sys/dev/netif/wi/if_wi.c

   1 /*      $NetBSD: wi.c,v 1.109 2003/01/09 08:52:19 dyoung Exp $  */
   2
   3 /*
   4  * Copyright (c) 1997, 1998, 1999
   5  *      Bill Paul <wpaul@ctr.columbia.edu>.  All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  * 3. All advertising materials mentioning features or use of this software
  16  *    must display the following acknowledgement:
  17  *      This product includes software developed by Bill Paul.
  18  * 4. Neither the name of the author nor the names of any co-contributors
  19  *    may be used to endorse or promote products derived from this software
  20  *    without specific prior written permission.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
  23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  25  * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
  26  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  27  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  28  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  29  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  30  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  31  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  32  * THE POSSIBILITY OF SUCH DAMAGE.
  33  *
  34  * $FreeBSD: src/sys/dev/wi/if_wi.c,v 1.166 2004/04/01 00:38:45 sam Exp $
  35  * $DragonFly: src/sys/dev/netif/wi/if_wi.c,v 1.35 2005/12/31 14:25:04 sephe Exp $
  36  */
  37
  38 /*
  39  * Lucent WaveLAN/IEEE 802.11 PCMCIA driver.
  40  *
  41  * Original FreeBSD driver written by Bill Paul <wpaul@ctr.columbia.edu>
  42  * Electrical Engineering Department
  43  * Columbia University, New York City
  44  */
  45
  46 /*
  47  * The WaveLAN/IEEE adapter is the second generation of the WaveLAN
  48  * from Lucent. Unlike the older cards, the new ones are programmed
  49  * entirely via a firmware-driven controller called the Hermes.
  50  * Unfortunately, Lucent will not release the Hermes programming manual
  51  * without an NDA (if at all). What they do release is an API library
  52  * called the HCF (Hardware Control Functions) which is supposed to
  53  * do the device-specific operations of a device driver for you. The
  54  * publically available version of the HCF library (the 'HCF Light') is
  55  * a) extremely gross, b) lacks certain features, particularly support
  56  * for 802.11 frames, and c) is contaminated by the GNU Public License.
  57  *
  58  * This driver does not use the HCF or HCF Light at all. Instead, it
  59  * programs the Hermes controller directly, using information gleaned
  60  * from the HCF Light code and corresponding documentation.
  61  *
  62  * This driver supports the ISA, PCMCIA and PCI versions of the Lucent
  63  * WaveLan cards (based on the Hermes chipset), as well as the newer
  64  * Prism 2 chipsets with firmware from Intersil and Symbol.
  65  */
  66
  67 #define WI_HERMES_AUTOINC_WAR   /* Work around data write autoinc bug. */
  68 #define WI_HERMES_STATS_WAR     /* Work around stats counter bug. */
  69
  70 #include "opt_polling.h"
  71
  72 #include <sys/param.h>
  73 #include <sys/endian.h>
  74 #include <sys/systm.h>
  75 #include <sys/sockio.h>
  76 #include <sys/mbuf.h>
  77 #include <sys/proc.h>
  78 #include <sys/kernel.h>
  79 #include <sys/socket.h>
  80 #include <sys/module.h>
  81 #include <sys/bus.h>
  82 #include <sys/random.h>
  83 #include <sys/syslog.h>
  84 #include <sys/sysctl.h>
  85 #include <sys/serialize.h>
  86 #include <sys/thread2.h>
  87
  88 #include <machine/bus.h>
  89 #include <machine/resource.h>
  90 #include <machine/atomic.h>
  91 #include <sys/rman.h>
  92
  93 #include <net/if.h>
  94 #include <net/if_arp.h>
  95 #include <net/ethernet.h>
  96 #include <net/if_dl.h>
  97 #include <net/if_media.h>
  98 #include <net/if_types.h>
  99 #include <net/ifq_var.h>
 100
 101 #include <netproto/802_11/ieee80211_var.h>
 102 #include <netproto/802_11/ieee80211_ioctl.h>
 103 #include <netproto/802_11/ieee80211_radiotap.h>
 104 #include <netproto/802_11/if_wavelan_ieee.h>
 105
 106 #include <netinet/in.h>
 107 #include <netinet/in_systm.h>
 108 #include <netinet/in_var.h>
 109 #include <netinet/ip.h>
 110 #include <netinet/if_ether.h>
 111
 112 #include <net/bpf.h>
 113
 114 #include <dev/netif/wi/if_wireg.h>
 115 #include <dev/netif/wi/if_wivar.h>
 116
 117 static void wi_start(struct ifnet *);
 118 static int  wi_reset(struct wi_softc *);
 119 static void wi_watchdog(struct ifnet *);
 120 static int  wi_ioctl(struct ifnet *, u_long, caddr_t, struct ucred *);
 121 static int  wi_media_change(struct ifnet *);
 122 static void wi_media_status(struct ifnet *, struct ifmediareq *);
 123
 124 static void wi_rx_intr(struct wi_softc *);
 125 static void wi_tx_intr(struct wi_softc *);
 126 static void wi_tx_ex_intr(struct wi_softc *);
 127 static void wi_info_intr(struct wi_softc *);
 128
 129 static int  wi_get_cfg(struct ifnet *, u_long, caddr_t, struct ucred *);
 130 static int  wi_set_cfg(struct ifnet *, u_long, caddr_t);
 131 static int  wi_write_txrate(struct wi_softc *);
 132 static int  wi_write_wep(struct wi_softc *);
 133 static int  wi_write_multi(struct wi_softc *);
 134 static int  wi_alloc_fid(struct wi_softc *, int, int *);
 135 static void wi_read_nicid(struct wi_softc *);
 136 static int  wi_write_ssid(struct wi_softc *, int, u_int8_t *, int);
 137
 138 static int  wi_cmd(struct wi_softc *, int, int, int, int);
 139 static int  wi_seek_bap(struct wi_softc *, int, int);
 140 static int  wi_read_bap(struct wi_softc *, int, int, void *, int);
 141 static int  wi_write_bap(struct wi_softc *, int, int, void *, int);
 142 static int  wi_mwrite_bap(struct wi_softc *, int, int, struct mbuf *, int);
 143 static int  wi_read_rid(struct wi_softc *, int, void *, int *);
 144 static int  wi_write_rid(struct wi_softc *, int, void *, int);
 145
 146 static int  wi_newstate(struct ieee80211com *, enum ieee80211_state, int);
 147
 148 static int  wi_scan_ap(struct wi_softc *, u_int16_t, u_int16_t);
 149 static void wi_scan_result(struct wi_softc *, int, int);
 150
 151 static void wi_dump_pkt(struct wi_frame *, struct ieee80211_node *, int rssi);
 152
 153 static int wi_get_debug(struct wi_softc *, struct wi_req *);
 154 static int wi_set_debug(struct wi_softc *, struct wi_req *);
 155
 156 /* support to download firmware for symbol CF card */
 157 static int wi_symbol_write_firm(struct wi_softc *, const void *, int,
 158                 const void *, int);
 159 static int wi_symbol_set_hcr(struct wi_softc *, int);
 160 #ifdef DEVICE_POLLING
 161 static void wi_poll(struct ifnet *ifp, enum poll_cmd cmd, int count);
 162 #endif
 163
 164 static __inline int
 165 wi_write_val(struct wi_softc *sc, int rid, u_int16_t val)
 166 {
 167
 168         val = htole16(val);
 169         return wi_write_rid(sc, rid, &val, sizeof(val));
 170 }
 171
 172 SYSCTL_NODE(_hw, OID_AUTO, wi, CTLFLAG_RD, 0, "Wireless driver parameters");
 173
 174 static  struct timeval lasttxerror;     /* time of last tx error msg */
 175 static  int curtxeps;                   /* current tx error msgs/sec */
 176 static  int wi_txerate = 0;             /* tx error rate: max msgs/sec */
 177 SYSCTL_INT(_hw_wi, OID_AUTO, txerate, CTLFLAG_RW, &wi_txerate,
 178             0, "max tx error msgs/sec; 0 to disable msgs");
 179
 180 #define WI_DEBUG
 181 #ifdef WI_DEBUG
 182 static  int wi_debug = 0;
 183 SYSCTL_INT(_hw_wi, OID_AUTO, debug, CTLFLAG_RW, &wi_debug,
 184             0, "control debugging printfs");
 185
 186 #define DPRINTF(X)      if (wi_debug) if_printf X
 187 #define DPRINTF2(X)     if (wi_debug > 1) if_printf X
 188 #define IFF_DUMPPKTS(_ifp) \
 189         (((_ifp)->if_flags & (IFF_DEBUG|IFF_LINK2)) == (IFF_DEBUG|IFF_LINK2))
 190 #else
 191 #define DPRINTF(X)
 192 #define DPRINTF2(X)
 193 #define IFF_DUMPPKTS(_ifp)      0
 194 #endif
 195
 196 #define WI_INTRS        (WI_EV_RX | WI_EV_ALLOC | WI_EV_INFO)
 197
 198 struct wi_card_ident wi_card_ident[] = {
 199         /* CARD_ID                      CARD_NAME               FIRM_TYPE */
 200         { WI_NIC_LUCENT_ID,             WI_NIC_LUCENT_STR,      WI_LUCENT },
 201         { WI_NIC_SONY_ID,               WI_NIC_SONY_STR,        WI_LUCENT },
 202         { WI_NIC_LUCENT_EMB_ID,         WI_NIC_LUCENT_EMB_STR,  WI_LUCENT },
 203         { WI_NIC_EVB2_ID,               WI_NIC_EVB2_STR,        WI_INTERSIL },
 204         { WI_NIC_HWB3763_ID,            WI_NIC_HWB3763_STR,     WI_INTERSIL },
 205         { WI_NIC_HWB3163_ID,            WI_NIC_HWB3163_STR,     WI_INTERSIL },
 206         { WI_NIC_HWB3163B_ID,           WI_NIC_HWB3163B_STR,    WI_INTERSIL },
 207         { WI_NIC_EVB3_ID,               WI_NIC_EVB3_STR,        WI_INTERSIL },
 208         { WI_NIC_HWB1153_ID,            WI_NIC_HWB1153_STR,     WI_INTERSIL },
 209         { WI_NIC_P2_SST_ID,             WI_NIC_P2_SST_STR,      WI_INTERSIL },
 210         { WI_NIC_EVB2_SST_ID,           WI_NIC_EVB2_SST_STR,    WI_INTERSIL },
 211         { WI_NIC_3842_EVA_ID,           WI_NIC_3842_EVA_STR,    WI_INTERSIL },
 212         { WI_NIC_3842_PCMCIA_AMD_ID,    WI_NIC_3842_PCMCIA_STR, WI_INTERSIL },
 213         { WI_NIC_3842_PCMCIA_SST_ID,    WI_NIC_3842_PCMCIA_STR, WI_INTERSIL },
 214         { WI_NIC_3842_PCMCIA_ATL_ID,    WI_NIC_3842_PCMCIA_STR, WI_INTERSIL },
 215         { WI_NIC_3842_PCMCIA_ATS_ID,    WI_NIC_3842_PCMCIA_STR, WI_INTERSIL },
 216         { WI_NIC_3842_MINI_AMD_ID,      WI_NIC_3842_MINI_STR,   WI_INTERSIL },
 217         { WI_NIC_3842_MINI_SST_ID,      WI_NIC_3842_MINI_STR,   WI_INTERSIL },
 218         { WI_NIC_3842_MINI_ATL_ID,      WI_NIC_3842_MINI_STR,   WI_INTERSIL },
 219         { WI_NIC_3842_MINI_ATS_ID,      WI_NIC_3842_MINI_STR,   WI_INTERSIL },
 220         { WI_NIC_3842_PCI_AMD_ID,       WI_NIC_3842_PCI_STR,    WI_INTERSIL },
 221         { WI_NIC_3842_PCI_SST_ID,       WI_NIC_3842_PCI_STR,    WI_INTERSIL },
 222         { WI_NIC_3842_PCI_ATS_ID,       WI_NIC_3842_PCI_STR,    WI_INTERSIL },
 223         { WI_NIC_3842_PCI_ATL_ID,       WI_NIC_3842_PCI_STR,    WI_INTERSIL },
 224         { WI_NIC_P3_PCMCIA_AMD_ID,      WI_NIC_P3_PCMCIA_STR,   WI_INTERSIL },
 225         { WI_NIC_P3_PCMCIA_SST_ID,      WI_NIC_P3_PCMCIA_STR,   WI_INTERSIL },
 226         { WI_NIC_P3_PCMCIA_ATL_ID,      WI_NIC_P3_PCMCIA_STR,   WI_INTERSIL },
 227         { WI_NIC_P3_PCMCIA_ATS_ID,      WI_NIC_P3_PCMCIA_STR,   WI_INTERSIL },
 228         { WI_NIC_P3_MINI_AMD_ID,        WI_NIC_P3_MINI_STR,     WI_INTERSIL },
 229         { WI_NIC_P3_MINI_SST_ID,        WI_NIC_P3_MINI_STR,     WI_INTERSIL },
 230         { WI_NIC_P3_MINI_ATL_ID,        WI_NIC_P3_MINI_STR,     WI_INTERSIL },
 231         { WI_NIC_P3_MINI_ATS_ID,        WI_NIC_P3_MINI_STR,     WI_INTERSIL },
 232         { 0,    NULL,   0 },
 233 };
 234
 235 devclass_t wi_devclass;
 236
 237 int
 238 wi_attach(device_t dev)
 239 {
 240         struct wi_softc *sc = device_get_softc(dev);
 241         struct ieee80211com *ic = &sc->sc_ic;
 242         struct ifnet *ifp = &ic->ic_if;
 243         int i, nrates, buflen;
 244         u_int16_t val;
 245         u_int8_t ratebuf[2 + IEEE80211_RATE_SIZE];
 246         struct ieee80211_rateset *rs;
 247         static const u_int8_t empty_macaddr[IEEE80211_ADDR_LEN] = {
 248                 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 249         };
 250         int error;
 251
 252         ifp->if_softc = sc;
 253         if_initname(ifp, device_get_name(dev), device_get_unit(dev));
 254
 255         sc->wi_cmd_count = 500;
 256         /* Reset the NIC. */
 257         error = wi_reset(sc);
 258         if (error)
 259                 goto fail;
 260
 261         /*
 262          * Read the station address.
 263          * And do it twice. I've seen PRISM-based cards that return
 264          * an error when trying to read it the first time, which causes
 265          * the probe to fail.
 266          */
 267         buflen = IEEE80211_ADDR_LEN;
 268         error = wi_read_rid(sc, WI_RID_MAC_NODE, ic->ic_myaddr, &buflen);
 269         if (error != 0) {
 270                 buflen = IEEE80211_ADDR_LEN;
 271                 error = wi_read_rid(sc, WI_RID_MAC_NODE, ic->ic_myaddr, &buflen);
 272         }
 273         if (error) {
 274                 device_printf(dev, "mac read failed %d\n", error);
 275                 goto fail;
 276         }
 277         if (IEEE80211_ADDR_EQ(ic->ic_myaddr, empty_macaddr)) {
 278                 device_printf(dev, "mac read failed (all zeros)\n");
 279                 error = ENXIO;
 280                 goto fail;
 281         }
 282
 283         /* Read NIC identification */
 284         wi_read_nicid(sc);
 285
 286         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
 287         ifp->if_ioctl = wi_ioctl;
 288         ifp->if_start = wi_start;
 289         ifp->if_watchdog = wi_watchdog;
 290         ifp->if_init = wi_init;
 291         ifq_set_maxlen(&ifp->if_snd, IFQ_MAXLEN);
 292         ifq_set_ready(&ifp->if_snd);
 293 #ifdef DEVICE_POLLING
 294         ifp->if_poll = wi_poll;
 295 #endif
 296         ifp->if_capenable = ifp->if_capabilities;
 297
 298         ic->ic_phytype = IEEE80211_T_DS;
 299         ic->ic_opmode = IEEE80211_M_STA;
 300         ic->ic_caps = IEEE80211_C_PMGT | IEEE80211_C_AHDEMO;
 301         ic->ic_state = IEEE80211_S_INIT;
 302
 303         /*
 304          * Query the card for available channels and setup the
 305          * channel table.  We assume these are all 11b channels.
 306          */
 307         buflen = sizeof(val);
 308         if (wi_read_rid(sc, WI_RID_CHANNEL_LIST, &val, &buflen) != 0)
 309                 val = htole16(0x1fff);  /* assume 1-11 */
 310         KASSERT(val != 0, ("wi_attach: no available channels listed!"));
 311
 312         val <<= 1;                      /* shift for base 1 indices */
 313         for (i = 1; i < 16; i++) {
 314                 if (isset((u_int8_t*)&val, i)) {
 315                         ic->ic_channels[i].ic_freq =
 316                                 ieee80211_ieee2mhz(i, IEEE80211_CHAN_B);
 317                         ic->ic_channels[i].ic_flags = IEEE80211_CHAN_B;
 318                 }
 319         }
 320
 321         /*
 322          * Read the default channel from the NIC. This may vary
 323          * depending on the country where the NIC was purchased, so
 324          * we can't hard-code a default and expect it to work for
 325          * everyone.
 326          *
 327          * If no channel is specified, let the 802.11 code select.
 328          */
 329         buflen = sizeof(val);
 330         if (wi_read_rid(sc, WI_RID_OWN_CHNL, &val, &buflen) == 0) {
 331                 val = le16toh(val);
 332                 KASSERT(val < IEEE80211_CHAN_MAX &&
 333                         ic->ic_channels[val].ic_flags != 0,
 334                         ("wi_attach: invalid own channel %u!", val));
 335                 ic->ic_ibss_chan = &ic->ic_channels[val];
 336         } else {
 337                 device_printf(dev,
 338                         "WI_RID_OWN_CHNL failed, using first channel!\n");
 339                 ic->ic_ibss_chan = &ic->ic_channels[0];
 340         }
 341
 342         /*
 343          * Set flags based on firmware version.
