WaveLAN driver from FreeBSD

4 files changed, 2595 insertions, 1 deletions

diff --git a/sys/dev/pcmcia/files.pcmcia b/sys/dev/pcmcia/files.pcmcia
index 817193adcb4..4e9741c3522 100644
--- a/sys/dev/pcmcia/files.pcmcia
+++ b/sys/dev/pcmcia/files.pcmcia
@@ -1,4 +1,4 @@
-#	$OpenBSD: files.pcmcia,v 1.18 1999/07/01 06:29:55 fgsch Exp $
+#	$OpenBSD: files.pcmcia,v 1.19 1999/07/11 16:25:36 niklas Exp $
 #	$NetBSD: files.pcmcia,v 1.9 1998/06/21 18:45:41 christos Exp $
 #
 # Config.new file and device description for machine-independent PCMCIA code.
@@ -69,3 +69,8 @@ file dev/pcmcia/if_rl2_pcmcia.c			rln_pcmcia
 #device	cnw: ether, ifnet
 #attach	cnw at pcmcia
 #file	dev/pcmcia/if_cnw.c			cnw
+
+# Lucent WaveLAN
+device wi: ether, ifnet
+attach wi at pcmcia
+file dev/pcmcia/if_wi.c				wi
diff --git a/sys/dev/pcmcia/if_wavelan_ieee.h b/sys/dev/pcmcia/if_wavelan_ieee.h
new file mode 100644
index 00000000000..9c9077b71f8
--- /dev/null
+++ b/sys/dev/pcmcia/if_wavelan_ieee.h
@@ -0,0 +1,291 @@
+/*	$OpenBSD: if_wavelan_ieee.h,v 1.1 1999/07/11 16:25:36 niklas Exp $	*/
+
+/*
+ * Copyright (c) 1997, 1998, 1999
+ *	Bill Paul <wpaul@ctr.columbia.edu>.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by Bill Paul.
+ * 4. Neither the name of the author nor the names of any co-contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *	From: if_wavelan_ieee.h,v 1.1 1999/05/05 07:36:50 wpaul Exp $
+ */
+
+#ifndef _IF_WAVELAN_IEEE_H
+#define _IF_WAVELAN_IEEE_H
+
+/*
+ * This header defines a simple command interface to the FreeBSD
+ * WaveLAN/IEEE driver (wi) driver, which is used to set certain
+ * device-specific parameters which can't be easily managed through
+ * ifconfig(8). No, sysctl(2) is not the answer. I said a _simple_
+ * interface, didn't I.
+ */
+
+#ifndef SIOCSWAVELAN
+#ifdef __FreeBSD__
+#define SIOCSWAVELAN	SIOCSIFGENERIC
+#else	/* !__FreeBSD__ */
+#define SIOCSWAVELAN	SIOCSIFASYNCMAP
+#endif	/* __FreeBSD__ */
+#endif
+
+#ifndef SIOCGWAVELAN
+#ifdef __FreeBSD__
+#define SIOCGWAVELAN	SIOCGIFGENERIC
+#else	/* !__FreeBSD__ */
+#define SIOCGWAVELAN	SIOCGIFASYNCMAP
+#endif	/* __FreeBSD__ */
+#endif
+
+/*
+ * Technically I don't think there's a limit to a record
+ * length. The largest record is the one that contains the CIS
+ * data, which is 240 words long, so 256 should be a safe
+ * value.
+ */
+#define WI_MAX_DATALEN	512
+
+struct wi_req {
+	u_int16_t	wi_len;
+	u_int16_t	wi_type;
+	u_int16_t	wi_val[WI_MAX_DATALEN];
+};
+
+/*
+ * Private LTV records (interpreted only by the driver). This is
+ * a minor kludge to allow reading the interface statistics from
+ * the driver.
+ */
+#define WI_RID_IFACE_STATS	0x0100
+#define WI_RID_MGMT_XMIT	0x0200
+
+struct wi_80211_hdr {
+	u_int16_t		frame_ctl;
+	u_int16_t		dur_id;
+	u_int8_t		addr1[6];
+	u_int8_t		addr2[6];
+	u_int8_t		addr3[6];
+	u_int16_t		seq_ctl;
+	u_int8_t		addr4[6];
+};
+
+#define WI_FCTL_VERS		0x0002
+#define WI_FCTL_FTYPE		0x000C
+#define WI_FCTL_STYPE		0x00F0
+#define WI_FCTL_TODS		0x0100
+#define WI_FCTL_FROMDS		0x0200
+#define WI_FCTL_MOREFRAGS	0x0400
+#define WI_FCTL_RETRY		0x0800
+#define WI_FCTL_PM		0x1000
+#define WI_FCTL_MOREDATA	0x2000
+#define WI_FCTL_WEP		0x4000
+#define WI_FCTL_ORDER		0x8000
+
+#define WI_FTYPE_MGMT		0x0000
+#define WI_FTYPE_CTL		0x0004
+#define WI_FTYPE_DATA		0x0008
+
+#define WI_STYPE_MGMT_ASREQ	0x0000	/* association request */
+#define WI_STYPE_MGMT_ASRESP	0x0010	/* association response */
+#define WI_STYPE_MGMT_REASREQ	0x0020	/* reassociation request */
+#define WI_STYPE_MGMT_REASRESP	0x0030	/* reassociation response */
+#define WI_STYPE_MGMT_PROBEREQ	0x0040	/* probe request */
+#define WI_STYPE_MGMT_PROBERESP	0x0050	/* probe response */
+#define WI_STYPE_MGMT_BEACON	0x0080	/* beacon */
+#define WI_STYPE_MGMT_ATIM	0x0090	/* announcement traffic ind msg */
+#define WI_STYPE_MGMT_DISAS	0x00A0	/* disassociation */
+#define WI_STYPE_MGMT_AUTH	0x00B0	/* authentication */
+#define WI_STYPE_MGMT_DEAUTH	0x00C0	/* deauthentication */
+
+struct wi_mgmt_hdr {
+	u_int16_t		frame_ctl;
+	u_int16_t		duration;
+	u_int8_t		dst_addr[6];
+	u_int8_t		src_addr[6];
+	u_int8_t		bssid[6];
+	u_int16_t		seq_ctl;
+};
+
+#if (defined(__FreeBSD__) && !defined(KERNEL)) || (!defined(__FreeBSD__) && !defined(_KERNEL))
+struct wi_counters {
+	u_int32_t		wi_tx_unicast_frames;
+	u_int32_t		wi_tx_multicast_frames;
+	u_int32_t		wi_tx_fragments;
+	u_int32_t		wi_tx_unicast_octets;
+	u_int32_t		wi_tx_multicast_octets;
+	u_int32_t		wi_tx_deferred_xmits;
+	u_int32_t		wi_tx_single_retries;
+	u_int32_t		wi_tx_multi_retries;
+	u_int32_t		wi_tx_retry_limit;
+	u_int32_t		wi_tx_discards;
+	u_int32_t		wi_rx_unicast_frames;
+	u_int32_t		wi_rx_multicast_frames;
+	u_int32_t		wi_rx_fragments;
+	u_int32_t		wi_rx_unicast_octets;
+	u_int32_t		wi_rx_multicast_octets;
+	u_int32_t		wi_rx_fcs_errors;
+	u_int32_t		wi_rx_discards_nobuf;
+	u_int32_t		wi_tx_discards_wrong_sa;
+	u_int32_t		wi_rx_WEP_cant_decrypt;
+	u_int32_t		wi_rx_msg_in_msg_frags;
+	u_int32_t		wi_rx_msg_in_bad_msg_frags;
+};
+
+/*
+ * These are all the LTV record types that we can read or write
+ * from the WaveLAN. Not all of them are temendously useful, but I
+ * list as many as I know about here for completeness.
+ */
+
+#define WI_RID_DNLD_BUF		0xFD01
+#define WI_RID_MEMSZ		0xFD02
+#define WI_RID_DOMAINS		0xFD11
+#define WI_RID_CIS		0xFD13
+#define WI_RID_COMMQUAL		0xFD43
+#define WI_RID_SCALETHRESH	0xFD46
+#define WI_RID_PCF		0xFD87
+
+/*
+ * Network parameters, static configuration entities.
+ */
+#define WI_RID_PORTTYPE		0xFC00 /* Connection control characteristics */
+#define WI_RID_MAC_NODE		0xFC01 /* MAC address of this station */
+#define WI_RID_DESIRED_SSID	0xFC02 /* Service Set ID for connection */
+#define WI_RID_OWN_CHNL		0xFC03 /* Comm channel for BSS creation */
+#define WI_RID_OWN_SSID		0xFC04 /* IBSS creation ID */
+#define WI_RID_OWN_ATIM_WIN	0xFC05 /* ATIM window time for IBSS creation */
+#define WI_RID_SYSTEM_SCALE	0xFC06 /* scale that specifies AP density */
+#define WI_RID_MAX_DATALEN	0xFC07 /* Max len of MAC frame body data */
+#define WI_RID_MAC_WDS		0xFC08 /* MAC addr of corresponding WDS node */
+#define WI_RID_PM_ENABLED	0xFC09 /* ESS power management enable */
+#define WI_RID_PM_EPS		0xFC0A /* PM EPS/PS mode */
+#define WI_RID_MCAST_RX		0xFC0B /* ESS PM mcast reception */
+#define WI_RID_MAX_SLEEP	0xFC0C /* max sleep time for ESS PM */
+#define WI_RID_HOLDOVER		0xFC0D /* holdover time for ESS PM */
+#define WI_RID_NODENAME		0xFC0E /* ID name of this node for diag */
+#define WI_RID_DTIM_PERIOD	0xFC10 /* beacon interval between DTIMs */
+#define WI_RID_WDS_ADDR1	0xFC11 /* port 1 MAC of WDS link node */
+#define WI_RID_WDS_ADDR2	0xFC12 /* port 1 MAC of WDS link node */
+#define WI_RID_WDS_ADDR3	0xFC13 /* port 1 MAC of WDS link node */
+#define WI_RID_WDS_ADDR4	0xFC14 /* port 1 MAC of WDS link node */
+#define WI_RID_WDS_ADDR5	0xFC15 /* port 1 MAC of WDS link node */
+#define WI_RID_WDS_ADDR6	0xFC16 /* port 1 MAC of WDS link node */
+#define WI_RID_MCAST_PM_BUF	0xFC17 /* PM buffering of mcast */
+
+/*
+ * Network parameters, dynamic configuration entities
+ */
+#define WI_RID_MCAST_LIST	0xFC80 /* list of multicast addrs */
+#define WI_RID_CREATE_IBSS	0xFC81 /* create IBSS */
+#define WI_RID_FRAG_THRESH	0xFC82 /* frag len, unicast msg xmit */
+#define WI_RID_RTS_THRESH	0xFC83 /* frame len for RTS/CTS handshake */
+#define WI_RID_TX_RATE		0xFC84 /* data rate for message xmit */
+#define WI_RID_PROMISC		0xFC85 /* enable promisc mode */
+#define WI_RID_FRAG_THRESH0	0xFC90
+#define WI_RID_FRAG_THRESH1	0xFC91
+#define WI_RID_FRAG_THRESH2	0xFC92
+#define WI_RID_FRAG_THRESH3	0xFC93
+#define WI_RID_FRAG_THRESH4	0xFC94
+#define WI_RID_FRAG_THRESH5	0xFC95
+#define WI_RID_FRAG_THRESH6	0xFC96
+#define WI_RID_RTS_THRESH0	0xFC97
+#define WI_RID_RTS_THRESH1	0xFC98
+#define WI_RID_RTS_THRESH2	0xFC99
+#define WI_RID_RTS_THRESH3	0xFC9A
+#define WI_RID_RTS_THRESH4	0xFC9B
+#define WI_RID_RTS_THRESH5	0xFC9C
+#define WI_RID_RTS_THRESH6	0xFC9D
+#define WI_RID_TX_RATE0		0xFC9E
+#define WI_RID_TX_RATE1		0xFC9F
+#define WI_RID_TX_RATE2		0xFCA0
+#define WI_RID_TX_RATE3		0xFCA1
+#define WI_RID_TX_RATE4		0xFCA2
+#define WI_RID_TX_RATE5		0xFCA3
+#define WI_RID_TX_RATE6		0xFCA4
+#define WI_RID_TICK_TIME	0xFCE0
+
+/*
+ * NIC information
+ */
+#define WI_RID_FIRM_ID		0xFD02 /* Primary func firmware ID. */
+#define WI_RID_PRI_SUP_RANGE	0xFD03 /* primary supplier compatibility */
+#define WI_RID_CIF_ACT_RANGE	0xFD04 /* controller sup. compatibility */
+#define WI_RID_SERIALNO		0xFD0A /* card serial number */
+#define WI_RID_CARD_ID		0xFD0B /* card identification */
+#define WI_RID_MFI_SUP_RANGE	0xFD0C /* modem supplier compatibility */
+#define WI_RID_CFI_SUP_RANGE	0xFD0D /* controller sup. compatibility */
+#define WI_RID_CHANNEL_LIST	0xFD10 /* allowd comm. frequencies. */
+#define WI_RID_REG_DOMAINS	0xFD11 /* list of intendted regulatory doms */
+#define WI_RID_TEMP_TYPE	0xFD12 /* hw temp range code */
+#define WI_RID_CIS		0xFD13 /* PC card info struct */
+#define WI_RID_STA_IDENEITY	0xFD20 /* station funcs firmware ident */
+#define WI_RID_STA_SUP_RANGE	0xFD21 /* station supplier compat */
+#define WI_RID_MFI_ACT_RANGE	0xFD22
+#define WI_RID_CFI_ACT_RANGE	0xFD33
+
+/*
+ * MAC information
+ */
+#define WI_RID_PORT_STAT	0xFD40 /* actual MAC port con control stat */
+#define WI_RID_CURRENT_SSID	0xFD41 /* ID of actually connected SS */
+#define WI_RID_CURRENT_BSSID	0xFD42 /* ID of actually connected BSS */
+#define WI_RID_COMMS_QUALITY	0xFD43 /* quality of BSS connection */
+#define WI_RID_CUR_TX_RATE	0xFD44 /* current TX rate */
+#define WI_RID_OWN_BEACON_INT	0xFD45 /* beacon xmit time for BSS creation */
