sys/dev/netif/wi/if_wi.c

   1 /*
   2  * Copyright (c) 1997, 1998, 1999
   3  *      Bill Paul <wpaul@ctr.columbia.edu>.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  * 3. All advertising materials mentioning features or use of this software
  14  *    must display the following acknowledgement:
  15  *      This product includes software developed by Bill Paul.
  16  * 4. Neither the name of the author nor the names of any co-contributors
  17  *    may be used to endorse or promote products derived from this software
  18  *    without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
  21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
  24  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  30  * THE POSSIBILITY OF SUCH DAMAGE.
  31  *
  32  * $FreeBSD: src/sys/dev/wi/if_wi.c,v 1.103.2.2 2002/08/02 07:11:34 imp Exp $
  33  * $DragonFly: src/sys/dev/netif/wi/if_wi.c,v 1.11 2004/06/02 14:42:56 eirikn Exp $
  34  */
  35
  36 /*
  37  * Lucent WaveLAN/IEEE 802.11 PCMCIA driver for FreeBSD.
  38  *
  39  * Written by Bill Paul <wpaul@ctr.columbia.edu>
  40  * Electrical Engineering Department
  41  * Columbia University, New York City
  42  */
  43
  44 /*
  45  * The WaveLAN/IEEE adapter is the second generation of the WaveLAN
  46  * from Lucent. Unlike the older cards, the new ones are programmed
  47  * entirely via a firmware-driven controller called the Hermes.
  48  * Unfortunately, Lucent will not release the Hermes programming manual
  49  * without an NDA (if at all). What they do release is an API library
  50  * called the HCF (Hardware Control Functions) which is supposed to
  51  * do the device-specific operations of a device driver for you. The
  52  * publically available version of the HCF library (the 'HCF Light') is
  53  * a) extremely gross, b) lacks certain features, particularly support
  54  * for 802.11 frames, and c) is contaminated by the GNU Public License.
  55  *
  56  * This driver does not use the HCF or HCF Light at all. Instead, it
  57  * programs the Hermes controller directly, using information gleaned
  58  * from the HCF Light code and corresponding documentation.
  59  *
  60  * This driver supports the ISA, PCMCIA and PCI versions of the Lucent
  61  * WaveLan cards (based on the Hermes chipset), as well as the newer
  62  * Prism 2 chipsets with firmware from Intersil and Symbol.
  63  */
  64
  65 #include <sys/param.h>
  66 #include <sys/systm.h>
  67 #if defined(__FreeBSD__) && __FreeBSD_version >= 500033
  68 #include <sys/endian.h>
  69 #endif
  70 #include <sys/sockio.h>
  71 #include <sys/mbuf.h>
  72 #include <sys/proc.h>
  73 #include <sys/kernel.h>
  74 #include <sys/socket.h>
  75 #include <sys/module.h>
  76 #include <sys/bus.h>
  77 #include <sys/random.h>
  78 #include <sys/syslog.h>
  79 #include <sys/sysctl.h>
  80
  81 #include <machine/bus.h>
  82 #include <machine/resource.h>
  83 #include <machine/clock.h>
  84 #include <sys/rman.h>
  85
  86 #include <net/if.h>
  87 #include <net/if_arp.h>
  88 #include <net/ethernet.h>
  89 #include <net/if_dl.h>
  90 #include <net/if_media.h>
  91 #include <net/if_types.h>
  92 #include <net/if_ieee80211.h>
  93
  94 #include <netinet/in.h>
  95 #include <netinet/in_systm.h>
  96 #include <netinet/in_var.h>
  97 #include <netinet/ip.h>
  98 #include <netinet/if_ether.h>
  99
 100 #include <net/bpf.h>
 101
 102 #include "if_wavelan_ieee.h"
 103 #include "wi_hostap.h"
 104 #include "if_wivar.h"
 105 #include "if_wireg.h"
 106
 107 static void wi_intr(void *);
 108 static void wi_reset(struct wi_softc *);
 109 static int wi_ioctl(struct ifnet *, u_long, caddr_t, struct ucred *);
 110 static void wi_init(void *);
 111 static void wi_start(struct ifnet *);
 112 static void wi_stop(struct wi_softc *);
 113 static void wi_watchdog(struct ifnet *);
 114 static void wi_rxeof(struct wi_softc *);
 115 static void wi_txeof(struct wi_softc *, int);
 116 static void wi_update_stats(struct wi_softc *);
 117 static void wi_setmulti(struct wi_softc *);
 118
 119 static int wi_cmd(struct wi_softc *, int, int, int, int);
 120 static int wi_read_record(struct wi_softc *, struct wi_ltv_gen *);
 121 static int wi_write_record(struct wi_softc *, struct wi_ltv_gen *);
 122 static int wi_read_data(struct wi_softc *, int, int, caddr_t, int);
 123 static int wi_write_data(struct wi_softc *, int, int, caddr_t, int);
 124 static int wi_seek(struct wi_softc *, int, int, int);
 125 static int wi_alloc_nicmem(struct wi_softc *, int, int *);
 126 static void wi_inquire(void *);
 127 static void wi_setdef(struct wi_softc *, struct wi_req *);
 128
 129 #ifdef WICACHE
 130 static
 131 void wi_cache_store(struct wi_softc *, struct ether_header *,
 132         struct mbuf *, unsigned short);
 133 #endif
 134
 135 static int wi_get_cur_ssid(struct wi_softc *, char *, int *);
 136 static void wi_get_id(struct wi_softc *);
 137 static int wi_media_change(struct ifnet *);
 138 static void wi_media_status(struct ifnet *, struct ifmediareq *);
 139
 140 static int wi_get_debug(struct wi_softc *, struct wi_req *);
 141 static int wi_set_debug(struct wi_softc *, struct wi_req *);
 142
 143 DECLARE_DUMMY_MODULE(if_wi);
 144
 145 devclass_t wi_devclass;
 146
 147 struct wi_card_ident wi_card_ident[] = {
 148         /* CARD_ID                      CARD_NAME               FIRM_TYPE */
 149         { WI_NIC_LUCENT_ID,             WI_NIC_LUCENT_STR,      WI_LUCENT },
 150         { WI_NIC_SONY_ID,               WI_NIC_SONY_STR,        WI_LUCENT },
 151         { WI_NIC_LUCENT_EMB_ID,         WI_NIC_LUCENT_EMB_STR,  WI_LUCENT },
 152         { WI_NIC_EVB2_ID,               WI_NIC_EVB2_STR,        WI_INTERSIL },
 153         { WI_NIC_HWB3763_ID,            WI_NIC_HWB3763_STR,     WI_INTERSIL },
 154         { WI_NIC_HWB3163_ID,            WI_NIC_HWB3163_STR,     WI_INTERSIL },
 155         { WI_NIC_HWB3163B_ID,           WI_NIC_HWB3163B_STR,    WI_INTERSIL },
 156         { WI_NIC_EVB3_ID,               WI_NIC_EVB3_STR,        WI_INTERSIL },
 157         { WI_NIC_HWB1153_ID,            WI_NIC_HWB1153_STR,     WI_INTERSIL },
 158         { WI_NIC_P2_SST_ID,             WI_NIC_P2_SST_STR,      WI_INTERSIL },
 159         { WI_NIC_EVB2_SST_ID,           WI_NIC_EVB2_SST_STR,    WI_INTERSIL },
 160         { WI_NIC_3842_EVA_ID,           WI_NIC_3842_EVA_STR,    WI_INTERSIL },
 161         { WI_NIC_3842_PCMCIA_AMD_ID,    WI_NIC_3842_PCMCIA_STR, WI_INTERSIL },
 162         { WI_NIC_3842_PCMCIA_SST_ID,    WI_NIC_3842_PCMCIA_STR, WI_INTERSIL },
 163         { WI_NIC_3842_PCMCIA_ATM_ID,    WI_NIC_3842_PCMCIA_STR, WI_INTERSIL },
 164         { WI_NIC_3842_MINI_AMD_ID,      WI_NIC_3842_MINI_STR,   WI_INTERSIL },
 165         { WI_NIC_3842_MINI_SST_ID,      WI_NIC_3842_MINI_STR,   WI_INTERSIL },
 166         { WI_NIC_3842_MINI_ATM_ID,      WI_NIC_3842_MINI_STR,   WI_INTERSIL },
 167         { WI_NIC_3842_PCI_AMD_ID,       WI_NIC_3842_PCI_STR,    WI_INTERSIL },
 168         { WI_NIC_3842_PCI_SST_ID,       WI_NIC_3842_PCI_STR,    WI_INTERSIL },
 169         { WI_NIC_3842_PCI_ATM_ID,       WI_NIC_3842_PCI_STR,    WI_INTERSIL },
 170         { WI_NIC_P3_PCMCIA_AMD_ID,      WI_NIC_P3_PCMCIA_STR,   WI_INTERSIL },
 171         { WI_NIC_P3_PCMCIA_SST_ID,      WI_NIC_P3_PCMCIA_STR,   WI_INTERSIL },
 172         { WI_NIC_P3_MINI_AMD_ID,        WI_NIC_P3_MINI_STR,     WI_INTERSIL },
 173         { WI_NIC_P3_MINI_SST_ID,        WI_NIC_P3_MINI_STR,     WI_INTERSIL },
 174         { 0,    NULL,   0 },
 175 };
 176
 177 int
 178 wi_generic_detach(dev)
 179         device_t                dev;
 180 {
 181         struct wi_softc         *sc;
 182         struct ifnet            *ifp;
 183         int                     s;
 184
 185         sc = device_get_softc(dev);
 186         WI_LOCK(sc, s);
 187         ifp = &sc->arpcom.ac_if;
 188
 189         if (sc->wi_gone) {
 190                 device_printf(dev, "already unloaded\n");
 191                 WI_UNLOCK(sc, s);
 192                 return(ENODEV);
 193         }
 194
 195         wi_stop(sc);
 196
 197         /* Delete all remaining media. */
 198         ifmedia_removeall(&sc->ifmedia);
 199
 200         ether_ifdetach(ifp);
 201         bus_teardown_intr(dev, sc->irq, sc->wi_intrhand);
 202         wi_free(dev);
 203         sc->wi_gone = 1;
 204
 205         WI_UNLOCK(sc, s);
 206 #if defined(__FreeBSD__) && __FreeBSD_version >= 500000
 207         mtx_destroy(&sc->wi_mtx);
 208 #endif
 209
 210         return(0);
 211 }
 212
 213 int
 214 wi_generic_attach(device_t dev)
 215 {
 216         struct wi_softc         *sc;
 217         struct wi_ltv_macaddr   mac;
 218         struct wi_ltv_gen       gen;
 219         struct ifnet            *ifp;
 220         int                     error;
 221         int                     s;
 222
 223         /* XXX maybe we need the splimp stuff here XXX */
 224         sc = device_get_softc(dev);
 225         ifp = &sc->arpcom.ac_if;
 226
 227         error = bus_setup_intr(dev, sc->irq, INTR_TYPE_NET,
 228             wi_intr, sc, &sc->wi_intrhand);
 229
 230         if (error) {
 231                 device_printf(dev, "bus_setup_intr() failed! (%d)\n", error);
 232                 wi_free(dev);
 233                 return (error);
 234         }
 235
 236 #if defined(__FreeBSD__) && __FreeBSD_version >= 500000
 237         mtx_init(&sc->wi_mtx, device_get_nameunit(dev), MTX_NETWORK_LOCK,
 238             MTX_DEF | MTX_RECURSE);
 239 #endif
 240         WI_LOCK(sc, s);
 241
 242         /* Reset the NIC. */
 243         wi_reset(sc);
 244
 245         /*
 246          * Read the station address.
 247          * And do it twice. I've seen PRISM-based cards that return
 248          * an error when trying to read it the first time, which causes
 249          * the probe to fail.
 250          */
 251         mac.wi_type = WI_RID_MAC_NODE;
 252         mac.wi_len = 4;
 253         wi_read_record(sc, (struct wi_ltv_gen *)&mac);
 254         if ((error = wi_read_record(sc, (struct wi_ltv_gen *)&mac)) != 0) {
 255                 device_printf(dev, "mac read failed %d\n", error);
 256                 wi_free(dev);
 257                 return (error);
 258         }
 259         bcopy((char *)&mac.wi_mac_addr,
 260            (char *)&sc->arpcom.ac_enaddr, ETHER_ADDR_LEN);
 261
 262         device_printf(dev, "802.11 address: %6D\n", sc->arpcom.ac_enaddr, ":");
 263
 264         wi_get_id(sc);
 265
 266         ifp->if_softc = sc;
 267         if_initname(ifp, "wi", sc->wi_unit);
 268         ifp->if_mtu = ETHERMTU;
 269         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
 270         ifp->if_ioctl = wi_ioctl;
 271         ifp->if_output = ether_output;
 272         ifp->if_start = wi_start;
 273         ifp->if_watchdog = wi_watchdog;
 274         ifp->if_init = wi_init;
 275         ifp->if_baudrate = 10000000;
 276         ifp->if_snd.ifq_maxlen = IFQ_MAXLEN;
 277
 278         bzero(sc->wi_node_name, sizeof(sc->wi_node_name));
 279         bcopy(WI_DEFAULT_NODENAME, sc->wi_node_name,
 280             sizeof(WI_DEFAULT_NODENAME) - 1);
 281
 282         bzero(sc->wi_net_name, sizeof(sc->wi_net_name));
 283         bcopy(WI_DEFAULT_NETNAME, sc->wi_net_name,
 284             sizeof(WI_DEFAULT_NETNAME) - 1);
 285
 286         bzero(sc->wi_ibss_name, sizeof(sc->wi_ibss_name));
 287         bcopy(WI_DEFAULT_IBSS, sc->wi_ibss_name,
 288             sizeof(WI_DEFAULT_IBSS) - 1);
 289
 290         sc->wi_portnum = WI_DEFAULT_PORT;
 291         sc->wi_ptype = WI_PORTTYPE_BSS;
 292         sc->wi_ap_density = WI_DEFAULT_AP_DENSITY;
 293         sc->wi_rts_thresh = WI_DEFAULT_RTS_THRESH;
 294         sc->wi_tx_rate = WI_DEFAULT_TX_RATE;
 295         sc->wi_max_data_len = WI_DEFAULT_DATALEN;
 296         sc->wi_create_ibss = WI_DEFAULT_CREATE_IBSS;
 297         sc->wi_pm_enabled = WI_DEFAULT_PM_ENABLED;
 298         sc->wi_max_sleep = WI_DEFAULT_MAX_SLEEP;
 299         sc->wi_roaming = WI_DEFAULT_ROAMING;
 300         sc->wi_authtype = WI_DEFAULT_AUTHTYPE;
 301         sc->wi_authmode = IEEE80211_AUTH_OPEN;
 302
 303         /*
 304          * Read the default channel from the NIC. This may vary
 305          * depending on the country where the NIC was purchased, so
 306          * we can't hard-code a default and expect it to work for
 307          * everyone.
 308          */
 309         gen.wi_type = WI_RID_OWN_CHNL;
 310         gen.wi_len = 2;
 311         wi_read_record(sc, &gen);
 312         sc->wi_channel = gen.wi_val;
 313
 314         /*
 315          * Set flags based on firmware version.
 316          */
 317         switch (sc->sc_firmware_type) {
 318         case WI_LUCENT:
 319                 sc->wi_flags |= WI_FLAGS_HAS_ROAMING;
 320                 if (sc->sc_sta_firmware_ver >= 60000)
 321                         sc->wi_flags |= WI_FLAGS_HAS_MOR;
 322                 if (sc->sc_sta_firmware_ver >= 60006) {
 323                         sc->wi_flags |= WI_FLAGS_HAS_IBSS;
 324                         sc->wi_flags |= WI_FLAGS_HAS_CREATE_IBSS;
 325                 }
 326                 sc->wi_ibss_port = htole16(1);
 327                 break;
 328         case WI_INTERSIL:
 329                 sc->wi_flags |= WI_FLAGS_HAS_ROAMING;
 330                 if (sc->sc_sta_firmware_ver >= 800) {
 331                         sc->wi_flags |= WI_FLAGS_HAS_IBSS;
 332                         sc->wi_flags |= WI_FLAGS_HAS_CREATE_IBSS;
 333                 }
 334                 /*
 335                  * version 0.8.3 and newer are the only ones that are known
 336                  * to currently work.  Earlier versions can be made to work,
 337                  * at least according to the Linux driver.
