sys/dev/netif/owi/if_owi.c

   1 /*
   2  * Copyright (c) 1997, 1998, 1999
   3  *      Bill Paul <wpaul@ctr.columbia.edu>.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  * 3. All advertising materials mentioning features or use of this software
  14  *    must display the following acknowledgement:
  15  *      This product includes software developed by Bill Paul.
  16  * 4. Neither the name of the author nor the names of any co-contributors
  17  *    may be used to endorse or promote products derived from this software
  18  *    without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
  21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
  24  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  30  * THE POSSIBILITY OF SUCH DAMAGE.
  31  *
  32  * $FreeBSD: src/sys/dev/wi/if_wi.c,v 1.103.2.2 2002/08/02 07:11:34 imp Exp $
  33  * $DragonFly: src/sys/dev/netif/owi/Attic/if_owi.c,v 1.3 2005/01/23 20:21:31 joerg Exp $
  34  */
  35
  36 /*
  37  * Lucent WaveLAN/IEEE 802.11 PCMCIA driver for FreeBSD.
  38  *
  39  * Written by Bill Paul <wpaul@ctr.columbia.edu>
  40  * Electrical Engineering Department
  41  * Columbia University, New York City
  42  */
  43
  44 /*
  45  * The WaveLAN/IEEE adapter is the second generation of the WaveLAN
  46  * from Lucent. Unlike the older cards, the new ones are programmed
  47  * entirely via a firmware-driven controller called the Hermes.
  48  * Unfortunately, Lucent will not release the Hermes programming manual
  49  * without an NDA (if at all). What they do release is an API library
  50  * called the HCF (Hardware Control Functions) which is supposed to
  51  * do the device-specific operations of a device driver for you. The
  52  * publically available version of the HCF library (the 'HCF Light') is
  53  * a) extremely gross, b) lacks certain features, particularly support
  54  * for 802.11 frames, and c) is contaminated by the GNU Public License.
  55  *
  56  * This driver does not use the HCF or HCF Light at all. Instead, it
  57  * programs the Hermes controller directly, using information gleaned
  58  * from the HCF Light code and corresponding documentation.
  59  *
  60  * This driver supports the ISA, PCMCIA and PCI versions of the Lucent
  61  * WaveLan cards (based on the Hermes chipset), as well as the newer
  62  * Prism 2 chipsets with firmware from Intersil and Symbol.
  63  */
  64
  65 #include <sys/param.h>
  66 #include <sys/systm.h>
  67 #if defined(__FreeBSD__) && __FreeBSD_version >= 500033
  68 #include <sys/endian.h>
  69 #endif
  70 #include <sys/sockio.h>
  71 #include <sys/mbuf.h>
  72 #include <sys/proc.h>
  73 #include <sys/kernel.h>
  74 #include <sys/socket.h>
  75 #include <sys/module.h>
  76 #include <sys/bus.h>
  77 #include <sys/random.h>
  78 #include <sys/syslog.h>
  79 #include <sys/sysctl.h>
  80
  81 #include <machine/bus.h>
  82 #include <machine/resource.h>
  83 #include <machine/clock.h>
  84 #include <sys/rman.h>
  85
  86 #include <net/if.h>
  87 #include <net/if_arp.h>
  88 #include <net/ethernet.h>
  89 #include <net/if_dl.h>
  90 #include <net/if_media.h>
  91 #include <net/if_types.h>
  92 #include <netproto/802_11/ieee80211.h>
  93 #include <netproto/802_11/ieee80211_ioctl.h>
  94 #include <netproto/802_11/if_wavelan_ieee.h>
  95
  96 #include <netinet/in.h>
  97 #include <netinet/in_systm.h>
  98 #include <netinet/in_var.h>
  99 #include <netinet/ip.h>
 100 #include <netinet/if_ether.h>
 101
 102 #include <net/bpf.h>
 103
 104 #include "wi_hostap.h"
 105 #include "if_wivar.h"
 106 #include "if_wireg.h"
 107
 108 #define WI_CMD_DEBUG            0x0038 /* prism2 debug */
 109
 110 static void wi_intr(void *);
 111 static void wi_reset(struct wi_softc *);
 112 static int wi_ioctl(struct ifnet *, u_long, caddr_t, struct ucred *);
 113 static void wi_init(void *);
 114 static void wi_start(struct ifnet *);
 115 static void wi_stop(struct wi_softc *);
 116 static void wi_watchdog(struct ifnet *);
 117 static void wi_rxeof(struct wi_softc *);
 118 static void wi_txeof(struct wi_softc *, int);
 119 static void wi_update_stats(struct wi_softc *);
 120 static void wi_setmulti(struct wi_softc *);
 121
 122 static int wi_cmd(struct wi_softc *, int, int, int, int);
 123 static int wi_read_record(struct wi_softc *, struct wi_ltv_gen *);
 124 static int wi_write_record(struct wi_softc *, struct wi_ltv_gen *);
 125 static int wi_read_data(struct wi_softc *, int, int, caddr_t, int);
 126 static int wi_write_data(struct wi_softc *, int, int, caddr_t, int);
 127 static int wi_seek(struct wi_softc *, int, int, int);
 128 static int wi_alloc_nicmem(struct wi_softc *, int, int *);
 129 static void wi_inquire(void *);
 130 static void wi_setdef(struct wi_softc *, struct wi_req *);
 131
 132 #ifdef WICACHE
 133 static
 134 void wi_cache_store(struct wi_softc *, struct mbuf *, unsigned short);
 135 #endif
 136
 137 static int wi_get_cur_ssid(struct wi_softc *, char *, int *);
 138 static void wi_get_id(struct wi_softc *);
 139 static int wi_media_change(struct ifnet *);
 140 static void wi_media_status(struct ifnet *, struct ifmediareq *);
 141
 142 static int wi_get_debug(struct wi_softc *, struct wi_req *);
 143 static int wi_set_debug(struct wi_softc *, struct wi_req *);
 144
 145 DECLARE_DUMMY_MODULE(if_wi);
 146
 147 devclass_t owi_devclass;
 148
 149 static struct wi_card_ident wi_card_ident[] = {
 150         /* CARD_ID                      CARD_NAME               FIRM_TYPE */
 151         { WI_NIC_LUCENT_ID,             WI_NIC_LUCENT_STR,      WI_LUCENT },
 152         { WI_NIC_SONY_ID,               WI_NIC_SONY_STR,        WI_LUCENT },
 153         { WI_NIC_LUCENT_EMB_ID,         WI_NIC_LUCENT_EMB_STR,  WI_LUCENT },
 154         { WI_NIC_EVB2_ID,               WI_NIC_EVB2_STR,        WI_INTERSIL },
 155         { WI_NIC_HWB3763_ID,            WI_NIC_HWB3763_STR,     WI_INTERSIL },
 156         { WI_NIC_HWB3163_ID,            WI_NIC_HWB3163_STR,     WI_INTERSIL },
 157         { WI_NIC_HWB3163B_ID,           WI_NIC_HWB3163B_STR,    WI_INTERSIL },
 158         { WI_NIC_EVB3_ID,               WI_NIC_EVB3_STR,        WI_INTERSIL },
 159         { WI_NIC_HWB1153_ID,            WI_NIC_HWB1153_STR,     WI_INTERSIL },
 160         { WI_NIC_P2_SST_ID,             WI_NIC_P2_SST_STR,      WI_INTERSIL },
 161         { WI_NIC_EVB2_SST_ID,           WI_NIC_EVB2_SST_STR,    WI_INTERSIL },
 162         { WI_NIC_3842_EVA_ID,           WI_NIC_3842_EVA_STR,    WI_INTERSIL },
 163         { WI_NIC_3842_PCMCIA_AMD_ID,    WI_NIC_3842_PCMCIA_STR, WI_INTERSIL },
 164         { WI_NIC_3842_PCMCIA_SST_ID,    WI_NIC_3842_PCMCIA_STR, WI_INTERSIL },
 165         { WI_NIC_3842_PCMCIA_ATM_ID,    WI_NIC_3842_PCMCIA_STR, WI_INTERSIL },
 166         { WI_NIC_3842_MINI_AMD_ID,      WI_NIC_3842_MINI_STR,   WI_INTERSIL },
 167         { WI_NIC_3842_MINI_SST_ID,      WI_NIC_3842_MINI_STR,   WI_INTERSIL },
 168         { WI_NIC_3842_MINI_ATM_ID,      WI_NIC_3842_MINI_STR,   WI_INTERSIL },
 169         { WI_NIC_3842_PCI_AMD_ID,       WI_NIC_3842_PCI_STR,    WI_INTERSIL },
 170         { WI_NIC_3842_PCI_SST_ID,       WI_NIC_3842_PCI_STR,    WI_INTERSIL },
 171         { WI_NIC_3842_PCI_ATM_ID,       WI_NIC_3842_PCI_STR,    WI_INTERSIL },
 172         { WI_NIC_P3_PCMCIA_AMD_ID,      WI_NIC_P3_PCMCIA_STR,   WI_INTERSIL },
 173         { WI_NIC_P3_PCMCIA_SST_ID,      WI_NIC_P3_PCMCIA_STR,   WI_INTERSIL },
 174         { WI_NIC_P3_MINI_AMD_ID,        WI_NIC_P3_MINI_STR,     WI_INTERSIL },
 175         { WI_NIC_P3_MINI_SST_ID,        WI_NIC_P3_MINI_STR,     WI_INTERSIL },
 176         { 0,    NULL,   0 },
 177 };
 178
 179 int
 180 owi_generic_detach(dev)
 181         device_t                dev;
 182 {
 183         struct wi_softc         *sc;
 184         struct ifnet            *ifp;
 185         int                     s;
 186
 187         sc = device_get_softc(dev);
 188         WI_LOCK(sc, s);
 189         ifp = &sc->arpcom.ac_if;
 190
 191         if (sc->wi_gone) {
 192                 device_printf(dev, "already unloaded\n");
 193                 WI_UNLOCK(sc, s);
 194                 return(ENODEV);
 195         }
 196
 197         wi_stop(sc);
 198
 199         /* Delete all remaining media. */
 200         ifmedia_removeall(&sc->ifmedia);
 201
 202         ether_ifdetach(ifp);
 203         bus_teardown_intr(dev, sc->irq, sc->wi_intrhand);
 204         owi_free(dev);
 205         sc->wi_gone = 1;
 206
 207         WI_UNLOCK(sc, s);
 208 #if defined(__FreeBSD__) && __FreeBSD_version >= 500000
 209         mtx_destroy(&sc->wi_mtx);
 210 #endif
 211
 212         return(0);
 213 }
 214
 215 int
 216 owi_generic_attach(device_t dev)
 217 {
 218         struct wi_softc         *sc;
 219         struct wi_ltv_macaddr   mac;
 220         struct wi_ltv_gen       gen;
 221         struct ifnet            *ifp;
 222         int                     error;
 223         int                     s;
 224
 225         /* XXX maybe we need the splimp stuff here XXX */
 226         sc = device_get_softc(dev);
 227         ifp = &sc->arpcom.ac_if;
 228         callout_init(&sc->wi_stat_timer);
 229
 230         error = bus_setup_intr(dev, sc->irq, INTR_TYPE_NET,
 231             wi_intr, sc, &sc->wi_intrhand);
 232
 233         if (error) {
 234                 device_printf(dev, "bus_setup_intr() failed! (%d)\n", error);
 235                 owi_free(dev);
 236                 return (error);
 237         }
 238
 239 #if defined(__FreeBSD__) && __FreeBSD_version >= 500000
 240         mtx_init(&sc->wi_mtx, device_get_nameunit(dev), MTX_NETWORK_LOCK,
 241             MTX_DEF | MTX_RECURSE);
 242 #endif
 243         WI_LOCK(sc, s);
 244
 245         /* Reset the NIC. */
 246         wi_reset(sc);
 247
 248         /*
 249          * Read the station address.
 250          * And do it twice. I've seen PRISM-based cards that return
 251          * an error when trying to read it the first time, which causes
 252          * the probe to fail.
 253          */
 254         mac.wi_type = WI_RID_MAC_NODE;
 255         mac.wi_len = 4;
 256         wi_read_record(sc, (struct wi_ltv_gen *)&mac);
 257         if ((error = wi_read_record(sc, (struct wi_ltv_gen *)&mac)) != 0) {
 258                 device_printf(dev, "mac read failed %d\n", error);
 259                 owi_free(dev);
 260                 WI_UNLOCK(sc, s);
 261                 return (error);
 262         }
 263         bcopy((char *)&mac.wi_mac_addr,
 264            (char *)&sc->arpcom.ac_enaddr, ETHER_ADDR_LEN);
 265
 266         wi_get_id(sc);
 267
 268         ifp->if_softc = sc;
 269         if_initname(ifp, "wi", sc->wi_unit);
 270         ifp->if_mtu = ETHERMTU;
 271         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
 272         ifp->if_ioctl = wi_ioctl;
 273         ifp->if_start = wi_start;
 274         ifp->if_watchdog = wi_watchdog;
 275         ifp->if_init = wi_init;
 276         ifp->if_baudrate = 10000000;
 277         ifp->if_snd.ifq_maxlen = IFQ_MAXLEN;
 278
 279         bzero(sc->wi_node_name, sizeof(sc->wi_node_name));
 280         bcopy(WI_DEFAULT_NODENAME, sc->wi_node_name,
 281             sizeof(WI_DEFAULT_NODENAME) - 1);
 282
 283         bzero(sc->wi_net_name, sizeof(sc->wi_net_name));
 284         bcopy(WI_DEFAULT_NETNAME, sc->wi_net_name,
 285             sizeof(WI_DEFAULT_NETNAME) - 1);
 286
 287         bzero(sc->wi_ibss_name, sizeof(sc->wi_ibss_name));
 288         bcopy(WI_DEFAULT_IBSS, sc->wi_ibss_name,
 289             sizeof(WI_DEFAULT_IBSS) - 1);
 290
 291         sc->wi_portnum = WI_DEFAULT_PORT;
 292         sc->wi_ptype = WI_PORTTYPE_BSS;
 293         sc->wi_ap_density = WI_DEFAULT_AP_DENSITY;
 294         sc->wi_rts_thresh = WI_DEFAULT_RTS_THRESH;
 295         sc->wi_tx_rate = WI_DEFAULT_TX_RATE;
 296         sc->wi_max_data_len = WI_DEFAULT_DATALEN;
 297         sc->wi_create_ibss = WI_DEFAULT_CREATE_IBSS;
 298         sc->wi_pm_enabled = WI_DEFAULT_PM_ENABLED;
 299         sc->wi_max_sleep = WI_DEFAULT_MAX_SLEEP;
 300         sc->wi_roaming = WI_DEFAULT_ROAMING;
 301         sc->wi_authtype = WI_DEFAULT_AUTHTYPE;
 302         sc->wi_authmode = IEEE80211_AUTH_OPEN;
 303
 304         /*
 305          * Read the default channel from the NIC. This may vary
 306          * depending on the country where the NIC was purchased, so
 307          * we can't hard-code a default and expect it to work for
 308          * everyone.
 309          */
 310         gen.wi_type = WI_RID_OWN_CHNL;
 311         gen.wi_len = 2;
 312         wi_read_record(sc, &gen);
 313         sc->wi_channel = gen.wi_val;
 314
 315         /*
 316          * Set flags based on firmware version.
 317          */
 318         switch (sc->sc_firmware_type) {
 319         case WI_LUCENT:
 320                 sc->wi_flags |= WI_FLAGS_HAS_ROAMING;
 321                 if (sc->sc_sta_firmware_ver >= 60000)
 322                         sc->wi_flags |= WI_FLAGS_HAS_MOR;
 323                 if (sc->sc_sta_firmware_ver >= 60006) {
 324                         sc->wi_flags |= WI_FLAGS_HAS_IBSS;
 325                         sc->wi_flags |= WI_FLAGS_HAS_CREATE_IBSS;
 326                 }
 327                 sc->wi_ibss_port = htole16(1);
 328                 break;
 329         case WI_INTERSIL:
 330                 sc->wi_flags |= WI_FLAGS_HAS_ROAMING;
 331                 if (sc->sc_sta_firmware_ver >= 800) {
 332                         sc->wi_flags |= WI_FLAGS_HAS_IBSS;
 333                         sc->wi_flags |= WI_FLAGS_HAS_CREATE_IBSS;
 334                 }
 335                 /*
 336                  * version 0.8.3 and newer are the only ones that are known
 337                  * to currently work.  Earlier versions can be made to work,
 338                  * at least according to the Linux driver.
