if_wi.c revision 86385
1/*
2 * Copyright (c) 1997, 1998, 1999
3 *	Bill Paul <wpaul@ctr.columbia.edu>.  All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 *    notice, this list of conditions and the following disclaimer in the
12 *    documentation and/or other materials provided with the distribution.
13 * 3. All advertising materials mentioning features or use of this software
14 *    must display the following acknowledgement:
15 *	This product includes software developed by Bill Paul.
16 * 4. Neither the name of the author nor the names of any co-contributors
17 *    may be used to endorse or promote products derived from this software
18 *    without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
24 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
30 * THE POSSIBILITY OF SUCH DAMAGE.
31 */
32
33/*
34 * Lucent WaveLAN/IEEE 802.11 PCMCIA driver for FreeBSD.
35 *
36 * Written by Bill Paul <wpaul@ctr.columbia.edu>
37 * Electrical Engineering Department
38 * Columbia University, New York City
39 */
40
41/*
42 * The WaveLAN/IEEE adapter is the second generation of the WaveLAN
43 * from Lucent. Unlike the older cards, the new ones are programmed
44 * entirely via a firmware-driven controller called the Hermes.
45 * Unfortunately, Lucent will not release the Hermes programming manual
46 * without an NDA (if at all). What they do release is an API library
47 * called the HCF (Hardware Control Functions) which is supposed to
48 * do the device-specific operations of a device driver for you. The
49 * publically available version of the HCF library (the 'HCF Light') is
50 * a) extremely gross, b) lacks certain features, particularly support
51 * for 802.11 frames, and c) is contaminated by the GNU Public License.
52 *
53 * This driver does not use the HCF or HCF Light at all. Instead, it
54 * programs the Hermes controller directly, using information gleaned
55 * from the HCF Light code and corresponding documentation.
56 *
57 * This driver supports both the PCMCIA and ISA versions of the
58 * WaveLAN/IEEE cards. Note however that the ISA card isn't really
59 * anything of the sort: it's actually a PCMCIA bridge adapter
60 * that fits into an ISA slot, into which a PCMCIA WaveLAN card is
61 * inserted. Consequently, you need to use the pccard support for
62 * both the ISA and PCMCIA adapters.
63 */
64
65#define WI_HERMES_AUTOINC_WAR	/* Work around data write autoinc bug. */
66#define WI_HERMES_STATS_WAR	/* Work around stats counter bug. */
67#define WICACHE			/* turn on signal strength cache code */
68
69#include "pci.h"
70
71#include <sys/param.h>
72#include <sys/systm.h>
73#include <sys/sockio.h>
74#include <sys/mbuf.h>
75#include <sys/proc.h>
76#include <sys/kernel.h>
77#include <sys/socket.h>
78#include <sys/module.h>
79#include <sys/bus.h>
80#include <sys/syslog.h>
81#include <sys/sysctl.h>
82
83#include <machine/bus.h>
84#include <machine/resource.h>
85#include <machine/md_var.h>
86#include <machine/bus_pio.h>
87#include <sys/rman.h>
88
89#if NPCI > 0
90#include <pci/pcireg.h>
91#include <pci/pcivar.h>
92#endif
93
94#include <net/if.h>
95#include <net/if_arp.h>
96#include <net/ethernet.h>
97#include <net/if_dl.h>
98#include <net/if_media.h>
99#include <net/if_types.h>
100#include <net/if_ieee80211.h>
101
102#include <netinet/in.h>
103#include <netinet/in_systm.h>
104#include <netinet/in_var.h>
105#include <netinet/ip.h>
106#include <netinet/if_ether.h>
107
108#include <net/bpf.h>
109
110#include <dev/pccard/pccardvar.h>
111#include <dev/pccard/pccarddevs.h>
112
113#include <dev/wi/if_wavelan_ieee.h>
114#include <dev/wi/if_wireg.h>
115
116#include "card_if.h"
117
118#if !defined(lint)
119static const char rcsid[] =
120  "$FreeBSD: head/sys/dev/wi/if_wi.c 86385 2001-11-15 06:37:13Z imp $";
121#endif
122
123#ifdef foo
124static u_int8_t	wi_mcast_addr[6] = { 0x01, 0x60, 0x1D, 0x00, 0x01, 0x00 };
125#endif
126
127static void wi_intr		__P((void *));
128static void wi_reset		__P((struct wi_softc *));
129static int wi_ioctl		__P((struct ifnet *, u_long, caddr_t));
130static void wi_init		__P((void *));
131static void wi_start		__P((struct ifnet *));
132static void wi_stop		__P((struct wi_softc *));
133static void wi_watchdog		__P((struct ifnet *));
134static void wi_rxeof		__P((struct wi_softc *));
135static void wi_txeof		__P((struct wi_softc *, int));
136static void wi_update_stats	__P((struct wi_softc *));
137static void wi_setmulti		__P((struct wi_softc *));
138
139static int wi_cmd		__P((struct wi_softc *, int, int));
140static int wi_read_record	__P((struct wi_softc *, struct wi_ltv_gen *));
141static int wi_write_record	__P((struct wi_softc *, struct wi_ltv_gen *));
142static int wi_read_data		__P((struct wi_softc *, int,
143					int, caddr_t, int));
144static int wi_write_data	__P((struct wi_softc *, int,
145					int, caddr_t, int));
146static int wi_seek		__P((struct wi_softc *, int, int, int));
147static int wi_alloc_nicmem	__P((struct wi_softc *, int, int *));
148static void wi_inquire		__P((void *));
149static void wi_setdef		__P((struct wi_softc *, struct wi_req *));
150static int wi_mgmt_xmit		__P((struct wi_softc *, caddr_t, int));
151
152#ifdef WICACHE
153static
154void wi_cache_store __P((struct wi_softc *, struct ether_header *,
155	struct mbuf *, unsigned short));
156#endif
157
158static int wi_generic_attach	__P((device_t));
159static int wi_pccard_match	__P((device_t));
160static int wi_pccard_probe	__P((device_t));
161static int wi_pccard_attach	__P((device_t));
162#if NPCI > 0
163static int wi_pci_probe		__P((device_t));
164static int wi_pci_attach	__P((device_t));
165#endif
166static int wi_pccard_detach	__P((device_t));
167static void wi_shutdown		__P((device_t));
168
169static int wi_alloc		__P((device_t, int));
170static void wi_free		__P((device_t));
171
172static int wi_get_cur_ssid	__P((struct wi_softc *, char *, int *));
173static int wi_media_change	__P((struct ifnet *));
174static void wi_media_status	__P((struct ifnet *, struct ifmediareq *));
175
176static device_method_t wi_pccard_methods[] = {
177	/* Device interface */
178	DEVMETHOD(device_probe,		pccard_compat_probe),
179	DEVMETHOD(device_attach,	pccard_compat_attach),
180	DEVMETHOD(device_detach,	wi_pccard_detach),
181	DEVMETHOD(device_shutdown,	wi_shutdown),
182
183	/* Card interface */
184	DEVMETHOD(card_compat_match,	wi_pccard_match),
185	DEVMETHOD(card_compat_probe,	wi_pccard_probe),
186	DEVMETHOD(card_compat_attach,	wi_pccard_attach),
187
188	{ 0, 0 }
189};
190
191#if NPCI > 0
192static device_method_t wi_pci_methods[] = {
193	/* Device interface */
194	DEVMETHOD(device_probe,		wi_pci_probe),
195	DEVMETHOD(device_attach,	wi_pci_attach),
196	DEVMETHOD(device_detach,	wi_pccard_detach),
197	DEVMETHOD(device_shutdown,	wi_shutdown),
198
199	{ 0, 0 }
200};
201#endif
202
203static driver_t wi_pccard_driver = {
204	"wi",
205	wi_pccard_methods,
206	sizeof(struct wi_softc)
207};
208
209#if NPCI > 0
210static driver_t wi_pci_driver = {
211	"wi",
212	wi_pci_methods,
213	sizeof(struct wi_softc)
214};
215
216static struct {
217	unsigned int vendor,device;
218	char *desc;
219} pci_ids[] = {
220	{0x1638, 0x1100,	"PRISM2STA PCI WaveLAN/IEEE 802.11"},
221	{0x1385, 0x4100,	"Netgear MA301 PCI IEEE 802.11b"},
222	{0,	 0,	NULL}
223};
224#endif
225
226static devclass_t wi_devclass;
227
228DRIVER_MODULE(if_wi, pccard, wi_pccard_driver, wi_devclass, 0, 0);
229#if NPCI > 0
230DRIVER_MODULE(if_wi, pci, wi_pci_driver, wi_devclass, 0, 0);
231#endif
232
233static const struct pccard_product wi_pccard_products[] = {
234	PCMCIA_CARD(3COM, 3CRWE737A, 0),
235	PCMCIA_CARD(BUFFALO, WLI_PCM_S11, 0),
236	PCMCIA_CARD(COMPAQ, NC5004, 0),
237	PCMCIA_CARD(CONTEC, FX_DS110_PCC, 0),
238	PCMCIA_CARD(COREGA, WIRELESS_LAN_PCC_11, 0),
239	PCMCIA_CARD(COREGA, WIRELESS_LAN_PCCA_11, 0),
240	PCMCIA_CARD(COREGA, WIRELESS_LAN_PCCB_11, 0),
241	PCMCIA_CARD(ELSA, XI300_IEEE, 0),
242	PCMCIA_CARD(ELSA, XI800_IEEE, 0),
243	PCMCIA_CARD(EMTAC, WLAN, 0),
244	PCMCIA_CARD(GEMTEK, WLAN, 0),
245	PCMCIA_CARD(INTEL, PRO_WLAN_2011, 0),
246	PCMCIA_CARD(INTERSIL, PRISM2, 0),
247	PCMCIA_CARD(IODATA2, WNB11PCM, 0),
248	PCMCIA_CARD2(LUCENT, WAVELAN_IEEE, NANOSPEED_PRISM2, 0),
249	PCMCIA_CARD2(LUCENT, WAVELAN_IEEE, NEC_CMZ_RT_WP, 0),
250	PCMCIA_CARD2(LUCENT, WAVELAN_IEEE, NTT_ME_WLAN, 0),
251	PCMCIA_CARD2(LUCENT, WAVELAN_IEEE, SMC_2632W, 0),
252	/* Must be after other LUCENT ones because it is less specific */
253	PCMCIA_CARD(LUCENT, WAVELAN_IEEE, 0),
254	PCMCIA_CARD(SAMSUNG, SWL_2000N, 0),
255	PCMCIA_CARD(TDK, LAK_CD011WL, 0),
256	{ NULL }
257};
258
259static int wi_pccard_match(dev)
260	device_t	dev;
261{
262	const struct pccard_product *pp;
263
264	if ((pp = pccard_product_lookup(dev, wi_pccard_products,
265	    sizeof(wi_pccard_products[0]), NULL)) != NULL) {
266		device_set_desc(dev, pp->pp_name);
267		return 0;
268	}
269	return ENXIO;
270}
271
272static int wi_pccard_probe(dev)
273	device_t	dev;
274{
275	struct wi_softc	*sc;
276	int		error;
277
278	sc = device_get_softc(dev);
279	sc->wi_gone = 0;
280
281	error = wi_alloc(dev, 0);
282	if (error)
283		return (error);
284
285	wi_free(dev);
286
287	/* Make sure interrupts are disabled. */
288	CSR_WRITE_2(sc, WI_INT_EN, 0);
289	CSR_WRITE_2(sc, WI_EVENT_ACK, 0xFFFF);
290
291	return (0);
292}
293
294#if NPCI > 0
295static int
296wi_pci_probe(dev)
297	device_t	dev;
298{
299	struct wi_softc		*sc;
300	int i;
301
302	sc = device_get_softc(dev);
303	for(i=0; pci_ids[i].vendor != 0; i++) {
304		if ((pci_get_vendor(dev) == pci_ids[i].vendor) &&
305			(pci_get_device(dev) == pci_ids[i].device)) {
306			sc->wi_prism2 = 1;
307			device_set_desc(dev, pci_ids[i].desc);
308			return (0);
309		}
310	}
311	return(ENXIO);
312}
313#endif
314
315static int wi_pccard_detach(dev)
316	device_t		dev;
317{
318	struct wi_softc		*sc;
319	struct ifnet		*ifp;
320
321	sc = device_get_softc(dev);
322	WI_LOCK(sc);
323	ifp = &sc->arpcom.ac_if;
324
325	if (sc->wi_gone) {
326		device_printf(dev, "already unloaded\n");
327		WI_UNLOCK(sc);
328		return(ENODEV);
329	}
330
331	wi_stop(sc);
332
333	/* Delete all remaining media. */
334	ifmedia_removeall(&sc->ifmedia);
335
336	ether_ifdetach(ifp, ETHER_BPF_SUPPORTED);
337	bus_teardown_intr(dev, sc->irq, sc->wi_intrhand);
338	wi_free(dev);
339	sc->wi_gone = 1;
340
341	WI_UNLOCK(sc);
342	mtx_destroy(&sc->wi_mtx);
343
344	return(0);
345}
346
347static int wi_pccard_attach(device_t dev)
348{
349	struct wi_softc		*sc;
350	int			error;
351	u_int32_t		flags;
352
353	sc = device_get_softc(dev);
354
355	/*
356	 *	XXX: quick hack to support Prism II chip.
