sys/dev/netif/wi/if_wi.c

   1 /*
   2  * Copyright (c) 1997, 1998, 1999
   3  *      Bill Paul <wpaul@ctr.columbia.edu>.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  * 3. All advertising materials mentioning features or use of this software
  14  *    must display the following acknowledgement:
  15  *      This product includes software developed by Bill Paul.
  16  * 4. Neither the name of the author nor the names of any co-contributors
  17  *    may be used to endorse or promote products derived from this software
  18  *    without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
  21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
  24  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  30  * THE POSSIBILITY OF SUCH DAMAGE.
  31  *
  32  * $FreeBSD: src/sys/dev/wi/if_wi.c,v 1.103.2.2 2002/08/02 07:11:34 imp Exp $
  33  * $DragonFly: src/sys/dev/netif/wi/if_wi.c,v 1.12 2004/06/25 09:13:30 joerg Exp $
  34  */
  35
  36 /*
  37  * Lucent WaveLAN/IEEE 802.11 PCMCIA driver for FreeBSD.
  38  *
  39  * Written by Bill Paul <wpaul@ctr.columbia.edu>
  40  * Electrical Engineering Department
  41  * Columbia University, New York City
  42  */
  43
  44 /*
  45  * The WaveLAN/IEEE adapter is the second generation of the WaveLAN
  46  * from Lucent. Unlike the older cards, the new ones are programmed
  47  * entirely via a firmware-driven controller called the Hermes.
  48  * Unfortunately, Lucent will not release the Hermes programming manual
  49  * without an NDA (if at all). What they do release is an API library
  50  * called the HCF (Hardware Control Functions) which is supposed to
  51  * do the device-specific operations of a device driver for you. The
  52  * publically available version of the HCF library (the 'HCF Light') is
  53  * a) extremely gross, b) lacks certain features, particularly support
  54  * for 802.11 frames, and c) is contaminated by the GNU Public License.
  55  *
  56  * This driver does not use the HCF or HCF Light at all. Instead, it
  57  * programs the Hermes controller directly, using information gleaned
  58  * from the HCF Light code and corresponding documentation.
  59  *
  60  * This driver supports the ISA, PCMCIA and PCI versions of the Lucent
  61  * WaveLan cards (based on the Hermes chipset), as well as the newer
  62  * Prism 2 chipsets with firmware from Intersil and Symbol.
  63  */
  64
  65 #include <sys/param.h>
  66 #include <sys/systm.h>
  67 #if defined(__FreeBSD__) && __FreeBSD_version >= 500033
  68 #include <sys/endian.h>
  69 #endif
  70 #include <sys/sockio.h>
  71 #include <sys/mbuf.h>
  72 #include <sys/proc.h>
  73 #include <sys/kernel.h>
  74 #include <sys/socket.h>
  75 #include <sys/module.h>
  76 #include <sys/bus.h>
  77 #include <sys/random.h>
  78 #include <sys/syslog.h>
  79 #include <sys/sysctl.h>
  80
  81 #include <machine/bus.h>
  82 #include <machine/resource.h>
  83 #include <machine/clock.h>
  84 #include <sys/rman.h>
  85
  86 #include <net/if.h>
  87 #include <net/if_arp.h>
  88 #include <net/ethernet.h>
  89 #include <net/if_dl.h>
  90 #include <net/if_media.h>
  91 #include <net/if_types.h>
  92 #include <net/if_ieee80211.h>
  93
  94 #include <netinet/in.h>
  95 #include <netinet/in_systm.h>
  96 #include <netinet/in_var.h>
  97 #include <netinet/ip.h>
  98 #include <netinet/if_ether.h>
  99
 100 #include <net/bpf.h>
 101
 102 #include "if_wavelan_ieee.h"
 103 #include "wi_hostap.h"
 104 #include "if_wivar.h"
 105 #include "if_wireg.h"
 106
 107 static void wi_intr(void *);
 108 static void wi_reset(struct wi_softc *);
 109 static int wi_ioctl(struct ifnet *, u_long, caddr_t, struct ucred *);
 110 static void wi_init(void *);
 111 static void wi_start(struct ifnet *);
 112 static void wi_stop(struct wi_softc *);
 113 static void wi_watchdog(struct ifnet *);
 114 static void wi_rxeof(struct wi_softc *);
 115 static void wi_txeof(struct wi_softc *, int);
 116 static void wi_update_stats(struct wi_softc *);
 117 static void wi_setmulti(struct wi_softc *);
 118
 119 static int wi_cmd(struct wi_softc *, int, int, int, int);
 120 static int wi_read_record(struct wi_softc *, struct wi_ltv_gen *);
 121 static int wi_write_record(struct wi_softc *, struct wi_ltv_gen *);
 122 static int wi_read_data(struct wi_softc *, int, int, caddr_t, int);
 123 static int wi_write_data(struct wi_softc *, int, int, caddr_t, int);
 124 static int wi_seek(struct wi_softc *, int, int, int);
 125 static int wi_alloc_nicmem(struct wi_softc *, int, int *);
 126 static void wi_inquire(void *);
 127 static void wi_setdef(struct wi_softc *, struct wi_req *);
 128
 129 #ifdef WICACHE
 130 static
 131 void wi_cache_store(struct wi_softc *, struct ether_header *,
 132         struct mbuf *, unsigned short);
 133 #endif
 134
 135 static int wi_get_cur_ssid(struct wi_softc *, char *, int *);
 136 static void wi_get_id(struct wi_softc *);
 137 static int wi_media_change(struct ifnet *);
 138 static void wi_media_status(struct ifnet *, struct ifmediareq *);
 139
 140 static int wi_get_debug(struct wi_softc *, struct wi_req *);
 141 static int wi_set_debug(struct wi_softc *, struct wi_req *);
 142
 143 DECLARE_DUMMY_MODULE(if_wi);
 144
 145 devclass_t wi_devclass;
 146
 147 struct wi_card_ident wi_card_ident[] = {
 148         /* CARD_ID                      CARD_NAME               FIRM_TYPE */
 149         { WI_NIC_LUCENT_ID,             WI_NIC_LUCENT_STR,      WI_LUCENT },
 150         { WI_NIC_SONY_ID,               WI_NIC_SONY_STR,        WI_LUCENT },
 151         { WI_NIC_LUCENT_EMB_ID,         WI_NIC_LUCENT_EMB_STR,  WI_LUCENT },
 152         { WI_NIC_EVB2_ID,               WI_NIC_EVB2_STR,        WI_INTERSIL },
 153         { WI_NIC_HWB3763_ID,            WI_NIC_HWB3763_STR,     WI_INTERSIL },
 154         { WI_NIC_HWB3163_ID,            WI_NIC_HWB3163_STR,     WI_INTERSIL },
 155         { WI_NIC_HWB3163B_ID,           WI_NIC_HWB3163B_STR,    WI_INTERSIL },
 156         { WI_NIC_EVB3_ID,               WI_NIC_EVB3_STR,        WI_INTERSIL },
 157         { WI_NIC_HWB1153_ID,            WI_NIC_HWB1153_STR,     WI_INTERSIL },
 158         { WI_NIC_P2_SST_ID,             WI_NIC_P2_SST_STR,      WI_INTERSIL },
 159         { WI_NIC_EVB2_SST_ID,           WI_NIC_EVB2_SST_STR,    WI_INTERSIL },
 160         { WI_NIC_3842_EVA_ID,           WI_NIC_3842_EVA_STR,    WI_INTERSIL },
 161         { WI_NIC_3842_PCMCIA_AMD_ID,    WI_NIC_3842_PCMCIA_STR, WI_INTERSIL },
 162         { WI_NIC_3842_PCMCIA_SST_ID,    WI_NIC_3842_PCMCIA_STR, WI_INTERSIL },
 163         { WI_NIC_3842_PCMCIA_ATM_ID,    WI_NIC_3842_PCMCIA_STR, WI_INTERSIL },
 164         { WI_NIC_3842_MINI_AMD_ID,      WI_NIC_3842_MINI_STR,   WI_INTERSIL },
 165         { WI_NIC_3842_MINI_SST_ID,      WI_NIC_3842_MINI_STR,   WI_INTERSIL },
 166         { WI_NIC_3842_MINI_ATM_ID,      WI_NIC_3842_MINI_STR,   WI_INTERSIL },
 167         { WI_NIC_3842_PCI_AMD_ID,       WI_NIC_3842_PCI_STR,    WI_INTERSIL },
 168         { WI_NIC_3842_PCI_SST_ID,       WI_NIC_3842_PCI_STR,    WI_INTERSIL },
 169         { WI_NIC_3842_PCI_ATM_ID,       WI_NIC_3842_PCI_STR,    WI_INTERSIL },
 170         { WI_NIC_P3_PCMCIA_AMD_ID,      WI_NIC_P3_PCMCIA_STR,   WI_INTERSIL },
 171         { WI_NIC_P3_PCMCIA_SST_ID,      WI_NIC_P3_PCMCIA_STR,   WI_INTERSIL },
 172         { WI_NIC_P3_MINI_AMD_ID,        WI_NIC_P3_MINI_STR,     WI_INTERSIL },
 173         { WI_NIC_P3_MINI_SST_ID,        WI_NIC_P3_MINI_STR,     WI_INTERSIL },
 174         { 0,    NULL,   0 },
 175 };
 176
 177 int
 178 wi_generic_detach(dev)
 179         device_t                dev;
 180 {
 181         struct wi_softc         *sc;
 182         struct ifnet            *ifp;
 183         int                     s;
 184
 185         sc = device_get_softc(dev);
 186         WI_LOCK(sc, s);
 187         ifp = &sc->arpcom.ac_if;
 188
 189         if (sc->wi_gone) {
 190                 device_printf(dev, "already unloaded\n");
 191                 WI_UNLOCK(sc, s);
 192                 return(ENODEV);
 193         }
 194
 195         wi_stop(sc);
 196
 197         /* Delete all remaining media. */
 198         ifmedia_removeall(&sc->ifmedia);
 199
 200         ether_ifdetach(ifp);
 201         bus_teardown_intr(dev, sc->irq, sc->wi_intrhand);
 202         wi_free(dev);
 203         sc->wi_gone = 1;
 204
 205         WI_UNLOCK(sc, s);
 206 #if defined(__FreeBSD__) && __FreeBSD_version >= 500000
 207         mtx_destroy(&sc->wi_mtx);
 208 #endif
 209
 210         return(0);
 211 }
 212
 213 int
 214 wi_generic_attach(device_t dev)
 215 {
 216         struct wi_softc         *sc;
 217         struct wi_ltv_macaddr   mac;
 218         struct wi_ltv_gen       gen;
 219         struct ifnet            *ifp;
 220         int                     error;
 221         int                     s;
 222
 223         /* XXX maybe we need the splimp stuff here XXX */
 224         sc = device_get_softc(dev);
 225         ifp = &sc->arpcom.ac_if;
 226
 227         error = bus_setup_intr(dev, sc->irq, INTR_TYPE_NET,
 228             wi_intr, sc, &sc->wi_intrhand);
 229
 230         if (error) {
 231                 device_printf(dev, "bus_setup_intr() failed! (%d)\n", error);
 232                 wi_free(dev);
 233                 return (error);
 234         }
 235
 236 #if defined(__FreeBSD__) && __FreeBSD_version >= 500000
 237         mtx_init(&sc->wi_mtx, device_get_nameunit(dev), MTX_NETWORK_LOCK,
 238             MTX_DEF | MTX_RECURSE);
 239 #endif
 240         WI_LOCK(sc, s);
 241
 242         /* Reset the NIC. */
 243         wi_reset(sc);
 244
 245         /*
 246          * Read the station address.
 247          * And do it twice. I've seen PRISM-based cards that return
 248          * an error when trying to read it the first time, which causes
 249          * the probe to fail.
 250          */
 251         mac.wi_type = WI_RID_MAC_NODE;
 252         mac.wi_len = 4;
 253         wi_read_record(sc, (struct wi_ltv_gen *)&mac);
 254         if ((error = wi_read_record(sc, (struct wi_ltv_gen *)&mac)) != 0) {
 255                 device_printf(dev, "mac read failed %d\n", error);
 256                 wi_free(dev);
 257                 WI_UNLOCK(sc, s);
 258                 return (error);
 259         }
 260         bcopy((char *)&mac.wi_mac_addr,
 261            (char *)&sc->arpcom.ac_enaddr, ETHER_ADDR_LEN);
 262
 263         device_printf(dev, "802.11 address: %6D\n", sc->arpcom.ac_enaddr, ":");
 264
 265         wi_get_id(sc);
 266
 267         ifp->if_softc = sc;
 268         if_initname(ifp, "wi", sc->wi_unit);
 269         ifp->if_mtu = ETHERMTU;
 270         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
 271         ifp->if_ioctl = wi_ioctl;
 272         ifp->if_output = ether_output;
 273         ifp->if_start = wi_start;
 274         ifp->if_watchdog = wi_watchdog;
 275         ifp->if_init = wi_init;
 276         ifp->if_baudrate = 10000000;
 277         ifp->if_snd.ifq_maxlen = IFQ_MAXLEN;
 278
 279         bzero(sc->wi_node_name, sizeof(sc->wi_node_name));
 280         bcopy(WI_DEFAULT_NODENAME, sc->wi_node_name,
 281             sizeof(WI_DEFAULT_NODENAME) - 1);
 282
 283         bzero(sc->wi_net_name, sizeof(sc->wi_net_name));
 284         bcopy(WI_DEFAULT_NETNAME, sc->wi_net_name,
 285             sizeof(WI_DEFAULT_NETNAME) - 1);
 286
 287         bzero(sc->wi_ibss_name, sizeof(sc->wi_ibss_name));
 288         bcopy(WI_DEFAULT_IBSS, sc->wi_ibss_name,
 289             sizeof(WI_DEFAULT_IBSS) - 1);
 290
 291         sc->wi_portnum = WI_DEFAULT_PORT;
 292         sc->wi_ptype = WI_PORTTYPE_BSS;
 293         sc->wi_ap_density = WI_DEFAULT_AP_DENSITY;
 294         sc->wi_rts_thresh = WI_DEFAULT_RTS_THRESH;
 295         sc->wi_tx_rate = WI_DEFAULT_TX_RATE;
 296         sc->wi_max_data_len = WI_DEFAULT_DATALEN;
 297         sc->wi_create_ibss = WI_DEFAULT_CREATE_IBSS;
 298         sc->wi_pm_enabled = WI_DEFAULT_PM_ENABLED;
 299         sc->wi_max_sleep = WI_DEFAULT_MAX_SLEEP;
 300         sc->wi_roaming = WI_DEFAULT_ROAMING;
 301         sc->wi_authtype = WI_DEFAULT_AUTHTYPE;
 302         sc->wi_authmode = IEEE80211_AUTH_OPEN;
 303
 304         /*
 305          * Read the default channel from the NIC. This may vary
 306          * depending on the country where the NIC was purchased, so
 307          * we can't hard-code a default and expect it to work for
 308          * everyone.
 309          */
 310         gen.wi_type = WI_RID_OWN_CHNL;
 311         gen.wi_len = 2;
 312         wi_read_record(sc, &gen);
 313         sc->wi_channel = gen.wi_val;
 314
 315         /*
 316          * Set flags based on firmware version.
 317          */
 318         switch (sc->sc_firmware_type) {
 319         case WI_LUCENT:
 320                 sc->wi_flags |= WI_FLAGS_HAS_ROAMING;
 321                 if (sc->sc_sta_firmware_ver >= 60000)
 322                         sc->wi_flags |= WI_FLAGS_HAS_MOR;
 323                 if (sc->sc_sta_firmware_ver >= 60006) {
 324                         sc->wi_flags |= WI_FLAGS_HAS_IBSS;
 325                         sc->wi_flags |= WI_FLAGS_HAS_CREATE_IBSS;
 326                 }
 327                 sc->wi_ibss_port = htole16(1);
 328                 break;
 329         case WI_INTERSIL:
 330                 sc->wi_flags |= WI_FLAGS_HAS_ROAMING;
 331                 if (sc->sc_sta_firmware_ver >= 800) {
 332                         sc->wi_flags |= WI_FLAGS_HAS_IBSS;
 333                         sc->wi_flags |= WI_FLAGS_HAS_CREATE_IBSS;
 334                 }
 335                 /*
 336                  * version 0.8.3 and newer are the only ones that are known
 337                  * to currently work.  Earlier versions can be made to work,
 338                  * at least according to the Linux driver.
