The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/dev/malo/if_malo.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (c) 2008 Weongyo Jeong <weongyo@freebsd.org>
    3  * Copyright (c) 2007 Marvell Semiconductor, Inc.
    4  * Copyright (c) 2007 Sam Leffler, Errno Consulting
    5  * All rights reserved.
    6  *
    7  * Redistribution and use in source and binary forms, with or without
    8  * modification, are permitted provided that the following conditions
    9  * are met:
   10  * 1. Redistributions of source code must retain the above copyright
   11  *    notice, this list of conditions and the following disclaimer,
   12  *    without modification.
   13  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
   14  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
   15  *    redistribution must be conditioned upon including a substantially
   16  *    similar Disclaimer requirement for further binary redistribution.
   17  *
   18  * NO WARRANTY
   19  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
   20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
   21  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
   22  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
   23  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
   24  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
   25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
   26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
   27  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
   28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
   29  * THE POSSIBILITY OF SUCH DAMAGES.
   30  */
   31 
   32 #include <sys/cdefs.h>
   33 #ifdef __FreeBSD__
   34 __FBSDID("$FreeBSD$");
   35 #endif
   36 
   37 #include <sys/param.h>
   38 #include <sys/endian.h>
   39 #include <sys/kernel.h>
   40 #include <sys/socket.h>
   41 #include <sys/sockio.h>
   42 #include <sys/sysctl.h>
   43 #include <sys/taskqueue.h>
   44 
   45 #include <machine/bus.h>
   46 #include <sys/bus.h>
   47 
   48 #include <net/if.h>
   49 #include <net/if_dl.h>
   50 #include <net/if_media.h>
   51 #include <net/if_types.h>
   52 #include <net/ethernet.h>
   53 
   54 #include <net80211/ieee80211_var.h>
   55 #include <net80211/ieee80211_regdomain.h>
   56 
   57 #include <net/bpf.h>
   58 
   59 #include <dev/malo/if_malo.h>
   60 
   61 SYSCTL_NODE(_hw, OID_AUTO, malo, CTLFLAG_RD, 0,
   62     "Marvell 88w8335 driver parameters");
   63 
   64 static  int malo_txcoalesce = 8;        /* # tx pkts to q before poking f/w*/
   65 SYSCTL_INT(_hw_malo, OID_AUTO, txcoalesce, CTLFLAG_RW, &malo_txcoalesce,
   66             0, "tx buffers to send at once");
   67 TUNABLE_INT("hw.malo.txcoalesce", &malo_txcoalesce);
   68 static  int malo_rxbuf = MALO_RXBUF;            /* # rx buffers to allocate */
   69 SYSCTL_INT(_hw_malo, OID_AUTO, rxbuf, CTLFLAG_RW, &malo_rxbuf,
   70             0, "rx buffers allocated");
   71 TUNABLE_INT("hw.malo.rxbuf", &malo_rxbuf);
   72 static  int malo_rxquota = MALO_RXBUF;          /* # max buffers to process */
   73 SYSCTL_INT(_hw_malo, OID_AUTO, rxquota, CTLFLAG_RW, &malo_rxquota,
   74             0, "max rx buffers to process per interrupt");
   75 TUNABLE_INT("hw.malo.rxquota", &malo_rxquota);
   76 static  int malo_txbuf = MALO_TXBUF;            /* # tx buffers to allocate */
   77 SYSCTL_INT(_hw_malo, OID_AUTO, txbuf, CTLFLAG_RW, &malo_txbuf,
   78             0, "tx buffers allocated");
   79 TUNABLE_INT("hw.malo.txbuf", &malo_txbuf);
   80 
   81 #ifdef MALO_DEBUG
   82 static  int malo_debug = 0;
   83 SYSCTL_INT(_hw_malo, OID_AUTO, debug, CTLFLAG_RW, &malo_debug,
   84             0, "control debugging printfs");
   85 TUNABLE_INT("hw.malo.debug", &malo_debug);
   86 enum {
   87         MALO_DEBUG_XMIT         = 0x00000001,   /* basic xmit operation */
   88         MALO_DEBUG_XMIT_DESC    = 0x00000002,   /* xmit descriptors */
   89         MALO_DEBUG_RECV         = 0x00000004,   /* basic recv operation */
   90         MALO_DEBUG_RECV_DESC    = 0x00000008,   /* recv descriptors */
   91         MALO_DEBUG_RESET        = 0x00000010,   /* reset processing */
   92         MALO_DEBUG_INTR         = 0x00000040,   /* ISR */
   93         MALO_DEBUG_TX_PROC      = 0x00000080,   /* tx ISR proc */
   94         MALO_DEBUG_RX_PROC      = 0x00000100,   /* rx ISR proc */
   95         MALO_DEBUG_STATE        = 0x00000400,   /* 802.11 state transitions */
   96         MALO_DEBUG_NODE         = 0x00000800,   /* node management */
   97         MALO_DEBUG_RECV_ALL     = 0x00001000,   /* trace all frames (beacons) */
   98         MALO_DEBUG_FW           = 0x00008000,   /* firmware */
   99         MALO_DEBUG_ANY          = 0xffffffff
  100 };
  101 #define IS_BEACON(wh)                                                   \
  102         ((wh->i_fc[0] & (IEEE80211_FC0_TYPE_MASK |                      \
  103                 IEEE80211_FC0_SUBTYPE_MASK)) ==                         \
  104          (IEEE80211_FC0_TYPE_MGT|IEEE80211_FC0_SUBTYPE_BEACON))
  105 #define IFF_DUMPPKTS_RECV(sc, wh)                                       \
  106         (((sc->malo_debug & MALO_DEBUG_RECV) &&                         \
  107           ((sc->malo_debug & MALO_DEBUG_RECV_ALL) || !IS_BEACON(wh))) || \
  108          (sc->malo_ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==            \
  109           (IFF_DEBUG|IFF_LINK2))
  110 #define IFF_DUMPPKTS_XMIT(sc)                                           \
  111         ((sc->malo_debug & MALO_DEBUG_XMIT) ||                          \
  112          (sc->malo_ifp->if_flags & (IFF_DEBUG | IFF_LINK2)) ==          \
  113              (IFF_DEBUG | IFF_LINK2))
  114 #define DPRINTF(sc, m, fmt, ...) do {                           \
  115         if (sc->malo_debug & (m))                               \
  116                 printf(fmt, __VA_ARGS__);                       \
  117 } while (0)
  118 #else
  119 #define DPRINTF(sc, m, fmt, ...) do {                           \
  120         (void) sc;                                              \
  121 } while (0)
  122 #endif
  123 
  124 MALLOC_DEFINE(M_MALODEV, "malodev", "malo driver dma buffers");
  125 
  126 static  int     malo_dma_setup(struct malo_softc *);
  127 static  int     malo_setup_hwdma(struct malo_softc *);
  128 static  void    malo_txq_init(struct malo_softc *, struct malo_txq *, int);
  129 static  void    malo_tx_cleanupq(struct malo_softc *, struct malo_txq *);
  130 static  void    malo_start(struct ifnet *);
  131 static  void    malo_watchdog(void *);
  132 static  int     malo_ioctl(struct ifnet *, u_long, caddr_t);
  133 static  void    malo_updateslot(struct ifnet *);
  134 static  int     malo_newstate(struct ieee80211com *, enum ieee80211_state, int);
  135 static  void    malo_scan_start(struct ieee80211com *);
  136 static  void    malo_scan_end(struct ieee80211com *);
  137 static  void    malo_set_channel(struct ieee80211com *);
  138 static  int     malo_raw_xmit(struct ieee80211_node *, struct mbuf *,
  139                     const struct ieee80211_bpf_params *);
  140 static  int     malo_media_change(struct ifnet *);
  141 static  void    malo_bpfattach(struct malo_softc *);
  142 static  void    malo_sysctlattach(struct malo_softc *);
  143 static  void    malo_announce(struct malo_softc *);
  144 static  void    malo_dma_cleanup(struct malo_softc *);
  145 static  void    malo_stop_locked(struct ifnet *, int);
  146 static  int     malo_chan_set(struct malo_softc *, struct ieee80211_channel *);
  147 static  int     malo_mode_init(struct malo_softc *);
  148 static  void    malo_tx_proc(void *, int);
  149 static  void    malo_rx_proc(void *, int);
  150 static  void    malo_init(void *);
  151 
  152 /*
  153  * Read/Write shorthands for accesses to BAR 0.  Note that all BAR 1
  154  * operations are done in the "hal" except getting H/W MAC address at
  155  * malo_attach and there should be no reference to them here.
  156  */
  157 static uint32_t
  158 malo_bar0_read4(struct malo_softc *sc, bus_size_t off)
  159 {
  160         return bus_space_read_4(sc->malo_io0t, sc->malo_io0h, off);
  161 }
  162 
  163 static void
  164 malo_bar0_write4(struct malo_softc *sc, bus_size_t off, uint32_t val)
  165 {
  166         DPRINTF(sc, MALO_DEBUG_FW, "%s: off 0x%x val 0x%x\n",
  167             __func__, off, val);
  168 
  169         bus_space_write_4(sc->malo_io0t, sc->malo_io0h, off, val);
  170 }
  171 
  172 static uint8_t
  173 malo_bar1_read1(struct malo_softc *sc, bus_size_t off)
  174 {
  175         return bus_space_read_1(sc->malo_io1t, sc->malo_io1h, off);
  176 }
  177 
  178 int
  179 malo_attach(uint16_t devid, struct malo_softc *sc)
  180 {
  181         int error, i;
  182         struct ieee80211com *ic = &sc->malo_ic;
  183         struct ifnet *ifp;
  184         struct malo_hal *mh;
  185         uint8_t bands;
  186 
  187         ifp = sc->malo_ifp = if_alloc(IFT_ETHER);
  188         if (ifp == NULL) {
  189                 device_printf(sc->malo_dev, "can not if_alloc()\n");
  190                 return ENOSPC;
  191         }
  192 
  193         MALO_LOCK_INIT(sc);
  194         callout_init_mtx(&sc->malo_watchdog_timer, &sc->malo_mtx, 0);
  195 
  196         /* set these up early for if_printf use */
  197         if_initname(ifp, device_get_name(sc->malo_dev),
  198             device_get_unit(sc->malo_dev));
  199 
  200         /*
  201          * NB: get mac address from hardware directly here before we set DMAs
  202          * for HAL because we don't want to disturb operations of HAL at BAR 1.
  203          */
  204         for (i = 0; i < IEEE80211_ADDR_LEN; i++) {
  205                 /* XXX remove a magic number but we don't have documents.  */
  206                 ic->ic_myaddr[i] = malo_bar1_read1(sc, 0xa528 + i);
  207                 DELAY(1000);
  208         }
  209 
  210         mh = malo_hal_attach(sc->malo_dev, devid,
  211             sc->malo_io1h, sc->malo_io1t, sc->malo_dmat);
  212         if (mh == NULL) {
  213                 if_printf(ifp, "unable to attach HAL\n");
  214                 error = EIO;
  215                 goto bad;
  216         }
  217         sc->malo_mh = mh;
  218 
  219         sc->malo_txantenna = 0x2;       /* h/w default */
  220         sc->malo_rxantenna = 0xffff;    /* h/w default */
  221 
  222         /*
  223          * Allocate tx + rx descriptors and populate the lists.
  224          * We immediately push the information to the firmware
  225          * as otherwise it gets upset.
  226          */
  227         error = malo_dma_setup(sc);
  228         if (error != 0) {
  229                 if_printf(ifp, "failed to setup descriptors: %d\n", error);
  230                 goto bad1;
  231         }
  232 
  233         sc->malo_tq = taskqueue_create_fast("malo_taskq", M_NOWAIT,
  234                 taskqueue_thread_enqueue, &sc->malo_tq);
  235         taskqueue_start_threads(&sc->malo_tq, 1, PI_NET,
  236                 "%s taskq", ifp->if_xname);
  237 
  238         TASK_INIT(&sc->malo_rxtask, 0, malo_rx_proc, sc);
  239         TASK_INIT(&sc->malo_txtask, 0, malo_tx_proc, sc);
  240 
  241         ifp->if_softc = sc;
  242         ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST;
  243         ifp->if_start = malo_start;
  244         ifp->if_ioctl = malo_ioctl;
  245         ifp->if_init = malo_init;
  246         IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
  247         ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
  248         IFQ_SET_READY(&ifp->if_snd);
  249 
  250         /* NB: firmware looks that it does not export regdomain info API.  */
  251         bands = 0;
  252         setbit(&bands, IEEE80211_MODE_11B);
  253         setbit(&bands, IEEE80211_MODE_11G);
  254         ieee80211_init_channels(ic, 0, CTRY_DEFAULT, bands, 0, 1);
  255 
  256         ic->ic_ifp = ifp;
  257         /* XXX not right but it's not used anywhere important */
  258         ic->ic_phytype = IEEE80211_T_OFDM;
  259         ic->ic_opmode = IEEE80211_M_STA;
  260         ic->ic_caps =
  261               IEEE80211_C_BGSCAN                /* capable of bg scanning */
  262             | IEEE80211_C_MONITOR               /* monitor mode */
  263             | IEEE80211_C_SHPREAMBLE            /* short preamble supported */
  264             | IEEE80211_C_SHSLOT                /* short slot time supported */
  265             | IEEE80211_C_TXPMGT                /* capable of txpow mgt */
  266             | IEEE80211_C_WPA                   /* capable of WPA1+WPA2 */
  267             ;
  268 
  269         /*
  270          * Transmit requires space in the packet for a special format transmit
  271          * record and optional padding between this record and the payload.
