xref: /netbsd-src/sys/dev/ic/an.c (revision cac8e449158efc7261bebc8657cbb0125a2cfdde)
1 /*	$NetBSD: an.c,v 1.52 2008/07/03 18:10:07 drochner Exp $	*/
2 /*
3  * Copyright (c) 1997, 1998, 1999
4  *	Bill Paul <wpaul@ctr.columbia.edu>.  All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  * 3. All advertising materials mentioning features or use of this software
15  *    must display the following acknowledgement:
16  *	This product includes software developed by Bill Paul.
17  * 4. Neither the name of the author nor the names of any co-contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
25  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
26  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
27  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
28  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
29  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
30  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
31  * THE POSSIBILITY OF SUCH DAMAGE.
32  *
33  * $FreeBSD: src/sys/dev/an/if_an.c,v 1.12 2000/11/13 23:04:12 wpaul Exp $
34  */
35 /*
36  * Copyright (c) 2004, 2005 David Young.  All rights reserved.
37  * Copyright (c) 2004, 2005 OJC Technologies.  All rights reserved.
38  * Copyright (c) 2004, 2005 Dayton Data Center Services, LLC.  All
39  *     rights reserved.
40  *
41  * Redistribution and use in source and binary forms, with or without
42  * modification, are permitted provided that the following conditions
43  * are met:
44  * 1. Redistributions of source code must retain the above copyright
45  *    notice, this list of conditions and the following disclaimer.
46  * 2. Redistributions in binary form must reproduce the above copyright
47  *    notice, this list of conditions and the following disclaimer in the
48  *    documentation and/or other materials provided with the distribution.
49  * 3. Neither the name of the author nor the names of any co-contributors
50  *    may be used to endorse or promote products derived from this software
51  *    without specific prior written permission.
52  *
53  * THIS SOFTWARE IS PROVIDED BY David Young AND CONTRIBUTORS ``AS IS'' AND
54  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
55  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
56  * ARE DISCLAIMED.  IN NO EVENT SHALL David Young AND CONTRIBUTORS
57  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
58  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
59  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
60  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
61  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
62  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
63  * THE POSSIBILITY OF SUCH DAMAGE.
64  */
65 
66 /*
67  * Aironet 4500/4800 802.11 PCMCIA/ISA/PCI driver for FreeBSD.
68  *
69  * Written by Bill Paul <wpaul@ctr.columbia.edu>
70  * Electrical Engineering Department
71  * Columbia University, New York City
72  */
73 
74 /*
75  * Ported to NetBSD from FreeBSD by Atsushi Onoe at the San Diego
76  * IETF meeting.
77  */
78 
79 #include <sys/cdefs.h>
80 __KERNEL_RCSID(0, "$NetBSD: an.c,v 1.52 2008/07/03 18:10:07 drochner Exp $");
81 
82 #include "bpfilter.h"
83 
84 #include <sys/param.h>
85 #include <sys/callout.h>
86 #include <sys/sysctl.h>
87 #include <sys/systm.h>
88 #include <sys/sockio.h>
89 #include <sys/mbuf.h>
90 #include <sys/kernel.h>
91 #include <sys/ucred.h>
92 #include <sys/socket.h>
93 #include <sys/device.h>
94 #include <sys/proc.h>
95 #include <sys/md4.h>
96 #include <sys/endian.h>
97 #include <sys/kauth.h>
98 
99 #include <sys/bus.h>
100 
101 #include <net/if.h>
102 #include <net/if_dl.h>
103 #include <net/if_ether.h>
104 #include <net/if_llc.h>
105 #include <net/if_media.h>
106 #include <net/if_types.h>
107 
108 #include <net80211/ieee80211_netbsd.h>
109 #include <net80211/ieee80211_var.h>
110 #include <net80211/ieee80211_radiotap.h>
111 
112 #if NBPFILTER > 0
113 #include <net/bpf.h>
114 #include <net/bpfdesc.h>
115 #endif
116 
117 #include <dev/ic/anreg.h>
118 #include <dev/ic/anvar.h>
119 
120 static int	an_reset(struct an_softc *);
121 static void	an_wait(struct an_softc *);
122 static int	an_init(struct ifnet *);
123 static void	an_stop(struct ifnet *, int);
124 static void	an_start(struct ifnet *);
125 static void	an_watchdog(struct ifnet *);
126 static int	an_ioctl(struct ifnet *, u_long, void *);
127 static int	an_media_change(struct ifnet *);
128 static void	an_media_status(struct ifnet *, struct ifmediareq *);
129 
130 static int	an_set_nwkey(struct an_softc *, struct ieee80211_nwkey *);
131 static int	an_set_nwkey_wep(struct an_softc *, struct ieee80211_nwkey *);
132 static int	an_set_nwkey_eap(struct an_softc *, struct ieee80211_nwkey *);
133 static int	an_get_nwkey(struct an_softc *, struct ieee80211_nwkey *);
134 static int	an_write_wepkey(struct an_softc *, int, struct an_wepkey *,
135 				int);
136 
137 static void	an_rx_intr(struct an_softc *);
138 static void	an_tx_intr(struct an_softc *, int);
139 static void	an_linkstat_intr(struct an_softc *);
140 
141 static int	an_cmd(struct an_softc *, int, int);
142 static int	an_seek_bap(struct an_softc *, int, int);
143 static int	an_read_bap(struct an_softc *, int, int, void *, int);
144 static int	an_write_bap(struct an_softc *, int, int, void *, int);
145 static int	an_mwrite_bap(struct an_softc *, int, int, struct mbuf *, int);
146 static int	an_read_rid(struct an_softc *, int, void *, int *);
147 static int	an_write_rid(struct an_softc *, int, void *, int);
148 
149 static int	an_alloc_fid(struct an_softc *, int, int *);
150 
151 static int	an_newstate(struct ieee80211com *, enum ieee80211_state, int);
152 
153 #ifdef AN_DEBUG
154 int an_debug = 0;
155 
156 #define	DPRINTF(X)	if (an_debug) printf X
157 #define	DPRINTF2(X)	if (an_debug > 1) printf X
158 static int an_sysctl_verify(SYSCTLFN_PROTO, int lower, int upper);
159 static int an_sysctl_verify_debug(SYSCTLFN_PROTO);
160 #else
161 #define	DPRINTF(X)
162 #define	DPRINTF2(X)
163 #endif
164 
165 int
166 an_attach(struct an_softc *sc)
167 {
168 	struct ieee80211com *ic = &sc->sc_ic;
169 	struct ifnet *ifp = &sc->sc_if;
170 	int i, s;
171 	struct an_rid_wepkey *akey;
172 	int buflen, kid, rid;
173 	int chan, chan_min, chan_max;
174 
175 	s = splnet();
176 	sc->sc_invalid = 0;
177 
178 	an_wait(sc);
179 	if (an_reset(sc) != 0) {
180 		sc->sc_invalid = 1;
181 		splx(s);
182 		return 1;
183 	}
184 
185 	/* Load factory config */
186 	if (an_cmd(sc, AN_CMD_READCFG, 0) != 0) {
187 		splx(s);
188 		aprint_error_dev(sc->sc_dev, "failed to load config data\n");
189 		return 1;
190 	}
191 
192 	/* Read the current configuration */
193 	buflen = sizeof(sc->sc_config);
194 	if (an_read_rid(sc, AN_RID_GENCONFIG, &sc->sc_config, &buflen) != 0) {
195 		splx(s);
196 		aprint_error_dev(sc->sc_dev, "read config failed\n");
197 		return 1;
198 	}
199 
200 	/* Read the card capabilities */
201 	buflen = sizeof(sc->sc_caps);
202 	if (an_read_rid(sc, AN_RID_CAPABILITIES, &sc->sc_caps, &buflen) != 0) {
203 		splx(s);
204 		aprint_error_dev(sc->sc_dev, "read caps failed\n");
205 		return 1;
206 	}
207 
208 #ifdef AN_DEBUG
209 	if (an_debug) {
210 		static const int dumprid[] = {
211 		    AN_RID_GENCONFIG, AN_RID_CAPABILITIES, AN_RID_SSIDLIST,
212 		    AN_RID_APLIST, AN_RID_STATUS, AN_RID_ENCAP
213 		};
214 
215 		for (rid = 0; rid < sizeof(dumprid)/sizeof(dumprid[0]); rid++) {
216 			buflen = sizeof(sc->sc_buf);
217 			if (an_read_rid(sc, dumprid[rid], &sc->sc_buf, &buflen)
218 			    != 0)
219 				continue;
220 			printf("%04x (%d):\n", dumprid[rid], buflen);
221 			for (i = 0; i < (buflen + 1) / 2; i++)
222 				printf(" %04x", sc->sc_buf.sc_val[i]);
223 			printf("\n");
224 		}
225 	}
226 #endif
227 
228 	/* Read WEP settings from persistent memory */
229 	akey = &sc->sc_buf.sc_wepkey;
230 	buflen = sizeof(struct an_rid_wepkey);
231 	rid = AN_RID_WEP_VOLATILE;	/* first persistent key */
232 	while (an_read_rid(sc, rid, akey, &buflen) == 0) {