357	 *	Currently, we need to set a flags in pccard.conf to specify
358	 *	which type chip is used.
359	 *
360	 *	We need to replace this code in a future.
361	 *	It is better to use CIS than using a flag.
362	 */
363	flags = device_get_flags(dev);
364#define	WI_FLAGS_PRISM2	0x10000
365	if (flags & WI_FLAGS_PRISM2) {
366		sc->wi_prism2 = 1;
367		if (bootverbose) {
368			device_printf(dev, "found PrismII chip\n");
369		}
370	}
371	else {
372		sc->wi_prism2 = 0;
373		if (bootverbose) {
374			device_printf(dev, "found Lucent chip\n");
375		}
376	}
377
378	error = wi_alloc(dev, 0);
379	if (error) {
380		device_printf(dev, "wi_alloc() failed! (%d)\n", error);
381		return (error);
382	}
383	return (wi_generic_attach(dev));
384}
385
386#if NPCI > 0
387static int
388wi_pci_attach(device_t dev)
389{
390	struct wi_softc		*sc;
391	u_int32_t		command, wanted;
392	u_int16_t		reg;
393	int			error;
394
395	sc = device_get_softc(dev);
396
397	command = pci_read_config(dev, PCIR_COMMAND, 4);
398	wanted = PCIM_CMD_PORTEN|PCIM_CMD_MEMEN;
399	command |= wanted;
400	pci_write_config(dev, PCIR_COMMAND, command, 4);
401	command = pci_read_config(dev, PCIR_COMMAND, 4);
402	if ((command & wanted) != wanted) {
403		device_printf(dev, "wi_pci_attach() failed to enable pci!\n");
404		return (ENXIO);
405	}
406
407	error = wi_alloc(dev, WI_PCI_IORES);
408	if (error)
409		return (error);
410
411	/* Make sure interrupts are disabled. */
412	CSR_WRITE_2(sc, WI_INT_EN, 0);
413	CSR_WRITE_2(sc, WI_EVENT_ACK, 0xFFFF);
414
415	/* We have to do a magic PLX poke to enable interrupts */
416	sc->local_rid = WI_PCI_LOCALRES;
417	sc->local = bus_alloc_resource(dev, SYS_RES_IOPORT,
418		&sc->local_rid, 0, ~0, 1, RF_ACTIVE);
419	sc->wi_localtag = rman_get_bustag(sc->local);
420	sc->wi_localhandle = rman_get_bushandle(sc->local);
421	command = bus_space_read_4(sc->wi_localtag, sc->wi_localhandle,
422		WI_LOCAL_INTCSR);
423	command |= WI_LOCAL_INTEN;
424	bus_space_write_4(sc->wi_localtag, sc->wi_localhandle,
425		WI_LOCAL_INTCSR, command);
426	bus_release_resource(dev, SYS_RES_IOPORT, sc->local_rid, sc->local);
427	sc->local = NULL;
428
429	sc->mem_rid = WI_PCI_MEMRES;
430	sc->mem = bus_alloc_resource(dev, SYS_RES_MEMORY, &sc->mem_rid,
431				0, ~0, 1, RF_ACTIVE);
432	if (sc->mem == NULL) {
433		device_printf(dev, "couldn't allocate memory\n");
434		wi_free(dev);
435		return (ENXIO);
436	}
437	sc->wi_bmemtag = rman_get_bustag(sc->mem);
438	sc->wi_bmemhandle = rman_get_bushandle(sc->mem);
439
440	/*
441	 * From Linux driver:
442	 * Write COR to enable PC card
443	 * This is a subset of the protocol that the pccard bus code
444	 * would do.
445	 */
446	CSM_WRITE_1(sc, WI_COR_OFFSET, WI_COR_VALUE);
447	reg = CSM_READ_1(sc, WI_COR_OFFSET);
448
449	CSR_WRITE_2(sc, WI_HFA384X_SWSUPPORT0_OFF, WI_PRISM2STA_MAGIC);
450	reg = CSR_READ_2(sc, WI_HFA384X_SWSUPPORT0_OFF);
451	if (reg != WI_PRISM2STA_MAGIC) {
452		device_printf(dev,
453		    "CSR_READ_2(WI_HFA384X_SWSUPPORT0_OFF) "
454		    "wanted %d, got %d\n", WI_PRISM2STA_MAGIC, reg);
455		wi_free(dev);
456		return (ENXIO);
457	}
458
459	error = wi_generic_attach(dev);
460	if (error != 0)
461		return (error);
462
463	return (0);
464}
465#endif
466
467static int
468wi_generic_attach(device_t dev)
469{
470	struct wi_softc		*sc;
471	struct wi_ltv_macaddr	mac;
472	struct wi_ltv_gen	gen;
473	struct ifnet		*ifp;
474	int			error;
475
476	sc = device_get_softc(dev);
477	ifp = &sc->arpcom.ac_if;
478
479	error = bus_setup_intr(dev, sc->irq, INTR_TYPE_NET,
480	    wi_intr, sc, &sc->wi_intrhand);
481
482	if (error) {
483		device_printf(dev, "bus_setup_intr() failed! (%d)\n", error);
484		wi_free(dev);
485		return (error);
486	}
487
488	mtx_init(&sc->wi_mtx, device_get_nameunit(dev), MTX_DEF | MTX_RECURSE);
489	WI_LOCK(sc);
490
491	/* Reset the NIC. */
492	wi_reset(sc);
493
494	/*
495	 * Read the station address.
496	 * And do it twice. I've seen PRISM-based cards that return
497	 * an error when trying to read it the first time, which causes
498	 * the probe to fail.
499	 */
500	mac.wi_type = WI_RID_MAC_NODE;
501	mac.wi_len = 4;
502	wi_read_record(sc, (struct wi_ltv_gen *)&mac);
503	if ((error = wi_read_record(sc, (struct wi_ltv_gen *)&mac)) != 0) {
504		device_printf(dev, "mac read failed %d\n", error);
505		wi_free(dev);
506		return (error);
507	}
508	bcopy((char *)&mac.wi_mac_addr,
509	   (char *)&sc->arpcom.ac_enaddr, ETHER_ADDR_LEN);
510
511	device_printf(dev, "Ethernet address: %6D\n",
512	    sc->arpcom.ac_enaddr, ":");
513
514	ifp->if_softc = sc;
515	ifp->if_unit = sc->wi_unit;
516	ifp->if_name = "wi";
517	ifp->if_mtu = ETHERMTU;
518	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
519	ifp->if_ioctl = wi_ioctl;
520	ifp->if_output = ether_output;
521	ifp->if_start = wi_start;
522	ifp->if_watchdog = wi_watchdog;
523	ifp->if_init = wi_init;
524	ifp->if_baudrate = 10000000;
525	ifp->if_snd.ifq_maxlen = IFQ_MAXLEN;
526
527	bzero(sc->wi_node_name, sizeof(sc->wi_node_name));
528	bcopy(WI_DEFAULT_NODENAME, sc->wi_node_name,
529	    sizeof(WI_DEFAULT_NODENAME) - 1);
530
531	bzero(sc->wi_net_name, sizeof(sc->wi_net_name));
532	bcopy(WI_DEFAULT_NETNAME, sc->wi_net_name,
533	    sizeof(WI_DEFAULT_NETNAME) - 1);
534
535	bzero(sc->wi_ibss_name, sizeof(sc->wi_ibss_name));
536	bcopy(WI_DEFAULT_IBSS, sc->wi_ibss_name,
537	    sizeof(WI_DEFAULT_IBSS) - 1);
538
539	sc->wi_portnum = WI_DEFAULT_PORT;
540	sc->wi_ptype = WI_PORTTYPE_BSS;
541	sc->wi_ap_density = WI_DEFAULT_AP_DENSITY;
542	sc->wi_rts_thresh = WI_DEFAULT_RTS_THRESH;
543	sc->wi_tx_rate = WI_DEFAULT_TX_RATE;
544	sc->wi_max_data_len = WI_DEFAULT_DATALEN;
545	sc->wi_create_ibss = WI_DEFAULT_CREATE_IBSS;
546	sc->wi_pm_enabled = WI_DEFAULT_PM_ENABLED;
547	sc->wi_max_sleep = WI_DEFAULT_MAX_SLEEP;
548
549	/*
550	 * Read the default channel from the NIC. This may vary
551	 * depending on the country where the NIC was purchased, so
552	 * we can't hard-code a default and expect it to work for
553	 * everyone.
554	 */
555	gen.wi_type = WI_RID_OWN_CHNL;
556	gen.wi_len = 2;
557	wi_read_record(sc, &gen);
558	sc->wi_channel = gen.wi_val;
559
560	/*
561	 * Find out if we support WEP on this card.
562	 */
563	gen.wi_type = WI_RID_WEP_AVAIL;
564	gen.wi_len = 2;
565	wi_read_record(sc, &gen);
566	sc->wi_has_wep = gen.wi_val;
567
568	if (bootverbose) {
569		device_printf(sc->dev,
570				__FUNCTION__ ":wi_has_wep = %d\n",
571				sc->wi_has_wep);
572	}
573
574	bzero((char *)&sc->wi_stats, sizeof(sc->wi_stats));
575
576	wi_init(sc);
577	wi_stop(sc);
578
579	ifmedia_init(&sc->ifmedia, 0, wi_media_change, wi_media_status);
580	/* XXX: Should read from card capabilities */
581#define ADD(m, c)       ifmedia_add(&sc->ifmedia, (m), (c), NULL)
582	ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1,
583	    IFM_IEEE80211_ADHOC, 0), 0);
584	ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS1, 0, 0), 0);
585	ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2,
586	    IFM_IEEE80211_ADHOC, 0), 0);
587	ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS2, 0, 0), 0);
588	ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5,
589	    IFM_IEEE80211_ADHOC, 0), 0);
590	ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS5, 0, 0), 0);
591	ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11,
592	    IFM_IEEE80211_ADHOC, 0), 0);
593	ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_IEEE80211_DS11, 0, 0), 0);
594	ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO,
595		IFM_IEEE80211_ADHOC, 0), 0);
596	ADD(IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO, 0, 0), 0);
597#undef	ADD
598	ifmedia_set(&sc->ifmedia, IFM_MAKEWORD(IFM_IEEE80211, IFM_AUTO,
599	    0, 0));
600
601
602	/*
603	 * Call MI attach routine.
