sys/dev/netif/awi/awi.c

   1 /*      $NetBSD: awi.c,v 1.26 2000/07/21 04:48:55 onoe Exp $    */
   2 /* $FreeBSD: src/sys/dev/awi/awi.c,v 1.10.2.2 2003/01/23 21:06:42 sam Exp $ */
   3 /* $DragonFly: src/sys/dev/netif/awi/Attic/awi.c,v 1.23 2005/06/13 20:30:45 joerg Exp $ */
   4
   5 /*-
   6  * Copyright (c) 1999 The NetBSD Foundation, Inc.
   7  * All rights reserved.
   8  *
   9  * This code is derived from software contributed to The NetBSD Foundation
  10  * by Bill Sommerfeld
  11  *
  12  * Redistribution and use in source and binary forms, with or without
  13  * modification, are permitted provided that the following conditions
  14  * are met:
  15  * 1. Redistributions of source code must retain the above copyright
  16  *    notice, this list of conditions and the following disclaimer.
  17  * 2. Redistributions in binary form must reproduce the above copyright
  18  *    notice, this list of conditions and the following disclaimer in the
  19  *    documentation and/or other materials provided with the distribution.
  20  * 3. All advertising materials mentioning features or use of this software
  21  *    must display the following acknowledgement:
  22  *        This product includes software developed by the NetBSD
  23  *        Foundation, Inc. and its contributors.
  24  * 4. Neither the name of The NetBSD Foundation nor the names of its
  25  *    contributors may be used to endorse or promote products derived
  26  *    from this software without specific prior written permission.
  27  *
  28  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
  29  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  30  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  31  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
  32  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  33  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  34  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  35  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  36  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  37  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  38  * POSSIBILITY OF SUCH DAMAGE.
  39  */
  40 /*
  41  * Driver for AMD 802.11 firmware.
  42  * Uses am79c930 chip driver to talk to firmware running on the am79c930.
  43  *
  44  * More-or-less a generic ethernet-like if driver, with 802.11 gorp added.
  45  */
  46
  47 /*
  48  * todo:
  49  *      - flush tx queue on resynch.
  50  *      - clear oactive on "down".
  51  *      - rewrite copy-into-mbuf code
  52  *      - mgmt state machine gets stuck retransmitting assoc requests.
  53  *      - multicast filter.
  54  *      - fix device reset so it's more likely to work
  55  *      - show status goo through ifmedia.
  56  *
  57  * more todo:
  58  *      - deal with more 802.11 frames.
  59  *              - send reassoc request
  60  *              - deal with reassoc response
  61  *              - send/deal with disassociation
  62  *      - deal with "full" access points (no room for me).
  63  *      - power save mode
  64  *
  65  * later:
  66  *      - SSID preferences
  67  *      - need ioctls for poking at the MIBs
  68  *      - implement ad-hoc mode (including bss creation).
  69  *      - decide when to do "ad hoc" vs. infrastructure mode (IFF_LINK flags?)
  70  *              (focus on inf. mode since that will be needed for ietf)
  71  *      - deal with DH vs. FH versions of the card
  72  *      - deal with faster cards (2mb/s)
  73  *      - ?WEP goo (mmm, rc4) (it looks not particularly useful).
  74  *      - ifmedia revision.
  75  *      - common 802.11 mibish things.
  76  *      - common 802.11 media layer.
  77  */
  78
  79 /*
  80  * Driver for AMD 802.11 PCnetMobile firmware.
  81  * Uses am79c930 chip driver to talk to firmware running on the am79c930.
  82  *
  83  * The initial version of the driver was written by
  84  * Bill Sommerfeld <sommerfeld@netbsd.org>.
  85  * Then the driver module completely rewritten to support cards with DS phy
  86  * and to support adhoc mode by Atsushi Onoe <onoe@netbsd.org>
  87  */
  88
  89 #include "opt_inet.h"
  90
  91 #include <sys/param.h>
  92 #include <sys/systm.h>
  93 #include <sys/kernel.h>
  94 #include <sys/mbuf.h>
  95 #include <sys/malloc.h>
  96 #include <sys/proc.h>
  97 #include <sys/socket.h>
  98 #include <sys/sockio.h>
  99 #include <sys/errno.h>
 100 #include <sys/syslog.h>
 101 #include <sys/bus.h>
 102 #include <sys/thread2.h>
 103
 104 #include <net/if.h>
 105 #include <net/ifq_var.h>
 106 #include <net/if_dl.h>
 107 #include <net/ethernet.h>
 108 #include <net/if_media.h>
 109 #include <net/if_llc.h>
 110 #include <netproto/802_11/ieee80211.h>
 111 #include <netproto/802_11/ieee80211_ioctl.h>
 112
 113 #ifdef INET
 114 #include <netinet/in.h>
 115 #include <netinet/in_systm.h>
 116 #include <netinet/in_var.h>
 117 #include <netinet/ip.h>
 118 #include <netinet/if_ether.h>
 119 #endif
 120
 121 #include <net/bpf.h>
 122 #include <net/bpfdesc.h>
 123
 124 #include <machine/cpu.h>
 125 #include <machine/bus.h>
 126
 127 #include <dev/netif/awi/am79c930reg.h>
 128 #include <dev/netif/awi/am79c930var.h>
 129 #include <dev/netif/awi/awireg.h>
 130 #include <dev/netif/awi/awivar.h>
 131
 132 static int awi_ioctl (struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *);
 133 #ifdef IFM_IEEE80211
 134 static int awi_media_rate2opt (struct awi_softc *sc, int rate);
 135 static int awi_media_opt2rate (struct awi_softc *sc, int opt);
 136 static int awi_media_change (struct ifnet *ifp);
 137 static void awi_media_status (struct ifnet *ifp, struct ifmediareq *imr);
 138 #endif
 139 static void awi_watchdog (struct ifnet *ifp);
 140 static void awi_start (struct ifnet *ifp);
 141 static void awi_txint (struct awi_softc *sc);
 142 static struct mbuf * awi_fix_txhdr (struct awi_softc *sc, struct mbuf *m0);
 143 static struct mbuf * awi_fix_rxhdr (struct awi_softc *sc, struct mbuf *m0);
 144 static void awi_input (struct awi_softc *sc, struct mbuf *m, u_int32_t rxts, u_int8_t rssi);
 145 static void awi_rxint (struct awi_softc *sc);
 146 static struct mbuf * awi_devget (struct awi_softc *sc, u_int32_t off, u_int16_t len);
 147 static int awi_init_hw (struct awi_softc *sc);
 148 static int awi_init_mibs (struct awi_softc *sc);
 149 static int awi_init_txrx (struct awi_softc *sc);
 150 static void awi_stop_txrx (struct awi_softc *sc);
 151 static int awi_start_scan (struct awi_softc *sc);
 152 static int awi_next_scan (struct awi_softc *sc);
 153 static void awi_stop_scan (struct awi_softc *sc);
 154 static void awi_recv_beacon (struct awi_softc *sc, struct mbuf *m0, u_int32_t rxts, u_int8_t rssi);
 155 static int awi_set_ss (struct awi_softc *sc);
 156 static void awi_try_sync (struct awi_softc *sc);
 157 static void awi_sync_done (struct awi_softc *sc);
 158 static void awi_send_deauth (struct awi_softc *sc);
 159 static void awi_send_auth (struct awi_softc *sc, int seq);
 160 static void awi_recv_auth (struct awi_softc *sc, struct mbuf *m0);
 161 static void awi_send_asreq (struct awi_softc *sc, int reassoc);
 162 static void awi_recv_asresp (struct awi_softc *sc, struct mbuf *m0);
 163 static int awi_mib (struct awi_softc *sc, u_int8_t cmd, u_int8_t mib);
 164 static int awi_cmd_scan (struct awi_softc *sc);
 165 static int awi_cmd (struct awi_softc *sc, u_int8_t cmd);
 166 static void awi_cmd_done (struct awi_softc *sc);
 167 static int awi_next_txd (struct awi_softc *sc, int len, u_int32_t *framep, u_int32_t*ntxdp);
 168 static int awi_lock (struct awi_softc *sc);
 169 static void awi_unlock (struct awi_softc *sc);
 170 static int awi_intr_lock (struct awi_softc *sc);
 171 static void awi_intr_unlock (struct awi_softc *sc);
 172 static int awi_cmd_wait (struct awi_softc *sc);
 173 static void awi_print_essid (u_int8_t *essid);
 174
 175 DECLARE_DUMMY_MODULE(if_awi);
 176
 177 #ifdef AWI_DEBUG
 178 static void awi_dump_pkt (struct awi_softc *sc, struct mbuf *m, int rssi);
 179 int awi_verbose = 0;
 180 int awi_dump = 0;
 181 #define AWI_DUMP_MASK(fc0)  (1 << (((fc0) & IEEE80211_FC0_SUBTYPE_MASK) >> 4))
 182 int awi_dump_mask = AWI_DUMP_MASK(IEEE80211_FC0_SUBTYPE_BEACON);
 183 int awi_dump_hdr = 0;
 184 int awi_dump_len = 28;
 185 #endif
 186
 187 #define AWI_BPF_NORM    0
 188 #define AWI_BPF_RAW     1
 189 #define AWI_BPF_MTAP(sc, m, raw) do {                                   \
 190         if ((sc)->sc_rawbpf == (raw))                                   \
 191                 BPF_MTAP((sc)->sc_ifp, (m));                            \
 192 } while (0);
 193
 194 #ifndef llc_snap
 195 #define llc_snap              llc_un.type_snap
 196 #endif
 197
 198 devclass_t awi_devclass;
 199
 200 int
 201 awi_attach(sc)
 202         struct awi_softc *sc;
 203 {
 204         struct ifnet *ifp = sc->sc_ifp;
 205         int error;
 206 #ifdef IFM_IEEE80211
 207         int i;
 208         u_int8_t *phy_rates;
 209         int mword;
 210         struct ifmediareq imr;
 211 #endif
 212
 213         crit_enter();
 214         /*
 215          * Even if we can sleep in initialization state,
 216          * all other processes (e.g. ifconfig) have to wait for
 217          * completion of attaching interface.
 218          */
 219         sc->sc_busy = 1;
 220         sc->sc_status = AWI_ST_INIT;
 221         TAILQ_INIT(&sc->sc_scan);
 222         error = awi_init_hw(sc);
 223         if (error) {
 224                 sc->sc_invalid = 1;
 225                 crit_exit();
 226                 return error;
 227         }
 228         error = awi_init_mibs(sc);
 229         crit_exit();
 230         if (error) {
 231                 sc->sc_invalid = 1;
 232                 return error;
 233         }
 234
 235         ifp->if_softc = sc;
 236         ifp->if_start = awi_start;
 237         ifp->if_ioctl = awi_ioctl;
 238         ifp->if_watchdog = awi_watchdog;
 239         ifp->if_mtu = ETHERMTU;
 240         ifp->if_hdrlen = sizeof(struct ieee80211_frame) +
 241             sizeof(struct ether_header);
 242         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
 243 #ifdef IFF_NOTRAILERS
 244         ifp->if_flags |= IFF_NOTRAILERS;
 245 #endif
 246         ifq_set_maxlen(&ifp->if_snd, ifqmaxlen);
 247         ifq_set_ready(&ifp->if_snd);
 248         memcpy(sc->sc_ec.ac_enaddr, sc->sc_mib_addr.aMAC_Address,
 249             ETHER_ADDR_LEN);
 250
 251         if_printf(ifp, "IEEE802.11 %s %dMbps (firmware %s)\n",
 252             sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH ? "FH" : "DS",
 253             sc->sc_tx_rate / 10, sc->sc_banner);
 254         ether_ifattach(ifp, sc->sc_mib_addr.aMAC_Address);
 255
 256 #ifdef IFM_IEEE80211
 257         ifmedia_init(&sc->sc_media, 0, awi_media_change, awi_media_status);
 258         phy_rates = sc->sc_mib_phy.aSuprt_Data_Rates;
 259         for (i = 0; i < phy_rates[1]; i++) {
 260                 mword = awi_media_rate2opt(sc, AWI_80211_RATE(phy_rates[2 + i]));
 261                 if (mword == 0)
 262                         continue;
 263                 mword |= IFM_IEEE80211;
 264                 ifmedia_add(&sc->sc_media, mword, 0, NULL);
 265                 ifmedia_add(&sc->sc_media,
 266                     mword | IFM_IEEE80211_ADHOC, 0, NULL);
 267                 if (sc->sc_mib_phy.IEEE_PHY_Type != AWI_PHY_TYPE_FH)
 268                         ifmedia_add(&sc->sc_media,
 269                             mword | IFM_IEEE80211_ADHOC | IFM_FLAG0, 0, NULL);
 270         }
 271         awi_media_status(ifp, &imr);
 272         ifmedia_set(&sc->sc_media, imr.ifm_active);
 273 #endif
 274
 275         /* ready to accept ioctl */
 276         awi_unlock(sc);
 277
 278         /* Attach is successful. */
 279         sc->sc_attached = 1;
 280         return 0;
 281 }
 282
 283 static int
 284 awi_ioctl(ifp, cmd, data, cr)
 285         struct ifnet *ifp;
 286         u_long cmd;
 287         caddr_t data;
 288         struct ucred *cr;
 289 {
 290         struct awi_softc *sc = ifp->if_softc;
 291         struct ifreq *ifr = (struct ifreq *)data;
 292         struct ifaddr *ifa = (struct ifaddr *)data;
 293         int error;
 294         struct ieee80211_nwid nwid;
 295         u_int8_t *p;
 296
 297         crit_enter();
 298
 299         /* serialize ioctl */
 300         error = awi_lock(sc);
 301         if (error)
 302                 goto cantlock;
 303         switch (cmd) {
 304         case SIOCSIFADDR:
 305                 ifp->if_flags |= IFF_UP;
 306                 switch (ifa->ifa_addr->sa_family) {
 307 #ifdef INET
 308                 case AF_INET:
 309                         arp_ifinit((void *)ifp, ifa);
 310                         break;
 311 #endif
 312                 }
 313                 /* FALLTHROUGH */
 314         case SIOCSIFFLAGS:
 315                 sc->sc_format_llc = !(ifp->if_flags & IFF_LINK0);
 316                 if (!(ifp->if_flags & IFF_UP)) {
 317                         if (sc->sc_enabled) {
 318                                 awi_stop(sc);
 319                                 if (sc->sc_disable)
 320                                         (*sc->sc_disable)(sc);
 321                                 sc->sc_enabled = 0;
 322                         }
 323                         break;
 324                 }
 325                 error = awi_init(sc);
 326                 break;
 327
 328         case SIOCADDMULTI:
 329         case SIOCDELMULTI:
 330                 error = ENETRESET;      /*XXX*/
 331                 /*
 332                  * Do not rescan BSS.  Rather, just reset multicast filter.