233 		kid = le16toh(akey->an_key_index);
234 		DPRINTF(("an_attach: wep rid=0x%x len=%d(%zu) index=0x%04x "
235 		    "mac[0]=%02x keylen=%d\n",
236 		    rid, buflen, sizeof(*akey), kid,
237 		    akey->an_mac_addr[0], le16toh(akey->an_key_len)));
238 		if (kid == 0xffff) {
239 			sc->sc_tx_perskey = akey->an_mac_addr[0];
240 			sc->sc_tx_key = -1;
241 			break;
242 		}
243 		if (kid >= IEEE80211_WEP_NKID)
244 			break;
245 		sc->sc_perskeylen[kid] = le16toh(akey->an_key_len);
246 		sc->sc_wepkeys[kid].an_wep_keylen = -1;
247 		rid = AN_RID_WEP_PERSISTENT;	/* for next key */
248 		buflen = sizeof(struct an_rid_wepkey);
249 	}
250 
251 	aprint_normal_dev(sc->sc_dev, "%s %s (firmware %s)\n",
252 	    sc->sc_caps.an_manufname, sc->sc_caps.an_prodname,
253 	    sc->sc_caps.an_prodvers);
254 
255 	memcpy(ifp->if_xname, device_xname(sc->sc_dev), IFNAMSIZ);
256 
257 	ifp->if_softc = sc;
258 	ifp->if_flags = IFF_BROADCAST | IFF_NOTRAILERS | IFF_SIMPLEX |
259 	    IFF_MULTICAST | IFF_ALLMULTI;
260 	ifp->if_ioctl = an_ioctl;
261 	ifp->if_start = an_start;
262 	ifp->if_init = an_init;
263 	ifp->if_stop = an_stop;
264 	ifp->if_watchdog = an_watchdog;
265 	IFQ_SET_READY(&ifp->if_snd);
266 
267 	ic->ic_ifp = ifp;
268 	ic->ic_phytype = IEEE80211_T_DS;
269 	ic->ic_opmode = IEEE80211_M_STA;
270 	ic->ic_caps = IEEE80211_C_WEP | IEEE80211_C_PMGT | IEEE80211_C_IBSS |
271 	    IEEE80211_C_MONITOR;
272 	ic->ic_state = IEEE80211_S_INIT;
273 	IEEE80211_ADDR_COPY(ic->ic_myaddr, sc->sc_caps.an_oemaddr);
274 
275 	switch (le16toh(sc->sc_caps.an_regdomain)) {
276 	default:
277 	case AN_REGDOMAIN_USA:
278 	case AN_REGDOMAIN_CANADA:
279 		chan_min = 1; chan_max = 11; break;
280 	case AN_REGDOMAIN_EUROPE:
281 	case AN_REGDOMAIN_AUSTRALIA:
282 		chan_min = 1; chan_max = 13; break;
283 	case AN_REGDOMAIN_JAPAN:
284 		chan_min = 14; chan_max = 14; break;
285 	case AN_REGDOMAIN_SPAIN:
286 		chan_min = 10; chan_max = 11; break;
287 	case AN_REGDOMAIN_FRANCE:
288 		chan_min = 10; chan_max = 13; break;
289 	case AN_REGDOMAIN_JAPANWIDE:
290 		chan_min = 1; chan_max = 14; break;
291 	}
292 
293 	for (chan = chan_min; chan <= chan_max; chan++) {
294 		ic->ic_channels[chan].ic_freq =
295 		    ieee80211_ieee2mhz(chan, IEEE80211_CHAN_2GHZ);
296 		ic->ic_channels[chan].ic_flags = IEEE80211_CHAN_B;
297 	}
298 	ic->ic_ibss_chan = &ic->ic_channels[chan_min];
299 
300 	aprint_normal("%s: 802.11 address: %s, channel: %d-%d\n",
301 	    ifp->if_xname, ether_sprintf(ic->ic_myaddr), chan_min, chan_max);
302 
303 	/* Find supported rate */
304 	for (i = 0; i < sizeof(sc->sc_caps.an_rates); i++) {
305 		if (sc->sc_caps.an_rates[i] == 0)
306 			continue;
307 		ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[
308 		    ic->ic_sup_rates[IEEE80211_MODE_11B].rs_nrates++] =
309 		    sc->sc_caps.an_rates[i];
310 	}
311 
312 	/*
313 	 * Call MI attach routine.
314 	 */
315 	if_attach(ifp);
316 	ieee80211_ifattach(ic);
317 
318 	sc->sc_newstate = ic->ic_newstate;
319 	ic->ic_newstate = an_newstate;
320 
321 	ieee80211_media_init(ic, an_media_change, an_media_status);
322 
323 	/*
324 	 * radiotap BPF device
325 	 */
326 #if NBPFILTER > 0
327 	bpfattach2(ifp, DLT_IEEE802_11_RADIO,
328 	    sizeof(struct ieee80211_frame) + 64, &sc->sc_drvbpf);
329 #endif
330 
331 	memset(&sc->sc_rxtapu, 0, sizeof(sc->sc_rxtapu));
332 	sc->sc_rxtap.ar_ihdr.it_len = htole16(sizeof(sc->sc_rxtapu));
333 	sc->sc_rxtap.ar_ihdr.it_present = htole32(AN_RX_RADIOTAP_PRESENT);
334 
335 	memset(&sc->sc_txtapu, 0, sizeof(sc->sc_txtapu));
336 	sc->sc_txtap.at_ihdr.it_len = htole16(sizeof(sc->sc_txtapu));
337 	sc->sc_txtap.at_ihdr.it_present = htole32(AN_TX_RADIOTAP_PRESENT);
338 
339 	sc->sc_attached = 1;
340 	splx(s);
341 
342 	ieee80211_announce(ic);
343 	return 0;
344 }
345 
346 #ifdef AN_DEBUG
347 /*
348  * Setup sysctl(3) MIB, hw.an.*
349  *
350  * TBD condition CTLFLAG_PERMANENT on being an LKM or not
351  */
352 SYSCTL_SETUP(sysctl_an, "sysctl an(4) subtree setup")
353 {
354 	int rc;
355 	const struct sysctlnode *cnode, *rnode;
356 
357 	if ((rc = sysctl_createv(clog, 0, NULL, &rnode,
358 	    CTLFLAG_PERMANENT, CTLTYPE_NODE, "hw", NULL,
359 	    NULL, 0, NULL, 0, CTL_HW, CTL_EOL)) != 0)
360 		goto err;
361 
362 	if ((rc = sysctl_createv(clog, 0, &rnode, &rnode,
363 	    CTLFLAG_PERMANENT, CTLTYPE_NODE, "an",
364 	    "Cisco/Aironet 802.11 controls",
365 	    NULL, 0, NULL, 0, CTL_CREATE, CTL_EOL)) != 0)
366 		goto err;
367 
368 	/* control debugging printfs */
369 	if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
370 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
371 	    "debug", SYSCTL_DESCR("Enable Cisco/Aironet debugging output"),
372 	    an_sysctl_verify_debug, 0, &an_debug, 0,
373 	    CTL_CREATE, CTL_EOL)) != 0)
374 		goto err;
375 
376 	return;
377 err:
378 	printf("%s: sysctl_createv failed (rc = %d)\n", __func__, rc);
379 }
380 
381 static int
382 an_sysctl_verify(SYSCTLFN_ARGS, int lower, int upper)
383 {
384 	int error, t;
385 	struct sysctlnode node;
386 
387 	node = *rnode;
388 	t = *(int*)rnode->sysctl_data;
389 	node.sysctl_data = &t;
390 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
391 	if (error || newp == NULL)
392 		return (error);
393 
394 	if (t < lower || t > upper)
395 		return (EINVAL);
396 
397 	*(int*)rnode->sysctl_data = t;
398 
399 	return (0);
400 }
401 
402 static int
403 an_sysctl_verify_debug(SYSCTLFN_ARGS)
404 {
405 	return an_sysctl_verify(SYSCTLFN_CALL(rnode), 0, 2);
406 }
407 #endif /* AN_DEBUG */
408 
409 int
410 an_detach(struct an_softc *sc)
411 {
412 	struct ieee80211com *ic = &sc->sc_ic;
413 	struct ifnet *ifp = &sc->sc_if;
414 	int s;
415 
416 	if (!sc->sc_attached)
417 		return 0;
418 
419 	s = splnet();
420 	sc->sc_invalid = 1;
421 	an_stop(ifp, 1);
422 	ieee80211_ifdetach(ic);
423 	if_detach(ifp);
424 	splx(s);
425 	return 0;
426 }
427 
428 int
429 an_activate(struct device *self, enum devact act)
430 {
431 	struct an_softc *sc = (struct an_softc *)self;
432 	int s, error = 0;
433 
434 	s = splnet();
435 	switch (act) {
436 	case DVACT_ACTIVATE:
437 		error = EOPNOTSUPP;
438 		break;
439 
440 	case DVACT_DEACTIVATE:
441 		sc->sc_invalid = 1;
442 		if_deactivate(&sc->sc_if);
443 		break;
444 	}
445 	splx(s);
446 
447 	return error;
448 }
449 
450 int
451 an_intr(void *arg)
452 {
453 	struct an_softc *sc = arg;
454 	struct ifnet *ifp = &sc->sc_if;
455 	int i;
456 	u_int16_t status;
457 
458 	if (!sc->sc_enabled || sc->sc_invalid ||
459 	    !device_is_active(sc->sc_dev) ||
460 	    (ifp->if_flags & IFF_RUNNING) == 0)
461 		return 0;
462 
463 	if ((ifp->if_flags & IFF_UP) == 0) {
464 		CSR_WRITE_2(sc, AN_INT_EN, 0);
465 		CSR_WRITE_2(sc, AN_EVENT_ACK, ~0);
466 		return 1;
467 	}
468 
469 	/* maximum 10 loops per interrupt */
470 	for (i = 0; i < 10; i++) {
471 		if (!sc->sc_enabled || sc->sc_invalid)
472 			return 1;
473 		if (CSR_READ_2(sc, AN_SW0) != AN_MAGIC) {
474 			DPRINTF(("an_intr: magic number changed: %x\n",
475 			    CSR_READ_2(sc, AN_SW0)));
476 			sc->sc_invalid = 1;
477 			return 1;
478 		}
479 		status = CSR_READ_2(sc, AN_EVENT_STAT);
480 		CSR_WRITE_2(sc, AN_EVENT_ACK, status & ~(AN_INTRS));
481 		if ((status & AN_INTRS) == 0)
482 			break;
483 
484 		if (status & AN_EV_RX)
485 			an_rx_intr(sc);
486 
487 		if (status & (AN_EV_TX | AN_EV_TX_EXC))
488 			an_tx_intr(sc, status);
489 
490 		if (status & AN_EV_LINKSTAT)
491 			an_linkstat_intr(sc);
492 
493 		if ((ifp->if_flags & IFF_OACTIVE) == 0 &&
494 		    sc->sc_ic.ic_state == IEEE80211_S_RUN &&
495 		    !IFQ_IS_EMPTY(&ifp->if_snd))
496 			an_start(ifp);
497 	}
498 
499 	return 1;
500 }
501 
502 static int
503 an_init(struct ifnet *ifp)
504 {
505 	struct an_softc *sc = ifp->if_softc;
506 	struct ieee80211com *ic = &sc->sc_ic;
507 	int i, error, fid;
508 
509 	DPRINTF(("an_init: enabled %d\n", sc->sc_enabled));
510 	if (!sc->sc_enabled) {
511 		if (sc->sc_enable)
512 			(*sc->sc_enable)(sc);
513 		an_wait(sc);
514 		sc->sc_enabled = 1;
