Remove unused variables.
[dragonfly.git] / sys / dev / netif / owi / if_owi.c
1 /*
2  * Copyright (c) 1997, 1998, 1999
3  *      Bill Paul <wpaul@ctr.columbia.edu>.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. All advertising materials mentioning features or use of this software
14  *    must display the following acknowledgement:
15  *      This product includes software developed by Bill Paul.
16  * 4. Neither the name of the author nor the names of any co-contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
24  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
30  * THE POSSIBILITY OF SUCH DAMAGE.
31  *
32  * $FreeBSD: src/sys/dev/wi/if_wi.c,v 1.103.2.2 2002/08/02 07:11:34 imp Exp $
33  * $DragonFly: src/sys/dev/netif/owi/Attic/if_owi.c,v 1.9 2005/06/10 15:29:17 swildner Exp $
34  */
35
36 /*
37  * Lucent WaveLAN/IEEE 802.11 PCMCIA driver for FreeBSD.
38  *
39  * Written by Bill Paul <wpaul@ctr.columbia.edu>
40  * Electrical Engineering Department
41  * Columbia University, New York City
42  */
43
44 /*
45  * The WaveLAN/IEEE adapter is the second generation of the WaveLAN
46  * from Lucent. Unlike the older cards, the new ones are programmed
47  * entirely via a firmware-driven controller called the Hermes.
48  * Unfortunately, Lucent will not release the Hermes programming manual
49  * without an NDA (if at all). What they do release is an API library
50  * called the HCF (Hardware Control Functions) which is supposed to
51  * do the device-specific operations of a device driver for you. The
52  * publically available version of the HCF library (the 'HCF Light') is 
53  * a) extremely gross, b) lacks certain features, particularly support
54  * for 802.11 frames, and c) is contaminated by the GNU Public License.
55  *
56  * This driver does not use the HCF or HCF Light at all. Instead, it
57  * programs the Hermes controller directly, using information gleaned
58  * from the HCF Light code and corresponding documentation.
59  *
60  * This driver supports the ISA, PCMCIA and PCI versions of the Lucent
61  * WaveLan cards (based on the Hermes chipset), as well as the newer
62  * Prism 2 chipsets with firmware from Intersil and Symbol.
63  */
64
65 #include <sys/param.h>
66 #include <sys/systm.h>
67 #if defined(__FreeBSD__) && __FreeBSD_version >= 500033
68 #include <sys/endian.h>
69 #endif
70 #include <sys/sockio.h>
71 #include <sys/mbuf.h>
72 #include <sys/proc.h>
73 #include <sys/kernel.h>
74 #include <sys/socket.h>
75 #include <sys/module.h>
76 #include <sys/bus.h>
77 #include <sys/random.h>
78 #include <sys/syslog.h>
79 #include <sys/sysctl.h>
80
81 #include <machine/bus.h>
82 #include <machine/resource.h>
83 #include <machine/clock.h>
84 #include <sys/rman.h>
85
86 #include <net/if.h>
87 #include <net/ifq_var.h>
88 #include <net/if_arp.h>
89 #include <net/ethernet.h>
90 #include <net/if_dl.h>
91 #include <net/if_media.h>
92 #include <net/if_types.h>
93 #include <netproto/802_11/ieee80211.h>
94 #include <netproto/802_11/ieee80211_ioctl.h>
95 #include <netproto/802_11/if_wavelan_ieee.h>
96
97 #include <netinet/in.h>
98 #include <netinet/in_systm.h>
99 #include <netinet/in_var.h>
100 #include <netinet/ip.h>
101 #include <netinet/if_ether.h>
102
103 #include <net/bpf.h>
104
105 #include "wi_hostap.h"
106 #include "if_wivar.h"
107 #include "if_wireg.h"
108
109 #define WI_CMD_DEBUG            0x0038 /* prism2 debug */
110
111 static void wi_intr(void *);
112 static void wi_reset(struct wi_softc *);
113 static int wi_ioctl(struct ifnet *, u_long, caddr_t, struct ucred *);
114 static void wi_init(void *);
115 static void wi_start(struct ifnet *);
116 static void wi_stop(struct wi_softc *);
117 static void wi_watchdog(struct ifnet *);
118 static void wi_rxeof(struct wi_softc *);
119 static void wi_txeof(struct wi_softc *, int);
120 static void wi_update_stats(struct wi_softc *);
121 static void wi_setmulti(struct wi_softc *);
122
123 static int wi_cmd(struct wi_softc *, int, int, int, int);
124 static int wi_read_record(struct wi_softc *, struct wi_ltv_gen *);
125 static int wi_write_record(struct wi_softc *, struct wi_ltv_gen *);
126 static int wi_read_data(struct wi_softc *, int, int, caddr_t, int);
127 static int wi_write_data(struct wi_softc *, int, int, caddr_t, int);
128 static int wi_seek(struct wi_softc *, int, int, int);
129 static int wi_alloc_nicmem(struct wi_softc *, int, int *);
130 static void wi_inquire(void *);
131 static void wi_setdef(struct wi_softc *, struct wi_req *);
132
133 #ifdef WICACHE
134 static
135 void wi_cache_store(struct wi_softc *, struct mbuf *, unsigned short);
136 #endif
137
138 static int wi_get_cur_ssid(struct wi_softc *, char *, int *);
139 static void wi_get_id(struct wi_softc *);
140 static int wi_media_change(struct ifnet *);
141 static void wi_media_status(struct ifnet *, struct ifmediareq *);
142
143 static int wi_get_debug(struct wi_softc *, struct wi_req *);
144 static int wi_set_debug(struct wi_softc *, struct wi_req *);
145
146 DECLARE_DUMMY_MODULE(if_wi);
147
148 devclass_t owi_devclass;
149
150 static struct wi_card_ident wi_card_ident[] = {
151         /* CARD_ID                      CARD_NAME               FIRM_TYPE */
152         { WI_NIC_LUCENT_ID,             WI_NIC_LUCENT_STR,      WI_LUCENT },
153         { WI_NIC_SONY_ID,               WI_NIC_SONY_STR,        WI_LUCENT },
154         { WI_NIC_LUCENT_EMB_ID,         WI_NIC_LUCENT_EMB_STR,  WI_LUCENT },
155         { WI_NIC_EVB2_ID,               WI_NIC_EVB2_STR,        WI_INTERSIL },
156         { WI_NIC_HWB3763_ID,            WI_NIC_HWB3763_STR,     WI_INTERSIL },
157         { WI_NIC_HWB3163_ID,            WI_NIC_HWB3163_STR,     WI_INTERSIL },
158         { WI_NIC_HWB3163B_ID,           WI_NIC_HWB3163B_STR,    WI_INTERSIL },
159         { WI_NIC_EVB3_ID,               WI_NIC_EVB3_STR,        WI_INTERSIL },
160         { WI_NIC_HWB1153_ID,            WI_NIC_HWB1153_STR,     WI_INTERSIL },
161         { WI_NIC_P2_SST_ID,             WI_NIC_P2_SST_STR,      WI_INTERSIL },
162         { WI_NIC_EVB2_SST_ID,           WI_NIC_EVB2_SST_STR,    WI_INTERSIL },
163         { WI_NIC_3842_EVA_ID,           WI_NIC_3842_EVA_STR,    WI_INTERSIL },
164         { WI_NIC_3842_PCMCIA_AMD_ID,    WI_NIC_3842_PCMCIA_STR, WI_INTERSIL },
165         { WI_NIC_3842_PCMCIA_SST_ID,    WI_NIC_3842_PCMCIA_STR, WI_INTERSIL },
166         { WI_NIC_3842_PCMCIA_ATM_ID,    WI_NIC_3842_PCMCIA_STR, WI_INTERSIL },
167         { WI_NIC_3842_MINI_AMD_ID,      WI_NIC_3842_MINI_STR,   WI_INTERSIL },
168         { WI_NIC_3842_MINI_SST_ID,      WI_NIC_3842_MINI_STR,   WI_INTERSIL },
169         { WI_NIC_3842_MINI_ATM_ID,      WI_NIC_3842_MINI_STR,   WI_INTERSIL },
170         { WI_NIC_3842_PCI_AMD_ID,       WI_NIC_3842_PCI_STR,    WI_INTERSIL },
171         { WI_NIC_3842_PCI_SST_ID,       WI_NIC_3842_PCI_STR,    WI_INTERSIL },
172         { WI_NIC_3842_PCI_ATM_ID,       WI_NIC_3842_PCI_STR,    WI_INTERSIL },
173         { WI_NIC_P3_PCMCIA_AMD_ID,      WI_NIC_P3_PCMCIA_STR,   WI_INTERSIL },
174         { WI_NIC_P3_PCMCIA_SST_ID,      WI_NIC_P3_PCMCIA_STR,   WI_INTERSIL },
175         { WI_NIC_P3_MINI_AMD_ID,        WI_NIC_P3_MINI_STR,     WI_INTERSIL },
176         { WI_NIC_P3_MINI_SST_ID,        WI_NIC_P3_MINI_STR,     WI_INTERSIL },
177         { 0,    NULL,   0 },
178 };
179
180 int
181 owi_generic_detach(dev)
182         device_t                dev;
183 {
184         struct wi_softc         *sc;
185         struct ifnet            *ifp;
186         int                     s;
187
188         sc = device_get_softc(dev);
189         WI_LOCK(sc, s);
190         ifp = &sc->arpcom.ac_if;
191
192         if (sc->wi_gone) {
193                 device_printf(dev, "already unloaded\n");
194                 WI_UNLOCK(sc, s);
195                 return(ENODEV);
196         }
197
198         wi_stop(sc);
199
200         /* Delete all remaining media. */
201         ifmedia_removeall(&sc->ifmedia);
202
203         ether_ifdetach(ifp);
204         bus_teardown_intr(dev, sc->irq, sc->wi_intrhand);
205         owi_free(dev);
206         sc->wi_gone = 1;
207
208         WI_UNLOCK(sc, s);
209 #if defined(__FreeBSD__) && __FreeBSD_version >= 500000
210         mtx_destroy(&sc->wi_mtx);
211 #endif
212
213         return(0);
214 }
215
216 int
217 owi_generic_attach(device_t dev)
218 {
219         struct wi_softc         *sc;
220         struct wi_ltv_macaddr   mac;
221         struct wi_ltv_gen       gen;
222         struct ifnet            *ifp;
223         int                     error;
224         int                     s;
225
226         /* XXX maybe we need the splimp stuff here XXX */
227         sc = device_get_softc(dev);
228         ifp = &sc->arpcom.ac_if;
229         callout_init(&sc->wi_stat_timer);
230
231         error = bus_setup_intr(dev, sc->irq, INTR_TYPE_NET,
232                                wi_intr, sc, &sc->wi_intrhand, NULL);
233
234         if (error) {
235                 device_printf(dev, "bus_setup_intr() failed! (%d)\n", error);
236                 owi_free(dev);
237                 return (error);
238         }
239
240 #if defined(__FreeBSD__) && __FreeBSD_version >= 500000
241         mtx_init(&sc->wi_mtx, device_get_nameunit(dev), MTX_NETWORK_LOCK,
242             MTX_DEF | MTX_RECURSE);
243 #endif
244         WI_LOCK(sc, s);
245
246         /* Reset the NIC. */
247         wi_reset(sc);
248
249         /*
250          * Read the station address.
251          * And do it twice. I've seen PRISM-based cards that return
252          * an error when trying to read it the first time, which causes
253          * the probe to fail.
254          */
255         mac.wi_type = WI_RID_MAC_NODE;
256         mac.wi_len = 4;
257         wi_read_record(sc, (struct wi_ltv_gen *)&mac);
258         if ((error = wi_read_record(sc, (struct wi_ltv_gen *)&mac)) != 0) {
259                 device_printf(dev, "mac read failed %d\n", error);
260                 owi_free(dev);
261                 WI_UNLOCK(sc, s);
262                 return (error);
263         }
264         bcopy((char *)&mac.wi_mac_addr,
265            (char *)&sc->arpcom.ac_enaddr, ETHER_ADDR_LEN);
266
267         wi_get_id(sc);
268
269         ifp->if_softc = sc;
270         if_initname(ifp, "wi", sc->wi_unit);
271         ifp->if_mtu = ETHERMTU;
272         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
273         ifp->if_ioctl = wi_ioctl;
274         ifp->if_start = wi_start;
275         ifp->if_watchdog = wi_watchdog;
276         ifp->if_init = wi_init;
277         ifp->if_baudrate = 10000000;
278         ifq_set_maxlen(&ifp->if_snd, IFQ_MAXLEN);
279         ifq_set_ready(&ifp->if_snd);
280
281         bzero(sc->wi_node_name, sizeof(sc->wi_node_name));
282         bcopy(WI_DEFAULT_NODENAME, sc->wi_node_name,
283             sizeof(WI_DEFAULT_NODENAME) - 1);
284
285         bzero(sc->wi_net_name, sizeof(sc->wi_net_name));
286         bcopy(WI_DEFAULT_NETNAME, sc->wi_net_name,
287             sizeof(WI_DEFAULT_NETNAME) - 1);
288
289         bzero(sc->wi_ibss_name, sizeof(sc->wi_ibss_name));
290         bcopy(WI_DEFAULT_IBSS, sc->wi_ibss_name,
291             sizeof(WI_DEFAULT_IBSS) - 1);
292
293         sc->wi_portnum = WI_DEFAULT_PORT;
294         sc->wi_ptype = WI_PORTTYPE_BSS;
295         sc->wi_ap_density = WI_DEFAULT_AP_DENSITY;
296         sc->wi_rts_thresh = WI_DEFAULT_RTS_THRESH;
297         sc->wi_tx_rate = WI_DEFAULT_TX_RATE;
298         sc->wi_max_data_len = WI_DEFAULT_DATALEN;
299         sc->wi_create_ibss = WI_DEFAULT_CREATE_IBSS;
300         sc->wi_pm_enabled = WI_DEFAULT_PM_ENABLED;
301         sc->wi_max_sleep = WI_DEFAULT_MAX_SLEEP;
302         sc->wi_roaming = WI_DEFAULT_ROAMING;
303         sc->wi_authtype = WI_DEFAULT_AUTHTYPE;
304         sc->wi_authmode = IEEE80211_AUTH_OPEN;
305
306         /*
307          * Read the default channel from the NIC. This may vary
308          * depending on the country where the NIC was purchased, so
309          * we can't hard-code a default and expect it to work for
310          * everyone.
311          */
312         gen.wi_type = WI_RID_OWN_CHNL;
313         gen.wi_len = 2;
314         wi_read_record(sc, &gen);
315         sc->wi_channel = gen.wi_val;
316
317         /*
318          * Set flags based on firmware version.
319          */
320         switch (sc->sc_firmware_type) {
321         case WI_LUCENT:
322                 sc->wi_flags |= WI_FLAGS_HAS_ROAMING;
323                 if (sc->sc_sta_firmware_ver >= 60000)
324                         sc->wi_flags |= WI_FLAGS_HAS_MOR;
325                 if (sc->sc_sta_firmware_ver >= 60006) {
326                         sc->wi_flags |= WI_FLAGS_HAS_IBSS;
327                         sc->wi_flags |= WI_FLAGS_HAS_CREATE_IBSS;
328                 }
329                 sc->wi_ibss_port = htole16(1);
330                 break;
331         case WI_INTERSIL:
332                 sc->wi_flags |= WI_FLAGS_HAS_ROAMING;
333                 if (sc->sc_sta_firmware_ver >= 800) {
334                         sc->wi_flags |= WI_FLAGS_HAS_IBSS;
335                         sc->wi_flags |= WI_FLAGS_HAS_CREATE_IBSS;
336                 }
337                 /*
338                  * version 0.8.3 and newer are the only ones that are known
339                  * to currently work.  Earlier versions can be made to work,
340                  * at least according to the Linux driver.
