Version:  2.0.40 2.2.26 2.4.37 3.2 3.3 3.4 3.5 3.6 3.7 3.8 3.9 3.10 3.11 3.12 3.13 3.14 3.15 3.16 3.17 3.18

Linux/drivers/net/wireless/airo.c

  1 /*======================================================================
  2 
  3     Aironet driver for 4500 and 4800 series cards
  4 
  5     This code is released under both the GPL version 2 and BSD licenses.
  6     Either license may be used.  The respective licenses are found at
  7     the end of this file.
  8 
  9     This code was developed by Benjamin Reed <breed@users.sourceforge.net>
 10     including portions of which come from the Aironet PC4500
 11     Developer's Reference Manual and used with permission.  Copyright
 12     (C) 1999 Benjamin Reed.  All Rights Reserved.  Permission to use
 13     code in the Developer's manual was granted for this driver by
 14     Aironet.  Major code contributions were received from Javier Achirica
 15     <achirica@users.sourceforge.net> and Jean Tourrilhes <jt@hpl.hp.com>.
 16     Code was also integrated from the Cisco Aironet driver for Linux.
 17     Support for MPI350 cards was added by Fabrice Bellet
 18     <fabrice@bellet.info>.
 19 
 20 ======================================================================*/
 21 
 22 #include <linux/err.h>
 23 #include <linux/init.h>
 24 
 25 #include <linux/kernel.h>
 26 #include <linux/module.h>
 27 #include <linux/proc_fs.h>
 28 
 29 #include <linux/sched.h>
 30 #include <linux/ptrace.h>
 31 #include <linux/slab.h>
 32 #include <linux/string.h>
 33 #include <linux/timer.h>
 34 #include <linux/interrupt.h>
 35 #include <linux/in.h>
 36 #include <linux/bitops.h>
 37 #include <linux/scatterlist.h>
 38 #include <linux/crypto.h>
 39 #include <linux/io.h>
 40 #include <asm/unaligned.h>
 41 
 42 #include <linux/netdevice.h>
 43 #include <linux/etherdevice.h>
 44 #include <linux/skbuff.h>
 45 #include <linux/if_arp.h>
 46 #include <linux/ioport.h>
 47 #include <linux/pci.h>
 48 #include <linux/uaccess.h>
 49 #include <linux/kthread.h>
 50 #include <linux/freezer.h>
 51 
 52 #include <net/cfg80211.h>
 53 #include <net/iw_handler.h>
 54 
 55 #include "airo.h"
 56 
 57 #define DRV_NAME "airo"
 58 
 59 #ifdef CONFIG_PCI
 60 static const struct pci_device_id card_ids[] = {
 61         { 0x14b9, 1, PCI_ANY_ID, PCI_ANY_ID, },
 62         { 0x14b9, 0x4500, PCI_ANY_ID, PCI_ANY_ID },
 63         { 0x14b9, 0x4800, PCI_ANY_ID, PCI_ANY_ID, },
 64         { 0x14b9, 0x0340, PCI_ANY_ID, PCI_ANY_ID, },
 65         { 0x14b9, 0x0350, PCI_ANY_ID, PCI_ANY_ID, },
 66         { 0x14b9, 0x5000, PCI_ANY_ID, PCI_ANY_ID, },
 67         { 0x14b9, 0xa504, PCI_ANY_ID, PCI_ANY_ID, },
 68         { 0, }
 69 };
 70 MODULE_DEVICE_TABLE(pci, card_ids);
 71 
 72 static int airo_pci_probe(struct pci_dev *, const struct pci_device_id *);
 73 static void airo_pci_remove(struct pci_dev *);
 74 static int airo_pci_suspend(struct pci_dev *pdev, pm_message_t state);
 75 static int airo_pci_resume(struct pci_dev *pdev);
 76 
 77 static struct pci_driver airo_driver = {
 78         .name     = DRV_NAME,
 79         .id_table = card_ids,
 80         .probe    = airo_pci_probe,
 81         .remove   = airo_pci_remove,
 82         .suspend  = airo_pci_suspend,
 83         .resume   = airo_pci_resume,
 84 };
 85 #endif /* CONFIG_PCI */
 86 
 87 /* Include Wireless Extension definition and check version - Jean II */
 88 #include <linux/wireless.h>
 89 #define WIRELESS_SPY            /* enable iwspy support */
 90 
 91 #define CISCO_EXT               /* enable Cisco extensions */
 92 #ifdef CISCO_EXT
 93 #include <linux/delay.h>
 94 #endif
 95 
 96 /* Hack to do some power saving */
 97 #define POWER_ON_DOWN
 98 
 99 /* As you can see this list is HUGH!
100    I really don't know what a lot of these counts are about, but they
101    are all here for completeness.  If the IGNLABEL macro is put in
102    infront of the label, that statistic will not be included in the list
103    of statistics in the /proc filesystem */
104 
105 #define IGNLABEL(comment) NULL
106 static const char *statsLabels[] = {
107         "RxOverrun",
108         IGNLABEL("RxPlcpCrcErr"),
109         IGNLABEL("RxPlcpFormatErr"),
110         IGNLABEL("RxPlcpLengthErr"),
111         "RxMacCrcErr",
112         "RxMacCrcOk",
113         "RxWepErr",
114         "RxWepOk",
115         "RetryLong",
116         "RetryShort",
117         "MaxRetries",
118         "NoAck",
119         "NoCts",
120         "RxAck",
121         "RxCts",
122         "TxAck",
123         "TxRts",
124         "TxCts",
125         "TxMc",
126         "TxBc",
127         "TxUcFrags",
128         "TxUcPackets",
129         "TxBeacon",
130         "RxBeacon",
131         "TxSinColl",
132         "TxMulColl",
133         "DefersNo",
134         "DefersProt",
135         "DefersEngy",
136         "DupFram",
137         "RxFragDisc",
138         "TxAged",
139         "RxAged",
140         "LostSync-MaxRetry",
141         "LostSync-MissedBeacons",
142         "LostSync-ArlExceeded",
143         "LostSync-Deauth",
144         "LostSync-Disassoced",
145         "LostSync-TsfTiming",
146         "HostTxMc",
147         "HostTxBc",
148         "HostTxUc",
149         "HostTxFail",
150         "HostRxMc",
151         "HostRxBc",
152         "HostRxUc",
153         "HostRxDiscard",
154         IGNLABEL("HmacTxMc"),
155         IGNLABEL("HmacTxBc"),
156         IGNLABEL("HmacTxUc"),
157         IGNLABEL("HmacTxFail"),
158         IGNLABEL("HmacRxMc"),
159         IGNLABEL("HmacRxBc"),
160         IGNLABEL("HmacRxUc"),
161         IGNLABEL("HmacRxDiscard"),
162         IGNLABEL("HmacRxAccepted"),
163         "SsidMismatch",
164         "ApMismatch",
165         "RatesMismatch",
166         "AuthReject",
167         "AuthTimeout",
168         "AssocReject",
169         "AssocTimeout",
170         IGNLABEL("ReasonOutsideTable"),
171         IGNLABEL("ReasonStatus1"),
172         IGNLABEL("ReasonStatus2"),
173         IGNLABEL("ReasonStatus3"),
174         IGNLABEL("ReasonStatus4"),
175         IGNLABEL("ReasonStatus5"),
176         IGNLABEL("ReasonStatus6"),
177         IGNLABEL("ReasonStatus7"),
178         IGNLABEL("ReasonStatus8"),
179         IGNLABEL("ReasonStatus9"),
180         IGNLABEL("ReasonStatus10"),
181         IGNLABEL("ReasonStatus11"),
182         IGNLABEL("ReasonStatus12"),
183         IGNLABEL("ReasonStatus13"),
184         IGNLABEL("ReasonStatus14"),
185         IGNLABEL("ReasonStatus15"),
186         IGNLABEL("ReasonStatus16"),
187         IGNLABEL("ReasonStatus17"),
188         IGNLABEL("ReasonStatus18"),
189         IGNLABEL("ReasonStatus19"),
190         "RxMan",
191         "TxMan",
192         "RxRefresh",
193         "TxRefresh",
194         "RxPoll",
195         "TxPoll",
196         "HostRetries",
197         "LostSync-HostReq",
198         "HostTxBytes",
199         "HostRxBytes",
200         "ElapsedUsec",
201         "ElapsedSec",
202         "LostSyncBetterAP",
203         "PrivacyMismatch",
204         "Jammed",
205         "DiscRxNotWepped",
206         "PhyEleMismatch",
207         (char*)-1 };
208 #ifndef RUN_AT
209 #define RUN_AT(x) (jiffies+(x))
210 #endif
211 
212 
213 /* These variables are for insmod, since it seems that the rates
214    can only be set in setup_card.  Rates should be a comma separated
215    (no spaces) list of rates (up to 8). */
216 
217 static int rates[8];
218 static char *ssids[3];
219 
220 static int io[4];
221 static int irq[4];
222 
223 static
224 int maxencrypt /* = 0 */; /* The highest rate that the card can encrypt at.
225                        0 means no limit.  For old cards this was 4 */
226 
227 static int auto_wep /* = 0 */; /* If set, it tries to figure out the wep mode */
228 static int aux_bap /* = 0 */; /* Checks to see if the aux ports are needed to read
229                     the bap, needed on some older cards and buses. */
230 static int adhoc;
231 
232 static int probe = 1;
233 
234 static kuid_t proc_kuid;
235 static int proc_uid /* = 0 */;
236 
237 static kgid_t proc_kgid;
238 static int proc_gid /* = 0 */;
239 
240 static int airo_perm = 0555;
241 
242 static int proc_perm = 0644;
243 
244 MODULE_AUTHOR("Benjamin Reed");
245 MODULE_DESCRIPTION("Support for Cisco/Aironet 802.11 wireless ethernet cards.  "
246                    "Direct support for ISA/PCI/MPI cards and support for PCMCIA when used with airo_cs.");
247 MODULE_LICENSE("Dual BSD/GPL");
248 MODULE_SUPPORTED_DEVICE("Aironet 4500, 4800 and Cisco 340/350");
249 module_param_array(io, int, NULL, 0);
250 module_param_array(irq, int, NULL, 0);
251 module_param_array(rates, int, NULL, 0);
252 module_param_array(ssids, charp, NULL, 0);
253 module_param(auto_wep, int, 0);
254 MODULE_PARM_DESC(auto_wep,
255                  "If non-zero, the driver will keep looping through the authentication options until an association is made.  "
256                  "The value of auto_wep is number of the wep keys to check.  "
257                  "A value of 2 will try using the key at index 0 and index 1.");
258 module_param(aux_bap, int, 0);
259 MODULE_PARM_DESC(aux_bap,
260                  "If non-zero, the driver will switch into a mode that seems to work better for older cards with some older buses.  "
261                  "Before switching it checks that the switch is needed.");
262 module_param(maxencrypt, int, 0);
263 MODULE_PARM_DESC(maxencrypt,
264                  "The maximum speed that the card can do encryption.  "
265                  "Units are in 512kbs.  "
266                  "Zero (default) means there is no limit.  "
267                  "Older cards used to be limited to 2mbs (4).");
268 module_param(adhoc, int, 0);
269 MODULE_PARM_DESC(adhoc, "If non-zero, the card will start in adhoc mode.");
270 module_param(probe, int, 0);
271 MODULE_PARM_DESC(probe, "If zero, the driver won't start the card.");
272 
273 module_param(proc_uid, int, 0);
274 MODULE_PARM_DESC(proc_uid, "The uid that the /proc files will belong to.");
275 module_param(proc_gid, int, 0);
276 MODULE_PARM_DESC(proc_gid, "The gid that the /proc files will belong to.");
277 module_param(airo_perm, int, 0);
278 MODULE_PARM_DESC(airo_perm, "The permission bits of /proc/[driver/]aironet.");
279 module_param(proc_perm, int, 0);
280 MODULE_PARM_DESC(proc_perm, "The permission bits of the files in /proc");
281 
282 /* This is a kind of sloppy hack to get this information to OUT4500 and
283    IN4500.  I would be extremely interested in the situation where this
284    doesn't work though!!! */
285 static int do8bitIO /* = 0 */;
286 
287 /* Return codes */
288 #define SUCCESS 0
289 #define ERROR -1
290 #define NO_PACKET -2
291 
292 /* Commands */
293 #define NOP2            0x0000
294 #define MAC_ENABLE      0x0001
295 #define MAC_DISABLE     0x0002
296 #define CMD_LOSE_SYNC   0x0003 /* Not sure what this does... */
297 #define CMD_SOFTRESET   0x0004
298 #define HOSTSLEEP       0x0005
299 #define CMD_MAGIC_PKT   0x0006
300 #define CMD_SETWAKEMASK 0x0007
301 #define CMD_READCFG     0x0008
302 #define CMD_SETMODE     0x0009
303 #define CMD_ALLOCATETX  0x000a
304 #define CMD_TRANSMIT    0x000b
305 #define CMD_DEALLOCATETX 0x000c
306 #define NOP             0x0010
307 #define CMD_WORKAROUND  0x0011
308 #define CMD_ALLOCATEAUX 0x0020
309 #define CMD_ACCESS      0x0021
310 #define CMD_PCIBAP      0x0022
311 #define CMD_PCIAUX      0x0023
312 #define CMD_ALLOCBUF    0x0028
313 #define CMD_GETTLV      0x0029
314 #define CMD_PUTTLV      0x002a
315 #define CMD_DELTLV      0x002b
316 #define CMD_FINDNEXTTLV 0x002c
317 #define CMD_PSPNODES    0x0030
318 #define CMD_SETCW       0x0031    
319 #define CMD_SETPCF      0x0032    
320 #define CMD_SETPHYREG   0x003e
321 #define CMD_TXTEST      0x003f
322 #define MAC_ENABLETX    0x0101
323 #define CMD_LISTBSS     0x0103
324 #define CMD_SAVECFG     0x0108
325 #define CMD_ENABLEAUX   0x0111
326 #define CMD_WRITERID    0x0121
327 #define CMD_USEPSPNODES 0x0130
328 #define MAC_ENABLERX    0x0201
329 
330 /* Command errors */
331 #define ERROR_QUALIF 0x00
332 #define ERROR_ILLCMD 0x01
333 #define ERROR_ILLFMT 0x02
334 #define ERROR_INVFID 0x03
335 #define ERROR_INVRID 0x04
336 #define ERROR_LARGE 0x05
337 #define ERROR_NDISABL 0x06
338 #define ERROR_ALLOCBSY 0x07
339 #define ERROR_NORD 0x0B
340 #define ERROR_NOWR 0x0C
341 #define ERROR_INVFIDTX 0x0D
342 #define ERROR_TESTACT 0x0E
343 #define ERROR_TAGNFND 0x12
344 #define ERROR_DECODE 0x20
345 #define ERROR_DESCUNAV 0x21
346 #define ERROR_BADLEN 0x22
347 #define ERROR_MODE 0x80
348 #define ERROR_HOP 0x81
349 #define ERROR_BINTER 0x82
350 #define ERROR_RXMODE 0x83
351 #define ERROR_MACADDR 0x84
352 #define ERROR_RATES 0x85
353 #define ERROR_ORDER 0x86
354 #define ERROR_SCAN 0x87
355 #define ERROR_AUTH 0x88
356 #define ERROR_PSMODE 0x89
357 #define ERROR_RTYPE 0x8A
358 #define ERROR_DIVER 0x8B
359 #define ERROR_SSID 0x8C
360 #define ERROR_APLIST 0x8D
361 #define ERROR_AUTOWAKE 0x8E
362 #define ERROR_LEAP 0x8F
363 
364 /* Registers */
365 #define COMMAND 0x00
366 #define PARAM0 0x02
367 #define PARAM1 0x04
368 #define PARAM2 0x06
369 #define STATUS 0x08
370 #define RESP0 0x0a
371 #define RESP1 0x0c
372 #define RESP2 0x0e
373 #define LINKSTAT 0x10
374 #define SELECT0 0x18
375 #define OFFSET0 0x1c
376 #define RXFID 0x20
377 #define TXALLOCFID 0x22
378 #define TXCOMPLFID 0x24
379 #define DATA0 0x36
380 #define EVSTAT 0x30
381 #define EVINTEN 0x32
382 #define EVACK 0x34
383 #define SWS0 0x28
384 #define SWS1 0x2a
385 #define SWS2 0x2c
386 #define SWS3 0x2e
387 #define AUXPAGE 0x3A
388 #define AUXOFF 0x3C
389 #define AUXDATA 0x3E
390 
391 #define FID_TX 1
392 #define FID_RX 2
393 /* Offset into aux memory for descriptors */
394 #define AUX_OFFSET 0x800
395 /* Size of allocated packets */
396 #define PKTSIZE 1840
397 #define RIDSIZE 2048
398 /* Size of the transmit queue */
399 #define MAXTXQ 64
400 
401 /* BAP selectors */
402 #define BAP0 0 /* Used for receiving packets */
403 #define BAP1 2 /* Used for xmiting packets and working with RIDS */
404 
405 /* Flags */
406 #define COMMAND_BUSY 0x8000
407 
408 #define BAP_BUSY 0x8000
409 #define BAP_ERR 0x4000
410 #define BAP_DONE 0x2000
411 
412 #define PROMISC 0xffff
413 #define NOPROMISC 0x0000
414 
415 #define EV_CMD 0x10
416 #define EV_CLEARCOMMANDBUSY 0x4000
417 #define EV_RX 0x01
418 #define EV_TX 0x02
419 #define EV_TXEXC 0x04
420 #define EV_ALLOC 0x08
421 #define EV_LINK 0x80
422 #define EV_AWAKE 0x100
423 #define EV_TXCPY 0x400
424 #define EV_UNKNOWN 0x800
425 #define EV_MIC 0x1000 /* Message Integrity Check Interrupt */
426 #define EV_AWAKEN 0x2000
427 #define STATUS_INTS (EV_AWAKE|EV_LINK|EV_TXEXC|EV_TX|EV_TXCPY|EV_RX|EV_MIC)
428 
429 #ifdef CHECK_UNKNOWN_INTS
430 #define IGNORE_INTS ( EV_CMD | EV_UNKNOWN)
431 #else
432 #define IGNORE_INTS (~STATUS_INTS)
433 #endif
434 
435 /* RID TYPES */
436 #define RID_RW 0x20
437 
438 /* The RIDs */
439 #define RID_CAPABILITIES 0xFF00
440 #define RID_APINFO     0xFF01
441 #define RID_RADIOINFO  0xFF02
442 #define RID_UNKNOWN3   0xFF03
443 #define RID_RSSI       0xFF04
444 #define RID_CONFIG     0xFF10
445 #define RID_SSID       0xFF11
446 #define RID_APLIST     0xFF12
447 #define RID_DRVNAME    0xFF13
448 #define RID_ETHERENCAP 0xFF14
449 #define RID_WEP_TEMP   0xFF15
450 #define RID_WEP_PERM   0xFF16
451 #define RID_MODULATION 0xFF17
452 #define RID_OPTIONS    0xFF18
453 #define RID_ACTUALCONFIG 0xFF20 /*readonly*/
454 #define RID_FACTORYCONFIG 0xFF21
455 #define RID_UNKNOWN22  0xFF22
456 #define RID_LEAPUSERNAME 0xFF23
457 #define RID_LEAPPASSWORD 0xFF24
458 #define RID_STATUS     0xFF50
459 #define RID_BEACON_HST 0xFF51
460 #define RID_BUSY_HST   0xFF52
461 #define RID_RETRIES_HST 0xFF53
462 #define RID_UNKNOWN54  0xFF54
463 #define RID_UNKNOWN55  0xFF55
464 #define RID_UNKNOWN56  0xFF56
465 #define RID_MIC        0xFF57
466 #define RID_STATS16    0xFF60
467 #define RID_STATS16DELTA 0xFF61
468 #define RID_STATS16DELTACLEAR 0xFF62
469 #define RID_STATS      0xFF68
470 #define RID_STATSDELTA 0xFF69
471 #define RID_STATSDELTACLEAR 0xFF6A
472 #define RID_ECHOTEST_RID 0xFF70
473 #define RID_ECHOTEST_RESULTS 0xFF71
474 #define RID_BSSLISTFIRST 0xFF72
475 #define RID_BSSLISTNEXT  0xFF73
476 #define RID_WPA_BSSLISTFIRST 0xFF74
477 #define RID_WPA_BSSLISTNEXT  0xFF75
478 
479 typedef struct {
480         u16 cmd;
481         u16 parm0;
482         u16 parm1;
483         u16 parm2;
484 } Cmd;
485 
486 typedef struct {
487         u16 status;
488         u16 rsp0;
489         u16 rsp1;
490         u16 rsp2;
491 } Resp;
492 
493 /*
494  * Rids and endian-ness:  The Rids will always be in cpu endian, since
495  * this all the patches from the big-endian guys end up doing that.
496  * so all rid access should use the read/writeXXXRid routines.
497  */
498 
499 /* This structure came from an email sent to me from an engineer at
500    aironet for inclusion into this driver */
501 typedef struct WepKeyRid WepKeyRid;
502 struct WepKeyRid {
503         __le16 len;
504         __le16 kindex;
505         u8 mac[ETH_ALEN];
506         __le16 klen;
507         u8 key[16];
508 } __packed;
509 
510 /* These structures are from the Aironet's PC4500 Developers Manual */
511 typedef struct Ssid Ssid;
512 struct Ssid {
513         __le16 len;
514         u8 ssid[32];
515 } __packed;
516 
517 typedef struct SsidRid SsidRid;
518 struct SsidRid {
519         __le16 len;
520         Ssid ssids[3];
521 } __packed;
522 
523 typedef struct ModulationRid ModulationRid;
524 struct ModulationRid {
525         __le16 len;
526         __le16 modulation;
527 #define MOD_DEFAULT cpu_to_le16(0)
528 #define MOD_CCK cpu_to_le16(1)
529 #define MOD_MOK cpu_to_le16(2)
530 } __packed;
531 
532 typedef struct ConfigRid ConfigRid;
533 struct ConfigRid {
534         __le16 len; /* sizeof(ConfigRid) */
535         __le16 opmode; /* operating mode */
536 #define MODE_STA_IBSS cpu_to_le16(0)
537 #define MODE_STA_ESS cpu_to_le16(1)
538 #define MODE_AP cpu_to_le16(2)
539 #define MODE_AP_RPTR cpu_to_le16(3)
540 #define MODE_CFG_MASK cpu_to_le16(0xff)
541 #define MODE_ETHERNET_HOST cpu_to_le16(0<<8) /* rx payloads converted */
542 #define MODE_LLC_HOST cpu_to_le16(1<<8) /* rx payloads left as is */
543 #define MODE_AIRONET_EXTEND cpu_to_le16(1<<9) /* enable Aironet extenstions */
544 #define MODE_AP_INTERFACE cpu_to_le16(1<<10) /* enable ap interface extensions */
545 #define MODE_ANTENNA_ALIGN cpu_to_le16(1<<11) /* enable antenna alignment */
546 #define MODE_ETHER_LLC cpu_to_le16(1<<12) /* enable ethernet LLC */
547 #define MODE_LEAF_NODE cpu_to_le16(1<<13) /* enable leaf node bridge */
548 #define MODE_CF_POLLABLE cpu_to_le16(1<<14) /* enable CF pollable */
549 #define MODE_MIC cpu_to_le16(1<<15) /* enable MIC */
550         __le16 rmode; /* receive mode */
551 #define RXMODE_BC_MC_ADDR cpu_to_le16(0)
552 #define RXMODE_BC_ADDR cpu_to_le16(1) /* ignore multicasts */
553 #define RXMODE_ADDR cpu_to_le16(2) /* ignore multicast and broadcast */
554 #define RXMODE_RFMON cpu_to_le16(3) /* wireless monitor mode */
555 #define RXMODE_RFMON_ANYBSS cpu_to_le16(4)
556 #define RXMODE_LANMON cpu_to_le16(5) /* lan style monitor -- data packets only */
557 #define RXMODE_MASK cpu_to_le16(255)
558 #define RXMODE_DISABLE_802_3_HEADER cpu_to_le16(1<<8) /* disables 802.3 header on rx */
559 #define RXMODE_FULL_MASK (RXMODE_MASK | RXMODE_DISABLE_802_3_HEADER)
560 #define RXMODE_NORMALIZED_RSSI cpu_to_le16(1<<9) /* return normalized RSSI */
561         __le16 fragThresh;
562         __le16 rtsThres;
563         u8 macAddr[ETH_ALEN];
564         u8 rates[8];
565         __le16 shortRetryLimit;
566         __le16 longRetryLimit;
567         __le16 txLifetime; /* in kusec */
568         __le16 rxLifetime; /* in kusec */
569         __le16 stationary;
570         __le16 ordering;
571         __le16 u16deviceType; /* for overriding device type */
572         __le16 cfpRate;
573         __le16 cfpDuration;
574         __le16 _reserved1[3];
575         /*---------- Scanning/Associating ----------*/
576         __le16 scanMode;
577 #define SCANMODE_ACTIVE cpu_to_le16(0)
578 #define SCANMODE_PASSIVE cpu_to_le16(1)
579 #define SCANMODE_AIROSCAN cpu_to_le16(2)
580         __le16 probeDelay; /* in kusec */
581         __le16 probeEnergyTimeout; /* in kusec */
582         __le16 probeResponseTimeout;
583         __le16 beaconListenTimeout;
584         __le16 joinNetTimeout;
585         __le16 authTimeout;
586         __le16 authType;
587 #define AUTH_OPEN cpu_to_le16(0x1)
588 #define AUTH_ENCRYPT cpu_to_le16(0x101)
589 #define AUTH_SHAREDKEY cpu_to_le16(0x102)
590 #define AUTH_ALLOW_UNENCRYPTED cpu_to_le16(0x200)
591         __le16 associationTimeout;
592         __le16 specifiedApTimeout;
593         __le16 offlineScanInterval;
594         __le16 offlineScanDuration;
595         __le16 linkLossDelay;
596         __le16 maxBeaconLostTime;
597         __le16 refreshInterval;
598 #define DISABLE_REFRESH cpu_to_le16(0xFFFF)
599         __le16 _reserved1a[1];
600         /*---------- Power save operation ----------*/
601         __le16 powerSaveMode;
602 #define POWERSAVE_CAM cpu_to_le16(0)
603 #define POWERSAVE_PSP cpu_to_le16(1)
604 #define POWERSAVE_PSPCAM cpu_to_le16(2)
605         __le16 sleepForDtims;
606         __le16 listenInterval;
607         __le16 fastListenInterval;
608         __le16 listenDecay;
609         __le16 fastListenDelay;
610         __le16 _reserved2[2];
611         /*---------- Ap/Ibss config items ----------*/
612         __le16 beaconPeriod;
613         __le16 atimDuration;
614         __le16 hopPeriod;
615         __le16 channelSet;
616         __le16 channel;
617         __le16 dtimPeriod;
618         __le16 bridgeDistance;
619         __le16 radioID;
620         /*---------- Radio configuration ----------*/
621         __le16 radioType;
622 #define RADIOTYPE_DEFAULT cpu_to_le16(0)
623 #define RADIOTYPE_802_11 cpu_to_le16(1)
624 #define RADIOTYPE_LEGACY cpu_to_le16(2)
625         u8 rxDiversity;
626         u8 txDiversity;
627         __le16 txPower;
628 #define TXPOWER_DEFAULT 0
629         __le16 rssiThreshold;
630 #define RSSI_DEFAULT 0
631         __le16 modulation;
632 #define PREAMBLE_AUTO cpu_to_le16(0)
633 #define PREAMBLE_LONG cpu_to_le16(1)
634 #define PREAMBLE_SHORT cpu_to_le16(2)
635         __le16 preamble;
636         __le16 homeProduct;
637         __le16 radioSpecific;
638         /*---------- Aironet Extensions ----------*/
639         u8 nodeName[16];
640         __le16 arlThreshold;
641         __le16 arlDecay;
642         __le16 arlDelay;
643         __le16 _reserved4[1];
644         /*---------- Aironet Extensions ----------*/
645         u8 magicAction;
646 #define MAGIC_ACTION_STSCHG 1
647 #define MAGIC_ACTION_RESUME 2
648 #define MAGIC_IGNORE_MCAST (1<<8)
649 #define MAGIC_IGNORE_BCAST (1<<9)
650 #define MAGIC_SWITCH_TO_PSP (0<<10)
651 #define MAGIC_STAY_IN_CAM (1<<10)
652         u8 magicControl;
653         __le16 autoWake;
654 } __packed;
655 
656 typedef struct StatusRid StatusRid;
657 struct StatusRid {
658         __le16 len;
659         u8 mac[ETH_ALEN];
660         __le16 mode;
661         __le16 errorCode;
662         __le16 sigQuality;
663         __le16 SSIDlen;
664         char SSID[32];
665         char apName[16];
666         u8 bssid[4][ETH_ALEN];
667         __le16 beaconPeriod;
668         __le16 dimPeriod;
669         __le16 atimDuration;
670         __le16 hopPeriod;
671         __le16 channelSet;
672         __le16 channel;
673         __le16 hopsToBackbone;
674         __le16 apTotalLoad;
675         __le16 generatedLoad;
676         __le16 accumulatedArl;
677         __le16 signalQuality;
678         __le16 currentXmitRate;
679         __le16 apDevExtensions;
680         __le16 normalizedSignalStrength;
681         __le16 shortPreamble;
682         u8 apIP[4];
683         u8 noisePercent; /* Noise percent in last second */
684         u8 noisedBm; /* Noise dBm in last second */
685         u8 noiseAvePercent; /* Noise percent in last minute */
686         u8 noiseAvedBm; /* Noise dBm in last minute */
687         u8 noiseMaxPercent; /* Highest noise percent in last minute */
688         u8 noiseMaxdBm; /* Highest noise dbm in last minute */
689         __le16 load;
690         u8 carrier[4];
691         __le16 assocStatus;
692 #define STAT_NOPACKETS 0
693 #define STAT_NOCARRIERSET 10
694 #define STAT_GOTCARRIERSET 11
695 #define STAT_WRONGSSID 20
696 #define STAT_BADCHANNEL 25
697 #define STAT_BADBITRATES 30
698 #define STAT_BADPRIVACY 35
699 #define STAT_APFOUND 40
700 #define STAT_APREJECTED 50
701 #define STAT_AUTHENTICATING 60
702 #define STAT_DEAUTHENTICATED 61
703 #define STAT_AUTHTIMEOUT 62
704 #define STAT_ASSOCIATING 70
705 #define STAT_DEASSOCIATED 71
706 #define STAT_ASSOCTIMEOUT 72
707 #define STAT_NOTAIROAP 73
708 #define STAT_ASSOCIATED 80
709 #define STAT_LEAPING 90
710 #define STAT_LEAPFAILED 91
711 #define STAT_LEAPTIMEDOUT 92
712 #define STAT_LEAPCOMPLETE 93
713 } __packed;
714 
715 typedef struct StatsRid StatsRid;
716 struct StatsRid {
717         __le16 len;
718         __le16 spacer;
719         __le32 vals[100];
720 } __packed;
721 
722 typedef struct APListRid APListRid;
723 struct APListRid {
724         __le16 len;
725         u8 ap[4][ETH_ALEN];
726 } __packed;
727 
728 typedef struct CapabilityRid CapabilityRid;
729 struct CapabilityRid {
730         __le16 len;
731         char oui[3];
732         char zero;
733         __le16 prodNum;
734         char manName[32];
735         char prodName[16];
736         char prodVer[8];
737         char factoryAddr[ETH_ALEN];
738         char aironetAddr[ETH_ALEN];
739         __le16 radioType;
740         __le16 country;
741         char callid[ETH_ALEN];
742         char supportedRates[8];
743         char rxDiversity;
744         char txDiversity;
745         __le16 txPowerLevels[8];
746         __le16 hardVer;
747         __le16 hardCap;
748         __le16 tempRange;
749         __le16 softVer;
750         __le16 softSubVer;
751         __le16 interfaceVer;
752         __le16 softCap;
753         __le16 bootBlockVer;
754         __le16 requiredHard;
755         __le16 extSoftCap;
756 } __packed;
757 
758 /* Only present on firmware >= 5.30.17 */
759 typedef struct BSSListRidExtra BSSListRidExtra;
760 struct BSSListRidExtra {
761   __le16 unknown[4];
762   u8 fixed[12]; /* WLAN management frame */
763   u8 iep[624];
764 } __packed;
765 
766 typedef struct BSSListRid BSSListRid;
767 struct BSSListRid {
768   __le16 len;
769   __le16 index; /* First is 0 and 0xffff means end of list */
770 #define RADIO_FH 1 /* Frequency hopping radio type */
771 #define RADIO_DS 2 /* Direct sequence radio type */
772 #define RADIO_TMA 4 /* Proprietary radio used in old cards (2500) */
773   __le16 radioType;
774   u8 bssid[ETH_ALEN]; /* Mac address of the BSS */
775   u8 zero;
776   u8 ssidLen;
777   u8 ssid[32];
778   __le16 dBm;
779 #define CAP_ESS cpu_to_le16(1<<0)
780 #define CAP_IBSS cpu_to_le16(1<<1)
781 #define CAP_PRIVACY cpu_to_le16(1<<4)
782 #define CAP_SHORTHDR cpu_to_le16(1<<5)
783   __le16 cap;
784   __le16 beaconInterval;
785   u8 rates[8]; /* Same as rates for config rid */
786   struct { /* For frequency hopping only */
787     __le16 dwell;
788     u8 hopSet;
789     u8 hopPattern;
790     u8 hopIndex;
791     u8 fill;
792   } fh;
793   __le16 dsChannel;
794   __le16 atimWindow;
795 
796   /* Only present on firmware >= 5.30.17 */
797   BSSListRidExtra extra;
798 } __packed;
799 
800 typedef struct {
801   BSSListRid bss;
802   struct list_head list;
803 } BSSListElement;
804 
805 typedef struct tdsRssiEntry tdsRssiEntry;
806 struct tdsRssiEntry {
807   u8 rssipct;
808   u8 rssidBm;
809 } __packed;
810 
811 typedef struct tdsRssiRid tdsRssiRid;
812 struct tdsRssiRid {
813   u16 len;
814   tdsRssiEntry x[256];
815 } __packed;
816 
817 typedef struct MICRid MICRid;
818 struct MICRid {
819         __le16 len;
820         __le16 state;
821         __le16 multicastValid;
822         u8  multicast[16];
823         __le16 unicastValid;
824         u8  unicast[16];
825 } __packed;
826 
827 typedef struct MICBuffer MICBuffer;
828 struct MICBuffer {
829         __be16 typelen;
830 
831         union {
832             u8 snap[8];
833             struct {
834                 u8 dsap;
835                 u8 ssap;
836                 u8 control;
837                 u8 orgcode[3];
838                 u8 fieldtype[2];
839             } llc;
840         } u;
841         __be32 mic;
842         __be32 seq;
843 } __packed;
844 
845 typedef struct {
846         u8 da[ETH_ALEN];
847         u8 sa[ETH_ALEN];
848 } etherHead;
849 
850 #define TXCTL_TXOK (1<<1) /* report if tx is ok */
851 #define TXCTL_TXEX (1<<2) /* report if tx fails */
852 #define TXCTL_802_3 (0<<3) /* 802.3 packet */
853 #define TXCTL_802_11 (1<<3) /* 802.11 mac packet */
854 #define TXCTL_ETHERNET (0<<4) /* payload has ethertype */
855 #define TXCTL_LLC (1<<4) /* payload is llc */
856 #define TXCTL_RELEASE (0<<5) /* release after completion */
857 #define TXCTL_NORELEASE (1<<5) /* on completion returns to host */
858 
859 #define BUSY_FID 0x10000
860 
861 #ifdef CISCO_EXT
862 #define AIROMAGIC       0xa55a
863 /* Warning : SIOCDEVPRIVATE may disapear during 2.5.X - Jean II */
864 #ifdef SIOCIWFIRSTPRIV
865 #ifdef SIOCDEVPRIVATE
866 #define AIROOLDIOCTL    SIOCDEVPRIVATE
867 #define AIROOLDIDIFC    AIROOLDIOCTL + 1
868 #endif /* SIOCDEVPRIVATE */
869 #else /* SIOCIWFIRSTPRIV */
870 #define SIOCIWFIRSTPRIV SIOCDEVPRIVATE
871 #endif /* SIOCIWFIRSTPRIV */
872 /* This may be wrong. When using the new SIOCIWFIRSTPRIV range, we probably
873  * should use only "GET" ioctls (last bit set to 1). "SET" ioctls are root
874  * only and don't return the modified struct ifreq to the application which
875  * is usually a problem. - Jean II */
876 #define AIROIOCTL       SIOCIWFIRSTPRIV
877 #define AIROIDIFC       AIROIOCTL + 1
878 
879 /* Ioctl constants to be used in airo_ioctl.command */
880 
881 #define AIROGCAP                0       // Capability rid
882 #define AIROGCFG                1       // USED A LOT
883 #define AIROGSLIST              2       // System ID list
884 #define AIROGVLIST              3       // List of specified AP's
885 #define AIROGDRVNAM             4       //  NOTUSED
886 #define AIROGEHTENC             5       // NOTUSED
887 #define AIROGWEPKTMP            6
888 #define AIROGWEPKNV             7
889 #define AIROGSTAT               8
890 #define AIROGSTATSC32           9
891 #define AIROGSTATSD32           10
892 #define AIROGMICRID             11
893 #define AIROGMICSTATS           12
894 #define AIROGFLAGS              13
895 #define AIROGID                 14
896 #define AIRORRID                15
897 #define AIRORSWVERSION          17
898 
899 /* Leave gap of 40 commands after AIROGSTATSD32 for future */
900 
901 #define AIROPCAP                AIROGSTATSD32 + 40
902 #define AIROPVLIST              AIROPCAP      + 1
903 #define AIROPSLIST              AIROPVLIST    + 1
904 #define AIROPCFG                AIROPSLIST    + 1
905 #define AIROPSIDS               AIROPCFG      + 1
906 #define AIROPAPLIST             AIROPSIDS     + 1
907 #define AIROPMACON              AIROPAPLIST   + 1       /* Enable mac  */
908 #define AIROPMACOFF             AIROPMACON    + 1       /* Disable mac */
909 #define AIROPSTCLR              AIROPMACOFF   + 1
910 #define AIROPWEPKEY             AIROPSTCLR    + 1
911 #define AIROPWEPKEYNV           AIROPWEPKEY   + 1
912 #define AIROPLEAPPWD            AIROPWEPKEYNV + 1
913 #define AIROPLEAPUSR            AIROPLEAPPWD  + 1
914 
915 /* Flash codes */
916 
917 #define AIROFLSHRST            AIROPWEPKEYNV  + 40
918 #define AIROFLSHGCHR           AIROFLSHRST    + 1
919 #define AIROFLSHSTFL           AIROFLSHGCHR   + 1
920 #define AIROFLSHPCHR           AIROFLSHSTFL   + 1
921 #define AIROFLPUTBUF           AIROFLSHPCHR   + 1
922 #define AIRORESTART            AIROFLPUTBUF   + 1
923 
924 #define FLASHSIZE       32768
925 #define AUXMEMSIZE      (256 * 1024)
926 
927 typedef struct aironet_ioctl {
928         unsigned short command;         // What to do
929         unsigned short len;             // Len of data
930         unsigned short ridnum;          // rid number
931         unsigned char __user *data;     // d-data
932 } aironet_ioctl;
933 
934 static const char swversion[] = "2.1";
935 #endif /* CISCO_EXT */
936 
937 #define NUM_MODULES       2
938 #define MIC_MSGLEN_MAX    2400
939 #define EMMH32_MSGLEN_MAX MIC_MSGLEN_MAX
940 #define AIRO_DEF_MTU      2312
941 
942 typedef struct {
943         u32   size;            // size
944         u8    enabled;         // MIC enabled or not
945         u32   rxSuccess;       // successful packets received
946         u32   rxIncorrectMIC;  // pkts dropped due to incorrect MIC comparison
947         u32   rxNotMICed;      // pkts dropped due to not being MIC'd
948         u32   rxMICPlummed;    // pkts dropped due to not having a MIC plummed
949         u32   rxWrongSequence; // pkts dropped due to sequence number violation
950         u32   reserve[32];
951 } mic_statistics;
952 
953 typedef struct {
954         u32 coeff[((EMMH32_MSGLEN_MAX)+3)>>2];
955         u64 accum;      // accumulated mic, reduced to u32 in final()
956         int position;   // current position (byte offset) in message
957         union {
958                 u8  d8[4];
959                 __be32 d32;
960         } part; // saves partial message word across update() calls
961 } emmh32_context;
962 
963 typedef struct {
964         emmh32_context seed;        // Context - the seed
965         u32              rx;        // Received sequence number
966         u32              tx;        // Tx sequence number
967         u32              window;    // Start of window
968         u8               valid;     // Flag to say if context is valid or not
969         u8               key[16];
970 } miccntx;
971 
972 typedef struct {
973         miccntx mCtx;           // Multicast context
974         miccntx uCtx;           // Unicast context
975 } mic_module;
976 
977 typedef struct {
978         unsigned int  rid: 16;
979         unsigned int  len: 15;
980         unsigned int  valid: 1;
981         dma_addr_t host_addr;
982 } Rid;
983 
984 typedef struct {
985         unsigned int  offset: 15;
986         unsigned int  eoc: 1;
987         unsigned int  len: 15;
988         unsigned int  valid: 1;
989         dma_addr_t host_addr;
990 } TxFid;
991 
992 struct rx_hdr {
993         __le16 status, len;
994         u8 rssi[2];
995         u8 rate;
996         u8 freq;
997         __le16 tmp[4];
998 } __packed;
999 
1000 typedef struct {
1001         unsigned int  ctl: 15;
1002         unsigned int  rdy: 1;
1003         unsigned int  len: 15;
1004         unsigned int  valid: 1;
1005         dma_addr_t host_addr;
1006 } RxFid;
1007 
1008 /*
1009  * Host receive descriptor
1010  */
1011 typedef struct {
1012         unsigned char __iomem *card_ram_off; /* offset into card memory of the
1013                                                 desc */
