1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2008 Weongyo Jeong <weongyo@freebsd.org>
5 * Copyright (c) 2007 Marvell Semiconductor, Inc.
6 * Copyright (c) 2007 Sam Leffler, Errno Consulting
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer,
14 * without modification.
15 * 2. Redistributions in binary form must reproduce at minimum a disclaimer
16 * similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
17 * redistribution must be conditioned upon including a substantially
18 * similar Disclaimer requirement for further binary redistribution.
19 *
20 * NO WARRANTY
21 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23 * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
24 * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
25 * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
26 * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
27 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
28 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
29 * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
30 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
31 * THE POSSIBILITY OF SUCH DAMAGES.
32 */
33
34 #include <sys/cdefs.h>
35 #ifdef __FreeBSD__
36 #endif
37
38 #include "opt_malo.h"
39
40 #include <sys/param.h>
41 #include <sys/endian.h>
42 #include <sys/kernel.h>
43 #include <sys/malloc.h>
44 #include <sys/socket.h>
45 #include <sys/sockio.h>
46 #include <sys/sysctl.h>
47 #include <sys/taskqueue.h>
48
49 #include <machine/bus.h>
50 #include <sys/bus.h>
51
52 #include <net/if.h>
53 #include <net/if_var.h>
54 #include <net/if_dl.h>
55 #include <net/if_media.h>
56 #include <net/if_types.h>
57 #include <net/ethernet.h>
58
59 #include <net80211/ieee80211_var.h>
60 #include <net80211/ieee80211_regdomain.h>
61
62 #include <net/bpf.h>
63
64 #include <dev/malo/if_malo.h>
65
66 SYSCTL_NODE(_hw, OID_AUTO, malo, CTLFLAG_RD | CTLFLAG_MPSAFE, 0,
67 "Marvell 88w8335 driver parameters");
68
69 static int malo_txcoalesce = 8; /* # tx pkts to q before poking f/w*/
70 SYSCTL_INT(_hw_malo, OID_AUTO, txcoalesce, CTLFLAG_RWTUN, &malo_txcoalesce,
71 0, "tx buffers to send at once");
72 static int malo_rxbuf = MALO_RXBUF; /* # rx buffers to allocate */
73 SYSCTL_INT(_hw_malo, OID_AUTO, rxbuf, CTLFLAG_RWTUN, &malo_rxbuf,
74 0, "rx buffers allocated");
75 static int malo_rxquota = MALO_RXBUF; /* # max buffers to process */
76 SYSCTL_INT(_hw_malo, OID_AUTO, rxquota, CTLFLAG_RWTUN, &malo_rxquota,
77 0, "max rx buffers to process per interrupt");
78 static int malo_txbuf = MALO_TXBUF; /* # tx buffers to allocate */
79 SYSCTL_INT(_hw_malo, OID_AUTO, txbuf, CTLFLAG_RWTUN, &malo_txbuf,
80 0, "tx buffers allocated");
81
82 #ifdef MALO_DEBUG
83 static int malo_debug = 0;
84 SYSCTL_INT(_hw_malo, OID_AUTO, debug, CTLFLAG_RWTUN, &malo_debug,
85 0, "control debugging printfs");
86 enum {
87 MALO_DEBUG_XMIT = 0x00000001, /* basic xmit operation */
88 MALO_DEBUG_XMIT_DESC = 0x00000002, /* xmit descriptors */
89 MALO_DEBUG_RECV = 0x00000004, /* basic recv operation */
90 MALO_DEBUG_RECV_DESC = 0x00000008, /* recv descriptors */
91 MALO_DEBUG_RESET = 0x00000010, /* reset processing */
92 MALO_DEBUG_INTR = 0x00000040, /* ISR */
93 MALO_DEBUG_TX_PROC = 0x00000080, /* tx ISR proc */
94 MALO_DEBUG_RX_PROC = 0x00000100, /* rx ISR proc */
95 MALO_DEBUG_STATE = 0x00000400, /* 802.11 state transitions */
96 MALO_DEBUG_NODE = 0x00000800, /* node management */
97 MALO_DEBUG_RECV_ALL = 0x00001000, /* trace all frames (beacons) */
98 MALO_DEBUG_FW = 0x00008000, /* firmware */
99 MALO_DEBUG_ANY = 0xffffffff
100 };
101 #define IS_BEACON(wh) \
102 ((wh->i_fc[0] & (IEEE80211_FC0_TYPE_MASK | \
103 IEEE80211_FC0_SUBTYPE_MASK)) == \
104 (IEEE80211_FC0_TYPE_MGT|IEEE80211_FC0_SUBTYPE_BEACON))
105 #define IFF_DUMPPKTS_RECV(sc, wh) \
106 (((sc->malo_debug & MALO_DEBUG_RECV) && \
107 ((sc->malo_debug & MALO_DEBUG_RECV_ALL) || !IS_BEACON(wh))))
108 #define IFF_DUMPPKTS_XMIT(sc) \
109 (sc->malo_debug & MALO_DEBUG_XMIT)
110 #define DPRINTF(sc, m, fmt, ...) do { \
111 if (sc->malo_debug & (m)) \
112 printf(fmt, __VA_ARGS__); \
113 } while (0)
114 #else
115 #define DPRINTF(sc, m, fmt, ...) do { \
116 (void) sc; \
117 } while (0)
118 #endif
119
120 static MALLOC_DEFINE(M_MALODEV, "malodev", "malo driver dma buffers");
121
122 static struct ieee80211vap *malo_vap_create(struct ieee80211com *,
123 const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
124 const uint8_t [IEEE80211_ADDR_LEN],
125 const uint8_t [IEEE80211_ADDR_LEN]);
126 static void malo_vap_delete(struct ieee80211vap *);
127 static int malo_dma_setup(struct malo_softc *);
128 static int malo_setup_hwdma(struct malo_softc *);
129 static void malo_txq_init(struct malo_softc *, struct malo_txq *, int);
130 static void malo_tx_cleanupq(struct malo_softc *, struct malo_txq *);
131 static void malo_parent(struct ieee80211com *);
132 static int malo_transmit(struct ieee80211com *, struct mbuf *);
133 static void malo_start(struct malo_softc *);
134 static void malo_watchdog(void *);
135 static void malo_updateslot(struct ieee80211com *);
136 static int malo_newstate(struct ieee80211vap *, enum ieee80211_state, int);
137 static void malo_scan_start(struct ieee80211com *);
138 static void malo_scan_end(struct ieee80211com *);
139 static void malo_set_channel(struct ieee80211com *);
140 static int malo_raw_xmit(struct ieee80211_node *, struct mbuf *,
141 const struct ieee80211_bpf_params *);
142 static void malo_sysctlattach(struct malo_softc *);
143 static void malo_announce(struct malo_softc *);
144 static void malo_dma_cleanup(struct malo_softc *);
145 static void malo_stop(struct malo_softc *);
146 static int malo_chan_set(struct malo_softc *, struct ieee80211_channel *);
147 static int malo_mode_init(struct malo_softc *);
148 static void malo_tx_proc(void *, int);
149 static void malo_rx_proc(void *, int);
150 static void malo_init(void *);
151
152 /*
153 * Read/Write shorthands for accesses to BAR 0. Note that all BAR 1
154 * operations are done in the "hal" except getting H/W MAC address at
155 * malo_attach and there should be no reference to them here.
156 */
157 static uint32_t
malo_bar0_read4(struct malo_softc * sc,bus_size_t off)158 malo_bar0_read4(struct malo_softc *sc, bus_size_t off)
159 {
160 return bus_space_read_4(sc->malo_io0t, sc->malo_io0h, off);
161 }
162
163 static void
malo_bar0_write4(struct malo_softc * sc,bus_size_t off,uint32_t val)164 malo_bar0_write4(struct malo_softc *sc, bus_size_t off, uint32_t val)
165 {
166 DPRINTF(sc, MALO_DEBUG_FW, "%s: off 0x%jx val 0x%x\n",
167 __func__, (uintmax_t)off, val);
168
169 bus_space_write_4(sc->malo_io0t, sc->malo_io0h, off, val);
170 }
171
172 int
malo_attach(uint16_t devid,struct malo_softc * sc)173 malo_attach(uint16_t devid, struct malo_softc *sc)
174 {
175 struct ieee80211com *ic = &sc->malo_ic;
176 struct malo_hal *mh;
177 int error;
178 uint8_t bands[IEEE80211_MODE_BYTES];
179
180 MALO_LOCK_INIT(sc);
181 callout_init_mtx(&sc->malo_watchdog_timer, &sc->malo_mtx, 0);
182 mbufq_init(&sc->malo_snd, ifqmaxlen);
183
184 mh = malo_hal_attach(sc->malo_dev, devid,
185 sc->malo_io1h, sc->malo_io1t, sc->malo_dmat);
186 if (mh == NULL) {
187 device_printf(sc->malo_dev, "unable to attach HAL\n");
188 error = EIO;
189 goto bad;
190 }
191 sc->malo_mh = mh;
192
193 /*
194 * Load firmware so we can get setup. We arbitrarily pick station
195 * firmware; we'll re-load firmware as needed so setting up
196 * the wrong mode isn't a big deal.
197 */
198 error = malo_hal_fwload(mh, "malo8335-h", "malo8335-m");
199 if (error != 0) {
200 device_printf(sc->malo_dev, "unable to setup firmware\n");
201 goto bad1;
202 }
203 /* XXX gethwspecs() extracts correct informations? not maybe! */
204 error = malo_hal_gethwspecs(mh, &sc->malo_hwspecs);
205 if (error != 0) {
206 device_printf(sc->malo_dev, "unable to fetch h/w specs\n");
207 goto bad1;
208 }
209
210 DPRINTF(sc, MALO_DEBUG_FW,
211 "malo_hal_gethwspecs: hwversion 0x%x hostif 0x%x"
212 "maxnum_wcb 0x%x maxnum_mcaddr 0x%x maxnum_tx_wcb 0x%x"
213 "regioncode 0x%x num_antenna 0x%x fw_releasenum 0x%x"
214 "wcbbase0 0x%x rxdesc_read 0x%x rxdesc_write 0x%x"
215 "ul_fw_awakecookie 0x%x w[4] = %x %x %x %x",
216 sc->malo_hwspecs.hwversion,
217 sc->malo_hwspecs.hostinterface, sc->malo_hwspecs.maxnum_wcb,
218 sc->malo_hwspecs.maxnum_mcaddr, sc->malo_hwspecs.maxnum_tx_wcb,
219 sc->malo_hwspecs.regioncode, sc->malo_hwspecs.num_antenna,
220 sc->malo_hwspecs.fw_releasenum, sc->malo_hwspecs.wcbbase0,
221 sc->malo_hwspecs.rxdesc_read, sc->malo_hwspecs.rxdesc_write,
222 sc->malo_hwspecs.ul_fw_awakecookie,
223 sc->malo_hwspecs.wcbbase[0], sc->malo_hwspecs.wcbbase[1],
224 sc->malo_hwspecs.wcbbase[2], sc->malo_hwspecs.wcbbase[3]);
225
226 /* NB: firmware looks that it does not export regdomain info API. */
227 memset(bands, 0, sizeof(bands));
228 setbit(bands, IEEE80211_MODE_11B);
229 setbit(bands, IEEE80211_MODE_11G);
230 ieee80211_init_channels(ic, NULL, bands);
231
232 sc->malo_txantenna = 0x2; /* h/w default */
233 sc->malo_rxantenna = 0xffff; /* h/w default */
234
235 /*
236 * Allocate tx + rx descriptors and populate the lists.
