xref: /dragonfly/sys/dev/netif/wi/if_wi.c (revision 2d8a3be7)
1 /*
2  * Copyright (c) 1997, 1998, 1999
3  *	Bill Paul <wpaul@ctr.columbia.edu>.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. All advertising materials mentioning features or use of this software
14  *    must display the following acknowledgement:
15  *	This product includes software developed by Bill Paul.
16  * 4. Neither the name of the author nor the names of any co-contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
24  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
30  * THE POSSIBILITY OF SUCH DAMAGE.
31  *
32  * $FreeBSD: src/sys/dev/wi/if_wi.c,v 1.103.2.2 2002/08/02 07:11:34 imp Exp $
33  * $DragonFly: src/sys/dev/netif/wi/if_wi.c,v 1.5 2003/08/07 21:17:06 dillon Exp $
34  */
35 
36 /*
37  * Lucent WaveLAN/IEEE 802.11 PCMCIA driver for FreeBSD.
38  *
39  * Written by Bill Paul <wpaul@ctr.columbia.edu>
40  * Electrical Engineering Department
41  * Columbia University, New York City
42  */
43 
44 /*
45  * The WaveLAN/IEEE adapter is the second generation of the WaveLAN
46  * from Lucent. Unlike the older cards, the new ones are programmed
47  * entirely via a firmware-driven controller called the Hermes.
48  * Unfortunately, Lucent will not release the Hermes programming manual
49  * without an NDA (if at all). What they do release is an API library
50  * called the HCF (Hardware Control Functions) which is supposed to
51  * do the device-specific operations of a device driver for you. The
52  * publically available version of the HCF library (the 'HCF Light') is
53  * a) extremely gross, b) lacks certain features, particularly support
54  * for 802.11 frames, and c) is contaminated by the GNU Public License.
55  *
56  * This driver does not use the HCF or HCF Light at all. Instead, it
57  * programs the Hermes controller directly, using information gleaned
58  * from the HCF Light code and corresponding documentation.
59  *
60  * This driver supports the ISA, PCMCIA and PCI versions of the Lucent
61  * WaveLan cards (based on the Hermes chipset), as well as the newer
62  * Prism 2 chipsets with firmware from Intersil and Symbol.
63  */
64 
65 #include <sys/param.h>
66 #include <sys/systm.h>
67 #if __FreeBSD_version >= 500033
68 #include <sys/endian.h>
69 #endif
70 #include <sys/sockio.h>
71 #include <sys/mbuf.h>
72 #include <sys/proc.h>
73 #include <sys/kernel.h>
74 #include <sys/socket.h>
75 #include <sys/module.h>
76 #include <sys/bus.h>
77 #include <sys/random.h>
78 #include <sys/syslog.h>
79 #include <sys/sysctl.h>
80 
81 #include <machine/bus.h>
82 #include <machine/resource.h>
83 #include <machine/clock.h>
84 #include <sys/rman.h>
85 
86 #include <net/if.h>
87 #include <net/if_arp.h>
88 #include <net/ethernet.h>
89 #include <net/if_dl.h>
90 #include <net/if_media.h>
91 #include <net/if_types.h>
92 #include <net/if_ieee80211.h>
93 
94 #include <netinet/in.h>
95 #include <netinet/in_systm.h>
96 #include <netinet/in_var.h>
97 #include <netinet/ip.h>
98 #include <netinet/if_ether.h>
99 
100 #include <net/bpf.h>
101 
102 #include "if_wavelan_ieee.h"
103 #include "wi_hostap.h"
104 #include "if_wivar.h"
105 #include "if_wireg.h"
106 
107 static void wi_intr(void *);
108 static void wi_reset(struct wi_softc *);
109 static int wi_ioctl(struct ifnet *, u_long, caddr_t);
110 static void wi_init(void *);
111 static void wi_start(struct ifnet *);
112 static void wi_stop(struct wi_softc *);
113 static void wi_watchdog(struct ifnet *);
114 static void wi_rxeof(struct wi_softc *);
115 static void wi_txeof(struct wi_softc *, int);
116 static void wi_update_stats(struct wi_softc *);
117 static void wi_setmulti(struct wi_softc *);
118 
119 static int wi_cmd(struct wi_softc *, int, int, int, int);
120 static int wi_read_record(struct wi_softc *, struct wi_ltv_gen *);
121 static int wi_write_record(struct wi_softc *, struct wi_ltv_gen *);
122 static int wi_read_data(struct wi_softc *, int, int, caddr_t, int);
123 static int wi_write_data(struct wi_softc *, int, int, caddr_t, int);
124 static int wi_seek(struct wi_softc *, int, int, int);
125 static int wi_alloc_nicmem(struct wi_softc *, int, int *);
126 static void wi_inquire(void *);
127 static void wi_setdef(struct wi_softc *, struct wi_req *);
128 
129 #ifdef WICACHE
130 static
131 void wi_cache_store(struct wi_softc *, struct ether_header *,
132 	struct mbuf *, unsigned short);
133 #endif
134 
135 static int wi_get_cur_ssid(struct wi_softc *, char *, int *);
136 static void wi_get_id(struct wi_softc *);
137 static int wi_media_change(struct ifnet *);
138 static void wi_media_status(struct ifnet *, struct ifmediareq *);
139 
140 static int wi_get_debug(struct wi_softc *, struct wi_req *);
141 static int wi_set_debug(struct wi_softc *, struct wi_req *);
142 
143 devclass_t wi_devclass;
144 
145 struct wi_card_ident wi_card_ident[] = {
146 	/* CARD_ID			CARD_NAME		FIRM_TYPE */
147 	{ WI_NIC_LUCENT_ID,		WI_NIC_LUCENT_STR,	WI_LUCENT },
148 	{ WI_NIC_SONY_ID,		WI_NIC_SONY_STR,	WI_LUCENT },
149 	{ WI_NIC_LUCENT_EMB_ID,		WI_NIC_LUCENT_EMB_STR,	WI_LUCENT },
150 	{ WI_NIC_EVB2_ID,		WI_NIC_EVB2_STR,	WI_INTERSIL },
151 	{ WI_NIC_HWB3763_ID,		WI_NIC_HWB3763_STR,	WI_INTERSIL },
152 	{ WI_NIC_HWB3163_ID,		WI_NIC_HWB3163_STR,	WI_INTERSIL },
153 	{ WI_NIC_HWB3163B_ID,		WI_NIC_HWB3163B_STR,	WI_INTERSIL },
154 	{ WI_NIC_EVB3_ID,		WI_NIC_EVB3_STR,	WI_INTERSIL },
155 	{ WI_NIC_HWB1153_ID,		WI_NIC_HWB1153_STR,	WI_INTERSIL },
156 	{ WI_NIC_P2_SST_ID,		WI_NIC_P2_SST_STR,	WI_INTERSIL },
157 	{ WI_NIC_EVB2_SST_ID,		WI_NIC_EVB2_SST_STR,	WI_INTERSIL },
158 	{ WI_NIC_3842_EVA_ID,		WI_NIC_3842_EVA_STR,	WI_INTERSIL },
159 	{ WI_NIC_3842_PCMCIA_AMD_ID,	WI_NIC_3842_PCMCIA_STR,	WI_INTERSIL },
160 	{ WI_NIC_3842_PCMCIA_SST_ID,	WI_NIC_3842_PCMCIA_STR,	WI_INTERSIL },
161 	{ WI_NIC_3842_PCMCIA_ATM_ID,	WI_NIC_3842_PCMCIA_STR,	WI_INTERSIL },
162 	{ WI_NIC_3842_MINI_AMD_ID,	WI_NIC_3842_MINI_STR,	WI_INTERSIL },
163 	{ WI_NIC_3842_MINI_SST_ID,	WI_NIC_3842_MINI_STR,	WI_INTERSIL },
164 	{ WI_NIC_3842_MINI_ATM_ID,	WI_NIC_3842_MINI_STR,	WI_INTERSIL },
165 	{ WI_NIC_3842_PCI_AMD_ID,	WI_NIC_3842_PCI_STR,	WI_INTERSIL },
166 	{ WI_NIC_3842_PCI_SST_ID,	WI_NIC_3842_PCI_STR,	WI_INTERSIL },
167 	{ WI_NIC_3842_PCI_ATM_ID,	WI_NIC_3842_PCI_STR,	WI_INTERSIL },
168 	{ WI_NIC_P3_PCMCIA_AMD_ID,	WI_NIC_P3_PCMCIA_STR,	WI_INTERSIL },
169 	{ WI_NIC_P3_PCMCIA_SST_ID,	WI_NIC_P3_PCMCIA_STR,	WI_INTERSIL },
170 	{ WI_NIC_P3_MINI_AMD_ID,	WI_NIC_P3_MINI_STR,	WI_INTERSIL },
171 	{ WI_NIC_P3_MINI_SST_ID,	WI_NIC_P3_MINI_STR,	WI_INTERSIL },
172 	{ 0,	NULL,	0 },
173 };
174 
175 int
176 wi_generic_detach(dev)
177 	device_t		dev;
178 {
179 	struct wi_softc		*sc;
180 	struct ifnet		*ifp;
181 	int			s;
182 
183 	sc = device_get_softc(dev);
184 	WI_LOCK(sc, s);
185 	ifp = &sc->arpcom.ac_if;
186 
187 	if (sc->wi_gone) {
188 		device_printf(dev, "already unloaded\n");
189 		WI_UNLOCK(sc, s);
190 		return(ENODEV);
191 	}
192 
193 	wi_stop(sc);
194 
195 	/* Delete all remaining media. */
196 	ifmedia_removeall(&sc->ifmedia);
197 
198 	ether_ifdetach(ifp, ETHER_BPF_SUPPORTED);
199 	bus_teardown_intr(dev, sc->irq, sc->wi_intrhand);
200 	wi_free(dev);
201 	sc->wi_gone = 1;
202 
203 	WI_UNLOCK(sc, s);
204 #if __FreeBSD_version >= 500000
205 	mtx_destroy(&sc->wi_mtx);
206 #endif
207 
208 	return(0);
209 }
210 
211 int
212 wi_generic_attach(device_t dev)
213 {
214 	struct wi_softc		*sc;
215 	struct wi_ltv_macaddr	mac;
216 	struct wi_ltv_gen	gen;
217 	struct ifnet		*ifp;
218 	int			error;
219 	int			s;
220 
221 	/* XXX maybe we need the splimp stuff here XXX */
222 	sc = device_get_softc(dev);
223 	ifp = &sc->arpcom.ac_if;
224 
225 	error = bus_setup_intr(dev, sc->irq, INTR_TYPE_NET,
226 	    wi_intr, sc, &sc->wi_intrhand);
227 
228 	if (error) {
229 		device_printf(dev, "bus_setup_intr() failed! (%d)\n", error);
230 		wi_free(dev);
231 		return (error);
232 	}
233 
234 #if __FreeBSD_version >= 500000
235 	mtx_init(&sc->wi_mtx, device_get_nameunit(dev), MTX_NETWORK_LOCK,
236 	    MTX_DEF | MTX_RECURSE);
237 #endif
238 	WI_LOCK(sc, s);
239 
240 	/* Reset the NIC. */
241 	wi_reset(sc);
242 
243 	/*
244 	 * Read the station address.
245 	 * And do it twice. I've seen PRISM-based cards that return
246 	 * an error when trying to read it the first time, which causes
247 	 * the probe to fail.
248 	 */
249 	mac.wi_type = WI_RID_MAC_NODE;
250 	mac.wi_len = 4;
251 	wi_read_record(sc, (struct wi_ltv_gen *)&mac);
252 	if ((error = wi_read_record(sc, (struct wi_ltv_gen *)&mac)) != 0) {
253 		device_printf(dev, "mac read failed %d\n", error);
254 		wi_free(dev);
255 		return (error);
256 	}
257 	bcopy((char *)&mac.wi_mac_addr,
258 	   (char *)&sc->arpcom.ac_enaddr, ETHER_ADDR_LEN);
259 
260 	device_printf(dev, "802.11 address: %6D\n", sc->arpcom.ac_enaddr, ":");
261 
262 	wi_get_id(sc);
263 
264 	ifp->if_softc = sc;
265 	ifp->if_unit = sc->wi_unit;
266 	ifp->if_name = "wi";
267 	ifp->if_mtu = ETHERMTU;
268 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
269 	ifp->if_ioctl = wi_ioctl;
270 	ifp->if_output = ether_output;
271 	ifp->if_start = wi_start;
272 	ifp->if_watchdog = wi_watchdog;
273 	ifp->if_init = wi_init;
274 	ifp->if_baudrate = 10000000;
275 	ifp->if_snd.ifq_maxlen = IFQ_MAXLEN;
276 
277 	bzero(sc->wi_node_name, sizeof(sc->wi_node_name));
278 	bcopy(WI_DEFAULT_NODENAME, sc->wi_node_name,
279 	    sizeof(WI_DEFAULT_NODENAME) - 1);
280 
281 	bzero(sc->wi_net_name, sizeof(sc->wi_net_name));
282 	bcopy(WI_DEFAULT_NETNAME, sc->wi_net_name,
283 	    sizeof(WI_DEFAULT_NETNAME) - 1);
284 
285 	bzero(sc->wi_ibss_name, sizeof(sc->wi_ibss_name));
286 	bcopy(WI_DEFAULT_IBSS, sc->wi_ibss_name,
287 	    sizeof(WI_DEFAULT_IBSS) - 1);
288 
289 	sc->wi_portnum = WI_DEFAULT_PORT;
290 	sc->wi_ptype = WI_PORTTYPE_BSS;
291 	sc->wi_ap_density = WI_DEFAULT_AP_DENSITY;
292 	sc->wi_rts_thresh = WI_DEFAULT_RTS_THRESH;
293 	sc->wi_tx_rate = WI_DEFAULT_TX_RATE;
294 	sc->wi_max_data_len = WI_DEFAULT_DATALEN;
295 	sc->wi_create_ibss = WI_DEFAULT_CREATE_IBSS;
296 	sc->wi_pm_enabled = WI_DEFAULT_PM_ENABLED;
297 	sc->wi_max_sleep = WI_DEFAULT_MAX_SLEEP;
298 	sc->wi_roaming = WI_DEFAULT_ROAMING;
299 	sc->wi_authtype = WI_DEFAULT_AUTHTYPE;
300 	sc->wi_authmode = IEEE80211_AUTH_OPEN;
301 
302 	/*
303 	 * Read the default channel from the NIC. This may vary
304 	 * depending on the country where the NIC was purchased, so
305 	 * we can't hard-code a default and expect it to work for
306 	 * everyone.
307 	 */
308 	gen.wi_type = WI_RID_OWN_CHNL;
309 	gen.wi_len = 2;
310 	wi_read_record(sc, &gen);
311 	sc->wi_channel = gen.wi_val;
312 
313 	/*
314 	 * Set flags based on firmware version.
315 	 */
316 	switch (sc->sc_firmware_type) {
317 	case WI_LUCENT:
318 		sc->wi_flags |= WI_FLAGS_HAS_ROAMING;
319 		if (sc->sc_sta_firmware_ver >= 60000)
320 			sc->wi_flags |= WI_FLAGS_HAS_MOR;
321 		if (sc->sc_sta_firmware_ver >= 60006) {
322 			sc->wi_flags |= WI_FLAGS_HAS_IBSS;
323 			sc->wi_flags |= WI_FLAGS_HAS_CREATE_IBSS;
324 		}
325 		sc->wi_ibss_port = htole16(1);
326 		break;
327 	case WI_INTERSIL:
328 		sc->wi_flags |= WI_FLAGS_HAS_ROAMING;
329 		if (sc->sc_sta_firmware_ver >= 800) {
330 			sc->wi_flags |= WI_FLAGS_HAS_IBSS;
331 			sc->wi_flags |= WI_FLAGS_HAS_CREATE_IBSS;
332 		}
333 		/*
334 		 * version 0.8.3 and newer are the only ones that are known
335 		 * to currently work.  Earlier versions can be made to work,
336 		 * at least according to the Linux driver.
337 		 */
338 		if (sc->sc_sta_firmware_ver >= 803)
339 			sc->wi_flags |= WI_FLAGS_HAS_HOSTAP;
340 		sc->wi_ibss_port = htole16(0);
341 		break;
342 	case WI_SYMBOL:
343 		sc->wi_flags |= WI_FLAGS_HAS_DIVERSITY;
344 		if (sc->sc_sta_firmware_ver >= 20000)
345 			sc->wi_flags |= WI_FLAGS_HAS_IBSS;
346 		/* Older Symbol firmware does not support IBSS creation. */
347 		if (sc->sc_sta_firmware_ver >= 25000)
348 			sc->wi_flags |= WI_FLAGS_HAS_CREATE_IBSS;
349 		sc->wi_ibss_port = htole16(4);
350 		break;
351 	}
352 
353 	/*
354 	 * Find out if we support WEP on this card.