 344          */
 345         switch (sc->sc_firmware_type) {
 346         case WI_LUCENT:
 347                 sc->sc_ntxbuf = 1;
 348                 sc->sc_flags |= WI_FLAGS_HAS_SYSSCALE;
 349 #ifdef WI_HERMES_AUTOINC_WAR
 350                 /* XXX: not confirmed, but never seen for recent firmware */
 351                 if (sc->sc_sta_firmware_ver <  40000) {
 352                         sc->sc_flags |= WI_FLAGS_BUG_AUTOINC;
 353                 }
 354 #endif
 355                 if (sc->sc_sta_firmware_ver >= 60000)
 356                         sc->sc_flags |= WI_FLAGS_HAS_MOR;
 357                 if (sc->sc_sta_firmware_ver >= 60006) {
 358                         ic->ic_caps |= IEEE80211_C_IBSS;
 359                         ic->ic_caps |= IEEE80211_C_MONITOR;
 360                 }
 361                 sc->sc_ibss_port = htole16(1);
 362
 363                 sc->sc_min_rssi = WI_LUCENT_MIN_RSSI;
 364                 sc->sc_max_rssi = WI_LUCENT_MAX_RSSI;
 365                 sc->sc_dbm_offset = WI_LUCENT_DBM_OFFSET;
 366                 break;
 367
 368         case WI_INTERSIL:
 369                 sc->sc_ntxbuf = WI_NTXBUF;
 370                 sc->sc_flags |= WI_FLAGS_HAS_FRAGTHR;
 371                 sc->sc_flags |= WI_FLAGS_HAS_ROAMING;
 372                 sc->sc_flags |= WI_FLAGS_HAS_SYSSCALE;
 373                 /*
 374                  * Old firmware are slow, so give peace a chance.
 375                  */
 376                 if (sc->sc_sta_firmware_ver < 10000)
 377                         sc->wi_cmd_count = 5000;
 378                 if (sc->sc_sta_firmware_ver > 10101)
 379                         sc->sc_flags |= WI_FLAGS_HAS_DBMADJUST;
 380                 if (sc->sc_sta_firmware_ver >= 800) {
 381                         ic->ic_caps |= IEEE80211_C_IBSS;
 382                         ic->ic_caps |= IEEE80211_C_MONITOR;
 383                 }
 384                 /*
 385                  * version 0.8.3 and newer are the only ones that are known
 386                  * to currently work.  Earlier versions can be made to work,
 387                  * at least according to the Linux driver.
 388                  */
 389                 if (sc->sc_sta_firmware_ver >= 803)
 390                         ic->ic_caps |= IEEE80211_C_HOSTAP;
 391                 sc->sc_ibss_port = htole16(0);
 392
 393                 sc->sc_min_rssi = WI_PRISM_MIN_RSSI;
 394                 sc->sc_max_rssi = WI_PRISM_MAX_RSSI;
 395                 sc->sc_dbm_offset = WI_PRISM_DBM_OFFSET;
 396                 break;
 397
 398         case WI_SYMBOL:
 399                 sc->sc_ntxbuf = 1;
 400                 sc->sc_flags |= WI_FLAGS_HAS_DIVERSITY;
 401                 if (sc->sc_sta_firmware_ver >= 25000)
 402                         ic->ic_caps |= IEEE80211_C_IBSS;
 403                 sc->sc_ibss_port = htole16(4);
 404
 405                 sc->sc_min_rssi = WI_PRISM_MIN_RSSI;
 406                 sc->sc_max_rssi = WI_PRISM_MAX_RSSI;
 407                 sc->sc_dbm_offset = WI_PRISM_DBM_OFFSET;
 408                 break;
 409         }
 410
 411         /*
 412          * Find out if we support WEP on this card.
 413          */
 414         buflen = sizeof(val);
 415         if (wi_read_rid(sc, WI_RID_WEP_AVAIL, &val, &buflen) == 0 &&
 416             val != htole16(0))
 417                 ic->ic_caps |= IEEE80211_C_WEP;
 418
 419         /* Find supported rates. */
 420         buflen = sizeof(ratebuf);
 421         rs = &ic->ic_sup_rates[IEEE80211_MODE_11B];
 422         if (wi_read_rid(sc, WI_RID_DATA_RATES, ratebuf, &buflen) == 0) {
 423                 nrates = le16toh(*(u_int16_t *)ratebuf);
 424                 if (nrates > IEEE80211_RATE_MAXSIZE)
 425                         nrates = IEEE80211_RATE_MAXSIZE;
 426                 rs->rs_nrates = 0;
 427                 for (i = 0; i < nrates; i++)
 428                         if (ratebuf[2+i])
 429                                 rs->rs_rates[rs->rs_nrates++] = ratebuf[2+i];
 430         } else {
 431                 /* XXX fallback on error? */
 432                 rs->rs_nrates = 0;
 433         }
 434
 435         buflen = sizeof(val);
 436         if ((sc->sc_flags & WI_FLAGS_HAS_DBMADJUST) &&
 437             wi_read_rid(sc, WI_RID_DBM_ADJUST, &val, &buflen) == 0) {
 438                 sc->sc_dbm_offset = le16toh(val);
 439         }
 440
 441         sc->sc_max_datalen = 2304;
 442         sc->sc_system_scale = 1;
 443         sc->sc_cnfauthmode = IEEE80211_AUTH_OPEN;
 444         sc->sc_roaming_mode = 1;
 445
 446         sc->sc_portnum = WI_DEFAULT_PORT;
 447         sc->sc_authtype = WI_DEFAULT_AUTHTYPE;
 448
 449         bzero(sc->sc_nodename, sizeof(sc->sc_nodename));
 450         sc->sc_nodelen = sizeof(WI_DEFAULT_NODENAME) - 1;
 451         bcopy(WI_DEFAULT_NODENAME, sc->sc_nodename, sc->sc_nodelen);
 452
 453         bzero(sc->sc_net_name, sizeof(sc->sc_net_name));
 454         bcopy(WI_DEFAULT_NETNAME, sc->sc_net_name,
 455             sizeof(WI_DEFAULT_NETNAME) - 1);
 456
 457         /*
 458          * Call MI attach routine.
 459          */
 460         ieee80211_ifattach(ifp);
 461         /* override state transition method */
 462         sc->sc_newstate = ic->ic_newstate;
 463         ic->ic_newstate = wi_newstate;
 464         ieee80211_media_init(ifp, wi_media_change, wi_media_status);
 465
 466         bpfattach_dlt(ifp, DLT_IEEE802_11_RADIO,
 467                 sizeof(struct ieee80211_frame) + sizeof(sc->sc_tx_th),
 468                 &sc->sc_drvbpf);
 469         /*
 470          * Initialize constant fields.
 471          * XXX make header lengths a multiple of 32-bits so subsequent
 472          *     headers are properly aligned; this is a kludge to keep
 473          *     certain applications happy.
 474          *
 475          * NB: the channel is setup each time we transition to the
 476          *     RUN state to avoid filling it in for each frame.
 477          */
 478         sc->sc_tx_th_len = roundup(sizeof(sc->sc_tx_th), sizeof(u_int32_t));
 479         sc->sc_tx_th.wt_ihdr.it_len = htole16(sc->sc_tx_th_len);
 480         sc->sc_tx_th.wt_ihdr.it_present = htole32(WI_TX_RADIOTAP_PRESENT);
 481
 482         sc->sc_rx_th_len = roundup(sizeof(sc->sc_rx_th), sizeof(u_int32_t));
 483         sc->sc_rx_th.wr_ihdr.it_len = htole16(sc->sc_rx_th_len);
 484         sc->sc_rx_th.wr_ihdr.it_present = htole32(WI_RX_RADIOTAP_PRESENT);
 485
 486
 487         error = bus_setup_intr(dev, sc->irq, INTR_MPSAFE,
 488                                wi_intr, sc, &sc->wi_intrhand,
 489                                ifp->if_serializer);
 490         if (error) {
 491                 ieee80211_ifdetach(ifp);
 492                 device_printf(dev, "bus_setup_intr() failed! (%d)\n", error);
 493                 goto fail;
 494         }
 495
 496         return(0);
 497
 498 fail:
 499         wi_free(dev);
 500         return(error);
 501 }
 502
 503 int
 504 wi_detach(device_t dev)
 505 {
 506         struct wi_softc *sc = device_get_softc(dev);
 507         struct ifnet *ifp = &sc->sc_ic.ic_if;
 508
 509         lwkt_serialize_enter(ifp->if_serializer);
 510
 511         /* check if device was removed */
 512         sc->wi_gone |= !bus_child_present(dev);
 513         wi_stop(ifp, 0);
 514         bus_teardown_intr(dev, sc->irq, sc->wi_intrhand);
 515
 516         lwkt_serialize_exit(ifp->if_serializer);
 517
 518         ieee80211_ifdetach(ifp);
 519         wi_free(dev);
 520         return (0);
 521 }
 522
 523 void
 524 wi_shutdown(device_t dev)
 525 {
 526         struct wi_softc *sc = device_get_softc(dev);
 527         struct ifnet *ifp = &sc->sc_if;
 528
 529         lwkt_serialize_enter(ifp->if_serializer);
 530         wi_stop(ifp, 1);
 531         lwkt_serialize_exit(ifp->if_serializer);
 532 }
 533
 534 #ifdef DEVICE_POLLING
 535
 536 static void
 537 wi_poll(struct ifnet *ifp, enum poll_cmd cmd, int count)
 538 {
 539         struct wi_softc *sc = ifp->if_softc;
 540         uint16_t status;
 541
 542         switch(cmd) {
 543         case POLL_REGISTER:
 544                 /* disable interruptds */
 545                 CSR_WRITE_2(sc, WI_INT_EN, 0);
 546                 break;
 547         case POLL_DEREGISTER:
 548                 /* enable interrupts */
 549                 CSR_WRITE_2(sc, WI_INT_EN, WI_INTRS);
 550                 break;
 551         default:
 552                 status = CSR_READ_2(sc, WI_EVENT_STAT);
 553
 554                 if (status & WI_EV_RX)
 555                         wi_rx_intr(sc);
 556                 if (status & WI_EV_ALLOC)
 557                         wi_tx_intr(sc);
 558                 if (status & WI_EV_INFO)
 559                         wi_info_intr(sc);
 560
 561                 if (cmd == POLL_AND_CHECK_STATUS) {
 562                         if (status & WI_EV_INFO)
 563                                 wi_info_intr(sc);
 564                 }
 565
 566                 if ((ifp->if_flags & IFF_OACTIVE) == 0 &&
 567                     (sc->sc_flags & WI_FLAGS_OUTRANGE) == 0 && !ifq_is_empty(&ifp->if_snd)) {
 568                         wi_start(ifp);
 569                 }
 570                 break;
 571         }
 572 }
 573 #endif /* DEVICE_POLLING */
 574
 575 void
 576 wi_intr(void *arg)
 577 {
 578         struct wi_softc *sc = arg;
 579         struct ifnet *ifp = &sc->sc_ic.ic_if;
 580         u_int16_t status;
 581
 582         if (sc->wi_gone || !sc->sc_enabled || (ifp->if_flags & IFF_UP) == 0) {
 583                 CSR_WRITE_2(sc, WI_INT_EN, 0);
 584                 CSR_WRITE_2(sc, WI_EVENT_ACK, 0xFFFF);
 585                 return;
 586         }
 587
 588         /* Disable interrupts. */
 589         CSR_WRITE_2(sc, WI_INT_EN, 0);
 590
 591         status = CSR_READ_2(sc, WI_EVENT_STAT);
 592         if (status & WI_EV_RX)
 593                 wi_rx_intr(sc);
 594         if (status & WI_EV_ALLOC)
 595                 wi_tx_intr(sc);
 596         if (status & WI_EV_TX_EXC)
 597                 wi_tx_ex_intr(sc);
 598         if (status & WI_EV_INFO)
 599                 wi_info_intr(sc);
 600         if ((ifp->if_flags & IFF_OACTIVE) == 0 &&
 601             (sc->sc_flags & WI_FLAGS_OUTRANGE) == 0 &&
 602             !ifq_is_empty(&ifp->if_snd))
 603                 wi_start(ifp);
 604
 605         /* Re-enable interrupts. */
 606         CSR_WRITE_2(sc, WI_INT_EN, WI_INTRS);
 607
 608         return;
 609 }
 610
 611 void
 612 wi_init(void *arg)
 613 {
 614         struct wi_softc *sc = arg;
 615         struct ifnet *ifp = &sc->sc_if;
 616         struct ieee80211com *ic = &sc->sc_ic;
 617         struct wi_joinreq join;
 618         int i;
 619         int error = 0, wasenabled;
 620
 621         if (sc->wi_gone)
 622                 return;
 623
 624         if ((wasenabled = sc->sc_enabled))
 625                 wi_stop(ifp, 1);
 626         wi_reset(sc);
 627
 628         /* common 802.11 configuration */
 629         ic->ic_flags &= ~IEEE80211_F_IBSSON;
 630         sc->sc_flags &= ~WI_FLAGS_OUTRANGE;
 631         switch (ic->ic_opmode) {
 632         case IEEE80211_M_STA:
 633                 wi_write_val(sc, WI_RID_PORTTYPE, WI_PORTTYPE_BSS);
 634                 break;
 635         case IEEE80211_M_IBSS:
 636                 wi_write_val(sc, WI_RID_PORTTYPE, sc->sc_ibss_port);
 637                 ic->ic_flags |= IEEE80211_F_IBSSON;
 638                 break;
 639         case IEEE80211_M_AHDEMO:
 640                 wi_write_val(sc, WI_RID_PORTTYPE, WI_PORTTYPE_ADHOC);
 641                 break;
 642         case IEEE80211_M_HOSTAP:
 643                 /*
 644                  * For PRISM cards, override the empty SSID, because in
 645                  * HostAP mode the controller will lock up otherwise.
 646                  */
 647                 if (sc->sc_firmware_type == WI_INTERSIL &&
 648                     ic->ic_des_esslen == 0) {
 649                         ic->ic_des_essid[0] = ' ';
 650                         ic->ic_des_esslen = 1;
 651                 }
 652                 wi_write_val(sc, WI_RID_PORTTYPE, WI_PORTTYPE_HOSTAP);
 653                 break;
 654         case IEEE80211_M_MONITOR:
 655                 if (sc->sc_firmware_type == WI_LUCENT)
 656                         wi_write_val(sc, WI_RID_PORTTYPE, WI_PORTTYPE_ADHOC);
 657                 wi_cmd(sc, WI_CMD_DEBUG | (WI_TEST_MONITOR << 8), 0, 0, 0);
 658                 break;
 659         }
 660
 661         /* Intersil interprets this RID as joining ESS even in IBSS mode */
 662         if (sc->sc_firmware_type == WI_LUCENT &&
 663             (ic->ic_flags & IEEE80211_F_IBSSON) && ic->ic_des_esslen > 0)
 664                 wi_write_val(sc, WI_RID_CREATE_IBSS, 1);
 665         else
 666                 wi_write_val(sc, WI_RID_CREATE_IBSS, 0);
 667         wi_write_val(sc, WI_RID_MAX_SLEEP, ic->ic_lintval);
 668         wi_write_ssid(sc, WI_RID_DESIRED_SSID, ic->ic_des_essid,
 669             ic->ic_des_esslen);
 670         wi_write_val(sc, WI_RID_OWN_CHNL,
 671                 ieee80211_chan2ieee(ic, ic->ic_ibss_chan));
 672         wi_write_ssid(sc, WI_RID_OWN_SSID, ic->ic_des_essid, ic->ic_des_esslen);
 673
 674         IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
 675         wi_write_rid(sc, WI_RID_MAC_NODE, ic->ic_myaddr, IEEE80211_ADDR_LEN);
 676
 677         wi_write_val(sc, WI_RID_PM_ENABLED,
 678             (ic->ic_flags & IEEE80211_F_PMGTON) ? 1 : 0);
 679
 680         /* not yet common 802.11 configuration */
 681         wi_write_val(sc, WI_RID_MAX_DATALEN, sc->sc_max_datalen);
 682         wi_write_val(sc, WI_RID_RTS_THRESH, ic->ic_rtsthreshold);
 683         if (sc->sc_flags & WI_FLAGS_HAS_FRAGTHR)
 684                 wi_write_val(sc, WI_RID_FRAG_THRESH, ic->ic_fragthreshold);
 685
 686         /* driver specific 802.11 configuration */
 687         if (sc->sc_flags & WI_FLAGS_HAS_SYSSCALE)
 688                 wi_write_val(sc, WI_RID_SYSTEM_SCALE, sc->sc_system_scale);
 689         if (sc->sc_flags & WI_FLAGS_HAS_ROAMING)
 690                 wi_write_val(sc, WI_RID_ROAMING_MODE, sc->sc_roaming_mode);
 691         if (sc->sc_flags & WI_FLAGS_HAS_MOR)
 692                 wi_write_val(sc, WI_RID_MICROWAVE_OVEN, sc->sc_microwave_oven);
 693         wi_write_txrate(sc);
 694         wi_write_ssid(sc, WI_RID_NODENAME, sc->sc_nodename, sc->sc_nodelen);
 695
 696         if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
 697             sc->sc_firmware_type == WI_INTERSIL) {
 698                 wi_write_val(sc, WI_RID_OWN_BEACON_INT, ic->ic_lintval);
 699                 wi_write_val(sc, WI_RID_BASIC_RATE, 0x03);   /* 1, 2 */
 700                 wi_write_val(sc, WI_RID_SUPPORT_RATE, 0x0f); /* 1, 2, 5.5, 11 */
 701                 wi_write_val(sc, WI_RID_DTIM_PERIOD, 1);
 702         }
 703
 704         /*
 705          * Initialize promisc mode.