237 * We immediately push the information to the firmware
238 * as otherwise it gets upset.
239 */
240 error = malo_dma_setup(sc);
241 if (error != 0) {
242 device_printf(sc->malo_dev,
243 "failed to setup descriptors: %d\n", error);
244 goto bad1;
245 }
246 error = malo_setup_hwdma(sc); /* push to firmware */
247 if (error != 0) /* NB: malo_setupdma prints msg */
248 goto bad2;
249
250 sc->malo_tq = taskqueue_create_fast("malo_taskq", M_NOWAIT,
251 taskqueue_thread_enqueue, &sc->malo_tq);
252 taskqueue_start_threads(&sc->malo_tq, 1, PI_NET,
253 "%s taskq", device_get_nameunit(sc->malo_dev));
254
255 NET_TASK_INIT(&sc->malo_rxtask, 0, malo_rx_proc, sc);
256 TASK_INIT(&sc->malo_txtask, 0, malo_tx_proc, sc);
257
258 ic->ic_softc = sc;
259 ic->ic_name = device_get_nameunit(sc->malo_dev);
260 /* XXX not right but it's not used anywhere important */
261 ic->ic_phytype = IEEE80211_T_OFDM;
262 ic->ic_opmode = IEEE80211_M_STA;
263 ic->ic_caps =
264 IEEE80211_C_STA /* station mode supported */
265 | IEEE80211_C_BGSCAN /* capable of bg scanning */
266 | IEEE80211_C_MONITOR /* monitor mode */
267 | IEEE80211_C_SHPREAMBLE /* short preamble supported */
268 | IEEE80211_C_SHSLOT /* short slot time supported */
269 | IEEE80211_C_TXPMGT /* capable of txpow mgt */
270 | IEEE80211_C_WPA /* capable of WPA1+WPA2 */
271 ;
272 IEEE80211_ADDR_COPY(ic->ic_macaddr, sc->malo_hwspecs.macaddr);
273
274 /*
275 * Transmit requires space in the packet for a special format transmit
276 * record and optional padding between this record and the payload.
277 * Ask the net80211 layer to arrange this when encapsulating
278 * packets so we can add it efficiently.
279 */
280 ic->ic_headroom = sizeof(struct malo_txrec) -
281 sizeof(struct ieee80211_frame);
282
283 /* call MI attach routine. */
284 ieee80211_ifattach(ic);
285 /* override default methods */
286 ic->ic_vap_create = malo_vap_create;
287 ic->ic_vap_delete = malo_vap_delete;
288 ic->ic_raw_xmit = malo_raw_xmit;
289 ic->ic_updateslot = malo_updateslot;
290 ic->ic_scan_start = malo_scan_start;
291 ic->ic_scan_end = malo_scan_end;
292 ic->ic_set_channel = malo_set_channel;
293 ic->ic_parent = malo_parent;
294 ic->ic_transmit = malo_transmit;
295
296 sc->malo_invalid = 0; /* ready to go, enable int handling */
297
298 ieee80211_radiotap_attach(ic,
299 &sc->malo_tx_th.wt_ihdr, sizeof(sc->malo_tx_th),
300 MALO_TX_RADIOTAP_PRESENT,
301 &sc->malo_rx_th.wr_ihdr, sizeof(sc->malo_rx_th),
302 MALO_RX_RADIOTAP_PRESENT);
303
304 /*
305 * Setup dynamic sysctl's.
306 */
307 malo_sysctlattach(sc);
308
309 if (bootverbose)
310 ieee80211_announce(ic);
311 malo_announce(sc);
312
313 return 0;
314 bad2:
315 malo_dma_cleanup(sc);
316 bad1:
317 malo_hal_detach(mh);
318 bad:
319 sc->malo_invalid = 1;
320
321 return error;
322 }
323
324 static struct ieee80211vap *
malo_vap_create(struct ieee80211com * ic,const char name[IFNAMSIZ],int unit,enum ieee80211_opmode opmode,int flags,const uint8_t bssid[IEEE80211_ADDR_LEN],const uint8_t mac[IEEE80211_ADDR_LEN])325 malo_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
326 enum ieee80211_opmode opmode, int flags,
327 const uint8_t bssid[IEEE80211_ADDR_LEN],
328 const uint8_t mac[IEEE80211_ADDR_LEN])
329 {
330 struct malo_softc *sc = ic->ic_softc;
331 struct malo_vap *mvp;
332 struct ieee80211vap *vap;
333
334 if (!TAILQ_EMPTY(&ic->ic_vaps)) {
335 device_printf(sc->malo_dev, "multiple vaps not supported\n");
336 return NULL;
337 }
338 switch (opmode) {
339 case IEEE80211_M_STA:
340 if (opmode == IEEE80211_M_STA)
341 flags |= IEEE80211_CLONE_NOBEACONS;
342 /* fall thru... */
343 case IEEE80211_M_MONITOR:
344 break;
345 default:
346 device_printf(sc->malo_dev, "%s mode not supported\n",
347 ieee80211_opmode_name[opmode]);
348 return NULL; /* unsupported */
349 }
350 mvp = malloc(sizeof(struct malo_vap), M_80211_VAP, M_WAITOK | M_ZERO);
351 vap = &mvp->malo_vap;
352 ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
353
354 /* override state transition machine */
355 mvp->malo_newstate = vap->iv_newstate;
356 vap->iv_newstate = malo_newstate;
357
358 /* complete setup */
359 ieee80211_vap_attach(vap,
360 ieee80211_media_change, ieee80211_media_status, mac);
361 ic->ic_opmode = opmode;
362 return vap;
363 }
364
365 static void
malo_vap_delete(struct ieee80211vap * vap)366 malo_vap_delete(struct ieee80211vap *vap)
367 {
368 struct malo_vap *mvp = MALO_VAP(vap);
369
370 ieee80211_vap_detach(vap);
371 free(mvp, M_80211_VAP);
372 }
373
374 int
malo_intr(void * arg)375 malo_intr(void *arg)
376 {
377 struct malo_softc *sc = arg;
378 struct malo_hal *mh = sc->malo_mh;
379 uint32_t status;
380
381 if (sc->malo_invalid) {
382 /*
383 * The hardware is not ready/present, don't touch anything.
384 * Note this can happen early on if the IRQ is shared.
385 */
386 DPRINTF(sc, MALO_DEBUG_ANY, "%s: invalid; ignored\n", __func__);
387 return (FILTER_STRAY);
388 }
389
390 /*
391 * Figure out the reason(s) for the interrupt.
392 */
393 malo_hal_getisr(mh, &status); /* NB: clears ISR too */
394 if (status == 0) /* must be a shared irq */
395 return (FILTER_STRAY);
396
397 DPRINTF(sc, MALO_DEBUG_INTR, "%s: status 0x%x imask 0x%x\n",
398 __func__, status, sc->malo_imask);
399
400 if (status & MALO_A2HRIC_BIT_RX_RDY)
401 taskqueue_enqueue(sc->malo_tq, &sc->malo_rxtask);
402 if (status & MALO_A2HRIC_BIT_TX_DONE)
403 taskqueue_enqueue(sc->malo_tq, &sc->malo_txtask);
404 if (status & MALO_A2HRIC_BIT_OPC_DONE)
405 malo_hal_cmddone(mh);
406 if (status & MALO_A2HRIC_BIT_MAC_EVENT)
407 ;
408 if (status & MALO_A2HRIC_BIT_RX_PROBLEM)
409 ;
410 if (status & MALO_A2HRIC_BIT_ICV_ERROR) {
411 /* TKIP ICV error */
412 sc->malo_stats.mst_rx_badtkipicv++;
413 }
414 #ifdef MALO_DEBUG
415 if (((status | sc->malo_imask) ^ sc->malo_imask) != 0)
416 DPRINTF(sc, MALO_DEBUG_INTR,
417 "%s: can't handle interrupt status 0x%x\n",
418 __func__, status);
419 #endif
420 return (FILTER_HANDLED);
421 }
422
423 static void
malo_load_cb(void * arg,bus_dma_segment_t * segs,int nsegs,int error)424 malo_load_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
425 {
426 bus_addr_t *paddr = (bus_addr_t*) arg;
427
428 KASSERT(error == 0, ("error %u on bus_dma callback", error));
429
430 *paddr = segs->ds_addr;
431 }
432
433 static int
malo_desc_setup(struct malo_softc * sc,const char * name,struct malo_descdma * dd,int nbuf,size_t bufsize,int ndesc,size_t descsize)434 malo_desc_setup(struct malo_softc *sc, const char *name,
435 struct malo_descdma *dd,
436 int nbuf, size_t bufsize, int ndesc, size_t descsize)
437 {
438 int error;
439 uint8_t *ds;
440
441 DPRINTF(sc, MALO_DEBUG_RESET,
442 "%s: %s DMA: %u bufs (%ju) %u desc/buf (%ju)\n",
443 __func__, name, nbuf, (uintmax_t) bufsize,
444 ndesc, (uintmax_t) descsize);
445
446 dd->dd_name = name;
447 dd->dd_desc_len = nbuf * ndesc * descsize;
448
449 /*
450 * Setup DMA descriptor area.
451 */
452 error = bus_dma_tag_create(bus_get_dma_tag(sc->malo_dev),/* parent */
453 PAGE_SIZE, 0, /* alignment, bounds */
454 BUS_SPACE_MAXADDR_32BIT, /* lowaddr */
455 BUS_SPACE_MAXADDR, /* highaddr */
456 NULL, NULL, /* filter, filterarg */
457 dd->dd_desc_len, /* maxsize */
458 1, /* nsegments */
459 dd->dd_desc_len, /* maxsegsize */
460 BUS_DMA_ALLOCNOW, /* flags */
461 NULL, /* lockfunc */
462 NULL, /* lockarg */
463 &dd->dd_dmat);
464 if (error != 0) {
465 device_printf(sc->malo_dev, "cannot allocate %s DMA tag\n",
466 dd->dd_name);
467 return error;
468 }
469
470 /* allocate descriptors */
471 error = bus_dmamem_alloc(dd->dd_dmat, (void**) &dd->dd_desc,
472 BUS_DMA_NOWAIT | BUS_DMA_COHERENT, &dd->dd_dmamap);
473 if (error != 0) {
474 device_printf(sc->malo_dev,
475 "unable to alloc memory for %u %s descriptors, "
476 "error %u\n", nbuf * ndesc, dd->dd_name, error);
477 goto fail1;
478 }
479
480 error = bus_dmamap_load(dd->dd_dmat, dd->dd_dmamap,
481 dd->dd_desc, dd->dd_desc_len,
482 malo_load_cb, &dd->dd_desc_paddr, BUS_DMA_NOWAIT);
483 if (error != 0) {
484 device_printf(sc->malo_dev,
485 "unable to map %s descriptors, error %u\n",
486 dd->dd_name, error);
487 goto fail2;
488 }
489
490 ds = dd->dd_desc;
491 memset(ds, 0, dd->dd_desc_len);
492 DPRINTF(sc, MALO_DEBUG_RESET,
493 "%s: %s DMA map: %p (%lu) -> 0x%jx (%lu)\n",
494 __func__, dd->dd_name, ds, (u_long) dd->dd_desc_len,
495 (uintmax_t) dd->dd_desc_paddr, /*XXX*/ (u_long) dd->dd_desc_len);
496
497 return 0;
498 fail2:
499 bus_dmamem_free(dd->dd_dmat, dd->dd_desc, dd->dd_dmamap);
500 fail1:
501 bus_dma_tag_destroy(dd->dd_dmat);
502 memset(dd, 0, sizeof(*dd));
503 return error;
504 }
505
506 #define DS2PHYS(_dd, _ds) \
507 ((_dd)->dd_desc_paddr + ((caddr_t)(_ds) - (caddr_t)(_dd)->dd_desc))
508
509 static int
malo_rxdma_setup(struct malo_softc * sc)510 malo_rxdma_setup(struct malo_softc *sc)
511 {
512 int error, bsize, i;
513 struct malo_rxbuf *bf;
514 struct malo_rxdesc *ds;
515
516 error = malo_desc_setup(sc, "rx", &sc->malo_rxdma,
517 malo_rxbuf, sizeof(struct malo_rxbuf),
518 1, sizeof(struct malo_rxdesc));
519 if (error != 0)
520 return error;
521
522 /*
523 * Allocate rx buffers and set them up.