341                  */
342                 if (sc->sc_sta_firmware_ver >= 803)
343                         sc->wi_flags |= WI_FLAGS_HAS_HOSTAP;
344                 sc->wi_ibss_port = htole16(0);
345                 break;
346         case WI_SYMBOL:
347                 sc->wi_flags |= WI_FLAGS_HAS_DIVERSITY;
348                 if (sc->sc_sta_firmware_ver >= 20000)
349                         sc->wi_flags |= WI_FLAGS_HAS_IBSS;
350                 /* Older Symbol firmware does not support IBSS creation. */
351                 if (sc->sc_sta_firmware_ver >= 25000)
352                         sc->wi_flags |= WI_FLAGS_HAS_CREATE_IBSS;
353                 sc->wi_ibss_port = htole16(4);
354                 break;
355         }
356
357         /*
358          * Find out if we support WEP on this card.
359          */
360         gen.wi_type = WI_RID_WEP_AVAIL;
361         gen.wi_len = 2;
362         wi_read_record(sc, &gen);
363         sc->wi_has_wep = gen.wi_val;
364
365         if (bootverbose)
366                 device_printf(sc->dev, "wi_has_wep = %d\n", sc->wi_has_wep);
367
368         /* 
369          * Find supported rates.
370          */
371         gen.wi_type = WI_RID_DATA_RATES;
372         gen.wi_len = 2;
373         if (wi_read_record(sc, &gen))
374                 sc->wi_supprates = WI_SUPPRATES_1M | WI_SUPPRATES_2M |
375                     WI_SUPPRATES_5M | WI_SUPPRATES_11M;
376         else
377                 sc->wi_supprates = gen.wi_val;
378
379         bzero((char *)&sc->wi_stats, sizeof(sc->wi_stats));
380
381         wi_init(sc);
382         wi_stop(sc);
383
384         ifmedia_init(&sc->ifmedia, 0, wi_media_change, wi_media_status);
385 #define ADD(m, c)       ifmedia_add(&sc->ifmedia, (m), (c), NULL)
386         if (sc->wi_supprates & WI_SUPPRATES_1M) {
387                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1, 0, 0), 0);
388                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1,
389                     IFM_IEEE80211_ADHOC, 0), 0);
390                 if (sc->wi_flags & WI_FLAGS_HAS_IBSS)
391                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1,
392                             IFM_IEEE80211_IBSS, 0), 0);
393                 if (sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS)
394                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1,
395                             IFM_IEEE80211_IBSSMASTER, 0), 0);
396                 if (sc->wi_flags & WI_FLAGS_HAS_HOSTAP)
397                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1,
398                             IFM_IEEE80211_HOSTAP, 0), 0);
399         }
400         if (sc->wi_supprates & WI_SUPPRATES_2M) {
401                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2, 0, 0), 0);
402                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2,
403                     IFM_IEEE80211_ADHOC, 0), 0);
404                 if (sc->wi_flags & WI_FLAGS_HAS_IBSS)
405                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2,
406                             IFM_IEEE80211_IBSS, 0), 0);
407                 if (sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS)
408                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2,
409                             IFM_IEEE80211_IBSSMASTER, 0), 0);
410                 if (sc->wi_flags & WI_FLAGS_HAS_HOSTAP)
411                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2,
412                             IFM_IEEE80211_HOSTAP, 0), 0);
413         }
414         if (sc->wi_supprates & WI_SUPPRATES_5M) {
415                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5, 0, 0), 0);
416                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5,
417                     IFM_IEEE80211_ADHOC, 0), 0);
418                 if (sc->wi_flags & WI_FLAGS_HAS_IBSS)
419                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5,
420                             IFM_IEEE80211_IBSS, 0), 0);
421                 if (sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS)
422                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5,
423                             IFM_IEEE80211_IBSSMASTER, 0), 0);
424                 if (sc->wi_flags & WI_FLAGS_HAS_HOSTAP)
425                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5,
426                             IFM_IEEE80211_HOSTAP, 0), 0);
427         }
428         if (sc->wi_supprates & WI_SUPPRATES_11M) {
429                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11, 0, 0), 0);
430                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11,
431                     IFM_IEEE80211_ADHOC, 0), 0);
432                 if (sc->wi_flags & WI_FLAGS_HAS_IBSS)
433                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11,
434                             IFM_IEEE80211_IBSS, 0), 0);
435                 if (sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS)
436                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11,
437                             IFM_IEEE80211_IBSSMASTER, 0), 0);
438                 if (sc->wi_flags & WI_FLAGS_HAS_HOSTAP)
439                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11,
440                             IFM_IEEE80211_HOSTAP, 0), 0);
441                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_MANUAL, 0, 0), 0);
442         }
443         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO, IFM_IEEE80211_ADHOC, 0), 0);
444         if (sc->wi_flags & WI_FLAGS_HAS_IBSS)
445                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO, IFM_IEEE80211_IBSS,
446                     0), 0);
447         if (sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS)
448                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO,
449                     IFM_IEEE80211_IBSSMASTER, 0), 0);
450         if (sc->wi_flags & WI_FLAGS_HAS_HOSTAP)
451                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO,
452                     IFM_IEEE80211_HOSTAP, 0), 0);
453         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO, 0, 0), 0);
454 #undef ADD
455         ifmedia_set(&sc->ifmedia, IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO, 0, 0));
456
457         /*
458          * Call MI attach routine.
459          */
460         ether_ifattach(ifp, sc->arpcom.ac_enaddr);
461         WI_UNLOCK(sc, s);
462
463         return(0);
464 }
465
466 static void
467 wi_get_id(sc)
468         struct wi_softc *sc;
469 {
470         struct wi_ltv_ver       ver;
471         struct wi_card_ident    *id;
472
473         /* getting chip identity */
474         memset(&ver, 0, sizeof(ver));
475         ver.wi_type = WI_RID_CARD_ID;
476         ver.wi_len = 5;
477         wi_read_record(sc, (struct wi_ltv_gen *)&ver);
478         device_printf(sc->dev, "using ");
479         sc->sc_firmware_type = WI_NOTYPE;
480         for (id = wi_card_ident; id->card_name != NULL; id++) {
481                 if (le16toh(ver.wi_ver[0]) == id->card_id) {
482                         printf("%s", id->card_name);
483                         sc->sc_firmware_type = id->firm_type;
484                         break;
485                 }
486         }
487         if (sc->sc_firmware_type == WI_NOTYPE) {
488                 if (le16toh(ver.wi_ver[0]) & 0x8000) {
489                         printf("Unknown PRISM2 chip");
490                         sc->sc_firmware_type = WI_INTERSIL;
491                 } else {
492                         printf("Unknown Lucent chip");
493                         sc->sc_firmware_type = WI_LUCENT;
494                 }
495         }
496
497         if (sc->sc_firmware_type != WI_LUCENT) {
498                 /* get primary firmware version */
499                 memset(&ver, 0, sizeof(ver));
500                 ver.wi_type = WI_RID_PRI_IDENTITY;
501                 ver.wi_len = 5;
502                 wi_read_record(sc, (struct wi_ltv_gen *)&ver);
503                 ver.wi_ver[1] = le16toh(ver.wi_ver[1]);
504                 ver.wi_ver[2] = le16toh(ver.wi_ver[2]);
505                 ver.wi_ver[3] = le16toh(ver.wi_ver[3]);
506                 sc->sc_pri_firmware_ver = ver.wi_ver[2] * 10000 +
507                     ver.wi_ver[3] * 100 + ver.wi_ver[1];
508         }
509
510         /* get station firmware version */
511         memset(&ver, 0, sizeof(ver));
512         ver.wi_type = WI_RID_STA_IDENTITY;
513         ver.wi_len = 5;
514         wi_read_record(sc, (struct wi_ltv_gen *)&ver);
515         ver.wi_ver[1] = le16toh(ver.wi_ver[1]);
516         ver.wi_ver[2] = le16toh(ver.wi_ver[2]);
517         ver.wi_ver[3] = le16toh(ver.wi_ver[3]);
518         sc->sc_sta_firmware_ver = ver.wi_ver[2] * 10000 +
519             ver.wi_ver[3] * 100 + ver.wi_ver[1];
520         if (sc->sc_firmware_type == WI_INTERSIL &&
521             (sc->sc_sta_firmware_ver == 10102 || 
522              sc->sc_sta_firmware_ver == 20102)) {
523                 struct wi_ltv_str sver;
524                 char *p;
525
526                 memset(&sver, 0, sizeof(sver));
527                 sver.wi_type = WI_RID_SYMBOL_IDENTITY;
528                 sver.wi_len = 7;
529                 /* value should be the format like "V2.00-11" */
530                 if (wi_read_record(sc, (struct wi_ltv_gen *)&sver) == 0 &&
531                     *(p = (char *)sver.wi_str) >= 'A' &&
532                     p[2] == '.' && p[5] == '-' && p[8] == '\0') {
533                         sc->sc_firmware_type = WI_SYMBOL;
534                         sc->sc_sta_firmware_ver = (p[1] - '0') * 10000 +
535                             (p[3] - '0') * 1000 + (p[4] - '0') * 100 +
536                             (p[6] - '0') * 10 + (p[7] - '0');
537                 }
538         }
539         printf("\n");
540         device_printf(sc->dev, "%s Firmware: ",
541              sc->sc_firmware_type == WI_LUCENT ? "Lucent" :
542             (sc->sc_firmware_type == WI_SYMBOL ? "Symbol" : "Intersil"));
543
544         /*
545          * The primary firmware is only valid on Prism based chipsets
546          * (INTERSIL or SYMBOL).
547          */
548         if (sc->sc_firmware_type != WI_LUCENT)
549             printf("Primary %u.%02u.%02u, ", sc->sc_pri_firmware_ver / 10000,
550                     (sc->sc_pri_firmware_ver % 10000) / 100,
551                     sc->sc_pri_firmware_ver % 100);
552         printf("Station %u.%02u.%02u\n",
553             sc->sc_sta_firmware_ver / 10000, (sc->sc_sta_firmware_ver % 10000) / 100,
554             sc->sc_sta_firmware_ver % 100);
555         return;
556 }
557
558 static void
559 wi_rxeof(sc)
560         struct wi_softc         *sc;
561 {
562         struct ifnet            *ifp;
563         struct ether_header     *eh;
564         struct mbuf             *m;
565         int                     id;
566
567         ifp = &sc->arpcom.ac_if;
568
569         id = CSR_READ_2(sc, WI_RX_FID);
570
571         /*
572          * if we have the procframe flag set, disregard all this and just
573          * read the data from the device.
574          */
575         if (sc->wi_procframe || sc->wi_debug.wi_monitor) {
576                 struct wi_frame         *rx_frame;
577                 int                     datlen, hdrlen;
578
579                 /* first allocate mbuf for packet storage */
580                 MGETHDR(m, MB_DONTWAIT, MT_DATA);
581                 if (m == NULL) {
582                         ifp->if_ierrors++;
583                         return;
584                 }
585                 MCLGET(m, MB_DONTWAIT);
586                 if (!(m->m_flags & M_EXT)) {
587                         m_freem(m);
588                         ifp->if_ierrors++;
589                         return;
590                 }
591
592                 m->m_pkthdr.rcvif = ifp;
593
594                 /* now read wi_frame first so we know how much data to read */
595                 if (wi_read_data(sc, id, 0, mtod(m, caddr_t),
596                     sizeof(struct wi_frame))) {
597                         m_freem(m);
598                         ifp->if_ierrors++;
599                         return;
600                 }
601
602                 rx_frame = mtod(m, struct wi_frame *);
603
604                 switch ((rx_frame->wi_status & WI_STAT_MAC_PORT) >> 8) {
605                 case 7:
606                         switch (rx_frame->wi_frame_ctl & WI_FCTL_FTYPE) {
607                         case WI_FTYPE_DATA:
608                                 hdrlen = WI_DATA_HDRLEN;
609                                 datlen = rx_frame->wi_dat_len + WI_FCS_LEN;
610                                 break;
611                         case WI_FTYPE_MGMT:
612                                 hdrlen = WI_MGMT_HDRLEN;
613                                 datlen = rx_frame->wi_dat_len + WI_FCS_LEN;
614                                 break;
615                         case WI_FTYPE_CTL:
616                                 /*
617                                  * prism2 cards don't pass control packets
618                                  * down properly or consistently, so we'll only
619                                  * pass down the header.
620                                  */
621                                 hdrlen = WI_CTL_HDRLEN;
622                                 datlen = 0;
623                                 break;
624                         default:
625                                 device_printf(sc->dev, "received packet of "
626                                     "unknown type on port 7\n");
627                                 m_freem(m);
628                                 ifp->if_ierrors++;
629                                 return;
630                         }
631                         break;
632                 case 0:
633                         hdrlen = WI_DATA_HDRLEN;
634                         datlen = rx_frame->wi_dat_len + WI_FCS_LEN;
635                         break;
636                 default:
637                         device_printf(sc->dev, "received packet on invalid "
638                             "port (wi_status=0x%x)\n", rx_frame->wi_status);
639                         m_freem(m);
640                         ifp->if_ierrors++;
641                         return;
642                 }
643
644                 if ((hdrlen + datlen + 2) > MCLBYTES) {
645                         device_printf(sc->dev, "oversized packet received "
646                             "(wi_dat_len=%d, wi_status=0x%x)\n",
647                             datlen, rx_frame->wi_status);
648                         m_freem(m);
649                         ifp->if_ierrors++;
650                         return;
651                 }
652
653                 if (wi_read_data(sc, id, hdrlen, mtod(m, caddr_t) + hdrlen,
654                     datlen + 2)) {
655                         m_freem(m);
656                         ifp->if_ierrors++;
657                         return;
658                 }
659
660                 m->m_pkthdr.len = m->m_len = hdrlen + datlen;
661
662                 ifp->if_ipackets++;
663
664                 /* Handle BPF listeners. */
665                 BPF_MTAP(ifp, m);
666
667                 m_freem(m);
668         } else {
669                 struct wi_frame         rx_frame;
670
671                 /* First read in the frame header */
672                 if (wi_read_data(sc, id, 0, (caddr_t)&rx_frame,
673                     sizeof(rx_frame))) {
674                         ifp->if_ierrors++;
675                         return;
676                 }
677
678                 if (rx_frame.wi_status & WI_STAT_ERRSTAT) {
679                         ifp->if_ierrors++;
680                         return;
681                 }
682
683                 MGETHDR(m, MB_DONTWAIT, MT_DATA);
684                 if (m == NULL) {
685                         ifp->if_ierrors++;
686                         return;
687                 }
688                 MCLGET(m, MB_DONTWAIT);
689                 if (!(m->m_flags & M_EXT)) {
690                         m_freem(m);
691                         ifp->if_ierrors++;
692                         return;
693                 }
694
695                 eh = mtod(m, struct ether_header *);
696                 m->m_pkthdr.rcvif = ifp;
697
698                 if (rx_frame.wi_status == WI_STAT_MGMT &&
699                     sc->wi_ptype == WI_PORTTYPE_AP) {
700                         if ((WI_802_11_OFFSET_RAW + rx_frame.wi_dat_len + 2) >
701                             MCLBYTES) {
702                                 device_printf(sc->dev, "oversized mgmt packet "
703                                     "received in hostap mode " 
704                                     "(wi_dat_len=%d, wi_status=0x%x)\n",
705                                     rx_frame.wi_dat_len, rx_frame.wi_status);
706                                 m_freem(m);
707                                 ifp->if_ierrors++;
708                                 return;
709                         }
710
711                         /* Put the whole header in there. */
712                         bcopy(&rx_frame, mtod(m, void *),
713                             sizeof(struct wi_frame));
714                         if (wi_read_data(sc, id, WI_802_11_OFFSET_RAW, 
715                             mtod(m, caddr_t) + WI_802_11_OFFSET_RAW,
716                             rx_frame.wi_dat_len + 2)) {
717                                 m_freem(m);
718                                 ifp->if_ierrors++;
719                                 return;
720                         }
721                         m->m_pkthdr.len = m->m_len =
722                             WI_802_11_OFFSET_RAW + rx_frame.wi_dat_len;
723                         /* XXX: consider giving packet to bhp? */
724                         owihap_mgmt_input(sc, &rx_frame, m);
725                         return;
726                 }
727
728                 if (rx_frame.wi_status == WI_STAT_1042 ||
729                     rx_frame.wi_status == WI_STAT_TUNNEL ||
730                     rx_frame.wi_status == WI_STAT_WMP_MSG) {
731                         if((rx_frame.wi_dat_len + WI_SNAPHDR_LEN) > MCLBYTES) {
732                                 device_printf(sc->dev,
733                                     "oversized packet received "
734                                     "(wi_dat_len=%d, wi_status=0x%x)\n",
735                                     rx_frame.wi_dat_len, rx_frame.wi_status);
736                                 m_freem(m);
737                                 ifp->if_ierrors++;
738                                 return;
739                         }
740                         m->m_pkthdr.len = m->m_len =
741                             rx_frame.wi_dat_len + WI_SNAPHDR_LEN;
742
743 #if 0
744                         bcopy((char *)&rx_frame.wi_addr1,
745                             (char *)&eh->ether_dhost, ETHER_ADDR_LEN);
746                         if (sc->wi_ptype == WI_PORTTYPE_ADHOC) {
747                                 bcopy((char *)&rx_frame.wi_addr2,
748                                     (char *)&eh->ether_shost, ETHER_ADDR_LEN);
749                         } else {
750                                 bcopy((char *)&rx_frame.wi_addr3,
751                                     (char *)&eh->ether_shost, ETHER_ADDR_LEN);
752                         }
753 #else
754                         bcopy((char *)&rx_frame.wi_dst_addr,
755                                 (char *)&eh->ether_dhost, ETHER_ADDR_LEN);
756                         bcopy((char *)&rx_frame.wi_src_addr,
757                                 (char *)&eh->ether_shost, ETHER_ADDR_LEN);
758 #endif
759
760                         bcopy((char *)&rx_frame.wi_type,
761                             (char *)&eh->ether_type, ETHER_TYPE_LEN);
762
763                         if (wi_read_data(sc, id, WI_802_11_OFFSET,
764                             mtod(m, caddr_t) + sizeof(struct ether_header),
765                             m->m_len + 2)) {
766                                 m_freem(m);
767                                 ifp->if_ierrors++;
768                                 return;
769                         }
770                 } else {
771                         if((rx_frame.wi_dat_len +
772                             sizeof(struct ether_header)) > MCLBYTES) {
773                                 device_printf(sc->dev,
774                                     "oversized packet received "
775                                     "(wi_dat_len=%d, wi_status=0x%x)\n",
776                                     rx_frame.wi_dat_len, rx_frame.wi_status);
777                                 m_freem(m);
778                                 ifp->if_ierrors++;
779                                 return;
780                         }
781                         m->m_pkthdr.len = m->m_len =
782                             rx_frame.wi_dat_len + sizeof(struct ether_header);
783
784                         if (wi_read_data(sc, id, WI_802_3_OFFSET,
785                             mtod(m, caddr_t), m->m_len + 2)) {
786                                 m_freem(m);
787                                 ifp->if_ierrors++;
788                                 return;
789                         }
790                 }
791
792                 ifp->if_ipackets++;
793
794                 if (sc->wi_ptype == WI_PORTTYPE_AP) {
795                         /* 
796                          * Give host AP code first crack at data
797                          * packets.  If it decides to handle it (or
798                          * drop it), it will return a non-zero.
