sys/dev/netif/an/if_an.c

   1 /*
   2  * Copyright (c) 1997, 1998, 1999
   3  *      Bill Paul <wpaul@ctr.columbia.edu>.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  * 3. All advertising materials mentioning features or use of this software
  14  *    must display the following acknowledgement:
  15  *      This product includes software developed by Bill Paul.
  16  * 4. Neither the name of the author nor the names of any co-contributors
  17  *    may be used to endorse or promote products derived from this software
  18  *    without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
  21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
  24  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  30  * THE POSSIBILITY OF SUCH DAMAGE.
  31  *
  32  * $FreeBSD: src/sys/dev/an/if_an.c,v 1.2.2.13 2003/02/11 03:32:48 ambrisko Exp $
  33  * $DragonFly: src/sys/dev/netif/an/if_an.c,v 1.14 2004/07/27 14:06:14 joerg Exp $
  34  *
  35  * $FreeBSD: src/sys/dev/an/if_an.c,v 1.2.2.13 2003/02/11 03:32:48 ambrisko Exp $
  36  */
  37
  38 /*
  39  * Aironet 4500/4800 802.11 PCMCIA/ISA/PCI driver for FreeBSD.
  40  *
  41  * Written by Bill Paul <wpaul@ctr.columbia.edu>
  42  * Electrical Engineering Department
  43  * Columbia University, New York City
  44  */
  45
  46 /*
  47  * The Aironet 4500/4800 series cards come in PCMCIA, ISA and PCI form.
  48  * This driver supports all three device types (PCI devices are supported
  49  * through an extra PCI shim: /sys/dev/an/if_an_pci.c). ISA devices can be
  50  * supported either using hard-coded IO port/IRQ settings or via Plug
  51  * and Play. The 4500 series devices support 1Mbps and 2Mbps data rates.
  52  * The 4800 devices support 1, 2, 5.5 and 11Mbps rates.
  53  *
  54  * Like the WaveLAN/IEEE cards, the Aironet NICs are all essentially
  55  * PCMCIA devices. The ISA and PCI cards are a combination of a PCMCIA
  56  * device and a PCMCIA to ISA or PCMCIA to PCI adapter card. There are
  57  * a couple of important differences though:
  58  *
  59  * - Lucent ISA card looks to the host like a PCMCIA controller with
  60  *   a PCMCIA WaveLAN card inserted. This means that even desktop
  61  *   machines need to be configured with PCMCIA support in order to
  62  *   use WaveLAN/IEEE ISA cards. The Aironet cards on the other hand
  63  *   actually look like normal ISA and PCI devices to the host, so
  64  *   no PCMCIA controller support is needed
  65  *
  66  * The latter point results in a small gotcha. The Aironet PCMCIA
  67  * cards can be configured for one of two operating modes depending
  68  * on how the Vpp1 and Vpp2 programming voltages are set when the
  69  * card is activated. In order to put the card in proper PCMCIA
  70  * operation (where the CIS table is visible and the interface is
  71  * programmed for PCMCIA operation), both Vpp1 and Vpp2 have to be
  72  * set to 5 volts. FreeBSD by default doesn't set the Vpp voltages,
  73  * which leaves the card in ISA/PCI mode, which prevents it from
  74  * being activated as an PCMCIA device.
  75  *
  76  * Note that some PCMCIA controller software packages for Windows NT
  77  * fail to set the voltages as well.
  78  *
  79  * The Aironet devices can operate in both station mode and access point
  80  * mode. Typically, when programmed for station mode, the card can be set
  81  * to automatically perform encapsulation/decapsulation of Ethernet II
  82  * and 802.3 frames within 802.11 frames so that the host doesn't have
  83  * to do it itself. This driver doesn't program the card that way: the
  84  * driver handles all of the encapsulation/decapsulation itself.
  85  */
  86
  87 #include "opt_inet.h"
  88
  89 #ifdef INET
  90 #define ANCACHE                 /* enable signal strength cache */
  91 #endif
  92
  93 #include <sys/param.h>
  94 #include <sys/systm.h>
  95 #include <sys/sockio.h>
  96 #include <sys/mbuf.h>
  97 #include <sys/proc.h>
  98 #include <sys/kernel.h>
  99 #include <sys/proc.h>
 100 #include <sys/ucred.h>
 101 #include <sys/socket.h>
 102 #ifdef ANCACHE
 103 #include <sys/syslog.h>
 104 #endif
 105 #include <sys/sysctl.h>
 106 #include <machine/clock.h>      /* for DELAY */
 107
 108 #include <sys/module.h>
 109 #include <sys/sysctl.h>
 110 #include <sys/bus.h>
 111 #include <machine/bus.h>
 112 #include <sys/rman.h>
 113 #include <machine/resource.h>
 114 #include <sys/malloc.h>
 115
 116 #include <net/if.h>
 117 #include <net/if_arp.h>
 118 #include <net/ethernet.h>
 119 #include <net/if_dl.h>
 120 #include <net/if_types.h>
 121 #include <net/if_media.h>
 122 #include <netproto/802_11/ieee80211.h>
 123 #include <netproto/802_11/ieee80211_ioctl.h>
 124
 125 #ifdef INET
 126 #include <netinet/in.h>
 127 #include <netinet/in_systm.h>
 128 #include <netinet/in_var.h>
 129 #include <netinet/ip.h>
 130 #endif
 131
 132 #include <net/bpf.h>
 133
 134 #include <machine/md_var.h>
 135
 136 #include "if_aironet_ieee.h"
 137 #include "if_anreg.h"
 138
 139 /* These are global because we need them in sys/pci/if_an_p.c. */
 140 static void an_reset            (struct an_softc *);
 141 static int                      an_init_mpi350_desc     (struct an_softc *);
 142 static int an_ioctl             (struct ifnet *, u_long, caddr_t,
 143                                         struct ucred *);
 144 static void an_init             (void *);
 145 static int an_init_tx_ring      (struct an_softc *);
 146 static void an_start            (struct ifnet *);
 147 static void an_watchdog         (struct ifnet *);
 148 static void an_rxeof            (struct an_softc *);
 149 static void an_txeof            (struct an_softc *, int);
 150
 151 static void an_promisc          (struct an_softc *, int);
 152 static int an_cmd               (struct an_softc *, int, int);
 153 static int an_cmd_struct        (struct an_softc *, struct an_command *,
 154                                         struct an_reply *);
 155 static int an_read_record       (struct an_softc *, struct an_ltv_gen *);
 156 static int an_write_record      (struct an_softc *, struct an_ltv_gen *);
 157 static int an_read_data         (struct an_softc *, int,
 158                                         int, caddr_t, int);
 159 static int an_write_data        (struct an_softc *, int,
 160                                         int, caddr_t, int);
 161 static int an_seek              (struct an_softc *, int, int, int);
 162 static int an_alloc_nicmem      (struct an_softc *, int, int *);
 163 static int an_dma_malloc        (struct an_softc *, bus_size_t,
 164                                         struct an_dma_alloc *, int);
 165 static void an_dma_free         (struct an_softc *,
 166                                         struct an_dma_alloc *);
 167 static void an_dma_malloc_cb    (void *, bus_dma_segment_t *, int, int);
 168 static void an_stats_update     (void *);
 169 static void an_setdef           (struct an_softc *, struct an_req *);
 170 #ifdef ANCACHE
 171 static void an_cache_store      (struct an_softc *, struct mbuf *,
 172                                  uint8_t, uint8_t);
 173 #endif
 174
 175 /* function definitions for use with the Cisco's Linux configuration
 176    utilities
 177 */
 178
 179 static int readrids             (struct ifnet*, struct aironet_ioctl*);
 180 static int writerids            (struct ifnet*, struct aironet_ioctl*);
 181 static int flashcard            (struct ifnet*, struct aironet_ioctl*);
 182
 183 static int cmdreset             (struct ifnet *);
 184 static int setflashmode         (struct ifnet *);
 185 static int flashgchar           (struct ifnet *,int,int);
 186 static int flashpchar           (struct ifnet *,int,int);
 187 static int flashputbuf          (struct ifnet *);
 188 static int flashrestart         (struct ifnet *);
 189 static int WaitBusy             (struct ifnet *, int);
 190 static int unstickbusy          (struct ifnet *);
 191
 192 static void an_dump_record      (struct an_softc *,struct an_ltv_gen *,
 193                                     char *);
 194
 195 static int an_media_change      (struct ifnet *);
 196 static void an_media_status     (struct ifnet *, struct ifmediareq *);
 197
 198 static int      an_dump = 0;
 199 static int      an_cache_mode = 0;
 200
 201 #define DBM 0
 202 #define PERCENT 1
 203 #define RAW 2
 204
 205 static char an_conf[256];
 206 static char an_conf_cache[256];
 207
 208 DECLARE_DUMMY_MODULE(if_an);
 209
 210 /* sysctl vars */
 211
 212 SYSCTL_NODE(_hw, OID_AUTO, an, CTLFLAG_RD, 0, "Wireless driver parameters");
 213
 214 static int
 215 sysctl_an_dump(SYSCTL_HANDLER_ARGS)
 216 {
 217         int     error, r, last;
 218         char    *s = an_conf;
 219
 220         last = an_dump;
 221
 222         switch (an_dump) {
 223         case 0:
 224                 strcpy(an_conf, "off");
 225                 break;
 226         case 1:
 227                 strcpy(an_conf, "type");
 228                 break;
 229         case 2:
 230                 strcpy(an_conf, "dump");
 231                 break;
 232         default:
 233                 snprintf(an_conf, 5, "%x", an_dump);
 234                 break;
 235         }
 236
 237         error = sysctl_handle_string(oidp, an_conf, sizeof(an_conf), req);
 238
 239         if (strncmp(an_conf,"off", 3) == 0) {
 240                 an_dump = 0;
 241         }
 242         if (strncmp(an_conf,"dump", 4) == 0) {
 243                 an_dump = 1;
 244         }
 245         if (strncmp(an_conf,"type", 4) == 0) {
 246                 an_dump = 2;
 247         }
 248         if (*s == 'f') {
 249                 r = 0;
 250                 for (;;s++) {
 251                         if ((*s >= '0') && (*s <= '9')) {
 252                                 r = r * 16 + (*s - '0');
 253                         } else if ((*s >= 'a') && (*s <= 'f')) {
 254                                 r = r * 16 + (*s - 'a' + 10);
 255                         } else {
 256                                 break;
 257                         }
 258                 }
 259                 an_dump = r;
 260         }
 261         if (an_dump != last)
 262                 printf("Sysctl changed for Aironet driver\n");
 263
 264         return error;
 265 }
 266
 267 SYSCTL_PROC(_hw_an, OID_AUTO, an_dump, CTLTYPE_STRING | CTLFLAG_RW,
 268             0, sizeof(an_conf), sysctl_an_dump, "A", "");
 269
 270 static int
 271 sysctl_an_cache_mode(SYSCTL_HANDLER_ARGS)
 272 {
 273         int     error, last;
 274
 275         last = an_cache_mode;
 276
 277         switch (an_cache_mode) {
 278         case 1:
 279                 strcpy(an_conf_cache, "per");
 280                 break;
 281         case 2:
 282                 strcpy(an_conf_cache, "raw");
 283                 break;
 284         default:
 285                 strcpy(an_conf_cache, "dbm");
 286                 break;
 287         }
 288
 289         error = sysctl_handle_string(oidp, an_conf_cache,
 290                         sizeof(an_conf_cache), req);
 291
 292         if (strncmp(an_conf_cache,"dbm", 3) == 0) {
 293                 an_cache_mode = 0;
 294         }
 295         if (strncmp(an_conf_cache,"per", 3) == 0) {
 296                 an_cache_mode = 1;
 297         }
 298         if (strncmp(an_conf_cache,"raw", 3) == 0) {
 299                 an_cache_mode = 2;
 300         }
 301
 302         return error;
 303 }
 304
 305 SYSCTL_PROC(_hw_an, OID_AUTO, an_cache_mode, CTLTYPE_STRING | CTLFLAG_RW,
 306             0, sizeof(an_conf_cache), sysctl_an_cache_mode, "A", "");
 307
 308 /*
 309  * We probe for an Aironet 4500/4800 card by attempting to
 310  * read the default SSID list. On reset, the first entry in
 311  * the SSID list will contain the name "tsunami." If we don't
 312  * find this, then there's no card present.
 313  */
 314 int
 315 an_probe(dev)
 316         device_t                dev;
 317 {
 318         struct an_softc *sc = device_get_softc(dev);
 319         struct an_ltv_ssidlist  ssid;
 320         int     error;
 321
 322         bzero((char *)&ssid, sizeof(ssid));
 323
 324         error = an_alloc_port(dev, 0, AN_IOSIZ);
 325         if (error != 0)
 326                 return (0);
 327
 328         /* can't do autoprobing */
 329         if (rman_get_start(sc->port_res) == -1)
 330                 return(0);
 331
 332         /*
 333          * We need to fake up a softc structure long enough
 334          * to be able to issue commands and call some of the
 335          * other routines.
 336          */
 337         sc->an_bhandle = rman_get_bushandle(sc->port_res);
 338         sc->an_btag = rman_get_bustag(sc->port_res);
 339         sc->an_unit = device_get_unit(dev);
 340
 341         ssid.an_len = sizeof(ssid);
 342         ssid.an_type = AN_RID_SSIDLIST;
 343
 344         /* Make sure interrupts are disabled. */
 345         CSR_WRITE_2(sc, AN_INT_EN(sc->mpi350), 0);
 346         CSR_WRITE_2(sc, AN_EVENT_ACK(sc->mpi350), 0xFFFF);
 347
 348         an_reset(sc);
 349         /* No need for an_init_mpi350_desc since it will be done in attach */
 350
 351         if (an_cmd(sc, AN_CMD_READCFG, 0))
 352                 return(0);
 353
 354         if (an_read_record(sc, (struct an_ltv_gen *)&ssid))
 355                 return(0);
 356
 357         /* See if the ssid matches what we expect ... but doesn't have to */
 358         if (strcmp(ssid.an_ssid1, AN_DEF_SSID))
 359                 return(0);
 360
 361         return(AN_IOSIZ);
 362 }
 363
 364 /*
 365  * Allocate a port resource with the given resource id.
 366  */
 367 int
 368 an_alloc_port(dev, rid, size)
 369         device_t dev;
 370         int rid;
 371         int size;
 372 {
 373         struct an_softc *sc = device_get_softc(dev);
 374         struct resource *res;
 375
 376         res = bus_alloc_resource(dev, SYS_RES_IOPORT, &rid,
 377                                  0ul, ~0ul, size, RF_ACTIVE);
 378         if (res) {
 379                 sc->port_rid = rid;
 380                 sc->port_res = res;
 381                 return (0);
 382         } else {
 383                 return (ENOENT);
 384         }
 385 }
 386
 387 /*
 388  * Allocate a memory resource with the given resource id.
 389  */
 390 int an_alloc_memory(device_t dev, int rid, int size)
 391 {
 392         struct an_softc *sc = device_get_softc(dev);
 393         struct resource *res;
 394
 395         res = bus_alloc_resource(dev, SYS_RES_MEMORY, &rid,
 396                                  0ul, ~0ul, size, RF_ACTIVE);
 397         if (res) {
 398                 sc->mem_rid = rid;
 399                 sc->mem_res = res;
 400                 sc->mem_used = size;
 401                 return (0);
 402         } else {
 403                 return (ENOENT);
 404         }
 405 }
 406
 407 /*
 408  * Allocate a auxilary memory resource with the given resource id.
 409  */
 410 int an_alloc_aux_memory(device_t dev, int rid, int size)
 411 {
 412         struct an_softc *sc = device_get_softc(dev);
 413         struct resource *res;
 414
 415         res = bus_alloc_resource(dev, SYS_RES_MEMORY, &rid,
 416                                  0ul, ~0ul, size, RF_ACTIVE);
 417         if (res) {
 418                 sc->mem_aux_rid = rid;
 419                 sc->mem_aux_res = res;
 420                 sc->mem_aux_used = size;
 421                 return (0);
 422         } else {
 423                 return (ENOENT);
 424         }
 425 }
 426
 427 /*
 428  * Allocate an irq resource with the given resource id.
