1/* $NetBSD: an.c,v 1.63 2016/06/10 13:27:13 ozaki-r Exp $ */
2/*
3 * Copyright (c) 1997, 1998, 1999
4 * Bill Paul <wpaul@ctr.columbia.edu>. All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * 3. All advertising materials mentioning features or use of this software
15 * must display the following acknowledgement:
16 * This product includes software developed by Bill Paul.
17 * 4. Neither the name of the author nor the names of any co-contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
25 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
26 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
27 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
28 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
29 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
30 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
31 * THE POSSIBILITY OF SUCH DAMAGE.
32 *
33 * $FreeBSD: src/sys/dev/an/if_an.c,v 1.12 2000/11/13 23:04:12 wpaul Exp $
34 */
35/*
36 * Copyright (c) 2004, 2005 David Young. All rights reserved.
37 * Copyright (c) 2004, 2005 OJC Technologies. All rights reserved.
38 * Copyright (c) 2004, 2005 Dayton Data Center Services, LLC. All
39 * rights reserved.
40 *
41 * Redistribution and use in source and binary forms, with or without
42 * modification, are permitted provided that the following conditions
43 * are met:
44 * 1. Redistributions of source code must retain the above copyright
45 * notice, this list of conditions and the following disclaimer.
46 * 2. Redistributions in binary form must reproduce the above copyright
47 * notice, this list of conditions and the following disclaimer in the
48 * documentation and/or other materials provided with the distribution.
49 * 3. Neither the name of the author nor the names of any co-contributors
50 * may be used to endorse or promote products derived from this software
51 * without specific prior written permission.
52 *
53 * THIS SOFTWARE IS PROVIDED BY David Young AND CONTRIBUTORS ``AS IS'' AND
54 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
55 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
56 * ARE DISCLAIMED. IN NO EVENT SHALL David Young AND CONTRIBUTORS
57 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
58 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
59 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
60 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
61 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
62 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
63 * THE POSSIBILITY OF SUCH DAMAGE.
64 */
65
66/*
67 * Aironet 4500/4800 802.11 PCMCIA/ISA/PCI driver for FreeBSD.
68 *
69 * Written by Bill Paul <wpaul@ctr.columbia.edu>
70 * Electrical Engineering Department
71 * Columbia University, New York City
72 */
73
74/*
75 * Ported to NetBSD from FreeBSD by Atsushi Onoe at the San Diego
76 * IETF meeting.
77 */
78
79#include <sys/cdefs.h>
80__KERNEL_RCSID(0, "$NetBSD: an.c,v 1.63 2016/06/10 13:27:13 ozaki-r Exp $");
81
82
83#include <sys/param.h>
84#include <sys/callout.h>
85#include <sys/sysctl.h>
86#include <sys/systm.h>
87#include <sys/sockio.h>
88#include <sys/mbuf.h>
89#include <sys/kernel.h>
90#include <sys/ucred.h>
91#include <sys/socket.h>
92#include <sys/device.h>
93#include <sys/proc.h>
94#include <sys/md4.h>
95#include <sys/endian.h>
96#include <sys/kauth.h>
97
98#include <sys/bus.h>
99
100#include <net/if.h>
101#include <net/if_dl.h>
102#include <net/if_ether.h>
103#include <net/if_llc.h>
104#include <net/if_media.h>
105#include <net/if_types.h>
106
107#include <net80211/ieee80211_netbsd.h>
108#include <net80211/ieee80211_var.h>
109#include <net80211/ieee80211_radiotap.h>
110
111#include <net/bpf.h>
112#include <net/bpfdesc.h>
113
114#include <dev/ic/anreg.h>
115#include <dev/ic/anvar.h>
116
117static int an_reset(struct an_softc *);
118static void an_wait(struct an_softc *);
119static int an_init(struct ifnet *);
120static void an_stop(struct ifnet *, int);
121static void an_start(struct ifnet *);
122static void an_watchdog(struct ifnet *);
123static int an_ioctl(struct ifnet *, u_long, void *);
124static int an_media_change(struct ifnet *);
125static void an_media_status(struct ifnet *, struct ifmediareq *);
126
127static int an_set_nwkey(struct an_softc *, struct ieee80211_nwkey *);
128static int an_set_nwkey_wep(struct an_softc *, struct ieee80211_nwkey *);
129static int an_set_nwkey_eap(struct an_softc *, struct ieee80211_nwkey *);
130static int an_get_nwkey(struct an_softc *, struct ieee80211_nwkey *);
131static int an_write_wepkey(struct an_softc *, int, struct an_wepkey *,
132 int);
133
134static void an_rx_intr(struct an_softc *);
135static void an_tx_intr(struct an_softc *, int);
136static void an_linkstat_intr(struct an_softc *);
137
138static int an_cmd(struct an_softc *, int, int);
139static int an_seek_bap(struct an_softc *, int, int);
140static int an_read_bap(struct an_softc *, int, int, void *, int);
141static int an_write_bap(struct an_softc *, int, int, void *, int);
142static int an_mwrite_bap(struct an_softc *, int, int, struct mbuf *, int);
143static int an_read_rid(struct an_softc *, int, void *, int *);
144static int an_write_rid(struct an_softc *, int, void *, int);
145
146static int an_alloc_fid(struct an_softc *, int, int *);
147
148static int an_newstate(struct ieee80211com *, enum ieee80211_state, int);
149
150#ifdef AN_DEBUG
151int an_debug = 0;
152
153#define DPRINTF(X) if (an_debug) printf X
154#define DPRINTF2(X) if (an_debug > 1) printf X
155static int an_sysctl_verify(SYSCTLFN_PROTO, int lower, int upper);
156static int an_sysctl_verify_debug(SYSCTLFN_PROTO);
157#else
158#define DPRINTF(X)
159#define DPRINTF2(X)
160#endif
161
162int
163an_attach(struct an_softc *sc)
164{
165 struct ieee80211com *ic = &sc->sc_ic;
166 struct ifnet *ifp = &sc->sc_if;
167 int i, s;
168 struct an_rid_wepkey *akey;
169 int buflen, kid, rid;
170 int chan, chan_min, chan_max;
171
172 s = splnet();
173
174 an_wait(sc);
175 if (an_reset(sc) != 0) {
176 config_deactivate(sc->sc_dev);
177 splx(s);
178 return 1;
179 }
180
181 /* Load factory config */
182 if (an_cmd(sc, AN_CMD_READCFG, 0) != 0) {
183 splx(s);
184 aprint_error_dev(sc->sc_dev, "failed to load config data\n");
185 return 1;
186 }
187
188 /* Read the current configuration */
189 buflen = sizeof(sc->sc_config);
190 if (an_read_rid(sc, AN_RID_GENCONFIG, &sc->sc_config, &buflen) != 0) {
191 splx(s);
192 aprint_error_dev(sc->sc_dev, "read config failed\n");
193 return 1;
194 }
195
196 /* Read the card capabilities */
197 buflen = sizeof(sc->sc_caps);
198 if (an_read_rid(sc, AN_RID_CAPABILITIES, &sc->sc_caps, &buflen) != 0) {
199 splx(s);
200 aprint_error_dev(sc->sc_dev, "read caps failed\n");
201 return 1;
202 }
203
204#ifdef AN_DEBUG
205 if (an_debug) {
206 static const int dumprid[] = {
207 AN_RID_GENCONFIG, AN_RID_CAPABILITIES, AN_RID_SSIDLIST,
208 AN_RID_APLIST, AN_RID_STATUS, AN_RID_ENCAP
209 };
210
211 for (rid = 0; rid < sizeof(dumprid)/sizeof(dumprid[0]); rid++) {
212 buflen = sizeof(sc->sc_buf);
213 if (an_read_rid(sc, dumprid[rid], &sc->sc_buf, &buflen)
214 != 0)
215 continue;
216 printf("%04x (%d):\n", dumprid[rid], buflen);
217 for (i = 0; i < (buflen + 1) / 2; i++)
218 printf(" %04x", sc->sc_buf.sc_val[i]);
219 printf("\n");
220 }
221 }
222#endif
223
224 /* Read WEP settings from persistent memory */
225 akey = &sc->sc_buf.sc_wepkey;
226 buflen = sizeof(struct an_rid_wepkey);
227 rid = AN_RID_WEP_VOLATILE; /* first persistent key */
228 while (an_read_rid(sc, rid, akey, &buflen) == 0) {
229 kid = le16toh(akey->an_key_index);
230 DPRINTF(("an_attach: wep rid=0x%x len=%d(%zu) index=0x%04x "
231 "mac[0]=%02x keylen=%d\n",
232 rid, buflen, sizeof(*akey), kid,
233 akey->an_mac_addr[0], le16toh(akey->an_key_len)));
234 if (kid == 0xffff) {
235 sc->sc_tx_perskey = akey->an_mac_addr[0];
236 sc->sc_tx_key = -1;
237 break;
238 }
239 if (kid >= IEEE80211_WEP_NKID)
240 break;
241 sc->sc_perskeylen[kid] = le16toh(akey->an_key_len);
242 sc->sc_wepkeys[kid].an_wep_keylen = -1;
243 rid = AN_RID_WEP_PERSISTENT; /* for next key */
244 buflen = sizeof(struct an_rid_wepkey);
245 }
246
247 aprint_normal_dev(sc->sc_dev, "%s %s (firmware %s)\n",
248 sc->sc_caps.an_manufname, sc->sc_caps.an_prodname,
249 sc->sc_caps.an_prodvers);
250
251 memcpy(ifp->if_xname, device_xname(sc->sc_dev), IFNAMSIZ);
252
253 ifp->if_softc = sc;
254 ifp->if_flags = IFF_BROADCAST | IFF_NOTRAILERS | IFF_SIMPLEX |
255 IFF_MULTICAST | IFF_ALLMULTI;
256 ifp->if_ioctl = an_ioctl;
257 ifp->if_start = an_start;
258 ifp->if_init = an_init;
259 ifp->if_stop = an_stop;
260 ifp->if_watchdog = an_watchdog;
261 IFQ_SET_READY(&ifp->if_snd);
262
263 ic->ic_ifp = ifp;
264 ic->ic_phytype = IEEE80211_T_DS;
265 ic->ic_opmode = IEEE80211_M_STA;
266 ic->ic_caps = IEEE80211_C_WEP | IEEE80211_C_PMGT | IEEE80211_C_IBSS |
267 IEEE80211_C_MONITOR;
268 ic->ic_state = IEEE80211_S_INIT;
269 IEEE80211_ADDR_COPY(ic->ic_myaddr, sc->sc_caps.an_oemaddr);
270
271 switch (le16toh(sc->sc_caps.an_regdomain)) {
272 default:
273 case AN_REGDOMAIN_USA:
274 case AN_REGDOMAIN_CANADA:
275 chan_min = 1; chan_max = 11; break;
276 case AN_REGDOMAIN_EUROPE:
277 case AN_REGDOMAIN_AUSTRALIA:
278 chan_min = 1; chan_max = 13; break;
279 case AN_REGDOMAIN_JAPAN:
280 chan_min = 14; chan_max = 14; break;
281 case AN_REGDOMAIN_SPAIN:
282 chan_min = 10; chan_max = 11; break;
283 case AN_REGDOMAIN_FRANCE:
284 chan_min = 10; chan_max = 13; break;
285 case AN_REGDOMAIN_JAPANWIDE:
286 chan_min = 1; chan_max = 14; break;
287 }
288
289 for (chan = chan_min; chan <= chan_max; chan++) {
290 ic->ic_channels[chan].ic_freq =
291 ieee80211_ieee2mhz(chan, IEEE80211_CHAN_2GHZ);
292 ic->ic_channels[chan].ic_flags = IEEE80211_CHAN_B;
293 }
294 ic->ic_ibss_chan = &ic->ic_channels[chan_min];
295
296 aprint_normal("%s: 802.11 address: %s, channel: %d-%d\n",
297 ifp->if_xname, ether_sprintf(ic->ic_myaddr), chan_min, chan_max);
298
299 /* Find supported rate */
300 for (i = 0; i < sizeof(sc->sc_caps.an_rates); i++) {
301 if (sc->sc_caps.an_rates[i] == 0)
302 continue;
303 ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[
304 ic->ic_sup_rates[IEEE80211_MODE_11B].rs_nrates++] =
305 sc->sc_caps.an_rates[i];
306 }
307
308 /*
309 * Call MI attach routine.