799                          * Otherwise, it is destined for this host.
800                          */
801                         if (owihap_data_input(sc, &rx_frame, m))
802                                 return;
803                 }
804                 /* Receive packet. */
805 #ifdef WICACHE
806                 wi_cache_store(sc, m, rx_frame.wi_q_info);
807 #endif  
808                 (*ifp->if_input)(ifp,  m);
809         }
810 }
811
812 static void
813 wi_txeof(sc, status)
814         struct wi_softc         *sc;
815         int                     status;
816 {
817         struct ifnet            *ifp;
818
819         ifp = &sc->arpcom.ac_if;
820
821         ifp->if_timer = 0;
822         ifp->if_flags &= ~IFF_OACTIVE;
823
824         if (status & WI_EV_TX_EXC)
825                 ifp->if_oerrors++;
826         else
827                 ifp->if_opackets++;
828
829         return;
830 }
831
832 static void
833 wi_inquire(xsc)
834         void                    *xsc;
835 {
836         struct wi_softc         *sc;
837         struct ifnet            *ifp;
838         int                     s;
839
840         sc = xsc;
841         ifp = &sc->arpcom.ac_if;
842
843         callout_reset(&sc->wi_stat_timer, hz* 60, wi_inquire, sc);
844
845         /* Don't do this while we're transmitting */
846         if (ifp->if_flags & IFF_OACTIVE)
847                 return;
848
849         WI_LOCK(sc, s);
850         wi_cmd(sc, WI_CMD_INQUIRE, WI_INFO_COUNTERS, 0, 0);
851         WI_UNLOCK(sc, s);
852
853         return;
854 }
855
856 static void
857 wi_update_stats(sc)
858         struct wi_softc         *sc;
859 {
860         struct wi_ltv_gen       gen;
861         u_int16_t               id;
862         struct ifnet            *ifp;
863         u_int32_t               *ptr;
864         int                     len, i;
865         u_int16_t               t;
866
867         ifp = &sc->arpcom.ac_if;
868
869         id = CSR_READ_2(sc, WI_INFO_FID);
870
871         wi_read_data(sc, id, 0, (char *)&gen, 4);
872
873         /*
874          * if we just got our scan results, copy it over into the scan buffer
875          * so we can return it to anyone that asks for it. (add a little
876          * compatibility with the prism2 scanning mechanism)
877          */
878         if (gen.wi_type == WI_INFO_SCAN_RESULTS)
879         {
880                 sc->wi_scanbuf_len = gen.wi_len;
881                 wi_read_data(sc, id, 4, (char *)sc->wi_scanbuf,
882                     sc->wi_scanbuf_len * 2);
883
884                 return;
885         }
886         else if (gen.wi_type != WI_INFO_COUNTERS)
887                 return;
888
889         len = (gen.wi_len - 1 < sizeof(sc->wi_stats) / 4) ?
890                 gen.wi_len - 1 : sizeof(sc->wi_stats) / 4;
891         ptr = (u_int32_t *)&sc->wi_stats;
892
893         for (i = 0; i < len - 1; i++) {
894                 t = CSR_READ_2(sc, WI_DATA1);
895 #ifdef WI_HERMES_STATS_WAR
896                 if (t > 0xF000)
897                         t = ~t & 0xFFFF;
898 #endif
899                 ptr[i] += t;
900         }
901
902         ifp->if_collisions = sc->wi_stats.wi_tx_single_retries +
903             sc->wi_stats.wi_tx_multi_retries +
904             sc->wi_stats.wi_tx_retry_limit;
905
906         return;
907 }
908
909 static void
910 wi_intr(xsc)
911         void            *xsc;
912 {
913         struct wi_softc         *sc = xsc;
914         struct ifnet            *ifp;
915         u_int16_t               status;
916         int                     s;
917
918         WI_LOCK(sc, s);
919
920         ifp = &sc->arpcom.ac_if;
921
922         if (sc->wi_gone || !(ifp->if_flags & IFF_UP)) {
923                 CSR_WRITE_2(sc, WI_EVENT_ACK, 0xFFFF);
924                 CSR_WRITE_2(sc, WI_INT_EN, 0);
925                 WI_UNLOCK(sc, s);
926                 return;
927         }
928
929         /* Disable interrupts. */
930         CSR_WRITE_2(sc, WI_INT_EN, 0);
931
932         status = CSR_READ_2(sc, WI_EVENT_STAT);
933         CSR_WRITE_2(sc, WI_EVENT_ACK, ~WI_INTRS);
934
935         if (status & WI_EV_RX) {
936                 wi_rxeof(sc);
937                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_RX);
938         }
939
940         if (status & WI_EV_TX) {
941                 wi_txeof(sc, status);
942                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_TX);
943         }
944
945         if (status & WI_EV_ALLOC) {
946                 int                     id;
947
948                 id = CSR_READ_2(sc, WI_ALLOC_FID);
949                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_ALLOC);
950                 if (id == sc->wi_tx_data_id)
951                         wi_txeof(sc, status);
952         }
953
954         if (status & WI_EV_INFO) {
955                 wi_update_stats(sc);
956                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_INFO);
957         }
958
959         if (status & WI_EV_TX_EXC) {
960                 wi_txeof(sc, status);
961                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_TX_EXC);
962         }
963
964         if (status & WI_EV_INFO_DROP) {
965                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_INFO_DROP);
966         }
967
968         /* Re-enable interrupts. */
969         CSR_WRITE_2(sc, WI_INT_EN, WI_INTRS);
970
971         if (!ifq_is_empty(&ifp->if_snd)) {
972                 wi_start(ifp);
973         }
974
975         WI_UNLOCK(sc, s);
976
977         return;
978 }
979
980 static int
981 wi_cmd(sc, cmd, val0, val1, val2)
982         struct wi_softc         *sc;
983         int                     cmd;
984         int                     val0;
985         int                     val1;
986         int                     val2;
987 {
988         int                     i, s = 0;
989         static volatile int count  = 0;
990         
991         if (count > 1)
992                 panic("Hey partner, hold on there!");
993         count++;
994
995         /* wait for the busy bit to clear */
996         for (i = 500; i > 0; i--) {     /* 5s */
997                 if (!(CSR_READ_2(sc, WI_COMMAND) & WI_CMD_BUSY)) {
998                         break;
999                 }
1000                 DELAY(10*1000); /* 10 m sec */
1001         }
1002         if (i == 0) {
1003                 device_printf(sc->dev, "wi_cmd: busy bit won't clear.\n" );
1004                 count--;
1005                 return(ETIMEDOUT);
1006         }
1007
1008         CSR_WRITE_2(sc, WI_PARAM0, val0);
1009         CSR_WRITE_2(sc, WI_PARAM1, val1);
1010         CSR_WRITE_2(sc, WI_PARAM2, val2);
1011         CSR_WRITE_2(sc, WI_COMMAND, cmd);
1012
1013         for (i = 0; i < WI_TIMEOUT; i++) {
1014                 /*
1015                  * Wait for 'command complete' bit to be
1016                  * set in the event status register.
1017                  */
1018                 s = CSR_READ_2(sc, WI_EVENT_STAT);
1019                 if (s & WI_EV_CMD) {
1020                         /* Ack the event and read result code. */
1021                         s = CSR_READ_2(sc, WI_STATUS);
1022                         CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_CMD);
1023 #ifdef foo
1024                         if ((s & WI_CMD_CODE_MASK) != (cmd & WI_CMD_CODE_MASK))
1025                                 return(EIO);
1026 #endif
1027                         if (s & WI_STAT_CMD_RESULT) {
1028                                 count--;
1029                                 return(EIO);
1030                         }
1031                         break;
1032                 }
1033                 DELAY(WI_DELAY);
1034         }
1035
1036         count--;
1037         if (i == WI_TIMEOUT) {
1038                 device_printf(sc->dev,
1039                     "timeout in wi_cmd 0x%04x; event status 0x%04x\n", cmd, s);
1040                 return(ETIMEDOUT);
1041         }
1042         return(0);
1043 }
1044
1045 static void
1046 wi_reset(sc)
1047         struct wi_softc         *sc;
1048 {
1049 #define WI_INIT_TRIES 3
1050         int i;
1051         int tries;
1052         
1053         /* Symbol firmware cannot be initialized more than once */
1054         if (sc->sc_firmware_type == WI_SYMBOL && sc->sc_enabled)
1055                 return;
1056         if (sc->sc_firmware_type == WI_SYMBOL)
1057                 tries = 1;
1058         else
1059                 tries = WI_INIT_TRIES;
1060
1061         for (i = 0; i < tries; i++) {
1062                 if (wi_cmd(sc, WI_CMD_INI, 0, 0, 0) == 0)
1063                         break;
1064                 DELAY(WI_DELAY * 1000);
1065         }
1066         sc->sc_enabled = 1;
1067
1068         if (i == tries) {
1069                 device_printf(sc->dev, "init failed\n");
1070                 return;
1071         }
1072
1073         CSR_WRITE_2(sc, WI_INT_EN, 0);
1074         CSR_WRITE_2(sc, WI_EVENT_ACK, 0xFFFF);
1075
1076         /* Calibrate timer. */
1077         WI_SETVAL(WI_RID_TICK_TIME, 8);
1078
1079         return;
1080 }
1081
1082 /*
1083  * Read an LTV record from the NIC.
1084  */
1085 static int
1086 wi_read_record(sc, ltv)
1087         struct wi_softc         *sc;
1088         struct wi_ltv_gen       *ltv;
1089 {
1090         u_int16_t               *ptr;
1091         int                     i, len, code;
1092         struct wi_ltv_gen       *oltv, p2ltv;
1093
1094         oltv = ltv;
1095         if (sc->sc_firmware_type != WI_LUCENT) {
1096                 switch (ltv->wi_type) {
1097                 case WI_RID_ENCRYPTION:
1098                         p2ltv.wi_type = WI_RID_P2_ENCRYPTION;
1099                         p2ltv.wi_len = 2;
1100                         ltv = &p2ltv;
1101                         break;
1102                 case WI_RID_TX_CRYPT_KEY:
1103                         p2ltv.wi_type = WI_RID_P2_TX_CRYPT_KEY;
1104                         p2ltv.wi_len = 2;
1105                         ltv = &p2ltv;
1106                         break;
1107                 case WI_RID_ROAMING_MODE:
1108                         if (sc->sc_firmware_type == WI_INTERSIL)
1109                                 break;
1110                         /* not supported */
1111                         ltv->wi_len = 1;
1112                         return 0;
1113                 case WI_RID_MICROWAVE_OVEN:
1114                         /* not supported */
1115                         ltv->wi_len = 1;
1116                         return 0;
1117                 }
1118         }
1119
1120         /* Tell the NIC to enter record read mode. */
1121         if (wi_cmd(sc, WI_CMD_ACCESS|WI_ACCESS_READ, ltv->wi_type, 0, 0))
1122                 return(EIO);
1123
1124         /* Seek to the record. */
1125         if (wi_seek(sc, ltv->wi_type, 0, WI_BAP1))
1126                 return(EIO);
1127
1128         /*
1129          * Read the length and record type and make sure they
1130          * match what we expect (this verifies that we have enough
1131          * room to hold all of the returned data).
1132          */
1133         len = CSR_READ_2(sc, WI_DATA1);
1134         if (len > ltv->wi_len)
1135                 return(ENOSPC);
1136         code = CSR_READ_2(sc, WI_DATA1);
1137         if (code != ltv->wi_type)
1138                 return(EIO);
1139
1140         ltv->wi_len = len;
1141         ltv->wi_type = code;
1142
1143         /* Now read the data. */
1144         ptr = &ltv->wi_val;
1145         for (i = 0; i < ltv->wi_len - 1; i++)
1146                 ptr[i] = CSR_READ_2(sc, WI_DATA1);
1147
1148         if (ltv->wi_type == WI_RID_PORTTYPE && sc->wi_ptype == WI_PORTTYPE_IBSS
1149             && ltv->wi_val == sc->wi_ibss_port) {
1150                 /*
1151                  * Convert vendor IBSS port type to WI_PORTTYPE_IBSS.
1152                  * Since Lucent uses port type 1 for BSS *and* IBSS we
1153                  * have to rely on wi_ptype to distinguish this for us.