 429  */
 430 int
 431 an_alloc_irq(dev, rid, flags)
 432         device_t dev;
 433         int rid;
 434         int flags;
 435 {
 436         struct an_softc *sc = device_get_softc(dev);
 437         struct resource *res;
 438
 439         res = bus_alloc_resource(dev, SYS_RES_IRQ, &rid,
 440                                  0ul, ~0ul, 1, (RF_ACTIVE | flags));
 441         if (res) {
 442                 sc->irq_rid = rid;
 443                 sc->irq_res = res;
 444                 return (0);
 445         } else {
 446                 return (ENOENT);
 447         }
 448 }
 449
 450 static void
 451 an_dma_malloc_cb(arg, segs, nseg, error)
 452         void *arg;
 453         bus_dma_segment_t *segs;
 454         int nseg;
 455         int error;
 456 {
 457         bus_addr_t *paddr = (bus_addr_t*) arg;
 458         *paddr = segs->ds_addr;
 459 }
 460
 461 /*
 462  * Alloc DMA memory and set the pointer to it
 463  */
 464 static int
 465 an_dma_malloc(sc, size, dma, mapflags)
 466         struct an_softc *sc;
 467         bus_size_t size;
 468         struct an_dma_alloc *dma;
 469         int mapflags;
 470 {
 471         int r;
 472
 473         r = bus_dmamap_create(sc->an_dtag, BUS_DMA_NOWAIT, &dma->an_dma_map);
 474         if (r != 0)
 475                 goto fail_0;
 476
 477         r = bus_dmamem_alloc(sc->an_dtag, (void**) &dma->an_dma_vaddr,
 478                              BUS_DMA_NOWAIT, &dma->an_dma_map);
 479         if (r != 0)
 480                 goto fail_1;
 481
 482         r = bus_dmamap_load(sc->an_dtag, dma->an_dma_map, dma->an_dma_vaddr,
 483                             size,
 484                             an_dma_malloc_cb,
 485                             &dma->an_dma_paddr,
 486                             mapflags | BUS_DMA_NOWAIT);
 487         if (r != 0)
 488                 goto fail_2;
 489
 490         dma->an_dma_size = size;
 491         return (0);
 492
 493 fail_2:
 494         bus_dmamap_unload(sc->an_dtag, dma->an_dma_map);
 495 fail_1:
 496         bus_dmamem_free(sc->an_dtag, dma->an_dma_vaddr, dma->an_dma_map);
 497 fail_0:
 498         bus_dmamap_destroy(sc->an_dtag, dma->an_dma_map);
 499         dma->an_dma_map = NULL;
 500         return (r);
 501 }
 502
 503 static void
 504 an_dma_free(sc, dma)
 505         struct an_softc *sc;
 506         struct an_dma_alloc *dma;
 507 {
 508         bus_dmamap_unload(sc->an_dtag, dma->an_dma_map);
 509         bus_dmamem_free(sc->an_dtag, dma->an_dma_vaddr, dma->an_dma_map);
 510         bus_dmamap_destroy(sc->an_dtag, dma->an_dma_map);
 511 }
 512
 513 /*
 514  * Release all resources
 515  */
 516 void
 517 an_release_resources(dev)
 518         device_t dev;
 519 {
 520         struct an_softc *sc = device_get_softc(dev);
 521         int i;
 522
 523         if (sc->port_res) {
 524                 bus_release_resource(dev, SYS_RES_IOPORT,
 525                                      sc->port_rid, sc->port_res);
 526                 sc->port_res = 0;
 527         }
 528         if (sc->mem_res) {
 529                 bus_release_resource(dev, SYS_RES_MEMORY,
 530                                      sc->mem_rid, sc->mem_res);
 531                 sc->mem_res = 0;
 532         }
 533         if (sc->mem_aux_res) {
 534                 bus_release_resource(dev, SYS_RES_MEMORY,
 535                                      sc->mem_aux_rid, sc->mem_aux_res);
 536                 sc->mem_aux_res = 0;
 537         }
 538         if (sc->irq_res) {
 539                 bus_release_resource(dev, SYS_RES_IRQ,
 540                                      sc->irq_rid, sc->irq_res);
 541                 sc->irq_res = 0;
 542         }
 543         if (sc->an_rid_buffer.an_dma_paddr) {
 544                 an_dma_free(sc, &sc->an_rid_buffer);
 545         }
 546         for (i = 0; i < AN_MAX_RX_DESC; i++)
 547                 if (sc->an_rx_buffer[i].an_dma_paddr) {
 548                         an_dma_free(sc, &sc->an_rx_buffer[i]);
 549                 }
 550         for (i = 0; i < AN_MAX_TX_DESC; i++)
 551                 if (sc->an_tx_buffer[i].an_dma_paddr) {
 552                         an_dma_free(sc, &sc->an_tx_buffer[i]);
 553                 }
 554         if (sc->an_dtag) {
 555                 bus_dma_tag_destroy(sc->an_dtag);
 556         }
 557
 558 }
 559
 560 int
 561 an_init_mpi350_desc(sc)
 562         struct an_softc *sc;
 563 {
 564         struct an_command       cmd_struct;
 565         struct an_reply         reply;
 566         struct an_card_rid_desc an_rid_desc;
 567         struct an_card_rx_desc  an_rx_desc;
 568         struct an_card_tx_desc  an_tx_desc;
 569         int                     i, desc;
 570
 571         if(!sc->an_rid_buffer.an_dma_paddr)
 572                 an_dma_malloc(sc, AN_RID_BUFFER_SIZE,
 573                                  &sc->an_rid_buffer, 0);
 574         for (i = 0; i < AN_MAX_RX_DESC; i++)
 575                 if(!sc->an_rx_buffer[i].an_dma_paddr)
 576                         an_dma_malloc(sc, AN_RX_BUFFER_SIZE,
 577                                       &sc->an_rx_buffer[i], 0);
 578         for (i = 0; i < AN_MAX_TX_DESC; i++)
 579                 if(!sc->an_tx_buffer[i].an_dma_paddr)
 580                         an_dma_malloc(sc, AN_TX_BUFFER_SIZE,
 581                                       &sc->an_tx_buffer[i], 0);
 582
 583         /*
 584          * Allocate RX descriptor
 585          */
 586         bzero(&reply,sizeof(reply));
 587         cmd_struct.an_cmd   = AN_CMD_ALLOC_DESC;
 588         cmd_struct.an_parm0 = AN_DESCRIPTOR_RX;
 589         cmd_struct.an_parm1 = AN_RX_DESC_OFFSET;
 590         cmd_struct.an_parm2 = AN_MAX_RX_DESC;
 591         if (an_cmd_struct(sc, &cmd_struct, &reply)) {
 592                 printf("an%d: failed to allocate RX descriptor\n",
 593                        sc->an_unit);
 594                 return(EIO);
 595         }
 596
 597         for (desc = 0; desc < AN_MAX_RX_DESC; desc++) {
 598                 bzero(&an_rx_desc, sizeof(an_rx_desc));
 599                 an_rx_desc.an_valid = 1;
 600                 an_rx_desc.an_len = AN_RX_BUFFER_SIZE;
 601                 an_rx_desc.an_done = 0;
 602                 an_rx_desc.an_phys = sc->an_rx_buffer[desc].an_dma_paddr;
 603
 604                 for (i = 0; i < sizeof(an_rx_desc) / 4; i++)
 605                         CSR_MEM_AUX_WRITE_4(sc, AN_RX_DESC_OFFSET
 606                                             + (desc * sizeof(an_rx_desc))
 607                                             + (i * 4),
 608                                             ((u_int32_t*)&an_rx_desc)[i]);
 609         }
 610
 611         /*
 612          * Allocate TX descriptor
 613          */
 614
 615         bzero(&reply,sizeof(reply));
 616         cmd_struct.an_cmd   = AN_CMD_ALLOC_DESC;
 617         cmd_struct.an_parm0 = AN_DESCRIPTOR_TX;
 618         cmd_struct.an_parm1 = AN_TX_DESC_OFFSET;
 619         cmd_struct.an_parm2 = AN_MAX_TX_DESC;
 620         if (an_cmd_struct(sc, &cmd_struct, &reply)) {
 621                 printf("an%d: failed to allocate TX descriptor\n",
 622                        sc->an_unit);
 623                 return(EIO);
 624         }
 625
 626         for (desc = 0; desc < AN_MAX_TX_DESC; desc++) {
 627                 bzero(&an_tx_desc, sizeof(an_tx_desc));
 628                 an_tx_desc.an_offset = 0;
 629                 an_tx_desc.an_eoc = 0;
 630                 an_tx_desc.an_valid = 0;
 631                 an_tx_desc.an_len = 0;
 632                 an_tx_desc.an_phys = sc->an_tx_buffer[desc].an_dma_paddr;
 633
 634                 for (i = 0; i < sizeof(an_tx_desc) / 4; i++)
 635                         CSR_MEM_AUX_WRITE_4(sc, AN_TX_DESC_OFFSET
 636                                             + (desc * sizeof(an_tx_desc))
 637                                             + (i * 4),
 638                                             ((u_int32_t*)&an_tx_desc)[i]);
 639         }
 640
 641         /*
 642          * Allocate RID descriptor
 643          */
 644
 645         bzero(&reply,sizeof(reply));
 646         cmd_struct.an_cmd   = AN_CMD_ALLOC_DESC;
 647         cmd_struct.an_parm0 = AN_DESCRIPTOR_HOSTRW;
 648         cmd_struct.an_parm1 = AN_HOST_DESC_OFFSET;
 649         cmd_struct.an_parm2 = 1;
 650         if (an_cmd_struct(sc, &cmd_struct, &reply)) {
 651                 printf("an%d: failed to allocate host descriptor\n",
 652                        sc->an_unit);
 653                 return(EIO);
 654         }
 655
 656         bzero(&an_rid_desc, sizeof(an_rid_desc));
 657         an_rid_desc.an_valid = 1;
 658         an_rid_desc.an_len = AN_RID_BUFFER_SIZE;
 659         an_rid_desc.an_rid = 0;
 660         an_rid_desc.an_phys = sc->an_rid_buffer.an_dma_paddr;
 661
 662         for (i = 0; i < sizeof(an_rid_desc) / 4; i++)
 663                 CSR_MEM_AUX_WRITE_4(sc, AN_HOST_DESC_OFFSET + i * 4,
 664                                     ((u_int32_t*)&an_rid_desc)[i]);
 665
 666         return(0);
 667 }
 668
 669 int
 670 an_attach(sc, unit, flags)
 671         struct an_softc *sc;
 672         int unit;
 673         int flags;
 674 {
 675         struct ifnet            *ifp = &sc->arpcom.ac_if;
 676         int                     error;
 677
 678         sc->an_gone = 0;
 679         sc->an_associated = 0;
 680         sc->an_monitor = 0;
 681         sc->an_was_monitor = 0;
 682         sc->an_flash_buffer = NULL;
 683
 684         /* Reset the NIC. */
 685         an_reset(sc);
 686         if (sc->mpi350) {
 687                 error = an_init_mpi350_desc(sc);
 688                 if (error)
 689                         return(error);
 690         }
 691
 692         /* Load factory config */
 693         if (an_cmd(sc, AN_CMD_READCFG, 0)) {
 694                 printf("an%d: failed to load config data\n", sc->an_unit);
 695                 return(EIO);
 696         }
 697
 698         /* Read the current configuration */
 699         sc->an_config.an_type = AN_RID_GENCONFIG;
 700         sc->an_config.an_len = sizeof(struct an_ltv_genconfig);
 701         if (an_read_record(sc, (struct an_ltv_gen *)&sc->an_config)) {
 702                 printf("an%d: read record failed\n", sc->an_unit);
 703                 return(EIO);
 704         }
 705
 706         /* Read the card capabilities */
 707         sc->an_caps.an_type = AN_RID_CAPABILITIES;
 708         sc->an_caps.an_len = sizeof(struct an_ltv_caps);
 709         if (an_read_record(sc, (struct an_ltv_gen *)&sc->an_caps)) {
 710                 printf("an%d: read record failed\n", sc->an_unit);
 711                 return(EIO);
 712         }
 713
 714         /* Read ssid list */
 715         sc->an_ssidlist.an_type = AN_RID_SSIDLIST;
 716         sc->an_ssidlist.an_len = sizeof(struct an_ltv_ssidlist);
 717         if (an_read_record(sc, (struct an_ltv_gen *)&sc->an_ssidlist)) {
 718                 printf("an%d: read record failed\n", sc->an_unit);
 719                 return(EIO);
 720         }
 721
 722         /* Read AP list */
 723         sc->an_aplist.an_type = AN_RID_APLIST;
 724         sc->an_aplist.an_len = sizeof(struct an_ltv_aplist);
 725         if (an_read_record(sc, (struct an_ltv_gen *)&sc->an_aplist)) {
 726                 printf("an%d: read record failed\n", sc->an_unit);
 727                 return(EIO);
 728         }
 729
 730 #ifdef ANCACHE
 731         /* Read the RSSI <-> dBm map */
 732         sc->an_have_rssimap = 0;
 733         if (sc->an_caps.an_softcaps & 8) {
 734                 sc->an_rssimap.an_type = AN_RID_RSSI_MAP;
 735                 sc->an_rssimap.an_len = sizeof(struct an_ltv_rssi_map);
 736                 if (an_read_record(sc, (struct an_ltv_gen *)&sc->an_rssimap)) {
 737                         printf("an%d: unable to get RSSI <-> dBM map\n", sc->an_unit);
 738                 } else {
 739                         printf("an%d: got RSSI <-> dBM map\n", sc->an_unit);
 740                         sc->an_have_rssimap = 1;
 741                 }
 742         } else {
 743                 printf("an%d: no RSSI <-> dBM map\n", sc->an_unit);
 744         }
 745 #endif
 746
 747         ifp->if_softc = sc;
 748         if_initname(ifp, "an", unit);
 749         ifp->if_mtu = ETHERMTU;
 750         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
 751         ifp->if_ioctl = an_ioctl;
 752         ifp->if_start = an_start;
 753         ifp->if_watchdog = an_watchdog;
 754         ifp->if_init = an_init;
 755         ifp->if_baudrate = 10000000;
 756         ifp->if_snd.ifq_maxlen = IFQ_MAXLEN;
 757
 758         bzero(sc->an_config.an_nodename, sizeof(sc->an_config.an_nodename));
 759         bcopy(AN_DEFAULT_NODENAME, sc->an_config.an_nodename,
 760             sizeof(AN_DEFAULT_NODENAME) - 1);
 761
 762         bzero(sc->an_ssidlist.an_ssid1, sizeof(sc->an_ssidlist.an_ssid1));
 763         bcopy(AN_DEFAULT_NETNAME, sc->an_ssidlist.an_ssid1,
 764             sizeof(AN_DEFAULT_NETNAME) - 1);
 765         sc->an_ssidlist.an_ssid1_len = strlen(AN_DEFAULT_NETNAME);
 766
 767         sc->an_config.an_opmode =
 768             AN_OPMODE_INFRASTRUCTURE_STATION;
 769
 770         sc->an_tx_rate = 0;
 771         bzero((char *)&sc->an_stats, sizeof(sc->an_stats));
 772
 773         ifmedia_init(&sc->an_ifmedia, 0, an_media_change, an_media_status);
 774 #define ADD(m, c)       ifmedia_add(&sc->an_ifmedia, (m), (c), NULL)
 775         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1,
 776             IFM_IEEE80211_ADHOC, 0), 0);
 777         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1, 0, 0), 0);
 778         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2,
 779             IFM_IEEE80211_ADHOC, 0), 0);
 780         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2, 0, 0), 0);
 781         if (sc->an_caps.an_rates[2] == AN_RATE_5_5MBPS) {
 782                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5,
 783                     IFM_IEEE80211_ADHOC, 0), 0);
 784                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5, 0, 0), 0);
 785         }
 786         if (sc->an_caps.an_rates[3] == AN_RATE_11MBPS) {
 787                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11,
 788                     IFM_IEEE80211_ADHOC, 0), 0);
 789                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11, 0, 0), 0);
 790         }
 791         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO,
 792             IFM_IEEE80211_ADHOC, 0), 0);
 793         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO, 0, 0), 0);
 794 #undef  ADD
 795         ifmedia_set(&sc->an_ifmedia, IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO,
 796             0, 0));
 797
 798         /*
 799          * Call MI attach routine.