524 */
525 bsize = malo_rxbuf * sizeof(struct malo_rxbuf);
526 bf = malloc(bsize, M_MALODEV, M_NOWAIT | M_ZERO);
527 if (bf == NULL) {
528 device_printf(sc->malo_dev,
529 "malloc of %u rx buffers failed\n", bsize);
530 return error;
531 }
532 sc->malo_rxdma.dd_bufptr = bf;
533
534 STAILQ_INIT(&sc->malo_rxbuf);
535 ds = sc->malo_rxdma.dd_desc;
536 for (i = 0; i < malo_rxbuf; i++, bf++, ds++) {
537 bf->bf_desc = ds;
538 bf->bf_daddr = DS2PHYS(&sc->malo_rxdma, ds);
539 error = bus_dmamap_create(sc->malo_dmat, BUS_DMA_NOWAIT,
540 &bf->bf_dmamap);
541 if (error != 0) {
542 device_printf(sc->malo_dev,
543 "%s: unable to dmamap for rx buffer, error %d\n",
544 __func__, error);
545 return error;
546 }
547 /* NB: tail is intentional to preserve descriptor order */
548 STAILQ_INSERT_TAIL(&sc->malo_rxbuf, bf, bf_list);
549 }
550 return 0;
551 }
552
553 static int
malo_txdma_setup(struct malo_softc * sc,struct malo_txq * txq)554 malo_txdma_setup(struct malo_softc *sc, struct malo_txq *txq)
555 {
556 int error, bsize, i;
557 struct malo_txbuf *bf;
558 struct malo_txdesc *ds;
559
560 error = malo_desc_setup(sc, "tx", &txq->dma,
561 malo_txbuf, sizeof(struct malo_txbuf),
562 MALO_TXDESC, sizeof(struct malo_txdesc));
563 if (error != 0)
564 return error;
565
566 /* allocate and setup tx buffers */
567 bsize = malo_txbuf * sizeof(struct malo_txbuf);
568 bf = malloc(bsize, M_MALODEV, M_NOWAIT | M_ZERO);
569 if (bf == NULL) {
570 device_printf(sc->malo_dev, "malloc of %u tx buffers failed\n",
571 malo_txbuf);
572 return ENOMEM;
573 }
574 txq->dma.dd_bufptr = bf;
575
576 STAILQ_INIT(&txq->free);
577 txq->nfree = 0;
578 ds = txq->dma.dd_desc;
579 for (i = 0; i < malo_txbuf; i++, bf++, ds += MALO_TXDESC) {
580 bf->bf_desc = ds;
581 bf->bf_daddr = DS2PHYS(&txq->dma, ds);
582 error = bus_dmamap_create(sc->malo_dmat, BUS_DMA_NOWAIT,
583 &bf->bf_dmamap);
584 if (error != 0) {
585 device_printf(sc->malo_dev,
586 "unable to create dmamap for tx "
587 "buffer %u, error %u\n", i, error);
588 return error;
589 }
590 STAILQ_INSERT_TAIL(&txq->free, bf, bf_list);
591 txq->nfree++;
592 }
593
594 return 0;
595 }
596
597 static void
malo_desc_cleanup(struct malo_softc * sc,struct malo_descdma * dd)598 malo_desc_cleanup(struct malo_softc *sc, struct malo_descdma *dd)
599 {
600 bus_dmamap_unload(dd->dd_dmat, dd->dd_dmamap);
601 bus_dmamem_free(dd->dd_dmat, dd->dd_desc, dd->dd_dmamap);
602 bus_dma_tag_destroy(dd->dd_dmat);
603
604 memset(dd, 0, sizeof(*dd));
605 }
606
607 static void
malo_rxdma_cleanup(struct malo_softc * sc)608 malo_rxdma_cleanup(struct malo_softc *sc)
609 {
610 struct malo_rxbuf *bf;
611
612 STAILQ_FOREACH(bf, &sc->malo_rxbuf, bf_list) {
613 if (bf->bf_m != NULL) {
614 m_freem(bf->bf_m);
615 bf->bf_m = NULL;
616 }
617 if (bf->bf_dmamap != NULL) {
618 bus_dmamap_destroy(sc->malo_dmat, bf->bf_dmamap);
619 bf->bf_dmamap = NULL;
620 }
621 }
622 STAILQ_INIT(&sc->malo_rxbuf);
623 if (sc->malo_rxdma.dd_bufptr != NULL) {
624 free(sc->malo_rxdma.dd_bufptr, M_MALODEV);
625 sc->malo_rxdma.dd_bufptr = NULL;
626 }
627 if (sc->malo_rxdma.dd_desc_len != 0)
628 malo_desc_cleanup(sc, &sc->malo_rxdma);
629 }
630
631 static void
malo_txdma_cleanup(struct malo_softc * sc,struct malo_txq * txq)632 malo_txdma_cleanup(struct malo_softc *sc, struct malo_txq *txq)
633 {
634 struct malo_txbuf *bf;
635 struct ieee80211_node *ni;
636
637 STAILQ_FOREACH(bf, &txq->free, bf_list) {
638 if (bf->bf_m != NULL) {
639 m_freem(bf->bf_m);
640 bf->bf_m = NULL;
641 }
642 ni = bf->bf_node;
643 bf->bf_node = NULL;
644 if (ni != NULL) {
645 /*
646 * Reclaim node reference.
647 */
648 ieee80211_free_node(ni);
649 }
650 if (bf->bf_dmamap != NULL) {
651 bus_dmamap_destroy(sc->malo_dmat, bf->bf_dmamap);
652 bf->bf_dmamap = NULL;
653 }
654 }
655 STAILQ_INIT(&txq->free);
656 txq->nfree = 0;
657 if (txq->dma.dd_bufptr != NULL) {
658 free(txq->dma.dd_bufptr, M_MALODEV);
659 txq->dma.dd_bufptr = NULL;
660 }
661 if (txq->dma.dd_desc_len != 0)
662 malo_desc_cleanup(sc, &txq->dma);
663 }
664
665 static void
malo_dma_cleanup(struct malo_softc * sc)666 malo_dma_cleanup(struct malo_softc *sc)
667 {
668 int i;
669
670 for (i = 0; i < MALO_NUM_TX_QUEUES; i++)
671 malo_txdma_cleanup(sc, &sc->malo_txq[i]);
672
673 malo_rxdma_cleanup(sc);
674 }
675
676 static int
malo_dma_setup(struct malo_softc * sc)677 malo_dma_setup(struct malo_softc *sc)
678 {
679 int error, i;
680
681 /* rxdma initializing. */
682 error = malo_rxdma_setup(sc);
683 if (error != 0)
684 return error;
685
686 /* NB: we just have 1 tx queue now. */
687 for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
688 error = malo_txdma_setup(sc, &sc->malo_txq[i]);
689 if (error != 0) {
690 malo_dma_cleanup(sc);
691
692 return error;
693 }
694
695 malo_txq_init(sc, &sc->malo_txq[i], i);
696 }
697
698 return 0;
699 }
700
701 static void
malo_hal_set_rxtxdma(struct malo_softc * sc)702 malo_hal_set_rxtxdma(struct malo_softc *sc)
703 {
704 int i;
705
706 malo_bar0_write4(sc, sc->malo_hwspecs.rxdesc_read,
707 sc->malo_hwdma.rxdesc_read);
708 malo_bar0_write4(sc, sc->malo_hwspecs.rxdesc_write,
709 sc->malo_hwdma.rxdesc_read);
710
711 for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
712 malo_bar0_write4(sc,
713 sc->malo_hwspecs.wcbbase[i], sc->malo_hwdma.wcbbase[i]);
714 }
715 }
716
717 /*
718 * Inform firmware of our tx/rx dma setup. The BAR 0 writes below are
719 * for compatibility with older firmware. For current firmware we send
720 * this information with a cmd block via malo_hal_sethwdma.
721 */
722 static int
malo_setup_hwdma(struct malo_softc * sc)723 malo_setup_hwdma(struct malo_softc *sc)
724 {
725 int i;
726 struct malo_txq *txq;
727
728 sc->malo_hwdma.rxdesc_read = sc->malo_rxdma.dd_desc_paddr;
729
730 for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
731 txq = &sc->malo_txq[i];
732 sc->malo_hwdma.wcbbase[i] = txq->dma.dd_desc_paddr;
733 }
734 sc->malo_hwdma.maxnum_txwcb = malo_txbuf;
735 sc->malo_hwdma.maxnum_wcb = MALO_NUM_TX_QUEUES;
736
737 malo_hal_set_rxtxdma(sc);
738
739 return 0;
740 }
741
742 static void
malo_txq_init(struct malo_softc * sc,struct malo_txq * txq,int qnum)743 malo_txq_init(struct malo_softc *sc, struct malo_txq *txq, int qnum)
744 {
745 struct malo_txbuf *bf, *bn;
746 struct malo_txdesc *ds;
747
748 MALO_TXQ_LOCK_INIT(sc, txq);
749 txq->qnum = qnum;
750 txq->txpri = 0; /* XXX */
751
752 STAILQ_FOREACH(bf, &txq->free, bf_list) {
753 bf->bf_txq = txq;
754
755 ds = bf->bf_desc;
756 bn = STAILQ_NEXT(bf, bf_list);
757 if (bn == NULL)
758 bn = STAILQ_FIRST(&txq->free);
759 ds->physnext = htole32(bn->bf_daddr);
760 }
761 STAILQ_INIT(&txq->active);
762 }
763
764 /*
765 * Reclaim resources for a setup queue.
766 */
767 static void
malo_tx_cleanupq(struct malo_softc * sc,struct malo_txq * txq)768 malo_tx_cleanupq(struct malo_softc *sc, struct malo_txq *txq)
769 {
770 /* XXX hal work? */
771 MALO_TXQ_LOCK_DESTROY(txq);
772 }
773
774 /*
775 * Allocate a tx buffer for sending a frame.