1154                  */
1155                 ltv->wi_val = htole16(WI_PORTTYPE_IBSS);
1156         } else if (sc->sc_firmware_type != WI_LUCENT) {
1157                 switch (oltv->wi_type) {
1158                 case WI_RID_TX_RATE:
1159                 case WI_RID_CUR_TX_RATE:
1160                         switch (ltv->wi_val) {
1161                         case 1: oltv->wi_val = 1; break;
1162                         case 2: oltv->wi_val = 2; break;
1163                         case 3: oltv->wi_val = 6; break;
1164                         case 4: oltv->wi_val = 5; break;
1165                         case 7: oltv->wi_val = 7; break;
1166                         case 8: oltv->wi_val = 11; break;
1167                         case 15: oltv->wi_val = 3; break;
1168                         default: oltv->wi_val = 0x100 + ltv->wi_val; break;
1169                         }
1170                         break;
1171                 case WI_RID_ENCRYPTION:
1172                         oltv->wi_len = 2;
1173                         if (ltv->wi_val & 0x01)
1174                                 oltv->wi_val = 1;
1175                         else
1176                                 oltv->wi_val = 0;
1177                         break;
1178                 case WI_RID_TX_CRYPT_KEY:
1179                         oltv->wi_len = 2;
1180                         oltv->wi_val = ltv->wi_val;
1181                         break;
1182                 case WI_RID_CNFAUTHMODE:
1183                         oltv->wi_len = 2;
1184                         if (le16toh(ltv->wi_val) & 0x01)
1185                                 oltv->wi_val = htole16(1);
1186                         else if (le16toh(ltv->wi_val) & 0x02)
1187                                 oltv->wi_val = htole16(2);
1188                         break;
1189                 }
1190         }
1191
1192         return(0);
1193 }
1194
1195 /*
1196  * Same as read, except we inject data instead of reading it.
1197  */
1198 static int
1199 wi_write_record(sc, ltv)
1200         struct wi_softc         *sc;
1201         struct wi_ltv_gen       *ltv;
1202 {
1203         u_int16_t               *ptr;
1204         int                     i;
1205         struct wi_ltv_gen       p2ltv;
1206
1207         if (ltv->wi_type == WI_RID_PORTTYPE &&
1208             le16toh(ltv->wi_val) == WI_PORTTYPE_IBSS) {
1209                 /* Convert WI_PORTTYPE_IBSS to vendor IBSS port type. */
1210                 p2ltv.wi_type = WI_RID_PORTTYPE;
1211                 p2ltv.wi_len = 2;
1212                 p2ltv.wi_val = sc->wi_ibss_port;
1213                 ltv = &p2ltv;
1214         } else if (sc->sc_firmware_type != WI_LUCENT) {
1215                 switch (ltv->wi_type) {
1216                 case WI_RID_TX_RATE:
1217                         p2ltv.wi_type = WI_RID_TX_RATE;
1218                         p2ltv.wi_len = 2;
1219                         switch (ltv->wi_val) {
1220                         case 1: p2ltv.wi_val = 1; break;
1221                         case 2: p2ltv.wi_val = 2; break;
1222                         case 3: p2ltv.wi_val = 15; break;
1223                         case 5: p2ltv.wi_val = 4; break;
1224                         case 6: p2ltv.wi_val = 3; break;
1225                         case 7: p2ltv.wi_val = 7; break;
1226                         case 11: p2ltv.wi_val = 8; break;
1227                         default: return EINVAL;
1228                         }
1229                         ltv = &p2ltv;
1230                         break;
1231                 case WI_RID_ENCRYPTION:
1232                         p2ltv.wi_type = WI_RID_P2_ENCRYPTION;
1233                         p2ltv.wi_len = 2;
1234                         if (le16toh(ltv->wi_val)) {
1235                                 p2ltv.wi_val =htole16(PRIVACY_INVOKED |
1236                                     EXCLUDE_UNENCRYPTED);
1237                                 if (sc->wi_ptype == WI_PORTTYPE_AP)
1238                                         /* 
1239                                          * Disable tx encryption...
1240                                          * it's broken.
1241                                          */
1242                                         p2ltv.wi_val |= htole16(HOST_ENCRYPT);
1243                         } else
1244                                 p2ltv.wi_val =
1245                                     htole16(HOST_ENCRYPT | HOST_DECRYPT);
1246                         ltv = &p2ltv;
1247                         break;
1248                 case WI_RID_TX_CRYPT_KEY:
1249                         p2ltv.wi_type = WI_RID_P2_TX_CRYPT_KEY;
1250                         p2ltv.wi_len = 2;
1251                         p2ltv.wi_val = ltv->wi_val;
1252                         ltv = &p2ltv;
1253                         break;
1254                 case WI_RID_DEFLT_CRYPT_KEYS:
1255                     {
1256                         int error;
1257                         int keylen;
1258                         struct wi_ltv_str       ws;
1259                         struct wi_ltv_keys      *wk =
1260                             (struct wi_ltv_keys *)ltv;
1261
1262                         keylen = wk->wi_keys[sc->wi_tx_key].wi_keylen;
1263
1264                         for (i = 0; i < 4; i++) {
1265                                 bzero(&ws, sizeof(ws));
1266                                 ws.wi_len = (keylen > 5) ? 8 : 4;
1267                                 ws.wi_type = WI_RID_P2_CRYPT_KEY0 + i;
1268                                 memcpy(ws.wi_str,
1269                                     &wk->wi_keys[i].wi_keydat, keylen);
1270                                 error = wi_write_record(sc,
1271                                     (struct wi_ltv_gen *)&ws);
1272                                 if (error)
1273                                         return error;
1274                         }
1275                         return 0;
1276                     }
1277                 case WI_RID_CNFAUTHMODE:
1278                         p2ltv.wi_type = WI_RID_CNFAUTHMODE;
1279                         p2ltv.wi_len = 2;
1280                         if (le16toh(ltv->wi_val) == 1)
1281                                 p2ltv.wi_val = htole16(0x01);
1282                         else if (le16toh(ltv->wi_val) == 2)
1283                                 p2ltv.wi_val = htole16(0x02);
1284                         ltv = &p2ltv;
1285                         break;
1286                 case WI_RID_ROAMING_MODE:
1287                         if (sc->sc_firmware_type == WI_INTERSIL)
1288                                 break;
1289                         /* not supported */
1290                         return 0;
1291                 case WI_RID_MICROWAVE_OVEN:
1292                         /* not supported */
1293                         return 0;
1294                 }
1295         } else {
1296                 /* LUCENT */
1297                 switch (ltv->wi_type) {  
1298                 case WI_RID_TX_RATE:
1299                         switch (ltv->wi_val) {
1300                         case 1: ltv->wi_val = 1; break;  /* 1Mb/s fixed */
1301                         case 2: ltv->wi_val = 2; break;  /* 2Mb/s fixed */
1302                         case 3: ltv->wi_val = 3; break;  /* 11Mb/s auto */
1303                         case 5: ltv->wi_val = 4; break;  /* 5.5Mb/s fixed */
1304                         case 6: ltv->wi_val = 6; break;  /* 2Mb/s auto */
1305                         case 7: ltv->wi_val = 7; break;  /* 5.5Mb/s auto */
1306                         case 11: ltv->wi_val = 5; break; /* 11Mb/s fixed */
1307                         default: return EINVAL;
1308                         }
1309                 }
1310         }
1311
1312         if (wi_seek(sc, ltv->wi_type, 0, WI_BAP1))
1313                 return(EIO);
1314
1315         CSR_WRITE_2(sc, WI_DATA1, ltv->wi_len);
1316         CSR_WRITE_2(sc, WI_DATA1, ltv->wi_type);
1317
1318         ptr = &ltv->wi_val;
1319         for (i = 0; i < ltv->wi_len - 1; i++)
1320                 CSR_WRITE_2(sc, WI_DATA1, ptr[i]);
1321
1322         if (wi_cmd(sc, WI_CMD_ACCESS|WI_ACCESS_WRITE, ltv->wi_type, 0, 0))
1323                 return(EIO);
1324
1325         return(0);
1326 }
1327
1328 static int
1329 wi_seek(sc, id, off, chan)
1330         struct wi_softc         *sc;
1331         int                     id, off, chan;
1332 {
1333         int                     i;
1334         int                     selreg, offreg;
1335         int                     status;
1336
1337         switch (chan) {
1338         case WI_BAP0:
1339                 selreg = WI_SEL0;
1340                 offreg = WI_OFF0;
1341                 break;
1342         case WI_BAP1:
1343                 selreg = WI_SEL1;
1344                 offreg = WI_OFF1;
1345                 break;
1346         default:
1347                 device_printf(sc->dev, "invalid data path: %x\n", chan);
1348                 return(EIO);
1349         }
1350
1351         CSR_WRITE_2(sc, selreg, id);
1352         CSR_WRITE_2(sc, offreg, off);
1353
1354         for (i = 0; i < WI_TIMEOUT; i++) {
1355                 status = CSR_READ_2(sc, offreg);
1356                 if (!(status & (WI_OFF_BUSY|WI_OFF_ERR)))
1357                         break;
1358                 DELAY(WI_DELAY);
1359         }
1360
1361         if (i == WI_TIMEOUT) {
1362                 device_printf(sc->dev, "timeout in wi_seek to %x/%x; last status %x\n",
1363                         id, off, status);
1364                 return(ETIMEDOUT);
1365         }
1366
1367         return(0);
1368 }
1369
1370 static int
1371 wi_read_data(sc, id, off, buf, len)
1372         struct wi_softc         *sc;
1373         int                     id, off;
1374         caddr_t                 buf;
1375         int                     len;
1376 {
1377         int                     i;
1378         u_int16_t               *ptr;
1379
1380         if (wi_seek(sc, id, off, WI_BAP1))
1381                 return(EIO);
1382
1383         ptr = (u_int16_t *)buf;
1384         for (i = 0; i < len / 2; i++)
1385                 ptr[i] = CSR_READ_2(sc, WI_DATA1);
1386
1387         return(0);
1388 }
1389
1390 /*
1391  * According to the comments in the HCF Light code, there is a bug in
1392  * the Hermes (or possibly in certain Hermes firmware revisions) where
1393  * the chip's internal autoincrement counter gets thrown off during
1394  * data writes: the autoincrement is missed, causing one data word to
1395  * be overwritten and subsequent words to be written to the wrong memory
1396  * locations. The end result is that we could end up transmitting bogus
1397  * frames without realizing it. The workaround for this is to write a
1398  * couple of extra guard words after the end of the transfer, then
1399  * attempt to read then back. If we fail to locate the guard words where
1400  * we expect them, we preform the transfer over again.
1401  */
1402 static int
1403 wi_write_data(sc, id, off, buf, len)
1404         struct wi_softc         *sc;
1405         int                     id, off;
1406         caddr_t                 buf;
1407         int                     len;
1408 {
1409         int                     i;
1410         u_int16_t               *ptr;
1411 #ifdef WI_HERMES_AUTOINC_WAR
1412         int                     retries;
1413
1414         retries = 512;
1415 again:
1416 #endif
1417
1418         if (wi_seek(sc, id, off, WI_BAP0))
1419                 return(EIO);
1420
1421         ptr = (u_int16_t *)buf;
1422         for (i = 0; i < (len / 2); i++)
1423                 CSR_WRITE_2(sc, WI_DATA0, ptr[i]);
1424
1425 #ifdef WI_HERMES_AUTOINC_WAR
1426         CSR_WRITE_2(sc, WI_DATA0, 0x1234);
1427         CSR_WRITE_2(sc, WI_DATA0, 0x5678);
1428
1429         if (wi_seek(sc, id, off + len, WI_BAP0))
1430                 return(EIO);
1431
1432         if (CSR_READ_2(sc, WI_DATA0) != 0x1234 ||
1433             CSR_READ_2(sc, WI_DATA0) != 0x5678) {
1434                 if (--retries >= 0)
1435                         goto again;
1436                 device_printf(sc->dev, "wi_write_data device timeout\n");
1437                 return (EIO);
1438         }
1439 #endif
1440
1441         return(0);
1442 }
1443
1444 /*
1445  * Allocate a region of memory inside the NIC and zero
1446  * it out.
1447  */
1448 static int
1449 wi_alloc_nicmem(sc, len, id)
1450         struct wi_softc         *sc;
1451         int                     len;
1452         int                     *id;
1453 {
1454         int                     i;
1455
1456         if (wi_cmd(sc, WI_CMD_ALLOC_MEM, len, 0, 0)) {
1457                 device_printf(sc->dev,
1458                     "failed to allocate %d bytes on NIC\n", len);
1459                 return(ENOMEM);
1460         }
1461
1462         for (i = 0; i < WI_TIMEOUT; i++) {
1463                 if (CSR_READ_2(sc, WI_EVENT_STAT) & WI_EV_ALLOC)
1464                         break;
1465                 DELAY(WI_DELAY);
1466         }
1467
1468         if (i == WI_TIMEOUT) {
1469                 device_printf(sc->dev, "time out allocating memory on card\n");
1470                 return(ETIMEDOUT);
1471         }
1472
1473         CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_ALLOC);
1474         *id = CSR_READ_2(sc, WI_ALLOC_FID);
1475
1476         if (wi_seek(sc, *id, 0, WI_BAP0)) {
1477                 device_printf(sc->dev, "seek failed while allocating memory on card\n");
1478                 return(EIO);
1479         }
1480
1481         for (i = 0; i < len / 2; i++)
1482                 CSR_WRITE_2(sc, WI_DATA0, 0);
1483
1484         return(0);
1485 }
1486
1487 static void
1488 wi_setmulti(sc)
1489         struct wi_softc         *sc;
1490 {
1491         struct ifnet            *ifp;
1492         int                     i = 0;
1493         struct ifmultiaddr      *ifma;
1494         struct wi_ltv_mcast     mcast;
1495
1496         ifp = &sc->arpcom.ac_if;
1497
1498         bzero((char *)&mcast, sizeof(mcast));
1499
1500         mcast.wi_type = WI_RID_MCAST_LIST;
1501         mcast.wi_len = (3 * 16) + 1;
1502
1503         if (ifp->if_flags & IFF_ALLMULTI || ifp->if_flags & IFF_PROMISC) {
1504                 wi_write_record(sc, (struct wi_ltv_gen *)&mcast);
1505                 return;
1506         }
1507
1508 #if defined(__DragonFly__) || __FreeBSD_version < 500000
1509         LIST_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
1510 #else
1511         TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
1512 #endif
1513                 if (ifma->ifma_addr->sa_family != AF_LINK)
1514                         continue;
1515                 if (i < 16) {
1516                         bcopy(LLADDR((struct sockaddr_dl *)ifma->ifma_addr),
1517                             (char *)&mcast.wi_mcast[i], ETHER_ADDR_LEN);
1518                         i++;
1519                 } else {
1520                         bzero((char *)&mcast, sizeof(mcast));
1521                         break;
1522                 }
1523         }
1524
1525         mcast.wi_len = (i * 3) + 1;
1526         wi_write_record(sc, (struct wi_ltv_gen *)&mcast);
1527
1528         return;
1529 }
1530
1531 static void
1532 wi_setdef(sc, wreq)
1533         struct wi_softc         *sc;
1534         struct wi_req           *wreq;
1535 {
1536         struct ifnet            *ifp;
1537
1538         ifp = &sc->arpcom.ac_if;
1539
1540         switch(wreq->wi_type) {
1541         case WI_RID_MAC_NODE:
1542                 bcopy((char *)&wreq->wi_val, (char *)&sc->arpcom.ac_enaddr,
1543                    ETHER_ADDR_LEN);
1544                 bcopy((char *)&wreq->wi_val, IF_LLADDR(ifp), ETHER_ADDR_LEN);
1545                 break;
1546         case WI_RID_PORTTYPE:
1547                 sc->wi_ptype = le16toh(wreq->wi_val[0]);
1548                 break;
1549         case WI_RID_TX_RATE:
1550                 sc->wi_tx_rate = le16toh(wreq->wi_val[0]);
1551                 break;
1552         case WI_RID_MAX_DATALEN:
1553                 sc->wi_max_data_len = le16toh(wreq->wi_val[0]);
1554                 break;
1555         case WI_RID_RTS_THRESH:
1556                 sc->wi_rts_thresh = le16toh(wreq->wi_val[0]);
1557                 break;
1558         case WI_RID_SYSTEM_SCALE:
1559                 sc->wi_ap_density = le16toh(wreq->wi_val[0]);
1560                 break;
1561         case WI_RID_CREATE_IBSS:
1562                 sc->wi_create_ibss = le16toh(wreq->wi_val[0]);
1563                 break;
1564         case WI_RID_OWN_CHNL:
1565                 sc->wi_channel = le16toh(wreq->wi_val[0]);
1566                 break;
1567         case WI_RID_NODENAME:
1568                 bzero(sc->wi_node_name, sizeof(sc->wi_node_name));
1569                 bcopy((char *)&wreq->wi_val[1], sc->wi_node_name, 30);
1570                 break;
1571         case WI_RID_DESIRED_SSID:
1572                 bzero(sc->wi_net_name, sizeof(sc->wi_net_name));
1573                 bcopy((char *)&wreq->wi_val[1], sc->wi_net_name, 30);
1574                 break;
1575         case WI_RID_OWN_SSID:
1576                 bzero(sc->wi_ibss_name, sizeof(sc->wi_ibss_name));
1577                 bcopy((char *)&wreq->wi_val[1], sc->wi_ibss_name, 30);
1578                 break;
1579         case WI_RID_PM_ENABLED:
1580                 sc->wi_pm_enabled = le16toh(wreq->wi_val[0]);
1581                 break;
1582         case WI_RID_MICROWAVE_OVEN:
1583                 sc->wi_mor_enabled = le16toh(wreq->wi_val[0]);
1584                 break;
1585         case WI_RID_MAX_SLEEP:
1586                 sc->wi_max_sleep = le16toh(wreq->wi_val[0]);
1587                 break;
1588         case WI_RID_CNFAUTHMODE:
1589                 sc->wi_authtype = le16toh(wreq->wi_val[0]);
1590                 break;
1591         case WI_RID_ROAMING_MODE:
1592                 sc->wi_roaming = le16toh(wreq->wi_val[0]);
1593                 break;
1594         case WI_RID_ENCRYPTION:
1595                 sc->wi_use_wep = le16toh(wreq->wi_val[0]);
1596                 break;
1597         case WI_RID_TX_CRYPT_KEY:
1598                 sc->wi_tx_key = le16toh(wreq->wi_val[0]);
1599                 break;
1600         case WI_RID_DEFLT_CRYPT_KEYS:
1601                 bcopy((char *)wreq, (char *)&sc->wi_keys,
1602                     sizeof(struct wi_ltv_keys));
1603                 break;
1604         default:
1605                 break;
1606         }
1607
1608         /* Reinitialize WaveLAN. */
1609         wi_init(sc);
1610
1611         return;
1612 }
1613
1614 static int
1615 wi_ioctl(ifp, command, data, cr)
1616         struct ifnet            *ifp;
1617         u_long                  command;
1618         caddr_t                 data;
1619         struct ucred            *cr;
1620 {
1621         int                     error = 0;
1622         int                     len;
1623         u_int8_t                tmpkey[14];
1624         char                    tmpssid[IEEE80211_NWID_LEN];
1625         struct wi_softc         *sc;
1626         struct wi_req           wreq;
1627         struct ifreq            *ifr;
1628         struct ieee80211req     *ireq;
1629         int                     s;
1630
1631         sc = ifp->if_softc;
1632         WI_LOCK(sc, s);
1633         ifr = (struct ifreq *)data;
1634         ireq = (struct ieee80211req *)data;
1635
1636         if (sc->wi_gone) {
1637                 error = ENODEV;
1638                 goto out;
1639         }
1640
1641         switch(command) {
1642         case SIOCSIFFLAGS:
1643                 /*
1644                  * Can't do promisc and hostap at the same time.  If all that's
1645                  * changing is the promisc flag, try to short-circuit a call to
1646                  * wi_init() by just setting PROMISC in the hardware.