 800          */
 801         ether_ifattach(ifp, sc->an_caps.an_oemaddr);
 802         callout_handle_init(&sc->an_stat_ch);
 803
 804         return(0);
 805 }
 806
 807 static void
 808 an_rxeof(sc)
 809         struct an_softc *sc;
 810 {
 811         struct ifnet   *ifp;
 812         struct ether_header *eh;
 813         struct ieee80211_frame *ih;
 814         struct an_rxframe rx_frame;
 815         struct an_rxframe_802_3 rx_frame_802_3;
 816         struct mbuf    *m;
 817         int             len, id, error = 0, i, count = 0;
 818         int             ieee80211_header_len;
 819         u_char          *bpf_buf;
 820         u_short         fc1;
 821         struct an_card_rx_desc an_rx_desc;
 822         u_int8_t        *buf;
 823
 824         ifp = &sc->arpcom.ac_if;
 825
 826         if (!sc->mpi350) {
 827                 id = CSR_READ_2(sc, AN_RX_FID);
 828
 829                 if (sc->an_monitor && (ifp->if_flags & IFF_PROMISC)) {
 830                         /* read raw 802.11 packet */
 831                         bpf_buf = sc->buf_802_11;
 832
 833                         /* read header */
 834                         if (an_read_data(sc, id, 0x0, (caddr_t)&rx_frame,
 835                                          sizeof(rx_frame))) {
 836                                 ifp->if_ierrors++;
 837                                 return;
 838                         }
 839
 840                         /*
 841                          * skip beacon by default since this increases the
 842                          * system load a lot
 843                          */
 844
 845                         if (!(sc->an_monitor & AN_MONITOR_INCLUDE_BEACON) &&
 846                             (rx_frame.an_frame_ctl &
 847                              IEEE80211_FC0_SUBTYPE_BEACON)) {
 848                                 return;
 849                         }
 850
 851                         if (sc->an_monitor & AN_MONITOR_AIRONET_HEADER) {
 852                                 len = rx_frame.an_rx_payload_len
 853                                         + sizeof(rx_frame);
 854                                 /* Check for insane frame length */
 855                                 if (len > sizeof(sc->buf_802_11)) {
 856                                         printf("an%d: oversized packet "
 857                                                "received (%d, %d)\n",
 858                                                sc->an_unit, len, MCLBYTES);
 859                                         ifp->if_ierrors++;
 860                                         return;
 861                                 }
 862
 863                                 bcopy((char *)&rx_frame,
 864                                       bpf_buf, sizeof(rx_frame));
 865
 866                                 error = an_read_data(sc, id, sizeof(rx_frame),
 867                                             (caddr_t)bpf_buf+sizeof(rx_frame),
 868                                             rx_frame.an_rx_payload_len);
 869                         } else {
 870                                 fc1=rx_frame.an_frame_ctl >> 8;
 871                                 ieee80211_header_len =
 872                                         sizeof(struct ieee80211_frame);
 873                                 if ((fc1 & IEEE80211_FC1_DIR_TODS) &&
 874                                     (fc1 & IEEE80211_FC1_DIR_FROMDS)) {
 875                                         ieee80211_header_len += ETHER_ADDR_LEN;
 876                                 }
 877
 878                                 len = rx_frame.an_rx_payload_len
 879                                         + ieee80211_header_len;
 880                                 /* Check for insane frame length */
 881                                 if (len > sizeof(sc->buf_802_11)) {
 882                                         printf("an%d: oversized packet "
 883                                                "received (%d, %d)\n",
 884                                                sc->an_unit, len, MCLBYTES);
 885                                         ifp->if_ierrors++;
 886                                         return;
 887                                 }
 888
 889                                 ih = (struct ieee80211_frame *)bpf_buf;
 890
 891                                 bcopy((char *)&rx_frame.an_frame_ctl,
 892                                       (char *)ih, ieee80211_header_len);
 893
 894                                 error = an_read_data(sc, id, sizeof(rx_frame) +
 895                                             rx_frame.an_gaplen,
 896                                             (caddr_t)ih +ieee80211_header_len,
 897                                             rx_frame.an_rx_payload_len);
 898                         }
 899                         /* dump raw 802.11 packet to bpf and skip ip stack */
 900                         if (ifp->if_bpf != NULL) {
 901                                 bpf_tap(ifp, bpf_buf, len);
 902                         }
 903                 } else {
 904                         MGETHDR(m, M_NOWAIT, MT_DATA);
 905                         if (m == NULL) {
 906                                 ifp->if_ierrors++;
 907                                 return;
 908                         }
 909                         MCLGET(m, M_NOWAIT);
 910                         if (!(m->m_flags & M_EXT)) {
 911                                 m_freem(m);
 912                                 ifp->if_ierrors++;
 913                                 return;
 914                         }
 915                         m->m_pkthdr.rcvif = ifp;
 916                         /* Read Ethernet encapsulated packet */
 917
 918 #ifdef ANCACHE
 919                         /* Read NIC frame header */
 920                         if (an_read_data(sc, id, 0, (caddr_t)&rx_frame,
 921                                          sizeof(rx_frame))) {
 922                                 ifp->if_ierrors++;
 923                                 return;
 924                         }
 925 #endif
 926                         /* Read in the 802_3 frame header */
 927                         if (an_read_data(sc, id, 0x34,
 928                                          (caddr_t)&rx_frame_802_3,
 929                                          sizeof(rx_frame_802_3))) {
 930                                 ifp->if_ierrors++;
 931                                 return;
 932                         }
 933                         if (rx_frame_802_3.an_rx_802_3_status != 0) {
 934                                 ifp->if_ierrors++;
 935                                 return;
 936                         }
 937                         /* Check for insane frame length */
 938                         len = rx_frame_802_3.an_rx_802_3_payload_len;
 939                         if (len > sizeof(sc->buf_802_11)) {
 940                                 printf("an%d: oversized packet "
 941                                        "received (%d, %d)\n",
 942                                        sc->an_unit, len, MCLBYTES);
 943                                 ifp->if_ierrors++;
 944                                 return;
 945                         }
 946                         m->m_pkthdr.len = m->m_len =
 947                                 rx_frame_802_3.an_rx_802_3_payload_len + 12;
 948
 949                         eh = mtod(m, struct ether_header *);
 950
 951                         bcopy((char *)&rx_frame_802_3.an_rx_dst_addr,
 952                               (char *)&eh->ether_dhost, ETHER_ADDR_LEN);
 953                         bcopy((char *)&rx_frame_802_3.an_rx_src_addr,
 954                               (char *)&eh->ether_shost, ETHER_ADDR_LEN);
 955
 956                         /* in mbuf header type is just before payload */
 957                         error = an_read_data(sc, id, 0x44,
 958                                     (caddr_t)&(eh->ether_type),
 959                                     rx_frame_802_3.an_rx_802_3_payload_len);
 960
 961                         if (error) {
 962                                 m_freem(m);
 963                                 ifp->if_ierrors++;
 964                                 return;
 965                         }
 966                         ifp->if_ipackets++;
 967
 968 #ifdef ANCACHE
 969                         an_cache_store(sc, m,
 970                                 rx_frame.an_rx_signal_strength,
 971                                 rx_frame.an_rsvd0);
 972 #endif
 973                         (*ifp->if_input)(ifp, m);
 974                 }
 975
 976         } else { /* MPI-350 */
 977                 for (count = 0; count < AN_MAX_RX_DESC; count++){
 978                         for (i = 0; i < sizeof(an_rx_desc) / 4; i++)
 979                                 ((u_int32_t*)&an_rx_desc)[i]
 980                                         = CSR_MEM_AUX_READ_4(sc,
 981                                                 AN_RX_DESC_OFFSET
 982                                                 + (count * sizeof(an_rx_desc))
 983                                                 + (i * 4));
 984
 985                         if (an_rx_desc.an_done && !an_rx_desc.an_valid) {
 986                                 buf = sc->an_rx_buffer[count].an_dma_vaddr;
 987
 988                                 MGETHDR(m, M_NOWAIT, MT_DATA);
 989                                 if (m == NULL) {
 990                                         ifp->if_ierrors++;
 991                                         return;
 992                                 }
 993                                 MCLGET(m, M_NOWAIT);
 994                                 if (!(m->m_flags & M_EXT)) {
 995                                         m_freem(m);
 996                                         ifp->if_ierrors++;
 997                                         return;
 998                                 }
 999                                 m->m_pkthdr.rcvif = ifp;
1000                                 /* Read Ethernet encapsulated packet */
1001
1002                                 /*
1003                                  * No ANCACHE support since we just get back
1004                                  * an Ethernet packet no 802.11 info
1005                                  */
1006 #if 0
1007 #ifdef ANCACHE
1008                                 /* Read NIC frame header */
1009                                 bcopy(buf, (caddr_t)&rx_frame,
1010                                       sizeof(rx_frame));
1011 #endif
1012 #endif
1013                                 /* Check for insane frame length */
1014                                 len = an_rx_desc.an_len + 12;
1015                                 if (len > MCLBYTES) {
1016                                         printf("an%d: oversized packet "
1017                                                "received (%d, %d)\n",
1018                                                sc->an_unit, len, MCLBYTES);
1019                                         ifp->if_ierrors++;
1020                                         return;
1021                                 }
1022
1023                                 m->m_pkthdr.len = m->m_len =
1024                                         an_rx_desc.an_len + 12;
1025
1026                                 eh = mtod(m, struct ether_header *);
1027
1028                                 bcopy(buf, (char *)eh,
1029                                       m->m_pkthdr.len);
1030
1031                                 ifp->if_ipackets++;
1032
1033 #if 0
1034 #ifdef ANCACHE
1035                                 an_cache_store(sc, m,
1036                                         rx_frame.an_rx_signal_strength,
1037                                         rx_frame.an_rsvd0);
1038 #endif
1039 #endif
1040                                 (*ifp->if_input)(ifp, m);
1041
1042                                 an_rx_desc.an_valid = 1;
1043                                 an_rx_desc.an_len = AN_RX_BUFFER_SIZE;
1044                                 an_rx_desc.an_done = 0;
1045                                 an_rx_desc.an_phys =
1046                                         sc->an_rx_buffer[count].an_dma_paddr;
1047
1048                                 for (i = 0; i < sizeof(an_rx_desc) / 4; i++)
1049                                         CSR_MEM_AUX_WRITE_4(sc,
1050                                                 AN_RX_DESC_OFFSET
1051                                                 + (count * sizeof(an_rx_desc))
1052                                                 + (i * 4),
1053                                                 ((u_int32_t*)&an_rx_desc)[i]);
1054
1055                         } else {
1056                                 printf("an%d: Didn't get valid RX packet "
1057                                        "%x %x %d\n",
1058                                        sc->an_unit,
1059                                        an_rx_desc.an_done,
1060                                        an_rx_desc.an_valid, an_rx_desc.an_len);
1061                         }
1062                 }
1063         }
1064 }
1065
1066 static void
1067 an_txeof(sc, status)
1068         struct an_softc         *sc;
1069         int                     status;
1070 {
1071         struct ifnet            *ifp;
1072         int                     id, i;
1073
1074         ifp = &sc->arpcom.ac_if;
1075
1076         ifp->if_timer = 0;
1077         ifp->if_flags &= ~IFF_OACTIVE;
1078
1079         if (!sc->mpi350) {
1080                 id = CSR_READ_2(sc, AN_TX_CMP_FID);
1081
1082                 if (status & AN_EV_TX_EXC) {
1083                         ifp->if_oerrors++;
1084                 } else
1085                         ifp->if_opackets++;
1086
1087                 for (i = 0; i < AN_TX_RING_CNT; i++) {
1088                         if (id == sc->an_rdata.an_tx_ring[i]) {
1089                                 sc->an_rdata.an_tx_ring[i] = 0;
1090                                 break;
1091                         }
1092                 }
1093
1094                 AN_INC(sc->an_rdata.an_tx_cons, AN_TX_RING_CNT);
1095         } else { /* MPI 350 */
1096                 AN_INC(sc->an_rdata.an_tx_cons, AN_MAX_TX_DESC);
1097                 if (sc->an_rdata.an_tx_prod ==
1098                     sc->an_rdata.an_tx_cons)
1099                         sc->an_rdata.an_tx_empty = 1;
1100         }
1101
1102         return;
1103 }
1104
1105 /*
1106  * We abuse the stats updater to check the current NIC status. This
1107  * is important because we don't want to allow transmissions until
1108  * the NIC has synchronized to the current cell (either as the master
1109  * in an ad-hoc group, or as a station connected to an access point).
1110  */
1111 static void
1112 an_stats_update(xsc)
1113         void                    *xsc;
1114 {
1115         struct an_softc         *sc;
1116         struct ifnet            *ifp;
1117         int                     s;
1118
1119         s = splimp();
1120
1121         sc = xsc;
1122         ifp = &sc->arpcom.ac_if;
1123
1124         sc->an_status.an_type = AN_RID_STATUS;
1125         sc->an_status.an_len = sizeof(struct an_ltv_status);
1126         an_read_record(sc, (struct an_ltv_gen *)&sc->an_status);
1127
1128         if (sc->an_status.an_opmode & AN_STATUS_OPMODE_IN_SYNC)
1129                 sc->an_associated = 1;
1130         else
1131                 sc->an_associated = 0;
1132
1133         /* Don't do this while we're transmitting */
1134         if (ifp->if_flags & IFF_OACTIVE) {
1135                 sc->an_stat_ch = timeout(an_stats_update, sc, hz);
1136                 splx(s);
1137                 return;
1138         }
1139
1140         sc->an_stats.an_len = sizeof(struct an_ltv_stats);
1141         sc->an_stats.an_type = AN_RID_32BITS_CUM;
1142         an_read_record(sc, (struct an_ltv_gen *)&sc->an_stats.an_len);
1143
1144         sc->an_stat_ch = timeout(an_stats_update, sc, hz);
1145         splx(s);
1146
1147         return;
1148 }
1149
1150 void
1151 an_intr(xsc)
1152         void                    *xsc;
1153 {
1154         struct an_softc         *sc;
1155         struct ifnet            *ifp;
1156         u_int16_t               status;
1157
1158         sc = (struct an_softc*)xsc;
1159
1160         if (sc->an_gone)
1161                 return;
1162
1163         ifp = &sc->arpcom.ac_if;
1164
1165         /* Disable interrupts. */
1166         CSR_WRITE_2(sc, AN_INT_EN(sc->mpi350), 0);
1167
1168         status = CSR_READ_2(sc, AN_EVENT_STAT(sc->mpi350));
1169         CSR_WRITE_2(sc, AN_EVENT_ACK(sc->mpi350), ~AN_INTRS);
1170
1171         if (status & AN_EV_AWAKE) {
1172                 CSR_WRITE_2(sc, AN_EVENT_ACK(sc->mpi350), AN_EV_AWAKE);
1173         }
1174
1175         if (status & AN_EV_LINKSTAT) {
1176                 if (CSR_READ_2(sc, AN_LINKSTAT(sc->mpi350))
1177                     == AN_LINKSTAT_ASSOCIATED)
1178                         sc->an_associated = 1;
1179                 else
1180                         sc->an_associated = 0;
1181                 CSR_WRITE_2(sc, AN_EVENT_ACK(sc->mpi350), AN_EV_LINKSTAT);
1182         }
1183
1184         if (status & AN_EV_RX) {
1185                 an_rxeof(sc);
1186                 CSR_WRITE_2(sc, AN_EVENT_ACK(sc->mpi350), AN_EV_RX);
1187         }
1188
1189         if (status & AN_EV_TX) {
1190                 an_txeof(sc, status);
1191                 CSR_WRITE_2(sc, AN_EVENT_ACK(sc->mpi350), AN_EV_TX);
1192         }
1193
1194         if (status & AN_EV_TX_EXC) {
1195                 an_txeof(sc, status);
1196                 CSR_WRITE_2(sc, AN_EVENT_ACK(sc->mpi350), AN_EV_TX_EXC);
1197         }
1198
1199         if (status & AN_EV_ALLOC)
1200                 CSR_WRITE_2(sc, AN_EVENT_ACK(sc->mpi350), AN_EV_ALLOC);
1201
1202         /* Re-enable interrupts. */
1203         CSR_WRITE_2(sc, AN_INT_EN(sc->mpi350), AN_INTRS);
1204
1205         if ((ifp->if_flags & IFF_UP) && (ifp->if_snd.ifq_head != NULL))
1206                 an_start(ifp);
1207
1208         return;
1209 }
1210
1211 static int
1212 an_cmd_struct(sc, cmd, reply)
1213         struct an_softc         *sc;
1214         struct an_command       *cmd;
1215         struct an_reply         *reply;
1216 {
1217         int                     i;
1218
1219         for (i = 0; i != AN_TIMEOUT; i++) {
1220                 if (CSR_READ_2(sc, AN_COMMAND(sc->mpi350)) & AN_CMD_BUSY) {
1221                         DELAY(1000);
1222                 } else
1223                         break;
1224         }
1225         if( i == AN_TIMEOUT) {
1226                 printf("BUSY\n");
1227                 return(ETIMEDOUT);
1228         }
1229
1230         CSR_WRITE_2(sc, AN_PARAM0(sc->mpi350), cmd->an_parm0);
1231         CSR_WRITE_2(sc, AN_PARAM1(sc->mpi350), cmd->an_parm1);
1232         CSR_WRITE_2(sc, AN_PARAM2(sc->mpi350), cmd->an_parm2);
1233         CSR_WRITE_2(sc, AN_COMMAND(sc->mpi350), cmd->an_cmd);
1234
1235         for (i = 0; i < AN_TIMEOUT; i++) {
1236                 if (CSR_READ_2(sc, AN_EVENT_STAT(sc->mpi350)) & AN_EV_CMD)
1237                         break;
1238                 DELAY(1000);
1239         }
1240
1241         reply->an_resp0 = CSR_READ_2(sc, AN_RESP0(sc->mpi350));
1242         reply->an_resp1 = CSR_READ_2(sc, AN_RESP1(sc->mpi350));
1243         reply->an_resp2 = CSR_READ_2(sc, AN_RESP2(sc->mpi350));
1244         reply->an_status = CSR_READ_2(sc, AN_STATUS(sc->mpi350));
1245
1246         if (CSR_READ_2(sc, AN_COMMAND(sc->mpi350)) & AN_CMD_BUSY)
1247                 CSR_WRITE_2(sc, AN_EVENT_ACK(sc->mpi350), AN_EV_CLR_STUCK_BUSY);
1248
1249         /* Ack the command */
1250         CSR_WRITE_2(sc, AN_EVENT_ACK(sc->mpi350), AN_EV_CMD);
1251
1252         if (i == AN_TIMEOUT)
1253                 return(ETIMEDOUT);
1254
1255         return(0);
1256 }
1257
1258 static int
1259 an_cmd(sc, cmd, val)
1260         struct an_softc         *sc;
1261         int                     cmd;
1262         int                     val;
1263 {
1264         int                     i, s = 0;
1265
1266         CSR_WRITE_2(sc, AN_PARAM0(sc->mpi350), val);
1267         CSR_WRITE_2(sc, AN_PARAM1(sc->mpi350), 0);
1268         CSR_WRITE_2(sc, AN_PARAM2(sc->mpi350), 0);
1269         CSR_WRITE_2(sc, AN_COMMAND(sc->mpi350), cmd);
1270
1271         for (i = 0; i < AN_TIMEOUT; i++) {
1272                 if (CSR_READ_2(sc, AN_EVENT_STAT(sc->mpi350)) & AN_EV_CMD)
1273                         break;
1274                 else {
1275                         if (CSR_READ_2(sc, AN_COMMAND(sc->mpi350)) == cmd)
1276                                 CSR_WRITE_2(sc, AN_COMMAND(sc->mpi350), cmd);
1277                 }
1278         }
1279
1280         for (i = 0; i < AN_TIMEOUT; i++) {
1281                 CSR_READ_2(sc, AN_RESP0(sc->mpi350));
1282                 CSR_READ_2(sc, AN_RESP1(sc->mpi350));
1283                 CSR_READ_2(sc, AN_RESP2(sc->mpi350));
1284                 s = CSR_READ_2(sc, AN_STATUS(sc->mpi350));
1285                 if ((s & AN_STAT_CMD_CODE) == (cmd & AN_STAT_CMD_CODE))
1286                         break;
1287         }
1288
1289         /* Ack the command */
1290         CSR_WRITE_2(sc, AN_EVENT_ACK(sc->mpi350), AN_EV_CMD);
1291
1292         if (CSR_READ_2(sc, AN_COMMAND(sc->mpi350)) & AN_CMD_BUSY)
1293                 CSR_WRITE_2(sc, AN_EVENT_ACK(sc->mpi350), AN_EV_CLR_STUCK_BUSY);
1294
1295         if (i == AN_TIMEOUT)
1296                 return(ETIMEDOUT);
1297
1298         return(0);
1299 }
1300
1301 /*
1302  * This reset sequence may look a little strange, but this is the
1303  * most reliable method I've found to really kick the NIC in the
1304  * head and force it to reboot correctly.
1305  */
1306 static void
1307 an_reset(sc)
1308         struct an_softc         *sc;
1309 {
1310         if (sc->an_gone)
1311                 return;
1312
1313         an_cmd(sc, AN_CMD_ENABLE, 0);
1314         an_cmd(sc, AN_CMD_FW_RESTART, 0);
1315         an_cmd(sc, AN_CMD_NOOP2, 0);
1316
1317         if (an_cmd(sc, AN_CMD_FORCE_SYNCLOSS, 0) == ETIMEDOUT)
1318                 printf("an%d: reset failed\n", sc->an_unit);
1319
1320         an_cmd(sc, AN_CMD_DISABLE, 0);
1321
1322         return;
1323 }
1324
1325 /*
1326  * Read an LTV record from the NIC.