+#define WI_RID_CUR_SCALE_THRESH	0xFD46 /* actual system scane thresh setting */
+#define WI_RID_PROT_RESP_TIME	0xFD47 /* time to wait for resp to req msg */
+#define WI_RID_SHORT_RTR_LIM	0xFD48 /* max tx attempts for short frames */
+#define WI_RID_LONG_RTS_LIM	0xFD49 /* max tx attempts for long frames */
+#define WI_RID_MAX_TX_LIFE	0xFD4A /* max tx frame handling duration */
+#define WI_RID_MAX_RX_LIFE	0xFD4B /* max rx frame handling duration */
+#define WI_RID_CF_POLL		0xFD4C /* contention free pollable ind */
+#define WI_RID_AUTH_ALGS	0xFD4D /* auth algorithms available */
+#define WI_RID_AUTH_TYPE	0xFD4E /* availanle auth types */
+#define WI_RID_WEP_AVAIL	0xFD4F /* WEP privacy option available */
+#define WI_RID_CUR_TX_RATE1	0xFD80
+#define WI_RID_CUR_TX_RATE2	0xFD81
+#define WI_RID_CUR_TX_RATE3	0xFD82
+#define WI_RID_CUR_TX_RATE4	0xFD83
+#define WI_RID_CUR_TX_RATE5	0xFD84
+#define WI_RID_CUR_TX_RATE6	0xFD85
+#define WI_RID_OWN_MAC		0xFD86 /* unique local MAC addr */
+#define WI_RID_PCI_INFO		0xFD87 /* point coordination func cap */
+
+/*
+ * Modem information
+ */
+#define WI_RID_PHY_TYPE		0xFDC0 /* phys layer type indication */
+#define WI_RID_CURRENT_CHAN	0xFDC1 /* current frequency */
+#define WI_RID_PWR_STATE	0xFDC2 /* pwr consumption status */
+#define WI_RID_CCA_MODE		0xFDC3 /* clear chan assess mode indication */
+#define WI_RID_CCA_TIME		0xFDC4 /* clear chan assess time */
+#define WI_RID_MAC_PROC_DELAY	0xFDC5 /* MAC processing delay time */
+#define WI_RID_DATA_RATES	0xFDC6 /* supported data rates */
+#endif
+
+
+#endif
diff --git a/sys/dev/pcmcia/if_wi.c b/sys/dev/pcmcia/if_wi.c
new file mode 100644
index 00000000000..14db9ebac79
--- /dev/null
+++ b/sys/dev/pcmcia/if_wi.c
@@ -0,0 +1,1684 @@
+/*	$OpenBSD: if_wi.c,v 1.1 1999/07/11 16:25:36 niklas Exp $	*/
+
+/*
+ * Copyright (c) 1997, 1998, 1999
+ *	Bill Paul <wpaul@ctr.columbia.edu>.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by Bill Paul.
+ * 4. Neither the name of the author nor the names of any co-contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *	From: if_wi.c,v 1.7 1999/07/04 14:40:22 wpaul Exp $
+ */
+
+/*
+ * Lucent WaveLAN/IEEE 802.11 PCMCIA driver for FreeBSD.
+ *
+ * Written by Bill Paul <wpaul@ctr.columbia.edu>
+ * Electrical Engineering Department
+ * Columbia University, New York City
+ */
+
+/*
+ * The WaveLAN/IEEE adapter is the second generation of the WaveLAN
+ * from Lucent. Unlike the older cards, the new ones are programmed
+ * entirely via a firmware-driven controller called the Hermes.
+ * Unfortunately, Lucent will not release the Hermes programming manual
+ * without an NDA (if at all). What they do release is an API library
+ * called the HCF (Hardware Control Functions) which is supposed to
+ * do the device-specific operations of a device driver for you. The
+ * publically available version of the HCF library (the 'HCF Light') is 
+ * a) extremely gross, b) lacks certain features, particularly support
+ * for 802.11 frames, and c) is contaminated by the GNU Public License.
+ *
+ * This driver does not use the HCF or HCF Light at all. Instead, it
+ * programs the Hermes controller directly, using information gleaned
+ * from the HCF Light code and corresponding documentation.
+ *
+ * This driver supports both the PCMCIA and ISA versions of the
+ * WaveLAN/IEEE cards. Note however that the ISA card isn't really
+ * anything of the sort: it's actually a PCMCIA bridge adapter
+ * that fits into an ISA slot, into which a PCMCIA WaveLAN card is
+ * inserted. Consequently, you need to use the pccard support for
+ * both the ISA and PCMCIA adapters.
+ */
+
+#define WI_HERMES_AUTOINC_WAR	/* Work around data write autoinc bug. */
+#define WI_HERMES_STATS_WAR	/* Work around stats counter bug. */
+
+#include "bpfilter.h"
+#ifdef __FreeBSD__
+#include "card.h"
+#include "wi.h"
+#endif	/* __FreeBSD__ */
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/sockio.h>
+#include <sys/mbuf.h>
+#include <sys/malloc.h>
+#include <sys/kernel.h>
+#include <sys/socket.h>
+#ifndef __FreeBSD__
+#include <sys/device.h>
+#endif	/* !__FreeBSD__ */
+
+#include <net/if.h>
+#ifdef __FreeBSD__
+#include <net/if_arp.h>
+#include <net/ethernet.h>
+#endif	/* __FreeBSD__ */
+#include <net/if_dl.h>
+#include <net/if_media.h>
+#include <net/if_types.h>
+
+#ifdef INET
+#include <netinet/in.h>
+#include <netinet/in_systm.h>
+#include <netinet/in_var.h>
+#include <netinet/ip.h>
+#include <netinet/if_ether.h>
+#endif
+
+#if NBPFILTER > 0
+#include <net/bpf.h>
+#endif
+
+#ifdef __FreeBSD__
+#include <machine/clock.h>
+#include <machine/md_var.h>
+#include <machine/bus_pio.h>
+#endif	/* __FreeBSD__ */
+#include <machine/bus.h>
+
+#include <i386/isa/icu.h>
+
+#ifdef __FreeBSD__
+
+#include <i386/isa/isa_device.h>
+#include <i386/isa/if_wireg.h>
+#include <machine/if_wavelan_ieee.h>
+
+#if NCARD > 0
+#include <sys/select.h>
+#include <pccard/cardinfo.h>
+#include <pccard/slot.h>
+#endif	/* NCARD > 0 */
+
+static struct wi_softc wi_softc[NWI];
+
+#define TIMEOUT(handle,func,arg,time) (handle) = timeout((func), (arg), (time))
+#define UNTIMEOUT(func,arg,handle) untimeout((func), (arg), (handle))
+#define BPF_MTAP(if,mbuf) bpf_mtap((if), (mbuf))
+#define BPFATTACH(if_bpf,if,dlt,sz) bpfattach((if), (dlt), (sz))
+#define STATIC static
+#define WI_PRT_FMT "wi%d"
+#define WI_PRT_ARG(sc) (sc)->wi_unit
+
+#else	/* !__FreeBSD__ */
+
+#include <dev/pcmcia/pcmciareg.h>
+#include <dev/pcmcia/pcmciavar.h>
+#include <dev/pcmcia/pcmciadevs.h>
+#include <dev/pcmcia/if_wireg.h>
+#include <dev/pcmcia/if_wavelan_ieee.h>
+
+#define TIMEOUT(handle,func,arg,time) timeout((func), (arg), (time))
+#define UNTIMEOUT(func,arg,handle) untimeout((func), (arg))
+#define BPF_MTAP(if,mbuf) bpf_mtap((if)->if_bpf, (mbuf))
+#define BPFATTACH(if_bpf,if,dlt,sz) bpfattach((if_bpf), (if), (dlt), (sz))
+#define STATIC
+#define WI_PRT_FMT "%s"
+#define WI_PRT_ARG(sc) (sc)->sc_dev.dv_xname
+
+#endif	/* __FreeBSD__ */
+
+#ifdef WIDEBUG
+
+u_int32_t	widebug = WIDEBUG;
+
+#define WID_INTR	0x01
+#define WID_START	0x02
+#define WID_IOCTL	0x04
+#define WID_INIT	0x08
+#define WID_STOP	0x10
+#define WID_RESET	0x20
+
+#define DPRINTF(mask,args) if (widebug & (mask)) printf args;
+
+#else	/* !WIDEBUG */
+#define DPRINTF(mask,args)
+#endif	/* WIDEBUG */
+
+#if !defined(lint)
+static const char rcsid[] =
+#ifdef __FreeBSD__
+	"$Id: if_wi.c,v 1.1 1999/07/11 16:25:36 niklas Exp $";
+#else	/* !__FreeBSD__ */
+	"$OpenBSD: if_wi.c,v 1.1 1999/07/11 16:25:36 niklas Exp $";
+#endif	/* __FreeBSD__ */
+#endif	/* lint */
+
+#ifdef foo
+static u_int8_t	wi_mcast_addr[6] = { 0x01, 0x60, 0x1D, 0x00, 0x01, 0x00 };
+#endif
+
+STATIC void wi_reset		__P((struct wi_softc *));
+STATIC int wi_ioctl		__P((struct ifnet *, u_long, caddr_t));
+STATIC void wi_init		__P((void *));
+STATIC void wi_start		__P((struct ifnet *));
+STATIC void wi_stop		__P((struct wi_softc *));
+STATIC void wi_watchdog		__P((struct ifnet *));
+#ifdef __FreeBSD__
+STATIC void wi_shutdown		__P((int, void *));
+#else	/* !__FreeBSD__ */
+STATIC void wi_shutdown		__P((void *));
+#endif	/* __FreeBSD__ */
+STATIC void wi_rxeof		__P((struct wi_softc *));
+STATIC void wi_txeof		__P((struct wi_softc *, int));
+STATIC void wi_update_stats	__P((struct wi_softc *));
+STATIC void wi_setmulti		__P((struct wi_softc *));
+
+STATIC int wi_cmd		__P((struct wi_softc *, int, int));
+STATIC int wi_read_record	__P((struct wi_softc *, struct wi_ltv_gen *));
+STATIC int wi_write_record	__P((struct wi_softc *, struct wi_ltv_gen *));
+STATIC int wi_read_data		__P((struct wi_softc *, int,
+					int, caddr_t, int));
+STATIC int wi_write_data	__P((struct wi_softc *, int,
+					int, caddr_t, int));
+STATIC int wi_seek		__P((struct wi_softc *, int, int, int));
+STATIC int wi_alloc_nicmem	__P((struct wi_softc *, int, int *));
+STATIC void wi_inquire		__P((void *));
+STATIC void wi_setdef		__P((struct wi_softc *, struct wi_req *));
+STATIC int wi_mgmt_xmit		__P((struct wi_softc *, caddr_t, int));
+
+#ifdef __FreeBSD__
+
+STATIC int wi_probe		__P((struct isa_device *));
+STATIC int wi_attach		__P((struct isa_device *));
+#ifdef PCCARD_MODULE
+static ointhand2_t		wi_intr;
+#else
+void wi_intr			__P((int));
+#endif	/* PCCARD_MODULE */
+
+struct isa_driver widriver = {
+	wi_probe,
+	wi_attach,
+	"wi",
+	1
+};
+
+#if NCARD > 0
+STATIC int wi_pccard_init	__P((struct pccard_devinfo *));
+STATIC void wi_pccard_unload	__P((struct pccard_devinfo *));
+STATIC int wi_pccard_intr	__P((struct pccard_devinfo *));
+
+#ifdef PCCARD_MODULE
+PCCARD_MODULE(wi, wi_pccard_init, wi_pccard_unload,
+		wi_pccard_intr, 0, net_imask);
+#else
+static struct pccard_device wi_info = {
+	"wi",
+	wi_pccard_init,
+	wi_pccard_unload,
+	wi_pccard_intr,
+	0,			/* Attributes - presently unused */
+	&net_imask		/* Interrupt mask for device */
+				/* XXX - Should this also include net_imask? */
+};
+
+DATA_SET(pccarddrv_set, wi_info);
+#endif
+
+/* Initialize the PCCARD. */
+STATIC int wi_pccard_init(sc_p)
+	struct pccard_devinfo	*sc_p;
+{
+	struct wi_softc		*sc;
+	int			i;
+	u_int32_t		irq;
+
+	if (sc_p->isahd.id_unit >= NWI)
+		return(ENODEV);
+
+	sc = &wi_softc[sc_p->isahd.id_unit];
+	sc->wi_gone = 0;
+	sc->wi_unit = sc_p->isahd.id_unit;
+	sc->wi_bhandle = sc_p->isahd.id_iobase;
+	sc->wi_btag = I386_BUS_SPACE_IO;
+
+	/* Make sure interrupts are disabled. */
+	CSR_WRITE_2(sc, WI_INT_EN, 0);
+	CSR_WRITE_2(sc, WI_EVENT_ACK, 0xFFFF);
+
+	/* Grr. IRQ is encoded as a bitmask. */
+	irq = sc_p->isahd.id_irq;
+	for (i = 0; i < 32; i++) {
+		if (irq & 0x1)
+			break;
+		irq >>= 1;
+	}
+
+	/*
+	 * Print a nice probe message to let the operator
+	 * know something interesting is happening.