1014         RxFid         rx_desc;               /* card receive descriptor */
1015         char          *virtual_host_addr;    /* virtual address of host receive
1016                                                 buffer */
1017         int           pending;
1018 } HostRxDesc;
1019 
1020 /*
1021  * Host transmit descriptor
1022  */
1023 typedef struct {
1024         unsigned char __iomem *card_ram_off;         /* offset into card memory of the
1025                                                 desc */
1026         TxFid         tx_desc;               /* card transmit descriptor */
1027         char          *virtual_host_addr;    /* virtual address of host receive
1028                                                 buffer */
1029         int           pending;
1030 } HostTxDesc;
1031 
1032 /*
1033  * Host RID descriptor
1034  */
1035 typedef struct {
1036         unsigned char __iomem *card_ram_off;      /* offset into card memory of the
1037                                              descriptor */
1038         Rid           rid_desc;           /* card RID descriptor */
1039         char          *virtual_host_addr; /* virtual address of host receive
1040                                              buffer */
1041 } HostRidDesc;
1042 
1043 typedef struct {
1044         u16 sw0;
1045         u16 sw1;
1046         u16 status;
1047         u16 len;
1048 #define HOST_SET (1 << 0)
1049 #define HOST_INT_TX (1 << 1) /* Interrupt on successful TX */
1050 #define HOST_INT_TXERR (1 << 2) /* Interrupt on unseccessful TX */
1051 #define HOST_LCC_PAYLOAD (1 << 4) /* LLC payload, 0 = Ethertype */
1052 #define HOST_DONT_RLSE (1 << 5) /* Don't release buffer when done */
1053 #define HOST_DONT_RETRY (1 << 6) /* Don't retry trasmit */
1054 #define HOST_CLR_AID (1 << 7) /* clear AID failure */
1055 #define HOST_RTS (1 << 9) /* Force RTS use */
1056 #define HOST_SHORT (1 << 10) /* Do short preamble */
1057         u16 ctl;
1058         u16 aid;
1059         u16 retries;
1060         u16 fill;
1061 } TxCtlHdr;
1062 
1063 typedef struct {
1064         u16 ctl;
1065         u16 duration;
1066         char addr1[6];
1067         char addr2[6];
1068         char addr3[6];
1069         u16 seq;
1070         char addr4[6];
1071 } WifiHdr;
1072 
1073 
1074 typedef struct {
1075         TxCtlHdr ctlhdr;
1076         u16 fill1;
1077         u16 fill2;
1078         WifiHdr wifihdr;
1079         u16 gaplen;
1080         u16 status;
1081 } WifiCtlHdr;
1082 
1083 static WifiCtlHdr wifictlhdr8023 = {
1084         .ctlhdr = {
1085                 .ctl    = HOST_DONT_RLSE,
1086         }
1087 };
1088 
1089 // A few details needed for WEP (Wireless Equivalent Privacy)
1090 #define MAX_KEY_SIZE 13                 // 128 (?) bits
1091 #define MIN_KEY_SIZE  5                 // 40 bits RC4 - WEP
1092 typedef struct wep_key_t {
1093         u16     len;
1094         u8      key[16];        /* 40-bit and 104-bit keys */
1095 } wep_key_t;
1096 
1097 /* List of Wireless Handlers (new API) */
1098 static const struct iw_handler_def      airo_handler_def;
1099 
1100 static const char version[] = "airo.c 0.6 (Ben Reed & Javier Achirica)";
1101 
1102 struct airo_info;
1103 
1104 static int get_dec_u16( char *buffer, int *start, int limit );
1105 static void OUT4500( struct airo_info *, u16 register, u16 value );
1106 static unsigned short IN4500( struct airo_info *, u16 register );
1107 static u16 setup_card(struct airo_info*, u8 *mac, int lock);
1108 static int enable_MAC(struct airo_info *ai, int lock);
1109 static void disable_MAC(struct airo_info *ai, int lock);
1110 static void enable_interrupts(struct airo_info*);
1111 static void disable_interrupts(struct airo_info*);
1112 static u16 issuecommand(struct airo_info*, Cmd *pCmd, Resp *pRsp);
1113 static int bap_setup(struct airo_info*, u16 rid, u16 offset, int whichbap);
1114 static int aux_bap_read(struct airo_info*, __le16 *pu16Dst, int bytelen,
1115                         int whichbap);
1116 static int fast_bap_read(struct airo_info*, __le16 *pu16Dst, int bytelen,
1117                          int whichbap);
1118 static int bap_write(struct airo_info*, const __le16 *pu16Src, int bytelen,
1119                      int whichbap);
1120 static int PC4500_accessrid(struct airo_info*, u16 rid, u16 accmd);
1121 static int PC4500_readrid(struct airo_info*, u16 rid, void *pBuf, int len, int lock);
1122 static int PC4500_writerid(struct airo_info*, u16 rid, const void
1123                            *pBuf, int len, int lock);
1124 static int do_writerid( struct airo_info*, u16 rid, const void *rid_data,
1125                         int len, int dummy );
1126 static u16 transmit_allocate(struct airo_info*, int lenPayload, int raw);
1127 static int transmit_802_3_packet(struct airo_info*, int len, char *pPacket);
1128 static int transmit_802_11_packet(struct airo_info*, int len, char *pPacket);
1129 
1130 static int mpi_send_packet (struct net_device *dev);
1131 static void mpi_unmap_card(struct pci_dev *pci);
1132 static void mpi_receive_802_3(struct airo_info *ai);
1133 static void mpi_receive_802_11(struct airo_info *ai);
1134 static int waitbusy (struct airo_info *ai);
1135 
1136 static irqreturn_t airo_interrupt( int irq, void* dev_id);
1137 static int airo_thread(void *data);
1138 static void timer_func( struct net_device *dev );
1139 static int airo_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
1140 static struct iw_statistics *airo_get_wireless_stats (struct net_device *dev);
1141 static void airo_read_wireless_stats (struct airo_info *local);
1142 #ifdef CISCO_EXT
1143 static int readrids(struct net_device *dev, aironet_ioctl *comp);
1144 static int writerids(struct net_device *dev, aironet_ioctl *comp);
1145 static int flashcard(struct net_device *dev, aironet_ioctl *comp);
1146 #endif /* CISCO_EXT */
1147 static void micinit(struct airo_info *ai);
1148 static int micsetup(struct airo_info *ai);
1149 static int encapsulate(struct airo_info *ai, etherHead *pPacket, MICBuffer *buffer, int len);
1150 static int decapsulate(struct airo_info *ai, MICBuffer *mic, etherHead *pPacket, u16 payLen);
1151 
1152 static u8 airo_rssi_to_dbm (tdsRssiEntry *rssi_rid, u8 rssi);
1153 static u8 airo_dbm_to_pct (tdsRssiEntry *rssi_rid, u8 dbm);
1154 
1155 static void airo_networks_free(struct airo_info *ai);
1156 
1157 struct airo_info {
1158         struct net_device             *dev;
1159         struct list_head              dev_list;
1160         /* Note, we can have MAX_FIDS outstanding.  FIDs are 16-bits, so we
1161            use the high bit to mark whether it is in use. */
1162 #define MAX_FIDS 6
1163 #define MPI_MAX_FIDS 1
1164         u32                           fids[MAX_FIDS];
1165         ConfigRid config;
1166         char keyindex; // Used with auto wep
1167         char defindex; // Used with auto wep
1168         struct proc_dir_entry *proc_entry;
1169         spinlock_t aux_lock;
1170 #define FLAG_RADIO_OFF  0       /* User disabling of MAC */
1171 #define FLAG_RADIO_DOWN 1       /* ifup/ifdown disabling of MAC */
1172 #define FLAG_RADIO_MASK 0x03
1173 #define FLAG_ENABLED    2
1174 #define FLAG_ADHOC      3       /* Needed by MIC */
1175 #define FLAG_MIC_CAPABLE 4
1176 #define FLAG_UPDATE_MULTI 5
1177 #define FLAG_UPDATE_UNI 6
1178 #define FLAG_802_11     7
1179 #define FLAG_PROMISC    8       /* IFF_PROMISC 0x100 - include/linux/if.h */
1180 #define FLAG_PENDING_XMIT 9
1181 #define FLAG_PENDING_XMIT11 10
1182 #define FLAG_MPI        11
1183 #define FLAG_REGISTERED 12
1184 #define FLAG_COMMIT     13
1185 #define FLAG_RESET      14
1186 #define FLAG_FLASHING   15
1187 #define FLAG_WPA_CAPABLE        16
1188         unsigned long flags;
1189 #define JOB_DIE 0
1190 #define JOB_XMIT        1
1191 #define JOB_XMIT11      2
1192 #define JOB_STATS       3
1193 #define JOB_PROMISC     4
1194 #define JOB_MIC 5
1195 #define JOB_EVENT       6
1196 #define JOB_AUTOWEP     7
1197 #define JOB_WSTATS      8
1198 #define JOB_SCAN_RESULTS  9
1199         unsigned long jobs;
1200         int (*bap_read)(struct airo_info*, __le16 *pu16Dst, int bytelen,
1201                         int whichbap);
1202         unsigned short *flash;
1203         tdsRssiEntry *rssi;
1204         struct task_struct *list_bss_task;
1205         struct task_struct *airo_thread_task;
1206         struct semaphore sem;
1207         wait_queue_head_t thr_wait;
1208         unsigned long expires;
1209         struct {
1210                 struct sk_buff *skb;
1211                 int fid;
1212         } xmit, xmit11;
1213         struct net_device *wifidev;
1214         struct iw_statistics    wstats;         // wireless stats
1215         unsigned long           scan_timeout;   /* Time scan should be read */
1216         struct iw_spy_data      spy_data;
1217         struct iw_public_data   wireless_data;
1218         /* MIC stuff */
1219         struct crypto_cipher    *tfm;
1220         mic_module              mod[2];
1221         mic_statistics          micstats;
1222         HostRxDesc rxfids[MPI_MAX_FIDS]; // rx/tx/config MPI350 descriptors
1223         HostTxDesc txfids[MPI_MAX_FIDS];
1224         HostRidDesc config_desc;
1225         unsigned long ridbus; // phys addr of config_desc
1226         struct sk_buff_head txq;// tx queue used by mpi350 code
1227         struct pci_dev          *pci;
1228         unsigned char           __iomem *pcimem;
1229         unsigned char           __iomem *pciaux;
1230         unsigned char           *shared;
1231         dma_addr_t              shared_dma;
1232         pm_message_t            power;
1233         SsidRid                 *SSID;
1234         APListRid               *APList;
1235 #define PCI_SHARED_LEN          2*MPI_MAX_FIDS*PKTSIZE+RIDSIZE
1236         char                    proc_name[IFNAMSIZ];
1237 
1238         int                     wep_capable;
1239         int                     max_wep_idx;
1240 
1241         /* WPA-related stuff */
1242         unsigned int bssListFirst;
1243         unsigned int bssListNext;
1244         unsigned int bssListRidLen;
1245 
1246         struct list_head network_list;
1247         struct list_head network_free_list;
1248         BSSListElement *networks;
1249 };
1250 
1251 static inline int bap_read(struct airo_info *ai, __le16 *pu16Dst, int bytelen,
1252                            int whichbap)
1253 {
1254         return ai->bap_read(ai, pu16Dst, bytelen, whichbap);
1255 }
1256 
1257 static int setup_proc_entry( struct net_device *dev,
1258                              struct airo_info *apriv );
1259 static int takedown_proc_entry( struct net_device *dev,
1260                                 struct airo_info *apriv );
1261 
1262 static int cmdreset(struct airo_info *ai);
1263 static int setflashmode (struct airo_info *ai);
1264 static int flashgchar(struct airo_info *ai,int matchbyte,int dwelltime);
1265 static int flashputbuf(struct airo_info *ai);
1266 static int flashrestart(struct airo_info *ai,struct net_device *dev);
1267 
1268 #define airo_print(type, name, fmt, args...) \
1269         printk(type DRV_NAME "(%s): " fmt "\n", name, ##args)
1270 
1271 #define airo_print_info(name, fmt, args...) \
1272         airo_print(KERN_INFO, name, fmt, ##args)
1273 
1274 #define airo_print_dbg(name, fmt, args...) \
1275         airo_print(KERN_DEBUG, name, fmt, ##args)
1276 
1277 #define airo_print_warn(name, fmt, args...) \
1278         airo_print(KERN_WARNING, name, fmt, ##args)
1279 
1280 #define airo_print_err(name, fmt, args...) \
1281         airo_print(KERN_ERR, name, fmt, ##args)
1282 
1283 #define AIRO_FLASH(dev) (((struct airo_info *)dev->ml_priv)->flash)
1284 
1285 /***********************************************************************
1286  *                              MIC ROUTINES                           *
1287  ***********************************************************************
1288  */
1289 
1290 static int RxSeqValid (struct airo_info *ai,miccntx *context,int mcast,u32 micSeq);
1291 static void MoveWindow(miccntx *context, u32 micSeq);
1292 static void emmh32_setseed(emmh32_context *context, u8 *pkey, int keylen,
1293                            struct crypto_cipher *tfm);
1294 static void emmh32_init(emmh32_context *context);
1295 static void emmh32_update(emmh32_context *context, u8 *pOctets, int len);
1296 static void emmh32_final(emmh32_context *context, u8 digest[4]);
1297 static int flashpchar(struct airo_info *ai,int byte,int dwelltime);
1298 
1299 static void age_mic_context(miccntx *cur, miccntx *old, u8 *key, int key_len,
1300                             struct crypto_cipher *tfm)
1301 {
1302         /* If the current MIC context is valid and its key is the same as
1303          * the MIC register, there's nothing to do.
1304          */
1305         if (cur->valid && (memcmp(cur->key, key, key_len) == 0))
1306                 return;
1307 
1308         /* Age current mic Context */
1309         memcpy(old, cur, sizeof(*cur));
1310 
1311         /* Initialize new context */
1312         memcpy(cur->key, key, key_len);
1313         cur->window  = 33; /* Window always points to the middle */
1314         cur->rx      = 0;  /* Rx Sequence numbers */
1315         cur->tx      = 0;  /* Tx sequence numbers */
1316         cur->valid   = 1;  /* Key is now valid */
1317 
1318         /* Give key to mic seed */
1319         emmh32_setseed(&cur->seed, key, key_len, tfm);
1320 }
1321 
1322 /* micinit - Initialize mic seed */
1323 
1324 static void micinit(struct airo_info *ai)
1325 {
1326         MICRid mic_rid;
1327 
1328         clear_bit(JOB_MIC, &ai->jobs);
1329         PC4500_readrid(ai, RID_MIC, &mic_rid, sizeof(mic_rid), 0);
1330         up(&ai->sem);
1331 
1332         ai->micstats.enabled = (le16_to_cpu(mic_rid.state) & 0x00FF) ? 1 : 0;
1333         if (!ai->micstats.enabled) {
1334                 /* So next time we have a valid key and mic is enabled, we will
1335                  * update the sequence number if the key is the same as before.
1336                  */
1337                 ai->mod[0].uCtx.valid = 0;
1338                 ai->mod[0].mCtx.valid = 0;
1339                 return;
1340         }
1341 
1342         if (mic_rid.multicastValid) {
1343                 age_mic_context(&ai->mod[0].mCtx, &ai->mod[1].mCtx,
1344                                 mic_rid.multicast, sizeof(mic_rid.multicast),
1345                                 ai->tfm);
1346         }
1347 
1348         if (mic_rid.unicastValid) {
1349                 age_mic_context(&ai->mod[0].uCtx, &ai->mod[1].uCtx,
1350                                 mic_rid.unicast, sizeof(mic_rid.unicast),
1351                                 ai->tfm);
1352         }
1353 }
1354 
1355 /* micsetup - Get ready for business */
1356 
1357 static int micsetup(struct airo_info *ai) {
1358         int i;
1359 
1360         if (ai->tfm == NULL)
1361                 ai->tfm = crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC);
1362 
1363         if (IS_ERR(ai->tfm)) {
1364                 airo_print_err(ai->dev->name, "failed to load transform for AES");
1365                 ai->tfm = NULL;
1366                 return ERROR;
1367         }
1368 
1369         for (i=0; i < NUM_MODULES; i++) {
1370                 memset(&ai->mod[i].mCtx,0,sizeof(miccntx));
1371                 memset(&ai->mod[i].uCtx,0,sizeof(miccntx));
1372         }
1373         return SUCCESS;
1374 }
1375 
1376 static const u8 micsnap[] = {0xAA,0xAA,0x03,0x00,0x40,0x96,0x00,0x02};
1377 
1378 /*===========================================================================
1379  * Description: Mic a packet
1380  *    
1381  *      Inputs: etherHead * pointer to an 802.3 frame
1382  *    
1383  *     Returns: BOOLEAN if successful, otherwise false.
1384  *             PacketTxLen will be updated with the mic'd packets size.
1385  *
1386  *    Caveats: It is assumed that the frame buffer will already
1387  *             be big enough to hold the largets mic message possible.
1388  *            (No memory allocation is done here).
1389  *  
1390  *    Author: sbraneky (10/15/01)
1391  *    Merciless hacks by rwilcher (1/14/02)
1392  */
1393 
1394 static int encapsulate(struct airo_info *ai ,etherHead *frame, MICBuffer *mic, int payLen)
1395 {
1396         miccntx   *context;
1397 
1398         // Determine correct context
1399         // If not adhoc, always use unicast key
1400 
1401         if (test_bit(FLAG_ADHOC, &ai->flags) && (frame->da[0] & 0x1))
1402                 context = &ai->mod[0].mCtx;
1403         else
1404                 context = &ai->mod[0].uCtx;
1405   
1406         if (!context->valid)
1407                 return ERROR;
1408 
1409         mic->typelen = htons(payLen + 16); //Length of Mic'd packet
1410 
1411         memcpy(&mic->u.snap, micsnap, sizeof(micsnap)); // Add Snap
1412 
1413         // Add Tx sequence
1414         mic->seq = htonl(context->tx);
1415         context->tx += 2;
1416 
1417         emmh32_init(&context->seed); // Mic the packet
1418         emmh32_update(&context->seed,frame->da,ETH_ALEN * 2); // DA,SA
1419         emmh32_update(&context->seed,(u8*)&mic->typelen,10); // Type/Length and Snap
1420         emmh32_update(&context->seed,(u8*)&mic->seq,sizeof(mic->seq)); //SEQ
1421         emmh32_update(&context->seed,(u8*)(frame + 1),payLen); //payload
1422         emmh32_final(&context->seed, (u8*)&mic->mic);
1423 
1424         /*    New Type/length ?????????? */
1425         mic->typelen = 0; //Let NIC know it could be an oversized packet
1426         return SUCCESS;
1427 }
1428 
1429 typedef enum {
1430     NONE,
1431     NOMIC,
1432     NOMICPLUMMED,
1433     SEQUENCE,
1434     INCORRECTMIC,
1435 } mic_error;
1436 
1437 /*===========================================================================
1438  *  Description: Decapsulates a MIC'd packet and returns the 802.3 packet
1439  *               (removes the MIC stuff) if packet is a valid packet.
1440  *      
1441  *       Inputs: etherHead  pointer to the 802.3 packet             
1442  *     
1443  *      Returns: BOOLEAN - TRUE if packet should be dropped otherwise FALSE
1444  *     
1445  *      Author: sbraneky (10/15/01)
1446  *    Merciless hacks by rwilcher (1/14/02)
1447  *---------------------------------------------------------------------------
1448  */
1449 
1450 static int decapsulate(struct airo_info *ai, MICBuffer *mic, etherHead *eth, u16 payLen)
1451 {
1452         int      i;
1453         u32      micSEQ;
1454         miccntx  *context;
1455         u8       digest[4];
1456         mic_error micError = NONE;
1457 
1458         // Check if the packet is a Mic'd packet
1459 
1460         if (!ai->micstats.enabled) {
1461                 //No Mic set or Mic OFF but we received a MIC'd packet.
1462                 if (memcmp ((u8*)eth + 14, micsnap, sizeof(micsnap)) == 0) {
1463                         ai->micstats.rxMICPlummed++;
1464                         return ERROR;
1465                 }
1466                 return SUCCESS;
1467         }
1468 
1469         if (ntohs(mic->typelen) == 0x888E)
1470                 return SUCCESS;
1471 
1472         if (memcmp (mic->u.snap, micsnap, sizeof(micsnap)) != 0) {
1473             // Mic enabled but packet isn't Mic'd
1474                 ai->micstats.rxMICPlummed++;
1475                 return ERROR;
1476         }
1477 
1478         micSEQ = ntohl(mic->seq);            //store SEQ as CPU order
1479 
1480         //At this point we a have a mic'd packet and mic is enabled
1481         //Now do the mic error checking.
1482 
1483         //Receive seq must be odd
1484         if ( (micSEQ & 1) == 0 ) {
1485                 ai->micstats.rxWrongSequence++;
1486                 return ERROR;
1487         }
1488 
1489         for (i = 0; i < NUM_MODULES; i++) {
1490                 int mcast = eth->da[0] & 1;
1491                 //Determine proper context 
1492                 context = mcast ? &ai->mod[i].mCtx : &ai->mod[i].uCtx;
1493         
1494                 //Make sure context is valid
1495                 if (!context->valid) {
1496                         if (i == 0)
1497                                 micError = NOMICPLUMMED;
1498                         continue;                
1499                 }
1500                 //DeMic it 
1501 
1502                 if (!mic->typelen)
1503                         mic->typelen = htons(payLen + sizeof(MICBuffer) - 2);
1504         
1505                 emmh32_init(&context->seed);
1506                 emmh32_update(&context->seed, eth->da, ETH_ALEN*2); 
1507                 emmh32_update(&context->seed, (u8 *)&mic->typelen, sizeof(mic->typelen)+sizeof(mic->u.snap)); 
1508                 emmh32_update(&context->seed, (u8 *)&mic->seq,sizeof(mic->seq));        
1509                 emmh32_update(&context->seed, (u8 *)(eth + 1),payLen);  
1510                 //Calculate MIC
1511                 emmh32_final(&context->seed, digest);
1512         
1513                 if (memcmp(digest, &mic->mic, 4)) { //Make sure the mics match
1514                   //Invalid Mic
1515                         if (i == 0)
1516                                 micError = INCORRECTMIC;
1517                         continue;
1518                 }
1519 
1520                 //Check Sequence number if mics pass
1521                 if (RxSeqValid(ai, context, mcast, micSEQ) == SUCCESS) {
1522                         ai->micstats.rxSuccess++;
1523                         return SUCCESS;
1524                 }
1525                 if (i == 0)
1526                         micError = SEQUENCE;
1527         }
1528 
1529         // Update statistics
1530         switch (micError) {
1531                 case NOMICPLUMMED: ai->micstats.rxMICPlummed++;   break;
1532                 case SEQUENCE:    ai->micstats.rxWrongSequence++; break;
1533                 case INCORRECTMIC: ai->micstats.rxIncorrectMIC++; break;
1534                 case NONE:  break;
1535                 case NOMIC: break;
1536         }
1537         return ERROR;
1538 }
1539 
1540 /*===========================================================================
1541  * Description:  Checks the Rx Seq number to make sure it is valid
1542  *               and hasn't already been received
1543  *   
1544  *     Inputs: miccntx - mic context to check seq against
1545  *             micSeq  - the Mic seq number
1546  *   
1547  *    Returns: TRUE if valid otherwise FALSE. 
1548  *
1549  *    Author: sbraneky (10/15/01)
1550  *    Merciless hacks by rwilcher (1/14/02)
1551  *---------------------------------------------------------------------------
1552  */
1553 
1554 static int RxSeqValid (struct airo_info *ai,miccntx *context,int mcast,u32 micSeq)
1555 {
1556         u32 seq,index;
1557 
1558         //Allow for the ap being rebooted - if it is then use the next 
1559         //sequence number of the current sequence number - might go backwards
1560 
1561         if (mcast) {
1562                 if (test_bit(FLAG_UPDATE_MULTI, &ai->flags)) {
1563                         clear_bit (FLAG_UPDATE_MULTI, &ai->flags);
1564                         context->window = (micSeq > 33) ? micSeq : 33;
1565                         context->rx     = 0;        // Reset rx
1566                 }
1567         } else if (test_bit(FLAG_UPDATE_UNI, &ai->flags)) {
1568                 clear_bit (FLAG_UPDATE_UNI, &ai->flags);
1569                 context->window = (micSeq > 33) ? micSeq : 33; // Move window
1570                 context->rx     = 0;        // Reset rx
1571         }
1572 
1573         //Make sequence number relative to START of window
1574         seq = micSeq - (context->window - 33);
1575 
1576         //Too old of a SEQ number to check.
1577         if ((s32)seq < 0)
1578                 return ERROR;
1579     
1580         if ( seq > 64 ) {
1581                 //Window is infinite forward
1582                 MoveWindow(context,micSeq);
1583                 return SUCCESS;
1584         }
1585 
1586         // We are in the window. Now check the context rx bit to see if it was already sent
1587         seq >>= 1;         //divide by 2 because we only have odd numbers
1588         index = 1 << seq;  //Get an index number
1589 
1590         if (!(context->rx & index)) {
1591                 //micSEQ falls inside the window.
1592                 //Add seqence number to the list of received numbers.
1593                 context->rx |= index;
1594 
1595                 MoveWindow(context,micSeq);
1596 
1597                 return SUCCESS;
1598         }
1599         return ERROR;
1600 }
1601 
1602 static void MoveWindow(miccntx *context, u32 micSeq)
1603 {
1604         u32 shift;
1605 
1606         //Move window if seq greater than the middle of the window
1607         if (micSeq > context->window) {
1608                 shift = (micSeq - context->window) >> 1;
1609     
1610                     //Shift out old
1611                 if (shift < 32)
1612                         context->rx >>= shift;
1613                 else
1614                         context->rx = 0;
1615 
1616                 context->window = micSeq;      //Move window
1617         }
1618 }
1619 
1620 /*==============================================*/
1621 /*========== EMMH ROUTINES  ====================*/
1622 /*==============================================*/
1623 
1624 /* mic accumulate */
1625 #define MIC_ACCUM(val)  \
1626         context->accum += (u64)(val) * context->coeff[coeff_position++];
1627 
1628 static unsigned char aes_counter[16];
1629 
1630 /* expand the key to fill the MMH coefficient array */
1631 static void emmh32_setseed(emmh32_context *context, u8 *pkey, int keylen,
1632                            struct crypto_cipher *tfm)
1633 {
1634   /* take the keying material, expand if necessary, truncate at 16-bytes */
1635   /* run through AES counter mode to generate context->coeff[] */
1636   
1637         int i,j;
1638         u32 counter;
1639         u8 *cipher, plain[16];
1640 
1641         crypto_cipher_setkey(tfm, pkey, 16);
1642         counter = 0;
1643         for (i = 0; i < ARRAY_SIZE(context->coeff); ) {
1644                 aes_counter[15] = (u8)(counter >> 0);
1645                 aes_counter[14] = (u8)(counter >> 8);
1646                 aes_counter[13] = (u8)(counter >> 16);
1647                 aes_counter[12] = (u8)(counter >> 24);
1648                 counter++;
1649                 memcpy (plain, aes_counter, 16);
1650                 crypto_cipher_encrypt_one(tfm, plain, plain);
1651                 cipher = plain;
1652                 for (j = 0; (j < 16) && (i < ARRAY_SIZE(context->coeff)); ) {
1653                         context->coeff[i++] = ntohl(*(__be32 *)&cipher[j]);
1654                         j += 4;
1655                 }
1656         }
1657 }
1658 
1659 /* prepare for calculation of a new mic */
1660 static void emmh32_init(emmh32_context *context)
1661 {
1662         /* prepare for new mic calculation */
1663         context->accum = 0;
1664         context->position = 0;
1665 }
1666 
1667 /* add some bytes to the mic calculation */
1668 static void emmh32_update(emmh32_context *context, u8 *pOctets, int len)
1669 {
1670         int     coeff_position, byte_position;
1671   
1672         if (len == 0) return;
1673   
1674         coeff_position = context->position >> 2;
1675   
1676         /* deal with partial 32-bit word left over from last update */
1677         byte_position = context->position & 3;
1678         if (byte_position) {
1679                 /* have a partial word in part to deal with */
1680                 do {
1681                         if (len == 0) return;
1682                         context->part.d8[byte_position++] = *pOctets++;
1683                         context->position++;
1684                         len--;
1685                 } while (byte_position < 4);
1686                 MIC_ACCUM(ntohl(context->part.d32));
1687         }
1688 
1689         /* deal with full 32-bit words */
1690         while (len >= 4) {
1691                 MIC_ACCUM(ntohl(*(__be32 *)pOctets));
1692                 context->position += 4;
1693                 pOctets += 4;
1694                 len -= 4;
1695         }
1696 
1697         /* deal with partial 32-bit word that will be left over from this update */
1698         byte_position = 0;
1699         while (len > 0) {
1700                 context->part.d8[byte_position++] = *pOctets++;
1701                 context->position++;
1702                 len--;
1703         }
1704 }
1705 
1706 /* mask used to zero empty bytes for final partial word */
1707 static u32 mask32[4] = { 0x00000000L, 0xFF000000L, 0xFFFF0000L, 0xFFFFFF00L };
1708 
1709 /* calculate the mic */
1710 static void emmh32_final(emmh32_context *context, u8 digest[4])
1711 {
1712         int     coeff_position, byte_position;
1713         u32     val;
1714   
1715         u64 sum, utmp;
1716         s64 stmp;
1717 
1718         coeff_position = context->position >> 2;
1719   
1720         /* deal with partial 32-bit word left over from last update */
1721         byte_position = context->position & 3;
1722         if (byte_position) {
1723                 /* have a partial word in part to deal with */
1724                 val = ntohl(context->part.d32);
1725                 MIC_ACCUM(val & mask32[byte_position]); /* zero empty bytes */
1726         }
1727 
1728         /* reduce the accumulated u64 to a 32-bit MIC */
1729         sum = context->accum;
1730         stmp = (sum  & 0xffffffffLL) - ((sum >> 32)  * 15);
1731         utmp = (stmp & 0xffffffffLL) - ((stmp >> 32) * 15);
1732         sum = utmp & 0xffffffffLL;
1733         if (utmp > 0x10000000fLL)
1734                 sum -= 15;
1735 
1736         val = (u32)sum;
1737         digest[0] = (val>>24) & 0xFF;
1738         digest[1] = (val>>16) & 0xFF;
1739         digest[2] = (val>>8) & 0xFF;
1740         digest[3] = val & 0xFF;
1741 }
1742 
1743 static int readBSSListRid(struct airo_info *ai, int first,
1744                       BSSListRid *list)
1745 {
1746         Cmd cmd;
1747         Resp rsp;
1748 
1749         if (first == 1) {
1750                 if (ai->flags & FLAG_RADIO_MASK) return -ENETDOWN;
1751                 memset(&cmd, 0, sizeof(cmd));
1752                 cmd.cmd=CMD_LISTBSS;
1753                 if (down_interruptible(&ai->sem))
1754                         return -ERESTARTSYS;
1755                 ai->list_bss_task = current;
1756                 issuecommand(ai, &cmd, &rsp);
1757                 up(&ai->sem);
1758                 /* Let the command take effect */
1759                 schedule_timeout_uninterruptible(3 * HZ);
1760                 ai->list_bss_task = NULL;
1761         }
1762         return PC4500_readrid(ai, first ? ai->bssListFirst : ai->bssListNext,
1763                             list, ai->bssListRidLen, 1);
1764 }
1765 
1766 static int readWepKeyRid(struct airo_info *ai, WepKeyRid *wkr, int temp, int lock)
1767 {
1768         return PC4500_readrid(ai, temp ? RID_WEP_TEMP : RID_WEP_PERM,
1769                                 wkr, sizeof(*wkr), lock);
1770 }
1771 
1772 static int writeWepKeyRid(struct airo_info *ai, WepKeyRid *wkr, int perm, int lock)
1773 {
1774         int rc;
1775         rc = PC4500_writerid(ai, RID_WEP_TEMP, wkr, sizeof(*wkr), lock);
1776         if (rc!=SUCCESS)
1777                 airo_print_err(ai->dev->name, "WEP_TEMP set %x", rc);
1778         if (perm) {
1779                 rc = PC4500_writerid(ai, RID_WEP_PERM, wkr, sizeof(*wkr), lock);
1780                 if (rc!=SUCCESS)
1781                         airo_print_err(ai->dev->name, "WEP_PERM set %x", rc);
1782         }
1783         return rc;
1784 }
1785 
1786 static int readSsidRid(struct airo_info*ai, SsidRid *ssidr)
1787 {
1788         return PC4500_readrid(ai, RID_SSID, ssidr, sizeof(*ssidr), 1);
1789 }
1790 
1791 static int writeSsidRid(struct airo_info*ai, SsidRid *pssidr, int lock)
1792 {
1793         return PC4500_writerid(ai, RID_SSID, pssidr, sizeof(*pssidr), lock);
1794 }
1795 
1796 static int readConfigRid(struct airo_info *ai, int lock)
1797 {
1798         int rc;
1799         ConfigRid cfg;
1800 
1801         if (ai->config.len)
1802                 return SUCCESS;
1803 
1804         rc = PC4500_readrid(ai, RID_ACTUALCONFIG, &cfg, sizeof(cfg), lock);
1805         if (rc != SUCCESS)
1806                 return rc;
1807 
1808         ai->config = cfg;
1809         return SUCCESS;
1810 }
1811 
1812 static inline void checkThrottle(struct airo_info *ai)
1813 {
1814         int i;
1815 /* Old hardware had a limit on encryption speed */
1816         if (ai->config.authType != AUTH_OPEN && maxencrypt) {
1817                 for(i=0; i<8; i++) {
1818                         if (ai->config.rates[i] > maxencrypt) {
1819                                 ai->config.rates[i] = 0;
1820                         }
1821                 }
1822         }
1823 }
1824 
1825 static int writeConfigRid(struct airo_info *ai, int lock)
1826 {
1827         ConfigRid cfgr;
1828 
1829         if (!test_bit (FLAG_COMMIT, &ai->flags))
1830                 return SUCCESS;
1831 
1832         clear_bit (FLAG_COMMIT, &ai->flags);
1833         clear_bit (FLAG_RESET, &ai->flags);
1834         checkThrottle(ai);
1835         cfgr = ai->config;
1836 
1837         if ((cfgr.opmode & MODE_CFG_MASK) == MODE_STA_IBSS)
1838                 set_bit(FLAG_ADHOC, &ai->flags);
1839         else
1840                 clear_bit(FLAG_ADHOC, &ai->flags);
1841 
1842         return PC4500_writerid( ai, RID_CONFIG, &cfgr, sizeof(cfgr), lock);
1843 }
1844 
1845 static int readStatusRid(struct airo_info *ai, StatusRid *statr, int lock)
1846 {
1847         return PC4500_readrid(ai, RID_STATUS, statr, sizeof(*statr), lock);
1848 }
1849 
1850 static int readAPListRid(struct airo_info *ai, APListRid *aplr)
1851 {
1852         return PC4500_readrid(ai, RID_APLIST, aplr, sizeof(*aplr), 1);
1853 }
1854 
1855 static int writeAPListRid(struct airo_info *ai, APListRid *aplr, int lock)
1856 {
1857         return PC4500_writerid(ai, RID_APLIST, aplr, sizeof(*aplr), lock);
1858 }
1859 
1860 static int readCapabilityRid(struct airo_info *ai, CapabilityRid *capr, int lock)
1861 {
1862         return PC4500_readrid(ai, RID_CAPABILITIES, capr, sizeof(*capr), lock);
1863 }
1864 
1865 static int readStatsRid(struct airo_info*ai, StatsRid *sr, int rid, int lock)
1866 {
1867         return PC4500_readrid(ai, rid, sr, sizeof(*sr), lock);
1868 }
1869 
1870 static void try_auto_wep(struct airo_info *ai)
1871 {
1872         if (auto_wep && !test_bit(FLAG_RADIO_DOWN, &ai->flags)) {
1873                 ai->expires = RUN_AT(3*HZ);
1874                 wake_up_interruptible(&ai->thr_wait);
1875         }
1876 }
1877 
1878 static int airo_open(struct net_device *dev) {
1879         struct airo_info *ai = dev->ml_priv;
1880         int rc = 0;
1881 
1882         if (test_bit(FLAG_FLASHING, &ai->flags))
1883                 return -EIO;
1884 
1885         /* Make sure the card is configured.
