sys/dev/netif/owi/if_owi.c

   1 /*
   2  * Copyright (c) 1997, 1998, 1999
   3  *      Bill Paul <wpaul@ctr.columbia.edu>.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  * 3. All advertising materials mentioning features or use of this software
  14  *    must display the following acknowledgement:
  15  *      This product includes software developed by Bill Paul.
  16  * 4. Neither the name of the author nor the names of any co-contributors
  17  *    may be used to endorse or promote products derived from this software
  18  *    without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
  21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
  24  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  30  * THE POSSIBILITY OF SUCH DAMAGE.
  31  *
  32  * $FreeBSD: src/sys/dev/wi/if_wi.c,v 1.103.2.2 2002/08/02 07:11:34 imp Exp $
  33  * $DragonFly: src/sys/dev/netif/owi/Attic/if_owi.c,v 1.11 2005/10/12 17:35:52 dillon Exp $
  34  */
  35
  36 /*
  37  * Lucent WaveLAN/IEEE 802.11 PCMCIA driver for FreeBSD.
  38  *
  39  * Written by Bill Paul <wpaul@ctr.columbia.edu>
  40  * Electrical Engineering Department
  41  * Columbia University, New York City
  42  */
  43
  44 /*
  45  * The WaveLAN/IEEE adapter is the second generation of the WaveLAN
  46  * from Lucent. Unlike the older cards, the new ones are programmed
  47  * entirely via a firmware-driven controller called the Hermes.
  48  * Unfortunately, Lucent will not release the Hermes programming manual
  49  * without an NDA (if at all). What they do release is an API library
  50  * called the HCF (Hardware Control Functions) which is supposed to
  51  * do the device-specific operations of a device driver for you. The
  52  * publically available version of the HCF library (the 'HCF Light') is
  53  * a) extremely gross, b) lacks certain features, particularly support
  54  * for 802.11 frames, and c) is contaminated by the GNU Public License.
  55  *
  56  * This driver does not use the HCF or HCF Light at all. Instead, it
  57  * programs the Hermes controller directly, using information gleaned
  58  * from the HCF Light code and corresponding documentation.
  59  *
  60  * This driver supports the ISA, PCMCIA and PCI versions of the Lucent
  61  * WaveLan cards (based on the Hermes chipset), as well as the newer
  62  * Prism 2 chipsets with firmware from Intersil and Symbol.
  63  */
  64
  65 #include <sys/param.h>
  66 #include <sys/systm.h>
  67 #include <sys/endian.h>
  68 #include <sys/sockio.h>
  69 #include <sys/mbuf.h>
  70 #include <sys/proc.h>
  71 #include <sys/kernel.h>
  72 #include <sys/socket.h>
  73 #include <sys/module.h>
  74 #include <sys/bus.h>
  75 #include <sys/random.h>
  76 #include <sys/syslog.h>
  77 #include <sys/sysctl.h>
  78 #include <sys/thread2.h>
  79
  80 #include <machine/bus.h>
  81 #include <machine/resource.h>
  82 #include <machine/clock.h>
  83 #include <sys/rman.h>
  84
  85 #include <net/if.h>
  86 #include <net/ifq_var.h>
  87 #include <net/if_arp.h>
  88 #include <net/ethernet.h>
  89 #include <net/if_dl.h>
  90 #include <net/if_media.h>
  91 #include <net/if_types.h>
  92 #include <netproto/802_11/ieee80211.h>
  93 #include <netproto/802_11/ieee80211_ioctl.h>
  94 #include <netproto/802_11/if_wavelan_ieee.h>
  95
  96 #include <netinet/in.h>
  97 #include <netinet/in_systm.h>
  98 #include <netinet/in_var.h>
  99 #include <netinet/ip.h>
 100 #include <netinet/if_ether.h>
 101
 102 #include <net/bpf.h>
 103
 104 #include "wi_hostap.h"
 105 #include "if_wivar.h"
 106 #include "if_wireg.h"
 107
 108 #define WI_CMD_DEBUG            0x0038 /* prism2 debug */
 109
 110 static void wi_intr(void *);
 111 static void wi_reset(struct wi_softc *);
 112 static int wi_ioctl(struct ifnet *, u_long, caddr_t, struct ucred *);
 113 static void wi_init(void *);
 114 static void wi_start(struct ifnet *);
 115 static void wi_stop(struct wi_softc *);
 116 static void wi_watchdog(struct ifnet *);
 117 static void wi_rxeof(struct wi_softc *);
 118 static void wi_txeof(struct wi_softc *, int);
 119 static void wi_update_stats(struct wi_softc *);
 120 static void wi_setmulti(struct wi_softc *);
 121
 122 static int wi_cmd(struct wi_softc *, int, int, int, int);
 123 static int wi_read_record(struct wi_softc *, struct wi_ltv_gen *);
 124 static int wi_write_record(struct wi_softc *, struct wi_ltv_gen *);
 125 static int wi_read_data(struct wi_softc *, int, int, caddr_t, int);
 126 static int wi_write_data(struct wi_softc *, int, int, caddr_t, int);
 127 static int wi_seek(struct wi_softc *, int, int, int);
 128 static int wi_alloc_nicmem(struct wi_softc *, int, int *);
 129 static void wi_inquire(void *);
 130 static void wi_setdef(struct wi_softc *, struct wi_req *);
 131
 132 #ifdef WICACHE
 133 static
 134 void wi_cache_store(struct wi_softc *, struct mbuf *, unsigned short);
 135 #endif
 136
 137 static int wi_get_cur_ssid(struct wi_softc *, char *, int *);
 138 static void wi_get_id(struct wi_softc *);
 139 static int wi_media_change(struct ifnet *);
 140 static void wi_media_status(struct ifnet *, struct ifmediareq *);
 141
 142 static int wi_get_debug(struct wi_softc *, struct wi_req *);
 143 static int wi_set_debug(struct wi_softc *, struct wi_req *);
 144
 145 DECLARE_DUMMY_MODULE(if_wi);
 146
 147 devclass_t owi_devclass;
 148
 149 static struct wi_card_ident wi_card_ident[] = {
 150         /* CARD_ID                      CARD_NAME               FIRM_TYPE */
 151         { WI_NIC_LUCENT_ID,             WI_NIC_LUCENT_STR,      WI_LUCENT },
 152         { WI_NIC_SONY_ID,               WI_NIC_SONY_STR,        WI_LUCENT },
 153         { WI_NIC_LUCENT_EMB_ID,         WI_NIC_LUCENT_EMB_STR,  WI_LUCENT },
 154         { WI_NIC_EVB2_ID,               WI_NIC_EVB2_STR,        WI_INTERSIL },
 155         { WI_NIC_HWB3763_ID,            WI_NIC_HWB3763_STR,     WI_INTERSIL },
 156         { WI_NIC_HWB3163_ID,            WI_NIC_HWB3163_STR,     WI_INTERSIL },
 157         { WI_NIC_HWB3163B_ID,           WI_NIC_HWB3163B_STR,    WI_INTERSIL },
 158         { WI_NIC_EVB3_ID,               WI_NIC_EVB3_STR,        WI_INTERSIL },
 159         { WI_NIC_HWB1153_ID,            WI_NIC_HWB1153_STR,     WI_INTERSIL },
 160         { WI_NIC_P2_SST_ID,             WI_NIC_P2_SST_STR,      WI_INTERSIL },
 161         { WI_NIC_EVB2_SST_ID,           WI_NIC_EVB2_SST_STR,    WI_INTERSIL },
 162         { WI_NIC_3842_EVA_ID,           WI_NIC_3842_EVA_STR,    WI_INTERSIL },
 163         { WI_NIC_3842_PCMCIA_AMD_ID,    WI_NIC_3842_PCMCIA_STR, WI_INTERSIL },
 164         { WI_NIC_3842_PCMCIA_SST_ID,    WI_NIC_3842_PCMCIA_STR, WI_INTERSIL },
 165         { WI_NIC_3842_PCMCIA_ATM_ID,    WI_NIC_3842_PCMCIA_STR, WI_INTERSIL },
 166         { WI_NIC_3842_MINI_AMD_ID,      WI_NIC_3842_MINI_STR,   WI_INTERSIL },
 167         { WI_NIC_3842_MINI_SST_ID,      WI_NIC_3842_MINI_STR,   WI_INTERSIL },
 168         { WI_NIC_3842_MINI_ATM_ID,      WI_NIC_3842_MINI_STR,   WI_INTERSIL },
 169         { WI_NIC_3842_PCI_AMD_ID,       WI_NIC_3842_PCI_STR,    WI_INTERSIL },
 170         { WI_NIC_3842_PCI_SST_ID,       WI_NIC_3842_PCI_STR,    WI_INTERSIL },
 171         { WI_NIC_3842_PCI_ATM_ID,       WI_NIC_3842_PCI_STR,    WI_INTERSIL },
 172         { WI_NIC_P3_PCMCIA_AMD_ID,      WI_NIC_P3_PCMCIA_STR,   WI_INTERSIL },
 173         { WI_NIC_P3_PCMCIA_SST_ID,      WI_NIC_P3_PCMCIA_STR,   WI_INTERSIL },
 174         { WI_NIC_P3_MINI_AMD_ID,        WI_NIC_P3_MINI_STR,     WI_INTERSIL },
 175         { WI_NIC_P3_MINI_SST_ID,        WI_NIC_P3_MINI_STR,     WI_INTERSIL },
 176         { 0,    NULL,   0 },
 177 };
 178
 179 int
 180 owi_generic_detach(dev)
 181         device_t                dev;
 182 {
 183         struct wi_softc *sc = device_get_softc(dev);
 184         struct ifnet *ifp = &sc->arpcom.ac_if;
 185
 186         crit_enter();
 187
 188         if (sc->wi_gone) {
 189                 device_printf(dev, "already unloaded\n");
 190                 crit_exit();
 191                 return(ENODEV);
 192         }
 193
 194         wi_stop(sc);
 195
 196         /* Delete all remaining media. */
 197         ifmedia_removeall(&sc->ifmedia);
 198
 199         ether_ifdetach(ifp);
 200         bus_teardown_intr(dev, sc->irq, sc->wi_intrhand);
 201
 202         crit_exit();
 203
 204         owi_free(dev);
 205         sc->wi_gone = 1;
 206
 207         return(0);
 208 }
 209
 210 int
 211 owi_generic_attach(device_t dev)
 212 {
 213         struct wi_softc         *sc;
 214         struct wi_ltv_macaddr   mac;
 215         struct wi_ltv_gen       gen;
 216         struct ifnet            *ifp;
 217         int                     error;
 218
 219         /* XXX maybe we need the splimp stuff here XXX */
 220         sc = device_get_softc(dev);
 221         ifp = &sc->arpcom.ac_if;
 222         callout_init(&sc->wi_stat_timer);
 223
 224 #if defined(__FreeBSD__) && __FreeBSD_version >= 500000
 225         mtx_init(&sc->wi_mtx, device_get_nameunit(dev), MTX_NETWORK_LOCK,
 226             MTX_DEF | MTX_RECURSE);
 227 #endif
 228
 229         /* Reset the NIC. */
 230         wi_reset(sc);
 231
 232         /*
 233          * Read the station address.
 234          * And do it twice. I've seen PRISM-based cards that return
 235          * an error when trying to read it the first time, which causes
 236          * the probe to fail.
 237          */
 238         mac.wi_type = WI_RID_MAC_NODE;
 239         mac.wi_len = 4;
 240         wi_read_record(sc, (struct wi_ltv_gen *)&mac);
 241         if ((error = wi_read_record(sc, (struct wi_ltv_gen *)&mac)) != 0) {
 242                 device_printf(dev, "mac read failed %d\n", error);
 243                 owi_free(dev);
 244                 return (error);
 245         }
 246         bcopy((char *)&mac.wi_mac_addr,
 247            (char *)&sc->arpcom.ac_enaddr, ETHER_ADDR_LEN);
 248
 249         wi_get_id(sc);
 250
 251         ifp->if_softc = sc;
 252         if_initname(ifp, "wi", sc->wi_unit);
 253         ifp->if_mtu = ETHERMTU;
 254         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
 255         ifp->if_ioctl = wi_ioctl;
 256         ifp->if_start = wi_start;
 257         ifp->if_watchdog = wi_watchdog;
 258         ifp->if_init = wi_init;
 259         ifp->if_baudrate = 10000000;
 260         ifq_set_maxlen(&ifp->if_snd, IFQ_MAXLEN);
 261         ifq_set_ready(&ifp->if_snd);
 262
 263         bzero(sc->wi_node_name, sizeof(sc->wi_node_name));
 264         bcopy(WI_DEFAULT_NODENAME, sc->wi_node_name,
 265             sizeof(WI_DEFAULT_NODENAME) - 1);
 266
 267         bzero(sc->wi_net_name, sizeof(sc->wi_net_name));
 268         bcopy(WI_DEFAULT_NETNAME, sc->wi_net_name,
 269             sizeof(WI_DEFAULT_NETNAME) - 1);
 270
 271         bzero(sc->wi_ibss_name, sizeof(sc->wi_ibss_name));
 272         bcopy(WI_DEFAULT_IBSS, sc->wi_ibss_name,
 273             sizeof(WI_DEFAULT_IBSS) - 1);
 274
 275         sc->wi_portnum = WI_DEFAULT_PORT;
 276         sc->wi_ptype = WI_PORTTYPE_BSS;
 277         sc->wi_ap_density = WI_DEFAULT_AP_DENSITY;
 278         sc->wi_rts_thresh = WI_DEFAULT_RTS_THRESH;
 279         sc->wi_tx_rate = WI_DEFAULT_TX_RATE;
 280         sc->wi_max_data_len = WI_DEFAULT_DATALEN;
 281         sc->wi_create_ibss = WI_DEFAULT_CREATE_IBSS;
 282         sc->wi_pm_enabled = WI_DEFAULT_PM_ENABLED;
 283         sc->wi_max_sleep = WI_DEFAULT_MAX_SLEEP;
 284         sc->wi_roaming = WI_DEFAULT_ROAMING;
 285         sc->wi_authtype = WI_DEFAULT_AUTHTYPE;
 286         sc->wi_authmode = IEEE80211_AUTH_OPEN;
 287
 288         /*
 289          * Read the default channel from the NIC. This may vary
 290          * depending on the country where the NIC was purchased, so
 291          * we can't hard-code a default and expect it to work for
 292          * everyone.
 293          */
 294         gen.wi_type = WI_RID_OWN_CHNL;
 295         gen.wi_len = 2;
 296         wi_read_record(sc, &gen);
 297         sc->wi_channel = gen.wi_val;
 298
 299         /*
 300          * Set flags based on firmware version.
 301          */
 302         switch (sc->sc_firmware_type) {
 303         case WI_LUCENT:
 304                 sc->wi_flags |= WI_FLAGS_HAS_ROAMING;
 305                 if (sc->sc_sta_firmware_ver >= 60000)
 306                         sc->wi_flags |= WI_FLAGS_HAS_MOR;
 307                 if (sc->sc_sta_firmware_ver >= 60006) {
 308                         sc->wi_flags |= WI_FLAGS_HAS_IBSS;
 309                         sc->wi_flags |= WI_FLAGS_HAS_CREATE_IBSS;
 310                 }
 311                 sc->wi_ibss_port = htole16(1);
 312                 break;
 313         case WI_INTERSIL:
 314                 sc->wi_flags |= WI_FLAGS_HAS_ROAMING;
 315                 if (sc->sc_sta_firmware_ver >= 800) {
 316                         sc->wi_flags |= WI_FLAGS_HAS_IBSS;
 317                         sc->wi_flags |= WI_FLAGS_HAS_CREATE_IBSS;
 318                 }
 319                 /*
 320                  * version 0.8.3 and newer are the only ones that are known
 321                  * to currently work.  Earlier versions can be made to work,
 322                  * at least according to the Linux driver.