  272          * Ask the net80211 layer to arrange this when encapsulating
  273          * packets so we can add it efficiently. 
  274          */
  275         ic->ic_headroom = sizeof(struct malo_txrec) -
  276             sizeof(struct ieee80211_frame);
  277 
  278         /* call MI attach routine. */
  279         ieee80211_ifattach(ic);
  280         /* override default methods */
  281         ic->ic_updateslot = malo_updateslot;
  282         ic->ic_raw_xmit = malo_raw_xmit;
  283 
  284         sc->malo_newstate = ic->ic_newstate;
  285         ic->ic_newstate = malo_newstate;
  286 
  287         ic->ic_scan_start = malo_scan_start;
  288         ic->ic_scan_end = malo_scan_end;
  289         ic->ic_set_channel = malo_set_channel;
  290 
  291         /* complete initialization */
  292         ieee80211_media_init(ic, malo_media_change, ieee80211_media_status);
  293 
  294         sc->malo_invalid = 0;           /* ready to go, enable int handling */
  295 
  296         malo_bpfattach(sc);
  297 
  298         /*
  299          * Setup dynamic sysctl's.
  300          */
  301         malo_sysctlattach(sc);
  302 
  303         if (bootverbose)
  304                 ieee80211_announce(ic);
  305 
  306         return 0;
  307 bad1:
  308         malo_hal_detach(mh);
  309 bad:
  310         if_free(ifp);
  311         sc->malo_invalid = 1;
  312 
  313         return error;
  314 }
  315 
  316 int
  317 malo_intr(void *arg)
  318 {
  319         struct malo_softc *sc = arg;
  320         struct malo_hal *mh = sc->malo_mh;
  321         uint32_t status;
  322 
  323         if (sc->malo_invalid) {
  324                 /*
  325                  * The hardware is not ready/present, don't touch anything.
  326                  * Note this can happen early on if the IRQ is shared.
  327                  */
  328                 DPRINTF(sc, MALO_DEBUG_ANY, "%s: invalid; ignored\n", __func__);
  329                 return (FILTER_STRAY);
  330         }
  331 
  332         /*
  333          * Figure out the reason(s) for the interrupt.
  334          */
  335         malo_hal_getisr(mh, &status);           /* NB: clears ISR too */
  336         if (status == 0)                        /* must be a shared irq */
  337                 return (FILTER_STRAY);
  338 
  339         DPRINTF(sc, MALO_DEBUG_INTR, "%s: status 0x%x imask 0x%x\n",
  340             __func__, status, sc->malo_imask);
  341 
  342         if (status & MALO_A2HRIC_BIT_RX_RDY)
  343                 taskqueue_enqueue_fast(sc->malo_tq, &sc->malo_rxtask);
  344         if (status & MALO_A2HRIC_BIT_TX_DONE)
  345                 taskqueue_enqueue_fast(sc->malo_tq, &sc->malo_txtask);
  346         if (status & MALO_A2HRIC_BIT_OPC_DONE)
  347                 malo_hal_cmddone(mh);
  348         if (status & MALO_A2HRIC_BIT_MAC_EVENT)
  349                 ;
  350         if (status & MALO_A2HRIC_BIT_RX_PROBLEM)
  351                 ;
  352         if (status & MALO_A2HRIC_BIT_ICV_ERROR) {
  353                 /* TKIP ICV error */
  354                 sc->malo_stats.mst_rx_badtkipicv++;
  355         }
  356 
  357 #ifdef MALO_DEBUG
  358         if (((status | sc->malo_imask) ^ sc->malo_imask) != 0)
  359                 DPRINTF(sc, MALO_DEBUG_INTR,
  360                     "%s: can't handle interrupt status 0x%x\n",
  361                     __func__, status);
  362 #endif
  363 
  364         return (FILTER_HANDLED);
  365 }
  366 
  367 static void
  368 malo_load_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
  369 {
  370         bus_addr_t *paddr = (bus_addr_t*) arg;
  371 
  372         KASSERT(error == 0, ("error %u on bus_dma callback", error));
  373 
  374         *paddr = segs->ds_addr;
  375 }
  376 
  377 static int
  378 malo_desc_setup(struct malo_softc *sc, const char *name,
  379     struct malo_descdma *dd,
  380     int nbuf, size_t bufsize, int ndesc, size_t descsize)
  381 {
  382         int error;
  383         struct ifnet *ifp = sc->malo_ifp;
  384         uint8_t *ds;
  385 
  386         DPRINTF(sc, MALO_DEBUG_RESET,
  387             "%s: %s DMA: %u bufs (%ju) %u desc/buf (%ju)\n",
  388             __func__, name, nbuf, (uintmax_t) bufsize,
  389             ndesc, (uintmax_t) descsize);
  390         
  391         dd->dd_name = name;
  392         dd->dd_desc_len = nbuf * ndesc * descsize;
  393 
  394         /*
  395          * Setup DMA descriptor area.
  396          */
  397         error = bus_dma_tag_create(bus_get_dma_tag(sc->malo_dev),/* parent */
  398                        PAGE_SIZE, 0,            /* alignment, bounds */
  399                        BUS_SPACE_MAXADDR_32BIT, /* lowaddr */
  400                        BUS_SPACE_MAXADDR,       /* highaddr */
  401                        NULL, NULL,              /* filter, filterarg */
  402                        dd->dd_desc_len,         /* maxsize */
  403                        1,                       /* nsegments */
  404                        dd->dd_desc_len,         /* maxsegsize */
  405                        BUS_DMA_ALLOCNOW,        /* flags */
  406                        NULL,                    /* lockfunc */
  407                        NULL,                    /* lockarg */
  408                        &dd->dd_dmat);
  409         if (error != 0) {
  410                 if_printf(ifp, "cannot allocate %s DMA tag\n", dd->dd_name);
  411                 return error;
  412         }
  413         
  414         /* allocate descriptors */
  415         error = bus_dmamap_create(dd->dd_dmat, BUS_DMA_NOWAIT, &dd->dd_dmamap);
  416         if (error != 0) {
  417                 if_printf(ifp, "unable to create dmamap for %s descriptors, "
  418                     "error %u\n", dd->dd_name, error);
  419                 goto fail0;
  420         }
  421         
  422         error = bus_dmamem_alloc(dd->dd_dmat, (void**) &dd->dd_desc,
  423             BUS_DMA_NOWAIT | BUS_DMA_COHERENT, &dd->dd_dmamap);
  424         if (error != 0) {
  425                 if_printf(ifp, "unable to alloc memory for %u %s descriptors, "
  426                     "error %u\n", nbuf * ndesc, dd->dd_name, error);
  427                 goto fail1;
  428         }
  429 
  430         error = bus_dmamap_load(dd->dd_dmat, dd->dd_dmamap,
  431             dd->dd_desc, dd->dd_desc_len,
  432             malo_load_cb, &dd->dd_desc_paddr, BUS_DMA_NOWAIT);
  433         if (error != 0) {
  434                 if_printf(ifp, "unable to map %s descriptors, error %u\n",
  435                     dd->dd_name, error);
  436                 goto fail2;
  437         }
  438         
  439         ds = dd->dd_desc;
  440         memset(ds, 0, dd->dd_desc_len);
  441         DPRINTF(sc, MALO_DEBUG_RESET, "%s: %s DMA map: %p (%lu) -> %p (%lu)\n",
  442             __func__, dd->dd_name, ds, (u_long) dd->dd_desc_len,
  443             (caddr_t) dd->dd_desc_paddr, /*XXX*/ (u_long) dd->dd_desc_len);
  444 
  445         return 0;
  446 fail2:
  447         bus_dmamem_free(dd->dd_dmat, dd->dd_desc, dd->dd_dmamap);
  448 fail1:
  449         bus_dmamap_destroy(dd->dd_dmat, dd->dd_dmamap);
  450 fail0:
  451         bus_dma_tag_destroy(dd->dd_dmat);
  452         memset(dd, 0, sizeof(*dd));
  453         return error;
  454 }
  455 
  456 #define DS2PHYS(_dd, _ds) \
  457         ((_dd)->dd_desc_paddr + ((caddr_t)(_ds) - (caddr_t)(_dd)->dd_desc))
  458 
  459 static int
  460 malo_rxdma_setup(struct malo_softc *sc)
  461 {
  462         struct ifnet *ifp = sc->malo_ifp;
  463         int error, bsize, i;
  464         struct malo_rxbuf *bf;
  465         struct malo_rxdesc *ds;
  466 
  467         error = malo_desc_setup(sc, "rx", &sc->malo_rxdma,
  468             malo_rxbuf, sizeof(struct malo_rxbuf),
  469             1, sizeof(struct malo_rxdesc));
  470         if (error != 0)
  471                 return error;
  472 
  473         /*
  474          * Allocate rx buffers and set them up.
  475          */
  476         bsize = malo_rxbuf * sizeof(struct malo_rxbuf);
  477         bf = malloc(bsize, M_MALODEV, M_NOWAIT | M_ZERO);
  478         if (bf == NULL) {
  479                 if_printf(ifp, "malloc of %u rx buffers failed\n", bsize);
  480                 return error;
  481         }
  482         sc->malo_rxdma.dd_bufptr = bf;
  483         
  484         STAILQ_INIT(&sc->malo_rxbuf);
  485         ds = sc->malo_rxdma.dd_desc;
  486         for (i = 0; i < malo_rxbuf; i++, bf++, ds++) {
  487                 bf->bf_desc = ds;
  488                 bf->bf_daddr = DS2PHYS(&sc->malo_rxdma, ds);
  489                 error = bus_dmamap_create(sc->malo_dmat, BUS_DMA_NOWAIT,
  490                     &bf->bf_dmamap);
  491                 if (error != 0) {
  492                         if_printf(ifp, "%s: unable to dmamap for rx buffer, "
  493                             "error %d\n", __func__, error);
  494                         return error;
  495                 }
  496                 /* NB: tail is intentional to preserve descriptor order */
  497                 STAILQ_INSERT_TAIL(&sc->malo_rxbuf, bf, bf_list);
  498         }
  499         return 0;
  500 }
  501 
  502 static int
  503 malo_txdma_setup(struct malo_softc *sc, struct malo_txq *txq)
  504 {
  505         struct ifnet *ifp = sc->malo_ifp;
  506         int error, bsize, i;
  507         struct malo_txbuf *bf;
  508         struct malo_txdesc *ds;
  509 
  510         error = malo_desc_setup(sc, "tx", &txq->dma,
  511             malo_txbuf, sizeof(struct malo_txbuf),
  512             MALO_TXDESC, sizeof(struct malo_txdesc));
  513         if (error != 0)
  514                 return error;
  515         
  516         /* allocate and setup tx buffers */
  517         bsize = malo_txbuf * sizeof(struct malo_txbuf);
  518         bf = malloc(bsize, M_MALODEV, M_NOWAIT | M_ZERO);
  519         if (bf == NULL) {
  520                 if_printf(ifp, "malloc of %u tx buffers failed\n",
  521                     malo_txbuf);
  522                 return ENOMEM;
  523         }
  524         txq->dma.dd_bufptr = bf;
  525         
  526         STAILQ_INIT(&txq->free);
  527         txq->nfree = 0;
  528         ds = txq->dma.dd_desc;
  529         for (i = 0; i < malo_txbuf; i++, bf++, ds += MALO_TXDESC) {
  530                 bf->bf_desc = ds;
  531                 bf->bf_daddr = DS2PHYS(&txq->dma, ds);
  532                 error = bus_dmamap_create(sc->malo_dmat, BUS_DMA_NOWAIT,
  533                     &bf->bf_dmamap);
  534                 if (error != 0) {
  535                         if_printf(ifp, "unable to create dmamap for tx "
  536                             "buffer %u, error %u\n", i, error);
  537                         return error;
  538                 }
  539                 STAILQ_INSERT_TAIL(&txq->free, bf, bf_list);
  540                 txq->nfree++;
  541         }
  542 
  543         return 0;
  544 }
  545 
  546 static void
  547 malo_desc_cleanup(struct malo_softc *sc, struct malo_descdma *dd)
  548 {
  549         bus_dmamap_unload(dd->dd_dmat, dd->dd_dmamap);
  550         bus_dmamem_free(dd->dd_dmat, dd->dd_desc, dd->dd_dmamap);
  551         bus_dmamap_destroy(dd->dd_dmat, dd->dd_dmamap);
  552         bus_dma_tag_destroy(dd->dd_dmat);
  553 
  554         memset(dd, 0, sizeof(*dd));
  555 }
  556 
  557 static void
  558 malo_rxdma_cleanup(struct malo_softc *sc)
  559 {
  560         struct malo_rxbuf *bf;
  561 
  562         STAILQ_FOREACH(bf, &sc->malo_rxbuf, bf_list) {
  563                 if (bf->bf_m != NULL) {
  564                         m_freem(bf->bf_m);
  565                         bf->bf_m = NULL;
  566                 }
  567                 if (bf->bf_dmamap != NULL) {
  568                         bus_dmamap_destroy(sc->malo_dmat, bf->bf_dmamap);
  569                         bf->bf_dmamap = NULL;
  570                 }
  571         }
  572         STAILQ_INIT(&sc->malo_rxbuf);
  573         if (sc->malo_rxdma.dd_bufptr != NULL) {
  574                 free(sc->malo_rxdma.dd_bufptr, M_MALODEV);
  575                 sc->malo_rxdma.dd_bufptr = NULL;
  576         }
  577         if (sc->malo_rxdma.dd_desc_len != 0)
  578                 malo_desc_cleanup(sc, &sc->malo_rxdma);
  579 }
  580 
  581 static void
  582 malo_txdma_cleanup(struct malo_softc *sc, struct malo_txq *txq)
  583 {
  584         struct malo_txbuf *bf;
  585         struct ieee80211_node *ni;
  586 
  587         STAILQ_FOREACH(bf, &txq->free, bf_list) {
  588                 if (bf->bf_m != NULL) {
  589                         m_freem(bf->bf_m);
  590                         bf->bf_m = NULL;
  591                 }
  592                 ni = bf->bf_node;
  593                 bf->bf_node = NULL;
  594                 if (ni != NULL) {
  595                         /*
  596                          * Reclaim node reference.
