sys/dev/netif/awi/awi.c

   1 /*      $NetBSD: awi.c,v 1.26 2000/07/21 04:48:55 onoe Exp $    */
   2 /* $FreeBSD: src/sys/dev/awi/awi.c,v 1.10.2.2 2003/01/23 21:06:42 sam Exp $ */
   3 /* $DragonFly: src/sys/dev/netif/awi/Attic/awi.c,v 1.19 2005/02/15 18:23:41 joerg Exp $ */
   4
   5 /*-
   6  * Copyright (c) 1999 The NetBSD Foundation, Inc.
   7  * All rights reserved.
   8  *
   9  * This code is derived from software contributed to The NetBSD Foundation
  10  * by Bill Sommerfeld
  11  *
  12  * Redistribution and use in source and binary forms, with or without
  13  * modification, are permitted provided that the following conditions
  14  * are met:
  15  * 1. Redistributions of source code must retain the above copyright
  16  *    notice, this list of conditions and the following disclaimer.
  17  * 2. Redistributions in binary form must reproduce the above copyright
  18  *    notice, this list of conditions and the following disclaimer in the
  19  *    documentation and/or other materials provided with the distribution.
  20  * 3. All advertising materials mentioning features or use of this software
  21  *    must display the following acknowledgement:
  22  *        This product includes software developed by the NetBSD
  23  *        Foundation, Inc. and its contributors.
  24  * 4. Neither the name of The NetBSD Foundation nor the names of its
  25  *    contributors may be used to endorse or promote products derived
  26  *    from this software without specific prior written permission.
  27  *
  28  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
  29  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  30  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  31  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
  32  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  33  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  34  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  35  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  36  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  37  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  38  * POSSIBILITY OF SUCH DAMAGE.
  39  */
  40 /*
  41  * Driver for AMD 802.11 firmware.
  42  * Uses am79c930 chip driver to talk to firmware running on the am79c930.
  43  *
  44  * More-or-less a generic ethernet-like if driver, with 802.11 gorp added.
  45  */
  46
  47 /*
  48  * todo:
  49  *      - flush tx queue on resynch.
  50  *      - clear oactive on "down".
  51  *      - rewrite copy-into-mbuf code
  52  *      - mgmt state machine gets stuck retransmitting assoc requests.
  53  *      - multicast filter.
  54  *      - fix device reset so it's more likely to work
  55  *      - show status goo through ifmedia.
  56  *
  57  * more todo:
  58  *      - deal with more 802.11 frames.
  59  *              - send reassoc request
  60  *              - deal with reassoc response
  61  *              - send/deal with disassociation
  62  *      - deal with "full" access points (no room for me).
  63  *      - power save mode
  64  *
  65  * later:
  66  *      - SSID preferences
  67  *      - need ioctls for poking at the MIBs
  68  *      - implement ad-hoc mode (including bss creation).
  69  *      - decide when to do "ad hoc" vs. infrastructure mode (IFF_LINK flags?)
  70  *              (focus on inf. mode since that will be needed for ietf)
  71  *      - deal with DH vs. FH versions of the card
  72  *      - deal with faster cards (2mb/s)
  73  *      - ?WEP goo (mmm, rc4) (it looks not particularly useful).
  74  *      - ifmedia revision.
  75  *      - common 802.11 mibish things.
  76  *      - common 802.11 media layer.
  77  */
  78
  79 /*
  80  * Driver for AMD 802.11 PCnetMobile firmware.
  81  * Uses am79c930 chip driver to talk to firmware running on the am79c930.
  82  *
  83  * The initial version of the driver was written by
  84  * Bill Sommerfeld <sommerfeld@netbsd.org>.
  85  * Then the driver module completely rewritten to support cards with DS phy
  86  * and to support adhoc mode by Atsushi Onoe <onoe@netbsd.org>
  87  */
  88
  89 #include "opt_inet.h"
  90 #if defined(__DragonFly__) || (defined(__FreeBSD__) && __FreeBSD__ >= 4)
  91 #define NBPFILTER       1
  92 #elif defined(__DragonFly__) || (defined(__FreeBSD__) && __FreeBSD__ >= 3)
  93 #include "use_bpf.h"
  94 #define NBPFILTER       NBPF
  95 #else
  96 #include "bpfilter.h"
  97 #endif
  98
  99 #include <sys/param.h>
 100 #include <sys/systm.h>
 101 #include <sys/kernel.h>
 102 #include <sys/mbuf.h>
 103 #include <sys/malloc.h>
 104 #include <sys/proc.h>
 105 #include <sys/socket.h>
 106 #include <sys/sockio.h>
 107 #include <sys/errno.h>
 108 #include <sys/syslog.h>
 109 #if defined(__DragonFly__) || (defined(__FreeBSD__) && __FreeBSD__ >= 4)
 110 #include <sys/bus.h>
 111 #else
 112 #include <sys/device.h>
 113 #endif
 114
 115 #include <net/if.h>
 116 #include <net/ifq_var.h>
 117 #include <net/if_dl.h>
 118 #if defined(__DragonFly__) || defined(__FreeBSD__)
 119 #include <net/ethernet.h>
 120 #else
 121 #include <net/if_ether.h>
 122 #endif
 123 #include <net/if_media.h>
 124 #include <net/if_llc.h>
 125 #include <netproto/802_11/ieee80211.h>
 126 #include <netproto/802_11/ieee80211_ioctl.h>
 127
 128 #ifdef INET
 129 #include <netinet/in.h>
 130 #include <netinet/in_systm.h>
 131 #include <netinet/in_var.h>
 132 #include <netinet/ip.h>
 133 #ifdef __NetBSD__
 134 #include <netinet/if_inarp.h>
 135 #else
 136 #include <netinet/if_ether.h>
 137 #endif
 138 #endif
 139
 140 #if NBPFILTER > 0
 141 #include <net/bpf.h>
 142 #include <net/bpfdesc.h>
 143 #endif
 144
 145 #include <machine/cpu.h>
 146 #include <machine/bus.h>
 147 #ifdef __NetBSD__
 148 #include <machine/intr.h>
 149 #endif
 150 #if defined(__DragonFly__) || defined(__FreeBSD__)
 151 #include <machine/clock.h>
 152 #endif
 153
 154 #ifdef __NetBSD__
 155 #include <dev/ic/am79c930reg.h>
 156 #include <dev/ic/am79c930var.h>
 157 #include <dev/ic/awireg.h>
 158 #include <dev/ic/awivar.h>
 159 #endif
 160 #if defined(__DragonFly__) || defined(__FreeBSD__)
 161 #include "am79c930reg.h"
 162 #include "am79c930var.h"
 163 #include "awireg.h"
 164 #include "awivar.h"
 165 #endif
 166
 167 static int awi_ioctl (struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *);
 168 #ifdef IFM_IEEE80211
 169 static int awi_media_rate2opt (struct awi_softc *sc, int rate);
 170 static int awi_media_opt2rate (struct awi_softc *sc, int opt);
 171 static int awi_media_change (struct ifnet *ifp);
 172 static void awi_media_status (struct ifnet *ifp, struct ifmediareq *imr);
 173 #endif
 174 static void awi_watchdog (struct ifnet *ifp);
 175 static void awi_start (struct ifnet *ifp);
 176 static void awi_txint (struct awi_softc *sc);
 177 static struct mbuf * awi_fix_txhdr (struct awi_softc *sc, struct mbuf *m0);
 178 static struct mbuf * awi_fix_rxhdr (struct awi_softc *sc, struct mbuf *m0);
 179 static void awi_input (struct awi_softc *sc, struct mbuf *m, u_int32_t rxts, u_int8_t rssi);
 180 static void awi_rxint (struct awi_softc *sc);
 181 static struct mbuf * awi_devget (struct awi_softc *sc, u_int32_t off, u_int16_t len);
 182 static int awi_init_hw (struct awi_softc *sc);
 183 static int awi_init_mibs (struct awi_softc *sc);
 184 static int awi_init_txrx (struct awi_softc *sc);
 185 static void awi_stop_txrx (struct awi_softc *sc);
 186 static int awi_start_scan (struct awi_softc *sc);
 187 static int awi_next_scan (struct awi_softc *sc);
 188 static void awi_stop_scan (struct awi_softc *sc);
 189 static void awi_recv_beacon (struct awi_softc *sc, struct mbuf *m0, u_int32_t rxts, u_int8_t rssi);
 190 static int awi_set_ss (struct awi_softc *sc);
 191 static void awi_try_sync (struct awi_softc *sc);
 192 static void awi_sync_done (struct awi_softc *sc);
 193 static void awi_send_deauth (struct awi_softc *sc);
 194 static void awi_send_auth (struct awi_softc *sc, int seq);
 195 static void awi_recv_auth (struct awi_softc *sc, struct mbuf *m0);
 196 static void awi_send_asreq (struct awi_softc *sc, int reassoc);
 197 static void awi_recv_asresp (struct awi_softc *sc, struct mbuf *m0);
 198 static int awi_mib (struct awi_softc *sc, u_int8_t cmd, u_int8_t mib);
 199 static int awi_cmd_scan (struct awi_softc *sc);
 200 static int awi_cmd (struct awi_softc *sc, u_int8_t cmd);
 201 static void awi_cmd_done (struct awi_softc *sc);
 202 static int awi_next_txd (struct awi_softc *sc, int len, u_int32_t *framep, u_int32_t*ntxdp);
 203 static int awi_lock (struct awi_softc *sc);
 204 static void awi_unlock (struct awi_softc *sc);
 205 static int awi_intr_lock (struct awi_softc *sc);
 206 static void awi_intr_unlock (struct awi_softc *sc);
 207 static int awi_cmd_wait (struct awi_softc *sc);
 208 static void awi_print_essid (u_int8_t *essid);
 209
 210 DECLARE_DUMMY_MODULE(if_awi);
 211
 212 #ifdef AWI_DEBUG
 213 static void awi_dump_pkt (struct awi_softc *sc, struct mbuf *m, int rssi);
 214 int awi_verbose = 0;
 215 int awi_dump = 0;
 216 #define AWI_DUMP_MASK(fc0)  (1 << (((fc0) & IEEE80211_FC0_SUBTYPE_MASK) >> 4))
 217 int awi_dump_mask = AWI_DUMP_MASK(IEEE80211_FC0_SUBTYPE_BEACON);
 218 int awi_dump_hdr = 0;
 219 int awi_dump_len = 28;
 220 #endif
 221
 222 #if NBPFILTER > 0
 223 #define AWI_BPF_NORM    0
 224 #define AWI_BPF_RAW     1
 225 #if defined(__DragonFly__) || defined(__FreeBSD__)
 226 #define AWI_BPF_MTAP(sc, m, raw) do {                                   \
 227         if ((sc)->sc_rawbpf == (raw))                                   \
 228                 BPF_MTAP((sc)->sc_ifp, (m));                            \
 229 } while (0);
 230 #else
 231 #define AWI_BPF_MTAP(sc, m, raw) do {                                   \
 232         if ((sc)->sc_ifp->if_bpf && (sc)->sc_rawbpf == (raw))           \
 233                 bpf_mtap((sc)->sc_ifp->if_bpf, (m));                    \
 234 } while (0);
 235 #endif
 236 #else
 237 #define AWI_BPF_MTAP(sc, m, raw)
 238 #endif
 239
 240 #ifndef llc_snap
 241 #define llc_snap              llc_un.type_snap
 242 #endif
 243
 244 devclass_t awi_devclass;
 245
 246 int
 247 awi_attach(sc)
 248         struct awi_softc *sc;
 249 {
 250         struct ifnet *ifp = sc->sc_ifp;
 251         int s;
 252         int error;
 253 #ifdef IFM_IEEE80211
 254         int i;
 255         u_int8_t *phy_rates;
 256         int mword;
 257         struct ifmediareq imr;
 258 #endif
 259
 260         s = splnet();
 261         /*
 262          * Even if we can sleep in initialization state,
 263          * all other processes (e.g. ifconfig) have to wait for
 264          * completion of attaching interface.