355 	 */
356 	gen.wi_type = WI_RID_WEP_AVAIL;
357 	gen.wi_len = 2;
358 	wi_read_record(sc, &gen);
359 	sc->wi_has_wep = gen.wi_val;
360 
361 	if (bootverbose)
362 		device_printf(sc->dev, "wi_has_wep = %d\n", sc->wi_has_wep);
363 
364 	/*
365 	 * Find supported rates.
366 	 */
367 	gen.wi_type = WI_RID_DATA_RATES;
368 	gen.wi_len = 2;
369 	if (wi_read_record(sc, &gen))
370 		sc->wi_supprates = WI_SUPPRATES_1M | WI_SUPPRATES_2M |
371 		    WI_SUPPRATES_5M | WI_SUPPRATES_11M;
372 	else
373 		sc->wi_supprates = gen.wi_val;
374 
375 	bzero((char *)&sc->wi_stats, sizeof(sc->wi_stats));
376 
377 	wi_init(sc);
378 	wi_stop(sc);
379 
380 	ifmedia_init(&sc->ifmedia, 0, wi_media_change, wi_media_status);
381 #define ADD(m, c)       ifmedia_add(&sc->ifmedia, (m), (c), NULL)
382 	if (sc->wi_supprates & WI_SUPPRATES_1M) {
383 		ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1, 0, 0), 0);
384 		ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1,
385 		    IFM_IEEE80211_ADHOC, 0), 0);
386 		if (sc->wi_flags & WI_FLAGS_HAS_IBSS)
387 			ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1,
388 			    IFM_IEEE80211_IBSS, 0), 0);
389 		if (sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS)
390 			ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1,
391 			    IFM_IEEE80211_IBSSMASTER, 0), 0);
392 		if (sc->wi_flags & WI_FLAGS_HAS_HOSTAP)
393 			ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1,
394 			    IFM_IEEE80211_HOSTAP, 0), 0);
395 	}
396 	if (sc->wi_supprates & WI_SUPPRATES_2M) {
397 		ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2, 0, 0), 0);
398 		ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2,
399 		    IFM_IEEE80211_ADHOC, 0), 0);
400 		if (sc->wi_flags & WI_FLAGS_HAS_IBSS)
401 			ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2,
402 			    IFM_IEEE80211_IBSS, 0), 0);
403 		if (sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS)
404 			ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2,
405 			    IFM_IEEE80211_IBSSMASTER, 0), 0);
406 		if (sc->wi_flags & WI_FLAGS_HAS_HOSTAP)
407 			ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2,
408 			    IFM_IEEE80211_HOSTAP, 0), 0);
409 	}
410 	if (sc->wi_supprates & WI_SUPPRATES_5M) {
411 		ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5, 0, 0), 0);
412 		ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5,
413 		    IFM_IEEE80211_ADHOC, 0), 0);
414 		if (sc->wi_flags & WI_FLAGS_HAS_IBSS)
415 			ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5,
416 			    IFM_IEEE80211_IBSS, 0), 0);
417 		if (sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS)
418 			ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5,
419 			    IFM_IEEE80211_IBSSMASTER, 0), 0);
420 		if (sc->wi_flags & WI_FLAGS_HAS_HOSTAP)
421 			ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5,
422 			    IFM_IEEE80211_HOSTAP, 0), 0);
423 	}
424 	if (sc->wi_supprates & WI_SUPPRATES_11M) {
425 		ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11, 0, 0), 0);
426 		ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11,
427 		    IFM_IEEE80211_ADHOC, 0), 0);
428 		if (sc->wi_flags & WI_FLAGS_HAS_IBSS)
429 			ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11,
430 			    IFM_IEEE80211_IBSS, 0), 0);
431 		if (sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS)
432 			ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11,
433 			    IFM_IEEE80211_IBSSMASTER, 0), 0);
434 		if (sc->wi_flags & WI_FLAGS_HAS_HOSTAP)
435 			ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11,
436 			    IFM_IEEE80211_HOSTAP, 0), 0);
437 		ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_MANUAL, 0, 0), 0);
438 	}
439 	ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO, IFM_IEEE80211_ADHOC, 0), 0);
440 	if (sc->wi_flags & WI_FLAGS_HAS_IBSS)
441 		ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO, IFM_IEEE80211_IBSS,
442 		    0), 0);
443 	if (sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS)
444 		ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO,
445 		    IFM_IEEE80211_IBSSMASTER, 0), 0);
446 	if (sc->wi_flags & WI_FLAGS_HAS_HOSTAP)
447 		ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO,
448 		    IFM_IEEE80211_HOSTAP, 0), 0);
449 	ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO, 0, 0), 0);
450 #undef ADD
451 	ifmedia_set(&sc->ifmedia, IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO, 0, 0));
452 
453 	/*
454 	 * Call MI attach routine.
455 	 */
456 	ether_ifattach(ifp, ETHER_BPF_SUPPORTED);
457 	callout_handle_init(&sc->wi_stat_ch);
458 	WI_UNLOCK(sc, s);
459 
460 	return(0);
461 }
462 
463 static void
464 wi_get_id(sc)
465 	struct wi_softc *sc;
466 {
467 	struct wi_ltv_ver       ver;
468 	struct wi_card_ident	*id;
469 
470 	/* getting chip identity */
471 	memset(&ver, 0, sizeof(ver));
472 	ver.wi_type = WI_RID_CARD_ID;
473 	ver.wi_len = 5;
474 	wi_read_record(sc, (struct wi_ltv_gen *)&ver);
475 	device_printf(sc->dev, "using ");
476 	sc->sc_firmware_type = WI_NOTYPE;
477 	for (id = wi_card_ident; id->card_name != NULL; id++) {
478 		if (le16toh(ver.wi_ver[0]) == id->card_id) {
479 			printf("%s", id->card_name);
480 			sc->sc_firmware_type = id->firm_type;
481 			break;
482 		}
483 	}
484 	if (sc->sc_firmware_type == WI_NOTYPE) {
485 		if (le16toh(ver.wi_ver[0]) & 0x8000) {
486 			printf("Unknown PRISM2 chip");
487 			sc->sc_firmware_type = WI_INTERSIL;
488 		} else {
489 			printf("Unknown Lucent chip");
490 			sc->sc_firmware_type = WI_LUCENT;
491 		}
492 	}
493 
494 	if (sc->sc_firmware_type != WI_LUCENT) {
495 		/* get primary firmware version */
496 		memset(&ver, 0, sizeof(ver));
497 		ver.wi_type = WI_RID_PRI_IDENTITY;
498 		ver.wi_len = 5;
499 		wi_read_record(sc, (struct wi_ltv_gen *)&ver);
500 		ver.wi_ver[1] = le16toh(ver.wi_ver[1]);
501 		ver.wi_ver[2] = le16toh(ver.wi_ver[2]);
502 		ver.wi_ver[3] = le16toh(ver.wi_ver[3]);
503 		sc->sc_pri_firmware_ver = ver.wi_ver[2] * 10000 +
504 		    ver.wi_ver[3] * 100 + ver.wi_ver[1];
505 	}
506 
507 	/* get station firmware version */
508 	memset(&ver, 0, sizeof(ver));
509 	ver.wi_type = WI_RID_STA_IDENTITY;
510 	ver.wi_len = 5;
511 	wi_read_record(sc, (struct wi_ltv_gen *)&ver);
512 	ver.wi_ver[1] = le16toh(ver.wi_ver[1]);
513 	ver.wi_ver[2] = le16toh(ver.wi_ver[2]);
514 	ver.wi_ver[3] = le16toh(ver.wi_ver[3]);
515 	sc->sc_sta_firmware_ver = ver.wi_ver[2] * 10000 +
516 	    ver.wi_ver[3] * 100 + ver.wi_ver[1];
517 	if (sc->sc_firmware_type == WI_INTERSIL &&
518 	    (sc->sc_sta_firmware_ver == 10102 ||
519 	     sc->sc_sta_firmware_ver == 20102)) {
520 		struct wi_ltv_str sver;
521 		char *p;
522 
523 		memset(&sver, 0, sizeof(sver));
524 		sver.wi_type = WI_RID_SYMBOL_IDENTITY;
525 		sver.wi_len = 7;
526 		/* value should be the format like "V2.00-11" */
527 		if (wi_read_record(sc, (struct wi_ltv_gen *)&sver) == 0 &&
528 		    *(p = (char *)sver.wi_str) >= 'A' &&
529 		    p[2] == '.' && p[5] == '-' && p[8] == '\0') {
530 			sc->sc_firmware_type = WI_SYMBOL;
531 			sc->sc_sta_firmware_ver = (p[1] - '0') * 10000 +
532 			    (p[3] - '0') * 1000 + (p[4] - '0') * 100 +
533 			    (p[6] - '0') * 10 + (p[7] - '0');
534 		}
535 	}
536 	printf("\n");
537 	device_printf(sc->dev, "%s Firmware: ",
538 	     sc->sc_firmware_type == WI_LUCENT ? "Lucent" :
539 	    (sc->sc_firmware_type == WI_SYMBOL ? "Symbol" : "Intersil"));
540 
541 	/*
542 	 * The primary firmware is only valid on Prism based chipsets
543 	 * (INTERSIL or SYMBOL).
544 	 */
545 	if (sc->sc_firmware_type != WI_LUCENT)
546 	    printf("Primary %u.%02u.%02u, ", sc->sc_pri_firmware_ver / 10000,
547 		    (sc->sc_pri_firmware_ver % 10000) / 100,
548 		    sc->sc_pri_firmware_ver % 100);
549 	printf("Station %u.%02u.%02u\n",
550 	    sc->sc_sta_firmware_ver / 10000, (sc->sc_sta_firmware_ver % 10000) / 100,
551 	    sc->sc_sta_firmware_ver % 100);
552 	return;
553 }
554 
555 static void
556 wi_rxeof(sc)
557 	struct wi_softc		*sc;
558 {
559 	struct ifnet		*ifp;
560 	struct ether_header	*eh;
561 	struct mbuf		*m;
562 	int			id;
563 
564 	ifp = &sc->arpcom.ac_if;
565 
566 	id = CSR_READ_2(sc, WI_RX_FID);
567 
568 	/*
569 	 * if we have the procframe flag set, disregard all this and just
570 	 * read the data from the device.
571 	 */
572 	if (sc->wi_procframe || sc->wi_debug.wi_monitor) {
573 		struct wi_frame		*rx_frame;
574 		int			datlen, hdrlen;
575 
576 		/* first allocate mbuf for packet storage */
577 		MGETHDR(m, M_DONTWAIT, MT_DATA);
578 		if (m == NULL) {
579 			ifp->if_ierrors++;
580 			return;
581 		}
582 		MCLGET(m, M_DONTWAIT);
583 		if (!(m->m_flags & M_EXT)) {
584 			m_freem(m);
585 			ifp->if_ierrors++;
586 			return;
587 		}
588 
589 		m->m_pkthdr.rcvif = ifp;
590 
591 		/* now read wi_frame first so we know how much data to read */
592 		if (wi_read_data(sc, id, 0, mtod(m, caddr_t),
593 		    sizeof(struct wi_frame))) {
594 			m_freem(m);
595 			ifp->if_ierrors++;
596 			return;
597 		}
598 
599 		rx_frame = mtod(m, struct wi_frame *);
600 
601 		switch ((rx_frame->wi_status & WI_STAT_MAC_PORT) >> 8) {
602 		case 7:
603 			switch (rx_frame->wi_frame_ctl & WI_FCTL_FTYPE) {
604 			case WI_FTYPE_DATA:
605 				hdrlen = WI_DATA_HDRLEN;
606 				datlen = rx_frame->wi_dat_len + WI_FCS_LEN;
607 				break;
608 			case WI_FTYPE_MGMT:
609 				hdrlen = WI_MGMT_HDRLEN;
610 				datlen = rx_frame->wi_dat_len + WI_FCS_LEN;
611 				break;
612 			case WI_FTYPE_CTL:
613 				/*
614 				 * prism2 cards don't pass control packets
615 				 * down properly or consistently, so we'll only
616 				 * pass down the header.
617 				 */
618 				hdrlen = WI_CTL_HDRLEN;
619 				datlen = 0;
620 				break;
621 			default:
622 				device_printf(sc->dev, "received packet of "
623 				    "unknown type on port 7\n");
624 				m_freem(m);
625 				ifp->if_ierrors++;
626 				return;
627 			}
628 			break;
629 		case 0:
630 			hdrlen = WI_DATA_HDRLEN;
631 			datlen = rx_frame->wi_dat_len + WI_FCS_LEN;
632 			break;
633 		default:
634 			device_printf(sc->dev, "received packet on invalid "
635 			    "port (wi_status=0x%x)\n", rx_frame->wi_status);
636 			m_freem(m);
637 			ifp->if_ierrors++;
638 			return;
639 		}
640 
641 		if ((hdrlen + datlen + 2) > MCLBYTES) {
642 			device_printf(sc->dev, "oversized packet received "
643 			    "(wi_dat_len=%d, wi_status=0x%x)\n",
644 			    datlen, rx_frame->wi_status);
645 			m_freem(m);
646 			ifp->if_ierrors++;
647 			return;
648 		}
649 
650 		if (wi_read_data(sc, id, hdrlen, mtod(m, caddr_t) + hdrlen,
651 		    datlen + 2)) {
652 			m_freem(m);
653 			ifp->if_ierrors++;
654 			return;
655 		}
656 
657 		m->m_pkthdr.len = m->m_len = hdrlen + datlen;
658 
659 		ifp->if_ipackets++;
660 
661 		/* Handle BPF listeners. */
662 		if (ifp->if_bpf)
663 			bpf_mtap(ifp, m);
664 
665 		m_freem(m);
666 	} else {
667 		struct wi_frame		rx_frame;
668 
669 		/* First read in the frame header */
670 		if (wi_read_data(sc, id, 0, (caddr_t)&rx_frame,
671 		    sizeof(rx_frame))) {
672 			ifp->if_ierrors++;
673 			return;
674 		}
675 
676 		if (rx_frame.wi_status & WI_STAT_ERRSTAT) {
677 			ifp->if_ierrors++;
678 			return;
679 		}
680 
681 		MGETHDR(m, M_DONTWAIT, MT_DATA);
682 		if (m == NULL) {
683 			ifp->if_ierrors++;
684 			return;
685 		}
686 		MCLGET(m, M_DONTWAIT);
687 		if (!(m->m_flags & M_EXT)) {
688 			m_freem(m);
689 			ifp->if_ierrors++;
690 			return;
691 		}
692 
693 		eh = mtod(m, struct ether_header *);
694 		m->m_pkthdr.rcvif = ifp;
695 
696 		if (rx_frame.wi_status == WI_STAT_MGMT &&
697 		    sc->wi_ptype == WI_PORTTYPE_AP) {
698 			if ((WI_802_11_OFFSET_RAW + rx_frame.wi_dat_len + 2) >
699 			    MCLBYTES) {
700 				device_printf(sc->dev, "oversized mgmt packet "
701 				    "received in hostap mode "
702 				    "(wi_dat_len=%d, wi_status=0x%x)\n",
703 				    rx_frame.wi_dat_len, rx_frame.wi_status);
704 				m_freem(m);
705 				ifp->if_ierrors++;
706 				return;
707 			}
708 
709 			/* Put the whole header in there. */
710 			bcopy(&rx_frame, mtod(m, void *),
711 			    sizeof(struct wi_frame));
712 			if (wi_read_data(sc, id, WI_802_11_OFFSET_RAW,
713 			    mtod(m, caddr_t) + WI_802_11_OFFSET_RAW,
714 			    rx_frame.wi_dat_len + 2)) {
715 				m_freem(m);
716 				ifp->if_ierrors++;
717 				return;
718 			}
719 			m->m_pkthdr.len = m->m_len =
720 			    WI_802_11_OFFSET_RAW + rx_frame.wi_dat_len;
721 			/* XXX: consider giving packet to bhp? */
722 			wihap_mgmt_input(sc, &rx_frame, m);
723 			return;
724 		}
725 
726 		if (rx_frame.wi_status == WI_STAT_1042 ||
727 		    rx_frame.wi_status == WI_STAT_TUNNEL ||
728 		    rx_frame.wi_status == WI_STAT_WMP_MSG) {
729 			if((rx_frame.wi_dat_len + WI_SNAPHDR_LEN) > MCLBYTES) {
730 				device_printf(sc->dev,
731 				    "oversized packet received "
732 				    "(wi_dat_len=%d, wi_status=0x%x)\n",
733 				    rx_frame.wi_dat_len, rx_frame.wi_status);
734 				m_freem(m);
735 				ifp->if_ierrors++;
736 				return;
737 			}
738 			m->m_pkthdr.len = m->m_len =
739 			    rx_frame.wi_dat_len + WI_SNAPHDR_LEN;
740 
741 #if 0
742 			bcopy((char *)&rx_frame.wi_addr1,
743 			    (char *)&eh->ether_dhost, ETHER_ADDR_LEN);
744 			if (sc->wi_ptype == WI_PORTTYPE_ADHOC) {
745 				bcopy((char *)&rx_frame.wi_addr2,
746 				    (char *)&eh->ether_shost, ETHER_ADDR_LEN);
747 			} else {
748 				bcopy((char *)&rx_frame.wi_addr3,
749 				    (char *)&eh->ether_shost, ETHER_ADDR_LEN);
750 			}
751 #else
752 			bcopy((char *)&rx_frame.wi_dst_addr,
753 				(char *)&eh->ether_dhost, ETHER_ADDR_LEN);
754 			bcopy((char *)&rx_frame.wi_src_addr,
755 				(char *)&eh->ether_shost, ETHER_ADDR_LEN);
756 #endif
757 
758 			bcopy((char *)&rx_frame.wi_type,
759 			    (char *)&eh->ether_type, ETHER_TYPE_LEN);
760 
761 			if (wi_read_data(sc, id, WI_802_11_OFFSET,
762 			    mtod(m, caddr_t) + sizeof(struct ether_header),
763 			    m->m_len + 2)) {
764 				m_freem(m);
765 				ifp->if_ierrors++;
766 				return;
767 			}
768 		} else {
769 			if((rx_frame.wi_dat_len +
770 			    sizeof(struct ether_header)) > MCLBYTES) {
771 				device_printf(sc->dev,
772 				    "oversized packet received "
773 				    "(wi_dat_len=%d, wi_status=0x%x)\n",
774 				    rx_frame.wi_dat_len, rx_frame.wi_status);
775 				m_freem(m);
776 				ifp->if_ierrors++;
777 				return;
778 			}
779 			m->m_pkthdr.len = m->m_len =
780 			    rx_frame.wi_dat_len + sizeof(struct ether_header);
781 
782 			if (wi_read_data(sc, id, WI_802_3_OFFSET,
783 			    mtod(m, caddr_t), m->m_len + 2)) {
784 				m_freem(m);
785 				ifp->if_ierrors++;
786 				return;
787 			}
788 		}
789 
790 		ifp->if_ipackets++;
791 
792 		if (sc->wi_ptype == WI_PORTTYPE_AP) {
793 			/*
794 			 * Give host AP code first crack at data
795 			 * packets.  If it decides to handle it (or
796 			 * drop it), it will return a non-zero.
