Kernel implementation of the 4-way handshake and group-key

handshake protocols (both supplicant and authenticator state
machines) as defined in the IEEE 802.11i standard.

Software implementation of the TKIP (Temporal Key Integrity
Protocol) and CCMP (CTR with CBC-MAC Protocol) protocols.

This diff doesn't implement any of the 802.1X authentication
protocols and thus only PSK authentication (using pre-shared
keys) is currently supported.

In concrete terms, this adds support for WPA-PSK and WPA2-PSK
protocols, both in station and hostap modes.

The following drivers are marked as WPA-capable and should
work:  bwi(4), malo(4), ral(4), iwn(4), wpi(4), ural(4),
rum(4), upgt(4), and zyd(4)

The following options have been added to ifconfig(8):
wpa, wpapsk, wpaprotos, wpaakms, wpaciphers, wpagroupcipher

wpa-psk(8) can be used to generate keys from passphrases.

tested by many@
ok deraadt@

10 files changed, 77 insertions, 90 deletions

diff --git a/sys/dev/ic/acx.c b/sys/dev/ic/acx.c
index 472ccf0f90c..f385eb55c7c 100644
--- a/sys/dev/ic/acx.c
+++ b/sys/dev/ic/acx.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: acx.c,v 1.81 2008/03/13 23:07:28 brad Exp $ */
+/*	$OpenBSD: acx.c,v 1.82 2008/04/16 18:32:15 damien Exp $ */
 
 /*
  * Copyright (c) 2006 Jonathan Gray <jsg@openbsd.org>
@@ -998,10 +998,11 @@ acx_start(struct ifnet *ifp)
 
 		wh = mtod(m, struct ieee80211_frame *);
 		if ((wh->i_fc[1] & IEEE80211_FC1_WEP) && !sc->chip_hw_crypt) {
-			m = ieee80211_wep_crypt(ifp, m, 1);
-			if (m == NULL) {
+			struct ieee80211_key *k;
+
+			k = ieee80211_get_txkey(ic, wh, ni);
+			if ((m = ieee80211_encrypt(ic, m, k)) == NULL) {
 				ieee80211_release_node(ic, ni);
-				m_freem(m);
 				ifp->if_oerrors++;
 				continue;
 			}
diff --git a/sys/dev/ic/atw.c b/sys/dev/ic/atw.c
index 3525221e361..56b9ae24c6a 100644
--- a/sys/dev/ic/atw.c
+++ b/sys/dev/ic/atw.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: atw.c,v 1.56 2008/03/13 23:07:29 brad Exp $	*/
+/*	$OpenBSD: atw.c,v 1.57 2008/04/16 18:32:15 damien Exp $	*/
 /*	$NetBSD: atw.c,v 1.69 2004/07/23 07:07:55 dyoung Exp $	*/
 
 /*-
@@ -3614,6 +3614,7 @@ atw_start(struct ifnet *ifp)
 	struct ieee80211com *ic = &sc->sc_ic;
 	struct ieee80211_node *ni;
 	struct ieee80211_frame *wh;
+	struct ieee80211_key *k;
 	struct atw_frame *hh;
 	struct mbuf *m0, *m;
 	struct atw_txsoft *txs, *last_txs;
@@ -3670,8 +3671,11 @@ atw_start(struct ifnet *ifp)
 				break;
 			}
 
-			if (sc->sc_ic.ic_flags & IEEE80211_F_WEPON) {
-				if ((m0 = ieee80211_wep_crypt(ifp, m0, 1)) == NULL) {
+			if (ic->ic_flags & IEEE80211_F_WEPON) {
+				wh = mtod(m0, struct ieee80211_frame *);
+				k = ieee80211_get_txkey(ic, wh, ni);
+				m0 = ieee80211_encrypt(ic, m0, k);
+				if (m0 == NULL) {
 					ifp->if_oerrors++;
 					break;	
 				}
diff --git a/sys/dev/ic/bwi.c b/sys/dev/ic/bwi.c
index 18f2da657e4..1be7833615a 100644
--- a/sys/dev/ic/bwi.c
+++ b/sys/dev/ic/bwi.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: bwi.c,v 1.74 2008/02/25 21:13:30 mglocker Exp $	*/
+/*	$OpenBSD: bwi.c,v 1.75 2008/04/16 18:32:15 damien Exp $	*/
 