 333                  */
 334                 if (error == ENETRESET) {
 335                         if (sc->sc_enabled)
 336                                 error = awi_init(sc);
 337                         else
 338                                 error = 0;
 339                 }
 340                 break;
 341         case SIOCSIFMTU:
 342                 if (ifr->ifr_mtu > ETHERMTU)
 343                         error = EINVAL;
 344                 else
 345                         ifp->if_mtu = ifr->ifr_mtu;
 346                 break;
 347         case SIOCS80211NWID:
 348                 error = suser_cred(cr, NULL_CRED_OKAY); /* EPERM if no proc */
 349                 if (error)
 350                         break;
 351                 error = copyin(ifr->ifr_data, &nwid, sizeof(nwid));
 352                 if (error)
 353                         break;
 354                 if (nwid.i_len > IEEE80211_NWID_LEN) {
 355                         error = EINVAL;
 356                         break;
 357                 }
 358                 if (sc->sc_mib_mac.aDesired_ESS_ID[1] == nwid.i_len &&
 359                     memcmp(&sc->sc_mib_mac.aDesired_ESS_ID[2], nwid.i_nwid,
 360                     nwid.i_len) == 0)
 361                         break;
 362                 memset(sc->sc_mib_mac.aDesired_ESS_ID, 0, AWI_ESS_ID_SIZE);
 363                 sc->sc_mib_mac.aDesired_ESS_ID[0] = IEEE80211_ELEMID_SSID;
 364                 sc->sc_mib_mac.aDesired_ESS_ID[1] = nwid.i_len;
 365                 memcpy(&sc->sc_mib_mac.aDesired_ESS_ID[2], nwid.i_nwid,
 366                     nwid.i_len);
 367                 if (sc->sc_enabled) {
 368                         awi_stop(sc);
 369                         error = awi_init(sc);
 370                 }
 371                 break;
 372         case SIOCG80211NWID:
 373                 if (ifp->if_flags & IFF_RUNNING)
 374                         p = sc->sc_bss.essid;
 375                 else
 376                         p = sc->sc_mib_mac.aDesired_ESS_ID;
 377                 error = copyout(p + 1, ifr->ifr_data, 1 + IEEE80211_NWID_LEN);
 378                 break;
 379         case SIOCS80211NWKEY:
 380                 error = suser_cred(cr, NULL_CRED_OKAY); /* EPERM if no proc */
 381                 if (error)
 382                         break;
 383                 error = awi_wep_setnwkey(sc, (struct ieee80211_nwkey *)data);
 384                 break;
 385         case SIOCG80211NWKEY:
 386                 error = awi_wep_getnwkey(sc, (struct ieee80211_nwkey *)data);
 387                 break;
 388 #ifdef IFM_IEEE80211
 389         case SIOCSIFMEDIA:
 390         case SIOCGIFMEDIA:
 391                 error = ifmedia_ioctl(ifp, ifr, &sc->sc_media, cmd);
 392                 break;
 393 #endif
 394         default:
 395                 error = awi_wicfg(ifp, cmd, data);
 396                 break;
 397         }
 398         awi_unlock(sc);
 399   cantlock:
 400         crit_exit();
 401         return error;
 402 }
 403
 404 #ifdef IFM_IEEE80211
 405 static int
 406 awi_media_rate2opt(sc, rate)
 407         struct awi_softc *sc;
 408         int rate;
 409 {
 410         int mword;
 411
 412         mword = 0;
 413         switch (rate) {
 414         case 10:
 415                 if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH)
 416                         mword = IFM_IEEE80211_FH1;
 417                 else
 418                         mword = IFM_IEEE80211_DS1;
 419                 break;
 420         case 20:
 421                 if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH)
 422                         mword = IFM_IEEE80211_FH2;
 423                 else
 424                         mword = IFM_IEEE80211_DS2;
 425                 break;
 426         case 55:
 427                 if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_DS)
 428                         mword = IFM_IEEE80211_DS5;
 429                 break;
 430         case 110:
 431                 if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_DS)
 432                         mword = IFM_IEEE80211_DS11;
 433                 break;
 434         }
 435         return mword;
 436 }
 437
 438 static int
 439 awi_media_opt2rate(sc, opt)
 440         struct awi_softc *sc;
 441         int opt;
 442 {
 443         int rate;
 444
 445         rate = 0;
 446         switch (IFM_SUBTYPE(opt)) {
 447         case IFM_IEEE80211_FH1:
 448         case IFM_IEEE80211_FH2:
 449                 if (sc->sc_mib_phy.IEEE_PHY_Type != AWI_PHY_TYPE_FH)
 450                         return 0;
 451                 break;
 452         case IFM_IEEE80211_DS1:
 453         case IFM_IEEE80211_DS2:
 454         case IFM_IEEE80211_DS5:
 455         case IFM_IEEE80211_DS11:
 456                 if (sc->sc_mib_phy.IEEE_PHY_Type != AWI_PHY_TYPE_DS)
 457                         return 0;
 458                 break;
 459         }
 460
 461         switch (IFM_SUBTYPE(opt)) {
 462         case IFM_IEEE80211_FH1:
 463         case IFM_IEEE80211_DS1:
 464                 rate = 10;
 465                 break;
 466         case IFM_IEEE80211_FH2:
 467         case IFM_IEEE80211_DS2:
 468                 rate = 20;
 469                 break;
 470         case IFM_IEEE80211_DS5:
 471                 rate = 55;
 472                 break;
 473         case IFM_IEEE80211_DS11:
 474                 rate = 110;
 475                 break;
 476         }
 477         return rate;
 478 }
 479
 480 /*
 481  * Called from ifmedia_ioctl via awi_ioctl with lock obtained.
 482  */
 483 static int
 484 awi_media_change(ifp)
 485         struct ifnet *ifp;
 486 {
 487         struct awi_softc *sc = ifp->if_softc;
 488         struct ifmedia_entry *ime;
 489         u_int8_t *phy_rates;
 490         int i, rate, error;
 491
 492         error = 0;
 493         ime = sc->sc_media.ifm_cur;
 494         rate = awi_media_opt2rate(sc, ime->ifm_media);
 495         if (rate == 0)
 496                 return EINVAL;
 497         if (rate != sc->sc_tx_rate) {
 498                 phy_rates = sc->sc_mib_phy.aSuprt_Data_Rates;
 499                 for (i = 0; i < phy_rates[1]; i++) {
 500                         if (rate == AWI_80211_RATE(phy_rates[2 + i]))
 501                                 break;
 502                 }
 503                 if (i == phy_rates[1])
 504                         return EINVAL;
 505         }
 506         if (ime->ifm_media & IFM_IEEE80211_ADHOC) {
 507                 sc->sc_mib_local.Network_Mode = 0;
 508                 if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH)
 509                         sc->sc_no_bssid = 0;
 510                 else
 511                         sc->sc_no_bssid = (ime->ifm_media & IFM_FLAG0) ? 1 : 0;
 512         } else {
 513                 sc->sc_mib_local.Network_Mode = 1;
 514         }
 515         if (sc->sc_enabled) {
 516                 awi_stop(sc);
 517                 error = awi_init(sc);
 518         }
 519         return error;
 520 }
 521
 522 static void
 523 awi_media_status(ifp, imr)
 524         struct ifnet *ifp;
 525         struct ifmediareq *imr;
 526 {
 527         struct awi_softc *sc = ifp->if_softc;
 528
 529         imr->ifm_status = IFM_AVALID;
 530         if (ifp->if_flags & IFF_RUNNING)
 531                 imr->ifm_status |= IFM_ACTIVE;
 532         imr->ifm_active = IFM_IEEE80211;
 533         imr->ifm_active |= awi_media_rate2opt(sc, sc->sc_tx_rate);
 534         if (sc->sc_mib_local.Network_Mode == 0) {
 535                 imr->ifm_active |= IFM_IEEE80211_ADHOC;
 536                 if (sc->sc_no_bssid)
 537                         imr->ifm_active |= IFM_FLAG0;
 538         }
 539 }
 540 #endif /* IFM_IEEE80211 */
 541
 542 int
 543 awi_intr(arg)
 544         void *arg;
 545 {
 546         struct awi_softc *sc = arg;
 547         u_int16_t status;
 548         int error, handled = 0, ocansleep;
 549
 550         if (!sc->sc_enabled || !sc->sc_enab_intr || sc->sc_invalid)
 551                 return 0;
 552
 553         am79c930_gcr_setbits(&sc->sc_chip,
 554             AM79C930_GCR_DISPWDN | AM79C930_GCR_ECINT);
 555         awi_write_1(sc, AWI_DIS_PWRDN, 1);
 556         ocansleep = sc->sc_cansleep;
 557         sc->sc_cansleep = 0;
 558
 559         for (;;) {
 560                 error = awi_intr_lock(sc);
 561                 if (error)
 562                         break;
 563                 status = awi_read_1(sc, AWI_INTSTAT);
 564                 awi_write_1(sc, AWI_INTSTAT, 0);
 565                 awi_write_1(sc, AWI_INTSTAT, 0);
 566                 status |= awi_read_1(sc, AWI_INTSTAT2) << 8;
 567                 awi_write_1(sc, AWI_INTSTAT2, 0);
 568                 DELAY(10);
 569                 awi_intr_unlock(sc);
 570                 if (!sc->sc_cmd_inprog)
 571                         status &= ~AWI_INT_CMD; /* make sure */
 572                 if (status == 0)
 573                         break;
 574                 handled = 1;
 575                 if (status & AWI_INT_RX)
 576                         awi_rxint(sc);
 577                 if (status & AWI_INT_TX)
 578                         awi_txint(sc);
 579                 if (status & AWI_INT_CMD)
 580                         awi_cmd_done(sc);
 581                 if (status & AWI_INT_SCAN_CMPLT) {
 582                         if (sc->sc_status == AWI_ST_SCAN &&
 583                             sc->sc_mgt_timer > 0)
 584                                 (void)awi_next_scan(sc);
 585                 }
 586         }
 587         sc->sc_cansleep = ocansleep;
 588         am79c930_gcr_clearbits(&sc->sc_chip, AM79C930_GCR_DISPWDN);
 589         awi_write_1(sc, AWI_DIS_PWRDN, 0);
 590         return handled;
 591 }
 592
 593 int
 594 awi_init(sc)
 595         struct awi_softc *sc;
 596 {
 597         struct ifnet *ifp = sc->sc_ifp;
 598         int error, ostatus;
 599         int n;
 600         struct ifmultiaddr *ifma;
 601
 602         /* reinitialize muticast filter */
 603         n = 0;
 604         ifp->if_flags |= IFF_ALLMULTI;
 605         sc->sc_mib_local.Accept_All_Multicast_Dis = 0;
 606         if (ifp->if_flags & IFF_PROMISC) {
 607                 sc->sc_mib_mac.aPromiscuous_Enable = 1;
 608                 goto set_mib;
 609         }
 610         sc->sc_mib_mac.aPromiscuous_Enable = 0;
 611         if (ifp->if_amcount != 0)
 612                 goto set_mib;
 613         LIST_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
 614                 if (ifma->ifma_addr->sa_family != AF_LINK)
 615                         continue;
 616                 if (n == AWI_GROUP_ADDR_SIZE)
 617                         goto set_mib;
 618                 memcpy(sc->sc_mib_addr.aGroup_Addresses[n],
 619                     LLADDR((struct sockaddr_dl *)ifma->ifma_addr),
 620                     ETHER_ADDR_LEN);
 621                 n++;
 622         }
 623         for (; n < AWI_GROUP_ADDR_SIZE; n++)
 624                 memset(sc->sc_mib_addr.aGroup_Addresses[n], 0, ETHER_ADDR_LEN);
 625         ifp->if_flags &= ~IFF_ALLMULTI;
 626         sc->sc_mib_local.Accept_All_Multicast_Dis = 1;
 627
 628   set_mib:
 629 #ifdef notdef   /* allow non-encrypted frame for receiving. */
 630         sc->sc_mib_mgt.Wep_Required = sc->sc_wep_algo != NULL ? 1 : 0;
 631 #endif
 632         if (!sc->sc_enabled) {
 633                 sc->sc_enabled = 1;
 634                 if (sc->sc_enable)
 635                         (*sc->sc_enable)(sc);
 636                 sc->sc_status = AWI_ST_INIT;
 637                 error = awi_init_hw(sc);
 638                 if (error)
 639                         return error;
 640         }
 641         ostatus = sc->sc_status;
 642         sc->sc_status = AWI_ST_INIT;
 643         if ((error = awi_mib(sc, AWI_CMD_SET_MIB, AWI_MIB_LOCAL)) != 0 ||
 644             (error = awi_mib(sc, AWI_CMD_SET_MIB, AWI_MIB_ADDR)) != 0 ||
 645             (error = awi_mib(sc, AWI_CMD_SET_MIB, AWI_MIB_MAC)) != 0 ||
 646             (error = awi_mib(sc, AWI_CMD_SET_MIB, AWI_MIB_MGT)) != 0 ||
 647             (error = awi_mib(sc, AWI_CMD_SET_MIB, AWI_MIB_PHY)) != 0) {
 648                 awi_stop(sc);
 649                 return error;
 650         }
 651         if (ifp->if_flags & IFF_RUNNING)
 652                 sc->sc_status = AWI_ST_RUNNING;
 653         else {
 654                 if (ostatus == AWI_ST_INIT) {
 655                         error = awi_init_txrx(sc);
 656                         if (error)
 657                                 return error;
 658                 }
 659                 error = awi_start_scan(sc);
 660         }
 661         return error;
 662 }
 663
 664 void
 665 awi_stop(sc)
 666         struct awi_softc *sc;
 667 {
 668         struct ifnet *ifp = sc->sc_ifp;
 669         struct awi_bss *bp;
 670
 671         sc->sc_status = AWI_ST_INIT;
 672         if (!sc->sc_invalid) {
 673                 (void)awi_cmd_wait(sc);
 674                 if (sc->sc_mib_local.Network_Mode &&