1327  */
1328 static int
1329 an_read_record(sc, ltv)
1330         struct an_softc         *sc;
1331         struct an_ltv_gen       *ltv;
1332 {
1333         struct an_ltv_gen       *an_ltv;
1334         struct an_card_rid_desc an_rid_desc;
1335         struct an_command       cmd;
1336         struct an_reply         reply;
1337         u_int16_t               *ptr;
1338         u_int8_t                *ptr2;
1339         int                     i, len;
1340
1341         if (ltv->an_len < 4 || ltv->an_type == 0)
1342                 return(EINVAL);
1343
1344         if (!sc->mpi350){
1345                 /* Tell the NIC to enter record read mode. */
1346                 if (an_cmd(sc, AN_CMD_ACCESS|AN_ACCESS_READ, ltv->an_type)) {
1347                         printf("an%d: RID access failed\n", sc->an_unit);
1348                         return(EIO);
1349                 }
1350
1351                 /* Seek to the record. */
1352                 if (an_seek(sc, ltv->an_type, 0, AN_BAP1)) {
1353                         printf("an%d: seek to record failed\n", sc->an_unit);
1354                         return(EIO);
1355                 }
1356
1357                 /*
1358                  * Read the length and record type and make sure they
1359                  * match what we expect (this verifies that we have enough
1360                  * room to hold all of the returned data).
1361                  * Length includes type but not length.
1362                  */
1363                 len = CSR_READ_2(sc, AN_DATA1);
1364                 if (len > (ltv->an_len - 2)) {
1365                         printf("an%d: record length mismatch -- expected %d, "
1366                                "got %d for Rid %x\n", sc->an_unit,
1367                                ltv->an_len - 2, len, ltv->an_type);
1368                         len = ltv->an_len - 2;
1369                 } else {
1370                         ltv->an_len = len + 2;
1371                 }
1372
1373                 /* Now read the data. */
1374                 len -= 2;       /* skip the type */
1375                 ptr = &ltv->an_val;
1376                 for (i = len; i > 1; i -= 2)
1377                         *ptr++ = CSR_READ_2(sc, AN_DATA1);
1378                 if (i) {
1379                         ptr2 = (u_int8_t *)ptr;
1380                         *ptr2 = CSR_READ_1(sc, AN_DATA1);
1381                 }
1382         } else { /* MPI-350 */
1383                 an_rid_desc.an_valid = 1;
1384                 an_rid_desc.an_len = AN_RID_BUFFER_SIZE;
1385                 an_rid_desc.an_rid = 0;
1386                 an_rid_desc.an_phys = sc->an_rid_buffer.an_dma_paddr;
1387                 bzero(sc->an_rid_buffer.an_dma_vaddr, AN_RID_BUFFER_SIZE);
1388
1389                 bzero(&cmd, sizeof(cmd));
1390                 bzero(&reply, sizeof(reply));
1391                 cmd.an_cmd = AN_CMD_ACCESS|AN_ACCESS_READ;
1392                 cmd.an_parm0 = ltv->an_type;
1393
1394                 for (i = 0; i < sizeof(an_rid_desc) / 4; i++)
1395                         CSR_MEM_AUX_WRITE_4(sc, AN_HOST_DESC_OFFSET + i * 4,
1396                                             ((u_int32_t*)&an_rid_desc)[i]);
1397
1398                 if (an_cmd_struct(sc, &cmd, &reply)
1399                     || reply.an_status & AN_CMD_QUAL_MASK) {
1400                         printf("an%d: failed to read RID %x %x %x %x %x, %d\n",
1401                                sc->an_unit, ltv->an_type,
1402                                reply.an_status,
1403                                reply.an_resp0,
1404                                reply.an_resp1,
1405                                reply.an_resp2,
1406                                i);
1407                         return(EIO);
1408                 }
1409
1410                 an_ltv = (struct an_ltv_gen *)sc->an_rid_buffer.an_dma_vaddr;
1411                 if (an_ltv->an_len + 2 < an_rid_desc.an_len) {
1412                         an_rid_desc.an_len = an_ltv->an_len;
1413                 }
1414
1415                 if (an_rid_desc.an_len > 2)
1416                         bcopy(&an_ltv->an_type,
1417                               &ltv->an_val,
1418                               an_rid_desc.an_len - 2);
1419                 ltv->an_len = an_rid_desc.an_len + 2;
1420         }
1421
1422         if (an_dump)
1423                 an_dump_record(sc, ltv, "Read");
1424
1425         return(0);
1426 }
1427
1428 /*
1429  * Same as read, except we inject data instead of reading it.
1430  */
1431 static int
1432 an_write_record(sc, ltv)
1433         struct an_softc         *sc;
1434         struct an_ltv_gen       *ltv;
1435 {
1436         struct an_card_rid_desc an_rid_desc;
1437         struct an_command       cmd;
1438         struct an_reply         reply;
1439         char                    *buf;
1440         u_int16_t               *ptr;
1441         u_int8_t                *ptr2;
1442         int                     i, len;
1443
1444         if (an_dump)
1445                 an_dump_record(sc, ltv, "Write");
1446
1447         if (!sc->mpi350){
1448                 if (an_cmd(sc, AN_CMD_ACCESS|AN_ACCESS_READ, ltv->an_type))
1449                         return(EIO);
1450
1451                 if (an_seek(sc, ltv->an_type, 0, AN_BAP1))
1452                         return(EIO);
1453
1454                 /*
1455                  * Length includes type but not length.
1456                  */
1457                 len = ltv->an_len - 2;
1458                 CSR_WRITE_2(sc, AN_DATA1, len);
1459
1460                 len -= 2;       /* skip the type */
1461                 ptr = &ltv->an_val;
1462                 for (i = len; i > 1; i -= 2)
1463                         CSR_WRITE_2(sc, AN_DATA1, *ptr++);
1464                 if (i) {
1465                         ptr2 = (u_int8_t *)ptr;
1466                         CSR_WRITE_1(sc, AN_DATA0, *ptr2);
1467                 }
1468
1469                 if (an_cmd(sc, AN_CMD_ACCESS|AN_ACCESS_WRITE, ltv->an_type))
1470                         return(EIO);
1471         } else {
1472                 /* MPI-350 */
1473
1474                 for (i = 0; i != AN_TIMEOUT; i++) {
1475                         if (CSR_READ_2(sc, AN_COMMAND(sc->mpi350))
1476                             & AN_CMD_BUSY) {
1477                                 DELAY(10);
1478                         } else
1479                                 break;
1480                 }
1481                 if (i == AN_TIMEOUT) {
1482                         printf("BUSY\n");
1483                 }
1484
1485                 an_rid_desc.an_valid = 1;
1486                 an_rid_desc.an_len = ltv->an_len - 2;
1487                 an_rid_desc.an_rid = ltv->an_type;
1488                 an_rid_desc.an_phys = sc->an_rid_buffer.an_dma_paddr;
1489
1490                 bcopy(&ltv->an_type, sc->an_rid_buffer.an_dma_vaddr,
1491                       an_rid_desc.an_len);
1492
1493                 bzero(&cmd,sizeof(cmd));
1494                 bzero(&reply,sizeof(reply));
1495                 cmd.an_cmd = AN_CMD_ACCESS|AN_ACCESS_WRITE;
1496                 cmd.an_parm0 = ltv->an_type;
1497
1498                 for (i = 0; i < sizeof(an_rid_desc) / 4; i++)
1499                         CSR_MEM_AUX_WRITE_4(sc, AN_HOST_DESC_OFFSET + i * 4,
1500                                             ((u_int32_t*)&an_rid_desc)[i]);
1501
1502                 if ((i = an_cmd_struct(sc, &cmd, &reply))) {
1503                         printf("an%d: failed to write RID 1 %x %x %x %x %x, %d\n",
1504                             sc->an_unit, ltv->an_type,
1505                             reply.an_status,
1506                             reply.an_resp0,
1507                             reply.an_resp1,
1508                             reply.an_resp2,
1509                             i);
1510                         return(EIO);
1511                 }
1512
1513                 ptr = (u_int16_t *)buf;
1514
1515                 if (reply.an_status & AN_CMD_QUAL_MASK) {
1516                         printf("an%d: failed to write RID 2 %x %x %x %x %x, %d\n",
1517                             sc->an_unit, ltv->an_type,
1518                             reply.an_status,
1519                             reply.an_resp0,
1520                             reply.an_resp1,
1521                             reply.an_resp2,
1522                             i);
1523                         return(EIO);
1524                 }
1525         }
1526
1527         return(0);
1528 }
1529
1530 static void
1531 an_dump_record(sc, ltv, string)
1532         struct an_softc         *sc;
1533         struct an_ltv_gen       *ltv;
1534         char                    *string;
1535 {
1536         u_int8_t                *ptr2;
1537         int                     len;
1538         int                     i;
1539         int                     count = 0;
1540         char                    buf[17], temp;
1541
1542         len = ltv->an_len - 4;
1543         printf("an%d: RID %4x, Length %4d, Mode %s\n",
1544                 sc->an_unit, ltv->an_type, ltv->an_len - 4, string);
1545
1546         if (an_dump == 1 || (an_dump == ltv->an_type)) {
1547                 printf("an%d:\t", sc->an_unit);
1548                 bzero(buf,sizeof(buf));
1549
1550                 ptr2 = (u_int8_t *)&ltv->an_val;
1551                 for (i = len; i > 0; i--) {
1552                         printf("%02x ", *ptr2);
1553
1554                         temp = *ptr2++;
1555                         if (temp >= ' ' && temp <= '~')
1556                                 buf[count] = temp;
1557                         else if (temp >= 'A' && temp <= 'Z')
1558                                 buf[count] = temp;
1559                         else
1560                                 buf[count] = '.';
1561                         if (++count == 16) {
1562                                 count = 0;
1563                                 printf("%s\n",buf);
1564                                 printf("an%d:\t", sc->an_unit);
1565                                 bzero(buf,sizeof(buf));
1566                         }
1567                 }
1568                 for (; count != 16; count++) {
1569                         printf("   ");
1570                 }
1571                 printf(" %s\n",buf);
1572         }
1573 }
1574
1575 static int
1576 an_seek(sc, id, off, chan)
1577         struct an_softc         *sc;
1578         int                     id, off, chan;
1579 {
1580         int                     i;
1581         int                     selreg, offreg;
1582
1583         switch (chan) {
1584         case AN_BAP0:
1585                 selreg = AN_SEL0;
1586                 offreg = AN_OFF0;
1587                 break;
1588         case AN_BAP1:
1589                 selreg = AN_SEL1;
1590                 offreg = AN_OFF1;
1591                 break;
1592         default:
1593                 printf("an%d: invalid data path: %x\n", sc->an_unit, chan);
1594                 return(EIO);
1595         }
1596
1597         CSR_WRITE_2(sc, selreg, id);
1598         CSR_WRITE_2(sc, offreg, off);
1599
1600         for (i = 0; i < AN_TIMEOUT; i++) {
1601                 if (!(CSR_READ_2(sc, offreg) & (AN_OFF_BUSY|AN_OFF_ERR)))
1602                         break;
1603         }
1604
1605         if (i == AN_TIMEOUT)
1606                 return(ETIMEDOUT);
1607
1608         return(0);
1609 }
1610
1611 static int
1612 an_read_data(sc, id, off, buf, len)
1613         struct an_softc         *sc;
1614         int                     id, off;
1615         caddr_t                 buf;
1616         int                     len;
1617 {
1618         int                     i;
1619         u_int16_t               *ptr;
1620         u_int8_t                *ptr2;
1621
1622         if (off != -1) {
1623                 if (an_seek(sc, id, off, AN_BAP1))
1624                         return(EIO);
1625         }
1626
1627         ptr = (u_int16_t *)buf;
1628         for (i = len; i > 1; i -= 2)
1629                 *ptr++ = CSR_READ_2(sc, AN_DATA1);
1630         if (i) {
1631                 ptr2 = (u_int8_t *)ptr;
1632                 *ptr2 = CSR_READ_1(sc, AN_DATA1);
1633         }
1634
1635         return(0);
1636 }
1637
1638 static int
1639 an_write_data(sc, id, off, buf, len)
1640         struct an_softc         *sc;
1641         int                     id, off;
1642         caddr_t                 buf;
1643         int                     len;
1644 {
1645         int                     i;
1646         u_int16_t               *ptr;
1647         u_int8_t                *ptr2;
1648
1649         if (off != -1) {
1650                 if (an_seek(sc, id, off, AN_BAP0))
1651                         return(EIO);
1652         }
1653
1654         ptr = (u_int16_t *)buf;
1655         for (i = len; i > 1; i -= 2)
1656                 CSR_WRITE_2(sc, AN_DATA0, *ptr++);
1657         if (i) {
1658                 ptr2 = (u_int8_t *)ptr;
1659                 CSR_WRITE_1(sc, AN_DATA0, *ptr2);
1660         }
1661
1662         return(0);
1663 }
1664
1665 /*
1666  * Allocate a region of memory inside the NIC and zero
1667  * it out.
1668  */
1669 static int
1670 an_alloc_nicmem(sc, len, id)
1671         struct an_softc         *sc;
1672         int                     len;
1673         int                     *id;
1674 {
1675         int                     i;
1676
1677         if (an_cmd(sc, AN_CMD_ALLOC_MEM, len)) {
1678                 printf("an%d: failed to allocate %d bytes on NIC\n",
1679                     sc->an_unit, len);
1680                 return(ENOMEM);
1681         }
1682
1683         for (i = 0; i < AN_TIMEOUT; i++) {
1684                 if (CSR_READ_2(sc, AN_EVENT_STAT(sc->mpi350)) & AN_EV_ALLOC)
1685                         break;
1686         }
1687
1688         if (i == AN_TIMEOUT)
1689                 return(ETIMEDOUT);
1690
1691         CSR_WRITE_2(sc, AN_EVENT_ACK(sc->mpi350), AN_EV_ALLOC);
1692         *id = CSR_READ_2(sc, AN_ALLOC_FID);
1693
1694         if (an_seek(sc, *id, 0, AN_BAP0))
1695                 return(EIO);
1696
1697         for (i = 0; i < len / 2; i++)
1698                 CSR_WRITE_2(sc, AN_DATA0, 0);
1699
1700         return(0);
1701 }
1702
1703 static void
1704 an_setdef(sc, areq)
1705         struct an_softc         *sc;
1706         struct an_req           *areq;
1707 {
1708         struct sockaddr_dl      *sdl;
1709         struct ifaddr           *ifa;
1710         struct ifnet            *ifp;
1711         struct an_ltv_genconfig *cfg;
1712         struct an_ltv_ssidlist  *ssid;
1713         struct an_ltv_aplist    *ap;
1714         struct an_ltv_gen       *sp;
1715
1716         ifp = &sc->arpcom.ac_if;
1717
1718         switch (areq->an_type) {
1719         case AN_RID_GENCONFIG:
1720                 cfg = (struct an_ltv_genconfig *)areq;
1721
1722                 ifa = ifnet_addrs[ifp->if_index - 1];
1723                 sdl = (struct sockaddr_dl *)ifa->ifa_addr;
1724                 bcopy((char *)&cfg->an_macaddr, (char *)&sc->arpcom.ac_enaddr,
1725                     ETHER_ADDR_LEN);
1726                 bcopy((char *)&cfg->an_macaddr, LLADDR(sdl), ETHER_ADDR_LEN);
1727
1728                 bcopy((char *)cfg, (char *)&sc->an_config,
1729                         sizeof(struct an_ltv_genconfig));
1730                 break;
1731         case AN_RID_SSIDLIST:
1732                 ssid = (struct an_ltv_ssidlist *)areq;
1733                 bcopy((char *)ssid, (char *)&sc->an_ssidlist,
1734                         sizeof(struct an_ltv_ssidlist));
1735                 break;
1736         case AN_RID_APLIST:
1737                 ap = (struct an_ltv_aplist *)areq;
1738                 bcopy((char *)ap, (char *)&sc->an_aplist,
1739                         sizeof(struct an_ltv_aplist));
1740                 break;
1741         case AN_RID_TX_SPEED:
1742                 sp = (struct an_ltv_gen *)areq;
1743                 sc->an_tx_rate = sp->an_val;
1744
1745                 /* Read the current configuration */
1746                 sc->an_config.an_type = AN_RID_GENCONFIG;
1747                 sc->an_config.an_len = sizeof(struct an_ltv_genconfig);
1748                 an_read_record(sc, (struct an_ltv_gen *)&sc->an_config);
1749                 cfg = &sc->an_config;
1750
1751                 /* clear other rates and set the only one we want */
1752                 bzero(cfg->an_rates, sizeof(cfg->an_rates));
1753                 cfg->an_rates[0] = sc->an_tx_rate;
1754
1755                 /* Save the new rate */
1756                 sc->an_config.an_type = AN_RID_GENCONFIG;
1757                 sc->an_config.an_len = sizeof(struct an_ltv_genconfig);
1758                 break;
1759         case AN_RID_WEP_TEMP:
1760                 /* Cache the temp keys */
1761                 bcopy(areq,
1762                     &sc->an_temp_keys[((struct an_ltv_key *)areq)->kindex],
1763                     sizeof(struct an_ltv_key));
1764         case AN_RID_WEP_PERM:
1765         case AN_RID_LEAPUSERNAME:
1766         case AN_RID_LEAPPASSWORD:
1767                 /* Disable the MAC. */
1768                 an_cmd(sc, AN_CMD_DISABLE, 0);
1769
1770                 /* Write the key */
1771                 an_write_record(sc, (struct an_ltv_gen *)areq);
1772
1773                 /* Turn the MAC back on. */
1774                 an_cmd(sc, AN_CMD_ENABLE, 0);
1775
1776                 break;
1777         case AN_RID_MONITOR_MODE:
1778                 cfg = (struct an_ltv_genconfig *)areq;
1779                 bpfdetach(ifp);
1780                 if (ng_ether_detach_p != NULL)
1781                         (*ng_ether_detach_p) (ifp);
1782                 sc->an_monitor = cfg->an_len;
1783
1784                 if (sc->an_monitor & AN_MONITOR) {
1785                         if (sc->an_monitor & AN_MONITOR_AIRONET_HEADER) {
1786                                 bpfattach(ifp, DLT_AIRONET_HEADER,
1787                                         sizeof(struct ether_header));
1788                         } else {
1789                                 bpfattach(ifp, DLT_IEEE802_11,
1790                                         sizeof(struct ether_header));
1791                         }
1792                 } else {
1793                         bpfattach(ifp, DLT_EN10MB,
1794                                   sizeof(struct ether_header));
1795                         if (ng_ether_attach_p != NULL)
1796                                 (*ng_ether_attach_p) (ifp);
1797                 }
1798                 break;
1799         default:
1800                 printf("an%d: unknown RID: %x\n", sc->an_unit, areq->an_type);
1801                 return;
1802                 break;
1803         }
1804
1805
1806         /* Reinitialize the card. */
1807         if (ifp->if_flags)
1808                 an_init(sc);
1809
1810         return;
1811 }
1812
1813 /*
1814  * Derived from Linux driver to enable promiscious mode.