 339                  */
 340                 if (sc->sc_sta_firmware_ver >= 803)
 341                         sc->wi_flags |= WI_FLAGS_HAS_HOSTAP;
 342                 sc->wi_ibss_port = htole16(0);
 343                 break;
 344         case WI_SYMBOL:
 345                 sc->wi_flags |= WI_FLAGS_HAS_DIVERSITY;
 346                 if (sc->sc_sta_firmware_ver >= 20000)
 347                         sc->wi_flags |= WI_FLAGS_HAS_IBSS;
 348                 /* Older Symbol firmware does not support IBSS creation. */
 349                 if (sc->sc_sta_firmware_ver >= 25000)
 350                         sc->wi_flags |= WI_FLAGS_HAS_CREATE_IBSS;
 351                 sc->wi_ibss_port = htole16(4);
 352                 break;
 353         }
 354
 355         /*
 356          * Find out if we support WEP on this card.
 357          */
 358         gen.wi_type = WI_RID_WEP_AVAIL;
 359         gen.wi_len = 2;
 360         wi_read_record(sc, &gen);
 361         sc->wi_has_wep = gen.wi_val;
 362
 363         if (bootverbose)
 364                 device_printf(sc->dev, "wi_has_wep = %d\n", sc->wi_has_wep);
 365
 366         /*
 367          * Find supported rates.
 368          */
 369         gen.wi_type = WI_RID_DATA_RATES;
 370         gen.wi_len = 2;
 371         if (wi_read_record(sc, &gen))
 372                 sc->wi_supprates = WI_SUPPRATES_1M | WI_SUPPRATES_2M |
 373                     WI_SUPPRATES_5M | WI_SUPPRATES_11M;
 374         else
 375                 sc->wi_supprates = gen.wi_val;
 376
 377         bzero((char *)&sc->wi_stats, sizeof(sc->wi_stats));
 378
 379         wi_init(sc);
 380         wi_stop(sc);
 381
 382         ifmedia_init(&sc->ifmedia, 0, wi_media_change, wi_media_status);
 383 #define ADD(m, c)       ifmedia_add(&sc->ifmedia, (m), (c), NULL)
 384         if (sc->wi_supprates & WI_SUPPRATES_1M) {
 385                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1, 0, 0), 0);
 386                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1,
 387                     IFM_IEEE80211_ADHOC, 0), 0);
 388                 if (sc->wi_flags & WI_FLAGS_HAS_IBSS)
 389                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1,
 390                             IFM_IEEE80211_IBSS, 0), 0);
 391                 if (sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS)
 392                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1,
 393                             IFM_IEEE80211_IBSSMASTER, 0), 0);
 394                 if (sc->wi_flags & WI_FLAGS_HAS_HOSTAP)
 395                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1,
 396                             IFM_IEEE80211_HOSTAP, 0), 0);
 397         }
 398         if (sc->wi_supprates & WI_SUPPRATES_2M) {
 399                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2, 0, 0), 0);
 400                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2,
 401                     IFM_IEEE80211_ADHOC, 0), 0);
 402                 if (sc->wi_flags & WI_FLAGS_HAS_IBSS)
 403                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2,
 404                             IFM_IEEE80211_IBSS, 0), 0);
 405                 if (sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS)
 406                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2,
 407                             IFM_IEEE80211_IBSSMASTER, 0), 0);
 408                 if (sc->wi_flags & WI_FLAGS_HAS_HOSTAP)
 409                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2,
 410                             IFM_IEEE80211_HOSTAP, 0), 0);
 411         }
 412         if (sc->wi_supprates & WI_SUPPRATES_5M) {
 413                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5, 0, 0), 0);
 414                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5,
 415                     IFM_IEEE80211_ADHOC, 0), 0);
 416                 if (sc->wi_flags & WI_FLAGS_HAS_IBSS)
 417                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5,
 418                             IFM_IEEE80211_IBSS, 0), 0);
 419                 if (sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS)
 420                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5,
 421                             IFM_IEEE80211_IBSSMASTER, 0), 0);
 422                 if (sc->wi_flags & WI_FLAGS_HAS_HOSTAP)
 423                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5,
 424                             IFM_IEEE80211_HOSTAP, 0), 0);
 425         }
 426         if (sc->wi_supprates & WI_SUPPRATES_11M) {
 427                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11, 0, 0), 0);
 428                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11,
 429                     IFM_IEEE80211_ADHOC, 0), 0);
 430                 if (sc->wi_flags & WI_FLAGS_HAS_IBSS)
 431                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11,
 432                             IFM_IEEE80211_IBSS, 0), 0);
 433                 if (sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS)
 434                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11,
 435                             IFM_IEEE80211_IBSSMASTER, 0), 0);
 436                 if (sc->wi_flags & WI_FLAGS_HAS_HOSTAP)
 437                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11,
 438                             IFM_IEEE80211_HOSTAP, 0), 0);
 439                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_MANUAL, 0, 0), 0);
 440         }
 441         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO, IFM_IEEE80211_ADHOC, 0), 0);
 442         if (sc->wi_flags & WI_FLAGS_HAS_IBSS)
 443                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO, IFM_IEEE80211_IBSS,
 444                     0), 0);
 445         if (sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS)
 446                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO,
 447                     IFM_IEEE80211_IBSSMASTER, 0), 0);
 448         if (sc->wi_flags & WI_FLAGS_HAS_HOSTAP)
 449                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO,
 450                     IFM_IEEE80211_HOSTAP, 0), 0);
 451         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO, 0, 0), 0);
 452 #undef ADD
 453         ifmedia_set(&sc->ifmedia, IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO, 0, 0));
 454
 455         /*
 456          * Call MI attach routine.
 457          */
 458         ether_ifattach(ifp, sc->arpcom.ac_enaddr);
 459         callout_handle_init(&sc->wi_stat_ch);
 460         WI_UNLOCK(sc, s);
 461
 462         return(0);
 463 }
 464
 465 static void
 466 wi_get_id(sc)
 467         struct wi_softc *sc;
 468 {
 469         struct wi_ltv_ver       ver;
 470         struct wi_card_ident    *id;
 471
 472         /* getting chip identity */
 473         memset(&ver, 0, sizeof(ver));
 474         ver.wi_type = WI_RID_CARD_ID;
 475         ver.wi_len = 5;
 476         wi_read_record(sc, (struct wi_ltv_gen *)&ver);
 477         device_printf(sc->dev, "using ");
 478         sc->sc_firmware_type = WI_NOTYPE;
 479         for (id = wi_card_ident; id->card_name != NULL; id++) {
 480                 if (le16toh(ver.wi_ver[0]) == id->card_id) {
 481                         printf("%s", id->card_name);
 482                         sc->sc_firmware_type = id->firm_type;
 483                         break;
 484                 }
 485         }
 486         if (sc->sc_firmware_type == WI_NOTYPE) {
 487                 if (le16toh(ver.wi_ver[0]) & 0x8000) {
 488                         printf("Unknown PRISM2 chip");
 489                         sc->sc_firmware_type = WI_INTERSIL;
 490                 } else {
 491                         printf("Unknown Lucent chip");
 492                         sc->sc_firmware_type = WI_LUCENT;
 493                 }
 494         }
 495
 496         if (sc->sc_firmware_type != WI_LUCENT) {
 497                 /* get primary firmware version */
 498                 memset(&ver, 0, sizeof(ver));
 499                 ver.wi_type = WI_RID_PRI_IDENTITY;
 500                 ver.wi_len = 5;
 501                 wi_read_record(sc, (struct wi_ltv_gen *)&ver);
 502                 ver.wi_ver[1] = le16toh(ver.wi_ver[1]);
 503                 ver.wi_ver[2] = le16toh(ver.wi_ver[2]);
 504                 ver.wi_ver[3] = le16toh(ver.wi_ver[3]);
 505                 sc->sc_pri_firmware_ver = ver.wi_ver[2] * 10000 +
 506                     ver.wi_ver[3] * 100 + ver.wi_ver[1];
 507         }
 508
 509         /* get station firmware version */
 510         memset(&ver, 0, sizeof(ver));
 511         ver.wi_type = WI_RID_STA_IDENTITY;
 512         ver.wi_len = 5;
 513         wi_read_record(sc, (struct wi_ltv_gen *)&ver);
 514         ver.wi_ver[1] = le16toh(ver.wi_ver[1]);
 515         ver.wi_ver[2] = le16toh(ver.wi_ver[2]);
 516         ver.wi_ver[3] = le16toh(ver.wi_ver[3]);
 517         sc->sc_sta_firmware_ver = ver.wi_ver[2] * 10000 +
 518             ver.wi_ver[3] * 100 + ver.wi_ver[1];
 519         if (sc->sc_firmware_type == WI_INTERSIL &&
 520             (sc->sc_sta_firmware_ver == 10102 ||
 521              sc->sc_sta_firmware_ver == 20102)) {
 522                 struct wi_ltv_str sver;
 523                 char *p;
 524
 525                 memset(&sver, 0, sizeof(sver));
 526                 sver.wi_type = WI_RID_SYMBOL_IDENTITY;
 527                 sver.wi_len = 7;
 528                 /* value should be the format like "V2.00-11" */
 529                 if (wi_read_record(sc, (struct wi_ltv_gen *)&sver) == 0 &&
 530                     *(p = (char *)sver.wi_str) >= 'A' &&
 531                     p[2] == '.' && p[5] == '-' && p[8] == '\0') {
 532                         sc->sc_firmware_type = WI_SYMBOL;
 533                         sc->sc_sta_firmware_ver = (p[1] - '0') * 10000 +
 534                             (p[3] - '0') * 1000 + (p[4] - '0') * 100 +
 535                             (p[6] - '0') * 10 + (p[7] - '0');
 536                 }
 537         }
 538         printf("\n");
 539         device_printf(sc->dev, "%s Firmware: ",
 540              sc->sc_firmware_type == WI_LUCENT ? "Lucent" :
 541             (sc->sc_firmware_type == WI_SYMBOL ? "Symbol" : "Intersil"));
 542
 543         /*
 544          * The primary firmware is only valid on Prism based chipsets
 545          * (INTERSIL or SYMBOL).
 546          */
 547         if (sc->sc_firmware_type != WI_LUCENT)
 548             printf("Primary %u.%02u.%02u, ", sc->sc_pri_firmware_ver / 10000,
 549                     (sc->sc_pri_firmware_ver % 10000) / 100,
 550                     sc->sc_pri_firmware_ver % 100);
 551         printf("Station %u.%02u.%02u\n",
 552             sc->sc_sta_firmware_ver / 10000, (sc->sc_sta_firmware_ver % 10000) / 100,
 553             sc->sc_sta_firmware_ver % 100);
 554         return;
 555 }
 556
 557 static void
 558 wi_rxeof(sc)
 559         struct wi_softc         *sc;
 560 {
 561         struct ifnet            *ifp;
 562         struct ether_header     *eh;
 563         struct mbuf             *m;
 564         int                     id;
 565
 566         ifp = &sc->arpcom.ac_if;
 567
 568         id = CSR_READ_2(sc, WI_RX_FID);
 569
 570         /*
 571          * if we have the procframe flag set, disregard all this and just
 572          * read the data from the device.
 573          */
 574         if (sc->wi_procframe || sc->wi_debug.wi_monitor) {
 575                 struct wi_frame         *rx_frame;
 576                 int                     datlen, hdrlen;
 577
 578                 /* first allocate mbuf for packet storage */
 579                 MGETHDR(m, MB_DONTWAIT, MT_DATA);
 580                 if (m == NULL) {
 581                         ifp->if_ierrors++;
 582                         return;
 583                 }
 584                 MCLGET(m, MB_DONTWAIT);
 585                 if (!(m->m_flags & M_EXT)) {
 586                         m_freem(m);
 587                         ifp->if_ierrors++;
 588                         return;
 589                 }
 590
 591                 m->m_pkthdr.rcvif = ifp;
 592
 593                 /* now read wi_frame first so we know how much data to read */
 594                 if (wi_read_data(sc, id, 0, mtod(m, caddr_t),
 595                     sizeof(struct wi_frame))) {
 596                         m_freem(m);
 597                         ifp->if_ierrors++;
 598                         return;
 599                 }
 600
 601                 rx_frame = mtod(m, struct wi_frame *);
 602
 603                 switch ((rx_frame->wi_status & WI_STAT_MAC_PORT) >> 8) {
 604                 case 7:
 605                         switch (rx_frame->wi_frame_ctl & WI_FCTL_FTYPE) {
 606                         case WI_FTYPE_DATA:
 607                                 hdrlen = WI_DATA_HDRLEN;
 608                                 datlen = rx_frame->wi_dat_len + WI_FCS_LEN;
 609                                 break;
 610                         case WI_FTYPE_MGMT:
 611                                 hdrlen = WI_MGMT_HDRLEN;
 612                                 datlen = rx_frame->wi_dat_len + WI_FCS_LEN;
 613                                 break;
 614                         case WI_FTYPE_CTL:
 615                                 /*
 616                                  * prism2 cards don't pass control packets
 617                                  * down properly or consistently, so we'll only
 618                                  * pass down the header.
