sys/dev/netif/wi/if_wi.c

   1 /*      $NetBSD: wi.c,v 1.109 2003/01/09 08:52:19 dyoung Exp $  */
   2
   3 /*
   4  * Copyright (c) 1997, 1998, 1999
   5  *      Bill Paul <wpaul@ctr.columbia.edu>.  All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  * 3. All advertising materials mentioning features or use of this software
  16  *    must display the following acknowledgement:
  17  *      This product includes software developed by Bill Paul.
  18  * 4. Neither the name of the author nor the names of any co-contributors
  19  *    may be used to endorse or promote products derived from this software
  20  *    without specific prior written permission.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
  23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  25  * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
  26  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  27  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  28  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  29  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  30  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  31  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  32  * THE POSSIBILITY OF SUCH DAMAGE.
  33  *
  34  * $FreeBSD: src/sys/dev/wi/if_wi.c,v 1.166 2004/04/01 00:38:45 sam Exp $
  35  * $DragonFly: src/sys/dev/netif/wi/if_wi.c,v 1.16 2004/09/06 13:52:24 joerg Exp $
  36  */
  37
  38 /*
  39  * Lucent WaveLAN/IEEE 802.11 PCMCIA driver.
  40  *
  41  * Original FreeBSD driver written by Bill Paul <wpaul@ctr.columbia.edu>
  42  * Electrical Engineering Department
  43  * Columbia University, New York City
  44  */
  45
  46 /*
  47  * The WaveLAN/IEEE adapter is the second generation of the WaveLAN
  48  * from Lucent. Unlike the older cards, the new ones are programmed
  49  * entirely via a firmware-driven controller called the Hermes.
  50  * Unfortunately, Lucent will not release the Hermes programming manual
  51  * without an NDA (if at all). What they do release is an API library
  52  * called the HCF (Hardware Control Functions) which is supposed to
  53  * do the device-specific operations of a device driver for you. The
  54  * publically available version of the HCF library (the 'HCF Light') is
  55  * a) extremely gross, b) lacks certain features, particularly support
  56  * for 802.11 frames, and c) is contaminated by the GNU Public License.
  57  *
  58  * This driver does not use the HCF or HCF Light at all. Instead, it
  59  * programs the Hermes controller directly, using information gleaned
  60  * from the HCF Light code and corresponding documentation.
  61  *
  62  * This driver supports the ISA, PCMCIA and PCI versions of the Lucent
  63  * WaveLan cards (based on the Hermes chipset), as well as the newer
  64  * Prism 2 chipsets with firmware from Intersil and Symbol.
  65  */
  66
  67 #define WI_HERMES_AUTOINC_WAR   /* Work around data write autoinc bug. */
  68 #define WI_HERMES_STATS_WAR     /* Work around stats counter bug. */
  69
  70 #include <sys/param.h>
  71 #include <sys/endian.h>
  72 #include <sys/systm.h>
  73 #include <sys/sockio.h>
  74 #include <sys/mbuf.h>
  75 #include <sys/proc.h>
  76 #include <sys/kernel.h>
  77 #include <sys/socket.h>
  78 #include <sys/module.h>
  79 #include <sys/bus.h>
  80 #include <sys/random.h>
  81 #include <sys/syslog.h>
  82 #include <sys/sysctl.h>
  83
  84 #include <machine/bus.h>
  85 #include <machine/resource.h>
  86 #include <machine/clock.h>
  87 #include <machine/atomic.h>
  88 #include <sys/rman.h>
  89
  90 #include <net/if.h>
  91 #include <net/if_arp.h>
  92 #include <net/ethernet.h>
  93 #include <net/if_dl.h>
  94 #include <net/if_media.h>
  95 #include <net/if_types.h>
  96
  97 #include <netproto/802_11/ieee80211_var.h>
  98 #include <netproto/802_11/ieee80211_ioctl.h>
  99 #include <netproto/802_11/ieee80211_radiotap.h>
 100 #include <netproto/802_11/if_wavelan_ieee.h>
 101
 102 #include <netinet/in.h>
 103 #include <netinet/in_systm.h>
 104 #include <netinet/in_var.h>
 105 #include <netinet/ip.h>
 106 #include <netinet/if_ether.h>
 107
 108 #include <net/bpf.h>
 109
 110 #include <dev/netif/wi/if_wireg.h>
 111 #include <dev/netif/wi/if_wivar.h>
 112
 113 static void wi_start(struct ifnet *);
 114 static int  wi_reset(struct wi_softc *);
 115 static void wi_watchdog(struct ifnet *);
 116 static int  wi_ioctl(struct ifnet *, u_long, caddr_t, struct ucred *);
 117 static int  wi_media_change(struct ifnet *);
 118 static void wi_media_status(struct ifnet *, struct ifmediareq *);
 119
 120 static void wi_rx_intr(struct wi_softc *);
 121 static void wi_tx_intr(struct wi_softc *);
 122 static void wi_tx_ex_intr(struct wi_softc *);
 123 static void wi_info_intr(struct wi_softc *);
 124
 125 static int  wi_get_cfg(struct ifnet *, u_long, caddr_t, struct ucred *);
 126 static int  wi_set_cfg(struct ifnet *, u_long, caddr_t);
 127 static int  wi_write_txrate(struct wi_softc *);
 128 static int  wi_write_wep(struct wi_softc *);
 129 static int  wi_write_multi(struct wi_softc *);
 130 static int  wi_alloc_fid(struct wi_softc *, int, int *);
 131 static void wi_read_nicid(struct wi_softc *);
 132 static int  wi_write_ssid(struct wi_softc *, int, u_int8_t *, int);
 133
 134 static int  wi_cmd(struct wi_softc *, int, int, int, int);
 135 static int  wi_seek_bap(struct wi_softc *, int, int);
 136 static int  wi_read_bap(struct wi_softc *, int, int, void *, int);
 137 static int  wi_write_bap(struct wi_softc *, int, int, void *, int);
 138 static int  wi_mwrite_bap(struct wi_softc *, int, int, struct mbuf *, int);
 139 static int  wi_read_rid(struct wi_softc *, int, void *, int *);
 140 static int  wi_write_rid(struct wi_softc *, int, void *, int);
 141
 142 static int  wi_newstate(struct ieee80211com *, enum ieee80211_state, int);
 143
 144 static int  wi_scan_ap(struct wi_softc *, u_int16_t, u_int16_t);
 145 static void wi_scan_result(struct wi_softc *, int, int);
 146
 147 static void wi_dump_pkt(struct wi_frame *, struct ieee80211_node *, int rssi);
 148
 149 static int wi_get_debug(struct wi_softc *, struct wi_req *);
 150 static int wi_set_debug(struct wi_softc *, struct wi_req *);
 151
 152 /* support to download firmware for symbol CF card */
 153 static int wi_symbol_write_firm(struct wi_softc *, const void *, int,
 154                 const void *, int);
 155 static int wi_symbol_set_hcr(struct wi_softc *, int);
 156
 157 static __inline int
 158 wi_write_val(struct wi_softc *sc, int rid, u_int16_t val)
 159 {
 160
 161         val = htole16(val);
 162         return wi_write_rid(sc, rid, &val, sizeof(val));
 163 }
 164
 165 SYSCTL_NODE(_hw, OID_AUTO, wi, CTLFLAG_RD, 0, "Wireless driver parameters");
 166
 167 static  struct timeval lasttxerror;     /* time of last tx error msg */
 168 static  int curtxeps;                   /* current tx error msgs/sec */
 169 static  int wi_txerate = 0;             /* tx error rate: max msgs/sec */
 170 SYSCTL_INT(_hw_wi, OID_AUTO, txerate, CTLFLAG_RW, &wi_txerate,
 171             0, "max tx error msgs/sec; 0 to disable msgs");
 172
 173 #define WI_DEBUG
 174 #ifdef WI_DEBUG
 175 static  int wi_debug = 0;
 176 SYSCTL_INT(_hw_wi, OID_AUTO, debug, CTLFLAG_RW, &wi_debug,
 177             0, "control debugging printfs");
 178
 179 #define DPRINTF(X)      if (wi_debug) printf X
 180 #define DPRINTF2(X)     if (wi_debug > 1) printf X
 181 #define IFF_DUMPPKTS(_ifp) \
 182         (((_ifp)->if_flags & (IFF_DEBUG|IFF_LINK2)) == (IFF_DEBUG|IFF_LINK2))
 183 #else
 184 #define DPRINTF(X)
 185 #define DPRINTF2(X)
 186 #define IFF_DUMPPKTS(_ifp)      0
 187 #endif
 188
 189 #define WI_INTRS        (WI_EV_RX | WI_EV_ALLOC | WI_EV_INFO)
 190
 191 struct wi_card_ident wi_card_ident[] = {
 192         /* CARD_ID                      CARD_NAME               FIRM_TYPE */
 193         { WI_NIC_LUCENT_ID,             WI_NIC_LUCENT_STR,      WI_LUCENT },
 194         { WI_NIC_SONY_ID,               WI_NIC_SONY_STR,        WI_LUCENT },
 195         { WI_NIC_LUCENT_EMB_ID,         WI_NIC_LUCENT_EMB_STR,  WI_LUCENT },
 196         { WI_NIC_EVB2_ID,               WI_NIC_EVB2_STR,        WI_INTERSIL },
 197         { WI_NIC_HWB3763_ID,            WI_NIC_HWB3763_STR,     WI_INTERSIL },
 198         { WI_NIC_HWB3163_ID,            WI_NIC_HWB3163_STR,     WI_INTERSIL },
 199         { WI_NIC_HWB3163B_ID,           WI_NIC_HWB3163B_STR,    WI_INTERSIL },
 200         { WI_NIC_EVB3_ID,               WI_NIC_EVB3_STR,        WI_INTERSIL },
 201         { WI_NIC_HWB1153_ID,            WI_NIC_HWB1153_STR,     WI_INTERSIL },
 202         { WI_NIC_P2_SST_ID,             WI_NIC_P2_SST_STR,      WI_INTERSIL },
 203         { WI_NIC_EVB2_SST_ID,           WI_NIC_EVB2_SST_STR,    WI_INTERSIL },
 204         { WI_NIC_3842_EVA_ID,           WI_NIC_3842_EVA_STR,    WI_INTERSIL },
 205         { WI_NIC_3842_PCMCIA_AMD_ID,    WI_NIC_3842_PCMCIA_STR, WI_INTERSIL },
 206         { WI_NIC_3842_PCMCIA_SST_ID,    WI_NIC_3842_PCMCIA_STR, WI_INTERSIL },
 207         { WI_NIC_3842_PCMCIA_ATL_ID,    WI_NIC_3842_PCMCIA_STR, WI_INTERSIL },
 208         { WI_NIC_3842_PCMCIA_ATS_ID,    WI_NIC_3842_PCMCIA_STR, WI_INTERSIL },
 209         { WI_NIC_3842_MINI_AMD_ID,      WI_NIC_3842_MINI_STR,   WI_INTERSIL },
 210         { WI_NIC_3842_MINI_SST_ID,      WI_NIC_3842_MINI_STR,   WI_INTERSIL },
 211         { WI_NIC_3842_MINI_ATL_ID,      WI_NIC_3842_MINI_STR,   WI_INTERSIL },
 212         { WI_NIC_3842_MINI_ATS_ID,      WI_NIC_3842_MINI_STR,   WI_INTERSIL },
 213         { WI_NIC_3842_PCI_AMD_ID,       WI_NIC_3842_PCI_STR,    WI_INTERSIL },
 214         { WI_NIC_3842_PCI_SST_ID,       WI_NIC_3842_PCI_STR,    WI_INTERSIL },
 215         { WI_NIC_3842_PCI_ATS_ID,       WI_NIC_3842_PCI_STR,    WI_INTERSIL },
 216         { WI_NIC_3842_PCI_ATL_ID,       WI_NIC_3842_PCI_STR,    WI_INTERSIL },
 217         { WI_NIC_P3_PCMCIA_AMD_ID,      WI_NIC_P3_PCMCIA_STR,   WI_INTERSIL },
 218         { WI_NIC_P3_PCMCIA_SST_ID,      WI_NIC_P3_PCMCIA_STR,   WI_INTERSIL },
 219         { WI_NIC_P3_PCMCIA_ATL_ID,      WI_NIC_P3_PCMCIA_STR,   WI_INTERSIL },
 220         { WI_NIC_P3_PCMCIA_ATS_ID,      WI_NIC_P3_PCMCIA_STR,   WI_INTERSIL },
 221         { WI_NIC_P3_MINI_AMD_ID,        WI_NIC_P3_MINI_STR,     WI_INTERSIL },
 222         { WI_NIC_P3_MINI_SST_ID,        WI_NIC_P3_MINI_STR,     WI_INTERSIL },
 223         { WI_NIC_P3_MINI_ATL_ID,        WI_NIC_P3_MINI_STR,     WI_INTERSIL },
 224         { WI_NIC_P3_MINI_ATS_ID,        WI_NIC_P3_MINI_STR,     WI_INTERSIL },
 225         { 0,    NULL,   0 },
 226 };
 227
 228 devclass_t wi_devclass;
 229
 230 int
 231 wi_attach(device_t dev)
 232 {
 233         struct wi_softc *sc = device_get_softc(dev);
 234         struct ieee80211com *ic = &sc->sc_ic;
 235         struct ifnet *ifp = &ic->ic_if;
 236         int i, nrates, buflen;
 237         u_int16_t val;
 238         u_int8_t ratebuf[2 + IEEE80211_RATE_SIZE];
 239         struct ieee80211_rateset *rs;
 240         static const u_int8_t empty_macaddr[IEEE80211_ADDR_LEN] = {
 241                 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 242         };
 243         int error;
 244
 245         /*
 246          * NB: no locking is needed here; don't put it here
 247          *     unless you can prove it!
 248          */
 249         error = bus_setup_intr(dev, sc->irq, INTR_TYPE_NET | INTR_MPSAFE,
 250             wi_intr, sc, &sc->wi_intrhand);
 251
 252         if (error) {
 253                 device_printf(dev, "bus_setup_intr() failed! (%d)\n", error);
 254                 wi_free(dev);
 255                 return (error);
 256         }
 257
 258         sc->wi_cmd_count = 500;
 259         /* Reset the NIC. */
 260         if (wi_reset(sc) != 0)
 261                 return ENXIO;           /* XXX */
 262
 263         /*
 264          * Read the station address.
 265          * And do it twice. I've seen PRISM-based cards that return
 266          * an error when trying to read it the first time, which causes
 267          * the probe to fail.
 268          */
 269         buflen = IEEE80211_ADDR_LEN;
 270         error = wi_read_rid(sc, WI_RID_MAC_NODE, ic->ic_myaddr, &buflen);
 271         if (error != 0) {
 272                 buflen = IEEE80211_ADDR_LEN;
 273                 error = wi_read_rid(sc, WI_RID_MAC_NODE, ic->ic_myaddr, &buflen);
 274         }
 275         if (error || IEEE80211_ADDR_EQ(ic->ic_myaddr, empty_macaddr)) {
 276                 if (error != 0)
 277                         device_printf(dev, "mac read failed %d\n", error);
 278                 else
 279                         device_printf(dev, "mac read failed (all zeros)\n");
 280                 wi_free(dev);
 281                 return (error);
 282         }
 283
 284         /* Read NIC identification */
 285         wi_read_nicid(sc);
 286
 287         ifp->if_softc = sc;
 288         if_initname(ifp, device_get_name(dev), device_get_unit(dev));
 289         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
 290         ifp->if_ioctl = wi_ioctl;
 291         ifp->if_start = wi_start;
 292         ifp->if_watchdog = wi_watchdog;
 293         ifp->if_init = wi_init;
 294         ifp->if_snd.ifq_maxlen = IFQ_MAXLEN;
 295
 296         ic->ic_phytype = IEEE80211_T_DS;
 297         ic->ic_opmode = IEEE80211_M_STA;
 298         ic->ic_caps = IEEE80211_C_PMGT | IEEE80211_C_AHDEMO;
 299         ic->ic_state = IEEE80211_S_INIT;
 300
 301         /*
 302          * Query the card for available channels and setup the
 303          * channel table.  We assume these are all 11b channels.
 304          */
 305         buflen = sizeof(val);
 306         if (wi_read_rid(sc, WI_RID_CHANNEL_LIST, &val, &buflen) != 0)
 307                 val = htole16(0x1fff);  /* assume 1-11 */
 308         KASSERT(val != 0, ("wi_attach: no available channels listed!"));
 309
 310         val <<= 1;                      /* shift for base 1 indices */
 311         for (i = 1; i < 16; i++) {
 312                 if (isset((u_int8_t*)&val, i)) {
 313                         ic->ic_channels[i].ic_freq =
 314                                 ieee80211_ieee2mhz(i, IEEE80211_CHAN_B);
 315                         ic->ic_channels[i].ic_flags = IEEE80211_CHAN_B;
 316                 }
 317         }
 318
 319         /*
 320          * Read the default channel from the NIC. This may vary
 321          * depending on the country where the NIC was purchased, so
 322          * we can't hard-code a default and expect it to work for
 323          * everyone.
 324          *
 325          * If no channel is specified, let the 802.11 code select.