1886          * Wireless Extensions may postpone config changes until the card
1887          * is open (to pipeline changes and speed-up card setup). If
1888          * those changes are not yet committed, do it now - Jean II */
1889         if (test_bit(FLAG_COMMIT, &ai->flags)) {
1890                 disable_MAC(ai, 1);
1891                 writeConfigRid(ai, 1);
1892         }
1893 
1894         if (ai->wifidev != dev) {
1895                 clear_bit(JOB_DIE, &ai->jobs);
1896                 ai->airo_thread_task = kthread_run(airo_thread, dev, "%s",
1897                                                    dev->name);
1898                 if (IS_ERR(ai->airo_thread_task))
1899                         return (int)PTR_ERR(ai->airo_thread_task);
1900 
1901                 rc = request_irq(dev->irq, airo_interrupt, IRQF_SHARED,
1902                         dev->name, dev);
1903                 if (rc) {
1904                         airo_print_err(dev->name,
1905                                 "register interrupt %d failed, rc %d",
1906                                 dev->irq, rc);
1907                         set_bit(JOB_DIE, &ai->jobs);
1908                         kthread_stop(ai->airo_thread_task);
1909                         return rc;
1910                 }
1911 
1912                 /* Power on the MAC controller (which may have been disabled) */
1913                 clear_bit(FLAG_RADIO_DOWN, &ai->flags);
1914                 enable_interrupts(ai);
1915 
1916                 try_auto_wep(ai);
1917         }
1918         enable_MAC(ai, 1);
1919 
1920         netif_start_queue(dev);
1921         return 0;
1922 }
1923 
1924 static netdev_tx_t mpi_start_xmit(struct sk_buff *skb,
1925                                         struct net_device *dev)
1926 {
1927         int npacks, pending;
1928         unsigned long flags;
1929         struct airo_info *ai = dev->ml_priv;
1930 
1931         if (!skb) {
1932                 airo_print_err(dev->name, "%s: skb == NULL!",__func__);
1933                 return NETDEV_TX_OK;
1934         }
1935         npacks = skb_queue_len (&ai->txq);
1936 
1937         if (npacks >= MAXTXQ - 1) {
1938                 netif_stop_queue (dev);
1939                 if (npacks > MAXTXQ) {
1940                         dev->stats.tx_fifo_errors++;
1941                         return NETDEV_TX_BUSY;
1942                 }
1943                 skb_queue_tail (&ai->txq, skb);
1944                 return NETDEV_TX_OK;
1945         }
1946 
1947         spin_lock_irqsave(&ai->aux_lock, flags);
1948         skb_queue_tail (&ai->txq, skb);
1949         pending = test_bit(FLAG_PENDING_XMIT, &ai->flags);
1950         spin_unlock_irqrestore(&ai->aux_lock,flags);
1951         netif_wake_queue (dev);
1952 
1953         if (pending == 0) {
1954                 set_bit(FLAG_PENDING_XMIT, &ai->flags);
1955                 mpi_send_packet (dev);
1956         }
1957         return NETDEV_TX_OK;
1958 }
1959 
1960 /*
1961  * @mpi_send_packet
1962  *
1963  * Attempt to transmit a packet. Can be called from interrupt
1964  * or transmit . return number of packets we tried to send
1965  */
1966 
1967 static int mpi_send_packet (struct net_device *dev)
1968 {
1969         struct sk_buff *skb;
1970         unsigned char *buffer;
1971         s16 len;
1972         __le16 *payloadLen;
1973         struct airo_info *ai = dev->ml_priv;
1974         u8 *sendbuf;
1975 
1976         /* get a packet to send */
1977 
1978         if ((skb = skb_dequeue(&ai->txq)) == NULL) {
1979                 airo_print_err(dev->name,
1980                         "%s: Dequeue'd zero in send_packet()",
1981                         __func__);
1982                 return 0;
1983         }
1984 
1985         /* check min length*/
1986         len = ETH_ZLEN < skb->len ? skb->len : ETH_ZLEN;
1987         buffer = skb->data;
1988 
1989         ai->txfids[0].tx_desc.offset = 0;
1990         ai->txfids[0].tx_desc.valid = 1;
1991         ai->txfids[0].tx_desc.eoc = 1;
1992         ai->txfids[0].tx_desc.len =len+sizeof(WifiHdr);
1993 
1994 /*
1995  * Magic, the cards firmware needs a length count (2 bytes) in the host buffer
1996  * right after  TXFID_HDR.The TXFID_HDR contains the status short so payloadlen
1997  * is immediately after it. ------------------------------------------------
1998  *                         |TXFIDHDR+STATUS|PAYLOADLEN|802.3HDR|PACKETDATA|
1999  *                         ------------------------------------------------
2000  */
2001 
2002         memcpy(ai->txfids[0].virtual_host_addr,
2003                 (char *)&wifictlhdr8023, sizeof(wifictlhdr8023));
2004 
2005         payloadLen = (__le16 *)(ai->txfids[0].virtual_host_addr +
2006                 sizeof(wifictlhdr8023));
2007         sendbuf = ai->txfids[0].virtual_host_addr +
2008                 sizeof(wifictlhdr8023) + 2 ;
2009 
2010         /*
2011          * Firmware automatically puts 802 header on so
2012          * we don't need to account for it in the length
2013          */
2014         if (test_bit(FLAG_MIC_CAPABLE, &ai->flags) && ai->micstats.enabled &&
2015                 (ntohs(((__be16 *)buffer)[6]) != 0x888E)) {
2016                 MICBuffer pMic;
2017 
2018                 if (encapsulate(ai, (etherHead *)buffer, &pMic, len - sizeof(etherHead)) != SUCCESS)
2019                         return ERROR;
2020 
2021                 *payloadLen = cpu_to_le16(len-sizeof(etherHead)+sizeof(pMic));
2022                 ai->txfids[0].tx_desc.len += sizeof(pMic);
2023                 /* copy data into airo dma buffer */
2024                 memcpy (sendbuf, buffer, sizeof(etherHead));
2025                 buffer += sizeof(etherHead);
2026                 sendbuf += sizeof(etherHead);
2027                 memcpy (sendbuf, &pMic, sizeof(pMic));
2028                 sendbuf += sizeof(pMic);
2029                 memcpy (sendbuf, buffer, len - sizeof(etherHead));
2030         } else {
2031                 *payloadLen = cpu_to_le16(len - sizeof(etherHead));
2032 
2033                 dev->trans_start = jiffies;
2034 
2035                 /* copy data into airo dma buffer */
2036                 memcpy(sendbuf, buffer, len);
2037         }
2038 
2039         memcpy_toio(ai->txfids[0].card_ram_off,
2040                 &ai->txfids[0].tx_desc, sizeof(TxFid));
2041 
2042         OUT4500(ai, EVACK, 8);
2043 
2044         dev_kfree_skb_any(skb);
2045         return 1;
2046 }
2047 
2048 static void get_tx_error(struct airo_info *ai, s32 fid)
2049 {
2050         __le16 status;
2051 
2052         if (fid < 0)
2053                 status = ((WifiCtlHdr *)ai->txfids[0].virtual_host_addr)->ctlhdr.status;
2054         else {
2055                 if (bap_setup(ai, ai->fids[fid] & 0xffff, 4, BAP0) != SUCCESS)
2056                         return;
2057                 bap_read(ai, &status, 2, BAP0);
2058         }
2059         if (le16_to_cpu(status) & 2) /* Too many retries */
2060                 ai->dev->stats.tx_aborted_errors++;
2061         if (le16_to_cpu(status) & 4) /* Transmit lifetime exceeded */
2062                 ai->dev->stats.tx_heartbeat_errors++;
2063         if (le16_to_cpu(status) & 8) /* Aid fail */
2064                 { }
2065         if (le16_to_cpu(status) & 0x10) /* MAC disabled */
2066                 ai->dev->stats.tx_carrier_errors++;
2067         if (le16_to_cpu(status) & 0x20) /* Association lost */
2068                 { }
2069         /* We produce a TXDROP event only for retry or lifetime
2070          * exceeded, because that's the only status that really mean
2071          * that this particular node went away.
2072          * Other errors means that *we* screwed up. - Jean II */
2073         if ((le16_to_cpu(status) & 2) ||
2074              (le16_to_cpu(status) & 4)) {
2075                 union iwreq_data        wrqu;
2076                 char junk[0x18];
2077 
2078                 /* Faster to skip over useless data than to do
2079                  * another bap_setup(). We are at offset 0x6 and
2080                  * need to go to 0x18 and read 6 bytes - Jean II */
2081                 bap_read(ai, (__le16 *) junk, 0x18, BAP0);
2082 
2083                 /* Copy 802.11 dest address.
2084                  * We use the 802.11 header because the frame may
2085                  * not be 802.3 or may be mangled...
2086                  * In Ad-Hoc mode, it will be the node address.
2087                  * In managed mode, it will be most likely the AP addr
2088                  * User space will figure out how to convert it to
2089                  * whatever it needs (IP address or else).
2090                  * - Jean II */
2091                 memcpy(wrqu.addr.sa_data, junk + 0x12, ETH_ALEN);
2092                 wrqu.addr.sa_family = ARPHRD_ETHER;
2093 
2094                 /* Send event to user space */
2095                 wireless_send_event(ai->dev, IWEVTXDROP, &wrqu, NULL);
2096         }
2097 }
2098 
2099 static void airo_end_xmit(struct net_device *dev) {
2100         u16 status;
2101         int i;
2102         struct airo_info *priv = dev->ml_priv;
2103         struct sk_buff *skb = priv->xmit.skb;
2104         int fid = priv->xmit.fid;
2105         u32 *fids = priv->fids;
2106 
2107         clear_bit(JOB_XMIT, &priv->jobs);
2108         clear_bit(FLAG_PENDING_XMIT, &priv->flags);
2109         status = transmit_802_3_packet (priv, fids[fid], skb->data);
2110         up(&priv->sem);
2111 
2112         i = 0;
2113         if ( status == SUCCESS ) {
2114                 dev->trans_start = jiffies;
2115                 for (; i < MAX_FIDS / 2 && (priv->fids[i] & 0xffff0000); i++);
2116         } else {
2117                 priv->fids[fid] &= 0xffff;
2118                 dev->stats.tx_window_errors++;
2119         }
2120         if (i < MAX_FIDS / 2)
2121                 netif_wake_queue(dev);
2122         dev_kfree_skb(skb);
2123 }
2124 
2125 static netdev_tx_t airo_start_xmit(struct sk_buff *skb,
2126                                          struct net_device *dev)
2127 {
2128         s16 len;
2129         int i, j;
2130         struct airo_info *priv = dev->ml_priv;
2131         u32 *fids = priv->fids;
2132 
2133         if ( skb == NULL ) {
2134                 airo_print_err(dev->name, "%s: skb == NULL!", __func__);
2135                 return NETDEV_TX_OK;
2136         }
2137 
2138         /* Find a vacant FID */
2139         for( i = 0; i < MAX_FIDS / 2 && (fids[i] & 0xffff0000); i++ );
2140         for( j = i + 1; j < MAX_FIDS / 2 && (fids[j] & 0xffff0000); j++ );
2141 
2142         if ( j >= MAX_FIDS / 2 ) {
2143                 netif_stop_queue(dev);
2144 
2145                 if (i == MAX_FIDS / 2) {
2146                         dev->stats.tx_fifo_errors++;
2147                         return NETDEV_TX_BUSY;
2148                 }
2149         }
2150         /* check min length*/
2151         len = ETH_ZLEN < skb->len ? skb->len : ETH_ZLEN;
2152         /* Mark fid as used & save length for later */
2153         fids[i] |= (len << 16);
2154         priv->xmit.skb = skb;
2155         priv->xmit.fid = i;
2156         if (down_trylock(&priv->sem) != 0) {
2157                 set_bit(FLAG_PENDING_XMIT, &priv->flags);
2158                 netif_stop_queue(dev);
2159                 set_bit(JOB_XMIT, &priv->jobs);
2160                 wake_up_interruptible(&priv->thr_wait);
2161         } else
2162                 airo_end_xmit(dev);
2163         return NETDEV_TX_OK;
2164 }
2165 
2166 static void airo_end_xmit11(struct net_device *dev) {
2167         u16 status;
2168         int i;
2169         struct airo_info *priv = dev->ml_priv;
2170         struct sk_buff *skb = priv->xmit11.skb;
2171         int fid = priv->xmit11.fid;
2172         u32 *fids = priv->fids;
2173 
2174         clear_bit(JOB_XMIT11, &priv->jobs);
2175         clear_bit(FLAG_PENDING_XMIT11, &priv->flags);
2176         status = transmit_802_11_packet (priv, fids[fid], skb->data);
2177         up(&priv->sem);
2178 
2179         i = MAX_FIDS / 2;
2180         if ( status == SUCCESS ) {
2181                 dev->trans_start = jiffies;
2182                 for (; i < MAX_FIDS && (priv->fids[i] & 0xffff0000); i++);
2183         } else {
2184                 priv->fids[fid] &= 0xffff;
2185                 dev->stats.tx_window_errors++;
2186         }
2187         if (i < MAX_FIDS)
2188                 netif_wake_queue(dev);
2189         dev_kfree_skb(skb);
2190 }
2191 
2192 static netdev_tx_t airo_start_xmit11(struct sk_buff *skb,
2193                                            struct net_device *dev)
2194 {
2195         s16 len;
2196         int i, j;
2197         struct airo_info *priv = dev->ml_priv;
2198         u32 *fids = priv->fids;
2199 
2200         if (test_bit(FLAG_MPI, &priv->flags)) {
2201                 /* Not implemented yet for MPI350 */
2202                 netif_stop_queue(dev);
2203                 dev_kfree_skb_any(skb);
2204                 return NETDEV_TX_OK;
2205         }
2206 
2207         if ( skb == NULL ) {
2208                 airo_print_err(dev->name, "%s: skb == NULL!", __func__);
2209                 return NETDEV_TX_OK;
2210         }
2211 
2212         /* Find a vacant FID */
2213         for( i = MAX_FIDS / 2; i < MAX_FIDS && (fids[i] & 0xffff0000); i++ );
2214         for( j = i + 1; j < MAX_FIDS && (fids[j] & 0xffff0000); j++ );
2215 
2216         if ( j >= MAX_FIDS ) {
2217                 netif_stop_queue(dev);
2218 
2219                 if (i == MAX_FIDS) {
2220                         dev->stats.tx_fifo_errors++;
2221                         return NETDEV_TX_BUSY;
2222                 }
2223         }
2224         /* check min length*/
2225         len = ETH_ZLEN < skb->len ? skb->len : ETH_ZLEN;
2226         /* Mark fid as used & save length for later */
2227         fids[i] |= (len << 16);
2228         priv->xmit11.skb = skb;
2229         priv->xmit11.fid = i;
2230         if (down_trylock(&priv->sem) != 0) {
2231                 set_bit(FLAG_PENDING_XMIT11, &priv->flags);
2232                 netif_stop_queue(dev);
2233                 set_bit(JOB_XMIT11, &priv->jobs);
2234                 wake_up_interruptible(&priv->thr_wait);
2235         } else
2236                 airo_end_xmit11(dev);
2237         return NETDEV_TX_OK;
2238 }
2239 
2240 static void airo_read_stats(struct net_device *dev)
2241 {
2242         struct airo_info *ai = dev->ml_priv;
2243         StatsRid stats_rid;
2244         __le32 *vals = stats_rid.vals;
2245 
2246         clear_bit(JOB_STATS, &ai->jobs);
2247         if (ai->power.event) {
2248                 up(&ai->sem);
2249                 return;
2250         }
2251         readStatsRid(ai, &stats_rid, RID_STATS, 0);
2252         up(&ai->sem);
2253 
2254         dev->stats.rx_packets = le32_to_cpu(vals[43]) + le32_to_cpu(vals[44]) +
2255                                le32_to_cpu(vals[45]);
2256         dev->stats.tx_packets = le32_to_cpu(vals[39]) + le32_to_cpu(vals[40]) +
2257                                le32_to_cpu(vals[41]);
2258         dev->stats.rx_bytes = le32_to_cpu(vals[92]);
2259         dev->stats.tx_bytes = le32_to_cpu(vals[91]);
2260         dev->stats.rx_errors = le32_to_cpu(vals[0]) + le32_to_cpu(vals[2]) +
2261                               le32_to_cpu(vals[3]) + le32_to_cpu(vals[4]);
2262         dev->stats.tx_errors = le32_to_cpu(vals[42]) +
2263                               dev->stats.tx_fifo_errors;
2264         dev->stats.multicast = le32_to_cpu(vals[43]);
2265         dev->stats.collisions = le32_to_cpu(vals[89]);
2266 
2267         /* detailed rx_errors: */
2268         dev->stats.rx_length_errors = le32_to_cpu(vals[3]);
2269         dev->stats.rx_crc_errors = le32_to_cpu(vals[4]);
2270         dev->stats.rx_frame_errors = le32_to_cpu(vals[2]);
2271         dev->stats.rx_fifo_errors = le32_to_cpu(vals[0]);
2272 }
2273 
2274 static struct net_device_stats *airo_get_stats(struct net_device *dev)
2275 {
2276         struct airo_info *local =  dev->ml_priv;
2277 
2278         if (!test_bit(JOB_STATS, &local->jobs)) {
2279                 /* Get stats out of the card if available */
2280                 if (down_trylock(&local->sem) != 0) {
2281                         set_bit(JOB_STATS, &local->jobs);
2282                         wake_up_interruptible(&local->thr_wait);
2283                 } else
2284                         airo_read_stats(dev);
2285         }
2286 
2287         return &dev->stats;
2288 }
2289 
2290 static void airo_set_promisc(struct airo_info *ai) {
2291         Cmd cmd;
2292         Resp rsp;
2293 
2294         memset(&cmd, 0, sizeof(cmd));
2295         cmd.cmd=CMD_SETMODE;
2296         clear_bit(JOB_PROMISC, &ai->jobs);
2297         cmd.parm0=(ai->flags&IFF_PROMISC) ? PROMISC : NOPROMISC;
2298         issuecommand(ai, &cmd, &rsp);
2299         up(&ai->sem);
2300 }
2301 
2302 static void airo_set_multicast_list(struct net_device *dev) {
2303         struct airo_info *ai = dev->ml_priv;
2304 
2305         if ((dev->flags ^ ai->flags) & IFF_PROMISC) {
2306                 change_bit(FLAG_PROMISC, &ai->flags);
2307                 if (down_trylock(&ai->sem) != 0) {
2308                         set_bit(JOB_PROMISC, &ai->jobs);
2309                         wake_up_interruptible(&ai->thr_wait);
2310                 } else
2311                         airo_set_promisc(ai);
2312         }
2313 
2314         if ((dev->flags&IFF_ALLMULTI) || !netdev_mc_empty(dev)) {
2315                 /* Turn on multicast.  (Should be already setup...) */
2316         }
2317 }
2318 
2319 static int airo_set_mac_address(struct net_device *dev, void *p)
2320 {
2321         struct airo_info *ai = dev->ml_priv;
2322         struct sockaddr *addr = p;
2323 
2324         readConfigRid(ai, 1);
2325         memcpy (ai->config.macAddr, addr->sa_data, dev->addr_len);
2326         set_bit (FLAG_COMMIT, &ai->flags);
2327         disable_MAC(ai, 1);
2328         writeConfigRid (ai, 1);
2329         enable_MAC(ai, 1);
2330         memcpy (ai->dev->dev_addr, addr->sa_data, dev->addr_len);
2331         if (ai->wifidev)
2332                 memcpy (ai->wifidev->dev_addr, addr->sa_data, dev->addr_len);
2333         return 0;
2334 }
2335 
2336 static int airo_change_mtu(struct net_device *dev, int new_mtu)
2337 {
2338         if ((new_mtu < 68) || (new_mtu > 2400))
2339                 return -EINVAL;
2340         dev->mtu = new_mtu;
2341         return 0;
2342 }
2343 
2344 static LIST_HEAD(airo_devices);
2345 
2346 static void add_airo_dev(struct airo_info *ai)
2347 {
2348         /* Upper layers already keep track of PCI devices,
2349          * so we only need to remember our non-PCI cards. */
2350         if (!ai->pci)
2351                 list_add_tail(&ai->dev_list, &airo_devices);
2352 }
2353 
2354 static void del_airo_dev(struct airo_info *ai)
2355 {
2356         if (!ai->pci)
2357                 list_del(&ai->dev_list);
2358 }
2359 
2360 static int airo_close(struct net_device *dev) {
2361         struct airo_info *ai = dev->ml_priv;
2362 
2363         netif_stop_queue(dev);
2364 
2365         if (ai->wifidev != dev) {
2366 #ifdef POWER_ON_DOWN
2367                 /* Shut power to the card. The idea is that the user can save
2368                  * power when he doesn't need the card with "ifconfig down".
2369                  * That's the method that is most friendly towards the network
2370                  * stack (i.e. the network stack won't try to broadcast
2371                  * anything on the interface and routes are gone. Jean II */
2372                 set_bit(FLAG_RADIO_DOWN, &ai->flags);
2373                 disable_MAC(ai, 1);
2374 #endif
2375                 disable_interrupts( ai );
2376 
2377                 free_irq(dev->irq, dev);
2378 
2379                 set_bit(JOB_DIE, &ai->jobs);
2380                 kthread_stop(ai->airo_thread_task);
2381         }
2382         return 0;
2383 }
2384 
2385 void stop_airo_card( struct net_device *dev, int freeres )
2386 {
2387         struct airo_info *ai = dev->ml_priv;
2388 
2389         set_bit(FLAG_RADIO_DOWN, &ai->flags);
2390         disable_MAC(ai, 1);
2391         disable_interrupts(ai);
2392         takedown_proc_entry( dev, ai );
2393         if (test_bit(FLAG_REGISTERED, &ai->flags)) {
2394                 unregister_netdev( dev );
2395                 if (ai->wifidev) {
2396                         unregister_netdev(ai->wifidev);
2397                         free_netdev(ai->wifidev);
2398                         ai->wifidev = NULL;
2399                 }
2400                 clear_bit(FLAG_REGISTERED, &ai->flags);
2401         }
2402         /*
2403          * Clean out tx queue
2404          */
2405         if (test_bit(FLAG_MPI, &ai->flags) && !skb_queue_empty(&ai->txq)) {
2406                 struct sk_buff *skb = NULL;
2407                 for (;(skb = skb_dequeue(&ai->txq));)
2408                         dev_kfree_skb(skb);
2409         }
2410 
2411         airo_networks_free (ai);
2412 
2413         kfree(ai->flash);
2414         kfree(ai->rssi);
2415         kfree(ai->APList);
2416         kfree(ai->SSID);
2417         if (freeres) {
2418                 /* PCMCIA frees this stuff, so only for PCI and ISA */
2419                 release_region( dev->base_addr, 64 );
2420                 if (test_bit(FLAG_MPI, &ai->flags)) {
2421                         if (ai->pci)
2422                                 mpi_unmap_card(ai->pci);
2423                         if (ai->pcimem)
2424                                 iounmap(ai->pcimem);
2425                         if (ai->pciaux)
2426                                 iounmap(ai->pciaux);
2427                         pci_free_consistent(ai->pci, PCI_SHARED_LEN,
2428                                 ai->shared, ai->shared_dma);
2429                 }
2430         }
2431         crypto_free_cipher(ai->tfm);
2432         del_airo_dev(ai);
2433         free_netdev( dev );
2434 }
2435 
2436 EXPORT_SYMBOL(stop_airo_card);
2437 
2438 static int wll_header_parse(const struct sk_buff *skb, unsigned char *haddr)
2439 {
2440         memcpy(haddr, skb_mac_header(skb) + 10, ETH_ALEN);
2441         return ETH_ALEN;
2442 }
2443 
2444 static void mpi_unmap_card(struct pci_dev *pci)
2445 {
2446         unsigned long mem_start = pci_resource_start(pci, 1);
2447         unsigned long mem_len = pci_resource_len(pci, 1);
2448         unsigned long aux_start = pci_resource_start(pci, 2);
2449         unsigned long aux_len = AUXMEMSIZE;
2450 
2451         release_mem_region(aux_start, aux_len);
2452         release_mem_region(mem_start, mem_len);
2453 }
2454 
2455 /*************************************************************
2456  *  This routine assumes that descriptors have been setup .
2457  *  Run at insmod time or after reset  when the decriptors
2458  *  have been initialized . Returns 0 if all is well nz
2459  *  otherwise . Does not allocate memory but sets up card
2460  *  using previously allocated descriptors.
2461  */
2462 static int mpi_init_descriptors (struct airo_info *ai)
2463 {
2464         Cmd cmd;
2465         Resp rsp;
2466         int i;
2467         int rc = SUCCESS;
2468 
2469         /* Alloc  card RX descriptors */
2470         netif_stop_queue(ai->dev);
2471 
2472         memset(&rsp,0,sizeof(rsp));
2473         memset(&cmd,0,sizeof(cmd));
2474 
2475         cmd.cmd = CMD_ALLOCATEAUX;
2476         cmd.parm0 = FID_RX;
2477         cmd.parm1 = (ai->rxfids[0].card_ram_off - ai->pciaux);
2478         cmd.parm2 = MPI_MAX_FIDS;
2479         rc=issuecommand(ai, &cmd, &rsp);
2480         if (rc != SUCCESS) {
2481                 airo_print_err(ai->dev->name, "Couldn't allocate RX FID");
2482                 return rc;
2483         }
2484 
2485         for (i=0; i<MPI_MAX_FIDS; i++) {
2486                 memcpy_toio(ai->rxfids[i].card_ram_off,
2487                         &ai->rxfids[i].rx_desc, sizeof(RxFid));
2488         }
2489 
2490         /* Alloc card TX descriptors */
2491 
2492         memset(&rsp,0,sizeof(rsp));
2493         memset(&cmd,0,sizeof(cmd));
2494 
2495         cmd.cmd = CMD_ALLOCATEAUX;
2496         cmd.parm0 = FID_TX;
2497         cmd.parm1 = (ai->txfids[0].card_ram_off - ai->pciaux);
2498         cmd.parm2 = MPI_MAX_FIDS;
2499 
2500         for (i=0; i<MPI_MAX_FIDS; i++) {
2501                 ai->txfids[i].tx_desc.valid = 1;
2502                 memcpy_toio(ai->txfids[i].card_ram_off,
2503                         &ai->txfids[i].tx_desc, sizeof(TxFid));
2504         }
2505         ai->txfids[i-1].tx_desc.eoc = 1; /* Last descriptor has EOC set */
2506 
2507         rc=issuecommand(ai, &cmd, &rsp);
2508         if (rc != SUCCESS) {
2509                 airo_print_err(ai->dev->name, "Couldn't allocate TX FID");
2510                 return rc;
2511         }
2512 
2513         /* Alloc card Rid descriptor */
2514         memset(&rsp,0,sizeof(rsp));
2515         memset(&cmd,0,sizeof(cmd));
2516 
2517         cmd.cmd = CMD_ALLOCATEAUX;
2518         cmd.parm0 = RID_RW;
2519         cmd.parm1 = (ai->config_desc.card_ram_off - ai->pciaux);
2520         cmd.parm2 = 1; /* Magic number... */
2521         rc=issuecommand(ai, &cmd, &rsp);
2522         if (rc != SUCCESS) {
2523                 airo_print_err(ai->dev->name, "Couldn't allocate RID");
2524                 return rc;
2525         }
2526 
2527         memcpy_toio(ai->config_desc.card_ram_off,
2528                 &ai->config_desc.rid_desc, sizeof(Rid));
2529 
2530         return rc;
2531 }
2532 
2533 /*
2534  * We are setting up three things here:
2535  * 1) Map AUX memory for descriptors: Rid, TxFid, or RxFid.
2536  * 2) Map PCI memory for issuing commands.
2537  * 3) Allocate memory (shared) to send and receive ethernet frames.
