sys/dev/netif/awi/awi.c

   1 /*      $NetBSD: awi.c,v 1.26 2000/07/21 04:48:55 onoe Exp $    */
   2 /* $FreeBSD: src/sys/dev/awi/awi.c,v 1.10.2.2 2003/01/23 21:06:42 sam Exp $ */
   3 /* $DragonFly: src/sys/dev/netif/awi/Attic/awi.c,v 1.20 2005/06/08 23:10:27 hsu Exp $ */
   4
   5 /*-
   6  * Copyright (c) 1999 The NetBSD Foundation, Inc.
   7  * All rights reserved.
   8  *
   9  * This code is derived from software contributed to The NetBSD Foundation
  10  * by Bill Sommerfeld
  11  *
  12  * Redistribution and use in source and binary forms, with or without
  13  * modification, are permitted provided that the following conditions
  14  * are met:
  15  * 1. Redistributions of source code must retain the above copyright
  16  *    notice, this list of conditions and the following disclaimer.
  17  * 2. Redistributions in binary form must reproduce the above copyright
  18  *    notice, this list of conditions and the following disclaimer in the
  19  *    documentation and/or other materials provided with the distribution.
  20  * 3. All advertising materials mentioning features or use of this software
  21  *    must display the following acknowledgement:
  22  *        This product includes software developed by the NetBSD
  23  *        Foundation, Inc. and its contributors.
  24  * 4. Neither the name of The NetBSD Foundation nor the names of its
  25  *    contributors may be used to endorse or promote products derived
  26  *    from this software without specific prior written permission.
  27  *
  28  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
  29  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  30  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  31  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
  32  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  33  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  34  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  35  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  36  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  37  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  38  * POSSIBILITY OF SUCH DAMAGE.
  39  */
  40 /*
  41  * Driver for AMD 802.11 firmware.
  42  * Uses am79c930 chip driver to talk to firmware running on the am79c930.
  43  *
  44  * More-or-less a generic ethernet-like if driver, with 802.11 gorp added.
  45  */
  46
  47 /*
  48  * todo:
  49  *      - flush tx queue on resynch.
  50  *      - clear oactive on "down".
  51  *      - rewrite copy-into-mbuf code
  52  *      - mgmt state machine gets stuck retransmitting assoc requests.
  53  *      - multicast filter.
  54  *      - fix device reset so it's more likely to work
  55  *      - show status goo through ifmedia.
  56  *
  57  * more todo:
  58  *      - deal with more 802.11 frames.
  59  *              - send reassoc request
  60  *              - deal with reassoc response
  61  *              - send/deal with disassociation
  62  *      - deal with "full" access points (no room for me).
  63  *      - power save mode
  64  *
  65  * later:
  66  *      - SSID preferences
  67  *      - need ioctls for poking at the MIBs
  68  *      - implement ad-hoc mode (including bss creation).
  69  *      - decide when to do "ad hoc" vs. infrastructure mode (IFF_LINK flags?)
  70  *              (focus on inf. mode since that will be needed for ietf)
  71  *      - deal with DH vs. FH versions of the card
  72  *      - deal with faster cards (2mb/s)
  73  *      - ?WEP goo (mmm, rc4) (it looks not particularly useful).
  74  *      - ifmedia revision.
  75  *      - common 802.11 mibish things.
  76  *      - common 802.11 media layer.
  77  */
  78
  79 /*
  80  * Driver for AMD 802.11 PCnetMobile firmware.
  81  * Uses am79c930 chip driver to talk to firmware running on the am79c930.
  82  *
  83  * The initial version of the driver was written by
  84  * Bill Sommerfeld <sommerfeld@netbsd.org>.
  85  * Then the driver module completely rewritten to support cards with DS phy
  86  * and to support adhoc mode by Atsushi Onoe <onoe@netbsd.org>
  87  */
  88
  89 #include "opt_inet.h"
  90 #if defined(__DragonFly__) || (defined(__FreeBSD__) && __FreeBSD__ >= 4)
  91 #define NBPFILTER       1
  92 #elif defined(__DragonFly__) || (defined(__FreeBSD__) && __FreeBSD__ >= 3)
  93 #include "use_bpf.h"
  94 #define NBPFILTER       NBPF
  95 #else
  96 #include "bpfilter.h"
  97 #endif
  98
  99 #include <sys/param.h>
 100 #include <sys/systm.h>
 101 #include <sys/kernel.h>
 102 #include <sys/mbuf.h>
 103 #include <sys/malloc.h>
 104 #include <sys/proc.h>
 105 #include <sys/socket.h>
 106 #include <sys/sockio.h>
 107 #include <sys/errno.h>
 108 #include <sys/syslog.h>
 109 #if defined(__DragonFly__) || (defined(__FreeBSD__) && __FreeBSD__ >= 4)
 110 #include <sys/bus.h>
 111 #else
 112 #include <sys/device.h>
 113 #endif
 114
 115 #include <net/if.h>
 116 #include <net/ifq_var.h>
 117 #include <net/if_dl.h>
 118 #if defined(__DragonFly__) || defined(__FreeBSD__)
 119 #include <net/ethernet.h>
 120 #else
 121 #include <net/if_ether.h>
 122 #endif
 123 #include <net/if_media.h>
 124 #include <net/if_llc.h>
 125 #include <netproto/802_11/ieee80211.h>
 126 #include <netproto/802_11/ieee80211_ioctl.h>
 127
 128 #ifdef INET
 129 #include <netinet/in.h>
 130 #include <netinet/in_systm.h>
 131 #include <netinet/in_var.h>
 132 #include <netinet/ip.h>
 133 #ifdef __NetBSD__
 134 #include <netinet/if_inarp.h>
 135 #else
 136 #include <netinet/if_ether.h>
 137 #endif
 138 #endif
 139
 140 #if NBPFILTER > 0
 141 #include <net/bpf.h>
 142 #include <net/bpfdesc.h>
 143 #endif
 144
 145 #include <machine/cpu.h>
 146 #include <machine/bus.h>
 147 #ifdef __NetBSD__
 148 #include <machine/intr.h>
 149 #endif
 150 #if defined(__DragonFly__) || defined(__FreeBSD__)
 151 #include <machine/clock.h>
 152 #endif
 153
 154 #ifdef __NetBSD__
 155 #include <dev/ic/am79c930reg.h>
 156 #include <dev/ic/am79c930var.h>
 157 #include <dev/ic/awireg.h>
 158 #include <dev/ic/awivar.h>
 159 #endif
 160 #if defined(__DragonFly__) || defined(__FreeBSD__)
 161 #include "am79c930reg.h"
 162 #include "am79c930var.h"
 163 #include "awireg.h"
 164 #include "awivar.h"
 165 #endif
 166
 167 static int awi_ioctl (struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *);
 168 #ifdef IFM_IEEE80211
 169 static int awi_media_rate2opt (struct awi_softc *sc, int rate);
 170 static int awi_media_opt2rate (struct awi_softc *sc, int opt);
 171 static int awi_media_change (struct ifnet *ifp);
 172 static void awi_media_status (struct ifnet *ifp, struct ifmediareq *imr);
 173 #endif
 174 static void awi_watchdog (struct ifnet *ifp);
 175 static void awi_start (struct ifnet *ifp);
 176 static void awi_txint (struct awi_softc *sc);
 177 static struct mbuf * awi_fix_txhdr (struct awi_softc *sc, struct mbuf *m0);
 178 static struct mbuf * awi_fix_rxhdr (struct awi_softc *sc, struct mbuf *m0);
 179 static void awi_input (struct awi_softc *sc, struct mbuf *m, u_int32_t rxts, u_int8_t rssi);
 180 static void awi_rxint (struct awi_softc *sc);
 181 static struct mbuf * awi_devget (struct awi_softc *sc, u_int32_t off, u_int16_t len);
 182 static int awi_init_hw (struct awi_softc *sc);
 183 static int awi_init_mibs (struct awi_softc *sc);
 184 static int awi_init_txrx (struct awi_softc *sc);
 185 static void awi_stop_txrx (struct awi_softc *sc);
 186 static int awi_start_scan (struct awi_softc *sc);
 187 static int awi_next_scan (struct awi_softc *sc);
 188 static void awi_stop_scan (struct awi_softc *sc);
 189 static void awi_recv_beacon (struct awi_softc *sc, struct mbuf *m0, u_int32_t rxts, u_int8_t rssi);
 190 static int awi_set_ss (struct awi_softc *sc);
 191 static void awi_try_sync (struct awi_softc *sc);
 192 static void awi_sync_done (struct awi_softc *sc);
 193 static void awi_send_deauth (struct awi_softc *sc);
 194 static void awi_send_auth (struct awi_softc *sc, int seq);
 195 static void awi_recv_auth (struct awi_softc *sc, struct mbuf *m0);
 196 static void awi_send_asreq (struct awi_softc *sc, int reassoc);
 197 static void awi_recv_asresp (struct awi_softc *sc, struct mbuf *m0);
 198 static int awi_mib (struct awi_softc *sc, u_int8_t cmd, u_int8_t mib);
 199 static int awi_cmd_scan (struct awi_softc *sc);
 200 static int awi_cmd (struct awi_softc *sc, u_int8_t cmd);
 201 static void awi_cmd_done (struct awi_softc *sc);
 202 static int awi_next_txd (struct awi_softc *sc, int len, u_int32_t *framep, u_int32_t*ntxdp);
 203 static int awi_lock (struct awi_softc *sc);
 204 static void awi_unlock (struct awi_softc *sc);
 205 static int awi_intr_lock (struct awi_softc *sc);
 206 static void awi_intr_unlock (struct awi_softc *sc);
 207 static int awi_cmd_wait (struct awi_softc *sc);
 208 static void awi_print_essid (u_int8_t *essid);
 209
 210 DECLARE_DUMMY_MODULE(if_awi);
 211
 212 #ifdef AWI_DEBUG
 213 static void awi_dump_pkt (struct awi_softc *sc, struct mbuf *m, int rssi);
 214 int awi_verbose = 0;
 215 int awi_dump = 0;
 216 #define AWI_DUMP_MASK(fc0)  (1 << (((fc0) & IEEE80211_FC0_SUBTYPE_MASK) >> 4))
 217 int awi_dump_mask = AWI_DUMP_MASK(IEEE80211_FC0_SUBTYPE_BEACON);
 218 int awi_dump_hdr = 0;
 219 int awi_dump_len = 28;
 220 #endif
 221
 222 #if NBPFILTER > 0
 223 #define AWI_BPF_NORM    0
 224 #define AWI_BPF_RAW     1
 225 #if defined(__DragonFly__) || defined(__FreeBSD__)
 226 #define AWI_BPF_MTAP(sc, m, raw) do {                                   \
 227         if ((sc)->sc_rawbpf == (raw))                                   \
 228                 BPF_MTAP((sc)->sc_ifp, (m));                            \
 229 } while (0);
 230 #else
 231 #define AWI_BPF_MTAP(sc, m, raw) do {                                   \
 232         if ((sc)->sc_ifp->if_bpf && (sc)->sc_rawbpf == (raw))           \
 233                 bpf_mtap((sc)->sc_ifp->if_bpf, (m));                    \
 234 } while (0);
 235 #endif
 236 #else
 237 #define AWI_BPF_MTAP(sc, m, raw)
 238 #endif
 239
 240 #ifndef llc_snap
 241 #define llc_snap              llc_un.type_snap
 242 #endif
 243
 244 devclass_t awi_devclass;
 245
 246 int
 247 awi_attach(sc)
 248         struct awi_softc *sc;
 249 {
 250         struct ifnet *ifp = sc->sc_ifp;
 251         int s;
 252         int error;
 253 #ifdef IFM_IEEE80211
 254         int i;
 255         u_int8_t *phy_rates;
 256         int mword;
 257         struct ifmediareq imr;
 258 #endif
 259
 260         s = splnet();
 261         /*
 262          * Even if we can sleep in initialization state,
 263          * all other processes (e.g. ifconfig) have to wait for
 264          * completion of attaching interface.