776 */
777 static struct malo_txbuf *
malo_getbuf(struct malo_softc * sc,struct malo_txq * txq)778 malo_getbuf(struct malo_softc *sc, struct malo_txq *txq)
779 {
780 struct malo_txbuf *bf;
781
782 MALO_TXQ_LOCK(txq);
783 bf = STAILQ_FIRST(&txq->free);
784 if (bf != NULL) {
785 STAILQ_REMOVE_HEAD(&txq->free, bf_list);
786 txq->nfree--;
787 }
788 MALO_TXQ_UNLOCK(txq);
789 if (bf == NULL) {
790 DPRINTF(sc, MALO_DEBUG_XMIT,
791 "%s: out of xmit buffers on q %d\n", __func__, txq->qnum);
792 sc->malo_stats.mst_tx_qstop++;
793 }
794 return bf;
795 }
796
797 static int
malo_tx_dmasetup(struct malo_softc * sc,struct malo_txbuf * bf,struct mbuf * m0)798 malo_tx_dmasetup(struct malo_softc *sc, struct malo_txbuf *bf, struct mbuf *m0)
799 {
800 struct mbuf *m;
801 int error;
802
803 /*
804 * Load the DMA map so any coalescing is done. This also calculates
805 * the number of descriptors we need.
806 */
807 error = bus_dmamap_load_mbuf_sg(sc->malo_dmat, bf->bf_dmamap, m0,
808 bf->bf_segs, &bf->bf_nseg,
809 BUS_DMA_NOWAIT);
810 if (error == EFBIG) {
811 /* XXX packet requires too many descriptors */
812 bf->bf_nseg = MALO_TXDESC + 1;
813 } else if (error != 0) {
814 sc->malo_stats.mst_tx_busdma++;
815 m_freem(m0);
816 return error;
817 }
818 /*
819 * Discard null packets and check for packets that require too many
820 * TX descriptors. We try to convert the latter to a cluster.
821 */
822 if (error == EFBIG) { /* too many desc's, linearize */
823 sc->malo_stats.mst_tx_linear++;
824 m = m_defrag(m0, M_NOWAIT);
825 if (m == NULL) {
826 m_freem(m0);
827 sc->malo_stats.mst_tx_nombuf++;
828 return ENOMEM;
829 }
830 m0 = m;
831 error = bus_dmamap_load_mbuf_sg(sc->malo_dmat, bf->bf_dmamap, m0,
832 bf->bf_segs, &bf->bf_nseg,
833 BUS_DMA_NOWAIT);
834 if (error != 0) {
835 sc->malo_stats.mst_tx_busdma++;
836 m_freem(m0);
837 return error;
838 }
839 KASSERT(bf->bf_nseg <= MALO_TXDESC,
840 ("too many segments after defrag; nseg %u", bf->bf_nseg));
841 } else if (bf->bf_nseg == 0) { /* null packet, discard */
842 sc->malo_stats.mst_tx_nodata++;
843 m_freem(m0);
844 return EIO;
845 }
846 DPRINTF(sc, MALO_DEBUG_XMIT, "%s: m %p len %u\n",
847 __func__, m0, m0->m_pkthdr.len);
848 bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
849 bf->bf_m = m0;
850
851 return 0;
852 }
853
854 #ifdef MALO_DEBUG
855 static void
malo_printrxbuf(const struct malo_rxbuf * bf,u_int ix)856 malo_printrxbuf(const struct malo_rxbuf *bf, u_int ix)
857 {
858 const struct malo_rxdesc *ds = bf->bf_desc;
859 uint32_t status = le32toh(ds->status);
860
861 printf("R[%2u] (DS.V:%p DS.P:0x%jx) NEXT:%08x DATA:%08x RC:%02x%s\n"
862 " STAT:%02x LEN:%04x SNR:%02x NF:%02x CHAN:%02x"
863 " RATE:%02x QOS:%04x\n", ix, ds, (uintmax_t)bf->bf_daddr,
864 le32toh(ds->physnext), le32toh(ds->physbuffdata),
865 ds->rxcontrol,
866 ds->rxcontrol != MALO_RXD_CTRL_DRIVER_OWN ?
867 "" : (status & MALO_RXD_STATUS_OK) ? " *" : " !",
868 ds->status, le16toh(ds->pktlen), ds->snr, ds->nf, ds->channel,
869 ds->rate, le16toh(ds->qosctrl));
870 }
871
872 static void
malo_printtxbuf(const struct malo_txbuf * bf,u_int qnum,u_int ix)873 malo_printtxbuf(const struct malo_txbuf *bf, u_int qnum, u_int ix)
874 {
875 const struct malo_txdesc *ds = bf->bf_desc;
876 uint32_t status = le32toh(ds->status);
877
878 printf("Q%u[%3u]", qnum, ix);
879 printf(" (DS.V:%p DS.P:0x%jx)\n", ds, (uintmax_t)bf->bf_daddr);
880 printf(" NEXT:%08x DATA:%08x LEN:%04x STAT:%08x%s\n",
881 le32toh(ds->physnext),
882 le32toh(ds->pktptr), le16toh(ds->pktlen), status,
883 status & MALO_TXD_STATUS_USED ?
884 "" : (status & 3) != 0 ? " *" : " !");
885 printf(" RATE:%02x PRI:%x QOS:%04x SAP:%08x FORMAT:%04x\n",
886 ds->datarate, ds->txpriority, le16toh(ds->qosctrl),
887 le32toh(ds->sap_pktinfo), le16toh(ds->format));
888 #if 0
889 {
890 const uint8_t *cp = (const uint8_t *) ds;
891 int i;
892 for (i = 0; i < sizeof(struct malo_txdesc); i++) {
893 printf("%02x ", cp[i]);
894 if (((i+1) % 16) == 0)
895 printf("\n");
896 }
897 printf("\n");
898 }
899 #endif
900 }
901 #endif /* MALO_DEBUG */
902
903 static __inline void
malo_updatetxrate(struct ieee80211_node * ni,int rix)904 malo_updatetxrate(struct ieee80211_node *ni, int rix)
905 {
906 static const int ieeerates[] =
907 { 2, 4, 11, 22, 44, 12, 18, 24, 36, 48, 96, 108 };
908 if (rix < nitems(ieeerates))
909 ni->ni_txrate = ieeerates[rix];
910 }
911
912 static int
malo_fix2rate(int fix_rate)913 malo_fix2rate(int fix_rate)
914 {
915 static const int rates[] =
916 { 2, 4, 11, 22, 12, 18, 24, 36, 48, 96, 108 };
917 return (fix_rate < nitems(rates) ? rates[fix_rate] : 0);
918 }
919
920 /*
921 * Process completed xmit descriptors from the specified queue.
922 */
923 static int
malo_tx_processq(struct malo_softc * sc,struct malo_txq * txq)924 malo_tx_processq(struct malo_softc *sc, struct malo_txq *txq)
925 {
926 struct malo_txbuf *bf;
927 struct malo_txdesc *ds;
928 struct ieee80211_node *ni;
929 int nreaped;
930 uint32_t status;
931
932 DPRINTF(sc, MALO_DEBUG_TX_PROC, "%s: tx queue %u\n",
933 __func__, txq->qnum);
934 for (nreaped = 0;; nreaped++) {
935 MALO_TXQ_LOCK(txq);
936 bf = STAILQ_FIRST(&txq->active);
937 if (bf == NULL) {
938 MALO_TXQ_UNLOCK(txq);
939 break;
940 }
941 ds = bf->bf_desc;
942 MALO_TXDESC_SYNC(txq, ds,
943 BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
944 if (ds->status & htole32(MALO_TXD_STATUS_FW_OWNED)) {
945 MALO_TXQ_UNLOCK(txq);
946 break;
947 }
948 STAILQ_REMOVE_HEAD(&txq->active, bf_list);
949 MALO_TXQ_UNLOCK(txq);
950
951 #ifdef MALO_DEBUG
952 if (sc->malo_debug & MALO_DEBUG_XMIT_DESC)
953 malo_printtxbuf(bf, txq->qnum, nreaped);
954 #endif
955 ni = bf->bf_node;
956 if (ni != NULL) {
957 status = le32toh(ds->status);
958 if (status & MALO_TXD_STATUS_OK) {
959 uint16_t format = le16toh(ds->format);
960 uint8_t txant =_IEEE80211_MASKSHIFT(
961 format, MALO_TXD_ANTENNA);
962
963 sc->malo_stats.mst_ant_tx[txant]++;
964 if (status & MALO_TXD_STATUS_OK_RETRY)
965 sc->malo_stats.mst_tx_retries++;
966 if (status & MALO_TXD_STATUS_OK_MORE_RETRY)
967 sc->malo_stats.mst_tx_mretries++;
968 malo_updatetxrate(ni, ds->datarate);
969 sc->malo_stats.mst_tx_rate = ds->datarate;
970 } else {
971 if (status & MALO_TXD_STATUS_FAILED_LINK_ERROR)
972 sc->malo_stats.mst_tx_linkerror++;
973 if (status & MALO_TXD_STATUS_FAILED_XRETRY)
974 sc->malo_stats.mst_tx_xretries++;
975 if (status & MALO_TXD_STATUS_FAILED_AGING)
976 sc->malo_stats.mst_tx_aging++;
977 }
978 /* XXX strip fw len in case header inspected */
979 m_adj(bf->bf_m, sizeof(uint16_t));
980 ieee80211_tx_complete(ni, bf->bf_m,
981 (status & MALO_TXD_STATUS_OK) == 0);
982 } else
983 m_freem(bf->bf_m);
984
985 ds->status = htole32(MALO_TXD_STATUS_IDLE);
986 ds->pktlen = htole32(0);
987
988 bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap,
989 BUS_DMASYNC_POSTWRITE);
990 bus_dmamap_unload(sc->malo_dmat, bf->bf_dmamap);
991 bf->bf_m = NULL;
992 bf->bf_node = NULL;
993
994 MALO_TXQ_LOCK(txq);
995 STAILQ_INSERT_TAIL(&txq->free, bf, bf_list);
996 txq->nfree++;
997 MALO_TXQ_UNLOCK(txq);
998 }
999 return nreaped;
1000 }
1001
1002 /*
1003 * Deferred processing of transmit interrupt.
1004 */
1005 static void
malo_tx_proc(void * arg,int npending)1006 malo_tx_proc(void *arg, int npending)
1007 {
1008 struct malo_softc *sc = arg;
1009 int i, nreaped;
1010
1011 /*
1012 * Process each active queue.
1013 */
1014 nreaped = 0;
1015 MALO_LOCK(sc);
1016 for (i = 0; i < MALO_NUM_TX_QUEUES; i++) {
1017 if (!STAILQ_EMPTY(&sc->malo_txq[i].active))
1018 nreaped += malo_tx_processq(sc, &sc->malo_txq[i]);
1019 }
1020
1021 if (nreaped != 0) {
1022 sc->malo_timer = 0;
1023 malo_start(sc);
1024 }
1025 MALO_UNLOCK(sc);
1026 }
1027
1028 static int
malo_tx_start(struct malo_softc * sc,struct ieee80211_node * ni,struct malo_txbuf * bf,struct mbuf * m0)1029 malo_tx_start(struct malo_softc *sc, struct ieee80211_node *ni,
1030 struct malo_txbuf *bf, struct mbuf *m0)
1031 {
1032 #define IS_DATA_FRAME(wh) \
1033 ((wh->i_fc[0] & (IEEE80211_FC0_TYPE_MASK)) == IEEE80211_FC0_TYPE_DATA)
1034 int error, iswep;
1035 int hdrlen, pktlen;
1036 struct ieee80211_frame *wh;
1037 struct ieee80211com *ic = &sc->malo_ic;
1038 struct ieee80211vap *vap = ni->ni_vap;
1039 struct malo_txdesc *ds;
1040 struct malo_txrec *tr;
1041 struct malo_txq *txq;
1042 uint16_t qos;
1043
1044 wh = mtod(m0, struct ieee80211_frame *);
1045 iswep = wh->i_fc[1] & IEEE80211_FC1_PROTECTED;
1046 hdrlen = ieee80211_anyhdrsize(wh);
1047 pktlen = m0->m_pkthdr.len;
1048 if (IEEE80211_QOS_HAS_SEQ(wh)) {
1049 qos = *(uint16_t *)ieee80211_getqos(wh);
1050 } else
1051 qos = 0;
1052
1053 if (iswep) {
1054 struct ieee80211_key *k;
1055
1056 /*
1057 * Construct the 802.11 header+trailer for an encrypted
1058 * frame. The only reason this can fail is because of an
1059 * unknown or unsupported cipher/key type.