 675                     sc->sc_status > AWI_ST_AUTH)
 676                         awi_send_deauth(sc);
 677                 awi_stop_txrx(sc);
 678         }
 679         ifp->if_flags &= ~(IFF_RUNNING|IFF_OACTIVE);
 680         ifp->if_timer = 0;
 681         sc->sc_tx_timer = sc->sc_rx_timer = sc->sc_mgt_timer = 0;
 682         IF_DRAIN(&sc->sc_mgtq);
 683         ifq_purge(&ifp->if_snd);
 684         while ((bp = TAILQ_FIRST(&sc->sc_scan)) != NULL) {
 685                 TAILQ_REMOVE(&sc->sc_scan, bp, list);
 686                 free(bp, M_DEVBUF);
 687         }
 688 }
 689
 690 static void
 691 awi_watchdog(ifp)
 692         struct ifnet *ifp;
 693 {
 694         struct awi_softc *sc = ifp->if_softc;
 695         int ocansleep;
 696
 697         if (sc->sc_invalid) {
 698                 ifp->if_timer = 0;
 699                 return;
 700         }
 701
 702         ocansleep = sc->sc_cansleep;
 703         sc->sc_cansleep = 0;
 704         if (sc->sc_tx_timer && --sc->sc_tx_timer == 0) {
 705                 if_printf(ifp, "transmit timeout\n");
 706                 awi_txint(sc);
 707         }
 708         if (sc->sc_rx_timer && --sc->sc_rx_timer == 0) {
 709                 if (ifp->if_flags & IFF_DEBUG) {
 710                         if_printf(ifp, "no recent beacons from %6D; rescanning\n",
 711                                   sc->sc_bss.bssid, ":");
 712                 }
 713                 ifp->if_flags &= ~IFF_RUNNING;
 714                 awi_start_scan(sc);
 715         }
 716         if (sc->sc_mgt_timer && --sc->sc_mgt_timer == 0) {
 717                 switch (sc->sc_status) {
 718                 case AWI_ST_SCAN:
 719                         awi_stop_scan(sc);
 720                         break;
 721                 case AWI_ST_AUTH:
 722                 case AWI_ST_ASSOC:
 723                         /* restart scan */
 724                         awi_start_scan(sc);
 725                         break;
 726                 default:
 727                         break;
 728                 }
 729         }
 730
 731         if (sc->sc_tx_timer == 0 && sc->sc_rx_timer == 0 &&
 732             sc->sc_mgt_timer == 0)
 733                 ifp->if_timer = 0;
 734         else
 735                 ifp->if_timer = 1;
 736         sc->sc_cansleep = ocansleep;
 737 }
 738
 739 static void
 740 awi_start(ifp)
 741         struct ifnet *ifp;
 742 {
 743         struct awi_softc *sc = ifp->if_softc;
 744         struct mbuf *m0, *m;
 745         u_int32_t txd, frame, ntxd;
 746         u_int8_t rate;
 747         int len, sent = 0;
 748
 749         for (;;) {
 750                 txd = sc->sc_txnext;
 751                 IF_DEQUEUE(&sc->sc_mgtq, m0);
 752                 if (m0 != NULL) {
 753                         if (awi_next_txd(sc, m0->m_pkthdr.len, &frame, &ntxd)) {
 754                                 IF_PREPEND(&sc->sc_mgtq, m0);
 755                                 ifp->if_flags |= IFF_OACTIVE;
 756                                 break;
 757                         }
 758                 } else {
 759                         if (!(ifp->if_flags & IFF_RUNNING))
 760                                 break;
 761                         m0 = ifq_poll(&ifp->if_snd);
 762                         if (m0 == NULL)
 763                                 break;
 764                         len = m0->m_pkthdr.len + sizeof(struct ieee80211_frame);
 765                         if (sc->sc_format_llc)
 766                                 len += sizeof(struct llc) -
 767                                     sizeof(struct ether_header);
 768                         if (sc->sc_wep_algo != NULL)
 769                                 len += IEEE80211_WEP_IVLEN +
 770                                     IEEE80211_WEP_KIDLEN + IEEE80211_WEP_CRCLEN;
 771                         if (awi_next_txd(sc, len, &frame, &ntxd)) {
 772                                 ifp->if_flags |= IFF_OACTIVE;
 773                                 break;
 774                         }
 775                         m0 = ifq_dequeue(&ifp->if_snd);
 776                         AWI_BPF_MTAP(sc, m0, AWI_BPF_NORM);
 777                         m0 = awi_fix_txhdr(sc, m0);
 778                         if (sc->sc_wep_algo != NULL && m0 != NULL)
 779                                 m0 = awi_wep_encrypt(sc, m0, 1);
 780                         if (m0 == NULL) {
 781                                 ifp->if_oerrors++;
 782                                 continue;
 783                         }
 784                         ifp->if_opackets++;
 785                 }
 786 #ifdef AWI_DEBUG
 787                 if (awi_dump)
 788                         awi_dump_pkt(sc, m0, -1);
 789 #endif
 790                 AWI_BPF_MTAP(sc, m0, AWI_BPF_RAW);
 791                 len = 0;
 792                 for (m = m0; m != NULL; m = m->m_next) {
 793                         awi_write_bytes(sc, frame + len, mtod(m, u_int8_t *),
 794                             m->m_len);
 795                         len += m->m_len;
 796                 }
 797                 m_freem(m0);
 798                 rate = sc->sc_tx_rate;  /*XXX*/
 799                 awi_write_1(sc, ntxd + AWI_TXD_STATE, 0);
 800                 awi_write_4(sc, txd + AWI_TXD_START, frame);
 801                 awi_write_4(sc, txd + AWI_TXD_NEXT, ntxd);
 802                 awi_write_4(sc, txd + AWI_TXD_LENGTH, len);
 803                 awi_write_1(sc, txd + AWI_TXD_RATE, rate);
 804                 awi_write_4(sc, txd + AWI_TXD_NDA, 0);
 805                 awi_write_4(sc, txd + AWI_TXD_NRA, 0);
 806                 awi_write_1(sc, txd + AWI_TXD_STATE, AWI_TXD_ST_OWN);
 807                 sc->sc_txnext = ntxd;
 808                 sent++;
 809         }
 810         if (sent) {
 811                 if (sc->sc_tx_timer == 0)
 812                         sc->sc_tx_timer = 5;
 813                 ifp->if_timer = 1;
 814 #ifdef AWI_DEBUG
 815                 if (awi_verbose)
 816                         printf("awi_start: sent %d txdone %d txnext %d txbase %d txend %d\n", sent, sc->sc_txdone, sc->sc_txnext, sc->sc_txbase, sc->sc_txend);
 817 #endif
 818         }
 819 }
 820
 821 static void
 822 awi_txint(sc)
 823         struct awi_softc *sc;
 824 {
 825         struct ifnet *ifp = sc->sc_ifp;
 826         u_int8_t flags;
 827
 828         while (sc->sc_txdone != sc->sc_txnext) {
 829                 flags = awi_read_1(sc, sc->sc_txdone + AWI_TXD_STATE);
 830                 if ((flags & AWI_TXD_ST_OWN) || !(flags & AWI_TXD_ST_DONE))
 831                         break;
 832                 if (flags & AWI_TXD_ST_ERROR)
 833                         ifp->if_oerrors++;
 834                 sc->sc_txdone = awi_read_4(sc, sc->sc_txdone + AWI_TXD_NEXT) &
 835                     0x7fff;
 836         }
 837         sc->sc_tx_timer = 0;
 838         ifp->if_flags &= ~IFF_OACTIVE;
 839 #ifdef AWI_DEBUG
 840         if (awi_verbose)
 841                 printf("awi_txint: txdone %d txnext %d txbase %d txend %d\n",
 842                     sc->sc_txdone, sc->sc_txnext, sc->sc_txbase, sc->sc_txend);
 843 #endif
 844         awi_start(ifp);
 845 }
 846
 847 static struct mbuf *
 848 awi_fix_txhdr(sc, m0)
 849         struct awi_softc *sc;
 850         struct mbuf *m0;
 851 {
 852         struct ether_header eh;
 853         struct ieee80211_frame *wh;
 854         struct llc *llc;
 855
 856         if (m0->m_len < sizeof(eh)) {
 857                 m0 = m_pullup(m0, sizeof(eh));
 858                 if (m0 == NULL)
 859                         return NULL;
 860         }
 861         memcpy(&eh, mtod(m0, caddr_t), sizeof(eh));
 862         if (sc->sc_format_llc) {
 863                 m_adj(m0, sizeof(struct ether_header) - sizeof(struct llc));
 864                 llc = mtod(m0, struct llc *);
 865                 llc->llc_dsap = llc->llc_ssap = LLC_SNAP_LSAP;
 866                 llc->llc_control = LLC_UI;
 867                 llc->llc_snap.org_code[0] = llc->llc_snap.org_code[1] =
 868                     llc->llc_snap.org_code[2] = 0;
 869                 llc->llc_snap.ether_type = eh.ether_type;
 870         }
 871         M_PREPEND(m0, sizeof(struct ieee80211_frame), MB_DONTWAIT);
 872         if (m0 == NULL)
 873                 return NULL;
 874         wh = mtod(m0, struct ieee80211_frame *);
 875
 876         wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_DATA;
 877         LE_WRITE_2(wh->i_dur, 0);
 878         LE_WRITE_2(wh->i_seq, 0);
 879         if (sc->sc_mib_local.Network_Mode) {
 880                 wh->i_fc[1] = IEEE80211_FC1_DIR_TODS;
 881                 memcpy(wh->i_addr1, sc->sc_bss.bssid, ETHER_ADDR_LEN);
 882                 memcpy(wh->i_addr2, eh.ether_shost, ETHER_ADDR_LEN);
 883                 memcpy(wh->i_addr3, eh.ether_dhost, ETHER_ADDR_LEN);
 884         } else {
 885                 wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
 886                 memcpy(wh->i_addr1, eh.ether_dhost, ETHER_ADDR_LEN);
 887                 memcpy(wh->i_addr2, eh.ether_shost, ETHER_ADDR_LEN);
 888                 memcpy(wh->i_addr3, sc->sc_bss.bssid, ETHER_ADDR_LEN);
 889         }
 890         return m0;
 891 }
 892
 893 static struct mbuf *
 894 awi_fix_rxhdr(sc, m0)
 895         struct awi_softc *sc;
 896         struct mbuf *m0;
 897 {
 898         struct ieee80211_frame wh;
 899         struct ether_header *eh;
 900         struct llc *llc;
 901
 902         if (m0->m_len < sizeof(wh)) {
 903                 m_freem(m0);
 904                 return NULL;
 905         }
 906         llc = (struct llc *)(mtod(m0, caddr_t) + sizeof(wh));
 907         if (llc->llc_dsap == LLC_SNAP_LSAP &&
 908             llc->llc_ssap == LLC_SNAP_LSAP &&
 909             llc->llc_control == LLC_UI &&
 910             llc->llc_snap.org_code[0] == 0 &&
 911             llc->llc_snap.org_code[1] == 0 &&
 912             llc->llc_snap.org_code[2] == 0) {
 913                 memcpy(&wh, mtod(m0, caddr_t), sizeof(wh));
 914                 m_adj(m0, sizeof(wh) + sizeof(*llc) - sizeof(*eh));
 915                 eh = mtod(m0, struct ether_header *);
 916                 switch (wh.i_fc[1] & IEEE80211_FC1_DIR_MASK) {
 917                 case IEEE80211_FC1_DIR_NODS:
 918                         memcpy(eh->ether_dhost, wh.i_addr1, ETHER_ADDR_LEN);
 919                         memcpy(eh->ether_shost, wh.i_addr2, ETHER_ADDR_LEN);
 920                         break;
 921                 case IEEE80211_FC1_DIR_TODS:
 922                         memcpy(eh->ether_dhost, wh.i_addr3, ETHER_ADDR_LEN);
 923                         memcpy(eh->ether_shost, wh.i_addr2, ETHER_ADDR_LEN);
 924                         break;
 925                 case IEEE80211_FC1_DIR_FROMDS:
 926                         memcpy(eh->ether_dhost, wh.i_addr1, ETHER_ADDR_LEN);
 927                         memcpy(eh->ether_shost, wh.i_addr3, ETHER_ADDR_LEN);
 928                         break;
 929                 case IEEE80211_FC1_DIR_DSTODS:
 930                         m_freem(m0);
 931                         return NULL;
 932                 }
 933         } else {
 934                 /* assuming ethernet encapsulation, just strip 802.11 header */
 935                 m_adj(m0, sizeof(wh));
 936         }
 937         if (ALIGN(mtod(m0, caddr_t) + sizeof(struct ether_header)) !=
 938             (u_int)(mtod(m0, caddr_t) + sizeof(struct ether_header))) {
 939                 /* XXX: we loose to estimate the type of encapsulation */
 940                 struct mbuf *n, *n0, **np;
 941                 caddr_t newdata;
 942                 int off;
 943
 944                 n0 = NULL;
 945                 np = &n0;
 946                 off = 0;
 947                 while (m0->m_pkthdr.len > off) {
 948                         int msize;
 949
 950                         n = m_getl(m0->m_pkthdr.len - off, MB_DONTWAIT,
 951                                    MT_DATA, n0 == NULL ? M_PKTHDR : 0, &msize);
 952                         if (n == NULL) {
 953                                 m_freem(m0);
 954                                 return (NULL);
 955                         }
 956                         n->m_len = msize;
 957                         if (n0 == NULL) {
 958                                 M_MOVE_PKTHDR(n, m0);
 959                                 newdata = (caddr_t)
 960                                     ALIGN(n->m_data
 961                                     + sizeof(struct ether_header))
 962                                     - sizeof(struct ether_header);
 963                                 n->m_len -= newdata - n->m_data;
 964                                 n->m_data = newdata;
 965                         }
 966                         if (n->m_len > m0->m_pkthdr.len - off)
 967                                 n->m_len = m0->m_pkthdr.len - off;
 968                         m_copydata(m0, off, n->m_len, mtod(n, caddr_t));
 969                         off += n->m_len;
 970                         *np = n;
