git.oblomov.eu Git - linux-2.6/blob - drivers/net/wireless/orinoco.c

   1 /* orinoco.c - (formerly known as dldwd_cs.c and orinoco_cs.c)
   2  *
   3  * A driver for Hermes or Prism 2 chipset based PCMCIA wireless
   4  * adaptors, with Lucent/Agere, Intersil or Symbol firmware.
   5  *
   6  * Current maintainers (as of 29 September 2003) are:
   7  *      Pavel Roskin <proski AT gnu.org>
   8  * and  David Gibson <hermes AT gibson.dropbear.id.au>
   9  *
  10  * (C) Copyright David Gibson, IBM Corporation 2001-2003.
  11  * Copyright (C) 2000 David Gibson, Linuxcare Australia.
  12  *      With some help from :
  13  * Copyright (C) 2001 Jean Tourrilhes, HP Labs
  14  * Copyright (C) 2001 Benjamin Herrenschmidt
  15  *
  16  * Based on dummy_cs.c 1.27 2000/06/12 21:27:25
  17  *
  18  * Portions based on wvlan_cs.c 1.0.6, Copyright Andreas Neuhaus <andy
  19  * AT fasta.fh-dortmund.de>
  20  *      http://www.stud.fh-dortmund.de/~andy/wvlan/
  21  *
  22  * The contents of this file are subject to the Mozilla Public License
  23  * Version 1.1 (the "License"); you may not use this file except in
  24  * compliance with the License. You may obtain a copy of the License
  25  * at http://www.mozilla.org/MPL/
  26  *
  27  * Software distributed under the License is distributed on an "AS IS"
  28  * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
  29  * the License for the specific language governing rights and
  30  * limitations under the License.
  31  *
  32  * The initial developer of the original code is David A. Hinds
  33  * <dahinds AT users.sourceforge.net>.  Portions created by David
  34  * A. Hinds are Copyright (C) 1999 David A. Hinds.  All Rights
  35  * Reserved.
  36  *
  37  * Alternatively, the contents of this file may be used under the
  38  * terms of the GNU General Public License version 2 (the "GPL"), in
  39  * which case the provisions of the GPL are applicable instead of the
  40  * above.  If you wish to allow the use of your version of this file
  41  * only under the terms of the GPL and not to allow others to use your
  42  * version of this file under the MPL, indicate your decision by
  43  * deleting the provisions above and replace them with the notice and
  44  * other provisions required by the GPL.  If you do not delete the
  45  * provisions above, a recipient may use your version of this file
  46  * under either the MPL or the GPL.  */
  47
  48 /*
  49  * TODO
  50  *      o Handle de-encapsulation within network layer, provide 802.11
  51  *        headers (patch from Thomas 'Dent' Mirlacher)
  52  *      o Fix possible races in SPY handling.
  53  *      o Disconnect wireless extensions from fundamental configuration.
  54  *      o (maybe) Software WEP support (patch from Stano Meduna).
  55  *      o (maybe) Use multiple Tx buffers - driver handling queue
  56  *        rather than firmware.
  57  */
  58
  59 /* Locking and synchronization:
  60  *
  61  * The basic principle is that everything is serialized through a
  62  * single spinlock, priv->lock.  The lock is used in user, bh and irq
  63  * context, so when taken outside hardirq context it should always be
  64  * taken with interrupts disabled.  The lock protects both the
  65  * hardware and the struct orinoco_private.
  66  *
  67  * Another flag, priv->hw_unavailable indicates that the hardware is
  68  * unavailable for an extended period of time (e.g. suspended, or in
  69  * the middle of a hard reset).  This flag is protected by the
  70  * spinlock.  All code which touches the hardware should check the
  71  * flag after taking the lock, and if it is set, give up on whatever
  72  * they are doing and drop the lock again.  The orinoco_lock()
  73  * function handles this (it unlocks and returns -EBUSY if
  74  * hw_unavailable is non-zero).
  75  */
  76
  77 #define DRIVER_NAME "orinoco"
  78
  79 #include <linux/module.h>
  80 #include <linux/kernel.h>
  81 #include <linux/init.h>
  82 #include <linux/delay.h>
  83 #include <linux/netdevice.h>
  84 #include <linux/etherdevice.h>
  85 #include <linux/ethtool.h>
  86 #include <linux/firmware.h>
  87 #include <linux/if_arp.h>
  88 #include <linux/wireless.h>
  89 #include <net/iw_handler.h>
  90 #include <net/ieee80211.h>
  91
  92 #include <linux/scatterlist.h>
  93 #include <linux/crypto.h>
  94
  95 #include "hermes_rid.h"
  96 #include "hermes_dld.h"
  97 #include "orinoco.h"
  98
  99 /********************************************************************/
 100 /* Module information                                               */
 101 /********************************************************************/
 102
 103 MODULE_AUTHOR("Pavel Roskin <proski@gnu.org> & David Gibson <hermes@gibson.dropbear.id.au>");
 104 MODULE_DESCRIPTION("Driver for Lucent Orinoco, Prism II based and similar wireless cards");
 105 MODULE_LICENSE("Dual MPL/GPL");
 106
 107 /* Level of debugging. Used in the macros in orinoco.h */
 108 #ifdef ORINOCO_DEBUG
 109 int orinoco_debug = ORINOCO_DEBUG;
 110 module_param(orinoco_debug, int, 0644);
 111 MODULE_PARM_DESC(orinoco_debug, "Debug level");
 112 EXPORT_SYMBOL(orinoco_debug);
 113 #endif
 114
 115 static int suppress_linkstatus; /* = 0 */
 116 module_param(suppress_linkstatus, bool, 0644);
 117 MODULE_PARM_DESC(suppress_linkstatus, "Don't log link status changes");
 118 static int ignore_disconnect; /* = 0 */
 119 module_param(ignore_disconnect, int, 0644);
 120 MODULE_PARM_DESC(ignore_disconnect, "Don't report lost link to the network layer");
 121
 122 static int force_monitor; /* = 0 */
 123 module_param(force_monitor, int, 0644);
 124 MODULE_PARM_DESC(force_monitor, "Allow monitor mode for all firmware versions");
 125
 126 /********************************************************************/
 127 /* Compile time configuration and compatibility stuff               */
 128 /********************************************************************/
 129
 130 /* We do this this way to avoid ifdefs in the actual code */
 131 #ifdef WIRELESS_SPY
 132 #define SPY_NUMBER(priv)        (priv->spy_data.spy_number)
 133 #else
 134 #define SPY_NUMBER(priv)        0
 135 #endif /* WIRELESS_SPY */
 136
 137 /********************************************************************/
 138 /* Internal constants                                               */
 139 /********************************************************************/
 140
 141 /* 802.2 LLC/SNAP header used for Ethernet encapsulation over 802.11 */
 142 static const u8 encaps_hdr[] = {0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00};
 143 #define ENCAPS_OVERHEAD         (sizeof(encaps_hdr) + 2)
 144
 145 #define ORINOCO_MIN_MTU         256
 146 #define ORINOCO_MAX_MTU         (IEEE80211_DATA_LEN - ENCAPS_OVERHEAD)
 147
 148 #define SYMBOL_MAX_VER_LEN      (14)
 149 #define USER_BAP                0
 150 #define IRQ_BAP                 1
 151 #define MAX_IRQLOOPS_PER_IRQ    10
 152 #define MAX_IRQLOOPS_PER_JIFFY  (20000/HZ) /* Based on a guestimate of
 153                                             * how many events the
 154                                             * device could
 155                                             * legitimately generate */
 156 #define SMALL_KEY_SIZE          5
 157 #define LARGE_KEY_SIZE          13
 158 #define TX_NICBUF_SIZE_BUG      1585            /* Bug in Symbol firmware */
 159
 160 #define DUMMY_FID               0xFFFF
 161
 162 /*#define MAX_MULTICAST(priv)   (priv->firmware_type == FIRMWARE_TYPE_AGERE ? \
 163   HERMES_MAX_MULTICAST : 0)*/
 164 #define MAX_MULTICAST(priv)     (HERMES_MAX_MULTICAST)
 165
 166 #define ORINOCO_INTEN           (HERMES_EV_RX | HERMES_EV_ALLOC \
 167                                  | HERMES_EV_TX | HERMES_EV_TXEXC \
 168                                  | HERMES_EV_WTERR | HERMES_EV_INFO \
 169                                  | HERMES_EV_INFDROP )
 170
 171 #define MAX_RID_LEN 1024
 172
 173 static const struct iw_handler_def orinoco_handler_def;
 174 static const struct ethtool_ops orinoco_ethtool_ops;
 175
 176 /********************************************************************/
 177 /* Data tables                                                      */
 178 /********************************************************************/
 179
 180 /* The frequency of each channel in MHz */
 181 static const long channel_frequency[] = {
 182         2412, 2417, 2422, 2427, 2432, 2437, 2442,
 183         2447, 2452, 2457, 2462, 2467, 2472, 2484
 184 };
 185 #define NUM_CHANNELS ARRAY_SIZE(channel_frequency)
 186
 187 /* This tables gives the actual meanings of the bitrate IDs returned
 188  * by the firmware. */
 189 static struct {
 190         int bitrate; /* in 100s of kilobits */
 191         int automatic;
 192         u16 agere_txratectrl;
 193         u16 intersil_txratectrl;
 194 } bitrate_table[] = {
 195         {110, 1,  3, 15}, /* Entry 0 is the default */
 196         {10,  0,  1,  1},
 197         {10,  1,  1,  1},
 198         {20,  0,  2,  2},
 199         {20,  1,  6,  3},
 200         {55,  0,  4,  4},
 201         {55,  1,  7,  7},
 202         {110, 0,  5,  8},
 203 };
 204 #define BITRATE_TABLE_SIZE ARRAY_SIZE(bitrate_table)
 205
 206 /********************************************************************/
 207 /* Data types                                                       */
 208 /********************************************************************/
 209
 210 /* Beginning of the Tx descriptor, used in TxExc handling */
 211 struct hermes_txexc_data {
 212         struct hermes_tx_descriptor desc;
 213         __le16 frame_ctl;
 214         __le16 duration_id;
 215         u8 addr1[ETH_ALEN];
 216 } __attribute__ ((packed));
 217
 218 /* Rx frame header except compatibility 802.3 header */
 219 struct hermes_rx_descriptor {
 220         /* Control */
 221         __le16 status;
 222         __le32 time;
 223         u8 silence;
 224         u8 signal;
 225         u8 rate;
 226         u8 rxflow;
 227         __le32 reserved;
 228
 229         /* 802.11 header */
 230         __le16 frame_ctl;
 231         __le16 duration_id;
 232         u8 addr1[ETH_ALEN];
 233         u8 addr2[ETH_ALEN];
 234         u8 addr3[ETH_ALEN];
 235         __le16 seq_ctl;
 236         u8 addr4[ETH_ALEN];
 237
 238         /* Data length */
 239         __le16 data_len;
 240 } __attribute__ ((packed));
 241
 242 /********************************************************************/
 243 /* Function prototypes                                              */
 244 /********************************************************************/
 245
 246 static int __orinoco_program_rids(struct net_device *dev);
 247 static void __orinoco_set_multicast_list(struct net_device *dev);
 248
 249 /********************************************************************/
 250 /* Michael MIC crypto setup                                         */
 251 /********************************************************************/
 252 #define MICHAEL_MIC_LEN 8
 253 static int orinoco_mic_init(struct orinoco_private *priv)
 254 {
 255         priv->tx_tfm_mic = crypto_alloc_hash("michael_mic", 0, 0);
 256         if (IS_ERR(priv->tx_tfm_mic)) {
 257                 printk(KERN_DEBUG "orinoco_mic_init: could not allocate "
 258                        "crypto API michael_mic\n");
 259                 priv->tx_tfm_mic = NULL;
 260                 return -ENOMEM;
 261         }
 262
 263         priv->rx_tfm_mic = crypto_alloc_hash("michael_mic", 0, 0);
 264         if (IS_ERR(priv->rx_tfm_mic)) {
 265                 printk(KERN_DEBUG "orinoco_mic_init: could not allocate "
 266                        "crypto API michael_mic\n");
 267                 priv->rx_tfm_mic = NULL;
 268                 return -ENOMEM;
 269         }
 270
 271         return 0;
 272 }
 273
 274 static void orinoco_mic_free(struct orinoco_private *priv)
 275 {
 276         if (priv->tx_tfm_mic)
 277                 crypto_free_hash(priv->tx_tfm_mic);
 278         if (priv->rx_tfm_mic)
 279                 crypto_free_hash(priv->rx_tfm_mic);
 280 }
 281
 282 static int michael_mic(struct crypto_hash *tfm_michael, u8 *key,
 283                        u8 *da, u8 *sa, u8 priority,
 284                        u8 *data, size_t data_len, u8 *mic)
 285 {
 286         struct hash_desc desc;
 287         struct scatterlist sg[2];
 288         u8 hdr[ETH_HLEN + 2]; /* size of header + padding */
 289
 290         if (tfm_michael == NULL) {
 291                 printk(KERN_WARNING "michael_mic: tfm_michael == NULL\n");
 292                 return -1;
 293         }
 294
 295         /* Copy header into buffer. We need the padding on the end zeroed */
 296         memcpy(&hdr[0], da, ETH_ALEN);
 297         memcpy(&hdr[ETH_ALEN], sa, ETH_ALEN);
 298         hdr[ETH_ALEN*2] = priority;
 299         hdr[ETH_ALEN*2+1] = 0;
 300         hdr[ETH_ALEN*2+2] = 0;
 301         hdr[ETH_ALEN*2+3] = 0;
 302
 303         /* Use scatter gather to MIC header and data in one go */
 304         sg_init_table(sg, 2);
 305         sg_set_buf(&sg[0], hdr, sizeof(hdr));
 306         sg_set_buf(&sg[1], data, data_len);
 307
 308         if (crypto_hash_setkey(tfm_michael, key, MIC_KEYLEN))
 309                 return -1;
 310
 311         desc.tfm = tfm_michael;
 312         desc.flags = 0;
 313         return crypto_hash_digest(&desc, sg, data_len + sizeof(hdr),
 314                                   mic);
 315 }
 316
 317 /********************************************************************/
 318 /* Internal helper functions                                        */
 319 /********************************************************************/
 320
 321 static inline void set_port_type(struct orinoco_private *priv)
 322 {
 323         switch (priv->iw_mode) {
 324         case IW_MODE_INFRA:
 325                 priv->port_type = 1;
 326                 priv->createibss = 0;
 327                 break;
 328         case IW_MODE_ADHOC:
 329                 if (priv->prefer_port3) {
 330                         priv->port_type = 3;
 331                         priv->createibss = 0;
 332                 } else {
 333                         priv->port_type = priv->ibss_port;
 334                         priv->createibss = 1;
 335                 }
 336                 break;
 337         case IW_MODE_MONITOR:
 338                 priv->port_type = 3;
 339                 priv->createibss = 0;
 340                 break;
 341         default:
 342                 printk(KERN_ERR "%s: Invalid priv->iw_mode in set_port_type()\n",
 343                        priv->ndev->name);
 344         }
 345 }
 346
 347 #define ORINOCO_MAX_BSS_COUNT   64
 348 static int orinoco_bss_data_allocate(struct orinoco_private *priv)
 349 {
 350         if (priv->bss_xbss_data)
 351                 return 0;
 352
 353         if (priv->has_ext_scan)
 354                 priv->bss_xbss_data = kzalloc(ORINOCO_MAX_BSS_COUNT *
 355                                               sizeof(struct xbss_element),
 356                                               GFP_KERNEL);
 357         else
 358                 priv->bss_xbss_data = kzalloc(ORINOCO_MAX_BSS_COUNT *
 359                                               sizeof(struct bss_element),
 360                                               GFP_KERNEL);
 361
 362         if (!priv->bss_xbss_data) {
 363                 printk(KERN_WARNING "Out of memory allocating beacons");
 364                 return -ENOMEM;
 365         }
 366         return 0;
 367 }
 368
 369 static void orinoco_bss_data_free(struct orinoco_private *priv)
 370 {
 371         kfree(priv->bss_xbss_data);
 372         priv->bss_xbss_data = NULL;
 373 }
 374
 375 #define PRIV_BSS        ((struct bss_element *)priv->bss_xbss_data)
 376 #define PRIV_XBSS       ((struct xbss_element *)priv->bss_xbss_data)
 377 static void orinoco_bss_data_init(struct orinoco_private *priv)
 378 {
 379         int i;
 380
 381         INIT_LIST_HEAD(&priv->bss_free_list);
 382         INIT_LIST_HEAD(&priv->bss_list);
 383         if (priv->has_ext_scan)
 384                 for (i = 0; i < ORINOCO_MAX_BSS_COUNT; i++)
 385                         list_add_tail(&(PRIV_XBSS[i].list),
 386                                       &priv->bss_free_list);
 387         else
 388                 for (i = 0; i < ORINOCO_MAX_BSS_COUNT; i++)
 389                         list_add_tail(&(PRIV_BSS[i].list),
 390                                       &priv->bss_free_list);
 391
 392 }
 393
 394 static inline u8 *orinoco_get_ie(u8 *data, size_t len,
 395                                  enum ieee80211_mfie eid)
 396 {
 397         u8 *p = data;
 398         while ((p + 2) < (data + len)) {
 399                 if (p[0] == eid)
 400                         return p;
 401                 p += p[1] + 2;
 402         }
 403         return NULL;
 404 }
 405
 406 #define WPA_OUI_TYPE    "\x00\x50\xF2\x01"
 407 #define WPA_SELECTOR_LEN 4
 408 static inline u8 *orinoco_get_wpa_ie(u8 *data, size_t len)
 409 {
 410         u8 *p = data;
 411         while ((p + 2 + WPA_SELECTOR_LEN) < (data + len)) {
 412                 if ((p[0] == MFIE_TYPE_GENERIC) &&
 413                     (memcmp(&p[2], WPA_OUI_TYPE, WPA_SELECTOR_LEN) == 0))
 414                         return p;
 415                 p += p[1] + 2;
 416         }
 417         return NULL;
 418 }
 419
 420
 421 /********************************************************************/
 422 /* Download functionality                                           */
 423 /********************************************************************/
 424
 425 struct fw_info {
 426         char *pri_fw;
 427         char *sta_fw;
 428         char *ap_fw;
 429         u32 pda_addr;
 430         u16 pda_size;
 431 };
 432
 433 const static struct fw_info orinoco_fw[] = {
 434         { "", "agere_sta_fw.bin", "agere_ap_fw.bin", 0x00390000, 1000 },
 435         { "", "prism_sta_fw.bin", "prism_ap_fw.bin", 0, 1024 },
 436         { "symbol_sp24t_prim_fw", "symbol_sp24t_sec_fw", "", 0x00003100, 512 }
 437 };
 438
 439 /* Structure used to access fields in FW
 440  * Make sure LE decoding macros are used
 441  */
 442 struct orinoco_fw_header {
 443         char hdr_vers[6];       /* ASCII string for header version */
 444         __le16 headersize;      /* Total length of header */
 445         __le32 entry_point;     /* NIC entry point */
 446         __le32 blocks;          /* Number of blocks to program */
 447         __le32 block_offset;    /* Offset of block data from eof header */
 448         __le32 pdr_offset;      /* Offset to PDR data from eof header */
 449         __le32 pri_offset;      /* Offset to primary plug data */
 450         __le32 compat_offset;   /* Offset to compatibility data*/
 451         char signature[0];      /* FW signature length headersize-20 */
 452 } __attribute__ ((packed));
 453
 454 /* Download either STA or AP firmware into the card. */
 455 static int
 456 orinoco_dl_firmware(struct orinoco_private *priv,
 457                     const struct fw_info *fw,
 458                     int ap)
 459 {
 460         /* Plug Data Area (PDA) */
 461         __le16 *pda;
 462
 463         hermes_t *hw = &priv->hw;
 464         const struct firmware *fw_entry;
 465         const struct orinoco_fw_header *hdr;
 466         const unsigned char *first_block;
 467         const unsigned char *end;
 468         const char *firmware;
 469         struct net_device *dev = priv->ndev;
 470         int err = 0;
 471
 472         pda = kzalloc(fw->pda_size, GFP_KERNEL);
 473         if (!pda)
 474                 return -ENOMEM;
 475
 476         if (ap)
 477                 firmware = fw->ap_fw;
 478         else
 479                 firmware = fw->sta_fw;
 480
 481         printk(KERN_DEBUG "%s: Attempting to download firmware %s\n",
 482                dev->name, firmware);
 483
 484         /* Read current plug data */
 485         err = hermes_read_pda(hw, pda, fw->pda_addr, fw->pda_size, 0);
 486         printk(KERN_DEBUG "%s: Read PDA returned %d\n", dev->name, err);
 487         if (err)
 488                 goto free;
 489
 490         if (priv->cached_fw)
 491                 fw_entry = priv->cached_fw;
 492         else {
 493                 err = request_firmware(&fw_entry, firmware, priv->dev);
 494                 if (err) {
 495                         printk(KERN_ERR "%s: Cannot find firmware %s\n",
 496                                dev->name, firmware);
 497                         err = -ENOENT;
 498                         goto free;
 499                 }
 500                 priv->cached_fw = fw_entry;
 501         }
 502
 503         hdr = (const struct orinoco_fw_header *) fw_entry->data;
 504
 505         /* Enable aux port to allow programming */
 506         err = hermesi_program_init(hw, le32_to_cpu(hdr->entry_point));
 507         printk(KERN_DEBUG "%s: Program init returned %d\n", dev->name, err);
 508         if (err != 0)
 509                 goto abort;
 510
 511         /* Program data */
 512         first_block = (fw_entry->data +
 513                        le16_to_cpu(hdr->headersize) +
 514                        le32_to_cpu(hdr->block_offset));
 515         end = fw_entry->data + fw_entry->size;
 516
 517         err = hermes_program(hw, first_block, end);
 518         printk(KERN_DEBUG "%s: Program returned %d\n", dev->name, err);
 519         if (err != 0)
 520                 goto abort;
 521
 522         /* Update production data */
 523         first_block = (fw_entry->data +
 524                        le16_to_cpu(hdr->headersize) +
 525                        le32_to_cpu(hdr->pdr_offset));
 526
 527         err = hermes_apply_pda_with_defaults(hw, first_block, pda);
 528         printk(KERN_DEBUG "%s: Apply PDA returned %d\n", dev->name, err);
 529         if (err)
 530                 goto abort;
 531
 532         /* Tell card we've finished */
 533         err = hermesi_program_end(hw);
 534         printk(KERN_DEBUG "%s: Program end returned %d\n", dev->name, err);
 535         if (err != 0)
 536                 goto abort;
 537
 538         /* Check if we're running */
 539         printk(KERN_DEBUG "%s: hermes_present returned %d\n",
 540                dev->name, hermes_present(hw));
 541
 542 abort:
 543         /* In case of error, assume firmware was bogus and release it */
 544         if (err) {
 545                 priv->cached_fw = NULL;
 546                 release_firmware(fw_entry);
 547         }
 548
 549 free:
 550         kfree(pda);
 551         return err;
 552 }
 553
 554 /* End markers */
 555 #define TEXT_END        0x1A            /* End of text header */
 556
 557 /*
 558  * Process a firmware image - stop the card, load the firmware, reset
 559  * the card and make sure it responds.  For the secondary firmware take
 560  * care of the PDA - read it and then write it on top of the firmware.
 561  */
 562 static int
 563 symbol_dl_image(struct orinoco_private *priv, const struct fw_info *fw,
 564                 const unsigned char *image, const unsigned char *end,
 565                 int secondary)
 566 {
 567         hermes_t *hw = &priv->hw;
 568         int ret = 0;
 569         const unsigned char *ptr;
 570         const unsigned char *first_block;
 571
 572         /* Plug Data Area (PDA) */
 573         __le16 *pda = NULL;
 574
 575         /* Binary block begins after the 0x1A marker */
 576         ptr = image;
 577         while (*ptr++ != TEXT_END);
 578         first_block = ptr;
 579
 580         /* Read the PDA from EEPROM */
 581         if (secondary) {
 582                 pda = kzalloc(fw->pda_size, GFP_KERNEL);
 583                 if (!pda)
 584                         return -ENOMEM;
 585
 586                 ret = hermes_read_pda(hw, pda, fw->pda_addr, fw->pda_size, 1);
 587                 if (ret)
 588                         goto free;
 589         }
 590
 591         /* Stop the firmware, so that it can be safely rewritten */
 592         if (priv->stop_fw) {
 593                 ret = priv->stop_fw(priv, 1);
 594                 if (ret)
 595                         goto free;
 596         }
 597
 598         /* Program the adapter with new firmware */
 599         ret = hermes_program(hw, first_block, end);
 600         if (ret)
 601                 goto free;
 602
 603         /* Write the PDA to the adapter */
 604         if (secondary) {
 605                 size_t len = hermes_blocks_length(first_block);
 606                 ptr = first_block + len;
 607                 ret = hermes_apply_pda(hw, ptr, pda);
 608                 kfree(pda);
 609                 if (ret)
 610                         return ret;
 611         }
 612
 613         /* Run the firmware */
 614         if (priv->stop_fw) {
 615                 ret = priv->stop_fw(priv, 0);
 616                 if (ret)
 617                         return ret;
 618         }
 619
 620         /* Reset hermes chip and make sure it responds */
 621         ret = hermes_init(hw);
 622
 623         /* hermes_reset() should return 0 with the secondary firmware */
 624         if (secondary && ret != 0)
 625                 return -ENODEV;
 626
 627         /* And this should work with any firmware */
 628         if (!hermes_present(hw))
 629                 return -ENODEV;
 630
 631         return 0;
 632
 633 free:
 634         kfree(pda);
 635         return ret;
 636 }
 637
 638
 639 /*
 640  * Download the firmware into the card, this also does a PCMCIA soft
 641  * reset on the card, to make sure it's in a sane state.
 642  */
 643 static int
 644 symbol_dl_firmware(struct orinoco_private *priv,
 645                    const struct fw_info *fw)
 646 {
 647         struct net_device *dev = priv->ndev;
 648         int ret;
 649         const struct firmware *fw_entry;
 650
 651         if (request_firmware(&fw_entry, fw->pri_fw,
 652                              priv->dev) != 0) {
 653                 printk(KERN_ERR "%s: Cannot find firmware: %s\n",
 654                        dev->name, fw->pri_fw);
 655                 return -ENOENT;
 656         }
 657
 658         /* Load primary firmware */
 659         ret = symbol_dl_image(priv, fw, fw_entry->data,
 660                               fw_entry->data + fw_entry->size, 0);
 661         release_firmware(fw_entry);
 662         if (ret) {
 663                 printk(KERN_ERR "%s: Primary firmware download failed\n",
 664                        dev->name);
 665                 return ret;
 666         }
 667
 668         if (request_firmware(&fw_entry, fw->sta_fw,
 669                              priv->dev) != 0) {
 670                 printk(KERN_ERR "%s: Cannot find firmware: %s\n",
 671                        dev->name, fw->sta_fw);
 672                 return -ENOENT;
 673         }
 674
 675         /* Load secondary firmware */
 676         ret = symbol_dl_image(priv, fw, fw_entry->data,
 677                               fw_entry->data + fw_entry->size, 1);
 678         release_firmware(fw_entry);
 679         if (ret) {
 680                 printk(KERN_ERR "%s: Secondary firmware download failed\n",
 681                        dev->name);
 682         }
 683
 684         return ret;
 685 }
 686
 687 static int orinoco_download(struct orinoco_private *priv)
 688 {
 689         int err = 0;
 690         /* Reload firmware */
 691         switch (priv->firmware_type) {
 692         case FIRMWARE_TYPE_AGERE:
 693                 /* case FIRMWARE_TYPE_INTERSIL: */
 694                 err = orinoco_dl_firmware(priv,
 695                                           &orinoco_fw[priv->firmware_type], 0);
 696                 break;
 697
 698         case FIRMWARE_TYPE_SYMBOL:
 699                 err = symbol_dl_firmware(priv,
 700                                          &orinoco_fw[priv->firmware_type]);
 701                 break;
 702         case FIRMWARE_TYPE_INTERSIL:
 703                 break;
 704         }
 705         /* TODO: if we fail we probably need to reinitialise
 706          * the driver */
 707
 708         return err;
 709 }
 710
 711 /********************************************************************/
 712 /* Device methods                                                   */
 713 /********************************************************************/
 714
 715 static int orinoco_open(struct net_device *dev)
 716 {
 717         struct orinoco_private *priv = netdev_priv(dev);
 718         unsigned long flags;
 719         int err;
 720
 721         if (orinoco_lock(priv, &flags) != 0)
 722                 return -EBUSY;
 723
 724         err = __orinoco_up(dev);
 725
 726         if (! err)
 727                 priv->open = 1;
 728
 729         orinoco_unlock(priv, &flags);
 730
 731         return err;
 732 }
 733
 734 static int orinoco_stop(struct net_device *dev)
 735 {
 736         struct orinoco_private *priv = netdev_priv(dev);
 737         int err = 0;
 738
 739         /* We mustn't use orinoco_lock() here, because we need to be
 740            able to close the interface even if hw_unavailable is set
 741            (e.g. as we're released after a PC Card removal) */
 742         spin_lock_irq(&priv->lock);
 743
 744         priv->open = 0;
 745
 746         err = __orinoco_down(dev);
 747
 748         spin_unlock_irq(&priv->lock);
 749
 750         return err;
 751 }
 752
 753 static struct net_device_stats *orinoco_get_stats(struct net_device *dev)
 754 {
 755         struct orinoco_private *priv = netdev_priv(dev);
 756
 757         return &priv->stats;
 758 }
 759
 760 static struct iw_statistics *orinoco_get_wireless_stats(struct net_device *dev)
 761 {
 762         struct orinoco_private *priv = netdev_priv(dev);
 763         hermes_t *hw = &priv->hw;
 764         struct iw_statistics *wstats = &priv->wstats;
 765         int err;
 766         unsigned long flags;
 767
 768         if (! netif_device_present(dev)) {
 769                 printk(KERN_WARNING "%s: get_wireless_stats() called while device not present\n",
 770                        dev->name);
 771                 return NULL; /* FIXME: Can we do better than this? */
 772         }
 773
 774         /* If busy, return the old stats.  Returning NULL may cause
 775          * the interface to disappear from /proc/net/wireless */
 776         if (orinoco_lock(priv, &flags) != 0)
 777                 return wstats;
 778
 779         /* We can't really wait for the tallies inquiry command to
 780          * complete, so we just use the previous results and trigger
 781          * a new tallies inquiry command for next time - Jean II */
 782         /* FIXME: Really we should wait for the inquiry to come back -
 783          * as it is the stats we give don't make a whole lot of sense.