604	 */
605	ether_ifattach(ifp, ETHER_BPF_SUPPORTED);
606	callout_handle_init(&sc->wi_stat_ch);
607	WI_UNLOCK(sc);
608
609	return(0);
610}
611
612static void wi_rxeof(sc)
613	struct wi_softc		*sc;
614{
615	struct ifnet		*ifp;
616	struct ether_header	*eh;
617	struct wi_frame		rx_frame;
618	struct mbuf		*m;
619	int			id;
620
621	ifp = &sc->arpcom.ac_if;
622
623	id = CSR_READ_2(sc, WI_RX_FID);
624
625	/* First read in the frame header */
626	if (wi_read_data(sc, id, 0, (caddr_t)&rx_frame, sizeof(rx_frame))) {
627		ifp->if_ierrors++;
628		return;
629	}
630
631	if (rx_frame.wi_status & WI_STAT_ERRSTAT) {
632		ifp->if_ierrors++;
633		return;
634	}
635
636	MGETHDR(m, M_DONTWAIT, MT_DATA);
637	if (m == NULL) {
638		ifp->if_ierrors++;
639		return;
640	}
641	MCLGET(m, M_DONTWAIT);
642	if (!(m->m_flags & M_EXT)) {
643		m_freem(m);
644		ifp->if_ierrors++;
645		return;
646	}
647
648	eh = mtod(m, struct ether_header *);
649	m->m_pkthdr.rcvif = ifp;
650
651	if (rx_frame.wi_status == WI_STAT_1042 ||
652	    rx_frame.wi_status == WI_STAT_TUNNEL ||
653	    rx_frame.wi_status == WI_STAT_WMP_MSG) {
654		if((rx_frame.wi_dat_len + WI_SNAPHDR_LEN) > MCLBYTES) {
655			device_printf(sc->dev, "oversized packet received "
656			    "(wi_dat_len=%d, wi_status=0x%x)\n",
657			    rx_frame.wi_dat_len, rx_frame.wi_status);
658			m_freem(m);
659			ifp->if_ierrors++;
660			return;
661		}
662		m->m_pkthdr.len = m->m_len =
663		    rx_frame.wi_dat_len + WI_SNAPHDR_LEN;
664
665#if 0
666		bcopy((char *)&rx_frame.wi_addr1,
667		    (char *)&eh->ether_dhost, ETHER_ADDR_LEN);
668		if (sc->wi_ptype == WI_PORTTYPE_ADHOC) {
669			bcopy((char *)&rx_frame.wi_addr2,
670			    (char *)&eh->ether_shost, ETHER_ADDR_LEN);
671		} else {
672			bcopy((char *)&rx_frame.wi_addr3,
673			    (char *)&eh->ether_shost, ETHER_ADDR_LEN);
674		}
675#else
676		bcopy((char *)&rx_frame.wi_dst_addr,
677			(char *)&eh->ether_dhost, ETHER_ADDR_LEN);
678		bcopy((char *)&rx_frame.wi_src_addr,
679			(char *)&eh->ether_shost, ETHER_ADDR_LEN);
680#endif
681
682		bcopy((char *)&rx_frame.wi_type,
683		    (char *)&eh->ether_type, ETHER_TYPE_LEN);
684
685		if (wi_read_data(sc, id, WI_802_11_OFFSET,
686		    mtod(m, caddr_t) + sizeof(struct ether_header),
687		    m->m_len + 2)) {
688			m_freem(m);
689			ifp->if_ierrors++;
690			return;
691		}
692	} else {
693		if((rx_frame.wi_dat_len +
694		    sizeof(struct ether_header)) > MCLBYTES) {
695			device_printf(sc->dev, "oversized packet received "
696			    "(wi_dat_len=%d, wi_status=0x%x)\n",
697			    rx_frame.wi_dat_len, rx_frame.wi_status);
698			m_freem(m);
699			ifp->if_ierrors++;
700			return;
701		}
702		m->m_pkthdr.len = m->m_len =
703		    rx_frame.wi_dat_len + sizeof(struct ether_header);
704
705		if (wi_read_data(sc, id, WI_802_3_OFFSET,
706		    mtod(m, caddr_t), m->m_len + 2)) {
707			m_freem(m);
708			ifp->if_ierrors++;
709			return;
710		}
711	}
712
713	ifp->if_ipackets++;
714
715	/* Receive packet. */
716	m_adj(m, sizeof(struct ether_header));
717#ifdef WICACHE
718	wi_cache_store(sc, eh, m, rx_frame.wi_q_info);
719#endif
720	ether_input(ifp, eh, m);
721}
722
723static void wi_txeof(sc, status)
724	struct wi_softc		*sc;
725	int			status;
726{
727	struct ifnet		*ifp;
728
729	ifp = &sc->arpcom.ac_if;
730
731	ifp->if_timer = 0;
732	ifp->if_flags &= ~IFF_OACTIVE;
733
734	if (status & WI_EV_TX_EXC)
735		ifp->if_oerrors++;
736	else
737		ifp->if_opackets++;
738
739	return;
740}
741
742void wi_inquire(xsc)
743	void			*xsc;
744{
745	struct wi_softc		*sc;
746	struct ifnet		*ifp;
747
748	sc = xsc;
749	ifp = &sc->arpcom.ac_if;
750
751	sc->wi_stat_ch = timeout(wi_inquire, sc, hz * 60);
752
753	/* Don't do this while we're transmitting */
754	if (ifp->if_flags & IFF_OACTIVE)
755		return;
756
757	wi_cmd(sc, WI_CMD_INQUIRE, WI_INFO_COUNTERS);
758
759	return;
760}
761
762void wi_update_stats(sc)
763	struct wi_softc		*sc;
764{
765	struct wi_ltv_gen	gen;
766	u_int16_t		id;
767	struct ifnet		*ifp;
768	u_int32_t		*ptr;
769	int			len, i;
770	u_int16_t		t;
771
772	ifp = &sc->arpcom.ac_if;
773
774	id = CSR_READ_2(sc, WI_INFO_FID);
775
776	wi_read_data(sc, id, 0, (char *)&gen, 4);
777
778	if (gen.wi_type != WI_INFO_COUNTERS)
779		return;
780
781	len = (gen.wi_len - 1 < sizeof(sc->wi_stats) / 4) ?
782		gen.wi_len - 1 : sizeof(sc->wi_stats) / 4;
783	ptr = (u_int32_t *)&sc->wi_stats;
784
785	for (i = 0; i < len - 1; i++) {
786		t = CSR_READ_2(sc, WI_DATA1);
787#ifdef WI_HERMES_STATS_WAR
788		if (t > 0xF000)
789			t = ~t & 0xFFFF;
790#endif
791		ptr[i] += t;
792	}
793
794	ifp->if_collisions = sc->wi_stats.wi_tx_single_retries +
795	    sc->wi_stats.wi_tx_multi_retries +
796	    sc->wi_stats.wi_tx_retry_limit;
797
798	return;
799}
800
801static void wi_intr(xsc)
802	void		*xsc;
803{
804	struct wi_softc		*sc = xsc;
805	struct ifnet		*ifp;
806	u_int16_t		status;
807
808	WI_LOCK(sc);
809
810	ifp = &sc->arpcom.ac_if;
811
812	if (sc->wi_gone || !(ifp->if_flags & IFF_UP)) {
813		CSR_WRITE_2(sc, WI_EVENT_ACK, 0xFFFF);
814		CSR_WRITE_2(sc, WI_INT_EN, 0);
815		WI_UNLOCK(sc);
816		return;
817	}
818
819	/* Disable interrupts. */
820	CSR_WRITE_2(sc, WI_INT_EN, 0);
821
822	status = CSR_READ_2(sc, WI_EVENT_STAT);
823	CSR_WRITE_2(sc, WI_EVENT_ACK, ~WI_INTRS);
824
825	if (status & WI_EV_RX) {
826		wi_rxeof(sc);
827		CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_RX);
828	}
829
830	if (status & WI_EV_TX) {
831		wi_txeof(sc, status);
832		CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_TX);
833	}
834
835	if (status & WI_EV_ALLOC) {
836		int			id;
837
838		id = CSR_READ_2(sc, WI_ALLOC_FID);
839		CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_ALLOC);
840		if (id == sc->wi_tx_data_id)
841			wi_txeof(sc, status);
842	}
843
844	if (status & WI_EV_INFO) {
845		wi_update_stats(sc);
846		CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_INFO);
847	}
848
849	if (status & WI_EV_TX_EXC) {
850		wi_txeof(sc, status);
851		CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_TX_EXC);
852	}
853
854	if (status & WI_EV_INFO_DROP) {
855		CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_INFO_DROP);
856	}
857
858	/* Re-enable interrupts. */
859	CSR_WRITE_2(sc, WI_INT_EN, WI_INTRS);
860
861	if (ifp->if_snd.ifq_head != NULL) {
862		wi_start(ifp);
863	}
864
865	WI_UNLOCK(sc);
866
867	return;
868}
869
870static int wi_cmd(sc, cmd, val)
871	struct wi_softc		*sc;
872	int			cmd;
873	int			val;
874{
875	int			i, s = 0;
876
877	/* wait for the busy bit to clear */
878	for (i = 500; i > 0; i--) {	/* 5s */
879		if (!(CSR_READ_2(sc, WI_COMMAND) & WI_CMD_BUSY)) {
880			break;
881		}
882		DELAY(10*1000);	/* 10 m sec */
883	}
884	if (i == 0) {
885		return(ETIMEDOUT);
886	}
887
888	CSR_WRITE_2(sc, WI_PARAM0, val);
889	CSR_WRITE_2(sc, WI_PARAM1, 0);
890	CSR_WRITE_2(sc, WI_PARAM2, 0);
891	CSR_WRITE_2(sc, WI_COMMAND, cmd);
892
893	for (i = 0; i < WI_TIMEOUT; i++) {
894		/*
895		 * Wait for 'command complete' bit to be
896		 * set in the event status register.
897		 */
898		s = CSR_READ_2(sc, WI_EVENT_STAT) & WI_EV_CMD;
899		if (s) {
900			/* Ack the event and read result code. */
901			s = CSR_READ_2(sc, WI_STATUS);
902			CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_CMD);
903#ifdef foo
904			if ((s & WI_CMD_CODE_MASK) != (cmd & WI_CMD_CODE_MASK))
905				return(EIO);
906#endif
907			if (s & WI_STAT_CMD_RESULT)
908				return(EIO);
909			break;
910		}
911		if (cmd == WI_CMD_INI)
912			DELAY(100);
913	}
914
915	if (i == WI_TIMEOUT)
916		return(ETIMEDOUT);
917
918	return(0);
919}
920
921static void wi_reset(sc)
922	struct wi_softc		*sc;
923{
924#define WI_INIT_TRIES 5
925	int i;
926
927	for (i = 0; i < WI_INIT_TRIES; i++) {
928		if (wi_cmd(sc, WI_CMD_INI, 0) == 0)
929			break;
930		DELAY(50 * 1000);	/* 50ms */
931	}
932	if (i == WI_INIT_TRIES)
933		device_printf(sc->dev, "init failed\n");
934
935	CSR_WRITE_2(sc, WI_INT_EN, 0);
936	CSR_WRITE_2(sc, WI_EVENT_ACK, 0xFFFF);
937
938	/* Calibrate timer. */
939	WI_SETVAL(WI_RID_TICK_TIME, 8);
940
941	return;
942}
943
944/*
945 * Read an LTV record from the NIC.