 265          */
 266         sc->sc_busy = 1;
 267         sc->sc_status = AWI_ST_INIT;
 268         TAILQ_INIT(&sc->sc_scan);
 269         error = awi_init_hw(sc);
 270         if (error) {
 271                 sc->sc_invalid = 1;
 272                 splx(s);
 273                 return error;
 274         }
 275         error = awi_init_mibs(sc);
 276         splx(s);
 277         if (error) {
 278                 sc->sc_invalid = 1;
 279                 return error;
 280         }
 281
 282         ifp->if_softc = sc;
 283         ifp->if_start = awi_start;
 284         ifp->if_ioctl = awi_ioctl;
 285         ifp->if_watchdog = awi_watchdog;
 286         ifp->if_mtu = ETHERMTU;
 287         ifp->if_hdrlen = sizeof(struct ieee80211_frame) +
 288             sizeof(struct ether_header);
 289         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
 290 #ifdef IFF_NOTRAILERS
 291         ifp->if_flags |= IFF_NOTRAILERS;
 292 #endif
 293 #ifdef __NetBSD__
 294         memcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
 295 #endif
 296 #if defined(__DragonFly__) || defined(__FreeBSD__)
 297         ifq_set_maxlen(&ifp->if_snd, ifqmaxlen);
 298         ifq_set_ready(&ifp->if_snd);
 299         memcpy(sc->sc_ec.ac_enaddr, sc->sc_mib_addr.aMAC_Address,
 300             ETHER_ADDR_LEN);
 301 #endif
 302
 303         if_printf(ifp, "IEEE802.11 %s %dMbps (firmware %s)\n",
 304             sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH ? "FH" : "DS",
 305             sc->sc_tx_rate / 10, sc->sc_banner);
 306         ether_ifattach(ifp, sc->sc_mib_addr.aMAC_Address);
 307
 308 #ifdef IFM_IEEE80211
 309         ifmedia_init(&sc->sc_media, 0, awi_media_change, awi_media_status);
 310         phy_rates = sc->sc_mib_phy.aSuprt_Data_Rates;
 311         for (i = 0; i < phy_rates[1]; i++) {
 312                 mword = awi_media_rate2opt(sc, AWI_80211_RATE(phy_rates[2 + i]));
 313                 if (mword == 0)
 314                         continue;
 315                 mword |= IFM_IEEE80211;
 316                 ifmedia_add(&sc->sc_media, mword, 0, NULL);
 317                 ifmedia_add(&sc->sc_media,
 318                     mword | IFM_IEEE80211_ADHOC, 0, NULL);
 319                 if (sc->sc_mib_phy.IEEE_PHY_Type != AWI_PHY_TYPE_FH)
 320                         ifmedia_add(&sc->sc_media,
 321                             mword | IFM_IEEE80211_ADHOC | IFM_FLAG0, 0, NULL);
 322         }
 323         awi_media_status(ifp, &imr);
 324         ifmedia_set(&sc->sc_media, imr.ifm_active);
 325 #endif
 326
 327         /* ready to accept ioctl */
 328         awi_unlock(sc);
 329
 330         /* Attach is successful. */
 331         sc->sc_attached = 1;
 332         return 0;
 333 }
 334
 335 #ifdef __NetBSD__
 336 int
 337 awi_detach(sc)
 338         struct awi_softc *sc;
 339 {
 340         struct ifnet *ifp = sc->sc_ifp;
 341         int s;
 342
 343         /* Succeed if there is no work to do. */
 344         if (!sc->sc_attached)
 345                 return (0);
 346
 347         s = splnet();
 348         sc->sc_invalid = 1;
 349         awi_stop(sc);
 350         while (sc->sc_sleep_cnt > 0) {
 351                 wakeup(sc);
 352                 (void)tsleep(sc, 0, "awidet", 1);
 353         }
 354         if (sc->sc_wep_ctx != NULL)
 355                 free(sc->sc_wep_ctx, M_DEVBUF);
 356 #if NBPFILTER > 0
 357         bpfdetach(ifp);
 358 #endif
 359 #ifdef IFM_IEEE80211
 360         ifmedia_delete_instance(&sc->sc_media, IFM_INST_ANY);
 361 #endif
 362         ether_ifdetach(ifp);
 363         if_detach(ifp);
 364         if (sc->sc_enabled) {
 365                 if (sc->sc_disable)
 366                         (*sc->sc_disable)(sc);
 367                 sc->sc_enabled = 0;
 368         }
 369         splx(s);
 370         return 0;
 371 }
 372
 373 int
 374 awi_activate(self, act)
 375         struct device *self;
 376         enum devact act;
 377 {
 378         struct awi_softc *sc = (struct awi_softc *)self;
 379         int s, error = 0;
 380
 381         s = splnet();
 382         switch (act) {
 383         case DVACT_ACTIVATE:
 384                 error = EOPNOTSUPP;
 385                 break;
 386
 387         case DVACT_DEACTIVATE:
 388                 sc->sc_invalid = 1;
 389                 if (sc->sc_ifp)
 390                         if_deactivate(sc->sc_ifp);
 391                 break;
 392         }
 393         splx(s);
 394
 395         return error;
 396 }
 397
 398 void
 399 awi_power(sc, why)
 400         struct awi_softc *sc;
 401         int why;
 402 {
 403         int s;
 404         int ocansleep;
 405
 406         if (!sc->sc_enabled)
 407                 return;
 408
 409         s = splnet();
 410         ocansleep = sc->sc_cansleep;
 411         sc->sc_cansleep = 0;
 412 #ifdef needtobefixed    /*ONOE*/
 413         if (why == PWR_RESUME) {
 414                 sc->sc_enabled = 0;
 415                 awi_init(sc);
 416                 (void)awi_intr(sc);
 417         } else {
 418                 awi_stop(sc);
 419                 if (sc->sc_disable)
 420                         (*sc->sc_disable)(sc);
 421         }
 422 #endif
 423         sc->sc_cansleep = ocansleep;
 424         splx(s);
 425 }
 426 #endif /* __NetBSD__ */
 427
 428 static int
 429 awi_ioctl(ifp, cmd, data, cr)
 430         struct ifnet *ifp;
 431         u_long cmd;
 432         caddr_t data;
 433         struct ucred *cr;
 434 {
 435         struct awi_softc *sc = ifp->if_softc;
 436         struct ifreq *ifr = (struct ifreq *)data;
 437         struct ifaddr *ifa = (struct ifaddr *)data;
 438         int s, error;
 439         struct ieee80211_nwid nwid;
 440         u_int8_t *p;
 441
 442         s = splnet();
 443
 444         /* serialize ioctl */
 445         error = awi_lock(sc);
 446         if (error)
 447                 goto cantlock;
 448         switch (cmd) {
 449         case SIOCSIFADDR:
 450                 ifp->if_flags |= IFF_UP;
 451                 switch (ifa->ifa_addr->sa_family) {
 452 #ifdef INET
 453                 case AF_INET:
 454                         arp_ifinit((void *)ifp, ifa);
 455                         break;
 456 #endif
 457                 }
 458                 /* FALLTHROUGH */
 459         case SIOCSIFFLAGS:
 460                 sc->sc_format_llc = !(ifp->if_flags & IFF_LINK0);
 461                 if (!(ifp->if_flags & IFF_UP)) {
 462                         if (sc->sc_enabled) {
 463                                 awi_stop(sc);
 464                                 if (sc->sc_disable)
 465                                         (*sc->sc_disable)(sc);
 466                                 sc->sc_enabled = 0;
 467                         }
 468                         break;
 469                 }
 470                 error = awi_init(sc);
 471                 break;
 472
 473         case SIOCADDMULTI:
 474         case SIOCDELMULTI:
 475 #if defined(__DragonFly__) || defined(__FreeBSD__)
 476                 error = ENETRESET;      /*XXX*/
 477 #else
 478                 error = (cmd == SIOCADDMULTI) ?
 479                     ether_addmulti(ifr, &sc->sc_ec) :
 480                     ether_delmulti(ifr, &sc->sc_ec);
 481 #endif
 482                 /*
 483                  * Do not rescan BSS.  Rather, just reset multicast filter.
 484                  */
 485                 if (error == ENETRESET) {
 486                         if (sc->sc_enabled)
 487                                 error = awi_init(sc);
 488                         else
 489                                 error = 0;
 490                 }
 491                 break;
 492         case SIOCSIFMTU:
 493                 if (ifr->ifr_mtu > ETHERMTU)
 494                         error = EINVAL;
 495                 else
 496                         ifp->if_mtu = ifr->ifr_mtu;
 497                 break;
 498         case SIOCS80211NWID:
 499 #if defined(__DragonFly__) || defined(__FreeBSD__)
 500                 error = suser_cred(cr, NULL_CRED_OKAY); /* EPERM if no proc */
 501                 if (error)
 502                         break;
 503 #endif
 504                 error = copyin(ifr->ifr_data, &nwid, sizeof(nwid));
 505                 if (error)
 506                         break;
 507                 if (nwid.i_len > IEEE80211_NWID_LEN) {
 508                         error = EINVAL;
 509                         break;
 510                 }
 511                 if (sc->sc_mib_mac.aDesired_ESS_ID[1] == nwid.i_len &&
 512                     memcmp(&sc->sc_mib_mac.aDesired_ESS_ID[2], nwid.i_nwid,
 513                     nwid.i_len) == 0)
 514                         break;
 515                 memset(sc->sc_mib_mac.aDesired_ESS_ID, 0, AWI_ESS_ID_SIZE);
 516                 sc->sc_mib_mac.aDesired_ESS_ID[0] = IEEE80211_ELEMID_SSID;
 517                 sc->sc_mib_mac.aDesired_ESS_ID[1] = nwid.i_len;
 518                 memcpy(&sc->sc_mib_mac.aDesired_ESS_ID[2], nwid.i_nwid,
 519                     nwid.i_len);
 520                 if (sc->sc_enabled) {
 521                         awi_stop(sc);
 522                         error = awi_init(sc);
 523                 }
 524                 break;
 525         case SIOCG80211NWID:
 526                 if (ifp->if_flags & IFF_RUNNING)
 527                         p = sc->sc_bss.essid;
 528                 else
 529                         p = sc->sc_mib_mac.aDesired_ESS_ID;
 530                 error = copyout(p + 1, ifr->ifr_data, 1 + IEEE80211_NWID_LEN);
 531                 break;
 532         case SIOCS80211NWKEY:
 533 #if defined(__DragonFly__) || defined(__FreeBSD__)
 534                 error = suser_cred(cr, NULL_CRED_OKAY); /* EPERM if no proc */
 535                 if (error)
 536                         break;
 537 #endif
 538                 error = awi_wep_setnwkey(sc, (struct ieee80211_nwkey *)data);
 539                 break;
 540         case SIOCG80211NWKEY:
 541                 error = awi_wep_getnwkey(sc, (struct ieee80211_nwkey *)data);
 542                 break;
 543 #ifdef IFM_IEEE80211
 544         case SIOCSIFMEDIA:
 545         case SIOCGIFMEDIA:
 546                 error = ifmedia_ioctl(ifp, ifr, &sc->sc_media, cmd);
 547                 break;
 548 #endif
 549         default:
 550                 error = awi_wicfg(ifp, cmd, data);
 551                 break;
 552         }
 553         awi_unlock(sc);
 554   cantlock:
 555         splx(s);
 556         return error;
 557 }
 558
 559 #ifdef IFM_IEEE80211
 560 static int
 561 awi_media_rate2opt(sc, rate)
 562         struct awi_softc *sc;
 563         int rate;
 564 {
 565         int mword;
 566
 567         mword = 0;
 568         switch (rate) {
 569         case 10:
 570                 if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH)
 571                         mword = IFM_IEEE80211_FH1;
 572                 else
 573                         mword = IFM_IEEE80211_DS1;
 574                 break;
 575         case 20:
 576                 if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH)
 577                         mword = IFM_IEEE80211_FH2;
 578                 else
 579                         mword = IFM_IEEE80211_DS2;
 580                 break;
 581         case 55:
 582                 if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_DS)
 583                         mword = IFM_IEEE80211_DS5;
 584                 break;
 585         case 110:
 586                 if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_DS)
 587                         mword = IFM_IEEE80211_DS11;
 588                 break;
 589         }
 590         return mword;
 591 }
 592
 593 static int
 594 awi_media_opt2rate(sc, opt)
 595         struct awi_softc *sc;
 596         int opt;
 597 {
 598         int rate;
 599
 600         rate = 0;
 601         switch (IFM_SUBTYPE(opt)) {
 602         case IFM_IEEE80211_FH1:
 603         case IFM_IEEE80211_FH2:
 604                 if (sc->sc_mib_phy.IEEE_PHY_Type != AWI_PHY_TYPE_FH)
 605                         return 0;
 606                 break;
 607         case IFM_IEEE80211_DS1:
 608         case IFM_IEEE80211_DS2:
 609         case IFM_IEEE80211_DS5:
 610         case IFM_IEEE80211_DS11:
 611                 if (sc->sc_mib_phy.IEEE_PHY_Type != AWI_PHY_TYPE_DS)
 612                         return 0;
 613                 break;
 614         }
 615
 616         switch (IFM_SUBTYPE(opt)) {
 617         case IFM_IEEE80211_FH1:
 618         case IFM_IEEE80211_DS1:
 619                 rate = 10;
 620                 break;
 621         case IFM_IEEE80211_FH2:
 622         case IFM_IEEE80211_DS2:
 623                 rate = 20;
 624                 break;
 625         case IFM_IEEE80211_DS5:
 626                 rate = 55;
 627                 break;
 628         case IFM_IEEE80211_DS11:
 629                 rate = 110;
 630                 break;
 631         }
 632         return rate;
 633 }
 634
 635 /*
 636  * Called from ifmedia_ioctl via awi_ioctl with lock obtained.
