drivers/net/wireless/orinoco/orinoco.c

   1 /* orinoco.c - (formerly known as dldwd_cs.c and orinoco_cs.c)
   2  *
   3  * A driver for Hermes or Prism 2 chipset based PCMCIA wireless
   4  * adaptors, with Lucent/Agere, Intersil or Symbol firmware.
   5  *
   6  * Current maintainers (as of 29 September 2003) are:
   7  *      Pavel Roskin <proski AT gnu.org>
   8  * and  David Gibson <hermes AT gibson.dropbear.id.au>
   9  *
  10  * (C) Copyright David Gibson, IBM Corporation 2001-2003.
  11  * Copyright (C) 2000 David Gibson, Linuxcare Australia.
  12  *      With some help from :
  13  * Copyright (C) 2001 Jean Tourrilhes, HP Labs
  14  * Copyright (C) 2001 Benjamin Herrenschmidt
  15  *
  16  * Based on dummy_cs.c 1.27 2000/06/12 21:27:25
  17  *
  18  * Portions based on wvlan_cs.c 1.0.6, Copyright Andreas Neuhaus <andy
  19  * AT fasta.fh-dortmund.de>
  20  *      http://www.stud.fh-dortmund.de/~andy/wvlan/
  21  *
  22  * The contents of this file are subject to the Mozilla Public License
  23  * Version 1.1 (the "License"); you may not use this file except in
  24  * compliance with the License. You may obtain a copy of the License
  25  * at http://www.mozilla.org/MPL/
  26  *
  27  * Software distributed under the License is distributed on an "AS IS"
  28  * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
  29  * the License for the specific language governing rights and
  30  * limitations under the License.
  31  *
  32  * The initial developer of the original code is David A. Hinds
  33  * <dahinds AT users.sourceforge.net>.  Portions created by David
  34  * A. Hinds are Copyright (C) 1999 David A. Hinds.  All Rights
  35  * Reserved.
  36  *
  37  * Alternatively, the contents of this file may be used under the
  38  * terms of the GNU General Public License version 2 (the "GPL"), in
  39  * which case the provisions of the GPL are applicable instead of the
  40  * above.  If you wish to allow the use of your version of this file
  41  * only under the terms of the GPL and not to allow others to use your
  42  * version of this file under the MPL, indicate your decision by
  43  * deleting the provisions above and replace them with the notice and
  44  * other provisions required by the GPL.  If you do not delete the
  45  * provisions above, a recipient may use your version of this file
  46  * under either the MPL or the GPL.  */
  47
  48 /*
  49  * TODO
  50  *      o Handle de-encapsulation within network layer, provide 802.11
  51  *        headers (patch from Thomas 'Dent' Mirlacher)
  52  *      o Fix possible races in SPY handling.
  53  *      o Disconnect wireless extensions from fundamental configuration.
  54  *      o (maybe) Software WEP support (patch from Stano Meduna).
  55  *      o (maybe) Use multiple Tx buffers - driver handling queue
  56  *        rather than firmware.
  57  */
  58
  59 /* Locking and synchronization:
  60  *
  61  * The basic principle is that everything is serialized through a
  62  * single spinlock, priv->lock.  The lock is used in user, bh and irq
  63  * context, so when taken outside hardirq context it should always be
  64  * taken with interrupts disabled.  The lock protects both the
  65  * hardware and the struct orinoco_private.
  66  *
  67  * Another flag, priv->hw_unavailable indicates that the hardware is
  68  * unavailable for an extended period of time (e.g. suspended, or in
  69  * the middle of a hard reset).  This flag is protected by the
  70  * spinlock.  All code which touches the hardware should check the
  71  * flag after taking the lock, and if it is set, give up on whatever
  72  * they are doing and drop the lock again.  The orinoco_lock()
  73  * function handles this (it unlocks and returns -EBUSY if
  74  * hw_unavailable is non-zero).
  75  */
  76
  77 #define DRIVER_NAME "orinoco"
  78
  79 #include <linux/module.h>
  80 #include <linux/kernel.h>
  81 #include <linux/init.h>
  82 #include <linux/delay.h>
  83 #include <linux/netdevice.h>
  84 #include <linux/etherdevice.h>
  85 #include <linux/ethtool.h>
  86 #include <linux/firmware.h>
  87 #include <linux/if_arp.h>
  88 #include <linux/wireless.h>
  89 #include <linux/ieee80211.h>
  90 #include <net/iw_handler.h>
  91
  92 #include <linux/scatterlist.h>
  93 #include <linux/crypto.h>
  94
  95 #include "hermes_rid.h"
  96 #include "hermes_dld.h"
  97 #include "orinoco.h"
  98
  99 /********************************************************************/
 100 /* Module information                                               */
 101 /********************************************************************/
 102
 103 MODULE_AUTHOR("Pavel Roskin <proski@gnu.org> & David Gibson <hermes@gibson.dropbear.id.au>");
 104 MODULE_DESCRIPTION("Driver for Lucent Orinoco, Prism II based and similar wireless cards");
 105 MODULE_LICENSE("Dual MPL/GPL");
 106
 107 /* Level of debugging. Used in the macros in orinoco.h */
 108 #ifdef ORINOCO_DEBUG
 109 int orinoco_debug = ORINOCO_DEBUG;
 110 module_param(orinoco_debug, int, 0644);
 111 MODULE_PARM_DESC(orinoco_debug, "Debug level");
 112 EXPORT_SYMBOL(orinoco_debug);
 113 #endif
 114
 115 static int suppress_linkstatus; /* = 0 */
 116 module_param(suppress_linkstatus, bool, 0644);
 117 MODULE_PARM_DESC(suppress_linkstatus, "Don't log link status changes");
 118 static int ignore_disconnect; /* = 0 */
 119 module_param(ignore_disconnect, int, 0644);
 120 MODULE_PARM_DESC(ignore_disconnect, "Don't report lost link to the network layer");
 121
 122 static int force_monitor; /* = 0 */
 123 module_param(force_monitor, int, 0644);
 124 MODULE_PARM_DESC(force_monitor, "Allow monitor mode for all firmware versions");
 125
 126 /********************************************************************/
 127 /* Compile time configuration and compatibility stuff               */
 128 /********************************************************************/
 129
 130 /* We do this this way to avoid ifdefs in the actual code */
 131 #ifdef WIRELESS_SPY
 132 #define SPY_NUMBER(priv)        (priv->spy_data.spy_number)
 133 #else
 134 #define SPY_NUMBER(priv)        0
 135 #endif /* WIRELESS_SPY */
 136
 137 /********************************************************************/
 138 /* Internal constants                                               */
 139 /********************************************************************/
 140
 141 /* 802.2 LLC/SNAP header used for Ethernet encapsulation over 802.11 */
 142 static const u8 encaps_hdr[] = {0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00};
 143 #define ENCAPS_OVERHEAD         (sizeof(encaps_hdr) + 2)
 144
 145 #define ORINOCO_MIN_MTU         256
 146 #define ORINOCO_MAX_MTU         (IEEE80211_MAX_DATA_LEN - ENCAPS_OVERHEAD)
 147
 148 #define SYMBOL_MAX_VER_LEN      (14)
 149 #define USER_BAP                0
 150 #define IRQ_BAP                 1
 151 #define MAX_IRQLOOPS_PER_IRQ    10
 152 #define MAX_IRQLOOPS_PER_JIFFY  (20000/HZ) /* Based on a guestimate of
 153                                             * how many events the
 154                                             * device could
 155                                             * legitimately generate */
 156 #define SMALL_KEY_SIZE          5
 157 #define LARGE_KEY_SIZE          13
 158 #define TX_NICBUF_SIZE_BUG      1585            /* Bug in Symbol firmware */
 159
 160 #define DUMMY_FID               0xFFFF
 161
 162 /*#define MAX_MULTICAST(priv)   (priv->firmware_type == FIRMWARE_TYPE_AGERE ? \
 163   HERMES_MAX_MULTICAST : 0)*/
 164 #define MAX_MULTICAST(priv)     (HERMES_MAX_MULTICAST)
 165
 166 #define ORINOCO_INTEN           (HERMES_EV_RX | HERMES_EV_ALLOC \
 167                                  | HERMES_EV_TX | HERMES_EV_TXEXC \
 168                                  | HERMES_EV_WTERR | HERMES_EV_INFO \
 169                                  | HERMES_EV_INFDROP )
 170
 171 #define MAX_RID_LEN 1024
 172
 173 static const struct iw_handler_def orinoco_handler_def;
 174 static const struct ethtool_ops orinoco_ethtool_ops;
 175
 176 /********************************************************************/
 177 /* Data tables                                                      */
 178 /********************************************************************/
 179
 180 /* The frequency of each channel in MHz */
 181 static const long channel_frequency[] = {
 182         2412, 2417, 2422, 2427, 2432, 2437, 2442,
 183         2447, 2452, 2457, 2462, 2467, 2472, 2484
 184 };
 185 #define NUM_CHANNELS ARRAY_SIZE(channel_frequency)
 186
 187 /* This tables gives the actual meanings of the bitrate IDs returned
 188  * by the firmware. */
 189 static struct {
 190         int bitrate; /* in 100s of kilobits */
 191         int automatic;
 192         u16 agere_txratectrl;
 193         u16 intersil_txratectrl;
 194 } bitrate_table[] = {
 195         {110, 1,  3, 15}, /* Entry 0 is the default */
 196         {10,  0,  1,  1},
 197         {10,  1,  1,  1},
 198         {20,  0,  2,  2},
 199         {20,  1,  6,  3},
 200         {55,  0,  4,  4},
 201         {55,  1,  7,  7},
 202         {110, 0,  5,  8},
 203 };
 204 #define BITRATE_TABLE_SIZE ARRAY_SIZE(bitrate_table)
 205
 206 /********************************************************************/
 207 /* Data types                                                       */
 208 /********************************************************************/
 209
 210 /* Beginning of the Tx descriptor, used in TxExc handling */
 211 struct hermes_txexc_data {
 212         struct hermes_tx_descriptor desc;
 213         __le16 frame_ctl;
 214         __le16 duration_id;
 215         u8 addr1[ETH_ALEN];
 216 } __attribute__ ((packed));
 217
 218 /* Rx frame header except compatibility 802.3 header */
 219 struct hermes_rx_descriptor {
 220         /* Control */
 221         __le16 status;
 222         __le32 time;
 223         u8 silence;
 224         u8 signal;
 225         u8 rate;
 226         u8 rxflow;
 227         __le32 reserved;
 228
 229         /* 802.11 header */
 230         __le16 frame_ctl;
 231         __le16 duration_id;
 232         u8 addr1[ETH_ALEN];
 233         u8 addr2[ETH_ALEN];
 234         u8 addr3[ETH_ALEN];
 235         __le16 seq_ctl;
 236         u8 addr4[ETH_ALEN];
 237
 238         /* Data length */
 239         __le16 data_len;
 240 } __attribute__ ((packed));
 241
 242 /********************************************************************/
 243 /* Function prototypes                                              */
 244 /********************************************************************/
 245
 246 static int __orinoco_program_rids(struct net_device *dev);
 247 static void __orinoco_set_multicast_list(struct net_device *dev);
 248
 249 /********************************************************************/
 250 /* Michael MIC crypto setup                                         */
 251 /********************************************************************/
 252 #define MICHAEL_MIC_LEN 8
 253 static int orinoco_mic_init(struct orinoco_private *priv)
 254 {
 255         priv->tx_tfm_mic = crypto_alloc_hash("michael_mic", 0, 0);
 256         if (IS_ERR(priv->tx_tfm_mic)) {
 257                 printk(KERN_DEBUG "orinoco_mic_init: could not allocate "
 258                        "crypto API michael_mic\n");
 259                 priv->tx_tfm_mic = NULL;
 260                 return -ENOMEM;
 261         }
 262
 263         priv->rx_tfm_mic = crypto_alloc_hash("michael_mic", 0, 0);
 264         if (IS_ERR(priv->rx_tfm_mic)) {
 265                 printk(KERN_DEBUG "orinoco_mic_init: could not allocate "
 266                        "crypto API michael_mic\n");
 267                 priv->rx_tfm_mic = NULL;
 268                 return -ENOMEM;
 269         }
 270
 271         return 0;
 272 }
 273
 274 static void orinoco_mic_free(struct orinoco_private *priv)
 275 {
 276         if (priv->tx_tfm_mic)
 277                 crypto_free_hash(priv->tx_tfm_mic);
 278         if (priv->rx_tfm_mic)
 279                 crypto_free_hash(priv->rx_tfm_mic);
 280 }
 281
 282 static int michael_mic(struct crypto_hash *tfm_michael, u8 *key,
 283                        u8 *da, u8 *sa, u8 priority,
 284                        u8 *data, size_t data_len, u8 *mic)
 285 {
 286         struct hash_desc desc;
 287         struct scatterlist sg[2];
 288         u8 hdr[ETH_HLEN + 2]; /* size of header + padding */
 289
 290         if (tfm_michael == NULL) {
 291                 printk(KERN_WARNING "michael_mic: tfm_michael == NULL\n");
 292                 return -1;
 293         }
 294
 295         /* Copy header into buffer. We need the padding on the end zeroed */
 296         memcpy(&hdr[0], da, ETH_ALEN);
 297         memcpy(&hdr[ETH_ALEN], sa, ETH_ALEN);
 298         hdr[ETH_ALEN*2] = priority;
 299         hdr[ETH_ALEN*2+1] = 0;
 300         hdr[ETH_ALEN*2+2] = 0;
 301         hdr[ETH_ALEN*2+3] = 0;
 302
 303         /* Use scatter gather to MIC header and data in one go */
 304         sg_init_table(sg, 2);
 305         sg_set_buf(&sg[0], hdr, sizeof(hdr));
 306         sg_set_buf(&sg[1], data, data_len);
 307
 308         if (crypto_hash_setkey(tfm_michael, key, MIC_KEYLEN))
 309                 return -1;
 310
 311         desc.tfm = tfm_michael;
 312         desc.flags = 0;
 313         return crypto_hash_digest(&desc, sg, data_len + sizeof(hdr),
 314                                   mic);
 315 }
 316
 317 /********************************************************************/
 318 /* Internal helper functions                                        */
 319 /********************************************************************/
 320
 321 static inline void set_port_type(struct orinoco_private *priv)
 322 {
 323         switch (priv->iw_mode) {
 324         case IW_MODE_INFRA:
 325                 priv->port_type = 1;
 326                 priv->createibss = 0;
 327                 break;
 328         case IW_MODE_ADHOC:
 329                 if (priv->prefer_port3) {
 330                         priv->port_type = 3;
 331                         priv->createibss = 0;
 332                 } else {
 333                         priv->port_type = priv->ibss_port;
 334                         priv->createibss = 1;
 335                 }
 336                 break;
 337         case IW_MODE_MONITOR:
 338                 priv->port_type = 3;
 339                 priv->createibss = 0;
 340                 break;
 341         default:
 342                 printk(KERN_ERR "%s: Invalid priv->iw_mode in set_port_type()\n",
 343                        priv->ndev->name);
 344         }
 345 }
 346
 347 #define ORINOCO_MAX_BSS_COUNT   64
 348 static int orinoco_bss_data_allocate(struct orinoco_private *priv)
 349 {
 350         if (priv->bss_xbss_data)
 351                 return 0;
 352
 353         if (priv->has_ext_scan)
 354                 priv->bss_xbss_data = kzalloc(ORINOCO_MAX_BSS_COUNT *
 355                                               sizeof(struct xbss_element),
 356                                               GFP_KERNEL);
 357         else
 358                 priv->bss_xbss_data = kzalloc(ORINOCO_MAX_BSS_COUNT *
 359                                               sizeof(struct bss_element),
 360                                               GFP_KERNEL);
 361
 362         if (!priv->bss_xbss_data) {
 363                 printk(KERN_WARNING "Out of memory allocating beacons");
 364                 return -ENOMEM;
 365         }
 366         return 0;
 367 }
 368
 369 static void orinoco_bss_data_free(struct orinoco_private *priv)
 370 {
 371         kfree(priv->bss_xbss_data);
 372         priv->bss_xbss_data = NULL;
 373 }
 374
 375 #define PRIV_BSS        ((struct bss_element *)priv->bss_xbss_data)
 376 #define PRIV_XBSS       ((struct xbss_element *)priv->bss_xbss_data)
 377 static void orinoco_bss_data_init(struct orinoco_private *priv)
 378 {
 379         int i;
 380
 381         INIT_LIST_HEAD(&priv->bss_free_list);
 382         INIT_LIST_HEAD(&priv->bss_list);
 383         if (priv->has_ext_scan)
 384                 for (i = 0; i < ORINOCO_MAX_BSS_COUNT; i++)
 385                         list_add_tail(&(PRIV_XBSS[i].list),
 386                                       &priv->bss_free_list);
 387         else
 388                 for (i = 0; i < ORINOCO_MAX_BSS_COUNT; i++)
 389                         list_add_tail(&(PRIV_BSS[i].list),
 390                                       &priv->bss_free_list);
 391
 392 }
 393
 394 static inline u8 *orinoco_get_ie(u8 *data, size_t len,
 395                                  enum ieee80211_eid eid)
 396 {
 397         u8 *p = data;
 398         while ((p + 2) < (data + len)) {
 399                 if (p[0] == eid)
 400                         return p;
 401                 p += p[1] + 2;
 402         }
 403         return NULL;
 404 }
 405
 406 #define WPA_OUI_TYPE    "\x00\x50\xF2\x01"
 407 #define WPA_SELECTOR_LEN 4
 408 static inline u8 *orinoco_get_wpa_ie(u8 *data, size_t len)
 409 {
 410         u8 *p = data;
 411         while ((p + 2 + WPA_SELECTOR_LEN) < (data + len)) {
 412                 if ((p[0] == WLAN_EID_GENERIC) &&
 413                     (memcmp(&p[2], WPA_OUI_TYPE, WPA_SELECTOR_LEN) == 0))
 414                         return p;
 415                 p += p[1] + 2;
 416         }
 417         return NULL;
 418 }
 419
 420
 421 /********************************************************************/
 422 /* Download functionality                                           */
 423 /********************************************************************/
 424
 425 struct fw_info {
 426         char *pri_fw;
 427         char *sta_fw;
 428         char *ap_fw;
 429         u32 pda_addr;
 430         u16 pda_size;
 431 };
 432
 433 const static struct fw_info orinoco_fw[] = {
 434         { "", "agere_sta_fw.bin", "agere_ap_fw.bin", 0x00390000, 1000 },
 435         { "", "prism_sta_fw.bin", "prism_ap_fw.bin", 0, 1024 },
 436         { "symbol_sp24t_prim_fw", "symbol_sp24t_sec_fw", "", 0x00003100, 512 }
 437 };
 438
 439 /* Structure used to access fields in FW
 440  * Make sure LE decoding macros are used
 441  */
 442 struct orinoco_fw_header {
 443         char hdr_vers[6];       /* ASCII string for header version */
 444         __le16 headersize;      /* Total length of header */
 445         __le32 entry_point;     /* NIC entry point */
 446         __le32 blocks;          /* Number of blocks to program */
 447         __le32 block_offset;    /* Offset of block data from eof header */
 448         __le32 pdr_offset;      /* Offset to PDR data from eof header */
 449         __le32 pri_offset;      /* Offset to primary plug data */
 450         __le32 compat_offset;   /* Offset to compatibility data*/
 451         char signature[0];      /* FW signature length headersize-20 */
 452 } __attribute__ ((packed));
 453
 454 /* Download either STA or AP firmware into the card. */
 455 static int
 456 orinoco_dl_firmware(struct orinoco_private *priv,
 457                     const struct fw_info *fw,
 458                     int ap)
 459 {
 460         /* Plug Data Area (PDA) */
 461         __le16 *pda;
 462
 463         hermes_t *hw = &priv->hw;
 464         const struct firmware *fw_entry;
 465         const struct orinoco_fw_header *hdr;
 466         const unsigned char *first_block;
 467         const unsigned char *end;
 468         const char *firmware;
 469         struct net_device *dev = priv->ndev;
 470         int err = 0;
 471
 472         pda = kzalloc(fw->pda_size, GFP_KERNEL);
 473         if (!pda)
 474                 return -ENOMEM;
 475
 476         if (ap)
 477                 firmware = fw->ap_fw;
 478         else
 479                 firmware = fw->sta_fw;
 480
 481         printk(KERN_DEBUG "%s: Attempting to download firmware %s\n",
 482                dev->name, firmware);
 483
 484         /* Read current plug data */
 485         err = hermes_read_pda(hw, pda, fw->pda_addr, fw->pda_size, 0);
 486         printk(KERN_DEBUG "%s: Read PDA returned %d\n", dev->name, err);
 487         if (err)
 488                 goto free;
 489
 490         if (priv->cached_fw)
 491                 fw_entry = priv->cached_fw;
 492         else {
 493                 err = request_firmware(&fw_entry, firmware, priv->dev);
 494                 if (err) {
 495                         printk(KERN_ERR "%s: Cannot find firmware %s\n",
 496                                dev->name, firmware);
 497                         err = -ENOENT;
 498                         goto free;
 499                 }
 500                 priv->cached_fw = fw_entry;
 501         }
 502
 503         hdr = (const struct orinoco_fw_header *) fw_entry->data;
 504
 505         /* Enable aux port to allow programming */
 506         err = hermesi_program_init(hw, le32_to_cpu(hdr->entry_point));
 507         printk(KERN_DEBUG "%s: Program init returned %d\n", dev->name, err);
 508         if (err != 0)
 509                 goto abort;
 510
 511         /* Program data */
 512         first_block = (fw_entry->data +
 513                        le16_to_cpu(hdr->headersize) +
 514                        le32_to_cpu(hdr->block_offset));
 515         end = fw_entry->data + fw_entry->size;
 516
 517         err = hermes_program(hw, first_block, end);
 518         printk(KERN_DEBUG "%s: Program returned %d\n", dev->name, err);
 519         if (err != 0)
 520                 goto abort;
 521
 522         /* Update production data */
 523         first_block = (fw_entry->data +
 524                        le16_to_cpu(hdr->headersize) +
 525                        le32_to_cpu(hdr->pdr_offset));
 526
 527         err = hermes_apply_pda_with_defaults(hw, first_block, pda);
 528         printk(KERN_DEBUG "%s: Apply PDA returned %d\n", dev->name, err);
 529         if (err)
 530                 goto abort;
 531
 532         /* Tell card we've finished */
 533         err = hermesi_program_end(hw);
 534         printk(KERN_DEBUG "%s: Program end returned %d\n", dev->name, err);
 535         if (err != 0)
 536                 goto abort;
 537
 538         /* Check if we're running */
 539         printk(KERN_DEBUG "%s: hermes_present returned %d\n",
 540                dev->name, hermes_present(hw));
 541
 542 abort:
 543         /* In case of error, assume firmware was bogus and release it */
 544         if (err) {
 545                 priv->cached_fw = NULL;
 546                 release_firmware(fw_entry);
 547         }
 548
 549 free:
 550         kfree(pda);
 551         return err;
 552 }
 553
 554 /* End markers */
 555 #define TEXT_END        0x1A            /* End of text header */
 556
 557 /*
 558  * Process a firmware image - stop the card, load the firmware, reset
 559  * the card and make sure it responds.  For the secondary firmware take
 560  * care of the PDA - read it and then write it on top of the firmware.
 561  */
 562 static int
 563 symbol_dl_image(struct orinoco_private *priv, const struct fw_info *fw,
 564                 const unsigned char *image, const unsigned char *end,
 565                 int secondary)
 566 {
 567         hermes_t *hw = &priv->hw;
 568         int ret = 0;
 569         const unsigned char *ptr;
 570         const unsigned char *first_block;
 571
 572         /* Plug Data Area (PDA) */
 573         __le16 *pda = NULL;
 574
 575         /* Binary block begins after the 0x1A marker */
 576         ptr = image;
 577         while (*ptr++ != TEXT_END);
 578         first_block = ptr;
 579
 580         /* Read the PDA from EEPROM */
 581         if (secondary) {
 582                 pda = kzalloc(fw->pda_size, GFP_KERNEL);
 583                 if (!pda)
 584                         return -ENOMEM;
 585
 586                 ret = hermes_read_pda(hw, pda, fw->pda_addr, fw->pda_size, 1);
 587                 if (ret)
 588                         goto free;
 589         }
 590
 591         /* Stop the firmware, so that it can be safely rewritten */
 592         if (priv->stop_fw) {
 593                 ret = priv->stop_fw(priv, 1);
 594                 if (ret)
 595                         goto free;
 596         }
 597
 598         /* Program the adapter with new firmware */
 599         ret = hermes_program(hw, first_block, end);
 600         if (ret)
 601                 goto free;
 602
 603         /* Write the PDA to the adapter */
 604         if (secondary) {
 605                 size_t len = hermes_blocks_length(first_block);
 606                 ptr = first_block + len;
 607                 ret = hermes_apply_pda(hw, ptr, pda);
 608                 kfree(pda);
 609                 if (ret)
 610                         return ret;
 611         }
 612
 613         /* Run the firmware */
 614         if (priv->stop_fw) {
 615                 ret = priv->stop_fw(priv, 0);
 616                 if (ret)
 617                         return ret;
 618         }
 619
 620         /* Reset hermes chip and make sure it responds */
 621         ret = hermes_init(hw);
 622
 623         /* hermes_reset() should return 0 with the secondary firmware */
 624         if (secondary && ret != 0)
 625                 return -ENODEV;
 626
 627         /* And this should work with any firmware */
 628         if (!hermes_present(hw))
 629                 return -ENODEV;
 630
 631         return 0;
 632
 633 free:
 634         kfree(pda);
 635         return ret;
 636 }
 637
 638
 639 /*
 640  * Download the firmware into the card, this also does a PCMCIA soft
 641  * reset on the card, to make sure it's in a sane state.
 642  */
 643 static int
 644 symbol_dl_firmware(struct orinoco_private *priv,
 645                    const struct fw_info *fw)
 646 {
 647         struct net_device *dev = priv->ndev;
 648         int ret;
 649         const struct firmware *fw_entry;
 650
 651         if (request_firmware(&fw_entry, fw->pri_fw,
 652                              priv->dev) != 0) {
 653                 printk(KERN_ERR "%s: Cannot find firmware: %s\n",
 654                        dev->name, fw->pri_fw);
 655                 return -ENOENT;
 656         }
 657
 658         /* Load primary firmware */
 659         ret = symbol_dl_image(priv, fw, fw_entry->data,
 660                               fw_entry->data + fw_entry->size, 0);
 661         release_firmware(fw_entry);
 662         if (ret) {
 663                 printk(KERN_ERR "%s: Primary firmware download failed\n",
 664                        dev->name);
 665                 return ret;
 666         }
 667
 668         if (request_firmware(&fw_entry, fw->sta_fw,
 669                              priv->dev) != 0) {
 670                 printk(KERN_ERR "%s: Cannot find firmware: %s\n",
 671                        dev->name, fw->sta_fw);
 672                 return -ENOENT;
 673         }
 674
 675         /* Load secondary firmware */
 676         ret = symbol_dl_image(priv, fw, fw_entry->data,
 677                               fw_entry->data + fw_entry->size, 1);
 678         release_firmware(fw_entry);
 679         if (ret) {
 680                 printk(KERN_ERR "%s: Secondary firmware download failed\n",
 681                        dev->name);
 682         }
 683
 684         return ret;
 685 }
 686
 687 static int orinoco_download(struct orinoco_private *priv)
 688 {
 689         int err = 0;
 690         /* Reload firmware */
 691         switch (priv->firmware_type) {
 692         case FIRMWARE_TYPE_AGERE:
 693                 /* case FIRMWARE_TYPE_INTERSIL: */
 694                 err = orinoco_dl_firmware(priv,
 695                                           &orinoco_fw[priv->firmware_type], 0);
 696                 break;
 697
 698         case FIRMWARE_TYPE_SYMBOL:
 699                 err = symbol_dl_firmware(priv,
 700                                          &orinoco_fw[priv->firmware_type]);
 701                 break;
 702         case FIRMWARE_TYPE_INTERSIL:
 703                 break;
 704         }
 705         /* TODO: if we fail we probably need to reinitialise
 706          * the driver */
 707
 708         return err;
 709 }
 710
 711 /********************************************************************/
 712 /* Device methods                                                   */
 713 /********************************************************************/
 714
 715 static int orinoco_open(struct net_device *dev)
 716 {
 717         struct orinoco_private *priv = netdev_priv(dev);
 718         unsigned long flags;
 719         int err;
 720
 721         if (orinoco_lock(priv, &flags) != 0)
 722                 return -EBUSY;
 723
 724         err = __orinoco_up(dev);
 725
 726         if (! err)
 727                 priv->open = 1;
 728
 729         orinoco_unlock(priv, &flags);
 730
 731         return err;
 732 }
 733
 734 static int orinoco_stop(struct net_device *dev)
 735 {
 736         struct orinoco_private *priv = netdev_priv(dev);
 737         int err = 0;
 738
 739         /* We mustn't use orinoco_lock() here, because we need to be
 740            able to close the interface even if hw_unavailable is set
 741            (e.g. as we're released after a PC Card removal) */
 742         spin_lock_irq(&priv->lock);
 743
 744         priv->open = 0;
 745
 746         err = __orinoco_down(dev);
 747
 748         spin_unlock_irq(&priv->lock);
 749
 750         return err;
 751 }
 752
 753 static struct net_device_stats *orinoco_get_stats(struct net_device *dev)
 754 {
 755         struct orinoco_private *priv = netdev_priv(dev);
 756
 757         return &priv->stats;
 758 }
 759
 760 static struct iw_statistics *orinoco_get_wireless_stats(struct net_device *dev)
 761 {
 762         struct orinoco_private *priv = netdev_priv(dev);
 763         hermes_t *hw = &priv->hw;
 764         struct iw_statistics *wstats = &priv->wstats;
 765         int err;
 766         unsigned long flags;
 767
 768         if (! netif_device_present(dev)) {
 769                 printk(KERN_WARNING "%s: get_wireless_stats() called while device not present\n",
 770                        dev->name);
 771                 return NULL; /* FIXME: Can we do better than this? */
 772         }
 773
 774         /* If busy, return the old stats.  Returning NULL may cause
 775          * the interface to disappear from /proc/net/wireless */
 776         if (orinoco_lock(priv, &flags) != 0)
 777                 return wstats;
 778
 779         /* We can't really wait for the tallies inquiry command to
 780          * complete, so we just use the previous results and trigger
 781          * a new tallies inquiry command for next time - Jean II */
 782         /* FIXME: Really we should wait for the inquiry to come back -
 783          * as it is the stats we give don't make a whole lot of sense.