1815  */
1816
1817 static void
1818 an_promisc(sc, promisc)
1819         struct an_softc         *sc;
1820         int                     promisc;
1821 {
1822         if (sc->an_was_monitor)
1823                 an_reset(sc);
1824                 if (sc->mpi350)
1825                         an_init_mpi350_desc(sc);
1826         if (sc->an_monitor || sc->an_was_monitor)
1827                 an_init(sc);
1828
1829         sc->an_was_monitor = sc->an_monitor;
1830         an_cmd(sc, AN_CMD_SET_MODE, promisc ? 0xffff : 0);
1831
1832         return;
1833 }
1834
1835 static int
1836 an_ioctl(ifp, command, data, cr)
1837         struct ifnet            *ifp;
1838         u_long                  command;
1839         caddr_t                 data;
1840         struct ucred            *cr;
1841 {
1842         int                     s, error = 0;
1843         int                     len;
1844         int                     i;
1845         struct an_softc         *sc;
1846         struct ifreq            *ifr;
1847         struct ieee80211req     *ireq;
1848         u_int8_t                tmpstr[IEEE80211_NWID_LEN*2];
1849         u_int8_t                *tmpptr;
1850         struct an_ltv_genconfig *config;
1851         struct an_ltv_key       *key;
1852         struct an_ltv_status    *status;
1853         struct an_ltv_ssidlist  *ssids;
1854         int                     mode;
1855         struct aironet_ioctl    l_ioctl;
1856
1857         sc = ifp->if_softc;
1858         s = splimp();
1859         ifr = (struct ifreq *)data;
1860         ireq = (struct ieee80211req *)data;
1861
1862         config = (struct an_ltv_genconfig *)&sc->areq;
1863         key = (struct an_ltv_key *)&sc->areq;
1864         status = (struct an_ltv_status *)&sc->areq;
1865         ssids = (struct an_ltv_ssidlist *)&sc->areq;
1866
1867         if (sc->an_gone) {
1868                 error = ENODEV;
1869                 goto out;
1870         }
1871
1872         switch (command) {
1873         case SIOCSIFADDR:
1874         case SIOCGIFADDR:
1875         case SIOCSIFMTU:
1876                 error = ether_ioctl(ifp, command, data);
1877                 break;
1878         case SIOCSIFFLAGS:
1879                 if (ifp->if_flags & IFF_UP) {
1880                         if (ifp->if_flags & IFF_RUNNING &&
1881                             ifp->if_flags & IFF_PROMISC &&
1882                             !(sc->an_if_flags & IFF_PROMISC)) {
1883                                 an_promisc(sc, 1);
1884                         } else if (ifp->if_flags & IFF_RUNNING &&
1885                             !(ifp->if_flags & IFF_PROMISC) &&
1886                             sc->an_if_flags & IFF_PROMISC) {
1887                                 an_promisc(sc, 0);
1888                         } else
1889                                 an_init(sc);
1890                 } else {
1891                         if (ifp->if_flags & IFF_RUNNING)
1892                                 an_stop(sc);
1893                 }
1894                 sc->an_if_flags = ifp->if_flags;
1895                 error = 0;
1896                 break;
1897         case SIOCSIFMEDIA:
1898         case SIOCGIFMEDIA:
1899                 error = ifmedia_ioctl(ifp, ifr, &sc->an_ifmedia, command);
1900                 break;
1901         case SIOCADDMULTI:
1902         case SIOCDELMULTI:
1903                 /* The Aironet has no multicast filter. */
1904                 error = 0;
1905                 break;
1906         case SIOCGAIRONET:
1907                 error = copyin(ifr->ifr_data, &sc->areq, sizeof(sc->areq));
1908                 if (error != 0)
1909                         break;
1910 #ifdef ANCACHE
1911                 if (sc->areq.an_type == AN_RID_ZERO_CACHE) {
1912                         error = suser_cred(cr, NULL_CRED_OKAY);
1913                         if (error)
1914                                 break;
1915                         sc->an_sigitems = sc->an_nextitem = 0;
1916                         break;
1917                 } else if (sc->areq.an_type == AN_RID_READ_CACHE) {
1918                         char *pt = (char *)&sc->areq.an_val;
1919                         bcopy((char *)&sc->an_sigitems, (char *)pt,
1920                             sizeof(int));
1921                         pt += sizeof(int);
1922                         sc->areq.an_len = sizeof(int) / 2;
1923                         bcopy((char *)&sc->an_sigcache, (char *)pt,
1924                             sizeof(struct an_sigcache) * sc->an_sigitems);
1925                         sc->areq.an_len += ((sizeof(struct an_sigcache) *
1926                             sc->an_sigitems) / 2) + 1;
1927                 } else
1928 #endif
1929                 if (an_read_record(sc, (struct an_ltv_gen *)&sc->areq)) {
1930                         error = EINVAL;
1931                         break;
1932                 }
1933                 error = copyout(&sc->areq, ifr->ifr_data, sizeof(sc->areq));
1934                 break;
1935         case SIOCSAIRONET:
1936                 if ((error = suser_cred(cr, NULL_CRED_OKAY)))
1937                         goto out;
1938                 error = copyin(ifr->ifr_data, &sc->areq, sizeof(sc->areq));
1939                 if (error != 0)
1940                         break;
1941                 an_setdef(sc, &sc->areq);
1942                 break;
1943         case SIOCGPRIVATE_0:              /* used by Cisco client utility */
1944                 if ((error = suser_cred(cr, NULL_CRED_OKAY)))
1945                         goto out;
1946                 copyin(ifr->ifr_data, &l_ioctl, sizeof(l_ioctl));
1947                 mode = l_ioctl.command;
1948
1949                 if (mode >= AIROGCAP && mode <= AIROGSTATSD32) {
1950                         error = readrids(ifp, &l_ioctl);
1951                 } else if (mode >= AIROPCAP && mode <= AIROPLEAPUSR) {
1952                         error = writerids(ifp, &l_ioctl);
1953                 } else if (mode >= AIROFLSHRST && mode <= AIRORESTART) {
1954                         error = flashcard(ifp, &l_ioctl);
1955                 } else {
1956                         error =-1;
1957                 }
1958
1959                 /* copy out the updated command info */
1960                 copyout(&l_ioctl, ifr->ifr_data, sizeof(l_ioctl));
1961
1962                 break;
1963         case SIOCGPRIVATE_1:              /* used by Cisco client utility */
1964                 if ((error = suser_cred(cr, NULL_CRED_OKAY)))
1965                         goto out;
1966                 copyin(ifr->ifr_data, &l_ioctl, sizeof(l_ioctl));
1967                 l_ioctl.command = 0;
1968                 error = AIROMAGIC;
1969                 copyout(&error, l_ioctl.data, sizeof(error));
1970                 error = 0;
1971                 break;
1972         case SIOCG80211:
1973                 sc->areq.an_len = sizeof(sc->areq);
1974                 /* was that a good idea DJA we are doing a short-cut */
1975                 switch (ireq->i_type) {
1976                 case IEEE80211_IOC_SSID:
1977                         if (ireq->i_val == -1) {
1978                                 sc->areq.an_type = AN_RID_STATUS;
1979                                 if (an_read_record(sc,
1980                                     (struct an_ltv_gen *)&sc->areq)) {
1981                                         error = EINVAL;
1982                                         break;
1983                                 }
1984                                 len = status->an_ssidlen;
1985                                 tmpptr = status->an_ssid;
1986                         } else if (ireq->i_val >= 0) {
1987                                 sc->areq.an_type = AN_RID_SSIDLIST;
1988                                 if (an_read_record(sc,
1989                                     (struct an_ltv_gen *)&sc->areq)) {
1990                                         error = EINVAL;
1991                                         break;
1992                                 }
1993                                 if (ireq->i_val == 0) {
1994                                         len = ssids->an_ssid1_len;
1995                                         tmpptr = ssids->an_ssid1;
1996                                 } else if (ireq->i_val == 1) {
1997                                         len = ssids->an_ssid2_len;
1998                                         tmpptr = ssids->an_ssid2;
1999                                 } else if (ireq->i_val == 2) {
2000                                         len = ssids->an_ssid3_len;
2001                                         tmpptr = ssids->an_ssid3;
2002                                 } else {
2003                                         error = EINVAL;
2004                                         break;
2005                                 }
2006                         } else {
2007                                 error = EINVAL;
2008                                 break;
2009                         }
2010                         if (len > IEEE80211_NWID_LEN) {
2011                                 error = EINVAL;
2012                                 break;
2013                         }
2014                         ireq->i_len = len;
2015                         bzero(tmpstr, IEEE80211_NWID_LEN);
2016                         bcopy(tmpptr, tmpstr, len);
2017                         error = copyout(tmpstr, ireq->i_data,
2018                             IEEE80211_NWID_LEN);
2019                         break;
2020                 case IEEE80211_IOC_NUMSSIDS:
2021                         ireq->i_val = 3;
2022                         break;
2023                 case IEEE80211_IOC_WEP:
2024                         sc->areq.an_type = AN_RID_ACTUALCFG;
2025                         if (an_read_record(sc,
2026                             (struct an_ltv_gen *)&sc->areq)) {
2027                                 error = EINVAL;
2028                                 break;
2029                         }
2030                         if (config->an_authtype & AN_AUTHTYPE_PRIVACY_IN_USE) {
2031                                 if (config->an_authtype &
2032                                     AN_AUTHTYPE_ALLOW_UNENCRYPTED)
2033                                         ireq->i_val = IEEE80211_WEP_MIXED;
2034                                 else
2035                                         ireq->i_val = IEEE80211_WEP_ON;
2036                         } else {
2037                                 ireq->i_val = IEEE80211_WEP_OFF;
2038                         }
2039                         break;
2040                 case IEEE80211_IOC_WEPKEY:
2041                         /*
2042                          * XXX: I'm not entierly convinced this is
2043                          * correct, but it's what is implemented in
2044                          * ancontrol so it will have to do until we get
2045                          * access to actual Cisco code.
2046                          */
2047                         if (ireq->i_val < 0 || ireq->i_val > 8) {
2048                                 error = EINVAL;
2049                                 break;
2050                         }
2051                         len = 0;
2052                         if (ireq->i_val < 5) {
2053                                 sc->areq.an_type = AN_RID_WEP_TEMP;
2054                                 for (i = 0; i < 5; i++) {
2055                                         if (an_read_record(sc,
2056                                             (struct an_ltv_gen *)&sc->areq)) {
2057                                                 error = EINVAL;
2058                                                 break;
2059                                         }
2060                                         if (key->kindex == 0xffff)
2061                                                 break;
2062                                         if (key->kindex == ireq->i_val)
2063                                                 len = key->klen;
2064                                         /* Required to get next entry */
2065                                         sc->areq.an_type = AN_RID_WEP_PERM;
2066                                 }
2067                                 if (error != 0)
2068                                         break;
2069                         }
2070                         /* We aren't allowed to read the value of the
2071                          * key from the card so we just output zeros
2072                          * like we would if we could read the card, but
2073                          * denied the user access.
2074                          */
2075                         bzero(tmpstr, len);
2076                         ireq->i_len = len;
2077                         error = copyout(tmpstr, ireq->i_data, len);
2078                         break;
2079                 case IEEE80211_IOC_NUMWEPKEYS:
2080                         ireq->i_val = 9; /* include home key */
2081                         break;
2082                 case IEEE80211_IOC_WEPTXKEY:
2083                         /*
2084                          * For some strange reason, you have to read all
2085                          * keys before you can read the txkey.
2086                          */
2087                         sc->areq.an_type = AN_RID_WEP_TEMP;
2088                         for (i = 0; i < 5; i++) {
2089                                 if (an_read_record(sc,
2090                                     (struct an_ltv_gen *) &sc->areq)) {
2091                                         error = EINVAL;
2092                                         break;
2093                                 }
2094                                 if (key->kindex == 0xffff)
2095                                         break;
2096                                 /* Required to get next entry */
2097                                 sc->areq.an_type = AN_RID_WEP_PERM;
2098                         }
2099                         if (error != 0)
2100                                 break;
2101
2102                         sc->areq.an_type = AN_RID_WEP_PERM;
2103                         key->kindex = 0xffff;
2104                         if (an_read_record(sc,
2105                             (struct an_ltv_gen *)&sc->areq)) {
2106                                 error = EINVAL;
2107                                 break;
2108                         }
2109                         ireq->i_val = key->mac[0];
2110                         /*
2111                          * Check for home mode.  Map home mode into
2112                          * 5th key since that is how it is stored on
2113                          * the card
2114                          */
2115                         sc->areq.an_len  = sizeof(struct an_ltv_genconfig);
2116                         sc->areq.an_type = AN_RID_GENCONFIG;
2117                         if (an_read_record(sc,
2118                             (struct an_ltv_gen *)&sc->areq)) {
2119                                 error = EINVAL;
2120                                 break;
2121                         }
2122                         if (config->an_home_product & AN_HOME_NETWORK)
2123                                 ireq->i_val = 4;
2124                         break;
2125                 case IEEE80211_IOC_AUTHMODE:
2126                         sc->areq.an_type = AN_RID_ACTUALCFG;
2127                         if (an_read_record(sc,
2128                             (struct an_ltv_gen *)&sc->areq)) {
2129                                 error = EINVAL;
2130                                 break;
2131                         }
2132                         if ((config->an_authtype & AN_AUTHTYPE_MASK) ==
2133                             AN_AUTHTYPE_NONE) {
2134                             ireq->i_val = IEEE80211_AUTH_NONE;
2135                         } else if ((config->an_authtype & AN_AUTHTYPE_MASK) ==
2136                             AN_AUTHTYPE_OPEN) {
2137                             ireq->i_val = IEEE80211_AUTH_OPEN;
2138                         } else if ((config->an_authtype & AN_AUTHTYPE_MASK) ==
2139                             AN_AUTHTYPE_SHAREDKEY) {
2140                             ireq->i_val = IEEE80211_AUTH_SHARED;
2141                         } else
2142                                 error = EINVAL;
2143                         break;
2144                 case IEEE80211_IOC_STATIONNAME:
2145                         sc->areq.an_type = AN_RID_ACTUALCFG;
2146                         if (an_read_record(sc,
2147                             (struct an_ltv_gen *)&sc->areq)) {
2148                                 error = EINVAL;
2149                                 break;
2150                         }
2151                         ireq->i_len = sizeof(config->an_nodename);
2152                         tmpptr = config->an_nodename;
2153                         bzero(tmpstr, IEEE80211_NWID_LEN);
2154                         bcopy(tmpptr, tmpstr, ireq->i_len);
2155                         error = copyout(tmpstr, ireq->i_data,
2156                             IEEE80211_NWID_LEN);
2157                         break;
2158                 case IEEE80211_IOC_CHANNEL:
2159                         sc->areq.an_type = AN_RID_STATUS;
2160                         if (an_read_record(sc,
2161                             (struct an_ltv_gen *)&sc->areq)) {
2162                                 error = EINVAL;
2163                                 break;
2164                         }
2165                         ireq->i_val = status->an_cur_channel;
2166                         break;
2167                 case IEEE80211_IOC_POWERSAVE:
2168                         sc->areq.an_type = AN_RID_ACTUALCFG;
2169                         if (an_read_record(sc,
2170                             (struct an_ltv_gen *)&sc->areq)) {
2171                                 error = EINVAL;
2172                                 break;
2173                         }
2174                         if (config->an_psave_mode == AN_PSAVE_NONE) {
2175                                 ireq->i_val = IEEE80211_POWERSAVE_OFF;
2176                         } else if (config->an_psave_mode == AN_PSAVE_CAM) {
2177                                 ireq->i_val = IEEE80211_POWERSAVE_CAM;
2178                         } else if (config->an_psave_mode == AN_PSAVE_PSP) {
2179                                 ireq->i_val = IEEE80211_POWERSAVE_PSP;
2180                         } else if (config->an_psave_mode == AN_PSAVE_PSP_CAM) {
2181                                 ireq->i_val = IEEE80211_POWERSAVE_PSP_CAM;
2182                         } else
2183                                 error = EINVAL;
2184                         break;
2185                 case IEEE80211_IOC_POWERSAVESLEEP:
2186                         sc->areq.an_type = AN_RID_ACTUALCFG;
2187                         if (an_read_record(sc,
2188                             (struct an_ltv_gen *)&sc->areq)) {
2189                                 error = EINVAL;
2190                                 break;
2191                         }
2192                         ireq->i_val = config->an_listen_interval;
2193                         break;
2194                 }
2195                 break;
2196         case SIOCS80211:
2197                 if ((error = suser_cred(cr, NULL_CRED_OKAY)))
2198                         goto out;
2199                 sc->areq.an_len = sizeof(sc->areq);
2200                 /*
2201                  * We need a config structure for everything but the WEP
2202                  * key management and SSIDs so we get it now so avoid
2203                  * duplicating this code every time.