 326          */
 327         buflen = sizeof(val);
 328         if (wi_read_rid(sc, WI_RID_OWN_CHNL, &val, &buflen) == 0) {
 329                 val = le16toh(val);
 330                 KASSERT(val < IEEE80211_CHAN_MAX &&
 331                         ic->ic_channels[val].ic_flags != 0,
 332                         ("wi_attach: invalid own channel %u!", val));
 333                 ic->ic_ibss_chan = &ic->ic_channels[val];
 334         } else {
 335                 device_printf(dev,
 336                         "WI_RID_OWN_CHNL failed, using first channel!\n");
 337                 ic->ic_ibss_chan = &ic->ic_channels[0];
 338         }
 339
 340         /*
 341          * Set flags based on firmware version.
 342          */
 343         switch (sc->sc_firmware_type) {
 344         case WI_LUCENT:
 345                 sc->sc_ntxbuf = 1;
 346                 sc->sc_flags |= WI_FLAGS_HAS_SYSSCALE;
 347 #ifdef WI_HERMES_AUTOINC_WAR
 348                 /* XXX: not confirmed, but never seen for recent firmware */
 349                 if (sc->sc_sta_firmware_ver <  40000) {
 350                         sc->sc_flags |= WI_FLAGS_BUG_AUTOINC;
 351                 }
 352 #endif
 353                 if (sc->sc_sta_firmware_ver >= 60000)
 354                         sc->sc_flags |= WI_FLAGS_HAS_MOR;
 355                 if (sc->sc_sta_firmware_ver >= 60006) {
 356                         ic->ic_caps |= IEEE80211_C_IBSS;
 357                         ic->ic_caps |= IEEE80211_C_MONITOR;
 358                 }
 359                 sc->sc_ibss_port = htole16(1);
 360
 361                 sc->sc_min_rssi = WI_LUCENT_MIN_RSSI;
 362                 sc->sc_max_rssi = WI_LUCENT_MAX_RSSI;
 363                 sc->sc_dbm_offset = WI_LUCENT_DBM_OFFSET;
 364                 break;
 365
 366         case WI_INTERSIL:
 367                 sc->sc_ntxbuf = WI_NTXBUF;
 368                 sc->sc_flags |= WI_FLAGS_HAS_FRAGTHR;
 369                 sc->sc_flags |= WI_FLAGS_HAS_ROAMING;
 370                 sc->sc_flags |= WI_FLAGS_HAS_SYSSCALE;
 371                 /*
 372                  * Old firmware are slow, so give peace a chance.
 373                  */
 374                 if (sc->sc_sta_firmware_ver < 10000)
 375                         sc->wi_cmd_count = 5000;
 376                 if (sc->sc_sta_firmware_ver > 10101)
 377                         sc->sc_flags |= WI_FLAGS_HAS_DBMADJUST;
 378                 if (sc->sc_sta_firmware_ver >= 800) {
 379                         ic->ic_caps |= IEEE80211_C_IBSS;
 380                         ic->ic_caps |= IEEE80211_C_MONITOR;
 381                 }
 382                 /*
 383                  * version 0.8.3 and newer are the only ones that are known
 384                  * to currently work.  Earlier versions can be made to work,
 385                  * at least according to the Linux driver.
 386                  */
 387                 if (sc->sc_sta_firmware_ver >= 803)
 388                         ic->ic_caps |= IEEE80211_C_HOSTAP;
 389                 sc->sc_ibss_port = htole16(0);
 390
 391                 sc->sc_min_rssi = WI_PRISM_MIN_RSSI;
 392                 sc->sc_max_rssi = WI_PRISM_MAX_RSSI;
 393                 sc->sc_dbm_offset = WI_PRISM_DBM_OFFSET;
 394                 break;
 395
 396         case WI_SYMBOL:
 397                 sc->sc_ntxbuf = 1;
 398                 sc->sc_flags |= WI_FLAGS_HAS_DIVERSITY;
 399                 if (sc->sc_sta_firmware_ver >= 25000)
 400                         ic->ic_caps |= IEEE80211_C_IBSS;
 401                 sc->sc_ibss_port = htole16(4);
 402
 403                 sc->sc_min_rssi = WI_PRISM_MIN_RSSI;
 404                 sc->sc_max_rssi = WI_PRISM_MAX_RSSI;
 405                 sc->sc_dbm_offset = WI_PRISM_DBM_OFFSET;
 406                 break;
 407         }
 408
 409         /*
 410          * Find out if we support WEP on this card.
 411          */
 412         buflen = sizeof(val);
 413         if (wi_read_rid(sc, WI_RID_WEP_AVAIL, &val, &buflen) == 0 &&
 414             val != htole16(0))
 415                 ic->ic_caps |= IEEE80211_C_WEP;
 416
 417         /* Find supported rates. */
 418         buflen = sizeof(ratebuf);
 419         rs = &ic->ic_sup_rates[IEEE80211_MODE_11B];
 420         if (wi_read_rid(sc, WI_RID_DATA_RATES, ratebuf, &buflen) == 0) {
 421                 nrates = le16toh(*(u_int16_t *)ratebuf);
 422                 if (nrates > IEEE80211_RATE_MAXSIZE)
 423                         nrates = IEEE80211_RATE_MAXSIZE;
 424                 rs->rs_nrates = 0;
 425                 for (i = 0; i < nrates; i++)
 426                         if (ratebuf[2+i])
 427                                 rs->rs_rates[rs->rs_nrates++] = ratebuf[2+i];
 428         } else {
 429                 /* XXX fallback on error? */
 430                 rs->rs_nrates = 0;
 431         }
 432
 433         buflen = sizeof(val);
 434         if ((sc->sc_flags & WI_FLAGS_HAS_DBMADJUST) &&
 435             wi_read_rid(sc, WI_RID_DBM_ADJUST, &val, &buflen) == 0) {
 436                 sc->sc_dbm_offset = le16toh(val);
 437         }
 438
 439         sc->sc_max_datalen = 2304;
 440         sc->sc_system_scale = 1;
 441         sc->sc_cnfauthmode = IEEE80211_AUTH_OPEN;
 442         sc->sc_roaming_mode = 1;
 443
 444         sc->sc_portnum = WI_DEFAULT_PORT;
 445         sc->sc_authtype = WI_DEFAULT_AUTHTYPE;
 446
 447         bzero(sc->sc_nodename, sizeof(sc->sc_nodename));
 448         sc->sc_nodelen = sizeof(WI_DEFAULT_NODENAME) - 1;
 449         bcopy(WI_DEFAULT_NODENAME, sc->sc_nodename, sc->sc_nodelen);
 450
 451         bzero(sc->sc_net_name, sizeof(sc->sc_net_name));
 452         bcopy(WI_DEFAULT_NETNAME, sc->sc_net_name,
 453             sizeof(WI_DEFAULT_NETNAME) - 1);
 454
 455         /*
 456          * Call MI attach routine.
 457          */
 458         ieee80211_ifattach(ifp);
 459         /* override state transition method */
 460         sc->sc_newstate = ic->ic_newstate;
 461         ic->ic_newstate = wi_newstate;
 462         ieee80211_media_init(ifp, wi_media_change, wi_media_status);
 463
 464 #ifdef WI_RAWBPF
 465         bpfattach2(ifp, DLT_IEEE802_11_RADIO,
 466                 sizeof(struct ieee80211_frame) + sizeof(sc->sc_tx_th),
 467                 &sc->sc_drvbpf);
 468         /*
 469          * Initialize constant fields.
 470          * XXX make header lengths a multiple of 32-bits so subsequent
 471          *     headers are properly aligned; this is a kludge to keep
 472          *     certain applications happy.
 473          *
 474          * NB: the channel is setup each time we transition to the
 475          *     RUN state to avoid filling it in for each frame.
 476          */
 477         sc->sc_tx_th_len = roundup(sizeof(sc->sc_tx_th), sizeof(u_int32_t));
 478         sc->sc_tx_th.wt_ihdr.it_len = htole16(sc->sc_tx_th_len);
 479         sc->sc_tx_th.wt_ihdr.it_present = htole32(WI_TX_RADIOTAP_PRESENT);
 480
 481         sc->sc_rx_th_len = roundup(sizeof(sc->sc_rx_th), sizeof(u_int32_t));
 482         sc->sc_rx_th.wr_ihdr.it_len = htole16(sc->sc_rx_th_len);
 483         sc->sc_rx_th.wr_ihdr.it_present = htole32(WI_RX_RADIOTAP_PRESENT);
 484 #endif
 485         return (0);
 486 }
 487
 488 int
 489 wi_detach(device_t dev)
 490 {
 491         struct wi_softc *sc = device_get_softc(dev);
 492         struct ifnet *ifp = &sc->sc_ic.ic_if;
 493         WI_LOCK_DECL();
 494
 495         WI_LOCK(sc);
 496
 497         /* check if device was removed */
 498         sc->wi_gone |= !bus_child_present(dev);
 499
 500         wi_stop(ifp, 0);
 501
 502         ieee80211_ifdetach(ifp);
 503         WI_UNLOCK(sc);
 504         bus_teardown_intr(dev, sc->irq, sc->wi_intrhand);
 505         wi_free(dev);
 506         return (0);
 507 }
 508
 509 void
 510 wi_shutdown(device_t dev)
 511 {
 512         struct wi_softc *sc = device_get_softc(dev);
 513
 514         wi_stop(&sc->sc_if, 1);
 515 }
 516
 517 void
 518 wi_intr(void *arg)
 519 {
 520         struct wi_softc *sc = arg;
 521         struct ifnet *ifp = &sc->sc_ic.ic_if;
 522         u_int16_t status;
 523         WI_LOCK_DECL();
 524
 525         WI_LOCK(sc);
 526
 527         if (sc->wi_gone || !sc->sc_enabled || (ifp->if_flags & IFF_UP) == 0) {
 528                 CSR_WRITE_2(sc, WI_INT_EN, 0);
 529                 CSR_WRITE_2(sc, WI_EVENT_ACK, 0xFFFF);
 530                 WI_UNLOCK(sc);
 531                 return;
 532         }
 533
 534         /* Disable interrupts. */
 535         CSR_WRITE_2(sc, WI_INT_EN, 0);
 536
 537         status = CSR_READ_2(sc, WI_EVENT_STAT);
 538         if (status & WI_EV_RX)
 539                 wi_rx_intr(sc);
 540         if (status & WI_EV_ALLOC)
 541                 wi_tx_intr(sc);
 542         if (status & WI_EV_TX_EXC)
 543                 wi_tx_ex_intr(sc);
 544         if (status & WI_EV_INFO)
 545                 wi_info_intr(sc);
 546         if ((ifp->if_flags & IFF_OACTIVE) == 0 &&
 547             (sc->sc_flags & WI_FLAGS_OUTRANGE) == 0 &&
 548             IF_QLEN(&ifp->if_snd) != 0)
 549                 wi_start(ifp);
 550
 551         /* Re-enable interrupts. */
 552         CSR_WRITE_2(sc, WI_INT_EN, WI_INTRS);
 553
 554         WI_UNLOCK(sc);
 555
 556         return;
 557 }
 558
 559 void
 560 wi_init(void *arg)
 561 {
 562         struct wi_softc *sc = arg;
 563         struct ifnet *ifp = &sc->sc_if;
 564         struct ieee80211com *ic = &sc->sc_ic;
 565         struct wi_joinreq join;
 566         int i;
 567         int error = 0, wasenabled;
 568         struct ifaddr *ifa;
 569         struct sockaddr_dl *sdl;
 570         WI_LOCK_DECL();
 571
 572         WI_LOCK(sc);
 573
 574         if (sc->wi_gone) {
 575                 WI_UNLOCK(sc);
 576                 return;
 577         }
 578
 579         if ((wasenabled = sc->sc_enabled))
 580                 wi_stop(ifp, 1);
 581         wi_reset(sc);
 582
 583         /* common 802.11 configuration */
 584         ic->ic_flags &= ~IEEE80211_F_IBSSON;
 585         sc->sc_flags &= ~WI_FLAGS_OUTRANGE;
 586         switch (ic->ic_opmode) {
 587         case IEEE80211_M_STA:
 588                 wi_write_val(sc, WI_RID_PORTTYPE, WI_PORTTYPE_BSS);
 589                 break;
 590         case IEEE80211_M_IBSS:
 591                 wi_write_val(sc, WI_RID_PORTTYPE, sc->sc_ibss_port);
 592                 ic->ic_flags |= IEEE80211_F_IBSSON;
 593                 break;
 594         case IEEE80211_M_AHDEMO:
 595                 wi_write_val(sc, WI_RID_PORTTYPE, WI_PORTTYPE_ADHOC);
 596                 break;
 597         case IEEE80211_M_HOSTAP:
 598                 /*
 599                  * For PRISM cards, override the empty SSID, because in
 600                  * HostAP mode the controller will lock up otherwise.
 601                  */
 602                 if (sc->sc_firmware_type == WI_INTERSIL &&
 603                     ic->ic_des_esslen == 0) {
 604                         ic->ic_des_essid[0] = ' ';
 605                         ic->ic_des_esslen = 1;
 606                 }
 607                 wi_write_val(sc, WI_RID_PORTTYPE, WI_PORTTYPE_HOSTAP);
 608                 break;
 609         case IEEE80211_M_MONITOR:
 610                 if (sc->sc_firmware_type == WI_LUCENT)
 611                         wi_write_val(sc, WI_RID_PORTTYPE, WI_PORTTYPE_ADHOC);
 612                 wi_cmd(sc, WI_CMD_DEBUG | (WI_TEST_MONITOR << 8), 0, 0, 0);
 613                 break;
 614         }
 615
 616         /* Intersil interprets this RID as joining ESS even in IBSS mode */
 617         if (sc->sc_firmware_type == WI_LUCENT &&
 618             (ic->ic_flags & IEEE80211_F_IBSSON) && ic->ic_des_esslen > 0)
 619                 wi_write_val(sc, WI_RID_CREATE_IBSS, 1);
 620         else
 621                 wi_write_val(sc, WI_RID_CREATE_IBSS, 0);
 622         wi_write_val(sc, WI_RID_MAX_SLEEP, ic->ic_lintval);
 623         wi_write_ssid(sc, WI_RID_DESIRED_SSID, ic->ic_des_essid,
 624             ic->ic_des_esslen);
 625         wi_write_val(sc, WI_RID_OWN_CHNL,
 626                 ieee80211_chan2ieee(ic, ic->ic_ibss_chan));
 627         wi_write_ssid(sc, WI_RID_OWN_SSID, ic->ic_des_essid, ic->ic_des_esslen);
 628
 629         ifa = ifaddr_byindex(ifp->if_index);
 630         sdl = (struct sockaddr_dl *) ifa->ifa_addr;
 631         IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(sdl));
 632         wi_write_rid(sc, WI_RID_MAC_NODE, ic->ic_myaddr, IEEE80211_ADDR_LEN);
 633
 634         wi_write_val(sc, WI_RID_PM_ENABLED,
 635             (ic->ic_flags & IEEE80211_F_PMGTON) ? 1 : 0);
 636
 637         /* not yet common 802.11 configuration */
 638         wi_write_val(sc, WI_RID_MAX_DATALEN, sc->sc_max_datalen);
 639         wi_write_val(sc, WI_RID_RTS_THRESH, ic->ic_rtsthreshold);
 640         if (sc->sc_flags & WI_FLAGS_HAS_FRAGTHR)
 641                 wi_write_val(sc, WI_RID_FRAG_THRESH, ic->ic_fragthreshold);
 642
 643         /* driver specific 802.11 configuration */
 644         if (sc->sc_flags & WI_FLAGS_HAS_SYSSCALE)
 645                 wi_write_val(sc, WI_RID_SYSTEM_SCALE, sc->sc_system_scale);
 646         if (sc->sc_flags & WI_FLAGS_HAS_ROAMING)
 647                 wi_write_val(sc, WI_RID_ROAMING_MODE, sc->sc_roaming_mode);
 648         if (sc->sc_flags & WI_FLAGS_HAS_MOR)
 649                 wi_write_val(sc, WI_RID_MICROWAVE_OVEN, sc->sc_microwave_oven);
 650         wi_write_txrate(sc);
 651         wi_write_ssid(sc, WI_RID_NODENAME, sc->sc_nodename, sc->sc_nodelen);
 652
 653         if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
 654             sc->sc_firmware_type == WI_INTERSIL) {
 655                 wi_write_val(sc, WI_RID_OWN_BEACON_INT, ic->ic_lintval);
 656                 wi_write_val(sc, WI_RID_BASIC_RATE, 0x03);   /* 1, 2 */
 657                 wi_write_val(sc, WI_RID_SUPPORT_RATE, 0x0f); /* 1, 2, 5.5, 11 */
 658                 wi_write_val(sc, WI_RID_DTIM_PERIOD, 1);
 659         }
 660
 661         /*
 662          * Initialize promisc mode.
 663          *      Being in the Host-AP mode causes a great
 664          *      deal of pain if primisc mode is set.
 665          *      Therefore we avoid confusing the firmware
 666          *      and always reset promisc mode in Host-AP
 667          *      mode.  Host-AP sees all the packets anyway.