 971                         np = &n->m_next;
 972                 }
 973                 m_freem(m0);
 974                 m0 = n0;
 975         }
 976         return m0;
 977 }
 978
 979 static void
 980 awi_input(sc, m, rxts, rssi)
 981         struct awi_softc *sc;
 982         struct mbuf *m;
 983         u_int32_t rxts;
 984         u_int8_t rssi;
 985 {
 986         struct ifnet *ifp = sc->sc_ifp;
 987         struct ieee80211_frame *wh;
 988
 989         /* trim CRC here for WEP can find its own CRC at the end of packet. */
 990         m_adj(m, -ETHER_CRC_LEN);
 991         AWI_BPF_MTAP(sc, m, AWI_BPF_RAW);
 992         wh = mtod(m, struct ieee80211_frame *);
 993         if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
 994             IEEE80211_FC0_VERSION_0) {
 995                 if_printf(ifp, "receive packet with wrong version: %x\n",
 996                           wh->i_fc[0]);
 997                 m_freem(m);
 998                 ifp->if_ierrors++;
 999                 return;
1000         }
1001         if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1002                 m = awi_wep_encrypt(sc, m, 0);
1003                 if (m == NULL) {
1004                         ifp->if_ierrors++;
1005                         return;
1006                 }
1007                 wh = mtod(m, struct ieee80211_frame *);
1008         }
1009 #ifdef AWI_DEBUG
1010         if (awi_dump)
1011                 awi_dump_pkt(sc, m, rssi);
1012 #endif
1013
1014         if ((sc->sc_mib_local.Network_Mode || !sc->sc_no_bssid) &&
1015             sc->sc_status == AWI_ST_RUNNING) {
1016                 if (memcmp(wh->i_addr2, sc->sc_bss.bssid, ETHER_ADDR_LEN) == 0) {
1017                         sc->sc_rx_timer = 10;
1018                         sc->sc_bss.rssi = rssi;
1019                 }
1020         }
1021         switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
1022         case IEEE80211_FC0_TYPE_DATA:
1023                 if (sc->sc_mib_local.Network_Mode) {
1024                         if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) !=
1025                             IEEE80211_FC1_DIR_FROMDS) {
1026                                 m_freem(m);
1027                                 return;
1028                         }
1029                 } else {
1030                         if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) !=
1031                             IEEE80211_FC1_DIR_NODS) {
1032                                 m_freem(m);
1033                                 return;
1034                         }
1035                 }
1036                 m = awi_fix_rxhdr(sc, m);
1037                 if (m == NULL) {
1038                         ifp->if_ierrors++;
1039                         break;
1040                 }
1041                 ifp->if_ipackets++;
1042                 (*ifp->if_input)(ifp, m);
1043                 break;
1044         case IEEE80211_FC0_TYPE_MGT:
1045                 if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) !=
1046                    IEEE80211_FC1_DIR_NODS) {
1047                         m_freem(m);
1048                         return;
1049                 }
1050                 switch (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) {
1051                 case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
1052                 case IEEE80211_FC0_SUBTYPE_BEACON:
1053                         awi_recv_beacon(sc, m, rxts, rssi);
1054                         break;
1055                 case IEEE80211_FC0_SUBTYPE_AUTH:
1056                         awi_recv_auth(sc, m);
1057                         break;
1058                 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
1059                 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
1060                         awi_recv_asresp(sc, m);
1061                         break;
1062                 case IEEE80211_FC0_SUBTYPE_DEAUTH:
1063                         if (sc->sc_mib_local.Network_Mode)
1064                                 awi_send_auth(sc, 1);
1065                         break;
1066                 case IEEE80211_FC0_SUBTYPE_DISASSOC:
1067                         if (sc->sc_mib_local.Network_Mode)
1068                                 awi_send_asreq(sc, 1);
1069                         break;
1070                 }
1071                 m_freem(m);
1072                 break;
1073         case IEEE80211_FC0_TYPE_CTL:
1074         default:
1075                 /* should not come here */
1076                 m_freem(m);
1077                 break;
1078         }
1079 }
1080
1081 static void
1082 awi_rxint(sc)
1083         struct awi_softc *sc;
1084 {
1085         u_int8_t state, rate, rssi;
1086         u_int16_t len;
1087         u_int32_t frame, next, rxts, rxoff;
1088         struct mbuf *m;
1089
1090         rxoff = sc->sc_rxdoff;
1091         for (;;) {
1092                 state = awi_read_1(sc, rxoff + AWI_RXD_HOST_DESC_STATE);
1093                 if (state & AWI_RXD_ST_OWN)
1094                         break;
1095                 if (!(state & AWI_RXD_ST_CONSUMED)) {
1096                         if (state & AWI_RXD_ST_RXERROR)
1097                                 sc->sc_ifp->if_ierrors++;
1098                         else {
1099                                 len   = awi_read_2(sc, rxoff + AWI_RXD_LEN);
1100                                 rate  = awi_read_1(sc, rxoff + AWI_RXD_RATE);
1101                                 rssi  = awi_read_1(sc, rxoff + AWI_RXD_RSSI);
1102                                 frame = awi_read_4(sc, rxoff + AWI_RXD_START_FRAME) & 0x7fff;
1103                                 rxts  = awi_read_4(sc, rxoff + AWI_RXD_LOCALTIME);
1104                                 m = awi_devget(sc, frame, len);
1105                                 if (state & AWI_RXD_ST_LF)
1106                                         awi_input(sc, m, rxts, rssi);
1107                                 else
1108                                         sc->sc_rxpend = m;
1109                         }
1110                         state |= AWI_RXD_ST_CONSUMED;
1111                         awi_write_1(sc, rxoff + AWI_RXD_HOST_DESC_STATE, state);
1112                 }
1113                 next  = awi_read_4(sc, rxoff + AWI_RXD_NEXT);
1114                 if (next & AWI_RXD_NEXT_LAST)
1115                         break;
1116                 /* make sure the next pointer is correct */
1117                 if (next != awi_read_4(sc, rxoff + AWI_RXD_NEXT))
1118                         break;
1119                 state |= AWI_RXD_ST_OWN;
1120                 awi_write_1(sc, rxoff + AWI_RXD_HOST_DESC_STATE, state);
1121                 rxoff = next & 0x7fff;
1122         }
1123         sc->sc_rxdoff = rxoff;
1124 }
1125
1126 static struct mbuf *
1127 awi_devget(sc, off, len)
1128         struct awi_softc *sc;
1129         u_int32_t off;
1130         u_int16_t len;
1131 {
1132         struct mbuf *m;
1133         struct mbuf *top, **mp;
1134         u_int tlen;
1135         int msize;
1136
1137         top = sc->sc_rxpend;
1138         mp = &top;
1139         if (top != NULL) {
1140                 sc->sc_rxpend = NULL;
1141                 top->m_pkthdr.len += len;
1142                 m = top;
1143                 while (*mp != NULL) {
1144                         m = *mp;
1145                         mp = &m->m_next;
1146                 }
1147                 if (m->m_flags & M_EXT)
1148                         tlen = m->m_ext.ext_size;
1149                 else if (m->m_flags & M_PKTHDR)
1150                         tlen = MHLEN;
1151                 else
1152                         tlen = MLEN;
1153                 tlen -= m->m_len;
1154                 if (tlen > len)
1155                         tlen = len;
1156                 awi_read_bytes(sc, off, mtod(m, u_int8_t *) + m->m_len, tlen);
1157                 off += tlen;
1158                 len -= tlen;
1159         }
1160
1161         while (len > 0) {
1162                 m = m_getl(len, MB_DONTWAIT, MT_DATA,
1163                            top == NULL ? M_PKTHDR : 0, &msize);
1164                 if (m == NULL) {
1165                         m_freem(top);
1166                         return (NULL);
1167                 }
1168                 m->m_len = msize;
1169                 if (top == NULL) {
1170                         int hdrlen = sizeof(struct ieee80211_frame) +
1171                             (sc->sc_format_llc ? sizeof(struct llc) :
1172                             sizeof(struct ether_header));
1173                         caddr_t newdata = (caddr_t)
1174                             ALIGN(m->m_data + hdrlen) - hdrlen;
1175
1176                         m->m_pkthdr.rcvif = sc->sc_ifp;
1177                         m->m_pkthdr.len = len;
1178                         m->m_len -= newdata - m->m_data;
1179                         m->m_data = newdata;
1180                 }
1181                 if (m->m_len > len)
1182                         m->m_len = len;
1183                 awi_read_bytes(sc, off, mtod(m, u_int8_t *), m->m_len);
1184                 off += m->m_len;
1185                 len -= m->m_len;
1186                 *mp = m;
1187                 mp = &m->m_next;
1188         }
1189         return top;
1190 }
1191
1192 /*
1193  * Initialize hardware and start firmware to accept commands.
1194  * Called everytime after power on firmware.
1195  */
1196
1197 static int
1198 awi_init_hw(sc)
1199         struct awi_softc *sc;
1200 {
1201         struct ifnet *ifp = sc->sc_ifp;
1202         u_int8_t status;
1203         u_int16_t intmask;
1204         int i, error;
1205
1206         sc->sc_enab_intr = 0;
1207         sc->sc_invalid = 0;     /* XXX: really? */
1208         awi_drvstate(sc, AWI_DRV_RESET);
1209
1210         /* reset firmware */
1211         am79c930_gcr_setbits(&sc->sc_chip, AM79C930_GCR_CORESET);
1212         DELAY(100);
1213         awi_write_1(sc, AWI_SELFTEST, 0);
1214         awi_write_1(sc, AWI_CMD, 0);
1215         awi_write_1(sc, AWI_BANNER, 0);
1216         am79c930_gcr_clearbits(&sc->sc_chip, AM79C930_GCR_CORESET);
1217         DELAY(100);
1218
1219         /* wait for selftest completion */
1220         for (i = 0; ; i++) {
1221                 if (i >= AWI_SELFTEST_TIMEOUT*hz/1000) {
1222                         if_printf(ifp, "failed to complete selftest (timeout)\n");
1223                         return ENXIO;
1224                 }
1225                 status = awi_read_1(sc, AWI_SELFTEST);
1226                 if ((status & 0xf0) == 0xf0)
1227                         break;
1228                 if (sc->sc_cansleep) {
1229                         sc->sc_sleep_cnt++;
1230                         (void)tsleep(sc, 0, "awitst", 1);
1231                         sc->sc_sleep_cnt--;
1232                 } else {
1233                         DELAY(1000*1000/hz);
1234                 }
1235         }
1236         if (status != AWI_SELFTEST_PASSED) {
1237                 if_printf(ifp, "failed to complete selftest (code %x)\n",
1238                           status);
1239                 return ENXIO;
1240         }
1241
1242         /* check banner to confirm firmware write it */
1243         awi_read_bytes(sc, AWI_BANNER, sc->sc_banner, AWI_BANNER_LEN);
1244         if (memcmp(sc->sc_banner, "PCnetMobile:", 12) != 0) {
1245                 if_printf(ifp, "failed to complete selftest (bad banner)\n");
1246                 for (i = 0; i < AWI_BANNER_LEN; i++)
1247                         printf("%s%02x", i ? ":" : "\t", sc->sc_banner[i]);
1248                 printf("\n");
1249                 return ENXIO;
1250         }
1251
1252         /* initializing interrupt */
1253         sc->sc_enab_intr = 1;
1254         error = awi_intr_lock(sc);
1255         if (error)
1256                 return error;
1257         intmask = AWI_INT_GROGGY | AWI_INT_SCAN_CMPLT |
1258             AWI_INT_TX | AWI_INT_RX | AWI_INT_CMD;
1259         awi_write_1(sc, AWI_INTMASK, ~intmask & 0xff);
1260         awi_write_1(sc, AWI_INTMASK2, 0);
1261         awi_write_1(sc, AWI_INTSTAT, 0);
1262         awi_write_1(sc, AWI_INTSTAT2, 0);
1263         awi_intr_unlock(sc);
1264         am79c930_gcr_setbits(&sc->sc_chip, AM79C930_GCR_ENECINT);
1265
1266         /* issueing interface test command */
1267         error = awi_cmd(sc, AWI_CMD_NOP);
1268         if (error) {
1269                 if_printf(ifp, "failed to complete selftest");
1270                 if (error == ENXIO)
1271                         printf(" (no hardware)\n");
1272                 else if (error != EWOULDBLOCK)
1273                         printf(" (error %d)\n", error);
1274                 else if (sc->sc_cansleep)
1275                         printf(" (lost interrupt)\n");
1276                 else
1277                         printf(" (command timeout)\n");
1278         }
1279         return error;
1280 }
1281
1282 /*
1283  * Extract the factory default MIB value from firmware and assign the driver
1284  * default value.