946 */
947static int wi_read_record(sc, ltv)
948	struct wi_softc		*sc;
949	struct wi_ltv_gen	*ltv;
950{
951	u_int16_t		*ptr;
952	int			i, len, code;
953	struct wi_ltv_gen	*oltv, p2ltv;
954
955	oltv = ltv;
956	if (sc->wi_prism2) {
957		switch (ltv->wi_type) {
958		case WI_RID_ENCRYPTION:
959			p2ltv.wi_type = WI_RID_P2_ENCRYPTION;
960			p2ltv.wi_len = 2;
961			ltv = &p2ltv;
962			break;
963		case WI_RID_TX_CRYPT_KEY:
964			p2ltv.wi_type = WI_RID_P2_TX_CRYPT_KEY;
965			p2ltv.wi_len = 2;
966			ltv = &p2ltv;
967			break;
968		}
969	}
970
971	/* Tell the NIC to enter record read mode. */
972	if (wi_cmd(sc, WI_CMD_ACCESS|WI_ACCESS_READ, ltv->wi_type))
973		return(EIO);
974
975	/* Seek to the record. */
976	if (wi_seek(sc, ltv->wi_type, 0, WI_BAP1))
977		return(EIO);
978
979	/*
980	 * Read the length and record type and make sure they
981	 * match what we expect (this verifies that we have enough
982	 * room to hold all of the returned data).
983	 */
984	len = CSR_READ_2(sc, WI_DATA1);
985	if (len > ltv->wi_len)
986		return(ENOSPC);
987	code = CSR_READ_2(sc, WI_DATA1);
988	if (code != ltv->wi_type)
989		return(EIO);
990
991	ltv->wi_len = len;
992	ltv->wi_type = code;
993
994	/* Now read the data. */
995	ptr = &ltv->wi_val;
996	for (i = 0; i < ltv->wi_len - 1; i++)
997		ptr[i] = CSR_READ_2(sc, WI_DATA1);
998
999	if (sc->wi_prism2) {
1000		switch (oltv->wi_type) {
1001		case WI_RID_TX_RATE:
1002		case WI_RID_CUR_TX_RATE:
1003			switch (ltv->wi_val) {
1004			case 1: oltv->wi_val = 1; break;
1005			case 2: oltv->wi_val = 2; break;
1006			case 3:	oltv->wi_val = 6; break;
1007			case 4: oltv->wi_val = 5; break;
1008			case 7: oltv->wi_val = 7; break;
1009			case 8: oltv->wi_val = 11; break;
1010			case 15: oltv->wi_val = 3; break;
1011			default: oltv->wi_val = 0x100 + ltv->wi_val; break;
1012			}
1013			break;
1014		case WI_RID_ENCRYPTION:
1015			oltv->wi_len = 2;
1016			if (ltv->wi_val & 0x01)
1017				oltv->wi_val = 1;
1018			else
1019				oltv->wi_val = 0;
1020			break;
1021		case WI_RID_TX_CRYPT_KEY:
1022			oltv->wi_len = 2;
1023			oltv->wi_val = ltv->wi_val;
1024			break;
1025		}
1026	}
1027
1028	return(0);
1029}
1030
1031/*
1032 * Same as read, except we inject data instead of reading it.
1033 */
1034static int wi_write_record(sc, ltv)
1035	struct wi_softc		*sc;
1036	struct wi_ltv_gen	*ltv;
1037{
1038	u_int16_t		*ptr;
1039	int			i;
1040	struct wi_ltv_gen	p2ltv;
1041
1042	if (sc->wi_prism2) {
1043		switch (ltv->wi_type) {
1044		case WI_RID_TX_RATE:
1045			p2ltv.wi_type = WI_RID_TX_RATE;
1046			p2ltv.wi_len = 2;
1047			switch (ltv->wi_val) {
1048			case 1: p2ltv.wi_val = 1; break;
1049			case 2: p2ltv.wi_val = 2; break;
1050			case 3:	p2ltv.wi_val = 15; break;
1051			case 5: p2ltv.wi_val = 4; break;
1052			case 6: p2ltv.wi_val = 3; break;
1053			case 7: p2ltv.wi_val = 7; break;
1054			case 11: p2ltv.wi_val = 8; break;
1055			default: return EINVAL;
1056			}
1057			ltv = &p2ltv;
1058			break;
1059		case WI_RID_ENCRYPTION:
1060			p2ltv.wi_type = WI_RID_P2_ENCRYPTION;
1061			p2ltv.wi_len = 2;
1062			if (ltv->wi_val)
1063				p2ltv.wi_val = 0x03;
1064			else
1065				p2ltv.wi_val = 0x90;
1066			ltv = &p2ltv;
1067			break;
1068		case WI_RID_TX_CRYPT_KEY:
1069			p2ltv.wi_type = WI_RID_P2_TX_CRYPT_KEY;
1070			p2ltv.wi_len = 2;
1071			p2ltv.wi_val = ltv->wi_val;
1072			ltv = &p2ltv;
1073			break;
1074		case WI_RID_DEFLT_CRYPT_KEYS:
1075		    {
1076			int error;
1077			struct wi_ltv_str	ws;
1078			struct wi_ltv_keys	*wk =
1079			    (struct wi_ltv_keys *)ltv;
1080
1081			for (i = 0; i < 4; i++) {
1082				ws.wi_len = 4;
1083				ws.wi_type = WI_RID_P2_CRYPT_KEY0 + i;
1084				memcpy(ws.wi_str,
1085				    &wk->wi_keys[i].wi_keydat, 5);
1086				ws.wi_str[5] = '\0';
1087				error = wi_write_record(sc,
1088				    (struct wi_ltv_gen *)&ws);
1089				if (error)
1090					return error;
1091			}
1092			return 0;
1093		    }
1094		}
1095	}
1096
1097	if (wi_seek(sc, ltv->wi_type, 0, WI_BAP1))
1098		return(EIO);
1099
1100	CSR_WRITE_2(sc, WI_DATA1, ltv->wi_len);
1101	CSR_WRITE_2(sc, WI_DATA1, ltv->wi_type);
1102
1103	ptr = &ltv->wi_val;
1104	for (i = 0; i < ltv->wi_len - 1; i++)
1105		CSR_WRITE_2(sc, WI_DATA1, ptr[i]);
1106
1107	if (wi_cmd(sc, WI_CMD_ACCESS|WI_ACCESS_WRITE, ltv->wi_type))
1108		return(EIO);
1109
1110	return(0);
1111}
1112
1113static int wi_seek(sc, id, off, chan)
1114	struct wi_softc		*sc;
1115	int			id, off, chan;
1116{
1117	int			i;
1118	int			selreg, offreg;
1119	int			status;
1120
1121	switch (chan) {
1122	case WI_BAP0:
1123		selreg = WI_SEL0;
1124		offreg = WI_OFF0;
1125		break;
1126	case WI_BAP1:
1127		selreg = WI_SEL1;
1128		offreg = WI_OFF1;
1129		break;
1130	default:
1131		device_printf(sc->dev, "invalid data path: %x\n", chan);
1132		return(EIO);
1133	}
1134
1135	CSR_WRITE_2(sc, selreg, id);
1136	CSR_WRITE_2(sc, offreg, off);
1137
1138	for (i = 0; i < WI_TIMEOUT; i++) {
1139		status = CSR_READ_2(sc, offreg);
1140		if (!(status & (WI_OFF_BUSY|WI_OFF_ERR)))
1141			break;
1142	}
1143
1144	if (i == WI_TIMEOUT) {
1145		device_printf(sc->dev, "timeout in wi_seek to %x/%x; last status %x\n",
1146			id, off, status);
1147		return(ETIMEDOUT);
1148	}
1149
1150	return(0);
1151}
1152
1153static int wi_read_data(sc, id, off, buf, len)
1154	struct wi_softc		*sc;
1155	int			id, off;
1156	caddr_t			buf;
1157	int			len;
1158{
1159	int			i;
1160	u_int16_t		*ptr;
1161
1162	if (wi_seek(sc, id, off, WI_BAP1))
1163		return(EIO);
1164
1165	ptr = (u_int16_t *)buf;
1166	for (i = 0; i < len / 2; i++)
1167		ptr[i] = CSR_READ_2(sc, WI_DATA1);
1168
1169	return(0);
1170}
1171
1172/*
1173 * According to the comments in the HCF Light code, there is a bug in
1174 * the Hermes (or possibly in certain Hermes firmware revisions) where
1175 * the chip's internal autoincrement counter gets thrown off during
1176 * data writes: the autoincrement is missed, causing one data word to
1177 * be overwritten and subsequent words to be written to the wrong memory
1178 * locations. The end result is that we could end up transmitting bogus
1179 * frames without realizing it. The workaround for this is to write a
1180 * couple of extra guard words after the end of the transfer, then
1181 * attempt to read then back. If we fail to locate the guard words where
1182 * we expect them, we preform the transfer over again.
1183 */
1184static int wi_write_data(sc, id, off, buf, len)
1185	struct wi_softc		*sc;
1186	int			id, off;
1187	caddr_t			buf;
1188	int			len;
1189{
1190	int			i;
1191	u_int16_t		*ptr;
1192#ifdef WI_HERMES_AUTOINC_WAR
1193	int			retries;
1194
1195	retries = 512;
1196again:
1197#endif
1198
1199	if (wi_seek(sc, id, off, WI_BAP0))
1200		return(EIO);
1201
1202	ptr = (u_int16_t *)buf;
1203	for (i = 0; i < (len / 2); i++)
1204		CSR_WRITE_2(sc, WI_DATA0, ptr[i]);
1205
1206#ifdef WI_HERMES_AUTOINC_WAR
1207	CSR_WRITE_2(sc, WI_DATA0, 0x1234);
1208	CSR_WRITE_2(sc, WI_DATA0, 0x5678);
1209
1210	if (wi_seek(sc, id, off + len, WI_BAP0))
1211		return(EIO);
1212
1213	if (CSR_READ_2(sc, WI_DATA0) != 0x1234 ||
1214	    CSR_READ_2(sc, WI_DATA0) != 0x5678) {
1215		if (--retries >= 0)
1216			goto again;
1217		device_printf(sc->dev, "wi_write_data device timeout\n");
1218		return (EIO);
1219	}
1220#endif
1221
1222	return(0);
1223}
1224
1225/*
1226 * Allocate a region of memory inside the NIC and zero
1227 * it out.