 784          * Unfortunately, it's not clear how to do that within the
 785          * wireless extensions framework: I think we're in user
 786          * context, but a lock seems to be held by the time we get in
 787          * here so we're not safe to sleep here. */
 788         hermes_inquire(hw, HERMES_INQ_TALLIES);
 789
 790         if (priv->iw_mode == IW_MODE_ADHOC) {
 791                 memset(&wstats->qual, 0, sizeof(wstats->qual));
 792                 /* If a spy address is defined, we report stats of the
 793                  * first spy address - Jean II */
 794                 if (SPY_NUMBER(priv)) {
 795                         wstats->qual.qual = priv->spy_data.spy_stat[0].qual;
 796                         wstats->qual.level = priv->spy_data.spy_stat[0].level;
 797                         wstats->qual.noise = priv->spy_data.spy_stat[0].noise;
 798                         wstats->qual.updated = priv->spy_data.spy_stat[0].updated;
 799                 }
 800         } else {
 801                 struct {
 802                         __le16 qual, signal, noise, unused;
 803                 } __attribute__ ((packed)) cq;
 804
 805                 err = HERMES_READ_RECORD(hw, USER_BAP,
 806                                          HERMES_RID_COMMSQUALITY, &cq);
 807
 808                 if (!err) {
 809                         wstats->qual.qual = (int)le16_to_cpu(cq.qual);
 810                         wstats->qual.level = (int)le16_to_cpu(cq.signal) - 0x95;
 811                         wstats->qual.noise = (int)le16_to_cpu(cq.noise) - 0x95;
 812                         wstats->qual.updated = 7;
 813                 }
 814         }
 815
 816         orinoco_unlock(priv, &flags);
 817         return wstats;
 818 }
 819
 820 static void orinoco_set_multicast_list(struct net_device *dev)
 821 {
 822         struct orinoco_private *priv = netdev_priv(dev);
 823         unsigned long flags;
 824
 825         if (orinoco_lock(priv, &flags) != 0) {
 826                 printk(KERN_DEBUG "%s: orinoco_set_multicast_list() "
 827                        "called when hw_unavailable\n", dev->name);
 828                 return;
 829         }
 830
 831         __orinoco_set_multicast_list(dev);
 832         orinoco_unlock(priv, &flags);
 833 }
 834
 835 static int orinoco_change_mtu(struct net_device *dev, int new_mtu)
 836 {
 837         struct orinoco_private *priv = netdev_priv(dev);
 838
 839         if ( (new_mtu < ORINOCO_MIN_MTU) || (new_mtu > ORINOCO_MAX_MTU) )
 840                 return -EINVAL;
 841
 842         /* MTU + encapsulation + header length */
 843         if ( (new_mtu + ENCAPS_OVERHEAD + sizeof(struct ieee80211_hdr)) >
 844              (priv->nicbuf_size - ETH_HLEN) )
 845                 return -EINVAL;
 846
 847         dev->mtu = new_mtu;
 848
 849         return 0;
 850 }
 851
 852 /********************************************************************/
 853 /* Tx path                                                          */
 854 /********************************************************************/
 855
 856 static int orinoco_xmit(struct sk_buff *skb, struct net_device *dev)
 857 {
 858         struct orinoco_private *priv = netdev_priv(dev);
 859         struct net_device_stats *stats = &priv->stats;
 860         hermes_t *hw = &priv->hw;
 861         int err = 0;
 862         u16 txfid = priv->txfid;
 863         struct ethhdr *eh;
 864         int tx_control;
 865         unsigned long flags;
 866
 867         if (! netif_running(dev)) {
 868                 printk(KERN_ERR "%s: Tx on stopped device!\n",
 869                        dev->name);
 870                 return NETDEV_TX_BUSY;
 871         }
 872
 873         if (netif_queue_stopped(dev)) {
 874                 printk(KERN_DEBUG "%s: Tx while transmitter busy!\n",
 875                        dev->name);
 876                 return NETDEV_TX_BUSY;
 877         }
 878
 879         if (orinoco_lock(priv, &flags) != 0) {
 880                 printk(KERN_ERR "%s: orinoco_xmit() called while hw_unavailable\n",
 881                        dev->name);
 882                 return NETDEV_TX_BUSY;
 883         }
 884
 885         if (! netif_carrier_ok(dev) || (priv->iw_mode == IW_MODE_MONITOR)) {
 886                 /* Oops, the firmware hasn't established a connection,
 887                    silently drop the packet (this seems to be the
 888                    safest approach). */
 889                 goto drop;
 890         }
 891
 892         /* Check packet length */
 893         if (skb->len < ETH_HLEN)
 894                 goto drop;
 895
 896         tx_control = HERMES_TXCTRL_TX_OK | HERMES_TXCTRL_TX_EX;
 897
 898         if (priv->encode_alg == IW_ENCODE_ALG_TKIP)
 899                 tx_control |= (priv->tx_key << HERMES_MIC_KEY_ID_SHIFT) |
 900                         HERMES_TXCTRL_MIC;
 901
 902         if (priv->has_alt_txcntl) {
 903                 /* WPA enabled firmwares have tx_cntl at the end of
 904                  * the 802.11 header.  So write zeroed descriptor and
 905                  * 802.11 header at the same time
 906                  */
 907                 char desc[HERMES_802_3_OFFSET];
 908                 __le16 *txcntl = (__le16 *) &desc[HERMES_TXCNTL2_OFFSET];
 909
 910                 memset(&desc, 0, sizeof(desc));
 911
 912                 *txcntl = cpu_to_le16(tx_control);
 913                 err = hermes_bap_pwrite(hw, USER_BAP, &desc, sizeof(desc),
 914                                         txfid, 0);
 915                 if (err) {
 916                         if (net_ratelimit())
 917                                 printk(KERN_ERR "%s: Error %d writing Tx "
 918                                        "descriptor to BAP\n", dev->name, err);
 919                         goto busy;
 920                 }
 921         } else {
 922                 struct hermes_tx_descriptor desc;
 923
 924                 memset(&desc, 0, sizeof(desc));
 925
 926                 desc.tx_control = cpu_to_le16(tx_control);
 927                 err = hermes_bap_pwrite(hw, USER_BAP, &desc, sizeof(desc),
 928                                         txfid, 0);
 929                 if (err) {
 930                         if (net_ratelimit())
 931                                 printk(KERN_ERR "%s: Error %d writing Tx "
 932                                        "descriptor to BAP\n", dev->name, err);
 933                         goto busy;
 934                 }
 935
 936                 /* Clear the 802.11 header and data length fields - some
 937                  * firmwares (e.g. Lucent/Agere 8.xx) appear to get confused
 938                  * if this isn't done. */
 939                 hermes_clear_words(hw, HERMES_DATA0,
 940                                    HERMES_802_3_OFFSET - HERMES_802_11_OFFSET);
 941         }
 942
 943         eh = (struct ethhdr *)skb->data;
 944
 945         /* Encapsulate Ethernet-II frames */
 946         if (ntohs(eh->h_proto) > ETH_DATA_LEN) { /* Ethernet-II frame */
 947                 struct header_struct {
 948                         struct ethhdr eth;      /* 802.3 header */
 949                         u8 encap[6];            /* 802.2 header */
 950                 } __attribute__ ((packed)) hdr;
 951
 952                 /* Strip destination and source from the data */
 953                 skb_pull(skb, 2 * ETH_ALEN);
 954
 955                 /* And move them to a separate header */
 956                 memcpy(&hdr.eth, eh, 2 * ETH_ALEN);
 957                 hdr.eth.h_proto = htons(sizeof(encaps_hdr) + skb->len);
 958                 memcpy(hdr.encap, encaps_hdr, sizeof(encaps_hdr));
 959
 960                 /* Insert the SNAP header */
 961                 if (skb_headroom(skb) < sizeof(hdr)) {
 962                         printk(KERN_ERR
 963                                "%s: Not enough headroom for 802.2 headers %d\n",
 964                                dev->name, skb_headroom(skb));
 965                         goto drop;
 966                 }
 967                 eh = (struct ethhdr *) skb_push(skb, sizeof(hdr));
 968                 memcpy(eh, &hdr, sizeof(hdr));
 969         }
 970
 971         err = hermes_bap_pwrite(hw, USER_BAP, skb->data, skb->len,
 972                                 txfid, HERMES_802_3_OFFSET);
 973         if (err) {
 974                 printk(KERN_ERR "%s: Error %d writing packet to BAP\n",
 975                        dev->name, err);
 976                 goto busy;
 977         }
 978
 979         /* Calculate Michael MIC */
 980         if (priv->encode_alg == IW_ENCODE_ALG_TKIP) {
 981                 u8 mic_buf[MICHAEL_MIC_LEN + 1];
 982                 u8 *mic;
 983                 size_t offset;
 984                 size_t len;
 985
 986                 if (skb->len % 2) {
 987                         /* MIC start is on an odd boundary */
 988                         mic_buf[0] = skb->data[skb->len - 1];
 989                         mic = &mic_buf[1];
 990                         offset = skb->len - 1;
 991                         len = MICHAEL_MIC_LEN + 1;
 992                 } else {
 993                         mic = &mic_buf[0];
 994                         offset = skb->len;
 995                         len = MICHAEL_MIC_LEN;
 996                 }
 997
 998                 michael_mic(priv->tx_tfm_mic,
 999                             priv->tkip_key[priv->tx_key].tx_mic,
1000                             eh->h_dest, eh->h_source, 0 /* priority */,
1001                             skb->data + ETH_HLEN, skb->len - ETH_HLEN, mic);
1002
1003                 /* Write the MIC */
1004                 err = hermes_bap_pwrite(hw, USER_BAP, &mic_buf[0], len,
1005                                         txfid, HERMES_802_3_OFFSET + offset);
1006                 if (err) {
1007                         printk(KERN_ERR "%s: Error %d writing MIC to BAP\n",
1008                                dev->name, err);
1009                         goto busy;
1010                 }
1011         }
1012
1013         /* Finally, we actually initiate the send */
1014         netif_stop_queue(dev);
1015
1016         err = hermes_docmd_wait(hw, HERMES_CMD_TX | HERMES_CMD_RECL,
1017                                 txfid, NULL);
1018         if (err) {
1019                 netif_start_queue(dev);
1020                 if (net_ratelimit())
1021                         printk(KERN_ERR "%s: Error %d transmitting packet\n",
1022                                 dev->name, err);
1023                 goto busy;
1024         }
1025
1026         dev->trans_start = jiffies;
1027         stats->tx_bytes += HERMES_802_3_OFFSET + skb->len;
1028         goto ok;
1029
1030  drop:
1031         stats->tx_errors++;
1032         stats->tx_dropped++;
1033
1034  ok:
1035         orinoco_unlock(priv, &flags);
1036         dev_kfree_skb(skb);
1037         return NETDEV_TX_OK;
1038
1039  busy:
1040         if (err == -EIO)
1041                 schedule_work(&priv->reset_work);
1042         orinoco_unlock(priv, &flags);
1043         return NETDEV_TX_BUSY;
1044 }
1045
1046 static void __orinoco_ev_alloc(struct net_device *dev, hermes_t *hw)
1047 {
1048         struct orinoco_private *priv = netdev_priv(dev);
1049         u16 fid = hermes_read_regn(hw, ALLOCFID);
1050
1051         if (fid != priv->txfid) {
1052                 if (fid != DUMMY_FID)
1053                         printk(KERN_WARNING "%s: Allocate event on unexpected fid (%04X)\n",
1054                                dev->name, fid);
1055                 return;
1056         }
1057
1058         hermes_write_regn(hw, ALLOCFID, DUMMY_FID);
1059 }
1060
1061 static void __orinoco_ev_tx(struct net_device *dev, hermes_t *hw)
1062 {
1063         struct orinoco_private *priv = netdev_priv(dev);
1064         struct net_device_stats *stats = &priv->stats;
1065
1066         stats->tx_packets++;
1067
1068         netif_wake_queue(dev);
1069
1070         hermes_write_regn(hw, TXCOMPLFID, DUMMY_FID);
1071 }
1072
1073 static void __orinoco_ev_txexc(struct net_device *dev, hermes_t *hw)
1074 {
1075         struct orinoco_private *priv = netdev_priv(dev);
1076         struct net_device_stats *stats = &priv->stats;
1077         u16 fid = hermes_read_regn(hw, TXCOMPLFID);
1078         u16 status;
1079         struct hermes_txexc_data hdr;
1080         int err = 0;
1081
1082         if (fid == DUMMY_FID)
1083                 return; /* Nothing's really happened */
1084
1085         /* Read part of the frame header - we need status and addr1 */
1086         err = hermes_bap_pread(hw, IRQ_BAP, &hdr,
1087                                sizeof(struct hermes_txexc_data),
1088                                fid, 0);
1089
1090         hermes_write_regn(hw, TXCOMPLFID, DUMMY_FID);
1091         stats->tx_errors++;
1092
1093         if (err) {
1094                 printk(KERN_WARNING "%s: Unable to read descriptor on Tx error "
1095                        "(FID=%04X error %d)\n",
1096                        dev->name, fid, err);
1097                 return;
1098         }
1099
1100         DEBUG(1, "%s: Tx error, err %d (FID=%04X)\n", dev->name,
1101               err, fid);
1102
1103         /* We produce a TXDROP event only for retry or lifetime
1104          * exceeded, because that's the only status that really mean
1105          * that this particular node went away.
1106          * Other errors means that *we* screwed up. - Jean II */
1107         status = le16_to_cpu(hdr.desc.status);
1108         if (status & (HERMES_TXSTAT_RETRYERR | HERMES_TXSTAT_AGEDERR)) {
1109                 union iwreq_data        wrqu;
1110
1111                 /* Copy 802.11 dest address.
1112                  * We use the 802.11 header because the frame may
1113                  * not be 802.3 or may be mangled...
1114                  * In Ad-Hoc mode, it will be the node address.
1115                  * In managed mode, it will be most likely the AP addr
1116                  * User space will figure out how to convert it to
1117                  * whatever it needs (IP address or else).
1118                  * - Jean II */
1119                 memcpy(wrqu.addr.sa_data, hdr.addr1, ETH_ALEN);
1120                 wrqu.addr.sa_family = ARPHRD_ETHER;
1121
1122                 /* Send event to user space */
1123                 wireless_send_event(dev, IWEVTXDROP, &wrqu, NULL);
1124         }
1125
1126         netif_wake_queue(dev);
1127 }
1128
1129 static void orinoco_tx_timeout(struct net_device *dev)
1130 {
1131         struct orinoco_private *priv = netdev_priv(dev);
1132         struct net_device_stats *stats = &priv->stats;
1133         struct hermes *hw = &priv->hw;
1134
1135         printk(KERN_WARNING "%s: Tx timeout! "
1136                "ALLOCFID=%04x, TXCOMPLFID=%04x, EVSTAT=%04x\n",
1137                dev->name, hermes_read_regn(hw, ALLOCFID),
1138                hermes_read_regn(hw, TXCOMPLFID), hermes_read_regn(hw, EVSTAT));
1139
1140         stats->tx_errors++;
1141
1142         schedule_work(&priv->reset_work);
1143 }
1144
1145 /********************************************************************/
1146 /* Rx path (data frames)                                            */
1147 /********************************************************************/
1148
1149 /* Does the frame have a SNAP header indicating it should be
1150  * de-encapsulated to Ethernet-II? */
1151 static inline int is_ethersnap(void *_hdr)
1152 {
1153         u8 *hdr = _hdr;
1154
1155         /* We de-encapsulate all packets which, a) have SNAP headers
1156          * (i.e. SSAP=DSAP=0xaa and CTRL=0x3 in the 802.2 LLC header
1157          * and where b) the OUI of the SNAP header is 00:00:00 or
1158          * 00:00:f8 - we need both because different APs appear to use
1159          * different OUIs for some reason */
1160         return (memcmp(hdr, &encaps_hdr, 5) == 0)
1161                 && ( (hdr[5] == 0x00) || (hdr[5] == 0xf8) );
1162 }
1163
1164 static inline void orinoco_spy_gather(struct net_device *dev, u_char *mac,
1165                                       int level, int noise)
1166 {
1167         struct iw_quality wstats;
1168         wstats.level = level - 0x95;
1169         wstats.noise = noise - 0x95;
1170         wstats.qual = (level > noise) ? (level - noise) : 0;
1171         wstats.updated = 7;
1172         /* Update spy records */
1173         wireless_spy_update(dev, mac, &wstats);
1174 }
1175
1176 static void orinoco_stat_gather(struct net_device *dev,
1177                                 struct sk_buff *skb,
1178                                 struct hermes_rx_descriptor *desc)
1179 {
1180         struct orinoco_private *priv = netdev_priv(dev);
1181
1182         /* Using spy support with lots of Rx packets, like in an
1183          * infrastructure (AP), will really slow down everything, because
1184          * the MAC address must be compared to each entry of the spy list.
1185          * If the user really asks for it (set some address in the
1186          * spy list), we do it, but he will pay the price.
1187          * Note that to get here, you need both WIRELESS_SPY
1188          * compiled in AND some addresses in the list !!!
1189          */
1190         /* Note : gcc will optimise the whole section away if
1191          * WIRELESS_SPY is not defined... - Jean II */
1192         if (SPY_NUMBER(priv)) {
1193                 orinoco_spy_gather(dev, skb_mac_header(skb) + ETH_ALEN,
1194                                    desc->signal, desc->silence);
1195         }
1196 }
1197
1198 /*
1199  * orinoco_rx_monitor - handle received monitor frames.
1200  *
1201  * Arguments:
1202  *      dev             network device
1203  *      rxfid           received FID
1204  *      desc            rx descriptor of the frame
1205  *
1206  * Call context: interrupt
1207  */
1208 static void orinoco_rx_monitor(struct net_device *dev, u16 rxfid,
1209                                struct hermes_rx_descriptor *desc)
1210 {
1211         u32 hdrlen = 30;        /* return full header by default */
1212         u32 datalen = 0;
1213         u16 fc;
1214         int err;
1215         int len;
1216         struct sk_buff *skb;
1217         struct orinoco_private *priv = netdev_priv(dev);
1218         struct net_device_stats *stats = &priv->stats;
1219         hermes_t *hw = &priv->hw;
1220
1221         len = le16_to_cpu(desc->data_len);
1222
1223         /* Determine the size of the header and the data */
1224         fc = le16_to_cpu(desc->frame_ctl);
1225         switch (fc & IEEE80211_FCTL_FTYPE) {
1226         case IEEE80211_FTYPE_DATA:
1227                 if ((fc & IEEE80211_FCTL_TODS)
1228                     && (fc & IEEE80211_FCTL_FROMDS))
1229                         hdrlen = 30;
1230                 else
1231                         hdrlen = 24;
1232                 datalen = len;
1233                 break;
1234         case IEEE80211_FTYPE_MGMT:
1235                 hdrlen = 24;
1236                 datalen = len;
1237                 break;
1238         case IEEE80211_FTYPE_CTL:
1239                 switch (fc & IEEE80211_FCTL_STYPE) {
1240                 case IEEE80211_STYPE_PSPOLL:
1241                 case IEEE80211_STYPE_RTS:
1242                 case IEEE80211_STYPE_CFEND:
1243                 case IEEE80211_STYPE_CFENDACK:
1244                         hdrlen = 16;
1245                         break;
1246                 case IEEE80211_STYPE_CTS:
1247                 case IEEE80211_STYPE_ACK:
1248                         hdrlen = 10;
1249                         break;
1250                 }
1251                 break;
1252         default:
1253                 /* Unknown frame type */
1254                 break;
1255         }
1256
1257         /* sanity check the length */
1258         if (datalen > IEEE80211_MAX_DATA_LEN + 12) {
1259                 printk(KERN_DEBUG "%s: oversized monitor frame, "
1260                        "data length = %d\n", dev->name, datalen);
1261                 stats->rx_length_errors++;
1262                 goto update_stats;
1263         }
1264
1265         skb = dev_alloc_skb(hdrlen + datalen);
1266         if (!skb) {
1267                 printk(KERN_WARNING "%s: Cannot allocate skb for monitor frame\n",
1268                        dev->name);
1269                 goto update_stats;
1270         }
1271
1272         /* Copy the 802.11 header to the skb */
1273         memcpy(skb_put(skb, hdrlen), &(desc->frame_ctl), hdrlen);
1274         skb_reset_mac_header(skb);
1275
1276         /* If any, copy the data from the card to the skb */
1277         if (datalen > 0) {
1278                 err = hermes_bap_pread(hw, IRQ_BAP, skb_put(skb, datalen),
1279                                        ALIGN(datalen, 2), rxfid,
1280                                        HERMES_802_2_OFFSET);
1281                 if (err) {
1282                         printk(KERN_ERR "%s: error %d reading monitor frame\n",
1283                                dev->name, err);
1284                         goto drop;
1285                 }
1286         }
1287
1288         skb->dev = dev;
1289         skb->ip_summed = CHECKSUM_NONE;
1290         skb->pkt_type = PACKET_OTHERHOST;
1291         skb->protocol = __constant_htons(ETH_P_802_2);
1292
1293         stats->rx_packets++;
1294         stats->rx_bytes += skb->len;
1295
1296         netif_rx(skb);
1297         return;
1298
1299  drop:
1300         dev_kfree_skb_irq(skb);
1301  update_stats:
1302         stats->rx_errors++;
1303         stats->rx_dropped++;
1304 }
1305
1306 /* Get tsc from the firmware */
1307 static int orinoco_hw_get_tkip_iv(struct orinoco_private *priv, int key,
1308                                   u8 *tsc)
1309 {
1310         hermes_t *hw = &priv->hw;
1311         int err = 0;
1312         u8 tsc_arr[4][IW_ENCODE_SEQ_MAX_SIZE];
1313
1314         if ((key < 0) || (key > 4))
1315                 return -EINVAL;
1316
1317         err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CURRENT_TKIP_IV,
1318                               sizeof(tsc_arr), NULL, &tsc_arr);
1319         if (!err)
1320                 memcpy(tsc, &tsc_arr[key][0], sizeof(tsc_arr[0]));
1321
1322         return err;
1323 }
1324
1325 static void __orinoco_ev_rx(struct net_device *dev, hermes_t *hw)
1326 {
1327         struct orinoco_private *priv = netdev_priv(dev);
1328         struct net_device_stats *stats = &priv->stats;
1329         struct iw_statistics *wstats = &priv->wstats;
1330         struct sk_buff *skb = NULL;
1331         u16 rxfid, status;
1332         int length;
1333         struct hermes_rx_descriptor *desc;
1334         struct orinoco_rx_data *rx_data;
1335         int err;
1336
1337         desc = kmalloc(sizeof(*desc), GFP_ATOMIC);
1338         if (!desc) {
1339                 printk(KERN_WARNING
1340                        "%s: Can't allocate space for RX descriptor\n",
1341                        dev->name);
1342                 goto update_stats;
1343         }
1344
1345         rxfid = hermes_read_regn(hw, RXFID);
1346
1347         err = hermes_bap_pread(hw, IRQ_BAP, desc, sizeof(*desc),
1348                                rxfid, 0);
1349         if (err) {
1350                 printk(KERN_ERR "%s: error %d reading Rx descriptor. "
1351                        "Frame dropped.\n", dev->name, err);
1352                 goto update_stats;
1353         }
1354
1355         status = le16_to_cpu(desc->status);
1356
1357         if (status & HERMES_RXSTAT_BADCRC) {
1358                 DEBUG(1, "%s: Bad CRC on Rx. Frame dropped.\n",
1359                       dev->name);
1360                 stats->rx_crc_errors++;
1361                 goto update_stats;
1362         }
1363
1364         /* Handle frames in monitor mode */
1365         if (priv->iw_mode == IW_MODE_MONITOR) {
1366                 orinoco_rx_monitor(dev, rxfid, desc);
1367                 goto out;
1368         }
1369
1370         if (status & HERMES_RXSTAT_UNDECRYPTABLE) {
1371                 DEBUG(1, "%s: Undecryptable frame on Rx. Frame dropped.\n",
1372                       dev->name);
1373                 wstats->discard.code++;
1374                 goto update_stats;
1375         }
1376
1377         length = le16_to_cpu(desc->data_len);
1378
1379         /* Sanity checks */
1380         if (length < 3) { /* No for even an 802.2 LLC header */
1381                 /* At least on Symbol firmware with PCF we get quite a
1382                    lot of these legitimately - Poll frames with no
1383                    data. */
1384                 goto out;
1385         }
1386         if (length > IEEE80211_MAX_DATA_LEN) {
1387                 printk(KERN_WARNING "%s: Oversized frame received (%d bytes)\n",
1388                        dev->name, length);
1389                 stats->rx_length_errors++;
1390                 goto update_stats;
1391         }
1392
1393         /* Payload size does not include Michael MIC. Increase payload
1394          * size to read it together with the data. */
1395         if (status & HERMES_RXSTAT_MIC)
1396                 length += MICHAEL_MIC_LEN;
1397
1398         /* We need space for the packet data itself, plus an ethernet
1399            header, plus 2 bytes so we can align the IP header on a
1400            32bit boundary, plus 1 byte so we can read in odd length
1401            packets from the card, which has an IO granularity of 16
1402            bits */
1403         skb = dev_alloc_skb(length+ETH_HLEN+2+1);
1404         if (!skb) {
1405                 printk(KERN_WARNING "%s: Can't allocate skb for Rx\n",
1406                        dev->name);
1407                 goto update_stats;
1408         }
1409
1410         /* We'll prepend the header, so reserve space for it.  The worst
1411            case is no decapsulation, when 802.3 header is prepended and
1412            nothing is removed.  2 is for aligning the IP header.  */
1413         skb_reserve(skb, ETH_HLEN + 2);
1414
1415         err = hermes_bap_pread(hw, IRQ_BAP, skb_put(skb, length),
1416                                ALIGN(length, 2), rxfid,
1417                                HERMES_802_2_OFFSET);
1418         if (err) {
1419                 printk(KERN_ERR "%s: error %d reading frame. "
1420                        "Frame dropped.\n", dev->name, err);
1421                 goto drop;
1422         }
1423
1424         /* Add desc and skb to rx queue */
1425         rx_data = kzalloc(sizeof(*rx_data), GFP_ATOMIC);
1426         if (!rx_data) {
1427                 printk(KERN_WARNING "%s: Can't allocate RX packet\n",
1428                         dev->name);
1429                 goto drop;
1430         }
1431         rx_data->desc = desc;
1432         rx_data->skb = skb;
1433         list_add_tail(&rx_data->list, &priv->rx_list);
1434         tasklet_schedule(&priv->rx_tasklet);
1435
1436         return;
1437
1438 drop:
1439         dev_kfree_skb_irq(skb);
1440 update_stats:
1441         stats->rx_errors++;
1442         stats->rx_dropped++;
1443 out:
1444         kfree(desc);
1445 }
1446
1447 static void orinoco_rx(struct net_device *dev,
1448                        struct hermes_rx_descriptor *desc,
1449                        struct sk_buff *skb)
1450 {
1451         struct orinoco_private *priv = netdev_priv(dev);
1452         struct net_device_stats *stats = &priv->stats;
1453         u16 status, fc;
1454         int length;
1455         struct ethhdr *hdr;
1456
1457         status = le16_to_cpu(desc->status);
1458         length = le16_to_cpu(desc->data_len);
1459         fc = le16_to_cpu(desc->frame_ctl);
1460
1461         /* Calculate and check MIC */
1462         if (status & HERMES_RXSTAT_MIC) {
1463                 int key_id = ((status & HERMES_RXSTAT_MIC_KEY_ID) >>
1464                               HERMES_MIC_KEY_ID_SHIFT);
1465                 u8 mic[MICHAEL_MIC_LEN];
1466                 u8 *rxmic;
1467                 u8 *src = (fc & IEEE80211_FCTL_FROMDS) ?
1468                         desc->addr3 : desc->addr2;
1469
1470                 /* Extract Michael MIC from payload */
1471                 rxmic = skb->data + skb->len - MICHAEL_MIC_LEN;
1472
1473                 skb_trim(skb, skb->len - MICHAEL_MIC_LEN);
1474                 length -= MICHAEL_MIC_LEN;
1475
1476                 michael_mic(priv->rx_tfm_mic,
1477                             priv->tkip_key[key_id].rx_mic,
1478                             desc->addr1,
1479                             src,
1480                             0, /* priority or QoS? */
1481                             skb->data,
1482                             skb->len,
1483                             &mic[0]);
1484
1485                 if (memcmp(mic, rxmic,
1486                            MICHAEL_MIC_LEN)) {
1487                         union iwreq_data wrqu;
1488                         struct iw_michaelmicfailure wxmic;
1489
1490                         printk(KERN_WARNING "%s: "
1491                                "Invalid Michael MIC in data frame from %pM, "
1492                                "using key %i\n",
1493                                dev->name, src, key_id);
1494
1495                         /* TODO: update stats */
1496
1497                         /* Notify userspace */
1498                         memset(&wxmic, 0, sizeof(wxmic));
1499                         wxmic.flags = key_id & IW_MICFAILURE_KEY_ID;
1500                         wxmic.flags |= (desc->addr1[0] & 1) ?