1647                  */
1648                 if (ifp->if_flags & IFF_UP) {
1649                         if (sc->wi_ptype != WI_PORTTYPE_AP &&
1650                             ifp->if_flags & IFF_RUNNING) {
1651                                 if (ifp->if_flags & IFF_PROMISC &&
1652                                     !(sc->wi_if_flags & IFF_PROMISC)) {
1653                                         WI_SETVAL(WI_RID_PROMISC, 1);
1654                                 } else if (!(ifp->if_flags & IFF_PROMISC) &&
1655                                     sc->wi_if_flags & IFF_PROMISC) {
1656                                         WI_SETVAL(WI_RID_PROMISC, 0);
1657                                 } else {
1658                                         wi_init(sc);
1659                                 }
1660                         } else {
1661                                 wi_init(sc);
1662                         }
1663                 } else {
1664                         if (ifp->if_flags & IFF_RUNNING) {
1665                                 wi_stop(sc);
1666                         }
1667                 }
1668                 sc->wi_if_flags = ifp->if_flags;
1669                 error = 0;
1670                 break;
1671         case SIOCSIFMEDIA:
1672         case SIOCGIFMEDIA:
1673                 error = ifmedia_ioctl(ifp, ifr, &sc->ifmedia, command);
1674                 break;
1675         case SIOCADDMULTI:
1676         case SIOCDELMULTI:
1677                 wi_setmulti(sc);
1678                 error = 0;
1679                 break;
1680         case SIOCGWAVELAN:
1681                 error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1682                 if (error)
1683                         break;
1684                 if (wreq.wi_len > WI_MAX_DATALEN) {
1685                         error = EINVAL;
1686                         break;
1687                 }
1688                 /* Don't show WEP keys to non-root users. */
1689                 if (wreq.wi_type == WI_RID_DEFLT_CRYPT_KEYS &&
1690                     suser_cred(cr, NULL_CRED_OKAY))
1691                         break;
1692                 if (wreq.wi_type == WI_RID_IFACE_STATS) {
1693                         bcopy((char *)&sc->wi_stats, (char *)&wreq.wi_val,
1694                             sizeof(sc->wi_stats));
1695                         wreq.wi_len = (sizeof(sc->wi_stats) / 2) + 1;
1696                 } else if (wreq.wi_type == WI_RID_DEFLT_CRYPT_KEYS) {
1697                         bcopy((char *)&sc->wi_keys, (char *)&wreq,
1698                             sizeof(struct wi_ltv_keys));
1699                 }
1700 #ifdef WICACHE
1701                 else if (wreq.wi_type == WI_RID_ZERO_CACHE) {
1702                         sc->wi_sigitems = sc->wi_nextitem = 0;
1703                 } else if (wreq.wi_type == WI_RID_READ_CACHE) {
1704                         char *pt = (char *)&wreq.wi_val;
1705                         bcopy((char *)&sc->wi_sigitems,
1706                             (char *)pt, sizeof(int));
1707                         pt += (sizeof (int));
1708                         wreq.wi_len = sizeof(int) / 2;
1709                         bcopy((char *)&sc->wi_sigcache, (char *)pt,
1710                             sizeof(struct wi_sigcache) * sc->wi_sigitems);
1711                         wreq.wi_len += ((sizeof(struct wi_sigcache) *
1712                             sc->wi_sigitems) / 2) + 1;
1713                 }
1714 #endif
1715                 else if (wreq.wi_type == WI_RID_PROCFRAME) {
1716                         wreq.wi_len = 2;
1717                         wreq.wi_val[0] = sc->wi_procframe;
1718                 } else if (wreq.wi_type == WI_RID_PRISM2) {
1719                         wreq.wi_len = 2;
1720                         wreq.wi_val[0] = sc->sc_firmware_type != WI_LUCENT;
1721                 } else if (wreq.wi_type == WI_RID_SCAN_RES && 
1722                     sc->sc_firmware_type == WI_LUCENT) {
1723                         memcpy((char *)wreq.wi_val, (char *)sc->wi_scanbuf,
1724                             sc->wi_scanbuf_len * 2);
1725                         wreq.wi_len = sc->wi_scanbuf_len;
1726                 } else {
1727                         if (wi_read_record(sc, (struct wi_ltv_gen *)&wreq)) {
1728                                 error = EINVAL;
1729                                 break;
1730                         }
1731                 }
1732                 error = copyout(&wreq, ifr->ifr_data, sizeof(wreq));
1733                 break;
1734         case SIOCSWAVELAN:
1735                 if ((error = suser_cred(cr, NULL_CRED_OKAY)))
1736                         goto out;
1737                 error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1738                 if (error)
1739                         break;
1740                 if (wreq.wi_len > WI_MAX_DATALEN) {
1741                         error = EINVAL;
1742                         break;
1743                 }
1744                 if (wreq.wi_type == WI_RID_IFACE_STATS) {
1745                         error = EINVAL;
1746                         break;
1747                 } else if (wreq.wi_type == WI_RID_MGMT_XMIT) {
1748                         error = owi_mgmt_xmit(sc, (caddr_t)&wreq.wi_val,
1749                             wreq.wi_len);
1750                 } else if (wreq.wi_type == WI_RID_PROCFRAME) {
1751                         sc->wi_procframe = wreq.wi_val[0];
1752                 /*
1753                  * if we're getting a scan request from a wavelan card
1754                  * (non-prism2), send out a cmd_inquire to the card to scan
1755                  * results for the scan will be received through the info
1756                  * interrupt handler. otherwise the scan request can be
1757                  * directly handled by a prism2 card's rid interface.
1758                  */
1759                 } else if (wreq.wi_type == WI_RID_SCAN_REQ && 
1760                     sc->sc_firmware_type == WI_LUCENT) {
1761                         wi_cmd(sc, WI_CMD_INQUIRE, WI_INFO_SCAN_RESULTS, 0, 0);
1762                 } else {
1763                         error = wi_write_record(sc, (struct wi_ltv_gen *)&wreq);
1764                         if (!error)
1765                                 wi_setdef(sc, &wreq);
1766                 }
1767                 break;
1768         case SIOCGPRISM2DEBUG:
1769                 error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1770                 if (error)
1771                         break;
1772                 if (!(ifp->if_flags & IFF_RUNNING) ||
1773                     sc->sc_firmware_type == WI_LUCENT) {
1774                         error = EIO;
1775                         break;
1776                 }
1777                 error = wi_get_debug(sc, &wreq);
1778                 if (error == 0)
1779                         error = copyout(&wreq, ifr->ifr_data, sizeof(wreq));
1780                 break;
1781         case SIOCSPRISM2DEBUG:
1782                 if ((error = suser_cred(cr, NULL_CRED_OKAY)))
1783                         goto out;
1784                 error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1785                 if (error)
1786                         break;
1787                 error = wi_set_debug(sc, &wreq);
1788                 break;
1789         case SIOCG80211:
1790                 switch(ireq->i_type) {
1791                 case IEEE80211_IOC_SSID:
1792                         if(ireq->i_val == -1) {
1793                                 bzero(tmpssid, IEEE80211_NWID_LEN);
1794                                 error = wi_get_cur_ssid(sc, tmpssid, &len);
1795                                 if (error != 0)
1796                                         break;
1797                                 error = copyout(tmpssid, ireq->i_data,
1798                                         IEEE80211_NWID_LEN);
1799                                 ireq->i_len = len;
1800                         } else if (ireq->i_val == 0) {
1801                                 error = copyout(sc->wi_net_name,
1802                                     ireq->i_data,
1803                                     IEEE80211_NWID_LEN);
1804                                 ireq->i_len = IEEE80211_NWID_LEN;
1805                         } else
1806                                 error = EINVAL;
1807                         break;
1808                 case IEEE80211_IOC_NUMSSIDS:
1809                         ireq->i_val = 1;
1810                         break;
1811                 case IEEE80211_IOC_WEP:
1812                         if(!sc->wi_has_wep) {
1813                                 ireq->i_val = IEEE80211_WEP_NOSUP; 
1814                         } else {
1815                                 if(sc->wi_use_wep) {
1816                                         ireq->i_val =
1817                                             IEEE80211_WEP_MIXED;
1818                                 } else {
1819                                         ireq->i_val =
1820                                             IEEE80211_WEP_OFF;
1821                                 }
1822                         }
1823                         break;
1824                 case IEEE80211_IOC_WEPKEY:
1825                         if(!sc->wi_has_wep ||
1826                             ireq->i_val < 0 || ireq->i_val > 3) {
1827                                 error = EINVAL;
1828                                 break;
1829                         }
1830                         len = sc->wi_keys.wi_keys[ireq->i_val].wi_keylen;
1831                         if (suser_cred(cr, NULL_CRED_OKAY))
1832                                 bcopy(sc->wi_keys.wi_keys[ireq->i_val].wi_keydat,
1833                                     tmpkey, len);
1834                         else
1835                                 bzero(tmpkey, len);
1836
1837                         ireq->i_len = len;
1838                         error = copyout(tmpkey, ireq->i_data, len);
1839
1840                         break;
1841                 case IEEE80211_IOC_NUMWEPKEYS:
1842                         if(!sc->wi_has_wep)
1843                                 error = EINVAL;
1844                         else
1845                                 ireq->i_val = 4;
1846                         break;
1847                 case IEEE80211_IOC_WEPTXKEY:
1848                         if(!sc->wi_has_wep)
1849                                 error = EINVAL;
1850                         else
1851                                 ireq->i_val = sc->wi_tx_key;
1852                         break;
1853                 case IEEE80211_IOC_AUTHMODE:
1854                         ireq->i_val = sc->wi_authmode;
1855                         break;
1856                 case IEEE80211_IOC_STATIONNAME:
1857                         error = copyout(sc->wi_node_name,
1858                             ireq->i_data, IEEE80211_NWID_LEN);
1859                         ireq->i_len = IEEE80211_NWID_LEN;
1860                         break;
1861                 case IEEE80211_IOC_CHANNEL:
1862                         wreq.wi_type = WI_RID_CURRENT_CHAN;
1863                         wreq.wi_len = WI_MAX_DATALEN;
1864                         if (wi_read_record(sc, (struct wi_ltv_gen *)&wreq))
1865                                 error = EINVAL;
1866                         else {
1867                                 ireq->i_val = wreq.wi_val[0];
1868                         }
1869                         break;
1870                 case IEEE80211_IOC_POWERSAVE:
1871                         if(sc->wi_pm_enabled)
1872                                 ireq->i_val = IEEE80211_POWERSAVE_ON;
1873                         else
1874                                 ireq->i_val = IEEE80211_POWERSAVE_OFF;
1875                         break;
1876                 case IEEE80211_IOC_POWERSAVESLEEP:
1877                         ireq->i_val = sc->wi_max_sleep;
1878                         break;
1879                 default:
1880                         error = EINVAL;
1881                 }
1882                 break;
1883         case SIOCS80211:
1884                 if ((error = suser_cred(cr, NULL_CRED_OKAY)))
1885                         goto out;
1886                 switch(ireq->i_type) {
1887                 case IEEE80211_IOC_SSID:
1888                         if (ireq->i_val != 0 ||
1889                             ireq->i_len > IEEE80211_NWID_LEN) {
1890                                 error = EINVAL;
1891                                 break;
1892                         }
1893                         /* We set both of them */
1894                         bzero(sc->wi_net_name, IEEE80211_NWID_LEN);
1895                         error = copyin(ireq->i_data,
1896                             sc->wi_net_name, ireq->i_len);
1897                         bcopy(sc->wi_net_name, sc->wi_ibss_name, IEEE80211_NWID_LEN);
1898                         break;
1899                 case IEEE80211_IOC_WEP:
1900                         /*
1901                          * These cards only support one mode so
1902                          * we just turn wep on what ever is
1903                          * passed in if it's not OFF.
1904                          */
1905                         if (ireq->i_val == IEEE80211_WEP_OFF) {
1906                                 sc->wi_use_wep = 0;
1907                         } else {
1908                                 sc->wi_use_wep = 1;
1909                         }
1910                         break;
1911                 case IEEE80211_IOC_WEPKEY:
1912                         if (ireq->i_val < 0 || ireq->i_val > 3 ||
1913                                 ireq->i_len > 13) {
1914                                 error = EINVAL;
1915                                 break;
1916                         } 
1917                         bzero(sc->wi_keys.wi_keys[ireq->i_val].wi_keydat, 13);
1918                         error = copyin(ireq->i_data, 
1919                             sc->wi_keys.wi_keys[ireq->i_val].wi_keydat,
1920                             ireq->i_len);
1921                         if(error)
1922                                 break;
1923                         sc->wi_keys.wi_keys[ireq->i_val].wi_keylen =
1924                                     ireq->i_len;
1925                         break;
1926                 case IEEE80211_IOC_WEPTXKEY:
1927                         if (ireq->i_val < 0 || ireq->i_val > 3) {
1928                                 error = EINVAL;
1929                                 break;
1930                         }
1931                         sc->wi_tx_key = ireq->i_val;
1932                         break;
1933                 case IEEE80211_IOC_AUTHMODE:
1934                         sc->wi_authmode = ireq->i_val;
1935                         break;
1936                 case IEEE80211_IOC_STATIONNAME:
1937                         if (ireq->i_len > 32) {
1938                                 error = EINVAL;
1939                                 break;
1940                         }
1941                         bzero(sc->wi_node_name, 32);
1942                         error = copyin(ireq->i_data,
1943                             sc->wi_node_name, ireq->i_len);
1944                         break;
1945                 case IEEE80211_IOC_CHANNEL:
1946                         /*
1947                          * The actual range is 1-14, but if you
1948                          * set it to 0 you get the default. So
1949                          * we let that work too.