 265          */
 266         sc->sc_busy = 1;
 267         sc->sc_status = AWI_ST_INIT;
 268         TAILQ_INIT(&sc->sc_scan);
 269         error = awi_init_hw(sc);
 270         if (error) {
 271                 sc->sc_invalid = 1;
 272                 splx(s);
 273                 return error;
 274         }
 275         error = awi_init_mibs(sc);
 276         splx(s);
 277         if (error) {
 278                 sc->sc_invalid = 1;
 279                 return error;
 280         }
 281
 282         ifp->if_softc = sc;
 283         ifp->if_start = awi_start;
 284         ifp->if_ioctl = awi_ioctl;
 285         ifp->if_watchdog = awi_watchdog;
 286         ifp->if_mtu = ETHERMTU;
 287         ifp->if_hdrlen = sizeof(struct ieee80211_frame) +
 288             sizeof(struct ether_header);
 289         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
 290 #ifdef IFF_NOTRAILERS
 291         ifp->if_flags |= IFF_NOTRAILERS;
 292 #endif
 293 #ifdef __NetBSD__
 294         memcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
 295 #endif
 296 #if defined(__DragonFly__) || defined(__FreeBSD__)
 297         ifq_set_maxlen(&ifp->if_snd, ifqmaxlen);
 298         ifq_set_ready(&ifp->if_snd);
 299         memcpy(sc->sc_ec.ac_enaddr, sc->sc_mib_addr.aMAC_Address,
 300             ETHER_ADDR_LEN);
 301 #endif
 302
 303         if_printf(ifp, "IEEE802.11 %s %dMbps (firmware %s)\n",
 304             sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH ? "FH" : "DS",
 305             sc->sc_tx_rate / 10, sc->sc_banner);
 306         ether_ifattach(ifp, sc->sc_mib_addr.aMAC_Address);
 307
 308 #ifdef IFM_IEEE80211
 309         ifmedia_init(&sc->sc_media, 0, awi_media_change, awi_media_status);
 310         phy_rates = sc->sc_mib_phy.aSuprt_Data_Rates;
 311         for (i = 0; i < phy_rates[1]; i++) {
 312                 mword = awi_media_rate2opt(sc, AWI_80211_RATE(phy_rates[2 + i]));
 313                 if (mword == 0)
 314                         continue;
 315                 mword |= IFM_IEEE80211;
 316                 ifmedia_add(&sc->sc_media, mword, 0, NULL);
 317                 ifmedia_add(&sc->sc_media,
 318                     mword | IFM_IEEE80211_ADHOC, 0, NULL);
 319                 if (sc->sc_mib_phy.IEEE_PHY_Type != AWI_PHY_TYPE_FH)
 320                         ifmedia_add(&sc->sc_media,
 321                             mword | IFM_IEEE80211_ADHOC | IFM_FLAG0, 0, NULL);
 322         }
 323         awi_media_status(ifp, &imr);
 324         ifmedia_set(&sc->sc_media, imr.ifm_active);
 325 #endif
 326
 327         /* ready to accept ioctl */
 328         awi_unlock(sc);
 329
 330         /* Attach is successful. */
 331         sc->sc_attached = 1;
 332         return 0;
 333 }
 334
 335 #ifdef __NetBSD__
 336 int
 337 awi_detach(sc)
 338         struct awi_softc *sc;
 339 {
 340         struct ifnet *ifp = sc->sc_ifp;
 341         int s;
 342
 343         /* Succeed if there is no work to do. */
 344         if (!sc->sc_attached)
 345                 return (0);
 346
 347         s = splnet();
 348         sc->sc_invalid = 1;
 349         awi_stop(sc);
 350         while (sc->sc_sleep_cnt > 0) {
 351                 wakeup(sc);
 352                 (void)tsleep(sc, 0, "awidet", 1);
 353         }
 354         if (sc->sc_wep_ctx != NULL)
 355                 free(sc->sc_wep_ctx, M_DEVBUF);
 356 #if NBPFILTER > 0
 357         bpfdetach(ifp);
 358 #endif
 359 #ifdef IFM_IEEE80211
 360         ifmedia_delete_instance(&sc->sc_media, IFM_INST_ANY);
 361 #endif
 362         ether_ifdetach(ifp);
 363         if_detach(ifp);
 364         if (sc->sc_enabled) {
 365                 if (sc->sc_disable)
 366                         (*sc->sc_disable)(sc);
 367                 sc->sc_enabled = 0;
 368         }
 369         splx(s);
 370         return 0;
 371 }
 372
 373 int
 374 awi_activate(self, act)
 375         struct device *self;
 376         enum devact act;
 377 {
 378         struct awi_softc *sc = (struct awi_softc *)self;
 379         int s, error = 0;
 380
 381         s = splnet();
 382         switch (act) {
 383         case DVACT_ACTIVATE:
 384                 error = EOPNOTSUPP;
 385                 break;
 386
 387         case DVACT_DEACTIVATE:
 388                 sc->sc_invalid = 1;
 389                 if (sc->sc_ifp)
 390                         if_deactivate(sc->sc_ifp);
 391                 break;
 392         }
 393         splx(s);
 394
 395         return error;
 396 }
 397
 398 void
 399 awi_power(sc, why)
 400         struct awi_softc *sc;
 401         int why;
 402 {
 403         int s;
 404         int ocansleep;
 405
 406         if (!sc->sc_enabled)
 407                 return;
 408
 409         s = splnet();
 410         ocansleep = sc->sc_cansleep;
 411         sc->sc_cansleep = 0;
 412 #ifdef needtobefixed    /*ONOE*/
 413         if (why == PWR_RESUME) {
 414                 sc->sc_enabled = 0;
 415                 awi_init(sc);
 416                 (void)awi_intr(sc);
 417         } else {
 418                 awi_stop(sc);
 419                 if (sc->sc_disable)
 420                         (*sc->sc_disable)(sc);
 421         }
 422 #endif
 423         sc->sc_cansleep = ocansleep;
 424         splx(s);
 425 }
 426 #endif /* __NetBSD__ */
 427
 428 static int
 429 awi_ioctl(ifp, cmd, data, cr)
 430         struct ifnet *ifp;
 431         u_long cmd;
 432         caddr_t data;
 433         struct ucred *cr;
 434 {
 435         struct awi_softc *sc = ifp->if_softc;
 436         struct ifreq *ifr = (struct ifreq *)data;
 437         struct ifaddr *ifa = (struct ifaddr *)data;
 438         int s, error;
 439         struct ieee80211_nwid nwid;
 440         u_int8_t *p;
 441
 442         s = splnet();
 443
 444         /* serialize ioctl */
 445         error = awi_lock(sc);
 446         if (error)
 447                 goto cantlock;
 448         switch (cmd) {
 449         case SIOCSIFADDR:
 450                 ifp->if_flags |= IFF_UP;
 451                 switch (ifa->ifa_addr->sa_family) {
 452 #ifdef INET
 453                 case AF_INET:
 454                         arp_ifinit((void *)ifp, ifa);
 455                         break;
 456 #endif
 457                 }
 458                 /* FALLTHROUGH */
 459         case SIOCSIFFLAGS:
 460                 sc->sc_format_llc = !(ifp->if_flags & IFF_LINK0);
 461                 if (!(ifp->if_flags & IFF_UP)) {
 462                         if (sc->sc_enabled) {
 463                                 awi_stop(sc);
 464                                 if (sc->sc_disable)
 465                                         (*sc->sc_disable)(sc);
 466                                 sc->sc_enabled = 0;
 467                         }
 468                         break;
 469                 }
 470                 error = awi_init(sc);
 471                 break;
 472
 473         case SIOCADDMULTI:
 474         case SIOCDELMULTI:
 475 #if defined(__DragonFly__) || defined(__FreeBSD__)
 476                 error = ENETRESET;      /*XXX*/
 477 #else
 478                 error = (cmd == SIOCADDMULTI) ?
 479                     ether_addmulti(ifr, &sc->sc_ec) :
 480                     ether_delmulti(ifr, &sc->sc_ec);
 481 #endif
 482                 /*
 483                  * Do not rescan BSS.  Rather, just reset multicast filter.
 484                  */
 485                 if (error == ENETRESET) {
 486                         if (sc->sc_enabled)
 487                                 error = awi_init(sc);
 488                         else
 489                                 error = 0;
 490                 }
 491                 break;
 492         case SIOCSIFMTU:
 493                 if (ifr->ifr_mtu > ETHERMTU)
 494                         error = EINVAL;
 495                 else
 496                         ifp->if_mtu = ifr->ifr_mtu;
 497                 break;
 498         case SIOCS80211NWID:
 499 #if defined(__DragonFly__) || defined(__FreeBSD__)
 500                 error = suser_cred(cr, NULL_CRED_OKAY); /* EPERM if no proc */
 501                 if (error)
 502                         break;
 503 #endif
 504                 error = copyin(ifr->ifr_data, &nwid, sizeof(nwid));
 505                 if (error)
 506                         break;
 507                 if (nwid.i_len > IEEE80211_NWID_LEN) {
 508                         error = EINVAL;
 509                         break;
 510                 }
 511                 if (sc->sc_mib_mac.aDesired_ESS_ID[1] == nwid.i_len &&
 512                     memcmp(&sc->sc_mib_mac.aDesired_ESS_ID[2], nwid.i_nwid,
 513                     nwid.i_len) == 0)
 514                         break;
 515                 memset(sc->sc_mib_mac.aDesired_ESS_ID, 0, AWI_ESS_ID_SIZE);
 516                 sc->sc_mib_mac.aDesired_ESS_ID[0] = IEEE80211_ELEMID_SSID;
 517                 sc->sc_mib_mac.aDesired_ESS_ID[1] = nwid.i_len;
 518                 memcpy(&sc->sc_mib_mac.aDesired_ESS_ID[2], nwid.i_nwid,
 519                     nwid.i_len);
 520                 if (sc->sc_enabled) {
 521                         awi_stop(sc);
 522                         error = awi_init(sc);
 523                 }
 524                 break;
 525         case SIOCG80211NWID:
 526                 if (ifp->if_flags & IFF_RUNNING)
 527                         p = sc->sc_bss.essid;
 528                 else
 529                         p = sc->sc_mib_mac.aDesired_ESS_ID;
 530                 error = copyout(p + 1, ifr->ifr_data, 1 + IEEE80211_NWID_LEN);
 531                 break;
 532         case SIOCS80211NWKEY:
 533 #if defined(__DragonFly__) || defined(__FreeBSD__)
 534                 error = suser_cred(cr, NULL_CRED_OKAY); /* EPERM if no proc */
 535                 if (error)
 536                         break;
 537 #endif
 538                 error = awi_wep_setnwkey(sc, (struct ieee80211_nwkey *)data);
 539                 break;
 540         case SIOCG80211NWKEY:
 541                 error = awi_wep_getnwkey(sc, (struct ieee80211_nwkey *)data);
 542                 break;
 543 #ifdef IFM_IEEE80211
 544         case SIOCSIFMEDIA:
 545         case SIOCGIFMEDIA:
 546                 error = ifmedia_ioctl(ifp, ifr, &sc->sc_media, cmd);
 547                 break;
 548 #endif
 549         default:
 550                 error = awi_wicfg(ifp, cmd, data);
 551                 break;
 552         }
 553         awi_unlock(sc);
 554   cantlock:
 555         splx(s);
 556         return error;
 557 }
 558
 559 #ifdef IFM_IEEE80211
 560 static int
 561 awi_media_rate2opt(sc, rate)
 562         struct awi_softc *sc;
 563         int rate;
 564 {
 565         int mword;
 566
 567         mword = 0;
 568         switch (rate) {
 569         case 10:
 570                 if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH)
 571                         mword = IFM_IEEE80211_FH1;
 572                 else
 573                         mword = IFM_IEEE80211_DS1;
 574                 break;
 575         case 20:
 576                 if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH)
 577                         mword = IFM_IEEE80211_FH2;
 578                 else
 579                         mword = IFM_IEEE80211_DS2;
 580                 break;
 581         case 55:
 582                 if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_DS)
 583                         mword = IFM_IEEE80211_DS5;
 584                 break;
 585         case 110:
 586                 if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_DS)
 587                         mword = IFM_IEEE80211_DS11;
 588                 break;
 589         }
 590         return mword;
 591 }
 592
 593 static int
 594 awi_media_opt2rate(sc, opt)
 595         struct awi_softc *sc;
 596         int opt;
 597 {
 598         int rate;
 599
 600         rate = 0;
 601         switch (IFM_SUBTYPE(opt)) {
 602         case IFM_IEEE80211_FH1:
 603         case IFM_IEEE80211_FH2:
 604                 if (sc->sc_mib_phy.IEEE_PHY_Type != AWI_PHY_TYPE_FH)
 605                         return 0;
 606                 break;
 607         case IFM_IEEE80211_DS1:
 608         case IFM_IEEE80211_DS2:
 609         case IFM_IEEE80211_DS5:
 610         case IFM_IEEE80211_DS11:
 611                 if (sc->sc_mib_phy.IEEE_PHY_Type != AWI_PHY_TYPE_DS)
 612                         return 0;
 613                 break;
 614         }
 615
 616         switch (IFM_SUBTYPE(opt)) {
 617         case IFM_IEEE80211_FH1:
 618         case IFM_IEEE80211_DS1:
 619                 rate = 10;
 620                 break;
 621         case IFM_IEEE80211_FH2:
 622         case IFM_IEEE80211_DS2:
 623                 rate = 20;
 624                 break;
 625         case IFM_IEEE80211_DS5:
 626                 rate = 55;
 627                 break;
 628         case IFM_IEEE80211_DS11:
 629                 rate = 110;
 630                 break;
 631         }
 632         return rate;
 633 }
 634
 635 /*
 636  * Called from ifmedia_ioctl via awi_ioctl with lock obtained.