1501                                 IW_MICFAILURE_GROUP : IW_MICFAILURE_PAIRWISE;
1502                         wxmic.src_addr.sa_family = ARPHRD_ETHER;
1503                         memcpy(wxmic.src_addr.sa_data, src, ETH_ALEN);
1504
1505                         (void) orinoco_hw_get_tkip_iv(priv, key_id,
1506                                                       &wxmic.tsc[0]);
1507
1508                         memset(&wrqu, 0, sizeof(wrqu));
1509                         wrqu.data.length = sizeof(wxmic);
1510                         wireless_send_event(dev, IWEVMICHAELMICFAILURE, &wrqu,
1511                                             (char *) &wxmic);
1512
1513                         goto drop;
1514                 }
1515         }
1516
1517         /* Handle decapsulation
1518          * In most cases, the firmware tell us about SNAP frames.
1519          * For some reason, the SNAP frames sent by LinkSys APs
1520          * are not properly recognised by most firmwares.
1521          * So, check ourselves */
1522         if (length >= ENCAPS_OVERHEAD &&
1523             (((status & HERMES_RXSTAT_MSGTYPE) == HERMES_RXSTAT_1042) ||
1524              ((status & HERMES_RXSTAT_MSGTYPE) == HERMES_RXSTAT_TUNNEL) ||
1525              is_ethersnap(skb->data))) {
1526                 /* These indicate a SNAP within 802.2 LLC within
1527                    802.11 frame which we'll need to de-encapsulate to
1528                    the original EthernetII frame. */
1529                 hdr = (struct ethhdr *)skb_push(skb, ETH_HLEN - ENCAPS_OVERHEAD);
1530         } else {
1531                 /* 802.3 frame - prepend 802.3 header as is */
1532                 hdr = (struct ethhdr *)skb_push(skb, ETH_HLEN);
1533                 hdr->h_proto = htons(length);
1534         }
1535         memcpy(hdr->h_dest, desc->addr1, ETH_ALEN);
1536         if (fc & IEEE80211_FCTL_FROMDS)
1537                 memcpy(hdr->h_source, desc->addr3, ETH_ALEN);
1538         else
1539                 memcpy(hdr->h_source, desc->addr2, ETH_ALEN);
1540
1541         skb->protocol = eth_type_trans(skb, dev);
1542         skb->ip_summed = CHECKSUM_NONE;
1543         if (fc & IEEE80211_FCTL_TODS)
1544                 skb->pkt_type = PACKET_OTHERHOST;
1545
1546         /* Process the wireless stats if needed */
1547         orinoco_stat_gather(dev, skb, desc);
1548
1549         /* Pass the packet to the networking stack */
1550         netif_rx(skb);
1551         stats->rx_packets++;
1552         stats->rx_bytes += length;
1553
1554         return;
1555
1556  drop:
1557         dev_kfree_skb(skb);
1558         stats->rx_errors++;
1559         stats->rx_dropped++;
1560 }
1561
1562 static void orinoco_rx_isr_tasklet(unsigned long data)
1563 {
1564         struct net_device *dev = (struct net_device *) data;
1565         struct orinoco_private *priv = netdev_priv(dev);
1566         struct orinoco_rx_data *rx_data, *temp;
1567         struct hermes_rx_descriptor *desc;
1568         struct sk_buff *skb;
1569
1570         /* extract desc and skb from queue */
1571         list_for_each_entry_safe(rx_data, temp, &priv->rx_list, list) {
1572                 desc = rx_data->desc;
1573                 skb = rx_data->skb;
1574                 list_del(&rx_data->list);
1575                 kfree(rx_data);
1576
1577                 orinoco_rx(dev, desc, skb);
1578
1579                 kfree(desc);
1580         }
1581 }
1582
1583 /********************************************************************/
1584 /* Rx path (info frames)                                            */
1585 /********************************************************************/
1586
1587 static void print_linkstatus(struct net_device *dev, u16 status)
1588 {
1589         char * s;
1590
1591         if (suppress_linkstatus)
1592                 return;
1593
1594         switch (status) {
1595         case HERMES_LINKSTATUS_NOT_CONNECTED:
1596                 s = "Not Connected";
1597                 break;
1598         case HERMES_LINKSTATUS_CONNECTED:
1599                 s = "Connected";
1600                 break;
1601         case HERMES_LINKSTATUS_DISCONNECTED:
1602                 s = "Disconnected";
1603                 break;
1604         case HERMES_LINKSTATUS_AP_CHANGE:
1605                 s = "AP Changed";
1606                 break;
1607         case HERMES_LINKSTATUS_AP_OUT_OF_RANGE:
1608                 s = "AP Out of Range";
1609                 break;
1610         case HERMES_LINKSTATUS_AP_IN_RANGE:
1611                 s = "AP In Range";
1612                 break;
1613         case HERMES_LINKSTATUS_ASSOC_FAILED:
1614                 s = "Association Failed";
1615                 break;
1616         default:
1617                 s = "UNKNOWN";
1618         }
1619
1620         printk(KERN_INFO "%s: New link status: %s (%04x)\n",
1621                dev->name, s, status);
1622 }
1623
1624 /* Search scan results for requested BSSID, join it if found */
1625 static void orinoco_join_ap(struct work_struct *work)
1626 {
1627         struct orinoco_private *priv =
1628                 container_of(work, struct orinoco_private, join_work);
1629         struct net_device *dev = priv->ndev;
1630         struct hermes *hw = &priv->hw;
1631         int err;
1632         unsigned long flags;
1633         struct join_req {
1634                 u8 bssid[ETH_ALEN];
1635                 __le16 channel;
1636         } __attribute__ ((packed)) req;
1637         const int atom_len = offsetof(struct prism2_scan_apinfo, atim);
1638         struct prism2_scan_apinfo *atom = NULL;
1639         int offset = 4;
1640         int found = 0;
1641         u8 *buf;
1642         u16 len;
1643
1644         /* Allocate buffer for scan results */
1645         buf = kmalloc(MAX_SCAN_LEN, GFP_KERNEL);
1646         if (! buf)
1647                 return;
1648
1649         if (orinoco_lock(priv, &flags) != 0)
1650                 goto fail_lock;
1651
1652         /* Sanity checks in case user changed something in the meantime */
1653         if (! priv->bssid_fixed)
1654                 goto out;
1655
1656         if (strlen(priv->desired_essid) == 0)
1657                 goto out;
1658
1659         /* Read scan results from the firmware */
1660         err = hermes_read_ltv(hw, USER_BAP,
1661                               HERMES_RID_SCANRESULTSTABLE,
1662                               MAX_SCAN_LEN, &len, buf);
1663         if (err) {
1664                 printk(KERN_ERR "%s: Cannot read scan results\n",
1665                        dev->name);
1666                 goto out;
1667         }
1668
1669         len = HERMES_RECLEN_TO_BYTES(len);
1670
1671         /* Go through the scan results looking for the channel of the AP
1672          * we were requested to join */
1673         for (; offset + atom_len <= len; offset += atom_len) {
1674                 atom = (struct prism2_scan_apinfo *) (buf + offset);
1675                 if (memcmp(&atom->bssid, priv->desired_bssid, ETH_ALEN) == 0) {
1676                         found = 1;
1677                         break;
1678                 }
1679         }
1680
1681         if (! found) {
1682                 DEBUG(1, "%s: Requested AP not found in scan results\n",
1683                       dev->name);
1684                 goto out;
1685         }
1686
1687         memcpy(req.bssid, priv->desired_bssid, ETH_ALEN);
1688         req.channel = atom->channel;    /* both are little-endian */
1689         err = HERMES_WRITE_RECORD(hw, USER_BAP, HERMES_RID_CNFJOINREQUEST,
1690                                   &req);
1691         if (err)
1692                 printk(KERN_ERR "%s: Error issuing join request\n", dev->name);
1693
1694  out:
1695         orinoco_unlock(priv, &flags);
1696
1697  fail_lock:
1698         kfree(buf);
1699 }
1700
1701 /* Send new BSSID to userspace */
1702 static void orinoco_send_bssid_wevent(struct orinoco_private *priv)
1703 {
1704         struct net_device *dev = priv->ndev;
1705         struct hermes *hw = &priv->hw;
1706         union iwreq_data wrqu;
1707         int err;
1708
1709         err = hermes_read_ltv(hw, IRQ_BAP, HERMES_RID_CURRENTBSSID,
1710                               ETH_ALEN, NULL, wrqu.ap_addr.sa_data);
1711         if (err != 0)
1712                 return;
1713
1714         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
1715
1716         /* Send event to user space */
1717         wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
1718 }
1719
1720 static void orinoco_send_assocreqie_wevent(struct orinoco_private *priv)
1721 {
1722         struct net_device *dev = priv->ndev;
1723         struct hermes *hw = &priv->hw;
1724         union iwreq_data wrqu;
1725         int err;
1726         u8 buf[88];
1727         u8 *ie;
1728
1729         if (!priv->has_wpa)
1730                 return;
1731
1732         err = hermes_read_ltv(hw, IRQ_BAP, HERMES_RID_CURRENT_ASSOC_REQ_INFO,
1733                               sizeof(buf), NULL, &buf);
1734         if (err != 0)
1735                 return;
1736
1737         ie = orinoco_get_wpa_ie(buf, sizeof(buf));
1738         if (ie) {
1739                 int rem = sizeof(buf) - (ie - &buf[0]);
1740                 wrqu.data.length = ie[1] + 2;
1741                 if (wrqu.data.length > rem)
1742                         wrqu.data.length = rem;
1743
1744                 if (wrqu.data.length)
1745                         /* Send event to user space */
1746                         wireless_send_event(dev, IWEVASSOCREQIE, &wrqu, ie);
1747         }
1748 }
1749
1750 static void orinoco_send_assocrespie_wevent(struct orinoco_private *priv)
1751 {
1752         struct net_device *dev = priv->ndev;
1753         struct hermes *hw = &priv->hw;
1754         union iwreq_data wrqu;
1755         int err;
1756         u8 buf[88]; /* TODO: verify max size or IW_GENERIC_IE_MAX */
1757         u8 *ie;
1758
1759         if (!priv->has_wpa)
1760                 return;
1761
1762         err = hermes_read_ltv(hw, IRQ_BAP, HERMES_RID_CURRENT_ASSOC_RESP_INFO,
1763                               sizeof(buf), NULL, &buf);
1764         if (err != 0)
1765                 return;
1766
1767         ie = orinoco_get_wpa_ie(buf, sizeof(buf));
1768         if (ie) {
1769                 int rem = sizeof(buf) - (ie - &buf[0]);
1770                 wrqu.data.length = ie[1] + 2;
1771                 if (wrqu.data.length > rem)
1772                         wrqu.data.length = rem;
1773
1774                 if (wrqu.data.length)
1775                         /* Send event to user space */
1776                         wireless_send_event(dev, IWEVASSOCRESPIE, &wrqu, ie);
1777         }
1778 }
1779
1780 static void orinoco_send_wevents(struct work_struct *work)
1781 {
1782         struct orinoco_private *priv =
1783                 container_of(work, struct orinoco_private, wevent_work);
1784         unsigned long flags;
1785
1786         if (orinoco_lock(priv, &flags) != 0)
1787                 return;
1788
1789         orinoco_send_assocreqie_wevent(priv);
1790         orinoco_send_assocrespie_wevent(priv);
1791         orinoco_send_bssid_wevent(priv);
1792
1793         orinoco_unlock(priv, &flags);
1794 }
1795
1796 static inline void orinoco_clear_scan_results(struct orinoco_private *priv,
1797                                               unsigned long scan_age)
1798 {
1799         if (priv->has_ext_scan) {
1800                 struct xbss_element *bss;
1801                 struct xbss_element *tmp_bss;
1802
1803                 /* Blow away current list of scan results */
1804                 list_for_each_entry_safe(bss, tmp_bss, &priv->bss_list, list) {
1805                         if (!scan_age ||
1806                             time_after(jiffies, bss->last_scanned + scan_age)) {
1807                                 list_move_tail(&bss->list,
1808                                                &priv->bss_free_list);
1809                                 /* Don't blow away ->list, just BSS data */
1810                                 memset(&bss->bss, 0, sizeof(bss->bss));
1811                                 bss->last_scanned = 0;
1812                         }
1813                 }
1814         } else {
1815                 struct bss_element *bss;
1816                 struct bss_element *tmp_bss;
1817
1818                 /* Blow away current list of scan results */
1819                 list_for_each_entry_safe(bss, tmp_bss, &priv->bss_list, list) {
1820                         if (!scan_age ||
1821                             time_after(jiffies, bss->last_scanned + scan_age)) {
1822                                 list_move_tail(&bss->list,
1823                                                &priv->bss_free_list);
1824                                 /* Don't blow away ->list, just BSS data */
1825                                 memset(&bss->bss, 0, sizeof(bss->bss));
1826                                 bss->last_scanned = 0;
1827                         }
1828                 }
1829         }
1830 }
1831
1832 static void orinoco_add_ext_scan_result(struct orinoco_private *priv,
1833                                         struct agere_ext_scan_info *atom)
1834 {
1835         struct xbss_element *bss = NULL;
1836         int found = 0;
1837
1838         /* Try to update an existing bss first */
1839         list_for_each_entry(bss, &priv->bss_list, list) {
1840                 if (compare_ether_addr(bss->bss.bssid, atom->bssid))
1841                         continue;
1842                 /* ESSID lengths */
1843                 if (bss->bss.data[1] != atom->data[1])
1844                         continue;
1845                 if (memcmp(&bss->bss.data[2], &atom->data[2],
1846                            atom->data[1]))
1847                         continue;
1848                 found = 1;
1849                 break;
1850         }
1851
1852         /* Grab a bss off the free list */
1853         if (!found && !list_empty(&priv->bss_free_list)) {
1854                 bss = list_entry(priv->bss_free_list.next,
1855                                  struct xbss_element, list);
1856                 list_del(priv->bss_free_list.next);
1857
1858                 list_add_tail(&bss->list, &priv->bss_list);
1859         }
1860
1861         if (bss) {
1862                 /* Always update the BSS to get latest beacon info */
1863                 memcpy(&bss->bss, atom, sizeof(bss->bss));
1864                 bss->last_scanned = jiffies;
1865         }
1866 }
1867
1868 static int orinoco_process_scan_results(struct net_device *dev,
1869                                         unsigned char *buf,
1870                                         int len)
1871 {
1872         struct orinoco_private *priv = netdev_priv(dev);
1873         int                     offset;         /* In the scan data */
1874         union hermes_scan_info *atom;
1875         int                     atom_len;
1876
1877         switch (priv->firmware_type) {
1878         case FIRMWARE_TYPE_AGERE:
1879                 atom_len = sizeof(struct agere_scan_apinfo);
1880                 offset = 0;
1881                 break;
1882         case FIRMWARE_TYPE_SYMBOL:
1883                 /* Lack of documentation necessitates this hack.
1884                  * Different firmwares have 68 or 76 byte long atoms.
1885                  * We try modulo first.  If the length divides by both,
1886                  * we check what would be the channel in the second
1887                  * frame for a 68-byte atom.  76-byte atoms have 0 there.
1888                  * Valid channel cannot be 0.  */
1889                 if (len % 76)
1890                         atom_len = 68;
1891                 else if (len % 68)
1892                         atom_len = 76;
1893                 else if (len >= 1292 && buf[68] == 0)
1894                         atom_len = 76;
1895                 else
1896                         atom_len = 68;
1897                 offset = 0;
1898                 break;
1899         case FIRMWARE_TYPE_INTERSIL:
1900                 offset = 4;
1901                 if (priv->has_hostscan) {
1902                         atom_len = le16_to_cpup((__le16 *)buf);
1903                         /* Sanity check for atom_len */
1904                         if (atom_len < sizeof(struct prism2_scan_apinfo)) {
1905                                 printk(KERN_ERR "%s: Invalid atom_len in scan "
1906                                        "data: %d\n", dev->name, atom_len);
1907                                 return -EIO;
1908                         }
1909                 } else
1910                         atom_len = offsetof(struct prism2_scan_apinfo, atim);
1911                 break;
1912         default:
1913                 return -EOPNOTSUPP;
1914         }
1915
1916         /* Check that we got an whole number of atoms */
1917         if ((len - offset) % atom_len) {
1918                 printk(KERN_ERR "%s: Unexpected scan data length %d, "
1919                        "atom_len %d, offset %d\n", dev->name, len,
1920                        atom_len, offset);
1921                 return -EIO;
1922         }
1923
1924         orinoco_clear_scan_results(priv, msecs_to_jiffies(15000));
1925
1926         /* Read the entries one by one */
1927         for (; offset + atom_len <= len; offset += atom_len) {
1928                 int found = 0;
1929                 struct bss_element *bss = NULL;
1930
1931                 /* Get next atom */
1932                 atom = (union hermes_scan_info *) (buf + offset);
1933
1934                 /* Try to update an existing bss first */
1935                 list_for_each_entry(bss, &priv->bss_list, list) {
1936                         if (compare_ether_addr(bss->bss.a.bssid, atom->a.bssid))
1937                                 continue;
1938                         if (le16_to_cpu(bss->bss.a.essid_len) !=
1939                               le16_to_cpu(atom->a.essid_len))
1940                                 continue;
1941                         if (memcmp(bss->bss.a.essid, atom->a.essid,
1942                               le16_to_cpu(atom->a.essid_len)))
1943                                 continue;
1944                         found = 1;
1945                         break;
1946                 }
1947
1948                 /* Grab a bss off the free list */
1949                 if (!found && !list_empty(&priv->bss_free_list)) {
1950                         bss = list_entry(priv->bss_free_list.next,
1951                                          struct bss_element, list);
1952                         list_del(priv->bss_free_list.next);
1953
1954                         list_add_tail(&bss->list, &priv->bss_list);
1955                 }
1956
1957                 if (bss) {
1958                         /* Always update the BSS to get latest beacon info */
1959                         memcpy(&bss->bss, atom, sizeof(bss->bss));
1960                         bss->last_scanned = jiffies;
1961                 }
1962         }
1963
1964         return 0;
1965 }
1966
1967 static void __orinoco_ev_info(struct net_device *dev, hermes_t *hw)
1968 {
1969         struct orinoco_private *priv = netdev_priv(dev);
1970         u16 infofid;
1971         struct {
1972                 __le16 len;
1973                 __le16 type;
1974         } __attribute__ ((packed)) info;
1975         int len, type;
1976         int err;
1977
1978         /* This is an answer to an INQUIRE command that we did earlier,
1979          * or an information "event" generated by the card
1980          * The controller return to us a pseudo frame containing
1981          * the information in question - Jean II */
1982         infofid = hermes_read_regn(hw, INFOFID);
1983
1984         /* Read the info frame header - don't try too hard */
1985         err = hermes_bap_pread(hw, IRQ_BAP, &info, sizeof(info),
1986                                infofid, 0);
1987         if (err) {
1988                 printk(KERN_ERR "%s: error %d reading info frame. "
1989                        "Frame dropped.\n", dev->name, err);
1990                 return;
1991         }
1992
1993         len = HERMES_RECLEN_TO_BYTES(le16_to_cpu(info.len));
1994         type = le16_to_cpu(info.type);
1995
1996         switch (type) {
1997         case HERMES_INQ_TALLIES: {
1998                 struct hermes_tallies_frame tallies;
1999                 struct iw_statistics *wstats = &priv->wstats;
2000
2001                 if (len > sizeof(tallies)) {
2002                         printk(KERN_WARNING "%s: Tallies frame too long (%d bytes)\n",
2003                                dev->name, len);
2004                         len = sizeof(tallies);
2005                 }
2006
2007                 err = hermes_bap_pread(hw, IRQ_BAP, &tallies, len,
2008                                        infofid, sizeof(info));
2009                 if (err)
2010                         break;
2011
2012                 /* Increment our various counters */
2013                 /* wstats->discard.nwid - no wrong BSSID stuff */
2014                 wstats->discard.code +=
2015                         le16_to_cpu(tallies.RxWEPUndecryptable);
2016                 if (len == sizeof(tallies))
2017                         wstats->discard.code +=
2018                                 le16_to_cpu(tallies.RxDiscards_WEPICVError) +
2019                                 le16_to_cpu(tallies.RxDiscards_WEPExcluded);
2020                 wstats->discard.misc +=
2021                         le16_to_cpu(tallies.TxDiscardsWrongSA);
2022                 wstats->discard.fragment +=
2023                         le16_to_cpu(tallies.RxMsgInBadMsgFragments);
2024                 wstats->discard.retries +=
2025                         le16_to_cpu(tallies.TxRetryLimitExceeded);
2026                 /* wstats->miss.beacon - no match */
2027         }
2028         break;
2029         case HERMES_INQ_LINKSTATUS: {
2030                 struct hermes_linkstatus linkstatus;
2031                 u16 newstatus;
2032                 int connected;
2033
2034                 if (priv->iw_mode == IW_MODE_MONITOR)
2035                         break;
2036
2037                 if (len != sizeof(linkstatus)) {
2038                         printk(KERN_WARNING "%s: Unexpected size for linkstatus frame (%d bytes)\n",
2039                                dev->name, len);
2040                         break;
2041                 }
2042
2043                 err = hermes_bap_pread(hw, IRQ_BAP, &linkstatus, len,
2044                                        infofid, sizeof(info));
2045                 if (err)
2046                         break;
2047                 newstatus = le16_to_cpu(linkstatus.linkstatus);
2048
2049                 /* Symbol firmware uses "out of range" to signal that
2050                  * the hostscan frame can be requested.  */
2051                 if (newstatus == HERMES_LINKSTATUS_AP_OUT_OF_RANGE &&
2052                     priv->firmware_type == FIRMWARE_TYPE_SYMBOL &&
2053                     priv->has_hostscan && priv->scan_inprogress) {
2054                         hermes_inquire(hw, HERMES_INQ_HOSTSCAN_SYMBOL);
2055                         break;
2056                 }
2057
2058                 connected = (newstatus == HERMES_LINKSTATUS_CONNECTED)
2059                         || (newstatus == HERMES_LINKSTATUS_AP_CHANGE)
2060                         || (newstatus == HERMES_LINKSTATUS_AP_IN_RANGE);
2061
2062                 if (connected)
2063                         netif_carrier_on(dev);
2064                 else if (!ignore_disconnect)
2065                         netif_carrier_off(dev);
2066
2067                 if (newstatus != priv->last_linkstatus) {
2068                         priv->last_linkstatus = newstatus;
2069                         print_linkstatus(dev, newstatus);
2070                         /* The info frame contains only one word which is the
2071                          * status (see hermes.h). The status is pretty boring
2072                          * in itself, that's why we export the new BSSID...
2073                          * Jean II */
2074                         schedule_work(&priv->wevent_work);
2075                 }
2076         }
2077         break;
2078         case HERMES_INQ_SCAN:
2079                 if (!priv->scan_inprogress && priv->bssid_fixed &&
2080                     priv->firmware_type == FIRMWARE_TYPE_INTERSIL) {
2081                         schedule_work(&priv->join_work);
2082                         break;
2083                 }
2084                 /* fall through */
2085         case HERMES_INQ_HOSTSCAN:
2086         case HERMES_INQ_HOSTSCAN_SYMBOL: {
2087                 /* Result of a scanning. Contains information about
2088                  * cells in the vicinity - Jean II */
2089                 union iwreq_data        wrqu;
2090                 unsigned char *buf;
2091
2092                 /* Scan is no longer in progress */
2093                 priv->scan_inprogress = 0;
2094
2095                 /* Sanity check */
2096                 if (len > 4096) {
2097                         printk(KERN_WARNING "%s: Scan results too large (%d bytes)\n",
2098                                dev->name, len);
2099                         break;
2100                 }
2101
2102                 /* Allocate buffer for results */
2103                 buf = kmalloc(len, GFP_ATOMIC);
2104                 if (buf == NULL)
2105                         /* No memory, so can't printk()... */
2106                         break;
2107
2108                 /* Read scan data */
2109                 err = hermes_bap_pread(hw, IRQ_BAP, (void *) buf, len,
2110                                        infofid, sizeof(info));
2111                 if (err) {
2112                         kfree(buf);
2113                         break;
2114                 }
2115
2116 #ifdef ORINOCO_DEBUG
2117                 {
2118                         int     i;
2119                         printk(KERN_DEBUG "Scan result [%02X", buf[0]);
2120                         for(i = 1; i < (len * 2); i++)
2121                                 printk(":%02X", buf[i]);
2122                         printk("]\n");
2123                 }
2124 #endif  /* ORINOCO_DEBUG */
2125
2126                 if (orinoco_process_scan_results(dev, buf, len) == 0) {
2127                         /* Send an empty event to user space.