2538  */
2539 static int mpi_map_card(struct airo_info *ai, struct pci_dev *pci)
2540 {
2541         unsigned long mem_start, mem_len, aux_start, aux_len;
2542         int rc = -1;
2543         int i;
2544         dma_addr_t busaddroff;
2545         unsigned char *vpackoff;
2546         unsigned char __iomem *pciaddroff;
2547 
2548         mem_start = pci_resource_start(pci, 1);
2549         mem_len = pci_resource_len(pci, 1);
2550         aux_start = pci_resource_start(pci, 2);
2551         aux_len = AUXMEMSIZE;
2552 
2553         if (!request_mem_region(mem_start, mem_len, DRV_NAME)) {
2554                 airo_print_err("", "Couldn't get region %x[%x]",
2555                         (int)mem_start, (int)mem_len);
2556                 goto out;
2557         }
2558         if (!request_mem_region(aux_start, aux_len, DRV_NAME)) {
2559                 airo_print_err("", "Couldn't get region %x[%x]",
2560                         (int)aux_start, (int)aux_len);
2561                 goto free_region1;
2562         }
2563 
2564         ai->pcimem = ioremap(mem_start, mem_len);
2565         if (!ai->pcimem) {
2566                 airo_print_err("", "Couldn't map region %x[%x]",
2567                         (int)mem_start, (int)mem_len);
2568                 goto free_region2;
2569         }
2570         ai->pciaux = ioremap(aux_start, aux_len);
2571         if (!ai->pciaux) {
2572                 airo_print_err("", "Couldn't map region %x[%x]",
2573                         (int)aux_start, (int)aux_len);
2574                 goto free_memmap;
2575         }
2576 
2577         /* Reserve PKTSIZE for each fid and 2K for the Rids */
2578         ai->shared = pci_alloc_consistent(pci, PCI_SHARED_LEN, &ai->shared_dma);
2579         if (!ai->shared) {
2580                 airo_print_err("", "Couldn't alloc_consistent %d",
2581                         PCI_SHARED_LEN);
2582                 goto free_auxmap;
2583         }
2584 
2585         /*
2586          * Setup descriptor RX, TX, CONFIG
2587          */
2588         busaddroff = ai->shared_dma;
2589         pciaddroff = ai->pciaux + AUX_OFFSET;
2590         vpackoff   = ai->shared;
2591 
2592         /* RX descriptor setup */
2593         for(i = 0; i < MPI_MAX_FIDS; i++) {
2594                 ai->rxfids[i].pending = 0;
2595                 ai->rxfids[i].card_ram_off = pciaddroff;
2596                 ai->rxfids[i].virtual_host_addr = vpackoff;
2597                 ai->rxfids[i].rx_desc.host_addr = busaddroff;
2598                 ai->rxfids[i].rx_desc.valid = 1;
2599                 ai->rxfids[i].rx_desc.len = PKTSIZE;
2600                 ai->rxfids[i].rx_desc.rdy = 0;
2601 
2602                 pciaddroff += sizeof(RxFid);
2603                 busaddroff += PKTSIZE;
2604                 vpackoff   += PKTSIZE;
2605         }
2606 
2607         /* TX descriptor setup */
2608         for(i = 0; i < MPI_MAX_FIDS; i++) {
2609                 ai->txfids[i].card_ram_off = pciaddroff;
2610                 ai->txfids[i].virtual_host_addr = vpackoff;
2611                 ai->txfids[i].tx_desc.valid = 1;
2612                 ai->txfids[i].tx_desc.host_addr = busaddroff;
2613                 memcpy(ai->txfids[i].virtual_host_addr,
2614                         &wifictlhdr8023, sizeof(wifictlhdr8023));
2615 
2616                 pciaddroff += sizeof(TxFid);
2617                 busaddroff += PKTSIZE;
2618                 vpackoff   += PKTSIZE;
2619         }
2620         ai->txfids[i-1].tx_desc.eoc = 1; /* Last descriptor has EOC set */
2621 
2622         /* Rid descriptor setup */
2623         ai->config_desc.card_ram_off = pciaddroff;
2624         ai->config_desc.virtual_host_addr = vpackoff;
2625         ai->config_desc.rid_desc.host_addr = busaddroff;
2626         ai->ridbus = busaddroff;
2627         ai->config_desc.rid_desc.rid = 0;
2628         ai->config_desc.rid_desc.len = RIDSIZE;
2629         ai->config_desc.rid_desc.valid = 1;
2630         pciaddroff += sizeof(Rid);
2631         busaddroff += RIDSIZE;
2632         vpackoff   += RIDSIZE;
2633 
2634         /* Tell card about descriptors */
2635         if (mpi_init_descriptors (ai) != SUCCESS)
2636                 goto free_shared;
2637 
2638         return 0;
2639  free_shared:
2640         pci_free_consistent(pci, PCI_SHARED_LEN, ai->shared, ai->shared_dma);
2641  free_auxmap:
2642         iounmap(ai->pciaux);
2643  free_memmap:
2644         iounmap(ai->pcimem);
2645  free_region2:
2646         release_mem_region(aux_start, aux_len);
2647  free_region1:
2648         release_mem_region(mem_start, mem_len);
2649  out:
2650         return rc;
2651 }
2652 
2653 static const struct header_ops airo_header_ops = {
2654         .parse = wll_header_parse,
2655 };
2656 
2657 static const struct net_device_ops airo11_netdev_ops = {
2658         .ndo_open               = airo_open,
2659         .ndo_stop               = airo_close,
2660         .ndo_start_xmit         = airo_start_xmit11,
2661         .ndo_get_stats          = airo_get_stats,
2662         .ndo_set_mac_address    = airo_set_mac_address,
2663         .ndo_do_ioctl           = airo_ioctl,
2664         .ndo_change_mtu         = airo_change_mtu,
2665 };
2666 
2667 static void wifi_setup(struct net_device *dev)
2668 {
2669         dev->netdev_ops = &airo11_netdev_ops;
2670         dev->header_ops = &airo_header_ops;
2671         dev->wireless_handlers = &airo_handler_def;
2672 
2673         dev->type               = ARPHRD_IEEE80211;
2674         dev->hard_header_len    = ETH_HLEN;
2675         dev->mtu                = AIRO_DEF_MTU;
2676         dev->addr_len           = ETH_ALEN;
2677         dev->tx_queue_len       = 100; 
2678 
2679         memset(dev->broadcast,0xFF, ETH_ALEN);
2680 
2681         dev->flags              = IFF_BROADCAST|IFF_MULTICAST;
2682 }
2683 
2684 static struct net_device *init_wifidev(struct airo_info *ai,
2685                                         struct net_device *ethdev)
2686 {
2687         int err;
2688         struct net_device *dev = alloc_netdev(0, "wifi%d", NET_NAME_UNKNOWN,
2689                                               wifi_setup);
2690         if (!dev)
2691                 return NULL;
2692         dev->ml_priv = ethdev->ml_priv;
2693         dev->irq = ethdev->irq;
2694         dev->base_addr = ethdev->base_addr;
2695         dev->wireless_data = ethdev->wireless_data;
2696         SET_NETDEV_DEV(dev, ethdev->dev.parent);
2697         eth_hw_addr_inherit(dev, ethdev);
2698         err = register_netdev(dev);
2699         if (err<0) {
2700                 free_netdev(dev);
2701                 return NULL;
2702         }
2703         return dev;
2704 }
2705 
2706 static int reset_card( struct net_device *dev , int lock) {
2707         struct airo_info *ai = dev->ml_priv;
2708 
2709         if (lock && down_interruptible(&ai->sem))
2710                 return -1;
2711         waitbusy (ai);
2712         OUT4500(ai,COMMAND,CMD_SOFTRESET);
2713         msleep(200);
2714         waitbusy (ai);
2715         msleep(200);
2716         if (lock)
2717                 up(&ai->sem);
2718         return 0;
2719 }
2720 
2721 #define AIRO_MAX_NETWORK_COUNT  64
2722 static int airo_networks_allocate(struct airo_info *ai)
2723 {
2724         if (ai->networks)
2725                 return 0;
2726 
2727         ai->networks = kcalloc(AIRO_MAX_NETWORK_COUNT, sizeof(BSSListElement),
2728                                GFP_KERNEL);
2729         if (!ai->networks) {
2730                 airo_print_warn("", "Out of memory allocating beacons");
2731                 return -ENOMEM;
2732         }
2733 
2734         return 0;
2735 }
2736 
2737 static void airo_networks_free(struct airo_info *ai)
2738 {
2739         kfree(ai->networks);
2740         ai->networks = NULL;
2741 }
2742 
2743 static void airo_networks_initialize(struct airo_info *ai)
2744 {
2745         int i;
2746 
2747         INIT_LIST_HEAD(&ai->network_free_list);
2748         INIT_LIST_HEAD(&ai->network_list);
2749         for (i = 0; i < AIRO_MAX_NETWORK_COUNT; i++)
2750                 list_add_tail(&ai->networks[i].list,
2751                               &ai->network_free_list);
2752 }
2753 
2754 static const struct net_device_ops airo_netdev_ops = {
2755         .ndo_open               = airo_open,
2756         .ndo_stop               = airo_close,
2757         .ndo_start_xmit         = airo_start_xmit,
2758         .ndo_get_stats          = airo_get_stats,
2759         .ndo_set_rx_mode        = airo_set_multicast_list,
2760         .ndo_set_mac_address    = airo_set_mac_address,
2761         .ndo_do_ioctl           = airo_ioctl,
2762         .ndo_change_mtu         = airo_change_mtu,
2763         .ndo_validate_addr      = eth_validate_addr,
2764 };
2765 
2766 static const struct net_device_ops mpi_netdev_ops = {
2767         .ndo_open               = airo_open,
2768         .ndo_stop               = airo_close,
2769         .ndo_start_xmit         = mpi_start_xmit,
2770         .ndo_get_stats          = airo_get_stats,
2771         .ndo_set_rx_mode        = airo_set_multicast_list,
2772         .ndo_set_mac_address    = airo_set_mac_address,
2773         .ndo_do_ioctl           = airo_ioctl,
2774         .ndo_change_mtu         = airo_change_mtu,
2775         .ndo_validate_addr      = eth_validate_addr,
2776 };
2777 
2778 
2779 static struct net_device *_init_airo_card( unsigned short irq, int port,
2780                                            int is_pcmcia, struct pci_dev *pci,
2781                                            struct device *dmdev )
2782 {
2783         struct net_device *dev;
2784         struct airo_info *ai;
2785         int i, rc;
2786         CapabilityRid cap_rid;
2787 
2788         /* Create the network device object. */
2789         dev = alloc_netdev(sizeof(*ai), "", NET_NAME_UNKNOWN, ether_setup);
2790         if (!dev) {
2791                 airo_print_err("", "Couldn't alloc_etherdev");
2792                 return NULL;
2793         }
2794 
2795         ai = dev->ml_priv = netdev_priv(dev);
2796         ai->wifidev = NULL;
2797         ai->flags = 1 << FLAG_RADIO_DOWN;
2798         ai->jobs = 0;
2799         ai->dev = dev;
2800         if (pci && (pci->device == 0x5000 || pci->device == 0xa504)) {
2801                 airo_print_dbg("", "Found an MPI350 card");
2802                 set_bit(FLAG_MPI, &ai->flags);
2803         }
2804         spin_lock_init(&ai->aux_lock);
2805         sema_init(&ai->sem, 1);
2806         ai->config.len = 0;
2807         ai->pci = pci;
2808         init_waitqueue_head (&ai->thr_wait);
2809         ai->tfm = NULL;
2810         add_airo_dev(ai);
2811 
2812         if (airo_networks_allocate (ai))
2813                 goto err_out_free;
2814         airo_networks_initialize (ai);
2815 
2816         skb_queue_head_init (&ai->txq);
2817 
2818         /* The Airo-specific entries in the device structure. */
2819         if (test_bit(FLAG_MPI,&ai->flags))
2820                 dev->netdev_ops = &mpi_netdev_ops;
2821         else
2822                 dev->netdev_ops = &airo_netdev_ops;
2823         dev->wireless_handlers = &airo_handler_def;
2824         ai->wireless_data.spy_data = &ai->spy_data;
2825         dev->wireless_data = &ai->wireless_data;
2826         dev->irq = irq;
2827         dev->base_addr = port;
2828         dev->priv_flags &= ~IFF_TX_SKB_SHARING;
2829 
2830         SET_NETDEV_DEV(dev, dmdev);
2831 
2832         reset_card (dev, 1);
2833         msleep(400);
2834 
2835         if (!is_pcmcia) {
2836                 if (!request_region(dev->base_addr, 64, DRV_NAME)) {
2837                         rc = -EBUSY;
2838                         airo_print_err(dev->name, "Couldn't request region");
2839                         goto err_out_nets;
2840                 }
2841         }
2842 
2843         if (test_bit(FLAG_MPI,&ai->flags)) {
2844                 if (mpi_map_card(ai, pci)) {
2845                         airo_print_err("", "Could not map memory");
2846                         goto err_out_res;
2847                 }
2848         }
2849 
2850         if (probe) {
2851                 if (setup_card(ai, dev->dev_addr, 1) != SUCCESS) {
2852                         airo_print_err(dev->name, "MAC could not be enabled" );
2853                         rc = -EIO;
2854                         goto err_out_map;
2855                 }
2856         } else if (!test_bit(FLAG_MPI,&ai->flags)) {
2857                 ai->bap_read = fast_bap_read;
2858                 set_bit(FLAG_FLASHING, &ai->flags);
2859         }
2860 
2861         strcpy(dev->name, "eth%d");
2862         rc = register_netdev(dev);
2863         if (rc) {
2864                 airo_print_err(dev->name, "Couldn't register_netdev");
2865                 goto err_out_map;
2866         }
2867         ai->wifidev = init_wifidev(ai, dev);
2868         if (!ai->wifidev)
2869                 goto err_out_reg;
2870 
2871         rc = readCapabilityRid(ai, &cap_rid, 1);
2872         if (rc != SUCCESS) {
2873                 rc = -EIO;
2874                 goto err_out_wifi;
2875         }
2876         /* WEP capability discovery */
2877         ai->wep_capable = (cap_rid.softCap & cpu_to_le16(0x02)) ? 1 : 0;
2878         ai->max_wep_idx = (cap_rid.softCap & cpu_to_le16(0x80)) ? 3 : 0;
2879 
2880         airo_print_info(dev->name, "Firmware version %x.%x.%02d",
2881                         ((le16_to_cpu(cap_rid.softVer) >> 8) & 0xF),
2882                         (le16_to_cpu(cap_rid.softVer) & 0xFF),
2883                         le16_to_cpu(cap_rid.softSubVer));
2884 
2885         /* Test for WPA support */
2886         /* Only firmware versions 5.30.17 or better can do WPA */
2887         if (le16_to_cpu(cap_rid.softVer) > 0x530
2888          || (le16_to_cpu(cap_rid.softVer) == 0x530
2889               && le16_to_cpu(cap_rid.softSubVer) >= 17)) {
2890                 airo_print_info(ai->dev->name, "WPA supported.");
2891 
2892                 set_bit(FLAG_WPA_CAPABLE, &ai->flags);
2893                 ai->bssListFirst = RID_WPA_BSSLISTFIRST;
2894                 ai->bssListNext = RID_WPA_BSSLISTNEXT;
2895                 ai->bssListRidLen = sizeof(BSSListRid);
2896         } else {
2897                 airo_print_info(ai->dev->name, "WPA unsupported with firmware "
2898                         "versions older than 5.30.17.");
2899 
2900                 ai->bssListFirst = RID_BSSLISTFIRST;
2901                 ai->bssListNext = RID_BSSLISTNEXT;
2902                 ai->bssListRidLen = sizeof(BSSListRid) - sizeof(BSSListRidExtra);
2903         }
2904 
2905         set_bit(FLAG_REGISTERED,&ai->flags);
2906         airo_print_info(dev->name, "MAC enabled %pM", dev->dev_addr);
2907 
2908         /* Allocate the transmit buffers */
2909         if (probe && !test_bit(FLAG_MPI,&ai->flags))
2910                 for( i = 0; i < MAX_FIDS; i++ )
2911                         ai->fids[i] = transmit_allocate(ai,AIRO_DEF_MTU,i>=MAX_FIDS/2);
2912 
2913         if (setup_proc_entry(dev, dev->ml_priv) < 0)
2914                 goto err_out_wifi;
2915 
2916         return dev;
2917 
2918 err_out_wifi:
2919         unregister_netdev(ai->wifidev);
2920         free_netdev(ai->wifidev);
2921 err_out_reg:
2922         unregister_netdev(dev);
2923 err_out_map:
2924         if (test_bit(FLAG_MPI,&ai->flags) && pci) {
2925                 pci_free_consistent(pci, PCI_SHARED_LEN, ai->shared, ai->shared_dma);
2926                 iounmap(ai->pciaux);
2927                 iounmap(ai->pcimem);
2928                 mpi_unmap_card(ai->pci);
2929         }
2930 err_out_res:
2931         if (!is_pcmcia)
2932                 release_region( dev->base_addr, 64 );
2933 err_out_nets:
2934         airo_networks_free(ai);
2935 err_out_free:
2936         del_airo_dev(ai);
2937         free_netdev(dev);
2938         return NULL;
2939 }
2940 
2941 struct net_device *init_airo_card( unsigned short irq, int port, int is_pcmcia,
2942                                   struct device *dmdev)
2943 {
2944         return _init_airo_card ( irq, port, is_pcmcia, NULL, dmdev);
2945 }
2946 
2947 EXPORT_SYMBOL(init_airo_card);
2948 
2949 static int waitbusy (struct airo_info *ai) {
2950         int delay = 0;
2951         while ((IN4500(ai, COMMAND) & COMMAND_BUSY) && (delay < 10000)) {
2952                 udelay (10);
2953                 if ((++delay % 20) == 0)
2954                         OUT4500(ai, EVACK, EV_CLEARCOMMANDBUSY);
2955         }
2956         return delay < 10000;
2957 }
2958 
2959 int reset_airo_card( struct net_device *dev )
2960 {
2961         int i;
2962         struct airo_info *ai = dev->ml_priv;
2963 
2964         if (reset_card (dev, 1))
2965                 return -1;
2966 
2967         if ( setup_card(ai, dev->dev_addr, 1 ) != SUCCESS ) {
2968                 airo_print_err(dev->name, "MAC could not be enabled");
2969                 return -1;
2970         }
2971         airo_print_info(dev->name, "MAC enabled %pM", dev->dev_addr);
2972         /* Allocate the transmit buffers if needed */
2973         if (!test_bit(FLAG_MPI,&ai->flags))
2974                 for( i = 0; i < MAX_FIDS; i++ )
2975                         ai->fids[i] = transmit_allocate (ai,AIRO_DEF_MTU,i>=MAX_FIDS/2);
2976 
2977         enable_interrupts( ai );
2978         netif_wake_queue(dev);
2979         return 0;
2980 }
2981 
2982 EXPORT_SYMBOL(reset_airo_card);
2983 
2984 static void airo_send_event(struct net_device *dev) {
2985         struct airo_info *ai = dev->ml_priv;
2986         union iwreq_data wrqu;
2987         StatusRid status_rid;
2988 
2989         clear_bit(JOB_EVENT, &ai->jobs);
2990         PC4500_readrid(ai, RID_STATUS, &status_rid, sizeof(status_rid), 0);
2991         up(&ai->sem);
2992         wrqu.data.length = 0;
2993         wrqu.data.flags = 0;
2994         memcpy(wrqu.ap_addr.sa_data, status_rid.bssid[0], ETH_ALEN);
2995         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
2996 
2997         /* Send event to user space */
2998         wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
2999 }
3000 
3001 static void airo_process_scan_results (struct airo_info *ai) {
3002         union iwreq_data        wrqu;
3003         BSSListRid bss;
3004         int rc;
3005         BSSListElement * loop_net;
3006         BSSListElement * tmp_net;
3007 
3008         /* Blow away current list of scan results */
3009         list_for_each_entry_safe (loop_net, tmp_net, &ai->network_list, list) {
3010                 list_move_tail (&loop_net->list, &ai->network_free_list);
3011                 /* Don't blow away ->list, just BSS data */
3012                 memset (loop_net, 0, sizeof (loop_net->bss));
3013         }
3014 
3015         /* Try to read the first entry of the scan result */
3016         rc = PC4500_readrid(ai, ai->bssListFirst, &bss, ai->bssListRidLen, 0);
3017         if((rc) || (bss.index == cpu_to_le16(0xffff))) {
3018                 /* No scan results */
3019                 goto out;
3020         }
3021 
3022         /* Read and parse all entries */
3023         tmp_net = NULL;
3024         while((!rc) && (bss.index != cpu_to_le16(0xffff))) {
3025                 /* Grab a network off the free list */
3026                 if (!list_empty(&ai->network_free_list)) {
3027                         tmp_net = list_entry(ai->network_free_list.next,
3028                                             BSSListElement, list);
3029                         list_del(ai->network_free_list.next);
3030                 }
3031 
3032                 if (tmp_net != NULL) {
3033                         memcpy(tmp_net, &bss, sizeof(tmp_net->bss));
3034                         list_add_tail(&tmp_net->list, &ai->network_list);
3035                         tmp_net = NULL;
3036                 }
3037 
3038                 /* Read next entry */
3039                 rc = PC4500_readrid(ai, ai->bssListNext,
3040                                     &bss, ai->bssListRidLen, 0);
3041         }
3042 
3043 out:
3044         ai->scan_timeout = 0;
3045         clear_bit(JOB_SCAN_RESULTS, &ai->jobs);
3046         up(&ai->sem);
3047 
3048         /* Send an empty event to user space.
3049          * We don't send the received data on
3050          * the event because it would require
3051          * us to do complex transcoding, and
3052          * we want to minimise the work done in
3053          * the irq handler. Use a request to
3054          * extract the data - Jean II */
3055         wrqu.data.length = 0;
3056         wrqu.data.flags = 0;
3057         wireless_send_event(ai->dev, SIOCGIWSCAN, &wrqu, NULL);
3058 }
3059 
3060 static int airo_thread(void *data) {
3061         struct net_device *dev = data;
3062         struct airo_info *ai = dev->ml_priv;
3063         int locked;
3064 
3065         set_freezable();
3066         while(1) {
3067                 /* make swsusp happy with our thread */
3068                 try_to_freeze();
3069 
3070                 if (test_bit(JOB_DIE, &ai->jobs))
3071                         break;
3072 
3073                 if (ai->jobs) {
3074                         locked = down_interruptible(&ai->sem);
3075                 } else {
3076                         wait_queue_t wait;
3077 
3078                         init_waitqueue_entry(&wait, current);
3079                         add_wait_queue(&ai->thr_wait, &wait);
3080                         for (;;) {
3081                                 set_current_state(TASK_INTERRUPTIBLE);
3082                                 if (ai->jobs)
3083                                         break;
3084                                 if (ai->expires || ai->scan_timeout) {
3085                                         if (ai->scan_timeout &&
3086                                                         time_after_eq(jiffies,ai->scan_timeout)){
3087                                                 set_bit(JOB_SCAN_RESULTS, &ai->jobs);
3088                                                 break;
3089                                         } else if (ai->expires &&
3090                                                         time_after_eq(jiffies,ai->expires)){
3091                                                 set_bit(JOB_AUTOWEP, &ai->jobs);
3092                                                 break;
3093                                         }
3094                                         if (!kthread_should_stop() &&
3095                                             !freezing(current)) {
3096                                                 unsigned long wake_at;
3097                                                 if (!ai->expires || !ai->scan_timeout) {
3098                                                         wake_at = max(ai->expires,
3099                                                                 ai->scan_timeout);
3100                                                 } else {
3101                                                         wake_at = min(ai->expires,
3102                                                                 ai->scan_timeout);
3103                                                 }
3104                                                 schedule_timeout(wake_at - jiffies);
3105                                                 continue;
3106                                         }
3107                                 } else if (!kthread_should_stop() &&
3108                                            !freezing(current)) {
3109                                         schedule();
3110                                         continue;
3111                                 }
3112                                 break;
3113                         }
3114                         current->state = TASK_RUNNING;
3115                         remove_wait_queue(&ai->thr_wait, &wait);
3116                         locked = 1;
3117                 }
3118 
3119                 if (locked)
3120                         continue;
3121 
3122                 if (test_bit(JOB_DIE, &ai->jobs)) {
3123                         up(&ai->sem);
3124                         break;
3125                 }
3126 
3127                 if (ai->power.event || test_bit(FLAG_FLASHING, &ai->flags)) {
3128                         up(&ai->sem);
3129                         continue;
3130                 }
3131 
3132                 if (test_bit(JOB_XMIT, &ai->jobs))
3133                         airo_end_xmit(dev);
3134                 else if (test_bit(JOB_XMIT11, &ai->jobs))
3135                         airo_end_xmit11(dev);
3136                 else if (test_bit(JOB_STATS, &ai->jobs))
3137                         airo_read_stats(dev);
3138                 else if (test_bit(JOB_WSTATS, &ai->jobs))
3139                         airo_read_wireless_stats(ai);
3140                 else if (test_bit(JOB_PROMISC, &ai->jobs))
3141                         airo_set_promisc(ai);
3142                 else if (test_bit(JOB_MIC, &ai->jobs))
3143                         micinit(ai);
3144                 else if (test_bit(JOB_EVENT, &ai->jobs))
3145                         airo_send_event(dev);
3146                 else if (test_bit(JOB_AUTOWEP, &ai->jobs))
3147                         timer_func(dev);
3148                 else if (test_bit(JOB_SCAN_RESULTS, &ai->jobs))
3149                         airo_process_scan_results(ai);
3150                 else  /* Shouldn't get here, but we make sure to unlock */
3151                         up(&ai->sem);
3152         }
3153 
3154         return 0;
3155 }
3156 
3157 static int header_len(__le16 ctl)
3158 {
3159         u16 fc = le16_to_cpu(ctl);
3160         switch (fc & 0xc) {
3161         case 4:
3162                 if ((fc & 0xe0) == 0xc0)
3163                         return 10;      /* one-address control packet */
3164                 return 16;      /* two-address control packet */
3165         case 8:
3166                 if ((fc & 0x300) == 0x300)
3167                         return 30;      /* WDS packet */
3168         }
3169         return 24;
3170 }
3171 
3172 static void airo_handle_cisco_mic(struct airo_info *ai)
3173 {
3174         if (test_bit(FLAG_MIC_CAPABLE, &ai->flags)) {
3175                 set_bit(JOB_MIC, &ai->jobs);
3176                 wake_up_interruptible(&ai->thr_wait);
3177         }
3178 }
3179 
3180 /* Airo Status codes */
3181 #define STAT_NOBEACON   0x8000 /* Loss of sync - missed beacons */
3182 #define STAT_MAXRETRIES 0x8001 /* Loss of sync - max retries */
3183 #define STAT_MAXARL     0x8002 /* Loss of sync - average retry level exceeded*/
3184 #define STAT_FORCELOSS  0x8003 /* Loss of sync - host request */
3185 #define STAT_TSFSYNC    0x8004 /* Loss of sync - TSF synchronization */
3186 #define STAT_DEAUTH     0x8100 /* low byte is 802.11 reason code */
3187 #define STAT_DISASSOC   0x8200 /* low byte is 802.11 reason code */
3188 #define STAT_ASSOC_FAIL 0x8400 /* low byte is 802.11 reason code */
3189 #define STAT_AUTH_FAIL  0x0300 /* low byte is 802.11 reason code */
3190 #define STAT_ASSOC      0x0400 /* Associated */
3191 #define STAT_REASSOC    0x0600 /* Reassociated?  Only on firmware >= 5.30.17 */
3192 
3193 static void airo_print_status(const char *devname, u16 status)
3194 {
3195         u8 reason = status & 0xFF;
3196 
3197         switch (status & 0xFF00) {
3198         case STAT_NOBEACON:
3199                 switch (status) {
3200                 case STAT_NOBEACON:
3201                         airo_print_dbg(devname, "link lost (missed beacons)");
3202                         break;
3203                 case STAT_MAXRETRIES:
3204                 case STAT_MAXARL:
3205                         airo_print_dbg(devname, "link lost (max retries)");
3206                         break;
3207                 case STAT_FORCELOSS:
3208                         airo_print_dbg(devname, "link lost (local choice)");
3209                         break;
3210                 case STAT_TSFSYNC:
3211                         airo_print_dbg(devname, "link lost (TSF sync lost)");
3212                         break;
3213                 default:
3214                         airo_print_dbg(devname, "unknow status %x\n", status);
3215                         break;
3216                 }
3217                 break;
3218         case STAT_DEAUTH:
3219                 airo_print_dbg(devname, "deauthenticated (reason: %d)", reason);
3220                 break;
3221         case STAT_DISASSOC:
3222                 airo_print_dbg(devname, "disassociated (reason: %d)", reason);
3223                 break;
3224         case STAT_ASSOC_FAIL:
3225                 airo_print_dbg(devname, "association failed (reason: %d)",
3226                                reason);
3227                 break;
3228         case STAT_AUTH_FAIL:
3229                 airo_print_dbg(devname, "authentication failed (reason: %d)",
3230                                reason);
3231                 break;
3232         case STAT_ASSOC:
3233         case STAT_REASSOC:
3234                 break;
3235         default:
3236                 airo_print_dbg(devname, "unknow status %x\n", status);
3237                 break;
3238         }
3239 }
3240 
3241 static void airo_handle_link(struct airo_info *ai)
3242 {
3243         union iwreq_data wrqu;
3244         int scan_forceloss = 0;
3245         u16 status;
3246 
3247         /* Get new status and acknowledge the link change */
3248         status = le16_to_cpu(IN4500(ai, LINKSTAT));
3249         OUT4500(ai, EVACK, EV_LINK);
3250 
3251         if ((status == STAT_FORCELOSS) && (ai->scan_timeout > 0))
3252                 scan_forceloss = 1;
3253 
3254         airo_print_status(ai->dev->name, status);
3255 
3256         if ((status == STAT_ASSOC) || (status == STAT_REASSOC)) {
3257                 if (auto_wep)
3258                         ai->expires = 0;
3259                 if (ai->list_bss_task)
3260                         wake_up_process(ai->list_bss_task);
3261                 set_bit(FLAG_UPDATE_UNI, &ai->flags);
3262                 set_bit(FLAG_UPDATE_MULTI, &ai->flags);
3263 
3264                 if (down_trylock(&ai->sem) != 0) {
3265                         set_bit(JOB_EVENT, &ai->jobs);
3266                         wake_up_interruptible(&ai->thr_wait);
3267                 } else
3268                         airo_send_event(ai->dev);
3269         } else if (!scan_forceloss) {
3270                 if (auto_wep && !ai->expires) {
3271                         ai->expires = RUN_AT(3*HZ);
3272                         wake_up_interruptible(&ai->thr_wait);
3273                 }
3274 
3275                 /* Send event to user space */
3276                 memset(wrqu.ap_addr.sa_data, '\0', ETH_ALEN);
3277                 wrqu.ap_addr.sa_family = ARPHRD_ETHER;
3278                 wireless_send_event(ai->dev, SIOCGIWAP, &wrqu, NULL);
3279         }
3280 }
3281 
3282 static void airo_handle_rx(struct airo_info *ai)
3283 {
3284         struct sk_buff *skb = NULL;
3285         __le16 fc, v, *buffer, tmpbuf[4];
3286         u16 len, hdrlen = 0, gap, fid;
3287         struct rx_hdr hdr;
3288         int success = 0;
3289 
3290         if (test_bit(FLAG_MPI, &ai->flags)) {
3291                 if (test_bit(FLAG_802_11, &ai->flags))
3292                         mpi_receive_802_11(ai);
3293                 else
3294                         mpi_receive_802_3(ai);
3295                 OUT4500(ai, EVACK, EV_RX);
3296                 return;
3297         }
3298 
3299         fid = IN4500(ai, RXFID);
3300 
3301         /* Get the packet length */
3302         if (test_bit(FLAG_802_11, &ai->flags)) {
3303                 bap_setup (ai, fid, 4, BAP0);
3304                 bap_read (ai, (__le16*)&hdr, sizeof(hdr), BAP0);
3305                 /* Bad CRC. Ignore packet */
3306                 if (le16_to_cpu(hdr.status) & 2)
3307                         hdr.len = 0;
3308                 if (ai->wifidev == NULL)
3309                         hdr.len = 0;
3310         } else {
3311                 bap_setup(ai, fid, 0x36, BAP0);
3312                 bap_read(ai, &hdr.len, 2, BAP0);
3313         }
3314         len = le16_to_cpu(hdr.len);
3315 
3316         if (len > AIRO_DEF_MTU) {
3317                 airo_print_err(ai->dev->name, "Bad size %d", len);
3318                 goto done;
3319         }
3320         if (len == 0)
3321                 goto done;
3322 
3323         if (test_bit(FLAG_802_11, &ai->flags)) {
3324                 bap_read(ai, &fc, sizeof (fc), BAP0);
3325                 hdrlen = header_len(fc);
3326         } else
3327                 hdrlen = ETH_ALEN * 2;
3328 
3329         skb = dev_alloc_skb(len + hdrlen + 2 + 2);
3330         if (!skb) {
3331                 ai->dev->stats.rx_dropped++;
3332                 goto done;
3333         }
3334 
3335         skb_reserve(skb, 2); /* This way the IP header is aligned */
3336         buffer = (__le16 *) skb_put(skb, len + hdrlen);
3337         if (test_bit(FLAG_802_11, &ai->flags)) {
3338                 buffer[0] = fc;
3339                 bap_read(ai, buffer + 1, hdrlen - 2, BAP0);
3340                 if (hdrlen == 24)
3341                         bap_read(ai, tmpbuf, 6, BAP0);
3342 
3343                 bap_read(ai, &v, sizeof(v), BAP0);
3344                 gap = le16_to_cpu(v);
3345                 if (gap) {
3346                         if (gap <= 8) {
3347                                 bap_read(ai, tmpbuf, gap, BAP0);
3348                         } else {
3349                                 airo_print_err(ai->dev->name, "gaplen too "
3350                                         "big. Problems will follow...");
3351                         }
3352                 }
3353                 bap_read(ai, buffer + hdrlen/2, len, BAP0);
3354         } else {
3355                 MICBuffer micbuf;
3356 
3357                 bap_read(ai, buffer, ETH_ALEN * 2, BAP0);
3358                 if (ai->micstats.enabled) {
3359                         bap_read(ai, (__le16 *) &micbuf, sizeof (micbuf), BAP0);
3360                         if (ntohs(micbuf.typelen) > 0x05DC)
3361                                 bap_setup(ai, fid, 0x44, BAP0);
3362                         else {
3363                                 if (len <= sizeof (micbuf)) {
3364                                         dev_kfree_skb_irq(skb);
3365                                         goto done;
3366                                 }
3367 
3368                                 len -= sizeof(micbuf);
3369                                 skb_trim(skb, len + hdrlen);
3370                         }
3371                 }
3372 
3373                 bap_read(ai, buffer + ETH_ALEN, len, BAP0);
3374                 if (decapsulate(ai, &micbuf, (etherHead*) buffer, len))
3375                         dev_kfree_skb_irq (skb);
3376                 else
3377                         success = 1;
3378         }
3379 
3380 #ifdef WIRELESS_SPY
3381         if (success && (ai->spy_data.spy_number > 0)) {
3382                 char *sa;
3383                 struct iw_quality wstats;
3384 
3385                 /* Prepare spy data : addr + qual */
3386                 if (!test_bit(FLAG_802_11, &ai->flags)) {
3387                         sa = (char *) buffer + 6;
3388                         bap_setup(ai, fid, 8, BAP0);
3389                         bap_read(ai, (__le16 *) hdr.rssi, 2, BAP0);
3390                 } else
3391                         sa = (char *) buffer + 10;
3392                 wstats.qual = hdr.rssi[0];
3393                 if (ai->rssi)
3394                         wstats.level = 0x100 - ai->rssi[hdr.rssi[1]].rssidBm;
3395                 else
3396                         wstats.level = (hdr.rssi[1] + 321) / 2;
3397                 wstats.noise = ai->wstats.qual.noise;
3398                 wstats.updated =  IW_QUAL_LEVEL_UPDATED
3399                                 | IW_QUAL_QUAL_UPDATED
3400                                 | IW_QUAL_DBM;
3401                 /* Update spy records */
3402                 wireless_spy_update(ai->dev, sa, &wstats);
3403         }
3404 #endif /* WIRELESS_SPY */
3405 
3406 done:
3407         OUT4500(ai, EVACK, EV_RX);
3408 
3409         if (success) {
3410                 if (test_bit(FLAG_802_11, &ai->flags)) {
3411                         skb_reset_mac_header(skb);
3412                         skb->pkt_type = PACKET_OTHERHOST;
3413                         skb->dev = ai->wifidev;
3414                         skb->protocol = htons(ETH_P_802_2);
3415                 } else
3416                         skb->protocol = eth_type_trans(skb, ai->dev);
3417                 skb->ip_summed = CHECKSUM_NONE;
3418 
3419                 netif_rx(skb);
3420         }
3421 }
3422 
3423 static void airo_handle_tx(struct airo_info *ai, u16 status)
3424 {
3425         int i, len = 0, index = -1;
3426         u16 fid;
3427 
3428         if (test_bit(FLAG_MPI, &ai->flags)) {
3429                 unsigned long flags;
3430 
3431                 if (status & EV_TXEXC)
3432                         get_tx_error(ai, -1);
3433 
3434                 spin_lock_irqsave(&ai->aux_lock, flags);
3435                 if (!skb_queue_empty(&ai->txq)) {
3436                         spin_unlock_irqrestore(&ai->aux_lock,flags);
3437                         mpi_send_packet(ai->dev);
3438                 } else {
3439                         clear_bit(FLAG_PENDING_XMIT, &ai->flags);
3440                         spin_unlock_irqrestore(&ai->aux_lock,flags);
3441                         netif_wake_queue(ai->dev);
3442                 }
3443                 OUT4500(ai, EVACK, status & (EV_TX | EV_TXCPY | EV_TXEXC));
3444                 return;
3445         }
3446 
3447         fid = IN4500(ai, TXCOMPLFID);
3448 
3449         for(i = 0; i < MAX_FIDS; i++) {
3450                 if ((ai->fids[i] & 0xffff) == fid) {
3451                         len = ai->fids[i] >> 16;
3452                         index = i;
3453                 }
3454         }
3455 
3456         if (index != -1) {
3457                 if (status & EV_TXEXC)
3458                         get_tx_error(ai, index);
3459 
3460                 OUT4500(ai, EVACK, status & (EV_TX | EV_TXEXC));
3461 
3462                 /* Set up to be used again */
3463                 ai->fids[index] &= 0xffff;
3464                 if (index < MAX_FIDS / 2) {
3465                         if (!test_bit(FLAG_PENDING_XMIT, &ai->flags))
3466                                 netif_wake_queue(ai->dev);
3467                 } else {
3468                         if (!test_bit(FLAG_PENDING_XMIT11, &ai->flags))
3469                                 netif_wake_queue(ai->wifidev);
3470                 }
3471         } else {
3472                 OUT4500(ai, EVACK, status & (EV_TX | EV_TXCPY | EV_TXEXC));
3473                 airo_print_err(ai->dev->name, "Unallocated FID was used to xmit");
3474         }
3475 }
3476 
3477 static irqreturn_t airo_interrupt(int irq, void *dev_id)
3478 {
3479         struct net_device *dev = dev_id;
3480         u16 status, savedInterrupts = 0;
3481         struct airo_info *ai = dev->ml_priv;
3482         int handled = 0;
3483 
3484         if (!netif_device_present(dev))
3485                 return IRQ_NONE;
3486 
3487         for (;;) {
3488                 status = IN4500(ai, EVSTAT);
3489                 if (!(status & STATUS_INTS) || (status == 0xffff))
3490                         break;
3491 
3492                 handled = 1;
3493 
3494                 if (status & EV_AWAKE) {
3495                         OUT4500(ai, EVACK, EV_AWAKE);
3496                         OUT4500(ai, EVACK, EV_AWAKE);
3497                 }
3498 
3499                 if (!savedInterrupts) {
3500                         savedInterrupts = IN4500(ai, EVINTEN);
3501                         OUT4500(ai, EVINTEN, 0);
3502                 }
3503 
3504                 if (status & EV_MIC) {
3505                         OUT4500(ai, EVACK, EV_MIC);
3506                         airo_handle_cisco_mic(ai);
3507                 }
3508 
3509                 if (status & EV_LINK) {
3510                         /* Link status changed */
3511                         airo_handle_link(ai);
3512                 }
3513 
3514                 /* Check to see if there is something to receive */
3515                 if (status & EV_RX)
3516                         airo_handle_rx(ai);
3517 
3518                 /* Check to see if a packet has been transmitted */
3519                 if (status & (EV_TX | EV_TXCPY | EV_TXEXC))
3520                         airo_handle_tx(ai, status);
3521 
3522                 if ( status & ~STATUS_INTS & ~IGNORE_INTS ) {
3523                         airo_print_warn(ai->dev->name, "Got weird status %x",
3524                                 status & ~STATUS_INTS & ~IGNORE_INTS );
3525                 }
3526         }
3527 
3528         if (savedInterrupts)
3529                 OUT4500(ai, EVINTEN, savedInterrupts);
3530 
3531         return IRQ_RETVAL(handled);
3532 }
3533 
3534 /*
3535  *  Routines to talk to the card
3536  */
3537 
3538 /*
3539  *  This was originally written for the 4500, hence the name
3540  *  NOTE:  If use with 8bit mode and SMP bad things will happen!