 637  */
 638 static int
 639 awi_media_change(ifp)
 640         struct ifnet *ifp;
 641 {
 642         struct awi_softc *sc = ifp->if_softc;
 643         struct ifmedia_entry *ime;
 644         u_int8_t *phy_rates;
 645         int i, rate, error;
 646
 647         error = 0;
 648         ime = sc->sc_media.ifm_cur;
 649         rate = awi_media_opt2rate(sc, ime->ifm_media);
 650         if (rate == 0)
 651                 return EINVAL;
 652         if (rate != sc->sc_tx_rate) {
 653                 phy_rates = sc->sc_mib_phy.aSuprt_Data_Rates;
 654                 for (i = 0; i < phy_rates[1]; i++) {
 655                         if (rate == AWI_80211_RATE(phy_rates[2 + i]))
 656                                 break;
 657                 }
 658                 if (i == phy_rates[1])
 659                         return EINVAL;
 660         }
 661         if (ime->ifm_media & IFM_IEEE80211_ADHOC) {
 662                 sc->sc_mib_local.Network_Mode = 0;
 663                 if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH)
 664                         sc->sc_no_bssid = 0;
 665                 else
 666                         sc->sc_no_bssid = (ime->ifm_media & IFM_FLAG0) ? 1 : 0;
 667         } else {
 668                 sc->sc_mib_local.Network_Mode = 1;
 669         }
 670         if (sc->sc_enabled) {
 671                 awi_stop(sc);
 672                 error = awi_init(sc);
 673         }
 674         return error;
 675 }
 676
 677 static void
 678 awi_media_status(ifp, imr)
 679         struct ifnet *ifp;
 680         struct ifmediareq *imr;
 681 {
 682         struct awi_softc *sc = ifp->if_softc;
 683
 684         imr->ifm_status = IFM_AVALID;
 685         if (ifp->if_flags & IFF_RUNNING)
 686                 imr->ifm_status |= IFM_ACTIVE;
 687         imr->ifm_active = IFM_IEEE80211;
 688         imr->ifm_active |= awi_media_rate2opt(sc, sc->sc_tx_rate);
 689         if (sc->sc_mib_local.Network_Mode == 0) {
 690                 imr->ifm_active |= IFM_IEEE80211_ADHOC;
 691                 if (sc->sc_no_bssid)
 692                         imr->ifm_active |= IFM_FLAG0;
 693         }
 694 }
 695 #endif /* IFM_IEEE80211 */
 696
 697 int
 698 awi_intr(arg)
 699         void *arg;
 700 {
 701         struct awi_softc *sc = arg;
 702         u_int16_t status;
 703         int error, handled = 0, ocansleep;
 704
 705         if (!sc->sc_enabled || !sc->sc_enab_intr || sc->sc_invalid)
 706                 return 0;
 707
 708         am79c930_gcr_setbits(&sc->sc_chip,
 709             AM79C930_GCR_DISPWDN | AM79C930_GCR_ECINT);
 710         awi_write_1(sc, AWI_DIS_PWRDN, 1);
 711         ocansleep = sc->sc_cansleep;
 712         sc->sc_cansleep = 0;
 713
 714         for (;;) {
 715                 error = awi_intr_lock(sc);
 716                 if (error)
 717                         break;
 718                 status = awi_read_1(sc, AWI_INTSTAT);
 719                 awi_write_1(sc, AWI_INTSTAT, 0);
 720                 awi_write_1(sc, AWI_INTSTAT, 0);
 721                 status |= awi_read_1(sc, AWI_INTSTAT2) << 8;
 722                 awi_write_1(sc, AWI_INTSTAT2, 0);
 723                 DELAY(10);
 724                 awi_intr_unlock(sc);
 725                 if (!sc->sc_cmd_inprog)
 726                         status &= ~AWI_INT_CMD; /* make sure */
 727                 if (status == 0)
 728                         break;
 729                 handled = 1;
 730                 if (status & AWI_INT_RX)
 731                         awi_rxint(sc);
 732                 if (status & AWI_INT_TX)
 733                         awi_txint(sc);
 734                 if (status & AWI_INT_CMD)
 735                         awi_cmd_done(sc);
 736                 if (status & AWI_INT_SCAN_CMPLT) {
 737                         if (sc->sc_status == AWI_ST_SCAN &&
 738                             sc->sc_mgt_timer > 0)
 739                                 (void)awi_next_scan(sc);
 740                 }
 741         }
 742         sc->sc_cansleep = ocansleep;
 743         am79c930_gcr_clearbits(&sc->sc_chip, AM79C930_GCR_DISPWDN);
 744         awi_write_1(sc, AWI_DIS_PWRDN, 0);
 745         return handled;
 746 }
 747
 748 int
 749 awi_init(sc)
 750         struct awi_softc *sc;
 751 {
 752         struct ifnet *ifp = sc->sc_ifp;
 753         int error, ostatus;
 754         int n;
 755 #if defined(__DragonFly__) || defined(__FreeBSD__)
 756         struct ifmultiaddr *ifma;
 757 #else
 758         struct ether_multi *enm;
 759         struct ether_multistep step;
 760 #endif
 761
 762         /* reinitialize muticast filter */
 763         n = 0;
 764         ifp->if_flags |= IFF_ALLMULTI;
 765         sc->sc_mib_local.Accept_All_Multicast_Dis = 0;
 766         if (ifp->if_flags & IFF_PROMISC) {
 767                 sc->sc_mib_mac.aPromiscuous_Enable = 1;
 768                 goto set_mib;
 769         }
 770         sc->sc_mib_mac.aPromiscuous_Enable = 0;
 771 #if defined(__DragonFly__) || defined(__FreeBSD__)
 772         if (ifp->if_amcount != 0)
 773                 goto set_mib;
 774         for (ifma = LIST_FIRST(&ifp->if_multiaddrs); ifma != NULL;
 775             ifma = LIST_NEXT(ifma, ifma_link)) {
 776                 if (ifma->ifma_addr->sa_family != AF_LINK)
 777                         continue;
 778                 if (n == AWI_GROUP_ADDR_SIZE)
 779                         goto set_mib;
 780                 memcpy(sc->sc_mib_addr.aGroup_Addresses[n],
 781                     LLADDR((struct sockaddr_dl *)ifma->ifma_addr),
 782                     ETHER_ADDR_LEN);
 783                 n++;
 784         }
 785 #else
 786         ETHER_FIRST_MULTI(step, &sc->sc_ec, enm);
 787         while (enm != NULL) {
 788                 if (n == AWI_GROUP_ADDR_SIZE ||
 789                     memcmp(enm->enm_addrlo, enm->enm_addrhi, ETHER_ADDR_LEN)
 790                     != 0)
 791                         goto set_mib;
 792                 memcpy(sc->sc_mib_addr.aGroup_Addresses[n], enm->enm_addrlo,
 793                     ETHER_ADDR_LEN);
 794                 n++;
 795                 ETHER_NEXT_MULTI(step, enm);
 796         }
 797 #endif
 798         for (; n < AWI_GROUP_ADDR_SIZE; n++)
 799                 memset(sc->sc_mib_addr.aGroup_Addresses[n], 0, ETHER_ADDR_LEN);
 800         ifp->if_flags &= ~IFF_ALLMULTI;
 801         sc->sc_mib_local.Accept_All_Multicast_Dis = 1;
 802
 803   set_mib:
 804 #ifdef notdef   /* allow non-encrypted frame for receiving. */
 805         sc->sc_mib_mgt.Wep_Required = sc->sc_wep_algo != NULL ? 1 : 0;
 806 #endif
 807         if (!sc->sc_enabled) {
 808                 sc->sc_enabled = 1;
 809                 if (sc->sc_enable)
 810                         (*sc->sc_enable)(sc);
 811                 sc->sc_status = AWI_ST_INIT;
 812                 error = awi_init_hw(sc);
 813                 if (error)
 814                         return error;
 815         }
 816         ostatus = sc->sc_status;
 817         sc->sc_status = AWI_ST_INIT;
 818         if ((error = awi_mib(sc, AWI_CMD_SET_MIB, AWI_MIB_LOCAL)) != 0 ||
 819             (error = awi_mib(sc, AWI_CMD_SET_MIB, AWI_MIB_ADDR)) != 0 ||
 820             (error = awi_mib(sc, AWI_CMD_SET_MIB, AWI_MIB_MAC)) != 0 ||
 821             (error = awi_mib(sc, AWI_CMD_SET_MIB, AWI_MIB_MGT)) != 0 ||
 822             (error = awi_mib(sc, AWI_CMD_SET_MIB, AWI_MIB_PHY)) != 0) {
 823                 awi_stop(sc);
 824                 return error;
 825         }
 826         if (ifp->if_flags & IFF_RUNNING)
 827                 sc->sc_status = AWI_ST_RUNNING;
 828         else {
 829                 if (ostatus == AWI_ST_INIT) {
 830                         error = awi_init_txrx(sc);
 831                         if (error)
 832                                 return error;
 833                 }
 834                 error = awi_start_scan(sc);
 835         }
 836         return error;
 837 }
 838
 839 void
 840 awi_stop(sc)
 841         struct awi_softc *sc;
 842 {
 843         struct ifnet *ifp = sc->sc_ifp;
 844         struct awi_bss *bp;
 845
 846         sc->sc_status = AWI_ST_INIT;
 847         if (!sc->sc_invalid) {
 848                 (void)awi_cmd_wait(sc);
 849                 if (sc->sc_mib_local.Network_Mode &&
 850                     sc->sc_status > AWI_ST_AUTH)
 851                         awi_send_deauth(sc);
 852                 awi_stop_txrx(sc);
 853         }
 854         ifp->if_flags &= ~(IFF_RUNNING|IFF_OACTIVE);
 855         ifp->if_timer = 0;
 856         sc->sc_tx_timer = sc->sc_rx_timer = sc->sc_mgt_timer = 0;
 857         IF_DRAIN(&sc->sc_mgtq);
 858         ifq_purge(&ifp->if_snd);
 859         while ((bp = TAILQ_FIRST(&sc->sc_scan)) != NULL) {
 860                 TAILQ_REMOVE(&sc->sc_scan, bp, list);
 861                 free(bp, M_DEVBUF);
 862         }
 863 }
 864
 865 static void
 866 awi_watchdog(ifp)
 867         struct ifnet *ifp;
 868 {
 869         struct awi_softc *sc = ifp->if_softc;
 870         int ocansleep;
 871
 872         if (sc->sc_invalid) {
 873                 ifp->if_timer = 0;
 874                 return;
 875         }
 876
 877         ocansleep = sc->sc_cansleep;
 878         sc->sc_cansleep = 0;
 879         if (sc->sc_tx_timer && --sc->sc_tx_timer == 0) {
 880                 if_printf(ifp, "transmit timeout\n");
 881                 awi_txint(sc);
 882         }
 883         if (sc->sc_rx_timer && --sc->sc_rx_timer == 0) {
 884                 if (ifp->if_flags & IFF_DEBUG) {
 885                         if_printf(ifp, "no recent beacons from %6D; rescanning\n",
 886                                   sc->sc_bss.bssid, ":");
 887                 }
 888                 ifp->if_flags &= ~IFF_RUNNING;
 889                 awi_start_scan(sc);
 890         }
 891         if (sc->sc_mgt_timer && --sc->sc_mgt_timer == 0) {
 892                 switch (sc->sc_status) {
 893                 case AWI_ST_SCAN:
 894                         awi_stop_scan(sc);
 895                         break;
 896                 case AWI_ST_AUTH:
 897                 case AWI_ST_ASSOC:
 898                         /* restart scan */
 899                         awi_start_scan(sc);
 900                         break;
 901                 default:
 902                         break;
 903                 }
 904         }
 905
 906         if (sc->sc_tx_timer == 0 && sc->sc_rx_timer == 0 &&
 907             sc->sc_mgt_timer == 0)
 908                 ifp->if_timer = 0;
 909         else
 910                 ifp->if_timer = 1;
 911         sc->sc_cansleep = ocansleep;
 912 }
 913
 914 static void
 915 awi_start(ifp)
 916         struct ifnet *ifp;
 917 {
 918         struct awi_softc *sc = ifp->if_softc;
 919         struct mbuf *m0, *m;
 920         u_int32_t txd, frame, ntxd;
 921         u_int8_t rate;
 922         int len, sent = 0;
 923
 924         for (;;) {
 925                 txd = sc->sc_txnext;
 926                 IF_DEQUEUE(&sc->sc_mgtq, m0);
 927                 if (m0 != NULL) {
 928                         if (awi_next_txd(sc, m0->m_pkthdr.len, &frame, &ntxd)) {
 929                                 IF_PREPEND(&sc->sc_mgtq, m0);
 930                                 ifp->if_flags |= IFF_OACTIVE;
 931                                 break;
 932                         }
 933                 } else {
 934                         if (!(ifp->if_flags & IFF_RUNNING))
 935                                 break;
 936                         m0 = ifq_poll(&ifp->if_snd);
 937                         if (m0 == NULL)
 938                                 break;
 939                         len = m0->m_pkthdr.len + sizeof(struct ieee80211_frame);
 940                         if (sc->sc_format_llc)
 941                                 len += sizeof(struct llc) -
 942                                     sizeof(struct ether_header);
 943                         if (sc->sc_wep_algo != NULL)
 944                                 len += IEEE80211_WEP_IVLEN +
 945                                     IEEE80211_WEP_KIDLEN + IEEE80211_WEP_CRCLEN;
 946                         if (awi_next_txd(sc, len, &frame, &ntxd)) {
 947                                 ifp->if_flags |= IFF_OACTIVE;
 948                                 break;
 949                         }
 950                         m0 = ifq_dequeue(&ifp->if_snd);
 951                         AWI_BPF_MTAP(sc, m0, AWI_BPF_NORM);
 952                         m0 = awi_fix_txhdr(sc, m0);
 953                         if (sc->sc_wep_algo != NULL && m0 != NULL)
 954                                 m0 = awi_wep_encrypt(sc, m0, 1);
 955                         if (m0 == NULL) {
 956                                 ifp->if_oerrors++;
 957                                 continue;
 958                         }
 959                         ifp->if_opackets++;
 960                 }
 961 #ifdef AWI_DEBUG
 962                 if (awi_dump)
 963                         awi_dump_pkt(sc, m0, -1);
 964 #endif
 965                 AWI_BPF_MTAP(sc, m0, AWI_BPF_RAW);
 966                 len = 0;
 967                 for (m = m0; m != NULL; m = m->m_next) {
 968                         awi_write_bytes(sc, frame + len, mtod(m, u_int8_t *),
 969                             m->m_len);
 970                         len += m->m_len;
 971                 }
 972                 m_freem(m0);
 973                 rate = sc->sc_tx_rate;  /*XXX*/
 974                 awi_write_1(sc, ntxd + AWI_TXD_STATE, 0);
 975                 awi_write_4(sc, txd + AWI_TXD_START, frame);
 976                 awi_write_4(sc, txd + AWI_TXD_NEXT, ntxd);
 977                 awi_write_4(sc, txd + AWI_TXD_LENGTH, len);
 978                 awi_write_1(sc, txd + AWI_TXD_RATE, rate);
 979                 awi_write_4(sc, txd + AWI_TXD_NDA, 0);
 980                 awi_write_4(sc, txd + AWI_TXD_NRA, 0);
 981                 awi_write_1(sc, txd + AWI_TXD_STATE, AWI_TXD_ST_OWN);
 982                 sc->sc_txnext = ntxd;
 983                 sent++;
 984         }
 985         if (sent) {
 986                 if (sc->sc_tx_timer == 0)
 987                         sc->sc_tx_timer = 5;
 988                 ifp->if_timer = 1;
 989 #ifdef AWI_DEBUG
 990                 if (awi_verbose)
 991                         printf("awi_start: sent %d txdone %d txnext %d txbase %d txend %d\n", sent, sc->sc_txdone, sc->sc_txnext, sc->sc_txbase, sc->sc_txend);
 992 #endif
 993         }
 994 }
 995
 996 static void
 997 awi_txint(sc)
 998         struct awi_softc *sc;
 999 {
1000         struct ifnet *ifp = sc->sc_ifp;
1001         u_int8_t flags;
1002
1003         while (sc->sc_txdone != sc->sc_txnext) {
1004                 flags = awi_read_1(sc, sc->sc_txdone + AWI_TXD_STATE);
1005                 if ((flags & AWI_TXD_ST_OWN) || !(flags & AWI_TXD_ST_DONE))
1006                         break;
1007                 if (flags & AWI_TXD_ST_ERROR)
1008                         ifp->if_oerrors++;
1009                 sc->sc_txdone = awi_read_4(sc, sc->sc_txdone + AWI_TXD_NEXT) &
1010                     0x7fff;
1011         }
1012         sc->sc_tx_timer = 0;
1013         ifp->if_flags &= ~IFF_OACTIVE;
1014 #ifdef AWI_DEBUG
1015         if (awi_verbose)
1016                 printf("awi_txint: txdone %d txnext %d txbase %d txend %d\n",
1017                     sc->sc_txdone, sc->sc_txnext, sc->sc_txbase, sc->sc_txend);
1018 #endif
1019         awi_start(ifp);
1020 }
1021
1022 static struct mbuf *
1023 awi_fix_txhdr(sc, m0)
1024         struct awi_softc *sc;
1025         struct mbuf *m0;
1026 {
1027         struct ether_header eh;
1028         struct ieee80211_frame *wh;
1029         struct llc *llc;