2128                          * We don't send the received data on the event because
2129                          * it would require us to do complex transcoding, and
2130                          * we want to minimise the work done in the irq handler
2131                          * Use a request to extract the data - Jean II */
2132                         wrqu.data.length = 0;
2133                         wrqu.data.flags = 0;
2134                         wireless_send_event(dev, SIOCGIWSCAN, &wrqu, NULL);
2135                 }
2136                 kfree(buf);
2137         }
2138         break;
2139         case HERMES_INQ_CHANNELINFO:
2140         {
2141                 struct agere_ext_scan_info *bss;
2142
2143                 if (!priv->scan_inprogress) {
2144                         printk(KERN_DEBUG "%s: Got chaninfo without scan, "
2145                                "len=%d\n", dev->name, len);
2146                         break;
2147                 }
2148
2149                 /* An empty result indicates that the scan is complete */
2150                 if (len == 0) {
2151                         union iwreq_data        wrqu;
2152
2153                         /* Scan is no longer in progress */
2154                         priv->scan_inprogress = 0;
2155
2156                         wrqu.data.length = 0;
2157                         wrqu.data.flags = 0;
2158                         wireless_send_event(dev, SIOCGIWSCAN, &wrqu, NULL);
2159                         break;
2160                 }
2161
2162                 /* Sanity check */
2163                 else if (len > sizeof(*bss)) {
2164                         printk(KERN_WARNING
2165                                "%s: Ext scan results too large (%d bytes). "
2166                                "Truncating results to %zd bytes.\n",
2167                                dev->name, len, sizeof(*bss));
2168                         len = sizeof(*bss);
2169                 } else if (len < (offsetof(struct agere_ext_scan_info,
2170                                            data) + 2)) {
2171                         /* Drop this result now so we don't have to
2172                          * keep checking later */
2173                         printk(KERN_WARNING
2174                                "%s: Ext scan results too short (%d bytes)\n",
2175                                dev->name, len);
2176                         break;
2177                 }
2178
2179                 bss = kmalloc(sizeof(*bss), GFP_ATOMIC);
2180                 if (bss == NULL)
2181                         break;
2182
2183                 /* Read scan data */
2184                 err = hermes_bap_pread(hw, IRQ_BAP, (void *) bss, len,
2185                                        infofid, sizeof(info));
2186                 if (err) {
2187                         kfree(bss);
2188                         break;
2189                 }
2190
2191                 orinoco_add_ext_scan_result(priv, bss);
2192
2193                 kfree(bss);
2194                 break;
2195         }
2196         case HERMES_INQ_SEC_STAT_AGERE:
2197                 /* Security status (Agere specific) */
2198                 /* Ignore this frame for now */
2199                 if (priv->firmware_type == FIRMWARE_TYPE_AGERE)
2200                         break;
2201                 /* fall through */
2202         default:
2203                 printk(KERN_DEBUG "%s: Unknown information frame received: "
2204                        "type 0x%04x, length %d\n", dev->name, type, len);
2205                 /* We don't actually do anything about it */
2206                 break;
2207         }
2208 }
2209
2210 static void __orinoco_ev_infdrop(struct net_device *dev, hermes_t *hw)
2211 {
2212         if (net_ratelimit())
2213                 printk(KERN_DEBUG "%s: Information frame lost.\n", dev->name);
2214 }
2215
2216 /********************************************************************/
2217 /* Internal hardware control routines                               */
2218 /********************************************************************/
2219
2220 int __orinoco_up(struct net_device *dev)
2221 {
2222         struct orinoco_private *priv = netdev_priv(dev);
2223         struct hermes *hw = &priv->hw;
2224         int err;
2225
2226         netif_carrier_off(dev); /* just to make sure */
2227
2228         err = __orinoco_program_rids(dev);
2229         if (err) {
2230                 printk(KERN_ERR "%s: Error %d configuring card\n",
2231                        dev->name, err);
2232                 return err;
2233         }
2234
2235         /* Fire things up again */
2236         hermes_set_irqmask(hw, ORINOCO_INTEN);
2237         err = hermes_enable_port(hw, 0);
2238         if (err) {
2239                 printk(KERN_ERR "%s: Error %d enabling MAC port\n",
2240                        dev->name, err);
2241                 return err;
2242         }
2243
2244         netif_start_queue(dev);
2245
2246         return 0;
2247 }
2248
2249 int __orinoco_down(struct net_device *dev)
2250 {
2251         struct orinoco_private *priv = netdev_priv(dev);
2252         struct hermes *hw = &priv->hw;
2253         int err;
2254
2255         netif_stop_queue(dev);
2256
2257         if (! priv->hw_unavailable) {
2258                 if (! priv->broken_disableport) {
2259                         err = hermes_disable_port(hw, 0);
2260                         if (err) {
2261                                 /* Some firmwares (e.g. Intersil 1.3.x) seem
2262                                  * to have problems disabling the port, oh
2263                                  * well, too bad. */
2264                                 printk(KERN_WARNING "%s: Error %d disabling MAC port\n",
2265                                        dev->name, err);
2266                                 priv->broken_disableport = 1;
2267                         }
2268                 }
2269                 hermes_set_irqmask(hw, 0);
2270                 hermes_write_regn(hw, EVACK, 0xffff);
2271         }
2272
2273         /* firmware will have to reassociate */
2274         netif_carrier_off(dev);
2275         priv->last_linkstatus = 0xffff;
2276
2277         return 0;
2278 }
2279
2280 static int orinoco_allocate_fid(struct net_device *dev)
2281 {
2282         struct orinoco_private *priv = netdev_priv(dev);
2283         struct hermes *hw = &priv->hw;
2284         int err;
2285
2286         err = hermes_allocate(hw, priv->nicbuf_size, &priv->txfid);
2287         if (err == -EIO && priv->nicbuf_size > TX_NICBUF_SIZE_BUG) {
2288                 /* Try workaround for old Symbol firmware bug */
2289                 printk(KERN_WARNING "%s: firmware ALLOC bug detected "
2290                        "(old Symbol firmware?). Trying to work around... ",
2291                        dev->name);
2292
2293                 priv->nicbuf_size = TX_NICBUF_SIZE_BUG;
2294                 err = hermes_allocate(hw, priv->nicbuf_size, &priv->txfid);
2295                 if (err)
2296                         printk("failed!\n");
2297                 else
2298                         printk("ok.\n");
2299         }
2300
2301         return err;
2302 }
2303
2304 int orinoco_reinit_firmware(struct net_device *dev)
2305 {
2306         struct orinoco_private *priv = netdev_priv(dev);
2307         struct hermes *hw = &priv->hw;
2308         int err;
2309
2310         err = hermes_init(hw);
2311         if (priv->do_fw_download && !err) {
2312                 err = orinoco_download(priv);
2313                 if (err)
2314                         priv->do_fw_download = 0;
2315         }
2316         if (!err)
2317                 err = orinoco_allocate_fid(dev);
2318
2319         return err;
2320 }
2321
2322 static int __orinoco_hw_set_bitrate(struct orinoco_private *priv)
2323 {
2324         hermes_t *hw = &priv->hw;
2325         int err = 0;
2326
2327         if (priv->bitratemode >= BITRATE_TABLE_SIZE) {
2328                 printk(KERN_ERR "%s: BUG: Invalid bitrate mode %d\n",
2329                        priv->ndev->name, priv->bitratemode);
2330                 return -EINVAL;
2331         }
2332
2333         switch (priv->firmware_type) {
2334         case FIRMWARE_TYPE_AGERE:
2335                 err = hermes_write_wordrec(hw, USER_BAP,
2336                                            HERMES_RID_CNFTXRATECONTROL,
2337                                            bitrate_table[priv->bitratemode].agere_txratectrl);
2338                 break;
2339         case FIRMWARE_TYPE_INTERSIL:
2340         case FIRMWARE_TYPE_SYMBOL:
2341                 err = hermes_write_wordrec(hw, USER_BAP,
2342                                            HERMES_RID_CNFTXRATECONTROL,
2343                                            bitrate_table[priv->bitratemode].intersil_txratectrl);
2344                 break;
2345         default:
2346                 BUG();
2347         }
2348
2349         return err;
2350 }
2351
2352 /* Set fixed AP address */
2353 static int __orinoco_hw_set_wap(struct orinoco_private *priv)
2354 {
2355         int roaming_flag;
2356         int err = 0;
2357         hermes_t *hw = &priv->hw;
2358
2359         switch (priv->firmware_type) {
2360         case FIRMWARE_TYPE_AGERE:
2361                 /* not supported */
2362                 break;
2363         case FIRMWARE_TYPE_INTERSIL:
2364                 if (priv->bssid_fixed)
2365                         roaming_flag = 2;
2366                 else
2367                         roaming_flag = 1;
2368
2369                 err = hermes_write_wordrec(hw, USER_BAP,
2370                                            HERMES_RID_CNFROAMINGMODE,
2371                                            roaming_flag);
2372                 break;
2373         case FIRMWARE_TYPE_SYMBOL:
2374                 err = HERMES_WRITE_RECORD(hw, USER_BAP,
2375                                           HERMES_RID_CNFMANDATORYBSSID_SYMBOL,
2376                                           &priv->desired_bssid);
2377                 break;
2378         }
2379         return err;
2380 }
2381
2382 /* Change the WEP keys and/or the current keys.  Can be called
2383  * either from __orinoco_hw_setup_enc() or directly from
2384  * orinoco_ioctl_setiwencode().  In the later case the association
2385  * with the AP is not broken (if the firmware can handle it),
2386  * which is needed for 802.1x implementations. */
2387 static int __orinoco_hw_setup_wepkeys(struct orinoco_private *priv)
2388 {
2389         hermes_t *hw = &priv->hw;
2390         int err = 0;
2391
2392         switch (priv->firmware_type) {
2393         case FIRMWARE_TYPE_AGERE:
2394                 err = HERMES_WRITE_RECORD(hw, USER_BAP,
2395                                           HERMES_RID_CNFWEPKEYS_AGERE,
2396                                           &priv->keys);
2397                 if (err)
2398                         return err;
2399                 err = hermes_write_wordrec(hw, USER_BAP,
2400                                            HERMES_RID_CNFTXKEY_AGERE,
2401                                            priv->tx_key);
2402                 if (err)
2403                         return err;
2404                 break;
2405         case FIRMWARE_TYPE_INTERSIL:
2406         case FIRMWARE_TYPE_SYMBOL:
2407                 {
2408                         int keylen;
2409                         int i;
2410
2411                         /* Force uniform key length to work around firmware bugs */
2412                         keylen = le16_to_cpu(priv->keys[priv->tx_key].len);
2413
2414                         if (keylen > LARGE_KEY_SIZE) {
2415                                 printk(KERN_ERR "%s: BUG: Key %d has oversize length %d.\n",
2416                                        priv->ndev->name, priv->tx_key, keylen);
2417                                 return -E2BIG;
2418                         }
2419
2420                         /* Write all 4 keys */
2421                         for(i = 0; i < ORINOCO_MAX_KEYS; i++) {
2422                                 err = hermes_write_ltv(hw, USER_BAP,
2423                                                        HERMES_RID_CNFDEFAULTKEY0 + i,
2424                                                        HERMES_BYTES_TO_RECLEN(keylen),
2425                                                        priv->keys[i].data);
2426                                 if (err)
2427                                         return err;
2428                         }
2429
2430                         /* Write the index of the key used in transmission */
2431                         err = hermes_write_wordrec(hw, USER_BAP,
2432                                                    HERMES_RID_CNFWEPDEFAULTKEYID,
2433                                                    priv->tx_key);
2434                         if (err)
2435                                 return err;
2436                 }
2437                 break;
2438         }
2439
2440         return 0;
2441 }
2442
2443 static int __orinoco_hw_setup_enc(struct orinoco_private *priv)
2444 {
2445         hermes_t *hw = &priv->hw;
2446         int err = 0;
2447         int master_wep_flag;
2448         int auth_flag;
2449         int enc_flag;
2450
2451         /* Setup WEP keys for WEP and WPA */
2452         if (priv->encode_alg)
2453                 __orinoco_hw_setup_wepkeys(priv);
2454
2455         if (priv->wep_restrict)
2456                 auth_flag = HERMES_AUTH_SHARED_KEY;
2457         else
2458                 auth_flag = HERMES_AUTH_OPEN;
2459
2460         if (priv->wpa_enabled)
2461                 enc_flag = 2;
2462         else if (priv->encode_alg == IW_ENCODE_ALG_WEP)
2463                 enc_flag = 1;
2464         else
2465                 enc_flag = 0;
2466
2467         switch (priv->firmware_type) {
2468         case FIRMWARE_TYPE_AGERE: /* Agere style WEP */
2469                 if (priv->encode_alg == IW_ENCODE_ALG_WEP) {
2470                         /* Enable the shared-key authentication. */
2471                         err = hermes_write_wordrec(hw, USER_BAP,
2472                                                    HERMES_RID_CNFAUTHENTICATION_AGERE,
2473                                                    auth_flag);
2474                 }
2475                 err = hermes_write_wordrec(hw, USER_BAP,
2476                                            HERMES_RID_CNFWEPENABLED_AGERE,
2477                                            enc_flag);
2478                 if (err)
2479                         return err;
2480
2481                 if (priv->has_wpa) {
2482                         /* Set WPA key management */
2483                         err = hermes_write_wordrec(hw, USER_BAP,
2484                                   HERMES_RID_CNFSETWPAAUTHMGMTSUITE_AGERE,
2485                                   priv->key_mgmt);
2486                         if (err)
2487                                 return err;
2488                 }
2489
2490                 break;
2491
2492         case FIRMWARE_TYPE_INTERSIL: /* Intersil style WEP */
2493         case FIRMWARE_TYPE_SYMBOL: /* Symbol style WEP */
2494                 if (priv->encode_alg == IW_ENCODE_ALG_WEP) {
2495                         if (priv->wep_restrict ||
2496                             (priv->firmware_type == FIRMWARE_TYPE_SYMBOL))
2497                                 master_wep_flag = HERMES_WEP_PRIVACY_INVOKED |
2498                                                   HERMES_WEP_EXCL_UNENCRYPTED;
2499                         else
2500                                 master_wep_flag = HERMES_WEP_PRIVACY_INVOKED;
2501
2502                         err = hermes_write_wordrec(hw, USER_BAP,
2503                                                    HERMES_RID_CNFAUTHENTICATION,
2504                                                    auth_flag);
2505                         if (err)
2506                                 return err;
2507                 } else
2508                         master_wep_flag = 0;
2509
2510                 if (priv->iw_mode == IW_MODE_MONITOR)
2511                         master_wep_flag |= HERMES_WEP_HOST_DECRYPT;
2512
2513                 /* Master WEP setting : on/off */
2514                 err = hermes_write_wordrec(hw, USER_BAP,
2515                                            HERMES_RID_CNFWEPFLAGS_INTERSIL,
2516                                            master_wep_flag);
2517                 if (err)
2518                         return err;
2519
2520                 break;
2521         }
2522
2523         return 0;
2524 }
2525
2526 /* key must be 32 bytes, including the tx and rx MIC keys.
2527  * rsc must be 8 bytes
2528  * tsc must be 8 bytes or NULL
2529  */
2530 static int __orinoco_hw_set_tkip_key(hermes_t *hw, int key_idx, int set_tx,
2531                                      u8 *key, u8 *rsc, u8 *tsc)
2532 {
2533         struct {
2534                 __le16 idx;
2535                 u8 rsc[IW_ENCODE_SEQ_MAX_SIZE];
2536                 u8 key[TKIP_KEYLEN];
2537                 u8 tx_mic[MIC_KEYLEN];
2538                 u8 rx_mic[MIC_KEYLEN];
2539                 u8 tsc[IW_ENCODE_SEQ_MAX_SIZE];
2540         } __attribute__ ((packed)) buf;
2541         int ret;
2542         int err;
2543         int k;
2544         u16 xmitting;
2545
2546         key_idx &= 0x3;
2547
2548         if (set_tx)
2549                 key_idx |= 0x8000;
2550
2551         buf.idx = cpu_to_le16(key_idx);
2552         memcpy(buf.key, key,
2553                sizeof(buf.key) + sizeof(buf.tx_mic) + sizeof(buf.rx_mic));
2554
2555         if (rsc == NULL)
2556                 memset(buf.rsc, 0, sizeof(buf.rsc));
2557         else
2558                 memcpy(buf.rsc, rsc, sizeof(buf.rsc));
2559
2560         if (tsc == NULL) {
2561                 memset(buf.tsc, 0, sizeof(buf.tsc));
2562                 buf.tsc[4] = 0x10;
2563         } else {
2564                 memcpy(buf.tsc, tsc, sizeof(buf.tsc));
2565         }
2566
2567         /* Wait upto 100ms for tx queue to empty */
2568         k = 100;
2569         do {
2570                 k--;
2571                 udelay(1000);
2572                 ret = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_TXQUEUEEMPTY,
2573                                           &xmitting);
2574                 if (ret)
2575                         break;
2576         } while ((k > 0) && xmitting);
2577
2578         if (k == 0)
2579                 ret = -ETIMEDOUT;
2580
2581         err = HERMES_WRITE_RECORD(hw, USER_BAP,
2582                                   HERMES_RID_CNFADDDEFAULTTKIPKEY_AGERE,
2583                                   &buf);
2584
2585         return ret ? ret : err;
2586 }
2587
2588 static int orinoco_clear_tkip_key(struct orinoco_private *priv,
2589                                   int key_idx)
2590 {
2591         hermes_t *hw = &priv->hw;
2592         int err;
2593
2594         memset(&priv->tkip_key[key_idx], 0, sizeof(priv->tkip_key[key_idx]));
2595         err = hermes_write_wordrec(hw, USER_BAP,
2596                                    HERMES_RID_CNFREMDEFAULTTKIPKEY_AGERE,
2597                                    key_idx);
2598         if (err)
2599                 printk(KERN_WARNING "%s: Error %d clearing TKIP key %d\n",
2600                        priv->ndev->name, err, key_idx);
2601         return err;
2602 }
2603
2604 static int __orinoco_program_rids(struct net_device *dev)
2605 {
2606         struct orinoco_private *priv = netdev_priv(dev);
2607         hermes_t *hw = &priv->hw;
2608         int err;
2609         struct hermes_idstring idbuf;
2610
2611         /* Set the MAC address */
2612         err = hermes_write_ltv(hw, USER_BAP, HERMES_RID_CNFOWNMACADDR,
2613                                HERMES_BYTES_TO_RECLEN(ETH_ALEN), dev->dev_addr);
2614         if (err) {
2615                 printk(KERN_ERR "%s: Error %d setting MAC address\n",
2616                        dev->name, err);
2617                 return err;
2618         }
2619
2620         /* Set up the link mode */
2621         err = hermes_write_wordrec(hw, USER_BAP, HERMES_RID_CNFPORTTYPE,
2622                                    priv->port_type);
2623         if (err) {
2624                 printk(KERN_ERR "%s: Error %d setting port type\n",
2625                        dev->name, err);
2626                 return err;
2627         }
2628         /* Set the channel/frequency */
2629         if (priv->channel != 0 && priv->iw_mode != IW_MODE_INFRA) {
2630                 err = hermes_write_wordrec(hw, USER_BAP,
2631                                            HERMES_RID_CNFOWNCHANNEL,
2632                                            priv->channel);
2633                 if (err) {
2634                         printk(KERN_ERR "%s: Error %d setting channel %d\n",
2635                                dev->name, err, priv->channel);
2636                         return err;
2637                 }
2638         }
2639
2640         if (priv->has_ibss) {
2641                 u16 createibss;
2642
2643                 if ((strlen(priv->desired_essid) == 0) && (priv->createibss)) {
2644                         printk(KERN_WARNING "%s: This firmware requires an "
2645                                "ESSID in IBSS-Ad-Hoc mode.\n", dev->name);
2646                         /* With wvlan_cs, in this case, we would crash.
2647                          * hopefully, this driver will behave better...
2648                          * Jean II */
2649                         createibss = 0;
2650                 } else {
2651                         createibss = priv->createibss;
2652                 }
2653
2654                 err = hermes_write_wordrec(hw, USER_BAP,
2655                                            HERMES_RID_CNFCREATEIBSS,
2656                                            createibss);
2657                 if (err) {
2658                         printk(KERN_ERR "%s: Error %d setting CREATEIBSS\n",
2659                                dev->name, err);
2660                         return err;
2661                 }
2662         }
2663
2664         /* Set the desired BSSID */
2665         err = __orinoco_hw_set_wap(priv);
2666         if (err) {
2667                 printk(KERN_ERR "%s: Error %d setting AP address\n",
2668                        dev->name, err);
2669                 return err;
2670         }
2671         /* Set the desired ESSID */
2672         idbuf.len = cpu_to_le16(strlen(priv->desired_essid));
2673         memcpy(&idbuf.val, priv->desired_essid, sizeof(idbuf.val));
2674         /* WinXP wants partner to configure OWNSSID even in IBSS mode. (jimc) */
2675         err = hermes_write_ltv(hw, USER_BAP, HERMES_RID_CNFOWNSSID,
2676                                HERMES_BYTES_TO_RECLEN(strlen(priv->desired_essid)+2),
2677                                &idbuf);
2678         if (err) {
2679                 printk(KERN_ERR "%s: Error %d setting OWNSSID\n",
2680                        dev->name, err);
2681                 return err;
2682         }
2683         err = hermes_write_ltv(hw, USER_BAP, HERMES_RID_CNFDESIREDSSID,
2684                                HERMES_BYTES_TO_RECLEN(strlen(priv->desired_essid)+2),
2685                                &idbuf);
2686         if (err) {
2687                 printk(KERN_ERR "%s: Error %d setting DESIREDSSID\n",
2688                        dev->name, err);
2689                 return err;
2690         }
2691
2692         /* Set the station name */
2693         idbuf.len = cpu_to_le16(strlen(priv->nick));
2694         memcpy(&idbuf.val, priv->nick, sizeof(idbuf.val));
2695         err = hermes_write_ltv(hw, USER_BAP, HERMES_RID_CNFOWNNAME,
2696                                HERMES_BYTES_TO_RECLEN(strlen(priv->nick)+2),
2697                                &idbuf);
2698         if (err) {
2699                 printk(KERN_ERR "%s: Error %d setting nickname\n",
2700                        dev->name, err);
2701                 return err;
2702         }
2703
2704         /* Set AP density */
2705         if (priv->has_sensitivity) {
2706                 err = hermes_write_wordrec(hw, USER_BAP,
2707                                            HERMES_RID_CNFSYSTEMSCALE,
2708                                            priv->ap_density);
2709                 if (err) {
2710                         printk(KERN_WARNING "%s: Error %d setting SYSTEMSCALE.  "
2711                                "Disabling sensitivity control\n",
2712                                dev->name, err);
2713
2714                         priv->has_sensitivity = 0;
2715                 }
2716         }
2717
2718         /* Set RTS threshold */
2719         err = hermes_write_wordrec(hw, USER_BAP, HERMES_RID_CNFRTSTHRESHOLD,
2720                                    priv->rts_thresh);
2721         if (err) {
2722                 printk(KERN_ERR "%s: Error %d setting RTS threshold\n",
2723                        dev->name, err);
2724                 return err;
2725         }
2726
2727         /* Set fragmentation threshold or MWO robustness */
2728         if (priv->has_mwo)
2729                 err = hermes_write_wordrec(hw, USER_BAP,
2730                                            HERMES_RID_CNFMWOROBUST_AGERE,
2731                                            priv->mwo_robust);
2732         else
2733                 err = hermes_write_wordrec(hw, USER_BAP,
2734                                            HERMES_RID_CNFFRAGMENTATIONTHRESHOLD,
2735                                            priv->frag_thresh);
2736         if (err) {
2737                 printk(KERN_ERR "%s: Error %d setting fragmentation\n",
2738                        dev->name, err);
2739                 return err;
2740         }
2741
2742         /* Set bitrate */
2743         err = __orinoco_hw_set_bitrate(priv);
2744         if (err) {
2745                 printk(KERN_ERR "%s: Error %d setting bitrate\n",
2746                        dev->name, err);
2747                 return err;
2748         }
2749
2750         /* Set power management */
2751         if (priv->has_pm) {
2752                 err = hermes_write_wordrec(hw, USER_BAP,
2753                                            HERMES_RID_CNFPMENABLED,
2754                                            priv->pm_on);
2755                 if (err) {
2756                         printk(KERN_ERR "%s: Error %d setting up PM\n",
2757                                dev->name, err);
2758                         return err;
2759                 }
2760
2761                 err = hermes_write_wordrec(hw, USER_BAP,
2762                                            HERMES_RID_CNFMULTICASTRECEIVE,
2763                                            priv->pm_mcast);
2764                 if (err) {
2765                         printk(KERN_ERR "%s: Error %d setting up PM\n",
2766                                dev->name, err);
2767                         return err;
2768                 }
2769                 err = hermes_write_wordrec(hw, USER_BAP,
2770                                            HERMES_RID_CNFMAXSLEEPDURATION,
2771                                            priv->pm_period);
2772                 if (err) {
2773                         printk(KERN_ERR "%s: Error %d setting up PM\n",
2774                                dev->name, err);
2775                         return err;
2776                 }
2777                 err = hermes_write_wordrec(hw, USER_BAP,
2778                                            HERMES_RID_CNFPMHOLDOVERDURATION,
2779                                            priv->pm_timeout);
2780                 if (err) {
2781                         printk(KERN_ERR "%s: Error %d setting up PM\n",
2782                                dev->name, err);
2783                         return err;
2784                 }
2785         }
2786
2787         /* Set preamble - only for Symbol so far... */
2788         if (priv->has_preamble) {
2789                 err = hermes_write_wordrec(hw, USER_BAP,
2790                                            HERMES_RID_CNFPREAMBLE_SYMBOL,
2791                                            priv->preamble);
2792                 if (err) {
2793                         printk(KERN_ERR "%s: Error %d setting preamble\n",
2794                                dev->name, err);
2795                         return err;
2796                 }
2797         }
2798
2799         /* Set up encryption */
2800         if (priv->has_wep || priv->has_wpa) {
2801                 err = __orinoco_hw_setup_enc(priv);
2802                 if (err) {
2803                         printk(KERN_ERR "%s: Error %d activating encryption\n",
2804                                dev->name, err);
2805                         return err;
2806                 }
2807         }
2808
2809         if (priv->iw_mode == IW_MODE_MONITOR) {
2810                 /* Enable monitor mode */
2811                 dev->type = ARPHRD_IEEE80211;
2812                 err = hermes_docmd_wait(hw, HERMES_CMD_TEST |
2813                                             HERMES_TEST_MONITOR, 0, NULL);
2814         } else {
2815                 /* Disable monitor mode */
2816                 dev->type = ARPHRD_ETHER;
2817                 err = hermes_docmd_wait(hw, HERMES_CMD_TEST |
2818                                             HERMES_TEST_STOP, 0, NULL);
2819         }
2820         if (err)
2821                 return err;
2822
2823         /* Set promiscuity / multicast*/
2824         priv->promiscuous = 0;
2825         priv->mc_count = 0;
2826
2827         /* FIXME: what about netif_tx_lock */
2828         __orinoco_set_multicast_list(dev);
2829
2830         return 0;
2831 }
2832
2833 /* FIXME: return int? */
2834 static void
2835 __orinoco_set_multicast_list(struct net_device *dev)
2836 {
2837         struct orinoco_private *priv = netdev_priv(dev);
2838         hermes_t *hw = &priv->hw;
2839         int err = 0;
2840         int promisc, mc_count;
2841
2842         /* The Hermes doesn't seem to have an allmulti mode, so we go
2843          * into promiscuous mode and let the upper levels deal. */
2844         if ( (dev->flags & IFF_PROMISC) || (dev->flags & IFF_ALLMULTI) ||
2845              (dev->mc_count > MAX_MULTICAST(priv)) ) {
2846                 promisc = 1;
2847                 mc_count = 0;
2848         } else {
2849                 promisc = 0;
2850                 mc_count = dev->mc_count;
2851         }
2852
2853         if (promisc != priv->promiscuous) {
2854                 err = hermes_write_wordrec(hw, USER_BAP,
2855                                            HERMES_RID_CNFPROMISCUOUSMODE,
2856                                            promisc);
2857                 if (err) {
2858                         printk(KERN_ERR "%s: Error %d setting PROMISCUOUSMODE to 1.\n",
2859                                dev->name, err);
2860                 } else
2861                         priv->promiscuous = promisc;
2862         }
2863
2864         /* If we're not in promiscuous mode, then we need to set the
2865          * group address if either we want to multicast, or if we were
2866          * multicasting and want to stop */
2867         if (! promisc && (mc_count || priv->mc_count) ) {
2868                 struct dev_mc_list *p = dev->mc_list;
2869                 struct hermes_multicast mclist;
2870                 int i;
2871
2872                 for (i = 0; i < mc_count; i++) {
2873                         /* paranoia: is list shorter than mc_count? */
2874                         BUG_ON(! p);
2875                         /* paranoia: bad address size in list? */
2876                         BUG_ON(p->dmi_addrlen != ETH_ALEN);
2877
2878                         memcpy(mclist.addr[i], p->dmi_addr, ETH_ALEN);
2879                         p = p->next;
2880                 }
2881
2882                 if (p)
2883                         printk(KERN_WARNING "%s: Multicast list is "
2884                                "longer than mc_count\n", dev->name);
2885
2886                 err = hermes_write_ltv(hw, USER_BAP,
2887                                    HERMES_RID_CNFGROUPADDRESSES,
2888                                    HERMES_BYTES_TO_RECLEN(mc_count * ETH_ALEN),
2889                                    &mclist);
2890                 if (err)
2891                         printk(KERN_ERR "%s: Error %d setting multicast list.\n",
2892                                dev->name, err);
2893                 else
2894                         priv->mc_count = mc_count;
2895         }
2896 }
2897
2898 /* This must be called from user context, without locks held - use
2899  * schedule_work() */
2900 static void orinoco_reset(struct work_struct *work)
2901 {
2902         struct orinoco_private *priv =
2903                 container_of(work, struct orinoco_private, reset_work);
2904         struct net_device *dev = priv->ndev;
2905         struct hermes *hw = &priv->hw;
2906         int err;
2907         unsigned long flags;
2908
2909         if (orinoco_lock(priv, &flags) != 0)
2910                 /* When the hardware becomes available again, whatever
2911                  * detects that is responsible for re-initializing
2912                  * it. So no need for anything further */
2913                 return;
2914
2915         netif_stop_queue(dev);
2916
2917         /* Shut off interrupts.  Depending on what state the hardware
2918          * is in, this might not work, but we'll try anyway */
2919         hermes_set_irqmask(hw, 0);
2920         hermes_write_regn(hw, EVACK, 0xffff);
2921
2922         priv->hw_unavailable++;
2923         priv->last_linkstatus = 0xffff; /* firmware will have to reassociate */
2924         netif_carrier_off(dev);
2925
2926         orinoco_unlock(priv, &flags);
2927
2928         /* Scanning support: Cleanup of driver struct */
2929         orinoco_clear_scan_results(priv, 0);
2930         priv->scan_inprogress = 0;
2931
2932         if (priv->hard_reset) {
2933                 err = (*priv->hard_reset)(priv);
2934                 if (err) {
2935                         printk(KERN_ERR "%s: orinoco_reset: Error %d "
2936                                "performing hard reset\n", dev->name, err);
2937                         goto disable;
2938                 }
2939         }
2940
2941         err = orinoco_reinit_firmware(dev);
2942         if (err) {
2943                 printk(KERN_ERR "%s: orinoco_reset: Error %d re-initializing firmware\n",
2944                        dev->name, err);
2945                 goto disable;
2946         }
2947
2948         spin_lock_irq(&priv->lock); /* This has to be called from user context */
2949
2950         priv->hw_unavailable--;
2951
2952         /* priv->open or priv->hw_unavailable might have changed while
2953          * we dropped the lock */
2954         if (priv->open && (! priv->hw_unavailable)) {
2955                 err = __orinoco_up(dev);
2956                 if (err) {
2957                         printk(KERN_ERR "%s: orinoco_reset: Error %d reenabling card\n",
2958                                dev->name, err);
2959                 } else
2960                         dev->trans_start = jiffies;
2961         }
2962
2963         spin_unlock_irq(&priv->lock);
2964
2965         return;
2966  disable:
2967         hermes_set_irqmask(hw, 0);
2968         netif_device_detach(dev);
2969         printk(KERN_ERR "%s: Device has been disabled!\n", dev->name);
2970 }
2971
2972 /********************************************************************/
2973 /* Interrupt handler                                                */
2974 /********************************************************************/
2975
2976 static void __orinoco_ev_tick(struct net_device *dev, hermes_t *hw)
2977 {
2978         printk(KERN_DEBUG "%s: TICK\n", dev->name);
2979 }
2980
2981 static void __orinoco_ev_wterr(struct net_device *dev, hermes_t *hw)
2982 {
2983         /* This seems to happen a fair bit under load, but ignoring it
2984            seems to work fine...*/
2985         printk(KERN_DEBUG "%s: MAC controller error (WTERR). Ignoring.\n",
2986                dev->name);
2987 }
2988
2989 irqreturn_t orinoco_interrupt(int irq, void *dev_id)
2990 {
2991         struct net_device *dev = dev_id;
2992         struct orinoco_private *priv = netdev_priv(dev);
2993         hermes_t *hw = &priv->hw;
2994         int count = MAX_IRQLOOPS_PER_IRQ;
2995         u16 evstat, events;
2996         /* These are used to detect a runaway interrupt situation */
2997         /* If we get more than MAX_IRQLOOPS_PER_JIFFY iterations in a jiffy,
2998          * we panic and shut down the hardware */
2999         static int last_irq_jiffy = 0; /* jiffies value the last time
3000                                         * we were called */
3001         static int loops_this_jiffy = 0;
3002         unsigned long flags;
3003
3004         if (orinoco_lock(priv, &flags) != 0) {
3005                 /* If hw is unavailable - we don't know if the irq was
3006                  * for us or not */
3007                 return IRQ_HANDLED;
3008         }
3009
3010         evstat = hermes_read_regn(hw, EVSTAT);
3011         events = evstat & hw->inten;
3012         if (! events) {
3013                 orinoco_unlock(priv, &flags);
3014                 return IRQ_NONE;
3015         }
3016
3017         if (jiffies != last_irq_jiffy)
3018                 loops_this_jiffy = 0;
3019         last_irq_jiffy = jiffies;
3020
3021         while (events && count--) {