1950                          */
1951                         if (ireq->i_val < 0 || ireq->i_val > 14) {
1952                                 error = EINVAL;
1953                                 break;
1954                         }
1955                         sc->wi_channel = ireq->i_val;
1956                         break;
1957                 case IEEE80211_IOC_POWERSAVE:
1958                         switch (ireq->i_val) {
1959                         case IEEE80211_POWERSAVE_OFF:
1960                                 sc->wi_pm_enabled = 0;
1961                                 break;
1962                         case IEEE80211_POWERSAVE_ON:
1963                                 sc->wi_pm_enabled = 1;
1964                                 break;
1965                         default:
1966                                 error = EINVAL;
1967                                 break;
1968                         }
1969                         break;
1970                 case IEEE80211_IOC_POWERSAVESLEEP:
1971                         if (ireq->i_val < 0) {
1972                                 error = EINVAL;
1973                                 break;
1974                         }
1975                         sc->wi_max_sleep = ireq->i_val;
1976                         break;
1977                 default:
1978                         error = EINVAL;
1979                         break;
1980                 }
1981
1982                 /* Reinitialize WaveLAN. */
1983                 wi_init(sc);
1984
1985         break;
1986         case SIOCHOSTAP_ADD:
1987         case SIOCHOSTAP_DEL:
1988         case SIOCHOSTAP_GET:
1989         case SIOCHOSTAP_GETALL:
1990         case SIOCHOSTAP_GFLAGS:
1991         case SIOCHOSTAP_SFLAGS:
1992                 /* Send all Host AP specific ioctl's to Host AP code. */
1993                 error = owihap_ioctl(sc, command, data);
1994                 break;
1995         default:
1996                 error = ether_ioctl(ifp, command, data);
1997                 break;
1998         }
1999 out:
2000         WI_UNLOCK(sc, s);
2001
2002         return(error);
2003 }
2004
2005 static void
2006 wi_init(xsc)
2007         void                    *xsc;
2008 {
2009         struct wi_softc         *sc = xsc;
2010         struct ifnet            *ifp = &sc->arpcom.ac_if;
2011         struct wi_ltv_macaddr   mac;
2012         int                     id = 0;
2013         int                     s;
2014
2015         WI_LOCK(sc, s);
2016
2017         if (sc->wi_gone) {
2018                 WI_UNLOCK(sc, s);
2019                 return;
2020         }
2021
2022         if (ifp->if_flags & IFF_RUNNING)
2023                 wi_stop(sc);
2024
2025         wi_reset(sc);
2026
2027         /* Program max data length. */
2028         WI_SETVAL(WI_RID_MAX_DATALEN, sc->wi_max_data_len);
2029
2030         /* Set the port type. */
2031         WI_SETVAL(WI_RID_PORTTYPE, sc->wi_ptype);
2032
2033         /* Enable/disable IBSS creation. */
2034         WI_SETVAL(WI_RID_CREATE_IBSS, sc->wi_create_ibss);
2035
2036         /* Program the RTS/CTS threshold. */
2037         WI_SETVAL(WI_RID_RTS_THRESH, sc->wi_rts_thresh);
2038
2039         /* Program the TX rate */
2040         WI_SETVAL(WI_RID_TX_RATE, sc->wi_tx_rate);
2041
2042         /* Access point density */
2043         WI_SETVAL(WI_RID_SYSTEM_SCALE, sc->wi_ap_density);
2044
2045         /* Power Management Enabled */
2046         WI_SETVAL(WI_RID_PM_ENABLED, sc->wi_pm_enabled);
2047
2048         /* Power Managment Max Sleep */
2049         WI_SETVAL(WI_RID_MAX_SLEEP, sc->wi_max_sleep);
2050
2051         /* Roaming type */
2052         WI_SETVAL(WI_RID_ROAMING_MODE, sc->wi_roaming);
2053
2054         /* Specify the IBSS name */
2055         WI_SETSTR(WI_RID_OWN_SSID, sc->wi_ibss_name);
2056
2057         /* Specify the network name */
2058         WI_SETSTR(WI_RID_DESIRED_SSID, sc->wi_net_name);
2059
2060         /* Specify the frequency to use */
2061         WI_SETVAL(WI_RID_OWN_CHNL, sc->wi_channel);
2062
2063         /* Program the nodename. */
2064         WI_SETSTR(WI_RID_NODENAME, sc->wi_node_name);
2065
2066         /* Specify the authentication mode. */
2067         WI_SETVAL(WI_RID_CNFAUTHMODE, sc->wi_authmode);
2068
2069         /* Set our MAC address. */
2070         mac.wi_len = 4;
2071         mac.wi_type = WI_RID_MAC_NODE;
2072         bcopy((char *)&sc->arpcom.ac_enaddr,
2073            (char *)&mac.wi_mac_addr, ETHER_ADDR_LEN);
2074         wi_write_record(sc, (struct wi_ltv_gen *)&mac);
2075
2076         /*
2077          * Initialize promisc mode.
2078          *      Being in the Host-AP mode causes
2079          *      great deal of pain if promisc mode is set.
2080          *      Therefore we avoid confusing the firmware
2081          *      and always reset promisc mode in Host-AP regime,
2082          *      it shows us all the packets anyway.
2083          */
2084         if (sc->wi_ptype != WI_PORTTYPE_AP && ifp->if_flags & IFF_PROMISC)
2085                 WI_SETVAL(WI_RID_PROMISC, 1);
2086         else
2087                 WI_SETVAL(WI_RID_PROMISC, 0);
2088
2089         /* Configure WEP. */
2090         if (sc->wi_has_wep) {
2091                 WI_SETVAL(WI_RID_ENCRYPTION, sc->wi_use_wep);
2092                 WI_SETVAL(WI_RID_TX_CRYPT_KEY, sc->wi_tx_key);
2093                 sc->wi_keys.wi_len = (sizeof(struct wi_ltv_keys) / 2) + 1;
2094                 sc->wi_keys.wi_type = WI_RID_DEFLT_CRYPT_KEYS;
2095                 wi_write_record(sc, (struct wi_ltv_gen *)&sc->wi_keys);
2096                 if (sc->sc_firmware_type != WI_LUCENT && sc->wi_use_wep) {
2097                         /*
2098                          * ONLY HWB3163 EVAL-CARD Firmware version
2099                          * less than 0.8 variant2
2100                          *
2101                          * If promiscuous mode disable, Prism2 chip
2102                          * does not work with WEP.
2103                          * It is under investigation for details.
2104                          * (ichiro@netbsd.org)
2105                          *
2106                          * And make sure that we don't need to do it
2107                          * in hostap mode, since it interferes with
2108                          * the above hostap workaround.
2109                          */
2110                         if (sc->wi_ptype != WI_PORTTYPE_AP &&
2111                             sc->sc_firmware_type == WI_INTERSIL &&
2112                             sc->sc_sta_firmware_ver < 802 ) {
2113                                 /* firm ver < 0.8 variant 2 */
2114                                 WI_SETVAL(WI_RID_PROMISC, 1);
2115                         }
2116                         WI_SETVAL(WI_RID_CNFAUTHMODE, sc->wi_authtype);
2117                 }
2118         }
2119
2120         /* Set multicast filter. */
2121         wi_setmulti(sc);
2122
2123         /* Enable desired port */
2124         wi_cmd(sc, WI_CMD_ENABLE | sc->wi_portnum, 0, 0, 0);
2125
2126         if (wi_alloc_nicmem(sc, ETHER_MAX_LEN + sizeof(struct wi_frame) + 8, &id))
2127                 device_printf(sc->dev, "tx buffer allocation failed\n");
2128         sc->wi_tx_data_id = id;
2129
2130         if (wi_alloc_nicmem(sc, ETHER_MAX_LEN + sizeof(struct wi_frame) + 8, &id))
2131                 device_printf(sc->dev, "mgmt. buffer allocation failed\n");
2132         sc->wi_tx_mgmt_id = id;
2133
2134         /* enable interrupts */
2135         CSR_WRITE_2(sc, WI_INT_EN, WI_INTRS);
2136
2137         owihap_init(sc);
2138
2139         ifp->if_flags |= IFF_RUNNING;
2140         ifp->if_flags &= ~IFF_OACTIVE;
2141
2142         callout_reset(&sc->wi_stat_timer, hz * 60, wi_inquire, sc);
2143         WI_UNLOCK(sc, s);
2144
2145         return;
2146 }
2147
2148 #define RC4STATE 256
2149 #define RC4KEYLEN 16
2150 #define RC4SWAP(x,y) \
2151     do { u_int8_t t = state[x]; state[x] = state[y]; state[y] = t; } while(0)
2152
2153 static void
2154 wi_do_hostencrypt(struct wi_softc *sc, caddr_t buf, int len)
2155 {
2156         u_int32_t i, crc, klen;
2157         u_int8_t state[RC4STATE], key[RC4KEYLEN];
2158         u_int8_t x, y, *dat;
2159
2160         if (!sc->wi_icv_flag) {
2161                 sc->wi_icv = arc4random();
2162                 sc->wi_icv_flag++;
2163         } else
2164                 sc->wi_icv++;
2165         /*
2166          * Skip 'bad' IVs from Fluhrer/Mantin/Shamir:
2167          * (B, 255, N) with 3 <= B < 8
2168          */
2169         if (sc->wi_icv >= 0x03ff00 &&
2170             (sc->wi_icv & 0xf8ff00) == 0x00ff00)
2171                 sc->wi_icv += 0x000100;
2172
2173         /* prepend 24bit IV to tx key, byte order does not matter */
2174         key[0] = sc->wi_icv >> 16;
2175         key[1] = sc->wi_icv >> 8;
2176         key[2] = sc->wi_icv;
2177
2178         klen = sc->wi_keys.wi_keys[sc->wi_tx_key].wi_keylen +
2179             IEEE80211_WEP_IVLEN;
2180         klen = (klen >= RC4KEYLEN) ? RC4KEYLEN : RC4KEYLEN/2;
2181         bcopy((char *)&sc->wi_keys.wi_keys[sc->wi_tx_key].wi_keydat,
2182             (char *)key + IEEE80211_WEP_IVLEN, klen - IEEE80211_WEP_IVLEN);
2183
2184         /* rc4 keysetup */
2185         x = y = 0;
2186         for (i = 0; i < RC4STATE; i++)
2187                 state[i] = i;
2188         for (i = 0; i < RC4STATE; i++) {
2189                 y = (key[x] + state[i] + y) % RC4STATE;
2190                 RC4SWAP(i, y);
2191                 x = (x + 1) % klen;
2192         }
2193
2194         /* output: IV, tx keyid, rc4(data), rc4(crc32(data)) */
2195         dat = buf;
2196         dat[0] = key[0];
2197         dat[1] = key[1];
2198         dat[2] = key[2];
2199         dat[3] = sc->wi_tx_key << 6;            /* pad and keyid */
2200         dat += 4;
2201
2202         /* compute rc4 over data, crc32 over data */
2203         crc = ~0;
2204         x = y = 0;
2205         for (i = 0; i < len; i++) {
2206                 x = (x + 1) % RC4STATE;
2207                 y = (state[x] + y) % RC4STATE;
2208                 RC4SWAP(x, y);
2209                 crc = crc32_tab[(crc ^ dat[i]) & 0xff] ^ (crc >> 8);
2210                 dat[i] ^= state[(state[x] + state[y]) % RC4STATE];
2211         }
2212         crc = ~crc;
2213         dat += len;
2214
2215         /* append little-endian crc32 and encrypt */
2216         dat[0] = crc;
2217         dat[1] = crc >> 8;
2218         dat[2] = crc >> 16;
2219         dat[3] = crc >> 24;
2220         for (i = 0; i < IEEE80211_WEP_CRCLEN; i++) {
2221                 x = (x + 1) % RC4STATE;
2222                 y = (state[x] + y) % RC4STATE;
2223                 RC4SWAP(x, y);
2224                 dat[i] ^= state[(state[x] + state[y]) % RC4STATE];
2225         }
2226 }
2227
2228 static void
2229 wi_start(ifp)
2230         struct ifnet            *ifp;
2231 {
2232         struct wi_softc         *sc;
2233         struct mbuf             *m0;
2234         struct wi_frame         tx_frame;
2235         struct ether_header     *eh;
2236         int                     id;
2237         int                     s;
2238
2239         sc = ifp->if_softc;
2240         WI_LOCK(sc, s);
2241
2242         if (sc->wi_gone) {
2243                 WI_UNLOCK(sc, s);
2244                 return;
2245         }
2246
2247         if (ifp->if_flags & IFF_OACTIVE) {
2248                 WI_UNLOCK(sc, s);
2249                 return;
2250         }
2251
2252 nextpkt:
2253         m0 = ifq_dequeue(&ifp->if_snd);
2254         if (m0 == NULL) {
2255                 WI_UNLOCK(sc, s);
2256                 return;
2257         }
2258
2259         bzero((char *)&tx_frame, sizeof(tx_frame));
2260         tx_frame.wi_frame_ctl = htole16(WI_FTYPE_DATA);
2261         id = sc->wi_tx_data_id;
2262         eh = mtod(m0, struct ether_header *);
2263
2264         if (sc->wi_ptype == WI_PORTTYPE_AP) {
2265                 if (!owihap_check_tx(&sc->wi_hostap_info,
2266                     eh->ether_dhost, &tx_frame.wi_tx_rate)) {
2267                         if (ifp->if_flags & IFF_DEBUG)
2268                                 printf("wi_start: dropping unassoc "
2269                                        "dst %6D\n", eh->ether_dhost, ":");
2270                         m_freem(m0);
2271                         goto nextpkt;
2272                 }
2273         }
2274         /*
2275          * Use RFC1042 encoding for IP and ARP datagrams,
2276          * 802.3 for anything else.