 339                  */
 340                 if (sc->sc_sta_firmware_ver >= 803)
 341                         sc->wi_flags |= WI_FLAGS_HAS_HOSTAP;
 342                 sc->wi_ibss_port = htole16(0);
 343                 break;
 344         case WI_SYMBOL:
 345                 sc->wi_flags |= WI_FLAGS_HAS_DIVERSITY;
 346                 if (sc->sc_sta_firmware_ver >= 20000)
 347                         sc->wi_flags |= WI_FLAGS_HAS_IBSS;
 348                 /* Older Symbol firmware does not support IBSS creation. */
 349                 if (sc->sc_sta_firmware_ver >= 25000)
 350                         sc->wi_flags |= WI_FLAGS_HAS_CREATE_IBSS;
 351                 sc->wi_ibss_port = htole16(4);
 352                 break;
 353         }
 354
 355         /*
 356          * Find out if we support WEP on this card.
 357          */
 358         gen.wi_type = WI_RID_WEP_AVAIL;
 359         gen.wi_len = 2;
 360         wi_read_record(sc, &gen);
 361         sc->wi_has_wep = gen.wi_val;
 362
 363         if (bootverbose)
 364                 device_printf(sc->dev, "wi_has_wep = %d\n", sc->wi_has_wep);
 365
 366         /*
 367          * Find supported rates.
 368          */
 369         gen.wi_type = WI_RID_DATA_RATES;
 370         gen.wi_len = 2;
 371         if (wi_read_record(sc, &gen))
 372                 sc->wi_supprates = WI_SUPPRATES_1M | WI_SUPPRATES_2M |
 373                     WI_SUPPRATES_5M | WI_SUPPRATES_11M;
 374         else
 375                 sc->wi_supprates = gen.wi_val;
 376
 377         bzero((char *)&sc->wi_stats, sizeof(sc->wi_stats));
 378
 379         wi_init(sc);
 380         wi_stop(sc);
 381
 382         ifmedia_init(&sc->ifmedia, 0, wi_media_change, wi_media_status);
 383 #define ADD(m, c)       ifmedia_add(&sc->ifmedia, (m), (c), NULL)
 384         if (sc->wi_supprates & WI_SUPPRATES_1M) {
 385                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1, 0, 0), 0);
 386                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1,
 387                     IFM_IEEE80211_ADHOC, 0), 0);
 388                 if (sc->wi_flags & WI_FLAGS_HAS_IBSS)
 389                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1,
 390                             IFM_IEEE80211_IBSS, 0), 0);
 391                 if (sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS)
 392                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1,
 393                             IFM_IEEE80211_IBSSMASTER, 0), 0);
 394                 if (sc->wi_flags & WI_FLAGS_HAS_HOSTAP)
 395                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1,
 396                             IFM_IEEE80211_HOSTAP, 0), 0);
 397         }
 398         if (sc->wi_supprates & WI_SUPPRATES_2M) {
 399                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2, 0, 0), 0);
 400                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2,
 401                     IFM_IEEE80211_ADHOC, 0), 0);
 402                 if (sc->wi_flags & WI_FLAGS_HAS_IBSS)
 403                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2,
 404                             IFM_IEEE80211_IBSS, 0), 0);
 405                 if (sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS)
 406                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2,
 407                             IFM_IEEE80211_IBSSMASTER, 0), 0);
 408                 if (sc->wi_flags & WI_FLAGS_HAS_HOSTAP)
 409                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2,
 410                             IFM_IEEE80211_HOSTAP, 0), 0);
 411         }
 412         if (sc->wi_supprates & WI_SUPPRATES_5M) {
 413                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5, 0, 0), 0);
 414                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5,
 415                     IFM_IEEE80211_ADHOC, 0), 0);
 416                 if (sc->wi_flags & WI_FLAGS_HAS_IBSS)
 417                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5,
 418                             IFM_IEEE80211_IBSS, 0), 0);
 419                 if (sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS)
 420                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5,
 421                             IFM_IEEE80211_IBSSMASTER, 0), 0);
 422                 if (sc->wi_flags & WI_FLAGS_HAS_HOSTAP)
 423                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5,
 424                             IFM_IEEE80211_HOSTAP, 0), 0);
 425         }
 426         if (sc->wi_supprates & WI_SUPPRATES_11M) {
 427                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11, 0, 0), 0);
 428                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11,
 429                     IFM_IEEE80211_ADHOC, 0), 0);
 430                 if (sc->wi_flags & WI_FLAGS_HAS_IBSS)
 431                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11,
 432                             IFM_IEEE80211_IBSS, 0), 0);
 433                 if (sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS)
 434                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11,
 435                             IFM_IEEE80211_IBSSMASTER, 0), 0);
 436                 if (sc->wi_flags & WI_FLAGS_HAS_HOSTAP)
 437                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11,
 438                             IFM_IEEE80211_HOSTAP, 0), 0);
 439                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_MANUAL, 0, 0), 0);
 440         }
 441         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO, IFM_IEEE80211_ADHOC, 0), 0);
 442         if (sc->wi_flags & WI_FLAGS_HAS_IBSS)
 443                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO, IFM_IEEE80211_IBSS,
 444                     0), 0);
 445         if (sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS)
 446                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO,
 447                     IFM_IEEE80211_IBSSMASTER, 0), 0);
 448         if (sc->wi_flags & WI_FLAGS_HAS_HOSTAP)
 449                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO,
 450                     IFM_IEEE80211_HOSTAP, 0), 0);
 451         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO, 0, 0), 0);
 452 #undef ADD
 453         ifmedia_set(&sc->ifmedia, IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO, 0, 0));
 454
 455         /*
 456          * Call MI attach routine.
 457          */
 458         ether_ifattach(ifp, sc->arpcom.ac_enaddr);
 459         WI_UNLOCK(sc, s);
 460
 461         return(0);
 462 }
 463
 464 static void
 465 wi_get_id(sc)
 466         struct wi_softc *sc;
 467 {
 468         struct wi_ltv_ver       ver;
 469         struct wi_card_ident    *id;
 470
 471         /* getting chip identity */
 472         memset(&ver, 0, sizeof(ver));
 473         ver.wi_type = WI_RID_CARD_ID;
 474         ver.wi_len = 5;
 475         wi_read_record(sc, (struct wi_ltv_gen *)&ver);
 476         device_printf(sc->dev, "using ");
 477         sc->sc_firmware_type = WI_NOTYPE;
 478         for (id = wi_card_ident; id->card_name != NULL; id++) {
 479                 if (le16toh(ver.wi_ver[0]) == id->card_id) {
 480                         printf("%s", id->card_name);
 481                         sc->sc_firmware_type = id->firm_type;
 482                         break;
 483                 }
 484         }
 485         if (sc->sc_firmware_type == WI_NOTYPE) {
 486                 if (le16toh(ver.wi_ver[0]) & 0x8000) {
 487                         printf("Unknown PRISM2 chip");
 488                         sc->sc_firmware_type = WI_INTERSIL;
 489                 } else {
 490                         printf("Unknown Lucent chip");
 491                         sc->sc_firmware_type = WI_LUCENT;
 492                 }
 493         }
 494
 495         if (sc->sc_firmware_type != WI_LUCENT) {
 496                 /* get primary firmware version */
 497                 memset(&ver, 0, sizeof(ver));
 498                 ver.wi_type = WI_RID_PRI_IDENTITY;
 499                 ver.wi_len = 5;
 500                 wi_read_record(sc, (struct wi_ltv_gen *)&ver);
 501                 ver.wi_ver[1] = le16toh(ver.wi_ver[1]);
 502                 ver.wi_ver[2] = le16toh(ver.wi_ver[2]);
 503                 ver.wi_ver[3] = le16toh(ver.wi_ver[3]);
 504                 sc->sc_pri_firmware_ver = ver.wi_ver[2] * 10000 +
 505                     ver.wi_ver[3] * 100 + ver.wi_ver[1];
 506         }
 507
 508         /* get station firmware version */
 509         memset(&ver, 0, sizeof(ver));
 510         ver.wi_type = WI_RID_STA_IDENTITY;
 511         ver.wi_len = 5;
 512         wi_read_record(sc, (struct wi_ltv_gen *)&ver);
 513         ver.wi_ver[1] = le16toh(ver.wi_ver[1]);
 514         ver.wi_ver[2] = le16toh(ver.wi_ver[2]);
 515         ver.wi_ver[3] = le16toh(ver.wi_ver[3]);
 516         sc->sc_sta_firmware_ver = ver.wi_ver[2] * 10000 +
 517             ver.wi_ver[3] * 100 + ver.wi_ver[1];
 518         if (sc->sc_firmware_type == WI_INTERSIL &&
 519             (sc->sc_sta_firmware_ver == 10102 ||
 520              sc->sc_sta_firmware_ver == 20102)) {
 521                 struct wi_ltv_str sver;
 522                 char *p;
 523
 524                 memset(&sver, 0, sizeof(sver));
 525                 sver.wi_type = WI_RID_SYMBOL_IDENTITY;
 526                 sver.wi_len = 7;
 527                 /* value should be the format like "V2.00-11" */
 528                 if (wi_read_record(sc, (struct wi_ltv_gen *)&sver) == 0 &&
 529                     *(p = (char *)sver.wi_str) >= 'A' &&
 530                     p[2] == '.' && p[5] == '-' && p[8] == '\0') {
 531                         sc->sc_firmware_type = WI_SYMBOL;
 532                         sc->sc_sta_firmware_ver = (p[1] - '0') * 10000 +
 533                             (p[3] - '0') * 1000 + (p[4] - '0') * 100 +
 534                             (p[6] - '0') * 10 + (p[7] - '0');
 535                 }
 536         }
 537         printf("\n");
 538         device_printf(sc->dev, "%s Firmware: ",
 539              sc->sc_firmware_type == WI_LUCENT ? "Lucent" :
 540             (sc->sc_firmware_type == WI_SYMBOL ? "Symbol" : "Intersil"));
 541
 542         /*
 543          * The primary firmware is only valid on Prism based chipsets
 544          * (INTERSIL or SYMBOL).
 545          */
 546         if (sc->sc_firmware_type != WI_LUCENT)
 547             printf("Primary %u.%02u.%02u, ", sc->sc_pri_firmware_ver / 10000,
 548                     (sc->sc_pri_firmware_ver % 10000) / 100,
 549                     sc->sc_pri_firmware_ver % 100);
 550         printf("Station %u.%02u.%02u\n",
 551             sc->sc_sta_firmware_ver / 10000, (sc->sc_sta_firmware_ver % 10000) / 100,
 552             sc->sc_sta_firmware_ver % 100);
 553         return;
 554 }
 555
 556 static void
 557 wi_rxeof(sc)
 558         struct wi_softc         *sc;
 559 {
 560         struct ifnet            *ifp;
 561         struct ether_header     *eh;
 562         struct mbuf             *m;
 563         int                     id;
 564
 565         ifp = &sc->arpcom.ac_if;
 566
 567         id = CSR_READ_2(sc, WI_RX_FID);
 568
 569         /*
 570          * if we have the procframe flag set, disregard all this and just
 571          * read the data from the device.
 572          */
 573         if (sc->wi_procframe || sc->wi_debug.wi_monitor) {
 574                 struct wi_frame         *rx_frame;
 575                 int                     datlen, hdrlen;
 576
 577                 /* first allocate mbuf for packet storage */
 578                 MGETHDR(m, MB_DONTWAIT, MT_DATA);
 579                 if (m == NULL) {
 580                         ifp->if_ierrors++;
 581                         return;
 582                 }
 583                 MCLGET(m, MB_DONTWAIT);
 584                 if (!(m->m_flags & M_EXT)) {
 585                         m_freem(m);
 586                         ifp->if_ierrors++;
 587                         return;
 588                 }
 589
 590                 m->m_pkthdr.rcvif = ifp;
 591
 592                 /* now read wi_frame first so we know how much data to read */
 593                 if (wi_read_data(sc, id, 0, mtod(m, caddr_t),
 594                     sizeof(struct wi_frame))) {
 595                         m_freem(m);
 596                         ifp->if_ierrors++;
 597                         return;
 598                 }
 599
 600                 rx_frame = mtod(m, struct wi_frame *);
 601
 602                 switch ((rx_frame->wi_status & WI_STAT_MAC_PORT) >> 8) {
 603                 case 7:
 604                         switch (rx_frame->wi_frame_ctl & WI_FCTL_FTYPE) {
 605                         case WI_FTYPE_DATA:
 606                                 hdrlen = WI_DATA_HDRLEN;
 607                                 datlen = rx_frame->wi_dat_len + WI_FCS_LEN;
 608                                 break;
 609                         case WI_FTYPE_MGMT:
 610                                 hdrlen = WI_MGMT_HDRLEN;
 611                                 datlen = rx_frame->wi_dat_len + WI_FCS_LEN;
 612                                 break;
 613                         case WI_FTYPE_CTL:
 614                                 /*
 615                                  * prism2 cards don't pass control packets
 616                                  * down properly or consistently, so we'll only
 617                                  * pass down the header.