3022                 if (++loops_this_jiffy > MAX_IRQLOOPS_PER_JIFFY) {
3023                         printk(KERN_WARNING "%s: IRQ handler is looping too "
3024                                "much! Resetting.\n", dev->name);
3025                         /* Disable interrupts for now */
3026                         hermes_set_irqmask(hw, 0);
3027                         schedule_work(&priv->reset_work);
3028                         break;
3029                 }
3030
3031                 /* Check the card hasn't been removed */
3032                 if (! hermes_present(hw)) {
3033                         DEBUG(0, "orinoco_interrupt(): card removed\n");
3034                         break;
3035                 }
3036
3037                 if (events & HERMES_EV_TICK)
3038                         __orinoco_ev_tick(dev, hw);
3039                 if (events & HERMES_EV_WTERR)
3040                         __orinoco_ev_wterr(dev, hw);
3041                 if (events & HERMES_EV_INFDROP)
3042                         __orinoco_ev_infdrop(dev, hw);
3043                 if (events & HERMES_EV_INFO)
3044                         __orinoco_ev_info(dev, hw);
3045                 if (events & HERMES_EV_RX)
3046                         __orinoco_ev_rx(dev, hw);
3047                 if (events & HERMES_EV_TXEXC)
3048                         __orinoco_ev_txexc(dev, hw);
3049                 if (events & HERMES_EV_TX)
3050                         __orinoco_ev_tx(dev, hw);
3051                 if (events & HERMES_EV_ALLOC)
3052                         __orinoco_ev_alloc(dev, hw);
3053
3054                 hermes_write_regn(hw, EVACK, evstat);
3055
3056                 evstat = hermes_read_regn(hw, EVSTAT);
3057                 events = evstat & hw->inten;
3058         };
3059
3060         orinoco_unlock(priv, &flags);
3061         return IRQ_HANDLED;
3062 }
3063
3064 /********************************************************************/
3065 /* Initialization                                                   */
3066 /********************************************************************/
3067
3068 struct comp_id {
3069         u16 id, variant, major, minor;
3070 } __attribute__ ((packed));
3071
3072 static inline fwtype_t determine_firmware_type(struct comp_id *nic_id)
3073 {
3074         if (nic_id->id < 0x8000)
3075                 return FIRMWARE_TYPE_AGERE;
3076         else if (nic_id->id == 0x8000 && nic_id->major == 0)
3077                 return FIRMWARE_TYPE_SYMBOL;
3078         else
3079                 return FIRMWARE_TYPE_INTERSIL;
3080 }
3081
3082 /* Set priv->firmware type, determine firmware properties */
3083 static int determine_firmware(struct net_device *dev)
3084 {
3085         struct orinoco_private *priv = netdev_priv(dev);
3086         hermes_t *hw = &priv->hw;
3087         int err;
3088         struct comp_id nic_id, sta_id;
3089         unsigned int firmver;
3090         char tmp[SYMBOL_MAX_VER_LEN+1] __attribute__((aligned(2)));
3091
3092         /* Get the hardware version */
3093         err = HERMES_READ_RECORD(hw, USER_BAP, HERMES_RID_NICID, &nic_id);
3094         if (err) {
3095                 printk(KERN_ERR "%s: Cannot read hardware identity: error %d\n",
3096                        dev->name, err);
3097                 return err;
3098         }
3099
3100         le16_to_cpus(&nic_id.id);
3101         le16_to_cpus(&nic_id.variant);
3102         le16_to_cpus(&nic_id.major);
3103         le16_to_cpus(&nic_id.minor);
3104         printk(KERN_DEBUG "%s: Hardware identity %04x:%04x:%04x:%04x\n",
3105                dev->name, nic_id.id, nic_id.variant,
3106                nic_id.major, nic_id.minor);
3107
3108         priv->firmware_type = determine_firmware_type(&nic_id);
3109
3110         /* Get the firmware version */
3111         err = HERMES_READ_RECORD(hw, USER_BAP, HERMES_RID_STAID, &sta_id);
3112         if (err) {
3113                 printk(KERN_ERR "%s: Cannot read station identity: error %d\n",
3114                        dev->name, err);
3115                 return err;
3116         }
3117
3118         le16_to_cpus(&sta_id.id);
3119         le16_to_cpus(&sta_id.variant);
3120         le16_to_cpus(&sta_id.major);
3121         le16_to_cpus(&sta_id.minor);
3122         printk(KERN_DEBUG "%s: Station identity  %04x:%04x:%04x:%04x\n",
3123                dev->name, sta_id.id, sta_id.variant,
3124                sta_id.major, sta_id.minor);
3125
3126         switch (sta_id.id) {
3127         case 0x15:
3128                 printk(KERN_ERR "%s: Primary firmware is active\n",
3129                        dev->name);
3130                 return -ENODEV;
3131         case 0x14b:
3132                 printk(KERN_ERR "%s: Tertiary firmware is active\n",
3133                        dev->name);
3134                 return -ENODEV;
3135         case 0x1f:      /* Intersil, Agere, Symbol Spectrum24 */
3136         case 0x21:      /* Symbol Spectrum24 Trilogy */
3137                 break;
3138         default:
3139                 printk(KERN_NOTICE "%s: Unknown station ID, please report\n",
3140                        dev->name);
3141                 break;
3142         }
3143
3144         /* Default capabilities */
3145         priv->has_sensitivity = 1;
3146         priv->has_mwo = 0;
3147         priv->has_preamble = 0;
3148         priv->has_port3 = 1;
3149         priv->has_ibss = 1;
3150         priv->has_wep = 0;
3151         priv->has_big_wep = 0;
3152         priv->has_alt_txcntl = 0;
3153         priv->has_ext_scan = 0;
3154         priv->has_wpa = 0;
3155         priv->do_fw_download = 0;
3156
3157         /* Determine capabilities from the firmware version */
3158         switch (priv->firmware_type) {
3159         case FIRMWARE_TYPE_AGERE:
3160                 /* Lucent Wavelan IEEE, Lucent Orinoco, Cabletron RoamAbout,
3161                    ELSA, Melco, HP, IBM, Dell 1150, Compaq 110/210 */
3162                 snprintf(priv->fw_name, sizeof(priv->fw_name) - 1,
3163                          "Lucent/Agere %d.%02d", sta_id.major, sta_id.minor);
3164
3165                 firmver = ((unsigned long)sta_id.major << 16) | sta_id.minor;
3166
3167                 priv->has_ibss = (firmver >= 0x60006);
3168                 priv->has_wep = (firmver >= 0x40020);
3169                 priv->has_big_wep = 1; /* FIXME: this is wrong - how do we tell
3170                                           Gold cards from the others? */
3171                 priv->has_mwo = (firmver >= 0x60000);
3172                 priv->has_pm = (firmver >= 0x40020); /* Don't work in 7.52 ? */
3173                 priv->ibss_port = 1;
3174                 priv->has_hostscan = (firmver >= 0x8000a);
3175                 priv->do_fw_download = 1;
3176                 priv->broken_monitor = (firmver >= 0x80000);
3177                 priv->has_alt_txcntl = (firmver >= 0x90000); /* All 9.x ? */
3178                 priv->has_ext_scan = (firmver >= 0x90000); /* All 9.x ? */
3179                 priv->has_wpa = (firmver >= 0x9002a);
3180                 /* Tested with Agere firmware :
3181                  *      1.16 ; 4.08 ; 4.52 ; 6.04 ; 6.16 ; 7.28 => Jean II
3182                  * Tested CableTron firmware : 4.32 => Anton */
3183                 break;
3184         case FIRMWARE_TYPE_SYMBOL:
3185                 /* Symbol , 3Com AirConnect, Intel, Ericsson WLAN */
3186                 /* Intel MAC : 00:02:B3:* */
3187                 /* 3Com MAC : 00:50:DA:* */
3188                 memset(tmp, 0, sizeof(tmp));
3189                 /* Get the Symbol firmware version */
3190                 err = hermes_read_ltv(hw, USER_BAP,
3191                                       HERMES_RID_SECONDARYVERSION_SYMBOL,
3192                                       SYMBOL_MAX_VER_LEN, NULL, &tmp);
3193                 if (err) {
3194                         printk(KERN_WARNING
3195                                "%s: Error %d reading Symbol firmware info. Wildly guessing capabilities...\n",
3196                                dev->name, err);
3197                         firmver = 0;
3198                         tmp[0] = '\0';
3199                 } else {
3200                         /* The firmware revision is a string, the format is
3201                          * something like : "V2.20-01".
3202                          * Quick and dirty parsing... - Jean II
3203                          */
3204                         firmver = ((tmp[1] - '0') << 16) | ((tmp[3] - '0') << 12)
3205                                 | ((tmp[4] - '0') << 8) | ((tmp[6] - '0') << 4)
3206                                 | (tmp[7] - '0');
3207
3208                         tmp[SYMBOL_MAX_VER_LEN] = '\0';
3209                 }
3210
3211                 snprintf(priv->fw_name, sizeof(priv->fw_name) - 1,
3212                          "Symbol %s", tmp);
3213
3214                 priv->has_ibss = (firmver >= 0x20000);
3215                 priv->has_wep = (firmver >= 0x15012);
3216                 priv->has_big_wep = (firmver >= 0x20000);
3217                 priv->has_pm = (firmver >= 0x20000 && firmver < 0x22000) ||
3218                                (firmver >= 0x29000 && firmver < 0x30000) ||
3219                                firmver >= 0x31000;
3220                 priv->has_preamble = (firmver >= 0x20000);
3221                 priv->ibss_port = 4;
3222
3223                 /* Symbol firmware is found on various cards, but
3224                  * there has been no attempt to check firmware
3225                  * download on non-spectrum_cs based cards.
3226                  *
3227                  * Given that the Agere firmware download works
3228                  * differently, we should avoid doing a firmware
3229                  * download with the Symbol algorithm on non-spectrum
3230                  * cards.
3231                  *
3232                  * For now we can identify a spectrum_cs based card
3233                  * because it has a firmware reset function.
3234                  */
3235                 priv->do_fw_download = (priv->stop_fw != NULL);
3236
3237                 priv->broken_disableport = (firmver == 0x25013) ||
3238                                            (firmver >= 0x30000 && firmver <= 0x31000);
3239                 priv->has_hostscan = (firmver >= 0x31001) ||
3240                                      (firmver >= 0x29057 && firmver < 0x30000);
3241                 /* Tested with Intel firmware : 0x20015 => Jean II */
3242                 /* Tested with 3Com firmware : 0x15012 & 0x22001 => Jean II */
3243                 break;
3244         case FIRMWARE_TYPE_INTERSIL:
3245                 /* D-Link, Linksys, Adtron, ZoomAir, and many others...
3246                  * Samsung, Compaq 100/200 and Proxim are slightly
3247                  * different and less well tested */
3248                 /* D-Link MAC : 00:40:05:* */
3249                 /* Addtron MAC : 00:90:D1:* */
3250                 snprintf(priv->fw_name, sizeof(priv->fw_name) - 1,
3251                          "Intersil %d.%d.%d", sta_id.major, sta_id.minor,
3252                          sta_id.variant);
3253
3254                 firmver = ((unsigned long)sta_id.major << 16) |
3255                         ((unsigned long)sta_id.minor << 8) | sta_id.variant;
3256
3257                 priv->has_ibss = (firmver >= 0x000700); /* FIXME */
3258                 priv->has_big_wep = priv->has_wep = (firmver >= 0x000800);
3259                 priv->has_pm = (firmver >= 0x000700);
3260                 priv->has_hostscan = (firmver >= 0x010301);
3261
3262                 if (firmver >= 0x000800)
3263                         priv->ibss_port = 0;
3264                 else {
3265                         printk(KERN_NOTICE "%s: Intersil firmware earlier "
3266                                "than v0.8.x - several features not supported\n",
3267                                dev->name);
3268                         priv->ibss_port = 1;
3269                 }
3270                 break;
3271         }
3272         printk(KERN_DEBUG "%s: Firmware determined as %s\n", dev->name,
3273                priv->fw_name);
3274
3275         return 0;
3276 }
3277
3278 static int orinoco_init(struct net_device *dev)
3279 {
3280         struct orinoco_private *priv = netdev_priv(dev);
3281         hermes_t *hw = &priv->hw;
3282         int err = 0;
3283         struct hermes_idstring nickbuf;
3284         u16 reclen;
3285         int len;
3286
3287         /* No need to lock, the hw_unavailable flag is already set in
3288          * alloc_orinocodev() */
3289         priv->nicbuf_size = IEEE80211_MAX_FRAME_LEN + ETH_HLEN;
3290
3291         /* Initialize the firmware */
3292         err = hermes_init(hw);
3293         if (err != 0) {
3294                 printk(KERN_ERR "%s: failed to initialize firmware (err = %d)\n",
3295                        dev->name, err);
3296                 goto out;
3297         }
3298
3299         err = determine_firmware(dev);
3300         if (err != 0) {
3301                 printk(KERN_ERR "%s: Incompatible firmware, aborting\n",
3302                        dev->name);
3303                 goto out;
3304         }
3305
3306         if (priv->do_fw_download) {
3307                 err = orinoco_download(priv);
3308                 if (err)
3309                         priv->do_fw_download = 0;
3310
3311                 /* Check firmware version again */
3312                 err = determine_firmware(dev);
3313                 if (err != 0) {
3314                         printk(KERN_ERR "%s: Incompatible firmware, aborting\n",
3315                                dev->name);
3316                         goto out;
3317                 }
3318         }
3319
3320         if (priv->has_port3)
3321                 printk(KERN_DEBUG "%s: Ad-hoc demo mode supported\n", dev->name);
3322         if (priv->has_ibss)
3323                 printk(KERN_DEBUG "%s: IEEE standard IBSS ad-hoc mode supported\n",
3324                        dev->name);
3325         if (priv->has_wep) {
3326                 printk(KERN_DEBUG "%s: WEP supported, ", dev->name);
3327                 if (priv->has_big_wep)
3328                         printk("104-bit key\n");
3329                 else
3330                         printk("40-bit key\n");
3331         }
3332         if (priv->has_wpa) {
3333                 printk(KERN_DEBUG "%s: WPA-PSK supported\n", dev->name);
3334                 if (orinoco_mic_init(priv)) {
3335                         printk(KERN_ERR "%s: Failed to setup MIC crypto "
3336                                "algorithm. Disabling WPA support\n", dev->name);
3337                         priv->has_wpa = 0;
3338                 }
3339         }
3340
3341         /* Now we have the firmware capabilities, allocate appropiate
3342          * sized scan buffers */
3343         if (orinoco_bss_data_allocate(priv))
3344                 goto out;
3345         orinoco_bss_data_init(priv);
3346
3347         /* Get the MAC address */
3348         err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CNFOWNMACADDR,
3349                               ETH_ALEN, NULL, dev->dev_addr);
3350         if (err) {
3351                 printk(KERN_WARNING "%s: failed to read MAC address!\n",
3352                        dev->name);
3353                 goto out;
3354         }
3355
3356         printk(KERN_DEBUG "%s: MAC address %pM\n",
3357                dev->name, dev->dev_addr);
3358
3359         /* Get the station name */
3360         err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CNFOWNNAME,
3361                               sizeof(nickbuf), &reclen, &nickbuf);
3362         if (err) {
3363                 printk(KERN_ERR "%s: failed to read station name\n",
3364                        dev->name);
3365                 goto out;
3366         }
3367         if (nickbuf.len)
3368                 len = min(IW_ESSID_MAX_SIZE, (int)le16_to_cpu(nickbuf.len));
3369         else
3370                 len = min(IW_ESSID_MAX_SIZE, 2 * reclen);
3371         memcpy(priv->nick, &nickbuf.val, len);
3372         priv->nick[len] = '\0';
3373
3374         printk(KERN_DEBUG "%s: Station name \"%s\"\n", dev->name, priv->nick);
3375
3376         err = orinoco_allocate_fid(dev);
3377         if (err) {
3378                 printk(KERN_ERR "%s: failed to allocate NIC buffer!\n",
3379                        dev->name);
3380                 goto out;
3381         }
3382
3383         /* Get allowed channels */
3384         err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_CHANNELLIST,
3385                                   &priv->channel_mask);
3386         if (err) {
3387                 printk(KERN_ERR "%s: failed to read channel list!\n",
3388                        dev->name);
3389                 goto out;
3390         }
3391
3392         /* Get initial AP density */
3393         err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_CNFSYSTEMSCALE,
3394                                   &priv->ap_density);
3395         if (err || priv->ap_density < 1 || priv->ap_density > 3) {
3396                 priv->has_sensitivity = 0;
3397         }
3398
3399         /* Get initial RTS threshold */
3400         err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_CNFRTSTHRESHOLD,
3401                                   &priv->rts_thresh);
3402         if (err) {
3403                 printk(KERN_ERR "%s: failed to read RTS threshold!\n",
3404                        dev->name);
3405                 goto out;
3406         }
3407
3408         /* Get initial fragmentation settings */
3409         if (priv->has_mwo)
3410                 err = hermes_read_wordrec(hw, USER_BAP,
3411                                           HERMES_RID_CNFMWOROBUST_AGERE,
3412                                           &priv->mwo_robust);
3413         else
3414                 err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_CNFFRAGMENTATIONTHRESHOLD,
3415                                           &priv->frag_thresh);
3416         if (err) {
3417                 printk(KERN_ERR "%s: failed to read fragmentation settings!\n",
3418                        dev->name);
3419                 goto out;
3420         }
3421
3422         /* Power management setup */
3423         if (priv->has_pm) {
3424                 priv->pm_on = 0;
3425                 priv->pm_mcast = 1;
3426                 err = hermes_read_wordrec(hw, USER_BAP,
3427                                           HERMES_RID_CNFMAXSLEEPDURATION,
3428                                           &priv->pm_period);
3429                 if (err) {
3430                         printk(KERN_ERR "%s: failed to read power management period!\n",
3431                                dev->name);
3432                         goto out;
3433                 }
3434                 err = hermes_read_wordrec(hw, USER_BAP,
3435                                           HERMES_RID_CNFPMHOLDOVERDURATION,
3436                                           &priv->pm_timeout);
3437                 if (err) {
3438                         printk(KERN_ERR "%s: failed to read power management timeout!\n",
3439                                dev->name);
3440                         goto out;
3441                 }
3442         }
3443
3444         /* Preamble setup */
3445         if (priv->has_preamble) {
3446                 err = hermes_read_wordrec(hw, USER_BAP,
3447                                           HERMES_RID_CNFPREAMBLE_SYMBOL,
3448                                           &priv->preamble);
3449                 if (err)
3450                         goto out;
3451         }
3452
3453         /* Set up the default configuration */
3454         priv->iw_mode = IW_MODE_INFRA;
3455         /* By default use IEEE/IBSS ad-hoc mode if we have it */
3456         priv->prefer_port3 = priv->has_port3 && (! priv->has_ibss);
3457         set_port_type(priv);
3458         priv->channel = 0; /* use firmware default */
3459
3460         priv->promiscuous = 0;
3461         priv->encode_alg = IW_ENCODE_ALG_NONE;
3462         priv->tx_key = 0;
3463         priv->wpa_enabled = 0;
3464         priv->tkip_cm_active = 0;
3465         priv->key_mgmt = 0;
3466         priv->wpa_ie_len = 0;
3467         priv->wpa_ie = NULL;
3468
3469         /* Make the hardware available, as long as it hasn't been
3470          * removed elsewhere (e.g. by PCMCIA hot unplug) */
3471         spin_lock_irq(&priv->lock);
3472         priv->hw_unavailable--;
3473         spin_unlock_irq(&priv->lock);
3474
3475         printk(KERN_DEBUG "%s: ready\n", dev->name);
3476
3477  out:
3478         return err;
3479 }
3480
3481 struct net_device
3482 *alloc_orinocodev(int sizeof_card,
3483                   struct device *device,
3484                   int (*hard_reset)(struct orinoco_private *),
3485                   int (*stop_fw)(struct orinoco_private *, int))
3486 {
3487         struct net_device *dev;
3488         struct orinoco_private *priv;
3489
3490         dev = alloc_etherdev(sizeof(struct orinoco_private) + sizeof_card);
3491         if (! dev)
3492                 return NULL;
3493         priv = netdev_priv(dev);
3494         priv->ndev = dev;
3495         if (sizeof_card)
3496                 priv->card = (void *)((unsigned long)priv
3497                                       + sizeof(struct orinoco_private));
3498         else
3499                 priv->card = NULL;
3500         priv->dev = device;
3501
3502         /* Setup / override net_device fields */
3503         dev->init = orinoco_init;
3504         dev->hard_start_xmit = orinoco_xmit;
3505         dev->tx_timeout = orinoco_tx_timeout;
3506         dev->watchdog_timeo = HZ; /* 1 second timeout */
3507         dev->get_stats = orinoco_get_stats;
3508         dev->ethtool_ops = &orinoco_ethtool_ops;
3509         dev->wireless_handlers = (struct iw_handler_def *)&orinoco_handler_def;
3510 #ifdef WIRELESS_SPY
3511         priv->wireless_data.spy_data = &priv->spy_data;
3512         dev->wireless_data = &priv->wireless_data;
3513 #endif
3514         dev->change_mtu = orinoco_change_mtu;
3515         dev->set_multicast_list = orinoco_set_multicast_list;
3516         /* we use the default eth_mac_addr for setting the MAC addr */
3517
3518         /* Reserve space in skb for the SNAP header */
3519         dev->hard_header_len += ENCAPS_OVERHEAD;
3520
3521         /* Set up default callbacks */
3522         dev->open = orinoco_open;
3523         dev->stop = orinoco_stop;
3524         priv->hard_reset = hard_reset;
3525         priv->stop_fw = stop_fw;
3526
3527         spin_lock_init(&priv->lock);
3528         priv->open = 0;
3529         priv->hw_unavailable = 1; /* orinoco_init() must clear this
3530                                    * before anything else touches the
3531                                    * hardware */
3532         INIT_WORK(&priv->reset_work, orinoco_reset);
3533         INIT_WORK(&priv->join_work, orinoco_join_ap);
3534         INIT_WORK(&priv->wevent_work, orinoco_send_wevents);
3535
3536         INIT_LIST_HEAD(&priv->rx_list);
3537         tasklet_init(&priv->rx_tasklet, orinoco_rx_isr_tasklet,
3538                      (unsigned long) dev);
3539
3540         netif_carrier_off(dev);
3541         priv->last_linkstatus = 0xffff;
3542
3543         priv->cached_fw = NULL;
3544
3545         return dev;
3546 }
3547
3548 void free_orinocodev(struct net_device *dev)
3549 {
3550         struct orinoco_private *priv = netdev_priv(dev);
3551
3552         /* No need to empty priv->rx_list: if the tasklet is scheduled
3553          * when we call tasklet_kill it will run one final time,
3554          * emptying the list */
3555         tasklet_kill(&priv->rx_tasklet);
3556         if (priv->cached_fw)
3557                 release_firmware(priv->cached_fw);
3558         priv->cached_fw = NULL;
3559         priv->wpa_ie_len = 0;
3560         kfree(priv->wpa_ie);
3561         orinoco_mic_free(priv);
3562         orinoco_bss_data_free(priv);
3563         free_netdev(dev);
3564 }
3565
3566 /********************************************************************/
3567 /* Wireless extensions                                              */
3568 /********************************************************************/
3569
3570 /* Return : < 0 -> error code ; >= 0 -> length */
3571 static int orinoco_hw_get_essid(struct orinoco_private *priv, int *active,
3572                                 char buf[IW_ESSID_MAX_SIZE+1])
3573 {
3574         hermes_t *hw = &priv->hw;
3575         int err = 0;
3576         struct hermes_idstring essidbuf;
3577         char *p = (char *)(&essidbuf.val);
3578         int len;
3579         unsigned long flags;
3580
3581         if (orinoco_lock(priv, &flags) != 0)
3582                 return -EBUSY;
3583
3584         if (strlen(priv->desired_essid) > 0) {
3585                 /* We read the desired SSID from the hardware rather
3586                    than from priv->desired_essid, just in case the
3587                    firmware is allowed to change it on us. I'm not
3588                    sure about this */
3589                 /* My guess is that the OWNSSID should always be whatever
3590                  * we set to the card, whereas CURRENT_SSID is the one that
3591                  * may change... - Jean II */
3592                 u16 rid;
3593
3594                 *active = 1;
3595
3596                 rid = (priv->port_type == 3) ? HERMES_RID_CNFOWNSSID :
3597                         HERMES_RID_CNFDESIREDSSID;
3598
3599                 err = hermes_read_ltv(hw, USER_BAP, rid, sizeof(essidbuf),
3600                                       NULL, &essidbuf);
3601                 if (err)
3602                         goto fail_unlock;
3603         } else {
3604                 *active = 0;
3605
3606                 err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CURRENTSSID,
3607                                       sizeof(essidbuf), NULL, &essidbuf);
3608                 if (err)
3609                         goto fail_unlock;
3610         }
3611
3612         len = le16_to_cpu(essidbuf.len);
3613         BUG_ON(len > IW_ESSID_MAX_SIZE);
3614
3615         memset(buf, 0, IW_ESSID_MAX_SIZE);
3616         memcpy(buf, p, len);
3617         err = len;
3618
3619  fail_unlock:
3620         orinoco_unlock(priv, &flags);
3621
3622         return err;
3623 }
3624
3625 static long orinoco_hw_get_freq(struct orinoco_private *priv)
3626 {
3627
3628         hermes_t *hw = &priv->hw;
3629         int err = 0;
3630         u16 channel;
3631         long freq = 0;
3632         unsigned long flags;
3633
3634         if (orinoco_lock(priv, &flags) != 0)
3635                 return -EBUSY;
3636
3637         err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_CURRENTCHANNEL, &channel);
3638         if (err)
3639                 goto out;
3640
3641         /* Intersil firmware 1.3.5 returns 0 when the interface is down */
3642         if (channel == 0) {
3643                 err = -EBUSY;
3644                 goto out;
3645         }
3646
3647         if ( (channel < 1) || (channel > NUM_CHANNELS) ) {
3648                 printk(KERN_WARNING "%s: Channel out of range (%d)!\n",
3649                        priv->ndev->name, channel);
3650                 err = -EBUSY;
3651                 goto out;
3652
3653         }
3654         freq = channel_frequency[channel-1] * 100000;
3655
3656  out:
3657         orinoco_unlock(priv, &flags);
3658
3659         if (err > 0)
3660                 err = -EBUSY;
3661         return err ? err : freq;
3662 }
3663
3664 static int orinoco_hw_get_bitratelist(struct orinoco_private *priv,
3665                                       int *numrates, s32 *rates, int max)
3666 {
3667         hermes_t *hw = &priv->hw;
3668         struct hermes_idstring list;
3669         unsigned char *p = (unsigned char *)&list.val;
3670         int err = 0;
3671         int num;
3672         int i;
3673         unsigned long flags;
3674
3675         if (orinoco_lock(priv, &flags) != 0)
3676                 return -EBUSY;
3677
3678         err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_SUPPORTEDDATARATES,
3679                               sizeof(list), NULL, &list);
3680         orinoco_unlock(priv, &flags);
3681
3682         if (err)
3683                 return err;
3684
3685         num = le16_to_cpu(list.len);
3686         *numrates = num;
3687         num = min(num, max);
3688
3689         for (i = 0; i < num; i++) {
3690                 rates[i] = (p[i] & 0x7f) * 500000; /* convert to bps */
3691         }
3692
3693         return 0;
3694 }
3695
3696 static int orinoco_ioctl_getname(struct net_device *dev,
3697                                  struct iw_request_info *info,
3698                                  char *name,
3699                                  char *extra)
3700 {
3701         struct orinoco_private *priv = netdev_priv(dev);
3702         int numrates;
3703         int err;
3704
3705         err = orinoco_hw_get_bitratelist(priv, &numrates, NULL, 0);
3706
3707         if (!err && (numrates > 2))
3708                 strcpy(name, "IEEE 802.11b");
3709         else
3710                 strcpy(name, "IEEE 802.11-DS");
3711
3712         return 0;
3713 }
3714
3715 static int orinoco_ioctl_setwap(struct net_device *dev,
3716                                 struct iw_request_info *info,
3717                                 struct sockaddr *ap_addr,
3718                                 char *extra)
3719 {
3720         struct orinoco_private *priv = netdev_priv(dev);
3721         int err = -EINPROGRESS;         /* Call commit handler */
3722         unsigned long flags;
3723         static const u8 off_addr[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
3724         static const u8 any_addr[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
3725
3726         if (orinoco_lock(priv, &flags) != 0)
3727                 return -EBUSY;
3728
3729         /* Enable automatic roaming - no sanity checks are needed */
3730         if (memcmp(&ap_addr->sa_data, off_addr, ETH_ALEN) == 0 ||
3731             memcmp(&ap_addr->sa_data, any_addr, ETH_ALEN) == 0) {
3732                 priv->bssid_fixed = 0;
3733                 memset(priv->desired_bssid, 0, ETH_ALEN);
3734
3735                 /* "off" means keep existing connection */
3736                 if (ap_addr->sa_data[0] == 0) {
3737                         __orinoco_hw_set_wap(priv);
3738                         err = 0;
3739                 }
3740                 goto out;
3741         }
3742
3743         if (priv->firmware_type == FIRMWARE_TYPE_AGERE) {
3744                 printk(KERN_WARNING "%s: Lucent/Agere firmware doesn't "
3745                        "support manual roaming\n",
3746                        dev->name);
3747                 err = -EOPNOTSUPP;
3748                 goto out;
3749         }
3750
3751         if (priv->iw_mode != IW_MODE_INFRA) {
3752                 printk(KERN_WARNING "%s: Manual roaming supported only in "
3753                        "managed mode\n", dev->name);
3754                 err = -EOPNOTSUPP;
3755                 goto out;
3756         }
3757
3758         /* Intersil firmware hangs without Desired ESSID */
3759         if (priv->firmware_type == FIRMWARE_TYPE_INTERSIL &&
3760             strlen(priv->desired_essid) == 0) {
3761                 printk(KERN_WARNING "%s: Desired ESSID must be set for "
3762                        "manual roaming\n", dev->name);
3763                 err = -EOPNOTSUPP;
3764                 goto out;
3765         }
3766
3767         /* Finally, enable manual roaming */
3768         priv->bssid_fixed = 1;
3769         memcpy(priv->desired_bssid, &ap_addr->sa_data, ETH_ALEN);
3770
3771  out:
3772         orinoco_unlock(priv, &flags);
3773         return err;
3774 }
3775
3776 static int orinoco_ioctl_getwap(struct net_device *dev,
3777                                 struct iw_request_info *info,
3778                                 struct sockaddr *ap_addr,
3779                                 char *extra)
3780 {
3781         struct orinoco_private *priv = netdev_priv(dev);
3782
3783         hermes_t *hw = &priv->hw;
3784         int err = 0;
3785         unsigned long flags;
3786
3787         if (orinoco_lock(priv, &flags) != 0)
3788                 return -EBUSY;
3789
3790         ap_addr->sa_family = ARPHRD_ETHER;
3791         err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CURRENTBSSID,
3792                               ETH_ALEN, NULL, ap_addr->sa_data);
3793
3794         orinoco_unlock(priv, &flags);
3795
3796         return err;
3797 }
3798
3799 static int orinoco_ioctl_setmode(struct net_device *dev,
3800                                  struct iw_request_info *info,
3801                                  u32 *mode,
3802                                  char *extra)
3803 {
3804         struct orinoco_private *priv = netdev_priv(dev);
3805         int err = -EINPROGRESS;         /* Call commit handler */
3806         unsigned long flags;
3807
3808         if (priv->iw_mode == *mode)
3809                 return 0;
3810
3811         if (orinoco_lock(priv, &flags) != 0)
3812                 return -EBUSY;
3813
3814         switch (*mode) {
3815         case IW_MODE_ADHOC:
3816                 if (!priv->has_ibss && !priv->has_port3)
3817                         err = -EOPNOTSUPP;
3818                 break;
3819
3820         case IW_MODE_INFRA:
3821                 break;
3822
3823         case IW_MODE_MONITOR:
3824                 if (priv->broken_monitor && !force_monitor) {
3825                         printk(KERN_WARNING "%s: Monitor mode support is "
3826                                "buggy in this firmware, not enabling\n",
3827                                dev->name);
3828                         err = -EOPNOTSUPP;
3829                 }
3830                 break;
3831
3832         default:
3833                 err = -EOPNOTSUPP;
3834                 break;
3835         }
3836
3837         if (err == -EINPROGRESS) {
3838                 priv->iw_mode = *mode;
3839                 set_port_type(priv);
3840         }
3841
3842         orinoco_unlock(priv, &flags);
3843
3844         return err;
3845 }
3846
3847 static int orinoco_ioctl_getmode(struct net_device *dev,
3848                                  struct iw_request_info *info,
3849                                  u32 *mode,
3850                                  char *extra)
3851 {
3852         struct orinoco_private *priv = netdev_priv(dev);
3853
3854         *mode = priv->iw_mode;
3855         return 0;
3856 }
3857
3858 static int orinoco_ioctl_getiwrange(struct net_device *dev,
3859                                     struct iw_request_info *info,
3860                                     struct iw_point *rrq,
3861                                     char *extra)
3862 {
3863         struct orinoco_private *priv = netdev_priv(dev);
3864         int err = 0;
3865         struct iw_range *range = (struct iw_range *) extra;
3866         int numrates;
3867         int i, k;
3868
3869         rrq->length = sizeof(struct iw_range);
3870         memset(range, 0, sizeof(struct iw_range));
3871
3872         range->we_version_compiled = WIRELESS_EXT;
3873         range->we_version_source = 22;
3874
3875         /* Set available channels/frequencies */
3876         range->num_channels = NUM_CHANNELS;
3877         k = 0;
3878         for (i = 0; i < NUM_CHANNELS; i++) {
3879                 if (priv->channel_mask & (1 << i)) {
3880                         range->freq[k].i = i + 1;
3881                         range->freq[k].m = channel_frequency[i] * 100000;
3882                         range->freq[k].e = 1;
3883                         k++;
3884                 }
3885
3886                 if (k >= IW_MAX_FREQUENCIES)
3887                         break;
3888         }
3889         range->num_frequency = k;
3890         range->sensitivity = 3;
3891
3892         if (priv->has_wep) {
3893                 range->max_encoding_tokens = ORINOCO_MAX_KEYS;
3894                 range->encoding_size[0] = SMALL_KEY_SIZE;
3895                 range->num_encoding_sizes = 1;
3896
3897                 if (priv->has_big_wep) {
3898                         range->encoding_size[1] = LARGE_KEY_SIZE;
3899                         range->num_encoding_sizes = 2;
3900                 }
3901         }
3902
3903         if (priv->has_wpa)
3904                 range->enc_capa = IW_ENC_CAPA_WPA | IW_ENC_CAPA_CIPHER_TKIP;
3905
3906         if ((priv->iw_mode == IW_MODE_ADHOC) && (!SPY_NUMBER(priv))){
3907                 /* Quality stats meaningless in ad-hoc mode */
3908         } else {
3909                 range->max_qual.qual = 0x8b - 0x2f;
3910                 range->max_qual.level = 0x2f - 0x95 - 1;
3911                 range->max_qual.noise = 0x2f - 0x95 - 1;
3912                 /* Need to get better values */
3913                 range->avg_qual.qual = 0x24;
3914                 range->avg_qual.level = 0xC2;
3915                 range->avg_qual.noise = 0x9E;
3916         }
3917
3918         err = orinoco_hw_get_bitratelist(priv, &numrates,
3919                                          range->bitrate, IW_MAX_BITRATES);
3920         if (err)
3921                 return err;
3922         range->num_bitrates = numrates;
3923
3924         /* Set an indication of the max TCP throughput in bit/s that we can
3925          * expect using this interface. May be use for QoS stuff...