 784          * Unfortunately, it's not clear how to do that within the
 785          * wireless extensions framework: I think we're in user
 786          * context, but a lock seems to be held by the time we get in
 787          * here so we're not safe to sleep here. */
 788         hermes_inquire(hw, HERMES_INQ_TALLIES);
 789
 790         if (priv->iw_mode == IW_MODE_ADHOC) {
 791                 memset(&wstats->qual, 0, sizeof(wstats->qual));
 792                 /* If a spy address is defined, we report stats of the
 793                  * first spy address - Jean II */
 794                 if (SPY_NUMBER(priv)) {
 795                         wstats->qual.qual = priv->spy_data.spy_stat[0].qual;
 796                         wstats->qual.level = priv->spy_data.spy_stat[0].level;
 797                         wstats->qual.noise = priv->spy_data.spy_stat[0].noise;
 798                         wstats->qual.updated = priv->spy_data.spy_stat[0].updated;
 799                 }
 800         } else {
 801                 struct {
 802                         __le16 qual, signal, noise, unused;
 803                 } __attribute__ ((packed)) cq;
 804
 805                 err = HERMES_READ_RECORD(hw, USER_BAP,
 806                                          HERMES_RID_COMMSQUALITY, &cq);
 807
 808                 if (!err) {
 809                         wstats->qual.qual = (int)le16_to_cpu(cq.qual);
 810                         wstats->qual.level = (int)le16_to_cpu(cq.signal) - 0x95;
 811                         wstats->qual.noise = (int)le16_to_cpu(cq.noise) - 0x95;
 812                         wstats->qual.updated = 7;
 813                 }
 814         }
 815
 816         orinoco_unlock(priv, &flags);
 817         return wstats;
 818 }
 819
 820 static void orinoco_set_multicast_list(struct net_device *dev)
 821 {
 822         struct orinoco_private *priv = netdev_priv(dev);
 823         unsigned long flags;
 824
 825         if (orinoco_lock(priv, &flags) != 0) {
 826                 printk(KERN_DEBUG "%s: orinoco_set_multicast_list() "
 827                        "called when hw_unavailable\n", dev->name);
 828                 return;
 829         }
 830
 831         __orinoco_set_multicast_list(dev);
 832         orinoco_unlock(priv, &flags);
 833 }
 834
 835 static int orinoco_change_mtu(struct net_device *dev, int new_mtu)
 836 {
 837         struct orinoco_private *priv = netdev_priv(dev);
 838
 839         if ( (new_mtu < ORINOCO_MIN_MTU) || (new_mtu > ORINOCO_MAX_MTU) )
 840                 return -EINVAL;
 841
 842         if ( (new_mtu + ENCAPS_OVERHEAD + IEEE80211_HLEN) >
 843              (priv->nicbuf_size - ETH_HLEN) )
 844                 return -EINVAL;
 845
 846         dev->mtu = new_mtu;
 847
 848         return 0;
 849 }
 850
 851 /********************************************************************/
 852 /* Tx path                                                          */
 853 /********************************************************************/
 854
 855 static int orinoco_xmit(struct sk_buff *skb, struct net_device *dev)
 856 {
 857         struct orinoco_private *priv = netdev_priv(dev);
 858         struct net_device_stats *stats = &priv->stats;
 859         hermes_t *hw = &priv->hw;
 860         int err = 0;
 861         u16 txfid = priv->txfid;
 862         struct ethhdr *eh;
 863         int tx_control;
 864         unsigned long flags;
 865
 866         if (! netif_running(dev)) {
 867                 printk(KERN_ERR "%s: Tx on stopped device!\n",
 868                        dev->name);
 869                 return NETDEV_TX_BUSY;
 870         }
 871
 872         if (netif_queue_stopped(dev)) {
 873                 printk(KERN_DEBUG "%s: Tx while transmitter busy!\n",
 874                        dev->name);
 875                 return NETDEV_TX_BUSY;
 876         }
 877
 878         if (orinoco_lock(priv, &flags) != 0) {
 879                 printk(KERN_ERR "%s: orinoco_xmit() called while hw_unavailable\n",
 880                        dev->name);
 881                 return NETDEV_TX_BUSY;
 882         }
 883
 884         if (! netif_carrier_ok(dev) || (priv->iw_mode == IW_MODE_MONITOR)) {
 885                 /* Oops, the firmware hasn't established a connection,
 886                    silently drop the packet (this seems to be the
 887                    safest approach). */
 888                 goto drop;
 889         }
 890
 891         /* Check packet length */
 892         if (skb->len < ETH_HLEN)
 893                 goto drop;
 894
 895         tx_control = HERMES_TXCTRL_TX_OK | HERMES_TXCTRL_TX_EX;
 896
 897         if (priv->encode_alg == IW_ENCODE_ALG_TKIP)
 898                 tx_control |= (priv->tx_key << HERMES_MIC_KEY_ID_SHIFT) |
 899                         HERMES_TXCTRL_MIC;
 900
 901         if (priv->has_alt_txcntl) {
 902                 /* WPA enabled firmwares have tx_cntl at the end of
 903                  * the 802.11 header.  So write zeroed descriptor and
 904                  * 802.11 header at the same time
 905                  */
 906                 char desc[HERMES_802_3_OFFSET];
 907                 __le16 *txcntl = (__le16 *) &desc[HERMES_TXCNTL2_OFFSET];
 908
 909                 memset(&desc, 0, sizeof(desc));
 910
 911                 *txcntl = cpu_to_le16(tx_control);
 912                 err = hermes_bap_pwrite(hw, USER_BAP, &desc, sizeof(desc),
 913                                         txfid, 0);
 914                 if (err) {
 915                         if (net_ratelimit())
 916                                 printk(KERN_ERR "%s: Error %d writing Tx "
 917                                        "descriptor to BAP\n", dev->name, err);
 918                         goto busy;
 919                 }
 920         } else {
 921                 struct hermes_tx_descriptor desc;
 922
 923                 memset(&desc, 0, sizeof(desc));
 924
 925                 desc.tx_control = cpu_to_le16(tx_control);
 926                 err = hermes_bap_pwrite(hw, USER_BAP, &desc, sizeof(desc),
 927                                         txfid, 0);
 928                 if (err) {
 929                         if (net_ratelimit())
 930                                 printk(KERN_ERR "%s: Error %d writing Tx "
 931                                        "descriptor to BAP\n", dev->name, err);
 932                         goto busy;
 933                 }
 934
 935                 /* Clear the 802.11 header and data length fields - some
 936                  * firmwares (e.g. Lucent/Agere 8.xx) appear to get confused
 937                  * if this isn't done. */
 938                 hermes_clear_words(hw, HERMES_DATA0,
 939                                    HERMES_802_3_OFFSET - HERMES_802_11_OFFSET);
 940         }
 941
 942         eh = (struct ethhdr *)skb->data;
 943
 944         /* Encapsulate Ethernet-II frames */
 945         if (ntohs(eh->h_proto) > ETH_DATA_LEN) { /* Ethernet-II frame */
 946                 struct header_struct {
 947                         struct ethhdr eth;      /* 802.3 header */
 948                         u8 encap[6];            /* 802.2 header */
 949                 } __attribute__ ((packed)) hdr;
 950
 951                 /* Strip destination and source from the data */
 952                 skb_pull(skb, 2 * ETH_ALEN);
 953
 954                 /* And move them to a separate header */
 955                 memcpy(&hdr.eth, eh, 2 * ETH_ALEN);
 956                 hdr.eth.h_proto = htons(sizeof(encaps_hdr) + skb->len);
 957                 memcpy(hdr.encap, encaps_hdr, sizeof(encaps_hdr));
 958
 959                 /* Insert the SNAP header */
 960                 if (skb_headroom(skb) < sizeof(hdr)) {
 961                         printk(KERN_ERR
 962                                "%s: Not enough headroom for 802.2 headers %d\n",
 963                                dev->name, skb_headroom(skb));
 964                         goto drop;
 965                 }
 966                 eh = (struct ethhdr *) skb_push(skb, sizeof(hdr));
 967                 memcpy(eh, &hdr, sizeof(hdr));
 968         }
 969
 970         err = hermes_bap_pwrite(hw, USER_BAP, skb->data, skb->len,
 971                                 txfid, HERMES_802_3_OFFSET);
 972         if (err) {
 973                 printk(KERN_ERR "%s: Error %d writing packet to BAP\n",
 974                        dev->name, err);
 975                 goto busy;
 976         }
 977
 978         /* Calculate Michael MIC */
 979         if (priv->encode_alg == IW_ENCODE_ALG_TKIP) {
 980                 u8 mic_buf[MICHAEL_MIC_LEN + 1];
 981                 u8 *mic;
 982                 size_t offset;
 983                 size_t len;
 984
 985                 if (skb->len % 2) {
 986                         /* MIC start is on an odd boundary */
 987                         mic_buf[0] = skb->data[skb->len - 1];
 988                         mic = &mic_buf[1];
 989                         offset = skb->len - 1;
 990                         len = MICHAEL_MIC_LEN + 1;
 991                 } else {
 992                         mic = &mic_buf[0];
 993                         offset = skb->len;
 994                         len = MICHAEL_MIC_LEN;
 995                 }
 996
 997                 michael_mic(priv->tx_tfm_mic,
 998                             priv->tkip_key[priv->tx_key].tx_mic,
 999                             eh->h_dest, eh->h_source, 0 /* priority */,
1000                             skb->data + ETH_HLEN, skb->len - ETH_HLEN, mic);
1001
1002                 /* Write the MIC */
1003                 err = hermes_bap_pwrite(hw, USER_BAP, &mic_buf[0], len,
1004                                         txfid, HERMES_802_3_OFFSET + offset);
1005                 if (err) {
1006                         printk(KERN_ERR "%s: Error %d writing MIC to BAP\n",
1007                                dev->name, err);
1008                         goto busy;
1009                 }
1010         }
1011
1012         /* Finally, we actually initiate the send */
1013         netif_stop_queue(dev);
1014
1015         err = hermes_docmd_wait(hw, HERMES_CMD_TX | HERMES_CMD_RECL,
1016                                 txfid, NULL);
1017         if (err) {
1018                 netif_start_queue(dev);
1019                 if (net_ratelimit())
1020                         printk(KERN_ERR "%s: Error %d transmitting packet\n",
1021                                 dev->name, err);
1022                 goto busy;
1023         }
1024
1025         dev->trans_start = jiffies;
1026         stats->tx_bytes += HERMES_802_3_OFFSET + skb->len;
1027         goto ok;
1028
1029  drop:
1030         stats->tx_errors++;
1031         stats->tx_dropped++;
1032
1033  ok:
1034         orinoco_unlock(priv, &flags);
1035         dev_kfree_skb(skb);
1036         return NETDEV_TX_OK;
1037
1038  busy:
1039         if (err == -EIO)
1040                 schedule_work(&priv->reset_work);
1041         orinoco_unlock(priv, &flags);
1042         return NETDEV_TX_BUSY;
1043 }
1044
1045 static void __orinoco_ev_alloc(struct net_device *dev, hermes_t *hw)
1046 {
1047         struct orinoco_private *priv = netdev_priv(dev);
1048         u16 fid = hermes_read_regn(hw, ALLOCFID);
1049
1050         if (fid != priv->txfid) {
1051                 if (fid != DUMMY_FID)
1052                         printk(KERN_WARNING "%s: Allocate event on unexpected fid (%04X)\n",
1053                                dev->name, fid);
1054                 return;
1055         }
1056
1057         hermes_write_regn(hw, ALLOCFID, DUMMY_FID);
1058 }
1059
1060 static void __orinoco_ev_tx(struct net_device *dev, hermes_t *hw)
1061 {
1062         struct orinoco_private *priv = netdev_priv(dev);
1063         struct net_device_stats *stats = &priv->stats;
1064
1065         stats->tx_packets++;
1066
1067         netif_wake_queue(dev);
1068
1069         hermes_write_regn(hw, TXCOMPLFID, DUMMY_FID);
1070 }
1071
1072 static void __orinoco_ev_txexc(struct net_device *dev, hermes_t *hw)
1073 {
1074         struct orinoco_private *priv = netdev_priv(dev);
1075         struct net_device_stats *stats = &priv->stats;
1076         u16 fid = hermes_read_regn(hw, TXCOMPLFID);
1077         u16 status;
1078         struct hermes_txexc_data hdr;
1079         int err = 0;
1080
1081         if (fid == DUMMY_FID)
1082                 return; /* Nothing's really happened */
1083
1084         /* Read part of the frame header - we need status and addr1 */
1085         err = hermes_bap_pread(hw, IRQ_BAP, &hdr,
1086                                sizeof(struct hermes_txexc_data),
1087                                fid, 0);
1088
1089         hermes_write_regn(hw, TXCOMPLFID, DUMMY_FID);
1090         stats->tx_errors++;
1091
1092         if (err) {
1093                 printk(KERN_WARNING "%s: Unable to read descriptor on Tx error "
1094                        "(FID=%04X error %d)\n",
1095                        dev->name, fid, err);
1096                 return;
1097         }
1098
1099         DEBUG(1, "%s: Tx error, err %d (FID=%04X)\n", dev->name,
1100               err, fid);
1101
1102         /* We produce a TXDROP event only for retry or lifetime
1103          * exceeded, because that's the only status that really mean
1104          * that this particular node went away.
1105          * Other errors means that *we* screwed up. - Jean II */
1106         status = le16_to_cpu(hdr.desc.status);
1107         if (status & (HERMES_TXSTAT_RETRYERR | HERMES_TXSTAT_AGEDERR)) {
1108                 union iwreq_data        wrqu;
1109
1110                 /* Copy 802.11 dest address.
1111                  * We use the 802.11 header because the frame may
1112                  * not be 802.3 or may be mangled...
1113                  * In Ad-Hoc mode, it will be the node address.
1114                  * In managed mode, it will be most likely the AP addr
1115                  * User space will figure out how to convert it to
1116                  * whatever it needs (IP address or else).
1117                  * - Jean II */
1118                 memcpy(wrqu.addr.sa_data, hdr.addr1, ETH_ALEN);
1119                 wrqu.addr.sa_family = ARPHRD_ETHER;
1120
1121                 /* Send event to user space */
1122                 wireless_send_event(dev, IWEVTXDROP, &wrqu, NULL);
1123         }
1124
1125         netif_wake_queue(dev);
1126 }
1127
1128 static void orinoco_tx_timeout(struct net_device *dev)
1129 {
1130         struct orinoco_private *priv = netdev_priv(dev);
1131         struct net_device_stats *stats = &priv->stats;
1132         struct hermes *hw = &priv->hw;
1133
1134         printk(KERN_WARNING "%s: Tx timeout! "
1135                "ALLOCFID=%04x, TXCOMPLFID=%04x, EVSTAT=%04x\n",
1136                dev->name, hermes_read_regn(hw, ALLOCFID),
1137                hermes_read_regn(hw, TXCOMPLFID), hermes_read_regn(hw, EVSTAT));
1138
1139         stats->tx_errors++;
1140
1141         schedule_work(&priv->reset_work);
1142 }
1143
1144 /********************************************************************/
1145 /* Rx path (data frames)                                            */
1146 /********************************************************************/
1147
1148 /* Does the frame have a SNAP header indicating it should be
1149  * de-encapsulated to Ethernet-II? */
1150 static inline int is_ethersnap(void *_hdr)
1151 {
1152         u8 *hdr = _hdr;
1153
1154         /* We de-encapsulate all packets which, a) have SNAP headers
1155          * (i.e. SSAP=DSAP=0xaa and CTRL=0x3 in the 802.2 LLC header
1156          * and where b) the OUI of the SNAP header is 00:00:00 or
1157          * 00:00:f8 - we need both because different APs appear to use
1158          * different OUIs for some reason */
1159         return (memcmp(hdr, &encaps_hdr, 5) == 0)
1160                 && ( (hdr[5] == 0x00) || (hdr[5] == 0xf8) );
1161 }
1162
1163 static inline void orinoco_spy_gather(struct net_device *dev, u_char *mac,
1164                                       int level, int noise)
1165 {
1166         struct iw_quality wstats;
1167         wstats.level = level - 0x95;
1168         wstats.noise = noise - 0x95;
1169         wstats.qual = (level > noise) ? (level - noise) : 0;
1170         wstats.updated = 7;
1171         /* Update spy records */
1172         wireless_spy_update(dev, mac, &wstats);
1173 }
1174
1175 static void orinoco_stat_gather(struct net_device *dev,
1176                                 struct sk_buff *skb,
1177                                 struct hermes_rx_descriptor *desc)
1178 {
1179         struct orinoco_private *priv = netdev_priv(dev);
1180
1181         /* Using spy support with lots of Rx packets, like in an
1182          * infrastructure (AP), will really slow down everything, because
1183          * the MAC address must be compared to each entry of the spy list.
1184          * If the user really asks for it (set some address in the
1185          * spy list), we do it, but he will pay the price.
1186          * Note that to get here, you need both WIRELESS_SPY
1187          * compiled in AND some addresses in the list !!!
1188          */
1189         /* Note : gcc will optimise the whole section away if
1190          * WIRELESS_SPY is not defined... - Jean II */
1191         if (SPY_NUMBER(priv)) {
1192                 orinoco_spy_gather(dev, skb_mac_header(skb) + ETH_ALEN,
1193                                    desc->signal, desc->silence);
1194         }
1195 }
1196
1197 /*
1198  * orinoco_rx_monitor - handle received monitor frames.
1199  *
1200  * Arguments:
1201  *      dev             network device
1202  *      rxfid           received FID
1203  *      desc            rx descriptor of the frame
1204  *
1205  * Call context: interrupt
1206  */
1207 static void orinoco_rx_monitor(struct net_device *dev, u16 rxfid,
1208                                struct hermes_rx_descriptor *desc)
1209 {
1210         u32 hdrlen = 30;        /* return full header by default */
1211         u32 datalen = 0;
1212         u16 fc;
1213         int err;
1214         int len;
1215         struct sk_buff *skb;
1216         struct orinoco_private *priv = netdev_priv(dev);
1217         struct net_device_stats *stats = &priv->stats;
1218         hermes_t *hw = &priv->hw;
1219
1220         len = le16_to_cpu(desc->data_len);
1221
1222         /* Determine the size of the header and the data */
1223         fc = le16_to_cpu(desc->frame_ctl);
1224         switch (fc & IEEE80211_FCTL_FTYPE) {
1225         case IEEE80211_FTYPE_DATA:
1226                 if ((fc & IEEE80211_FCTL_TODS)
1227                     && (fc & IEEE80211_FCTL_FROMDS))
1228                         hdrlen = 30;
1229                 else
1230                         hdrlen = 24;
1231                 datalen = len;
1232                 break;
1233         case IEEE80211_FTYPE_MGMT:
1234                 hdrlen = 24;
1235                 datalen = len;
1236                 break;
1237         case IEEE80211_FTYPE_CTL:
1238                 switch (fc & IEEE80211_FCTL_STYPE) {
1239                 case IEEE80211_STYPE_PSPOLL:
1240                 case IEEE80211_STYPE_RTS:
1241                 case IEEE80211_STYPE_CFEND:
1242                 case IEEE80211_STYPE_CFENDACK:
1243                         hdrlen = 16;
1244                         break;
1245                 case IEEE80211_STYPE_CTS:
1246                 case IEEE80211_STYPE_ACK:
1247                         hdrlen = 10;
1248                         break;
1249                 }
1250                 break;
1251         default:
1252                 /* Unknown frame type */
1253                 break;
1254         }
1255
1256         /* sanity check the length */
1257         if (datalen > IEEE80211_DATA_LEN + 12) {
1258                 printk(KERN_DEBUG "%s: oversized monitor frame, "
1259                        "data length = %d\n", dev->name, datalen);
1260                 stats->rx_length_errors++;
1261                 goto update_stats;
1262         }
1263
1264         skb = dev_alloc_skb(hdrlen + datalen);
1265         if (!skb) {
1266                 printk(KERN_WARNING "%s: Cannot allocate skb for monitor frame\n",
1267                        dev->name);
1268                 goto update_stats;
1269         }
1270
1271         /* Copy the 802.11 header to the skb */
1272         memcpy(skb_put(skb, hdrlen), &(desc->frame_ctl), hdrlen);
1273         skb_reset_mac_header(skb);
1274
1275         /* If any, copy the data from the card to the skb */
1276         if (datalen > 0) {
1277                 err = hermes_bap_pread(hw, IRQ_BAP, skb_put(skb, datalen),
1278                                        ALIGN(datalen, 2), rxfid,
1279                                        HERMES_802_2_OFFSET);
1280                 if (err) {
1281                         printk(KERN_ERR "%s: error %d reading monitor frame\n",
1282                                dev->name, err);
1283                         goto drop;
1284                 }
1285         }
1286
1287         skb->dev = dev;
1288         skb->ip_summed = CHECKSUM_NONE;
1289         skb->pkt_type = PACKET_OTHERHOST;
1290         skb->protocol = __constant_htons(ETH_P_802_2);
1291
1292         dev->last_rx = jiffies;
1293         stats->rx_packets++;
1294         stats->rx_bytes += skb->len;
1295
1296         netif_rx(skb);
1297         return;
1298
1299  drop:
1300         dev_kfree_skb_irq(skb);
1301  update_stats:
1302         stats->rx_errors++;
1303         stats->rx_dropped++;
1304 }
1305
1306 /* Get tsc from the firmware */
1307 static int orinoco_hw_get_tkip_iv(struct orinoco_private *priv, int key,
1308                                   u8 *tsc)
1309 {
1310         hermes_t *hw = &priv->hw;
1311         int err = 0;
1312         u8 tsc_arr[4][IW_ENCODE_SEQ_MAX_SIZE];
1313
1314         if ((key < 0) || (key > 4))
1315                 return -EINVAL;
1316
1317         err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CURRENT_TKIP_IV,
1318                               sizeof(tsc_arr), NULL, &tsc_arr);
1319         if (!err)
1320                 memcpy(tsc, &tsc_arr[key][0], sizeof(tsc_arr[0]));
1321
1322         return err;
1323 }
1324
1325 static void __orinoco_ev_rx(struct net_device *dev, hermes_t *hw)
1326 {
1327         struct orinoco_private *priv = netdev_priv(dev);
1328         struct net_device_stats *stats = &priv->stats;
1329         struct iw_statistics *wstats = &priv->wstats;
1330         struct sk_buff *skb = NULL;
1331         u16 rxfid, status;
1332         int length;
1333         struct hermes_rx_descriptor *desc;
1334         struct orinoco_rx_data *rx_data;
1335         int err;
1336
1337         desc = kmalloc(sizeof(*desc), GFP_ATOMIC);
1338         if (!desc) {
1339                 printk(KERN_WARNING
1340                        "%s: Can't allocate space for RX descriptor\n",
1341                        dev->name);
1342                 goto update_stats;
1343         }
1344
1345         rxfid = hermes_read_regn(hw, RXFID);
1346
1347         err = hermes_bap_pread(hw, IRQ_BAP, desc, sizeof(*desc),
1348                                rxfid, 0);
1349         if (err) {
1350                 printk(KERN_ERR "%s: error %d reading Rx descriptor. "
1351                        "Frame dropped.\n", dev->name, err);
1352                 goto update_stats;
1353         }
1354
1355         status = le16_to_cpu(desc->status);
1356
1357         if (status & HERMES_RXSTAT_BADCRC) {
1358                 DEBUG(1, "%s: Bad CRC on Rx. Frame dropped.\n",
1359                       dev->name);
1360                 stats->rx_crc_errors++;
1361                 goto update_stats;
1362         }
1363
1364         /* Handle frames in monitor mode */
1365         if (priv->iw_mode == IW_MODE_MONITOR) {
1366                 orinoco_rx_monitor(dev, rxfid, desc);
1367                 goto out;
1368         }
1369
1370         if (status & HERMES_RXSTAT_UNDECRYPTABLE) {
1371                 DEBUG(1, "%s: Undecryptable frame on Rx. Frame dropped.\n",
1372                       dev->name);
1373                 wstats->discard.code++;
1374                 goto update_stats;
1375         }
1376
1377         length = le16_to_cpu(desc->data_len);
1378
1379         /* Sanity checks */
1380         if (length < 3) { /* No for even an 802.2 LLC header */
1381                 /* At least on Symbol firmware with PCF we get quite a
1382                    lot of these legitimately - Poll frames with no
1383                    data. */
1384                 goto out;
1385         }
1386         if (length > IEEE80211_DATA_LEN) {
1387                 printk(KERN_WARNING "%s: Oversized frame received (%d bytes)\n",
1388                        dev->name, length);
1389                 stats->rx_length_errors++;
1390                 goto update_stats;
1391         }
1392
1393         /* Payload size does not include Michael MIC. Increase payload
1394          * size to read it together with the data. */
1395         if (status & HERMES_RXSTAT_MIC)
1396                 length += MICHAEL_MIC_LEN;
1397
1398         /* We need space for the packet data itself, plus an ethernet
1399            header, plus 2 bytes so we can align the IP header on a
1400            32bit boundary, plus 1 byte so we can read in odd length
1401            packets from the card, which has an IO granularity of 16
1402            bits */
1403         skb = dev_alloc_skb(length+ETH_HLEN+2+1);
1404         if (!skb) {
1405                 printk(KERN_WARNING "%s: Can't allocate skb for Rx\n",
1406                        dev->name);
1407                 goto update_stats;
1408         }
1409
1410         /* We'll prepend the header, so reserve space for it.  The worst
1411            case is no decapsulation, when 802.3 header is prepended and
1412            nothing is removed.  2 is for aligning the IP header.  */
1413         skb_reserve(skb, ETH_HLEN + 2);
1414
1415         err = hermes_bap_pread(hw, IRQ_BAP, skb_put(skb, length),
1416                                ALIGN(length, 2), rxfid,
1417                                HERMES_802_2_OFFSET);
1418         if (err) {
1419                 printk(KERN_ERR "%s: error %d reading frame. "
1420                        "Frame dropped.\n", dev->name, err);
1421                 goto drop;
1422         }
1423
1424         /* Add desc and skb to rx queue */
1425         rx_data = kzalloc(sizeof(*rx_data), GFP_ATOMIC);
1426         if (!rx_data) {
1427                 printk(KERN_WARNING "%s: Can't allocate RX packet\n",
1428                         dev->name);
1429                 goto drop;
1430         }
1431         rx_data->desc = desc;
1432         rx_data->skb = skb;
1433         list_add_tail(&rx_data->list, &priv->rx_list);
1434         tasklet_schedule(&priv->rx_tasklet);
1435
1436         return;
1437
1438 drop:
1439         dev_kfree_skb_irq(skb);
1440 update_stats:
1441         stats->rx_errors++;
1442         stats->rx_dropped++;
1443 out:
1444         kfree(desc);
1445 }
1446
1447 static void orinoco_rx(struct net_device *dev,
1448                        struct hermes_rx_descriptor *desc,
1449                        struct sk_buff *skb)
1450 {
1451         struct orinoco_private *priv = netdev_priv(dev);
1452         struct net_device_stats *stats = &priv->stats;
1453         u16 status, fc;
1454         int length;
1455         struct ethhdr *hdr;
1456
1457         status = le16_to_cpu(desc->status);
1458         length = le16_to_cpu(desc->data_len);
1459         fc = le16_to_cpu(desc->frame_ctl);
1460
1461         /* Calculate and check MIC */
1462         if (status & HERMES_RXSTAT_MIC) {
1463                 int key_id = ((status & HERMES_RXSTAT_MIC_KEY_ID) >>
1464                               HERMES_MIC_KEY_ID_SHIFT);
1465                 u8 mic[MICHAEL_MIC_LEN];
1466                 u8 *rxmic;
1467                 u8 *src = (fc & IEEE80211_FCTL_FROMDS) ?
1468                         desc->addr3 : desc->addr2;
1469
1470                 /* Extract Michael MIC from payload */
1471                 rxmic = skb->data + skb->len - MICHAEL_MIC_LEN;
1472
1473                 skb_trim(skb, skb->len - MICHAEL_MIC_LEN);
1474                 length -= MICHAEL_MIC_LEN;
1475
1476                 michael_mic(priv->rx_tfm_mic,
1477                             priv->tkip_key[key_id].rx_mic,
1478                             desc->addr1,
1479                             src,
1480                             0, /* priority or QoS? */
1481                             skb->data,
1482                             skb->len,
1483                             &mic[0]);
1484
1485                 if (memcmp(mic, rxmic,
1486                            MICHAEL_MIC_LEN)) {
1487                         union iwreq_data wrqu;
1488                         struct iw_michaelmicfailure wxmic;
1489
1490                         printk(KERN_WARNING "%s: "
1491                                "Invalid Michael MIC in data frame from %pM, "
1492                                "using key %i\n",
1493                                dev->name, src, key_id);
1494
1495                         /* TODO: update stats */
1496
1497                         /* Notify userspace */
1498                         memset(&wxmic, 0, sizeof(wxmic));
1499                         wxmic.flags = key_id & IW_MICFAILURE_KEY_ID;
1500                         wxmic.flags |= (desc->addr1[0] & 1) ?