 706          *      Being in the Host-AP mode causes a great
 707          *      deal of pain if primisc mode is set.
 708          *      Therefore we avoid confusing the firmware
 709          *      and always reset promisc mode in Host-AP
 710          *      mode.  Host-AP sees all the packets anyway.
 711          */
 712         if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
 713             (ifp->if_flags & IFF_PROMISC) != 0) {
 714                 wi_write_val(sc, WI_RID_PROMISC, 1);
 715         } else {
 716                 wi_write_val(sc, WI_RID_PROMISC, 0);
 717         }
 718
 719         /* Configure WEP. */
 720         if (ic->ic_caps & IEEE80211_C_WEP)
 721                 wi_write_wep(sc);
 722
 723         /* Set multicast filter. */
 724         wi_write_multi(sc);
 725
 726         /* Allocate fids for the card */
 727         if (sc->sc_firmware_type != WI_SYMBOL || !wasenabled) {
 728                 sc->sc_buflen = IEEE80211_MAX_LEN + sizeof(struct wi_frame);
 729                 if (sc->sc_firmware_type == WI_SYMBOL)
 730                         sc->sc_buflen = 1585;   /* XXX */
 731                 for (i = 0; i < sc->sc_ntxbuf; i++) {
 732                         error = wi_alloc_fid(sc, sc->sc_buflen,
 733                             &sc->sc_txd[i].d_fid);
 734                         if (error) {
 735                                 if_printf(ifp,
 736                                     "tx buffer allocation failed (error %u)\n",
 737                                     error);
 738                                 goto out;
 739                         }
 740                         sc->sc_txd[i].d_len = 0;
 741                 }
 742         }
 743         sc->sc_txcur = sc->sc_txnext = 0;
 744
 745         /* Enable desired port */
 746         wi_cmd(sc, WI_CMD_ENABLE | sc->sc_portnum, 0, 0, 0);
 747
 748         sc->sc_enabled = 1;
 749         ifp->if_flags |= IFF_RUNNING;
 750         ifp->if_flags &= ~IFF_OACTIVE;
 751         if (ic->ic_opmode == IEEE80211_M_AHDEMO ||
 752             ic->ic_opmode == IEEE80211_M_MONITOR ||
 753             ic->ic_opmode == IEEE80211_M_HOSTAP)
 754                 ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
 755
 756         /* Enable interrupts if not polling */
 757 #ifdef DEVICE_POLLING
 758         if ((ifp->if_flags & IFF_POLLING) == 0)
 759 #endif
 760                 CSR_WRITE_2(sc, WI_INT_EN, WI_INTRS);
 761
 762         if (!wasenabled &&
 763             ic->ic_opmode == IEEE80211_M_HOSTAP &&
 764             sc->sc_firmware_type == WI_INTERSIL) {
 765                 /* XXX: some card need to be re-enabled for hostap */
 766                 wi_cmd(sc, WI_CMD_DISABLE | WI_PORT0, 0, 0, 0);
 767                 wi_cmd(sc, WI_CMD_ENABLE | WI_PORT0, 0, 0, 0);
 768         }
 769
 770         if (ic->ic_opmode == IEEE80211_M_STA &&
 771             ((ic->ic_flags & IEEE80211_F_DESBSSID) ||
 772             ic->ic_des_chan != IEEE80211_CHAN_ANYC)) {
 773                 memset(&join, 0, sizeof(join));
 774                 if (ic->ic_flags & IEEE80211_F_DESBSSID)
 775                         IEEE80211_ADDR_COPY(&join.wi_bssid, ic->ic_des_bssid);
 776                 if (ic->ic_des_chan != IEEE80211_CHAN_ANYC)
 777                         join.wi_chan = htole16(
 778                                 ieee80211_chan2ieee(ic, ic->ic_des_chan));
 779                 /* Lucent firmware does not support the JOIN RID. */
 780                 if (sc->sc_firmware_type != WI_LUCENT)
 781                         wi_write_rid(sc, WI_RID_JOIN_REQ, &join, sizeof(join));
 782         }
 783         return;
 784 out:
 785         if (error) {
 786                 if_printf(ifp, "interface not running\n");
 787                 wi_stop(ifp, 1);
 788         }
 789
 790         DPRINTF((ifp, "wi_init: return %d\n", error));
 791         return;
 792 }
 793
 794 void
 795 wi_stop(struct ifnet *ifp, int disable)
 796 {
 797         struct ieee80211com *ic = (struct ieee80211com *) ifp;
 798         struct wi_softc *sc = ifp->if_softc;
 799
 800         DELAY(100000);
 801
 802         ifp->if_flags &= ~(IFF_OACTIVE | IFF_RUNNING);
 803         ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
 804         if (sc->sc_enabled && !sc->wi_gone) {
 805                 CSR_WRITE_2(sc, WI_INT_EN, 0);
 806                 wi_cmd(sc, WI_CMD_DISABLE | sc->sc_portnum, 0, 0, 0);
 807                 if (disable) {
 808 #ifdef __NetBSD__
 809                         if (sc->sc_disable)
 810                                 (*sc->sc_disable)(sc);
 811 #endif
 812                         sc->sc_enabled = 0;
 813                 }
 814         } else if (sc->wi_gone && disable)      /* gone --> not enabled */
 815             sc->sc_enabled = 0;
 816
 817         sc->sc_tx_timer = 0;
 818         sc->sc_scan_timer = 0;
 819         sc->sc_syn_timer = 0;
 820         sc->sc_false_syns = 0;
 821         sc->sc_naps = 0;
 822         ifp->if_timer = 0;
 823 }
 824
 825 static void
 826 wi_start(struct ifnet *ifp)
 827 {
 828         struct wi_softc *sc = ifp->if_softc;
 829         struct ieee80211com *ic = &sc->sc_ic;
 830         struct ieee80211_node *ni;
 831         struct ieee80211_frame *wh;
 832         struct mbuf *m0;
 833         struct wi_frame frmhdr;
 834         int cur, fid, off, error;
 835
 836         if (sc->wi_gone)
 837                 return;
 838
 839         if (sc->sc_flags & WI_FLAGS_OUTRANGE)
 840                 return;
 841
 842         memset(&frmhdr, 0, sizeof(frmhdr));
 843         cur = sc->sc_txnext;
 844         for (;;) {
 845                 IF_POLL(&ic->ic_mgtq, m0);
 846                 if (m0 != NULL) {
 847                         if (sc->sc_txd[cur].d_len != 0) {
 848                                 ifp->if_flags |= IFF_OACTIVE;
 849                                 break;
 850                         }
 851                         IF_DEQUEUE(&ic->ic_mgtq, m0);
 852                         /*
 853                          * Hack!  The referenced node pointer is in the
 854                          * rcvif field of the packet header.  This is
 855                          * placed there by ieee80211_mgmt_output because
 856                          * we need to hold the reference with the frame
 857                          * and there's no other way (other than packet
 858                          * tags which we consider too expensive to use)
 859                          * to pass it along.
 860                          */
 861                         ni = (struct ieee80211_node *) m0->m_pkthdr.rcvif;
 862                         m0->m_pkthdr.rcvif = NULL;
 863
 864                         m_copydata(m0, 4, ETHER_ADDR_LEN * 2,
 865                             (caddr_t)&frmhdr.wi_ehdr);
 866                         frmhdr.wi_ehdr.ether_type = 0;
 867                         wh = mtod(m0, struct ieee80211_frame *);
 868                 } else {
 869                         if (ic->ic_state != IEEE80211_S_RUN)
 870                                 break;
 871                         m0 = ifq_poll(&ifp->if_snd);
 872                         if (m0 == NULL)
 873                                 break;
 874                         if (sc->sc_txd[cur].d_len != 0) {
 875                                 ifp->if_flags |= IFF_OACTIVE;
 876                                 break;
 877                         }
 878                         ifq_dequeue(&ifp->if_snd, m0);
 879                         ifp->if_opackets++;
 880                         m_copydata(m0, 0, ETHER_HDR_LEN,
 881                             (caddr_t)&frmhdr.wi_ehdr);
 882                         BPF_MTAP(ifp, m0);
 883
 884                         m0 = ieee80211_encap(ifp, m0, &ni);
 885                         if (m0 == NULL) {
 886                                 ifp->if_oerrors++;
 887                                 continue;
 888                         }
 889                         wh = mtod(m0, struct ieee80211_frame *);
 890                         if (ic->ic_flags & IEEE80211_F_WEPON)
 891                                 wh->i_fc[1] |= IEEE80211_FC1_WEP;
 892
 893                 }
 894
 895                 if (ic->ic_rawbpf != NULL)
 896                         bpf_mtap(ic->ic_rawbpf, m0);
 897
 898                 frmhdr.wi_tx_ctl = htole16(WI_ENC_TX_802_11|WI_TXCNTL_TX_EX);
 899                 if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
 900                     (wh->i_fc[1] & IEEE80211_FC1_WEP)) {
 901                         if ((m0 = ieee80211_wep_crypt(ifp, m0, 1)) == NULL) {
 902                                 ifp->if_oerrors++;
 903                                 if (ni && ni != ic->ic_bss)
 904                                         ieee80211_free_node(ic, ni);
 905                                 continue;
 906                         }
 907                         frmhdr.wi_tx_ctl |= htole16(WI_TXCNTL_NOCRYPT);
 908                 }
 909
 910                 if (sc->sc_drvbpf) {
 911                         sc->sc_tx_th.wt_rate =
 912                                 ni->ni_rates.rs_rates[ni->ni_txrate];
 913                         bpf_ptap(sc->sc_drvbpf, m0, &sc->sc_tx_th,
 914                                  sc->sc_tx_th_len);
 915                 }
 916
 917                 m_copydata(m0, 0, sizeof(struct ieee80211_frame),
 918                     (caddr_t)&frmhdr.wi_whdr);
 919                 m_adj(m0, sizeof(struct ieee80211_frame));
 920                 frmhdr.wi_dat_len = htole16(m0->m_pkthdr.len);
 921                 if (IFF_DUMPPKTS(ifp))
 922                         wi_dump_pkt(&frmhdr, NULL, -1);
 923                 fid = sc->sc_txd[cur].d_fid;
 924                 off = sizeof(frmhdr);
 925                 error = wi_write_bap(sc, fid, 0, &frmhdr, sizeof(frmhdr)) != 0
 926                      || wi_mwrite_bap(sc, fid, off, m0, m0->m_pkthdr.len) != 0;
 927                 m_freem(m0);
 928                 if (ni && ni != ic->ic_bss)
 929                         ieee80211_free_node(ic, ni);
 930                 if (error) {
 931                         ifp->if_oerrors++;
 932                         continue;
 933                 }
 934                 sc->sc_txd[cur].d_len = off;
 935                 if (sc->sc_txcur == cur) {
 936                         if (wi_cmd(sc, WI_CMD_TX | WI_RECLAIM, fid, 0, 0)) {
 937                                 if_printf(ifp, "xmit failed\n");
 938                                 sc->sc_txd[cur].d_len = 0;
 939                                 continue;
 940                         }
 941                         sc->sc_tx_timer = 5;
 942                         ifp->if_timer = 1;
 943                 }
 944                 sc->sc_txnext = cur = (cur + 1) % sc->sc_ntxbuf;
 945         }
 946 }
 947
 948 static int
 949 wi_reset(struct wi_softc *sc)
 950 {
 951         struct ieee80211com *ic = &sc->sc_ic;
 952         struct ifnet *ifp = &ic->ic_if;
 953 #define WI_INIT_TRIES 3
 954         int i;
 955         int error = 0;
 956         int tries;
 957
 958         /* Symbol firmware cannot be initialized more than once */
 959         if (sc->sc_firmware_type == WI_SYMBOL && sc->sc_reset)
 960                 return (0);
 961         if (sc->sc_firmware_type == WI_SYMBOL)
 962                 tries = 1;
 963         else
 964                 tries = WI_INIT_TRIES;
 965
 966         for (i = 0; i < tries; i++) {
 967                 if ((error = wi_cmd(sc, WI_CMD_INI, 0, 0, 0)) == 0)
 968                         break;
 969                 DELAY(WI_DELAY * 1000);
 970         }
 971         sc->sc_reset = 1;
 972
 973         if (i == tries) {
 974                 if_printf(ifp, "init failed\n");
 975                 return (error);
 976         }
 977
 978         CSR_WRITE_2(sc, WI_INT_EN, 0);
 979         CSR_WRITE_2(sc, WI_EVENT_ACK, 0xFFFF);
 980
 981         /* Calibrate timer. */
 982         wi_write_val(sc, WI_RID_TICK_TIME, 8);
 983
 984         return (0);
 985 #undef WI_INIT_TRIES
 986 }
 987
 988 static void
 989 wi_watchdog(struct ifnet *ifp)
 990 {
 991         struct wi_softc *sc = ifp->if_softc;
 992
 993         ifp->if_timer = 0;
 994         if (!sc->sc_enabled)
 995                 return;
 996
 997         if (sc->sc_tx_timer) {
 998                 if (--sc->sc_tx_timer == 0) {
 999                         if_printf(ifp, "device timeout\n");
1000                         ifp->if_oerrors++;
1001                         wi_init(ifp->if_softc);
1002                         return;
1003                 }
1004                 ifp->if_timer = 1;
1005         }
1006
1007         if (sc->sc_scan_timer) {
1008                 if (--sc->sc_scan_timer <= WI_SCAN_WAIT - WI_SCAN_INQWAIT &&
1009                     sc->sc_firmware_type == WI_INTERSIL) {
1010                         DPRINTF((ifp, "wi_watchdog: inquire scan\n"));
1011                         wi_cmd(sc, WI_CMD_INQUIRE, WI_INFO_SCAN_RESULTS, 0, 0);
1012                 }
1013                 if (sc->sc_scan_timer)
1014                         ifp->if_timer = 1;
1015         }
1016
1017         if (sc->sc_syn_timer) {
1018                 if (--sc->sc_syn_timer == 0) {
1019                         struct ieee80211com *ic = (struct ieee80211com *) ifp;
1020                         DPRINTF2((ifp, "wi_watchdog: %d false syns\n",
1021                             sc->sc_false_syns));
1022                         sc->sc_false_syns = 0;
1023                         ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
1024                         sc->sc_syn_timer = 5;
1025                 }
1026                 ifp->if_timer = 1;
1027         }
1028
1029         /* TODO: rate control */
1030         ieee80211_watchdog(ifp);
1031 }
1032
1033 static int
1034 wi_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
1035 {
1036         struct wi_softc *sc = ifp->if_softc;
1037         struct ieee80211com *ic = &sc->sc_ic;
1038         struct ifreq *ifr = (struct ifreq *)data;
1039         struct ieee80211req *ireq;
1040         u_int8_t nodename[IEEE80211_NWID_LEN];
1041         int error = 0;
1042         struct wi_req wreq;
1043
1044         if (sc->wi_gone) {
1045                 error = ENODEV;
1046                 goto out;
1047         }
1048
1049         switch (cmd) {
1050         case SIOCSIFFLAGS:
1051                 /*
1052                  * Can't do promisc and hostap at the same time.  If all that's
1053                  * changing is the promisc flag, try to short-circuit a call to
1054                  * wi_init() by just setting PROMISC in the hardware.