2204                  */
2205                 if (ireq->i_type != IEEE80211_IOC_SSID &&
2206                     ireq->i_type != IEEE80211_IOC_WEPKEY &&
2207                     ireq->i_type != IEEE80211_IOC_WEPTXKEY) {
2208                         sc->areq.an_type = AN_RID_GENCONFIG;
2209                         if (an_read_record(sc,
2210                             (struct an_ltv_gen *)&sc->areq)) {
2211                                 error = EINVAL;
2212                                 break;
2213                         }
2214                 }
2215                 switch (ireq->i_type) {
2216                 case IEEE80211_IOC_SSID:
2217                         sc->areq.an_type = AN_RID_SSIDLIST;
2218                         if (an_read_record(sc,
2219                             (struct an_ltv_gen *)&sc->areq)) {
2220                                 error = EINVAL;
2221                                 break;
2222                         }
2223                         if (ireq->i_len > IEEE80211_NWID_LEN) {
2224                                 error = EINVAL;
2225                                 break;
2226                         }
2227                         switch (ireq->i_val) {
2228                         case 0:
2229                                 error = copyin(ireq->i_data,
2230                                     ssids->an_ssid1, ireq->i_len);
2231                                 ssids->an_ssid1_len = ireq->i_len;
2232                                 break;
2233                         case 1:
2234                                 error = copyin(ireq->i_data,
2235                                     ssids->an_ssid2, ireq->i_len);
2236                                 ssids->an_ssid2_len = ireq->i_len;
2237                                 break;
2238                         case 2:
2239                                 error = copyin(ireq->i_data,
2240                                     ssids->an_ssid3, ireq->i_len);
2241                                 ssids->an_ssid3_len = ireq->i_len;
2242                                 break;
2243                         default:
2244                                 error = EINVAL;
2245                                 break;
2246                         }
2247                         break;
2248                 case IEEE80211_IOC_WEP:
2249                         switch (ireq->i_val) {
2250                         case IEEE80211_WEP_OFF:
2251                                 config->an_authtype &=
2252                                     ~(AN_AUTHTYPE_PRIVACY_IN_USE |
2253                                     AN_AUTHTYPE_ALLOW_UNENCRYPTED);
2254                                 break;
2255                         case IEEE80211_WEP_ON:
2256                                 config->an_authtype |=
2257                                     AN_AUTHTYPE_PRIVACY_IN_USE;
2258                                 config->an_authtype &=
2259                                     ~AN_AUTHTYPE_ALLOW_UNENCRYPTED;
2260                                 break;
2261                         case IEEE80211_WEP_MIXED:
2262                                 config->an_authtype |=
2263                                     AN_AUTHTYPE_PRIVACY_IN_USE |
2264                                     AN_AUTHTYPE_ALLOW_UNENCRYPTED;
2265                                 break;
2266                         default:
2267                                 error = EINVAL;
2268                                 break;
2269                         }
2270                         break;
2271                 case IEEE80211_IOC_WEPKEY:
2272                         if (ireq->i_val < 0 || ireq->i_val > 8 ||
2273                             ireq->i_len > 13) {
2274                                 error = EINVAL;
2275                                 break;
2276                         }
2277                         error = copyin(ireq->i_data, tmpstr, 13);
2278                         if (error != 0)
2279                                 break;
2280                         /*
2281                          * Map the 9th key into the home mode
2282                          * since that is how it is stored on
2283                          * the card
2284                          */
2285                         bzero(&sc->areq, sizeof(struct an_ltv_key));
2286                         sc->areq.an_len = sizeof(struct an_ltv_key);
2287                         key->mac[0] = 1;        /* The others are 0. */
2288                         if (ireq->i_val < 4) {
2289                                 sc->areq.an_type = AN_RID_WEP_TEMP;
2290                                 key->kindex = ireq->i_val;
2291                         } else {
2292                                 sc->areq.an_type = AN_RID_WEP_PERM;
2293                                 key->kindex = ireq->i_val - 4;
2294                         }
2295                         key->klen = ireq->i_len;
2296                         bcopy(tmpstr, key->key, key->klen);
2297                         break;
2298                 case IEEE80211_IOC_WEPTXKEY:
2299                         if (ireq->i_val < 0 || ireq->i_val > 4) {
2300                                 error = EINVAL;
2301                                 break;
2302                         }
2303
2304                         /*
2305                          * Map the 5th key into the home mode
2306                          * since that is how it is stored on
2307                          * the card
2308                          */
2309                         sc->areq.an_len  = sizeof(struct an_ltv_genconfig);
2310                         sc->areq.an_type = AN_RID_ACTUALCFG;
2311                         if (an_read_record(sc,
2312                             (struct an_ltv_gen *)&sc->areq)) {
2313                                 error = EINVAL;
2314                                 break;
2315                         }
2316                         if (ireq->i_val ==  4) {
2317                                 config->an_home_product |= AN_HOME_NETWORK;
2318                                 ireq->i_val = 0;
2319                         } else {
2320                                 config->an_home_product &= ~AN_HOME_NETWORK;
2321                         }
2322
2323                         sc->an_config.an_home_product
2324                                 = config->an_home_product;
2325
2326                         /* update configuration */
2327                         an_init(sc);
2328
2329                         bzero(&sc->areq, sizeof(struct an_ltv_key));
2330                         sc->areq.an_len = sizeof(struct an_ltv_key);
2331                         sc->areq.an_type = AN_RID_WEP_PERM;
2332                         key->kindex = 0xffff;
2333                         key->mac[0] = ireq->i_val;
2334                         break;
2335                 case IEEE80211_IOC_AUTHMODE:
2336                         switch (ireq->i_val) {
2337                         case IEEE80211_AUTH_NONE:
2338                                 config->an_authtype = AN_AUTHTYPE_NONE |
2339                                     (config->an_authtype & ~AN_AUTHTYPE_MASK);
2340                                 break;
2341                         case IEEE80211_AUTH_OPEN:
2342                                 config->an_authtype = AN_AUTHTYPE_OPEN |
2343                                     (config->an_authtype & ~AN_AUTHTYPE_MASK);
2344                                 break;
2345                         case IEEE80211_AUTH_SHARED:
2346                                 config->an_authtype = AN_AUTHTYPE_SHAREDKEY |
2347                                     (config->an_authtype & ~AN_AUTHTYPE_MASK);
2348                                 break;
2349                         default:
2350                                 error = EINVAL;
2351                         }
2352                         break;
2353                 case IEEE80211_IOC_STATIONNAME:
2354                         if (ireq->i_len > 16) {
2355                                 error = EINVAL;
2356                                 break;
2357                         }
2358                         bzero(config->an_nodename, 16);
2359                         error = copyin(ireq->i_data,
2360                             config->an_nodename, ireq->i_len);
2361                         break;
2362                 case IEEE80211_IOC_CHANNEL:
2363                         /*
2364                          * The actual range is 1-14, but if you set it
2365                          * to 0 you get the default so we let that work
2366                          * too.
2367                          */
2368                         if (ireq->i_val < 0 || ireq->i_val >14) {
2369                                 error = EINVAL;
2370                                 break;
2371                         }
2372                         config->an_ds_channel = ireq->i_val;
2373                         break;
2374                 case IEEE80211_IOC_POWERSAVE:
2375                         switch (ireq->i_val) {
2376                         case IEEE80211_POWERSAVE_OFF:
2377                                 config->an_psave_mode = AN_PSAVE_NONE;
2378                                 break;
2379                         case IEEE80211_POWERSAVE_CAM:
2380                                 config->an_psave_mode = AN_PSAVE_CAM;
2381                                 break;
2382                         case IEEE80211_POWERSAVE_PSP:
2383                                 config->an_psave_mode = AN_PSAVE_PSP;
2384                                 break;
2385                         case IEEE80211_POWERSAVE_PSP_CAM:
2386                                 config->an_psave_mode = AN_PSAVE_PSP_CAM;
2387                                 break;
2388                         default:
2389                                 error = EINVAL;
2390                                 break;
2391                         }
2392                         break;
2393                 case IEEE80211_IOC_POWERSAVESLEEP:
2394                         config->an_listen_interval = ireq->i_val;
2395                         break;
2396                 }
2397
2398                 if (!error)
2399                         an_setdef(sc, &sc->areq);
2400                 break;
2401         default:
2402                 error = EINVAL;
2403                 break;
2404         }
2405 out:
2406         splx(s);
2407
2408         return(error != 0);
2409 }
2410
2411 static int
2412 an_init_tx_ring(sc)
2413         struct an_softc         *sc;
2414 {
2415         int                     i;
2416         int                     id;
2417
2418         if (sc->an_gone)
2419                 return (0);
2420
2421         if (!sc->mpi350) {
2422                 for (i = 0; i < AN_TX_RING_CNT; i++) {
2423                         if (an_alloc_nicmem(sc, 1518 +
2424                             0x44, &id))
2425                                 return(ENOMEM);
2426                         sc->an_rdata.an_tx_fids[i] = id;
2427                         sc->an_rdata.an_tx_ring[i] = 0;
2428                 }
2429         }
2430
2431         sc->an_rdata.an_tx_prod = 0;
2432         sc->an_rdata.an_tx_cons = 0;
2433         sc->an_rdata.an_tx_empty = 1;
2434
2435         return(0);
2436 }
2437
2438 static void
2439 an_init(xsc)
2440         void                    *xsc;
2441 {
2442         struct an_softc         *sc = xsc;
2443         struct ifnet            *ifp = &sc->arpcom.ac_if;
2444         int                     s;
2445
2446         s = splimp();
2447
2448         if (sc->an_gone) {
2449                 splx(s);
2450                 return;
2451         }
2452
2453         if (ifp->if_flags & IFF_RUNNING)
2454                 an_stop(sc);
2455
2456         sc->an_associated = 0;
2457
2458         /* Allocate the TX buffers */
2459         if (an_init_tx_ring(sc)) {
2460                 an_reset(sc);
2461                 if (sc->mpi350)
2462                         an_init_mpi350_desc(sc);
2463                 if (an_init_tx_ring(sc)) {
2464                         printf("an%d: tx buffer allocation "
2465                             "failed\n", sc->an_unit);
2466                         splx(s);
2467                         return;
2468                 }
2469         }
2470
2471         /* Set our MAC address. */
2472         bcopy((char *)&sc->arpcom.ac_enaddr,
2473             (char *)&sc->an_config.an_macaddr, ETHER_ADDR_LEN);
2474
2475         if (ifp->if_flags & IFF_BROADCAST)
2476                 sc->an_config.an_rxmode = AN_RXMODE_BC_ADDR;
2477         else
2478                 sc->an_config.an_rxmode = AN_RXMODE_ADDR;
2479
2480         if (ifp->if_flags & IFF_MULTICAST)
2481                 sc->an_config.an_rxmode = AN_RXMODE_BC_MC_ADDR;
2482
2483         if (ifp->if_flags & IFF_PROMISC) {
2484                 if (sc->an_monitor & AN_MONITOR) {
2485                         if (sc->an_monitor & AN_MONITOR_ANY_BSS) {
2486                                 sc->an_config.an_rxmode |=
2487                                     AN_RXMODE_80211_MONITOR_ANYBSS |
2488                                     AN_RXMODE_NO_8023_HEADER;
2489                         } else {
2490                                 sc->an_config.an_rxmode |=
2491                                     AN_RXMODE_80211_MONITOR_CURBSS |
2492                                     AN_RXMODE_NO_8023_HEADER;
2493                         }
2494                 }
2495         }
2496
2497         if (sc->an_have_rssimap)
2498                 sc->an_config.an_rxmode |= AN_RXMODE_NORMALIZED_RSSI;
2499
2500         /* Set the ssid list */
2501         sc->an_ssidlist.an_type = AN_RID_SSIDLIST;
2502         sc->an_ssidlist.an_len = sizeof(struct an_ltv_ssidlist);
2503         if (an_write_record(sc, (struct an_ltv_gen *)&sc->an_ssidlist)) {
2504                 printf("an%d: failed to set ssid list\n", sc->an_unit);
2505                 splx(s);
2506                 return;
2507         }
2508
2509         /* Set the AP list */
2510         sc->an_aplist.an_type = AN_RID_APLIST;
2511         sc->an_aplist.an_len = sizeof(struct an_ltv_aplist);
2512         if (an_write_record(sc, (struct an_ltv_gen *)&sc->an_aplist)) {
2513                 printf("an%d: failed to set AP list\n", sc->an_unit);
2514                 splx(s);
2515                 return;
2516         }
2517
2518         /* Set the configuration in the NIC */
2519         sc->an_config.an_len = sizeof(struct an_ltv_genconfig);
2520         sc->an_config.an_type = AN_RID_GENCONFIG;
2521         if (an_write_record(sc, (struct an_ltv_gen *)&sc->an_config)) {
2522                 printf("an%d: failed to set configuration\n", sc->an_unit);
2523                 splx(s);
2524                 return;
2525         }
2526
2527         /* Enable the MAC */
2528         if (an_cmd(sc, AN_CMD_ENABLE, 0)) {
2529                 printf("an%d: failed to enable MAC\n", sc->an_unit);
2530                 splx(s);
2531                 return;
2532         }
2533
2534         if (ifp->if_flags & IFF_PROMISC)
2535                 an_cmd(sc, AN_CMD_SET_MODE, 0xffff);
2536
2537         /* enable interrupts */
2538         CSR_WRITE_2(sc, AN_INT_EN(sc->mpi350), AN_INTRS);
2539
2540         ifp->if_flags |= IFF_RUNNING;
2541         ifp->if_flags &= ~IFF_OACTIVE;
2542
2543         sc->an_stat_ch = timeout(an_stats_update, sc, hz);
2544         splx(s);
2545
2546         return;
2547 }
2548
2549 static void
2550 an_start(ifp)
2551         struct ifnet            *ifp;
2552 {
2553         struct an_softc         *sc;
2554         struct mbuf             *m0 = NULL;
2555         struct an_txframe_802_3 tx_frame_802_3;
2556         struct ether_header     *eh;
2557         int                     id, idx, i;
2558         unsigned char           txcontrol;
2559         struct an_card_tx_desc an_tx_desc;
2560         u_int8_t                *ptr;
2561         u_int8_t                *buf;
2562
2563         sc = ifp->if_softc;
2564
2565         if (sc->an_gone)
2566                 return;
2567
2568         if (ifp->if_flags & IFF_OACTIVE)
2569                 return;
2570
2571         if (!sc->an_associated)
2572                 return;
2573
2574         /* We can't send in monitor mode so toss any attempts. */
2575         if (sc->an_monitor && (ifp->if_flags & IFF_PROMISC)) {
2576                 for (;;) {
2577                         IF_DEQUEUE(&ifp->if_snd, m0);
2578                         if (m0 == NULL)
2579                                 break;
2580                         m_freem(m0);
2581                 }
2582                 return;
2583         }
2584
2585         idx = sc->an_rdata.an_tx_prod;
2586
2587         if (!sc->mpi350) {
2588                 bzero((char *)&tx_frame_802_3, sizeof(tx_frame_802_3));
2589
2590                 while (sc->an_rdata.an_tx_ring[idx] == 0) {
2591                         IF_DEQUEUE(&ifp->if_snd, m0);
2592                         if (m0 == NULL)
2593                                 break;
2594
2595                         id = sc->an_rdata.an_tx_fids[idx];
2596                         eh = mtod(m0, struct ether_header *);
2597
2598                         bcopy((char *)&eh->ether_dhost,
2599                               (char *)&tx_frame_802_3.an_tx_dst_addr,
2600                               ETHER_ADDR_LEN);
2601                         bcopy((char *)&eh->ether_shost,
2602                               (char *)&tx_frame_802_3.an_tx_src_addr,
2603                               ETHER_ADDR_LEN);
2604
2605                         /* minus src/dest mac & type */
2606                         tx_frame_802_3.an_tx_802_3_payload_len =
2607                                 m0->m_pkthdr.len - 12;
2608
2609                         m_copydata(m0, sizeof(struct ether_header) - 2 ,
2610                                    tx_frame_802_3.an_tx_802_3_payload_len,
2611                                    (caddr_t)&sc->an_txbuf);
2612
2613                         txcontrol = AN_TXCTL_8023;
2614                         /* write the txcontrol only */
2615                         an_write_data(sc, id, 0x08, (caddr_t)&txcontrol,
2616                                       sizeof(txcontrol));
2617
2618                         /* 802_3 header */
2619                         an_write_data(sc, id, 0x34, (caddr_t)&tx_frame_802_3,
2620                                       sizeof(struct an_txframe_802_3));
2621
2622                         /* in mbuf header type is just before payload */
2623                         an_write_data(sc, id, 0x44, (caddr_t)&sc->an_txbuf,
2624                                       tx_frame_802_3.an_tx_802_3_payload_len);
2625
2626                         /*
2627                          * If there's a BPF listner, bounce a copy of
2628                          * this frame to him.