1060 *
1061 * NB: we do this even though the firmware will ignore
1062 * what we've done for WEP and TKIP as we need the
1063 * ExtIV filled in for CCMP and this also adjusts
1064 * the headers which simplifies our work below.
1065 */
1066 k = ieee80211_crypto_encap(ni, m0);
1067 if (k == NULL) {
1068 /*
1069 * This can happen when the key is yanked after the
1070 * frame was queued. Just discard the frame; the
1071 * 802.11 layer counts failures and provides
1072 * debugging/diagnostics.
1073 */
1074 m_freem(m0);
1075 return EIO;
1076 }
1077
1078 /*
1079 * Adjust the packet length for the crypto additions
1080 * done during encap and any other bits that the f/w
1081 * will add later on.
1082 */
1083 pktlen = m0->m_pkthdr.len;
1084
1085 /* packet header may have moved, reset our local pointer */
1086 wh = mtod(m0, struct ieee80211_frame *);
1087 }
1088
1089 if (ieee80211_radiotap_active_vap(vap)) {
1090 sc->malo_tx_th.wt_flags = 0; /* XXX */
1091 if (iswep)
1092 sc->malo_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
1093 sc->malo_tx_th.wt_txpower = ni->ni_txpower;
1094 sc->malo_tx_th.wt_antenna = sc->malo_txantenna;
1095
1096 ieee80211_radiotap_tx(vap, m0);
1097 }
1098
1099 /*
1100 * Copy up/down the 802.11 header; the firmware requires
1101 * we present a 2-byte payload length followed by a
1102 * 4-address header (w/o QoS), followed (optionally) by
1103 * any WEP/ExtIV header (but only filled in for CCMP).
1104 * We are assured the mbuf has sufficient headroom to
1105 * prepend in-place by the setup of ic_headroom in
1106 * malo_attach.
1107 */
1108 if (hdrlen < sizeof(struct malo_txrec)) {
1109 const int space = sizeof(struct malo_txrec) - hdrlen;
1110 if (M_LEADINGSPACE(m0) < space) {
1111 /* NB: should never happen */
1112 device_printf(sc->malo_dev,
1113 "not enough headroom, need %d found %zd, "
1114 "m_flags 0x%x m_len %d\n",
1115 space, M_LEADINGSPACE(m0), m0->m_flags, m0->m_len);
1116 ieee80211_dump_pkt(ic,
1117 mtod(m0, const uint8_t *), m0->m_len, 0, -1);
1118 m_freem(m0);
1119 /* XXX stat */
1120 return EIO;
1121 }
1122 M_PREPEND(m0, space, M_NOWAIT);
1123 }
1124 tr = mtod(m0, struct malo_txrec *);
1125 if (wh != (struct ieee80211_frame *) &tr->wh)
1126 ovbcopy(wh, &tr->wh, hdrlen);
1127 /*
1128 * Note: the "firmware length" is actually the length of the fully
1129 * formed "802.11 payload". That is, it's everything except for
1130 * the 802.11 header. In particular this includes all crypto
1131 * material including the MIC!
1132 */
1133 tr->fwlen = htole16(pktlen - hdrlen);
1134
1135 /*
1136 * Load the DMA map so any coalescing is done. This
1137 * also calculates the number of descriptors we need.
1138 */
1139 error = malo_tx_dmasetup(sc, bf, m0);
1140 if (error != 0)
1141 return error;
1142 bf->bf_node = ni; /* NB: held reference */
1143 m0 = bf->bf_m; /* NB: may have changed */
1144 tr = mtod(m0, struct malo_txrec *);
1145 wh = (struct ieee80211_frame *)&tr->wh;
1146
1147 /*
1148 * Formulate tx descriptor.
1149 */
1150 ds = bf->bf_desc;
1151 txq = bf->bf_txq;
1152
1153 ds->qosctrl = qos; /* NB: already little-endian */
1154 ds->pktptr = htole32(bf->bf_segs[0].ds_addr);
1155 ds->pktlen = htole16(bf->bf_segs[0].ds_len);
1156 /* NB: pPhysNext setup once, don't touch */
1157 ds->datarate = IS_DATA_FRAME(wh) ? 1 : 0;
1158 ds->sap_pktinfo = 0;
1159 ds->format = 0;
1160
1161 /*
1162 * Select transmit rate.
1163 */
1164 switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
1165 case IEEE80211_FC0_TYPE_MGT:
1166 sc->malo_stats.mst_tx_mgmt++;
1167 /* fall thru... */
1168 case IEEE80211_FC0_TYPE_CTL:
1169 ds->txpriority = 1;
1170 break;
1171 case IEEE80211_FC0_TYPE_DATA:
1172 ds->txpriority = txq->qnum;
1173 break;
1174 default:
1175 device_printf(sc->malo_dev, "bogus frame type 0x%x (%s)\n",
1176 wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK, __func__);
1177 /* XXX statistic */
1178 m_freem(m0);
1179 return EIO;
1180 }
1181
1182 #ifdef MALO_DEBUG
1183 if (IFF_DUMPPKTS_XMIT(sc))
1184 ieee80211_dump_pkt(ic,
1185 mtod(m0, const uint8_t *)+sizeof(uint16_t),
1186 m0->m_len - sizeof(uint16_t), ds->datarate, -1);
1187 #endif
1188
1189 MALO_TXQ_LOCK(txq);
1190 if (!IS_DATA_FRAME(wh))
1191 ds->status |= htole32(1);
1192 ds->status |= htole32(MALO_TXD_STATUS_FW_OWNED);
1193 STAILQ_INSERT_TAIL(&txq->active, bf, bf_list);
1194 MALO_TXDESC_SYNC(txq, ds, BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
1195
1196 sc->malo_timer = 5;
1197 MALO_TXQ_UNLOCK(txq);
1198 return 0;
1199 }
1200
1201 static int
malo_transmit(struct ieee80211com * ic,struct mbuf * m)1202 malo_transmit(struct ieee80211com *ic, struct mbuf *m)
1203 {
1204 struct malo_softc *sc = ic->ic_softc;
1205 int error;
1206
1207 MALO_LOCK(sc);
1208 if (!sc->malo_running) {
1209 MALO_UNLOCK(sc);
1210 return (ENXIO);
1211 }
1212 error = mbufq_enqueue(&sc->malo_snd, m);
1213 if (error) {
1214 MALO_UNLOCK(sc);
1215 return (error);
1216 }
1217 malo_start(sc);
1218 MALO_UNLOCK(sc);
1219 return (0);
1220 }
1221
1222 static void
malo_start(struct malo_softc * sc)1223 malo_start(struct malo_softc *sc)
1224 {
1225 struct ieee80211_node *ni;
1226 struct malo_txq *txq = &sc->malo_txq[0];
1227 struct malo_txbuf *bf = NULL;
1228 struct mbuf *m;
1229 int nqueued = 0;
1230
1231 MALO_LOCK_ASSERT(sc);
1232
1233 if (!sc->malo_running || sc->malo_invalid)
1234 return;
1235
1236 while ((m = mbufq_dequeue(&sc->malo_snd)) != NULL) {
1237 ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
1238 bf = malo_getbuf(sc, txq);
1239 if (bf == NULL) {
1240 mbufq_prepend(&sc->malo_snd, m);
1241 sc->malo_stats.mst_tx_qstop++;
1242 break;
1243 }
1244 /*
1245 * Pass the frame to the h/w for transmission.
1246 */
1247 if (malo_tx_start(sc, ni, bf, m)) {
1248 if_inc_counter(ni->ni_vap->iv_ifp,
1249 IFCOUNTER_OERRORS, 1);
1250 if (bf != NULL) {
1251 bf->bf_m = NULL;
1252 bf->bf_node = NULL;
1253 MALO_TXQ_LOCK(txq);
1254 STAILQ_INSERT_HEAD(&txq->free, bf, bf_list);
1255 MALO_TXQ_UNLOCK(txq);
1256 }
1257 ieee80211_free_node(ni);
1258 continue;
1259 }
1260 nqueued++;
1261
1262 if (nqueued >= malo_txcoalesce) {
1263 /*
1264 * Poke the firmware to process queued frames;
1265 * see below about (lack of) locking.
1266 */
1267 nqueued = 0;
1268 malo_hal_txstart(sc->malo_mh, 0/*XXX*/);
1269 }
1270 }
1271
1272 if (nqueued) {
1273 /*
1274 * NB: We don't need to lock against tx done because
1275 * this just prods the firmware to check the transmit
1276 * descriptors. The firmware will also start fetching
1277 * descriptors by itself if it notices new ones are
1278 * present when it goes to deliver a tx done interrupt
1279 * to the host. So if we race with tx done processing
1280 * it's ok. Delivering the kick here rather than in
1281 * malo_tx_start is an optimization to avoid poking the
1282 * firmware for each packet.
1283 *
1284 * NB: the queue id isn't used so 0 is ok.
1285 */
1286 malo_hal_txstart(sc->malo_mh, 0/*XXX*/);
1287 }
1288 }
1289
1290 static void
malo_watchdog(void * arg)1291 malo_watchdog(void *arg)
1292 {
1293 struct malo_softc *sc = arg;
1294
1295 callout_reset(&sc->malo_watchdog_timer, hz, malo_watchdog, sc);
1296 if (sc->malo_timer == 0 || --sc->malo_timer > 0)
1297 return;
1298
1299 if (sc->malo_running && !sc->malo_invalid) {
1300 device_printf(sc->malo_dev, "watchdog timeout\n");
1301
1302 /* XXX no way to reset h/w. now */
1303
1304 counter_u64_add(sc->malo_ic.ic_oerrors, 1);
1305 sc->malo_stats.mst_watchdog++;
1306 }
1307 }
1308
1309 static int
malo_hal_reset(struct malo_softc * sc)1310 malo_hal_reset(struct malo_softc *sc)
1311 {
1312 static int first = 0;
1313 struct ieee80211com *ic = &sc->malo_ic;
1314 struct malo_hal *mh = sc->malo_mh;
1315
1316 if (first == 0) {
1317 /*
1318 * NB: when the device firstly is initialized, sometimes
1319 * firmware could override rx/tx dma registers so we re-set
1320 * these values once.