3926          * Jean II */
3927         if (numrates > 2)
3928                 range->throughput = 5 * 1000 * 1000;    /* ~5 Mb/s */
3929         else
3930                 range->throughput = 1.5 * 1000 * 1000;  /* ~1.5 Mb/s */
3931
3932         range->min_rts = 0;
3933         range->max_rts = 2347;
3934         range->min_frag = 256;
3935         range->max_frag = 2346;
3936
3937         range->min_pmp = 0;
3938         range->max_pmp = 65535000;
3939         range->min_pmt = 0;
3940         range->max_pmt = 65535 * 1000;  /* ??? */
3941         range->pmp_flags = IW_POWER_PERIOD;
3942         range->pmt_flags = IW_POWER_TIMEOUT;
3943         range->pm_capa = IW_POWER_PERIOD | IW_POWER_TIMEOUT | IW_POWER_UNICAST_R;
3944
3945         range->retry_capa = IW_RETRY_LIMIT | IW_RETRY_LIFETIME;
3946         range->retry_flags = IW_RETRY_LIMIT;
3947         range->r_time_flags = IW_RETRY_LIFETIME;
3948         range->min_retry = 0;
3949         range->max_retry = 65535;       /* ??? */
3950         range->min_r_time = 0;
3951         range->max_r_time = 65535 * 1000;       /* ??? */
3952
3953         if (priv->firmware_type == FIRMWARE_TYPE_AGERE)
3954                 range->scan_capa = IW_SCAN_CAPA_ESSID;
3955         else
3956                 range->scan_capa = IW_SCAN_CAPA_NONE;
3957
3958         /* Event capability (kernel) */
3959         IW_EVENT_CAPA_SET_KERNEL(range->event_capa);
3960         /* Event capability (driver) */
3961         IW_EVENT_CAPA_SET(range->event_capa, SIOCGIWTHRSPY);
3962         IW_EVENT_CAPA_SET(range->event_capa, SIOCGIWAP);
3963         IW_EVENT_CAPA_SET(range->event_capa, SIOCGIWSCAN);
3964         IW_EVENT_CAPA_SET(range->event_capa, IWEVTXDROP);
3965
3966         return 0;
3967 }
3968
3969 static int orinoco_ioctl_setiwencode(struct net_device *dev,
3970                                      struct iw_request_info *info,
3971                                      struct iw_point *erq,
3972                                      char *keybuf)
3973 {
3974         struct orinoco_private *priv = netdev_priv(dev);
3975         int index = (erq->flags & IW_ENCODE_INDEX) - 1;
3976         int setindex = priv->tx_key;
3977         int encode_alg = priv->encode_alg;
3978         int restricted = priv->wep_restrict;
3979         u16 xlen = 0;
3980         int err = -EINPROGRESS;         /* Call commit handler */
3981         unsigned long flags;
3982
3983         if (! priv->has_wep)
3984                 return -EOPNOTSUPP;
3985
3986         if (erq->pointer) {
3987                 /* We actually have a key to set - check its length */
3988                 if (erq->length > LARGE_KEY_SIZE)
3989                         return -E2BIG;
3990
3991                 if ( (erq->length > SMALL_KEY_SIZE) && !priv->has_big_wep )
3992                         return -E2BIG;
3993         }
3994
3995         if (orinoco_lock(priv, &flags) != 0)
3996                 return -EBUSY;
3997
3998         /* Clear any TKIP key we have */
3999         if ((priv->has_wpa) && (priv->encode_alg == IW_ENCODE_ALG_TKIP))
4000                 (void) orinoco_clear_tkip_key(priv, setindex);
4001
4002         if (erq->length > 0) {
4003                 if ((index < 0) || (index >= ORINOCO_MAX_KEYS))
4004                         index = priv->tx_key;
4005
4006                 /* Adjust key length to a supported value */
4007                 if (erq->length > SMALL_KEY_SIZE) {
4008                         xlen = LARGE_KEY_SIZE;
4009                 } else if (erq->length > 0) {
4010                         xlen = SMALL_KEY_SIZE;
4011                 } else
4012                         xlen = 0;
4013
4014                 /* Switch on WEP if off */
4015                 if ((encode_alg != IW_ENCODE_ALG_WEP) && (xlen > 0)) {
4016                         setindex = index;
4017                         encode_alg = IW_ENCODE_ALG_WEP;
4018                 }
4019         } else {
4020                 /* Important note : if the user do "iwconfig eth0 enc off",
4021                  * we will arrive there with an index of -1. This is valid
4022                  * but need to be taken care off... Jean II */
4023                 if ((index < 0) || (index >= ORINOCO_MAX_KEYS)) {
4024                         if((index != -1) || (erq->flags == 0)) {
4025                                 err = -EINVAL;
4026                                 goto out;
4027                         }
4028                 } else {
4029                         /* Set the index : Check that the key is valid */
4030                         if(priv->keys[index].len == 0) {
4031                                 err = -EINVAL;
4032                                 goto out;
4033                         }
4034                         setindex = index;
4035                 }
4036         }
4037
4038         if (erq->flags & IW_ENCODE_DISABLED)
4039                 encode_alg = IW_ENCODE_ALG_NONE;
4040         if (erq->flags & IW_ENCODE_OPEN)
4041                 restricted = 0;
4042         if (erq->flags & IW_ENCODE_RESTRICTED)
4043                 restricted = 1;
4044
4045         if (erq->pointer && erq->length > 0) {
4046                 priv->keys[index].len = cpu_to_le16(xlen);
4047                 memset(priv->keys[index].data, 0,
4048                        sizeof(priv->keys[index].data));
4049                 memcpy(priv->keys[index].data, keybuf, erq->length);
4050         }
4051         priv->tx_key = setindex;
4052
4053         /* Try fast key change if connected and only keys are changed */
4054         if ((priv->encode_alg == encode_alg) &&
4055             (priv->wep_restrict == restricted) &&
4056             netif_carrier_ok(dev)) {
4057                 err = __orinoco_hw_setup_wepkeys(priv);
4058                 /* No need to commit if successful */
4059                 goto out;
4060         }
4061
4062         priv->encode_alg = encode_alg;
4063         priv->wep_restrict = restricted;
4064
4065  out:
4066         orinoco_unlock(priv, &flags);
4067
4068         return err;
4069 }
4070
4071 static int orinoco_ioctl_getiwencode(struct net_device *dev,
4072                                      struct iw_request_info *info,
4073                                      struct iw_point *erq,
4074                                      char *keybuf)
4075 {
4076         struct orinoco_private *priv = netdev_priv(dev);
4077         int index = (erq->flags & IW_ENCODE_INDEX) - 1;
4078         u16 xlen = 0;
4079         unsigned long flags;
4080
4081         if (! priv->has_wep)
4082                 return -EOPNOTSUPP;
4083
4084         if (orinoco_lock(priv, &flags) != 0)
4085                 return -EBUSY;
4086
4087         if ((index < 0) || (index >= ORINOCO_MAX_KEYS))
4088                 index = priv->tx_key;
4089
4090         erq->flags = 0;
4091         if (!priv->encode_alg)
4092                 erq->flags |= IW_ENCODE_DISABLED;
4093         erq->flags |= index + 1;
4094
4095         if (priv->wep_restrict)
4096                 erq->flags |= IW_ENCODE_RESTRICTED;
4097         else
4098                 erq->flags |= IW_ENCODE_OPEN;
4099
4100         xlen = le16_to_cpu(priv->keys[index].len);
4101
4102         erq->length = xlen;
4103
4104         memcpy(keybuf, priv->keys[index].data, ORINOCO_MAX_KEY_SIZE);
4105
4106         orinoco_unlock(priv, &flags);
4107         return 0;
4108 }
4109
4110 static int orinoco_ioctl_setessid(struct net_device *dev,
4111                                   struct iw_request_info *info,
4112                                   struct iw_point *erq,
4113                                   char *essidbuf)
4114 {
4115         struct orinoco_private *priv = netdev_priv(dev);
4116         unsigned long flags;
4117
4118         /* Note : ESSID is ignored in Ad-Hoc demo mode, but we can set it
4119          * anyway... - Jean II */
4120
4121         /* Hum... Should not use Wireless Extension constant (may change),
4122          * should use our own... - Jean II */
4123         if (erq->length > IW_ESSID_MAX_SIZE)
4124                 return -E2BIG;
4125
4126         if (orinoco_lock(priv, &flags) != 0)
4127                 return -EBUSY;
4128
4129         /* NULL the string (for NULL termination & ESSID = ANY) - Jean II */
4130         memset(priv->desired_essid, 0, sizeof(priv->desired_essid));
4131
4132         /* If not ANY, get the new ESSID */
4133         if (erq->flags) {
4134                 memcpy(priv->desired_essid, essidbuf, erq->length);
4135         }
4136
4137         orinoco_unlock(priv, &flags);
4138
4139         return -EINPROGRESS;            /* Call commit handler */
4140 }
4141
4142 static int orinoco_ioctl_getessid(struct net_device *dev,
4143                                   struct iw_request_info *info,
4144                                   struct iw_point *erq,
4145                                   char *essidbuf)
4146 {
4147         struct orinoco_private *priv = netdev_priv(dev);
4148         int active;
4149         int err = 0;
4150         unsigned long flags;
4151
4152         if (netif_running(dev)) {
4153                 err = orinoco_hw_get_essid(priv, &active, essidbuf);
4154                 if (err < 0)
4155                         return err;
4156                 erq->length = err;
4157         } else {
4158                 if (orinoco_lock(priv, &flags) != 0)
4159                         return -EBUSY;
4160                 memcpy(essidbuf, priv->desired_essid, IW_ESSID_MAX_SIZE);
4161                 erq->length = strlen(priv->desired_essid);
4162                 orinoco_unlock(priv, &flags);
4163         }
4164
4165         erq->flags = 1;
4166
4167         return 0;
4168 }
4169
4170 static int orinoco_ioctl_setnick(struct net_device *dev,
4171                                  struct iw_request_info *info,
4172                                  struct iw_point *nrq,
4173                                  char *nickbuf)
4174 {
4175         struct orinoco_private *priv = netdev_priv(dev);
4176         unsigned long flags;
4177
4178         if (nrq->length > IW_ESSID_MAX_SIZE)
4179                 return -E2BIG;
4180
4181         if (orinoco_lock(priv, &flags) != 0)
4182                 return -EBUSY;
4183
4184         memset(priv->nick, 0, sizeof(priv->nick));
4185         memcpy(priv->nick, nickbuf, nrq->length);
4186
4187         orinoco_unlock(priv, &flags);
4188
4189         return -EINPROGRESS;            /* Call commit handler */
4190 }
4191
4192 static int orinoco_ioctl_getnick(struct net_device *dev,
4193                                  struct iw_request_info *info,
4194                                  struct iw_point *nrq,
4195                                  char *nickbuf)
4196 {
4197         struct orinoco_private *priv = netdev_priv(dev);
4198         unsigned long flags;
4199
4200         if (orinoco_lock(priv, &flags) != 0)
4201                 return -EBUSY;
4202
4203         memcpy(nickbuf, priv->nick, IW_ESSID_MAX_SIZE);
4204         orinoco_unlock(priv, &flags);
4205
4206         nrq->length = strlen(priv->nick);
4207
4208         return 0;
4209 }
4210
4211 static int orinoco_ioctl_setfreq(struct net_device *dev,
4212                                  struct iw_request_info *info,
4213                                  struct iw_freq *frq,
4214                                  char *extra)
4215 {
4216         struct orinoco_private *priv = netdev_priv(dev);
4217         int chan = -1;
4218         unsigned long flags;
4219         int err = -EINPROGRESS;         /* Call commit handler */
4220
4221         /* In infrastructure mode the AP sets the channel */
4222         if (priv->iw_mode == IW_MODE_INFRA)
4223                 return -EBUSY;
4224
4225         if ( (frq->e == 0) && (frq->m <= 1000) ) {
4226                 /* Setting by channel number */
4227                 chan = frq->m;
4228         } else {
4229                 /* Setting by frequency - search the table */
4230                 int mult = 1;
4231                 int i;
4232
4233                 for (i = 0; i < (6 - frq->e); i++)
4234                         mult *= 10;
4235
4236                 for (i = 0; i < NUM_CHANNELS; i++)
4237                         if (frq->m == (channel_frequency[i] * mult))
4238                                 chan = i+1;
4239         }
4240
4241         if ( (chan < 1) || (chan > NUM_CHANNELS) ||
4242              ! (priv->channel_mask & (1 << (chan-1)) ) )
4243                 return -EINVAL;
4244
4245         if (orinoco_lock(priv, &flags) != 0)
4246                 return -EBUSY;
4247
4248         priv->channel = chan;
4249         if (priv->iw_mode == IW_MODE_MONITOR) {
4250                 /* Fast channel change - no commit if successful */
4251                 hermes_t *hw = &priv->hw;
4252                 err = hermes_docmd_wait(hw, HERMES_CMD_TEST |
4253                                             HERMES_TEST_SET_CHANNEL,
4254                                         chan, NULL);
4255         }
4256         orinoco_unlock(priv, &flags);
4257
4258         return err;
4259 }
4260
4261 static int orinoco_ioctl_getfreq(struct net_device *dev,
4262                                  struct iw_request_info *info,
4263                                  struct iw_freq *frq,
4264                                  char *extra)
4265 {
4266         struct orinoco_private *priv = netdev_priv(dev);
4267         int tmp;
4268
4269         /* Locking done in there */
4270         tmp = orinoco_hw_get_freq(priv);
4271         if (tmp < 0) {
4272                 return tmp;
4273         }
4274
4275         frq->m = tmp;
4276         frq->e = 1;
4277
4278         return 0;
4279 }
4280
4281 static int orinoco_ioctl_getsens(struct net_device *dev,
4282                                  struct iw_request_info *info,
4283                                  struct iw_param *srq,
4284                                  char *extra)
4285 {
4286         struct orinoco_private *priv = netdev_priv(dev);
4287         hermes_t *hw = &priv->hw;
4288         u16 val;
4289         int err;
4290         unsigned long flags;
4291
4292         if (!priv->has_sensitivity)
4293                 return -EOPNOTSUPP;
4294
4295         if (orinoco_lock(priv, &flags) != 0)
4296                 return -EBUSY;
4297         err = hermes_read_wordrec(hw, USER_BAP,
4298                                   HERMES_RID_CNFSYSTEMSCALE, &val);
4299         orinoco_unlock(priv, &flags);
4300
4301         if (err)
4302                 return err;
4303
4304         srq->value = val;
4305         srq->fixed = 0; /* auto */
4306
4307         return 0;
4308 }
4309
4310 static int orinoco_ioctl_setsens(struct net_device *dev,
4311                                  struct iw_request_info *info,
4312                                  struct iw_param *srq,
4313                                  char *extra)
4314 {
4315         struct orinoco_private *priv = netdev_priv(dev);
4316         int val = srq->value;
4317         unsigned long flags;
4318
4319         if (!priv->has_sensitivity)
4320                 return -EOPNOTSUPP;
4321
4322         if ((val < 1) || (val > 3))
4323                 return -EINVAL;
4324
4325         if (orinoco_lock(priv, &flags) != 0)
4326                 return -EBUSY;
4327         priv->ap_density = val;
4328         orinoco_unlock(priv, &flags);
4329
4330         return -EINPROGRESS;            /* Call commit handler */
4331 }
4332
4333 static int orinoco_ioctl_setrts(struct net_device *dev,
4334                                 struct iw_request_info *info,
4335                                 struct iw_param *rrq,
4336                                 char *extra)
4337 {
4338         struct orinoco_private *priv = netdev_priv(dev);
4339         int val = rrq->value;
4340         unsigned long flags;
4341
4342         if (rrq->disabled)
4343                 val = 2347;
4344
4345         if ( (val < 0) || (val > 2347) )
4346                 return -EINVAL;
4347
4348         if (orinoco_lock(priv, &flags) != 0)
4349                 return -EBUSY;
4350
4351         priv->rts_thresh = val;
4352         orinoco_unlock(priv, &flags);
4353
4354         return -EINPROGRESS;            /* Call commit handler */
4355 }
4356
4357 static int orinoco_ioctl_getrts(struct net_device *dev,
4358                                 struct iw_request_info *info,
4359                                 struct iw_param *rrq,
4360                                 char *extra)
4361 {
4362         struct orinoco_private *priv = netdev_priv(dev);
4363
4364         rrq->value = priv->rts_thresh;
4365         rrq->disabled = (rrq->value == 2347);
4366         rrq->fixed = 1;
4367
4368         return 0;
4369 }
4370
4371 static int orinoco_ioctl_setfrag(struct net_device *dev,
4372                                  struct iw_request_info *info,
4373                                  struct iw_param *frq,
4374                                  char *extra)
4375 {
4376         struct orinoco_private *priv = netdev_priv(dev);
4377         int err = -EINPROGRESS;         /* Call commit handler */
4378         unsigned long flags;
4379
4380         if (orinoco_lock(priv, &flags) != 0)
4381                 return -EBUSY;
4382
4383         if (priv->has_mwo) {
4384                 if (frq->disabled)
4385                         priv->mwo_robust = 0;
4386                 else {
4387                         if (frq->fixed)
4388                                 printk(KERN_WARNING "%s: Fixed fragmentation is "
4389                                        "not supported on this firmware. "
4390                                        "Using MWO robust instead.\n", dev->name);
4391                         priv->mwo_robust = 1;
4392                 }
4393         } else {
4394                 if (frq->disabled)
4395                         priv->frag_thresh = 2346;
4396                 else {
4397                         if ( (frq->value < 256) || (frq->value > 2346) )
4398                                 err = -EINVAL;
4399                         else
4400                                 priv->frag_thresh = frq->value & ~0x1; /* must be even */
4401                 }
4402         }
4403
4404         orinoco_unlock(priv, &flags);
4405
4406         return err;
4407 }
4408
4409 static int orinoco_ioctl_getfrag(struct net_device *dev,
4410                                  struct iw_request_info *info,
4411                                  struct iw_param *frq,
4412                                  char *extra)
4413 {
4414         struct orinoco_private *priv = netdev_priv(dev);
4415         hermes_t *hw = &priv->hw;
4416         int err;
4417         u16 val;
4418         unsigned long flags;
4419
4420         if (orinoco_lock(priv, &flags) != 0)
4421                 return -EBUSY;
4422
4423         if (priv->has_mwo) {
4424                 err = hermes_read_wordrec(hw, USER_BAP,
4425                                           HERMES_RID_CNFMWOROBUST_AGERE,
4426                                           &val);
4427                 if (err)
4428                         val = 0;
4429
4430                 frq->value = val ? 2347 : 0;
4431                 frq->disabled = ! val;
4432                 frq->fixed = 0;
4433         } else {
4434                 err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_CNFFRAGMENTATIONTHRESHOLD,
4435                                           &val);
4436                 if (err)
4437                         val = 0;
4438
4439                 frq->value = val;
4440                 frq->disabled = (val >= 2346);
4441                 frq->fixed = 1;
4442         }
4443
4444         orinoco_unlock(priv, &flags);
4445
4446         return err;
4447 }
4448
4449 static int orinoco_ioctl_setrate(struct net_device *dev,
4450                                  struct iw_request_info *info,
4451                                  struct iw_param *rrq,
4452                                  char *extra)
4453 {
4454         struct orinoco_private *priv = netdev_priv(dev);
4455         int ratemode = -1;
4456         int bitrate; /* 100s of kilobits */
4457         int i;
4458         unsigned long flags;
4459
4460         /* As the user space doesn't know our highest rate, it uses -1
4461          * to ask us to set the highest rate.  Test it using "iwconfig
4462          * ethX rate auto" - Jean II */
4463         if (rrq->value == -1)
4464                 bitrate = 110;
4465         else {
4466                 if (rrq->value % 100000)
4467                         return -EINVAL;
4468                 bitrate = rrq->value / 100000;
4469         }
4470
4471         if ( (bitrate != 10) && (bitrate != 20) &&
4472              (bitrate != 55) && (bitrate != 110) )
4473                 return -EINVAL;
4474
4475         for (i = 0; i < BITRATE_TABLE_SIZE; i++)
4476                 if ( (bitrate_table[i].bitrate == bitrate) &&
4477                      (bitrate_table[i].automatic == ! rrq->fixed) ) {
4478                         ratemode = i;
4479                         break;
4480                 }
4481
4482         if (ratemode == -1)
4483                 return -EINVAL;
4484
4485         if (orinoco_lock(priv, &flags) != 0)
4486                 return -EBUSY;
4487         priv->bitratemode = ratemode;
4488         orinoco_unlock(priv, &flags);
4489
4490         return -EINPROGRESS;
4491 }
4492
4493 static int orinoco_ioctl_getrate(struct net_device *dev,
4494                                  struct iw_request_info *info,
4495                                  struct iw_param *rrq,
4496                                  char *extra)
4497 {
4498         struct orinoco_private *priv = netdev_priv(dev);
4499         hermes_t *hw = &priv->hw;
4500         int err = 0;
4501         int ratemode;
4502         int i;
4503         u16 val;
4504         unsigned long flags;
4505
4506         if (orinoco_lock(priv, &flags) != 0)
4507                 return -EBUSY;
4508
4509         ratemode = priv->bitratemode;
4510
4511         BUG_ON((ratemode < 0) || (ratemode >= BITRATE_TABLE_SIZE));
4512
4513         rrq->value = bitrate_table[ratemode].bitrate * 100000;
4514         rrq->fixed = ! bitrate_table[ratemode].automatic;
4515         rrq->disabled = 0;
4516
4517         /* If the interface is running we try to find more about the
4518            current mode */
4519         if (netif_running(dev)) {
4520                 err = hermes_read_wordrec(hw, USER_BAP,
4521                                           HERMES_RID_CURRENTTXRATE, &val);
4522                 if (err)
4523                         goto out;
4524
4525                 switch (priv->firmware_type) {
4526                 case FIRMWARE_TYPE_AGERE: /* Lucent style rate */
4527                         /* Note : in Lucent firmware, the return value of
4528                          * HERMES_RID_CURRENTTXRATE is the bitrate in Mb/s,
4529                          * and therefore is totally different from the
4530                          * encoding of HERMES_RID_CNFTXRATECONTROL.