 618                                  */
 619                                 hdrlen = WI_CTL_HDRLEN;
 620                                 datlen = 0;
 621                                 break;
 622                         default:
 623                                 device_printf(sc->dev, "received packet of "
 624                                     "unknown type on port 7\n");
 625                                 m_freem(m);
 626                                 ifp->if_ierrors++;
 627                                 return;
 628                         }
 629                         break;
 630                 case 0:
 631                         hdrlen = WI_DATA_HDRLEN;
 632                         datlen = rx_frame->wi_dat_len + WI_FCS_LEN;
 633                         break;
 634                 default:
 635                         device_printf(sc->dev, "received packet on invalid "
 636                             "port (wi_status=0x%x)\n", rx_frame->wi_status);
 637                         m_freem(m);
 638                         ifp->if_ierrors++;
 639                         return;
 640                 }
 641
 642                 if ((hdrlen + datlen + 2) > MCLBYTES) {
 643                         device_printf(sc->dev, "oversized packet received "
 644                             "(wi_dat_len=%d, wi_status=0x%x)\n",
 645                             datlen, rx_frame->wi_status);
 646                         m_freem(m);
 647                         ifp->if_ierrors++;
 648                         return;
 649                 }
 650
 651                 if (wi_read_data(sc, id, hdrlen, mtod(m, caddr_t) + hdrlen,
 652                     datlen + 2)) {
 653                         m_freem(m);
 654                         ifp->if_ierrors++;
 655                         return;
 656                 }
 657
 658                 m->m_pkthdr.len = m->m_len = hdrlen + datlen;
 659
 660                 ifp->if_ipackets++;
 661
 662                 /* Handle BPF listeners. */
 663                 BPF_MTAP(ifp, m);
 664
 665                 m_freem(m);
 666         } else {
 667                 struct wi_frame         rx_frame;
 668
 669                 /* First read in the frame header */
 670                 if (wi_read_data(sc, id, 0, (caddr_t)&rx_frame,
 671                     sizeof(rx_frame))) {
 672                         ifp->if_ierrors++;
 673                         return;
 674                 }
 675
 676                 if (rx_frame.wi_status & WI_STAT_ERRSTAT) {
 677                         ifp->if_ierrors++;
 678                         return;
 679                 }
 680
 681                 MGETHDR(m, MB_DONTWAIT, MT_DATA);
 682                 if (m == NULL) {
 683                         ifp->if_ierrors++;
 684                         return;
 685                 }
 686                 MCLGET(m, MB_DONTWAIT);
 687                 if (!(m->m_flags & M_EXT)) {
 688                         m_freem(m);
 689                         ifp->if_ierrors++;
 690                         return;
 691                 }
 692
 693                 eh = mtod(m, struct ether_header *);
 694                 m->m_pkthdr.rcvif = ifp;
 695
 696                 if (rx_frame.wi_status == WI_STAT_MGMT &&
 697                     sc->wi_ptype == WI_PORTTYPE_AP) {
 698                         if ((WI_802_11_OFFSET_RAW + rx_frame.wi_dat_len + 2) >
 699                             MCLBYTES) {
 700                                 device_printf(sc->dev, "oversized mgmt packet "
 701                                     "received in hostap mode "
 702                                     "(wi_dat_len=%d, wi_status=0x%x)\n",
 703                                     rx_frame.wi_dat_len, rx_frame.wi_status);
 704                                 m_freem(m);
 705                                 ifp->if_ierrors++;
 706                                 return;
 707                         }
 708
 709                         /* Put the whole header in there. */
 710                         bcopy(&rx_frame, mtod(m, void *),
 711                             sizeof(struct wi_frame));
 712                         if (wi_read_data(sc, id, WI_802_11_OFFSET_RAW,
 713                             mtod(m, caddr_t) + WI_802_11_OFFSET_RAW,
 714                             rx_frame.wi_dat_len + 2)) {
 715                                 m_freem(m);
 716                                 ifp->if_ierrors++;
 717                                 return;
 718                         }
 719                         m->m_pkthdr.len = m->m_len =
 720                             WI_802_11_OFFSET_RAW + rx_frame.wi_dat_len;
 721                         /* XXX: consider giving packet to bhp? */
 722                         owihap_mgmt_input(sc, &rx_frame, m);
 723                         return;
 724                 }
 725
 726                 if (rx_frame.wi_status == WI_STAT_1042 ||
 727                     rx_frame.wi_status == WI_STAT_TUNNEL ||
 728                     rx_frame.wi_status == WI_STAT_WMP_MSG) {
 729                         if((rx_frame.wi_dat_len + WI_SNAPHDR_LEN) > MCLBYTES) {
 730                                 device_printf(sc->dev,
 731                                     "oversized packet received "
 732                                     "(wi_dat_len=%d, wi_status=0x%x)\n",
 733                                     rx_frame.wi_dat_len, rx_frame.wi_status);
 734                                 m_freem(m);
 735                                 ifp->if_ierrors++;
 736                                 return;
 737                         }
 738                         m->m_pkthdr.len = m->m_len =
 739                             rx_frame.wi_dat_len + WI_SNAPHDR_LEN;
 740
 741 #if 0
 742                         bcopy((char *)&rx_frame.wi_addr1,
 743                             (char *)&eh->ether_dhost, ETHER_ADDR_LEN);
 744                         if (sc->wi_ptype == WI_PORTTYPE_ADHOC) {
 745                                 bcopy((char *)&rx_frame.wi_addr2,
 746                                     (char *)&eh->ether_shost, ETHER_ADDR_LEN);
 747                         } else {
 748                                 bcopy((char *)&rx_frame.wi_addr3,
 749                                     (char *)&eh->ether_shost, ETHER_ADDR_LEN);
 750                         }
 751 #else
 752                         bcopy((char *)&rx_frame.wi_dst_addr,
 753                                 (char *)&eh->ether_dhost, ETHER_ADDR_LEN);
 754                         bcopy((char *)&rx_frame.wi_src_addr,
 755                                 (char *)&eh->ether_shost, ETHER_ADDR_LEN);
 756 #endif
 757
 758                         bcopy((char *)&rx_frame.wi_type,
 759                             (char *)&eh->ether_type, ETHER_TYPE_LEN);
 760
 761                         if (wi_read_data(sc, id, WI_802_11_OFFSET,
 762                             mtod(m, caddr_t) + sizeof(struct ether_header),
 763                             m->m_len + 2)) {
 764                                 m_freem(m);
 765                                 ifp->if_ierrors++;
 766                                 return;
 767                         }
 768                 } else {
 769                         if((rx_frame.wi_dat_len +
 770                             sizeof(struct ether_header)) > MCLBYTES) {
 771                                 device_printf(sc->dev,
 772                                     "oversized packet received "
 773                                     "(wi_dat_len=%d, wi_status=0x%x)\n",
 774                                     rx_frame.wi_dat_len, rx_frame.wi_status);
 775                                 m_freem(m);
 776                                 ifp->if_ierrors++;
 777                                 return;
 778                         }
 779                         m->m_pkthdr.len = m->m_len =
 780                             rx_frame.wi_dat_len + sizeof(struct ether_header);
 781
 782                         if (wi_read_data(sc, id, WI_802_3_OFFSET,
 783                             mtod(m, caddr_t), m->m_len + 2)) {
 784                                 m_freem(m);
 785                                 ifp->if_ierrors++;
 786                                 return;
 787                         }
 788                 }
 789
 790                 ifp->if_ipackets++;
 791
 792                 if (sc->wi_ptype == WI_PORTTYPE_AP) {
 793                         /*
 794                          * Give host AP code first crack at data
 795                          * packets.  If it decides to handle it (or
 796                          * drop it), it will return a non-zero.
 797                          * Otherwise, it is destined for this host.
 798                          */
 799                         if (owihap_data_input(sc, &rx_frame, m))
 800                                 return;
 801                 }
 802                 /* Receive packet. */
 803 #ifdef WICACHE
 804                 wi_cache_store(sc, m, rx_frame.wi_q_info);
 805 #endif
 806                 (*ifp->if_input)(ifp,  m);
 807         }
 808 }
 809
 810 static void
 811 wi_txeof(sc, status)
 812         struct wi_softc         *sc;
 813         int                     status;
 814 {
 815         struct ifnet            *ifp;
 816
 817         ifp = &sc->arpcom.ac_if;
 818
 819         ifp->if_timer = 0;
 820         ifp->if_flags &= ~IFF_OACTIVE;
 821
 822         if (status & WI_EV_TX_EXC)
 823                 ifp->if_oerrors++;
 824         else
 825                 ifp->if_opackets++;
 826
 827         return;
 828 }
 829
 830 static void
 831 wi_inquire(xsc)
 832         void                    *xsc;
 833 {
 834         struct wi_softc         *sc;
 835         struct ifnet            *ifp;
 836         int                     s;
 837
 838         sc = xsc;
 839         ifp = &sc->arpcom.ac_if;
 840
 841         callout_reset(&sc->wi_stat_timer, hz* 60, wi_inquire, sc);
 842
 843         /* Don't do this while we're transmitting */
 844         if (ifp->if_flags & IFF_OACTIVE)
 845                 return;
 846
 847         WI_LOCK(sc, s);
 848         wi_cmd(sc, WI_CMD_INQUIRE, WI_INFO_COUNTERS, 0, 0);
 849         WI_UNLOCK(sc, s);
 850
 851         return;
 852 }
 853
 854 static void
 855 wi_update_stats(sc)
 856         struct wi_softc         *sc;
 857 {
 858         struct wi_ltv_gen       gen;
 859         u_int16_t               id;
 860         struct ifnet            *ifp;
 861         u_int32_t               *ptr;
 862         int                     len, i;
 863         u_int16_t               t;
 864
 865         ifp = &sc->arpcom.ac_if;
 866
 867         id = CSR_READ_2(sc, WI_INFO_FID);
 868
 869         wi_read_data(sc, id, 0, (char *)&gen, 4);
 870
 871         /*
 872          * if we just got our scan results, copy it over into the scan buffer
 873          * so we can return it to anyone that asks for it. (add a little
 874          * compatibility with the prism2 scanning mechanism)
 875          */
 876         if (gen.wi_type == WI_INFO_SCAN_RESULTS)
 877         {
 878                 sc->wi_scanbuf_len = gen.wi_len;
 879                 wi_read_data(sc, id, 4, (char *)sc->wi_scanbuf,
 880                     sc->wi_scanbuf_len * 2);
 881
 882                 return;
 883         }
 884         else if (gen.wi_type != WI_INFO_COUNTERS)
 885                 return;
 886
 887         len = (gen.wi_len - 1 < sizeof(sc->wi_stats) / 4) ?
 888                 gen.wi_len - 1 : sizeof(sc->wi_stats) / 4;
 889         ptr = (u_int32_t *)&sc->wi_stats;
 890
 891         for (i = 0; i < len - 1; i++) {
 892                 t = CSR_READ_2(sc, WI_DATA1);
 893 #ifdef WI_HERMES_STATS_WAR
 894                 if (t > 0xF000)
 895                         t = ~t & 0xFFFF;
 896 #endif
 897                 ptr[i] += t;
 898         }
 899
 900         ifp->if_collisions = sc->wi_stats.wi_tx_single_retries +
 901             sc->wi_stats.wi_tx_multi_retries +
 902             sc->wi_stats.wi_tx_retry_limit;
 903
 904         return;
 905 }
 906
 907 static void
 908 wi_intr(xsc)
 909         void            *xsc;
 910 {
 911         struct wi_softc         *sc = xsc;
 912         struct ifnet            *ifp;
 913         u_int16_t               status;
 914         int                     s;
 915
 916         WI_LOCK(sc, s);
 917
 918         ifp = &sc->arpcom.ac_if;
 919
 920         if (sc->wi_gone || !(ifp->if_flags & IFF_UP)) {
 921                 CSR_WRITE_2(sc, WI_EVENT_ACK, 0xFFFF);
 922                 CSR_WRITE_2(sc, WI_INT_EN, 0);
 923                 WI_UNLOCK(sc, s);
 924                 return;
 925         }
 926
 927         /* Disable interrupts. */
 928         CSR_WRITE_2(sc, WI_INT_EN, 0);
 929
 930         status = CSR_READ_2(sc, WI_EVENT_STAT);
 931         CSR_WRITE_2(sc, WI_EVENT_ACK, ~WI_INTRS);
 932
 933         if (status & WI_EV_RX) {
 934                 wi_rxeof(sc);
 935                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_RX);
 936         }
 937
 938         if (status & WI_EV_TX) {
 939                 wi_txeof(sc, status);
 940                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_TX);
 941         }
 942
 943         if (status & WI_EV_ALLOC) {
 944                 int                     id;
 945
 946                 id = CSR_READ_2(sc, WI_ALLOC_FID);
 947                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_ALLOC);
 948                 if (id == sc->wi_tx_data_id)
 949                         wi_txeof(sc, status);
 950         }
 951
 952         if (status & WI_EV_INFO) {
 953                 wi_update_stats(sc);
 954                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_INFO);
 955         }
 956
 957         if (status & WI_EV_TX_EXC) {
 958                 wi_txeof(sc, status);
 959                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_TX_EXC);
 960         }
 961
 962         if (status & WI_EV_INFO_DROP) {
 963                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_INFO_DROP);
 964         }
 965
 966         /* Re-enable interrupts. */
 967         CSR_WRITE_2(sc, WI_INT_EN, WI_INTRS);
 968
 969         if (ifp->if_snd.ifq_head != NULL) {
 970                 wi_start(ifp);
 971         }
 972
 973         WI_UNLOCK(sc, s);
 974
 975         return;
 976 }
 977
 978 static int
 979 wi_cmd(sc, cmd, val0, val1, val2)
 980         struct wi_softc         *sc;
 981         int                     cmd;
 982         int                     val0;
 983         int                     val1;
 984         int                     val2;
 985 {
 986         int                     i, s = 0;
 987         static volatile int count  = 0;
 988
 989         if (count > 1)
 990                 panic("Hey partner, hold on there!");
 991         count++;
 992
 993         /* wait for the busy bit to clear */
 994         for (i = 500; i > 0; i--) {     /* 5s */
 995                 if (!(CSR_READ_2(sc, WI_COMMAND) & WI_CMD_BUSY)) {
 996                         break;
 997                 }
 998                 DELAY(10*1000); /* 10 m sec */
 999         }
1000         if (i == 0) {
1001                 device_printf(sc->dev, "wi_cmd: busy bit won't clear.\n" );
1002                 count--;
1003                 return(ETIMEDOUT);
1004         }
1005
1006         CSR_WRITE_2(sc, WI_PARAM0, val0);
1007         CSR_WRITE_2(sc, WI_PARAM1, val1);
1008         CSR_WRITE_2(sc, WI_PARAM2, val2);
1009         CSR_WRITE_2(sc, WI_COMMAND, cmd);
1010
1011         for (i = 0; i < WI_TIMEOUT; i++) {
1012                 /*
1013                  * Wait for 'command complete' bit to be
1014                  * set in the event status register.
1015                  */
1016                 s = CSR_READ_2(sc, WI_EVENT_STAT);
1017                 if (s & WI_EV_CMD) {
1018                         /* Ack the event and read result code. */
1019                         s = CSR_READ_2(sc, WI_STATUS);
1020                         CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_CMD);
1021 #ifdef foo
1022                         if ((s & WI_CMD_CODE_MASK) != (cmd & WI_CMD_CODE_MASK))
1023                                 return(EIO);
1024 #endif
1025                         if (s & WI_STAT_CMD_RESULT) {
1026                                 count--;
1027                                 return(EIO);
1028                         }
1029                         break;
1030                 }
1031                 DELAY(WI_DELAY);
1032         }
1033
1034         count--;
1035         if (i == WI_TIMEOUT) {
1036                 device_printf(sc->dev,
1037                     "timeout in wi_cmd 0x%04x; event status 0x%04x\n", cmd, s);
1038                 return(ETIMEDOUT);
1039         }
1040         return(0);
1041 }
1042
1043 static void
1044 wi_reset(sc)
1045         struct wi_softc         *sc;
1046 {
1047 #define WI_INIT_TRIES 3
1048         int i;
1049         int tries;
1050
1051         /* Symbol firmware cannot be initialized more than once */
1052         if (sc->sc_firmware_type == WI_SYMBOL && sc->sc_enabled)
1053                 return;
1054         if (sc->sc_firmware_type == WI_SYMBOL)
1055                 tries = 1;
1056         else
1057                 tries = WI_INIT_TRIES;
1058
1059         for (i = 0; i < tries; i++) {
1060                 if (wi_cmd(sc, WI_CMD_INI, 0, 0, 0) == 0)
1061                         break;
1062                 DELAY(WI_DELAY * 1000);
1063         }
1064         sc->sc_enabled = 1;
1065
1066         if (i == tries) {
1067                 device_printf(sc->dev, "init failed\n");
1068                 return;
1069         }
1070
1071         CSR_WRITE_2(sc, WI_INT_EN, 0);
1072         CSR_WRITE_2(sc, WI_EVENT_ACK, 0xFFFF);
1073
1074         /* Calibrate timer. */
1075         WI_SETVAL(WI_RID_TICK_TIME, 8);
1076
1077         return;
1078 }
1079
1080 /*
1081  * Read an LTV record from the NIC.
1082  */
1083 static int
1084 wi_read_record(sc, ltv)
1085         struct wi_softc         *sc;
1086         struct wi_ltv_gen       *ltv;
1087 {
1088         u_int16_t               *ptr;
1089         int                     i, len, code;
1090         struct wi_ltv_gen       *oltv, p2ltv;
1091
1092         oltv = ltv;
1093         if (sc->sc_firmware_type != WI_LUCENT) {
1094                 switch (ltv->wi_type) {
1095                 case WI_RID_ENCRYPTION:
1096                         p2ltv.wi_type = WI_RID_P2_ENCRYPTION;
1097                         p2ltv.wi_len = 2;
1098                         ltv = &p2ltv;
1099                         break;
1100                 case WI_RID_TX_CRYPT_KEY:
1101                         p2ltv.wi_type = WI_RID_P2_TX_CRYPT_KEY;
1102                         p2ltv.wi_len = 2;
1103                         ltv = &p2ltv;
1104                         break;
1105                 case WI_RID_ROAMING_MODE:
1106                         if (sc->sc_firmware_type == WI_INTERSIL)
1107                                 break;
1108                         /* not supported */
1109                         ltv->wi_len = 1;
1110                         return 0;
1111                 case WI_RID_MICROWAVE_OVEN:
1112                         /* not supported */
1113                         ltv->wi_len = 1;
1114                         return 0;
1115                 }
1116         }
1117
1118         /* Tell the NIC to enter record read mode. */
1119         if (wi_cmd(sc, WI_CMD_ACCESS|WI_ACCESS_READ, ltv->wi_type, 0, 0))
1120                 return(EIO);
1121
1122         /* Seek to the record. */
1123         if (wi_seek(sc, ltv->wi_type, 0, WI_BAP1))
1124                 return(EIO);
1125
1126         /*
1127          * Read the length and record type and make sure they
1128          * match what we expect (this verifies that we have enough
1129          * room to hold all of the returned data).
1130          */
1131         len = CSR_READ_2(sc, WI_DATA1);
1132         if (len > ltv->wi_len)
1133                 return(ENOSPC);
1134         code = CSR_READ_2(sc, WI_DATA1);
1135         if (code != ltv->wi_type)
1136                 return(EIO);
1137
1138         ltv->wi_len = len;
1139         ltv->wi_type = code;
1140
1141         /* Now read the data. */
1142         ptr = &ltv->wi_val;
1143         for (i = 0; i < ltv->wi_len - 1; i++)
1144                 ptr[i] = CSR_READ_2(sc, WI_DATA1);
1145
1146         if (ltv->wi_type == WI_RID_PORTTYPE && sc->wi_ptype == WI_PORTTYPE_IBSS
1147             && ltv->wi_val == sc->wi_ibss_port) {
1148                 /*
1149                  * Convert vendor IBSS port type to WI_PORTTYPE_IBSS.