+	 */
+	printf("wi%d: <WaveLAN/IEEE 802.11> at 0x%x-0x%x irq %d on isa\n",
+	    sc_p->isahd.id_unit, sc_p->isahd.id_iobase,
+	    sc_p->isahd.id_iobase + WI_IOSIZ - 1, i);
+
+	if (wi_attach(&sc_p->isahd))
+		return(ENXIO);
+
+	return(0);
+}
+
+STATIC void wi_pccard_unload(sc_p)
+	struct pccard_devinfo	*sc_p;
+{
+	struct wi_softc		*sc;
+	struct ifnet		*ifp;
+
+	sc = &wi_softc[sc_p->isahd.id_unit];
+	ifp = &sc->arpcom.ac_if;
+
+	if (sc->wi_gone) {
+		printf("wi%d: already unloaded\n", sc_p->isahd.id_unit);
+		return;
+	}
+
+	ifp->if_flags &= ~IFF_RUNNING;
+	if_down(ifp);
+	sc->wi_gone = 1;
+	printf("wi%d: unloaded\n", sc_p->isahd.id_unit);
+
+	return;
+}
+
+STATIC int wi_pccard_intr(sc_p)
+	struct pccard_devinfo	*sc_p;
+{
+	wi_intr(sc_p->isahd.id_unit);
+	return(1);
+}
+
+#endif
+
+STATIC int wi_probe(isa_dev)
+	struct isa_device	*isa_dev;
+{
+	/*
+	 * The ISA WaveLAN/IEEE card is actually not an ISA card:
+	 * it's a PCMCIA card plugged into a PCMCIA bridge adapter
+	 * that fits into an ISA slot. Consequently, we will always
+	 * be using the pccard support to probe and attach these
+	 * devices, so we can never actually probe one from here.
+	 */
+	return(0);
+}
+
+STATIC int wi_attach(isa_dev)
+	struct isa_device	*isa_dev;
+{
+	struct wi_softc		*sc;
+	struct wi_ltv_macaddr	mac;
+	struct wi_ltv_gen	gen;
+	struct ifnet		*ifp;
+	char			ifname[IFNAMSIZ];
+
+#ifdef PCCARD_MODULE
+	isa_dev->id_ointr = wi_intr;
+#endif
+	sc = &wi_softc[isa_dev->id_unit];
+	ifp = &sc->arpcom.ac_if;
+
+	/* Reset the NIC. */
+	wi_reset(sc);
+
+	/* Read the station address. */
+	mac.wi_type = WI_RID_MAC_NODE;
+	mac.wi_len = 4;
+	wi_read_record(sc, (struct wi_ltv_gen *)&mac);
+	bcopy((char *)&mac.wi_mac_addr,
+	   (char *)&sc->arpcom.ac_enaddr, ETHER_ADDR_LEN);
+
+	printf("wi%d: Ethernet address: %6D\n", sc->wi_unit,
+	    sc->arpcom.ac_enaddr, ":");
+
+	ifp->if_softc = sc;
+	ifp->if_unit = sc->wi_unit;
+	ifp->if_name = "wi";
+	ifp->if_mtu = ETHERMTU;
+	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
+	ifp->if_ioctl = wi_ioctl;
+	ifp->if_output = ether_output;
+	ifp->if_start = wi_start;
+	ifp->if_watchdog = wi_watchdog;
+	ifp->if_init = wi_init;
+	ifp->if_baudrate = 10000000;
+	ifp->if_snd.ifq_maxlen = IFQ_MAXLEN;
+
+	bzero(sc->wi_node_name, sizeof(sc->wi_node_name));
+	bcopy(WI_DEFAULT_NODENAME, sc->wi_node_name,
+	    sizeof(WI_DEFAULT_NODENAME) - 1);
+
+	bzero(sc->wi_net_name, sizeof(sc->wi_net_name));
+	bcopy(WI_DEFAULT_NETNAME, sc->wi_net_name,
+	    sizeof(WI_DEFAULT_NETNAME) - 1);
+
+	bzero(sc->wi_ibss_name, sizeof(sc->wi_ibss_name));
+	bcopy(WI_DEFAULT_IBSS, sc->wi_ibss_name,
+	    sizeof(WI_DEFAULT_IBSS) - 1);
+
+	sc->wi_portnum = WI_DEFAULT_PORT;
+	sc->wi_ptype = WI_PORTTYPE_ADHOC;
+	sc->wi_ap_density = WI_DEFAULT_AP_DENSITY;
+	sc->wi_rts_thresh = WI_DEFAULT_RTS_THRESH;
+	sc->wi_tx_rate = WI_DEFAULT_TX_RATE;
+	sc->wi_max_data_len = WI_DEFAULT_DATALEN;
+	sc->wi_create_ibss = WI_DEFAULT_CREATE_IBSS;
+	sc->wi_pm_enabled = WI_DEFAULT_PM_ENABLED;
+	sc->wi_max_sleep = WI_DEFAULT_MAX_SLEEP;
+
+	/*
+	 * Read the default channel from the NIC. This may vary
+	 * depending on the country where the NIC was purchased, so
+	 * we can't hard-code a default and expect it to work for
+	 * everyone.
+	 */
+	gen.wi_type = WI_RID_OWN_CHNL;
+	gen.wi_len = 2;
+	wi_read_record(sc, &gen);
+	sc->wi_channel = gen.wi_val;
+
+	bzero((char *)&sc->wi_stats, sizeof(sc->wi_stats));
+
+	wi_init(sc);
+	wi_stop(sc);
+
+	/*
+	 * If this logical interface has already been attached,
+	 * don't attach it again or chaos will ensue.
+	 */
+	sprintf(ifname, "wi%d", sc->wi_unit);
+
+	if (ifunit(ifname) == NULL) {
+		callout_handle_init(&sc->wi_stat_ch);
+		/*
+		 * Call MI attach routines.
+		 */
+		if_attach(ifp);
+		ether_ifattach(ifp);
+
+#if NBPFILTER > 0
+		bpfattach(ifp, DLT_EN10MB, sizeof(struct ether_header));
+#endif
+
+		at_shutdown(wi_shutdown, sc, SHUTDOWN_POST_SYNC);
+	}
+
+	return(0);
+}
+
+#else	/* !__FreeBSD__ */
+
+int	wi_pcmcia_match __P((struct device *, void *, void *));
+void	wi_pcmcia_attach __P((struct device *, struct device *, void *));
+int	wi_intr __P((void *));
+
+/* Autoconfig definition of driver back-end */
+struct cfdriver wi_cd = {
+	NULL, "wi", DV_IFNET
+};
+
+struct cfattach wi_ca = {
+	sizeof (struct wi_softc), wi_pcmcia_match, wi_pcmcia_attach
+};
+
+int
+wi_pcmcia_match(parent, match, aux)
+	struct device *parent;
+	void *match, *aux;
+{
+	struct pcmcia_attach_args *pa = aux;
+	
+	if (pa->pf->function != PCMCIA_FUNCTION_NETWORK)
+		return (0);
+
+	switch (pa->manufacturer) {
+	case PCMCIA_VENDOR_LUCENT:
+		/* XXX Per-productid checking here. */
+		return (1);
+
+	default:
+		return (0);
+	}
+}
+
+void
+wi_pcmcia_attach(parent, self, aux)
+	struct device *parent, *self;
+	void *aux;
+{
+	struct wi_softc		*sc = (struct wi_softc *)self;
+	struct pcmcia_attach_args *pa = aux;
+	struct pcmcia_function	*pf = pa->pf;
+	struct pcmcia_config_entry *cfe = pf->cfe_head.sqh_first;
+	struct pcmcia_io_handle	pcioh;
+	struct wi_ltv_macaddr	mac;
+	struct wi_ltv_gen	gen;
+	struct ifnet		*ifp;
+	int			state = 0;
+	int			io_window;
+
+	/* Enable the card. */
+	pcmcia_function_init(pf, cfe);
+	if (pcmcia_function_enable(pf)) {
+		printf(": function enable failed\n");
+		goto bad;
+	}
+	state++;
+
+	if (pcmcia_io_alloc(pf, 0, WI_IOSIZ, WI_IOSIZ, &pcioh)) {
+		printf(": can't alloc i/o space\n");
+		goto bad;
+	}
+	state++;
+
+	if (pcmcia_io_map(pf, PCMCIA_WIDTH_IO16, 0, WI_IOSIZ, &pcioh,
+	    &io_window)) {
+		printf(": can't map io space\n");
+		goto bad;
+	}
+	state++;
+
+	sc->wi_gone = 0;
+	sc->wi_btag = pcioh.iot;
+	sc->wi_bhandle = pcioh.ioh;
+
+	/* Make sure interrupts are disabled. */
+	CSR_WRITE_2(sc, WI_INT_EN, 0);
+	CSR_WRITE_2(sc, WI_EVENT_ACK, 0xFFFF);
+
+	wi_reset(sc);
+
+	/* Read the station address. */
+	mac.wi_type = WI_RID_MAC_NODE;
+	mac.wi_len = 4;
+	wi_read_record(sc, (struct wi_ltv_gen *)&mac);
+	bcopy((char *)&mac.wi_mac_addr, (char *)&sc->arpcom.ac_enaddr,
+	    ETHER_ADDR_LEN);
+
+	printf(": address %s", ether_sprintf(sc->arpcom.ac_enaddr));
+
+	ifp = &sc->arpcom.ac_if;
+	bcopy(sc->sc_dev.dv_xname, ifp->if_xname, IFNAMSIZ);
+	ifp->if_softc = sc;
+	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
+	ifp->if_ioctl = wi_ioctl;
+	ifp->if_start = wi_start;
+	ifp->if_watchdog = wi_watchdog;
+	ifp->if_baudrate = 10000000;
+	ifp->if_snd.ifq_maxlen = IFQ_MAXLEN;
+
+	bzero(sc->wi_node_name, sizeof(sc->wi_node_name));
+	bcopy(WI_DEFAULT_NODENAME, sc->wi_node_name,
+	    sizeof(WI_DEFAULT_NODENAME) - 1);
+
+	bzero(sc->wi_net_name, sizeof(sc->wi_net_name));
+	bcopy(WI_DEFAULT_NETNAME, sc->wi_net_name,
+	    sizeof(WI_DEFAULT_NETNAME) - 1);
+
+	bzero(sc->wi_ibss_name, sizeof(sc->wi_ibss_name));
+	bcopy(WI_DEFAULT_IBSS, sc->wi_ibss_name,
+	    sizeof(WI_DEFAULT_IBSS) - 1);
+
+	sc->wi_portnum = WI_DEFAULT_PORT;
+	sc->wi_ptype = WI_PORTTYPE_ADHOC;
+	sc->wi_ap_density = WI_DEFAULT_AP_DENSITY;
+	sc->wi_rts_thresh = WI_DEFAULT_RTS_THRESH;
+	sc->wi_tx_rate = WI_DEFAULT_TX_RATE;
+	sc->wi_max_data_len = WI_DEFAULT_DATALEN;
+	sc->wi_create_ibss = WI_DEFAULT_CREATE_IBSS;
+	sc->wi_pm_enabled = WI_DEFAULT_PM_ENABLED;
+	sc->wi_max_sleep = WI_DEFAULT_MAX_SLEEP;
+
+	/*
+	 * Read the default channel from the NIC. This may vary
+	 * depending on the country where the NIC was purchased, so
+	 * we can't hard-code a default and expect it to work for
+	 * everyone.