310 */
311 if_attach(ifp);
312 ieee80211_ifattach(ic);
313
314 sc->sc_newstate = ic->ic_newstate;
315 ic->ic_newstate = an_newstate;
316
317 ieee80211_media_init(ic, an_media_change, an_media_status);
318
319 /*
320 * radiotap BPF device
321 */
322 bpf_attach2(ifp, DLT_IEEE802_11_RADIO,
323 sizeof(struct ieee80211_frame) + 64, &sc->sc_drvbpf);
324
325 memset(&sc->sc_rxtapu, 0, sizeof(sc->sc_rxtapu));
326 sc->sc_rxtap.ar_ihdr.it_len = htole16(sizeof(sc->sc_rxtapu));
327 sc->sc_rxtap.ar_ihdr.it_present = htole32(AN_RX_RADIOTAP_PRESENT);
328
329 memset(&sc->sc_txtapu, 0, sizeof(sc->sc_txtapu));
330 sc->sc_txtap.at_ihdr.it_len = htole16(sizeof(sc->sc_txtapu));
331 sc->sc_txtap.at_ihdr.it_present = htole32(AN_TX_RADIOTAP_PRESENT);
332
333 sc->sc_attached = 1;
334 splx(s);
335
336 ieee80211_announce(ic);
337 return 0;
338}
339
340#ifdef AN_DEBUG
341/*
342 * Setup sysctl(3) MIB, hw.an.*
343 *
344 * TBD condition CTLFLAG_PERMANENT on being a module or not
345 */
346SYSCTL_SETUP(sysctl_an, "sysctl an(4) subtree setup")
347{
348 int rc;
349 const struct sysctlnode *cnode, *rnode;
350
351 if ((rc = sysctl_createv(clog, 0, NULL, &rnode,
352 CTLFLAG_PERMANENT, CTLTYPE_NODE, "an",
353 "Cisco/Aironet 802.11 controls",
354 NULL, 0, NULL, 0, CTL_HW, CTL_CREATE, CTL_EOL)) != 0)
355 goto err;
356
357 /* control debugging printfs */
358 if ((rc = sysctl_createv(clog, 0, &rnode, &cnode,
359 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
360 "debug", SYSCTL_DESCR("Enable Cisco/Aironet debugging output"),
361 an_sysctl_verify_debug, 0, &an_debug, 0,
362 CTL_CREATE, CTL_EOL)) != 0)
363 goto err;
364
365 return;
366err:
367 printf("%s: sysctl_createv failed (rc = %d)\n", __func__, rc);
368}
369
370static int
371an_sysctl_verify(SYSCTLFN_ARGS, int lower, int upper)
372{
373 int error, t;
374 struct sysctlnode node;
375
376 node = *rnode;
377 t = *(int*)rnode->sysctl_data;
378 node.sysctl_data = &t;
379 error = sysctl_lookup(SYSCTLFN_CALL(&node));
380 if (error || newp == NULL)
381 return (error);
382
383 if (t < lower || t > upper)
384 return (EINVAL);
385
386 *(int*)rnode->sysctl_data = t;
387
388 return (0);
389}
390
391static int
392an_sysctl_verify_debug(SYSCTLFN_ARGS)
393{
394 return an_sysctl_verify(SYSCTLFN_CALL(rnode), 0, 2);
395}
396#endif /* AN_DEBUG */
397
398int
399an_detach(struct an_softc *sc)
400{
401 struct ieee80211com *ic = &sc->sc_ic;
402 struct ifnet *ifp = &sc->sc_if;
403 int s;
404
405 if (!sc->sc_attached)
406 return 0;
407
408 s = splnet();
409 an_stop(ifp, 1);
410 ieee80211_ifdetach(ic);
411 if_detach(ifp);
412 splx(s);
413 return 0;
414}
415
416int
417an_activate(device_t self, enum devact act)
418{
419 struct an_softc *sc = device_private(self);
420
421 switch (act) {
422 case DVACT_DEACTIVATE:
423 if_deactivate(&sc->sc_if);
424 return 0;
425 default:
426 return EOPNOTSUPP;
427 }
428}
429
430int
431an_intr(void *arg)
432{
433 struct an_softc *sc = arg;
434 struct ifnet *ifp = &sc->sc_if;
435 int i;
436 u_int16_t status;
437
438 if (!sc->sc_enabled || !device_is_active(sc->sc_dev) ||
439 (ifp->if_flags & IFF_RUNNING) == 0)
440 return 0;
441
442 if ((ifp->if_flags & IFF_UP) == 0) {
443 CSR_WRITE_2(sc, AN_INT_EN, 0);
444 CSR_WRITE_2(sc, AN_EVENT_ACK, ~0);
445 return 1;
446 }
447
448 /* maximum 10 loops per interrupt */
449 for (i = 0; i < 10; i++) {
450 if (!sc->sc_enabled || !device_is_active(sc->sc_dev))
451 return 1;
452 if (CSR_READ_2(sc, AN_SW0) != AN_MAGIC) {
453 DPRINTF(("an_intr: magic number changed: %x\n",
454 CSR_READ_2(sc, AN_SW0)));
455 config_deactivate(sc->sc_dev);
456 return 1;
457 }
458 status = CSR_READ_2(sc, AN_EVENT_STAT);
459 CSR_WRITE_2(sc, AN_EVENT_ACK, status & ~(AN_INTRS));
460 if ((status & AN_INTRS) == 0)
461 break;
462
463 if (status & AN_EV_RX)
464 an_rx_intr(sc);
465
466 if (status & (AN_EV_TX | AN_EV_TX_EXC))
467 an_tx_intr(sc, status);
468
469 if (status & AN_EV_LINKSTAT)
470 an_linkstat_intr(sc);
471
472 if ((ifp->if_flags & IFF_OACTIVE) == 0 &&
473 sc->sc_ic.ic_state == IEEE80211_S_RUN &&
474 !IFQ_IS_EMPTY(&ifp->if_snd))
475 an_start(ifp);
476 }
477
478 return 1;
479}
480
481static int
482an_init(struct ifnet *ifp)
483{
484 struct an_softc *sc = ifp->if_softc;
485 struct ieee80211com *ic = &sc->sc_ic;
486 int i, error, fid;
487
488 DPRINTF(("an_init: enabled %d\n", sc->sc_enabled));
489 if (!sc->sc_enabled) {
490 if (sc->sc_enable)
491 (*sc->sc_enable)(sc);
492 an_wait(sc);
493 sc->sc_enabled = 1;
494 } else {
495 an_stop(ifp, 0);
496 if ((error = an_reset(sc)) != 0) {
497 printf("%s: failed to reset\n", ifp->if_xname);
498 an_stop(ifp, 1);
499 return error;
500 }
501 }
502 CSR_WRITE_2(sc, AN_SW0, AN_MAGIC);
503
504 /* Allocate the TX buffers */
505 for (i = 0; i < AN_TX_RING_CNT; i++) {
506 if ((error = an_alloc_fid(sc, AN_TX_MAX_LEN, &fid)) != 0) {
507 printf("%s: failed to allocate nic memory\n",
508 ifp->if_xname);
509 an_stop(ifp, 1);
510 return error;
511 }
512 DPRINTF2(("an_init: txbuf %d allocated %x\n", i, fid));
513 sc->sc_txd[i].d_fid = fid;
514 sc->sc_txd[i].d_inuse = 0;
515 }
516 sc->sc_txcur = sc->sc_txnext = 0;
517
518 IEEE80211_ADDR_COPY(sc->sc_config.an_macaddr, ic->ic_myaddr);
519 sc->sc_config.an_scanmode = htole16(AN_SCANMODE_ACTIVE);
520 sc->sc_config.an_authtype = htole16(AN_AUTHTYPE_OPEN); /*XXX*/
521 if (ic->ic_flags & IEEE80211_F_PRIVACY) {
522 sc->sc_config.an_authtype |=
523 htole16(AN_AUTHTYPE_PRIVACY_IN_USE);
524 if (sc->sc_use_leap)
525 sc->sc_config.an_authtype |=
526 htole16(AN_AUTHTYPE_LEAP);
527 }
528 sc->sc_config.an_listen_interval = htole16(ic->ic_lintval);
529 sc->sc_config.an_beacon_period = htole16(ic->ic_lintval);
530 if (ic->ic_flags & IEEE80211_F_PMGTON)
531 sc->sc_config.an_psave_mode = htole16(AN_PSAVE_PSP);
532 else
533 sc->sc_config.an_psave_mode = htole16(AN_PSAVE_CAM);
534 sc->sc_config.an_ds_channel =
535 htole16(ieee80211_chan2ieee(ic, ic->ic_ibss_chan));
536
537 switch (ic->ic_opmode) {
538 case IEEE80211_M_STA:
539 sc->sc_config.an_opmode =
540 htole16(AN_OPMODE_INFRASTRUCTURE_STATION);
541 sc->sc_config.an_rxmode = htole16(AN_RXMODE_BC_MC_ADDR);
542 break;
543 case IEEE80211_M_IBSS:
544 sc->sc_config.an_opmode = htole16(AN_OPMODE_IBSS_ADHOC);
545 sc->sc_config.an_rxmode = htole16(AN_RXMODE_BC_MC_ADDR);
546 break;
547 case IEEE80211_M_MONITOR:
548 sc->sc_config.an_opmode =
549 htole16(AN_OPMODE_INFRASTRUCTURE_STATION);
550 sc->sc_config.an_rxmode =
551 htole16(AN_RXMODE_80211_MONITOR_ANYBSS);
552 sc->sc_config.an_authtype = htole16(AN_AUTHTYPE_NONE);
553 if (ic->ic_flags & IEEE80211_F_PRIVACY)
554 sc->sc_config.an_authtype |=
555 htole16(AN_AUTHTYPE_PRIVACY_IN_USE |
556 AN_AUTHTYPE_ALLOW_UNENCRYPTED);
557 break;
558 default:
559 printf("%s: bad opmode %d\n", ifp->if_xname, ic->ic_opmode);
560 an_stop(ifp, 1);
561 return EIO;
562 }
563 sc->sc_config.an_rxmode |= htole16(AN_RXMODE_NO_8023_HEADER);
564
565 /* Set the ssid list */
566 memset(&sc->sc_buf, 0, sizeof(sc->sc_buf.sc_ssidlist));
567 sc->sc_buf.sc_ssidlist.an_entry[0].an_ssid_len =
568 htole16(ic->ic_des_esslen);
569 if (ic->ic_des_esslen)
570 memcpy(sc->sc_buf.sc_ssidlist.an_entry[0].an_ssid,
571 ic->ic_des_essid, ic->ic_des_esslen);
572 if ((error = an_write_rid(sc, AN_RID_SSIDLIST, &sc->sc_buf,
573 sizeof(sc->sc_buf.sc_ssidlist))) != 0) {
574 printf("%s: failed to write ssid list\n", ifp->if_xname);
575 an_stop(ifp, 1);
576 return error;
577 }
578
579 /* Set the AP list */
580 memset(&sc->sc_buf, 0, sizeof(sc->sc_buf.sc_aplist));
581 (void)an_write_rid(sc, AN_RID_APLIST, &sc->sc_buf,
582 sizeof(sc->sc_buf.sc_aplist));
583
584 /* Set the encapsulation */
585 for (i = 0; i < AN_ENCAP_NENTS; i++) {
586 sc->sc_buf.sc_encap.an_entry[i].an_ethertype = htole16(0);
587 sc->sc_buf.sc_encap.an_entry[i].an_action =
588 htole16(AN_RXENCAP_RFC1024 | AN_TXENCAP_RFC1024);
589 }
590 (void)an_write_rid(sc, AN_RID_ENCAP, &sc->sc_buf,
591 sizeof(sc->sc_buf.sc_encap));
592
593 /* Set the WEP Keys */
594 if (ic->ic_flags & IEEE80211_F_PRIVACY)
595 an_write_wepkey(sc, AN_RID_WEP_VOLATILE, sc->sc_wepkeys,
596 sc->sc_tx_key);
597
598 /* Set the configuration */
599#ifdef AN_DEBUG
600 if (an_debug) {
601 printf("write config:\n");
602 for (i = 0; i < sizeof(sc->sc_config) / 2; i++)
603 printf(" %04x", ((u_int16_t *)&sc->sc_config)[i]);
604 printf("\n");
605 }
606#endif
607 if ((error = an_write_rid(sc, AN_RID_GENCONFIG, &sc->sc_config,
608 sizeof(sc->sc_config))) != 0) {
609 printf("%s: failed to write config\n", ifp->if_xname);
610 an_stop(ifp, 1);
611 return error;
612 }
613
614 /* Enable the MAC */
615 if (an_cmd(sc, AN_CMD_ENABLE, 0)) {
616 aprint_error_dev(sc->sc_dev, "failed to enable MAC\n");
617 an_stop(ifp, 1);
618 return ENXIO;
619 }
620 if (ifp->if_flags & IFF_PROMISC)
621 an_cmd(sc, AN_CMD_SET_MODE, 0xffff);
622
623 ifp->if_flags |= IFF_RUNNING;
624 ifp->if_flags &= ~IFF_OACTIVE;
625 ic->ic_state = IEEE80211_S_INIT;
626 if (ic->ic_opmode == IEEE80211_M_MONITOR)
627 ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
628
629 /* enable interrupts */
630 CSR_WRITE_2(sc, AN_INT_EN, AN_INTRS);
631 return 0;
632}
633
634static void
635an_stop(struct ifnet *ifp, int disable)
636{
637 struct an_softc *sc = ifp->if_softc;
638 int i, s;
639
640 if (!sc->sc_enabled)
641 return;
642
643 DPRINTF(("an_stop: disable %d\n", disable));
644
645 s = splnet();
646 ieee80211_new_state(&sc->sc_ic, IEEE80211_S_INIT, -1);
647 if (device_is_active(sc->sc_dev)) {
648 an_cmd(sc, AN_CMD_FORCE_SYNCLOSS, 0);
649 CSR_WRITE_2(sc, AN_INT_EN, 0);
650 an_cmd(sc, AN_CMD_DISABLE, 0);
651
652 for (i = 0; i < AN_TX_RING_CNT; i++)
653 an_cmd(sc, AN_CMD_DEALLOC_MEM, sc->sc_txd[i].d_fid);
654 }
655
656 sc->sc_tx_timer = 0;
657 ifp->if_timer = 0;
658 ifp->if_flags &= ~(IFF_RUNNING|IFF_OACTIVE);
659
660 if (disable) {
661 if (sc->sc_disable)
662 (*sc->sc_disable)(sc);
663 sc->sc_enabled = 0;
664 }
665 splx(s);
666}
667
668static void
669an_start(struct ifnet *ifp)
670{
671 struct an_softc *sc = (struct an_softc *)ifp->if_softc;
672 struct ieee80211com *ic = &sc->sc_ic;
673 struct ieee80211_node *ni;
674 struct ieee80211_frame *wh;
675 struct an_txframe frmhdr;
676 struct ether_header *eh;
677 struct mbuf *m;
678 u_int16_t len;
679 int cur, fid;
680
681 if (!sc->sc_enabled || !device_is_active(sc->sc_dev)) {
682 DPRINTF(("an_start: noop: enabled %d invalid %d\n",
683 sc->sc_enabled, !device_is_active(sc->sc_dev)));
684 return;
685 }
686
687 memset(&frmhdr, 0, sizeof(frmhdr));
688 cur = sc->sc_txnext;
689 for (;;) {
690 if (ic->ic_state != IEEE80211_S_RUN) {
691 DPRINTF(("an_start: not running %d\n", ic->ic_state));
692 break;
693 }
694 IFQ_POLL(&ifp->if_snd, m);
695 if (m == NULL) {
696 DPRINTF2(("an_start: no pending mbuf\n"));
697 break;
698 }
699 if (sc->sc_txd[cur].d_inuse) {
700 DPRINTF2(("an_start: %x/%d busy\n",
701 sc->sc_txd[cur].d_fid, cur));
702 ifp->if_flags |= IFF_OACTIVE;
703 break;
704 }
705 IFQ_DEQUEUE(&ifp->if_snd, m);
706 ifp->if_opackets++;
707 bpf_mtap(ifp, m);
708 eh = mtod(m, struct ether_header *);
709 ni = ieee80211_find_txnode(ic, eh->ether_dhost);
710 if (ni == NULL) {
711 /* NB: ieee80211_find_txnode does stat+msg */
712 goto bad;
713 }
714 if ((m = ieee80211_encap(ic, m, ni)) == NULL)
715 goto bad;
716 ieee80211_free_node(ni);
717 bpf_mtap3(ic->ic_rawbpf, m);
718
719 wh = mtod(m, struct ieee80211_frame *);
720 if (ic->ic_flags & IEEE80211_F_PRIVACY)
721 wh->i_fc[1] |= IEEE80211_FC1_WEP;
722 m_copydata(m, 0, sizeof(struct ieee80211_frame),
723 (void *)&frmhdr.an_whdr);
724
725 /* insert payload length in front of llc/snap */
726 len = htons(m->m_pkthdr.len - sizeof(struct ieee80211_frame));
727 m_adj(m, sizeof(struct ieee80211_frame) - sizeof(len));
728 if (mtod(m, u_long) & 0x01)
729 memcpy(mtod(m, void *), &len, sizeof(len));
730 else
731 *mtod(m, u_int16_t *) = len;
732
733 /*
734 * XXX Aironet firmware apparently convert the packet
735 * with longer than 1500 bytes in length into LLC/SNAP.