1055                  */
1056                 if (ifp->if_flags & IFF_UP) {
1057                         if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
1058                             ifp->if_flags & IFF_RUNNING) {
1059                                 if (ifp->if_flags & IFF_PROMISC &&
1060                                     !(sc->sc_if_flags & IFF_PROMISC)) {
1061                                         wi_write_val(sc, WI_RID_PROMISC, 1);
1062                                 } else if (!(ifp->if_flags & IFF_PROMISC) &&
1063                                     sc->sc_if_flags & IFF_PROMISC) {
1064                                         wi_write_val(sc, WI_RID_PROMISC, 0);
1065                                 } else {
1066                                         wi_init(sc);
1067                                 }
1068                         } else {
1069                                 wi_init(sc);
1070                         }
1071                 } else {
1072                         if (ifp->if_flags & IFF_RUNNING) {
1073                                 wi_stop(ifp, 1);
1074                         }
1075                         sc->wi_gone = 0;
1076                 }
1077                 sc->sc_if_flags = ifp->if_flags;
1078                 error = 0;
1079                 break;
1080         case SIOCADDMULTI:
1081         case SIOCDELMULTI:
1082                 error = wi_write_multi(sc);
1083                 break;
1084         case SIOCGIFGENERIC:
1085                 error = wi_get_cfg(ifp, cmd, data, cr);
1086                 break;
1087         case SIOCSIFGENERIC:
1088                 error = suser_cred(cr, NULL_CRED_OKAY);
1089                 if (error)
1090                         break;
1091                 error = wi_set_cfg(ifp, cmd, data);
1092                 break;
1093         case SIOCGPRISM2DEBUG:
1094                 error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1095                 if (error)
1096                         break;
1097                 if (!(ifp->if_flags & IFF_RUNNING) ||
1098                     sc->sc_firmware_type == WI_LUCENT) {
1099                         error = EIO;
1100                         break;
1101                 }
1102                 error = wi_get_debug(sc, &wreq);
1103                 if (error == 0)
1104                         error = copyout(&wreq, ifr->ifr_data, sizeof(wreq));
1105                 break;
1106         case SIOCSPRISM2DEBUG:
1107                 if ((error = suser_cred(cr, NULL_CRED_OKAY)))
1108                         goto out;
1109                 error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1110                 if (error)
1111                         break;
1112                 error = wi_set_debug(sc, &wreq);
1113                 break;
1114         case SIOCG80211:
1115                 ireq = (struct ieee80211req *) data;
1116                 switch (ireq->i_type) {
1117                 case IEEE80211_IOC_STATIONNAME:
1118                         ireq->i_len = sc->sc_nodelen + 1;
1119                         error = copyout(sc->sc_nodename, ireq->i_data,
1120                                         ireq->i_len);
1121                         break;
1122                 default:
1123                         error = ieee80211_ioctl(ifp, cmd, data, cr);
1124                         break;
1125                 }
1126                 break;
1127         case SIOCS80211:
1128                 error = suser_cred(cr, NULL_CRED_OKAY);
1129                 if (error)
1130                         break;
1131                 ireq = (struct ieee80211req *) data;
1132                 switch (ireq->i_type) {
1133                 case IEEE80211_IOC_STATIONNAME:
1134                         if (ireq->i_val != 0 ||
1135                             ireq->i_len > IEEE80211_NWID_LEN) {
1136                                 error = EINVAL;
1137                                 break;
1138                         }
1139                         memset(nodename, 0, IEEE80211_NWID_LEN);
1140                         error = copyin(ireq->i_data, nodename, ireq->i_len);
1141                         if (error)
1142                                 break;
1143                         if (sc->sc_enabled) {
1144                                 error = wi_write_ssid(sc, WI_RID_NODENAME,
1145                                         nodename, ireq->i_len);
1146                                 if (error)
1147                                         break;
1148                         }
1149                         memcpy(sc->sc_nodename, nodename, IEEE80211_NWID_LEN);
1150                         sc->sc_nodelen = ireq->i_len;
1151                         break;
1152                 default:
1153                         error = ieee80211_ioctl(ifp, cmd, data, cr);
1154                         break;
1155                 }
1156                 break;
1157         case SIOCSIFCAP:
1158                 if (ifp->if_flags & IFF_RUNNING)
1159                         wi_init(sc);
1160                 break;
1161         default:
1162                 error = ieee80211_ioctl(ifp, cmd, data, cr);
1163                 break;
1164         }
1165         if (error == ENETRESET) {
1166                 if (sc->sc_enabled)
1167                         wi_init(sc);    /* XXX no error return */
1168                 error = 0;
1169         }
1170 out:
1171         return error;
1172 }
1173
1174 static int
1175 wi_media_change(struct ifnet *ifp)
1176 {
1177         struct wi_softc *sc = ifp->if_softc;
1178         int error;
1179
1180         error = ieee80211_media_change(ifp);
1181         if (error == ENETRESET) {
1182                 if (sc->sc_enabled)
1183                         wi_init(sc);    /* XXX no error return */
1184                 error = 0;
1185         }
1186         return error;
1187 }
1188
1189 static void
1190 wi_media_status(struct ifnet *ifp, struct ifmediareq *imr)
1191 {
1192         struct wi_softc *sc = ifp->if_softc;
1193         struct ieee80211com *ic = &sc->sc_ic;
1194         u_int16_t val;
1195         int rate, len;
1196
1197         if (sc->wi_gone || !sc->sc_enabled) {
1198                 imr->ifm_active = IFM_IEEE80211 | IFM_NONE;
1199                 imr->ifm_status = 0;
1200                 return;
1201         }
1202
1203         imr->ifm_status = IFM_AVALID;
1204         imr->ifm_active = IFM_IEEE80211;
1205         if (ic->ic_state == IEEE80211_S_RUN &&
1206             (sc->sc_flags & WI_FLAGS_OUTRANGE) == 0)
1207                 imr->ifm_status |= IFM_ACTIVE;
1208         len = sizeof(val);
1209         if (wi_read_rid(sc, WI_RID_CUR_TX_RATE, &val, &len) != 0)
1210                 rate = 0;
1211         else {
1212                 /* convert to 802.11 rate */
1213                 rate = val * 2;
1214                 if (sc->sc_firmware_type == WI_LUCENT) {
1215                         if (rate == 4 * 2)
1216                                 rate = 11;      /* 5.5Mbps */
1217                         else if (rate == 5 * 2)
1218                                 rate = 22;      /* 11Mbps */
1219                 } else {
1220                         if (rate == 4*2)
1221                                 rate = 11;      /* 5.5Mbps */
1222                         else if (rate == 8*2)
1223                                 rate = 22;      /* 11Mbps */
1224                 }
1225         }
1226         imr->ifm_active |= ieee80211_rate2media(ic, rate, IEEE80211_MODE_11B);
1227         switch (ic->ic_opmode) {
1228         case IEEE80211_M_STA:
1229                 break;
1230         case IEEE80211_M_IBSS:
1231                 imr->ifm_active |= IFM_IEEE80211_ADHOC;
1232                 break;
1233         case IEEE80211_M_AHDEMO:
1234                 imr->ifm_active |= IFM_IEEE80211_ADHOC | IFM_FLAG0;
1235                 break;
1236         case IEEE80211_M_HOSTAP:
1237                 imr->ifm_active |= IFM_IEEE80211_HOSTAP;
1238                 break;
1239         case IEEE80211_M_MONITOR:
1240                 imr->ifm_active |= IFM_IEEE80211_MONITOR;
1241                 break;
1242         }
1243 }
1244
1245 static void
1246 wi_sync_bssid(struct wi_softc *sc, u_int8_t new_bssid[IEEE80211_ADDR_LEN])
1247 {
1248         struct ieee80211com *ic = &sc->sc_ic;
1249         struct ieee80211_node *ni = ic->ic_bss;
1250         struct ifnet *ifp = &ic->ic_if;
1251
1252         if (IEEE80211_ADDR_EQ(new_bssid, ni->ni_bssid))
1253                 return;
1254
1255         DPRINTF((ifp, "wi_sync_bssid: bssid %6D -> %6D ?\n", ni->ni_bssid, ":",
1256             new_bssid, ":"));
1257
1258         /* In promiscuous mode, the BSSID field is not a reliable
1259          * indicator of the firmware's BSSID. Damp spurious
1260          * change-of-BSSID indications.
1261          */
1262         if ((ifp->if_flags & IFF_PROMISC) != 0 &&
1263             sc->sc_false_syns >= WI_MAX_FALSE_SYNS)
1264                 return;
1265
1266         ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
1267 }
1268
1269 static void
1270 wi_rx_monitor(struct wi_softc *sc, int fid)
1271 {
1272         struct ieee80211com *ic = &sc->sc_ic;
1273         struct ifnet *ifp = &ic->ic_if;
1274         struct wi_frame *rx_frame;
1275         struct mbuf *m;
1276         int datlen, hdrlen;
1277
1278         /* first allocate mbuf for packet storage */
1279         m = m_getcl(MB_DONTWAIT, MT_DATA, 0);
1280         if (m == NULL) {
1281                 ifp->if_ierrors++;
1282                 return;
1283         }
1284
1285         m->m_pkthdr.rcvif = ifp;
1286
1287         /* now read wi_frame first so we know how much data to read */
1288         if (wi_read_bap(sc, fid, 0, mtod(m, caddr_t), sizeof(*rx_frame))) {
1289                 ifp->if_ierrors++;
1290                 goto done;
1291         }
1292
1293         rx_frame = mtod(m, struct wi_frame *);
1294
1295         switch ((rx_frame->wi_status & WI_STAT_MAC_PORT) >> 8) {
1296         case 7:
1297                 switch (rx_frame->wi_whdr.i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
1298                 case IEEE80211_FC0_TYPE_DATA:
1299                         hdrlen = WI_DATA_HDRLEN;
1300                         datlen = rx_frame->wi_dat_len + WI_FCS_LEN;
1301                         break;
1302                 case IEEE80211_FC0_TYPE_MGT:
1303                         hdrlen = WI_MGMT_HDRLEN;
1304                         datlen = rx_frame->wi_dat_len + WI_FCS_LEN;
1305                         break;
1306                 case IEEE80211_FC0_TYPE_CTL:
1307                         /*
1308                          * prism2 cards don't pass control packets
1309                          * down properly or consistently, so we'll only
1310                          * pass down the header.
1311                          */
1312                         hdrlen = WI_CTL_HDRLEN;
1313                         datlen = 0;
1314                         break;
1315                 default:
1316                         if_printf(ifp, "received packet of unknown type "
1317                                 "on port 7\n");
1318                         ifp->if_ierrors++;
1319                         goto done;
1320                 }
1321                 break;
1322         case 0:
1323                 hdrlen = WI_DATA_HDRLEN;
1324                 datlen = rx_frame->wi_dat_len + WI_FCS_LEN;
1325                 break;
1326         default:
1327                 if_printf(ifp, "received packet on invalid "
1328                     "port (wi_status=0x%x)\n", rx_frame->wi_status);
1329                 ifp->if_ierrors++;
1330                 goto done;
1331         }
1332
1333         if (hdrlen + datlen + 2 > MCLBYTES) {
1334                 if_printf(ifp, "oversized packet received "
1335                     "(wi_dat_len=%d, wi_status=0x%x)\n",
1336                     datlen, rx_frame->wi_status);
1337                 ifp->if_ierrors++;
1338                 goto done;
1339         }
1340
1341         if (wi_read_bap(sc, fid, hdrlen, mtod(m, caddr_t) + hdrlen,
1342             datlen + 2) == 0) {
1343                 m->m_pkthdr.len = m->m_len = hdrlen + datlen;
1344                 ifp->if_ipackets++;
1345                 BPF_MTAP(ifp, m);       /* Handle BPF listeners. */
1346         } else
1347                 ifp->if_ierrors++;
1348 done:
1349         m_freem(m);
1350 }
1351
1352 static void
1353 wi_rx_intr(struct wi_softc *sc)
1354 {
1355         struct ieee80211com *ic = &sc->sc_ic;
1356         struct ifnet *ifp = &ic->ic_if;
1357         struct wi_frame frmhdr;
1358         struct mbuf *m;
1359         struct ieee80211_frame *wh;
1360         struct ieee80211_node *ni;
1361         int fid, len, off, rssi;
1362         u_int8_t dir;
1363         u_int16_t status;
1364         u_int32_t rstamp;
1365
1366         fid = CSR_READ_2(sc, WI_RX_FID);
1367
1368         if (sc->wi_debug.wi_monitor) {
1369                 /*
1370                  * If we are in monitor mode just
1371                  * read the data from the device.
1372                  */
1373                 wi_rx_monitor(sc, fid);
1374                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_RX);
1375                 return;
1376         }
1377
1378         /* First read in the frame header */
1379         if (wi_read_bap(sc, fid, 0, &frmhdr, sizeof(frmhdr))) {
1380                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_RX);
1381                 ifp->if_ierrors++;
1382                 DPRINTF((ifp, "wi_rx_intr: read fid %x failed\n", fid));
1383                 return;
1384         }
1385
1386         if (IFF_DUMPPKTS(ifp))
1387                 wi_dump_pkt(&frmhdr, NULL, frmhdr.wi_rx_signal);
1388
1389         /*
1390          * Drop undecryptable or packets with receive errors here
1391          */
1392         status = le16toh(frmhdr.wi_status);
1393         if (status & WI_STAT_ERRSTAT) {
1394                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_RX);
1395                 ifp->if_ierrors++;
1396                 DPRINTF((ifp, "wi_rx_intr: fid %x error status %x\n",
1397                          fid, status));
1398                 return;
1399         }
1400         rssi = frmhdr.wi_rx_signal;
1401         rstamp = (le16toh(frmhdr.wi_rx_tstamp0) << 16) |
1402             le16toh(frmhdr.wi_rx_tstamp1);
1403
1404         len = le16toh(frmhdr.wi_dat_len);
1405         off = ALIGN(sizeof(struct ieee80211_frame));
1406
1407         /*
1408          * Sometimes the PRISM2.x returns bogusly large frames. Except
1409          * in monitor mode, just throw them away.
1410          */
1411         if (off + len > MCLBYTES) {
1412                 if (ic->ic_opmode != IEEE80211_M_MONITOR) {
1413                         CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_RX);
1414                         ifp->if_ierrors++;
1415                         DPRINTF((ifp, "wi_rx_intr: oversized packet\n"));
1416                         return;
1417                 } else
1418                         len = 0;
1419         }
1420
1421         m = m_getl(off + len, MB_DONTWAIT, MT_DATA, M_PKTHDR, NULL);
1422         if (m == NULL) {
1423                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_RX);
1424                 ifp->if_ierrors++;
1425                 DPRINTF((ifp, "wi_rx_intr: m_getl failed\n"));
1426                 return;
1427         }
1428
1429         m->m_data += off - sizeof(struct ieee80211_frame);
1430         memcpy(m->m_data, &frmhdr.wi_whdr, sizeof(struct ieee80211_frame));
1431         wi_read_bap(sc, fid, sizeof(frmhdr),
1432             m->m_data + sizeof(struct ieee80211_frame), len);
1433         m->m_pkthdr.len = m->m_len = sizeof(struct ieee80211_frame) + len;
1434         m->m_pkthdr.rcvif = ifp;
1435
1436         CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_RX);
1437
1438         if (sc->sc_drvbpf) {
1439                 /* XXX replace divide by table */
1440                 sc->sc_rx_th.wr_rate = frmhdr.wi_rx_rate / 5;
1441                 sc->sc_rx_th.wr_antsignal = frmhdr.wi_rx_signal;
1442                 sc->sc_rx_th.wr_antnoise = frmhdr.wi_rx_silence;
1443                 sc->sc_rx_th.wr_flags = 0;
1444                 if (frmhdr.wi_status & WI_STAT_PCF)
1445                         sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_CFP;
1446                 bpf_ptap(sc->sc_drvbpf, m, &sc->sc_rx_th, sc->sc_rx_th_len);
1447         }
1448
1449         wh = mtod(m, struct ieee80211_frame *);
1450         if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1451                 /*
1452                  * WEP is decrypted by hardware. Clear WEP bit
1453                  * header for ieee80211_input().
1454                  */
1455                 wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
1456         }
1457
1458         /* synchronize driver's BSSID with firmware's BSSID */
1459         dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
1460         if (ic->ic_opmode == IEEE80211_M_IBSS && dir == IEEE80211_FC1_DIR_NODS)
1461                 wi_sync_bssid(sc, wh->i_addr3);
1462
1463         /*
1464          * Locate the node for sender, track state, and
1465          * then pass this node (referenced) up to the 802.11
1466          * layer for its use.  We are required to pass
1467          * something so we fallback to ic_bss when this frame
1468          * is from an unknown sender.
1469          */
1470         if (ic->ic_opmode != IEEE80211_M_STA) {
1471                 ni = ieee80211_find_node(ic, wh->i_addr2);
1472                 if (ni == NULL)
1473                         ni = ieee80211_ref_node(ic->ic_bss);
1474         } else
1475                 ni = ieee80211_ref_node(ic->ic_bss);
1476         /*
1477          * Send frame up for processing.
1478          */
1479         ieee80211_input(ifp, m, ni, rssi, rstamp);
1480         /*
1481          * The frame may have caused the node to be marked for
1482          * reclamation (e.g. in response to a DEAUTH message)
1483          * so use free_node here instead of unref_node.
1484          */
1485         if (ni == ic->ic_bss)
1486                 ieee80211_unref_node(&ni);
1487         else
1488                 ieee80211_free_node(ic, ni);
1489 }
1490
1491 static void
1492 wi_tx_ex_intr(struct wi_softc *sc)
1493 {
1494         struct ieee80211com *ic = &sc->sc_ic;
1495         struct ifnet *ifp = &ic->ic_if;
1496         struct wi_frame frmhdr;
1497         int fid;
1498
1499         fid = CSR_READ_2(sc, WI_TX_CMP_FID);
1500         /* Read in the frame header */
1501         if (wi_read_bap(sc, fid, 0, &frmhdr, sizeof(frmhdr)) == 0) {
1502                 u_int16_t status = le16toh(frmhdr.wi_status);
1503
1504                 /*
1505                  * Spontaneous station disconnects appear as xmit
1506                  * errors.  Don't announce them and/or count them
1507                  * as an output error.