 323                  */
 324                 if (sc->sc_sta_firmware_ver >= 803)
 325                         sc->wi_flags |= WI_FLAGS_HAS_HOSTAP;
 326                 sc->wi_ibss_port = htole16(0);
 327                 break;
 328         case WI_SYMBOL:
 329                 sc->wi_flags |= WI_FLAGS_HAS_DIVERSITY;
 330                 if (sc->sc_sta_firmware_ver >= 20000)
 331                         sc->wi_flags |= WI_FLAGS_HAS_IBSS;
 332                 /* Older Symbol firmware does not support IBSS creation. */
 333                 if (sc->sc_sta_firmware_ver >= 25000)
 334                         sc->wi_flags |= WI_FLAGS_HAS_CREATE_IBSS;
 335                 sc->wi_ibss_port = htole16(4);
 336                 break;
 337         }
 338
 339         /*
 340          * Find out if we support WEP on this card.
 341          */
 342         gen.wi_type = WI_RID_WEP_AVAIL;
 343         gen.wi_len = 2;
 344         wi_read_record(sc, &gen);
 345         sc->wi_has_wep = gen.wi_val;
 346
 347         if (bootverbose)
 348                 device_printf(sc->dev, "wi_has_wep = %d\n", sc->wi_has_wep);
 349
 350         /*
 351          * Find supported rates.
 352          */
 353         gen.wi_type = WI_RID_DATA_RATES;
 354         gen.wi_len = 2;
 355         if (wi_read_record(sc, &gen))
 356                 sc->wi_supprates = WI_SUPPRATES_1M | WI_SUPPRATES_2M |
 357                     WI_SUPPRATES_5M | WI_SUPPRATES_11M;
 358         else
 359                 sc->wi_supprates = gen.wi_val;
 360
 361         bzero((char *)&sc->wi_stats, sizeof(sc->wi_stats));
 362
 363         wi_init(sc);
 364         wi_stop(sc);
 365
 366         ifmedia_init(&sc->ifmedia, 0, wi_media_change, wi_media_status);
 367 #define ADD(m, c)       ifmedia_add(&sc->ifmedia, (m), (c), NULL)
 368         if (sc->wi_supprates & WI_SUPPRATES_1M) {
 369                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1, 0, 0), 0);
 370                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1,
 371                     IFM_IEEE80211_ADHOC, 0), 0);
 372                 if (sc->wi_flags & WI_FLAGS_HAS_IBSS)
 373                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1,
 374                             IFM_IEEE80211_IBSS, 0), 0);
 375                 if (sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS)
 376                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1,
 377                             IFM_IEEE80211_IBSSMASTER, 0), 0);
 378                 if (sc->wi_flags & WI_FLAGS_HAS_HOSTAP)
 379                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1,
 380                             IFM_IEEE80211_HOSTAP, 0), 0);
 381         }
 382         if (sc->wi_supprates & WI_SUPPRATES_2M) {
 383                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2, 0, 0), 0);
 384                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2,
 385                     IFM_IEEE80211_ADHOC, 0), 0);
 386                 if (sc->wi_flags & WI_FLAGS_HAS_IBSS)
 387                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2,
 388                             IFM_IEEE80211_IBSS, 0), 0);
 389                 if (sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS)
 390                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2,
 391                             IFM_IEEE80211_IBSSMASTER, 0), 0);
 392                 if (sc->wi_flags & WI_FLAGS_HAS_HOSTAP)
 393                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2,
 394                             IFM_IEEE80211_HOSTAP, 0), 0);
 395         }
 396         if (sc->wi_supprates & WI_SUPPRATES_5M) {
 397                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5, 0, 0), 0);
 398                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5,
 399                     IFM_IEEE80211_ADHOC, 0), 0);
 400                 if (sc->wi_flags & WI_FLAGS_HAS_IBSS)
 401                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5,
 402                             IFM_IEEE80211_IBSS, 0), 0);
 403                 if (sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS)
 404                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5,
 405                             IFM_IEEE80211_IBSSMASTER, 0), 0);
 406                 if (sc->wi_flags & WI_FLAGS_HAS_HOSTAP)
 407                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5,
 408                             IFM_IEEE80211_HOSTAP, 0), 0);
 409         }
 410         if (sc->wi_supprates & WI_SUPPRATES_11M) {
 411                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11, 0, 0), 0);
 412                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11,
 413                     IFM_IEEE80211_ADHOC, 0), 0);
 414                 if (sc->wi_flags & WI_FLAGS_HAS_IBSS)
 415                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11,
 416                             IFM_IEEE80211_IBSS, 0), 0);
 417                 if (sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS)
 418                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11,
 419                             IFM_IEEE80211_IBSSMASTER, 0), 0);
 420                 if (sc->wi_flags & WI_FLAGS_HAS_HOSTAP)
 421                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11,
 422                             IFM_IEEE80211_HOSTAP, 0), 0);
 423                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_MANUAL, 0, 0), 0);
 424         }
 425         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO, IFM_IEEE80211_ADHOC, 0), 0);
 426         if (sc->wi_flags & WI_FLAGS_HAS_IBSS)
 427                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO, IFM_IEEE80211_IBSS,
 428                     0), 0);
 429         if (sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS)
 430                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO,
 431                     IFM_IEEE80211_IBSSMASTER, 0), 0);
 432         if (sc->wi_flags & WI_FLAGS_HAS_HOSTAP)
 433                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO,
 434                     IFM_IEEE80211_HOSTAP, 0), 0);
 435         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO, 0, 0), 0);
 436 #undef ADD
 437         ifmedia_set(&sc->ifmedia, IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO, 0, 0));
 438
 439         /*
 440          * Call MI attach routine.
 441          */
 442         ether_ifattach(ifp, sc->arpcom.ac_enaddr);
 443
 444         error = bus_setup_intr(dev, sc->irq, 0,
 445                                wi_intr, sc, &sc->wi_intrhand, NULL);
 446         if (error) {
 447                 ether_ifdetach(ifp);
 448                 device_printf(dev, "bus_setup_intr() failed! (%d)\n", error);
 449                 owi_free(dev);
 450                 return (error);
 451         }
 452
 453         return(0);
 454 }
 455
 456 static void
 457 wi_get_id(sc)
 458         struct wi_softc *sc;
 459 {
 460         struct wi_ltv_ver       ver;
 461         struct wi_card_ident    *id;
 462
 463         /* getting chip identity */
 464         memset(&ver, 0, sizeof(ver));
 465         ver.wi_type = WI_RID_CARD_ID;
 466         ver.wi_len = 5;
 467         wi_read_record(sc, (struct wi_ltv_gen *)&ver);
 468         device_printf(sc->dev, "using ");
 469         sc->sc_firmware_type = WI_NOTYPE;
 470         for (id = wi_card_ident; id->card_name != NULL; id++) {
 471                 if (le16toh(ver.wi_ver[0]) == id->card_id) {
 472                         printf("%s", id->card_name);
 473                         sc->sc_firmware_type = id->firm_type;
 474                         break;
 475                 }
 476         }
 477         if (sc->sc_firmware_type == WI_NOTYPE) {
 478                 if (le16toh(ver.wi_ver[0]) & 0x8000) {
 479                         printf("Unknown PRISM2 chip");
 480                         sc->sc_firmware_type = WI_INTERSIL;
 481                 } else {
 482                         printf("Unknown Lucent chip");
 483                         sc->sc_firmware_type = WI_LUCENT;
 484                 }
 485         }
 486
 487         if (sc->sc_firmware_type != WI_LUCENT) {
 488                 /* get primary firmware version */
 489                 memset(&ver, 0, sizeof(ver));
 490                 ver.wi_type = WI_RID_PRI_IDENTITY;
 491                 ver.wi_len = 5;
 492                 wi_read_record(sc, (struct wi_ltv_gen *)&ver);
 493                 ver.wi_ver[1] = le16toh(ver.wi_ver[1]);
 494                 ver.wi_ver[2] = le16toh(ver.wi_ver[2]);
 495                 ver.wi_ver[3] = le16toh(ver.wi_ver[3]);
 496                 sc->sc_pri_firmware_ver = ver.wi_ver[2] * 10000 +
 497                     ver.wi_ver[3] * 100 + ver.wi_ver[1];
 498         }
 499
 500         /* get station firmware version */
 501         memset(&ver, 0, sizeof(ver));
 502         ver.wi_type = WI_RID_STA_IDENTITY;
 503         ver.wi_len = 5;
 504         wi_read_record(sc, (struct wi_ltv_gen *)&ver);
 505         ver.wi_ver[1] = le16toh(ver.wi_ver[1]);
 506         ver.wi_ver[2] = le16toh(ver.wi_ver[2]);
 507         ver.wi_ver[3] = le16toh(ver.wi_ver[3]);
 508         sc->sc_sta_firmware_ver = ver.wi_ver[2] * 10000 +
 509             ver.wi_ver[3] * 100 + ver.wi_ver[1];
 510         if (sc->sc_firmware_type == WI_INTERSIL &&
 511             (sc->sc_sta_firmware_ver == 10102 ||
 512              sc->sc_sta_firmware_ver == 20102)) {
 513                 struct wi_ltv_str sver;
 514                 char *p;
 515
 516                 memset(&sver, 0, sizeof(sver));
 517                 sver.wi_type = WI_RID_SYMBOL_IDENTITY;
 518                 sver.wi_len = 7;
 519                 /* value should be the format like "V2.00-11" */
 520                 if (wi_read_record(sc, (struct wi_ltv_gen *)&sver) == 0 &&
 521                     *(p = (char *)sver.wi_str) >= 'A' &&
 522                     p[2] == '.' && p[5] == '-' && p[8] == '\0') {
 523                         sc->sc_firmware_type = WI_SYMBOL;
 524                         sc->sc_sta_firmware_ver = (p[1] - '0') * 10000 +
 525                             (p[3] - '0') * 1000 + (p[4] - '0') * 100 +
 526                             (p[6] - '0') * 10 + (p[7] - '0');
 527                 }
 528         }
 529         printf("\n");
 530         device_printf(sc->dev, "%s Firmware: ",
 531              sc->sc_firmware_type == WI_LUCENT ? "Lucent" :
 532             (sc->sc_firmware_type == WI_SYMBOL ? "Symbol" : "Intersil"));
 533
 534         /*
 535          * The primary firmware is only valid on Prism based chipsets
 536          * (INTERSIL or SYMBOL).
 537          */
 538         if (sc->sc_firmware_type != WI_LUCENT)
 539             printf("Primary %u.%02u.%02u, ", sc->sc_pri_firmware_ver / 10000,
 540                     (sc->sc_pri_firmware_ver % 10000) / 100,
 541                     sc->sc_pri_firmware_ver % 100);
 542         printf("Station %u.%02u.%02u\n",
 543             sc->sc_sta_firmware_ver / 10000, (sc->sc_sta_firmware_ver % 10000) / 100,
 544             sc->sc_sta_firmware_ver % 100);
 545         return;
 546 }
 547
 548 static void
 549 wi_rxeof(sc)
 550         struct wi_softc         *sc;
 551 {
 552         struct ifnet            *ifp;
 553         struct ether_header     *eh;
 554         struct mbuf             *m;
 555         int                     id;
 556
 557         ifp = &sc->arpcom.ac_if;
 558
 559         id = CSR_READ_2(sc, WI_RX_FID);
 560
 561         /*
 562          * if we have the procframe flag set, disregard all this and just
 563          * read the data from the device.
 564          */
 565         if (sc->wi_procframe || sc->wi_debug.wi_monitor) {
 566                 struct wi_frame         *rx_frame;
 567                 int                     datlen, hdrlen;
 568
 569                 /* first allocate mbuf for packet storage */
 570                 MGETHDR(m, MB_DONTWAIT, MT_DATA);
 571                 if (m == NULL) {
 572                         ifp->if_ierrors++;
 573                         return;
 574                 }
 575                 MCLGET(m, MB_DONTWAIT);
 576                 if (!(m->m_flags & M_EXT)) {
 577                         m_freem(m);
 578                         ifp->if_ierrors++;
 579                         return;
 580                 }
 581
 582                 m->m_pkthdr.rcvif = ifp;
 583
 584                 /* now read wi_frame first so we know how much data to read */
 585                 if (wi_read_data(sc, id, 0, mtod(m, caddr_t),
 586                     sizeof(struct wi_frame))) {
 587                         m_freem(m);
 588                         ifp->if_ierrors++;
 589                         return;
 590                 }
 591
 592                 rx_frame = mtod(m, struct wi_frame *);
 593
 594                 switch ((rx_frame->wi_status & WI_STAT_MAC_PORT) >> 8) {
 595                 case 7:
 596                         switch (rx_frame->wi_frame_ctl & WI_FCTL_FTYPE) {
 597                         case WI_FTYPE_DATA:
 598                                 hdrlen = WI_DATA_HDRLEN;
 599                                 datlen = rx_frame->wi_dat_len + WI_FCS_LEN;
 600                                 break;
 601                         case WI_FTYPE_MGMT:
 602                                 hdrlen = WI_MGMT_HDRLEN;
 603                                 datlen = rx_frame->wi_dat_len + WI_FCS_LEN;
 604                                 break;
 605                         case WI_FTYPE_CTL:
 606                                 /*
 607                                  * prism2 cards don't pass control packets
 608                                  * down properly or consistently, so we'll only
 609                                  * pass down the header.