736 * If we have 1500 bytes in ethernet payload, it is
737 * 1508 bytes including LLC/SNAP and will be inserted
738 * additional LLC/SNAP header with 1501-1508 in its
739 * ethertype !!
740 * So we skip LLC/SNAP header and force firmware to
741 * convert it to LLC/SNAP again.
742 */
743 m_adj(m, sizeof(struct llc));
744
745 frmhdr.an_tx_ctl = htole16(AN_TXCTL_80211);
746 frmhdr.an_tx_payload_len = htole16(m->m_pkthdr.len);
747 frmhdr.an_gaplen = htole16(AN_TXGAP_802_11);
748
749 if (ic->ic_fixed_rate != -1)
750 frmhdr.an_tx_rate =
751 ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[
752 ic->ic_fixed_rate] & IEEE80211_RATE_VAL;
753 else
754 frmhdr.an_tx_rate = 0;
755
756 /* XXX radiotap for tx must be completed */
757 if (sc->sc_drvbpf) {
758 struct an_tx_radiotap_header *tap = &sc->sc_txtap;
759 tap->at_rate = ic->ic_bss->ni_rates.rs_rates[ic->ic_bss->ni_txrate];
760 tap->at_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
761 tap->at_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
762 /* TBD tap->wt_flags */
763 bpf_mtap2(sc->sc_drvbpf, tap, tap->at_ihdr.it_len, m);
764 }
765
766#ifdef AN_DEBUG
767 if ((ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==
768 (IFF_DEBUG|IFF_LINK2)) {
769 ieee80211_dump_pkt((u_int8_t *)&frmhdr.an_whdr,
770 sizeof(struct ieee80211_frame), -1, 0);
771 printf(" txctl 0x%x plen %u\n",
772 le16toh(frmhdr.an_tx_ctl),
773 le16toh(frmhdr.an_tx_payload_len));
774 }
775#endif
776 if (sizeof(frmhdr) + AN_TXGAP_802_11 + sizeof(len) +
777 m->m_pkthdr.len > AN_TX_MAX_LEN)
778 goto bad;
779
780 fid = sc->sc_txd[cur].d_fid;
781 if (an_write_bap(sc, fid, 0, &frmhdr, sizeof(frmhdr)) != 0)
782 goto bad;
783 /* dummy write to avoid seek. */
784 an_write_bap(sc, fid, -1, &frmhdr, AN_TXGAP_802_11);
785 an_mwrite_bap(sc, fid, -1, m, m->m_pkthdr.len);
786 m_freem(m);
787
788 DPRINTF2(("an_start: send %zu byte via %x/%d\n",
789 ntohs(len) + sizeof(struct ieee80211_frame),
790 fid, cur));
791 sc->sc_txd[cur].d_inuse = 1;
792 if (an_cmd(sc, AN_CMD_TX, fid)) {
793 printf("%s: xmit failed\n", ifp->if_xname);
794 sc->sc_txd[cur].d_inuse = 0;
795 continue;
796 }
797 sc->sc_tx_timer = 5;
798 ifp->if_timer = 1;
799 AN_INC(cur, AN_TX_RING_CNT);
800 sc->sc_txnext = cur;
801 continue;
802bad:
803 ifp->if_oerrors++;
804 m_freem(m);
805 }
806}
807
808static int
809an_reset(struct an_softc *sc)
810{
811
812 DPRINTF(("an_reset\n"));
813
814 if (!sc->sc_enabled)
815 return ENXIO;
816
817 an_cmd(sc, AN_CMD_ENABLE, 0);
818 an_cmd(sc, AN_CMD_FW_RESTART, 0);
819 an_cmd(sc, AN_CMD_NOOP2, 0);
820
821 if (an_cmd(sc, AN_CMD_FORCE_SYNCLOSS, 0) == ETIMEDOUT) {
822 aprint_error_dev(sc->sc_dev, "reset failed\n");
823 return ETIMEDOUT;
824 }
825
826 an_cmd(sc, AN_CMD_DISABLE, 0);
827 return 0;
828}
829
830static void
831an_watchdog(struct ifnet *ifp)
832{
833 struct an_softc *sc = ifp->if_softc;
834
835 if (!sc->sc_enabled)
836 return;
837
838 if (sc->sc_tx_timer) {
839 if (--sc->sc_tx_timer == 0) {
840 printf("%s: device timeout\n", ifp->if_xname);
841 ifp->if_oerrors++;
842 an_init(ifp);
843 return;
844 }
845 ifp->if_timer = 1;
846 }
847 ieee80211_watchdog(&sc->sc_ic);
848}
849
850static int
851an_ioctl(struct ifnet *ifp, u_long command, void *data)
852{
853 struct an_softc *sc = ifp->if_softc;
854 int s, error = 0;
855
856 if (!device_is_active(sc->sc_dev))
857 return ENXIO;
858
859 s = splnet();
860
861 switch (command) {
862 case SIOCSIFFLAGS:
863 if ((error = ifioctl_common(ifp, command, data)) != 0)
864 break;
865 if (ifp->if_flags & IFF_UP) {
866 if (sc->sc_enabled) {
867 /*
868 * To avoid rescanning another access point,
869 * do not call an_init() here. Instead, only
870 * reflect promisc mode settings.
871 */
872 error = an_cmd(sc, AN_CMD_SET_MODE,
873 (ifp->if_flags & IFF_PROMISC) ? 0xffff : 0);
874 } else
875 error = an_init(ifp);
876 } else if (sc->sc_enabled)
877 an_stop(ifp, 1);
878 break;
879 case SIOCADDMULTI:
880 case SIOCDELMULTI:
881 error = ether_ioctl(ifp, command, data);
882 if (error == ENETRESET) {
883 /* we don't have multicast filter. */
884 error = 0;
885 }
886 break;
887 case SIOCS80211NWKEY:
888 error = an_set_nwkey(sc, (struct ieee80211_nwkey *)data);
889 break;
890 case SIOCG80211NWKEY:
891 error = an_get_nwkey(sc, (struct ieee80211_nwkey *)data);
892 break;
893 default:
894 error = ieee80211_ioctl(&sc->sc_ic, command, data);
895 break;
896 }
897 if (error == ENETRESET) {
898 if (sc->sc_enabled)
899 error = an_init(ifp);
900 else
901 error = 0;
902 }
903 splx(s);
904 return error;
905}
906
907/* TBD factor with ieee80211_media_change */
908static int
909an_media_change(struct ifnet *ifp)
910{
911 struct an_softc *sc = ifp->if_softc;
912 struct ieee80211com *ic = &sc->sc_ic;
913 struct ifmedia_entry *ime;
914 enum ieee80211_opmode newmode;
915 int i, rate, error = 0;
916
917 ime = ic->ic_media.ifm_cur;
918 if (IFM_SUBTYPE(ime->ifm_media) == IFM_AUTO) {
919 i = -1;
920 } else {
921 struct ieee80211_rateset *rs =
922 &ic->ic_sup_rates[IEEE80211_MODE_11B];
923 rate = ieee80211_media2rate(ime->ifm_media);
924 if (rate == 0)
925 return EINVAL;
926 for (i = 0; i < rs->rs_nrates; i++) {
927 if ((rs->rs_rates[i] & IEEE80211_RATE_VAL) == rate)
928 break;
929 }
930 if (i == rs->rs_nrates)
931 return EINVAL;
932 }
933 if (ic->ic_fixed_rate != i) {
934 ic->ic_fixed_rate = i;
935 error = ENETRESET;
936 }
937
938 if (ime->ifm_media & IFM_IEEE80211_ADHOC)
939 newmode = IEEE80211_M_IBSS;
940 else if (ime->ifm_media & IFM_IEEE80211_HOSTAP)
941 newmode = IEEE80211_M_HOSTAP;
942 else if (ime->ifm_media & IFM_IEEE80211_MONITOR)
943 newmode = IEEE80211_M_MONITOR;
944 else
945 newmode = IEEE80211_M_STA;
946 if (ic->ic_opmode != newmode) {
947 ic->ic_opmode = newmode;
948 error = ENETRESET;
949 }
950 if (error == ENETRESET) {
951 if (sc->sc_enabled)
952 error = an_init(ifp);
953 else
954 error = 0;
955 }
956 ifp->if_baudrate = ifmedia_baudrate(ic->ic_media.ifm_cur->ifm_media);
957
958 return error;
959}
960
961static void
962an_media_status(struct ifnet *ifp, struct ifmediareq *imr)
963{
964 struct an_softc *sc = ifp->if_softc;
965 struct ieee80211com *ic = &sc->sc_ic;
966 int rate, buflen;
967
968 if (sc->sc_enabled == 0) {
969 imr->ifm_active = IFM_IEEE80211 | IFM_NONE;
970 imr->ifm_status = 0;
971 return;
972 }
973
974 imr->ifm_status = IFM_AVALID;
975 imr->ifm_active = IFM_IEEE80211;
976 if (ic->ic_state == IEEE80211_S_RUN)