 619                                  */
 620                                 hdrlen = WI_CTL_HDRLEN;
 621                                 datlen = 0;
 622                                 break;
 623                         default:
 624                                 device_printf(sc->dev, "received packet of "
 625                                     "unknown type on port 7\n");
 626                                 m_freem(m);
 627                                 ifp->if_ierrors++;
 628                                 return;
 629                         }
 630                         break;
 631                 case 0:
 632                         hdrlen = WI_DATA_HDRLEN;
 633                         datlen = rx_frame->wi_dat_len + WI_FCS_LEN;
 634                         break;
 635                 default:
 636                         device_printf(sc->dev, "received packet on invalid "
 637                             "port (wi_status=0x%x)\n", rx_frame->wi_status);
 638                         m_freem(m);
 639                         ifp->if_ierrors++;
 640                         return;
 641                 }
 642
 643                 if ((hdrlen + datlen + 2) > MCLBYTES) {
 644                         device_printf(sc->dev, "oversized packet received "
 645                             "(wi_dat_len=%d, wi_status=0x%x)\n",
 646                             datlen, rx_frame->wi_status);
 647                         m_freem(m);
 648                         ifp->if_ierrors++;
 649                         return;
 650                 }
 651
 652                 if (wi_read_data(sc, id, hdrlen, mtod(m, caddr_t) + hdrlen,
 653                     datlen + 2)) {
 654                         m_freem(m);
 655                         ifp->if_ierrors++;
 656                         return;
 657                 }
 658
 659                 m->m_pkthdr.len = m->m_len = hdrlen + datlen;
 660
 661                 ifp->if_ipackets++;
 662
 663                 /* Handle BPF listeners. */
 664                 if (ifp->if_bpf)
 665                         bpf_mtap(ifp, m);
 666
 667                 m_freem(m);
 668         } else {
 669                 struct wi_frame         rx_frame;
 670
 671                 /* First read in the frame header */
 672                 if (wi_read_data(sc, id, 0, (caddr_t)&rx_frame,
 673                     sizeof(rx_frame))) {
 674                         ifp->if_ierrors++;
 675                         return;
 676                 }
 677
 678                 if (rx_frame.wi_status & WI_STAT_ERRSTAT) {
 679                         ifp->if_ierrors++;
 680                         return;
 681                 }
 682
 683                 MGETHDR(m, MB_DONTWAIT, MT_DATA);
 684                 if (m == NULL) {
 685                         ifp->if_ierrors++;
 686                         return;
 687                 }
 688                 MCLGET(m, MB_DONTWAIT);
 689                 if (!(m->m_flags & M_EXT)) {
 690                         m_freem(m);
 691                         ifp->if_ierrors++;
 692                         return;
 693                 }
 694
 695                 eh = mtod(m, struct ether_header *);
 696                 m->m_pkthdr.rcvif = ifp;
 697
 698                 if (rx_frame.wi_status == WI_STAT_MGMT &&
 699                     sc->wi_ptype == WI_PORTTYPE_AP) {
 700                         if ((WI_802_11_OFFSET_RAW + rx_frame.wi_dat_len + 2) >
 701                             MCLBYTES) {
 702                                 device_printf(sc->dev, "oversized mgmt packet "
 703                                     "received in hostap mode "
 704                                     "(wi_dat_len=%d, wi_status=0x%x)\n",
 705                                     rx_frame.wi_dat_len, rx_frame.wi_status);
 706                                 m_freem(m);
 707                                 ifp->if_ierrors++;
 708                                 return;
 709                         }
 710
 711                         /* Put the whole header in there. */
 712                         bcopy(&rx_frame, mtod(m, void *),
 713                             sizeof(struct wi_frame));
 714                         if (wi_read_data(sc, id, WI_802_11_OFFSET_RAW,
 715                             mtod(m, caddr_t) + WI_802_11_OFFSET_RAW,
 716                             rx_frame.wi_dat_len + 2)) {
 717                                 m_freem(m);
 718                                 ifp->if_ierrors++;
 719                                 return;
 720                         }
 721                         m->m_pkthdr.len = m->m_len =
 722                             WI_802_11_OFFSET_RAW + rx_frame.wi_dat_len;
 723                         /* XXX: consider giving packet to bhp? */
 724                         wihap_mgmt_input(sc, &rx_frame, m);
 725                         return;
 726                 }
 727
 728                 if (rx_frame.wi_status == WI_STAT_1042 ||
 729                     rx_frame.wi_status == WI_STAT_TUNNEL ||
 730                     rx_frame.wi_status == WI_STAT_WMP_MSG) {
 731                         if((rx_frame.wi_dat_len + WI_SNAPHDR_LEN) > MCLBYTES) {
 732                                 device_printf(sc->dev,
 733                                     "oversized packet received "
 734                                     "(wi_dat_len=%d, wi_status=0x%x)\n",
 735                                     rx_frame.wi_dat_len, rx_frame.wi_status);
 736                                 m_freem(m);
 737                                 ifp->if_ierrors++;
 738                                 return;
 739                         }
 740                         m->m_pkthdr.len = m->m_len =
 741                             rx_frame.wi_dat_len + WI_SNAPHDR_LEN;
 742
 743 #if 0
 744                         bcopy((char *)&rx_frame.wi_addr1,
 745                             (char *)&eh->ether_dhost, ETHER_ADDR_LEN);
 746                         if (sc->wi_ptype == WI_PORTTYPE_ADHOC) {
 747                                 bcopy((char *)&rx_frame.wi_addr2,
 748                                     (char *)&eh->ether_shost, ETHER_ADDR_LEN);
 749                         } else {
 750                                 bcopy((char *)&rx_frame.wi_addr3,
 751                                     (char *)&eh->ether_shost, ETHER_ADDR_LEN);
 752                         }
 753 #else
 754                         bcopy((char *)&rx_frame.wi_dst_addr,
 755                                 (char *)&eh->ether_dhost, ETHER_ADDR_LEN);
 756                         bcopy((char *)&rx_frame.wi_src_addr,
 757                                 (char *)&eh->ether_shost, ETHER_ADDR_LEN);
 758 #endif
 759
 760                         bcopy((char *)&rx_frame.wi_type,
 761                             (char *)&eh->ether_type, ETHER_TYPE_LEN);
 762
 763                         if (wi_read_data(sc, id, WI_802_11_OFFSET,
 764                             mtod(m, caddr_t) + sizeof(struct ether_header),
 765                             m->m_len + 2)) {
 766                                 m_freem(m);
 767                                 ifp->if_ierrors++;
 768                                 return;
 769                         }
 770                 } else {
 771                         if((rx_frame.wi_dat_len +
 772                             sizeof(struct ether_header)) > MCLBYTES) {
 773                                 device_printf(sc->dev,
 774                                     "oversized packet received "
 775                                     "(wi_dat_len=%d, wi_status=0x%x)\n",
 776                                     rx_frame.wi_dat_len, rx_frame.wi_status);
 777                                 m_freem(m);
 778                                 ifp->if_ierrors++;
 779                                 return;
 780                         }
 781                         m->m_pkthdr.len = m->m_len =
 782                             rx_frame.wi_dat_len + sizeof(struct ether_header);
 783
 784                         if (wi_read_data(sc, id, WI_802_3_OFFSET,
 785                             mtod(m, caddr_t), m->m_len + 2)) {
 786                                 m_freem(m);
 787                                 ifp->if_ierrors++;
 788                                 return;
 789                         }
 790                 }
 791
 792                 ifp->if_ipackets++;
 793
 794                 if (sc->wi_ptype == WI_PORTTYPE_AP) {
 795                         /*
 796                          * Give host AP code first crack at data
 797                          * packets.  If it decides to handle it (or
 798                          * drop it), it will return a non-zero.
 799                          * Otherwise, it is destined for this host.
 800                          */
 801                         if (wihap_data_input(sc, &rx_frame, m))
 802                                 return;
 803                 }
 804                 /* Receive packet. */
 805                 m_adj(m, sizeof(struct ether_header));
 806 #ifdef WICACHE
 807                 wi_cache_store(sc, eh, m, rx_frame.wi_q_info);
 808 #endif
 809                 ether_input(ifp, eh, m);
 810         }
 811 }
 812
 813 static void
 814 wi_txeof(sc, status)
 815         struct wi_softc         *sc;
 816         int                     status;
 817 {
 818         struct ifnet            *ifp;
 819
 820         ifp = &sc->arpcom.ac_if;
 821
 822         ifp->if_timer = 0;
 823         ifp->if_flags &= ~IFF_OACTIVE;
 824
 825         if (status & WI_EV_TX_EXC)
 826                 ifp->if_oerrors++;
 827         else
 828                 ifp->if_opackets++;
 829
 830         return;
 831 }
 832
 833 void
 834 wi_inquire(xsc)
 835         void                    *xsc;
 836 {
 837         struct wi_softc         *sc;
 838         struct ifnet            *ifp;
 839         int                     s;
 840
 841         sc = xsc;
 842         ifp = &sc->arpcom.ac_if;
 843
 844         sc->wi_stat_ch = timeout(wi_inquire, sc, hz * 60);
 845
 846         /* Don't do this while we're transmitting */
 847         if (ifp->if_flags & IFF_OACTIVE)
 848                 return;
 849
 850         WI_LOCK(sc, s);
 851         wi_cmd(sc, WI_CMD_INQUIRE, WI_INFO_COUNTERS, 0, 0);
 852         WI_UNLOCK(sc, s);
 853
 854         return;
 855 }
 856
 857 void
 858 wi_update_stats(sc)
 859         struct wi_softc         *sc;
 860 {
 861         struct wi_ltv_gen       gen;
 862         u_int16_t               id;
 863         struct ifnet            *ifp;
 864         u_int32_t               *ptr;
 865         int                     len, i;
 866         u_int16_t               t;
 867
 868         ifp = &sc->arpcom.ac_if;
 869
 870         id = CSR_READ_2(sc, WI_INFO_FID);
 871
 872         wi_read_data(sc, id, 0, (char *)&gen, 4);
 873
 874         /*
 875          * if we just got our scan results, copy it over into the scan buffer
 876          * so we can return it to anyone that asks for it. (add a little
 877          * compatibility with the prism2 scanning mechanism)
 878          */
 879         if (gen.wi_type == WI_INFO_SCAN_RESULTS)
 880         {
 881                 sc->wi_scanbuf_len = gen.wi_len;
 882                 wi_read_data(sc, id, 4, (char *)sc->wi_scanbuf,
 883                     sc->wi_scanbuf_len * 2);
 884
 885                 return;
 886         }
 887         else if (gen.wi_type != WI_INFO_COUNTERS)
 888                 return;
 889
 890         len = (gen.wi_len - 1 < sizeof(sc->wi_stats) / 4) ?
 891                 gen.wi_len - 1 : sizeof(sc->wi_stats) / 4;
 892         ptr = (u_int32_t *)&sc->wi_stats;
 893
 894         for (i = 0; i < len - 1; i++) {
 895                 t = CSR_READ_2(sc, WI_DATA1);
 896 #ifdef WI_HERMES_STATS_WAR
 897                 if (t > 0xF000)
 898                         t = ~t & 0xFFFF;
 899 #endif
 900                 ptr[i] += t;
 901         }
 902
 903         ifp->if_collisions = sc->wi_stats.wi_tx_single_retries +
 904             sc->wi_stats.wi_tx_multi_retries +
 905             sc->wi_stats.wi_tx_retry_limit;
 906
 907         return;
 908 }
 909
 910 static void
 911 wi_intr(xsc)
 912         void            *xsc;
 913 {
 914         struct wi_softc         *sc = xsc;
 915         struct ifnet            *ifp;
 916         u_int16_t               status;
 917         int                     s;
 918
 919         WI_LOCK(sc, s);
 920
 921         ifp = &sc->arpcom.ac_if;
 922
 923         if (sc->wi_gone || !(ifp->if_flags & IFF_UP)) {
 924                 CSR_WRITE_2(sc, WI_EVENT_ACK, 0xFFFF);
 925                 CSR_WRITE_2(sc, WI_INT_EN, 0);
 926                 WI_UNLOCK(sc, s);
 927                 return;
 928         }
 929
 930         /* Disable interrupts. */
 931         CSR_WRITE_2(sc, WI_INT_EN, 0);
 932
 933         status = CSR_READ_2(sc, WI_EVENT_STAT);
 934         CSR_WRITE_2(sc, WI_EVENT_ACK, ~WI_INTRS);
 935
 936         if (status & WI_EV_RX) {
 937                 wi_rxeof(sc);
 938                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_RX);
 939         }
 940
 941         if (status & WI_EV_TX) {
 942                 wi_txeof(sc, status);
 943                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_TX);
 944         }
 945
 946         if (status & WI_EV_ALLOC) {
 947                 int                     id;
 948
 949                 id = CSR_READ_2(sc, WI_ALLOC_FID);
 950                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_ALLOC);
 951                 if (id == sc->wi_tx_data_id)
 952                         wi_txeof(sc, status);
 953         }
 954
 955         if (status & WI_EV_INFO) {
 956                 wi_update_stats(sc);
 957                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_INFO);
 958         }
 959
 960         if (status & WI_EV_TX_EXC) {
 961                 wi_txeof(sc, status);
 962                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_TX_EXC);
 963         }
 964
 965         if (status & WI_EV_INFO_DROP) {
 966                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_INFO_DROP);
 967         }
 968
 969         /* Re-enable interrupts. */
 970         CSR_WRITE_2(sc, WI_INT_EN, WI_INTRS);
 971
 972         if (ifp->if_snd.ifq_head != NULL) {
 973                 wi_start(ifp);
 974         }
 975
 976         WI_UNLOCK(sc, s);
 977
 978         return;
 979 }
 980
 981 static int
 982 wi_cmd(sc, cmd, val0, val1, val2)
 983         struct wi_softc         *sc;
 984         int                     cmd;
 985         int                     val0;
 986         int                     val1;
 987         int                     val2;
 988 {
 989         int                     i, s = 0;
 990         static volatile int count  = 0;
 991
 992         if (count > 1)
 993                 panic("Hey partner, hold on there!");
 994         count++;
 995
 996         /* wait for the busy bit to clear */
 997         for (i = 500; i > 0; i--) {     /* 5s */
 998                 if (!(CSR_READ_2(sc, WI_COMMAND) & WI_CMD_BUSY)) {
 999                         break;
1000                 }
1001                 DELAY(10*1000); /* 10 m sec */
1002         }
1003         if (i == 0) {
1004                 device_printf(sc->dev, "wi_cmd: busy bit won't clear.\n" );
1005                 count--;
1006                 return(ETIMEDOUT);
1007         }
1008
1009         CSR_WRITE_2(sc, WI_PARAM0, val0);
1010         CSR_WRITE_2(sc, WI_PARAM1, val1);
1011         CSR_WRITE_2(sc, WI_PARAM2, val2);
1012         CSR_WRITE_2(sc, WI_COMMAND, cmd);
1013
1014         for (i = 0; i < WI_TIMEOUT; i++) {
1015                 /*
1016                  * Wait for 'command complete' bit to be
1017                  * set in the event status register.
1018                  */
1019                 s = CSR_READ_2(sc, WI_EVENT_STAT);
1020                 if (s & WI_EV_CMD) {
1021                         /* Ack the event and read result code. */
1022                         s = CSR_READ_2(sc, WI_STATUS);
1023                         CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_CMD);
1024 #ifdef foo
1025                         if ((s & WI_CMD_CODE_MASK) != (cmd & WI_CMD_CODE_MASK))
1026                                 return(EIO);
1027 #endif
1028                         if (s & WI_STAT_CMD_RESULT) {
1029                                 count--;
1030                                 return(EIO);
1031                         }
1032                         break;
1033                 }
1034                 DELAY(WI_DELAY);
1035         }
1036
1037         count--;
1038         if (i == WI_TIMEOUT) {
1039                 device_printf(sc->dev,
1040                     "timeout in wi_cmd 0x%04x; event status 0x%04x\n", cmd, s);
1041                 return(ETIMEDOUT);
1042         }
1043         return(0);
1044 }
1045
1046 static void
1047 wi_reset(sc)
1048         struct wi_softc         *sc;
1049 {
1050 #define WI_INIT_TRIES 3
1051         int i;
1052         int tries;
1053
1054         /* Symbol firmware cannot be initialized more than once */
1055         if (sc->sc_firmware_type == WI_SYMBOL && sc->sc_enabled)
1056                 return;
1057         if (sc->sc_firmware_type == WI_SYMBOL)
1058                 tries = 1;
1059         else
1060                 tries = WI_INIT_TRIES;
1061
1062         for (i = 0; i < tries; i++) {
1063                 if (wi_cmd(sc, WI_CMD_INI, 0, 0, 0) == 0)
1064                         break;
1065                 DELAY(WI_DELAY * 1000);
1066         }
1067         sc->sc_enabled = 1;
1068
1069         if (i == tries) {
1070                 device_printf(sc->dev, "init failed\n");
1071                 return;
1072         }
1073
1074         CSR_WRITE_2(sc, WI_INT_EN, 0);
1075         CSR_WRITE_2(sc, WI_EVENT_ACK, 0xFFFF);
1076
1077         /* Calibrate timer. */
1078         WI_SETVAL(WI_RID_TICK_TIME, 8);
1079
1080         return;
1081 }
1082
1083 /*
1084  * Read an LTV record from the NIC.
1085  */
1086 static int
1087 wi_read_record(sc, ltv)
1088         struct wi_softc         *sc;
1089         struct wi_ltv_gen       *ltv;
1090 {
1091         u_int16_t               *ptr;
1092         int                     i, len, code;
1093         struct wi_ltv_gen       *oltv, p2ltv;
1094
1095         oltv = ltv;
1096         if (sc->sc_firmware_type != WI_LUCENT) {
1097                 switch (ltv->wi_type) {
1098                 case WI_RID_ENCRYPTION:
1099                         p2ltv.wi_type = WI_RID_P2_ENCRYPTION;
1100                         p2ltv.wi_len = 2;
1101                         ltv = &p2ltv;
1102                         break;
1103                 case WI_RID_TX_CRYPT_KEY:
1104                         p2ltv.wi_type = WI_RID_P2_TX_CRYPT_KEY;
1105                         p2ltv.wi_len = 2;
1106                         ltv = &p2ltv;
1107                         break;
1108                 case WI_RID_ROAMING_MODE:
1109                         if (sc->sc_firmware_type == WI_INTERSIL)
1110                                 break;
1111                         /* not supported */
1112                         ltv->wi_len = 1;
1113                         return 0;
1114                 case WI_RID_MICROWAVE_OVEN:
1115                         /* not supported */
1116                         ltv->wi_len = 1;
1117                         return 0;
1118                 }
1119         }
1120
1121         /* Tell the NIC to enter record read mode. */
1122         if (wi_cmd(sc, WI_CMD_ACCESS|WI_ACCESS_READ, ltv->wi_type, 0, 0))
1123                 return(EIO);
1124
1125         /* Seek to the record. */
1126         if (wi_seek(sc, ltv->wi_type, 0, WI_BAP1))
1127                 return(EIO);
1128
1129         /*
1130          * Read the length and record type and make sure they
1131          * match what we expect (this verifies that we have enough
1132          * room to hold all of the returned data).
1133          */
1134         len = CSR_READ_2(sc, WI_DATA1);
1135         if (len > ltv->wi_len)
1136                 return(ENOSPC);
1137         code = CSR_READ_2(sc, WI_DATA1);
1138         if (code != ltv->wi_type)
1139                 return(EIO);
1140
1141         ltv->wi_len = len;
1142         ltv->wi_type = code;
1143
1144         /* Now read the data. */
1145         ptr = &ltv->wi_val;
1146         for (i = 0; i < ltv->wi_len - 1; i++)
1147                 ptr[i] = CSR_READ_2(sc, WI_DATA1);
1148
1149         if (ltv->wi_type == WI_RID_PORTTYPE && sc->wi_ptype == WI_PORTTYPE_IBSS
1150             && ltv->wi_val == sc->wi_ibss_port) {
1151                 /*
1152                  * Convert vendor IBSS port type to WI_PORTTYPE_IBSS.