 610                                  */
 611                                 hdrlen = WI_CTL_HDRLEN;
 612                                 datlen = 0;
 613                                 break;
 614                         default:
 615                                 device_printf(sc->dev, "received packet of "
 616                                     "unknown type on port 7\n");
 617                                 m_freem(m);
 618                                 ifp->if_ierrors++;
 619                                 return;
 620                         }
 621                         break;
 622                 case 0:
 623                         hdrlen = WI_DATA_HDRLEN;
 624                         datlen = rx_frame->wi_dat_len + WI_FCS_LEN;
 625                         break;
 626                 default:
 627                         device_printf(sc->dev, "received packet on invalid "
 628                             "port (wi_status=0x%x)\n", rx_frame->wi_status);
 629                         m_freem(m);
 630                         ifp->if_ierrors++;
 631                         return;
 632                 }
 633
 634                 if ((hdrlen + datlen + 2) > MCLBYTES) {
 635                         device_printf(sc->dev, "oversized packet received "
 636                             "(wi_dat_len=%d, wi_status=0x%x)\n",
 637                             datlen, rx_frame->wi_status);
 638                         m_freem(m);
 639                         ifp->if_ierrors++;
 640                         return;
 641                 }
 642
 643                 if (wi_read_data(sc, id, hdrlen, mtod(m, caddr_t) + hdrlen,
 644                     datlen + 2)) {
 645                         m_freem(m);
 646                         ifp->if_ierrors++;
 647                         return;
 648                 }
 649
 650                 m->m_pkthdr.len = m->m_len = hdrlen + datlen;
 651
 652                 ifp->if_ipackets++;
 653
 654                 /* Handle BPF listeners. */
 655                 BPF_MTAP(ifp, m);
 656
 657                 m_freem(m);
 658         } else {
 659                 struct wi_frame         rx_frame;
 660
 661                 /* First read in the frame header */
 662                 if (wi_read_data(sc, id, 0, (caddr_t)&rx_frame,
 663                     sizeof(rx_frame))) {
 664                         ifp->if_ierrors++;
 665                         return;
 666                 }
 667
 668                 if (rx_frame.wi_status & WI_STAT_ERRSTAT) {
 669                         ifp->if_ierrors++;
 670                         return;
 671                 }
 672
 673                 MGETHDR(m, MB_DONTWAIT, MT_DATA);
 674                 if (m == NULL) {
 675                         ifp->if_ierrors++;
 676                         return;
 677                 }
 678                 MCLGET(m, MB_DONTWAIT);
 679                 if (!(m->m_flags & M_EXT)) {
 680                         m_freem(m);
 681                         ifp->if_ierrors++;
 682                         return;
 683                 }
 684
 685                 eh = mtod(m, struct ether_header *);
 686                 m->m_pkthdr.rcvif = ifp;
 687
 688                 if (rx_frame.wi_status == WI_STAT_MGMT &&
 689                     sc->wi_ptype == WI_PORTTYPE_AP) {
 690                         if ((WI_802_11_OFFSET_RAW + rx_frame.wi_dat_len + 2) >
 691                             MCLBYTES) {
 692                                 device_printf(sc->dev, "oversized mgmt packet "
 693                                     "received in hostap mode "
 694                                     "(wi_dat_len=%d, wi_status=0x%x)\n",
 695                                     rx_frame.wi_dat_len, rx_frame.wi_status);
 696                                 m_freem(m);
 697                                 ifp->if_ierrors++;
 698                                 return;
 699                         }
 700
 701                         /* Put the whole header in there. */
 702                         bcopy(&rx_frame, mtod(m, void *),
 703                             sizeof(struct wi_frame));
 704                         if (wi_read_data(sc, id, WI_802_11_OFFSET_RAW,
 705                             mtod(m, caddr_t) + WI_802_11_OFFSET_RAW,
 706                             rx_frame.wi_dat_len + 2)) {
 707                                 m_freem(m);
 708                                 ifp->if_ierrors++;
 709                                 return;
 710                         }
 711                         m->m_pkthdr.len = m->m_len =
 712                             WI_802_11_OFFSET_RAW + rx_frame.wi_dat_len;
 713                         /* XXX: consider giving packet to bhp? */
 714                         owihap_mgmt_input(sc, &rx_frame, m);
 715                         return;
 716                 }
 717
 718                 if (rx_frame.wi_status == WI_STAT_1042 ||
 719                     rx_frame.wi_status == WI_STAT_TUNNEL ||
 720                     rx_frame.wi_status == WI_STAT_WMP_MSG) {
 721                         if((rx_frame.wi_dat_len + WI_SNAPHDR_LEN) > MCLBYTES) {
 722                                 device_printf(sc->dev,
 723                                     "oversized packet received "
 724                                     "(wi_dat_len=%d, wi_status=0x%x)\n",
 725                                     rx_frame.wi_dat_len, rx_frame.wi_status);
 726                                 m_freem(m);
 727                                 ifp->if_ierrors++;
 728                                 return;
 729                         }
 730                         m->m_pkthdr.len = m->m_len =
 731                             rx_frame.wi_dat_len + WI_SNAPHDR_LEN;
 732
 733 #if 0
 734                         bcopy((char *)&rx_frame.wi_addr1,
 735                             (char *)&eh->ether_dhost, ETHER_ADDR_LEN);
 736                         if (sc->wi_ptype == WI_PORTTYPE_ADHOC) {
 737                                 bcopy((char *)&rx_frame.wi_addr2,
 738                                     (char *)&eh->ether_shost, ETHER_ADDR_LEN);
 739                         } else {
 740                                 bcopy((char *)&rx_frame.wi_addr3,
 741                                     (char *)&eh->ether_shost, ETHER_ADDR_LEN);
 742                         }
 743 #else
 744                         bcopy((char *)&rx_frame.wi_dst_addr,
 745                                 (char *)&eh->ether_dhost, ETHER_ADDR_LEN);
 746                         bcopy((char *)&rx_frame.wi_src_addr,
 747                                 (char *)&eh->ether_shost, ETHER_ADDR_LEN);
 748 #endif
 749
 750                         bcopy((char *)&rx_frame.wi_type,
 751                             (char *)&eh->ether_type, ETHER_TYPE_LEN);
 752
 753                         if (wi_read_data(sc, id, WI_802_11_OFFSET,
 754                             mtod(m, caddr_t) + sizeof(struct ether_header),
 755                             m->m_len + 2)) {
 756                                 m_freem(m);
 757                                 ifp->if_ierrors++;
 758                                 return;
 759                         }
 760                 } else {
 761                         if((rx_frame.wi_dat_len +
 762                             sizeof(struct ether_header)) > MCLBYTES) {
 763                                 device_printf(sc->dev,
 764                                     "oversized packet received "
 765                                     "(wi_dat_len=%d, wi_status=0x%x)\n",
 766                                     rx_frame.wi_dat_len, rx_frame.wi_status);
 767                                 m_freem(m);
 768                                 ifp->if_ierrors++;
 769                                 return;
 770                         }
 771                         m->m_pkthdr.len = m->m_len =
 772                             rx_frame.wi_dat_len + sizeof(struct ether_header);
 773
 774                         if (wi_read_data(sc, id, WI_802_3_OFFSET,
 775                             mtod(m, caddr_t), m->m_len + 2)) {
 776                                 m_freem(m);
 777                                 ifp->if_ierrors++;
 778                                 return;
 779                         }
 780                 }
 781
 782                 ifp->if_ipackets++;
 783
 784                 if (sc->wi_ptype == WI_PORTTYPE_AP) {
 785                         /*
 786                          * Give host AP code first crack at data
 787                          * packets.  If it decides to handle it (or
 788                          * drop it), it will return a non-zero.
 789                          * Otherwise, it is destined for this host.
 790                          */
 791                         if (owihap_data_input(sc, &rx_frame, m))
 792                                 return;
 793                 }
 794                 /* Receive packet. */
 795 #ifdef WICACHE
 796                 wi_cache_store(sc, m, rx_frame.wi_q_info);
 797 #endif
 798                 (*ifp->if_input)(ifp,  m);
 799         }
 800 }
 801
 802 static void
 803 wi_txeof(sc, status)
 804         struct wi_softc         *sc;
 805         int                     status;
 806 {
 807         struct ifnet            *ifp;
 808
 809         ifp = &sc->arpcom.ac_if;
 810
 811         ifp->if_timer = 0;
 812         ifp->if_flags &= ~IFF_OACTIVE;
 813
 814         if (status & WI_EV_TX_EXC)
 815                 ifp->if_oerrors++;
 816         else
 817                 ifp->if_opackets++;
 818
 819         return;
 820 }
 821
 822 static void
 823 wi_inquire(xsc)
 824         void                    *xsc;
 825 {
 826         struct wi_softc *sc = xsc;
 827         struct ifnet            *ifp = &sc->arpcom.ac_if;
 828
 829         crit_enter();
 830
 831         callout_reset(&sc->wi_stat_timer, hz* 60, wi_inquire, sc);
 832
 833         /* Don't do this while we're transmitting */
 834         if (ifp->if_flags & IFF_OACTIVE) {
 835                 crit_exit();
 836                 return;
 837         }
 838
 839         wi_cmd(sc, WI_CMD_INQUIRE, WI_INFO_COUNTERS, 0, 0);
 840
 841         crit_exit();
 842 }
 843
 844 static void
 845 wi_update_stats(sc)
 846         struct wi_softc         *sc;
 847 {
 848         struct wi_ltv_gen       gen;
 849         u_int16_t               id;
 850         struct ifnet            *ifp;
 851         u_int32_t               *ptr;
 852         int                     len, i;
 853         u_int16_t               t;
 854
 855         ifp = &sc->arpcom.ac_if;
 856
 857         id = CSR_READ_2(sc, WI_INFO_FID);
 858
 859         wi_read_data(sc, id, 0, (char *)&gen, 4);
 860
 861         /*
 862          * if we just got our scan results, copy it over into the scan buffer
 863          * so we can return it to anyone that asks for it. (add a little
 864          * compatibility with the prism2 scanning mechanism)
 865          */
 866         if (gen.wi_type == WI_INFO_SCAN_RESULTS)
 867         {
 868                 sc->wi_scanbuf_len = gen.wi_len;
 869                 wi_read_data(sc, id, 4, (char *)sc->wi_scanbuf,
 870                     sc->wi_scanbuf_len * 2);
 871
 872                 return;
 873         }
 874         else if (gen.wi_type != WI_INFO_COUNTERS)
 875                 return;
 876
 877         len = (gen.wi_len - 1 < sizeof(sc->wi_stats) / 4) ?
 878                 gen.wi_len - 1 : sizeof(sc->wi_stats) / 4;
 879         ptr = (u_int32_t *)&sc->wi_stats;
 880
 881         for (i = 0; i < len - 1; i++) {
 882                 t = CSR_READ_2(sc, WI_DATA1);
 883 #ifdef WI_HERMES_STATS_WAR
 884                 if (t > 0xF000)
 885                         t = ~t & 0xFFFF;
 886 #endif
 887                 ptr[i] += t;
 888         }
 889
 890         ifp->if_collisions = sc->wi_stats.wi_tx_single_retries +
 891             sc->wi_stats.wi_tx_multi_retries +
 892             sc->wi_stats.wi_tx_retry_limit;
 893
 894         return;
 895 }
 896
 897 static void
 898 wi_intr(xsc)
 899         void            *xsc;
 900 {
 901         struct wi_softc         *sc = xsc;
 902         struct ifnet            *ifp = &sc->arpcom.ac_if;
 903         u_int16_t               status;
 904
 905         if (sc->wi_gone || !(ifp->if_flags & IFF_UP)) {
 906                 CSR_WRITE_2(sc, WI_EVENT_ACK, 0xFFFF);
 907                 CSR_WRITE_2(sc, WI_INT_EN, 0);
 908                 return;
 909         }
 910
 911         /* Disable interrupts. */
 912         CSR_WRITE_2(sc, WI_INT_EN, 0);
 913
 914         status = CSR_READ_2(sc, WI_EVENT_STAT);
 915         CSR_WRITE_2(sc, WI_EVENT_ACK, ~WI_INTRS);
 916
 917         if (status & WI_EV_RX) {
 918                 wi_rxeof(sc);
 919                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_RX);
 920         }
 921
 922         if (status & WI_EV_TX) {
 923                 wi_txeof(sc, status);
 924                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_TX);
 925         }
 926
 927         if (status & WI_EV_ALLOC) {
 928                 int                     id;
 929
 930                 id = CSR_READ_2(sc, WI_ALLOC_FID);
 931                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_ALLOC);
 932                 if (id == sc->wi_tx_data_id)
 933                         wi_txeof(sc, status);
 934         }
 935
 936         if (status & WI_EV_INFO) {
 937                 wi_update_stats(sc);
 938                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_INFO);
 939         }
 940
 941         if (status & WI_EV_TX_EXC) {
 942                 wi_txeof(sc, status);
 943                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_TX_EXC);
 944         }
 945
 946         if (status & WI_EV_INFO_DROP) {
 947                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_INFO_DROP);
 948         }
 949
 950         /* Re-enable interrupts. */
 951         CSR_WRITE_2(sc, WI_INT_EN, WI_INTRS);
 952
 953         if (!ifq_is_empty(&ifp->if_snd)) {
 954                 wi_start(ifp);
 955         }
 956 }
 957
 958 static int
 959 wi_cmd(sc, cmd, val0, val1, val2)
 960         struct wi_softc         *sc;
 961         int                     cmd;
 962         int                     val0;
 963         int                     val1;
 964         int                     val2;
 965 {
 966         int                     i, s = 0;
 967         static volatile int count  = 0;
 968
 969         if (count > 1)
 970                 panic("Hey partner, hold on there!");
 971         count++;
 972
 973         /* wait for the busy bit to clear */
 974         for (i = 500; i > 0; i--) {     /* 5s */
 975                 if (!(CSR_READ_2(sc, WI_COMMAND) & WI_CMD_BUSY)) {
 976                         break;
 977                 }
 978                 DELAY(10*1000); /* 10 m sec */
 979         }
 980         if (i == 0) {
 981                 device_printf(sc->dev, "wi_cmd: busy bit won't clear.\n" );
 982                 count--;
 983                 return(ETIMEDOUT);
 984         }
 985
 986         CSR_WRITE_2(sc, WI_PARAM0, val0);
 987         CSR_WRITE_2(sc, WI_PARAM1, val1);
 988         CSR_WRITE_2(sc, WI_PARAM2, val2);
 989         CSR_WRITE_2(sc, WI_COMMAND, cmd);
 990
 991         for (i = 0; i < WI_TIMEOUT; i++) {
 992                 /*
 993                  * Wait for 'command complete' bit to be
 994                  * set in the event status register.
 995                  */
 996                 s = CSR_READ_2(sc, WI_EVENT_STAT);
 997                 if (s & WI_EV_CMD) {
 998                         /* Ack the event and read result code. */
 999                         s = CSR_READ_2(sc, WI_STATUS);
1000                         CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_CMD);
1001 #ifdef foo
1002                         if ((s & WI_CMD_CODE_MASK) != (cmd & WI_CMD_CODE_MASK))
1003                                 return(EIO);
1004 #endif
1005                         if (s & WI_STAT_CMD_RESULT) {
1006                                 count--;
1007                                 return(EIO);
1008                         }
1009                         break;
1010                 }
1011                 DELAY(WI_DELAY);
1012         }
1013
1014         count--;
1015         if (i == WI_TIMEOUT) {
1016                 device_printf(sc->dev,
1017                     "timeout in wi_cmd 0x%04x; event status 0x%04x\n", cmd, s);
1018                 return(ETIMEDOUT);
1019         }
1020         return(0);
1021 }
1022
1023 static void
1024 wi_reset(sc)
1025         struct wi_softc         *sc;
1026 {
1027 #define WI_INIT_TRIES 3
1028         int i;
1029         int tries;
1030
1031         /* Symbol firmware cannot be initialized more than once */
1032         if (sc->sc_firmware_type == WI_SYMBOL && sc->sc_enabled)
1033                 return;
1034         if (sc->sc_firmware_type == WI_SYMBOL)
1035                 tries = 1;
1036         else
1037                 tries = WI_INIT_TRIES;
1038
1039         for (i = 0; i < tries; i++) {
1040                 if (wi_cmd(sc, WI_CMD_INI, 0, 0, 0) == 0)
1041                         break;
1042                 DELAY(WI_DELAY * 1000);
1043         }
1044         sc->sc_enabled = 1;
1045
1046         if (i == tries) {
1047                 device_printf(sc->dev, "init failed\n");
1048                 return;
1049         }
1050
1051         CSR_WRITE_2(sc, WI_INT_EN, 0);
1052         CSR_WRITE_2(sc, WI_EVENT_ACK, 0xFFFF);
1053
1054         /* Calibrate timer. */
1055         WI_SETVAL(WI_RID_TICK_TIME, 8);
1056
1057         return;
1058 }
1059
1060 /*
1061  * Read an LTV record from the NIC.
1062  */
1063 static int
1064 wi_read_record(sc, ltv)
1065         struct wi_softc         *sc;
1066         struct wi_ltv_gen       *ltv;
1067 {
1068         u_int16_t               *ptr;
1069         int                     i, len, code;
1070         struct wi_ltv_gen       *oltv, p2ltv;
1071
1072         oltv = ltv;
1073         if (sc->sc_firmware_type != WI_LUCENT) {
1074                 switch (ltv->wi_type) {
1075                 case WI_RID_ENCRYPTION:
1076                         p2ltv.wi_type = WI_RID_P2_ENCRYPTION;
1077                         p2ltv.wi_len = 2;
1078                         ltv = &p2ltv;
1079                         break;
1080                 case WI_RID_TX_CRYPT_KEY:
1081                         p2ltv.wi_type = WI_RID_P2_TX_CRYPT_KEY;
1082                         p2ltv.wi_len = 2;
1083                         ltv = &p2ltv;
1084                         break;
1085                 case WI_RID_ROAMING_MODE:
1086                         if (sc->sc_firmware_type == WI_INTERSIL)
1087                                 break;
1088                         /* not supported */
1089                         ltv->wi_len = 1;
1090                         return 0;
1091                 case WI_RID_MICROWAVE_OVEN:
1092                         /* not supported */
1093                         ltv->wi_len = 1;
1094                         return 0;
1095                 }
1096         }
1097
1098         /* Tell the NIC to enter record read mode. */
1099         if (wi_cmd(sc, WI_CMD_ACCESS|WI_ACCESS_READ, ltv->wi_type, 0, 0))
1100                 return(EIO);
1101
1102         /* Seek to the record. */
1103         if (wi_seek(sc, ltv->wi_type, 0, WI_BAP1))
1104                 return(EIO);
1105
1106         /*
1107          * Read the length and record type and make sure they
1108          * match what we expect (this verifies that we have enough
1109          * room to hold all of the returned data).
1110          */
1111         len = CSR_READ_2(sc, WI_DATA1);
1112         if (len > ltv->wi_len)
1113                 return(ENOSPC);
1114         code = CSR_READ_2(sc, WI_DATA1);
1115         if (code != ltv->wi_type)
1116                 return(EIO);
1117
1118         ltv->wi_len = len;
1119         ltv->wi_type = code;
1120
1121         /* Now read the data. */
1122         ptr = &ltv->wi_val;
1123         for (i = 0; i < ltv->wi_len - 1; i++)
1124                 ptr[i] = CSR_READ_2(sc, WI_DATA1);
1125
1126         if (ltv->wi_type == WI_RID_PORTTYPE && sc->wi_ptype == WI_PORTTYPE_IBSS
1127             && ltv->wi_val == sc->wi_ibss_port) {
1128                 /*
1129                  * Convert vendor IBSS port type to WI_PORTTYPE_IBSS.