797 			 * Otherwise, it is destined for this host.
798 			 */
799 			if (wihap_data_input(sc, &rx_frame, m))
800 				return;
801 		}
802 		/* Receive packet. */
803 		m_adj(m, sizeof(struct ether_header));
804 #ifdef WICACHE
805 		wi_cache_store(sc, eh, m, rx_frame.wi_q_info);
806 #endif
807 		ether_input(ifp, eh, m);
808 	}
809 }
810 
811 static void
812 wi_txeof(sc, status)
813 	struct wi_softc		*sc;
814 	int			status;
815 {
816 	struct ifnet		*ifp;
817 
818 	ifp = &sc->arpcom.ac_if;
819 
820 	ifp->if_timer = 0;
821 	ifp->if_flags &= ~IFF_OACTIVE;
822 
823 	if (status & WI_EV_TX_EXC)
824 		ifp->if_oerrors++;
825 	else
826 		ifp->if_opackets++;
827 
828 	return;
829 }
830 
831 void
832 wi_inquire(xsc)
833 	void			*xsc;
834 {
835 	struct wi_softc		*sc;
836 	struct ifnet		*ifp;
837 	int			s;
838 
839 	sc = xsc;
840 	ifp = &sc->arpcom.ac_if;
841 
842 	sc->wi_stat_ch = timeout(wi_inquire, sc, hz * 60);
843 
844 	/* Don't do this while we're transmitting */
845 	if (ifp->if_flags & IFF_OACTIVE)
846 		return;
847 
848 	WI_LOCK(sc, s);
849 	wi_cmd(sc, WI_CMD_INQUIRE, WI_INFO_COUNTERS, 0, 0);
850 	WI_UNLOCK(sc, s);
851 
852 	return;
853 }
854 
855 void
856 wi_update_stats(sc)
857 	struct wi_softc		*sc;
858 {
859 	struct wi_ltv_gen	gen;
860 	u_int16_t		id;
861 	struct ifnet		*ifp;
862 	u_int32_t		*ptr;
863 	int			len, i;
864 	u_int16_t		t;
865 
866 	ifp = &sc->arpcom.ac_if;
867 
868 	id = CSR_READ_2(sc, WI_INFO_FID);
869 
870 	wi_read_data(sc, id, 0, (char *)&gen, 4);
871 
872 	/*
873 	 * if we just got our scan results, copy it over into the scan buffer
874 	 * so we can return it to anyone that asks for it. (add a little
875 	 * compatibility with the prism2 scanning mechanism)
876 	 */
877 	if (gen.wi_type == WI_INFO_SCAN_RESULTS)
878 	{
879 		sc->wi_scanbuf_len = gen.wi_len;
880 		wi_read_data(sc, id, 4, (char *)sc->wi_scanbuf,
881 		    sc->wi_scanbuf_len * 2);
882 
883 		return;
884 	}
885 	else if (gen.wi_type != WI_INFO_COUNTERS)
886 		return;
887 
888 	len = (gen.wi_len - 1 < sizeof(sc->wi_stats) / 4) ?
889 		gen.wi_len - 1 : sizeof(sc->wi_stats) / 4;
890 	ptr = (u_int32_t *)&sc->wi_stats;
891 
892 	for (i = 0; i < len - 1; i++) {
893 		t = CSR_READ_2(sc, WI_DATA1);
894 #ifdef WI_HERMES_STATS_WAR
895 		if (t > 0xF000)
896 			t = ~t & 0xFFFF;
897 #endif
898 		ptr[i] += t;
899 	}
900 
901 	ifp->if_collisions = sc->wi_stats.wi_tx_single_retries +
902 	    sc->wi_stats.wi_tx_multi_retries +
903 	    sc->wi_stats.wi_tx_retry_limit;
904 
905 	return;
906 }
907 
908 static void
909 wi_intr(xsc)
910 	void		*xsc;
911 {
912 	struct wi_softc		*sc = xsc;
913 	struct ifnet		*ifp;
914 	u_int16_t		status;
915 	int			s;
916 
917 	WI_LOCK(sc, s);
918 
919 	ifp = &sc->arpcom.ac_if;
920 
921 	if (sc->wi_gone || !(ifp->if_flags & IFF_UP)) {
922 		CSR_WRITE_2(sc, WI_EVENT_ACK, 0xFFFF);
923 		CSR_WRITE_2(sc, WI_INT_EN, 0);
924 		WI_UNLOCK(sc, s);
925 		return;
926 	}
927 
928 	/* Disable interrupts. */
929 	CSR_WRITE_2(sc, WI_INT_EN, 0);
930 
931 	status = CSR_READ_2(sc, WI_EVENT_STAT);
932 	CSR_WRITE_2(sc, WI_EVENT_ACK, ~WI_INTRS);
933 
934 	if (status & WI_EV_RX) {
935 		wi_rxeof(sc);
936 		CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_RX);
937 	}
938 
939 	if (status & WI_EV_TX) {
940 		wi_txeof(sc, status);
941 		CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_TX);
942 	}
943 
944 	if (status & WI_EV_ALLOC) {
945 		int			id;
946 
947 		id = CSR_READ_2(sc, WI_ALLOC_FID);
948 		CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_ALLOC);
949 		if (id == sc->wi_tx_data_id)
950 			wi_txeof(sc, status);
951 	}
952 
953 	if (status & WI_EV_INFO) {
954 		wi_update_stats(sc);
955 		CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_INFO);
956 	}
957 
958 	if (status & WI_EV_TX_EXC) {
959 		wi_txeof(sc, status);
960 		CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_TX_EXC);
961 	}
962 
963 	if (status & WI_EV_INFO_DROP) {
964 		CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_INFO_DROP);
965 	}
966 
967 	/* Re-enable interrupts. */
968 	CSR_WRITE_2(sc, WI_INT_EN, WI_INTRS);
969 
970 	if (ifp->if_snd.ifq_head != NULL) {
971 		wi_start(ifp);
972 	}
973 
974 	WI_UNLOCK(sc, s);
975 
976 	return;
977 }
978 
979 static int
980 wi_cmd(sc, cmd, val0, val1, val2)
981 	struct wi_softc		*sc;
982 	int			cmd;
983 	int			val0;
984 	int			val1;
985 	int			val2;
986 {
987 	int			i, s = 0;
988 	static volatile int count  = 0;
989 
990 	if (count > 1)
991 		panic("Hey partner, hold on there!");
992 	count++;
993 
994 	/* wait for the busy bit to clear */
995 	for (i = 500; i > 0; i--) {	/* 5s */
996 		if (!(CSR_READ_2(sc, WI_COMMAND) & WI_CMD_BUSY)) {
997 			break;
998 		}
999 		DELAY(10*1000);	/* 10 m sec */
1000 	}
1001 	if (i == 0) {
1002 		device_printf(sc->dev, "wi_cmd: busy bit won't clear.\n" );
1003 		count--;
1004 		return(ETIMEDOUT);
1005 	}
1006 
1007 	CSR_WRITE_2(sc, WI_PARAM0, val0);
1008 	CSR_WRITE_2(sc, WI_PARAM1, val1);
1009 	CSR_WRITE_2(sc, WI_PARAM2, val2);
1010 	CSR_WRITE_2(sc, WI_COMMAND, cmd);
1011 
1012 	for (i = 0; i < WI_TIMEOUT; i++) {
1013 		/*
1014 		 * Wait for 'command complete' bit to be
1015 		 * set in the event status register.
1016 		 */
1017 		s = CSR_READ_2(sc, WI_EVENT_STAT);
1018 		if (s & WI_EV_CMD) {
1019 			/* Ack the event and read result code. */
1020 			s = CSR_READ_2(sc, WI_STATUS);
1021 			CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_CMD);
1022 #ifdef foo
1023 			if ((s & WI_CMD_CODE_MASK) != (cmd & WI_CMD_CODE_MASK))
1024 				return(EIO);
1025 #endif
1026 			if (s & WI_STAT_CMD_RESULT) {
1027 				count--;
1028 				return(EIO);
1029 			}
1030 			break;
1031 		}
1032 		DELAY(WI_DELAY);
1033 	}
1034 
1035 	count--;
1036 	if (i == WI_TIMEOUT) {
1037 		device_printf(sc->dev,
1038 		    "timeout in wi_cmd 0x%04x; event status 0x%04x\n", cmd, s);
1039 		return(ETIMEDOUT);
1040 	}
1041 	return(0);
1042 }
1043 
1044 static void
1045 wi_reset(sc)
1046 	struct wi_softc		*sc;
1047 {
1048 #define WI_INIT_TRIES 3
1049 	int i;
1050 	int tries;
1051 
1052 	/* Symbol firmware cannot be initialized more than once */
1053 	if (sc->sc_firmware_type == WI_SYMBOL && sc->sc_enabled)
1054 		return;
1055 	if (sc->sc_firmware_type == WI_SYMBOL)
1056 		tries = 1;
1057 	else
1058 		tries = WI_INIT_TRIES;
1059 
1060 	for (i = 0; i < tries; i++) {
1061 		if (wi_cmd(sc, WI_CMD_INI, 0, 0, 0) == 0)
1062 			break;
1063 		DELAY(WI_DELAY * 1000);
1064 	}
1065 	sc->sc_enabled = 1;
1066 
1067 	if (i == tries) {
1068 		device_printf(sc->dev, "init failed\n");
1069 		return;
1070 	}
1071 
1072 	CSR_WRITE_2(sc, WI_INT_EN, 0);
1073 	CSR_WRITE_2(sc, WI_EVENT_ACK, 0xFFFF);
1074 
1075 	/* Calibrate timer. */
1076 	WI_SETVAL(WI_RID_TICK_TIME, 8);
1077 
1078 	return;
1079 }
1080 
1081 /*
1082  * Read an LTV record from the NIC.
1083  */
1084 static int
1085 wi_read_record(sc, ltv)
1086 	struct wi_softc		*sc;
1087 	struct wi_ltv_gen	*ltv;
1088 {
1089 	u_int16_t		*ptr;
1090 	int			i, len, code;
1091 	struct wi_ltv_gen	*oltv, p2ltv;
1092 
1093 	oltv = ltv;
1094 	if (sc->sc_firmware_type != WI_LUCENT) {
1095 		switch (ltv->wi_type) {
1096 		case WI_RID_ENCRYPTION:
1097 			p2ltv.wi_type = WI_RID_P2_ENCRYPTION;
1098 			p2ltv.wi_len = 2;
1099 			ltv = &p2ltv;
1100 			break;
1101 		case WI_RID_TX_CRYPT_KEY:
1102 			p2ltv.wi_type = WI_RID_P2_TX_CRYPT_KEY;
1103 			p2ltv.wi_len = 2;
1104 			ltv = &p2ltv;
1105 			break;
1106 		case WI_RID_ROAMING_MODE:
1107 			if (sc->sc_firmware_type == WI_INTERSIL)
1108 				break;
1109 			/* not supported */
1110 			ltv->wi_len = 1;
1111 			return 0;
1112 		case WI_RID_MICROWAVE_OVEN:
1113 			/* not supported */
1114 			ltv->wi_len = 1;
1115 			return 0;
1116 		}
1117 	}
1118 
1119 	/* Tell the NIC to enter record read mode. */
1120 	if (wi_cmd(sc, WI_CMD_ACCESS|WI_ACCESS_READ, ltv->wi_type, 0, 0))
1121 		return(EIO);
1122 
1123 	/* Seek to the record. */
1124 	if (wi_seek(sc, ltv->wi_type, 0, WI_BAP1))
1125 		return(EIO);
1126 
1127 	/*
1128 	 * Read the length and record type and make sure they
1129 	 * match what we expect (this verifies that we have enough
1130 	 * room to hold all of the returned data).
1131 	 */
1132 	len = CSR_READ_2(sc, WI_DATA1);
1133 	if (len > ltv->wi_len)
1134 		return(ENOSPC);
1135 	code = CSR_READ_2(sc, WI_DATA1);
1136 	if (code != ltv->wi_type)
1137 		return(EIO);
1138 
1139 	ltv->wi_len = len;
1140 	ltv->wi_type = code;
1141 
1142 	/* Now read the data. */
1143 	ptr = &ltv->wi_val;
1144 	for (i = 0; i < ltv->wi_len - 1; i++)
1145 		ptr[i] = CSR_READ_2(sc, WI_DATA1);
1146 
1147 	if (ltv->wi_type == WI_RID_PORTTYPE && sc->wi_ptype == WI_PORTTYPE_IBSS
1148 	    && ltv->wi_val == sc->wi_ibss_port) {
1149 		/*
1150 		 * Convert vendor IBSS port type to WI_PORTTYPE_IBSS.
1151 		 * Since Lucent uses port type 1 for BSS *and* IBSS we
1152 		 * have to rely on wi_ptype to distinguish this for us.