 /*
  * Copyright (c) 2007 The DragonFly Project.  All rights reserved.
@@ -864,6 +864,7 @@ bwi_attach(struct bwi_softc *sc)
 	ic->ic_caps = IEEE80211_C_SHSLOT |
 	    IEEE80211_C_SHPREAMBLE |
 	    IEEE80211_C_WEP |
+	    IEEE80211_C_RSN |
 	    IEEE80211_C_MONITOR;
 	ic->ic_state = IEEE80211_S_INIT;
 	ic->ic_opmode = IEEE80211_M_STA;
@@ -7196,6 +7197,7 @@ bwi_start(struct ifnet *ifp)
 	while (tbd->tbd_buf[idx].tb_mbuf == NULL) {
 		struct ieee80211_frame *wh;
 		struct ieee80211_node *ni;
+		struct ieee80211_key *k;
 		struct mbuf *m;
 		int mgt_pkt = 0;
 
@@ -7249,9 +7251,9 @@ bwi_start(struct ifnet *ifp)
 			bpf_mtap(ic->ic_rawbpf, m, BPF_DIRECTION_OUT);
 #endif
 		wh = mtod(m, struct ieee80211_frame *);
-		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
-			m = ieee80211_wep_crypt(ifp, m, 1);
-			if (m == NULL)
+		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
+			k = ieee80211_get_txkey(ic, wh, ni);
+			if ((m = ieee80211_encrypt(ic, m, k)) == NULL)
 				return;
 		}
 		wh = NULL;	/* Catch any invalid use */
diff --git a/sys/dev/ic/malo.c b/sys/dev/ic/malo.c
index a0a30abd071..e17cd6585cb 100644
--- a/sys/dev/ic/malo.c
+++ b/sys/dev/ic/malo.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: malo.c,v 1.81 2007/11/10 14:20:15 mglocker Exp $ */
+/*	$OpenBSD: malo.c,v 1.82 2008/04/16 18:32:15 damien Exp $ */
 
 /*
  * Copyright (c) 2006 Claudio Jeker <claudio@openbsd.org>
@@ -378,7 +378,8 @@ malo_attach(struct malo_softc *sc)
 	    IEEE80211_C_MONITOR |
 	    IEEE80211_C_SHPREAMBLE |
 	    IEEE80211_C_SHSLOT |
-	    IEEE80211_C_WEP;
+	    IEEE80211_C_WEP |
+	    IEEE80211_C_RSN;
 	ic->ic_opmode = IEEE80211_M_STA;
 	ic->ic_state = IEEE80211_S_INIT;
 	ic->ic_max_rssi = 75;
@@ -1411,15 +1412,6 @@ malo_tx_mgt(struct malo_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
 	}
 	wh = mtod(m0, struct ieee80211_frame *);
 
-	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
-		m0 = ieee80211_wep_crypt(ifp, m0, 1);
-		if (m0 == NULL)
-			return (ENOBUFS);
-
-		/* packet header may have moved, reset our local pointer */
-		wh = mtod(m0, struct ieee80211_frame *);
-	}
-
 #if NBPFILTER > 0
 	if (sc->sc_drvbpf != NULL) {
 		struct mbuf mb;
@@ -1506,6 +1498,7 @@ malo_tx_data(struct malo_softc *sc, struct mbuf *m0,
 	struct malo_tx_desc *desc;
 	struct malo_tx_data *data;
 	struct ieee80211_frame *wh;
+	struct ieee80211_key *k;
 	struct mbuf *mnew;
 	int error;
 
@@ -1524,8 +1517,8 @@ malo_tx_data(struct malo_softc *sc, struct mbuf *m0,
 	wh = mtod(m0, struct ieee80211_frame *);
 