3541  *         Why would some one do 8 bit IO in an SMP machine?!?
3542  */
3543 static void OUT4500( struct airo_info *ai, u16 reg, u16 val ) {
3544         if (test_bit(FLAG_MPI,&ai->flags))
3545                 reg <<= 1;
3546         if ( !do8bitIO )
3547                 outw( val, ai->dev->base_addr + reg );
3548         else {
3549                 outb( val & 0xff, ai->dev->base_addr + reg );
3550                 outb( val >> 8, ai->dev->base_addr + reg + 1 );
3551         }
3552 }
3553 
3554 static u16 IN4500( struct airo_info *ai, u16 reg ) {
3555         unsigned short rc;
3556 
3557         if (test_bit(FLAG_MPI,&ai->flags))
3558                 reg <<= 1;
3559         if ( !do8bitIO )
3560                 rc = inw( ai->dev->base_addr + reg );
3561         else {
3562                 rc = inb( ai->dev->base_addr + reg );
3563                 rc += ((int)inb( ai->dev->base_addr + reg + 1 )) << 8;
3564         }
3565         return rc;
3566 }
3567 
3568 static int enable_MAC(struct airo_info *ai, int lock)
3569 {
3570         int rc;
3571         Cmd cmd;
3572         Resp rsp;
3573 
3574         /* FLAG_RADIO_OFF : Radio disabled via /proc or Wireless Extensions
3575          * FLAG_RADIO_DOWN : Radio disabled via "ifconfig ethX down"
3576          * Note : we could try to use !netif_running(dev) in enable_MAC()
3577          * instead of this flag, but I don't trust it *within* the
3578          * open/close functions, and testing both flags together is
3579          * "cheaper" - Jean II */
3580         if (ai->flags & FLAG_RADIO_MASK) return SUCCESS;
3581 
3582         if (lock && down_interruptible(&ai->sem))
3583                 return -ERESTARTSYS;
3584 
3585         if (!test_bit(FLAG_ENABLED, &ai->flags)) {
3586                 memset(&cmd, 0, sizeof(cmd));
3587                 cmd.cmd = MAC_ENABLE;
3588                 rc = issuecommand(ai, &cmd, &rsp);
3589                 if (rc == SUCCESS)
3590                         set_bit(FLAG_ENABLED, &ai->flags);
3591         } else
3592                 rc = SUCCESS;
3593 
3594         if (lock)
3595             up(&ai->sem);
3596 
3597         if (rc)
3598                 airo_print_err(ai->dev->name, "Cannot enable MAC");
3599         else if ((rsp.status & 0xFF00) != 0) {
3600                 airo_print_err(ai->dev->name, "Bad MAC enable reason=%x, "
3601                         "rid=%x, offset=%d", rsp.rsp0, rsp.rsp1, rsp.rsp2);
3602                 rc = ERROR;
3603         }
3604         return rc;
3605 }
3606 
3607 static void disable_MAC( struct airo_info *ai, int lock ) {
3608         Cmd cmd;
3609         Resp rsp;
3610 
3611         if (lock && down_interruptible(&ai->sem))
3612                 return;
3613 
3614         if (test_bit(FLAG_ENABLED, &ai->flags)) {
3615                 memset(&cmd, 0, sizeof(cmd));
3616                 cmd.cmd = MAC_DISABLE; // disable in case already enabled
3617                 issuecommand(ai, &cmd, &rsp);
3618                 clear_bit(FLAG_ENABLED, &ai->flags);
3619         }
3620         if (lock)
3621                 up(&ai->sem);
3622 }
3623 
3624 static void enable_interrupts( struct airo_info *ai ) {
3625         /* Enable the interrupts */
3626         OUT4500( ai, EVINTEN, STATUS_INTS );
3627 }
3628 
3629 static void disable_interrupts( struct airo_info *ai ) {
3630         OUT4500( ai, EVINTEN, 0 );
3631 }
3632 
3633 static void mpi_receive_802_3(struct airo_info *ai)
3634 {
3635         RxFid rxd;
3636         int len = 0;
3637         struct sk_buff *skb;
3638         char *buffer;
3639         int off = 0;
3640         MICBuffer micbuf;
3641 
3642         memcpy_fromio(&rxd, ai->rxfids[0].card_ram_off, sizeof(rxd));
3643         /* Make sure we got something */
3644         if (rxd.rdy && rxd.valid == 0) {
3645                 len = rxd.len + 12;
3646                 if (len < 12 || len > 2048)
3647                         goto badrx;
3648 
3649                 skb = dev_alloc_skb(len);
3650                 if (!skb) {
3651                         ai->dev->stats.rx_dropped++;
3652                         goto badrx;
3653                 }
3654                 buffer = skb_put(skb,len);
3655                 memcpy(buffer, ai->rxfids[0].virtual_host_addr, ETH_ALEN * 2);
3656                 if (ai->micstats.enabled) {
3657                         memcpy(&micbuf,
3658                                 ai->rxfids[0].virtual_host_addr + ETH_ALEN * 2,
3659                                 sizeof(micbuf));
3660                         if (ntohs(micbuf.typelen) <= 0x05DC) {
3661                                 if (len <= sizeof(micbuf) + ETH_ALEN * 2)
3662                                         goto badmic;
3663 
3664                                 off = sizeof(micbuf);
3665                                 skb_trim (skb, len - off);
3666                         }
3667                 }
3668                 memcpy(buffer + ETH_ALEN * 2,
3669                         ai->rxfids[0].virtual_host_addr + ETH_ALEN * 2 + off,
3670                         len - ETH_ALEN * 2 - off);
3671                 if (decapsulate (ai, &micbuf, (etherHead*)buffer, len - off - ETH_ALEN * 2)) {
3672 badmic:
3673                         dev_kfree_skb_irq (skb);
3674                         goto badrx;
3675                 }
3676 #ifdef WIRELESS_SPY
3677                 if (ai->spy_data.spy_number > 0) {
3678                         char *sa;
3679                         struct iw_quality wstats;
3680                         /* Prepare spy data : addr + qual */
3681                         sa = buffer + ETH_ALEN;
3682                         wstats.qual = 0; /* XXX Where do I get that info from ??? */
3683                         wstats.level = 0;
3684                         wstats.updated = 0;
3685                         /* Update spy records */
3686                         wireless_spy_update(ai->dev, sa, &wstats);
3687                 }
3688 #endif /* WIRELESS_SPY */
3689 
3690                 skb->ip_summed = CHECKSUM_NONE;
3691                 skb->protocol = eth_type_trans(skb, ai->dev);
3692                 netif_rx(skb);
3693         }
3694 badrx:
3695         if (rxd.valid == 0) {
3696                 rxd.valid = 1;
3697                 rxd.rdy = 0;
3698                 rxd.len = PKTSIZE;
3699                 memcpy_toio(ai->rxfids[0].card_ram_off, &rxd, sizeof(rxd));
3700         }
3701 }
3702 
3703 static void mpi_receive_802_11(struct airo_info *ai)
3704 {
3705         RxFid rxd;
3706         struct sk_buff *skb = NULL;
3707         u16 len, hdrlen = 0;
3708         __le16 fc;
3709         struct rx_hdr hdr;
3710         u16 gap;
3711         u16 *buffer;
3712         char *ptr = ai->rxfids[0].virtual_host_addr + 4;
3713 
3714         memcpy_fromio(&rxd, ai->rxfids[0].card_ram_off, sizeof(rxd));
3715         memcpy ((char *)&hdr, ptr, sizeof(hdr));
3716         ptr += sizeof(hdr);
3717         /* Bad CRC. Ignore packet */
3718         if (le16_to_cpu(hdr.status) & 2)
3719                 hdr.len = 0;
3720         if (ai->wifidev == NULL)
3721                 hdr.len = 0;
3722         len = le16_to_cpu(hdr.len);
3723         if (len > AIRO_DEF_MTU) {
3724                 airo_print_err(ai->dev->name, "Bad size %d", len);
3725                 goto badrx;
3726         }
3727         if (len == 0)
3728                 goto badrx;
3729 
3730         fc = get_unaligned((__le16 *)ptr);
3731         hdrlen = header_len(fc);
3732 
3733         skb = dev_alloc_skb( len + hdrlen + 2 );
3734         if ( !skb ) {
3735                 ai->dev->stats.rx_dropped++;
3736                 goto badrx;
3737         }
3738         buffer = (u16*)skb_put (skb, len + hdrlen);
3739         memcpy ((char *)buffer, ptr, hdrlen);
3740         ptr += hdrlen;
3741         if (hdrlen == 24)
3742                 ptr += 6;
3743         gap = get_unaligned_le16(ptr);
3744         ptr += sizeof(__le16);
3745         if (gap) {
3746                 if (gap <= 8)
3747                         ptr += gap;
3748                 else
3749                         airo_print_err(ai->dev->name,
3750                             "gaplen too big. Problems will follow...");
3751         }
3752         memcpy ((char *)buffer + hdrlen, ptr, len);
3753         ptr += len;
3754 #ifdef IW_WIRELESS_SPY    /* defined in iw_handler.h */
3755         if (ai->spy_data.spy_number > 0) {
3756                 char *sa;
3757                 struct iw_quality wstats;
3758                 /* Prepare spy data : addr + qual */
3759                 sa = (char*)buffer + 10;
3760                 wstats.qual = hdr.rssi[0];
3761                 if (ai->rssi)
3762                         wstats.level = 0x100 - ai->rssi[hdr.rssi[1]].rssidBm;
3763                 else
3764                         wstats.level = (hdr.rssi[1] + 321) / 2;
3765                 wstats.noise = ai->wstats.qual.noise;
3766                 wstats.updated = IW_QUAL_QUAL_UPDATED
3767                         | IW_QUAL_LEVEL_UPDATED
3768                         | IW_QUAL_DBM;
3769                 /* Update spy records */
3770                 wireless_spy_update(ai->dev, sa, &wstats);
3771         }
3772 #endif /* IW_WIRELESS_SPY */
3773         skb_reset_mac_header(skb);
3774         skb->pkt_type = PACKET_OTHERHOST;
3775         skb->dev = ai->wifidev;
3776         skb->protocol = htons(ETH_P_802_2);
3777         skb->ip_summed = CHECKSUM_NONE;
3778         netif_rx( skb );
3779 
3780 badrx:
3781         if (rxd.valid == 0) {
3782                 rxd.valid = 1;
3783                 rxd.rdy = 0;
3784                 rxd.len = PKTSIZE;
3785                 memcpy_toio(ai->rxfids[0].card_ram_off, &rxd, sizeof(rxd));
3786         }
3787 }
3788 
3789 static u16 setup_card(struct airo_info *ai, u8 *mac, int lock)
3790 {
3791         Cmd cmd;
3792         Resp rsp;
3793         int status;
3794         SsidRid mySsid;
3795         __le16 lastindex;
3796         WepKeyRid wkr;
3797         int rc;
3798 
3799         memset( &mySsid, 0, sizeof( mySsid ) );
3800         kfree (ai->flash);
3801         ai->flash = NULL;
3802 
3803         /* The NOP is the first step in getting the card going */
3804         cmd.cmd = NOP;
3805         cmd.parm0 = cmd.parm1 = cmd.parm2 = 0;
3806         if (lock && down_interruptible(&ai->sem))
3807                 return ERROR;
3808         if ( issuecommand( ai, &cmd, &rsp ) != SUCCESS ) {
3809                 if (lock)
3810                         up(&ai->sem);
3811                 return ERROR;
3812         }
3813         disable_MAC( ai, 0);
3814 
3815         // Let's figure out if we need to use the AUX port
3816         if (!test_bit(FLAG_MPI,&ai->flags)) {
3817                 cmd.cmd = CMD_ENABLEAUX;
3818                 if (issuecommand(ai, &cmd, &rsp) != SUCCESS) {
3819                         if (lock)
3820                                 up(&ai->sem);
3821                         airo_print_err(ai->dev->name, "Error checking for AUX port");
3822                         return ERROR;
3823                 }
3824                 if (!aux_bap || rsp.status & 0xff00) {
3825                         ai->bap_read = fast_bap_read;
3826                         airo_print_dbg(ai->dev->name, "Doing fast bap_reads");
3827                 } else {
3828                         ai->bap_read = aux_bap_read;
3829                         airo_print_dbg(ai->dev->name, "Doing AUX bap_reads");
3830                 }
3831         }
3832         if (lock)
3833                 up(&ai->sem);
3834         if (ai->config.len == 0) {
3835                 int i;
3836                 tdsRssiRid rssi_rid;
3837                 CapabilityRid cap_rid;
3838 
3839                 kfree(ai->APList);
3840                 ai->APList = NULL;
3841                 kfree(ai->SSID);
3842                 ai->SSID = NULL;
3843                 // general configuration (read/modify/write)
3844                 status = readConfigRid(ai, lock);
3845                 if ( status != SUCCESS ) return ERROR;
3846 
3847                 status = readCapabilityRid(ai, &cap_rid, lock);
3848                 if ( status != SUCCESS ) return ERROR;
3849 
3850                 status = PC4500_readrid(ai,RID_RSSI,&rssi_rid,sizeof(rssi_rid),lock);
3851                 if ( status == SUCCESS ) {
3852                         if (ai->rssi || (ai->rssi = kmalloc(512, GFP_KERNEL)) != NULL)
3853                                 memcpy(ai->rssi, (u8*)&rssi_rid + 2, 512); /* Skip RID length member */
3854                 }
3855                 else {
3856                         kfree(ai->rssi);
3857                         ai->rssi = NULL;
3858                         if (cap_rid.softCap & cpu_to_le16(8))
3859                                 ai->config.rmode |= RXMODE_NORMALIZED_RSSI;
3860                         else
3861                                 airo_print_warn(ai->dev->name, "unknown received signal "
3862                                                 "level scale");
3863                 }
3864                 ai->config.opmode = adhoc ? MODE_STA_IBSS : MODE_STA_ESS;
3865                 ai->config.authType = AUTH_OPEN;
3866                 ai->config.modulation = MOD_CCK;
3867 
3868                 if (le16_to_cpu(cap_rid.len) >= sizeof(cap_rid) &&
3869                     (cap_rid.extSoftCap & cpu_to_le16(1)) &&
3870                     micsetup(ai) == SUCCESS) {
3871                         ai->config.opmode |= MODE_MIC;
3872                         set_bit(FLAG_MIC_CAPABLE, &ai->flags);
3873                 }
3874 
3875                 /* Save off the MAC */
3876                 for( i = 0; i < ETH_ALEN; i++ ) {
3877                         mac[i] = ai->config.macAddr[i];
3878                 }
3879 
3880                 /* Check to see if there are any insmod configured
3881                    rates to add */
3882                 if ( rates[0] ) {
3883                         memset(ai->config.rates,0,sizeof(ai->config.rates));
3884                         for( i = 0; i < 8 && rates[i]; i++ ) {
3885                                 ai->config.rates[i] = rates[i];
3886                         }
3887                 }
3888                 set_bit (FLAG_COMMIT, &ai->flags);
3889         }
3890 
3891         /* Setup the SSIDs if present */
3892         if ( ssids[0] ) {
3893                 int i;
3894                 for( i = 0; i < 3 && ssids[i]; i++ ) {
3895                         size_t len = strlen(ssids[i]);
3896                         if (len > 32)
3897                                 len = 32;
3898                         mySsid.ssids[i].len = cpu_to_le16(len);
3899                         memcpy(mySsid.ssids[i].ssid, ssids[i], len);
3900                 }
3901                 mySsid.len = cpu_to_le16(sizeof(mySsid));
3902         }
3903 
3904         status = writeConfigRid(ai, lock);
3905         if ( status != SUCCESS ) return ERROR;
3906 
3907         /* Set up the SSID list */
3908         if ( ssids[0] ) {
3909                 status = writeSsidRid(ai, &mySsid, lock);
3910                 if ( status != SUCCESS ) return ERROR;
3911         }
3912 
3913         status = enable_MAC(ai, lock);
3914         if (status != SUCCESS)
3915                 return ERROR;
3916 
3917         /* Grab the initial wep key, we gotta save it for auto_wep */
3918         rc = readWepKeyRid(ai, &wkr, 1, lock);
3919         if (rc == SUCCESS) do {
3920                 lastindex = wkr.kindex;
3921                 if (wkr.kindex == cpu_to_le16(0xffff)) {
3922                         ai->defindex = wkr.mac[0];
3923                 }
3924                 rc = readWepKeyRid(ai, &wkr, 0, lock);
3925         } while(lastindex != wkr.kindex);
3926 
3927         try_auto_wep(ai);
3928 
3929         return SUCCESS;
3930 }
3931 
3932 static u16 issuecommand(struct airo_info *ai, Cmd *pCmd, Resp *pRsp) {
3933         // Im really paranoid about letting it run forever!
3934         int max_tries = 600000;
3935 
3936         if (IN4500(ai, EVSTAT) & EV_CMD)
3937                 OUT4500(ai, EVACK, EV_CMD);
3938 
3939         OUT4500(ai, PARAM0, pCmd->parm0);
3940         OUT4500(ai, PARAM1, pCmd->parm1);
3941         OUT4500(ai, PARAM2, pCmd->parm2);
3942         OUT4500(ai, COMMAND, pCmd->cmd);
3943 
3944         while (max_tries-- && (IN4500(ai, EVSTAT) & EV_CMD) == 0) {
3945                 if ((IN4500(ai, COMMAND)) == pCmd->cmd)
3946                         // PC4500 didn't notice command, try again
3947                         OUT4500(ai, COMMAND, pCmd->cmd);
3948                 if (!in_atomic() && (max_tries & 255) == 0)
3949                         schedule();
3950         }
3951 
3952         if ( max_tries == -1 ) {
3953                 airo_print_err(ai->dev->name,
3954                         "Max tries exceeded when issuing command");
3955                 if (IN4500(ai, COMMAND) & COMMAND_BUSY)
3956                         OUT4500(ai, EVACK, EV_CLEARCOMMANDBUSY);
3957                 return ERROR;
3958         }
3959 
3960         // command completed
3961         pRsp->status = IN4500(ai, STATUS);
3962         pRsp->rsp0 = IN4500(ai, RESP0);
3963         pRsp->rsp1 = IN4500(ai, RESP1);
3964         pRsp->rsp2 = IN4500(ai, RESP2);
3965         if ((pRsp->status & 0xff00)!=0 && pCmd->cmd != CMD_SOFTRESET)
3966                 airo_print_err(ai->dev->name,
3967                         "cmd:%x status:%x rsp0:%x rsp1:%x rsp2:%x",
3968                         pCmd->cmd, pRsp->status, pRsp->rsp0, pRsp->rsp1,
3969                         pRsp->rsp2);
3970 
3971         // clear stuck command busy if necessary
3972         if (IN4500(ai, COMMAND) & COMMAND_BUSY) {
3973                 OUT4500(ai, EVACK, EV_CLEARCOMMANDBUSY);
3974         }
3975         // acknowledge processing the status/response
3976         OUT4500(ai, EVACK, EV_CMD);
3977 
3978         return SUCCESS;
3979 }
3980 
3981 /* Sets up the bap to start exchange data.  whichbap should
3982  * be one of the BAP0 or BAP1 defines.  Locks should be held before
3983  * calling! */
3984 static int bap_setup(struct airo_info *ai, u16 rid, u16 offset, int whichbap )
3985 {
3986         int timeout = 50;
3987         int max_tries = 3;
3988 
3989         OUT4500(ai, SELECT0+whichbap, rid);
3990         OUT4500(ai, OFFSET0+whichbap, offset);
3991         while (1) {
3992                 int status = IN4500(ai, OFFSET0+whichbap);
3993                 if (status & BAP_BUSY) {
3994                         /* This isn't really a timeout, but its kinda
3995                            close */
3996                         if (timeout--) {
3997                                 continue;
3998                         }
3999                 } else if ( status & BAP_ERR ) {
4000                         /* invalid rid or offset */
4001                         airo_print_err(ai->dev->name, "BAP error %x %d",
4002                                 status, whichbap );
4003                         return ERROR;
4004                 } else if (status & BAP_DONE) { // success
4005                         return SUCCESS;
4006                 }
4007                 if ( !(max_tries--) ) {
4008                         airo_print_err(ai->dev->name,
4009                                 "BAP setup error too many retries\n");
4010                         return ERROR;
4011                 }
4012                 // -- PC4500 missed it, try again
4013                 OUT4500(ai, SELECT0+whichbap, rid);
4014                 OUT4500(ai, OFFSET0+whichbap, offset);
4015                 timeout = 50;
4016         }
4017 }
4018 
4019 /* should only be called by aux_bap_read.  This aux function and the
4020    following use concepts not documented in the developers guide.  I
4021    got them from a patch given to my by Aironet */
4022 static u16 aux_setup(struct airo_info *ai, u16 page,
4023                      u16 offset, u16 *len)
4024 {
4025         u16 next;
4026 
4027         OUT4500(ai, AUXPAGE, page);
4028         OUT4500(ai, AUXOFF, 0);
4029         next = IN4500(ai, AUXDATA);
4030         *len = IN4500(ai, AUXDATA)&0xff;
4031         if (offset != 4) OUT4500(ai, AUXOFF, offset);
4032         return next;
4033 }
4034 
4035 /* requires call to bap_setup() first */
4036 static int aux_bap_read(struct airo_info *ai, __le16 *pu16Dst,
4037                         int bytelen, int whichbap)
4038 {
4039         u16 len;
4040         u16 page;
4041         u16 offset;
4042         u16 next;
4043         int words;
4044         int i;
4045         unsigned long flags;
4046 
4047         spin_lock_irqsave(&ai->aux_lock, flags);
4048         page = IN4500(ai, SWS0+whichbap);
4049         offset = IN4500(ai, SWS2+whichbap);
4050         next = aux_setup(ai, page, offset, &len);
4051         words = (bytelen+1)>>1;
4052 
4053         for (i=0; i<words;) {
4054                 int count;
4055                 count = (len>>1) < (words-i) ? (len>>1) : (words-i);
4056                 if ( !do8bitIO )
4057                         insw( ai->dev->base_addr+DATA0+whichbap,
4058                               pu16Dst+i,count );
4059                 else
4060                         insb( ai->dev->base_addr+DATA0+whichbap,
4061                               pu16Dst+i, count << 1 );
4062                 i += count;
4063                 if (i<words) {
4064                         next = aux_setup(ai, next, 4, &len);
4065                 }
4066         }
4067         spin_unlock_irqrestore(&ai->aux_lock, flags);
4068         return SUCCESS;
4069 }
4070 
4071 
4072 /* requires call to bap_setup() first */
4073 static int fast_bap_read(struct airo_info *ai, __le16 *pu16Dst,
4074                          int bytelen, int whichbap)
4075 {
4076         bytelen = (bytelen + 1) & (~1); // round up to even value
4077         if ( !do8bitIO )
4078                 insw( ai->dev->base_addr+DATA0+whichbap, pu16Dst, bytelen>>1 );
4079         else
4080                 insb( ai->dev->base_addr+DATA0+whichbap, pu16Dst, bytelen );
4081         return SUCCESS;
4082 }
4083 
4084 /* requires call to bap_setup() first */
4085 static int bap_write(struct airo_info *ai, const __le16 *pu16Src,
4086                      int bytelen, int whichbap)
4087 {
4088         bytelen = (bytelen + 1) & (~1); // round up to even value
4089         if ( !do8bitIO )
4090                 outsw( ai->dev->base_addr+DATA0+whichbap,
4091                        pu16Src, bytelen>>1 );
4092         else
4093                 outsb( ai->dev->base_addr+DATA0+whichbap, pu16Src, bytelen );
4094         return SUCCESS;
4095 }
4096 
4097 static int PC4500_accessrid(struct airo_info *ai, u16 rid, u16 accmd)
4098 {
4099         Cmd cmd; /* for issuing commands */
4100         Resp rsp; /* response from commands */
4101         u16 status;
4102 
4103         memset(&cmd, 0, sizeof(cmd));
4104         cmd.cmd = accmd;
4105         cmd.parm0 = rid;
4106         status = issuecommand(ai, &cmd, &rsp);
4107         if (status != 0) return status;
4108         if ( (rsp.status & 0x7F00) != 0) {
4109                 return (accmd << 8) + (rsp.rsp0 & 0xFF);
4110         }
4111         return 0;
4112 }
4113 
4114 /*  Note, that we are using BAP1 which is also used by transmit, so
4115  *  we must get a lock. */
4116 static int PC4500_readrid(struct airo_info *ai, u16 rid, void *pBuf, int len, int lock)
4117 {
4118         u16 status;
4119         int rc = SUCCESS;
4120 
4121         if (lock) {
4122                 if (down_interruptible(&ai->sem))
4123                         return ERROR;
4124         }
4125         if (test_bit(FLAG_MPI,&ai->flags)) {
4126                 Cmd cmd;
4127                 Resp rsp;
4128 
4129                 memset(&cmd, 0, sizeof(cmd));
4130                 memset(&rsp, 0, sizeof(rsp));
4131                 ai->config_desc.rid_desc.valid = 1;
4132                 ai->config_desc.rid_desc.len = RIDSIZE;
4133                 ai->config_desc.rid_desc.rid = 0;
4134                 ai->config_desc.rid_desc.host_addr = ai->ridbus;
4135 
4136                 cmd.cmd = CMD_ACCESS;
4137                 cmd.parm0 = rid;
4138 
4139                 memcpy_toio(ai->config_desc.card_ram_off,
4140                         &ai->config_desc.rid_desc, sizeof(Rid));
4141 
4142                 rc = issuecommand(ai, &cmd, &rsp);
4143 
4144                 if (rsp.status & 0x7f00)
4145                         rc = rsp.rsp0;
4146                 if (!rc)
4147                         memcpy(pBuf, ai->config_desc.virtual_host_addr, len);
4148                 goto done;
4149         } else {
4150                 if ((status = PC4500_accessrid(ai, rid, CMD_ACCESS))!=SUCCESS) {
4151                         rc = status;
4152                         goto done;
4153                 }
4154                 if (bap_setup(ai, rid, 0, BAP1) != SUCCESS) {
4155                         rc = ERROR;
4156                         goto done;
4157                 }
4158                 // read the rid length field
4159                 bap_read(ai, pBuf, 2, BAP1);
4160                 // length for remaining part of rid
4161                 len = min(len, (int)le16_to_cpu(*(__le16*)pBuf)) - 2;
4162 
4163                 if ( len <= 2 ) {
4164                         airo_print_err(ai->dev->name,
4165                                 "Rid %x has a length of %d which is too short",
4166                                 (int)rid, (int)len );
4167                         rc = ERROR;
4168                         goto done;
4169                 }
4170                 // read remainder of the rid
4171                 rc = bap_read(ai, ((__le16*)pBuf)+1, len, BAP1);
4172         }
4173 done:
4174         if (lock)
4175                 up(&ai->sem);
4176         return rc;
4177 }
4178 
4179 /*  Note, that we are using BAP1 which is also used by transmit, so
4180  *  make sure this isn't called when a transmit is happening */
4181 static int PC4500_writerid(struct airo_info *ai, u16 rid,
4182                            const void *pBuf, int len, int lock)
4183 {
4184         u16 status;
4185         int rc = SUCCESS;
4186 
4187         *(__le16*)pBuf = cpu_to_le16((u16)len);
4188 
4189         if (lock) {
4190                 if (down_interruptible(&ai->sem))
4191                         return ERROR;
4192         }
4193         if (test_bit(FLAG_MPI,&ai->flags)) {
4194                 Cmd cmd;
4195                 Resp rsp;
4196 
4197                 if (test_bit(FLAG_ENABLED, &ai->flags) && (RID_WEP_TEMP != rid))
4198                         airo_print_err(ai->dev->name,
4199                                 "%s: MAC should be disabled (rid=%04x)",
4200                                 __func__, rid);
4201                 memset(&cmd, 0, sizeof(cmd));
4202                 memset(&rsp, 0, sizeof(rsp));
4203 
4204                 ai->config_desc.rid_desc.valid = 1;
4205                 ai->config_desc.rid_desc.len = *((u16 *)pBuf);
4206                 ai->config_desc.rid_desc.rid = 0;
4207 
4208                 cmd.cmd = CMD_WRITERID;
4209                 cmd.parm0 = rid;
4210 
4211                 memcpy_toio(ai->config_desc.card_ram_off,
4212                         &ai->config_desc.rid_desc, sizeof(Rid));
4213 
4214                 if (len < 4 || len > 2047) {
4215                         airo_print_err(ai->dev->name, "%s: len=%d", __func__, len);
4216                         rc = -1;
4217                 } else {
4218                         memcpy(ai->config_desc.virtual_host_addr,
4219                                 pBuf, len);
4220 
4221                         rc = issuecommand(ai, &cmd, &rsp);
4222                         if ((rc & 0xff00) != 0) {
4223                                 airo_print_err(ai->dev->name, "%s: Write rid Error %d",
4224                                                 __func__, rc);
4225                                 airo_print_err(ai->dev->name, "%s: Cmd=%04x",
4226                                                 __func__, cmd.cmd);
4227                         }
4228 
4229                         if ((rsp.status & 0x7f00))
4230                                 rc = rsp.rsp0;
4231                 }
4232         } else {
4233                 // --- first access so that we can write the rid data
4234                 if ( (status = PC4500_accessrid(ai, rid, CMD_ACCESS)) != 0) {
4235                         rc = status;
4236                         goto done;
4237                 }
4238                 // --- now write the rid data
4239                 if (bap_setup(ai, rid, 0, BAP1) != SUCCESS) {
4240                         rc = ERROR;
4241                         goto done;
4242                 }
4243                 bap_write(ai, pBuf, len, BAP1);
4244                 // ---now commit the rid data
4245                 rc = PC4500_accessrid(ai, rid, 0x100|CMD_ACCESS);
4246         }
4247 done:
4248         if (lock)
4249                 up(&ai->sem);
4250         return rc;
4251 }
4252 
4253 /* Allocates a FID to be used for transmitting packets.  We only use
4254    one for now. */
4255 static u16 transmit_allocate(struct airo_info *ai, int lenPayload, int raw)
4256 {
4257         unsigned int loop = 3000;
4258         Cmd cmd;
4259         Resp rsp;
4260         u16 txFid;
4261         __le16 txControl;
4262 
4263         cmd.cmd = CMD_ALLOCATETX;
4264         cmd.parm0 = lenPayload;
4265         if (down_interruptible(&ai->sem))
4266                 return ERROR;
4267         if (issuecommand(ai, &cmd, &rsp) != SUCCESS) {
4268                 txFid = ERROR;
4269                 goto done;
4270         }
4271         if ( (rsp.status & 0xFF00) != 0) {
4272                 txFid = ERROR;
4273                 goto done;
4274         }
4275         /* wait for the allocate event/indication
4276          * It makes me kind of nervous that this can just sit here and spin,
4277          * but in practice it only loops like four times. */
4278         while (((IN4500(ai, EVSTAT) & EV_ALLOC) == 0) && --loop);
4279         if (!loop) {
4280                 txFid = ERROR;
4281                 goto done;
4282         }
4283 
4284         // get the allocated fid and acknowledge
4285         txFid = IN4500(ai, TXALLOCFID);
4286         OUT4500(ai, EVACK, EV_ALLOC);
4287 
4288         /*  The CARD is pretty cool since it converts the ethernet packet
4289          *  into 802.11.  Also note that we don't release the FID since we
4290          *  will be using the same one over and over again. */
4291         /*  We only have to setup the control once since we are not
4292          *  releasing the fid. */
4293         if (raw)
4294                 txControl = cpu_to_le16(TXCTL_TXOK | TXCTL_TXEX | TXCTL_802_11
4295                         | TXCTL_ETHERNET | TXCTL_NORELEASE);
4296         else
4297                 txControl = cpu_to_le16(TXCTL_TXOK | TXCTL_TXEX | TXCTL_802_3
4298                         | TXCTL_ETHERNET | TXCTL_NORELEASE);
4299         if (bap_setup(ai, txFid, 0x0008, BAP1) != SUCCESS)
4300                 txFid = ERROR;
4301         else
4302                 bap_write(ai, &txControl, sizeof(txControl), BAP1);
4303 
4304 done:
4305         up(&ai->sem);
4306 
4307         return txFid;
4308 }
4309 
4310 /* In general BAP1 is dedicated to transmiting packets.  However,
4311    since we need a BAP when accessing RIDs, we also use BAP1 for that.
4312    Make sure the BAP1 spinlock is held when this is called. */
4313 static int transmit_802_3_packet(struct airo_info *ai, int len, char *pPacket)
4314 {
4315         __le16 payloadLen;
4316         Cmd cmd;
4317         Resp rsp;
4318         int miclen = 0;
4319         u16 txFid = len;
4320         MICBuffer pMic;
4321 
4322         len >>= 16;
4323 
4324         if (len <= ETH_ALEN * 2) {
4325                 airo_print_warn(ai->dev->name, "Short packet %d", len);
4326                 return ERROR;
4327         }
4328         len -= ETH_ALEN * 2;
4329 
4330         if (test_bit(FLAG_MIC_CAPABLE, &ai->flags) && ai->micstats.enabled && 
4331             (ntohs(((__be16 *)pPacket)[6]) != 0x888E)) {
4332                 if (encapsulate(ai,(etherHead *)pPacket,&pMic,len) != SUCCESS)
4333                         return ERROR;
4334                 miclen = sizeof(pMic);
4335         }
4336         // packet is destination[6], source[6], payload[len-12]
4337         // write the payload length and dst/src/payload
4338         if (bap_setup(ai, txFid, 0x0036, BAP1) != SUCCESS) return ERROR;
4339         /* The hardware addresses aren't counted as part of the payload, so
4340          * we have to subtract the 12 bytes for the addresses off */
4341         payloadLen = cpu_to_le16(len + miclen);
4342         bap_write(ai, &payloadLen, sizeof(payloadLen),BAP1);
4343         bap_write(ai, (__le16*)pPacket, sizeof(etherHead), BAP1);
4344         if (miclen)
4345                 bap_write(ai, (__le16*)&pMic, miclen, BAP1);
4346         bap_write(ai, (__le16*)(pPacket + sizeof(etherHead)), len, BAP1);
4347         // issue the transmit command
4348         memset( &cmd, 0, sizeof( cmd ) );
4349         cmd.cmd = CMD_TRANSMIT;
4350         cmd.parm0 = txFid;
4351         if (issuecommand(ai, &cmd, &rsp) != SUCCESS) return ERROR;
4352         if ( (rsp.status & 0xFF00) != 0) return ERROR;
4353         return SUCCESS;
4354 }
4355 
4356 static int transmit_802_11_packet(struct airo_info *ai, int len, char *pPacket)
4357 {
4358         __le16 fc, payloadLen;
4359         Cmd cmd;
4360         Resp rsp;
4361         int hdrlen;
4362         static u8 tail[(30-10) + 2 + 6] = {[30-10] = 6};
4363         /* padding of header to full size + le16 gaplen (6) + gaplen bytes */
4364         u16 txFid = len;
4365         len >>= 16;
4366 
4367         fc = *(__le16*)pPacket;
4368         hdrlen = header_len(fc);
4369 
4370         if (len < hdrlen) {
4371                 airo_print_warn(ai->dev->name, "Short packet %d", len);
4372                 return ERROR;
4373         }
4374 
4375         /* packet is 802.11 header +  payload
4376          * write the payload length and dst/src/payload */
4377         if (bap_setup(ai, txFid, 6, BAP1) != SUCCESS) return ERROR;
4378         /* The 802.11 header aren't counted as part of the payload, so
4379          * we have to subtract the header bytes off */
4380         payloadLen = cpu_to_le16(len-hdrlen);
4381         bap_write(ai, &payloadLen, sizeof(payloadLen),BAP1);
4382         if (bap_setup(ai, txFid, 0x0014, BAP1) != SUCCESS) return ERROR;
4383         bap_write(ai, (__le16 *)pPacket, hdrlen, BAP1);
4384         bap_write(ai, (__le16 *)(tail + (hdrlen - 10)), 38 - hdrlen, BAP1);
4385 
4386         bap_write(ai, (__le16 *)(pPacket + hdrlen), len - hdrlen, BAP1);
4387         // issue the transmit command
4388         memset( &cmd, 0, sizeof( cmd ) );
4389         cmd.cmd = CMD_TRANSMIT;
4390         cmd.parm0 = txFid;
4391         if (issuecommand(ai, &cmd, &rsp) != SUCCESS) return ERROR;
4392         if ( (rsp.status & 0xFF00) != 0) return ERROR;
4393         return SUCCESS;
4394 }
4395 
4396 /*
4397  *  This is the proc_fs routines.  It is a bit messier than I would
4398  *  like!  Feel free to clean it up!