977 imr->ifm_status |= IFM_ACTIVE;
978 buflen = sizeof(sc->sc_buf);
979 if (ic->ic_fixed_rate != -1)
980 rate = ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[
981 ic->ic_fixed_rate] & IEEE80211_RATE_VAL;
982 else if (an_read_rid(sc, AN_RID_STATUS, &sc->sc_buf, &buflen) != 0)
983 rate = 0;
984 else
985 rate = le16toh(sc->sc_buf.sc_status.an_current_tx_rate);
986 imr->ifm_active |= ieee80211_rate2media(ic, rate, IEEE80211_MODE_11B);
987 switch (ic->ic_opmode) {
988 case IEEE80211_M_STA:
989 break;
990 case IEEE80211_M_IBSS:
991 imr->ifm_active |= IFM_IEEE80211_ADHOC;
992 break;
993 case IEEE80211_M_HOSTAP:
994 imr->ifm_active |= IFM_IEEE80211_HOSTAP;
995 break;
996 case IEEE80211_M_MONITOR:
997 imr->ifm_active |= IFM_IEEE80211_MONITOR;
998 break;
999 default:
1000 break;
1001 }
1002}
1003
1004static int
1005an_set_nwkey(struct an_softc *sc, struct ieee80211_nwkey *nwkey)
1006{
1007 int error;
1008 struct ieee80211com *ic = &sc->sc_ic;
1009 u_int16_t prevauth;
1010
1011 error = 0;
1012 prevauth = sc->sc_config.an_authtype;
1013
1014 switch (nwkey->i_wepon) {
1015 case IEEE80211_NWKEY_OPEN:
1016 sc->sc_config.an_authtype = AN_AUTHTYPE_OPEN;
1017 ic->ic_flags &= ~IEEE80211_F_PRIVACY;
1018 break;
1019
1020 case IEEE80211_NWKEY_WEP:
1021 case IEEE80211_NWKEY_WEP | IEEE80211_NWKEY_PERSIST:
1022 error = an_set_nwkey_wep(sc, nwkey);
1023 if (error == 0 || error == ENETRESET) {
1024 sc->sc_config.an_authtype =
1025 AN_AUTHTYPE_OPEN | AN_AUTHTYPE_PRIVACY_IN_USE;
1026 ic->ic_flags |= IEEE80211_F_PRIVACY;
1027 }
1028 break;
1029
1030 case IEEE80211_NWKEY_EAP:
1031 error = an_set_nwkey_eap(sc, nwkey);
1032 if (error == 0 || error == ENETRESET) {
1033 sc->sc_config.an_authtype = AN_AUTHTYPE_OPEN |
1034 AN_AUTHTYPE_PRIVACY_IN_USE | AN_AUTHTYPE_LEAP;
1035 ic->ic_flags |= IEEE80211_F_PRIVACY;
1036 }
1037 break;
1038 default:
1039 error = EINVAL;
1040 break;
1041 }
1042 if (error == 0 && prevauth != sc->sc_config.an_authtype)
1043 error = ENETRESET;
1044 return error;
1045}
1046
1047static int
1048an_set_nwkey_wep(struct an_softc *sc, struct ieee80211_nwkey *nwkey)
1049{
1050 int i, txkey, anysetkey, needreset, error;
1051 struct an_wepkey keys[IEEE80211_WEP_NKID];
1052
1053 error = 0;
1054 memset(keys, 0, sizeof(keys));
1055 anysetkey = needreset = 0;
1056
1057 /* load argument and sanity check */
1058 for (i = 0; i < IEEE80211_WEP_NKID; i++) {
1059 keys[i].an_wep_keylen = nwkey->i_key[i].i_keylen;
1060 if (keys[i].an_wep_keylen < 0)
1061 continue;
1062 if (keys[i].an_wep_keylen != 0 &&
1063 keys[i].an_wep_keylen < IEEE80211_WEP_KEYLEN)
1064 return EINVAL;
1065 if (keys[i].an_wep_keylen > sizeof(keys[i].an_wep_key))
1066 return EINVAL;
1067 if ((error = copyin(nwkey->i_key[i].i_keydat,
1068 keys[i].an_wep_key, keys[i].an_wep_keylen)) != 0)
1069 return error;
1070 anysetkey++;
1071 }
1072 txkey = nwkey->i_defkid - 1;
1073 if (txkey >= 0) {
1074 if (txkey >= IEEE80211_WEP_NKID)
1075 return EINVAL;
1076 /* default key must have a valid value */
1077 if (keys[txkey].an_wep_keylen == 0 ||
1078 (keys[txkey].an_wep_keylen < 0 &&
1079 sc->sc_perskeylen[txkey] == 0))
1080 return EINVAL;
1081 anysetkey++;
1082 }
1083 DPRINTF(("an_set_nwkey_wep: %s: %sold(%d:%d,%d,%d,%d) "
1084 "pers(%d:%d,%d,%d,%d) new(%d:%d,%d,%d,%d)\n",
1085 device_xname(sc->sc_dev),
1086 ((nwkey->i_wepon & IEEE80211_NWKEY_PERSIST) ? "persist: " : ""),
1087 sc->sc_tx_key,
1088 sc->sc_wepkeys[0].an_wep_keylen, sc->sc_wepkeys[1].an_wep_keylen,
1089 sc->sc_wepkeys[2].an_wep_keylen, sc->sc_wepkeys[3].an_wep_keylen,
1090 sc->sc_tx_perskey,
1091 sc->sc_perskeylen[0], sc->sc_perskeylen[1],
1092 sc->sc_perskeylen[2], sc->sc_perskeylen[3],
1093 txkey,
1094 keys[0].an_wep_keylen, keys[1].an_wep_keylen,
1095 keys[2].an_wep_keylen, keys[3].an_wep_keylen));
1096 if (!(nwkey->i_wepon & IEEE80211_NWKEY_PERSIST)) {
1097 /* set temporary keys */
1098 sc->sc_tx_key = txkey;
1099 for (i = 0; i < IEEE80211_WEP_NKID; i++) {
1100 if (keys[i].an_wep_keylen < 0)
1101 continue;
1102 memcpy(&sc->sc_wepkeys[i], &keys[i], sizeof(keys[i]));
1103 }
1104 } else {
1105 /* set persist keys */
1106 if (anysetkey) {
1107 /* prepare to write nvram */
1108 if (!sc->sc_enabled) {
1109 if (sc->sc_enable)
1110 (*sc->sc_enable)(sc);
1111 an_wait(sc);
1112 sc->sc_enabled = 1;
1113 error = an_write_wepkey(sc,
1114 AN_RID_WEP_PERSISTENT, keys, txkey);
1115 if (sc->sc_disable)
1116 (*sc->sc_disable)(sc);
1117 sc->sc_enabled = 0;
1118 } else {
1119 an_cmd(sc, AN_CMD_DISABLE, 0);
1120 error = an_write_wepkey(sc,
1121 AN_RID_WEP_PERSISTENT, keys, txkey);
1122 an_cmd(sc, AN_CMD_ENABLE, 0);
1123 }
1124 if (error)
1125 return error;
1126 }
1127 if (txkey >= 0)
1128 sc->sc_tx_perskey = txkey;
1129 if (sc->sc_tx_key >= 0) {
1130 sc->sc_tx_key = -1;
1131 needreset++;
1132 }
1133 for (i = 0; i < IEEE80211_WEP_NKID; i++) {
1134 if (sc->sc_wepkeys[i].an_wep_keylen >= 0) {
1135 memset(&sc->sc_wepkeys[i].an_wep_key, 0,
1136 sizeof(sc->sc_wepkeys[i].an_wep_key));
1137 sc->sc_wepkeys[i].an_wep_keylen = -1;
1138 needreset++;
1139 }
1140 if (keys[i].an_wep_keylen >= 0)
1141 sc->sc_perskeylen[i] = keys[i].an_wep_keylen;
1142 }
1143 }
1144 if (needreset) {
1145 /* firmware restart to reload persistent key */
1146 an_reset(sc);
1147 }
1148 if (anysetkey || needreset)
1149 error = ENETRESET;
1150 return error;
1151}
1152
1153static int
1154an_set_nwkey_eap(struct an_softc *sc, struct ieee80211_nwkey *nwkey)
1155{
1156 int i, error, len;
1157 struct ifnet *ifp = &sc->sc_if;
1158 struct an_rid_leapkey *key;
1159 u_int16_t unibuf[sizeof(key->an_key)];
1160 static const int leap_rid[] = { AN_RID_LEAP_PASS, AN_RID_LEAP_USER };
1161 MD4_CTX ctx;
1162
1163 error = 0;
1164
1165 if (nwkey->i_key[0].i_keydat == NULL &&
1166 nwkey->i_key[1].i_keydat == NULL)
1167 return 0;
1168 if (!sc->sc_enabled)
1169 return ENXIO;
1170 an_cmd(sc, AN_CMD_DISABLE, 0);
1171 key = &sc->sc_buf.sc_leapkey;
1172 for (i = 0; i < 2; i++) {
1173 if (nwkey->i_key[i].i_keydat == NULL)
1174 continue;
1175 len = nwkey->i_key[i].i_keylen;
1176 if (len > sizeof(key->an_key))
1177 return EINVAL;
1178 memset(key, 0, sizeof(*key));
1179 key->an_key_len = htole16(len);
1180 if ((error = copyin(nwkey->i_key[i].i_keydat, key->an_key,
1181 len)) != 0)
1182 return error;
1183 if (i == 1) {
1184 /*
1185 * Cisco seems to use PasswordHash and PasswordHashHash
1186 * in RFC-2759 (MS-CHAP-V2).