4531                          * Don't forget that 6Mb/s is really 5.5Mb/s */
4532                         if (val == 6)
4533                                 rrq->value = 5500000;
4534                         else
4535                                 rrq->value = val * 1000000;
4536                         break;
4537                 case FIRMWARE_TYPE_INTERSIL: /* Intersil style rate */
4538                 case FIRMWARE_TYPE_SYMBOL: /* Symbol style rate */
4539                         for (i = 0; i < BITRATE_TABLE_SIZE; i++)
4540                                 if (bitrate_table[i].intersil_txratectrl == val) {
4541                                         ratemode = i;
4542                                         break;
4543                                 }
4544                         if (i >= BITRATE_TABLE_SIZE)
4545                                 printk(KERN_INFO "%s: Unable to determine current bitrate (0x%04hx)\n",
4546                                        dev->name, val);
4547
4548                         rrq->value = bitrate_table[ratemode].bitrate * 100000;
4549                         break;
4550                 default:
4551                         BUG();
4552                 }
4553         }
4554
4555  out:
4556         orinoco_unlock(priv, &flags);
4557
4558         return err;
4559 }
4560
4561 static int orinoco_ioctl_setpower(struct net_device *dev,
4562                                   struct iw_request_info *info,
4563                                   struct iw_param *prq,
4564                                   char *extra)
4565 {
4566         struct orinoco_private *priv = netdev_priv(dev);
4567         int err = -EINPROGRESS;         /* Call commit handler */
4568         unsigned long flags;
4569
4570         if (orinoco_lock(priv, &flags) != 0)
4571                 return -EBUSY;
4572
4573         if (prq->disabled) {
4574                 priv->pm_on = 0;
4575         } else {
4576                 switch (prq->flags & IW_POWER_MODE) {
4577                 case IW_POWER_UNICAST_R:
4578                         priv->pm_mcast = 0;
4579                         priv->pm_on = 1;
4580                         break;
4581                 case IW_POWER_ALL_R:
4582                         priv->pm_mcast = 1;
4583                         priv->pm_on = 1;
4584                         break;
4585                 case IW_POWER_ON:
4586                         /* No flags : but we may have a value - Jean II */
4587                         break;
4588                 default:
4589                         err = -EINVAL;
4590                         goto out;
4591                 }
4592
4593                 if (prq->flags & IW_POWER_TIMEOUT) {
4594                         priv->pm_on = 1;
4595                         priv->pm_timeout = prq->value / 1000;
4596                 }
4597                 if (prq->flags & IW_POWER_PERIOD) {
4598                         priv->pm_on = 1;
4599                         priv->pm_period = prq->value / 1000;
4600                 }
4601                 /* It's valid to not have a value if we are just toggling
4602                  * the flags... Jean II */
4603                 if(!priv->pm_on) {
4604                         err = -EINVAL;
4605                         goto out;
4606                 }
4607         }
4608
4609  out:
4610         orinoco_unlock(priv, &flags);
4611
4612         return err;
4613 }
4614
4615 static int orinoco_ioctl_getpower(struct net_device *dev,
4616                                   struct iw_request_info *info,
4617                                   struct iw_param *prq,
4618                                   char *extra)
4619 {
4620         struct orinoco_private *priv = netdev_priv(dev);
4621         hermes_t *hw = &priv->hw;
4622         int err = 0;
4623         u16 enable, period, timeout, mcast;
4624         unsigned long flags;
4625
4626         if (orinoco_lock(priv, &flags) != 0)
4627                 return -EBUSY;
4628
4629         err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_CNFPMENABLED, &enable);
4630         if (err)
4631                 goto out;
4632
4633         err = hermes_read_wordrec(hw, USER_BAP,
4634                                   HERMES_RID_CNFMAXSLEEPDURATION, &period);
4635         if (err)
4636                 goto out;
4637
4638         err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_CNFPMHOLDOVERDURATION, &timeout);
4639         if (err)
4640                 goto out;
4641
4642         err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_CNFMULTICASTRECEIVE, &mcast);
4643         if (err)
4644                 goto out;
4645
4646         prq->disabled = !enable;
4647         /* Note : by default, display the period */
4648         if ((prq->flags & IW_POWER_TYPE) == IW_POWER_TIMEOUT) {
4649                 prq->flags = IW_POWER_TIMEOUT;
4650                 prq->value = timeout * 1000;
4651         } else {
4652                 prq->flags = IW_POWER_PERIOD;
4653                 prq->value = period * 1000;
4654         }
4655         if (mcast)
4656                 prq->flags |= IW_POWER_ALL_R;
4657         else
4658                 prq->flags |= IW_POWER_UNICAST_R;
4659
4660  out:
4661         orinoco_unlock(priv, &flags);
4662
4663         return err;
4664 }
4665
4666 static int orinoco_ioctl_set_encodeext(struct net_device *dev,
4667                                        struct iw_request_info *info,
4668                                        union iwreq_data *wrqu,
4669                                        char *extra)
4670 {
4671         struct orinoco_private *priv = netdev_priv(dev);
4672         struct iw_point *encoding = &wrqu->encoding;
4673         struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
4674         int idx, alg = ext->alg, set_key = 1;
4675         unsigned long flags;
4676         int err = -EINVAL;
4677         u16 key_len;
4678
4679         if (orinoco_lock(priv, &flags) != 0)
4680                 return -EBUSY;
4681
4682         /* Determine and validate the key index */
4683         idx = encoding->flags & IW_ENCODE_INDEX;
4684         if (idx) {
4685                 if ((idx < 1) || (idx > 4))
4686                         goto out;
4687                 idx--;
4688         } else
4689                 idx = priv->tx_key;
4690
4691         if (encoding->flags & IW_ENCODE_DISABLED)
4692             alg = IW_ENCODE_ALG_NONE;
4693
4694         if (priv->has_wpa && (alg != IW_ENCODE_ALG_TKIP)) {
4695                 /* Clear any TKIP TX key we had */
4696                 (void) orinoco_clear_tkip_key(priv, priv->tx_key);
4697         }
4698
4699         if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY) {
4700                 priv->tx_key = idx;
4701                 set_key = ((alg == IW_ENCODE_ALG_TKIP) ||
4702                            (ext->key_len > 0)) ? 1 : 0;
4703         }
4704
4705         if (set_key) {
4706                 /* Set the requested key first */
4707                 switch (alg) {
4708                 case IW_ENCODE_ALG_NONE:
4709                         priv->encode_alg = alg;
4710                         priv->keys[idx].len = 0;
4711                         break;
4712
4713                 case IW_ENCODE_ALG_WEP:
4714                         if (ext->key_len > SMALL_KEY_SIZE)
4715                                 key_len = LARGE_KEY_SIZE;
4716                         else if (ext->key_len > 0)
4717                                 key_len = SMALL_KEY_SIZE;
4718                         else
4719                                 goto out;
4720
4721                         priv->encode_alg = alg;
4722                         priv->keys[idx].len = cpu_to_le16(key_len);
4723
4724                         key_len = min(ext->key_len, key_len);
4725
4726                         memset(priv->keys[idx].data, 0, ORINOCO_MAX_KEY_SIZE);
4727                         memcpy(priv->keys[idx].data, ext->key, key_len);
4728                         break;
4729
4730                 case IW_ENCODE_ALG_TKIP:
4731                 {
4732                         hermes_t *hw = &priv->hw;
4733                         u8 *tkip_iv = NULL;
4734
4735                         if (!priv->has_wpa ||
4736                             (ext->key_len > sizeof(priv->tkip_key[0])))
4737                                 goto out;
4738
4739                         priv->encode_alg = alg;
4740                         memset(&priv->tkip_key[idx], 0,
4741                                sizeof(priv->tkip_key[idx]));
4742                         memcpy(&priv->tkip_key[idx], ext->key, ext->key_len);
4743
4744                         if (ext->ext_flags & IW_ENCODE_EXT_RX_SEQ_VALID)
4745                                 tkip_iv = &ext->rx_seq[0];
4746
4747                         err = __orinoco_hw_set_tkip_key(hw, idx,
4748                                  ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY,
4749                                  (u8 *) &priv->tkip_key[idx],
4750                                  tkip_iv, NULL);
4751                         if (err)
4752                                 printk(KERN_ERR "%s: Error %d setting TKIP key"
4753                                        "\n", dev->name, err);
4754
4755                         goto out;
4756                 }
4757                 default:
4758                         goto out;
4759                 }
4760         }
4761         err = -EINPROGRESS;
4762  out:
4763         orinoco_unlock(priv, &flags);
4764
4765         return err;
4766 }
4767
4768 static int orinoco_ioctl_get_encodeext(struct net_device *dev,
4769                                        struct iw_request_info *info,
4770                                        union iwreq_data *wrqu,
4771                                        char *extra)
4772 {
4773         struct orinoco_private *priv = netdev_priv(dev);
4774         struct iw_point *encoding = &wrqu->encoding;
4775         struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
4776         int idx, max_key_len;
4777         unsigned long flags;
4778         int err;
4779
4780         if (orinoco_lock(priv, &flags) != 0)
4781                 return -EBUSY;
4782
4783         err = -EINVAL;
4784         max_key_len = encoding->length - sizeof(*ext);
4785         if (max_key_len < 0)
4786                 goto out;
4787
4788         idx = encoding->flags & IW_ENCODE_INDEX;
4789         if (idx) {
4790                 if ((idx < 1) || (idx > 4))
4791                         goto out;
4792                 idx--;
4793         } else
4794                 idx = priv->tx_key;
4795
4796         encoding->flags = idx + 1;
4797         memset(ext, 0, sizeof(*ext));
4798
4799         ext->alg = priv->encode_alg;
4800         switch (priv->encode_alg) {
4801         case IW_ENCODE_ALG_NONE:
4802                 ext->key_len = 0;
4803                 encoding->flags |= IW_ENCODE_DISABLED;
4804                 break;
4805         case IW_ENCODE_ALG_WEP:
4806                 ext->key_len = min_t(u16, le16_to_cpu(priv->keys[idx].len),
4807                                      max_key_len);
4808                 memcpy(ext->key, priv->keys[idx].data, ext->key_len);
4809                 encoding->flags |= IW_ENCODE_ENABLED;
4810                 break;
4811         case IW_ENCODE_ALG_TKIP:
4812                 ext->key_len = min_t(u16, sizeof(struct orinoco_tkip_key),
4813                                      max_key_len);
4814                 memcpy(ext->key, &priv->tkip_key[idx], ext->key_len);
4815                 encoding->flags |= IW_ENCODE_ENABLED;
4816                 break;
4817         }
4818
4819         err = 0;
4820  out:
4821         orinoco_unlock(priv, &flags);
4822
4823         return err;
4824 }
4825
4826 static int orinoco_ioctl_set_auth(struct net_device *dev,
4827                                   struct iw_request_info *info,
4828                                   union iwreq_data *wrqu, char *extra)
4829 {
4830         struct orinoco_private *priv = netdev_priv(dev);
4831         hermes_t *hw = &priv->hw;
4832         struct iw_param *param = &wrqu->param;
4833         unsigned long flags;
4834         int ret = -EINPROGRESS;
4835
4836         if (orinoco_lock(priv, &flags) != 0)
4837                 return -EBUSY;
4838
4839         switch (param->flags & IW_AUTH_INDEX) {
4840         case IW_AUTH_WPA_VERSION:
4841         case IW_AUTH_CIPHER_PAIRWISE:
4842         case IW_AUTH_CIPHER_GROUP:
4843         case IW_AUTH_RX_UNENCRYPTED_EAPOL:
4844         case IW_AUTH_PRIVACY_INVOKED:
4845         case IW_AUTH_DROP_UNENCRYPTED:
4846                 /*
4847                  * orinoco does not use these parameters
4848                  */
4849                 break;
4850
4851         case IW_AUTH_KEY_MGMT:
4852                 /* wl_lkm implies value 2 == PSK for Hermes I
4853                  * which ties in with WEXT
4854                  * no other hints tho :(
4855                  */
4856                 priv->key_mgmt = param->value;
4857                 break;
4858
4859         case IW_AUTH_TKIP_COUNTERMEASURES:
4860                 /* When countermeasures are enabled, shut down the
4861                  * card; when disabled, re-enable the card. This must
4862                  * take effect immediately.
4863                  *
4864                  * TODO: Make sure that the EAPOL message is getting
4865                  *       out before card disabled
4866                  */
4867                 if (param->value) {
4868                         priv->tkip_cm_active = 1;
4869                         ret = hermes_enable_port(hw, 0);
4870                 } else {
4871                         priv->tkip_cm_active = 0;
4872                         ret = hermes_disable_port(hw, 0);
4873                 }
4874                 break;
4875
4876         case IW_AUTH_80211_AUTH_ALG:
4877                 if (param->value & IW_AUTH_ALG_SHARED_KEY)
4878                         priv->wep_restrict = 1;
4879                 else if (param->value & IW_AUTH_ALG_OPEN_SYSTEM)
4880                         priv->wep_restrict = 0;
4881                 else
4882                         ret = -EINVAL;
4883                 break;
4884
4885         case IW_AUTH_WPA_ENABLED:
4886                 if (priv->has_wpa) {
4887                         priv->wpa_enabled = param->value ? 1 : 0;
4888                 } else {
4889                         if (param->value)
4890                                 ret = -EOPNOTSUPP;
4891                         /* else silently accept disable of WPA */
4892                         priv->wpa_enabled = 0;
4893                 }
4894                 break;
4895
4896         default:
4897                 ret = -EOPNOTSUPP;
4898         }
4899
4900         orinoco_unlock(priv, &flags);
4901         return ret;
4902 }
4903
4904 static int orinoco_ioctl_get_auth(struct net_device *dev,
4905                                   struct iw_request_info *info,
4906                                   union iwreq_data *wrqu, char *extra)
4907 {
4908         struct orinoco_private *priv = netdev_priv(dev);
4909         struct iw_param *param = &wrqu->param;
4910         unsigned long flags;
4911         int ret = 0;
4912
4913         if (orinoco_lock(priv, &flags) != 0)
4914                 return -EBUSY;
4915
4916         switch (param->flags & IW_AUTH_INDEX) {
4917         case IW_AUTH_KEY_MGMT:
4918                 param->value = priv->key_mgmt;
4919                 break;
4920
4921         case IW_AUTH_TKIP_COUNTERMEASURES:
4922                 param->value = priv->tkip_cm_active;
4923                 break;
4924
4925         case IW_AUTH_80211_AUTH_ALG:
4926                 if (priv->wep_restrict)
4927                         param->value = IW_AUTH_ALG_SHARED_KEY;
4928                 else
4929                         param->value = IW_AUTH_ALG_OPEN_SYSTEM;
4930                 break;
4931
4932         case IW_AUTH_WPA_ENABLED:
4933                 param->value = priv->wpa_enabled;
4934                 break;
4935
4936         default:
4937                 ret = -EOPNOTSUPP;
4938         }
4939
4940         orinoco_unlock(priv, &flags);
4941         return ret;
4942 }
4943
4944 static int orinoco_ioctl_set_genie(struct net_device *dev,
4945                                    struct iw_request_info *info,
4946                                    union iwreq_data *wrqu, char *extra)
4947 {
4948         struct orinoco_private *priv = netdev_priv(dev);
4949         u8 *buf;
4950         unsigned long flags;
4951         int err = 0;
4952
4953         /* cut off at IEEE80211_MAX_DATA_LEN */
4954         if ((wrqu->data.length > IEEE80211_MAX_DATA_LEN) ||
4955             (wrqu->data.length && (extra == NULL)))
4956                 return -EINVAL;
4957
4958         if (orinoco_lock(priv, &flags) != 0)
4959                 return -EBUSY;
4960
4961         if (wrqu->data.length) {
4962                 buf = kmalloc(wrqu->data.length, GFP_KERNEL);
4963                 if (buf == NULL) {
4964                         err = -ENOMEM;
4965                         goto out;
4966                 }
4967
4968                 memcpy(buf, extra, wrqu->data.length);
4969                 kfree(priv->wpa_ie);
4970                 priv->wpa_ie = buf;
4971                 priv->wpa_ie_len = wrqu->data.length;
4972         } else {
4973                 kfree(priv->wpa_ie);
4974                 priv->wpa_ie = NULL;
4975                 priv->wpa_ie_len = 0;
4976         }
4977
4978         if (priv->wpa_ie) {
4979                 /* Looks like wl_lkm wants to check the auth alg, and
4980                  * somehow pass it to the firmware.
4981                  * Instead it just calls the key mgmt rid
4982                  *   - we do this in set auth.
4983                  */
4984         }
4985
4986 out:
4987         orinoco_unlock(priv, &flags);
4988         return err;
4989 }
4990
4991 static int orinoco_ioctl_get_genie(struct net_device *dev,
4992                                    struct iw_request_info *info,
4993                                    union iwreq_data *wrqu, char *extra)
4994 {
4995         struct orinoco_private *priv = netdev_priv(dev);
4996         unsigned long flags;
4997         int err = 0;
4998
4999         if (orinoco_lock(priv, &flags) != 0)
5000                 return -EBUSY;
5001
5002         if ((priv->wpa_ie_len == 0) || (priv->wpa_ie == NULL)) {
5003                 wrqu->data.length = 0;
5004                 goto out;
5005         }
5006
5007         if (wrqu->data.length < priv->wpa_ie_len) {
5008                 err = -E2BIG;
5009                 goto out;
5010         }
5011
5012         wrqu->data.length = priv->wpa_ie_len;
5013         memcpy(extra, priv->wpa_ie, priv->wpa_ie_len);
5014
5015 out:
5016         orinoco_unlock(priv, &flags);
5017         return err;
5018 }
5019
5020 static int orinoco_ioctl_set_mlme(struct net_device *dev,
5021                                   struct iw_request_info *info,
5022                                   union iwreq_data *wrqu, char *extra)
5023 {
5024         struct orinoco_private *priv = netdev_priv(dev);
5025         hermes_t *hw = &priv->hw;
5026         struct iw_mlme *mlme = (struct iw_mlme *)extra;
5027         unsigned long flags;
5028         int ret = 0;
5029
5030         if (orinoco_lock(priv, &flags) != 0)
5031                 return -EBUSY;
5032
5033         switch (mlme->cmd) {
5034         case IW_MLME_DEAUTH:
5035                 /* silently ignore */
5036                 break;
5037
5038         case IW_MLME_DISASSOC:
5039         {
5040                 struct {
5041                         u8 addr[ETH_ALEN];
5042                         __le16 reason_code;
5043                 } __attribute__ ((packed)) buf;
5044
5045                 memcpy(buf.addr, mlme->addr.sa_data, ETH_ALEN);
5046                 buf.reason_code = cpu_to_le16(mlme->reason_code);
5047                 ret = HERMES_WRITE_RECORD(hw, USER_BAP,
5048                                           HERMES_RID_CNFDISASSOCIATE,
5049                                           &buf);
5050                 break;
5051         }
5052         default:
5053                 ret = -EOPNOTSUPP;
5054         }
5055
5056         orinoco_unlock(priv, &flags);
5057         return ret;
5058 }
5059
5060 static int orinoco_ioctl_getretry(struct net_device *dev,
5061                                   struct iw_request_info *info,
5062                                   struct iw_param *rrq,
5063                                   char *extra)
5064 {
5065         struct orinoco_private *priv = netdev_priv(dev);
5066         hermes_t *hw = &priv->hw;
5067         int err = 0;
5068         u16 short_limit, long_limit, lifetime;
5069         unsigned long flags;
5070
5071         if (orinoco_lock(priv, &flags) != 0)
5072                 return -EBUSY;
5073
5074         err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_SHORTRETRYLIMIT,
5075                                   &short_limit);
5076         if (err)
5077                 goto out;
5078
5079         err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_LONGRETRYLIMIT,
5080                                   &long_limit);
5081         if (err)
5082                 goto out;
5083
5084         err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_MAXTRANSMITLIFETIME,
5085                                   &lifetime);
5086         if (err)
5087                 goto out;
5088
5089         rrq->disabled = 0;              /* Can't be disabled */
5090
5091         /* Note : by default, display the retry number */
5092         if ((rrq->flags & IW_RETRY_TYPE) == IW_RETRY_LIFETIME) {
5093                 rrq->flags = IW_RETRY_LIFETIME;
5094                 rrq->value = lifetime * 1000;   /* ??? */
5095         } else {
5096                 /* By default, display the min number */
5097                 if ((rrq->flags & IW_RETRY_LONG)) {
5098                         rrq->flags = IW_RETRY_LIMIT | IW_RETRY_LONG;
5099                         rrq->value = long_limit;
5100                 } else {
5101                         rrq->flags = IW_RETRY_LIMIT;
5102                         rrq->value = short_limit;
5103                         if(short_limit != long_limit)
5104                                 rrq->flags |= IW_RETRY_SHORT;
5105                 }
5106         }
5107
5108  out:
5109         orinoco_unlock(priv, &flags);
5110
5111         return err;
5112 }
5113
5114 static int orinoco_ioctl_reset(struct net_device *dev,
5115                                struct iw_request_info *info,
5116                                void *wrqu,
5117                                char *extra)
5118 {
5119         struct orinoco_private *priv = netdev_priv(dev);
5120
5121         if (! capable(CAP_NET_ADMIN))
5122                 return -EPERM;
5123
5124         if (info->cmd == (SIOCIWFIRSTPRIV + 0x1)) {
5125                 printk(KERN_DEBUG "%s: Forcing reset!\n", dev->name);
5126
5127                 /* Firmware reset */
5128                 orinoco_reset(&priv->reset_work);
5129         } else {
5130                 printk(KERN_DEBUG "%s: Force scheduling reset!\n", dev->name);
5131
5132                 schedule_work(&priv->reset_work);
5133         }
5134
5135         return 0;
5136 }
5137
5138 static int orinoco_ioctl_setibssport(struct net_device *dev,
5139                                      struct iw_request_info *info,
5140                                      void *wrqu,
5141                                      char *extra)
5142
5143 {
5144         struct orinoco_private *priv = netdev_priv(dev);
5145         int val = *( (int *) extra );
5146         unsigned long flags;
5147
5148         if (orinoco_lock(priv, &flags) != 0)
5149                 return -EBUSY;
5150
5151         priv->ibss_port = val ;
5152
5153         /* Actually update the mode we are using */
5154         set_port_type(priv);
5155
5156         orinoco_unlock(priv, &flags);
5157         return -EINPROGRESS;            /* Call commit handler */
5158 }
5159
5160 static int orinoco_ioctl_getibssport(struct net_device *dev,
5161                                      struct iw_request_info *info,
5162                                      void *wrqu,
5163                                      char *extra)
5164 {
5165         struct orinoco_private *priv = netdev_priv(dev);
5166         int *val = (int *) extra;
5167
5168         *val = priv->ibss_port;
5169         return 0;
5170 }
5171
5172 static int orinoco_ioctl_setport3(struct net_device *dev,
5173                                   struct iw_request_info *info,
5174                                   void *wrqu,
5175                                   char *extra)
5176 {
5177         struct orinoco_private *priv = netdev_priv(dev);
5178         int val = *( (int *) extra );
5179         int err = 0;
5180         unsigned long flags;
5181
5182         if (orinoco_lock(priv, &flags) != 0)
5183                 return -EBUSY;
5184
5185         switch (val) {
5186         case 0: /* Try to do IEEE ad-hoc mode */
5187                 if (! priv->has_ibss) {
5188                         err = -EINVAL;
5189                         break;
5190                 }
5191                 priv->prefer_port3 = 0;
5192
5193                 break;
5194
5195         case 1: /* Try to do Lucent proprietary ad-hoc mode */
5196                 if (! priv->has_port3) {
5197                         err = -EINVAL;
5198                         break;
5199                 }
5200                 priv->prefer_port3 = 1;
5201                 break;
5202
5203         default:
5204                 err = -EINVAL;
5205         }
5206
5207         if (! err) {
5208                 /* Actually update the mode we are using */
5209                 set_port_type(priv);
5210                 err = -EINPROGRESS;
5211         }
5212
5213         orinoco_unlock(priv, &flags);
5214
5215         return err;
5216 }
5217
5218 static int orinoco_ioctl_getport3(struct net_device *dev,
5219                                   struct iw_request_info *info,
5220                                   void *wrqu,
5221                                   char *extra)
5222 {
5223         struct orinoco_private *priv = netdev_priv(dev);
5224         int *val = (int *) extra;
5225
5226         *val = priv->prefer_port3;
5227         return 0;
5228 }
5229
5230 static int orinoco_ioctl_setpreamble(struct net_device *dev,
5231                                      struct iw_request_info *info,
5232                                      void *wrqu,
5233                                      char *extra)
5234 {
5235         struct orinoco_private *priv = netdev_priv(dev);
5236         unsigned long flags;
5237         int val;
5238
5239         if (! priv->has_preamble)
5240                 return -EOPNOTSUPP;
5241
5242         /* 802.11b has recently defined some short preamble.
5243          * Basically, the Phy header has been reduced in size.
5244          * This increase performance, especially at high rates
5245          * (the preamble is transmitted at 1Mb/s), unfortunately
5246          * this give compatibility troubles... - Jean II */
5247         val = *( (int *) extra );
5248
5249         if (orinoco_lock(priv, &flags) != 0)
5250                 return -EBUSY;
5251
5252         if (val)
5253                 priv->preamble = 1;
5254         else
5255                 priv->preamble = 0;
5256
5257         orinoco_unlock(priv, &flags);
5258
5259         return -EINPROGRESS;            /* Call commit handler */
5260 }
5261
5262 static int orinoco_ioctl_getpreamble(struct net_device *dev,
5263                                      struct iw_request_info *info,
5264                                      void *wrqu,
5265                                      char *extra)
5266 {
5267         struct orinoco_private *priv = netdev_priv(dev);
5268         int *val = (int *) extra;
5269
5270         if (! priv->has_preamble)
5271                 return -EOPNOTSUPP;
5272
5273         *val = priv->preamble;
5274         return 0;
5275 }
5276
5277 /* ioctl interface to hermes_read_ltv()
5278  * To use with iwpriv, pass the RID as the token argument, e.g.
5279  * iwpriv get_rid [0xfc00]
5280  * At least Wireless Tools 25 is required to use iwpriv.
5281  * For Wireless Tools 25 and 26 append "dummy" are the end. */
5282 static int orinoco_ioctl_getrid(struct net_device *dev,
5283                                 struct iw_request_info *info,
5284                                 struct iw_point *data,
5285                                 char *extra)
5286 {
5287         struct orinoco_private *priv = netdev_priv(dev);
5288         hermes_t *hw = &priv->hw;
5289         int rid = data->flags;
5290         u16 length;
5291         int err;
5292         unsigned long flags;
5293
5294         /* It's a "get" function, but we don't want users to access the
5295          * WEP key and other raw firmware data */
5296         if (! capable(CAP_NET_ADMIN))
5297                 return -EPERM;
5298
5299         if (rid < 0xfc00 || rid > 0xffff)
5300                 return -EINVAL;
5301
5302         if (orinoco_lock(priv, &flags) != 0)
5303                 return -EBUSY;
5304
5305         err = hermes_read_ltv(hw, USER_BAP, rid, MAX_RID_LEN, &length,
5306                               extra);
5307         if (err)
5308                 goto out;
5309
5310         data->length = min_t(u16, HERMES_RECLEN_TO_BYTES(length),
5311                              MAX_RID_LEN);
5312
5313  out:
5314         orinoco_unlock(priv, &flags);
5315         return err;
5316 }
5317
5318 /* Trigger a scan (look for other cells in the vicinity) */
5319 static int orinoco_ioctl_setscan(struct net_device *dev,
5320                                  struct iw_request_info *info,
5321                                  struct iw_point *srq,
5322                                  char *extra)
5323 {
5324         struct orinoco_private *priv = netdev_priv(dev);
5325         hermes_t *hw = &priv->hw;
5326         struct iw_scan_req *si = (struct iw_scan_req *) extra;
5327         int err = 0;
5328         unsigned long flags;
5329
5330         /* Note : you may have realised that, as this is a SET operation,
5331          * this is privileged and therefore a normal user can't
5332          * perform scanning.
5333          * This is not an error, while the device perform scanning,
5334          * traffic doesn't flow, so it's a perfect DoS...
5335          * Jean II */
5336
5337         if (orinoco_lock(priv, &flags) != 0)
5338                 return -EBUSY;
5339
5340         /* Scanning with port 0 disabled would fail */
5341         if (!netif_running(dev)) {
5342                 err = -ENETDOWN;
5343                 goto out;
5344         }
5345
5346         /* In monitor mode, the scan results are always empty.
5347          * Probe responses are passed to the driver as received
5348          * frames and could be processed in software. */
5349         if (priv->iw_mode == IW_MODE_MONITOR) {
5350                 err = -EOPNOTSUPP;
5351                 goto out;
5352         }
5353
5354         /* Note : because we don't lock out the irq handler, the way
5355          * we access scan variables in priv is critical.
5356          *      o scan_inprogress : not touched by irq handler
5357          *      o scan_mode : not touched by irq handler
5358          * Before modifying anything on those variables, please think hard !
5359          * Jean II */
5360
5361         /* Save flags */
5362         priv->scan_mode = srq->flags;
5363
5364         /* Always trigger scanning, even if it's in progress.