  597                          */
  598                         ieee80211_free_node(ni);
  599                 }
  600                 if (bf->bf_dmamap != NULL) {
  601                         bus_dmamap_destroy(sc->malo_dmat, bf->bf_dmamap);
  602                         bf->bf_dmamap = NULL;
  603                 }
  604         }
  605         STAILQ_INIT(&txq->free);
  606         txq->nfree = 0;
  607         if (txq->dma.dd_bufptr != NULL) {
  608                 free(txq->dma.dd_bufptr, M_MALODEV);
  609                 txq->dma.dd_bufptr = NULL;
  610         }
  611         if (txq->dma.dd_desc_len != 0)
  612                 malo_desc_cleanup(sc, &txq->dma);
  613 }
  614 
  615 static void
  616 malo_dma_cleanup(struct malo_softc *sc)
  617 {
  618         int i;
  619 
  620         for (i = 0; i < MALO_NUM_TX_QUEUES; i++)
  621                 malo_txdma_cleanup(sc, &sc->malo_txq[i]);
  622 
  623         malo_rxdma_cleanup(sc);
  624 }
  625 
  626 static int
  627 malo_dma_setup(struct malo_softc *sc)
  628 {
  629         int error, i;
  630 
  631         /* rxdma initializing.  */
  632         error = malo_rxdma_setup(sc);
  633         if (error != 0)
  634                 return error;
  635 
  636         /* NB: we just have 1 tx queue now.  */
  637         for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
  638                 error = malo_txdma_setup(sc, &sc->malo_txq[i]);
  639                 if (error != 0) {
  640                         malo_dma_cleanup(sc);
  641 
  642                         return error;
  643                 }
  644 
  645                 malo_txq_init(sc, &sc->malo_txq[i], i);
  646         }
  647 
  648         return 0;
  649 }
  650 
  651 static void
  652 malo_hal_set_rxtxdma(struct malo_softc *sc)
  653 {
  654         int i;
  655 
  656         malo_bar0_write4(sc, sc->malo_hwspecs.rxdesc_read,
  657             sc->malo_hwdma.rxdesc_read);
  658         malo_bar0_write4(sc, sc->malo_hwspecs.rxdesc_write,
  659             sc->malo_hwdma.rxdesc_read);
  660 
  661         for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
  662                 malo_bar0_write4(sc,
  663                     sc->malo_hwspecs.wcbbase[i], sc->malo_hwdma.wcbbase[i]);
  664         }
  665 }
  666 
  667 /*
  668  * Inform firmware of our tx/rx dma setup.  The BAR 0 writes below are
  669  * for compatibility with older firmware.  For current firmware we send
  670  * this information with a cmd block via malo_hal_sethwdma.
  671  */
  672 static int
  673 malo_setup_hwdma(struct malo_softc *sc)
  674 {
  675         int i;
  676         struct malo_txq *txq;
  677 
  678         sc->malo_hwdma.rxdesc_read = sc->malo_rxdma.dd_desc_paddr;
  679 
  680         for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
  681                 txq = &sc->malo_txq[i];
  682                 sc->malo_hwdma.wcbbase[i] = txq->dma.dd_desc_paddr;
  683         }
  684         sc->malo_hwdma.maxnum_txwcb = malo_txbuf;
  685         sc->malo_hwdma.maxnum_wcb = MALO_NUM_TX_QUEUES;
  686 
  687         malo_hal_set_rxtxdma(sc);
  688 
  689         return 0;
  690 }
  691 
  692 static void
  693 malo_txq_init(struct malo_softc *sc, struct malo_txq *txq, int qnum)
  694 {
  695         struct malo_txbuf *bf, *bn;
  696         struct malo_txdesc *ds;
  697 
  698         MALO_TXQ_LOCK_INIT(sc, txq);
  699         txq->qnum = qnum;
  700         txq->txpri = 0; /* XXX */
  701 
  702         STAILQ_FOREACH(bf, &txq->free, bf_list) {
  703                 bf->bf_txq = txq;
  704 
  705                 ds = bf->bf_desc;
  706                 bn = STAILQ_NEXT(bf, bf_list);
  707                 if (bn == NULL)
  708                         bn = STAILQ_FIRST(&txq->free);
  709                 ds->physnext = htole32(bn->bf_daddr);
  710         }
  711         STAILQ_INIT(&txq->active);
  712 }
  713 
  714 /*
  715  * Reclaim resources for a setup queue.
  716  */
  717 static void
  718 malo_tx_cleanupq(struct malo_softc *sc, struct malo_txq *txq)
  719 {
  720         /* XXX hal work? */
  721         MALO_TXQ_LOCK_DESTROY(txq);
  722 }
  723 
  724 /*
  725  * Allocate a tx buffer for sending a frame.
  726  */
  727 static struct malo_txbuf *
  728 malo_getbuf(struct malo_softc *sc, struct malo_txq *txq)
  729 {
  730         struct malo_txbuf *bf;
  731 
  732         MALO_TXQ_LOCK(txq);
  733         bf = STAILQ_FIRST(&txq->free);
  734         if (bf != NULL) {
  735                 STAILQ_REMOVE_HEAD(&txq->free, bf_list);
  736                 txq->nfree--;
  737         }
  738         MALO_TXQ_UNLOCK(txq);
  739         if (bf == NULL) {
  740                 DPRINTF(sc, MALO_DEBUG_XMIT,
  741                     "%s: out of xmit buffers on q %d\n", __func__, txq->qnum);
  742                 sc->malo_stats.mst_tx_qstop++;
  743         }
  744         return bf;
  745 }
  746 
  747 static int
  748 malo_tx_dmasetup(struct malo_softc *sc, struct malo_txbuf *bf, struct mbuf *m0)
  749 {
  750         struct mbuf *m;
  751         int error;
  752 
  753         /*
  754          * Load the DMA map so any coalescing is done.  This also calculates
  755          * the number of descriptors we need.
  756          */
  757         error = bus_dmamap_load_mbuf_sg(sc->malo_dmat, bf->bf_dmamap, m0,
  758                                      bf->bf_segs, &bf->bf_nseg,
  759                                      BUS_DMA_NOWAIT);
  760         if (error == EFBIG) {
  761                 /* XXX packet requires too many descriptors */
  762                 bf->bf_nseg = MALO_TXDESC + 1;
  763         } else if (error != 0) {
  764                 sc->malo_stats.mst_tx_busdma++;
  765                 m_freem(m0);
  766                 return error;
  767         }
  768         /*
  769          * Discard null packets and check for packets that require too many
  770          * TX descriptors.  We try to convert the latter to a cluster.
  771          */
  772         if (error == EFBIG) {           /* too many desc's, linearize */
  773                 sc->malo_stats.mst_tx_linear++;
  774                 m = m_defrag(m0, M_DONTWAIT);
  775                 if (m == NULL) {
  776                         m_freem(m0);
  777                         sc->malo_stats.mst_tx_nombuf++;
  778                         return ENOMEM;
  779                 }
  780                 m0 = m;
  781                 error = bus_dmamap_load_mbuf_sg(sc->malo_dmat, bf->bf_dmamap, m0,
  782                                              bf->bf_segs, &bf->bf_nseg,
  783                                              BUS_DMA_NOWAIT);
  784                 if (error != 0) {
  785                         sc->malo_stats.mst_tx_busdma++;
  786                         m_freem(m0);
  787                         return error;
  788                 }
  789                 KASSERT(bf->bf_nseg <= MALO_TXDESC,
  790                     ("too many segments after defrag; nseg %u", bf->bf_nseg));
  791         } else if (bf->bf_nseg == 0) {          /* null packet, discard */
  792                 sc->malo_stats.mst_tx_nodata++;
  793                 m_freem(m0);
  794                 return EIO;
  795         }
  796         DPRINTF(sc, MALO_DEBUG_XMIT, "%s: m %p len %u\n",
  797                 __func__, m0, m0->m_pkthdr.len);
  798         bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
  799         bf->bf_m = m0;
  800 
  801         return 0;
  802 }
  803 
  804 #ifdef MALO_DEBUG
  805 static void
  806 malo_printrxbuf(const struct malo_rxbuf *bf, u_int ix)
  807 {
  808         const struct malo_rxdesc *ds = bf->bf_desc;
  809         uint32_t status = le32toh(ds->status);
  810         
  811         printf("R[%2u] (DS.V:%p DS.P:%p) NEXT:%08x DATA:%08x RC:%02x%s\n"
  812             "      STAT:%02x LEN:%04x SNR:%02x NF:%02x CHAN:%02x"
  813             " RATE:%02x QOS:%04x\n",
  814             ix, ds, (const struct malo_desc *)bf->bf_daddr,
  815             le32toh(ds->physnext), le32toh(ds->physbuffdata),
  816             ds->rxcontrol, 
  817             ds->rxcontrol != MALO_RXD_CTRL_DRIVER_OWN ?
  818                 "" : (status & MALO_RXD_STATUS_OK) ? " *" : " !",
  819             ds->status, le16toh(ds->pktlen), ds->snr, ds->nf, ds->channel,
  820             ds->rate, le16toh(ds->qosctrl));
  821 }
  822 
  823 static void
  824 malo_printtxbuf(const struct malo_txbuf *bf, u_int qnum, u_int ix)
  825 {
  826         const struct malo_txdesc *ds = bf->bf_desc;
  827         uint32_t status = le32toh(ds->status);
  828         
  829         printf("Q%u[%3u]", qnum, ix);
  830         printf(" (DS.V:%p DS.P:%p)\n",
  831             ds, (const struct malo_txdesc *)bf->bf_daddr);
  832         printf("    NEXT:%08x DATA:%08x LEN:%04x STAT:%08x%s\n",
  833             le32toh(ds->physnext),
  834             le32toh(ds->pktptr), le16toh(ds->pktlen), status,
  835             status & MALO_TXD_STATUS_USED ?
  836             "" : (status & 3) != 0 ? " *" : " !");
  837         printf("    RATE:%02x PRI:%x QOS:%04x SAP:%08x FORMAT:%04x\n",
  838             ds->datarate, ds->txpriority, le16toh(ds->qosctrl),
  839             le32toh(ds->sap_pktinfo), le16toh(ds->format));
  840 #if 0
  841         {
  842                 const uint8_t *cp = (const uint8_t *) ds;
  843                 int i;
  844                 for (i = 0; i < sizeof(struct malo_txdesc); i++) {
  845                         printf("%02x ", cp[i]);
  846                         if (((i+1) % 16) == 0)
  847                                 printf("\n");
  848                 }
  849                 printf("\n");
  850         }
  851 #endif
  852 }
  853 #endif /* MALO_DEBUG */
  854 
  855 static __inline void
  856 malo_updatetxrate(struct ieee80211_node *ni, int rix)
  857 {
  858 #define N(x)    (sizeof(x)/sizeof(x[0]))
  859         static const int ieeerates[] =
  860             { 2, 4, 11, 22, 44, 12, 18, 24, 36, 48, 96, 108 };
  861         if (rix < N(ieeerates))
  862                 ni->ni_txrate = ieeerates[rix];
  863 #undef N
  864 }
  865 
  866 static int
  867 malo_fix2rate(int fix_rate)
  868 {
  869 #define N(x)    (sizeof(x)/sizeof(x[0]))
  870         static const int rates[] =
  871             { 2, 4, 11, 22, 12, 18, 24, 36, 48, 96, 108 };
  872         return (fix_rate < N(rates) ? rates[fix_rate] : 0);
  873 #undef N
  874 }
  875 
  876 /* idiomatic shorthands: MS = mask+shift, SM = shift+mask */
  877 #define MS(v,x)                 (((v) & x) >> x##_S)
  878 #define SM(v,x)                 (((v) << x##_S) & x)
  879 
  880 /*
  881  * Process completed xmit descriptors from the specified queue.