515 	} else {
516 		an_stop(ifp, 0);
517 		if ((error = an_reset(sc)) != 0) {
518 			printf("%s: failed to reset\n", ifp->if_xname);
519 			an_stop(ifp, 1);
520 			return error;
521 		}
522 	}
523 	CSR_WRITE_2(sc, AN_SW0, AN_MAGIC);
524 
525 	/* Allocate the TX buffers */
526 	for (i = 0; i < AN_TX_RING_CNT; i++) {
527 		if ((error = an_alloc_fid(sc, AN_TX_MAX_LEN, &fid)) != 0) {
528 			printf("%s: failed to allocate nic memory\n",
529 			    ifp->if_xname);
530 			an_stop(ifp, 1);
531 			return error;
532 		}
533 		DPRINTF2(("an_init: txbuf %d allocated %x\n", i, fid));
534 		sc->sc_txd[i].d_fid = fid;
535 		sc->sc_txd[i].d_inuse = 0;
536 	}
537 	sc->sc_txcur = sc->sc_txnext = 0;
538 
539 	IEEE80211_ADDR_COPY(sc->sc_config.an_macaddr, ic->ic_myaddr);
540 	sc->sc_config.an_scanmode = htole16(AN_SCANMODE_ACTIVE);
541 	sc->sc_config.an_authtype = htole16(AN_AUTHTYPE_OPEN);	/*XXX*/
542 	if (ic->ic_flags & IEEE80211_F_PRIVACY) {
543 		sc->sc_config.an_authtype |=
544 		    htole16(AN_AUTHTYPE_PRIVACY_IN_USE);
545 		if (sc->sc_use_leap)
546 			sc->sc_config.an_authtype |=
547 			    htole16(AN_AUTHTYPE_LEAP);
548 	}
549 	sc->sc_config.an_listen_interval = htole16(ic->ic_lintval);
550 	sc->sc_config.an_beacon_period = htole16(ic->ic_lintval);
551 	if (ic->ic_flags & IEEE80211_F_PMGTON)
552 		sc->sc_config.an_psave_mode = htole16(AN_PSAVE_PSP);
553 	else
554 		sc->sc_config.an_psave_mode = htole16(AN_PSAVE_CAM);
555 	sc->sc_config.an_ds_channel =
556 	    htole16(ieee80211_chan2ieee(ic, ic->ic_ibss_chan));
557 
558 	switch (ic->ic_opmode) {
559 	case IEEE80211_M_STA:
560 		sc->sc_config.an_opmode =
561 		    htole16(AN_OPMODE_INFRASTRUCTURE_STATION);
562 		sc->sc_config.an_rxmode = htole16(AN_RXMODE_BC_MC_ADDR);
563 		break;
564 	case IEEE80211_M_IBSS:
565 		sc->sc_config.an_opmode = htole16(AN_OPMODE_IBSS_ADHOC);
566 		sc->sc_config.an_rxmode = htole16(AN_RXMODE_BC_MC_ADDR);
567 		break;
568 	case IEEE80211_M_MONITOR:
569 		sc->sc_config.an_opmode =
570 		    htole16(AN_OPMODE_INFRASTRUCTURE_STATION);
571 		sc->sc_config.an_rxmode =
572 		    htole16(AN_RXMODE_80211_MONITOR_ANYBSS);
573 		sc->sc_config.an_authtype = htole16(AN_AUTHTYPE_NONE);
574 		if (ic->ic_flags & IEEE80211_F_PRIVACY)
575 			sc->sc_config.an_authtype |=
576 			    htole16(AN_AUTHTYPE_PRIVACY_IN_USE |
577 		            AN_AUTHTYPE_ALLOW_UNENCRYPTED);
578 		break;
579 	default:
580 		printf("%s: bad opmode %d\n", ifp->if_xname, ic->ic_opmode);
581 		an_stop(ifp, 1);
582 		return EIO;
583 	}
584 	sc->sc_config.an_rxmode |= htole16(AN_RXMODE_NO_8023_HEADER);
585 
586 	/* Set the ssid list */
587 	memset(&sc->sc_buf, 0, sizeof(sc->sc_buf.sc_ssidlist));
588 	sc->sc_buf.sc_ssidlist.an_entry[0].an_ssid_len =
589 	    htole16(ic->ic_des_esslen);
590 	if (ic->ic_des_esslen)
591 		memcpy(sc->sc_buf.sc_ssidlist.an_entry[0].an_ssid,
592 		    ic->ic_des_essid, ic->ic_des_esslen);
593 	if (an_write_rid(sc, AN_RID_SSIDLIST, &sc->sc_buf,
594 	    sizeof(sc->sc_buf.sc_ssidlist)) != 0) {
595 		printf("%s: failed to write ssid list\n", ifp->if_xname);
596 		an_stop(ifp, 1);
597 		return error;
598 	}
599 
600 	/* Set the AP list */
601 	memset(&sc->sc_buf, 0, sizeof(sc->sc_buf.sc_aplist));
602 	(void)an_write_rid(sc, AN_RID_APLIST, &sc->sc_buf,
603 	    sizeof(sc->sc_buf.sc_aplist));
604 
605 	/* Set the encapsulation */
606 	for (i = 0; i < AN_ENCAP_NENTS; i++) {
607 		sc->sc_buf.sc_encap.an_entry[i].an_ethertype = htole16(0);
608 		sc->sc_buf.sc_encap.an_entry[i].an_action =
609 		    htole16(AN_RXENCAP_RFC1024 | AN_TXENCAP_RFC1024);
610 	}
611 	(void)an_write_rid(sc, AN_RID_ENCAP, &sc->sc_buf,
612 	    sizeof(sc->sc_buf.sc_encap));
613 
614 	/* Set the WEP Keys */
615 	if (ic->ic_flags & IEEE80211_F_PRIVACY)
616 		an_write_wepkey(sc, AN_RID_WEP_VOLATILE, sc->sc_wepkeys,
617 		    sc->sc_tx_key);
618 
619 	/* Set the configuration */
620 #ifdef AN_DEBUG
621 	if (an_debug) {
622 		printf("write config:\n");
623 		for (i = 0; i < sizeof(sc->sc_config) / 2; i++)
624 			printf(" %04x", ((u_int16_t *)&sc->sc_config)[i]);
625 		printf("\n");
626 	}
627 #endif
628 	if (an_write_rid(sc, AN_RID_GENCONFIG, &sc->sc_config,
629 	    sizeof(sc->sc_config)) != 0) {
630 		printf("%s: failed to write config\n", ifp->if_xname);
631 		an_stop(ifp, 1);
632 		return error;
633 	}
634 
635 	/* Enable the MAC */
636 	if (an_cmd(sc, AN_CMD_ENABLE, 0)) {
637 		aprint_error_dev(sc->sc_dev, "failed to enable MAC\n");
638 		an_stop(ifp, 1);
639 		return ENXIO;
640 	}
641 	if (ifp->if_flags & IFF_PROMISC)
642 		an_cmd(sc, AN_CMD_SET_MODE, 0xffff);
643 
644 	ifp->if_flags |= IFF_RUNNING;
645 	ifp->if_flags &= ~IFF_OACTIVE;
646 	ic->ic_state = IEEE80211_S_INIT;
647 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
648 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
649 
650 	/* enable interrupts */
651 	CSR_WRITE_2(sc, AN_INT_EN, AN_INTRS);
652 	return 0;
653 }
654 
655 static void
656 an_stop(struct ifnet *ifp, int disable)
657 {
658 	struct an_softc *sc = ifp->if_softc;
659 	int i, s;
660 
661 	if (!sc->sc_enabled)
662 		return;
663 
664 	DPRINTF(("an_stop: disable %d\n", disable));
665 
666 	s = splnet();
667 	ieee80211_new_state(&sc->sc_ic, IEEE80211_S_INIT, -1);
668 	if (!sc->sc_invalid) {
669 		an_cmd(sc, AN_CMD_FORCE_SYNCLOSS, 0);
670 		CSR_WRITE_2(sc, AN_INT_EN, 0);
671 		an_cmd(sc, AN_CMD_DISABLE, 0);
672 
673 		for (i = 0; i < AN_TX_RING_CNT; i++)
674 			an_cmd(sc, AN_CMD_DEALLOC_MEM, sc->sc_txd[i].d_fid);
675 	}
676 
677 	sc->sc_tx_timer = 0;
678 	ifp->if_timer = 0;
679 	ifp->if_flags &= ~(IFF_RUNNING|IFF_OACTIVE);
680 
681 	if (disable) {
682 		if (sc->sc_disable)
683 			(*sc->sc_disable)(sc);
684 		sc->sc_enabled = 0;
685 	}
686 	splx(s);
687 }
688 
689 static void
690 an_start(struct ifnet *ifp)
691 {
692 	struct an_softc *sc = (struct an_softc *)ifp->if_softc;
693 	struct ieee80211com *ic = &sc->sc_ic;
694 	struct ieee80211_node *ni;
695 	struct ieee80211_frame *wh;
696 	struct an_txframe frmhdr;
697 	struct ether_header *eh;
698 	struct mbuf *m;
699 	u_int16_t len;
700 	int cur, fid;
701 
702 	if (!sc->sc_enabled || sc->sc_invalid) {
703 		DPRINTF(("an_start: noop: enabled %d invalid %d\n",
704 		    sc->sc_enabled, sc->sc_invalid));
705 		return;
706 	}
707 
708 	memset(&frmhdr, 0, sizeof(frmhdr));
709 	cur = sc->sc_txnext;
710 	for (;;) {
711 		if (ic->ic_state != IEEE80211_S_RUN) {
712 			DPRINTF(("an_start: not running %d\n", ic->ic_state));
713 			break;
714 		}
715 		IFQ_POLL(&ifp->if_snd, m);
716 		if (m == NULL) {
717 			DPRINTF2(("an_start: no pending mbuf\n"));
718 			break;
719 		}
720 		if (sc->sc_txd[cur].d_inuse) {
721 			DPRINTF2(("an_start: %x/%d busy\n",
722 			    sc->sc_txd[cur].d_fid, cur));
723 			ifp->if_flags |= IFF_OACTIVE;
724 			break;
725 		}
726 		IFQ_DEQUEUE(&ifp->if_snd, m);
727 		ifp->if_opackets++;
728 #if NBPFILTER > 0
729 		if (ifp->if_bpf)
730 			bpf_mtap(ifp->if_bpf, m);
731 #endif
732 		eh = mtod(m, struct ether_header *);
733 		ni = ieee80211_find_txnode(ic, eh->ether_dhost);
734 		if (ni == NULL) {
735 			/* NB: ieee80211_find_txnode does stat+msg */
736 			goto bad;
737 		}
738 		if ((m = ieee80211_encap(ic, m, ni)) == NULL)
739 			goto bad;
740 		ieee80211_free_node(ni);
741 #if NBPFILTER > 0
742 		if (ic->ic_rawbpf)
743 			bpf_mtap(ic->ic_rawbpf, m);
744 #endif
745 
746 		wh = mtod(m, struct ieee80211_frame *);
747 		if (ic->ic_flags & IEEE80211_F_PRIVACY)
748 			wh->i_fc[1] |= IEEE80211_FC1_WEP;
749 		m_copydata(m, 0, sizeof(struct ieee80211_frame),
750 		    (void *)&frmhdr.an_whdr);
751 
752 		/* insert payload length in front of llc/snap */
753 		len = htons(m->m_pkthdr.len - sizeof(struct ieee80211_frame));
754 		m_adj(m, sizeof(struct ieee80211_frame) - sizeof(len));
755 		if (mtod(m, u_long) & 0x01)
756 			memcpy(mtod(m, void *), &len, sizeof(len));
757 		else
758 			*mtod(m, u_int16_t *) = len;
759 
760 		/*
761 		 * XXX Aironet firmware apparently convert the packet
762 		 * with longer than 1500 bytes in length into LLC/SNAP.