1150                  * Since Lucent uses port type 1 for BSS *and* IBSS we
1151                  * have to rely on wi_ptype to distinguish this for us.
1152                  */
1153                 ltv->wi_val = htole16(WI_PORTTYPE_IBSS);
1154         } else if (sc->sc_firmware_type != WI_LUCENT) {
1155                 switch (oltv->wi_type) {
1156                 case WI_RID_TX_RATE:
1157                 case WI_RID_CUR_TX_RATE:
1158                         switch (ltv->wi_val) {
1159                         case 1: oltv->wi_val = 1; break;
1160                         case 2: oltv->wi_val = 2; break;
1161                         case 3: oltv->wi_val = 6; break;
1162                         case 4: oltv->wi_val = 5; break;
1163                         case 7: oltv->wi_val = 7; break;
1164                         case 8: oltv->wi_val = 11; break;
1165                         case 15: oltv->wi_val = 3; break;
1166                         default: oltv->wi_val = 0x100 + ltv->wi_val; break;
1167                         }
1168                         break;
1169                 case WI_RID_ENCRYPTION:
1170                         oltv->wi_len = 2;
1171                         if (ltv->wi_val & 0x01)
1172                                 oltv->wi_val = 1;
1173                         else
1174                                 oltv->wi_val = 0;
1175                         break;
1176                 case WI_RID_TX_CRYPT_KEY:
1177                         oltv->wi_len = 2;
1178                         oltv->wi_val = ltv->wi_val;
1179                         break;
1180                 case WI_RID_CNFAUTHMODE:
1181                         oltv->wi_len = 2;
1182                         if (le16toh(ltv->wi_val) & 0x01)
1183                                 oltv->wi_val = htole16(1);
1184                         else if (le16toh(ltv->wi_val) & 0x02)
1185                                 oltv->wi_val = htole16(2);
1186                         break;
1187                 }
1188         }
1189
1190         return(0);
1191 }
1192
1193 /*
1194  * Same as read, except we inject data instead of reading it.
1195  */
1196 static int
1197 wi_write_record(sc, ltv)
1198         struct wi_softc         *sc;
1199         struct wi_ltv_gen       *ltv;
1200 {
1201         u_int16_t               *ptr;
1202         int                     i;
1203         struct wi_ltv_gen       p2ltv;
1204
1205         if (ltv->wi_type == WI_RID_PORTTYPE &&
1206             le16toh(ltv->wi_val) == WI_PORTTYPE_IBSS) {
1207                 /* Convert WI_PORTTYPE_IBSS to vendor IBSS port type. */
1208                 p2ltv.wi_type = WI_RID_PORTTYPE;
1209                 p2ltv.wi_len = 2;
1210                 p2ltv.wi_val = sc->wi_ibss_port;
1211                 ltv = &p2ltv;
1212         } else if (sc->sc_firmware_type != WI_LUCENT) {
1213                 switch (ltv->wi_type) {
1214                 case WI_RID_TX_RATE:
1215                         p2ltv.wi_type = WI_RID_TX_RATE;
1216                         p2ltv.wi_len = 2;
1217                         switch (ltv->wi_val) {
1218                         case 1: p2ltv.wi_val = 1; break;
1219                         case 2: p2ltv.wi_val = 2; break;
1220                         case 3: p2ltv.wi_val = 15; break;
1221                         case 5: p2ltv.wi_val = 4; break;
1222                         case 6: p2ltv.wi_val = 3; break;
1223                         case 7: p2ltv.wi_val = 7; break;
1224                         case 11: p2ltv.wi_val = 8; break;
1225                         default: return EINVAL;
1226                         }
1227                         ltv = &p2ltv;
1228                         break;
1229                 case WI_RID_ENCRYPTION:
1230                         p2ltv.wi_type = WI_RID_P2_ENCRYPTION;
1231                         p2ltv.wi_len = 2;
1232                         if (le16toh(ltv->wi_val)) {
1233                                 p2ltv.wi_val =htole16(PRIVACY_INVOKED |
1234                                     EXCLUDE_UNENCRYPTED);
1235                                 if (sc->wi_ptype == WI_PORTTYPE_AP)
1236                                         /*
1237                                          * Disable tx encryption...
1238                                          * it's broken.
1239                                          */
1240                                         p2ltv.wi_val |= htole16(HOST_ENCRYPT);
1241                         } else
1242                                 p2ltv.wi_val =
1243                                     htole16(HOST_ENCRYPT | HOST_DECRYPT);
1244                         ltv = &p2ltv;
1245                         break;
1246                 case WI_RID_TX_CRYPT_KEY:
1247                         p2ltv.wi_type = WI_RID_P2_TX_CRYPT_KEY;
1248                         p2ltv.wi_len = 2;
1249                         p2ltv.wi_val = ltv->wi_val;
1250                         ltv = &p2ltv;
1251                         break;
1252                 case WI_RID_DEFLT_CRYPT_KEYS:
1253                     {
1254                         int error;
1255                         int keylen;
1256                         struct wi_ltv_str       ws;
1257                         struct wi_ltv_keys      *wk =
1258                             (struct wi_ltv_keys *)ltv;
1259
1260                         keylen = wk->wi_keys[sc->wi_tx_key].wi_keylen;
1261
1262                         for (i = 0; i < 4; i++) {
1263                                 bzero(&ws, sizeof(ws));
1264                                 ws.wi_len = (keylen > 5) ? 8 : 4;
1265                                 ws.wi_type = WI_RID_P2_CRYPT_KEY0 + i;
1266                                 memcpy(ws.wi_str,
1267                                     &wk->wi_keys[i].wi_keydat, keylen);
1268                                 error = wi_write_record(sc,
1269                                     (struct wi_ltv_gen *)&ws);
1270                                 if (error)
1271                                         return error;
1272                         }
1273                         return 0;
1274                     }
1275                 case WI_RID_CNFAUTHMODE:
1276                         p2ltv.wi_type = WI_RID_CNFAUTHMODE;
1277                         p2ltv.wi_len = 2;
1278                         if (le16toh(ltv->wi_val) == 1)
1279                                 p2ltv.wi_val = htole16(0x01);
1280                         else if (le16toh(ltv->wi_val) == 2)
1281                                 p2ltv.wi_val = htole16(0x02);
1282                         ltv = &p2ltv;
1283                         break;
1284                 case WI_RID_ROAMING_MODE:
1285                         if (sc->sc_firmware_type == WI_INTERSIL)
1286                                 break;
1287                         /* not supported */
1288                         return 0;
1289                 case WI_RID_MICROWAVE_OVEN:
1290                         /* not supported */
1291                         return 0;
1292                 }
1293         } else {
1294                 /* LUCENT */
1295                 switch (ltv->wi_type) {
1296                 case WI_RID_TX_RATE:
1297                         switch (ltv->wi_val) {
1298                         case 1: ltv->wi_val = 1; break;  /* 1Mb/s fixed */
1299                         case 2: ltv->wi_val = 2; break;  /* 2Mb/s fixed */
1300                         case 3: ltv->wi_val = 3; break;  /* 11Mb/s auto */
1301                         case 5: ltv->wi_val = 4; break;  /* 5.5Mb/s fixed */
1302                         case 6: ltv->wi_val = 6; break;  /* 2Mb/s auto */
1303                         case 7: ltv->wi_val = 7; break;  /* 5.5Mb/s auto */
1304                         case 11: ltv->wi_val = 5; break; /* 11Mb/s fixed */
1305                         default: return EINVAL;
1306                         }
1307                 }
1308         }
1309
1310         if (wi_seek(sc, ltv->wi_type, 0, WI_BAP1))
1311                 return(EIO);
1312
1313         CSR_WRITE_2(sc, WI_DATA1, ltv->wi_len);
1314         CSR_WRITE_2(sc, WI_DATA1, ltv->wi_type);
1315
1316         ptr = &ltv->wi_val;
1317         for (i = 0; i < ltv->wi_len - 1; i++)
1318                 CSR_WRITE_2(sc, WI_DATA1, ptr[i]);
1319
1320         if (wi_cmd(sc, WI_CMD_ACCESS|WI_ACCESS_WRITE, ltv->wi_type, 0, 0))
1321                 return(EIO);
1322
1323         return(0);
1324 }
1325
1326 static int
1327 wi_seek(sc, id, off, chan)
1328         struct wi_softc         *sc;
1329         int                     id, off, chan;
1330 {
1331         int                     i;
1332         int                     selreg, offreg;
1333         int                     status;
1334
1335         switch (chan) {
1336         case WI_BAP0:
1337                 selreg = WI_SEL0;
1338                 offreg = WI_OFF0;
1339                 break;
1340         case WI_BAP1:
1341                 selreg = WI_SEL1;
1342                 offreg = WI_OFF1;
1343                 break;
1344         default:
1345                 device_printf(sc->dev, "invalid data path: %x\n", chan);
1346                 return(EIO);
1347         }
1348
1349         CSR_WRITE_2(sc, selreg, id);
1350         CSR_WRITE_2(sc, offreg, off);
1351
1352         for (i = 0; i < WI_TIMEOUT; i++) {
1353                 status = CSR_READ_2(sc, offreg);
1354                 if (!(status & (WI_OFF_BUSY|WI_OFF_ERR)))
1355                         break;
1356                 DELAY(WI_DELAY);
1357         }
1358
1359         if (i == WI_TIMEOUT) {
1360                 device_printf(sc->dev, "timeout in wi_seek to %x/%x; last status %x\n",
1361                         id, off, status);
1362                 return(ETIMEDOUT);
1363         }
1364
1365         return(0);
1366 }
1367
1368 static int
1369 wi_read_data(sc, id, off, buf, len)
1370         struct wi_softc         *sc;
1371         int                     id, off;
1372         caddr_t                 buf;
1373         int                     len;
1374 {
1375         int                     i;
1376         u_int16_t               *ptr;
1377
1378         if (wi_seek(sc, id, off, WI_BAP1))
1379                 return(EIO);
1380
1381         ptr = (u_int16_t *)buf;
1382         for (i = 0; i < len / 2; i++)
1383                 ptr[i] = CSR_READ_2(sc, WI_DATA1);
1384
1385         return(0);
1386 }
1387
1388 /*
1389  * According to the comments in the HCF Light code, there is a bug in
1390  * the Hermes (or possibly in certain Hermes firmware revisions) where
1391  * the chip's internal autoincrement counter gets thrown off during
1392  * data writes: the autoincrement is missed, causing one data word to
1393  * be overwritten and subsequent words to be written to the wrong memory
1394  * locations. The end result is that we could end up transmitting bogus
1395  * frames without realizing it. The workaround for this is to write a
1396  * couple of extra guard words after the end of the transfer, then
1397  * attempt to read then back. If we fail to locate the guard words where
1398  * we expect them, we preform the transfer over again.
1399  */
1400 static int
1401 wi_write_data(sc, id, off, buf, len)
1402         struct wi_softc         *sc;
1403         int                     id, off;
1404         caddr_t                 buf;
1405         int                     len;
1406 {
1407         int                     i;
1408         u_int16_t               *ptr;
1409 #ifdef WI_HERMES_AUTOINC_WAR
1410         int                     retries;
1411
1412         retries = 512;
1413 again:
1414 #endif
1415
1416         if (wi_seek(sc, id, off, WI_BAP0))
1417                 return(EIO);
1418
1419         ptr = (u_int16_t *)buf;
1420         for (i = 0; i < (len / 2); i++)
1421                 CSR_WRITE_2(sc, WI_DATA0, ptr[i]);
1422
1423 #ifdef WI_HERMES_AUTOINC_WAR
1424         CSR_WRITE_2(sc, WI_DATA0, 0x1234);
1425         CSR_WRITE_2(sc, WI_DATA0, 0x5678);
1426
1427         if (wi_seek(sc, id, off + len, WI_BAP0))
1428                 return(EIO);
1429
1430         if (CSR_READ_2(sc, WI_DATA0) != 0x1234 ||
1431             CSR_READ_2(sc, WI_DATA0) != 0x5678) {
1432                 if (--retries >= 0)
1433                         goto again;
1434                 device_printf(sc->dev, "wi_write_data device timeout\n");
1435                 return (EIO);
1436         }
1437 #endif
1438
1439         return(0);
1440 }
1441
1442 /*
1443  * Allocate a region of memory inside the NIC and zero
1444  * it out.