 637  */
 638 static int
 639 awi_media_change(ifp)
 640         struct ifnet *ifp;
 641 {
 642         struct awi_softc *sc = ifp->if_softc;
 643         struct ifmedia_entry *ime;
 644         u_int8_t *phy_rates;
 645         int i, rate, error;
 646
 647         error = 0;
 648         ime = sc->sc_media.ifm_cur;
 649         rate = awi_media_opt2rate(sc, ime->ifm_media);
 650         if (rate == 0)
 651                 return EINVAL;
 652         if (rate != sc->sc_tx_rate) {
 653                 phy_rates = sc->sc_mib_phy.aSuprt_Data_Rates;
 654                 for (i = 0; i < phy_rates[1]; i++) {
 655                         if (rate == AWI_80211_RATE(phy_rates[2 + i]))
 656                                 break;
 657                 }
 658                 if (i == phy_rates[1])
 659                         return EINVAL;
 660         }
 661         if (ime->ifm_media & IFM_IEEE80211_ADHOC) {
 662                 sc->sc_mib_local.Network_Mode = 0;
 663                 if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH)
 664                         sc->sc_no_bssid = 0;
 665                 else
 666                         sc->sc_no_bssid = (ime->ifm_media & IFM_FLAG0) ? 1 : 0;
 667         } else {
 668                 sc->sc_mib_local.Network_Mode = 1;
 669         }
 670         if (sc->sc_enabled) {
 671                 awi_stop(sc);
 672                 error = awi_init(sc);
 673         }
 674         return error;
 675 }
 676
 677 static void
 678 awi_media_status(ifp, imr)
 679         struct ifnet *ifp;
 680         struct ifmediareq *imr;
 681 {
 682         struct awi_softc *sc = ifp->if_softc;
 683
 684         imr->ifm_status = IFM_AVALID;
 685         if (ifp->if_flags & IFF_RUNNING)
 686                 imr->ifm_status |= IFM_ACTIVE;
 687         imr->ifm_active = IFM_IEEE80211;
 688         imr->ifm_active |= awi_media_rate2opt(sc, sc->sc_tx_rate);
 689         if (sc->sc_mib_local.Network_Mode == 0) {
 690                 imr->ifm_active |= IFM_IEEE80211_ADHOC;
 691                 if (sc->sc_no_bssid)
 692                         imr->ifm_active |= IFM_FLAG0;
 693         }
 694 }
 695 #endif /* IFM_IEEE80211 */
 696
 697 int
 698 awi_intr(arg)
 699         void *arg;
 700 {
 701         struct awi_softc *sc = arg;
 702         u_int16_t status;
 703         int error, handled = 0, ocansleep;
 704
 705         if (!sc->sc_enabled || !sc->sc_enab_intr || sc->sc_invalid)
 706                 return 0;
 707
 708         am79c930_gcr_setbits(&sc->sc_chip,
 709             AM79C930_GCR_DISPWDN | AM79C930_GCR_ECINT);
 710         awi_write_1(sc, AWI_DIS_PWRDN, 1);
 711         ocansleep = sc->sc_cansleep;
 712         sc->sc_cansleep = 0;
 713
 714         for (;;) {
 715                 error = awi_intr_lock(sc);
 716                 if (error)
 717                         break;
 718                 status = awi_read_1(sc, AWI_INTSTAT);
 719                 awi_write_1(sc, AWI_INTSTAT, 0);
 720                 awi_write_1(sc, AWI_INTSTAT, 0);
 721                 status |= awi_read_1(sc, AWI_INTSTAT2) << 8;
 722                 awi_write_1(sc, AWI_INTSTAT2, 0);
 723                 DELAY(10);
 724                 awi_intr_unlock(sc);
 725                 if (!sc->sc_cmd_inprog)
 726                         status &= ~AWI_INT_CMD; /* make sure */
 727                 if (status == 0)
 728                         break;
 729                 handled = 1;
 730                 if (status & AWI_INT_RX)
 731                         awi_rxint(sc);
 732                 if (status & AWI_INT_TX)
 733                         awi_txint(sc);
 734                 if (status & AWI_INT_CMD)
 735                         awi_cmd_done(sc);
 736                 if (status & AWI_INT_SCAN_CMPLT) {
 737                         if (sc->sc_status == AWI_ST_SCAN &&
 738                             sc->sc_mgt_timer > 0)
 739                                 (void)awi_next_scan(sc);
 740                 }
 741         }
 742         sc->sc_cansleep = ocansleep;
 743         am79c930_gcr_clearbits(&sc->sc_chip, AM79C930_GCR_DISPWDN);
 744         awi_write_1(sc, AWI_DIS_PWRDN, 0);
 745         return handled;
 746 }
 747
 748 int
 749 awi_init(sc)
 750         struct awi_softc *sc;
 751 {
 752         struct ifnet *ifp = sc->sc_ifp;
 753         int error, ostatus;
 754         int n;
 755 #if defined(__DragonFly__) || defined(__FreeBSD__)
 756         struct ifmultiaddr *ifma;
 757 #else
 758         struct ether_multi *enm;
 759         struct ether_multistep step;
 760 #endif
 761
 762         /* reinitialize muticast filter */
 763         n = 0;
 764         ifp->if_flags |= IFF_ALLMULTI;
 765         sc->sc_mib_local.Accept_All_Multicast_Dis = 0;
 766         if (ifp->if_flags & IFF_PROMISC) {
 767                 sc->sc_mib_mac.aPromiscuous_Enable = 1;
 768                 goto set_mib;
 769         }
 770         sc->sc_mib_mac.aPromiscuous_Enable = 0;
 771 #if defined(__DragonFly__) || defined(__FreeBSD__)
 772         if (ifp->if_amcount != 0)
 773                 goto set_mib;
 774         for (ifma = LIST_FIRST(&ifp->if_multiaddrs); ifma != NULL;
 775             ifma = LIST_NEXT(ifma, ifma_link)) {
 776                 if (ifma->ifma_addr->sa_family != AF_LINK)
 777                         continue;
 778                 if (n == AWI_GROUP_ADDR_SIZE)
 779                         goto set_mib;
 780                 memcpy(sc->sc_mib_addr.aGroup_Addresses[n],
 781                     LLADDR((struct sockaddr_dl *)ifma->ifma_addr),
 782                     ETHER_ADDR_LEN);
 783                 n++;
 784         }
 785 #else
 786         ETHER_FIRST_MULTI(step, &sc->sc_ec, enm);
 787         while (enm != NULL) {
 788                 if (n == AWI_GROUP_ADDR_SIZE ||
 789                     memcmp(enm->enm_addrlo, enm->enm_addrhi, ETHER_ADDR_LEN)
 790                     != 0)
 791                         goto set_mib;
 792                 memcpy(sc->sc_mib_addr.aGroup_Addresses[n], enm->enm_addrlo,
 793                     ETHER_ADDR_LEN);
 794                 n++;
 795                 ETHER_NEXT_MULTI(step, enm);
 796         }
 797 #endif
 798         for (; n < AWI_GROUP_ADDR_SIZE; n++)
 799                 memset(sc->sc_mib_addr.aGroup_Addresses[n], 0, ETHER_ADDR_LEN);
 800         ifp->if_flags &= ~IFF_ALLMULTI;
 801         sc->sc_mib_local.Accept_All_Multicast_Dis = 1;
 802
 803   set_mib:
 804 #ifdef notdef   /* allow non-encrypted frame for receiving. */
 805         sc->sc_mib_mgt.Wep_Required = sc->sc_wep_algo != NULL ? 1 : 0;
 806 #endif
 807         if (!sc->sc_enabled) {
 808                 sc->sc_enabled = 1;
 809                 if (sc->sc_enable)
 810                         (*sc->sc_enable)(sc);
 811                 sc->sc_status = AWI_ST_INIT;
 812                 error = awi_init_hw(sc);
 813                 if (error)
 814                         return error;
 815         }
 816         ostatus = sc->sc_status;
 817         sc->sc_status = AWI_ST_INIT;
 818         if ((error = awi_mib(sc, AWI_CMD_SET_MIB, AWI_MIB_LOCAL)) != 0 ||
 819             (error = awi_mib(sc, AWI_CMD_SET_MIB, AWI_MIB_ADDR)) != 0 ||
 820             (error = awi_mib(sc, AWI_CMD_SET_MIB, AWI_MIB_MAC)) != 0 ||
 821             (error = awi_mib(sc, AWI_CMD_SET_MIB, AWI_MIB_MGT)) != 0 ||
 822             (error = awi_mib(sc, AWI_CMD_SET_MIB, AWI_MIB_PHY)) != 0) {
 823                 awi_stop(sc);
 824                 return error;
 825         }
 826         if (ifp->if_flags & IFF_RUNNING)
 827                 sc->sc_status = AWI_ST_RUNNING;
 828         else {
 829                 if (ostatus == AWI_ST_INIT) {
 830                         error = awi_init_txrx(sc);
 831                         if (error)
 832                                 return error;
 833                 }
 834                 error = awi_start_scan(sc);
 835         }
 836         return error;
 837 }
 838
 839 void
 840 awi_stop(sc)
 841         struct awi_softc *sc;
 842 {
 843         struct ifnet *ifp = sc->sc_ifp;
 844         struct awi_bss *bp;
 845
 846         sc->sc_status = AWI_ST_INIT;
 847         if (!sc->sc_invalid) {
 848                 (void)awi_cmd_wait(sc);
 849                 if (sc->sc_mib_local.Network_Mode &&
 850                     sc->sc_status > AWI_ST_AUTH)
 851                         awi_send_deauth(sc);
 852                 awi_stop_txrx(sc);
 853         }
 854         ifp->if_flags &= ~(IFF_RUNNING|IFF_OACTIVE);
 855         ifp->if_timer = 0;
 856         sc->sc_tx_timer = sc->sc_rx_timer = sc->sc_mgt_timer = 0;
 857         IF_DRAIN(&sc->sc_mgtq);
 858         ifq_purge(&ifp->if_snd);
 859         while ((bp = TAILQ_FIRST(&sc->sc_scan)) != NULL) {
 860                 TAILQ_REMOVE(&sc->sc_scan, bp, list);
 861                 free(bp, M_DEVBUF);
 862         }
 863 }
 864
 865 static void
 866 awi_watchdog(ifp)
 867         struct ifnet *ifp;
 868 {
 869         struct awi_softc *sc = ifp->if_softc;
 870         int ocansleep;
 871
 872         if (sc->sc_invalid) {
 873                 ifp->if_timer = 0;
 874                 return;
 875         }
 876
 877         ocansleep = sc->sc_cansleep;
 878         sc->sc_cansleep = 0;
 879         if (sc->sc_tx_timer && --sc->sc_tx_timer == 0) {
 880                 if_printf(ifp, "transmit timeout\n");
 881                 awi_txint(sc);
 882         }
 883         if (sc->sc_rx_timer && --sc->sc_rx_timer == 0) {
 884                 if (ifp->if_flags & IFF_DEBUG) {
 885                         if_printf(ifp, "no recent beacons from %6D; rescanning\n",
 886                                   sc->sc_bss.bssid, ":");
 887                 }
 888                 ifp->if_flags &= ~IFF_RUNNING;
 889                 awi_start_scan(sc);
 890         }
 891         if (sc->sc_mgt_timer && --sc->sc_mgt_timer == 0) {
 892                 switch (sc->sc_status) {
 893                 case AWI_ST_SCAN:
 894                         awi_stop_scan(sc);
 895                         break;
 896                 case AWI_ST_AUTH:
 897                 case AWI_ST_ASSOC:
 898                         /* restart scan */
 899                         awi_start_scan(sc);
 900                         break;
 901                 default:
 902                         break;
 903                 }
 904         }
 905
 906         if (sc->sc_tx_timer == 0 && sc->sc_rx_timer == 0 &&
 907             sc->sc_mgt_timer == 0)
 908                 ifp->if_timer = 0;
 909         else
 910                 ifp->if_timer = 1;
 911         sc->sc_cansleep = ocansleep;
 912 }
 913
 914 static void
 915 awi_start(ifp)
 916         struct ifnet *ifp;
 917 {
 918         struct awi_softc *sc = ifp->if_softc;
 919         struct mbuf *m0, *m;
 920         u_int32_t txd, frame, ntxd;
 921         u_int8_t rate;
 922         int len, sent = 0;
 923
 924         for (;;) {
 925                 txd = sc->sc_txnext;
 926                 IF_DEQUEUE(&sc->sc_mgtq, m0);
 927                 if (m0 != NULL) {
 928                         if (awi_next_txd(sc, m0->m_pkthdr.len, &frame, &ntxd)) {
 929                                 IF_PREPEND(&sc->sc_mgtq, m0);
 930                                 ifp->if_flags |= IFF_OACTIVE;
 931                                 break;
 932                         }
 933                 } else {
 934                         if (!(ifp->if_flags & IFF_RUNNING))
 935                                 break;
 936                         m0 = ifq_poll(&ifp->if_snd);
 937                         if (m0 == NULL)
 938                                 break;
 939                         len = m0->m_pkthdr.len + sizeof(struct ieee80211_frame);
 940                         if (sc->sc_format_llc)
 941                                 len += sizeof(struct llc) -
 942                                     sizeof(struct ether_header);
 943                         if (sc->sc_wep_algo != NULL)
 944                                 len += IEEE80211_WEP_IVLEN +
 945                                     IEEE80211_WEP_KIDLEN + IEEE80211_WEP_CRCLEN;
 946                         if (awi_next_txd(sc, len, &frame, &ntxd)) {
 947                                 ifp->if_flags |= IFF_OACTIVE;
 948                                 break;
 949                         }
 950                         m0 = ifq_dequeue(&ifp->if_snd);
 951                         AWI_BPF_MTAP(sc, m0, AWI_BPF_NORM);
 952                         m0 = awi_fix_txhdr(sc, m0);
 953                         if (sc->sc_wep_algo != NULL && m0 != NULL)
 954                                 m0 = awi_wep_encrypt(sc, m0, 1);
 955                         if (m0 == NULL) {
 956                                 ifp->if_oerrors++;
 957                                 continue;
 958                         }
 959                         ifp->if_opackets++;
 960                 }
 961 #ifdef AWI_DEBUG
 962                 if (awi_dump)
 963                         awi_dump_pkt(sc, m0, -1);
 964 #endif
 965                 AWI_BPF_MTAP(sc, m0, AWI_BPF_RAW);
 966                 len = 0;
 967                 for (m = m0; m != NULL; m = m->m_next) {
 968                         awi_write_bytes(sc, frame + len, mtod(m, u_int8_t *),
 969                             m->m_len);
 970                         len += m->m_len;
 971                 }
 972                 m_freem(m0);
 973                 rate = sc->sc_tx_rate;  /*XXX*/
 974                 awi_write_1(sc, ntxd + AWI_TXD_STATE, 0);
 975                 awi_write_4(sc, txd + AWI_TXD_START, frame);
 976                 awi_write_4(sc, txd + AWI_TXD_NEXT, ntxd);
 977                 awi_write_4(sc, txd + AWI_TXD_LENGTH, len);
 978                 awi_write_1(sc, txd + AWI_TXD_RATE, rate);
 979                 awi_write_4(sc, txd + AWI_TXD_NDA, 0);
 980                 awi_write_4(sc, txd + AWI_TXD_NRA, 0);
 981                 awi_write_1(sc, txd + AWI_TXD_STATE, AWI_TXD_ST_OWN);
 982                 sc->sc_txnext = ntxd;
 983                 sent++;
 984         }
 985         if (sent) {
 986                 if (sc->sc_tx_timer == 0)
 987                         sc->sc_tx_timer = 5;
 988                 ifp->if_timer = 1;
 989 #ifdef AWI_DEBUG
 990                 if (awi_verbose)
 991                         printf("awi_start: sent %d txdone %d txnext %d txbase %d txend %d\n", sent, sc->sc_txdone, sc->sc_txnext, sc->sc_txbase, sc->sc_txend);
 992 #endif
 993         }
 994 }
 995
 996 static void
 997 awi_txint(sc)
 998         struct awi_softc *sc;
 999 {
1000         struct ifnet *ifp = sc->sc_ifp;
1001         u_int8_t flags;
1002
1003         while (sc->sc_txdone != sc->sc_txnext) {
1004                 flags = awi_read_1(sc, sc->sc_txdone + AWI_TXD_STATE);
1005                 if ((flags & AWI_TXD_ST_OWN) || !(flags & AWI_TXD_ST_DONE))
1006                         break;
1007                 if (flags & AWI_TXD_ST_ERROR)
1008                         ifp->if_oerrors++;
1009                 sc->sc_txdone = awi_read_4(sc, sc->sc_txdone + AWI_TXD_NEXT) &
1010                     0x7fff;
1011         }
1012         sc->sc_tx_timer = 0;
1013         ifp->if_flags &= ~IFF_OACTIVE;
1014 #ifdef AWI_DEBUG
1015         if (awi_verbose)
1016                 printf("awi_txint: txdone %d txnext %d txbase %d txend %d\n",
1017                     sc->sc_txdone, sc->sc_txnext, sc->sc_txbase, sc->sc_txend);
1018 #endif
1019         awi_start(ifp);
1020 }
1021
1022 static struct mbuf *
1023 awi_fix_txhdr(sc, m0)
1024         struct awi_softc *sc;
1025         struct mbuf *m0;
1026 {
1027         struct ether_header eh;
1028         struct ieee80211_frame *wh;
1029         struct llc *llc;
1030
1031         if (m0->m_len < sizeof(eh)) {
1032                 m0 = m_pullup(m0, sizeof(eh));
1033                 if (m0 == NULL)
1034                         return NULL;
1035         }
1036         memcpy(&eh, mtod(m0, caddr_t), sizeof(eh));
1037         if (sc->sc_format_llc) {
1038                 m_adj(m0, sizeof(struct ether_header) - sizeof(struct llc));