 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
-		m0 = ieee80211_wep_crypt(ifp, m0, 1);
-		if (m0 == NULL)
+		k = ieee80211_get_txkey(ic, wh, ni);
+		if ((m0 = ieee80211_encrypt(ic, m0, k)) == NULL)
 			return (ENOBUFS);
 
 		/* packet header may have moved, reset our local pointer */
diff --git a/sys/dev/ic/pgt.c b/sys/dev/ic/pgt.c
index 4b7c9ea9866..b3da4357569 100644
--- a/sys/dev/ic/pgt.c
+++ b/sys/dev/ic/pgt.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pgt.c,v 1.47 2008/03/13 23:07:29 brad Exp $  */
+/*	$OpenBSD: pgt.c,v 1.48 2008/04/16 18:32:15 damien Exp $  */
 
 /*
  * Copyright (c) 2006 Claudio Jeker <claudio@openbsd.org>
@@ -2978,10 +2978,6 @@ pgt_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
 			ic->ic_if.if_timer = 0;
 		ic->ic_mgt_timer = 0;
 		ic->ic_flags &= ~IEEE80211_F_SIBSS;
-		if (ic->ic_wep_ctx != NULL) {
-			free(ic->ic_wep_ctx, M_DEVBUF);  
-			ic->ic_wep_ctx = NULL;
-		}
 		ieee80211_free_allnodes(ic);
 		break;
 	case IEEE80211_S_SCAN:
diff --git a/sys/dev/ic/rt2560.c b/sys/dev/ic/rt2560.c
index de3de628cb3..81bbb9f93f0 100644
--- a/sys/dev/ic/rt2560.c
+++ b/sys/dev/ic/rt2560.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rt2560.c,v 1.35 2007/11/17 14:29:11 damien Exp $  */
+/*	$OpenBSD: rt2560.c,v 1.36 2008/04/16 18:32:15 damien Exp $  */
 
 /*-
  * Copyright (c) 2005, 2006
@@ -242,7 +242,8 @@ rt2560_attach(void *xsc, int id)
 	    IEEE80211_C_TXPMGT |	/* tx power management */
 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
-	    IEEE80211_C_WEP;		/* s/w WEP */
+	    IEEE80211_C_WEP |		/* s/w WEP */
+	    IEEE80211_C_RSN;		/* WPA/RSN */
 
 	/* set supported .11b and .11g rates */
 	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
@@ -1595,7 +1596,6 @@ rt2560_tx_mgt(struct rt2560_softc *sc, struct mbuf *m0,
     struct ieee80211_node *ni)
 {
 	struct ieee80211com *ic = &sc->sc_ic;
-	struct ifnet *ifp = &ic->ic_if;
 	struct rt2560_tx_desc *desc;
 	struct rt2560_tx_data *data;
 	struct ieee80211_frame *wh;
@@ -1606,17 +1606,6 @@ rt2560_tx_mgt(struct rt2560_softc *sc, struct mbuf *m0,
 	desc = &sc->prioq.desc[sc->prioq.cur];
 	data = &sc->prioq.data[sc->prioq.cur];
 
-	wh = mtod(m0, struct ieee80211_frame *);
-
-	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
-		m0 = ieee80211_wep_crypt(ifp, m0, 1);
-		if (m0 == NULL)
-			return ENOBUFS;
-
-		/* packet header may have moved, reset our local pointer */
-		wh = mtod(m0, struct ieee80211_frame *);
-	}
-
 	error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
 	    BUS_DMA_NOWAIT);
 	if (error != 0) {
@@ -1691,11 +1680,11 @@ rt2560_tx_data(struct rt2560_softc *sc, struct mbuf *m0,
     struct ieee80211_node *ni)
 {
 	struct ieee80211com *ic = &sc->sc_ic;
-	struct ifnet *ifp = &ic->ic_if;
 	struct rt2560_tx_ring *txq = &sc->txq;
 	struct rt2560_tx_desc *desc;
 	struct rt2560_tx_data *data;
 	struct ieee80211_frame *wh;
+	struct ieee80211_key *k;
 	struct mbuf *mnew;
 	uint16_t dur;
 	uint32_t flags = 0;
@@ -1703,9 +1692,10 @@ rt2560_tx_data(struct rt2560_softc *sc, struct mbuf *m0,
 
 	wh = mtod(m0, struct ieee80211_frame *);
 
