linux/drivers/net/wireless/airo.c
<<
>>
Prefs
   1/*======================================================================
   2
   3    Aironet driver for 4500 and 4800 series cards
   4
   5    This code is released under both the GPL version 2 and BSD licenses.
   6    Either license may be used.  The respective licenses are found at
   7    the end of this file.
   8
   9    This code was developed by Benjamin Reed <breed@users.sourceforge.net>
  10    including portions of which come from the Aironet PC4500
  11    Developer's Reference Manual and used with permission.  Copyright
  12    (C) 1999 Benjamin Reed.  All Rights Reserved.  Permission to use
  13    code in the Developer's manual was granted for this driver by
  14    Aironet.  Major code contributions were received from Javier Achirica
  15    <achirica@users.sourceforge.net> and Jean Tourrilhes <jt@hpl.hp.com>.
  16    Code was also integrated from the Cisco Aironet driver for Linux.
  17    Support for MPI350 cards was added by Fabrice Bellet
  18    <fabrice@bellet.info>.
  19
  20======================================================================*/
  21
  22#include <linux/err.h>
  23#include <linux/init.h>
  24
  25#include <linux/kernel.h>
  26#include <linux/module.h>
  27#include <linux/proc_fs.h>
  28
  29#include <linux/sched.h>
  30#include <linux/ptrace.h>
  31#include <linux/slab.h>
  32#include <linux/string.h>
  33#include <linux/timer.h>
  34#include <linux/interrupt.h>
  35#include <linux/in.h>
  36#include <linux/bitops.h>
  37#include <linux/scatterlist.h>
  38#include <linux/crypto.h>
  39#include <asm/io.h>
  40#include <asm/system.h>
  41#include <asm/unaligned.h>
  42
  43#include <linux/netdevice.h>
  44#include <linux/etherdevice.h>
  45#include <linux/skbuff.h>
  46#include <linux/if_arp.h>
  47#include <linux/ioport.h>
  48#include <linux/pci.h>
  49#include <asm/uaccess.h>
  50#include <linux/kthread.h>
  51#include <linux/freezer.h>
  52
  53#include <linux/ieee80211.h>
  54
  55#include "airo.h"
  56
  57#define DRV_NAME "airo"
  58
  59#ifdef CONFIG_PCI
  60static struct pci_device_id card_ids[] = {
  61        { 0x14b9, 1, PCI_ANY_ID, PCI_ANY_ID, },
  62        { 0x14b9, 0x4500, PCI_ANY_ID, PCI_ANY_ID },
  63        { 0x14b9, 0x4800, PCI_ANY_ID, PCI_ANY_ID, },
  64        { 0x14b9, 0x0340, PCI_ANY_ID, PCI_ANY_ID, },
  65        { 0x14b9, 0x0350, PCI_ANY_ID, PCI_ANY_ID, },
  66        { 0x14b9, 0x5000, PCI_ANY_ID, PCI_ANY_ID, },
  67        { 0x14b9, 0xa504, PCI_ANY_ID, PCI_ANY_ID, },
  68        { 0, }
  69};
  70MODULE_DEVICE_TABLE(pci, card_ids);
  71
  72static int airo_pci_probe(struct pci_dev *, const struct pci_device_id *);
  73static void airo_pci_remove(struct pci_dev *);
  74static int airo_pci_suspend(struct pci_dev *pdev, pm_message_t state);
  75static int airo_pci_resume(struct pci_dev *pdev);
  76
  77static struct pci_driver airo_driver = {
  78        .name     = DRV_NAME,
  79        .id_table = card_ids,
  80        .probe    = airo_pci_probe,
  81        .remove   = __devexit_p(airo_pci_remove),
  82        .suspend  = airo_pci_suspend,
  83        .resume   = airo_pci_resume,
  84};
  85#endif /* CONFIG_PCI */
  86
  87/* Include Wireless Extension definition and check version - Jean II */
  88#include <linux/wireless.h>
  89#define WIRELESS_SPY            /* enable iwspy support */
  90#include <net/iw_handler.h>     /* New driver API */
  91
  92#define CISCO_EXT               /* enable Cisco extensions */
  93#ifdef CISCO_EXT
  94#include <linux/delay.h>
  95#endif
  96
  97/* Hack to do some power saving */
  98#define POWER_ON_DOWN
  99
 100/* As you can see this list is HUGH!
 101   I really don't know what a lot of these counts are about, but they
 102   are all here for completeness.  If the IGNLABEL macro is put in
 103   infront of the label, that statistic will not be included in the list
 104   of statistics in the /proc filesystem */
 105
 106#define IGNLABEL(comment) NULL
 107static char *statsLabels[] = {
 108        "RxOverrun",
 109        IGNLABEL("RxPlcpCrcErr"),
 110        IGNLABEL("RxPlcpFormatErr"),
 111        IGNLABEL("RxPlcpLengthErr"),
 112        "RxMacCrcErr",
 113        "RxMacCrcOk",
 114        "RxWepErr",
 115        "RxWepOk",
 116        "RetryLong",
 117        "RetryShort",
 118        "MaxRetries",
 119        "NoAck",
 120        "NoCts",
 121        "RxAck",
 122        "RxCts",
 123        "TxAck",
 124        "TxRts",
 125        "TxCts",
 126        "TxMc",
 127        "TxBc",
 128        "TxUcFrags",
 129        "TxUcPackets",
 130        "TxBeacon",
 131        "RxBeacon",
 132        "TxSinColl",
 133        "TxMulColl",
 134        "DefersNo",
 135        "DefersProt",
 136        "DefersEngy",
 137        "DupFram",
 138        "RxFragDisc",
 139        "TxAged",
 140        "RxAged",
 141        "LostSync-MaxRetry",
 142        "LostSync-MissedBeacons",
 143        "LostSync-ArlExceeded",
 144        "LostSync-Deauth",
 145        "LostSync-Disassoced",
 146        "LostSync-TsfTiming",
 147        "HostTxMc",
 148        "HostTxBc",
 149        "HostTxUc",
 150        "HostTxFail",
 151        "HostRxMc",
 152        "HostRxBc",
 153        "HostRxUc",
 154        "HostRxDiscard",
 155        IGNLABEL("HmacTxMc"),
 156        IGNLABEL("HmacTxBc"),
 157        IGNLABEL("HmacTxUc"),
 158        IGNLABEL("HmacTxFail"),
 159        IGNLABEL("HmacRxMc"),
 160        IGNLABEL("HmacRxBc"),
 161        IGNLABEL("HmacRxUc"),
 162        IGNLABEL("HmacRxDiscard"),
 163        IGNLABEL("HmacRxAccepted"),
 164        "SsidMismatch",
 165        "ApMismatch",
 166        "RatesMismatch",
 167        "AuthReject",
 168        "AuthTimeout",
 169        "AssocReject",
 170        "AssocTimeout",
 171        IGNLABEL("ReasonOutsideTable"),
 172        IGNLABEL("ReasonStatus1"),
 173        IGNLABEL("ReasonStatus2"),
 174        IGNLABEL("ReasonStatus3"),
 175        IGNLABEL("ReasonStatus4"),
 176        IGNLABEL("ReasonStatus5"),
 177        IGNLABEL("ReasonStatus6"),
 178        IGNLABEL("ReasonStatus7"),
 179        IGNLABEL("ReasonStatus8"),
 180        IGNLABEL("ReasonStatus9"),
 181        IGNLABEL("ReasonStatus10"),
 182        IGNLABEL("ReasonStatus11"),
 183        IGNLABEL("ReasonStatus12"),
 184        IGNLABEL("ReasonStatus13"),
 185        IGNLABEL("ReasonStatus14"),
 186        IGNLABEL("ReasonStatus15"),
 187        IGNLABEL("ReasonStatus16"),
 188        IGNLABEL("ReasonStatus17"),
 189        IGNLABEL("ReasonStatus18"),
 190        IGNLABEL("ReasonStatus19"),
 191        "RxMan",
 192        "TxMan",
 193        "RxRefresh",
 194        "TxRefresh",
 195        "RxPoll",
 196        "TxPoll",
 197        "HostRetries",
 198        "LostSync-HostReq",
 199        "HostTxBytes",
 200        "HostRxBytes",
 201        "ElapsedUsec",
 202        "ElapsedSec",
 203        "LostSyncBetterAP",
 204        "PrivacyMismatch",
 205        "Jammed",
 206        "DiscRxNotWepped",
 207        "PhyEleMismatch",
 208        (char*)-1 };
 209#ifndef RUN_AT
 210#define RUN_AT(x) (jiffies+(x))
 211#endif
 212
 213
 214/* These variables are for insmod, since it seems that the rates
 215   can only be set in setup_card.  Rates should be a comma separated
 216   (no spaces) list of rates (up to 8). */
 217
 218static int rates[8];
 219static int basic_rate;
 220static char *ssids[3];
 221
 222static int io[4];
 223static int irq[4];
 224
 225static
 226int maxencrypt /* = 0 */; /* The highest rate that the card can encrypt at.
 227                       0 means no limit.  For old cards this was 4 */
 228
 229static int auto_wep /* = 0 */; /* If set, it tries to figure out the wep mode */
 230static int aux_bap /* = 0 */; /* Checks to see if the aux ports are needed to read
 231                    the bap, needed on some older cards and buses. */
 232static int adhoc;
 233
 234static int probe = 1;
 235
 236static int proc_uid /* = 0 */;
 237
 238static int proc_gid /* = 0 */;
 239
 240static int airo_perm = 0555;
 241
 242static int proc_perm = 0644;
 243
 244MODULE_AUTHOR("Benjamin Reed");
 245MODULE_DESCRIPTION("Support for Cisco/Aironet 802.11 wireless ethernet \
 246cards.  Direct support for ISA/PCI/MPI cards and support \
 247for PCMCIA when used with airo_cs.");
 248MODULE_LICENSE("Dual BSD/GPL");
 249MODULE_SUPPORTED_DEVICE("Aironet 4500, 4800 and Cisco 340/350");
 250module_param_array(io, int, NULL, 0);
 251module_param_array(irq, int, NULL, 0);
 252module_param(basic_rate, int, 0);
 253module_param_array(rates, int, NULL, 0);
 254module_param_array(ssids, charp, NULL, 0);
 255module_param(auto_wep, int, 0);
 256MODULE_PARM_DESC(auto_wep, "If non-zero, the driver will keep looping through \
 257the authentication options until an association is made.  The value of \
 258auto_wep is number of the wep keys to check.  A value of 2 will try using \
 259the key at index 0 and index 1.");
 260module_param(aux_bap, int, 0);
 261MODULE_PARM_DESC(aux_bap, "If non-zero, the driver will switch into a mode \
 262than seems to work better for older cards with some older buses.  Before \
 263switching it checks that the switch is needed.");
 264module_param(maxencrypt, int, 0);
 265MODULE_PARM_DESC(maxencrypt, "The maximum speed that the card can do \
 266encryption.  Units are in 512kbs.  Zero (default) means there is no limit. \
 267Older cards used to be limited to 2mbs (4).");
 268module_param(adhoc, int, 0);
 269MODULE_PARM_DESC(adhoc, "If non-zero, the card will start in adhoc mode.");
 270module_param(probe, int, 0);
 271MODULE_PARM_DESC(probe, "If zero, the driver won't start the card.");
 272
 273module_param(proc_uid, int, 0);
 274MODULE_PARM_DESC(proc_uid, "The uid that the /proc files will belong to.");
 275module_param(proc_gid, int, 0);
 276MODULE_PARM_DESC(proc_gid, "The gid that the /proc files will belong to.");
 277module_param(airo_perm, int, 0);
 278MODULE_PARM_DESC(airo_perm, "The permission bits of /proc/[driver/]aironet.");
 279module_param(proc_perm, int, 0);
 280MODULE_PARM_DESC(proc_perm, "The permission bits of the files in /proc");
 281
 282/* This is a kind of sloppy hack to get this information to OUT4500 and
 283   IN4500.  I would be extremely interested in the situation where this
 284   doesn't work though!!! */
 285static int do8bitIO /* = 0 */;
 286
 287/* Return codes */
 288#define SUCCESS 0
 289#define ERROR -1
 290#define NO_PACKET -2
 291
 292/* Commands */
 293#define NOP2            0x0000
 294#define MAC_ENABLE      0x0001
 295#define MAC_DISABLE     0x0002
 296#define CMD_LOSE_SYNC   0x0003 /* Not sure what this does... */
 297#define CMD_SOFTRESET   0x0004
 298#define HOSTSLEEP       0x0005
 299#define CMD_MAGIC_PKT   0x0006
 300#define CMD_SETWAKEMASK 0x0007
 301#define CMD_READCFG     0x0008
 302#define CMD_SETMODE     0x0009
 303#define CMD_ALLOCATETX  0x000a
 304#define CMD_TRANSMIT    0x000b
 305#define CMD_DEALLOCATETX 0x000c
 306#define NOP             0x0010
 307#define CMD_WORKAROUND  0x0011
 308#define CMD_ALLOCATEAUX 0x0020
 309#define CMD_ACCESS      0x0021
 310#define CMD_PCIBAP      0x0022
 311#define CMD_PCIAUX      0x0023
 312#define CMD_ALLOCBUF    0x0028
 313#define CMD_GETTLV      0x0029
 314#define CMD_PUTTLV      0x002a
 315#define CMD_DELTLV      0x002b
 316#define CMD_FINDNEXTTLV 0x002c
 317#define CMD_PSPNODES    0x0030
 318#define CMD_SETCW       0x0031    
 319#define CMD_SETPCF      0x0032    
 320#define CMD_SETPHYREG   0x003e
 321#define CMD_TXTEST      0x003f
 322#define MAC_ENABLETX    0x0101
 323#define CMD_LISTBSS     0x0103
 324#define CMD_SAVECFG     0x0108
 325#define CMD_ENABLEAUX   0x0111
 326#define CMD_WRITERID    0x0121
 327#define CMD_USEPSPNODES 0x0130
 328#define MAC_ENABLERX    0x0201
 329
 330/* Command errors */
 331#define ERROR_QUALIF 0x00
 332#define ERROR_ILLCMD 0x01
 333#define ERROR_ILLFMT 0x02
 334#define ERROR_INVFID 0x03
 335#define ERROR_INVRID 0x04
 336#define ERROR_LARGE 0x05
 337#define ERROR_NDISABL 0x06
 338#define ERROR_ALLOCBSY 0x07
 339#define ERROR_NORD 0x0B
 340#define ERROR_NOWR 0x0C
 341#define ERROR_INVFIDTX 0x0D
 342#define ERROR_TESTACT 0x0E
 343#define ERROR_TAGNFND 0x12
 344#define ERROR_DECODE 0x20
 345#define ERROR_DESCUNAV 0x21
 346#define ERROR_BADLEN 0x22
 347#define ERROR_MODE 0x80
 348#define ERROR_HOP 0x81
 349#define ERROR_BINTER 0x82
 350#define ERROR_RXMODE 0x83
 351#define ERROR_MACADDR 0x84
 352#define ERROR_RATES 0x85
 353#define ERROR_ORDER 0x86
 354#define ERROR_SCAN 0x87
 355#define ERROR_AUTH 0x88
 356#define ERROR_PSMODE 0x89
 357#define ERROR_RTYPE 0x8A
 358#define ERROR_DIVER 0x8B
 359#define ERROR_SSID 0x8C
 360#define ERROR_APLIST 0x8D
 361#define ERROR_AUTOWAKE 0x8E
 362#define ERROR_LEAP 0x8F
 363
 364/* Registers */
 365#define COMMAND 0x00
 366#define PARAM0 0x02
 367#define PARAM1 0x04
 368#define PARAM2 0x06
 369#define STATUS 0x08
 370#define RESP0 0x0a
 371#define RESP1 0x0c
 372#define RESP2 0x0e
 373#define LINKSTAT 0x10
 374#define SELECT0 0x18
 375#define OFFSET0 0x1c
 376#define RXFID 0x20
 377#define TXALLOCFID 0x22
 378#define TXCOMPLFID 0x24
 379#define DATA0 0x36
 380#define EVSTAT 0x30
 381#define EVINTEN 0x32
 382#define EVACK 0x34
 383#define SWS0 0x28
 384#define SWS1 0x2a
 385#define SWS2 0x2c
 386#define SWS3 0x2e
 387#define AUXPAGE 0x3A
 388#define AUXOFF 0x3C
 389#define AUXDATA 0x3E
 390
 391#define FID_TX 1
 392#define FID_RX 2
 393/* Offset into aux memory for descriptors */
 394#define AUX_OFFSET 0x800
 395/* Size of allocated packets */
 396#define PKTSIZE 1840
 397#define RIDSIZE 2048
 398/* Size of the transmit queue */
 399#define MAXTXQ 64
 400
 401/* BAP selectors */
 402#define BAP0 0 /* Used for receiving packets */
 403#define BAP1 2 /* Used for xmiting packets and working with RIDS */
 404
 405/* Flags */
 406#define COMMAND_BUSY 0x8000
 407
 408#define BAP_BUSY 0x8000
 409#define BAP_ERR 0x4000
 410#define BAP_DONE 0x2000
 411
 412#define PROMISC 0xffff
 413#define NOPROMISC 0x0000
 414
 415#define EV_CMD 0x10
 416#define EV_CLEARCOMMANDBUSY 0x4000
 417#define EV_RX 0x01
 418#define EV_TX 0x02
 419#define EV_TXEXC 0x04
 420#define EV_ALLOC 0x08
 421#define EV_LINK 0x80
 422#define EV_AWAKE 0x100
 423#define EV_TXCPY 0x400
 424#define EV_UNKNOWN 0x800
 425#define EV_MIC 0x1000 /* Message Integrity Check Interrupt */
 426#define EV_AWAKEN 0x2000
 427#define STATUS_INTS (EV_AWAKE|EV_LINK|EV_TXEXC|EV_TX|EV_TXCPY|EV_RX|EV_MIC)
 428
 429#ifdef CHECK_UNKNOWN_INTS
 430#define IGNORE_INTS ( EV_CMD | EV_UNKNOWN)
 431#else
 432#define IGNORE_INTS (~STATUS_INTS)
 433#endif
 434
 435/* RID TYPES */
 436#define RID_RW 0x20
 437
 438/* The RIDs */
 439#define RID_CAPABILITIES 0xFF00
 440#define RID_APINFO     0xFF01
 441#define RID_RADIOINFO  0xFF02
 442#define RID_UNKNOWN3   0xFF03
 443#define RID_RSSI       0xFF04
 444#define RID_CONFIG     0xFF10
 445#define RID_SSID       0xFF11
 446#define RID_APLIST     0xFF12
 447#define RID_DRVNAME    0xFF13
 448#define RID_ETHERENCAP 0xFF14
 449#define RID_WEP_TEMP   0xFF15
 450#define RID_WEP_PERM   0xFF16
 451#define RID_MODULATION 0xFF17
 452#define RID_OPTIONS    0xFF18
 453#define RID_ACTUALCONFIG 0xFF20 /*readonly*/
 454#define RID_FACTORYCONFIG 0xFF21
 455#define RID_UNKNOWN22  0xFF22
 456#define RID_LEAPUSERNAME 0xFF23
 457#define RID_LEAPPASSWORD 0xFF24
 458#define RID_STATUS     0xFF50
 459#define RID_BEACON_HST 0xFF51
 460#define RID_BUSY_HST   0xFF52
 461#define RID_RETRIES_HST 0xFF53
 462#define RID_UNKNOWN54  0xFF54
 463#define RID_UNKNOWN55  0xFF55
 464#define RID_UNKNOWN56  0xFF56
 465#define RID_MIC        0xFF57
 466#define RID_STATS16    0xFF60
 467#define RID_STATS16DELTA 0xFF61
 468#define RID_STATS16DELTACLEAR 0xFF62
 469#define RID_STATS      0xFF68
 470#define RID_STATSDELTA 0xFF69
 471#define RID_STATSDELTACLEAR 0xFF6A
 472#define RID_ECHOTEST_RID 0xFF70
 473#define RID_ECHOTEST_RESULTS 0xFF71
 474#define RID_BSSLISTFIRST 0xFF72
 475#define RID_BSSLISTNEXT  0xFF73
 476#define RID_WPA_BSSLISTFIRST 0xFF74
 477#define RID_WPA_BSSLISTNEXT  0xFF75
 478
 479typedef struct {
 480        u16 cmd;
 481        u16 parm0;
 482        u16 parm1;
 483        u16 parm2;
 484} Cmd;
 485
 486typedef struct {
 487        u16 status;
 488        u16 rsp0;
 489        u16 rsp1;
 490        u16 rsp2;
 491} Resp;
 492
 493/*
 494 * Rids and endian-ness:  The Rids will always be in cpu endian, since
 495 * this all the patches from the big-endian guys end up doing that.
 496 * so all rid access should use the read/writeXXXRid routines.