1445  */
1446 static int
1447 wi_alloc_nicmem(sc, len, id)
1448         struct wi_softc         *sc;
1449         int                     len;
1450         int                     *id;
1451 {
1452         int                     i;
1453
1454         if (wi_cmd(sc, WI_CMD_ALLOC_MEM, len, 0, 0)) {
1455                 device_printf(sc->dev,
1456                     "failed to allocate %d bytes on NIC\n", len);
1457                 return(ENOMEM);
1458         }
1459
1460         for (i = 0; i < WI_TIMEOUT; i++) {
1461                 if (CSR_READ_2(sc, WI_EVENT_STAT) & WI_EV_ALLOC)
1462                         break;
1463                 DELAY(WI_DELAY);
1464         }
1465
1466         if (i == WI_TIMEOUT) {
1467                 device_printf(sc->dev, "time out allocating memory on card\n");
1468                 return(ETIMEDOUT);
1469         }
1470
1471         CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_ALLOC);
1472         *id = CSR_READ_2(sc, WI_ALLOC_FID);
1473
1474         if (wi_seek(sc, *id, 0, WI_BAP0)) {
1475                 device_printf(sc->dev, "seek failed while allocating memory on card\n");
1476                 return(EIO);
1477         }
1478
1479         for (i = 0; i < len / 2; i++)
1480                 CSR_WRITE_2(sc, WI_DATA0, 0);
1481
1482         return(0);
1483 }
1484
1485 static void
1486 wi_setmulti(sc)
1487         struct wi_softc         *sc;
1488 {
1489         struct ifnet            *ifp;
1490         int                     i = 0;
1491         struct ifmultiaddr      *ifma;
1492         struct wi_ltv_mcast     mcast;
1493
1494         ifp = &sc->arpcom.ac_if;
1495
1496         bzero((char *)&mcast, sizeof(mcast));
1497
1498         mcast.wi_type = WI_RID_MCAST_LIST;
1499         mcast.wi_len = (3 * 16) + 1;
1500
1501         if (ifp->if_flags & IFF_ALLMULTI || ifp->if_flags & IFF_PROMISC) {
1502                 wi_write_record(sc, (struct wi_ltv_gen *)&mcast);
1503                 return;
1504         }
1505
1506 #if defined(__DragonFly__) || __FreeBSD_version < 500000
1507         LIST_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
1508 #else
1509         TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
1510 #endif
1511                 if (ifma->ifma_addr->sa_family != AF_LINK)
1512                         continue;
1513                 if (i < 16) {
1514                         bcopy(LLADDR((struct sockaddr_dl *)ifma->ifma_addr),
1515                             (char *)&mcast.wi_mcast[i], ETHER_ADDR_LEN);
1516                         i++;
1517                 } else {
1518                         bzero((char *)&mcast, sizeof(mcast));
1519                         break;
1520                 }
1521         }
1522
1523         mcast.wi_len = (i * 3) + 1;
1524         wi_write_record(sc, (struct wi_ltv_gen *)&mcast);
1525
1526         return;
1527 }
1528
1529 static void
1530 wi_setdef(sc, wreq)
1531         struct wi_softc         *sc;
1532         struct wi_req           *wreq;
1533 {
1534         struct sockaddr_dl      *sdl;
1535         struct ifaddr           *ifa;
1536         struct ifnet            *ifp;
1537
1538         ifp = &sc->arpcom.ac_if;
1539
1540         switch(wreq->wi_type) {
1541         case WI_RID_MAC_NODE:
1542                 ifa = ifaddr_byindex(ifp->if_index);
1543                 sdl = (struct sockaddr_dl *)ifa->ifa_addr;
1544                 bcopy((char *)&wreq->wi_val, (char *)&sc->arpcom.ac_enaddr,
1545                    ETHER_ADDR_LEN);
1546                 bcopy((char *)&wreq->wi_val, LLADDR(sdl), ETHER_ADDR_LEN);
1547                 break;
1548         case WI_RID_PORTTYPE:
1549                 sc->wi_ptype = le16toh(wreq->wi_val[0]);
1550                 break;
1551         case WI_RID_TX_RATE:
1552                 sc->wi_tx_rate = le16toh(wreq->wi_val[0]);
1553                 break;
1554         case WI_RID_MAX_DATALEN:
1555                 sc->wi_max_data_len = le16toh(wreq->wi_val[0]);
1556                 break;
1557         case WI_RID_RTS_THRESH:
1558                 sc->wi_rts_thresh = le16toh(wreq->wi_val[0]);
1559                 break;
1560         case WI_RID_SYSTEM_SCALE:
1561                 sc->wi_ap_density = le16toh(wreq->wi_val[0]);
1562                 break;
1563         case WI_RID_CREATE_IBSS:
1564                 sc->wi_create_ibss = le16toh(wreq->wi_val[0]);
1565                 break;
1566         case WI_RID_OWN_CHNL:
1567                 sc->wi_channel = le16toh(wreq->wi_val[0]);
1568                 break;
1569         case WI_RID_NODENAME:
1570                 bzero(sc->wi_node_name, sizeof(sc->wi_node_name));
1571                 bcopy((char *)&wreq->wi_val[1], sc->wi_node_name, 30);
1572                 break;
1573         case WI_RID_DESIRED_SSID:
1574                 bzero(sc->wi_net_name, sizeof(sc->wi_net_name));
1575                 bcopy((char *)&wreq->wi_val[1], sc->wi_net_name, 30);
1576                 break;
1577         case WI_RID_OWN_SSID:
1578                 bzero(sc->wi_ibss_name, sizeof(sc->wi_ibss_name));
1579                 bcopy((char *)&wreq->wi_val[1], sc->wi_ibss_name, 30);
1580                 break;
1581         case WI_RID_PM_ENABLED:
1582                 sc->wi_pm_enabled = le16toh(wreq->wi_val[0]);
1583                 break;
1584         case WI_RID_MICROWAVE_OVEN:
1585                 sc->wi_mor_enabled = le16toh(wreq->wi_val[0]);
1586                 break;
1587         case WI_RID_MAX_SLEEP:
1588                 sc->wi_max_sleep = le16toh(wreq->wi_val[0]);
1589                 break;
1590         case WI_RID_CNFAUTHMODE:
1591                 sc->wi_authtype = le16toh(wreq->wi_val[0]);
1592                 break;
1593         case WI_RID_ROAMING_MODE:
1594                 sc->wi_roaming = le16toh(wreq->wi_val[0]);
1595                 break;
1596         case WI_RID_ENCRYPTION:
1597                 sc->wi_use_wep = le16toh(wreq->wi_val[0]);
1598                 break;
1599         case WI_RID_TX_CRYPT_KEY:
1600                 sc->wi_tx_key = le16toh(wreq->wi_val[0]);
1601                 break;
1602         case WI_RID_DEFLT_CRYPT_KEYS:
1603                 bcopy((char *)wreq, (char *)&sc->wi_keys,
1604                     sizeof(struct wi_ltv_keys));
1605                 break;
1606         default:
1607                 break;
1608         }
1609
1610         /* Reinitialize WaveLAN. */
1611         wi_init(sc);
1612
1613         return;
1614 }
1615
1616 static int
1617 wi_ioctl(ifp, command, data, cr)
1618         struct ifnet            *ifp;
1619         u_long                  command;
1620         caddr_t                 data;
1621         struct ucred            *cr;
1622 {
1623         int                     error = 0;
1624         int                     len;
1625         u_int8_t                tmpkey[14];
1626         char                    tmpssid[IEEE80211_NWID_LEN];
1627         struct wi_softc         *sc;
1628         struct wi_req           wreq;
1629         struct ifreq            *ifr;
1630         struct ieee80211req     *ireq;
1631         int                     s;
1632
1633         sc = ifp->if_softc;
1634         WI_LOCK(sc, s);
1635         ifr = (struct ifreq *)data;
1636         ireq = (struct ieee80211req *)data;
1637
1638         if (sc->wi_gone) {
1639                 error = ENODEV;
1640                 goto out;
1641         }
1642
1643         switch(command) {
1644         case SIOCSIFADDR:
1645         case SIOCGIFADDR:
1646         case SIOCSIFMTU:
1647                 error = ether_ioctl(ifp, command, data);
1648                 break;
1649         case SIOCSIFFLAGS:
1650                 /*
1651                  * Can't do promisc and hostap at the same time.  If all that's
1652                  * changing is the promisc flag, try to short-circuit a call to
1653                  * wi_init() by just setting PROMISC in the hardware.
1654                  */
1655                 if (ifp->if_flags & IFF_UP) {
1656                         if (sc->wi_ptype != WI_PORTTYPE_AP &&
1657                             ifp->if_flags & IFF_RUNNING) {
1658                                 if (ifp->if_flags & IFF_PROMISC &&
1659                                     !(sc->wi_if_flags & IFF_PROMISC)) {
1660                                         WI_SETVAL(WI_RID_PROMISC, 1);
1661                                 } else if (!(ifp->if_flags & IFF_PROMISC) &&
1662                                     sc->wi_if_flags & IFF_PROMISC) {
1663                                         WI_SETVAL(WI_RID_PROMISC, 0);
1664                                 } else {
1665                                         wi_init(sc);
1666                                 }
1667                         } else {
1668                                 wi_init(sc);
1669                         }
1670                 } else {
1671                         if (ifp->if_flags & IFF_RUNNING) {
1672                                 wi_stop(sc);
1673                         }
1674                 }
1675                 sc->wi_if_flags = ifp->if_flags;
1676                 error = 0;
1677                 break;
1678         case SIOCSIFMEDIA:
1679         case SIOCGIFMEDIA:
1680                 error = ifmedia_ioctl(ifp, ifr, &sc->ifmedia, command);
1681                 break;
1682         case SIOCADDMULTI:
1683         case SIOCDELMULTI:
1684                 wi_setmulti(sc);
1685                 error = 0;
1686                 break;
1687         case SIOCGWAVELAN:
1688                 error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1689                 if (error)
1690                         break;
1691                 if (wreq.wi_len > WI_MAX_DATALEN) {
1692                         error = EINVAL;
1693                         break;
1694                 }
1695                 /* Don't show WEP keys to non-root users. */
1696                 if (wreq.wi_type == WI_RID_DEFLT_CRYPT_KEYS &&
1697                     suser_cred(cr, NULL_CRED_OKAY))
1698                         break;
1699                 if (wreq.wi_type == WI_RID_IFACE_STATS) {
1700                         bcopy((char *)&sc->wi_stats, (char *)&wreq.wi_val,
1701                             sizeof(sc->wi_stats));
1702                         wreq.wi_len = (sizeof(sc->wi_stats) / 2) + 1;
1703                 } else if (wreq.wi_type == WI_RID_DEFLT_CRYPT_KEYS) {
1704                         bcopy((char *)&sc->wi_keys, (char *)&wreq,
1705                             sizeof(struct wi_ltv_keys));
1706                 }
1707 #ifdef WICACHE
1708                 else if (wreq.wi_type == WI_RID_ZERO_CACHE) {
1709                         sc->wi_sigitems = sc->wi_nextitem = 0;
1710                 } else if (wreq.wi_type == WI_RID_READ_CACHE) {
1711                         char *pt = (char *)&wreq.wi_val;
1712                         bcopy((char *)&sc->wi_sigitems,
1713                             (char *)pt, sizeof(int));
1714                         pt += (sizeof (int));
1715                         wreq.wi_len = sizeof(int) / 2;
1716                         bcopy((char *)&sc->wi_sigcache, (char *)pt,
1717                             sizeof(struct wi_sigcache) * sc->wi_sigitems);
1718                         wreq.wi_len += ((sizeof(struct wi_sigcache) *
1719                             sc->wi_sigitems) / 2) + 1;
1720                 }
1721 #endif
1722                 else if (wreq.wi_type == WI_RID_PROCFRAME) {
1723                         wreq.wi_len = 2;
1724                         wreq.wi_val[0] = sc->wi_procframe;
1725                 } else if (wreq.wi_type == WI_RID_PRISM2) {
1726                         wreq.wi_len = 2;
1727                         wreq.wi_val[0] = sc->sc_firmware_type != WI_LUCENT;
1728                 } else if (wreq.wi_type == WI_RID_SCAN_RES &&
1729                     sc->sc_firmware_type == WI_LUCENT) {
1730                         memcpy((char *)wreq.wi_val, (char *)sc->wi_scanbuf,
1731                             sc->wi_scanbuf_len * 2);
1732                         wreq.wi_len = sc->wi_scanbuf_len;
1733                 } else {
1734                         if (wi_read_record(sc, (struct wi_ltv_gen *)&wreq)) {
1735                                 error = EINVAL;
1736                                 break;
1737                         }
1738                 }
1739                 error = copyout(&wreq, ifr->ifr_data, sizeof(wreq));
1740                 break;
1741         case SIOCSWAVELAN:
1742                 if ((error = suser_cred(cr, NULL_CRED_OKAY)))
1743                         goto out;
1744                 error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1745                 if (error)
1746                         break;
1747                 if (wreq.wi_len > WI_MAX_DATALEN) {
1748                         error = EINVAL;
1749                         break;
1750                 }
1751                 if (wreq.wi_type == WI_RID_IFACE_STATS) {
1752                         error = EINVAL;
1753                         break;
1754                 } else if (wreq.wi_type == WI_RID_MGMT_XMIT) {
1755                         error = owi_mgmt_xmit(sc, (caddr_t)&wreq.wi_val,
1756                             wreq.wi_len);
1757                 } else if (wreq.wi_type == WI_RID_PROCFRAME) {
1758                         sc->wi_procframe = wreq.wi_val[0];
1759                 /*
1760                  * if we're getting a scan request from a wavelan card
1761                  * (non-prism2), send out a cmd_inquire to the card to scan
1762                  * results for the scan will be received through the info
1763                  * interrupt handler. otherwise the scan request can be
1764                  * directly handled by a prism2 card's rid interface.
1765                  */
1766                 } else if (wreq.wi_type == WI_RID_SCAN_REQ &&
1767                     sc->sc_firmware_type == WI_LUCENT) {
1768                         wi_cmd(sc, WI_CMD_INQUIRE, WI_INFO_SCAN_RESULTS, 0, 0);
1769                 } else {
1770                         error = wi_write_record(sc, (struct wi_ltv_gen *)&wreq);
1771                         if (!error)
1772                                 wi_setdef(sc, &wreq);
1773                 }
1774                 break;
1775         case SIOCGPRISM2DEBUG:
1776                 error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1777                 if (error)
1778                         break;
1779                 if (!(ifp->if_flags & IFF_RUNNING) ||
1780                     sc->sc_firmware_type == WI_LUCENT) {
1781                         error = EIO;
1782                         break;
1783                 }
1784                 error = wi_get_debug(sc, &wreq);
1785                 if (error == 0)
1786                         error = copyout(&wreq, ifr->ifr_data, sizeof(wreq));
1787                 break;
1788         case SIOCSPRISM2DEBUG:
1789                 if ((error = suser_cred(cr, NULL_CRED_OKAY)))
1790                         goto out;
1791                 error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1792                 if (error)
1793                         break;
1794                 error = wi_set_debug(sc, &wreq);
1795                 break;
1796         case SIOCG80211:
1797                 switch(ireq->i_type) {
1798                 case IEEE80211_IOC_SSID:
1799                         if(ireq->i_val == -1) {
1800                                 bzero(tmpssid, IEEE80211_NWID_LEN);
1801                                 error = wi_get_cur_ssid(sc, tmpssid, &len);
1802                                 if (error != 0)
1803                                         break;
1804                                 error = copyout(tmpssid, ireq->i_data,
1805                                         IEEE80211_NWID_LEN);
1806                                 ireq->i_len = len;
1807                         } else if (ireq->i_val == 0) {
1808                                 error = copyout(sc->wi_net_name,
1809                                     ireq->i_data,
1810                                     IEEE80211_NWID_LEN);
1811                                 ireq->i_len = IEEE80211_NWID_LEN;
1812                         } else
1813                                 error = EINVAL;
1814                         break;
1815                 case IEEE80211_IOC_NUMSSIDS:
1816                         ireq->i_val = 1;
1817                         break;
1818                 case IEEE80211_IOC_WEP:
1819                         if(!sc->wi_has_wep) {
1820                                 ireq->i_val = IEEE80211_WEP_NOSUP;
1821                         } else {
1822                                 if(sc->wi_use_wep) {
1823                                         ireq->i_val =
1824                                             IEEE80211_WEP_MIXED;
1825                                 } else {
1826                                         ireq->i_val =
1827                                             IEEE80211_WEP_OFF;
1828                                 }
1829                         }
1830                         break;
1831                 case IEEE80211_IOC_WEPKEY:
1832                         if(!sc->wi_has_wep ||
1833                             ireq->i_val < 0 || ireq->i_val > 3) {
1834                                 error = EINVAL;
1835                                 break;
1836                         }
1837                         len = sc->wi_keys.wi_keys[ireq->i_val].wi_keylen;
1838                         if (suser_cred(cr, NULL_CRED_OKAY))
1839                                 bcopy(sc->wi_keys.wi_keys[ireq->i_val].wi_keydat,
1840                                     tmpkey, len);
1841                         else
1842                                 bzero(tmpkey, len);
1843
1844                         ireq->i_len = len;
1845                         error = copyout(tmpkey, ireq->i_data, len);
1846
1847                         break;
1848                 case IEEE80211_IOC_NUMWEPKEYS:
1849                         if(!sc->wi_has_wep)
1850                                 error = EINVAL;
1851                         else
1852                                 ireq->i_val = 4;
1853                         break;
1854                 case IEEE80211_IOC_WEPTXKEY:
1855                         if(!sc->wi_has_wep)
1856                                 error = EINVAL;
1857                         else
1858                                 ireq->i_val = sc->wi_tx_key;
1859                         break;
1860                 case IEEE80211_IOC_AUTHMODE:
1861                         ireq->i_val = sc->wi_authmode;
1862                         break;
1863                 case IEEE80211_IOC_STATIONNAME:
1864                         error = copyout(sc->wi_node_name,
1865                             ireq->i_data, IEEE80211_NWID_LEN);
1866                         ireq->i_len = IEEE80211_NWID_LEN;
1867                         break;
1868                 case IEEE80211_IOC_CHANNEL:
1869                         wreq.wi_type = WI_RID_CURRENT_CHAN;
1870                         wreq.wi_len = WI_MAX_DATALEN;
1871                         if (wi_read_record(sc, (struct wi_ltv_gen *)&wreq))
1872                                 error = EINVAL;
1873                         else {
1874                                 ireq->i_val = wreq.wi_val[0];
1875                         }
1876                         break;
1877                 case IEEE80211_IOC_POWERSAVE:
1878                         if(sc->wi_pm_enabled)
1879                                 ireq->i_val = IEEE80211_POWERSAVE_ON;
1880                         else
1881                                 ireq->i_val = IEEE80211_POWERSAVE_OFF;
1882                         break;
1883                 case IEEE80211_IOC_POWERSAVESLEEP:
1884                         ireq->i_val = sc->wi_max_sleep;
1885                         break;
1886                 default:
1887                         error = EINVAL;
1888                 }
1889                 break;
1890         case SIOCS80211:
1891                 if ((error = suser_cred(cr, NULL_CRED_OKAY)))
1892                         goto out;
1893                 switch(ireq->i_type) {
1894                 case IEEE80211_IOC_SSID:
1895                         if (ireq->i_val != 0 ||
1896                             ireq->i_len > IEEE80211_NWID_LEN) {
1897                                 error = EINVAL;
1898                                 break;
1899                         }
1900                         /* We set both of them */
1901                         bzero(sc->wi_net_name, IEEE80211_NWID_LEN);
1902                         error = copyin(ireq->i_data,
1903                             sc->wi_net_name, ireq->i_len);
1904                         bcopy(sc->wi_net_name, sc->wi_ibss_name, IEEE80211_NWID_LEN);
1905                         break;
1906                 case IEEE80211_IOC_WEP:
1907                         /*
1908                          * These cards only support one mode so
1909                          * we just turn wep on what ever is
1910                          * passed in if it's not OFF.