 668          */
 669         if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
 670             (ifp->if_flags & IFF_PROMISC) != 0) {
 671                 wi_write_val(sc, WI_RID_PROMISC, 1);
 672         } else {
 673                 wi_write_val(sc, WI_RID_PROMISC, 0);
 674         }
 675
 676         /* Configure WEP. */
 677         if (ic->ic_caps & IEEE80211_C_WEP)
 678                 wi_write_wep(sc);
 679
 680         /* Set multicast filter. */
 681         wi_write_multi(sc);
 682
 683         /* Allocate fids for the card */
 684         if (sc->sc_firmware_type != WI_SYMBOL || !wasenabled) {
 685                 sc->sc_buflen = IEEE80211_MAX_LEN + sizeof(struct wi_frame);
 686                 if (sc->sc_firmware_type == WI_SYMBOL)
 687                         sc->sc_buflen = 1585;   /* XXX */
 688                 for (i = 0; i < sc->sc_ntxbuf; i++) {
 689                         error = wi_alloc_fid(sc, sc->sc_buflen,
 690                             &sc->sc_txd[i].d_fid);
 691                         if (error) {
 692                                 device_printf(sc->sc_dev,
 693                                     "tx buffer allocation failed (error %u)\n",
 694                                     error);
 695                                 goto out;
 696                         }
 697                         sc->sc_txd[i].d_len = 0;
 698                 }
 699         }
 700         sc->sc_txcur = sc->sc_txnext = 0;
 701
 702         /* Enable desired port */
 703         wi_cmd(sc, WI_CMD_ENABLE | sc->sc_portnum, 0, 0, 0);
 704
 705         sc->sc_enabled = 1;
 706         ifp->if_flags |= IFF_RUNNING;
 707         ifp->if_flags &= ~IFF_OACTIVE;
 708         if (ic->ic_opmode == IEEE80211_M_AHDEMO ||
 709             ic->ic_opmode == IEEE80211_M_MONITOR ||
 710             ic->ic_opmode == IEEE80211_M_HOSTAP)
 711                 ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
 712
 713         /* Enable interrupts */
 714         CSR_WRITE_2(sc, WI_INT_EN, WI_INTRS);
 715
 716         if (!wasenabled &&
 717             ic->ic_opmode == IEEE80211_M_HOSTAP &&
 718             sc->sc_firmware_type == WI_INTERSIL) {
 719                 /* XXX: some card need to be re-enabled for hostap */
 720                 wi_cmd(sc, WI_CMD_DISABLE | WI_PORT0, 0, 0, 0);
 721                 wi_cmd(sc, WI_CMD_ENABLE | WI_PORT0, 0, 0, 0);
 722         }
 723
 724         if (ic->ic_opmode == IEEE80211_M_STA &&
 725             ((ic->ic_flags & IEEE80211_F_DESBSSID) ||
 726             ic->ic_des_chan != IEEE80211_CHAN_ANYC)) {
 727                 memset(&join, 0, sizeof(join));
 728                 if (ic->ic_flags & IEEE80211_F_DESBSSID)
 729                         IEEE80211_ADDR_COPY(&join.wi_bssid, ic->ic_des_bssid);
 730                 if (ic->ic_des_chan != IEEE80211_CHAN_ANYC)
 731                         join.wi_chan = htole16(
 732                                 ieee80211_chan2ieee(ic, ic->ic_des_chan));
 733                 /* Lucent firmware does not support the JOIN RID. */
 734                 if (sc->sc_firmware_type != WI_LUCENT)
 735                         wi_write_rid(sc, WI_RID_JOIN_REQ, &join, sizeof(join));
 736         }
 737
 738         WI_UNLOCK(sc);
 739         return;
 740 out:
 741         if (error) {
 742                 if_printf(ifp, "interface not running\n");
 743                 wi_stop(ifp, 1);
 744         }
 745         WI_UNLOCK(sc);
 746         DPRINTF(("wi_init: return %d\n", error));
 747         return;
 748 }
 749
 750 void
 751 wi_stop(struct ifnet *ifp, int disable)
 752 {
 753         struct ieee80211com *ic = (struct ieee80211com *) ifp;
 754         struct wi_softc *sc = ifp->if_softc;
 755         WI_LOCK_DECL();
 756
 757         WI_LOCK(sc);
 758
 759         DELAY(100000);
 760
 761         ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
 762         if (sc->sc_enabled && !sc->wi_gone) {
 763                 CSR_WRITE_2(sc, WI_INT_EN, 0);
 764                 wi_cmd(sc, WI_CMD_DISABLE | sc->sc_portnum, 0, 0, 0);
 765                 if (disable) {
 766 #ifdef __NetBSD__
 767                         if (sc->sc_disable)
 768                                 (*sc->sc_disable)(sc);
 769 #endif
 770                         sc->sc_enabled = 0;
 771                 }
 772         } else if (sc->wi_gone && disable)      /* gone --> not enabled */
 773             sc->sc_enabled = 0;
 774
 775         sc->sc_tx_timer = 0;
 776         sc->sc_scan_timer = 0;
 777         sc->sc_syn_timer = 0;
 778         sc->sc_false_syns = 0;
 779         sc->sc_naps = 0;
 780         ifp->if_flags &= ~(IFF_OACTIVE | IFF_RUNNING);
 781         ifp->if_timer = 0;
 782
 783         WI_UNLOCK(sc);
 784 }
 785
 786 static void
 787 wi_start(struct ifnet *ifp)
 788 {
 789         struct wi_softc *sc = ifp->if_softc;
 790         struct ieee80211com *ic = &sc->sc_ic;
 791         struct ieee80211_node *ni;
 792         struct ieee80211_frame *wh;
 793         struct mbuf *m0;
 794         struct wi_frame frmhdr;
 795         int cur, fid, off, error;
 796         WI_LOCK_DECL();
 797
 798         WI_LOCK(sc);
 799
 800         if (sc->wi_gone) {
 801                 WI_UNLOCK(sc);
 802                 return;
 803         }
 804         if (sc->sc_flags & WI_FLAGS_OUTRANGE) {
 805                 WI_UNLOCK(sc);
 806                 return;
 807         }
 808
 809         memset(&frmhdr, 0, sizeof(frmhdr));
 810         cur = sc->sc_txnext;
 811         for (;;) {
 812                 IF_POLL(&ic->ic_mgtq, m0);
 813                 if (m0 != NULL) {
 814                         if (sc->sc_txd[cur].d_len != 0) {
 815                                 ifp->if_flags |= IFF_OACTIVE;
 816                                 break;
 817                         }
 818                         IF_DEQUEUE(&ic->ic_mgtq, m0);
 819                         /*
 820                          * Hack!  The referenced node pointer is in the
 821                          * rcvif field of the packet header.  This is
 822                          * placed there by ieee80211_mgmt_output because
 823                          * we need to hold the reference with the frame
 824                          * and there's no other way (other than packet
 825                          * tags which we consider too expensive to use)
 826                          * to pass it along.
 827                          */
 828                         ni = (struct ieee80211_node *) m0->m_pkthdr.rcvif;
 829                         m0->m_pkthdr.rcvif = NULL;
 830
 831                         m_copydata(m0, 4, ETHER_ADDR_LEN * 2,
 832                             (caddr_t)&frmhdr.wi_ehdr);
 833                         frmhdr.wi_ehdr.ether_type = 0;
 834                         wh = mtod(m0, struct ieee80211_frame *);
 835                 } else {
 836                         if (ic->ic_state != IEEE80211_S_RUN)
 837                                 break;
 838                         IFQ_POLL(&ifp->if_snd, m0);
 839                         if (m0 == NULL)
 840                                 break;
 841                         if (sc->sc_txd[cur].d_len != 0) {
 842                                 ifp->if_flags |= IFF_OACTIVE;
 843                                 break;
 844                         }
 845                         IFQ_DEQUEUE(&ifp->if_snd, m0);
 846                         ifp->if_opackets++;
 847                         m_copydata(m0, 0, ETHER_HDR_LEN,
 848                             (caddr_t)&frmhdr.wi_ehdr);
 849                         BPF_MTAP(ifp, m0);
 850
 851                         m0 = ieee80211_encap(ifp, m0, &ni);
 852                         if (m0 == NULL) {
 853                                 ifp->if_oerrors++;
 854                                 continue;
 855                         }
 856                         wh = mtod(m0, struct ieee80211_frame *);
 857                         if (ic->ic_flags & IEEE80211_F_WEPON)
 858                                 wh->i_fc[1] |= IEEE80211_FC1_WEP;
 859
 860                 }
 861 #ifdef IEEE80211_RAWBPF
 862                 if (ic->ic_rawbpf)
 863                         bpf_mtap(ic->ic_rawbpf, m0);
 864 #endif
 865                 frmhdr.wi_tx_ctl = htole16(WI_ENC_TX_802_11|WI_TXCNTL_TX_EX);
 866                 if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
 867                     (wh->i_fc[1] & IEEE80211_FC1_WEP)) {
 868                         if ((m0 = ieee80211_wep_crypt(ifp, m0, 1)) == NULL) {
 869                                 ifp->if_oerrors++;
 870                                 if (ni && ni != ic->ic_bss)
 871                                         ieee80211_free_node(ic, ni);
 872                                 continue;
 873                         }
 874                         frmhdr.wi_tx_ctl |= htole16(WI_TXCNTL_NOCRYPT);
 875                 }
 876 #ifdef WI_RAWBPF
 877                 if (sc->sc_drvbpf) {
 878                         sc->sc_tx_th.wt_rate =
 879                                 ni->ni_rates.rs_rates[ni->ni_txrate];
 880                         bpf_mtap2(sc->sc_drvbpf,
 881                                 &sc->sc_tx_th, sc->sc_tx_th_len, m0);
 882                 }
 883 #endif
 884                 m_copydata(m0, 0, sizeof(struct ieee80211_frame),
 885                     (caddr_t)&frmhdr.wi_whdr);
 886                 m_adj(m0, sizeof(struct ieee80211_frame));
 887                 frmhdr.wi_dat_len = htole16(m0->m_pkthdr.len);
 888                 if (IFF_DUMPPKTS(ifp))
 889                         wi_dump_pkt(&frmhdr, NULL, -1);
 890                 fid = sc->sc_txd[cur].d_fid;
 891                 off = sizeof(frmhdr);
 892                 error = wi_write_bap(sc, fid, 0, &frmhdr, sizeof(frmhdr)) != 0
 893                      || wi_mwrite_bap(sc, fid, off, m0, m0->m_pkthdr.len) != 0;
 894                 m_freem(m0);
 895                 if (ni && ni != ic->ic_bss)
 896                         ieee80211_free_node(ic, ni);
 897                 if (error) {
 898                         ifp->if_oerrors++;
 899                         continue;
 900                 }
 901                 sc->sc_txd[cur].d_len = off;
 902                 if (sc->sc_txcur == cur) {
 903                         if (wi_cmd(sc, WI_CMD_TX | WI_RECLAIM, fid, 0, 0)) {
 904                                 if_printf(ifp, "xmit failed\n");
 905                                 sc->sc_txd[cur].d_len = 0;
 906                                 continue;
 907                         }
 908                         sc->sc_tx_timer = 5;
 909                         ifp->if_timer = 1;
 910                 }
 911                 sc->sc_txnext = cur = (cur + 1) % sc->sc_ntxbuf;
 912         }
 913
 914         WI_UNLOCK(sc);
 915 }
 916
 917 static int
 918 wi_reset(struct wi_softc *sc)
 919 {
 920         struct ieee80211com *ic = &sc->sc_ic;
 921         struct ifnet *ifp = &ic->ic_if;
 922 #define WI_INIT_TRIES 3
 923         int i;
 924         int error = 0;
 925         int tries;
 926
 927         /* Symbol firmware cannot be initialized more than once */
 928         if (sc->sc_firmware_type == WI_SYMBOL && sc->sc_reset)
 929                 return (0);
 930         if (sc->sc_firmware_type == WI_SYMBOL)
 931                 tries = 1;
 932         else
 933                 tries = WI_INIT_TRIES;
 934
 935         for (i = 0; i < tries; i++) {
 936                 if ((error = wi_cmd(sc, WI_CMD_INI, 0, 0, 0)) == 0)
 937                         break;
 938                 DELAY(WI_DELAY * 1000);
 939         }
 940         sc->sc_reset = 1;
 941
 942         if (i == tries) {
 943                 if_printf(ifp, "init failed\n");
 944                 return (error);
 945         }
 946
 947         CSR_WRITE_2(sc, WI_INT_EN, 0);
 948         CSR_WRITE_2(sc, WI_EVENT_ACK, 0xFFFF);
 949
 950         /* Calibrate timer. */
 951         wi_write_val(sc, WI_RID_TICK_TIME, 8);
 952
 953         return (0);
 954 #undef WI_INIT_TRIES
 955 }
 956
 957 static void
 958 wi_watchdog(struct ifnet *ifp)
 959 {
 960         struct wi_softc *sc = ifp->if_softc;
 961
 962         ifp->if_timer = 0;
 963         if (!sc->sc_enabled)
 964                 return;
 965
 966         if (sc->sc_tx_timer) {
 967                 if (--sc->sc_tx_timer == 0) {
 968                         if_printf(ifp, "device timeout\n");
 969                         ifp->if_oerrors++;
 970                         wi_init(ifp->if_softc);
 971                         return;
 972                 }
 973                 ifp->if_timer = 1;
 974         }
 975
 976         if (sc->sc_scan_timer) {
 977                 if (--sc->sc_scan_timer <= WI_SCAN_WAIT - WI_SCAN_INQWAIT &&
 978                     sc->sc_firmware_type == WI_INTERSIL) {
 979                         DPRINTF(("wi_watchdog: inquire scan\n"));
 980                         wi_cmd(sc, WI_CMD_INQUIRE, WI_INFO_SCAN_RESULTS, 0, 0);
 981                 }
 982                 if (sc->sc_scan_timer)
 983                         ifp->if_timer = 1;
 984         }
 985
 986         if (sc->sc_syn_timer) {
 987                 if (--sc->sc_syn_timer == 0) {
 988                         struct ieee80211com *ic = (struct ieee80211com *) ifp;
 989                         DPRINTF2(("wi_watchdog: %d false syns\n",
 990                             sc->sc_false_syns));
 991                         sc->sc_false_syns = 0;
 992                         ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
 993                         sc->sc_syn_timer = 5;
 994                 }
 995                 ifp->if_timer = 1;
 996         }
 997
 998         /* TODO: rate control */
 999         ieee80211_watchdog(ifp);
1000 }
1001
1002 static int
1003 wi_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
1004 {
1005         struct wi_softc *sc = ifp->if_softc;
1006         struct ieee80211com *ic = &sc->sc_ic;
1007         struct ifreq *ifr = (struct ifreq *)data;
1008         struct ieee80211req *ireq;
1009         u_int8_t nodename[IEEE80211_NWID_LEN];
1010         int error = 0;
1011         struct wi_req wreq;
1012         WI_LOCK_DECL();
1013
1014         WI_LOCK(sc);
1015
1016         if (sc->wi_gone) {
1017                 error = ENODEV;
1018                 goto out;
1019         }
1020
1021         switch (cmd) {
1022         case SIOCSIFFLAGS:
1023                 /*
1024                  * Can't do promisc and hostap at the same time.  If all that's
1025                  * changing is the promisc flag, try to short-circuit a call to
1026                  * wi_init() by just setting PROMISC in the hardware.