 497 */
 498
 499/* This structure came from an email sent to me from an engineer at
 500   aironet for inclusion into this driver */
 501typedef struct WepKeyRid WepKeyRid;
 502struct WepKeyRid {
 503        __le16 len;
 504        __le16 kindex;
 505        u8 mac[ETH_ALEN];
 506        __le16 klen;
 507        u8 key[16];
 508} __attribute__ ((packed));
 509
 510/* These structures are from the Aironet's PC4500 Developers Manual */
 511typedef struct Ssid Ssid;
 512struct Ssid {
 513        __le16 len;
 514        u8 ssid[32];
 515} __attribute__ ((packed));
 516
 517typedef struct SsidRid SsidRid;
 518struct SsidRid {
 519        __le16 len;
 520        Ssid ssids[3];
 521} __attribute__ ((packed));
 522
 523typedef struct ModulationRid ModulationRid;
 524struct ModulationRid {
 525        __le16 len;
 526        __le16 modulation;
 527#define MOD_DEFAULT cpu_to_le16(0)
 528#define MOD_CCK cpu_to_le16(1)
 529#define MOD_MOK cpu_to_le16(2)
 530} __attribute__ ((packed));
 531
 532typedef struct ConfigRid ConfigRid;
 533struct ConfigRid {
 534        __le16 len; /* sizeof(ConfigRid) */
 535        __le16 opmode; /* operating mode */
 536#define MODE_STA_IBSS cpu_to_le16(0)
 537#define MODE_STA_ESS cpu_to_le16(1)
 538#define MODE_AP cpu_to_le16(2)
 539#define MODE_AP_RPTR cpu_to_le16(3)
 540#define MODE_CFG_MASK cpu_to_le16(0xff)
 541#define MODE_ETHERNET_HOST cpu_to_le16(0<<8) /* rx payloads converted */
 542#define MODE_LLC_HOST cpu_to_le16(1<<8) /* rx payloads left as is */
 543#define MODE_AIRONET_EXTEND cpu_to_le16(1<<9) /* enable Aironet extenstions */
 544#define MODE_AP_INTERFACE cpu_to_le16(1<<10) /* enable ap interface extensions */
 545#define MODE_ANTENNA_ALIGN cpu_to_le16(1<<11) /* enable antenna alignment */
 546#define MODE_ETHER_LLC cpu_to_le16(1<<12) /* enable ethernet LLC */
 547#define MODE_LEAF_NODE cpu_to_le16(1<<13) /* enable leaf node bridge */
 548#define MODE_CF_POLLABLE cpu_to_le16(1<<14) /* enable CF pollable */
 549#define MODE_MIC cpu_to_le16(1<<15) /* enable MIC */
 550        __le16 rmode; /* receive mode */
 551#define RXMODE_BC_MC_ADDR cpu_to_le16(0)
 552#define RXMODE_BC_ADDR cpu_to_le16(1) /* ignore multicasts */
 553#define RXMODE_ADDR cpu_to_le16(2) /* ignore multicast and broadcast */
 554#define RXMODE_RFMON cpu_to_le16(3) /* wireless monitor mode */
 555#define RXMODE_RFMON_ANYBSS cpu_to_le16(4)
 556#define RXMODE_LANMON cpu_to_le16(5) /* lan style monitor -- data packets only */
 557#define RXMODE_MASK cpu_to_le16(255)
 558#define RXMODE_DISABLE_802_3_HEADER cpu_to_le16(1<<8) /* disables 802.3 header on rx */
 559#define RXMODE_FULL_MASK (RXMODE_MASK | RXMODE_DISABLE_802_3_HEADER)
 560#define RXMODE_NORMALIZED_RSSI cpu_to_le16(1<<9) /* return normalized RSSI */
 561        __le16 fragThresh;
 562        __le16 rtsThres;
 563        u8 macAddr[ETH_ALEN];
 564        u8 rates[8];
 565        __le16 shortRetryLimit;
 566        __le16 longRetryLimit;
 567        __le16 txLifetime; /* in kusec */
 568        __le16 rxLifetime; /* in kusec */
 569        __le16 stationary;
 570        __le16 ordering;
 571        __le16 u16deviceType; /* for overriding device type */
 572        __le16 cfpRate;
 573        __le16 cfpDuration;
 574        __le16 _reserved1[3];
 575        /*---------- Scanning/Associating ----------*/
 576        __le16 scanMode;
 577#define SCANMODE_ACTIVE cpu_to_le16(0)
 578#define SCANMODE_PASSIVE cpu_to_le16(1)
 579#define SCANMODE_AIROSCAN cpu_to_le16(2)
 580        __le16 probeDelay; /* in kusec */
 581        __le16 probeEnergyTimeout; /* in kusec */
 582        __le16 probeResponseTimeout;
 583        __le16 beaconListenTimeout;
 584        __le16 joinNetTimeout;
 585        __le16 authTimeout;
 586        __le16 authType;
 587#define AUTH_OPEN cpu_to_le16(0x1)
 588#define AUTH_ENCRYPT cpu_to_le16(0x101)
 589#define AUTH_SHAREDKEY cpu_to_le16(0x102)
 590#define AUTH_ALLOW_UNENCRYPTED cpu_to_le16(0x200)
 591        __le16 associationTimeout;
 592        __le16 specifiedApTimeout;
 593        __le16 offlineScanInterval;
 594        __le16 offlineScanDuration;
 595        __le16 linkLossDelay;
 596        __le16 maxBeaconLostTime;
 597        __le16 refreshInterval;
 598#define DISABLE_REFRESH cpu_to_le16(0xFFFF)
 599        __le16 _reserved1a[1];
 600        /*---------- Power save operation ----------*/
 601        __le16 powerSaveMode;
 602#define POWERSAVE_CAM cpu_to_le16(0)
 603#define POWERSAVE_PSP cpu_to_le16(1)
 604#define POWERSAVE_PSPCAM cpu_to_le16(2)
 605        __le16 sleepForDtims;
 606        __le16 listenInterval;
 607        __le16 fastListenInterval;
 608        __le16 listenDecay;
 609        __le16 fastListenDelay;
 610        __le16 _reserved2[2];
 611        /*---------- Ap/Ibss config items ----------*/
 612        __le16 beaconPeriod;
 613        __le16 atimDuration;
 614        __le16 hopPeriod;
 615        __le16 channelSet;
 616        __le16 channel;
 617        __le16 dtimPeriod;
 618        __le16 bridgeDistance;
 619        __le16 radioID;
 620        /*---------- Radio configuration ----------*/
 621        __le16 radioType;
 622#define RADIOTYPE_DEFAULT cpu_to_le16(0)
 623#define RADIOTYPE_802_11 cpu_to_le16(1)
 624#define RADIOTYPE_LEGACY cpu_to_le16(2)
 625        u8 rxDiversity;
 626        u8 txDiversity;
 627        __le16 txPower;
 628#define TXPOWER_DEFAULT 0
 629        __le16 rssiThreshold;
 630#define RSSI_DEFAULT 0
 631        __le16 modulation;
 632#define PREAMBLE_AUTO cpu_to_le16(0)
 633#define PREAMBLE_LONG cpu_to_le16(1)
 634#define PREAMBLE_SHORT cpu_to_le16(2)
 635        __le16 preamble;
 636        __le16 homeProduct;
 637        __le16 radioSpecific;
 638        /*---------- Aironet Extensions ----------*/
 639        u8 nodeName[16];
 640        __le16 arlThreshold;
 641        __le16 arlDecay;
 642        __le16 arlDelay;
 643        __le16 _reserved4[1];
 644        /*---------- Aironet Extensions ----------*/
 645        u8 magicAction;
 646#define MAGIC_ACTION_STSCHG 1
 647#define MAGIC_ACTION_RESUME 2
 648#define MAGIC_IGNORE_MCAST (1<<8)
 649#define MAGIC_IGNORE_BCAST (1<<9)
 650#define MAGIC_SWITCH_TO_PSP (0<<10)
 651#define MAGIC_STAY_IN_CAM (1<<10)
 652        u8 magicControl;
 653        __le16 autoWake;
 654} __attribute__ ((packed));
 655
 656typedef struct StatusRid StatusRid;
 657struct StatusRid {
 658        __le16 len;
 659        u8 mac[ETH_ALEN];
 660        __le16 mode;
 661        __le16 errorCode;
 662        __le16 sigQuality;
 663        __le16 SSIDlen;
 664        char SSID[32];
 665        char apName[16];
 666        u8 bssid[4][ETH_ALEN];
 667        __le16 beaconPeriod;
 668        __le16 dimPeriod;
 669        __le16 atimDuration;
 670        __le16 hopPeriod;
 671        __le16 channelSet;
 672        __le16 channel;
 673        __le16 hopsToBackbone;
 674        __le16 apTotalLoad;
 675        __le16 generatedLoad;
 676        __le16 accumulatedArl;
 677        __le16 signalQuality;
 678        __le16 currentXmitRate;
 679        __le16 apDevExtensions;
 680        __le16 normalizedSignalStrength;
 681        __le16 shortPreamble;
 682        u8 apIP[4];
 683        u8 noisePercent; /* Noise percent in last second */
 684        u8 noisedBm; /* Noise dBm in last second */
 685        u8 noiseAvePercent; /* Noise percent in last minute */
 686        u8 noiseAvedBm; /* Noise dBm in last minute */
 687        u8 noiseMaxPercent; /* Highest noise percent in last minute */
 688        u8 noiseMaxdBm; /* Highest noise dbm in last minute */
 689        __le16 load;
 690        u8 carrier[4];
 691        __le16 assocStatus;
 692#define STAT_NOPACKETS 0
 693#define STAT_NOCARRIERSET 10
 694#define STAT_GOTCARRIERSET 11
 695#define STAT_WRONGSSID 20
 696#define STAT_BADCHANNEL 25
 697#define STAT_BADBITRATES 30
 698#define STAT_BADPRIVACY 35
 699#define STAT_APFOUND 40
 700#define STAT_APREJECTED 50
 701#define STAT_AUTHENTICATING 60
 702#define STAT_DEAUTHENTICATED 61
 703#define STAT_AUTHTIMEOUT 62
 704#define STAT_ASSOCIATING 70
 705#define STAT_DEASSOCIATED 71
 706#define STAT_ASSOCTIMEOUT 72
 707#define STAT_NOTAIROAP 73
 708#define STAT_ASSOCIATED 80
 709#define STAT_LEAPING 90
 710#define STAT_LEAPFAILED 91
 711#define STAT_LEAPTIMEDOUT 92
 712#define STAT_LEAPCOMPLETE 93
 713} __attribute__ ((packed));
 714
 715typedef struct StatsRid StatsRid;
 716struct StatsRid {
 717        __le16 len;
 718        __le16 spacer;
 719        __le32 vals[100];
 720} __attribute__ ((packed));
 721
 722typedef struct APListRid APListRid;
 723struct APListRid {
 724        __le16 len;
 725        u8 ap[4][ETH_ALEN];
 726} __attribute__ ((packed));
 727
 728typedef struct CapabilityRid CapabilityRid;
 729struct CapabilityRid {
 730        __le16 len;
 731        char oui[3];
 732        char zero;
 733        __le16 prodNum;
 734        char manName[32];
 735        char prodName[16];
 736        char prodVer[8];
 737        char factoryAddr[ETH_ALEN];
 738        char aironetAddr[ETH_ALEN];
 739        __le16 radioType;
 740        __le16 country;
 741        char callid[ETH_ALEN];
 742        char supportedRates[8];
 743        char rxDiversity;
 744        char txDiversity;
 745        __le16 txPowerLevels[8];
 746        __le16 hardVer;
 747        __le16 hardCap;
 748        __le16 tempRange;
 749        __le16 softVer;
 750        __le16 softSubVer;
 751        __le16 interfaceVer;
 752        __le16 softCap;
 753        __le16 bootBlockVer;
 754        __le16 requiredHard;
 755        __le16 extSoftCap;
 756} __attribute__ ((packed));
 757
 758/* Only present on firmware >= 5.30.17 */
 759typedef struct BSSListRidExtra BSSListRidExtra;
 760struct BSSListRidExtra {
 761  __le16 unknown[4];
 762  u8 fixed[12]; /* WLAN management frame */
 763  u8 iep[624];
 764} __attribute__ ((packed));
 765
 766typedef struct BSSListRid BSSListRid;
 767struct BSSListRid {
 768  __le16 len;
 769  __le16 index; /* First is 0 and 0xffff means end of list */
 770#define RADIO_FH 1 /* Frequency hopping radio type */
 771#define RADIO_DS 2 /* Direct sequence radio type */
 772#define RADIO_TMA 4 /* Proprietary radio used in old cards (2500) */
 773  __le16 radioType;
 774  u8 bssid[ETH_ALEN]; /* Mac address of the BSS */
 775  u8 zero;
 776  u8 ssidLen;
 777  u8 ssid[32];
 778  __le16 dBm;
 779#define CAP_ESS cpu_to_le16(1<<0)
 780#define CAP_IBSS cpu_to_le16(1<<1)
 781#define CAP_PRIVACY cpu_to_le16(1<<4)
 782#define CAP_SHORTHDR cpu_to_le16(1<<5)
 783  __le16 cap;
 784  __le16 beaconInterval;
 785  u8 rates[8]; /* Same as rates for config rid */
 786  struct { /* For frequency hopping only */
 787    __le16 dwell;
 788    u8 hopSet;
 789    u8 hopPattern;
 790    u8 hopIndex;
 791    u8 fill;
 792  } fh;
 793  __le16 dsChannel;
 794  __le16 atimWindow;
 795
 796  /* Only present on firmware >= 5.30.17 */
 797  BSSListRidExtra extra;
 798} __attribute__ ((packed));
 799
 800typedef struct {
 801  BSSListRid bss;
 802  struct list_head list;
 803} BSSListElement;
 804
 805typedef struct tdsRssiEntry tdsRssiEntry;
 806struct tdsRssiEntry {
 807  u8 rssipct;
 808  u8 rssidBm;
 809} __attribute__ ((packed));
 810
 811typedef struct tdsRssiRid tdsRssiRid;
 812struct tdsRssiRid {
 813  u16 len;
 814  tdsRssiEntry x[256];
 815} __attribute__ ((packed));
 816
 817typedef struct MICRid MICRid;
 818struct MICRid {
 819        __le16 len;
 820        __le16 state;
 821        __le16 multicastValid;
 822        u8  multicast[16];
 823        __le16 unicastValid;
 824        u8  unicast[16];
 825} __attribute__ ((packed));
 826
 827typedef struct MICBuffer MICBuffer;
 828struct MICBuffer {
 829        __be16 typelen;
 830
 831        union {
 832            u8 snap[8];
 833            struct {
 834                u8 dsap;
 835                u8 ssap;
 836                u8 control;
 837                u8 orgcode[3];
 838                u8 fieldtype[2];
 839            } llc;
 840        } u;
 841        __be32 mic;
 842        __be32 seq;
 843} __attribute__ ((packed));
 844
 845typedef struct {
 846        u8 da[ETH_ALEN];
 847        u8 sa[ETH_ALEN];
 848} etherHead;
 849
 850#define TXCTL_TXOK (1<<1) /* report if tx is ok */
 851#define TXCTL_TXEX (1<<2) /* report if tx fails */
 852#define TXCTL_802_3 (0<<3) /* 802.3 packet */
 853#define TXCTL_802_11 (1<<3) /* 802.11 mac packet */
 854#define TXCTL_ETHERNET (0<<4) /* payload has ethertype */
 855#define TXCTL_LLC (1<<4) /* payload is llc */
 856#define TXCTL_RELEASE (0<<5) /* release after completion */
 857#define TXCTL_NORELEASE (1<<5) /* on completion returns to host */
 858
 859#define BUSY_FID 0x10000
 860
 861#ifdef CISCO_EXT
 862#define AIROMAGIC       0xa55a
 863/* Warning : SIOCDEVPRIVATE may disapear during 2.5.X - Jean II */
 864#ifdef SIOCIWFIRSTPRIV
 865#ifdef SIOCDEVPRIVATE
 866#define AIROOLDIOCTL    SIOCDEVPRIVATE
 867#define AIROOLDIDIFC    AIROOLDIOCTL + 1
 868#endif /* SIOCDEVPRIVATE */
 869#else /* SIOCIWFIRSTPRIV */
 870#define SIOCIWFIRSTPRIV SIOCDEVPRIVATE
 871#endif /* SIOCIWFIRSTPRIV */
 872/* This may be wrong. When using the new SIOCIWFIRSTPRIV range, we probably
 873 * should use only "GET" ioctls (last bit set to 1). "SET" ioctls are root
 874 * only and don't return the modified struct ifreq to the application which
 875 * is usually a problem. - Jean II */
 876#define AIROIOCTL       SIOCIWFIRSTPRIV
 877#define AIROIDIFC       AIROIOCTL + 1
 878
 879/* Ioctl constants to be used in airo_ioctl.command */
 880
 881#define AIROGCAP                0       // Capability rid
 882#define AIROGCFG                1       // USED A LOT
 883#define AIROGSLIST              2       // System ID list
 884#define AIROGVLIST              3       // List of specified AP's
 885#define AIROGDRVNAM             4       //  NOTUSED
 886#define AIROGEHTENC             5       // NOTUSED
 887#define AIROGWEPKTMP            6
 888#define AIROGWEPKNV             7
 889#define AIROGSTAT               8
 890#define AIROGSTATSC32           9
 891#define AIROGSTATSD32           10
 892#define AIROGMICRID             11
 893#define AIROGMICSTATS           12
 894#define AIROGFLAGS              13
 895#define AIROGID                 14
 896#define AIRORRID                15
 897#define AIRORSWVERSION          17
 898
 899/* Leave gap of 40 commands after AIROGSTATSD32 for future */
 900
 901#define AIROPCAP                AIROGSTATSD32 + 40
 902#define AIROPVLIST              AIROPCAP      + 1
 903#define AIROPSLIST              AIROPVLIST    + 1
 904#define AIROPCFG                AIROPSLIST    + 1
 905#define AIROPSIDS               AIROPCFG      + 1
 906#define AIROPAPLIST             AIROPSIDS     + 1
 907#define AIROPMACON              AIROPAPLIST   + 1       /* Enable mac  */
 908#define AIROPMACOFF             AIROPMACON    + 1       /* Disable mac */
 909#define AIROPSTCLR              AIROPMACOFF   + 1
 910#define AIROPWEPKEY             AIROPSTCLR    + 1
 911#define AIROPWEPKEYNV           AIROPWEPKEY   + 1
 912#define AIROPLEAPPWD            AIROPWEPKEYNV + 1
 913#define AIROPLEAPUSR            AIROPLEAPPWD  + 1
 914
 915/* Flash codes */
 916
 917#define AIROFLSHRST            AIROPWEPKEYNV  + 40
 918#define AIROFLSHGCHR           AIROFLSHRST    + 1
 919#define AIROFLSHSTFL           AIROFLSHGCHR   + 1
 920#define AIROFLSHPCHR           AIROFLSHSTFL   + 1
 921#define AIROFLPUTBUF           AIROFLSHPCHR   + 1
 922#define AIRORESTART            AIROFLPUTBUF   + 1
 923
 924#define FLASHSIZE       32768
 925#define AUXMEMSIZE      (256 * 1024)
 926
 927typedef struct aironet_ioctl {
 928        unsigned short command;         // What to do
 929        unsigned short len;             // Len of data
 930        unsigned short ridnum;          // rid number
 931        unsigned char __user *data;     // d-data
 932} aironet_ioctl;
 933
 934static char swversion[] = "2.1";
 935#endif /* CISCO_EXT */
 936
 937#define NUM_MODULES       2
 938#define MIC_MSGLEN_MAX    2400
 939#define EMMH32_MSGLEN_MAX MIC_MSGLEN_MAX
 940#define AIRO_DEF_MTU      2312
 941
 942typedef struct {
 943        u32   size;            // size
 944        u8    enabled;         // MIC enabled or not
 945        u32   rxSuccess;       // successful packets received
 946        u32   rxIncorrectMIC;  // pkts dropped due to incorrect MIC comparison
 947        u32   rxNotMICed;      // pkts dropped due to not being MIC'd
 948        u32   rxMICPlummed;    // pkts dropped due to not having a MIC plummed
 949        u32   rxWrongSequence; // pkts dropped due to sequence number violation
 950        u32   reserve[32];
 951} mic_statistics;
 952
 953typedef struct {
 954        u32 coeff[((EMMH32_MSGLEN_MAX)+3)>>2];
 955        u64 accum;      // accumulated mic, reduced to u32 in final()
 956        int position;   // current position (byte offset) in message
 957        union {
 958                u8  d8[4];
 959                __be32 d32;
 960        } part; // saves partial message word across update() calls
 961} emmh32_context;
 962
 963typedef struct {
 964        emmh32_context seed;        // Context - the seed
 965        u32              rx;        // Received sequence number
 966        u32              tx;        // Tx sequence number
 967        u32              window;    // Start of window
 968        u8               valid;     // Flag to say if context is valid or not
 969        u8               key[16];
 970} miccntx;
 971
 972typedef struct {
 973        miccntx mCtx;           // Multicast context
 974        miccntx uCtx;           // Unicast context
 975} mic_module;
 976
 977typedef struct {
 978        unsigned int  rid: 16;
 979        unsigned int  len: 15;
 980        unsigned int  valid: 1;
 981        dma_addr_t host_addr;
 982} Rid;
 983
 984typedef struct {
 985        unsigned int  offset: 15;
 986        unsigned int  eoc: 1;
 987        unsigned int  len: 15;
 988        unsigned int  valid: 1;
 989        dma_addr_t host_addr;
 990} TxFid;
 991
 992struct rx_hdr {
 993        __le16 status, len;
 994        u8 rssi[2];
 995        u8 rate;
 996        u8 freq;
 997        __le16 tmp[4];
 998} __attribute__ ((packed));
 999
1000typedef struct {
1001        unsigned int  ctl: 15;
1002        unsigned int  rdy: 1;
1003        unsigned int  len: 15;
1004        unsigned int  valid: 1;
1005        dma_addr_t host_addr;
1006} RxFid;
1007
1008/*
1009 * Host receive descriptor
1010 */
1011typedef struct {
1012        unsigned char __iomem *card_ram_off; /* offset into card memory of the
1013                                                desc */
1014        RxFid         rx_desc;               /* card receive descriptor */
1015        char          *virtual_host_addr;    /* virtual address of host receive
1016                                                buffer */
1017        int           pending;
1018} HostRxDesc;
1019
1020/*
1021 * Host transmit descriptor
1022 */
1023typedef struct {
1024        unsigned char __iomem *card_ram_off;         /* offset into card memory of the
1025                                                desc */
1026        TxFid         tx_desc;               /* card transmit descriptor */
1027        char          *virtual_host_addr;    /* virtual address of host receive
1028                                                buffer */
1029        int           pending;
1030} HostTxDesc;
1031
1032/*
1033 * Host RID descriptor
1034 */
1035typedef struct {
1036        unsigned char __iomem *card_ram_off;      /* offset into card memory of the
1037                                             descriptor */
1038        Rid           rid_desc;           /* card RID descriptor */
1039        char          *virtual_host_addr; /* virtual address of host receive
1040                                             buffer */
1041} HostRidDesc;
1042
1043typedef struct {
1044        u16 sw0;
1045        u16 sw1;
1046        u16 status;
1047        u16 len;
1048#define HOST_SET (1 << 0)
1049#define HOST_INT_TX (1 << 1) /* Interrupt on successful TX */
1050#define HOST_INT_TXERR (1 << 2) /* Interrupt on unseccessful TX */
1051#define HOST_LCC_PAYLOAD (1 << 4) /* LLC payload, 0 = Ethertype */
1052#define HOST_DONT_RLSE (1 << 5) /* Don't release buffer when done */
1053#define HOST_DONT_RETRY (1 << 6) /* Don't retry trasmit */