1039                 llc = mtod(m0, struct llc *);
1040                 llc->llc_dsap = llc->llc_ssap = LLC_SNAP_LSAP;
1041                 llc->llc_control = LLC_UI;
1042                 llc->llc_snap.org_code[0] = llc->llc_snap.org_code[1] =
1043                     llc->llc_snap.org_code[2] = 0;
1044                 llc->llc_snap.ether_type = eh.ether_type;
1045         }
1046         M_PREPEND(m0, sizeof(struct ieee80211_frame), MB_DONTWAIT);
1047         if (m0 == NULL)
1048                 return NULL;
1049         wh = mtod(m0, struct ieee80211_frame *);
1050
1051         wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_DATA;
1052         LE_WRITE_2(wh->i_dur, 0);
1053         LE_WRITE_2(wh->i_seq, 0);
1054         if (sc->sc_mib_local.Network_Mode) {
1055                 wh->i_fc[1] = IEEE80211_FC1_DIR_TODS;
1056                 memcpy(wh->i_addr1, sc->sc_bss.bssid, ETHER_ADDR_LEN);
1057                 memcpy(wh->i_addr2, eh.ether_shost, ETHER_ADDR_LEN);
1058                 memcpy(wh->i_addr3, eh.ether_dhost, ETHER_ADDR_LEN);
1059         } else {
1060                 wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
1061                 memcpy(wh->i_addr1, eh.ether_dhost, ETHER_ADDR_LEN);
1062                 memcpy(wh->i_addr2, eh.ether_shost, ETHER_ADDR_LEN);
1063                 memcpy(wh->i_addr3, sc->sc_bss.bssid, ETHER_ADDR_LEN);
1064         }
1065         return m0;
1066 }
1067
1068 static struct mbuf *
1069 awi_fix_rxhdr(sc, m0)
1070         struct awi_softc *sc;
1071         struct mbuf *m0;
1072 {
1073         struct ieee80211_frame wh;
1074         struct ether_header *eh;
1075         struct llc *llc;
1076
1077         if (m0->m_len < sizeof(wh)) {
1078                 m_freem(m0);
1079                 return NULL;
1080         }
1081         llc = (struct llc *)(mtod(m0, caddr_t) + sizeof(wh));
1082         if (llc->llc_dsap == LLC_SNAP_LSAP &&
1083             llc->llc_ssap == LLC_SNAP_LSAP &&
1084             llc->llc_control == LLC_UI &&
1085             llc->llc_snap.org_code[0] == 0 &&
1086             llc->llc_snap.org_code[1] == 0 &&
1087             llc->llc_snap.org_code[2] == 0) {
1088                 memcpy(&wh, mtod(m0, caddr_t), sizeof(wh));
1089                 m_adj(m0, sizeof(wh) + sizeof(*llc) - sizeof(*eh));
1090                 eh = mtod(m0, struct ether_header *);
1091                 switch (wh.i_fc[1] & IEEE80211_FC1_DIR_MASK) {
1092                 case IEEE80211_FC1_DIR_NODS:
1093                         memcpy(eh->ether_dhost, wh.i_addr1, ETHER_ADDR_LEN);
1094                         memcpy(eh->ether_shost, wh.i_addr2, ETHER_ADDR_LEN);
1095                         break;
1096                 case IEEE80211_FC1_DIR_TODS:
1097                         memcpy(eh->ether_dhost, wh.i_addr3, ETHER_ADDR_LEN);
1098                         memcpy(eh->ether_shost, wh.i_addr2, ETHER_ADDR_LEN);
1099                         break;
1100                 case IEEE80211_FC1_DIR_FROMDS:
1101                         memcpy(eh->ether_dhost, wh.i_addr1, ETHER_ADDR_LEN);
1102                         memcpy(eh->ether_shost, wh.i_addr3, ETHER_ADDR_LEN);
1103                         break;
1104                 case IEEE80211_FC1_DIR_DSTODS:
1105                         m_freem(m0);
1106                         return NULL;
1107                 }
1108         } else {
1109                 /* assuming ethernet encapsulation, just strip 802.11 header */
1110                 m_adj(m0, sizeof(wh));
1111         }
1112         if (ALIGN(mtod(m0, caddr_t) + sizeof(struct ether_header)) !=
1113             (u_int)(mtod(m0, caddr_t) + sizeof(struct ether_header))) {
1114                 /* XXX: we loose to estimate the type of encapsulation */
1115                 struct mbuf *n, *n0, **np;
1116                 caddr_t newdata;
1117                 int off;
1118
1119                 n0 = NULL;
1120                 np = &n0;
1121                 off = 0;
1122                 while (m0->m_pkthdr.len > off) {
1123                         if (n0 == NULL) {
1124                                 MGETHDR(n, MB_DONTWAIT, MT_DATA);
1125                                 if (n == NULL) {
1126                                         m_freem(m0);
1127                                         return NULL;
1128                                 }
1129                                 M_MOVE_PKTHDR(n, m0);
1130                                 n->m_len = MHLEN;
1131                         } else {
1132                                 MGET(n, MB_DONTWAIT, MT_DATA);
1133                                 if (n == NULL) {
1134                                         m_freem(m0);
1135                                         m_freem(n0);
1136                                         return NULL;
1137                                 }
1138                                 n->m_len = MLEN;
1139                         }
1140                         if (m0->m_pkthdr.len - off >= MINCLSIZE) {
1141                                 MCLGET(n, MB_DONTWAIT);
1142                                 if (n->m_flags & M_EXT)
1143                                         n->m_len = n->m_ext.ext_size;
1144                         }
1145                         if (n0 == NULL) {
1146                                 newdata = (caddr_t)
1147                                     ALIGN(n->m_data
1148                                     + sizeof(struct ether_header))
1149                                     - sizeof(struct ether_header);
1150                                 n->m_len -= newdata - n->m_data;
1151                                 n->m_data = newdata;
1152                         }
1153                         if (n->m_len > m0->m_pkthdr.len - off)
1154                                 n->m_len = m0->m_pkthdr.len - off;
1155                         m_copydata(m0, off, n->m_len, mtod(n, caddr_t));
1156                         off += n->m_len;
1157                         *np = n;
1158                         np = &n->m_next;
1159                 }
1160                 m_freem(m0);
1161                 m0 = n0;
1162         }
1163         return m0;
1164 }
1165
1166 static void
1167 awi_input(sc, m, rxts, rssi)
1168         struct awi_softc *sc;
1169         struct mbuf *m;
1170         u_int32_t rxts;
1171         u_int8_t rssi;
1172 {
1173         struct ifnet *ifp = sc->sc_ifp;
1174         struct ieee80211_frame *wh;
1175
1176         /* trim CRC here for WEP can find its own CRC at the end of packet. */
1177         m_adj(m, -ETHER_CRC_LEN);
1178         AWI_BPF_MTAP(sc, m, AWI_BPF_RAW);
1179         wh = mtod(m, struct ieee80211_frame *);
1180         if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
1181             IEEE80211_FC0_VERSION_0) {
1182                 if_printf(ifp, "receive packet with wrong version: %x\n",
1183                           wh->i_fc[0]);
1184                 m_freem(m);
1185                 ifp->if_ierrors++;
1186                 return;
1187         }
1188         if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1189                 m = awi_wep_encrypt(sc, m, 0);
1190                 if (m == NULL) {
1191                         ifp->if_ierrors++;
1192                         return;
1193                 }
1194                 wh = mtod(m, struct ieee80211_frame *);
1195         }
1196 #ifdef AWI_DEBUG
1197         if (awi_dump)
1198                 awi_dump_pkt(sc, m, rssi);
1199 #endif
1200
1201         if ((sc->sc_mib_local.Network_Mode || !sc->sc_no_bssid) &&
1202             sc->sc_status == AWI_ST_RUNNING) {
1203                 if (memcmp(wh->i_addr2, sc->sc_bss.bssid, ETHER_ADDR_LEN) == 0) {
1204                         sc->sc_rx_timer = 10;
1205                         sc->sc_bss.rssi = rssi;
1206                 }
1207         }
1208         switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
1209         case IEEE80211_FC0_TYPE_DATA:
1210                 if (sc->sc_mib_local.Network_Mode) {
1211                         if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) !=
1212                             IEEE80211_FC1_DIR_FROMDS) {
1213                                 m_freem(m);
1214                                 return;
1215                         }
1216                 } else {
1217                         if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) !=
1218                             IEEE80211_FC1_DIR_NODS) {
1219                                 m_freem(m);
1220                                 return;
1221                         }
1222                 }
1223                 m = awi_fix_rxhdr(sc, m);
1224                 if (m == NULL) {
1225                         ifp->if_ierrors++;
1226                         break;
1227                 }
1228                 ifp->if_ipackets++;
1229 #if !(defined(__DragonFly__) || (defined(__FreeBSD__) && __FreeBSD__ >= 4))
1230                 AWI_BPF_MTAP(sc, m, AWI_BPF_NORM);
1231 #endif
1232                 (*ifp->if_input)(ifp, m);
1233                 break;
1234         case IEEE80211_FC0_TYPE_MGT:
1235                 if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) !=
1236                    IEEE80211_FC1_DIR_NODS) {
1237                         m_freem(m);
1238                         return;
1239                 }
1240                 switch (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) {
1241                 case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
1242                 case IEEE80211_FC0_SUBTYPE_BEACON:
1243                         awi_recv_beacon(sc, m, rxts, rssi);
1244                         break;
1245                 case IEEE80211_FC0_SUBTYPE_AUTH:
1246                         awi_recv_auth(sc, m);
1247                         break;
1248                 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
1249                 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
1250                         awi_recv_asresp(sc, m);
1251                         break;
1252                 case IEEE80211_FC0_SUBTYPE_DEAUTH:
1253                         if (sc->sc_mib_local.Network_Mode)
1254                                 awi_send_auth(sc, 1);
1255                         break;
1256                 case IEEE80211_FC0_SUBTYPE_DISASSOC:
1257                         if (sc->sc_mib_local.Network_Mode)
1258                                 awi_send_asreq(sc, 1);
1259                         break;
1260                 }
1261                 m_freem(m);
1262                 break;
1263         case IEEE80211_FC0_TYPE_CTL:
1264         default:
1265                 /* should not come here */
1266                 m_freem(m);
1267                 break;
1268         }
1269 }
1270
1271 static void
1272 awi_rxint(sc)
1273         struct awi_softc *sc;
1274 {
1275         u_int8_t state, rate, rssi;
1276         u_int16_t len;
1277         u_int32_t frame, next, rxts, rxoff;
1278         struct mbuf *m;
1279
1280         rxoff = sc->sc_rxdoff;
1281         for (;;) {
1282                 state = awi_read_1(sc, rxoff + AWI_RXD_HOST_DESC_STATE);
1283                 if (state & AWI_RXD_ST_OWN)
1284                         break;
1285                 if (!(state & AWI_RXD_ST_CONSUMED)) {
1286                         if (state & AWI_RXD_ST_RXERROR)
1287                                 sc->sc_ifp->if_ierrors++;
1288                         else {
1289                                 len   = awi_read_2(sc, rxoff + AWI_RXD_LEN);
1290                                 rate  = awi_read_1(sc, rxoff + AWI_RXD_RATE);
1291                                 rssi  = awi_read_1(sc, rxoff + AWI_RXD_RSSI);
1292                                 frame = awi_read_4(sc, rxoff + AWI_RXD_START_FRAME) & 0x7fff;
1293                                 rxts  = awi_read_4(sc, rxoff + AWI_RXD_LOCALTIME);
1294                                 m = awi_devget(sc, frame, len);
1295                                 if (state & AWI_RXD_ST_LF)
1296                                         awi_input(sc, m, rxts, rssi);
1297                                 else
1298                                         sc->sc_rxpend = m;
1299                         }
1300                         state |= AWI_RXD_ST_CONSUMED;
1301                         awi_write_1(sc, rxoff + AWI_RXD_HOST_DESC_STATE, state);
1302                 }
1303                 next  = awi_read_4(sc, rxoff + AWI_RXD_NEXT);
1304                 if (next & AWI_RXD_NEXT_LAST)
1305                         break;
1306                 /* make sure the next pointer is correct */
1307                 if (next != awi_read_4(sc, rxoff + AWI_RXD_NEXT))
1308                         break;
1309                 state |= AWI_RXD_ST_OWN;
1310                 awi_write_1(sc, rxoff + AWI_RXD_HOST_DESC_STATE, state);
1311                 rxoff = next & 0x7fff;
1312         }
1313         sc->sc_rxdoff = rxoff;
1314 }
1315
1316 static struct mbuf *
1317 awi_devget(sc, off, len)
1318         struct awi_softc *sc;
1319         u_int32_t off;
1320         u_int16_t len;
1321 {
1322         struct mbuf *m;
1323         struct mbuf *top, **mp;
1324         u_int tlen;
1325
1326         top = sc->sc_rxpend;
1327         mp = &top;
1328         if (top != NULL) {
1329                 sc->sc_rxpend = NULL;
1330                 top->m_pkthdr.len += len;
1331                 m = top;
1332                 while (*mp != NULL) {
1333                         m = *mp;
1334                         mp = &m->m_next;
1335                 }
1336                 if (m->m_flags & M_EXT)
1337                         tlen = m->m_ext.ext_size;
1338                 else if (m->m_flags & M_PKTHDR)
1339                         tlen = MHLEN;
1340                 else
1341                         tlen = MLEN;
1342                 tlen -= m->m_len;
1343                 if (tlen > len)
1344                         tlen = len;
1345                 awi_read_bytes(sc, off, mtod(m, u_int8_t *) + m->m_len, tlen);
1346                 off += tlen;
1347                 len -= tlen;
1348         }
1349
1350         while (len > 0) {
1351                 if (top == NULL) {
1352                         MGETHDR(m, MB_DONTWAIT, MT_DATA);
1353                         if (m == NULL)
1354                                 return NULL;
1355                         m->m_pkthdr.rcvif = sc->sc_ifp;
1356                         m->m_pkthdr.len = len;
1357                         m->m_len = MHLEN;
1358                 } else {
1359                         MGET(m, MB_DONTWAIT, MT_DATA);
1360                         if (m == NULL) {
1361                                 m_freem(top);
1362                                 return NULL;
1363                         }
1364                         m->m_len = MLEN;
1365                 }
1366                 if (len >= MINCLSIZE) {
1367                         MCLGET(m, MB_DONTWAIT);
1368                         if (m->m_flags & M_EXT)
1369                                 m->m_len = m->m_ext.ext_size;
1370                 }
1371                 if (top == NULL) {
1372                         int hdrlen = sizeof(struct ieee80211_frame) +
1373                             (sc->sc_format_llc ? sizeof(struct llc) :
1374                             sizeof(struct ether_header));
1375                         caddr_t newdata = (caddr_t)
1376                             ALIGN(m->m_data + hdrlen) - hdrlen;
1377                         m->m_len -= newdata - m->m_data;
1378                         m->m_data = newdata;
1379                 }
1380                 if (m->m_len > len)
1381                         m->m_len = len;
1382                 awi_read_bytes(sc, off, mtod(m, u_int8_t *), m->m_len);
1383                 off += m->m_len;
1384                 len -= m->m_len;
1385                 *mp = m;
1386                 mp = &m->m_next;
1387         }
1388         return top;
1389 }
1390
1391 /*
1392  * Initialize hardware and start firmware to accept commands.