2277          */
2278         if (ntohs(eh->ether_type) > ETHER_MAX_LEN) {
2279                 bcopy((char *)&eh->ether_dhost,
2280                     (char *)&tx_frame.wi_addr1, ETHER_ADDR_LEN);
2281                 if (sc->wi_ptype == WI_PORTTYPE_AP) {
2282                         tx_frame.wi_tx_ctl = WI_ENC_TX_MGMT; /* XXX */
2283                         tx_frame.wi_frame_ctl |= WI_FCTL_FROMDS;
2284                         if (sc->wi_use_wep)
2285                                 tx_frame.wi_frame_ctl |= WI_FCTL_WEP;
2286                         bcopy((char *)&sc->arpcom.ac_enaddr,
2287                               (char *)&tx_frame.wi_addr2, ETHER_ADDR_LEN);
2288                         bcopy((char *)&eh->ether_shost,
2289                               (char *)&tx_frame.wi_addr3, ETHER_ADDR_LEN);
2290                 }
2291                 else
2292                         bcopy((char *)&eh->ether_shost,
2293                             (char *)&tx_frame.wi_addr2, ETHER_ADDR_LEN);
2294                 bcopy((char *)&eh->ether_dhost,
2295                     (char *)&tx_frame.wi_dst_addr, ETHER_ADDR_LEN);
2296                 bcopy((char *)&eh->ether_shost,
2297                     (char *)&tx_frame.wi_src_addr, ETHER_ADDR_LEN);
2298
2299                 tx_frame.wi_dat_len = m0->m_pkthdr.len - WI_SNAPHDR_LEN;
2300                 tx_frame.wi_dat[0] = htons(WI_SNAP_WORD0);
2301                 tx_frame.wi_dat[1] = htons(WI_SNAP_WORD1);
2302                 tx_frame.wi_len = htons(m0->m_pkthdr.len - WI_SNAPHDR_LEN);
2303                 tx_frame.wi_type = eh->ether_type;
2304
2305                 if (sc->wi_ptype == WI_PORTTYPE_AP && sc->wi_use_wep) {
2306                         /* Do host encryption. */
2307                         bcopy(&tx_frame.wi_dat[0], &sc->wi_txbuf[4], 8);
2308                         m_copydata(m0, sizeof(struct ether_header),
2309                             m0->m_pkthdr.len - sizeof(struct ether_header),
2310                             (caddr_t)&sc->wi_txbuf[12]);
2311                         wi_do_hostencrypt(sc, &sc->wi_txbuf[0],
2312                             tx_frame.wi_dat_len);
2313                         tx_frame.wi_dat_len += IEEE80211_WEP_IVLEN +
2314                             IEEE80211_WEP_KIDLEN + IEEE80211_WEP_CRCLEN;
2315                         wi_write_data(sc, id, 0, (caddr_t)&tx_frame,
2316                             sizeof(struct wi_frame));
2317                         wi_write_data(sc, id, WI_802_11_OFFSET_RAW,
2318                             (caddr_t)&sc->wi_txbuf, (m0->m_pkthdr.len -
2319                             sizeof(struct ether_header)) + 18);
2320                 } else {
2321                         m_copydata(m0, sizeof(struct ether_header),
2322                             m0->m_pkthdr.len - sizeof(struct ether_header),
2323                             (caddr_t)&sc->wi_txbuf);
2324                         wi_write_data(sc, id, 0, (caddr_t)&tx_frame,
2325                             sizeof(struct wi_frame));
2326                         wi_write_data(sc, id, WI_802_11_OFFSET,
2327                             (caddr_t)&sc->wi_txbuf, (m0->m_pkthdr.len -
2328                             sizeof(struct ether_header)) + 2);
2329                 }
2330         } else {
2331                 tx_frame.wi_dat_len = m0->m_pkthdr.len;
2332
2333                 if (sc->wi_ptype == WI_PORTTYPE_AP && sc->wi_use_wep) {
2334                         /* Do host encryption. */
2335                         printf( "XXX: host encrypt not implemented for 802.3\n" );
2336                 } else {
2337                         eh->ether_type = htons(m0->m_pkthdr.len -
2338                             WI_SNAPHDR_LEN);
2339                         m_copydata(m0, 0, m0->m_pkthdr.len,
2340                             (caddr_t)&sc->wi_txbuf);
2341
2342                         wi_write_data(sc, id, 0, (caddr_t)&tx_frame,
2343                             sizeof(struct wi_frame));
2344                         wi_write_data(sc, id, WI_802_3_OFFSET,
2345                             (caddr_t)&sc->wi_txbuf, m0->m_pkthdr.len + 2);
2346                 }
2347         }
2348
2349         /*
2350          * If there's a BPF listner, bounce a copy of
2351          * this frame to him. Also, don't send this to the bpf sniffer
2352          * if we're in procframe or monitor sniffing mode.
2353          */
2354         if (!(sc->wi_procframe || sc->wi_debug.wi_monitor))
2355                 BPF_MTAP(ifp, m0);
2356
2357         m_freem(m0);
2358
2359         if (wi_cmd(sc, WI_CMD_TX|WI_RECLAIM, id, 0, 0))
2360                 device_printf(sc->dev, "xmit failed\n");
2361
2362         ifp->if_flags |= IFF_OACTIVE;
2363
2364         /*
2365          * Set a timeout in case the chip goes out to lunch.
2366          */
2367         ifp->if_timer = 5;
2368
2369         WI_UNLOCK(sc, s);
2370         return;
2371 }
2372
2373 int
2374 owi_mgmt_xmit(sc, data, len)
2375         struct wi_softc         *sc;
2376         caddr_t                 data;
2377         int                     len;
2378 {
2379         struct wi_frame         tx_frame;
2380         int                     id;
2381         struct wi_80211_hdr     *hdr;
2382         caddr_t                 dptr;
2383
2384         if (sc->wi_gone)
2385                 return(ENODEV);
2386
2387         hdr = (struct wi_80211_hdr *)data;
2388         dptr = data + sizeof(struct wi_80211_hdr);
2389
2390         bzero((char *)&tx_frame, sizeof(tx_frame));
2391         id = sc->wi_tx_mgmt_id;
2392
2393         bcopy((char *)hdr, (char *)&tx_frame.wi_frame_ctl,
2394            sizeof(struct wi_80211_hdr));
2395
2396         tx_frame.wi_tx_ctl = WI_ENC_TX_MGMT;
2397         tx_frame.wi_dat_len = len - sizeof(struct wi_80211_hdr);
2398         tx_frame.wi_len = htons(tx_frame.wi_dat_len);
2399
2400         wi_write_data(sc, id, 0, (caddr_t)&tx_frame, sizeof(struct wi_frame));
2401         wi_write_data(sc, id, WI_802_11_OFFSET_RAW, dptr,
2402             len - sizeof(struct wi_80211_hdr) + 2);
2403
2404         if (wi_cmd(sc, WI_CMD_TX|WI_RECLAIM, id, 0, 0)) {
2405                 device_printf(sc->dev, "xmit failed\n");
2406                 return(EIO);
2407         }
2408
2409         return(0);
2410 }
2411
2412 static void
2413 wi_stop(sc)
2414         struct wi_softc         *sc;
2415 {
2416         struct ifnet            *ifp;
2417         int                     s;
2418
2419         WI_LOCK(sc, s);
2420
2421         if (sc->wi_gone) {
2422                 WI_UNLOCK(sc, s);
2423                 return;
2424         }
2425
2426         owihap_shutdown(sc);
2427
2428         ifp = &sc->arpcom.ac_if;
2429
2430         /*
2431          * If the card is gone and the memory port isn't mapped, we will
2432          * (hopefully) get 0xffff back from the status read, which is not
2433          * a valid status value.
2434          */
2435         if (CSR_READ_2(sc, WI_STATUS) != 0xffff) {
2436                 CSR_WRITE_2(sc, WI_INT_EN, 0);
2437                 wi_cmd(sc, WI_CMD_DISABLE|sc->wi_portnum, 0, 0, 0);
2438         }
2439
2440         callout_stop(&sc->wi_stat_timer);
2441
2442         ifp->if_flags &= ~(IFF_RUNNING|IFF_OACTIVE);
2443
2444         WI_UNLOCK(sc, s);
2445         return;
2446 }
2447
2448 static void
2449 wi_watchdog(ifp)
2450         struct ifnet            *ifp;
2451 {
2452         struct wi_softc         *sc;
2453
2454         sc = ifp->if_softc;
2455
2456         device_printf(sc->dev, "watchdog timeout\n");
2457
2458         wi_init(sc);
2459
2460         ifp->if_oerrors++;
2461
2462         return;
2463 }
2464
2465 int
2466 owi_alloc(dev, rid)
2467         device_t                dev;
2468         int                     rid;
2469 {
2470         struct wi_softc         *sc = device_get_softc(dev);
2471
2472         if (sc->wi_bus_type != WI_BUS_PCI_NATIVE) {
2473                 sc->iobase_rid = rid;
2474                 sc->iobase = bus_alloc_resource(dev, SYS_RES_IOPORT,
2475                     &sc->iobase_rid, 0, ~0, (1 << 6),
2476                     rman_make_alignment_flags(1 << 6) | RF_ACTIVE);
2477                 if (!sc->iobase) {
2478                         device_printf(dev, "No I/O space?!\n");
2479                         return (ENXIO);
2480                 }
2481
2482                 sc->wi_io_addr = rman_get_start(sc->iobase);
2483                 sc->wi_btag = rman_get_bustag(sc->iobase);
2484                 sc->wi_bhandle = rman_get_bushandle(sc->iobase);
2485         } else {
2486                 sc->mem_rid = rid;
2487                 sc->mem = bus_alloc_resource_any(dev, SYS_RES_MEMORY,
2488                     &sc->mem_rid, RF_ACTIVE);
2489
2490                 if (!sc->mem) {
2491                         device_printf(dev, "No Mem space on prism2.5?\n");
2492                         return (ENXIO);
2493                 }
2494
2495                 sc->wi_btag = rman_get_bustag(sc->mem);
2496                 sc->wi_bhandle = rman_get_bushandle(sc->mem);
2497         }
2498
2499
2500         sc->irq_rid = 0;
2501         sc->irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &sc->irq_rid,
2502             RF_ACTIVE |
2503             ((sc->wi_bus_type == WI_BUS_PCCARD) ? 0 : RF_SHAREABLE));
2504
2505         if (!sc->irq) {
2506                 owi_free(dev);
2507                 device_printf(dev, "No irq?!\n");
2508                 return (ENXIO);
2509         }
2510
2511         sc->dev = dev;
2512         sc->wi_unit = device_get_unit(dev);
2513
2514         return (0);
2515 }
2516
2517 void
2518 owi_free(dev)
2519         device_t                dev;
2520 {
2521         struct wi_softc         *sc = device_get_softc(dev);
2522
2523         if (sc->iobase != NULL) {
2524                 bus_release_resource(dev, SYS_RES_IOPORT, sc->iobase_rid, sc->iobase);
2525                 sc->iobase = NULL;
2526         }
2527         if (sc->irq != NULL) {
2528                 bus_release_resource(dev, SYS_RES_IRQ, sc->irq_rid, sc->irq);
2529                 sc->irq = NULL;
2530         }
2531         if (sc->mem != NULL) {
2532                 bus_release_resource(dev, SYS_RES_MEMORY, sc->mem_rid, sc->mem);
2533                 sc->mem = NULL;
2534         }
2535
2536         return;
2537 }
2538
2539 void
2540 owi_shutdown(dev)
2541         device_t                dev;
2542 {
2543         struct wi_softc         *sc;
2544
2545         sc = device_get_softc(dev);
2546         wi_stop(sc);
2547
2548         return;
2549 }
2550
2551 #ifdef WICACHE
2552 /* wavelan signal strength cache code.
2553  * store signal/noise/quality on per MAC src basis in
2554  * a small fixed cache.  The cache wraps if > MAX slots
2555  * used.  The cache may be zeroed out to start over.
2556  * Two simple filters exist to reduce computation:
2557  * 1. ip only (literally 0x800) which may be used
2558  * to ignore some packets.  It defaults to ip only.
2559  * it could be used to focus on broadcast, non-IP 802.11 beacons.
2560  * 2. multicast/broadcast only.  This may be used to
2561  * ignore unicast packets and only cache signal strength
2562  * for multicast/broadcast packets (beacons); e.g., Mobile-IP
2563  * beacons and not unicast traffic.
2564  *
2565  * The cache stores (MAC src(index), IP src (major clue), signal,
2566  *      quality, noise)
2567  *
2568  * No apologies for storing IP src here.  It's easy and saves much
2569  * trouble elsewhere.  The cache is assumed to be INET dependent, 
2570  * although it need not be.
2571  */
2572
2573 #ifdef documentation
2574
2575 int owi_sigitems;                                /* number of cached entries */
2576 struct wi_sigcache owi_sigcache[MAXWICACHE];  /*  array of cache entries */
2577 int owi_nextitem;                                /*  index/# of entries */
2578
2579
2580 #endif
2581
2582 /* control variables for cache filtering.  Basic idea is
2583  * to reduce cost (e.g., to only Mobile-IP agent beacons
2584  * which are broadcast or multicast).  Still you might
2585  * want to measure signal strength with unicast ping packets
2586  * on a pt. to pt. ant. setup.
2587  */
2588 /* set true if you want to limit cache items to broadcast/mcast 
2589  * only packets (not unicast).  Useful for mobile-ip beacons which
2590  * are broadcast/multicast at network layer.  Default is all packets
2591  * so ping/unicast will work say with pt. to pt. antennae setup.
2592  */
2593 static int wi_cache_mcastonly = 0;
2594 SYSCTL_INT(_machdep, OID_AUTO, owi_cache_mcastonly, CTLFLAG_RW, 
2595         &wi_cache_mcastonly, 0, "");
2596
2597 /* set true if you want to limit cache items to IP packets only
2598 */
2599 static int wi_cache_iponly = 1;
2600 SYSCTL_INT(_machdep, OID_AUTO, owi_cache_iponly, CTLFLAG_RW, 
2601         &wi_cache_iponly, 0, "");
2602
2603 /*
2604  * Original comments:
2605  * -----------------
2606  * wi_cache_store, per rx packet store signal
2607  * strength in MAC (src) indexed cache.
2608  *
2609  * follows linux driver in how signal strength is computed.
2610  * In ad hoc mode, we use the rx_quality field. 
2611  * signal and noise are trimmed to fit in the range from 47..138.
2612  * rx_quality field MSB is signal strength.
2613  * rx_quality field LSB is noise.
2614  * "quality" is (signal - noise) as is log value.
2615  * note: quality CAN be negative.
2616  * 
2617  * In BSS mode, we use the RID for communication quality.
2618  * TBD:  BSS mode is currently untested.
2619  *
2620  * Bill's comments:
2621  * ---------------
2622  * Actually, we use the rx_quality field all the time for both "ad-hoc"
2623  * and BSS modes. Why? Because reading an RID is really, really expensive:
2624  * there's a bunch of PIO operations that have to be done to read a record
2625  * from the NIC, and reading the comms quality RID each time a packet is
2626  * received can really hurt performance. We don't have to do this anyway:
2627  * the comms quality field only reflects the values in the rx_quality field
2628  * anyway. The comms quality RID is only meaningful in infrastructure mode,
2629  * but the values it contains are updated based on the rx_quality from
2630  * frames received from the access point.
2631  *
2632  * Also, according to Lucent, the signal strength and noise level values
2633  * can be converted to dBms by subtracting 149, so I've modified the code
2634  * to do that instead of the scaling it did originally.
2635  */
2636 static void
2637 wi_cache_store(struct wi_softc *sc, struct mbuf *m, unsigned short rx_quality)
2638 {
2639         struct ether_header *eh = mtod(m, struct ether_header *);
2640         struct ip *ip = NULL; 
2641         int i;
2642         static int cache_slot = 0;      /* use this cache entry */
2643         static int wrapindex = 0;       /* next "free" cache entry */
2644         int sig, noise;
2645
2646         /* 
2647          * filters:
2648          * 1. ip only
2649          * 2. configurable filter to throw out unicast packets,
2650          * keep multicast only.
2651          */
2652  
2653         if ((ntohs(eh->ether_type) == ETHERTYPE_IP))
2654                 ip = (struct ip *)(mtod(m, uint8_t *) + ETHER_HDR_LEN);
2655         else if (wi_cache_iponly)
2656                 return;
2657
2658         /*
2659          *  filter for broadcast/multicast only
2660          */
2661         if (wi_cache_mcastonly && ((eh->ether_dhost[0] & 1) == 0)) {
2662                 return;
2663         }
2664
2665 #ifdef SIGDEBUG
2666         printf("wi%d: q value %x (MSB=0x%x, LSB=0x%x) \n", sc->wi_unit,
2667             rx_quality & 0xffff, rx_quality >> 8, rx_quality & 0xff);
2668 #endif
2669
2670         
2671         /*
2672          * do a linear search for a matching MAC address 
2673          * in the cache table
2674          * . MAC address is 6 bytes,
2675          * . var w_nextitem holds total number of entries already cached
2676          */
2677         for(i = 0; i < sc->wi_nextitem; i++) {
2678                 if (! bcmp(eh->ether_shost , sc->wi_sigcache[i].macsrc,  6 )) {
2679                         /* 
2680                          * Match!,
2681                          * so we already have this entry,
2682                          * update the data
2683                          */
2684                         break;  
2685                 }
2686         }
2687
2688         /*
2689          *  did we find a matching mac address?