  882  */
  883 static int
  884 malo_tx_processq(struct malo_softc *sc, struct malo_txq *txq)
  885 {
  886         struct malo_txbuf *bf;
  887         struct malo_txdesc *ds;
  888         struct ieee80211_node *ni;
  889         int nreaped;
  890         uint32_t status;
  891 
  892         DPRINTF(sc, MALO_DEBUG_TX_PROC, "%s: tx queue %u\n",
  893             __func__, txq->qnum);
  894         for (nreaped = 0;; nreaped++) {
  895                 MALO_TXQ_LOCK(txq);
  896                 bf = STAILQ_FIRST(&txq->active);
  897                 if (bf == NULL) {
  898                         MALO_TXQ_UNLOCK(txq);
  899                         break;
  900                 }
  901                 ds = bf->bf_desc;
  902                 MALO_TXDESC_SYNC(txq, ds,
  903                     BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
  904                 if (ds->status & htole32(MALO_TXD_STATUS_FW_OWNED)) {
  905                         MALO_TXQ_UNLOCK(txq);
  906                         break;
  907                 }
  908                 STAILQ_REMOVE_HEAD(&txq->active, bf_list);
  909                 MALO_TXQ_UNLOCK(txq);
  910 
  911 #ifdef MALO_DEBUG
  912                 if (sc->malo_debug & MALO_DEBUG_XMIT_DESC)
  913                         malo_printtxbuf(bf, txq->qnum, nreaped);
  914 #endif
  915                 ni = bf->bf_node;
  916                 if (ni != NULL) {
  917                         status = le32toh(ds->status);
  918                         if (status & MALO_TXD_STATUS_OK) {
  919                                 uint16_t format = le16toh(ds->format);
  920                                 uint8_t txant = MS(format, MALO_TXD_ANTENNA);
  921 
  922                                 sc->malo_stats.mst_ant_tx[txant]++;
  923                                 if (status & MALO_TXD_STATUS_OK_RETRY)
  924                                         sc->malo_stats.mst_tx_retries++;
  925                                 if (status & MALO_TXD_STATUS_OK_MORE_RETRY)
  926                                         sc->malo_stats.mst_tx_mretries++;
  927                                 malo_updatetxrate(ni, ds->datarate);
  928                                 sc->malo_stats.mst_tx_rate = ds->datarate;
  929                         } else {
  930                                 if (status & MALO_TXD_STATUS_FAILED_LINK_ERROR)
  931                                         sc->malo_stats.mst_tx_linkerror++;
  932                                 if (status & MALO_TXD_STATUS_FAILED_XRETRY)
  933                                         sc->malo_stats.mst_tx_xretries++;
  934                                 if (status & MALO_TXD_STATUS_FAILED_AGING)
  935                                         sc->malo_stats.mst_tx_aging++;
  936                         }
  937                         /*
  938                          * Do any tx complete callback.  Note this must
  939                          * be done before releasing the node reference.
  940                          * XXX no way to figure out if frame was ACK'd
  941                          */
  942                         if (bf->bf_m->m_flags & M_TXCB) {
  943                                 /* XXX strip fw len in case header inspected */
  944                                 m_adj(bf->bf_m, sizeof(uint16_t));
  945                                 ieee80211_process_callback(ni, bf->bf_m,
  946                                         (status & MALO_TXD_STATUS_OK) == 0);
  947                         }
  948                         /*
  949                          * Reclaim reference to node.
  950                          *
  951                          * NB: the node may be reclaimed here if, for example
  952                          *     this is a DEAUTH message that was sent and the
  953                          *     node was timed out due to inactivity.
  954                          */
  955                         ieee80211_free_node(ni);
  956                 }
  957                 ds->status = htole32(MALO_TXD_STATUS_IDLE);
  958                 ds->pktlen = htole32(0);
  959 
  960                 bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap,
  961                     BUS_DMASYNC_POSTWRITE);
  962                 bus_dmamap_unload(sc->malo_dmat, bf->bf_dmamap);
  963                 m_freem(bf->bf_m);
  964                 bf->bf_m = NULL;
  965                 bf->bf_node = NULL;
  966 
  967                 MALO_TXQ_LOCK(txq);
  968                 STAILQ_INSERT_TAIL(&txq->free, bf, bf_list);
  969                 txq->nfree++;
  970                 MALO_TXQ_UNLOCK(txq);
  971         }
  972         return nreaped;
  973 }
  974 
  975 /*
  976  * Deferred processing of transmit interrupt.
  977  */
  978 static void
  979 malo_tx_proc(void *arg, int npending)
  980 {
  981         struct malo_softc *sc = arg;
  982         struct ifnet *ifp = sc->malo_ifp;
  983         int i, nreaped;
  984 
  985         /*
  986          * Process each active queue.
  987          */
  988         nreaped = 0;
  989         for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
  990                 if (!STAILQ_EMPTY(&sc->malo_txq[i].active))
  991                         nreaped += malo_tx_processq(sc, &sc->malo_txq[i]);
  992         }
  993 
  994         if (nreaped != 0) {
  995                 ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
  996                 sc->malo_timer = 0;
  997                 malo_start(ifp);
  998         }
  999 }
 1000 
 1001 static int
 1002 malo_tx_start(struct malo_softc *sc, struct ieee80211_node *ni,
 1003     struct malo_txbuf *bf, struct mbuf *m0)
 1004 {
 1005 #define IEEE80211_DIR_DSTODS(wh) \
 1006         ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS)
 1007 #define IS_DATA_FRAME(wh)                                               \
 1008         ((wh->i_fc[0] & (IEEE80211_FC0_TYPE_MASK)) == IEEE80211_FC0_TYPE_DATA)
 1009         int error, ismcast, iswep;
 1010         int copyhdrlen, hdrlen, pktlen;
 1011         struct ieee80211_frame *wh;
 1012         struct ieee80211com *ic = &sc->malo_ic;
 1013         struct ifnet *ifp = sc->malo_ifp;
 1014         struct malo_txdesc *ds;
 1015         struct malo_txrec *tr;
 1016         struct malo_txq *txq;
 1017         uint16_t qos;
 1018 
 1019         wh = mtod(m0, struct ieee80211_frame *);
 1020         iswep = wh->i_fc[1] & IEEE80211_FC1_WEP;
 1021         ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
 1022         copyhdrlen = hdrlen = ieee80211_anyhdrsize(wh);
 1023         pktlen = m0->m_pkthdr.len;
 1024         if (IEEE80211_QOS_HAS_SEQ(wh)) {
 1025                 if (IEEE80211_DIR_DSTODS(wh)) {
 1026                         qos = *(uint16_t *)
 1027                             (((struct ieee80211_qosframe_addr4 *) wh)->i_qos);
 1028                         copyhdrlen -= sizeof(qos);
 1029                 } else
 1030                         qos = *(uint16_t *)
 1031                             (((struct ieee80211_qosframe *) wh)->i_qos);
 1032         } else
 1033                 qos = 0;
 1034 
 1035         if (iswep) {
 1036                 struct ieee80211_key *k;
 1037 
 1038                 /*
 1039                  * Construct the 802.11 header+trailer for an encrypted
 1040                  * frame. The only reason this can fail is because of an
 1041                  * unknown or unsupported cipher/key type.
 1042                  *
 1043                  * NB: we do this even though the firmware will ignore
 1044                  *     what we've done for WEP and TKIP as we need the
 1045                  *     ExtIV filled in for CCMP and this also adjusts
 1046                  *     the headers which simplifies our work below.
 1047                  */
 1048                 k = ieee80211_crypto_encap(ic, ni, m0);
 1049                 if (k == NULL) {
 1050                         /*
 1051                          * This can happen when the key is yanked after the
 1052                          * frame was queued.  Just discard the frame; the
 1053                          * 802.11 layer counts failures and provides
 1054                          * debugging/diagnostics.
 1055                          */
 1056                         m_freem(m0);
 1057                         return EIO;
 1058                 }
 1059 
 1060                 /*
 1061                  * Adjust the packet length for the crypto additions
 1062                  * done during encap and any other bits that the f/w
 1063                  * will add later on.
 1064                  */
 1065                 pktlen = m0->m_pkthdr.len;
 1066 
 1067                 /* packet header may have moved, reset our local pointer */
 1068                 wh = mtod(m0, struct ieee80211_frame *);
 1069         }
 1070 
 1071         if (bpf_peers_present(sc->malo_drvbpf)) {
 1072                 sc->malo_tx_th.wt_flags = 0;    /* XXX */
 1073                 if (iswep)
 1074                         sc->malo_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
 1075                 sc->malo_tx_th.wt_txpower = ni->ni_txpower;
 1076                 sc->malo_tx_th.wt_antenna = sc->malo_txantenna;
 1077 
 1078                 bpf_mtap2(sc->malo_drvbpf,
 1079                         &sc->malo_tx_th, sc->malo_tx_th_len, m0);
 1080         }
 1081 
 1082         /*
 1083          * Copy up/down the 802.11 header; the firmware requires
 1084          * we present a 2-byte payload length followed by a
 1085          * 4-address header (w/o QoS), followed (optionally) by
 1086          * any WEP/ExtIV header (but only filled in for CCMP).
 1087          * We are assured the mbuf has sufficient headroom to
 1088          * prepend in-place by the setup of ic_headroom in
 1089          * malo_attach.
 1090          */
 1091         if (hdrlen < sizeof(struct malo_txrec)) {
 1092                 const int space = sizeof(struct malo_txrec) - hdrlen;
 1093                 if (M_LEADINGSPACE(m0) < space) {
 1094                         /* NB: should never happen */
 1095                         device_printf(sc->malo_dev,
 1096                             "not enough headroom, need %d found %zd, "
 1097                             "m_flags 0x%x m_len %d\n",
 1098                             space, M_LEADINGSPACE(m0), m0->m_flags, m0->m_len);
 1099                         ieee80211_dump_pkt(ic,
 1100                             mtod(m0, const uint8_t *), m0->m_len, 0, -1);
 1101                         m_freem(m0);
 1102                         /* XXX stat */
 1103                         return EIO;
 1104                 }
 1105                 M_PREPEND(m0, space, M_NOWAIT);
 1106         }
 1107         tr = mtod(m0, struct malo_txrec *);
 1108         if (wh != (struct ieee80211_frame *) &tr->wh)
 1109                 ovbcopy(wh, &tr->wh, hdrlen);
 1110         /*
 1111          * Note: the "firmware length" is actually the length of the fully
 1112          * formed "802.11 payload".  That is, it's everything except for
 1113          * the 802.11 header.  In particular this includes all crypto
 1114          * material including the MIC!
 1115          */
 1116         tr->fwlen = htole16(pktlen - hdrlen);
 1117 
 1118         /*
 1119          * Load the DMA map so any coalescing is done.  This
 1120          * also calculates the number of descriptors we need.
 1121          */
 1122         error = malo_tx_dmasetup(sc, bf, m0);
 1123         if (error != 0)
 1124                 return error;
 1125         bf->bf_node = ni;                       /* NB: held reference */
 1126         m0 = bf->bf_m;                          /* NB: may have changed */
 1127         tr = mtod(m0, struct malo_txrec *);
 1128         wh = (struct ieee80211_frame *)&tr->wh;
 1129 
 1130         /*
 1131          * Formulate tx descriptor.
 1132          */
 1133         ds = bf->bf_desc;
 1134         txq = bf->bf_txq;
 1135 
 1136         ds->qosctrl = qos;                      /* NB: already little-endian */
 1137         ds->pktptr = htole32(bf->bf_segs[0].ds_addr);
 1138         ds->pktlen = htole16(bf->bf_segs[0].ds_len);
 1139         /* NB: pPhysNext setup once, don't touch */
 1140         ds->datarate = IS_DATA_FRAME(wh) ? 1 : 0;
 1141         ds->sap_pktinfo = 0;
 1142         ds->format = 0;
 1143 
 1144         /*
 1145          * Select transmit rate.
 1146          */
 1147         switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
 1148         case IEEE80211_FC0_TYPE_MGT:
 1149                 sc->malo_stats.mst_tx_mgmt++;
 1150                 /* fall thru... */
 1151         case IEEE80211_FC0_TYPE_CTL:
 1152                 ds->txpriority = 1;
 1153                 break;
 1154         case IEEE80211_FC0_TYPE_DATA:
 1155                 ds->txpriority = txq->qnum;
 1156                 break;
 1157         default:
 1158                 if_printf(ifp, "bogus frame type 0x%x (%s)\n",
 1159                         wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK, __func__);
 1160                 /* XXX statistic */
 1161                 m_freem(m0);
 1162                 return EIO;
 1163         }
 1164 
 1165 #ifdef MALO_DEBUG
 1166         if (IFF_DUMPPKTS_XMIT(sc))
 1167                 ieee80211_dump_pkt(ic,
 1168                     mtod(m0, const uint8_t *)+sizeof(uint16_t),
 1169                     m0->m_len - sizeof(uint16_t), ds->datarate, -1);
 1170 #endif
 1171 
 1172         MALO_TXQ_LOCK(txq);
 1173         if (!IS_DATA_FRAME(wh))
 1174                 ds->status |= htole32(1);
 1175         ds->status |= htole32(MALO_TXD_STATUS_FW_OWNED);
 1176         STAILQ_INSERT_TAIL(&txq->active, bf, bf_list);
 1177         MALO_TXDESC_SYNC(txq, ds, BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
 1178 
 1179         ifp->if_opackets++;
 1180         sc->malo_timer = 5;
 1181         MALO_TXQ_UNLOCK(txq);
 1182         return 0;
 1183 #undef IEEE80211_DIR_DSTODS
 1184 }
 1185 
 1186 static void
 1187 malo_start(struct ifnet *ifp)
 1188 {
 1189         int nqueued = 0;
 1190         struct ether_header *eh;
 1191         struct malo_softc *sc = ifp->if_softc;
 1192         struct ieee80211_frame *wh;
 1193         struct ieee80211_node *ni;
 1194         struct ieee80211com *ic = &sc->malo_ic;
 1195         struct malo_txbuf *bf = NULL;
 1196         struct malo_txq *txq = NULL;
 1197         struct mbuf *m;
 1198 
 1199         if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0 || sc->malo_invalid)
 1200                 return;
 1201 
 1202         for (;;) {
 1203                 /*
 1204                  * Poll the management queue for frames; they
 1205                  * have priority over normal data frames.
 1206                  */
 1207                 IF_DEQUEUE(&ic->ic_mgtq, m);
 1208                 if (m == NULL) {
 1209                         /*
 1210                          * No data frames go out unless we're associated.
 1211                          */
 1212                         if (ic->ic_state != IEEE80211_S_RUN) {
 1213                                 DPRINTF(sc, MALO_DEBUG_XMIT,
 1214                                     "%s: discard data packet, state %s\n",
 1215                                     __func__,
 1216                                     ieee80211_state_name[ic->ic_state]);
 1217                                 sc->malo_stats.mst_tx_discard++;
 1218                                 break;
 1219                         }
 1220                         IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
 1221                         if (m == NULL)
 1222                                 break;
 1223                         /*
 1224                          * Cancel any background scan.