1321 */
1322 malo_hal_set_rxtxdma(sc);
1323 first = 1;
1324 }
1325
1326 malo_hal_setantenna(mh, MHA_ANTENNATYPE_RX, sc->malo_rxantenna);
1327 malo_hal_setantenna(mh, MHA_ANTENNATYPE_TX, sc->malo_txantenna);
1328 malo_hal_setradio(mh, 1, MHP_AUTO_PREAMBLE);
1329 malo_chan_set(sc, ic->ic_curchan);
1330
1331 /* XXX needs other stuffs? */
1332
1333 return 1;
1334 }
1335
1336 static __inline struct mbuf *
malo_getrxmbuf(struct malo_softc * sc,struct malo_rxbuf * bf)1337 malo_getrxmbuf(struct malo_softc *sc, struct malo_rxbuf *bf)
1338 {
1339 struct mbuf *m;
1340 bus_addr_t paddr;
1341 int error;
1342
1343 /* XXX don't need mbuf, just dma buffer */
1344 m = m_getjcl(M_NOWAIT, MT_DATA, M_PKTHDR, MJUMPAGESIZE);
1345 if (m == NULL) {
1346 sc->malo_stats.mst_rx_nombuf++; /* XXX */
1347 return NULL;
1348 }
1349 error = bus_dmamap_load(sc->malo_dmat, bf->bf_dmamap,
1350 mtod(m, caddr_t), MJUMPAGESIZE,
1351 malo_load_cb, &paddr, BUS_DMA_NOWAIT);
1352 if (error != 0) {
1353 device_printf(sc->malo_dev,
1354 "%s: bus_dmamap_load failed, error %d\n", __func__, error);
1355 m_freem(m);
1356 return NULL;
1357 }
1358 bf->bf_data = paddr;
1359 bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
1360
1361 return m;
1362 }
1363
1364 static int
malo_rxbuf_init(struct malo_softc * sc,struct malo_rxbuf * bf)1365 malo_rxbuf_init(struct malo_softc *sc, struct malo_rxbuf *bf)
1366 {
1367 struct malo_rxdesc *ds;
1368
1369 ds = bf->bf_desc;
1370 if (bf->bf_m == NULL) {
1371 bf->bf_m = malo_getrxmbuf(sc, bf);
1372 if (bf->bf_m == NULL) {
1373 /* mark descriptor to be skipped */
1374 ds->rxcontrol = MALO_RXD_CTRL_OS_OWN;
1375 /* NB: don't need PREREAD */
1376 MALO_RXDESC_SYNC(sc, ds, BUS_DMASYNC_PREWRITE);
1377 return ENOMEM;
1378 }
1379 }
1380
1381 /*
1382 * Setup descriptor.
1383 */
1384 ds->qosctrl = 0;
1385 ds->snr = 0;
1386 ds->status = MALO_RXD_STATUS_IDLE;
1387 ds->channel = 0;
1388 ds->pktlen = htole16(MALO_RXSIZE);
1389 ds->nf = 0;
1390 ds->physbuffdata = htole32(bf->bf_data);
1391 /* NB: don't touch pPhysNext, set once */
1392 ds->rxcontrol = MALO_RXD_CTRL_DRIVER_OWN;
1393 MALO_RXDESC_SYNC(sc, ds, BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
1394
1395 return 0;
1396 }
1397
1398 /*
1399 * Setup the rx data structures. This should only be done once or we may get
1400 * out of sync with the firmware.
1401 */
1402 static int
malo_startrecv(struct malo_softc * sc)1403 malo_startrecv(struct malo_softc *sc)
1404 {
1405 struct malo_rxbuf *bf, *prev;
1406 struct malo_rxdesc *ds;
1407
1408 if (sc->malo_recvsetup == 1) {
1409 malo_mode_init(sc); /* set filters, etc. */
1410 return 0;
1411 }
1412
1413 prev = NULL;
1414 STAILQ_FOREACH(bf, &sc->malo_rxbuf, bf_list) {
1415 int error = malo_rxbuf_init(sc, bf);
1416 if (error != 0) {
1417 DPRINTF(sc, MALO_DEBUG_RECV,
1418 "%s: malo_rxbuf_init failed %d\n",
1419 __func__, error);
1420 return error;
1421 }
1422 if (prev != NULL) {
1423 ds = prev->bf_desc;
1424 ds->physnext = htole32(bf->bf_daddr);
1425 }
1426 prev = bf;
1427 }
1428 if (prev != NULL) {
1429 ds = prev->bf_desc;
1430 ds->physnext =
1431 htole32(STAILQ_FIRST(&sc->malo_rxbuf)->bf_daddr);
1432 }
1433
1434 sc->malo_recvsetup = 1;
1435
1436 malo_mode_init(sc); /* set filters, etc. */
1437
1438 return 0;
1439 }
1440
1441 static void
malo_init_locked(struct malo_softc * sc)1442 malo_init_locked(struct malo_softc *sc)
1443 {
1444 struct malo_hal *mh = sc->malo_mh;
1445 int error;
1446
1447 MALO_LOCK_ASSERT(sc);
1448
1449 /*
1450 * Stop anything previously setup. This is safe whether this is
1451 * the first time through or not.
1452 */
1453 malo_stop(sc);
1454
1455 /*
1456 * Push state to the firmware.
1457 */
1458 if (!malo_hal_reset(sc)) {
1459 device_printf(sc->malo_dev,
1460 "%s: unable to reset hardware\n", __func__);
1461 return;
1462 }
1463
1464 /*
1465 * Setup recv (once); transmit is already good to go.
1466 */
1467 error = malo_startrecv(sc);
1468 if (error != 0) {
1469 device_printf(sc->malo_dev,
1470 "%s: unable to start recv logic, error %d\n",
1471 __func__, error);
1472 return;
1473 }
1474
1475 /*
1476 * Enable interrupts.
1477 */
1478 sc->malo_imask = MALO_A2HRIC_BIT_RX_RDY
1479 | MALO_A2HRIC_BIT_TX_DONE
1480 | MALO_A2HRIC_BIT_OPC_DONE
1481 | MALO_A2HRIC_BIT_MAC_EVENT
1482 | MALO_A2HRIC_BIT_RX_PROBLEM
1483 | MALO_A2HRIC_BIT_ICV_ERROR
1484 | MALO_A2HRIC_BIT_RADAR_DETECT
1485 | MALO_A2HRIC_BIT_CHAN_SWITCH;
1486
1487 sc->malo_running = 1;
1488 malo_hal_intrset(mh, sc->malo_imask);
1489 callout_reset(&sc->malo_watchdog_timer, hz, malo_watchdog, sc);
1490 }
1491
1492 static void
malo_init(void * arg)1493 malo_init(void *arg)
1494 {
1495 struct malo_softc *sc = (struct malo_softc *) arg;
1496 struct ieee80211com *ic = &sc->malo_ic;
1497
1498 MALO_LOCK(sc);
1499 malo_init_locked(sc);
1500 MALO_UNLOCK(sc);
1501
1502 if (sc->malo_running)
1503 ieee80211_start_all(ic); /* start all vap's */
1504 }
1505
1506 struct malo_copy_maddr_ctx {
1507 uint8_t macs[IEEE80211_ADDR_LEN * MALO_HAL_MCAST_MAX];
1508 int nmc;
1509 };
1510
1511 static u_int
malo_copy_maddr(void * arg,struct sockaddr_dl * sdl,u_int nmc)1512 malo_copy_maddr(void *arg, struct sockaddr_dl *sdl, u_int nmc)
1513 {
1514 struct malo_copy_maddr_ctx *ctx = arg;
1515
1516 if (ctx->nmc == MALO_HAL_MCAST_MAX)
1517 return (0);
1518
1519 IEEE80211_ADDR_COPY(ctx->macs + (ctx->nmc * IEEE80211_ADDR_LEN),
1520 LLADDR(sdl));
1521 ctx->nmc++;
1522
1523 return (1);
1524 }
1525
1526 /*
1527 * Set the multicast filter contents into the hardware.
1528 */
1529 static void
malo_setmcastfilter(struct malo_softc * sc)1530 malo_setmcastfilter(struct malo_softc *sc)
1531 {
1532 struct malo_copy_maddr_ctx ctx;
1533 struct ieee80211com *ic = &sc->malo_ic;
1534 struct ieee80211vap *vap;
1535
1536
1537 if (ic->ic_opmode == IEEE80211_M_MONITOR || ic->ic_allmulti > 0 ||
1538 ic->ic_promisc > 0)
1539 goto all;
1540
1541 ctx.nmc = 0;
1542 TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
1543 if_foreach_llmaddr(vap->iv_ifp, malo_copy_maddr, &ctx);
1544
1545 malo_hal_setmcast(sc->malo_mh, ctx.nmc, ctx.macs);
1546
1547 all:
1548 /*
1549 * XXX we don't know how to set the f/w for supporting
1550 * IFF_ALLMULTI | IFF_PROMISC cases
1551 */
1552 return;
1553 }
1554
1555 static int
malo_mode_init(struct malo_softc * sc)1556 malo_mode_init(struct malo_softc *sc)
1557 {
1558 struct ieee80211com *ic = &sc->malo_ic;
1559 struct malo_hal *mh = sc->malo_mh;
1560
1561 malo_hal_setpromisc(mh, ic->ic_promisc > 0);
1562 malo_setmcastfilter(sc);
1563
1564 return ENXIO;
1565 }
1566
1567 static void
malo_tx_draintxq(struct malo_softc * sc,struct malo_txq * txq)1568 malo_tx_draintxq(struct malo_softc *sc, struct malo_txq *txq)
1569 {
1570 struct ieee80211_node *ni;
1571 struct malo_txbuf *bf;
1572 u_int ix __unused;
1573
1574 /*
1575 * NB: this assumes output has been stopped and
1576 * we do not need to block malo_tx_tasklet
1577 */
1578 for (ix = 0;; ix++) {
1579 MALO_TXQ_LOCK(txq);
1580 bf = STAILQ_FIRST(&txq->active);
1581 if (bf == NULL) {
1582 MALO_TXQ_UNLOCK(txq);
1583 break;
1584 }
1585 STAILQ_REMOVE_HEAD(&txq->active, bf_list);
1586 MALO_TXQ_UNLOCK(txq);
1587 #ifdef MALO_DEBUG
1588 if (sc->malo_debug & MALO_DEBUG_RESET) {
1589 struct ieee80211com *ic = &sc->malo_ic;
1590 const struct malo_txrec *tr =
1591 mtod(bf->bf_m, const struct malo_txrec *);
1592 malo_printtxbuf(bf, txq->qnum, ix);
1593 ieee80211_dump_pkt(ic, (const uint8_t *)&tr->wh,
1594 bf->bf_m->m_len - sizeof(tr->fwlen), 0, -1);
1595 }
1596 #endif /* MALO_DEBUG */
1597 bus_dmamap_unload(sc->malo_dmat, bf->bf_dmamap);
1598 ni = bf->bf_node;
1599 bf->bf_node = NULL;
1600 if (ni != NULL) {
1601 /*
1602 * Reclaim node reference.