1027                  */
1028                 if (ifp->if_flags & IFF_UP) {
1029                         if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
1030                             ifp->if_flags & IFF_RUNNING) {
1031                                 if (ifp->if_flags & IFF_PROMISC &&
1032                                     !(sc->sc_if_flags & IFF_PROMISC)) {
1033                                         wi_write_val(sc, WI_RID_PROMISC, 1);
1034                                 } else if (!(ifp->if_flags & IFF_PROMISC) &&
1035                                     sc->sc_if_flags & IFF_PROMISC) {
1036                                         wi_write_val(sc, WI_RID_PROMISC, 0);
1037                                 } else {
1038                                         wi_init(sc);
1039                                 }
1040                         } else {
1041                                 wi_init(sc);
1042                         }
1043                 } else {
1044                         if (ifp->if_flags & IFF_RUNNING) {
1045                                 wi_stop(ifp, 1);
1046                         }
1047                         sc->wi_gone = 0;
1048                 }
1049                 sc->sc_if_flags = ifp->if_flags;
1050                 error = 0;
1051                 break;
1052         case SIOCADDMULTI:
1053         case SIOCDELMULTI:
1054                 error = wi_write_multi(sc);
1055                 break;
1056         case SIOCGIFGENERIC:
1057                 error = wi_get_cfg(ifp, cmd, data, cr);
1058                 break;
1059         case SIOCSIFGENERIC:
1060                 error = suser_cred(cr, NULL_CRED_OKAY);
1061                 if (error)
1062                         break;
1063                 error = wi_set_cfg(ifp, cmd, data);
1064                 break;
1065         case SIOCGPRISM2DEBUG:
1066                 error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1067                 if (error)
1068                         break;
1069                 if (!(ifp->if_flags & IFF_RUNNING) ||
1070                     sc->sc_firmware_type == WI_LUCENT) {
1071                         error = EIO;
1072                         break;
1073                 }
1074                 error = wi_get_debug(sc, &wreq);
1075                 if (error == 0)
1076                         error = copyout(&wreq, ifr->ifr_data, sizeof(wreq));
1077                 break;
1078         case SIOCSPRISM2DEBUG:
1079                 if ((error = suser_cred(cr, NULL_CRED_OKAY)))
1080                         goto out;
1081                 error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1082                 if (error)
1083                         break;
1084                 error = wi_set_debug(sc, &wreq);
1085                 break;
1086         case SIOCG80211:
1087                 ireq = (struct ieee80211req *) data;
1088                 switch (ireq->i_type) {
1089                 case IEEE80211_IOC_STATIONNAME:
1090                         ireq->i_len = sc->sc_nodelen + 1;
1091                         error = copyout(sc->sc_nodename, ireq->i_data,
1092                                         ireq->i_len);
1093                         break;
1094                 default:
1095                         error = ieee80211_ioctl(ifp, cmd, data, cr);
1096                         break;
1097                 }
1098                 break;
1099         case SIOCS80211:
1100                 error = suser_cred(cr, NULL_CRED_OKAY);
1101                 if (error)
1102                         break;
1103                 ireq = (struct ieee80211req *) data;
1104                 switch (ireq->i_type) {
1105                 case IEEE80211_IOC_STATIONNAME:
1106                         if (ireq->i_val != 0 ||
1107                             ireq->i_len > IEEE80211_NWID_LEN) {
1108                                 error = EINVAL;
1109                                 break;
1110                         }
1111                         memset(nodename, 0, IEEE80211_NWID_LEN);
1112                         error = copyin(ireq->i_data, nodename, ireq->i_len);
1113                         if (error)
1114                                 break;
1115                         if (sc->sc_enabled) {
1116                                 error = wi_write_ssid(sc, WI_RID_NODENAME,
1117                                         nodename, ireq->i_len);
1118                                 if (error)
1119                                         break;
1120                         }
1121                         memcpy(sc->sc_nodename, nodename, IEEE80211_NWID_LEN);
1122                         sc->sc_nodelen = ireq->i_len;
1123                         break;
1124                 default:
1125                         error = ieee80211_ioctl(ifp, cmd, data, cr);
1126                         break;
1127                 }
1128                 break;
1129         default:
1130                 error = ieee80211_ioctl(ifp, cmd, data, cr);
1131                 break;
1132         }
1133         if (error == ENETRESET) {
1134                 if (sc->sc_enabled)
1135                         wi_init(sc);    /* XXX no error return */
1136                 error = 0;
1137         }
1138 out:
1139         WI_UNLOCK(sc);
1140
1141         return (error);
1142 }
1143
1144 static int
1145 wi_media_change(struct ifnet *ifp)
1146 {
1147         struct wi_softc *sc = ifp->if_softc;
1148         int error;
1149
1150         error = ieee80211_media_change(ifp);
1151         if (error == ENETRESET) {
1152                 if (sc->sc_enabled)
1153                         wi_init(sc);    /* XXX no error return */
1154                 error = 0;
1155         }
1156         return error;
1157 }
1158
1159 static void
1160 wi_media_status(struct ifnet *ifp, struct ifmediareq *imr)
1161 {
1162         struct wi_softc *sc = ifp->if_softc;
1163         struct ieee80211com *ic = &sc->sc_ic;
1164         u_int16_t val;
1165         int rate, len;
1166
1167         if (sc->wi_gone || !sc->sc_enabled) {
1168                 imr->ifm_active = IFM_IEEE80211 | IFM_NONE;
1169                 imr->ifm_status = 0;
1170                 return;
1171         }
1172
1173         imr->ifm_status = IFM_AVALID;
1174         imr->ifm_active = IFM_IEEE80211;
1175         if (ic->ic_state == IEEE80211_S_RUN &&
1176             (sc->sc_flags & WI_FLAGS_OUTRANGE) == 0)
1177                 imr->ifm_status |= IFM_ACTIVE;
1178         len = sizeof(val);
1179         if (wi_read_rid(sc, WI_RID_CUR_TX_RATE, &val, &len) != 0)
1180                 rate = 0;
1181         else {
1182                 /* convert to 802.11 rate */
1183                 rate = val * 2;
1184                 if (sc->sc_firmware_type == WI_LUCENT) {
1185                         if (rate == 4 * 2)
1186                                 rate = 11;      /* 5.5Mbps */
1187                         else if (rate == 5 * 2)
1188                                 rate = 22;      /* 11Mbps */
1189                 } else {
1190                         if (rate == 4*2)
1191                                 rate = 11;      /* 5.5Mbps */
1192                         else if (rate == 8*2)
1193                                 rate = 22;      /* 11Mbps */
1194                 }
1195         }
1196         imr->ifm_active |= ieee80211_rate2media(ic, rate, IEEE80211_MODE_11B);
1197         switch (ic->ic_opmode) {
1198         case IEEE80211_M_STA:
1199                 break;
1200         case IEEE80211_M_IBSS:
1201                 imr->ifm_active |= IFM_IEEE80211_ADHOC;
1202                 break;
1203         case IEEE80211_M_AHDEMO:
1204                 imr->ifm_active |= IFM_IEEE80211_ADHOC | IFM_FLAG0;
1205                 break;
1206         case IEEE80211_M_HOSTAP:
1207                 imr->ifm_active |= IFM_IEEE80211_HOSTAP;
1208                 break;
1209         case IEEE80211_M_MONITOR:
1210                 imr->ifm_active |= IFM_IEEE80211_MONITOR;
1211                 break;
1212         }
1213 }
1214
1215 static void
1216 wi_sync_bssid(struct wi_softc *sc, u_int8_t new_bssid[IEEE80211_ADDR_LEN])
1217 {
1218         struct ieee80211com *ic = &sc->sc_ic;
1219         struct ieee80211_node *ni = ic->ic_bss;
1220         struct ifnet *ifp = &ic->ic_if;
1221
1222         if (IEEE80211_ADDR_EQ(new_bssid, ni->ni_bssid))
1223                 return;
1224
1225         DPRINTF(("wi_sync_bssid: bssid %6D -> ", ni->ni_bssid, ":"));
1226         DPRINTF(("%6D ?\n", new_bssid, ":"));
1227
1228         /* In promiscuous mode, the BSSID field is not a reliable
1229          * indicator of the firmware's BSSID. Damp spurious
1230          * change-of-BSSID indications.
1231          */
1232         if ((ifp->if_flags & IFF_PROMISC) != 0 &&
1233             sc->sc_false_syns >= WI_MAX_FALSE_SYNS)
1234                 return;
1235
1236         ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
1237 }
1238
1239 static void
1240 wi_rx_monitor(struct wi_softc *sc, int fid)
1241 {
1242         struct ieee80211com *ic = &sc->sc_ic;
1243         struct ifnet *ifp = &ic->ic_if;
1244         struct wi_frame *rx_frame;
1245         struct mbuf *m;
1246         int datlen, hdrlen;
1247
1248         /* first allocate mbuf for packet storage */
1249         m = m_getcl(MB_DONTWAIT, MT_DATA, 0);
1250         if (m == NULL) {
1251                 ifp->if_ierrors++;
1252                 return;
1253         }
1254
1255         m->m_pkthdr.rcvif = ifp;
1256
1257         /* now read wi_frame first so we know how much data to read */
1258         if (wi_read_bap(sc, fid, 0, mtod(m, caddr_t), sizeof(*rx_frame))) {
1259                 ifp->if_ierrors++;
1260                 goto done;
1261         }
1262
1263         rx_frame = mtod(m, struct wi_frame *);
1264
1265         switch ((rx_frame->wi_status & WI_STAT_MAC_PORT) >> 8) {
1266         case 7:
1267                 switch (rx_frame->wi_whdr.i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
1268                 case IEEE80211_FC0_TYPE_DATA:
1269                         hdrlen = WI_DATA_HDRLEN;
1270                         datlen = rx_frame->wi_dat_len + WI_FCS_LEN;
1271                         break;
1272                 case IEEE80211_FC0_TYPE_MGT:
1273                         hdrlen = WI_MGMT_HDRLEN;
1274                         datlen = rx_frame->wi_dat_len + WI_FCS_LEN;
1275                         break;
1276                 case IEEE80211_FC0_TYPE_CTL:
1277                         /*
1278                          * prism2 cards don't pass control packets
1279                          * down properly or consistently, so we'll only
1280                          * pass down the header.
1281                          */
1282                         hdrlen = WI_CTL_HDRLEN;
1283                         datlen = 0;
1284                         break;
1285                 default:
1286                         if_printf(ifp, "received packet of unknown type "
1287                                 "on port 7\n");
1288                         ifp->if_ierrors++;
1289                         goto done;
1290                 }
1291                 break;
1292         case 0:
1293                 hdrlen = WI_DATA_HDRLEN;
1294                 datlen = rx_frame->wi_dat_len + WI_FCS_LEN;
1295                 break;
1296         default:
1297                 if_printf(ifp, "received packet on invalid "
1298                     "port (wi_status=0x%x)\n", rx_frame->wi_status);
1299                 ifp->if_ierrors++;
1300                 goto done;
1301         }
1302
1303         if (hdrlen + datlen + 2 > MCLBYTES) {
1304                 if_printf(ifp, "oversized packet received "
1305                     "(wi_dat_len=%d, wi_status=0x%x)\n",
1306                     datlen, rx_frame->wi_status);
1307                 ifp->if_ierrors++;
1308                 goto done;
1309         }
1310
1311         if (wi_read_bap(sc, fid, hdrlen, mtod(m, caddr_t) + hdrlen,
1312             datlen + 2) == 0) {
1313                 m->m_pkthdr.len = m->m_len = hdrlen + datlen;
1314                 ifp->if_ipackets++;
1315                 BPF_MTAP(ifp, m);       /* Handle BPF listeners. */
1316         } else
1317                 ifp->if_ierrors++;
1318 done:
1319         m_freem(m);
1320 }
1321
1322 static void
1323 wi_rx_intr(struct wi_softc *sc)
1324 {
1325         struct ieee80211com *ic = &sc->sc_ic;
1326         struct ifnet *ifp = &ic->ic_if;
1327         struct wi_frame frmhdr;
1328         struct mbuf *m;
1329         struct ieee80211_frame *wh;
1330         struct ieee80211_node *ni;
1331         int fid, len, off, rssi;
1332         u_int8_t dir;
1333         u_int16_t status;
1334         u_int32_t rstamp;
1335
1336         fid = CSR_READ_2(sc, WI_RX_FID);
1337
1338         if (sc->wi_debug.wi_monitor) {
1339                 /*
1340                  * If we are in monitor mode just
1341                  * read the data from the device.
1342                  */
1343                 wi_rx_monitor(sc, fid);
1344                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_RX);
1345                 return;
1346         }
1347
1348         /* First read in the frame header */
1349         if (wi_read_bap(sc, fid, 0, &frmhdr, sizeof(frmhdr))) {
1350                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_RX);
1351                 ifp->if_ierrors++;
1352                 DPRINTF(("wi_rx_intr: read fid %x failed\n", fid));
1353                 return;
1354         }
1355
1356         if (IFF_DUMPPKTS(ifp))
1357                 wi_dump_pkt(&frmhdr, NULL, frmhdr.wi_rx_signal);
1358
1359         /*
1360          * Drop undecryptable or packets with receive errors here
1361          */
1362         status = le16toh(frmhdr.wi_status);
1363         if (status & WI_STAT_ERRSTAT) {
1364                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_RX);
1365                 ifp->if_ierrors++;
1366                 DPRINTF(("wi_rx_intr: fid %x error status %x\n", fid, status));
1367                 return;
1368         }
1369         rssi = frmhdr.wi_rx_signal;
1370         rstamp = (le16toh(frmhdr.wi_rx_tstamp0) << 16) |
1371             le16toh(frmhdr.wi_rx_tstamp1);
1372
1373         len = le16toh(frmhdr.wi_dat_len);
1374         off = ALIGN(sizeof(struct ieee80211_frame));
1375
1376         /*
1377          * Sometimes the PRISM2.x returns bogusly large frames. Except
1378          * in monitor mode, just throw them away.
1379          */
1380         if (off + len > MCLBYTES) {
1381                 if (ic->ic_opmode != IEEE80211_M_MONITOR) {
1382                         CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_RX);
1383                         ifp->if_ierrors++;
1384                         DPRINTF(("wi_rx_intr: oversized packet\n"));
1385                         return;
1386                 } else
1387                         len = 0;
1388         }
1389
1390         MGETHDR(m, MB_DONTWAIT, MT_DATA);
1391         if (m == NULL) {
1392                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_RX);
1393                 ifp->if_ierrors++;
1394                 DPRINTF(("wi_rx_intr: MGET failed\n"));
1395                 return;
1396         }
1397         if (off + len > MHLEN) {
1398                 MCLGET(m, MB_DONTWAIT);
1399                 if ((m->m_flags & M_EXT) == 0) {
1400                         CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_RX);
1401                         m_freem(m);
1402                         ifp->if_ierrors++;
1403                         DPRINTF(("wi_rx_intr: MCLGET failed\n"));
1404                         return;
1405                 }
1406         }
1407
1408         m->m_data += off - sizeof(struct ieee80211_frame);
1409         memcpy(m->m_data, &frmhdr.wi_whdr, sizeof(struct ieee80211_frame));
1410         wi_read_bap(sc, fid, sizeof(frmhdr),
1411             m->m_data + sizeof(struct ieee80211_frame), len);
1412         m->m_pkthdr.len = m->m_len = sizeof(struct ieee80211_frame) + len;
1413         m->m_pkthdr.rcvif = ifp;
1414
1415         CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_RX);
1416
1417 #ifdef WI_RAWBPF
1418         if (sc->sc_drvbpf) {
1419                 /* XXX replace divide by table */
1420                 sc->sc_rx_th.wr_rate = frmhdr.wi_rx_rate / 5;
1421                 sc->sc_rx_th.wr_antsignal = frmhdr.wi_rx_signal;
1422                 sc->sc_rx_th.wr_antnoise = frmhdr.wi_rx_silence;
1423                 sc->sc_rx_th.wr_flags = 0;
1424                 if (frmhdr.wi_status & WI_STAT_PCF)
1425                         sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_CFP;
1426                 bpf_mtap2(sc->sc_drvbpf,
1427                         &sc->sc_rx_th, sc->sc_rx_th_len, m);
1428         }
1429 #endif
1430         wh = mtod(m, struct ieee80211_frame *);
1431         if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1432                 /*
1433                  * WEP is decrypted by hardware. Clear WEP bit
1434                  * header for ieee80211_input().
1435                  */
1436                 wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
1437         }
1438
1439         /* synchronize driver's BSSID with firmware's BSSID */
1440         dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
1441         if (ic->ic_opmode == IEEE80211_M_IBSS && dir == IEEE80211_FC1_DIR_NODS)
1442                 wi_sync_bssid(sc, wh->i_addr3);
1443
1444         /*
1445          * Locate the node for sender, track state, and
1446          * then pass this node (referenced) up to the 802.11
1447          * layer for its use.  We are required to pass
1448          * something so we fallback to ic_bss when this frame
1449          * is from an unknown sender.
1450          */
1451         if (ic->ic_opmode != IEEE80211_M_STA) {
1452                 ni = ieee80211_find_node(ic, wh->i_addr2);
1453                 if (ni == NULL)
1454                         ni = ieee80211_ref_node(ic->ic_bss);
1455         } else
1456                 ni = ieee80211_ref_node(ic->ic_bss);
1457         /*
1458          * Send frame up for processing.
1459          */
1460         ieee80211_input(ifp, m, ni, rssi, rstamp);
1461         /*
1462          * The frame may have caused the node to be marked for
1463          * reclamation (e.g. in response to a DEAUTH message)
1464          * so use free_node here instead of unref_node.
1465          */
1466         if (ni == ic->ic_bss)
1467                 ieee80211_unref_node(&ni);
1468         else
1469                 ieee80211_free_node(ic, ni);
1470 }
1471
1472 static void
1473 wi_tx_ex_intr(struct wi_softc *sc)
1474 {
1475         struct ieee80211com *ic = &sc->sc_ic;
1476         struct ifnet *ifp = &ic->ic_if;
1477         struct wi_frame frmhdr;
1478         int fid;
1479
1480         fid = CSR_READ_2(sc, WI_TX_CMP_FID);
1481         /* Read in the frame header */
1482         if (wi_read_bap(sc, fid, 0, &frmhdr, sizeof(frmhdr)) == 0) {
1483                 u_int16_t status = le16toh(frmhdr.wi_status);
1484
1485                 /*
1486                  * Spontaneous station disconnects appear as xmit
1487                  * errors.  Don't announce them and/or count them
1488                  * as an output error.