1030
1031         if (m0->m_len < sizeof(eh)) {
1032                 m0 = m_pullup(m0, sizeof(eh));
1033                 if (m0 == NULL)
1034                         return NULL;
1035         }
1036         memcpy(&eh, mtod(m0, caddr_t), sizeof(eh));
1037         if (sc->sc_format_llc) {
1038                 m_adj(m0, sizeof(struct ether_header) - sizeof(struct llc));
1039                 llc = mtod(m0, struct llc *);
1040                 llc->llc_dsap = llc->llc_ssap = LLC_SNAP_LSAP;
1041                 llc->llc_control = LLC_UI;
1042                 llc->llc_snap.org_code[0] = llc->llc_snap.org_code[1] =
1043                     llc->llc_snap.org_code[2] = 0;
1044                 llc->llc_snap.ether_type = eh.ether_type;
1045         }
1046         M_PREPEND(m0, sizeof(struct ieee80211_frame), MB_DONTWAIT);
1047         if (m0 == NULL)
1048                 return NULL;
1049         wh = mtod(m0, struct ieee80211_frame *);
1050
1051         wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_DATA;
1052         LE_WRITE_2(wh->i_dur, 0);
1053         LE_WRITE_2(wh->i_seq, 0);
1054         if (sc->sc_mib_local.Network_Mode) {
1055                 wh->i_fc[1] = IEEE80211_FC1_DIR_TODS;
1056                 memcpy(wh->i_addr1, sc->sc_bss.bssid, ETHER_ADDR_LEN);
1057                 memcpy(wh->i_addr2, eh.ether_shost, ETHER_ADDR_LEN);
1058                 memcpy(wh->i_addr3, eh.ether_dhost, ETHER_ADDR_LEN);
1059         } else {
1060                 wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
1061                 memcpy(wh->i_addr1, eh.ether_dhost, ETHER_ADDR_LEN);
1062                 memcpy(wh->i_addr2, eh.ether_shost, ETHER_ADDR_LEN);
1063                 memcpy(wh->i_addr3, sc->sc_bss.bssid, ETHER_ADDR_LEN);
1064         }
1065         return m0;
1066 }
1067
1068 static struct mbuf *
1069 awi_fix_rxhdr(sc, m0)
1070         struct awi_softc *sc;
1071         struct mbuf *m0;
1072 {
1073         struct ieee80211_frame wh;
1074         struct ether_header *eh;
1075         struct llc *llc;
1076
1077         if (m0->m_len < sizeof(wh)) {
1078                 m_freem(m0);
1079                 return NULL;
1080         }
1081         llc = (struct llc *)(mtod(m0, caddr_t) + sizeof(wh));
1082         if (llc->llc_dsap == LLC_SNAP_LSAP &&
1083             llc->llc_ssap == LLC_SNAP_LSAP &&
1084             llc->llc_control == LLC_UI &&
1085             llc->llc_snap.org_code[0] == 0 &&
1086             llc->llc_snap.org_code[1] == 0 &&
1087             llc->llc_snap.org_code[2] == 0) {
1088                 memcpy(&wh, mtod(m0, caddr_t), sizeof(wh));
1089                 m_adj(m0, sizeof(wh) + sizeof(*llc) - sizeof(*eh));
1090                 eh = mtod(m0, struct ether_header *);
1091                 switch (wh.i_fc[1] & IEEE80211_FC1_DIR_MASK) {
1092                 case IEEE80211_FC1_DIR_NODS:
1093                         memcpy(eh->ether_dhost, wh.i_addr1, ETHER_ADDR_LEN);
1094                         memcpy(eh->ether_shost, wh.i_addr2, ETHER_ADDR_LEN);
1095                         break;
1096                 case IEEE80211_FC1_DIR_TODS:
1097                         memcpy(eh->ether_dhost, wh.i_addr3, ETHER_ADDR_LEN);
1098                         memcpy(eh->ether_shost, wh.i_addr2, ETHER_ADDR_LEN);
1099                         break;
1100                 case IEEE80211_FC1_DIR_FROMDS:
1101                         memcpy(eh->ether_dhost, wh.i_addr1, ETHER_ADDR_LEN);
1102                         memcpy(eh->ether_shost, wh.i_addr3, ETHER_ADDR_LEN);
1103                         break;
1104                 case IEEE80211_FC1_DIR_DSTODS:
1105                         m_freem(m0);
1106                         return NULL;
1107                 }
1108         } else {
1109                 /* assuming ethernet encapsulation, just strip 802.11 header */
1110                 m_adj(m0, sizeof(wh));
1111         }
1112         if (ALIGN(mtod(m0, caddr_t) + sizeof(struct ether_header)) !=
1113             (u_int)(mtod(m0, caddr_t) + sizeof(struct ether_header))) {
1114                 /* XXX: we loose to estimate the type of encapsulation */
1115                 struct mbuf *n, *n0, **np;
1116                 caddr_t newdata;
1117                 int off;
1118
1119                 n0 = NULL;
1120                 np = &n0;
1121                 off = 0;
1122                 while (m0->m_pkthdr.len > off) {
1123                         int msize;
1124
1125                         n = m_getl(m0->m_pkthdr.len - off, MB_DONTWAIT,
1126                                    MT_DATA, n0 == NULL ? M_PKTHDR : 0, &msize);
1127                         if (n == NULL) {
1128                                 m_freem(m0);
1129                                 return (NULL);
1130                         }
1131                         n->m_len = msize;
1132                         if (n0 == NULL) {
1133                                 M_MOVE_PKTHDR(n, m0);
1134                                 newdata = (caddr_t)
1135                                     ALIGN(n->m_data
1136                                     + sizeof(struct ether_header))
1137                                     - sizeof(struct ether_header);
1138                                 n->m_len -= newdata - n->m_data;
1139                                 n->m_data = newdata;
1140                         }
1141                         if (n->m_len > m0->m_pkthdr.len - off)
1142                                 n->m_len = m0->m_pkthdr.len - off;
1143                         m_copydata(m0, off, n->m_len, mtod(n, caddr_t));
1144                         off += n->m_len;
1145                         *np = n;
1146                         np = &n->m_next;
1147                 }
1148                 m_freem(m0);
1149                 m0 = n0;
1150         }
1151         return m0;
1152 }
1153
1154 static void
1155 awi_input(sc, m, rxts, rssi)
1156         struct awi_softc *sc;
1157         struct mbuf *m;
1158         u_int32_t rxts;
1159         u_int8_t rssi;
1160 {
1161         struct ifnet *ifp = sc->sc_ifp;
1162         struct ieee80211_frame *wh;
1163
1164         /* trim CRC here for WEP can find its own CRC at the end of packet. */
1165         m_adj(m, -ETHER_CRC_LEN);
1166         AWI_BPF_MTAP(sc, m, AWI_BPF_RAW);
1167         wh = mtod(m, struct ieee80211_frame *);
1168         if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
1169             IEEE80211_FC0_VERSION_0) {
1170                 if_printf(ifp, "receive packet with wrong version: %x\n",
1171                           wh->i_fc[0]);
1172                 m_freem(m);
1173                 ifp->if_ierrors++;
1174                 return;
1175         }
1176         if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1177                 m = awi_wep_encrypt(sc, m, 0);
1178                 if (m == NULL) {
1179                         ifp->if_ierrors++;
1180                         return;
1181                 }
1182                 wh = mtod(m, struct ieee80211_frame *);
1183         }
1184 #ifdef AWI_DEBUG
1185         if (awi_dump)
1186                 awi_dump_pkt(sc, m, rssi);
1187 #endif
1188
1189         if ((sc->sc_mib_local.Network_Mode || !sc->sc_no_bssid) &&
1190             sc->sc_status == AWI_ST_RUNNING) {
1191                 if (memcmp(wh->i_addr2, sc->sc_bss.bssid, ETHER_ADDR_LEN) == 0) {
1192                         sc->sc_rx_timer = 10;
1193                         sc->sc_bss.rssi = rssi;
1194                 }
1195         }
1196         switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
1197         case IEEE80211_FC0_TYPE_DATA:
1198                 if (sc->sc_mib_local.Network_Mode) {
1199                         if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) !=
1200                             IEEE80211_FC1_DIR_FROMDS) {
1201                                 m_freem(m);
1202                                 return;
1203                         }
1204                 } else {
1205                         if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) !=
1206                             IEEE80211_FC1_DIR_NODS) {
1207                                 m_freem(m);
1208                                 return;
1209                         }
1210                 }
1211                 m = awi_fix_rxhdr(sc, m);
1212                 if (m == NULL) {
1213                         ifp->if_ierrors++;
1214                         break;
1215                 }
1216                 ifp->if_ipackets++;
1217 #if !(defined(__DragonFly__) || (defined(__FreeBSD__) && __FreeBSD__ >= 4))
1218                 AWI_BPF_MTAP(sc, m, AWI_BPF_NORM);
1219 #endif
1220                 (*ifp->if_input)(ifp, m);
1221                 break;
1222         case IEEE80211_FC0_TYPE_MGT:
1223                 if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) !=
1224                    IEEE80211_FC1_DIR_NODS) {
1225                         m_freem(m);
1226                         return;
1227                 }
1228                 switch (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) {
1229                 case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
1230                 case IEEE80211_FC0_SUBTYPE_BEACON:
1231                         awi_recv_beacon(sc, m, rxts, rssi);
1232                         break;
1233                 case IEEE80211_FC0_SUBTYPE_AUTH:
1234                         awi_recv_auth(sc, m);
1235                         break;
1236                 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
1237                 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
1238                         awi_recv_asresp(sc, m);
1239                         break;
1240                 case IEEE80211_FC0_SUBTYPE_DEAUTH:
1241                         if (sc->sc_mib_local.Network_Mode)
1242                                 awi_send_auth(sc, 1);
1243                         break;
1244                 case IEEE80211_FC0_SUBTYPE_DISASSOC:
1245                         if (sc->sc_mib_local.Network_Mode)
1246                                 awi_send_asreq(sc, 1);
1247                         break;
1248                 }
1249                 m_freem(m);
1250                 break;
1251         case IEEE80211_FC0_TYPE_CTL:
1252         default:
1253                 /* should not come here */
1254                 m_freem(m);
1255                 break;
1256         }
1257 }
1258
1259 static void
1260 awi_rxint(sc)
1261         struct awi_softc *sc;
1262 {
1263         u_int8_t state, rate, rssi;
1264         u_int16_t len;
1265         u_int32_t frame, next, rxts, rxoff;
1266         struct mbuf *m;
1267
1268         rxoff = sc->sc_rxdoff;
1269         for (;;) {
1270                 state = awi_read_1(sc, rxoff + AWI_RXD_HOST_DESC_STATE);
1271                 if (state & AWI_RXD_ST_OWN)
1272                         break;
1273                 if (!(state & AWI_RXD_ST_CONSUMED)) {
1274                         if (state & AWI_RXD_ST_RXERROR)
1275                                 sc->sc_ifp->if_ierrors++;
1276                         else {
1277                                 len   = awi_read_2(sc, rxoff + AWI_RXD_LEN);
1278                                 rate  = awi_read_1(sc, rxoff + AWI_RXD_RATE);
1279                                 rssi  = awi_read_1(sc, rxoff + AWI_RXD_RSSI);
1280                                 frame = awi_read_4(sc, rxoff + AWI_RXD_START_FRAME) & 0x7fff;
1281                                 rxts  = awi_read_4(sc, rxoff + AWI_RXD_LOCALTIME);
1282                                 m = awi_devget(sc, frame, len);
1283                                 if (state & AWI_RXD_ST_LF)
1284                                         awi_input(sc, m, rxts, rssi);
1285                                 else
1286                                         sc->sc_rxpend = m;
1287                         }
1288                         state |= AWI_RXD_ST_CONSUMED;
1289                         awi_write_1(sc, rxoff + AWI_RXD_HOST_DESC_STATE, state);
1290                 }
1291                 next  = awi_read_4(sc, rxoff + AWI_RXD_NEXT);
1292                 if (next & AWI_RXD_NEXT_LAST)
1293                         break;
1294                 /* make sure the next pointer is correct */
1295                 if (next != awi_read_4(sc, rxoff + AWI_RXD_NEXT))
1296                         break;
1297                 state |= AWI_RXD_ST_OWN;
1298                 awi_write_1(sc, rxoff + AWI_RXD_HOST_DESC_STATE, state);
1299                 rxoff = next & 0x7fff;
1300         }
1301         sc->sc_rxdoff = rxoff;
1302 }
1303
1304 static struct mbuf *
1305 awi_devget(sc, off, len)
1306         struct awi_softc *sc;
1307         u_int32_t off;
1308         u_int16_t len;
1309 {
1310         struct mbuf *m;
1311         struct mbuf *top, **mp;
1312         u_int tlen;
1313
1314         top = sc->sc_rxpend;
1315         mp = &top;
1316         if (top != NULL) {
1317                 sc->sc_rxpend = NULL;
1318                 top->m_pkthdr.len += len;
1319                 m = top;
1320                 while (*mp != NULL) {
1321                         m = *mp;
1322                         mp = &m->m_next;
1323                 }
1324                 if (m->m_flags & M_EXT)
1325                         tlen = m->m_ext.ext_size;
1326                 else if (m->m_flags & M_PKTHDR)
1327                         tlen = MHLEN;
1328                 else
1329                         tlen = MLEN;
1330                 tlen -= m->m_len;
1331                 if (tlen > len)
1332                         tlen = len;
1333                 awi_read_bytes(sc, off, mtod(m, u_int8_t *) + m->m_len, tlen);
1334                 off += tlen;
1335                 len -= tlen;
1336         }
1337
1338         while (len > 0) {
1339                 if (top == NULL) {
1340                         MGETHDR(m, MB_DONTWAIT, MT_DATA);
1341                         if (m == NULL)
1342                                 return NULL;
1343                         m->m_pkthdr.rcvif = sc->sc_ifp;
1344                         m->m_pkthdr.len = len;
1345                         m->m_len = MHLEN;
1346                 } else {
1347                         MGET(m, MB_DONTWAIT, MT_DATA);
1348                         if (m == NULL) {
1349                                 m_freem(top);
1350                                 return NULL;
1351                         }
1352                         m->m_len = MLEN;
1353                 }
1354                 if (len >= MINCLSIZE) {
1355                         MCLGET(m, MB_DONTWAIT);
1356                         if (m->m_flags & M_EXT)
1357                                 m->m_len = m->m_ext.ext_size;
1358                 }
1359                 if (top == NULL) {
1360                         int hdrlen = sizeof(struct ieee80211_frame) +
1361                             (sc->sc_format_llc ? sizeof(struct llc) :
1362                             sizeof(struct ether_header));
1363                         caddr_t newdata = (caddr_t)
1364                             ALIGN(m->m_data + hdrlen) - hdrlen;
1365                         m->m_len -= newdata - m->m_data;
1366                         m->m_data = newdata;
1367                 }
1368                 if (m->m_len > len)
1369                         m->m_len = len;
1370                 awi_read_bytes(sc, off, mtod(m, u_int8_t *), m->m_len);
1371                 off += m->m_len;
1372                 len -= m->m_len;
1373                 *mp = m;
1374                 mp = &m->m_next;
1375         }
1376         return top;
1377 }
1378
1379 /*
1380  * Initialize hardware and start firmware to accept commands.