1603 */
1604 ieee80211_free_node(ni);
1605 }
1606 m_freem(bf->bf_m);
1607 bf->bf_m = NULL;
1608
1609 MALO_TXQ_LOCK(txq);
1610 STAILQ_INSERT_TAIL(&txq->free, bf, bf_list);
1611 txq->nfree++;
1612 MALO_TXQ_UNLOCK(txq);
1613 }
1614 }
1615
1616 static void
malo_stop(struct malo_softc * sc)1617 malo_stop(struct malo_softc *sc)
1618 {
1619 struct malo_hal *mh = sc->malo_mh;
1620 int i;
1621
1622 DPRINTF(sc, MALO_DEBUG_ANY, "%s: invalid %u running %u\n",
1623 __func__, sc->malo_invalid, sc->malo_running);
1624
1625 MALO_LOCK_ASSERT(sc);
1626
1627 if (!sc->malo_running)
1628 return;
1629
1630 /*
1631 * Shutdown the hardware and driver:
1632 * disable interrupts
1633 * turn off the radio
1634 * drain and release tx queues
1635 *
1636 * Note that some of this work is not possible if the hardware
1637 * is gone (invalid).
1638 */
1639 sc->malo_running = 0;
1640 callout_stop(&sc->malo_watchdog_timer);
1641 sc->malo_timer = 0;
1642 /* disable interrupt. */
1643 malo_hal_intrset(mh, 0);
1644 /* turn off the radio. */
1645 malo_hal_setradio(mh, 0, MHP_AUTO_PREAMBLE);
1646
1647 /* drain and release tx queues. */
1648 for (i = 0; i < MALO_NUM_TX_QUEUES; i++)
1649 malo_tx_draintxq(sc, &sc->malo_txq[i]);
1650 }
1651
1652 static void
malo_parent(struct ieee80211com * ic)1653 malo_parent(struct ieee80211com *ic)
1654 {
1655 struct malo_softc *sc = ic->ic_softc;
1656 int startall = 0;
1657
1658 MALO_LOCK(sc);
1659 if (ic->ic_nrunning > 0) {
1660 /*
1661 * Beware of being called during attach/detach
1662 * to reset promiscuous mode. In that case we
1663 * will still be marked UP but not RUNNING.
1664 * However trying to re-init the interface
1665 * is the wrong thing to do as we've already
1666 * torn down much of our state. There's
1667 * probably a better way to deal with this.
1668 */
1669 if (!sc->malo_running && !sc->malo_invalid) {
1670 malo_init(sc);
1671 startall = 1;
1672 }
1673 /*
1674 * To avoid rescanning another access point,
1675 * do not call malo_init() here. Instead,
1676 * only reflect promisc mode settings.
1677 */
1678 malo_mode_init(sc);
1679 } else if (sc->malo_running)
1680 malo_stop(sc);
1681 MALO_UNLOCK(sc);
1682 if (startall)
1683 ieee80211_start_all(ic);
1684 }
1685
1686 /*
1687 * Callback from the 802.11 layer to update the slot time
1688 * based on the current setting. We use it to notify the
1689 * firmware of ERP changes and the f/w takes care of things
1690 * like slot time and preamble.
1691 */
1692 static void
malo_updateslot(struct ieee80211com * ic)1693 malo_updateslot(struct ieee80211com *ic)
1694 {
1695 struct malo_softc *sc = ic->ic_softc;
1696 struct malo_hal *mh = sc->malo_mh;
1697 int error;
1698
1699 /* NB: can be called early; suppress needless cmds */
1700 if (!sc->malo_running)
1701 return;
1702
1703 DPRINTF(sc, MALO_DEBUG_RESET,
1704 "%s: chan %u MHz/flags 0x%x %s slot, (ic_flags 0x%x)\n",
1705 __func__, ic->ic_curchan->ic_freq, ic->ic_curchan->ic_flags,
1706 ic->ic_flags & IEEE80211_F_SHSLOT ? "short" : "long", ic->ic_flags);
1707
1708 if (ic->ic_flags & IEEE80211_F_SHSLOT)
1709 error = malo_hal_set_slot(mh, 1);
1710 else
1711 error = malo_hal_set_slot(mh, 0);
1712
1713 if (error != 0)
1714 device_printf(sc->malo_dev, "setting %s slot failed\n",
1715 ic->ic_flags & IEEE80211_F_SHSLOT ? "short" : "long");
1716 }
1717
1718 static int
malo_newstate(struct ieee80211vap * vap,enum ieee80211_state nstate,int arg)1719 malo_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1720 {
1721 struct ieee80211com *ic = vap->iv_ic;
1722 struct malo_softc *sc = ic->ic_softc;
1723 struct malo_hal *mh = sc->malo_mh;
1724 int error;
1725
1726 DPRINTF(sc, MALO_DEBUG_STATE, "%s: %s -> %s\n", __func__,
1727 ieee80211_state_name[vap->iv_state],
1728 ieee80211_state_name[nstate]);
1729
1730 /*
1731 * Invoke the net80211 layer first so iv_bss is setup.
1732 */
1733 error = MALO_VAP(vap)->malo_newstate(vap, nstate, arg);
1734 if (error != 0)
1735 return error;
1736
1737 if (nstate == IEEE80211_S_RUN && vap->iv_state != IEEE80211_S_RUN) {
1738 struct ieee80211_node *ni = vap->iv_bss;
1739 enum ieee80211_phymode mode = ieee80211_chan2mode(ni->ni_chan);
1740 const struct ieee80211_txparam *tp = &vap->iv_txparms[mode];
1741
1742 DPRINTF(sc, MALO_DEBUG_STATE,
1743 "%s: %s(RUN): iv_flags 0x%08x bintvl %d bssid %s "
1744 "capinfo 0x%04x chan %d associd 0x%x mode %d rate %d\n",
1745 if_name(vap->iv_ifp), __func__, vap->iv_flags,
1746 ni->ni_intval, ether_sprintf(ni->ni_bssid), ni->ni_capinfo,
1747 ieee80211_chan2ieee(ic, ic->ic_curchan),
1748 ni->ni_associd, mode, tp->ucastrate);
1749
1750 malo_hal_setradio(mh, 1,
1751 (ic->ic_flags & IEEE80211_F_SHPREAMBLE) ?
1752 MHP_SHORT_PREAMBLE : MHP_LONG_PREAMBLE);
1753 malo_hal_setassocid(sc->malo_mh, ni->ni_bssid, ni->ni_associd);
1754 malo_hal_set_rate(mh, mode,
1755 tp->ucastrate == IEEE80211_FIXED_RATE_NONE ?
1756 0 : malo_fix2rate(tp->ucastrate));
1757 }
1758 return 0;
1759 }
1760
1761 static int
malo_raw_xmit(struct ieee80211_node * ni,struct mbuf * m,const struct ieee80211_bpf_params * params)1762 malo_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1763 const struct ieee80211_bpf_params *params)
1764 {
1765 struct ieee80211com *ic = ni->ni_ic;
1766 struct malo_softc *sc = ic->ic_softc;
1767 struct malo_txbuf *bf;
1768 struct malo_txq *txq;
1769
1770 if (!sc->malo_running || sc->malo_invalid) {
1771 m_freem(m);
1772 return ENETDOWN;
1773 }
1774
1775 /*
1776 * Grab a TX buffer and associated resources. Note that we depend
1777 * on the classification by the 802.11 layer to get to the right h/w
1778 * queue. Management frames must ALWAYS go on queue 1 but we
1779 * cannot just force that here because we may receive non-mgt frames.
1780 */
1781 txq = &sc->malo_txq[0];
1782 bf = malo_getbuf(sc, txq);
1783 if (bf == NULL) {
1784 m_freem(m);
1785 return ENOBUFS;
1786 }
1787
1788 /*
1789 * Pass the frame to the h/w for transmission.
1790 */
1791 if (malo_tx_start(sc, ni, bf, m) != 0) {
1792 bf->bf_m = NULL;
1793 bf->bf_node = NULL;
1794 MALO_TXQ_LOCK(txq);
1795 STAILQ_INSERT_HEAD(&txq->free, bf, bf_list);
1796 txq->nfree++;
1797 MALO_TXQ_UNLOCK(txq);
1798
1799 return EIO; /* XXX */
1800 }
1801
1802 /*
1803 * NB: We don't need to lock against tx done because this just
1804 * prods the firmware to check the transmit descriptors. The firmware
1805 * will also start fetching descriptors by itself if it notices
1806 * new ones are present when it goes to deliver a tx done interrupt
1807 * to the host. So if we race with tx done processing it's ok.
1808 * Delivering the kick here rather than in malo_tx_start is
1809 * an optimization to avoid poking the firmware for each packet.
1810 *
1811 * NB: the queue id isn't used so 0 is ok.
1812 */
1813 malo_hal_txstart(sc->malo_mh, 0/*XXX*/);
1814
1815 return 0;
1816 }
1817
1818 static void
malo_sysctlattach(struct malo_softc * sc)1819 malo_sysctlattach(struct malo_softc *sc)
1820 {
1821 #ifdef MALO_DEBUG
1822 struct sysctl_ctx_list *ctx = device_get_sysctl_ctx(sc->malo_dev);
1823 struct sysctl_oid *tree = device_get_sysctl_tree(sc->malo_dev);
1824
1825 sc->malo_debug = malo_debug;
1826 SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
1827 "debug", CTLFLAG_RW, &sc->malo_debug, 0,
1828 "control debugging printfs");
1829 #endif
1830 }
1831
1832 static void
malo_announce(struct malo_softc * sc)1833 malo_announce(struct malo_softc *sc)
1834 {
1835
1836 device_printf(sc->malo_dev,
1837 "versions [hw %d fw %d.%d.%d.%d] (regioncode %d)\n",
1838 sc->malo_hwspecs.hwversion,
1839 (sc->malo_hwspecs.fw_releasenum >> 24) & 0xff,
1840 (sc->malo_hwspecs.fw_releasenum >> 16) & 0xff,
1841 (sc->malo_hwspecs.fw_releasenum >> 8) & 0xff,
1842 (sc->malo_hwspecs.fw_releasenum >> 0) & 0xff,
1843 sc->malo_hwspecs.regioncode);
1844
1845 if (bootverbose || malo_rxbuf != MALO_RXBUF)
1846 device_printf(sc->malo_dev,
1847 "using %u rx buffers\n", malo_rxbuf);
1848 if (bootverbose || malo_txbuf != MALO_TXBUF)
1849 device_printf(sc->malo_dev,
1850 "using %u tx buffers\n", malo_txbuf);
1851 }
1852
1853 /*
1854 * Convert net80211 channel to a HAL channel.
1855 */
1856 static void
malo_mapchan(struct malo_hal_channel * hc,const struct ieee80211_channel * chan)1857 malo_mapchan(struct malo_hal_channel *hc, const struct ieee80211_channel *chan)
1858 {
1859 hc->channel = chan->ic_ieee;
1860
1861 *(uint32_t *)&hc->flags = 0;
1862 if (IEEE80211_IS_CHAN_2GHZ(chan))
1863 hc->flags.freqband = MALO_FREQ_BAND_2DOT4GHZ;
1864 }
1865
1866 /*
1867 * Set/change channels. If the channel is really being changed,
1868 * it's done by reseting the chip. To accomplish this we must
1869 * first cleanup any pending DMA, then restart stuff after a la
1870 * malo_init.
1871 */
1872 static int
malo_chan_set(struct malo_softc * sc,struct ieee80211_channel * chan)1873 malo_chan_set(struct malo_softc *sc, struct ieee80211_channel *chan)
1874 {
1875 struct malo_hal *mh = sc->malo_mh;
1876 struct malo_hal_channel hchan;
1877
1878 DPRINTF(sc, MALO_DEBUG_RESET, "%s: chan %u MHz/flags 0x%x\n",
1879 __func__, chan->ic_freq, chan->ic_flags);
1880
1881 /*
1882 * Convert to a HAL channel description with the flags constrained
1883 * to reflect the current operating mode.