1130                  * Since Lucent uses port type 1 for BSS *and* IBSS we
1131                  * have to rely on wi_ptype to distinguish this for us.
1132                  */
1133                 ltv->wi_val = htole16(WI_PORTTYPE_IBSS);
1134         } else if (sc->sc_firmware_type != WI_LUCENT) {
1135                 switch (oltv->wi_type) {
1136                 case WI_RID_TX_RATE:
1137                 case WI_RID_CUR_TX_RATE:
1138                         switch (ltv->wi_val) {
1139                         case 1: oltv->wi_val = 1; break;
1140                         case 2: oltv->wi_val = 2; break;
1141                         case 3: oltv->wi_val = 6; break;
1142                         case 4: oltv->wi_val = 5; break;
1143                         case 7: oltv->wi_val = 7; break;
1144                         case 8: oltv->wi_val = 11; break;
1145                         case 15: oltv->wi_val = 3; break;
1146                         default: oltv->wi_val = 0x100 + ltv->wi_val; break;
1147                         }
1148                         break;
1149                 case WI_RID_ENCRYPTION:
1150                         oltv->wi_len = 2;
1151                         if (ltv->wi_val & 0x01)
1152                                 oltv->wi_val = 1;
1153                         else
1154                                 oltv->wi_val = 0;
1155                         break;
1156                 case WI_RID_TX_CRYPT_KEY:
1157                         oltv->wi_len = 2;
1158                         oltv->wi_val = ltv->wi_val;
1159                         break;
1160                 case WI_RID_CNFAUTHMODE:
1161                         oltv->wi_len = 2;
1162                         if (le16toh(ltv->wi_val) & 0x01)
1163                                 oltv->wi_val = htole16(1);
1164                         else if (le16toh(ltv->wi_val) & 0x02)
1165                                 oltv->wi_val = htole16(2);
1166                         break;
1167                 }
1168         }
1169
1170         return(0);
1171 }
1172
1173 /*
1174  * Same as read, except we inject data instead of reading it.
1175  */
1176 static int
1177 wi_write_record(sc, ltv)
1178         struct wi_softc         *sc;
1179         struct wi_ltv_gen       *ltv;
1180 {
1181         u_int16_t               *ptr;
1182         int                     i;
1183         struct wi_ltv_gen       p2ltv;
1184
1185         if (ltv->wi_type == WI_RID_PORTTYPE &&
1186             le16toh(ltv->wi_val) == WI_PORTTYPE_IBSS) {
1187                 /* Convert WI_PORTTYPE_IBSS to vendor IBSS port type. */
1188                 p2ltv.wi_type = WI_RID_PORTTYPE;
1189                 p2ltv.wi_len = 2;
1190                 p2ltv.wi_val = sc->wi_ibss_port;
1191                 ltv = &p2ltv;
1192         } else if (sc->sc_firmware_type != WI_LUCENT) {
1193                 switch (ltv->wi_type) {
1194                 case WI_RID_TX_RATE:
1195                         p2ltv.wi_type = WI_RID_TX_RATE;
1196                         p2ltv.wi_len = 2;
1197                         switch (ltv->wi_val) {
1198                         case 1: p2ltv.wi_val = 1; break;
1199                         case 2: p2ltv.wi_val = 2; break;
1200                         case 3: p2ltv.wi_val = 15; break;
1201                         case 5: p2ltv.wi_val = 4; break;
1202                         case 6: p2ltv.wi_val = 3; break;
1203                         case 7: p2ltv.wi_val = 7; break;
1204                         case 11: p2ltv.wi_val = 8; break;
1205                         default: return EINVAL;
1206                         }
1207                         ltv = &p2ltv;
1208                         break;
1209                 case WI_RID_ENCRYPTION:
1210                         p2ltv.wi_type = WI_RID_P2_ENCRYPTION;
1211                         p2ltv.wi_len = 2;
1212                         if (le16toh(ltv->wi_val)) {
1213                                 p2ltv.wi_val =htole16(PRIVACY_INVOKED |
1214                                     EXCLUDE_UNENCRYPTED);
1215                                 if (sc->wi_ptype == WI_PORTTYPE_AP)
1216                                         /*
1217                                          * Disable tx encryption...
1218                                          * it's broken.
1219                                          */
1220                                         p2ltv.wi_val |= htole16(HOST_ENCRYPT);
1221                         } else
1222                                 p2ltv.wi_val =
1223                                     htole16(HOST_ENCRYPT | HOST_DECRYPT);
1224                         ltv = &p2ltv;
1225                         break;
1226                 case WI_RID_TX_CRYPT_KEY:
1227                         p2ltv.wi_type = WI_RID_P2_TX_CRYPT_KEY;
1228                         p2ltv.wi_len = 2;
1229                         p2ltv.wi_val = ltv->wi_val;
1230                         ltv = &p2ltv;
1231                         break;
1232                 case WI_RID_DEFLT_CRYPT_KEYS:
1233                     {
1234                         int error;
1235                         int keylen;
1236                         struct wi_ltv_str       ws;
1237                         struct wi_ltv_keys      *wk =
1238                             (struct wi_ltv_keys *)ltv;
1239
1240                         keylen = wk->wi_keys[sc->wi_tx_key].wi_keylen;
1241
1242                         for (i = 0; i < 4; i++) {
1243                                 bzero(&ws, sizeof(ws));
1244                                 ws.wi_len = (keylen > 5) ? 8 : 4;
1245                                 ws.wi_type = WI_RID_P2_CRYPT_KEY0 + i;
1246                                 memcpy(ws.wi_str,
1247                                     &wk->wi_keys[i].wi_keydat, keylen);
1248                                 error = wi_write_record(sc,
1249                                     (struct wi_ltv_gen *)&ws);
1250                                 if (error)
1251                                         return error;
1252                         }
1253                         return 0;
1254                     }
1255                 case WI_RID_CNFAUTHMODE:
1256                         p2ltv.wi_type = WI_RID_CNFAUTHMODE;
1257                         p2ltv.wi_len = 2;
1258                         if (le16toh(ltv->wi_val) == 1)
1259                                 p2ltv.wi_val = htole16(0x01);
1260                         else if (le16toh(ltv->wi_val) == 2)
1261                                 p2ltv.wi_val = htole16(0x02);
1262                         ltv = &p2ltv;
1263                         break;
1264                 case WI_RID_ROAMING_MODE:
1265                         if (sc->sc_firmware_type == WI_INTERSIL)
1266                                 break;
1267                         /* not supported */
1268                         return 0;
1269                 case WI_RID_MICROWAVE_OVEN:
1270                         /* not supported */
1271                         return 0;
1272                 }
1273         } else {
1274                 /* LUCENT */
1275                 switch (ltv->wi_type) {
1276                 case WI_RID_TX_RATE:
1277                         switch (ltv->wi_val) {
1278                         case 1: ltv->wi_val = 1; break;  /* 1Mb/s fixed */
1279                         case 2: ltv->wi_val = 2; break;  /* 2Mb/s fixed */
1280                         case 3: ltv->wi_val = 3; break;  /* 11Mb/s auto */
1281                         case 5: ltv->wi_val = 4; break;  /* 5.5Mb/s fixed */
1282                         case 6: ltv->wi_val = 6; break;  /* 2Mb/s auto */
1283                         case 7: ltv->wi_val = 7; break;  /* 5.5Mb/s auto */
1284                         case 11: ltv->wi_val = 5; break; /* 11Mb/s fixed */
1285                         default: return EINVAL;
1286                         }
1287                 }
1288         }
1289
1290         if (wi_seek(sc, ltv->wi_type, 0, WI_BAP1))
1291                 return(EIO);
1292
1293         CSR_WRITE_2(sc, WI_DATA1, ltv->wi_len);
1294         CSR_WRITE_2(sc, WI_DATA1, ltv->wi_type);
1295
1296         ptr = &ltv->wi_val;
1297         for (i = 0; i < ltv->wi_len - 1; i++)
1298                 CSR_WRITE_2(sc, WI_DATA1, ptr[i]);
1299
1300         if (wi_cmd(sc, WI_CMD_ACCESS|WI_ACCESS_WRITE, ltv->wi_type, 0, 0))
1301                 return(EIO);
1302
1303         return(0);
1304 }
1305
1306 static int
1307 wi_seek(sc, id, off, chan)
1308         struct wi_softc         *sc;
1309         int                     id, off, chan;
1310 {
1311         int                     i;
1312         int                     selreg, offreg;
1313         int                     status;
1314
1315         switch (chan) {
1316         case WI_BAP0:
1317                 selreg = WI_SEL0;
1318                 offreg = WI_OFF0;
1319                 break;
1320         case WI_BAP1:
1321                 selreg = WI_SEL1;
1322                 offreg = WI_OFF1;
1323                 break;
1324         default:
1325                 device_printf(sc->dev, "invalid data path: %x\n", chan);
1326                 return(EIO);
1327         }
1328
1329         CSR_WRITE_2(sc, selreg, id);
1330         CSR_WRITE_2(sc, offreg, off);
1331
1332         for (i = 0; i < WI_TIMEOUT; i++) {
1333                 status = CSR_READ_2(sc, offreg);
1334                 if (!(status & (WI_OFF_BUSY|WI_OFF_ERR)))
1335                         break;
1336                 DELAY(WI_DELAY);
1337         }
1338
1339         if (i == WI_TIMEOUT) {
1340                 device_printf(sc->dev, "timeout in wi_seek to %x/%x; last status %x\n",
1341                         id, off, status);
1342                 return(ETIMEDOUT);
1343         }
1344
1345         return(0);
1346 }
1347
1348 static int
1349 wi_read_data(sc, id, off, buf, len)
1350         struct wi_softc         *sc;
1351         int                     id, off;
1352         caddr_t                 buf;
1353         int                     len;
1354 {
1355         int                     i;
1356         u_int16_t               *ptr;
1357
1358         if (wi_seek(sc, id, off, WI_BAP1))
1359                 return(EIO);
1360
1361         ptr = (u_int16_t *)buf;
1362         for (i = 0; i < len / 2; i++)
1363                 ptr[i] = CSR_READ_2(sc, WI_DATA1);
1364
1365         return(0);
1366 }
1367
1368 /*
1369  * According to the comments in the HCF Light code, there is a bug in
1370  * the Hermes (or possibly in certain Hermes firmware revisions) where
1371  * the chip's internal autoincrement counter gets thrown off during
1372  * data writes: the autoincrement is missed, causing one data word to
1373  * be overwritten and subsequent words to be written to the wrong memory
1374  * locations. The end result is that we could end up transmitting bogus
1375  * frames without realizing it. The workaround for this is to write a
1376  * couple of extra guard words after the end of the transfer, then
1377  * attempt to read then back. If we fail to locate the guard words where
1378  * we expect them, we preform the transfer over again.
1379  */
1380 static int
1381 wi_write_data(sc, id, off, buf, len)
1382         struct wi_softc         *sc;
1383         int                     id, off;
1384         caddr_t                 buf;
1385         int                     len;
1386 {
1387         int                     i;
1388         u_int16_t               *ptr;
1389 #ifdef WI_HERMES_AUTOINC_WAR
1390         int                     retries;
1391
1392         retries = 512;
1393 again:
1394 #endif
1395
1396         if (wi_seek(sc, id, off, WI_BAP0))
1397                 return(EIO);
1398
1399         ptr = (u_int16_t *)buf;
1400         for (i = 0; i < (len / 2); i++)
1401                 CSR_WRITE_2(sc, WI_DATA0, ptr[i]);
1402
1403 #ifdef WI_HERMES_AUTOINC_WAR
1404         CSR_WRITE_2(sc, WI_DATA0, 0x1234);
1405         CSR_WRITE_2(sc, WI_DATA0, 0x5678);
1406
1407         if (wi_seek(sc, id, off + len, WI_BAP0))
1408                 return(EIO);
1409
1410         if (CSR_READ_2(sc, WI_DATA0) != 0x1234 ||
1411             CSR_READ_2(sc, WI_DATA0) != 0x5678) {
1412                 if (--retries >= 0)
1413                         goto again;
1414                 device_printf(sc->dev, "wi_write_data device timeout\n");
1415                 return (EIO);
1416         }
1417 #endif
1418
1419         return(0);
1420 }
1421
1422 /*
1423  * Allocate a region of memory inside the NIC and zero
1424  * it out.