1153                  * Since Lucent uses port type 1 for BSS *and* IBSS we
1154                  * have to rely on wi_ptype to distinguish this for us.
1155                  */
1156                 ltv->wi_val = htole16(WI_PORTTYPE_IBSS);
1157         } else if (sc->sc_firmware_type != WI_LUCENT) {
1158                 switch (oltv->wi_type) {
1159                 case WI_RID_TX_RATE:
1160                 case WI_RID_CUR_TX_RATE:
1161                         switch (ltv->wi_val) {
1162                         case 1: oltv->wi_val = 1; break;
1163                         case 2: oltv->wi_val = 2; break;
1164                         case 3: oltv->wi_val = 6; break;
1165                         case 4: oltv->wi_val = 5; break;
1166                         case 7: oltv->wi_val = 7; break;
1167                         case 8: oltv->wi_val = 11; break;
1168                         case 15: oltv->wi_val = 3; break;
1169                         default: oltv->wi_val = 0x100 + ltv->wi_val; break;
1170                         }
1171                         break;
1172                 case WI_RID_ENCRYPTION:
1173                         oltv->wi_len = 2;
1174                         if (ltv->wi_val & 0x01)
1175                                 oltv->wi_val = 1;
1176                         else
1177                                 oltv->wi_val = 0;
1178                         break;
1179                 case WI_RID_TX_CRYPT_KEY:
1180                         oltv->wi_len = 2;
1181                         oltv->wi_val = ltv->wi_val;
1182                         break;
1183                 case WI_RID_CNFAUTHMODE:
1184                         oltv->wi_len = 2;
1185                         if (le16toh(ltv->wi_val) & 0x01)
1186                                 oltv->wi_val = htole16(1);
1187                         else if (le16toh(ltv->wi_val) & 0x02)
1188                                 oltv->wi_val = htole16(2);
1189                         break;
1190                 }
1191         }
1192
1193         return(0);
1194 }
1195
1196 /*
1197  * Same as read, except we inject data instead of reading it.
1198  */
1199 static int
1200 wi_write_record(sc, ltv)
1201         struct wi_softc         *sc;
1202         struct wi_ltv_gen       *ltv;
1203 {
1204         u_int16_t               *ptr;
1205         int                     i;
1206         struct wi_ltv_gen       p2ltv;
1207
1208         if (ltv->wi_type == WI_RID_PORTTYPE &&
1209             le16toh(ltv->wi_val) == WI_PORTTYPE_IBSS) {
1210                 /* Convert WI_PORTTYPE_IBSS to vendor IBSS port type. */
1211                 p2ltv.wi_type = WI_RID_PORTTYPE;
1212                 p2ltv.wi_len = 2;
1213                 p2ltv.wi_val = sc->wi_ibss_port;
1214                 ltv = &p2ltv;
1215         } else if (sc->sc_firmware_type != WI_LUCENT) {
1216                 switch (ltv->wi_type) {
1217                 case WI_RID_TX_RATE:
1218                         p2ltv.wi_type = WI_RID_TX_RATE;
1219                         p2ltv.wi_len = 2;
1220                         switch (ltv->wi_val) {
1221                         case 1: p2ltv.wi_val = 1; break;
1222                         case 2: p2ltv.wi_val = 2; break;
1223                         case 3: p2ltv.wi_val = 15; break;
1224                         case 5: p2ltv.wi_val = 4; break;
1225                         case 6: p2ltv.wi_val = 3; break;
1226                         case 7: p2ltv.wi_val = 7; break;
1227                         case 11: p2ltv.wi_val = 8; break;
1228                         default: return EINVAL;
1229                         }
1230                         ltv = &p2ltv;
1231                         break;
1232                 case WI_RID_ENCRYPTION:
1233                         p2ltv.wi_type = WI_RID_P2_ENCRYPTION;
1234                         p2ltv.wi_len = 2;
1235                         if (le16toh(ltv->wi_val)) {
1236                                 p2ltv.wi_val =htole16(PRIVACY_INVOKED |
1237                                     EXCLUDE_UNENCRYPTED);
1238                                 if (sc->wi_ptype == WI_PORTTYPE_AP)
1239                                         /*
1240                                          * Disable tx encryption...
1241                                          * it's broken.
1242                                          */
1243                                         p2ltv.wi_val |= htole16(HOST_ENCRYPT);
1244                         } else
1245                                 p2ltv.wi_val =
1246                                     htole16(HOST_ENCRYPT | HOST_DECRYPT);
1247                         ltv = &p2ltv;
1248                         break;
1249                 case WI_RID_TX_CRYPT_KEY:
1250                         p2ltv.wi_type = WI_RID_P2_TX_CRYPT_KEY;
1251                         p2ltv.wi_len = 2;
1252                         p2ltv.wi_val = ltv->wi_val;
1253                         ltv = &p2ltv;
1254                         break;
1255                 case WI_RID_DEFLT_CRYPT_KEYS:
1256                     {
1257                         int error;
1258                         int keylen;
1259                         struct wi_ltv_str       ws;
1260                         struct wi_ltv_keys      *wk =
1261                             (struct wi_ltv_keys *)ltv;
1262
1263                         keylen = wk->wi_keys[sc->wi_tx_key].wi_keylen;
1264
1265                         for (i = 0; i < 4; i++) {
1266                                 bzero(&ws, sizeof(ws));
1267                                 ws.wi_len = (keylen > 5) ? 8 : 4;
1268                                 ws.wi_type = WI_RID_P2_CRYPT_KEY0 + i;
1269                                 memcpy(ws.wi_str,
1270                                     &wk->wi_keys[i].wi_keydat, keylen);
1271                                 error = wi_write_record(sc,
1272                                     (struct wi_ltv_gen *)&ws);
1273                                 if (error)
1274                                         return error;
1275                         }
1276                         return 0;
1277                     }
1278                 case WI_RID_CNFAUTHMODE:
1279                         p2ltv.wi_type = WI_RID_CNFAUTHMODE;
1280                         p2ltv.wi_len = 2;
1281                         if (le16toh(ltv->wi_val) == 1)
1282                                 p2ltv.wi_val = htole16(0x01);
1283                         else if (le16toh(ltv->wi_val) == 2)
1284                                 p2ltv.wi_val = htole16(0x02);
1285                         ltv = &p2ltv;
1286                         break;
1287                 case WI_RID_ROAMING_MODE:
1288                         if (sc->sc_firmware_type == WI_INTERSIL)
1289                                 break;
1290                         /* not supported */
1291                         return 0;
1292                 case WI_RID_MICROWAVE_OVEN:
1293                         /* not supported */
1294                         return 0;
1295                 }
1296         } else {
1297                 /* LUCENT */
1298                 switch (ltv->wi_type) {
1299                 case WI_RID_TX_RATE:
1300                         switch (ltv->wi_val) {
1301                         case 1: ltv->wi_val = 1; break;  /* 1Mb/s fixed */
1302                         case 2: ltv->wi_val = 2; break;  /* 2Mb/s fixed */
1303                         case 3: ltv->wi_val = 3; break;  /* 11Mb/s auto */
1304                         case 5: ltv->wi_val = 4; break;  /* 5.5Mb/s fixed */
1305                         case 6: ltv->wi_val = 6; break;  /* 2Mb/s auto */
1306                         case 7: ltv->wi_val = 7; break;  /* 5.5Mb/s auto */
1307                         case 11: ltv->wi_val = 5; break; /* 11Mb/s fixed */
1308                         default: return EINVAL;
1309                         }
1310                 }
1311         }
1312
1313         if (wi_seek(sc, ltv->wi_type, 0, WI_BAP1))
1314                 return(EIO);
1315
1316         CSR_WRITE_2(sc, WI_DATA1, ltv->wi_len);
1317         CSR_WRITE_2(sc, WI_DATA1, ltv->wi_type);
1318
1319         ptr = &ltv->wi_val;
1320         for (i = 0; i < ltv->wi_len - 1; i++)
1321                 CSR_WRITE_2(sc, WI_DATA1, ptr[i]);
1322
1323         if (wi_cmd(sc, WI_CMD_ACCESS|WI_ACCESS_WRITE, ltv->wi_type, 0, 0))
1324                 return(EIO);
1325
1326         return(0);
1327 }
1328
1329 static int
1330 wi_seek(sc, id, off, chan)
1331         struct wi_softc         *sc;
1332         int                     id, off, chan;
1333 {
1334         int                     i;
1335         int                     selreg, offreg;
1336         int                     status;
1337
1338         switch (chan) {
1339         case WI_BAP0:
1340                 selreg = WI_SEL0;
1341                 offreg = WI_OFF0;
1342                 break;
1343         case WI_BAP1:
1344                 selreg = WI_SEL1;
1345                 offreg = WI_OFF1;
1346                 break;
1347         default:
1348                 device_printf(sc->dev, "invalid data path: %x\n", chan);
1349                 return(EIO);
1350         }
1351
1352         CSR_WRITE_2(sc, selreg, id);
1353         CSR_WRITE_2(sc, offreg, off);
1354
1355         for (i = 0; i < WI_TIMEOUT; i++) {
1356                 status = CSR_READ_2(sc, offreg);
1357                 if (!(status & (WI_OFF_BUSY|WI_OFF_ERR)))
1358                         break;
1359                 DELAY(WI_DELAY);
1360         }
1361
1362         if (i == WI_TIMEOUT) {
1363                 device_printf(sc->dev, "timeout in wi_seek to %x/%x; last status %x\n",
1364                         id, off, status);
1365                 return(ETIMEDOUT);
1366         }
1367
1368         return(0);
1369 }
1370
1371 static int
1372 wi_read_data(sc, id, off, buf, len)
1373         struct wi_softc         *sc;
1374         int                     id, off;
1375         caddr_t                 buf;
1376         int                     len;
1377 {
1378         int                     i;
1379         u_int16_t               *ptr;
1380
1381         if (wi_seek(sc, id, off, WI_BAP1))
1382                 return(EIO);
1383
1384         ptr = (u_int16_t *)buf;
1385         for (i = 0; i < len / 2; i++)
1386                 ptr[i] = CSR_READ_2(sc, WI_DATA1);
1387
1388         return(0);
1389 }
1390
1391 /*
1392  * According to the comments in the HCF Light code, there is a bug in
1393  * the Hermes (or possibly in certain Hermes firmware revisions) where
1394  * the chip's internal autoincrement counter gets thrown off during
1395  * data writes: the autoincrement is missed, causing one data word to
1396  * be overwritten and subsequent words to be written to the wrong memory
1397  * locations. The end result is that we could end up transmitting bogus
1398  * frames without realizing it. The workaround for this is to write a
1399  * couple of extra guard words after the end of the transfer, then
1400  * attempt to read then back. If we fail to locate the guard words where
1401  * we expect them, we preform the transfer over again.
1402  */
1403 static int
1404 wi_write_data(sc, id, off, buf, len)
1405         struct wi_softc         *sc;
1406         int                     id, off;
1407         caddr_t                 buf;
1408         int                     len;
1409 {
1410         int                     i;
1411         u_int16_t               *ptr;
1412 #ifdef WI_HERMES_AUTOINC_WAR
1413         int                     retries;
1414
1415         retries = 512;
1416 again:
1417 #endif
1418
1419         if (wi_seek(sc, id, off, WI_BAP0))
1420                 return(EIO);
1421
1422         ptr = (u_int16_t *)buf;
1423         for (i = 0; i < (len / 2); i++)
1424                 CSR_WRITE_2(sc, WI_DATA0, ptr[i]);
1425
1426 #ifdef WI_HERMES_AUTOINC_WAR
1427         CSR_WRITE_2(sc, WI_DATA0, 0x1234);
1428         CSR_WRITE_2(sc, WI_DATA0, 0x5678);
1429
1430         if (wi_seek(sc, id, off + len, WI_BAP0))
1431                 return(EIO);
1432
1433         if (CSR_READ_2(sc, WI_DATA0) != 0x1234 ||
1434             CSR_READ_2(sc, WI_DATA0) != 0x5678) {
1435                 if (--retries >= 0)
1436                         goto again;
1437                 device_printf(sc->dev, "wi_write_data device timeout\n");
1438                 return (EIO);
1439         }
1440 #endif
1441
1442         return(0);
1443 }
1444
1445 /*
1446  * Allocate a region of memory inside the NIC and zero
1447  * it out.