1187 */
1188 memset(unibuf, 0, sizeof(unibuf));
1189 /* XXX: convert password to unicode */
1190 for (i = 0; i < len; i++)
1191 unibuf[i] = key->an_key[i];
1192 /* set PasswordHash */
1193 MD4Init(&ctx);
1194 MD4Update(&ctx, (u_int8_t *)unibuf, len * 2);
1195 MD4Final(key->an_key, &ctx);
1196 /* set PasswordHashHash */
1197 MD4Init(&ctx);
1198 MD4Update(&ctx, key->an_key, 16);
1199 MD4Final(key->an_key + 16, &ctx);
1200 key->an_key_len = htole16(32);
1201 }
1202 if ((error = an_write_rid(sc, leap_rid[i], key,
1203 sizeof(*key))) != 0) {
1204 printf("%s: LEAP set failed\n", ifp->if_xname);
1205 return error;
1206 }
1207 }
1208 error = an_cmd(sc, AN_CMD_ENABLE, 0);
1209 if (error)
1210 printf("%s: an_set_nwkey: failed to enable MAC\n",
1211 ifp->if_xname);
1212 else
1213 error = ENETRESET;
1214 return error;
1215}
1216
1217static int
1218an_get_nwkey(struct an_softc *sc, struct ieee80211_nwkey *nwkey)
1219{
1220 int i, error;
1221
1222 error = 0;
1223 if (sc->sc_config.an_authtype & AN_AUTHTYPE_LEAP)
1224 nwkey->i_wepon = IEEE80211_NWKEY_EAP;
1225 else if (sc->sc_config.an_authtype & AN_AUTHTYPE_PRIVACY_IN_USE)
1226 nwkey->i_wepon = IEEE80211_NWKEY_WEP;
1227 else
1228 nwkey->i_wepon = IEEE80211_NWKEY_OPEN;
1229 if (sc->sc_tx_key == -1)
1230 nwkey->i_defkid = sc->sc_tx_perskey + 1;
1231 else
1232 nwkey->i_defkid = sc->sc_tx_key + 1;
1233 if (nwkey->i_key[0].i_keydat == NULL)
1234 return 0;
1235 for (i = 0; i < IEEE80211_WEP_NKID; i++) {
1236 if (nwkey->i_key[i].i_keydat == NULL)
1237 continue;
1238 /* do not show any keys to non-root user */
1239 /* XXX-elad: why is this inside a loop? */
1240 if ((error = kauth_authorize_network(curlwp->l_cred,
1241 KAUTH_NETWORK_INTERFACE,
1242 KAUTH_REQ_NETWORK_INTERFACE_GETPRIV, sc->sc_ic.ic_ifp,
1243 KAUTH_ARG(SIOCG80211NWKEY), NULL)) != 0)
1244 break;
1245 nwkey->i_key[i].i_keylen = sc->sc_wepkeys[i].an_wep_keylen;
1246 if (nwkey->i_key[i].i_keylen < 0) {
1247 if (sc->sc_perskeylen[i] == 0)
1248 nwkey->i_key[i].i_keylen = 0;
1249 continue;
1250 }
1251 if ((error = copyout(sc->sc_wepkeys[i].an_wep_key,
1252 nwkey->i_key[i].i_keydat,
1253 sc->sc_wepkeys[i].an_wep_keylen)) != 0)
1254 break;
1255 }
1256 return error;
1257}
1258
1259static int
1260an_write_wepkey(struct an_softc *sc, int type, struct an_wepkey *keys, int kid)
1261{
1262 int i, error;
1263 struct an_rid_wepkey *akey;
1264
1265 error = 0;
1266 akey = &sc->sc_buf.sc_wepkey;
1267 memset(akey, 0, sizeof(struct an_rid_wepkey));
1268 for (i = 0; i < IEEE80211_WEP_NKID; i++) {
1269 if (keys[i].an_wep_keylen < 0 ||
1270 keys[i].an_wep_keylen > sizeof(akey->an_key))
1271 continue;
1272 akey->an_key_len = htole16(keys[i].an_wep_keylen);
1273 akey->an_key_index = htole16(i);
1274 akey->an_mac_addr[0] = 1; /* default mac */
1275 memcpy(akey->an_key, keys[i].an_wep_key, keys[i].an_wep_keylen);
1276 if ((error = an_write_rid(sc, type, akey, sizeof(*akey))) != 0)
1277 return error;
1278 }
1279 if (kid >= 0) {
1280 akey->an_key_index = htole16(0xffff);
1281 akey->an_mac_addr[0] = kid;
1282 akey->an_key_len = htole16(0);
1283 memset(akey->an_key, 0, sizeof(akey->an_key));
1284 error = an_write_rid(sc, type, akey, sizeof(*akey));
1285 }
1286 return error;
1287}
1288
1289#ifdef AN_DEBUG
1290static void
1291an_dump_pkt(const char *devname, struct mbuf *m)
1292{
1293 int col, col0, i;
1294 uint8_t *pkt = mtod(m, uint8_t *);
1295 const char *delim = "";
1296 int delimw = 0;
1297
1298 printf("%s: pkt ", devname);
1299 col = col0 = strlen(devname) + strlen(": pkt ");
1300 for (i = 0; i < m->m_len; i++) {
1301 printf("%s%02x", delim, pkt[i]);
1302 delim = ":";
1303 delimw = 1;
1304 col += delimw + 2;
1305 if (col >= 72) {
1306 printf("\n%*s", col0, "");
1307 col = col0;
1308 delim = "";
1309 delimw = 0;
1310 }
1311 }
1312 if (col != 0)
1313 printf("\n");
1314}
1315#endif /* AN_DEBUG */
1316
1317/*
1318 * Low level functions
1319 */
1320
1321static void
1322an_rx_intr(struct an_softc *sc)
1323{
1324 struct ieee80211com *ic = &sc->sc_ic;
1325 struct ifnet *ifp = &sc->sc_if;
1326 struct ieee80211_frame_min *wh;
1327 struct ieee80211_node *ni;
1328 struct an_rxframe frmhdr;
1329 struct mbuf *m;
1330 u_int16_t status;
1331 int fid, gaplen, len, off;
1332 uint8_t *gap;
1333
1334 fid = CSR_READ_2(sc, AN_RX_FID);
1335
1336 /* First read in the frame header */
1337 if (an_read_bap(sc, fid, 0, &frmhdr, sizeof(frmhdr)) != 0) {
1338 CSR_WRITE_2(sc, AN_EVENT_ACK, AN_EV_RX);
1339 ifp->if_ierrors++;
1340 DPRINTF(("an_rx_intr: read fid %x failed\n", fid));
1341 return;
1342 }
1343
1344#ifdef AN_DEBUG
1345 if ((ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) == (IFF_DEBUG|IFF_LINK2)) {
1346 ieee80211_dump_pkt((u_int8_t *)&frmhdr.an_whdr,
1347 sizeof(struct ieee80211_frame), frmhdr.an_rx_rate,
1348 frmhdr.an_rx_signal_strength);
1349 printf(" time 0x%x status 0x%x plen %u chan %u"
1350 " plcp %02x %02x %02x %02x gap %u\n",
1351 le32toh(frmhdr.an_rx_time), le16toh(frmhdr.an_rx_status),
1352 le16toh(frmhdr.an_rx_payload_len), frmhdr.an_rx_chan,
1353 frmhdr.an_plcp_hdr[0], frmhdr.an_plcp_hdr[1],
1354 frmhdr.an_plcp_hdr[2], frmhdr.an_plcp_hdr[3],
1355 le16toh(frmhdr.an_gaplen));
1356 }
1357#endif
1358
1359 status = le16toh(frmhdr.an_rx_status);
1360 if ((status & AN_STAT_ERRSTAT) != 0 &&
1361 ic->ic_opmode != IEEE80211_M_MONITOR) {
1362 CSR_WRITE_2(sc, AN_EVENT_ACK, AN_EV_RX);
1363 ifp->if_ierrors++;
1364 DPRINTF(("an_rx_intr: fid %x status %x\n", fid, status));
1365 return;
1366 }
1367
1368 /* the payload length field includes a 16-bit "mystery field" */
1369 len = le16toh(frmhdr.an_rx_payload_len) - sizeof(uint16_t);
1370 off = ALIGN(sizeof(struct ieee80211_frame));
1371
1372 if (off + len > MCLBYTES) {
1373 if (ic->ic_opmode != IEEE80211_M_MONITOR) {
1374 CSR_WRITE_2(sc, AN_EVENT_ACK, AN_EV_RX);
1375 ifp->if_ierrors++;
1376 DPRINTF(("an_rx_intr: oversized packet %d\n", len));
1377 return;
1378 }
1379 len = 0;
1380 }
1381
1382 MGETHDR(m, M_DONTWAIT, MT_DATA);
1383 if (m == NULL) {
1384 CSR_WRITE_2(sc, AN_EVENT_ACK, AN_EV_RX);
1385 ifp->if_ierrors++;
1386 DPRINTF(("an_rx_intr: MGET failed\n"));
1387 return;
1388 }
1389 if (off + len + AN_GAPLEN_MAX > MHLEN) {
1390 MCLGET(m, M_DONTWAIT);
1391 if ((m->m_flags & M_EXT) == 0) {
1392 CSR_WRITE_2(sc, AN_EVENT_ACK, AN_EV_RX);
1393 m_freem(m);
1394 ifp->if_ierrors++;
1395 DPRINTF(("an_rx_intr: MCLGET failed\n"));
1396 return;
1397 }
1398 }
1399 m->m_data += off - sizeof(struct ieee80211_frame);
1400
1401 if (ic->ic_opmode != IEEE80211_M_MONITOR) {
1402 gaplen = le16toh(frmhdr.an_gaplen);
1403 if (gaplen > AN_GAPLEN_MAX) {
1404 CSR_WRITE_2(sc, AN_EVENT_ACK, AN_EV_RX);
1405 m_freem(m);
1406 ifp->if_ierrors++;
1407 DPRINTF(("%s: gap too long\n", __func__));
1408 return;
1409 }
1410 /*
1411 * We don't need the 16-bit mystery field (payload length?),
1412 * so read it into the region reserved for the 802.11 header.