1393  * Called everytime after power on firmware.
1394  */
1395
1396 static int
1397 awi_init_hw(sc)
1398         struct awi_softc *sc;
1399 {
1400         struct ifnet *ifp = sc->sc_ifp;
1401         u_int8_t status;
1402         u_int16_t intmask;
1403         int i, error;
1404
1405         sc->sc_enab_intr = 0;
1406         sc->sc_invalid = 0;     /* XXX: really? */
1407         awi_drvstate(sc, AWI_DRV_RESET);
1408
1409         /* reset firmware */
1410         am79c930_gcr_setbits(&sc->sc_chip, AM79C930_GCR_CORESET);
1411         DELAY(100);
1412         awi_write_1(sc, AWI_SELFTEST, 0);
1413         awi_write_1(sc, AWI_CMD, 0);
1414         awi_write_1(sc, AWI_BANNER, 0);
1415         am79c930_gcr_clearbits(&sc->sc_chip, AM79C930_GCR_CORESET);
1416         DELAY(100);
1417
1418         /* wait for selftest completion */
1419         for (i = 0; ; i++) {
1420                 if (i >= AWI_SELFTEST_TIMEOUT*hz/1000) {
1421                         if_printf(ifp, "failed to complete selftest (timeout)\n");
1422                         return ENXIO;
1423                 }
1424                 status = awi_read_1(sc, AWI_SELFTEST);
1425                 if ((status & 0xf0) == 0xf0)
1426                         break;
1427                 if (sc->sc_cansleep) {
1428                         sc->sc_sleep_cnt++;
1429                         (void)tsleep(sc, 0, "awitst", 1);
1430                         sc->sc_sleep_cnt--;
1431                 } else {
1432                         DELAY(1000*1000/hz);
1433                 }
1434         }
1435         if (status != AWI_SELFTEST_PASSED) {
1436                 if_printf(ifp, "failed to complete selftest (code %x)\n",
1437                           status);
1438                 return ENXIO;
1439         }
1440
1441         /* check banner to confirm firmware write it */
1442         awi_read_bytes(sc, AWI_BANNER, sc->sc_banner, AWI_BANNER_LEN);
1443         if (memcmp(sc->sc_banner, "PCnetMobile:", 12) != 0) {
1444                 if_printf(ifp, "failed to complete selftest (bad banner)\n");
1445                 for (i = 0; i < AWI_BANNER_LEN; i++)
1446                         printf("%s%02x", i ? ":" : "\t", sc->sc_banner[i]);
1447                 printf("\n");
1448                 return ENXIO;
1449         }
1450
1451         /* initializing interrupt */
1452         sc->sc_enab_intr = 1;
1453         error = awi_intr_lock(sc);
1454         if (error)
1455                 return error;
1456         intmask = AWI_INT_GROGGY | AWI_INT_SCAN_CMPLT |
1457             AWI_INT_TX | AWI_INT_RX | AWI_INT_CMD;
1458         awi_write_1(sc, AWI_INTMASK, ~intmask & 0xff);
1459         awi_write_1(sc, AWI_INTMASK2, 0);
1460         awi_write_1(sc, AWI_INTSTAT, 0);
1461         awi_write_1(sc, AWI_INTSTAT2, 0);
1462         awi_intr_unlock(sc);
1463         am79c930_gcr_setbits(&sc->sc_chip, AM79C930_GCR_ENECINT);
1464
1465         /* issueing interface test command */
1466         error = awi_cmd(sc, AWI_CMD_NOP);
1467         if (error) {
1468                 if_printf(ifp, "failed to complete selftest");
1469                 if (error == ENXIO)
1470                         printf(" (no hardware)\n");
1471                 else if (error != EWOULDBLOCK)
1472                         printf(" (error %d)\n", error);
1473                 else if (sc->sc_cansleep)
1474                         printf(" (lost interrupt)\n");
1475                 else
1476                         printf(" (command timeout)\n");
1477         }
1478         return error;
1479 }
1480
1481 /*
1482  * Extract the factory default MIB value from firmware and assign the driver
1483  * default value.
1484  * Called once at attaching the interface.
1485  */
1486
1487 static int
1488 awi_init_mibs(sc)
1489         struct awi_softc *sc;
1490 {
1491         int i, error;
1492         u_int8_t *rate;
1493
1494         if ((error = awi_mib(sc, AWI_CMD_GET_MIB, AWI_MIB_LOCAL)) != 0 ||
1495             (error = awi_mib(sc, AWI_CMD_GET_MIB, AWI_MIB_ADDR)) != 0 ||
1496             (error = awi_mib(sc, AWI_CMD_GET_MIB, AWI_MIB_MAC)) != 0 ||
1497             (error = awi_mib(sc, AWI_CMD_GET_MIB, AWI_MIB_MGT)) != 0 ||
1498             (error = awi_mib(sc, AWI_CMD_GET_MIB, AWI_MIB_PHY)) != 0) {
1499                 if_printf(sc->sc_ifp,
1500                           "failed to get default mib value (error %d)\n",
1501                           error);
1502                 return error;
1503         }
1504
1505         rate = sc->sc_mib_phy.aSuprt_Data_Rates;
1506         sc->sc_tx_rate = AWI_RATE_1MBIT;
1507         for (i = 0; i < rate[1]; i++) {
1508                 if (AWI_80211_RATE(rate[2 + i]) > sc->sc_tx_rate)
1509                         sc->sc_tx_rate = AWI_80211_RATE(rate[2 + i]);
1510         }
1511         awi_init_region(sc);
1512         memset(&sc->sc_mib_mac.aDesired_ESS_ID, 0, AWI_ESS_ID_SIZE);
1513         sc->sc_mib_mac.aDesired_ESS_ID[0] = IEEE80211_ELEMID_SSID;
1514         sc->sc_mib_local.Fragmentation_Dis = 1;
1515         sc->sc_mib_local.Accept_All_Multicast_Dis = 1;
1516         sc->sc_mib_local.Power_Saving_Mode_Dis = 1;
1517
1518         /* allocate buffers */
1519         sc->sc_txbase = AWI_BUFFERS;
1520         sc->sc_txend = sc->sc_txbase +
1521             (AWI_TXD_SIZE + sizeof(struct ieee80211_frame) +
1522             sizeof(struct ether_header) + ETHERMTU) * AWI_NTXBUFS;
1523         LE_WRITE_4(&sc->sc_mib_local.Tx_Buffer_Offset, sc->sc_txbase);
1524         LE_WRITE_4(&sc->sc_mib_local.Tx_Buffer_Size,
1525             sc->sc_txend - sc->sc_txbase);
1526         LE_WRITE_4(&sc->sc_mib_local.Rx_Buffer_Offset, sc->sc_txend);
1527         LE_WRITE_4(&sc->sc_mib_local.Rx_Buffer_Size,
1528             AWI_BUFFERS_END - sc->sc_txend);
1529         sc->sc_mib_local.Network_Mode = 1;
1530         sc->sc_mib_local.Acting_as_AP = 0;
1531         return 0;
1532 }
1533
1534 /*
1535  * Start transmitter and receiver of firmware
1536  * Called after awi_init_hw() to start operation.
1537  */
1538
1539 static int
1540 awi_init_txrx(sc)
1541         struct awi_softc *sc;
1542 {
1543         int error;
1544
1545         /* start transmitter */
1546         sc->sc_txdone = sc->sc_txnext = sc->sc_txbase;
1547         awi_write_4(sc, sc->sc_txbase + AWI_TXD_START, 0);
1548         awi_write_4(sc, sc->sc_txbase + AWI_TXD_NEXT, 0);
1549         awi_write_4(sc, sc->sc_txbase + AWI_TXD_LENGTH, 0);
1550         awi_write_1(sc, sc->sc_txbase + AWI_TXD_RATE, 0);
1551         awi_write_4(sc, sc->sc_txbase + AWI_TXD_NDA, 0);
1552         awi_write_4(sc, sc->sc_txbase + AWI_TXD_NRA, 0);
1553         awi_write_1(sc, sc->sc_txbase + AWI_TXD_STATE, 0);
1554         awi_write_4(sc, AWI_CMD_PARAMS+AWI_CA_TX_DATA, sc->sc_txbase);
1555         awi_write_4(sc, AWI_CMD_PARAMS+AWI_CA_TX_MGT, 0);
1556         awi_write_4(sc, AWI_CMD_PARAMS+AWI_CA_TX_BCAST, 0);
1557         awi_write_4(sc, AWI_CMD_PARAMS+AWI_CA_TX_PS, 0);
1558         awi_write_4(sc, AWI_CMD_PARAMS+AWI_CA_TX_CF, 0);
1559         error = awi_cmd(sc, AWI_CMD_INIT_TX);
1560         if (error)
1561                 return error;
1562
1563         /* start receiver */
1564         if (sc->sc_rxpend) {
1565                 m_freem(sc->sc_rxpend);
1566                 sc->sc_rxpend = NULL;
1567         }
1568         error = awi_cmd(sc, AWI_CMD_INIT_RX);
1569         if (error)
1570                 return error;
1571         sc->sc_rxdoff = awi_read_4(sc, AWI_CMD_PARAMS+AWI_CA_IRX_DATA_DESC);
1572         sc->sc_rxmoff = awi_read_4(sc, AWI_CMD_PARAMS+AWI_CA_IRX_PS_DESC);
1573         return 0;
1574 }
1575
1576 static void
1577 awi_stop_txrx(sc)
1578         struct awi_softc *sc;
1579 {
1580
1581         if (sc->sc_cmd_inprog)
1582                 (void)awi_cmd_wait(sc);
1583         (void)awi_cmd(sc, AWI_CMD_KILL_RX);
1584         (void)awi_cmd_wait(sc);
1585         sc->sc_cmd_inprog = AWI_CMD_FLUSH_TX;
1586         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_FTX_DATA, 1);
1587         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_FTX_MGT, 0);
1588         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_FTX_BCAST, 0);
1589         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_FTX_PS, 0);
1590         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_FTX_CF, 0);
1591         (void)awi_cmd(sc, AWI_CMD_FLUSH_TX);
1592         (void)awi_cmd_wait(sc);
1593 }
1594
1595 int
1596 awi_init_region(sc)
1597         struct awi_softc *sc;
1598 {
1599
1600         if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH) {
1601                 switch (sc->sc_mib_phy.aCurrent_Reg_Domain) {
1602                 case AWI_REG_DOMAIN_US:
1603                 case AWI_REG_DOMAIN_CA:
1604                 case AWI_REG_DOMAIN_EU:
1605                         sc->sc_scan_min = 0;
1606                         sc->sc_scan_max = 77;
1607                         break;
1608                 case AWI_REG_DOMAIN_ES:
1609                         sc->sc_scan_min = 0;
1610                         sc->sc_scan_max = 26;
1611                         break;
1612                 case AWI_REG_DOMAIN_FR:
1613                         sc->sc_scan_min = 0;
1614                         sc->sc_scan_max = 32;
1615                         break;
1616                 case AWI_REG_DOMAIN_JP:
1617                         sc->sc_scan_min = 6;
1618                         sc->sc_scan_max = 17;
1619                         break;
1620                 default:
1621                         return EINVAL;
1622                 }
1623                 sc->sc_scan_set = sc->sc_scan_cur % 3 + 1;
1624         } else {
1625                 switch (sc->sc_mib_phy.aCurrent_Reg_Domain) {
1626                 case AWI_REG_DOMAIN_US:
1627                 case AWI_REG_DOMAIN_CA:
1628                         sc->sc_scan_min = 1;
1629                         sc->sc_scan_max = 11;
1630                         sc->sc_scan_cur = 3;
1631                         break;
1632                 case AWI_REG_DOMAIN_EU:
1633                         sc->sc_scan_min = 1;
1634                         sc->sc_scan_max = 13;
1635                         sc->sc_scan_cur = 3;
1636                         break;
1637                 case AWI_REG_DOMAIN_ES:
1638                         sc->sc_scan_min = 10;
1639                         sc->sc_scan_max = 11;
1640                         sc->sc_scan_cur = 10;
1641                         break;
1642                 case AWI_REG_DOMAIN_FR:
1643                         sc->sc_scan_min = 10;
1644                         sc->sc_scan_max = 13;
1645                         sc->sc_scan_cur = 10;
1646                         break;
1647                 case AWI_REG_DOMAIN_JP:
1648                         sc->sc_scan_min = 14;
1649                         sc->sc_scan_max = 14;
1650                         sc->sc_scan_cur = 14;
1651                         break;
1652                 default:
1653                         return EINVAL;
1654                 }
1655         }
1656         sc->sc_ownch = sc->sc_scan_cur;
1657         return 0;
1658 }
1659
1660 static int
1661 awi_start_scan(sc)
1662         struct awi_softc *sc;
1663 {
1664         int error = 0;
1665         struct awi_bss *bp;
1666
1667         while ((bp = TAILQ_FIRST(&sc->sc_scan)) != NULL) {
1668                 TAILQ_REMOVE(&sc->sc_scan, bp, list);
1669                 free(bp, M_DEVBUF);
1670         }
1671         if (!sc->sc_mib_local.Network_Mode && sc->sc_no_bssid) {
1672                 memset(&sc->sc_bss, 0, sizeof(sc->sc_bss));
1673                 sc->sc_bss.essid[0] = IEEE80211_ELEMID_SSID;
1674                 if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH) {
1675                         sc->sc_bss.chanset = sc->sc_ownch % 3 + 1;
1676                         sc->sc_bss.pattern = sc->sc_ownch;
1677                         sc->sc_bss.index = 1;
1678                         sc->sc_bss.dwell_time = 200;    /*XXX*/
1679                 } else
1680                         sc->sc_bss.chanset = sc->sc_ownch;
1681                 sc->sc_status = AWI_ST_SETSS;
1682                 error = awi_set_ss(sc);
1683         } else {
1684                 if (sc->sc_mib_local.Network_Mode)
1685                         awi_drvstate(sc, AWI_DRV_INFSC);
1686                 else
1687                         awi_drvstate(sc, AWI_DRV_ADHSC);
1688                 sc->sc_start_bss = 0;
1689                 sc->sc_active_scan = 1;
1690                 sc->sc_mgt_timer = AWI_ASCAN_WAIT / 1000;
1691                 sc->sc_ifp->if_timer = 1;
1692                 sc->sc_status = AWI_ST_SCAN;
1693                 error = awi_cmd_scan(sc);
1694         }
1695         return error;
1696 }
1697
1698 static int
1699 awi_next_scan(sc)
1700         struct awi_softc *sc;
1701 {
1702         int error;
1703
1704         for (;;) {
1705                 /*
1706                  * The pattern parameter for FH phy should be incremented
1707                  * by 3.  But BayStack 650 Access Points apparently always
1708                  * assign hop pattern set parameter to 1 for any pattern.