2690          * if yes, then overwrite a previously existing cache entry
2691          */
2692         if (i < sc->wi_nextitem )   {
2693                 cache_slot = i; 
2694         }
2695         /*
2696          * else, have a new address entry,so
2697          * add this new entry,
2698          * if table full, then we need to replace LRU entry
2699          */
2700         else    {                          
2701
2702                 /* 
2703                  * check for space in cache table 
2704                  * note: wi_nextitem also holds number of entries
2705                  * added in the cache table 
2706                  */
2707                 if ( sc->wi_nextitem < MAXWICACHE ) {
2708                         cache_slot = sc->wi_nextitem;
2709                         sc->wi_nextitem++;                 
2710                         sc->wi_sigitems = sc->wi_nextitem;
2711                 }
2712                 /* no space found, so simply wrap with wrap index
2713                  * and "zap" the next entry
2714                  */
2715                 else {
2716                         if (wrapindex == MAXWICACHE) {
2717                                 wrapindex = 0;
2718                         }
2719                         cache_slot = wrapindex++;
2720                 }
2721         }
2722
2723         /* 
2724          * invariant: cache_slot now points at some slot
2725          * in cache.
2726          */
2727         if (cache_slot < 0 || cache_slot >= MAXWICACHE) {
2728                 log(LOG_ERR, "wi_cache_store, bad index: %d of "
2729                     "[0..%d], gross cache error\n",
2730                     cache_slot, MAXWICACHE);
2731                 return;
2732         }
2733
2734         /*
2735          *  store items in cache
2736          *  .ip source address
2737          *  .mac src
2738          *  .signal, etc.
2739          */
2740         if (ip != NULL)
2741                 sc->wi_sigcache[cache_slot].ipsrc = ip->ip_src.s_addr;
2742         bcopy( eh->ether_shost, sc->wi_sigcache[cache_slot].macsrc,  6);
2743
2744         sig = (rx_quality >> 8) & 0xFF;
2745         noise = rx_quality & 0xFF;
2746         sc->wi_sigcache[cache_slot].signal = sig - 149;
2747         sc->wi_sigcache[cache_slot].noise = noise - 149;
2748         sc->wi_sigcache[cache_slot].quality = sig - noise;
2749
2750         return;
2751 }
2752 #endif
2753
2754 static int
2755 wi_get_cur_ssid(sc, ssid, len)
2756         struct wi_softc         *sc;
2757         char                    *ssid;
2758         int                     *len;
2759 {
2760         int                     error = 0;
2761         struct wi_req           wreq;
2762
2763         wreq.wi_len = WI_MAX_DATALEN;
2764         switch (sc->wi_ptype) {
2765         case WI_PORTTYPE_AP:
2766                 *len = IEEE80211_NWID_LEN;
2767                 bcopy(sc->wi_net_name, ssid, IEEE80211_NWID_LEN);
2768                 break;
2769         case WI_PORTTYPE_ADHOC:
2770                 wreq.wi_type = WI_RID_CURRENT_SSID;
2771                 error = wi_read_record(sc, (struct wi_ltv_gen *)&wreq);
2772                 if (error != 0)
2773                         break;
2774                 if (wreq.wi_val[0] > IEEE80211_NWID_LEN) {
2775                         error = EINVAL;
2776                         break;
2777                 }
2778                 *len = wreq.wi_val[0];
2779                 bcopy(&wreq.wi_val[1], ssid, IEEE80211_NWID_LEN);
2780                 break;
2781         case WI_PORTTYPE_BSS:
2782                 wreq.wi_type = WI_RID_COMMQUAL;
2783                 error = wi_read_record(sc, (struct wi_ltv_gen *)&wreq);
2784                 if (error != 0)
2785                         break;
2786                 if (wreq.wi_val[0] != 0) /* associated */ {
2787                         wreq.wi_type = WI_RID_CURRENT_SSID;
2788                         wreq.wi_len = WI_MAX_DATALEN;
2789                         error = wi_read_record(sc, (struct wi_ltv_gen *)&wreq);
2790                         if (error != 0)
2791                                 break;
2792                         if (wreq.wi_val[0] > IEEE80211_NWID_LEN) {
2793                                 error = EINVAL;
2794                                 break;
2795                         }
2796                         *len = wreq.wi_val[0];
2797                         bcopy(&wreq.wi_val[1], ssid, IEEE80211_NWID_LEN);
2798                 } else {
2799                         *len = IEEE80211_NWID_LEN;
2800                         bcopy(sc->wi_net_name, ssid, IEEE80211_NWID_LEN);
2801                 }
2802                 break;
2803         default:
2804                 error = EINVAL;
2805                 break;
2806         }
2807
2808         return error;
2809 }
2810
2811 static int
2812 wi_media_change(ifp)
2813         struct ifnet            *ifp;
2814 {
2815         struct wi_softc         *sc = ifp->if_softc;
2816         int                     otype = sc->wi_ptype;
2817         int                     orate = sc->wi_tx_rate;
2818         int                     ocreate_ibss = sc->wi_create_ibss;
2819
2820         if ((sc->ifmedia.ifm_cur->ifm_media & IFM_IEEE80211_HOSTAP) &&
2821             sc->sc_firmware_type != WI_INTERSIL)
2822                 return (EINVAL);
2823
2824         sc->wi_create_ibss = 0;
2825
2826         switch (sc->ifmedia.ifm_cur->ifm_media & IFM_OMASK) {
2827         case 0:
2828                 sc->wi_ptype = WI_PORTTYPE_BSS;
2829                 break;
2830         case IFM_IEEE80211_ADHOC:
2831                 sc->wi_ptype = WI_PORTTYPE_ADHOC;
2832                 break;
2833         case IFM_IEEE80211_HOSTAP:
2834                 sc->wi_ptype = WI_PORTTYPE_AP;
2835                 break;
2836         case IFM_IEEE80211_IBSSMASTER:
2837         case IFM_IEEE80211_IBSSMASTER|IFM_IEEE80211_IBSS:
2838                 if (!(sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS))
2839                         return (EINVAL);
2840                 sc->wi_create_ibss = 1;
2841                 /* FALLTHROUGH */
2842         case IFM_IEEE80211_IBSS:
2843                 sc->wi_ptype = WI_PORTTYPE_IBSS;
2844                 break;
2845         default:
2846                 /* Invalid combination. */
2847                 return (EINVAL);
2848         }
2849
2850         switch (IFM_SUBTYPE(sc->ifmedia.ifm_cur->ifm_media)) {
2851         case IFM_IEEE80211_DS1:
2852                 sc->wi_tx_rate = 1;
2853                 break;
2854         case IFM_IEEE80211_DS2:
2855                 sc->wi_tx_rate = 2;
2856                 break;
2857         case IFM_IEEE80211_DS5:
2858                 sc->wi_tx_rate = 5;
2859                 break;
2860         case IFM_IEEE80211_DS11:
2861                 sc->wi_tx_rate = 11;
2862                 break;
2863         case IFM_AUTO:
2864                 sc->wi_tx_rate = 3;
2865                 break;
2866         }
2867
2868         if (ocreate_ibss != sc->wi_create_ibss || otype != sc->wi_ptype ||
2869             orate != sc->wi_tx_rate)
2870                 wi_init(sc);
2871
2872         return(0);
2873 }
2874
2875 static void
2876 wi_media_status(ifp, imr)
2877         struct ifnet            *ifp;
2878         struct ifmediareq       *imr;
2879 {
2880         struct wi_req           wreq;
2881         struct wi_softc         *sc = ifp->if_softc;
2882
2883         if (sc->wi_tx_rate == 3) {
2884                 imr->ifm_active = IFM_IEEE80211|IFM_AUTO;
2885                 if (sc->wi_ptype == WI_PORTTYPE_ADHOC)
2886                         imr->ifm_active |= IFM_IEEE80211_ADHOC;
2887                 else if (sc->wi_ptype == WI_PORTTYPE_AP)
2888                         imr->ifm_active |= IFM_IEEE80211_HOSTAP;
2889                 else if (sc->wi_ptype == WI_PORTTYPE_IBSS) {
2890                         if (sc->wi_create_ibss)
2891                                 imr->ifm_active |= IFM_IEEE80211_IBSSMASTER;
2892                         else
2893                                 imr->ifm_active |= IFM_IEEE80211_IBSS;
2894                 }
2895                 wreq.wi_type = WI_RID_CUR_TX_RATE;
2896                 wreq.wi_len = WI_MAX_DATALEN;
2897                 if (wi_read_record(sc, (struct wi_ltv_gen *)&wreq) == 0) {
2898                         switch(wreq.wi_val[0]) {
2899                         case 1:
2900                                 imr->ifm_active |= IFM_IEEE80211_DS1;
2901                                 break;
2902                         case 2:
2903                                 imr->ifm_active |= IFM_IEEE80211_DS2;
2904                                 break;
2905                         case 6:
2906                                 imr->ifm_active |= IFM_IEEE80211_DS5;
2907                                 break;
2908                         case 11:
2909                                 imr->ifm_active |= IFM_IEEE80211_DS11;
2910                                 break;
2911                                 }
2912                 }
2913         } else {
2914                 imr->ifm_active = sc->ifmedia.ifm_cur->ifm_media;
2915         }
2916
2917         imr->ifm_status = IFM_AVALID;
2918         if (sc->wi_ptype == WI_PORTTYPE_ADHOC ||
2919             sc->wi_ptype == WI_PORTTYPE_IBSS)
2920                 /*
2921                  * XXX: It would be nice if we could give some actually
2922                  * useful status like whether we joined another IBSS or
2923                  * created one ourselves.
2924                  */
2925                 imr->ifm_status |= IFM_ACTIVE;
2926         else if (sc->wi_ptype == WI_PORTTYPE_AP)
2927                 imr->ifm_status |= IFM_ACTIVE;
2928         else {
2929                 wreq.wi_type = WI_RID_COMMQUAL;
2930                 wreq.wi_len = WI_MAX_DATALEN;
2931                 if (wi_read_record(sc, (struct wi_ltv_gen *)&wreq) == 0 &&
2932                     wreq.wi_val[0] != 0)
2933                         imr->ifm_status |= IFM_ACTIVE;
2934         }
2935 }
2936
2937 static int
2938 wi_get_debug(sc, wreq)
2939         struct wi_softc         *sc;
2940         struct wi_req           *wreq;
2941 {
2942         int                     error = 0;
2943
2944         wreq->wi_len = 1;
2945
2946         switch (wreq->wi_type) {
2947         case WI_DEBUG_SLEEP:
2948                 wreq->wi_len++;
2949                 wreq->wi_val[0] = sc->wi_debug.wi_sleep;
2950                 break;
2951         case WI_DEBUG_DELAYSUPP:
2952                 wreq->wi_len++;
2953                 wreq->wi_val[0] = sc->wi_debug.wi_delaysupp;
2954                 break;
2955         case WI_DEBUG_TXSUPP:
2956                 wreq->wi_len++;
2957                 wreq->wi_val[0] = sc->wi_debug.wi_txsupp;
2958                 break;
2959         case WI_DEBUG_MONITOR:
2960                 wreq->wi_len++;
2961                 wreq->wi_val[0] = sc->wi_debug.wi_monitor;
2962                 break;
2963         case WI_DEBUG_LEDTEST:
2964                 wreq->wi_len += 3;
2965                 wreq->wi_val[0] = sc->wi_debug.wi_ledtest;
2966                 wreq->wi_val[1] = sc->wi_debug.wi_ledtest_param0;
2967                 wreq->wi_val[2] = sc->wi_debug.wi_ledtest_param1;
2968                 break;
2969         case WI_DEBUG_CONTTX:
2970                 wreq->wi_len += 2;
2971                 wreq->wi_val[0] = sc->wi_debug.wi_conttx;
2972                 wreq->wi_val[1] = sc->wi_debug.wi_conttx_param0;
2973                 break;
2974         case WI_DEBUG_CONTRX:
2975                 wreq->wi_len++;
2976                 wreq->wi_val[0] = sc->wi_debug.wi_contrx;
2977                 break;
2978         case WI_DEBUG_SIGSTATE:
2979                 wreq->wi_len += 2;
2980                 wreq->wi_val[0] = sc->wi_debug.wi_sigstate;
2981                 wreq->wi_val[1] = sc->wi_debug.wi_sigstate_param0;
2982                 break;
2983         case WI_DEBUG_CONFBITS:
2984                 wreq->wi_len += 2;
2985                 wreq->wi_val[0] = sc->wi_debug.wi_confbits;
2986                 wreq->wi_val[1] = sc->wi_debug.wi_confbits_param0;
2987                 break;
2988         default:
2989                 error = EIO;
2990                 break;
2991         }
2992
2993         return (error);
2994 }
2995
2996 static int
2997 wi_set_debug(sc, wreq)
2998         struct wi_softc         *sc;
2999         struct wi_req           *wreq;
3000 {
3001         int                     error = 0;
3002         u_int16_t               cmd, param0 = 0, param1 = 0;
3003
3004         switch (wreq->wi_type) {
3005         case WI_DEBUG_RESET:
3006         case WI_DEBUG_INIT:
3007         case WI_DEBUG_CALENABLE:
3008                 break;
3009         case WI_DEBUG_SLEEP:
3010                 sc->wi_debug.wi_sleep = 1;
3011                 break;
3012         case WI_DEBUG_WAKE:
3013                 sc->wi_debug.wi_sleep = 0;
3014                 break;
3015         case WI_DEBUG_CHAN:
3016                 param0 = wreq->wi_val[0];
3017                 break;
3018         case WI_DEBUG_DELAYSUPP:
3019                 sc->wi_debug.wi_delaysupp = 1;
3020                 break;
3021         case WI_DEBUG_TXSUPP:
3022                 sc->wi_debug.wi_txsupp = 1;
3023                 break;
3024         case WI_DEBUG_MONITOR:
3025                 sc->wi_debug.wi_monitor = 1;
3026                 break;
3027         case WI_DEBUG_LEDTEST:
3028                 param0 = wreq->wi_val[0];
3029                 param1 = wreq->wi_val[1];
3030                 sc->wi_debug.wi_ledtest = 1;
3031                 sc->wi_debug.wi_ledtest_param0 = param0;
3032                 sc->wi_debug.wi_ledtest_param1 = param1;
3033                 break;
3034         case WI_DEBUG_CONTTX:
3035                 param0 = wreq->wi_val[0];
3036                 sc->wi_debug.wi_conttx = 1;
3037                 sc->wi_debug.wi_conttx_param0 = param0;
3038                 break;
3039         case WI_DEBUG_STOPTEST:
3040                 sc->wi_debug.wi_delaysupp = 0;
3041                 sc->wi_debug.wi_txsupp = 0;
3042                 sc->wi_debug.wi_monitor = 0;
3043                 sc->wi_debug.wi_ledtest = 0;
3044                 sc->wi_debug.wi_ledtest_param0 = 0;
3045                 sc->wi_debug.wi_ledtest_param1 = 0;
3046                 sc->wi_debug.wi_conttx = 0;
3047                 sc->wi_debug.wi_conttx_param0 = 0;
3048                 sc->wi_debug.wi_contrx = 0;
3049                 sc->wi_debug.wi_sigstate = 0;
3050                 sc->wi_debug.wi_sigstate_param0 = 0;
3051                 break;
3052         case WI_DEBUG_CONTRX:
3053                 sc->wi_debug.wi_contrx = 1;
3054                 break;
3055         case WI_DEBUG_SIGSTATE:
3056                 param0 = wreq->wi_val[0];
3057                 sc->wi_debug.wi_sigstate = 1;
3058                 sc->wi_debug.wi_sigstate_param0 = param0;
3059                 break;
3060         case WI_DEBUG_CONFBITS:
3061                 param0 = wreq->wi_val[0];
3062                 param1 = wreq->wi_val[1];
3063                 sc->wi_debug.wi_confbits = param0;
3064                 sc->wi_debug.wi_confbits_param0 = param1;
3065                 break;
3066         default:
3067                 error = EIO;
3068                 break;
3069         }
3070
3071         if (error)
3072                 return (error);
3073
3074         cmd = WI_CMD_DEBUG | (wreq->wi_type << 8);
3075         error = wi_cmd(sc, cmd, param0, param1, 0);
3076
3077         return (error);
3078 }