1413 *
1414 * When Cisco Aironet 350 cards w/ firmware version 5 or
1415 * greater operate with certain Cisco 350 APs,
1416 * the "gap" is filled with the SNAP header. Read
1417 * it in after the 802.11 header.
1418 */
1419 gap = m->m_data + sizeof(struct ieee80211_frame) -
1420 sizeof(uint16_t);
1421 an_read_bap(sc, fid, -1, gap, gaplen + sizeof(u_int16_t));
1422#ifdef AN_DEBUG
1423 if ((ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) ==
1424 (IFF_DEBUG|IFF_LINK2)) {
1425 int i;
1426 printf(" gap&len");
1427 for (i = 0; i < gaplen + sizeof(u_int16_t); i++)
1428 printf(" %02x", gap[i]);
1429 printf("\n");
1430 }
1431#endif
1432 } else
1433 gaplen = 0;
1434
1435 an_read_bap(sc, fid, -1,
1436 m->m_data + sizeof(struct ieee80211_frame) + gaplen, len);
1437 m->m_pkthdr.len = m->m_len = sizeof(struct ieee80211_frame) + gaplen +
1438 len;
1439
1440 memcpy(m->m_data, &frmhdr.an_whdr, sizeof(struct ieee80211_frame));
1441 m_set_rcvif(m, ifp);
1442 CSR_WRITE_2(sc, AN_EVENT_ACK, AN_EV_RX);
1443
1444 if (sc->sc_drvbpf) {
1445 struct an_rx_radiotap_header *tap = &sc->sc_rxtap;
1446
1447 tap->ar_rate = frmhdr.an_rx_rate;
1448 tap->ar_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
1449 tap->ar_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
1450 tap->ar_antsignal = frmhdr.an_rx_signal_strength;
1451 if ((le16toh(frmhdr.an_rx_status) & AN_STAT_BADCRC) ||
1452 (le16toh(frmhdr.an_rx_status) & AN_STAT_ERRSTAT) ||
1453 (le16toh(frmhdr.an_rx_status) & AN_STAT_UNDECRYPTABLE))
1454 tap->ar_flags |= IEEE80211_RADIOTAP_F_BADFCS;
1455
1456 bpf_mtap2(sc->sc_drvbpf, tap, tap->ar_ihdr.it_len, m);
1457 }
1458 wh = mtod(m, struct ieee80211_frame_min *);
1459 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1460 /*
1461 * WEP is decrypted by hardware. Clear WEP bit
1462 * header for ieee80211_input().
1463 */
1464 wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
1465 }
1466
1467#ifdef AN_DEBUG
1468 if (an_debug > 1)
1469 an_dump_pkt(device_xname(sc->sc_dev), m);
1470#endif /* AN_DEBUG */
1471
1472 ni = ieee80211_find_rxnode(ic, wh);
1473 ieee80211_input(ic, m, ni, frmhdr.an_rx_signal_strength,
1474 le32toh(frmhdr.an_rx_time));
1475 ieee80211_free_node(ni);
1476}
1477
1478static void
1479an_tx_intr(struct an_softc *sc, int status)
1480{
1481 struct ifnet *ifp = &sc->sc_if;
1482 int cur, fid;
1483
1484 sc->sc_tx_timer = 0;
1485 ifp->if_flags &= ~IFF_OACTIVE;
1486
1487 fid = CSR_READ_2(sc, AN_TX_CMP_FID);
1488 CSR_WRITE_2(sc, AN_EVENT_ACK, status & (AN_EV_TX | AN_EV_TX_EXC));
1489
1490 if (status & AN_EV_TX_EXC)
1491 ifp->if_oerrors++;
1492 else
1493 ifp->if_opackets++;
1494
1495 cur = sc->sc_txcur;
1496 if (sc->sc_txd[cur].d_fid == fid) {
1497 sc->sc_txd[cur].d_inuse = 0;
1498 DPRINTF2(("an_tx_intr: sent %x/%d\n", fid, cur));
1499 AN_INC(cur, AN_TX_RING_CNT);
1500 sc->sc_txcur = cur;
1501 } else {
1502 for (cur = 0; cur < AN_TX_RING_CNT; cur++) {
1503 if (fid == sc->sc_txd[cur].d_fid) {
1504 sc->sc_txd[cur].d_inuse = 0;
1505 break;
1506 }
1507 }
1508 if (ifp->if_flags & IFF_DEBUG)
1509 printf("%s: tx mismatch: "
1510 "expected %x(%d), actual %x(%d)\n",
1511 device_xname(sc->sc_dev),
1512 sc->sc_txd[sc->sc_txcur].d_fid, sc->sc_txcur,
1513 fid, cur);
1514 }
1515
1516 return;
1517}
1518
1519static void
1520an_linkstat_intr(struct an_softc *sc)
1521{
1522 struct ieee80211com *ic = &sc->sc_ic;
1523 u_int16_t status;
1524
1525 status = CSR_READ_2(sc, AN_LINKSTAT);
1526 CSR_WRITE_2(sc, AN_EVENT_ACK, AN_EV_LINKSTAT);
1527 DPRINTF(("an_linkstat_intr: status 0x%x\n", status));
1528
1529 if (status == AN_LINKSTAT_ASSOCIATED) {
1530 if (ic->ic_state != IEEE80211_S_RUN ||
1531 ic->ic_opmode == IEEE80211_M_IBSS)
1532 ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
1533 } else {
1534 if (ic->ic_opmode == IEEE80211_M_STA)
1535 ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
1536 }
1537}
1538
1539/* Must be called at proper protection level! */
1540static int
1541an_cmd(struct an_softc *sc, int cmd, int val)
1542{
1543 int i, status;
1544
1545 /* make sure that previous command completed */
1546 if (CSR_READ_2(sc, AN_COMMAND) & AN_CMD_BUSY) {
1547 if (sc->sc_if.if_flags & IFF_DEBUG)
1548 printf("%s: command 0x%x busy\n", device_xname(sc->sc_dev),
1549 CSR_READ_2(sc, AN_COMMAND));
1550 CSR_WRITE_2(sc, AN_EVENT_ACK, AN_EV_CLR_STUCK_BUSY);
1551 }
1552
1553 CSR_WRITE_2(sc, AN_PARAM0, val);
1554 CSR_WRITE_2(sc, AN_PARAM1, 0);
1555 CSR_WRITE_2(sc, AN_PARAM2, 0);
1556 CSR_WRITE_2(sc, AN_COMMAND, cmd);
1557
1558 if (cmd == AN_CMD_FW_RESTART) {
1559 /* XXX: should sleep here */
1560 DELAY(100*1000);
1561 }
1562
1563 for (i = 0; i < AN_TIMEOUT; i++) {
1564 if (CSR_READ_2(sc, AN_EVENT_STAT) & AN_EV_CMD)
1565 break;
1566 DELAY(10);
1567 }
1568
1569 status = CSR_READ_2(sc, AN_STATUS);
1570
1571 /* clear stuck command busy if necessary */
1572 if (CSR_READ_2(sc, AN_COMMAND) & AN_CMD_BUSY)
1573 CSR_WRITE_2(sc, AN_EVENT_ACK, AN_EV_CLR_STUCK_BUSY);
1574
1575 /* Ack the command */
1576 CSR_WRITE_2(sc, AN_EVENT_ACK, AN_EV_CMD);
1577
1578 if (i == AN_TIMEOUT) {
1579 if (sc->sc_if.if_flags & IFF_DEBUG)
1580 printf("%s: command 0x%x param 0x%x timeout\n",
1581 device_xname(sc->sc_dev), cmd, val);
1582 return ETIMEDOUT;
1583 }
1584 if (status & AN_STAT_CMD_RESULT) {
1585 if (sc->sc_if.if_flags & IFF_DEBUG)
1586 printf("%s: command 0x%x param 0x%x status 0x%x "
1587 "resp 0x%x 0x%x 0x%x\n",
1588 device_xname(sc->sc_dev), cmd, val, status,
1589 CSR_READ_2(sc, AN_RESP0), CSR_READ_2(sc, AN_RESP1),
1590 CSR_READ_2(sc, AN_RESP2));
1591 return EIO;
1592 }
1593
1594 return 0;
1595}
1596
1597
1598/*
1599 * Wait for firmware come up after power enabled.