1911                          */
1912                         if (ireq->i_val == IEEE80211_WEP_OFF) {
1913                                 sc->wi_use_wep = 0;
1914                         } else {
1915                                 sc->wi_use_wep = 1;
1916                         }
1917                         break;
1918                 case IEEE80211_IOC_WEPKEY:
1919                         if (ireq->i_val < 0 || ireq->i_val > 3 ||
1920                                 ireq->i_len > 13) {
1921                                 error = EINVAL;
1922                                 break;
1923                         }
1924                         bzero(sc->wi_keys.wi_keys[ireq->i_val].wi_keydat, 13);
1925                         error = copyin(ireq->i_data,
1926                             sc->wi_keys.wi_keys[ireq->i_val].wi_keydat,
1927                             ireq->i_len);
1928                         if(error)
1929                                 break;
1930                         sc->wi_keys.wi_keys[ireq->i_val].wi_keylen =
1931                                     ireq->i_len;
1932                         break;
1933                 case IEEE80211_IOC_WEPTXKEY:
1934                         if (ireq->i_val < 0 || ireq->i_val > 3) {
1935                                 error = EINVAL;
1936                                 break;
1937                         }
1938                         sc->wi_tx_key = ireq->i_val;
1939                         break;
1940                 case IEEE80211_IOC_AUTHMODE:
1941                         sc->wi_authmode = ireq->i_val;
1942                         break;
1943                 case IEEE80211_IOC_STATIONNAME:
1944                         if (ireq->i_len > 32) {
1945                                 error = EINVAL;
1946                                 break;
1947                         }
1948                         bzero(sc->wi_node_name, 32);
1949                         error = copyin(ireq->i_data,
1950                             sc->wi_node_name, ireq->i_len);
1951                         break;
1952                 case IEEE80211_IOC_CHANNEL:
1953                         /*
1954                          * The actual range is 1-14, but if you
1955                          * set it to 0 you get the default. So
1956                          * we let that work too.
1957                          */
1958                         if (ireq->i_val < 0 || ireq->i_val > 14) {
1959                                 error = EINVAL;
1960                                 break;
1961                         }
1962                         sc->wi_channel = ireq->i_val;
1963                         break;
1964                 case IEEE80211_IOC_POWERSAVE:
1965                         switch (ireq->i_val) {
1966                         case IEEE80211_POWERSAVE_OFF:
1967                                 sc->wi_pm_enabled = 0;
1968                                 break;
1969                         case IEEE80211_POWERSAVE_ON:
1970                                 sc->wi_pm_enabled = 1;
1971                                 break;
1972                         default:
1973                                 error = EINVAL;
1974                                 break;
1975                         }
1976                         break;
1977                 case IEEE80211_IOC_POWERSAVESLEEP:
1978                         if (ireq->i_val < 0) {
1979                                 error = EINVAL;
1980                                 break;
1981                         }
1982                         sc->wi_max_sleep = ireq->i_val;
1983                         break;
1984                 default:
1985                         error = EINVAL;
1986                         break;
1987                 }
1988
1989                 /* Reinitialize WaveLAN. */
1990                 wi_init(sc);
1991
1992         break;
1993         case SIOCHOSTAP_ADD:
1994         case SIOCHOSTAP_DEL:
1995         case SIOCHOSTAP_GET:
1996         case SIOCHOSTAP_GETALL:
1997         case SIOCHOSTAP_GFLAGS:
1998         case SIOCHOSTAP_SFLAGS:
1999                 /* Send all Host AP specific ioctl's to Host AP code. */
2000                 error = owihap_ioctl(sc, command, data);
2001                 break;
2002         default:
2003                 error = EINVAL;
2004                 break;
2005         }
2006 out:
2007         WI_UNLOCK(sc, s);
2008
2009         return(error);
2010 }
2011
2012 static void
2013 wi_init(xsc)
2014         void                    *xsc;
2015 {
2016         struct wi_softc         *sc = xsc;
2017         struct ifnet            *ifp = &sc->arpcom.ac_if;
2018         struct wi_ltv_macaddr   mac;
2019         int                     id = 0;
2020         int                     s;
2021
2022         WI_LOCK(sc, s);
2023
2024         if (sc->wi_gone) {
2025                 WI_UNLOCK(sc, s);
2026                 return;
2027         }
2028
2029         if (ifp->if_flags & IFF_RUNNING)
2030                 wi_stop(sc);
2031
2032         wi_reset(sc);
2033
2034         /* Program max data length. */
2035         WI_SETVAL(WI_RID_MAX_DATALEN, sc->wi_max_data_len);
2036
2037         /* Set the port type. */
2038         WI_SETVAL(WI_RID_PORTTYPE, sc->wi_ptype);
2039
2040         /* Enable/disable IBSS creation. */
2041         WI_SETVAL(WI_RID_CREATE_IBSS, sc->wi_create_ibss);
2042
2043         /* Program the RTS/CTS threshold. */
2044         WI_SETVAL(WI_RID_RTS_THRESH, sc->wi_rts_thresh);
2045
2046         /* Program the TX rate */
2047         WI_SETVAL(WI_RID_TX_RATE, sc->wi_tx_rate);
2048
2049         /* Access point density */
2050         WI_SETVAL(WI_RID_SYSTEM_SCALE, sc->wi_ap_density);
2051
2052         /* Power Management Enabled */
2053         WI_SETVAL(WI_RID_PM_ENABLED, sc->wi_pm_enabled);
2054
2055         /* Power Managment Max Sleep */
2056         WI_SETVAL(WI_RID_MAX_SLEEP, sc->wi_max_sleep);
2057
2058         /* Roaming type */
2059         WI_SETVAL(WI_RID_ROAMING_MODE, sc->wi_roaming);
2060
2061         /* Specify the IBSS name */
2062         WI_SETSTR(WI_RID_OWN_SSID, sc->wi_ibss_name);
2063
2064         /* Specify the network name */
2065         WI_SETSTR(WI_RID_DESIRED_SSID, sc->wi_net_name);
2066
2067         /* Specify the frequency to use */
2068         WI_SETVAL(WI_RID_OWN_CHNL, sc->wi_channel);
2069
2070         /* Program the nodename. */
2071         WI_SETSTR(WI_RID_NODENAME, sc->wi_node_name);
2072
2073         /* Specify the authentication mode. */
2074         WI_SETVAL(WI_RID_CNFAUTHMODE, sc->wi_authmode);
2075
2076         /* Set our MAC address. */
2077         mac.wi_len = 4;
2078         mac.wi_type = WI_RID_MAC_NODE;
2079         bcopy((char *)&sc->arpcom.ac_enaddr,
2080            (char *)&mac.wi_mac_addr, ETHER_ADDR_LEN);
2081         wi_write_record(sc, (struct wi_ltv_gen *)&mac);
2082
2083         /*
2084          * Initialize promisc mode.
2085          *      Being in the Host-AP mode causes
2086          *      great deal of pain if promisc mode is set.
2087          *      Therefore we avoid confusing the firmware
2088          *      and always reset promisc mode in Host-AP regime,
2089          *      it shows us all the packets anyway.
2090          */
2091         if (sc->wi_ptype != WI_PORTTYPE_AP && ifp->if_flags & IFF_PROMISC)
2092                 WI_SETVAL(WI_RID_PROMISC, 1);
2093         else
2094                 WI_SETVAL(WI_RID_PROMISC, 0);
2095
2096         /* Configure WEP. */
2097         if (sc->wi_has_wep) {
2098                 WI_SETVAL(WI_RID_ENCRYPTION, sc->wi_use_wep);
2099                 WI_SETVAL(WI_RID_TX_CRYPT_KEY, sc->wi_tx_key);
2100                 sc->wi_keys.wi_len = (sizeof(struct wi_ltv_keys) / 2) + 1;
2101                 sc->wi_keys.wi_type = WI_RID_DEFLT_CRYPT_KEYS;
2102                 wi_write_record(sc, (struct wi_ltv_gen *)&sc->wi_keys);
2103                 if (sc->sc_firmware_type != WI_LUCENT && sc->wi_use_wep) {
2104                         /*
2105                          * ONLY HWB3163 EVAL-CARD Firmware version
2106                          * less than 0.8 variant2
2107                          *
2108                          * If promiscuous mode disable, Prism2 chip
2109                          * does not work with WEP.
2110                          * It is under investigation for details.
2111                          * (ichiro@netbsd.org)
2112                          *
2113                          * And make sure that we don't need to do it
2114                          * in hostap mode, since it interferes with
2115                          * the above hostap workaround.
2116                          */
2117                         if (sc->wi_ptype != WI_PORTTYPE_AP &&
2118                             sc->sc_firmware_type == WI_INTERSIL &&
2119                             sc->sc_sta_firmware_ver < 802 ) {
2120                                 /* firm ver < 0.8 variant 2 */
2121                                 WI_SETVAL(WI_RID_PROMISC, 1);
2122                         }
2123                         WI_SETVAL(WI_RID_CNFAUTHMODE, sc->wi_authtype);
2124                 }
2125         }
2126
2127         /* Set multicast filter. */
2128         wi_setmulti(sc);
2129
2130         /* Enable desired port */
2131         wi_cmd(sc, WI_CMD_ENABLE | sc->wi_portnum, 0, 0, 0);
2132
2133         if (wi_alloc_nicmem(sc, ETHER_MAX_LEN + sizeof(struct wi_frame) + 8, &id))
2134                 device_printf(sc->dev, "tx buffer allocation failed\n");
2135         sc->wi_tx_data_id = id;
2136
2137         if (wi_alloc_nicmem(sc, ETHER_MAX_LEN + sizeof(struct wi_frame) + 8, &id))
2138                 device_printf(sc->dev, "mgmt. buffer allocation failed\n");
2139         sc->wi_tx_mgmt_id = id;
2140
2141         /* enable interrupts */
2142         CSR_WRITE_2(sc, WI_INT_EN, WI_INTRS);
2143
2144         owihap_init(sc);
2145
2146         ifp->if_flags |= IFF_RUNNING;
2147         ifp->if_flags &= ~IFF_OACTIVE;
2148
2149         callout_reset(&sc->wi_stat_timer, hz * 60, wi_inquire, sc);
2150         WI_UNLOCK(sc, s);
2151
2152         return;
2153 }
2154
2155 #define RC4STATE 256
2156 #define RC4KEYLEN 16
2157 #define RC4SWAP(x,y) \
2158     do { u_int8_t t = state[x]; state[x] = state[y]; state[y] = t; } while(0)
2159
2160 static void
2161 wi_do_hostencrypt(struct wi_softc *sc, caddr_t buf, int len)
2162 {
2163         u_int32_t i, crc, klen;
2164         u_int8_t state[RC4STATE], key[RC4KEYLEN];
2165         u_int8_t x, y, *dat;
2166
2167         if (!sc->wi_icv_flag) {
2168                 sc->wi_icv = arc4random();
2169                 sc->wi_icv_flag++;
2170         } else
2171                 sc->wi_icv++;
2172         /*
2173          * Skip 'bad' IVs from Fluhrer/Mantin/Shamir:
2174          * (B, 255, N) with 3 <= B < 8
2175          */
2176         if (sc->wi_icv >= 0x03ff00 &&
2177             (sc->wi_icv & 0xf8ff00) == 0x00ff00)
2178                 sc->wi_icv += 0x000100;
2179
2180         /* prepend 24bit IV to tx key, byte order does not matter */
2181         key[0] = sc->wi_icv >> 16;
2182         key[1] = sc->wi_icv >> 8;
2183         key[2] = sc->wi_icv;
2184
2185         klen = sc->wi_keys.wi_keys[sc->wi_tx_key].wi_keylen +
2186             IEEE80211_WEP_IVLEN;
2187         klen = (klen >= RC4KEYLEN) ? RC4KEYLEN : RC4KEYLEN/2;
2188         bcopy((char *)&sc->wi_keys.wi_keys[sc->wi_tx_key].wi_keydat,
2189             (char *)key + IEEE80211_WEP_IVLEN, klen - IEEE80211_WEP_IVLEN);
2190
2191         /* rc4 keysetup */
2192         x = y = 0;
2193         for (i = 0; i < RC4STATE; i++)
2194                 state[i] = i;
2195         for (i = 0; i < RC4STATE; i++) {
2196                 y = (key[x] + state[i] + y) % RC4STATE;
2197                 RC4SWAP(i, y);
2198                 x = (x + 1) % klen;
2199         }
2200
2201         /* output: IV, tx keyid, rc4(data), rc4(crc32(data)) */
2202         dat = buf;
2203         dat[0] = key[0];
2204         dat[1] = key[1];
2205         dat[2] = key[2];
2206         dat[3] = sc->wi_tx_key << 6;            /* pad and keyid */
2207         dat += 4;
2208
2209         /* compute rc4 over data, crc32 over data */
2210         crc = ~0;
2211         x = y = 0;
2212         for (i = 0; i < len; i++) {
2213                 x = (x + 1) % RC4STATE;
2214                 y = (state[x] + y) % RC4STATE;
2215                 RC4SWAP(x, y);
2216                 crc = crc32_tab[(crc ^ dat[i]) & 0xff] ^ (crc >> 8);
2217                 dat[i] ^= state[(state[x] + state[y]) % RC4STATE];
2218         }
2219         crc = ~crc;
2220         dat += len;
2221
2222         /* append little-endian crc32 and encrypt */
2223         dat[0] = crc;
2224         dat[1] = crc >> 8;
2225         dat[2] = crc >> 16;
2226         dat[3] = crc >> 24;
2227         for (i = 0; i < IEEE80211_WEP_CRCLEN; i++) {
2228                 x = (x + 1) % RC4STATE;
2229                 y = (state[x] + y) % RC4STATE;
2230                 RC4SWAP(x, y);
2231                 dat[i] ^= state[(state[x] + state[y]) % RC4STATE];
2232         }
2233 }
2234
2235 static void
2236 wi_start(ifp)
2237         struct ifnet            *ifp;
2238 {
2239         struct wi_softc         *sc;
2240         struct mbuf             *m0;
2241         struct wi_frame         tx_frame;
2242         struct ether_header     *eh;
2243         int                     id;
2244         int                     s;
2245
2246         sc = ifp->if_softc;
2247         WI_LOCK(sc, s);
2248
2249         if (sc->wi_gone) {
2250                 WI_UNLOCK(sc, s);
2251                 return;
2252         }
2253
2254         if (ifp->if_flags & IFF_OACTIVE) {
2255                 WI_UNLOCK(sc, s);
2256                 return;
2257         }
2258
2259 nextpkt:
2260         IF_DEQUEUE(&ifp->if_snd, m0);
2261         if (m0 == NULL) {
2262                 WI_UNLOCK(sc, s);
2263                 return;
2264         }
2265
2266         bzero((char *)&tx_frame, sizeof(tx_frame));
2267         tx_frame.wi_frame_ctl = htole16(WI_FTYPE_DATA);
2268         id = sc->wi_tx_data_id;
2269         eh = mtod(m0, struct ether_header *);
2270
2271         if (sc->wi_ptype == WI_PORTTYPE_AP) {
2272                 if (!owihap_check_tx(&sc->wi_hostap_info,
2273                     eh->ether_dhost, &tx_frame.wi_tx_rate)) {
2274                         if (ifp->if_flags & IFF_DEBUG)
2275                                 printf("wi_start: dropping unassoc "
2276                                        "dst %6D\n", eh->ether_dhost, ":");
2277                         m_freem(m0);
2278                         goto nextpkt;
2279                 }
2280         }
2281         /*
2282          * Use RFC1042 encoding for IP and ARP datagrams,
2283          * 802.3 for anything else.