+	 */
+	gen.wi_type = WI_RID_OWN_CHNL;
+	gen.wi_len = 2;
+	wi_read_record(sc, &gen);
+	sc->wi_channel = gen.wi_val;
+
+	bzero((char *)&sc->wi_stats, sizeof(sc->wi_stats));
+
+	/*
+	 * Call MI attach routines.
+	 */
+	if_attach(ifp);
+	ether_ifattach(ifp);
+
+#if NBPFILTER > 0
+	BPFATTACH(&sc->arpcom.ac_if.if_bpf, ifp, DLT_EN10MB,
+	    sizeof(struct ether_header));
+#endif
+
+	shutdownhook_establish(wi_shutdown, sc);
+
+	printf("\n");
+
+	/* Establish the interrupt. */
+	sc->sc_ih = pcmcia_intr_establish(pa->pf, IPL_NET, wi_intr, sc);
+	if (sc->sc_ih == NULL) {
+		printf("%s: couldn't establish interrupt\n",
+		    sc->sc_dev.dv_xname);
+		goto bad;
+	}
+
+	wi_init(sc);
+	wi_stop(sc);
+
+#ifdef notyet
+	/*
+	 * XXX This should be done once the framework has enable/disable hooks.
+	 */
+	pcmcia_function_disable(pf);
+#endif	/* notyet */
+
+	return;
+
+bad:
+	if (state > 2)
+		pcmcia_chip_io_unmap(pf->sc->pct, pf->sc->pch, io_window);
+	if (state > 1)
+		pcmcia_chip_io_free(pf->sc->pct, pf->sc->pch, &pcioh);
+	if (state > 0)
+		pcmcia_function_disable(pf);
+}
+
+#endif	/* __FreeBSD__ */
+
+#ifdef __FreeBSD__
+void wi_intr(unit)
+	int			unit;
+{
+	struct wi_softc		*sc = &wi_softc[unit];
+#else	/* !__FreeBSD__ */
+int wi_intr(vsc)
+	void			*vsc;
+{
+	struct wi_softc		*sc = vsc;
+#endif	/* __FreeBSD__ */
+	struct ifnet		*ifp;
+	u_int16_t		status;
+
+	DPRINTF(WID_INTR, ("wi_intr: sc %p\n", sc));
+
+	ifp = &sc->arpcom.ac_if;
+
+	if (!(ifp->if_flags & IFF_UP)) {
+		CSR_WRITE_2(sc, WI_EVENT_ACK, 0xFFFF);
+		CSR_WRITE_2(sc, WI_INT_EN, 0);
+		return (0);
+	}
+
+	/* Disable interrupts. */
+	CSR_WRITE_2(sc, WI_INT_EN, 0);
+
+	status = CSR_READ_2(sc, WI_EVENT_STAT);
+	CSR_WRITE_2(sc, WI_EVENT_ACK, ~WI_INTRS);
+
+	if (status & WI_EV_RX) {
+		wi_rxeof(sc);
+		CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_RX);
+	}
+
+	if (status & WI_EV_TX) {
+		wi_txeof(sc, status);
+		CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_TX);
+	}
+
+	if (status & WI_EV_ALLOC) {
+		int			id;
+		id = CSR_READ_2(sc, WI_ALLOC_FID);
+		CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_ALLOC);
+		if (id == sc->wi_tx_data_id)
+			wi_txeof(sc, status);
+	}
+
+	if (status & WI_EV_INFO) {
+		wi_update_stats(sc);
+		CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_INFO);
+	}
+
+	if (status & WI_EV_TX_EXC) {
+		wi_txeof(sc, status);
+		CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_TX_EXC);
+	}
+
+	if (status & WI_EV_INFO_DROP) {
+		CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_INFO_DROP);
+	}
+
+	/* Re-enable interrupts. */
+	CSR_WRITE_2(sc, WI_INT_EN, WI_INTRS);
+
+	if (ifp->if_snd.ifq_head != NULL)
+		wi_start(ifp);
+
+	return (1);
+}
+
+STATIC void wi_rxeof(sc)
+	struct wi_softc		*sc;
+{
+	struct ifnet		*ifp;
+	struct ether_header	*eh;
+	struct wi_frame		rx_frame;
+	struct mbuf		*m;
+	int			id;
+
+	ifp = &sc->arpcom.ac_if;
+
+	id = CSR_READ_2(sc, WI_RX_FID);
+
+	/* First read in the frame header */
+	if (wi_read_data(sc, id, 0, (caddr_t)&rx_frame, sizeof(rx_frame))) {
+		ifp->if_ierrors++;
+		return;
+	}
+
+	if (rx_frame.wi_status & WI_STAT_ERRSTAT) {
+		ifp->if_ierrors++;
+		return;
+	}
+
+	MGETHDR(m, M_DONTWAIT, MT_DATA);
+	if (m == NULL) {
+		ifp->if_ierrors++;
+		return;
+	}
+	MCLGET(m, M_DONTWAIT);
+	if (!(m->m_flags & M_EXT)) {
+		m_freem(m);
+		ifp->if_ierrors++;
+		return;
+	}
+
+	eh = mtod(m, struct ether_header *);
+	m->m_pkthdr.rcvif = ifp;
+
+	if (rx_frame.wi_status == WI_STAT_1042 ||
+	    rx_frame.wi_status == WI_STAT_TUNNEL ||
+	    rx_frame.wi_status == WI_STAT_WMP_MSG) {
+		if((rx_frame.wi_dat_len + WI_SNAPHDR_LEN) > MCLBYTES) {
+			printf(WI_PRT_FMT ": oversized packet received "
+			    "(wi_dat_len=%d, wi_status=0x%x)\n",
+			    WI_PRT_ARG(sc), rx_frame.wi_dat_len,
+			    rx_frame.wi_status);
+			m_freem(m);
+			ifp->if_ierrors++;
+			return;
+		}
+		m->m_pkthdr.len = m->m_len =
+		    rx_frame.wi_dat_len + WI_SNAPHDR_LEN;
+
+		bcopy((char *)&rx_frame.wi_addr1,
+		    (char *)&eh->ether_dhost, ETHER_ADDR_LEN);
+		bcopy((char *)&rx_frame.wi_addr2,
+		    (char *)&eh->ether_shost, ETHER_ADDR_LEN);
+		bcopy((char *)&rx_frame.wi_type,
+		    (char *)&eh->ether_type, sizeof(u_int16_t));
+
+		if (wi_read_data(sc, id, WI_802_11_OFFSET,
+		    mtod(m, caddr_t) + sizeof(struct ether_header),
+		    m->m_len + 2)) {
+			m_freem(m);
+			ifp->if_ierrors++;
+			return;
+		}
+	} else {
+		if((rx_frame.wi_dat_len +
+		    sizeof(struct ether_header)) > MCLBYTES) {
+			printf(WI_PRT_FMT ": oversized packet received "
+			    "(wi_dat_len=%d, wi_status=0x%x)\n",
+			    WI_PRT_ARG(sc), rx_frame.wi_dat_len,
+			    rx_frame.wi_status);
+			m_freem(m);
+			ifp->if_ierrors++;
+			return;
+		}
+		m->m_pkthdr.len = m->m_len =
+		    rx_frame.wi_dat_len + sizeof(struct ether_header);
+
+		if (wi_read_data(sc, id, WI_802_3_OFFSET,
+		    mtod(m, caddr_t), m->m_len + 2)) {
+			m_freem(m);
+			ifp->if_ierrors++;
+			return;
+		}
+	}
+
+	ifp->if_ipackets++;
+
+#if NBPFILTER > 0
+	/* Handle BPF listeners. */
+	if (ifp->if_bpf) {
+		BPF_MTAP(ifp, m);
+		if (ifp->if_flags & IFF_PROMISC &&
+		    (bcmp(eh->ether_dhost, sc->arpcom.ac_enaddr,
+		    ETHER_ADDR_LEN) && (eh->ether_dhost[0] & 1) == 0)) {
+			m_freem(m);
+			return;
+		}
+	}
+#endif
+
+	/* Receive packet. */
+	m_adj(m, sizeof(struct ether_header));
+	ether_input(ifp, eh, m);
+
+	return;
+}
+
+STATIC void wi_txeof(sc, status)
+	struct wi_softc		*sc;
+	int			status;
+{
+	struct ifnet		*ifp;
+
+	ifp = &sc->arpcom.ac_if;
+
+	ifp->if_timer = 0;
+	ifp->if_flags &= ~IFF_OACTIVE;
+
+	if (status & WI_EV_TX_EXC)
+		ifp->if_oerrors++;
+	else
+		ifp->if_opackets++;
+
+	return;
+}
+
+void wi_inquire(xsc)
+	void			*xsc;
+{
+	struct wi_softc		*sc;
+	struct ifnet		*ifp;
+
+	sc = xsc;
+	ifp = &sc->arpcom.ac_if;
+
+	TIMEOUT(sc->wi_stat_ch, wi_inquire, sc, hz * 60);
+
+	/* Don't do this while we're transmitting */
+	if (ifp->if_flags & IFF_OACTIVE)
+		return;
+
+	wi_cmd(sc, WI_CMD_INQUIRE, WI_INFO_COUNTERS);
+
+	return;
+}
+
+void wi_update_stats(sc)
+	struct wi_softc		*sc;
+{
+	struct wi_ltv_gen	gen;
+	u_int16_t		id;
+	struct ifnet		*ifp;
+	u_int32_t		*ptr;
+	int			i;
+	u_int16_t		t;
+
+	ifp = &sc->arpcom.ac_if;
+
+	id = CSR_READ_2(sc, WI_INFO_FID);
+
+	wi_read_data(sc, id, 0, (char *)&gen, 4);
+
+	if (gen.wi_type != WI_INFO_COUNTERS ||
+	    gen.wi_len > (sizeof(sc->wi_stats) / 4) + 1)
+		return;
+
+	ptr = (u_int32_t *)&sc->wi_stats;
+
+	for (i = 0; i < gen.wi_len - 1; i++) {
+		t = CSR_READ_2(sc, WI_DATA1);
+#ifdef WI_HERMES_STATS_WAR
+		if (t > 0xF000)
+			t = ~t & 0xFFFF;
+#endif
+		ptr[i] += t;
+	}
+
+	ifp->if_collisions = sc->wi_stats.wi_tx_single_retries +
+	    sc->wi_stats.wi_tx_multi_retries +
+	    sc->wi_stats.wi_tx_retry_limit;
+
+	return;
+}
+
+STATIC int wi_cmd(sc, cmd, val)
+	struct wi_softc		*sc;
+	int			cmd;
+	int			val;
+{
+	int			i, s = 0;
+
+	CSR_WRITE_2(sc, WI_PARAM0, val);
+	CSR_WRITE_2(sc, WI_COMMAND, cmd);
+
+	for (i = 0; i < WI_TIMEOUT; i++) {
+		/*
+		 * Wait for 'command complete' bit to be
+		 * set in the event status register.
+		 */
+		s = CSR_READ_2(sc, WI_EVENT_STAT) & WI_EV_CMD;
+		if (s) {
+			/* Ack the event and read result code. */
+			s = CSR_READ_2(sc, WI_STATUS);
+			CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_CMD);
+#ifdef foo
+			if ((s & WI_CMD_CODE_MASK) != (cmd & WI_CMD_CODE_MASK))
+				return(EIO);
+#endif
+			if (s & WI_STAT_CMD_RESULT)
+				return(EIO);
+			break;
+		}
+	}
+
+	if (i == WI_TIMEOUT)
+		return(ETIMEDOUT);
+
+	return(0);
+}
+
+STATIC void wi_reset(sc)
+	struct wi_softc		*sc;
+{
+	DPRINTF(WID_RESET, ("wi_reset: sc %p\n", sc));
+
+	if (wi_cmd(sc, WI_CMD_INI, 0))
+		printf(WI_PRT_FMT ": init failed\n", WI_PRT_ARG(sc));
+	CSR_WRITE_2(sc, WI_INT_EN, 0);
+	CSR_WRITE_2(sc, WI_EVENT_ACK, 0xFFFF);
+
+	/* Calibrate timer. */
+	WI_SETVAL(WI_RID_TICK_TIME, 8);
+
+	return;
+}
+
+/*
+ * Read an LTV record from the NIC.