1228 */
1229static int wi_alloc_nicmem(sc, len, id)
1230	struct wi_softc		*sc;
1231	int			len;
1232	int			*id;
1233{
1234	int			i;
1235
1236	if (wi_cmd(sc, WI_CMD_ALLOC_MEM, len)) {
1237		device_printf(sc->dev,
1238		    "failed to allocate %d bytes on NIC\n", len);
1239		return(ENOMEM);
1240	}
1241
1242	for (i = 0; i < WI_TIMEOUT; i++) {
1243		if (CSR_READ_2(sc, WI_EVENT_STAT) & WI_EV_ALLOC)
1244			break;
1245	}
1246
1247	if (i == WI_TIMEOUT) {
1248		device_printf(sc->dev, "time out allocating memory on card\n");
1249		return(ETIMEDOUT);
1250	}
1251
1252	CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_ALLOC);
1253	*id = CSR_READ_2(sc, WI_ALLOC_FID);
1254
1255	if (wi_seek(sc, *id, 0, WI_BAP0)) {
1256		device_printf(sc->dev, "seek failed while allocating memory on card\n");
1257		return(EIO);
1258	}
1259
1260	for (i = 0; i < len / 2; i++)
1261		CSR_WRITE_2(sc, WI_DATA0, 0);
1262
1263	return(0);
1264}
1265
1266static void wi_setmulti(sc)
1267	struct wi_softc		*sc;
1268{
1269	struct ifnet		*ifp;
1270	int			i = 0;
1271	struct ifmultiaddr	*ifma;
1272	struct wi_ltv_mcast	mcast;
1273
1274	ifp = &sc->arpcom.ac_if;
1275
1276	bzero((char *)&mcast, sizeof(mcast));
1277
1278	mcast.wi_type = WI_RID_MCAST;
1279	mcast.wi_len = (3 * 16) + 1;
1280
1281	if (ifp->if_flags & IFF_ALLMULTI || ifp->if_flags & IFF_PROMISC) {
1282		wi_write_record(sc, (struct wi_ltv_gen *)&mcast);
1283		return;
1284	}
1285
1286	TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
1287		if (ifma->ifma_addr->sa_family != AF_LINK)
1288			continue;
1289		if (i < 16) {
1290			bcopy(LLADDR((struct sockaddr_dl *)ifma->ifma_addr),
1291			    (char *)&mcast.wi_mcast[i], ETHER_ADDR_LEN);
1292			i++;
1293		} else {
1294			bzero((char *)&mcast, sizeof(mcast));
1295			break;
1296		}
1297	}
1298
1299	mcast.wi_len = (i * 3) + 1;
1300	wi_write_record(sc, (struct wi_ltv_gen *)&mcast);
1301
1302	return;
1303}
1304
1305static void wi_setdef(sc, wreq)
1306	struct wi_softc		*sc;
1307	struct wi_req		*wreq;
1308{
1309	struct sockaddr_dl	*sdl;
1310	struct ifaddr		*ifa;
1311	struct ifnet		*ifp;
1312
1313	ifp = &sc->arpcom.ac_if;
1314
1315	switch(wreq->wi_type) {
1316	case WI_RID_MAC_NODE:
1317		ifa = ifaddr_byindex(ifp->if_index);
1318		sdl = (struct sockaddr_dl *)ifa->ifa_addr;
1319		bcopy((char *)&wreq->wi_val, (char *)&sc->arpcom.ac_enaddr,
1320		   ETHER_ADDR_LEN);
1321		bcopy((char *)&wreq->wi_val, LLADDR(sdl), ETHER_ADDR_LEN);
1322		break;
1323	case WI_RID_PORTTYPE:
1324		sc->wi_ptype = wreq->wi_val[0];
1325		break;
1326	case WI_RID_TX_RATE:
1327		sc->wi_tx_rate = wreq->wi_val[0];
1328		break;
1329	case WI_RID_MAX_DATALEN:
1330		sc->wi_max_data_len = wreq->wi_val[0];
1331		break;
1332	case WI_RID_RTS_THRESH:
1333		sc->wi_rts_thresh = wreq->wi_val[0];
1334		break;
1335	case WI_RID_SYSTEM_SCALE:
1336		sc->wi_ap_density = wreq->wi_val[0];
1337		break;
1338	case WI_RID_CREATE_IBSS:
1339		sc->wi_create_ibss = wreq->wi_val[0];
1340		break;
1341	case WI_RID_OWN_CHNL:
1342		sc->wi_channel = wreq->wi_val[0];
1343		break;
1344	case WI_RID_NODENAME:
1345		bzero(sc->wi_node_name, sizeof(sc->wi_node_name));
1346		bcopy((char *)&wreq->wi_val[1], sc->wi_node_name, 30);
1347		break;
1348	case WI_RID_DESIRED_SSID:
1349		bzero(sc->wi_net_name, sizeof(sc->wi_net_name));
1350		bcopy((char *)&wreq->wi_val[1], sc->wi_net_name, 30);
1351		break;
1352	case WI_RID_OWN_SSID:
1353		bzero(sc->wi_ibss_name, sizeof(sc->wi_ibss_name));
1354		bcopy((char *)&wreq->wi_val[1], sc->wi_ibss_name, 30);
1355		break;
1356	case WI_RID_PM_ENABLED:
1357		sc->wi_pm_enabled = wreq->wi_val[0];
1358		break;
1359	case WI_RID_MAX_SLEEP:
1360		sc->wi_max_sleep = wreq->wi_val[0];
1361		break;
1362	case WI_RID_ENCRYPTION:
1363		sc->wi_use_wep = wreq->wi_val[0];
1364		break;
1365	case WI_RID_TX_CRYPT_KEY:
1366		sc->wi_tx_key = wreq->wi_val[0];
1367		break;
1368	case WI_RID_DEFLT_CRYPT_KEYS:
1369		bcopy((char *)wreq, (char *)&sc->wi_keys,
1370		    sizeof(struct wi_ltv_keys));
1371		break;
1372	default:
1373		break;
1374	}
1375
1376	/* Reinitialize WaveLAN. */
1377	wi_init(sc);
1378
1379	return;
1380}
1381
1382static int wi_ioctl(ifp, command, data)
1383	struct ifnet		*ifp;
1384	u_long			command;
1385	caddr_t			data;
1386{
1387	int			error = 0;
1388	int			len;
1389	u_int8_t		tmpkey[14];
1390	char			tmpssid[IEEE80211_NWID_LEN];
1391	struct wi_softc		*sc;
1392	struct wi_req		wreq;
1393	struct ifreq		*ifr;
1394	struct ieee80211req	*ireq;
1395	struct proc		*p = curproc;
1396
1397	sc = ifp->if_softc;
1398	WI_LOCK(sc);
1399	ifr = (struct ifreq *)data;
1400	ireq = (struct ieee80211req *)data;
1401
1402	if (sc->wi_gone) {
1403		error = ENODEV;
1404		goto out;
1405	}
1406
1407	switch(command) {
1408	case SIOCSIFADDR:
1409	case SIOCGIFADDR:
1410	case SIOCSIFMTU:
1411		error = ether_ioctl(ifp, command, data);
1412		break;
1413	case SIOCSIFFLAGS:
1414		if (ifp->if_flags & IFF_UP) {
1415			if (ifp->if_flags & IFF_RUNNING &&
1416			    ifp->if_flags & IFF_PROMISC &&
1417			    !(sc->wi_if_flags & IFF_PROMISC)) {
1418				WI_SETVAL(WI_RID_PROMISC, 1);
1419			} else if (ifp->if_flags & IFF_RUNNING &&
1420			    !(ifp->if_flags & IFF_PROMISC) &&
1421			    sc->wi_if_flags & IFF_PROMISC) {
1422				WI_SETVAL(WI_RID_PROMISC, 0);
1423			} else
1424				wi_init(sc);
1425		} else {
1426			if (ifp->if_flags & IFF_RUNNING) {
1427				wi_stop(sc);
1428			}
1429		}
1430		sc->wi_if_flags = ifp->if_flags;
1431		error = 0;
1432		break;
1433	case SIOCSIFMEDIA:
1434	case SIOCGIFMEDIA:
1435		error = ifmedia_ioctl(ifp, ifr, &sc->ifmedia, command);
1436		break;
1437	case SIOCADDMULTI:
1438	case SIOCDELMULTI:
1439		wi_setmulti(sc);
1440		error = 0;
1441		break;
1442	case SIOCGWAVELAN:
1443		error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1444		if (error)
1445			break;
1446		/* Don't show WEP keys to non-root users. */
1447		if (wreq.wi_type == WI_RID_DEFLT_CRYPT_KEYS && suser(p))
1448			break;
1449		if (wreq.wi_type == WI_RID_IFACE_STATS) {
1450			bcopy((char *)&sc->wi_stats, (char *)&wreq.wi_val,
1451			    sizeof(sc->wi_stats));
1452			wreq.wi_len = (sizeof(sc->wi_stats) / 2) + 1;
1453		} else if (wreq.wi_type == WI_RID_DEFLT_CRYPT_KEYS) {
1454			bcopy((char *)&sc->wi_keys, (char *)&wreq,
1455			    sizeof(struct wi_ltv_keys));
1456		}
1457#ifdef WICACHE
1458		else if (wreq.wi_type == WI_RID_ZERO_CACHE) {
1459			sc->wi_sigitems = sc->wi_nextitem = 0;
1460		} else if (wreq.wi_type == WI_RID_READ_CACHE) {
1461			char *pt = (char *)&wreq.wi_val;
1462			bcopy((char *)&sc->wi_sigitems,
1463			    (char *)pt, sizeof(int));
1464			pt += (sizeof (int));
1465			wreq.wi_len = sizeof(int) / 2;
1466			bcopy((char *)&sc->wi_sigcache, (char *)pt,
1467			    sizeof(struct wi_sigcache) * sc->wi_sigitems);
1468			wreq.wi_len += ((sizeof(struct wi_sigcache) *
1469			    sc->wi_sigitems) / 2) + 1;
1470		}
1471#endif
1472		else {
1473			if (wi_read_record(sc, (struct wi_ltv_gen *)&wreq)) {
1474				error = EINVAL;
1475				break;
1476			}
1477		}
1478		error = copyout(&wreq, ifr->ifr_data, sizeof(wreq));
1479		break;
1480	case SIOCSWAVELAN:
1481		if ((error = suser(p)))
1482			goto out;
1483		error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
1484		if (error)
1485			break;
1486		if (wreq.wi_type == WI_RID_IFACE_STATS) {
1487			error = EINVAL;
1488			break;
1489		} else if (wreq.wi_type == WI_RID_MGMT_XMIT) {
1490			error = wi_mgmt_xmit(sc, (caddr_t)&wreq.wi_val,
1491			    wreq.wi_len);
1492		} else {
1493			error = wi_write_record(sc, (struct wi_ltv_gen *)&wreq);
1494			if (!error)
1495				wi_setdef(sc, &wreq);
1496		}
1497		break;
1498	case SIOCG80211:
1499		switch(ireq->i_type) {
1500		case IEEE80211_IOC_SSID:
1501			if(ireq->i_val == -1) {
1502				bzero(tmpssid, IEEE80211_NWID_LEN);
1503				error = wi_get_cur_ssid(sc, tmpssid, &len);
1504				if (error != 0)
1505					break;
1506				error = copyout(tmpssid, ireq->i_data,
1507					IEEE80211_NWID_LEN);
1508				ireq->i_len = len;
1509			} else if (ireq->i_val == 0) {
1510				error = copyout(sc->wi_net_name,
1511				    ireq->i_data,
1512				    IEEE80211_NWID_LEN);
1513				ireq->i_len = IEEE80211_NWID_LEN;
1514			} else
1515				error = EINVAL;
1516			break;
1517		case IEEE80211_IOC_NUMSSIDS:
1518			ireq->i_val = 1;
1519			break;
1520		case IEEE80211_IOC_WEP:
1521			if(!sc->wi_has_wep) {
1522				ireq->i_val = IEEE80211_WEP_NOSUP;
1523			} else {
1524				if(sc->wi_use_wep) {
1525					ireq->i_val =