763 		 * If we have 1500 bytes in ethernet payload, it is
764 		 * 1508 bytes including LLC/SNAP and will be inserted
765 		 * additional LLC/SNAP header with 1501-1508 in its
766 		 * ethertype !!
767 		 * So we skip LLC/SNAP header and force firmware to
768 		 * convert it to LLC/SNAP again.
769 		 */
770 		m_adj(m, sizeof(struct llc));
771 
772 		frmhdr.an_tx_ctl = htole16(AN_TXCTL_80211);
773 		frmhdr.an_tx_payload_len = htole16(m->m_pkthdr.len);
774 		frmhdr.an_gaplen = htole16(AN_TXGAP_802_11);
775 
776 		if (ic->ic_fixed_rate != -1)
777 			frmhdr.an_tx_rate =
778 			    ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[
779 			    ic->ic_fixed_rate] & IEEE80211_RATE_VAL;
780 		else
781 			frmhdr.an_tx_rate = 0;
782 
783 		/* XXX radiotap for tx must be completed */
784 #if NBPFILTER > 0
785 		if (sc->sc_drvbpf) {
786 			struct an_tx_radiotap_header *tap = &sc->sc_txtap;
787 			tap->at_rate = ic->ic_bss->ni_rates.rs_rates[ic->ic_bss->ni_txrate];
788 			tap->at_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
789 			tap->at_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
790 			/* TBD tap->wt_flags */
791 			bpf_mtap2(sc->sc_drvbpf, tap, tap->at_ihdr.it_len, m);
792 		}
793 #endif
794 
795 #ifdef AN_DEBUG
796 		if ((ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==
797 		    (IFF_DEBUG|IFF_LINK2)) {
798 			ieee80211_dump_pkt((u_int8_t *)&frmhdr.an_whdr,
799 			    sizeof(struct ieee80211_frame), -1, 0);
800 			printf(" txctl 0x%x plen %u\n",
801 			    le16toh(frmhdr.an_tx_ctl),
802 			    le16toh(frmhdr.an_tx_payload_len));
803 		}
804 #endif
805 		if (sizeof(frmhdr) + AN_TXGAP_802_11 + sizeof(len) +
806 		    m->m_pkthdr.len > AN_TX_MAX_LEN)
807 			goto bad;
808 
809 		fid = sc->sc_txd[cur].d_fid;
810 		if (an_write_bap(sc, fid, 0, &frmhdr, sizeof(frmhdr)) != 0)
811 			goto bad;
812 		/* dummy write to avoid seek. */
813 		an_write_bap(sc, fid, -1, &frmhdr, AN_TXGAP_802_11);
814 		an_mwrite_bap(sc, fid, -1, m, m->m_pkthdr.len);
815 		m_freem(m);
816 
817 		DPRINTF2(("an_start: send %zu byte via %x/%d\n",
818 		    ntohs(len) + sizeof(struct ieee80211_frame),
819 		    fid, cur));
820 		sc->sc_txd[cur].d_inuse = 1;
821 		if (an_cmd(sc, AN_CMD_TX, fid)) {
822 			printf("%s: xmit failed\n", ifp->if_xname);
823 			sc->sc_txd[cur].d_inuse = 0;
824 			continue;
825 		}
826 		sc->sc_tx_timer = 5;
827 		ifp->if_timer = 1;
828 		AN_INC(cur, AN_TX_RING_CNT);
829 		sc->sc_txnext = cur;
830 		continue;
831 bad:
832 		ifp->if_oerrors++;
833 		m_freem(m);
834 	}
835 }
836 
837 static int
838 an_reset(struct an_softc *sc)
839 {
840 
841 	DPRINTF(("an_reset\n"));
842 
843 	if (!sc->sc_enabled)
844 		return ENXIO;
845 
846 	an_cmd(sc, AN_CMD_ENABLE, 0);
847 	an_cmd(sc, AN_CMD_FW_RESTART, 0);
848 	an_cmd(sc, AN_CMD_NOOP2, 0);
849 
850 	if (an_cmd(sc, AN_CMD_FORCE_SYNCLOSS, 0) == ETIMEDOUT) {
851 		aprint_error_dev(sc->sc_dev, "reset failed\n");
852 		return ETIMEDOUT;
853 	}
854 
855 	an_cmd(sc, AN_CMD_DISABLE, 0);
856 	return 0;
857 }
858 
859 static void
860 an_watchdog(struct ifnet *ifp)
861 {
862 	struct an_softc *sc = ifp->if_softc;
863 
864 	if (!sc->sc_enabled)
865 		return;
866 
867 	if (sc->sc_tx_timer) {
868 		if (--sc->sc_tx_timer == 0) {
869 			printf("%s: device timeout\n", ifp->if_xname);
870 			ifp->if_oerrors++;
871 			an_init(ifp);
872 			return;
873 		}
874 		ifp->if_timer = 1;
875 	}
876 	ieee80211_watchdog(&sc->sc_ic);
877 }
878 
879 static int
880 an_ioctl(struct ifnet *ifp, u_long command, void *data)
881 {
882 	struct an_softc *sc = ifp->if_softc;
883 	int s, error = 0;
884 
885 	if (!device_is_active(sc->sc_dev))
886 		return ENXIO;
887 
888 	s = splnet();
889 
890 	switch (command) {
891 	case SIOCSIFFLAGS:
892 		if (ifp->if_flags & IFF_UP) {
893 			if (sc->sc_enabled) {
894 				/*
895 				 * To avoid rescanning another access point,
896 				 * do not call an_init() here.  Instead, only
897 				 * reflect promisc mode settings.