1709                  * So we try all combinations of pattern/set parameters.
1710                  * Since this causes no error, it may be a bug of
1711                  * PCnetMobile firmware.
1712                  */
1713                 sc->sc_scan_cur++;
1714                 if (sc->sc_scan_cur > sc->sc_scan_max) {
1715                         sc->sc_scan_cur = sc->sc_scan_min;
1716                         if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH)
1717                                 sc->sc_scan_set = sc->sc_scan_set % 3 + 1;
1718                 }
1719                 error = awi_cmd_scan(sc);
1720                 if (error != EINVAL)
1721                         break;
1722         }
1723         return error;
1724 }
1725
1726 static void
1727 awi_stop_scan(sc)
1728         struct awi_softc *sc;
1729 {
1730         struct ifnet *ifp = sc->sc_ifp;
1731         struct awi_bss *bp, *sbp;
1732         int fail;
1733
1734         bp = TAILQ_FIRST(&sc->sc_scan);
1735         if (bp == NULL) {
1736   notfound:
1737                 if (sc->sc_active_scan) {
1738                         if (ifp->if_flags & IFF_DEBUG)
1739                                 if_printf(ifp, "entering passive scan mode\n");
1740                         sc->sc_active_scan = 0;
1741                 }
1742                 sc->sc_mgt_timer = AWI_PSCAN_WAIT / 1000;
1743                 ifp->if_timer = 1;
1744                 (void)awi_next_scan(sc);
1745                 return;
1746         }
1747         sbp = NULL;
1748         if (ifp->if_flags & IFF_DEBUG)
1749                 if_printf(ifp, "\tmacaddr     ch/pat   sig flag  wep  essid\n");
1750         for (; bp != NULL; bp = TAILQ_NEXT(bp, list)) {
1751                 if (bp->fails) {
1752                         /*
1753                          * The configuration of the access points may change
1754                          * during my scan.  So we retries to associate with
1755                          * it unless there are any suitable AP.
1756                          */
1757                         if (bp->fails++ < 3)
1758                                 continue;
1759                         bp->fails = 0;
1760                 }
1761                 fail = 0;
1762                 /*
1763                  * Since the firmware apparently scans not only the specified
1764                  * channel of SCAN command but all available channel within
1765                  * the region, we should filter out unnecessary responses here.
1766                  */
1767                 if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH) {
1768                         if (bp->pattern < sc->sc_scan_min ||
1769                             bp->pattern > sc->sc_scan_max)
1770                                 fail |= 0x01;
1771                 } else {
1772                         if (bp->chanset < sc->sc_scan_min ||
1773                             bp->chanset > sc->sc_scan_max)
1774                                 fail |= 0x01;
1775                 }
1776                 if (sc->sc_mib_local.Network_Mode) {
1777                         if (!(bp->capinfo & IEEE80211_CAPINFO_ESS) ||
1778                             (bp->capinfo & IEEE80211_CAPINFO_IBSS))
1779                                 fail |= 0x02;
1780                 } else {
1781                         if ((bp->capinfo & IEEE80211_CAPINFO_ESS) ||
1782                             !(bp->capinfo & IEEE80211_CAPINFO_IBSS))
1783                                 fail |= 0x02;
1784                 }
1785                 if (sc->sc_wep_algo == NULL) {
1786                         if (bp->capinfo & IEEE80211_CAPINFO_PRIVACY)
1787                                 fail |= 0x04;
1788                 } else {
1789                         if (!(bp->capinfo & IEEE80211_CAPINFO_PRIVACY))
1790                                 fail |= 0x04;
1791                 }
1792                 if (sc->sc_mib_mac.aDesired_ESS_ID[1] != 0 &&
1793                     memcmp(&sc->sc_mib_mac.aDesired_ESS_ID, bp->essid,
1794                     sizeof(bp->essid)) != 0)
1795                         fail |= 0x08;
1796                 if (ifp->if_flags & IFF_DEBUG) {
1797                         printf(" %c %6D", fail ? '-' : '+', bp->esrc, ":");
1798                         if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH)
1799                                 printf("  %2d/%d%c", bp->pattern, bp->chanset,
1800                                     fail & 0x01 ? '!' : ' ');
1801                         else
1802                                 printf("  %4d%c", bp->chanset,
1803                                     fail & 0x01 ? '!' : ' ');
1804                         printf(" %+4d", bp->rssi);
1805                         printf(" %4s%c",
1806                             (bp->capinfo & IEEE80211_CAPINFO_ESS) ? "ess" :
1807                             (bp->capinfo & IEEE80211_CAPINFO_IBSS) ? "ibss" :
1808                             "????",
1809                             fail & 0x02 ? '!' : ' ');
1810                         printf(" %3s%c ",
1811                             (bp->capinfo & IEEE80211_CAPINFO_PRIVACY) ? "wep" :
1812                             "no",
1813                             fail & 0x04 ? '!' : ' ');
1814                         awi_print_essid(bp->essid);
1815                         printf("%s\n", fail & 0x08 ? "!" : "");
1816                 }
1817                 if (!fail) {
1818                         if (sbp == NULL || bp->rssi > sbp->rssi)
1819                                 sbp = bp;
1820                 }
1821         }
1822         if (sbp == NULL)
1823                 goto notfound;
1824         sc->sc_bss = *sbp;
1825         (void)awi_set_ss(sc);
1826 }
1827
1828 static void
1829 awi_recv_beacon(sc, m0, rxts, rssi)
1830         struct awi_softc *sc;
1831         struct mbuf *m0;
1832         u_int32_t rxts;
1833         u_int8_t rssi;
1834 {
1835         struct ieee80211_frame *wh;
1836         struct awi_bss *bp;
1837         u_int8_t *frame, *eframe;
1838         u_int8_t *tstamp, *bintval, *capinfo, *ssid, *rates, *parms;
1839
1840         if (sc->sc_status != AWI_ST_SCAN)
1841                 return;
1842         wh = mtod(m0, struct ieee80211_frame *);
1843
1844         frame = (u_int8_t *)&wh[1];
1845         eframe = mtod(m0, u_int8_t *) + m0->m_len;
1846         /*
1847          * XXX:
1848          *      timestamp [8]
1849          *      beacon interval [2]
1850          *      capability information [2]
1851          *      ssid [tlv]
1852          *      supported rates [tlv]
1853          *      parameter set [tlv]
1854          *      ...
1855          */
1856         if (frame + 12 > eframe) {
1857 #ifdef AWI_DEBUG
1858                 if (awi_verbose)
1859                         printf("awi_recv_beacon: frame too short \n");
1860 #endif
1861                 return;
1862         }
1863         tstamp = frame;
1864         frame += 8;
1865         bintval = frame;
1866         frame += 2;
1867         capinfo = frame;
1868         frame += 2;
1869
1870         ssid = rates = parms = NULL;
1871         while (frame < eframe) {
1872                 switch (*frame) {
1873                 case IEEE80211_ELEMID_SSID:
1874                         ssid = frame;
1875                         break;
1876                 case IEEE80211_ELEMID_RATES:
1877                         rates = frame;
1878                         break;
1879                 case IEEE80211_ELEMID_FHPARMS:
1880                 case IEEE80211_ELEMID_DSPARMS:
1881                         parms = frame;
1882                         break;
1883                 }
1884                 frame += frame[1] + 2;
1885         }
1886         if (ssid == NULL || rates == NULL || parms == NULL) {
1887 #ifdef AWI_DEBUG
1888                 if (awi_verbose)
1889                         printf("awi_recv_beacon: ssid=%p, rates=%p, parms=%p\n",
1890                             ssid, rates, parms);
1891 #endif
1892                 return;
1893         }
1894         if (ssid[1] > IEEE80211_NWID_LEN) {
1895 #ifdef AWI_DEBUG
1896                 if (awi_verbose)
1897                         printf("awi_recv_beacon: bad ssid len: %d from %6D\n",
1898                             ssid[1], wh->i_addr2, ":");
1899 #endif
1900                 return;
1901         }
1902
1903         for (bp = TAILQ_FIRST(&sc->sc_scan); bp != NULL;
1904             bp = TAILQ_NEXT(bp, list)) {
1905                 if (memcmp(bp->esrc, wh->i_addr2, ETHER_ADDR_LEN) == 0 &&
1906                     memcmp(bp->bssid, wh->i_addr3, ETHER_ADDR_LEN) == 0)
1907                         break;
1908         }
1909         if (bp == NULL) {
1910                 bp = malloc(sizeof(struct awi_bss), M_DEVBUF, M_INTWAIT);
1911                 if (bp == NULL)
1912                         return;
1913                 TAILQ_INSERT_TAIL(&sc->sc_scan, bp, list);
1914                 memcpy(bp->esrc, wh->i_addr2, ETHER_ADDR_LEN);
1915                 memcpy(bp->bssid, wh->i_addr3, ETHER_ADDR_LEN);
1916                 memset(bp->essid, 0, sizeof(bp->essid));
1917                 memcpy(bp->essid, ssid, 2 + ssid[1]);
1918         }
1919         bp->rssi = rssi;
1920         bp->rxtime = rxts;
1921         memcpy(bp->timestamp, tstamp, sizeof(bp->timestamp));
1922         bp->interval = LE_READ_2(bintval);
1923         bp->capinfo = LE_READ_2(capinfo);
1924         if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH) {
1925                 bp->chanset = parms[4];
1926                 bp->pattern = parms[5];
1927                 bp->index = parms[6];
1928                 bp->dwell_time = LE_READ_2(parms + 2);
1929         } else {
1930                 bp->chanset = parms[2];
1931                 bp->pattern = 0;
1932                 bp->index = 0;
1933                 bp->dwell_time = 0;
1934         }
1935         if (sc->sc_mgt_timer == 0)
1936                 awi_stop_scan(sc);
1937 }
1938
1939 static int
1940 awi_set_ss(sc)
1941         struct awi_softc *sc;
1942 {
1943         struct ifnet *ifp = sc->sc_ifp;
1944         struct awi_bss *bp;
1945         int error;
1946
1947         sc->sc_status = AWI_ST_SETSS;
1948         bp = &sc->sc_bss;
1949         if (ifp->if_flags & IFF_DEBUG) {
1950                 if_printf(ifp, "ch %d pat %d id %d dw %d iv %d bss %6D ssid ",
1951                           bp->chanset, bp->pattern, bp->index, bp->dwell_time,
1952                           bp->interval, bp->bssid, ":");
1953                 awi_print_essid(bp->essid);
1954                 printf("\n");
1955         }
1956         memcpy(&sc->sc_mib_mgt.aCurrent_BSS_ID, bp->bssid, ETHER_ADDR_LEN);
1957         memcpy(&sc->sc_mib_mgt.aCurrent_ESS_ID, bp->essid,
1958             AWI_ESS_ID_SIZE);
1959         LE_WRITE_2(&sc->sc_mib_mgt.aBeacon_Period, bp->interval);
1960         error = awi_mib(sc, AWI_CMD_SET_MIB, AWI_MIB_MGT);
1961         return error;
1962 }
1963
1964 static void
1965 awi_try_sync(sc)
1966         struct awi_softc *sc;
1967 {
1968         struct awi_bss *bp;
1969
1970         sc->sc_status = AWI_ST_SYNC;
1971         bp = &sc->sc_bss;
1972
1973         if (sc->sc_cmd_inprog) {
1974                 if (awi_cmd_wait(sc))
1975                         return;
1976         }
1977         sc->sc_cmd_inprog = AWI_CMD_SYNC;
1978         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SYNC_SET, bp->chanset);
1979         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SYNC_PATTERN, bp->pattern);
1980         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SYNC_IDX, bp->index);
1981         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SYNC_STARTBSS,
1982             sc->sc_start_bss ? 1 : 0);
1983         awi_write_2(sc, AWI_CMD_PARAMS+AWI_CA_SYNC_DWELL, bp->dwell_time);
1984         awi_write_2(sc, AWI_CMD_PARAMS+AWI_CA_SYNC_MBZ, 0);
1985         awi_write_bytes(sc, AWI_CMD_PARAMS+AWI_CA_SYNC_TIMESTAMP,
1986             bp->timestamp, 8);
1987         awi_write_4(sc, AWI_CMD_PARAMS+AWI_CA_SYNC_REFTIME, bp->rxtime);
1988         (void)awi_cmd(sc, AWI_CMD_SYNC);
1989 }
1990
1991 static void
1992 awi_sync_done(sc)
1993         struct awi_softc *sc;
1994 {
1995         struct ifnet *ifp = sc->sc_ifp;
1996
1997         if (sc->sc_mib_local.Network_Mode) {
1998                 awi_drvstate(sc, AWI_DRV_INFSY);
1999                 awi_send_auth(sc, 1);
2000         } else {
2001                 if (ifp->if_flags & IFF_DEBUG) {
2002                         if_printf(ifp, "synced with");
2003                         if (sc->sc_no_bssid)
2004                                 printf(" no-bssid");
2005                         else {
2006                                 printf(" %6D ssid ", sc->sc_bss.bssid, ":");
2007                                 awi_print_essid(sc->sc_bss.essid);
2008                         }
2009                         if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH)
2010                                 printf(" at chanset %d pattern %d\n",
2011                                     sc->sc_bss.chanset, sc->sc_bss.pattern);
2012                         else
2013                                 printf(" at channel %d\n", sc->sc_bss.chanset);
2014                 }
2015                 awi_drvstate(sc, AWI_DRV_ADHSY);
2016                 sc->sc_status = AWI_ST_RUNNING;
2017                 ifp->if_flags |= IFF_RUNNING;
2018                 awi_start(ifp);
2019         }
2020 }
2021
2022 static void
2023 awi_send_deauth(sc)
2024         struct awi_softc *sc;
2025 {
2026         struct ifnet *ifp = sc->sc_ifp;
2027         struct mbuf *m;
2028         struct ieee80211_frame *wh;
2029         u_int8_t *deauth;
2030
2031         MGETHDR(m, MB_DONTWAIT, MT_DATA);
2032         if (m == NULL)
2033                 return;
2034         if (ifp->if_flags & IFF_DEBUG)
2035                 if_printf(ifp, "sending deauth to %6D\n",
2036                           sc->sc_bss.bssid, ":");
2037
2038         wh = mtod(m, struct ieee80211_frame *);
2039         wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