1489                  */
1490                 if ((status & WI_TXSTAT_DISCONNECT) == 0) {
1491                         if (ppsratecheck(&lasttxerror, &curtxeps, wi_txerate)) {
1492                                 if_printf(ifp, "tx failed");
1493                                 if (status & WI_TXSTAT_RET_ERR)
1494                                         printf(", retry limit exceeded");
1495                                 if (status & WI_TXSTAT_AGED_ERR)
1496                                         printf(", max transmit lifetime exceeded");
1497                                 if (status & WI_TXSTAT_DISCONNECT)
1498                                         printf(", port disconnected");
1499                                 if (status & WI_TXSTAT_FORM_ERR)
1500                                         printf(", invalid format (data len %u src %6D)",
1501                                                 le16toh(frmhdr.wi_dat_len),
1502                                                 frmhdr.wi_ehdr.ether_shost, ":");
1503                                 if (status & ~0xf)
1504                                         printf(", status=0x%x", status);
1505                                 printf("\n");
1506                         }
1507                         ifp->if_oerrors++;
1508                 } else {
1509                         DPRINTF(("port disconnected\n"));
1510                         ifp->if_collisions++;   /* XXX */
1511                 }
1512         } else
1513                 DPRINTF(("wi_tx_ex_intr: read fid %x failed\n", fid));
1514         CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_TX_EXC);
1515 }
1516
1517 static void
1518 wi_tx_intr(struct wi_softc *sc)
1519 {
1520         struct ieee80211com *ic = &sc->sc_ic;
1521         struct ifnet *ifp = &ic->ic_if;
1522         int fid, cur;
1523
1524         if (sc->wi_gone)
1525                 return;
1526
1527         fid = CSR_READ_2(sc, WI_ALLOC_FID);
1528         CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_ALLOC);
1529
1530         cur = sc->sc_txcur;
1531         if (sc->sc_txd[cur].d_fid != fid) {
1532                 if_printf(ifp, "bad alloc %x != %x, cur %d nxt %d\n",
1533                     fid, sc->sc_txd[cur].d_fid, cur, sc->sc_txnext);
1534                 return;
1535         }
1536         sc->sc_tx_timer = 0;
1537         sc->sc_txd[cur].d_len = 0;
1538         sc->sc_txcur = cur = (cur + 1) % sc->sc_ntxbuf;
1539         if (sc->sc_txd[cur].d_len == 0)
1540                 ifp->if_flags &= ~IFF_OACTIVE;
1541         else {
1542                 if (wi_cmd(sc, WI_CMD_TX | WI_RECLAIM, sc->sc_txd[cur].d_fid,
1543                     0, 0)) {
1544                         if_printf(ifp, "xmit failed\n");
1545                         sc->sc_txd[cur].d_len = 0;
1546                 } else {
1547                         sc->sc_tx_timer = 5;
1548                         ifp->if_timer = 1;
1549                 }
1550         }
1551 }
1552
1553 static void
1554 wi_info_intr(struct wi_softc *sc)
1555 {
1556         struct ieee80211com *ic = &sc->sc_ic;
1557         struct ifnet *ifp = &ic->ic_if;
1558         int i, fid, len, off;
1559         u_int16_t ltbuf[2];
1560         u_int16_t stat;
1561         u_int32_t *ptr;
1562
1563         fid = CSR_READ_2(sc, WI_INFO_FID);
1564         wi_read_bap(sc, fid, 0, ltbuf, sizeof(ltbuf));
1565
1566         switch (le16toh(ltbuf[1])) {
1567
1568         case WI_INFO_LINK_STAT:
1569                 wi_read_bap(sc, fid, sizeof(ltbuf), &stat, sizeof(stat));
1570                 DPRINTF(("wi_info_intr: LINK_STAT 0x%x\n", le16toh(stat)));
1571                 switch (le16toh(stat)) {
1572                 case WI_INFO_LINK_STAT_CONNECTED:
1573                         sc->sc_flags &= ~WI_FLAGS_OUTRANGE;
1574                         if (ic->ic_state == IEEE80211_S_RUN &&
1575                             ic->ic_opmode != IEEE80211_M_IBSS)
1576                                 break;
1577                         /* FALLTHROUGH */
1578                 case WI_INFO_LINK_STAT_AP_CHG:
1579                         ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
1580                         break;
1581                 case WI_INFO_LINK_STAT_AP_INR:
1582                         sc->sc_flags &= ~WI_FLAGS_OUTRANGE;
1583                         break;
1584                 case WI_INFO_LINK_STAT_AP_OOR:
1585                         if (sc->sc_firmware_type == WI_SYMBOL &&
1586                             sc->sc_scan_timer > 0) {
1587                                 if (wi_cmd(sc, WI_CMD_INQUIRE,
1588                                     WI_INFO_HOST_SCAN_RESULTS, 0, 0) != 0)
1589                                         sc->sc_scan_timer = 0;
1590                                 break;
1591                         }
1592                         if (ic->ic_opmode == IEEE80211_M_STA)
1593                                 sc->sc_flags |= WI_FLAGS_OUTRANGE;
1594                         break;
1595                 case WI_INFO_LINK_STAT_DISCONNECTED:
1596                 case WI_INFO_LINK_STAT_ASSOC_FAILED:
1597                         if (ic->ic_opmode == IEEE80211_M_STA)
1598                                 ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
1599                         break;
1600                 }
1601                 break;
1602
1603         case WI_INFO_COUNTERS:
1604                 /* some card versions have a larger stats structure */
1605                 len = min(le16toh(ltbuf[0]) - 1, sizeof(sc->sc_stats) / 4);
1606                 ptr = (u_int32_t *)&sc->sc_stats;
1607                 off = sizeof(ltbuf);
1608                 for (i = 0; i < len; i++, off += 2, ptr++) {
1609                         wi_read_bap(sc, fid, off, &stat, sizeof(stat));
1610 #ifdef WI_HERMES_STATS_WAR
1611                         if (stat & 0xf000)
1612                                 stat = ~stat;
1613 #endif
1614                         *ptr += stat;
1615                 }
1616                 ifp->if_collisions = sc->sc_stats.wi_tx_single_retries +
1617                     sc->sc_stats.wi_tx_multi_retries +
1618                     sc->sc_stats.wi_tx_retry_limit;
1619                 break;
1620
1621         case WI_INFO_SCAN_RESULTS:
1622         case WI_INFO_HOST_SCAN_RESULTS:
1623                 wi_scan_result(sc, fid, le16toh(ltbuf[0]));
1624                 break;
1625
1626         default:
1627                 DPRINTF(("wi_info_intr: got fid %x type %x len %d\n", fid,
1628                     le16toh(ltbuf[1]), le16toh(ltbuf[0])));
1629                 break;
1630         }
1631         CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_INFO);
1632 }
1633
1634 static int
1635 wi_write_multi(struct wi_softc *sc)
1636 {
1637         struct ifnet *ifp = &sc->sc_ic.ic_if;
1638         int n;
1639         struct ifmultiaddr *ifma;
1640         struct wi_mcast mlist;
1641
1642         if (ifp->if_flags & IFF_ALLMULTI || ifp->if_flags & IFF_PROMISC) {
1643 allmulti:
1644                 memset(&mlist, 0, sizeof(mlist));
1645                 return wi_write_rid(sc, WI_RID_MCAST_LIST, &mlist,
1646                     sizeof(mlist));
1647         }
1648
1649         n = 0;
1650         LIST_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
1651                 if (ifma->ifma_addr->sa_family != AF_LINK)
1652                         continue;
1653                 if (n >= 16)
1654                         goto allmulti;
1655                 IEEE80211_ADDR_COPY(&mlist.wi_mcast[n],
1656                     (LLADDR((struct sockaddr_dl *)ifma->ifma_addr)));
1657                 n++;
1658         }
1659         return wi_write_rid(sc, WI_RID_MCAST_LIST, &mlist,
1660             IEEE80211_ADDR_LEN * n);
1661 }
1662
1663 static void
1664 wi_read_nicid(struct wi_softc *sc)
1665 {
1666         struct wi_card_ident *id;
1667         char *p;
1668         int len;
1669         u_int16_t ver[4];
1670
1671         /* getting chip identity */
1672         memset(ver, 0, sizeof(ver));
1673         len = sizeof(ver);
1674         wi_read_rid(sc, WI_RID_CARD_ID, ver, &len);
1675         device_printf(sc->sc_dev, "using ");
1676
1677         sc->sc_firmware_type = WI_NOTYPE;
1678         for (id = wi_card_ident; id->card_name != NULL; id++) {
1679                 if (le16toh(ver[0]) == id->card_id) {
1680                         printf("%s", id->card_name);
1681                         sc->sc_firmware_type = id->firm_type;
1682                         break;
1683                 }
1684         }
1685         if (sc->sc_firmware_type == WI_NOTYPE) {
1686                 if (le16toh(ver[0]) & 0x8000) {
1687                         printf("Unknown PRISM2 chip");
1688                         sc->sc_firmware_type = WI_INTERSIL;
1689                 } else {
1690                         printf("Unknown Lucent chip");
1691                         sc->sc_firmware_type = WI_LUCENT;
1692                 }
1693         }
1694
1695         /* get primary firmware version (Only Prism chips) */
1696         if (sc->sc_firmware_type != WI_LUCENT) {
1697                 memset(ver, 0, sizeof(ver));
1698                 len = sizeof(ver);
1699                 wi_read_rid(sc, WI_RID_PRI_IDENTITY, ver, &len);
1700                 sc->sc_pri_firmware_ver = le16toh(ver[2]) * 10000 +
1701                     le16toh(ver[3]) * 100 + le16toh(ver[1]);
1702         }
1703
1704         /* get station firmware version */
1705         memset(ver, 0, sizeof(ver));
1706         len = sizeof(ver);
1707         wi_read_rid(sc, WI_RID_STA_IDENTITY, ver, &len);
1708         sc->sc_sta_firmware_ver = le16toh(ver[2]) * 10000 +
1709             le16toh(ver[3]) * 100 + le16toh(ver[1]);
1710         if (sc->sc_firmware_type == WI_INTERSIL &&
1711             (sc->sc_sta_firmware_ver == 10102 ||
1712              sc->sc_sta_firmware_ver == 20102)) {
1713                 char ident[12];
1714                 memset(ident, 0, sizeof(ident));
1715                 len = sizeof(ident);
1716                 /* value should be the format like "V2.00-11" */
1717                 if (wi_read_rid(sc, WI_RID_SYMBOL_IDENTITY, ident, &len) == 0 &&
1718                     *(p = (char *)ident) >= 'A' &&
1719                     p[2] == '.' && p[5] == '-' && p[8] == '\0') {
1720                         sc->sc_firmware_type = WI_SYMBOL;
1721                         sc->sc_sta_firmware_ver = (p[1] - '0') * 10000 +
1722                             (p[3] - '0') * 1000 + (p[4] - '0') * 100 +
1723                             (p[6] - '0') * 10 + (p[7] - '0');
1724                 }
1725         }
1726         printf("\n");
1727         device_printf(sc->sc_dev, "%s Firmware: ",
1728              sc->sc_firmware_type == WI_LUCENT ? "Lucent" :
1729             (sc->sc_firmware_type == WI_SYMBOL ? "Symbol" : "Intersil"));
1730         if (sc->sc_firmware_type != WI_LUCENT)  /* XXX */
1731                 printf("Primary (%u.%u.%u), ",
1732                     sc->sc_pri_firmware_ver / 10000,
1733                     (sc->sc_pri_firmware_ver % 10000) / 100,
1734                     sc->sc_pri_firmware_ver % 100);
1735         printf("Station (%u.%u.%u)\n",
1736             sc->sc_sta_firmware_ver / 10000,
1737             (sc->sc_sta_firmware_ver % 10000) / 100,
1738             sc->sc_sta_firmware_ver % 100);
1739 }
1740
1741 static int
1742 wi_write_ssid(struct wi_softc *sc, int rid, u_int8_t *buf, int buflen)
1743 {
1744         struct wi_ssid ssid;
1745
1746         if (buflen > IEEE80211_NWID_LEN)
1747                 return ENOBUFS;
1748         memset(&ssid, 0, sizeof(ssid));
1749         ssid.wi_len = htole16(buflen);
1750         memcpy(ssid.wi_ssid, buf, buflen);
1751         return wi_write_rid(sc, rid, &ssid, sizeof(ssid));
1752 }
1753
1754 static int
1755 wi_get_cfg(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
1756 {
1757         struct wi_softc *sc = ifp->if_softc;
1758         struct ieee80211com *ic = &sc->sc_ic;
1759         struct ifreq *ifr = (struct ifreq *)data;
1760         struct wi_req wreq;
1761         struct wi_scan_res *res;
1762         size_t reslen;
1763         int len, n, error, mif, val, off, i;
1764
1765         error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1766         if (error)
1767                 return error;
1768         len = (wreq.wi_len - 1) * 2;
1769         if (len < sizeof(u_int16_t))
1770                 return ENOSPC;
1771         if (len > sizeof(wreq.wi_val))
1772                 len = sizeof(wreq.wi_val);
1773
1774         switch (wreq.wi_type) {
1775
1776         case WI_RID_IFACE_STATS:
1777                 memcpy(wreq.wi_val, &sc->sc_stats, sizeof(sc->sc_stats));
1778                 if (len < sizeof(sc->sc_stats))
1779                         error = ENOSPC;
1780                 else
1781                         len = sizeof(sc->sc_stats);
1782                 break;
1783
1784         case WI_RID_ENCRYPTION:
1785         case WI_RID_TX_CRYPT_KEY:
1786         case WI_RID_DEFLT_CRYPT_KEYS:
1787         case WI_RID_TX_RATE:
1788                 return ieee80211_cfgget(ifp, cmd, data, cr);
1789
1790         case WI_RID_MICROWAVE_OVEN:
1791                 if (sc->sc_enabled && (sc->sc_flags & WI_FLAGS_HAS_MOR)) {
1792                         error = wi_read_rid(sc, wreq.wi_type, wreq.wi_val,
1793                             &len);
1794                         break;
1795                 }
1796                 wreq.wi_val[0] = htole16(sc->sc_microwave_oven);
1797                 len = sizeof(u_int16_t);
1798                 break;
1799
1800         case WI_RID_DBM_ADJUST:
1801                 if (sc->sc_enabled && (sc->sc_flags & WI_FLAGS_HAS_DBMADJUST)) {
1802                         error = wi_read_rid(sc, wreq.wi_type, wreq.wi_val,
1803                             &len);
1804                         break;
1805                 }
1806                 wreq.wi_val[0] = htole16(sc->sc_dbm_offset);
1807                 len = sizeof(u_int16_t);
1808                 break;
1809
1810         case WI_RID_ROAMING_MODE:
1811                 if (sc->sc_enabled && (sc->sc_flags & WI_FLAGS_HAS_ROAMING)) {
1812                         error = wi_read_rid(sc, wreq.wi_type, wreq.wi_val,
1813                             &len);
1814                         break;
1815                 }
1816                 wreq.wi_val[0] = htole16(sc->sc_roaming_mode);
1817                 len = sizeof(u_int16_t);
1818                 break;
1819
1820         case WI_RID_SYSTEM_SCALE:
1821                 if (sc->sc_enabled && (sc->sc_flags & WI_FLAGS_HAS_SYSSCALE)) {
1822                         error = wi_read_rid(sc, wreq.wi_type, wreq.wi_val,
1823                             &len);
1824                         break;
1825                 }
1826                 wreq.wi_val[0] = htole16(sc->sc_system_scale);
1827                 len = sizeof(u_int16_t);
1828                 break;
1829
1830         case WI_RID_FRAG_THRESH:
1831                 if (sc->sc_enabled && (sc->sc_flags & WI_FLAGS_HAS_FRAGTHR)) {
1832                         error = wi_read_rid(sc, wreq.wi_type, wreq.wi_val,
1833                             &len);
1834                         break;
1835                 }
1836                 wreq.wi_val[0] = htole16(ic->ic_fragthreshold);
1837                 len = sizeof(u_int16_t);
1838                 break;
1839
1840         case WI_RID_READ_APS:
1841                 if (ic->ic_opmode == IEEE80211_M_HOSTAP)
1842                         return ieee80211_cfgget(ifp, cmd, data, cr);
1843                 if (sc->sc_scan_timer > 0) {
1844                         error = EINPROGRESS;
1845                         break;
1846                 }
1847                 n = sc->sc_naps;
1848                 if (len < sizeof(n)) {
1849                         error = ENOSPC;
1850                         break;
1851                 }
1852                 if (len < sizeof(n) + sizeof(struct wi_apinfo) * n)
1853                         n = (len - sizeof(n)) / sizeof(struct wi_apinfo);
1854                 len = sizeof(n) + sizeof(struct wi_apinfo) * n;
1855                 memcpy(wreq.wi_val, &n, sizeof(n));
1856                 memcpy((caddr_t)wreq.wi_val + sizeof(n), sc->sc_aps,
1857                     sizeof(struct wi_apinfo) * n);
1858                 break;
1859
1860         case WI_RID_PRISM2:
1861                 wreq.wi_val[0] = sc->sc_firmware_type != WI_LUCENT;
1862                 len = sizeof(u_int16_t);
1863                 break;
1864
1865         case WI_RID_MIF:
1866                 mif = wreq.wi_val[0];
1867                 error = wi_cmd(sc, WI_CMD_READMIF, mif, 0, 0);
1868                 val = CSR_READ_2(sc, WI_RESP0);
1869                 wreq.wi_val[0] = val;
1870                 len = sizeof(u_int16_t);
1871                 break;
1872
1873         case WI_RID_ZERO_CACHE:
1874         case WI_RID_PROCFRAME:          /* ignore for compatibility */
1875                 /* XXX ??? */
1876                 break;
1877
1878         case WI_RID_READ_CACHE:
1879                 return ieee80211_cfgget(ifp, cmd, data, cr);
1880
1881         case WI_RID_SCAN_RES:           /* compatibility interface */
1882                 if (ic->ic_opmode == IEEE80211_M_HOSTAP)
1883                         return ieee80211_cfgget(ifp, cmd, data, cr);
1884                 if (sc->sc_scan_timer > 0) {
1885                         error = EINPROGRESS;
1886                         break;
1887                 }
1888                 n = sc->sc_naps;
1889                 if (sc->sc_firmware_type == WI_LUCENT) {
1890                         off = 0;
1891                         reslen = WI_WAVELAN_RES_SIZE;
1892                 } else {
1893                         off = sizeof(struct wi_scan_p2_hdr);
1894                         reslen = WI_PRISM2_RES_SIZE;
1895                 }
1896                 if (len < off + reslen * n)
1897                         n = (len - off) / reslen;
1898                 len = off + reslen * n;
1899                 if (off != 0) {
1900                         struct wi_scan_p2_hdr *p2 = (struct wi_scan_p2_hdr *)wreq.wi_val;
1901                         /*
1902                          * Prepend Prism-specific header.