2284          */
2285         if (ntohs(eh->ether_type) > ETHER_MAX_LEN) {
2286                 bcopy((char *)&eh->ether_dhost,
2287                     (char *)&tx_frame.wi_addr1, ETHER_ADDR_LEN);
2288                 if (sc->wi_ptype == WI_PORTTYPE_AP) {
2289                         tx_frame.wi_tx_ctl = WI_ENC_TX_MGMT; /* XXX */
2290                         tx_frame.wi_frame_ctl |= WI_FCTL_FROMDS;
2291                         if (sc->wi_use_wep)
2292                                 tx_frame.wi_frame_ctl |= WI_FCTL_WEP;
2293                         bcopy((char *)&sc->arpcom.ac_enaddr,
2294                               (char *)&tx_frame.wi_addr2, ETHER_ADDR_LEN);
2295                         bcopy((char *)&eh->ether_shost,
2296                               (char *)&tx_frame.wi_addr3, ETHER_ADDR_LEN);
2297                 }
2298                 else
2299                         bcopy((char *)&eh->ether_shost,
2300                             (char *)&tx_frame.wi_addr2, ETHER_ADDR_LEN);
2301                 bcopy((char *)&eh->ether_dhost,
2302                     (char *)&tx_frame.wi_dst_addr, ETHER_ADDR_LEN);
2303                 bcopy((char *)&eh->ether_shost,
2304                     (char *)&tx_frame.wi_src_addr, ETHER_ADDR_LEN);
2305
2306                 tx_frame.wi_dat_len = m0->m_pkthdr.len - WI_SNAPHDR_LEN;
2307                 tx_frame.wi_dat[0] = htons(WI_SNAP_WORD0);
2308                 tx_frame.wi_dat[1] = htons(WI_SNAP_WORD1);
2309                 tx_frame.wi_len = htons(m0->m_pkthdr.len - WI_SNAPHDR_LEN);
2310                 tx_frame.wi_type = eh->ether_type;
2311
2312                 if (sc->wi_ptype == WI_PORTTYPE_AP && sc->wi_use_wep) {
2313                         /* Do host encryption. */
2314                         bcopy(&tx_frame.wi_dat[0], &sc->wi_txbuf[4], 8);
2315                         m_copydata(m0, sizeof(struct ether_header),
2316                             m0->m_pkthdr.len - sizeof(struct ether_header),
2317                             (caddr_t)&sc->wi_txbuf[12]);
2318                         wi_do_hostencrypt(sc, &sc->wi_txbuf[0],
2319                             tx_frame.wi_dat_len);
2320                         tx_frame.wi_dat_len += IEEE80211_WEP_IVLEN +
2321                             IEEE80211_WEP_KIDLEN + IEEE80211_WEP_CRCLEN;
2322                         wi_write_data(sc, id, 0, (caddr_t)&tx_frame,
2323                             sizeof(struct wi_frame));
2324                         wi_write_data(sc, id, WI_802_11_OFFSET_RAW,
2325                             (caddr_t)&sc->wi_txbuf, (m0->m_pkthdr.len -
2326                             sizeof(struct ether_header)) + 18);
2327                 } else {
2328                         m_copydata(m0, sizeof(struct ether_header),
2329                             m0->m_pkthdr.len - sizeof(struct ether_header),
2330                             (caddr_t)&sc->wi_txbuf);
2331                         wi_write_data(sc, id, 0, (caddr_t)&tx_frame,
2332                             sizeof(struct wi_frame));
2333                         wi_write_data(sc, id, WI_802_11_OFFSET,
2334                             (caddr_t)&sc->wi_txbuf, (m0->m_pkthdr.len -
2335                             sizeof(struct ether_header)) + 2);
2336                 }
2337         } else {
2338                 tx_frame.wi_dat_len = m0->m_pkthdr.len;
2339
2340                 if (sc->wi_ptype == WI_PORTTYPE_AP && sc->wi_use_wep) {
2341                         /* Do host encryption. */
2342                         printf( "XXX: host encrypt not implemented for 802.3\n" );
2343                 } else {
2344                         eh->ether_type = htons(m0->m_pkthdr.len -
2345                             WI_SNAPHDR_LEN);
2346                         m_copydata(m0, 0, m0->m_pkthdr.len,
2347                             (caddr_t)&sc->wi_txbuf);
2348
2349                         wi_write_data(sc, id, 0, (caddr_t)&tx_frame,
2350                             sizeof(struct wi_frame));
2351                         wi_write_data(sc, id, WI_802_3_OFFSET,
2352                             (caddr_t)&sc->wi_txbuf, m0->m_pkthdr.len + 2);
2353                 }
2354         }
2355
2356         /*
2357          * If there's a BPF listner, bounce a copy of
2358          * this frame to him. Also, don't send this to the bpf sniffer
2359          * if we're in procframe or monitor sniffing mode.
2360          */
2361         if (!(sc->wi_procframe || sc->wi_debug.wi_monitor))
2362                 BPF_MTAP(ifp, m0);
2363
2364         m_freem(m0);
2365
2366         if (wi_cmd(sc, WI_CMD_TX|WI_RECLAIM, id, 0, 0))
2367                 device_printf(sc->dev, "xmit failed\n");
2368
2369         ifp->if_flags |= IFF_OACTIVE;
2370
2371         /*
2372          * Set a timeout in case the chip goes out to lunch.
2373          */
2374         ifp->if_timer = 5;
2375
2376         WI_UNLOCK(sc, s);
2377         return;
2378 }
2379
2380 int
2381 owi_mgmt_xmit(sc, data, len)
2382         struct wi_softc         *sc;
2383         caddr_t                 data;
2384         int                     len;
2385 {
2386         struct wi_frame         tx_frame;
2387         int                     id;
2388         struct wi_80211_hdr     *hdr;
2389         caddr_t                 dptr;
2390
2391         if (sc->wi_gone)
2392                 return(ENODEV);
2393
2394         hdr = (struct wi_80211_hdr *)data;
2395         dptr = data + sizeof(struct wi_80211_hdr);
2396
2397         bzero((char *)&tx_frame, sizeof(tx_frame));
2398         id = sc->wi_tx_mgmt_id;
2399
2400         bcopy((char *)hdr, (char *)&tx_frame.wi_frame_ctl,
2401            sizeof(struct wi_80211_hdr));
2402
2403         tx_frame.wi_tx_ctl = WI_ENC_TX_MGMT;
2404         tx_frame.wi_dat_len = len - sizeof(struct wi_80211_hdr);
2405         tx_frame.wi_len = htons(tx_frame.wi_dat_len);
2406
2407         wi_write_data(sc, id, 0, (caddr_t)&tx_frame, sizeof(struct wi_frame));
2408         wi_write_data(sc, id, WI_802_11_OFFSET_RAW, dptr,
2409             len - sizeof(struct wi_80211_hdr) + 2);
2410
2411         if (wi_cmd(sc, WI_CMD_TX|WI_RECLAIM, id, 0, 0)) {
2412                 device_printf(sc->dev, "xmit failed\n");
2413                 return(EIO);
2414         }
2415
2416         return(0);
2417 }
2418
2419 static void
2420 wi_stop(sc)
2421         struct wi_softc         *sc;
2422 {
2423         struct ifnet            *ifp;
2424         int                     s;
2425
2426         WI_LOCK(sc, s);
2427
2428         if (sc->wi_gone) {
2429                 WI_UNLOCK(sc, s);
2430                 return;
2431         }
2432
2433         owihap_shutdown(sc);
2434
2435         ifp = &sc->arpcom.ac_if;
2436
2437         /*
2438          * If the card is gone and the memory port isn't mapped, we will
2439          * (hopefully) get 0xffff back from the status read, which is not
2440          * a valid status value.
2441          */
2442         if (CSR_READ_2(sc, WI_STATUS) != 0xffff) {
2443                 CSR_WRITE_2(sc, WI_INT_EN, 0);
2444                 wi_cmd(sc, WI_CMD_DISABLE|sc->wi_portnum, 0, 0, 0);
2445         }
2446
2447         callout_stop(&sc->wi_stat_timer);
2448
2449         ifp->if_flags &= ~(IFF_RUNNING|IFF_OACTIVE);
2450
2451         WI_UNLOCK(sc, s);
2452         return;
2453 }
2454
2455 static void
2456 wi_watchdog(ifp)
2457         struct ifnet            *ifp;
2458 {
2459         struct wi_softc         *sc;
2460
2461         sc = ifp->if_softc;
2462
2463         device_printf(sc->dev, "watchdog timeout\n");
2464
2465         wi_init(sc);
2466
2467         ifp->if_oerrors++;
2468
2469         return;
2470 }
2471
2472 int
2473 owi_alloc(dev, rid)
2474         device_t                dev;
2475         int                     rid;
2476 {
2477         struct wi_softc         *sc = device_get_softc(dev);
2478
2479         if (sc->wi_bus_type != WI_BUS_PCI_NATIVE) {
2480                 sc->iobase_rid = rid;
2481                 sc->iobase = bus_alloc_resource(dev, SYS_RES_IOPORT,
2482                     &sc->iobase_rid, 0, ~0, (1 << 6),
2483                     rman_make_alignment_flags(1 << 6) | RF_ACTIVE);
2484                 if (!sc->iobase) {
2485                         device_printf(dev, "No I/O space?!\n");
2486                         return (ENXIO);
2487                 }
2488
2489                 sc->wi_io_addr = rman_get_start(sc->iobase);
2490                 sc->wi_btag = rman_get_bustag(sc->iobase);
2491                 sc->wi_bhandle = rman_get_bushandle(sc->iobase);
2492         } else {
2493                 sc->mem_rid = rid;
2494                 sc->mem = bus_alloc_resource(dev, SYS_RES_MEMORY,
2495                     &sc->mem_rid, 0, ~0, 1, RF_ACTIVE);
2496
2497                 if (!sc->mem) {
2498                         device_printf(dev, "No Mem space on prism2.5?\n");
2499                         return (ENXIO);
2500                 }
2501
2502                 sc->wi_btag = rman_get_bustag(sc->mem);
2503                 sc->wi_bhandle = rman_get_bushandle(sc->mem);
2504         }
2505
2506
2507         sc->irq_rid = 0;
2508         sc->irq = bus_alloc_resource(dev, SYS_RES_IRQ, &sc->irq_rid,
2509             0, ~0, 1, RF_ACTIVE |
2510             ((sc->wi_bus_type == WI_BUS_PCCARD) ? 0 : RF_SHAREABLE));
2511
2512         if (!sc->irq) {
2513                 owi_free(dev);
2514                 device_printf(dev, "No irq?!\n");
2515                 return (ENXIO);
2516         }
2517
2518         sc->dev = dev;
2519         sc->wi_unit = device_get_unit(dev);
2520
2521         return (0);
2522 }
2523
2524 void
2525 owi_free(dev)
2526         device_t                dev;
2527 {
2528         struct wi_softc         *sc = device_get_softc(dev);
2529
2530         if (sc->iobase != NULL) {
2531                 bus_release_resource(dev, SYS_RES_IOPORT, sc->iobase_rid, sc->iobase);
2532                 sc->iobase = NULL;
2533         }
2534         if (sc->irq != NULL) {
2535                 bus_release_resource(dev, SYS_RES_IRQ, sc->irq_rid, sc->irq);
2536                 sc->irq = NULL;
2537         }
2538         if (sc->mem != NULL) {
2539                 bus_release_resource(dev, SYS_RES_MEMORY, sc->mem_rid, sc->mem);
2540                 sc->mem = NULL;
2541         }
2542
2543         return;
2544 }
2545
2546 void
2547 owi_shutdown(dev)
2548         device_t                dev;
2549 {
2550         struct wi_softc         *sc;
2551
2552         sc = device_get_softc(dev);
2553         wi_stop(sc);
2554
2555         return;
2556 }
2557
2558 #ifdef WICACHE
2559 /* wavelan signal strength cache code.
2560  * store signal/noise/quality on per MAC src basis in
2561  * a small fixed cache.  The cache wraps if > MAX slots
2562  * used.  The cache may be zeroed out to start over.
2563  * Two simple filters exist to reduce computation:
2564  * 1. ip only (literally 0x800) which may be used
2565  * to ignore some packets.  It defaults to ip only.
2566  * it could be used to focus on broadcast, non-IP 802.11 beacons.
2567  * 2. multicast/broadcast only.  This may be used to
2568  * ignore unicast packets and only cache signal strength
2569  * for multicast/broadcast packets (beacons); e.g., Mobile-IP
2570  * beacons and not unicast traffic.
2571  *
2572  * The cache stores (MAC src(index), IP src (major clue), signal,
2573  *      quality, noise)
2574  *
2575  * No apologies for storing IP src here.  It's easy and saves much
2576  * trouble elsewhere.  The cache is assumed to be INET dependent,
2577  * although it need not be.
2578  */
2579
2580 #ifdef documentation
2581
2582 int owi_sigitems;                                /* number of cached entries */
2583 struct wi_sigcache owi_sigcache[MAXWICACHE];  /*  array of cache entries */
2584 int owi_nextitem;                                /*  index/# of entries */
2585
2586
2587 #endif
2588
2589 /* control variables for cache filtering.  Basic idea is
2590  * to reduce cost (e.g., to only Mobile-IP agent beacons
2591  * which are broadcast or multicast).  Still you might
2592  * want to measure signal strength with unicast ping packets
2593  * on a pt. to pt. ant. setup.
2594  */
2595 /* set true if you want to limit cache items to broadcast/mcast
2596  * only packets (not unicast).  Useful for mobile-ip beacons which
2597  * are broadcast/multicast at network layer.  Default is all packets
2598  * so ping/unicast will work say with pt. to pt. antennae setup.
2599  */
2600 static int wi_cache_mcastonly = 0;
2601 SYSCTL_INT(_machdep, OID_AUTO, owi_cache_mcastonly, CTLFLAG_RW,
2602         &wi_cache_mcastonly, 0, "");
2603
2604 /* set true if you want to limit cache items to IP packets only
2605 */
2606 static int wi_cache_iponly = 1;
2607 SYSCTL_INT(_machdep, OID_AUTO, owi_cache_iponly, CTLFLAG_RW,
2608         &wi_cache_iponly, 0, "");
2609
2610 /*
2611  * Original comments:
2612  * -----------------
2613  * wi_cache_store, per rx packet store signal
2614  * strength in MAC (src) indexed cache.
2615  *
2616  * follows linux driver in how signal strength is computed.
2617  * In ad hoc mode, we use the rx_quality field.
2618  * signal and noise are trimmed to fit in the range from 47..138.
2619  * rx_quality field MSB is signal strength.
2620  * rx_quality field LSB is noise.
2621  * "quality" is (signal - noise) as is log value.
2622  * note: quality CAN be negative.
2623  *
2624  * In BSS mode, we use the RID for communication quality.
2625  * TBD:  BSS mode is currently untested.
2626  *
2627  * Bill's comments:
2628  * ---------------
2629  * Actually, we use the rx_quality field all the time for both "ad-hoc"
2630  * and BSS modes. Why? Because reading an RID is really, really expensive:
2631  * there's a bunch of PIO operations that have to be done to read a record
2632  * from the NIC, and reading the comms quality RID each time a packet is
2633  * received can really hurt performance. We don't have to do this anyway:
2634  * the comms quality field only reflects the values in the rx_quality field
2635  * anyway. The comms quality RID is only meaningful in infrastructure mode,
2636  * but the values it contains are updated based on the rx_quality from
2637  * frames received from the access point.
2638  *
2639  * Also, according to Lucent, the signal strength and noise level values
2640  * can be converted to dBms by subtracting 149, so I've modified the code
2641  * to do that instead of the scaling it did originally.
2642  */
2643 static void
2644 wi_cache_store(struct wi_softc *sc, struct mbuf *m, unsigned short rx_quality)
2645 {
2646         struct ether_header *eh = mtod(m, struct ether_header *);
2647         struct ip *ip = NULL;
2648         int i;
2649         static int cache_slot = 0;      /* use this cache entry */
2650         static int wrapindex = 0;       /* next "free" cache entry */
2651         int sig, noise;
2652
2653         /*
2654          * filters:
2655          * 1. ip only
2656          * 2. configurable filter to throw out unicast packets,
2657          * keep multicast only.
2658          */
2659
2660         if ((ntohs(eh->ether_type) == ETHERTYPE_IP))
2661                 ip = (struct ip *)(mtod(m, uint8_t *) + ETHER_HDR_LEN);
2662         else if (wi_cache_iponly)
2663                 return;
2664
2665         /*
2666          *  filter for broadcast/multicast only
2667          */
2668         if (wi_cache_mcastonly && ((eh->ether_dhost[0] & 1) == 0)) {
2669                 return;
2670         }
2671
2672 #ifdef SIGDEBUG
2673         printf("wi%d: q value %x (MSB=0x%x, LSB=0x%x) \n", sc->wi_unit,
2674             rx_quality & 0xffff, rx_quality >> 8, rx_quality & 0xff);
2675 #endif
2676
2677
2678         /*
2679          * do a linear search for a matching MAC address
2680          * in the cache table
2681          * . MAC address is 6 bytes,
2682          * . var w_nextitem holds total number of entries already cached
2683          */
2684         for(i = 0; i < sc->wi_nextitem; i++) {
2685                 if (! bcmp(eh->ether_shost , sc->wi_sigcache[i].macsrc,  6 )) {
2686                         /*
2687                          * Match!,
2688                          * so we already have this entry,
2689                          * update the data
2690                          */
2691                         break;
2692                 }
2693         }
2694
2695         /*
2696          *  did we find a matching mac address?