1501                                 IW_MICFAILURE_GROUP : IW_MICFAILURE_PAIRWISE;
1502                         wxmic.src_addr.sa_family = ARPHRD_ETHER;
1503                         memcpy(wxmic.src_addr.sa_data, src, ETH_ALEN);
1504
1505                         (void) orinoco_hw_get_tkip_iv(priv, key_id,
1506                                                       &wxmic.tsc[0]);
1507
1508                         memset(&wrqu, 0, sizeof(wrqu));
1509                         wrqu.data.length = sizeof(wxmic);
1510                         wireless_send_event(dev, IWEVMICHAELMICFAILURE, &wrqu,
1511                                             (char *) &wxmic);
1512
1513                         goto drop;
1514                 }
1515         }
1516
1517         /* Handle decapsulation
1518          * In most cases, the firmware tell us about SNAP frames.
1519          * For some reason, the SNAP frames sent by LinkSys APs
1520          * are not properly recognised by most firmwares.
1521          * So, check ourselves */
1522         if (length >= ENCAPS_OVERHEAD &&
1523             (((status & HERMES_RXSTAT_MSGTYPE) == HERMES_RXSTAT_1042) ||
1524              ((status & HERMES_RXSTAT_MSGTYPE) == HERMES_RXSTAT_TUNNEL) ||
1525              is_ethersnap(skb->data))) {
1526                 /* These indicate a SNAP within 802.2 LLC within
1527                    802.11 frame which we'll need to de-encapsulate to
1528                    the original EthernetII frame. */
1529                 hdr = (struct ethhdr *)skb_push(skb, ETH_HLEN - ENCAPS_OVERHEAD);
1530         } else {
1531                 /* 802.3 frame - prepend 802.3 header as is */
1532                 hdr = (struct ethhdr *)skb_push(skb, ETH_HLEN);
1533                 hdr->h_proto = htons(length);
1534         }
1535         memcpy(hdr->h_dest, desc->addr1, ETH_ALEN);
1536         if (fc & IEEE80211_FCTL_FROMDS)
1537                 memcpy(hdr->h_source, desc->addr3, ETH_ALEN);
1538         else
1539                 memcpy(hdr->h_source, desc->addr2, ETH_ALEN);
1540
1541         dev->last_rx = jiffies;
1542         skb->protocol = eth_type_trans(skb, dev);
1543         skb->ip_summed = CHECKSUM_NONE;
1544         if (fc & IEEE80211_FCTL_TODS)
1545                 skb->pkt_type = PACKET_OTHERHOST;
1546
1547         /* Process the wireless stats if needed */
1548         orinoco_stat_gather(dev, skb, desc);
1549
1550         /* Pass the packet to the networking stack */
1551         netif_rx(skb);
1552         stats->rx_packets++;
1553         stats->rx_bytes += length;
1554
1555         return;
1556
1557  drop:
1558         dev_kfree_skb(skb);
1559         stats->rx_errors++;
1560         stats->rx_dropped++;
1561 }
1562
1563 static void orinoco_rx_isr_tasklet(unsigned long data)
1564 {
1565         struct net_device *dev = (struct net_device *) data;
1566         struct orinoco_private *priv = netdev_priv(dev);
1567         struct orinoco_rx_data *rx_data, *temp;
1568         struct hermes_rx_descriptor *desc;
1569         struct sk_buff *skb;
1570
1571         /* extract desc and skb from queue */
1572         list_for_each_entry_safe(rx_data, temp, &priv->rx_list, list) {
1573                 desc = rx_data->desc;
1574                 skb = rx_data->skb;
1575                 list_del(&rx_data->list);
1576                 kfree(rx_data);
1577
1578                 orinoco_rx(dev, desc, skb);
1579
1580                 kfree(desc);
1581         }
1582 }
1583
1584 /********************************************************************/
1585 /* Rx path (info frames)                                            */
1586 /********************************************************************/
1587
1588 static void print_linkstatus(struct net_device *dev, u16 status)
1589 {
1590         char * s;
1591
1592         if (suppress_linkstatus)
1593                 return;
1594
1595         switch (status) {
1596         case HERMES_LINKSTATUS_NOT_CONNECTED:
1597                 s = "Not Connected";
1598                 break;
1599         case HERMES_LINKSTATUS_CONNECTED:
1600                 s = "Connected";
1601                 break;
1602         case HERMES_LINKSTATUS_DISCONNECTED:
1603                 s = "Disconnected";
1604                 break;
1605         case HERMES_LINKSTATUS_AP_CHANGE:
1606                 s = "AP Changed";
1607                 break;
1608         case HERMES_LINKSTATUS_AP_OUT_OF_RANGE:
1609                 s = "AP Out of Range";
1610                 break;
1611         case HERMES_LINKSTATUS_AP_IN_RANGE:
1612                 s = "AP In Range";
1613                 break;
1614         case HERMES_LINKSTATUS_ASSOC_FAILED:
1615                 s = "Association Failed";
1616                 break;
1617         default:
1618                 s = "UNKNOWN";
1619         }
1620
1621         printk(KERN_INFO "%s: New link status: %s (%04x)\n",
1622                dev->name, s, status);
1623 }
1624
1625 /* Search scan results for requested BSSID, join it if found */
1626 static void orinoco_join_ap(struct work_struct *work)
1627 {
1628         struct orinoco_private *priv =
1629                 container_of(work, struct orinoco_private, join_work);
1630         struct net_device *dev = priv->ndev;
1631         struct hermes *hw = &priv->hw;
1632         int err;
1633         unsigned long flags;
1634         struct join_req {
1635                 u8 bssid[ETH_ALEN];
1636                 __le16 channel;
1637         } __attribute__ ((packed)) req;
1638         const int atom_len = offsetof(struct prism2_scan_apinfo, atim);
1639         struct prism2_scan_apinfo *atom = NULL;
1640         int offset = 4;
1641         int found = 0;
1642         u8 *buf;
1643         u16 len;
1644
1645         /* Allocate buffer for scan results */
1646         buf = kmalloc(MAX_SCAN_LEN, GFP_KERNEL);
1647         if (! buf)
1648                 return;
1649
1650         if (orinoco_lock(priv, &flags) != 0)
1651                 goto fail_lock;
1652
1653         /* Sanity checks in case user changed something in the meantime */
1654         if (! priv->bssid_fixed)
1655                 goto out;
1656
1657         if (strlen(priv->desired_essid) == 0)
1658                 goto out;
1659
1660         /* Read scan results from the firmware */
1661         err = hermes_read_ltv(hw, USER_BAP,
1662                               HERMES_RID_SCANRESULTSTABLE,
1663                               MAX_SCAN_LEN, &len, buf);
1664         if (err) {
1665                 printk(KERN_ERR "%s: Cannot read scan results\n",
1666                        dev->name);
1667                 goto out;
1668         }
1669
1670         len = HERMES_RECLEN_TO_BYTES(len);
1671
1672         /* Go through the scan results looking for the channel of the AP
1673          * we were requested to join */
1674         for (; offset + atom_len <= len; offset += atom_len) {
1675                 atom = (struct prism2_scan_apinfo *) (buf + offset);
1676                 if (memcmp(&atom->bssid, priv->desired_bssid, ETH_ALEN) == 0) {
1677                         found = 1;
1678                         break;
1679                 }
1680         }
1681
1682         if (! found) {
1683                 DEBUG(1, "%s: Requested AP not found in scan results\n",
1684                       dev->name);
1685                 goto out;
1686         }
1687
1688         memcpy(req.bssid, priv->desired_bssid, ETH_ALEN);
1689         req.channel = atom->channel;    /* both are little-endian */
1690         err = HERMES_WRITE_RECORD(hw, USER_BAP, HERMES_RID_CNFJOINREQUEST,
1691                                   &req);
1692         if (err)
1693                 printk(KERN_ERR "%s: Error issuing join request\n", dev->name);
1694
1695  out:
1696         orinoco_unlock(priv, &flags);
1697
1698  fail_lock:
1699         kfree(buf);
1700 }
1701
1702 /* Send new BSSID to userspace */
1703 static void orinoco_send_bssid_wevent(struct orinoco_private *priv)
1704 {
1705         struct net_device *dev = priv->ndev;
1706         struct hermes *hw = &priv->hw;
1707         union iwreq_data wrqu;
1708         int err;
1709
1710         err = hermes_read_ltv(hw, IRQ_BAP, HERMES_RID_CURRENTBSSID,
1711                               ETH_ALEN, NULL, wrqu.ap_addr.sa_data);
1712         if (err != 0)
1713                 return;
1714
1715         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
1716
1717         /* Send event to user space */
1718         wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
1719 }
1720
1721 static void orinoco_send_assocreqie_wevent(struct orinoco_private *priv)
1722 {
1723         struct net_device *dev = priv->ndev;
1724         struct hermes *hw = &priv->hw;
1725         union iwreq_data wrqu;
1726         int err;
1727         u8 buf[88];
1728         u8 *ie;
1729
1730         if (!priv->has_wpa)
1731                 return;
1732
1733         err = hermes_read_ltv(hw, IRQ_BAP, HERMES_RID_CURRENT_ASSOC_REQ_INFO,
1734                               sizeof(buf), NULL, &buf);
1735         if (err != 0)
1736                 return;
1737
1738         ie = orinoco_get_wpa_ie(buf, sizeof(buf));
1739         if (ie) {
1740                 int rem = sizeof(buf) - (ie - &buf[0]);
1741                 wrqu.data.length = ie[1] + 2;
1742                 if (wrqu.data.length > rem)
1743                         wrqu.data.length = rem;
1744
1745                 if (wrqu.data.length)
1746                         /* Send event to user space */
1747                         wireless_send_event(dev, IWEVASSOCREQIE, &wrqu, ie);
1748         }
1749 }
1750
1751 static void orinoco_send_assocrespie_wevent(struct orinoco_private *priv)
1752 {
1753         struct net_device *dev = priv->ndev;
1754         struct hermes *hw = &priv->hw;
1755         union iwreq_data wrqu;
1756         int err;
1757         u8 buf[88]; /* TODO: verify max size or IW_GENERIC_IE_MAX */
1758         u8 *ie;
1759
1760         if (!priv->has_wpa)
1761                 return;
1762
1763         err = hermes_read_ltv(hw, IRQ_BAP, HERMES_RID_CURRENT_ASSOC_RESP_INFO,
1764                               sizeof(buf), NULL, &buf);
1765         if (err != 0)
1766                 return;
1767
1768         ie = orinoco_get_wpa_ie(buf, sizeof(buf));
1769         if (ie) {
1770                 int rem = sizeof(buf) - (ie - &buf[0]);
1771                 wrqu.data.length = ie[1] + 2;
1772                 if (wrqu.data.length > rem)
1773                         wrqu.data.length = rem;
1774
1775                 if (wrqu.data.length)
1776                         /* Send event to user space */
1777                         wireless_send_event(dev, IWEVASSOCRESPIE, &wrqu, ie);
1778         }
1779 }
1780
1781 static void orinoco_send_wevents(struct work_struct *work)
1782 {
1783         struct orinoco_private *priv =
1784                 container_of(work, struct orinoco_private, wevent_work);
1785         unsigned long flags;
1786
1787         if (orinoco_lock(priv, &flags) != 0)
1788                 return;
1789
1790         orinoco_send_assocreqie_wevent(priv);
1791         orinoco_send_assocrespie_wevent(priv);
1792         orinoco_send_bssid_wevent(priv);
1793
1794         orinoco_unlock(priv, &flags);
1795 }
1796
1797 static inline void orinoco_clear_scan_results(struct orinoco_private *priv,
1798                                               unsigned long scan_age)
1799 {
1800         if (priv->has_ext_scan) {
1801                 struct xbss_element *bss;
1802                 struct xbss_element *tmp_bss;
1803
1804                 /* Blow away current list of scan results */
1805                 list_for_each_entry_safe(bss, tmp_bss, &priv->bss_list, list) {
1806                         if (!scan_age ||
1807                             time_after(jiffies, bss->last_scanned + scan_age)) {
1808                                 list_move_tail(&bss->list,
1809                                                &priv->bss_free_list);
1810                                 /* Don't blow away ->list, just BSS data */
1811                                 memset(&bss->bss, 0, sizeof(bss->bss));
1812                                 bss->last_scanned = 0;
1813                         }
1814                 }
1815         } else {
1816                 struct bss_element *bss;
1817                 struct bss_element *tmp_bss;
1818
1819                 /* Blow away current list of scan results */
1820                 list_for_each_entry_safe(bss, tmp_bss, &priv->bss_list, list) {
1821                         if (!scan_age ||
1822                             time_after(jiffies, bss->last_scanned + scan_age)) {
1823                                 list_move_tail(&bss->list,
1824                                                &priv->bss_free_list);
1825                                 /* Don't blow away ->list, just BSS data */
1826                                 memset(&bss->bss, 0, sizeof(bss->bss));
1827                                 bss->last_scanned = 0;
1828                         }
1829                 }
1830         }
1831 }
1832
1833 static void orinoco_add_ext_scan_result(struct orinoco_private *priv,
1834                                         struct agere_ext_scan_info *atom)
1835 {
1836         struct xbss_element *bss = NULL;
1837         int found = 0;
1838
1839         /* Try to update an existing bss first */
1840         list_for_each_entry(bss, &priv->bss_list, list) {
1841                 if (compare_ether_addr(bss->bss.bssid, atom->bssid))
1842                         continue;
1843                 /* ESSID lengths */
1844                 if (bss->bss.data[1] != atom->data[1])
1845                         continue;
1846                 if (memcmp(&bss->bss.data[2], &atom->data[2],
1847                            atom->data[1]))
1848                         continue;
1849                 found = 1;
1850                 break;
1851         }
1852
1853         /* Grab a bss off the free list */
1854         if (!found && !list_empty(&priv->bss_free_list)) {
1855                 bss = list_entry(priv->bss_free_list.next,
1856                                  struct xbss_element, list);
1857                 list_del(priv->bss_free_list.next);
1858
1859                 list_add_tail(&bss->list, &priv->bss_list);
1860         }
1861
1862         if (bss) {
1863                 /* Always update the BSS to get latest beacon info */
1864                 memcpy(&bss->bss, atom, sizeof(bss->bss));
1865                 bss->last_scanned = jiffies;
1866         }
1867 }
1868
1869 static int orinoco_process_scan_results(struct net_device *dev,
1870                                         unsigned char *buf,
1871                                         int len)
1872 {
1873         struct orinoco_private *priv = netdev_priv(dev);
1874         int                     offset;         /* In the scan data */
1875         union hermes_scan_info *atom;
1876         int                     atom_len;
1877
1878         switch (priv->firmware_type) {
1879         case FIRMWARE_TYPE_AGERE:
1880                 atom_len = sizeof(struct agere_scan_apinfo);
1881                 offset = 0;
1882                 break;
1883         case FIRMWARE_TYPE_SYMBOL:
1884                 /* Lack of documentation necessitates this hack.
1885                  * Different firmwares have 68 or 76 byte long atoms.
1886                  * We try modulo first.  If the length divides by both,
1887                  * we check what would be the channel in the second
1888                  * frame for a 68-byte atom.  76-byte atoms have 0 there.
1889                  * Valid channel cannot be 0.  */
1890                 if (len % 76)
1891                         atom_len = 68;
1892                 else if (len % 68)
1893                         atom_len = 76;
1894                 else if (len >= 1292 && buf[68] == 0)
1895                         atom_len = 76;
1896                 else
1897                         atom_len = 68;
1898                 offset = 0;
1899                 break;
1900         case FIRMWARE_TYPE_INTERSIL:
1901                 offset = 4;
1902                 if (priv->has_hostscan) {
1903                         atom_len = le16_to_cpup((__le16 *)buf);
1904                         /* Sanity check for atom_len */
1905                         if (atom_len < sizeof(struct prism2_scan_apinfo)) {
1906                                 printk(KERN_ERR "%s: Invalid atom_len in scan "
1907                                        "data: %d\n", dev->name, atom_len);
1908                                 return -EIO;
1909                         }
1910                 } else
1911                         atom_len = offsetof(struct prism2_scan_apinfo, atim);
1912                 break;
1913         default:
1914                 return -EOPNOTSUPP;
1915         }
1916
1917         /* Check that we got an whole number of atoms */
1918         if ((len - offset) % atom_len) {
1919                 printk(KERN_ERR "%s: Unexpected scan data length %d, "
1920                        "atom_len %d, offset %d\n", dev->name, len,
1921                        atom_len, offset);
1922                 return -EIO;
1923         }
1924
1925         orinoco_clear_scan_results(priv, msecs_to_jiffies(15000));
1926
1927         /* Read the entries one by one */
1928         for (; offset + atom_len <= len; offset += atom_len) {
1929                 int found = 0;
1930                 struct bss_element *bss = NULL;
1931
1932                 /* Get next atom */
1933                 atom = (union hermes_scan_info *) (buf + offset);
1934
1935                 /* Try to update an existing bss first */
1936                 list_for_each_entry(bss, &priv->bss_list, list) {
1937                         if (compare_ether_addr(bss->bss.a.bssid, atom->a.bssid))
1938                                 continue;
1939                         if (le16_to_cpu(bss->bss.a.essid_len) !=
1940                               le16_to_cpu(atom->a.essid_len))
1941                                 continue;
1942                         if (memcmp(bss->bss.a.essid, atom->a.essid,
1943                               le16_to_cpu(atom->a.essid_len)))
1944                                 continue;
1945                         found = 1;
1946                         break;
1947                 }
1948
1949                 /* Grab a bss off the free list */
1950                 if (!found && !list_empty(&priv->bss_free_list)) {
1951                         bss = list_entry(priv->bss_free_list.next,
1952                                          struct bss_element, list);
1953                         list_del(priv->bss_free_list.next);
1954
1955                         list_add_tail(&bss->list, &priv->bss_list);
1956                 }
1957
1958                 if (bss) {
1959                         /* Always update the BSS to get latest beacon info */
1960                         memcpy(&bss->bss, atom, sizeof(bss->bss));
1961                         bss->last_scanned = jiffies;
1962                 }
1963         }
1964
1965         return 0;
1966 }
1967
1968 static void __orinoco_ev_info(struct net_device *dev, hermes_t *hw)
1969 {
1970         struct orinoco_private *priv = netdev_priv(dev);
1971         u16 infofid;
1972         struct {
1973                 __le16 len;
1974                 __le16 type;
1975         } __attribute__ ((packed)) info;
1976         int len, type;
1977         int err;
1978
1979         /* This is an answer to an INQUIRE command that we did earlier,
1980          * or an information "event" generated by the card
1981          * The controller return to us a pseudo frame containing
1982          * the information in question - Jean II */
1983         infofid = hermes_read_regn(hw, INFOFID);
1984
1985         /* Read the info frame header - don't try too hard */
1986         err = hermes_bap_pread(hw, IRQ_BAP, &info, sizeof(info),
1987                                infofid, 0);
1988         if (err) {
1989                 printk(KERN_ERR "%s: error %d reading info frame. "
1990                        "Frame dropped.\n", dev->name, err);
1991                 return;
1992         }
1993
1994         len = HERMES_RECLEN_TO_BYTES(le16_to_cpu(info.len));
1995         type = le16_to_cpu(info.type);
1996
1997         switch (type) {
1998         case HERMES_INQ_TALLIES: {
1999                 struct hermes_tallies_frame tallies;
2000                 struct iw_statistics *wstats = &priv->wstats;
2001
2002                 if (len > sizeof(tallies)) {
2003                         printk(KERN_WARNING "%s: Tallies frame too long (%d bytes)\n",
2004                                dev->name, len);
2005                         len = sizeof(tallies);
2006                 }
2007
2008                 err = hermes_bap_pread(hw, IRQ_BAP, &tallies, len,
2009                                        infofid, sizeof(info));
2010                 if (err)
2011                         break;
2012
2013                 /* Increment our various counters */
2014                 /* wstats->discard.nwid - no wrong BSSID stuff */
2015                 wstats->discard.code +=
2016                         le16_to_cpu(tallies.RxWEPUndecryptable);
2017                 if (len == sizeof(tallies))
2018                         wstats->discard.code +=
2019                                 le16_to_cpu(tallies.RxDiscards_WEPICVError) +
2020                                 le16_to_cpu(tallies.RxDiscards_WEPExcluded);
2021                 wstats->discard.misc +=
2022                         le16_to_cpu(tallies.TxDiscardsWrongSA);
2023                 wstats->discard.fragment +=
2024                         le16_to_cpu(tallies.RxMsgInBadMsgFragments);
2025                 wstats->discard.retries +=
2026                         le16_to_cpu(tallies.TxRetryLimitExceeded);
2027                 /* wstats->miss.beacon - no match */
2028         }
2029         break;
2030         case HERMES_INQ_LINKSTATUS: {
2031                 struct hermes_linkstatus linkstatus;
2032                 u16 newstatus;
2033                 int connected;
2034
2035                 if (priv->iw_mode == IW_MODE_MONITOR)
2036                         break;
2037
2038                 if (len != sizeof(linkstatus)) {
2039                         printk(KERN_WARNING "%s: Unexpected size for linkstatus frame (%d bytes)\n",
2040                                dev->name, len);
2041                         break;
2042                 }
2043
2044                 err = hermes_bap_pread(hw, IRQ_BAP, &linkstatus, len,
2045                                        infofid, sizeof(info));
2046                 if (err)
2047                         break;
2048                 newstatus = le16_to_cpu(linkstatus.linkstatus);
2049
2050                 /* Symbol firmware uses "out of range" to signal that
2051                  * the hostscan frame can be requested.  */
2052                 if (newstatus == HERMES_LINKSTATUS_AP_OUT_OF_RANGE &&
2053                     priv->firmware_type == FIRMWARE_TYPE_SYMBOL &&
2054                     priv->has_hostscan && priv->scan_inprogress) {
2055                         hermes_inquire(hw, HERMES_INQ_HOSTSCAN_SYMBOL);
2056                         break;
2057                 }
2058
2059                 connected = (newstatus == HERMES_LINKSTATUS_CONNECTED)
2060                         || (newstatus == HERMES_LINKSTATUS_AP_CHANGE)
2061                         || (newstatus == HERMES_LINKSTATUS_AP_IN_RANGE);
2062
2063                 if (connected)
2064                         netif_carrier_on(dev);
2065                 else if (!ignore_disconnect)
2066                         netif_carrier_off(dev);
2067
2068                 if (newstatus != priv->last_linkstatus) {
2069                         priv->last_linkstatus = newstatus;
2070                         print_linkstatus(dev, newstatus);
2071                         /* The info frame contains only one word which is the
2072                          * status (see hermes.h). The status is pretty boring
2073                          * in itself, that's why we export the new BSSID...
2074                          * Jean II */
2075                         schedule_work(&priv->wevent_work);
2076                 }
2077         }
2078         break;
2079         case HERMES_INQ_SCAN:
2080                 if (!priv->scan_inprogress && priv->bssid_fixed &&
2081                     priv->firmware_type == FIRMWARE_TYPE_INTERSIL) {
2082                         schedule_work(&priv->join_work);
2083                         break;
2084                 }
2085                 /* fall through */
2086         case HERMES_INQ_HOSTSCAN:
2087         case HERMES_INQ_HOSTSCAN_SYMBOL: {
2088                 /* Result of a scanning. Contains information about
2089                  * cells in the vicinity - Jean II */
2090                 union iwreq_data        wrqu;
2091                 unsigned char *buf;
2092
2093                 /* Scan is no longer in progress */
2094                 priv->scan_inprogress = 0;
2095
2096                 /* Sanity check */
2097                 if (len > 4096) {
2098                         printk(KERN_WARNING "%s: Scan results too large (%d bytes)\n",
2099                                dev->name, len);
2100                         break;
2101                 }
2102
2103                 /* Allocate buffer for results */
2104                 buf = kmalloc(len, GFP_ATOMIC);
2105                 if (buf == NULL)
2106                         /* No memory, so can't printk()... */
2107                         break;
2108
2109                 /* Read scan data */
2110                 err = hermes_bap_pread(hw, IRQ_BAP, (void *) buf, len,
2111                                        infofid, sizeof(info));
2112                 if (err) {
2113                         kfree(buf);
2114                         break;
2115                 }
2116
2117 #ifdef ORINOCO_DEBUG
2118                 {
2119                         int     i;
2120                         printk(KERN_DEBUG "Scan result [%02X", buf[0]);
2121                         for(i = 1; i < (len * 2); i++)
2122                                 printk(":%02X", buf[i]);
2123                         printk("]\n");
2124                 }
2125 #endif  /* ORINOCO_DEBUG */
2126
2127                 if (orinoco_process_scan_results(dev, buf, len) == 0) {
2128                         /* Send an empty event to user space.