1153 		 */
1154 		ltv->wi_val = htole16(WI_PORTTYPE_IBSS);
1155 	} else if (sc->sc_firmware_type != WI_LUCENT) {
1156 		switch (oltv->wi_type) {
1157 		case WI_RID_TX_RATE:
1158 		case WI_RID_CUR_TX_RATE:
1159 			switch (ltv->wi_val) {
1160 			case 1: oltv->wi_val = 1; break;
1161 			case 2: oltv->wi_val = 2; break;
1162 			case 3:	oltv->wi_val = 6; break;
1163 			case 4: oltv->wi_val = 5; break;
1164 			case 7: oltv->wi_val = 7; break;
1165 			case 8: oltv->wi_val = 11; break;
1166 			case 15: oltv->wi_val = 3; break;
1167 			default: oltv->wi_val = 0x100 + ltv->wi_val; break;
1168 			}
1169 			break;
1170 		case WI_RID_ENCRYPTION:
1171 			oltv->wi_len = 2;
1172 			if (ltv->wi_val & 0x01)
1173 				oltv->wi_val = 1;
1174 			else
1175 				oltv->wi_val = 0;
1176 			break;
1177 		case WI_RID_TX_CRYPT_KEY:
1178 			oltv->wi_len = 2;
1179 			oltv->wi_val = ltv->wi_val;
1180 			break;
1181 		case WI_RID_CNFAUTHMODE:
1182                         oltv->wi_len = 2;
1183 			if (le16toh(ltv->wi_val) & 0x01)
1184 				oltv->wi_val = htole16(1);
1185 			else if (le16toh(ltv->wi_val) & 0x02)
1186 				oltv->wi_val = htole16(2);
1187 			break;
1188 		}
1189 	}
1190 
1191 	return(0);
1192 }
1193 
1194 /*
1195  * Same as read, except we inject data instead of reading it.
1196  */
1197 static int
1198 wi_write_record(sc, ltv)
1199 	struct wi_softc		*sc;
1200 	struct wi_ltv_gen	*ltv;
1201 {
1202 	u_int16_t		*ptr;
1203 	int			i;
1204 	struct wi_ltv_gen	p2ltv;
1205 
1206 	if (ltv->wi_type == WI_RID_PORTTYPE &&
1207 	    le16toh(ltv->wi_val) == WI_PORTTYPE_IBSS) {
1208 		/* Convert WI_PORTTYPE_IBSS to vendor IBSS port type. */
1209 		p2ltv.wi_type = WI_RID_PORTTYPE;
1210 		p2ltv.wi_len = 2;
1211 		p2ltv.wi_val = sc->wi_ibss_port;
1212 		ltv = &p2ltv;
1213 	} else if (sc->sc_firmware_type != WI_LUCENT) {
1214 		switch (ltv->wi_type) {
1215 		case WI_RID_TX_RATE:
1216 			p2ltv.wi_type = WI_RID_TX_RATE;
1217 			p2ltv.wi_len = 2;
1218 			switch (ltv->wi_val) {
1219 			case 1: p2ltv.wi_val = 1; break;
1220 			case 2: p2ltv.wi_val = 2; break;
1221 			case 3:	p2ltv.wi_val = 15; break;
1222 			case 5: p2ltv.wi_val = 4; break;
1223 			case 6: p2ltv.wi_val = 3; break;
1224 			case 7: p2ltv.wi_val = 7; break;
1225 			case 11: p2ltv.wi_val = 8; break;
1226 			default: return EINVAL;
1227 			}
1228 			ltv = &p2ltv;
1229 			break;
1230 		case WI_RID_ENCRYPTION:
1231 			p2ltv.wi_type = WI_RID_P2_ENCRYPTION;
1232 			p2ltv.wi_len = 2;
1233 			if (le16toh(ltv->wi_val)) {
1234 				p2ltv.wi_val =htole16(PRIVACY_INVOKED |
1235 				    EXCLUDE_UNENCRYPTED);
1236 				if (sc->wi_ptype == WI_PORTTYPE_AP)
1237 					/*
1238 					 * Disable tx encryption...
1239 					 * it's broken.
1240 					 */
1241 					p2ltv.wi_val |= htole16(HOST_ENCRYPT);
1242 			} else
1243 				p2ltv.wi_val =
1244 				    htole16(HOST_ENCRYPT | HOST_DECRYPT);
1245 			ltv = &p2ltv;
1246 			break;
1247 		case WI_RID_TX_CRYPT_KEY:
1248 			p2ltv.wi_type = WI_RID_P2_TX_CRYPT_KEY;
1249 			p2ltv.wi_len = 2;
1250 			p2ltv.wi_val = ltv->wi_val;
1251 			ltv = &p2ltv;
1252 			break;
1253 		case WI_RID_DEFLT_CRYPT_KEYS:
1254 		    {
1255 			int error;
1256 			int keylen;
1257 			struct wi_ltv_str	ws;
1258 			struct wi_ltv_keys	*wk =
1259 			    (struct wi_ltv_keys *)ltv;
1260 
1261 			keylen = wk->wi_keys[sc->wi_tx_key].wi_keylen;
1262 
1263 			for (i = 0; i < 4; i++) {
1264 				bzero(&ws, sizeof(ws));
1265 				ws.wi_len = (keylen > 5) ? 8 : 4;
1266 				ws.wi_type = WI_RID_P2_CRYPT_KEY0 + i;
1267 				memcpy(ws.wi_str,
1268 				    &wk->wi_keys[i].wi_keydat, keylen);
1269 				error = wi_write_record(sc,
1270 				    (struct wi_ltv_gen *)&ws);
1271 				if (error)
1272 					return error;
1273 			}
1274 			return 0;
1275 		    }
1276 		case WI_RID_CNFAUTHMODE:
1277 			p2ltv.wi_type = WI_RID_CNFAUTHMODE;
1278 			p2ltv.wi_len = 2;
1279 			if (le16toh(ltv->wi_val) == 1)
1280 				p2ltv.wi_val = htole16(0x01);
1281 			else if (le16toh(ltv->wi_val) == 2)
1282 				p2ltv.wi_val = htole16(0x02);
1283 			ltv = &p2ltv;
1284 			break;
1285 		case WI_RID_ROAMING_MODE:
1286 			if (sc->sc_firmware_type == WI_INTERSIL)
1287 				break;
1288 			/* not supported */
1289 			return 0;
1290 		case WI_RID_MICROWAVE_OVEN:
1291 			/* not supported */
1292 			return 0;
1293 		}
1294 	} else {
1295 		/* LUCENT */
1296 		switch (ltv->wi_type) {
1297 		case WI_RID_TX_RATE:
1298 			switch (ltv->wi_val) {
1299 			case 1: ltv->wi_val = 1; break;  /* 1Mb/s fixed */
1300 			case 2: ltv->wi_val = 2; break;  /* 2Mb/s fixed */
1301 			case 3: ltv->wi_val = 3; break;  /* 11Mb/s auto */
1302 			case 5: ltv->wi_val = 4; break;  /* 5.5Mb/s fixed */
1303 			case 6: ltv->wi_val = 6; break;  /* 2Mb/s auto */
1304 			case 7: ltv->wi_val = 7; break;  /* 5.5Mb/s auto */
1305 			case 11: ltv->wi_val = 5; break; /* 11Mb/s fixed */
1306 			default: return EINVAL;
1307 			}
1308 		}
1309 	}
1310 
1311 	if (wi_seek(sc, ltv->wi_type, 0, WI_BAP1))
1312 		return(EIO);
1313 
1314 	CSR_WRITE_2(sc, WI_DATA1, ltv->wi_len);
1315 	CSR_WRITE_2(sc, WI_DATA1, ltv->wi_type);
1316 
1317 	ptr = &ltv->wi_val;
1318 	for (i = 0; i < ltv->wi_len - 1; i++)
1319 		CSR_WRITE_2(sc, WI_DATA1, ptr[i]);
1320 
1321 	if (wi_cmd(sc, WI_CMD_ACCESS|WI_ACCESS_WRITE, ltv->wi_type, 0, 0))
1322 		return(EIO);
1323 
1324 	return(0);
1325 }
1326 
1327 static int
1328 wi_seek(sc, id, off, chan)
1329 	struct wi_softc		*sc;
1330 	int			id, off, chan;
1331 {
1332 	int			i;
1333 	int			selreg, offreg;
1334 	int			status;
1335 
1336 	switch (chan) {
1337 	case WI_BAP0:
1338 		selreg = WI_SEL0;
1339 		offreg = WI_OFF0;
1340 		break;
1341 	case WI_BAP1:
1342 		selreg = WI_SEL1;
1343 		offreg = WI_OFF1;
1344 		break;
1345 	default:
1346 		device_printf(sc->dev, "invalid data path: %x\n", chan);
1347 		return(EIO);
1348 	}
1349 
1350 	CSR_WRITE_2(sc, selreg, id);
1351 	CSR_WRITE_2(sc, offreg, off);
1352 
1353 	for (i = 0; i < WI_TIMEOUT; i++) {
1354 		status = CSR_READ_2(sc, offreg);
1355 		if (!(status & (WI_OFF_BUSY|WI_OFF_ERR)))
1356 			break;
1357 		DELAY(WI_DELAY);
1358 	}
1359 
1360 	if (i == WI_TIMEOUT) {
1361 		device_printf(sc->dev, "timeout in wi_seek to %x/%x; last status %x\n",
1362 			id, off, status);
1363 		return(ETIMEDOUT);
1364 	}
1365 
1366 	return(0);
1367 }
1368 
1369 static int
1370 wi_read_data(sc, id, off, buf, len)
1371 	struct wi_softc		*sc;
1372 	int			id, off;
1373 	caddr_t			buf;
1374 	int			len;
1375 {
1376 	int			i;
1377 	u_int16_t		*ptr;
1378 
1379 	if (wi_seek(sc, id, off, WI_BAP1))
1380 		return(EIO);
1381 
1382 	ptr = (u_int16_t *)buf;
1383 	for (i = 0; i < len / 2; i++)
1384 		ptr[i] = CSR_READ_2(sc, WI_DATA1);
1385 
1386 	return(0);
1387 }
1388 
1389 /*
1390  * According to the comments in the HCF Light code, there is a bug in
1391  * the Hermes (or possibly in certain Hermes firmware revisions) where
1392  * the chip's internal autoincrement counter gets thrown off during
1393  * data writes: the autoincrement is missed, causing one data word to
1394  * be overwritten and subsequent words to be written to the wrong memory
1395  * locations. The end result is that we could end up transmitting bogus
1396  * frames without realizing it. The workaround for this is to write a
1397  * couple of extra guard words after the end of the transfer, then
1398  * attempt to read then back. If we fail to locate the guard words where
1399  * we expect them, we preform the transfer over again.
1400  */
1401 static int
1402 wi_write_data(sc, id, off, buf, len)
1403 	struct wi_softc		*sc;
1404 	int			id, off;
1405 	caddr_t			buf;
1406 	int			len;
1407 {
1408 	int			i;
1409 	u_int16_t		*ptr;
1410 #ifdef WI_HERMES_AUTOINC_WAR
1411 	int			retries;
1412 
1413 	retries = 512;
1414 again:
1415 #endif
1416 
1417 	if (wi_seek(sc, id, off, WI_BAP0))
1418 		return(EIO);
1419 
1420 	ptr = (u_int16_t *)buf;
1421 	for (i = 0; i < (len / 2); i++)
1422 		CSR_WRITE_2(sc, WI_DATA0, ptr[i]);
1423 
1424 #ifdef WI_HERMES_AUTOINC_WAR
1425 	CSR_WRITE_2(sc, WI_DATA0, 0x1234);
1426 	CSR_WRITE_2(sc, WI_DATA0, 0x5678);
1427 
1428 	if (wi_seek(sc, id, off + len, WI_BAP0))
1429 		return(EIO);
1430 
1431 	if (CSR_READ_2(sc, WI_DATA0) != 0x1234 ||
1432 	    CSR_READ_2(sc, WI_DATA0) != 0x5678) {
1433 		if (--retries >= 0)
1434 			goto again;
1435 		device_printf(sc->dev, "wi_write_data device timeout\n");
1436 		return (EIO);
1437 	}
1438 #endif
1439 
1440 	return(0);
1441 }
1442 
1443 /*
1444  * Allocate a region of memory inside the NIC and zero
1445  * it out.
1446  */
1447 static int
1448 wi_alloc_nicmem(sc, len, id)
1449 	struct wi_softc		*sc;
1450 	int			len;
1451 	int			*id;
1452 {
1453 	int			i;
1454 
1455 	if (wi_cmd(sc, WI_CMD_ALLOC_MEM, len, 0, 0)) {
1456 		device_printf(sc->dev,
1457 		    "failed to allocate %d bytes on NIC\n", len);
1458 		return(ENOMEM);
1459 	}
1460 
1461 	for (i = 0; i < WI_TIMEOUT; i++) {
1462 		if (CSR_READ_2(sc, WI_EVENT_STAT) & WI_EV_ALLOC)
1463 			break;
1464 		DELAY(WI_DELAY);
1465 	}
1466 
1467 	if (i == WI_TIMEOUT) {
1468 		device_printf(sc->dev, "time out allocating memory on card\n");
1469 		return(ETIMEDOUT);
1470 	}
1471 
1472 	CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_ALLOC);
1473 	*id = CSR_READ_2(sc, WI_ALLOC_FID);
1474 
1475 	if (wi_seek(sc, *id, 0, WI_BAP0)) {
1476 		device_printf(sc->dev, "seek failed while allocating memory on card\n");
1477 		return(EIO);
1478 	}
1479 
1480 	for (i = 0; i < len / 2; i++)
1481 		CSR_WRITE_2(sc, WI_DATA0, 0);
1482 
1483 	return(0);
1484 }
1485 
1486 static void
1487 wi_setmulti(sc)
1488 	struct wi_softc		*sc;
1489 {
1490 	struct ifnet		*ifp;
1491 	int			i = 0;
1492 	struct ifmultiaddr	*ifma;
1493 	struct wi_ltv_mcast	mcast;
1494 
1495 	ifp = &sc->arpcom.ac_if;
1496 
1497 	bzero((char *)&mcast, sizeof(mcast));
1498 
1499 	mcast.wi_type = WI_RID_MCAST_LIST;
1500 	mcast.wi_len = (3 * 16) + 1;
1501 
1502 	if (ifp->if_flags & IFF_ALLMULTI || ifp->if_flags & IFF_PROMISC) {
1503 		wi_write_record(sc, (struct wi_ltv_gen *)&mcast);
1504 		return;
1505 	}
1506 
1507 #if __FreeBSD_version < 500000
1508 	LIST_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
1509 #else
1510 	TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
1511 #endif
1512 		if (ifma->ifma_addr->sa_family != AF_LINK)
1513 			continue;
1514 		if (i < 16) {
1515 			bcopy(LLADDR((struct sockaddr_dl *)ifma->ifma_addr),
1516 			    (char *)&mcast.wi_mcast[i], ETHER_ADDR_LEN);
1517 			i++;
1518 		} else {
1519 			bzero((char *)&mcast, sizeof(mcast));
1520 			break;
1521 		}
1522 	}
1523 
1524 	mcast.wi_len = (i * 3) + 1;
1525 	wi_write_record(sc, (struct wi_ltv_gen *)&mcast);
1526 
1527 	return;
1528 }
1529 
1530 static void
1531 wi_setdef(sc, wreq)
1532 	struct wi_softc		*sc;
1533 	struct wi_req		*wreq;
1534 {
1535 	struct sockaddr_dl	*sdl;
1536 	struct ifaddr		*ifa;
1537 	struct ifnet		*ifp;
1538 
1539 	ifp = &sc->arpcom.ac_if;
1540 
1541 	switch(wreq->wi_type) {
1542 	case WI_RID_MAC_NODE:
1543 		ifa = ifaddr_byindex(ifp->if_index);
1544 		sdl = (struct sockaddr_dl *)ifa->ifa_addr;
1545 		bcopy((char *)&wreq->wi_val, (char *)&sc->arpcom.ac_enaddr,
1546 		   ETHER_ADDR_LEN);
1547 		bcopy((char *)&wreq->wi_val, LLADDR(sdl), ETHER_ADDR_LEN);
1548 		break;
1549 	case WI_RID_PORTTYPE:
1550 		sc->wi_ptype = le16toh(wreq->wi_val[0]);
1551 		break;
1552 	case WI_RID_TX_RATE:
1553 		sc->wi_tx_rate = le16toh(wreq->wi_val[0]);
1554 		break;
1555 	case WI_RID_MAX_DATALEN:
1556 		sc->wi_max_data_len = le16toh(wreq->wi_val[0]);
1557 		break;
1558 	case WI_RID_RTS_THRESH:
1559 		sc->wi_rts_thresh = le16toh(wreq->wi_val[0]);
1560 		break;
1561 	case WI_RID_SYSTEM_SCALE:
1562 		sc->wi_ap_density = le16toh(wreq->wi_val[0]);
1563 		break;
1564 	case WI_RID_CREATE_IBSS:
1565 		sc->wi_create_ibss = le16toh(wreq->wi_val[0]);
1566 		break;
1567 	case WI_RID_OWN_CHNL:
1568 		sc->wi_channel = le16toh(wreq->wi_val[0]);
1569 		break;
1570 	case WI_RID_NODENAME:
1571 		bzero(sc->wi_node_name, sizeof(sc->wi_node_name));
1572 		bcopy((char *)&wreq->wi_val[1], sc->wi_node_name, 30);
1573 		break;
1574 	case WI_RID_DESIRED_SSID:
1575 		bzero(sc->wi_net_name, sizeof(sc->wi_net_name));
1576 		bcopy((char *)&wreq->wi_val[1], sc->wi_net_name, 30);
1577 		break;
1578 	case WI_RID_OWN_SSID:
1579 		bzero(sc->wi_ibss_name, sizeof(sc->wi_ibss_name));
1580 		bcopy((char *)&wreq->wi_val[1], sc->wi_ibss_name, 30);
1581 		break;
1582 	case WI_RID_PM_ENABLED:
1583 		sc->wi_pm_enabled = le16toh(wreq->wi_val[0]);
1584 		break;
1585 	case WI_RID_MICROWAVE_OVEN:
1586 		sc->wi_mor_enabled = le16toh(wreq->wi_val[0]);
1587 		break;
1588 	case WI_RID_MAX_SLEEP:
1589 		sc->wi_max_sleep = le16toh(wreq->wi_val[0]);
1590 		break;
1591 	case WI_RID_CNFAUTHMODE:
1592 		sc->wi_authtype = le16toh(wreq->wi_val[0]);
1593 		break;
1594 	case WI_RID_ROAMING_MODE:
1595 		sc->wi_roaming = le16toh(wreq->wi_val[0]);
1596 		break;
1597 	case WI_RID_ENCRYPTION:
1598 		sc->wi_use_wep = le16toh(wreq->wi_val[0]);
1599 		break;
1600 	case WI_RID_TX_CRYPT_KEY:
1601 		sc->wi_tx_key = le16toh(wreq->wi_val[0]);
1602 		break;
1603 	case WI_RID_DEFLT_CRYPT_KEYS:
1604 		bcopy((char *)wreq, (char *)&sc->wi_keys,
1605 		    sizeof(struct wi_ltv_keys));
1606 		break;
1607 	default:
1608 		break;
1609 	}
1610 
1611 	/* Reinitialize WaveLAN. */
1612 	wi_init(sc);
1613 
1614 	return;
1615 }
1616 
1617 static int
1618 wi_ioctl(ifp, command, data)
1619 	struct ifnet		*ifp;
1620 	u_long			command;
1621 	caddr_t			data;
1622 {
1623 	int			error = 0;
1624 	int			len;
1625 	u_int8_t		tmpkey[14];
1626 	char			tmpssid[IEEE80211_NWID_LEN];
1627 	struct wi_softc		*sc;
1628 	struct wi_req		wreq;
1629 	struct ifreq		*ifr;
1630 	struct ieee80211req	*ireq;
1631 	struct thread		*td = curthread;
1632 	int			s;
1633 
1634 	sc = ifp->if_softc;
1635 	WI_LOCK(sc, s);
1636 	ifr = (struct ifreq *)data;
1637 	ireq = (struct ieee80211req *)data;
1638 
1639 	if (sc->wi_gone) {
1640 		error = ENODEV;
1641 		goto out;
1642 	}
1643 
1644 	switch(command) {
1645 	case SIOCSIFADDR:
1646 	case SIOCGIFADDR:
1647 	case SIOCSIFMTU:
1648 		error = ether_ioctl(ifp, command, data);
1649 		break;
1650 	case SIOCSIFFLAGS:
1651 		/*
1652 		 * Can't do promisc and hostap at the same time.  If all that's
1653 		 * changing is the promisc flag, try to short-circuit a call to
1654 		 * wi_init() by just setting PROMISC in the hardware.