2629                          */
2630                         if (ifp->if_bpf)
2631                                 bpf_mtap(ifp, m0);
2632
2633                         m_freem(m0);
2634                         m0 = NULL;
2635
2636                         sc->an_rdata.an_tx_ring[idx] = id;
2637                         if (an_cmd(sc, AN_CMD_TX, id))
2638                                 printf("an%d: xmit failed\n", sc->an_unit);
2639
2640                         AN_INC(idx, AN_TX_RING_CNT);
2641                 }
2642         } else { /* MPI-350 */
2643                 while (sc->an_rdata.an_tx_empty ||
2644                     idx != sc->an_rdata.an_tx_cons) {
2645                         IF_DEQUEUE(&ifp->if_snd, m0);
2646                         if (m0 == NULL) {
2647                                 break;
2648                         }
2649                         buf = sc->an_tx_buffer[idx].an_dma_vaddr;
2650
2651                         eh = mtod(m0, struct ether_header *);
2652
2653                         /* DJA optimize this to limit bcopy */
2654                         bcopy((char *)&eh->ether_dhost,
2655                               (char *)&tx_frame_802_3.an_tx_dst_addr,
2656                               ETHER_ADDR_LEN);
2657                         bcopy((char *)&eh->ether_shost,
2658                               (char *)&tx_frame_802_3.an_tx_src_addr,
2659                               ETHER_ADDR_LEN);
2660
2661                         /* minus src/dest mac & type */
2662                         tx_frame_802_3.an_tx_802_3_payload_len =
2663                                 m0->m_pkthdr.len - 12;
2664
2665                         m_copydata(m0, sizeof(struct ether_header) - 2 ,
2666                                    tx_frame_802_3.an_tx_802_3_payload_len,
2667                                    (caddr_t)&sc->an_txbuf);
2668
2669                         txcontrol = AN_TXCTL_8023;
2670                         /* write the txcontrol only */
2671                         bcopy((caddr_t)&txcontrol, &buf[0x08],
2672                               sizeof(txcontrol));
2673
2674                         /* 802_3 header */
2675                         bcopy((caddr_t)&tx_frame_802_3, &buf[0x34],
2676                               sizeof(struct an_txframe_802_3));
2677
2678                         /* in mbuf header type is just before payload */
2679                         bcopy((caddr_t)&sc->an_txbuf, &buf[0x44],
2680                               tx_frame_802_3.an_tx_802_3_payload_len);
2681
2682
2683                         bzero(&an_tx_desc, sizeof(an_tx_desc));
2684                         an_tx_desc.an_offset = 0;
2685                         an_tx_desc.an_eoc = 1;
2686                         an_tx_desc.an_valid = 1;
2687                         an_tx_desc.an_len =  0x44 +
2688                                 tx_frame_802_3.an_tx_802_3_payload_len;
2689                         an_tx_desc.an_phys = sc->an_tx_buffer[idx].an_dma_paddr;
2690                         ptr = (u_int8_t*)&an_tx_desc;
2691                         for (i = 0; i < sizeof(an_tx_desc); i++) {
2692                                 CSR_MEM_AUX_WRITE_1(sc, AN_TX_DESC_OFFSET + i,
2693                                                     ptr[i]);
2694                         }
2695
2696                         /*
2697                          * If there's a BPF listner, bounce a copy of
2698                          * this frame to him.
2699                          */
2700                         if (ifp->if_bpf)
2701                                 bpf_mtap(ifp, m0);
2702
2703                         m_freem(m0);
2704                         m0 = NULL;
2705
2706                         CSR_WRITE_2(sc, AN_EVENT_ACK(sc->mpi350), AN_EV_ALLOC);
2707
2708                         AN_INC(idx, AN_MAX_TX_DESC);
2709                         sc->an_rdata.an_tx_empty = 0;
2710                 }
2711         }
2712
2713         if (m0 != NULL)
2714                 ifp->if_flags |= IFF_OACTIVE;
2715
2716         sc->an_rdata.an_tx_prod = idx;
2717
2718         /*
2719          * Set a timeout in case the chip goes out to lunch.
2720          */
2721         ifp->if_timer = 5;
2722
2723         return;
2724 }
2725
2726 void
2727 an_stop(sc)
2728         struct an_softc         *sc;
2729 {
2730         struct ifnet            *ifp;
2731         int                     i;
2732         int                     s;
2733
2734         s = splimp();
2735
2736         if (sc->an_gone) {
2737                 splx(s);
2738                 return;
2739         }
2740
2741         ifp = &sc->arpcom.ac_if;
2742
2743         an_cmd(sc, AN_CMD_FORCE_SYNCLOSS, 0);
2744         CSR_WRITE_2(sc, AN_INT_EN(sc->mpi350), 0);
2745         an_cmd(sc, AN_CMD_DISABLE, 0);
2746
2747         for (i = 0; i < AN_TX_RING_CNT; i++)
2748                 an_cmd(sc, AN_CMD_DEALLOC_MEM, sc->an_rdata.an_tx_fids[i]);
2749
2750         untimeout(an_stats_update, sc, sc->an_stat_ch);
2751
2752         ifp->if_flags &= ~(IFF_RUNNING|IFF_OACTIVE);
2753
2754         if (sc->an_flash_buffer) {
2755                 free(sc->an_flash_buffer, M_DEVBUF);
2756                 sc->an_flash_buffer = NULL;
2757         }
2758
2759         splx(s);
2760
2761         return;
2762 }
2763
2764 static void
2765 an_watchdog(ifp)
2766         struct ifnet            *ifp;
2767 {
2768         struct an_softc         *sc;
2769         int                     s;
2770
2771         sc = ifp->if_softc;
2772         s = splimp();
2773
2774         if (sc->an_gone) {
2775                 splx(s);
2776                 return;
2777         }
2778
2779         printf("an%d: device timeout\n", sc->an_unit);
2780
2781         an_reset(sc);
2782         if (sc->mpi350)
2783                 an_init_mpi350_desc(sc);
2784         an_init(sc);
2785
2786         ifp->if_oerrors++;
2787         splx(s);
2788
2789         return;
2790 }
2791
2792 void
2793 an_shutdown(dev)
2794         device_t                dev;
2795 {
2796         struct an_softc         *sc;
2797
2798         sc = device_get_softc(dev);
2799         an_stop(sc);
2800
2801         return;
2802 }
2803
2804 void
2805 an_resume(dev)
2806         device_t                dev;
2807 {
2808         struct an_softc         *sc;
2809         struct ifnet            *ifp;
2810         int                     i;
2811
2812         sc = device_get_softc(dev);
2813         ifp = &sc->arpcom.ac_if;
2814
2815         an_reset(sc);
2816         if (sc->mpi350)
2817                 an_init_mpi350_desc(sc);
2818         an_init(sc);
2819
2820         /* Recovery temporary keys */
2821         for (i = 0; i < 4; i++) {
2822                 sc->areq.an_type = AN_RID_WEP_TEMP;
2823                 sc->areq.an_len = sizeof(struct an_ltv_key);
2824                 bcopy(&sc->an_temp_keys[i],
2825                     &sc->areq, sizeof(struct an_ltv_key));
2826                 an_setdef(sc, &sc->areq);
2827         }
2828
2829         if (ifp->if_flags & IFF_UP)
2830                 an_start(ifp);
2831
2832         return;
2833 }
2834
2835 #ifdef ANCACHE
2836 /* Aironet signal strength cache code.
2837  * store signal/noise/quality on per MAC src basis in
2838  * a small fixed cache.  The cache wraps if > MAX slots
2839  * used.  The cache may be zeroed out to start over.
2840  * Two simple filters exist to reduce computation:
2841  * 1. ip only (literally 0x800, ETHERTYPE_IP) which may be used
2842  * to ignore some packets.  It defaults to ip only.
2843  * it could be used to focus on broadcast, non-IP 802.11 beacons.
2844  * 2. multicast/broadcast only.  This may be used to
2845  * ignore unicast packets and only cache signal strength
2846  * for multicast/broadcast packets (beacons); e.g., Mobile-IP
2847  * beacons and not unicast traffic.
2848  *
2849  * The cache stores (MAC src(index), IP src (major clue), signal,
2850  *      quality, noise)
2851  *
2852  * No apologies for storing IP src here.  It's easy and saves much
2853  * trouble elsewhere.  The cache is assumed to be INET dependent,
2854  * although it need not be.
2855  *
2856  * Note: the Aironet only has a single byte of signal strength value
2857  * in the rx frame header, and it's not scaled to anything sensible.
2858  * This is kind of lame, but it's all we've got.
2859  */
2860
2861 #ifdef documentation
2862
2863 int an_sigitems;                                /* number of cached entries */
2864 struct an_sigcache an_sigcache[MAXANCACHE];  /*  array of cache entries */
2865 int an_nextitem;                                /*  index/# of entries */
2866
2867
2868 #endif
2869
2870 /* control variables for cache filtering.  Basic idea is
2871  * to reduce cost (e.g., to only Mobile-IP agent beacons
2872  * which are broadcast or multicast).  Still you might
2873  * want to measure signal strength anth unicast ping packets
2874  * on a pt. to pt. ant. setup.
2875  */
2876 /* set true if you want to limit cache items to broadcast/mcast
2877  * only packets (not unicast).  Useful for mobile-ip beacons which
2878  * are broadcast/multicast at network layer.  Default is all packets
2879  * so ping/unicast anll work say anth pt. to pt. antennae setup.
2880  */
2881 static int an_cache_mcastonly = 0;
2882 SYSCTL_INT(_hw_an, OID_AUTO, an_cache_mcastonly, CTLFLAG_RW,
2883         &an_cache_mcastonly, 0, "");
2884
2885 /* set true if you want to limit cache items to IP packets only
2886 */
2887 static int an_cache_iponly = 1;
2888 SYSCTL_INT(_hw_an, OID_AUTO, an_cache_iponly, CTLFLAG_RW,
2889         &an_cache_iponly, 0, "");
2890
2891 /*
2892  * an_cache_store, per rx packet store signal
2893  * strength in MAC (src) indexed cache.
2894  */
2895 static void
2896 an_cache_store (sc, m, rx_rssi, rx_quality)
2897         struct an_softc *sc;
2898         struct mbuf *m;
2899         u_int8_t rx_rssi;
2900         u_int8_t rx_quality;
2901 {
2902         struct ether_header *eh = mtod(m, struct ether_header *);
2903         struct ip *ip = NULL;
2904         int i;
2905         static int cache_slot = 0;      /* use this cache entry */
2906         static int wrapindex = 0;       /* next "free" cache entry */
2907
2908         /* filters:
2909          * 1. ip only
2910          * 2. configurable filter to throw out unicast packets,
2911          * keep multicast only.
2912          */
2913
2914         if ((ntohs(eh->ether_type) == ETHERTYPE_IP))
2915                 ip = (struct ip *)(mtod(m, uint8_t *) + ETHER_HDR_LEN);
2916         else if (an_cache_iponly)
2917                 return;
2918
2919         /* filter for broadcast/multicast only
2920          */
2921         if (an_cache_mcastonly && ((eh->ether_dhost[0] & 1) == 0)) {
2922                 return;
2923         }
2924
2925 #ifdef SIGDEBUG
2926         printf("an: q value %x (MSB=0x%x, LSB=0x%x) \n",
2927                 rx_rssi & 0xffff, rx_rssi >> 8, rx_rssi & 0xff);
2928 #endif
2929
2930         /* do a linear search for a matching MAC address
2931          * in the cache table
2932          * . MAC address is 6 bytes,
2933          * . var w_nextitem holds total number of entries already cached
2934          */
2935         for (i = 0; i < sc->an_nextitem; i++) {
2936                 if (! bcmp(eh->ether_shost , sc->an_sigcache[i].macsrc,  6 )) {
2937                         /* Match!,
2938                          * so we already have this entry,
2939                          * update the data
2940                          */
2941                         break;
2942                 }
2943         }
2944
2945         /* did we find a matching mac address?
2946          * if yes, then overwrite a previously existing cache entry
2947          */
2948         if (i < sc->an_nextitem )   {
2949                 cache_slot = i;
2950         }
2951         /* else, have a new address entry,so
2952          * add this new entry,
2953          * if table full, then we need to replace LRU entry
2954          */
2955         else    {
2956
2957                 /* check for space in cache table
2958                  * note: an_nextitem also holds number of entries
2959                  * added in the cache table
2960                  */
2961                 if ( sc->an_nextitem < MAXANCACHE ) {
2962                         cache_slot = sc->an_nextitem;
2963                         sc->an_nextitem++;
2964                         sc->an_sigitems = sc->an_nextitem;
2965                 }
2966                 /* no space found, so simply wrap anth wrap index
2967                  * and "zap" the next entry
2968                  */
2969                 else {
2970                         if (wrapindex == MAXANCACHE) {
2971                                 wrapindex = 0;
2972                         }
2973                         cache_slot = wrapindex++;
2974                 }
2975         }
2976
2977         /* invariant: cache_slot now points at some slot
2978          * in cache.
2979          */
2980         if (cache_slot < 0 || cache_slot >= MAXANCACHE) {
2981                 log(LOG_ERR, "an_cache_store, bad index: %d of "
2982                     "[0..%d], gross cache error\n",
2983                     cache_slot, MAXANCACHE);
2984                 return;
2985         }
2986
2987         /*  store items in cache
2988          *  .ip source address
2989          *  .mac src
2990          *  .signal, etc.
2991          */
2992         if (ip != NULL) {
2993                 sc->an_sigcache[cache_slot].ipsrc = ip->ip_src.s_addr;
2994         }
2995         bcopy( eh->ether_shost, sc->an_sigcache[cache_slot].macsrc,  6);
2996
2997
2998         switch (an_cache_mode) {
2999         case DBM:
3000                 if (sc->an_have_rssimap) {
3001                         sc->an_sigcache[cache_slot].signal =
3002                                 - sc->an_rssimap.an_entries[rx_rssi].an_rss_dbm;
3003                         sc->an_sigcache[cache_slot].quality =
3004                                 - sc->an_rssimap.an_entries[rx_quality].an_rss_dbm;
3005                 } else {
3006                         sc->an_sigcache[cache_slot].signal = rx_rssi - 100;
3007                         sc->an_sigcache[cache_slot].quality = rx_quality - 100;
3008                 }
3009                 break;
3010         case PERCENT:
3011                 if (sc->an_have_rssimap) {
3012                         sc->an_sigcache[cache_slot].signal =
3013                                 sc->an_rssimap.an_entries[rx_rssi].an_rss_pct;
3014                         sc->an_sigcache[cache_slot].quality =
3015                                 sc->an_rssimap.an_entries[rx_quality].an_rss_pct;
3016                 } else {
3017                         if (rx_rssi > 100)
3018                                 rx_rssi = 100;
3019                         if (rx_quality > 100)
3020                                 rx_quality = 100;
3021                         sc->an_sigcache[cache_slot].signal = rx_rssi;
3022                         sc->an_sigcache[cache_slot].quality = rx_quality;
3023                 }
3024                 break;
3025         case RAW:
3026                 sc->an_sigcache[cache_slot].signal = rx_rssi;
3027                 sc->an_sigcache[cache_slot].quality = rx_quality;
3028                 break;
3029         }
3030
3031         sc->an_sigcache[cache_slot].noise = 0;
3032
3033         return;
3034 }
3035 #endif
3036
3037 static int
3038 an_media_change(ifp)
3039         struct ifnet            *ifp;
3040 {
3041         struct an_softc *sc = ifp->if_softc;
3042         struct an_ltv_genconfig *cfg;
3043         int otype = sc->an_config.an_opmode;
3044         int orate = sc->an_tx_rate;
3045
3046         if ((sc->an_ifmedia.ifm_cur->ifm_media & IFM_IEEE80211_ADHOC) != 0)
3047                 sc->an_config.an_opmode = AN_OPMODE_IBSS_ADHOC;
3048         else
3049                 sc->an_config.an_opmode = AN_OPMODE_INFRASTRUCTURE_STATION;
3050
3051         switch (IFM_SUBTYPE(sc->an_ifmedia.ifm_cur->ifm_media)) {
3052         case IFM_IEEE80211_DS1:
3053                 sc->an_tx_rate = AN_RATE_1MBPS;
3054                 break;
3055         case IFM_IEEE80211_DS2:
3056                 sc->an_tx_rate = AN_RATE_2MBPS;
3057                 break;
3058         case IFM_IEEE80211_DS5:
3059                 sc->an_tx_rate = AN_RATE_5_5MBPS;
3060                 break;
3061         case IFM_IEEE80211_DS11:
3062                 sc->an_tx_rate = AN_RATE_11MBPS;
3063                 break;
3064         case IFM_AUTO:
3065                 sc->an_tx_rate = 0;
3066                 break;
3067         }
3068
3069         if (orate != sc->an_tx_rate) {
3070                 /* Read the current configuration */
3071                 sc->an_config.an_type = AN_RID_GENCONFIG;
3072                 sc->an_config.an_len = sizeof(struct an_ltv_genconfig);
3073                 an_read_record(sc, (struct an_ltv_gen *)&sc->an_config);
3074                 cfg = &sc->an_config;
3075
3076                 /* clear other rates and set the only one we want */
3077                 bzero(cfg->an_rates, sizeof(cfg->an_rates));
3078                 cfg->an_rates[0] = sc->an_tx_rate;
3079
3080                 /* Save the new rate */
3081                 sc->an_config.an_type = AN_RID_GENCONFIG;
3082                 sc->an_config.an_len = sizeof(struct an_ltv_genconfig);
3083         }
3084
3085         if (otype != sc->an_config.an_opmode ||
3086             orate != sc->an_tx_rate)
3087                 an_init(sc);
3088
3089         return(0);
3090 }
3091
3092 static void
3093 an_media_status(ifp, imr)
3094         struct ifnet            *ifp;
3095         struct ifmediareq       *imr;
3096 {
3097         struct an_ltv_status    status;
3098         struct an_softc         *sc = ifp->if_softc;
3099
3100         status.an_len = sizeof(status);
3101         status.an_type = AN_RID_STATUS;
3102         if (an_read_record(sc, (struct an_ltv_gen *)&status)) {
3103                 /* If the status read fails, just lie. */
3104                 imr->ifm_active = sc->an_ifmedia.ifm_cur->ifm_media;
3105                 imr->ifm_status = IFM_AVALID|IFM_ACTIVE;
3106         }
3107
3108         if (sc->an_tx_rate == 0) {
3109                 imr->ifm_active = IFM_IEEE80211|IFM_AUTO;
3110                 if (sc->an_config.an_opmode == AN_OPMODE_IBSS_ADHOC)
3111                         imr->ifm_active |= IFM_IEEE80211_ADHOC;
3112                 switch (status.an_current_tx_rate) {
3113                 case AN_RATE_1MBPS:
3114                         imr->ifm_active |= IFM_IEEE80211_DS1;
3115                         break;
3116                 case AN_RATE_2MBPS:
3117                         imr->ifm_active |= IFM_IEEE80211_DS2;
3118                         break;
3119                 case AN_RATE_5_5MBPS:
3120                         imr->ifm_active |= IFM_IEEE80211_DS5;
3121                         break;
3122                 case AN_RATE_11MBPS:
3123                         imr->ifm_active |= IFM_IEEE80211_DS11;
3124                         break;
3125                 }
3126         } else {
3127                 imr->ifm_active = sc->an_ifmedia.ifm_cur->ifm_media;
3128         }
3129
3130         imr->ifm_status = IFM_AVALID;
3131         if (status.an_opmode & AN_STATUS_OPMODE_ASSOCIATED)
3132                 imr->ifm_status |= IFM_ACTIVE;
3133 }
3134
3135 /********************** Cisco utility support routines *************/
3136
3137 /*
3138  * ReadRids & WriteRids derived from Cisco driver additions to Ben Reed's
3139  * Linux driver
3140  */
3141
3142 static int
3143 readrids(ifp, l_ioctl)
3144         struct ifnet   *ifp;
3145         struct aironet_ioctl *l_ioctl;
3146 {
3147         unsigned short  rid;
3148         struct an_softc *sc;
3149
3150         switch (l_ioctl->command) {
3151         case AIROGCAP:
3152                 rid = AN_RID_CAPABILITIES;
3153                 break;
3154         case AIROGCFG:
3155                 rid = AN_RID_GENCONFIG;
3156                 break;
3157         case AIROGSLIST:
3158                 rid = AN_RID_SSIDLIST;
3159                 break;
3160         case AIROGVLIST:
3161                 rid = AN_RID_APLIST;
3162                 break;
3163         case AIROGDRVNAM:
3164                 rid = AN_RID_DRVNAME;
3165                 break;
3166         case AIROGEHTENC:
3167                 rid = AN_RID_ENCAPPROTO;
3168                 break;
3169         case AIROGWEPKTMP:
3170                 rid = AN_RID_WEP_TEMP;
3171                 break;
3172         case AIROGWEPKNV:
3173                 rid = AN_RID_WEP_PERM;
3174                 break;
3175         case AIROGSTAT:
3176                 rid = AN_RID_STATUS;
3177                 break;
3178         case AIROGSTATSD32:
3179                 rid = AN_RID_32BITS_DELTA;
3180                 break;
3181         case AIROGSTATSC32:
3182                 rid = AN_RID_32BITS_CUM;
3183                 break;
3184         default:
3185                 rid = 999;
3186                 break;
3187         }
3188
3189         if (rid == 999) /* Is bad command */
3190                 return -EINVAL;
3191
3192         sc = ifp->if_softc;
3193         sc->areq.an_len  = AN_MAX_DATALEN;
3194         sc->areq.an_type = rid;
3195
3196         an_read_record(sc, (struct an_ltv_gen *)&sc->areq);
3197
3198         l_ioctl->len = sc->areq.an_len - 4;     /* just data */
3199
3200         /* the data contains the length at first */
3201         if (copyout(&(sc->areq.an_len), l_ioctl->data,
3202                     sizeof(sc->areq.an_len))) {
3203                 return -EFAULT;
3204         }
3205         /* Just copy the data back */
3206         if (copyout(&(sc->areq.an_val), l_ioctl->data + 2,
3207                     l_ioctl->len)) {
3208                 return -EFAULT;
3209         }
3210         return 0;
3211 }
3212
3213 static int
3214 writerids(ifp, l_ioctl)
3215         struct ifnet   *ifp;
3216         struct aironet_ioctl *l_ioctl;
3217 {
3218         struct an_softc *sc;
3219         int             rid, command;
3220
3221         sc = ifp->if_softc;
3222         rid = 0;
3223         command = l_ioctl->command;
3224
3225         switch (command) {
3226         case AIROPSIDS:
3227                 rid = AN_RID_SSIDLIST;
3228                 break;
3229         case AIROPCAP:
3230                 rid = AN_RID_CAPABILITIES;
3231                 break;
3232         case AIROPAPLIST:
3233                 rid = AN_RID_APLIST;
3234                 break;
3235         case AIROPCFG:
3236                 rid = AN_RID_GENCONFIG;
3237                 break;
3238         case AIROPMACON:
3239                 an_cmd(sc, AN_CMD_ENABLE, 0);
3240                 return 0;
3241                 break;
3242         case AIROPMACOFF:
3243                 an_cmd(sc, AN_CMD_DISABLE, 0);
3244                 return 0;
3245                 break;
3246         case AIROPSTCLR:
3247                 /*
3248                  * This command merely clears the counts does not actually
3249                  * store any data only reads rid. But as it changes the cards
3250                  * state, I put it in the writerid routines.