1508                  */
1509                 if ((status & WI_TXSTAT_DISCONNECT) == 0) {
1510                         if (ppsratecheck(&lasttxerror, &curtxeps, wi_txerate)) {
1511                                 if_printf(ifp, "tx failed");
1512                                 if (status & WI_TXSTAT_RET_ERR)
1513                                         printf(", retry limit exceeded");
1514                                 if (status & WI_TXSTAT_AGED_ERR)
1515                                         printf(", max transmit lifetime exceeded");
1516                                 if (status & WI_TXSTAT_DISCONNECT)
1517                                         printf(", port disconnected");
1518                                 if (status & WI_TXSTAT_FORM_ERR)
1519                                         printf(", invalid format (data len %u src %6D)",
1520                                                 le16toh(frmhdr.wi_dat_len),
1521                                                 frmhdr.wi_ehdr.ether_shost, ":");
1522                                 if (status & ~0xf)
1523                                         printf(", status=0x%x", status);
1524                                 printf("\n");
1525                         }
1526                         ifp->if_oerrors++;
1527                 } else {
1528                         DPRINTF((ifp, "port disconnected\n"));
1529                         ifp->if_collisions++;   /* XXX */
1530                 }
1531         } else
1532                 DPRINTF((ifp, "wi_tx_ex_intr: read fid %x failed\n", fid));
1533         CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_TX_EXC);
1534 }
1535
1536 static void
1537 wi_tx_intr(struct wi_softc *sc)
1538 {
1539         struct ieee80211com *ic = &sc->sc_ic;
1540         struct ifnet *ifp = &ic->ic_if;
1541         int fid, cur;
1542
1543         if (sc->wi_gone)
1544                 return;
1545
1546         fid = CSR_READ_2(sc, WI_ALLOC_FID);
1547         CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_ALLOC);
1548
1549         cur = sc->sc_txcur;
1550         if (sc->sc_txd[cur].d_fid != fid) {
1551                 if_printf(ifp, "bad alloc %x != %x, cur %d nxt %d\n",
1552                     fid, sc->sc_txd[cur].d_fid, cur, sc->sc_txnext);
1553                 return;
1554         }
1555         sc->sc_tx_timer = 0;
1556         sc->sc_txd[cur].d_len = 0;
1557         sc->sc_txcur = cur = (cur + 1) % sc->sc_ntxbuf;
1558         if (sc->sc_txd[cur].d_len == 0)
1559                 ifp->if_flags &= ~IFF_OACTIVE;
1560         else {
1561                 if (wi_cmd(sc, WI_CMD_TX | WI_RECLAIM, sc->sc_txd[cur].d_fid,
1562                     0, 0)) {
1563                         if_printf(ifp, "xmit failed\n");
1564                         sc->sc_txd[cur].d_len = 0;
1565                 } else {
1566                         sc->sc_tx_timer = 5;
1567                         ifp->if_timer = 1;
1568                 }
1569         }
1570 }
1571
1572 static void
1573 wi_info_intr(struct wi_softc *sc)
1574 {
1575         struct ieee80211com *ic = &sc->sc_ic;
1576         struct ifnet *ifp = &ic->ic_if;
1577         int i, fid, len, off;
1578         u_int16_t ltbuf[2];
1579         u_int16_t stat;
1580         u_int32_t *ptr;
1581
1582         fid = CSR_READ_2(sc, WI_INFO_FID);
1583         wi_read_bap(sc, fid, 0, ltbuf, sizeof(ltbuf));
1584
1585         switch (le16toh(ltbuf[1])) {
1586
1587         case WI_INFO_LINK_STAT:
1588                 wi_read_bap(sc, fid, sizeof(ltbuf), &stat, sizeof(stat));
1589                 DPRINTF((ifp, "wi_info_intr: LINK_STAT 0x%x\n", le16toh(stat)));
1590                 switch (le16toh(stat)) {
1591                 case WI_INFO_LINK_STAT_CONNECTED:
1592                         sc->sc_flags &= ~WI_FLAGS_OUTRANGE;
1593                         if (ic->ic_state == IEEE80211_S_RUN &&
1594                             ic->ic_opmode != IEEE80211_M_IBSS)
1595                                 break;
1596                         /* FALLTHROUGH */
1597                 case WI_INFO_LINK_STAT_AP_CHG:
1598                         ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
1599                         break;
1600                 case WI_INFO_LINK_STAT_AP_INR:
1601                         sc->sc_flags &= ~WI_FLAGS_OUTRANGE;
1602                         break;
1603                 case WI_INFO_LINK_STAT_AP_OOR:
1604                         if (sc->sc_firmware_type == WI_SYMBOL &&
1605                             sc->sc_scan_timer > 0) {
1606                                 if (wi_cmd(sc, WI_CMD_INQUIRE,
1607                                     WI_INFO_HOST_SCAN_RESULTS, 0, 0) != 0)
1608                                         sc->sc_scan_timer = 0;
1609                                 break;
1610                         }
1611                         if (ic->ic_opmode == IEEE80211_M_STA)
1612                                 sc->sc_flags |= WI_FLAGS_OUTRANGE;
1613                         break;
1614                 case WI_INFO_LINK_STAT_DISCONNECTED:
1615                 case WI_INFO_LINK_STAT_ASSOC_FAILED:
1616                         if (ic->ic_opmode == IEEE80211_M_STA)
1617                                 ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
1618                         break;
1619                 }
1620                 break;
1621
1622         case WI_INFO_COUNTERS:
1623                 /* some card versions have a larger stats structure */
1624                 len = min(le16toh(ltbuf[0]) - 1, sizeof(sc->sc_stats) / 4);
1625                 ptr = (u_int32_t *)&sc->sc_stats;
1626                 off = sizeof(ltbuf);
1627                 for (i = 0; i < len; i++, off += 2, ptr++) {
1628                         wi_read_bap(sc, fid, off, &stat, sizeof(stat));
1629 #ifdef WI_HERMES_STATS_WAR
1630                         if (stat & 0xf000)
1631                                 stat = ~stat;
1632 #endif
1633                         *ptr += stat;
1634                 }
1635                 ifp->if_collisions = sc->sc_stats.wi_tx_single_retries +
1636                     sc->sc_stats.wi_tx_multi_retries +
1637                     sc->sc_stats.wi_tx_retry_limit;
1638                 break;
1639
1640         case WI_INFO_SCAN_RESULTS:
1641         case WI_INFO_HOST_SCAN_RESULTS:
1642                 wi_scan_result(sc, fid, le16toh(ltbuf[0]));
1643                 break;
1644
1645         default:
1646                 DPRINTF((ifp, "wi_info_intr: got fid %x type %x len %d\n", fid,
1647                     le16toh(ltbuf[1]), le16toh(ltbuf[0])));
1648                 break;
1649         }
1650         CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_INFO);
1651 }
1652
1653 static int
1654 wi_write_multi(struct wi_softc *sc)
1655 {
1656         struct ifnet *ifp = &sc->sc_ic.ic_if;
1657         int n;
1658         struct ifmultiaddr *ifma;
1659         struct wi_mcast mlist;
1660
1661         if (ifp->if_flags & IFF_ALLMULTI || ifp->if_flags & IFF_PROMISC) {
1662 allmulti:
1663                 memset(&mlist, 0, sizeof(mlist));
1664                 return wi_write_rid(sc, WI_RID_MCAST_LIST, &mlist,
1665                     sizeof(mlist));
1666         }
1667
1668         n = 0;
1669         LIST_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
1670                 if (ifma->ifma_addr->sa_family != AF_LINK)
1671                         continue;
1672                 if (n >= 16)
1673                         goto allmulti;
1674                 IEEE80211_ADDR_COPY(&mlist.wi_mcast[n],
1675                     (LLADDR((struct sockaddr_dl *)ifma->ifma_addr)));
1676                 n++;
1677         }
1678         return wi_write_rid(sc, WI_RID_MCAST_LIST, &mlist,
1679             IEEE80211_ADDR_LEN * n);
1680 }
1681
1682 static void
1683 wi_read_nicid(struct wi_softc *sc)
1684 {
1685         struct wi_card_ident *id;
1686         char *p;
1687         int len;
1688         u_int16_t ver[4];
1689
1690         /* getting chip identity */
1691         memset(ver, 0, sizeof(ver));
1692         len = sizeof(ver);
1693         wi_read_rid(sc, WI_RID_CARD_ID, ver, &len);
1694         if_printf(&sc->sc_ic.ic_if, "using ");
1695
1696         sc->sc_firmware_type = WI_NOTYPE;
1697         for (id = wi_card_ident; id->card_name != NULL; id++) {
1698                 if (le16toh(ver[0]) == id->card_id) {
1699                         printf("%s", id->card_name);
1700                         sc->sc_firmware_type = id->firm_type;
1701                         break;
1702                 }
1703         }
1704         if (sc->sc_firmware_type == WI_NOTYPE) {
1705                 if (le16toh(ver[0]) & 0x8000) {
1706                         printf("Unknown PRISM2 chip");
1707                         sc->sc_firmware_type = WI_INTERSIL;
1708                 } else {
1709                         printf("Unknown Lucent chip");
1710                         sc->sc_firmware_type = WI_LUCENT;
1711                 }
1712         }
1713
1714         /* get primary firmware version (Only Prism chips) */
1715         if (sc->sc_firmware_type != WI_LUCENT) {
1716                 memset(ver, 0, sizeof(ver));
1717                 len = sizeof(ver);
1718                 wi_read_rid(sc, WI_RID_PRI_IDENTITY, ver, &len);
1719                 sc->sc_pri_firmware_ver = le16toh(ver[2]) * 10000 +
1720                     le16toh(ver[3]) * 100 + le16toh(ver[1]);
1721         }
1722
1723         /* get station firmware version */
1724         memset(ver, 0, sizeof(ver));
1725         len = sizeof(ver);
1726         wi_read_rid(sc, WI_RID_STA_IDENTITY, ver, &len);
1727         sc->sc_sta_firmware_ver = le16toh(ver[2]) * 10000 +
1728             le16toh(ver[3]) * 100 + le16toh(ver[1]);
1729         if (sc->sc_firmware_type == WI_INTERSIL &&
1730             (sc->sc_sta_firmware_ver == 10102 ||
1731              sc->sc_sta_firmware_ver == 20102)) {
1732                 char ident[12];
1733                 memset(ident, 0, sizeof(ident));
1734                 len = sizeof(ident);
1735                 /* value should be the format like "V2.00-11" */
1736                 if (wi_read_rid(sc, WI_RID_SYMBOL_IDENTITY, ident, &len) == 0 &&
1737                     *(p = (char *)ident) >= 'A' &&
1738                     p[2] == '.' && p[5] == '-' && p[8] == '\0') {
1739                         sc->sc_firmware_type = WI_SYMBOL;
1740                         sc->sc_sta_firmware_ver = (p[1] - '0') * 10000 +
1741                             (p[3] - '0') * 1000 + (p[4] - '0') * 100 +
1742                             (p[6] - '0') * 10 + (p[7] - '0');
1743                 }
1744         }
1745         printf("\n");
1746         if_printf(&sc->sc_ic.ic_if, "%s Firmware: ",
1747              sc->sc_firmware_type == WI_LUCENT ? "Lucent" :
1748             (sc->sc_firmware_type == WI_SYMBOL ? "Symbol" : "Intersil"));
1749         if (sc->sc_firmware_type != WI_LUCENT)  /* XXX */
1750                 printf("Primary (%u.%u.%u), ",
1751                     sc->sc_pri_firmware_ver / 10000,
1752                     (sc->sc_pri_firmware_ver % 10000) / 100,
1753                     sc->sc_pri_firmware_ver % 100);
1754         printf("Station (%u.%u.%u)\n",
1755             sc->sc_sta_firmware_ver / 10000,
1756             (sc->sc_sta_firmware_ver % 10000) / 100,
1757             sc->sc_sta_firmware_ver % 100);
1758 }
1759
1760 static int
1761 wi_write_ssid(struct wi_softc *sc, int rid, u_int8_t *buf, int buflen)
1762 {
1763         struct wi_ssid ssid;
1764
1765         if (buflen > IEEE80211_NWID_LEN)
1766                 return ENOBUFS;
1767         memset(&ssid, 0, sizeof(ssid));
1768         ssid.wi_len = htole16(buflen);
1769         memcpy(ssid.wi_ssid, buf, buflen);
1770         return wi_write_rid(sc, rid, &ssid, sizeof(ssid));
1771 }
1772
1773 static int
1774 wi_get_cfg(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
1775 {
1776         struct wi_softc *sc = ifp->if_softc;
1777         struct ieee80211com *ic = &sc->sc_ic;
1778         struct ifreq *ifr = (struct ifreq *)data;
1779         struct wi_req wreq;
1780         struct wi_scan_res *res;
1781         size_t reslen;
1782         int len, n, error, mif, val, off, i;
1783
1784         error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1785         if (error)
1786                 return error;
1787         len = (wreq.wi_len - 1) * 2;
1788         if (len < sizeof(u_int16_t))
1789                 return ENOSPC;
1790         if (len > sizeof(wreq.wi_val))
1791                 len = sizeof(wreq.wi_val);
1792
1793         switch (wreq.wi_type) {
1794
1795         case WI_RID_IFACE_STATS:
1796                 memcpy(wreq.wi_val, &sc->sc_stats, sizeof(sc->sc_stats));
1797                 if (len < sizeof(sc->sc_stats))
1798                         error = ENOSPC;
1799                 else
1800                         len = sizeof(sc->sc_stats);
1801                 break;
1802
1803         case WI_RID_ENCRYPTION:
1804         case WI_RID_TX_CRYPT_KEY:
1805         case WI_RID_DEFLT_CRYPT_KEYS:
1806         case WI_RID_TX_RATE:
1807                 return ieee80211_cfgget(ifp, cmd, data, cr);
1808
1809         case WI_RID_MICROWAVE_OVEN:
1810                 if (sc->sc_enabled && (sc->sc_flags & WI_FLAGS_HAS_MOR)) {
1811                         error = wi_read_rid(sc, wreq.wi_type, wreq.wi_val,
1812                             &len);
1813                         break;
1814                 }
1815                 wreq.wi_val[0] = htole16(sc->sc_microwave_oven);
1816                 len = sizeof(u_int16_t);
1817                 break;
1818
1819         case WI_RID_DBM_ADJUST:
1820                 if (sc->sc_enabled && (sc->sc_flags & WI_FLAGS_HAS_DBMADJUST)) {
1821                         error = wi_read_rid(sc, wreq.wi_type, wreq.wi_val,
1822                             &len);
1823                         break;
1824                 }
1825                 wreq.wi_val[0] = htole16(sc->sc_dbm_offset);
1826                 len = sizeof(u_int16_t);
1827                 break;
1828
1829         case WI_RID_ROAMING_MODE:
1830                 if (sc->sc_enabled && (sc->sc_flags & WI_FLAGS_HAS_ROAMING)) {
1831                         error = wi_read_rid(sc, wreq.wi_type, wreq.wi_val,
1832                             &len);
1833                         break;
1834                 }
1835                 wreq.wi_val[0] = htole16(sc->sc_roaming_mode);
1836                 len = sizeof(u_int16_t);
1837                 break;
1838
1839         case WI_RID_SYSTEM_SCALE:
1840                 if (sc->sc_enabled && (sc->sc_flags & WI_FLAGS_HAS_SYSSCALE)) {
1841                         error = wi_read_rid(sc, wreq.wi_type, wreq.wi_val,
1842                             &len);
1843                         break;
1844                 }
1845                 wreq.wi_val[0] = htole16(sc->sc_system_scale);
1846                 len = sizeof(u_int16_t);
1847                 break;
1848
1849         case WI_RID_FRAG_THRESH:
1850                 if (sc->sc_enabled && (sc->sc_flags & WI_FLAGS_HAS_FRAGTHR)) {
1851                         error = wi_read_rid(sc, wreq.wi_type, wreq.wi_val,
1852                             &len);
1853                         break;
1854                 }
1855                 wreq.wi_val[0] = htole16(ic->ic_fragthreshold);
1856                 len = sizeof(u_int16_t);
1857                 break;
1858
1859         case WI_RID_READ_APS:
1860                 if (ic->ic_opmode == IEEE80211_M_HOSTAP)
1861                         return ieee80211_cfgget(ifp, cmd, data, cr);
1862                 if (sc->sc_scan_timer > 0) {
1863                         error = EINPROGRESS;
1864                         break;
1865                 }
1866                 n = sc->sc_naps;
1867                 if (len < sizeof(n)) {
1868                         error = ENOSPC;
1869                         break;
1870                 }
1871                 if (len < sizeof(n) + sizeof(struct wi_apinfo) * n)
1872                         n = (len - sizeof(n)) / sizeof(struct wi_apinfo);
1873                 len = sizeof(n) + sizeof(struct wi_apinfo) * n;
1874                 memcpy(wreq.wi_val, &n, sizeof(n));
1875                 memcpy((caddr_t)wreq.wi_val + sizeof(n), sc->sc_aps,
1876                     sizeof(struct wi_apinfo) * n);
1877                 break;
1878
1879         case WI_RID_PRISM2:
1880                 wreq.wi_val[0] = sc->sc_firmware_type != WI_LUCENT;
1881                 len = sizeof(u_int16_t);
1882                 break;
1883
1884         case WI_RID_MIF:
1885                 mif = wreq.wi_val[0];
1886                 error = wi_cmd(sc, WI_CMD_READMIF, mif, 0, 0);
1887                 val = CSR_READ_2(sc, WI_RESP0);
1888                 wreq.wi_val[0] = val;
1889                 len = sizeof(u_int16_t);
1890                 break;
1891
1892         case WI_RID_ZERO_CACHE:
1893         case WI_RID_PROCFRAME:          /* ignore for compatibility */
1894                 /* XXX ??? */
1895                 break;
1896
1897         case WI_RID_READ_CACHE:
1898                 return ieee80211_cfgget(ifp, cmd, data, cr);
1899
1900         case WI_RID_SCAN_RES:           /* compatibility interface */
1901                 if (ic->ic_opmode == IEEE80211_M_HOSTAP)
1902                         return ieee80211_cfgget(ifp, cmd, data, cr);
1903                 if (sc->sc_scan_timer > 0) {
1904                         error = EINPROGRESS;
1905                         break;
1906                 }
1907                 n = sc->sc_naps;
1908                 if (sc->sc_firmware_type == WI_LUCENT) {
1909                         off = 0;
1910                         reslen = WI_WAVELAN_RES_SIZE;
1911                 } else {
1912                         off = sizeof(struct wi_scan_p2_hdr);
1913                         reslen = WI_PRISM2_RES_SIZE;
1914                 }
1915                 if (len < off + reslen * n)
1916                         n = (len - off) / reslen;
1917                 len = off + reslen * n;
1918                 if (off != 0) {
1919                         struct wi_scan_p2_hdr *p2 = (struct wi_scan_p2_hdr *)wreq.wi_val;
1920                         /*
1921                          * Prepend Prism-specific header.