 1225                          */
 1226                         if (ic->ic_flags & IEEE80211_F_SCAN)
 1227                                 ieee80211_cancel_scan(ic);
 1228 
 1229                         /*
 1230                          * Find the node for the destination so we can do
 1231                          * things like power save and fast frames aggregation.
 1232                          */
 1233                         if (m->m_len < sizeof(struct ether_header) &&
 1234                            (m = m_pullup(m, sizeof(struct ether_header))) ==
 1235                             NULL) {
 1236                                 ic->ic_stats.is_tx_nobuf++;     /* XXX */
 1237                                 ni = NULL;
 1238                                 goto bad;
 1239                         }
 1240                         eh = mtod(m, struct ether_header *);
 1241                         ni = ieee80211_find_txnode(ic, eh->ether_dhost);
 1242                         if (ni == NULL) {
 1243                                 /* NB: ieee80211_find_txnode does stat+msg */
 1244                                 m_freem(m);
 1245                                 goto bad;
 1246                         }
 1247                         /* calculate priority so we can find the tx queue */
 1248                         if (ieee80211_classify(ic, m, ni)) {
 1249                                 DPRINTF(sc, MALO_DEBUG_XMIT,
 1250                                         "%s: discard, classification failure\n",
 1251                                         __func__);
 1252                                 m_freem(m);
 1253                                 goto bad;
 1254                         }
 1255 
 1256                         txq = &sc->malo_txq[0];
 1257 
 1258                         bf = malo_getbuf(sc, txq);
 1259                         if (bf == NULL) {
 1260                                 IFQ_DRV_PREPEND(&ifp->if_snd, m);
 1261                                 ieee80211_free_node(ni);
 1262 
 1263                                 /* XXX blocks other traffic */
 1264                                 ifp->if_drv_flags |= IFF_DRV_OACTIVE;
 1265                                 sc->malo_stats.mst_tx_qstop++;
 1266                                 break;
 1267                         }
 1268                         ifp->if_opackets++;
 1269 
 1270                         if (bpf_peers_present(ifp->if_bpf))
 1271                                 bpf_mtap(ifp->if_bpf, m);
 1272 
 1273                         /*
 1274                          * Encapsulate the packet in prep for transmission.
 1275                          */
 1276                         m = ieee80211_encap(ic, m, ni);
 1277                         if (m == NULL) {
 1278                                 DPRINTF(sc, MALO_DEBUG_XMIT,
 1279                                     "%s: encapsulation failure\n", __func__);
 1280                                 sc->malo_stats.mst_tx_encap++;
 1281                                 goto bad;
 1282                         }
 1283                 } else {
 1284                         /*
 1285                          * Grab a TX buffer and associated resources.
 1286                          * Note that we depend on the classification
 1287                          * by the 802.11 layer to get to the right h/w
 1288                          * queue.  Management frames must ALWAYS go on
 1289                          * queue 1 but we cannot just force that here
 1290                          * because we may receive non-mgt frames through
 1291                          * the ic_mgtq (e.g. null data frames).
 1292                          */
 1293                         txq = &sc->malo_txq[0];
 1294                         bf = malo_getbuf(sc, txq);
 1295                         if (bf == NULL) {
 1296                                 IF_PREPEND(&ic->ic_mgtq, m);
 1297                                 /* XXX stat */
 1298                                 break;
 1299                         }
 1300 
 1301                         /*
 1302                          * Hack!  The referenced node pointer is in the
 1303                          * rcvif field of the packet header.  This is
 1304                          * placed there by ieee80211_mgmt_output because
 1305                          * we need to hold the reference with the frame
 1306                          * and there's no other way (other than packet
 1307                          * tags which we consider too expensive to use)
 1308                          * to pass it along.
 1309                          */
 1310                         ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
 1311                         m->m_pkthdr.rcvif = NULL;
 1312 
 1313                         wh = mtod(m, struct ieee80211_frame *);
 1314                         sc->malo_stats.mst_tx_mgmt++;
 1315 
 1316                         if (bpf_peers_present(ic->ic_rawbpf))
 1317                                 bpf_mtap(ic->ic_rawbpf, m);
 1318                 }
 1319 
 1320                 /*
 1321                  * Pass the frame to the h/w for transmission.
 1322                  */
 1323                 if (malo_tx_start(sc, ni, bf, m)) {
 1324         bad:
 1325                         ifp->if_oerrors++;
 1326                         if (bf != NULL) {
 1327                                 bf->bf_m = NULL;
 1328                                 bf->bf_node = NULL;
 1329                                 MALO_TXQ_LOCK(txq);
 1330                                 STAILQ_INSERT_HEAD(&txq->free, bf, bf_list);
 1331                                 MALO_TXQ_UNLOCK(txq);
 1332                         }
 1333                         ieee80211_free_node(ni);
 1334                         continue;
 1335                 }
 1336                 nqueued++;
 1337 
 1338                 if (nqueued >= malo_txcoalesce) {
 1339                         /*
 1340                          * Poke the firmware to process queued frames;
 1341                          * see below about (lack of) locking.
 1342                          */
 1343                         nqueued = 0;
 1344                         malo_hal_txstart(sc->malo_mh, 0/*XXX*/);
 1345                 }
 1346         }
 1347 
 1348         if (nqueued) {
 1349                 /*
 1350                  * NB: We don't need to lock against tx done because
 1351                  * this just prods the firmware to check the transmit
 1352                  * descriptors.  The firmware will also start fetching
 1353                  * descriptors by itself if it notices new ones are
 1354                  * present when it goes to deliver a tx done interrupt
 1355                  * to the host. So if we race with tx done processing
 1356                  * it's ok.  Delivering the kick here rather than in
 1357                  * malo_tx_start is an optimization to avoid poking the
 1358                  * firmware for each packet.
 1359                  *
 1360                  * NB: the queue id isn't used so 0 is ok.
 1361                  */
 1362                 malo_hal_txstart(sc->malo_mh, 0/*XXX*/);
 1363         }
 1364 }
 1365 
 1366 static void
 1367 malo_watchdog(void *arg)
 1368 {
 1369         struct malo_softc *sc;
 1370         struct ifnet *ifp;
 1371 
 1372         sc = arg;
 1373         callout_reset(&sc->malo_watchdog_timer, hz, malo_watchdog, sc);
 1374         if (sc->malo_timer == 0 || --sc->malo_timer > 0)
 1375                 return;
 1376 
 1377         ifp = sc->malo_ifp;
 1378         if ((ifp->if_drv_flags & IFF_DRV_RUNNING) && !sc->malo_invalid) {
 1379                 if_printf(ifp, "watchdog timeout\n");
 1380 
 1381                 /* XXX no way to reset h/w. now  */
 1382 
 1383                 ifp->if_oerrors++;
 1384                 sc->malo_stats.mst_watchdog++;
 1385         }
 1386 }
 1387 
 1388 static int
 1389 malo_hal_reset(struct malo_softc *sc)
 1390 {
 1391         static int first = 0;
 1392         struct ieee80211com *ic = &sc->malo_ic;
 1393         struct malo_hal *mh = sc->malo_mh;
 1394 
 1395         if (first == 0) {
 1396                 /*
 1397                  * NB: when the device firstly is initialized, sometimes
 1398                  * firmware could override rx/tx dma registers so we re-set
 1399                  * these values once.
 1400                  */
 1401                 malo_hal_set_rxtxdma(sc);
 1402                 first = 1;
 1403         }
 1404 
 1405         malo_hal_setantenna(mh, MHA_ANTENNATYPE_RX, sc->malo_rxantenna);
 1406         malo_hal_setantenna(mh, MHA_ANTENNATYPE_TX, sc->malo_txantenna);
 1407         malo_hal_setradio(mh, 1, MHP_AUTO_PREAMBLE);
 1408         malo_chan_set(sc, ic->ic_curchan);
 1409 
 1410         /* XXX needs other stuffs?  */
 1411 
 1412         return 1;
 1413 }
 1414 
 1415 static __inline struct mbuf *
 1416 malo_getrxmbuf(struct malo_softc *sc, struct malo_rxbuf *bf)
 1417 {
 1418         struct mbuf *m;
 1419         bus_addr_t paddr;
 1420         int error;
 1421 
 1422         /* XXX don't need mbuf, just dma buffer */
 1423         m = m_getjcl(M_DONTWAIT, MT_DATA, M_PKTHDR, MJUMPAGESIZE);
 1424         if (m == NULL) {
 1425                 sc->malo_stats.mst_rx_nombuf++; /* XXX */
 1426                 return NULL;
 1427         }
 1428         error = bus_dmamap_load(sc->malo_dmat, bf->bf_dmamap,
 1429             mtod(m, caddr_t), MJUMPAGESIZE,
 1430             malo_load_cb, &paddr, BUS_DMA_NOWAIT);
 1431         if (error != 0) {
 1432                 if_printf(sc->malo_ifp,
 1433                     "%s: bus_dmamap_load failed, error %d\n", __func__, error);
 1434                 m_freem(m);
 1435                 return NULL;
 1436         }
 1437         bf->bf_data = paddr;
 1438         bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
 1439 
 1440         return m;
 1441 }
 1442 
 1443 static int
 1444 malo_rxbuf_init(struct malo_softc *sc, struct malo_rxbuf *bf)
 1445 {
 1446         struct malo_rxdesc *ds;
 1447 
 1448         ds = bf->bf_desc;
 1449         if (bf->bf_m == NULL) {
 1450                 bf->bf_m = malo_getrxmbuf(sc, bf);
 1451                 if (bf->bf_m == NULL) {
 1452                         /* mark descriptor to be skipped */
 1453                         ds->rxcontrol = MALO_RXD_CTRL_OS_OWN;
 1454                         /* NB: don't need PREREAD */
 1455                         MALO_RXDESC_SYNC(sc, ds, BUS_DMASYNC_PREWRITE);
 1456                         return ENOMEM;
 1457                 }
 1458         }
 1459 
 1460         /*
 1461          * Setup descriptor.
 1462          */
 1463         ds->qosctrl = 0;
 1464         ds->snr = 0;
 1465         ds->status = MALO_RXD_STATUS_IDLE;
 1466         ds->channel = 0;
 1467         ds->pktlen = htole16(MALO_RXSIZE);
 1468         ds->nf = 0;
 1469         ds->physbuffdata = htole32(bf->bf_data);
 1470         /* NB: don't touch pPhysNext, set once */
 1471         ds->rxcontrol = MALO_RXD_CTRL_DRIVER_OWN;
 1472         MALO_RXDESC_SYNC(sc, ds, BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
 1473 
 1474         return 0;
 1475 }
 1476 
 1477 /*
 1478  * Setup the rx data structures.  This should only be done once or we may get
 1479  * out of sync with the firmware.
 1480  */
 1481 static int
 1482 malo_startrecv(struct malo_softc *sc)
 1483 {
 1484         struct malo_rxbuf *bf, *prev;
 1485         struct malo_rxdesc *ds;
 1486         
 1487         if (sc->malo_recvsetup == 1) {
 1488                 malo_mode_init(sc);             /* set filters, etc. */
 1489                 return 0;
 1490         }
 1491         
 1492         prev = NULL;
 1493         STAILQ_FOREACH(bf, &sc->malo_rxbuf, bf_list) {
 1494                 int error = malo_rxbuf_init(sc, bf);
 1495                 if (error != 0) {
 1496                         DPRINTF(sc, MALO_DEBUG_RECV,
 1497                             "%s: malo_rxbuf_init failed %d\n",
 1498                             __func__, error);
 1499                         return error;
 1500                 }
 1501                 if (prev != NULL) {
 1502                         ds = prev->bf_desc;
 1503                         ds->physnext = htole32(bf->bf_daddr);
 1504                 }
 1505                 prev = bf;
 1506         }
 1507         if (prev != NULL) {
 1508                 ds = prev->bf_desc;
 1509                 ds->physnext =
 1510                     htole32(STAILQ_FIRST(&sc->malo_rxbuf)->bf_daddr);
 1511         }
 1512 
 1513         sc->malo_recvsetup = 1;
 1514 
 1515         malo_mode_init(sc);             /* set filters, etc. */
 1516         
 1517         return 0;
 1518 }
 1519 
 1520 static void
 1521 malo_init(void *arg)
 1522 {
 1523         struct malo_softc *sc = (struct malo_softc *) arg;
 1524         struct ieee80211com *ic = &sc->malo_ic;
 1525         struct ifnet *ifp = sc->malo_ifp;
 1526         struct malo_hal *mh = sc->malo_mh;
 1527         int error;
 1528         
 1529         DPRINTF(sc, MALO_DEBUG_ANY, "%s: if_flags 0x%x\n",
 1530             __func__, ifp->if_flags);
 1531 
 1532         if (!sc->malo_fw_loaded) {
 1533                 /*
 1534                  * Load firmware so we can get setup.