1448  */
1449 static int
1450 wi_alloc_nicmem(sc, len, id)
1451         struct wi_softc         *sc;
1452         int                     len;
1453         int                     *id;
1454 {
1455         int                     i;
1456
1457         if (wi_cmd(sc, WI_CMD_ALLOC_MEM, len, 0, 0)) {
1458                 device_printf(sc->dev,
1459                     "failed to allocate %d bytes on NIC\n", len);
1460                 return(ENOMEM);
1461         }
1462
1463         for (i = 0; i < WI_TIMEOUT; i++) {
1464                 if (CSR_READ_2(sc, WI_EVENT_STAT) & WI_EV_ALLOC)
1465                         break;
1466                 DELAY(WI_DELAY);
1467         }
1468
1469         if (i == WI_TIMEOUT) {
1470                 device_printf(sc->dev, "time out allocating memory on card\n");
1471                 return(ETIMEDOUT);
1472         }
1473
1474         CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_ALLOC);
1475         *id = CSR_READ_2(sc, WI_ALLOC_FID);
1476
1477         if (wi_seek(sc, *id, 0, WI_BAP0)) {
1478                 device_printf(sc->dev, "seek failed while allocating memory on card\n");
1479                 return(EIO);
1480         }
1481
1482         for (i = 0; i < len / 2; i++)
1483                 CSR_WRITE_2(sc, WI_DATA0, 0);
1484
1485         return(0);
1486 }
1487
1488 static void
1489 wi_setmulti(sc)
1490         struct wi_softc         *sc;
1491 {
1492         struct ifnet            *ifp;
1493         int                     i = 0;
1494         struct ifmultiaddr      *ifma;
1495         struct wi_ltv_mcast     mcast;
1496
1497         ifp = &sc->arpcom.ac_if;
1498
1499         bzero((char *)&mcast, sizeof(mcast));
1500
1501         mcast.wi_type = WI_RID_MCAST_LIST;
1502         mcast.wi_len = (3 * 16) + 1;
1503
1504         if (ifp->if_flags & IFF_ALLMULTI || ifp->if_flags & IFF_PROMISC) {
1505                 wi_write_record(sc, (struct wi_ltv_gen *)&mcast);
1506                 return;
1507         }
1508
1509 #if defined(__DragonFly__) || __FreeBSD_version < 500000
1510         LIST_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
1511 #else
1512         TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
1513 #endif
1514                 if (ifma->ifma_addr->sa_family != AF_LINK)
1515                         continue;
1516                 if (i < 16) {
1517                         bcopy(LLADDR((struct sockaddr_dl *)ifma->ifma_addr),
1518                             (char *)&mcast.wi_mcast[i], ETHER_ADDR_LEN);
1519                         i++;
1520                 } else {
1521                         bzero((char *)&mcast, sizeof(mcast));
1522                         break;
1523                 }
1524         }
1525
1526         mcast.wi_len = (i * 3) + 1;
1527         wi_write_record(sc, (struct wi_ltv_gen *)&mcast);
1528
1529         return;
1530 }
1531
1532 static void
1533 wi_setdef(sc, wreq)
1534         struct wi_softc         *sc;
1535         struct wi_req           *wreq;
1536 {
1537         struct sockaddr_dl      *sdl;
1538         struct ifaddr           *ifa;
1539         struct ifnet            *ifp;
1540
1541         ifp = &sc->arpcom.ac_if;
1542
1543         switch(wreq->wi_type) {
1544         case WI_RID_MAC_NODE:
1545                 ifa = ifaddr_byindex(ifp->if_index);
1546                 sdl = (struct sockaddr_dl *)ifa->ifa_addr;
1547                 bcopy((char *)&wreq->wi_val, (char *)&sc->arpcom.ac_enaddr,
1548                    ETHER_ADDR_LEN);
1549                 bcopy((char *)&wreq->wi_val, LLADDR(sdl), ETHER_ADDR_LEN);
1550                 break;
1551         case WI_RID_PORTTYPE:
1552                 sc->wi_ptype = le16toh(wreq->wi_val[0]);
1553                 break;
1554         case WI_RID_TX_RATE:
1555                 sc->wi_tx_rate = le16toh(wreq->wi_val[0]);
1556                 break;
1557         case WI_RID_MAX_DATALEN:
1558                 sc->wi_max_data_len = le16toh(wreq->wi_val[0]);
1559                 break;
1560         case WI_RID_RTS_THRESH:
1561                 sc->wi_rts_thresh = le16toh(wreq->wi_val[0]);
1562                 break;
1563         case WI_RID_SYSTEM_SCALE:
1564                 sc->wi_ap_density = le16toh(wreq->wi_val[0]);
1565                 break;
1566         case WI_RID_CREATE_IBSS:
1567                 sc->wi_create_ibss = le16toh(wreq->wi_val[0]);
1568                 break;
1569         case WI_RID_OWN_CHNL:
1570                 sc->wi_channel = le16toh(wreq->wi_val[0]);
1571                 break;
1572         case WI_RID_NODENAME:
1573                 bzero(sc->wi_node_name, sizeof(sc->wi_node_name));
1574                 bcopy((char *)&wreq->wi_val[1], sc->wi_node_name, 30);
1575                 break;
1576         case WI_RID_DESIRED_SSID:
1577                 bzero(sc->wi_net_name, sizeof(sc->wi_net_name));
1578                 bcopy((char *)&wreq->wi_val[1], sc->wi_net_name, 30);
1579                 break;
1580         case WI_RID_OWN_SSID:
1581                 bzero(sc->wi_ibss_name, sizeof(sc->wi_ibss_name));
1582                 bcopy((char *)&wreq->wi_val[1], sc->wi_ibss_name, 30);
1583                 break;
1584         case WI_RID_PM_ENABLED:
1585                 sc->wi_pm_enabled = le16toh(wreq->wi_val[0]);
1586                 break;
1587         case WI_RID_MICROWAVE_OVEN:
1588                 sc->wi_mor_enabled = le16toh(wreq->wi_val[0]);
1589                 break;
1590         case WI_RID_MAX_SLEEP:
1591                 sc->wi_max_sleep = le16toh(wreq->wi_val[0]);
1592                 break;
1593         case WI_RID_CNFAUTHMODE:
1594                 sc->wi_authtype = le16toh(wreq->wi_val[0]);
1595                 break;
1596         case WI_RID_ROAMING_MODE:
1597                 sc->wi_roaming = le16toh(wreq->wi_val[0]);
1598                 break;
1599         case WI_RID_ENCRYPTION:
1600                 sc->wi_use_wep = le16toh(wreq->wi_val[0]);
1601                 break;
1602         case WI_RID_TX_CRYPT_KEY:
1603                 sc->wi_tx_key = le16toh(wreq->wi_val[0]);
1604                 break;
1605         case WI_RID_DEFLT_CRYPT_KEYS:
1606                 bcopy((char *)wreq, (char *)&sc->wi_keys,
1607                     sizeof(struct wi_ltv_keys));
1608                 break;
1609         default:
1610                 break;
1611         }
1612
1613         /* Reinitialize WaveLAN. */
1614         wi_init(sc);
1615
1616         return;
1617 }
1618
1619 static int
1620 wi_ioctl(ifp, command, data, cr)
1621         struct ifnet            *ifp;
1622         u_long                  command;
1623         caddr_t                 data;
1624         struct ucred            *cr;
1625 {
1626         int                     error = 0;
1627         int                     len;
1628         u_int8_t                tmpkey[14];
1629         char                    tmpssid[IEEE80211_NWID_LEN];
1630         struct wi_softc         *sc;
1631         struct wi_req           wreq;
1632         struct ifreq            *ifr;
1633         struct ieee80211req     *ireq;
1634         int                     s;
1635
1636         sc = ifp->if_softc;
1637         WI_LOCK(sc, s);
1638         ifr = (struct ifreq *)data;
1639         ireq = (struct ieee80211req *)data;
1640
1641         if (sc->wi_gone) {
1642                 error = ENODEV;
1643                 goto out;
1644         }
1645
1646         switch(command) {
1647         case SIOCSIFADDR:
1648         case SIOCGIFADDR:
1649         case SIOCSIFMTU:
1650                 error = ether_ioctl(ifp, command, data);
1651                 break;
1652         case SIOCSIFFLAGS:
1653                 /*
1654                  * Can't do promisc and hostap at the same time.  If all that's
1655                  * changing is the promisc flag, try to short-circuit a call to
1656                  * wi_init() by just setting PROMISC in the hardware.
1657                  */
1658                 if (ifp->if_flags & IFF_UP) {
1659                         if (sc->wi_ptype != WI_PORTTYPE_AP &&
1660                             ifp->if_flags & IFF_RUNNING) {
1661                                 if (ifp->if_flags & IFF_PROMISC &&
1662                                     !(sc->wi_if_flags & IFF_PROMISC)) {
1663                                         WI_SETVAL(WI_RID_PROMISC, 1);
1664                                 } else if (!(ifp->if_flags & IFF_PROMISC) &&
1665                                     sc->wi_if_flags & IFF_PROMISC) {
1666                                         WI_SETVAL(WI_RID_PROMISC, 0);
1667                                 } else {
1668                                         wi_init(sc);
1669                                 }
1670                         } else {
1671                                 wi_init(sc);
1672                         }
1673                 } else {
1674                         if (ifp->if_flags & IFF_RUNNING) {
1675                                 wi_stop(sc);
1676                         }
1677                 }
1678                 sc->wi_if_flags = ifp->if_flags;
1679                 error = 0;
1680                 break;
1681         case SIOCSIFMEDIA:
1682         case SIOCGIFMEDIA:
1683                 error = ifmedia_ioctl(ifp, ifr, &sc->ifmedia, command);
1684                 break;
1685         case SIOCADDMULTI:
1686         case SIOCDELMULTI:
1687                 wi_setmulti(sc);
1688                 error = 0;
1689                 break;
1690         case SIOCGWAVELAN:
1691                 error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1692                 if (error)
1693                         break;
1694                 if (wreq.wi_len > WI_MAX_DATALEN) {
1695                         error = EINVAL;
1696                         break;
1697                 }
1698                 /* Don't show WEP keys to non-root users. */
1699                 if (wreq.wi_type == WI_RID_DEFLT_CRYPT_KEYS &&
1700                     suser_cred(cr, NULL_CRED_OKAY))
1701                         break;
1702                 if (wreq.wi_type == WI_RID_IFACE_STATS) {
1703                         bcopy((char *)&sc->wi_stats, (char *)&wreq.wi_val,
1704                             sizeof(sc->wi_stats));
1705                         wreq.wi_len = (sizeof(sc->wi_stats) / 2) + 1;
1706                 } else if (wreq.wi_type == WI_RID_DEFLT_CRYPT_KEYS) {
1707                         bcopy((char *)&sc->wi_keys, (char *)&wreq,
1708                             sizeof(struct wi_ltv_keys));
1709                 }
1710 #ifdef WICACHE
1711                 else if (wreq.wi_type == WI_RID_ZERO_CACHE) {
1712                         sc->wi_sigitems = sc->wi_nextitem = 0;
1713                 } else if (wreq.wi_type == WI_RID_READ_CACHE) {
1714                         char *pt = (char *)&wreq.wi_val;
1715                         bcopy((char *)&sc->wi_sigitems,
1716                             (char *)pt, sizeof(int));
1717                         pt += (sizeof (int));
1718                         wreq.wi_len = sizeof(int) / 2;
1719                         bcopy((char *)&sc->wi_sigcache, (char *)pt,
1720                             sizeof(struct wi_sigcache) * sc->wi_sigitems);
1721                         wreq.wi_len += ((sizeof(struct wi_sigcache) *
1722                             sc->wi_sigitems) / 2) + 1;
1723                 }
1724 #endif
1725                 else if (wreq.wi_type == WI_RID_PROCFRAME) {
1726                         wreq.wi_len = 2;
1727                         wreq.wi_val[0] = sc->wi_procframe;
1728                 } else if (wreq.wi_type == WI_RID_PRISM2) {
1729                         wreq.wi_len = 2;
1730                         wreq.wi_val[0] = sc->sc_firmware_type != WI_LUCENT;
1731                 } else if (wreq.wi_type == WI_RID_SCAN_RES &&
1732                     sc->sc_firmware_type == WI_LUCENT) {
1733                         memcpy((char *)wreq.wi_val, (char *)sc->wi_scanbuf,
1734                             sc->wi_scanbuf_len * 2);
1735                         wreq.wi_len = sc->wi_scanbuf_len;
1736                 } else {
1737                         if (wi_read_record(sc, (struct wi_ltv_gen *)&wreq)) {
1738                                 error = EINVAL;
1739                                 break;
1740                         }
1741                 }
1742                 error = copyout(&wreq, ifr->ifr_data, sizeof(wreq));
1743                 break;
1744         case SIOCSWAVELAN:
1745                 if ((error = suser_cred(cr, NULL_CRED_OKAY)))
1746                         goto out;
1747                 error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1748                 if (error)
1749                         break;
1750                 if (wreq.wi_len > WI_MAX_DATALEN) {
1751                         error = EINVAL;
1752                         break;
1753                 }
1754                 if (wreq.wi_type == WI_RID_IFACE_STATS) {
1755                         error = EINVAL;
1756                         break;
1757                 } else if (wreq.wi_type == WI_RID_MGMT_XMIT) {
1758                         error = wi_mgmt_xmit(sc, (caddr_t)&wreq.wi_val,
1759                             wreq.wi_len);
1760                 } else if (wreq.wi_type == WI_RID_PROCFRAME) {
1761                         sc->wi_procframe = wreq.wi_val[0];
1762                 /*
1763                  * if we're getting a scan request from a wavelan card
1764                  * (non-prism2), send out a cmd_inquire to the card to scan
1765                  * results for the scan will be received through the info
1766                  * interrupt handler. otherwise the scan request can be
1767                  * directly handled by a prism2 card's rid interface.
1768                  */
1769                 } else if (wreq.wi_type == WI_RID_SCAN_REQ &&
1770                     sc->sc_firmware_type == WI_LUCENT) {
1771                         wi_cmd(sc, WI_CMD_INQUIRE, WI_INFO_SCAN_RESULTS, 0, 0);
1772                 } else {
1773                         error = wi_write_record(sc, (struct wi_ltv_gen *)&wreq);
1774                         if (!error)
1775                                 wi_setdef(sc, &wreq);
1776                 }
1777                 break;
1778         case SIOCGPRISM2DEBUG:
1779                 error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1780                 if (error)
1781                         break;
1782                 if (!(ifp->if_flags & IFF_RUNNING) ||
1783                     sc->sc_firmware_type == WI_LUCENT) {
1784                         error = EIO;
1785                         break;
1786                 }
1787                 error = wi_get_debug(sc, &wreq);
1788                 if (error == 0)
1789                         error = copyout(&wreq, ifr->ifr_data, sizeof(wreq));
1790                 break;
1791         case SIOCSPRISM2DEBUG:
1792                 if ((error = suser_cred(cr, NULL_CRED_OKAY)))
1793                         goto out;
1794                 error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1795                 if (error)
1796                         break;
1797                 error = wi_set_debug(sc, &wreq);
1798                 break;
1799         case SIOCG80211:
1800                 switch(ireq->i_type) {
1801                 case IEEE80211_IOC_SSID:
1802                         if(ireq->i_val == -1) {
1803                                 bzero(tmpssid, IEEE80211_NWID_LEN);
1804                                 error = wi_get_cur_ssid(sc, tmpssid, &len);
1805                                 if (error != 0)
1806                                         break;
1807                                 error = copyout(tmpssid, ireq->i_data,
1808                                         IEEE80211_NWID_LEN);
1809                                 ireq->i_len = len;
1810                         } else if (ireq->i_val == 0) {
1811                                 error = copyout(sc->wi_net_name,
1812                                     ireq->i_data,
1813                                     IEEE80211_NWID_LEN);
1814                                 ireq->i_len = IEEE80211_NWID_LEN;
1815                         } else
1816                                 error = EINVAL;
1817                         break;
1818                 case IEEE80211_IOC_NUMSSIDS:
1819                         ireq->i_val = 1;
1820                         break;
1821                 case IEEE80211_IOC_WEP:
1822                         if(!sc->wi_has_wep) {
1823                                 ireq->i_val = IEEE80211_WEP_NOSUP;
1824                         } else {
1825                                 if(sc->wi_use_wep) {
1826                                         ireq->i_val =
1827                                             IEEE80211_WEP_MIXED;
1828                                 } else {
1829                                         ireq->i_val =
1830                                             IEEE80211_WEP_OFF;
1831                                 }
1832                         }
1833                         break;
1834                 case IEEE80211_IOC_WEPKEY:
1835                         if(!sc->wi_has_wep ||
1836                             ireq->i_val < 0 || ireq->i_val > 3) {
1837                                 error = EINVAL;
1838                                 break;
1839                         }
1840                         len = sc->wi_keys.wi_keys[ireq->i_val].wi_keylen;
1841                         if (suser_cred(cr, NULL_CRED_OKAY))
1842                                 bcopy(sc->wi_keys.wi_keys[ireq->i_val].wi_keydat,
1843                                     tmpkey, len);
1844                         else
1845                                 bzero(tmpkey, len);
1846
1847                         ireq->i_len = len;
1848                         error = copyout(tmpkey, ireq->i_data, len);
1849
1850                         break;
1851                 case IEEE80211_IOC_NUMWEPKEYS:
1852                         if(!sc->wi_has_wep)
1853                                 error = EINVAL;
1854                         else
1855                                 ireq->i_val = 4;
1856                         break;
1857                 case IEEE80211_IOC_WEPTXKEY:
1858                         if(!sc->wi_has_wep)
1859                                 error = EINVAL;
1860                         else
1861                                 ireq->i_val = sc->wi_tx_key;
1862                         break;
1863                 case IEEE80211_IOC_AUTHMODE:
1864                         ireq->i_val = sc->wi_authmode;
1865                         break;
1866                 case IEEE80211_IOC_STATIONNAME:
1867                         error = copyout(sc->wi_node_name,
1868                             ireq->i_data, IEEE80211_NWID_LEN);
1869                         ireq->i_len = IEEE80211_NWID_LEN;
1870                         break;
1871                 case IEEE80211_IOC_CHANNEL:
1872                         wreq.wi_type = WI_RID_CURRENT_CHAN;
1873                         wreq.wi_len = WI_MAX_DATALEN;
1874                         if (wi_read_record(sc, (struct wi_ltv_gen *)&wreq))
1875                                 error = EINVAL;
1876                         else {
1877                                 ireq->i_val = wreq.wi_val[0];
1878                         }
1879                         break;
1880                 case IEEE80211_IOC_POWERSAVE:
1881                         if(sc->wi_pm_enabled)
1882                                 ireq->i_val = IEEE80211_POWERSAVE_ON;
1883                         else
1884                                 ireq->i_val = IEEE80211_POWERSAVE_OFF;
1885                         break;
1886                 case IEEE80211_IOC_POWERSAVESLEEP:
1887                         ireq->i_val = sc->wi_max_sleep;
1888                         break;
1889                 default:
1890                         error = EINVAL;
1891                 }
1892                 break;
1893         case SIOCS80211:
1894                 if ((error = suser_cred(cr, NULL_CRED_OKAY)))
1895                         goto out;
1896                 switch(ireq->i_type) {
1897                 case IEEE80211_IOC_SSID:
1898                         if (ireq->i_val != 0 ||
1899                             ireq->i_len > IEEE80211_NWID_LEN) {
1900                                 error = EINVAL;
1901                                 break;
1902                         }
1903                         /* We set both of them */
1904                         bzero(sc->wi_net_name, IEEE80211_NWID_LEN);
1905                         error = copyin(ireq->i_data,
1906                             sc->wi_net_name, ireq->i_len);
1907                         bcopy(sc->wi_net_name, sc->wi_ibss_name, IEEE80211_NWID_LEN);
1908                         break;
1909                 case IEEE80211_IOC_WEP:
1910                         /*
1911                          * These cards only support one mode so
1912                          * we just turn wep on what ever is
1913                          * passed in if it's not OFF.