1285  * Called once at attaching the interface.
1286  */
1287
1288 static int
1289 awi_init_mibs(sc)
1290         struct awi_softc *sc;
1291 {
1292         int i, error;
1293         u_int8_t *rate;
1294
1295         if ((error = awi_mib(sc, AWI_CMD_GET_MIB, AWI_MIB_LOCAL)) != 0 ||
1296             (error = awi_mib(sc, AWI_CMD_GET_MIB, AWI_MIB_ADDR)) != 0 ||
1297             (error = awi_mib(sc, AWI_CMD_GET_MIB, AWI_MIB_MAC)) != 0 ||
1298             (error = awi_mib(sc, AWI_CMD_GET_MIB, AWI_MIB_MGT)) != 0 ||
1299             (error = awi_mib(sc, AWI_CMD_GET_MIB, AWI_MIB_PHY)) != 0) {
1300                 if_printf(sc->sc_ifp,
1301                           "failed to get default mib value (error %d)\n",
1302                           error);
1303                 return error;
1304         }
1305
1306         rate = sc->sc_mib_phy.aSuprt_Data_Rates;
1307         sc->sc_tx_rate = AWI_RATE_1MBIT;
1308         for (i = 0; i < rate[1]; i++) {
1309                 if (AWI_80211_RATE(rate[2 + i]) > sc->sc_tx_rate)
1310                         sc->sc_tx_rate = AWI_80211_RATE(rate[2 + i]);
1311         }
1312         awi_init_region(sc);
1313         memset(&sc->sc_mib_mac.aDesired_ESS_ID, 0, AWI_ESS_ID_SIZE);
1314         sc->sc_mib_mac.aDesired_ESS_ID[0] = IEEE80211_ELEMID_SSID;
1315         sc->sc_mib_local.Fragmentation_Dis = 1;
1316         sc->sc_mib_local.Accept_All_Multicast_Dis = 1;
1317         sc->sc_mib_local.Power_Saving_Mode_Dis = 1;
1318
1319         /* allocate buffers */
1320         sc->sc_txbase = AWI_BUFFERS;
1321         sc->sc_txend = sc->sc_txbase +
1322             (AWI_TXD_SIZE + sizeof(struct ieee80211_frame) +
1323             sizeof(struct ether_header) + ETHERMTU) * AWI_NTXBUFS;
1324         LE_WRITE_4(&sc->sc_mib_local.Tx_Buffer_Offset, sc->sc_txbase);
1325         LE_WRITE_4(&sc->sc_mib_local.Tx_Buffer_Size,
1326             sc->sc_txend - sc->sc_txbase);
1327         LE_WRITE_4(&sc->sc_mib_local.Rx_Buffer_Offset, sc->sc_txend);
1328         LE_WRITE_4(&sc->sc_mib_local.Rx_Buffer_Size,
1329             AWI_BUFFERS_END - sc->sc_txend);
1330         sc->sc_mib_local.Network_Mode = 1;
1331         sc->sc_mib_local.Acting_as_AP = 0;
1332         return 0;
1333 }
1334
1335 /*
1336  * Start transmitter and receiver of firmware
1337  * Called after awi_init_hw() to start operation.
1338  */
1339
1340 static int
1341 awi_init_txrx(sc)
1342         struct awi_softc *sc;
1343 {
1344         int error;
1345
1346         /* start transmitter */
1347         sc->sc_txdone = sc->sc_txnext = sc->sc_txbase;
1348         awi_write_4(sc, sc->sc_txbase + AWI_TXD_START, 0);
1349         awi_write_4(sc, sc->sc_txbase + AWI_TXD_NEXT, 0);
1350         awi_write_4(sc, sc->sc_txbase + AWI_TXD_LENGTH, 0);
1351         awi_write_1(sc, sc->sc_txbase + AWI_TXD_RATE, 0);
1352         awi_write_4(sc, sc->sc_txbase + AWI_TXD_NDA, 0);
1353         awi_write_4(sc, sc->sc_txbase + AWI_TXD_NRA, 0);
1354         awi_write_1(sc, sc->sc_txbase + AWI_TXD_STATE, 0);
1355         awi_write_4(sc, AWI_CMD_PARAMS+AWI_CA_TX_DATA, sc->sc_txbase);
1356         awi_write_4(sc, AWI_CMD_PARAMS+AWI_CA_TX_MGT, 0);
1357         awi_write_4(sc, AWI_CMD_PARAMS+AWI_CA_TX_BCAST, 0);
1358         awi_write_4(sc, AWI_CMD_PARAMS+AWI_CA_TX_PS, 0);
1359         awi_write_4(sc, AWI_CMD_PARAMS+AWI_CA_TX_CF, 0);
1360         error = awi_cmd(sc, AWI_CMD_INIT_TX);
1361         if (error)
1362                 return error;
1363
1364         /* start receiver */
1365         if (sc->sc_rxpend) {
1366                 m_freem(sc->sc_rxpend);
1367                 sc->sc_rxpend = NULL;
1368         }
1369         error = awi_cmd(sc, AWI_CMD_INIT_RX);
1370         if (error)
1371                 return error;
1372         sc->sc_rxdoff = awi_read_4(sc, AWI_CMD_PARAMS+AWI_CA_IRX_DATA_DESC);
1373         sc->sc_rxmoff = awi_read_4(sc, AWI_CMD_PARAMS+AWI_CA_IRX_PS_DESC);
1374         return 0;
1375 }
1376
1377 static void
1378 awi_stop_txrx(sc)
1379         struct awi_softc *sc;
1380 {
1381
1382         if (sc->sc_cmd_inprog)
1383                 (void)awi_cmd_wait(sc);
1384         (void)awi_cmd(sc, AWI_CMD_KILL_RX);
1385         (void)awi_cmd_wait(sc);
1386         sc->sc_cmd_inprog = AWI_CMD_FLUSH_TX;
1387         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_FTX_DATA, 1);
1388         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_FTX_MGT, 0);
1389         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_FTX_BCAST, 0);
1390         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_FTX_PS, 0);
1391         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_FTX_CF, 0);
1392         (void)awi_cmd(sc, AWI_CMD_FLUSH_TX);
1393         (void)awi_cmd_wait(sc);
1394 }
1395
1396 int
1397 awi_init_region(sc)
1398         struct awi_softc *sc;
1399 {
1400
1401         if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH) {
1402                 switch (sc->sc_mib_phy.aCurrent_Reg_Domain) {
1403                 case AWI_REG_DOMAIN_US:
1404                 case AWI_REG_DOMAIN_CA:
1405                 case AWI_REG_DOMAIN_EU:
1406                         sc->sc_scan_min = 0;
1407                         sc->sc_scan_max = 77;
1408                         break;
1409                 case AWI_REG_DOMAIN_ES:
1410                         sc->sc_scan_min = 0;
1411                         sc->sc_scan_max = 26;
1412                         break;
1413                 case AWI_REG_DOMAIN_FR:
1414                         sc->sc_scan_min = 0;
1415                         sc->sc_scan_max = 32;
1416                         break;
1417                 case AWI_REG_DOMAIN_JP:
1418                         sc->sc_scan_min = 6;
1419                         sc->sc_scan_max = 17;
1420                         break;
1421                 default:
1422                         return EINVAL;
1423                 }
1424                 sc->sc_scan_set = sc->sc_scan_cur % 3 + 1;
1425         } else {
1426                 switch (sc->sc_mib_phy.aCurrent_Reg_Domain) {
1427                 case AWI_REG_DOMAIN_US:
1428                 case AWI_REG_DOMAIN_CA:
1429                         sc->sc_scan_min = 1;
1430                         sc->sc_scan_max = 11;
1431                         sc->sc_scan_cur = 3;
1432                         break;
1433                 case AWI_REG_DOMAIN_EU:
1434                         sc->sc_scan_min = 1;
1435                         sc->sc_scan_max = 13;
1436                         sc->sc_scan_cur = 3;
1437                         break;
1438                 case AWI_REG_DOMAIN_ES:
1439                         sc->sc_scan_min = 10;
1440                         sc->sc_scan_max = 11;
1441                         sc->sc_scan_cur = 10;
1442                         break;
1443                 case AWI_REG_DOMAIN_FR:
1444                         sc->sc_scan_min = 10;
1445                         sc->sc_scan_max = 13;
1446                         sc->sc_scan_cur = 10;
1447                         break;
1448                 case AWI_REG_DOMAIN_JP:
1449                         sc->sc_scan_min = 14;
1450                         sc->sc_scan_max = 14;
1451                         sc->sc_scan_cur = 14;
1452                         break;
1453                 default:
1454                         return EINVAL;
1455                 }
1456         }
1457         sc->sc_ownch = sc->sc_scan_cur;
1458         return 0;
1459 }
1460
1461 static int
1462 awi_start_scan(sc)
1463         struct awi_softc *sc;
1464 {
1465         int error = 0;
1466         struct awi_bss *bp;
1467
1468         while ((bp = TAILQ_FIRST(&sc->sc_scan)) != NULL) {
1469                 TAILQ_REMOVE(&sc->sc_scan, bp, list);
1470                 free(bp, M_DEVBUF);
1471         }
1472         if (!sc->sc_mib_local.Network_Mode && sc->sc_no_bssid) {
1473                 memset(&sc->sc_bss, 0, sizeof(sc->sc_bss));
1474                 sc->sc_bss.essid[0] = IEEE80211_ELEMID_SSID;
1475                 if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH) {
1476                         sc->sc_bss.chanset = sc->sc_ownch % 3 + 1;
1477                         sc->sc_bss.pattern = sc->sc_ownch;
1478                         sc->sc_bss.index = 1;
1479                         sc->sc_bss.dwell_time = 200;    /*XXX*/
1480                 } else
1481                         sc->sc_bss.chanset = sc->sc_ownch;
1482                 sc->sc_status = AWI_ST_SETSS;
1483                 error = awi_set_ss(sc);
1484         } else {
1485                 if (sc->sc_mib_local.Network_Mode)
1486                         awi_drvstate(sc, AWI_DRV_INFSC);
1487                 else
1488                         awi_drvstate(sc, AWI_DRV_ADHSC);
1489                 sc->sc_start_bss = 0;
1490                 sc->sc_active_scan = 1;
1491                 sc->sc_mgt_timer = AWI_ASCAN_WAIT / 1000;
1492                 sc->sc_ifp->if_timer = 1;
1493                 sc->sc_status = AWI_ST_SCAN;
1494                 error = awi_cmd_scan(sc);
1495         }
1496         return error;
1497 }
1498
1499 static int
1500 awi_next_scan(sc)
1501         struct awi_softc *sc;
1502 {
1503         int error;
1504
1505         for (;;) {
1506                 /*
1507                  * The pattern parameter for FH phy should be incremented
1508                  * by 3.  But BayStack 650 Access Points apparently always
1509                  * assign hop pattern set parameter to 1 for any pattern.
1510                  * So we try all combinations of pattern/set parameters.
1511                  * Since this causes no error, it may be a bug of
1512                  * PCnetMobile firmware.
1513                  */
1514                 sc->sc_scan_cur++;
1515                 if (sc->sc_scan_cur > sc->sc_scan_max) {
1516                         sc->sc_scan_cur = sc->sc_scan_min;
1517                         if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH)
1518                                 sc->sc_scan_set = sc->sc_scan_set % 3 + 1;
1519                 }
1520                 error = awi_cmd_scan(sc);
1521                 if (error != EINVAL)
1522                         break;
1523         }
1524         return error;
1525 }
1526
1527 static void
1528 awi_stop_scan(sc)
1529         struct awi_softc *sc;
1530 {
1531         struct ifnet *ifp = sc->sc_ifp;
1532         struct awi_bss *bp, *sbp;
1533         int fail;
1534
1535         bp = TAILQ_FIRST(&sc->sc_scan);
1536         if (bp == NULL) {
1537   notfound:
1538                 if (sc->sc_active_scan) {
1539                         if (ifp->if_flags & IFF_DEBUG)
1540                                 if_printf(ifp, "entering passive scan mode\n");
1541                         sc->sc_active_scan = 0;
1542                 }
1543                 sc->sc_mgt_timer = AWI_PSCAN_WAIT / 1000;
1544                 ifp->if_timer = 1;
1545                 (void)awi_next_scan(sc);
1546                 return;
1547         }
1548         sbp = NULL;
1549         if (ifp->if_flags & IFF_DEBUG)
1550                 if_printf(ifp, "\tmacaddr     ch/pat   sig flag  wep  essid\n");
1551         for (; bp != NULL; bp = TAILQ_NEXT(bp, list)) {
1552                 if (bp->fails) {
1553                         /*
1554                          * The configuration of the access points may change
1555                          * during my scan.  So we retries to associate with
1556                          * it unless there are any suitable AP.
1557                          */
1558                         if (bp->fails++ < 3)
1559                                 continue;
1560                         bp->fails = 0;
1561                 }
1562                 fail = 0;
1563                 /*
1564                  * Since the firmware apparently scans not only the specified
1565                  * channel of SCAN command but all available channel within
1566                  * the region, we should filter out unnecessary responses here.