4399  */
4400 
4401 static ssize_t proc_read( struct file *file,
4402                           char __user *buffer,
4403                           size_t len,
4404                           loff_t *offset);
4405 
4406 static ssize_t proc_write( struct file *file,
4407                            const char __user *buffer,
4408                            size_t len,
4409                            loff_t *offset );
4410 static int proc_close( struct inode *inode, struct file *file );
4411 
4412 static int proc_stats_open( struct inode *inode, struct file *file );
4413 static int proc_statsdelta_open( struct inode *inode, struct file *file );
4414 static int proc_status_open( struct inode *inode, struct file *file );
4415 static int proc_SSID_open( struct inode *inode, struct file *file );
4416 static int proc_APList_open( struct inode *inode, struct file *file );
4417 static int proc_BSSList_open( struct inode *inode, struct file *file );
4418 static int proc_config_open( struct inode *inode, struct file *file );
4419 static int proc_wepkey_open( struct inode *inode, struct file *file );
4420 
4421 static const struct file_operations proc_statsdelta_ops = {
4422         .owner          = THIS_MODULE,
4423         .read           = proc_read,
4424         .open           = proc_statsdelta_open,
4425         .release        = proc_close,
4426         .llseek         = default_llseek,
4427 };
4428 
4429 static const struct file_operations proc_stats_ops = {
4430         .owner          = THIS_MODULE,
4431         .read           = proc_read,
4432         .open           = proc_stats_open,
4433         .release        = proc_close,
4434         .llseek         = default_llseek,
4435 };
4436 
4437 static const struct file_operations proc_status_ops = {
4438         .owner          = THIS_MODULE,
4439         .read           = proc_read,
4440         .open           = proc_status_open,
4441         .release        = proc_close,
4442         .llseek         = default_llseek,
4443 };
4444 
4445 static const struct file_operations proc_SSID_ops = {
4446         .owner          = THIS_MODULE,
4447         .read           = proc_read,
4448         .write          = proc_write,
4449         .open           = proc_SSID_open,
4450         .release        = proc_close,
4451         .llseek         = default_llseek,
4452 };
4453 
4454 static const struct file_operations proc_BSSList_ops = {
4455         .owner          = THIS_MODULE,
4456         .read           = proc_read,
4457         .write          = proc_write,
4458         .open           = proc_BSSList_open,
4459         .release        = proc_close,
4460         .llseek         = default_llseek,
4461 };
4462 
4463 static const struct file_operations proc_APList_ops = {
4464         .owner          = THIS_MODULE,
4465         .read           = proc_read,
4466         .write          = proc_write,
4467         .open           = proc_APList_open,
4468         .release        = proc_close,
4469         .llseek         = default_llseek,
4470 };
4471 
4472 static const struct file_operations proc_config_ops = {
4473         .owner          = THIS_MODULE,
4474         .read           = proc_read,
4475         .write          = proc_write,
4476         .open           = proc_config_open,
4477         .release        = proc_close,
4478         .llseek         = default_llseek,
4479 };
4480 
4481 static const struct file_operations proc_wepkey_ops = {
4482         .owner          = THIS_MODULE,
4483         .read           = proc_read,
4484         .write          = proc_write,
4485         .open           = proc_wepkey_open,
4486         .release        = proc_close,
4487         .llseek         = default_llseek,
4488 };
4489 
4490 static struct proc_dir_entry *airo_entry;
4491 
4492 struct proc_data {
4493         int release_buffer;
4494         int readlen;
4495         char *rbuffer;
4496         int writelen;
4497         int maxwritelen;
4498         char *wbuffer;
4499         void (*on_close) (struct inode *, struct file *);
4500 };
4501 
4502 static int setup_proc_entry( struct net_device *dev,
4503                              struct airo_info *apriv ) {
4504         struct proc_dir_entry *entry;
4505 
4506         /* First setup the device directory */
4507         strcpy(apriv->proc_name,dev->name);
4508         apriv->proc_entry = proc_mkdir_mode(apriv->proc_name, airo_perm,
4509                                             airo_entry);
4510         if (!apriv->proc_entry)
4511                 return -ENOMEM;
4512         proc_set_user(apriv->proc_entry, proc_kuid, proc_kgid);
4513 
4514         /* Setup the StatsDelta */
4515         entry = proc_create_data("StatsDelta", S_IRUGO & proc_perm,
4516                                  apriv->proc_entry, &proc_statsdelta_ops, dev);
4517         if (!entry)
4518                 goto fail;
4519         proc_set_user(entry, proc_kuid, proc_kgid);
4520 
4521         /* Setup the Stats */
4522         entry = proc_create_data("Stats", S_IRUGO & proc_perm,
4523                                  apriv->proc_entry, &proc_stats_ops, dev);
4524         if (!entry)
4525                 goto fail;
4526         proc_set_user(entry, proc_kuid, proc_kgid);
4527 
4528         /* Setup the Status */
4529         entry = proc_create_data("Status", S_IRUGO & proc_perm,
4530                                  apriv->proc_entry, &proc_status_ops, dev);
4531         if (!entry)
4532                 goto fail;
4533         proc_set_user(entry, proc_kuid, proc_kgid);
4534 
4535         /* Setup the Config */
4536         entry = proc_create_data("Config", proc_perm,
4537                                  apriv->proc_entry, &proc_config_ops, dev);
4538         if (!entry)
4539                 goto fail;
4540         proc_set_user(entry, proc_kuid, proc_kgid);
4541 
4542         /* Setup the SSID */
4543         entry = proc_create_data("SSID", proc_perm,
4544                                  apriv->proc_entry, &proc_SSID_ops, dev);
4545         if (!entry)
4546                 goto fail;
4547         proc_set_user(entry, proc_kuid, proc_kgid);
4548 
4549         /* Setup the APList */
4550         entry = proc_create_data("APList", proc_perm,
4551                                  apriv->proc_entry, &proc_APList_ops, dev);
4552         if (!entry)
4553                 goto fail;
4554         proc_set_user(entry, proc_kuid, proc_kgid);
4555 
4556         /* Setup the BSSList */
4557         entry = proc_create_data("BSSList", proc_perm,
4558                                  apriv->proc_entry, &proc_BSSList_ops, dev);
4559         if (!entry)
4560                 goto fail;
4561         proc_set_user(entry, proc_kuid, proc_kgid);
4562 
4563         /* Setup the WepKey */
4564         entry = proc_create_data("WepKey", proc_perm,
4565                                  apriv->proc_entry, &proc_wepkey_ops, dev);
4566         if (!entry)
4567                 goto fail;
4568         proc_set_user(entry, proc_kuid, proc_kgid);
4569         return 0;
4570 
4571 fail:
4572         remove_proc_subtree(apriv->proc_name, airo_entry);
4573         return -ENOMEM;
4574 }
4575 
4576 static int takedown_proc_entry( struct net_device *dev,
4577                                 struct airo_info *apriv )
4578 {
4579         remove_proc_subtree(apriv->proc_name, airo_entry);
4580         return 0;
4581 }
4582 
4583 /*
4584  *  What we want from the proc_fs is to be able to efficiently read
4585  *  and write the configuration.  To do this, we want to read the
4586  *  configuration when the file is opened and write it when the file is
4587  *  closed.  So basically we allocate a read buffer at open and fill it
4588  *  with data, and allocate a write buffer and read it at close.
4589  */
4590 
4591 /*
4592  *  The read routine is generic, it relies on the preallocated rbuffer
4593  *  to supply the data.
4594  */
4595 static ssize_t proc_read( struct file *file,
4596                           char __user *buffer,
4597                           size_t len,
4598                           loff_t *offset )
4599 {
4600         struct proc_data *priv = file->private_data;
4601 
4602         if (!priv->rbuffer)
4603                 return -EINVAL;
4604 
4605         return simple_read_from_buffer(buffer, len, offset, priv->rbuffer,
4606                                         priv->readlen);
4607 }
4608 
4609 /*
4610  *  The write routine is generic, it fills in a preallocated rbuffer
4611  *  to supply the data.
4612  */
4613 static ssize_t proc_write( struct file *file,
4614                            const char __user *buffer,
4615                            size_t len,
4616                            loff_t *offset )
4617 {
4618         ssize_t ret;
4619         struct proc_data *priv = file->private_data;
4620 
4621         if (!priv->wbuffer)
4622                 return -EINVAL;
4623 
4624         ret = simple_write_to_buffer(priv->wbuffer, priv->maxwritelen, offset,
4625                                         buffer, len);
4626         if (ret > 0)
4627                 priv->writelen = max_t(int, priv->writelen, *offset);
4628 
4629         return ret;
4630 }
4631 
4632 static int proc_status_open(struct inode *inode, struct file *file)
4633 {
4634         struct proc_data *data;
4635         struct net_device *dev = PDE_DATA(inode);
4636         struct airo_info *apriv = dev->ml_priv;
4637         CapabilityRid cap_rid;
4638         StatusRid status_rid;
4639         u16 mode;
4640         int i;
4641 
4642         if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
4643                 return -ENOMEM;
4644         data = file->private_data;
4645         if ((data->rbuffer = kmalloc( 2048, GFP_KERNEL )) == NULL) {
4646                 kfree (file->private_data);
4647                 return -ENOMEM;
4648         }
4649 
4650         readStatusRid(apriv, &status_rid, 1);
4651         readCapabilityRid(apriv, &cap_rid, 1);
4652 
4653         mode = le16_to_cpu(status_rid.mode);
4654 
4655         i = sprintf(data->rbuffer, "Status: %s%s%s%s%s%s%s%s%s\n",
4656                     mode & 1 ? "CFG ": "",
4657                     mode & 2 ? "ACT ": "",
4658                     mode & 0x10 ? "SYN ": "",
4659                     mode & 0x20 ? "LNK ": "",
4660                     mode & 0x40 ? "LEAP ": "",
4661                     mode & 0x80 ? "PRIV ": "",
4662                     mode & 0x100 ? "KEY ": "",
4663                     mode & 0x200 ? "WEP ": "",
4664                     mode & 0x8000 ? "ERR ": "");
4665         sprintf( data->rbuffer+i, "Mode: %x\n"
4666                  "Signal Strength: %d\n"
4667                  "Signal Quality: %d\n"
4668                  "SSID: %-.*s\n"
4669                  "AP: %-.16s\n"
4670                  "Freq: %d\n"
4671                  "BitRate: %dmbs\n"
4672                  "Driver Version: %s\n"
4673                  "Device: %s\nManufacturer: %s\nFirmware Version: %s\n"
4674                  "Radio type: %x\nCountry: %x\nHardware Version: %x\n"
4675                  "Software Version: %x\nSoftware Subversion: %x\n"
4676                  "Boot block version: %x\n",
4677                  le16_to_cpu(status_rid.mode),
4678                  le16_to_cpu(status_rid.normalizedSignalStrength),
4679                  le16_to_cpu(status_rid.signalQuality),
4680                  le16_to_cpu(status_rid.SSIDlen),
4681                  status_rid.SSID,
4682                  status_rid.apName,
4683                  le16_to_cpu(status_rid.channel),
4684                  le16_to_cpu(status_rid.currentXmitRate) / 2,
4685                  version,
4686                  cap_rid.prodName,
4687                  cap_rid.manName,
4688                  cap_rid.prodVer,
4689                  le16_to_cpu(cap_rid.radioType),
4690                  le16_to_cpu(cap_rid.country),
4691                  le16_to_cpu(cap_rid.hardVer),
4692                  le16_to_cpu(cap_rid.softVer),
4693                  le16_to_cpu(cap_rid.softSubVer),
4694                  le16_to_cpu(cap_rid.bootBlockVer));
4695         data->readlen = strlen( data->rbuffer );
4696         return 0;
4697 }
4698 
4699 static int proc_stats_rid_open(struct inode*, struct file*, u16);
4700 static int proc_statsdelta_open( struct inode *inode,
4701                                  struct file *file ) {
4702         if (file->f_mode&FMODE_WRITE) {
4703                 return proc_stats_rid_open(inode, file, RID_STATSDELTACLEAR);
4704         }
4705         return proc_stats_rid_open(inode, file, RID_STATSDELTA);
4706 }
4707 
4708 static int proc_stats_open( struct inode *inode, struct file *file ) {
4709         return proc_stats_rid_open(inode, file, RID_STATS);
4710 }
4711 
4712 static int proc_stats_rid_open( struct inode *inode,
4713                                 struct file *file,
4714                                 u16 rid )
4715 {
4716         struct proc_data *data;
4717         struct net_device *dev = PDE_DATA(inode);
4718         struct airo_info *apriv = dev->ml_priv;
4719         StatsRid stats;
4720         int i, j;
4721         __le32 *vals = stats.vals;
4722         int len;
4723 
4724         if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
4725                 return -ENOMEM;
4726         data = file->private_data;
4727         if ((data->rbuffer = kmalloc( 4096, GFP_KERNEL )) == NULL) {
4728                 kfree (file->private_data);
4729                 return -ENOMEM;
4730         }
4731 
4732         readStatsRid(apriv, &stats, rid, 1);
4733         len = le16_to_cpu(stats.len);
4734 
4735         j = 0;
4736         for(i=0; statsLabels[i]!=(char *)-1 && i*4<len; i++) {
4737                 if (!statsLabels[i]) continue;
4738                 if (j+strlen(statsLabels[i])+16>4096) {
4739                         airo_print_warn(apriv->dev->name,
4740                                "Potentially disastrous buffer overflow averted!");
4741                         break;
4742                 }
4743                 j+=sprintf(data->rbuffer+j, "%s: %u\n", statsLabels[i],
4744                                 le32_to_cpu(vals[i]));
4745         }
4746         if (i*4 >= len) {
4747                 airo_print_warn(apriv->dev->name, "Got a short rid");
4748         }
4749         data->readlen = j;
4750         return 0;
4751 }
4752 
4753 static int get_dec_u16( char *buffer, int *start, int limit ) {
4754         u16 value;
4755         int valid = 0;
4756         for (value = 0; *start < limit && buffer[*start] >= '' &&
4757                         buffer[*start] <= '9'; (*start)++) {
4758                 valid = 1;
4759                 value *= 10;
4760                 value += buffer[*start] - '';
4761         }
4762         if ( !valid ) return -1;
4763         return value;
4764 }
4765 
4766 static int airo_config_commit(struct net_device *dev,
4767                               struct iw_request_info *info, void *zwrq,
4768                               char *extra);
4769 
4770 static inline int sniffing_mode(struct airo_info *ai)
4771 {
4772         return (le16_to_cpu(ai->config.rmode) & le16_to_cpu(RXMODE_MASK)) >=
4773                 le16_to_cpu(RXMODE_RFMON);
4774 }
4775 
4776 static void proc_config_on_close(struct inode *inode, struct file *file)
4777 {
4778         struct proc_data *data = file->private_data;
4779         struct net_device *dev = PDE_DATA(inode);
4780         struct airo_info *ai = dev->ml_priv;
4781         char *line;
4782 
4783         if ( !data->writelen ) return;
4784 
4785         readConfigRid(ai, 1);
4786         set_bit (FLAG_COMMIT, &ai->flags);
4787 
4788         line = data->wbuffer;
4789         while( line[0] ) {
4790 /*** Mode processing */
4791                 if ( !strncmp( line, "Mode: ", 6 ) ) {
4792                         line += 6;
4793                         if (sniffing_mode(ai))
4794                                 set_bit (FLAG_RESET, &ai->flags);
4795                         ai->config.rmode &= ~RXMODE_FULL_MASK;
4796                         clear_bit (FLAG_802_11, &ai->flags);
4797                         ai->config.opmode &= ~MODE_CFG_MASK;
4798                         ai->config.scanMode = SCANMODE_ACTIVE;
4799                         if ( line[0] == 'a' ) {
4800                                 ai->config.opmode |= MODE_STA_IBSS;
4801                         } else {
4802                                 ai->config.opmode |= MODE_STA_ESS;
4803                                 if ( line[0] == 'r' ) {
4804                                         ai->config.rmode |= RXMODE_RFMON | RXMODE_DISABLE_802_3_HEADER;
4805                                         ai->config.scanMode = SCANMODE_PASSIVE;
4806                                         set_bit (FLAG_802_11, &ai->flags);
4807                                 } else if ( line[0] == 'y' ) {
4808                                         ai->config.rmode |= RXMODE_RFMON_ANYBSS | RXMODE_DISABLE_802_3_HEADER;
4809                                         ai->config.scanMode = SCANMODE_PASSIVE;
4810                                         set_bit (FLAG_802_11, &ai->flags);
4811                                 } else if ( line[0] == 'l' )
4812                                         ai->config.rmode |= RXMODE_LANMON;
4813                         }
4814                         set_bit (FLAG_COMMIT, &ai->flags);
4815                 }
4816 
4817 /*** Radio status */
4818                 else if (!strncmp(line,"Radio: ", 7)) {
4819                         line += 7;
4820                         if (!strncmp(line,"off",3)) {
4821                                 set_bit (FLAG_RADIO_OFF, &ai->flags);
4822                         } else {
4823                                 clear_bit (FLAG_RADIO_OFF, &ai->flags);
4824                         }
4825                 }
4826 /*** NodeName processing */
4827                 else if ( !strncmp( line, "NodeName: ", 10 ) ) {
4828                         int j;
4829 
4830                         line += 10;
4831                         memset( ai->config.nodeName, 0, 16 );
4832 /* Do the name, assume a space between the mode and node name */
4833                         for( j = 0; j < 16 && line[j] != '\n'; j++ ) {
4834                                 ai->config.nodeName[j] = line[j];
4835                         }
4836                         set_bit (FLAG_COMMIT, &ai->flags);
4837                 }
4838 
4839 /*** PowerMode processing */
4840                 else if ( !strncmp( line, "PowerMode: ", 11 ) ) {
4841                         line += 11;
4842                         if ( !strncmp( line, "PSPCAM", 6 ) ) {
4843                                 ai->config.powerSaveMode = POWERSAVE_PSPCAM;
4844                                 set_bit (FLAG_COMMIT, &ai->flags);
4845                         } else if ( !strncmp( line, "PSP", 3 ) ) {
4846                                 ai->config.powerSaveMode = POWERSAVE_PSP;
4847                                 set_bit (FLAG_COMMIT, &ai->flags);
4848                         } else {
4849                                 ai->config.powerSaveMode = POWERSAVE_CAM;
4850                                 set_bit (FLAG_COMMIT, &ai->flags);
4851                         }
4852                 } else if ( !strncmp( line, "DataRates: ", 11 ) ) {
4853                         int v, i = 0, k = 0; /* i is index into line,
4854                                                 k is index to rates */
4855 
4856                         line += 11;
4857                         while((v = get_dec_u16(line, &i, 3))!=-1) {
4858                                 ai->config.rates[k++] = (u8)v;
4859                                 line += i + 1;
4860                                 i = 0;
4861                         }
4862                         set_bit (FLAG_COMMIT, &ai->flags);
4863                 } else if ( !strncmp( line, "Channel: ", 9 ) ) {
4864                         int v, i = 0;
4865                         line += 9;
4866                         v = get_dec_u16(line, &i, i+3);
4867                         if ( v != -1 ) {
4868                                 ai->config.channelSet = cpu_to_le16(v);
4869                                 set_bit (FLAG_COMMIT, &ai->flags);
4870                         }
4871                 } else if ( !strncmp( line, "XmitPower: ", 11 ) ) {
4872                         int v, i = 0;
4873                         line += 11;
4874                         v = get_dec_u16(line, &i, i+3);
4875                         if ( v != -1 ) {
4876                                 ai->config.txPower = cpu_to_le16(v);
4877                                 set_bit (FLAG_COMMIT, &ai->flags);
4878                         }
4879                 } else if ( !strncmp( line, "WEP: ", 5 ) ) {
4880                         line += 5;
4881                         switch( line[0] ) {
4882                         case 's':
4883                                 ai->config.authType = AUTH_SHAREDKEY;
4884                                 break;
4885                         case 'e':
4886                                 ai->config.authType = AUTH_ENCRYPT;
4887                                 break;
4888                         default:
4889                                 ai->config.authType = AUTH_OPEN;
4890                                 break;
4891                         }
4892                         set_bit (FLAG_COMMIT, &ai->flags);
4893                 } else if ( !strncmp( line, "LongRetryLimit: ", 16 ) ) {
4894                         int v, i = 0;
4895 
4896                         line += 16;
4897                         v = get_dec_u16(line, &i, 3);
4898                         v = (v<0) ? 0 : ((v>255) ? 255 : v);
4899                         ai->config.longRetryLimit = cpu_to_le16(v);
4900                         set_bit (FLAG_COMMIT, &ai->flags);
4901                 } else if ( !strncmp( line, "ShortRetryLimit: ", 17 ) ) {
4902                         int v, i = 0;
4903 
4904                         line += 17;
4905                         v = get_dec_u16(line, &i, 3);
4906                         v = (v<0) ? 0 : ((v>255) ? 255 : v);
4907                         ai->config.shortRetryLimit = cpu_to_le16(v);
4908                         set_bit (FLAG_COMMIT, &ai->flags);
4909                 } else if ( !strncmp( line, "RTSThreshold: ", 14 ) ) {
4910                         int v, i = 0;
4911 
4912                         line += 14;
4913                         v = get_dec_u16(line, &i, 4);
4914                         v = (v<0) ? 0 : ((v>AIRO_DEF_MTU) ? AIRO_DEF_MTU : v);
4915                         ai->config.rtsThres = cpu_to_le16(v);
4916                         set_bit (FLAG_COMMIT, &ai->flags);
4917                 } else if ( !strncmp( line, "TXMSDULifetime: ", 16 ) ) {
4918                         int v, i = 0;
4919 
4920                         line += 16;
4921                         v = get_dec_u16(line, &i, 5);
4922                         v = (v<0) ? 0 : v;
4923                         ai->config.txLifetime = cpu_to_le16(v);
4924                         set_bit (FLAG_COMMIT, &ai->flags);
4925                 } else if ( !strncmp( line, "RXMSDULifetime: ", 16 ) ) {
4926                         int v, i = 0;
4927 
4928                         line += 16;
4929                         v = get_dec_u16(line, &i, 5);
4930                         v = (v<0) ? 0 : v;
4931                         ai->config.rxLifetime = cpu_to_le16(v);
4932                         set_bit (FLAG_COMMIT, &ai->flags);
4933                 } else if ( !strncmp( line, "TXDiversity: ", 13 ) ) {
4934                         ai->config.txDiversity =
4935                                 (line[13]=='l') ? 1 :
4936                                 ((line[13]=='r')? 2: 3);
4937                         set_bit (FLAG_COMMIT, &ai->flags);
4938                 } else if ( !strncmp( line, "RXDiversity: ", 13 ) ) {
4939                         ai->config.rxDiversity =
4940                                 (line[13]=='l') ? 1 :
4941                                 ((line[13]=='r')? 2: 3);
4942                         set_bit (FLAG_COMMIT, &ai->flags);
4943                 } else if ( !strncmp( line, "FragThreshold: ", 15 ) ) {
4944                         int v, i = 0;
4945 
4946                         line += 15;
4947                         v = get_dec_u16(line, &i, 4);
4948                         v = (v<256) ? 256 : ((v>AIRO_DEF_MTU) ? AIRO_DEF_MTU : v);
4949                         v = v & 0xfffe; /* Make sure its even */
4950                         ai->config.fragThresh = cpu_to_le16(v);
4951                         set_bit (FLAG_COMMIT, &ai->flags);
4952                 } else if (!strncmp(line, "Modulation: ", 12)) {
4953                         line += 12;
4954                         switch(*line) {
4955                         case 'd':  ai->config.modulation=MOD_DEFAULT; set_bit(FLAG_COMMIT, &ai->flags); break;
4956                         case 'c':  ai->config.modulation=MOD_CCK; set_bit(FLAG_COMMIT, &ai->flags); break;
4957                         case 'm':  ai->config.modulation=MOD_MOK; set_bit(FLAG_COMMIT, &ai->flags); break;
4958                         default: airo_print_warn(ai->dev->name, "Unknown modulation");
4959                         }
4960                 } else if (!strncmp(line, "Preamble: ", 10)) {
4961                         line += 10;
4962                         switch(*line) {
4963                         case 'a': ai->config.preamble=PREAMBLE_AUTO; set_bit(FLAG_COMMIT, &ai->flags); break;
4964                         case 'l': ai->config.preamble=PREAMBLE_LONG; set_bit(FLAG_COMMIT, &ai->flags); break;
4965                         case 's': ai->config.preamble=PREAMBLE_SHORT; set_bit(FLAG_COMMIT, &ai->flags); break;
4966                         default: airo_print_warn(ai->dev->name, "Unknown preamble");
4967                         }
4968                 } else {
4969                         airo_print_warn(ai->dev->name, "Couldn't figure out %s", line);
4970                 }
4971                 while( line[0] && line[0] != '\n' ) line++;
4972                 if ( line[0] ) line++;
4973         }
4974         airo_config_commit(dev, NULL, NULL, NULL);
4975 }
4976 
4977 static const char *get_rmode(__le16 mode)
4978 {
4979         switch(mode & RXMODE_MASK) {
4980         case RXMODE_RFMON:  return "rfmon";
4981         case RXMODE_RFMON_ANYBSS:  return "yna (any) bss rfmon";
4982         case RXMODE_LANMON:  return "lanmon";
4983         }
4984         return "ESS";
4985 }
4986 
4987 static int proc_config_open(struct inode *inode, struct file *file)
4988 {
4989         struct proc_data *data;
4990         struct net_device *dev = PDE_DATA(inode);
4991         struct airo_info *ai = dev->ml_priv;
4992         int i;
4993         __le16 mode;
4994 
4995         if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
4996                 return -ENOMEM;
4997         data = file->private_data;
4998         if ((data->rbuffer = kmalloc( 2048, GFP_KERNEL )) == NULL) {
4999                 kfree (file->private_data);
5000                 return -ENOMEM;
5001         }
5002         if ((data->wbuffer = kzalloc( 2048, GFP_KERNEL )) == NULL) {
5003                 kfree (data->rbuffer);
5004                 kfree (file->private_data);
5005                 return -ENOMEM;
5006         }
5007         data->maxwritelen = 2048;
5008         data->on_close = proc_config_on_close;
5009 
5010         readConfigRid(ai, 1);
5011 
5012         mode = ai->config.opmode & MODE_CFG_MASK;
5013         i = sprintf( data->rbuffer,
5014                      "Mode: %s\n"
5015                      "Radio: %s\n"
5016                      "NodeName: %-16s\n"
5017                      "PowerMode: %s\n"
5018                      "DataRates: %d %d %d %d %d %d %d %d\n"
5019                      "Channel: %d\n"
5020                      "XmitPower: %d\n",
5021                      mode == MODE_STA_IBSS ? "adhoc" :
5022                      mode == MODE_STA_ESS ? get_rmode(ai->config.rmode):
5023                      mode == MODE_AP ? "AP" :
5024                      mode == MODE_AP_RPTR ? "AP RPTR" : "Error",
5025                      test_bit(FLAG_RADIO_OFF, &ai->flags) ? "off" : "on",
5026                      ai->config.nodeName,
5027                      ai->config.powerSaveMode == POWERSAVE_CAM ? "CAM" :
5028                      ai->config.powerSaveMode == POWERSAVE_PSP ? "PSP" :
5029                      ai->config.powerSaveMode == POWERSAVE_PSPCAM ? "PSPCAM" :
5030                      "Error",
5031                      (int)ai->config.rates[0],
5032                      (int)ai->config.rates[1],
5033                      (int)ai->config.rates[2],
5034                      (int)ai->config.rates[3],
5035                      (int)ai->config.rates[4],
5036                      (int)ai->config.rates[5],
5037                      (int)ai->config.rates[6],
5038                      (int)ai->config.rates[7],
5039                      le16_to_cpu(ai->config.channelSet),
5040                      le16_to_cpu(ai->config.txPower)
5041                 );
5042         sprintf( data->rbuffer + i,
5043                  "LongRetryLimit: %d\n"
5044                  "ShortRetryLimit: %d\n"
5045                  "RTSThreshold: %d\n"
5046                  "TXMSDULifetime: %d\n"
5047                  "RXMSDULifetime: %d\n"
5048                  "TXDiversity: %s\n"
5049                  "RXDiversity: %s\n"
5050                  "FragThreshold: %d\n"
5051                  "WEP: %s\n"
5052                  "Modulation: %s\n"
5053                  "Preamble: %s\n",
5054                  le16_to_cpu(ai->config.longRetryLimit),
5055                  le16_to_cpu(ai->config.shortRetryLimit),
5056                  le16_to_cpu(ai->config.rtsThres),
5057                  le16_to_cpu(ai->config.txLifetime),
5058                  le16_to_cpu(ai->config.rxLifetime),
5059                  ai->config.txDiversity == 1 ? "left" :
5060                  ai->config.txDiversity == 2 ? "right" : "both",
5061                  ai->config.rxDiversity == 1 ? "left" :
5062                  ai->config.rxDiversity == 2 ? "right" : "both",
5063                  le16_to_cpu(ai->config.fragThresh),
5064                  ai->config.authType == AUTH_ENCRYPT ? "encrypt" :
5065                  ai->config.authType == AUTH_SHAREDKEY ? "shared" : "open",
5066                  ai->config.modulation == MOD_DEFAULT ? "default" :
5067                  ai->config.modulation == MOD_CCK ? "cck" :
5068                  ai->config.modulation == MOD_MOK ? "mok" : "error",
5069                  ai->config.preamble == PREAMBLE_AUTO ? "auto" :
5070                  ai->config.preamble == PREAMBLE_LONG ? "long" :
5071                  ai->config.preamble == PREAMBLE_SHORT ? "short" : "error"
5072                 );
5073         data->readlen = strlen( data->rbuffer );
5074         return 0;
5075 }
5076 
5077 static void proc_SSID_on_close(struct inode *inode, struct file *file)
5078 {
5079         struct proc_data *data = file->private_data;
5080         struct net_device *dev = PDE_DATA(inode);
5081         struct airo_info *ai = dev->ml_priv;
5082         SsidRid SSID_rid;
5083         int i;
5084         char *p = data->wbuffer;
5085         char *end = p + data->writelen;
5086 
5087         if (!data->writelen)
5088                 return;
5089 
5090         *end = '\n'; /* sentinel; we have space for it */
5091 
5092         memset(&SSID_rid, 0, sizeof(SSID_rid));
5093 
5094         for (i = 0; i < 3 && p < end; i++) {
5095                 int j = 0;
5096                 /* copy up to 32 characters from this line */
5097                 while (*p != '\n' && j < 32)
5098                         SSID_rid.ssids[i].ssid[j++] = *p++;
5099                 if (j == 0)
5100                         break;
5101                 SSID_rid.ssids[i].len = cpu_to_le16(j);
5102                 /* skip to the beginning of the next line */
5103                 while (*p++ != '\n')
5104                         ;
5105         }
5106         if (i)
5107                 SSID_rid.len = cpu_to_le16(sizeof(SSID_rid));
5108         disable_MAC(ai, 1);
5109         writeSsidRid(ai, &SSID_rid, 1);
5110         enable_MAC(ai, 1);
5111 }
5112 
5113 static void proc_APList_on_close( struct inode *inode, struct file *file ) {
5114         struct proc_data *data = file->private_data;
5115         struct net_device *dev = PDE_DATA(inode);
5116         struct airo_info *ai = dev->ml_priv;
5117         APListRid APList_rid;
5118         int i;
5119 
5120         if ( !data->writelen ) return;
5121 
5122         memset( &APList_rid, 0, sizeof(APList_rid) );
5123         APList_rid.len = cpu_to_le16(sizeof(APList_rid));
5124 
5125         for( i = 0; i < 4 && data->writelen >= (i+1)*6*3; i++ ) {
5126                 int j;
5127                 for( j = 0; j < 6*3 && data->wbuffer[j+i*6*3]; j++ ) {
5128                         switch(j%3) {
5129                         case 0:
5130                                 APList_rid.ap[i][j/3]=
5131                                         hex_to_bin(data->wbuffer[j+i*6*3])<<4;
5132                                 break;
5133                         case 1:
5134                                 APList_rid.ap[i][j/3]|=
5135                                         hex_to_bin(data->wbuffer[j+i*6*3]);
5136                                 break;
5137                         }
5138                 }
5139         }
5140         disable_MAC(ai, 1);
5141         writeAPListRid(ai, &APList_rid, 1);
5142         enable_MAC(ai, 1);
5143 }
5144 
5145 /* This function wraps PC4500_writerid with a MAC disable */
5146 static int do_writerid( struct airo_info *ai, u16 rid, const void *rid_data,
5147                         int len, int dummy ) {
5148         int rc;
5149 
5150         disable_MAC(ai, 1);
5151         rc = PC4500_writerid(ai, rid, rid_data, len, 1);
5152         enable_MAC(ai, 1);
5153         return rc;
5154 }
5155 
5156 /* Returns the WEP key at the specified index, or -1 if that key does
5157  * not exist.  The buffer is assumed to be at least 16 bytes in length.