1425  */
1426 static int
1427 wi_alloc_nicmem(sc, len, id)
1428         struct wi_softc         *sc;
1429         int                     len;
1430         int                     *id;
1431 {
1432         int                     i;
1433
1434         if (wi_cmd(sc, WI_CMD_ALLOC_MEM, len, 0, 0)) {
1435                 device_printf(sc->dev,
1436                     "failed to allocate %d bytes on NIC\n", len);
1437                 return(ENOMEM);
1438         }
1439
1440         for (i = 0; i < WI_TIMEOUT; i++) {
1441                 if (CSR_READ_2(sc, WI_EVENT_STAT) & WI_EV_ALLOC)
1442                         break;
1443                 DELAY(WI_DELAY);
1444         }
1445
1446         if (i == WI_TIMEOUT) {
1447                 device_printf(sc->dev, "time out allocating memory on card\n");
1448                 return(ETIMEDOUT);
1449         }
1450
1451         CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_ALLOC);
1452         *id = CSR_READ_2(sc, WI_ALLOC_FID);
1453
1454         if (wi_seek(sc, *id, 0, WI_BAP0)) {
1455                 device_printf(sc->dev, "seek failed while allocating memory on card\n");
1456                 return(EIO);
1457         }
1458
1459         for (i = 0; i < len / 2; i++)
1460                 CSR_WRITE_2(sc, WI_DATA0, 0);
1461
1462         return(0);
1463 }
1464
1465 static void
1466 wi_setmulti(sc)
1467         struct wi_softc         *sc;
1468 {
1469         struct ifnet            *ifp;
1470         int                     i = 0;
1471         struct ifmultiaddr      *ifma;
1472         struct wi_ltv_mcast     mcast;
1473
1474         ifp = &sc->arpcom.ac_if;
1475
1476         bzero((char *)&mcast, sizeof(mcast));
1477
1478         mcast.wi_type = WI_RID_MCAST_LIST;
1479         mcast.wi_len = (3 * 16) + 1;
1480
1481         if (ifp->if_flags & IFF_ALLMULTI || ifp->if_flags & IFF_PROMISC) {
1482                 wi_write_record(sc, (struct wi_ltv_gen *)&mcast);
1483                 return;
1484         }
1485
1486 #if defined(__DragonFly__) || __FreeBSD_version < 500000
1487         LIST_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
1488 #else
1489         TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
1490 #endif
1491                 if (ifma->ifma_addr->sa_family != AF_LINK)
1492                         continue;
1493                 if (i < 16) {
1494                         bcopy(LLADDR((struct sockaddr_dl *)ifma->ifma_addr),
1495                             (char *)&mcast.wi_mcast[i], ETHER_ADDR_LEN);
1496                         i++;
1497                 } else {
1498                         bzero((char *)&mcast, sizeof(mcast));
1499                         break;
1500                 }
1501         }
1502
1503         mcast.wi_len = (i * 3) + 1;
1504         wi_write_record(sc, (struct wi_ltv_gen *)&mcast);
1505
1506         return;
1507 }
1508
1509 static void
1510 wi_setdef(sc, wreq)
1511         struct wi_softc         *sc;
1512         struct wi_req           *wreq;
1513 {
1514         struct ifnet            *ifp;
1515
1516         ifp = &sc->arpcom.ac_if;
1517
1518         switch(wreq->wi_type) {
1519         case WI_RID_MAC_NODE:
1520                 bcopy((char *)&wreq->wi_val, (char *)&sc->arpcom.ac_enaddr,
1521                    ETHER_ADDR_LEN);
1522                 bcopy((char *)&wreq->wi_val, IF_LLADDR(ifp), ETHER_ADDR_LEN);
1523                 break;
1524         case WI_RID_PORTTYPE:
1525                 sc->wi_ptype = le16toh(wreq->wi_val[0]);
1526                 break;
1527         case WI_RID_TX_RATE:
1528                 sc->wi_tx_rate = le16toh(wreq->wi_val[0]);
1529                 break;
1530         case WI_RID_MAX_DATALEN:
1531                 sc->wi_max_data_len = le16toh(wreq->wi_val[0]);
1532                 break;
1533         case WI_RID_RTS_THRESH:
1534                 sc->wi_rts_thresh = le16toh(wreq->wi_val[0]);
1535                 break;
1536         case WI_RID_SYSTEM_SCALE:
1537                 sc->wi_ap_density = le16toh(wreq->wi_val[0]);
1538                 break;
1539         case WI_RID_CREATE_IBSS:
1540                 sc->wi_create_ibss = le16toh(wreq->wi_val[0]);
1541                 break;
1542         case WI_RID_OWN_CHNL:
1543                 sc->wi_channel = le16toh(wreq->wi_val[0]);
1544                 break;
1545         case WI_RID_NODENAME:
1546                 bzero(sc->wi_node_name, sizeof(sc->wi_node_name));
1547                 bcopy((char *)&wreq->wi_val[1], sc->wi_node_name, 30);
1548                 break;
1549         case WI_RID_DESIRED_SSID:
1550                 bzero(sc->wi_net_name, sizeof(sc->wi_net_name));
1551                 bcopy((char *)&wreq->wi_val[1], sc->wi_net_name, 30);
1552                 break;
1553         case WI_RID_OWN_SSID:
1554                 bzero(sc->wi_ibss_name, sizeof(sc->wi_ibss_name));
1555                 bcopy((char *)&wreq->wi_val[1], sc->wi_ibss_name, 30);
1556                 break;
1557         case WI_RID_PM_ENABLED:
1558                 sc->wi_pm_enabled = le16toh(wreq->wi_val[0]);
1559                 break;
1560         case WI_RID_MICROWAVE_OVEN:
1561                 sc->wi_mor_enabled = le16toh(wreq->wi_val[0]);
1562                 break;
1563         case WI_RID_MAX_SLEEP:
1564                 sc->wi_max_sleep = le16toh(wreq->wi_val[0]);
1565                 break;
1566         case WI_RID_CNFAUTHMODE:
1567                 sc->wi_authtype = le16toh(wreq->wi_val[0]);
1568                 break;
1569         case WI_RID_ROAMING_MODE:
1570                 sc->wi_roaming = le16toh(wreq->wi_val[0]);
1571                 break;
1572         case WI_RID_ENCRYPTION:
1573                 sc->wi_use_wep = le16toh(wreq->wi_val[0]);
1574                 break;
1575         case WI_RID_TX_CRYPT_KEY:
1576                 sc->wi_tx_key = le16toh(wreq->wi_val[0]);
1577                 break;
1578         case WI_RID_DEFLT_CRYPT_KEYS:
1579                 bcopy((char *)wreq, (char *)&sc->wi_keys,
1580                     sizeof(struct wi_ltv_keys));
1581                 break;
1582         default:
1583                 break;
1584         }
1585
1586         /* Reinitialize WaveLAN. */
1587         wi_init(sc);
1588
1589         return;
1590 }
1591
1592 static int
1593 wi_ioctl(ifp, command, data, cr)
1594         struct ifnet            *ifp;
1595         u_long                  command;
1596         caddr_t                 data;
1597         struct ucred            *cr;
1598 {
1599         int                     error = 0;
1600         int                     len;
1601         u_int8_t                tmpkey[14];
1602         char                    tmpssid[IEEE80211_NWID_LEN];
1603         struct wi_softc         *sc = ifp->if_softc;
1604         struct wi_req           wreq;
1605         struct ifreq            *ifr;
1606         struct ieee80211req     *ireq;
1607
1608         ifr = (struct ifreq *)data;
1609         ireq = (struct ieee80211req *)data;
1610
1611         crit_enter();
1612
1613         if (sc->wi_gone) {
1614                 error = ENODEV;
1615                 goto out;
1616         }
1617
1618         switch(command) {
1619         case SIOCSIFFLAGS:
1620                 /*
1621                  * Can't do promisc and hostap at the same time.  If all that's
1622                  * changing is the promisc flag, try to short-circuit a call to
1623                  * wi_init() by just setting PROMISC in the hardware.
1624                  */
1625                 if (ifp->if_flags & IFF_UP) {
1626                         if (sc->wi_ptype != WI_PORTTYPE_AP &&
1627                             ifp->if_flags & IFF_RUNNING) {
1628                                 if (ifp->if_flags & IFF_PROMISC &&
1629                                     !(sc->wi_if_flags & IFF_PROMISC)) {
1630                                         WI_SETVAL(WI_RID_PROMISC, 1);
1631                                 } else if (!(ifp->if_flags & IFF_PROMISC) &&
1632                                     sc->wi_if_flags & IFF_PROMISC) {
1633                                         WI_SETVAL(WI_RID_PROMISC, 0);
1634                                 } else {
1635                                         wi_init(sc);
1636                                 }
1637                         } else {
1638                                 wi_init(sc);
1639                         }
1640                 } else {
1641                         if (ifp->if_flags & IFF_RUNNING) {
1642                                 wi_stop(sc);
1643                         }
1644                 }
1645                 sc->wi_if_flags = ifp->if_flags;
1646                 error = 0;
1647                 break;
1648         case SIOCSIFMEDIA:
1649         case SIOCGIFMEDIA:
1650                 error = ifmedia_ioctl(ifp, ifr, &sc->ifmedia, command);
1651                 break;
1652         case SIOCADDMULTI:
1653         case SIOCDELMULTI:
1654                 wi_setmulti(sc);
1655                 error = 0;
1656                 break;
1657         case SIOCGWAVELAN:
1658                 error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1659                 if (error)
1660                         break;
1661                 if (wreq.wi_len > WI_MAX_DATALEN) {
1662                         error = EINVAL;
1663                         break;
1664                 }
1665                 /* Don't show WEP keys to non-root users. */
1666                 if (wreq.wi_type == WI_RID_DEFLT_CRYPT_KEYS &&
1667                     suser_cred(cr, NULL_CRED_OKAY))
1668                         break;
1669                 if (wreq.wi_type == WI_RID_IFACE_STATS) {
1670                         bcopy((char *)&sc->wi_stats, (char *)&wreq.wi_val,
1671                             sizeof(sc->wi_stats));
1672                         wreq.wi_len = (sizeof(sc->wi_stats) / 2) + 1;
1673                 } else if (wreq.wi_type == WI_RID_DEFLT_CRYPT_KEYS) {
1674                         bcopy((char *)&sc->wi_keys, (char *)&wreq,
1675                             sizeof(struct wi_ltv_keys));
1676                 }
1677 #ifdef WICACHE
1678                 else if (wreq.wi_type == WI_RID_ZERO_CACHE) {
1679                         sc->wi_sigitems = sc->wi_nextitem = 0;
1680                 } else if (wreq.wi_type == WI_RID_READ_CACHE) {
1681                         char *pt = (char *)&wreq.wi_val;
1682                         bcopy((char *)&sc->wi_sigitems,
1683                             (char *)pt, sizeof(int));
1684                         pt += (sizeof (int));
1685                         wreq.wi_len = sizeof(int) / 2;
1686                         bcopy((char *)&sc->wi_sigcache, (char *)pt,
1687                             sizeof(struct wi_sigcache) * sc->wi_sigitems);
1688                         wreq.wi_len += ((sizeof(struct wi_sigcache) *
1689                             sc->wi_sigitems) / 2) + 1;
1690                 }
1691 #endif
1692                 else if (wreq.wi_type == WI_RID_PROCFRAME) {
1693                         wreq.wi_len = 2;
1694                         wreq.wi_val[0] = sc->wi_procframe;
1695                 } else if (wreq.wi_type == WI_RID_PRISM2) {
1696                         wreq.wi_len = 2;
1697                         wreq.wi_val[0] = sc->sc_firmware_type != WI_LUCENT;
1698                 } else if (wreq.wi_type == WI_RID_SCAN_RES &&
1699                     sc->sc_firmware_type == WI_LUCENT) {
1700                         memcpy((char *)wreq.wi_val, (char *)sc->wi_scanbuf,
1701                             sc->wi_scanbuf_len * 2);
1702                         wreq.wi_len = sc->wi_scanbuf_len;
1703                 } else {
1704                         if (wi_read_record(sc, (struct wi_ltv_gen *)&wreq)) {
1705                                 error = EINVAL;
1706                                 break;
1707                         }
1708                 }
1709                 error = copyout(&wreq, ifr->ifr_data, sizeof(wreq));
1710                 break;
1711         case SIOCSWAVELAN:
1712                 if ((error = suser_cred(cr, NULL_CRED_OKAY)))
1713                         goto out;
1714                 error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1715                 if (error)
1716                         break;
1717                 if (wreq.wi_len > WI_MAX_DATALEN) {
1718                         error = EINVAL;
1719                         break;
1720                 }
1721                 if (wreq.wi_type == WI_RID_IFACE_STATS) {
1722                         error = EINVAL;
1723                         break;
1724                 } else if (wreq.wi_type == WI_RID_MGMT_XMIT) {
1725                         error = owi_mgmt_xmit(sc, (caddr_t)&wreq.wi_val,
1726                             wreq.wi_len);
1727                 } else if (wreq.wi_type == WI_RID_PROCFRAME) {
1728                         sc->wi_procframe = wreq.wi_val[0];
1729                 /*
1730                  * if we're getting a scan request from a wavelan card
1731                  * (non-prism2), send out a cmd_inquire to the card to scan
1732                  * results for the scan will be received through the info
1733                  * interrupt handler. otherwise the scan request can be
1734                  * directly handled by a prism2 card's rid interface.
1735                  */
1736                 } else if (wreq.wi_type == WI_RID_SCAN_REQ &&
1737                     sc->sc_firmware_type == WI_LUCENT) {
1738                         wi_cmd(sc, WI_CMD_INQUIRE, WI_INFO_SCAN_RESULTS, 0, 0);
1739                 } else {
1740                         error = wi_write_record(sc, (struct wi_ltv_gen *)&wreq);
1741                         if (!error)
1742                                 wi_setdef(sc, &wreq);
1743                 }
1744                 break;
1745         case SIOCGPRISM2DEBUG:
1746                 error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1747                 if (error)
1748                         break;
1749                 if (!(ifp->if_flags & IFF_RUNNING) ||
1750                     sc->sc_firmware_type == WI_LUCENT) {
1751                         error = EIO;
1752                         break;
1753                 }
1754                 error = wi_get_debug(sc, &wreq);
1755                 if (error == 0)
1756                         error = copyout(&wreq, ifr->ifr_data, sizeof(wreq));
1757                 break;
1758         case SIOCSPRISM2DEBUG:
1759                 if ((error = suser_cred(cr, NULL_CRED_OKAY)))
1760                         goto out;
1761                 error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1762                 if (error)
1763                         break;
1764                 error = wi_set_debug(sc, &wreq);
1765                 break;
1766         case SIOCG80211:
1767                 switch(ireq->i_type) {
1768                 case IEEE80211_IOC_SSID:
1769                         if(ireq->i_val == -1) {
1770                                 bzero(tmpssid, IEEE80211_NWID_LEN);
1771                                 error = wi_get_cur_ssid(sc, tmpssid, &len);
1772                                 if (error != 0)
1773                                         break;
1774                                 error = copyout(tmpssid, ireq->i_data,
1775                                         IEEE80211_NWID_LEN);
1776                                 ireq->i_len = len;
1777                         } else if (ireq->i_val == 0) {
1778                                 error = copyout(sc->wi_net_name,
1779                                     ireq->i_data,
1780                                     IEEE80211_NWID_LEN);
1781                                 ireq->i_len = IEEE80211_NWID_LEN;
1782                         } else
1783                                 error = EINVAL;
1784                         break;
1785                 case IEEE80211_IOC_NUMSSIDS:
1786                         ireq->i_val = 1;
1787                         break;
1788                 case IEEE80211_IOC_WEP:
1789                         if(!sc->wi_has_wep) {
1790                                 ireq->i_val = IEEE80211_WEP_NOSUP;
1791                         } else {
1792                                 if(sc->wi_use_wep) {
1793                                         ireq->i_val =
1794                                             IEEE80211_WEP_MIXED;
1795                                 } else {
1796                                         ireq->i_val =
1797                                             IEEE80211_WEP_OFF;
1798                                 }
1799                         }
1800                         break;
1801                 case IEEE80211_IOC_WEPKEY:
1802                         if(!sc->wi_has_wep ||
1803                             ireq->i_val < 0 || ireq->i_val > 3) {
1804                                 error = EINVAL;
1805                                 break;
1806                         }
1807                         len = sc->wi_keys.wi_keys[ireq->i_val].wi_keylen;
1808                         if (suser_cred(cr, NULL_CRED_OKAY))
1809                                 bcopy(sc->wi_keys.wi_keys[ireq->i_val].wi_keydat,
1810                                     tmpkey, len);
1811                         else
1812                                 bzero(tmpkey, len);
1813
1814                         ireq->i_len = len;
1815                         error = copyout(tmpkey, ireq->i_data, len);
1816
1817                         break;
1818                 case IEEE80211_IOC_NUMWEPKEYS:
1819                         if(!sc->wi_has_wep)
1820                                 error = EINVAL;
1821                         else
1822                                 ireq->i_val = 4;
1823                         break;
1824                 case IEEE80211_IOC_WEPTXKEY:
1825                         if(!sc->wi_has_wep)
1826                                 error = EINVAL;
1827                         else
1828                                 ireq->i_val = sc->wi_tx_key;
1829                         break;
1830                 case IEEE80211_IOC_AUTHMODE:
1831                         ireq->i_val = sc->wi_authmode;
1832                         break;
1833                 case IEEE80211_IOC_STATIONNAME:
1834                         error = copyout(sc->wi_node_name,
1835                             ireq->i_data, IEEE80211_NWID_LEN);
1836                         ireq->i_len = IEEE80211_NWID_LEN;
1837                         break;
1838                 case IEEE80211_IOC_CHANNEL:
1839                         wreq.wi_type = WI_RID_CURRENT_CHAN;
1840                         wreq.wi_len = WI_MAX_DATALEN;
1841                         if (wi_read_record(sc, (struct wi_ltv_gen *)&wreq))
1842                                 error = EINVAL;
1843                         else {
1844                                 ireq->i_val = wreq.wi_val[0];
1845                         }
1846                         break;
1847                 case IEEE80211_IOC_POWERSAVE:
1848                         if(sc->wi_pm_enabled)
1849                                 ireq->i_val = IEEE80211_POWERSAVE_ON;
1850                         else
1851                                 ireq->i_val = IEEE80211_POWERSAVE_OFF;
1852                         break;
1853                 case IEEE80211_IOC_POWERSAVESLEEP:
1854                         ireq->i_val = sc->wi_max_sleep;
1855                         break;
1856                 default:
1857                         error = EINVAL;
1858                 }
1859                 break;
1860         case SIOCS80211:
1861                 if ((error = suser_cred(cr, NULL_CRED_OKAY)))
1862                         goto out;
1863                 switch(ireq->i_type) {
1864                 case IEEE80211_IOC_SSID:
1865                         if (ireq->i_val != 0 ||
1866                             ireq->i_len > IEEE80211_NWID_LEN) {
1867                                 error = EINVAL;
1868                                 break;
1869                         }
1870                         /* We set both of them */
1871                         bzero(sc->wi_net_name, IEEE80211_NWID_LEN);
1872                         error = copyin(ireq->i_data,
1873                             sc->wi_net_name, ireq->i_len);
1874                         bcopy(sc->wi_net_name, sc->wi_ibss_name, IEEE80211_NWID_LEN);
1875                         break;
1876                 case IEEE80211_IOC_WEP:
1877                         /*
1878                          * These cards only support one mode so
1879                          * we just turn wep on what ever is
1880                          * passed in if it's not OFF.