-	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
-		m0 = ieee80211_wep_crypt(ifp, m0, 1);
-		if (m0 == NULL)
+	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
+		k = ieee80211_get_txkey(ic, wh, ni);
+
+		if ((m0 = ieee80211_encrypt(ic, m0, k)) == NULL)
 			return ENOBUFS;
 
 		/* packet header may have moved, reset our local pointer */
diff --git a/sys/dev/ic/rt2661.c b/sys/dev/ic/rt2661.c
index 0cc21cd0910..04a98615465 100644
--- a/sys/dev/ic/rt2661.c
+++ b/sys/dev/ic/rt2661.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rt2661.c,v 1.40 2007/11/17 14:29:11 damien Exp $	*/
+/*	$OpenBSD: rt2661.c,v 1.41 2008/04/16 18:32:15 damien Exp $	*/
 
 /*-
  * Copyright (c) 2006
@@ -252,7 +252,8 @@ rt2661_attach(void *xsc, int id)
 	    IEEE80211_C_TXPMGT |	/* tx power management */
 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
-	    IEEE80211_C_WEP;		/* s/w WEP */
+	    IEEE80211_C_WEP |		/* s/w WEP */
+	    IEEE80211_C_RSN;		/* WPA/RSN */
 
 	if (sc->rf_rev == RT2661_RF_5225 || sc->rf_rev == RT2661_RF_5325) {
 		/* set supported .11a rates */
@@ -1442,7 +1443,6 @@ rt2661_tx_mgt(struct rt2661_softc *sc, struct mbuf *m0,
     struct ieee80211_node *ni)
 {
 	struct ieee80211com *ic = &sc->sc_ic;
-	struct ifnet *ifp = &ic->ic_if;
 	struct rt2661_tx_desc *desc;
 	struct rt2661_tx_data *data;
 	struct ieee80211_frame *wh;
@@ -1456,17 +1456,6 @@ rt2661_tx_mgt(struct rt2661_softc *sc, struct mbuf *m0,
 	/* send mgt frames at the lowest available rate */
 	rate = IEEE80211_IS_CHAN_5GHZ(ni->ni_chan) ? 12 : 2;
 
-	wh = mtod(m0, struct ieee80211_frame *);
-
-	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
-		m0 = ieee80211_wep_crypt(ifp, m0, 1);
-		if (m0 == NULL)
-			return ENOBUFS;
-
-		/* packet header may have moved, reset our local pointer */
-		wh = mtod(m0, struct ieee80211_frame *);
-	}
-
 	error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
 	    BUS_DMA_NOWAIT);
 	if (error != 0) {
@@ -1499,6 +1488,8 @@ rt2661_tx_mgt(struct rt2661_softc *sc, struct mbuf *m0,
 	data->m = m0;
 	data->ni = ni;
 
+	wh = mtod(m0, struct ieee80211_frame *);
+
 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
 		flags |= RT2661_TX_NEED_ACK;
 
@@ -1539,11 +1530,11 @@ rt2661_tx_data(struct rt2661_softc *sc, struct mbuf *m0,
     struct ieee80211_node *ni, int ac)
 {
 	struct ieee80211com *ic = &sc->sc_ic;
-	struct ifnet *ifp = &ic->ic_if;
 	struct rt2661_tx_ring *txq = &sc->txq[ac];
 	struct rt2661_tx_desc *desc;
 	struct rt2661_tx_data *data;
 	struct ieee80211_frame *wh;
+	struct ieee80211_key *k;
 	struct mbuf *mnew;
 	uint16_t dur;
 	uint32_t flags = 0;
@@ -1551,9 +1542,10 @@ rt2661_tx_data(struct rt2661_softc *sc, struct mbuf *m0,
 
 	wh = mtod(m0, struct ieee80211_frame *);
 