898 				 */
899 				error = an_cmd(sc, AN_CMD_SET_MODE,
900 				    (ifp->if_flags & IFF_PROMISC) ? 0xffff : 0);
901 			} else
902 				error = an_init(ifp);
903 		} else if (sc->sc_enabled)
904 			an_stop(ifp, 1);
905 		break;
906 	case SIOCADDMULTI:
907 	case SIOCDELMULTI:
908 		error = ether_ioctl(ifp, command, data);
909 		if (error == ENETRESET) {
910 			/* we don't have multicast filter. */
911 			error = 0;
912 		}
913 		break;
914 	case SIOCS80211NWKEY:
915 		error = an_set_nwkey(sc, (struct ieee80211_nwkey *)data);
916 			break;
917 	case SIOCG80211NWKEY:
918 		error = an_get_nwkey(sc, (struct ieee80211_nwkey *)data);
919 		break;
920 	default:
921 		error = ieee80211_ioctl(&sc->sc_ic, command, data);
922 		break;
923 	}
924 	if (error == ENETRESET) {
925 		if (sc->sc_enabled)
926 			error = an_init(ifp);
927 		else
928 			error = 0;
929 	}
930 	splx(s);
931 	return error;
932 }
933 
934 /* TBD factor with ieee80211_media_change */
935 static int
936 an_media_change(struct ifnet *ifp)
937 {
938 	struct an_softc *sc = ifp->if_softc;
939 	struct ieee80211com *ic = &sc->sc_ic;
940 	struct ifmedia_entry *ime;
941 	enum ieee80211_opmode newmode;
942 	int i, rate, error = 0;
943 
944 	ime = ic->ic_media.ifm_cur;
945 	if (IFM_SUBTYPE(ime->ifm_media) == IFM_AUTO) {
946 		i = -1;
947 	} else {
948 		struct ieee80211_rateset *rs =
949 		    &ic->ic_sup_rates[IEEE80211_MODE_11B];
950 		rate = ieee80211_media2rate(ime->ifm_media);
951 		if (rate == 0)
952 			return EINVAL;
953 		for (i = 0; i < rs->rs_nrates; i++) {
954 			if ((rs->rs_rates[i] & IEEE80211_RATE_VAL) == rate)
955 				break;
956 		}
957 		if (i == rs->rs_nrates)
958 			return EINVAL;
959 	}
960 	if (ic->ic_fixed_rate != i) {
961 		ic->ic_fixed_rate = i;
962 		error = ENETRESET;
963 	}
964 
965 	if (ime->ifm_media & IFM_IEEE80211_ADHOC)
966 		newmode = IEEE80211_M_IBSS;
967 	else if (ime->ifm_media & IFM_IEEE80211_HOSTAP)
968 		newmode = IEEE80211_M_HOSTAP;
969 	else if (ime->ifm_media & IFM_IEEE80211_MONITOR)
970 		newmode = IEEE80211_M_MONITOR;
971 	else
972 		newmode = IEEE80211_M_STA;
973 	if (ic->ic_opmode != newmode) {
974 		ic->ic_opmode = newmode;
975 		error = ENETRESET;
976 	}
977 	if (error == ENETRESET) {
978 		if (sc->sc_enabled)
979 			error = an_init(ifp);
980 		else
981 			error = 0;
982 	}
983 	ifp->if_baudrate = ifmedia_baudrate(ic->ic_media.ifm_cur->ifm_media);
984 
985 	return error;
986 }
987 
988 static void
989 an_media_status(struct ifnet *ifp, struct ifmediareq *imr)
990 {
991 	struct an_softc *sc = ifp->if_softc;
992 	struct ieee80211com *ic = &sc->sc_ic;
993 	int rate, buflen;
994 
995 	if (sc->sc_enabled == 0) {
996 		imr->ifm_active = IFM_IEEE80211 | IFM_NONE;
997 		imr->ifm_status = 0;
998 		return;
999 	}
1000 
1001 	imr->ifm_status = IFM_AVALID;
1002 	imr->ifm_active = IFM_IEEE80211;
1003 	if (ic->ic_state == IEEE80211_S_RUN)
1004 		imr->ifm_status |= IFM_ACTIVE;
1005 	buflen = sizeof(sc->sc_buf);
1006 	if (ic->ic_fixed_rate != -1)
1007 		rate = ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[
1008 		    ic->ic_fixed_rate] & IEEE80211_RATE_VAL;
1009 	else if (an_read_rid(sc, AN_RID_STATUS, &sc->sc_buf, &buflen) != 0)
1010 		rate = 0;
1011 	else
1012 		rate = le16toh(sc->sc_buf.sc_status.an_current_tx_rate);
1013 	imr->ifm_active |= ieee80211_rate2media(ic, rate, IEEE80211_MODE_11B);
1014 	switch (ic->ic_opmode) {
1015 	case IEEE80211_M_STA:
1016 		break;
1017 	case IEEE80211_M_IBSS:
1018 		imr->ifm_active |= IFM_IEEE80211_ADHOC;
1019 		break;
1020 	case IEEE80211_M_HOSTAP:
1021 		imr->ifm_active |= IFM_IEEE80211_HOSTAP;
1022 		break;
1023 	case IEEE80211_M_MONITOR:
1024 		imr->ifm_active |= IFM_IEEE80211_MONITOR;
1025 		break;
1026 	default:
1027 		break;
1028 	}
1029 }
1030 
1031 static int
1032 an_set_nwkey(struct an_softc *sc, struct ieee80211_nwkey *nwkey)
1033 {
1034 	int error;
1035 	struct ieee80211com *ic = &sc->sc_ic;
1036 	u_int16_t prevauth;
1037 
1038 	error = 0;
1039 	prevauth = sc->sc_config.an_authtype;
1040 
1041 	switch (nwkey->i_wepon) {
1042 	case IEEE80211_NWKEY_OPEN:
1043 		sc->sc_config.an_authtype = AN_AUTHTYPE_OPEN;
1044 		ic->ic_flags &= ~IEEE80211_F_PRIVACY;
1045 		break;
1046 
1047 	case IEEE80211_NWKEY_WEP:
1048 	case IEEE80211_NWKEY_WEP | IEEE80211_NWKEY_PERSIST:
1049 		error = an_set_nwkey_wep(sc, nwkey);
1050 		if (error == 0 || error == ENETRESET) {
1051 			sc->sc_config.an_authtype =
1052 			    AN_AUTHTYPE_OPEN | AN_AUTHTYPE_PRIVACY_IN_USE;
1053 			ic->ic_flags |= IEEE80211_F_PRIVACY;
1054 		}
1055 		break;
1056 
1057 	case IEEE80211_NWKEY_EAP:
1058 		error = an_set_nwkey_eap(sc, nwkey);
1059 		if (error == 0 || error == ENETRESET) {
1060 			sc->sc_config.an_authtype = AN_AUTHTYPE_OPEN |
1061 			    AN_AUTHTYPE_PRIVACY_IN_USE | AN_AUTHTYPE_LEAP;
1062 			ic->ic_flags |= IEEE80211_F_PRIVACY;
1063 		}
1064 		break;
1065 	default:
1066 		error = EINVAL;
1067 		break;
1068 	}
1069 	if (error == 0 && prevauth != sc->sc_config.an_authtype)
1070 		error = ENETRESET;
1071 	return error;
1072 }
1073 
1074 static int
1075 an_set_nwkey_wep(struct an_softc *sc, struct ieee80211_nwkey *nwkey)
1076 {
1077 	int i, txkey, anysetkey, needreset, error;
1078 	struct an_wepkey keys[IEEE80211_WEP_NKID];
1079 
1080 	error = 0;
1081 	memset(keys, 0, sizeof(keys));
1082 	anysetkey = needreset = 0;
1083 
1084 	/* load argument and sanity check */
1085 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
1086 		keys[i].an_wep_keylen = nwkey->i_key[i].i_keylen;
1087 		if (keys[i].an_wep_keylen < 0)
1088 			continue;
1089 		if (keys[i].an_wep_keylen != 0 &&
1090 		    keys[i].an_wep_keylen < IEEE80211_WEP_KEYLEN)
1091 			return EINVAL;
1092 		if (keys[i].an_wep_keylen > sizeof(keys[i].an_wep_key))
1093 			return EINVAL;
1094 		if ((error = copyin(nwkey->i_key[i].i_keydat,
1095 		    keys[i].an_wep_key, keys[i].an_wep_keylen)) != 0)
1096 			return error;
1097 		anysetkey++;
1098 	}
1099 	txkey = nwkey->i_defkid - 1;
1100 	if (txkey >= 0) {
1101 		if (txkey >= IEEE80211_WEP_NKID)
1102 			return EINVAL;
1103 		/* default key must have a valid value */
1104 		if (keys[txkey].an_wep_keylen == 0 ||
1105 		    (keys[txkey].an_wep_keylen < 0 &&
1106 		    sc->sc_perskeylen[txkey] == 0))
1107 			return EINVAL;
1108 		anysetkey++;
1109 	}
1110 	DPRINTF(("an_set_nwkey_wep: %s: %sold(%d:%d,%d,%d,%d) "
1111 	    "pers(%d:%d,%d,%d,%d) new(%d:%d,%d,%d,%d)\n",
1112 	    device_xname(sc->sc_dev),
1113 	    ((nwkey->i_wepon & IEEE80211_NWKEY_PERSIST) ? "persist: " : ""),
1114 	    sc->sc_tx_key,
1115 	    sc->sc_wepkeys[0].an_wep_keylen, sc->sc_wepkeys[1].an_wep_keylen,
1116 	    sc->sc_wepkeys[2].an_wep_keylen, sc->sc_wepkeys[3].an_wep_keylen,
1117 	    sc->sc_tx_perskey,
1118 	    sc->sc_perskeylen[0], sc->sc_perskeylen[1],
1119 	    sc->sc_perskeylen[2], sc->sc_perskeylen[3],
1120 	    txkey,
1121 	    keys[0].an_wep_keylen, keys[1].an_wep_keylen,
1122 	    keys[2].an_wep_keylen, keys[3].an_wep_keylen));
1123 	if (!(nwkey->i_wepon & IEEE80211_NWKEY_PERSIST)) {
1124 		/* set temporary keys */
1125 		sc->sc_tx_key = txkey;
1126 		for (i = 0; i < IEEE80211_WEP_NKID; i++) {
1127 			if (keys[i].an_wep_keylen < 0)
1128 				continue;
1129 			memcpy(&sc->sc_wepkeys[i], &keys[i], sizeof(keys[i]));
1130 		}
1131 	} else {
1132 		/* set persist keys */
1133 		if (anysetkey) {
1134 			/* prepare to write nvram */
1135 			if (!sc->sc_enabled) {
1136 				if (sc->sc_enable)
1137 					(*sc->sc_enable)(sc);
1138 				an_wait(sc);
1139 				sc->sc_enabled = 1;
1140 				error = an_write_wepkey(sc,
1141 				    AN_RID_WEP_PERSISTENT, keys, txkey);
1142 				if (sc->sc_disable)
1143 					(*sc->sc_disable)(sc);
1144 				sc->sc_enabled = 0;
1145 			} else {
1146 				an_cmd(sc, AN_CMD_DISABLE, 0);
1147 				error = an_write_wepkey(sc,
1148 				    AN_RID_WEP_PERSISTENT, keys, txkey);
1149 				an_cmd(sc, AN_CMD_ENABLE, 0);
1150 			}
1151 			if (error)
1152 				return error;
1153 		}
1154 		if (txkey >= 0)
1155 			sc->sc_tx_perskey = txkey;
1156 		if (sc->sc_tx_key >= 0) {
1157 			sc->sc_tx_key = -1;
1158 			needreset++;
1159 		}
1160 		for (i = 0; i < IEEE80211_WEP_NKID; i++) {
1161 			if (sc->sc_wepkeys[i].an_wep_keylen >= 0) {
1162 				memset(&sc->sc_wepkeys[i].an_wep_key, 0,
1163 				    sizeof(sc->sc_wepkeys[i].an_wep_key));
1164 				sc->sc_wepkeys[i].an_wep_keylen = -1;
1165 				needreset++;
1166 			}
1167 			if (keys[i].an_wep_keylen >= 0)
1168 				sc->sc_perskeylen[i] = keys[i].an_wep_keylen;
1169 		}
1170 	}
1171 	if (needreset) {
1172 		/* firmware restart to reload persistent key */
1173 		an_reset(sc);
1174 	}
1175 	if (anysetkey || needreset)
1176 		error = ENETRESET;
1177 	return error;
1178 }
1179 
1180 static int
1181 an_set_nwkey_eap(struct an_softc *sc, struct ieee80211_nwkey *nwkey)
1182 {
1183 	int i, error, len;
1184 	struct ifnet *ifp = &sc->sc_if;
1185 	struct an_rid_leapkey *key;
1186 	u_int16_t unibuf[sizeof(key->an_key)];
1187 	static const int leap_rid[] = { AN_RID_LEAP_PASS, AN_RID_LEAP_USER };
1188 	MD4_CTX ctx;
1189 
1190 	error = 0;
1191 
1192 	if (nwkey->i_key[0].i_keydat == NULL &&
1193 	    nwkey->i_key[1].i_keydat == NULL)
1194 		return 0;
1195 	if (!sc->sc_enabled)
1196 		return ENXIO;
1197 	an_cmd(sc, AN_CMD_DISABLE, 0);
1198 	key = &sc->sc_buf.sc_leapkey;
1199 	for (i = 0; i < 2; i++) {
1200 		if (nwkey->i_key[i].i_keydat == NULL)
1201 			continue;
1202 		len = nwkey->i_key[i].i_keylen;
1203 		if (len > sizeof(key->an_key))
1204 			return EINVAL;
1205 		memset(key, 0, sizeof(*key));
1206 		key->an_key_len = htole16(len);
1207 		if ((error = copyin(nwkey->i_key[i].i_keydat, key->an_key,
1208 		    len)) != 0)
1209 			return error;
1210 		if (i == 1) {
1211 			/*
1212 			 * Cisco seems to use PasswordHash and PasswordHashHash
1213 			 * in RFC-2759 (MS-CHAP-V2).