1054#define HOST_CLR_AID (1 << 7) /* clear AID failure */
1055#define HOST_RTS (1 << 9) /* Force RTS use */
1056#define HOST_SHORT (1 << 10) /* Do short preamble */
1057        u16 ctl;
1058        u16 aid;
1059        u16 retries;
1060        u16 fill;
1061} TxCtlHdr;
1062
1063typedef struct {
1064        u16 ctl;
1065        u16 duration;
1066        char addr1[6];
1067        char addr2[6];
1068        char addr3[6];
1069        u16 seq;
1070        char addr4[6];
1071} WifiHdr;
1072
1073
1074typedef struct {
1075        TxCtlHdr ctlhdr;
1076        u16 fill1;
1077        u16 fill2;
1078        WifiHdr wifihdr;
1079        u16 gaplen;
1080        u16 status;
1081} WifiCtlHdr;
1082
1083static WifiCtlHdr wifictlhdr8023 = {
1084        .ctlhdr = {
1085                .ctl    = HOST_DONT_RLSE,
1086        }
1087};
1088
1089// A few details needed for WEP (Wireless Equivalent Privacy)
1090#define MAX_KEY_SIZE 13                 // 128 (?) bits
1091#define MIN_KEY_SIZE  5                 // 40 bits RC4 - WEP
1092typedef struct wep_key_t {
1093        u16     len;
1094        u8      key[16];        /* 40-bit and 104-bit keys */
1095} wep_key_t;
1096
1097/* List of Wireless Handlers (new API) */
1098static const struct iw_handler_def      airo_handler_def;
1099
1100static const char version[] = "airo.c 0.6 (Ben Reed & Javier Achirica)";
1101
1102struct airo_info;
1103
1104static int get_dec_u16( char *buffer, int *start, int limit );
1105static void OUT4500( struct airo_info *, u16 register, u16 value );
1106static unsigned short IN4500( struct airo_info *, u16 register );
1107static u16 setup_card(struct airo_info*, u8 *mac, int lock);
1108static int enable_MAC(struct airo_info *ai, int lock);
1109static void disable_MAC(struct airo_info *ai, int lock);
1110static void enable_interrupts(struct airo_info*);
1111static void disable_interrupts(struct airo_info*);
1112static u16 issuecommand(struct airo_info*, Cmd *pCmd, Resp *pRsp);
1113static int bap_setup(struct airo_info*, u16 rid, u16 offset, int whichbap);
1114static int aux_bap_read(struct airo_info*, __le16 *pu16Dst, int bytelen,
1115                        int whichbap);
1116static int fast_bap_read(struct airo_info*, __le16 *pu16Dst, int bytelen,
1117                         int whichbap);
1118static int bap_write(struct airo_info*, const __le16 *pu16Src, int bytelen,
1119                     int whichbap);
1120static int PC4500_accessrid(struct airo_info*, u16 rid, u16 accmd);
1121static int PC4500_readrid(struct airo_info*, u16 rid, void *pBuf, int len, int lock);
1122static int PC4500_writerid(struct airo_info*, u16 rid, const void
1123                           *pBuf, int len, int lock);
1124static int do_writerid( struct airo_info*, u16 rid, const void *rid_data,
1125                        int len, int dummy );
1126static u16 transmit_allocate(struct airo_info*, int lenPayload, int raw);
1127static int transmit_802_3_packet(struct airo_info*, int len, char *pPacket);
1128static int transmit_802_11_packet(struct airo_info*, int len, char *pPacket);
1129
1130static int mpi_send_packet (struct net_device *dev);
1131static void mpi_unmap_card(struct pci_dev *pci);
1132static void mpi_receive_802_3(struct airo_info *ai);
1133static void mpi_receive_802_11(struct airo_info *ai);
1134static int waitbusy (struct airo_info *ai);
1135
1136static irqreturn_t airo_interrupt( int irq, void* dev_id);
1137static int airo_thread(void *data);
1138static void timer_func( struct net_device *dev );
1139static int airo_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
1140static struct iw_statistics *airo_get_wireless_stats (struct net_device *dev);
1141static void airo_read_wireless_stats (struct airo_info *local);
1142#ifdef CISCO_EXT
1143static int readrids(struct net_device *dev, aironet_ioctl *comp);
1144static int writerids(struct net_device *dev, aironet_ioctl *comp);
1145static int flashcard(struct net_device *dev, aironet_ioctl *comp);
1146#endif /* CISCO_EXT */
1147static void micinit(struct airo_info *ai);
1148static int micsetup(struct airo_info *ai);
1149static int encapsulate(struct airo_info *ai, etherHead *pPacket, MICBuffer *buffer, int len);
1150static int decapsulate(struct airo_info *ai, MICBuffer *mic, etherHead *pPacket, u16 payLen);
1151
1152static u8 airo_rssi_to_dbm (tdsRssiEntry *rssi_rid, u8 rssi);
1153static u8 airo_dbm_to_pct (tdsRssiEntry *rssi_rid, u8 dbm);
1154
1155static void airo_networks_free(struct airo_info *ai);
1156
1157struct airo_info {
1158        struct net_device             *dev;
1159        struct list_head              dev_list;
1160        /* Note, we can have MAX_FIDS outstanding.  FIDs are 16-bits, so we
1161           use the high bit to mark whether it is in use. */
1162#define MAX_FIDS 6
1163#define MPI_MAX_FIDS 1
1164        u32                           fids[MAX_FIDS];
1165        ConfigRid config;
1166        char keyindex; // Used with auto wep
1167        char defindex; // Used with auto wep
1168        struct proc_dir_entry *proc_entry;
1169        spinlock_t aux_lock;
1170#define FLAG_RADIO_OFF  0       /* User disabling of MAC */
1171#define FLAG_RADIO_DOWN 1       /* ifup/ifdown disabling of MAC */
1172#define FLAG_RADIO_MASK 0x03
1173#define FLAG_ENABLED    2
1174#define FLAG_ADHOC      3       /* Needed by MIC */
1175#define FLAG_MIC_CAPABLE 4
1176#define FLAG_UPDATE_MULTI 5
1177#define FLAG_UPDATE_UNI 6
1178#define FLAG_802_11     7
1179#define FLAG_PROMISC    8       /* IFF_PROMISC 0x100 - include/linux/if.h */
1180#define FLAG_PENDING_XMIT 9
1181#define FLAG_PENDING_XMIT11 10
1182#define FLAG_MPI        11
1183#define FLAG_REGISTERED 12
1184#define FLAG_COMMIT     13
1185#define FLAG_RESET      14
1186#define FLAG_FLASHING   15
1187#define FLAG_WPA_CAPABLE        16
1188        unsigned long flags;
1189#define JOB_DIE 0
1190#define JOB_XMIT        1
1191#define JOB_XMIT11      2
1192#define JOB_STATS       3
1193#define JOB_PROMISC     4
1194#define JOB_MIC 5
1195#define JOB_EVENT       6
1196#define JOB_AUTOWEP     7
1197#define JOB_WSTATS      8
1198#define JOB_SCAN_RESULTS  9
1199        unsigned long jobs;
1200        int (*bap_read)(struct airo_info*, __le16 *pu16Dst, int bytelen,
1201                        int whichbap);
1202        unsigned short *flash;
1203        tdsRssiEntry *rssi;
1204        struct task_struct *list_bss_task;
1205        struct task_struct *airo_thread_task;
1206        struct semaphore sem;
1207        wait_queue_head_t thr_wait;
1208        unsigned long expires;
1209        struct {
1210                struct sk_buff *skb;
1211                int fid;
1212        } xmit, xmit11;
1213        struct net_device *wifidev;
1214        struct iw_statistics    wstats;         // wireless stats
1215        unsigned long           scan_timeout;   /* Time scan should be read */
1216        struct iw_spy_data      spy_data;
1217        struct iw_public_data   wireless_data;
1218        /* MIC stuff */
1219        struct crypto_cipher    *tfm;
1220        mic_module              mod[2];
1221        mic_statistics          micstats;
1222        HostRxDesc rxfids[MPI_MAX_FIDS]; // rx/tx/config MPI350 descriptors
1223        HostTxDesc txfids[MPI_MAX_FIDS];
1224        HostRidDesc config_desc;
1225        unsigned long ridbus; // phys addr of config_desc
1226        struct sk_buff_head txq;// tx queue used by mpi350 code
1227        struct pci_dev          *pci;
1228        unsigned char           __iomem *pcimem;
1229        unsigned char           __iomem *pciaux;
1230        unsigned char           *shared;
1231        dma_addr_t              shared_dma;
1232        pm_message_t            power;
1233        SsidRid                 *SSID;
1234        APListRid               *APList;
1235#define PCI_SHARED_LEN          2*MPI_MAX_FIDS*PKTSIZE+RIDSIZE
1236        char                    proc_name[IFNAMSIZ];
1237
1238        int                     wep_capable;
1239        int                     max_wep_idx;
1240
1241        /* WPA-related stuff */
1242        unsigned int bssListFirst;
1243        unsigned int bssListNext;
1244        unsigned int bssListRidLen;
1245
1246        struct list_head network_list;
1247        struct list_head network_free_list;
1248        BSSListElement *networks;
1249};
1250
1251static inline int bap_read(struct airo_info *ai, __le16 *pu16Dst, int bytelen,
1252                           int whichbap)
1253{
1254        return ai->bap_read(ai, pu16Dst, bytelen, whichbap);
1255}
1256
1257static int setup_proc_entry( struct net_device *dev,
1258                             struct airo_info *apriv );
1259static int takedown_proc_entry( struct net_device *dev,
1260                                struct airo_info *apriv );
1261
1262static int cmdreset(struct airo_info *ai);
1263static int setflashmode (struct airo_info *ai);
1264static int flashgchar(struct airo_info *ai,int matchbyte,int dwelltime);
1265static int flashputbuf(struct airo_info *ai);
1266static int flashrestart(struct airo_info *ai,struct net_device *dev);
1267
1268#define airo_print(type, name, fmt, args...) \
1269        printk(type DRV_NAME "(%s): " fmt "\n", name, ##args)
1270
1271#define airo_print_info(name, fmt, args...) \
1272        airo_print(KERN_INFO, name, fmt, ##args)
1273
1274#define airo_print_dbg(name, fmt, args...) \
1275        airo_print(KERN_DEBUG, name, fmt, ##args)
1276
1277#define airo_print_warn(name, fmt, args...) \
1278        airo_print(KERN_WARNING, name, fmt, ##args)
1279
1280#define airo_print_err(name, fmt, args...) \
1281        airo_print(KERN_ERR, name, fmt, ##args)
1282
1283#define AIRO_FLASH(dev) (((struct airo_info *)dev->ml_priv)->flash)
1284
1285/***********************************************************************
1286 *                              MIC ROUTINES                           *
1287 ***********************************************************************
1288 */
1289
1290static int RxSeqValid (struct airo_info *ai,miccntx *context,int mcast,u32 micSeq);
1291static void MoveWindow(miccntx *context, u32 micSeq);
1292static void emmh32_setseed(emmh32_context *context, u8 *pkey, int keylen,
1293                           struct crypto_cipher *tfm);
1294static void emmh32_init(emmh32_context *context);
1295static void emmh32_update(emmh32_context *context, u8 *pOctets, int len);
1296static void emmh32_final(emmh32_context *context, u8 digest[4]);
1297static int flashpchar(struct airo_info *ai,int byte,int dwelltime);
1298
1299static void age_mic_context(miccntx *cur, miccntx *old, u8 *key, int key_len,
1300                            struct crypto_cipher *tfm)
1301{
1302        /* If the current MIC context is valid and its key is the same as
1303         * the MIC register, there's nothing to do.
1304         */
1305        if (cur->valid && (memcmp(cur->key, key, key_len) == 0))
1306                return;
1307
1308        /* Age current mic Context */
1309        memcpy(old, cur, sizeof(*cur));
1310
1311        /* Initialize new context */
1312        memcpy(cur->key, key, key_len);
1313        cur->window  = 33; /* Window always points to the middle */
1314        cur->rx      = 0;  /* Rx Sequence numbers */
1315        cur->tx      = 0;  /* Tx sequence numbers */
1316        cur->valid   = 1;  /* Key is now valid */
1317
1318        /* Give key to mic seed */
1319        emmh32_setseed(&cur->seed, key, key_len, tfm);
1320}
1321
1322/* micinit - Initialize mic seed */
1323
1324static void micinit(struct airo_info *ai)
1325{
1326        MICRid mic_rid;
1327
1328        clear_bit(JOB_MIC, &ai->jobs);
1329        PC4500_readrid(ai, RID_MIC, &mic_rid, sizeof(mic_rid), 0);
1330        up(&ai->sem);
1331
1332        ai->micstats.enabled = (le16_to_cpu(mic_rid.state) & 0x00FF) ? 1 : 0;
1333        if (!ai->micstats.enabled) {
1334                /* So next time we have a valid key and mic is enabled, we will
1335                 * update the sequence number if the key is the same as before.
1336                 */
1337                ai->mod[0].uCtx.valid = 0;
1338                ai->mod[0].mCtx.valid = 0;
1339                return;
1340        }
1341
1342        if (mic_rid.multicastValid) {
1343                age_mic_context(&ai->mod[0].mCtx, &ai->mod[1].mCtx,
1344                                mic_rid.multicast, sizeof(mic_rid.multicast),
1345                                ai->tfm);
1346        }
1347
1348        if (mic_rid.unicastValid) {
1349                age_mic_context(&ai->mod[0].uCtx, &ai->mod[1].uCtx,
1350                                mic_rid.unicast, sizeof(mic_rid.unicast),
1351                                ai->tfm);
1352        }
1353}
1354
1355/* micsetup - Get ready for business */
1356
1357static int micsetup(struct airo_info *ai) {
1358        int i;
1359
1360        if (ai->tfm == NULL)
1361                ai->tfm = crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC);
1362
1363        if (IS_ERR(ai->tfm)) {
1364                airo_print_err(ai->dev->name, "failed to load transform for AES");
1365                ai->tfm = NULL;
1366                return ERROR;
1367        }
1368
1369        for (i=0; i < NUM_MODULES; i++) {
1370                memset(&ai->mod[i].mCtx,0,sizeof(miccntx));
1371                memset(&ai->mod[i].uCtx,0,sizeof(miccntx));
1372        }
1373        return SUCCESS;
1374}
1375
1376static char micsnap[] = {0xAA,0xAA,0x03,0x00,0x40,0x96,0x00,0x02};
1377
1378/*===========================================================================
1379 * Description: Mic a packet
1380 *    
1381 *      Inputs: etherHead * pointer to an 802.3 frame
1382 *    
1383 *     Returns: BOOLEAN if successful, otherwise false.
1384 *             PacketTxLen will be updated with the mic'd packets size.
1385 *
1386 *    Caveats: It is assumed that the frame buffer will already
1387 *             be big enough to hold the largets mic message possible.
1388 *            (No memory allocation is done here).
1389 *  
1390 *    Author: sbraneky (10/15/01)
1391 *    Merciless hacks by rwilcher (1/14/02)
1392 */
1393
1394static int encapsulate(struct airo_info *ai ,etherHead *frame, MICBuffer *mic, int payLen)
1395{
1396        miccntx   *context;
1397
1398        // Determine correct context
1399        // If not adhoc, always use unicast key
1400
1401        if (test_bit(FLAG_ADHOC, &ai->flags) && (frame->da[0] & 0x1))
1402                context = &ai->mod[0].mCtx;
1403        else
1404                context = &ai->mod[0].uCtx;
1405  
1406        if (!context->valid)
1407                return ERROR;
1408
1409        mic->typelen = htons(payLen + 16); //Length of Mic'd packet
1410
1411        memcpy(&mic->u.snap, micsnap, sizeof(micsnap)); // Add Snap
1412
1413        // Add Tx sequence
1414        mic->seq = htonl(context->tx);
1415        context->tx += 2;
1416
1417        emmh32_init(&context->seed); // Mic the packet
1418        emmh32_update(&context->seed,frame->da,ETH_ALEN * 2); // DA,SA
1419        emmh32_update(&context->seed,(u8*)&mic->typelen,10); // Type/Length and Snap
1420        emmh32_update(&context->seed,(u8*)&mic->seq,sizeof(mic->seq)); //SEQ
1421        emmh32_update(&context->seed,frame->da + ETH_ALEN * 2,payLen); //payload
1422        emmh32_final(&context->seed, (u8*)&mic->mic);
1423
1424        /*    New Type/length ?????????? */
1425        mic->typelen = 0; //Let NIC know it could be an oversized packet
1426        return SUCCESS;
1427}
1428
1429typedef enum {
1430    NONE,
1431    NOMIC,
1432    NOMICPLUMMED,
1433    SEQUENCE,
1434    INCORRECTMIC,
1435} mic_error;
1436
1437/*===========================================================================
1438 *  Description: Decapsulates a MIC'd packet and returns the 802.3 packet
1439 *               (removes the MIC stuff) if packet is a valid packet.
1440 *      
1441 *       Inputs: etherHead  pointer to the 802.3 packet             
1442 *     
1443 *      Returns: BOOLEAN - TRUE if packet should be dropped otherwise FALSE
1444 *     
1445 *      Author: sbraneky (10/15/01)
1446 *    Merciless hacks by rwilcher (1/14/02)
1447 *---------------------------------------------------------------------------
1448 */
1449
1450static int decapsulate(struct airo_info *ai, MICBuffer *mic, etherHead *eth, u16 payLen)
1451{
1452        int      i;
1453        u32      micSEQ;
1454        miccntx  *context;
1455        u8       digest[4];
1456        mic_error micError = NONE;
1457
1458        // Check if the packet is a Mic'd packet
1459
1460        if (!ai->micstats.enabled) {
1461                //No Mic set or Mic OFF but we received a MIC'd packet.
1462                if (memcmp ((u8*)eth + 14, micsnap, sizeof(micsnap)) == 0) {
1463                        ai->micstats.rxMICPlummed++;
1464                        return ERROR;
1465                }
1466                return SUCCESS;
1467        }
1468
1469        if (ntohs(mic->typelen) == 0x888E)
1470                return SUCCESS;
1471
1472        if (memcmp (mic->u.snap, micsnap, sizeof(micsnap)) != 0) {
1473            // Mic enabled but packet isn't Mic'd
1474                ai->micstats.rxMICPlummed++;
1475                return ERROR;
1476        }
1477
1478        micSEQ = ntohl(mic->seq);            //store SEQ as CPU order
1479
1480        //At this point we a have a mic'd packet and mic is enabled
1481        //Now do the mic error checking.
1482
1483        //Receive seq must be odd
1484        if ( (micSEQ & 1) == 0 ) {
1485                ai->micstats.rxWrongSequence++;
1486                return ERROR;
1487        }
1488
1489        for (i = 0; i < NUM_MODULES; i++) {
1490                int mcast = eth->da[0] & 1;
1491                //Determine proper context 
1492                context = mcast ? &ai->mod[i].mCtx : &ai->mod[i].uCtx;
1493        
1494                //Make sure context is valid
1495                if (!context->valid) {
1496                        if (i == 0)
1497                                micError = NOMICPLUMMED;
1498                        continue;                
1499                }
1500                //DeMic it 
1501
1502                if (!mic->typelen)
1503                        mic->typelen = htons(payLen + sizeof(MICBuffer) - 2);
1504        
1505                emmh32_init(&context->seed);
1506                emmh32_update(&context->seed, eth->da, ETH_ALEN*2); 
1507                emmh32_update(&context->seed, (u8 *)&mic->typelen, sizeof(mic->typelen)+sizeof(mic->u.snap)); 
1508                emmh32_update(&context->seed, (u8 *)&mic->seq,sizeof(mic->seq));        
1509                emmh32_update(&context->seed, eth->da + ETH_ALEN*2,payLen);     
1510                //Calculate MIC
1511                emmh32_final(&context->seed, digest);
1512        
1513                if (memcmp(digest, &mic->mic, 4)) { //Make sure the mics match
1514                  //Invalid Mic
1515                        if (i == 0)
1516                                micError = INCORRECTMIC;
1517                        continue;
1518                }
1519
1520                //Check Sequence number if mics pass
1521                if (RxSeqValid(ai, context, mcast, micSEQ) == SUCCESS) {
1522                        ai->micstats.rxSuccess++;
1523                        return SUCCESS;
1524                }
1525                if (i == 0)
1526                        micError = SEQUENCE;
1527        }
1528
1529        // Update statistics
1530        switch (micError) {
1531                case NOMICPLUMMED: ai->micstats.rxMICPlummed++;   break;
1532                case SEQUENCE:    ai->micstats.rxWrongSequence++; break;
1533                case INCORRECTMIC: ai->micstats.rxIncorrectMIC++; break;
1534                case NONE:  break;
1535                case NOMIC: break;
1536        }
1537        return ERROR;
1538}
1539
1540/*===========================================================================
1541 * Description:  Checks the Rx Seq number to make sure it is valid
1542 *               and hasn't already been received
1543 *   
1544 *     Inputs: miccntx - mic context to check seq against
1545 *             micSeq  - the Mic seq number
1546 *   
1547 *    Returns: TRUE if valid otherwise FALSE. 