1381  * Called everytime after power on firmware.
1382  */
1383
1384 static int
1385 awi_init_hw(sc)
1386         struct awi_softc *sc;
1387 {
1388         struct ifnet *ifp = sc->sc_ifp;
1389         u_int8_t status;
1390         u_int16_t intmask;
1391         int i, error;
1392
1393         sc->sc_enab_intr = 0;
1394         sc->sc_invalid = 0;     /* XXX: really? */
1395         awi_drvstate(sc, AWI_DRV_RESET);
1396
1397         /* reset firmware */
1398         am79c930_gcr_setbits(&sc->sc_chip, AM79C930_GCR_CORESET);
1399         DELAY(100);
1400         awi_write_1(sc, AWI_SELFTEST, 0);
1401         awi_write_1(sc, AWI_CMD, 0);
1402         awi_write_1(sc, AWI_BANNER, 0);
1403         am79c930_gcr_clearbits(&sc->sc_chip, AM79C930_GCR_CORESET);
1404         DELAY(100);
1405
1406         /* wait for selftest completion */
1407         for (i = 0; ; i++) {
1408                 if (i >= AWI_SELFTEST_TIMEOUT*hz/1000) {
1409                         if_printf(ifp, "failed to complete selftest (timeout)\n");
1410                         return ENXIO;
1411                 }
1412                 status = awi_read_1(sc, AWI_SELFTEST);
1413                 if ((status & 0xf0) == 0xf0)
1414                         break;
1415                 if (sc->sc_cansleep) {
1416                         sc->sc_sleep_cnt++;
1417                         (void)tsleep(sc, 0, "awitst", 1);
1418                         sc->sc_sleep_cnt--;
1419                 } else {
1420                         DELAY(1000*1000/hz);
1421                 }
1422         }
1423         if (status != AWI_SELFTEST_PASSED) {
1424                 if_printf(ifp, "failed to complete selftest (code %x)\n",
1425                           status);
1426                 return ENXIO;
1427         }
1428
1429         /* check banner to confirm firmware write it */
1430         awi_read_bytes(sc, AWI_BANNER, sc->sc_banner, AWI_BANNER_LEN);
1431         if (memcmp(sc->sc_banner, "PCnetMobile:", 12) != 0) {
1432                 if_printf(ifp, "failed to complete selftest (bad banner)\n");
1433                 for (i = 0; i < AWI_BANNER_LEN; i++)
1434                         printf("%s%02x", i ? ":" : "\t", sc->sc_banner[i]);
1435                 printf("\n");
1436                 return ENXIO;
1437         }
1438
1439         /* initializing interrupt */
1440         sc->sc_enab_intr = 1;
1441         error = awi_intr_lock(sc);
1442         if (error)
1443                 return error;
1444         intmask = AWI_INT_GROGGY | AWI_INT_SCAN_CMPLT |
1445             AWI_INT_TX | AWI_INT_RX | AWI_INT_CMD;
1446         awi_write_1(sc, AWI_INTMASK, ~intmask & 0xff);
1447         awi_write_1(sc, AWI_INTMASK2, 0);
1448         awi_write_1(sc, AWI_INTSTAT, 0);
1449         awi_write_1(sc, AWI_INTSTAT2, 0);
1450         awi_intr_unlock(sc);
1451         am79c930_gcr_setbits(&sc->sc_chip, AM79C930_GCR_ENECINT);
1452
1453         /* issueing interface test command */
1454         error = awi_cmd(sc, AWI_CMD_NOP);
1455         if (error) {
1456                 if_printf(ifp, "failed to complete selftest");
1457                 if (error == ENXIO)
1458                         printf(" (no hardware)\n");
1459                 else if (error != EWOULDBLOCK)
1460                         printf(" (error %d)\n", error);
1461                 else if (sc->sc_cansleep)
1462                         printf(" (lost interrupt)\n");
1463                 else
1464                         printf(" (command timeout)\n");
1465         }
1466         return error;
1467 }
1468
1469 /*
1470  * Extract the factory default MIB value from firmware and assign the driver
1471  * default value.
1472  * Called once at attaching the interface.
1473  */
1474
1475 static int
1476 awi_init_mibs(sc)
1477         struct awi_softc *sc;
1478 {
1479         int i, error;
1480         u_int8_t *rate;
1481
1482         if ((error = awi_mib(sc, AWI_CMD_GET_MIB, AWI_MIB_LOCAL)) != 0 ||
1483             (error = awi_mib(sc, AWI_CMD_GET_MIB, AWI_MIB_ADDR)) != 0 ||
1484             (error = awi_mib(sc, AWI_CMD_GET_MIB, AWI_MIB_MAC)) != 0 ||
1485             (error = awi_mib(sc, AWI_CMD_GET_MIB, AWI_MIB_MGT)) != 0 ||
1486             (error = awi_mib(sc, AWI_CMD_GET_MIB, AWI_MIB_PHY)) != 0) {
1487                 if_printf(sc->sc_ifp,
1488                           "failed to get default mib value (error %d)\n",
1489                           error);
1490                 return error;
1491         }
1492
1493         rate = sc->sc_mib_phy.aSuprt_Data_Rates;
1494         sc->sc_tx_rate = AWI_RATE_1MBIT;
1495         for (i = 0; i < rate[1]; i++) {
1496                 if (AWI_80211_RATE(rate[2 + i]) > sc->sc_tx_rate)
1497                         sc->sc_tx_rate = AWI_80211_RATE(rate[2 + i]);
1498         }
1499         awi_init_region(sc);
1500         memset(&sc->sc_mib_mac.aDesired_ESS_ID, 0, AWI_ESS_ID_SIZE);
1501         sc->sc_mib_mac.aDesired_ESS_ID[0] = IEEE80211_ELEMID_SSID;
1502         sc->sc_mib_local.Fragmentation_Dis = 1;
1503         sc->sc_mib_local.Accept_All_Multicast_Dis = 1;
1504         sc->sc_mib_local.Power_Saving_Mode_Dis = 1;
1505
1506         /* allocate buffers */
1507         sc->sc_txbase = AWI_BUFFERS;
1508         sc->sc_txend = sc->sc_txbase +
1509             (AWI_TXD_SIZE + sizeof(struct ieee80211_frame) +
1510             sizeof(struct ether_header) + ETHERMTU) * AWI_NTXBUFS;
1511         LE_WRITE_4(&sc->sc_mib_local.Tx_Buffer_Offset, sc->sc_txbase);
1512         LE_WRITE_4(&sc->sc_mib_local.Tx_Buffer_Size,
1513             sc->sc_txend - sc->sc_txbase);
1514         LE_WRITE_4(&sc->sc_mib_local.Rx_Buffer_Offset, sc->sc_txend);
1515         LE_WRITE_4(&sc->sc_mib_local.Rx_Buffer_Size,
1516             AWI_BUFFERS_END - sc->sc_txend);
1517         sc->sc_mib_local.Network_Mode = 1;
1518         sc->sc_mib_local.Acting_as_AP = 0;
1519         return 0;
1520 }
1521
1522 /*
1523  * Start transmitter and receiver of firmware
1524  * Called after awi_init_hw() to start operation.
1525  */
1526
1527 static int
1528 awi_init_txrx(sc)
1529         struct awi_softc *sc;
1530 {
1531         int error;
1532
1533         /* start transmitter */
1534         sc->sc_txdone = sc->sc_txnext = sc->sc_txbase;
1535         awi_write_4(sc, sc->sc_txbase + AWI_TXD_START, 0);
1536         awi_write_4(sc, sc->sc_txbase + AWI_TXD_NEXT, 0);
1537         awi_write_4(sc, sc->sc_txbase + AWI_TXD_LENGTH, 0);
1538         awi_write_1(sc, sc->sc_txbase + AWI_TXD_RATE, 0);
1539         awi_write_4(sc, sc->sc_txbase + AWI_TXD_NDA, 0);
1540         awi_write_4(sc, sc->sc_txbase + AWI_TXD_NRA, 0);
1541         awi_write_1(sc, sc->sc_txbase + AWI_TXD_STATE, 0);
1542         awi_write_4(sc, AWI_CMD_PARAMS+AWI_CA_TX_DATA, sc->sc_txbase);
1543         awi_write_4(sc, AWI_CMD_PARAMS+AWI_CA_TX_MGT, 0);
1544         awi_write_4(sc, AWI_CMD_PARAMS+AWI_CA_TX_BCAST, 0);
1545         awi_write_4(sc, AWI_CMD_PARAMS+AWI_CA_TX_PS, 0);
1546         awi_write_4(sc, AWI_CMD_PARAMS+AWI_CA_TX_CF, 0);
1547         error = awi_cmd(sc, AWI_CMD_INIT_TX);
1548         if (error)
1549                 return error;
1550
1551         /* start receiver */
1552         if (sc->sc_rxpend) {
1553                 m_freem(sc->sc_rxpend);
1554                 sc->sc_rxpend = NULL;
1555         }
1556         error = awi_cmd(sc, AWI_CMD_INIT_RX);
1557         if (error)
1558                 return error;
1559         sc->sc_rxdoff = awi_read_4(sc, AWI_CMD_PARAMS+AWI_CA_IRX_DATA_DESC);
1560         sc->sc_rxmoff = awi_read_4(sc, AWI_CMD_PARAMS+AWI_CA_IRX_PS_DESC);
1561         return 0;
1562 }
1563
1564 static void
1565 awi_stop_txrx(sc)
1566         struct awi_softc *sc;
1567 {
1568
1569         if (sc->sc_cmd_inprog)
1570                 (void)awi_cmd_wait(sc);
1571         (void)awi_cmd(sc, AWI_CMD_KILL_RX);
1572         (void)awi_cmd_wait(sc);
1573         sc->sc_cmd_inprog = AWI_CMD_FLUSH_TX;
1574         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_FTX_DATA, 1);
1575         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_FTX_MGT, 0);
1576         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_FTX_BCAST, 0);
1577         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_FTX_PS, 0);
1578         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_FTX_CF, 0);
1579         (void)awi_cmd(sc, AWI_CMD_FLUSH_TX);
1580         (void)awi_cmd_wait(sc);
1581 }
1582
1583 int
1584 awi_init_region(sc)
1585         struct awi_softc *sc;
1586 {
1587
1588         if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH) {
1589                 switch (sc->sc_mib_phy.aCurrent_Reg_Domain) {
1590                 case AWI_REG_DOMAIN_US:
1591                 case AWI_REG_DOMAIN_CA:
1592                 case AWI_REG_DOMAIN_EU:
1593                         sc->sc_scan_min = 0;
1594                         sc->sc_scan_max = 77;
1595                         break;
1596                 case AWI_REG_DOMAIN_ES:
1597                         sc->sc_scan_min = 0;
1598                         sc->sc_scan_max = 26;
1599                         break;
1600                 case AWI_REG_DOMAIN_FR:
1601                         sc->sc_scan_min = 0;
1602                         sc->sc_scan_max = 32;
1603                         break;
1604                 case AWI_REG_DOMAIN_JP:
1605                         sc->sc_scan_min = 6;
1606                         sc->sc_scan_max = 17;
1607                         break;
1608                 default:
1609                         return EINVAL;
1610                 }
1611                 sc->sc_scan_set = sc->sc_scan_cur % 3 + 1;
1612         } else {
1613                 switch (sc->sc_mib_phy.aCurrent_Reg_Domain) {
1614                 case AWI_REG_DOMAIN_US:
1615                 case AWI_REG_DOMAIN_CA:
1616                         sc->sc_scan_min = 1;
1617                         sc->sc_scan_max = 11;
1618                         sc->sc_scan_cur = 3;
1619                         break;
1620                 case AWI_REG_DOMAIN_EU:
1621                         sc->sc_scan_min = 1;
1622                         sc->sc_scan_max = 13;
1623                         sc->sc_scan_cur = 3;
1624                         break;
1625                 case AWI_REG_DOMAIN_ES:
1626                         sc->sc_scan_min = 10;
1627                         sc->sc_scan_max = 11;
1628                         sc->sc_scan_cur = 10;
1629                         break;
1630                 case AWI_REG_DOMAIN_FR:
1631                         sc->sc_scan_min = 10;
1632                         sc->sc_scan_max = 13;
1633                         sc->sc_scan_cur = 10;
1634                         break;
1635                 case AWI_REG_DOMAIN_JP:
1636                         sc->sc_scan_min = 14;
1637                         sc->sc_scan_max = 14;
1638                         sc->sc_scan_cur = 14;
1639                         break;
1640                 default:
1641                         return EINVAL;
1642                 }
1643         }
1644         sc->sc_ownch = sc->sc_scan_cur;
1645         return 0;
1646 }
1647
1648 static int
1649 awi_start_scan(sc)
1650         struct awi_softc *sc;
1651 {
1652         int error = 0;
1653         struct awi_bss *bp;
1654
1655         while ((bp = TAILQ_FIRST(&sc->sc_scan)) != NULL) {
1656                 TAILQ_REMOVE(&sc->sc_scan, bp, list);
1657                 free(bp, M_DEVBUF);
1658         }
1659         if (!sc->sc_mib_local.Network_Mode && sc->sc_no_bssid) {
1660                 memset(&sc->sc_bss, 0, sizeof(sc->sc_bss));
1661                 sc->sc_bss.essid[0] = IEEE80211_ELEMID_SSID;
1662                 if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH) {
1663                         sc->sc_bss.chanset = sc->sc_ownch % 3 + 1;
1664                         sc->sc_bss.pattern = sc->sc_ownch;
1665                         sc->sc_bss.index = 1;
1666                         sc->sc_bss.dwell_time = 200;    /*XXX*/
1667                 } else
1668                         sc->sc_bss.chanset = sc->sc_ownch;
1669                 sc->sc_status = AWI_ST_SETSS;
1670                 error = awi_set_ss(sc);
1671         } else {
1672                 if (sc->sc_mib_local.Network_Mode)
1673                         awi_drvstate(sc, AWI_DRV_INFSC);
1674                 else
1675                         awi_drvstate(sc, AWI_DRV_ADHSC);
1676                 sc->sc_start_bss = 0;
1677                 sc->sc_active_scan = 1;
1678                 sc->sc_mgt_timer = AWI_ASCAN_WAIT / 1000;
1679                 sc->sc_ifp->if_timer = 1;
1680                 sc->sc_status = AWI_ST_SCAN;
1681                 error = awi_cmd_scan(sc);
1682         }
1683         return error;
1684 }
1685
1686 static int
1687 awi_next_scan(sc)
1688         struct awi_softc *sc;
1689 {
1690         int error;
1691
1692         for (;;) {
1693                 /*
1694                  * The pattern parameter for FH phy should be incremented
1695                  * by 3.  But BayStack 650 Access Points apparently always
1696                  * assign hop pattern set parameter to 1 for any pattern.