 338                  */
 339                 if (sc->sc_sta_firmware_ver >= 803)
 340                         sc->wi_flags |= WI_FLAGS_HAS_HOSTAP;
 341                 sc->wi_ibss_port = htole16(0);
 342                 break;
 343         case WI_SYMBOL:
 344                 sc->wi_flags |= WI_FLAGS_HAS_DIVERSITY;
 345                 if (sc->sc_sta_firmware_ver >= 20000)
 346                         sc->wi_flags |= WI_FLAGS_HAS_IBSS;
 347                 /* Older Symbol firmware does not support IBSS creation. */
 348                 if (sc->sc_sta_firmware_ver >= 25000)
 349                         sc->wi_flags |= WI_FLAGS_HAS_CREATE_IBSS;
 350                 sc->wi_ibss_port = htole16(4);
 351                 break;
 352         }
 353
 354         /*
 355          * Find out if we support WEP on this card.
 356          */
 357         gen.wi_type = WI_RID_WEP_AVAIL;
 358         gen.wi_len = 2;
 359         wi_read_record(sc, &gen);
 360         sc->wi_has_wep = gen.wi_val;
 361
 362         if (bootverbose)
 363                 device_printf(sc->dev, "wi_has_wep = %d\n", sc->wi_has_wep);
 364
 365         /*
 366          * Find supported rates.
 367          */
 368         gen.wi_type = WI_RID_DATA_RATES;
 369         gen.wi_len = 2;
 370         if (wi_read_record(sc, &gen))
 371                 sc->wi_supprates = WI_SUPPRATES_1M | WI_SUPPRATES_2M |
 372                     WI_SUPPRATES_5M | WI_SUPPRATES_11M;
 373         else
 374                 sc->wi_supprates = gen.wi_val;
 375
 376         bzero((char *)&sc->wi_stats, sizeof(sc->wi_stats));
 377
 378         wi_init(sc);
 379         wi_stop(sc);
 380
 381         ifmedia_init(&sc->ifmedia, 0, wi_media_change, wi_media_status);
 382 #define ADD(m, c)       ifmedia_add(&sc->ifmedia, (m), (c), NULL)
 383         if (sc->wi_supprates & WI_SUPPRATES_1M) {
 384                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1, 0, 0), 0);
 385                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1,
 386                     IFM_IEEE80211_ADHOC, 0), 0);
 387                 if (sc->wi_flags & WI_FLAGS_HAS_IBSS)
 388                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1,
 389                             IFM_IEEE80211_IBSS, 0), 0);
 390                 if (sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS)
 391                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1,
 392                             IFM_IEEE80211_IBSSMASTER, 0), 0);
 393                 if (sc->wi_flags & WI_FLAGS_HAS_HOSTAP)
 394                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1,
 395                             IFM_IEEE80211_HOSTAP, 0), 0);
 396         }
 397         if (sc->wi_supprates & WI_SUPPRATES_2M) {
 398                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2, 0, 0), 0);
 399                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2,
 400                     IFM_IEEE80211_ADHOC, 0), 0);
 401                 if (sc->wi_flags & WI_FLAGS_HAS_IBSS)
 402                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2,
 403                             IFM_IEEE80211_IBSS, 0), 0);
 404                 if (sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS)
 405                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2,
 406                             IFM_IEEE80211_IBSSMASTER, 0), 0);
 407                 if (sc->wi_flags & WI_FLAGS_HAS_HOSTAP)
 408                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2,
 409                             IFM_IEEE80211_HOSTAP, 0), 0);
 410         }
 411         if (sc->wi_supprates & WI_SUPPRATES_5M) {
 412                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5, 0, 0), 0);
 413                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5,
 414                     IFM_IEEE80211_ADHOC, 0), 0);
 415                 if (sc->wi_flags & WI_FLAGS_HAS_IBSS)
 416                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5,
 417                             IFM_IEEE80211_IBSS, 0), 0);
 418                 if (sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS)
 419                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5,
 420                             IFM_IEEE80211_IBSSMASTER, 0), 0);
 421                 if (sc->wi_flags & WI_FLAGS_HAS_HOSTAP)
 422                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5,
 423                             IFM_IEEE80211_HOSTAP, 0), 0);
 424         }
 425         if (sc->wi_supprates & WI_SUPPRATES_11M) {
 426                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11, 0, 0), 0);
 427                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11,
 428                     IFM_IEEE80211_ADHOC, 0), 0);
 429                 if (sc->wi_flags & WI_FLAGS_HAS_IBSS)
 430                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11,
 431                             IFM_IEEE80211_IBSS, 0), 0);
 432                 if (sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS)
 433                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11,
 434                             IFM_IEEE80211_IBSSMASTER, 0), 0);
 435                 if (sc->wi_flags & WI_FLAGS_HAS_HOSTAP)
 436                         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11,
 437                             IFM_IEEE80211_HOSTAP, 0), 0);
 438                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_MANUAL, 0, 0), 0);
 439         }
 440         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO, IFM_IEEE80211_ADHOC, 0), 0);
 441         if (sc->wi_flags & WI_FLAGS_HAS_IBSS)
 442                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO, IFM_IEEE80211_IBSS,
 443                     0), 0);
 444         if (sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS)
 445                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO,
 446                     IFM_IEEE80211_IBSSMASTER, 0), 0);
 447         if (sc->wi_flags & WI_FLAGS_HAS_HOSTAP)
 448                 ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO,
 449                     IFM_IEEE80211_HOSTAP, 0), 0);
 450         ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO, 0, 0), 0);
 451 #undef ADD
 452         ifmedia_set(&sc->ifmedia, IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO, 0, 0));
 453
 454         /*
 455          * Call MI attach routine.
 456          */
 457         ether_ifattach(ifp, sc->arpcom.ac_enaddr);
 458         callout_handle_init(&sc->wi_stat_ch);
 459         WI_UNLOCK(sc, s);
 460
 461         return(0);
 462 }
 463
 464 static void
 465 wi_get_id(sc)
 466         struct wi_softc *sc;
 467 {
 468         struct wi_ltv_ver       ver;
 469         struct wi_card_ident    *id;
 470
 471         /* getting chip identity */
 472         memset(&ver, 0, sizeof(ver));
 473         ver.wi_type = WI_RID_CARD_ID;
 474         ver.wi_len = 5;
 475         wi_read_record(sc, (struct wi_ltv_gen *)&ver);
 476         device_printf(sc->dev, "using ");
 477         sc->sc_firmware_type = WI_NOTYPE;
 478         for (id = wi_card_ident; id->card_name != NULL; id++) {
 479                 if (le16toh(ver.wi_ver[0]) == id->card_id) {
 480                         printf("%s", id->card_name);
 481                         sc->sc_firmware_type = id->firm_type;
 482                         break;
 483                 }
 484         }
 485         if (sc->sc_firmware_type == WI_NOTYPE) {
 486                 if (le16toh(ver.wi_ver[0]) & 0x8000) {
 487                         printf("Unknown PRISM2 chip");
 488                         sc->sc_firmware_type = WI_INTERSIL;
 489                 } else {
 490                         printf("Unknown Lucent chip");
 491                         sc->sc_firmware_type = WI_LUCENT;
 492                 }
 493         }
 494
 495         if (sc->sc_firmware_type != WI_LUCENT) {
 496                 /* get primary firmware version */
 497                 memset(&ver, 0, sizeof(ver));
 498                 ver.wi_type = WI_RID_PRI_IDENTITY;
 499                 ver.wi_len = 5;
 500                 wi_read_record(sc, (struct wi_ltv_gen *)&ver);
 501                 ver.wi_ver[1] = le16toh(ver.wi_ver[1]);
 502                 ver.wi_ver[2] = le16toh(ver.wi_ver[2]);
 503                 ver.wi_ver[3] = le16toh(ver.wi_ver[3]);
 504                 sc->sc_pri_firmware_ver = ver.wi_ver[2] * 10000 +
 505                     ver.wi_ver[3] * 100 + ver.wi_ver[1];
 506         }
 507
 508         /* get station firmware version */
 509         memset(&ver, 0, sizeof(ver));
 510         ver.wi_type = WI_RID_STA_IDENTITY;
 511         ver.wi_len = 5;
 512         wi_read_record(sc, (struct wi_ltv_gen *)&ver);
 513         ver.wi_ver[1] = le16toh(ver.wi_ver[1]);
 514         ver.wi_ver[2] = le16toh(ver.wi_ver[2]);
 515         ver.wi_ver[3] = le16toh(ver.wi_ver[3]);
 516         sc->sc_sta_firmware_ver = ver.wi_ver[2] * 10000 +
 517             ver.wi_ver[3] * 100 + ver.wi_ver[1];
 518         if (sc->sc_firmware_type == WI_INTERSIL &&
 519             (sc->sc_sta_firmware_ver == 10102 ||
 520              sc->sc_sta_firmware_ver == 20102)) {
 521                 struct wi_ltv_str sver;
 522                 char *p;
 523
 524                 memset(&sver, 0, sizeof(sver));
 525                 sver.wi_type = WI_RID_SYMBOL_IDENTITY;
 526                 sver.wi_len = 7;
 527                 /* value should be the format like "V2.00-11" */
 528                 if (wi_read_record(sc, (struct wi_ltv_gen *)&sver) == 0 &&
 529                     *(p = (char *)sver.wi_str) >= 'A' &&
 530                     p[2] == '.' && p[5] == '-' && p[8] == '\0') {
 531                         sc->sc_firmware_type = WI_SYMBOL;
 532                         sc->sc_sta_firmware_ver = (p[1] - '0') * 10000 +
 533                             (p[3] - '0') * 1000 + (p[4] - '0') * 100 +
 534                             (p[6] - '0') * 10 + (p[7] - '0');
 535                 }
 536         }
 537         printf("\n");
 538         device_printf(sc->dev, "%s Firmware: ",
 539              sc->sc_firmware_type == WI_LUCENT ? "Lucent" :
 540             (sc->sc_firmware_type == WI_SYMBOL ? "Symbol" : "Intersil"));
 541
 542         /*
 543          * The primary firmware is only valid on Prism based chipsets
 544          * (INTERSIL or SYMBOL).
 545          */
 546         if (sc->sc_firmware_type != WI_LUCENT)
 547             printf("Primary %u.%02u.%02u, ", sc->sc_pri_firmware_ver / 10000,
 548                     (sc->sc_pri_firmware_ver % 10000) / 100,
 549                     sc->sc_pri_firmware_ver % 100);
 550         printf("Station %u.%02u.%02u\n",
 551             sc->sc_sta_firmware_ver / 10000, (sc->sc_sta_firmware_ver % 10000) / 100,
 552             sc->sc_sta_firmware_ver % 100);
 553         return;
 554 }
 555
 556 static void
 557 wi_rxeof(sc)
 558         struct wi_softc         *sc;
 559 {
 560         struct ifnet            *ifp;
 561         struct ether_header     *eh;
 562         struct mbuf             *m;
 563         int                     id;
 564
 565         ifp = &sc->arpcom.ac_if;
 566
 567         id = CSR_READ_2(sc, WI_RX_FID);
 568
 569         /*
 570          * if we have the procframe flag set, disregard all this and just
 571          * read the data from the device.
 572          */
 573         if (sc->wi_procframe || sc->wi_debug.wi_monitor) {
 574                 struct wi_frame         *rx_frame;
 575                 int                     datlen, hdrlen;
 576
 577                 /* first allocate mbuf for packet storage */
 578                 MGETHDR(m, MB_DONTWAIT, MT_DATA);
 579                 if (m == NULL) {
 580                         ifp->if_ierrors++;
 581                         return;
 582                 }
 583                 MCLGET(m, MB_DONTWAIT);
 584                 if (!(m->m_flags & M_EXT)) {
 585                         m_freem(m);
 586                         ifp->if_ierrors++;
 587                         return;
 588                 }
 589
 590                 m->m_pkthdr.rcvif = ifp;
 591
 592                 /* now read wi_frame first so we know how much data to read */
 593                 if (wi_read_data(sc, id, 0, mtod(m, caddr_t),
 594                     sizeof(struct wi_frame))) {
 595                         m_freem(m);
 596                         ifp->if_ierrors++;
 597                         return;
 598                 }
 599
 600                 rx_frame = mtod(m, struct wi_frame *);
 601
 602                 switch ((rx_frame->wi_status & WI_STAT_MAC_PORT) >> 8) {
 603                 case 7:
 604                         switch (rx_frame->wi_frame_ctl & WI_FCTL_FTYPE) {
 605                         case WI_FTYPE_DATA:
 606                                 hdrlen = WI_DATA_HDRLEN;
 607                                 datlen = rx_frame->wi_dat_len + WI_FCS_LEN;
 608                                 break;
 609                         case WI_FTYPE_MGMT:
 610                                 hdrlen = WI_MGMT_HDRLEN;
 611                                 datlen = rx_frame->wi_dat_len + WI_FCS_LEN;
 612                                 break;
 613                         case WI_FTYPE_CTL:
 614                                 /*
 615                                  * prism2 cards don't pass control packets
 616                                  * down properly or consistently, so we'll only
 617                                  * pass down the header.