1600 */
1601static void
1602an_wait(struct an_softc *sc)
1603{
1604 int i;
1605
1606 CSR_WRITE_2(sc, AN_COMMAND, AN_CMD_NOOP2);
1607 for (i = 0; i < 3*hz; i++) {
1608 if (CSR_READ_2(sc, AN_EVENT_STAT) & AN_EV_CMD)
1609 break;
1610 (void)tsleep(sc, PWAIT, "anatch", 1);
1611 }
1612 CSR_WRITE_2(sc, AN_EVENT_ACK, AN_EV_CMD);
1613}
1614
1615static int
1616an_seek_bap(struct an_softc *sc, int id, int off)
1617{
1618 int i, status;
1619
1620 CSR_WRITE_2(sc, AN_SEL0, id);
1621 CSR_WRITE_2(sc, AN_OFF0, off);
1622
1623 for (i = 0; ; i++) {
1624 status = CSR_READ_2(sc, AN_OFF0);
1625 if ((status & AN_OFF_BUSY) == 0)
1626 break;
1627 if (i == AN_TIMEOUT) {
1628 printf("%s: timeout in an_seek_bap to 0x%x/0x%x\n",
1629 device_xname(sc->sc_dev), id, off);
1630 sc->sc_bap_off = AN_OFF_ERR; /* invalidate */
1631 return ETIMEDOUT;
1632 }
1633 DELAY(10);
1634 }
1635 if (status & AN_OFF_ERR) {
1636 aprint_error_dev(sc->sc_dev, "failed in an_seek_bap to 0x%x/0x%x\n",
1637 id, off);
1638 sc->sc_bap_off = AN_OFF_ERR; /* invalidate */
1639 return EIO;
1640 }
1641 sc->sc_bap_id = id;
1642 sc->sc_bap_off = off;
1643 return 0;
1644}
1645
1646static int
1647an_read_bap(struct an_softc *sc, int id, int off, void *buf, int buflen)
1648{
1649 int error, cnt;
1650
1651 if (buflen == 0)
1652 return 0;
1653 if (off == -1)
1654 off = sc->sc_bap_off;
1655 if (id != sc->sc_bap_id || off != sc->sc_bap_off) {
1656 if ((error = an_seek_bap(sc, id, off)) != 0)
1657 return EIO;
1658 }
1659
1660 cnt = (buflen + 1) / 2;
1661 CSR_READ_MULTI_STREAM_2(sc, AN_DATA0, (u_int16_t *)buf, cnt);
1662 sc->sc_bap_off += cnt * 2;
1663 return 0;
1664}
1665
1666static int
1667an_write_bap(struct an_softc *sc, int id, int off, void *buf, int buflen)
1668{
1669 int error, cnt;
1670
1671 if (buflen == 0)
1672 return 0;
1673 if (off == -1)
1674 off = sc->sc_bap_off;
1675 if (id != sc->sc_bap_id || off != sc->sc_bap_off) {
1676 if ((error = an_seek_bap(sc, id, off)) != 0)
1677 return EIO;
1678 }
1679
1680 cnt = (buflen + 1) / 2;
1681 CSR_WRITE_MULTI_STREAM_2(sc, AN_DATA0, (u_int16_t *)buf, cnt);
1682 sc->sc_bap_off += cnt * 2;
1683 return 0;
1684}
1685
1686static int
1687an_mwrite_bap(struct an_softc *sc, int id, int off, struct mbuf *m, int totlen)
1688{
1689 int error, len, cnt;
1690
1691 if (off == -1)
1692 off = sc->sc_bap_off;
1693 if (id != sc->sc_bap_id || off != sc->sc_bap_off) {
1694 if ((error = an_seek_bap(sc, id, off)) != 0)
1695 return EIO;
1696 }
1697
1698 for (len = 0; m != NULL; m = m->m_next) {
1699 if (m->m_len == 0)
1700 continue;
1701 len = min(m->m_len, totlen);
1702
1703 if ((mtod(m, u_long) & 0x1) || (len & 0x1)) {
1704 m_copydata(m, 0, totlen, (void *)&sc->sc_buf.sc_txbuf);
1705 cnt = (totlen + 1) / 2;
1706 CSR_WRITE_MULTI_STREAM_2(sc, AN_DATA0,
1707 sc->sc_buf.sc_val, cnt);
1708 off += cnt * 2;
1709 break;
1710 }
1711 cnt = len / 2;
1712 CSR_WRITE_MULTI_STREAM_2(sc, AN_DATA0, mtod(m, u_int16_t *),
1713 cnt);
1714 off += len;
1715 totlen -= len;
1716 }
1717 sc->sc_bap_off = off;
1718 return 0;
1719}
1720
1721static int
1722an_alloc_fid(struct an_softc *sc, int len, int *idp)
1723{
1724 int i;
1725
1726 if (an_cmd(sc, AN_CMD_ALLOC_MEM, len)) {
1727 aprint_error_dev(sc->sc_dev, "failed to allocate %d bytes on NIC\n",
1728 len);
1729 return ENOMEM;
1730 }
1731
1732 for (i = 0; i < AN_TIMEOUT; i++) {
1733 if (CSR_READ_2(sc, AN_EVENT_STAT) & AN_EV_ALLOC)
1734 break;
1735 if (i == AN_TIMEOUT) {
1736 printf("%s: timeout in alloc\n", device_xname(sc->sc_dev));
1737 return ETIMEDOUT;
1738 }
1739 DELAY(10);
1740 }
1741
1742 *idp = CSR_READ_2(sc, AN_ALLOC_FID);
1743 CSR_WRITE_2(sc, AN_EVENT_ACK, AN_EV_ALLOC);
1744 return 0;
1745}
1746
1747static int
1748an_read_rid(struct an_softc *sc, int rid, void *buf, int *buflenp)
1749{
1750 int error;
1751 u_int16_t len;
1752
1753 /* Tell the NIC to enter record read mode. */
1754 error = an_cmd(sc, AN_CMD_ACCESS | AN_ACCESS_READ, rid);
1755 if (error)
1756 return error;
1757
1758 /* length in byte, including length itself */
1759 error = an_read_bap(sc, rid, 0, &len, sizeof(len));
1760 if (error)
1761 return error;
1762
1763 len = le16toh(len) - 2;
1764 if (*buflenp < len) {
1765 aprint_error_dev(sc->sc_dev, "record buffer is too small, "
1766 "rid=%x, size=%d, len=%d\n",
1767 rid, *buflenp, len);
1768 return ENOSPC;
1769 }
1770 *buflenp = len;
1771 return an_read_bap(sc, rid, sizeof(len), buf, len);
1772}
1773
1774static int
1775an_write_rid(struct an_softc *sc, int rid, void *buf, int buflen)
1776{
1777 int error;
1778 u_int16_t len;
1779
1780 /* length in byte, including length itself */
1781 len = htole16(buflen + 2);
1782
1783 error = an_write_bap(sc, rid, 0, &len, sizeof(len));
1784 if (error)
1785 return error;
1786 error = an_write_bap(sc, rid, sizeof(len), buf, buflen);
1787 if (error)
1788 return error;
1789
1790 return an_cmd(sc, AN_CMD_ACCESS | AN_ACCESS_WRITE, rid);
1791}
1792
1793static int
1794an_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
1795{
1796 struct an_softc *sc = (struct an_softc *)ic->ic_ifp->if_softc;
1797 struct ieee80211_node *ni = ic->ic_bss;
1798 int buflen;
1799
1800 DPRINTF(("an_newstate: %s -> %s\n", ieee80211_state_name[ic->ic_state],
1801 ieee80211_state_name[nstate]));
1802
1803 switch (nstate) {
1804 case IEEE80211_S_INIT:
1805 ic->ic_flags &= ~IEEE80211_F_IBSSON;
1806 return (*sc->sc_newstate)(ic, nstate, arg);
1807
1808 case IEEE80211_S_SCAN:
1809 case IEEE80211_S_AUTH:
1810 case IEEE80211_S_ASSOC:
1811 ic->ic_state = nstate; /* NB: skip normal ieee80211 handling */
1812 return 0;
1813
1814 case IEEE80211_S_RUN:
1815 buflen = sizeof(sc->sc_buf);
1816 an_read_rid(sc, AN_RID_STATUS, &sc->sc_buf, &buflen);
1817 IEEE80211_ADDR_COPY(ni->ni_bssid,
1818 sc->sc_buf.sc_status.an_cur_bssid);
1819 IEEE80211_ADDR_COPY(ni->ni_macaddr, ni->ni_bssid);
1820 ni->ni_chan = &ic->ic_channels[
1821 le16toh(sc->sc_buf.sc_status.an_cur_channel)];
1822 ni->ni_esslen = le16toh(sc->sc_buf.sc_status.an_ssidlen);
1823 if (ni->ni_esslen > IEEE80211_NWID_LEN)
1824 ni->ni_esslen = IEEE80211_NWID_LEN; /*XXX*/
1825 memcpy(ni->ni_essid, sc->sc_buf.sc_status.an_ssid,
1826 ni->ni_esslen);
1827 ni->ni_rates = ic->ic_sup_rates[IEEE80211_MODE_11B]; /*XXX*/
1828 if (ic->ic_ifp->if_flags & IFF_DEBUG) {
1829 printf("%s: ", device_xname(sc->sc_dev));
1830 if (ic->ic_opmode == IEEE80211_M_STA)
1831 printf("associated ");
1832 else
1833 printf("synchronized ");
1834 printf("with %s ssid ", ether_sprintf(ni->ni_bssid));
1835 ieee80211_print_essid(ni->ni_essid, ni->ni_esslen);
1836 printf(" channel %u start %uMb\n",
1837 le16toh(sc->sc_buf.sc_status.an_cur_channel),
1838 le16toh(sc->sc_buf.sc_status.an_current_tx_rate)/2);
1839 }
1840 break;
1841
1842 default:
1843 break;
1844 }
1845 return (*sc->sc_newstate)(ic, nstate, arg);
1846}
1847