1697                  * So we try all combinations of pattern/set parameters.
1698                  * Since this causes no error, it may be a bug of
1699                  * PCnetMobile firmware.
1700                  */
1701                 sc->sc_scan_cur++;
1702                 if (sc->sc_scan_cur > sc->sc_scan_max) {
1703                         sc->sc_scan_cur = sc->sc_scan_min;
1704                         if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH)
1705                                 sc->sc_scan_set = sc->sc_scan_set % 3 + 1;
1706                 }
1707                 error = awi_cmd_scan(sc);
1708                 if (error != EINVAL)
1709                         break;
1710         }
1711         return error;
1712 }
1713
1714 static void
1715 awi_stop_scan(sc)
1716         struct awi_softc *sc;
1717 {
1718         struct ifnet *ifp = sc->sc_ifp;
1719         struct awi_bss *bp, *sbp;
1720         int fail;
1721
1722         bp = TAILQ_FIRST(&sc->sc_scan);
1723         if (bp == NULL) {
1724   notfound:
1725                 if (sc->sc_active_scan) {
1726                         if (ifp->if_flags & IFF_DEBUG)
1727                                 if_printf(ifp, "entering passive scan mode\n");
1728                         sc->sc_active_scan = 0;
1729                 }
1730                 sc->sc_mgt_timer = AWI_PSCAN_WAIT / 1000;
1731                 ifp->if_timer = 1;
1732                 (void)awi_next_scan(sc);
1733                 return;
1734         }
1735         sbp = NULL;
1736         if (ifp->if_flags & IFF_DEBUG)
1737                 if_printf(ifp, "\tmacaddr     ch/pat   sig flag  wep  essid\n");
1738         for (; bp != NULL; bp = TAILQ_NEXT(bp, list)) {
1739                 if (bp->fails) {
1740                         /*
1741                          * The configuration of the access points may change
1742                          * during my scan.  So we retries to associate with
1743                          * it unless there are any suitable AP.
1744                          */
1745                         if (bp->fails++ < 3)
1746                                 continue;
1747                         bp->fails = 0;
1748                 }
1749                 fail = 0;
1750                 /*
1751                  * Since the firmware apparently scans not only the specified
1752                  * channel of SCAN command but all available channel within
1753                  * the region, we should filter out unnecessary responses here.
1754                  */
1755                 if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH) {
1756                         if (bp->pattern < sc->sc_scan_min ||
1757                             bp->pattern > sc->sc_scan_max)
1758                                 fail |= 0x01;
1759                 } else {
1760                         if (bp->chanset < sc->sc_scan_min ||
1761                             bp->chanset > sc->sc_scan_max)
1762                                 fail |= 0x01;
1763                 }
1764                 if (sc->sc_mib_local.Network_Mode) {
1765                         if (!(bp->capinfo & IEEE80211_CAPINFO_ESS) ||
1766                             (bp->capinfo & IEEE80211_CAPINFO_IBSS))
1767                                 fail |= 0x02;
1768                 } else {
1769                         if ((bp->capinfo & IEEE80211_CAPINFO_ESS) ||
1770                             !(bp->capinfo & IEEE80211_CAPINFO_IBSS))
1771                                 fail |= 0x02;
1772                 }
1773                 if (sc->sc_wep_algo == NULL) {
1774                         if (bp->capinfo & IEEE80211_CAPINFO_PRIVACY)
1775                                 fail |= 0x04;
1776                 } else {
1777                         if (!(bp->capinfo & IEEE80211_CAPINFO_PRIVACY))
1778                                 fail |= 0x04;
1779                 }
1780                 if (sc->sc_mib_mac.aDesired_ESS_ID[1] != 0 &&
1781                     memcmp(&sc->sc_mib_mac.aDesired_ESS_ID, bp->essid,
1782                     sizeof(bp->essid)) != 0)
1783                         fail |= 0x08;
1784                 if (ifp->if_flags & IFF_DEBUG) {
1785                         printf(" %c %6D", fail ? '-' : '+', bp->esrc, ":");
1786                         if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH)
1787                                 printf("  %2d/%d%c", bp->pattern, bp->chanset,
1788                                     fail & 0x01 ? '!' : ' ');
1789                         else
1790                                 printf("  %4d%c", bp->chanset,
1791                                     fail & 0x01 ? '!' : ' ');
1792                         printf(" %+4d", bp->rssi);
1793                         printf(" %4s%c",
1794                             (bp->capinfo & IEEE80211_CAPINFO_ESS) ? "ess" :
1795                             (bp->capinfo & IEEE80211_CAPINFO_IBSS) ? "ibss" :
1796                             "????",
1797                             fail & 0x02 ? '!' : ' ');
1798                         printf(" %3s%c ",
1799                             (bp->capinfo & IEEE80211_CAPINFO_PRIVACY) ? "wep" :
1800                             "no",
1801                             fail & 0x04 ? '!' : ' ');
1802                         awi_print_essid(bp->essid);
1803                         printf("%s\n", fail & 0x08 ? "!" : "");
1804                 }
1805                 if (!fail) {
1806                         if (sbp == NULL || bp->rssi > sbp->rssi)
1807                                 sbp = bp;
1808                 }
1809         }
1810         if (sbp == NULL)
1811                 goto notfound;
1812         sc->sc_bss = *sbp;
1813         (void)awi_set_ss(sc);
1814 }
1815
1816 static void
1817 awi_recv_beacon(sc, m0, rxts, rssi)
1818         struct awi_softc *sc;
1819         struct mbuf *m0;
1820         u_int32_t rxts;
1821         u_int8_t rssi;
1822 {
1823         struct ieee80211_frame *wh;
1824         struct awi_bss *bp;
1825         u_int8_t *frame, *eframe;
1826         u_int8_t *tstamp, *bintval, *capinfo, *ssid, *rates, *parms;
1827
1828         if (sc->sc_status != AWI_ST_SCAN)
1829                 return;
1830         wh = mtod(m0, struct ieee80211_frame *);
1831
1832         frame = (u_int8_t *)&wh[1];
1833         eframe = mtod(m0, u_int8_t *) + m0->m_len;
1834         /*
1835          * XXX:
1836          *      timestamp [8]
1837          *      beacon interval [2]
1838          *      capability information [2]
1839          *      ssid [tlv]
1840          *      supported rates [tlv]
1841          *      parameter set [tlv]
1842          *      ...
1843          */
1844         if (frame + 12 > eframe) {
1845 #ifdef AWI_DEBUG
1846                 if (awi_verbose)
1847                         printf("awi_recv_beacon: frame too short \n");
1848 #endif
1849                 return;
1850         }
1851         tstamp = frame;
1852         frame += 8;
1853         bintval = frame;
1854         frame += 2;
1855         capinfo = frame;
1856         frame += 2;
1857
1858         ssid = rates = parms = NULL;
1859         while (frame < eframe) {
1860                 switch (*frame) {
1861                 case IEEE80211_ELEMID_SSID:
1862                         ssid = frame;
1863                         break;
1864                 case IEEE80211_ELEMID_RATES:
1865                         rates = frame;
1866                         break;
1867                 case IEEE80211_ELEMID_FHPARMS:
1868                 case IEEE80211_ELEMID_DSPARMS:
1869                         parms = frame;
1870                         break;
1871                 }
1872                 frame += frame[1] + 2;
1873         }
1874         if (ssid == NULL || rates == NULL || parms == NULL) {
1875 #ifdef AWI_DEBUG
1876                 if (awi_verbose)
1877                         printf("awi_recv_beacon: ssid=%p, rates=%p, parms=%p\n",
1878                             ssid, rates, parms);
1879 #endif
1880                 return;
1881         }
1882         if (ssid[1] > IEEE80211_NWID_LEN) {
1883 #ifdef AWI_DEBUG
1884                 if (awi_verbose)
1885                         printf("awi_recv_beacon: bad ssid len: %d from %6D\n",
1886                             ssid[1], wh->i_addr2, ":");
1887 #endif
1888                 return;
1889         }
1890
1891         for (bp = TAILQ_FIRST(&sc->sc_scan); bp != NULL;
1892             bp = TAILQ_NEXT(bp, list)) {
1893                 if (memcmp(bp->esrc, wh->i_addr2, ETHER_ADDR_LEN) == 0 &&
1894                     memcmp(bp->bssid, wh->i_addr3, ETHER_ADDR_LEN) == 0)
1895                         break;
1896         }
1897         if (bp == NULL) {
1898                 bp = malloc(sizeof(struct awi_bss), M_DEVBUF, M_INTWAIT);
1899                 if (bp == NULL)
1900                         return;
1901                 TAILQ_INSERT_TAIL(&sc->sc_scan, bp, list);
1902                 memcpy(bp->esrc, wh->i_addr2, ETHER_ADDR_LEN);
1903                 memcpy(bp->bssid, wh->i_addr3, ETHER_ADDR_LEN);
1904                 memset(bp->essid, 0, sizeof(bp->essid));
1905                 memcpy(bp->essid, ssid, 2 + ssid[1]);
1906         }
1907         bp->rssi = rssi;
1908         bp->rxtime = rxts;
1909         memcpy(bp->timestamp, tstamp, sizeof(bp->timestamp));
1910         bp->interval = LE_READ_2(bintval);
1911         bp->capinfo = LE_READ_2(capinfo);
1912         if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH) {
1913                 bp->chanset = parms[4];
1914                 bp->pattern = parms[5];
1915                 bp->index = parms[6];
1916                 bp->dwell_time = LE_READ_2(parms + 2);
1917         } else {
1918                 bp->chanset = parms[2];
1919                 bp->pattern = 0;
1920                 bp->index = 0;
1921                 bp->dwell_time = 0;
1922         }
1923         if (sc->sc_mgt_timer == 0)
1924                 awi_stop_scan(sc);
1925 }
1926
1927 static int
1928 awi_set_ss(sc)
1929         struct awi_softc *sc;
1930 {
1931         struct ifnet *ifp = sc->sc_ifp;
1932         struct awi_bss *bp;
1933         int error;
1934
1935         sc->sc_status = AWI_ST_SETSS;
1936         bp = &sc->sc_bss;
1937         if (ifp->if_flags & IFF_DEBUG) {
1938                 if_printf(ifp, "ch %d pat %d id %d dw %d iv %d bss %6D ssid ",
1939                           bp->chanset, bp->pattern, bp->index, bp->dwell_time,
1940                           bp->interval, bp->bssid, ":");
1941                 awi_print_essid(bp->essid);
1942                 printf("\n");
1943         }
1944         memcpy(&sc->sc_mib_mgt.aCurrent_BSS_ID, bp->bssid, ETHER_ADDR_LEN);
1945         memcpy(&sc->sc_mib_mgt.aCurrent_ESS_ID, bp->essid,
1946             AWI_ESS_ID_SIZE);
1947         LE_WRITE_2(&sc->sc_mib_mgt.aBeacon_Period, bp->interval);
1948         error = awi_mib(sc, AWI_CMD_SET_MIB, AWI_MIB_MGT);
1949         return error;
1950 }
1951
1952 static void
1953 awi_try_sync(sc)
1954         struct awi_softc *sc;
1955 {
1956         struct awi_bss *bp;
1957
1958         sc->sc_status = AWI_ST_SYNC;
1959         bp = &sc->sc_bss;
1960
1961         if (sc->sc_cmd_inprog) {
1962                 if (awi_cmd_wait(sc))
1963                         return;
1964         }
1965         sc->sc_cmd_inprog = AWI_CMD_SYNC;
1966         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SYNC_SET, bp->chanset);
1967         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SYNC_PATTERN, bp->pattern);
1968         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SYNC_IDX, bp->index);
1969         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SYNC_STARTBSS,
1970             sc->sc_start_bss ? 1 : 0);
1971         awi_write_2(sc, AWI_CMD_PARAMS+AWI_CA_SYNC_DWELL, bp->dwell_time);
1972         awi_write_2(sc, AWI_CMD_PARAMS+AWI_CA_SYNC_MBZ, 0);
1973         awi_write_bytes(sc, AWI_CMD_PARAMS+AWI_CA_SYNC_TIMESTAMP,
1974             bp->timestamp, 8);
1975         awi_write_4(sc, AWI_CMD_PARAMS+AWI_CA_SYNC_REFTIME, bp->rxtime);
1976         (void)awi_cmd(sc, AWI_CMD_SYNC);
1977 }
1978
1979 static void
1980 awi_sync_done(sc)
1981         struct awi_softc *sc;
1982 {
1983         struct ifnet *ifp = sc->sc_ifp;
1984
1985         if (sc->sc_mib_local.Network_Mode) {
1986                 awi_drvstate(sc, AWI_DRV_INFSY);
1987                 awi_send_auth(sc, 1);
1988         } else {
1989                 if (ifp->if_flags & IFF_DEBUG) {
1990                         if_printf(ifp, "synced with");
1991                         if (sc->sc_no_bssid)
1992                                 printf(" no-bssid");
1993                         else {
1994                                 printf(" %6D ssid ", sc->sc_bss.bssid, ":");
1995                                 awi_print_essid(sc->sc_bss.essid);
1996                         }
1997                         if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH)
1998                                 printf(" at chanset %d pattern %d\n",
1999                                     sc->sc_bss.chanset, sc->sc_bss.pattern);
2000                         else
2001                                 printf(" at channel %d\n", sc->sc_bss.chanset);
2002                 }
2003                 awi_drvstate(sc, AWI_DRV_ADHSY);
2004                 sc->sc_status = AWI_ST_RUNNING;
2005                 ifp->if_flags |= IFF_RUNNING;
2006                 awi_start(ifp);
2007         }
2008 }
2009
2010 static void
2011 awi_send_deauth(sc)
2012         struct awi_softc *sc;
2013 {
2014         struct ifnet *ifp = sc->sc_ifp;
2015         struct mbuf *m;
2016         struct ieee80211_frame *wh;
2017         u_int8_t *deauth;
2018
2019         MGETHDR(m, MB_DONTWAIT, MT_DATA);
2020         if (m == NULL)
2021                 return;
2022         if (ifp->if_flags & IFF_DEBUG)
2023                 if_printf(ifp, "sending deauth to %6D\n",
2024                           sc->sc_bss.bssid, ":");
2025
2026         wh = mtod(m, struct ieee80211_frame *);
2027         wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