 618                                  */
 619                                 hdrlen = WI_CTL_HDRLEN;
 620                                 datlen = 0;
 621                                 break;
 622                         default:
 623                                 device_printf(sc->dev, "received packet of "
 624                                     "unknown type on port 7\n");
 625                                 m_freem(m);
 626                                 ifp->if_ierrors++;
 627                                 return;
 628                         }
 629                         break;
 630                 case 0:
 631                         hdrlen = WI_DATA_HDRLEN;
 632                         datlen = rx_frame->wi_dat_len + WI_FCS_LEN;
 633                         break;
 634                 default:
 635                         device_printf(sc->dev, "received packet on invalid "
 636                             "port (wi_status=0x%x)\n", rx_frame->wi_status);
 637                         m_freem(m);
 638                         ifp->if_ierrors++;
 639                         return;
 640                 }
 641
 642                 if ((hdrlen + datlen + 2) > MCLBYTES) {
 643                         device_printf(sc->dev, "oversized packet received "
 644                             "(wi_dat_len=%d, wi_status=0x%x)\n",
 645                             datlen, rx_frame->wi_status);
 646                         m_freem(m);
 647                         ifp->if_ierrors++;
 648                         return;
 649                 }
 650
 651                 if (wi_read_data(sc, id, hdrlen, mtod(m, caddr_t) + hdrlen,
 652                     datlen + 2)) {
 653                         m_freem(m);
 654                         ifp->if_ierrors++;
 655                         return;
 656                 }
 657
 658                 m->m_pkthdr.len = m->m_len = hdrlen + datlen;
 659
 660                 ifp->if_ipackets++;
 661
 662                 /* Handle BPF listeners. */
 663                 if (ifp->if_bpf)
 664                         bpf_mtap(ifp, m);
 665
 666                 m_freem(m);
 667         } else {
 668                 struct wi_frame         rx_frame;
 669
 670                 /* First read in the frame header */
 671                 if (wi_read_data(sc, id, 0, (caddr_t)&rx_frame,
 672                     sizeof(rx_frame))) {
 673                         ifp->if_ierrors++;
 674                         return;
 675                 }
 676
 677                 if (rx_frame.wi_status & WI_STAT_ERRSTAT) {
 678                         ifp->if_ierrors++;
 679                         return;
 680                 }
 681
 682                 MGETHDR(m, MB_DONTWAIT, MT_DATA);
 683                 if (m == NULL) {
 684                         ifp->if_ierrors++;
 685                         return;
 686                 }
 687                 MCLGET(m, MB_DONTWAIT);
 688                 if (!(m->m_flags & M_EXT)) {
 689                         m_freem(m);
 690                         ifp->if_ierrors++;
 691                         return;
 692                 }
 693
 694                 eh = mtod(m, struct ether_header *);
 695                 m->m_pkthdr.rcvif = ifp;
 696
 697                 if (rx_frame.wi_status == WI_STAT_MGMT &&
 698                     sc->wi_ptype == WI_PORTTYPE_AP) {
 699                         if ((WI_802_11_OFFSET_RAW + rx_frame.wi_dat_len + 2) >
 700                             MCLBYTES) {
 701                                 device_printf(sc->dev, "oversized mgmt packet "
 702                                     "received in hostap mode "
 703                                     "(wi_dat_len=%d, wi_status=0x%x)\n",
 704                                     rx_frame.wi_dat_len, rx_frame.wi_status);
 705                                 m_freem(m);
 706                                 ifp->if_ierrors++;
 707                                 return;
 708                         }
 709
 710                         /* Put the whole header in there. */
 711                         bcopy(&rx_frame, mtod(m, void *),
 712                             sizeof(struct wi_frame));
 713                         if (wi_read_data(sc, id, WI_802_11_OFFSET_RAW,
 714                             mtod(m, caddr_t) + WI_802_11_OFFSET_RAW,
 715                             rx_frame.wi_dat_len + 2)) {
 716                                 m_freem(m);
 717                                 ifp->if_ierrors++;
 718                                 return;
 719                         }
 720                         m->m_pkthdr.len = m->m_len =
 721                             WI_802_11_OFFSET_RAW + rx_frame.wi_dat_len;
 722                         /* XXX: consider giving packet to bhp? */
 723                         wihap_mgmt_input(sc, &rx_frame, m);
 724                         return;
 725                 }
 726
 727                 if (rx_frame.wi_status == WI_STAT_1042 ||
 728                     rx_frame.wi_status == WI_STAT_TUNNEL ||
 729                     rx_frame.wi_status == WI_STAT_WMP_MSG) {
 730                         if((rx_frame.wi_dat_len + WI_SNAPHDR_LEN) > MCLBYTES) {
 731                                 device_printf(sc->dev,
 732                                     "oversized packet received "
 733                                     "(wi_dat_len=%d, wi_status=0x%x)\n",
 734                                     rx_frame.wi_dat_len, rx_frame.wi_status);
 735                                 m_freem(m);
 736                                 ifp->if_ierrors++;
 737                                 return;
 738                         }
 739                         m->m_pkthdr.len = m->m_len =
 740                             rx_frame.wi_dat_len + WI_SNAPHDR_LEN;
 741
 742 #if 0
 743                         bcopy((char *)&rx_frame.wi_addr1,
 744                             (char *)&eh->ether_dhost, ETHER_ADDR_LEN);
 745                         if (sc->wi_ptype == WI_PORTTYPE_ADHOC) {
 746                                 bcopy((char *)&rx_frame.wi_addr2,
 747                                     (char *)&eh->ether_shost, ETHER_ADDR_LEN);
 748                         } else {
 749                                 bcopy((char *)&rx_frame.wi_addr3,
 750                                     (char *)&eh->ether_shost, ETHER_ADDR_LEN);
 751                         }
 752 #else
 753                         bcopy((char *)&rx_frame.wi_dst_addr,
 754                                 (char *)&eh->ether_dhost, ETHER_ADDR_LEN);
 755                         bcopy((char *)&rx_frame.wi_src_addr,
 756                                 (char *)&eh->ether_shost, ETHER_ADDR_LEN);
 757 #endif
 758
 759                         bcopy((char *)&rx_frame.wi_type,
 760                             (char *)&eh->ether_type, ETHER_TYPE_LEN);
 761
 762                         if (wi_read_data(sc, id, WI_802_11_OFFSET,
 763                             mtod(m, caddr_t) + sizeof(struct ether_header),
 764                             m->m_len + 2)) {
 765                                 m_freem(m);
 766                                 ifp->if_ierrors++;
 767                                 return;
 768                         }
 769                 } else {
 770                         if((rx_frame.wi_dat_len +
 771                             sizeof(struct ether_header)) > MCLBYTES) {
 772                                 device_printf(sc->dev,
 773                                     "oversized packet received "
 774                                     "(wi_dat_len=%d, wi_status=0x%x)\n",
 775                                     rx_frame.wi_dat_len, rx_frame.wi_status);
 776                                 m_freem(m);
 777                                 ifp->if_ierrors++;
 778                                 return;
 779                         }
 780                         m->m_pkthdr.len = m->m_len =
 781                             rx_frame.wi_dat_len + sizeof(struct ether_header);
 782
 783                         if (wi_read_data(sc, id, WI_802_3_OFFSET,
 784                             mtod(m, caddr_t), m->m_len + 2)) {
 785                                 m_freem(m);
 786                                 ifp->if_ierrors++;
 787                                 return;
 788                         }
 789                 }
 790
 791                 ifp->if_ipackets++;
 792
 793                 if (sc->wi_ptype == WI_PORTTYPE_AP) {
 794                         /*
 795                          * Give host AP code first crack at data
 796                          * packets.  If it decides to handle it (or
 797                          * drop it), it will return a non-zero.
 798                          * Otherwise, it is destined for this host.
 799                          */
 800                         if (wihap_data_input(sc, &rx_frame, m))
 801                                 return;
 802                 }
 803                 /* Receive packet. */
 804                 m_adj(m, sizeof(struct ether_header));
 805 #ifdef WICACHE
 806                 wi_cache_store(sc, eh, m, rx_frame.wi_q_info);
 807 #endif
 808                 ether_input(ifp, eh, m);
 809         }
 810 }
 811
 812 static void
 813 wi_txeof(sc, status)
 814         struct wi_softc         *sc;
 815         int                     status;
 816 {
 817         struct ifnet            *ifp;
 818
 819         ifp = &sc->arpcom.ac_if;
 820
 821         ifp->if_timer = 0;
 822         ifp->if_flags &= ~IFF_OACTIVE;
 823
 824         if (status & WI_EV_TX_EXC)
 825                 ifp->if_oerrors++;
 826         else
 827                 ifp->if_opackets++;
 828
 829         return;
 830 }
 831
 832 void
 833 wi_inquire(xsc)
 834         void                    *xsc;
 835 {
 836         struct wi_softc         *sc;
 837         struct ifnet            *ifp;
 838         int                     s;
 839
 840         sc = xsc;
 841         ifp = &sc->arpcom.ac_if;
 842
 843         sc->wi_stat_ch = timeout(wi_inquire, sc, hz * 60);
 844
 845         /* Don't do this while we're transmitting */
 846         if (ifp->if_flags & IFF_OACTIVE)
 847                 return;
 848
 849         WI_LOCK(sc, s);
 850         wi_cmd(sc, WI_CMD_INQUIRE, WI_INFO_COUNTERS, 0, 0);
 851         WI_UNLOCK(sc, s);
 852
 853         return;
 854 }
 855
 856 void
 857 wi_update_stats(sc)
 858         struct wi_softc         *sc;
 859 {
 860         struct wi_ltv_gen       gen;
 861         u_int16_t               id;
 862         struct ifnet            *ifp;
 863         u_int32_t               *ptr;
 864         int                     len, i;
 865         u_int16_t               t;
 866
 867         ifp = &sc->arpcom.ac_if;
 868
 869         id = CSR_READ_2(sc, WI_INFO_FID);
 870
 871         wi_read_data(sc, id, 0, (char *)&gen, 4);
 872
 873         /*
 874          * if we just got our scan results, copy it over into the scan buffer
 875          * so we can return it to anyone that asks for it. (add a little
 876          * compatibility with the prism2 scanning mechanism)
 877          */
 878         if (gen.wi_type == WI_INFO_SCAN_RESULTS)
 879         {
 880                 sc->wi_scanbuf_len = gen.wi_len;
 881                 wi_read_data(sc, id, 4, (char *)sc->wi_scanbuf,
 882                     sc->wi_scanbuf_len * 2);
 883
 884                 return;
 885         }
 886         else if (gen.wi_type != WI_INFO_COUNTERS)
 887                 return;
 888
 889         len = (gen.wi_len - 1 < sizeof(sc->wi_stats) / 4) ?
 890                 gen.wi_len - 1 : sizeof(sc->wi_stats) / 4;
 891         ptr = (u_int32_t *)&sc->wi_stats;
 892
 893         for (i = 0; i < len - 1; i++) {
 894                 t = CSR_READ_2(sc, WI_DATA1);
 895 #ifdef WI_HERMES_STATS_WAR
 896                 if (t > 0xF000)
 897                         t = ~t & 0xFFFF;
 898 #endif
 899                 ptr[i] += t;
 900         }
 901
 902         ifp->if_collisions = sc->wi_stats.wi_tx_single_retries +
 903             sc->wi_stats.wi_tx_multi_retries +
 904             sc->wi_stats.wi_tx_retry_limit;
 905
 906         return;
 907 }
 908
 909 static void
 910 wi_intr(xsc)
 911         void            *xsc;
 912 {
 913         struct wi_softc         *sc = xsc;
 914         struct ifnet            *ifp;
 915         u_int16_t               status;
 916         int                     s;
 917
 918         WI_LOCK(sc, s);
 919
 920         ifp = &sc->arpcom.ac_if;
 921
 922         if (sc->wi_gone || !(ifp->if_flags & IFF_UP)) {
 923                 CSR_WRITE_2(sc, WI_EVENT_ACK, 0xFFFF);
 924                 CSR_WRITE_2(sc, WI_INT_EN, 0);
 925                 WI_UNLOCK(sc, s);
 926                 return;
 927         }
 928
 929         /* Disable interrupts. */
 930         CSR_WRITE_2(sc, WI_INT_EN, 0);
 931
 932         status = CSR_READ_2(sc, WI_EVENT_STAT);
 933         CSR_WRITE_2(sc, WI_EVENT_ACK, ~WI_INTRS);
 934
 935         if (status & WI_EV_RX) {
 936                 wi_rxeof(sc);
 937                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_RX);
 938         }
 939
 940         if (status & WI_EV_TX) {
 941                 wi_txeof(sc, status);
 942                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_TX);
 943         }
 944
 945         if (status & WI_EV_ALLOC) {
 946                 int                     id;
 947
 948                 id = CSR_READ_2(sc, WI_ALLOC_FID);
 949                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_ALLOC);
 950                 if (id == sc->wi_tx_data_id)
 951                         wi_txeof(sc, status);
 952         }
 953
 954         if (status & WI_EV_INFO) {
 955                 wi_update_stats(sc);
 956                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_INFO);
 957         }
 958
 959         if (status & WI_EV_TX_EXC) {
 960                 wi_txeof(sc, status);
 961                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_TX_EXC);
 962         }
 963
 964         if (status & WI_EV_INFO_DROP) {
 965                 CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_INFO_DROP);
 966         }
 967
 968         /* Re-enable interrupts. */
 969         CSR_WRITE_2(sc, WI_INT_EN, WI_INTRS);
 970
 971         if (ifp->if_snd.ifq_head != NULL) {
 972                 wi_start(ifp);
 973         }
 974
 975         WI_UNLOCK(sc, s);
 976
 977         return;
 978 }
 979
 980 static int
 981 wi_cmd(sc, cmd, val0, val1, val2)
 982         struct wi_softc         *sc;
 983         int                     cmd;
 984         int                     val0;
 985         int                     val1;
 986         int                     val2;
 987 {
 988         int                     i, s = 0;
 989         static volatile int count  = 0;
 990
 991         if (count > 1)
 992                 panic("Hey partner, hold on there!");
 993         count++;
 994
 995         /* wait for the busy bit to clear */
 996         for (i = 500; i > 0; i--) {     /* 5s */
 997                 if (!(CSR_READ_2(sc, WI_COMMAND) & WI_CMD_BUSY)) {
 998                         break;
 999                 }
1000                 DELAY(10*1000); /* 10 m sec */
1001         }
1002         if (i == 0) {
1003                 device_printf(sc->dev, "wi_cmd: busy bit won't clear.\n" );
1004                 count--;
1005                 return(ETIMEDOUT);
1006         }
1007
1008         CSR_WRITE_2(sc, WI_PARAM0, val0);
1009         CSR_WRITE_2(sc, WI_PARAM1, val1);
1010         CSR_WRITE_2(sc, WI_PARAM2, val2);
1011         CSR_WRITE_2(sc, WI_COMMAND, cmd);
1012
1013         for (i = 0; i < WI_TIMEOUT; i++) {
1014                 /*
1015                  * Wait for 'command complete' bit to be
1016                  * set in the event status register.
1017                  */
1018                 s = CSR_READ_2(sc, WI_EVENT_STAT);
1019                 if (s & WI_EV_CMD) {
1020                         /* Ack the event and read result code. */
1021                         s = CSR_READ_2(sc, WI_STATUS);
1022                         CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_CMD);
1023 #ifdef foo
1024                         if ((s & WI_CMD_CODE_MASK) != (cmd & WI_CMD_CODE_MASK))
1025                                 return(EIO);
1026 #endif
1027                         if (s & WI_STAT_CMD_RESULT) {
1028                                 count--;
1029                                 return(EIO);
1030                         }
1031                         break;
1032                 }
1033                 DELAY(WI_DELAY);
1034         }
1035
1036         count--;
1037         if (i == WI_TIMEOUT) {
1038                 device_printf(sc->dev,
1039                     "timeout in wi_cmd 0x%04x; event status 0x%04x\n", cmd, s);
1040                 return(ETIMEDOUT);
1041         }
1042         return(0);
1043 }
1044
1045 static void
1046 wi_reset(sc)
1047         struct wi_softc         *sc;
1048 {
1049 #define WI_INIT_TRIES 3
1050         int i;
1051         int tries;
1052
1053         /* Symbol firmware cannot be initialized more than once */
1054         if (sc->sc_firmware_type == WI_SYMBOL && sc->sc_enabled)
1055                 return;
1056         if (sc->sc_firmware_type == WI_SYMBOL)
1057                 tries = 1;
1058         else
1059                 tries = WI_INIT_TRIES;
1060
1061         for (i = 0; i < tries; i++) {
1062                 if (wi_cmd(sc, WI_CMD_INI, 0, 0, 0) == 0)
1063                         break;
1064                 DELAY(WI_DELAY * 1000);
1065         }
1066         sc->sc_enabled = 1;
1067
1068         if (i == tries) {
1069                 device_printf(sc->dev, "init failed\n");
1070                 return;
1071         }
1072
1073         CSR_WRITE_2(sc, WI_INT_EN, 0);
1074         CSR_WRITE_2(sc, WI_EVENT_ACK, 0xFFFF);
1075
1076         /* Calibrate timer. */
1077         WI_SETVAL(WI_RID_TICK_TIME, 8);
1078
1079         return;
1080 }
1081
1082 /*
1083  * Read an LTV record from the NIC.
1084  */
1085 static int
1086 wi_read_record(sc, ltv)
1087         struct wi_softc         *sc;
1088         struct wi_ltv_gen       *ltv;
1089 {
1090         u_int16_t               *ptr;
1091         int                     i, len, code;
1092         struct wi_ltv_gen       *oltv, p2ltv;
1093
1094         oltv = ltv;
1095         if (sc->sc_firmware_type != WI_LUCENT) {
1096                 switch (ltv->wi_type) {
1097                 case WI_RID_ENCRYPTION:
1098                         p2ltv.wi_type = WI_RID_P2_ENCRYPTION;
1099                         p2ltv.wi_len = 2;
1100                         ltv = &p2ltv;
1101                         break;
1102                 case WI_RID_TX_CRYPT_KEY:
1103                         p2ltv.wi_type = WI_RID_P2_TX_CRYPT_KEY;
1104                         p2ltv.wi_len = 2;
1105                         ltv = &p2ltv;
1106                         break;
1107                 case WI_RID_ROAMING_MODE:
1108                         if (sc->sc_firmware_type == WI_INTERSIL)
1109                                 break;
1110                         /* not supported */
1111                         ltv->wi_len = 1;
1112                         return 0;
1113                 case WI_RID_MICROWAVE_OVEN:
1114                         /* not supported */
1115                         ltv->wi_len = 1;
1116                         return 0;
1117                 }
1118         }
1119
1120         /* Tell the NIC to enter record read mode. */
1121         if (wi_cmd(sc, WI_CMD_ACCESS|WI_ACCESS_READ, ltv->wi_type, 0, 0))
1122                 return(EIO);
1123
1124         /* Seek to the record. */
1125         if (wi_seek(sc, ltv->wi_type, 0, WI_BAP1))
1126                 return(EIO);
1127
1128         /*
1129          * Read the length and record type and make sure they
1130          * match what we expect (this verifies that we have enough
1131          * room to hold all of the returned data).
1132          */
1133         len = CSR_READ_2(sc, WI_DATA1);
1134         if (len > ltv->wi_len)
1135                 return(ENOSPC);
1136         code = CSR_READ_2(sc, WI_DATA1);
1137         if (code != ltv->wi_type)
1138                 return(EIO);
1139
1140         ltv->wi_len = len;
1141         ltv->wi_type = code;
1142
1143         /* Now read the data. */
1144         ptr = &ltv->wi_val;
1145         for (i = 0; i < ltv->wi_len - 1; i++)
1146                 ptr[i] = CSR_READ_2(sc, WI_DATA1);
1147
1148         if (ltv->wi_type == WI_RID_PORTTYPE && sc->wi_ptype == WI_PORTTYPE_IBSS
1149             && ltv->wi_val == sc->wi_ibss_port) {
1150                 /*
1151                  * Convert vendor IBSS port type to WI_PORTTYPE_IBSS.