1914                          */
1915                         if (ireq->i_val == IEEE80211_WEP_OFF) {
1916                                 sc->wi_use_wep = 0;
1917                         } else {
1918                                 sc->wi_use_wep = 1;
1919                         }
1920                         break;
1921                 case IEEE80211_IOC_WEPKEY:
1922                         if (ireq->i_val < 0 || ireq->i_val > 3 ||
1923                                 ireq->i_len > 13) {
1924                                 error = EINVAL;
1925                                 break;
1926                         }
1927                         bzero(sc->wi_keys.wi_keys[ireq->i_val].wi_keydat, 13);
1928                         error = copyin(ireq->i_data,
1929                             sc->wi_keys.wi_keys[ireq->i_val].wi_keydat,
1930                             ireq->i_len);
1931                         if(error)
1932                                 break;
1933                         sc->wi_keys.wi_keys[ireq->i_val].wi_keylen =
1934                                     ireq->i_len;
1935                         break;
1936                 case IEEE80211_IOC_WEPTXKEY:
1937                         if (ireq->i_val < 0 || ireq->i_val > 3) {
1938                                 error = EINVAL;
1939                                 break;
1940                         }
1941                         sc->wi_tx_key = ireq->i_val;
1942                         break;
1943                 case IEEE80211_IOC_AUTHMODE:
1944                         sc->wi_authmode = ireq->i_val;
1945                         break;
1946                 case IEEE80211_IOC_STATIONNAME:
1947                         if (ireq->i_len > 32) {
1948                                 error = EINVAL;
1949                                 break;
1950                         }
1951                         bzero(sc->wi_node_name, 32);
1952                         error = copyin(ireq->i_data,
1953                             sc->wi_node_name, ireq->i_len);
1954                         break;
1955                 case IEEE80211_IOC_CHANNEL:
1956                         /*
1957                          * The actual range is 1-14, but if you
1958                          * set it to 0 you get the default. So
1959                          * we let that work too.
1960                          */
1961                         if (ireq->i_val < 0 || ireq->i_val > 14) {
1962                                 error = EINVAL;
1963                                 break;
1964                         }
1965                         sc->wi_channel = ireq->i_val;
1966                         break;
1967                 case IEEE80211_IOC_POWERSAVE:
1968                         switch (ireq->i_val) {
1969                         case IEEE80211_POWERSAVE_OFF:
1970                                 sc->wi_pm_enabled = 0;
1971                                 break;
1972                         case IEEE80211_POWERSAVE_ON:
1973                                 sc->wi_pm_enabled = 1;
1974                                 break;
1975                         default:
1976                                 error = EINVAL;
1977                                 break;
1978                         }
1979                         break;
1980                 case IEEE80211_IOC_POWERSAVESLEEP:
1981                         if (ireq->i_val < 0) {
1982                                 error = EINVAL;
1983                                 break;
1984                         }
1985                         sc->wi_max_sleep = ireq->i_val;
1986                         break;
1987                 default:
1988                         error = EINVAL;
1989                         break;
1990                 }
1991
1992                 /* Reinitialize WaveLAN. */
1993                 wi_init(sc);
1994
1995         break;
1996         case SIOCHOSTAP_ADD:
1997         case SIOCHOSTAP_DEL:
1998         case SIOCHOSTAP_GET:
1999         case SIOCHOSTAP_GETALL:
2000         case SIOCHOSTAP_GFLAGS:
2001         case SIOCHOSTAP_SFLAGS:
2002                 /* Send all Host AP specific ioctl's to Host AP code. */
2003                 error = wihap_ioctl(sc, command, data);
2004                 break;
2005         default:
2006                 error = EINVAL;
2007                 break;
2008         }
2009 out:
2010         WI_UNLOCK(sc, s);
2011
2012         return(error);
2013 }
2014
2015 static void
2016 wi_init(xsc)
2017         void                    *xsc;
2018 {
2019         struct wi_softc         *sc = xsc;
2020         struct ifnet            *ifp = &sc->arpcom.ac_if;
2021         struct wi_ltv_macaddr   mac;
2022         int                     id = 0;
2023         int                     s;
2024
2025         WI_LOCK(sc, s);
2026
2027         if (sc->wi_gone) {
2028                 WI_UNLOCK(sc, s);
2029                 return;
2030         }
2031
2032         if (ifp->if_flags & IFF_RUNNING)
2033                 wi_stop(sc);
2034
2035         wi_reset(sc);
2036
2037         /* Program max data length. */
2038         WI_SETVAL(WI_RID_MAX_DATALEN, sc->wi_max_data_len);
2039
2040         /* Set the port type. */
2041         WI_SETVAL(WI_RID_PORTTYPE, sc->wi_ptype);
2042
2043         /* Enable/disable IBSS creation. */
2044         WI_SETVAL(WI_RID_CREATE_IBSS, sc->wi_create_ibss);
2045
2046         /* Program the RTS/CTS threshold. */
2047         WI_SETVAL(WI_RID_RTS_THRESH, sc->wi_rts_thresh);
2048
2049         /* Program the TX rate */
2050         WI_SETVAL(WI_RID_TX_RATE, sc->wi_tx_rate);
2051
2052         /* Access point density */
2053         WI_SETVAL(WI_RID_SYSTEM_SCALE, sc->wi_ap_density);
2054
2055         /* Power Management Enabled */
2056         WI_SETVAL(WI_RID_PM_ENABLED, sc->wi_pm_enabled);
2057
2058         /* Power Managment Max Sleep */
2059         WI_SETVAL(WI_RID_MAX_SLEEP, sc->wi_max_sleep);
2060
2061         /* Roaming type */
2062         WI_SETVAL(WI_RID_ROAMING_MODE, sc->wi_roaming);
2063
2064         /* Specify the IBSS name */
2065         WI_SETSTR(WI_RID_OWN_SSID, sc->wi_ibss_name);
2066
2067         /* Specify the network name */
2068         WI_SETSTR(WI_RID_DESIRED_SSID, sc->wi_net_name);
2069
2070         /* Specify the frequency to use */
2071         WI_SETVAL(WI_RID_OWN_CHNL, sc->wi_channel);
2072
2073         /* Program the nodename. */
2074         WI_SETSTR(WI_RID_NODENAME, sc->wi_node_name);
2075
2076         /* Specify the authentication mode. */
2077         WI_SETVAL(WI_RID_CNFAUTHMODE, sc->wi_authmode);
2078
2079         /* Set our MAC address. */
2080         mac.wi_len = 4;
2081         mac.wi_type = WI_RID_MAC_NODE;
2082         bcopy((char *)&sc->arpcom.ac_enaddr,
2083            (char *)&mac.wi_mac_addr, ETHER_ADDR_LEN);
2084         wi_write_record(sc, (struct wi_ltv_gen *)&mac);
2085
2086         /*
2087          * Initialize promisc mode.
2088          *      Being in the Host-AP mode causes
2089          *      great deal of pain if promisc mode is set.
2090          *      Therefore we avoid confusing the firmware
2091          *      and always reset promisc mode in Host-AP regime,
2092          *      it shows us all the packets anyway.
2093          */
2094         if (sc->wi_ptype != WI_PORTTYPE_AP && ifp->if_flags & IFF_PROMISC)
2095                 WI_SETVAL(WI_RID_PROMISC, 1);
2096         else
2097                 WI_SETVAL(WI_RID_PROMISC, 0);
2098
2099         /* Configure WEP. */
2100         if (sc->wi_has_wep) {
2101                 WI_SETVAL(WI_RID_ENCRYPTION, sc->wi_use_wep);
2102                 WI_SETVAL(WI_RID_TX_CRYPT_KEY, sc->wi_tx_key);
2103                 sc->wi_keys.wi_len = (sizeof(struct wi_ltv_keys) / 2) + 1;
2104                 sc->wi_keys.wi_type = WI_RID_DEFLT_CRYPT_KEYS;
2105                 wi_write_record(sc, (struct wi_ltv_gen *)&sc->wi_keys);
2106                 if (sc->sc_firmware_type != WI_LUCENT && sc->wi_use_wep) {
2107                         /*
2108                          * ONLY HWB3163 EVAL-CARD Firmware version
2109                          * less than 0.8 variant2
2110                          *
2111                          * If promiscuous mode disable, Prism2 chip
2112                          * does not work with WEP.
2113                          * It is under investigation for details.
2114                          * (ichiro@netbsd.org)
2115                          *
2116                          * And make sure that we don't need to do it
2117                          * in hostap mode, since it interferes with
2118                          * the above hostap workaround.
2119                          */
2120                         if (sc->wi_ptype != WI_PORTTYPE_AP &&
2121                             sc->sc_firmware_type == WI_INTERSIL &&
2122                             sc->sc_sta_firmware_ver < 802 ) {
2123                                 /* firm ver < 0.8 variant 2 */
2124                                 WI_SETVAL(WI_RID_PROMISC, 1);
2125                         }
2126                         WI_SETVAL(WI_RID_CNFAUTHMODE, sc->wi_authtype);
2127                 }
2128         }
2129
2130         /* Set multicast filter. */
2131         wi_setmulti(sc);
2132
2133         /* Enable desired port */
2134         wi_cmd(sc, WI_CMD_ENABLE | sc->wi_portnum, 0, 0, 0);
2135
2136         if (wi_alloc_nicmem(sc, ETHER_MAX_LEN + sizeof(struct wi_frame) + 8, &id))
2137                 device_printf(sc->dev, "tx buffer allocation failed\n");
2138         sc->wi_tx_data_id = id;
2139
2140         if (wi_alloc_nicmem(sc, ETHER_MAX_LEN + sizeof(struct wi_frame) + 8, &id))
2141                 device_printf(sc->dev, "mgmt. buffer allocation failed\n");
2142         sc->wi_tx_mgmt_id = id;
2143
2144         /* enable interrupts */
2145         CSR_WRITE_2(sc, WI_INT_EN, WI_INTRS);
2146
2147         wihap_init(sc);
2148
2149         ifp->if_flags |= IFF_RUNNING;
2150         ifp->if_flags &= ~IFF_OACTIVE;
2151
2152         sc->wi_stat_ch = timeout(wi_inquire, sc, hz * 60);
2153         WI_UNLOCK(sc, s);
2154
2155         return;
2156 }
2157
2158 #define RC4STATE 256
2159 #define RC4KEYLEN 16
2160 #define RC4SWAP(x,y) \
2161     do { u_int8_t t = state[x]; state[x] = state[y]; state[y] = t; } while(0)
2162
2163 static void
2164 wi_do_hostencrypt(struct wi_softc *sc, caddr_t buf, int len)
2165 {
2166         u_int32_t i, crc, klen;
2167         u_int8_t state[RC4STATE], key[RC4KEYLEN];
2168         u_int8_t x, y, *dat;
2169
2170         if (!sc->wi_icv_flag) {
2171                 sc->wi_icv = arc4random();
2172                 sc->wi_icv_flag++;
2173         } else
2174                 sc->wi_icv++;
2175         /*
2176          * Skip 'bad' IVs from Fluhrer/Mantin/Shamir:
2177          * (B, 255, N) with 3 <= B < 8
2178          */
2179         if (sc->wi_icv >= 0x03ff00 &&
2180             (sc->wi_icv & 0xf8ff00) == 0x00ff00)
2181                 sc->wi_icv += 0x000100;
2182
2183         /* prepend 24bit IV to tx key, byte order does not matter */
2184         key[0] = sc->wi_icv >> 16;
2185         key[1] = sc->wi_icv >> 8;
2186         key[2] = sc->wi_icv;
2187
2188         klen = sc->wi_keys.wi_keys[sc->wi_tx_key].wi_keylen +
2189             IEEE80211_WEP_IVLEN;
2190         klen = (klen >= RC4KEYLEN) ? RC4KEYLEN : RC4KEYLEN/2;
2191         bcopy((char *)&sc->wi_keys.wi_keys[sc->wi_tx_key].wi_keydat,
2192             (char *)key + IEEE80211_WEP_IVLEN, klen - IEEE80211_WEP_IVLEN);
2193
2194         /* rc4 keysetup */
2195         x = y = 0;
2196         for (i = 0; i < RC4STATE; i++)
2197                 state[i] = i;
2198         for (i = 0; i < RC4STATE; i++) {
2199                 y = (key[x] + state[i] + y) % RC4STATE;
2200                 RC4SWAP(i, y);
2201                 x = (x + 1) % klen;
2202         }
2203
2204         /* output: IV, tx keyid, rc4(data), rc4(crc32(data)) */
2205         dat = buf;
2206         dat[0] = key[0];
2207         dat[1] = key[1];
2208         dat[2] = key[2];
2209         dat[3] = sc->wi_tx_key << 6;            /* pad and keyid */
2210         dat += 4;
2211
2212         /* compute rc4 over data, crc32 over data */
2213         crc = ~0;
2214         x = y = 0;
2215         for (i = 0; i < len; i++) {
2216                 x = (x + 1) % RC4STATE;
2217                 y = (state[x] + y) % RC4STATE;
2218                 RC4SWAP(x, y);
2219                 crc = crc32_tab[(crc ^ dat[i]) & 0xff] ^ (crc >> 8);
2220                 dat[i] ^= state[(state[x] + state[y]) % RC4STATE];
2221         }
2222         crc = ~crc;
2223         dat += len;
2224
2225         /* append little-endian crc32 and encrypt */
2226         dat[0] = crc;
2227         dat[1] = crc >> 8;
2228         dat[2] = crc >> 16;
2229         dat[3] = crc >> 24;
2230         for (i = 0; i < IEEE80211_WEP_CRCLEN; i++) {
2231                 x = (x + 1) % RC4STATE;
2232                 y = (state[x] + y) % RC4STATE;
2233                 RC4SWAP(x, y);
2234                 dat[i] ^= state[(state[x] + state[y]) % RC4STATE];
2235         }
2236 }
2237
2238 static void
2239 wi_start(ifp)
2240         struct ifnet            *ifp;
2241 {
2242         struct wi_softc         *sc;
2243         struct mbuf             *m0;
2244         struct wi_frame         tx_frame;
2245         struct ether_header     *eh;
2246         int                     id;
2247         int                     s;
2248
2249         sc = ifp->if_softc;
2250         WI_LOCK(sc, s);
2251
2252         if (sc->wi_gone) {
2253                 WI_UNLOCK(sc, s);
2254                 return;
2255         }
2256
2257         if (ifp->if_flags & IFF_OACTIVE) {
2258                 WI_UNLOCK(sc, s);
2259                 return;
2260         }
2261
2262 nextpkt:
2263         IF_DEQUEUE(&ifp->if_snd, m0);
2264         if (m0 == NULL) {
2265                 WI_UNLOCK(sc, s);
2266                 return;
2267         }
2268
2269         bzero((char *)&tx_frame, sizeof(tx_frame));
2270         tx_frame.wi_frame_ctl = htole16(WI_FTYPE_DATA);
2271         id = sc->wi_tx_data_id;
2272         eh = mtod(m0, struct ether_header *);
2273
2274         if (sc->wi_ptype == WI_PORTTYPE_AP) {
2275                 if (!wihap_check_tx(&sc->wi_hostap_info,
2276                     eh->ether_dhost, &tx_frame.wi_tx_rate)) {
2277                         if (ifp->if_flags & IFF_DEBUG)
2278                                 printf("wi_start: dropping unassoc "
2279                                        "dst %6D\n", eh->ether_dhost, ":");
2280                         m_freem(m0);
2281                         goto nextpkt;
2282                 }
2283         }
2284         /*
2285          * Use RFC1042 encoding for IP and ARP datagrams,
2286          * 802.3 for anything else.