1903                          */
1904                         if (len < sizeof(struct wi_scan_p2_hdr)) {
1905                                 error = ENOSPC;
1906                                 break;
1907                         }
1908                         p2 = (struct wi_scan_p2_hdr *)wreq.wi_val;
1909                         p2->wi_rsvd = 0;
1910                         p2->wi_reason = n;      /* XXX */
1911                 }
1912                 for (i = 0; i < n; i++, off += reslen) {
1913                         const struct wi_apinfo *ap = &sc->sc_aps[i];
1914
1915                         res = (struct wi_scan_res *)((char *)wreq.wi_val + off);
1916                         res->wi_chan = ap->channel;
1917                         res->wi_noise = ap->noise;
1918                         res->wi_signal = ap->signal;
1919                         IEEE80211_ADDR_COPY(res->wi_bssid, ap->bssid);
1920                         res->wi_interval = ap->interval;
1921                         res->wi_capinfo = ap->capinfo;
1922                         res->wi_ssid_len = ap->namelen;
1923                         memcpy(res->wi_ssid, ap->name,
1924                                 IEEE80211_NWID_LEN);
1925                         if (sc->sc_firmware_type != WI_LUCENT) {
1926                                 /* XXX not saved from Prism cards */
1927                                 memset(res->wi_srates, 0,
1928                                         sizeof(res->wi_srates));
1929                                 res->wi_rate = ap->rate;
1930                                 res->wi_rsvd = 0;
1931                         }
1932                 }
1933                 break;
1934
1935         default:
1936                 if (sc->sc_enabled) {
1937                         error = wi_read_rid(sc, wreq.wi_type, wreq.wi_val,
1938                             &len);
1939                         break;
1940                 }
1941                 switch (wreq.wi_type) {
1942                 case WI_RID_MAX_DATALEN:
1943                         wreq.wi_val[0] = htole16(sc->sc_max_datalen);
1944                         len = sizeof(u_int16_t);
1945                         break;
1946                 case WI_RID_RTS_THRESH:
1947                         wreq.wi_val[0] = htole16(ic->ic_rtsthreshold);
1948                         len = sizeof(u_int16_t);
1949                         break;
1950                 case WI_RID_CNFAUTHMODE:
1951                         wreq.wi_val[0] = htole16(sc->sc_cnfauthmode);
1952                         len = sizeof(u_int16_t);
1953                         break;
1954                 case WI_RID_NODENAME:
1955                         if (len < sc->sc_nodelen + sizeof(u_int16_t)) {
1956                                 error = ENOSPC;
1957                                 break;
1958                         }
1959                         len = sc->sc_nodelen + sizeof(u_int16_t);
1960                         wreq.wi_val[0] = htole16((sc->sc_nodelen + 1) / 2);
1961                         memcpy(&wreq.wi_val[1], sc->sc_nodename,
1962                             sc->sc_nodelen);
1963                         break;
1964                 default:
1965                         return ieee80211_cfgget(ifp, cmd, data, cr);
1966                 }
1967                 break;
1968         }
1969         if (error)
1970                 return error;
1971         wreq.wi_len = (len + 1) / 2 + 1;
1972         return copyout(&wreq, ifr->ifr_data, (wreq.wi_len + 1) * 2);
1973 }
1974
1975 static int
1976 wi_set_cfg(struct ifnet *ifp, u_long cmd, caddr_t data)
1977 {
1978         struct wi_softc *sc = ifp->if_softc;
1979         struct ieee80211com *ic = &sc->sc_ic;
1980         struct ifreq *ifr = (struct ifreq *)data;
1981         struct wi_req wreq;
1982         struct mbuf *m;
1983         int i, len, error, mif, val;
1984         struct ieee80211_rateset *rs;
1985
1986         error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1987         if (error)
1988                 return error;
1989         len = wreq.wi_len ? (wreq.wi_len - 1) * 2 : 0;
1990         switch (wreq.wi_type) {
1991         case WI_RID_DBM_ADJUST:
1992                 return ENODEV;
1993
1994         case WI_RID_NODENAME:
1995                 if (le16toh(wreq.wi_val[0]) * 2 > len ||
1996                     le16toh(wreq.wi_val[0]) > sizeof(sc->sc_nodename)) {
1997                         error = ENOSPC;
1998                         break;
1999                 }
2000                 if (sc->sc_enabled) {
2001                         error = wi_write_rid(sc, wreq.wi_type, wreq.wi_val,
2002                             len);
2003                         if (error)
2004                                 break;
2005                 }
2006                 sc->sc_nodelen = le16toh(wreq.wi_val[0]) * 2;
2007                 memcpy(sc->sc_nodename, &wreq.wi_val[1], sc->sc_nodelen);
2008                 break;
2009
2010         case WI_RID_MICROWAVE_OVEN:
2011         case WI_RID_ROAMING_MODE:
2012         case WI_RID_SYSTEM_SCALE:
2013         case WI_RID_FRAG_THRESH:
2014                 if (wreq.wi_type == WI_RID_MICROWAVE_OVEN &&
2015                     (sc->sc_flags & WI_FLAGS_HAS_MOR) == 0)
2016                         break;
2017                 if (wreq.wi_type == WI_RID_ROAMING_MODE &&
2018                     (sc->sc_flags & WI_FLAGS_HAS_ROAMING) == 0)
2019                         break;
2020                 if (wreq.wi_type == WI_RID_SYSTEM_SCALE &&
2021                     (sc->sc_flags & WI_FLAGS_HAS_SYSSCALE) == 0)
2022                         break;
2023                 if (wreq.wi_type == WI_RID_FRAG_THRESH &&
2024                     (sc->sc_flags & WI_FLAGS_HAS_FRAGTHR) == 0)
2025                         break;
2026                 /* FALLTHROUGH */
2027         case WI_RID_RTS_THRESH:
2028         case WI_RID_CNFAUTHMODE:
2029         case WI_RID_MAX_DATALEN:
2030                 if (sc->sc_enabled) {
2031                         error = wi_write_rid(sc, wreq.wi_type, wreq.wi_val,
2032                             sizeof(u_int16_t));
2033                         if (error)
2034                                 break;
2035                 }
2036                 switch (wreq.wi_type) {
2037                 case WI_RID_FRAG_THRESH:
2038                         ic->ic_fragthreshold = le16toh(wreq.wi_val[0]);
2039                         break;
2040                 case WI_RID_RTS_THRESH:
2041                         ic->ic_rtsthreshold = le16toh(wreq.wi_val[0]);
2042                         break;
2043                 case WI_RID_MICROWAVE_OVEN:
2044                         sc->sc_microwave_oven = le16toh(wreq.wi_val[0]);
2045                         break;
2046                 case WI_RID_ROAMING_MODE:
2047                         sc->sc_roaming_mode = le16toh(wreq.wi_val[0]);
2048                         break;
2049                 case WI_RID_SYSTEM_SCALE:
2050                         sc->sc_system_scale = le16toh(wreq.wi_val[0]);
2051                         break;
2052                 case WI_RID_CNFAUTHMODE:
2053                         sc->sc_cnfauthmode = le16toh(wreq.wi_val[0]);
2054                         break;
2055                 case WI_RID_MAX_DATALEN:
2056                         sc->sc_max_datalen = le16toh(wreq.wi_val[0]);
2057                         break;
2058                 }
2059                 break;
2060
2061         case WI_RID_TX_RATE:
2062                 switch (le16toh(wreq.wi_val[0])) {
2063                 case 3:
2064                         ic->ic_fixed_rate = -1;
2065                         break;
2066                 default:
2067                         rs = &ic->ic_sup_rates[IEEE80211_MODE_11B];
2068                         for (i = 0; i < rs->rs_nrates; i++) {
2069                                 if ((rs->rs_rates[i] & IEEE80211_RATE_VAL)
2070                                     / 2 == le16toh(wreq.wi_val[0]))
2071                                         break;
2072                         }
2073                         if (i == rs->rs_nrates)
2074                                 return EINVAL;
2075                         ic->ic_fixed_rate = i;
2076                 }
2077                 if (sc->sc_enabled)
2078                         error = wi_write_txrate(sc);
2079                 break;
2080
2081         case WI_RID_SCAN_APS:
2082                 if (sc->sc_enabled && ic->ic_opmode != IEEE80211_M_HOSTAP)
2083                         error = wi_scan_ap(sc, 0x3fff, 0x000f);
2084                 break;
2085
2086         case WI_RID_SCAN_REQ:           /* compatibility interface */
2087                 if (sc->sc_enabled && ic->ic_opmode != IEEE80211_M_HOSTAP)
2088                         error = wi_scan_ap(sc, wreq.wi_val[0], wreq.wi_val[1]);
2089                 break;
2090
2091         case WI_RID_MGMT_XMIT:
2092                 if (!sc->sc_enabled) {
2093                         error = ENETDOWN;
2094                         break;
2095                 }
2096                 if (ic->ic_mgtq.ifq_len > 5) {
2097                         error = EAGAIN;
2098                         break;
2099                 }
2100                 /* XXX wi_len looks in u_int8_t, not in u_int16_t */
2101                 m = m_devget((char *)&wreq.wi_val, wreq.wi_len, 0, ifp, NULL);
2102                 if (m == NULL) {
2103                         error = ENOMEM;
2104                         break;
2105                 }
2106                 IF_ENQUEUE(&ic->ic_mgtq, m);
2107                 break;
2108
2109         case WI_RID_MIF:
2110                 mif = wreq.wi_val[0];
2111                 val = wreq.wi_val[1];
2112                 error = wi_cmd(sc, WI_CMD_WRITEMIF, mif, val, 0);
2113                 break;
2114
2115         case WI_RID_PROCFRAME:          /* ignore for compatibility */
2116                 break;
2117
2118         case WI_RID_OWN_SSID:
2119                 if (le16toh(wreq.wi_val[0]) * 2 > len ||
2120                     le16toh(wreq.wi_val[0]) > IEEE80211_NWID_LEN) {
2121                         error = ENOSPC;
2122                         break;
2123                 }
2124                 memset(ic->ic_des_essid, 0, IEEE80211_NWID_LEN);
2125                 ic->ic_des_esslen = le16toh(wreq.wi_val[0]) * 2;
2126                 memcpy(ic->ic_des_essid, &wreq.wi_val[1], ic->ic_des_esslen);
2127                 error = ENETRESET;
2128                 break;
2129
2130         default:
2131                 if (sc->sc_enabled) {
2132                         error = wi_write_rid(sc, wreq.wi_type, wreq.wi_val,
2133                             len);
2134                         if (error)
2135                                 break;
2136                 }
2137                 error = ieee80211_cfgset(ifp, cmd, data);
2138                 break;
2139         }
2140         return error;
2141 }
2142
2143 static int
2144 wi_write_txrate(struct wi_softc *sc)
2145 {
2146         struct ieee80211com *ic = &sc->sc_ic;
2147         int i;
2148         u_int16_t rate;
2149
2150         if (ic->ic_fixed_rate < 0)
2151                 rate = 0;       /* auto */
2152         else
2153                 rate = (ic->ic_sup_rates[IEEE80211_MODE_11B].rs_rates[ic->ic_fixed_rate] &
2154                     IEEE80211_RATE_VAL) / 2;
2155
2156         /* rate: 0, 1, 2, 5, 11 */
2157
2158         switch (sc->sc_firmware_type) {
2159         case WI_LUCENT:
2160                 switch (rate) {
2161                 case 0:                 /* auto == 11mbps auto */
2162                         rate = 3;
2163                         break;
2164                 /* case 1, 2 map to 1, 2*/
2165                 case 5:                 /* 5.5Mbps -> 4 */
2166                         rate = 4;
2167                         break;
2168                 case 11:                /* 11mbps -> 5 */
2169                         rate = 5;
2170                         break;
2171                 default:
2172                         break;
2173                 }
2174                 break;
2175         default:
2176                 /* Choose a bit according to this table.
2177                  *
2178                  * bit | data rate
2179                  * ----+-------------------
2180                  * 0   | 1Mbps
2181                  * 1   | 2Mbps
2182                  * 2   | 5.5Mbps
2183                  * 3   | 11Mbps
2184                  */
2185                 for (i = 8; i > 0; i >>= 1) {
2186                         if (rate >= i)
2187                                 break;
2188                 }
2189                 if (i == 0)
2190                         rate = 0xf;     /* auto */
2191                 else
2192                         rate = i;
2193                 break;
2194         }
2195         return wi_write_val(sc, WI_RID_TX_RATE, rate);
2196 }
2197
2198 static int
2199 wi_write_wep(struct wi_softc *sc)
2200 {
2201         struct ieee80211com *ic = &sc->sc_ic;
2202         int error = 0;
2203         int i, keylen;
2204         u_int16_t val;
2205         struct wi_key wkey[IEEE80211_WEP_NKID];
2206
2207         switch (sc->sc_firmware_type) {
2208         case WI_LUCENT:
2209                 val = (ic->ic_flags & IEEE80211_F_WEPON) ? 1 : 0;
2210                 error = wi_write_val(sc, WI_RID_ENCRYPTION, val);
2211                 if (error)
2212                         break;
2213                 error = wi_write_val(sc, WI_RID_TX_CRYPT_KEY, ic->ic_wep_txkey);
2214                 if (error)
2215                         break;
2216                 memset(wkey, 0, sizeof(wkey));
2217                 for (i = 0; i < IEEE80211_WEP_NKID; i++) {
2218                         keylen = ic->ic_nw_keys[i].wk_len;
2219                         wkey[i].wi_keylen = htole16(keylen);
2220                         memcpy(wkey[i].wi_keydat, ic->ic_nw_keys[i].wk_key,
2221                             keylen);
2222                 }
2223                 error = wi_write_rid(sc, WI_RID_DEFLT_CRYPT_KEYS,
2224                     wkey, sizeof(wkey));
2225                 break;
2226
2227         case WI_INTERSIL:
2228         case WI_SYMBOL:
2229                 if (ic->ic_flags & IEEE80211_F_WEPON) {
2230                         /*
2231                          * ONLY HWB3163 EVAL-CARD Firmware version
2232                          * less than 0.8 variant2
2233                          *
2234                          *   If promiscuous mode disable, Prism2 chip
2235                          *  does not work with WEP .
2236                          * It is under investigation for details.
2237                          * (ichiro@netbsd.org)
2238                          */
2239                         if (sc->sc_firmware_type == WI_INTERSIL &&
2240                             sc->sc_sta_firmware_ver < 802 ) {
2241                                 /* firm ver < 0.8 variant 2 */
2242                                 wi_write_val(sc, WI_RID_PROMISC, 1);
2243                         }
2244                         wi_write_val(sc, WI_RID_CNFAUTHMODE,
2245                             sc->sc_cnfauthmode);
2246                         val = PRIVACY_INVOKED | EXCLUDE_UNENCRYPTED;
2247                         /*
2248                          * Encryption firmware has a bug for HostAP mode.
2249                          */
2250                         if (sc->sc_firmware_type == WI_INTERSIL &&
2251                             ic->ic_opmode == IEEE80211_M_HOSTAP)
2252                                 val |= HOST_ENCRYPT;
2253                 } else {
2254                         wi_write_val(sc, WI_RID_CNFAUTHMODE,
2255                             IEEE80211_AUTH_OPEN);
2256                         val = HOST_ENCRYPT | HOST_DECRYPT;
2257                 }
2258                 error = wi_write_val(sc, WI_RID_P2_ENCRYPTION, val);
2259                 if (error)
2260                         break;
2261                 error = wi_write_val(sc, WI_RID_P2_TX_CRYPT_KEY,
2262                     ic->ic_wep_txkey);
2263                 if (error)
2264                         break;
2265                 /*
2266                  * It seems that the firmware accept 104bit key only if
2267                  * all the keys have 104bit length.  We get the length of
2268                  * the transmit key and use it for all other keys.
2269                  * Perhaps we should use software WEP for such situation.
2270                  */
2271                 keylen = ic->ic_nw_keys[ic->ic_wep_txkey].wk_len;
2272                 if (keylen > IEEE80211_WEP_KEYLEN)
2273                         keylen = 13;    /* 104bit keys */
2274                 else
2275                         keylen = IEEE80211_WEP_KEYLEN;
2276                 for (i = 0; i < IEEE80211_WEP_NKID; i++) {
2277                         error = wi_write_rid(sc, WI_RID_P2_CRYPT_KEY0 + i,
2278                             ic->ic_nw_keys[i].wk_key, keylen);
2279                         if (error)
2280                                 break;
2281                 }
2282                 break;
2283         }
2284         return error;
2285 }
2286
2287 static int
2288 wi_cmd(struct wi_softc *sc, int cmd, int val0, int val1, int val2)
2289 {
2290         int                     i, s = 0;
2291         static volatile int count  = 0;
2292
2293         if (sc->wi_gone)
2294                 return (ENODEV);
2295
2296         if (count > 0)
2297                 panic("Hey partner, hold on there!");
2298         count++;
2299
2300         /* wait for the busy bit to clear */
2301         for (i = sc->wi_cmd_count; i > 0; i--) {        /* 500ms */
2302                 if (!(CSR_READ_2(sc, WI_COMMAND) & WI_CMD_BUSY))
2303                         break;
2304                 DELAY(1*1000);  /* 1ms */
2305         }
2306         if (i == 0) {
2307                 device_printf(sc->sc_dev, "wi_cmd: busy bit won't clear.\n" );
2308                 sc->wi_gone = 1;
2309                 count--;
2310                 return(ETIMEDOUT);
2311         }
2312
2313         CSR_WRITE_2(sc, WI_PARAM0, val0);
2314         CSR_WRITE_2(sc, WI_PARAM1, val1);
2315         CSR_WRITE_2(sc, WI_PARAM2, val2);
2316         CSR_WRITE_2(sc, WI_COMMAND, cmd);
2317
2318         if (cmd == WI_CMD_INI) {
2319                 /* XXX: should sleep here. */
2320                 DELAY(100*1000);                /* 100ms delay for init */
2321         }
2322         for (i = 0; i < WI_TIMEOUT; i++) {
2323                 /*
2324                  * Wait for 'command complete' bit to be
2325                  * set in the event status register.