1214 			 */
1215 			memset(unibuf, 0, sizeof(unibuf));
1216 			/* XXX: convert password to unicode */
1217 			for (i = 0; i < len; i++)
1218 				unibuf[i] = key->an_key[i];
1219 			/* set PasswordHash */
1220 			MD4Init(&ctx);
1221 			MD4Update(&ctx, (u_int8_t *)unibuf, len * 2);
1222 			MD4Final(key->an_key, &ctx);
1223 			/* set PasswordHashHash */
1224 			MD4Init(&ctx);
1225 			MD4Update(&ctx, key->an_key, 16);
1226 			MD4Final(key->an_key + 16, &ctx);
1227 			key->an_key_len = htole16(32);
1228 		}
1229 		if ((error = an_write_rid(sc, leap_rid[i], key,
1230 		    sizeof(*key))) != 0) {
1231 			printf("%s: LEAP set failed\n", ifp->if_xname);
1232 			return error;
1233 		}
1234 	}
1235 	error = an_cmd(sc, AN_CMD_ENABLE, 0);
1236 	if (error)
1237 		printf("%s: an_set_nwkey: failed to enable MAC\n",
1238 		    ifp->if_xname);
1239 	else
1240 		error = ENETRESET;
1241 	return error;
1242 }
1243 
1244 static int
1245 an_get_nwkey(struct an_softc *sc, struct ieee80211_nwkey *nwkey)
1246 {
1247 	int i, error;
1248 
1249 	error = 0;
1250 	if (sc->sc_config.an_authtype & AN_AUTHTYPE_LEAP)
1251 		nwkey->i_wepon = IEEE80211_NWKEY_EAP;
1252 	else if (sc->sc_config.an_authtype & AN_AUTHTYPE_PRIVACY_IN_USE)
1253 		nwkey->i_wepon = IEEE80211_NWKEY_WEP;
1254 	else
1255 		nwkey->i_wepon = IEEE80211_NWKEY_OPEN;
1256 	if (sc->sc_tx_key == -1)
1257 		nwkey->i_defkid = sc->sc_tx_perskey + 1;
1258 	else
1259 		nwkey->i_defkid = sc->sc_tx_key + 1;
1260 	if (nwkey->i_key[0].i_keydat == NULL)
1261 		return 0;
1262 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
1263 		if (nwkey->i_key[i].i_keydat == NULL)
1264 			continue;
1265 		/* do not show any keys to non-root user */
1266 		if ((error = kauth_authorize_generic(curlwp->l_cred,
1267 		    KAUTH_GENERIC_ISSUSER, NULL)) != 0)
1268 			break;
1269 		nwkey->i_key[i].i_keylen = sc->sc_wepkeys[i].an_wep_keylen;
1270 		if (nwkey->i_key[i].i_keylen < 0) {
1271 			if (sc->sc_perskeylen[i] == 0)
1272 				nwkey->i_key[i].i_keylen = 0;
1273 			continue;
1274 		}
1275 		if ((error = copyout(sc->sc_wepkeys[i].an_wep_key,
1276 		    nwkey->i_key[i].i_keydat,
1277 		    sc->sc_wepkeys[i].an_wep_keylen)) != 0)
1278 			break;
1279 	}
1280 	return error;
1281 }
1282 
1283 static int
1284 an_write_wepkey(struct an_softc *sc, int type, struct an_wepkey *keys, int kid)
1285 {
1286 	int i, error;
1287 	struct an_rid_wepkey *akey;
1288 
1289 	error = 0;
1290 	akey = &sc->sc_buf.sc_wepkey;
1291 	memset(akey, 0, sizeof(struct an_rid_wepkey));
1292 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
1293 		if (keys[i].an_wep_keylen < 0 ||
1294 		    keys[i].an_wep_keylen > sizeof(akey->an_key))
1295 			continue;
1296 		akey->an_key_len = htole16(keys[i].an_wep_keylen);
1297 		akey->an_key_index = htole16(i);
1298 		akey->an_mac_addr[0] = 1;	/* default mac */
1299 		memcpy(akey->an_key, keys[i].an_wep_key, keys[i].an_wep_keylen);
1300 		if ((error = an_write_rid(sc, type, akey, sizeof(*akey))) != 0)
1301 			return error;
1302 	}
1303 	if (kid >= 0) {
1304 		akey->an_key_index = htole16(0xffff);
1305 		akey->an_mac_addr[0] = kid;
1306 		akey->an_key_len = htole16(0);
1307 		memset(akey->an_key, 0, sizeof(akey->an_key));
1308 		error = an_write_rid(sc, type, akey, sizeof(*akey));
1309 	}
1310 	return error;
1311 }
1312 
1313 #ifdef AN_DEBUG
1314 static void
1315 an_dump_pkt(const char *devname, struct mbuf *m)
1316 {
1317 	int col, col0, i;
1318 	uint8_t *pkt = mtod(m, uint8_t *);
1319 	const char *delim = "";
1320 	int delimw = 0;
1321 
1322 	printf("%s: pkt ", devname);
1323 	col = col0 = strlen(devname) + strlen(": pkt ");
1324 	for (i = 0; i < m->m_len; i++) {
1325 		printf("%s%02x", delim, pkt[i]);
1326 		delim = ":";
1327 		delimw = 1;
1328 		col += delimw + 2;
1329 		if (col >= 72) {
1330 			printf("\n%*s", col0, "");
1331 			col = col0;
1332 			delim = "";
1333 			delimw = 0;
1334 		}
1335 	}
1336 	if (col != 0)
1337 		printf("\n");
1338 }
1339 #endif /* AN_DEBUG */
1340 
1341 /*
1342  * Low level functions
1343  */
1344 
1345 static void
1346 an_rx_intr(struct an_softc *sc)
1347 {
1348 	struct ieee80211com *ic = &sc->sc_ic;
1349 	struct ifnet *ifp = &sc->sc_if;
1350 	struct ieee80211_frame_min *wh;
1351 	struct ieee80211_node *ni;
1352 	struct an_rxframe frmhdr;
1353 	struct mbuf *m;
1354 	u_int16_t status;
1355 	int fid, gaplen, len, off;
1356 	uint8_t *gap;
1357 
1358 	fid = CSR_READ_2(sc, AN_RX_FID);
1359 
1360 	/* First read in the frame header */
1361 	if (an_read_bap(sc, fid, 0, &frmhdr, sizeof(frmhdr)) != 0) {
1362 		CSR_WRITE_2(sc, AN_EVENT_ACK, AN_EV_RX);
1363 		ifp->if_ierrors++;
1364 		DPRINTF(("an_rx_intr: read fid %x failed\n", fid));
1365 		return;
1366 	}
1367 
1368 #ifdef AN_DEBUG
1369 	if ((ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) == (IFF_DEBUG|IFF_LINK2)) {
1370 		ieee80211_dump_pkt((u_int8_t *)&frmhdr.an_whdr,
1371 		    sizeof(struct ieee80211_frame), frmhdr.an_rx_rate,
1372 		    frmhdr.an_rx_signal_strength);
1373 		printf(" time 0x%x status 0x%x plen %u chan %u"
1374 		    " plcp %02x %02x %02x %02x gap %u\n",
1375 		    le32toh(frmhdr.an_rx_time), le16toh(frmhdr.an_rx_status),
1376 		    le16toh(frmhdr.an_rx_payload_len), frmhdr.an_rx_chan,
1377 		    frmhdr.an_plcp_hdr[0], frmhdr.an_plcp_hdr[1],
1378 		    frmhdr.an_plcp_hdr[2], frmhdr.an_plcp_hdr[3],
1379 		    le16toh(frmhdr.an_gaplen));
1380 	}
1381 #endif
1382 
1383 	status = le16toh(frmhdr.an_rx_status);
1384 	if ((status & AN_STAT_ERRSTAT) != 0 &&
1385 	    ic->ic_opmode != IEEE80211_M_MONITOR) {
1386 		CSR_WRITE_2(sc, AN_EVENT_ACK, AN_EV_RX);
1387 		ifp->if_ierrors++;
1388 		DPRINTF(("an_rx_intr: fid %x status %x\n", fid, status));
1389 		return;
1390 	}
1391 
1392 	/* the payload length field includes a 16-bit "mystery field" */
1393 	len = le16toh(frmhdr.an_rx_payload_len) - sizeof(uint16_t);
1394 	off = ALIGN(sizeof(struct ieee80211_frame));
1395 
1396 	if (off + len > MCLBYTES) {
1397 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
1398 			CSR_WRITE_2(sc, AN_EVENT_ACK, AN_EV_RX);
1399 			ifp->if_ierrors++;
1400 			DPRINTF(("an_rx_intr: oversized packet %d\n", len));
1401 			return;
1402 		}
1403 		len = 0;
1404 	}
1405 
1406 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1407 	if (m == NULL) {
1408 		CSR_WRITE_2(sc, AN_EVENT_ACK, AN_EV_RX);
1409 		ifp->if_ierrors++;
1410 		DPRINTF(("an_rx_intr: MGET failed\n"));
1411 		return;
1412 	}
1413 	if (off + len + AN_GAPLEN_MAX > MHLEN) {
1414 		MCLGET(m, M_DONTWAIT);
1415 		if ((m->m_flags & M_EXT) == 0) {
1416 			CSR_WRITE_2(sc, AN_EVENT_ACK, AN_EV_RX);
1417 			m_freem(m);
1418 			ifp->if_ierrors++;
1419 			DPRINTF(("an_rx_intr: MCLGET failed\n"));
1420 			return;
1421 		}
1422 	}
1423 	m->m_data += off - sizeof(struct ieee80211_frame);
1424 
1425 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
1426 		gaplen = le16toh(frmhdr.an_gaplen);
1427 		if (gaplen > AN_GAPLEN_MAX) {
1428 			CSR_WRITE_2(sc, AN_EVENT_ACK, AN_EV_RX);
1429 			m_freem(m);
1430 			ifp->if_ierrors++;
1431 			DPRINTF(("%s: gap too long\n", __func__));
1432 			return;
1433 		}
1434 		/*
1435 		 * We don't need the 16-bit mystery field (payload length?),
1436 		 * so read it into the region reserved for the 802.11 header.