2287          */
2288         if (ntohs(eh->ether_type) > ETHER_MAX_LEN) {
2289                 bcopy((char *)&eh->ether_dhost,
2290                     (char *)&tx_frame.wi_addr1, ETHER_ADDR_LEN);
2291                 if (sc->wi_ptype == WI_PORTTYPE_AP) {
2292                         tx_frame.wi_tx_ctl = WI_ENC_TX_MGMT; /* XXX */
2293                         tx_frame.wi_frame_ctl |= WI_FCTL_FROMDS;
2294                         if (sc->wi_use_wep)
2295                                 tx_frame.wi_frame_ctl |= WI_FCTL_WEP;
2296                         bcopy((char *)&sc->arpcom.ac_enaddr,
2297                               (char *)&tx_frame.wi_addr2, ETHER_ADDR_LEN);
2298                         bcopy((char *)&eh->ether_shost,
2299                               (char *)&tx_frame.wi_addr3, ETHER_ADDR_LEN);
2300                 }
2301                 else
2302                         bcopy((char *)&eh->ether_shost,
2303                             (char *)&tx_frame.wi_addr2, ETHER_ADDR_LEN);
2304                 bcopy((char *)&eh->ether_dhost,
2305                     (char *)&tx_frame.wi_dst_addr, ETHER_ADDR_LEN);
2306                 bcopy((char *)&eh->ether_shost,
2307                     (char *)&tx_frame.wi_src_addr, ETHER_ADDR_LEN);
2308
2309                 tx_frame.wi_dat_len = m0->m_pkthdr.len - WI_SNAPHDR_LEN;
2310                 tx_frame.wi_dat[0] = htons(WI_SNAP_WORD0);
2311                 tx_frame.wi_dat[1] = htons(WI_SNAP_WORD1);
2312                 tx_frame.wi_len = htons(m0->m_pkthdr.len - WI_SNAPHDR_LEN);
2313                 tx_frame.wi_type = eh->ether_type;
2314
2315                 if (sc->wi_ptype == WI_PORTTYPE_AP && sc->wi_use_wep) {
2316                         /* Do host encryption. */
2317                         bcopy(&tx_frame.wi_dat[0], &sc->wi_txbuf[4], 8);
2318                         m_copydata(m0, sizeof(struct ether_header),
2319                             m0->m_pkthdr.len - sizeof(struct ether_header),
2320                             (caddr_t)&sc->wi_txbuf[12]);
2321                         wi_do_hostencrypt(sc, &sc->wi_txbuf[0],
2322                             tx_frame.wi_dat_len);
2323                         tx_frame.wi_dat_len += IEEE80211_WEP_IVLEN +
2324                             IEEE80211_WEP_KIDLEN + IEEE80211_WEP_CRCLEN;
2325                         wi_write_data(sc, id, 0, (caddr_t)&tx_frame,
2326                             sizeof(struct wi_frame));
2327                         wi_write_data(sc, id, WI_802_11_OFFSET_RAW,
2328                             (caddr_t)&sc->wi_txbuf, (m0->m_pkthdr.len -
2329                             sizeof(struct ether_header)) + 18);
2330                 } else {
2331                         m_copydata(m0, sizeof(struct ether_header),
2332                             m0->m_pkthdr.len - sizeof(struct ether_header),
2333                             (caddr_t)&sc->wi_txbuf);
2334                         wi_write_data(sc, id, 0, (caddr_t)&tx_frame,
2335                             sizeof(struct wi_frame));
2336                         wi_write_data(sc, id, WI_802_11_OFFSET,
2337                             (caddr_t)&sc->wi_txbuf, (m0->m_pkthdr.len -
2338                             sizeof(struct ether_header)) + 2);
2339                 }
2340         } else {
2341                 tx_frame.wi_dat_len = m0->m_pkthdr.len;
2342
2343                 if (sc->wi_ptype == WI_PORTTYPE_AP && sc->wi_use_wep) {
2344                         /* Do host encryption. */
2345                         printf( "XXX: host encrypt not implemented for 802.3\n" );
2346                 } else {
2347                         eh->ether_type = htons(m0->m_pkthdr.len -
2348                             WI_SNAPHDR_LEN);
2349                         m_copydata(m0, 0, m0->m_pkthdr.len,
2350                             (caddr_t)&sc->wi_txbuf);
2351
2352                         wi_write_data(sc, id, 0, (caddr_t)&tx_frame,
2353                             sizeof(struct wi_frame));
2354                         wi_write_data(sc, id, WI_802_3_OFFSET,
2355                             (caddr_t)&sc->wi_txbuf, m0->m_pkthdr.len + 2);
2356                 }
2357         }
2358
2359         /*
2360          * If there's a BPF listner, bounce a copy of
2361          * this frame to him. Also, don't send this to the bpf sniffer
2362          * if we're in procframe or monitor sniffing mode.
2363          */
2364         if (!(sc->wi_procframe || sc->wi_debug.wi_monitor) && ifp->if_bpf)
2365                 bpf_mtap(ifp, m0);
2366
2367         m_freem(m0);
2368
2369         if (wi_cmd(sc, WI_CMD_TX|WI_RECLAIM, id, 0, 0))
2370                 device_printf(sc->dev, "xmit failed\n");
2371
2372         ifp->if_flags |= IFF_OACTIVE;
2373
2374         /*
2375          * Set a timeout in case the chip goes out to lunch.
2376          */
2377         ifp->if_timer = 5;
2378
2379         WI_UNLOCK(sc, s);
2380         return;
2381 }
2382
2383 int
2384 wi_mgmt_xmit(sc, data, len)
2385         struct wi_softc         *sc;
2386         caddr_t                 data;
2387         int                     len;
2388 {
2389         struct wi_frame         tx_frame;
2390         int                     id;
2391         struct wi_80211_hdr     *hdr;
2392         caddr_t                 dptr;
2393
2394         if (sc->wi_gone)
2395                 return(ENODEV);
2396
2397         hdr = (struct wi_80211_hdr *)data;
2398         dptr = data + sizeof(struct wi_80211_hdr);
2399
2400         bzero((char *)&tx_frame, sizeof(tx_frame));
2401         id = sc->wi_tx_mgmt_id;
2402
2403         bcopy((char *)hdr, (char *)&tx_frame.wi_frame_ctl,
2404            sizeof(struct wi_80211_hdr));
2405
2406         tx_frame.wi_tx_ctl = WI_ENC_TX_MGMT;
2407         tx_frame.wi_dat_len = len - sizeof(struct wi_80211_hdr);
2408         tx_frame.wi_len = htons(tx_frame.wi_dat_len);
2409
2410         wi_write_data(sc, id, 0, (caddr_t)&tx_frame, sizeof(struct wi_frame));
2411         wi_write_data(sc, id, WI_802_11_OFFSET_RAW, dptr,
2412             len - sizeof(struct wi_80211_hdr) + 2);
2413
2414         if (wi_cmd(sc, WI_CMD_TX|WI_RECLAIM, id, 0, 0)) {
2415                 device_printf(sc->dev, "xmit failed\n");
2416                 return(EIO);
2417         }
2418
2419         return(0);
2420 }
2421
2422 static void
2423 wi_stop(sc)
2424         struct wi_softc         *sc;
2425 {
2426         struct ifnet            *ifp;
2427         int                     s;
2428
2429         WI_LOCK(sc, s);
2430
2431         if (sc->wi_gone) {
2432                 WI_UNLOCK(sc, s);
2433                 return;
2434         }
2435
2436         wihap_shutdown(sc);
2437
2438         ifp = &sc->arpcom.ac_if;
2439
2440         /*
2441          * If the card is gone and the memory port isn't mapped, we will
2442          * (hopefully) get 0xffff back from the status read, which is not
2443          * a valid status value.
2444          */
2445         if (CSR_READ_2(sc, WI_STATUS) != 0xffff) {
2446                 CSR_WRITE_2(sc, WI_INT_EN, 0);
2447                 wi_cmd(sc, WI_CMD_DISABLE|sc->wi_portnum, 0, 0, 0);
2448         }
2449
2450         untimeout(wi_inquire, sc, sc->wi_stat_ch);
2451
2452         ifp->if_flags &= ~(IFF_RUNNING|IFF_OACTIVE);
2453
2454         WI_UNLOCK(sc, s);
2455         return;
2456 }
2457
2458 static void
2459 wi_watchdog(ifp)
2460         struct ifnet            *ifp;
2461 {
2462         struct wi_softc         *sc;
2463
2464         sc = ifp->if_softc;
2465
2466         device_printf(sc->dev, "watchdog timeout\n");
2467
2468         wi_init(sc);
2469
2470         ifp->if_oerrors++;
2471
2472         return;
2473 }
2474
2475 int
2476 wi_alloc(dev, rid)
2477         device_t                dev;
2478         int                     rid;
2479 {
2480         struct wi_softc         *sc = device_get_softc(dev);
2481
2482         if (sc->wi_bus_type != WI_BUS_PCI_NATIVE) {
2483                 sc->iobase_rid = rid;
2484                 sc->iobase = bus_alloc_resource(dev, SYS_RES_IOPORT,
2485                     &sc->iobase_rid, 0, ~0, (1 << 6),
2486                     rman_make_alignment_flags(1 << 6) | RF_ACTIVE);
2487                 if (!sc->iobase) {
2488                         device_printf(dev, "No I/O space?!\n");
2489                         return (ENXIO);
2490                 }
2491
2492                 sc->wi_io_addr = rman_get_start(sc->iobase);
2493                 sc->wi_btag = rman_get_bustag(sc->iobase);
2494                 sc->wi_bhandle = rman_get_bushandle(sc->iobase);
2495         } else {
2496                 sc->mem_rid = rid;
2497                 sc->mem = bus_alloc_resource(dev, SYS_RES_MEMORY,
2498                     &sc->mem_rid, 0, ~0, 1, RF_ACTIVE);
2499
2500                 if (!sc->mem) {
2501                         device_printf(dev, "No Mem space on prism2.5?\n");
2502                         return (ENXIO);
2503                 }
2504
2505                 sc->wi_btag = rman_get_bustag(sc->mem);
2506                 sc->wi_bhandle = rman_get_bushandle(sc->mem);
2507         }
2508
2509
2510         sc->irq_rid = 0;
2511         sc->irq = bus_alloc_resource(dev, SYS_RES_IRQ, &sc->irq_rid,
2512             0, ~0, 1, RF_ACTIVE |
2513             ((sc->wi_bus_type == WI_BUS_PCCARD) ? 0 : RF_SHAREABLE));
2514
2515         if (!sc->irq) {
2516                 wi_free(dev);
2517                 device_printf(dev, "No irq?!\n");
2518                 return (ENXIO);
2519         }
2520
2521         sc->dev = dev;
2522         sc->wi_unit = device_get_unit(dev);
2523
2524         return (0);
2525 }
2526
2527 void
2528 wi_free(dev)
2529         device_t                dev;
2530 {
2531         struct wi_softc         *sc = device_get_softc(dev);
2532
2533         if (sc->iobase != NULL) {
2534                 bus_release_resource(dev, SYS_RES_IOPORT, sc->iobase_rid, sc->iobase);
2535                 sc->iobase = NULL;
2536         }
2537         if (sc->irq != NULL) {
2538                 bus_release_resource(dev, SYS_RES_IRQ, sc->irq_rid, sc->irq);
2539                 sc->irq = NULL;
2540         }
2541         if (sc->mem != NULL) {
2542                 bus_release_resource(dev, SYS_RES_MEMORY, sc->mem_rid, sc->mem);
2543                 sc->mem = NULL;
2544         }
2545
2546         return;
2547 }
2548
2549 void
2550 wi_shutdown(dev)
2551         device_t                dev;
2552 {
2553         struct wi_softc         *sc;
2554
2555         sc = device_get_softc(dev);
2556         wi_stop(sc);
2557
2558         return;
2559 }
2560
2561 #ifdef WICACHE
2562 /* wavelan signal strength cache code.
2563  * store signal/noise/quality on per MAC src basis in
2564  * a small fixed cache.  The cache wraps if > MAX slots
2565  * used.  The cache may be zeroed out to start over.
2566  * Two simple filters exist to reduce computation:
2567  * 1. ip only (literally 0x800) which may be used
2568  * to ignore some packets.  It defaults to ip only.
2569  * it could be used to focus on broadcast, non-IP 802.11 beacons.
2570  * 2. multicast/broadcast only.  This may be used to
2571  * ignore unicast packets and only cache signal strength
2572  * for multicast/broadcast packets (beacons); e.g., Mobile-IP
2573  * beacons and not unicast traffic.
2574  *
2575  * The cache stores (MAC src(index), IP src (major clue), signal,
2576  *      quality, noise)
2577  *
2578  * No apologies for storing IP src here.  It's easy and saves much
2579  * trouble elsewhere.  The cache is assumed to be INET dependent,
2580  * although it need not be.
2581  */
2582
2583 #ifdef documentation
2584
2585 int wi_sigitems;                                /* number of cached entries */
2586 struct wi_sigcache wi_sigcache[MAXWICACHE];  /*  array of cache entries */
2587 int wi_nextitem;                                /*  index/# of entries */
2588
2589
2590 #endif
2591
2592 /* control variables for cache filtering.  Basic idea is
2593  * to reduce cost (e.g., to only Mobile-IP agent beacons
2594  * which are broadcast or multicast).  Still you might
2595  * want to measure signal strength with unicast ping packets
2596  * on a pt. to pt. ant. setup.
2597  */
2598 /* set true if you want to limit cache items to broadcast/mcast
2599  * only packets (not unicast).  Useful for mobile-ip beacons which
2600  * are broadcast/multicast at network layer.  Default is all packets
2601  * so ping/unicast will work say with pt. to pt. antennae setup.
2602  */
2603 static int wi_cache_mcastonly = 0;
2604 SYSCTL_INT(_machdep, OID_AUTO, wi_cache_mcastonly, CTLFLAG_RW,
2605         &wi_cache_mcastonly, 0, "");
2606
2607 /* set true if you want to limit cache items to IP packets only
2608 */
2609 static int wi_cache_iponly = 1;
2610 SYSCTL_INT(_machdep, OID_AUTO, wi_cache_iponly, CTLFLAG_RW,
2611         &wi_cache_iponly, 0, "");
2612
2613 /*
2614  * Original comments:
2615  * -----------------
2616  * wi_cache_store, per rx packet store signal
2617  * strength in MAC (src) indexed cache.
2618  *
2619  * follows linux driver in how signal strength is computed.
2620  * In ad hoc mode, we use the rx_quality field.
2621  * signal and noise are trimmed to fit in the range from 47..138.
2622  * rx_quality field MSB is signal strength.
2623  * rx_quality field LSB is noise.
2624  * "quality" is (signal - noise) as is log value.
2625  * note: quality CAN be negative.
2626  *
2627  * In BSS mode, we use the RID for communication quality.
2628  * TBD:  BSS mode is currently untested.
2629  *
2630  * Bill's comments:
2631  * ---------------
2632  * Actually, we use the rx_quality field all the time for both "ad-hoc"
2633  * and BSS modes. Why? Because reading an RID is really, really expensive:
2634  * there's a bunch of PIO operations that have to be done to read a record
2635  * from the NIC, and reading the comms quality RID each time a packet is
2636  * received can really hurt performance. We don't have to do this anyway:
2637  * the comms quality field only reflects the values in the rx_quality field
2638  * anyway. The comms quality RID is only meaningful in infrastructure mode,
2639  * but the values it contains are updated based on the rx_quality from
2640  * frames received from the access point.
2641  *
2642  * Also, according to Lucent, the signal strength and noise level values
2643  * can be converted to dBms by subtracting 149, so I've modified the code
2644  * to do that instead of the scaling it did originally.
2645  */
2646 static void
2647 wi_cache_store(struct wi_softc *sc, struct ether_header *eh,
2648                      struct mbuf *m, unsigned short rx_quality)
2649 {
2650         struct ip *ip = 0;
2651         int i;
2652         static int cache_slot = 0;      /* use this cache entry */
2653         static int wrapindex = 0;       /* next "free" cache entry */
2654         int sig, noise;
2655         int sawip=0;
2656
2657         /*
2658          * filters:
2659          * 1. ip only
2660          * 2. configurable filter to throw out unicast packets,
2661          * keep multicast only.
2662          */
2663
2664         if ((ntohs(eh->ether_type) == ETHERTYPE_IP)) {
2665                 sawip = 1;
2666         }
2667
2668         /*
2669          * filter for ip packets only
2670         */
2671         if (wi_cache_iponly && !sawip) {
2672                 return;
2673         }
2674
2675         /*
2676          *  filter for broadcast/multicast only
2677          */
2678         if (wi_cache_mcastonly && ((eh->ether_dhost[0] & 1) == 0)) {
2679                 return;
2680         }
2681
2682 #ifdef SIGDEBUG
2683         printf("wi%d: q value %x (MSB=0x%x, LSB=0x%x) \n", sc->wi_unit,
2684             rx_quality & 0xffff, rx_quality >> 8, rx_quality & 0xff);
2685 #endif
2686
2687         /*
2688          *  find the ip header.  we want to store the ip_src
2689          * address.
2690          */
2691         if (sawip)
2692                 ip = mtod(m, struct ip *);
2693
2694         /*
2695          * do a linear search for a matching MAC address
2696          * in the cache table
2697          * . MAC address is 6 bytes,
2698          * . var w_nextitem holds total number of entries already cached
2699          */
2700         for(i = 0; i < sc->wi_nextitem; i++) {
2701                 if (! bcmp(eh->ether_shost , sc->wi_sigcache[i].macsrc,  6 )) {
2702                         /*
2703                          * Match!,
2704                          * so we already have this entry,
2705                          * update the data
2706                          */
2707                         break;
2708                 }
2709         }
2710
2711         /*
2712          *  did we find a matching mac address?