2697          * if yes, then overwrite a previously existing cache entry
2698          */
2699         if (i < sc->wi_nextitem )   {
2700                 cache_slot = i;
2701         }
2702         /*
2703          * else, have a new address entry,so
2704          * add this new entry,
2705          * if table full, then we need to replace LRU entry
2706          */
2707         else    {
2708
2709                 /*
2710                  * check for space in cache table
2711                  * note: wi_nextitem also holds number of entries
2712                  * added in the cache table
2713                  */
2714                 if ( sc->wi_nextitem < MAXWICACHE ) {
2715                         cache_slot = sc->wi_nextitem;
2716                         sc->wi_nextitem++;
2717                         sc->wi_sigitems = sc->wi_nextitem;
2718                 }
2719                 /* no space found, so simply wrap with wrap index
2720                  * and "zap" the next entry
2721                  */
2722                 else {
2723                         if (wrapindex == MAXWICACHE) {
2724                                 wrapindex = 0;
2725                         }
2726                         cache_slot = wrapindex++;
2727                 }
2728         }
2729
2730         /*
2731          * invariant: cache_slot now points at some slot
2732          * in cache.
2733          */
2734         if (cache_slot < 0 || cache_slot >= MAXWICACHE) {
2735                 log(LOG_ERR, "wi_cache_store, bad index: %d of "
2736                     "[0..%d], gross cache error\n",
2737                     cache_slot, MAXWICACHE);
2738                 return;
2739         }
2740
2741         /*
2742          *  store items in cache
2743          *  .ip source address
2744          *  .mac src
2745          *  .signal, etc.
2746          */
2747         if (ip != NULL)
2748                 sc->wi_sigcache[cache_slot].ipsrc = ip->ip_src.s_addr;
2749         bcopy( eh->ether_shost, sc->wi_sigcache[cache_slot].macsrc,  6);
2750
2751         sig = (rx_quality >> 8) & 0xFF;
2752         noise = rx_quality & 0xFF;
2753         sc->wi_sigcache[cache_slot].signal = sig - 149;
2754         sc->wi_sigcache[cache_slot].noise = noise - 149;
2755         sc->wi_sigcache[cache_slot].quality = sig - noise;
2756
2757         return;
2758 }
2759 #endif
2760
2761 static int
2762 wi_get_cur_ssid(sc, ssid, len)
2763         struct wi_softc         *sc;
2764         char                    *ssid;
2765         int                     *len;
2766 {
2767         int                     error = 0;
2768         struct wi_req           wreq;
2769
2770         wreq.wi_len = WI_MAX_DATALEN;
2771         switch (sc->wi_ptype) {
2772         case WI_PORTTYPE_AP:
2773                 *len = IEEE80211_NWID_LEN;
2774                 bcopy(sc->wi_net_name, ssid, IEEE80211_NWID_LEN);
2775                 break;
2776         case WI_PORTTYPE_ADHOC:
2777                 wreq.wi_type = WI_RID_CURRENT_SSID;
2778                 error = wi_read_record(sc, (struct wi_ltv_gen *)&wreq);
2779                 if (error != 0)
2780                         break;
2781                 if (wreq.wi_val[0] > IEEE80211_NWID_LEN) {
2782                         error = EINVAL;
2783                         break;
2784                 }
2785                 *len = wreq.wi_val[0];
2786                 bcopy(&wreq.wi_val[1], ssid, IEEE80211_NWID_LEN);
2787                 break;
2788         case WI_PORTTYPE_BSS:
2789                 wreq.wi_type = WI_RID_COMMQUAL;
2790                 error = wi_read_record(sc, (struct wi_ltv_gen *)&wreq);
2791                 if (error != 0)
2792                         break;
2793                 if (wreq.wi_val[0] != 0) /* associated */ {
2794                         wreq.wi_type = WI_RID_CURRENT_SSID;
2795                         wreq.wi_len = WI_MAX_DATALEN;
2796                         error = wi_read_record(sc, (struct wi_ltv_gen *)&wreq);
2797                         if (error != 0)
2798                                 break;
2799                         if (wreq.wi_val[0] > IEEE80211_NWID_LEN) {
2800                                 error = EINVAL;
2801                                 break;
2802                         }
2803                         *len = wreq.wi_val[0];
2804                         bcopy(&wreq.wi_val[1], ssid, IEEE80211_NWID_LEN);
2805                 } else {
2806                         *len = IEEE80211_NWID_LEN;
2807                         bcopy(sc->wi_net_name, ssid, IEEE80211_NWID_LEN);
2808                 }
2809                 break;
2810         default:
2811                 error = EINVAL;
2812                 break;
2813         }
2814
2815         return error;
2816 }
2817
2818 static int
2819 wi_media_change(ifp)
2820         struct ifnet            *ifp;
2821 {
2822         struct wi_softc         *sc = ifp->if_softc;
2823         int                     otype = sc->wi_ptype;
2824         int                     orate = sc->wi_tx_rate;
2825         int                     ocreate_ibss = sc->wi_create_ibss;
2826
2827         if ((sc->ifmedia.ifm_cur->ifm_media & IFM_IEEE80211_HOSTAP) &&
2828             sc->sc_firmware_type != WI_INTERSIL)
2829                 return (EINVAL);
2830
2831         sc->wi_create_ibss = 0;
2832
2833         switch (sc->ifmedia.ifm_cur->ifm_media & IFM_OMASK) {
2834         case 0:
2835                 sc->wi_ptype = WI_PORTTYPE_BSS;
2836                 break;
2837         case IFM_IEEE80211_ADHOC:
2838                 sc->wi_ptype = WI_PORTTYPE_ADHOC;
2839                 break;
2840         case IFM_IEEE80211_HOSTAP:
2841                 sc->wi_ptype = WI_PORTTYPE_AP;
2842                 break;
2843         case IFM_IEEE80211_IBSSMASTER:
2844         case IFM_IEEE80211_IBSSMASTER|IFM_IEEE80211_IBSS:
2845                 if (!(sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS))
2846                         return (EINVAL);
2847                 sc->wi_create_ibss = 1;
2848                 /* FALLTHROUGH */
2849         case IFM_IEEE80211_IBSS:
2850                 sc->wi_ptype = WI_PORTTYPE_IBSS;
2851                 break;
2852         default:
2853                 /* Invalid combination. */
2854                 return (EINVAL);
2855         }
2856
2857         switch (IFM_SUBTYPE(sc->ifmedia.ifm_cur->ifm_media)) {
2858         case IFM_IEEE80211_DS1:
2859                 sc->wi_tx_rate = 1;
2860                 break;
2861         case IFM_IEEE80211_DS2:
2862                 sc->wi_tx_rate = 2;
2863                 break;
2864         case IFM_IEEE80211_DS5:
2865                 sc->wi_tx_rate = 5;
2866                 break;
2867         case IFM_IEEE80211_DS11:
2868                 sc->wi_tx_rate = 11;
2869                 break;
2870         case IFM_AUTO:
2871                 sc->wi_tx_rate = 3;
2872                 break;
2873         }
2874
2875         if (ocreate_ibss != sc->wi_create_ibss || otype != sc->wi_ptype ||
2876             orate != sc->wi_tx_rate)
2877                 wi_init(sc);
2878
2879         return(0);
2880 }
2881
2882 static void
2883 wi_media_status(ifp, imr)
2884         struct ifnet            *ifp;
2885         struct ifmediareq       *imr;
2886 {
2887         struct wi_req           wreq;
2888         struct wi_softc         *sc = ifp->if_softc;
2889
2890         if (sc->wi_tx_rate == 3) {
2891                 imr->ifm_active = IFM_IEEE80211|IFM_AUTO;
2892                 if (sc->wi_ptype == WI_PORTTYPE_ADHOC)
2893                         imr->ifm_active |= IFM_IEEE80211_ADHOC;
2894                 else if (sc->wi_ptype == WI_PORTTYPE_AP)
2895                         imr->ifm_active |= IFM_IEEE80211_HOSTAP;
2896                 else if (sc->wi_ptype == WI_PORTTYPE_IBSS) {
2897                         if (sc->wi_create_ibss)
2898                                 imr->ifm_active |= IFM_IEEE80211_IBSSMASTER;
2899                         else
2900                                 imr->ifm_active |= IFM_IEEE80211_IBSS;
2901                 }
2902                 wreq.wi_type = WI_RID_CUR_TX_RATE;
2903                 wreq.wi_len = WI_MAX_DATALEN;
2904                 if (wi_read_record(sc, (struct wi_ltv_gen *)&wreq) == 0) {
2905                         switch(wreq.wi_val[0]) {
2906                         case 1:
2907                                 imr->ifm_active |= IFM_IEEE80211_DS1;
2908                                 break;
2909                         case 2:
2910                                 imr->ifm_active |= IFM_IEEE80211_DS2;
2911                                 break;
2912                         case 6:
2913                                 imr->ifm_active |= IFM_IEEE80211_DS5;
2914                                 break;
2915                         case 11:
2916                                 imr->ifm_active |= IFM_IEEE80211_DS11;
2917                                 break;
2918                                 }
2919                 }
2920         } else {
2921                 imr->ifm_active = sc->ifmedia.ifm_cur->ifm_media;
2922         }
2923
2924         imr->ifm_status = IFM_AVALID;
2925         if (sc->wi_ptype == WI_PORTTYPE_ADHOC ||
2926             sc->wi_ptype == WI_PORTTYPE_IBSS)
2927                 /*
2928                  * XXX: It would be nice if we could give some actually
2929                  * useful status like whether we joined another IBSS or
2930                  * created one ourselves.
2931                  */
2932                 imr->ifm_status |= IFM_ACTIVE;
2933         else if (sc->wi_ptype == WI_PORTTYPE_AP)
2934                 imr->ifm_status |= IFM_ACTIVE;
2935         else {
2936                 wreq.wi_type = WI_RID_COMMQUAL;
2937                 wreq.wi_len = WI_MAX_DATALEN;
2938                 if (wi_read_record(sc, (struct wi_ltv_gen *)&wreq) == 0 &&
2939                     wreq.wi_val[0] != 0)
2940                         imr->ifm_status |= IFM_ACTIVE;
2941         }
2942 }
2943
2944 static int
2945 wi_get_debug(sc, wreq)
2946         struct wi_softc         *sc;
2947         struct wi_req           *wreq;
2948 {
2949         int                     error = 0;
2950
2951         wreq->wi_len = 1;
2952
2953         switch (wreq->wi_type) {
2954         case WI_DEBUG_SLEEP:
2955                 wreq->wi_len++;
2956                 wreq->wi_val[0] = sc->wi_debug.wi_sleep;
2957                 break;
2958         case WI_DEBUG_DELAYSUPP:
2959                 wreq->wi_len++;
2960                 wreq->wi_val[0] = sc->wi_debug.wi_delaysupp;
2961                 break;
2962         case WI_DEBUG_TXSUPP:
2963                 wreq->wi_len++;
2964                 wreq->wi_val[0] = sc->wi_debug.wi_txsupp;
2965                 break;
2966         case WI_DEBUG_MONITOR:
2967                 wreq->wi_len++;
2968                 wreq->wi_val[0] = sc->wi_debug.wi_monitor;
2969                 break;
2970         case WI_DEBUG_LEDTEST:
2971                 wreq->wi_len += 3;
2972                 wreq->wi_val[0] = sc->wi_debug.wi_ledtest;
2973                 wreq->wi_val[1] = sc->wi_debug.wi_ledtest_param0;
2974                 wreq->wi_val[2] = sc->wi_debug.wi_ledtest_param1;
2975                 break;
2976         case WI_DEBUG_CONTTX:
2977                 wreq->wi_len += 2;
2978                 wreq->wi_val[0] = sc->wi_debug.wi_conttx;
2979                 wreq->wi_val[1] = sc->wi_debug.wi_conttx_param0;
2980                 break;
2981         case WI_DEBUG_CONTRX:
2982                 wreq->wi_len++;
2983                 wreq->wi_val[0] = sc->wi_debug.wi_contrx;
2984                 break;
2985         case WI_DEBUG_SIGSTATE:
2986                 wreq->wi_len += 2;
2987                 wreq->wi_val[0] = sc->wi_debug.wi_sigstate;
2988                 wreq->wi_val[1] = sc->wi_debug.wi_sigstate_param0;
2989                 break;
2990         case WI_DEBUG_CONFBITS:
2991                 wreq->wi_len += 2;
2992                 wreq->wi_val[0] = sc->wi_debug.wi_confbits;
2993                 wreq->wi_val[1] = sc->wi_debug.wi_confbits_param0;
2994                 break;
2995         default:
2996                 error = EIO;
2997                 break;
2998         }
2999
3000         return (error);
3001 }
3002
3003 static int
3004 wi_set_debug(sc, wreq)
3005         struct wi_softc         *sc;
3006         struct wi_req           *wreq;
3007 {
3008         int                     error = 0;
3009         u_int16_t               cmd, param0 = 0, param1 = 0;
3010
3011         switch (wreq->wi_type) {
3012         case WI_DEBUG_RESET:
3013         case WI_DEBUG_INIT:
3014         case WI_DEBUG_CALENABLE:
3015                 break;
3016         case WI_DEBUG_SLEEP:
3017                 sc->wi_debug.wi_sleep = 1;
3018                 break;
3019         case WI_DEBUG_WAKE:
3020                 sc->wi_debug.wi_sleep = 0;
3021                 break;
3022         case WI_DEBUG_CHAN:
3023                 param0 = wreq->wi_val[0];
3024                 break;
3025         case WI_DEBUG_DELAYSUPP:
3026                 sc->wi_debug.wi_delaysupp = 1;
3027                 break;
3028         case WI_DEBUG_TXSUPP:
3029                 sc->wi_debug.wi_txsupp = 1;
3030                 break;
3031         case WI_DEBUG_MONITOR:
3032                 sc->wi_debug.wi_monitor = 1;
3033                 break;
3034         case WI_DEBUG_LEDTEST:
3035                 param0 = wreq->wi_val[0];
3036                 param1 = wreq->wi_val[1];
3037                 sc->wi_debug.wi_ledtest = 1;
3038                 sc->wi_debug.wi_ledtest_param0 = param0;
3039                 sc->wi_debug.wi_ledtest_param1 = param1;
3040                 break;
3041         case WI_DEBUG_CONTTX:
3042                 param0 = wreq->wi_val[0];
3043                 sc->wi_debug.wi_conttx = 1;
3044                 sc->wi_debug.wi_conttx_param0 = param0;
3045                 break;
3046         case WI_DEBUG_STOPTEST:
3047                 sc->wi_debug.wi_delaysupp = 0;
3048                 sc->wi_debug.wi_txsupp = 0;
3049                 sc->wi_debug.wi_monitor = 0;
3050                 sc->wi_debug.wi_ledtest = 0;
3051                 sc->wi_debug.wi_ledtest_param0 = 0;
3052                 sc->wi_debug.wi_ledtest_param1 = 0;
3053                 sc->wi_debug.wi_conttx = 0;
3054                 sc->wi_debug.wi_conttx_param0 = 0;
3055                 sc->wi_debug.wi_contrx = 0;
3056                 sc->wi_debug.wi_sigstate = 0;
3057                 sc->wi_debug.wi_sigstate_param0 = 0;
3058                 break;
3059         case WI_DEBUG_CONTRX:
3060                 sc->wi_debug.wi_contrx = 1;
3061                 break;
3062         case WI_DEBUG_SIGSTATE:
3063                 param0 = wreq->wi_val[0];
3064                 sc->wi_debug.wi_sigstate = 1;
3065                 sc->wi_debug.wi_sigstate_param0 = param0;
3066                 break;
3067         case WI_DEBUG_CONFBITS:
3068                 param0 = wreq->wi_val[0];
3069                 param1 = wreq->wi_val[1];
3070                 sc->wi_debug.wi_confbits = param0;
3071                 sc->wi_debug.wi_confbits_param0 = param1;
3072                 break;
3073         default:
3074                 error = EIO;
3075                 break;
3076         }
3077
3078         if (error)
3079                 return (error);
3080
3081         cmd = WI_CMD_DEBUG | (wreq->wi_type << 8);
3082         error = wi_cmd(sc, cmd, param0, param1, 0);
3083
3084         return (error);
3085 }