2129                          * We don't send the received data on the event because
2130                          * it would require us to do complex transcoding, and
2131                          * we want to minimise the work done in the irq handler
2132                          * Use a request to extract the data - Jean II */
2133                         wrqu.data.length = 0;
2134                         wrqu.data.flags = 0;
2135                         wireless_send_event(dev, SIOCGIWSCAN, &wrqu, NULL);
2136                 }
2137                 kfree(buf);
2138         }
2139         break;
2140         case HERMES_INQ_CHANNELINFO:
2141         {
2142                 struct agere_ext_scan_info *bss;
2143
2144                 if (!priv->scan_inprogress) {
2145                         printk(KERN_DEBUG "%s: Got chaninfo without scan, "
2146                                "len=%d\n", dev->name, len);
2147                         break;
2148                 }
2149
2150                 /* An empty result indicates that the scan is complete */
2151                 if (len == 0) {
2152                         union iwreq_data        wrqu;
2153
2154                         /* Scan is no longer in progress */
2155                         priv->scan_inprogress = 0;
2156
2157                         wrqu.data.length = 0;
2158                         wrqu.data.flags = 0;
2159                         wireless_send_event(dev, SIOCGIWSCAN, &wrqu, NULL);
2160                         break;
2161                 }
2162
2163                 /* Sanity check */
2164                 else if (len > sizeof(*bss)) {
2165                         printk(KERN_WARNING
2166                                "%s: Ext scan results too large (%d bytes). "
2167                                "Truncating results to %zd bytes.\n",
2168                                dev->name, len, sizeof(*bss));
2169                         len = sizeof(*bss);
2170                 } else if (len < (offsetof(struct agere_ext_scan_info,
2171                                            data) + 2)) {
2172                         /* Drop this result now so we don't have to
2173                          * keep checking later */
2174                         printk(KERN_WARNING
2175                                "%s: Ext scan results too short (%d bytes)\n",
2176                                dev->name, len);
2177                         break;
2178                 }
2179
2180                 bss = kmalloc(sizeof(*bss), GFP_ATOMIC);
2181                 if (bss == NULL)
2182                         break;
2183
2184                 /* Read scan data */
2185                 err = hermes_bap_pread(hw, IRQ_BAP, (void *) bss, len,
2186                                        infofid, sizeof(info));
2187                 if (err) {
2188                         kfree(bss);
2189                         break;
2190                 }
2191
2192                 orinoco_add_ext_scan_result(priv, bss);
2193
2194                 kfree(bss);
2195                 break;
2196         }
2197         case HERMES_INQ_SEC_STAT_AGERE:
2198                 /* Security status (Agere specific) */
2199                 /* Ignore this frame for now */
2200                 if (priv->firmware_type == FIRMWARE_TYPE_AGERE)
2201                         break;
2202                 /* fall through */
2203         default:
2204                 printk(KERN_DEBUG "%s: Unknown information frame received: "
2205                        "type 0x%04x, length %d\n", dev->name, type, len);
2206                 /* We don't actually do anything about it */
2207                 break;
2208         }
2209 }
2210
2211 static void __orinoco_ev_infdrop(struct net_device *dev, hermes_t *hw)
2212 {
2213         if (net_ratelimit())
2214                 printk(KERN_DEBUG "%s: Information frame lost.\n", dev->name);
2215 }
2216
2217 /********************************************************************/
2218 /* Internal hardware control routines                               */
2219 /********************************************************************/
2220
2221 int __orinoco_up(struct net_device *dev)
2222 {
2223         struct orinoco_private *priv = netdev_priv(dev);
2224         struct hermes *hw = &priv->hw;
2225         int err;
2226
2227         netif_carrier_off(dev); /* just to make sure */
2228
2229         err = __orinoco_program_rids(dev);
2230         if (err) {
2231                 printk(KERN_ERR "%s: Error %d configuring card\n",
2232                        dev->name, err);
2233                 return err;
2234         }
2235
2236         /* Fire things up again */
2237         hermes_set_irqmask(hw, ORINOCO_INTEN);
2238         err = hermes_enable_port(hw, 0);
2239         if (err) {
2240                 printk(KERN_ERR "%s: Error %d enabling MAC port\n",
2241                        dev->name, err);
2242                 return err;
2243         }
2244
2245         netif_start_queue(dev);
2246
2247         return 0;
2248 }
2249
2250 int __orinoco_down(struct net_device *dev)
2251 {
2252         struct orinoco_private *priv = netdev_priv(dev);
2253         struct hermes *hw = &priv->hw;
2254         int err;
2255
2256         netif_stop_queue(dev);
2257
2258         if (! priv->hw_unavailable) {
2259                 if (! priv->broken_disableport) {
2260                         err = hermes_disable_port(hw, 0);
2261                         if (err) {
2262                                 /* Some firmwares (e.g. Intersil 1.3.x) seem
2263                                  * to have problems disabling the port, oh
2264                                  * well, too bad. */
2265                                 printk(KERN_WARNING "%s: Error %d disabling MAC port\n",
2266                                        dev->name, err);
2267                                 priv->broken_disableport = 1;
2268                         }
2269                 }
2270                 hermes_set_irqmask(hw, 0);
2271                 hermes_write_regn(hw, EVACK, 0xffff);
2272         }
2273
2274         /* firmware will have to reassociate */
2275         netif_carrier_off(dev);
2276         priv->last_linkstatus = 0xffff;
2277
2278         return 0;
2279 }
2280
2281 static int orinoco_allocate_fid(struct net_device *dev)
2282 {
2283         struct orinoco_private *priv = netdev_priv(dev);
2284         struct hermes *hw = &priv->hw;
2285         int err;
2286
2287         err = hermes_allocate(hw, priv->nicbuf_size, &priv->txfid);
2288         if (err == -EIO && priv->nicbuf_size > TX_NICBUF_SIZE_BUG) {
2289                 /* Try workaround for old Symbol firmware bug */
2290                 printk(KERN_WARNING "%s: firmware ALLOC bug detected "
2291                        "(old Symbol firmware?). Trying to work around... ",
2292                        dev->name);
2293
2294                 priv->nicbuf_size = TX_NICBUF_SIZE_BUG;
2295                 err = hermes_allocate(hw, priv->nicbuf_size, &priv->txfid);
2296                 if (err)
2297                         printk("failed!\n");
2298                 else
2299                         printk("ok.\n");
2300         }
2301
2302         return err;
2303 }
2304
2305 int orinoco_reinit_firmware(struct net_device *dev)
2306 {
2307         struct orinoco_private *priv = netdev_priv(dev);
2308         struct hermes *hw = &priv->hw;
2309         int err;
2310
2311         err = hermes_init(hw);
2312         if (priv->do_fw_download && !err) {
2313                 err = orinoco_download(priv);
2314                 if (err)
2315                         priv->do_fw_download = 0;
2316         }
2317         if (!err)
2318                 err = orinoco_allocate_fid(dev);
2319
2320         return err;
2321 }
2322
2323 static int __orinoco_hw_set_bitrate(struct orinoco_private *priv)
2324 {
2325         hermes_t *hw = &priv->hw;
2326         int err = 0;
2327
2328         if (priv->bitratemode >= BITRATE_TABLE_SIZE) {
2329                 printk(KERN_ERR "%s: BUG: Invalid bitrate mode %d\n",
2330                        priv->ndev->name, priv->bitratemode);
2331                 return -EINVAL;
2332         }
2333
2334         switch (priv->firmware_type) {
2335         case FIRMWARE_TYPE_AGERE:
2336                 err = hermes_write_wordrec(hw, USER_BAP,
2337                                            HERMES_RID_CNFTXRATECONTROL,
2338                                            bitrate_table[priv->bitratemode].agere_txratectrl);
2339                 break;
2340         case FIRMWARE_TYPE_INTERSIL:
2341         case FIRMWARE_TYPE_SYMBOL:
2342                 err = hermes_write_wordrec(hw, USER_BAP,
2343                                            HERMES_RID_CNFTXRATECONTROL,
2344                                            bitrate_table[priv->bitratemode].intersil_txratectrl);
2345                 break;
2346         default:
2347                 BUG();
2348         }
2349
2350         return err;
2351 }
2352
2353 /* Set fixed AP address */
2354 static int __orinoco_hw_set_wap(struct orinoco_private *priv)
2355 {
2356         int roaming_flag;
2357         int err = 0;
2358         hermes_t *hw = &priv->hw;
2359
2360         switch (priv->firmware_type) {
2361         case FIRMWARE_TYPE_AGERE:
2362                 /* not supported */
2363                 break;
2364         case FIRMWARE_TYPE_INTERSIL:
2365                 if (priv->bssid_fixed)
2366                         roaming_flag = 2;
2367                 else
2368                         roaming_flag = 1;
2369
2370                 err = hermes_write_wordrec(hw, USER_BAP,
2371                                            HERMES_RID_CNFROAMINGMODE,
2372                                            roaming_flag);
2373                 break;
2374         case FIRMWARE_TYPE_SYMBOL:
2375                 err = HERMES_WRITE_RECORD(hw, USER_BAP,
2376                                           HERMES_RID_CNFMANDATORYBSSID_SYMBOL,
2377                                           &priv->desired_bssid);
2378                 break;
2379         }
2380         return err;
2381 }
2382
2383 /* Change the WEP keys and/or the current keys.  Can be called
2384  * either from __orinoco_hw_setup_enc() or directly from
2385  * orinoco_ioctl_setiwencode().  In the later case the association
2386  * with the AP is not broken (if the firmware can handle it),
2387  * which is needed for 802.1x implementations. */
2388 static int __orinoco_hw_setup_wepkeys(struct orinoco_private *priv)
2389 {
2390         hermes_t *hw = &priv->hw;
2391         int err = 0;
2392
2393         switch (priv->firmware_type) {
2394         case FIRMWARE_TYPE_AGERE:
2395                 err = HERMES_WRITE_RECORD(hw, USER_BAP,
2396                                           HERMES_RID_CNFWEPKEYS_AGERE,
2397                                           &priv->keys);
2398                 if (err)
2399                         return err;
2400                 err = hermes_write_wordrec(hw, USER_BAP,
2401                                            HERMES_RID_CNFTXKEY_AGERE,
2402                                            priv->tx_key);
2403                 if (err)
2404                         return err;
2405                 break;
2406         case FIRMWARE_TYPE_INTERSIL:
2407         case FIRMWARE_TYPE_SYMBOL:
2408                 {
2409                         int keylen;
2410                         int i;
2411
2412                         /* Force uniform key length to work around firmware bugs */
2413                         keylen = le16_to_cpu(priv->keys[priv->tx_key].len);
2414
2415                         if (keylen > LARGE_KEY_SIZE) {
2416                                 printk(KERN_ERR "%s: BUG: Key %d has oversize length %d.\n",
2417                                        priv->ndev->name, priv->tx_key, keylen);
2418                                 return -E2BIG;
2419                         }
2420
2421                         /* Write all 4 keys */
2422                         for(i = 0; i < ORINOCO_MAX_KEYS; i++) {
2423                                 err = hermes_write_ltv(hw, USER_BAP,
2424                                                        HERMES_RID_CNFDEFAULTKEY0 + i,
2425                                                        HERMES_BYTES_TO_RECLEN(keylen),
2426                                                        priv->keys[i].data);
2427                                 if (err)
2428                                         return err;
2429                         }
2430
2431                         /* Write the index of the key used in transmission */
2432                         err = hermes_write_wordrec(hw, USER_BAP,
2433                                                    HERMES_RID_CNFWEPDEFAULTKEYID,
2434                                                    priv->tx_key);
2435                         if (err)
2436                                 return err;
2437                 }
2438                 break;
2439         }
2440
2441         return 0;
2442 }
2443
2444 static int __orinoco_hw_setup_enc(struct orinoco_private *priv)
2445 {
2446         hermes_t *hw = &priv->hw;
2447         int err = 0;
2448         int master_wep_flag;
2449         int auth_flag;
2450         int enc_flag;
2451
2452         /* Setup WEP keys for WEP and WPA */
2453         if (priv->encode_alg)
2454                 __orinoco_hw_setup_wepkeys(priv);
2455
2456         if (priv->wep_restrict)
2457                 auth_flag = HERMES_AUTH_SHARED_KEY;
2458         else
2459                 auth_flag = HERMES_AUTH_OPEN;
2460
2461         if (priv->wpa_enabled)
2462                 enc_flag = 2;
2463         else if (priv->encode_alg == IW_ENCODE_ALG_WEP)
2464                 enc_flag = 1;
2465         else
2466                 enc_flag = 0;
2467
2468         switch (priv->firmware_type) {
2469         case FIRMWARE_TYPE_AGERE: /* Agere style WEP */
2470                 if (priv->encode_alg == IW_ENCODE_ALG_WEP) {
2471                         /* Enable the shared-key authentication. */
2472                         err = hermes_write_wordrec(hw, USER_BAP,
2473                                                    HERMES_RID_CNFAUTHENTICATION_AGERE,
2474                                                    auth_flag);
2475                 }
2476                 err = hermes_write_wordrec(hw, USER_BAP,
2477                                            HERMES_RID_CNFWEPENABLED_AGERE,
2478                                            enc_flag);
2479                 if (err)
2480                         return err;
2481
2482                 if (priv->has_wpa) {
2483                         /* Set WPA key management */
2484                         err = hermes_write_wordrec(hw, USER_BAP,
2485                                   HERMES_RID_CNFSETWPAAUTHMGMTSUITE_AGERE,
2486                                   priv->key_mgmt);
2487                         if (err)
2488                                 return err;
2489                 }
2490
2491                 break;
2492
2493         case FIRMWARE_TYPE_INTERSIL: /* Intersil style WEP */
2494         case FIRMWARE_TYPE_SYMBOL: /* Symbol style WEP */
2495                 if (priv->encode_alg == IW_ENCODE_ALG_WEP) {
2496                         if (priv->wep_restrict ||
2497                             (priv->firmware_type == FIRMWARE_TYPE_SYMBOL))
2498                                 master_wep_flag = HERMES_WEP_PRIVACY_INVOKED |
2499                                                   HERMES_WEP_EXCL_UNENCRYPTED;
2500                         else
2501                                 master_wep_flag = HERMES_WEP_PRIVACY_INVOKED;
2502
2503                         err = hermes_write_wordrec(hw, USER_BAP,
2504                                                    HERMES_RID_CNFAUTHENTICATION,
2505                                                    auth_flag);
2506                         if (err)
2507                                 return err;
2508                 } else
2509                         master_wep_flag = 0;
2510
2511                 if (priv->iw_mode == IW_MODE_MONITOR)
2512                         master_wep_flag |= HERMES_WEP_HOST_DECRYPT;
2513
2514                 /* Master WEP setting : on/off */
2515                 err = hermes_write_wordrec(hw, USER_BAP,
2516                                            HERMES_RID_CNFWEPFLAGS_INTERSIL,
2517                                            master_wep_flag);
2518                 if (err)
2519                         return err;
2520
2521                 break;
2522         }
2523
2524         return 0;
2525 }
2526
2527 /* key must be 32 bytes, including the tx and rx MIC keys.
2528  * rsc must be 8 bytes
2529  * tsc must be 8 bytes or NULL
2530  */
2531 static int __orinoco_hw_set_tkip_key(hermes_t *hw, int key_idx, int set_tx,
2532                                      u8 *key, u8 *rsc, u8 *tsc)
2533 {
2534         struct {
2535                 __le16 idx;
2536                 u8 rsc[IW_ENCODE_SEQ_MAX_SIZE];
2537                 u8 key[TKIP_KEYLEN];
2538                 u8 tx_mic[MIC_KEYLEN];
2539                 u8 rx_mic[MIC_KEYLEN];
2540                 u8 tsc[IW_ENCODE_SEQ_MAX_SIZE];
2541         } __attribute__ ((packed)) buf;
2542         int ret;
2543         int err;
2544         int k;
2545         u16 xmitting;
2546
2547         key_idx &= 0x3;
2548
2549         if (set_tx)
2550                 key_idx |= 0x8000;
2551
2552         buf.idx = cpu_to_le16(key_idx);
2553         memcpy(buf.key, key,
2554                sizeof(buf.key) + sizeof(buf.tx_mic) + sizeof(buf.rx_mic));
2555
2556         if (rsc == NULL)
2557                 memset(buf.rsc, 0, sizeof(buf.rsc));
2558         else
2559                 memcpy(buf.rsc, rsc, sizeof(buf.rsc));
2560
2561         if (tsc == NULL) {
2562                 memset(buf.tsc, 0, sizeof(buf.tsc));
2563                 buf.tsc[4] = 0x10;
2564         } else {
2565                 memcpy(buf.tsc, tsc, sizeof(buf.tsc));
2566         }
2567
2568         /* Wait upto 100ms for tx queue to empty */
2569         k = 100;
2570         do {
2571                 k--;
2572                 udelay(1000);
2573                 ret = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_TXQUEUEEMPTY,
2574                                           &xmitting);
2575                 if (ret)
2576                         break;
2577         } while ((k > 0) && xmitting);
2578
2579         if (k == 0)
2580                 ret = -ETIMEDOUT;
2581
2582         err = HERMES_WRITE_RECORD(hw, USER_BAP,
2583                                   HERMES_RID_CNFADDDEFAULTTKIPKEY_AGERE,
2584                                   &buf);
2585
2586         return ret ? ret : err;
2587 }
2588
2589 static int orinoco_clear_tkip_key(struct orinoco_private *priv,
2590                                   int key_idx)
2591 {
2592         hermes_t *hw = &priv->hw;
2593         int err;
2594
2595         memset(&priv->tkip_key[key_idx], 0, sizeof(priv->tkip_key[key_idx]));
2596         err = hermes_write_wordrec(hw, USER_BAP,
2597                                    HERMES_RID_CNFREMDEFAULTTKIPKEY_AGERE,
2598                                    key_idx);
2599         if (err)
2600                 printk(KERN_WARNING "%s: Error %d clearing TKIP key %d\n",
2601                        priv->ndev->name, err, key_idx);
2602         return err;
2603 }
2604
2605 static int __orinoco_program_rids(struct net_device *dev)
2606 {
2607         struct orinoco_private *priv = netdev_priv(dev);
2608         hermes_t *hw = &priv->hw;
2609         int err;
2610         struct hermes_idstring idbuf;
2611
2612         /* Set the MAC address */
2613         err = hermes_write_ltv(hw, USER_BAP, HERMES_RID_CNFOWNMACADDR,
2614                                HERMES_BYTES_TO_RECLEN(ETH_ALEN), dev->dev_addr);
2615         if (err) {
2616                 printk(KERN_ERR "%s: Error %d setting MAC address\n",
2617                        dev->name, err);
2618                 return err;
2619         }
2620
2621         /* Set up the link mode */
2622         err = hermes_write_wordrec(hw, USER_BAP, HERMES_RID_CNFPORTTYPE,
2623                                    priv->port_type);
2624         if (err) {
2625                 printk(KERN_ERR "%s: Error %d setting port type\n",
2626                        dev->name, err);
2627                 return err;
2628         }
2629         /* Set the channel/frequency */
2630         if (priv->channel != 0 && priv->iw_mode != IW_MODE_INFRA) {
2631                 err = hermes_write_wordrec(hw, USER_BAP,
2632                                            HERMES_RID_CNFOWNCHANNEL,
2633                                            priv->channel);
2634                 if (err) {
2635                         printk(KERN_ERR "%s: Error %d setting channel %d\n",
2636                                dev->name, err, priv->channel);
2637                         return err;
2638                 }
2639         }
2640
2641         if (priv->has_ibss) {
2642                 u16 createibss;
2643
2644                 if ((strlen(priv->desired_essid) == 0) && (priv->createibss)) {
2645                         printk(KERN_WARNING "%s: This firmware requires an "
2646                                "ESSID in IBSS-Ad-Hoc mode.\n", dev->name);
2647                         /* With wvlan_cs, in this case, we would crash.
2648                          * hopefully, this driver will behave better...
2649                          * Jean II */
2650                         createibss = 0;
2651                 } else {
2652                         createibss = priv->createibss;
2653                 }
2654
2655                 err = hermes_write_wordrec(hw, USER_BAP,
2656                                            HERMES_RID_CNFCREATEIBSS,
2657                                            createibss);
2658                 if (err) {
2659                         printk(KERN_ERR "%s: Error %d setting CREATEIBSS\n",
2660                                dev->name, err);
2661                         return err;
2662                 }
2663         }
2664
2665         /* Set the desired BSSID */
2666         err = __orinoco_hw_set_wap(priv);
2667         if (err) {
2668                 printk(KERN_ERR "%s: Error %d setting AP address\n",
2669                        dev->name, err);
2670                 return err;
2671         }
2672         /* Set the desired ESSID */
2673         idbuf.len = cpu_to_le16(strlen(priv->desired_essid));
2674         memcpy(&idbuf.val, priv->desired_essid, sizeof(idbuf.val));
2675         /* WinXP wants partner to configure OWNSSID even in IBSS mode. (jimc) */
2676         err = hermes_write_ltv(hw, USER_BAP, HERMES_RID_CNFOWNSSID,
2677                                HERMES_BYTES_TO_RECLEN(strlen(priv->desired_essid)+2),
2678                                &idbuf);
2679         if (err) {
2680                 printk(KERN_ERR "%s: Error %d setting OWNSSID\n",
2681                        dev->name, err);
2682                 return err;
2683         }
2684         err = hermes_write_ltv(hw, USER_BAP, HERMES_RID_CNFDESIREDSSID,
2685                                HERMES_BYTES_TO_RECLEN(strlen(priv->desired_essid)+2),
2686                                &idbuf);
2687         if (err) {
2688                 printk(KERN_ERR "%s: Error %d setting DESIREDSSID\n",
2689                        dev->name, err);
2690                 return err;
2691         }
2692
2693         /* Set the station name */
2694         idbuf.len = cpu_to_le16(strlen(priv->nick));
2695         memcpy(&idbuf.val, priv->nick, sizeof(idbuf.val));
2696         err = hermes_write_ltv(hw, USER_BAP, HERMES_RID_CNFOWNNAME,
2697                                HERMES_BYTES_TO_RECLEN(strlen(priv->nick)+2),
2698                                &idbuf);
2699         if (err) {
2700                 printk(KERN_ERR "%s: Error %d setting nickname\n",
2701                        dev->name, err);
2702                 return err;
2703         }
2704
2705         /* Set AP density */
2706         if (priv->has_sensitivity) {
2707                 err = hermes_write_wordrec(hw, USER_BAP,
2708                                            HERMES_RID_CNFSYSTEMSCALE,
2709                                            priv->ap_density);
2710                 if (err) {
2711                         printk(KERN_WARNING "%s: Error %d setting SYSTEMSCALE.  "
2712                                "Disabling sensitivity control\n",
2713                                dev->name, err);
2714
2715                         priv->has_sensitivity = 0;
2716                 }
2717         }
2718
2719         /* Set RTS threshold */
2720         err = hermes_write_wordrec(hw, USER_BAP, HERMES_RID_CNFRTSTHRESHOLD,
2721                                    priv->rts_thresh);
2722         if (err) {
2723                 printk(KERN_ERR "%s: Error %d setting RTS threshold\n",
2724                        dev->name, err);
2725                 return err;
2726         }
2727
2728         /* Set fragmentation threshold or MWO robustness */
2729         if (priv->has_mwo)
2730                 err = hermes_write_wordrec(hw, USER_BAP,
2731                                            HERMES_RID_CNFMWOROBUST_AGERE,
2732                                            priv->mwo_robust);
2733         else
2734                 err = hermes_write_wordrec(hw, USER_BAP,
2735                                            HERMES_RID_CNFFRAGMENTATIONTHRESHOLD,
2736                                            priv->frag_thresh);
2737         if (err) {
2738                 printk(KERN_ERR "%s: Error %d setting fragmentation\n",
2739                        dev->name, err);
2740                 return err;
2741         }
2742
2743         /* Set bitrate */
2744         err = __orinoco_hw_set_bitrate(priv);
2745         if (err) {
2746                 printk(KERN_ERR "%s: Error %d setting bitrate\n",
2747                        dev->name, err);
2748                 return err;
2749         }
2750
2751         /* Set power management */
2752         if (priv->has_pm) {
2753                 err = hermes_write_wordrec(hw, USER_BAP,
2754                                            HERMES_RID_CNFPMENABLED,
2755                                            priv->pm_on);
2756                 if (err) {
2757                         printk(KERN_ERR "%s: Error %d setting up PM\n",
2758                                dev->name, err);
2759                         return err;
2760                 }
2761
2762                 err = hermes_write_wordrec(hw, USER_BAP,
2763                                            HERMES_RID_CNFMULTICASTRECEIVE,
2764                                            priv->pm_mcast);
2765                 if (err) {
2766                         printk(KERN_ERR "%s: Error %d setting up PM\n",
2767                                dev->name, err);
2768                         return err;
2769                 }
2770                 err = hermes_write_wordrec(hw, USER_BAP,
2771                                            HERMES_RID_CNFMAXSLEEPDURATION,
2772                                            priv->pm_period);
2773                 if (err) {
2774                         printk(KERN_ERR "%s: Error %d setting up PM\n",
2775                                dev->name, err);
2776                         return err;
2777                 }
2778                 err = hermes_write_wordrec(hw, USER_BAP,
2779                                            HERMES_RID_CNFPMHOLDOVERDURATION,
2780                                            priv->pm_timeout);
2781                 if (err) {
2782                         printk(KERN_ERR "%s: Error %d setting up PM\n",
2783                                dev->name, err);
2784                         return err;
2785                 }
2786         }
2787
2788         /* Set preamble - only for Symbol so far... */
2789         if (priv->has_preamble) {
2790                 err = hermes_write_wordrec(hw, USER_BAP,
2791                                            HERMES_RID_CNFPREAMBLE_SYMBOL,
2792                                            priv->preamble);
2793                 if (err) {
2794                         printk(KERN_ERR "%s: Error %d setting preamble\n",
2795                                dev->name, err);
2796                         return err;
2797                 }
2798         }
2799
2800         /* Set up encryption */
2801         if (priv->has_wep || priv->has_wpa) {
2802                 err = __orinoco_hw_setup_enc(priv);
2803                 if (err) {
2804                         printk(KERN_ERR "%s: Error %d activating encryption\n",
2805                                dev->name, err);
2806                         return err;
2807                 }
2808         }
2809
2810         if (priv->iw_mode == IW_MODE_MONITOR) {
2811                 /* Enable monitor mode */
2812                 dev->type = ARPHRD_IEEE80211;
2813                 err = hermes_docmd_wait(hw, HERMES_CMD_TEST |
2814                                             HERMES_TEST_MONITOR, 0, NULL);
2815         } else {
2816                 /* Disable monitor mode */
2817                 dev->type = ARPHRD_ETHER;
2818                 err = hermes_docmd_wait(hw, HERMES_CMD_TEST |
2819                                             HERMES_TEST_STOP, 0, NULL);
2820         }
2821         if (err)
2822                 return err;
2823
2824         /* Set promiscuity / multicast*/
2825         priv->promiscuous = 0;
2826         priv->mc_count = 0;
2827
2828         /* FIXME: what about netif_tx_lock */
2829         __orinoco_set_multicast_list(dev);
2830
2831         return 0;
2832 }
2833
2834 /* FIXME: return int? */
2835 static void
2836 __orinoco_set_multicast_list(struct net_device *dev)
2837 {
2838         struct orinoco_private *priv = netdev_priv(dev);
2839         hermes_t *hw = &priv->hw;
2840         int err = 0;
2841         int promisc, mc_count;
2842
2843         /* The Hermes doesn't seem to have an allmulti mode, so we go
2844          * into promiscuous mode and let the upper levels deal. */
2845         if ( (dev->flags & IFF_PROMISC) || (dev->flags & IFF_ALLMULTI) ||
2846              (dev->mc_count > MAX_MULTICAST(priv)) ) {
2847                 promisc = 1;
2848                 mc_count = 0;
2849         } else {
2850                 promisc = 0;
2851                 mc_count = dev->mc_count;
2852         }
2853
2854         if (promisc != priv->promiscuous) {
2855                 err = hermes_write_wordrec(hw, USER_BAP,
2856                                            HERMES_RID_CNFPROMISCUOUSMODE,
2857                                            promisc);
2858                 if (err) {
2859                         printk(KERN_ERR "%s: Error %d setting PROMISCUOUSMODE to 1.\n",
2860                                dev->name, err);
2861                 } else
2862                         priv->promiscuous = promisc;
2863         }
2864
2865         /* If we're not in promiscuous mode, then we need to set the
2866          * group address if either we want to multicast, or if we were
2867          * multicasting and want to stop */
2868         if (! promisc && (mc_count || priv->mc_count) ) {
2869                 struct dev_mc_list *p = dev->mc_list;
2870                 struct hermes_multicast mclist;
2871                 int i;
2872
2873                 for (i = 0; i < mc_count; i++) {
2874                         /* paranoia: is list shorter than mc_count? */
2875                         BUG_ON(! p);
2876                         /* paranoia: bad address size in list? */
2877                         BUG_ON(p->dmi_addrlen != ETH_ALEN);
2878
2879                         memcpy(mclist.addr[i], p->dmi_addr, ETH_ALEN);
2880                         p = p->next;
2881                 }
2882
2883                 if (p)
2884                         printk(KERN_WARNING "%s: Multicast list is "
2885                                "longer than mc_count\n", dev->name);
2886
2887                 err = hermes_write_ltv(hw, USER_BAP,
2888                                    HERMES_RID_CNFGROUPADDRESSES,
2889                                    HERMES_BYTES_TO_RECLEN(mc_count * ETH_ALEN),
2890                                    &mclist);
2891                 if (err)
2892                         printk(KERN_ERR "%s: Error %d setting multicast list.\n",
2893                                dev->name, err);
2894                 else
2895                         priv->mc_count = mc_count;
2896         }
2897 }
2898
2899 /* This must be called from user context, without locks held - use
2900  * schedule_work() */
2901 static void orinoco_reset(struct work_struct *work)
2902 {
2903         struct orinoco_private *priv =
2904                 container_of(work, struct orinoco_private, reset_work);
2905         struct net_device *dev = priv->ndev;
2906         struct hermes *hw = &priv->hw;
2907         int err;
2908         unsigned long flags;
2909
2910         if (orinoco_lock(priv, &flags) != 0)
2911                 /* When the hardware becomes available again, whatever
2912                  * detects that is responsible for re-initializing
2913                  * it. So no need for anything further */
2914                 return;
2915
2916         netif_stop_queue(dev);
2917
2918         /* Shut off interrupts.  Depending on what state the hardware
2919          * is in, this might not work, but we'll try anyway */
2920         hermes_set_irqmask(hw, 0);
2921         hermes_write_regn(hw, EVACK, 0xffff);
2922
2923         priv->hw_unavailable++;
2924         priv->last_linkstatus = 0xffff; /* firmware will have to reassociate */
2925         netif_carrier_off(dev);
2926
2927         orinoco_unlock(priv, &flags);
2928
2929         /* Scanning support: Cleanup of driver struct */
2930         orinoco_clear_scan_results(priv, 0);
2931         priv->scan_inprogress = 0;
2932
2933         if (priv->hard_reset) {
2934                 err = (*priv->hard_reset)(priv);
2935                 if (err) {
2936                         printk(KERN_ERR "%s: orinoco_reset: Error %d "
2937                                "performing hard reset\n", dev->name, err);
2938                         goto disable;
2939                 }
2940         }
2941
2942         err = orinoco_reinit_firmware(dev);
2943         if (err) {
2944                 printk(KERN_ERR "%s: orinoco_reset: Error %d re-initializing firmware\n",
2945                        dev->name, err);
2946                 goto disable;
2947         }
2948
2949         spin_lock_irq(&priv->lock); /* This has to be called from user context */
2950
2951         priv->hw_unavailable--;
2952
2953         /* priv->open or priv->hw_unavailable might have changed while
2954          * we dropped the lock */
2955         if (priv->open && (! priv->hw_unavailable)) {
2956                 err = __orinoco_up(dev);
2957                 if (err) {
2958                         printk(KERN_ERR "%s: orinoco_reset: Error %d reenabling card\n",
2959                                dev->name, err);
2960                 } else
2961                         dev->trans_start = jiffies;
2962         }
2963
2964         spin_unlock_irq(&priv->lock);
2965
2966         return;
2967  disable:
2968         hermes_set_irqmask(hw, 0);
2969         netif_device_detach(dev);
2970         printk(KERN_ERR "%s: Device has been disabled!\n", dev->name);
2971 }
2972
2973 /********************************************************************/
2974 /* Interrupt handler                                                */
2975 /********************************************************************/
2976
2977 static void __orinoco_ev_tick(struct net_device *dev, hermes_t *hw)
2978 {
2979         printk(KERN_DEBUG "%s: TICK\n", dev->name);
2980 }
2981
2982 static void __orinoco_ev_wterr(struct net_device *dev, hermes_t *hw)
2983 {
2984         /* This seems to happen a fair bit under load, but ignoring it
2985            seems to work fine...*/
2986         printk(KERN_DEBUG "%s: MAC controller error (WTERR). Ignoring.\n",
2987                dev->name);
2988 }
2989
2990 irqreturn_t orinoco_interrupt(int irq, void *dev_id)
2991 {
2992         struct net_device *dev = dev_id;
2993         struct orinoco_private *priv = netdev_priv(dev);
2994         hermes_t *hw = &priv->hw;
2995         int count = MAX_IRQLOOPS_PER_IRQ;
2996         u16 evstat, events;
2997         /* These are used to detect a runaway interrupt situation */
2998         /* If we get more than MAX_IRQLOOPS_PER_JIFFY iterations in a jiffy,
2999          * we panic and shut down the hardware */
3000         static int last_irq_jiffy = 0; /* jiffies value the last time
3001                                         * we were called */
3002         static int loops_this_jiffy = 0;
3003         unsigned long flags;
3004
3005         if (orinoco_lock(priv, &flags) != 0) {
3006                 /* If hw is unavailable - we don't know if the irq was
3007                  * for us or not */
3008                 return IRQ_HANDLED;
3009         }
3010
3011         evstat = hermes_read_regn(hw, EVSTAT);
3012         events = evstat & hw->inten;
3013         if (! events) {
3014                 orinoco_unlock(priv, &flags);
3015                 return IRQ_NONE;
3016         }
3017
3018         if (jiffies != last_irq_jiffy)
3019                 loops_this_jiffy = 0;
3020         last_irq_jiffy = jiffies;
3021
3022         while (events && count--) {