1548 *
1549 *    Author: sbraneky (10/15/01)
1550 *    Merciless hacks by rwilcher (1/14/02)
1551 *---------------------------------------------------------------------------
1552 */
1553
1554static int RxSeqValid (struct airo_info *ai,miccntx *context,int mcast,u32 micSeq)
1555{
1556        u32 seq,index;
1557
1558        //Allow for the ap being rebooted - if it is then use the next 
1559        //sequence number of the current sequence number - might go backwards
1560
1561        if (mcast) {
1562                if (test_bit(FLAG_UPDATE_MULTI, &ai->flags)) {
1563                        clear_bit (FLAG_UPDATE_MULTI, &ai->flags);
1564                        context->window = (micSeq > 33) ? micSeq : 33;
1565                        context->rx     = 0;        // Reset rx
1566                }
1567        } else if (test_bit(FLAG_UPDATE_UNI, &ai->flags)) {
1568                clear_bit (FLAG_UPDATE_UNI, &ai->flags);
1569                context->window = (micSeq > 33) ? micSeq : 33; // Move window
1570                context->rx     = 0;        // Reset rx
1571        }
1572
1573        //Make sequence number relative to START of window
1574        seq = micSeq - (context->window - 33);
1575
1576        //Too old of a SEQ number to check.
1577        if ((s32)seq < 0)
1578                return ERROR;
1579    
1580        if ( seq > 64 ) {
1581                //Window is infinite forward
1582                MoveWindow(context,micSeq);
1583                return SUCCESS;
1584        }
1585
1586        // We are in the window. Now check the context rx bit to see if it was already sent
1587        seq >>= 1;         //divide by 2 because we only have odd numbers
1588        index = 1 << seq;  //Get an index number
1589
1590        if (!(context->rx & index)) {
1591                //micSEQ falls inside the window.
1592                //Add seqence number to the list of received numbers.
1593                context->rx |= index;
1594
1595                MoveWindow(context,micSeq);
1596
1597                return SUCCESS;
1598        }
1599        return ERROR;
1600}
1601
1602static void MoveWindow(miccntx *context, u32 micSeq)
1603{
1604        u32 shift;
1605
1606        //Move window if seq greater than the middle of the window
1607        if (micSeq > context->window) {
1608                shift = (micSeq - context->window) >> 1;
1609    
1610                    //Shift out old
1611                if (shift < 32)
1612                        context->rx >>= shift;
1613                else
1614                        context->rx = 0;
1615
1616                context->window = micSeq;      //Move window
1617        }
1618}
1619
1620/*==============================================*/
1621/*========== EMMH ROUTINES  ====================*/
1622/*==============================================*/
1623
1624/* mic accumulate */
1625#define MIC_ACCUM(val)  \
1626        context->accum += (u64)(val) * context->coeff[coeff_position++];
1627
1628static unsigned char aes_counter[16];
1629
1630/* expand the key to fill the MMH coefficient array */
1631static void emmh32_setseed(emmh32_context *context, u8 *pkey, int keylen,
1632                           struct crypto_cipher *tfm)
1633{
1634  /* take the keying material, expand if necessary, truncate at 16-bytes */
1635  /* run through AES counter mode to generate context->coeff[] */
1636  
1637        int i,j;
1638        u32 counter;
1639        u8 *cipher, plain[16];
1640
1641        crypto_cipher_setkey(tfm, pkey, 16);
1642        counter = 0;
1643        for (i = 0; i < ARRAY_SIZE(context->coeff); ) {
1644                aes_counter[15] = (u8)(counter >> 0);
1645                aes_counter[14] = (u8)(counter >> 8);
1646                aes_counter[13] = (u8)(counter >> 16);
1647                aes_counter[12] = (u8)(counter >> 24);
1648                counter++;
1649                memcpy (plain, aes_counter, 16);
1650                crypto_cipher_encrypt_one(tfm, plain, plain);
1651                cipher = plain;
1652                for (j = 0; (j < 16) && (i < ARRAY_SIZE(context->coeff)); ) {
1653                        context->coeff[i++] = ntohl(*(__be32 *)&cipher[j]);
1654                        j += 4;
1655                }
1656        }
1657}
1658
1659/* prepare for calculation of a new mic */
1660static void emmh32_init(emmh32_context *context)
1661{
1662        /* prepare for new mic calculation */
1663        context->accum = 0;
1664        context->position = 0;
1665}
1666
1667/* add some bytes to the mic calculation */
1668static void emmh32_update(emmh32_context *context, u8 *pOctets, int len)
1669{
1670        int     coeff_position, byte_position;
1671  
1672        if (len == 0) return;
1673  
1674        coeff_position = context->position >> 2;
1675  
1676        /* deal with partial 32-bit word left over from last update */
1677        byte_position = context->position & 3;
1678        if (byte_position) {
1679                /* have a partial word in part to deal with */
1680                do {
1681                        if (len == 0) return;
1682                        context->part.d8[byte_position++] = *pOctets++;
1683                        context->position++;
1684                        len--;
1685                } while (byte_position < 4);
1686                MIC_ACCUM(ntohl(context->part.d32));
1687        }
1688
1689        /* deal with full 32-bit words */
1690        while (len >= 4) {
1691                MIC_ACCUM(ntohl(*(__be32 *)pOctets));
1692                context->position += 4;
1693                pOctets += 4;
1694                len -= 4;
1695        }
1696
1697        /* deal with partial 32-bit word that will be left over from this update */
1698        byte_position = 0;
1699        while (len > 0) {
1700                context->part.d8[byte_position++] = *pOctets++;
1701                context->position++;
1702                len--;
1703        }
1704}
1705
1706/* mask used to zero empty bytes for final partial word */
1707static u32 mask32[4] = { 0x00000000L, 0xFF000000L, 0xFFFF0000L, 0xFFFFFF00L };
1708
1709/* calculate the mic */
1710static void emmh32_final(emmh32_context *context, u8 digest[4])
1711{
1712        int     coeff_position, byte_position;
1713        u32     val;
1714  
1715        u64 sum, utmp;
1716        s64 stmp;
1717
1718        coeff_position = context->position >> 2;
1719  
1720        /* deal with partial 32-bit word left over from last update */
1721        byte_position = context->position & 3;
1722        if (byte_position) {
1723                /* have a partial word in part to deal with */
1724                val = ntohl(context->part.d32);
1725                MIC_ACCUM(val & mask32[byte_position]); /* zero empty bytes */
1726        }
1727
1728        /* reduce the accumulated u64 to a 32-bit MIC */
1729        sum = context->accum;
1730        stmp = (sum  & 0xffffffffLL) - ((sum >> 32)  * 15);
1731        utmp = (stmp & 0xffffffffLL) - ((stmp >> 32) * 15);
1732        sum = utmp & 0xffffffffLL;
1733        if (utmp > 0x10000000fLL)
1734                sum -= 15;
1735
1736        val = (u32)sum;
1737        digest[0] = (val>>24) & 0xFF;
1738        digest[1] = (val>>16) & 0xFF;
1739        digest[2] = (val>>8) & 0xFF;
1740        digest[3] = val & 0xFF;
1741}
1742
1743static int readBSSListRid(struct airo_info *ai, int first,
1744                      BSSListRid *list)
1745{
1746        Cmd cmd;
1747        Resp rsp;
1748
1749        if (first == 1) {
1750                if (ai->flags & FLAG_RADIO_MASK) return -ENETDOWN;
1751                memset(&cmd, 0, sizeof(cmd));
1752                cmd.cmd=CMD_LISTBSS;
1753                if (down_interruptible(&ai->sem))
1754                        return -ERESTARTSYS;
1755                ai->list_bss_task = current;
1756                issuecommand(ai, &cmd, &rsp);
1757                up(&ai->sem);
1758                /* Let the command take effect */
1759                schedule_timeout_uninterruptible(3 * HZ);
1760                ai->list_bss_task = NULL;
1761        }
1762        return PC4500_readrid(ai, first ? ai->bssListFirst : ai->bssListNext,
1763                            list, ai->bssListRidLen, 1);
1764}
1765
1766static int readWepKeyRid(struct airo_info *ai, WepKeyRid *wkr, int temp, int lock)
1767{
1768        return PC4500_readrid(ai, temp ? RID_WEP_TEMP : RID_WEP_PERM,
1769                                wkr, sizeof(*wkr), lock);
1770}
1771
1772static int writeWepKeyRid(struct airo_info *ai, WepKeyRid *wkr, int perm, int lock)
1773{
1774        int rc;
1775        rc = PC4500_writerid(ai, RID_WEP_TEMP, wkr, sizeof(*wkr), lock);
1776        if (rc!=SUCCESS)
1777                airo_print_err(ai->dev->name, "WEP_TEMP set %x", rc);
1778        if (perm) {
1779                rc = PC4500_writerid(ai, RID_WEP_PERM, wkr, sizeof(*wkr), lock);
1780                if (rc!=SUCCESS)
1781                        airo_print_err(ai->dev->name, "WEP_PERM set %x", rc);
1782        }
1783        return rc;
1784}
1785
1786static int readSsidRid(struct airo_info*ai, SsidRid *ssidr)
1787{
1788        return PC4500_readrid(ai, RID_SSID, ssidr, sizeof(*ssidr), 1);
1789}
1790
1791static int writeSsidRid(struct airo_info*ai, SsidRid *pssidr, int lock)
1792{
1793        return PC4500_writerid(ai, RID_SSID, pssidr, sizeof(*pssidr), lock);
1794}
1795
1796static int readConfigRid(struct airo_info *ai, int lock)
1797{
1798        int rc;
1799        ConfigRid cfg;
1800
1801        if (ai->config.len)
1802                return SUCCESS;
1803
1804        rc = PC4500_readrid(ai, RID_ACTUALCONFIG, &cfg, sizeof(cfg), lock);
1805        if (rc != SUCCESS)
1806                return rc;
1807
1808        ai->config = cfg;
1809        return SUCCESS;
1810}
1811
1812static inline void checkThrottle(struct airo_info *ai)
1813{
1814        int i;
1815/* Old hardware had a limit on encryption speed */
1816        if (ai->config.authType != AUTH_OPEN && maxencrypt) {
1817                for(i=0; i<8; i++) {
1818                        if (ai->config.rates[i] > maxencrypt) {
1819                                ai->config.rates[i] = 0;
1820                        }
1821                }
1822        }
1823}
1824
1825static int writeConfigRid(struct airo_info *ai, int lock)
1826{
1827        ConfigRid cfgr;
1828
1829        if (!test_bit (FLAG_COMMIT, &ai->flags))
1830                return SUCCESS;
1831
1832        clear_bit (FLAG_COMMIT, &ai->flags);
1833        clear_bit (FLAG_RESET, &ai->flags);
1834        checkThrottle(ai);
1835        cfgr = ai->config;
1836
1837        if ((cfgr.opmode & MODE_CFG_MASK) == MODE_STA_IBSS)
1838                set_bit(FLAG_ADHOC, &ai->flags);
1839        else
1840                clear_bit(FLAG_ADHOC, &ai->flags);
1841
1842        return PC4500_writerid( ai, RID_CONFIG, &cfgr, sizeof(cfgr), lock);
1843}
1844
1845static int readStatusRid(struct airo_info *ai, StatusRid *statr, int lock)
1846{
1847        return PC4500_readrid(ai, RID_STATUS, statr, sizeof(*statr), lock);
1848}
1849
1850static int readAPListRid(struct airo_info *ai, APListRid *aplr)
1851{
1852        return PC4500_readrid(ai, RID_APLIST, aplr, sizeof(*aplr), 1);
1853}
1854
1855static int writeAPListRid(struct airo_info *ai, APListRid *aplr, int lock)
1856{
1857        return PC4500_writerid(ai, RID_APLIST, aplr, sizeof(*aplr), lock);
1858}
1859
1860static int readCapabilityRid(struct airo_info *ai, CapabilityRid *capr, int lock)
1861{
1862        return PC4500_readrid(ai, RID_CAPABILITIES, capr, sizeof(*capr), lock);
1863}
1864
1865static int readStatsRid(struct airo_info*ai, StatsRid *sr, int rid, int lock)
1866{
1867        return PC4500_readrid(ai, rid, sr, sizeof(*sr), lock);
1868}
1869
1870static void try_auto_wep(struct airo_info *ai)
1871{
1872        if (auto_wep && !(ai->flags & FLAG_RADIO_DOWN)) {
1873                ai->expires = RUN_AT(3*HZ);
1874                wake_up_interruptible(&ai->thr_wait);
1875        }
1876}
1877
1878static int airo_open(struct net_device *dev) {
1879        struct airo_info *ai = dev->ml_priv;
1880        int rc = 0;
1881
1882        if (test_bit(FLAG_FLASHING, &ai->flags))
1883                return -EIO;
1884
1885        /* Make sure the card is configured.
1886         * Wireless Extensions may postpone config changes until the card
1887         * is open (to pipeline changes and speed-up card setup). If
1888         * those changes are not yet commited, do it now - Jean II */
1889        if (test_bit(FLAG_COMMIT, &ai->flags)) {
1890                disable_MAC(ai, 1);
1891                writeConfigRid(ai, 1);
1892        }
1893
1894        if (ai->wifidev != dev) {
1895                clear_bit(JOB_DIE, &ai->jobs);
1896                ai->airo_thread_task = kthread_run(airo_thread, dev, dev->name);
1897                if (IS_ERR(ai->airo_thread_task))
1898                        return (int)PTR_ERR(ai->airo_thread_task);
1899
1900                rc = request_irq(dev->irq, airo_interrupt, IRQF_SHARED,
1901                        dev->name, dev);
1902                if (rc) {
1903                        airo_print_err(dev->name,
1904                                "register interrupt %d failed, rc %d",
1905                                dev->irq, rc);
1906                        set_bit(JOB_DIE, &ai->jobs);
1907                        kthread_stop(ai->airo_thread_task);
1908                        return rc;
1909                }
1910
1911                /* Power on the MAC controller (which may have been disabled) */
1912                clear_bit(FLAG_RADIO_DOWN, &ai->flags);
1913                enable_interrupts(ai);
1914
1915                try_auto_wep(ai);
1916        }
1917        enable_MAC(ai, 1);
1918
1919        netif_start_queue(dev);
1920        return 0;
1921}
1922
1923static netdev_tx_t mpi_start_xmit(struct sk_buff *skb,
1924                                        struct net_device *dev)
1925{
1926        int npacks, pending;
1927        unsigned long flags;
1928        struct airo_info *ai = dev->ml_priv;
1929
1930        if (!skb) {
1931                airo_print_err(dev->name, "%s: skb == NULL!",__func__);
1932                return NETDEV_TX_OK;
1933        }
1934        npacks = skb_queue_len (&ai->txq);
1935
1936        if (npacks >= MAXTXQ - 1) {
1937                netif_stop_queue (dev);
1938                if (npacks > MAXTXQ) {
1939                        dev->stats.tx_fifo_errors++;
1940                        return NETDEV_TX_BUSY;
1941                }
1942                skb_queue_tail (&ai->txq, skb);
1943                return NETDEV_TX_OK;
1944        }
1945
1946        spin_lock_irqsave(&ai->aux_lock, flags);
1947        skb_queue_tail (&ai->txq, skb);
1948        pending = test_bit(FLAG_PENDING_XMIT, &ai->flags);
1949        spin_unlock_irqrestore(&ai->aux_lock,flags);
1950        netif_wake_queue (dev);
1951
1952        if (pending == 0) {
1953                set_bit(FLAG_PENDING_XMIT, &ai->flags);
1954                mpi_send_packet (dev);
1955        }
1956        return NETDEV_TX_OK;
1957}
1958
1959/*
1960 * @mpi_send_packet
1961 *
1962 * Attempt to transmit a packet. Can be called from interrupt
1963 * or transmit . return number of packets we tried to send
1964 */
1965
1966static int mpi_send_packet (struct net_device *dev)
1967{
1968        struct sk_buff *skb;
1969        unsigned char *buffer;
1970        s16 len;
1971        __le16 *payloadLen;
1972        struct airo_info *ai = dev->ml_priv;
1973        u8 *sendbuf;
1974
1975        /* get a packet to send */
1976
1977        if ((skb = skb_dequeue(&ai->txq)) == NULL) {
1978                airo_print_err(dev->name,
1979                        "%s: Dequeue'd zero in send_packet()",
1980                        __func__);
1981                return 0;
1982        }
1983
1984        /* check min length*/
1985        len = ETH_ZLEN < skb->len ? skb->len : ETH_ZLEN;
1986        buffer = skb->data;
1987
1988        ai->txfids[0].tx_desc.offset = 0;
1989        ai->txfids[0].tx_desc.valid = 1;
1990        ai->txfids[0].tx_desc.eoc = 1;
1991        ai->txfids[0].tx_desc.len =len+sizeof(WifiHdr);
1992
1993/*
1994 * Magic, the cards firmware needs a length count (2 bytes) in the host buffer
1995 * right after  TXFID_HDR.The TXFID_HDR contains the status short so payloadlen
1996 * is immediatly after it. ------------------------------------------------
1997 *                         |TXFIDHDR+STATUS|PAYLOADLEN|802.3HDR|PACKETDATA|
1998 *                         ------------------------------------------------
1999 */
2000
2001        memcpy((char *)ai->txfids[0].virtual_host_addr,
2002                (char *)&wifictlhdr8023, sizeof(wifictlhdr8023));
2003
2004        payloadLen = (__le16 *)(ai->txfids[0].virtual_host_addr +
2005                sizeof(wifictlhdr8023));
2006        sendbuf = ai->txfids[0].virtual_host_addr +
2007                sizeof(wifictlhdr8023) + 2 ;
2008
2009        /*
2010         * Firmware automaticly puts 802 header on so
2011         * we don't need to account for it in the length
2012         */
2013        if (test_bit(FLAG_MIC_CAPABLE, &ai->flags) && ai->micstats.enabled &&
2014                (ntohs(((__be16 *)buffer)[6]) != 0x888E)) {
2015                MICBuffer pMic;
2016
2017                if (encapsulate(ai, (etherHead *)buffer, &pMic, len - sizeof(etherHead)) != SUCCESS)
2018                        return ERROR;
2019
2020                *payloadLen = cpu_to_le16(len-sizeof(etherHead)+sizeof(pMic));
2021                ai->txfids[0].tx_desc.len += sizeof(pMic);
2022                /* copy data into airo dma buffer */
2023                memcpy (sendbuf, buffer, sizeof(etherHead));
2024                buffer += sizeof(etherHead);
2025                sendbuf += sizeof(etherHead);
2026                memcpy (sendbuf, &pMic, sizeof(pMic));
2027                sendbuf += sizeof(pMic);
2028                memcpy (sendbuf, buffer, len - sizeof(etherHead));
2029        } else {
2030                *payloadLen = cpu_to_le16(len - sizeof(etherHead));
2031
2032                dev->trans_start = jiffies;
2033
2034                /* copy data into airo dma buffer */
2035                memcpy(sendbuf, buffer, len);
2036        }
2037
2038        memcpy_toio(ai->txfids[0].card_ram_off,
2039                &ai->txfids[0].tx_desc, sizeof(TxFid));
2040
2041        OUT4500(ai, EVACK, 8);
2042
2043        dev_kfree_skb_any(skb);
2044        return 1;
2045}
2046
2047static void get_tx_error(struct airo_info *ai, s32 fid)
2048{
2049        __le16 status;
2050
2051        if (fid < 0)
2052                status = ((WifiCtlHdr *)ai->txfids[0].virtual_host_addr)->ctlhdr.status;
2053        else {
2054                if (bap_setup(ai, ai->fids[fid] & 0xffff, 4, BAP0) != SUCCESS)
2055                        return;
2056                bap_read(ai, &status, 2, BAP0);
2057        }
2058        if (le16_to_cpu(status) & 2) /* Too many retries */
2059                ai->dev->stats.tx_aborted_errors++;
2060        if (le16_to_cpu(status) & 4) /* Transmit lifetime exceeded */
2061                ai->dev->stats.tx_heartbeat_errors++;
2062        if (le16_to_cpu(status) & 8) /* Aid fail */
2063                { }
2064        if (le16_to_cpu(status) & 0x10) /* MAC disabled */
2065                ai->dev->stats.tx_carrier_errors++;
2066        if (le16_to_cpu(status) & 0x20) /* Association lost */
2067                { }
2068        /* We produce a TXDROP event only for retry or lifetime
2069         * exceeded, because that's the only status that really mean
2070         * that this particular node went away.
2071         * Other errors means that *we* screwed up. - Jean II */
2072        if ((le16_to_cpu(status) & 2) ||
2073             (le16_to_cpu(status) & 4)) {
2074                union iwreq_data        wrqu;
2075                char junk[0x18];
2076
2077                /* Faster to skip over useless data than to do
2078                 * another bap_setup(). We are at offset 0x6 and
2079                 * need to go to 0x18 and read 6 bytes - Jean II */
2080                bap_read(ai, (__le16 *) junk, 0x18, BAP0);
2081
2082                /* Copy 802.11 dest address.
2083                 * We use the 802.11 header because the frame may
2084                 * not be 802.3 or may be mangled...
2085                 * In Ad-Hoc mode, it will be the node address.
2086                 * In managed mode, it will be most likely the AP addr
2087                 * User space will figure out how to convert it to
2088                 * whatever it needs (IP address or else).