5365          * This way, if the info frame get lost, we will recover somewhat
5366          * gracefully  - Jean II */
5367
5368         if (priv->has_hostscan) {
5369                 switch (priv->firmware_type) {
5370                 case FIRMWARE_TYPE_SYMBOL:
5371                         err = hermes_write_wordrec(hw, USER_BAP,
5372                                                    HERMES_RID_CNFHOSTSCAN_SYMBOL,
5373                                                    HERMES_HOSTSCAN_SYMBOL_ONCE |
5374                                                    HERMES_HOSTSCAN_SYMBOL_BCAST);
5375                         break;
5376                 case FIRMWARE_TYPE_INTERSIL: {
5377                         __le16 req[3];
5378
5379                         req[0] = cpu_to_le16(0x3fff);   /* All channels */
5380                         req[1] = cpu_to_le16(0x0001);   /* rate 1 Mbps */
5381                         req[2] = 0;                     /* Any ESSID */
5382                         err = HERMES_WRITE_RECORD(hw, USER_BAP,
5383                                                   HERMES_RID_CNFHOSTSCAN, &req);
5384                 }
5385                 break;
5386                 case FIRMWARE_TYPE_AGERE:
5387                         if (priv->scan_mode & IW_SCAN_THIS_ESSID) {
5388                                 struct hermes_idstring idbuf;
5389                                 size_t len = min(sizeof(idbuf.val),
5390                                                  (size_t) si->essid_len);
5391                                 idbuf.len = cpu_to_le16(len);
5392                                 memcpy(idbuf.val, si->essid, len);
5393
5394                                 err = hermes_write_ltv(hw, USER_BAP,
5395                                                HERMES_RID_CNFSCANSSID_AGERE,
5396                                                HERMES_BYTES_TO_RECLEN(len + 2),
5397                                                &idbuf);
5398                         } else
5399                                 err = hermes_write_wordrec(hw, USER_BAP,
5400                                                    HERMES_RID_CNFSCANSSID_AGERE,
5401                                                    0);  /* Any ESSID */
5402                         if (err)
5403                                 break;
5404
5405                         if (priv->has_ext_scan) {
5406                                 /* Clear scan results at the start of
5407                                  * an extended scan */
5408                                 orinoco_clear_scan_results(priv,
5409                                                 msecs_to_jiffies(15000));
5410
5411                                 /* TODO: Is this available on older firmware?
5412                                  *   Can we use it to scan specific channels
5413                                  *   for IW_SCAN_THIS_FREQ? */
5414                                 err = hermes_write_wordrec(hw, USER_BAP,
5415                                                 HERMES_RID_CNFSCANCHANNELS2GHZ,
5416                                                 0x7FFF);
5417                                 if (err)
5418                                         goto out;
5419
5420                                 err = hermes_inquire(hw,
5421                                                      HERMES_INQ_CHANNELINFO);
5422                         } else
5423                                 err = hermes_inquire(hw, HERMES_INQ_SCAN);
5424                         break;
5425                 }
5426         } else
5427                 err = hermes_inquire(hw, HERMES_INQ_SCAN);
5428
5429         /* One more client */
5430         if (! err)
5431                 priv->scan_inprogress = 1;
5432
5433  out:
5434         orinoco_unlock(priv, &flags);
5435         return err;
5436 }
5437
5438 #define MAX_CUSTOM_LEN 64
5439
5440 /* Translate scan data returned from the card to a card independant
5441  * format that the Wireless Tools will understand - Jean II */
5442 static inline char *orinoco_translate_scan(struct net_device *dev,
5443                                            struct iw_request_info *info,
5444                                            char *current_ev,
5445                                            char *end_buf,
5446                                            union hermes_scan_info *bss,
5447                                            unsigned long last_scanned)
5448 {
5449         struct orinoco_private *priv = netdev_priv(dev);
5450         u16                     capabilities;
5451         u16                     channel;
5452         struct iw_event         iwe;            /* Temporary buffer */
5453         char custom[MAX_CUSTOM_LEN];
5454
5455         memset(&iwe, 0, sizeof(iwe));
5456
5457         /* First entry *MUST* be the AP MAC address */
5458         iwe.cmd = SIOCGIWAP;
5459         iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
5460         memcpy(iwe.u.ap_addr.sa_data, bss->a.bssid, ETH_ALEN);
5461         current_ev = iwe_stream_add_event(info, current_ev, end_buf,
5462                                           &iwe, IW_EV_ADDR_LEN);
5463
5464         /* Other entries will be displayed in the order we give them */
5465
5466         /* Add the ESSID */
5467         iwe.u.data.length = le16_to_cpu(bss->a.essid_len);
5468         if (iwe.u.data.length > 32)
5469                 iwe.u.data.length = 32;
5470         iwe.cmd = SIOCGIWESSID;
5471         iwe.u.data.flags = 1;
5472         current_ev = iwe_stream_add_point(info, current_ev, end_buf,
5473                                           &iwe, bss->a.essid);
5474
5475         /* Add mode */
5476         iwe.cmd = SIOCGIWMODE;
5477         capabilities = le16_to_cpu(bss->a.capabilities);
5478         if (capabilities & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS)) {
5479                 if (capabilities & WLAN_CAPABILITY_ESS)
5480                         iwe.u.mode = IW_MODE_MASTER;
5481                 else
5482                         iwe.u.mode = IW_MODE_ADHOC;
5483                 current_ev = iwe_stream_add_event(info, current_ev, end_buf,
5484                                                   &iwe, IW_EV_UINT_LEN);
5485         }
5486
5487         channel = bss->s.channel;
5488         if ((channel >= 1) && (channel <= NUM_CHANNELS)) {
5489                 /* Add channel and frequency */
5490                 iwe.cmd = SIOCGIWFREQ;
5491                 iwe.u.freq.m = channel;
5492                 iwe.u.freq.e = 0;
5493                 current_ev = iwe_stream_add_event(info, current_ev, end_buf,
5494                                                   &iwe, IW_EV_FREQ_LEN);
5495
5496                 iwe.u.freq.m = channel_frequency[channel-1] * 100000;
5497                 iwe.u.freq.e = 1;
5498                 current_ev = iwe_stream_add_event(info, current_ev, end_buf,
5499                                                   &iwe, IW_EV_FREQ_LEN);
5500         }
5501
5502         /* Add quality statistics. level and noise in dB. No link quality */
5503         iwe.cmd = IWEVQUAL;
5504         iwe.u.qual.updated = IW_QUAL_DBM | IW_QUAL_QUAL_INVALID;
5505         iwe.u.qual.level = (__u8) le16_to_cpu(bss->a.level) - 0x95;
5506         iwe.u.qual.noise = (__u8) le16_to_cpu(bss->a.noise) - 0x95;
5507         /* Wireless tools prior to 27.pre22 will show link quality
5508          * anyway, so we provide a reasonable value. */
5509         if (iwe.u.qual.level > iwe.u.qual.noise)
5510                 iwe.u.qual.qual = iwe.u.qual.level - iwe.u.qual.noise;
5511         else
5512                 iwe.u.qual.qual = 0;
5513         current_ev = iwe_stream_add_event(info, current_ev, end_buf,
5514                                           &iwe, IW_EV_QUAL_LEN);
5515
5516         /* Add encryption capability */
5517         iwe.cmd = SIOCGIWENCODE;
5518         if (capabilities & WLAN_CAPABILITY_PRIVACY)
5519                 iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
5520         else
5521                 iwe.u.data.flags = IW_ENCODE_DISABLED;
5522         iwe.u.data.length = 0;
5523         current_ev = iwe_stream_add_point(info, current_ev, end_buf,
5524                                           &iwe, NULL);
5525
5526         /* Bit rate is not available in Lucent/Agere firmwares */
5527         if (priv->firmware_type != FIRMWARE_TYPE_AGERE) {
5528                 char *current_val = current_ev + iwe_stream_lcp_len(info);
5529                 int i;
5530                 int step;
5531
5532                 if (priv->firmware_type == FIRMWARE_TYPE_SYMBOL)
5533                         step = 2;
5534                 else
5535                         step = 1;
5536
5537                 iwe.cmd = SIOCGIWRATE;
5538                 /* Those two flags are ignored... */
5539                 iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
5540                 /* Max 10 values */
5541                 for (i = 0; i < 10; i += step) {
5542                         /* NULL terminated */
5543                         if (bss->p.rates[i] == 0x0)
5544                                 break;
5545                         /* Bit rate given in 500 kb/s units (+ 0x80) */
5546                         iwe.u.bitrate.value =
5547                                 ((bss->p.rates[i] & 0x7f) * 500000);
5548                         current_val = iwe_stream_add_value(info, current_ev,
5549                                                            current_val,
5550                                                            end_buf, &iwe,
5551                                                            IW_EV_PARAM_LEN);
5552                 }
5553                 /* Check if we added any event */
5554                 if ((current_val - current_ev) > iwe_stream_lcp_len(info))
5555                         current_ev = current_val;
5556         }
5557
5558         /* Beacon interval */
5559         iwe.cmd = IWEVCUSTOM;
5560         iwe.u.data.length = snprintf(custom, MAX_CUSTOM_LEN,
5561                                      "bcn_int=%d",
5562                                      le16_to_cpu(bss->a.beacon_interv));
5563         if (iwe.u.data.length)
5564                 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
5565                                                   &iwe, custom);
5566
5567         /* Capabilites */
5568         iwe.cmd = IWEVCUSTOM;
5569         iwe.u.data.length = snprintf(custom, MAX_CUSTOM_LEN,
5570                                      "capab=0x%04x",
5571                                      capabilities);
5572         if (iwe.u.data.length)
5573                 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
5574                                                   &iwe, custom);
5575
5576         /* Add EXTRA: Age to display seconds since last beacon/probe response
5577          * for given network. */
5578         iwe.cmd = IWEVCUSTOM;
5579         iwe.u.data.length = snprintf(custom, MAX_CUSTOM_LEN,
5580                                      " Last beacon: %dms ago",
5581                                      jiffies_to_msecs(jiffies - last_scanned));
5582         if (iwe.u.data.length)
5583                 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
5584                                                   &iwe, custom);
5585
5586         return current_ev;
5587 }
5588
5589 static inline char *orinoco_translate_ext_scan(struct net_device *dev,
5590                                                struct iw_request_info *info,
5591                                                char *current_ev,
5592                                                char *end_buf,
5593                                                struct agere_ext_scan_info *bss,
5594                                                unsigned long last_scanned)
5595 {
5596         u16                     capabilities;
5597         u16                     channel;
5598         struct iw_event         iwe;            /* Temporary buffer */
5599         char custom[MAX_CUSTOM_LEN];
5600         u8 *ie;
5601
5602         memset(&iwe, 0, sizeof(iwe));
5603
5604         /* First entry *MUST* be the AP MAC address */
5605         iwe.cmd = SIOCGIWAP;
5606         iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
5607         memcpy(iwe.u.ap_addr.sa_data, bss->bssid, ETH_ALEN);
5608         current_ev = iwe_stream_add_event(info, current_ev, end_buf,
5609                                           &iwe, IW_EV_ADDR_LEN);
5610
5611         /* Other entries will be displayed in the order we give them */
5612
5613         /* Add the ESSID */
5614         ie = bss->data;
5615         iwe.u.data.length = ie[1];
5616         if (iwe.u.data.length) {
5617                 if (iwe.u.data.length > 32)
5618                         iwe.u.data.length = 32;
5619                 iwe.cmd = SIOCGIWESSID;
5620                 iwe.u.data.flags = 1;
5621                 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
5622                                                   &iwe, &ie[2]);
5623         }
5624
5625         /* Add mode */
5626         capabilities = le16_to_cpu(bss->capabilities);
5627         if (capabilities & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS)) {
5628                 iwe.cmd = SIOCGIWMODE;
5629                 if (capabilities & WLAN_CAPABILITY_ESS)
5630                         iwe.u.mode = IW_MODE_MASTER;
5631                 else
5632                         iwe.u.mode = IW_MODE_ADHOC;
5633                 current_ev = iwe_stream_add_event(info, current_ev, end_buf,
5634                                                   &iwe, IW_EV_UINT_LEN);
5635         }
5636
5637         ie = orinoco_get_ie(bss->data, sizeof(bss->data), WLAN_EID_DS_PARAMS);
5638         channel = ie ? ie[2] : 0;
5639         if ((channel >= 1) && (channel <= NUM_CHANNELS)) {
5640                 /* Add channel and frequency */
5641                 iwe.cmd = SIOCGIWFREQ;
5642                 iwe.u.freq.m = channel;
5643                 iwe.u.freq.e = 0;
5644                 current_ev = iwe_stream_add_event(info, current_ev, end_buf,
5645                                                   &iwe, IW_EV_FREQ_LEN);
5646
5647                 iwe.u.freq.m = channel_frequency[channel-1] * 100000;
5648                 iwe.u.freq.e = 1;
5649                 current_ev = iwe_stream_add_event(info, current_ev, end_buf,
5650                                                   &iwe, IW_EV_FREQ_LEN);
5651         }
5652
5653         /* Add quality statistics. level and noise in dB. No link quality */
5654         iwe.cmd = IWEVQUAL;
5655         iwe.u.qual.updated = IW_QUAL_DBM | IW_QUAL_QUAL_INVALID;
5656         iwe.u.qual.level = bss->level - 0x95;
5657         iwe.u.qual.noise = bss->noise - 0x95;
5658         /* Wireless tools prior to 27.pre22 will show link quality
5659          * anyway, so we provide a reasonable value. */
5660         if (iwe.u.qual.level > iwe.u.qual.noise)
5661                 iwe.u.qual.qual = iwe.u.qual.level - iwe.u.qual.noise;
5662         else
5663                 iwe.u.qual.qual = 0;
5664         current_ev = iwe_stream_add_event(info, current_ev, end_buf,
5665                                           &iwe, IW_EV_QUAL_LEN);
5666
5667         /* Add encryption capability */
5668         iwe.cmd = SIOCGIWENCODE;
5669         if (capabilities & WLAN_CAPABILITY_PRIVACY)
5670                 iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
5671         else
5672                 iwe.u.data.flags = IW_ENCODE_DISABLED;
5673         iwe.u.data.length = 0;
5674         current_ev = iwe_stream_add_point(info, current_ev, end_buf,
5675                                           &iwe, NULL);
5676
5677         /* WPA IE */
5678         ie = orinoco_get_wpa_ie(bss->data, sizeof(bss->data));
5679         if (ie) {
5680                 iwe.cmd = IWEVGENIE;
5681                 iwe.u.data.length = ie[1] + 2;
5682                 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
5683                                                   &iwe, ie);
5684         }
5685
5686         /* RSN IE */
5687         ie = orinoco_get_ie(bss->data, sizeof(bss->data), WLAN_EID_RSN);
5688         if (ie) {
5689                 iwe.cmd = IWEVGENIE;
5690                 iwe.u.data.length = ie[1] + 2;
5691                 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
5692                                                   &iwe, ie);
5693         }
5694
5695         ie = orinoco_get_ie(bss->data, sizeof(bss->data), WLAN_EID_SUPP_RATES);
5696         if (ie) {
5697                 char *p = current_ev + iwe_stream_lcp_len(info);
5698                 int i;
5699
5700                 iwe.cmd = SIOCGIWRATE;
5701                 /* Those two flags are ignored... */
5702                 iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
5703
5704                 for (i = 2; i < (ie[1] + 2); i++) {
5705                         iwe.u.bitrate.value = ((ie[i] & 0x7F) * 500000);
5706                         p = iwe_stream_add_value(info, current_ev, p, end_buf,
5707                                                  &iwe, IW_EV_PARAM_LEN);
5708                 }
5709                 /* Check if we added any event */
5710                 if (p > (current_ev + iwe_stream_lcp_len(info)))
5711                         current_ev = p;
5712         }
5713
5714         /* Timestamp */
5715         iwe.cmd = IWEVCUSTOM;
5716         iwe.u.data.length =
5717                 snprintf(custom, MAX_CUSTOM_LEN, "tsf=%016llx",
5718                          (unsigned long long) le64_to_cpu(bss->timestamp));
5719         if (iwe.u.data.length)
5720                 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
5721                                                   &iwe, custom);
5722
5723         /* Beacon interval */
5724         iwe.cmd = IWEVCUSTOM;
5725         iwe.u.data.length = snprintf(custom, MAX_CUSTOM_LEN,
5726                                      "bcn_int=%d",
5727                                      le16_to_cpu(bss->beacon_interval));
5728         if (iwe.u.data.length)
5729                 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
5730                                                   &iwe, custom);
5731
5732         /* Capabilites */
5733         iwe.cmd = IWEVCUSTOM;
5734         iwe.u.data.length = snprintf(custom, MAX_CUSTOM_LEN,
5735                                      "capab=0x%04x",
5736                                      capabilities);
5737         if (iwe.u.data.length)
5738                 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
5739                                                   &iwe, custom);
5740
5741         /* Add EXTRA: Age to display seconds since last beacon/probe response
5742          * for given network. */
5743         iwe.cmd = IWEVCUSTOM;
5744         iwe.u.data.length = snprintf(custom, MAX_CUSTOM_LEN,
5745                                      " Last beacon: %dms ago",
5746                                      jiffies_to_msecs(jiffies - last_scanned));
5747         if (iwe.u.data.length)
5748                 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
5749                                                   &iwe, custom);
5750
5751         return current_ev;
5752 }
5753
5754 /* Return results of a scan */
5755 static int orinoco_ioctl_getscan(struct net_device *dev,
5756                                  struct iw_request_info *info,
5757                                  struct iw_point *srq,
5758                                  char *extra)
5759 {
5760         struct orinoco_private *priv = netdev_priv(dev);
5761         int err = 0;
5762         unsigned long flags;
5763         char *current_ev = extra;
5764
5765         if (orinoco_lock(priv, &flags) != 0)
5766                 return -EBUSY;
5767
5768         if (priv->scan_inprogress) {
5769                 /* Important note : we don't want to block the caller
5770                  * until results are ready for various reasons.
5771                  * First, managing wait queues is complex and racy.
5772                  * Second, we grab some rtnetlink lock before comming
5773                  * here (in dev_ioctl()).
5774                  * Third, we generate an Wireless Event, so the
5775                  * caller can wait itself on that - Jean II */
5776                 err = -EAGAIN;
5777                 goto out;
5778         }
5779
5780         if (priv->has_ext_scan) {
5781                 struct xbss_element *bss;
5782
5783                 list_for_each_entry(bss, &priv->bss_list, list) {
5784                         /* Translate this entry to WE format */
5785                         current_ev =
5786                                 orinoco_translate_ext_scan(dev, info,
5787                                                            current_ev,
5788                                                            extra + srq->length,
5789                                                            &bss->bss,
5790                                                            bss->last_scanned);
5791
5792                         /* Check if there is space for one more entry */
5793                         if ((extra + srq->length - current_ev)
5794                             <= IW_EV_ADDR_LEN) {
5795                                 /* Ask user space to try again with a
5796                                  * bigger buffer */
5797                                 err = -E2BIG;
5798                                 goto out;
5799                         }
5800                 }
5801
5802         } else {
5803                 struct bss_element *bss;
5804
5805                 list_for_each_entry(bss, &priv->bss_list, list) {
5806                         /* Translate this entry to WE format */
5807                         current_ev = orinoco_translate_scan(dev, info,
5808                                                             current_ev,
5809                                                             extra + srq->length,
5810                                                             &bss->bss,
5811                                                             bss->last_scanned);
5812
5813                         /* Check if there is space for one more entry */
5814                         if ((extra + srq->length - current_ev)
5815                             <= IW_EV_ADDR_LEN) {
5816                                 /* Ask user space to try again with a
5817                                  * bigger buffer */
5818                                 err = -E2BIG;
5819                                 goto out;
5820                         }
5821                 }
5822         }
5823
5824         srq->length = (current_ev - extra);
5825         srq->flags = (__u16) priv->scan_mode;
5826
5827 out:
5828         orinoco_unlock(priv, &flags);
5829         return err;
5830 }
5831
5832 /* Commit handler, called after set operations */
5833 static int orinoco_ioctl_commit(struct net_device *dev,
5834                                 struct iw_request_info *info,
5835                                 void *wrqu,
5836                                 char *extra)
5837 {
5838         struct orinoco_private *priv = netdev_priv(dev);
5839         struct hermes *hw = &priv->hw;
5840         unsigned long flags;
5841         int err = 0;
5842
5843         if (!priv->open)
5844                 return 0;
5845
5846         if (priv->broken_disableport) {
5847                 orinoco_reset(&priv->reset_work);
5848                 return 0;
5849         }
5850
5851         if (orinoco_lock(priv, &flags) != 0)
5852                 return err;
5853
5854         err = hermes_disable_port(hw, 0);
5855         if (err) {
5856                 printk(KERN_WARNING "%s: Unable to disable port "
5857                        "while reconfiguring card\n", dev->name);
5858                 priv->broken_disableport = 1;
5859                 goto out;
5860         }
5861
5862         err = __orinoco_program_rids(dev);
5863         if (err) {
5864                 printk(KERN_WARNING "%s: Unable to reconfigure card\n",
5865                        dev->name);
5866                 goto out;
5867         }
5868
5869         err = hermes_enable_port(hw, 0);
5870         if (err) {
5871                 printk(KERN_WARNING "%s: Unable to enable port while reconfiguring card\n",
5872                        dev->name);
5873                 goto out;
5874         }
5875
5876  out:
5877         if (err) {
5878                 printk(KERN_WARNING "%s: Resetting instead...\n", dev->name);
5879                 schedule_work(&priv->reset_work);
5880                 err = 0;
5881         }
5882
5883         orinoco_unlock(priv, &flags);
5884         return err;
5885 }
5886
5887 static const struct iw_priv_args orinoco_privtab[] = {
5888         { SIOCIWFIRSTPRIV + 0x0, 0, 0, "force_reset" },
5889         { SIOCIWFIRSTPRIV + 0x1, 0, 0, "card_reset" },
5890         { SIOCIWFIRSTPRIV + 0x2, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
5891           0, "set_port3" },
5892         { SIOCIWFIRSTPRIV + 0x3, 0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
5893           "get_port3" },
5894         { SIOCIWFIRSTPRIV + 0x4, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
5895           0, "set_preamble" },
5896         { SIOCIWFIRSTPRIV + 0x5, 0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
5897           "get_preamble" },
5898         { SIOCIWFIRSTPRIV + 0x6, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
5899           0, "set_ibssport" },
5900         { SIOCIWFIRSTPRIV + 0x7, 0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
5901           "get_ibssport" },
5902         { SIOCIWFIRSTPRIV + 0x9, 0, IW_PRIV_TYPE_BYTE | MAX_RID_LEN,
5903           "get_rid" },
5904 };
5905
5906
5907 /*
5908  * Structures to export the Wireless Handlers
5909  */
5910
5911 #define STD_IW_HANDLER(id, func) \
5912         [IW_IOCTL_IDX(id)] = (iw_handler) func
5913 static const iw_handler orinoco_handler[] = {
5914         STD_IW_HANDLER(SIOCSIWCOMMIT,   orinoco_ioctl_commit),
5915         STD_IW_HANDLER(SIOCGIWNAME,     orinoco_ioctl_getname),
5916         STD_IW_HANDLER(SIOCSIWFREQ,     orinoco_ioctl_setfreq),
5917         STD_IW_HANDLER(SIOCGIWFREQ,     orinoco_ioctl_getfreq),
5918         STD_IW_HANDLER(SIOCSIWMODE,     orinoco_ioctl_setmode),
5919         STD_IW_HANDLER(SIOCGIWMODE,     orinoco_ioctl_getmode),
5920         STD_IW_HANDLER(SIOCSIWSENS,     orinoco_ioctl_setsens),
5921         STD_IW_HANDLER(SIOCGIWSENS,     orinoco_ioctl_getsens),
5922         STD_IW_HANDLER(SIOCGIWRANGE,    orinoco_ioctl_getiwrange),
5923         STD_IW_HANDLER(SIOCSIWSPY,      iw_handler_set_spy),
5924         STD_IW_HANDLER(SIOCGIWSPY,      iw_handler_get_spy),
5925         STD_IW_HANDLER(SIOCSIWTHRSPY,   iw_handler_set_thrspy),
5926         STD_IW_HANDLER(SIOCGIWTHRSPY,   iw_handler_get_thrspy),
5927         STD_IW_HANDLER(SIOCSIWAP,       orinoco_ioctl_setwap),
5928         STD_IW_HANDLER(SIOCGIWAP,       orinoco_ioctl_getwap),
5929         STD_IW_HANDLER(SIOCSIWSCAN,     orinoco_ioctl_setscan),
5930         STD_IW_HANDLER(SIOCGIWSCAN,     orinoco_ioctl_getscan),
5931         STD_IW_HANDLER(SIOCSIWESSID,    orinoco_ioctl_setessid),
5932         STD_IW_HANDLER(SIOCGIWESSID,    orinoco_ioctl_getessid),
5933         STD_IW_HANDLER(SIOCSIWNICKN,    orinoco_ioctl_setnick),
5934         STD_IW_HANDLER(SIOCGIWNICKN,    orinoco_ioctl_getnick),
5935         STD_IW_HANDLER(SIOCSIWRATE,     orinoco_ioctl_setrate),
5936         STD_IW_HANDLER(SIOCGIWRATE,     orinoco_ioctl_getrate),
5937         STD_IW_HANDLER(SIOCSIWRTS,      orinoco_ioctl_setrts),
5938         STD_IW_HANDLER(SIOCGIWRTS,      orinoco_ioctl_getrts),
5939         STD_IW_HANDLER(SIOCSIWFRAG,     orinoco_ioctl_setfrag),
5940         STD_IW_HANDLER(SIOCGIWFRAG,     orinoco_ioctl_getfrag),
5941         STD_IW_HANDLER(SIOCGIWRETRY,    orinoco_ioctl_getretry),
5942         STD_IW_HANDLER(SIOCSIWENCODE,   orinoco_ioctl_setiwencode),
5943         STD_IW_HANDLER(SIOCGIWENCODE,   orinoco_ioctl_getiwencode),
5944         STD_IW_HANDLER(SIOCSIWPOWER,    orinoco_ioctl_setpower),
5945         STD_IW_HANDLER(SIOCGIWPOWER,    orinoco_ioctl_getpower),
5946         STD_IW_HANDLER(SIOCSIWGENIE,    orinoco_ioctl_set_genie),
5947         STD_IW_HANDLER(SIOCGIWGENIE,    orinoco_ioctl_get_genie),
5948         STD_IW_HANDLER(SIOCSIWMLME,     orinoco_ioctl_set_mlme),
5949         STD_IW_HANDLER(SIOCSIWAUTH,     orinoco_ioctl_set_auth),
5950         STD_IW_HANDLER(SIOCGIWAUTH,     orinoco_ioctl_get_auth),
5951         STD_IW_HANDLER(SIOCSIWENCODEEXT, orinoco_ioctl_set_encodeext),
5952         STD_IW_HANDLER(SIOCGIWENCODEEXT, orinoco_ioctl_get_encodeext),
5953 };
5954
5955
5956 /*
5957   Added typecasting since we no longer use iwreq_data -- Moustafa
5958  */
5959 static const iw_handler orinoco_private_handler[] = {
5960         [0] = (iw_handler) orinoco_ioctl_reset,
5961         [1] = (iw_handler) orinoco_ioctl_reset,
5962         [2] = (iw_handler) orinoco_ioctl_setport3,
5963         [3] = (iw_handler) orinoco_ioctl_getport3,
5964         [4] = (iw_handler) orinoco_ioctl_setpreamble,
5965         [5] = (iw_handler) orinoco_ioctl_getpreamble,
5966         [6] = (iw_handler) orinoco_ioctl_setibssport,
5967         [7] = (iw_handler) orinoco_ioctl_getibssport,
5968         [9] = (iw_handler) orinoco_ioctl_getrid,
5969 };
5970
5971 static const struct iw_handler_def orinoco_handler_def = {
5972         .num_standard = ARRAY_SIZE(orinoco_handler),
5973         .num_private = ARRAY_SIZE(orinoco_private_handler),
5974         .num_private_args = ARRAY_SIZE(orinoco_privtab),
5975         .standard = orinoco_handler,
5976         .private = orinoco_private_handler,
5977         .private_args = orinoco_privtab,
5978         .get_wireless_stats = orinoco_get_wireless_stats,
5979 };
5980
5981 static void orinoco_get_drvinfo(struct net_device *dev,
5982                                 struct ethtool_drvinfo *info)
5983 {
5984         struct orinoco_private *priv = netdev_priv(dev);
5985
5986         strncpy(info->driver, DRIVER_NAME, sizeof(info->driver) - 1);
5987         strncpy(info->version, DRIVER_VERSION, sizeof(info->version) - 1);
5988         strncpy(info->fw_version, priv->fw_name, sizeof(info->fw_version) - 1);
5989         if (dev->dev.parent)
5990                 strncpy(info->bus_info, dev_name(dev->dev.parent),
5991                         sizeof(info->bus_info) - 1);
5992         else
5993                 snprintf(info->bus_info, sizeof(info->bus_info) - 1,
5994                          "PCMCIA %p", priv->hw.iobase);
5995 }
5996
5997 static const struct ethtool_ops orinoco_ethtool_ops = {
5998         .get_drvinfo = orinoco_get_drvinfo,
5999         .get_link = ethtool_op_get_link,
6000 };
6001
6002 /********************************************************************/
6003 /* Module initialization                                            */
6004 /********************************************************************/
6005
6006 EXPORT_SYMBOL(alloc_orinocodev);
6007 EXPORT_SYMBOL(free_orinocodev);
6008
6009 EXPORT_SYMBOL(__orinoco_up);
6010 EXPORT_SYMBOL(__orinoco_down);
6011 EXPORT_SYMBOL(orinoco_reinit_firmware);
6012
6013 EXPORT_SYMBOL(orinoco_interrupt);
6014
6015 /* Can't be declared "const" or the whole __initdata section will
6016  * become const */
6017 static char version[] __initdata = DRIVER_NAME " " DRIVER_VERSION
6018         " (David Gibson <hermes@gibson.dropbear.id.au>, "
6019         "Pavel Roskin <proski@gnu.org>, et al)";
6020
6021 static int __init init_orinoco(void)
6022 {
6023         printk(KERN_DEBUG "%s\n", version);
6024         return 0;
6025 }
6026
6027 static void __exit exit_orinoco(void)
6028 {
6029 }
6030
6031 module_init(init_orinoco);
6032 module_exit(exit_orinoco);