-	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
-		m0 = ieee80211_wep_crypt(ifp, m0, 1);
-		if (m0 == NULL)
+	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
+		k = ieee80211_get_txkey(ic, wh, ni);
+
+		if ((m0 = ieee80211_encrypt(ic, m0, k)) == NULL)
 			return ENOBUFS;
 
 		/* packet header may have moved, reset our local pointer */
diff --git a/sys/dev/ic/rt2860.c b/sys/dev/ic/rt2860.c
index 292dacacb70..82c085e6a4e 100644
--- a/sys/dev/ic/rt2860.c
+++ b/sys/dev/ic/rt2860.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rt2860.c,v 1.11 2007/12/14 21:28:49 damien Exp $	*/
+/*	$OpenBSD: rt2860.c,v 1.12 2008/04/16 18:32:15 damien Exp $	*/
 
 /*-
  * Copyright (c) 2007
@@ -127,9 +127,9 @@ void		rt2860_updateslot(struct ieee80211com *);
 void		rt2860_updateprot(struct ieee80211com *);
 void		rt2860_updateedca(struct ieee80211com *);
 int		rt2860_set_key(struct ieee80211com *, struct ieee80211_node *,
-		    const struct ieee80211_key *);
+		    struct ieee80211_key *);
 void		rt2860_delete_key(struct ieee80211com *,
-		    struct ieee80211_node *, int);
+		    struct ieee80211_node *, struct ieee80211_key *);
 int8_t		rt2860_rssi2dbm(struct rt2860_softc *, uint8_t, uint8_t);
 uint8_t		rt2860_maxrssi_chain(struct rt2860_softc *,
 		    const struct rt2860_rxwi *);
@@ -236,7 +236,8 @@ rt2860_attach(void *xsc, int id)
 	    IEEE80211_C_TXPMGT |	/* tx power management */
 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
-	    IEEE80211_C_WEP;		/* s/w WEP */
+	    IEEE80211_C_WEP |		/* s/w WEP */
+	    IEEE80211_C_RSN;		/* WPA/RSN */
 
 	if (sc->rf_rev == RT2860_RF_2750 || sc->rf_rev == RT2860_RF_2850) {
 		/* set supported .11a rates */
@@ -282,9 +283,10 @@ rt2860_attach(void *xsc, int id)
 	ic->ic_newassoc = rt2860_newassoc;
 	ic->ic_updateslot = rt2860_updateslot;
 	ic->ic_updateedca = rt2860_updateedca;
+#ifdef notyet
 	ic->ic_set_key = rt2860_set_key;
 	ic->ic_delete_key = rt2860_delete_key;
-
+#endif
 	/* override state transition machine */
 	sc->sc_newstate = ic->ic_newstate;
 	ic->ic_newstate = rt2860_newstate;
@@ -1322,12 +1324,12 @@ rt2860_tx_data(struct rt2860_softc *sc, struct mbuf *m0,
     struct ieee80211_node *ni, int qid)
 {
 	struct ieee80211com *ic = &sc->sc_ic;
-	struct ifnet *ifp = &ic->ic_if;
 	struct rt2860_tx_ring *ring = &sc->txq[qid];
 	struct rt2860_tx_data *data;
 	struct rt2860_txd *txd;
 	struct rt2860_txwi *txwi;
 	struct ieee80211_frame *wh;
+	struct ieee80211_key *k;
 	bus_dma_segment_t *seg;
 	u_int hdrlen;
 	uint16_t dur;
@@ -1356,8 +1358,9 @@ rt2860_tx_data(struct rt2860_softc *sc, struct mbuf *m0,
 	mcs = rt2860_rate2mcs(rate);
 
 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
-		m0 = ieee80211_wep_crypt(ifp, m0, 1);
-		if (m0 == NULL)
+		k = ieee80211_get_txkey(ic, wh, ni);
+
+		if ((m0 = ieee80211_encrypt(ic, m0, k)) == NULL)
 			return ENOBUFS;
 