2040             IEEE80211_FC0_SUBTYPE_AUTH;
2041         wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
2042         LE_WRITE_2(wh->i_dur, 0);
2043         LE_WRITE_2(wh->i_seq, 0);
2044         memcpy(wh->i_addr1, sc->sc_bss.bssid, ETHER_ADDR_LEN);
2045         memcpy(wh->i_addr2, sc->sc_mib_addr.aMAC_Address, ETHER_ADDR_LEN);
2046         memcpy(wh->i_addr3, sc->sc_bss.bssid, ETHER_ADDR_LEN);
2047
2048         deauth = (u_int8_t *)&wh[1];
2049         LE_WRITE_2(deauth, IEEE80211_REASON_AUTH_LEAVE);
2050         deauth += 2;
2051
2052         m->m_pkthdr.len = m->m_len = deauth - mtod(m, u_int8_t *);
2053         IF_ENQUEUE(&sc->sc_mgtq, m);
2054         awi_start(ifp);
2055         awi_drvstate(sc, AWI_DRV_INFTOSS);
2056 }
2057
2058 static void
2059 awi_send_auth(sc, seq)
2060         struct awi_softc *sc;
2061         int seq;
2062 {
2063         struct ifnet *ifp = sc->sc_ifp;
2064         struct mbuf *m;
2065         struct ieee80211_frame *wh;
2066         u_int8_t *auth;
2067
2068         MGETHDR(m, MB_DONTWAIT, MT_DATA);
2069         if (m == NULL)
2070                 return;
2071         sc->sc_status = AWI_ST_AUTH;
2072         if (ifp->if_flags & IFF_DEBUG)
2073                 if_printf(ifp, "sending auth to %6D\n",
2074                           sc->sc_bss.bssid, ":");
2075
2076         wh = mtod(m, struct ieee80211_frame *);
2077         wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
2078             IEEE80211_FC0_SUBTYPE_AUTH;
2079         wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
2080         LE_WRITE_2(wh->i_dur, 0);
2081         LE_WRITE_2(wh->i_seq, 0);
2082         memcpy(wh->i_addr1, sc->sc_bss.esrc, ETHER_ADDR_LEN);
2083         memcpy(wh->i_addr2, sc->sc_mib_addr.aMAC_Address, ETHER_ADDR_LEN);
2084         memcpy(wh->i_addr3, sc->sc_bss.bssid, ETHER_ADDR_LEN);
2085
2086         auth = (u_int8_t *)&wh[1];
2087         /* algorithm number */
2088         LE_WRITE_2(auth, IEEE80211_AUTH_ALG_OPEN);
2089         auth += 2;
2090         /* sequence number */
2091         LE_WRITE_2(auth, seq);
2092         auth += 2;
2093         /* status */
2094         LE_WRITE_2(auth, 0);
2095         auth += 2;
2096
2097         m->m_pkthdr.len = m->m_len = auth - mtod(m, u_int8_t *);
2098         IF_ENQUEUE(&sc->sc_mgtq, m);
2099         awi_start(ifp);
2100
2101         sc->sc_mgt_timer = AWI_TRANS_TIMEOUT / 1000;
2102         ifp->if_timer = 1;
2103 }
2104
2105 static void
2106 awi_recv_auth(sc, m0)
2107         struct awi_softc *sc;
2108         struct mbuf *m0;
2109 {
2110         struct ifnet *ifp = sc->sc_ifp;
2111         struct ieee80211_frame *wh;
2112         u_int8_t *auth, *eframe;
2113         struct awi_bss *bp;
2114         u_int16_t status;
2115
2116         wh = mtod(m0, struct ieee80211_frame *);
2117         auth = (u_int8_t *)&wh[1];
2118         eframe = mtod(m0, u_int8_t *) + m0->m_len;
2119         if (ifp->if_flags & IFF_DEBUG)
2120                 if_printf(ifp, "receive auth from %6D\n", wh->i_addr2, ":");
2121
2122         /* algorithm number */
2123         if (LE_READ_2(auth) != IEEE80211_AUTH_ALG_OPEN)
2124                 return;
2125         auth += 2;
2126         if (!sc->sc_mib_local.Network_Mode) {
2127                 if (sc->sc_status != AWI_ST_RUNNING)
2128                         return;
2129                 if (LE_READ_2(auth) == 1)
2130                         awi_send_auth(sc, 2);
2131                 return;
2132         }
2133         if (sc->sc_status != AWI_ST_AUTH)
2134                 return;
2135         /* sequence number */
2136         if (LE_READ_2(auth) != 2)
2137                 return;
2138         auth += 2;
2139         /* status */
2140         status = LE_READ_2(auth);
2141         if (status != 0) {
2142                 if_printf(ifp, "authentication failed (reason %d)\n", status);
2143                 for (bp = TAILQ_FIRST(&sc->sc_scan); bp != NULL;
2144                     bp = TAILQ_NEXT(bp, list)) {
2145                         if (memcmp(bp->esrc, sc->sc_bss.esrc, ETHER_ADDR_LEN)
2146                             == 0) {
2147                                 bp->fails++;
2148                                 break;
2149                         }
2150                 }
2151                 return;
2152         }
2153         sc->sc_mgt_timer = 0;
2154         awi_drvstate(sc, AWI_DRV_INFAUTH);
2155         awi_send_asreq(sc, 0);
2156 }
2157
2158 static void
2159 awi_send_asreq(sc, reassoc)
2160         struct awi_softc *sc;
2161         int reassoc;
2162 {
2163         struct ifnet *ifp = sc->sc_ifp;
2164         struct mbuf *m;
2165         struct ieee80211_frame *wh;
2166         u_int16_t lintval;
2167         u_int8_t *asreq;
2168
2169         MGETHDR(m, MB_DONTWAIT, MT_DATA);
2170         if (m == NULL)
2171                 return;
2172         sc->sc_status = AWI_ST_ASSOC;
2173         if (ifp->if_flags & IFF_DEBUG)
2174                 if_printf(ifp, "sending %sassoc req to %6D\n",
2175                     reassoc ? "re" : "", sc->sc_bss.bssid, ":");
2176
2177         wh = mtod(m, struct ieee80211_frame *);
2178         wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT;
2179         if (reassoc)
2180                 wh->i_fc[0] |= IEEE80211_FC0_SUBTYPE_REASSOC_REQ;
2181         else
2182                 wh->i_fc[0] |= IEEE80211_FC0_SUBTYPE_ASSOC_REQ;
2183         wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
2184         LE_WRITE_2(wh->i_dur, 0);
2185         LE_WRITE_2(wh->i_seq, 0);
2186         memcpy(wh->i_addr1, sc->sc_bss.esrc, ETHER_ADDR_LEN);
2187         memcpy(wh->i_addr2, sc->sc_mib_addr.aMAC_Address, ETHER_ADDR_LEN);
2188         memcpy(wh->i_addr3, sc->sc_bss.bssid, ETHER_ADDR_LEN);
2189
2190         asreq = (u_int8_t *)&wh[1];
2191
2192         /* capability info */
2193         if (sc->sc_wep_algo == NULL)
2194                 LE_WRITE_2(asreq, IEEE80211_CAPINFO_CF_POLLABLE);
2195         else
2196                 LE_WRITE_2(asreq,
2197                     IEEE80211_CAPINFO_CF_POLLABLE | IEEE80211_CAPINFO_PRIVACY);
2198         asreq += 2;
2199         /* listen interval */
2200         lintval = LE_READ_2(&sc->sc_mib_mgt.aListen_Interval);
2201         LE_WRITE_2(asreq, lintval);
2202         asreq += 2;
2203         if (reassoc) {
2204                 /* current AP address */
2205                 memcpy(asreq, sc->sc_bss.bssid, ETHER_ADDR_LEN);
2206                 asreq += ETHER_ADDR_LEN;
2207         }
2208         /* ssid */
2209         memcpy(asreq, sc->sc_bss.essid, 2 + sc->sc_bss.essid[1]);
2210         asreq += 2 + asreq[1];
2211         /* supported rates */
2212         memcpy(asreq, &sc->sc_mib_phy.aSuprt_Data_Rates, 4);
2213         asreq += 2 + asreq[1];
2214
2215         m->m_pkthdr.len = m->m_len = asreq - mtod(m, u_int8_t *);
2216         IF_ENQUEUE(&sc->sc_mgtq, m);
2217         awi_start(ifp);
2218
2219         sc->sc_mgt_timer = AWI_TRANS_TIMEOUT / 1000;
2220         ifp->if_timer = 1;
2221 }
2222
2223 static void
2224 awi_recv_asresp(sc, m0)
2225         struct awi_softc *sc;
2226         struct mbuf *m0;
2227 {
2228         struct ifnet *ifp = sc->sc_ifp;
2229         struct ieee80211_frame *wh;
2230         u_int8_t *asresp, *eframe;
2231         u_int16_t status;
2232         u_int8_t rate, *phy_rates;
2233         struct awi_bss *bp;
2234         int i, j;
2235
2236         wh = mtod(m0, struct ieee80211_frame *);
2237         asresp = (u_int8_t *)&wh[1];
2238         eframe = mtod(m0, u_int8_t *) + m0->m_len;
2239         if (ifp->if_flags & IFF_DEBUG)
2240                 if_printf(ifp, "receive assoc resp from %6D\n",
2241                           wh->i_addr2, ":");
2242
2243         if (!sc->sc_mib_local.Network_Mode)
2244                 return;
2245
2246         if (sc->sc_status != AWI_ST_ASSOC)
2247                 return;
2248         /* capability info */
2249         asresp += 2;
2250         /* status */
2251         status = LE_READ_2(asresp);
2252         if (status != 0) {
2253                 if_printf(ifp, "association failed (reason %d)\n", status);
2254                 for (bp = TAILQ_FIRST(&sc->sc_scan); bp != NULL;
2255                     bp = TAILQ_NEXT(bp, list)) {
2256                         if (memcmp(bp->esrc, sc->sc_bss.esrc, ETHER_ADDR_LEN)
2257                             == 0) {
2258                                 bp->fails++;
2259                                 break;
2260                         }
2261                 }
2262                 return;
2263         }
2264         asresp += 2;
2265         /* association id */
2266         asresp += 2;
2267         /* supported rates */
2268         rate = AWI_RATE_1MBIT;
2269         for (i = 0; i < asresp[1]; i++) {
2270                 if (AWI_80211_RATE(asresp[2 + i]) <= rate)
2271                         continue;
2272                 phy_rates = sc->sc_mib_phy.aSuprt_Data_Rates;
2273                 for (j = 0; j < phy_rates[1]; j++) {
2274                         if (AWI_80211_RATE(asresp[2 + i]) ==
2275                             AWI_80211_RATE(phy_rates[2 + j]))
2276                                 rate = AWI_80211_RATE(asresp[2 + i]);
2277                 }
2278         }
2279         if (ifp->if_flags & IFF_DEBUG) {
2280                 if_printf(ifp, "associated with %6D ssid ",
2281                           sc->sc_bss.bssid, ":");
2282                 awi_print_essid(sc->sc_bss.essid);
2283                 if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH)
2284                         printf(" chanset %d pattern %d\n",
2285                             sc->sc_bss.chanset, sc->sc_bss.pattern);
2286                 else
2287                         printf(" channel %d\n", sc->sc_bss.chanset);
2288         }
2289         sc->sc_tx_rate = rate;
2290         sc->sc_mgt_timer = 0;
2291         sc->sc_rx_timer = 10;
2292         ifp->if_timer = 1;
2293         sc->sc_status = AWI_ST_RUNNING;
2294         ifp->if_flags |= IFF_RUNNING;
2295         awi_drvstate(sc, AWI_DRV_INFASSOC);
2296         awi_start(ifp);
2297 }
2298
2299 static int
2300 awi_mib(sc, cmd, mib)
2301         struct awi_softc *sc;
2302         u_int8_t cmd;
2303         u_int8_t mib;
2304 {
2305         int error;
2306         u_int8_t size, *ptr;
2307
2308         switch (mib) {
2309         case AWI_MIB_LOCAL:
2310                 ptr = (u_int8_t *)&sc->sc_mib_local;
2311                 size = sizeof(sc->sc_mib_local);
2312                 break;
2313         case AWI_MIB_ADDR:
2314                 ptr = (u_int8_t *)&sc->sc_mib_addr;
2315                 size = sizeof(sc->sc_mib_addr);
2316                 break;
2317         case AWI_MIB_MAC:
2318                 ptr = (u_int8_t *)&sc->sc_mib_mac;
2319                 size = sizeof(sc->sc_mib_mac);
2320                 break;
2321         case AWI_MIB_STAT:
2322                 ptr = (u_int8_t *)&sc->sc_mib_stat;
2323                 size = sizeof(sc->sc_mib_stat);
2324                 break;
2325         case AWI_MIB_MGT:
2326                 ptr = (u_int8_t *)&sc->sc_mib_mgt;
2327                 size = sizeof(sc->sc_mib_mgt);
2328                 break;
2329         case AWI_MIB_PHY:
2330                 ptr = (u_int8_t *)&sc->sc_mib_phy;
2331                 size = sizeof(sc->sc_mib_phy);
2332                 break;
2333         default:
2334                 return EINVAL;
2335         }
2336         if (sc->sc_cmd_inprog) {
2337                 error = awi_cmd_wait(sc);
2338                 if (error) {
2339                         if (error == EWOULDBLOCK)
2340                                 printf("awi_mib: cmd %d inprog",
2341                                     sc->sc_cmd_inprog);
2342                         return error;
2343                 }
2344         }
2345         sc->sc_cmd_inprog = cmd;
2346         if (cmd == AWI_CMD_SET_MIB)
2347                 awi_write_bytes(sc, AWI_CMD_PARAMS+AWI_CA_MIB_DATA, ptr, size);
2348         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_MIB_TYPE, mib);
2349         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_MIB_SIZE, size);
2350         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_MIB_INDEX, 0);
2351         error = awi_cmd(sc, cmd);
2352         if (error)
2353                 return error;
2354         if (cmd == AWI_CMD_GET_MIB) {
2355                 awi_read_bytes(sc, AWI_CMD_PARAMS+AWI_CA_MIB_DATA, ptr, size);
2356 #ifdef AWI_DEBUG
2357                 if (awi_verbose) {
2358                         int i;
2359
2360                         printf("awi_mib: #%d:", mib);
2361                         for (i = 0; i < size; i++)
2362                                 printf(" %02x", ptr[i]);
2363                         printf("\n");
2364                 }
2365 #endif
2366         }
2367         return 0;
2368 }
2369
2370 static int
2371 awi_cmd_scan(sc)
2372         struct awi_softc *sc;
2373 {
2374         int error;
2375         u_int8_t scan_mode;
2376
2377         if (sc->sc_active_scan)
2378                 scan_mode = AWI_SCAN_ACTIVE;
2379         else
2380                 scan_mode = AWI_SCAN_PASSIVE;
2381         if (sc->sc_mib_mgt.aScan_Mode != scan_mode) {
2382                 sc->sc_mib_mgt.aScan_Mode = scan_mode;
2383                 error = awi_mib(sc, AWI_CMD_SET_MIB, AWI_MIB_MGT);
2384                 return error;
2385         }
2386
2387         if (sc->sc_cmd_inprog) {
2388                 error = awi_cmd_wait(sc);
2389                 if (error)
2390                         return error;
2391         }
2392         sc->sc_cmd_inprog = AWI_CMD_SCAN;
2393         awi_write_2(sc, AWI_CMD_PARAMS+AWI_CA_SCAN_DURATION,
2394             sc->sc_active_scan ? AWI_ASCAN_DURATION : AWI_PSCAN_DURATION);
2395         if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH) {
2396                 awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SCAN_SET,
2397                     sc->sc_scan_set);
2398                 awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SCAN_PATTERN,
2399                     sc->sc_scan_cur);