 1535                  */
 1536                 error = malo_hal_fwload(mh, "malo8335-h", "malo8335-m");
 1537                 if (error != 0) {
 1538                         if_printf(ifp, "unable to setup firmware\n");
 1539                         return;
 1540                 }
 1541                 /* XXX gethwspecs() extracts correct informations? not maybe! */
 1542                 error = malo_hal_gethwspecs(mh, &sc->malo_hwspecs);
 1543                 if (error != 0) {
 1544                         if_printf(ifp, "unable to fetch h/w specs\n");
 1545                         return;
 1546                 }
 1547 
 1548                 DPRINTF(sc, MALO_DEBUG_FW,
 1549                     "malo_hal_gethwspecs: hwversion 0x%x hostif 0x%x"
 1550                     "maxnum_wcb 0x%x maxnum_mcaddr 0x%x maxnum_tx_wcb 0x%x"
 1551                     "regioncode 0x%x num_antenna 0x%x fw_releasenum 0x%x"
 1552                     "wcbbase0 0x%x rxdesc_read 0x%x rxdesc_write 0x%x"
 1553                     "ul_fw_awakecookie 0x%x w[4] = %x %x %x %x",
 1554                     sc->malo_hwspecs.hwversion,
 1555                     sc->malo_hwspecs.hostinterface, sc->malo_hwspecs.maxnum_wcb,
 1556                     sc->malo_hwspecs.maxnum_mcaddr,
 1557                     sc->malo_hwspecs.maxnum_tx_wcb,
 1558                     sc->malo_hwspecs.regioncode, sc->malo_hwspecs.num_antenna,
 1559                     sc->malo_hwspecs.fw_releasenum, sc->malo_hwspecs.wcbbase0,
 1560                     sc->malo_hwspecs.rxdesc_read, sc->malo_hwspecs.rxdesc_write,
 1561                     sc->malo_hwspecs.ul_fw_awakecookie,
 1562                     sc->malo_hwspecs.wcbbase[0], sc->malo_hwspecs.wcbbase[1],
 1563                     sc->malo_hwspecs.wcbbase[2], sc->malo_hwspecs.wcbbase[3]);
 1564                 
 1565                 error = malo_setup_hwdma(sc);   /* push to firmware */
 1566                 /* NB: malo_setupdma prints msg */
 1567                 if (error != 0) {
 1568                         if_printf(ifp, "%s: failed to set up h/w dma\n",
 1569                             __func__);
 1570                         return;
 1571                 }
 1572 
 1573                 /* set reddomain.  */
 1574                 ic->ic_regdomain = sc->malo_hwspecs.regioncode;
 1575 
 1576                 malo_announce(sc);
 1577 
 1578                 sc->malo_fw_loaded = 1;
 1579         }
 1580 
 1581         MALO_LOCK(sc);
 1582         
 1583         /*
 1584          * Stop anything previously setup.  This is safe whether this is
 1585          * the first time through or not.
 1586          */
 1587         malo_stop_locked(ifp, 0);
 1588 
 1589         /*
 1590          * Push state to the firmware.
 1591          */
 1592         if (!malo_hal_reset(sc)) {
 1593                 if_printf(ifp, "%s: unable to reset hardware\n", __func__);
 1594                 goto done;
 1595         }
 1596 
 1597         /*
 1598          * Setup recv (once); transmit is already good to go.
 1599          */
 1600         error = malo_startrecv(sc);
 1601         if (error != 0) {
 1602                 if_printf(ifp, "%s: unable to start recv logic, error %d\n",
 1603                     __func__, error);
 1604                 goto done;
 1605         }
 1606 
 1607         /*
 1608          * Enable interrupts.
 1609          */
 1610         sc->malo_imask = MALO_A2HRIC_BIT_RX_RDY
 1611             | MALO_A2HRIC_BIT_TX_DONE
 1612             | MALO_A2HRIC_BIT_OPC_DONE
 1613             | MALO_A2HRIC_BIT_MAC_EVENT
 1614             | MALO_A2HRIC_BIT_RX_PROBLEM
 1615             | MALO_A2HRIC_BIT_ICV_ERROR
 1616             | MALO_A2HRIC_BIT_RADAR_DETECT
 1617             | MALO_A2HRIC_BIT_CHAN_SWITCH;
 1618 
 1619         ifp->if_drv_flags |= IFF_DRV_RUNNING;
 1620         ic->ic_state = IEEE80211_S_INIT;
 1621         IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
 1622 
 1623         malo_hal_intrset(mh, sc->malo_imask);
 1624         callout_reset(&sc->malo_watchdog_timer, hz, malo_watchdog, sc);
 1625 
 1626         /*
 1627          * The hardware should be ready to go now so it's safe to kick
 1628          * the 802.11 state machine as it's likely to immediately call back
 1629          * to us to send mgmt frames.
 1630          */
 1631         if (ic->ic_opmode != IEEE80211_M_MONITOR) {
 1632                 if (ic->ic_roaming != IEEE80211_ROAMING_MANUAL)
 1633                         ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
 1634         } else
 1635                 ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
 1636 
 1637 done:
 1638         if (error != 0)
 1639                 if_printf(ifp,
 1640                     "error(%d) occurred during the initializing.\n", error);
 1641 
 1642         MALO_UNLOCK(sc);
 1643 
 1644         return;
 1645 }
 1646 
 1647 /*
 1648  * Set the multicast filter contents into the hardware.
 1649  */
 1650 static void
 1651 malo_setmcastfilter(struct malo_softc *sc)
 1652 {
 1653         struct ieee80211com *ic = &sc->malo_ic;
 1654         struct ifmultiaddr *ifma;
 1655         struct ifnet *ifp = sc->malo_ifp;
 1656         uint8_t macs[IEEE80211_ADDR_LEN * MALO_HAL_MCAST_MAX];
 1657         uint8_t *mp;
 1658         int nmc;
 1659 
 1660         mp = macs;
 1661         nmc = 0;
 1662 
 1663         if (ic->ic_opmode == IEEE80211_M_MONITOR ||
 1664             (ifp->if_flags & (IFF_ALLMULTI | IFF_PROMISC)))
 1665                 goto all;
 1666         
 1667         IF_ADDR_LOCK(ifp);
 1668         TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
 1669                 if (ifma->ifma_addr->sa_family != AF_LINK)
 1670                         continue;
 1671 
 1672                 if (nmc == MALO_HAL_MCAST_MAX) {
 1673                         ifp->if_flags |= IFF_ALLMULTI;
 1674                         IF_ADDR_UNLOCK(ifp);
 1675                         goto all;
 1676                 }
 1677                 IEEE80211_ADDR_COPY(mp,
 1678                     LLADDR((struct sockaddr_dl *)ifma->ifma_addr));
 1679 
 1680                 mp += IEEE80211_ADDR_LEN, nmc++;
 1681         }
 1682         IF_ADDR_UNLOCK(ifp);
 1683 
 1684         malo_hal_setmcast(sc->malo_mh, nmc, macs);
 1685 
 1686 all:
 1687         /*
 1688          * XXX we don't know how to set the f/w for supporting
 1689          * IFF_ALLMULTI | IFF_PROMISC cases
 1690          */
 1691         return;
 1692 }
 1693 
 1694 static int
 1695 malo_mode_init(struct malo_softc *sc)
 1696 {
 1697         struct ieee80211com *ic = &sc->malo_ic;
 1698         struct ifnet *ifp = ic->ic_ifp;
 1699         struct malo_hal *mh = sc->malo_mh;
 1700 
 1701         /*
 1702          * Handle any link-level address change.  Note that we only
 1703          * need to force ic_myaddr; any other addresses are handled
 1704          * as a byproduct of the ifnet code marking the interface
 1705          * down then up.
 1706          */
 1707         IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
 1708 
 1709         /*
 1710          * NB: Ignore promisc in hostap mode; it's set by the
 1711          * bridge.  This is wrong but we have no way to
 1712          * identify internal requests (from the bridge)
 1713          * versus external requests such as for tcpdump.
 1714          */
 1715         malo_hal_setpromisc(mh, (ifp->if_flags & IFF_PROMISC) &&
 1716             ic->ic_opmode != IEEE80211_M_HOSTAP);
 1717         malo_setmcastfilter(sc);
 1718 
 1719         return ENXIO;
 1720 }
 1721 
 1722 static void
 1723 malo_tx_draintxq(struct malo_softc *sc, struct malo_txq *txq)
 1724 {
 1725         struct ieee80211_node *ni;
 1726         struct malo_txbuf *bf;
 1727         u_int ix;
 1728         
 1729         /*
 1730          * NB: this assumes output has been stopped and
 1731          *     we do not need to block malo_tx_tasklet
 1732          */
 1733         for (ix = 0;; ix++) {
 1734                 MALO_TXQ_LOCK(txq);
 1735                 bf = STAILQ_FIRST(&txq->active);
 1736                 if (bf == NULL) {
 1737                         MALO_TXQ_UNLOCK(txq);
 1738                         break;
 1739                 }
 1740                 STAILQ_REMOVE_HEAD(&txq->active, bf_list);
 1741                 MALO_TXQ_UNLOCK(txq);
 1742 #ifdef MALO_DEBUG
 1743                 if (sc->malo_debug & MALO_DEBUG_RESET) {
 1744                         const struct malo_txrec *tr =
 1745                             mtod(bf->bf_m, const struct malo_txrec *);
 1746                         malo_printtxbuf(bf, txq->qnum, ix);
 1747                         ieee80211_dump_pkt(&sc->malo_ic,
 1748                             (const uint8_t *)&tr->wh,
 1749                             bf->bf_m->m_len - sizeof(tr->fwlen), 0, -1);
 1750                 }
 1751 #endif /* MALO_DEBUG */
 1752                 bus_dmamap_unload(sc->malo_dmat, bf->bf_dmamap);
 1753                 ni = bf->bf_node;
 1754                 bf->bf_node = NULL;
 1755                 if (ni != NULL) {
 1756                         /*
 1757                          * Reclaim node reference.
 1758                          */
 1759                         ieee80211_free_node(ni);
 1760                 }
 1761                 m_freem(bf->bf_m);
 1762                 bf->bf_m = NULL;
 1763                 
 1764                 MALO_TXQ_LOCK(txq);
 1765                 STAILQ_INSERT_TAIL(&txq->free, bf, bf_list);
 1766                 txq->nfree++;
 1767                 MALO_TXQ_UNLOCK(txq);
 1768         }
 1769 }
 1770 
 1771 static void
 1772 malo_stop_locked(struct ifnet *ifp, int disable)
 1773 {
 1774         int i;
 1775         struct malo_softc *sc = ifp->if_softc;
 1776         struct ieee80211com *ic = &sc->malo_ic;
 1777         struct malo_hal *mh = sc->malo_mh;
 1778 
 1779         DPRINTF(sc, MALO_DEBUG_ANY, "%s: invalid %u if_flags 0x%x\n",
 1780             __func__, sc->malo_invalid, ifp->if_flags);
 1781 
 1782         MALO_LOCK_ASSERT(sc);
 1783 
 1784         if (!(ifp->if_drv_flags & IFF_DRV_RUNNING))
 1785                 return;
 1786 
 1787         /*
 1788          * Shutdown the hardware and driver:
 1789          *    reset 802.11 state machine
 1790          *    turn off timers
 1791          *    disable interrupts
 1792          *    turn off the radio
 1793          *    clear transmit machinery
 1794          *    clear receive machinery
 1795          *    drain and release tx queues
 1796          *    reclaim beacon resources
 1797          *    power down hardware
 1798          *
 1799          * Note that some of this work is not possible if the hardware
 1800          * is gone (invalid).
 1801          */
 1802         ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
 1803         ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
 1804         callout_stop(&sc->malo_watchdog_timer);
 1805         sc->malo_timer = 0;
 1806         if (sc->malo_fw_loaded == 1) {
 1807                 /* diable interrupt.  */
 1808                 malo_hal_intrset(mh, 0);
 1809                 /* turn off the radio.  */
 1810                 malo_hal_setradio(mh, 0, MHP_AUTO_PREAMBLE);
 1811         }
 1812 
 1813         /* drain and release tx queues.  */
 1814         for (i = 0; i < MALO_NUM_TX_QUEUES; i++)
 1815                 malo_tx_draintxq(sc, &sc->malo_txq[i]);
 1816 }
 1817 
 1818 static int
 1819 malo_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 1820 {
 1821 #define MALO_IS_RUNNING(ifp) \
 1822         ((ifp->if_flags & IFF_UP) && (ifp->if_drv_flags & IFF_DRV_RUNNING))
 1823         struct malo_softc *sc = ifp->if_softc;
 1824         struct ieee80211com *ic = &sc->malo_ic;
 1825         int error = 0;
 1826 
 1827         MALO_LOCK(sc);
 1828 
 1829         switch (cmd) {
 1830         case SIOCSIFFLAGS:
 1831                 if (MALO_IS_RUNNING(ifp)) {
 1832                         /*
 1833                          * To avoid rescanning another access point,
 1834                          * do not call malo_init() here.  Instead,
 1835                          * only reflect promisc mode settings.
 1836                          */
 1837                         malo_mode_init(sc);
 1838                 } else if (ifp->if_flags & IFF_UP) {
 1839                         /*
 1840                          * Beware of being called during attach/detach
 1841                          * to reset promiscuous mode.  In that case we
 1842                          * will still be marked UP but not RUNNING.
 1843                          * However trying to re-init the interface
 1844                          * is the wrong thing to do as we've already
 1845                          * torn down much of our state.  There's
 1846                          * probably a better way to deal with this.
 1847                          */
 1848                         if (!sc->malo_invalid)
 1849                                 malo_init(sc);
 1850                 } else
 1851                         malo_stop_locked(ifp, 1);
 1852                 break;
 1853         case SIOCADDMULTI:
 1854         case SIOCDELMULTI:
 1855                 /*
 1856                  * The upper layer has already installed/removed
 1857                  * the multicast address(es), just recalculate the
 1858                  * multicast filter for the card.