1922                          */
1923                         if (len < sizeof(struct wi_scan_p2_hdr)) {
1924                                 error = ENOSPC;
1925                                 break;
1926                         }
1927                         p2 = (struct wi_scan_p2_hdr *)wreq.wi_val;
1928                         p2->wi_rsvd = 0;
1929                         p2->wi_reason = n;      /* XXX */
1930                 }
1931                 for (i = 0; i < n; i++, off += reslen) {
1932                         const struct wi_apinfo *ap = &sc->sc_aps[i];
1933
1934                         res = (struct wi_scan_res *)((char *)wreq.wi_val + off);
1935                         res->wi_chan = ap->channel;
1936                         res->wi_noise = ap->noise;
1937                         res->wi_signal = ap->signal;
1938                         IEEE80211_ADDR_COPY(res->wi_bssid, ap->bssid);
1939                         res->wi_interval = ap->interval;
1940                         res->wi_capinfo = ap->capinfo;
1941                         res->wi_ssid_len = ap->namelen;
1942                         memcpy(res->wi_ssid, ap->name,
1943                                 IEEE80211_NWID_LEN);
1944                         if (sc->sc_firmware_type != WI_LUCENT) {
1945                                 /* XXX not saved from Prism cards */
1946                                 memset(res->wi_srates, 0,
1947                                         sizeof(res->wi_srates));
1948                                 res->wi_rate = ap->rate;
1949                                 res->wi_rsvd = 0;
1950                         }
1951                 }
1952                 break;
1953
1954         default:
1955                 if (sc->sc_enabled) {
1956                         error = wi_read_rid(sc, wreq.wi_type, wreq.wi_val,
1957                             &len);
1958                         break;
1959                 }
1960                 switch (wreq.wi_type) {
1961                 case WI_RID_MAX_DATALEN:
1962                         wreq.wi_val[0] = htole16(sc->sc_max_datalen);
1963                         len = sizeof(u_int16_t);
1964                         break;
1965                 case WI_RID_RTS_THRESH:
1966                         wreq.wi_val[0] = htole16(ic->ic_rtsthreshold);
1967                         len = sizeof(u_int16_t);
1968                         break;
1969                 case WI_RID_CNFAUTHMODE:
1970                         wreq.wi_val[0] = htole16(sc->sc_cnfauthmode);
1971                         len = sizeof(u_int16_t);
1972                         break;
1973                 case WI_RID_NODENAME:
1974                         if (len < sc->sc_nodelen + sizeof(u_int16_t)) {
1975                                 error = ENOSPC;
1976                                 break;
1977                         }
1978                         len = sc->sc_nodelen + sizeof(u_int16_t);
1979                         wreq.wi_val[0] = htole16((sc->sc_nodelen + 1) / 2);
1980                         memcpy(&wreq.wi_val[1], sc->sc_nodename,
1981                             sc->sc_nodelen);
1982                         break;
1983                 default:
1984                         return ieee80211_cfgget(ifp, cmd, data, cr);
1985                 }
1986                 break;
1987         }
1988         if (error)
1989                 return error;
1990         wreq.wi_len = (len + 1) / 2 + 1;
1991         return copyout(&wreq, ifr->ifr_data, (wreq.wi_len + 1) * 2);
1992 }
1993
1994 static int
1995 wi_set_cfg(struct ifnet *ifp, u_long cmd, caddr_t data)
1996 {
1997         struct wi_softc *sc = ifp->if_softc;
1998         struct ieee80211com *ic = &sc->sc_ic;
1999         struct ifreq *ifr = (struct ifreq *)data;
2000         struct wi_req wreq;
2001         struct mbuf *m;
2002         int i, len, error, mif, val;
2003         struct ieee80211_rateset *rs;
2004
2005         error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
2006         if (error)
2007                 return error;
2008         len = wreq.wi_len ? (wreq.wi_len - 1) * 2 : 0;
2009         switch (wreq.wi_type) {
2010         case WI_RID_DBM_ADJUST:
2011                 return ENODEV;
2012
2013         case WI_RID_NODENAME:
2014                 if (le16toh(wreq.wi_val[0]) * 2 > len ||
2015                     le16toh(wreq.wi_val[0]) > sizeof(sc->sc_nodename)) {
2016                         error = ENOSPC;
2017                         break;
2018                 }
2019                 if (sc->sc_enabled) {
2020                         error = wi_write_rid(sc, wreq.wi_type, wreq.wi_val,
2021                             len);
2022                         if (error)
2023                                 break;
2024                 }
2025                 sc->sc_nodelen = le16toh(wreq.wi_val[0]) * 2;
2026                 memcpy(sc->sc_nodename, &wreq.wi_val[1], sc->sc_nodelen);
2027                 break;
2028
2029         case WI_RID_MICROWAVE_OVEN:
2030         case WI_RID_ROAMING_MODE:
2031         case WI_RID_SYSTEM_SCALE:
2032         case WI_RID_FRAG_THRESH:
2033                 if (wreq.wi_type == WI_RID_MICROWAVE_OVEN &&
2034                     (sc->sc_flags & WI_FLAGS_HAS_MOR) == 0)
2035                         break;
2036                 if (wreq.wi_type == WI_RID_ROAMING_MODE &&
2037                     (sc->sc_flags & WI_FLAGS_HAS_ROAMING) == 0)
2038                         break;
2039                 if (wreq.wi_type == WI_RID_SYSTEM_SCALE &&
2040                     (sc->sc_flags & WI_FLAGS_HAS_SYSSCALE) == 0)
2041                         break;
2042                 if (wreq.wi_type == WI_RID_FRAG_THRESH &&
2043                     (sc->sc_flags & WI_FLAGS_HAS_FRAGTHR) == 0)
2044                         break;
2045                 /* FALLTHROUGH */
2046         case WI_RID_RTS_THRESH:
2047         case WI_RID_CNFAUTHMODE:
2048         case WI_RID_MAX_DATALEN:
2049                 if (sc->sc_enabled) {
2050                         error = wi_write_rid(sc, wreq.wi_type, wreq.wi_val,
2051                             sizeof(u_int16_t));
2052                         if (error)
2053                                 break;
2054                 }
2055                 switch (wreq.wi_type) {
2056                 case WI_RID_FRAG_THRESH:
2057                         ic->ic_fragthreshold = le16toh(wreq.wi_val[0]);
2058                         break;
2059                 case WI_RID_RTS_THRESH:
2060                         ic->ic_rtsthreshold = le16toh(wreq.wi_val[0]);
2061                         break;
2062                 case WI_RID_MICROWAVE_OVEN:
2063                         sc->sc_microwave_oven = le16toh(wreq.wi_val[0]);
2064                         break;
2065                 case WI_RID_ROAMING_MODE:
2066                         sc->sc_roaming_mode = le16toh(wreq.wi_val[0]);
2067                         break;
2068                 case WI_RID_SYSTEM_SCALE:
2069                         sc->sc_system_scale = le16toh(wreq.wi_val[0]);
2070                         break;
2071                 case WI_RID_CNFAUTHMODE:
2072                         sc->sc_cnfauthmode = le16toh(wreq.wi_val[0]);
2073                         break;
2074                 case WI_RID_MAX_DATALEN:
2075                         sc->sc_max_datalen = le16toh(wreq.wi_val[0]);
2076                         break;
2077                 }
2078                 break;
2079
2080         case WI_RID_TX_RATE:
2081                 switch (le16toh(wreq.wi_val[0])) {
2082                 case 3:
2083                         ic->ic_fixed_rate = -1;
2084                         break;
2085                 default:
2086                         rs = &ic->ic_sup_rates[IEEE80211_MODE_11B];
2087                         for (i = 0; i < rs->rs_nrates; i++) {
2088                                 if ((rs->rs_rates[i] & IEEE80211_RATE_VAL)
2089                                     / 2 == le16toh(wreq.wi_val[0]))
2090                                         break;
2091                         }
2092                         if (i == rs->rs_nrates)
2093                                 return EINVAL;
2094                         ic->ic_fixed_rate = i;
2095                 }
2096                 if (sc->sc_enabled)
2097                         error = wi_write_txrate(sc);
2098                 break;
2099
2100         case WI_RID_SCAN_APS:
2101                 if (sc->sc_enabled && ic->ic_opmode != IEEE80211_M_HOSTAP)
2102                         error = wi_scan_ap(sc, 0x3fff, 0x000f);
2103                 break;
2104
2105         case WI_RID_SCAN_REQ:           /* compatibility interface */
2106                 if (sc->sc_enabled && ic->ic_opmode != IEEE80211_M_HOSTAP)
2107                         error = wi_scan_ap(sc, wreq.wi_val[0], wreq.wi_val[1]);
2108                 break;
2109
2110         case WI_RID_MGMT_XMIT:
2111                 if (!sc->sc_enabled) {
2112                         error = ENETDOWN;
2113                         break;
2114                 }
2115                 if (ic->ic_mgtq.ifq_len > 5) {
2116                         error = EAGAIN;
2117                         break;
2118                 }
2119                 /* XXX wi_len looks in u_int8_t, not in u_int16_t */
2120                 m = m_devget((char *)&wreq.wi_val, wreq.wi_len, 0, ifp, NULL);
2121                 if (m == NULL) {
2122                         error = ENOMEM;
2123                         break;
2124                 }
2125                 IF_ENQUEUE(&ic->ic_mgtq, m);
2126                 break;
2127
2128         case WI_RID_MIF:
2129                 mif = wreq.wi_val[0];
2130                 val = wreq.wi_val[1];
2131                 error = wi_cmd(sc, WI_CMD_WRITEMIF, mif, val, 0);
2132                 break;
2133
2134         case WI_RID_PROCFRAME:          /* ignore for compatibility */
2135                 break;
2136
2137         case WI_RID_OWN_SSID:
2138                 if (le16toh(wreq.wi_val[0]) * 2 > len ||
2139                     le16toh(wreq.wi_val[0]) > IEEE80211_NWID_LEN) {
2140                         error = ENOSPC;
2141                         break;
2142                 }
2143                 memset(ic->ic_des_essid, 0, IEEE80211_NWID_LEN);
2144                 ic->ic_des_esslen = le16toh(wreq.wi_val[0]) * 2;
2145                 memcpy(ic->ic_des_essid, &wreq.wi_val[1], ic->ic_des_esslen);
2146                 error = ENETRESET;
2147                 break;
2148
2149         default:
2150                 if (sc->sc_enabled) {
2151                         error = wi_write_rid(sc, wreq.wi_type, wreq.wi_val,
2152                             len);
2153                         if (error)
2154                                 break;
2155                 }
2156                 error = ieee80211_cfgset(ifp, cmd, data);
2157                 break;
2158         }
2159         return error;
2160 }
2161
2162 static int
2163 wi_write_txrate(struct wi_softc *sc)
2164 {
2165         struct ieee80211com *ic = &sc->sc_ic;
2166         int i;
2167         u_int16_t rate;
2168
2169         if (ic->ic_fixed_rate < 0)
2170                 rate = 0;       /* auto */
2171         else
2172                 rate = (ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[ic->ic_fixed_rate] &
2173                     IEEE80211_RATE_VAL) / 2;
2174
2175         /* rate: 0, 1, 2, 5, 11 */
2176
2177         switch (sc->sc_firmware_type) {
2178         case WI_LUCENT:
2179                 switch (rate) {
2180                 case 0:                 /* auto == 11mbps auto */
2181                         rate = 3;
2182                         break;
2183                 /* case 1, 2 map to 1, 2*/
2184                 case 5:                 /* 5.5Mbps -> 4 */
2185                         rate = 4;
2186                         break;
2187                 case 11:                /* 11mbps -> 5 */
2188                         rate = 5;
2189                         break;
2190                 default:
2191                         break;
2192                 }
2193                 break;
2194         default:
2195                 /* Choose a bit according to this table.
2196                  *
2197                  * bit | data rate
2198                  * ----+-------------------
2199                  * 0   | 1Mbps
2200                  * 1   | 2Mbps
2201                  * 2   | 5.5Mbps
2202                  * 3   | 11Mbps
2203                  */
2204                 for (i = 8; i > 0; i >>= 1) {
2205                         if (rate >= i)
2206                                 break;
2207                 }
2208                 if (i == 0)
2209                         rate = 0xf;     /* auto */
2210                 else
2211                         rate = i;
2212                 break;
2213         }
2214         return wi_write_val(sc, WI_RID_TX_RATE, rate);
2215 }
2216
2217 static int
2218 wi_write_wep(struct wi_softc *sc)
2219 {
2220         struct ieee80211com *ic = &sc->sc_ic;
2221         int error = 0;
2222         int i, keylen;
2223         u_int16_t val;
2224         struct wi_key wkey[IEEE80211_WEP_NKID];
2225
2226         switch (sc->sc_firmware_type) {
2227         case WI_LUCENT:
2228                 val = (ic->ic_flags & IEEE80211_F_WEPON) ? 1 : 0;
2229                 error = wi_write_val(sc, WI_RID_ENCRYPTION, val);
2230                 if (error)
2231                         break;
2232                 error = wi_write_val(sc, WI_RID_TX_CRYPT_KEY, ic->ic_wep_txkey);
2233                 if (error)
2234                         break;
2235                 memset(wkey, 0, sizeof(wkey));
2236                 for (i = 0; i < IEEE80211_WEP_NKID; i++) {
2237                         keylen = ic->ic_nw_keys[i].wk_len;
2238                         wkey[i].wi_keylen = htole16(keylen);
2239                         memcpy(wkey[i].wi_keydat, ic->ic_nw_keys[i].wk_key,
2240                             keylen);
2241                 }
2242                 error = wi_write_rid(sc, WI_RID_DEFLT_CRYPT_KEYS,
2243                     wkey, sizeof(wkey));
2244                 break;
2245
2246         case WI_INTERSIL:
2247         case WI_SYMBOL:
2248                 if (ic->ic_flags & IEEE80211_F_WEPON) {
2249                         /*
2250                          * ONLY HWB3163 EVAL-CARD Firmware version
2251                          * less than 0.8 variant2
2252                          *
2253                          *   If promiscuous mode disable, Prism2 chip
2254                          *  does not work with WEP .
2255                          * It is under investigation for details.
2256                          * (ichiro@netbsd.org)
2257                          */
2258                         if (sc->sc_firmware_type == WI_INTERSIL &&
2259                             sc->sc_sta_firmware_ver < 802 ) {
2260                                 /* firm ver < 0.8 variant 2 */
2261                                 wi_write_val(sc, WI_RID_PROMISC, 1);
2262                         }
2263                         wi_write_val(sc, WI_RID_CNFAUTHMODE,
2264                             sc->sc_cnfauthmode);
2265                         val = PRIVACY_INVOKED | EXCLUDE_UNENCRYPTED;
2266                         /*
2267                          * Encryption firmware has a bug for HostAP mode.
2268                          */
2269                         if (sc->sc_firmware_type == WI_INTERSIL &&
2270                             ic->ic_opmode == IEEE80211_M_HOSTAP)
2271                                 val |= HOST_ENCRYPT;
2272                 } else {
2273                         wi_write_val(sc, WI_RID_CNFAUTHMODE,
2274                             IEEE80211_AUTH_OPEN);
2275                         val = HOST_ENCRYPT | HOST_DECRYPT;
2276                 }
2277                 error = wi_write_val(sc, WI_RID_P2_ENCRYPTION, val);
2278                 if (error)
2279                         break;
2280                 error = wi_write_val(sc, WI_RID_P2_TX_CRYPT_KEY,
2281                     ic->ic_wep_txkey);
2282                 if (error)
2283                         break;
2284                 /*
2285                  * It seems that the firmware accept 104bit key only if
2286                  * all the keys have 104bit length.  We get the length of
2287                  * the transmit key and use it for all other keys.
2288                  * Perhaps we should use software WEP for such situation.
2289                  */
2290                 keylen = ic->ic_nw_keys[ic->ic_wep_txkey].wk_len;
2291                 if (keylen > IEEE80211_WEP_KEYLEN)
2292                         keylen = 13;    /* 104bit keys */
2293                 else
2294                         keylen = IEEE80211_WEP_KEYLEN;
2295                 for (i = 0; i < IEEE80211_WEP_NKID; i++) {
2296                         error = wi_write_rid(sc, WI_RID_P2_CRYPT_KEY0 + i,
2297                             ic->ic_nw_keys[i].wk_key, keylen);
2298                         if (error)
2299                                 break;
2300                 }
2301                 break;
2302         }
2303         return error;
2304 }
2305
2306 static int
2307 wi_cmd(struct wi_softc *sc, int cmd, int val0, int val1, int val2)
2308 {
2309         int                     i, s = 0;
2310         static volatile int count  = 0;
2311
2312         if (sc->wi_gone)
2313                 return (ENODEV);
2314
2315         if (count > 0)
2316                 panic("Hey partner, hold on there!");
2317         count++;
2318
2319         /* wait for the busy bit to clear */
2320         for (i = sc->wi_cmd_count; i > 0; i--) {        /* 500ms */
2321                 if (!(CSR_READ_2(sc, WI_COMMAND) & WI_CMD_BUSY))
2322                         break;
2323                 DELAY(1*1000);  /* 1ms */
2324         }
2325         if (i == 0) {
2326                 if_printf(&sc->sc_ic.ic_if, "wi_cmd: busy bit won't clear.\n" );
2327                 sc->wi_gone = 1;
2328                 count--;
2329                 return(ETIMEDOUT);
2330         }
2331
2332         CSR_WRITE_2(sc, WI_PARAM0, val0);
2333         CSR_WRITE_2(sc, WI_PARAM1, val1);
2334         CSR_WRITE_2(sc, WI_PARAM2, val2);
2335         CSR_WRITE_2(sc, WI_COMMAND, cmd);
2336
2337         if (cmd == WI_CMD_INI) {
2338                 /* XXX: should sleep here. */
2339                 DELAY(100*1000);                /* 100ms delay for init */
2340         }
2341         for (i = 0; i < WI_TIMEOUT; i++) {
2342                 /*
2343                  * Wait for 'command complete' bit to be
2344                  * set in the event status register.