2713          * if yes, then overwrite a previously existing cache entry
2714          */
2715         if (i < sc->wi_nextitem )   {
2716                 cache_slot = i;
2717         }
2718         /*
2719          * else, have a new address entry,so
2720          * add this new entry,
2721          * if table full, then we need to replace LRU entry
2722          */
2723         else    {
2724
2725                 /*
2726                  * check for space in cache table
2727                  * note: wi_nextitem also holds number of entries
2728                  * added in the cache table
2729                  */
2730                 if ( sc->wi_nextitem < MAXWICACHE ) {
2731                         cache_slot = sc->wi_nextitem;
2732                         sc->wi_nextitem++;
2733                         sc->wi_sigitems = sc->wi_nextitem;
2734                 }
2735                 /* no space found, so simply wrap with wrap index
2736                  * and "zap" the next entry
2737                  */
2738                 else {
2739                         if (wrapindex == MAXWICACHE) {
2740                                 wrapindex = 0;
2741                         }
2742                         cache_slot = wrapindex++;
2743                 }
2744         }
2745
2746         /*
2747          * invariant: cache_slot now points at some slot
2748          * in cache.
2749          */
2750         if (cache_slot < 0 || cache_slot >= MAXWICACHE) {
2751                 log(LOG_ERR, "wi_cache_store, bad index: %d of "
2752                     "[0..%d], gross cache error\n",
2753                     cache_slot, MAXWICACHE);
2754                 return;
2755         }
2756
2757         /*
2758          *  store items in cache
2759          *  .ip source address
2760          *  .mac src
2761          *  .signal, etc.
2762          */
2763         if (sawip)
2764                 sc->wi_sigcache[cache_slot].ipsrc = ip->ip_src.s_addr;
2765         bcopy( eh->ether_shost, sc->wi_sigcache[cache_slot].macsrc,  6);
2766
2767         sig = (rx_quality >> 8) & 0xFF;
2768         noise = rx_quality & 0xFF;
2769         sc->wi_sigcache[cache_slot].signal = sig - 149;
2770         sc->wi_sigcache[cache_slot].noise = noise - 149;
2771         sc->wi_sigcache[cache_slot].quality = sig - noise;
2772
2773         return;
2774 }
2775 #endif
2776
2777 static int
2778 wi_get_cur_ssid(sc, ssid, len)
2779         struct wi_softc         *sc;
2780         char                    *ssid;
2781         int                     *len;
2782 {
2783         int                     error = 0;
2784         struct wi_req           wreq;
2785
2786         wreq.wi_len = WI_MAX_DATALEN;
2787         switch (sc->wi_ptype) {
2788         case WI_PORTTYPE_AP:
2789                 *len = IEEE80211_NWID_LEN;
2790                 bcopy(sc->wi_net_name, ssid, IEEE80211_NWID_LEN);
2791                 break;
2792         case WI_PORTTYPE_ADHOC:
2793                 wreq.wi_type = WI_RID_CURRENT_SSID;
2794                 error = wi_read_record(sc, (struct wi_ltv_gen *)&wreq);
2795                 if (error != 0)
2796                         break;
2797                 if (wreq.wi_val[0] > IEEE80211_NWID_LEN) {
2798                         error = EINVAL;
2799                         break;
2800                 }
2801                 *len = wreq.wi_val[0];
2802                 bcopy(&wreq.wi_val[1], ssid, IEEE80211_NWID_LEN);
2803                 break;
2804         case WI_PORTTYPE_BSS:
2805                 wreq.wi_type = WI_RID_COMMQUAL;
2806                 error = wi_read_record(sc, (struct wi_ltv_gen *)&wreq);
2807                 if (error != 0)
2808                         break;
2809                 if (wreq.wi_val[0] != 0) /* associated */ {
2810                         wreq.wi_type = WI_RID_CURRENT_SSID;
2811                         wreq.wi_len = WI_MAX_DATALEN;
2812                         error = wi_read_record(sc, (struct wi_ltv_gen *)&wreq);
2813                         if (error != 0)
2814                                 break;
2815                         if (wreq.wi_val[0] > IEEE80211_NWID_LEN) {
2816                                 error = EINVAL;
2817                                 break;
2818                         }
2819                         *len = wreq.wi_val[0];
2820                         bcopy(&wreq.wi_val[1], ssid, IEEE80211_NWID_LEN);
2821                 } else {
2822                         *len = IEEE80211_NWID_LEN;
2823                         bcopy(sc->wi_net_name, ssid, IEEE80211_NWID_LEN);
2824                 }
2825                 break;
2826         default:
2827                 error = EINVAL;
2828                 break;
2829         }
2830
2831         return error;
2832 }
2833
2834 static int
2835 wi_media_change(ifp)
2836         struct ifnet            *ifp;
2837 {
2838         struct wi_softc         *sc = ifp->if_softc;
2839         int                     otype = sc->wi_ptype;
2840         int                     orate = sc->wi_tx_rate;
2841         int                     ocreate_ibss = sc->wi_create_ibss;
2842
2843         if ((sc->ifmedia.ifm_cur->ifm_media & IFM_IEEE80211_HOSTAP) &&
2844             sc->sc_firmware_type != WI_INTERSIL)
2845                 return (EINVAL);
2846
2847         sc->wi_create_ibss = 0;
2848
2849         switch (sc->ifmedia.ifm_cur->ifm_media & IFM_OMASK) {
2850         case 0:
2851                 sc->wi_ptype = WI_PORTTYPE_BSS;
2852                 break;
2853         case IFM_IEEE80211_ADHOC:
2854                 sc->wi_ptype = WI_PORTTYPE_ADHOC;
2855                 break;
2856         case IFM_IEEE80211_HOSTAP:
2857                 sc->wi_ptype = WI_PORTTYPE_AP;
2858                 break;
2859         case IFM_IEEE80211_IBSSMASTER:
2860         case IFM_IEEE80211_IBSSMASTER|IFM_IEEE80211_IBSS:
2861                 if (!(sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS))
2862                         return (EINVAL);
2863                 sc->wi_create_ibss = 1;
2864                 /* FALLTHROUGH */
2865         case IFM_IEEE80211_IBSS:
2866                 sc->wi_ptype = WI_PORTTYPE_IBSS;
2867                 break;
2868         default:
2869                 /* Invalid combination. */
2870                 return (EINVAL);
2871         }
2872
2873         switch (IFM_SUBTYPE(sc->ifmedia.ifm_cur->ifm_media)) {
2874         case IFM_IEEE80211_DS1:
2875                 sc->wi_tx_rate = 1;
2876                 break;
2877         case IFM_IEEE80211_DS2:
2878                 sc->wi_tx_rate = 2;
2879                 break;
2880         case IFM_IEEE80211_DS5:
2881                 sc->wi_tx_rate = 5;
2882                 break;
2883         case IFM_IEEE80211_DS11:
2884                 sc->wi_tx_rate = 11;
2885                 break;
2886         case IFM_AUTO:
2887                 sc->wi_tx_rate = 3;
2888                 break;
2889         }
2890
2891         if (ocreate_ibss != sc->wi_create_ibss || otype != sc->wi_ptype ||
2892             orate != sc->wi_tx_rate)
2893                 wi_init(sc);
2894
2895         return(0);
2896 }
2897
2898 static void
2899 wi_media_status(ifp, imr)
2900         struct ifnet            *ifp;
2901         struct ifmediareq       *imr;
2902 {
2903         struct wi_req           wreq;
2904         struct wi_softc         *sc = ifp->if_softc;
2905
2906         if (sc->wi_tx_rate == 3) {
2907                 imr->ifm_active = IFM_IEEE80211|IFM_AUTO;
2908                 if (sc->wi_ptype == WI_PORTTYPE_ADHOC)
2909                         imr->ifm_active |= IFM_IEEE80211_ADHOC;
2910                 else if (sc->wi_ptype == WI_PORTTYPE_AP)
2911                         imr->ifm_active |= IFM_IEEE80211_HOSTAP;
2912                 else if (sc->wi_ptype == WI_PORTTYPE_IBSS) {
2913                         if (sc->wi_create_ibss)
2914                                 imr->ifm_active |= IFM_IEEE80211_IBSSMASTER;
2915                         else
2916                                 imr->ifm_active |= IFM_IEEE80211_IBSS;
2917                 }
2918                 wreq.wi_type = WI_RID_CUR_TX_RATE;
2919                 wreq.wi_len = WI_MAX_DATALEN;
2920                 if (wi_read_record(sc, (struct wi_ltv_gen *)&wreq) == 0) {
2921                         switch(wreq.wi_val[0]) {
2922                         case 1:
2923                                 imr->ifm_active |= IFM_IEEE80211_DS1;
2924                                 break;
2925                         case 2:
2926                                 imr->ifm_active |= IFM_IEEE80211_DS2;
2927                                 break;
2928                         case 6:
2929                                 imr->ifm_active |= IFM_IEEE80211_DS5;
2930                                 break;
2931                         case 11:
2932                                 imr->ifm_active |= IFM_IEEE80211_DS11;
2933                                 break;
2934                                 }
2935                 }
2936         } else {
2937                 imr->ifm_active = sc->ifmedia.ifm_cur->ifm_media;
2938         }
2939
2940         imr->ifm_status = IFM_AVALID;
2941         if (sc->wi_ptype == WI_PORTTYPE_ADHOC ||
2942             sc->wi_ptype == WI_PORTTYPE_IBSS)
2943                 /*
2944                  * XXX: It would be nice if we could give some actually
2945                  * useful status like whether we joined another IBSS or
2946                  * created one ourselves.
2947                  */
2948                 imr->ifm_status |= IFM_ACTIVE;
2949         else if (sc->wi_ptype == WI_PORTTYPE_AP)
2950                 imr->ifm_status |= IFM_ACTIVE;
2951         else {
2952                 wreq.wi_type = WI_RID_COMMQUAL;
2953                 wreq.wi_len = WI_MAX_DATALEN;
2954                 if (wi_read_record(sc, (struct wi_ltv_gen *)&wreq) == 0 &&
2955                     wreq.wi_val[0] != 0)
2956                         imr->ifm_status |= IFM_ACTIVE;
2957         }
2958 }
2959
2960 static int
2961 wi_get_debug(sc, wreq)
2962         struct wi_softc         *sc;
2963         struct wi_req           *wreq;
2964 {
2965         int                     error = 0;
2966
2967         wreq->wi_len = 1;
2968
2969         switch (wreq->wi_type) {
2970         case WI_DEBUG_SLEEP:
2971                 wreq->wi_len++;
2972                 wreq->wi_val[0] = sc->wi_debug.wi_sleep;
2973                 break;
2974         case WI_DEBUG_DELAYSUPP:
2975                 wreq->wi_len++;
2976                 wreq->wi_val[0] = sc->wi_debug.wi_delaysupp;
2977                 break;
2978         case WI_DEBUG_TXSUPP:
2979                 wreq->wi_len++;
2980                 wreq->wi_val[0] = sc->wi_debug.wi_txsupp;
2981                 break;
2982         case WI_DEBUG_MONITOR:
2983                 wreq->wi_len++;
2984                 wreq->wi_val[0] = sc->wi_debug.wi_monitor;
2985                 break;
2986         case WI_DEBUG_LEDTEST:
2987                 wreq->wi_len += 3;
2988                 wreq->wi_val[0] = sc->wi_debug.wi_ledtest;
2989                 wreq->wi_val[1] = sc->wi_debug.wi_ledtest_param0;
2990                 wreq->wi_val[2] = sc->wi_debug.wi_ledtest_param1;
2991                 break;
2992         case WI_DEBUG_CONTTX:
2993                 wreq->wi_len += 2;
2994                 wreq->wi_val[0] = sc->wi_debug.wi_conttx;
2995                 wreq->wi_val[1] = sc->wi_debug.wi_conttx_param0;
2996                 break;
2997         case WI_DEBUG_CONTRX:
2998                 wreq->wi_len++;
2999                 wreq->wi_val[0] = sc->wi_debug.wi_contrx;
3000                 break;
3001         case WI_DEBUG_SIGSTATE:
3002                 wreq->wi_len += 2;
3003                 wreq->wi_val[0] = sc->wi_debug.wi_sigstate;
3004                 wreq->wi_val[1] = sc->wi_debug.wi_sigstate_param0;
3005                 break;
3006         case WI_DEBUG_CONFBITS:
3007                 wreq->wi_len += 2;
3008                 wreq->wi_val[0] = sc->wi_debug.wi_confbits;
3009                 wreq->wi_val[1] = sc->wi_debug.wi_confbits_param0;
3010                 break;
3011         default:
3012                 error = EIO;
3013                 break;
3014         }
3015
3016         return (error);
3017 }
3018
3019 static int
3020 wi_set_debug(sc, wreq)
3021         struct wi_softc         *sc;
3022         struct wi_req           *wreq;
3023 {
3024         int                     error = 0;
3025         u_int16_t               cmd, param0 = 0, param1 = 0;
3026
3027         switch (wreq->wi_type) {
3028         case WI_DEBUG_RESET:
3029         case WI_DEBUG_INIT:
3030         case WI_DEBUG_CALENABLE:
3031                 break;
3032         case WI_DEBUG_SLEEP:
3033                 sc->wi_debug.wi_sleep = 1;
3034                 break;
3035         case WI_DEBUG_WAKE:
3036                 sc->wi_debug.wi_sleep = 0;
3037                 break;
3038         case WI_DEBUG_CHAN:
3039                 param0 = wreq->wi_val[0];
3040                 break;
3041         case WI_DEBUG_DELAYSUPP:
3042                 sc->wi_debug.wi_delaysupp = 1;
3043                 break;
3044         case WI_DEBUG_TXSUPP:
3045                 sc->wi_debug.wi_txsupp = 1;
3046                 break;
3047         case WI_DEBUG_MONITOR:
3048                 sc->wi_debug.wi_monitor = 1;
3049                 break;
3050         case WI_DEBUG_LEDTEST:
3051                 param0 = wreq->wi_val[0];
3052                 param1 = wreq->wi_val[1];
3053                 sc->wi_debug.wi_ledtest = 1;
3054                 sc->wi_debug.wi_ledtest_param0 = param0;
3055                 sc->wi_debug.wi_ledtest_param1 = param1;
3056                 break;
3057         case WI_DEBUG_CONTTX:
3058                 param0 = wreq->wi_val[0];
3059                 sc->wi_debug.wi_conttx = 1;
3060                 sc->wi_debug.wi_conttx_param0 = param0;
3061                 break;
3062         case WI_DEBUG_STOPTEST:
3063                 sc->wi_debug.wi_delaysupp = 0;
3064                 sc->wi_debug.wi_txsupp = 0;
3065                 sc->wi_debug.wi_monitor = 0;
3066                 sc->wi_debug.wi_ledtest = 0;
3067                 sc->wi_debug.wi_ledtest_param0 = 0;
3068                 sc->wi_debug.wi_ledtest_param1 = 0;
3069                 sc->wi_debug.wi_conttx = 0;
3070                 sc->wi_debug.wi_conttx_param0 = 0;
3071                 sc->wi_debug.wi_contrx = 0;
3072                 sc->wi_debug.wi_sigstate = 0;
3073                 sc->wi_debug.wi_sigstate_param0 = 0;
3074                 break;
3075         case WI_DEBUG_CONTRX:
3076                 sc->wi_debug.wi_contrx = 1;
3077                 break;
3078         case WI_DEBUG_SIGSTATE:
3079                 param0 = wreq->wi_val[0];
3080                 sc->wi_debug.wi_sigstate = 1;
3081                 sc->wi_debug.wi_sigstate_param0 = param0;
3082                 break;
3083         case WI_DEBUG_CONFBITS:
3084                 param0 = wreq->wi_val[0];
3085                 param1 = wreq->wi_val[1];
3086                 sc->wi_debug.wi_confbits = param0;
3087                 sc->wi_debug.wi_confbits_param0 = param1;
3088                 break;
3089         default:
3090                 error = EIO;
3091                 break;
3092         }
3093
3094         if (error)
3095                 return (error);
3096
3097         cmd = WI_CMD_DEBUG | (wreq->wi_type << 8);
3098         error = wi_cmd(sc, cmd, param0, param1, 0);
3099
3100         return (error);
3101 }