1655 		 */
1656 		if (ifp->if_flags & IFF_UP) {
1657 			if (sc->wi_ptype != WI_PORTTYPE_AP &&
1658 			    ifp->if_flags & IFF_RUNNING) {
1659 				if (ifp->if_flags & IFF_PROMISC &&
1660 				    !(sc->wi_if_flags & IFF_PROMISC)) {
1661 					WI_SETVAL(WI_RID_PROMISC, 1);
1662 				} else if (!(ifp->if_flags & IFF_PROMISC) &&
1663 				    sc->wi_if_flags & IFF_PROMISC) {
1664 					WI_SETVAL(WI_RID_PROMISC, 0);
1665 				} else {
1666 					wi_init(sc);
1667 				}
1668 			} else {
1669 				wi_init(sc);
1670 			}
1671 		} else {
1672 			if (ifp->if_flags & IFF_RUNNING) {
1673 				wi_stop(sc);
1674 			}
1675 		}
1676 		sc->wi_if_flags = ifp->if_flags;
1677 		error = 0;
1678 		break;
1679 	case SIOCSIFMEDIA:
1680 	case SIOCGIFMEDIA:
1681 		error = ifmedia_ioctl(ifp, ifr, &sc->ifmedia, command);
1682 		break;
1683 	case SIOCADDMULTI:
1684 	case SIOCDELMULTI:
1685 		wi_setmulti(sc);
1686 		error = 0;
1687 		break;
1688 	case SIOCGWAVELAN:
1689 		error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1690 		if (error)
1691 			break;
1692 		if (wreq.wi_len > WI_MAX_DATALEN) {
1693 			error = EINVAL;
1694 			break;
1695 		}
1696 		/* Don't show WEP keys to non-root users. */
1697 		if (wreq.wi_type == WI_RID_DEFLT_CRYPT_KEYS && suser(td))
1698 			break;
1699 		if (wreq.wi_type == WI_RID_IFACE_STATS) {
1700 			bcopy((char *)&sc->wi_stats, (char *)&wreq.wi_val,
1701 			    sizeof(sc->wi_stats));
1702 			wreq.wi_len = (sizeof(sc->wi_stats) / 2) + 1;
1703 		} else if (wreq.wi_type == WI_RID_DEFLT_CRYPT_KEYS) {
1704 			bcopy((char *)&sc->wi_keys, (char *)&wreq,
1705 			    sizeof(struct wi_ltv_keys));
1706 		}
1707 #ifdef WICACHE
1708 		else if (wreq.wi_type == WI_RID_ZERO_CACHE) {
1709 			sc->wi_sigitems = sc->wi_nextitem = 0;
1710 		} else if (wreq.wi_type == WI_RID_READ_CACHE) {
1711 			char *pt = (char *)&wreq.wi_val;
1712 			bcopy((char *)&sc->wi_sigitems,
1713 			    (char *)pt, sizeof(int));
1714 			pt += (sizeof (int));
1715 			wreq.wi_len = sizeof(int) / 2;
1716 			bcopy((char *)&sc->wi_sigcache, (char *)pt,
1717 			    sizeof(struct wi_sigcache) * sc->wi_sigitems);
1718 			wreq.wi_len += ((sizeof(struct wi_sigcache) *
1719 			    sc->wi_sigitems) / 2) + 1;
1720 		}
1721 #endif
1722 		else if (wreq.wi_type == WI_RID_PROCFRAME) {
1723 			wreq.wi_len = 2;
1724 			wreq.wi_val[0] = sc->wi_procframe;
1725 		} else if (wreq.wi_type == WI_RID_PRISM2) {
1726 			wreq.wi_len = 2;
1727 			wreq.wi_val[0] = sc->sc_firmware_type != WI_LUCENT;
1728 		} else if (wreq.wi_type == WI_RID_SCAN_RES &&
1729 		    sc->sc_firmware_type == WI_LUCENT) {
1730 			memcpy((char *)wreq.wi_val, (char *)sc->wi_scanbuf,
1731 			    sc->wi_scanbuf_len * 2);
1732 			wreq.wi_len = sc->wi_scanbuf_len;
1733 		} else {
1734 			if (wi_read_record(sc, (struct wi_ltv_gen *)&wreq)) {
1735 				error = EINVAL;
1736 				break;
1737 			}
1738 		}
1739 		error = copyout(&wreq, ifr->ifr_data, sizeof(wreq));
1740 		break;
1741 	case SIOCSWAVELAN:
1742 		if ((error = suser(td)))
1743 			goto out;
1744 		error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1745 		if (error)
1746 			break;
1747 		if (wreq.wi_len > WI_MAX_DATALEN) {
1748 			error = EINVAL;
1749 			break;
1750 		}
1751 		if (wreq.wi_type == WI_RID_IFACE_STATS) {
1752 			error = EINVAL;
1753 			break;
1754 		} else if (wreq.wi_type == WI_RID_MGMT_XMIT) {
1755 			error = wi_mgmt_xmit(sc, (caddr_t)&wreq.wi_val,
1756 			    wreq.wi_len);
1757 		} else if (wreq.wi_type == WI_RID_PROCFRAME) {
1758 			sc->wi_procframe = wreq.wi_val[0];
1759 		/*
1760 		 * if we're getting a scan request from a wavelan card
1761 		 * (non-prism2), send out a cmd_inquire to the card to scan
1762 		 * results for the scan will be received through the info
1763 		 * interrupt handler. otherwise the scan request can be
1764 		 * directly handled by a prism2 card's rid interface.
1765 		 */
1766 		} else if (wreq.wi_type == WI_RID_SCAN_REQ &&
1767 		    sc->sc_firmware_type == WI_LUCENT) {
1768 			wi_cmd(sc, WI_CMD_INQUIRE, WI_INFO_SCAN_RESULTS, 0, 0);
1769 		} else {
1770 			error = wi_write_record(sc, (struct wi_ltv_gen *)&wreq);
1771 			if (!error)
1772 				wi_setdef(sc, &wreq);
1773 		}
1774 		break;
1775 	case SIOCGPRISM2DEBUG:
1776 		error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1777 		if (error)
1778 			break;
1779 		if (!(ifp->if_flags & IFF_RUNNING) ||
1780 		    sc->sc_firmware_type == WI_LUCENT) {
1781 			error = EIO;
1782 			break;
1783 		}
1784 		error = wi_get_debug(sc, &wreq);
1785 		if (error == 0)
1786 			error = copyout(&wreq, ifr->ifr_data, sizeof(wreq));
1787 		break;
1788 	case SIOCSPRISM2DEBUG:
1789 		if ((error = suser(td)))
1790 			goto out;
1791 		error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1792 		if (error)
1793 			break;
1794 		error = wi_set_debug(sc, &wreq);
1795 		break;
1796 	case SIOCG80211:
1797 		switch(ireq->i_type) {
1798 		case IEEE80211_IOC_SSID:
1799 			if(ireq->i_val == -1) {
1800 				bzero(tmpssid, IEEE80211_NWID_LEN);
1801 				error = wi_get_cur_ssid(sc, tmpssid, &len);
1802 				if (error != 0)
1803 					break;
1804 				error = copyout(tmpssid, ireq->i_data,
1805 					IEEE80211_NWID_LEN);
1806 				ireq->i_len = len;
1807 			} else if (ireq->i_val == 0) {
1808 				error = copyout(sc->wi_net_name,
1809 				    ireq->i_data,
1810 				    IEEE80211_NWID_LEN);
1811 				ireq->i_len = IEEE80211_NWID_LEN;
1812 			} else
1813 				error = EINVAL;
1814 			break;
1815 		case IEEE80211_IOC_NUMSSIDS:
1816 			ireq->i_val = 1;
1817 			break;
1818 		case IEEE80211_IOC_WEP:
1819 			if(!sc->wi_has_wep) {
1820 				ireq->i_val = IEEE80211_WEP_NOSUP;
1821 			} else {
1822 				if(sc->wi_use_wep) {
1823 					ireq->i_val =
1824 					    IEEE80211_WEP_MIXED;
1825 				} else {
1826 					ireq->i_val =
1827 					    IEEE80211_WEP_OFF;
1828 				}
1829 			}
1830 			break;
1831 		case IEEE80211_IOC_WEPKEY:
1832 			if(!sc->wi_has_wep ||
1833 			    ireq->i_val < 0 || ireq->i_val > 3) {
1834 				error = EINVAL;
1835 				break;
1836 			}
1837 			len = sc->wi_keys.wi_keys[ireq->i_val].wi_keylen;
1838 			if (suser(td))
1839 				bcopy(sc->wi_keys.wi_keys[ireq->i_val].wi_keydat,
1840 				    tmpkey, len);
1841 			else
1842 				bzero(tmpkey, len);
1843 
1844 			ireq->i_len = len;
1845 			error = copyout(tmpkey, ireq->i_data, len);
1846 
1847 			break;
1848 		case IEEE80211_IOC_NUMWEPKEYS:
1849 			if(!sc->wi_has_wep)
1850 				error = EINVAL;
1851 			else
1852 				ireq->i_val = 4;
1853 			break;
1854 		case IEEE80211_IOC_WEPTXKEY:
1855 			if(!sc->wi_has_wep)
1856 				error = EINVAL;
1857 			else
1858 				ireq->i_val = sc->wi_tx_key;
1859 			break;
1860 		case IEEE80211_IOC_AUTHMODE:
1861 			ireq->i_val = sc->wi_authmode;
1862 			break;
1863 		case IEEE80211_IOC_STATIONNAME:
1864 			error = copyout(sc->wi_node_name,
1865 			    ireq->i_data, IEEE80211_NWID_LEN);
1866 			ireq->i_len = IEEE80211_NWID_LEN;
1867 			break;
1868 		case IEEE80211_IOC_CHANNEL:
1869 			wreq.wi_type = WI_RID_CURRENT_CHAN;
1870 			wreq.wi_len = WI_MAX_DATALEN;
1871 			if (wi_read_record(sc, (struct wi_ltv_gen *)&wreq))
1872 				error = EINVAL;
1873 			else {
1874 				ireq->i_val = wreq.wi_val[0];
1875 			}
1876 			break;
1877 		case IEEE80211_IOC_POWERSAVE:
1878 			if(sc->wi_pm_enabled)
1879 				ireq->i_val = IEEE80211_POWERSAVE_ON;
1880 			else
1881 				ireq->i_val = IEEE80211_POWERSAVE_OFF;
1882 			break;
1883 		case IEEE80211_IOC_POWERSAVESLEEP:
1884 			ireq->i_val = sc->wi_max_sleep;
1885 			break;
1886 		default:
1887 			error = EINVAL;
1888 		}
1889 		break;
1890 	case SIOCS80211:
1891 		if ((error = suser(td)))
1892 			goto out;
1893 		switch(ireq->i_type) {
1894 		case IEEE80211_IOC_SSID:
1895 			if (ireq->i_val != 0 ||
1896 			    ireq->i_len > IEEE80211_NWID_LEN) {
1897 				error = EINVAL;
1898 				break;
1899 			}
1900 			/* We set both of them */
1901 			bzero(sc->wi_net_name, IEEE80211_NWID_LEN);
1902 			error = copyin(ireq->i_data,
1903 			    sc->wi_net_name, ireq->i_len);
1904 			bcopy(sc->wi_net_name, sc->wi_ibss_name, IEEE80211_NWID_LEN);
1905 			break;
1906 		case IEEE80211_IOC_WEP:
1907 			/*
1908 			 * These cards only support one mode so
1909 			 * we just turn wep on what ever is
1910 			 * passed in if it's not OFF.
1911 			 */
1912 			if (ireq->i_val == IEEE80211_WEP_OFF) {
1913 				sc->wi_use_wep = 0;
1914 			} else {
1915 				sc->wi_use_wep = 1;
1916 			}
1917 			break;
1918 		case IEEE80211_IOC_WEPKEY:
1919 			if (ireq->i_val < 0 || ireq->i_val > 3 ||
1920 				ireq->i_len > 13) {
1921 				error = EINVAL;
1922 				break;
1923 			}
1924 			bzero(sc->wi_keys.wi_keys[ireq->i_val].wi_keydat, 13);
1925 			error = copyin(ireq->i_data,
1926 			    sc->wi_keys.wi_keys[ireq->i_val].wi_keydat,
1927 			    ireq->i_len);
1928 			if(error)
1929 				break;
1930 			sc->wi_keys.wi_keys[ireq->i_val].wi_keylen =
1931 				    ireq->i_len;
1932 			break;
1933 		case IEEE80211_IOC_WEPTXKEY:
1934 			if (ireq->i_val < 0 || ireq->i_val > 3) {
1935 				error = EINVAL;
1936 				break;
1937 			}
1938 			sc->wi_tx_key = ireq->i_val;
1939 			break;
1940 		case IEEE80211_IOC_AUTHMODE:
1941 			sc->wi_authmode = ireq->i_val;
1942 			break;
1943 		case IEEE80211_IOC_STATIONNAME:
1944 			if (ireq->i_len > 32) {
1945 				error = EINVAL;
1946 				break;
1947 			}
1948 			bzero(sc->wi_node_name, 32);
1949 			error = copyin(ireq->i_data,
1950 			    sc->wi_node_name, ireq->i_len);
1951 			break;
1952 		case IEEE80211_IOC_CHANNEL:
1953 			/*
1954 			 * The actual range is 1-14, but if you
1955 			 * set it to 0 you get the default. So
1956 			 * we let that work too.