5158  */
5159 static int get_wep_key(struct airo_info *ai, u16 index, char *buf, u16 buflen)
5160 {
5161         WepKeyRid wkr;
5162         int rc;
5163         __le16 lastindex;
5164 
5165         rc = readWepKeyRid(ai, &wkr, 1, 1);
5166         if (rc != SUCCESS)
5167                 return -1;
5168         do {
5169                 lastindex = wkr.kindex;
5170                 if (le16_to_cpu(wkr.kindex) == index) {
5171                         int klen = min_t(int, buflen, le16_to_cpu(wkr.klen));
5172                         memcpy(buf, wkr.key, klen);
5173                         return klen;
5174                 }
5175                 rc = readWepKeyRid(ai, &wkr, 0, 1);
5176                 if (rc != SUCCESS)
5177                         return -1;
5178         } while (lastindex != wkr.kindex);
5179         return -1;
5180 }
5181 
5182 static int get_wep_tx_idx(struct airo_info *ai)
5183 {
5184         WepKeyRid wkr;
5185         int rc;
5186         __le16 lastindex;
5187 
5188         rc = readWepKeyRid(ai, &wkr, 1, 1);
5189         if (rc != SUCCESS)
5190                 return -1;
5191         do {
5192                 lastindex = wkr.kindex;
5193                 if (wkr.kindex == cpu_to_le16(0xffff))
5194                         return wkr.mac[0];
5195                 rc = readWepKeyRid(ai, &wkr, 0, 1);
5196                 if (rc != SUCCESS)
5197                         return -1;
5198         } while (lastindex != wkr.kindex);
5199         return -1;
5200 }
5201 
5202 static int set_wep_key(struct airo_info *ai, u16 index, const char *key,
5203                        u16 keylen, int perm, int lock)
5204 {
5205         static const unsigned char macaddr[ETH_ALEN] = { 0x01, 0, 0, 0, 0, 0 };
5206         WepKeyRid wkr;
5207         int rc;
5208 
5209         if (WARN_ON(keylen == 0))
5210                 return -1;
5211 
5212         memset(&wkr, 0, sizeof(wkr));
5213         wkr.len = cpu_to_le16(sizeof(wkr));
5214         wkr.kindex = cpu_to_le16(index);
5215         wkr.klen = cpu_to_le16(keylen);
5216         memcpy(wkr.key, key, keylen);
5217         memcpy(wkr.mac, macaddr, ETH_ALEN);
5218 
5219         if (perm) disable_MAC(ai, lock);
5220         rc = writeWepKeyRid(ai, &wkr, perm, lock);
5221         if (perm) enable_MAC(ai, lock);
5222         return rc;
5223 }
5224 
5225 static int set_wep_tx_idx(struct airo_info *ai, u16 index, int perm, int lock)
5226 {
5227         WepKeyRid wkr;
5228         int rc;
5229 
5230         memset(&wkr, 0, sizeof(wkr));
5231         wkr.len = cpu_to_le16(sizeof(wkr));
5232         wkr.kindex = cpu_to_le16(0xffff);
5233         wkr.mac[0] = (char)index;
5234 
5235         if (perm) {
5236                 ai->defindex = (char)index;
5237                 disable_MAC(ai, lock);
5238         }
5239 
5240         rc = writeWepKeyRid(ai, &wkr, perm, lock);
5241 
5242         if (perm)
5243                 enable_MAC(ai, lock);
5244         return rc;
5245 }
5246 
5247 static void proc_wepkey_on_close( struct inode *inode, struct file *file ) {
5248         struct proc_data *data;
5249         struct net_device *dev = PDE_DATA(inode);
5250         struct airo_info *ai = dev->ml_priv;
5251         int i, rc;
5252         char key[16];
5253         u16 index = 0;
5254         int j = 0;
5255 
5256         memset(key, 0, sizeof(key));
5257 
5258         data = file->private_data;
5259         if ( !data->writelen ) return;
5260 
5261         if (data->wbuffer[0] >= '' && data->wbuffer[0] <= '3' &&
5262             (data->wbuffer[1] == ' ' || data->wbuffer[1] == '\n')) {
5263                 index = data->wbuffer[0] - '';
5264                 if (data->wbuffer[1] == '\n') {
5265                         rc = set_wep_tx_idx(ai, index, 1, 1);
5266                         if (rc < 0) {
5267                                 airo_print_err(ai->dev->name, "failed to set "
5268                                                "WEP transmit index to %d: %d.",
5269                                                index, rc);
5270                         }
5271                         return;
5272                 }
5273                 j = 2;
5274         } else {
5275                 airo_print_err(ai->dev->name, "WepKey passed invalid key index");
5276                 return;
5277         }
5278 
5279         for( i = 0; i < 16*3 && data->wbuffer[i+j]; i++ ) {
5280                 switch(i%3) {
5281                 case 0:
5282                         key[i/3] = hex_to_bin(data->wbuffer[i+j])<<4;
5283                         break;
5284                 case 1:
5285                         key[i/3] |= hex_to_bin(data->wbuffer[i+j]);
5286                         break;
5287                 }
5288         }
5289 
5290         rc = set_wep_key(ai, index, key, i/3, 1, 1);
5291         if (rc < 0) {
5292                 airo_print_err(ai->dev->name, "failed to set WEP key at index "
5293                                "%d: %d.", index, rc);
5294         }
5295 }
5296 
5297 static int proc_wepkey_open( struct inode *inode, struct file *file )
5298 {
5299         struct proc_data *data;
5300         struct net_device *dev = PDE_DATA(inode);
5301         struct airo_info *ai = dev->ml_priv;
5302         char *ptr;
5303         WepKeyRid wkr;
5304         __le16 lastindex;
5305         int j=0;
5306         int rc;
5307 
5308         if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
5309                 return -ENOMEM;
5310         memset(&wkr, 0, sizeof(wkr));
5311         data = file->private_data;
5312         if ((data->rbuffer = kzalloc( 180, GFP_KERNEL )) == NULL) {
5313                 kfree (file->private_data);
5314                 return -ENOMEM;
5315         }
5316         data->writelen = 0;
5317         data->maxwritelen = 80;
5318         if ((data->wbuffer = kzalloc( 80, GFP_KERNEL )) == NULL) {
5319                 kfree (data->rbuffer);
5320                 kfree (file->private_data);
5321                 return -ENOMEM;
5322         }
5323         data->on_close = proc_wepkey_on_close;
5324 
5325         ptr = data->rbuffer;
5326         strcpy(ptr, "No wep keys\n");
5327         rc = readWepKeyRid(ai, &wkr, 1, 1);
5328         if (rc == SUCCESS) do {
5329                 lastindex = wkr.kindex;
5330                 if (wkr.kindex == cpu_to_le16(0xffff)) {
5331                         j += sprintf(ptr+j, "Tx key = %d\n",
5332                                      (int)wkr.mac[0]);
5333                 } else {
5334                         j += sprintf(ptr+j, "Key %d set with length = %d\n",
5335                                      le16_to_cpu(wkr.kindex),
5336                                      le16_to_cpu(wkr.klen));
5337                 }
5338                 readWepKeyRid(ai, &wkr, 0, 1);
5339         } while((lastindex != wkr.kindex) && (j < 180-30));
5340 
5341         data->readlen = strlen( data->rbuffer );
5342         return 0;
5343 }
5344 
5345 static int proc_SSID_open(struct inode *inode, struct file *file)
5346 {
5347         struct proc_data *data;
5348         struct net_device *dev = PDE_DATA(inode);
5349         struct airo_info *ai = dev->ml_priv;
5350         int i;
5351         char *ptr;
5352         SsidRid SSID_rid;
5353 
5354         if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
5355                 return -ENOMEM;
5356         data = file->private_data;
5357         if ((data->rbuffer = kmalloc( 104, GFP_KERNEL )) == NULL) {
5358                 kfree (file->private_data);
5359                 return -ENOMEM;
5360         }
5361         data->writelen = 0;
5362         data->maxwritelen = 33*3;
5363         /* allocate maxwritelen + 1; we'll want a sentinel */
5364         if ((data->wbuffer = kzalloc(33*3 + 1, GFP_KERNEL)) == NULL) {
5365                 kfree (data->rbuffer);
5366                 kfree (file->private_data);
5367                 return -ENOMEM;
5368         }
5369         data->on_close = proc_SSID_on_close;
5370 
5371         readSsidRid(ai, &SSID_rid);
5372         ptr = data->rbuffer;
5373         for (i = 0; i < 3; i++) {
5374                 int j;
5375                 size_t len = le16_to_cpu(SSID_rid.ssids[i].len);
5376                 if (!len)
5377                         break;
5378                 if (len > 32)
5379                         len = 32;
5380                 for (j = 0; j < len && SSID_rid.ssids[i].ssid[j]; j++)
5381                         *ptr++ = SSID_rid.ssids[i].ssid[j];
5382                 *ptr++ = '\n';
5383         }
5384         *ptr = '\0';
5385         data->readlen = strlen( data->rbuffer );
5386         return 0;
5387 }
5388 
5389 static int proc_APList_open( struct inode *inode, struct file *file ) {
5390         struct proc_data *data;
5391         struct net_device *dev = PDE_DATA(inode);
5392         struct airo_info *ai = dev->ml_priv;
5393         int i;
5394         char *ptr;
5395         APListRid APList_rid;
5396 
5397         if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
5398                 return -ENOMEM;
5399         data = file->private_data;
5400         if ((data->rbuffer = kmalloc( 104, GFP_KERNEL )) == NULL) {
5401                 kfree (file->private_data);
5402                 return -ENOMEM;
5403         }
5404         data->writelen = 0;
5405         data->maxwritelen = 4*6*3;
5406         if ((data->wbuffer = kzalloc( data->maxwritelen, GFP_KERNEL )) == NULL) {
5407                 kfree (data->rbuffer);
5408                 kfree (file->private_data);
5409                 return -ENOMEM;
5410         }
5411         data->on_close = proc_APList_on_close;
5412 
5413         readAPListRid(ai, &APList_rid);
5414         ptr = data->rbuffer;
5415         for( i = 0; i < 4; i++ ) {
5416 // We end when we find a zero MAC
5417                 if ( !*(int*)APList_rid.ap[i] &&
5418                      !*(int*)&APList_rid.ap[i][2]) break;
5419                 ptr += sprintf(ptr, "%pM\n", APList_rid.ap[i]);
5420         }
5421         if (i==0) ptr += sprintf(ptr, "Not using specific APs\n");
5422 
5423         *ptr = '\0';
5424         data->readlen = strlen( data->rbuffer );
5425         return 0;
5426 }
5427 
5428 static int proc_BSSList_open( struct inode *inode, struct file *file ) {
5429         struct proc_data *data;
5430         struct net_device *dev = PDE_DATA(inode);
5431         struct airo_info *ai = dev->ml_priv;
5432         char *ptr;
5433         BSSListRid BSSList_rid;
5434         int rc;
5435         /* If doLoseSync is not 1, we won't do a Lose Sync */
5436         int doLoseSync = -1;
5437 
5438         if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
5439                 return -ENOMEM;
5440         data = file->private_data;
5441         if ((data->rbuffer = kmalloc( 1024, GFP_KERNEL )) == NULL) {
5442                 kfree (file->private_data);
5443                 return -ENOMEM;
5444         }
5445         data->writelen = 0;
5446         data->maxwritelen = 0;
5447         data->wbuffer = NULL;
5448         data->on_close = NULL;
5449 
5450         if (file->f_mode & FMODE_WRITE) {
5451                 if (!(file->f_mode & FMODE_READ)) {
5452                         Cmd cmd;
5453                         Resp rsp;
5454 
5455                         if (ai->flags & FLAG_RADIO_MASK) return -ENETDOWN;
5456                         memset(&cmd, 0, sizeof(cmd));
5457                         cmd.cmd=CMD_LISTBSS;
5458                         if (down_interruptible(&ai->sem))
5459                                 return -ERESTARTSYS;
5460                         issuecommand(ai, &cmd, &rsp);
5461                         up(&ai->sem);
5462                         data->readlen = 0;
5463                         return 0;
5464                 }
5465                 doLoseSync = 1;
5466         }
5467         ptr = data->rbuffer;
5468         /* There is a race condition here if there are concurrent opens.
5469            Since it is a rare condition, we'll just live with it, otherwise
5470            we have to add a spin lock... */
5471         rc = readBSSListRid(ai, doLoseSync, &BSSList_rid);
5472         while(rc == 0 && BSSList_rid.index != cpu_to_le16(0xffff)) {
5473                 ptr += sprintf(ptr, "%pM %*s rssi = %d",
5474                                BSSList_rid.bssid,
5475                                 (int)BSSList_rid.ssidLen,
5476                                 BSSList_rid.ssid,
5477                                 le16_to_cpu(BSSList_rid.dBm));
5478                 ptr += sprintf(ptr, " channel = %d %s %s %s %s\n",
5479                                 le16_to_cpu(BSSList_rid.dsChannel),
5480                                 BSSList_rid.cap & CAP_ESS ? "ESS" : "",
5481                                 BSSList_rid.cap & CAP_IBSS ? "adhoc" : "",
5482                                 BSSList_rid.cap & CAP_PRIVACY ? "wep" : "",
5483                                 BSSList_rid.cap & CAP_SHORTHDR ? "shorthdr" : "");
5484                 rc = readBSSListRid(ai, 0, &BSSList_rid);
5485         }
5486         *ptr = '\0';
5487         data->readlen = strlen( data->rbuffer );
5488         return 0;
5489 }
5490 
5491 static int proc_close( struct inode *inode, struct file *file )
5492 {
5493         struct proc_data *data = file->private_data;
5494 
5495         if (data->on_close != NULL)
5496                 data->on_close(inode, file);
5497         kfree(data->rbuffer);
5498         kfree(data->wbuffer);
5499         kfree(data);
5500         return 0;
5501 }
5502 
5503 /* Since the card doesn't automatically switch to the right WEP mode,
5504    we will make it do it.  If the card isn't associated, every secs we
5505    will switch WEP modes to see if that will help.  If the card is
5506    associated we will check every minute to see if anything has
5507    changed. */
5508 static void timer_func( struct net_device *dev ) {
5509         struct airo_info *apriv = dev->ml_priv;
5510 
5511 /* We don't have a link so try changing the authtype */
5512         readConfigRid(apriv, 0);
5513         disable_MAC(apriv, 0);
5514         switch(apriv->config.authType) {
5515                 case AUTH_ENCRYPT:
5516 /* So drop to OPEN */
5517                         apriv->config.authType = AUTH_OPEN;
5518                         break;
5519                 case AUTH_SHAREDKEY:
5520                         if (apriv->keyindex < auto_wep) {
5521                                 set_wep_tx_idx(apriv, apriv->keyindex, 0, 0);
5522                                 apriv->config.authType = AUTH_SHAREDKEY;
5523                                 apriv->keyindex++;
5524                         } else {
5525                                 /* Drop to ENCRYPT */
5526                                 apriv->keyindex = 0;
5527                                 set_wep_tx_idx(apriv, apriv->defindex, 0, 0);
5528                                 apriv->config.authType = AUTH_ENCRYPT;
5529                         }
5530                         break;
5531                 default:  /* We'll escalate to SHAREDKEY */
5532                         apriv->config.authType = AUTH_SHAREDKEY;
5533         }
5534         set_bit (FLAG_COMMIT, &apriv->flags);
5535         writeConfigRid(apriv, 0);
5536         enable_MAC(apriv, 0);
5537         up(&apriv->sem);
5538 
5539 /* Schedule check to see if the change worked */
5540         clear_bit(JOB_AUTOWEP, &apriv->jobs);
5541         apriv->expires = RUN_AT(HZ*3);
5542 }
5543 
5544 #ifdef CONFIG_PCI
5545 static int airo_pci_probe(struct pci_dev *pdev,
5546                                     const struct pci_device_id *pent)
5547 {
5548         struct net_device *dev;
5549 
5550         if (pci_enable_device(pdev))
5551                 return -ENODEV;
5552         pci_set_master(pdev);
5553 
5554         if (pdev->device == 0x5000 || pdev->device == 0xa504)
5555                         dev = _init_airo_card(pdev->irq, pdev->resource[0].start, 0, pdev, &pdev->dev);
5556         else
5557                         dev = _init_airo_card(pdev->irq, pdev->resource[2].start, 0, pdev, &pdev->dev);
5558         if (!dev) {
5559                 pci_disable_device(pdev);
5560                 return -ENODEV;
5561         }
5562 
5563         pci_set_drvdata(pdev, dev);
5564         return 0;
5565 }
5566 
5567 static void airo_pci_remove(struct pci_dev *pdev)
5568 {
5569         struct net_device *dev = pci_get_drvdata(pdev);
5570 
5571         airo_print_info(dev->name, "Unregistering...");
5572         stop_airo_card(dev, 1);
5573         pci_disable_device(pdev);
5574 }
5575 
5576 static int airo_pci_suspend(struct pci_dev *pdev, pm_message_t state)
5577 {
5578         struct net_device *dev = pci_get_drvdata(pdev);
5579         struct airo_info *ai = dev->ml_priv;
5580         Cmd cmd;
5581         Resp rsp;
5582 
5583         if (!ai->APList)
5584                 ai->APList = kmalloc(sizeof(APListRid), GFP_KERNEL);
5585         if (!ai->APList)
5586                 return -ENOMEM;
5587         if (!ai->SSID)
5588                 ai->SSID = kmalloc(sizeof(SsidRid), GFP_KERNEL);
5589         if (!ai->SSID)
5590                 return -ENOMEM;
5591         readAPListRid(ai, ai->APList);
5592         readSsidRid(ai, ai->SSID);
5593         memset(&cmd, 0, sizeof(cmd));
5594         /* the lock will be released at the end of the resume callback */
5595         if (down_interruptible(&ai->sem))
5596                 return -EAGAIN;
5597         disable_MAC(ai, 0);
5598         netif_device_detach(dev);
5599         ai->power = state;
5600         cmd.cmd = HOSTSLEEP;
5601         issuecommand(ai, &cmd, &rsp);
5602 
5603         pci_enable_wake(pdev, pci_choose_state(pdev, state), 1);
5604         pci_save_state(pdev);
5605         pci_set_power_state(pdev, pci_choose_state(pdev, state));
5606         return 0;
5607 }
5608 
5609 static int airo_pci_resume(struct pci_dev *pdev)
5610 {
5611         struct net_device *dev = pci_get_drvdata(pdev);
5612         struct airo_info *ai = dev->ml_priv;
5613         pci_power_t prev_state = pdev->current_state;
5614 
5615         pci_set_power_state(pdev, PCI_D0);
5616         pci_restore_state(pdev);
5617         pci_enable_wake(pdev, PCI_D0, 0);
5618 
5619         if (prev_state != PCI_D1) {
5620                 reset_card(dev, 0);
5621                 mpi_init_descriptors(ai);
5622                 setup_card(ai, dev->dev_addr, 0);
5623                 clear_bit(FLAG_RADIO_OFF, &ai->flags);
5624                 clear_bit(FLAG_PENDING_XMIT, &ai->flags);
5625         } else {
5626                 OUT4500(ai, EVACK, EV_AWAKEN);
5627                 OUT4500(ai, EVACK, EV_AWAKEN);
5628                 msleep(100);
5629         }
5630 
5631         set_bit(FLAG_COMMIT, &ai->flags);
5632         disable_MAC(ai, 0);
5633         msleep(200);
5634         if (ai->SSID) {
5635                 writeSsidRid(ai, ai->SSID, 0);
5636                 kfree(ai->SSID);
5637                 ai->SSID = NULL;
5638         }
5639         if (ai->APList) {
5640                 writeAPListRid(ai, ai->APList, 0);
5641                 kfree(ai->APList);
5642                 ai->APList = NULL;
5643         }
5644         writeConfigRid(ai, 0);
5645         enable_MAC(ai, 0);
5646         ai->power = PMSG_ON;
5647         netif_device_attach(dev);
5648         netif_wake_queue(dev);
5649         enable_interrupts(ai);
5650         up(&ai->sem);
5651         return 0;
5652 }
5653 #endif
5654 
5655 static int __init airo_init_module( void )
5656 {
5657         int i;
5658 
5659         proc_kuid = make_kuid(&init_user_ns, proc_uid);
5660         proc_kgid = make_kgid(&init_user_ns, proc_gid);
5661         if (!uid_valid(proc_kuid) || !gid_valid(proc_kgid))
5662                 return -EINVAL;
5663 
5664         airo_entry = proc_mkdir_mode("driver/aironet", airo_perm, NULL);
5665 
5666         if (airo_entry)
5667                 proc_set_user(airo_entry, proc_kuid, proc_kgid);
5668 
5669         for (i = 0; i < 4 && io[i] && irq[i]; i++) {
5670                 airo_print_info("", "Trying to configure ISA adapter at irq=%d "
5671                         "io=0x%x", irq[i], io[i] );
5672                 if (init_airo_card( irq[i], io[i], 0, NULL ))
5673                         /* do nothing */ ;
5674         }
5675 
5676 #ifdef CONFIG_PCI
5677         airo_print_info("", "Probing for PCI adapters");
5678         i = pci_register_driver(&airo_driver);
5679         airo_print_info("", "Finished probing for PCI adapters");
5680 
5681         if (i) {
5682                 remove_proc_entry("driver/aironet", NULL);
5683                 return i;
5684         }
5685 #endif
5686 
5687         /* Always exit with success, as we are a library module
5688          * as well as a driver module
5689          */
5690         return 0;
5691 }
5692 
5693 static void __exit airo_cleanup_module( void )
5694 {
5695         struct airo_info *ai;
5696         while(!list_empty(&airo_devices)) {
5697                 ai = list_entry(airo_devices.next, struct airo_info, dev_list);
5698                 airo_print_info(ai->dev->name, "Unregistering...");
5699                 stop_airo_card(ai->dev, 1);
5700         }
5701 #ifdef CONFIG_PCI
5702         pci_unregister_driver(&airo_driver);
5703 #endif
5704         remove_proc_entry("driver/aironet", NULL);
5705 }
5706 
5707 /*
5708  * Initial Wireless Extension code for Aironet driver by :
5709  *      Jean Tourrilhes <jt@hpl.hp.com> - HPL - 17 November 00
5710  * Conversion to new driver API by :
5711  *      Jean Tourrilhes <jt@hpl.hp.com> - HPL - 26 March 02
5712  * Javier also did a good amount of work here, adding some new extensions
5713  * and fixing my code. Let's just say that without him this code just
5714  * would not work at all... - Jean II
5715  */
5716 
5717 static u8 airo_rssi_to_dbm (tdsRssiEntry *rssi_rid, u8 rssi)
5718 {
5719         if (!rssi_rid)
5720                 return 0;
5721 
5722         return (0x100 - rssi_rid[rssi].rssidBm);
5723 }
5724 
5725 static u8 airo_dbm_to_pct (tdsRssiEntry *rssi_rid, u8 dbm)
5726 {
5727         int i;
5728 
5729         if (!rssi_rid)
5730                 return 0;
5731 
5732         for (i = 0; i < 256; i++)
5733                 if (rssi_rid[i].rssidBm == dbm)
5734                         return rssi_rid[i].rssipct;
5735 
5736         return 0;
5737 }
5738 
5739 
5740 static int airo_get_quality (StatusRid *status_rid, CapabilityRid *cap_rid)
5741 {
5742         int quality = 0;
5743         u16 sq;
5744 
5745         if ((status_rid->mode & cpu_to_le16(0x3f)) != cpu_to_le16(0x3f))
5746                 return 0;
5747 
5748         if (!(cap_rid->hardCap & cpu_to_le16(8)))
5749                 return 0;
5750 
5751         sq = le16_to_cpu(status_rid->signalQuality);
5752         if (memcmp(cap_rid->prodName, "350", 3))
5753                 if (sq > 0x20)
5754                         quality = 0;
5755                 else
5756                         quality = 0x20 - sq;
5757         else
5758                 if (sq > 0xb0)
5759                         quality = 0;
5760                 else if (sq < 0x10)
5761                         quality = 0xa0;
5762                 else
5763                         quality = 0xb0 - sq;
5764         return quality;
5765 }
5766 
5767 #define airo_get_max_quality(cap_rid) (memcmp((cap_rid)->prodName, "350", 3) ? 0x20 : 0xa0)
5768 #define airo_get_avg_quality(cap_rid) (memcmp((cap_rid)->prodName, "350", 3) ? 0x10 : 0x50);
5769 
5770 /*------------------------------------------------------------------*/
5771 /*
5772  * Wireless Handler : get protocol name
5773  */
5774 static int airo_get_name(struct net_device *dev,
5775                          struct iw_request_info *info,
5776                          char *cwrq,
5777                          char *extra)
5778 {
5779         strcpy(cwrq, "IEEE 802.11-DS");
5780         return 0;
5781 }
5782 
5783 /*------------------------------------------------------------------*/
5784 /*
5785  * Wireless Handler : set frequency
5786  */
5787 static int airo_set_freq(struct net_device *dev,
5788                          struct iw_request_info *info,
5789                          struct iw_freq *fwrq,
5790                          char *extra)
5791 {
5792         struct airo_info *local = dev->ml_priv;
5793         int rc = -EINPROGRESS;          /* Call commit handler */
5794 
5795         /* If setting by frequency, convert to a channel */
5796         if(fwrq->e == 1) {
5797                 int f = fwrq->m / 100000;
5798 
5799                 /* Hack to fall through... */
5800                 fwrq->e = 0;
5801                 fwrq->m = ieee80211_frequency_to_channel(f);
5802         }
5803         /* Setting by channel number */
5804         if((fwrq->m > 1000) || (fwrq->e > 0))
5805                 rc = -EOPNOTSUPP;
5806         else {
5807                 int channel = fwrq->m;
5808                 /* We should do a better check than that,
5809                  * based on the card capability !!! */
5810                 if((channel < 1) || (channel > 14)) {
5811                         airo_print_dbg(dev->name, "New channel value of %d is invalid!",
5812                                 fwrq->m);
5813                         rc = -EINVAL;
5814                 } else {
5815                         readConfigRid(local, 1);
5816                         /* Yes ! We can set it !!! */
5817                         local->config.channelSet = cpu_to_le16(channel);
5818                         set_bit (FLAG_COMMIT, &local->flags);
5819                 }
5820         }
5821         return rc;
5822 }
5823 
5824 /*------------------------------------------------------------------*/
5825 /*
5826  * Wireless Handler : get frequency
5827  */
5828 static int airo_get_freq(struct net_device *dev,
5829                          struct iw_request_info *info,
5830                          struct iw_freq *fwrq,
5831                          char *extra)
5832 {
5833         struct airo_info *local = dev->ml_priv;
5834         StatusRid status_rid;           /* Card status info */
5835         int ch;
5836 
5837         readConfigRid(local, 1);
5838         if ((local->config.opmode & MODE_CFG_MASK) == MODE_STA_ESS)
5839                 status_rid.channel = local->config.channelSet;
5840         else
5841                 readStatusRid(local, &status_rid, 1);
5842 
5843         ch = le16_to_cpu(status_rid.channel);
5844         if((ch > 0) && (ch < 15)) {
5845                 fwrq->m = 100000 *
5846                         ieee80211_channel_to_frequency(ch, IEEE80211_BAND_2GHZ);
5847                 fwrq->e = 1;
5848         } else {
5849                 fwrq->m = ch;
5850                 fwrq->e = 0;
5851         }
5852 
5853         return 0;
5854 }
5855 
5856 /*------------------------------------------------------------------*/
5857 /*
5858  * Wireless Handler : set ESSID
5859  */
5860 static int airo_set_essid(struct net_device *dev,
5861                           struct iw_request_info *info,
5862                           struct iw_point *dwrq,
5863                           char *extra)
5864 {
5865         struct airo_info *local = dev->ml_priv;
5866         SsidRid SSID_rid;               /* SSIDs */
5867 
5868         /* Reload the list of current SSID */
5869         readSsidRid(local, &SSID_rid);
5870 
5871         /* Check if we asked for `any' */
5872         if (dwrq->flags == 0) {
5873                 /* Just send an empty SSID list */
5874                 memset(&SSID_rid, 0, sizeof(SSID_rid));
5875         } else {
5876                 unsigned index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
5877 
5878                 /* Check the size of the string */
5879                 if (dwrq->length > IW_ESSID_MAX_SIZE)
5880                         return -E2BIG ;
5881 
5882                 /* Check if index is valid */
5883                 if (index >= ARRAY_SIZE(SSID_rid.ssids))
5884                         return -EINVAL;
5885 
5886                 /* Set the SSID */
5887                 memset(SSID_rid.ssids[index].ssid, 0,
5888                        sizeof(SSID_rid.ssids[index].ssid));
5889                 memcpy(SSID_rid.ssids[index].ssid, extra, dwrq->length);
5890                 SSID_rid.ssids[index].len = cpu_to_le16(dwrq->length);
5891         }
5892         SSID_rid.len = cpu_to_le16(sizeof(SSID_rid));
5893         /* Write it to the card */
5894         disable_MAC(local, 1);
5895         writeSsidRid(local, &SSID_rid, 1);
5896         enable_MAC(local, 1);
5897 
5898         return 0;
5899 }
5900 
5901 /*------------------------------------------------------------------*/
5902 /*
5903  * Wireless Handler : get ESSID
5904  */
5905 static int airo_get_essid(struct net_device *dev,
5906                           struct iw_request_info *info,
5907                           struct iw_point *dwrq,
5908                           char *extra)
5909 {
5910         struct airo_info *local = dev->ml_priv;
5911         StatusRid status_rid;           /* Card status info */
5912 
5913         readStatusRid(local, &status_rid, 1);
5914 
5915         /* Note : if dwrq->flags != 0, we should
5916          * get the relevant SSID from the SSID list... */
5917 
5918         /* Get the current SSID */
5919         memcpy(extra, status_rid.SSID, le16_to_cpu(status_rid.SSIDlen));
5920         /* If none, we may want to get the one that was set */
5921 
5922         /* Push it out ! */
5923         dwrq->length = le16_to_cpu(status_rid.SSIDlen);
5924         dwrq->flags = 1; /* active */
5925 
5926         return 0;
5927 }
5928 
5929 /*------------------------------------------------------------------*/
5930 /*
5931  * Wireless Handler : set AP address
5932  */
5933 static int airo_set_wap(struct net_device *dev,
5934                         struct iw_request_info *info,
5935                         struct sockaddr *awrq,
5936                         char *extra)
5937 {
5938         struct airo_info *local = dev->ml_priv;
5939         Cmd cmd;
5940         Resp rsp;
5941         APListRid APList_rid;
5942 
5943         if (awrq->sa_family != ARPHRD_ETHER)
5944                 return -EINVAL;
5945         else if (is_broadcast_ether_addr(awrq->sa_data) ||
5946                  is_zero_ether_addr(awrq->sa_data)) {
5947                 memset(&cmd, 0, sizeof(cmd));
5948                 cmd.cmd=CMD_LOSE_SYNC;
5949                 if (down_interruptible(&local->sem))
5950                         return -ERESTARTSYS;
5951                 issuecommand(local, &cmd, &rsp);
5952                 up(&local->sem);
5953         } else {
5954                 memset(&APList_rid, 0, sizeof(APList_rid));
5955                 APList_rid.len = cpu_to_le16(sizeof(APList_rid));
5956                 memcpy(APList_rid.ap[0], awrq->sa_data, ETH_ALEN);
5957                 disable_MAC(local, 1);
5958                 writeAPListRid(local, &APList_rid, 1);
5959                 enable_MAC(local, 1);
5960         }
5961         return 0;
5962 }
5963 
5964 /*------------------------------------------------------------------*/
5965 /*
5966  * Wireless Handler : get AP address
5967  */
5968 static int airo_get_wap(struct net_device *dev,
5969                         struct iw_request_info *info,
5970                         struct sockaddr *awrq,
5971                         char *extra)
5972 {
5973         struct airo_info *local = dev->ml_priv;
5974         StatusRid status_rid;           /* Card status info */
5975 
5976         readStatusRid(local, &status_rid, 1);
5977 
5978         /* Tentative. This seems to work, wow, I'm lucky !!! */
5979         memcpy(awrq->sa_data, status_rid.bssid[0], ETH_ALEN);
5980         awrq->sa_family = ARPHRD_ETHER;
5981 
5982         return 0;
5983 }
5984 
5985 /*------------------------------------------------------------------*/
5986 /*
5987  * Wireless Handler : set Nickname
5988  */
5989 static int airo_set_nick(struct net_device *dev,
5990                          struct iw_request_info *info,
5991                          struct iw_point *dwrq,
5992                          char *extra)
5993 {
5994         struct airo_info *local = dev->ml_priv;
5995 
5996         /* Check the size of the string */
5997         if(dwrq->length > 16) {
5998                 return -E2BIG;
5999         }
6000         readConfigRid(local, 1);
6001         memset(local->config.nodeName, 0, sizeof(local->config.nodeName));
6002         memcpy(local->config.nodeName, extra, dwrq->length);
6003         set_bit (FLAG_COMMIT, &local->flags);
6004 
6005         return -EINPROGRESS;            /* Call commit handler */
6006 }
6007 
6008 /*------------------------------------------------------------------*/
6009 /*
6010  * Wireless Handler : get Nickname
6011  */
6012 static int airo_get_nick(struct net_device *dev,
6013                          struct iw_request_info *info,
6014                          struct iw_point *dwrq,
6015                          char *extra)
6016 {
6017         struct airo_info *local = dev->ml_priv;
6018 
6019         readConfigRid(local, 1);
6020         strncpy(extra, local->config.nodeName, 16);
6021         extra[16] = '\0';
6022         dwrq->length = strlen(extra);
6023 
6024         return 0;
6025 }
6026 
6027 /*------------------------------------------------------------------*/
6028 /*
6029  * Wireless Handler : set Bit-Rate
6030  */
6031 static int airo_set_rate(struct net_device *dev,
6032                          struct iw_request_info *info,
6033                          struct iw_param *vwrq,
6034                          char *extra)
6035 {
6036         struct airo_info *local = dev->ml_priv;
6037         CapabilityRid cap_rid;          /* Card capability info */
6038         u8      brate = 0;
6039         int     i;
6040 
6041         /* First : get a valid bit rate value */
6042         readCapabilityRid(local, &cap_rid, 1);
6043 
6044         /* Which type of value ? */
6045         if((vwrq->value < 8) && (vwrq->value >= 0)) {
6046                 /* Setting by rate index */
6047                 /* Find value in the magic rate table */
6048                 brate = cap_rid.supportedRates[vwrq->value];
6049         } else {
6050                 /* Setting by frequency value */
6051                 u8      normvalue = (u8) (vwrq->value/500000);
6052 
6053                 /* Check if rate is valid */
6054                 for(i = 0 ; i < 8 ; i++) {
6055                         if(normvalue == cap_rid.supportedRates[i]) {
6056                                 brate = normvalue;
6057                                 break;
6058                         }
6059                 }
6060         }
6061         /* -1 designed the max rate (mostly auto mode) */
6062         if(vwrq->value == -1) {
6063                 /* Get the highest available rate */
6064                 for(i = 0 ; i < 8 ; i++) {
6065                         if(cap_rid.supportedRates[i] == 0)
6066                                 break;
6067                 }
6068                 if(i != 0)
6069                         brate = cap_rid.supportedRates[i - 1];
6070         }
6071         /* Check that it is valid */
6072         if(brate == 0) {
6073                 return -EINVAL;
6074         }
6075 
6076         readConfigRid(local, 1);
6077         /* Now, check if we want a fixed or auto value */
6078         if(vwrq->fixed == 0) {
6079                 /* Fill all the rates up to this max rate */
6080                 memset(local->config.rates, 0, 8);
6081                 for(i = 0 ; i < 8 ; i++) {
6082                         local->config.rates[i] = cap_rid.supportedRates[i];
6083                         if(local->config.rates[i] == brate)
6084                                 break;
6085                 }
6086         } else {
6087                 /* Fixed mode */
6088                 /* One rate, fixed */
6089                 memset(local->config.rates, 0, 8);
6090                 local->config.rates[0] = brate;
6091         }
6092         set_bit (FLAG_COMMIT, &local->flags);
6093 
6094         return -EINPROGRESS;            /* Call commit handler */
6095 }
6096 
6097 /*------------------------------------------------------------------*/
6098 /*
6099  * Wireless Handler : get Bit-Rate
6100  */
6101 static int airo_get_rate(struct net_device *dev,
6102                          struct iw_request_info *info,
6103                          struct iw_param *vwrq,
6104                          char *extra)
6105 {
6106         struct airo_info *local = dev->ml_priv;
6107         StatusRid status_rid;           /* Card status info */
6108 
6109         readStatusRid(local, &status_rid, 1);
6110 
6111         vwrq->value = le16_to_cpu(status_rid.currentXmitRate) * 500000;
6112         /* If more than one rate, set auto */
6113         readConfigRid(local, 1);
6114         vwrq->fixed = (local->config.rates[1] == 0);
6115 
6116         return 0;
6117 }
6118 
6119 /*------------------------------------------------------------------*/
6120 /*
6121  * Wireless Handler : set RTS threshold
6122  */
6123 static int airo_set_rts(struct net_device *dev,
6124                         struct iw_request_info *info,
6125                         struct iw_param *vwrq,
6126                         char *extra)
6127 {
6128         struct airo_info *local = dev->ml_priv;
6129         int rthr = vwrq->value;
6130 
6131         if(vwrq->disabled)
6132                 rthr = AIRO_DEF_MTU;
6133         if((rthr < 0) || (rthr > AIRO_DEF_MTU)) {
6134                 return -EINVAL;
6135         }
6136         readConfigRid(local, 1);
6137         local->config.rtsThres = cpu_to_le16(rthr);
6138         set_bit (FLAG_COMMIT, &local->flags);
6139 
6140         return -EINPROGRESS;            /* Call commit handler */
6141 }
6142 
6143 /*------------------------------------------------------------------*/
6144 /*
6145  * Wireless Handler : get RTS threshold
6146  */
6147 static int airo_get_rts(struct net_device *dev,
6148                         struct iw_request_info *info,
6149                         struct iw_param *vwrq,
6150                         char *extra)
6151 {
6152         struct airo_info *local = dev->ml_priv;
6153 
6154         readConfigRid(local, 1);
6155         vwrq->value = le16_to_cpu(local->config.rtsThres);
6156         vwrq->disabled = (vwrq->value >= AIRO_DEF_MTU);
6157         vwrq->fixed = 1;
6158 
6159         return 0;
6160 }
6161 
6162 /*------------------------------------------------------------------*/
6163 /*
6164  * Wireless Handler : set Fragmentation threshold
6165  */
6166 static int airo_set_frag(struct net_device *dev,
6167                          struct iw_request_info *info,
6168                          struct iw_param *vwrq,
6169                          char *extra)
6170 {
6171         struct airo_info *local = dev->ml_priv;
6172         int fthr = vwrq->value;
6173 
6174         if(vwrq->disabled)
6175                 fthr = AIRO_DEF_MTU;
6176         if((fthr < 256) || (fthr > AIRO_DEF_MTU)) {
6177                 return -EINVAL;
6178         }
6179         fthr &= ~0x1;   /* Get an even value - is it really needed ??? */
6180         readConfigRid(local, 1);
6181         local->config.fragThresh = cpu_to_le16(fthr);
6182         set_bit (FLAG_COMMIT, &local->flags);
6183 
6184         return -EINPROGRESS;            /* Call commit handler */
6185 }
6186 
6187 /*------------------------------------------------------------------*/
6188 /*
6189  * Wireless Handler : get Fragmentation threshold
6190  */
6191 static int airo_get_frag(struct net_device *dev,
6192                          struct iw_request_info *info,
6193                          struct iw_param *vwrq,
6194                          char *extra)
6195 {
6196         struct airo_info *local = dev->ml_priv;
6197 
6198         readConfigRid(local, 1);
6199         vwrq->value = le16_to_cpu(local->config.fragThresh);
6200         vwrq->disabled = (vwrq->value >= AIRO_DEF_MTU);
6201         vwrq->fixed = 1;
6202 
6203         return 0;
6204 }
6205 
6206 /*------------------------------------------------------------------*/
6207 /*
6208  * Wireless Handler : set Mode of Operation
6209  */
6210 static int airo_set_mode(struct net_device *dev,
6211                          struct iw_request_info *info,
6212                          __u32 *uwrq,
6213                          char *extra)
6214 {
6215         struct airo_info *local = dev->ml_priv;
6216         int reset = 0;
6217 
6218         readConfigRid(local, 1);
6219         if (sniffing_mode(local))
6220                 reset = 1;
6221 
6222         switch(*uwrq) {
6223                 case IW_MODE_ADHOC:
6224                         local->config.opmode &= ~MODE_CFG_MASK;
6225                         local->config.opmode |= MODE_STA_IBSS;
6226                         local->config.rmode &= ~RXMODE_FULL_MASK;
6227                         local->config.scanMode = SCANMODE_ACTIVE;
6228                         clear_bit (FLAG_802_11, &local->flags);
6229                         break;
6230                 case IW_MODE_INFRA:
6231                         local->config.opmode &= ~MODE_CFG_MASK;
6232                         local->config.opmode |= MODE_STA_ESS;
6233                         local->config.rmode &= ~RXMODE_FULL_MASK;
6234                         local->config.scanMode = SCANMODE_ACTIVE;
6235                         clear_bit (FLAG_802_11, &local->flags);
6236                         break;
6237                 case IW_MODE_MASTER:
6238                         local->config.opmode &= ~MODE_CFG_MASK;
6239                         local->config.opmode |= MODE_AP;
6240                         local->config.rmode &= ~RXMODE_FULL_MASK;
6241                         local->config.scanMode = SCANMODE_ACTIVE;
6242                         clear_bit (FLAG_802_11, &local->flags);
6243                         break;
6244                 case IW_MODE_REPEAT:
6245                         local->config.opmode &= ~MODE_CFG_MASK;
6246                         local->config.opmode |= MODE_AP_RPTR;
6247                         local->config.rmode &= ~RXMODE_FULL_MASK;
6248                         local->config.scanMode = SCANMODE_ACTIVE;
6249                         clear_bit (FLAG_802_11, &local->flags);
6250                         break;
6251                 case IW_MODE_MONITOR:
6252                         local->config.opmode &= ~MODE_CFG_MASK;
6253                         local->config.opmode |= MODE_STA_ESS;
6254                         local->config.rmode &= ~RXMODE_FULL_MASK;
6255                         local->config.rmode |= RXMODE_RFMON | RXMODE_DISABLE_802_3_HEADER;
6256                         local->config.scanMode = SCANMODE_PASSIVE;
6257                         set_bit (FLAG_802_11, &local->flags);
6258                         break;
6259                 default:
6260                         return -EINVAL;
6261         }
6262         if (reset)
6263                 set_bit (FLAG_RESET, &local->flags);
6264         set_bit (FLAG_COMMIT, &local->flags);
6265 
6266         return -EINPROGRESS;            /* Call commit handler */
6267 }
6268 
6269 /*------------------------------------------------------------------*/
6270 /*
6271  * Wireless Handler : get Mode of Operation
6272  */
6273 static int airo_get_mode(struct net_device *dev,
6274                          struct iw_request_info *info,
6275                          __u32 *uwrq,
6276                          char *extra)
6277 {
6278         struct airo_info *local = dev->ml_priv;
6279 
6280         readConfigRid(local, 1);
6281         /* If not managed, assume it's ad-hoc */
6282         switch (local->config.opmode & MODE_CFG_MASK) {
6283                 case MODE_STA_ESS:
6284                         *uwrq = IW_MODE_INFRA;
6285                         break;
6286                 case MODE_AP:
6287                         *uwrq = IW_MODE_MASTER;
6288                         break;
6289                 case MODE_AP_RPTR:
6290                         *uwrq = IW_MODE_REPEAT;
6291                         break;
6292                 default:
6293                         *uwrq = IW_MODE_ADHOC;
6294         }
6295 
6296         return 0;
6297 }
6298 
6299 static inline int valid_index(struct airo_info *ai, int index)
6300 {
6301         return (index >= 0) && (index <= ai->max_wep_idx);
6302 }
6303 
6304 /*------------------------------------------------------------------*/
6305 /*
6306  * Wireless Handler : set Encryption Key
6307  */
6308 static int airo_set_encode(struct net_device *dev,
6309                            struct iw_request_info *info,
6310                            struct iw_point *dwrq,
6311                            char *extra)
6312 {
6313         struct airo_info *local = dev->ml_priv;
6314         int perm = (dwrq->flags & IW_ENCODE_TEMP ? 0 : 1);
6315         __le16 currentAuthType = local->config.authType;
6316         int rc = 0;
6317 
6318         if (!local->wep_capable)
6319                 return -EOPNOTSUPP;
6320 
6321         readConfigRid(local, 1);
6322 
6323         /* Basic checking: do we have a key to set ?