2400                 awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SCAN_IDX, 1);
2401         } else {
2402                 awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SCAN_SET,
2403                     sc->sc_scan_cur);
2404                 awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SCAN_PATTERN, 0);
2405                 awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SCAN_IDX, 0);
2406         }
2407         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SCAN_SUSP, 0);
2408         return awi_cmd(sc, AWI_CMD_SCAN);
2409 }
2410
2411 static int
2412 awi_cmd(sc, cmd)
2413         struct awi_softc *sc;
2414         u_int8_t cmd;
2415 {
2416         u_int8_t status;
2417         int error = 0;
2418
2419         sc->sc_cmd_inprog = cmd;
2420         awi_write_1(sc, AWI_CMD_STATUS, AWI_STAT_IDLE);
2421         awi_write_1(sc, AWI_CMD, cmd);
2422         if (sc->sc_status != AWI_ST_INIT)
2423                 return 0;
2424         error = awi_cmd_wait(sc);
2425         if (error)
2426                 return error;
2427         status = awi_read_1(sc, AWI_CMD_STATUS);
2428         awi_write_1(sc, AWI_CMD, 0);
2429         switch (status) {
2430         case AWI_STAT_OK:
2431                 break;
2432         case AWI_STAT_BADPARM:
2433                 return EINVAL;
2434         default:
2435                 if_printf(sc->sc_ifp, "command %d failed %x\n", cmd, status);
2436                 return ENXIO;
2437         }
2438         return 0;
2439 }
2440
2441 static void
2442 awi_cmd_done(sc)
2443         struct awi_softc *sc;
2444 {
2445         u_int8_t cmd, status;
2446
2447         status = awi_read_1(sc, AWI_CMD_STATUS);
2448         if (status == AWI_STAT_IDLE)
2449                 return;         /* stray interrupt */
2450
2451         cmd = sc->sc_cmd_inprog;
2452         sc->sc_cmd_inprog = 0;
2453         if (sc->sc_status == AWI_ST_INIT) {
2454                 wakeup(sc);
2455                 return;
2456         }
2457         awi_write_1(sc, AWI_CMD, 0);
2458
2459         if (status != AWI_STAT_OK) {
2460                 if_printf(sc->sc_ifp, "command %d failed %x\n", cmd, status);
2461                 return;
2462         }
2463         switch (sc->sc_status) {
2464         case AWI_ST_SCAN:
2465                 if (cmd == AWI_CMD_SET_MIB)
2466                         awi_cmd_scan(sc);       /* retry */
2467                 break;
2468         case AWI_ST_SETSS:
2469                 awi_try_sync(sc);
2470                 break;
2471         case AWI_ST_SYNC:
2472                 awi_sync_done(sc);
2473                 break;
2474         default:
2475                 break;
2476         }
2477 }
2478
2479 static int
2480 awi_next_txd(sc, len, framep, ntxdp)
2481         struct awi_softc *sc;
2482         int len;
2483         u_int32_t *framep, *ntxdp;
2484 {
2485         u_int32_t txd, ntxd, frame;
2486
2487         txd = sc->sc_txnext;
2488         frame = txd + AWI_TXD_SIZE;
2489         if (frame + len > sc->sc_txend)
2490                 frame = sc->sc_txbase;
2491         ntxd = frame + len;
2492         if (ntxd + AWI_TXD_SIZE > sc->sc_txend)
2493                 ntxd = sc->sc_txbase;
2494         *framep = frame;
2495         *ntxdp = ntxd;
2496         /*
2497          * Determine if there are any room in ring buffer.
2498          *              --- send wait,  === new data,  +++ conflict (ENOBUFS)
2499          *   base........................end
2500          *         done----txd=====ntxd         OK
2501          *       --txd=====done++++ntxd--       full
2502          *       --txd=====ntxd    done--       OK
2503          *       ==ntxd    done----txd===       OK
2504          *       ==done++++ntxd----txd===       full
2505          *       ++ntxd    txd=====done++       full
2506          */
2507         if (txd < ntxd) {
2508                 if (txd < sc->sc_txdone && ntxd + AWI_TXD_SIZE > sc->sc_txdone)
2509                         return ENOBUFS;
2510         } else {
2511                 if (txd < sc->sc_txdone || ntxd + AWI_TXD_SIZE > sc->sc_txdone)
2512                         return ENOBUFS;
2513         }
2514         return 0;
2515 }
2516
2517 static int
2518 awi_lock(sc)
2519         struct awi_softc *sc;
2520 {
2521         int error = 0;
2522
2523         if (curproc == NULL) {
2524                 /*
2525                  * XXX
2526                  * Though driver ioctl should be called with context,
2527                  * KAME ipv6 stack calls ioctl in interrupt for now.
2528                  * We simply abort the request if there are other
2529                  * ioctl requests in progress.
2530                  */
2531                 if (sc->sc_busy) {
2532                         return EWOULDBLOCK;
2533                         if (sc->sc_invalid)
2534                                 return ENXIO;
2535                 }
2536                 sc->sc_busy = 1;
2537                 sc->sc_cansleep = 0;
2538                 return 0;
2539         }
2540         while (sc->sc_busy) {
2541                 if (sc->sc_invalid)
2542                         return ENXIO;
2543                 sc->sc_sleep_cnt++;
2544                 error = tsleep(sc, PCATCH, "awilck", 0);
2545                 sc->sc_sleep_cnt--;
2546                 if (error)
2547                         return error;
2548         }
2549         sc->sc_busy = 1;
2550         sc->sc_cansleep = 1;
2551         return 0;
2552 }
2553
2554 static void
2555 awi_unlock(sc)
2556         struct awi_softc *sc;
2557 {
2558         sc->sc_busy = 0;
2559         sc->sc_cansleep = 0;
2560         if (sc->sc_sleep_cnt)
2561                 wakeup(sc);
2562 }
2563
2564 static int
2565 awi_intr_lock(sc)
2566         struct awi_softc *sc;
2567 {
2568         u_int8_t status;
2569         int i, retry;
2570
2571         status = 1;
2572         for (retry = 0; retry < 10; retry++) {
2573                 for (i = 0; i < AWI_LOCKOUT_TIMEOUT*1000/5; i++) {
2574                         status = awi_read_1(sc, AWI_LOCKOUT_HOST);
2575                         if (status == 0)
2576                                 break;
2577                         DELAY(5);
2578                 }
2579                 if (status != 0)
2580                         break;
2581                 awi_write_1(sc, AWI_LOCKOUT_MAC, 1);
2582                 status = awi_read_1(sc, AWI_LOCKOUT_HOST);
2583                 if (status == 0)
2584                         break;
2585                 awi_write_1(sc, AWI_LOCKOUT_MAC, 0);
2586         }
2587         if (status != 0) {
2588                 if_printf(sc->sc_ifp, "failed to lock interrupt\n");
2589                 return ENXIO;
2590         }
2591         return 0;
2592 }
2593
2594 static void
2595 awi_intr_unlock(sc)
2596         struct awi_softc *sc;
2597 {
2598
2599         awi_write_1(sc, AWI_LOCKOUT_MAC, 0);
2600 }
2601
2602 static int
2603 awi_cmd_wait(sc)
2604         struct awi_softc *sc;
2605 {
2606         int i, error = 0;
2607
2608         i = 0;
2609         while (sc->sc_cmd_inprog) {
2610                 if (sc->sc_invalid)
2611                         return ENXIO;
2612                 if (awi_read_1(sc, AWI_CMD) != sc->sc_cmd_inprog) {
2613                         if_printf(sc->sc_ifp, "failed to access hardware\n");
2614                         sc->sc_invalid = 1;
2615                         return ENXIO;
2616                 }
2617                 if (sc->sc_cansleep) {
2618                         sc->sc_sleep_cnt++;
2619                         error = tsleep(sc, 0, "awicmd",
2620                             AWI_CMD_TIMEOUT*hz/1000);
2621                         sc->sc_sleep_cnt--;
2622                 } else {
2623                         if (awi_read_1(sc, AWI_CMD_STATUS) != AWI_STAT_IDLE) {
2624                                 awi_cmd_done(sc);
2625                                 break;
2626                         }
2627                         if (i++ >= AWI_CMD_TIMEOUT*1000/10)
2628                                 error = EWOULDBLOCK;
2629                         else
2630                                 DELAY(10);
2631                 }
2632                 if (error)
2633                         break;
2634         }
2635         return error;
2636 }
2637
2638 static void
2639 awi_print_essid(essid)
2640         u_int8_t *essid;
2641 {
2642         int i, len;
2643         u_int8_t *p;
2644
2645         len = essid[1];
2646         if (len > IEEE80211_NWID_LEN)
2647                 len = IEEE80211_NWID_LEN;       /*XXX*/
2648         /* determine printable or not */
2649         for (i = 0, p = essid + 2; i < len; i++, p++) {
2650                 if (*p < ' ' || *p > 0x7e)
2651                         break;
2652         }
2653         if (i == len) {
2654                 printf("\"");
2655                 for (i = 0, p = essid + 2; i < len; i++, p++)
2656                         printf("%c", *p);
2657                 printf("\"");
2658         } else {
2659                 printf("0x");
2660                 for (i = 0, p = essid + 2; i < len; i++, p++)
2661                         printf("%02x", *p);
2662         }
2663 }
2664
2665 #ifdef AWI_DEBUG
2666 static void
2667 awi_dump_pkt(sc, m, rssi)
2668         struct awi_softc *sc;
2669         struct mbuf *m;
2670         int rssi;
2671 {
2672         struct ieee80211_frame *wh;
2673         int i, l;
2674
2675         wh = mtod(m, struct ieee80211_frame *);
2676
2677         if (awi_dump_mask != 0 &&
2678             ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK)==IEEE80211_FC1_DIR_NODS) &&
2679             ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK)==IEEE80211_FC0_TYPE_MGT)) {
2680                 if ((AWI_DUMP_MASK(wh->i_fc[0]) & awi_dump_mask) != 0)
2681                         return;
2682         }
2683         if (awi_dump_mask < 0 &&
2684             (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK)==IEEE80211_FC0_TYPE_DATA)
2685                 return;
2686
2687         if (rssi < 0)
2688                 printf("tx: ");
2689         else
2690                 printf("rx: ");
2691         switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) {
2692         case IEEE80211_FC1_DIR_NODS:
2693                 printf("NODS %6D->%6D(%6D)", wh->i_addr2, ":",
2694                        wh->i_addr1, ":", wh->i_addr3, ":");
2695                 break;
2696         case IEEE80211_FC1_DIR_TODS:
2697                 printf("TODS %6D->%6D(%6D)", wh->i_addr2, ":",
2698                        wh->i_addr3, ":", wh->i_addr1, ":");
2699                 break;
2700         case IEEE80211_FC1_DIR_FROMDS:
2701                 printf("FRDS %6D->%6D(%6D)", wh->i_addr3, ":",
2702                        wh->i_addr1, ":", wh->i_addr2, ":");
2703                 break;
2704         case IEEE80211_FC1_DIR_DSTODS:
2705                 printf("DSDS %6D->%6D(%6D->%6D)", (u_int8_t *)&wh[1], ":",
2706                        wh->i_addr3, ":", wh->i_addr2, ":", wh->i_addr1, ":");
2707                 break;
2708         }
2709         switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
2710         case IEEE80211_FC0_TYPE_DATA:
2711                 printf(" data");
2712                 break;
2713         case IEEE80211_FC0_TYPE_MGT:
2714                 switch (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) {
2715                 case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
2716                         printf(" probe_req");
2717                         break;
2718                 case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
2719                         printf(" probe_resp");
2720                         break;
2721                 case IEEE80211_FC0_SUBTYPE_BEACON:
2722                         printf(" beacon");
2723                         break;
2724                 case IEEE80211_FC0_SUBTYPE_AUTH:
2725                         printf(" auth");
2726                         break;
2727                 case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
2728                         printf(" assoc_req");
2729                         break;
2730                 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
2731                         printf(" assoc_resp");
2732                         break;
2733                 case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
2734                         printf(" reassoc_req");
2735                         break;
2736                 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
2737                         printf(" reassoc_resp");
2738                         break;
2739                 case IEEE80211_FC0_SUBTYPE_DEAUTH:
2740                         printf(" deauth");
2741                         break;
2742                 case IEEE80211_FC0_SUBTYPE_DISASSOC:
2743                         printf(" disassoc");
2744                         break;
2745                 default:
2746                         printf(" mgt#%d",
2747                             wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
2748                         break;
2749                 }
2750                 break;
2751         default:
2752                 printf(" type#%d",
2753                     wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK);
2754                 break;
2755         }
2756         if (wh->i_fc[1] & IEEE80211_FC1_WEP)
2757                 printf(" WEP");
2758         if (rssi >= 0)
2759                 printf(" +%d", rssi);
2760         printf("\n");
2761         if (awi_dump_len > 0) {
2762                 l = m->m_len;
2763                 if (l > awi_dump_len + sizeof(*wh))
2764                         l = awi_dump_len + sizeof(*wh);
2765                 i = sizeof(*wh);
2766                 if (awi_dump_hdr)
2767                         i = 0;
2768                 for (; i < l; i++) {
2769                         if ((i & 1) == 0)
2770                                 printf(" ");
2771                         printf("%02x", mtod(m, u_int8_t *)[i]);
2772                 }
2773                 printf("\n");
2774         }
2775 }
2776 #endif