2028             IEEE80211_FC0_SUBTYPE_AUTH;
2029         wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
2030         LE_WRITE_2(wh->i_dur, 0);
2031         LE_WRITE_2(wh->i_seq, 0);
2032         memcpy(wh->i_addr1, sc->sc_bss.bssid, ETHER_ADDR_LEN);
2033         memcpy(wh->i_addr2, sc->sc_mib_addr.aMAC_Address, ETHER_ADDR_LEN);
2034         memcpy(wh->i_addr3, sc->sc_bss.bssid, ETHER_ADDR_LEN);
2035
2036         deauth = (u_int8_t *)&wh[1];
2037         LE_WRITE_2(deauth, IEEE80211_REASON_AUTH_LEAVE);
2038         deauth += 2;
2039
2040         m->m_pkthdr.len = m->m_len = deauth - mtod(m, u_int8_t *);
2041         IF_ENQUEUE(&sc->sc_mgtq, m);
2042         awi_start(ifp);
2043         awi_drvstate(sc, AWI_DRV_INFTOSS);
2044 }
2045
2046 static void
2047 awi_send_auth(sc, seq)
2048         struct awi_softc *sc;
2049         int seq;
2050 {
2051         struct ifnet *ifp = sc->sc_ifp;
2052         struct mbuf *m;
2053         struct ieee80211_frame *wh;
2054         u_int8_t *auth;
2055
2056         MGETHDR(m, MB_DONTWAIT, MT_DATA);
2057         if (m == NULL)
2058                 return;
2059         sc->sc_status = AWI_ST_AUTH;
2060         if (ifp->if_flags & IFF_DEBUG)
2061                 if_printf(ifp, "sending auth to %6D\n",
2062                           sc->sc_bss.bssid, ":");
2063
2064         wh = mtod(m, struct ieee80211_frame *);
2065         wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
2066             IEEE80211_FC0_SUBTYPE_AUTH;
2067         wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
2068         LE_WRITE_2(wh->i_dur, 0);
2069         LE_WRITE_2(wh->i_seq, 0);
2070         memcpy(wh->i_addr1, sc->sc_bss.esrc, ETHER_ADDR_LEN);
2071         memcpy(wh->i_addr2, sc->sc_mib_addr.aMAC_Address, ETHER_ADDR_LEN);
2072         memcpy(wh->i_addr3, sc->sc_bss.bssid, ETHER_ADDR_LEN);
2073
2074         auth = (u_int8_t *)&wh[1];
2075         /* algorithm number */
2076         LE_WRITE_2(auth, IEEE80211_AUTH_ALG_OPEN);
2077         auth += 2;
2078         /* sequence number */
2079         LE_WRITE_2(auth, seq);
2080         auth += 2;
2081         /* status */
2082         LE_WRITE_2(auth, 0);
2083         auth += 2;
2084
2085         m->m_pkthdr.len = m->m_len = auth - mtod(m, u_int8_t *);
2086         IF_ENQUEUE(&sc->sc_mgtq, m);
2087         awi_start(ifp);
2088
2089         sc->sc_mgt_timer = AWI_TRANS_TIMEOUT / 1000;
2090         ifp->if_timer = 1;
2091 }
2092
2093 static void
2094 awi_recv_auth(sc, m0)
2095         struct awi_softc *sc;
2096         struct mbuf *m0;
2097 {
2098         struct ifnet *ifp = sc->sc_ifp;
2099         struct ieee80211_frame *wh;
2100         u_int8_t *auth, *eframe;
2101         struct awi_bss *bp;
2102         u_int16_t status;
2103
2104         wh = mtod(m0, struct ieee80211_frame *);
2105         auth = (u_int8_t *)&wh[1];
2106         eframe = mtod(m0, u_int8_t *) + m0->m_len;
2107         if (ifp->if_flags & IFF_DEBUG)
2108                 if_printf(ifp, "receive auth from %6D\n", wh->i_addr2, ":");
2109
2110         /* algorithm number */
2111         if (LE_READ_2(auth) != IEEE80211_AUTH_ALG_OPEN)
2112                 return;
2113         auth += 2;
2114         if (!sc->sc_mib_local.Network_Mode) {
2115                 if (sc->sc_status != AWI_ST_RUNNING)
2116                         return;
2117                 if (LE_READ_2(auth) == 1)
2118                         awi_send_auth(sc, 2);
2119                 return;
2120         }
2121         if (sc->sc_status != AWI_ST_AUTH)
2122                 return;
2123         /* sequence number */
2124         if (LE_READ_2(auth) != 2)
2125                 return;
2126         auth += 2;
2127         /* status */
2128         status = LE_READ_2(auth);
2129         if (status != 0) {
2130                 if_printf(ifp, "authentication failed (reason %d)\n", status);
2131                 for (bp = TAILQ_FIRST(&sc->sc_scan); bp != NULL;
2132                     bp = TAILQ_NEXT(bp, list)) {
2133                         if (memcmp(bp->esrc, sc->sc_bss.esrc, ETHER_ADDR_LEN)
2134                             == 0) {
2135                                 bp->fails++;
2136                                 break;
2137                         }
2138                 }
2139                 return;
2140         }
2141         sc->sc_mgt_timer = 0;
2142         awi_drvstate(sc, AWI_DRV_INFAUTH);
2143         awi_send_asreq(sc, 0);
2144 }
2145
2146 static void
2147 awi_send_asreq(sc, reassoc)
2148         struct awi_softc *sc;
2149         int reassoc;
2150 {
2151         struct ifnet *ifp = sc->sc_ifp;
2152         struct mbuf *m;
2153         struct ieee80211_frame *wh;
2154         u_int16_t lintval;
2155         u_int8_t *asreq;
2156
2157         MGETHDR(m, MB_DONTWAIT, MT_DATA);
2158         if (m == NULL)
2159                 return;
2160         sc->sc_status = AWI_ST_ASSOC;
2161         if (ifp->if_flags & IFF_DEBUG)
2162                 if_printf(ifp, "sending %sassoc req to %6D\n",
2163                     reassoc ? "re" : "", sc->sc_bss.bssid, ":");
2164
2165         wh = mtod(m, struct ieee80211_frame *);
2166         wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT;
2167         if (reassoc)
2168                 wh->i_fc[0] |= IEEE80211_FC0_SUBTYPE_REASSOC_REQ;
2169         else
2170                 wh->i_fc[0] |= IEEE80211_FC0_SUBTYPE_ASSOC_REQ;
2171         wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
2172         LE_WRITE_2(wh->i_dur, 0);
2173         LE_WRITE_2(wh->i_seq, 0);
2174         memcpy(wh->i_addr1, sc->sc_bss.esrc, ETHER_ADDR_LEN);
2175         memcpy(wh->i_addr2, sc->sc_mib_addr.aMAC_Address, ETHER_ADDR_LEN);
2176         memcpy(wh->i_addr3, sc->sc_bss.bssid, ETHER_ADDR_LEN);
2177
2178         asreq = (u_int8_t *)&wh[1];
2179
2180         /* capability info */
2181         if (sc->sc_wep_algo == NULL)
2182                 LE_WRITE_2(asreq, IEEE80211_CAPINFO_CF_POLLABLE);
2183         else
2184                 LE_WRITE_2(asreq,
2185                     IEEE80211_CAPINFO_CF_POLLABLE | IEEE80211_CAPINFO_PRIVACY);
2186         asreq += 2;
2187         /* listen interval */
2188         lintval = LE_READ_2(&sc->sc_mib_mgt.aListen_Interval);
2189         LE_WRITE_2(asreq, lintval);
2190         asreq += 2;
2191         if (reassoc) {
2192                 /* current AP address */
2193                 memcpy(asreq, sc->sc_bss.bssid, ETHER_ADDR_LEN);
2194                 asreq += ETHER_ADDR_LEN;
2195         }
2196         /* ssid */
2197         memcpy(asreq, sc->sc_bss.essid, 2 + sc->sc_bss.essid[1]);
2198         asreq += 2 + asreq[1];
2199         /* supported rates */
2200         memcpy(asreq, &sc->sc_mib_phy.aSuprt_Data_Rates, 4);
2201         asreq += 2 + asreq[1];
2202
2203         m->m_pkthdr.len = m->m_len = asreq - mtod(m, u_int8_t *);
2204         IF_ENQUEUE(&sc->sc_mgtq, m);
2205         awi_start(ifp);
2206
2207         sc->sc_mgt_timer = AWI_TRANS_TIMEOUT / 1000;
2208         ifp->if_timer = 1;
2209 }
2210
2211 static void
2212 awi_recv_asresp(sc, m0)
2213         struct awi_softc *sc;
2214         struct mbuf *m0;
2215 {
2216         struct ifnet *ifp = sc->sc_ifp;
2217         struct ieee80211_frame *wh;
2218         u_int8_t *asresp, *eframe;
2219         u_int16_t status;
2220         u_int8_t rate, *phy_rates;
2221         struct awi_bss *bp;
2222         int i, j;
2223
2224         wh = mtod(m0, struct ieee80211_frame *);
2225         asresp = (u_int8_t *)&wh[1];
2226         eframe = mtod(m0, u_int8_t *) + m0->m_len;
2227         if (ifp->if_flags & IFF_DEBUG)
2228                 if_printf(ifp, "receive assoc resp from %6D\n",
2229                           wh->i_addr2, ":");
2230
2231         if (!sc->sc_mib_local.Network_Mode)
2232                 return;
2233
2234         if (sc->sc_status != AWI_ST_ASSOC)
2235                 return;
2236         /* capability info */
2237         asresp += 2;
2238         /* status */
2239         status = LE_READ_2(asresp);
2240         if (status != 0) {
2241                 if_printf(ifp, "association failed (reason %d)\n", status);
2242                 for (bp = TAILQ_FIRST(&sc->sc_scan); bp != NULL;
2243                     bp = TAILQ_NEXT(bp, list)) {
2244                         if (memcmp(bp->esrc, sc->sc_bss.esrc, ETHER_ADDR_LEN)
2245                             == 0) {
2246                                 bp->fails++;
2247                                 break;
2248                         }
2249                 }
2250                 return;
2251         }
2252         asresp += 2;
2253         /* association id */
2254         asresp += 2;
2255         /* supported rates */
2256         rate = AWI_RATE_1MBIT;
2257         for (i = 0; i < asresp[1]; i++) {
2258                 if (AWI_80211_RATE(asresp[2 + i]) <= rate)
2259                         continue;
2260                 phy_rates = sc->sc_mib_phy.aSuprt_Data_Rates;
2261                 for (j = 0; j < phy_rates[1]; j++) {
2262                         if (AWI_80211_RATE(asresp[2 + i]) ==
2263                             AWI_80211_RATE(phy_rates[2 + j]))
2264                                 rate = AWI_80211_RATE(asresp[2 + i]);
2265                 }
2266         }
2267         if (ifp->if_flags & IFF_DEBUG) {
2268                 if_printf(ifp, "associated with %6D ssid ",
2269                           sc->sc_bss.bssid, ":");
2270                 awi_print_essid(sc->sc_bss.essid);
2271                 if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH)
2272                         printf(" chanset %d pattern %d\n",
2273                             sc->sc_bss.chanset, sc->sc_bss.pattern);
2274                 else
2275                         printf(" channel %d\n", sc->sc_bss.chanset);
2276         }
2277         sc->sc_tx_rate = rate;
2278         sc->sc_mgt_timer = 0;
2279         sc->sc_rx_timer = 10;
2280         ifp->if_timer = 1;
2281         sc->sc_status = AWI_ST_RUNNING;
2282         ifp->if_flags |= IFF_RUNNING;
2283         awi_drvstate(sc, AWI_DRV_INFASSOC);
2284         awi_start(ifp);
2285 }
2286
2287 static int
2288 awi_mib(sc, cmd, mib)
2289         struct awi_softc *sc;
2290         u_int8_t cmd;
2291         u_int8_t mib;
2292 {
2293         int error;
2294         u_int8_t size, *ptr;
2295
2296         switch (mib) {
2297         case AWI_MIB_LOCAL:
2298                 ptr = (u_int8_t *)&sc->sc_mib_local;
2299                 size = sizeof(sc->sc_mib_local);
2300                 break;
2301         case AWI_MIB_ADDR:
2302                 ptr = (u_int8_t *)&sc->sc_mib_addr;
2303                 size = sizeof(sc->sc_mib_addr);
2304                 break;
2305         case AWI_MIB_MAC:
2306                 ptr = (u_int8_t *)&sc->sc_mib_mac;
2307                 size = sizeof(sc->sc_mib_mac);
2308                 break;
2309         case AWI_MIB_STAT:
2310                 ptr = (u_int8_t *)&sc->sc_mib_stat;
2311                 size = sizeof(sc->sc_mib_stat);
2312                 break;
2313         case AWI_MIB_MGT:
2314                 ptr = (u_int8_t *)&sc->sc_mib_mgt;
2315                 size = sizeof(sc->sc_mib_mgt);
2316                 break;
2317         case AWI_MIB_PHY:
2318                 ptr = (u_int8_t *)&sc->sc_mib_phy;
2319                 size = sizeof(sc->sc_mib_phy);
2320                 break;
2321         default:
2322                 return EINVAL;
2323         }
2324         if (sc->sc_cmd_inprog) {
2325                 error = awi_cmd_wait(sc);
2326                 if (error) {
2327                         if (error == EWOULDBLOCK)
2328                                 printf("awi_mib: cmd %d inprog",
2329                                     sc->sc_cmd_inprog);
2330                         return error;
2331                 }
2332         }
2333         sc->sc_cmd_inprog = cmd;
2334         if (cmd == AWI_CMD_SET_MIB)
2335                 awi_write_bytes(sc, AWI_CMD_PARAMS+AWI_CA_MIB_DATA, ptr, size);
2336         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_MIB_TYPE, mib);
2337         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_MIB_SIZE, size);
2338         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_MIB_INDEX, 0);
2339         error = awi_cmd(sc, cmd);
2340         if (error)
2341                 return error;
2342         if (cmd == AWI_CMD_GET_MIB) {
2343                 awi_read_bytes(sc, AWI_CMD_PARAMS+AWI_CA_MIB_DATA, ptr, size);
2344 #ifdef AWI_DEBUG
2345                 if (awi_verbose) {
2346                         int i;
2347
2348                         printf("awi_mib: #%d:", mib);
2349                         for (i = 0; i < size; i++)
2350                                 printf(" %02x", ptr[i]);
2351                         printf("\n");
2352                 }
2353 #endif
2354         }
2355         return 0;
2356 }
2357
2358 static int
2359 awi_cmd_scan(sc)
2360         struct awi_softc *sc;
2361 {
2362         int error;
2363         u_int8_t scan_mode;
2364
2365         if (sc->sc_active_scan)
2366                 scan_mode = AWI_SCAN_ACTIVE;
2367         else
2368                 scan_mode = AWI_SCAN_PASSIVE;
2369         if (sc->sc_mib_mgt.aScan_Mode != scan_mode) {
2370                 sc->sc_mib_mgt.aScan_Mode = scan_mode;
2371                 error = awi_mib(sc, AWI_CMD_SET_MIB, AWI_MIB_MGT);
2372                 return error;
2373         }
2374
2375         if (sc->sc_cmd_inprog) {
2376                 error = awi_cmd_wait(sc);
2377                 if (error)
2378                         return error;
2379         }
2380         sc->sc_cmd_inprog = AWI_CMD_SCAN;
2381         awi_write_2(sc, AWI_CMD_PARAMS+AWI_CA_SCAN_DURATION,
2382             sc->sc_active_scan ? AWI_ASCAN_DURATION : AWI_PSCAN_DURATION);
2383         if (sc->sc_mib_phy.IEEE_PHY_Type == AWI_PHY_TYPE_FH) {
2384                 awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SCAN_SET,
2385                     sc->sc_scan_set);
2386                 awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SCAN_PATTERN,
2387                     sc->sc_scan_cur);