1884 */
1885 malo_mapchan(&hchan, chan);
1886 malo_hal_intrset(mh, 0); /* disable interrupts */
1887 malo_hal_setchannel(mh, &hchan);
1888 malo_hal_settxpower(mh, &hchan);
1889
1890 /*
1891 * Update internal state.
1892 */
1893 sc->malo_tx_th.wt_chan_freq = htole16(chan->ic_freq);
1894 sc->malo_rx_th.wr_chan_freq = htole16(chan->ic_freq);
1895 if (IEEE80211_IS_CHAN_ANYG(chan)) {
1896 sc->malo_tx_th.wt_chan_flags = htole16(IEEE80211_CHAN_G);
1897 sc->malo_rx_th.wr_chan_flags = htole16(IEEE80211_CHAN_G);
1898 } else {
1899 sc->malo_tx_th.wt_chan_flags = htole16(IEEE80211_CHAN_B);
1900 sc->malo_rx_th.wr_chan_flags = htole16(IEEE80211_CHAN_B);
1901 }
1902 sc->malo_curchan = hchan;
1903 malo_hal_intrset(mh, sc->malo_imask);
1904
1905 return 0;
1906 }
1907
1908 static void
malo_scan_start(struct ieee80211com * ic)1909 malo_scan_start(struct ieee80211com *ic)
1910 {
1911 struct malo_softc *sc = ic->ic_softc;
1912
1913 DPRINTF(sc, MALO_DEBUG_STATE, "%s\n", __func__);
1914 }
1915
1916 static void
malo_scan_end(struct ieee80211com * ic)1917 malo_scan_end(struct ieee80211com *ic)
1918 {
1919 struct malo_softc *sc = ic->ic_softc;
1920
1921 DPRINTF(sc, MALO_DEBUG_STATE, "%s\n", __func__);
1922 }
1923
1924 static void
malo_set_channel(struct ieee80211com * ic)1925 malo_set_channel(struct ieee80211com *ic)
1926 {
1927 struct malo_softc *sc = ic->ic_softc;
1928
1929 (void) malo_chan_set(sc, ic->ic_curchan);
1930 }
1931
1932 static void
malo_rx_proc(void * arg,int npending)1933 malo_rx_proc(void *arg, int npending)
1934 {
1935 struct malo_softc *sc = arg;
1936 struct ieee80211com *ic = &sc->malo_ic;
1937 struct malo_rxbuf *bf;
1938 struct malo_rxdesc *ds;
1939 struct mbuf *m, *mnew;
1940 struct ieee80211_qosframe *wh;
1941 struct ieee80211_node *ni;
1942 int off, len, hdrlen, pktlen, rssi, ntodo;
1943 uint8_t *data, status;
1944 uint32_t readptr, writeptr;
1945
1946 DPRINTF(sc, MALO_DEBUG_RX_PROC,
1947 "%s: pending %u rdptr(0x%x) 0x%x wrptr(0x%x) 0x%x\n",
1948 __func__, npending,
1949 sc->malo_hwspecs.rxdesc_read,
1950 malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_read),
1951 sc->malo_hwspecs.rxdesc_write,
1952 malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_write));
1953
1954 readptr = malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_read);
1955 writeptr = malo_bar0_read4(sc, sc->malo_hwspecs.rxdesc_write);
1956 if (readptr == writeptr)
1957 return;
1958
1959 bf = sc->malo_rxnext;
1960 for (ntodo = malo_rxquota; ntodo > 0 && readptr != writeptr; ntodo--) {
1961 if (bf == NULL) {
1962 bf = STAILQ_FIRST(&sc->malo_rxbuf);
1963 break;
1964 }
1965 ds = bf->bf_desc;
1966 if (bf->bf_m == NULL) {
1967 /*
1968 * If data allocation failed previously there
1969 * will be no buffer; try again to re-populate it.
1970 * Note the firmware will not advance to the next
1971 * descriptor with a dma buffer so we must mimic
1972 * this or we'll get out of sync.
1973 */
1974 DPRINTF(sc, MALO_DEBUG_ANY,
1975 "%s: rx buf w/o dma memory\n", __func__);
1976 (void)malo_rxbuf_init(sc, bf);
1977 break;
1978 }
1979 MALO_RXDESC_SYNC(sc, ds,
1980 BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
1981 if (ds->rxcontrol != MALO_RXD_CTRL_DMA_OWN)
1982 break;
1983
1984 readptr = le32toh(ds->physnext);
1985
1986 #ifdef MALO_DEBUG
1987 if (sc->malo_debug & MALO_DEBUG_RECV_DESC)
1988 malo_printrxbuf(bf, 0);
1989 #endif
1990 status = ds->status;
1991 if (status & MALO_RXD_STATUS_DECRYPT_ERR_MASK) {
1992 counter_u64_add(ic->ic_ierrors, 1);
1993 goto rx_next;
1994 }
1995 /*
1996 * Sync the data buffer.
1997 */
1998 len = le16toh(ds->pktlen);
1999 bus_dmamap_sync(sc->malo_dmat, bf->bf_dmamap,
2000 BUS_DMASYNC_POSTREAD);
2001 /*
2002 * The 802.11 header is provided all or in part at the front;
2003 * use it to calculate the true size of the header that we'll
2004 * construct below. We use this to figure out where to copy
2005 * payload prior to constructing the header.
2006 */
2007 m = bf->bf_m;
2008 data = mtod(m, uint8_t *);
2009 hdrlen = ieee80211_anyhdrsize(data + sizeof(uint16_t));
2010 off = sizeof(uint16_t) + sizeof(struct ieee80211_frame_addr4);
2011
2012 /*
2013 * Calculate RSSI. XXX wrong
2014 */
2015 rssi = 2 * ((int) ds->snr - ds->nf); /* NB: .5 dBm */
2016 if (rssi > 100)
2017 rssi = 100;
2018
2019 pktlen = hdrlen + (len - off);
2020 /*
2021 * NB: we know our frame is at least as large as
2022 * IEEE80211_MIN_LEN because there is a 4-address frame at
2023 * the front. Hence there's no need to vet the packet length.
2024 * If the frame in fact is too small it should be discarded
2025 * at the net80211 layer.
2026 */
2027
2028 /* XXX don't need mbuf, just dma buffer */
2029 mnew = malo_getrxmbuf(sc, bf);
2030 if (mnew == NULL) {
2031 counter_u64_add(ic->ic_ierrors, 1);
2032 goto rx_next;
2033 }
2034 /*
2035 * Attach the dma buffer to the mbuf; malo_rxbuf_init will
2036 * re-setup the rx descriptor using the replacement dma
2037 * buffer we just installed above.
2038 */
2039 bf->bf_m = mnew;
2040 m->m_data += off - hdrlen;
2041 m->m_pkthdr.len = m->m_len = pktlen;
2042
2043 /*
2044 * Piece 802.11 header together.
2045 */
2046 wh = mtod(m, struct ieee80211_qosframe *);
2047 /* NB: don't need to do this sometimes but ... */
2048 /* XXX special case so we can memcpy after m_devget? */
2049 ovbcopy(data + sizeof(uint16_t), wh, hdrlen);
2050 if (IEEE80211_QOS_HAS_SEQ(wh))
2051 *(uint16_t *)ieee80211_getqos(wh) = ds->qosctrl;
2052 if (ieee80211_radiotap_active(ic)) {
2053 sc->malo_rx_th.wr_flags = 0;
2054 sc->malo_rx_th.wr_rate = ds->rate;
2055 sc->malo_rx_th.wr_antsignal = rssi;
2056 sc->malo_rx_th.wr_antnoise = ds->nf;
2057 }
2058 #ifdef MALO_DEBUG
2059 if (IFF_DUMPPKTS_RECV(sc, wh)) {
2060 ieee80211_dump_pkt(ic, mtod(m, caddr_t),
2061 len, ds->rate, rssi);
2062 }
2063 #endif
2064 /* dispatch */
2065 ni = ieee80211_find_rxnode(ic,
2066 (struct ieee80211_frame_min *)wh);
2067 if (ni != NULL) {
2068 (void) ieee80211_input(ni, m, rssi, ds->nf);
2069 ieee80211_free_node(ni);
2070 } else
2071 (void) ieee80211_input_all(ic, m, rssi, ds->nf);
2072 rx_next:
2073 /* NB: ignore ENOMEM so we process more descriptors */
2074 (void) malo_rxbuf_init(sc, bf);
2075 bf = STAILQ_NEXT(bf, bf_list);
2076 }
2077
2078 malo_bar0_write4(sc, sc->malo_hwspecs.rxdesc_read, readptr);
2079 sc->malo_rxnext = bf;
2080
2081 if (mbufq_first(&sc->malo_snd) != NULL)
2082 malo_start(sc);
2083 }
2084
2085 /*
2086 * Reclaim all tx queue resources.
2087 */
2088 static void
malo_tx_cleanup(struct malo_softc * sc)2089 malo_tx_cleanup(struct malo_softc *sc)
2090 {
2091 int i;
2092
2093 for (i = 0; i < MALO_NUM_TX_QUEUES; i++)
2094 malo_tx_cleanupq(sc, &sc->malo_txq[i]);
2095 }
2096
2097 int
malo_detach(struct malo_softc * sc)2098 malo_detach(struct malo_softc *sc)
2099 {
2100 struct ieee80211com *ic = &sc->malo_ic;
2101
2102 malo_stop(sc);
2103
2104 if (sc->malo_tq != NULL) {
2105 taskqueue_drain(sc->malo_tq, &sc->malo_rxtask);
2106 taskqueue_drain(sc->malo_tq, &sc->malo_txtask);
2107 taskqueue_free(sc->malo_tq);
2108 sc->malo_tq = NULL;
2109 }
2110
2111 /*
2112 * NB: the order of these is important:
2113 * o call the 802.11 layer before detaching the hal to
2114 * insure callbacks into the driver to delete global
2115 * key cache entries can be handled
2116 * o reclaim the tx queue data structures after calling
2117 * the 802.11 layer as we'll get called back to reclaim
2118 * node state and potentially want to use them
2119 * o to cleanup the tx queues the hal is called, so detach
2120 * it last
2121 * Other than that, it's straightforward...
2122 */
2123 ieee80211_ifdetach(ic);
2124 callout_drain(&sc->malo_watchdog_timer);
2125 malo_dma_cleanup(sc);
2126 malo_tx_cleanup(sc);
2127 malo_hal_detach(sc->malo_mh);
2128 mbufq_drain(&sc->malo_snd);
2129 MALO_LOCK_DESTROY(sc);
2130
2131 return 0;
2132 }
2133
2134 void
malo_shutdown(struct malo_softc * sc)2135 malo_shutdown(struct malo_softc *sc)
2136 {
2137
2138 malo_stop(sc);
2139 }
2140
2141 void
malo_suspend(struct malo_softc * sc)2142 malo_suspend(struct malo_softc *sc)
2143 {
2144
2145 malo_stop(sc);
2146 }
2147
2148 void
malo_resume(struct malo_softc * sc)2149 malo_resume(struct malo_softc *sc)
2150 {
2151
2152 if (sc->malo_ic.ic_nrunning > 0)
2153 malo_init(sc);
2154 }
2155