1152                  * Since Lucent uses port type 1 for BSS *and* IBSS we
1153                  * have to rely on wi_ptype to distinguish this for us.
1154                  */
1155                 ltv->wi_val = htole16(WI_PORTTYPE_IBSS);
1156         } else if (sc->sc_firmware_type != WI_LUCENT) {
1157                 switch (oltv->wi_type) {
1158                 case WI_RID_TX_RATE:
1159                 case WI_RID_CUR_TX_RATE:
1160                         switch (ltv->wi_val) {
1161                         case 1: oltv->wi_val = 1; break;
1162                         case 2: oltv->wi_val = 2; break;
1163                         case 3: oltv->wi_val = 6; break;
1164                         case 4: oltv->wi_val = 5; break;
1165                         case 7: oltv->wi_val = 7; break;
1166                         case 8: oltv->wi_val = 11; break;
1167                         case 15: oltv->wi_val = 3; break;
1168                         default: oltv->wi_val = 0x100 + ltv->wi_val; break;
1169                         }
1170                         break;
1171                 case WI_RID_ENCRYPTION:
1172                         oltv->wi_len = 2;
1173                         if (ltv->wi_val & 0x01)
1174                                 oltv->wi_val = 1;
1175                         else
1176                                 oltv->wi_val = 0;
1177                         break;
1178                 case WI_RID_TX_CRYPT_KEY:
1179                         oltv->wi_len = 2;
1180                         oltv->wi_val = ltv->wi_val;
1181                         break;
1182                 case WI_RID_CNFAUTHMODE:
1183                         oltv->wi_len = 2;
1184                         if (le16toh(ltv->wi_val) & 0x01)
1185                                 oltv->wi_val = htole16(1);
1186                         else if (le16toh(ltv->wi_val) & 0x02)
1187                                 oltv->wi_val = htole16(2);
1188                         break;
1189                 }
1190         }
1191
1192         return(0);
1193 }
1194
1195 /*
1196  * Same as read, except we inject data instead of reading it.
1197  */
1198 static int
1199 wi_write_record(sc, ltv)
1200         struct wi_softc         *sc;
1201         struct wi_ltv_gen       *ltv;
1202 {
1203         u_int16_t               *ptr;
1204         int                     i;
1205         struct wi_ltv_gen       p2ltv;
1206
1207         if (ltv->wi_type == WI_RID_PORTTYPE &&
1208             le16toh(ltv->wi_val) == WI_PORTTYPE_IBSS) {
1209                 /* Convert WI_PORTTYPE_IBSS to vendor IBSS port type. */
1210                 p2ltv.wi_type = WI_RID_PORTTYPE;
1211                 p2ltv.wi_len = 2;
1212                 p2ltv.wi_val = sc->wi_ibss_port;
1213                 ltv = &p2ltv;
1214         } else if (sc->sc_firmware_type != WI_LUCENT) {
1215                 switch (ltv->wi_type) {
1216                 case WI_RID_TX_RATE:
1217                         p2ltv.wi_type = WI_RID_TX_RATE;
1218                         p2ltv.wi_len = 2;
1219                         switch (ltv->wi_val) {
1220                         case 1: p2ltv.wi_val = 1; break;
1221                         case 2: p2ltv.wi_val = 2; break;
1222                         case 3: p2ltv.wi_val = 15; break;
1223                         case 5: p2ltv.wi_val = 4; break;
1224                         case 6: p2ltv.wi_val = 3; break;
1225                         case 7: p2ltv.wi_val = 7; break;
1226                         case 11: p2ltv.wi_val = 8; break;
1227                         default: return EINVAL;
1228                         }
1229                         ltv = &p2ltv;
1230                         break;
1231                 case WI_RID_ENCRYPTION:
1232                         p2ltv.wi_type = WI_RID_P2_ENCRYPTION;
1233                         p2ltv.wi_len = 2;
1234                         if (le16toh(ltv->wi_val)) {
1235                                 p2ltv.wi_val =htole16(PRIVACY_INVOKED |
1236                                     EXCLUDE_UNENCRYPTED);
1237                                 if (sc->wi_ptype == WI_PORTTYPE_AP)
1238                                         /*
1239                                          * Disable tx encryption...
1240                                          * it's broken.
1241                                          */
1242                                         p2ltv.wi_val |= htole16(HOST_ENCRYPT);
1243                         } else
1244                                 p2ltv.wi_val =
1245                                     htole16(HOST_ENCRYPT | HOST_DECRYPT);
1246                         ltv = &p2ltv;
1247                         break;
1248                 case WI_RID_TX_CRYPT_KEY:
1249                         p2ltv.wi_type = WI_RID_P2_TX_CRYPT_KEY;
1250                         p2ltv.wi_len = 2;
1251                         p2ltv.wi_val = ltv->wi_val;
1252                         ltv = &p2ltv;
1253                         break;
1254                 case WI_RID_DEFLT_CRYPT_KEYS:
1255                     {
1256                         int error;
1257                         int keylen;
1258                         struct wi_ltv_str       ws;
1259                         struct wi_ltv_keys      *wk =
1260                             (struct wi_ltv_keys *)ltv;
1261
1262                         keylen = wk->wi_keys[sc->wi_tx_key].wi_keylen;
1263
1264                         for (i = 0; i < 4; i++) {
1265                                 bzero(&ws, sizeof(ws));
1266                                 ws.wi_len = (keylen > 5) ? 8 : 4;
1267                                 ws.wi_type = WI_RID_P2_CRYPT_KEY0 + i;
1268                                 memcpy(ws.wi_str,
1269                                     &wk->wi_keys[i].wi_keydat, keylen);
1270                                 error = wi_write_record(sc,
1271                                     (struct wi_ltv_gen *)&ws);
1272                                 if (error)
1273                                         return error;
1274                         }
1275                         return 0;
1276                     }
1277                 case WI_RID_CNFAUTHMODE:
1278                         p2ltv.wi_type = WI_RID_CNFAUTHMODE;
1279                         p2ltv.wi_len = 2;
1280                         if (le16toh(ltv->wi_val) == 1)
1281                                 p2ltv.wi_val = htole16(0x01);
1282                         else if (le16toh(ltv->wi_val) == 2)
1283                                 p2ltv.wi_val = htole16(0x02);
1284                         ltv = &p2ltv;
1285                         break;
1286                 case WI_RID_ROAMING_MODE:
1287                         if (sc->sc_firmware_type == WI_INTERSIL)
1288                                 break;
1289                         /* not supported */
1290                         return 0;
1291                 case WI_RID_MICROWAVE_OVEN:
1292                         /* not supported */
1293                         return 0;
1294                 }
1295         } else {
1296                 /* LUCENT */
1297                 switch (ltv->wi_type) {
1298                 case WI_RID_TX_RATE:
1299                         switch (ltv->wi_val) {
1300                         case 1: ltv->wi_val = 1; break;  /* 1Mb/s fixed */
1301                         case 2: ltv->wi_val = 2; break;  /* 2Mb/s fixed */
1302                         case 3: ltv->wi_val = 3; break;  /* 11Mb/s auto */
1303                         case 5: ltv->wi_val = 4; break;  /* 5.5Mb/s fixed */
1304                         case 6: ltv->wi_val = 6; break;  /* 2Mb/s auto */
1305                         case 7: ltv->wi_val = 7; break;  /* 5.5Mb/s auto */
1306                         case 11: ltv->wi_val = 5; break; /* 11Mb/s fixed */
1307                         default: return EINVAL;
1308                         }
1309                 }
1310         }
1311
1312         if (wi_seek(sc, ltv->wi_type, 0, WI_BAP1))
1313                 return(EIO);
1314
1315         CSR_WRITE_2(sc, WI_DATA1, ltv->wi_len);
1316         CSR_WRITE_2(sc, WI_DATA1, ltv->wi_type);
1317
1318         ptr = &ltv->wi_val;
1319         for (i = 0; i < ltv->wi_len - 1; i++)
1320                 CSR_WRITE_2(sc, WI_DATA1, ptr[i]);
1321
1322         if (wi_cmd(sc, WI_CMD_ACCESS|WI_ACCESS_WRITE, ltv->wi_type, 0, 0))
1323                 return(EIO);
1324
1325         return(0);
1326 }
1327
1328 static int
1329 wi_seek(sc, id, off, chan)
1330         struct wi_softc         *sc;
1331         int                     id, off, chan;
1332 {
1333         int                     i;
1334         int                     selreg, offreg;
1335         int                     status;
1336
1337         switch (chan) {
1338         case WI_BAP0:
1339                 selreg = WI_SEL0;
1340                 offreg = WI_OFF0;
1341                 break;
1342         case WI_BAP1:
1343                 selreg = WI_SEL1;
1344                 offreg = WI_OFF1;
1345                 break;
1346         default:
1347                 device_printf(sc->dev, "invalid data path: %x\n", chan);
1348                 return(EIO);
1349         }
1350
1351         CSR_WRITE_2(sc, selreg, id);
1352         CSR_WRITE_2(sc, offreg, off);
1353
1354         for (i = 0; i < WI_TIMEOUT; i++) {
1355                 status = CSR_READ_2(sc, offreg);
1356                 if (!(status & (WI_OFF_BUSY|WI_OFF_ERR)))
1357                         break;
1358                 DELAY(WI_DELAY);
1359         }
1360
1361         if (i == WI_TIMEOUT) {
1362                 device_printf(sc->dev, "timeout in wi_seek to %x/%x; last status %x\n",
1363                         id, off, status);
1364                 return(ETIMEDOUT);
1365         }
1366
1367         return(0);
1368 }
1369
1370 static int
1371 wi_read_data(sc, id, off, buf, len)
1372         struct wi_softc         *sc;
1373         int                     id, off;
1374         caddr_t                 buf;
1375         int                     len;
1376 {
1377         int                     i;
1378         u_int16_t               *ptr;
1379
1380         if (wi_seek(sc, id, off, WI_BAP1))
1381                 return(EIO);
1382
1383         ptr = (u_int16_t *)buf;
1384         for (i = 0; i < len / 2; i++)
1385                 ptr[i] = CSR_READ_2(sc, WI_DATA1);
1386
1387         return(0);
1388 }
1389
1390 /*
1391  * According to the comments in the HCF Light code, there is a bug in
1392  * the Hermes (or possibly in certain Hermes firmware revisions) where
1393  * the chip's internal autoincrement counter gets thrown off during
1394  * data writes: the autoincrement is missed, causing one data word to
1395  * be overwritten and subsequent words to be written to the wrong memory
1396  * locations. The end result is that we could end up transmitting bogus
1397  * frames without realizing it. The workaround for this is to write a
1398  * couple of extra guard words after the end of the transfer, then
1399  * attempt to read then back. If we fail to locate the guard words where
1400  * we expect them, we preform the transfer over again.
1401  */
1402 static int
1403 wi_write_data(sc, id, off, buf, len)
1404         struct wi_softc         *sc;
1405         int                     id, off;
1406         caddr_t                 buf;
1407         int                     len;
1408 {
1409         int                     i;
1410         u_int16_t               *ptr;
1411 #ifdef WI_HERMES_AUTOINC_WAR
1412         int                     retries;
1413
1414         retries = 512;
1415 again:
1416 #endif
1417
1418         if (wi_seek(sc, id, off, WI_BAP0))
1419                 return(EIO);
1420
1421         ptr = (u_int16_t *)buf;
1422         for (i = 0; i < (len / 2); i++)
1423                 CSR_WRITE_2(sc, WI_DATA0, ptr[i]);
1424
1425 #ifdef WI_HERMES_AUTOINC_WAR
1426         CSR_WRITE_2(sc, WI_DATA0, 0x1234);
1427         CSR_WRITE_2(sc, WI_DATA0, 0x5678);
1428
1429         if (wi_seek(sc, id, off + len, WI_BAP0))
1430                 return(EIO);
1431
1432         if (CSR_READ_2(sc, WI_DATA0) != 0x1234 ||
1433             CSR_READ_2(sc, WI_DATA0) != 0x5678) {
1434                 if (--retries >= 0)
1435                         goto again;
1436                 device_printf(sc->dev, "wi_write_data device timeout\n");
1437                 return (EIO);
1438         }
1439 #endif
1440
1441         return(0);
1442 }
1443
1444 /*
1445  * Allocate a region of memory inside the NIC and zero
1446  * it out.