1437 		 *
1438 		 * When Cisco Aironet 350 cards w/ firmware version 5 or
1439 		 * greater operate with certain Cisco 350 APs,
1440 		 * the "gap" is filled with the SNAP header.  Read
1441 		 * it in after the 802.11 header.
1442 		 */
1443 		gap = m->m_data + sizeof(struct ieee80211_frame) -
1444 		    sizeof(uint16_t);
1445 		an_read_bap(sc, fid, -1, gap, gaplen + sizeof(u_int16_t));
1446 #ifdef AN_DEBUG
1447 		if ((ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==
1448 		    (IFF_DEBUG|IFF_LINK2)) {
1449 			int i;
1450 			printf(" gap&len");
1451 			for (i = 0; i < gaplen + sizeof(u_int16_t); i++)
1452 				printf(" %02x", gap[i]);
1453 			printf("\n");
1454 		}
1455 #endif
1456 	} else
1457 		gaplen = 0;
1458 
1459 	an_read_bap(sc, fid, -1,
1460 	    m->m_data + sizeof(struct ieee80211_frame) + gaplen, len);
1461 	m->m_pkthdr.len = m->m_len = sizeof(struct ieee80211_frame) + gaplen +
1462 	    len;
1463 
1464 	memcpy(m->m_data, &frmhdr.an_whdr, sizeof(struct ieee80211_frame));
1465 	m->m_pkthdr.rcvif = ifp;
1466 	CSR_WRITE_2(sc, AN_EVENT_ACK, AN_EV_RX);
1467 
1468 #if NBPFILTER > 0
1469 	if (sc->sc_drvbpf) {
1470 		struct an_rx_radiotap_header *tap = &sc->sc_rxtap;
1471 
1472 		tap->ar_rate = frmhdr.an_rx_rate;
1473 		tap->ar_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
1474 		tap->ar_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
1475 		tap->ar_antsignal = frmhdr.an_rx_signal_strength;
1476 		if ((le16toh(frmhdr.an_rx_status) & AN_STAT_BADCRC) ||
1477 		    (le16toh(frmhdr.an_rx_status) & AN_STAT_ERRSTAT) ||
1478 		    (le16toh(frmhdr.an_rx_status) & AN_STAT_UNDECRYPTABLE))
1479 		    tap->ar_flags |= IEEE80211_RADIOTAP_F_BADFCS;
1480 
1481 		bpf_mtap2(sc->sc_drvbpf, tap, tap->ar_ihdr.it_len, m);
1482 	}
1483 #endif
1484 	wh = mtod(m, struct ieee80211_frame_min *);
1485 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1486 		/*
1487 		 * WEP is decrypted by hardware. Clear WEP bit
1488 		 * header for ieee80211_input().
1489 		 */
1490 		wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
1491 	}
1492 
1493 #ifdef AN_DEBUG
1494 	if (an_debug > 1)
1495 		an_dump_pkt(device_xname(sc->sc_dev), m);
1496 #endif /* AN_DEBUG */
1497 
1498 	ni = ieee80211_find_rxnode(ic, wh);
1499 	ieee80211_input(ic, m, ni, frmhdr.an_rx_signal_strength,
1500 	    le32toh(frmhdr.an_rx_time));
1501 	ieee80211_free_node(ni);
1502 }
1503 
1504 static void
1505 an_tx_intr(struct an_softc *sc, int status)
1506 {
1507 	struct ifnet *ifp = &sc->sc_if;
1508 	int cur, fid;
1509 
1510 	sc->sc_tx_timer = 0;
1511 	ifp->if_flags &= ~IFF_OACTIVE;
1512 
1513 	fid = CSR_READ_2(sc, AN_TX_CMP_FID);
1514 	CSR_WRITE_2(sc, AN_EVENT_ACK, status & (AN_EV_TX | AN_EV_TX_EXC));
1515 
1516 	if (status & AN_EV_TX_EXC)
1517 		ifp->if_oerrors++;
1518 	else
1519 		ifp->if_opackets++;
1520 
1521 	cur = sc->sc_txcur;
1522 	if (sc->sc_txd[cur].d_fid == fid) {
1523 		sc->sc_txd[cur].d_inuse = 0;
1524 		DPRINTF2(("an_tx_intr: sent %x/%d\n", fid, cur));
1525 		AN_INC(cur, AN_TX_RING_CNT);
1526 		sc->sc_txcur = cur;
1527 	} else {
1528 		for (cur = 0; cur < AN_TX_RING_CNT; cur++) {
1529 			if (fid == sc->sc_txd[cur].d_fid) {
1530 				sc->sc_txd[cur].d_inuse = 0;
1531 				break;
1532 			}
1533 		}
1534 		if (ifp->if_flags & IFF_DEBUG)
1535 			printf("%s: tx mismatch: "
1536 			    "expected %x(%d), actual %x(%d)\n",
1537 			    device_xname(sc->sc_dev),
1538 			    sc->sc_txd[sc->sc_txcur].d_fid, sc->sc_txcur,
1539 			    fid, cur);
1540 	}
1541 
1542 	return;
1543 }
1544 
1545 static void
1546 an_linkstat_intr(struct an_softc *sc)
1547 {
1548 	struct ieee80211com *ic = &sc->sc_ic;
1549 	u_int16_t status;
1550 
1551 	status = CSR_READ_2(sc, AN_LINKSTAT);
1552 	CSR_WRITE_2(sc, AN_EVENT_ACK, AN_EV_LINKSTAT);
1553 	DPRINTF(("an_linkstat_intr: status 0x%x\n", status));
1554 
1555 	if (status == AN_LINKSTAT_ASSOCIATED) {
1556 		if (ic->ic_state != IEEE80211_S_RUN ||
1557 		    ic->ic_opmode == IEEE80211_M_IBSS)
1558 			ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
1559 	} else {
1560 		if (ic->ic_opmode == IEEE80211_M_STA)
1561 			ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
1562 	}
1563 }
1564 
1565 /* Must be called at proper protection level! */
1566 static int
1567 an_cmd(struct an_softc *sc, int cmd, int val)
1568 {
1569 	int i, status;
1570 
1571 	/* make sure that previous command completed */
1572 	if (CSR_READ_2(sc, AN_COMMAND) & AN_CMD_BUSY) {
1573 		if (sc->sc_if.if_flags & IFF_DEBUG)
1574 			printf("%s: command 0x%x busy\n", device_xname(sc->sc_dev),
1575 			    CSR_READ_2(sc, AN_COMMAND));
1576 		CSR_WRITE_2(sc, AN_EVENT_ACK, AN_EV_CLR_STUCK_BUSY);
1577 	}
1578 
1579 	CSR_WRITE_2(sc, AN_PARAM0, val);
1580 	CSR_WRITE_2(sc, AN_PARAM1, 0);
1581 	CSR_WRITE_2(sc, AN_PARAM2, 0);
1582 	CSR_WRITE_2(sc, AN_COMMAND, cmd);
1583 
1584 	if (cmd == AN_CMD_FW_RESTART) {
1585 		/* XXX: should sleep here */
1586 		DELAY(100*1000);
1587 	}
1588 
1589 	for (i = 0; i < AN_TIMEOUT; i++) {
1590 		if (CSR_READ_2(sc, AN_EVENT_STAT) & AN_EV_CMD)
1591 			break;
1592 		DELAY(10);
1593 	}
1594 
1595 	status = CSR_READ_2(sc, AN_STATUS);
1596 
1597 	/* clear stuck command busy if necessary */
1598 	if (CSR_READ_2(sc, AN_COMMAND) & AN_CMD_BUSY)
1599 		CSR_WRITE_2(sc, AN_EVENT_ACK, AN_EV_CLR_STUCK_BUSY);
1600 
1601 	/* Ack the command */
1602 	CSR_WRITE_2(sc, AN_EVENT_ACK, AN_EV_CMD);
1603 
1604 	if (i == AN_TIMEOUT) {
1605 		if (sc->sc_if.if_flags & IFF_DEBUG)
1606 			printf("%s: command 0x%x param 0x%x timeout\n",
1607 			    device_xname(sc->sc_dev), cmd, val);
1608 		return ETIMEDOUT;
1609 	}
1610 	if (status & AN_STAT_CMD_RESULT) {
1611 		if (sc->sc_if.if_flags & IFF_DEBUG)
1612 			printf("%s: command 0x%x param 0x%x status 0x%x "
1613 			    "resp 0x%x 0x%x 0x%x\n",
1614 			    device_xname(sc->sc_dev), cmd, val, status,
1615 			    CSR_READ_2(sc, AN_RESP0), CSR_READ_2(sc, AN_RESP1),
1616 			    CSR_READ_2(sc, AN_RESP2));
1617 		return EIO;
1618 	}
1619 
1620 	return 0;
1621 }
1622 
1623 
1624 /*
1625  * Wait for firmware come up after power enabled.