6324          * Note : with the new API, it's impossible to get a NULL pointer.
6325          * Therefore, we need to check a key size == 0 instead.
6326          * New version of iwconfig properly set the IW_ENCODE_NOKEY flag
6327          * when no key is present (only change flags), but older versions
6328          * don't do it. - Jean II */
6329         if (dwrq->length > 0) {
6330                 wep_key_t key;
6331                 int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
6332                 int current_index;
6333 
6334                 /* Check the size of the key */
6335                 if (dwrq->length > MAX_KEY_SIZE) {
6336                         return -EINVAL;
6337                 }
6338 
6339                 current_index = get_wep_tx_idx(local);
6340                 if (current_index < 0)
6341                         current_index = 0;
6342 
6343                 /* Check the index (none -> use current) */
6344                 if (!valid_index(local, index))
6345                         index = current_index;
6346 
6347                 /* Set the length */
6348                 if (dwrq->length > MIN_KEY_SIZE)
6349                         key.len = MAX_KEY_SIZE;
6350                 else
6351                         key.len = MIN_KEY_SIZE;
6352                 /* Check if the key is not marked as invalid */
6353                 if(!(dwrq->flags & IW_ENCODE_NOKEY)) {
6354                         /* Cleanup */
6355                         memset(key.key, 0, MAX_KEY_SIZE);
6356                         /* Copy the key in the driver */
6357                         memcpy(key.key, extra, dwrq->length);
6358                         /* Send the key to the card */
6359                         rc = set_wep_key(local, index, key.key, key.len, perm, 1);
6360                         if (rc < 0) {
6361                                 airo_print_err(local->dev->name, "failed to set"
6362                                                " WEP key at index %d: %d.",
6363                                                index, rc);
6364                                 return rc;
6365                         }
6366                 }
6367                 /* WE specify that if a valid key is set, encryption
6368                  * should be enabled (user may turn it off later)
6369                  * This is also how "iwconfig ethX key on" works */
6370                 if((index == current_index) && (key.len > 0) &&
6371                    (local->config.authType == AUTH_OPEN)) {
6372                         local->config.authType = AUTH_ENCRYPT;
6373                 }
6374         } else {
6375                 /* Do we want to just set the transmit key index ? */
6376                 int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
6377                 if (valid_index(local, index)) {
6378                         rc = set_wep_tx_idx(local, index, perm, 1);
6379                         if (rc < 0) {
6380                                 airo_print_err(local->dev->name, "failed to set"
6381                                                " WEP transmit index to %d: %d.",
6382                                                index, rc);
6383                                 return rc;
6384                         }
6385                 } else {
6386                         /* Don't complain if only change the mode */
6387                         if (!(dwrq->flags & IW_ENCODE_MODE))
6388                                 return -EINVAL;
6389                 }
6390         }
6391         /* Read the flags */
6392         if(dwrq->flags & IW_ENCODE_DISABLED)
6393                 local->config.authType = AUTH_OPEN;     // disable encryption
6394         if(dwrq->flags & IW_ENCODE_RESTRICTED)
6395                 local->config.authType = AUTH_SHAREDKEY;        // Only Both
6396         if(dwrq->flags & IW_ENCODE_OPEN)
6397                 local->config.authType = AUTH_ENCRYPT;  // Only Wep
6398         /* Commit the changes to flags if needed */
6399         if (local->config.authType != currentAuthType)
6400                 set_bit (FLAG_COMMIT, &local->flags);
6401         return -EINPROGRESS;            /* Call commit handler */
6402 }
6403 
6404 /*------------------------------------------------------------------*/
6405 /*
6406  * Wireless Handler : get Encryption Key
6407  */
6408 static int airo_get_encode(struct net_device *dev,
6409                            struct iw_request_info *info,
6410                            struct iw_point *dwrq,
6411                            char *extra)
6412 {
6413         struct airo_info *local = dev->ml_priv;
6414         int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
6415         int wep_key_len;
6416         u8 buf[16];
6417 
6418         if (!local->wep_capable)
6419                 return -EOPNOTSUPP;
6420 
6421         readConfigRid(local, 1);
6422 
6423         /* Check encryption mode */
6424         switch(local->config.authType)  {
6425                 case AUTH_ENCRYPT:
6426                         dwrq->flags = IW_ENCODE_OPEN;
6427                         break;
6428                 case AUTH_SHAREDKEY:
6429                         dwrq->flags = IW_ENCODE_RESTRICTED;
6430                         break;
6431                 default:
6432                 case AUTH_OPEN:
6433                         dwrq->flags = IW_ENCODE_DISABLED;
6434                         break;
6435         }
6436         /* We can't return the key, so set the proper flag and return zero */
6437         dwrq->flags |= IW_ENCODE_NOKEY;
6438         memset(extra, 0, 16);
6439 
6440         /* Which key do we want ? -1 -> tx index */
6441         if (!valid_index(local, index)) {
6442                 index = get_wep_tx_idx(local);
6443                 if (index < 0)
6444                         index = 0;
6445         }
6446         dwrq->flags |= index + 1;
6447 
6448         /* Copy the key to the user buffer */
6449         wep_key_len = get_wep_key(local, index, &buf[0], sizeof(buf));
6450         if (wep_key_len < 0) {
6451                 dwrq->length = 0;
6452         } else {
6453                 dwrq->length = wep_key_len;
6454                 memcpy(extra, buf, dwrq->length);
6455         }
6456 
6457         return 0;
6458 }
6459 
6460 /*------------------------------------------------------------------*/
6461 /*
6462  * Wireless Handler : set extended Encryption parameters
6463  */
6464 static int airo_set_encodeext(struct net_device *dev,
6465                            struct iw_request_info *info,
6466                             union iwreq_data *wrqu,
6467                             char *extra)
6468 {
6469         struct airo_info *local = dev->ml_priv;
6470         struct iw_point *encoding = &wrqu->encoding;
6471         struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
6472         int perm = ( encoding->flags & IW_ENCODE_TEMP ? 0 : 1 );
6473         __le16 currentAuthType = local->config.authType;
6474         int idx, key_len, alg = ext->alg, set_key = 1, rc;
6475         wep_key_t key;
6476 
6477         if (!local->wep_capable)
6478                 return -EOPNOTSUPP;
6479 
6480         readConfigRid(local, 1);
6481 
6482         /* Determine and validate the key index */
6483         idx = encoding->flags & IW_ENCODE_INDEX;
6484         if (idx) {
6485                 if (!valid_index(local, idx - 1))
6486                         return -EINVAL;
6487                 idx--;
6488         } else {
6489                 idx = get_wep_tx_idx(local);
6490                 if (idx < 0)
6491                         idx = 0;
6492         }
6493 
6494         if (encoding->flags & IW_ENCODE_DISABLED)
6495                 alg = IW_ENCODE_ALG_NONE;
6496 
6497         if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY) {
6498                 /* Only set transmit key index here, actual
6499                  * key is set below if needed.
6500                  */
6501                 rc = set_wep_tx_idx(local, idx, perm, 1);
6502                 if (rc < 0) {
6503                         airo_print_err(local->dev->name, "failed to set "
6504                                        "WEP transmit index to %d: %d.",
6505                                        idx, rc);
6506                         return rc;
6507                 }
6508                 set_key = ext->key_len > 0 ? 1 : 0;
6509         }
6510 
6511         if (set_key) {
6512                 /* Set the requested key first */
6513                 memset(key.key, 0, MAX_KEY_SIZE);
6514                 switch (alg) {
6515                 case IW_ENCODE_ALG_NONE:
6516                         key.len = 0;
6517                         break;
6518                 case IW_ENCODE_ALG_WEP:
6519                         if (ext->key_len > MIN_KEY_SIZE) {
6520                                 key.len = MAX_KEY_SIZE;
6521                         } else if (ext->key_len > 0) {
6522                                 key.len = MIN_KEY_SIZE;
6523                         } else {
6524                                 return -EINVAL;
6525                         }
6526                         key_len = min (ext->key_len, key.len);
6527                         memcpy(key.key, ext->key, key_len);
6528                         break;
6529                 default:
6530                         return -EINVAL;
6531                 }
6532                 if (key.len == 0) {
6533                         rc = set_wep_tx_idx(local, idx, perm, 1);
6534                         if (rc < 0) {
6535                                 airo_print_err(local->dev->name,
6536                                                "failed to set WEP transmit index to %d: %d.",
6537                                                idx, rc);
6538                                 return rc;
6539                         }
6540                 } else {
6541                         rc = set_wep_key(local, idx, key.key, key.len, perm, 1);
6542                         if (rc < 0) {
6543                                 airo_print_err(local->dev->name,
6544                                                "failed to set WEP key at index %d: %d.",
6545                                                idx, rc);
6546                                 return rc;
6547                         }
6548                 }
6549         }
6550 
6551         /* Read the flags */
6552         if(encoding->flags & IW_ENCODE_DISABLED)
6553                 local->config.authType = AUTH_OPEN;     // disable encryption
6554         if(encoding->flags & IW_ENCODE_RESTRICTED)
6555                 local->config.authType = AUTH_SHAREDKEY;        // Only Both
6556         if(encoding->flags & IW_ENCODE_OPEN)
6557                 local->config.authType = AUTH_ENCRYPT;  // Only Wep
6558         /* Commit the changes to flags if needed */
6559         if (local->config.authType != currentAuthType)
6560                 set_bit (FLAG_COMMIT, &local->flags);
6561 
6562         return -EINPROGRESS;
6563 }
6564 
6565 
6566 /*------------------------------------------------------------------*/
6567 /*
6568  * Wireless Handler : get extended Encryption parameters
6569  */
6570 static int airo_get_encodeext(struct net_device *dev,
6571                             struct iw_request_info *info,
6572                             union iwreq_data *wrqu,
6573                             char *extra)
6574 {
6575         struct airo_info *local = dev->ml_priv;
6576         struct iw_point *encoding = &wrqu->encoding;
6577         struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
6578         int idx, max_key_len, wep_key_len;
6579         u8 buf[16];
6580 
6581         if (!local->wep_capable)
6582                 return -EOPNOTSUPP;
6583 
6584         readConfigRid(local, 1);
6585 
6586         max_key_len = encoding->length - sizeof(*ext);
6587         if (max_key_len < 0)
6588                 return -EINVAL;
6589 
6590         idx = encoding->flags & IW_ENCODE_INDEX;
6591         if (idx) {
6592                 if (!valid_index(local, idx - 1))
6593                         return -EINVAL;
6594                 idx--;
6595         } else {
6596                 idx = get_wep_tx_idx(local);
6597                 if (idx < 0)
6598                         idx = 0;
6599         }
6600 
6601         encoding->flags = idx + 1;
6602         memset(ext, 0, sizeof(*ext));
6603 
6604         /* Check encryption mode */
6605         switch(local->config.authType) {
6606                 case AUTH_ENCRYPT:
6607                         encoding->flags = IW_ENCODE_ALG_WEP | IW_ENCODE_ENABLED;
6608                         break;
6609                 case AUTH_SHAREDKEY:
6610                         encoding->flags = IW_ENCODE_ALG_WEP | IW_ENCODE_ENABLED;
6611                         break;
6612                 default:
6613                 case AUTH_OPEN:
6614                         encoding->flags = IW_ENCODE_ALG_NONE | IW_ENCODE_DISABLED;
6615                         break;
6616         }
6617         /* We can't return the key, so set the proper flag and return zero */
6618         encoding->flags |= IW_ENCODE_NOKEY;
6619         memset(extra, 0, 16);
6620         
6621         /* Copy the key to the user buffer */
6622         wep_key_len = get_wep_key(local, idx, &buf[0], sizeof(buf));
6623         if (wep_key_len < 0) {
6624                 ext->key_len = 0;
6625         } else {
6626                 ext->key_len = wep_key_len;
6627                 memcpy(extra, buf, ext->key_len);
6628         }
6629 
6630         return 0;
6631 }
6632 
6633 
6634 /*------------------------------------------------------------------*/
6635 /*
6636  * Wireless Handler : set extended authentication parameters
6637  */
6638 static int airo_set_auth(struct net_device *dev,
6639                                struct iw_request_info *info,
6640                                union iwreq_data *wrqu, char *extra)
6641 {
6642         struct airo_info *local = dev->ml_priv;
6643         struct iw_param *param = &wrqu->param;
6644         __le16 currentAuthType = local->config.authType;
6645 
6646         switch (param->flags & IW_AUTH_INDEX) {
6647         case IW_AUTH_WPA_VERSION:
6648         case IW_AUTH_CIPHER_PAIRWISE:
6649         case IW_AUTH_CIPHER_GROUP:
6650         case IW_AUTH_KEY_MGMT:
6651         case IW_AUTH_RX_UNENCRYPTED_EAPOL:
6652         case IW_AUTH_PRIVACY_INVOKED:
6653                 /*
6654                  * airo does not use these parameters
6655                  */
6656                 break;
6657 
6658         case IW_AUTH_DROP_UNENCRYPTED:
6659                 if (param->value) {
6660                         /* Only change auth type if unencrypted */
6661                         if (currentAuthType == AUTH_OPEN)
6662                                 local->config.authType = AUTH_ENCRYPT;
6663                 } else {
6664                         local->config.authType = AUTH_OPEN;
6665                 }
6666 
6667                 /* Commit the changes to flags if needed */
6668                 if (local->config.authType != currentAuthType)
6669                         set_bit (FLAG_COMMIT, &local->flags);
6670                 break;
6671 
6672         case IW_AUTH_80211_AUTH_ALG: {
6673                         /* FIXME: What about AUTH_OPEN?  This API seems to
6674                          * disallow setting our auth to AUTH_OPEN.
6675                          */
6676                         if (param->value & IW_AUTH_ALG_SHARED_KEY) {
6677                                 local->config.authType = AUTH_SHAREDKEY;
6678                         } else if (param->value & IW_AUTH_ALG_OPEN_SYSTEM) {
6679                                 local->config.authType = AUTH_ENCRYPT;
6680                         } else
6681                                 return -EINVAL;
6682 
6683                         /* Commit the changes to flags if needed */
6684                         if (local->config.authType != currentAuthType)
6685                                 set_bit (FLAG_COMMIT, &local->flags);
6686                         break;
6687                 }
6688 
6689         case IW_AUTH_WPA_ENABLED:
6690                 /* Silently accept disable of WPA */
6691                 if (param->value > 0)
6692                         return -EOPNOTSUPP;
6693                 break;
6694 
6695         default:
6696                 return -EOPNOTSUPP;
6697         }
6698         return -EINPROGRESS;
6699 }
6700 
6701 
6702 /*------------------------------------------------------------------*/
6703 /*
6704  * Wireless Handler : get extended authentication parameters
6705  */
6706 static int airo_get_auth(struct net_device *dev,
6707                                struct iw_request_info *info,
6708                                union iwreq_data *wrqu, char *extra)
6709 {
6710         struct airo_info *local = dev->ml_priv;
6711         struct iw_param *param = &wrqu->param;
6712         __le16 currentAuthType = local->config.authType;
6713 
6714         switch (param->flags & IW_AUTH_INDEX) {
6715         case IW_AUTH_DROP_UNENCRYPTED:
6716                 switch (currentAuthType) {
6717                 case AUTH_SHAREDKEY:
6718                 case AUTH_ENCRYPT:
6719                         param->value = 1;
6720                         break;
6721                 default:
6722                         param->value = 0;
6723                         break;
6724                 }
6725                 break;
6726 
6727         case IW_AUTH_80211_AUTH_ALG:
6728                 switch (currentAuthType) {
6729                 case AUTH_SHAREDKEY:
6730                         param->value = IW_AUTH_ALG_SHARED_KEY;
6731                         break;
6732                 case AUTH_ENCRYPT:
6733                 default:
6734                         param->value = IW_AUTH_ALG_OPEN_SYSTEM;
6735                         break;
6736                 }
6737                 break;
6738 
6739         case IW_AUTH_WPA_ENABLED:
6740                 param->value = 0;
6741                 break;
6742 
6743         default:
6744                 return -EOPNOTSUPP;
6745         }
6746         return 0;
6747 }
6748 
6749 
6750 /*------------------------------------------------------------------*/
6751 /*
6752  * Wireless Handler : set Tx-Power
6753  */
6754 static int airo_set_txpow(struct net_device *dev,
6755                           struct iw_request_info *info,
6756                           struct iw_param *vwrq,
6757                           char *extra)
6758 {
6759         struct airo_info *local = dev->ml_priv;
6760         CapabilityRid cap_rid;          /* Card capability info */
6761         int i;
6762         int rc = -EINVAL;
6763         __le16 v = cpu_to_le16(vwrq->value);
6764 
6765         readCapabilityRid(local, &cap_rid, 1);
6766 
6767         if (vwrq->disabled) {
6768                 set_bit (FLAG_RADIO_OFF, &local->flags);
6769                 set_bit (FLAG_COMMIT, &local->flags);
6770                 return -EINPROGRESS;            /* Call commit handler */
6771         }
6772         if (vwrq->flags != IW_TXPOW_MWATT) {
6773                 return -EINVAL;
6774         }
6775         clear_bit (FLAG_RADIO_OFF, &local->flags);
6776         for (i = 0; i < 8 && cap_rid.txPowerLevels[i]; i++)
6777                 if (v == cap_rid.txPowerLevels[i]) {
6778                         readConfigRid(local, 1);
6779                         local->config.txPower = v;
6780                         set_bit (FLAG_COMMIT, &local->flags);
6781                         rc = -EINPROGRESS;      /* Call commit handler */
6782                         break;
6783                 }
6784         return rc;
6785 }
6786 
6787 /*------------------------------------------------------------------*/
6788 /*
6789  * Wireless Handler : get Tx-Power
6790  */
6791 static int airo_get_txpow(struct net_device *dev,
6792                           struct iw_request_info *info,
6793                           struct iw_param *vwrq,
6794                           char *extra)
6795 {
6796         struct airo_info *local = dev->ml_priv;
6797 
6798         readConfigRid(local, 1);
6799         vwrq->value = le16_to_cpu(local->config.txPower);
6800         vwrq->fixed = 1;        /* No power control */
6801         vwrq->disabled = test_bit(FLAG_RADIO_OFF, &local->flags);
6802         vwrq->flags = IW_TXPOW_MWATT;
6803 
6804         return 0;
6805 }
6806 
6807 /*------------------------------------------------------------------*/
6808 /*
6809  * Wireless Handler : set Retry limits
6810  */
6811 static int airo_set_retry(struct net_device *dev,
6812                           struct iw_request_info *info,
6813                           struct iw_param *vwrq,
6814                           char *extra)
6815 {
6816         struct airo_info *local = dev->ml_priv;
6817         int rc = -EINVAL;
6818 
6819         if(vwrq->disabled) {
6820                 return -EINVAL;
6821         }
6822         readConfigRid(local, 1);
6823         if(vwrq->flags & IW_RETRY_LIMIT) {
6824                 __le16 v = cpu_to_le16(vwrq->value);
6825                 if(vwrq->flags & IW_RETRY_LONG)
6826                         local->config.longRetryLimit = v;
6827                 else if (vwrq->flags & IW_RETRY_SHORT)
6828                         local->config.shortRetryLimit = v;
6829                 else {
6830                         /* No modifier : set both */
6831                         local->config.longRetryLimit = v;
6832                         local->config.shortRetryLimit = v;
6833                 }
6834                 set_bit (FLAG_COMMIT, &local->flags);
6835                 rc = -EINPROGRESS;              /* Call commit handler */
6836         }
6837         if(vwrq->flags & IW_RETRY_LIFETIME) {
6838                 local->config.txLifetime = cpu_to_le16(vwrq->value / 1024);
6839                 set_bit (FLAG_COMMIT, &local->flags);
6840                 rc = -EINPROGRESS;              /* Call commit handler */
6841         }
6842         return rc;
6843 }
6844 
6845 /*------------------------------------------------------------------*/
6846 /*
6847  * Wireless Handler : get Retry limits
6848  */
6849 static int airo_get_retry(struct net_device *dev,
6850                           struct iw_request_info *info,
6851                           struct iw_param *vwrq,
6852                           char *extra)
6853 {
6854         struct airo_info *local = dev->ml_priv;
6855 
6856         vwrq->disabled = 0;      /* Can't be disabled */
6857 
6858         readConfigRid(local, 1);
6859         /* Note : by default, display the min retry number */
6860         if((vwrq->flags & IW_RETRY_TYPE) == IW_RETRY_LIFETIME) {
6861                 vwrq->flags = IW_RETRY_LIFETIME;
6862                 vwrq->value = le16_to_cpu(local->config.txLifetime) * 1024;
6863         } else if((vwrq->flags & IW_RETRY_LONG)) {
6864                 vwrq->flags = IW_RETRY_LIMIT | IW_RETRY_LONG;
6865                 vwrq->value = le16_to_cpu(local->config.longRetryLimit);
6866         } else {
6867                 vwrq->flags = IW_RETRY_LIMIT;
6868                 vwrq->value = le16_to_cpu(local->config.shortRetryLimit);
6869                 if(local->config.shortRetryLimit != local->config.longRetryLimit)
6870                         vwrq->flags |= IW_RETRY_SHORT;
6871         }
6872 
6873         return 0;
6874 }
6875 
6876 /*------------------------------------------------------------------*/
6877 /*
6878  * Wireless Handler : get range info
6879  */
6880 static int airo_get_range(struct net_device *dev,
6881                           struct iw_request_info *info,
6882                           struct iw_point *dwrq,
6883                           char *extra)
6884 {
6885         struct airo_info *local = dev->ml_priv;
6886         struct iw_range *range = (struct iw_range *) extra;
6887         CapabilityRid cap_rid;          /* Card capability info */
6888         int             i;
6889         int             k;
6890 
6891         readCapabilityRid(local, &cap_rid, 1);
6892 
6893         dwrq->length = sizeof(struct iw_range);
6894         memset(range, 0, sizeof(*range));
6895         range->min_nwid = 0x0000;
6896         range->max_nwid = 0x0000;
6897         range->num_channels = 14;
6898         /* Should be based on cap_rid.country to give only
6899          * what the current card support */
6900         k = 0;
6901         for(i = 0; i < 14; i++) {
6902                 range->freq[k].i = i + 1; /* List index */
6903                 range->freq[k].m = 100000 *
6904                      ieee80211_channel_to_frequency(i + 1, IEEE80211_BAND_2GHZ);
6905                 range->freq[k++].e = 1; /* Values in MHz -> * 10^5 * 10 */
6906         }
6907         range->num_frequency = k;
6908 
6909         range->sensitivity = 65535;
6910 
6911         /* Hum... Should put the right values there */
6912         if (local->rssi)
6913                 range->max_qual.qual = 100;     /* % */
6914         else
6915                 range->max_qual.qual = airo_get_max_quality(&cap_rid);
6916         range->max_qual.level = 0x100 - 120;    /* -120 dBm */
6917         range->max_qual.noise = 0x100 - 120;    /* -120 dBm */
6918 
6919         /* Experimental measurements - boundary 11/5.5 Mb/s */
6920         /* Note : with or without the (local->rssi), results
6921          * are somewhat different. - Jean II */
6922         if (local->rssi) {
6923                 range->avg_qual.qual = 50;              /* % */
6924                 range->avg_qual.level = 0x100 - 70;     /* -70 dBm */
6925         } else {
6926                 range->avg_qual.qual = airo_get_avg_quality(&cap_rid);
6927                 range->avg_qual.level = 0x100 - 80;     /* -80 dBm */
6928         }
6929         range->avg_qual.noise = 0x100 - 85;             /* -85 dBm */
6930 
6931         for(i = 0 ; i < 8 ; i++) {
6932                 range->bitrate[i] = cap_rid.supportedRates[i] * 500000;
6933                 if(range->bitrate[i] == 0)
6934                         break;
6935         }
6936         range->num_bitrates = i;
6937 
6938         /* Set an indication of the max TCP throughput
6939          * in bit/s that we can expect using this interface.
6940          * May be use for QoS stuff... Jean II */
6941         if(i > 2)
6942                 range->throughput = 5000 * 1000;
6943         else
6944                 range->throughput = 1500 * 1000;
6945 
6946         range->min_rts = 0;
6947         range->max_rts = AIRO_DEF_MTU;
6948         range->min_frag = 256;
6949         range->max_frag = AIRO_DEF_MTU;
6950 
6951         if(cap_rid.softCap & cpu_to_le16(2)) {
6952                 // WEP: RC4 40 bits
6953                 range->encoding_size[0] = 5;
6954                 // RC4 ~128 bits
6955                 if (cap_rid.softCap & cpu_to_le16(0x100)) {
6956                         range->encoding_size[1] = 13;
6957                         range->num_encoding_sizes = 2;
6958                 } else
6959                         range->num_encoding_sizes = 1;
6960                 range->max_encoding_tokens =
6961                         cap_rid.softCap & cpu_to_le16(0x80) ? 4 : 1;
6962         } else {
6963                 range->num_encoding_sizes = 0;
6964                 range->max_encoding_tokens = 0;
6965         }
6966         range->min_pmp = 0;
6967         range->max_pmp = 5000000;       /* 5 secs */
6968         range->min_pmt = 0;
6969         range->max_pmt = 65535 * 1024;  /* ??? */
6970         range->pmp_flags = IW_POWER_PERIOD;
6971         range->pmt_flags = IW_POWER_TIMEOUT;
6972         range->pm_capa = IW_POWER_PERIOD | IW_POWER_TIMEOUT | IW_POWER_ALL_R;
6973 
6974         /* Transmit Power - values are in mW */
6975         for(i = 0 ; i < 8 ; i++) {
6976                 range->txpower[i] = le16_to_cpu(cap_rid.txPowerLevels[i]);
6977                 if(range->txpower[i] == 0)
6978                         break;
6979         }
6980         range->num_txpower = i;
6981         range->txpower_capa = IW_TXPOW_MWATT;
6982         range->we_version_source = 19;
6983         range->we_version_compiled = WIRELESS_EXT;
6984         range->retry_capa = IW_RETRY_LIMIT | IW_RETRY_LIFETIME;
6985         range->retry_flags = IW_RETRY_LIMIT;
6986         range->r_time_flags = IW_RETRY_LIFETIME;
6987         range->min_retry = 1;
6988         range->max_retry = 65535;
6989         range->min_r_time = 1024;
6990         range->max_r_time = 65535 * 1024;
6991 
6992         /* Event capability (kernel + driver) */
6993         range->event_capa[0] = (IW_EVENT_CAPA_K_0 |
6994                                 IW_EVENT_CAPA_MASK(SIOCGIWTHRSPY) |
6995                                 IW_EVENT_CAPA_MASK(SIOCGIWAP) |
6996                                 IW_EVENT_CAPA_MASK(SIOCGIWSCAN));
6997         range->event_capa[1] = IW_EVENT_CAPA_K_1;
6998         range->event_capa[4] = IW_EVENT_CAPA_MASK(IWEVTXDROP);
6999         return 0;
7000 }
7001 
7002 /*------------------------------------------------------------------*/
7003 /*
7004  * Wireless Handler : set Power Management
7005  */
7006 static int airo_set_power(struct net_device *dev,
7007                           struct iw_request_info *info,
7008                           struct iw_param *vwrq,
7009                           char *extra)
7010 {
7011         struct airo_info *local = dev->ml_priv;
7012 
7013         readConfigRid(local, 1);
7014         if (vwrq->disabled) {
7015                 if (sniffing_mode(local))
7016                         return -EINVAL;
7017                 local->config.powerSaveMode = POWERSAVE_CAM;
7018                 local->config.rmode &= ~RXMODE_MASK;
7019                 local->config.rmode |= RXMODE_BC_MC_ADDR;
7020                 set_bit (FLAG_COMMIT, &local->flags);
7021                 return -EINPROGRESS;            /* Call commit handler */
7022         }
7023         if ((vwrq->flags & IW_POWER_TYPE) == IW_POWER_TIMEOUT) {
7024                 local->config.fastListenDelay = cpu_to_le16((vwrq->value + 500) / 1024);
7025                 local->config.powerSaveMode = POWERSAVE_PSPCAM;
7026                 set_bit (FLAG_COMMIT, &local->flags);
7027         } else if ((vwrq->flags & IW_POWER_TYPE) == IW_POWER_PERIOD) {
7028                 local->config.fastListenInterval =
7029                 local->config.listenInterval =
7030                         cpu_to_le16((vwrq->value + 500) / 1024);
7031                 local->config.powerSaveMode = POWERSAVE_PSPCAM;
7032                 set_bit (FLAG_COMMIT, &local->flags);
7033         }
7034         switch (vwrq->flags & IW_POWER_MODE) {
7035                 case IW_POWER_UNICAST_R:
7036                         if (sniffing_mode(local))
7037                                 return -EINVAL;
7038                         local->config.rmode &= ~RXMODE_MASK;
7039                         local->config.rmode |= RXMODE_ADDR;
7040                         set_bit (FLAG_COMMIT, &local->flags);
7041                         break;
7042                 case IW_POWER_ALL_R:
7043                         if (sniffing_mode(local))
7044                                 return -EINVAL;
7045                         local->config.rmode &= ~RXMODE_MASK;
7046                         local->config.rmode |= RXMODE_BC_MC_ADDR;
7047                         set_bit (FLAG_COMMIT, &local->flags);
7048                 case IW_POWER_ON:
7049                         /* This is broken, fixme ;-) */
7050                         break;
7051                 default:
7052                         return -EINVAL;
7053         }
7054         // Note : we may want to factor local->need_commit here
7055         // Note2 : may also want to factor RXMODE_RFMON test
7056         return -EINPROGRESS;            /* Call commit handler */
7057 }
7058 
7059 /*------------------------------------------------------------------*/
7060 /*
7061  * Wireless Handler : get Power Management
7062  */
7063 static int airo_get_power(struct net_device *dev,
7064                           struct iw_request_info *info,
7065                           struct iw_param *vwrq,
7066                           char *extra)
7067 {
7068         struct airo_info *local = dev->ml_priv;
7069         __le16 mode;
7070 
7071         readConfigRid(local, 1);
7072         mode = local->config.powerSaveMode;
7073         if ((vwrq->disabled = (mode == POWERSAVE_CAM)))
7074                 return 0;
7075         if ((vwrq->flags