1881                          */
1882                         if (ireq->i_val == IEEE80211_WEP_OFF) {
1883                                 sc->wi_use_wep = 0;
1884                         } else {
1885                                 sc->wi_use_wep = 1;
1886                         }
1887                         break;
1888                 case IEEE80211_IOC_WEPKEY:
1889                         if (ireq->i_val < 0 || ireq->i_val > 3 ||
1890                                 ireq->i_len > 13) {
1891                                 error = EINVAL;
1892                                 break;
1893                         }
1894                         bzero(sc->wi_keys.wi_keys[ireq->i_val].wi_keydat, 13);
1895                         error = copyin(ireq->i_data,
1896                             sc->wi_keys.wi_keys[ireq->i_val].wi_keydat,
1897                             ireq->i_len);
1898                         if(error)
1899                                 break;
1900                         sc->wi_keys.wi_keys[ireq->i_val].wi_keylen =
1901                                     ireq->i_len;
1902                         break;
1903                 case IEEE80211_IOC_WEPTXKEY:
1904                         if (ireq->i_val < 0 || ireq->i_val > 3) {
1905                                 error = EINVAL;
1906                                 break;
1907                         }
1908                         sc->wi_tx_key = ireq->i_val;
1909                         break;
1910                 case IEEE80211_IOC_AUTHMODE:
1911                         sc->wi_authmode = ireq->i_val;
1912                         break;
1913                 case IEEE80211_IOC_STATIONNAME:
1914                         if (ireq->i_len > 32) {
1915                                 error = EINVAL;
1916                                 break;
1917                         }
1918                         bzero(sc->wi_node_name, 32);
1919                         error = copyin(ireq->i_data,
1920                             sc->wi_node_name, ireq->i_len);
1921                         break;
1922                 case IEEE80211_IOC_CHANNEL:
1923                         /*
1924                          * The actual range is 1-14, but if you
1925                          * set it to 0 you get the default. So
1926                          * we let that work too.
1927                          */
1928                         if (ireq->i_val < 0 || ireq->i_val > 14) {
1929                                 error = EINVAL;
1930                                 break;
1931                         }
1932                         sc->wi_channel = ireq->i_val;
1933                         break;
1934                 case IEEE80211_IOC_POWERSAVE:
1935                         switch (ireq->i_val) {
1936                         case IEEE80211_POWERSAVE_OFF:
1937                                 sc->wi_pm_enabled = 0;
1938                                 break;
1939                         case IEEE80211_POWERSAVE_ON:
1940                                 sc->wi_pm_enabled = 1;
1941                                 break;
1942                         default:
1943                                 error = EINVAL;
1944                                 break;
1945                         }
1946                         break;
1947                 case IEEE80211_IOC_POWERSAVESLEEP:
1948                         if (ireq->i_val < 0) {
1949                                 error = EINVAL;
1950                                 break;
1951                         }
1952                         sc->wi_max_sleep = ireq->i_val;
1953                         break;
1954                 default:
1955                         error = EINVAL;
1956                         break;
1957                 }
1958
1959                 /* Reinitialize WaveLAN. */
1960                 wi_init(sc);
1961
1962         break;
1963         case SIOCHOSTAP_ADD:
1964         case SIOCHOSTAP_DEL:
1965         case SIOCHOSTAP_GET:
1966         case SIOCHOSTAP_GETALL:
1967         case SIOCHOSTAP_GFLAGS:
1968         case SIOCHOSTAP_SFLAGS:
1969                 /* Send all Host AP specific ioctl's to Host AP code. */
1970                 error = owihap_ioctl(sc, command, data);
1971                 break;
1972         default:
1973                 error = ether_ioctl(ifp, command, data);
1974                 break;
1975         }
1976 out:
1977         crit_exit();
1978
1979         return(error);
1980 }
1981
1982 static void
1983 wi_init(xsc)
1984         void                    *xsc;
1985 {
1986         struct wi_softc         *sc = xsc;
1987         struct ifnet            *ifp = &sc->arpcom.ac_if;
1988         struct wi_ltv_macaddr   mac;
1989         int                     id = 0;
1990
1991         crit_enter();
1992
1993         if (sc->wi_gone) {
1994                 crit_exit();
1995                 return;
1996         }
1997
1998         if (ifp->if_flags & IFF_RUNNING)
1999                 wi_stop(sc);
2000
2001         wi_reset(sc);
2002
2003         /* Program max data length. */
2004         WI_SETVAL(WI_RID_MAX_DATALEN, sc->wi_max_data_len);
2005
2006         /* Set the port type. */
2007         WI_SETVAL(WI_RID_PORTTYPE, sc->wi_ptype);
2008
2009         /* Enable/disable IBSS creation. */
2010         WI_SETVAL(WI_RID_CREATE_IBSS, sc->wi_create_ibss);
2011
2012         /* Program the RTS/CTS threshold. */
2013         WI_SETVAL(WI_RID_RTS_THRESH, sc->wi_rts_thresh);
2014
2015         /* Program the TX rate */
2016         WI_SETVAL(WI_RID_TX_RATE, sc->wi_tx_rate);
2017
2018         /* Access point density */
2019         WI_SETVAL(WI_RID_SYSTEM_SCALE, sc->wi_ap_density);
2020
2021         /* Power Management Enabled */
2022         WI_SETVAL(WI_RID_PM_ENABLED, sc->wi_pm_enabled);
2023
2024         /* Power Managment Max Sleep */
2025         WI_SETVAL(WI_RID_MAX_SLEEP, sc->wi_max_sleep);
2026
2027         /* Roaming type */
2028         WI_SETVAL(WI_RID_ROAMING_MODE, sc->wi_roaming);
2029
2030         /* Specify the IBSS name */
2031         WI_SETSTR(WI_RID_OWN_SSID, sc->wi_ibss_name);
2032
2033         /* Specify the network name */
2034         WI_SETSTR(WI_RID_DESIRED_SSID, sc->wi_net_name);
2035
2036         /* Specify the frequency to use */
2037         WI_SETVAL(WI_RID_OWN_CHNL, sc->wi_channel);
2038
2039         /* Program the nodename. */
2040         WI_SETSTR(WI_RID_NODENAME, sc->wi_node_name);
2041
2042         /* Specify the authentication mode. */
2043         WI_SETVAL(WI_RID_CNFAUTHMODE, sc->wi_authmode);
2044
2045         /* Set our MAC address. */
2046         mac.wi_len = 4;
2047         mac.wi_type = WI_RID_MAC_NODE;
2048         bcopy((char *)&sc->arpcom.ac_enaddr,
2049            (char *)&mac.wi_mac_addr, ETHER_ADDR_LEN);
2050         wi_write_record(sc, (struct wi_ltv_gen *)&mac);
2051
2052         /*
2053          * Initialize promisc mode.
2054          *      Being in the Host-AP mode causes
2055          *      great deal of pain if promisc mode is set.
2056          *      Therefore we avoid confusing the firmware
2057          *      and always reset promisc mode in Host-AP regime,
2058          *      it shows us all the packets anyway.
2059          */
2060         if (sc->wi_ptype != WI_PORTTYPE_AP && ifp->if_flags & IFF_PROMISC)
2061                 WI_SETVAL(WI_RID_PROMISC, 1);
2062         else
2063                 WI_SETVAL(WI_RID_PROMISC, 0);
2064
2065         /* Configure WEP. */
2066         if (sc->wi_has_wep) {
2067                 WI_SETVAL(WI_RID_ENCRYPTION, sc->wi_use_wep);
2068                 WI_SETVAL(WI_RID_TX_CRYPT_KEY, sc->wi_tx_key);
2069                 sc->wi_keys.wi_len = (sizeof(struct wi_ltv_keys) / 2) + 1;
2070                 sc->wi_keys.wi_type = WI_RID_DEFLT_CRYPT_KEYS;
2071                 wi_write_record(sc, (struct wi_ltv_gen *)&sc->wi_keys);
2072                 if (sc->sc_firmware_type != WI_LUCENT && sc->wi_use_wep) {
2073                         /*
2074                          * ONLY HWB3163 EVAL-CARD Firmware version
2075                          * less than 0.8 variant2
2076                          *
2077                          * If promiscuous mode disable, Prism2 chip
2078                          * does not work with WEP.
2079                          * It is under investigation for details.
2080                          * (ichiro@netbsd.org)
2081                          *
2082                          * And make sure that we don't need to do it
2083                          * in hostap mode, since it interferes with
2084                          * the above hostap workaround.
2085                          */
2086                         if (sc->wi_ptype != WI_PORTTYPE_AP &&
2087                             sc->sc_firmware_type == WI_INTERSIL &&
2088                             sc->sc_sta_firmware_ver < 802 ) {
2089                                 /* firm ver < 0.8 variant 2 */
2090                                 WI_SETVAL(WI_RID_PROMISC, 1);
2091                         }
2092                         WI_SETVAL(WI_RID_CNFAUTHMODE, sc->wi_authtype);
2093                 }
2094         }
2095
2096         /* Set multicast filter. */
2097         wi_setmulti(sc);
2098
2099         /* Enable desired port */
2100         wi_cmd(sc, WI_CMD_ENABLE | sc->wi_portnum, 0, 0, 0);
2101
2102         if (wi_alloc_nicmem(sc, ETHER_MAX_LEN + sizeof(struct wi_frame) + 8, &id))
2103                 device_printf(sc->dev, "tx buffer allocation failed\n");
2104         sc->wi_tx_data_id = id;
2105
2106         if (wi_alloc_nicmem(sc, ETHER_MAX_LEN + sizeof(struct wi_frame) + 8, &id))
2107                 device_printf(sc->dev, "mgmt. buffer allocation failed\n");
2108         sc->wi_tx_mgmt_id = id;
2109
2110         /* enable interrupts */
2111         CSR_WRITE_2(sc, WI_INT_EN, WI_INTRS);
2112
2113         owihap_init(sc);
2114
2115         ifp->if_flags |= IFF_RUNNING;
2116         ifp->if_flags &= ~IFF_OACTIVE;
2117
2118         callout_reset(&sc->wi_stat_timer, hz * 60, wi_inquire, sc);
2119
2120         crit_exit();
2121 }
2122
2123 #define RC4STATE 256
2124 #define RC4KEYLEN 16
2125 #define RC4SWAP(x,y) \
2126     do { u_int8_t t = state[x]; state[x] = state[y]; state[y] = t; } while(0)
2127
2128 static void
2129 wi_do_hostencrypt(struct wi_softc *sc, caddr_t buf, int len)
2130 {
2131         u_int32_t i, crc, klen;
2132         u_int8_t state[RC4STATE], key[RC4KEYLEN];
2133         u_int8_t x, y, *dat;
2134
2135         if (!sc->wi_icv_flag) {
2136                 sc->wi_icv = arc4random();
2137                 sc->wi_icv_flag++;
2138         } else
2139                 sc->wi_icv++;
2140         /*
2141          * Skip 'bad' IVs from Fluhrer/Mantin/Shamir:
2142          * (B, 255, N) with 3 <= B < 8
2143          */
2144         if (sc->wi_icv >= 0x03ff00 &&
2145             (sc->wi_icv & 0xf8ff00) == 0x00ff00)
2146                 sc->wi_icv += 0x000100;
2147
2148         /* prepend 24bit IV to tx key, byte order does not matter */
2149         key[0] = sc->wi_icv >> 16;
2150         key[1] = sc->wi_icv >> 8;
2151         key[2] = sc->wi_icv;
2152
2153         klen = sc->wi_keys.wi_keys[sc->wi_tx_key].wi_keylen +
2154             IEEE80211_WEP_IVLEN;
2155         klen = (klen >= RC4KEYLEN) ? RC4KEYLEN : RC4KEYLEN/2;
2156         bcopy((char *)&sc->wi_keys.wi_keys[sc->wi_tx_key].wi_keydat,
2157             (char *)key + IEEE80211_WEP_IVLEN, klen - IEEE80211_WEP_IVLEN);
2158
2159         /* rc4 keysetup */
2160         x = y = 0;
2161         for (i = 0; i < RC4STATE; i++)
2162                 state[i] = i;
2163         for (i = 0; i < RC4STATE; i++) {
2164                 y = (key[x] + state[i] + y) % RC4STATE;
2165                 RC4SWAP(i, y);
2166                 x = (x + 1) % klen;
2167         }
2168
2169         /* output: IV, tx keyid, rc4(data), rc4(crc32(data)) */
2170         dat = buf;
2171         dat[0] = key[0];
2172         dat[1] = key[1];
2173         dat[2] = key[2];
2174         dat[3] = sc->wi_tx_key << 6;            /* pad and keyid */
2175         dat += 4;
2176
2177         /* compute rc4 over data, crc32 over data */
2178         crc = ~0;
2179         x = y = 0;
2180         for (i = 0; i < len; i++) {
2181                 x = (x + 1) % RC4STATE;
2182                 y = (state[x] + y) % RC4STATE;
2183                 RC4SWAP(x, y);
2184                 crc = crc32_tab[(crc ^ dat[i]) & 0xff] ^ (crc >> 8);
2185                 dat[i] ^= state[(state[x] + state[y]) % RC4STATE];
2186         }
2187         crc = ~crc;
2188         dat += len;
2189
2190         /* append little-endian crc32 and encrypt */
2191         dat[0] = crc;
2192         dat[1] = crc >> 8;
2193         dat[2] = crc >> 16;
2194         dat[3] = crc >> 24;
2195         for (i = 0; i < IEEE80211_WEP_CRCLEN; i++) {
2196                 x = (x + 1) % RC4STATE;
2197                 y = (state[x] + y) % RC4STATE;
2198                 RC4SWAP(x, y);
2199                 dat[i] ^= state[(state[x] + state[y]) % RC4STATE];
2200         }
2201 }
2202
2203 static void
2204 wi_start(ifp)
2205         struct ifnet            *ifp;
2206 {
2207         struct wi_softc         *sc = ifp->if_softc;
2208         struct mbuf             *m0;
2209         struct wi_frame         tx_frame;
2210         struct ether_header     *eh;
2211         int                     id;
2212
2213         crit_enter();
2214
2215         if (sc->wi_gone) {
2216                 crit_exit();
2217                 return;
2218         }
2219
2220         if (ifp->if_flags & IFF_OACTIVE) {
2221                 crit_exit();
2222                 return;
2223         }
2224
2225 nextpkt:
2226         m0 = ifq_dequeue(&ifp->if_snd);
2227         if (m0 == NULL) {
2228                 crit_exit();
2229                 return;
2230         }
2231
2232         bzero((char *)&tx_frame, sizeof(tx_frame));
2233         tx_frame.wi_frame_ctl = htole16(WI_FTYPE_DATA);
2234         id = sc->wi_tx_data_id;
2235         eh = mtod(m0, struct ether_header *);
2236
2237         if (sc->wi_ptype == WI_PORTTYPE_AP) {
2238                 if (!owihap_check_tx(&sc->wi_hostap_info,
2239                     eh->ether_dhost, &tx_frame.wi_tx_rate)) {
2240                         if (ifp->if_flags & IFF_DEBUG)
2241                                 printf("wi_start: dropping unassoc "
2242                                        "dst %6D\n", eh->ether_dhost, ":");
2243                         m_freem(m0);
2244                         goto nextpkt;
2245                 }
2246         }
2247         /*
2248          * Use RFC1042 encoding for IP and ARP datagrams,
2249          * 802.3 for anything else.