1567                  */
1568                 if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH) {
1569                         if (bp->pattern < sc->sc_scan_min ||
1570                             bp->pattern > sc->sc_scan_max)
1571                                 fail |= 0x01;
1572                 } else {
1573                         if (bp->chanset < sc->sc_scan_min ||
1574                             bp->chanset > sc->sc_scan_max)
1575                                 fail |= 0x01;
1576                 }
1577                 if (sc->sc_mib_local.Network_Mode) {
1578                         if (!(bp->capinfo & IEEE80211_CAPINFO_ESS) ||
1579                             (bp->capinfo & IEEE80211_CAPINFO_IBSS))
1580                                 fail |= 0x02;
1581                 } else {
1582                         if ((bp->capinfo & IEEE80211_CAPINFO_ESS) ||
1583                             !(bp->capinfo & IEEE80211_CAPINFO_IBSS))
1584                                 fail |= 0x02;
1585                 }
1586                 if (sc->sc_wep_algo == NULL) {
1587                         if (bp->capinfo & IEEE80211_CAPINFO_PRIVACY)
1588                                 fail |= 0x04;
1589                 } else {
1590                         if (!(bp->capinfo & IEEE80211_CAPINFO_PRIVACY))
1591                                 fail |= 0x04;
1592                 }
1593                 if (sc->sc_mib_mac.aDesired_ESS_ID[1] != 0 &&
1594                     memcmp(&sc->sc_mib_mac.aDesired_ESS_ID, bp->essid,
1595                     sizeof(bp->essid)) != 0)
1596                         fail |= 0x08;
1597                 if (ifp->if_flags & IFF_DEBUG) {
1598                         printf(" %c %6D", fail ? '-' : '+', bp->esrc, ":");
1599                         if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH)
1600                                 printf("  %2d/%d%c", bp->pattern, bp->chanset,
1601                                     fail & 0x01 ? '!' : ' ');
1602                         else
1603                                 printf("  %4d%c", bp->chanset,
1604                                     fail & 0x01 ? '!' : ' ');
1605                         printf(" %+4d", bp->rssi);
1606                         printf(" %4s%c",
1607                             (bp->capinfo & IEEE80211_CAPINFO_ESS) ? "ess" :
1608                             (bp->capinfo & IEEE80211_CAPINFO_IBSS) ? "ibss" :
1609                             "????",
1610                             fail & 0x02 ? '!' : ' ');
1611                         printf(" %3s%c ",
1612                             (bp->capinfo & IEEE80211_CAPINFO_PRIVACY) ? "wep" :
1613                             "no",
1614                             fail & 0x04 ? '!' : ' ');
1615                         awi_print_essid(bp->essid);
1616                         printf("%s\n", fail & 0x08 ? "!" : "");
1617                 }
1618                 if (!fail) {
1619                         if (sbp == NULL || bp->rssi > sbp->rssi)
1620                                 sbp = bp;
1621                 }
1622         }
1623         if (sbp == NULL)
1624                 goto notfound;
1625         sc->sc_bss = *sbp;
1626         (void)awi_set_ss(sc);
1627 }
1628
1629 static void
1630 awi_recv_beacon(sc, m0, rxts, rssi)
1631         struct awi_softc *sc;
1632         struct mbuf *m0;
1633         u_int32_t rxts;
1634         u_int8_t rssi;
1635 {
1636         struct ieee80211_frame *wh;
1637         struct awi_bss *bp;
1638         u_int8_t *frame, *eframe;
1639         u_int8_t *tstamp, *bintval, *capinfo, *ssid, *rates, *parms;
1640
1641         if (sc->sc_status != AWI_ST_SCAN)
1642                 return;
1643         wh = mtod(m0, struct ieee80211_frame *);
1644
1645         frame = (u_int8_t *)&wh[1];
1646         eframe = mtod(m0, u_int8_t *) + m0->m_len;
1647         /*
1648          * XXX:
1649          *      timestamp [8]
1650          *      beacon interval [2]
1651          *      capability information [2]
1652          *      ssid [tlv]
1653          *      supported rates [tlv]
1654          *      parameter set [tlv]
1655          *      ...
1656          */
1657         if (frame + 12 > eframe) {
1658 #ifdef AWI_DEBUG
1659                 if (awi_verbose)
1660                         printf("awi_recv_beacon: frame too short \n");
1661 #endif
1662                 return;
1663         }
1664         tstamp = frame;
1665         frame += 8;
1666         bintval = frame;
1667         frame += 2;
1668         capinfo = frame;
1669         frame += 2;
1670
1671         ssid = rates = parms = NULL;
1672         while (frame < eframe) {
1673                 switch (*frame) {
1674                 case IEEE80211_ELEMID_SSID:
1675                         ssid = frame;
1676                         break;
1677                 case IEEE80211_ELEMID_RATES:
1678                         rates = frame;
1679                         break;
1680                 case IEEE80211_ELEMID_FHPARMS:
1681                 case IEEE80211_ELEMID_DSPARMS:
1682                         parms = frame;
1683                         break;
1684                 }
1685                 frame += frame[1] + 2;
1686         }
1687         if (ssid == NULL || rates == NULL || parms == NULL) {
1688 #ifdef AWI_DEBUG
1689                 if (awi_verbose)
1690                         printf("awi_recv_beacon: ssid=%p, rates=%p, parms=%p\n",
1691                             ssid, rates, parms);
1692 #endif
1693                 return;
1694         }
1695         if (ssid[1] > IEEE80211_NWID_LEN) {
1696 #ifdef AWI_DEBUG
1697                 if (awi_verbose)
1698                         printf("awi_recv_beacon: bad ssid len: %d from %6D\n",
1699                             ssid[1], wh->i_addr2, ":");
1700 #endif
1701                 return;
1702         }
1703
1704         for (bp = TAILQ_FIRST(&sc->sc_scan); bp != NULL;
1705             bp = TAILQ_NEXT(bp, list)) {
1706                 if (memcmp(bp->esrc, wh->i_addr2, ETHER_ADDR_LEN) == 0 &&
1707                     memcmp(bp->bssid, wh->i_addr3, ETHER_ADDR_LEN) == 0)
1708                         break;
1709         }
1710         if (bp == NULL) {
1711                 bp = malloc(sizeof(struct awi_bss), M_DEVBUF, M_INTWAIT);
1712                 if (bp == NULL)
1713                         return;
1714                 TAILQ_INSERT_TAIL(&sc->sc_scan, bp, list);
1715                 memcpy(bp->esrc, wh->i_addr2, ETHER_ADDR_LEN);
1716                 memcpy(bp->bssid, wh->i_addr3, ETHER_ADDR_LEN);
1717                 memset(bp->essid, 0, sizeof(bp->essid));
1718                 memcpy(bp->essid, ssid, 2 + ssid[1]);
1719         }
1720         bp->rssi = rssi;
1721         bp->rxtime = rxts;
1722         memcpy(bp->timestamp, tstamp, sizeof(bp->timestamp));
1723         bp->interval = LE_READ_2(bintval);
1724         bp->capinfo = LE_READ_2(capinfo);
1725         if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH) {
1726                 bp->chanset = parms[4];
1727                 bp->pattern = parms[5];
1728                 bp->index = parms[6];
1729                 bp->dwell_time = LE_READ_2(parms + 2);
1730         } else {
1731                 bp->chanset = parms[2];
1732                 bp->pattern = 0;
1733                 bp->index = 0;
1734                 bp->dwell_time = 0;
1735         }
1736         if (sc->sc_mgt_timer == 0)
1737                 awi_stop_scan(sc);
1738 }
1739
1740 static int
1741 awi_set_ss(sc)
1742         struct awi_softc *sc;
1743 {
1744         struct ifnet *ifp = sc->sc_ifp;
1745         struct awi_bss *bp;
1746         int error;
1747
1748         sc->sc_status = AWI_ST_SETSS;
1749         bp = &sc->sc_bss;
1750         if (ifp->if_flags & IFF_DEBUG) {
1751                 if_printf(ifp, "ch %d pat %d id %d dw %d iv %d bss %6D ssid ",
1752                           bp->chanset, bp->pattern, bp->index, bp->dwell_time,
1753                           bp->interval, bp->bssid, ":");
1754                 awi_print_essid(bp->essid);
1755                 printf("\n");
1756         }
1757         memcpy(&sc->sc_mib_mgt.aCurrent_BSS_ID, bp->bssid, ETHER_ADDR_LEN);
1758         memcpy(&sc->sc_mib_mgt.aCurrent_ESS_ID, bp->essid,
1759             AWI_ESS_ID_SIZE);
1760         LE_WRITE_2(&sc->sc_mib_mgt.aBeacon_Period, bp->interval);
1761         error = awi_mib(sc, AWI_CMD_SET_MIB, AWI_MIB_MGT);
1762         return error;
1763 }
1764
1765 static void
1766 awi_try_sync(sc)
1767         struct awi_softc *sc;
1768 {
1769         struct awi_bss *bp;
1770
1771         sc->sc_status = AWI_ST_SYNC;
1772         bp = &sc->sc_bss;
1773
1774         if (sc->sc_cmd_inprog) {
1775                 if (awi_cmd_wait(sc))
1776                         return;
1777         }
1778         sc->sc_cmd_inprog = AWI_CMD_SYNC;
1779         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SYNC_SET, bp->chanset);
1780         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SYNC_PATTERN, bp->pattern);
1781         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SYNC_IDX, bp->index);
1782         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SYNC_STARTBSS,
1783             sc->sc_start_bss ? 1 : 0);
1784         awi_write_2(sc, AWI_CMD_PARAMS+AWI_CA_SYNC_DWELL, bp->dwell_time);
1785         awi_write_2(sc, AWI_CMD_PARAMS+AWI_CA_SYNC_MBZ, 0);
1786         awi_write_bytes(sc, AWI_CMD_PARAMS+AWI_CA_SYNC_TIMESTAMP,
1787             bp->timestamp, 8);
1788         awi_write_4(sc, AWI_CMD_PARAMS+AWI_CA_SYNC_REFTIME, bp->rxtime);
1789         (void)awi_cmd(sc, AWI_CMD_SYNC);
1790 }
1791
1792 static void
1793 awi_sync_done(sc)
1794         struct awi_softc *sc;
1795 {
1796         struct ifnet *ifp = sc->sc_ifp;
1797
1798         if (sc->sc_mib_local.Network_Mode) {
1799                 awi_drvstate(sc, AWI_DRV_INFSY);
1800                 awi_send_auth(sc, 1);
1801         } else {
1802                 if (ifp->if_flags & IFF_DEBUG) {
1803                         if_printf(ifp, "synced with");
1804                         if (sc->sc_no_bssid)
1805                                 printf(" no-bssid");
1806                         else {
1807                                 printf(" %6D ssid ", sc->sc_bss.bssid, ":");
1808                                 awi_print_essid(sc->sc_bss.essid);
1809                         }
1810                         if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH)
1811                                 printf(" at chanset %d pattern %d\n",
1812                                     sc->sc_bss.chanset, sc->sc_bss.pattern);
1813                         else
1814                                 printf(" at channel %d\n", sc->sc_bss.chanset);
1815                 }
1816                 awi_drvstate(sc, AWI_DRV_ADHSY);
1817                 sc->sc_status = AWI_ST_RUNNING;
1818                 ifp->if_flags |= IFF_RUNNING;
1819                 awi_start(ifp);
1820         }
1821 }
1822
1823 static void
1824 awi_send_deauth(sc)
1825         struct awi_softc *sc;
1826 {
1827         struct ifnet *ifp = sc->sc_ifp;
1828         struct mbuf *m;
1829         struct ieee80211_frame *wh;
1830         u_int8_t *deauth;
1831
1832         MGETHDR(m, MB_DONTWAIT, MT_DATA);
1833         if (m == NULL)
1834                 return;
1835         if (ifp->if_flags & IFF_DEBUG)
1836                 if_printf(ifp, "sending deauth to %6D\n",
1837                           sc->sc_bss.bssid, ":");
1838
1839         wh = mtod(m, struct ieee80211_frame *);
1840         wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
1841             IEEE80211_FC0_SUBTYPE_AUTH;
1842         wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
1843         LE_WRITE_2(wh->i_dur, 0);
1844         LE_WRITE_2(wh->i_seq, 0);
1845         memcpy(wh->i_addr1, sc->sc_bss.bssid, ETHER_ADDR_LEN);
1846         memcpy(wh->i_addr2, sc->sc_mib_addr.aMAC_Address, ETHER_ADDR_LEN);
1847         memcpy(wh->i_addr3, sc->sc_bss.bssid, ETHER_ADDR_LEN);
1848
1849         deauth = (u_int8_t *)&wh[1];
1850         LE_WRITE_2(deauth, IEEE80211_REASON_AUTH_LEAVE);
1851         deauth += 2;
1852
1853         m->m_pkthdr.len = m->m_len = deauth - mtod(m, u_int8_t *);
1854         IF_ENQUEUE(&sc->sc_mgtq, m);
1855         awi_start(ifp);
1856         awi_drvstate(sc, AWI_DRV_INFTOSS);
1857 }
1858
1859 static void
1860 awi_send_auth(sc, seq)
1861         struct awi_softc *sc;
1862         int seq;
1863 {
1864         struct ifnet *ifp = sc->sc_ifp;
1865         struct mbuf *m;
1866         struct ieee80211_frame *wh;
1867         u_int8_t *auth;
1868
1869         MGETHDR(m, MB_DONTWAIT, MT_DATA);
1870         if (m == NULL)
1871                 return;
1872         sc->sc_status = AWI_ST_AUTH;
1873         if (ifp->if_flags & IFF_DEBUG)
1874                 if_printf(ifp, "sending auth to %6D\n",
1875                           sc->sc_bss.bssid, ":");
1876
1877         wh = mtod(m, struct ieee80211_frame *);
1878         wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
1879             IEEE80211_FC0_SUBTYPE_AUTH;
1880         wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
1881         LE_WRITE_2(wh->i_dur, 0);
1882         LE_WRITE_2(wh->i_seq, 0);
1883         memcpy(wh->i_addr1, sc->sc_bss.esrc, ETHER_ADDR_LEN);
1884         memcpy(wh->i_addr2, sc->sc_mib_addr.aMAC_Address, ETHER_ADDR_LEN);
1885         memcpy(wh->i_addr3, sc->sc_bss.bssid, ETHER_ADDR_LEN);
1886
1887         auth = (u_int8_t *)&wh[1];
1888         /* algorithm number */
1889         LE_WRITE_2(auth, IEEE80211_AUTH_ALG_OPEN);
1890         auth += 2;
1891         /* sequence number */
1892         LE_WRITE_2(auth, seq);
1893         auth += 2;
1894         /* status */
1895         LE_WRITE_2(auth, 0);
1896         auth += 2;
1897
1898         m->m_pkthdr.len = m->m_len = auth - mtod(m, u_int8_t *);
1899         IF_ENQUEUE(&sc->sc_mgtq, m);
1900         awi_start(ifp);
1901
1902         sc->sc_mgt_timer = AWI_TRANS_TIMEOUT / 1000;
1903         ifp->if_timer = 1;
1904 }
1905
1906 static void
1907 awi_recv_auth(sc, m0)
1908         struct awi_softc *sc;
1909         struct mbuf *m0;
1910 {
1911         struct ifnet *ifp = sc->sc_ifp;
1912         struct ieee80211_frame *wh;
1913         u_int8_t *auth, *eframe;
1914         struct awi_bss *bp;
1915         u_int16_t status;
1916
1917         wh = mtod(m0, struct ieee80211_frame *);
1918         auth = (u_int8_t *)&wh[1];
1919         eframe = mtod(m0, u_int8_t *) + m0->m_len;