3023                 if (++loops_this_jiffy > MAX_IRQLOOPS_PER_JIFFY) {
3024                         printk(KERN_WARNING "%s: IRQ handler is looping too "
3025                                "much! Resetting.\n", dev->name);
3026                         /* Disable interrupts for now */
3027                         hermes_set_irqmask(hw, 0);
3028                         schedule_work(&priv->reset_work);
3029                         break;
3030                 }
3031
3032                 /* Check the card hasn't been removed */
3033                 if (! hermes_present(hw)) {
3034                         DEBUG(0, "orinoco_interrupt(): card removed\n");
3035                         break;
3036                 }
3037
3038                 if (events & HERMES_EV_TICK)
3039                         __orinoco_ev_tick(dev, hw);
3040                 if (events & HERMES_EV_WTERR)
3041                         __orinoco_ev_wterr(dev, hw);
3042                 if (events & HERMES_EV_INFDROP)
3043                         __orinoco_ev_infdrop(dev, hw);
3044                 if (events & HERMES_EV_INFO)
3045                         __orinoco_ev_info(dev, hw);
3046                 if (events & HERMES_EV_RX)
3047                         __orinoco_ev_rx(dev, hw);
3048                 if (events & HERMES_EV_TXEXC)
3049                         __orinoco_ev_txexc(dev, hw);
3050                 if (events & HERMES_EV_TX)
3051                         __orinoco_ev_tx(dev, hw);
3052                 if (events & HERMES_EV_ALLOC)
3053                         __orinoco_ev_alloc(dev, hw);
3054
3055                 hermes_write_regn(hw, EVACK, evstat);
3056
3057                 evstat = hermes_read_regn(hw, EVSTAT);
3058                 events = evstat & hw->inten;
3059         };
3060
3061         orinoco_unlock(priv, &flags);
3062         return IRQ_HANDLED;
3063 }
3064
3065 /********************************************************************/
3066 /* Initialization                                                   */
3067 /********************************************************************/
3068
3069 struct comp_id {
3070         u16 id, variant, major, minor;
3071 } __attribute__ ((packed));
3072
3073 static inline fwtype_t determine_firmware_type(struct comp_id *nic_id)
3074 {
3075         if (nic_id->id < 0x8000)
3076                 return FIRMWARE_TYPE_AGERE;
3077         else if (nic_id->id == 0x8000 && nic_id->major == 0)
3078                 return FIRMWARE_TYPE_SYMBOL;
3079         else
3080                 return FIRMWARE_TYPE_INTERSIL;
3081 }
3082
3083 /* Set priv->firmware type, determine firmware properties */
3084 static int determine_firmware(struct net_device *dev)
3085 {
3086         struct orinoco_private *priv = netdev_priv(dev);
3087         hermes_t *hw = &priv->hw;
3088         int err;
3089         struct comp_id nic_id, sta_id;
3090         unsigned int firmver;
3091         char tmp[SYMBOL_MAX_VER_LEN+1] __attribute__((aligned(2)));
3092
3093         /* Get the hardware version */
3094         err = HERMES_READ_RECORD(hw, USER_BAP, HERMES_RID_NICID, &nic_id);
3095         if (err) {
3096                 printk(KERN_ERR "%s: Cannot read hardware identity: error %d\n",
3097                        dev->name, err);
3098                 return err;
3099         }
3100
3101         le16_to_cpus(&nic_id.id);
3102         le16_to_cpus(&nic_id.variant);
3103         le16_to_cpus(&nic_id.major);
3104         le16_to_cpus(&nic_id.minor);
3105         printk(KERN_DEBUG "%s: Hardware identity %04x:%04x:%04x:%04x\n",
3106                dev->name, nic_id.id, nic_id.variant,
3107                nic_id.major, nic_id.minor);
3108
3109         priv->firmware_type = determine_firmware_type(&nic_id);
3110
3111         /* Get the firmware version */
3112         err = HERMES_READ_RECORD(hw, USER_BAP, HERMES_RID_STAID, &sta_id);
3113         if (err) {
3114                 printk(KERN_ERR "%s: Cannot read station identity: error %d\n",
3115                        dev->name, err);
3116                 return err;
3117         }
3118
3119         le16_to_cpus(&sta_id.id);
3120         le16_to_cpus(&sta_id.variant);
3121         le16_to_cpus(&sta_id.major);
3122         le16_to_cpus(&sta_id.minor);
3123         printk(KERN_DEBUG "%s: Station identity  %04x:%04x:%04x:%04x\n",
3124                dev->name, sta_id.id, sta_id.variant,
3125                sta_id.major, sta_id.minor);
3126
3127         switch (sta_id.id) {
3128         case 0x15:
3129                 printk(KERN_ERR "%s: Primary firmware is active\n",
3130                        dev->name);
3131                 return -ENODEV;
3132         case 0x14b:
3133                 printk(KERN_ERR "%s: Tertiary firmware is active\n",
3134                        dev->name);
3135                 return -ENODEV;
3136         case 0x1f:      /* Intersil, Agere, Symbol Spectrum24 */
3137         case 0x21:      /* Symbol Spectrum24 Trilogy */
3138                 break;
3139         default:
3140                 printk(KERN_NOTICE "%s: Unknown station ID, please report\n",
3141                        dev->name);
3142                 break;
3143         }
3144
3145         /* Default capabilities */
3146         priv->has_sensitivity = 1;
3147         priv->has_mwo = 0;
3148         priv->has_preamble = 0;
3149         priv->has_port3 = 1;
3150         priv->has_ibss = 1;
3151         priv->has_wep = 0;
3152         priv->has_big_wep = 0;
3153         priv->has_alt_txcntl = 0;
3154         priv->has_ext_scan = 0;
3155         priv->has_wpa = 0;
3156         priv->do_fw_download = 0;
3157
3158         /* Determine capabilities from the firmware version */
3159         switch (priv->firmware_type) {
3160         case FIRMWARE_TYPE_AGERE:
3161                 /* Lucent Wavelan IEEE, Lucent Orinoco, Cabletron RoamAbout,
3162                    ELSA, Melco, HP, IBM, Dell 1150, Compaq 110/210 */
3163                 snprintf(priv->fw_name, sizeof(priv->fw_name) - 1,
3164                          "Lucent/Agere %d.%02d", sta_id.major, sta_id.minor);
3165
3166                 firmver = ((unsigned long)sta_id.major << 16) | sta_id.minor;
3167
3168                 priv->has_ibss = (firmver >= 0x60006);
3169                 priv->has_wep = (firmver >= 0x40020);
3170                 priv->has_big_wep = 1; /* FIXME: this is wrong - how do we tell
3171                                           Gold cards from the others? */
3172                 priv->has_mwo = (firmver >= 0x60000);
3173                 priv->has_pm = (firmver >= 0x40020); /* Don't work in 7.52 ? */
3174                 priv->ibss_port = 1;
3175                 priv->has_hostscan = (firmver >= 0x8000a);
3176                 priv->do_fw_download = 1;
3177                 priv->broken_monitor = (firmver >= 0x80000);
3178                 priv->has_alt_txcntl = (firmver >= 0x90000); /* All 9.x ? */
3179                 priv->has_ext_scan = (firmver >= 0x90000); /* All 9.x ? */
3180                 priv->has_wpa = (firmver >= 0x9002a);
3181                 /* Tested with Agere firmware :
3182                  *      1.16 ; 4.08 ; 4.52 ; 6.04 ; 6.16 ; 7.28 => Jean II
3183                  * Tested CableTron firmware : 4.32 => Anton */
3184                 break;
3185         case FIRMWARE_TYPE_SYMBOL:
3186                 /* Symbol , 3Com AirConnect, Intel, Ericsson WLAN */
3187                 /* Intel MAC : 00:02:B3:* */
3188                 /* 3Com MAC : 00:50:DA:* */
3189                 memset(tmp, 0, sizeof(tmp));
3190                 /* Get the Symbol firmware version */
3191                 err = hermes_read_ltv(hw, USER_BAP,
3192                                       HERMES_RID_SECONDARYVERSION_SYMBOL,
3193                                       SYMBOL_MAX_VER_LEN, NULL, &tmp);
3194                 if (err) {
3195                         printk(KERN_WARNING
3196                                "%s: Error %d reading Symbol firmware info. Wildly guessing capabilities...\n",
3197                                dev->name, err);
3198                         firmver = 0;
3199                         tmp[0] = '\0';
3200                 } else {
3201                         /* The firmware revision is a string, the format is
3202                          * something like : "V2.20-01".
3203                          * Quick and dirty parsing... - Jean II
3204                          */
3205                         firmver = ((tmp[1] - '0') << 16) | ((tmp[3] - '0') << 12)
3206                                 | ((tmp[4] - '0') << 8) | ((tmp[6] - '0') << 4)
3207                                 | (tmp[7] - '0');
3208
3209                         tmp[SYMBOL_MAX_VER_LEN] = '\0';
3210                 }
3211
3212                 snprintf(priv->fw_name, sizeof(priv->fw_name) - 1,
3213                          "Symbol %s", tmp);
3214
3215                 priv->has_ibss = (firmver >= 0x20000);
3216                 priv->has_wep = (firmver >= 0x15012);
3217                 priv->has_big_wep = (firmver >= 0x20000);
3218                 priv->has_pm = (firmver >= 0x20000 && firmver < 0x22000) ||
3219                                (firmver >= 0x29000 && firmver < 0x30000) ||
3220                                firmver >= 0x31000;
3221                 priv->has_preamble = (firmver >= 0x20000);
3222                 priv->ibss_port = 4;
3223
3224                 /* Symbol firmware is found on various cards, but
3225                  * there has been no attempt to check firmware
3226                  * download on non-spectrum_cs based cards.
3227                  *
3228                  * Given that the Agere firmware download works
3229                  * differently, we should avoid doing a firmware
3230                  * download with the Symbol algorithm on non-spectrum
3231                  * cards.
3232                  *
3233                  * For now we can identify a spectrum_cs based card
3234                  * because it has a firmware reset function.
3235                  */
3236                 priv->do_fw_download = (priv->stop_fw != NULL);
3237
3238                 priv->broken_disableport = (firmver == 0x25013) ||
3239                                            (firmver >= 0x30000 && firmver <= 0x31000);
3240                 priv->has_hostscan = (firmver >= 0x31001) ||
3241                                      (firmver >= 0x29057 && firmver < 0x30000);
3242                 /* Tested with Intel firmware : 0x20015 => Jean II */
3243                 /* Tested with 3Com firmware : 0x15012 & 0x22001 => Jean II */
3244                 break;
3245         case FIRMWARE_TYPE_INTERSIL:
3246                 /* D-Link, Linksys, Adtron, ZoomAir, and many others...
3247                  * Samsung, Compaq 100/200 and Proxim are slightly
3248                  * different and less well tested */
3249                 /* D-Link MAC : 00:40:05:* */
3250                 /* Addtron MAC : 00:90:D1:* */
3251                 snprintf(priv->fw_name, sizeof(priv->fw_name) - 1,
3252                          "Intersil %d.%d.%d", sta_id.major, sta_id.minor,
3253                          sta_id.variant);
3254
3255                 firmver = ((unsigned long)sta_id.major << 16) |
3256                         ((unsigned long)sta_id.minor << 8) | sta_id.variant;
3257
3258                 priv->has_ibss = (firmver >= 0x000700); /* FIXME */
3259                 priv->has_big_wep = priv->has_wep = (firmver >= 0x000800);
3260                 priv->has_pm = (firmver >= 0x000700);
3261                 priv->has_hostscan = (firmver >= 0x010301);
3262
3263                 if (firmver >= 0x000800)
3264                         priv->ibss_port = 0;
3265                 else {
3266                         printk(KERN_NOTICE "%s: Intersil firmware earlier "
3267                                "than v0.8.x - several features not supported\n",
3268                                dev->name);
3269                         priv->ibss_port = 1;
3270                 }
3271                 break;
3272         }
3273         printk(KERN_DEBUG "%s: Firmware determined as %s\n", dev->name,
3274                priv->fw_name);
3275
3276         return 0;
3277 }
3278
3279 static int orinoco_init(struct net_device *dev)
3280 {
3281         struct orinoco_private *priv = netdev_priv(dev);
3282         hermes_t *hw = &priv->hw;
3283         int err = 0;
3284         struct hermes_idstring nickbuf;
3285         u16 reclen;
3286         int len;
3287
3288         /* No need to lock, the hw_unavailable flag is already set in
3289          * alloc_orinocodev() */
3290         priv->nicbuf_size = IEEE80211_FRAME_LEN + ETH_HLEN;
3291
3292         /* Initialize the firmware */
3293         err = hermes_init(hw);
3294         if (err != 0) {
3295                 printk(KERN_ERR "%s: failed to initialize firmware (err = %d)\n",
3296                        dev->name, err);
3297                 goto out;
3298         }
3299
3300         err = determine_firmware(dev);
3301         if (err != 0) {
3302                 printk(KERN_ERR "%s: Incompatible firmware, aborting\n",
3303                        dev->name);
3304                 goto out;
3305         }
3306
3307         if (priv->do_fw_download) {
3308                 err = orinoco_download(priv);
3309                 if (err)
3310                         priv->do_fw_download = 0;
3311
3312                 /* Check firmware version again */
3313                 err = determine_firmware(dev);
3314                 if (err != 0) {
3315                         printk(KERN_ERR "%s: Incompatible firmware, aborting\n",
3316                                dev->name);
3317                         goto out;
3318                 }
3319         }
3320
3321         if (priv->has_port3)
3322                 printk(KERN_DEBUG "%s: Ad-hoc demo mode supported\n", dev->name);
3323         if (priv->has_ibss)
3324                 printk(KERN_DEBUG "%s: IEEE standard IBSS ad-hoc mode supported\n",
3325                        dev->name);
3326         if (priv->has_wep) {
3327                 printk(KERN_DEBUG "%s: WEP supported, ", dev->name);
3328                 if (priv->has_big_wep)
3329                         printk("104-bit key\n");
3330                 else
3331                         printk("40-bit key\n");
3332         }
3333         if (priv->has_wpa) {
3334                 printk(KERN_DEBUG "%s: WPA-PSK supported\n", dev->name);
3335                 if (orinoco_mic_init(priv)) {
3336                         printk(KERN_ERR "%s: Failed to setup MIC crypto "
3337                                "algorithm. Disabling WPA support\n", dev->name);
3338                         priv->has_wpa = 0;
3339                 }
3340         }
3341
3342         /* Now we have the firmware capabilities, allocate appropiate
3343          * sized scan buffers */
3344         if (orinoco_bss_data_allocate(priv))
3345                 goto out;
3346         orinoco_bss_data_init(priv);
3347
3348         /* Get the MAC address */
3349         err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CNFOWNMACADDR,
3350                               ETH_ALEN, NULL, dev->dev_addr);
3351         if (err) {
3352                 printk(KERN_WARNING "%s: failed to read MAC address!\n",
3353                        dev->name);
3354                 goto out;
3355         }
3356
3357         printk(KERN_DEBUG "%s: MAC address %pM\n",
3358                dev->name, dev->dev_addr);
3359
3360         /* Get the station name */
3361         err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CNFOWNNAME,
3362                               sizeof(nickbuf), &reclen, &nickbuf);
3363         if (err) {
3364                 printk(KERN_ERR "%s: failed to read station name\n",
3365                        dev->name);
3366                 goto out;
3367         }
3368         if (nickbuf.len)
3369                 len = min(IW_ESSID_MAX_SIZE, (int)le16_to_cpu(nickbuf.len));
3370         else
3371                 len = min(IW_ESSID_MAX_SIZE, 2 * reclen);
3372         memcpy(priv->nick, &nickbuf.val, len);
3373         priv->nick[len] = '\0';
3374
3375         printk(KERN_DEBUG "%s: Station name \"%s\"\n", dev->name, priv->nick);
3376
3377         err = orinoco_allocate_fid(dev);
3378         if (err) {
3379                 printk(KERN_ERR "%s: failed to allocate NIC buffer!\n",
3380                        dev->name);
3381                 goto out;
3382         }
3383
3384         /* Get allowed channels */
3385         err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_CHANNELLIST,
3386                                   &priv->channel_mask);
3387         if (err) {
3388                 printk(KERN_ERR "%s: failed to read channel list!\n",
3389                        dev->name);
3390                 goto out;
3391         }
3392
3393         /* Get initial AP density */
3394         err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_CNFSYSTEMSCALE,
3395                                   &priv->ap_density);
3396         if (err || priv->ap_density < 1 || priv->ap_density > 3) {
3397                 priv->has_sensitivity = 0;
3398         }
3399
3400         /* Get initial RTS threshold */
3401         err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_CNFRTSTHRESHOLD,
3402                                   &priv->rts_thresh);
3403         if (err) {
3404                 printk(KERN_ERR "%s: failed to read RTS threshold!\n",
3405                        dev->name);
3406                 goto out;
3407         }
3408
3409         /* Get initial fragmentation settings */
3410         if (priv->has_mwo)
3411                 err = hermes_read_wordrec(hw, USER_BAP,
3412                                           HERMES_RID_CNFMWOROBUST_AGERE,
3413                                           &priv->mwo_robust);
3414         else
3415                 err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_CNFFRAGMENTATIONTHRESHOLD,
3416                                           &priv->frag_thresh);
3417         if (err) {
3418                 printk(KERN_ERR "%s: failed to read fragmentation settings!\n",
3419                        dev->name);
3420                 goto out;
3421         }
3422
3423         /* Power management setup */
3424         if (priv->has_pm) {
3425                 priv->pm_on = 0;
3426                 priv->pm_mcast = 1;
3427                 err = hermes_read_wordrec(hw, USER_BAP,
3428                                           HERMES_RID_CNFMAXSLEEPDURATION,
3429                                           &priv->pm_period);
3430                 if (err) {
3431                         printk(KERN_ERR "%s: failed to read power management period!\n",
3432                                dev->name);
3433                         goto out;
3434                 }
3435                 err = hermes_read_wordrec(hw, USER_BAP,
3436                                           HERMES_RID_CNFPMHOLDOVERDURATION,
3437                                           &priv->pm_timeout);
3438                 if (err) {
3439                         printk(KERN_ERR "%s: failed to read power management timeout!\n",
3440                                dev->name);
3441                         goto out;
3442                 }
3443         }
3444
3445         /* Preamble setup */
3446         if (priv->has_preamble) {
3447                 err = hermes_read_wordrec(hw, USER_BAP,
3448                                           HERMES_RID_CNFPREAMBLE_SYMBOL,
3449                                           &priv->preamble);
3450                 if (err)
3451                         goto out;
3452         }
3453
3454         /* Set up the default configuration */
3455         priv->iw_mode = IW_MODE_INFRA;
3456         /* By default use IEEE/IBSS ad-hoc mode if we have it */
3457         priv->prefer_port3 = priv->has_port3 && (! priv->has_ibss);
3458         set_port_type(priv);
3459         priv->channel = 0; /* use firmware default */
3460
3461         priv->promiscuous = 0;
3462         priv->encode_alg = IW_ENCODE_ALG_NONE;
3463         priv->tx_key = 0;
3464         priv->wpa_enabled = 0;
3465         priv->tkip_cm_active = 0;
3466         priv->key_mgmt = 0;
3467         priv->wpa_ie_len = 0;
3468         priv->wpa_ie = NULL;
3469
3470         /* Make the hardware available, as long as it hasn't been
3471          * removed elsewhere (e.g. by PCMCIA hot unplug) */
3472         spin_lock_irq(&priv->lock);
3473         priv->hw_unavailable--;
3474         spin_unlock_irq(&priv->lock);
3475
3476         printk(KERN_DEBUG "%s: ready\n", dev->name);
3477
3478  out:
3479         return err;
3480 }
3481
3482 struct net_device
3483 *alloc_orinocodev(int sizeof_card,
3484                   struct device *device,
3485                   int (*hard_reset)(struct orinoco_private *),
3486                   int (*stop_fw)(struct orinoco_private *, int))
3487 {
3488         struct net_device *dev;
3489         struct orinoco_private *priv;
3490
3491         dev = alloc_etherdev(sizeof(struct orinoco_private) + sizeof_card);
3492         if (! dev)
3493                 return NULL;
3494         priv = netdev_priv(dev);
3495         priv->ndev = dev;
3496         if (sizeof_card)
3497                 priv->card = (void *)((unsigned long)priv
3498                                       + sizeof(struct orinoco_private));
3499         else
3500                 priv->card = NULL;
3501         priv->dev = device;
3502
3503         /* Setup / override net_device fields */
3504         dev->init = orinoco_init;
3505         dev->hard_start_xmit = orinoco_xmit;
3506         dev->tx_timeout = orinoco_tx_timeout;
3507         dev->watchdog_timeo = HZ; /* 1 second timeout */
3508         dev->get_stats = orinoco_get_stats;
3509         dev->ethtool_ops = &orinoco_ethtool_ops;
3510         dev->wireless_handlers = (struct iw_handler_def *)&orinoco_handler_def;
3511 #ifdef WIRELESS_SPY
3512         priv->wireless_data.spy_data = &priv->spy_data;
3513         dev->wireless_data = &priv->wireless_data;
3514 #endif
3515         dev->change_mtu = orinoco_change_mtu;
3516         dev->set_multicast_list = orinoco_set_multicast_list;
3517         /* we use the default eth_mac_addr for setting the MAC addr */
3518
3519         /* Reserve space in skb for the SNAP header */
3520         dev->hard_header_len += ENCAPS_OVERHEAD;
3521
3522         /* Set up default callbacks */
3523         dev->open = orinoco_open;
3524         dev->stop = orinoco_stop;
3525         priv->hard_reset = hard_reset;
3526         priv->stop_fw = stop_fw;
3527
3528         spin_lock_init(&priv->lock);
3529         priv->open = 0;
3530         priv->hw_unavailable = 1; /* orinoco_init() must clear this
3531                                    * before anything else touches the
3532                                    * hardware */
3533         INIT_WORK(&priv->reset_work, orinoco_reset);
3534         INIT_WORK(&priv->join_work, orinoco_join_ap);
3535         INIT_WORK(&priv->wevent_work, orinoco_send_wevents);
3536
3537         INIT_LIST_HEAD(&priv->rx_list);
3538         tasklet_init(&priv->rx_tasklet, orinoco_rx_isr_tasklet,
3539                      (unsigned long) dev);
3540
3541         netif_carrier_off(dev);
3542         priv->last_linkstatus = 0xffff;
3543
3544         priv->cached_fw = NULL;
3545
3546         return dev;
3547 }
3548
3549 void free_orinocodev(struct net_device *dev)
3550 {
3551         struct orinoco_private *priv = netdev_priv(dev);
3552
3553         /* No need to empty priv->rx_list: if the tasklet is scheduled
3554          * when we call tasklet_kill it will run one final time,
3555          * emptying the list */
3556         tasklet_kill(&priv->rx_tasklet);
3557         if (priv->cached_fw)
3558                 release_firmware(priv->cached_fw);
3559         priv->cached_fw = NULL;
3560         priv->wpa_ie_len = 0;
3561         kfree(priv->wpa_ie);
3562         orinoco_mic_free(priv);
3563         orinoco_bss_data_free(priv);
3564         free_netdev(dev);
3565 }
3566
3567 /********************************************************************/
3568 /* Wireless extensions                                              */
3569 /********************************************************************/
3570
3571 /* Return : < 0 -> error code ; >= 0 -> length */
3572 static int orinoco_hw_get_essid(struct orinoco_private *priv, int *active,
3573                                 char buf[IW_ESSID_MAX_SIZE+1])
3574 {
3575         hermes_t *hw = &priv->hw;
3576         int err = 0;
3577         struct hermes_idstring essidbuf;
3578         char *p = (char *)(&essidbuf.val);
3579         int len;
3580         unsigned long flags;
3581
3582         if (orinoco_lock(priv, &flags) != 0)
3583                 return -EBUSY;
3584
3585         if (strlen(priv->desired_essid) > 0) {
3586                 /* We read the desired SSID from the hardware rather
3587                    than from priv->desired_essid, just in case the
3588                    firmware is allowed to change it on us. I'm not
3589                    sure about this */
3590                 /* My guess is that the OWNSSID should always be whatever
3591                  * we set to the card, whereas CURRENT_SSID is the one that
3592                  * may change... - Jean II */
3593                 u16 rid;
3594
3595                 *active = 1;
3596
3597                 rid = (priv->port_type == 3) ? HERMES_RID_CNFOWNSSID :
3598                         HERMES_RID_CNFDESIREDSSID;
3599
3600                 err = hermes_read_ltv(hw, USER_BAP, rid, sizeof(essidbuf),
3601                                       NULL, &essidbuf);
3602                 if (err)
3603                         goto fail_unlock;
3604         } else {
3605                 *active = 0;
3606
3607                 err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CURRENTSSID,
3608                                       sizeof(essidbuf), NULL, &essidbuf);
3609                 if (err)
3610                         goto fail_unlock;
3611         }
3612
3613         len = le16_to_cpu(essidbuf.len);
3614         BUG_ON(len > IW_ESSID_MAX_SIZE);
3615
3616         memset(buf, 0, IW_ESSID_MAX_SIZE);
3617         memcpy(buf, p, len);
3618         err = len;
3619
3620  fail_unlock:
3621         orinoco_unlock(priv, &flags);
3622
3623         return err;
3624 }
3625
3626 static long orinoco_hw_get_freq(struct orinoco_private *priv)
3627 {
3628
3629         hermes_t *hw = &priv->hw;
3630         int err = 0;
3631         u16 channel;
3632         long freq = 0;
3633         unsigned long flags;
3634
3635         if (orinoco_lock(priv, &flags) != 0)
3636                 return -EBUSY;
3637
3638         err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_CURRENTCHANNEL, &channel);
3639         if (err)
3640                 goto out;
3641
3642         /* Intersil firmware 1.3.5 returns 0 when the interface is down */
3643         if (channel == 0) {
3644                 err = -EBUSY;
3645                 goto out;
3646         }
3647
3648         if ( (channel < 1) || (channel > NUM_CHANNELS) ) {
3649                 printk(KERN_WARNING "%s: Channel out of range (%d)!\n",
3650                        priv->ndev->name, channel);
3651                 err = -EBUSY;
3652                 goto out;
3653
3654         }
3655         freq = channel_frequency[channel-1] * 100000;
3656
3657  out:
3658         orinoco_unlock(priv, &flags);
3659
3660         if (err > 0)
3661                 err = -EBUSY;
3662         return err ? err : freq;
3663 }
3664
3665 static int orinoco_hw_get_bitratelist(struct orinoco_private *priv,
3666                                       int *numrates, s32 *rates, int max)
3667 {
3668         hermes_t *hw = &priv->hw;
3669         struct hermes_idstring list;
3670         unsigned char *p = (unsigned char *)&list.val;
3671         int err = 0;
3672         int num;
3673         int i;
3674         unsigned long flags;
3675
3676         if (orinoco_lock(priv, &flags) != 0)
3677                 return -EBUSY;
3678
3679         err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_SUPPORTEDDATARATES,
3680                               sizeof(list), NULL, &list);
3681         orinoco_unlock(priv, &flags);
3682
3683         if (err)
3684                 return err;
3685
3686         num = le16_to_cpu(list.len);
3687         *numrates = num;
3688         num = min(num, max);
3689
3690         for (i = 0; i < num; i++) {
3691                 rates[i] = (p[i] & 0x7f) * 500000; /* convert to bps */
3692         }
3693
3694         return 0;
3695 }
3696
3697 static int orinoco_ioctl_getname(struct net_device *dev,
3698                                  struct iw_request_info *info,
3699                                  char *name,
3700                                  char *extra)
3701 {
3702         struct orinoco_private *priv = netdev_priv(dev);
3703         int numrates;
3704         int err;
3705
3706         err = orinoco_hw_get_bitratelist(priv, &numrates, NULL, 0);
3707
3708         if (!err && (numrates > 2))
3709                 strcpy(name, "IEEE 802.11b");
3710         else
3711                 strcpy(name, "IEEE 802.11-DS");
3712
3713         return 0;
3714 }
3715
3716 static int orinoco_ioctl_setwap(struct net_device *dev,
3717                                 struct iw_request_info *info,
3718                                 struct sockaddr *ap_addr,
3719                                 char *extra)
3720 {
3721         struct orinoco_private *priv = netdev_priv(dev);
3722         int err = -EINPROGRESS;         /* Call commit handler */
3723         unsigned long flags;
3724         static const u8 off_addr[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
3725         static const u8 any_addr[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
3726
3727         if (orinoco_lock(priv, &flags) != 0)
3728                 return -EBUSY;
3729
3730         /* Enable automatic roaming - no sanity checks are needed */
3731         if (memcmp(&ap_addr->sa_data, off_addr, ETH_ALEN) == 0 ||
3732             memcmp(&ap_addr->sa_data, any_addr, ETH_ALEN) == 0) {
3733                 priv->bssid_fixed = 0;
3734                 memset(priv->desired_bssid, 0, ETH_ALEN);
3735
3736                 /* "off" means keep existing connection */
3737                 if (ap_addr->sa_data[0] == 0) {
3738                         __orinoco_hw_set_wap(priv);
3739                         err = 0;
3740                 }
3741                 goto out;
3742         }
3743
3744         if (priv->firmware_type == FIRMWARE_TYPE_AGERE) {
3745                 printk(KERN_WARNING "%s: Lucent/Agere firmware doesn't "
3746                        "support manual roaming\n",
3747                        dev->name);
3748                 err = -EOPNOTSUPP;
3749                 goto out;
3750         }
3751
3752         if (priv->iw_mode != IW_MODE_INFRA) {
3753                 printk(KERN_WARNING "%s: Manual roaming supported only in "
3754                        "managed mode\n", dev->name);
3755                 err = -EOPNOTSUPP;
3756                 goto out;
3757         }
3758
3759         /* Intersil firmware hangs without Desired ESSID */
3760         if (priv->firmware_type == FIRMWARE_TYPE_INTERSIL &&
3761             strlen(priv->desired_essid) == 0) {
3762                 printk(KERN_WARNING "%s: Desired ESSID must be set for "
3763                        "manual roaming\n", dev->name);
3764                 err = -EOPNOTSUPP;
3765                 goto out;
3766         }
3767
3768         /* Finally, enable manual roaming */
3769         priv->bssid_fixed = 1;
3770         memcpy(priv->desired_bssid, &ap_addr->sa_data, ETH_ALEN);
3771
3772  out:
3773         orinoco_unlock(priv, &flags);
3774         return err;
3775 }
3776
3777 static int orinoco_ioctl_getwap(struct net_device *dev,
3778                                 struct iw_request_info *info,
3779                                 struct sockaddr *ap_addr,
3780                                 char *extra)
3781 {
3782         struct orinoco_private *priv = netdev_priv(dev);
3783
3784         hermes_t *hw = &priv->hw;
3785         int err = 0;
3786         unsigned long flags;
3787
3788         if (orinoco_lock(priv, &flags) != 0)
3789                 return -EBUSY;
3790
3791         ap_addr->sa_family = ARPHRD_ETHER;
3792         err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CURRENTBSSID,
3793                               ETH_ALEN, NULL, ap_addr->sa_data);
3794
3795         orinoco_unlock(priv, &flags);
3796
3797         return err;
3798 }
3799
3800 static int orinoco_ioctl_setmode(struct net_device *dev,
3801                                  struct iw_request_info *info,
3802                                  u32 *mode,
3803                                  char *extra)
3804 {
3805         struct orinoco_private *priv = netdev_priv(dev);
3806         int err = -EINPROGRESS;         /* Call commit handler */
3807         unsigned long flags;
3808
3809         if (priv->iw_mode == *mode)
3810                 return 0;
3811
3812         if (orinoco_lock(priv, &flags) != 0)
3813                 return -EBUSY;
3814
3815         switch (*mode) {
3816         case IW_MODE_ADHOC:
3817                 if (!priv->has_ibss && !priv->has_port3)
3818                         err = -EOPNOTSUPP;
3819                 break;
3820
3821         case IW_MODE_INFRA:
3822                 break;
3823
3824         case IW_MODE_MONITOR:
3825                 if (priv->broken_monitor && !force_monitor) {
3826                         printk(KERN_WARNING "%s: Monitor mode support is "
3827                                "buggy in this firmware, not enabling\n",
3828                                dev->name);
3829                         err = -EOPNOTSUPP;
3830                 }
3831                 break;
3832
3833         default:
3834                 err = -EOPNOTSUPP;
3835                 break;
3836         }
3837
3838         if (err == -EINPROGRESS) {
3839                 priv->iw_mode = *mode;
3840                 set_port_type(priv);
3841         }
3842
3843         orinoco_unlock(priv, &flags);
3844
3845         return err;
3846 }
3847
3848 static int orinoco_ioctl_getmode(struct net_device *dev,
3849                                  struct iw_request_info *info,
3850                                  u32 *mode,
3851                                  char *extra)
3852 {
3853         struct orinoco_private *priv = netdev_priv(dev);
3854
3855         *mode = priv->iw_mode;
3856         return 0;
3857 }
3858
3859 static int orinoco_ioctl_getiwrange(struct net_device *dev,
3860                                     struct iw_request_info *info,
3861                                     struct iw_point *rrq,
3862                                     char *extra)
3863 {
3864         struct orinoco_private *priv = netdev_priv(dev);
3865         int err = 0;
3866         struct iw_range *range = (struct iw_range *) extra;
3867         int numrates;
3868         int i, k;
3869
3870         rrq->length = sizeof(struct iw_range);
3871         memset(range, 0, sizeof(struct iw_range));
3872
3873         range->we_version_compiled = WIRELESS_EXT;
3874         range->we_version_source = 22;
3875
3876         /* Set available channels/frequencies */
3877         range->num_channels = NUM_CHANNELS;
3878         k = 0;
3879         for (i = 0; i < NUM_CHANNELS; i++) {
3880                 if (priv->channel_mask & (1 << i)) {
3881                         range->freq[k].i = i + 1;
3882                         range->freq[k].m = channel_frequency[i] * 100000;
3883                         range->freq[k].e = 1;
3884                         k++;
3885                 }
3886
3887                 if (k >= IW_MAX_FREQUENCIES)
3888                         break;
3889         }
3890         range->num_frequency = k;
3891         range->sensitivity = 3;
3892
3893         if (priv->has_wep) {
3894                 range->max_encoding_tokens = ORINOCO_MAX_KEYS;
3895                 range->encoding_size[0] = SMALL_KEY_SIZE;
3896                 range->num_encoding_sizes = 1;
3897
3898                 if (priv->has_big_wep) {
3899                         range->encoding_size[1] = LARGE_KEY_SIZE;
3900                         range->num_encoding_sizes = 2;
3901                 }
3902         }
3903
3904         if (priv->has_wpa)
3905                 range->enc_capa = IW_ENC_CAPA_WPA | IW_ENC_CAPA_CIPHER_TKIP;
3906
3907         if ((priv->iw_mode == IW_MODE_ADHOC) && (!SPY_NUMBER(priv))){
3908                 /* Quality stats meaningless in ad-hoc mode */
3909         } else {
3910                 range->max_qual.qual = 0x8b - 0x2f;
3911                 range->max_qual.level = 0x2f - 0x95 - 1;
3912                 range->max_qual.noise = 0x2f - 0x95 - 1;
3913                 /* Need to get better values */
3914                 range->avg_qual.qual = 0x24;
3915                 range->avg_qual.level = 0xC2;
3916                 range->avg_qual.noise = 0x9E;
3917         }
3918
3919         err = orinoco_hw_get_bitratelist(priv, &numrates,
3920                                          range->bitrate, IW_MAX_BITRATES);
3921         if (err)
3922                 return err;
3923         range->num_bitrates = numrates;
3924
3925         /* Set an indication of the max TCP throughput in bit/s that we can
3926          * expect using this interface. May be use for QoS stuff...