2089                 * - Jean II */
2090                memcpy(wrqu.addr.sa_data, junk + 0x12, ETH_ALEN);
2091                wrqu.addr.sa_family = ARPHRD_ETHER;
2092
2093                /* Send event to user space */
2094                wireless_send_event(ai->dev, IWEVTXDROP, &wrqu, NULL);
2095        }
2096}
2097
2098static void airo_end_xmit(struct net_device *dev) {
2099        u16 status;
2100        int i;
2101        struct airo_info *priv = dev->ml_priv;
2102        struct sk_buff *skb = priv->xmit.skb;
2103        int fid = priv->xmit.fid;
2104        u32 *fids = priv->fids;
2105
2106        clear_bit(JOB_XMIT, &priv->jobs);
2107        clear_bit(FLAG_PENDING_XMIT, &priv->flags);
2108        status = transmit_802_3_packet (priv, fids[fid], skb->data);
2109        up(&priv->sem);
2110
2111        i = 0;
2112        if ( status == SUCCESS ) {
2113                dev->trans_start = jiffies;
2114                for (; i < MAX_FIDS / 2 && (priv->fids[i] & 0xffff0000); i++);
2115        } else {
2116                priv->fids[fid] &= 0xffff;
2117                dev->stats.tx_window_errors++;
2118        }
2119        if (i < MAX_FIDS / 2)
2120                netif_wake_queue(dev);
2121        dev_kfree_skb(skb);
2122}
2123
2124static netdev_tx_t airo_start_xmit(struct sk_buff *skb,
2125                                         struct net_device *dev)
2126{
2127        s16 len;
2128        int i, j;
2129        struct airo_info *priv = dev->ml_priv;
2130        u32 *fids = priv->fids;
2131
2132        if ( skb == NULL ) {
2133                airo_print_err(dev->name, "%s: skb == NULL!", __func__);
2134                return NETDEV_TX_OK;
2135        }
2136
2137        /* Find a vacant FID */
2138        for( i = 0; i < MAX_FIDS / 2 && (fids[i] & 0xffff0000); i++ );
2139        for( j = i + 1; j < MAX_FIDS / 2 && (fids[j] & 0xffff0000); j++ );
2140
2141        if ( j >= MAX_FIDS / 2 ) {
2142                netif_stop_queue(dev);
2143
2144                if (i == MAX_FIDS / 2) {
2145                        dev->stats.tx_fifo_errors++;
2146                        return NETDEV_TX_BUSY;
2147                }
2148        }
2149        /* check min length*/
2150        len = ETH_ZLEN < skb->len ? skb->len : ETH_ZLEN;
2151        /* Mark fid as used & save length for later */
2152        fids[i] |= (len << 16);
2153        priv->xmit.skb = skb;
2154        priv->xmit.fid = i;
2155        if (down_trylock(&priv->sem) != 0) {
2156                set_bit(FLAG_PENDING_XMIT, &priv->flags);
2157                netif_stop_queue(dev);
2158                set_bit(JOB_XMIT, &priv->jobs);
2159                wake_up_interruptible(&priv->thr_wait);
2160        } else
2161                airo_end_xmit(dev);
2162        return NETDEV_TX_OK;
2163}
2164
2165static void airo_end_xmit11(struct net_device *dev) {
2166        u16 status;
2167        int i;
2168        struct airo_info *priv = dev->ml_priv;
2169        struct sk_buff *skb = priv->xmit11.skb;
2170        int fid = priv->xmit11.fid;
2171        u32 *fids = priv->fids;
2172
2173        clear_bit(JOB_XMIT11, &priv->jobs);
2174        clear_bit(FLAG_PENDING_XMIT11, &priv->flags);
2175        status = transmit_802_11_packet (priv, fids[fid], skb->data);
2176        up(&priv->sem);
2177
2178        i = MAX_FIDS / 2;
2179        if ( status == SUCCESS ) {
2180                dev->trans_start = jiffies;
2181                for (; i < MAX_FIDS && (priv->fids[i] & 0xffff0000); i++);
2182        } else {
2183                priv->fids[fid] &= 0xffff;
2184                dev->stats.tx_window_errors++;
2185        }
2186        if (i < MAX_FIDS)
2187                netif_wake_queue(dev);
2188        dev_kfree_skb(skb);
2189}
2190
2191static netdev_tx_t airo_start_xmit11(struct sk_buff *skb,
2192                                           struct net_device *dev)
2193{
2194        s16 len;
2195        int i, j;
2196        struct airo_info *priv = dev->ml_priv;
2197        u32 *fids = priv->fids;
2198
2199        if (test_bit(FLAG_MPI, &priv->flags)) {
2200                /* Not implemented yet for MPI350 */
2201                netif_stop_queue(dev);
2202                dev_kfree_skb_any(skb);
2203                return NETDEV_TX_OK;
2204        }
2205
2206        if ( skb == NULL ) {
2207                airo_print_err(dev->name, "%s: skb == NULL!", __func__);
2208                return NETDEV_TX_OK;
2209        }
2210
2211        /* Find a vacant FID */
2212        for( i = MAX_FIDS / 2; i < MAX_FIDS && (fids[i] & 0xffff0000); i++ );
2213        for( j = i + 1; j < MAX_FIDS && (fids[j] & 0xffff0000); j++ );
2214
2215        if ( j >= MAX_FIDS ) {
2216                netif_stop_queue(dev);
2217
2218                if (i == MAX_FIDS) {
2219                        dev->stats.tx_fifo_errors++;
2220                        return NETDEV_TX_BUSY;
2221                }
2222        }
2223        /* check min length*/
2224        len = ETH_ZLEN < skb->len ? skb->len : ETH_ZLEN;
2225        /* Mark fid as used & save length for later */
2226        fids[i] |= (len << 16);
2227        priv->xmit11.skb = skb;
2228        priv->xmit11.fid = i;
2229        if (down_trylock(&priv->sem) != 0) {
2230                set_bit(FLAG_PENDING_XMIT11, &priv->flags);
2231                netif_stop_queue(dev);
2232                set_bit(JOB_XMIT11, &priv->jobs);
2233                wake_up_interruptible(&priv->thr_wait);
2234        } else
2235                airo_end_xmit11(dev);
2236        return NETDEV_TX_OK;
2237}
2238
2239static void airo_read_stats(struct net_device *dev)
2240{
2241        struct airo_info *ai = dev->ml_priv;
2242        StatsRid stats_rid;
2243        __le32 *vals = stats_rid.vals;
2244
2245        clear_bit(JOB_STATS, &ai->jobs);
2246        if (ai->power.event) {
2247                up(&ai->sem);
2248                return;
2249        }
2250        readStatsRid(ai, &stats_rid, RID_STATS, 0);
2251        up(&ai->sem);
2252
2253        dev->stats.rx_packets = le32_to_cpu(vals[43]) + le32_to_cpu(vals[44]) +
2254                               le32_to_cpu(vals[45]);
2255        dev->stats.tx_packets = le32_to_cpu(vals[39]) + le32_to_cpu(vals[40]) +
2256                               le32_to_cpu(vals[41]);
2257        dev->stats.rx_bytes = le32_to_cpu(vals[92]);
2258        dev->stats.tx_bytes = le32_to_cpu(vals[91]);
2259        dev->stats.rx_errors = le32_to_cpu(vals[0]) + le32_to_cpu(vals[2]) +
2260                              le32_to_cpu(vals[3]) + le32_to_cpu(vals[4]);
2261        dev->stats.tx_errors = le32_to_cpu(vals[42]) +
2262                              dev->stats.tx_fifo_errors;
2263        dev->stats.multicast = le32_to_cpu(vals[43]);
2264        dev->stats.collisions = le32_to_cpu(vals[89]);
2265
2266        /* detailed rx_errors: */
2267        dev->stats.rx_length_errors = le32_to_cpu(vals[3]);
2268        dev->stats.rx_crc_errors = le32_to_cpu(vals[4]);
2269        dev->stats.rx_frame_errors = le32_to_cpu(vals[2]);
2270        dev->stats.rx_fifo_errors = le32_to_cpu(vals[0]);
2271}
2272
2273static struct net_device_stats *airo_get_stats(struct net_device *dev)
2274{
2275        struct airo_info *local =  dev->ml_priv;
2276
2277        if (!test_bit(JOB_STATS, &local->jobs)) {
2278                /* Get stats out of the card if available */
2279                if (down_trylock(&local->sem) != 0) {
2280                        set_bit(JOB_STATS, &local->jobs);
2281                        wake_up_interruptible(&local->thr_wait);
2282                } else
2283                        airo_read_stats(dev);
2284        }
2285
2286        return &dev->stats;
2287}
2288
2289static void airo_set_promisc(struct airo_info *ai) {
2290        Cmd cmd;
2291        Resp rsp;
2292
2293        memset(&cmd, 0, sizeof(cmd));
2294        cmd.cmd=CMD_SETMODE;
2295        clear_bit(JOB_PROMISC, &ai->jobs);
2296        cmd.parm0=(ai->flags&IFF_PROMISC) ? PROMISC : NOPROMISC;
2297        issuecommand(ai, &cmd, &rsp);
2298        up(&ai->sem);
2299}
2300
2301static void airo_set_multicast_list(struct net_device *dev) {
2302        struct airo_info *ai = dev->ml_priv;
2303
2304        if ((dev->flags ^ ai->flags) & IFF_PROMISC) {
2305                change_bit(FLAG_PROMISC, &ai->flags);
2306                if (down_trylock(&ai->sem) != 0) {
2307                        set_bit(JOB_PROMISC, &ai->jobs);
2308                        wake_up_interruptible(&ai->thr_wait);
2309                } else
2310                        airo_set_promisc(ai);
2311        }
2312
2313        if ((dev->flags&IFF_ALLMULTI)||dev->mc_count>0) {
2314                /* Turn on multicast.  (Should be already setup...) */
2315        }
2316}
2317
2318static int airo_set_mac_address(struct net_device *dev, void *p)
2319{
2320        struct airo_info *ai = dev->ml_priv;
2321        struct sockaddr *addr = p;
2322
2323        readConfigRid(ai, 1);
2324        memcpy (ai->config.macAddr, addr->sa_data, dev->addr_len);
2325        set_bit (FLAG_COMMIT, &ai->flags);
2326        disable_MAC(ai, 1);
2327        writeConfigRid (ai, 1);
2328        enable_MAC(ai, 1);
2329        memcpy (ai->dev->dev_addr, addr->sa_data, dev->addr_len);
2330        if (ai->wifidev)
2331                memcpy (ai->wifidev->dev_addr, addr->sa_data, dev->addr_len);
2332        return 0;
2333}
2334
2335static int airo_change_mtu(struct net_device *dev, int new_mtu)
2336{
2337        if ((new_mtu < 68) || (new_mtu > 2400))
2338                return -EINVAL;
2339        dev->mtu = new_mtu;
2340        return 0;
2341}
2342
2343static LIST_HEAD(airo_devices);
2344
2345static void add_airo_dev(struct airo_info *ai)
2346{
2347        /* Upper layers already keep track of PCI devices,
2348         * so we only need to remember our non-PCI cards. */
2349        if (!ai->pci)
2350                list_add_tail(&ai->dev_list, &airo_devices);
2351}
2352
2353static void del_airo_dev(struct airo_info *ai)
2354{
2355        if (!ai->pci)
2356                list_del(&ai->dev_list);
2357}
2358
2359static int airo_close(struct net_device *dev) {
2360        struct airo_info *ai = dev->ml_priv;
2361
2362        netif_stop_queue(dev);
2363
2364        if (ai->wifidev != dev) {
2365#ifdef POWER_ON_DOWN
2366                /* Shut power to the card. The idea is that the user can save
2367                 * power when he doesn't need the card with "ifconfig down".
2368                 * That's the method that is most friendly towards the network
2369                 * stack (i.e. the network stack won't try to broadcast
2370                 * anything on the interface and routes are gone. Jean II */
2371                set_bit(FLAG_RADIO_DOWN, &ai->flags);
2372                disable_MAC(ai, 1);
2373#endif
2374                disable_interrupts( ai );
2375
2376                free_irq(dev->irq, dev);
2377
2378                set_bit(JOB_DIE, &ai->jobs);
2379                kthread_stop(ai->airo_thread_task);
2380        }
2381        return 0;
2382}
2383
2384void stop_airo_card( struct net_device *dev, int freeres )
2385{
2386        struct airo_info *ai = dev->ml_priv;
2387
2388        set_bit(FLAG_RADIO_DOWN, &ai->flags);
2389        disable_MAC(ai, 1);
2390        disable_interrupts(ai);
2391        takedown_proc_entry( dev, ai );
2392        if (test_bit(FLAG_REGISTERED, &ai->flags)) {
2393                unregister_netdev( dev );
2394                if (ai->wifidev) {
2395                        unregister_netdev(ai->wifidev);
2396                        free_netdev(ai->wifidev);
2397                        ai->wifidev = NULL;
2398                }
2399                clear_bit(FLAG_REGISTERED, &ai->flags);
2400        }
2401        /*
2402         * Clean out tx queue
2403         */
2404        if (test_bit(FLAG_MPI, &ai->flags) && !skb_queue_empty(&ai->txq)) {
2405                struct sk_buff *skb = NULL;
2406                for (;(skb = skb_dequeue(&ai->txq));)
2407                        dev_kfree_skb(skb);
2408        }
2409
2410        airo_networks_free (ai);
2411
2412        kfree(ai->flash);
2413        kfree(ai->rssi);
2414        kfree(ai->APList);
2415        kfree(ai->SSID);
2416        if (freeres) {
2417                /* PCMCIA frees this stuff, so only for PCI and ISA */
2418                release_region( dev->base_addr, 64 );
2419                if (test_bit(FLAG_MPI, &ai->flags)) {
2420                        if (ai->pci)
2421                                mpi_unmap_card(ai->pci);
2422                        if (ai->pcimem)
2423                                iounmap(ai->pcimem);
2424                        if (ai->pciaux)
2425                                iounmap(ai->pciaux);
2426                        pci_free_consistent(ai->pci, PCI_SHARED_LEN,
2427                                ai->shared, ai->shared_dma);
2428                }
2429        }
2430        crypto_free_cipher(ai->tfm);
2431        del_airo_dev(ai);
2432        free_netdev( dev );
2433}
2434
2435EXPORT_SYMBOL(stop_airo_card);
2436
2437static int wll_header_parse(const struct sk_buff *skb, unsigned char *haddr)
2438{
2439        memcpy(haddr, skb_mac_header(skb) + 10, ETH_ALEN);
2440        return ETH_ALEN;
2441}
2442
2443static void mpi_unmap_card(struct pci_dev *pci)
2444{
2445        unsigned long mem_start = pci_resource_start(pci, 1);
2446        unsigned long mem_len = pci_resource_len(pci, 1);
2447        unsigned long aux_start = pci_resource_start(pci, 2);
2448        unsigned long aux_len = AUXMEMSIZE;
2449
2450        release_mem_region(aux_start, aux_len);
2451        release_mem_region(mem_start, mem_len);
2452}
2453
2454/*************************************************************
2455 *  This routine assumes that descriptors have been setup .
2456 *  Run at insmod time or after reset  when the decriptors
2457 *  have been initialized . Returns 0 if all is well nz
2458 *  otherwise . Does not allocate memory but sets up card
2459 *  using previously allocated descriptors.
2460 */
2461static int mpi_init_descriptors (struct airo_info *ai)
2462{
2463        Cmd cmd;
2464        Resp rsp;
2465        int i;
2466        int rc = SUCCESS;
2467
2468        /* Alloc  card RX descriptors */
2469        netif_stop_queue(ai->dev);
2470
2471        memset(&rsp,0,sizeof(rsp));
2472        memset(&cmd,0,sizeof(cmd));
2473
2474        cmd.cmd = CMD_ALLOCATEAUX;
2475        cmd.parm0 = FID_RX;
2476        cmd.parm1 = (ai->rxfids[0].card_ram_off - ai->pciaux);
2477        cmd.parm2 = MPI_MAX_FIDS;
2478        rc=issuecommand(ai, &cmd, &rsp);
2479        if (rc != SUCCESS) {
2480                airo_print_err(ai->dev->name, "Couldn't allocate RX FID");
2481                return rc;
2482        }
2483
2484        for (i=0; i<MPI_MAX_FIDS; i++) {
2485                memcpy_toio(ai->rxfids[i].card_ram_off,
2486                        &ai->rxfids[i].rx_desc, sizeof(RxFid));
2487        }
2488
2489        /* Alloc card TX descriptors */
2490
2491        memset(&rsp,0,sizeof(rsp));
2492        memset(&cmd,0,sizeof(cmd));
2493
2494        cmd.cmd = CMD_ALLOCATEAUX;
2495        cmd.parm0 = FID_TX;
2496        cmd.parm1 = (ai->txfids[0].card_ram_off - ai->pciaux);
2497        cmd.parm2 = MPI_MAX_FIDS;
2498
2499        for (i=0; i<MPI_MAX_FIDS; i++) {
2500                ai->txfids[i].tx_desc.valid = 1;
2501                memcpy_toio(ai->txfids[i].card_ram_off,
2502                        &ai->txfids[i].tx_desc, sizeof(TxFid));
2503        }
2504        ai->txfids[i-1].tx_desc.eoc = 1; /* Last descriptor has EOC set */
2505
2506        rc=issuecommand(ai, &cmd, &rsp);
2507        if (rc != SUCCESS) {
2508                airo_print_err(ai->dev->name, "Couldn't allocate TX FID");
2509                return rc;
2510        }
2511
2512        /* Alloc card Rid descriptor */
2513        memset(&rsp,0,sizeof(rsp));
2514        memset(&cmd,0,sizeof(cmd));
2515
2516        cmd.cmd = CMD_ALLOCATEAUX;
2517        cmd.parm0 = RID_RW;
2518        cmd.parm1 = (ai->config_desc.card_ram_off - ai->pciaux);
2519        cmd.parm2 = 1; /* Magic number... */
2520        rc=issuecommand(ai, &cmd, &rsp);
2521        if (rc != SUCCESS) {
2522                airo_print_err(ai->dev->name, "Couldn't allocate RID");
2523                return rc;
2524        }
2525
2526        memcpy_toio(ai->config_desc.card_ram_off,
2527                &ai->config_desc.rid_desc, sizeof(Rid));
2528
2529        return rc;
2530}
2531
2532/*
2533 * We are setting up three things here:
2534 * 1) Map AUX memory for descriptors: Rid, TxFid, or RxFid.
2535 * 2) Map PCI memory for issueing commands.
2536 * 3) Allocate memory (shared) to send and receive ethernet frames.