2326                  */
2327                 s = CSR_READ_2(sc, WI_EVENT_STAT);
2328                 if (s & WI_EV_CMD) {
2329                         /* Ack the event and read result code. */
2330                         s = CSR_READ_2(sc, WI_STATUS);
2331                         CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_CMD);
2332                         if (s & WI_STAT_CMD_RESULT) {
2333                                 count--;
2334                                 return(EIO);
2335                         }
2336                         break;
2337                 }
2338                 DELAY(WI_DELAY);
2339         }
2340
2341         count--;
2342         if (i == WI_TIMEOUT) {
2343                 device_printf(sc->sc_dev,
2344                     "timeout in wi_cmd 0x%04x; event status 0x%04x\n", cmd, s);
2345                 if (s == 0xffff)
2346                         sc->wi_gone = 1;
2347                 return(ETIMEDOUT);
2348         }
2349         return (0);
2350 }
2351
2352 static int
2353 wi_seek_bap(struct wi_softc *sc, int id, int off)
2354 {
2355         int i, status;
2356
2357         CSR_WRITE_2(sc, WI_SEL0, id);
2358         CSR_WRITE_2(sc, WI_OFF0, off);
2359
2360         for (i = 0; ; i++) {
2361                 status = CSR_READ_2(sc, WI_OFF0);
2362                 if ((status & WI_OFF_BUSY) == 0)
2363                         break;
2364                 if (i == WI_TIMEOUT) {
2365                         device_printf(sc->sc_dev, "timeout in wi_seek to %x/%x\n",
2366                             id, off);
2367                         sc->sc_bap_off = WI_OFF_ERR;    /* invalidate */
2368                         if (status == 0xffff)
2369                                 sc->wi_gone = 1;
2370                         return ETIMEDOUT;
2371                 }
2372                 DELAY(1);
2373         }
2374         if (status & WI_OFF_ERR) {
2375                 device_printf(sc->sc_dev, "failed in wi_seek to %x/%x\n", id, off);
2376                 sc->sc_bap_off = WI_OFF_ERR;    /* invalidate */
2377                 return EIO;
2378         }
2379         sc->sc_bap_id = id;
2380         sc->sc_bap_off = off;
2381         return 0;
2382 }
2383
2384 static int
2385 wi_read_bap(struct wi_softc *sc, int id, int off, void *buf, int buflen)
2386 {
2387         u_int16_t *ptr;
2388         int i, error, cnt;
2389
2390         if (buflen == 0)
2391                 return 0;
2392         if (id != sc->sc_bap_id || off != sc->sc_bap_off) {
2393                 if ((error = wi_seek_bap(sc, id, off)) != 0)
2394                         return error;
2395         }
2396         cnt = (buflen + 1) / 2;
2397         ptr = (u_int16_t *)buf;
2398         for (i = 0; i < cnt; i++)
2399                 *ptr++ = CSR_READ_2(sc, WI_DATA0);
2400         sc->sc_bap_off += cnt * 2;
2401         return 0;
2402 }
2403
2404 static int
2405 wi_write_bap(struct wi_softc *sc, int id, int off, void *buf, int buflen)
2406 {
2407         u_int16_t *ptr;
2408         int i, error, cnt;
2409
2410         if (buflen == 0)
2411                 return 0;
2412
2413 #ifdef WI_HERMES_AUTOINC_WAR
2414   again:
2415 #endif
2416         if (id != sc->sc_bap_id || off != sc->sc_bap_off) {
2417                 if ((error = wi_seek_bap(sc, id, off)) != 0)
2418                         return error;
2419         }
2420         cnt = (buflen + 1) / 2;
2421         ptr = (u_int16_t *)buf;
2422         for (i = 0; i < cnt; i++)
2423                 CSR_WRITE_2(sc, WI_DATA0, ptr[i]);
2424         sc->sc_bap_off += cnt * 2;
2425
2426 #ifdef WI_HERMES_AUTOINC_WAR
2427         /*
2428          * According to the comments in the HCF Light code, there is a bug
2429          * in the Hermes (or possibly in certain Hermes firmware revisions)
2430          * where the chip's internal autoincrement counter gets thrown off
2431          * during data writes:  the autoincrement is missed, causing one
2432          * data word to be overwritten and subsequent words to be written to
2433          * the wrong memory locations. The end result is that we could end
2434          * up transmitting bogus frames without realizing it. The workaround
2435          * for this is to write a couple of extra guard words after the end
2436          * of the transfer, then attempt to read then back. If we fail to
2437          * locate the guard words where we expect them, we preform the
2438          * transfer over again.
2439          */
2440         if ((sc->sc_flags & WI_FLAGS_BUG_AUTOINC) && (id & 0xf000) == 0) {
2441                 CSR_WRITE_2(sc, WI_DATA0, 0x1234);
2442                 CSR_WRITE_2(sc, WI_DATA0, 0x5678);
2443                 wi_seek_bap(sc, id, sc->sc_bap_off);
2444                 sc->sc_bap_off = WI_OFF_ERR;    /* invalidate */
2445                 if (CSR_READ_2(sc, WI_DATA0) != 0x1234 ||
2446                     CSR_READ_2(sc, WI_DATA0) != 0x5678) {
2447                         device_printf(sc->sc_dev,
2448                                 "detect auto increment bug, try again\n");
2449                         goto again;
2450                 }
2451         }
2452 #endif
2453         return 0;
2454 }
2455
2456 static int
2457 wi_mwrite_bap(struct wi_softc *sc, int id, int off, struct mbuf *m0, int totlen)
2458 {
2459         int error, len;
2460         struct mbuf *m;
2461
2462         for (m = m0; m != NULL && totlen > 0; m = m->m_next) {
2463                 if (m->m_len == 0)
2464                         continue;
2465
2466                 len = min(m->m_len, totlen);
2467
2468                 if (((u_long)m->m_data) % 2 != 0 || len % 2 != 0) {
2469                         m_copydata(m, 0, totlen, (caddr_t)&sc->sc_txbuf);
2470                         return wi_write_bap(sc, id, off, (caddr_t)&sc->sc_txbuf,
2471                             totlen);
2472                 }
2473
2474                 if ((error = wi_write_bap(sc, id, off, m->m_data, len)) != 0)
2475                         return error;
2476
2477                 off += m->m_len;
2478                 totlen -= len;
2479         }
2480         return 0;
2481 }
2482
2483 static int
2484 wi_alloc_fid(struct wi_softc *sc, int len, int *idp)
2485 {
2486         int i;
2487
2488         if (wi_cmd(sc, WI_CMD_ALLOC_MEM, len, 0, 0)) {
2489                 device_printf(sc->sc_dev, "failed to allocate %d bytes on NIC\n",
2490                     len);
2491                 return ENOMEM;
2492         }
2493
2494         for (i = 0; i < WI_TIMEOUT; i++) {
2495                 if (CSR_READ_2(sc, WI_EVENT_STAT) & WI_EV_ALLOC)
2496                         break;
2497                 if (i == WI_TIMEOUT) {
2498                         device_printf(sc->sc_dev, "timeout in alloc\n");
2499                         return ETIMEDOUT;
2500                 }
2501                 DELAY(1);
2502         }
2503         *idp = CSR_READ_2(sc, WI_ALLOC_FID);
2504         CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_ALLOC);
2505         return 0;
2506 }
2507
2508 static int
2509 wi_read_rid(struct wi_softc *sc, int rid, void *buf, int *buflenp)
2510 {
2511         int error, len;
2512         u_int16_t ltbuf[2];
2513
2514         /* Tell the NIC to enter record read mode. */
2515         error = wi_cmd(sc, WI_CMD_ACCESS | WI_ACCESS_READ, rid, 0, 0);
2516         if (error)
2517                 return error;
2518
2519         error = wi_read_bap(sc, rid, 0, ltbuf, sizeof(ltbuf));
2520         if (error)
2521                 return error;
2522
2523         if (le16toh(ltbuf[1]) != rid) {
2524                 device_printf(sc->sc_dev, "record read mismatch, rid=%x, got=%x\n",
2525                     rid, le16toh(ltbuf[1]));
2526                 return EIO;
2527         }
2528         len = (le16toh(ltbuf[0]) - 1) * 2;       /* already got rid */
2529         if (*buflenp < len) {
2530                 device_printf(sc->sc_dev, "record buffer is too small, "
2531                     "rid=%x, size=%d, len=%d\n",
2532                     rid, *buflenp, len);
2533                 return ENOSPC;
2534         }
2535         *buflenp = len;
2536         return wi_read_bap(sc, rid, sizeof(ltbuf), buf, len);
2537 }
2538
2539 static int
2540 wi_write_rid(struct wi_softc *sc, int rid, void *buf, int buflen)
2541 {
2542         int error;
2543         u_int16_t ltbuf[2];
2544
2545         ltbuf[0] = htole16((buflen + 1) / 2 + 1);        /* includes rid */
2546         ltbuf[1] = htole16(rid);
2547
2548         error = wi_write_bap(sc, rid, 0, ltbuf, sizeof(ltbuf));
2549         if (error)
2550                 return error;
2551         error = wi_write_bap(sc, rid, sizeof(ltbuf), buf, buflen);
2552         if (error)
2553                 return error;
2554
2555         return wi_cmd(sc, WI_CMD_ACCESS | WI_ACCESS_WRITE, rid, 0, 0);
2556 }
2557
2558 static int
2559 wi_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
2560 {
2561         struct ifnet *ifp = &ic->ic_if;
2562         struct wi_softc *sc = ifp->if_softc;
2563         struct ieee80211_node *ni = ic->ic_bss;
2564         int buflen;
2565         u_int16_t val;
2566         struct wi_ssid ssid;
2567         u_int8_t old_bssid[IEEE80211_ADDR_LEN];
2568
2569         DPRINTF(("%s: %s -> %s\n", __func__,
2570                 ieee80211_state_name[ic->ic_state],
2571                 ieee80211_state_name[nstate]));
2572
2573         switch (nstate) {
2574         case IEEE80211_S_INIT:
2575                 ic->ic_flags &= ~IEEE80211_F_SIBSS;
2576                 sc->sc_flags &= ~WI_FLAGS_OUTRANGE;
2577                 return (*sc->sc_newstate)(ic, nstate, arg);
2578
2579         case IEEE80211_S_RUN:
2580                 sc->sc_flags &= ~WI_FLAGS_OUTRANGE;
2581                 buflen = IEEE80211_ADDR_LEN;
2582                 wi_read_rid(sc, WI_RID_CURRENT_BSSID, ni->ni_bssid, &buflen);
2583                 IEEE80211_ADDR_COPY(ni->ni_macaddr, ni->ni_bssid);
2584                 buflen = sizeof(val);
2585                 wi_read_rid(sc, WI_RID_CURRENT_CHAN, &val, &buflen);
2586                 /* XXX validate channel */
2587                 ni->ni_chan = &ic->ic_channels[le16toh(val)];
2588 #ifdef WI_RAWBPF
2589                 sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
2590                         htole16(ni->ni_chan->ic_freq);
2591                 sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
2592                         htole16(ni->ni_chan->ic_flags);
2593 #endif
2594
2595                 if (IEEE80211_ADDR_EQ(old_bssid, ni->ni_bssid))
2596                         sc->sc_false_syns++;
2597                 else
2598                         sc->sc_false_syns = 0;
2599
2600                 if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
2601                         ni->ni_esslen = ic->ic_des_esslen;
2602                         memcpy(ni->ni_essid, ic->ic_des_essid, ni->ni_esslen);
2603                         ni->ni_rates = ic->ic_sup_rates[IEEE80211_MODE_11B];
2604                         ni->ni_intval = ic->ic_lintval;
2605                         ni->ni_capinfo = IEEE80211_CAPINFO_ESS;
2606                         if (ic->ic_flags & IEEE80211_F_WEPON)
2607                                 ni->ni_capinfo |= IEEE80211_CAPINFO_PRIVACY;
2608                 } else {
2609                         /* XXX check return value */
2610                         buflen = sizeof(ssid);
2611                         wi_read_rid(sc, WI_RID_CURRENT_SSID, &ssid, &buflen);
2612                         ni->ni_esslen = le16toh(ssid.wi_len);
2613                         if (ni->ni_esslen > IEEE80211_NWID_LEN)
2614                                 ni->ni_esslen = IEEE80211_NWID_LEN;     /*XXX*/
2615                         memcpy(ni->ni_essid, ssid.wi_ssid, ni->ni_esslen);
2616                 }
2617                 break;
2618
2619         case IEEE80211_S_SCAN:
2620         case IEEE80211_S_AUTH:
2621         case IEEE80211_S_ASSOC:
2622                 break;
2623         }
2624
2625         ic->ic_state = nstate;          /* NB: skip normal ieee80211 handling */
2626         return 0;
2627 }
2628
2629 static int
2630 wi_scan_ap(struct wi_softc *sc, u_int16_t chanmask, u_int16_t txrate)
2631 {
2632         int error = 0;
2633         u_int16_t val[2];
2634
2635         if (!sc->sc_enabled)
2636                 return ENXIO;
2637         switch (sc->sc_firmware_type) {
2638         case WI_LUCENT:
2639                 (void)wi_cmd(sc, WI_CMD_INQUIRE, WI_INFO_SCAN_RESULTS, 0, 0);
2640                 break;
2641         case WI_INTERSIL:
2642                 val[0] = chanmask;      /* channel */
2643                 val[1] = txrate;        /* tx rate */
2644                 error = wi_write_rid(sc, WI_RID_SCAN_REQ, val, sizeof(val));
2645                 break;
2646         case WI_SYMBOL:
2647                 /*
2648                  * XXX only supported on 3.x ?