1447  */
1448 static int
1449 wi_alloc_nicmem(sc, len, id)
1450         struct wi_softc         *sc;
1451         int                     len;
1452         int                     *id;
1453 {
1454         int                     i;
1455
1456         if (wi_cmd(sc, WI_CMD_ALLOC_MEM, len, 0, 0)) {
1457                 device_printf(sc->dev,
1458                     "failed to allocate %d bytes on NIC\n", len);
1459                 return(ENOMEM);
1460         }
1461
1462         for (i = 0; i < WI_TIMEOUT; i++) {
1463                 if (CSR_READ_2(sc, WI_EVENT_STAT) & WI_EV_ALLOC)
1464                         break;
1465                 DELAY(WI_DELAY);
1466         }
1467
1468         if (i == WI_TIMEOUT) {
1469                 device_printf(sc->dev, "time out allocating memory on card\n");
1470                 return(ETIMEDOUT);
1471         }
1472
1473         CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_ALLOC);
1474         *id = CSR_READ_2(sc, WI_ALLOC_FID);
1475
1476         if (wi_seek(sc, *id, 0, WI_BAP0)) {
1477                 device_printf(sc->dev, "seek failed while allocating memory on card\n");
1478                 return(EIO);
1479         }
1480
1481         for (i = 0; i < len / 2; i++)
1482                 CSR_WRITE_2(sc, WI_DATA0, 0);
1483
1484         return(0);
1485 }
1486
1487 static void
1488 wi_setmulti(sc)
1489         struct wi_softc         *sc;
1490 {
1491         struct ifnet            *ifp;
1492         int                     i = 0;
1493         struct ifmultiaddr      *ifma;
1494         struct wi_ltv_mcast     mcast;
1495
1496         ifp = &sc->arpcom.ac_if;
1497
1498         bzero((char *)&mcast, sizeof(mcast));
1499
1500         mcast.wi_type = WI_RID_MCAST_LIST;
1501         mcast.wi_len = (3 * 16) + 1;
1502
1503         if (ifp->if_flags & IFF_ALLMULTI || ifp->if_flags & IFF_PROMISC) {
1504                 wi_write_record(sc, (struct wi_ltv_gen *)&mcast);
1505                 return;
1506         }
1507
1508 #if defined(__DragonFly__) || __FreeBSD_version < 500000
1509         LIST_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
1510 #else
1511         TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
1512 #endif
1513                 if (ifma->ifma_addr->sa_family != AF_LINK)
1514                         continue;
1515                 if (i < 16) {
1516                         bcopy(LLADDR((struct sockaddr_dl *)ifma->ifma_addr),
1517                             (char *)&mcast.wi_mcast[i], ETHER_ADDR_LEN);
1518                         i++;
1519                 } else {
1520                         bzero((char *)&mcast, sizeof(mcast));
1521                         break;
1522                 }
1523         }
1524
1525         mcast.wi_len = (i * 3) + 1;
1526         wi_write_record(sc, (struct wi_ltv_gen *)&mcast);
1527
1528         return;
1529 }
1530
1531 static void
1532 wi_setdef(sc, wreq)
1533         struct wi_softc         *sc;
1534         struct wi_req           *wreq;
1535 {
1536         struct sockaddr_dl      *sdl;
1537         struct ifaddr           *ifa;
1538         struct ifnet            *ifp;
1539
1540         ifp = &sc->arpcom.ac_if;
1541
1542         switch(wreq->wi_type) {
1543         case WI_RID_MAC_NODE:
1544                 ifa = ifaddr_byindex(ifp->if_index);
1545                 sdl = (struct sockaddr_dl *)ifa->ifa_addr;
1546                 bcopy((char *)&wreq->wi_val, (char *)&sc->arpcom.ac_enaddr,
1547                    ETHER_ADDR_LEN);
1548                 bcopy((char *)&wreq->wi_val, LLADDR(sdl), ETHER_ADDR_LEN);
1549                 break;
1550         case WI_RID_PORTTYPE:
1551                 sc->wi_ptype = le16toh(wreq->wi_val[0]);
1552                 break;
1553         case WI_RID_TX_RATE:
1554                 sc->wi_tx_rate = le16toh(wreq->wi_val[0]);
1555                 break;
1556         case WI_RID_MAX_DATALEN:
1557                 sc->wi_max_data_len = le16toh(wreq->wi_val[0]);
1558                 break;
1559         case WI_RID_RTS_THRESH:
1560                 sc->wi_rts_thresh = le16toh(wreq->wi_val[0]);
1561                 break;
1562         case WI_RID_SYSTEM_SCALE:
1563                 sc->wi_ap_density = le16toh(wreq->wi_val[0]);
1564                 break;
1565         case WI_RID_CREATE_IBSS:
1566                 sc->wi_create_ibss = le16toh(wreq->wi_val[0]);
1567                 break;
1568         case WI_RID_OWN_CHNL:
1569                 sc->wi_channel = le16toh(wreq->wi_val[0]);
1570                 break;
1571         case WI_RID_NODENAME:
1572                 bzero(sc->wi_node_name, sizeof(sc->wi_node_name));
1573                 bcopy((char *)&wreq->wi_val[1], sc->wi_node_name, 30);
1574                 break;
1575         case WI_RID_DESIRED_SSID:
1576                 bzero(sc->wi_net_name, sizeof(sc->wi_net_name));
1577                 bcopy((char *)&wreq->wi_val[1], sc->wi_net_name, 30);
1578                 break;
1579         case WI_RID_OWN_SSID:
1580                 bzero(sc->wi_ibss_name, sizeof(sc->wi_ibss_name));
1581                 bcopy((char *)&wreq->wi_val[1], sc->wi_ibss_name, 30);
1582                 break;
1583         case WI_RID_PM_ENABLED:
1584                 sc->wi_pm_enabled = le16toh(wreq->wi_val[0]);
1585                 break;
1586         case WI_RID_MICROWAVE_OVEN:
1587                 sc->wi_mor_enabled = le16toh(wreq->wi_val[0]);
1588                 break;
1589         case WI_RID_MAX_SLEEP:
1590                 sc->wi_max_sleep = le16toh(wreq->wi_val[0]);
1591                 break;
1592         case WI_RID_CNFAUTHMODE:
1593                 sc->wi_authtype = le16toh(wreq->wi_val[0]);
1594                 break;
1595         case WI_RID_ROAMING_MODE:
1596                 sc->wi_roaming = le16toh(wreq->wi_val[0]);
1597                 break;
1598         case WI_RID_ENCRYPTION:
1599                 sc->wi_use_wep = le16toh(wreq->wi_val[0]);
1600                 break;
1601         case WI_RID_TX_CRYPT_KEY:
1602                 sc->wi_tx_key = le16toh(wreq->wi_val[0]);
1603                 break;
1604         case WI_RID_DEFLT_CRYPT_KEYS:
1605                 bcopy((char *)wreq, (char *)&sc->wi_keys,
1606                     sizeof(struct wi_ltv_keys));
1607                 break;
1608         default:
1609                 break;
1610         }
1611
1612         /* Reinitialize WaveLAN. */
1613         wi_init(sc);
1614
1615         return;
1616 }
1617
1618 static int
1619 wi_ioctl(ifp, command, data, cr)
1620         struct ifnet            *ifp;
1621         u_long                  command;
1622         caddr_t                 data;
1623         struct ucred            *cr;
1624 {
1625         int                     error = 0;
1626         int                     len;
1627         u_int8_t                tmpkey[14];
1628         char                    tmpssid[IEEE80211_NWID_LEN];
1629         struct wi_softc         *sc;
1630         struct wi_req           wreq;
1631         struct ifreq            *ifr;
1632         struct ieee80211req     *ireq;
1633         int                     s;
1634
1635         sc = ifp->if_softc;
1636         WI_LOCK(sc, s);
1637         ifr = (struct ifreq *)data;
1638         ireq = (struct ieee80211req *)data;
1639
1640         if (sc->wi_gone) {
1641                 error = ENODEV;
1642                 goto out;
1643         }
1644
1645         switch(command) {
1646         case SIOCSIFADDR:
1647         case SIOCGIFADDR:
1648         case SIOCSIFMTU:
1649                 error = ether_ioctl(ifp, command, data);
1650                 break;
1651         case SIOCSIFFLAGS:
1652                 /*
1653                  * Can't do promisc and hostap at the same time.  If all that's
1654                  * changing is the promisc flag, try to short-circuit a call to
1655                  * wi_init() by just setting PROMISC in the hardware.
1656                  */
1657                 if (ifp->if_flags & IFF_UP) {
1658                         if (sc->wi_ptype != WI_PORTTYPE_AP &&
1659                             ifp->if_flags & IFF_RUNNING) {
1660                                 if (ifp->if_flags & IFF_PROMISC &&
1661                                     !(sc->wi_if_flags & IFF_PROMISC)) {
1662                                         WI_SETVAL(WI_RID_PROMISC, 1);
1663                                 } else if (!(ifp->if_flags & IFF_PROMISC) &&
1664                                     sc->wi_if_flags & IFF_PROMISC) {
1665                                         WI_SETVAL(WI_RID_PROMISC, 0);
1666                                 } else {
1667                                         wi_init(sc);
1668                                 }
1669                         } else {
1670                                 wi_init(sc);
1671                         }
1672                 } else {
1673                         if (ifp->if_flags & IFF_RUNNING) {
1674                                 wi_stop(sc);
1675                         }
1676                 }
1677                 sc->wi_if_flags = ifp->if_flags;
1678                 error = 0;
1679                 break;
1680         case SIOCSIFMEDIA:
1681         case SIOCGIFMEDIA:
1682                 error = ifmedia_ioctl(ifp, ifr, &sc->ifmedia, command);
1683                 break;
1684         case SIOCADDMULTI:
1685         case SIOCDELMULTI:
1686                 wi_setmulti(sc);
1687                 error = 0;
1688                 break;
1689         case SIOCGWAVELAN:
1690                 error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1691                 if (error)
1692                         break;
1693                 if (wreq.wi_len > WI_MAX_DATALEN) {
1694                         error = EINVAL;
1695                         break;
1696                 }
1697                 /* Don't show WEP keys to non-root users. */
1698                 if (wreq.wi_type == WI_RID_DEFLT_CRYPT_KEYS &&
1699                     suser_cred(cr, NULL_CRED_OKAY))
1700                         break;
1701                 if (wreq.wi_type == WI_RID_IFACE_STATS) {
1702                         bcopy((char *)&sc->wi_stats, (char *)&wreq.wi_val,
1703                             sizeof(sc->wi_stats));
1704                         wreq.wi_len = (sizeof(sc->wi_stats) / 2) + 1;
1705                 } else if (wreq.wi_type == WI_RID_DEFLT_CRYPT_KEYS) {
1706                         bcopy((char *)&sc->wi_keys, (char *)&wreq,
1707                             sizeof(struct wi_ltv_keys));
1708                 }
1709 #ifdef WICACHE
1710                 else if (wreq.wi_type == WI_RID_ZERO_CACHE) {
1711                         sc->wi_sigitems = sc->wi_nextitem = 0;
1712                 } else if (wreq.wi_type == WI_RID_READ_CACHE) {
1713                         char *pt = (char *)&wreq.wi_val;
1714                         bcopy((char *)&sc->wi_sigitems,
1715                             (char *)pt, sizeof(int));
1716                         pt += (sizeof (int));
1717                         wreq.wi_len = sizeof(int) / 2;
1718                         bcopy((char *)&sc->wi_sigcache, (char *)pt,
1719                             sizeof(struct wi_sigcache) * sc->wi_sigitems);
1720                         wreq.wi_len += ((sizeof(struct wi_sigcache) *
1721                             sc->wi_sigitems) / 2) + 1;
1722                 }
1723 #endif
1724                 else if (wreq.wi_type == WI_RID_PROCFRAME) {
1725                         wreq.wi_len = 2;
1726                         wreq.wi_val[0] = sc->wi_procframe;
1727                 } else if (wreq.wi_type == WI_RID_PRISM2) {
1728                         wreq.wi_len = 2;
1729                         wreq.wi_val[0] = sc->sc_firmware_type != WI_LUCENT;
1730                 } else if (wreq.wi_type == WI_RID_SCAN_RES &&
1731                     sc->sc_firmware_type == WI_LUCENT) {
1732                         memcpy((char *)wreq.wi_val, (char *)sc->wi_scanbuf,
1733                             sc->wi_scanbuf_len * 2);
1734                         wreq.wi_len = sc->wi_scanbuf_len;
1735                 } else {
1736                         if (wi_read_record(sc, (struct wi_ltv_gen *)&wreq)) {
1737                                 error = EINVAL;
1738                                 break;
1739                         }
1740                 }
1741                 error = copyout(&wreq, ifr->ifr_data, sizeof(wreq));
1742                 break;
1743         case SIOCSWAVELAN:
1744                 if ((error = suser_cred(cr, NULL_CRED_OKAY)))
1745                         goto out;
1746                 error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1747                 if (error)
1748                         break;
1749                 if (wreq.wi_len > WI_MAX_DATALEN) {
1750                         error = EINVAL;
1751                         break;
1752                 }
1753                 if (wreq.wi_type == WI_RID_IFACE_STATS) {
1754                         error = EINVAL;
1755                         break;
1756                 } else if (wreq.wi_type == WI_RID_MGMT_XMIT) {
1757                         error = wi_mgmt_xmit(sc, (caddr_t)&wreq.wi_val,
1758                             wreq.wi_len);
1759                 } else if (wreq.wi_type == WI_RID_PROCFRAME) {
1760                         sc->wi_procframe = wreq.wi_val[0];
1761                 /*
1762                  * if we're getting a scan request from a wavelan card
1763                  * (non-prism2), send out a cmd_inquire to the card to scan
1764                  * results for the scan will be received through the info
1765                  * interrupt handler. otherwise the scan request can be
1766                  * directly handled by a prism2 card's rid interface.
1767                  */
1768                 } else if (wreq.wi_type == WI_RID_SCAN_REQ &&
1769                     sc->sc_firmware_type == WI_LUCENT) {
1770                         wi_cmd(sc, WI_CMD_INQUIRE, WI_INFO_SCAN_RESULTS, 0, 0);
1771                 } else {
1772                         error = wi_write_record(sc, (struct wi_ltv_gen *)&wreq);
1773                         if (!error)
1774                                 wi_setdef(sc, &wreq);
1775                 }
1776                 break;
1777         case SIOCGPRISM2DEBUG:
1778                 error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1779                 if (error)
1780                         break;
1781                 if (!(ifp->if_flags & IFF_RUNNING) ||
1782                     sc->sc_firmware_type == WI_LUCENT) {
1783                         error = EIO;
1784                         break;
1785                 }
1786                 error = wi_get_debug(sc, &wreq);
1787                 if (error == 0)
1788                         error = copyout(&wreq, ifr->ifr_data, sizeof(wreq));
1789                 break;
1790         case SIOCSPRISM2DEBUG:
1791                 if ((error = suser_cred(cr, NULL_CRED_OKAY)))
1792                         goto out;
1793                 error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1794                 if (error)
1795                         break;
1796                 error = wi_set_debug(sc, &wreq);
1797                 break;
1798         case SIOCG80211:
1799                 switch(ireq->i_type) {
1800                 case IEEE80211_IOC_SSID:
1801                         if(ireq->i_val == -1) {
1802                                 bzero(tmpssid, IEEE80211_NWID_LEN);
1803                                 error = wi_get_cur_ssid(sc, tmpssid, &len);
1804                                 if (error != 0)
1805                                         break;
1806                                 error = copyout(tmpssid, ireq->i_data,
1807                                         IEEE80211_NWID_LEN);
1808                                 ireq->i_len = len;
1809                         } else if (ireq->i_val == 0) {
1810                                 error = copyout(sc->wi_net_name,
1811                                     ireq->i_data,
1812                                     IEEE80211_NWID_LEN);
1813                                 ireq->i_len = IEEE80211_NWID_LEN;
1814                         } else
1815                                 error = EINVAL;
1816                         break;
1817                 case IEEE80211_IOC_NUMSSIDS:
1818                         ireq->i_val = 1;
1819                         break;
1820                 case IEEE80211_IOC_WEP:
1821                         if(!sc->wi_has_wep) {
1822                                 ireq->i_val = IEEE80211_WEP_NOSUP;
1823                         } else {
1824                                 if(sc->wi_use_wep) {
1825                                         ireq->i_val =
1826                                             IEEE80211_WEP_MIXED;
1827                                 } else {
1828                                         ireq->i_val =
1829                                             IEEE80211_WEP_OFF;
1830                                 }
1831                         }
1832                         break;
1833                 case IEEE80211_IOC_WEPKEY:
1834                         if(!sc->wi_has_wep ||
1835                             ireq->i_val < 0 || ireq->i_val > 3) {
1836                                 error = EINVAL;
1837                                 break;
1838                         }
1839                         len = sc->wi_keys.wi_keys[ireq->i_val].wi_keylen;
1840                         if (suser_cred(cr, NULL_CRED_OKAY))
1841                                 bcopy(sc->wi_keys.wi_keys[ireq->i_val].wi_keydat,
1842                                     tmpkey, len);
1843                         else
1844                                 bzero(tmpkey, len);
1845
1846                         ireq->i_len = len;
1847                         error = copyout(tmpkey, ireq->i_data, len);
1848
1849                         break;
1850                 case IEEE80211_IOC_NUMWEPKEYS:
1851                         if(!sc->wi_has_wep)
1852                                 error = EINVAL;
1853                         else
1854                                 ireq->i_val = 4;
1855                         break;
1856                 case IEEE80211_IOC_WEPTXKEY:
1857                         if(!sc->wi_has_wep)
1858                                 error = EINVAL;
1859                         else
1860                                 ireq->i_val = sc->wi_tx_key;
1861                         break;
1862                 case IEEE80211_IOC_AUTHMODE:
1863                         ireq->i_val = sc->wi_authmode;
1864                         break;
1865                 case IEEE80211_IOC_STATIONNAME:
1866                         error = copyout(sc->wi_node_name,
1867                             ireq->i_data, IEEE80211_NWID_LEN);
1868                         ireq->i_len = IEEE80211_NWID_LEN;
1869                         break;
1870                 case IEEE80211_IOC_CHANNEL:
1871                         wreq.wi_type = WI_RID_CURRENT_CHAN;
1872                         wreq.wi_len = WI_MAX_DATALEN;
1873                         if (wi_read_record(sc, (struct wi_ltv_gen *)&wreq))
1874                                 error = EINVAL;
1875                         else {
1876                                 ireq->i_val = wreq.wi_val[0];
1877                         }
1878                         break;
1879                 case IEEE80211_IOC_POWERSAVE:
1880                         if(sc->wi_pm_enabled)
1881                                 ireq->i_val = IEEE80211_POWERSAVE_ON;
1882                         else
1883                                 ireq->i_val = IEEE80211_POWERSAVE_OFF;
1884                         break;
1885                 case IEEE80211_IOC_POWERSAVESLEEP:
1886                         ireq->i_val = sc->wi_max_sleep;
1887                         break;
1888                 default:
1889                         error = EINVAL;
1890                 }
1891                 break;
1892         case SIOCS80211:
1893                 if ((error = suser_cred(cr, NULL_CRED_OKAY)))
1894                         goto out;
1895                 switch(ireq->i_type) {
1896                 case IEEE80211_IOC_SSID:
1897                         if (ireq->i_val != 0 ||
1898                             ireq->i_len > IEEE80211_NWID_LEN) {
1899                                 error = EINVAL;
1900                                 break;
1901                         }
1902                         /* We set both of them */
1903                         bzero(sc->wi_net_name, IEEE80211_NWID_LEN);
1904                         error = copyin(ireq->i_data,
1905                             sc->wi_net_name, ireq->i_len);
1906                         bcopy(sc->wi_net_name, sc->wi_ibss_name, IEEE80211_NWID_LEN);
1907                         break;
1908                 case IEEE80211_IOC_WEP:
1909                         /*
1910                          * These cards only support one mode so
1911                          * we just turn wep on what ever is
1912                          * passed in if it's not OFF.