2250          */
2251         if (ntohs(eh->ether_type) > ETHER_MAX_LEN) {
2252                 bcopy((char *)&eh->ether_dhost,
2253                     (char *)&tx_frame.wi_addr1, ETHER_ADDR_LEN);
2254                 if (sc->wi_ptype == WI_PORTTYPE_AP) {
2255                         tx_frame.wi_tx_ctl = WI_ENC_TX_MGMT; /* XXX */
2256                         tx_frame.wi_frame_ctl |= WI_FCTL_FROMDS;
2257                         if (sc->wi_use_wep)
2258                                 tx_frame.wi_frame_ctl |= WI_FCTL_WEP;
2259                         bcopy((char *)&sc->arpcom.ac_enaddr,
2260                               (char *)&tx_frame.wi_addr2, ETHER_ADDR_LEN);
2261                         bcopy((char *)&eh->ether_shost,
2262                               (char *)&tx_frame.wi_addr3, ETHER_ADDR_LEN);
2263                 }
2264                 else
2265                         bcopy((char *)&eh->ether_shost,
2266                             (char *)&tx_frame.wi_addr2, ETHER_ADDR_LEN);
2267                 bcopy((char *)&eh->ether_dhost,
2268                     (char *)&tx_frame.wi_dst_addr, ETHER_ADDR_LEN);
2269                 bcopy((char *)&eh->ether_shost,
2270                     (char *)&tx_frame.wi_src_addr, ETHER_ADDR_LEN);
2271
2272                 tx_frame.wi_dat_len = m0->m_pkthdr.len - WI_SNAPHDR_LEN;
2273                 tx_frame.wi_dat[0] = htons(WI_SNAP_WORD0);
2274                 tx_frame.wi_dat[1] = htons(WI_SNAP_WORD1);
2275                 tx_frame.wi_len = htons(m0->m_pkthdr.len - WI_SNAPHDR_LEN);
2276                 tx_frame.wi_type = eh->ether_type;
2277
2278                 if (sc->wi_ptype == WI_PORTTYPE_AP && sc->wi_use_wep) {
2279                         /* Do host encryption. */
2280                         bcopy(&tx_frame.wi_dat[0], &sc->wi_txbuf[4], 8);
2281                         m_copydata(m0, sizeof(struct ether_header),
2282                             m0->m_pkthdr.len - sizeof(struct ether_header),
2283                             (caddr_t)&sc->wi_txbuf[12]);
2284                         wi_do_hostencrypt(sc, &sc->wi_txbuf[0],
2285                             tx_frame.wi_dat_len);
2286                         tx_frame.wi_dat_len += IEEE80211_WEP_IVLEN +
2287                             IEEE80211_WEP_KIDLEN + IEEE80211_WEP_CRCLEN;
2288                         wi_write_data(sc, id, 0, (caddr_t)&tx_frame,
2289                             sizeof(struct wi_frame));
2290                         wi_write_data(sc, id, WI_802_11_OFFSET_RAW,
2291                             (caddr_t)&sc->wi_txbuf, (m0->m_pkthdr.len -
2292                             sizeof(struct ether_header)) + 18);
2293                 } else {
2294                         m_copydata(m0, sizeof(struct ether_header),
2295                             m0->m_pkthdr.len - sizeof(struct ether_header),
2296                             (caddr_t)&sc->wi_txbuf);
2297                         wi_write_data(sc, id, 0, (caddr_t)&tx_frame,
2298                             sizeof(struct wi_frame));
2299                         wi_write_data(sc, id, WI_802_11_OFFSET,
2300                             (caddr_t)&sc->wi_txbuf, (m0->m_pkthdr.len -
2301                             sizeof(struct ether_header)) + 2);
2302                 }
2303         } else {
2304                 tx_frame.wi_dat_len = m0->m_pkthdr.len;
2305
2306                 if (sc->wi_ptype == WI_PORTTYPE_AP && sc->wi_use_wep) {
2307                         /* Do host encryption. */
2308                         printf( "XXX: host encrypt not implemented for 802.3\n" );
2309                 } else {
2310                         eh->ether_type = htons(m0->m_pkthdr.len -
2311                             WI_SNAPHDR_LEN);
2312                         m_copydata(m0, 0, m0->m_pkthdr.len,
2313                             (caddr_t)&sc->wi_txbuf);
2314
2315                         wi_write_data(sc, id, 0, (caddr_t)&tx_frame,
2316                             sizeof(struct wi_frame));
2317                         wi_write_data(sc, id, WI_802_3_OFFSET,
2318                             (caddr_t)&sc->wi_txbuf, m0->m_pkthdr.len + 2);
2319                 }
2320         }
2321
2322         /*
2323          * If there's a BPF listner, bounce a copy of
2324          * this frame to him. Also, don't send this to the bpf sniffer
2325          * if we're in procframe or monitor sniffing mode.
2326          */
2327         if (!(sc->wi_procframe || sc->wi_debug.wi_monitor))
2328                 BPF_MTAP(ifp, m0);
2329
2330         m_freem(m0);
2331
2332         if (wi_cmd(sc, WI_CMD_TX|WI_RECLAIM, id, 0, 0))
2333                 device_printf(sc->dev, "xmit failed\n");
2334
2335         ifp->if_flags |= IFF_OACTIVE;
2336
2337         /*
2338          * Set a timeout in case the chip goes out to lunch.
2339          */
2340         ifp->if_timer = 5;
2341
2342         crit_exit();
2343 }
2344
2345 int
2346 owi_mgmt_xmit(sc, data, len)
2347         struct wi_softc         *sc;
2348         caddr_t                 data;
2349         int                     len;
2350 {
2351         struct wi_frame         tx_frame;
2352         int                     id;
2353         struct wi_80211_hdr     *hdr;
2354         caddr_t                 dptr;
2355
2356         if (sc->wi_gone)
2357                 return(ENODEV);
2358
2359         hdr = (struct wi_80211_hdr *)data;
2360         dptr = data + sizeof(struct wi_80211_hdr);
2361
2362         bzero((char *)&tx_frame, sizeof(tx_frame));
2363         id = sc->wi_tx_mgmt_id;
2364
2365         bcopy((char *)hdr, (char *)&tx_frame.wi_frame_ctl,
2366            sizeof(struct wi_80211_hdr));
2367
2368         tx_frame.wi_tx_ctl = WI_ENC_TX_MGMT;
2369         tx_frame.wi_dat_len = len - sizeof(struct wi_80211_hdr);
2370         tx_frame.wi_len = htons(tx_frame.wi_dat_len);
2371
2372         wi_write_data(sc, id, 0, (caddr_t)&tx_frame, sizeof(struct wi_frame));
2373         wi_write_data(sc, id, WI_802_11_OFFSET_RAW, dptr,
2374             len - sizeof(struct wi_80211_hdr) + 2);
2375
2376         if (wi_cmd(sc, WI_CMD_TX|WI_RECLAIM, id, 0, 0)) {
2377                 device_printf(sc->dev, "xmit failed\n");
2378                 return(EIO);
2379         }
2380
2381         return(0);
2382 }
2383
2384 static void
2385 wi_stop(sc)
2386         struct wi_softc         *sc;
2387 {
2388         struct ifnet            *ifp;
2389
2390         crit_enter();
2391
2392         if (sc->wi_gone) {
2393                 crit_exit();
2394                 return;
2395         }
2396
2397         owihap_shutdown(sc);
2398
2399         ifp = &sc->arpcom.ac_if;
2400
2401         /*
2402          * If the card is gone and the memory port isn't mapped, we will
2403          * (hopefully) get 0xffff back from the status read, which is not
2404          * a valid status value.
2405          */
2406         if (CSR_READ_2(sc, WI_STATUS) != 0xffff) {
2407                 CSR_WRITE_2(sc, WI_INT_EN, 0);
2408                 wi_cmd(sc, WI_CMD_DISABLE|sc->wi_portnum, 0, 0, 0);
2409         }
2410
2411         callout_stop(&sc->wi_stat_timer);
2412
2413         ifp->if_flags &= ~(IFF_RUNNING|IFF_OACTIVE);
2414
2415         crit_exit();
2416 }
2417
2418 static void
2419 wi_watchdog(ifp)
2420         struct ifnet            *ifp;
2421 {
2422         struct wi_softc         *sc;
2423
2424         sc = ifp->if_softc;
2425
2426         device_printf(sc->dev, "watchdog timeout\n");
2427
2428         wi_init(sc);
2429
2430         ifp->if_oerrors++;
2431
2432         return;
2433 }
2434
2435 int
2436 owi_alloc(dev, rid)
2437         device_t                dev;
2438         int                     rid;
2439 {
2440         struct wi_softc         *sc = device_get_softc(dev);
2441
2442         if (sc->wi_bus_type != WI_BUS_PCI_NATIVE) {
2443                 sc->iobase_rid = rid;
2444                 sc->iobase = bus_alloc_resource(dev, SYS_RES_IOPORT,
2445                     &sc->iobase_rid, 0, ~0, (1 << 6),
2446                     rman_make_alignment_flags(1 << 6) | RF_ACTIVE);
2447                 if (!sc->iobase) {
2448                         device_printf(dev, "No I/O space?!\n");
2449                         return (ENXIO);
2450                 }
2451
2452                 sc->wi_io_addr = rman_get_start(sc->iobase);
2453                 sc->wi_btag = rman_get_bustag(sc->iobase);
2454                 sc->wi_bhandle = rman_get_bushandle(sc->iobase);
2455         } else {
2456                 sc->mem_rid = rid;
2457                 sc->mem = bus_alloc_resource_any(dev, SYS_RES_MEMORY,
2458                     &sc->mem_rid, RF_ACTIVE);
2459
2460                 if (!sc->mem) {
2461                         device_printf(dev, "No Mem space on prism2.5?\n");
2462                         return (ENXIO);
2463                 }
2464
2465                 sc->wi_btag = rman_get_bustag(sc->mem);
2466                 sc->wi_bhandle = rman_get_bushandle(sc->mem);
2467         }
2468
2469
2470         sc->irq_rid = 0;
2471         sc->irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &sc->irq_rid,
2472             RF_ACTIVE |
2473             ((sc->wi_bus_type == WI_BUS_PCCARD) ? 0 : RF_SHAREABLE));
2474
2475         if (!sc->irq) {
2476                 owi_free(dev);
2477                 device_printf(dev, "No irq?!\n");
2478                 return (ENXIO);
2479         }
2480
2481         sc->dev = dev;
2482         sc->wi_unit = device_get_unit(dev);
2483
2484         return (0);
2485 }
2486
2487 void
2488 owi_free(dev)
2489         device_t                dev;
2490 {
2491         struct wi_softc         *sc = device_get_softc(dev);
2492
2493         if (sc->iobase != NULL) {
2494                 bus_release_resource(dev, SYS_RES_IOPORT, sc->iobase_rid, sc->iobase);
2495                 sc->iobase = NULL;
2496         }
2497         if (sc->irq != NULL) {
2498                 bus_release_resource(dev, SYS_RES_IRQ, sc->irq_rid, sc->irq);
2499                 sc->irq = NULL;
2500         }
2501         if (sc->mem != NULL) {
2502                 bus_release_resource(dev, SYS_RES_MEMORY, sc->mem_rid, sc->mem);
2503                 sc->mem = NULL;
2504         }
2505
2506         return;
2507 }
2508
2509 void
2510 owi_shutdown(dev)
2511         device_t                dev;
2512 {
2513         struct wi_softc         *sc;
2514
2515         sc = device_get_softc(dev);
2516         wi_stop(sc);
2517
2518         return;
2519 }
2520
2521 #ifdef WICACHE
2522 /* wavelan signal strength cache code.
2523  * store signal/noise/quality on per MAC src basis in
2524  * a small fixed cache.  The cache wraps if > MAX slots
2525  * used.  The cache may be zeroed out to start over.
2526  * Two simple filters exist to reduce computation:
2527  * 1. ip only (literally 0x800) which may be used
2528  * to ignore some packets.  It defaults to ip only.
2529  * it could be used to focus on broadcast, non-IP 802.11 beacons.
2530  * 2. multicast/broadcast only.  This may be used to
2531  * ignore unicast packets and only cache signal strength
2532  * for multicast/broadcast packets (beacons); e.g., Mobile-IP
2533  * beacons and not unicast traffic.
2534  *
2535  * The cache stores (MAC src(index), IP src (major clue), signal,
2536  *      quality, noise)
2537  *
2538  * No apologies for storing IP src here.  It's easy and saves much
2539  * trouble elsewhere.  The cache is assumed to be INET dependent,
2540  * although it need not be.
2541  */
2542
2543 #ifdef documentation
2544
2545 int owi_sigitems;                                /* number of cached entries */
2546 struct wi_sigcache owi_sigcache[MAXWICACHE];  /*  array of cache entries */
2547 int owi_nextitem;                                /*  index/# of entries */
2548
2549
2550 #endif
2551
2552 /* control variables for cache filtering.  Basic idea is
2553  * to reduce cost (e.g., to only Mobile-IP agent beacons
2554  * which are broadcast or multicast).  Still you might
2555  * want to measure signal strength with unicast ping packets
2556  * on a pt. to pt. ant. setup.
2557  */
2558 /* set true if you want to limit cache items to broadcast/mcast
2559  * only packets (not unicast).  Useful for mobile-ip beacons which
2560  * are broadcast/multicast at network layer.  Default is all packets
2561  * so ping/unicast will work say with pt. to pt. antennae setup.
2562  */
2563 static int wi_cache_mcastonly = 0;
2564 SYSCTL_INT(_machdep, OID_AUTO, owi_cache_mcastonly, CTLFLAG_RW,
2565         &wi_cache_mcastonly, 0, "");
2566
2567 /* set true if you want to limit cache items to IP packets only
2568 */
2569 static int wi_cache_iponly = 1;
2570 SYSCTL_INT(_machdep, OID_AUTO, owi_cache_iponly, CTLFLAG_RW,
2571         &wi_cache_iponly, 0, "");
2572
2573 /*
2574  * Original comments:
2575  * -----------------
2576  * wi_cache_store, per rx packet store signal
2577  * strength in MAC (src) indexed cache.
2578  *
2579  * follows linux driver in how signal strength is computed.
2580  * In ad hoc mode, we use the rx_quality field.
2581  * signal and noise are trimmed to fit in the range from 47..138.
2582  * rx_quality field MSB is signal strength.
2583  * rx_quality field LSB is noise.
2584  * "quality" is (signal - noise) as is log value.
2585  * note: quality CAN be negative.
2586  *
2587  * In BSS mode, we use the RID for communication quality.
2588  * TBD:  BSS mode is currently untested.
2589  *
2590  * Bill's comments:
2591  * ---------------
2592  * Actually, we use the rx_quality field all the time for both "ad-hoc"
2593  * and BSS modes. Why? Because reading an RID is really, really expensive:
2594  * there's a bunch of PIO operations that have to be done to read a record
2595  * from the NIC, and reading the comms quality RID each time a packet is
2596  * received can really hurt performance. We don't have to do this anyway:
2597  * the comms quality field only reflects the values in the rx_quality field
2598  * anyway. The comms quality RID is only meaningful in infrastructure mode,
2599  * but the values it contains are updated based on the rx_quality from
2600  * frames received from the access point.
2601  *
2602  * Also, according to Lucent, the signal strength and noise level values
2603  * can be converted to dBms by subtracting 149, so I've modified the code
2604  * to do that instead of the scaling it did originally.
2605  */
2606 static void
2607 wi_cache_store(struct wi_softc *sc, struct mbuf *m, unsigned short rx_quality)
2608 {
2609         struct ether_header *eh = mtod(m, struct ether_header *);
2610         struct ip *ip = NULL;
2611         int i;
2612         static int cache_slot = 0;      /* use this cache entry */
2613         static int wrapindex = 0;       /* next "free" cache entry */
2614         int sig, noise;
2615
2616         /*
2617          * filters:
2618          * 1. ip only
2619          * 2. configurable filter to throw out unicast packets,
2620          * keep multicast only.
2621          */
2622
2623         if ((ntohs(eh->ether_type) == ETHERTYPE_IP))
2624                 ip = (struct ip *)(mtod(m, uint8_t *) + ETHER_HDR_LEN);
2625         else if (wi_cache_iponly)
2626                 return;
2627
2628         /*
2629          *  filter for broadcast/multicast only
2630          */
2631         if (wi_cache_mcastonly && ((eh->ether_dhost[0] & 1) == 0)) {
2632                 return;
2633         }
2634
2635 #ifdef SIGDEBUG
2636         printf("wi%d: q value %x (MSB=0x%x, LSB=0x%x) \n", sc->wi_unit,
2637             rx_quality & 0xffff, rx_quality >> 8, rx_quality & 0xff);
2638 #endif
2639
2640
2641         /*
2642          * do a linear search for a matching MAC address
2643          * in the cache table
2644          * . MAC address is 6 bytes,
2645          * . var w_nextitem holds total number of entries already cached
2646          */
2647         for(i = 0; i < sc->wi_nextitem; i++) {
2648                 if (! bcmp(eh->ether_shost , sc->wi_sigcache[i].macsrc,  6 )) {
2649                         /*
2650                          * Match!,
2651                          * so we already have this entry,
2652                          * update the data
2653                          */
2654                         break;
2655                 }
2656         }
2657
2658         /*
2659          *  did we find a matching mac address?