1957 			 */
1958 			if (ireq->i_val < 0 || ireq->i_val > 14) {
1959 				error = EINVAL;
1960 				break;
1961 			}
1962 			sc->wi_channel = ireq->i_val;
1963 			break;
1964 		case IEEE80211_IOC_POWERSAVE:
1965 			switch (ireq->i_val) {
1966 			case IEEE80211_POWERSAVE_OFF:
1967 				sc->wi_pm_enabled = 0;
1968 				break;
1969 			case IEEE80211_POWERSAVE_ON:
1970 				sc->wi_pm_enabled = 1;
1971 				break;
1972 			default:
1973 				error = EINVAL;
1974 				break;
1975 			}
1976 			break;
1977 		case IEEE80211_IOC_POWERSAVESLEEP:
1978 			if (ireq->i_val < 0) {
1979 				error = EINVAL;
1980 				break;
1981 			}
1982 			sc->wi_max_sleep = ireq->i_val;
1983 			break;
1984 		default:
1985 			error = EINVAL;
1986 			break;
1987 		}
1988 
1989 		/* Reinitialize WaveLAN. */
1990 		wi_init(sc);
1991 
1992 	break;
1993 	case SIOCHOSTAP_ADD:
1994 	case SIOCHOSTAP_DEL:
1995 	case SIOCHOSTAP_GET:
1996 	case SIOCHOSTAP_GETALL:
1997 	case SIOCHOSTAP_GFLAGS:
1998 	case SIOCHOSTAP_SFLAGS:
1999 		/* Send all Host AP specific ioctl's to Host AP code. */
2000 		error = wihap_ioctl(sc, command, data);
2001 		break;
2002 	default:
2003 		error = EINVAL;
2004 		break;
2005 	}
2006 out:
2007 	WI_UNLOCK(sc, s);
2008 
2009 	return(error);
2010 }
2011 
2012 static void
2013 wi_init(xsc)
2014 	void			*xsc;
2015 {
2016 	struct wi_softc		*sc = xsc;
2017 	struct ifnet		*ifp = &sc->arpcom.ac_if;
2018 	struct wi_ltv_macaddr	mac;
2019 	int			id = 0;
2020 	int			s;
2021 
2022 	WI_LOCK(sc, s);
2023 
2024 	if (sc->wi_gone) {
2025 		WI_UNLOCK(sc, s);
2026 		return;
2027 	}
2028 
2029 	if (ifp->if_flags & IFF_RUNNING)
2030 		wi_stop(sc);
2031 
2032 	wi_reset(sc);
2033 
2034 	/* Program max data length. */
2035 	WI_SETVAL(WI_RID_MAX_DATALEN, sc->wi_max_data_len);
2036 
2037 	/* Set the port type. */
2038 	WI_SETVAL(WI_RID_PORTTYPE, sc->wi_ptype);
2039 
2040 	/* Enable/disable IBSS creation. */
2041 	WI_SETVAL(WI_RID_CREATE_IBSS, sc->wi_create_ibss);
2042 
2043 	/* Program the RTS/CTS threshold. */
2044 	WI_SETVAL(WI_RID_RTS_THRESH, sc->wi_rts_thresh);
2045 
2046 	/* Program the TX rate */
2047 	WI_SETVAL(WI_RID_TX_RATE, sc->wi_tx_rate);
2048 
2049 	/* Access point density */
2050 	WI_SETVAL(WI_RID_SYSTEM_SCALE, sc->wi_ap_density);
2051 
2052 	/* Power Management Enabled */
2053 	WI_SETVAL(WI_RID_PM_ENABLED, sc->wi_pm_enabled);
2054 
2055 	/* Power Managment Max Sleep */
2056 	WI_SETVAL(WI_RID_MAX_SLEEP, sc->wi_max_sleep);
2057 
2058 	/* Roaming type */
2059 	WI_SETVAL(WI_RID_ROAMING_MODE, sc->wi_roaming);
2060 
2061 	/* Specify the IBSS name */
2062 	WI_SETSTR(WI_RID_OWN_SSID, sc->wi_ibss_name);
2063 
2064 	/* Specify the network name */
2065 	WI_SETSTR(WI_RID_DESIRED_SSID, sc->wi_net_name);
2066 
2067 	/* Specify the frequency to use */
2068 	WI_SETVAL(WI_RID_OWN_CHNL, sc->wi_channel);
2069 
2070 	/* Program the nodename. */
2071 	WI_SETSTR(WI_RID_NODENAME, sc->wi_node_name);
2072 
2073 	/* Specify the authentication mode. */
2074 	WI_SETVAL(WI_RID_CNFAUTHMODE, sc->wi_authmode);
2075 
2076 	/* Set our MAC address. */
2077 	mac.wi_len = 4;
2078 	mac.wi_type = WI_RID_MAC_NODE;
2079 	bcopy((char *)&sc->arpcom.ac_enaddr,
2080 	   (char *)&mac.wi_mac_addr, ETHER_ADDR_LEN);
2081 	wi_write_record(sc, (struct wi_ltv_gen *)&mac);
2082 
2083 	/*
2084 	 * Initialize promisc mode.
2085 	 *      Being in the Host-AP mode causes
2086 	 *      great deal of pain if promisc mode is set.
2087 	 *      Therefore we avoid confusing the firmware
2088 	 *      and always reset promisc mode in Host-AP regime,
2089 	 *      it shows us all the packets anyway.
2090 	 */
2091 	if (sc->wi_ptype != WI_PORTTYPE_AP && ifp->if_flags & IFF_PROMISC)
2092 		WI_SETVAL(WI_RID_PROMISC, 1);
2093 	else
2094 		WI_SETVAL(WI_RID_PROMISC, 0);
2095 
2096 	/* Configure WEP. */
2097 	if (sc->wi_has_wep) {
2098 		WI_SETVAL(WI_RID_ENCRYPTION, sc->wi_use_wep);
2099 		WI_SETVAL(WI_RID_TX_CRYPT_KEY, sc->wi_tx_key);
2100 		sc->wi_keys.wi_len = (sizeof(struct wi_ltv_keys) / 2) + 1;
2101 		sc->wi_keys.wi_type = WI_RID_DEFLT_CRYPT_KEYS;
2102 		wi_write_record(sc, (struct wi_ltv_gen *)&sc->wi_keys);
2103 		if (sc->sc_firmware_type != WI_LUCENT && sc->wi_use_wep) {
2104 			/*
2105 			 * ONLY HWB3163 EVAL-CARD Firmware version
2106 			 * less than 0.8 variant2
2107 			 *
2108 			 * If promiscuous mode disable, Prism2 chip
2109 			 * does not work with WEP.
2110 			 * It is under investigation for details.
2111 			 * (ichiro@netbsd.org)
2112 			 *
2113 			 * And make sure that we don't need to do it
2114 			 * in hostap mode, since it interferes with
2115 			 * the above hostap workaround.
2116 			 */
2117 			if (sc->wi_ptype != WI_PORTTYPE_AP &&
2118 			    sc->sc_firmware_type == WI_INTERSIL &&
2119 			    sc->sc_sta_firmware_ver < 802 ) {
2120 				/* firm ver < 0.8 variant 2 */
2121 				WI_SETVAL(WI_RID_PROMISC, 1);
2122 			}
2123 			WI_SETVAL(WI_RID_CNFAUTHMODE, sc->wi_authtype);
2124 		}
2125 	}
2126 
2127 	/* Set multicast filter. */
2128 	wi_setmulti(sc);
2129 
2130 	/* Enable desired port */
2131 	wi_cmd(sc, WI_CMD_ENABLE | sc->wi_portnum, 0, 0, 0);
2132 
2133 	if (wi_alloc_nicmem(sc, ETHER_MAX_LEN + sizeof(struct wi_frame) + 8, &id))
2134 		device_printf(sc->dev, "tx buffer allocation failed\n");
2135 	sc->wi_tx_data_id = id;
2136 
2137 	if (wi_alloc_nicmem(sc, ETHER_MAX_LEN + sizeof(struct wi_frame) + 8, &id))
2138 		device_printf(sc->dev, "mgmt. buffer allocation failed\n");
2139 	sc->wi_tx_mgmt_id = id;
2140 
2141 	/* enable interrupts */
2142 	CSR_WRITE_2(sc, WI_INT_EN, WI_INTRS);
2143 
2144 	wihap_init(sc);
2145 
2146 	ifp->if_flags |= IFF_RUNNING;
2147 	ifp->if_flags &= ~IFF_OACTIVE;
2148 
2149 	sc->wi_stat_ch = timeout(wi_inquire, sc, hz * 60);
2150 	WI_UNLOCK(sc, s);
2151 
2152 	return;
2153 }
2154 
2155 #define RC4STATE 256
2156 #define RC4KEYLEN 16
2157 #define RC4SWAP(x,y) \
2158     do { u_int8_t t = state[x]; state[x] = state[y]; state[y] = t; } while(0)
2159 
2160 static void
2161 wi_do_hostencrypt(struct wi_softc *sc, caddr_t buf, int len)
2162 {
2163 	u_int32_t i, crc, klen;
2164 	u_int8_t state[RC4STATE], key[RC4KEYLEN];
2165 	u_int8_t x, y, *dat;
2166 
2167 	if (!sc->wi_icv_flag) {
2168 		sc->wi_icv = arc4random();
2169 		sc->wi_icv_flag++;
2170         } else
2171 		sc->wi_icv++;
2172 	/*
2173 	 * Skip 'bad' IVs from Fluhrer/Mantin/Shamir:
2174 	 * (B, 255, N) with 3 <= B < 8
2175 	 */
2176 	if (sc->wi_icv >= 0x03ff00 &&
2177             (sc->wi_icv & 0xf8ff00) == 0x00ff00)
2178                 sc->wi_icv += 0x000100;
2179 
2180 	/* prepend 24bit IV to tx key, byte order does not matter */
2181 	key[0] = sc->wi_icv >> 16;
2182 	key[1] = sc->wi_icv >> 8;
2183 	key[2] = sc->wi_icv;
2184 
2185 	klen = sc->wi_keys.wi_keys[sc->wi_tx_key].wi_keylen +
2186 	    IEEE80211_WEP_IVLEN;
2187 	klen = (klen >= RC4KEYLEN) ? RC4KEYLEN : RC4KEYLEN/2;
2188 	bcopy((char *)&sc->wi_keys.wi_keys[sc->wi_tx_key].wi_keydat,
2189 	    (char *)key + IEEE80211_WEP_IVLEN, klen - IEEE80211_WEP_IVLEN);
2190 
2191 	/* rc4 keysetup */
2192 	x = y = 0;
2193 	for (i = 0; i < RC4STATE; i++)
2194 		state[i] = i;
2195 	for (i = 0; i < RC4STATE; i++) {
2196 		y = (key[x] + state[i] + y) % RC4STATE;
2197 		RC4SWAP(i, y);
2198 		x = (x + 1) % klen;
2199 	}
2200 
2201 	/* output: IV, tx keyid, rc4(data), rc4(crc32(data)) */
2202 	dat = buf;
2203 	dat[0] = key[0];
2204 	dat[1] = key[1];
2205 	dat[2] = key[2];
2206 	dat[3] = sc->wi_tx_key << 6;		/* pad and keyid */
2207 	dat += 4;
2208 
2209 	/* compute rc4 over data, crc32 over data */
2210 	crc = ~0;
2211 	x = y = 0;
2212 	for (i = 0; i < len; i++) {
2213 		x = (x + 1) % RC4STATE;
2214 		y = (state[x] + y) % RC4STATE;
2215 		RC4SWAP(x, y);
2216 		crc = crc32_tab[(crc ^ dat[i]) & 0xff] ^ (crc >> 8);
2217 		dat[i] ^= state[(state[x] + state[y]) % RC4STATE];
2218 	}
2219 	crc = ~crc;
2220 	dat += len;
2221 
2222 	/* append little-endian crc32 and encrypt */
2223 	dat[0] = crc;
2224 	dat[1] = crc >> 8;
2225 	dat[2] = crc >> 16;
2226 	dat[3] = crc >> 24;
2227 	for (i = 0; i < IEEE80211_WEP_CRCLEN; i++) {
2228 		x = (x + 1) % RC4STATE;
2229 		y = (state[x] + y) % RC4STATE;
2230 		RC4SWAP(x, y);
2231 		dat[i] ^= state[(state[x] + state[y]) % RC4STATE];
2232 	}
2233 }
2234 
2235 static void
2236 wi_start(ifp)
2237 	struct ifnet		*ifp;
2238 {
2239 	struct wi_softc		*sc;
2240 	struct mbuf		*m0;
2241 	struct wi_frame		tx_frame;
2242 	struct ether_header	*eh;
2243 	int			id;
2244 	int			s;
2245 
2246 	sc = ifp->if_softc;
2247 	WI_LOCK(sc, s);
2248 
2249 	if (sc->wi_gone) {
2250 		WI_UNLOCK(sc, s);
2251 		return;
2252 	}
2253 
2254 	if (ifp->if_flags & IFF_OACTIVE) {
2255 		WI_UNLOCK(sc, s);
2256 		return;
2257 	}
2258 
2259 nextpkt:
2260 	IF_DEQUEUE(&ifp->if_snd, m0);
2261 	if (m0 == NULL) {
2262 		WI_UNLOCK(sc, s);
2263 		return;
2264 	}
2265 
2266 	bzero((char *)&tx_frame, sizeof(tx_frame));
2267 	tx_frame.wi_frame_ctl = htole16(WI_FTYPE_DATA);
2268 	id = sc->wi_tx_data_id;
2269 	eh = mtod(m0, struct ether_header *);
2270 
2271 	if (sc->wi_ptype == WI_PORTTYPE_AP) {
2272 		if (!wihap_check_tx(&sc->wi_hostap_info,
2273 		    eh->ether_dhost, &tx_frame.wi_tx_rate)) {
2274 			if (ifp->if_flags & IFF_DEBUG)
2275 				printf("wi_start: dropping unassoc "
2276 				       "dst %6D\n", eh->ether_dhost, ":");
2277 			m_freem(m0);
2278 			goto nextpkt;
2279 		}
2280 	}
2281 	/*
2282 	 * Use RFC1042 encoding for IP and ARP datagrams,
2283 	 * 802.3 for anything else.