1913                          */
1914                         if (ireq->i_val == IEEE80211_WEP_OFF) {
1915                                 sc->wi_use_wep = 0;
1916                         } else {
1917                                 sc->wi_use_wep = 1;
1918                         }
1919                         break;
1920                 case IEEE80211_IOC_WEPKEY:
1921                         if (ireq->i_val < 0 || ireq->i_val > 3 ||
1922                                 ireq->i_len > 13) {
1923                                 error = EINVAL;
1924                                 break;
1925                         }
1926                         bzero(sc->wi_keys.wi_keys[ireq->i_val].wi_keydat, 13);
1927                         error = copyin(ireq->i_data,
1928                             sc->wi_keys.wi_keys[ireq->i_val].wi_keydat,
1929                             ireq->i_len);
1930                         if(error)
1931                                 break;
1932                         sc->wi_keys.wi_keys[ireq->i_val].wi_keylen =
1933                                     ireq->i_len;
1934                         break;
1935                 case IEEE80211_IOC_WEPTXKEY:
1936                         if (ireq->i_val < 0 || ireq->i_val > 3) {
1937                                 error = EINVAL;
1938                                 break;
1939                         }
1940                         sc->wi_tx_key = ireq->i_val;
1941                         break;
1942                 case IEEE80211_IOC_AUTHMODE:
1943                         sc->wi_authmode = ireq->i_val;
1944                         break;
1945                 case IEEE80211_IOC_STATIONNAME:
1946                         if (ireq->i_len > 32) {
1947                                 error = EINVAL;
1948                                 break;
1949                         }
1950                         bzero(sc->wi_node_name, 32);
1951                         error = copyin(ireq->i_data,
1952                             sc->wi_node_name, ireq->i_len);
1953                         break;
1954                 case IEEE80211_IOC_CHANNEL:
1955                         /*
1956                          * The actual range is 1-14, but if you
1957                          * set it to 0 you get the default. So
1958                          * we let that work too.
1959                          */
1960                         if (ireq->i_val < 0 || ireq->i_val > 14) {
1961                                 error = EINVAL;
1962                                 break;
1963                         }
1964                         sc->wi_channel = ireq->i_val;
1965                         break;
1966                 case IEEE80211_IOC_POWERSAVE:
1967                         switch (ireq->i_val) {
1968                         case IEEE80211_POWERSAVE_OFF:
1969                                 sc->wi_pm_enabled = 0;
1970                                 break;
1971                         case IEEE80211_POWERSAVE_ON:
1972                                 sc->wi_pm_enabled = 1;
1973                                 break;
1974                         default:
1975                                 error = EINVAL;
1976                                 break;
1977                         }
1978                         break;
1979                 case IEEE80211_IOC_POWERSAVESLEEP:
1980                         if (ireq->i_val < 0) {
1981                                 error = EINVAL;
1982                                 break;
1983                         }
1984                         sc->wi_max_sleep = ireq->i_val;
1985                         break;
1986                 default:
1987                         error = EINVAL;
1988                         break;
1989                 }
1990
1991                 /* Reinitialize WaveLAN. */
1992                 wi_init(sc);
1993
1994         break;
1995         case SIOCHOSTAP_ADD:
1996         case SIOCHOSTAP_DEL:
1997         case SIOCHOSTAP_GET:
1998         case SIOCHOSTAP_GETALL:
1999         case SIOCHOSTAP_GFLAGS:
2000         case SIOCHOSTAP_SFLAGS:
2001                 /* Send all Host AP specific ioctl's to Host AP code. */
2002                 error = wihap_ioctl(sc, command, data);
2003                 break;
2004         default:
2005                 error = EINVAL;
2006                 break;
2007         }
2008 out:
2009         WI_UNLOCK(sc, s);
2010
2011         return(error);
2012 }
2013
2014 static void
2015 wi_init(xsc)
2016         void                    *xsc;
2017 {
2018         struct wi_softc         *sc = xsc;
2019         struct ifnet            *ifp = &sc->arpcom.ac_if;
2020         struct wi_ltv_macaddr   mac;
2021         int                     id = 0;
2022         int                     s;
2023
2024         WI_LOCK(sc, s);
2025
2026         if (sc->wi_gone) {
2027                 WI_UNLOCK(sc, s);
2028                 return;
2029         }
2030
2031         if (ifp->if_flags & IFF_RUNNING)
2032                 wi_stop(sc);
2033
2034         wi_reset(sc);
2035
2036         /* Program max data length. */
2037         WI_SETVAL(WI_RID_MAX_DATALEN, sc->wi_max_data_len);
2038
2039         /* Set the port type. */
2040         WI_SETVAL(WI_RID_PORTTYPE, sc->wi_ptype);
2041
2042         /* Enable/disable IBSS creation. */
2043         WI_SETVAL(WI_RID_CREATE_IBSS, sc->wi_create_ibss);
2044
2045         /* Program the RTS/CTS threshold. */
2046         WI_SETVAL(WI_RID_RTS_THRESH, sc->wi_rts_thresh);
2047
2048         /* Program the TX rate */
2049         WI_SETVAL(WI_RID_TX_RATE, sc->wi_tx_rate);
2050
2051         /* Access point density */
2052         WI_SETVAL(WI_RID_SYSTEM_SCALE, sc->wi_ap_density);
2053
2054         /* Power Management Enabled */
2055         WI_SETVAL(WI_RID_PM_ENABLED, sc->wi_pm_enabled);
2056
2057         /* Power Managment Max Sleep */
2058         WI_SETVAL(WI_RID_MAX_SLEEP, sc->wi_max_sleep);
2059
2060         /* Roaming type */
2061         WI_SETVAL(WI_RID_ROAMING_MODE, sc->wi_roaming);
2062
2063         /* Specify the IBSS name */
2064         WI_SETSTR(WI_RID_OWN_SSID, sc->wi_ibss_name);
2065
2066         /* Specify the network name */
2067         WI_SETSTR(WI_RID_DESIRED_SSID, sc->wi_net_name);
2068
2069         /* Specify the frequency to use */
2070         WI_SETVAL(WI_RID_OWN_CHNL, sc->wi_channel);
2071
2072         /* Program the nodename. */
2073         WI_SETSTR(WI_RID_NODENAME, sc->wi_node_name);
2074
2075         /* Specify the authentication mode. */
2076         WI_SETVAL(WI_RID_CNFAUTHMODE, sc->wi_authmode);
2077
2078         /* Set our MAC address. */
2079         mac.wi_len = 4;
2080         mac.wi_type = WI_RID_MAC_NODE;
2081         bcopy((char *)&sc->arpcom.ac_enaddr,
2082            (char *)&mac.wi_mac_addr, ETHER_ADDR_LEN);
2083         wi_write_record(sc, (struct wi_ltv_gen *)&mac);
2084
2085         /*
2086          * Initialize promisc mode.
2087          *      Being in the Host-AP mode causes
2088          *      great deal of pain if promisc mode is set.
2089          *      Therefore we avoid confusing the firmware
2090          *      and always reset promisc mode in Host-AP regime,
2091          *      it shows us all the packets anyway.
2092          */
2093         if (sc->wi_ptype != WI_PORTTYPE_AP && ifp->if_flags & IFF_PROMISC)
2094                 WI_SETVAL(WI_RID_PROMISC, 1);
2095         else
2096                 WI_SETVAL(WI_RID_PROMISC, 0);
2097
2098         /* Configure WEP. */
2099         if (sc->wi_has_wep) {
2100                 WI_SETVAL(WI_RID_ENCRYPTION, sc->wi_use_wep);
2101                 WI_SETVAL(WI_RID_TX_CRYPT_KEY, sc->wi_tx_key);
2102                 sc->wi_keys.wi_len = (sizeof(struct wi_ltv_keys) / 2) + 1;
2103                 sc->wi_keys.wi_type = WI_RID_DEFLT_CRYPT_KEYS;
2104                 wi_write_record(sc, (struct wi_ltv_gen *)&sc->wi_keys);
2105                 if (sc->sc_firmware_type != WI_LUCENT && sc->wi_use_wep) {
2106                         /*
2107                          * ONLY HWB3163 EVAL-CARD Firmware version
2108                          * less than 0.8 variant2
2109                          *
2110                          * If promiscuous mode disable, Prism2 chip
2111                          * does not work with WEP.
2112                          * It is under investigation for details.
2113                          * (ichiro@netbsd.org)
2114                          *
2115                          * And make sure that we don't need to do it
2116                          * in hostap mode, since it interferes with
2117                          * the above hostap workaround.
2118                          */
2119                         if (sc->wi_ptype != WI_PORTTYPE_AP &&
2120                             sc->sc_firmware_type == WI_INTERSIL &&
2121                             sc->sc_sta_firmware_ver < 802 ) {
2122                                 /* firm ver < 0.8 variant 2 */
2123                                 WI_SETVAL(WI_RID_PROMISC, 1);
2124                         }
2125                         WI_SETVAL(WI_RID_CNFAUTHMODE, sc->wi_authtype);
2126                 }
2127         }
2128
2129         /* Set multicast filter. */
2130         wi_setmulti(sc);
2131
2132         /* Enable desired port */
2133         wi_cmd(sc, WI_CMD_ENABLE | sc->wi_portnum, 0, 0, 0);
2134
2135         if (wi_alloc_nicmem(sc, ETHER_MAX_LEN + sizeof(struct wi_frame) + 8, &id))
2136                 device_printf(sc->dev, "tx buffer allocation failed\n");
2137         sc->wi_tx_data_id = id;
2138
2139         if (wi_alloc_nicmem(sc, ETHER_MAX_LEN + sizeof(struct wi_frame) + 8, &id))
2140                 device_printf(sc->dev, "mgmt. buffer allocation failed\n");
2141         sc->wi_tx_mgmt_id = id;
2142
2143         /* enable interrupts */
2144         CSR_WRITE_2(sc, WI_INT_EN, WI_INTRS);
2145
2146         wihap_init(sc);
2147
2148         ifp->if_flags |= IFF_RUNNING;
2149         ifp->if_flags &= ~IFF_OACTIVE;
2150
2151         sc->wi_stat_ch = timeout(wi_inquire, sc, hz * 60);
2152         WI_UNLOCK(sc, s);
2153
2154         return;
2155 }
2156
2157 #define RC4STATE 256
2158 #define RC4KEYLEN 16
2159 #define RC4SWAP(x,y) \
2160     do { u_int8_t t = state[x]; state[x] = state[y]; state[y] = t; } while(0)
2161
2162 static void
2163 wi_do_hostencrypt(struct wi_softc *sc, caddr_t buf, int len)
2164 {
2165         u_int32_t i, crc, klen;
2166         u_int8_t state[RC4STATE], key[RC4KEYLEN];
2167         u_int8_t x, y, *dat;
2168
2169         if (!sc->wi_icv_flag) {
2170                 sc->wi_icv = arc4random();
2171                 sc->wi_icv_flag++;
2172         } else
2173                 sc->wi_icv++;
2174         /*
2175          * Skip 'bad' IVs from Fluhrer/Mantin/Shamir:
2176          * (B, 255, N) with 3 <= B < 8
2177          */
2178         if (sc->wi_icv >= 0x03ff00 &&
2179             (sc->wi_icv & 0xf8ff00) == 0x00ff00)
2180                 sc->wi_icv += 0x000100;
2181
2182         /* prepend 24bit IV to tx key, byte order does not matter */
2183         key[0] = sc->wi_icv >> 16;
2184         key[1] = sc->wi_icv >> 8;
2185         key[2] = sc->wi_icv;
2186
2187         klen = sc->wi_keys.wi_keys[sc->wi_tx_key].wi_keylen +
2188             IEEE80211_WEP_IVLEN;
2189         klen = (klen >= RC4KEYLEN) ? RC4KEYLEN : RC4KEYLEN/2;
2190         bcopy((char *)&sc->wi_keys.wi_keys[sc->wi_tx_key].wi_keydat,
2191             (char *)key + IEEE80211_WEP_IVLEN, klen - IEEE80211_WEP_IVLEN);
2192
2193         /* rc4 keysetup */
2194         x = y = 0;
2195         for (i = 0; i < RC4STATE; i++)
2196                 state[i] = i;
2197         for (i = 0; i < RC4STATE; i++) {
2198                 y = (key[x] + state[i] + y) % RC4STATE;
2199                 RC4SWAP(i, y);
2200                 x = (x + 1) % klen;
2201         }
2202
2203         /* output: IV, tx keyid, rc4(data), rc4(crc32(data)) */
2204         dat = buf;
2205         dat[0] = key[0];
2206         dat[1] = key[1];
2207         dat[2] = key[2];
2208         dat[3] = sc->wi_tx_key << 6;            /* pad and keyid */
2209         dat += 4;
2210
2211         /* compute rc4 over data, crc32 over data */
2212         crc = ~0;
2213         x = y = 0;
2214         for (i = 0; i < len; i++) {
2215                 x = (x + 1) % RC4STATE;
2216                 y = (state[x] + y) % RC4STATE;
2217                 RC4SWAP(x, y);
2218                 crc = crc32_tab[(crc ^ dat[i]) & 0xff] ^ (crc >> 8);
2219                 dat[i] ^= state[(state[x] + state[y]) % RC4STATE];
2220         }
2221         crc = ~crc;
2222         dat += len;
2223
2224         /* append little-endian crc32 and encrypt */
2225         dat[0] = crc;
2226         dat[1] = crc >> 8;
2227         dat[2] = crc >> 16;
2228         dat[3] = crc >> 24;
2229         for (i = 0; i < IEEE80211_WEP_CRCLEN; i++) {
2230                 x = (x + 1) % RC4STATE;
2231                 y = (state[x] + y) % RC4STATE;
2232                 RC4SWAP(x, y);
2233                 dat[i] ^= state[(state[x] + state[y]) % RC4STATE];
2234         }
2235 }
2236
2237 static void
2238 wi_start(ifp)
2239         struct ifnet            *ifp;
2240 {
2241         struct wi_softc         *sc;
2242         struct mbuf             *m0;
2243         struct wi_frame         tx_frame;
2244         struct ether_header     *eh;
2245         int                     id;
2246         int                     s;
2247
2248         sc = ifp->if_softc;
2249         WI_LOCK(sc, s);
2250
2251         if (sc->wi_gone) {
2252                 WI_UNLOCK(sc, s);
2253                 return;
2254         }
2255
2256         if (ifp->if_flags & IFF_OACTIVE) {
2257                 WI_UNLOCK(sc, s);
2258                 return;
2259         }
2260
2261 nextpkt:
2262         IF_DEQUEUE(&ifp->if_snd, m0);
2263         if (m0 == NULL) {
2264                 WI_UNLOCK(sc, s);
2265                 return;
2266         }
2267
2268         bzero((char *)&tx_frame, sizeof(tx_frame));
2269         tx_frame.wi_frame_ctl = htole16(WI_FTYPE_DATA);
2270         id = sc->wi_tx_data_id;
2271         eh = mtod(m0, struct ether_header *);
2272
2273         if (sc->wi_ptype == WI_PORTTYPE_AP) {
2274                 if (!wihap_check_tx(&sc->wi_hostap_info,
2275                     eh->ether_dhost, &tx_frame.wi_tx_rate)) {
2276                         if (ifp->if_flags & IFF_DEBUG)
2277                                 printf("wi_start: dropping unassoc "
2278                                        "dst %6D\n", eh->ether_dhost, ":");
2279                         m_freem(m0);
2280                         goto nextpkt;
2281                 }
2282         }
2283         /*
2284          * Use RFC1042 encoding for IP and ARP datagrams,
2285          * 802.3 for anything else.