2537 */
2538static int mpi_map_card(struct airo_info *ai, struct pci_dev *pci)
2539{
2540        unsigned long mem_start, mem_len, aux_start, aux_len;
2541        int rc = -1;
2542        int i;
2543        dma_addr_t busaddroff;
2544        unsigned char *vpackoff;
2545        unsigned char __iomem *pciaddroff;
2546
2547        mem_start = pci_resource_start(pci, 1);
2548        mem_len = pci_resource_len(pci, 1);
2549        aux_start = pci_resource_start(pci, 2);
2550        aux_len = AUXMEMSIZE;
2551
2552        if (!request_mem_region(mem_start, mem_len, DRV_NAME)) {
2553                airo_print_err("", "Couldn't get region %x[%x]",
2554                        (int)mem_start, (int)mem_len);
2555                goto out;
2556        }
2557        if (!request_mem_region(aux_start, aux_len, DRV_NAME)) {
2558                airo_print_err("", "Couldn't get region %x[%x]",
2559                        (int)aux_start, (int)aux_len);
2560                goto free_region1;
2561        }
2562
2563        ai->pcimem = ioremap(mem_start, mem_len);
2564        if (!ai->pcimem) {
2565                airo_print_err("", "Couldn't map region %x[%x]",
2566                        (int)mem_start, (int)mem_len);
2567                goto free_region2;
2568        }
2569        ai->pciaux = ioremap(aux_start, aux_len);
2570        if (!ai->pciaux) {
2571                airo_print_err("", "Couldn't map region %x[%x]",
2572                        (int)aux_start, (int)aux_len);
2573                goto free_memmap;
2574        }
2575
2576        /* Reserve PKTSIZE for each fid and 2K for the Rids */
2577        ai->shared = pci_alloc_consistent(pci, PCI_SHARED_LEN, &ai->shared_dma);
2578        if (!ai->shared) {
2579                airo_print_err("", "Couldn't alloc_consistent %d",
2580                        PCI_SHARED_LEN);
2581                goto free_auxmap;
2582        }
2583
2584        /*
2585         * Setup descriptor RX, TX, CONFIG
2586         */
2587        busaddroff = ai->shared_dma;
2588        pciaddroff = ai->pciaux + AUX_OFFSET;
2589        vpackoff   = ai->shared;
2590
2591        /* RX descriptor setup */
2592        for(i = 0; i < MPI_MAX_FIDS; i++) {
2593                ai->rxfids[i].pending = 0;
2594                ai->rxfids[i].card_ram_off = pciaddroff;
2595                ai->rxfids[i].virtual_host_addr = vpackoff;
2596                ai->rxfids[i].rx_desc.host_addr = busaddroff;
2597                ai->rxfids[i].rx_desc.valid = 1;
2598                ai->rxfids[i].rx_desc.len = PKTSIZE;
2599                ai->rxfids[i].rx_desc.rdy = 0;
2600
2601                pciaddroff += sizeof(RxFid);
2602                busaddroff += PKTSIZE;
2603                vpackoff   += PKTSIZE;
2604        }
2605
2606        /* TX descriptor setup */
2607        for(i = 0; i < MPI_MAX_FIDS; i++) {
2608                ai->txfids[i].card_ram_off = pciaddroff;
2609                ai->txfids[i].virtual_host_addr = vpackoff;
2610                ai->txfids[i].tx_desc.valid = 1;
2611                ai->txfids[i].tx_desc.host_addr = busaddroff;
2612                memcpy(ai->txfids[i].virtual_host_addr,
2613                        &wifictlhdr8023, sizeof(wifictlhdr8023));
2614
2615                pciaddroff += sizeof(TxFid);
2616                busaddroff += PKTSIZE;
2617                vpackoff   += PKTSIZE;
2618        }
2619        ai->txfids[i-1].tx_desc.eoc = 1; /* Last descriptor has EOC set */
2620
2621        /* Rid descriptor setup */
2622        ai->config_desc.card_ram_off = pciaddroff;
2623        ai->config_desc.virtual_host_addr = vpackoff;
2624        ai->config_desc.rid_desc.host_addr = busaddroff;
2625        ai->ridbus = busaddroff;
2626        ai->config_desc.rid_desc.rid = 0;
2627        ai->config_desc.rid_desc.len = RIDSIZE;
2628        ai->config_desc.rid_desc.valid = 1;
2629        pciaddroff += sizeof(Rid);
2630        busaddroff += RIDSIZE;
2631        vpackoff   += RIDSIZE;
2632
2633        /* Tell card about descriptors */
2634        if (mpi_init_descriptors (ai) != SUCCESS)
2635                goto free_shared;
2636
2637        return 0;
2638 free_shared:
2639        pci_free_consistent(pci, PCI_SHARED_LEN, ai->shared, ai->shared_dma);
2640 free_auxmap:
2641        iounmap(ai->pciaux);
2642 free_memmap:
2643        iounmap(ai->pcimem);
2644 free_region2:
2645        release_mem_region(aux_start, aux_len);
2646 free_region1:
2647        release_mem_region(mem_start, mem_len);
2648 out:
2649        return rc;
2650}
2651
2652static const struct header_ops airo_header_ops = {
2653        .parse = wll_header_parse,
2654};
2655
2656static const struct net_device_ops airo11_netdev_ops = {
2657        .ndo_open               = airo_open,
2658        .ndo_stop               = airo_close,
2659        .ndo_start_xmit         = airo_start_xmit11,
2660        .ndo_get_stats          = airo_get_stats,
2661        .ndo_set_mac_address    = airo_set_mac_address,
2662        .ndo_do_ioctl           = airo_ioctl,
2663        .ndo_change_mtu         = airo_change_mtu,
2664};
2665
2666static void wifi_setup(struct net_device *dev)
2667{
2668        dev->netdev_ops = &airo11_netdev_ops;
2669        dev->header_ops = &airo_header_ops;
2670        dev->wireless_handlers = &airo_handler_def;
2671
2672        dev->type               = ARPHRD_IEEE80211;
2673        dev->hard_header_len    = ETH_HLEN;
2674        dev->mtu                = AIRO_DEF_MTU;
2675        dev->addr_len           = ETH_ALEN;
2676        dev->tx_queue_len       = 100; 
2677
2678        memset(dev->broadcast,0xFF, ETH_ALEN);
2679
2680        dev->flags              = IFF_BROADCAST|IFF_MULTICAST;
2681}
2682
2683static struct net_device *init_wifidev(struct airo_info *ai,
2684                                        struct net_device *ethdev)
2685{
2686        int err;
2687        struct net_device *dev = alloc_netdev(0, "wifi%d", wifi_setup);
2688        if (!dev)
2689                return NULL;
2690        dev->ml_priv = ethdev->ml_priv;
2691        dev->irq = ethdev->irq;
2692        dev->base_addr = ethdev->base_addr;
2693        dev->wireless_data = ethdev->wireless_data;
2694        SET_NETDEV_DEV(dev, ethdev->dev.parent);
2695        memcpy(dev->dev_addr, ethdev->dev_addr, dev->addr_len);
2696        err = register_netdev(dev);
2697        if (err<0) {
2698                free_netdev(dev);
2699                return NULL;
2700        }
2701        return dev;
2702}
2703
2704static int reset_card( struct net_device *dev , int lock) {
2705        struct airo_info *ai = dev->ml_priv;
2706
2707        if (lock && down_interruptible(&ai->sem))
2708                return -1;
2709        waitbusy (ai);
2710        OUT4500(ai,COMMAND,CMD_SOFTRESET);
2711        msleep(200);
2712        waitbusy (ai);
2713        msleep(200);
2714        if (lock)
2715                up(&ai->sem);
2716        return 0;
2717}
2718
2719#define AIRO_MAX_NETWORK_COUNT  64
2720static int airo_networks_allocate(struct airo_info *ai)
2721{
2722        if (ai->networks)
2723                return 0;
2724
2725        ai->networks =
2726            kzalloc(AIRO_MAX_NETWORK_COUNT * sizeof(BSSListElement),
2727                    GFP_KERNEL);
2728        if (!ai->networks) {
2729                airo_print_warn("", "Out of memory allocating beacons");
2730                return -ENOMEM;
2731        }
2732
2733        return 0;
2734}
2735
2736static void airo_networks_free(struct airo_info *ai)
2737{
2738        kfree(ai->networks);
2739        ai->networks = NULL;
2740}
2741
2742static void airo_networks_initialize(struct airo_info *ai)
2743{
2744        int i;
2745
2746        INIT_LIST_HEAD(&ai->network_free_list);
2747        INIT_LIST_HEAD(&ai->network_list);
2748        for (i = 0; i < AIRO_MAX_NETWORK_COUNT; i++)
2749                list_add_tail(&ai->networks[i].list,
2750                              &ai->network_free_list);
2751}
2752
2753static const struct net_device_ops airo_netdev_ops = {
2754        .ndo_open               = airo_open,
2755        .ndo_stop               = airo_close,
2756        .ndo_start_xmit         = airo_start_xmit,
2757        .ndo_get_stats          = airo_get_stats,
2758        .ndo_set_multicast_list = airo_set_multicast_list,
2759        .ndo_set_mac_address    = airo_set_mac_address,
2760        .ndo_do_ioctl           = airo_ioctl,
2761        .ndo_change_mtu         = airo_change_mtu,
2762        .ndo_validate_addr      = eth_validate_addr,
2763};
2764
2765static const struct net_device_ops mpi_netdev_ops = {
2766        .ndo_open               = airo_open,
2767        .ndo_stop               = airo_close,
2768        .ndo_start_xmit         = mpi_start_xmit,
2769        .ndo_get_stats          = airo_get_stats,
2770        .ndo_set_multicast_list = airo_set_multicast_list,
2771        .ndo_set_mac_address    = airo_set_mac_address,
2772        .ndo_do_ioctl           = airo_ioctl,
2773        .ndo_change_mtu         = airo_change_mtu,
2774        .ndo_validate_addr      = eth_validate_addr,
2775};
2776
2777
2778static struct net_device *_init_airo_card( unsigned short irq, int port,
2779                                           int is_pcmcia, struct pci_dev *pci,
2780                                           struct device *dmdev )
2781{
2782        struct net_device *dev;
2783        struct airo_info *ai;
2784        int i, rc;
2785        CapabilityRid cap_rid;
2786
2787        /* Create the network device object. */
2788        dev = alloc_netdev(sizeof(*ai), "", ether_setup);
2789        if (!dev) {
2790                airo_print_err("", "Couldn't alloc_etherdev");
2791                return NULL;
2792        }
2793
2794        ai = dev->ml_priv = netdev_priv(dev);
2795        ai->wifidev = NULL;
2796        ai->flags = 1 << FLAG_RADIO_DOWN;
2797        ai->jobs = 0;
2798        ai->dev = dev;
2799        if (pci && (pci->device == 0x5000 || pci->device == 0xa504)) {
2800                airo_print_dbg("", "Found an MPI350 card");
2801                set_bit(FLAG_MPI, &ai->flags);
2802        }
2803        spin_lock_init(&ai->aux_lock);
2804        sema_init(&ai->sem, 1);
2805        ai->config.len = 0;
2806        ai->pci = pci;
2807        init_waitqueue_head (&ai->thr_wait);
2808        ai->tfm = NULL;
2809        add_airo_dev(ai);
2810
2811        if (airo_networks_allocate (ai))
2812                goto err_out_free;
2813        airo_networks_initialize (ai);
2814
2815        skb_queue_head_init (&ai->txq);
2816
2817        /* The Airo-specific entries in the device structure. */
2818        if (test_bit(FLAG_MPI,&ai->flags))
2819                dev->netdev_ops = &mpi_netdev_ops;
2820        else
2821                dev->netdev_ops = &airo_netdev_ops;
2822        dev->wireless_handlers = &airo_handler_def;
2823        ai->wireless_data.spy_data = &ai->spy_data;
2824        dev->wireless_data = &ai->wireless_data;
2825        dev->irq = irq;
2826        dev->base_addr = port;
2827
2828        SET_NETDEV_DEV(dev, dmdev);
2829
2830        reset_card (dev, 1);
2831        msleep(400);
2832
2833        if (!is_pcmcia) {
2834                if (!request_region(dev->base_addr, 64, DRV_NAME)) {
2835                        rc = -EBUSY;
2836                        airo_print_err(dev->name, "Couldn't request region");
2837                        goto err_out_nets;
2838                }
2839        }
2840
2841        if (test_bit(FLAG_MPI,&ai->flags)) {
2842                if (mpi_map_card(ai, pci)) {
2843                        airo_print_err("", "Could not map memory");
2844                        goto err_out_res;
2845                }
2846        }
2847
2848        if (probe) {
2849                if (setup_card(ai, dev->dev_addr, 1) != SUCCESS) {
2850                        airo_print_err(dev->name, "MAC could not be enabled" );
2851                        rc = -EIO;
2852                        goto err_out_map;
2853                }
2854        } else if (!test_bit(FLAG_MPI,&ai->flags)) {
2855                ai->bap_read = fast_bap_read;
2856                set_bit(FLAG_FLASHING, &ai->flags);
2857        }
2858
2859        strcpy(dev->name, "eth%d");
2860        rc = register_netdev(dev);
2861        if (rc) {
2862                airo_print_err(dev->name, "Couldn't register_netdev");
2863                goto err_out_map;
2864        }
2865        ai->wifidev = init_wifidev(ai, dev);
2866        if (!ai->wifidev)
2867                goto err_out_reg;
2868
2869        rc = readCapabilityRid(ai, &cap_rid, 1);
2870        if (rc != SUCCESS) {
2871                rc = -EIO;
2872                goto err_out_wifi;
2873        }
2874        /* WEP capability discovery */
2875        ai->wep_capable = (cap_rid.softCap & cpu_to_le16(0x02)) ? 1 : 0;
2876        ai->max_wep_idx = (cap_rid.softCap & cpu_to_le16(0x80)) ? 3 : 0;
2877
2878        airo_print_info(dev->name, "Firmware version %x.%x.%02x",
2879                        ((le16_to_cpu(cap_rid.softVer) >> 8) & 0xF),
2880                        (le16_to_cpu(cap_rid.softVer) & 0xFF),
2881                        le16_to_cpu(cap_rid.softSubVer));
2882
2883        /* Test for WPA support */
2884        /* Only firmware versions 5.30.17 or better can do WPA */
2885        if (le16_to_cpu(cap_rid.softVer) > 0x530
2886         || (le16_to_cpu(cap_rid.softVer) == 0x530
2887              && le16_to_cpu(cap_rid.softSubVer) >= 17)) {
2888                airo_print_info(ai->dev->name, "WPA supported.");
2889
2890                set_bit(FLAG_WPA_CAPABLE, &ai->flags);
2891                ai->bssListFirst = RID_WPA_BSSLISTFIRST;
2892                ai->bssListNext = RID_WPA_BSSLISTNEXT;
2893                ai->bssListRidLen = sizeof(BSSListRid);
2894        } else {
2895                airo_print_info(ai->dev->name, "WPA unsupported with firmware "
2896                        "versions older than 5.30.17.");
2897
2898                ai->bssListFirst = RID_BSSLISTFIRST;
2899                ai->bssListNext = RID_BSSLISTNEXT;
2900                ai->bssListRidLen = sizeof(BSSListRid) - sizeof(BSSListRidExtra);
2901        }
2902
2903        set_bit(FLAG_REGISTERED,&ai->flags);
2904        airo_print_info(dev->name, "MAC enabled %pM", dev->dev_addr);
2905
2906        /* Allocate the transmit buffers */
2907        if (probe && !test_bit(FLAG_MPI,&ai->flags))
2908                for( i = 0; i < MAX_FIDS; i++ )
2909                        ai->fids[i] = transmit_allocate(ai,AIRO_DEF_MTU,i>=MAX_FIDS/2);
2910
2911        if (setup_proc_entry(dev, dev->ml_priv) < 0)
2912                goto err_out_wifi;
2913
2914        return dev;
2915
2916err_out_wifi:
2917        unregister_netdev(ai->wifidev);
2918        free_netdev(ai->wifidev);
2919err_out_reg:
2920        unregister_netdev(dev);
2921err_out_map:
2922        if (test_bit(FLAG_MPI,&ai->flags) && pci) {
2923                pci_free_consistent(pci, PCI_SHARED_LEN, ai->shared, ai->shared_dma);
2924                iounmap(ai->pciaux);
2925                iounmap(ai->pcimem);
2926                mpi_unmap_card(ai->pci);
2927        }
2928err_out_res:
2929        if (!is_pcmcia)
2930                release_region( dev->base_addr, 64 );
2931err_out_nets:
2932        airo_networks_free(ai);
2933        del_airo_dev(ai);
2934err_out_free:
2935        free_netdev(dev);
2936        return NULL;
2937}
2938
2939struct net_device *init_airo_card( unsigned short irq, int port, int is_pcmcia,
2940                                  struct device *dmdev)
2941{
2942        return _init_airo_card ( irq, port, is_pcmcia, NULL, dmdev);
2943}
2944
2945EXPORT_SYMBOL(init_airo_card);
2946
2947static int waitbusy (struct airo_info *ai) {
2948        int delay = 0;
2949        while ((IN4500(ai, COMMAND) & COMMAND_BUSY) && (delay < 10000)) {
2950                udelay (10);
2951                if ((++delay % 20) == 0)
2952                        OUT4500(ai, EVACK, EV_CLEARCOMMANDBUSY);
2953        }
2954        return delay < 10000;
2955}
2956
2957int reset_airo_card( struct net_device *dev )
2958{
2959        int i;
2960        struct airo_info *ai = dev->ml_priv;
2961
2962        if (reset_card (dev, 1))
2963                return -1;
2964
2965        if ( setup_card(ai, dev->dev_addr, 1 ) != SUCCESS ) {
2966                airo_print_err(dev->name, "MAC could not be enabled");
2967                return -1;
2968        }
2969        airo_print_info(dev->name, "MAC enabled %pM", dev->dev_addr);
2970        /* Allocate the transmit buffers if needed */
2971        if (!test_bit(FLAG_MPI,&ai->flags))
2972                for( i = 0; i < MAX_FIDS; i++ )
2973                        ai->fids[i] = transmit_allocate (ai,AIRO_DEF_MTU,i>=MAX_FIDS/2);
2974
2975        enable_interrupts( ai );
2976        netif_wake_queue(dev);
2977        return 0;
2978}
2979
2980EXPORT_SYMBOL(reset_airo_card);
2981
2982static void airo_send_event(struct net_device *dev) {
2983        struct airo_info *ai = dev->ml_priv;
2984        union iwreq_data wrqu;
2985        StatusRid status_rid;
2986
2987        clear_bit(JOB_EVENT, &ai->jobs);
2988        PC4500_readrid(ai, RID_STATUS, &status_rid, sizeof(status_rid), 0);
2989        up(&ai->sem);
2990        wrqu.data.length = 0;
2991        wrqu.data.flags = 0;
2992        memcpy(wrqu.ap_addr.sa_data, status_rid.bssid[0], ETH_ALEN);
2993        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
2994
2995        /* Send event to user space */
2996        wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
2997}
2998
2999static void airo_process_scan_results (struct airo_info *ai) {
3000        union iwreq_data        wrqu;
3001        BSSListRid bss;
3002        int rc;
3003        BSSListElement * loop_net;
3004        BSSListElement * tmp_net;
3005
3006        /* Blow away current list of scan results */
3007        list_for_each_entry_safe (loop_net, tmp_net, &ai->network_list, list) {
3008                list_move_tail (&loop_net->list, &ai->network_free_list);
3009                /* Don't blow away ->list, just BSS data */
3010                memset (loop_net, 0, sizeof (loop_net->bss));
3011        }
3012
3013        /* Try to read the first entry of the scan result */
3014        rc = PC4500_readrid(ai, ai->bssListFirst, &bss, ai->bssListRidLen, 0);
3015        if((rc) || (bss.index == cpu_to_le16(0xffff))) {
3016                /* No scan results */
3017                goto out;
3018        }
3019
3020        /* Read and parse all entries */
3021        tmp_net = NULL;
3022        while((!rc) && (bss.index != cpu_to_le16(0xffff))) {
3023                /* Grab a network off the free list */
3024                if (!list_empty(&ai->network_free_list)) {
3025                        tmp_net = list_entry(ai->network_free_list.next,
3026                                            BSSListElement, list);
3027                        list_del(ai->network_free_list.next);
3028                }
3029
3030                if (tmp_net != NULL) {
3031                        memcpy(tmp_net, &bss, sizeof(tmp_net->bss));
3032                        list_add_tail(&tmp_net->list, &ai->network_list);
3033                        tmp_net = NULL;
3034                }
3035
3036                /* Read next entry */
3037                rc = PC4500_readrid(ai, ai->bssListNext,
3038                                    &bss, ai->bssListRidLen, 0);
3039        }
3040
3041out:
3042        ai->scan_timeout = 0;
3043        clear_bit(JOB_SCAN_RESULTS, &ai->jobs);
3044        up(&ai->sem);
3045
3046        /* Send an empty event to user space.