+ */
+STATIC int wi_read_record(sc, ltv)
+	struct wi_softc		*sc;
+	struct wi_ltv_gen	*ltv;
+{
+	u_int16_t		*ptr;
+	int			i, len, code;
+
+	/* Tell the NIC to enter record read mode. */
+	if (wi_cmd(sc, WI_CMD_ACCESS|WI_ACCESS_READ, ltv->wi_type))
+		return(EIO);
+
+	/* Seek to the record. */
+	if (wi_seek(sc, ltv->wi_type, 0, WI_BAP1))
+		return(EIO);
+
+	/*
+	 * Read the length and record type and make sure they
+	 * match what we expect (this verifies that we have enough
+	 * room to hold all of the returned data).
+	 */
+	len = CSR_READ_2(sc, WI_DATA1);
+	if (len > ltv->wi_len)
+		return(ENOSPC);
+	code = CSR_READ_2(sc, WI_DATA1);
+	if (code != ltv->wi_type)
+		return(EIO);
+
+	ltv->wi_len = len;
+	ltv->wi_type = code;
+
+	/* Now read the data. */
+	ptr = &ltv->wi_val;
+	for (i = 0; i < ltv->wi_len - 1; i++)
+		ptr[i] = CSR_READ_2(sc, WI_DATA1);
+
+	return(0);
+}
+
+/*
+ * Same as read, except we inject data instead of reading it.
+ */
+STATIC int wi_write_record(sc, ltv)
+	struct wi_softc		*sc;
+	struct wi_ltv_gen	*ltv;
+{
+	u_int16_t		*ptr;
+	int			i;
+
+	if (wi_seek(sc, ltv->wi_type, 0, WI_BAP1))
+		return(EIO);
+
+	CSR_WRITE_2(sc, WI_DATA1, ltv->wi_len);
+	CSR_WRITE_2(sc, WI_DATA1, ltv->wi_type);
+
+	ptr = &ltv->wi_val;
+	for (i = 0; i < ltv->wi_len - 1; i++)
+		CSR_WRITE_2(sc, WI_DATA1, ptr[i]);
+
+	if (wi_cmd(sc, WI_CMD_ACCESS|WI_ACCESS_WRITE, ltv->wi_type))
+		return(EIO);
+
+	return(0);
+}
+
+STATIC int wi_seek(sc, id, off, chan)
+	struct wi_softc		*sc;
+	int			id, off, chan;
+{
+	int			i;
+	int			selreg, offreg;
+
+	switch (chan) {
+	case WI_BAP0:
+		selreg = WI_SEL0;
+		offreg = WI_OFF0;
+		break;
+	case WI_BAP1:
+		selreg = WI_SEL1;
+		offreg = WI_OFF1;
+		break;
+	default:
+		printf(WI_PRT_FMT ": invalid data path: %x\n", WI_PRT_ARG(sc),
+		    chan);
+		return(EIO);
+	}
+
+	CSR_WRITE_2(sc, selreg, id);
+	CSR_WRITE_2(sc, offreg, off);
+
+	for (i = 0; i < WI_TIMEOUT; i++) {
+		if (!(CSR_READ_2(sc, offreg) & (WI_OFF_BUSY|WI_OFF_ERR)))
+			break;
+	}
+
+	if (i == WI_TIMEOUT)
+		return(ETIMEDOUT);
+
+	return(0);
+}
+
+STATIC int wi_read_data(sc, id, off, buf, len)
+	struct wi_softc		*sc;
+	int			id, off;
+	caddr_t			buf;
+	int			len;
+{
+	int			i;
+	u_int16_t		*ptr;
+
+	if (wi_seek(sc, id, off, WI_BAP1))
+		return(EIO);
+
+	ptr = (u_int16_t *)buf;
+	for (i = 0; i < len / 2; i++)
+		ptr[i] = CSR_READ_2(sc, WI_DATA1);
+
+	return(0);
+}
+
+/*
+ * According to the comments in the HCF Light code, there is a bug in
+ * the Hermes (or possibly in certain Hermes firmware revisions) where
+ * the chip's internal autoincrement counter gets thrown off during
+ * data writes: the autoincrement is missed, causing one data word to
+ * be overwritten and subsequent words to be written to the wrong memory
+ * locations. The end result is that we could end up transmitting bogus
+ * frames without realizing it. The workaround for this is to write a
+ * couple of extra guard words after the end of the transfer, then
+ * attempt to read then back. If we fail to locate the guard words where
+ * we expect them, we preform the transfer over again.
+ */
+STATIC int wi_write_data(sc, id, off, buf, len)
+	struct wi_softc		*sc;
+	int			id, off;
+	caddr_t			buf;
+	int			len;
+{
+	int			i;
+	u_int16_t		*ptr;
+
+#ifdef WI_HERMES_AUTOINC_WAR
+again:
+#endif
+
+	if (wi_seek(sc, id, off, WI_BAP0))
+		return(EIO);
+
+	ptr = (u_int16_t *)buf;
+	for (i = 0; i < (len / 2); i++)
+		CSR_WRITE_2(sc, WI_DATA0, ptr[i]);
+
+#ifdef WI_HERMES_AUTOINC_WAR
+	CSR_WRITE_2(sc, WI_DATA0, 0x1234);
+	CSR_WRITE_2(sc, WI_DATA0, 0x5678);
+
+	if (wi_seek(sc, id, off + len, WI_BAP0))
+		return(EIO);
+
+	if (CSR_READ_2(sc, WI_DATA0) != 0x1234 ||
+	    CSR_READ_2(sc, WI_DATA0) != 0x5678)
+		goto again;
+#endif
+
+	return(0);
+}
+
+/*
+ * Allocate a region of memory inside the NIC and zero
+ * it out.
+ */
+STATIC int wi_alloc_nicmem(sc, len, id)
+	struct wi_softc		*sc;
+	int			len;
+	int			*id;
+{
+	int			i;
+
+	if (wi_cmd(sc, WI_CMD_ALLOC_MEM, len)) {
+		printf(WI_PRT_FMT ": failed to allocate %d bytes on NIC\n",
+		    WI_PRT_ARG(sc), len);
+		return(ENOMEM);
+	}
+
+	for (i = 0; i < WI_TIMEOUT; i++) {
+		if (CSR_READ_2(sc, WI_EVENT_STAT) & WI_EV_ALLOC)
+			break;
+	}
+
+	if (i == WI_TIMEOUT)
+		return(ETIMEDOUT);
+
+	CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_ALLOC);
+	*id = CSR_READ_2(sc, WI_ALLOC_FID);
+
+	if (wi_seek(sc, *id, 0, WI_BAP0))
+		return(EIO);
+
+	for (i = 0; i < len / 2; i++)
+		CSR_WRITE_2(sc, WI_DATA0, 0);
+
+	return(0);
+}
+
+STATIC void wi_setmulti(sc)
+	struct wi_softc		*sc;
+{
+	struct ifnet		*ifp;
+	int			i = 0;
+	struct wi_ltv_mcast	mcast;
+#ifdef __FreeBSD__
+	struct ifmultiaddr	*ifma;
+#else
+	struct ether_multistep	step;
+	struct ether_multi	*enm;
+#endif
+
+	ifp = &sc->arpcom.ac_if;
+
+	bzero((char *)&mcast, sizeof(mcast));
+
+	mcast.wi_type = WI_RID_MCAST;
+	mcast.wi_len = (3 * 16) + 1;
+
+	if (ifp->if_flags & IFF_ALLMULTI || ifp->if_flags & IFF_PROMISC) {
+		wi_write_record(sc, (struct wi_ltv_gen *)&mcast);
+		return;
+	}
+
+#ifdef __FreeBSD__
+	for (ifma = ifp->if_multiaddrs.lh_first; ifma != NULL;
+				ifma = ifma->ifma_link.le_next) {
+		if (ifma->ifma_addr->sa_family != AF_LINK)
+			continue;
+		if (i < 16) {
+			bcopy(LLADDR((struct sockaddr_dl *)ifma->ifma_addr),
+			    (char *)&mcast.wi_mcast[i], ETHER_ADDR_LEN);
+			i++;
+		} else {
+			bzero((char *)&mcast, sizeof(mcast));
+			break;
+		}
+	}
+#else	/* !__FreeBSD__ */
+	ETHER_FIRST_MULTI(step, &sc->arpcom, enm);
+	while (enm != NULL) {
+		if (i >= 16) {
+			bzero((char *)&mcast, sizeof(mcast));
+			break;
+		}
+
+		/* Punt on ranges. */
+		if (bcmp(enm->enm_addrlo, enm->enm_addrhi,
+		    sizeof(enm->enm_addrlo)) != 0)
+			break;
+		bcopy(enm->enm_addrlo, (char *)&mcast.wi_mcast[i],
+		    ETHER_ADDR_LEN);
+		i++;
+		ETHER_NEXT_MULTI(step, enm);
+	}
+#endif	/* __FreeBSD__ */
+
+	mcast.wi_len = (i * 3) + 1;
+	wi_write_record(sc, (struct wi_ltv_gen *)&mcast);
+
+	return;
+}
+
+STATIC void wi_setdef(sc, wreq)
+	struct wi_softc		*sc;
+	struct wi_req		*wreq;
+{
+	struct sockaddr_dl	*sdl;
+	struct ifaddr		*ifa;
+	struct ifnet		*ifp;
+#ifndef __FreeBSD__
+	extern struct ifaddr	**ifnet_addrs;
+#endif	/* !__FreeBSD__ */
+
+	ifp = &sc->arpcom.ac_if;
+
+	switch(wreq->wi_type) {
+	case WI_RID_MAC_NODE:
+		ifa = ifnet_addrs[ifp->if_index - 1];
+		sdl = (struct sockaddr_dl *)ifa->ifa_addr;
+		bcopy((char *)&wreq->wi_val, LLADDR(sdl), ETHER_ADDR_LEN);
+		bcopy((char *)&wreq->wi_val, (char *)&sc->arpcom.ac_enaddr,
+		   ETHER_ADDR_LEN);
+		break;
+	case WI_RID_PORTTYPE:
+		sc->wi_ptype = wreq->wi_val[0];
+		break;
+	case WI_RID_TX_RATE:
+		sc->wi_tx_rate = wreq->wi_val[0];
+		break;
+	case WI_RID_MAX_DATALEN:
+		sc->wi_max_data_len = wreq->wi_val[0];
+		break;
+	case WI_RID_RTS_THRESH:
+		sc->wi_rts_thresh = wreq->wi_val[0];
+		break;
+	case WI_RID_SYSTEM_SCALE:
+		sc->wi_ap_density = wreq->wi_val[0];
+		break;
+	case WI_RID_CREATE_IBSS:
+		sc->wi_create_ibss = wreq->wi_val[0];
+		break;
+	case WI_RID_OWN_CHNL:
+		sc->wi_channel = wreq->wi_val[0];
+		break;
+	case WI_RID_NODENAME:
+		bzero(sc->wi_node_name, sizeof(sc->wi_node_name));
+		bcopy((char *)&wreq->wi_val[1], sc->wi_node_name, 30);
+		break;
+	case WI_RID_DESIRED_SSID:
+		bzero(sc->wi_net_name, sizeof(sc->wi_net_name));
+		bcopy((char *)&wreq->wi_val[1], sc->wi_net_name, 30);
+		break;
+	case WI_RID_OWN_SSID:
+		bzero(sc->wi_ibss_name, sizeof(sc->wi_ibss_name));
+		bcopy((char *)&wreq->wi_val[1], sc->wi_ibss_name, 30);
+		break;
+	case WI_RID_PM_ENABLED:
+		sc->wi_pm_enabled = wreq->wi_val[0];
+		break;
+	case WI_RID_MAX_SLEEP:
+		sc->wi_max_sleep = wreq->wi_val[0];
+		break;
+	default:
+		break;
+	}
+
+	/* Reinitialize WaveLAN. */
+	wi_init(sc);
+
+	return;
+}
+
+STATIC int wi_ioctl(ifp, command, data)
+	struct ifnet		*ifp;
+	u_long			command;
+	caddr_t			data;
+{
+	int			s, error = 0;
+	struct wi_softc		*sc;
+	struct wi_req		wreq;
+	struct ifreq		*ifr;
+#ifndef __FreeBSD__
+	struct ifaddr		*ifa = (struct ifaddr *)data;
+#endif	/* !__FreeBSD__ */
+
+	s = splimp();
+
+	sc = ifp->if_softc;
+	ifr = (struct ifreq *)data;
+
+	if (sc->wi_gone)
+		return(ENODEV);
+
+	DPRINTF (WID_IOCTL, ("wi_ioctl: command %lu data %p", command, data));
+
+#ifndef __FreeBSD__
+	if ((error = ether_ioctl(ifp, &sc->arpcom, command, data)) > 0) {
+		splx(s);
+		return error;
+	}
+#endif	/* !__FreeBSD__ */
+
+	switch(command) {
+#ifdef __FreeBSD__
+	case SIOCSIFADDR:
+	case SIOCGIFADDR:
+	case SIOCSIFMTU:
+		error = ether_ioctl(ifp, command, data);
+		break;
+#else	/* !__FreeBSD__ */
+	case SIOCSIFADDR:
+		ifp->if_flags |= IFF_UP;
+		switch (ifa->ifa_addr->sa_family) {
+#ifdef INET
+		case AF_INET:
+			wi_init(sc);
+			arp_ifinit(&sc->arpcom, ifa);
+			break;
+#endif	/* INET */
+		default:
+			wi_init(sc);
+			break;
+		}
+		break;
+#endif	/* __FreeBSD__ */
+
+	case SIOCSIFFLAGS:
+		if (ifp->if_flags & IFF_UP) {
+			if (ifp->if_flags & IFF_RUNNING &&
+			    ifp->if_flags & IFF_PROMISC &&
+			    !(sc->wi_if_flags & IFF_PROMISC)) {
+				WI_SETVAL(WI_RID_PROMISC, 1);
+			} else if (ifp->if_flags & IFF_RUNNING &&
+			    !(ifp->if_flags & IFF_PROMISC) &&
+			    sc->wi_if_flags & IFF_PROMISC) {
+				WI_SETVAL(WI_RID_PROMISC, 0);
+			} else
+				wi_init(sc);
+		} else {
+			if (ifp->if_flags & IFF_RUNNING) {
+				wi_stop(sc);
+			}
+		}
+		sc->wi_if_flags = ifp->if_flags;
+		error = 0;
+		break;
+	case SIOCADDMULTI:
+	case SIOCDELMULTI:
+		wi_setmulti(sc);
+		error = 0;
+		break;
+	case SIOCGWAVELAN:
+		error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
+		if (error)
+			break;
+		if (wreq.wi_type == WI_RID_IFACE_STATS) {
+			bcopy((char *)&sc->wi_stats, (char *)&wreq.wi_val,
+			    sizeof(sc->wi_stats));
+			wreq.wi_len = (sizeof(sc->wi_stats) / 2) + 1;
+		} else {
+			if (wi_read_record(sc, (struct wi_ltv_gen *)&wreq)) {
+				error = EINVAL;
+				break;
+			}
+		}
+		error = copyout(&wreq, ifr->ifr_data, sizeof(wreq));
+		break;
+	case SIOCSWAVELAN:
+		error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
+		if (error)
+			break;
+		if (wreq.wi_type == WI_RID_IFACE_STATS) {
+			error = EINVAL;
+			break;
+		} else if (wreq.wi_type == WI_RID_MGMT_XMIT) {
+			error = wi_mgmt_xmit(sc, (caddr_t)&wreq.wi_val,
+			    wreq.wi_len);
+		} else {
+			error = wi_write_record(sc, (struct wi_ltv_gen *)&wreq);
+			if (!error)
+				wi_setdef(sc, &wreq);
+		}
+		break;
+	default:
+		error = EINVAL;
+		break;
+	}
+
+	splx(s);
+
+	return(error);
+}
+
+STATIC void wi_init(xsc)
+	void			*xsc;
+{
+	struct wi_softc		*sc = xsc;
+	struct ifnet		*ifp = &sc->arpcom.ac_if;
+	int			s;
+	struct wi_ltv_macaddr	mac;
+	int			id = 0;
+
+	if (sc->wi_gone)
+		return;
+
+	DPRINTF(WID_INIT, ("wi_init: sc %p\n", sc));
+
+	s = splimp();
+
+	if (ifp->if_flags & IFF_RUNNING)
+		wi_stop(sc);
+
+	wi_reset(sc);
+
+	/* Program max data length. */
+	WI_SETVAL(WI_RID_MAX_DATALEN, sc->wi_max_data_len);
+
+	/* Enable/disable IBSS creation. */
+	WI_SETVAL(WI_RID_CREATE_IBSS, sc->wi_create_ibss);
+
+	/* Set the port type. */
+	WI_SETVAL(WI_RID_PORTTYPE, sc->wi_ptype);
+
+	/* Program the RTS/CTS threshold. */
+	WI_SETVAL(WI_RID_RTS_THRESH, sc->wi_rts_thresh);
+
+	/* Program the TX rate */
+	WI_SETVAL(WI_RID_TX_RATE, sc->wi_tx_rate);
+
+	/* Access point density */
+	WI_SETVAL(WI_RID_SYSTEM_SCALE, sc->wi_ap_density);
+
+	/* Power Management Enabled */
+	WI_SETVAL(WI_RID_PM_ENABLED, sc->wi_pm_enabled);
+
+	/* Power Managment Max Sleep */
+	WI_SETVAL(WI_RID_MAX_SLEEP, sc->wi_max_sleep);
+
+	/* Specify the IBSS name */
+	WI_SETSTR(WI_RID_OWN_SSID, sc->wi_ibss_name);
+
+	/* Specify the network name */
+	WI_SETSTR(WI_RID_DESIRED_SSID, sc->wi_net_name);
+
+	/* Specify the frequency to use */
+	WI_SETVAL(WI_RID_OWN_CHNL, sc->wi_channel);
+
+	/* Program the nodename. */
+	WI_SETSTR(WI_RID_NODENAME, sc->wi_node_name);
+
+	/* Set our MAC address. */
+	mac.wi_len = 4;
+	mac.wi_type = WI_RID_MAC_NODE;
+	bcopy((char *)&sc->arpcom.ac_enaddr,
+	   (char *)&mac.wi_mac_addr, ETHER_ADDR_LEN);
+	wi_write_record(sc, (struct wi_ltv_gen *)&mac);
+
+	/* Initialize promisc mode. */
+	if (ifp->if_flags & IFF_PROMISC) {
+		WI_SETVAL(WI_RID_PROMISC, 1);
+	} else {
+		WI_SETVAL(WI_RID_PROMISC, 0);
+	}
+
+	/* Set multicast filter. */
+	wi_setmulti(sc);
+
+	/* Enable desired port */
+	wi_cmd(sc, WI_CMD_ENABLE|sc->wi_portnum, 0);
+
+	if (wi_alloc_nicmem(sc, 1518 + sizeof(struct wi_frame) + 8, &id))
+		printf(WI_PRT_FMT ": tx buffer allocation failed\n",
+		    WI_PRT_ARG(sc));
+	sc->wi_tx_data_id = id;
+
+	if (wi_alloc_nicmem(sc, 1518 + sizeof(struct wi_frame) + 8, &id))
+		printf(WI_PRT_FMT ": mgmt. buffer allocation failed\n",
+		    WI_PRT_ARG(sc));
+	sc->wi_tx_mgmt_id = id;
+
+	/* enable interrupts */
+	CSR_WRITE_2(sc, WI_INT_EN, WI_INTRS);
+
+	splx(s);
+
+	ifp->if_flags |= IFF_RUNNING;
+	ifp->if_flags &= ~IFF_OACTIVE;
+
+	TIMEOUT(sc->wi_stat_ch, wi_inquire, sc, hz * 60);
+
+	return;
+}
+
+STATIC void wi_start(ifp)
+	struct ifnet		*ifp;
+{
+	struct wi_softc		*sc;
+	struct mbuf		*m0;
+	struct wi_frame		tx_frame;
+	struct ether_header	*eh;
+	int			id;
+
+	sc = ifp->if_softc;
+
+	DPRINTF(WID_START, ("wi_start: ifp %p sc %p\n", ifp, sc));
+
+	if (sc->wi_gone)
+		return;
+
+	if (ifp->if_flags & IFF_OACTIVE)
+		return;
+
+	IF_DEQUEUE(&ifp->if_snd, m0);
+	if (m0 == NULL)
+		return;
+
+	bzero((char *)&tx_frame, sizeof(tx_frame));
+	id = sc->wi_tx_data_id;
+	eh = mtod(m0, struct ether_header *);
+
+	/*
+	 * Use RFC1042 encoding for IP and ARP datagrams,
+	 * 802.3 for anything else.
+	 */
+	if (ntohs(eh->ether_type) == ETHERTYPE_IP ||
+	    ntohs(eh->ether_type) == ETHERTYPE_ARP ||
+	    ntohs(eh->ether_type) == ETHERTYPE_REVARP) {
+		bcopy((char *)&eh->ether_dhost,
+		    (char *)&tx_frame.wi_addr1, ETHER_ADDR_LEN);
+		bcopy((char *)&eh->ether_shost,
+		    (char *)&tx_frame.wi_addr2, ETHER_ADDR_LEN);
+		bcopy((char *)&eh->ether_dhost,
+		    (char *)&tx_frame.wi_dst_addr, ETHER_ADDR_LEN);
+		bcopy((char *)&eh->ether_shost,
+		    (char *)&tx_frame.wi_src_addr, ETHER_ADDR_LEN);
+
+		tx_frame.wi_dat_len = m0->m_pkthdr.len - WI_SNAPHDR_LEN;
+		tx_frame.wi_frame_ctl = WI_FTYPE_DATA;
+		tx_frame.wi_dat[0] = htons(WI_SNAP_WORD0);
+		tx_frame.wi_dat[1] = htons(WI_SNAP_WORD1);
+		tx_frame.wi_len = htons(m0->m_pkthdr.len - WI_SNAPHDR_LEN);
+		tx_frame.wi_type = eh->ether_type;
+
+		m_copydata(m0, sizeof(struct ether_header),
+		    m0->m_pkthdr.len - sizeof(struct ether_header),
+		    (caddr_t)&sc->wi_txbuf);
+
+		wi_write_data(sc, id, 0, (caddr_t)&tx_frame,
+		    sizeof(struct wi_frame));
+		wi_write_data(sc, id, WI_802_11_OFFSET, (caddr_t)&sc->wi_txbuf,
+		    (m0->m_pkthdr.len - sizeof(struct ether_header)) + 2);
+	} else {
+		tx_frame.wi_dat_len = m0->m_pkthdr.len;
+
+		m_copydata(m0, 0, m0->m_pkthdr.len, (caddr_t)&sc->wi_txbuf);
+
+		wi_write_data(sc, id, 0, (caddr_t)&tx_frame,
+		    sizeof(struct wi_frame));
+		wi_write_data(sc, id, WI_802_3_OFFSET, (caddr_t)&sc->wi_txbuf,
+		    m0->m_pkthdr.len + 2);
+	}
+
+#if NBPFILTER > 0
+	/*
+	 * If there's a BPF listner, bounce a copy of
+	 * this frame to him.
+	 */
+	if (ifp->if_bpf)
+		BPF_MTAP(ifp, m0);
+#endif
+
+	m_freem(m0);
+
+	if (wi_cmd(sc, WI_CMD_TX|WI_RECLAIM, id))
+		printf(WI_PRT_FMT ": xmit failed\n", WI_PRT_ARG(sc));
+
+	ifp->if_flags |= IFF_OACTIVE;
+
+	/*
+	 * Set a timeout in case the chip goes out to lunch.