2286          */
2287         if (ntohs(eh->ether_type) > ETHER_MAX_LEN) {
2288                 bcopy((char *)&eh->ether_dhost,
2289                     (char *)&tx_frame.wi_addr1, ETHER_ADDR_LEN);
2290                 if (sc->wi_ptype == WI_PORTTYPE_AP) {
2291                         tx_frame.wi_tx_ctl = WI_ENC_TX_MGMT; /* XXX */
2292                         tx_frame.wi_frame_ctl |= WI_FCTL_FROMDS;
2293                         if (sc->wi_use_wep)
2294                                 tx_frame.wi_frame_ctl |= WI_FCTL_WEP;
2295                         bcopy((char *)&sc->arpcom.ac_enaddr,
2296                               (char *)&tx_frame.wi_addr2, ETHER_ADDR_LEN);
2297                         bcopy((char *)&eh->ether_shost,
2298                               (char *)&tx_frame.wi_addr3, ETHER_ADDR_LEN);
2299                 }
2300                 else
2301                         bcopy((char *)&eh->ether_shost,
2302                             (char *)&tx_frame.wi_addr2, ETHER_ADDR_LEN);
2303                 bcopy((char *)&eh->ether_dhost,
2304                     (char *)&tx_frame.wi_dst_addr, ETHER_ADDR_LEN);
2305                 bcopy((char *)&eh->ether_shost,
2306                     (char *)&tx_frame.wi_src_addr, ETHER_ADDR_LEN);
2307
2308                 tx_frame.wi_dat_len = m0->m_pkthdr.len - WI_SNAPHDR_LEN;
2309                 tx_frame.wi_dat[0] = htons(WI_SNAP_WORD0);
2310                 tx_frame.wi_dat[1] = htons(WI_SNAP_WORD1);
2311                 tx_frame.wi_len = htons(m0->m_pkthdr.len - WI_SNAPHDR_LEN);
2312                 tx_frame.wi_type = eh->ether_type;
2313
2314                 if (sc->wi_ptype == WI_PORTTYPE_AP && sc->wi_use_wep) {
2315                         /* Do host encryption. */
2316                         bcopy(&tx_frame.wi_dat[0], &sc->wi_txbuf[4], 8);
2317                         m_copydata(m0, sizeof(struct ether_header),
2318                             m0->m_pkthdr.len - sizeof(struct ether_header),
2319                             (caddr_t)&sc->wi_txbuf[12]);
2320                         wi_do_hostencrypt(sc, &sc->wi_txbuf[0],
2321                             tx_frame.wi_dat_len);
2322                         tx_frame.wi_dat_len += IEEE80211_WEP_IVLEN +
2323                             IEEE80211_WEP_KIDLEN + IEEE80211_WEP_CRCLEN;
2324                         wi_write_data(sc, id, 0, (caddr_t)&tx_frame,
2325                             sizeof(struct wi_frame));
2326                         wi_write_data(sc, id, WI_802_11_OFFSET_RAW,
2327                             (caddr_t)&sc->wi_txbuf, (m0->m_pkthdr.len -
2328                             sizeof(struct ether_header)) + 18);
2329                 } else {
2330                         m_copydata(m0, sizeof(struct ether_header),
2331                             m0->m_pkthdr.len - sizeof(struct ether_header),
2332                             (caddr_t)&sc->wi_txbuf);
2333                         wi_write_data(sc, id, 0, (caddr_t)&tx_frame,
2334                             sizeof(struct wi_frame));
2335                         wi_write_data(sc, id, WI_802_11_OFFSET,
2336                             (caddr_t)&sc->wi_txbuf, (m0->m_pkthdr.len -
2337                             sizeof(struct ether_header)) + 2);
2338                 }
2339         } else {
2340                 tx_frame.wi_dat_len = m0->m_pkthdr.len;
2341
2342                 if (sc->wi_ptype == WI_PORTTYPE_AP && sc->wi_use_wep) {
2343                         /* Do host encryption. */
2344                         printf( "XXX: host encrypt not implemented for 802.3\n" );
2345                 } else {
2346                         eh->ether_type = htons(m0->m_pkthdr.len -
2347                             WI_SNAPHDR_LEN);
2348                         m_copydata(m0, 0, m0->m_pkthdr.len,
2349                             (caddr_t)&sc->wi_txbuf);
2350
2351                         wi_write_data(sc, id, 0, (caddr_t)&tx_frame,
2352                             sizeof(struct wi_frame));
2353                         wi_write_data(sc, id, WI_802_3_OFFSET,
2354                             (caddr_t)&sc->wi_txbuf, m0->m_pkthdr.len + 2);
2355                 }
2356         }
2357
2358         /*
2359          * If there's a BPF listner, bounce a copy of
2360          * this frame to him. Also, don't send this to the bpf sniffer
2361          * if we're in procframe or monitor sniffing mode.
2362          */
2363         if (!(sc->wi_procframe || sc->wi_debug.wi_monitor) && ifp->if_bpf)
2364                 bpf_mtap(ifp, m0);
2365
2366         m_freem(m0);
2367
2368         if (wi_cmd(sc, WI_CMD_TX|WI_RECLAIM, id, 0, 0))
2369                 device_printf(sc->dev, "xmit failed\n");
2370
2371         ifp->if_flags |= IFF_OACTIVE;
2372
2373         /*
2374          * Set a timeout in case the chip goes out to lunch.
2375          */
2376         ifp->if_timer = 5;
2377
2378         WI_UNLOCK(sc, s);
2379         return;
2380 }
2381
2382 int
2383 wi_mgmt_xmit(sc, data, len)
2384         struct wi_softc         *sc;
2385         caddr_t                 data;
2386         int                     len;
2387 {
2388         struct wi_frame         tx_frame;
2389         int                     id;
2390         struct wi_80211_hdr     *hdr;
2391         caddr_t                 dptr;
2392
2393         if (sc->wi_gone)
2394                 return(ENODEV);
2395
2396         hdr = (struct wi_80211_hdr *)data;
2397         dptr = data + sizeof(struct wi_80211_hdr);
2398
2399         bzero((char *)&tx_frame, sizeof(tx_frame));
2400         id = sc->wi_tx_mgmt_id;
2401
2402         bcopy((char *)hdr, (char *)&tx_frame.wi_frame_ctl,
2403            sizeof(struct wi_80211_hdr));
2404
2405         tx_frame.wi_tx_ctl = WI_ENC_TX_MGMT;
2406         tx_frame.wi_dat_len = len - sizeof(struct wi_80211_hdr);
2407         tx_frame.wi_len = htons(tx_frame.wi_dat_len);
2408
2409         wi_write_data(sc, id, 0, (caddr_t)&tx_frame, sizeof(struct wi_frame));
2410         wi_write_data(sc, id, WI_802_11_OFFSET_RAW, dptr,
2411             len - sizeof(struct wi_80211_hdr) + 2);
2412
2413         if (wi_cmd(sc, WI_CMD_TX|WI_RECLAIM, id, 0, 0)) {
2414                 device_printf(sc->dev, "xmit failed\n");
2415                 return(EIO);
2416         }
2417
2418         return(0);
2419 }
2420
2421 static void
2422 wi_stop(sc)
2423         struct wi_softc         *sc;
2424 {
2425         struct ifnet            *ifp;
2426         int                     s;
2427
2428         WI_LOCK(sc, s);
2429
2430         if (sc->wi_gone) {
2431                 WI_UNLOCK(sc, s);
2432                 return;
2433         }
2434
2435         wihap_shutdown(sc);
2436
2437         ifp = &sc->arpcom.ac_if;
2438
2439         /*
2440          * If the card is gone and the memory port isn't mapped, we will
2441          * (hopefully) get 0xffff back from the status read, which is not
2442          * a valid status value.
2443          */
2444         if (CSR_READ_2(sc, WI_STATUS) != 0xffff) {
2445                 CSR_WRITE_2(sc, WI_INT_EN, 0);
2446                 wi_cmd(sc, WI_CMD_DISABLE|sc->wi_portnum, 0, 0, 0);
2447         }
2448
2449         untimeout(wi_inquire, sc, sc->wi_stat_ch);
2450
2451         ifp->if_flags &= ~(IFF_RUNNING|IFF_OACTIVE);
2452
2453         WI_UNLOCK(sc, s);
2454         return;
2455 }
2456
2457 static void
2458 wi_watchdog(ifp)
2459         struct ifnet            *ifp;
2460 {
2461         struct wi_softc         *sc;
2462
2463         sc = ifp->if_softc;
2464
2465         device_printf(sc->dev, "watchdog timeout\n");
2466
2467         wi_init(sc);
2468
2469         ifp->if_oerrors++;
2470
2471         return;
2472 }
2473
2474 int
2475 wi_alloc(dev, rid)
2476         device_t                dev;
2477         int                     rid;
2478 {
2479         struct wi_softc         *sc = device_get_softc(dev);
2480
2481         if (sc->wi_bus_type != WI_BUS_PCI_NATIVE) {
2482                 sc->iobase_rid = rid;
2483                 sc->iobase = bus_alloc_resource(dev, SYS_RES_IOPORT,
2484                     &sc->iobase_rid, 0, ~0, (1 << 6),
2485                     rman_make_alignment_flags(1 << 6) | RF_ACTIVE);
2486                 if (!sc->iobase) {
2487                         device_printf(dev, "No I/O space?!\n");
2488                         return (ENXIO);
2489                 }
2490
2491                 sc->wi_io_addr = rman_get_start(sc->iobase);
2492                 sc->wi_btag = rman_get_bustag(sc->iobase);
2493                 sc->wi_bhandle = rman_get_bushandle(sc->iobase);
2494         } else {
2495                 sc->mem_rid = rid;
2496                 sc->mem = bus_alloc_resource(dev, SYS_RES_MEMORY,
2497                     &sc->mem_rid, 0, ~0, 1, RF_ACTIVE);
2498
2499                 if (!sc->mem) {
2500                         device_printf(dev, "No Mem space on prism2.5?\n");
2501                         return (ENXIO);
2502                 }
2503
2504                 sc->wi_btag = rman_get_bustag(sc->mem);
2505                 sc->wi_bhandle = rman_get_bushandle(sc->mem);
2506         }
2507
2508
2509         sc->irq_rid = 0;
2510         sc->irq = bus_alloc_resource(dev, SYS_RES_IRQ, &sc->irq_rid,
2511             0, ~0, 1, RF_ACTIVE |
2512             ((sc->wi_bus_type == WI_BUS_PCCARD) ? 0 : RF_SHAREABLE));
2513
2514         if (!sc->irq) {
2515                 wi_free(dev);
2516                 device_printf(dev, "No irq?!\n");
2517                 return (ENXIO);
2518         }
2519
2520         sc->dev = dev;
2521         sc->wi_unit = device_get_unit(dev);
2522
2523         return (0);
2524 }
2525
2526 void
2527 wi_free(dev)
2528         device_t                dev;
2529 {
2530         struct wi_softc         *sc = device_get_softc(dev);
2531
2532         if (sc->iobase != NULL) {
2533                 bus_release_resource(dev, SYS_RES_IOPORT, sc->iobase_rid, sc->iobase);
2534                 sc->iobase = NULL;
2535         }
2536         if (sc->irq != NULL) {
2537                 bus_release_resource(dev, SYS_RES_IRQ, sc->irq_rid, sc->irq);
2538                 sc->irq = NULL;
2539         }
2540         if (sc->mem != NULL) {
2541                 bus_release_resource(dev, SYS_RES_MEMORY, sc->mem_rid, sc->mem);
2542                 sc->mem = NULL;
2543         }
2544
2545         return;
2546 }
2547
2548 void
2549 wi_shutdown(dev)
2550         device_t                dev;
2551 {
2552         struct wi_softc         *sc;
2553
2554         sc = device_get_softc(dev);
2555         wi_stop(sc);
2556
2557         return;
2558 }
2559
2560 #ifdef WICACHE
2561 /* wavelan signal strength cache code.
2562  * store signal/noise/quality on per MAC src basis in
2563  * a small fixed cache.  The cache wraps if > MAX slots
2564  * used.  The cache may be zeroed out to start over.
2565  * Two simple filters exist to reduce computation:
2566  * 1. ip only (literally 0x800) which may be used
2567  * to ignore some packets.  It defaults to ip only.
2568  * it could be used to focus on broadcast, non-IP 802.11 beacons.
2569  * 2. multicast/broadcast only.  This may be used to
2570  * ignore unicast packets and only cache signal strength
2571  * for multicast/broadcast packets (beacons); e.g., Mobile-IP
2572  * beacons and not unicast traffic.
2573  *
2574  * The cache stores (MAC src(index), IP src (major clue), signal,
2575  *      quality, noise)
2576  *
2577  * No apologies for storing IP src here.  It's easy and saves much
2578  * trouble elsewhere.  The cache is assumed to be INET dependent,
2579  * although it need not be.
2580  */
2581
2582 #ifdef documentation
2583
2584 int wi_sigitems;                                /* number of cached entries */
2585 struct wi_sigcache wi_sigcache[MAXWICACHE];  /*  array of cache entries */
2586 int wi_nextitem;                                /*  index/# of entries */
2587
2588
2589 #endif
2590
2591 /* control variables for cache filtering.  Basic idea is
2592  * to reduce cost (e.g., to only Mobile-IP agent beacons
2593  * which are broadcast or multicast).  Still you might
2594  * want to measure signal strength with unicast ping packets
2595  * on a pt. to pt. ant. setup.
2596  */
2597 /* set true if you want to limit cache items to broadcast/mcast
2598  * only packets (not unicast).  Useful for mobile-ip beacons which
2599  * are broadcast/multicast at network layer.  Default is all packets
2600  * so ping/unicast will work say with pt. to pt. antennae setup.
2601  */
2602 static int wi_cache_mcastonly = 0;
2603 SYSCTL_INT(_machdep, OID_AUTO, wi_cache_mcastonly, CTLFLAG_RW,
2604         &wi_cache_mcastonly, 0, "");
2605
2606 /* set true if you want to limit cache items to IP packets only
2607 */
2608 static int wi_cache_iponly = 1;
2609 SYSCTL_INT(_machdep, OID_AUTO, wi_cache_iponly, CTLFLAG_RW,
2610         &wi_cache_iponly, 0, "");
2611
2612 /*
2613  * Original comments:
2614  * -----------------
2615  * wi_cache_store, per rx packet store signal
2616  * strength in MAC (src) indexed cache.
2617  *
2618  * follows linux driver in how signal strength is computed.
2619  * In ad hoc mode, we use the rx_quality field.
2620  * signal and noise are trimmed to fit in the range from 47..138.
2621  * rx_quality field MSB is signal strength.
2622  * rx_quality field LSB is noise.
2623  * "quality" is (signal - noise) as is log value.
2624  * note: quality CAN be negative.
2625  *
2626  * In BSS mode, we use the RID for communication quality.
2627  * TBD:  BSS mode is currently untested.
2628  *
2629  * Bill's comments:
2630  * ---------------
2631  * Actually, we use the rx_quality field all the time for both "ad-hoc"
2632  * and BSS modes. Why? Because reading an RID is really, really expensive:
2633  * there's a bunch of PIO operations that have to be done to read a record
2634  * from the NIC, and reading the comms quality RID each time a packet is
2635  * received can really hurt performance. We don't have to do this anyway:
2636  * the comms quality field only reflects the values in the rx_quality field
2637  * anyway. The comms quality RID is only meaningful in infrastructure mode,
2638  * but the values it contains are updated based on the rx_quality from
2639  * frames received from the access point.
2640  *
2641  * Also, according to Lucent, the signal strength and noise level values
2642  * can be converted to dBms by subtracting 149, so I've modified the code
2643  * to do that instead of the scaling it did originally.
2644  */
2645 static void
2646 wi_cache_store(struct wi_softc *sc, struct ether_header *eh,
2647                      struct mbuf *m, unsigned short rx_quality)
2648 {
2649         struct ip *ip = 0;
2650         int i;
2651         static int cache_slot = 0;      /* use this cache entry */
2652         static int wrapindex = 0;       /* next "free" cache entry */
2653         int sig, noise;
2654         int sawip=0;
2655
2656         /*
2657          * filters:
2658          * 1. ip only
2659          * 2. configurable filter to throw out unicast packets,
2660          * keep multicast only.
2661          */
2662
2663         if ((ntohs(eh->ether_type) == ETHERTYPE_IP)) {
2664                 sawip = 1;
2665         }
2666
2667         /*
2668          * filter for ip packets only
2669         */
2670         if (wi_cache_iponly && !sawip) {
2671                 return;
2672         }
2673
2674         /*
2675          *  filter for broadcast/multicast only
2676          */
2677         if (wi_cache_mcastonly && ((eh->ether_dhost[0] & 1) == 0)) {
2678                 return;
2679         }
2680
2681 #ifdef SIGDEBUG
2682         printf("wi%d: q value %x (MSB=0x%x, LSB=0x%x) \n", sc->wi_unit,
2683             rx_quality & 0xffff, rx_quality >> 8, rx_quality & 0xff);
2684 #endif
2685
2686         /*
2687          *  find the ip header.  we want to store the ip_src
2688          * address.
2689          */
2690         if (sawip)
2691                 ip = mtod(m, struct ip *);
2692
2693         /*
2694          * do a linear search for a matching MAC address
2695          * in the cache table
2696          * . MAC address is 6 bytes,
2697          * . var w_nextitem holds total number of entries already cached
2698          */
2699         for(i = 0; i < sc->wi_nextitem; i++) {
2700                 if (! bcmp(eh->ether_shost , sc->wi_sigcache[i].macsrc,  6 )) {
2701                         /*
2702                          * Match!,
2703                          * so we already have this entry,
2704                          * update the data
2705                          */
2706                         break;
2707                 }
2708         }
2709
2710         /*
2711          *  did we find a matching mac address?