 1859                  */
 1860                 if (ifp->if_drv_flags & IFF_DRV_RUNNING)
 1861                         malo_mode_init(sc);
 1862                 break;
 1863         default:
 1864                 error = ieee80211_ioctl(ic, cmd, data);
 1865                 if (error == ENETRESET) {
 1866                         if (MALO_IS_RUNNING(ifp) &&
 1867                             ic->ic_roaming != IEEE80211_ROAMING_MANUAL)
 1868                                 malo_init(sc);
 1869                         error = 0;
 1870                 }
 1871                 if (error == ERESTART) {
 1872                         /* XXX we need to reset the device here.  */
 1873                         error = 0;
 1874                 }
 1875                 break;
 1876         }
 1877 
 1878         MALO_UNLOCK(sc);
 1879 
 1880         return error;
 1881 #undef MALO_IS_RUNNING
 1882 }
 1883 
 1884 /*
 1885  * Callback from the 802.11 layer to update the slot time
 1886  * based on the current setting.  We use it to notify the
 1887  * firmware of ERP changes and the f/w takes care of things
 1888  * like slot time and preamble.
 1889  */
 1890 static void
 1891 malo_updateslot(struct ifnet *ifp)
 1892 {
 1893         struct malo_softc *sc = ifp->if_softc;
 1894         struct ieee80211com *ic = &sc->malo_ic;
 1895         struct malo_hal *mh = sc->malo_mh;
 1896         int error;
 1897         
 1898         /* NB: can be called early; suppress needless cmds */
 1899         if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
 1900                 return;
 1901 
 1902         DPRINTF(sc, MALO_DEBUG_RESET,
 1903             "%s: chan %u MHz/flags 0x%x %s slot, (ic_flags 0x%x)\n",
 1904             __func__, ic->ic_curchan->ic_freq, ic->ic_curchan->ic_flags,
 1905             ic->ic_flags & IEEE80211_F_SHSLOT ? "short" : "long", ic->ic_flags);
 1906 
 1907         if (ic->ic_flags & IEEE80211_F_SHSLOT)
 1908                 error = malo_hal_set_slot(mh, 1);
 1909         else
 1910                 error = malo_hal_set_slot(mh, 0);
 1911 
 1912         if (error != 0)
 1913                 device_printf(sc->malo_dev, "setting %s slot failed\n",
 1914                         ic->ic_flags & IEEE80211_F_SHSLOT ? "short" : "long");
 1915 }
 1916 
 1917 static int
 1918 malo_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
 1919 {
 1920         struct ieee80211_node *ni = ic->ic_bss;
 1921         struct ifnet *ifp = ic->ic_ifp;
 1922         struct malo_softc *sc = ifp->if_softc;
 1923         struct malo_hal *mh = sc->malo_mh;
 1924         int error;
 1925 
 1926         DPRINTF(sc, MALO_DEBUG_STATE, "%s: %s -> %s\n", __func__,
 1927             ieee80211_state_name[ic->ic_state],
 1928             ieee80211_state_name[nstate]);
 1929 
 1930         /*
 1931          * Carry out firmware actions per-state.
 1932          */
 1933         switch (nstate) {
 1934         case IEEE80211_S_INIT:
 1935         case IEEE80211_S_SCAN:
 1936         case IEEE80211_S_AUTH:
 1937                 /* NB: do nothing.  */
 1938                 break;
 1939         case IEEE80211_S_ASSOC:
 1940                 malo_hal_setradio(mh, 1,
 1941                     (ic->ic_flags & IEEE80211_F_SHPREAMBLE) ?
 1942                     MHP_SHORT_PREAMBLE : MHP_LONG_PREAMBLE);
 1943                 break;
 1944         case IEEE80211_S_RUN:
 1945                 DPRINTF(sc, MALO_DEBUG_STATE,
 1946                     "%s: %s(RUN): ic_flags 0x%08x bintvl %d bssid %s "
 1947                     "capinfo 0x%04x chan %d\n",
 1948                     ifp->if_xname, __func__, ic->ic_flags,
 1949                     ni->ni_intval, ether_sprintf(ni->ni_bssid), ni->ni_capinfo,
 1950                     ieee80211_chan2ieee(ic, ic->ic_curchan));
 1951 
 1952                 switch (ic->ic_opmode) {
 1953                 case IEEE80211_M_STA:
 1954                         DPRINTF(sc, MALO_DEBUG_STATE, "%s: %s: aid 0x%x\n",
 1955                             ic->ic_ifp->if_xname, __func__, ni->ni_associd);
 1956                         malo_hal_setassocid(sc->malo_mh,
 1957                             ni->ni_bssid, ni->ni_associd);
 1958 
 1959                         if (ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE)
 1960                                 /* automatic rate adaption */
 1961                                 malo_hal_set_rate(mh, ic->ic_curmode, 0);
 1962                         else
 1963                                 /* fixed rate */
 1964                                 malo_hal_set_rate(mh, ic->ic_curmode, 
 1965                                     malo_fix2rate(ic->ic_fixed_rate));
 1966                         break;
 1967                 default:
 1968                         break;
 1969                 }
 1970 
 1971                 break;
 1972         default:
 1973                 if_printf(ifp, "%s: can't handle state %s -> %s\n",
 1974                     __func__, ieee80211_state_name[ic->ic_state],
 1975                     ieee80211_state_name[nstate]);
 1976         }
 1977 
 1978         /*
 1979          * Invoke the parent method to complete the work.
 1980          */
 1981         error = sc->malo_newstate(ic, nstate, arg);
 1982 
 1983         return error;
 1984 }
 1985 
 1986 static int
 1987 malo_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 1988         const struct ieee80211_bpf_params *params)
 1989 {
 1990         struct ieee80211com *ic = ni->ni_ic;
 1991         struct ifnet *ifp = ic->ic_ifp;
 1992         struct malo_softc *sc = ifp->if_softc;
 1993         struct malo_txbuf *bf;
 1994         struct malo_txq *txq;
 1995 
 1996         if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0 || sc->malo_invalid) {
 1997                 ieee80211_free_node(ni);
 1998                 m_freem(m);
 1999                 return ENETDOWN;
 2000         }
 2001 
 2002         /*
 2003          * Grab a TX buffer and associated resources.  Note that we depend
 2004          * on the classification by the 802.11 layer to get to the right h/w
 2005          * queue.  Management frames must ALWAYS go on queue 1 but we
 2006          * cannot just force that here because we may receive non-mgt frames.
 2007          */
 2008         txq = &sc->malo_txq[0];
 2009         bf = malo_getbuf(sc, txq);
 2010         if (bf == NULL) {
 2011                 /* XXX blocks other traffic */
 2012                 ifp->if_drv_flags |= IFF_DRV_OACTIVE;
 2013                 ieee80211_free_node(ni);
 2014                 m_freem(m);
 2015                 return ENOBUFS;
 2016         }
 2017 
 2018         /*
 2019          * Pass the frame to the h/w for transmission.
 2020          */
 2021         if (malo_tx_start(sc, ni, bf, m) != 0) {
 2022                 ifp->if_oerrors++;
 2023                 bf->bf_m = NULL;
 2024                 bf->bf_node = NULL;
 2025                 MALO_TXQ_LOCK(txq);
 2026                 STAILQ_INSERT_HEAD(&txq->free, bf, bf_list);
 2027                 txq->nfree++;
 2028                 MALO_TXQ_UNLOCK(txq);
 2029 
 2030                 ieee80211_free_node(ni);
 2031                 return EIO;             /* XXX */
 2032         }
 2033 
 2034         /*
 2035          * NB: We don't need to lock against tx done because this just
 2036          * prods the firmware to check the transmit descriptors.  The firmware
 2037          * will also start fetching descriptors by itself if it notices
 2038          * new ones are present when it goes to deliver a tx done interrupt
 2039          * to the host. So if we race with tx done processing it's ok.
 2040          * Delivering the kick here rather than in malo_tx_start is
 2041          * an optimization to avoid poking the firmware for each packet.
 2042          *
 2043          * NB: the queue id isn't used so 0 is ok.
 2044          */
 2045         malo_hal_txstart(sc->malo_mh, 0/*XXX*/);
 2046 
 2047         return 0;
 2048 }
 2049 
 2050 static int
 2051 malo_media_change(struct ifnet *ifp)
 2052 {
 2053 #define IS_UP(ifp) \
 2054         ((ifp->if_flags & IFF_UP) && (ifp->if_drv_flags & IFF_DRV_RUNNING))
 2055         int error;
 2056 
 2057         error = ieee80211_media_change(ifp);
 2058         if (error == ENETRESET) {
 2059                 struct malo_softc *sc = ifp->if_softc;
 2060 
 2061                 if (IS_UP(ifp))
 2062                         malo_init(sc);
 2063                 error = 0;
 2064         }
 2065         return error;
 2066 #undef IS_UP
 2067 }
 2068 
 2069 static void
 2070 malo_bpfattach(struct malo_softc *sc)
 2071 {
 2072         struct ifnet *ifp = sc->malo_ifp;
 2073 
 2074         bpfattach2(ifp, DLT_IEEE802_11_RADIO,
 2075             sizeof(struct ieee80211_frame) + sizeof(sc->malo_tx_th),
 2076             &sc->malo_drvbpf);
 2077 
 2078         /*
 2079          * Initialize constant fields.
 2080          * XXX make header lengths a multiple of 32-bits so subsequent
 2081          *     headers are properly aligned; this is a kludge to keep
 2082          *     certain applications happy.
 2083          *
 2084          * NB: the channel is setup each time we transition to the
 2085          *     RUN state to avoid filling it in for each frame.
 2086          */
 2087         sc->malo_tx_th_len = roundup(sizeof(sc->malo_tx_th), sizeof(uint32_t));
 2088         sc->malo_tx_th.wt_ihdr.it_len = htole16(sc->malo_tx_th_len);
 2089         sc->malo_tx_th.wt_ihdr.it_present = htole32(MALO_TX_RADIOTAP_PRESENT);
 2090 
 2091         sc->malo_rx_th_len = roundup(sizeof(sc->malo_rx_th), sizeof(uint32_t));
 2092         sc->malo_rx_th.wr_ihdr.it_len = htole16(sc->malo_rx_th_len);
 2093         sc->malo_rx_th.wr_ihdr.it_present = htole32(MALO_RX_RADIOTAP_PRESENT);
 2094 }
 2095 
 2096 static void
 2097 malo_sysctlattach(struct malo_softc *sc)
 2098 {
 2099 #ifdef  MALO_DEBUG
 2100         struct sysctl_ctx_list *ctx = device_get_sysctl_ctx(sc->malo_dev);
 2101         struct sysctl_oid *tree = device_get_sysctl_tree(sc->malo_dev);
 2102 
 2103         sc->malo_debug = malo_debug;
 2104         SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
 2105                 "debug", CTLFLAG_RW, &sc->malo_debug, 0,
 2106                 "control debugging printfs");
 2107 #endif
 2108 }
 2109 
 2110 static void
 2111 malo_announce(struct malo_softc *sc)
 2112 {
 2113         struct ifnet *ifp = sc->malo_ifp;
 2114 
 2115         if_printf(ifp, "versions [hw %d fw %d.%d.%d.%d] (regioncode %d)\n",
 2116                 sc->malo_hwspecs.hwversion,
 2117                 (sc->malo_hwspecs.fw_releasenum >> 24) & 0xff,
 2118                 (sc->malo_hwspecs.fw_releasenum >> 16) & 0xff,
 2119                 (sc->malo_hwspecs.fw_releasenum >> 8) & 0xff,
 2120                 (sc->malo_hwspecs.fw_releasenum >> 0) & 0xff,
 2121                 sc->malo_hwspecs.regioncode);
 2122 
 2123         if (bootverbose || malo_rxbuf != MALO_RXBUF)
 2124                 if_printf(ifp, "using %u rx buffers\n", malo_rxbuf);
 2125         if (bootverbose || malo_txbuf != MALO_TXBUF)
 2126                 if_printf(ifp, "using %u tx buffers\n", malo_txbuf);
 2127 }
 2128 
 2129 /*
 2130  * Convert net80211 channel to a HAL channel.
 2131  */
 2132 static void
 2133 malo_mapchan(struct malo_hal_channel *hc, const struct ieee80211_channel *chan)
 2134 {
 2135         hc->channel = chan->ic_ieee;
 2136 
 2137         *(uint32_t *)&hc->flags = 0;
 2138         if (IEEE80211_IS_CHAN_2GHZ(chan))
 2139                 hc->flags.freqband = MALO_FREQ_BAND_2DOT4GHZ;
 2140 }
 2141 
 2142 /*
 2143  * Set/change channels.  If the channel is really being changed,
 2144  * it's done by reseting the chip.  To accomplish this we must
 2145  * first cleanup any pending DMA, then restart stuff after a la
 2146  * malo_init.
 2147  */
 2148 static int
 2149 malo_chan_set(struct malo_softc *sc, struct ieee80211_channel *chan)
 2150 {
 2151         struct malo_hal *mh = sc->malo_mh;
 2152         struct malo_hal_channel hchan;
 2153 
 2154         DPRINTF(sc, MALO_DEBUG_RESET, "%s: chan %u MHz/flags 0x%x\n",
 2155             __func__, chan->ic_freq, chan->ic_flags);
 2156 
 2157         /*
 2158          * Convert to a HAL channel description with the flags constrained
 2159          * to reflect the current operating mode.
 2160          */
 2161         malo_mapchan(&hchan, chan);
 2162         malo_hal_intrset(mh, 0);                /* disable interrupts */
 2163         malo_hal_setchannel(mh, &hchan);
 2164         malo_hal_settxpower(mh, &hchan);
 2165 
 2166         /*
 2167          * Update internal state.