2660          * if yes, then overwrite a previously existing cache entry
2661          */
2662         if (i < sc->wi_nextitem )   {
2663                 cache_slot = i;
2664         }
2665         /*
2666          * else, have a new address entry,so
2667          * add this new entry,
2668          * if table full, then we need to replace LRU entry
2669          */
2670         else    {
2671
2672                 /*
2673                  * check for space in cache table
2674                  * note: wi_nextitem also holds number of entries
2675                  * added in the cache table
2676                  */
2677                 if ( sc->wi_nextitem < MAXWICACHE ) {
2678                         cache_slot = sc->wi_nextitem;
2679                         sc->wi_nextitem++;
2680                         sc->wi_sigitems = sc->wi_nextitem;
2681                 }
2682                 /* no space found, so simply wrap with wrap index
2683                  * and "zap" the next entry
2684                  */
2685                 else {
2686                         if (wrapindex == MAXWICACHE) {
2687                                 wrapindex = 0;
2688                         }
2689                         cache_slot = wrapindex++;
2690                 }
2691         }
2692
2693         /*
2694          * invariant: cache_slot now points at some slot
2695          * in cache.
2696          */
2697         if (cache_slot < 0 || cache_slot >= MAXWICACHE) {
2698                 log(LOG_ERR, "wi_cache_store, bad index: %d of "
2699                     "[0..%d], gross cache error\n",
2700                     cache_slot, MAXWICACHE);
2701                 return;
2702         }
2703
2704         /*
2705          *  store items in cache
2706          *  .ip source address
2707          *  .mac src
2708          *  .signal, etc.
2709          */
2710         if (ip != NULL)
2711                 sc->wi_sigcache[cache_slot].ipsrc = ip->ip_src.s_addr;
2712         bcopy( eh->ether_shost, sc->wi_sigcache[cache_slot].macsrc,  6);
2713
2714         sig = (rx_quality >> 8) & 0xFF;
2715         noise = rx_quality & 0xFF;
2716         sc->wi_sigcache[cache_slot].signal = sig - 149;
2717         sc->wi_sigcache[cache_slot].noise = noise - 149;
2718         sc->wi_sigcache[cache_slot].quality = sig - noise;
2719
2720         return;
2721 }
2722 #endif
2723
2724 static int
2725 wi_get_cur_ssid(sc, ssid, len)
2726         struct wi_softc         *sc;
2727         char                    *ssid;
2728         int                     *len;
2729 {
2730         int                     error = 0;
2731         struct wi_req           wreq;
2732
2733         wreq.wi_len = WI_MAX_DATALEN;
2734         switch (sc->wi_ptype) {
2735         case WI_PORTTYPE_AP:
2736                 *len = IEEE80211_NWID_LEN;
2737                 bcopy(sc->wi_net_name, ssid, IEEE80211_NWID_LEN);
2738                 break;
2739         case WI_PORTTYPE_ADHOC:
2740                 wreq.wi_type = WI_RID_CURRENT_SSID;
2741                 error = wi_read_record(sc, (struct wi_ltv_gen *)&wreq);
2742                 if (error != 0)
2743                         break;
2744                 if (wreq.wi_val[0] > IEEE80211_NWID_LEN) {
2745                         error = EINVAL;
2746                         break;
2747                 }
2748                 *len = wreq.wi_val[0];
2749                 bcopy(&wreq.wi_val[1], ssid, IEEE80211_NWID_LEN);
2750                 break;
2751         case WI_PORTTYPE_BSS:
2752                 wreq.wi_type = WI_RID_COMMQUAL;
2753                 error = wi_read_record(sc, (struct wi_ltv_gen *)&wreq);
2754                 if (error != 0)
2755                         break;
2756                 if (wreq.wi_val[0] != 0) /* associated */ {
2757                         wreq.wi_type = WI_RID_CURRENT_SSID;
2758                         wreq.wi_len = WI_MAX_DATALEN;
2759                         error = wi_read_record(sc, (struct wi_ltv_gen *)&wreq);
2760                         if (error != 0)
2761                                 break;
2762                         if (wreq.wi_val[0] > IEEE80211_NWID_LEN) {
2763                                 error = EINVAL;
2764                                 break;
2765                         }
2766                         *len = wreq.wi_val[0];
2767                         bcopy(&wreq.wi_val[1], ssid, IEEE80211_NWID_LEN);
2768                 } else {
2769                         *len = IEEE80211_NWID_LEN;
2770                         bcopy(sc->wi_net_name, ssid, IEEE80211_NWID_LEN);
2771                 }
2772                 break;
2773         default:
2774                 error = EINVAL;
2775                 break;
2776         }
2777
2778         return error;
2779 }
2780
2781 static int
2782 wi_media_change(ifp)
2783         struct ifnet            *ifp;
2784 {
2785         struct wi_softc         *sc = ifp->if_softc;
2786         int                     otype = sc->wi_ptype;
2787         int                     orate = sc->wi_tx_rate;
2788         int                     ocreate_ibss = sc->wi_create_ibss;
2789
2790         if ((sc->ifmedia.ifm_cur->ifm_media & IFM_IEEE80211_HOSTAP) &&
2791             sc->sc_firmware_type != WI_INTERSIL)
2792                 return (EINVAL);
2793
2794         sc->wi_create_ibss = 0;
2795
2796         switch (sc->ifmedia.ifm_cur->ifm_media & IFM_OMASK) {
2797         case 0:
2798                 sc->wi_ptype = WI_PORTTYPE_BSS;
2799                 break;
2800         case IFM_IEEE80211_ADHOC:
2801                 sc->wi_ptype = WI_PORTTYPE_ADHOC;
2802                 break;
2803         case IFM_IEEE80211_HOSTAP:
2804                 sc->wi_ptype = WI_PORTTYPE_AP;
2805                 break;
2806         case IFM_IEEE80211_IBSSMASTER:
2807         case IFM_IEEE80211_IBSSMASTER|IFM_IEEE80211_IBSS:
2808                 if (!(sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS))
2809                         return (EINVAL);
2810                 sc->wi_create_ibss = 1;
2811                 /* FALLTHROUGH */
2812         case IFM_IEEE80211_IBSS:
2813                 sc->wi_ptype = WI_PORTTYPE_IBSS;
2814                 break;
2815         default:
2816                 /* Invalid combination. */
2817                 return (EINVAL);
2818         }
2819
2820         switch (IFM_SUBTYPE(sc->ifmedia.ifm_cur->ifm_media)) {
2821         case IFM_IEEE80211_DS1:
2822                 sc->wi_tx_rate = 1;
2823                 break;
2824         case IFM_IEEE80211_DS2:
2825                 sc->wi_tx_rate = 2;
2826                 break;
2827         case IFM_IEEE80211_DS5:
2828                 sc->wi_tx_rate = 5;
2829                 break;
2830         case IFM_IEEE80211_DS11:
2831                 sc->wi_tx_rate = 11;
2832                 break;
2833         case IFM_AUTO:
2834                 sc->wi_tx_rate = 3;
2835                 break;
2836         }
2837
2838         if (ocreate_ibss != sc->wi_create_ibss || otype != sc->wi_ptype ||
2839             orate != sc->wi_tx_rate)
2840                 wi_init(sc);
2841
2842         return(0);
2843 }
2844
2845 static void
2846 wi_media_status(ifp, imr)
2847         struct ifnet            *ifp;
2848         struct ifmediareq       *imr;
2849 {
2850         struct wi_req           wreq;
2851         struct wi_softc         *sc = ifp->if_softc;
2852
2853         if (sc->wi_tx_rate == 3) {
2854                 imr->ifm_active = IFM_IEEE80211|IFM_AUTO;
2855                 if (sc->wi_ptype == WI_PORTTYPE_ADHOC)
2856                         imr->ifm_active |= IFM_IEEE80211_ADHOC;
2857                 else if (sc->wi_ptype == WI_PORTTYPE_AP)
2858                         imr->ifm_active |= IFM_IEEE80211_HOSTAP;
2859                 else if (sc->wi_ptype == WI_PORTTYPE_IBSS) {
2860                         if (sc->wi_create_ibss)
2861                                 imr->ifm_active |= IFM_IEEE80211_IBSSMASTER;
2862                         else
2863                                 imr->ifm_active |= IFM_IEEE80211_IBSS;
2864                 }
2865                 wreq.wi_type = WI_RID_CUR_TX_RATE;
2866                 wreq.wi_len = WI_MAX_DATALEN;
2867                 if (wi_read_record(sc, (struct wi_ltv_gen *)&wreq) == 0) {
2868                         switch(wreq.wi_val[0]) {
2869                         case 1:
2870                                 imr->ifm_active |= IFM_IEEE80211_DS1;
2871                                 break;
2872                         case 2:
2873                                 imr->ifm_active |= IFM_IEEE80211_DS2;
2874                                 break;
2875                         case 6:
2876                                 imr->ifm_active |= IFM_IEEE80211_DS5;
2877                                 break;
2878                         case 11:
2879                                 imr->ifm_active |= IFM_IEEE80211_DS11;
2880                                 break;
2881                                 }
2882                 }
2883         } else {
2884                 imr->ifm_active = sc->ifmedia.ifm_cur->ifm_media;
2885         }
2886
2887         imr->ifm_status = IFM_AVALID;
2888         if (sc->wi_ptype == WI_PORTTYPE_ADHOC ||
2889             sc->wi_ptype == WI_PORTTYPE_IBSS)
2890                 /*
2891                  * XXX: It would be nice if we could give some actually
2892                  * useful status like whether we joined another IBSS or
2893                  * created one ourselves.
2894                  */
2895                 imr->ifm_status |= IFM_ACTIVE;
2896         else if (sc->wi_ptype == WI_PORTTYPE_AP)
2897                 imr->ifm_status |= IFM_ACTIVE;
2898         else {
2899                 wreq.wi_type = WI_RID_COMMQUAL;
2900                 wreq.wi_len = WI_MAX_DATALEN;
2901                 if (wi_read_record(sc, (struct wi_ltv_gen *)&wreq) == 0 &&
2902                     wreq.wi_val[0] != 0)
2903                         imr->ifm_status |= IFM_ACTIVE;
2904         }
2905 }
2906
2907 static int
2908 wi_get_debug(sc, wreq)
2909         struct wi_softc         *sc;
2910         struct wi_req           *wreq;
2911 {
2912         int                     error = 0;
2913
2914         wreq->wi_len = 1;
2915
2916         switch (wreq->wi_type) {
2917         case WI_DEBUG_SLEEP:
2918                 wreq->wi_len++;
2919                 wreq->wi_val[0] = sc->wi_debug.wi_sleep;
2920                 break;
2921         case WI_DEBUG_DELAYSUPP:
2922                 wreq->wi_len++;
2923                 wreq->wi_val[0] = sc->wi_debug.wi_delaysupp;
2924                 break;
2925         case WI_DEBUG_TXSUPP:
2926                 wreq->wi_len++;
2927                 wreq->wi_val[0] = sc->wi_debug.wi_txsupp;
2928                 break;
2929         case WI_DEBUG_MONITOR:
2930                 wreq->wi_len++;
2931                 wreq->wi_val[0] = sc->wi_debug.wi_monitor;
2932                 break;
2933         case WI_DEBUG_LEDTEST:
2934                 wreq->wi_len += 3;
2935                 wreq->wi_val[0] = sc->wi_debug.wi_ledtest;
2936                 wreq->wi_val[1] = sc->wi_debug.wi_ledtest_param0;
2937                 wreq->wi_val[2] = sc->wi_debug.wi_ledtest_param1;
2938                 break;
2939         case WI_DEBUG_CONTTX:
2940                 wreq->wi_len += 2;
2941                 wreq->wi_val[0] = sc->wi_debug.wi_conttx;
2942                 wreq->wi_val[1] = sc->wi_debug.wi_conttx_param0;
2943                 break;
2944         case WI_DEBUG_CONTRX:
2945                 wreq->wi_len++;
2946                 wreq->wi_val[0] = sc->wi_debug.wi_contrx;
2947                 break;
2948         case WI_DEBUG_SIGSTATE:
2949                 wreq->wi_len += 2;
2950                 wreq->wi_val[0] = sc->wi_debug.wi_sigstate;
2951                 wreq->wi_val[1] = sc->wi_debug.wi_sigstate_param0;
2952                 break;
2953         case WI_DEBUG_CONFBITS:
2954                 wreq->wi_len += 2;
2955                 wreq->wi_val[0] = sc->wi_debug.wi_confbits;
2956                 wreq->wi_val[1] = sc->wi_debug.wi_confbits_param0;
2957                 break;
2958         default:
2959                 error = EIO;
2960                 break;
2961         }
2962
2963         return (error);
2964 }
2965
2966 static int
2967 wi_set_debug(sc, wreq)
2968         struct wi_softc         *sc;
2969         struct wi_req           *wreq;
2970 {
2971         int                     error = 0;
2972         u_int16_t               cmd, param0 = 0, param1 = 0;
2973
2974         switch (wreq->wi_type) {
2975         case WI_DEBUG_RESET:
2976         case WI_DEBUG_INIT:
2977         case WI_DEBUG_CALENABLE:
2978                 break;
2979         case WI_DEBUG_SLEEP:
2980                 sc->wi_debug.wi_sleep = 1;
2981                 break;
2982         case WI_DEBUG_WAKE:
2983                 sc->wi_debug.wi_sleep = 0;
2984                 break;
2985         case WI_DEBUG_CHAN:
2986                 param0 = wreq->wi_val[0];
2987                 break;
2988         case WI_DEBUG_DELAYSUPP:
2989                 sc->wi_debug.wi_delaysupp = 1;
2990                 break;
2991         case WI_DEBUG_TXSUPP:
2992                 sc->wi_debug.wi_txsupp = 1;
2993                 break;
2994         case WI_DEBUG_MONITOR:
2995                 sc->wi_debug.wi_monitor = 1;
2996                 break;
2997         case WI_DEBUG_LEDTEST:
2998                 param0 = wreq->wi_val[0];
2999                 param1 = wreq->wi_val[1];
3000                 sc->wi_debug.wi_ledtest = 1;
3001                 sc->wi_debug.wi_ledtest_param0 = param0;
3002                 sc->wi_debug.wi_ledtest_param1 = param1;
3003                 break;
3004         case WI_DEBUG_CONTTX:
3005                 param0 = wreq->wi_val[0];
3006                 sc->wi_debug.wi_conttx = 1;
3007                 sc->wi_debug.wi_conttx_param0 = param0;
3008                 break;
3009         case WI_DEBUG_STOPTEST:
3010                 sc->wi_debug.wi_delaysupp = 0;
3011                 sc->wi_debug.wi_txsupp = 0;
3012                 sc->wi_debug.wi_monitor = 0;
3013                 sc->wi_debug.wi_ledtest = 0;
3014                 sc->wi_debug.wi_ledtest_param0 = 0;
3015                 sc->wi_debug.wi_ledtest_param1 = 0;
3016                 sc->wi_debug.wi_conttx = 0;
3017                 sc->wi_debug.wi_conttx_param0 = 0;
3018                 sc->wi_debug.wi_contrx = 0;
3019                 sc->wi_debug.wi_sigstate = 0;
3020                 sc->wi_debug.wi_sigstate_param0 = 0;
3021                 break;
3022         case WI_DEBUG_CONTRX:
3023                 sc->wi_debug.wi_contrx = 1;
3024                 break;
3025         case WI_DEBUG_SIGSTATE:
3026                 param0 = wreq->wi_val[0];
3027                 sc->wi_debug.wi_sigstate = 1;
3028                 sc->wi_debug.wi_sigstate_param0 = param0;
3029                 break;
3030         case WI_DEBUG_CONFBITS:
3031                 param0 = wreq->wi_val[0];
3032                 param1 = wreq->wi_val[1];
3033                 sc->wi_debug.wi_confbits = param0;
3034                 sc->wi_debug.wi_confbits_param0 = param1;
3035                 break;
3036         default:
3037                 error = EIO;
3038                 break;
3039         }
3040
3041         if (error)
3042                 return (error);
3043
3044         cmd = WI_CMD_DEBUG | (wreq->wi_type << 8);
3045         error = wi_cmd(sc, cmd, param0, param1, 0);
3046
3047         return (error);
3048 }