3927          * Jean II */
3928         if (numrates > 2)
3929                 range->throughput = 5 * 1000 * 1000;    /* ~5 Mb/s */
3930         else
3931                 range->throughput = 1.5 * 1000 * 1000;  /* ~1.5 Mb/s */
3932
3933         range->min_rts = 0;
3934         range->max_rts = 2347;
3935         range->min_frag = 256;
3936         range->max_frag = 2346;
3937
3938         range->min_pmp = 0;
3939         range->max_pmp = 65535000;
3940         range->min_pmt = 0;
3941         range->max_pmt = 65535 * 1000;  /* ??? */
3942         range->pmp_flags = IW_POWER_PERIOD;
3943         range->pmt_flags = IW_POWER_TIMEOUT;
3944         range->pm_capa = IW_POWER_PERIOD | IW_POWER_TIMEOUT | IW_POWER_UNICAST_R;
3945
3946         range->retry_capa = IW_RETRY_LIMIT | IW_RETRY_LIFETIME;
3947         range->retry_flags = IW_RETRY_LIMIT;
3948         range->r_time_flags = IW_RETRY_LIFETIME;
3949         range->min_retry = 0;
3950         range->max_retry = 65535;       /* ??? */
3951         range->min_r_time = 0;
3952         range->max_r_time = 65535 * 1000;       /* ??? */
3953
3954         if (priv->firmware_type == FIRMWARE_TYPE_AGERE)
3955                 range->scan_capa = IW_SCAN_CAPA_ESSID;
3956         else
3957                 range->scan_capa = IW_SCAN_CAPA_NONE;
3958
3959         /* Event capability (kernel) */
3960         IW_EVENT_CAPA_SET_KERNEL(range->event_capa);
3961         /* Event capability (driver) */
3962         IW_EVENT_CAPA_SET(range->event_capa, SIOCGIWTHRSPY);
3963         IW_EVENT_CAPA_SET(range->event_capa, SIOCGIWAP);
3964         IW_EVENT_CAPA_SET(range->event_capa, SIOCGIWSCAN);
3965         IW_EVENT_CAPA_SET(range->event_capa, IWEVTXDROP);
3966
3967         return 0;
3968 }
3969
3970 static int orinoco_ioctl_setiwencode(struct net_device *dev,
3971                                      struct iw_request_info *info,
3972                                      struct iw_point *erq,
3973                                      char *keybuf)
3974 {
3975         struct orinoco_private *priv = netdev_priv(dev);
3976         int index = (erq->flags & IW_ENCODE_INDEX) - 1;
3977         int setindex = priv->tx_key;
3978         int encode_alg = priv->encode_alg;
3979         int restricted = priv->wep_restrict;
3980         u16 xlen = 0;
3981         int err = -EINPROGRESS;         /* Call commit handler */
3982         unsigned long flags;
3983
3984         if (! priv->has_wep)
3985                 return -EOPNOTSUPP;
3986
3987         if (erq->pointer) {
3988                 /* We actually have a key to set - check its length */
3989                 if (erq->length > LARGE_KEY_SIZE)
3990                         return -E2BIG;
3991
3992                 if ( (erq->length > SMALL_KEY_SIZE) && !priv->has_big_wep )
3993                         return -E2BIG;
3994         }
3995
3996         if (orinoco_lock(priv, &flags) != 0)
3997                 return -EBUSY;
3998
3999         /* Clear any TKIP key we have */
4000         if ((priv->has_wpa) && (priv->encode_alg == IW_ENCODE_ALG_TKIP))
4001                 (void) orinoco_clear_tkip_key(priv, setindex);
4002
4003         if (erq->length > 0) {
4004                 if ((index < 0) || (index >= ORINOCO_MAX_KEYS))
4005                         index = priv->tx_key;
4006
4007                 /* Adjust key length to a supported value */
4008                 if (erq->length > SMALL_KEY_SIZE) {
4009                         xlen = LARGE_KEY_SIZE;
4010                 } else if (erq->length > 0) {
4011                         xlen = SMALL_KEY_SIZE;
4012                 } else
4013                         xlen = 0;
4014
4015                 /* Switch on WEP if off */
4016                 if ((encode_alg != IW_ENCODE_ALG_WEP) && (xlen > 0)) {
4017                         setindex = index;
4018                         encode_alg = IW_ENCODE_ALG_WEP;
4019                 }
4020         } else {
4021                 /* Important note : if the user do "iwconfig eth0 enc off",
4022                  * we will arrive there with an index of -1. This is valid
4023                  * but need to be taken care off... Jean II */
4024                 if ((index < 0) || (index >= ORINOCO_MAX_KEYS)) {
4025                         if((index != -1) || (erq->flags == 0)) {
4026                                 err = -EINVAL;
4027                                 goto out;
4028                         }
4029                 } else {
4030                         /* Set the index : Check that the key is valid */
4031                         if(priv->keys[index].len == 0) {
4032                                 err = -EINVAL;
4033                                 goto out;
4034                         }
4035                         setindex = index;
4036                 }
4037         }
4038
4039         if (erq->flags & IW_ENCODE_DISABLED)
4040                 encode_alg = IW_ENCODE_ALG_NONE;
4041         if (erq->flags & IW_ENCODE_OPEN)
4042                 restricted = 0;
4043         if (erq->flags & IW_ENCODE_RESTRICTED)
4044                 restricted = 1;
4045
4046         if (erq->pointer && erq->length > 0) {
4047                 priv->keys[index].len = cpu_to_le16(xlen);
4048                 memset(priv->keys[index].data, 0,
4049                        sizeof(priv->keys[index].data));
4050                 memcpy(priv->keys[index].data, keybuf, erq->length);
4051         }
4052         priv->tx_key = setindex;
4053
4054         /* Try fast key change if connected and only keys are changed */
4055         if ((priv->encode_alg == encode_alg) &&
4056             (priv->wep_restrict == restricted) &&
4057             netif_carrier_ok(dev)) {
4058                 err = __orinoco_hw_setup_wepkeys(priv);
4059                 /* No need to commit if successful */
4060                 goto out;
4061         }
4062
4063         priv->encode_alg = encode_alg;
4064         priv->wep_restrict = restricted;
4065
4066  out:
4067         orinoco_unlock(priv, &flags);
4068
4069         return err;
4070 }
4071
4072 static int orinoco_ioctl_getiwencode(struct net_device *dev,
4073                                      struct iw_request_info *info,
4074                                      struct iw_point *erq,
4075                                      char *keybuf)
4076 {
4077         struct orinoco_private *priv = netdev_priv(dev);
4078         int index = (erq->flags & IW_ENCODE_INDEX) - 1;
4079         u16 xlen = 0;
4080         unsigned long flags;
4081
4082         if (! priv->has_wep)
4083                 return -EOPNOTSUPP;
4084
4085         if (orinoco_lock(priv, &flags) != 0)
4086                 return -EBUSY;
4087
4088         if ((index < 0) || (index >= ORINOCO_MAX_KEYS))
4089                 index = priv->tx_key;
4090
4091         erq->flags = 0;
4092         if (!priv->encode_alg)
4093                 erq->flags |= IW_ENCODE_DISABLED;
4094         erq->flags |= index + 1;
4095
4096         if (priv->wep_restrict)
4097                 erq->flags |= IW_ENCODE_RESTRICTED;
4098         else
4099                 erq->flags |= IW_ENCODE_OPEN;
4100
4101         xlen = le16_to_cpu(priv->keys[index].len);
4102
4103         erq->length = xlen;
4104
4105         memcpy(keybuf, priv->keys[index].data, ORINOCO_MAX_KEY_SIZE);
4106
4107         orinoco_unlock(priv, &flags);
4108         return 0;
4109 }
4110
4111 static int orinoco_ioctl_setessid(struct net_device *dev,
4112                                   struct iw_request_info *info,
4113                                   struct iw_point *erq,
4114                                   char *essidbuf)
4115 {
4116         struct orinoco_private *priv = netdev_priv(dev);
4117         unsigned long flags;
4118
4119         /* Note : ESSID is ignored in Ad-Hoc demo mode, but we can set it
4120          * anyway... - Jean II */
4121
4122         /* Hum... Should not use Wireless Extension constant (may change),
4123          * should use our own... - Jean II */
4124         if (erq->length > IW_ESSID_MAX_SIZE)
4125                 return -E2BIG;
4126
4127         if (orinoco_lock(priv, &flags) != 0)
4128                 return -EBUSY;
4129
4130         /* NULL the string (for NULL termination & ESSID = ANY) - Jean II */
4131         memset(priv->desired_essid, 0, sizeof(priv->desired_essid));
4132
4133         /* If not ANY, get the new ESSID */
4134         if (erq->flags) {
4135                 memcpy(priv->desired_essid, essidbuf, erq->length);
4136         }
4137
4138         orinoco_unlock(priv, &flags);
4139
4140         return -EINPROGRESS;            /* Call commit handler */
4141 }
4142
4143 static int orinoco_ioctl_getessid(struct net_device *dev,
4144                                   struct iw_request_info *info,
4145                                   struct iw_point *erq,
4146                                   char *essidbuf)
4147 {
4148         struct orinoco_private *priv = netdev_priv(dev);
4149         int active;
4150         int err = 0;
4151         unsigned long flags;
4152
4153         if (netif_running(dev)) {
4154                 err = orinoco_hw_get_essid(priv, &active, essidbuf);
4155                 if (err < 0)
4156                         return err;
4157                 erq->length = err;
4158         } else {
4159                 if (orinoco_lock(priv, &flags) != 0)
4160                         return -EBUSY;
4161                 memcpy(essidbuf, priv->desired_essid, IW_ESSID_MAX_SIZE);
4162                 erq->length = strlen(priv->desired_essid);
4163                 orinoco_unlock(priv, &flags);
4164         }
4165
4166         erq->flags = 1;
4167
4168         return 0;
4169 }
4170
4171 static int orinoco_ioctl_setnick(struct net_device *dev,
4172                                  struct iw_request_info *info,
4173                                  struct iw_point *nrq,
4174                                  char *nickbuf)
4175 {
4176         struct orinoco_private *priv = netdev_priv(dev);
4177         unsigned long flags;
4178
4179         if (nrq->length > IW_ESSID_MAX_SIZE)
4180                 return -E2BIG;
4181
4182         if (orinoco_lock(priv, &flags) != 0)
4183                 return -EBUSY;
4184
4185         memset(priv->nick, 0, sizeof(priv->nick));
4186         memcpy(priv->nick, nickbuf, nrq->length);
4187
4188         orinoco_unlock(priv, &flags);
4189
4190         return -EINPROGRESS;            /* Call commit handler */
4191 }
4192
4193 static int orinoco_ioctl_getnick(struct net_device *dev,
4194                                  struct iw_request_info *info,
4195                                  struct iw_point *nrq,
4196                                  char *nickbuf)
4197 {
4198         struct orinoco_private *priv = netdev_priv(dev);
4199         unsigned long flags;
4200
4201         if (orinoco_lock(priv, &flags) != 0)
4202                 return -EBUSY;
4203
4204         memcpy(nickbuf, priv->nick, IW_ESSID_MAX_SIZE);
4205         orinoco_unlock(priv, &flags);
4206
4207         nrq->length = strlen(priv->nick);
4208
4209         return 0;
4210 }
4211
4212 static int orinoco_ioctl_setfreq(struct net_device *dev,
4213                                  struct iw_request_info *info,
4214                                  struct iw_freq *frq,
4215                                  char *extra)
4216 {
4217         struct orinoco_private *priv = netdev_priv(dev);
4218         int chan = -1;
4219         unsigned long flags;
4220         int err = -EINPROGRESS;         /* Call commit handler */
4221
4222         /* In infrastructure mode the AP sets the channel */
4223         if (priv->iw_mode == IW_MODE_INFRA)
4224                 return -EBUSY;
4225
4226         if ( (frq->e == 0) && (frq->m <= 1000) ) {
4227                 /* Setting by channel number */
4228                 chan = frq->m;
4229         } else {
4230                 /* Setting by frequency - search the table */
4231                 int mult = 1;
4232                 int i;
4233
4234                 for (i = 0; i < (6 - frq->e); i++)
4235                         mult *= 10;
4236
4237                 for (i = 0; i < NUM_CHANNELS; i++)
4238                         if (frq->m == (channel_frequency[i] * mult))
4239                                 chan = i+1;
4240         }
4241
4242         if ( (chan < 1) || (chan > NUM_CHANNELS) ||
4243              ! (priv->channel_mask & (1 << (chan-1)) ) )
4244                 return -EINVAL;
4245
4246         if (orinoco_lock(priv, &flags) != 0)
4247                 return -EBUSY;
4248
4249         priv->channel = chan;
4250         if (priv->iw_mode == IW_MODE_MONITOR) {
4251                 /* Fast channel change - no commit if successful */
4252                 hermes_t *hw = &priv->hw;
4253                 err = hermes_docmd_wait(hw, HERMES_CMD_TEST |
4254                                             HERMES_TEST_SET_CHANNEL,
4255                                         chan, NULL);
4256         }
4257         orinoco_unlock(priv, &flags);
4258
4259         return err;
4260 }
4261
4262 static int orinoco_ioctl_getfreq(struct net_device *dev,
4263                                  struct iw_request_info *info,
4264                                  struct iw_freq *frq,
4265                                  char *extra)
4266 {
4267         struct orinoco_private *priv = netdev_priv(dev);
4268         int tmp;
4269
4270         /* Locking done in there */
4271         tmp = orinoco_hw_get_freq(priv);
4272         if (tmp < 0) {
4273                 return tmp;
4274         }
4275
4276         frq->m = tmp;
4277         frq->e = 1;
4278
4279         return 0;
4280 }
4281
4282 static int orinoco_ioctl_getsens(struct net_device *dev,
4283                                  struct iw_request_info *info,
4284                                  struct iw_param *srq,
4285                                  char *extra)
4286 {
4287         struct orinoco_private *priv = netdev_priv(dev);
4288         hermes_t *hw = &priv->hw;
4289         u16 val;
4290         int err;
4291         unsigned long flags;
4292
4293         if (!priv->has_sensitivity)
4294                 return -EOPNOTSUPP;
4295
4296         if (orinoco_lock(priv, &flags) != 0)
4297                 return -EBUSY;
4298         err = hermes_read_wordrec(hw, USER_BAP,
4299                                   HERMES_RID_CNFSYSTEMSCALE, &val);
4300         orinoco_unlock(priv, &flags);
4301
4302         if (err)
4303                 return err;
4304
4305         srq->value = val;
4306         srq->fixed = 0; /* auto */
4307
4308         return 0;
4309 }
4310
4311 static int orinoco_ioctl_setsens(struct net_device *dev,
4312                                  struct iw_request_info *info,
4313                                  struct iw_param *srq,
4314                                  char *extra)
4315 {
4316         struct orinoco_private *priv = netdev_priv(dev);
4317         int val = srq->value;
4318         unsigned long flags;
4319
4320         if (!priv->has_sensitivity)
4321                 return -EOPNOTSUPP;
4322
4323         if ((val < 1) || (val > 3))
4324                 return -EINVAL;
4325
4326         if (orinoco_lock(priv, &flags) != 0)
4327                 return -EBUSY;
4328         priv->ap_density = val;
4329         orinoco_unlock(priv, &flags);
4330
4331         return -EINPROGRESS;            /* Call commit handler */
4332 }
4333
4334 static int orinoco_ioctl_setrts(struct net_device *dev,
4335                                 struct iw_request_info *info,
4336                                 struct iw_param *rrq,
4337                                 char *extra)
4338 {
4339         struct orinoco_private *priv = netdev_priv(dev);
4340         int val = rrq->value;
4341         unsigned long flags;
4342
4343         if (rrq->disabled)
4344                 val = 2347;
4345
4346         if ( (val < 0) || (val > 2347) )
4347                 return -EINVAL;
4348
4349         if (orinoco_lock(priv, &flags) != 0)
4350                 return -EBUSY;
4351
4352         priv->rts_thresh = val;
4353         orinoco_unlock(priv, &flags);
4354
4355         return -EINPROGRESS;            /* Call commit handler */
4356 }
4357
4358 static int orinoco_ioctl_getrts(struct net_device *dev,
4359                                 struct iw_request_info *info,
4360                                 struct iw_param *rrq,
4361                                 char *extra)
4362 {
4363         struct orinoco_private *priv = netdev_priv(dev);
4364
4365         rrq->value = priv->rts_thresh;
4366         rrq->disabled = (rrq->value == 2347);
4367         rrq->fixed = 1;
4368
4369         return 0;
4370 }
4371
4372 static int orinoco_ioctl_setfrag(struct net_device *dev,
4373                                  struct iw_request_info *info,
4374                                  struct iw_param *frq,
4375                                  char *extra)
4376 {
4377         struct orinoco_private *priv = netdev_priv(dev);
4378         int err = -EINPROGRESS;         /* Call commit handler */
4379         unsigned long flags;
4380
4381         if (orinoco_lock(priv, &flags) != 0)
4382                 return -EBUSY;
4383
4384         if (priv->has_mwo) {
4385                 if (frq->disabled)
4386                         priv->mwo_robust = 0;
4387                 else {
4388                         if (frq->fixed)
4389                                 printk(KERN_WARNING "%s: Fixed fragmentation is "
4390                                        "not supported on this firmware. "
4391                                        "Using MWO robust instead.\n", dev->name);
4392                         priv->mwo_robust = 1;
4393                 }
4394         } else {
4395                 if (frq->disabled)
4396                         priv->frag_thresh = 2346;
4397                 else {
4398                         if ( (frq->value < 256) || (frq->value > 2346) )
4399                                 err = -EINVAL;
4400                         else
4401                                 priv->frag_thresh = frq->value & ~0x1; /* must be even */
4402                 }
4403         }
4404
4405         orinoco_unlock(priv, &flags);
4406
4407         return err;
4408 }
4409
4410 static int orinoco_ioctl_getfrag(struct net_device *dev,
4411                                  struct iw_request_info *info,
4412                                  struct iw_param *frq,
4413                                  char *extra)
4414 {
4415         struct orinoco_private *priv = netdev_priv(dev);
4416         hermes_t *hw = &priv->hw;
4417         int err;
4418         u16 val;
4419         unsigned long flags;
4420
4421         if (orinoco_lock(priv, &flags) != 0)
4422                 return -EBUSY;
4423
4424         if (priv->has_mwo) {
4425                 err = hermes_read_wordrec(hw, USER_BAP,
4426                                           HERMES_RID_CNFMWOROBUST_AGERE,
4427                                           &val);
4428                 if (err)
4429                         val = 0;
4430
4431                 frq->value = val ? 2347 : 0;
4432                 frq->disabled = ! val;
4433                 frq->fixed = 0;
4434         } else {
4435                 err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_CNFFRAGMENTATIONTHRESHOLD,
4436                                           &val);
4437                 if (err)
4438                         val = 0;
4439
4440                 frq->value = val;
4441                 frq->disabled = (val >= 2346);
4442                 frq->fixed = 1;
4443         }
4444
4445         orinoco_unlock(priv, &flags);
4446
4447         return err;
4448 }
4449
4450 static int orinoco_ioctl_setrate(struct net_device *dev,
4451                                  struct iw_request_info *info,
4452                                  struct iw_param *rrq,
4453                                  char *extra)
4454 {
4455         struct orinoco_private *priv = netdev_priv(dev);
4456         int ratemode = -1;
4457         int bitrate; /* 100s of kilobits */
4458         int i;
4459         unsigned long flags;
4460
4461         /* As the user space doesn't know our highest rate, it uses -1
4462          * to ask us to set the highest rate.  Test it using "iwconfig
4463          * ethX rate auto" - Jean II */
4464         if (rrq->value == -1)
4465                 bitrate = 110;
4466         else {
4467                 if (rrq->value % 100000)
4468                         return -EINVAL;
4469                 bitrate = rrq->value / 100000;
4470         }
4471
4472         if ( (bitrate != 10) && (bitrate != 20) &&
4473              (bitrate != 55) && (bitrate != 110) )
4474                 return -EINVAL;
4475
4476         for (i = 0; i < BITRATE_TABLE_SIZE; i++)
4477                 if ( (bitrate_table[i].bitrate == bitrate) &&
4478                      (bitrate_table[i].automatic == ! rrq->fixed) ) {
4479                         ratemode = i;
4480                         break;
4481                 }
4482
4483         if (ratemode == -1)
4484                 return -EINVAL;
4485
4486         if (orinoco_lock(priv, &flags) != 0)
4487                 return -EBUSY;
4488         priv->bitratemode = ratemode;
4489         orinoco_unlock(priv, &flags);
4490
4491         return -EINPROGRESS;
4492 }
4493
4494 static int orinoco_ioctl_getrate(struct net_device *dev,
4495                                  struct iw_request_info *info,
4496                                  struct iw_param *rrq,
4497                                  char *extra)
4498 {
4499         struct orinoco_private *priv = netdev_priv(dev);
4500         hermes_t *hw = &priv->hw;
4501         int err = 0;
4502         int ratemode;
4503         int i;
4504         u16 val;
4505         unsigned long flags;
4506
4507         if (orinoco_lock(priv, &flags) != 0)
4508                 return -EBUSY;
4509
4510         ratemode = priv->bitratemode;
4511
4512         BUG_ON((ratemode < 0) || (ratemode >= BITRATE_TABLE_SIZE));
4513
4514         rrq->value = bitrate_table[ratemode].bitrate * 100000;
4515         rrq->fixed = ! bitrate_table[ratemode].automatic;
4516         rrq->disabled = 0;
4517
4518         /* If the interface is running we try to find more about the
4519            current mode */
4520         if (netif_running(dev)) {
4521                 err = hermes_read_wordrec(hw, USER_BAP,
4522                                           HERMES_RID_CURRENTTXRATE, &val);
4523                 if (err)
4524                         goto out;
4525
4526                 switch (priv->firmware_type) {
4527                 case FIRMWARE_TYPE_AGERE: /* Lucent style rate */
4528                         /* Note : in Lucent firmware, the return value of
4529                          * HERMES_RID_CURRENTTXRATE is the bitrate in Mb/s,
4530                          * and therefore is totally different from the
4531                          * encoding of HERMES_RID_CNFTXRATECONTROL.