2345                  */
2346                 s = CSR_READ_2(sc, WI_EVENT_STAT);
2347                 if (s & WI_EV_CMD) {
2348                         /* Ack the event and read result code. */
2349                         s = CSR_READ_2(sc, WI_STATUS);
2350                         CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_CMD);
2351                         if (s & WI_STAT_CMD_RESULT) {
2352                                 count--;
2353                                 return(EIO);
2354                         }
2355                         break;
2356                 }
2357                 DELAY(WI_DELAY);
2358         }
2359
2360         count--;
2361         if (i == WI_TIMEOUT) {
2362                 if_printf(&sc->sc_ic.ic_if,
2363                     "timeout in wi_cmd 0x%04x; event status 0x%04x\n", cmd, s);
2364                 if (s == 0xffff)
2365                         sc->wi_gone = 1;
2366                 return(ETIMEDOUT);
2367         }
2368         return (0);
2369 }
2370
2371 static int
2372 wi_seek_bap(struct wi_softc *sc, int id, int off)
2373 {
2374         int i, status;
2375
2376         CSR_WRITE_2(sc, WI_SEL0, id);
2377         CSR_WRITE_2(sc, WI_OFF0, off);
2378
2379         for (i = 0; ; i++) {
2380                 status = CSR_READ_2(sc, WI_OFF0);
2381                 if ((status & WI_OFF_BUSY) == 0)
2382                         break;
2383                 if (i == WI_TIMEOUT) {
2384                         if_printf(&sc->sc_ic.ic_if,
2385                                   "timeout in wi_seek to %x/%x\n", id, off);
2386                         sc->sc_bap_off = WI_OFF_ERR;    /* invalidate */
2387                         if (status == 0xffff)
2388                                 sc->wi_gone = 1;
2389                         return ETIMEDOUT;
2390                 }
2391                 DELAY(1);
2392         }
2393         if (status & WI_OFF_ERR) {
2394                 if_printf(&sc->sc_ic.ic_if, "failed in wi_seek to %x/%x\n",
2395                           id, off);
2396                 sc->sc_bap_off = WI_OFF_ERR;    /* invalidate */
2397                 return EIO;
2398         }
2399         sc->sc_bap_id = id;
2400         sc->sc_bap_off = off;
2401         return 0;
2402 }
2403
2404 static int
2405 wi_read_bap(struct wi_softc *sc, int id, int off, void *buf, int buflen)
2406 {
2407         u_int16_t *ptr;
2408         int i, error, cnt;
2409
2410         if (buflen == 0)
2411                 return 0;
2412         if (id != sc->sc_bap_id || off != sc->sc_bap_off) {
2413                 if ((error = wi_seek_bap(sc, id, off)) != 0)
2414                         return error;
2415         }
2416         cnt = (buflen + 1) / 2;
2417         ptr = (u_int16_t *)buf;
2418         for (i = 0; i < cnt; i++)
2419                 *ptr++ = CSR_READ_2(sc, WI_DATA0);
2420         sc->sc_bap_off += cnt * 2;
2421         return 0;
2422 }
2423
2424 static int
2425 wi_write_bap(struct wi_softc *sc, int id, int off, void *buf, int buflen)
2426 {
2427         u_int16_t *ptr;
2428         int i, error, cnt;
2429
2430         if (buflen == 0)
2431                 return 0;
2432
2433 #ifdef WI_HERMES_AUTOINC_WAR
2434   again:
2435 #endif
2436         if (id != sc->sc_bap_id || off != sc->sc_bap_off) {
2437                 if ((error = wi_seek_bap(sc, id, off)) != 0)
2438                         return error;
2439         }
2440         cnt = (buflen + 1) / 2;
2441         ptr = (u_int16_t *)buf;
2442         for (i = 0; i < cnt; i++)
2443                 CSR_WRITE_2(sc, WI_DATA0, ptr[i]);
2444         sc->sc_bap_off += cnt * 2;
2445
2446 #ifdef WI_HERMES_AUTOINC_WAR
2447         /*
2448          * According to the comments in the HCF Light code, there is a bug
2449          * in the Hermes (or possibly in certain Hermes firmware revisions)
2450          * where the chip's internal autoincrement counter gets thrown off
2451          * during data writes:  the autoincrement is missed, causing one
2452          * data word to be overwritten and subsequent words to be written to
2453          * the wrong memory locations. The end result is that we could end
2454          * up transmitting bogus frames without realizing it. The workaround
2455          * for this is to write a couple of extra guard words after the end
2456          * of the transfer, then attempt to read then back. If we fail to
2457          * locate the guard words where we expect them, we preform the
2458          * transfer over again.
2459          */
2460         if ((sc->sc_flags & WI_FLAGS_BUG_AUTOINC) && (id & 0xf000) == 0) {
2461                 CSR_WRITE_2(sc, WI_DATA0, 0x1234);
2462                 CSR_WRITE_2(sc, WI_DATA0, 0x5678);
2463                 wi_seek_bap(sc, id, sc->sc_bap_off);
2464                 sc->sc_bap_off = WI_OFF_ERR;    /* invalidate */
2465                 if (CSR_READ_2(sc, WI_DATA0) != 0x1234 ||
2466                     CSR_READ_2(sc, WI_DATA0) != 0x5678) {
2467                         if_printf(&sc->sc_ic.ic_if,
2468                                   "detect auto increment bug, try again\n");
2469                         goto again;
2470                 }
2471         }
2472 #endif
2473         return 0;
2474 }
2475
2476 static int
2477 wi_mwrite_bap(struct wi_softc *sc, int id, int off, struct mbuf *m0, int totlen)
2478 {
2479         int error, len;
2480         struct mbuf *m;
2481
2482         for (m = m0; m != NULL && totlen > 0; m = m->m_next) {
2483                 if (m->m_len == 0)
2484                         continue;
2485
2486                 len = min(m->m_len, totlen);
2487
2488                 if (((u_long)m->m_data) % 2 != 0 || len % 2 != 0) {
2489                         m_copydata(m, 0, totlen, (caddr_t)&sc->sc_txbuf);
2490                         return wi_write_bap(sc, id, off, (caddr_t)&sc->sc_txbuf,
2491                             totlen);
2492                 }
2493
2494                 if ((error = wi_write_bap(sc, id, off, m->m_data, len)) != 0)
2495                         return error;
2496
2497                 off += m->m_len;
2498                 totlen -= len;
2499         }
2500         return 0;
2501 }
2502
2503 static int
2504 wi_alloc_fid(struct wi_softc *sc, int len, int *idp)
2505 {
2506         int i;
2507
2508         if (wi_cmd(sc, WI_CMD_ALLOC_MEM, len, 0, 0)) {
2509                 if_printf(&sc->sc_ic.ic_if,
2510                           "failed to allocate %d bytes on NIC\n", len);
2511                 return ENOMEM;
2512         }
2513
2514         for (i = 0; i < WI_TIMEOUT; i++) {
2515                 if (CSR_READ_2(sc, WI_EVENT_STAT) & WI_EV_ALLOC)
2516                         break;
2517                 if (i == WI_TIMEOUT) {
2518                         if_printf(&sc->sc_ic.ic_if, "timeout in alloc\n");
2519                         return ETIMEDOUT;
2520                 }
2521                 DELAY(1);
2522         }
2523         *idp = CSR_READ_2(sc, WI_ALLOC_FID);
2524         CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_ALLOC);
2525         return 0;
2526 }
2527
2528 static int
2529 wi_read_rid(struct wi_softc *sc, int rid, void *buf, int *buflenp)
2530 {
2531         int error, len;
2532         u_int16_t ltbuf[2];
2533
2534         /* Tell the NIC to enter record read mode. */
2535         error = wi_cmd(sc, WI_CMD_ACCESS | WI_ACCESS_READ, rid, 0, 0);
2536         if (error)
2537                 return error;
2538
2539         error = wi_read_bap(sc, rid, 0, ltbuf, sizeof(ltbuf));
2540         if (error)
2541                 return error;
2542
2543         if (le16toh(ltbuf[1]) != rid) {
2544                 if_printf(&sc->sc_ic.ic_if,
2545                           "record read mismatch, rid=%x, got=%x\n",
2546                           rid, le16toh(ltbuf[1]));
2547                 return EIO;
2548         }
2549         len = (le16toh(ltbuf[0]) - 1) * 2;       /* already got rid */
2550         if (*buflenp < len) {
2551                 if_printf(&sc->sc_ic.ic_if, "record buffer is too small, "
2552                           "rid=%x, size=%d, len=%d\n", rid, *buflenp, len);
2553                 return ENOSPC;
2554         }
2555         *buflenp = len;
2556         return wi_read_bap(sc, rid, sizeof(ltbuf), buf, len);
2557 }
2558
2559 static int
2560 wi_write_rid(struct wi_softc *sc, int rid, void *buf, int buflen)
2561 {
2562         int error;
2563         u_int16_t ltbuf[2];
2564
2565         ltbuf[0] = htole16((buflen + 1) / 2 + 1);        /* includes rid */
2566         ltbuf[1] = htole16(rid);
2567
2568         error = wi_write_bap(sc, rid, 0, ltbuf, sizeof(ltbuf));
2569         if (error)
2570                 return error;
2571         error = wi_write_bap(sc, rid, sizeof(ltbuf), buf, buflen);
2572         if (error)
2573                 return error;
2574
2575         return wi_cmd(sc, WI_CMD_ACCESS | WI_ACCESS_WRITE, rid, 0, 0);
2576 }
2577
2578 static int
2579 wi_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
2580 {
2581         struct ifnet *ifp = &ic->ic_if;
2582         struct wi_softc *sc = ifp->if_softc;
2583         struct ieee80211_node *ni = ic->ic_bss;
2584         int buflen;
2585         u_int16_t val;
2586         struct wi_ssid ssid;
2587         u_int8_t old_bssid[IEEE80211_ADDR_LEN];
2588
2589         DPRINTF((ifp, "%s: %s -> %s\n", __func__,
2590                 ieee80211_state_name[ic->ic_state],
2591                 ieee80211_state_name[nstate]));
2592
2593         switch (nstate) {
2594         case IEEE80211_S_INIT:
2595                 ic->ic_flags &= ~IEEE80211_F_SIBSS;
2596                 sc->sc_flags &= ~WI_FLAGS_OUTRANGE;
2597                 return (*sc->sc_newstate)(ic, nstate, arg);
2598
2599         case IEEE80211_S_RUN:
2600                 sc->sc_flags &= ~WI_FLAGS_OUTRANGE;
2601                 buflen = IEEE80211_ADDR_LEN;
2602                 wi_read_rid(sc, WI_RID_CURRENT_BSSID, ni->ni_bssid, &buflen);
2603                 IEEE80211_ADDR_COPY(ni->ni_macaddr, ni->ni_bssid);
2604                 buflen = sizeof(val);
2605                 wi_read_rid(sc, WI_RID_CURRENT_CHAN, &val, &buflen);
2606                 /* XXX validate channel */
2607                 ni->ni_chan = &ic->ic_channels[le16toh(val)];
2608                 sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
2609                         htole16(ni->ni_chan->ic_freq);
2610                 sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
2611                         htole16(ni->ni_chan->ic_flags);
2612
2613                 if (IEEE80211_ADDR_EQ(old_bssid, ni->ni_bssid))
2614                         sc->sc_false_syns++;
2615                 else
2616                         sc->sc_false_syns = 0;
2617
2618                 if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
2619                         ni->ni_esslen = ic->ic_des_esslen;
2620                         memcpy(ni->ni_essid, ic->ic_des_essid, ni->ni_esslen);
2621                         ni->ni_rates = ic->ic_sup_rates[IEEE80211_MODE_11B];
2622                         ni->ni_intval = ic->ic_lintval;
2623                         ni->ni_capinfo = IEEE80211_CAPINFO_ESS;
2624                         if (ic->ic_flags & IEEE80211_F_WEPON)
2625                                 ni->ni_capinfo |= IEEE80211_CAPINFO_PRIVACY;
2626                 } else {
2627                         /* XXX check return value */
2628                         buflen = sizeof(ssid);
2629                         wi_read_rid(sc, WI_RID_CURRENT_SSID, &ssid, &buflen);
2630                         ni->ni_esslen = le16toh(ssid.wi_len);
2631                         if (ni->ni_esslen > IEEE80211_NWID_LEN)
2632                                 ni->ni_esslen = IEEE80211_NWID_LEN;     /*XXX*/
2633                         memcpy(ni->ni_essid, ssid.wi_ssid, ni->ni_esslen);
2634                 }
2635                 break;
2636
2637         case IEEE80211_S_SCAN:
2638         case IEEE80211_S_AUTH:
2639         case IEEE80211_S_ASSOC:
2640                 break;
2641         }
2642
2643         ic->ic_state = nstate;          /* NB: skip normal ieee80211 handling */
2644         return 0;
2645 }
2646
2647 static int
2648 wi_scan_ap(struct wi_softc *sc, u_int16_t chanmask, u_int16_t txrate)
2649 {
2650         int error = 0;
2651         u_int16_t val[2];
2652
2653         if (!sc->sc_enabled)
2654                 return ENXIO;
2655         switch (sc->sc_firmware_type) {
2656         case WI_LUCENT:
2657                 (void)wi_cmd(sc, WI_CMD_INQUIRE, WI_INFO_SCAN_RESULTS, 0, 0);
2658                 break;
2659         case WI_INTERSIL:
2660                 val[0] = chanmask;      /* channel */
2661                 val[1] = txrate;        /* tx rate */
2662                 error = wi_write_rid(sc, WI_RID_SCAN_REQ, val, sizeof(val));
2663                 break;
2664         case WI_SYMBOL:
2665                 /*
2666                  * XXX only supported on 3.x ?