1626  */
1627 static void
1628 an_wait(struct an_softc *sc)
1629 {
1630 	int i;
1631 
1632 	CSR_WRITE_2(sc, AN_COMMAND, AN_CMD_NOOP2);
1633 	for (i = 0; i < 3*hz; i++) {
1634 		if (CSR_READ_2(sc, AN_EVENT_STAT) & AN_EV_CMD)
1635 			break;
1636 		(void)tsleep(sc, PWAIT, "anatch", 1);
1637 	}
1638 	CSR_WRITE_2(sc, AN_EVENT_ACK, AN_EV_CMD);
1639 }
1640 
1641 static int
1642 an_seek_bap(struct an_softc *sc, int id, int off)
1643 {
1644 	int i, status;
1645 
1646 	CSR_WRITE_2(sc, AN_SEL0, id);
1647 	CSR_WRITE_2(sc, AN_OFF0, off);
1648 
1649 	for (i = 0; ; i++) {
1650 		status = CSR_READ_2(sc, AN_OFF0);
1651 		if ((status & AN_OFF_BUSY) == 0)
1652 			break;
1653 		if (i == AN_TIMEOUT) {
1654 			printf("%s: timeout in an_seek_bap to 0x%x/0x%x\n",
1655 			    device_xname(sc->sc_dev), id, off);
1656 			sc->sc_bap_off = AN_OFF_ERR;	/* invalidate */
1657 			return ETIMEDOUT;
1658 		}
1659 		DELAY(10);
1660 	}
1661 	if (status & AN_OFF_ERR) {
1662 		aprint_error_dev(sc->sc_dev, "failed in an_seek_bap to 0x%x/0x%x\n",
1663 		    id, off);
1664 		sc->sc_bap_off = AN_OFF_ERR;	/* invalidate */
1665 		return EIO;
1666 	}
1667 	sc->sc_bap_id = id;
1668 	sc->sc_bap_off = off;
1669 	return 0;
1670 }
1671 
1672 static int
1673 an_read_bap(struct an_softc *sc, int id, int off, void *buf, int buflen)
1674 {
1675 	int error, cnt;
1676 
1677 	if (buflen == 0)
1678 		return 0;
1679 	if (off == -1)
1680 		off = sc->sc_bap_off;
1681 	if (id != sc->sc_bap_id || off != sc->sc_bap_off) {
1682 		if ((error = an_seek_bap(sc, id, off)) != 0)
1683 			return EIO;
1684 	}
1685 
1686 	cnt = (buflen + 1) / 2;
1687 	CSR_READ_MULTI_STREAM_2(sc, AN_DATA0, (u_int16_t *)buf, cnt);
1688 	sc->sc_bap_off += cnt * 2;
1689 	return 0;
1690 }
1691 
1692 static int
1693 an_write_bap(struct an_softc *sc, int id, int off, void *buf, int buflen)
1694 {
1695 	int error, cnt;
1696 
1697 	if (buflen == 0)
1698 		return 0;
1699 	if (off == -1)
1700 		off = sc->sc_bap_off;
1701 	if (id != sc->sc_bap_id || off != sc->sc_bap_off) {
1702 		if ((error = an_seek_bap(sc, id, off)) != 0)
1703 			return EIO;
1704 	}
1705 
1706 	cnt = (buflen + 1) / 2;
1707 	CSR_WRITE_MULTI_STREAM_2(sc, AN_DATA0, (u_int16_t *)buf, cnt);
1708 	sc->sc_bap_off += cnt * 2;
1709 	return 0;
1710 }
1711 
1712 static int
1713 an_mwrite_bap(struct an_softc *sc, int id, int off, struct mbuf *m, int totlen)
1714 {
1715 	int error, len, cnt;
1716 
1717 	if (off == -1)
1718 		off = sc->sc_bap_off;
1719 	if (id != sc->sc_bap_id || off != sc->sc_bap_off) {
1720 		if ((error = an_seek_bap(sc, id, off)) != 0)
1721 			return EIO;
1722 	}
1723 
1724 	for (len = 0; m != NULL; m = m->m_next) {
1725 		if (m->m_len == 0)
1726 			continue;
1727 		len = min(m->m_len, totlen);
1728 
1729 		if ((mtod(m, u_long) & 0x1) || (len & 0x1)) {
1730 			m_copydata(m, 0, totlen, (void *)&sc->sc_buf.sc_txbuf);
1731 			cnt = (totlen + 1) / 2;
1732 			CSR_WRITE_MULTI_STREAM_2(sc, AN_DATA0,
1733 			    sc->sc_buf.sc_val, cnt);
1734 			off += cnt * 2;
1735 			break;
1736 		}
1737 		cnt = len / 2;
1738 		CSR_WRITE_MULTI_STREAM_2(sc, AN_DATA0, mtod(m, u_int16_t *),
1739 		    cnt);
1740 		off += len;
1741 		totlen -= len;
1742 	}
1743 	sc->sc_bap_off = off;
1744 	return 0;
1745 }
1746 
1747 static int
1748 an_alloc_fid(struct an_softc *sc, int len, int *idp)
1749 {
1750 	int i;
1751 
1752 	if (an_cmd(sc, AN_CMD_ALLOC_MEM, len)) {
1753 		aprint_error_dev(sc->sc_dev, "failed to allocate %d bytes on NIC\n",
1754 		    len);
1755 		return ENOMEM;
1756 	}
1757 
1758 	for (i = 0; i < AN_TIMEOUT; i++) {
1759 		if (CSR_READ_2(sc, AN_EVENT_STAT) & AN_EV_ALLOC)
1760 			break;
1761 		if (i == AN_TIMEOUT) {
1762 			printf("%s: timeout in alloc\n", device_xname(sc->sc_dev));
1763 			return ETIMEDOUT;
1764 		}
1765 		DELAY(10);
1766 	}
1767 
1768 	*idp = CSR_READ_2(sc, AN_ALLOC_FID);
1769 	CSR_WRITE_2(sc, AN_EVENT_ACK, AN_EV_ALLOC);
1770 	return 0;
1771 }
1772 
1773 static int
1774 an_read_rid(struct an_softc *sc, int rid, void *buf, int *buflenp)
1775 {
1776 	int error;
1777 	u_int16_t len;
1778 
1779 	/* Tell the NIC to enter record read mode. */
1780 	error = an_cmd(sc, AN_CMD_ACCESS | AN_ACCESS_READ, rid);
1781 	if (error)
1782 		return error;
1783 
1784 	/* length in byte, including length itself */
1785 	error = an_read_bap(sc, rid, 0, &len, sizeof(len));
1786 	if (error)
1787 		return error;
1788 
1789 	len = le16toh(len) - 2;
1790 	if (*buflenp < len) {
1791 		aprint_error_dev(sc->sc_dev, "record buffer is too small, "
1792 		    "rid=%x, size=%d, len=%d\n",
1793 		    rid, *buflenp, len);
1794 		return ENOSPC;
1795 	}
1796 	*buflenp = len;
1797 	return an_read_bap(sc, rid, sizeof(len), buf, len);
1798 }
1799 
1800 static int
1801 an_write_rid(struct an_softc *sc, int rid, void *buf, int buflen)
1802 {
1803 	int error;
1804 	u_int16_t len;
1805 
1806 	/* length in byte, including length itself */
1807 	len = htole16(buflen + 2);
1808 
1809 	error = an_write_bap(sc, rid, 0, &len, sizeof(len));
1810 	if (error)
1811 		return error;
1812 	error = an_write_bap(sc, rid, sizeof(len), buf, buflen);
1813 	if (error)
1814 		return error;
1815 
1816 	return an_cmd(sc, AN_CMD_ACCESS | AN_ACCESS_WRITE, rid);
1817 }
1818 
1819 static int
1820 an_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
1821 {
1822 	struct an_softc *sc = (struct an_softc *)ic->ic_ifp->if_softc;
1823 	struct ieee80211_node *ni = ic->ic_bss;
1824 	enum ieee80211_state ostate;
1825 	int buflen;
1826 
1827 	ostate = ic->ic_state;
1828 	DPRINTF(("an_newstate: %s -> %s\n", ieee80211_state_name[ostate],
1829 	    ieee80211_state_name[nstate]));
1830 
1831 	switch (nstate) {
1832 	case IEEE80211_S_INIT:
1833 		ic->ic_flags &= ~IEEE80211_F_IBSSON;
1834 		return (*sc->sc_newstate)(ic, nstate, arg);
1835 
1836 	case IEEE80211_S_SCAN:
1837 	case IEEE80211_S_AUTH:
1838 	case IEEE80211_S_ASSOC:
1839 		ic->ic_state = nstate; /* NB: skip normal ieee80211 handling */
1840 		return 0;
1841 
1842 	case IEEE80211_S_RUN:
1843 		buflen = sizeof(sc->sc_buf);
1844 		an_read_rid(sc, AN_RID_STATUS, &sc->sc_buf, &buflen);
1845 		IEEE80211_ADDR_COPY(ni->ni_bssid,
1846 		    sc->sc_buf.sc_status.an_cur_bssid);
1847 		IEEE80211_ADDR_COPY(ni->ni_macaddr, ni->ni_bssid);
1848 		ni->ni_chan = &ic->ic_channels[
1849 		    le16toh(sc->sc_buf.sc_status.an_cur_channel)];
1850 		ni->ni_esslen = le16toh(sc->sc_buf.sc_status.an_ssidlen);
1851 		if (ni->ni_esslen > IEEE80211_NWID_LEN)
1852 			ni->ni_esslen = IEEE80211_NWID_LEN;	/*XXX*/
1853 		memcpy(ni->ni_essid, sc->sc_buf.sc_status.an_ssid,
1854 		    ni->ni_esslen);
1855 		ni->ni_rates = ic->ic_sup_rates[IEEE80211_MODE_11B];	/*XXX*/
1856 		if (ic->ic_ifp->if_flags & IFF_DEBUG) {
1857 			printf("%s: ", device_xname(sc->sc_dev));
1858 			if (ic->ic_opmode == IEEE80211_M_STA)
1859 				printf("associated ");
1860 			else
1861 				printf("synchronized ");
1862 			printf("with %s ssid ", ether_sprintf(ni->ni_bssid));
1863 			ieee80211_print_essid(ni->ni_essid, ni->ni_esslen);
1864 			printf(" channel %u start %uMb\n",
1865 			    le16toh(sc->sc_buf.sc_status.an_cur_channel),
1866 			    le16toh(sc->sc_buf.sc_status.an_current_tx_rate)/2);
1867 		}
1868 		break;
1869 
1870 	default:
1871 		break;
1872 	}
1873 	return (*sc->sc_newstate)(ic, nstate, arg);
1874 }
1875