 2168          */
 2169         sc->malo_tx_th.wt_chan_freq = htole16(chan->ic_freq);
 2170         sc->malo_rx_th.wr_chan_freq = htole16(chan->ic_freq);
 2171         if (IEEE80211_IS_CHAN_ANYG(chan)) {
 2172                 sc->malo_tx_th.wt_chan_flags = htole16(IEEE80211_CHAN_G);
 2173                 sc->malo_rx_th.wr_chan_flags = htole16(IEEE80211_CHAN_G);
 2174         } else {
 2175                 sc->malo_tx_th.wt_chan_flags = htole16(IEEE80211_CHAN_B);
 2176                 sc->malo_rx_th.wr_chan_flags = htole16(IEEE80211_CHAN_B);
 2177         }
 2178         sc->malo_curchan = hchan;
 2179         malo_hal_intrset(mh, sc->malo_imask);
 2180 
 2181         return 0;
 2182 }
 2183 
 2184 static void
 2185 malo_scan_start(struct ieee80211com *ic)
 2186 {
 2187         struct ifnet *ifp = ic->ic_ifp;
 2188         struct malo_softc *sc = ifp->if_softc;
 2189 
 2190         DPRINTF(sc, MALO_DEBUG_STATE, "%s\n", __func__);
 2191 }
 2192 
 2193 static void
 2194 malo_scan_end(struct ieee80211com *ic)
 2195 {
 2196         struct ifnet *ifp = ic->ic_ifp;
 2197         struct malo_softc *sc = ifp->if_softc;
 2198 
 2199         DPRINTF(sc, MALO_DEBUG_STATE, "%s\n", __func__);
 2200 }
 2201 
 2202 static void
 2203 malo_set_channel(struct ieee80211com *ic)
 2204 {
 2205         struct ifnet *ifp = ic->ic_ifp;
 2206         struct malo_softc *sc = ifp->if_softc;
 2207 
 2208         (void) malo_chan_set(sc, ic->ic_curchan);
 2209 }
 2210 
 2211 static void
 2212 malo_rx_proc(void *arg, int npending)
 2213 {
 2214 #define IEEE80211_DIR_DSTODS(wh)                                        \
 2215         ((((const struct ieee80211_frame *)wh)->i_fc[1] &               \
 2216             IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS)
 2217         struct malo_softc *sc = arg;
 2218         struct malo_rxbuf *bf;
 2219         struct ieee80211com *ic = &sc->malo_ic;
 2220         struct ifnet *ifp = sc->malo_ifp;
 2221         struct malo_rxdesc *ds;
 2222         struct mbuf *m, *mnew;
 2223         struct ieee80211_qosframe *wh;
 2224         struct ieee80211_qosframe_addr4 *wh4;
 2225         struct ieee80211_node *ni;
 2226         int off, len, hdrlen, pktlen, rssi, ntodo;
 2227         uint8_t *data, status;
 2228         uint32_t readptr, writeptr;
 2229 
 2230         DPRINTF(sc, MALO_DEBUG_RX_PROC,
 2231             "%s: pending %u rdptr(0x%x) 0x%x wrptr(0x%x) 0x%x\n",
 2232             __func__, npending,
 2233             sc->malo_hwspecs.rxdesc_read,
 2234             malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_read),
 2235             sc->malo_hwspecs.rxdesc_write,
 2236             malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_write));
 2237 
 2238         readptr = malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_read);
 2239         writeptr = malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_write);
 2240         if (readptr == writeptr)
 2241                 return;
 2242 
 2243         bf = sc->malo_rxnext;
 2244         for (ntodo = malo_rxquota; ntodo > 0 && (readptr != writeptr);
 2245              ntodo--) {
 2246                 if (bf == NULL) {
 2247                         bf = STAILQ_FIRST(&sc->malo_rxbuf);
 2248                         break;
 2249                 }
 2250                 ds = bf->bf_desc;
 2251                 if (bf->bf_m == NULL) {
 2252                         /*
 2253                          * If data allocation failed previously there
 2254                          * will be no buffer; try again to re-populate it.
 2255                          * Note the firmware will not advance to the next
 2256                          * descriptor with a dma buffer so we must mimic
 2257                          * this or we'll get out of sync.
 2258                          */ 
 2259                         DPRINTF(sc, MALO_DEBUG_ANY,
 2260                             "%s: rx buf w/o dma memory\n", __func__);
 2261                         (void)malo_rxbuf_init(sc, bf);
 2262                         break;
 2263                 }
 2264                 MALO_RXDESC_SYNC(sc, ds,
 2265                     BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
 2266                 if (ds->rxcontrol != MALO_RXD_CTRL_DMA_OWN)
 2267                         break;
 2268 
 2269                 readptr = le32toh(ds->physnext);
 2270 
 2271 #ifdef MALO_DEBUG
 2272                 if (sc->malo_debug & MALO_DEBUG_RECV_DESC)
 2273                         malo_printrxbuf(bf, 0);
 2274 #endif
 2275                 status = ds->status;
 2276                 if (status & MALO_RXD_STATUS_DECRYPT_ERR_MASK) {
 2277                         ifp->if_ierrors++;
 2278                         goto rx_next;
 2279                 }
 2280                 /*
 2281                  * Sync the data buffer.
 2282                  */
 2283                 len = le16toh(ds->pktlen);
 2284                 bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap,
 2285                     BUS_DMASYNC_POSTREAD);
 2286                 /*
 2287                  * The 802.11 header is provided all or in part at the front;
 2288                  * use it to calculate the true size of the header that we'll
 2289                  * construct below.  We use this to figure out where to copy
 2290                  * payload prior to constructing the header.
 2291                  */
 2292                 m = bf->bf_m;
 2293                 data = mtod(m, uint8_t *);
 2294                 hdrlen = ieee80211_anyhdrsize(data + sizeof(uint16_t));
 2295                 off = sizeof(uint16_t) + sizeof(struct ieee80211_frame_addr4);
 2296 
 2297                 /*
 2298                  * Calculate RSSI.  XXX wrong
 2299                  */
 2300                 rssi = 2 * ((int) ds->snr - ds->nf);    /* NB: .5 dBm  */
 2301                 if (rssi > 100)
 2302                         rssi = 100;
 2303 
 2304                 pktlen = hdrlen + (len - off);
 2305                 /*
 2306                  * NB: we know our frame is at least as large as
 2307                  * IEEE80211_MIN_LEN because there is a 4-address frame at
 2308                  * the front.  Hence there's no need to vet the packet length.
 2309                  * If the frame in fact is too small it should be discarded
 2310                  * at the net80211 layer.
 2311                  */
 2312 
 2313                 /* XXX don't need mbuf, just dma buffer */
 2314                 mnew = malo_getrxmbuf(sc, bf);
 2315                 if (mnew == NULL) {
 2316                         ifp->if_ierrors++;
 2317                         goto rx_next;
 2318                 }
 2319                 
 2320                 /*
 2321                  * Attach the dma buffer to the mbuf; malo_rxbuf_init will
 2322                  * re-setup the rx descriptor using the replacement dma
 2323                  * buffer we just installed above.
 2324                  */
 2325                 bf->bf_m = mnew;
 2326                 m->m_data += off - hdrlen;
 2327                 m->m_pkthdr.len = m->m_len = pktlen;
 2328                 m->m_pkthdr.rcvif = ifp;
 2329 
 2330                 /*
 2331                  * Piece 802.11 header together.
 2332                  */
 2333                 wh = mtod(m, struct ieee80211_qosframe *);
 2334                 /* NB: don't need to do this sometimes but ... */
 2335                 /* XXX special case so we can memcpy after m_devget? */
 2336                 ovbcopy(data + sizeof(uint16_t), wh, hdrlen);
 2337                 if (IEEE80211_QOS_HAS_SEQ(wh)) {
 2338                         if (IEEE80211_DIR_DSTODS(wh)) {
 2339                                 wh4 = mtod(m,
 2340                                     struct ieee80211_qosframe_addr4*);
 2341                                 *(uint16_t *)wh4->i_qos = ds->qosctrl;
 2342                         } else {
 2343                                 *(uint16_t *)wh->i_qos = ds->qosctrl;
 2344                         }
 2345                 }
 2346                 if (sc->malo_drvbpf != NULL) {
 2347                         sc->malo_rx_th.wr_flags = 0;
 2348                         sc->malo_rx_th.wr_rate = ds->rate;
 2349                         sc->malo_rx_th.wr_antsignal = rssi;
 2350                         sc->malo_rx_th.wr_antnoise = ds->nf;
 2351 
 2352                         bpf_mtap2(sc->malo_drvbpf,
 2353                             &sc->malo_rx_th, sc->malo_rx_th_len, m);
 2354                 }
 2355 #ifdef MALO_DEBUG
 2356                 if (IFF_DUMPPKTS_RECV(sc, wh)) {
 2357                         ieee80211_dump_pkt(ic, mtod(m, caddr_t),
 2358                             len, ds->rate, rssi);
 2359                 }
 2360 #endif
 2361                 ifp->if_ipackets++;
 2362                 
 2363                 /* dispatch */
 2364                 ni = ieee80211_find_rxnode(ic,
 2365                     (const struct ieee80211_frame_min *) wh);
 2366                 (void) ieee80211_input(ic, m, ni, rssi, ds->nf, 0/*XXX*/);
 2367                 ieee80211_free_node(ni);
 2368 
 2369 rx_next:
 2370                 /* NB: ignore ENOMEM so we process more descriptors */
 2371                 (void) malo_rxbuf_init(sc, bf);
 2372                 bf = STAILQ_NEXT(bf, bf_list);
 2373         }
 2374         
 2375         malo_bar0_write4(sc, sc->malo_hwspecs.rxdesc_read, readptr);
 2376         sc->malo_rxnext = bf;
 2377 
 2378         if ((ifp->if_drv_flags & IFF_DRV_OACTIVE) == 0 &&
 2379             !IFQ_IS_EMPTY(&ifp->if_snd))
 2380                 malo_start(ifp);
 2381 #undef IEEE80211_DIR_DSTODS
 2382 }
 2383 
 2384 static void
 2385 malo_stop(struct ifnet *ifp, int disable)
 2386 {
 2387         struct malo_softc *sc = ifp->if_softc;
 2388 
 2389         MALO_LOCK(sc);
 2390 
 2391         malo_stop_locked(ifp, disable);
 2392 
 2393         MALO_UNLOCK(sc);
 2394 }
 2395 
 2396 /*
 2397  * Reclaim all tx queue resources.
 2398  */
 2399 static void
 2400 malo_tx_cleanup(struct malo_softc *sc)
 2401 {
 2402         int i;
 2403 
 2404         for (i = 0; i < MALO_NUM_TX_QUEUES; i++)
 2405                 malo_tx_cleanupq(sc, &sc->malo_txq[i]);
 2406 }
 2407 
 2408 int
 2409 malo_detach(struct malo_softc *sc)
 2410 {
 2411         struct ifnet *ifp = sc->malo_ifp;
 2412 
 2413         DPRINTF(sc, MALO_DEBUG_ANY, "%s: if_flags %x\n",
 2414                 __func__, ifp->if_flags);
 2415 
 2416         malo_stop(ifp, 1);
 2417 
 2418         if (sc->malo_tq != NULL) {
 2419                 taskqueue_drain(sc->malo_tq, &sc->malo_rxtask);
 2420                 taskqueue_drain(sc->malo_tq, &sc->malo_txtask);
 2421                 taskqueue_free(sc->malo_tq);
 2422                 sc->malo_tq = NULL;
 2423         }
 2424 
 2425         bpfdetach(ifp);
 2426 
 2427         /*
 2428          * NB: the order of these is important:
 2429          * o call the 802.11 layer before detaching the hal to
 2430          *   insure callbacks into the driver to delete global
 2431          *   key cache entries can be handled
 2432          * o reclaim the tx queue data structures after calling
 2433          *   the 802.11 layer as we'll get called back to reclaim
 2434          *   node state and potentially want to use them
 2435          * o to cleanup the tx queues the hal is called, so detach
 2436          *   it last
 2437          * Other than that, it's straightforward...
 2438          */
 2439         ieee80211_ifdetach(&sc->malo_ic);
 2440         callout_drain(&sc->malo_watchdog_timer);
 2441         malo_dma_cleanup(sc);
 2442         malo_tx_cleanup(sc);
 2443         malo_hal_detach(sc->malo_mh);
 2444         if_free(ifp);
 2445 
 2446         MALO_LOCK_DESTROY(sc);
 2447 
 2448         return 0;
 2449 }
 2450 
 2451 void
 2452 malo_shutdown(struct malo_softc *sc)
 2453 {
 2454 
 2455         malo_stop(sc->malo_ifp, 1);
 2456 }
 2457 
 2458 void
 2459 malo_suspend(struct malo_softc *sc)
 2460 {
 2461         struct ifnet *ifp = sc->malo_ifp;
 2462 
 2463         DPRINTF(sc, MALO_DEBUG_ANY, "%s: if_flags %x\n",
 2464                 __func__, ifp->if_flags);
 2465 
 2466         malo_stop(ifp, 1);
 2467 }
 2468 
 2469 void
 2470 malo_resume(struct malo_softc *sc)
 2471 {
 2472         struct ifnet *ifp = sc->malo_ifp;
 2473 
 2474         DPRINTF(sc, MALO_DEBUG_ANY, "%s: if_flags %x\n",
 2475                 __func__, ifp->if_flags);
 2476 
 2477         if (ifp->if_flags & IFF_UP) {
 2478                 malo_init(sc);
 2479                 if (ifp->if_drv_flags & IFF_DRV_RUNNING)
 2480                         malo_start(ifp);
 2481         }
 2482 }

Cache object: 1759edd0e2c57ea661652414c8aa0fd7


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.