 		/* packet header may have moved, reset our local pointer */
@@ -2098,7 +2101,7 @@ rt2860_updateedca(struct ieee80211com *ic)
 
 int
 rt2860_set_key(struct ieee80211com *ic, struct ieee80211_node *ni,
-    const struct ieee80211_key *k)
+    struct ieee80211_key *k)
 {
 	struct rt2860_softc *sc = ic->ic_softc;
 	bus_size_t base;
@@ -2127,8 +2130,7 @@ rt2860_set_key(struct ieee80211com *ic, struct ieee80211_node *ni,
 		/* install group key */
 		base = RT2860_SKEY(0, k->k_id);
 		RAL_WRITE_REGION_1(sc, base, k->k_key, k->k_len);
-		RAL_WRITE_REGION_1(sc, base + 16, k->k_txmic, 8);
-		RAL_WRITE_REGION_1(sc, base + 24, k->k_rxmic, 8);
+		/* XXX TKIP + HostAP: swap Tx/Rx MIC */
 
 		attr = RAL_READ(sc, RT2860_SKEY_MODE_0_7);
 		attr &= ~(0xf << (k->k_id * 4));
@@ -2139,8 +2141,7 @@ rt2860_set_key(struct ieee80211com *ic, struct ieee80211_node *ni,
 		wcid = RT2860_AID2WCID(ni->ni_associd);
 		base = RT2860_PKEY(wcid);
 		RAL_WRITE_REGION_1(sc, base, k->k_key, k->k_len);
-		RAL_WRITE_REGION_1(sc, base + 16, k->k_txmic, 8);
-		RAL_WRITE_REGION_1(sc, base + 24, k->k_rxmic, 8);
+		/* XXX TKIP + HostAP: swap Tx/Rx MIC */
 
 		attr = RAL_READ(sc, RT2860_WCID_ATTR(wcid));
 		attr = (attr & ~0xf) | (mode << 1) | RT2860_RX_PKEY_EN;
@@ -2150,16 +2151,17 @@ rt2860_set_key(struct ieee80211com *ic, struct ieee80211_node *ni,
 }
 
 void
-rt2860_delete_key(struct ieee80211com *ic, struct ieee80211_node *ni, int kid)
+rt2860_delete_key(struct ieee80211com *ic, struct ieee80211_node *ni,
+    struct ieee80211_key *k)
 {
 	struct rt2860_softc *sc = ic->ic_softc;
 	uint32_t attr;
 	uint8_t wcid;
 
-	if (ni == NULL) {
+	if (k->k_flags & IEEE80211_KEY_GROUP) {
 		/* remove group key */
 		attr = RAL_READ(sc, RT2860_SKEY_MODE_0_7);
-		attr &= ~(0xf << (kid * 4));
+		attr &= ~(0xf << (k->k_id * 4));
 		RAL_WRITE(sc, RT2860_SKEY_MODE_0_7, attr);
 
 	} else {
diff --git a/sys/dev/ic/rt2860reg.h b/sys/dev/ic/rt2860reg.h
index 951abe93a1f..b82baccef67 100644
--- a/sys/dev/ic/rt2860reg.h
+++ b/sys/dev/ic/rt2860reg.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rt2860reg.h,v 1.7 2007/12/14 21:28:49 damien Exp $	*/
+/*	$OpenBSD: rt2860reg.h,v 1.8 2008/04/16 18:32:15 damien Exp $	*/
 
 /*-
  * Copyright (c) 2007
@@ -842,7 +842,8 @@ struct rt2860_rxwi {
 	{ RT2860_GF40_PROT_CFG,		0x03f44084 },	\
 	{ RT2860_MM20_PROT_CFG,		0x01744004 },	\
 	{ RT2860_MM40_PROT_CFG,		0x03f54084 },	\
-	{ RT2860_TXOP_CTRL_CFG,		0x0000243f },	\
+	{ RT2860_TXOP_CTRL_CFG,		0x0000583f },	\
+	{ RT2860_TXOP_HLDR_ET,		0x00000002 },	\
 	{ RT2860_TX_RTS_CFG,		0x00092b20 },	\
 	{ RT2860_EXP_ACK_TIME,		0x002400ca }
 