3251                  */
3252
3253                 rid = AN_RID_32BITS_DELTACLR;
3254                 sc = ifp->if_softc;
3255                 sc->areq.an_len = AN_MAX_DATALEN;
3256                 sc->areq.an_type = rid;
3257
3258                 an_read_record(sc, (struct an_ltv_gen *)&sc->areq);
3259                 l_ioctl->len = sc->areq.an_len - 4;     /* just data */
3260
3261                 /* the data contains the length at first */
3262                 if (copyout(&(sc->areq.an_len), l_ioctl->data,
3263                             sizeof(sc->areq.an_len))) {
3264                         return -EFAULT;
3265                 }
3266                 /* Just copy the data */
3267                 if (copyout(&(sc->areq.an_val), l_ioctl->data + 2,
3268                             l_ioctl->len)) {
3269                         return -EFAULT;
3270                 }
3271                 return 0;
3272                 break;
3273         case AIROPWEPKEY:
3274                 rid = AN_RID_WEP_TEMP;
3275                 break;
3276         case AIROPWEPKEYNV:
3277                 rid = AN_RID_WEP_PERM;
3278                 break;
3279         case AIROPLEAPUSR:
3280                 rid = AN_RID_LEAPUSERNAME;
3281                 break;
3282         case AIROPLEAPPWD:
3283                 rid = AN_RID_LEAPPASSWORD;
3284                 break;
3285         default:
3286                 return -EOPNOTSUPP;
3287         }
3288
3289         if (rid) {
3290                 if (l_ioctl->len > sizeof(sc->areq.an_val) + 4)
3291                         return -EINVAL;
3292                 sc->areq.an_len = l_ioctl->len + 4;     /* add type & length */
3293                 sc->areq.an_type = rid;
3294
3295                 /* Just copy the data back */
3296                 copyin((l_ioctl->data) + 2, &sc->areq.an_val,
3297                        l_ioctl->len);
3298
3299                 an_cmd(sc, AN_CMD_DISABLE, 0);
3300                 an_write_record(sc, (struct an_ltv_gen *)&sc->areq);
3301                 an_cmd(sc, AN_CMD_ENABLE, 0);
3302                 return 0;
3303         }
3304         return -EOPNOTSUPP;
3305 }
3306
3307 /*
3308  * General Flash utilities derived from Cisco driver additions to Ben Reed's
3309  * Linux driver
3310  */
3311
3312 #define FLASH_DELAY(x)  tsleep(ifp, 0, "flash", ((x) / hz) + 1);
3313 #define FLASH_COMMAND   0x7e7e
3314 #define FLASH_SIZE      32 * 1024
3315
3316 static int
3317 unstickbusy(ifp)
3318         struct ifnet   *ifp;
3319 {
3320         struct an_softc *sc = ifp->if_softc;
3321
3322         if (CSR_READ_2(sc, AN_COMMAND(sc->mpi350)) & AN_CMD_BUSY) {
3323                 CSR_WRITE_2(sc, AN_EVENT_ACK(sc->mpi350),
3324                             AN_EV_CLR_STUCK_BUSY);
3325                 return 1;
3326         }
3327         return 0;
3328 }
3329
3330 /*
3331  * Wait for busy completion from card wait for delay uSec's Return true for
3332  * success meaning command reg is clear
3333  */
3334
3335 static int
3336 WaitBusy(ifp, uSec)
3337         struct ifnet   *ifp;
3338         int             uSec;
3339 {
3340         int             statword = 0xffff;
3341         int             delay = 0;
3342         struct an_softc *sc = ifp->if_softc;
3343
3344         while ((statword & AN_CMD_BUSY) && delay <= (1000 * 100)) {
3345                 FLASH_DELAY(10);
3346                 delay += 10;
3347                 statword = CSR_READ_2(sc, AN_COMMAND(sc->mpi350));
3348
3349                 if ((AN_CMD_BUSY & statword) && (delay % 200)) {
3350                         unstickbusy(ifp);
3351                 }
3352         }
3353
3354         return 0 == (AN_CMD_BUSY & statword);
3355 }
3356
3357 /*
3358  * STEP 1) Disable MAC and do soft reset on card.
3359  */
3360
3361 static int
3362 cmdreset(ifp)
3363         struct ifnet   *ifp;
3364 {
3365         int             status;
3366         struct an_softc *sc = ifp->if_softc;
3367
3368         an_stop(sc);
3369
3370         an_cmd(sc, AN_CMD_DISABLE, 0);
3371
3372         if (!(status = WaitBusy(ifp, AN_TIMEOUT))) {
3373                 printf("an%d: Waitbusy hang b4 RESET =%d\n",
3374                        sc->an_unit, status);
3375                 return -EBUSY;
3376         }
3377         CSR_WRITE_2(sc, AN_COMMAND(sc->mpi350), AN_CMD_FW_RESTART);
3378
3379         FLASH_DELAY(1000);      /* WAS 600 12/7/00 */
3380
3381
3382         if (!(status = WaitBusy(ifp, 100))) {
3383                 printf("an%d: Waitbusy hang AFTER RESET =%d\n",
3384                        sc->an_unit, status);
3385                 return -EBUSY;
3386         }
3387         return 0;
3388 }
3389
3390 /*
3391  * STEP 2) Put the card in legendary flash mode
3392  */
3393
3394 static int
3395 setflashmode(ifp)
3396         struct ifnet   *ifp;
3397 {
3398         int             status;
3399         struct an_softc *sc = ifp->if_softc;
3400
3401         CSR_WRITE_2(sc, AN_SW0(sc->mpi350), FLASH_COMMAND);
3402         CSR_WRITE_2(sc, AN_SW1(sc->mpi350), FLASH_COMMAND);
3403         CSR_WRITE_2(sc, AN_SW0(sc->mpi350), FLASH_COMMAND);
3404         CSR_WRITE_2(sc, AN_COMMAND(sc->mpi350), FLASH_COMMAND);
3405
3406         /*
3407          * mdelay(500); // 500ms delay
3408          */
3409
3410         FLASH_DELAY(500);
3411
3412         if (!(status = WaitBusy(ifp, AN_TIMEOUT))) {
3413                 printf("Waitbusy hang after setflash mode\n");
3414                 return -EIO;
3415         }
3416         return 0;
3417 }
3418
3419 /*
3420  * Get a character from the card matching matchbyte Step 3)
3421  */
3422
3423 static int
3424 flashgchar(ifp, matchbyte, dwelltime)
3425         struct ifnet   *ifp;
3426         int             matchbyte;
3427         int             dwelltime;
3428 {
3429         int             rchar;
3430         unsigned char   rbyte = 0;
3431         int             success = -1;
3432         struct an_softc *sc = ifp->if_softc;
3433
3434
3435         do {
3436                 rchar = CSR_READ_2(sc, AN_SW1(sc->mpi350));
3437
3438                 if (dwelltime && !(0x8000 & rchar)) {
3439                         dwelltime -= 10;
3440                         FLASH_DELAY(10);
3441                         continue;
3442                 }
3443                 rbyte = 0xff & rchar;
3444
3445                 if ((rbyte == matchbyte) && (0x8000 & rchar)) {
3446                         CSR_WRITE_2(sc, AN_SW1(sc->mpi350), 0);
3447                         success = 1;
3448                         break;
3449                 }
3450                 if (rbyte == 0x81 || rbyte == 0x82 || rbyte == 0x83 || rbyte == 0x1a || 0xffff == rchar)
3451                         break;
3452                 CSR_WRITE_2(sc, AN_SW1(sc->mpi350), 0);
3453
3454         } while (dwelltime > 0);
3455         return success;
3456 }
3457
3458 /*
3459  * Put character to SWS0 wait for dwelltime x 50us for  echo .
3460  */
3461
3462 static int
3463 flashpchar(ifp, byte, dwelltime)
3464         struct ifnet   *ifp;
3465         int             byte;
3466         int             dwelltime;
3467 {
3468         int             echo;
3469         int             pollbusy, waittime;
3470         struct an_softc *sc = ifp->if_softc;
3471
3472         byte |= 0x8000;
3473
3474         if (dwelltime == 0)
3475                 dwelltime = 200;
3476
3477         waittime = dwelltime;
3478
3479         /*
3480          * Wait for busy bit d15 to go false indicating buffer empty
3481          */
3482         do {
3483                 pollbusy = CSR_READ_2(sc, AN_SW0(sc->mpi350));
3484
3485                 if (pollbusy & 0x8000) {
3486                         FLASH_DELAY(50);
3487                         waittime -= 50;
3488                         continue;
3489                 } else
3490                         break;
3491         }
3492         while (waittime >= 0);
3493
3494         /* timeout for busy clear wait */
3495
3496         if (waittime <= 0) {
3497                 printf("an%d: flash putchar busywait timeout! \n",
3498                        sc->an_unit);
3499                 return -1;
3500         }
3501         /*
3502          * Port is clear now write byte and wait for it to echo back
3503          */
3504         do {
3505                 CSR_WRITE_2(sc, AN_SW0(sc->mpi350), byte);
3506                 FLASH_DELAY(50);
3507                 dwelltime -= 50;
3508                 echo = CSR_READ_2(sc, AN_SW1(sc->mpi350));
3509         } while (dwelltime >= 0 && echo != byte);
3510
3511
3512         CSR_WRITE_2(sc, AN_SW1(sc->mpi350), 0);
3513
3514         return echo == byte;
3515 }
3516
3517 /*
3518  * Transfer 32k of firmware data from user buffer to our buffer and send to
3519  * the card
3520  */
3521
3522 static int
3523 flashputbuf(ifp)
3524         struct ifnet   *ifp;
3525 {
3526         unsigned short *bufp;
3527         int             nwords;
3528         struct an_softc *sc = ifp->if_softc;
3529
3530         /* Write stuff */
3531
3532         bufp = sc->an_flash_buffer;
3533
3534         if (!sc->mpi350) {
3535                 CSR_WRITE_2(sc, AN_AUX_PAGE, 0x100);
3536                 CSR_WRITE_2(sc, AN_AUX_OFFSET, 0);
3537
3538                 for (nwords = 0; nwords != FLASH_SIZE / 2; nwords++) {
3539                         CSR_WRITE_2(sc, AN_AUX_DATA, bufp[nwords] & 0xffff);
3540                 }
3541         } else {
3542                 for (nwords = 0; nwords != FLASH_SIZE / 4; nwords++) {
3543                         CSR_MEM_AUX_WRITE_4(sc, 0x8000,
3544                                 ((u_int32_t *)bufp)[nwords] & 0xffff);
3545                 }
3546         }
3547
3548         CSR_WRITE_2(sc, AN_SW0(sc->mpi350), 0x8000);
3549
3550         return 0;
3551 }
3552
3553 /*
3554  * After flashing restart the card.
3555  */
3556
3557 static int
3558 flashrestart(ifp)
3559         struct ifnet   *ifp;
3560 {
3561         int             status = 0;
3562         struct an_softc *sc = ifp->if_softc;
3563
3564         FLASH_DELAY(1024);              /* Added 12/7/00 */
3565
3566         an_init(sc);
3567
3568         FLASH_DELAY(1024);              /* Added 12/7/00 */
3569         return status;
3570 }
3571
3572 /*
3573  * Entry point for flash ioclt.
3574  */
3575
3576 static int
3577 flashcard(ifp, l_ioctl)
3578         struct ifnet   *ifp;
3579         struct aironet_ioctl *l_ioctl;
3580 {
3581         int             z = 0, status;
3582         struct an_softc *sc;
3583
3584         sc = ifp->if_softc;
3585         if (sc->mpi350) {
3586                 printf("an%d: flashing not supported on MPI 350 yet\n",
3587                        sc->an_unit);
3588                 return(-1);
3589         }
3590         status = l_ioctl->command;
3591
3592         switch (l_ioctl->command) {
3593         case AIROFLSHRST:
3594                 return cmdreset(ifp);
3595                 break;
3596         case AIROFLSHSTFL:
3597                 if (sc->an_flash_buffer) {
3598                         free(sc->an_flash_buffer, M_DEVBUF);
3599                         sc->an_flash_buffer = NULL;
3600                 }
3601                 sc->an_flash_buffer = malloc(FLASH_SIZE, M_DEVBUF, 0);
3602                 if (sc->an_flash_buffer)
3603                         return setflashmode(ifp);
3604                 else
3605                         return ENOBUFS;
3606                 break;
3607         case AIROFLSHGCHR:      /* Get char from aux */
3608                 copyin(l_ioctl->data, &sc->areq, l_ioctl->len);
3609                 z = *(int *)&sc->areq;
3610                 if ((status = flashgchar(ifp, z, 8000)) == 1)
3611                         return 0;
3612                 else
3613                         return -1;
3614                 break;
3615         case AIROFLSHPCHR:      /* Send char to card. */
3616                 copyin(l_ioctl->data, &sc->areq, l_ioctl->len);
3617                 z = *(int *)&sc->areq;
3618                 if ((status = flashpchar(ifp, z, 8000)) == -1)
3619                         return -EIO;
3620                 else
3621                         return 0;
3622                 break;
3623         case AIROFLPUTBUF:      /* Send 32k to card */
3624                 if (l_ioctl->len > FLASH_SIZE) {
3625                         printf("an%d: Buffer to big, %x %x\n", sc->an_unit,
3626                                l_ioctl->len, FLASH_SIZE);
3627                         return -EINVAL;
3628                 }
3629                 copyin(l_ioctl->data, sc->an_flash_buffer, l_ioctl->len);
3630
3631                 if ((status = flashputbuf(ifp)) != 0)
3632                         return -EIO;
3633                 else
3634                         return 0;
3635                 break;
3636         case AIRORESTART:
3637                 if ((status = flashrestart(ifp)) != 0) {
3638                         printf("an%d: FLASHRESTART returned %d\n",
3639                                sc->an_unit, status);
3640                         return -EIO;
3641                 } else
3642                         return 0;
3643
3644                 break;
3645         default:
3646                 return -EINVAL;
3647         }
3648
3649         return -EINVAL;
3650 }