2388                 awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SCAN_IDX, 1);
2389         } else {
2390                 awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SCAN_SET,
2391                     sc->sc_scan_cur);
2392                 awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SCAN_PATTERN, 0);
2393                 awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SCAN_IDX, 0);
2394         }
2395         awi_write_1(sc, AWI_CMD_PARAMS+AWI_CA_SCAN_SUSP, 0);
2396         return awi_cmd(sc, AWI_CMD_SCAN);
2397 }
2398
2399 static int
2400 awi_cmd(sc, cmd)
2401         struct awi_softc *sc;
2402         u_int8_t cmd;
2403 {
2404         u_int8_t status;
2405         int error = 0;
2406
2407         sc->sc_cmd_inprog = cmd;
2408         awi_write_1(sc, AWI_CMD_STATUS, AWI_STAT_IDLE);
2409         awi_write_1(sc, AWI_CMD, cmd);
2410         if (sc->sc_status != AWI_ST_INIT)
2411                 return 0;
2412         error = awi_cmd_wait(sc);
2413         if (error)
2414                 return error;
2415         status = awi_read_1(sc, AWI_CMD_STATUS);
2416         awi_write_1(sc, AWI_CMD, 0);
2417         switch (status) {
2418         case AWI_STAT_OK:
2419                 break;
2420         case AWI_STAT_BADPARM:
2421                 return EINVAL;
2422         default:
2423                 if_printf(sc->sc_ifp, "command %d failed %x\n", cmd, status);
2424                 return ENXIO;
2425         }
2426         return 0;
2427 }
2428
2429 static void
2430 awi_cmd_done(sc)
2431         struct awi_softc *sc;
2432 {
2433         u_int8_t cmd, status;
2434
2435         status = awi_read_1(sc, AWI_CMD_STATUS);
2436         if (status == AWI_STAT_IDLE)
2437                 return;         /* stray interrupt */
2438
2439         cmd = sc->sc_cmd_inprog;
2440         sc->sc_cmd_inprog = 0;
2441         if (sc->sc_status == AWI_ST_INIT) {
2442                 wakeup(sc);
2443                 return;
2444         }
2445         awi_write_1(sc, AWI_CMD, 0);
2446
2447         if (status != AWI_STAT_OK) {
2448                 if_printf(sc->sc_ifp, "command %d failed %x\n", cmd, status);
2449                 return;
2450         }
2451         switch (sc->sc_status) {
2452         case AWI_ST_SCAN:
2453                 if (cmd == AWI_CMD_SET_MIB)
2454                         awi_cmd_scan(sc);       /* retry */
2455                 break;
2456         case AWI_ST_SETSS:
2457                 awi_try_sync(sc);
2458                 break;
2459         case AWI_ST_SYNC:
2460                 awi_sync_done(sc);
2461                 break;
2462         default:
2463                 break;
2464         }
2465 }
2466
2467 static int
2468 awi_next_txd(sc, len, framep, ntxdp)
2469         struct awi_softc *sc;
2470         int len;
2471         u_int32_t *framep, *ntxdp;
2472 {
2473         u_int32_t txd, ntxd, frame;
2474
2475         txd = sc->sc_txnext;
2476         frame = txd + AWI_TXD_SIZE;
2477         if (frame + len > sc->sc_txend)
2478                 frame = sc->sc_txbase;
2479         ntxd = frame + len;
2480         if (ntxd + AWI_TXD_SIZE > sc->sc_txend)
2481                 ntxd = sc->sc_txbase;
2482         *framep = frame;
2483         *ntxdp = ntxd;
2484         /*
2485          * Determine if there are any room in ring buffer.
2486          *              --- send wait,  === new data,  +++ conflict (ENOBUFS)
2487          *   base........................end
2488          *         done----txd=====ntxd         OK
2489          *       --txd=====done++++ntxd--       full
2490          *       --txd=====ntxd    done--       OK
2491          *       ==ntxd    done----txd===       OK
2492          *       ==done++++ntxd----txd===       full
2493          *       ++ntxd    txd=====done++       full
2494          */
2495         if (txd < ntxd) {
2496                 if (txd < sc->sc_txdone && ntxd + AWI_TXD_SIZE > sc->sc_txdone)
2497                         return ENOBUFS;
2498         } else {
2499                 if (txd < sc->sc_txdone || ntxd + AWI_TXD_SIZE > sc->sc_txdone)
2500                         return ENOBUFS;
2501         }
2502         return 0;
2503 }
2504
2505 static int
2506 awi_lock(sc)
2507         struct awi_softc *sc;
2508 {
2509         int error = 0;
2510
2511         if (curproc == NULL) {
2512                 /*
2513                  * XXX
2514                  * Though driver ioctl should be called with context,
2515                  * KAME ipv6 stack calls ioctl in interrupt for now.
2516                  * We simply abort the request if there are other
2517                  * ioctl requests in progress.
2518                  */
2519                 if (sc->sc_busy) {
2520                         return EWOULDBLOCK;
2521                         if (sc->sc_invalid)
2522                                 return ENXIO;
2523                 }
2524                 sc->sc_busy = 1;
2525                 sc->sc_cansleep = 0;
2526                 return 0;
2527         }
2528         while (sc->sc_busy) {
2529                 if (sc->sc_invalid)
2530                         return ENXIO;
2531                 sc->sc_sleep_cnt++;
2532                 error = tsleep(sc, PCATCH, "awilck", 0);
2533                 sc->sc_sleep_cnt--;
2534                 if (error)
2535                         return error;
2536         }
2537         sc->sc_busy = 1;
2538         sc->sc_cansleep = 1;
2539         return 0;
2540 }
2541
2542 static void
2543 awi_unlock(sc)
2544         struct awi_softc *sc;
2545 {
2546         sc->sc_busy = 0;
2547         sc->sc_cansleep = 0;
2548         if (sc->sc_sleep_cnt)
2549                 wakeup(sc);
2550 }
2551
2552 static int
2553 awi_intr_lock(sc)
2554         struct awi_softc *sc;
2555 {
2556         u_int8_t status;
2557         int i, retry;
2558
2559         status = 1;
2560         for (retry = 0; retry < 10; retry++) {
2561                 for (i = 0; i < AWI_LOCKOUT_TIMEOUT*1000/5; i++) {
2562                         status = awi_read_1(sc, AWI_LOCKOUT_HOST);
2563                         if (status == 0)
2564                                 break;
2565                         DELAY(5);
2566                 }
2567                 if (status != 0)
2568                         break;
2569                 awi_write_1(sc, AWI_LOCKOUT_MAC, 1);
2570                 status = awi_read_1(sc, AWI_LOCKOUT_HOST);
2571                 if (status == 0)
2572                         break;
2573                 awi_write_1(sc, AWI_LOCKOUT_MAC, 0);
2574         }
2575         if (status != 0) {
2576                 if_printf(sc->sc_ifp, "failed to lock interrupt\n");
2577                 return ENXIO;
2578         }
2579         return 0;
2580 }
2581
2582 static void
2583 awi_intr_unlock(sc)
2584         struct awi_softc *sc;
2585 {
2586
2587         awi_write_1(sc, AWI_LOCKOUT_MAC, 0);
2588 }
2589
2590 static int
2591 awi_cmd_wait(sc)
2592         struct awi_softc *sc;
2593 {
2594         int i, error = 0;
2595
2596         i = 0;
2597         while (sc->sc_cmd_inprog) {
2598                 if (sc->sc_invalid)
2599                         return ENXIO;
2600                 if (awi_read_1(sc, AWI_CMD) != sc->sc_cmd_inprog) {
2601                         if_printf(sc->sc_ifp, "failed to access hardware\n");
2602                         sc->sc_invalid = 1;
2603                         return ENXIO;
2604                 }
2605                 if (sc->sc_cansleep) {
2606                         sc->sc_sleep_cnt++;
2607                         error = tsleep(sc, 0, "awicmd",
2608                             AWI_CMD_TIMEOUT*hz/1000);
2609                         sc->sc_sleep_cnt--;
2610                 } else {
2611                         if (awi_read_1(sc, AWI_CMD_STATUS) != AWI_STAT_IDLE) {
2612                                 awi_cmd_done(sc);
2613                                 break;
2614                         }
2615                         if (i++ >= AWI_CMD_TIMEOUT*1000/10)
2616                                 error = EWOULDBLOCK;
2617                         else
2618                                 DELAY(10);
2619                 }
2620                 if (error)
2621                         break;
2622         }
2623         return error;
2624 }
2625
2626 static void
2627 awi_print_essid(essid)
2628         u_int8_t *essid;
2629 {
2630         int i, len;
2631         u_int8_t *p;
2632
2633         len = essid[1];
2634         if (len > IEEE80211_NWID_LEN)
2635                 len = IEEE80211_NWID_LEN;       /*XXX*/
2636         /* determine printable or not */
2637         for (i = 0, p = essid + 2; i < len; i++, p++) {
2638                 if (*p < ' ' || *p > 0x7e)
2639                         break;
2640         }
2641         if (i == len) {
2642                 printf("\"");
2643                 for (i = 0, p = essid + 2; i < len; i++, p++)
2644                         printf("%c", *p);
2645                 printf("\"");
2646         } else {
2647                 printf("0x");
2648                 for (i = 0, p = essid + 2; i < len; i++, p++)
2649                         printf("%02x", *p);
2650         }
2651 }
2652
2653 #ifdef AWI_DEBUG
2654 static void
2655 awi_dump_pkt(sc, m, rssi)
2656         struct awi_softc *sc;
2657         struct mbuf *m;
2658         int rssi;
2659 {
2660         struct ieee80211_frame *wh;
2661         int i, l;
2662
2663         wh = mtod(m, struct ieee80211_frame *);
2664
2665         if (awi_dump_mask != 0 &&
2666             ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK)==IEEE80211_FC1_DIR_NODS) &&
2667             ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK)==IEEE80211_FC0_TYPE_MGT)) {
2668                 if ((AWI_DUMP_MASK(wh->i_fc[0]) & awi_dump_mask) != 0)
2669                         return;
2670         }
2671         if (awi_dump_mask < 0 &&
2672             (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK)==IEEE80211_FC0_TYPE_DATA)
2673                 return;
2674
2675         if (rssi < 0)
2676                 printf("tx: ");
2677         else
2678                 printf("rx: ");
2679         switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) {
2680         case IEEE80211_FC1_DIR_NODS:
2681                 printf("NODS %6D->%6D(%6D)", wh->i_addr2, ":",
2682                        wh->i_addr1, ":", wh->i_addr3, ":");
2683                 break;
2684         case IEEE80211_FC1_DIR_TODS:
2685                 printf("TODS %6D->%6D(%6D)", wh->i_addr2, ":",
2686                        wh->i_addr3, ":", wh->i_addr1, ":");
2687                 break;
2688         case IEEE80211_FC1_DIR_FROMDS:
2689                 printf("FRDS %6D->%6D(%6D)", wh->i_addr3, ":",
2690                        wh->i_addr1, ":", wh->i_addr2, ":");
2691                 break;
2692         case IEEE80211_FC1_DIR_DSTODS:
2693                 printf("DSDS %6D->%6D(%6D->%6D)", (u_int8_t *)&wh[1], ":",
2694                        wh->i_addr3, ":", wh->i_addr2, ":", wh->i_addr1, ":");
2695                 break;
2696         }
2697         switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
2698         case IEEE80211_FC0_TYPE_DATA:
2699                 printf(" data");
2700                 break;
2701         case IEEE80211_FC0_TYPE_MGT:
2702                 switch (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) {
2703                 case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
2704                         printf(" probe_req");
2705                         break;
2706                 case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
2707                         printf(" probe_resp");
2708                         break;
2709                 case IEEE80211_FC0_SUBTYPE_BEACON:
2710                         printf(" beacon");
2711                         break;
2712                 case IEEE80211_FC0_SUBTYPE_AUTH:
2713                         printf(" auth");
2714                         break;
2715                 case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
2716                         printf(" assoc_req");
2717                         break;
2718                 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
2719                         printf(" assoc_resp");
2720                         break;
2721                 case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
2722                         printf(" reassoc_req");
2723                         break;
2724                 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
2725                         printf(" reassoc_resp");
2726                         break;
2727                 case IEEE80211_FC0_SUBTYPE_DEAUTH:
2728                         printf(" deauth");
2729                         break;
2730                 case IEEE80211_FC0_SUBTYPE_DISASSOC:
2731                         printf(" disassoc");
2732                         break;
2733                 default:
2734                         printf(" mgt#%d",
2735                             wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
2736                         break;
2737                 }
2738                 break;
2739         default:
2740                 printf(" type#%d",
2741                     wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK);
2742                 break;
2743         }
2744         if (wh->i_fc[1] & IEEE80211_FC1_WEP)
2745                 printf(" WEP");
2746         if (rssi >= 0)
2747                 printf(" +%d", rssi);
2748         printf("\n");
2749         if (awi_dump_len > 0) {
2750                 l = m->m_len;
2751                 if (l > awi_dump_len + sizeof(*wh))
2752                         l = awi_dump_len + sizeof(*wh);
2753                 i = sizeof(*wh);
2754                 if (awi_dump_hdr)
2755                         i = 0;
2756                 for (; i < l; i++) {
2757                         if ((i & 1) == 0)
2758                                 printf(" ");
2759                         printf("%02x", mtod(m, u_int8_t *)[i]);
2760                 }
2761                 printf("\n");
2762         }
2763 }
2764 #endif