3047         * We don't send the received data on
3048         * the event because it would require
3049         * us to do complex transcoding, and
3050         * we want to minimise the work done in
3051         * the irq handler. Use a request to
3052         * extract the data - Jean II */
3053        wrqu.data.length = 0;
3054        wrqu.data.flags = 0;
3055        wireless_send_event(ai->dev, SIOCGIWSCAN, &wrqu, NULL);
3056}
3057
3058static int airo_thread(void *data) {
3059        struct net_device *dev = data;
3060        struct airo_info *ai = dev->ml_priv;
3061        int locked;
3062
3063        set_freezable();
3064        while(1) {
3065                /* make swsusp happy with our thread */
3066                try_to_freeze();
3067
3068                if (test_bit(JOB_DIE, &ai->jobs))
3069                        break;
3070
3071                if (ai->jobs) {
3072                        locked = down_interruptible(&ai->sem);
3073                } else {
3074                        wait_queue_t wait;
3075
3076                        init_waitqueue_entry(&wait, current);
3077                        add_wait_queue(&ai->thr_wait, &wait);
3078                        for (;;) {
3079                                set_current_state(TASK_INTERRUPTIBLE);
3080                                if (ai->jobs)
3081                                        break;
3082                                if (ai->expires || ai->scan_timeout) {
3083                                        if (ai->scan_timeout &&
3084                                                        time_after_eq(jiffies,ai->scan_timeout)){
3085                                                set_bit(JOB_SCAN_RESULTS, &ai->jobs);
3086                                                break;
3087                                        } else if (ai->expires &&
3088                                                        time_after_eq(jiffies,ai->expires)){
3089                                                set_bit(JOB_AUTOWEP, &ai->jobs);
3090                                                break;
3091                                        }
3092                                        if (!kthread_should_stop() &&
3093                                            !freezing(current)) {
3094                                                unsigned long wake_at;
3095                                                if (!ai->expires || !ai->scan_timeout) {
3096                                                        wake_at = max(ai->expires,
3097                                                                ai->scan_timeout);
3098                                                } else {
3099                                                        wake_at = min(ai->expires,
3100                                                                ai->scan_timeout);
3101                                                }
3102                                                schedule_timeout(wake_at - jiffies);
3103                                                continue;
3104                                        }
3105                                } else if (!kthread_should_stop() &&
3106                                           !freezing(current)) {
3107                                        schedule();
3108                                        continue;
3109                                }
3110                                break;
3111                        }
3112                        current->state = TASK_RUNNING;
3113                        remove_wait_queue(&ai->thr_wait, &wait);
3114                        locked = 1;
3115                }
3116
3117                if (locked)
3118                        continue;
3119
3120                if (test_bit(JOB_DIE, &ai->jobs)) {
3121                        up(&ai->sem);
3122                        break;
3123                }
3124
3125                if (ai->power.event || test_bit(FLAG_FLASHING, &ai->flags)) {
3126                        up(&ai->sem);
3127                        continue;
3128                }
3129
3130                if (test_bit(JOB_XMIT, &ai->jobs))
3131                        airo_end_xmit(dev);
3132                else if (test_bit(JOB_XMIT11, &ai->jobs))
3133                        airo_end_xmit11(dev);
3134                else if (test_bit(JOB_STATS, &ai->jobs))
3135                        airo_read_stats(dev);
3136                else if (test_bit(JOB_WSTATS, &ai->jobs))
3137                        airo_read_wireless_stats(ai);
3138                else if (test_bit(JOB_PROMISC, &ai->jobs))
3139                        airo_set_promisc(ai);
3140                else if (test_bit(JOB_MIC, &ai->jobs))
3141                        micinit(ai);
3142                else if (test_bit(JOB_EVENT, &ai->jobs))
3143                        airo_send_event(dev);
3144                else if (test_bit(JOB_AUTOWEP, &ai->jobs))
3145                        timer_func(dev);
3146                else if (test_bit(JOB_SCAN_RESULTS, &ai->jobs))
3147                        airo_process_scan_results(ai);
3148                else  /* Shouldn't get here, but we make sure to unlock */
3149                        up(&ai->sem);
3150        }
3151
3152        return 0;
3153}
3154
3155static int header_len(__le16 ctl)
3156{
3157        u16 fc = le16_to_cpu(ctl);
3158        switch (fc & 0xc) {
3159        case 4:
3160                if ((fc & 0xe0) == 0xc0)
3161                        return 10;      /* one-address control packet */
3162                return 16;      /* two-address control packet */
3163        case 8:
3164                if ((fc & 0x300) == 0x300)
3165                        return 30;      /* WDS packet */
3166        }
3167        return 24;
3168}
3169
3170static void airo_handle_cisco_mic(struct airo_info *ai)
3171{
3172        if (test_bit(FLAG_MIC_CAPABLE, &ai->flags)) {
3173                set_bit(JOB_MIC, &ai->jobs);
3174                wake_up_interruptible(&ai->thr_wait);
3175        }
3176}
3177
3178/* Airo Status codes */
3179#define STAT_NOBEACON   0x8000 /* Loss of sync - missed beacons */
3180#define STAT_MAXRETRIES 0x8001 /* Loss of sync - max retries */
3181#define STAT_MAXARL     0x8002 /* Loss of sync - average retry level exceeded*/
3182#define STAT_FORCELOSS  0x8003 /* Loss of sync - host request */
3183#define STAT_TSFSYNC    0x8004 /* Loss of sync - TSF synchronization */
3184#define STAT_DEAUTH     0x8100 /* low byte is 802.11 reason code */
3185#define STAT_DISASSOC   0x8200 /* low byte is 802.11 reason code */
3186#define STAT_ASSOC_FAIL 0x8400 /* low byte is 802.11 reason code */
3187#define STAT_AUTH_FAIL  0x0300 /* low byte is 802.11 reason code */
3188#define STAT_ASSOC      0x0400 /* Associated */
3189#define STAT_REASSOC    0x0600 /* Reassociated?  Only on firmware >= 5.30.17 */
3190
3191static void airo_print_status(const char *devname, u16 status)
3192{
3193        u8 reason = status & 0xFF;
3194
3195        switch (status) {
3196        case STAT_NOBEACON:
3197                airo_print_dbg(devname, "link lost (missed beacons)");
3198                break;
3199        case STAT_MAXRETRIES:
3200        case STAT_MAXARL:
3201                airo_print_dbg(devname, "link lost (max retries)");
3202                break;
3203        case STAT_FORCELOSS:
3204                airo_print_dbg(devname, "link lost (local choice)");
3205                break;
3206        case STAT_TSFSYNC:
3207                airo_print_dbg(devname, "link lost (TSF sync lost)");
3208                break;
3209        case STAT_DEAUTH:
3210                airo_print_dbg(devname, "deauthenticated (reason: %d)", reason);
3211                break;
3212        case STAT_DISASSOC:
3213                airo_print_dbg(devname, "disassociated (reason: %d)", reason);
3214                break;
3215        case STAT_ASSOC_FAIL:
3216                airo_print_dbg(devname, "association failed (reason: %d)",
3217                               reason);
3218                break;
3219        case STAT_AUTH_FAIL:
3220                airo_print_dbg(devname, "authentication failed (reason: %d)",
3221                               reason);
3222                break;
3223        default:
3224                break;
3225        }
3226}
3227
3228static void airo_handle_link(struct airo_info *ai)
3229{
3230        union iwreq_data wrqu;
3231        int scan_forceloss = 0;
3232        u16 status;
3233
3234        /* Get new status and acknowledge the link change */
3235        status = le16_to_cpu(IN4500(ai, LINKSTAT));
3236        OUT4500(ai, EVACK, EV_LINK);
3237
3238        if ((status == STAT_FORCELOSS) && (ai->scan_timeout > 0))
3239                scan_forceloss = 1;
3240
3241        airo_print_status(ai->dev->name, status);
3242
3243        if ((status == STAT_ASSOC) || (status == STAT_REASSOC)) {
3244                if (auto_wep)
3245                        ai->expires = 0;
3246                if (ai->list_bss_task)
3247                        wake_up_process(ai->list_bss_task);
3248                set_bit(FLAG_UPDATE_UNI, &ai->flags);
3249                set_bit(FLAG_UPDATE_MULTI, &ai->flags);
3250
3251                if (down_trylock(&ai->sem) != 0) {
3252                        set_bit(JOB_EVENT, &ai->jobs);
3253                        wake_up_interruptible(&ai->thr_wait);
3254                } else
3255                        airo_send_event(ai->dev);
3256        } else if (!scan_forceloss) {
3257                if (auto_wep && !ai->expires) {
3258                        ai->expires = RUN_AT(3*HZ);
3259                        wake_up_interruptible(&ai->thr_wait);
3260                }
3261
3262                /* Send event to user space */
3263                memset(wrqu.ap_addr.sa_data, '\0', ETH_ALEN);
3264                wrqu.ap_addr.sa_family = ARPHRD_ETHER;
3265                wireless_send_event(ai->dev, SIOCGIWAP, &wrqu, NULL);
3266        }
3267}
3268
3269static void airo_handle_rx(struct airo_info *ai)
3270{
3271        struct sk_buff *skb = NULL;
3272        __le16 fc, v, *buffer, tmpbuf[4];
3273        u16 len, hdrlen = 0, gap, fid;
3274        struct rx_hdr hdr;
3275        int success = 0;
3276
3277        if (test_bit(FLAG_MPI, &ai->flags)) {
3278                if (test_bit(FLAG_802_11, &ai->flags))
3279                        mpi_receive_802_11(ai);
3280                else
3281                        mpi_receive_802_3(ai);
3282                OUT4500(ai, EVACK, EV_RX);
3283                return;
3284        }
3285
3286        fid = IN4500(ai, RXFID);
3287
3288        /* Get the packet length */
3289        if (test_bit(FLAG_802_11, &ai->flags)) {
3290                bap_setup (ai, fid, 4, BAP0);
3291                bap_read (ai, (__le16*)&hdr, sizeof(hdr), BAP0);
3292                /* Bad CRC. Ignore packet */
3293                if (le16_to_cpu(hdr.status) & 2)
3294                        hdr.len = 0;
3295                if (ai->wifidev == NULL)
3296                        hdr.len = 0;
3297        } else {
3298                bap_setup(ai, fid, 0x36, BAP0);
3299                bap_read(ai, &hdr.len, 2, BAP0);
3300        }
3301        len = le16_to_cpu(hdr.len);
3302
3303        if (len > AIRO_DEF_MTU) {
3304                airo_print_err(ai->dev->name, "Bad size %d", len);
3305                goto done;
3306        }
3307        if (len == 0)
3308                goto done;
3309
3310        if (test_bit(FLAG_802_11, &ai->flags)) {
3311                bap_read(ai, &fc, sizeof (fc), BAP0);
3312                hdrlen = header_len(fc);
3313        } else
3314                hdrlen = ETH_ALEN * 2;
3315
3316        skb = dev_alloc_skb(len + hdrlen + 2 + 2);
3317        if (!skb) {
3318                ai->dev->stats.rx_dropped++;
3319                goto done;
3320        }
3321
3322        skb_reserve(skb, 2); /* This way the IP header is aligned */
3323        buffer = (__le16 *) skb_put(skb, len + hdrlen);
3324        if (test_bit(FLAG_802_11, &ai->flags)) {
3325                buffer[0] = fc;
3326                bap_read(ai, buffer + 1, hdrlen - 2, BAP0);
3327                if (hdrlen == 24)
3328                        bap_read(ai, tmpbuf, 6, BAP0);
3329
3330                bap_read(ai, &v, sizeof(v), BAP0);
3331                gap = le16_to_cpu(v);
3332                if (gap) {
3333                        if (gap <= 8) {
3334                                bap_read(ai, tmpbuf, gap, BAP0);
3335                        } else {
3336                                airo_print_err(ai->dev->name, "gaplen too "
3337                                        "big. Problems will follow...");
3338                        }
3339                }
3340                bap_read(ai, buffer + hdrlen/2, len, BAP0);
3341        } else {
3342                MICBuffer micbuf;
3343
3344                bap_read(ai, buffer, ETH_ALEN * 2, BAP0);
3345                if (ai->micstats.enabled) {
3346                        bap_read(ai, (__le16 *) &micbuf, sizeof (micbuf), BAP0);
3347                        if (ntohs(micbuf.typelen) > 0x05DC)
3348                                bap_setup(ai, fid, 0x44, BAP0);
3349                        else {
3350                                if (len <= sizeof (micbuf)) {
3351                                        dev_kfree_skb_irq(skb);
3352                                        goto done;
3353                                }
3354
3355                                len -= sizeof(micbuf);
3356                                skb_trim(skb, len + hdrlen);
3357                        }
3358                }
3359
3360                bap_read(ai, buffer + ETH_ALEN, len, BAP0);
3361                if (decapsulate(ai, &micbuf, (etherHead*) buffer, len))
3362                        dev_kfree_skb_irq (skb);
3363                else
3364                        success = 1;
3365        }
3366
3367#ifdef WIRELESS_SPY
3368        if (success && (ai->spy_data.spy_number > 0)) {
3369                char *sa;
3370                struct iw_quality wstats;
3371
3372                /* Prepare spy data : addr + qual */
3373                if (!test_bit(FLAG_802_11, &ai->flags)) {
3374                        sa = (char *) buffer + 6;
3375                        bap_setup(ai, fid, 8, BAP0);
3376                        bap_read(ai, (__le16 *) hdr.rssi, 2, BAP0);
3377                } else
3378                        sa = (char *) buffer + 10;
3379                wstats.qual = hdr.rssi[0];
3380                if (ai->rssi)
3381                        wstats.level = 0x100 - ai->rssi[hdr.rssi[1]].rssidBm;
3382                else
3383                        wstats.level = (hdr.rssi[1] + 321) / 2;
3384                wstats.noise = ai->wstats.qual.noise;
3385                wstats.updated =  IW_QUAL_LEVEL_UPDATED
3386                                | IW_QUAL_QUAL_UPDATED
3387                                | IW_QUAL_DBM;
3388                /* Update spy records */
3389                wireless_spy_update(ai->dev, sa, &wstats);
3390        }
3391#endif /* WIRELESS_SPY */
3392
3393done:
3394        OUT4500(ai, EVACK, EV_RX);
3395
3396        if (success) {
3397                if (test_bit(FLAG_802_11, &ai->flags)) {
3398                        skb_reset_mac_header(skb);
3399                        skb->pkt_type = PACKET_OTHERHOST;
3400                        skb->dev = ai->wifidev;
3401                        skb->protocol = htons(ETH_P_802_2);
3402                } else
3403                        skb->protocol = eth_type_trans(skb, ai->dev);
3404                skb->ip_summed = CHECKSUM_NONE;
3405
3406                netif_rx(skb);
3407        }
3408}
3409
3410static void airo_handle_tx(struct airo_info *ai, u16 status)
3411{
3412        int i, len = 0, index = -1;
3413        u16 fid;
3414
3415        if (test_bit(FLAG_MPI, &ai->flags)) {
3416                unsigned long flags;
3417
3418                if (status & EV_TXEXC)
3419                        get_tx_error(ai, -1);
3420
3421                spin_lock_irqsave(&ai->aux_lock, flags);
3422                if (!skb_queue_empty(&ai->txq)) {
3423                        spin_unlock_irqrestore(&ai->aux_lock,flags);
3424                        mpi_send_packet(ai->dev);
3425                } else {
3426                        clear_bit(FLAG_PENDING_XMIT, &ai->flags);
3427                        spin_unlock_irqrestore(&ai->aux_lock,flags);
3428                        netif_wake_queue(ai->dev);
3429                }
3430                OUT4500(ai, EVACK, status & (EV_TX | EV_TXCPY | EV_TXEXC));
3431                return;
3432        }
3433
3434        fid = IN4500(ai, TXCOMPLFID);
3435
3436        for(i = 0; i < MAX_FIDS; i++) {
3437                if ((ai->fids[i] & 0xffff) == fid) {
3438                        len = ai->fids[i] >> 16;
3439                        index = i;
3440                }
3441        }
3442
3443        if (index != -1) {
3444                if (status & EV_TXEXC)
3445                        get_tx_error(ai, index);
3446
3447                OUT4500(ai, EVACK, status & (EV_TX | EV_TXEXC));
3448
3449                /* Set up to be used again */
3450                ai->fids[index] &= 0xffff;
3451                if (index < MAX_FIDS / 2) {
3452                        if (!test_bit(FLAG_PENDING_XMIT, &ai->flags))
3453                                netif_wake_queue(ai->dev);
3454                } else {
3455                        if (!test_bit(FLAG_PENDING_XMIT11, &ai->flags))
3456                                netif_wake_queue(ai->wifidev);
3457                }
3458        } else {
3459                OUT4500(ai, EVACK, status & (EV_TX | EV_TXCPY | EV_TXEXC));
3460                airo_print_err(ai->dev->name, "Unallocated FID was used to xmit");
3461        }
3462}
3463
3464static irqreturn_t airo_interrupt(int irq, void *dev_id)
3465{
3466        struct net_device *dev = dev_id;
3467        u16 status, savedInterrupts = 0;
3468        struct airo_info *ai = dev->ml_priv;
3469        int handled = 0;
3470
3471        if (!netif_device_present(dev))
3472                return IRQ_NONE;
3473
3474        for (;;) {
3475                status = IN4500(ai, EVSTAT);
3476                if (!(status & STATUS_INTS) || (status == 0xffff))
3477                        break;
3478
3479                handled = 1;
3480
3481                if (status & EV_AWAKE) {
3482                        OUT4500(ai, EVACK, EV_AWAKE);
3483                        OUT4500(ai, EVACK, EV_AWAKE);
3484                }
3485
3486                if (!savedInterrupts) {
3487                        savedInterrupts = IN4500(ai, EVINTEN);
3488                        OUT4500(ai, EVINTEN, 0);
3489                }
3490
3491                if (status & EV_MIC) {
3492                        OUT4500(ai, EVACK, EV_MIC);
3493                        airo_handle_cisco_mic(ai);
3494                }
3495
3496                if (status & EV_LINK) {
3497                        /* Link status changed */
3498                        airo_handle_link(ai);
3499                }
3500
3501                /* Check to see if there is something to receive */
3502                if (status & EV_RX)
3503                        airo_handle_rx(ai);
3504
3505                /* Check to see if a packet has been transmitted */
3506                if (status & (EV_TX | EV_TXCPY | EV_TXEXC))
3507                        airo_handle_tx(ai, status);
3508
3509                if ( status & ~STATUS_INTS & ~IGNORE_INTS ) {
3510                        airo_print_warn(ai->dev->name, "Got weird status %x",
3511                                status & ~STATUS_INTS & ~IGNORE_INTS );
3512                }
3513        }
3514
3515        if (savedInterrupts)
3516                OUT4500(ai, EVINTEN, savedInterrupts);
3517
3518        return IRQ_RETVAL(handled);
3519}
3520
3521/*
3522 *  Routines to talk to the card
3523 */
3524
3525/*
3526 *  This was originally written for the 4500, hence the name
3527 *  NOTE:  If use with 8bit mode and SMP bad things will happen!
3528 *         Why would some one do 8 bit IO in an SMP machine?!?
3529 */
3530static void OUT4500( struct airo_info *ai, u16 reg, u16 val ) {
3531        if (test_bit(FLAG_MPI,&ai->flags))
3532                reg <<= 1;
3533        if ( !do8bitIO )
3534                outw( val, ai->dev->base_addr + reg );
3535        else {
3536                outb( val & 0xff, ai->dev->base_addr + reg );
3537                outb( val >> 8, ai->dev->base_addr + reg + 1 );
3538        }
3539}
3540
3541static u16 IN4500( struct airo_info *ai, u16 reg ) {
3542        unsigned short rc;
3543
3544        if (test_bit(FLAG_MPI,&ai->flags))
3545                reg <<= 1;
3546        if ( !do8bitIO )
3547                rc = inw( ai->dev->base_addr + reg );
3548        else {
3549                rc = inb( ai->dev->base_addr + reg );
3550                rc += ((int)inb( ai->dev->base_addr + reg + 1 )) << 8;
3551        }
3552        return rc;
3553}
3554
3555static int enable_MAC(struct airo_info *ai, int lock)
3556{
3557        int rc;
3558        Cmd cmd;
3559        Resp rsp;
3560
3561        /* FLAG_RADIO_OFF : Radio disabled via /proc or Wireless Extensions
3562         * FLAG_RADIO_DOWN : Radio disabled via "ifconfig ethX down"
3563         * Note : we could try to use !netif_running(dev) in enable_MAC()
3564         * instead of this flag, but I don't trust it *within* the
3565         * open/close functions, and testing both flags together is
3566         * "cheaper" - Jean II */
3567        if (ai->flags & FLAG_RADIO_MASK) return SUCCESS;
3568
3569        if (lock && down_interruptible(&ai->sem))
3570                return -ERESTARTSYS;
3571
3572        if (!test_bit(FLAG_ENABLED, &ai->flags)) {
3573                memset(&cmd, 0, sizeof(cmd));
3574                cmd.cmd = MAC_ENABLE;
3575                rc = issuecommand(ai, &cmd, &rsp);
3576                if (rc == SUCCESS)
3577                        set_bit(FLAG_ENABLED, &ai->flags);
3578        } else
3579                rc = SUCCESS;
3580
3581        if (lock)
3582            up(&ai->sem);
3583
3584        if (rc)
3585                airo_print_err(ai->dev->name, "Cannot enable MAC");
3586        else if ((rsp.status & 0xFF00) != 0) {
3587                airo_print_err(ai->dev->name, "Bad MAC enable reason=%x, "
3588                        "rid=%x, offset=%d", rsp.rsp0, rsp.rsp1, rsp.rsp2);
3589                rc = ERROR;
3590        }
3591        return rc;
3592}
3593
3594static void disable_MAC( struct airo_info *ai, int lock ) {
3595        Cmd cmd;
3596        Resp rsp;
3597
3598        if (lock && down_interruptible(&ai->sem))
3599                return;
3600
3601        if (test_bit(FLAG_ENABLED, &ai->flags)) {
3602                memset(&cmd, 0, sizeof(cmd));
3603                cmd.cmd = MAC_DISABLE; // disable in case already enabled
3604                issuecommand(ai, &cmd, &rsp);
3605                clear_bit(FLAG_ENABLED, &ai->flags);
3606        }
3607        if (lock)
3608                up(&ai->sem);
3609}
3610
3611static void enable_interrupts( struct airo_info *ai ) {
3612        /* Enable the interrupts */
3613        OUT4500( ai, EVINTEN, STATUS_INTS );
3614}
3615
3616static void disable_interrupts( struct airo_info *ai ) {
3617        OUT4500( ai, EVINTEN, 0 );
3618}
3619
3620static void mpi_receive_802_3(struct airo_info *ai)
3621{
3622        RxFid rxd;
3623        int len = 0;
3624        struct sk_buff *skb;
3625        char *buffer;
3626        int off = 0;
3627        MICBuffer micbuf;
3628
3629        memcpy_fromio(&rxd, ai->rxfids[0].card_ram_off, sizeof(rxd));
3630        /* Make sure we got something */
3631        if (rxd.rdy && rxd.valid == 0) {
3632                len = rxd.len + 12;
3633                if (len < 12 || len > 2048)
3634                        goto badrx;
3635
3636                skb = dev_alloc_skb(len);
3637                if (!skb) {
3638                        ai->dev->stats.rx_dropped++;
3639                        goto badrx;
3640                }
3641                buffer = skb_put(skb,len);
3642                memcpy(buffer, ai->rxfids[0].virtual_host_addr, ETH_ALEN * 2);
3643                if (ai->micstats.enabled) {
3644                        memcpy(&micbuf,
3645                                ai->rxfids[0].virtual_host_addr + ETH_ALEN * 2,
3646                                sizeof(micbuf));
3647                        if (ntohs(micbuf.typelen) <= 0x05DC) {
3648                                if (len <= sizeof(micbuf) + ETH_ALEN * 2)
3649                                        goto badmic;