2284 	 */
2285 	if (ntohs(eh->ether_type) > ETHER_MAX_LEN) {
2286 		bcopy((char *)&eh->ether_dhost,
2287 		    (char *)&tx_frame.wi_addr1, ETHER_ADDR_LEN);
2288 		if (sc->wi_ptype == WI_PORTTYPE_AP) {
2289 			tx_frame.wi_tx_ctl = WI_ENC_TX_MGMT; /* XXX */
2290 			tx_frame.wi_frame_ctl |= WI_FCTL_FROMDS;
2291 			if (sc->wi_use_wep)
2292 				tx_frame.wi_frame_ctl |= WI_FCTL_WEP;
2293 			bcopy((char *)&sc->arpcom.ac_enaddr,
2294 			      (char *)&tx_frame.wi_addr2, ETHER_ADDR_LEN);
2295 			bcopy((char *)&eh->ether_shost,
2296 			      (char *)&tx_frame.wi_addr3, ETHER_ADDR_LEN);
2297 		}
2298 		else
2299 			bcopy((char *)&eh->ether_shost,
2300 			    (char *)&tx_frame.wi_addr2, ETHER_ADDR_LEN);
2301 		bcopy((char *)&eh->ether_dhost,
2302 		    (char *)&tx_frame.wi_dst_addr, ETHER_ADDR_LEN);
2303 		bcopy((char *)&eh->ether_shost,
2304 		    (char *)&tx_frame.wi_src_addr, ETHER_ADDR_LEN);
2305 
2306 		tx_frame.wi_dat_len = m0->m_pkthdr.len - WI_SNAPHDR_LEN;
2307 		tx_frame.wi_dat[0] = htons(WI_SNAP_WORD0);
2308 		tx_frame.wi_dat[1] = htons(WI_SNAP_WORD1);
2309 		tx_frame.wi_len = htons(m0->m_pkthdr.len - WI_SNAPHDR_LEN);
2310 		tx_frame.wi_type = eh->ether_type;
2311 
2312 		if (sc->wi_ptype == WI_PORTTYPE_AP && sc->wi_use_wep) {
2313 			/* Do host encryption. */
2314 			bcopy(&tx_frame.wi_dat[0], &sc->wi_txbuf[4], 8);
2315 			m_copydata(m0, sizeof(struct ether_header),
2316 			    m0->m_pkthdr.len - sizeof(struct ether_header),
2317 			    (caddr_t)&sc->wi_txbuf[12]);
2318 			wi_do_hostencrypt(sc, &sc->wi_txbuf[0],
2319 			    tx_frame.wi_dat_len);
2320 			tx_frame.wi_dat_len += IEEE80211_WEP_IVLEN +
2321 			    IEEE80211_WEP_KIDLEN + IEEE80211_WEP_CRCLEN;
2322 			wi_write_data(sc, id, 0, (caddr_t)&tx_frame,
2323 			    sizeof(struct wi_frame));
2324 			wi_write_data(sc, id, WI_802_11_OFFSET_RAW,
2325 			    (caddr_t)&sc->wi_txbuf, (m0->m_pkthdr.len -
2326 			    sizeof(struct ether_header)) + 18);
2327 		} else {
2328 			m_copydata(m0, sizeof(struct ether_header),
2329 			    m0->m_pkthdr.len - sizeof(struct ether_header),
2330 			    (caddr_t)&sc->wi_txbuf);
2331 			wi_write_data(sc, id, 0, (caddr_t)&tx_frame,
2332 			    sizeof(struct wi_frame));
2333 			wi_write_data(sc, id, WI_802_11_OFFSET,
2334 			    (caddr_t)&sc->wi_txbuf, (m0->m_pkthdr.len -
2335 			    sizeof(struct ether_header)) + 2);
2336 		}
2337 	} else {
2338 		tx_frame.wi_dat_len = m0->m_pkthdr.len;
2339 
2340 		if (sc->wi_ptype == WI_PORTTYPE_AP && sc->wi_use_wep) {
2341 			/* Do host encryption. */
2342 			printf( "XXX: host encrypt not implemented for 802.3\n" );
2343 		} else {
2344 			eh->ether_type = htons(m0->m_pkthdr.len -
2345 			    WI_SNAPHDR_LEN);
2346 			m_copydata(m0, 0, m0->m_pkthdr.len,
2347 			    (caddr_t)&sc->wi_txbuf);
2348 
2349 			wi_write_data(sc, id, 0, (caddr_t)&tx_frame,
2350 			    sizeof(struct wi_frame));
2351 			wi_write_data(sc, id, WI_802_3_OFFSET,
2352 			    (caddr_t)&sc->wi_txbuf, m0->m_pkthdr.len + 2);
2353 		}
2354 	}
2355 
2356 	/*
2357 	 * If there's a BPF listner, bounce a copy of
2358  	 * this frame to him. Also, don't send this to the bpf sniffer
2359  	 * if we're in procframe or monitor sniffing mode.
2360 	 */
2361  	if (!(sc->wi_procframe || sc->wi_debug.wi_monitor) && ifp->if_bpf)
2362 		bpf_mtap(ifp, m0);
2363 
2364 	m_freem(m0);
2365 
2366 	if (wi_cmd(sc, WI_CMD_TX|WI_RECLAIM, id, 0, 0))
2367 		device_printf(sc->dev, "xmit failed\n");
2368 
2369 	ifp->if_flags |= IFF_OACTIVE;
2370 
2371 	/*
2372 	 * Set a timeout in case the chip goes out to lunch.
2373 	 */
2374 	ifp->if_timer = 5;
2375 
2376 	WI_UNLOCK(sc, s);
2377 	return;
2378 }
2379 
2380 int
2381 wi_mgmt_xmit(sc, data, len)
2382 	struct wi_softc		*sc;
2383 	caddr_t			data;
2384 	int			len;
2385 {
2386 	struct wi_frame		tx_frame;
2387 	int			id;
2388 	struct wi_80211_hdr	*hdr;
2389 	caddr_t			dptr;
2390 
2391 	if (sc->wi_gone)
2392 		return(ENODEV);
2393 
2394 	hdr = (struct wi_80211_hdr *)data;
2395 	dptr = data + sizeof(struct wi_80211_hdr);
2396 
2397 	bzero((char *)&tx_frame, sizeof(tx_frame));
2398 	id = sc->wi_tx_mgmt_id;
2399 
2400 	bcopy((char *)hdr, (char *)&tx_frame.wi_frame_ctl,
2401 	   sizeof(struct wi_80211_hdr));
2402 
2403 	tx_frame.wi_tx_ctl = WI_ENC_TX_MGMT;
2404 	tx_frame.wi_dat_len = len - sizeof(struct wi_80211_hdr);
2405 	tx_frame.wi_len = htons(tx_frame.wi_dat_len);
2406 
2407 	wi_write_data(sc, id, 0, (caddr_t)&tx_frame, sizeof(struct wi_frame));
2408 	wi_write_data(sc, id, WI_802_11_OFFSET_RAW, dptr,
2409 	    len - sizeof(struct wi_80211_hdr) + 2);
2410 
2411 	if (wi_cmd(sc, WI_CMD_TX|WI_RECLAIM, id, 0, 0)) {
2412 		device_printf(sc->dev, "xmit failed\n");
2413 		return(EIO);
2414 	}
2415 
2416 	return(0);
2417 }
2418 
2419 static void
2420 wi_stop(sc)
2421 	struct wi_softc		*sc;
2422 {
2423 	struct ifnet		*ifp;
2424 	int			s;
2425 
2426 	WI_LOCK(sc, s);
2427 
2428 	if (sc->wi_gone) {
2429 		WI_UNLOCK(sc, s);
2430 		return;
2431 	}
2432 
2433 	wihap_shutdown(sc);
2434 
2435 	ifp = &sc->arpcom.ac_if;
2436 
2437 	/*
2438 	 * If the card is gone and the memory port isn't mapped, we will
2439 	 * (hopefully) get 0xffff back from the status read, which is not
2440 	 * a valid status value.
2441 	 */
2442 	if (CSR_READ_2(sc, WI_STATUS) != 0xffff) {
2443 		CSR_WRITE_2(sc, WI_INT_EN, 0);
2444 		wi_cmd(sc, WI_CMD_DISABLE|sc->wi_portnum, 0, 0, 0);
2445 	}
2446 
2447 	untimeout(wi_inquire, sc, sc->wi_stat_ch);
2448 
2449 	ifp->if_flags &= ~(IFF_RUNNING|IFF_OACTIVE);
2450 
2451 	WI_UNLOCK(sc, s);
2452 	return;
2453 }
2454 
2455 static void
2456 wi_watchdog(ifp)
2457 	struct ifnet		*ifp;
2458 {
2459 	struct wi_softc		*sc;
2460 
2461 	sc = ifp->if_softc;
2462 
2463 	device_printf(sc->dev, "watchdog timeout\n");
2464 
2465 	wi_init(sc);
2466 
2467 	ifp->if_oerrors++;
2468 
2469 	return;
2470 }
2471 
2472 int
2473 wi_alloc(dev, rid)
2474 	device_t		dev;
2475 	int			rid;
2476 {
2477 	struct wi_softc		*sc = device_get_softc(dev);
2478 
2479 	if (sc->wi_bus_type != WI_BUS_PCI_NATIVE) {
2480 		sc->iobase_rid = rid;
2481 		sc->iobase = bus_alloc_resource(dev, SYS_RES_IOPORT,
2482 		    &sc->iobase_rid, 0, ~0, (1 << 6),
2483 		    rman_make_alignment_flags(1 << 6) | RF_ACTIVE);
2484 		if (!sc->iobase) {
2485 			device_printf(dev, "No I/O space?!\n");
2486 			return (ENXIO);
2487 		}
2488 
2489 		sc->wi_io_addr = rman_get_start(sc->iobase);
2490 		sc->wi_btag = rman_get_bustag(sc->iobase);
2491 		sc->wi_bhandle = rman_get_bushandle(sc->iobase);
2492 	} else {
2493 		sc->mem_rid = rid;
2494 		sc->mem = bus_alloc_resource(dev, SYS_RES_MEMORY,
2495 		    &sc->mem_rid, 0, ~0, 1, RF_ACTIVE);
2496 
2497 		if (!sc->mem) {
2498 			device_printf(dev, "No Mem space on prism2.5?\n");
2499 			return (ENXIO);
2500 		}
2501 
2502 		sc->wi_btag = rman_get_bustag(sc->mem);
2503 		sc->wi_bhandle = rman_get_bushandle(sc->mem);
2504 	}
2505 
2506 
2507 	sc->irq_rid = 0;
2508 	sc->irq = bus_alloc_resource(dev, SYS_RES_IRQ, &sc->irq_rid,
2509 	    0, ~0, 1, RF_ACTIVE |
2510 	    ((sc->wi_bus_type == WI_BUS_PCCARD) ? 0 : RF_SHAREABLE));
2511 
2512 	if (!sc->irq) {
2513 		wi_free(dev);
2514 		device_printf(dev, "No irq?!\n");
2515 		return (ENXIO);
2516 	}
2517 
2518 	sc->dev = dev;
2519 	sc->wi_unit = device_get_unit(dev);
2520 
2521 	return (0);
2522 }
2523 
2524 void
2525 wi_free(dev)
2526 	device_t		dev;
2527 {
2528 	struct wi_softc		*sc = device_get_softc(dev);
2529 
2530 	if (sc->iobase != NULL) {
2531 		bus_release_resource(dev, SYS_RES_IOPORT, sc->iobase_rid, sc->iobase);
2532 		sc->iobase = NULL;
2533 	}
2534 	if (sc->irq != NULL) {
2535 		bus_release_resource(dev, SYS_RES_IRQ, sc->irq_rid, sc->irq);
2536 		sc->irq = NULL;
2537 	}
2538 	if (sc->mem != NULL) {
2539 		bus_release_resource(dev, SYS_RES_MEMORY, sc->mem_rid, sc->mem);
2540 		sc->mem = NULL;
2541 	}
2542 
2543 	return;
2544 }
2545 
2546 void
2547 wi_shutdown(dev)
2548 	device_t		dev;
2549 {
2550 	struct wi_softc		*sc;
2551 
2552 	sc = device_get_softc(dev);
2553 	wi_stop(sc);
2554 
2555 	return;
2556 }
2557 
2558 #ifdef WICACHE
2559 /* wavelan signal strength cache code.
2560  * store signal/noise/quality on per MAC src basis in
2561  * a small fixed cache.  The cache wraps if > MAX slots
2562  * used.  The cache may be zeroed out to start over.
2563  * Two simple filters exist to reduce computation:
2564  * 1. ip only (literally 0x800) which may be used
2565  * to ignore some packets.  It defaults to ip only.
2566  * it could be used to focus on broadcast, non-IP 802.11 beacons.
2567  * 2. multicast/broadcast only.  This may be used to
2568  * ignore unicast packets and only cache signal strength
2569  * for multicast/broadcast packets (beacons); e.g., Mobile-IP
2570  * beacons and not unicast traffic.
2571  *
2572  * The cache stores (MAC src(index), IP src (major clue), signal,
2573  *	quality, noise)
2574  *
2575  * No apologies for storing IP src here.  It's easy and saves much
2576  * trouble elsewhere.  The cache is assumed to be INET dependent,
2577  * although it need not be.
2578  */
2579 
2580 #ifdef documentation
2581 
2582 int wi_sigitems;                                /* number of cached entries */
2583 struct wi_sigcache wi_sigcache[MAXWICACHE];  /*  array of cache entries */
2584 int wi_nextitem;                                /*  index/# of entries */
2585 
2586 
2587 #endif
2588 
2589 /* control variables for cache filtering.  Basic idea is
2590  * to reduce cost (e.g., to only Mobile-IP agent beacons
2591  * which are broadcast or multicast).  Still you might
2592  * want to measure signal strength with unicast ping packets
2593  * on a pt. to pt. ant. setup.
2594  */
2595 /* set true if you want to limit cache items to broadcast/mcast
2596  * only packets (not unicast).  Useful for mobile-ip beacons which
2597  * are broadcast/multicast at network layer.  Default is all packets
2598  * so ping/unicast will work say with pt. to pt. antennae setup.
2599  */
2600 static int wi_cache_mcastonly = 0;
2601 SYSCTL_INT(_machdep, OID_AUTO, wi_cache_mcastonly, CTLFLAG_RW,
2602 	&wi_cache_mcastonly, 0, "");
2603 
2604 /* set true if you want to limit cache items to IP packets only
2605 */
2606 static int wi_cache_iponly = 1;
2607 SYSCTL_INT(_machdep, OID_AUTO, wi_cache_iponly, CTLFLAG_RW,
2608 	&wi_cache_iponly, 0, "");
2609 
2610 /*
2611  * Original comments:
2612  * -----------------
2613  * wi_cache_store, per rx packet store signal
2614  * strength in MAC (src) indexed cache.
2615  *
2616  * follows linux driver in how signal strength is computed.
2617  * In ad hoc mode, we use the rx_quality field.
2618  * signal and noise are trimmed to fit in the range from 47..138.
2619  * rx_quality field MSB is signal strength.
2620  * rx_quality field LSB is noise.
2621  * "quality" is (signal - noise) as is log value.
2622  * note: quality CAN be negative.
2623  *
2624  * In BSS mode, we use the RID for communication quality.
2625  * TBD:  BSS mode is currently untested.
2626  *
2627  * Bill's comments:
2628  * ---------------
2629  * Actually, we use the rx_quality field all the time for both "ad-hoc"
2630  * and BSS modes. Why? Because reading an RID is really, really expensive:
2631  * there's a bunch of PIO operations that have to be done to read a record
2632  * from the NIC, and reading the comms quality RID each time a packet is
2633  * received can really hurt performance. We don't have to do this anyway:
2634  * the comms quality field only reflects the values in the rx_quality field
2635  * anyway. The comms quality RID is only meaningful in infrastructure mode,
2636  * but the values it contains are updated based on the rx_quality from
2637  * frames received from the access point.
2638  *
2639  * Also, according to Lucent, the signal strength and noise level values
2640  * can be converted to dBms by subtracting 149, so I've modified the code
2641  * to do that instead of the scaling it did originally.
2642  */
2643 static void
2644 wi_cache_store(struct wi_softc *sc, struct ether_header *eh,
2645                      struct mbuf *m, unsigned short rx_quality)
2646 {
2647 	struct ip *ip = 0;
2648 	int i;
2649 	static int cache_slot = 0; 	/* use this cache entry */
2650 	static int wrapindex = 0;       /* next "free" cache entry */
2651 	int sig, noise;
2652 	int sawip=0;
2653 
2654 	/*
2655 	 * filters:
2656 	 * 1. ip only
2657 	 * 2. configurable filter to throw out unicast packets,
2658 	 * keep multicast only.
2659 	 */
2660 
2661 	if ((ntohs(eh->ether_type) == ETHERTYPE_IP)) {
2662 		sawip = 1;
2663 	}
2664 
2665 	/*
2666 	 * filter for ip packets only
2667 	*/
2668 	if (wi_cache_iponly && !sawip) {
2669 		return;
2670 	}
2671 
2672 	/*
2673 	 *  filter for broadcast/multicast only
2674 	 */
2675 	if (wi_cache_mcastonly && ((eh->ether_dhost[0] & 1) == 0)) {
2676 		return;
2677 	}
2678 
2679 #ifdef SIGDEBUG
2680 	printf("wi%d: q value %x (MSB=0x%x, LSB=0x%x) \n", sc->wi_unit,
2681 	    rx_quality & 0xffff, rx_quality >> 8, rx_quality & 0xff);
2682 #endif
2683 
2684 	/*
2685 	 *  find the ip header.  we want to store the ip_src
2686 	 * address.
2687 	 */
2688 	if (sawip)
2689 		ip = mtod(m, struct ip *);
2690 
2691 	/*
2692 	 * do a linear search for a matching MAC address
2693 	 * in the cache table
2694 	 * . MAC address is 6 bytes,
2695 	 * . var w_nextitem holds total number of entries already cached
2696 	 */
2697 	for(i = 0; i < sc->wi_nextitem; i++) {
2698 		if (! bcmp(eh->ether_shost , sc->wi_sigcache[i].macsrc,  6 )) {
2699 			/*
2700 			 * Match!,
2701 			 * so we already have this entry,
2702 			 * update the data
2703 			 */
2704 			break;
2705 		}
2706 	}
2707 
2708 	/*
2709 	 *  did we find a matching mac address?