1526					    IEEE80211_WEP_MIXED;
1527				} else {
1528					ireq->i_val =
1529					    IEEE80211_WEP_OFF;
1530				}
1531			}
1532			break;
1533		case IEEE80211_IOC_WEPKEY:
1534			if(!sc->wi_has_wep ||
1535			    ireq->i_val < 0 || ireq->i_val > 3) {
1536				error = EINVAL;
1537				break;
1538			}
1539			len = sc->wi_keys.wi_keys[ireq->i_val].wi_keylen;
1540			if (suser(p))
1541				bcopy(sc->wi_keys.wi_keys[ireq->i_val].wi_keydat,
1542				    tmpkey, len);
1543			else
1544				bzero(tmpkey, len);
1545
1546			ireq->i_len = len;
1547			error = copyout(tmpkey, ireq->i_data, len);
1548
1549			break;
1550		case IEEE80211_IOC_NUMWEPKEYS:
1551			if(!sc->wi_has_wep)
1552				error = EINVAL;
1553			else
1554				ireq->i_val = 4;
1555			break;
1556		case IEEE80211_IOC_WEPTXKEY:
1557			if(!sc->wi_has_wep)
1558				error = EINVAL;
1559			else
1560				ireq->i_val = sc->wi_tx_key;
1561			break;
1562		case IEEE80211_IOC_AUTHMODE:
1563			ireq->i_val = IEEE80211_AUTH_NONE;
1564			break;
1565		case IEEE80211_IOC_STATIONNAME:
1566			error = copyout(sc->wi_node_name,
1567			    ireq->i_data, IEEE80211_NWID_LEN);
1568			ireq->i_len = IEEE80211_NWID_LEN;
1569			break;
1570		case IEEE80211_IOC_CHANNEL:
1571			wreq.wi_type = WI_RID_CURRENT_CHAN;
1572			wreq.wi_len = WI_MAX_DATALEN;
1573			if (wi_read_record(sc, (struct wi_ltv_gen *)&wreq))
1574				error = EINVAL;
1575			else {
1576				ireq->i_val = wreq.wi_val[0];
1577			}
1578			break;
1579		case IEEE80211_IOC_POWERSAVE:
1580			if(sc->wi_pm_enabled)
1581				ireq->i_val = IEEE80211_POWERSAVE_ON;
1582			else
1583				ireq->i_val = IEEE80211_POWERSAVE_OFF;
1584			break;
1585		case IEEE80211_IOC_POWERSAVESLEEP:
1586			ireq->i_val = sc->wi_max_sleep;
1587			break;
1588		default:
1589			error = EINVAL;
1590		}
1591		break;
1592	case SIOCS80211:
1593		if ((error = suser(p)))
1594			goto out;
1595		switch(ireq->i_type) {
1596		case IEEE80211_IOC_SSID:
1597			if (ireq->i_val != 0 ||
1598			    ireq->i_len > IEEE80211_NWID_LEN) {
1599				error = EINVAL;
1600				break;
1601			}
1602			/* We set both of them */
1603			bzero(sc->wi_net_name, IEEE80211_NWID_LEN);
1604			error = copyin(ireq->i_data,
1605			    sc->wi_net_name, ireq->i_len);
1606			bcopy(sc->wi_net_name, sc->wi_ibss_name, IEEE80211_NWID_LEN);
1607			break;
1608		case IEEE80211_IOC_WEP:
1609			/*
1610			 * These cards only support one mode so
1611			 * we just turn wep on what ever is
1612			 * passed in if it's not OFF.
1613			 */
1614			if (ireq->i_val == IEEE80211_WEP_OFF) {
1615				sc->wi_use_wep = 0;
1616			} else {
1617				sc->wi_use_wep = 1;
1618			}
1619			break;
1620		case IEEE80211_IOC_WEPKEY:
1621			if (ireq->i_val < 0 || ireq->i_val > 3 ||
1622				ireq->i_len > 13) {
1623				error = EINVAL;
1624				break;
1625			}
1626			bzero(sc->wi_keys.wi_keys[ireq->i_val].wi_keydat, 13);
1627			error = copyin(ireq->i_data,
1628			    sc->wi_keys.wi_keys[ireq->i_val].wi_keydat,
1629			    ireq->i_len);
1630			if(error)
1631				break;
1632			sc->wi_keys.wi_keys[ireq->i_val].wi_keylen =
1633				    ireq->i_len;
1634			break;
1635		case IEEE80211_IOC_WEPTXKEY:
1636			if (ireq->i_val < 0 || ireq->i_val > 3) {
1637				error = EINVAL;
1638				break;
1639			}
1640			sc->wi_tx_key = ireq->i_val;
1641			break;
1642		case IEEE80211_IOC_AUTHMODE:
1643			error = EINVAL;
1644			break;
1645		case IEEE80211_IOC_STATIONNAME:
1646			if (ireq->i_len > 32) {
1647				error = EINVAL;
1648				break;
1649			}
1650			bzero(sc->wi_node_name, 32);
1651			error = copyin(ireq->i_data,
1652			    sc->wi_node_name, ireq->i_len);
1653			break;
1654		case IEEE80211_IOC_CHANNEL:
1655			/*
1656			 * The actual range is 1-14, but if you
1657			 * set it to 0 you get the default. So
1658			 * we let that work too.
1659			 */
1660			if (ireq->i_val < 0 || ireq->i_val > 14) {
1661				error = EINVAL;
1662				break;
1663			}
1664			sc->wi_channel = ireq->i_val;
1665			break;
1666		case IEEE80211_IOC_POWERSAVE:
1667			switch (ireq->i_val) {
1668			case IEEE80211_POWERSAVE_OFF:
1669				sc->wi_pm_enabled = 0;
1670				break;
1671			case IEEE80211_POWERSAVE_ON:
1672				sc->wi_pm_enabled = 1;
1673				break;
1674			default:
1675				error = EINVAL;
1676				break;
1677			}
1678			break;
1679		case IEEE80211_IOC_POWERSAVESLEEP:
1680			if (ireq->i_val < 0) {
1681				error = EINVAL;
1682				break;
1683			}
1684			sc->wi_max_sleep = ireq->i_val;
1685			break;
1686		default:
1687			error = EINVAL;
1688			break;
1689		}
1690
1691		/* Reinitialize WaveLAN. */
1692		wi_init(sc);
1693
1694		break;
1695	default:
1696		error = EINVAL;
1697		break;
1698	}
1699out:
1700	WI_UNLOCK(sc);
1701
1702	return(error);
1703}
1704
1705static void wi_init(xsc)
1706	void			*xsc;
1707{
1708	struct wi_softc		*sc = xsc;
1709	struct ifnet		*ifp = &sc->arpcom.ac_if;
1710	struct wi_ltv_macaddr	mac;
1711	int			id = 0;
1712
1713	WI_LOCK(sc);
1714
1715	if (sc->wi_gone) {
1716		WI_UNLOCK(sc);
1717		return;
1718	}
1719
1720	if (ifp->if_flags & IFF_RUNNING)
1721		wi_stop(sc);
1722
1723	wi_reset(sc);
1724
1725	/* Program max data length. */
1726	WI_SETVAL(WI_RID_MAX_DATALEN, sc->wi_max_data_len);
1727
1728	/* Enable/disable IBSS creation. */
1729	WI_SETVAL(WI_RID_CREATE_IBSS, sc->wi_create_ibss);
1730
1731	/* Set the port type. */
1732	WI_SETVAL(WI_RID_PORTTYPE, sc->wi_ptype);
1733
1734	/* Program the RTS/CTS threshold. */
1735	WI_SETVAL(WI_RID_RTS_THRESH, sc->wi_rts_thresh);
1736
1737	/* Program the TX rate */
1738	WI_SETVAL(WI_RID_TX_RATE, sc->wi_tx_rate);
1739
1740	/* Access point density */
1741	WI_SETVAL(WI_RID_SYSTEM_SCALE, sc->wi_ap_density);
1742
1743	/* Power Management Enabled */
1744	WI_SETVAL(WI_RID_PM_ENABLED, sc->wi_pm_enabled);
1745
1746	/* Power Managment Max Sleep */
1747	WI_SETVAL(WI_RID_MAX_SLEEP, sc->wi_max_sleep);
1748
1749	/* Specify the IBSS name */
1750	WI_SETSTR(WI_RID_OWN_SSID, sc->wi_ibss_name);
1751
1752	/* Specify the network name */
1753	WI_SETSTR(WI_RID_DESIRED_SSID, sc->wi_net_name);
1754
1755	/* Specify the frequency to use */
1756	WI_SETVAL(WI_RID_OWN_CHNL, sc->wi_channel);
1757
1758	/* Program the nodename. */
1759	WI_SETSTR(WI_RID_NODENAME, sc->wi_node_name);
1760
1761	/* Set our MAC address. */
1762	mac.wi_len = 4;
1763	mac.wi_type = WI_RID_MAC_NODE;
1764	bcopy((char *)&sc->arpcom.ac_enaddr,
1765	   (char *)&mac.wi_mac_addr, ETHER_ADDR_LEN);
1766	wi_write_record(sc, (struct wi_ltv_gen *)&mac);
1767
1768	/* Configure WEP. */
1769	if (sc->wi_has_wep) {
1770		WI_SETVAL(WI_RID_ENCRYPTION, sc->wi_use_wep);
1771		WI_SETVAL(WI_RID_TX_CRYPT_KEY, sc->wi_tx_key);
1772		sc->wi_keys.wi_len = (sizeof(struct wi_ltv_keys) / 2) + 1;
1773		sc->wi_keys.wi_type = WI_RID_DEFLT_CRYPT_KEYS;
1774		wi_write_record(sc, (struct wi_ltv_gen *)&sc->wi_keys);
1775	}
1776
1777	/* Initialize promisc mode. */
1778	if (ifp->if_flags & IFF_PROMISC) {
1779		WI_SETVAL(WI_RID_PROMISC, 1);
1780	} else {
1781		WI_SETVAL(WI_RID_PROMISC, 0);
1782	}
1783
1784	/* Set multicast filter. */
1785	wi_setmulti(sc);
1786
1787	/* Enable desired port */
1788	wi_cmd(sc, WI_CMD_ENABLE|sc->wi_portnum, 0);
1789
1790	if (wi_alloc_nicmem(sc, ETHER_MAX_LEN + sizeof(struct wi_frame) + 8, &id))
1791		device_printf(sc->dev, "tx buffer allocation failed\n");
1792	sc->wi_tx_data_id = id;
1793
1794	if (wi_alloc_nicmem(sc, ETHER_MAX_LEN + sizeof(struct wi_frame) + 8, &id))
1795		device_printf(sc->dev, "mgmt. buffer allocation failed\n");
1796	sc->wi_tx_mgmt_id = id;
1797
1798	/* enable interrupts */
1799	CSR_WRITE_2(sc, WI_INT_EN, WI_INTRS);
1800
1801	ifp->if_flags |= IFF_RUNNING;
1802	ifp->if_flags &= ~IFF_OACTIVE;
1803
1804	sc->wi_stat_ch = timeout(wi_inquire, sc, hz * 60);
1805	WI_UNLOCK(sc);
1806
1807	return;
1808}
1809
1810static void wi_start(ifp)
1811	struct ifnet		*ifp;
1812{
1813	struct wi_softc		*sc;
1814	struct mbuf		*m0;
1815	struct wi_frame		tx_frame;
1816	struct ether_header	*eh;
1817	int			id;
1818
1819	sc = ifp->if_softc;
1820	WI_LOCK(sc);
1821
1822	if (sc->wi_gone) {
1823		WI_UNLOCK(sc);
1824		return;
1825	}
1826
1827	if (ifp->if_flags & IFF_OACTIVE) {
1828		WI_UNLOCK(sc);
1829		return;
1830	}
1831
1832	IF_DEQUEUE(&ifp->if_snd, m0);
1833	if (m0 == NULL) {
1834		WI_UNLOCK(sc);
1835		return;
1836	}
1837
1838	bzero((char *)&tx_frame, sizeof(tx_frame));
1839	id = sc->wi_tx_data_id;
1840	eh = mtod(m0, struct ether_header *);
1841
1842	/*
1843	 * Use RFC1042 encoding for IP and ARP datagrams,
1844	 * 802.3 for anything else.