4532                          * Don't forget that 6Mb/s is really 5.5Mb/s */
4533                         if (val == 6)
4534                                 rrq->value = 5500000;
4535                         else
4536                                 rrq->value = val * 1000000;
4537                         break;
4538                 case FIRMWARE_TYPE_INTERSIL: /* Intersil style rate */
4539                 case FIRMWARE_TYPE_SYMBOL: /* Symbol style rate */
4540                         for (i = 0; i < BITRATE_TABLE_SIZE; i++)
4541                                 if (bitrate_table[i].intersil_txratectrl == val) {
4542                                         ratemode = i;
4543                                         break;
4544                                 }
4545                         if (i >= BITRATE_TABLE_SIZE)
4546                                 printk(KERN_INFO "%s: Unable to determine current bitrate (0x%04hx)\n",
4547                                        dev->name, val);
4548
4549                         rrq->value = bitrate_table[ratemode].bitrate * 100000;
4550                         break;
4551                 default:
4552                         BUG();
4553                 }
4554         }
4555
4556  out:
4557         orinoco_unlock(priv, &flags);
4558
4559         return err;
4560 }
4561
4562 static int orinoco_ioctl_setpower(struct net_device *dev,
4563                                   struct iw_request_info *info,
4564                                   struct iw_param *prq,
4565                                   char *extra)
4566 {
4567         struct orinoco_private *priv = netdev_priv(dev);
4568         int err = -EINPROGRESS;         /* Call commit handler */
4569         unsigned long flags;
4570
4571         if (orinoco_lock(priv, &flags) != 0)
4572                 return -EBUSY;
4573
4574         if (prq->disabled) {
4575                 priv->pm_on = 0;
4576         } else {
4577                 switch (prq->flags & IW_POWER_MODE) {
4578                 case IW_POWER_UNICAST_R:
4579                         priv->pm_mcast = 0;
4580                         priv->pm_on = 1;
4581                         break;
4582                 case IW_POWER_ALL_R:
4583                         priv->pm_mcast = 1;
4584                         priv->pm_on = 1;
4585                         break;
4586                 case IW_POWER_ON:
4587                         /* No flags : but we may have a value - Jean II */
4588                         break;
4589                 default:
4590                         err = -EINVAL;
4591                         goto out;
4592                 }
4593
4594                 if (prq->flags & IW_POWER_TIMEOUT) {
4595                         priv->pm_on = 1;
4596                         priv->pm_timeout = prq->value / 1000;
4597                 }
4598                 if (prq->flags & IW_POWER_PERIOD) {
4599                         priv->pm_on = 1;
4600                         priv->pm_period = prq->value / 1000;
4601                 }
4602                 /* It's valid to not have a value if we are just toggling
4603                  * the flags... Jean II */
4604                 if(!priv->pm_on) {
4605                         err = -EINVAL;
4606                         goto out;
4607                 }
4608         }
4609
4610  out:
4611         orinoco_unlock(priv, &flags);
4612
4613         return err;
4614 }
4615
4616 static int orinoco_ioctl_getpower(struct net_device *dev,
4617                                   struct iw_request_info *info,
4618                                   struct iw_param *prq,
4619                                   char *extra)
4620 {
4621         struct orinoco_private *priv = netdev_priv(dev);
4622         hermes_t *hw = &priv->hw;
4623         int err = 0;
4624         u16 enable, period, timeout, mcast;
4625         unsigned long flags;
4626
4627         if (orinoco_lock(priv, &flags) != 0)
4628                 return -EBUSY;
4629
4630         err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_CNFPMENABLED, &enable);
4631         if (err)
4632                 goto out;
4633
4634         err = hermes_read_wordrec(hw, USER_BAP,
4635                                   HERMES_RID_CNFMAXSLEEPDURATION, &period);
4636         if (err)
4637                 goto out;
4638
4639         err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_CNFPMHOLDOVERDURATION, &timeout);
4640         if (err)
4641                 goto out;
4642
4643         err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_CNFMULTICASTRECEIVE, &mcast);
4644         if (err)
4645                 goto out;
4646
4647         prq->disabled = !enable;
4648         /* Note : by default, display the period */
4649         if ((prq->flags & IW_POWER_TYPE) == IW_POWER_TIMEOUT) {
4650                 prq->flags = IW_POWER_TIMEOUT;
4651                 prq->value = timeout * 1000;
4652         } else {
4653                 prq->flags = IW_POWER_PERIOD;
4654                 prq->value = period * 1000;
4655         }
4656         if (mcast)
4657                 prq->flags |= IW_POWER_ALL_R;
4658         else
4659                 prq->flags |= IW_POWER_UNICAST_R;
4660
4661  out:
4662         orinoco_unlock(priv, &flags);
4663
4664         return err;
4665 }
4666
4667 static int orinoco_ioctl_set_encodeext(struct net_device *dev,
4668                                        struct iw_request_info *info,
4669                                        union iwreq_data *wrqu,
4670                                        char *extra)
4671 {
4672         struct orinoco_private *priv = netdev_priv(dev);
4673         struct iw_point *encoding = &wrqu->encoding;
4674         struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
4675         int idx, alg = ext->alg, set_key = 1;
4676         unsigned long flags;
4677         int err = -EINVAL;
4678         u16 key_len;
4679
4680         if (orinoco_lock(priv, &flags) != 0)
4681                 return -EBUSY;
4682
4683         /* Determine and validate the key index */
4684         idx = encoding->flags & IW_ENCODE_INDEX;
4685         if (idx) {
4686                 if ((idx < 1) || (idx > WEP_KEYS))
4687                         goto out;
4688                 idx--;
4689         } else
4690                 idx = priv->tx_key;
4691
4692         if (encoding->flags & IW_ENCODE_DISABLED)
4693             alg = IW_ENCODE_ALG_NONE;
4694
4695         if (priv->has_wpa && (alg != IW_ENCODE_ALG_TKIP)) {
4696                 /* Clear any TKIP TX key we had */
4697                 (void) orinoco_clear_tkip_key(priv, priv->tx_key);
4698         }
4699
4700         if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY) {
4701                 priv->tx_key = idx;
4702                 set_key = ((alg == IW_ENCODE_ALG_TKIP) ||
4703                            (ext->key_len > 0)) ? 1 : 0;
4704         }
4705
4706         if (set_key) {
4707                 /* Set the requested key first */
4708                 switch (alg) {
4709                 case IW_ENCODE_ALG_NONE:
4710                         priv->encode_alg = alg;
4711                         priv->keys[idx].len = 0;
4712                         break;
4713
4714                 case IW_ENCODE_ALG_WEP:
4715                         if (ext->key_len > SMALL_KEY_SIZE)
4716                                 key_len = LARGE_KEY_SIZE;
4717                         else if (ext->key_len > 0)
4718                                 key_len = SMALL_KEY_SIZE;
4719                         else
4720                                 goto out;
4721
4722                         priv->encode_alg = alg;
4723                         priv->keys[idx].len = cpu_to_le16(key_len);
4724
4725                         key_len = min(ext->key_len, key_len);
4726
4727                         memset(priv->keys[idx].data, 0, ORINOCO_MAX_KEY_SIZE);
4728                         memcpy(priv->keys[idx].data, ext->key, key_len);
4729                         break;
4730
4731                 case IW_ENCODE_ALG_TKIP:
4732                 {
4733                         hermes_t *hw = &priv->hw;
4734                         u8 *tkip_iv = NULL;
4735
4736                         if (!priv->has_wpa ||
4737                             (ext->key_len > sizeof(priv->tkip_key[0])))
4738                                 goto out;
4739
4740                         priv->encode_alg = alg;
4741                         memset(&priv->tkip_key[idx], 0,
4742                                sizeof(priv->tkip_key[idx]));
4743                         memcpy(&priv->tkip_key[idx], ext->key, ext->key_len);
4744
4745                         if (ext->ext_flags & IW_ENCODE_EXT_RX_SEQ_VALID)
4746                                 tkip_iv = &ext->rx_seq[0];
4747
4748                         err = __orinoco_hw_set_tkip_key(hw, idx,
4749                                  ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY,
4750                                  (u8 *) &priv->tkip_key[idx],
4751                                  tkip_iv, NULL);
4752                         if (err)
4753                                 printk(KERN_ERR "%s: Error %d setting TKIP key"
4754                                        "\n", dev->name, err);
4755
4756                         goto out;
4757                 }
4758                 default:
4759                         goto out;
4760                 }
4761         }
4762         err = -EINPROGRESS;
4763  out:
4764         orinoco_unlock(priv, &flags);
4765
4766         return err;
4767 }
4768
4769 static int orinoco_ioctl_get_encodeext(struct net_device *dev,
4770                                        struct iw_request_info *info,
4771                                        union iwreq_data *wrqu,
4772                                        char *extra)
4773 {
4774         struct orinoco_private *priv = netdev_priv(dev);
4775         struct iw_point *encoding = &wrqu->encoding;
4776         struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
4777         int idx, max_key_len;
4778         unsigned long flags;
4779         int err;
4780
4781         if (orinoco_lock(priv, &flags) != 0)
4782                 return -EBUSY;
4783
4784         err = -EINVAL;
4785         max_key_len = encoding->length - sizeof(*ext);
4786         if (max_key_len < 0)
4787                 goto out;
4788
4789         idx = encoding->flags & IW_ENCODE_INDEX;
4790         if (idx) {
4791                 if ((idx < 1) || (idx > WEP_KEYS))
4792                         goto out;
4793                 idx--;
4794         } else
4795                 idx = priv->tx_key;
4796
4797         encoding->flags = idx + 1;
4798         memset(ext, 0, sizeof(*ext));
4799
4800         ext->alg = priv->encode_alg;
4801         switch (priv->encode_alg) {
4802         case IW_ENCODE_ALG_NONE:
4803                 ext->key_len = 0;
4804                 encoding->flags |= IW_ENCODE_DISABLED;
4805                 break;
4806         case IW_ENCODE_ALG_WEP:
4807                 ext->key_len = min_t(u16, le16_to_cpu(priv->keys[idx].len),
4808                                      max_key_len);
4809                 memcpy(ext->key, priv->keys[idx].data, ext->key_len);
4810                 encoding->flags |= IW_ENCODE_ENABLED;
4811                 break;
4812         case IW_ENCODE_ALG_TKIP:
4813                 ext->key_len = min_t(u16, sizeof(struct orinoco_tkip_key),
4814                                      max_key_len);
4815                 memcpy(ext->key, &priv->tkip_key[idx], ext->key_len);
4816                 encoding->flags |= IW_ENCODE_ENABLED;
4817                 break;
4818         }
4819
4820         err = 0;
4821  out:
4822         orinoco_unlock(priv, &flags);
4823
4824         return err;
4825 }
4826
4827 static int orinoco_ioctl_set_auth(struct net_device *dev,
4828                                   struct iw_request_info *info,
4829                                   union iwreq_data *wrqu, char *extra)
4830 {
4831         struct orinoco_private *priv = netdev_priv(dev);
4832         hermes_t *hw = &priv->hw;
4833         struct iw_param *param = &wrqu->param;
4834         unsigned long flags;
4835         int ret = -EINPROGRESS;
4836
4837         if (orinoco_lock(priv, &flags) != 0)
4838                 return -EBUSY;
4839
4840         switch (param->flags & IW_AUTH_INDEX) {
4841         case IW_AUTH_WPA_VERSION:
4842         case IW_AUTH_CIPHER_PAIRWISE:
4843         case IW_AUTH_CIPHER_GROUP:
4844         case IW_AUTH_RX_UNENCRYPTED_EAPOL:
4845         case IW_AUTH_PRIVACY_INVOKED:
4846         case IW_AUTH_DROP_UNENCRYPTED:
4847                 /*
4848                  * orinoco does not use these parameters
4849                  */
4850                 break;
4851
4852         case IW_AUTH_KEY_MGMT:
4853                 /* wl_lkm implies value 2 == PSK for Hermes I
4854                  * which ties in with WEXT
4855                  * no other hints tho :(
4856                  */
4857                 priv->key_mgmt = param->value;
4858                 break;
4859
4860         case IW_AUTH_TKIP_COUNTERMEASURES:
4861                 /* When countermeasures are enabled, shut down the
4862                  * card; when disabled, re-enable the card. This must
4863                  * take effect immediately.
4864                  *
4865                  * TODO: Make sure that the EAPOL message is getting
4866                  *       out before card disabled
4867                  */
4868                 if (param->value) {
4869                         priv->tkip_cm_active = 1;
4870                         ret = hermes_enable_port(hw, 0);
4871                 } else {
4872                         priv->tkip_cm_active = 0;
4873                         ret = hermes_disable_port(hw, 0);
4874                 }
4875                 break;
4876
4877         case IW_AUTH_80211_AUTH_ALG:
4878                 if (param->value & IW_AUTH_ALG_SHARED_KEY)
4879                         priv->wep_restrict = 1;
4880                 else if (param->value & IW_AUTH_ALG_OPEN_SYSTEM)
4881                         priv->wep_restrict = 0;
4882                 else
4883                         ret = -EINVAL;
4884                 break;
4885
4886         case IW_AUTH_WPA_ENABLED:
4887                 if (priv->has_wpa) {
4888                         priv->wpa_enabled = param->value ? 1 : 0;
4889                 } else {
4890                         if (param->value)
4891                                 ret = -EOPNOTSUPP;
4892                         /* else silently accept disable of WPA */
4893                         priv->wpa_enabled = 0;
4894                 }
4895                 break;
4896
4897         default:
4898                 ret = -EOPNOTSUPP;
4899         }
4900
4901         orinoco_unlock(priv, &flags);
4902         return ret;
4903 }
4904
4905 static int orinoco_ioctl_get_auth(struct net_device *dev,
4906                                   struct iw_request_info *info,
4907                                   union iwreq_data *wrqu, char *extra)
4908 {
4909         struct orinoco_private *priv = netdev_priv(dev);
4910         struct iw_param *param = &wrqu->param;
4911         unsigned long flags;
4912         int ret = 0;
4913
4914         if (orinoco_lock(priv, &flags) != 0)
4915                 return -EBUSY;
4916
4917         switch (param->flags & IW_AUTH_INDEX) {
4918         case IW_AUTH_KEY_MGMT:
4919                 param->value = priv->key_mgmt;
4920                 break;
4921
4922         case IW_AUTH_TKIP_COUNTERMEASURES:
4923                 param->value = priv->tkip_cm_active;
4924                 break;
4925
4926         case IW_AUTH_80211_AUTH_ALG:
4927                 if (priv->wep_restrict)
4928                         param->value = IW_AUTH_ALG_SHARED_KEY;
4929                 else
4930                         param->value = IW_AUTH_ALG_OPEN_SYSTEM;
4931                 break;
4932
4933         case IW_AUTH_WPA_ENABLED:
4934                 param->value = priv->wpa_enabled;
4935                 break;
4936
4937         default:
4938                 ret = -EOPNOTSUPP;
4939         }
4940
4941         orinoco_unlock(priv, &flags);
4942         return ret;
4943 }
4944
4945 static int orinoco_ioctl_set_genie(struct net_device *dev,
4946                                    struct iw_request_info *info,
4947                                    union iwreq_data *wrqu, char *extra)
4948 {
4949         struct orinoco_private *priv = netdev_priv(dev);
4950         u8 *buf;
4951         unsigned long flags;
4952         int err = 0;
4953
4954         if ((wrqu->data.length > MAX_WPA_IE_LEN) ||
4955             (wrqu->data.length && (extra == NULL)))
4956                 return -EINVAL;
4957
4958         if (orinoco_lock(priv, &flags) != 0)
4959                 return -EBUSY;
4960
4961         if (wrqu->data.length) {
4962                 buf = kmalloc(wrqu->data.length, GFP_KERNEL);
4963                 if (buf == NULL) {
4964                         err = -ENOMEM;
4965                         goto out;
4966                 }
4967
4968                 memcpy(buf, extra, wrqu->data.length);
4969                 kfree(priv->wpa_ie);
4970                 priv->wpa_ie = buf;
4971                 priv->wpa_ie_len = wrqu->data.length;
4972         } else {
4973                 kfree(priv->wpa_ie);
4974                 priv->wpa_ie = NULL;
4975                 priv->wpa_ie_len = 0;
4976         }
4977
4978         if (priv->wpa_ie) {
4979                 /* Looks like wl_lkm wants to check the auth alg, and
4980                  * somehow pass it to the firmware.
4981                  * Instead it just calls the key mgmt rid
4982                  *   - we do this in set auth.
4983                  */
4984         }
4985
4986 out:
4987         orinoco_unlock(priv, &flags);
4988         return err;
4989 }
4990
4991 static int orinoco_ioctl_get_genie(struct net_device *dev,
4992                                    struct iw_request_info *info,
4993                                    union iwreq_data *wrqu, char *extra)
4994 {
4995         struct orinoco_private *priv = netdev_priv(dev);
4996         unsigned long flags;
4997         int err = 0;
4998
4999         if (orinoco_lock(priv, &flags) != 0)
5000                 return -EBUSY;
5001
5002         if ((priv->wpa_ie_len == 0) || (priv->wpa_ie == NULL)) {
5003                 wrqu->data.length = 0;
5004                 goto out;
5005         }
5006
5007         if (wrqu->data.length < priv->wpa_ie_len) {
5008                 err = -E2BIG;
5009                 goto out;
5010         }
5011
5012         wrqu->data.length = priv->wpa_ie_len;
5013         memcpy(extra, priv->wpa_ie, priv->wpa_ie_len);
5014
5015 out:
5016         orinoco_unlock(priv, &flags);
5017         return err;
5018 }
5019
5020 static int orinoco_ioctl_set_mlme(struct net_device *dev,
5021                                   struct iw_request_info *info,
5022                                   union iwreq_data *wrqu, char *extra)
5023 {
5024         struct orinoco_private *priv = netdev_priv(dev);
5025         hermes_t *hw = &priv->hw;
5026         struct iw_mlme *mlme = (struct iw_mlme *)extra;
5027         unsigned long flags;
5028         int ret = 0;
5029
5030         if (orinoco_lock(priv, &flags) != 0)
5031                 return -EBUSY;
5032
5033         switch (mlme->cmd) {
5034         case IW_MLME_DEAUTH:
5035                 /* silently ignore */
5036                 break;
5037
5038         case IW_MLME_DISASSOC:
5039         {
5040                 struct {
5041                         u8 addr[ETH_ALEN];
5042                         __le16 reason_code;
5043                 } __attribute__ ((packed)) buf;
5044
5045                 memcpy(buf.addr, mlme->addr.sa_data, ETH_ALEN);
5046                 buf.reason_code = cpu_to_le16(mlme->reason_code);
5047                 ret = HERMES_WRITE_RECORD(hw, USER_BAP,
5048                                           HERMES_RID_CNFDISASSOCIATE,
5049                                           &buf);
5050                 break;
5051         }
5052         default:
5053                 ret = -EOPNOTSUPP;
5054         }
5055
5056         orinoco_unlock(priv, &flags);
5057         return ret;
5058 }
5059
5060 static int orinoco_ioctl_getretry(struct net_device *dev,
5061                                   struct iw_request_info *info,
5062                                   struct iw_param *rrq,
5063                                   char *extra)
5064 {
5065         struct orinoco_private *priv = netdev_priv(dev);
5066         hermes_t *hw = &priv->hw;
5067         int err = 0;
5068         u16 short_limit, long_limit, lifetime;
5069         unsigned long flags;
5070
5071         if (orinoco_lock(priv, &flags) != 0)
5072                 return -EBUSY;
5073
5074         err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_SHORTRETRYLIMIT,
5075                                   &short_limit);
5076         if (err)
5077                 goto out;
5078
5079         err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_LONGRETRYLIMIT,
5080                                   &long_limit);
5081         if (err)
5082                 goto out;
5083
5084         err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_MAXTRANSMITLIFETIME,
5085                                   &lifetime);
5086         if (err)
5087                 goto out;
5088
5089         rrq->disabled = 0;              /* Can't be disabled */
5090
5091         /* Note : by default, display the retry number */
5092         if ((rrq->flags & IW_RETRY_TYPE) == IW_RETRY_LIFETIME) {
5093                 rrq->flags = IW_RETRY_LIFETIME;
5094                 rrq->value = lifetime * 1000;   /* ??? */
5095         } else {
5096                 /* By default, display the min number */
5097                 if ((rrq->flags & IW_RETRY_LONG)) {
5098                         rrq->flags = IW_RETRY_LIMIT | IW_RETRY_LONG;
5099                         rrq->value = long_limit;
5100                 } else {
5101                         rrq->flags = IW_RETRY_LIMIT;
5102                         rrq->value = short_limit;
5103                         if(short_limit != long_limit)
5104                                 rrq->flags |= IW_RETRY_SHORT;
5105                 }
5106         }
5107
5108  out:
5109         orinoco_unlock(priv, &flags);
5110
5111         return err;
5112 }
5113
5114 static int orinoco_ioctl_reset(struct net_device *dev,
5115                                struct iw_request_info *info,
5116                                void *wrqu,
5117                                char *extra)
5118 {
5119         struct orinoco_private *priv = netdev_priv(dev);
5120
5121         if (! capable(CAP_NET_ADMIN))
5122                 return -EPERM;
5123
5124         if (info->cmd == (SIOCIWFIRSTPRIV + 0x1)) {
5125                 printk(KERN_DEBUG "%s: Forcing reset!\n", dev->name);
5126
5127                 /* Firmware reset */
5128                 orinoco_reset(&priv->reset_work);
5129         } else {
5130                 printk(KERN_DEBUG "%s: Force scheduling reset!\n", dev->name);
5131
5132                 schedule_work(&priv->reset_work);
5133         }
5134
5135         return 0;
5136 }
5137
5138 static int orinoco_ioctl_setibssport(struct net_device *dev,
5139                                      struct iw_request_info *info,
5140                                      void *wrqu,
5141                                      char *extra)
5142
5143 {
5144         struct orinoco_private *priv = netdev_priv(dev);
5145         int val = *( (int *) extra );
5146         unsigned long flags;
5147
5148         if (orinoco_lock(priv, &flags) != 0)
5149                 return -EBUSY;
5150
5151         priv->ibss_port = val ;
5152
5153         /* Actually update the mode we are using */
5154         set_port_type(priv);
5155
5156         orinoco_unlock(priv, &flags);
5157         return -EINPROGRESS;            /* Call commit handler */
5158 }
5159
5160 static int orinoco_ioctl_getibssport(struct net_device *dev,
5161                                      struct iw_request_info *info,
5162                                      void *wrqu,
5163                                      char *extra)
5164 {
5165         struct orinoco_private *priv = netdev_priv(dev);
5166         int *val = (int *) extra;
5167
5168         *val = priv->ibss_port;
5169         return 0;
5170 }
5171
5172 static int orinoco_ioctl_setport3(struct net_device *dev,
5173                                   struct iw_request_info *info,
5174                                   void *wrqu,
5175                                   char *extra)
5176 {
5177         struct orinoco_private *priv = netdev_priv(dev);
5178         int val = *( (int *) extra );
5179         int err = 0;
5180         unsigned long flags;
5181
5182         if (orinoco_lock(priv, &flags) != 0)
5183                 return -EBUSY;
5184
5185         switch (val) {
5186         case 0: /* Try to do IEEE ad-hoc mode */
5187                 if (! priv->has_ibss) {
5188                         err = -EINVAL;
5189                         break;
5190                 }
5191                 priv->prefer_port3 = 0;
5192
5193                 break;
5194
5195         case 1: /* Try to do Lucent proprietary ad-hoc mode */
5196                 if (! priv->has_port3) {
5197                         err = -EINVAL;
5198                         break;
5199                 }
5200                 priv->prefer_port3 = 1;
5201                 break;
5202
5203         default:
5204                 err = -EINVAL;
5205         }
5206
5207         if (! err) {
5208                 /* Actually update the mode we are using */
5209                 set_port_type(priv);
5210                 err = -EINPROGRESS;
5211         }
5212
5213         orinoco_unlock(priv, &flags);
5214
5215         return err;
5216 }
5217
5218 static int orinoco_ioctl_getport3(struct net_device *dev,
5219                                   struct iw_request_info *info,
5220                                   void *wrqu,
5221                                   char *extra)
5222 {
5223         struct orinoco_private *priv = netdev_priv(dev);
5224         int *val = (int *) extra;
5225
5226         *val = priv->prefer_port3;
5227         return 0;
5228 }
5229
5230 static int orinoco_ioctl_setpreamble(struct net_device *dev,
5231                                      struct iw_request_info *info,
5232                                      void *wrqu,
5233                                      char *extra)
5234 {
5235         struct orinoco_private *priv = netdev_priv(dev);
5236         unsigned long flags;
5237         int val;
5238
5239         if (! priv->has_preamble)
5240                 return -EOPNOTSUPP;
5241
5242         /* 802.11b has recently defined some short preamble.
5243          * Basically, the Phy header has been reduced in size.
5244          * This increase performance, especially at high rates
5245          * (the preamble is transmitted at 1Mb/s), unfortunately
5246          * this give compatibility troubles... - Jean II */
5247         val = *( (int *) extra );
5248
5249         if (orinoco_lock(priv, &flags) != 0)
5250                 return -EBUSY;
5251
5252         if (val)
5253                 priv->preamble = 1;
5254         else
5255                 priv->preamble = 0;
5256
5257         orinoco_unlock(priv, &flags);
5258
5259         return -EINPROGRESS;            /* Call commit handler */
5260 }
5261
5262 static int orinoco_ioctl_getpreamble(struct net_device *dev,
5263                                      struct iw_request_info *info,
5264                                      void *wrqu,
5265                                      char *extra)
5266 {
5267         struct orinoco_private *priv = netdev_priv(dev);
5268         int *val = (int *) extra;
5269
5270         if (! priv->has_preamble)
5271                 return -EOPNOTSUPP;
5272
5273         *val = priv->preamble;
5274         return 0;
5275 }
5276
5277 /* ioctl interface to hermes_read_ltv()
5278  * To use with iwpriv, pass the RID as the token argument, e.g.
5279  * iwpriv get_rid [0xfc00]
5280  * At least Wireless Tools 25 is required to use iwpriv.
5281  * For Wireless Tools 25 and 26 append "dummy" are the end. */
5282 static int orinoco_ioctl_getrid(struct net_device *dev,
5283                                 struct iw_request_info *info,
5284                                 struct iw_point *data,
5285                                 char *extra)
5286 {
5287         struct orinoco_private *priv = netdev_priv(dev);
5288         hermes_t *hw = &priv->hw;
5289         int rid = data->flags;
5290         u16 length;
5291         int err;
5292         unsigned long flags;
5293
5294         /* It's a "get" function, but we don't want users to access the
5295          * WEP key and other raw firmware data */
5296         if (! capable(CAP_NET_ADMIN))
5297                 return -EPERM;
5298
5299         if (rid < 0xfc00 || rid > 0xffff)
5300                 return -EINVAL;
5301
5302         if (orinoco_lock(priv, &flags) != 0)
5303                 return -EBUSY;
5304
5305         err = hermes_read_ltv(hw, USER_BAP, rid, MAX_RID_LEN, &length,
5306                               extra);
5307         if (err)
5308                 goto out;
5309
5310         data->length = min_t(u16, HERMES_RECLEN_TO_BYTES(length),
5311                              MAX_RID_LEN);
5312
5313  out:
5314         orinoco_unlock(priv, &flags);
5315         return err;
5316 }
5317
5318 /* Trigger a scan (look for other cells in the vicinity) */
5319 static int orinoco_ioctl_setscan(struct net_device *dev,
5320                                  struct iw_request_info *info,
5321                                  struct iw_point *srq,
5322                                  char *extra)
5323 {
5324         struct orinoco_private *priv = netdev_priv(dev);
5325         hermes_t *hw = &priv->hw;
5326         struct iw_scan_req *si = (struct iw_scan_req *) extra;
5327         int err = 0;
5328         unsigned long flags;
5329
5330         /* Note : you may have realised that, as this is a SET operation,
5331          * this is privileged and therefore a normal user can't
5332          * perform scanning.
5333          * This is not an error, while the device perform scanning,
5334          * traffic doesn't flow, so it's a perfect DoS...
5335          * Jean II */
5336
5337         if (orinoco_lock(priv, &flags) != 0)
5338                 return -EBUSY;
5339
5340         /* Scanning with port 0 disabled would fail */
5341         if (!netif_running(dev)) {
5342                 err = -ENETDOWN;
5343                 goto out;
5344         }
5345
5346         /* In monitor mode, the scan results are always empty.
5347          * Probe responses are passed to the driver as received
5348          * frames and could be processed in software. */
5349         if (priv->iw_mode == IW_MODE_MONITOR) {
5350                 err = -EOPNOTSUPP;
5351                 goto out;
5352         }
5353
5354         /* Note : because we don't lock out the irq handler, the way
5355          * we access scan variables in priv is critical.
5356          *      o scan_inprogress : not touched by irq handler
5357          *      o scan_mode : not touched by irq handler
5358          * Before modifying anything on those variables, please think hard !
5359          * Jean II */
5360
5361         /* Save flags */
5362         priv->scan_mode = srq->flags;
5363
5364         /* Always trigger scanning, even if it's in progress.