1920         if (ifp->if_flags & IFF_DEBUG)
1921                 if_printf(ifp, "receive auth from %6D\n", wh->i_addr2, ":");
1922
1923         /* algorithm number */
1924         if (LE_READ_2(auth) != IEEE80211_AUTH_ALG_OPEN)
1925                 return;
1926         auth += 2;
1927         if (!sc->sc_mib_local.Network_Mode) {
1928                 if (sc->sc_status != AWI_ST_RUNNING)
1929                         return;
1930                 if (LE_READ_2(auth) == 1)
1931                         awi_send_auth(sc, 2);
1932                 return;
1933         }
1934         if (sc->sc_status != AWI_ST_AUTH)
1935                 return;
1936         /* sequence number */
1937         if (LE_READ_2(auth) != 2)
1938                 return;
1939         auth += 2;
1940         /* status */
1941         status = LE_READ_2(auth);
1942         if (status != 0) {
1943                 if_printf(ifp, "authentication failed (reason %d)\n", status);
1944                 for (bp = TAILQ_FIRST(&sc->sc_scan); bp != NULL;
1945                     bp = TAILQ_NEXT(bp, list)) {
1946                         if (memcmp(bp->esrc, sc->sc_bss.esrc, ETHER_ADDR_LEN)
1947                             == 0) {
1948                                 bp->fails++;
1949                                 break;
1950                         }
1951                 }
1952                 return;
1953         }
1954         sc->sc_mgt_timer = 0;
1955         awi_drvstate(sc, AWI_DRV_INFAUTH);
1956         awi_send_asreq(sc, 0);
1957 }
1958
1959 static void
1960 awi_send_asreq(sc, reassoc)
1961         struct awi_softc *sc;
1962         int reassoc;
1963 {
1964         struct ifnet *ifp = sc->sc_ifp;
1965         struct mbuf *m;
1966         struct ieee80211_frame *wh;
1967         u_int16_t lintval;
1968         u_int8_t *asreq;
1969
1970         MGETHDR(m, MB_DONTWAIT, MT_DATA);
1971         if (m == NULL)
1972                 return;
1973         sc->sc_status = AWI_ST_ASSOC;
1974         if (ifp->if_flags & IFF_DEBUG)
1975                 if_printf(ifp, "sending %sassoc req to %6D\n",
1976                     reassoc ? "re" : "", sc->sc_bss.bssid, ":");
1977
1978         wh = mtod(m, struct ieee80211_frame *);
1979         wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT;
1980         if (reassoc)
1981                 wh->i_fc[0] |= IEEE80211_FC0_SUBTYPE_REASSOC_REQ;
1982         else
1983                 wh->i_fc[0] |= IEEE80211_FC0_SUBTYPE_ASSOC_REQ;
1984         wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
1985         LE_WRITE_2(wh->i_dur, 0);
1986         LE_WRITE_2(wh->i_seq, 0);
1987         memcpy(wh->i_addr1, sc->sc_bss.esrc, ETHER_ADDR_LEN);
1988         memcpy(wh->i_addr2, sc->sc_mib_addr.aMAC_Address, ETHER_ADDR_LEN);
1989         memcpy(wh->i_addr3, sc->sc_bss.bssid, ETHER_ADDR_LEN);
1990
1991         asreq = (u_int8_t *)&wh[1];
1992
1993         /* capability info */
1994         if (sc->sc_wep_algo == NULL)
1995                 LE_WRITE_2(asreq, IEEE80211_CAPINFO_CF_POLLABLE);
1996         else
1997                 LE_WRITE_2(asreq,
1998                     IEEE80211_CAPINFO_CF_POLLABLE | IEEE80211_CAPINFO_PRIVACY);
1999         asreq += 2;
2000         /* listen interval */
2001         lintval = LE_READ_2(&sc->sc_mib_mgt.aListen_Interval);
2002         LE_WRITE_2(asreq, lintval);
2003         asreq += 2;
2004         if (reassoc) {
2005                 /* current AP address */
2006                 memcpy(asreq, sc->sc_bss.bssid, ETHER_ADDR_LEN);
2007                 asreq += ETHER_ADDR_LEN;
2008         }
2009         /* ssid */
2010         memcpy(asreq, sc->sc_bss.essid, 2 + sc->sc_bss.essid[1]);
2011         asreq += 2 + asreq[1];
2012         /* supported rates */
2013         memcpy(asreq, &sc->sc_mib_phy.aSuprt_Data_Rates, 4);
2014         asreq += 2 + asreq[1];
2015
2016         m->m_pkthdr.len = m->m_len = asreq - mtod(m, u_int8_t *);
2017         IF_ENQUEUE(&sc->sc_mgtq, m);
2018         awi_start(ifp);
2019
2020         sc->sc_mgt_timer = AWI_TRANS_TIMEOUT / 1000;
2021         ifp->if_timer = 1;
2022 }
2023
2024 static void
2025 awi_recv_asresp(sc, m0)
2026         struct awi_softc *sc;
2027         struct mbuf *m0;
2028 {
2029         struct ifnet *ifp = sc->sc_ifp;
2030         struct ieee80211_frame *wh;
2031         u_int8_t *asresp, *eframe;
2032         u_int16_t status;
2033         u_int8_t rate, *phy_rates;
2034         struct awi_bss *bp;
2035         int i, j;
2036
2037         wh = mtod(m0, struct ieee80211_frame *);
2038         asresp = (u_int8_t *)&wh[1];
2039         eframe = mtod(m0, u_int8_t *) + m0->m_len;
2040         if (ifp->if_flags & IFF_DEBUG)
2041                 if_printf(ifp, "receive assoc resp from %6D\n",
2042                           wh->i_addr2, ":");
2043
2044         if (!sc->sc_mib_local.Network_Mode)
2045                 return;
2046
2047         if (sc->sc_status != AWI_ST_ASSOC)
2048                 return;
2049         /* capability info */
2050         asresp += 2;
2051         /* status */
2052         status = LE_READ_2(asresp);
2053         if (status != 0) {
2054                 if_printf(ifp, "association failed (reason %d)\n", status);
2055                 for (bp = TAILQ_FIRST(&sc->sc_scan); bp != NULL;
2056                     bp = TAILQ_NEXT(bp, list)) {
2057                         if (memcmp(bp->esrc, sc->sc_bss.esrc, ETHER_ADDR_LEN)
2058                             == 0) {
2059                                 bp->fails++;
2060                                 break;
2061                         }
2062                 }
2063                 return;
2064         }
2065         asresp += 2;
2066         /* association id */
2067         asresp += 2;
2068         /* supported rates */
2069         rate = AWI_RATE_1MBIT;
2070         for (i = 0; i < asresp[1]; i++) {
2071                 if (AWI_80211_RATE(asresp[2 + i]) <= rate)
2072                         continue;
2073                 phy_rates = sc->sc_mib_phy.aSuprt_Data_Rates;
2074                 for (j = 0; j < phy_rates[1]; j++) {
2075                         if (AWI_80211_RATE(asresp[2 + i]) ==
2076                             AWI_80211_RATE(phy_rates[2 + j]))
2077                                 rate = AWI_80211_RATE(asresp[2 + i]);
2078                 }
2079         }
2080         if (ifp->if_flags & IFF_DEBUG) {
2081                 if_printf(ifp, "associated with %6D ssid ",
2082                           sc->sc_bss.bssid, ":");
2083                 awi_print_essid(sc->sc_bss.essid);
2084                 if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH)
2085                         printf(" chanset %d pattern %d\n",
2086                             sc->sc_bss.chanset, sc->sc_bss.pattern);
2087                 else
2088                         printf(" channel %d\n", sc->sc_bss.chanset);
2089         }
2090         sc->sc_tx_rate = rate;
2091         sc->sc_mgt_timer = 0;
2092         sc->sc_rx_timer = 10;
2093         ifp->if_timer = 1;
2094         sc->sc_status = AWI_ST_RUNNING;
2095         ifp->if_flags |= IFF_RUNNING;
2096         awi_drvstate(sc, AWI_DRV_INFASSOC);
2097         awi_start(ifp);
2098 }
2099
2100 static int
2101 awi_mib(sc, cmd, mib)
2102         struct awi_softc *sc;
2103         u_int8_t cmd;
2104         u_int8_t mib;
2105 {
2106         int error;
2107         u_int8_t size, *ptr;
2108
2109         switch (mib) {
2110         case AWI_MIB_LOCAL:
2111                 ptr = (u_int8_t *)&sc->sc_mib_local;
2112                 size = sizeof(sc->sc_mib_local);
2113                 break;
2114         case AWI_MIB_ADDR:
2115                 ptr = (u_int8_t *)&sc->sc_mib_addr;
2116                 size = sizeof(sc->sc_mib_addr);
2117                 break;
2118         case AWI_MIB_MAC:
2119                 ptr = (u_int8_t *)&sc->sc_mib_mac;
2120                 size = sizeof(sc->sc_mib_mac);
2121                 break;
2122         case AWI_MIB_STAT:
2123                 ptr = (u_int8_t *)&sc->sc_mib_stat;
2124                 size = sizeof(sc->sc_mib_stat);
2125                 break;
2126         case AWI_MIB_MGT:
2127                 ptr = (u_int8_t *)&sc->sc_mib_mgt;
2128                 size = sizeof(sc->sc_mib_mgt);
2129                 break;
2130         case AWI_MIB_PHY:
2131                 ptr = (u_int8_t *)&sc->sc_mib_phy;
2132                 size = sizeof(sc->sc_mib_phy);
2133                 break;
2134         default:
2135                 return EINVAL;
2136         }
2137         if (sc->sc_cmd_inprog) {
2138                 error = awi_cmd_wait(sc);
2139                 if (error) {
2140                         if (error == EWOULDBLOCK)
2141                                 printf("awi_mib: cmd %d inprog",
2142                                     sc->sc_cmd_inprog);
2143                         return error;
2144                 }
2145         }
2146         sc->sc_cmd_inprog = cmd;
2147         if (cmd == AWI_CMD_SET_MIB)
2148                 awi_write_bytes(sc, AWI_CMD_PARAMS+AWI_CA_MIB_DATA, ptr, size);
2149         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_MIB_TYPE, mib);
2150         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_MIB_SIZE, size);
2151         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_MIB_INDEX, 0);
2152         error = awi_cmd(sc, cmd);
2153         if (error)
2154                 return error;
2155         if (cmd == AWI_CMD_GET_MIB) {
2156                 awi_read_bytes(sc, AWI_CMD_PARAMS+AWI_CA_MIB_DATA, ptr, size);
2157 #ifdef AWI_DEBUG
2158                 if (awi_verbose) {
2159                         int i;
2160
2161                         printf("awi_mib: #%d:", mib);
2162                         for (i = 0; i < size; i++)
2163                                 printf(" %02x", ptr[i]);
2164                         printf("\n");
2165                 }
2166 #endif
2167         }
2168         return 0;
2169 }
2170
2171 static int
2172 awi_cmd_scan(sc)
2173         struct awi_softc *sc;
2174 {
2175         int error;
2176         u_int8_t scan_mode;
2177
2178         if (sc->sc_active_scan)
2179                 scan_mode = AWI_SCAN_ACTIVE;
2180         else
2181                 scan_mode = AWI_SCAN_PASSIVE;
2182         if (sc->sc_mib_mgt.aScan_Mode != scan_mode) {
2183                 sc->sc_mib_mgt.aScan_Mode = scan_mode;
2184                 error = awi_mib(sc, AWI_CMD_SET_MIB, AWI_MIB_MGT);
2185                 return error;
2186         }
2187
2188         if (sc->sc_cmd_inprog) {
2189                 error = awi_cmd_wait(sc);
2190                 if (error)
2191                         return error;
2192         }
2193         sc->sc_cmd_inprog = AWI_CMD_SCAN;
2194         awi_write_2(sc, AWI_CMD_PARAMS+AWI_CA_SCAN_DURATION,
2195             sc->sc_active_scan ? AWI_ASCAN_DURATION : AWI_PSCAN_DURATION);
2196         if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH) {
2197                 awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SCAN_SET,
2198                     sc->sc_scan_set);
2199                 awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SCAN_PATTERN,
2200                     sc->sc_scan_cur);
2201                 awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SCAN_IDX, 1);
2202         } else {
2203                 awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SCAN_SET,
2204                     sc->sc_scan_cur);
2205                 awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SCAN_PATTERN, 0);
2206                 awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SCAN_IDX, 0);
2207         }
2208         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SCAN_SUSP, 0);
2209         return awi_cmd(sc, AWI_CMD_SCAN);
2210 }
2211
2212 static int
2213 awi_cmd(sc, cmd)
2214         struct awi_softc *sc;
2215         u_int8_t cmd;
2216 {
2217         u_int8_t status;
2218         int error = 0;
2219
2220         sc->sc_cmd_inprog = cmd;
2221         awi_write_1(sc, AWI_CMD_STATUS, AWI_STAT_IDLE);
2222         awi_write_1(sc, AWI_CMD, cmd);
2223         if (sc->sc_status != AWI_ST_INIT)
2224                 return 0;
2225         error = awi_cmd_wait(sc);
2226         if (error)
2227                 return error;
2228         status = awi_read_1(sc, AWI_CMD_STATUS);
2229         awi_write_1(sc, AWI_CMD, 0);
2230         switch (status) {
2231         case AWI_STAT_OK:
2232                 break;
2233         case AWI_STAT_BADPARM:
2234                 return EINVAL;
2235         default:
2236                 if_printf(sc->sc_ifp, "command %d failed %x\n", cmd, status);
2237                 return ENXIO;
2238         }
2239         return 0;
2240 }
2241
2242 static void
2243 awi_cmd_done(sc)
2244         struct awi_softc *sc;
2245 {
2246         u_int8_t cmd, status;
2247
2248         status = awi_read_1(sc, AWI_CMD_STATUS);
2249         if (status == AWI_STAT_IDLE)
2250                 return;         /* stray interrupt */
2251
2252         cmd = sc->sc_cmd_inprog;
2253         sc->sc_cmd_inprog = 0;
2254         if (sc->sc_status == AWI_ST_INIT) {
2255                 wakeup(sc);
2256                 return;
2257         }
2258         awi_write_1(sc, AWI_CMD, 0);
2259
2260         if (status != AWI_STAT_OK) {
2261                 if_printf(sc->sc_ifp, "command %d failed %x\n", cmd, status);
2262                 return;
2263         }
2264         switch (sc->sc_status) {
2265         case AWI_ST_SCAN:
2266                 if (cmd == AWI_CMD_SET_MIB)
2267                         awi_cmd_scan(sc);       /* retry */
2268                 break;
2269         case AWI_ST_SETSS:
2270                 awi_try_sync(sc);
2271                 break;
2272         case AWI_ST_SYNC:
2273                 awi_sync_done(sc);
2274                 break;
2275         default:
2276                 break;
2277         }
2278 }
2279
2280 static int
2281 awi_next_txd(sc, len, framep, ntxdp)
2282         struct awi_softc *sc;
2283         int len;
2284         u_int32_t *framep, *ntxdp;
2285 {
2286         u_int32_t txd, ntxd, frame;
2287
2288         txd = sc->sc_txnext;
2289         frame = txd + AWI_TXD_SIZE;
2290         if (frame + len > sc->sc_txend)
2291                 frame = sc->sc_txbase;
2292         ntxd = frame + len;
2293         if (ntxd + AWI_TXD_SIZE > sc->sc_txend)
2294                 ntxd = sc->sc_txbase;
2295         *framep = frame;
2296         *ntxdp = ntxd;
2297         /*
2298          * Determine if there are any room in ring buffer.