diff --git a/sys/dev/ic/rtw.c b/sys/dev/ic/rtw.c
index 9ccbdf20f2f..f0071a2be4e 100644
--- a/sys/dev/ic/rtw.c
+++ b/sys/dev/ic/rtw.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rtw.c,v 1.65 2007/11/21 15:58:22 blambert Exp $	*/
+/*	$OpenBSD: rtw.c,v 1.66 2008/04/16 18:32:15 damien Exp $	*/
 /*	$NetBSD: rtw.c,v 1.29 2004/12/27 19:49:16 dyoung Exp $ */
 
 /*-
@@ -2718,18 +2718,22 @@ rtw_dequeue(struct ifnet *ifp, struct rtw_txsoft_blk **tsbp,
     struct rtw_txdesc_blk **tdbp, struct mbuf **mp,
     struct ieee80211_node **nip)
 {
+	struct ieee80211com *ic;
+	struct ieee80211_frame *wh;
+	struct ieee80211_key *k;
 	struct mbuf *m0;
 	struct rtw_softc *sc;
 	short *if_flagsp;
 
 	sc = (struct rtw_softc *)ifp->if_softc;
+	ic = &sc->sc_ic;
 
 	DPRINTF(sc, RTW_DEBUG_XMIT,
 	    ("%s: enter %s\n", sc->sc_dev.dv_xname, __func__));
 
 	if_flagsp = &ifp->if_flags;
 
-	if (sc->sc_ic.ic_state == IEEE80211_S_RUN &&
+	if (ic->ic_state == IEEE80211_S_RUN &&
 	    (*mp = rtw_80211_dequeue(sc, &sc->sc_beaconq, RTW_TXPRIBCN, tsbp,
 	    tdbp, nip, if_flagsp)) != NULL) {
 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue beacon frame\n",
@@ -2737,7 +2741,7 @@ rtw_dequeue(struct ifnet *ifp, struct rtw_txsoft_blk **tsbp,
 		return 0;
 	}
 
-	if ((*mp = rtw_80211_dequeue(sc, &sc->sc_ic.ic_mgtq, RTW_TXPRIMD, tsbp,
+	if ((*mp = rtw_80211_dequeue(sc, &ic->ic_mgtq, RTW_TXPRIMD, tsbp,
 	    tdbp, nip, if_flagsp)) != NULL) {
 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue mgt frame\n",
 		    __func__));
@@ -2749,14 +2753,14 @@ rtw_dequeue(struct ifnet *ifp, struct rtw_txsoft_blk **tsbp,
 		return 0;
 	}
 
-	if ((*mp = rtw_80211_dequeue(sc, &sc->sc_ic.ic_pwrsaveq, RTW_TXPRIHI,
+	if ((*mp = rtw_80211_dequeue(sc, &ic->ic_pwrsaveq, RTW_TXPRIHI,
 	    tsbp, tdbp, nip, if_flagsp)) != NULL) {
 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: dequeue pwrsave frame\n",
 		    __func__));
 		return 0;
 	}
 
-	if (sc->sc_ic.ic_state != IEEE80211_S_RUN) {
+	if (ic->ic_state != IEEE80211_S_RUN) {
 		DPRINTF(sc, RTW_DEBUG_XMIT, ("%s: not running\n", __func__));
 		return 0;
 	}
@@ -2797,8 +2801,10 @@ rtw_dequeue(struct ifnet *ifp, struct rtw_txsoft_blk **tsbp,
 	}
 
 	/* XXX should do WEP in hardware */
-	if (sc->sc_ic.ic_flags & IEEE80211_F_WEPON) {
-		if ((m0 = ieee80211_wep_crypt(ifp, m0, 1)) == NULL)
+	if (ic->ic_flags & IEEE80211_F_WEPON) {
+		wh = mtod(m0, struct ieee80211_frame *);
+		k = ieee80211_get_txkey(ic, wh, *nip);
+		if ((m0 = ieee80211_encrypt(ic, m0, k)) == NULL)
 			return -1;
 	}