2649                  */
2650                 val[0] = BSCAN_BCAST | BSCAN_ONETIME;
2651                 error = wi_write_rid(sc, WI_RID_BCAST_SCAN_REQ,
2652                     val, sizeof(val[0]));
2653                 break;
2654         }
2655         if (error == 0) {
2656                 sc->sc_scan_timer = WI_SCAN_WAIT;
2657                 sc->sc_ic.ic_if.if_timer = 1;
2658                 DPRINTF(("wi_scan_ap: start scanning, "
2659                         "chamask 0x%x txrate 0x%x\n", chanmask, txrate));
2660         }
2661         return error;
2662 }
2663
2664 static void
2665 wi_scan_result(struct wi_softc *sc, int fid, int cnt)
2666 {
2667 #define N(a)    (sizeof (a) / sizeof (a[0]))
2668         int i, naps, off, szbuf;
2669         struct wi_scan_header ws_hdr;   /* Prism2 header */
2670         struct wi_scan_data_p2 ws_dat;  /* Prism2 scantable*/
2671         struct wi_apinfo *ap;
2672
2673         off = sizeof(u_int16_t) * 2;
2674         memset(&ws_hdr, 0, sizeof(ws_hdr));
2675         switch (sc->sc_firmware_type) {
2676         case WI_INTERSIL:
2677                 wi_read_bap(sc, fid, off, &ws_hdr, sizeof(ws_hdr));
2678                 off += sizeof(ws_hdr);
2679                 szbuf = sizeof(struct wi_scan_data_p2);
2680                 break;
2681         case WI_SYMBOL:
2682                 szbuf = sizeof(struct wi_scan_data_p2) + 6;
2683                 break;
2684         case WI_LUCENT:
2685                 szbuf = sizeof(struct wi_scan_data);
2686                 break;
2687         default:
2688                 device_printf(sc->sc_dev,
2689                         "wi_scan_result: unknown firmware type %u\n",
2690                         sc->sc_firmware_type);
2691                 naps = 0;
2692                 goto done;
2693         }
2694         naps = (cnt * 2 + 2 - off) / szbuf;
2695         if (naps > N(sc->sc_aps))
2696                 naps = N(sc->sc_aps);
2697         sc->sc_naps = naps;
2698         /* Read Data */
2699         ap = sc->sc_aps;
2700         memset(&ws_dat, 0, sizeof(ws_dat));
2701         for (i = 0; i < naps; i++, ap++) {
2702                 wi_read_bap(sc, fid, off, &ws_dat,
2703                     (sizeof(ws_dat) < szbuf ? sizeof(ws_dat) : szbuf));
2704                 DPRINTF2(("wi_scan_result: #%d: off %d bssid %6D\n", i, off,
2705                     ws_dat.wi_bssid, ":"));
2706                 off += szbuf;
2707                 ap->scanreason = le16toh(ws_hdr.wi_reason);
2708                 memcpy(ap->bssid, ws_dat.wi_bssid, sizeof(ap->bssid));
2709                 ap->channel = le16toh(ws_dat.wi_chid);
2710                 ap->signal  = le16toh(ws_dat.wi_signal);
2711                 ap->noise   = le16toh(ws_dat.wi_noise);
2712                 ap->quality = ap->signal - ap->noise;
2713                 ap->capinfo = le16toh(ws_dat.wi_capinfo);
2714                 ap->interval = le16toh(ws_dat.wi_interval);
2715                 ap->rate    = le16toh(ws_dat.wi_rate);
2716                 ap->namelen = le16toh(ws_dat.wi_namelen);
2717                 if (ap->namelen > sizeof(ap->name))
2718                         ap->namelen = sizeof(ap->name);
2719                 memcpy(ap->name, ws_dat.wi_name, ap->namelen);
2720         }
2721 done:
2722         /* Done scanning */
2723         sc->sc_scan_timer = 0;
2724         DPRINTF(("wi_scan_result: scan complete: ap %d\n", naps));
2725 #undef N
2726 }
2727
2728 static void
2729 wi_dump_pkt(struct wi_frame *wh, struct ieee80211_node *ni, int rssi)
2730 {
2731         ieee80211_dump_pkt((u_int8_t *) &wh->wi_whdr, sizeof(wh->wi_whdr),
2732             ni ? ni->ni_rates.rs_rates[ni->ni_txrate] & IEEE80211_RATE_VAL : -1, rssi);
2733         printf(" status 0x%x rx_tstamp1 %u rx_tstamp0 0x%u rx_silence %u\n",
2734                 le16toh(wh->wi_status), le16toh(wh->wi_rx_tstamp1),
2735                 le16toh(wh->wi_rx_tstamp0), wh->wi_rx_silence);
2736         printf(" rx_signal %u rx_rate %u rx_flow %u\n",
2737                 wh->wi_rx_signal, wh->wi_rx_rate, wh->wi_rx_flow);
2738         printf(" tx_rtry %u tx_rate %u tx_ctl 0x%x dat_len %u\n",
2739                 wh->wi_tx_rtry, wh->wi_tx_rate,
2740                 le16toh(wh->wi_tx_ctl), le16toh(wh->wi_dat_len));
2741         printf(" ehdr dst %6D src %6D type 0x%x\n",
2742                 wh->wi_ehdr.ether_dhost, ":", wh->wi_ehdr.ether_shost, ":",
2743                 wh->wi_ehdr.ether_type);
2744 }
2745
2746 int
2747 wi_alloc(device_t dev, int rid)
2748 {
2749         struct wi_softc *sc = device_get_softc(dev);
2750
2751         if (sc->wi_bus_type != WI_BUS_PCI_NATIVE) {
2752                 sc->iobase_rid = rid;
2753                 sc->iobase = bus_alloc_resource(dev, SYS_RES_IOPORT,
2754                     &sc->iobase_rid, 0, ~0, (1 << 6),
2755                     rman_make_alignment_flags(1 << 6) | RF_ACTIVE);
2756                 if (!sc->iobase) {
2757                         device_printf(dev, "No I/O space?!\n");
2758                         return (ENXIO);
2759                 }
2760
2761                 sc->wi_io_addr = rman_get_start(sc->iobase);
2762                 sc->wi_btag = rman_get_bustag(sc->iobase);
2763                 sc->wi_bhandle = rman_get_bushandle(sc->iobase);
2764         } else {
2765                 sc->mem_rid = rid;
2766                 sc->mem = bus_alloc_resource_any(dev, SYS_RES_MEMORY,
2767                     &sc->mem_rid, RF_ACTIVE);
2768
2769                 if (!sc->mem) {
2770                         device_printf(dev, "No Mem space on prism2.5?\n");
2771                         return (ENXIO);
2772                 }
2773
2774                 sc->wi_btag = rman_get_bustag(sc->mem);
2775                 sc->wi_bhandle = rman_get_bushandle(sc->mem);
2776         }
2777
2778
2779         sc->irq_rid = 0;
2780         sc->irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &sc->irq_rid,
2781             RF_ACTIVE |
2782             ((sc->wi_bus_type == WI_BUS_PCCARD) ? 0 : RF_SHAREABLE));
2783
2784         if (!sc->irq) {
2785                 wi_free(dev);
2786                 device_printf(dev, "No irq?!\n");
2787                 return (ENXIO);
2788         }
2789
2790         sc->sc_dev = dev;
2791         sc->sc_unit = device_get_unit(dev);
2792
2793         return (0);
2794 }
2795
2796 void
2797 wi_free(device_t dev)
2798 {
2799         struct wi_softc *sc = device_get_softc(dev);
2800
2801         if (sc->iobase != NULL) {
2802                 bus_release_resource(dev, SYS_RES_IOPORT, sc->iobase_rid, sc->iobase);
2803                 sc->iobase = NULL;
2804         }
2805         if (sc->irq != NULL) {
2806                 bus_release_resource(dev, SYS_RES_IRQ, sc->irq_rid, sc->irq);
2807                 sc->irq = NULL;
2808         }
2809         if (sc->mem != NULL) {
2810                 bus_release_resource(dev, SYS_RES_MEMORY, sc->mem_rid, sc->mem);
2811                 sc->mem = NULL;
2812         }
2813
2814         return;
2815 }
2816
2817 static int
2818 wi_get_debug(struct wi_softc *sc, struct wi_req *wreq)
2819 {
2820         int error = 0;
2821
2822         wreq->wi_len = 1;
2823
2824         switch (wreq->wi_type) {
2825         case WI_DEBUG_SLEEP:
2826                 wreq->wi_len++;
2827                 wreq->wi_val[0] = sc->wi_debug.wi_sleep;
2828                 break;
2829         case WI_DEBUG_DELAYSUPP:
2830                 wreq->wi_len++;
2831                 wreq->wi_val[0] = sc->wi_debug.wi_delaysupp;
2832                 break;
2833         case WI_DEBUG_TXSUPP:
2834                 wreq->wi_len++;
2835                 wreq->wi_val[0] = sc->wi_debug.wi_txsupp;
2836                 break;
2837         case WI_DEBUG_MONITOR:
2838                 wreq->wi_len++;
2839                 wreq->wi_val[0] = sc->wi_debug.wi_monitor;
2840                 break;
2841         case WI_DEBUG_LEDTEST:
2842                 wreq->wi_len += 3;
2843                 wreq->wi_val[0] = sc->wi_debug.wi_ledtest;
2844                 wreq->wi_val[1] = sc->wi_debug.wi_ledtest_param0;
2845                 wreq->wi_val[2] = sc->wi_debug.wi_ledtest_param1;
2846                 break;
2847         case WI_DEBUG_CONTTX:
2848                 wreq->wi_len += 2;
2849                 wreq->wi_val[0] = sc->wi_debug.wi_conttx;
2850                 wreq->wi_val[1] = sc->wi_debug.wi_conttx_param0;
2851                 break;
2852         case WI_DEBUG_CONTRX:
2853                 wreq->wi_len++;
2854                 wreq->wi_val[0] = sc->wi_debug.wi_contrx;
2855                 break;
2856         case WI_DEBUG_SIGSTATE:
2857                 wreq->wi_len += 2;
2858                 wreq->wi_val[0] = sc->wi_debug.wi_sigstate;
2859                 wreq->wi_val[1] = sc->wi_debug.wi_sigstate_param0;
2860                 break;
2861         case WI_DEBUG_CONFBITS:
2862                 wreq->wi_len += 2;
2863                 wreq->wi_val[0] = sc->wi_debug.wi_confbits;
2864                 wreq->wi_val[1] = sc->wi_debug.wi_confbits_param0;
2865                 break;
2866         default:
2867                 error = EIO;
2868                 break;
2869         }
2870
2871         return (error);
2872 }
2873
2874 static int
2875 wi_set_debug(struct wi_softc *sc, struct wi_req *wreq)
2876 {
2877         int error = 0;
2878         u_int16_t               cmd, param0 = 0, param1 = 0;
2879
2880         switch (wreq->wi_type) {
2881         case WI_DEBUG_RESET:
2882         case WI_DEBUG_INIT:
2883         case WI_DEBUG_CALENABLE:
2884                 break;
2885         case WI_DEBUG_SLEEP:
2886                 sc->wi_debug.wi_sleep = 1;
2887                 break;
2888         case WI_DEBUG_WAKE:
2889                 sc->wi_debug.wi_sleep = 0;
2890                 break;
2891         case WI_DEBUG_CHAN:
2892                 param0 = wreq->wi_val[0];
2893                 break;
2894         case WI_DEBUG_DELAYSUPP:
2895                 sc->wi_debug.wi_delaysupp = 1;
2896                 break;
2897         case WI_DEBUG_TXSUPP:
2898                 sc->wi_debug.wi_txsupp = 1;
2899                 break;
2900         case WI_DEBUG_MONITOR:
2901                 sc->wi_debug.wi_monitor = 1;
2902                 break;
2903         case WI_DEBUG_LEDTEST:
2904                 param0 = wreq->wi_val[0];
2905                 param1 = wreq->wi_val[1];
2906                 sc->wi_debug.wi_ledtest = 1;
2907                 sc->wi_debug.wi_ledtest_param0 = param0;
2908                 sc->wi_debug.wi_ledtest_param1 = param1;
2909                 break;
2910         case WI_DEBUG_CONTTX:
2911                 param0 = wreq->wi_val[0];
2912                 sc->wi_debug.wi_conttx = 1;
2913                 sc->wi_debug.wi_conttx_param0 = param0;
2914                 break;
2915         case WI_DEBUG_STOPTEST:
2916                 sc->wi_debug.wi_delaysupp = 0;
2917                 sc->wi_debug.wi_txsupp = 0;
2918                 sc->wi_debug.wi_monitor = 0;
2919                 sc->wi_debug.wi_ledtest = 0;
2920                 sc->wi_debug.wi_ledtest_param0 = 0;
2921                 sc->wi_debug.wi_ledtest_param1 = 0;
2922                 sc->wi_debug.wi_conttx = 0;
2923                 sc->wi_debug.wi_conttx_param0 = 0;
2924                 sc->wi_debug.wi_contrx = 0;
2925                 sc->wi_debug.wi_sigstate = 0;
2926                 sc->wi_debug.wi_sigstate_param0 = 0;
2927                 break;
2928         case WI_DEBUG_CONTRX:
2929                 sc->wi_debug.wi_contrx = 1;
2930                 break;
2931         case WI_DEBUG_SIGSTATE:
2932                 param0 = wreq->wi_val[0];
2933                 sc->wi_debug.wi_sigstate = 1;
2934                 sc->wi_debug.wi_sigstate_param0 = param0;
2935                 break;
2936         case WI_DEBUG_CONFBITS:
2937                 param0 = wreq->wi_val[0];
2938                 param1 = wreq->wi_val[1];
2939                 sc->wi_debug.wi_confbits = param0;
2940                 sc->wi_debug.wi_confbits_param0 = param1;
2941                 break;
2942         default:
2943                 error = EIO;
2944                 break;
2945         }
2946
2947         if (error)
2948                 return (error);
2949
2950         cmd = WI_CMD_DEBUG | (wreq->wi_type << 8);
2951         error = wi_cmd(sc, cmd, param0, param1, 0);
2952
2953         return (error);
2954 }
2955
2956 /*
2957  * Special routines to download firmware for Symbol CF card.
2958  * XXX: This should be modified generic into any PRISM-2 based card.
2959  */
2960
2961 #define WI_SBCF_PDIADDR         0x3100
2962
2963 /* unaligned load little endian */
2964 #define GETLE32(p)      ((p)[0] | ((p)[1]<<8) | ((p)[2]<<16) | ((p)[3]<<24))
2965 #define GETLE16(p)      ((p)[0] | ((p)[1]<<8))
2966
2967 int
2968 wi_symbol_load_firm(struct wi_softc *sc, const void *primsym, int primlen,
2969     const void *secsym, int seclen)
2970 {
2971         uint8_t ebuf[256];
2972         int i;
2973
2974         /* load primary code and run it */
2975         wi_symbol_set_hcr(sc, WI_HCR_EEHOLD);
2976         if (wi_symbol_write_firm(sc, primsym, primlen, NULL, 0))
2977                 return EIO;
2978         wi_symbol_set_hcr(sc, WI_HCR_RUN);
2979         for (i = 0; ; i++) {
2980                 if (i == 10)
2981                         return ETIMEDOUT;
2982                 tsleep(sc, 0, "wiinit", 1);
2983                 if (CSR_READ_2(sc, WI_CNTL) == WI_CNTL_AUX_ENA_STAT)
2984                         break;
2985                 /* write the magic key value to unlock aux port */
2986                 CSR_WRITE_2(sc, WI_PARAM0, WI_AUX_KEY0);
2987                 CSR_WRITE_2(sc, WI_PARAM1, WI_AUX_KEY1);
2988                 CSR_WRITE_2(sc, WI_PARAM2, WI_AUX_KEY2);
2989                 CSR_WRITE_2(sc, WI_CNTL, WI_CNTL_AUX_ENA_CNTL);
2990         }
2991
2992         /* issue read EEPROM command: XXX copied from wi_cmd() */
2993         CSR_WRITE_2(sc, WI_PARAM0, 0);
2994         CSR_WRITE_2(sc, WI_PARAM1, 0);
2995         CSR_WRITE_2(sc, WI_PARAM2, 0);
2996         CSR_WRITE_2(sc, WI_COMMAND, WI_CMD_READEE);
2997         for (i = 0; i < WI_TIMEOUT; i++) {
2998                 if (CSR_READ_2(sc, WI_EVENT_STAT) & WI_EV_CMD)
2999                         break;
3000                 DELAY(1);
3001         }
3002         CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_CMD);
3003
3004         CSR_WRITE_2(sc, WI_AUX_PAGE, WI_SBCF_PDIADDR / WI_AUX_PGSZ);
3005         CSR_WRITE_2(sc, WI_AUX_OFFSET, WI_SBCF_PDIADDR % WI_AUX_PGSZ);
3006         CSR_READ_MULTI_STREAM_2(sc, WI_AUX_DATA,
3007             (uint16_t *)ebuf, sizeof(ebuf) / 2);
3008         if (GETLE16(ebuf) > sizeof(ebuf))
3009                 return EIO;
3010         if (wi_symbol_write_firm(sc, secsym, seclen, ebuf + 4, GETLE16(ebuf)))
3011                 return EIO;
3012         return 0;
3013 }
3014
3015 static int
3016 wi_symbol_write_firm(struct wi_softc *sc, const void *buf, int buflen,
3017     const void *ebuf, int ebuflen)
3018 {
3019         const uint8_t *p, *ep, *q, *eq;
3020         char *tp;
3021         uint32_t addr, id, eid;
3022         int i, len, elen, nblk, pdrlen;
3023
3024         /*
3025          * Parse the header of the firmware image.
3026          */
3027         p = buf;
3028         ep = p + buflen;
3029         while (p < ep && *p++ != ' ');  /* FILE: */
3030         while (p < ep && *p++ != ' ');  /* filename */
3031         while (p < ep && *p++ != ' ');  /* type of the firmware */
3032         nblk = strtoul(p, &tp, 10);
3033         p = tp;
3034         pdrlen = strtoul(p + 1, &tp, 10);
3035         p = tp;
3036         while (p < ep && *p++ != 0x1a); /* skip rest of header */
3037
3038         /*
3039          * Block records: address[4], length[2], data[length];
3040          */
3041         for (i = 0; i < nblk; i++) {
3042                 addr = GETLE32(p);      p += 4;
3043                 len  = GETLE16(p);      p += 2;
3044                 CSR_WRITE_2(sc, WI_AUX_PAGE, addr / WI_AUX_PGSZ);
3045                 CSR_WRITE_2(sc, WI_AUX_OFFSET, addr % WI_AUX_PGSZ);
3046                 CSR_WRITE_MULTI_STREAM_2(sc, WI_AUX_DATA,
3047                     (const uint16_t *)p, len / 2);
3048                 p += len;
3049         }
3050
3051         /*
3052          * PDR: id[4], address[4], length[4];
3053          */
3054         for (i = 0; i < pdrlen; ) {
3055                 id   = GETLE32(p);      p += 4; i += 4;
3056                 addr = GETLE32(p);      p += 4; i += 4;
3057                 len  = GETLE32(p);      p += 4; i += 4;
3058                 /* replace PDR entry with the values from EEPROM, if any */
3059                 for (q = ebuf, eq = q + ebuflen; q < eq; q += elen * 2) {
3060                         elen = GETLE16(q);      q += 2;
3061                         eid  = GETLE16(q);      q += 2;
3062                         elen--;         /* elen includes eid */
3063                         if (eid == 0)
3064                                 break;
3065                         if (eid != id)
3066                                 continue;
3067                         CSR_WRITE_2(sc, WI_AUX_PAGE, addr / WI_AUX_PGSZ);
3068                         CSR_WRITE_2(sc, WI_AUX_OFFSET, addr % WI_AUX_PGSZ);
3069                         CSR_WRITE_MULTI_STREAM_2(sc, WI_AUX_DATA,
3070                             (const uint16_t *)q, len / 2);
3071                         break;
3072                 }
3073         }
3074         return 0;
3075 }
3076
3077 static int
3078 wi_symbol_set_hcr(struct wi_softc *sc, int mode)
3079 {
3080         uint16_t hcr;
3081
3082         CSR_WRITE_2(sc, WI_COR, WI_COR_RESET);
3083         tsleep(sc, 0, "wiinit", 1);
3084         hcr = CSR_READ_2(sc, WI_HCR);
3085         hcr = (hcr & WI_HCR_4WIRE) | (mode & ~WI_HCR_4WIRE);
3086         CSR_WRITE_2(sc, WI_HCR, hcr);
3087         tsleep(sc, 0, "wiinit", 1);
3088         CSR_WRITE_2(sc, WI_COR, WI_COR_IOMODE);
3089         tsleep(sc, 0, "wiinit", 1);
3090         return 0;
3091 }