2710 	 * if yes, then overwrite a previously existing cache entry
2711 	 */
2712 	if (i < sc->wi_nextitem )   {
2713 		cache_slot = i;
2714 	}
2715 	/*
2716 	 * else, have a new address entry,so
2717 	 * add this new entry,
2718 	 * if table full, then we need to replace LRU entry
2719 	 */
2720 	else    {
2721 
2722 		/*
2723 		 * check for space in cache table
2724 		 * note: wi_nextitem also holds number of entries
2725 		 * added in the cache table
2726 		 */
2727 		if ( sc->wi_nextitem < MAXWICACHE ) {
2728 			cache_slot = sc->wi_nextitem;
2729 			sc->wi_nextitem++;
2730 			sc->wi_sigitems = sc->wi_nextitem;
2731 		}
2732         	/* no space found, so simply wrap with wrap index
2733 		 * and "zap" the next entry
2734 		 */
2735 		else {
2736 			if (wrapindex == MAXWICACHE) {
2737 				wrapindex = 0;
2738 			}
2739 			cache_slot = wrapindex++;
2740 		}
2741 	}
2742 
2743 	/*
2744 	 * invariant: cache_slot now points at some slot
2745 	 * in cache.
2746 	 */
2747 	if (cache_slot < 0 || cache_slot >= MAXWICACHE) {
2748 		log(LOG_ERR, "wi_cache_store, bad index: %d of "
2749 		    "[0..%d], gross cache error\n",
2750 		    cache_slot, MAXWICACHE);
2751 		return;
2752 	}
2753 
2754 	/*
2755 	 *  store items in cache
2756 	 *  .ip source address
2757 	 *  .mac src
2758 	 *  .signal, etc.
2759 	 */
2760 	if (sawip)
2761 		sc->wi_sigcache[cache_slot].ipsrc = ip->ip_src.s_addr;
2762 	bcopy( eh->ether_shost, sc->wi_sigcache[cache_slot].macsrc,  6);
2763 
2764 	sig = (rx_quality >> 8) & 0xFF;
2765 	noise = rx_quality & 0xFF;
2766 	sc->wi_sigcache[cache_slot].signal = sig - 149;
2767 	sc->wi_sigcache[cache_slot].noise = noise - 149;
2768 	sc->wi_sigcache[cache_slot].quality = sig - noise;
2769 
2770 	return;
2771 }
2772 #endif
2773 
2774 static int
2775 wi_get_cur_ssid(sc, ssid, len)
2776 	struct wi_softc		*sc;
2777 	char			*ssid;
2778 	int			*len;
2779 {
2780 	int			error = 0;
2781 	struct wi_req		wreq;
2782 
2783 	wreq.wi_len = WI_MAX_DATALEN;
2784 	switch (sc->wi_ptype) {
2785 	case WI_PORTTYPE_AP:
2786 		*len = IEEE80211_NWID_LEN;
2787 		bcopy(sc->wi_net_name, ssid, IEEE80211_NWID_LEN);
2788 		break;
2789 	case WI_PORTTYPE_ADHOC:
2790 		wreq.wi_type = WI_RID_CURRENT_SSID;
2791 		error = wi_read_record(sc, (struct wi_ltv_gen *)&wreq);
2792 		if (error != 0)
2793 			break;
2794 		if (wreq.wi_val[0] > IEEE80211_NWID_LEN) {
2795 			error = EINVAL;
2796 			break;
2797 		}
2798 		*len = wreq.wi_val[0];
2799 		bcopy(&wreq.wi_val[1], ssid, IEEE80211_NWID_LEN);
2800 		break;
2801 	case WI_PORTTYPE_BSS:
2802 		wreq.wi_type = WI_RID_COMMQUAL;
2803 		error = wi_read_record(sc, (struct wi_ltv_gen *)&wreq);
2804 		if (error != 0)
2805 			break;
2806 		if (wreq.wi_val[0] != 0) /* associated */ {
2807 			wreq.wi_type = WI_RID_CURRENT_SSID;
2808 			wreq.wi_len = WI_MAX_DATALEN;
2809 			error = wi_read_record(sc, (struct wi_ltv_gen *)&wreq);
2810 			if (error != 0)
2811 				break;
2812 			if (wreq.wi_val[0] > IEEE80211_NWID_LEN) {
2813 				error = EINVAL;
2814 				break;
2815 			}
2816 			*len = wreq.wi_val[0];
2817 			bcopy(&wreq.wi_val[1], ssid, IEEE80211_NWID_LEN);
2818 		} else {
2819 			*len = IEEE80211_NWID_LEN;
2820 			bcopy(sc->wi_net_name, ssid, IEEE80211_NWID_LEN);
2821 		}
2822 		break;
2823 	default:
2824 		error = EINVAL;
2825 		break;
2826 	}
2827 
2828 	return error;
2829 }
2830 
2831 static int
2832 wi_media_change(ifp)
2833 	struct ifnet		*ifp;
2834 {
2835 	struct wi_softc		*sc = ifp->if_softc;
2836 	int			otype = sc->wi_ptype;
2837 	int			orate = sc->wi_tx_rate;
2838 	int			ocreate_ibss = sc->wi_create_ibss;
2839 
2840 	if ((sc->ifmedia.ifm_cur->ifm_media & IFM_IEEE80211_HOSTAP) &&
2841 	    sc->sc_firmware_type != WI_INTERSIL)
2842 		return (EINVAL);
2843 
2844 	sc->wi_create_ibss = 0;
2845 
2846 	switch (sc->ifmedia.ifm_cur->ifm_media & IFM_OMASK) {
2847 	case 0:
2848 		sc->wi_ptype = WI_PORTTYPE_BSS;
2849 		break;
2850 	case IFM_IEEE80211_ADHOC:
2851 		sc->wi_ptype = WI_PORTTYPE_ADHOC;
2852 		break;
2853 	case IFM_IEEE80211_HOSTAP:
2854 		sc->wi_ptype = WI_PORTTYPE_AP;
2855 		break;
2856 	case IFM_IEEE80211_IBSSMASTER:
2857 	case IFM_IEEE80211_IBSSMASTER|IFM_IEEE80211_IBSS:
2858 		if (!(sc->wi_flags & WI_FLAGS_HAS_CREATE_IBSS))
2859 			return (EINVAL);
2860 		sc->wi_create_ibss = 1;
2861 		/* FALLTHROUGH */
2862 	case IFM_IEEE80211_IBSS:
2863 		sc->wi_ptype = WI_PORTTYPE_IBSS;
2864 		break;
2865 	default:
2866 		/* Invalid combination. */
2867 		return (EINVAL);
2868 	}
2869 
2870 	switch (IFM_SUBTYPE(sc->ifmedia.ifm_cur->ifm_media)) {
2871 	case IFM_IEEE80211_DS1:
2872 		sc->wi_tx_rate = 1;
2873 		break;
2874 	case IFM_IEEE80211_DS2:
2875 		sc->wi_tx_rate = 2;
2876 		break;
2877 	case IFM_IEEE80211_DS5:
2878 		sc->wi_tx_rate = 5;
2879 		break;
2880 	case IFM_IEEE80211_DS11:
2881 		sc->wi_tx_rate = 11;
2882 		break;
2883 	case IFM_AUTO:
2884 		sc->wi_tx_rate = 3;
2885 		break;
2886 	}
2887 
2888 	if (ocreate_ibss != sc->wi_create_ibss || otype != sc->wi_ptype ||
2889 	    orate != sc->wi_tx_rate)
2890 		wi_init(sc);
2891 
2892 	return(0);
2893 }
2894 
2895 static void
2896 wi_media_status(ifp, imr)
2897 	struct ifnet		*ifp;
2898 	struct ifmediareq	*imr;
2899 {
2900 	struct wi_req		wreq;
2901 	struct wi_softc		*sc = ifp->if_softc;
2902 
2903 	if (sc->wi_tx_rate == 3) {
2904 		imr->ifm_active = IFM_IEEE80211|IFM_AUTO;
2905 		if (sc->wi_ptype == WI_PORTTYPE_ADHOC)
2906 			imr->ifm_active |= IFM_IEEE80211_ADHOC;
2907 		else if (sc->wi_ptype == WI_PORTTYPE_AP)
2908 			imr->ifm_active |= IFM_IEEE80211_HOSTAP;
2909 		else if (sc->wi_ptype == WI_PORTTYPE_IBSS) {
2910 			if (sc->wi_create_ibss)
2911 				imr->ifm_active |= IFM_IEEE80211_IBSSMASTER;
2912 			else
2913 				imr->ifm_active |= IFM_IEEE80211_IBSS;
2914 		}
2915 		wreq.wi_type = WI_RID_CUR_TX_RATE;
2916 		wreq.wi_len = WI_MAX_DATALEN;
2917 		if (wi_read_record(sc, (struct wi_ltv_gen *)&wreq) == 0) {
2918 			switch(wreq.wi_val[0]) {
2919 			case 1:
2920 				imr->ifm_active |= IFM_IEEE80211_DS1;
2921 				break;
2922 			case 2:
2923 				imr->ifm_active |= IFM_IEEE80211_DS2;
2924 				break;
2925 			case 6:
2926 				imr->ifm_active |= IFM_IEEE80211_DS5;
2927 				break;
2928 			case 11:
2929 				imr->ifm_active |= IFM_IEEE80211_DS11;
2930 				break;
2931 				}
2932 		}
2933 	} else {
2934 		imr->ifm_active = sc->ifmedia.ifm_cur->ifm_media;
2935 	}
2936 
2937 	imr->ifm_status = IFM_AVALID;
2938 	if (sc->wi_ptype == WI_PORTTYPE_ADHOC ||
2939 	    sc->wi_ptype == WI_PORTTYPE_IBSS)
2940 		/*
2941 		 * XXX: It would be nice if we could give some actually
2942 		 * useful status like whether we joined another IBSS or
2943 		 * created one ourselves.
2944 		 */
2945 		imr->ifm_status |= IFM_ACTIVE;
2946 	else if (sc->wi_ptype == WI_PORTTYPE_AP)
2947 		imr->ifm_status |= IFM_ACTIVE;
2948 	else {
2949 		wreq.wi_type = WI_RID_COMMQUAL;
2950 		wreq.wi_len = WI_MAX_DATALEN;
2951 		if (wi_read_record(sc, (struct wi_ltv_gen *)&wreq) == 0 &&
2952 		    wreq.wi_val[0] != 0)
2953 			imr->ifm_status |= IFM_ACTIVE;
2954 	}
2955 }
2956 
2957 static int
2958 wi_get_debug(sc, wreq)
2959 	struct wi_softc		*sc;
2960 	struct wi_req		*wreq;
2961 {
2962 	int			error = 0;
2963 
2964 	wreq->wi_len = 1;
2965 
2966 	switch (wreq->wi_type) {
2967 	case WI_DEBUG_SLEEP:
2968 		wreq->wi_len++;
2969 		wreq->wi_val[0] = sc->wi_debug.wi_sleep;
2970 		break;
2971 	case WI_DEBUG_DELAYSUPP:
2972 		wreq->wi_len++;
2973 		wreq->wi_val[0] = sc->wi_debug.wi_delaysupp;
2974 		break;
2975 	case WI_DEBUG_TXSUPP:
2976 		wreq->wi_len++;
2977 		wreq->wi_val[0] = sc->wi_debug.wi_txsupp;
2978 		break;
2979 	case WI_DEBUG_MONITOR:
2980 		wreq->wi_len++;
2981 		wreq->wi_val[0] = sc->wi_debug.wi_monitor;
2982 		break;
2983 	case WI_DEBUG_LEDTEST:
2984 		wreq->wi_len += 3;
2985 		wreq->wi_val[0] = sc->wi_debug.wi_ledtest;
2986 		wreq->wi_val[1] = sc->wi_debug.wi_ledtest_param0;
2987 		wreq->wi_val[2] = sc->wi_debug.wi_ledtest_param1;
2988 		break;
2989 	case WI_DEBUG_CONTTX:
2990 		wreq->wi_len += 2;
2991 		wreq->wi_val[0] = sc->wi_debug.wi_conttx;
2992 		wreq->wi_val[1] = sc->wi_debug.wi_conttx_param0;
2993 		break;
2994 	case WI_DEBUG_CONTRX:
2995 		wreq->wi_len++;
2996 		wreq->wi_val[0] = sc->wi_debug.wi_contrx;
2997 		break;
2998 	case WI_DEBUG_SIGSTATE:
2999 		wreq->wi_len += 2;
3000 		wreq->wi_val[0] = sc->wi_debug.wi_sigstate;
3001 		wreq->wi_val[1] = sc->wi_debug.wi_sigstate_param0;
3002 		break;
3003 	case WI_DEBUG_CONFBITS:
3004 		wreq->wi_len += 2;
3005 		wreq->wi_val[0] = sc->wi_debug.wi_confbits;
3006 		wreq->wi_val[1] = sc->wi_debug.wi_confbits_param0;
3007 		break;
3008 	default:
3009 		error = EIO;
3010 		break;
3011 	}
3012 
3013 	return (error);
3014 }
3015 
3016 static int
3017 wi_set_debug(sc, wreq)
3018 	struct wi_softc		*sc;
3019 	struct wi_req		*wreq;
3020 {
3021 	int			error = 0;
3022 	u_int16_t		cmd, param0 = 0, param1 = 0;
3023 
3024 	switch (wreq->wi_type) {
3025 	case WI_DEBUG_RESET:
3026 	case WI_DEBUG_INIT:
3027 	case WI_DEBUG_CALENABLE:
3028 		break;
3029 	case WI_DEBUG_SLEEP:
3030 		sc->wi_debug.wi_sleep = 1;
3031 		break;
3032 	case WI_DEBUG_WAKE:
3033 		sc->wi_debug.wi_sleep = 0;
3034 		break;
3035 	case WI_DEBUG_CHAN:
3036 		param0 = wreq->wi_val[0];
3037 		break;
3038 	case WI_DEBUG_DELAYSUPP:
3039 		sc->wi_debug.wi_delaysupp = 1;
3040 		break;
3041 	case WI_DEBUG_TXSUPP:
3042 		sc->wi_debug.wi_txsupp = 1;
3043 		break;
3044 	case WI_DEBUG_MONITOR:
3045 		sc->wi_debug.wi_monitor = 1;
3046 		break;
3047 	case WI_DEBUG_LEDTEST:
3048 		param0 = wreq->wi_val[0];
3049 		param1 = wreq->wi_val[1];
3050 		sc->wi_debug.wi_ledtest = 1;
3051 		sc->wi_debug.wi_ledtest_param0 = param0;
3052 		sc->wi_debug.wi_ledtest_param1 = param1;
3053 		break;
3054 	case WI_DEBUG_CONTTX:
3055 		param0 = wreq->wi_val[0];
3056 		sc->wi_debug.wi_conttx = 1;
3057 		sc->wi_debug.wi_conttx_param0 = param0;
3058 		break;
3059 	case WI_DEBUG_STOPTEST:
3060 		sc->wi_debug.wi_delaysupp = 0;
3061 		sc->wi_debug.wi_txsupp = 0;
3062 		sc->wi_debug.wi_monitor = 0;
3063 		sc->wi_debug.wi_ledtest = 0;
3064 		sc->wi_debug.wi_ledtest_param0 = 0;
3065 		sc->wi_debug.wi_ledtest_param1 = 0;
3066 		sc->wi_debug.wi_conttx = 0;
3067 		sc->wi_debug.wi_conttx_param0 = 0;
3068 		sc->wi_debug.wi_contrx = 0;
3069 		sc->wi_debug.wi_sigstate = 0;
3070 		sc->wi_debug.wi_sigstate_param0 = 0;
3071 		break;
3072 	case WI_DEBUG_CONTRX:
3073 		sc->wi_debug.wi_contrx = 1;
3074 		break;
3075 	case WI_DEBUG_SIGSTATE:
3076 		param0 = wreq->wi_val[0];
3077 		sc->wi_debug.wi_sigstate = 1;
3078 		sc->wi_debug.wi_sigstate_param0 = param0;
3079 		break;
3080 	case WI_DEBUG_CONFBITS:
3081 		param0 = wreq->wi_val[0];
3082 		param1 = wreq->wi_val[1];
3083 		sc->wi_debug.wi_confbits = param0;
3084 		sc->wi_debug.wi_confbits_param0 = param1;
3085 		break;
3086 	default:
3087 		error = EIO;
3088 		break;
3089 	}
3090 
3091 	if (error)
3092 		return (error);
3093 
3094 	cmd = WI_CMD_DEBUG | (wreq->wi_type << 8);
3095 	error = wi_cmd(sc, cmd, param0, param1, 0);
3096 
3097 	return (error);
3098 }
3099