+	 */
+	ifp->if_timer = 5;
+
+	return;
+}
+
+STATIC int wi_mgmt_xmit(sc, data, len)
+	struct wi_softc		*sc;
+	caddr_t			data;
+	int			len;
+{
+	struct wi_frame		tx_frame;
+	int			id;
+	struct wi_80211_hdr	*hdr;
+	caddr_t			dptr;
+
+	if (sc->wi_gone)
+		return(ENODEV);
+
+	hdr = (struct wi_80211_hdr *)data;
+	dptr = data + sizeof(struct wi_80211_hdr);
+
+	bzero((char *)&tx_frame, sizeof(tx_frame));
+	id = sc->wi_tx_mgmt_id;
+
+	bcopy((char *)hdr, (char *)&tx_frame.wi_frame_ctl,
+	   sizeof(struct wi_80211_hdr));
+
+	tx_frame.wi_dat_len = len - WI_SNAPHDR_LEN;
+	tx_frame.wi_len = htons(len - WI_SNAPHDR_LEN);
+
+	wi_write_data(sc, id, 0, (caddr_t)&tx_frame, sizeof(struct wi_frame));
+	wi_write_data(sc, id, WI_802_11_OFFSET_RAW, dptr,
+	    (len - sizeof(struct wi_80211_hdr)) + 2);
+
+	if (wi_cmd(sc, WI_CMD_TX|WI_RECLAIM, id)) {
+		printf(WI_PRT_FMT ": xmit failed\n", WI_PRT_ARG(sc));
+		return(EIO);
+	}
+
+	return(0);
+}
+
+STATIC void wi_stop(sc)
+	struct wi_softc		*sc;
+{
+	struct ifnet		*ifp;
+
+	if (sc->wi_gone)
+		return;
+
+	DPRINTF(WID_STOP, ("wi_stop: sc %p\n", sc));
+
+	ifp = &sc->arpcom.ac_if;
+
+	CSR_WRITE_2(sc, WI_INT_EN, 0);
+	wi_cmd(sc, WI_CMD_DISABLE|sc->wi_portnum, 0);
+
+	UNTIMEOUT(wi_inquire, sc, sc->wi_stat_ch);
+
+	ifp->if_flags &= ~(IFF_RUNNING|IFF_OACTIVE);
+
+	return;
+}
+
+STATIC void wi_watchdog(ifp)
+	struct ifnet		*ifp;
+{
+	struct wi_softc		*sc;
+
+	sc = ifp->if_softc;
+
+	printf(WI_PRT_FMT ": device timeout\n", WI_PRT_ARG(sc));
+
+	wi_init(sc);
+
+	ifp->if_oerrors++;
+
+	return;
+}
+
+#ifdef __FreeBSD__
+STATIC void wi_shutdown(howto, arg)
+	int			howto;
+#else	/* !__FreeBSD__ */
+STATIC void wi_shutdown(arg)
+#endif	/* __FreeBSD__ */
+	void			*arg;
+{
+	struct wi_softc		*sc;
+
+	sc = arg;
+	wi_stop(sc);
+
+	return;
+}
diff --git a/sys/dev/pcmcia/if_wireg.h b/sys/dev/pcmcia/if_wireg.h
new file mode 100644
index 00000000000..307e2d3225a
--- /dev/null
+++ b/sys/dev/pcmcia/if_wireg.h
@@ -0,0 +1,614 @@
+/*	$OpenBSD: if_wireg.h,v 1.1 1999/07/11 16:25:36 niklas Exp $	*/
+
+/*
+ * Copyright (c) 1997, 1998, 1999
+ *	Bill Paul <wpaul@ctr.columbia.edu>.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by Bill Paul.
+ * 4. Neither the name of the author nor the names of any co-contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *	From: if_wireg.h,v 1.4 1999/05/07 03:28:52 wpaul Exp $
+ */
+
+struct wi_counters {
+	u_int32_t		wi_tx_unicast_frames;
+	u_int32_t		wi_tx_multicast_frames;
+	u_int32_t		wi_tx_fragments;
+	u_int32_t		wi_tx_unicast_octets;
+	u_int32_t		wi_tx_multicast_octets;
+	u_int32_t		wi_tx_deferred_xmits;
+	u_int32_t		wi_tx_single_retries;
+	u_int32_t		wi_tx_multi_retries;
+	u_int32_t		wi_tx_retry_limit;
+	u_int32_t		wi_tx_discards;
+	u_int32_t		wi_rx_unicast_frames;
+	u_int32_t		wi_rx_multicast_frames;
+	u_int32_t		wi_rx_fragments;
+	u_int32_t		wi_rx_unicast_octets;
+	u_int32_t		wi_rx_multicast_octets;
+	u_int32_t		wi_rx_fcs_errors;
+	u_int32_t		wi_rx_discards_nobuf;
+	u_int32_t		wi_tx_discards_wrong_sa;
+	u_int32_t		wi_rx_WEP_cant_decrypt;
+	u_int32_t		wi_rx_msg_in_msg_frags;
+	u_int32_t		wi_rx_msg_in_bad_msg_frags;
+};
+
+struct wi_softc	{
+#ifndef __FreeBSD__
+	struct device		sc_dev;
+#endif	/* !__FreeBSD__ */
+	struct arpcom		arpcom;
+	struct ifmedia		ifmedia;
+	bus_space_handle_t	wi_bhandle;
+	bus_space_tag_t		wi_btag;
+	int			wi_tx_data_id;
+	int			wi_tx_mgmt_id;
+	int			wi_gone;
+	int			wi_if_flags;
+	u_int16_t		wi_ptype;
+	u_int16_t		wi_portnum;
+	u_int16_t		wi_max_data_len;
+	u_int16_t		wi_rts_thresh;
+	u_int16_t		wi_ap_density;
+	u_int16_t		wi_tx_rate;
+	u_int16_t		wi_create_ibss;
+	u_int16_t		wi_channel;
+	u_int16_t		wi_pm_enabled;
+	u_int16_t		wi_max_sleep;
+	char			wi_node_name[32];
+	char			wi_net_name[32];
+	char			wi_ibss_name[32];
+	u_int8_t		wi_txbuf[1536];
+	struct wi_counters	wi_stats;
+#ifdef __FreeBSD__
+	int			wi_unit;
+	struct callout_handle	wi_stat_ch;
+#else
+	void			*sc_ih;
+#endif	/* __FreeBSD__ */
+};
+
+#define WI_TIMEOUT	65536
+
+#define WI_PORT0	0
+#define WI_PORT1	1
+#define WI_PORT2	2
+#define WI_PORT3	3
+#define WI_PORT4	4
+#define WI_PORT5	5
+
+/* Default port: 0 (only 0 exists on stations) */
+#define WI_DEFAULT_PORT	(WI_PORT0 << 8)
+
+/* Default TX rate: 2Mbps, auto fallback */
+#define WI_DEFAULT_TX_RATE	3
+
+/* Default network name: ANY */
+#define WI_DEFAULT_NETNAME	"ANY"
+
+#define WI_DEFAULT_AP_DENSITY	1
+
+#define WI_DEFAULT_RTS_THRESH	2347
+	
+#define WI_DEFAULT_DATALEN	2304
+
+#define WI_DEFAULT_CREATE_IBSS	0
+
+#define WI_DEFAULT_PM_ENABLED	0
+
+#define WI_DEFAULT_MAX_SLEEP	100
+
+#ifdef __FreeBSD__
+#define WI_DEFAULT_NODENAME	"FreeBSD WaveLAN/IEEE node"
+
+#define WI_DEFAULT_IBSS		"FreeBSD IBSS"
+#else	/* !__FreeBSD__ */
+#define WI_DEFAULT_NODENAME	"WaveLAN/IEEE node"
+
+#define WI_DEFAULT_IBSS		"IBSS"
+#endif	/* __FreeBSD__ */
+
+#define WI_DEFAULT_CHAN		3
+
+/*
+ * register space access macros
+ */
+#define CSR_WRITE_4(sc, reg, val)	\
+	bus_space_write_4(sc->wi_btag, sc->wi_bhandle, reg, val)
+#define CSR_WRITE_2(sc, reg, val)	\
+	bus_space_write_2(sc->wi_btag, sc->wi_bhandle, reg, val)
+#define CSR_WRITE_1(sc, reg, val)	\
+	bus_space_write_1(sc->wi_btag, sc->wi_bhandle, reg, val)
+
+#define CSR_READ_4(sc, reg)		\
+	bus_space_read_4(sc->wi_btag, sc->wi_bhandle, reg)
+#define CSR_READ_2(sc, reg)		\
+	bus_space_read_2(sc->wi_btag, sc->wi_bhandle, reg)
+#define CSR_READ_1(sc, reg)		\
+	bus_space_read_1(sc->wi_btag, sc->wi_bhandle, reg)
+
+/*
+ * The WaveLAN/IEEE cards contain an 802.11 MAC controller which Lucent
+ * calls 'Hermes.' In typical fashion, getting documentation about this
+ * controller is about as easy as squeezing blood from a stone. Here
+ * is more or less what I know:
+ *
+ * - The Hermes controller is firmware driven, and the host interacts
+ *   with the Hermes via a firmware interface, which can change.
+ *
+ * - The Hermes is described in a document called: "Hermes Firmware
+ *   WaveLAN/IEEE Station Functions," document #010245, which of course
+ *   Lucent will not release without an NDA.
+ *
+ * - Lucent has created a library called HCF (Hardware Control Functions)
+ *   though which it wants developers to interact with the card. The HCF
+ *   is needlessly complex, ill conceived and badly documented. Actually,
+ *   the comments in the HCP code itself aren't bad, but the publically
+ *   available manual that comes with it is awful, probably due largely to
+ *   the fact that it has been emasculated in order to hide information
+ *   that Lucent wants to keep proprietary. The purpose of the HCF seems
+ *   to be to insulate the driver programmer from the Hermes itself so that
+ *   Lucent has an excuse not to release programming in for it.
+ *
+ * - Lucent only makes available documentation and code for 'HCF Light'
+ *   which is a stripped down version of HCF with certain features not
+ *   implemented, most notably support for 802.11 frames.
+ *
+ * - The HCF code which I have seen blows goats. Whoever decided to
+ *   use a 132 column format should be shot.
+ *
+ * Rather than actually use the Lucent HCF library, I have stripped all
+ * the useful information from it and used it to create a driver in the
+ * usual BSD form. Note: I don't want to hear anybody whining about the
+ * fact that the Lucent code is GPLed and mine isn't. I did not actually
+ * put any of Lucent's code in this driver: I only used it as a reference
+ * to obtain information about the underlying hardware. The Hermes
+ * programming interface is not GPLed, so bite me.
+ */
+
+/*
+ * Size of Hermes I/O space.
+ */
+#define WI_IOSIZ		0x40
+
+/*
+ * Hermes register definitions and what little I know about them.
+ */
+
+/* Hermes command/status registers. */
+#define WI_COMMAND		0x00
+#define WI_PARAM0		0x02
+#define WI_PARAM1		0x04
+#define WI_PARAM2		0x06
+#define WI_STATUS		0x08
+#define WI_RESP0		0x0A
+#define WI_RESP1		0x0C
+#define WI_RESP2		0x0E
+
+/* Command register values. */
+#define WI_CMD_BUSY		0x8000 /* busy bit */
+#define WI_CMD_INI		0x0000 /* initialize */
+#define WI_CMD_ENABLE		0x0001 /* enable */
+#define WI_CMD_DISABLE		0x0002 /* disable */
+#define WI_CMD_DIAG		0x0003
+#define WI_CMD_ALLOC_MEM	0x000A /* allocate NIC memory */
+#define WI_CMD_TX		0x000B /* transmit */
+#define WI_CMD_NOTIFY		0x0010
+#define WI_CMD_INQUIRE		0x0011
+#define WI_CMD_ACCESS		0x0021
+#define WI_CMD_PROGRAM		0x0022
+
+#define WI_CMD_CODE_MASK	0x003F
+
+/*
+ * Reclaim qualifier bit, applicable to the
+ * TX and INQUIRE commands.
+ */
+#define WI_RECLAIM		0x0100 /* reclaim NIC memory */
+
+/*
+ * ACCESS command qualifier bits.
+ */
+#define WI_ACCESS_READ		0x0000
+#define WI_ACCESS_WRITE		0x0100
+
+/*
+ * PROGRAM command qualifier bits.
+ */
+#define WI_PROGRAM_DISABLE	0x0000
+#define WI_PROGRAM_ENABLE_RAM	0x0100
+#define WI_PROGRAM_ENABLE_NVRAM	0x0200
+#define WI_PROGRAM_NVRAM	0x0300
+
+/* Status register values */
+#define WI_STAT_CMD_CODE	0x003F
+#define WI_STAT_DIAG_ERR	0x0100
+#define WI_STAT_INQ_ERR		0x0500
+#define WI_STAT_CMD_RESULT	0x7F00
+
+/* memory handle management registers */
+#define WI_INFO_FID		0x10
+#define WI_RX_FID		0x20
+#define WI_ALLOC_FID		0x22
+#define WI_TX_CMP_FID		0x24
+
+/*
+ * Buffer Access Path (BAP) registers.
+ * These are I/O channels. I believe you can use each one for
+ * any desired purpose independently of the other. In general
+ * though, we use BAP1 for reading and writing LTV records and
+ * reading received data frames, and BAP0 for writing transmit
+ * frames. This is a convention though, not a rule.