1845	 */
1846	if (ntohs(eh->ether_type) > ETHER_MAX_LEN) {
1847		bcopy((char *)&eh->ether_dhost,
1848		    (char *)&tx_frame.wi_addr1, ETHER_ADDR_LEN);
1849		bcopy((char *)&eh->ether_shost,
1850		    (char *)&tx_frame.wi_addr2, ETHER_ADDR_LEN);
1851		bcopy((char *)&eh->ether_dhost,
1852		    (char *)&tx_frame.wi_dst_addr, ETHER_ADDR_LEN);
1853		bcopy((char *)&eh->ether_shost,
1854		    (char *)&tx_frame.wi_src_addr, ETHER_ADDR_LEN);
1855
1856		tx_frame.wi_dat_len = m0->m_pkthdr.len - WI_SNAPHDR_LEN;
1857		tx_frame.wi_frame_ctl = WI_FTYPE_DATA;
1858		tx_frame.wi_dat[0] = htons(WI_SNAP_WORD0);
1859		tx_frame.wi_dat[1] = htons(WI_SNAP_WORD1);
1860		tx_frame.wi_len = htons(m0->m_pkthdr.len - WI_SNAPHDR_LEN);
1861		tx_frame.wi_type = eh->ether_type;
1862
1863		m_copydata(m0, sizeof(struct ether_header),
1864		    m0->m_pkthdr.len - sizeof(struct ether_header),
1865		    (caddr_t)&sc->wi_txbuf);
1866
1867		wi_write_data(sc, id, 0, (caddr_t)&tx_frame,
1868		    sizeof(struct wi_frame));
1869		wi_write_data(sc, id, WI_802_11_OFFSET, (caddr_t)&sc->wi_txbuf,
1870		    (m0->m_pkthdr.len - sizeof(struct ether_header)) + 2);
1871	} else {
1872		tx_frame.wi_dat_len = m0->m_pkthdr.len;
1873
1874		eh->ether_type = htons(m0->m_pkthdr.len - WI_SNAPHDR_LEN);
1875		m_copydata(m0, 0, m0->m_pkthdr.len, (caddr_t)&sc->wi_txbuf);
1876
1877		wi_write_data(sc, id, 0, (caddr_t)&tx_frame,
1878		    sizeof(struct wi_frame));
1879		wi_write_data(sc, id, WI_802_3_OFFSET, (caddr_t)&sc->wi_txbuf,
1880		    m0->m_pkthdr.len + 2);
1881	}
1882
1883	/*
1884	 * If there's a BPF listner, bounce a copy of
1885	 * this frame to him.
1886	 */
1887	if (ifp->if_bpf)
1888		bpf_mtap(ifp, m0);
1889
1890	m_freem(m0);
1891
1892	if (wi_cmd(sc, WI_CMD_TX|WI_RECLAIM, id))
1893		device_printf(sc->dev, "xmit failed\n");
1894
1895	ifp->if_flags |= IFF_OACTIVE;
1896
1897	/*
1898	 * Set a timeout in case the chip goes out to lunch.
1899	 */
1900	ifp->if_timer = 5;
1901
1902	WI_UNLOCK(sc);
1903	return;
1904}
1905
1906static int wi_mgmt_xmit(sc, data, len)
1907	struct wi_softc		*sc;
1908	caddr_t			data;
1909	int			len;
1910{
1911	struct wi_frame		tx_frame;
1912	int			id;
1913	struct wi_80211_hdr	*hdr;
1914	caddr_t			dptr;
1915
1916	if (sc->wi_gone)
1917		return(ENODEV);
1918
1919	hdr = (struct wi_80211_hdr *)data;
1920	dptr = data + sizeof(struct wi_80211_hdr);
1921
1922	bzero((char *)&tx_frame, sizeof(tx_frame));
1923	id = sc->wi_tx_mgmt_id;
1924
1925	bcopy((char *)hdr, (char *)&tx_frame.wi_frame_ctl,
1926	   sizeof(struct wi_80211_hdr));
1927
1928	tx_frame.wi_dat_len = len - WI_SNAPHDR_LEN;
1929	tx_frame.wi_len = htons(len - WI_SNAPHDR_LEN);
1930
1931	wi_write_data(sc, id, 0, (caddr_t)&tx_frame, sizeof(struct wi_frame));
1932	wi_write_data(sc, id, WI_802_11_OFFSET_RAW, dptr,
1933	    (len - sizeof(struct wi_80211_hdr)) + 2);
1934
1935	if (wi_cmd(sc, WI_CMD_TX|WI_RECLAIM, id)) {
1936		device_printf(sc->dev, "xmit failed\n");
1937		return(EIO);
1938	}
1939
1940	return(0);
1941}
1942
1943static void wi_stop(sc)
1944	struct wi_softc		*sc;
1945{
1946	struct ifnet		*ifp;
1947
1948	WI_LOCK(sc);
1949
1950	if (sc->wi_gone) {
1951		WI_UNLOCK(sc);
1952		return;
1953	}
1954
1955	ifp = &sc->arpcom.ac_if;
1956
1957	/*
1958	 * If the card is gone and the memory port isn't mapped, we will
1959	 * (hopefully) get 0xffff back from the status read, which is not
1960	 * a valid status value.
1961	 */
1962	if (CSR_READ_2(sc, WI_STATUS) != 0xffff) {
1963		CSR_WRITE_2(sc, WI_INT_EN, 0);
1964		wi_cmd(sc, WI_CMD_DISABLE|sc->wi_portnum, 0);
1965	}
1966
1967	untimeout(wi_inquire, sc, sc->wi_stat_ch);
1968
1969	ifp->if_flags &= ~(IFF_RUNNING|IFF_OACTIVE);
1970
1971	WI_UNLOCK(sc);
1972	return;
1973}
1974
1975static void wi_watchdog(ifp)
1976	struct ifnet		*ifp;
1977{
1978	struct wi_softc		*sc;
1979
1980	sc = ifp->if_softc;
1981
1982	device_printf(sc->dev, "watchdog timeout\n");
1983
1984	wi_init(sc);
1985
1986	ifp->if_oerrors++;
1987
1988	return;
1989}
1990
1991static int
1992wi_alloc(dev, io_rid)
1993	device_t		dev;
1994	int				io_rid;
1995{
1996	struct wi_softc		*sc = device_get_softc(dev);
1997
1998	sc->iobase_rid = io_rid;
1999	sc->iobase = bus_alloc_resource(dev, SYS_RES_IOPORT, &sc->iobase_rid,
2000				0, ~0, (1 << 6),
2001				rman_make_alignment_flags(1 << 6) | RF_ACTIVE);
2002	if (!sc->iobase) {
2003		device_printf(dev, "No I/O space?!\n");
2004		return (ENXIO);
2005	}
2006
2007	sc->irq_rid = 0;
2008	sc->irq = bus_alloc_resource(dev, SYS_RES_IRQ, &sc->irq_rid,
2009				     0, ~0, 1, RF_ACTIVE);
2010	if (!sc->irq) {
2011		wi_free(dev);
2012		device_printf(dev, "No irq?!\n");
2013		return (ENXIO);
2014	}
2015
2016	sc->dev = dev;
2017	sc->wi_unit = device_get_unit(dev);
2018	sc->wi_io_addr = rman_get_start(sc->iobase);
2019	sc->wi_btag = rman_get_bustag(sc->iobase);
2020	sc->wi_bhandle = rman_get_bushandle(sc->iobase);
2021
2022	return (0);
2023}
2024
2025static void wi_free(dev)
2026	device_t		dev;
2027{
2028	struct wi_softc		*sc = device_get_softc(dev);
2029
2030	if (sc->iobase != NULL) {
2031		bus_release_resource(dev, SYS_RES_IOPORT, sc->iobase_rid, sc->iobase);
2032		sc->iobase = NULL;
2033	}
2034	if (sc->irq != NULL) {
2035		bus_release_resource(dev, SYS_RES_IRQ, sc->irq_rid, sc->irq);
2036		sc->irq = NULL;
2037	}
2038	if (sc->mem != NULL) {
2039		bus_release_resource(dev, SYS_RES_MEMORY, sc->mem_rid, sc->mem);
2040		sc->mem = NULL;
2041	}
2042
2043	return;
2044}
2045
2046static void wi_shutdown(dev)
2047	device_t		dev;
2048{
2049	struct wi_softc		*sc;
2050
2051	sc = device_get_softc(dev);
2052	wi_stop(sc);
2053
2054	return;
2055}
2056
2057#ifdef WICACHE
2058/* wavelan signal strength cache code.
2059 * store signal/noise/quality on per MAC src basis in
2060 * a small fixed cache.  The cache wraps if > MAX slots
2061 * used.  The cache may be zeroed out to start over.
2062 * Two simple filters exist to reduce computation:
2063 * 1. ip only (literally 0x800) which may be used
2064 * to ignore some packets.  It defaults to ip only.
2065 * it could be used to focus on broadcast, non-IP 802.11 beacons.
2066 * 2. multicast/broadcast only.  This may be used to
2067 * ignore unicast packets and only cache signal strength
2068 * for multicast/broadcast packets (beacons); e.g., Mobile-IP
2069 * beacons and not unicast traffic.
2070 *
2071 * The cache stores (MAC src(index), IP src (major clue), signal,
2072 *	quality, noise)
2073 *
2074 * No apologies for storing IP src here.  It's easy and saves much
2075 * trouble elsewhere.  The cache is assumed to be INET dependent,
2076 * although it need not be.
2077 */
2078
2079#ifdef documentation
2080
2081int wi_sigitems;                                /* number of cached entries */
2082struct wi_sigcache wi_sigcache[MAXWICACHE];  /*  array of cache entries */
2083int wi_nextitem;                                /*  index/# of entries */
2084
2085
2086#endif
2087
2088/* control variables for cache filtering.  Basic idea is
2089 * to reduce cost (e.g., to only Mobile-IP agent beacons
2090 * which are broadcast or multicast).  Still you might
2091 * want to measure signal strength with unicast ping packets
2092 * on a pt. to pt. ant. setup.
2093 */
2094/* set true if you want to limit cache items to broadcast/mcast
2095 * only packets (not unicast).  Useful for mobile-ip beacons which
2096 * are broadcast/multicast at network layer.  Default is all packets
2097 * so ping/unicast will work say with pt. to pt. antennae setup.