2712          * if yes, then overwrite a previously existing cache entry
2713          */
2714         if (i < sc->wi_nextitem )   {
2715                 cache_slot = i;
2716         }
2717         /*
2718          * else, have a new address entry,so
2719          * add this new entry,
2720          * if table full, then we need to replace LRU entry
2721          */
2722         else    {
2723
2724                 /*
2725                  * check for space in cache table
2726                  * note: wi_nextitem also holds number of entries
2727                  * added in the cache table
2728                  */
2729                 if ( sc->wi_nextitem < MAXWICACHE ) {
2730                         cache_slot = sc->wi_nextitem;
2731                         sc->wi_nextitem++;
2732                         sc->wi_sigitems = sc->wi_nextitem;
2733                 }
2734                 /* no space found, so simply wrap with wrap index
2735                  * and "zap" the next entry
2736                  */
2737                 else {
2738                         if (wrapindex == MAXWICACHE) {
2739                                 wrapindex = 0;
2740                         }
2741                         cache_slot = wrapindex++;
2742                 }
2743         }
2744
2745         /*
2746          * invariant: cache_slot now points at some slot
2747          * in cache.
2748          */
2749         if (cache_slot < 0 || cache_slot >= MAXWICACHE) {
2750                 log(LOG_ERR, "wi_cache_store, bad index: %d of "
2751                     "[0..%d], gross cache error\n",
2752                     cache_slot, MAXWICACHE);
2753                 return;
2754         }
2755
2756         /*
2757          *  store items in cache
2758          *  .ip source address
2759          *  .mac src
2760          *  .signal, etc.
2761          */
2762         if (sawip)
2763                 sc->wi_sigcache[cache_slot].ipsrc = ip->ip_src.s_addr;
2764         bcopy( eh->ether_shost, sc->wi_sigcache[cache_slot].macsrc,  6);
2765
2766         sig = (rx_quality >> 8) & 0xFF;
2767         noise = rx_quality & 0xFF;
2768         sc->wi_sigcache[cache_slot].signal = sig - 149;
2769         sc->wi_sigcache[cache_slot].noise = noise - 149;
2770         sc->wi_sigcache[cache_slot].quality = sig - noise;
2771
2772         return;
2773 }
2774 #endif
2775
2776 static int
2777 wi_get_cur_ssid(sc, ssid, len)
2778         struct wi_softc         *sc;
2779         char                    *ssid;
2780         int                     *len;
2781 {
2782         int                     error = 0;
2783         struct wi_req           wreq;
2784
2785         wreq.wi_len = WI_MAX_DATALEN;
2786         switch (sc->wi_ptype) {
2787         case WI_PORTTYPE_AP:
2788                 *len = IEEE80211_NWID_LEN;
2789                 bcopy(sc->wi_net_name, ssid, IEEE80211_NWID_LEN);
2790                 break;
2791         case WI_PORTTYPE_ADHOC:
2792                 wreq.wi_type = WI_RID_CURRENT_SSID;
2793                 error = wi_read_record(sc, (struct wi_ltv_gen *)&wreq);
2794                 if (error != 0)
2795                         break;
2796                 if (wreq.wi_val[0] > IEEE80211_NWID_LEN) {
2797                         error = EINVAL;
2798                         break;
2799                 }
2800                 *len = wreq.wi_val[0];
2801                 bcopy(&wreq.wi_val[1], ssid, IEEE80211_NWID_LEN);
2802                 break;
2803         case WI_PORTTYPE_BSS:
2804                 wreq.wi_type = WI_RID_COMMQUAL;
2805                 error = wi_read_record(sc, (struct wi_ltv_gen *)&wreq);
2806                 if (error != 0)
2807                         break;
2808                 if (wreq.wi_val[0] != 0) /* associated */ {
2809                         wreq.wi_type = WI_RID_CURRENT_SSID;
2810                         wreq.wi_len = WI_MAX_DATALEN;
2811                         error = wi_read_record(sc, (struct wi_ltv_gen *)&wreq);
2812                         if (error != 0)
2813                                 break;
2814                         if (wreq.wi_val[0] > IEEE80211_NWID_LEN) {
2815                                 error = EINVAL;
2816                                 break;
2817                         }
2818                         *len = wreq.wi_val[0];
2819                         bcopy(&wreq.wi_val[1], ssid, IEEE80211_NWID_LEN);
2820                 } else {
2821                         *len = IEEE80211_NWID_LEN;
2822                         bcopy(sc->wi_net_name, ssid, IEEE80211_NWID_LEN);
2823                 }
2824                 break;
2825         default:
2826                 error = EINVAL;
2827                 break;
2828         }
2829
2830         return error;
2831 }
2832
2833 static int
2834 wi_media_change(ifp)
2835         struct ifnet            *ifp;
2836 {
2837         struct wi_softc         *sc = ifp->if_softc;
2838         int                     otype = sc->wi_ptype;
2839         int                     orate = sc->wi_tx_rate;
2840         int                     ocreate_ibss = sc->wi_create_ibss;
2841
2842         if ((sc->ifmedia.ifm_cur->ifm_media & IFM_IEEE80211_HOSTAP) &&
2843             sc->sc_firmware_type != WI_INTERSIL)
2844                 return (EINVAL);
2845
2846         sc->wi_create_ibss = 0;
2847
2848         switch (sc->ifmedia.ifm_cur->ifm_media & IFM_OMASK) {
2849         case 0:
2850                 sc->wi_ptype = WI_PORTTYPE_BSS;
2851                 break;
2852         case IFM_IEEE80211_ADHOC:
2853                 sc->wi_ptype = WI_PORTTYPE_ADHOC;
2854                 break;
2855         case IFM_IEEE80211_HOSTAP:
2856                 sc->wi_ptype = WI_PORTTYPE_AP;
2857                 break;
2858         case IFM_IEEE80211_IBSSMASTER:
2859         case IFM_IEEE80211_IBSSMASTER|IFM_IEEE80211_IBSS:
2860                 if (!(sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS))
2861                         return (EINVAL);
2862                 sc->wi_create_ibss = 1;
2863                 /* FALLTHROUGH */
2864         case IFM_IEEE80211_IBSS:
2865                 sc->wi_ptype = WI_PORTTYPE_IBSS;
2866                 break;
2867         default:
2868                 /* Invalid combination. */
2869                 return (EINVAL);
2870         }
2871
2872         switch (IFM_SUBTYPE(sc->ifmedia.ifm_cur->ifm_media)) {
2873         case IFM_IEEE80211_DS1:
2874                 sc->wi_tx_rate = 1;
2875                 break;
2876         case IFM_IEEE80211_DS2:
2877                 sc->wi_tx_rate = 2;
2878                 break;
2879         case IFM_IEEE80211_DS5:
2880                 sc->wi_tx_rate = 5;
2881                 break;
2882         case IFM_IEEE80211_DS11:
2883                 sc->wi_tx_rate = 11;
2884                 break;
2885         case IFM_AUTO:
2886                 sc->wi_tx_rate = 3;
2887                 break;
2888         }
2889
2890         if (ocreate_ibss != sc->wi_create_ibss || otype != sc->wi_ptype ||
2891             orate != sc->wi_tx_rate)
2892                 wi_init(sc);
2893
2894         return(0);
2895 }
2896
2897 static void
2898 wi_media_status(ifp, imr)
2899         struct ifnet            *ifp;
2900         struct ifmediareq       *imr;
2901 {
2902         struct wi_req           wreq;
2903         struct wi_softc         *sc = ifp->if_softc;
2904
2905         if (sc->wi_tx_rate == 3) {
2906                 imr->ifm_active = IFM_IEEE80211|IFM_AUTO;
2907                 if (sc->wi_ptype == WI_PORTTYPE_ADHOC)
2908                         imr->ifm_active |= IFM_IEEE80211_ADHOC;
2909                 else if (sc->wi_ptype == WI_PORTTYPE_AP)
2910                         imr->ifm_active |= IFM_IEEE80211_HOSTAP;
2911                 else if (sc->wi_ptype == WI_PORTTYPE_IBSS) {
2912                         if (sc->wi_create_ibss)
2913                                 imr->ifm_active |= IFM_IEEE80211_IBSSMASTER;
2914                         else
2915                                 imr->ifm_active |= IFM_IEEE80211_IBSS;
2916                 }
2917                 wreq.wi_type = WI_RID_CUR_TX_RATE;
2918                 wreq.wi_len = WI_MAX_DATALEN;
2919                 if (wi_read_record(sc, (struct wi_ltv_gen *)&wreq) == 0) {
2920                         switch(wreq.wi_val[0]) {
2921                         case 1:
2922                                 imr->ifm_active |= IFM_IEEE80211_DS1;
2923                                 break;
2924                         case 2:
2925                                 imr->ifm_active |= IFM_IEEE80211_DS2;
2926                                 break;
2927                         case 6:
2928                                 imr->ifm_active |= IFM_IEEE80211_DS5;
2929                                 break;
2930                         case 11:
2931                                 imr->ifm_active |= IFM_IEEE80211_DS11;
2932                                 break;
2933                                 }
2934                 }
2935         } else {
2936                 imr->ifm_active = sc->ifmedia.ifm_cur->ifm_media;
2937         }
2938
2939         imr->ifm_status = IFM_AVALID;
2940         if (sc->wi_ptype == WI_PORTTYPE_ADHOC ||
2941             sc->wi_ptype == WI_PORTTYPE_IBSS)
2942                 /*
2943                  * XXX: It would be nice if we could give some actually
2944                  * useful status like whether we joined another IBSS or
2945                  * created one ourselves.
2946                  */
2947                 imr->ifm_status |= IFM_ACTIVE;
2948         else if (sc->wi_ptype == WI_PORTTYPE_AP)
2949                 imr->ifm_status |= IFM_ACTIVE;
2950         else {
2951                 wreq.wi_type = WI_RID_COMMQUAL;
2952                 wreq.wi_len = WI_MAX_DATALEN;
2953                 if (wi_read_record(sc, (struct wi_ltv_gen *)&wreq) == 0 &&
2954                     wreq.wi_val[0] != 0)
2955                         imr->ifm_status |= IFM_ACTIVE;
2956         }
2957 }
2958
2959 static int
2960 wi_get_debug(sc, wreq)
2961         struct wi_softc         *sc;
2962         struct wi_req           *wreq;
2963 {
2964         int                     error = 0;
2965
2966         wreq->wi_len = 1;
2967
2968         switch (wreq->wi_type) {
2969         case WI_DEBUG_SLEEP:
2970                 wreq->wi_len++;
2971                 wreq->wi_val[0] = sc->wi_debug.wi_sleep;
2972                 break;
2973         case WI_DEBUG_DELAYSUPP:
2974                 wreq->wi_len++;
2975                 wreq->wi_val[0] = sc->wi_debug.wi_delaysupp;
2976                 break;
2977         case WI_DEBUG_TXSUPP:
2978                 wreq->wi_len++;
2979                 wreq->wi_val[0] = sc->wi_debug.wi_txsupp;
2980                 break;
2981         case WI_DEBUG_MONITOR:
2982                 wreq->wi_len++;
2983                 wreq->wi_val[0] = sc->wi_debug.wi_monitor;
2984                 break;
2985         case WI_DEBUG_LEDTEST:
2986                 wreq->wi_len += 3;
2987                 wreq->wi_val[0] = sc->wi_debug.wi_ledtest;
2988                 wreq->wi_val[1] = sc->wi_debug.wi_ledtest_param0;
2989                 wreq->wi_val[2] = sc->wi_debug.wi_ledtest_param1;
2990                 break;
2991         case WI_DEBUG_CONTTX:
2992                 wreq->wi_len += 2;
2993                 wreq->wi_val[0] = sc->wi_debug.wi_conttx;
2994                 wreq->wi_val[1] = sc->wi_debug.wi_conttx_param0;
2995                 break;
2996         case WI_DEBUG_CONTRX:
2997                 wreq->wi_len++;
2998                 wreq->wi_val[0] = sc->wi_debug.wi_contrx;
2999                 break;
3000         case WI_DEBUG_SIGSTATE:
3001                 wreq->wi_len += 2;
3002                 wreq->wi_val[0] = sc->wi_debug.wi_sigstate;
3003                 wreq->wi_val[1] = sc->wi_debug.wi_sigstate_param0;
3004                 break;
3005         case WI_DEBUG_CONFBITS:
3006                 wreq->wi_len += 2;
3007                 wreq->wi_val[0] = sc->wi_debug.wi_confbits;
3008                 wreq->wi_val[1] = sc->wi_debug.wi_confbits_param0;
3009                 break;
3010         default:
3011                 error = EIO;
3012                 break;
3013         }
3014
3015         return (error);
3016 }
3017
3018 static int
3019 wi_set_debug(sc, wreq)
3020         struct wi_softc         *sc;
3021         struct wi_req           *wreq;
3022 {
3023         int                     error = 0;
3024         u_int16_t               cmd, param0 = 0, param1 = 0;
3025
3026         switch (wreq->wi_type) {
3027         case WI_DEBUG_RESET:
3028         case WI_DEBUG_INIT:
3029         case WI_DEBUG_CALENABLE:
3030                 break;
3031         case WI_DEBUG_SLEEP:
3032                 sc->wi_debug.wi_sleep = 1;
3033                 break;
3034         case WI_DEBUG_WAKE:
3035                 sc->wi_debug.wi_sleep = 0;
3036                 break;
3037         case WI_DEBUG_CHAN:
3038                 param0 = wreq->wi_val[0];
3039                 break;
3040         case WI_DEBUG_DELAYSUPP:
3041                 sc->wi_debug.wi_delaysupp = 1;
3042                 break;
3043         case WI_DEBUG_TXSUPP:
3044                 sc->wi_debug.wi_txsupp = 1;
3045                 break;
3046         case WI_DEBUG_MONITOR:
3047                 sc->wi_debug.wi_monitor = 1;
3048                 break;
3049         case WI_DEBUG_LEDTEST:
3050                 param0 = wreq->wi_val[0];
3051                 param1 = wreq->wi_val[1];
3052                 sc->wi_debug.wi_ledtest = 1;
3053                 sc->wi_debug.wi_ledtest_param0 = param0;
3054                 sc->wi_debug.wi_ledtest_param1 = param1;
3055                 break;
3056         case WI_DEBUG_CONTTX:
3057                 param0 = wreq->wi_val[0];
3058                 sc->wi_debug.wi_conttx = 1;
3059                 sc->wi_debug.wi_conttx_param0 = param0;
3060                 break;
3061         case WI_DEBUG_STOPTEST:
3062                 sc->wi_debug.wi_delaysupp = 0;
3063                 sc->wi_debug.wi_txsupp = 0;
3064                 sc->wi_debug.wi_monitor = 0;
3065                 sc->wi_debug.wi_ledtest = 0;
3066                 sc->wi_debug.wi_ledtest_param0 = 0;
3067                 sc->wi_debug.wi_ledtest_param1 = 0;
3068                 sc->wi_debug.wi_conttx = 0;
3069                 sc->wi_debug.wi_conttx_param0 = 0;
3070                 sc->wi_debug.wi_contrx = 0;
3071                 sc->wi_debug.wi_sigstate = 0;
3072                 sc->wi_debug.wi_sigstate_param0 = 0;
3073                 break;
3074         case WI_DEBUG_CONTRX:
3075                 sc->wi_debug.wi_contrx = 1;
3076                 break;
3077         case WI_DEBUG_SIGSTATE:
3078                 param0 = wreq->wi_val[0];
3079                 sc->wi_debug.wi_sigstate = 1;
3080                 sc->wi_debug.wi_sigstate_param0 = param0;
3081                 break;
3082         case WI_DEBUG_CONFBITS:
3083                 param0 = wreq->wi_val[0];
3084                 param1 = wreq->wi_val[1];
3085                 sc->wi_debug.wi_confbits = param0;
3086                 sc->wi_debug.wi_confbits_param0 = param1;
3087                 break;
3088         default:
3089                 error = EIO;
3090                 break;
3091         }
3092
3093         if (error)
3094                 return (error);
3095
3096         cmd = WI_CMD_DEBUG | (wreq->wi_type << 8);
3097         error = wi_cmd(sc, cmd, param0, param1, 0);
3098
3099         return (error);
3100 }