2299          *              --- send wait,  === new data,  +++ conflict (ENOBUFS)
2300          *   base........................end
2301          *         done----txd=====ntxd         OK
2302          *       --txd=====done++++ntxd--       full
2303          *       --txd=====ntxd    done--       OK
2304          *       ==ntxd    done----txd===       OK
2305          *       ==done++++ntxd----txd===       full
2306          *       ++ntxd    txd=====done++       full
2307          */
2308         if (txd < ntxd) {
2309                 if (txd < sc->sc_txdone && ntxd + AWI_TXD_SIZE > sc->sc_txdone)
2310                         return ENOBUFS;
2311         } else {
2312                 if (txd < sc->sc_txdone || ntxd + AWI_TXD_SIZE > sc->sc_txdone)
2313                         return ENOBUFS;
2314         }
2315         return 0;
2316 }
2317
2318 static int
2319 awi_lock(sc)
2320         struct awi_softc *sc;
2321 {
2322         int error = 0;
2323
2324         if (curproc == NULL) {
2325                 /*
2326                  * XXX
2327                  * Though driver ioctl should be called with context,
2328                  * KAME ipv6 stack calls ioctl in interrupt for now.
2329                  * We simply abort the request if there are other
2330                  * ioctl requests in progress.
2331                  */
2332                 if (sc->sc_busy) {
2333                         return EWOULDBLOCK;
2334                         if (sc->sc_invalid)
2335                                 return ENXIO;
2336                 }
2337                 sc->sc_busy = 1;
2338                 sc->sc_cansleep = 0;
2339                 return 0;
2340         }
2341         while (sc->sc_busy) {
2342                 if (sc->sc_invalid)
2343                         return ENXIO;
2344                 sc->sc_sleep_cnt++;
2345                 error = tsleep(sc, PCATCH, "awilck", 0);
2346                 sc->sc_sleep_cnt--;
2347                 if (error)
2348                         return error;
2349         }
2350         sc->sc_busy = 1;
2351         sc->sc_cansleep = 1;
2352         return 0;
2353 }
2354
2355 static void
2356 awi_unlock(sc)
2357         struct awi_softc *sc;
2358 {
2359         sc->sc_busy = 0;
2360         sc->sc_cansleep = 0;
2361         if (sc->sc_sleep_cnt)
2362                 wakeup(sc);
2363 }
2364
2365 static int
2366 awi_intr_lock(sc)
2367         struct awi_softc *sc;
2368 {
2369         u_int8_t status;
2370         int i, retry;
2371
2372         status = 1;
2373         for (retry = 0; retry < 10; retry++) {
2374                 for (i = 0; i < AWI_LOCKOUT_TIMEOUT*1000/5; i++) {
2375                         status = awi_read_1(sc, AWI_LOCKOUT_HOST);
2376                         if (status == 0)
2377                                 break;
2378                         DELAY(5);
2379                 }
2380                 if (status != 0)
2381                         break;
2382                 awi_write_1(sc, AWI_LOCKOUT_MAC, 1);
2383                 status = awi_read_1(sc, AWI_LOCKOUT_HOST);
2384                 if (status == 0)
2385                         break;
2386                 awi_write_1(sc, AWI_LOCKOUT_MAC, 0);
2387         }
2388         if (status != 0) {
2389                 if_printf(sc->sc_ifp, "failed to lock interrupt\n");
2390                 return ENXIO;
2391         }
2392         return 0;
2393 }
2394
2395 static void
2396 awi_intr_unlock(sc)
2397         struct awi_softc *sc;
2398 {
2399
2400         awi_write_1(sc, AWI_LOCKOUT_MAC, 0);
2401 }
2402
2403 static int
2404 awi_cmd_wait(sc)
2405         struct awi_softc *sc;
2406 {
2407         int i, error = 0;
2408
2409         i = 0;
2410         while (sc->sc_cmd_inprog) {
2411                 if (sc->sc_invalid)
2412                         return ENXIO;
2413                 if (awi_read_1(sc, AWI_CMD) != sc->sc_cmd_inprog) {
2414                         if_printf(sc->sc_ifp, "failed to access hardware\n");
2415                         sc->sc_invalid = 1;
2416                         return ENXIO;
2417                 }
2418                 if (sc->sc_cansleep) {
2419                         sc->sc_sleep_cnt++;
2420                         error = tsleep(sc, 0, "awicmd",
2421                             AWI_CMD_TIMEOUT*hz/1000);
2422                         sc->sc_sleep_cnt--;
2423                 } else {
2424                         if (awi_read_1(sc, AWI_CMD_STATUS) != AWI_STAT_IDLE) {
2425                                 awi_cmd_done(sc);
2426                                 break;
2427                         }
2428                         if (i++ >= AWI_CMD_TIMEOUT*1000/10)
2429                                 error = EWOULDBLOCK;
2430                         else
2431                                 DELAY(10);
2432                 }
2433                 if (error)
2434                         break;
2435         }
2436         return error;
2437 }
2438
2439 static void
2440 awi_print_essid(essid)
2441         u_int8_t *essid;
2442 {
2443         int i, len;
2444         u_int8_t *p;
2445
2446         len = essid[1];
2447         if (len > IEEE80211_NWID_LEN)
2448                 len = IEEE80211_NWID_LEN;       /*XXX*/
2449         /* determine printable or not */
2450         for (i = 0, p = essid + 2; i < len; i++, p++) {
2451                 if (*p < ' ' || *p > 0x7e)
2452                         break;
2453         }
2454         if (i == len) {
2455                 printf("\"");
2456                 for (i = 0, p = essid + 2; i < len; i++, p++)
2457                         printf("%c", *p);
2458                 printf("\"");
2459         } else {
2460                 printf("0x");
2461                 for (i = 0, p = essid + 2; i < len; i++, p++)
2462                         printf("%02x", *p);
2463         }
2464 }
2465
2466 #ifdef AWI_DEBUG
2467 static void
2468 awi_dump_pkt(sc, m, rssi)
2469         struct awi_softc *sc;
2470         struct mbuf *m;
2471         int rssi;
2472 {
2473         struct ieee80211_frame *wh;
2474         int i, l;
2475
2476         wh = mtod(m, struct ieee80211_frame *);
2477
2478         if (awi_dump_mask != 0 &&
2479             ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK)==IEEE80211_FC1_DIR_NODS) &&
2480             ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK)==IEEE80211_FC0_TYPE_MGT)) {
2481                 if ((AWI_DUMP_MASK(wh->i_fc[0]) & awi_dump_mask) != 0)
2482                         return;
2483         }
2484         if (awi_dump_mask < 0 &&
2485             (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK)==IEEE80211_FC0_TYPE_DATA)
2486                 return;
2487
2488         if (rssi < 0)
2489                 printf("tx: ");
2490         else
2491                 printf("rx: ");
2492         switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) {
2493         case IEEE80211_FC1_DIR_NODS:
2494                 printf("NODS %6D->%6D(%6D)", wh->i_addr2, ":",
2495                        wh->i_addr1, ":", wh->i_addr3, ":");
2496                 break;
2497         case IEEE80211_FC1_DIR_TODS:
2498                 printf("TODS %6D->%6D(%6D)", wh->i_addr2, ":",
2499                        wh->i_addr3, ":", wh->i_addr1, ":");
2500                 break;
2501         case IEEE80211_FC1_DIR_FROMDS:
2502                 printf("FRDS %6D->%6D(%6D)", wh->i_addr3, ":",
2503                        wh->i_addr1, ":", wh->i_addr2, ":");
2504                 break;
2505         case IEEE80211_FC1_DIR_DSTODS:
2506                 printf("DSDS %6D->%6D(%6D->%6D)", (u_int8_t *)&wh[1], ":",
2507                        wh->i_addr3, ":", wh->i_addr2, ":", wh->i_addr1, ":");
2508                 break;
2509         }
2510         switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
2511         case IEEE80211_FC0_TYPE_DATA:
2512                 printf(" data");
2513                 break;
2514         case IEEE80211_FC0_TYPE_MGT:
2515                 switch (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) {
2516                 case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
2517                         printf(" probe_req");
2518                         break;
2519                 case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
2520                         printf(" probe_resp");
2521                         break;
2522                 case IEEE80211_FC0_SUBTYPE_BEACON:
2523                         printf(" beacon");
2524                         break;
2525                 case IEEE80211_FC0_SUBTYPE_AUTH:
2526                         printf(" auth");
2527                         break;
2528                 case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
2529                         printf(" assoc_req");
2530                         break;
2531                 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
2532                         printf(" assoc_resp");
2533                         break;
2534                 case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
2535                         printf(" reassoc_req");
2536                         break;
2537                 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
2538                         printf(" reassoc_resp");
2539                         break;
2540                 case IEEE80211_FC0_SUBTYPE_DEAUTH:
2541                         printf(" deauth");
2542                         break;
2543                 case IEEE80211_FC0_SUBTYPE_DISASSOC:
2544                         printf(" disassoc");
2545                         break;
2546                 default:
2547                         printf(" mgt#%d",
2548                             wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
2549                         break;
2550                 }
2551                 break;
2552         default:
2553                 printf(" type#%d",
2554                     wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK);
2555                 break;
2556         }
2557         if (wh->i_fc[1] & IEEE80211_FC1_WEP)
2558                 printf(" WEP");
2559         if (rssi >= 0)
2560                 printf(" +%d", rssi);
2561         printf("\n");
2562         if (awi_dump_len > 0) {
2563                 l = m->m_len;
2564                 if (l > awi_dump_len + sizeof(*wh))
2565                         l = awi_dump_len + sizeof(*wh);
2566                 i = sizeof(*wh);
2567                 if (awi_dump_hdr)
2568                         i = 0;
2569                 for (; i < l; i++) {
2570                         if ((i & 1) == 0)
2571                                 printf(" ");
2572                         printf("%02x", mtod(m, u_int8_t *)[i]);
2573                 }
2574                 printf("\n");
2575         }
2576 }
2577 #endif