2667                  */
2668                 val[0] = BSCAN_BCAST | BSCAN_ONETIME;
2669                 error = wi_write_rid(sc, WI_RID_BCAST_SCAN_REQ,
2670                     val, sizeof(val[0]));
2671                 break;
2672         }
2673         if (error == 0) {
2674                 sc->sc_scan_timer = WI_SCAN_WAIT;
2675                 sc->sc_ic.ic_if.if_timer = 1;
2676                 DPRINTF((&sc->sc_ic.ic_if, "wi_scan_ap: start scanning, "
2677                         "chamask 0x%x txrate 0x%x\n", chanmask, txrate));
2678         }
2679         return error;
2680 }
2681
2682 static void
2683 wi_scan_result(struct wi_softc *sc, int fid, int cnt)
2684 {
2685 #define N(a)    (sizeof (a) / sizeof (a[0]))
2686         int i, naps, off, szbuf;
2687         struct wi_scan_header ws_hdr;   /* Prism2 header */
2688         struct wi_scan_data_p2 ws_dat;  /* Prism2 scantable*/
2689         struct wi_apinfo *ap;
2690
2691         off = sizeof(u_int16_t) * 2;
2692         memset(&ws_hdr, 0, sizeof(ws_hdr));
2693         switch (sc->sc_firmware_type) {
2694         case WI_INTERSIL:
2695                 wi_read_bap(sc, fid, off, &ws_hdr, sizeof(ws_hdr));
2696                 off += sizeof(ws_hdr);
2697                 szbuf = sizeof(struct wi_scan_data_p2);
2698                 break;
2699         case WI_SYMBOL:
2700                 szbuf = sizeof(struct wi_scan_data_p2) + 6;
2701                 break;
2702         case WI_LUCENT:
2703                 szbuf = sizeof(struct wi_scan_data);
2704                 break;
2705         default:
2706                 if_printf(&sc->sc_ic.ic_if,
2707                           "wi_scan_result: unknown firmware type %u\n",
2708                           sc->sc_firmware_type);
2709                 naps = 0;
2710                 goto done;
2711         }
2712         naps = (cnt * 2 + 2 - off) / szbuf;
2713         if (naps > N(sc->sc_aps))
2714                 naps = N(sc->sc_aps);
2715         sc->sc_naps = naps;
2716         /* Read Data */
2717         ap = sc->sc_aps;
2718         memset(&ws_dat, 0, sizeof(ws_dat));
2719         for (i = 0; i < naps; i++, ap++) {
2720                 wi_read_bap(sc, fid, off, &ws_dat,
2721                     (sizeof(ws_dat) < szbuf ? sizeof(ws_dat) : szbuf));
2722                 DPRINTF2((&sc->sc_ic.ic_if,
2723                           "wi_scan_result: #%d: off %d bssid %6D\n",
2724                           i, off, ws_dat.wi_bssid, ":"));
2725                 off += szbuf;
2726                 ap->scanreason = le16toh(ws_hdr.wi_reason);
2727                 memcpy(ap->bssid, ws_dat.wi_bssid, sizeof(ap->bssid));
2728                 ap->channel = le16toh(ws_dat.wi_chid);
2729                 ap->signal  = le16toh(ws_dat.wi_signal);
2730                 ap->noise   = le16toh(ws_dat.wi_noise);
2731                 ap->quality = ap->signal - ap->noise;
2732                 ap->capinfo = le16toh(ws_dat.wi_capinfo);
2733                 ap->interval = le16toh(ws_dat.wi_interval);
2734                 ap->rate    = le16toh(ws_dat.wi_rate);
2735                 ap->namelen = le16toh(ws_dat.wi_namelen);
2736                 if (ap->namelen > sizeof(ap->name))
2737                         ap->namelen = sizeof(ap->name);
2738                 memcpy(ap->name, ws_dat.wi_name, ap->namelen);
2739         }
2740 done:
2741         /* Done scanning */
2742         sc->sc_scan_timer = 0;
2743         DPRINTF((&sc->sc_ic.ic_if, "wi_scan_result: scan complete: ap %d\n",
2744                  naps));
2745 #undef N
2746 }
2747
2748 static void
2749 wi_dump_pkt(struct wi_frame *wh, struct ieee80211_node *ni, int rssi)
2750 {
2751         ieee80211_dump_pkt((u_int8_t *) &wh->wi_whdr, sizeof(wh->wi_whdr),
2752             ni ? ni->ni_rates.rs_rates[ni->ni_txrate] & IEEE80211_RATE_VAL : -1, rssi);
2753         printf(" status 0x%x rx_tstamp1 %u rx_tstamp0 0x%u rx_silence %u\n",
2754                 le16toh(wh->wi_status), le16toh(wh->wi_rx_tstamp1),
2755                 le16toh(wh->wi_rx_tstamp0), wh->wi_rx_silence);
2756         printf(" rx_signal %u rx_rate %u rx_flow %u\n",
2757                 wh->wi_rx_signal, wh->wi_rx_rate, wh->wi_rx_flow);
2758         printf(" tx_rtry %u tx_rate %u tx_ctl 0x%x dat_len %u\n",
2759                 wh->wi_tx_rtry, wh->wi_tx_rate,
2760                 le16toh(wh->wi_tx_ctl), le16toh(wh->wi_dat_len));
2761         printf(" ehdr dst %6D src %6D type 0x%x\n",
2762                 wh->wi_ehdr.ether_dhost, ":", wh->wi_ehdr.ether_shost, ":",
2763                 wh->wi_ehdr.ether_type);
2764 }
2765
2766 int
2767 wi_alloc(device_t dev, int rid)
2768 {
2769         struct wi_softc *sc = device_get_softc(dev);
2770
2771         if (sc->wi_bus_type != WI_BUS_PCI_NATIVE) {
2772                 sc->iobase_rid = rid;
2773                 sc->iobase = bus_alloc_resource(dev, SYS_RES_IOPORT,
2774                     &sc->iobase_rid, 0, ~0, (1 << 6),
2775                     rman_make_alignment_flags(1 << 6) | RF_ACTIVE);
2776                 if (!sc->iobase) {
2777                         device_printf(dev, "No I/O space?!\n");
2778                         return (ENXIO);
2779                 }
2780
2781                 sc->wi_io_addr = rman_get_start(sc->iobase);
2782                 sc->wi_btag = rman_get_bustag(sc->iobase);
2783                 sc->wi_bhandle = rman_get_bushandle(sc->iobase);
2784         } else {
2785                 sc->mem_rid = rid;
2786                 sc->mem = bus_alloc_resource_any(dev, SYS_RES_MEMORY,
2787                     &sc->mem_rid, RF_ACTIVE);
2788
2789                 if (!sc->mem) {
2790                         device_printf(dev, "No Mem space on prism2.5?\n");
2791                         return (ENXIO);
2792                 }
2793
2794                 sc->wi_btag = rman_get_bustag(sc->mem);
2795                 sc->wi_bhandle = rman_get_bushandle(sc->mem);
2796         }
2797
2798
2799         sc->irq_rid = 0;
2800         sc->irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &sc->irq_rid,
2801             RF_ACTIVE |
2802             ((sc->wi_bus_type == WI_BUS_PCCARD) ? 0 : RF_SHAREABLE));
2803
2804         if (!sc->irq) {
2805                 wi_free(dev);
2806                 device_printf(dev, "No irq?!\n");
2807                 return (ENXIO);
2808         }
2809
2810         return (0);
2811 }
2812
2813 void
2814 wi_free(device_t dev)
2815 {
2816         struct wi_softc *sc = device_get_softc(dev);
2817
2818         if (sc->iobase != NULL) {
2819                 bus_release_resource(dev, SYS_RES_IOPORT, sc->iobase_rid, sc->iobase);
2820                 sc->iobase = NULL;
2821         }
2822         if (sc->irq != NULL) {
2823                 bus_release_resource(dev, SYS_RES_IRQ, sc->irq_rid, sc->irq);
2824                 sc->irq = NULL;
2825         }
2826         if (sc->mem != NULL) {
2827                 bus_release_resource(dev, SYS_RES_MEMORY, sc->mem_rid, sc->mem);
2828                 sc->mem = NULL;
2829         }
2830 }
2831
2832 static int
2833 wi_get_debug(struct wi_softc *sc, struct wi_req *wreq)
2834 {
2835         int error = 0;
2836
2837         wreq->wi_len = 1;
2838
2839         switch (wreq->wi_type) {
2840         case WI_DEBUG_SLEEP:
2841                 wreq->wi_len++;
2842                 wreq->wi_val[0] = sc->wi_debug.wi_sleep;
2843                 break;
2844         case WI_DEBUG_DELAYSUPP:
2845                 wreq->wi_len++;
2846                 wreq->wi_val[0] = sc->wi_debug.wi_delaysupp;
2847                 break;
2848         case WI_DEBUG_TXSUPP:
2849                 wreq->wi_len++;
2850                 wreq->wi_val[0] = sc->wi_debug.wi_txsupp;
2851                 break;
2852         case WI_DEBUG_MONITOR:
2853                 wreq->wi_len++;
2854                 wreq->wi_val[0] = sc->wi_debug.wi_monitor;
2855                 break;
2856         case WI_DEBUG_LEDTEST:
2857                 wreq->wi_len += 3;
2858                 wreq->wi_val[0] = sc->wi_debug.wi_ledtest;
2859                 wreq->wi_val[1] = sc->wi_debug.wi_ledtest_param0;
2860                 wreq->wi_val[2] = sc->wi_debug.wi_ledtest_param1;
2861                 break;
2862         case WI_DEBUG_CONTTX:
2863                 wreq->wi_len += 2;
2864                 wreq->wi_val[0] = sc->wi_debug.wi_conttx;
2865                 wreq->wi_val[1] = sc->wi_debug.wi_conttx_param0;
2866                 break;
2867         case WI_DEBUG_CONTRX:
2868                 wreq->wi_len++;
2869                 wreq->wi_val[0] = sc->wi_debug.wi_contrx;
2870                 break;
2871         case WI_DEBUG_SIGSTATE:
2872                 wreq->wi_len += 2;
2873                 wreq->wi_val[0] = sc->wi_debug.wi_sigstate;
2874                 wreq->wi_val[1] = sc->wi_debug.wi_sigstate_param0;
2875                 break;
2876         case WI_DEBUG_CONFBITS:
2877                 wreq->wi_len += 2;
2878                 wreq->wi_val[0] = sc->wi_debug.wi_confbits;
2879                 wreq->wi_val[1] = sc->wi_debug.wi_confbits_param0;
2880                 break;
2881         default:
2882                 error = EIO;
2883                 break;
2884         }
2885
2886         return (error);
2887 }
2888
2889 static int
2890 wi_set_debug(struct wi_softc *sc, struct wi_req *wreq)
2891 {
2892         int error = 0;
2893         u_int16_t               cmd, param0 = 0, param1 = 0;
2894
2895         switch (wreq->wi_type) {
2896         case WI_DEBUG_RESET:
2897         case WI_DEBUG_INIT:
2898         case WI_DEBUG_CALENABLE:
2899                 break;
2900         case WI_DEBUG_SLEEP:
2901                 sc->wi_debug.wi_sleep = 1;
2902                 break;
2903         case WI_DEBUG_WAKE:
2904                 sc->wi_debug.wi_sleep = 0;
2905                 break;
2906         case WI_DEBUG_CHAN:
2907                 param0 = wreq->wi_val[0];
2908                 break;
2909         case WI_DEBUG_DELAYSUPP:
2910                 sc->wi_debug.wi_delaysupp = 1;
2911                 break;
2912         case WI_DEBUG_TXSUPP:
2913                 sc->wi_debug.wi_txsupp = 1;
2914                 break;
2915         case WI_DEBUG_MONITOR:
2916                 sc->wi_debug.wi_monitor = 1;
2917                 break;
2918         case WI_DEBUG_LEDTEST:
2919                 param0 = wreq->wi_val[0];
2920                 param1 = wreq->wi_val[1];
2921                 sc->wi_debug.wi_ledtest = 1;
2922                 sc->wi_debug.wi_ledtest_param0 = param0;
2923                 sc->wi_debug.wi_ledtest_param1 = param1;
2924                 break;
2925         case WI_DEBUG_CONTTX:
2926                 param0 = wreq->wi_val[0];
2927                 sc->wi_debug.wi_conttx = 1;
2928                 sc->wi_debug.wi_conttx_param0 = param0;
2929                 break;
2930         case WI_DEBUG_STOPTEST:
2931                 sc->wi_debug.wi_delaysupp = 0;
2932                 sc->wi_debug.wi_txsupp = 0;
2933                 sc->wi_debug.wi_monitor = 0;
2934                 sc->wi_debug.wi_ledtest = 0;
2935                 sc->wi_debug.wi_ledtest_param0 = 0;
2936                 sc->wi_debug.wi_ledtest_param1 = 0;
2937                 sc->wi_debug.wi_conttx = 0;
2938                 sc->wi_debug.wi_conttx_param0 = 0;
2939                 sc->wi_debug.wi_contrx = 0;
2940                 sc->wi_debug.wi_sigstate = 0;
2941                 sc->wi_debug.wi_sigstate_param0 = 0;
2942                 break;
2943         case WI_DEBUG_CONTRX:
2944                 sc->wi_debug.wi_contrx = 1;
2945                 break;
2946         case WI_DEBUG_SIGSTATE:
2947                 param0 = wreq->wi_val[0];
2948                 sc->wi_debug.wi_sigstate = 1;
2949                 sc->wi_debug.wi_sigstate_param0 = param0;
2950                 break;
2951         case WI_DEBUG_CONFBITS:
2952                 param0 = wreq->wi_val[0];
2953                 param1 = wreq->wi_val[1];
2954                 sc->wi_debug.wi_confbits = param0;
2955                 sc->wi_debug.wi_confbits_param0 = param1;
2956                 break;
2957         default:
2958                 error = EIO;
2959                 break;
2960         }
2961
2962         if (error)
2963                 return (error);
2964
2965         cmd = WI_CMD_DEBUG | (wreq->wi_type << 8);
2966         error = wi_cmd(sc, cmd, param0, param1, 0);
2967
2968         return (error);
2969 }
2970
2971 /*
2972  * Special routines to download firmware for Symbol CF card.
2973  * XXX: This should be modified generic into any PRISM-2 based card.
2974  */
2975
2976 #define WI_SBCF_PDIADDR         0x3100
2977
2978 /* unaligned load little endian */
2979 #define GETLE32(p)      ((p)[0] | ((p)[1]<<8) | ((p)[2]<<16) | ((p)[3]<<24))
2980 #define GETLE16(p)      ((p)[0] | ((p)[1]<<8))
2981
2982 int
2983 wi_symbol_load_firm(struct wi_softc *sc, const void *primsym, int primlen,
2984     const void *secsym, int seclen)
2985 {
2986         uint8_t ebuf[256];
2987         int i;
2988
2989         /* load primary code and run it */
2990         wi_symbol_set_hcr(sc, WI_HCR_EEHOLD);
2991         if (wi_symbol_write_firm(sc, primsym, primlen, NULL, 0))
2992                 return EIO;
2993         wi_symbol_set_hcr(sc, WI_HCR_RUN);
2994         for (i = 0; ; i++) {
2995                 if (i == 10)
2996                         return ETIMEDOUT;
2997                 tsleep(sc, 0, "wiinit", 1);
2998                 if (CSR_READ_2(sc, WI_CNTL) == WI_CNTL_AUX_ENA_STAT)
2999                         break;
3000                 /* write the magic key value to unlock aux port */
3001                 CSR_WRITE_2(sc, WI_PARAM0, WI_AUX_KEY0);
3002                 CSR_WRITE_2(sc, WI_PARAM1, WI_AUX_KEY1);
3003                 CSR_WRITE_2(sc, WI_PARAM2, WI_AUX_KEY2);
3004                 CSR_WRITE_2(sc, WI_CNTL, WI_CNTL_AUX_ENA_CNTL);
3005         }
3006
3007         /* issue read EEPROM command: XXX copied from wi_cmd() */
3008         CSR_WRITE_2(sc, WI_PARAM0, 0);
3009         CSR_WRITE_2(sc, WI_PARAM1, 0);
3010         CSR_WRITE_2(sc, WI_PARAM2, 0);
3011         CSR_WRITE_2(sc, WI_COMMAND, WI_CMD_READEE);
3012         for (i = 0; i < WI_TIMEOUT; i++) {
3013                 if (CSR_READ_2(sc, WI_EVENT_STAT) & WI_EV_CMD)
3014                         break;
3015                 DELAY(1);
3016         }
3017         CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_CMD);
3018
3019         CSR_WRITE_2(sc, WI_AUX_PAGE, WI_SBCF_PDIADDR / WI_AUX_PGSZ);
3020         CSR_WRITE_2(sc, WI_AUX_OFFSET, WI_SBCF_PDIADDR % WI_AUX_PGSZ);
3021         CSR_READ_MULTI_STREAM_2(sc, WI_AUX_DATA,
3022             (uint16_t *)ebuf, sizeof(ebuf) / 2);
3023         if (GETLE16(ebuf) > sizeof(ebuf))
3024                 return EIO;
3025         if (wi_symbol_write_firm(sc, secsym, seclen, ebuf + 4, GETLE16(ebuf)))
3026                 return EIO;
3027         return 0;
3028 }
3029
3030 static int
3031 wi_symbol_write_firm(struct wi_softc *sc, const void *buf, int buflen,
3032     const void *ebuf, int ebuflen)
3033 {
3034         const uint8_t *p, *ep, *q, *eq;
3035         char *tp;
3036         uint32_t addr, id, eid;
3037         int i, len, elen, nblk, pdrlen;
3038
3039         /*
3040          * Parse the header of the firmware image.
3041          */
3042         p = buf;
3043         ep = p + buflen;
3044         while (p < ep && *p++ != ' ');  /* FILE: */
3045         while (p < ep && *p++ != ' ');  /* filename */
3046         while (p < ep && *p++ != ' ');  /* type of the firmware */
3047         nblk = strtoul(p, &tp, 10);
3048         p = tp;
3049         pdrlen = strtoul(p + 1, &tp, 10);
3050         p = tp;
3051         while (p < ep && *p++ != 0x1a); /* skip rest of header */
3052
3053         /*
3054          * Block records: address[4], length[2], data[length];
3055          */
3056         for (i = 0; i < nblk; i++) {
3057                 addr = GETLE32(p);      p += 4;
3058                 len  = GETLE16(p);      p += 2;
3059                 CSR_WRITE_2(sc, WI_AUX_PAGE, addr / WI_AUX_PGSZ);
3060                 CSR_WRITE_2(sc, WI_AUX_OFFSET, addr % WI_AUX_PGSZ);
3061                 CSR_WRITE_MULTI_STREAM_2(sc, WI_AUX_DATA,
3062                     (const uint16_t *)p, len / 2);
3063                 p += len;
3064         }
3065
3066         /*
3067          * PDR: id[4], address[4], length[4];
3068          */
3069         for (i = 0; i < pdrlen; ) {
3070                 id   = GETLE32(p);      p += 4; i += 4;
3071                 addr = GETLE32(p);      p += 4; i += 4;
3072                 len  = GETLE32(p);      p += 4; i += 4;
3073                 /* replace PDR entry with the values from EEPROM, if any */
3074                 for (q = ebuf, eq = q + ebuflen; q < eq; q += elen * 2) {
3075                         elen = GETLE16(q);      q += 2;
3076                         eid  = GETLE16(q);      q += 2;
3077                         elen--;         /* elen includes eid */
3078                         if (eid == 0)
3079                                 break;
3080                         if (eid != id)
3081                                 continue;
3082                         CSR_WRITE_2(sc, WI_AUX_PAGE, addr / WI_AUX_PGSZ);
3083                         CSR_WRITE_2(sc, WI_AUX_OFFSET, addr % WI_AUX_PGSZ);
3084                         CSR_WRITE_MULTI_STREAM_2(sc, WI_AUX_DATA,
3085                             (const uint16_t *)q, len / 2);
3086                         break;
3087                 }
3088         }
3089         return 0;
3090 }
3091
3092 static int
3093 wi_symbol_set_hcr(struct wi_softc *sc, int mode)
3094 {
3095         uint16_t hcr;
3096
3097         CSR_WRITE_2(sc, WI_COR, WI_COR_RESET);
3098         tsleep(sc, 0, "wiinit", 1);
3099         hcr = CSR_READ_2(sc, WI_HCR);
3100         hcr = (hcr & WI_HCR_4WIRE) | (mode & ~WI_HCR_4WIRE);
3101         CSR_WRITE_2(sc, WI_HCR, hcr);
3102         tsleep(sc, 0, "wiinit", 1);
3103         CSR_WRITE_2(sc, WI_COR, WI_COR_IOMODE);
3104         tsleep(sc, 0, "wiinit", 1);
3105         return 0;
3106 }