5365          * This way, if the info frame get lost, we will recover somewhat
5366          * gracefully  - Jean II */
5367
5368         if (priv->has_hostscan) {
5369                 switch (priv->firmware_type) {
5370                 case FIRMWARE_TYPE_SYMBOL:
5371                         err = hermes_write_wordrec(hw, USER_BAP,
5372                                                    HERMES_RID_CNFHOSTSCAN_SYMBOL,
5373                                                    HERMES_HOSTSCAN_SYMBOL_ONCE |
5374                                                    HERMES_HOSTSCAN_SYMBOL_BCAST);
5375                         break;
5376                 case FIRMWARE_TYPE_INTERSIL: {
5377                         __le16 req[3];
5378
5379                         req[0] = cpu_to_le16(0x3fff);   /* All channels */
5380                         req[1] = cpu_to_le16(0x0001);   /* rate 1 Mbps */
5381                         req[2] = 0;                     /* Any ESSID */
5382                         err = HERMES_WRITE_RECORD(hw, USER_BAP,
5383                                                   HERMES_RID_CNFHOSTSCAN, &req);
5384                 }
5385                 break;
5386                 case FIRMWARE_TYPE_AGERE:
5387                         if (priv->scan_mode & IW_SCAN_THIS_ESSID) {
5388                                 struct hermes_idstring idbuf;
5389                                 size_t len = min(sizeof(idbuf.val),
5390                                                  (size_t) si->essid_len);
5391                                 idbuf.len = cpu_to_le16(len);
5392                                 memcpy(idbuf.val, si->essid, len);
5393
5394                                 err = hermes_write_ltv(hw, USER_BAP,
5395                                                HERMES_RID_CNFSCANSSID_AGERE,
5396                                                HERMES_BYTES_TO_RECLEN(len + 2),
5397                                                &idbuf);
5398                         } else
5399                                 err = hermes_write_wordrec(hw, USER_BAP,
5400                                                    HERMES_RID_CNFSCANSSID_AGERE,
5401                                                    0);  /* Any ESSID */
5402                         if (err)
5403                                 break;
5404
5405                         if (priv->has_ext_scan) {
5406                                 /* Clear scan results at the start of
5407                                  * an extended scan */
5408                                 orinoco_clear_scan_results(priv,
5409                                                 msecs_to_jiffies(15000));
5410
5411                                 /* TODO: Is this available on older firmware?
5412                                  *   Can we use it to scan specific channels
5413                                  *   for IW_SCAN_THIS_FREQ? */
5414                                 err = hermes_write_wordrec(hw, USER_BAP,
5415                                                 HERMES_RID_CNFSCANCHANNELS2GHZ,
5416                                                 0x7FFF);
5417                                 if (err)
5418                                         goto out;
5419
5420                                 err = hermes_inquire(hw,
5421                                                      HERMES_INQ_CHANNELINFO);
5422                         } else
5423                                 err = hermes_inquire(hw, HERMES_INQ_SCAN);
5424                         break;
5425                 }
5426         } else
5427                 err = hermes_inquire(hw, HERMES_INQ_SCAN);
5428
5429         /* One more client */
5430         if (! err)
5431                 priv->scan_inprogress = 1;
5432
5433  out:
5434         orinoco_unlock(priv, &flags);
5435         return err;
5436 }
5437
5438 #define MAX_CUSTOM_LEN 64
5439
5440 /* Translate scan data returned from the card to a card independant
5441  * format that the Wireless Tools will understand - Jean II */
5442 static inline char *orinoco_translate_scan(struct net_device *dev,
5443                                            struct iw_request_info *info,
5444                                            char *current_ev,
5445                                            char *end_buf,
5446                                            union hermes_scan_info *bss,
5447                                            unsigned int last_scanned)
5448 {
5449         struct orinoco_private *priv = netdev_priv(dev);
5450         u16                     capabilities;
5451         u16                     channel;
5452         struct iw_event         iwe;            /* Temporary buffer */
5453         char custom[MAX_CUSTOM_LEN];
5454
5455         memset(&iwe, 0, sizeof(iwe));
5456
5457         /* First entry *MUST* be the AP MAC address */
5458         iwe.cmd = SIOCGIWAP;
5459         iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
5460         memcpy(iwe.u.ap_addr.sa_data, bss->a.bssid, ETH_ALEN);
5461         current_ev = iwe_stream_add_event(info, current_ev, end_buf,
5462                                           &iwe, IW_EV_ADDR_LEN);
5463
5464         /* Other entries will be displayed in the order we give them */
5465
5466         /* Add the ESSID */
5467         iwe.u.data.length = le16_to_cpu(bss->a.essid_len);
5468         if (iwe.u.data.length > 32)
5469                 iwe.u.data.length = 32;
5470         iwe.cmd = SIOCGIWESSID;
5471         iwe.u.data.flags = 1;
5472         current_ev = iwe_stream_add_point(info, current_ev, end_buf,
5473                                           &iwe, bss->a.essid);
5474
5475         /* Add mode */
5476         iwe.cmd = SIOCGIWMODE;
5477         capabilities = le16_to_cpu(bss->a.capabilities);
5478         if (capabilities & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS)) {
5479                 if (capabilities & WLAN_CAPABILITY_ESS)
5480                         iwe.u.mode = IW_MODE_MASTER;
5481                 else
5482                         iwe.u.mode = IW_MODE_ADHOC;
5483                 current_ev = iwe_stream_add_event(info, current_ev, end_buf,
5484                                                   &iwe, IW_EV_UINT_LEN);
5485         }
5486
5487         channel = bss->s.channel;
5488         if ((channel >= 1) && (channel <= NUM_CHANNELS)) {
5489                 /* Add channel and frequency */
5490                 iwe.cmd = SIOCGIWFREQ;
5491                 iwe.u.freq.m = channel;
5492                 iwe.u.freq.e = 0;
5493                 current_ev = iwe_stream_add_event(info, current_ev, end_buf,
5494                                                   &iwe, IW_EV_FREQ_LEN);
5495
5496                 iwe.u.freq.m = channel_frequency[channel-1] * 100000;
5497                 iwe.u.freq.e = 1;
5498                 current_ev = iwe_stream_add_event(info, current_ev, end_buf,
5499                                                   &iwe, IW_EV_FREQ_LEN);
5500         }
5501
5502         /* Add quality statistics. level and noise in dB. No link quality */
5503         iwe.cmd = IWEVQUAL;
5504         iwe.u.qual.updated = IW_QUAL_DBM | IW_QUAL_QUAL_INVALID;
5505         iwe.u.qual.level = (__u8) le16_to_cpu(bss->a.level) - 0x95;
5506         iwe.u.qual.noise = (__u8) le16_to_cpu(bss->a.noise) - 0x95;
5507         /* Wireless tools prior to 27.pre22 will show link quality
5508          * anyway, so we provide a reasonable value. */
5509         if (iwe.u.qual.level > iwe.u.qual.noise)
5510                 iwe.u.qual.qual = iwe.u.qual.level - iwe.u.qual.noise;
5511         else
5512                 iwe.u.qual.qual = 0;
5513         current_ev = iwe_stream_add_event(info, current_ev, end_buf,
5514                                           &iwe, IW_EV_QUAL_LEN);
5515
5516         /* Add encryption capability */
5517         iwe.cmd = SIOCGIWENCODE;
5518         if (capabilities & WLAN_CAPABILITY_PRIVACY)
5519                 iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
5520         else
5521                 iwe.u.data.flags = IW_ENCODE_DISABLED;
5522         iwe.u.data.length = 0;
5523         current_ev = iwe_stream_add_point(info, current_ev, end_buf,
5524                                           &iwe, NULL);
5525
5526         /* Bit rate is not available in Lucent/Agere firmwares */
5527         if (priv->firmware_type != FIRMWARE_TYPE_AGERE) {
5528                 char *current_val = current_ev + iwe_stream_lcp_len(info);
5529                 int i;
5530                 int step;
5531
5532                 if (priv->firmware_type == FIRMWARE_TYPE_SYMBOL)
5533                         step = 2;
5534                 else
5535                         step = 1;
5536
5537                 iwe.cmd = SIOCGIWRATE;
5538                 /* Those two flags are ignored... */
5539                 iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
5540                 /* Max 10 values */
5541                 for (i = 0; i < 10; i += step) {
5542                         /* NULL terminated */
5543                         if (bss->p.rates[i] == 0x0)
5544                                 break;
5545                         /* Bit rate given in 500 kb/s units (+ 0x80) */
5546                         iwe.u.bitrate.value =
5547                                 ((bss->p.rates[i] & 0x7f) * 500000);
5548                         current_val = iwe_stream_add_value(info, current_ev,
5549                                                            current_val,
5550                                                            end_buf, &iwe,
5551                                                            IW_EV_PARAM_LEN);
5552                 }
5553                 /* Check if we added any event */
5554                 if ((current_val - current_ev) > iwe_stream_lcp_len(info))
5555                         current_ev = current_val;
5556         }
5557
5558         /* Beacon interval */
5559         iwe.cmd = IWEVCUSTOM;
5560         iwe.u.data.length = snprintf(custom, MAX_CUSTOM_LEN,
5561                                      "bcn_int=%d",
5562                                      le16_to_cpu(bss->a.beacon_interv));
5563         if (iwe.u.data.length)
5564                 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
5565                                                   &iwe, custom);
5566
5567         /* Capabilites */
5568         iwe.cmd = IWEVCUSTOM;
5569         iwe.u.data.length = snprintf(custom, MAX_CUSTOM_LEN,
5570                                      "capab=0x%04x",
5571                                      capabilities);
5572         if (iwe.u.data.length)
5573                 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
5574                                                   &iwe, custom);
5575
5576         /* Add EXTRA: Age to display seconds since last beacon/probe response
5577          * for given network. */
5578         iwe.cmd = IWEVCUSTOM;
5579         iwe.u.data.length = snprintf(custom, MAX_CUSTOM_LEN,
5580                                      " Last beacon: %dms ago",
5581                                      jiffies_to_msecs(jiffies - last_scanned));
5582         if (iwe.u.data.length)
5583                 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
5584                                                   &iwe, custom);
5585
5586         return current_ev;
5587 }
5588
5589 static inline char *orinoco_translate_ext_scan(struct net_device *dev,
5590                                                struct iw_request_info *info,
5591                                                char *current_ev,
5592                                                char *end_buf,
5593                                                struct agere_ext_scan_info *bss,
5594                                                unsigned int last_scanned)
5595 {
5596         u16                     capabilities;
5597         u16                     channel;
5598         struct iw_event         iwe;            /* Temporary buffer */
5599         char custom[MAX_CUSTOM_LEN];
5600         u8 *ie;
5601
5602         memset(&iwe, 0, sizeof(iwe));
5603
5604         /* First entry *MUST* be the AP MAC address */
5605         iwe.cmd = SIOCGIWAP;
5606         iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
5607         memcpy(iwe.u.ap_addr.sa_data, bss->bssid, ETH_ALEN);
5608         current_ev = iwe_stream_add_event(info, current_ev, end_buf,
5609                                           &iwe, IW_EV_ADDR_LEN);
5610
5611         /* Other entries will be displayed in the order we give them */
5612
5613         /* Add the ESSID */
5614         ie = bss->data;
5615         iwe.u.data.length = ie[1];
5616         if (iwe.u.data.length) {
5617                 if (iwe.u.data.length > 32)
5618                         iwe.u.data.length = 32;
5619                 iwe.cmd = SIOCGIWESSID;
5620                 iwe.u.data.flags = 1;
5621                 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
5622                                                   &iwe, &ie[2]);
5623         }
5624
5625         /* Add mode */
5626         capabilities = le16_to_cpu(bss->capabilities);
5627         if (capabilities & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS)) {
5628                 iwe.cmd = SIOCGIWMODE;
5629                 if (capabilities & WLAN_CAPABILITY_ESS)
5630                         iwe.u.mode = IW_MODE_MASTER;
5631                 else
5632                         iwe.u.mode = IW_MODE_ADHOC;
5633                 current_ev = iwe_stream_add_event(info, current_ev, end_buf,
5634                                                   &iwe, IW_EV_UINT_LEN);
5635         }
5636
5637         ie = orinoco_get_ie(bss->data, sizeof(bss->data), MFIE_TYPE_DS_SET);
5638         channel = ie ? ie[2] : 0;
5639         if ((channel >= 1) && (channel <= NUM_CHANNELS)) {
5640                 /* Add channel and frequency */
5641                 iwe.cmd = SIOCGIWFREQ;
5642                 iwe.u.freq.m = channel;
5643                 iwe.u.freq.e = 0;
5644                 current_ev = iwe_stream_add_event(info, current_ev, end_buf,
5645                                                   &iwe, IW_EV_FREQ_LEN);
5646
5647                 iwe.u.freq.m = channel_frequency[channel-1] * 100000;
5648                 iwe.u.freq.e = 1;
5649                 current_ev = iwe_stream_add_event(info, current_ev, end_buf,
5650                                                   &iwe, IW_EV_FREQ_LEN);
5651         }
5652
5653         /* Add quality statistics. level and noise in dB. No link quality */
5654         iwe.cmd = IWEVQUAL;
5655         iwe.u.qual.updated = IW_QUAL_DBM | IW_QUAL_QUAL_INVALID;
5656         iwe.u.qual.level = bss->level - 0x95;
5657         iwe.u.qual.noise = bss->noise - 0x95;
5658         /* Wireless tools prior to 27.pre22 will show link quality
5659          * anyway, so we provide a reasonable value. */
5660         if (iwe.u.qual.level > iwe.u.qual.noise)
5661                 iwe.u.qual.qual = iwe.u.qual.level - iwe.u.qual.noise;
5662         else
5663                 iwe.u.qual.qual = 0;
5664         current_ev = iwe_stream_add_event(info, current_ev, end_buf,
5665                                           &iwe, IW_EV_QUAL_LEN);
5666
5667         /* Add encryption capability */
5668         iwe.cmd = SIOCGIWENCODE;
5669         if (capabilities & WLAN_CAPABILITY_PRIVACY)
5670                 iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
5671         else
5672                 iwe.u.data.flags = IW_ENCODE_DISABLED;
5673         iwe.u.data.length = 0;
5674         current_ev = iwe_stream_add_point(info, current_ev, end_buf,
5675                                           &iwe, NULL);
5676
5677         /* WPA IE */
5678         ie = orinoco_get_wpa_ie(bss->data, sizeof(bss->data));
5679         if (ie) {
5680                 iwe.cmd = IWEVGENIE;
5681                 iwe.u.data.length = ie[1] + 2;
5682                 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
5683                                                   &iwe, ie);
5684         }
5685
5686         /* RSN IE */
5687         ie = orinoco_get_ie(bss->data, sizeof(bss->data), MFIE_TYPE_RSN);
5688         if (ie) {
5689                 iwe.cmd = IWEVGENIE;
5690                 iwe.u.data.length = ie[1] + 2;
5691                 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
5692                                                   &iwe, ie);
5693         }
5694
5695         ie = orinoco_get_ie(bss->data, sizeof(bss->data), MFIE_TYPE_RATES);
5696         if (ie) {
5697                 char *p = current_ev + iwe_stream_lcp_len(info);
5698                 int i;
5699
5700                 iwe.cmd = SIOCGIWRATE;
5701                 /* Those two flags are ignored... */
5702                 iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
5703
5704                 for (i = 2; i < (ie[1] + 2); i++) {
5705                         iwe.u.bitrate.value = ((ie[i] & 0x7F) * 500000);
5706                         p = iwe_stream_add_value(info, current_ev, p, end_buf,
5707                                                  &iwe, IW_EV_PARAM_LEN);
5708                 }
5709                 /* Check if we added any event */
5710                 if (p > (current_ev + iwe_stream_lcp_len(info)))
5711                         current_ev = p;
5712         }
5713
5714         /* Timestamp */
5715         iwe.cmd = IWEVCUSTOM;
5716         iwe.u.data.length =
5717                 snprintf(custom, MAX_CUSTOM_LEN, "tsf=%016llx",
5718                          (unsigned long long) le64_to_cpu(bss->timestamp));
5719         if (iwe.u.data.length)
5720                 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
5721                                                   &iwe, custom);
5722
5723         /* Beacon interval */
5724         iwe.cmd = IWEVCUSTOM;
5725         iwe.u.data.length = snprintf(custom, MAX_CUSTOM_LEN,
5726                                      "bcn_int=%d",
5727                                      le16_to_cpu(bss->beacon_interval));
5728         if (iwe.u.data.length)
5729                 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
5730                                                   &iwe, custom);
5731
5732         /* Capabilites */
5733         iwe.cmd = IWEVCUSTOM;
5734         iwe.u.data.length = snprintf(custom, MAX_CUSTOM_LEN,
5735                                      "capab=0x%04x",
5736                                      capabilities);
5737         if (iwe.u.data.length)
5738                 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
5739                                                   &iwe, custom);
5740
5741         /* Add EXTRA: Age to display seconds since last beacon/probe response
5742          * for given network. */
5743         iwe.cmd = IWEVCUSTOM;
5744         iwe.u.data.length = snprintf(custom, MAX_CUSTOM_LEN,
5745                                      " Last beacon: %dms ago",
5746                                      jiffies_to_msecs(jiffies - last_scanned));
5747         if (iwe.u.data.length)
5748                 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
5749                                                   &iwe, custom);
5750
5751         return current_ev;
5752 }
5753
5754 /* Return results of a scan */
5755 static int orinoco_ioctl_getscan(struct net_device *dev,
5756                                  struct iw_request_info *info,
5757                                  struct iw_point *srq,
5758                                  char *extra)
5759 {
5760         struct orinoco_private *priv = netdev_priv(dev);
5761         int err = 0;
5762         unsigned long flags;
5763         char *current_ev = extra;
5764
5765         if (orinoco_lock(priv, &flags) != 0)
5766                 return -EBUSY;
5767
5768         if (priv->scan_inprogress) {
5769                 /* Important note : we don't want to block the caller
5770                  * until results are ready for various reasons.
5771                  * First, managing wait queues is complex and racy.
5772                  * Second, we grab some rtnetlink lock before comming
5773                  * here (in dev_ioctl()).
5774                  * Third, we generate an Wireless Event, so the
5775                  * caller can wait itself on that - Jean II */
5776                 err = -EAGAIN;
5777                 goto out;
5778         }
5779
5780         if (priv->has_ext_scan) {
5781                 struct xbss_element *bss;
5782
5783                 list_for_each_entry(bss, &priv->bss_list, list) {
5784                         /* Translate this entry to WE format */
5785                         current_ev =
5786                                 orinoco_translate_ext_scan(dev, info,
5787                                                            current_ev,
5788                                                            extra + srq->length,
5789                                                            &bss->bss,
5790                                                            bss->last_scanned);
5791
5792                         /* Check if there is space for one more entry */
5793                         if ((extra + srq->length - current_ev)
5794                             <= IW_EV_ADDR_LEN) {
5795                                 /* Ask user space to try again with a
5796                                  * bigger buffer */
5797                                 err = -E2BIG;
5798                                 goto out;
5799                         }
5800                 }
5801
5802         } else {
5803                 struct bss_element *bss;
5804
5805                 list_for_each_entry(bss, &priv->bss_list, list) {
5806                         /* Translate this entry to WE format */
5807                         current_ev = orinoco_translate_scan(dev, info,
5808                                                             current_ev,
5809                                                             extra + srq->length,
5810                                                             &bss->bss,
5811                                                             bss->last_scanned);
5812
5813                         /* Check if there is space for one more entry */
5814                         if ((extra + srq->length - current_ev)
5815                             <= IW_EV_ADDR_LEN) {
5816                                 /* Ask user space to try again with a
5817                                  * bigger buffer */
5818                                 err = -E2BIG;
5819                                 goto out;
5820                         }
5821                 }
5822         }
5823
5824         srq->length = (current_ev - extra);
5825         srq->flags = (__u16) priv->scan_mode;
5826
5827 out:
5828         orinoco_unlock(priv, &flags);
5829         return err;
5830 }
5831
5832 /* Commit handler, called after set operations */
5833 static int orinoco_ioctl_commit(struct net_device *dev,
5834                                 struct iw_request_info *info,
5835                                 void *wrqu,
5836                                 char *extra)
5837 {
5838         struct orinoco_private *priv = netdev_priv(dev);
5839         struct hermes *hw = &priv->hw;
5840         unsigned long flags;
5841         int err = 0;
5842
5843         if (!priv->open)
5844                 return 0;
5845
5846         if (priv->broken_disableport) {
5847                 orinoco_reset(&priv->reset_work);
5848                 return 0;
5849         }
5850
5851         if (orinoco_lock(priv, &flags) != 0)
5852                 return err;
5853
5854         err = hermes_disable_port(hw, 0);
5855         if (err) {
5856                 printk(KERN_WARNING "%s: Unable to disable port "
5857                        "while reconfiguring card\n", dev->name);
5858                 priv->broken_disableport = 1;
5859                 goto out;
5860         }
5861
5862         err = __orinoco_program_rids(dev);
5863         if (err) {
5864                 printk(KERN_WARNING "%s: Unable to reconfigure card\n",
5865                        dev->name);
5866                 goto out;
5867         }
5868
5869         err = hermes_enable_port(hw, 0);
5870         if (err) {
5871                 printk(KERN_WARNING "%s: Unable to enable port while reconfiguring card\n",
5872                        dev->name);
5873                 goto out;
5874         }
5875
5876  out:
5877         if (err) {
5878                 printk(KERN_WARNING "%s: Resetting instead...\n", dev->name);
5879                 schedule_work(&priv->reset_work);
5880                 err = 0;
5881         }
5882
5883         orinoco_unlock(priv, &flags);
5884         return err;
5885 }
5886
5887 static const struct iw_priv_args orinoco_privtab[] = {
5888         { SIOCIWFIRSTPRIV + 0x0, 0, 0, "force_reset" },
5889         { SIOCIWFIRSTPRIV + 0x1, 0, 0, "card_reset" },
5890         { SIOCIWFIRSTPRIV + 0x2, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
5891           0, "set_port3" },
5892         { SIOCIWFIRSTPRIV + 0x3, 0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
5893           "get_port3" },
5894         { SIOCIWFIRSTPRIV + 0x4, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
5895           0, "set_preamble" },
5896         { SIOCIWFIRSTPRIV + 0x5, 0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
5897           "get_preamble" },
5898         { SIOCIWFIRSTPRIV + 0x6, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
5899           0, "set_ibssport" },
5900         { SIOCIWFIRSTPRIV + 0x7, 0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
5901           "get_ibssport" },
5902         { SIOCIWFIRSTPRIV + 0x9, 0, IW_PRIV_TYPE_BYTE | MAX_RID_LEN,
5903           "get_rid" },
5904 };
5905
5906
5907 /*
5908  * Structures to export the Wireless Handlers
5909  */
5910
5911 #define STD_IW_HANDLER(id, func) \
5912         [IW_IOCTL_IDX(id)] = (iw_handler) func
5913 static const iw_handler orinoco_handler[] = {
5914         STD_IW_HANDLER(SIOCSIWCOMMIT,   orinoco_ioctl_commit),
5915         STD_IW_HANDLER(SIOCGIWNAME,     orinoco_ioctl_getname),
5916         STD_IW_HANDLER(SIOCSIWFREQ,     orinoco_ioctl_setfreq),
5917         STD_IW_HANDLER(SIOCGIWFREQ,     orinoco_ioctl_getfreq),
5918         STD_IW_HANDLER(SIOCSIWMODE,     orinoco_ioctl_setmode),
5919         STD_IW_HANDLER(SIOCGIWMODE,     orinoco_ioctl_getmode),
5920         STD_IW_HANDLER(SIOCSIWSENS,     orinoco_ioctl_setsens),
5921         STD_IW_HANDLER(SIOCGIWSENS,     orinoco_ioctl_getsens),
5922         STD_IW_HANDLER(SIOCGIWRANGE,    orinoco_ioctl_getiwrange),
5923         STD_IW_HANDLER(SIOCSIWSPY,      iw_handler_set_spy),
5924         STD_IW_HANDLER(SIOCGIWSPY,      iw_handler_get_spy),
5925         STD_IW_HANDLER(SIOCSIWTHRSPY,   iw_handler_set_thrspy),
5926         STD_IW_HANDLER(SIOCGIWTHRSPY,   iw_handler_get_thrspy),
5927         STD_IW_HANDLER(SIOCSIWAP,       orinoco_ioctl_setwap),
5928         STD_IW_HANDLER(SIOCGIWAP,       orinoco_ioctl_getwap),
5929         STD_IW_HANDLER(SIOCSIWSCAN,     orinoco_ioctl_setscan),
5930         STD_IW_HANDLER(SIOCGIWSCAN,     orinoco_ioctl_getscan),
5931         STD_IW_HANDLER(SIOCSIWESSID,    orinoco_ioctl_setessid),
5932         STD_IW_HANDLER(SIOCGIWESSID,    orinoco_ioctl_getessid),
5933         STD_IW_HANDLER(SIOCSIWNICKN,    orinoco_ioctl_setnick),
5934         STD_IW_HANDLER(SIOCGIWNICKN,    orinoco_ioctl_getnick),
5935         STD_IW_HANDLER(SIOCSIWRATE,     orinoco_ioctl_setrate),
5936         STD_IW_HANDLER(SIOCGIWRATE,     orinoco_ioctl_getrate),
5937         STD_IW_HANDLER(SIOCSIWRTS,      orinoco_ioctl_setrts),
5938         STD_IW_HANDLER(SIOCGIWRTS,      orinoco_ioctl_getrts),
5939         STD_IW_HANDLER(SIOCSIWFRAG,     orinoco_ioctl_setfrag),
5940         STD_IW_HANDLER(SIOCGIWFRAG,     orinoco_ioctl_getfrag),
5941         STD_IW_HANDLER(SIOCGIWRETRY,    orinoco_ioctl_getretry),
5942         STD_IW_HANDLER(SIOCSIWENCODE,   orinoco_ioctl_setiwencode),
5943         STD_IW_HANDLER(SIOCGIWENCODE,   orinoco_ioctl_getiwencode),
5944         STD_IW_HANDLER(SIOCSIWPOWER,    orinoco_ioctl_setpower),
5945         STD_IW_HANDLER(SIOCGIWPOWER,    orinoco_ioctl_getpower),
5946         STD_IW_HANDLER(SIOCSIWGENIE,    orinoco_ioctl_set_genie),
5947         STD_IW_HANDLER(SIOCGIWGENIE,    orinoco_ioctl_get_genie),
5948         STD_IW_HANDLER(SIOCSIWMLME,     orinoco_ioctl_set_mlme),
5949         STD_IW_HANDLER(SIOCSIWAUTH,     orinoco_ioctl_set_auth),
5950         STD_IW_HANDLER(SIOCGIWAUTH,     orinoco_ioctl_get_auth),
5951         STD_IW_HANDLER(SIOCSIWENCODEEXT, orinoco_ioctl_set_encodeext),
5952         STD_IW_HANDLER(SIOCGIWENCODEEXT, orinoco_ioctl_get_encodeext),
5953 };
5954
5955
5956 /*
5957   Added typecasting since we no longer use iwreq_data -- Moustafa
5958  */
5959 static const iw_handler orinoco_private_handler[] = {
5960         [0] = (iw_handler) orinoco_ioctl_reset,
5961         [1] = (iw_handler) orinoco_ioctl_reset,
5962         [2] = (iw_handler) orinoco_ioctl_setport3,
5963         [3] = (iw_handler) orinoco_ioctl_getport3,
5964         [4] = (iw_handler) orinoco_ioctl_setpreamble,
5965         [5] = (iw_handler) orinoco_ioctl_getpreamble,
5966         [6] = (iw_handler) orinoco_ioctl_setibssport,
5967         [7] = (iw_handler) orinoco_ioctl_getibssport,
5968         [9] = (iw_handler) orinoco_ioctl_getrid,
5969 };
5970
5971 static const struct iw_handler_def orinoco_handler_def = {
5972         .num_standard = ARRAY_SIZE(orinoco_handler),
5973         .num_private = ARRAY_SIZE(orinoco_private_handler),
5974         .num_private_args = ARRAY_SIZE(orinoco_privtab),
5975         .standard = orinoco_handler,
5976         .private = orinoco_private_handler,
5977         .private_args = orinoco_privtab,
5978         .get_wireless_stats = orinoco_get_wireless_stats,
5979 };
5980
5981 static void orinoco_get_drvinfo(struct net_device *dev,
5982                                 struct ethtool_drvinfo *info)
5983 {
5984         struct orinoco_private *priv = netdev_priv(dev);
5985
5986         strncpy(info->driver, DRIVER_NAME, sizeof(info->driver) - 1);
5987         strncpy(info->version, DRIVER_VERSION, sizeof(info->version) - 1);
5988         strncpy(info->fw_version, priv->fw_name, sizeof(info->fw_version) - 1);
5989         if (dev->dev.parent)
5990                 strncpy(info->bus_info, dev->dev.parent->bus_id,
5991                         sizeof(info->bus_info) - 1);
5992         else
5993                 snprintf(info->bus_info, sizeof(info->bus_info) - 1,
5994                          "PCMCIA %p", priv->hw.iobase);
5995 }
5996
5997 static const struct ethtool_ops orinoco_ethtool_ops = {
5998         .get_drvinfo = orinoco_get_drvinfo,
5999         .get_link = ethtool_op_get_link,
6000 };
6001
6002 /********************************************************************/
6003 /* Module initialization                                            */
6004 /********************************************************************/
6005
6006 EXPORT_SYMBOL(alloc_orinocodev);
6007 EXPORT_SYMBOL(free_orinocodev);
6008
6009 EXPORT_SYMBOL(__orinoco_up);
6010 EXPORT_SYMBOL(__orinoco_down);
6011 EXPORT_SYMBOL(orinoco_reinit_firmware);
6012
6013 EXPORT_SYMBOL(orinoco_interrupt);
6014
6015 /* Can't be declared "const" or the whole __initdata section will
6016  * become const */
6017 static char version[] __initdata = DRIVER_NAME " " DRIVER_VERSION
6018         " (David Gibson <hermes@gibson.dropbear.id.au>, "
6019         "Pavel Roskin <proski@gnu.org>, et al)";
6020
6021 static int __init init_orinoco(void)
6022 {
6023         printk(KERN_DEBUG "%s\n", version);
6024         return 0;
6025 }
6026
6027 static void __exit exit_orinoco(void)
6028 {
6029 }
6030
6031 module_init(init_orinoco);
6032 module_exit(exit_orinoco);