+ */
+#define WI_SEL0			0x18
+#define WI_SEL1			0x1A
+#define WI_OFF0			0x1C
+#define WI_OFF1			0x1E
+#define WI_DATA0		0x36
+#define WI_DATA1		0x38
+#define WI_BAP0			WI_DATA0
+#define WI_BAP1			WI_DATA1
+
+#define WI_OFF_BUSY		0x8000
+#define WI_OFF_ERR		0x4000
+#define WI_OFF_DATAOFF		0x0FFF
+
+/* Event registers */
+#define WI_EVENT_STAT		0x30	/* Event status */
+#define WI_INT_EN		0x32	/* Interrupt enable/disable */
+#define WI_EVENT_ACK		0x34	/* Ack event */
+
+/* Events */
+#define WI_EV_TICK		0x8000	/* aux timer tick */
+#define WI_EV_RES		0x4000	/* controller h/w error (time out) */
+#define WI_EV_INFO_DROP		0x2000	/* no RAM to build unsolicited frame */
+#define WI_EV_NO_CARD		0x0800	/* card removed (hunh?) */
+#define WI_EV_DUIF_RX		0x0400	/* wavelan management packet received */
+#define WI_EV_INFO		0x0080	/* async info frame */
+#define WI_EV_CMD		0x0010	/* command completed */
+#define WI_EV_ALLOC		0x0008	/* async alloc/reclaim completed */
+#define WI_EV_TX_EXC		0x0004	/* async xmit completed with failure */
+#define WI_EV_TX		0x0002	/* async xmit completed succesfully */
+#define WI_EV_RX		0x0001	/* async rx completed */
+
+#define WI_INTRS	\
+	(WI_EV_RX|WI_EV_TX|WI_EV_TX_EXC|WI_EV_ALLOC|WI_EV_INFO|WI_EV_INFO_DROP)
+
+/* Host software registers */
+#define WI_SW0			0x28
+#define WI_SW1			0x2A
+#define WI_SW2			0x2C
+#define WI_SW3			0x2E
+
+#define WI_CNTL			0x14
+
+#define WI_CNTL_AUX_ENA		0xC000
+#define WI_CNTL_AUX_ENA_STAT	0xC000
+#define WI_CNTL_AUX_DIS_STAT	0x0000
+#define WI_CNTL_AUX_ENA_CNTL	0x8000
+#define WI_CNTL_AUX_DIS_CNTL	0x4000
+
+#define WI_AUX_PAGE		0x3A
+#define WI_AUX_OFFSET		0x3C
+#define WI_AUX_DATA		0x3E
+
+/*
+ * One form of communication with the Hermes is with what Lucent calls
+ * LTV records, where LTV stands for Length, Type and Value. The length
+ * and type are 16 bits and are in native byte order. The value is in
+ * multiples of 16 bits and is in little endian byte order.
+ */
+struct wi_ltv_gen {
+	u_int16_t		wi_len;
+	u_int16_t		wi_type;
+	u_int16_t		wi_val;
+};
+
+struct wi_ltv_str {
+	u_int16_t		wi_len;
+	u_int16_t		wi_type;
+	u_int16_t		wi_str[17];
+};
+
+#define WI_SETVAL(recno, val)			\
+	do {					\
+		struct wi_ltv_gen	g;	\
+						\
+		g.wi_len = 2;			\
+		g.wi_type = recno;		\
+		g.wi_val = val;			\
+		wi_write_record(sc, &g);	\
+	} while (0)
+
+#define WI_SETSTR(recno, str)					\
+	do {							\
+		struct wi_ltv_str	s;			\
+		int			l;			\
+								\
+		l = (strlen(str) + 1) & ~0x1;			\
+		bzero((char *)&s, sizeof(s));			\
+		s.wi_len = (l / 2) + 2;				\
+		s.wi_type = recno;				\
+		s.wi_str[0] = strlen(str);			\
+		bcopy(str, (char *)&s.wi_str[1], strlen(str));	\
+		wi_write_record(sc, (struct wi_ltv_gen *)&s);	\
+	} while (0)
+
+/*
+ * Download buffer location and length (0xFD01).
+ */
+#define WI_RID_DNLD_BUF		0xFD01
+struct wi_ltv_dnld_buf {
+	u_int16_t		wi_len;
+	u_int16_t		wi_type;
+	u_int16_t		wi_buf_pg; /* page addr of intermediate dl buf*/
+	u_int16_t		wi_buf_off; /* offset of idb */
+	u_int16_t		wi_buf_len; /* len of idb */
+};
+
+/*
+ * Mem sizes (0xFD02).
+ */
+#define WI_RID_MEMSZ		0xFD02
+struct wi_ltv_memsz {
+	u_int16_t		wi_len;
+	u_int16_t		wi_type;
+	u_int16_t		wi_mem_ram;
+	u_int16_t		wi_mem_nvram;
+};
+
+/*
+ * List of intended regulatory domains (0xFD11).
+ */
+#define WI_RID_DOMAINS		0xFD11
+struct wi_ltv_domains {
+	u_int16_t		wi_len;
+	u_int16_t		wi_type;
+	u_int16_t		wi_domains[6];
+};
+
+/*
+ * CIS struct (0xFD13).
+ */
+#define WI_RID_CIS		0xFD13
+struct wi_ltv_cis {
+	u_int16_t		wi_len;
+	u_int16_t		wi_type;
+	u_int16_t		wi_cis[240];
+};
+
+/*
+ * Communications quality (0xFD43).
+ */
+#define WI_RID_COMMQUAL		0xFD43
+struct wi_ltv_commqual {
+	u_int16_t		wi_len;
+	u_int16_t		wi_type;
+	u_int16_t		wi_coms_qual;
+	u_int16_t		wi_sig_lvl;
+	u_int16_t		wi_noise_lvl;
+};
+
+/*
+ * Actual system scale thresholds (0xFD46).
+ */
+#define WI_RID_SYSTEM_SCALE	0xFC06
+#define WI_RID_SCALETHRESH	0xFD46
+struct wi_ltv_scalethresh {
+	u_int16_t		wi_len;
+	u_int16_t		wi_type;
+	u_int16_t		wi_energy_detect;
+	u_int16_t		wi_carrier_detect;
+	u_int16_t		wi_defer;
+	u_int16_t		wi_cell_search;
+	u_int16_t		wi_out_of_range;
+	u_int16_t		wi_delta_snr;
+};
+
+/*
+ * PCF info struct (0xFD87).
+ */
+#define WI_RID_PCF		0xFD87
+struct wi_ltv_pcf {
+	u_int16_t		wi_len;
+	u_int16_t		wi_type;
+	u_int16_t		wi_energy_detect;
+	u_int16_t		wi_carrier_detect;
+	u_int16_t		wi_defer;
+	u_int16_t		wi_cell_search;
+	u_int16_t		wi_range;
+};
+
+/*
+ * Connection control characteristics.
+ * 1 == Basic Service Set (BSS)
+ * 2 == Wireless Distribudion System (WDS)
+ * 3 == Pseudo IBSS
+ */
+#define WI_RID_PORTTYPE		0xFC00
+#define WI_PORTTYPE_BSS		0x1
+#define WI_PORTTYPE_WDS		0x2
+#define WI_PORTTYPE_ADHOC	0x3
+
+/*
+ * Mac addresses.
+ */
+#define WI_RID_MAC_NODE		0xFC01
+#define WI_RID_MAC_WDS		0xFC08
+struct wi_ltv_macaddr {
+	u_int16_t		wi_len;
+	u_int16_t		wi_type;
+	u_int16_t		wi_mac_addr[3];
+};
+
+/*
+ * Station set identification (SSID).
+ */
+#define WI_RID_DESIRED_SSID	0xFC02
+#define WI_RID_OWN_SSID		0xFC04
+struct wi_ltv_ssid {
+	u_int16_t		wi_len;
+	u_int16_t		wi_type;
+	u_int16_t		wi_id[17];
+};
+
+/*
+ * Set communications channel (radio frequency).
+ */
+#define WI_RID_OWN_CHNL		0xFC03
+
+/*
+ * Frame data size.
+ */
+#define WI_RID_MAX_DATALEN	0xFC07
+
+/*
+ * ESS power management enable
+ */
+#define WI_RID_PM_ENABLED	0xFC09
+
+/*
+ * ESS max PM sleep internal
+ */
+#define WI_RID_MAX_SLEEP	0xFC0C
+
+/*
+ * Set our station name.
+ */
+#define WI_RID_NODENAME		0xFC0E
+struct wi_ltv_nodename {
+	u_int16_t		wi_len;
+	u_int16_t		wi_type;
+	u_int16_t		wi_nodename[17];
+};
+
+/*
+ * Multicast addresses to be put in filter. We're
+ * allowed up to 16 addresses in the filter.
+ */
+#define WI_RID_MCAST		0xFC80
+struct wi_ltv_mcast {
+	u_int16_t		wi_len;
+	u_int16_t		wi_type;
+	struct ether_addr	wi_mcast[16];
+};
+
+/*
+ * Create IBSS.
+ */
+#define WI_RID_CREATE_IBSS	0xFC81
+
+#define WI_RID_FRAG_THRESH	0xFC82
+#define WI_RID_RTS_THRESH	0xFC83
+
+/*
+ * TX rate control
+ * 0 == Fixed 1mbps
+ * 1 == Fixed 2mbps
+ * 2 == auto fallback
+ */
+#define WI_RID_TX_RATE		0xFC84
+
+/*
+ * promiscuous mode.
+ */
+#define WI_RID_PROMISC		0xFC85
+
+/*
+ * Auxiliary Timer tick interval
+ */
+#define WI_RID_TICK_TIME	0xFCE0
+
+/*
+ * Information frame types.
+ */
+#define WI_INFO_NOTIFY		0xF000	/* Handover address */
+#define WI_INFO_COUNTERS	0xF100	/* Statistics counters */
+#define WI_INFO_SCAN_RESULTS	0xF101	/* Scan results */
+#define WI_INFO_LINK_STAT	0xF200	/* Link status */
+#define WI_INFO_ASSOC_STAT	0xF201	/* Association status */
+
+/*
+ * Hermes transmit/receive frame structure
+ */
+struct wi_frame {
+	u_int16_t		wi_status;	/* 0x00 */
+	u_int32_t		wi_rsvd0;	/* 0x02 */
+	u_int16_t		wi_q_info;	/* 0x06 */
+	u_int16_t		wi_rsvd1;	/* 0x08 */
+	u_int16_t		wi_tx_ctl;	/* 0x0C */
+	u_int16_t		wi_frame_ctl;	/* 0x0E */
+	u_int16_t		wi_id;		/* 0x10 */
+	u_int8_t		wi_addr1[6];	/* 0x12 */
+	u_int8_t		wi_addr2[6];	/* 0x18 */
+	u_int8_t		wi_addr3[6];	/* 0x1E */
+	u_int16_t		wi_seq_ctl;	/* 0x24 */
+	u_int8_t		wi_addr4[6];	/* 0x26 */
+	u_int16_t		wi_dat_len;	/* 0x2C */
+	u_int8_t		wi_dst_addr[6];	/* 0x2E */
+	u_int8_t		wi_src_addr[6];	/* 0x34 */
+	u_int16_t		wi_len;		/* 0x3A */
+	u_int16_t		wi_dat[3];	/* 0x3C */ /* SNAP header */
+	u_int16_t		wi_type;	/* 0x42 */
+};
+
+#define WI_802_3_OFFSET		0x2E
+#define WI_802_11_OFFSET	0x44
+#define WI_802_11_OFFSET_RAW	0x3C
+
+#define WI_STAT_BADCRC		0x0001
+#define WI_STAT_UNDECRYPTABLE	0x0002
+#define WI_STAT_ERRSTAT		0x0003
+#define WI_STAT_MAC_PORT	0x0700
+#define WI_STAT_1042		0x2000	/* RFC1042 encoded */
+#define WI_STAT_TUNNEL		0x4000	/* Bridge-tunnel encoded */
+#define WI_STAT_WMP_MSG		0x6000	/* WaveLAN-II management protocol */
+#define WI_RXSTAT_MSG_TYPE	0xE000
+
+#define WI_ENC_TX_802_3		0x00
+#define WI_ENC_TX_802_11	0x11
+#define WI_ENC_TX_E_II		0x0E
+
+#define WI_ENC_TX_1042		0x00
+#define WI_ENC_TX_TUNNEL	0xF8
+
+#define WI_TXCNTL_MACPORT	0x00FF
+#define WI_TXCNTL_STRUCTTYPE	0xFF00
+
+/*
+ * SNAP (sub-network access protocol) constants for transmission
+ * of IP datagrams over IEEE 802 networks, taken from RFC1042.
+ * We need these for the LLC/SNAP header fields in the TX/RX frame
+ * structure.
+ */
+#define WI_SNAP_K1		0xaa	/* assigned global SAP for SNAP */
+#define WI_SNAP_K2		0x00
+#define WI_SNAP_CONTROL		0x03	/* unnumbered information format */
+#define WI_SNAP_WORD0		(WI_SNAP_K1 | (WI_SNAP_K1 << 8))
+#define WI_SNAP_WORD1		(WI_SNAP_K2 | (WI_SNAP_CONTROL << 8))
+#define WI_SNAPHDR_LEN		0x6