large as
 2298                  * IEEE80211_MIN_LEN because there is a 4-address frame at
 2299                  * the front.  Hence there's no need to vet the packet length.
 2300                  * If the frame in fact is too small it should be discarded
 2301                  * at the net80211 layer.
 2302                  */
 2303 
 2304                 /* XXX don't need mbuf, just dma buffer */
 2305                 mnew = malo_getrxmbuf(sc, bf);
 2306                 if (mnew == NULL) {
 2307                         ifp->if_ierrors++;
 2308                         goto rx_next;
 2309                 }
 2310                 
 2311                 /*
 2312                  * Attach the dma buffer to the mbuf; malo_rxbuf_init will
 2313                  * re-setup the rx descriptor using the replacement dma
 2314                  * buffer we just installed above.
 2315                  */
 2316                 bf->bf_m = mnew;
 2317                 m->m_data += off - hdrlen;
 2318                 m->m_pkthdr.len = m->m_len = pktlen;
 2319                 m->m_pkthdr.rcvif = ifp;
 2320 
 2321                 /*
 2322                  * Piece 802.11 header together.
 2323                  */
 2324                 wh = mtod(m, struct ieee80211_qosframe *);
 2325                 /* NB: don't need to do this sometimes but ... */
 2326                 /* XXX special case so we can memcpy after m_devget? */
 2327                 ovbcopy(data + sizeof(uint16_t), wh, hdrlen);
 2328                 if (IEEE80211_QOS_HAS_SEQ(wh)) {
 2329                         if (IEEE80211_DIR_DSTODS(wh)) {
 2330                                 wh4 = mtod(m,
 2331                                     struct ieee80211_qosframe_addr4*);
 2332                                 *(uint16_t *)wh4->i_qos = ds->qosctrl;
 2333                         } else {
 2334                                 *(uint16_t *)wh->i_qos = ds->qosctrl;
 2335                         }
 2336                 }
 2337                 if (sc->malo_drvbpf != NULL) {
 2338                         sc->malo_rx_th.wr_flags = 0;
 2339                         sc->malo_rx_th.wr_rate = ds->rate;
 2340                         sc->malo_rx_th.wr_antsignal = rssi;
 2341                         sc->malo_rx_th.wr_antnoise = ds->nf;
 2342 
 2343                         bpf_mtap2(sc->malo_drvbpf,
 2344                             &sc->malo_rx_th, sc->malo_rx_th_len, m);
 2345                 }
 2346 #ifdef MALO_DEBUG
 2347                 if (IFF_DUMPPKTS_RECV(sc, wh)) {
 2348                         ieee80211_dump_pkt(ic, mtod(m, caddr_t),
 2349                             len, ds->rate, rssi);
 2350                 }
 2351 #endif
 2352                 ifp->if_ipackets++;
 2353                 
 2354                 /* dispatch */
 2355                 ni = ieee80211_find_rxnode(ic,
 2356                     (const struct ieee80211_frame_min *) wh);
 2357                 (void) ieee80211_input(ic, m, ni, rssi, ds->nf, 0/*XXX*/);
 2358                 ieee80211_free_node(ni);
 2359 
 2360 rx_next:
 2361                 /* NB: ignore ENOMEM so we process more descriptors */
 2362                 (void) malo_rxbuf_init(sc, bf);
 2363                 bf = STAILQ_NEXT(bf, bf_list);
 2364         }
 2365         
 2366         malo_bar0_write4(sc, sc->malo_hwspecs.rxdesc_read, readptr);
 2367         sc->malo_rxnext = bf;
 2368 
 2369         if ((ifp->if_drv_flags & IFF_DRV_OACTIVE) == 0 &&
 2370             !IFQ_IS_EMPTY(&ifp->if_snd))
 2371                 malo_start(ifp);
 2372 #undef IEEE80211_DIR_DSTODS
 2373 }
 2374 
 2375 static void
 2376 malo_stop(struct ifnet *ifp, int disable)
 2377 {
 2378         struct malo_softc *sc = ifp->if_softc;
 2379 
 2380         MALO_LOCK(sc);
 2381 
 2382         malo_stop_locked(ifp, disable);
 2383 
 2384         MALO_UNLOCK(sc);
 2385 }
 2386 
 2387 /*
 2388  * Reclaim all tx queue resources.
 2389  */
 2390 static void
 2391 malo_tx_cleanup(struct malo_softc *sc)
 2392 {
 2393         int i;
 2394 
 2395         for (i = 0; i < MALO_NUM_TX_QUEUES; i++)
 2396                 malo_tx_cleanupq(sc, &sc->malo_txq[i]);
 2397 }
 2398 
 2399 int
 2400 malo_detach(struct malo_softc *sc)
 2401 {
 2402         struct ifnet *ifp = sc->malo_ifp;
 2403 
 2404         DPRINTF(sc, MALO_DEBUG_ANY, "%s: if_flags %x\n",
 2405                 __func__, ifp->if_flags);
 2406 
 2407         malo_stop(ifp, 1);
 2408 
 2409         if (sc->malo_tq != NULL) {
 2410                 taskqueue_drain(sc->malo_tq, &sc->malo_rxtask);
 2411                 taskqueue_drain(sc->malo_tq, &sc->malo_txtask);
 2412                 taskqueue_free(sc->malo_tq);
 2413                 sc->malo_tq = NULL;
 2414         }
 2415 
 2416         bpfdetach(ifp);
 2417 
 2418         /*
 2419          * NB: the order of these is important:
 2420          * o call the 802.11 layer before detaching the hal to
 2421          *   insure callbacks into the driver to delete global
 2422          *   key cache entries can be handled
 2423          * o reclaim the tx queue data structures after calling
 2424          *   the 802.11 layer as we'll get called back to reclaim
 2425          *   node state and potentially want to use them
 2426          * o to cleanup the tx queues the hal is called, so detach
 2427          *   it last
 2428          * Other than that, it's straightforward...
 2429          */
 2430         ieee80211_ifdetach(&sc->malo_ic);
 2431         malo_dma_cleanup(sc);
 2432         malo_tx_cleanup(sc);
 2433         malo_hal_detach(sc->malo_mh);
 2434         if_free(ifp);
 2435 
 2436         MALO_LOCK_DESTROY(sc);
 2437 
 2438         return 0;
 2439 }
 2440 
 2441 void
 2442 malo_shutdown(struct malo_softc *sc)
 2443 {
 2444 
 2445         malo_stop(sc->malo_ifp, 1);
 2446 }
 2447 
 2448 void
 2449 malo_suspend(struct malo_softc *sc)
 2450 {
 2451         struct ifnet *ifp = sc->malo_ifp;
 2452 
 2453         DPRINTF(sc, MALO_DEBUG_ANY, "%s: if_flags %x\n",
 2454                 __func__, ifp->if_flags);
 2455 
 2456         malo_stop(ifp, 1);
 2457 }
 2458 
 2459 void
 2460 malo_resume(struct malo_softc *sc)
 2461 {
 2462         struct ifnet *ifp = sc->malo_ifp;
 2463 
 2464         DPRINTF(sc, MALO_DEBUG_ANY, "%s: if_flags %x\n",
 2465                 __func__, ifp->if_flags);
 2466 
 2467         if (ifp->if_flags & IFF_UP) {
 2468                 malo_init(sc);
 2469                 if (ifp->if_drv_flags & IFF_DRV_RUNNING)
 2470                         malo_start(ifp);
 2471         }
 2472 }

Cache object: 0165e66875ac4f0fafab747aee20dcda


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.