2098 */
2099static int wi_cache_mcastonly = 0;
2100SYSCTL_INT(_machdep, OID_AUTO, wi_cache_mcastonly, CTLFLAG_RW,
2101	&wi_cache_mcastonly, 0, "");
2102
2103/* set true if you want to limit cache items to IP packets only
2104*/
2105static int wi_cache_iponly = 1;
2106SYSCTL_INT(_machdep, OID_AUTO, wi_cache_iponly, CTLFLAG_RW,
2107	&wi_cache_iponly, 0, "");
2108
2109/*
2110 * Original comments:
2111 * -----------------
2112 * wi_cache_store, per rx packet store signal
2113 * strength in MAC (src) indexed cache.
2114 *
2115 * follows linux driver in how signal strength is computed.
2116 * In ad hoc mode, we use the rx_quality field.
2117 * signal and noise are trimmed to fit in the range from 47..138.
2118 * rx_quality field MSB is signal strength.
2119 * rx_quality field LSB is noise.
2120 * "quality" is (signal - noise) as is log value.
2121 * note: quality CAN be negative.
2122 *
2123 * In BSS mode, we use the RID for communication quality.
2124 * TBD:  BSS mode is currently untested.
2125 *
2126 * Bill's comments:
2127 * ---------------
2128 * Actually, we use the rx_quality field all the time for both "ad-hoc"
2129 * and BSS modes. Why? Because reading an RID is really, really expensive:
2130 * there's a bunch of PIO operations that have to be done to read a record
2131 * from the NIC, and reading the comms quality RID each time a packet is
2132 * received can really hurt performance. We don't have to do this anyway:
2133 * the comms quality field only reflects the values in the rx_quality field
2134 * anyway. The comms quality RID is only meaningful in infrastructure mode,
2135 * but the values it contains are updated based on the rx_quality from
2136 * frames received from the access point.
2137 *
2138 * Also, according to Lucent, the signal strength and noise level values
2139 * can be converted to dBms by subtracting 149, so I've modified the code
2140 * to do that instead of the scaling it did originally.
2141 */
2142static
2143void wi_cache_store (struct wi_softc *sc, struct ether_header *eh,
2144                     struct mbuf *m, unsigned short rx_quality)
2145{
2146	struct ip *ip = 0;
2147	int i;
2148	static int cache_slot = 0; 	/* use this cache entry */
2149	static int wrapindex = 0;       /* next "free" cache entry */
2150	int sig, noise;
2151	int sawip=0;
2152
2153	/* filters:
2154	 * 1. ip only
2155	 * 2. configurable filter to throw out unicast packets,
2156	 * keep multicast only.
2157	 */
2158
2159	if ((ntohs(eh->ether_type) == ETHERTYPE_IP)) {
2160		sawip = 1;
2161	}
2162
2163	/* filter for ip packets only
2164	*/
2165	if (wi_cache_iponly && !sawip) {
2166		return;
2167	}
2168
2169	/* filter for broadcast/multicast only
2170	 */
2171	if (wi_cache_mcastonly && ((eh->ether_dhost[0] & 1) == 0)) {
2172		return;
2173	}
2174
2175#ifdef SIGDEBUG
2176	printf("wi%d: q value %x (MSB=0x%x, LSB=0x%x) \n", sc->wi_unit,
2177	    rx_quality & 0xffff, rx_quality >> 8, rx_quality & 0xff);
2178#endif
2179
2180	/* find the ip header.  we want to store the ip_src
2181	 * address.
2182	 */
2183	if (sawip) {
2184		ip = mtod(m, struct ip *);
2185	}
2186
2187	/* do a linear search for a matching MAC address
2188	 * in the cache table
2189	 * . MAC address is 6 bytes,
2190	 * . var w_nextitem holds total number of entries already cached
2191	 */
2192	for(i = 0; i < sc->wi_nextitem; i++) {
2193		if (! bcmp(eh->ether_shost , sc->wi_sigcache[i].macsrc,  6 )) {
2194			/* Match!,
2195			 * so we already have this entry,
2196			 * update the data
2197			 */
2198			break;
2199		}
2200	}
2201
2202	/* did we find a matching mac address?
2203	 * if yes, then overwrite a previously existing cache entry
2204	 */
2205	if (i < sc->wi_nextitem )   {
2206		cache_slot = i;
2207	}
2208	/* else, have a new address entry,so
2209	 * add this new entry,
2210	 * if table full, then we need to replace LRU entry
2211	 */
2212	else    {
2213
2214		/* check for space in cache table
2215		 * note: wi_nextitem also holds number of entries
2216		 * added in the cache table
2217		 */
2218		if ( sc->wi_nextitem < MAXWICACHE ) {
2219			cache_slot = sc->wi_nextitem;
2220			sc->wi_nextitem++;
2221			sc->wi_sigitems = sc->wi_nextitem;
2222		}
2223        	/* no space found, so simply wrap with wrap index
2224		 * and "zap" the next entry
2225		 */
2226		else {
2227			if (wrapindex == MAXWICACHE) {
2228				wrapindex = 0;
2229			}
2230			cache_slot = wrapindex++;
2231		}
2232	}
2233
2234	/* invariant: cache_slot now points at some slot
2235	 * in cache.
2236	 */
2237	if (cache_slot < 0 || cache_slot >= MAXWICACHE) {
2238		log(LOG_ERR, "wi_cache_store, bad index: %d of "
2239		    "[0..%d], gross cache error\n",
2240		    cache_slot, MAXWICACHE);
2241		return;
2242	}
2243
2244	/*  store items in cache
2245	 *  .ip source address
2246	 *  .mac src
2247	 *  .signal, etc.
2248	 */
2249	if (sawip) {
2250		sc->wi_sigcache[cache_slot].ipsrc = ip->ip_src.s_addr;
2251	}
2252	bcopy( eh->ether_shost, sc->wi_sigcache[cache_slot].macsrc,  6);
2253
2254	sig = (rx_quality >> 8) & 0xFF;
2255	noise = rx_quality & 0xFF;
2256	sc->wi_sigcache[cache_slot].signal = sig - 149;
2257	sc->wi_sigcache[cache_slot].noise = noise - 149;
2258	sc->wi_sigcache[cache_slot].quality = sig - noise;
2259
2260	return;
2261}
2262#endif
2263
2264static int wi_get_cur_ssid(sc, ssid, len)
2265	struct wi_softc		*sc;
2266	char			*ssid;
2267	int			*len;
2268{
2269	int			error = 0;
2270	struct wi_req		wreq;
2271
2272	wreq.wi_len = WI_MAX_DATALEN;
2273	switch (sc->wi_ptype) {
2274	case WI_PORTTYPE_ADHOC:
2275		wreq.wi_type = WI_RID_CURRENT_SSID;
2276		error = wi_read_record(sc, (struct wi_ltv_gen *)&wreq);
2277		if (error != 0)
2278			break;
2279		if (wreq.wi_val[0] > IEEE80211_NWID_LEN) {
2280			error = EINVAL;
2281			break;
2282		}
2283		*len = wreq.wi_val[0];
2284		bcopy(&wreq.wi_val[1], ssid, IEEE80211_NWID_LEN);
2285		break;
2286	case WI_PORTTYPE_BSS:
2287		wreq.wi_type = WI_RID_COMMQUAL;
2288		error = wi_read_record(sc, (struct wi_ltv_gen *)&wreq);
2289		if (error != 0)
2290			break;
2291		if (wreq.wi_val[0] != 0) /* associated */ {
2292			wreq.wi_type = WI_RID_CURRENT_SSID;
2293			wreq.wi_len = WI_MAX_DATALEN;
2294			error = wi_read_record(sc, (struct wi_ltv_gen *)&wreq);
2295			if (error != 0)
2296				break;
2297			if (wreq.wi_val[0] > IEEE80211_NWID_LEN) {
2298				error = EINVAL;
2299				break;
2300			}
2301			*len = wreq.wi_val[0];
2302			bcopy(&wreq.wi_val[1], ssid, IEEE80211_NWID_LEN);
2303		} else {
2304			*len = IEEE80211_NWID_LEN;
2305			bcopy(sc->wi_net_name, ssid, IEEE80211_NWID_LEN);
2306		}
2307		break;
2308	default:
2309		error = EINVAL;
2310		break;
2311	}
2312
2313	return error;
2314}
2315
2316static int wi_media_change(ifp)
2317	struct ifnet		*ifp;
2318{
2319	struct wi_softc		*sc = ifp->if_softc;
2320	int			otype = sc->wi_ptype;
2321	int			orate = sc->wi_tx_rate;
2322
2323	if ((sc->ifmedia.ifm_cur->ifm_media & IFM_IEEE80211_ADHOC) != 0)
2324		sc->wi_ptype = WI_PORTTYPE_ADHOC;
2325	else
2326		sc->wi_ptype = WI_PORTTYPE_BSS;
2327
2328	switch (IFM_SUBTYPE(sc->ifmedia.ifm_cur->ifm_media)) {
2329	case IFM_IEEE80211_DS1:
2330		sc->wi_tx_rate = 1;
2331		break;
2332	case IFM_IEEE80211_DS2:
2333		sc->wi_tx_rate = 2;
2334		break;
2335	case IFM_IEEE80211_DS5:
2336		sc->wi_tx_rate = 5;
2337		break;
2338	case IFM_IEEE80211_DS11:
2339		sc->wi_tx_rate = 11;
2340		break;
2341	case IFM_AUTO:
2342		sc->wi_tx_rate = 3;
2343		break;
2344	}
2345
2346	if (otype != sc->wi_ptype ||
2347	    orate != sc->wi_tx_rate)
2348		wi_init(sc);
2349
2350	return(0);
2351}
2352
2353static void wi_media_status(ifp, imr)
2354	struct ifnet		*ifp;
2355	struct ifmediareq	*imr;
2356{
2357	struct wi_req		wreq;
2358	struct wi_softc		*sc = ifp->if_softc;
2359
2360	if (sc->wi_tx_rate == 3) {
2361		imr->ifm_active = IFM_IEEE80211|IFM_AUTO;
2362		if (sc->wi_ptype == WI_PORTTYPE_ADHOC)
2363			imr->ifm_active |= IFM_IEEE80211_ADHOC;
2364		wreq.wi_type = WI_RID_CUR_TX_RATE;
2365		wreq.wi_len = WI_MAX_DATALEN;
2366		if (wi_read_record(sc, (struct wi_ltv_gen *)&wreq) == 0) {
2367			switch(wreq.wi_val[0]) {
2368			case 1:
2369				imr->ifm_active |= IFM_IEEE80211_DS1;
2370				break;
2371			case 2:
2372				imr->ifm_active |= IFM_IEEE80211_DS2;
2373				break;
2374			case 6:
2375				imr->ifm_active |= IFM_IEEE80211_DS5;
2376				break;
2377			case 11:
2378				imr->ifm_active |= IFM_IEEE80211_DS11;
2379				break;
2380				}
2381		}
2382	} else {
2383		imr->ifm_active = sc->ifmedia.ifm_cur->ifm_media;
2384	}
2385
2386	imr->ifm_status = IFM_AVALID;
2387	if (sc->wi_ptype == WI_PORTTYPE_ADHOC)
2388		/*
2389		 * XXX: It would be nice if we could give some actually
2390		 * useful status like whether we joined another IBSS or
2391		 * created one ourselves.
2392		 */
2393		imr->ifm_status |= IFM_ACTIVE;
2394	else {
2395		wreq.wi_type = WI_RID_COMMQUAL;
2396		wreq.wi_len = WI_MAX_DATALEN;
2397		if (wi_read_record(sc, (struct wi_ltv_gen *)&wreq) == 0 &&
2398		    wreq.wi_val[0] != 0)
2399			imr->ifm_status |= IFM_ACTIVE;
2400	}
2401}
2402