3650
3651                                off = sizeof(micbuf);
3652                                skb_trim (skb, len - off);
3653                        }
3654                }
3655                memcpy(buffer + ETH_ALEN * 2,
3656                        ai->rxfids[0].virtual_host_addr + ETH_ALEN * 2 + off,
3657                        len - ETH_ALEN * 2 - off);
3658                if (decapsulate (ai, &micbuf, (etherHead*)buffer, len - off - ETH_ALEN * 2)) {
3659badmic:
3660                        dev_kfree_skb_irq (skb);
3661                        goto badrx;
3662                }
3663#ifdef WIRELESS_SPY
3664                if (ai->spy_data.spy_number > 0) {
3665                        char *sa;
3666                        struct iw_quality wstats;
3667                        /* Prepare spy data : addr + qual */
3668                        sa = buffer + ETH_ALEN;
3669                        wstats.qual = 0; /* XXX Where do I get that info from ??? */
3670                        wstats.level = 0;
3671                        wstats.updated = 0;
3672                        /* Update spy records */
3673                        wireless_spy_update(ai->dev, sa, &wstats);
3674                }
3675#endif /* WIRELESS_SPY */
3676
3677                skb->ip_summed = CHECKSUM_NONE;
3678                skb->protocol = eth_type_trans(skb, ai->dev);
3679                netif_rx(skb);
3680        }
3681badrx:
3682        if (rxd.valid == 0) {
3683                rxd.valid = 1;
3684                rxd.rdy = 0;
3685                rxd.len = PKTSIZE;
3686                memcpy_toio(ai->rxfids[0].card_ram_off, &rxd, sizeof(rxd));
3687        }
3688}
3689
3690static void mpi_receive_802_11(struct airo_info *ai)
3691{
3692        RxFid rxd;
3693        struct sk_buff *skb = NULL;
3694        u16 len, hdrlen = 0;
3695        __le16 fc;
3696        struct rx_hdr hdr;
3697        u16 gap;
3698        u16 *buffer;
3699        char *ptr = ai->rxfids[0].virtual_host_addr + 4;
3700
3701        memcpy_fromio(&rxd, ai->rxfids[0].card_ram_off, sizeof(rxd));
3702        memcpy ((char *)&hdr, ptr, sizeof(hdr));
3703        ptr += sizeof(hdr);
3704        /* Bad CRC. Ignore packet */
3705        if (le16_to_cpu(hdr.status) & 2)
3706                hdr.len = 0;
3707        if (ai->wifidev == NULL)
3708                hdr.len = 0;
3709        len = le16_to_cpu(hdr.len);
3710        if (len > AIRO_DEF_MTU) {
3711                airo_print_err(ai->dev->name, "Bad size %d", len);
3712                goto badrx;
3713        }
3714        if (len == 0)
3715                goto badrx;
3716
3717        fc = get_unaligned((__le16 *)ptr);
3718        hdrlen = header_len(fc);
3719
3720        skb = dev_alloc_skb( len + hdrlen + 2 );
3721        if ( !skb ) {
3722                ai->dev->stats.rx_dropped++;
3723                goto badrx;
3724        }
3725        buffer = (u16*)skb_put (skb, len + hdrlen);
3726        memcpy ((char *)buffer, ptr, hdrlen);
3727        ptr += hdrlen;
3728        if (hdrlen == 24)
3729                ptr += 6;
3730        gap = get_unaligned_le16(ptr);
3731        ptr += sizeof(__le16);
3732        if (gap) {
3733                if (gap <= 8)
3734                        ptr += gap;
3735                else
3736                        airo_print_err(ai->dev->name,
3737                            "gaplen too big. Problems will follow...");
3738        }
3739        memcpy ((char *)buffer + hdrlen, ptr, len);
3740        ptr += len;
3741#ifdef IW_WIRELESS_SPY    /* defined in iw_handler.h */
3742        if (ai->spy_data.spy_number > 0) {
3743                char *sa;
3744                struct iw_quality wstats;
3745                /* Prepare spy data : addr + qual */
3746                sa = (char*)buffer + 10;
3747                wstats.qual = hdr.rssi[0];
3748                if (ai->rssi)
3749                        wstats.level = 0x100 - ai->rssi[hdr.rssi[1]].rssidBm;
3750                else
3751                        wstats.level = (hdr.rssi[1] + 321) / 2;
3752                wstats.noise = ai->wstats.qual.noise;
3753                wstats.updated = IW_QUAL_QUAL_UPDATED
3754                        | IW_QUAL_LEVEL_UPDATED
3755                        | IW_QUAL_DBM;
3756                /* Update spy records */
3757                wireless_spy_update(ai->dev, sa, &wstats);
3758        }
3759#endif /* IW_WIRELESS_SPY */
3760        skb_reset_mac_header(skb);
3761        skb->pkt_type = PACKET_OTHERHOST;
3762        skb->dev = ai->wifidev;
3763        skb->protocol = htons(ETH_P_802_2);
3764        skb->ip_summed = CHECKSUM_NONE;
3765        netif_rx( skb );
3766
3767badrx:
3768        if (rxd.valid == 0) {
3769                rxd.valid = 1;
3770                rxd.rdy = 0;
3771                rxd.len = PKTSIZE;
3772                memcpy_toio(ai->rxfids[0].card_ram_off, &rxd, sizeof(rxd));
3773        }
3774}
3775
3776static u16 setup_card(struct airo_info *ai, u8 *mac, int lock)
3777{
3778        Cmd cmd;
3779        Resp rsp;
3780        int status;
3781        SsidRid mySsid;
3782        __le16 lastindex;
3783        WepKeyRid wkr;
3784        int rc;
3785
3786        memset( &mySsid, 0, sizeof( mySsid ) );
3787        kfree (ai->flash);
3788        ai->flash = NULL;
3789
3790        /* The NOP is the first step in getting the card going */
3791        cmd.cmd = NOP;
3792        cmd.parm0 = cmd.parm1 = cmd.parm2 = 0;
3793        if (lock && down_interruptible(&ai->sem))
3794                return ERROR;
3795        if ( issuecommand( ai, &cmd, &rsp ) != SUCCESS ) {
3796                if (lock)
3797                        up(&ai->sem);
3798                return ERROR;
3799        }
3800        disable_MAC( ai, 0);
3801
3802        // Let's figure out if we need to use the AUX port
3803        if (!test_bit(FLAG_MPI,&ai->flags)) {
3804                cmd.cmd = CMD_ENABLEAUX;
3805                if (issuecommand(ai, &cmd, &rsp) != SUCCESS) {
3806                        if (lock)
3807                                up(&ai->sem);
3808                        airo_print_err(ai->dev->name, "Error checking for AUX port");
3809                        return ERROR;
3810                }
3811                if (!aux_bap || rsp.status & 0xff00) {
3812                        ai->bap_read = fast_bap_read;
3813                        airo_print_dbg(ai->dev->name, "Doing fast bap_reads");
3814                } else {
3815                        ai->bap_read = aux_bap_read;
3816                        airo_print_dbg(ai->dev->name, "Doing AUX bap_reads");
3817                }
3818        }
3819        if (lock)
3820                up(&ai->sem);
3821        if (ai->config.len == 0) {
3822                int i;
3823                tdsRssiRid rssi_rid;
3824                CapabilityRid cap_rid;
3825
3826                kfree(ai->APList);
3827                ai->APList = NULL;
3828                kfree(ai->SSID);
3829                ai->SSID = NULL;
3830                // general configuration (read/modify/write)
3831                status = readConfigRid(ai, lock);
3832                if ( status != SUCCESS ) return ERROR;
3833
3834                status = readCapabilityRid(ai, &cap_rid, lock);
3835                if ( status != SUCCESS ) return ERROR;
3836
3837                status = PC4500_readrid(ai,RID_RSSI,&rssi_rid,sizeof(rssi_rid),lock);
3838                if ( status == SUCCESS ) {
3839                        if (ai->rssi || (ai->rssi = kmalloc(512, GFP_KERNEL)) != NULL)
3840                                memcpy(ai->rssi, (u8*)&rssi_rid + 2, 512); /* Skip RID length member */
3841                }
3842                else {
3843                        kfree(ai->rssi);
3844                        ai->rssi = NULL;
3845                        if (cap_rid.softCap & cpu_to_le16(8))
3846                                ai->config.rmode |= RXMODE_NORMALIZED_RSSI;
3847                        else
3848                                airo_print_warn(ai->dev->name, "unknown received signal "
3849                                                "level scale");
3850                }
3851                ai->config.opmode = adhoc ? MODE_STA_IBSS : MODE_STA_ESS;
3852                ai->config.authType = AUTH_OPEN;
3853                ai->config.modulation = MOD_CCK;
3854
3855                if (le16_to_cpu(cap_rid.len) >= sizeof(cap_rid) &&
3856                    (cap_rid.extSoftCap & cpu_to_le16(1)) &&
3857                    micsetup(ai) == SUCCESS) {
3858                        ai->config.opmode |= MODE_MIC;
3859                        set_bit(FLAG_MIC_CAPABLE, &ai->flags);
3860                }
3861
3862                /* Save off the MAC */
3863                for( i = 0; i < ETH_ALEN; i++ ) {
3864                        mac[i] = ai->config.macAddr[i];
3865                }
3866
3867                /* Check to see if there are any insmod configured
3868                   rates to add */
3869                if ( rates[0] ) {
3870                        memset(ai->config.rates,0,sizeof(ai->config.rates));
3871                        for( i = 0; i < 8 && rates[i]; i++ ) {
3872                                ai->config.rates[i] = rates[i];
3873                        }
3874                }
3875                if ( basic_rate > 0 ) {
3876                        for( i = 0; i < 8; i++ ) {
3877                                if ( ai->config.rates[i] == basic_rate ||
3878                                     !ai->config.rates ) {
3879                                        ai->config.rates[i] = basic_rate | 0x80;
3880                                        break;
3881                                }
3882                        }
3883                }
3884                set_bit (FLAG_COMMIT, &ai->flags);
3885        }
3886
3887        /* Setup the SSIDs if present */
3888        if ( ssids[0] ) {
3889                int i;
3890                for( i = 0; i < 3 && ssids[i]; i++ ) {
3891                        size_t len = strlen(ssids[i]);
3892                        if (len > 32)
3893                                len = 32;
3894                        mySsid.ssids[i].len = cpu_to_le16(len);
3895                        memcpy(mySsid.ssids[i].ssid, ssids[i], len);
3896                }
3897                mySsid.len = cpu_to_le16(sizeof(mySsid));
3898        }
3899
3900        status = writeConfigRid(ai, lock);
3901        if ( status != SUCCESS ) return ERROR;
3902
3903        /* Set up the SSID list */
3904        if ( ssids[0] ) {
3905                status = writeSsidRid(ai, &mySsid, lock);
3906                if ( status != SUCCESS ) return ERROR;
3907        }
3908
3909        status = enable_MAC(ai, lock);
3910        if (status != SUCCESS)
3911                return ERROR;
3912
3913        /* Grab the initial wep key, we gotta save it for auto_wep */
3914        rc = readWepKeyRid(ai, &wkr, 1, lock);
3915        if (rc == SUCCESS) do {
3916                lastindex = wkr.kindex;
3917                if (wkr.kindex == cpu_to_le16(0xffff)) {
3918                        ai->defindex = wkr.mac[0];
3919                }
3920                rc = readWepKeyRid(ai, &wkr, 0, lock);
3921        } while(lastindex != wkr.kindex);
3922
3923        try_auto_wep(ai);
3924
3925        return SUCCESS;
3926}
3927
3928static u16 issuecommand(struct airo_info *ai, Cmd *pCmd, Resp *pRsp) {
3929        // Im really paranoid about letting it run forever!
3930        int max_tries = 600000;
3931
3932        if (IN4500(ai, EVSTAT) & EV_CMD)
3933                OUT4500(ai, EVACK, EV_CMD);
3934
3935        OUT4500(ai, PARAM0, pCmd->parm0);
3936        OUT4500(ai, PARAM1, pCmd->parm1);
3937        OUT4500(ai, PARAM2, pCmd->parm2);
3938        OUT4500(ai, COMMAND, pCmd->cmd);
3939
3940        while (max_tries-- && (IN4500(ai, EVSTAT) & EV_CMD) == 0) {
3941                if ((IN4500(ai, COMMAND)) == pCmd->cmd)
3942                        // PC4500 didn't notice command, try again
3943                        OUT4500(ai, COMMAND, pCmd->cmd);
3944                if (!in_atomic() && (max_tries & 255) == 0)
3945                        schedule();
3946        }
3947
3948        if ( max_tries == -1 ) {
3949                airo_print_err(ai->dev->name,
3950                        "Max tries exceeded when issueing command");
3951                if (IN4500(ai, COMMAND) & COMMAND_BUSY)
3952                        OUT4500(ai, EVACK, EV_CLEARCOMMANDBUSY);
3953                return ERROR;
3954        }
3955
3956        // command completed
3957        pRsp->status = IN4500(ai, STATUS);
3958        pRsp->rsp0 = IN4500(ai, RESP0);
3959        pRsp->rsp1 = IN4500(ai, RESP1);
3960        pRsp->rsp2 = IN4500(ai, RESP2);
3961        if ((pRsp->status & 0xff00)!=0 && pCmd->cmd != CMD_SOFTRESET)
3962                airo_print_err(ai->dev->name,
3963                        "cmd:%x status:%x rsp0:%x rsp1:%x rsp2:%x",
3964                        pCmd->cmd, pRsp->status, pRsp->rsp0, pRsp->rsp1,
3965                        pRsp->rsp2);
3966
3967        // clear stuck command busy if necessary
3968        if (IN4500(ai, COMMAND) & COMMAND_BUSY) {
3969                OUT4500(ai, EVACK, EV_CLEARCOMMANDBUSY);
3970        }
3971        // acknowledge processing the status/response
3972        OUT4500(ai, EVACK, EV_CMD);
3973
3974        return SUCCESS;
3975}
3976
3977/* Sets up the bap to start exchange data.  whichbap should
3978 * be one of the BAP0 or BAP1 defines.  Locks should be held before
3979 * calling! */
3980static int bap_setup(struct airo_info *ai, u16 rid, u16 offset, int whichbap )
3981{
3982        int timeout = 50;
3983        int max_tries = 3;
3984
3985        OUT4500(ai, SELECT0+whichbap, rid);
3986        OUT4500(ai, OFFSET0+whichbap, offset);
3987        while (1) {
3988                int status = IN4500(ai, OFFSET0+whichbap);
3989                if (status & BAP_BUSY) {
3990                        /* This isn't really a timeout, but its kinda
3991                           close */
3992                        if (timeout--) {
3993                                continue;
3994                        }
3995                } else if ( status & BAP_ERR ) {
3996                        /* invalid rid or offset */
3997                        airo_print_err(ai->dev->name, "BAP error %x %d",
3998                                status, whichbap );
3999                        return ERROR;
4000                } else if (status & BAP_DONE) { // success
4001                        return SUCCESS;
4002                }
4003                if ( !(max_tries--) ) {
4004                        airo_print_err(ai->dev->name,
4005                                "BAP setup error too many retries\n");
4006                        return ERROR;
4007                }
4008                // -- PC4500 missed it, try again
4009                OUT4500(ai, SELECT0+whichbap, rid);
4010                OUT4500(ai, OFFSET0+whichbap, offset);
4011                timeout = 50;
4012        }
4013}
4014
4015/* should only be called by aux_bap_read.  This aux function and the
4016   following use concepts not documented in the developers guide.  I
4017   got them from a patch given to my by Aironet */
4018static u16 aux_setup(struct airo_info *ai, u16 page,
4019                     u16 offset, u16 *len)
4020{
4021        u16 next;
4022
4023        OUT4500(ai, AUXPAGE, page);
4024        OUT4500(ai, AUXOFF, 0);
4025        next = IN4500(ai, AUXDATA);
4026        *len = IN4500(ai, AUXDATA)&0xff;
4027        if (offset != 4) OUT4500(ai, AUXOFF, offset);
4028        return next;
4029}
4030
4031/* requires call to bap_setup() first */
4032static int aux_bap_read(struct airo_info *ai, __le16 *pu16Dst,
4033                        int bytelen, int whichbap)
4034{
4035        u16 len;
4036        u16 page;
4037        u16 offset;
4038        u16 next;
4039        int words;
4040        int i;
4041        unsigned long flags;
4042
4043        spin_lock_irqsave(&ai->aux_lock, flags);
4044        page = IN4500(ai, SWS0+whichbap);
4045        offset = IN4500(ai, SWS2+whichbap);
4046        next = aux_setup(ai, page, offset, &len);
4047        words = (bytelen+1)>>1;
4048
4049        for (i=0; i<words;) {
4050                int count;
4051                count = (len>>1) < (words-i) ? (len>>1) : (words-i);
4052                if ( !do8bitIO )
4053                        insw( ai->dev->base_addr+DATA0+whichbap,
4054                              pu16Dst+i,count );
4055                else
4056                        insb( ai->dev->base_addr+DATA0+whichbap,
4057                              pu16Dst+i, count << 1 );
4058                i += count;
4059                if (i<words) {
4060                        next = aux_setup(ai, next, 4, &len);
4061                }
4062        }
4063        spin_unlock_irqrestore(&ai->aux_lock, flags);
4064        return SUCCESS;
4065}
4066
4067
4068/* requires call to bap_setup() first */
4069static int fast_bap_read(struct airo_info *ai, __le16 *pu16Dst,
4070                         int bytelen, int whichbap)
4071{
4072        bytelen = (bytelen + 1) & (~1); // round up to even value
4073        if ( !do8bitIO )
4074                insw( ai->dev->base_addr+DATA0+whichbap, pu16Dst, bytelen>>1 );
4075        else
4076                insb( ai->dev->base_addr+DATA0+whichbap, pu16Dst, bytelen );
4077        return SUCCESS;
4078}
4079
4080/* requires call to bap_setup() first */
4081static int bap_write(struct airo_info *ai, const __le16 *pu16Src,
4082                     int bytelen, int whichbap)
4083{
4084        bytelen = (bytelen + 1) & (~1); // round up to even value
4085        if ( !do8bitIO )
4086                outsw( ai->dev->base_addr+DATA0+whichbap,
4087                       pu16Src, bytelen>>1 );
4088        else
4089                outsb( ai->dev->base_addr+DATA0+whichbap, pu16Src, bytelen );
4090        return SUCCESS;
4091}
4092
4093static int PC4500_accessrid(struct airo_info *ai, u16 rid, u16 accmd)
4094{
4095        Cmd cmd; /* for issuing commands */
4096        Resp rsp; /* response from commands */
4097        u16 status;
4098
4099        memset(&cmd, 0, sizeof(cmd));
4100        cmd.cmd = accmd;
4101        cmd.parm0 = rid;
4102        status = issuecommand(ai, &cmd, &rsp);
4103        if (status != 0) return status;
4104        if ( (rsp.status & 0x7F00) != 0) {
4105                return (accmd << 8) + (rsp.rsp0 & 0xFF);
4106        }
4107        return 0;
4108}
4109
4110/*  Note, that we are using BAP1 which is also used by transmit, so
4111 *  we must get a lock. */
4112static int PC4500_readrid(struct airo_info *ai, u16 rid, void *pBuf, int len, int lock)
4113{
4114        u16 status;
4115        int rc = SUCCESS;
4116
4117        if (lock) {
4118                if (down_interruptible(&ai->sem))
4119                        return ERROR;
4120        }
4121        if (test_bit(FLAG_MPI,&ai->flags)) {
4122                Cmd cmd;
4123                Resp rsp;
4124
4125                memset(&cmd, 0, sizeof(cmd));
4126                memset(&rsp, 0, sizeof(rsp));
4127                ai->config_desc.rid_desc.valid = 1;
4128                ai->config_desc.rid_desc.len = RIDSIZE;
4129                ai->config_desc.rid_desc.rid = 0;
4130                ai->config_desc.rid_desc.host_addr = ai->ridbus;
4131
4132                cmd.cmd = CMD_ACCESS;
4133                cmd.parm0 = rid;
4134
4135                memcpy_toio(ai->config_desc.card_ram_off,
4136                        &ai->config_desc.rid_desc, sizeof(Rid));
4137
4138                rc = issuecommand(ai, &cmd, &rsp);
4139
4140                if (rsp.status & 0x7f00)
4141                        rc = rsp.rsp0;
4142                if (!rc)
4143                        memcpy(pBuf, ai->config_desc.virtual_host_addr, len);
4144                goto done;
4145        } else {
4146                if ((status = PC4500_accessrid(ai, rid, CMD_ACCESS))!=SUCCESS) {
4147                        rc = status;
4148                        goto done;
4149                }
4150                if (bap_setup(ai, rid, 0, BAP1) != SUCCESS) {
4151                        rc = ERROR;
4152                        goto done;
4153                }
4154                // read the rid length field
4155                bap_read(ai, pBuf, 2, BAP1);
4156                // length for remaining part of rid
4157                len = min(len, (int)le16_to_cpu(*(__le16*)pBuf)) - 2;
4158
4159                if ( len <= 2 ) {
4160                        airo_print_err(ai->dev->name,
4161                                "Rid %x has a length of %d which is too short",
4162                                (int)rid, (int)len );
4163                        rc = ERROR;
4164                        goto done;
4165                }
4166                // read remainder of the rid
4167                rc = bap_read(ai, ((__le16*)pBuf)+1, len, BAP1);
4168        }
4169done:
4170        if (lock)
4171                up(&ai->sem);
4172        return rc;
4173}
4174
4175/*  Note, that we are using BAP1 which is also used by transmit, so
4176 *  make sure this isnt called when a transmit is happening */
4177static int PC4500_writerid(struct airo_info *ai, u16 rid,
4178                           const void *pBuf, int len, int lock)
4179{
4180        u16 status;
4181        int rc = SUCCESS;
4182
4183        *(__le16*)pBuf = cpu_to_le16((u16)len);
4184
4185        if (lock) {
4186                if (down_interruptible(&ai->sem))
4187                        return ERROR;
4188        }
4189        if (test_bit(FLAG_MPI,&ai->flags)) {
4190                Cmd cmd;
4191                Resp rsp;
4192
4193                if (test_bit(FLAG_ENABLED, &ai->flags) && (RID_WEP_TEMP != rid))
4194                        airo_print_err(ai->dev->name,
4195                                "%s: MAC should be disabled (rid=%04x)",
4196                                __func__, rid);
4197                memset(&cmd, 0, sizeof(cmd));
4198                memset(&rsp, 0, sizeof(rsp));
4199
4200                ai->config_desc.rid_desc.valid = 1;
4201                ai->config_desc.rid_desc.len = *((u16 *)pBuf);
4202                ai->config_desc.rid_desc.rid = 0;
4203
4204                cmd.cmd = CMD_WRITERID;
4205                cmd.parm0 = rid;
4206
4207                memcpy_toio(ai->config_desc.card_ram_off,
4208                        &ai->config_desc.rid_desc, sizeof(Rid));
4209
4210                if (len < 4 || len > 2047) {
4211                        airo_print_err(ai->dev->name, "%s: len=%d", __func__, len);
4212                        rc = -1;
4213                } else {
4214                        memcpy((char *)ai->config_desc.virtual_host_addr,
4215                                pBuf, len);
4216
4217                        rc = issuecommand(ai, &cmd, &rsp);
4218                        if ((rc & 0xff00) != 0) {
4219                                airo_print_err(ai->dev->name, "%s: Write rid Error %d",
4220                                                __func__, rc);
4221                                airo_print_err(ai->dev->name, "%s: Cmd=%04x",
4222                                                __func__, cmd.cmd);
4223                        }
4224
4225                        if ((rsp.status & 0x7f00))
4226                                rc = rsp.rsp0;
4227                }
4228        } else {
4229                // --- first access so that we can write the rid data
4230                if ( (status = PC4500_accessrid(ai, rid, CMD_ACCESS)) != 0) {
4231                        rc = status;
4232                        goto done;
4233                }
4234                // --- now write the rid data
4235                if (bap_setup(ai, rid, 0, BAP1) != SUCCESS) {
4236                        rc = ERROR;
4237                        goto done;
4238                }
4239                bap_write(ai, pBuf, len, BAP1);
4240                // ---now commit the rid data
4241                rc = PC4500_accessrid(ai, rid, 0x100|CMD_ACCESS);
4242        }
4243done:
4244        if (lock)
4245                up(&ai->sem);
4246        return rc;
4247}
4248
4249/* Allocates a FID to be used for transmitting packets.  We only use
4250   one for now. */
4251static u16 transmit_allocate(struct airo_info *ai, int lenPayload, int raw)
4252{
4253        unsigned int loop = 3000;
4254        Cmd cmd;
4255        Resp rsp;
4256        u16 txFid;
4257        __le16 txControl;
4258
4259        cmd.cmd = CMD_ALLOCATETX;
4260        cmd.parm0 = lenPayload;
4261        if (down_interruptible(&ai->sem))
4262                return ERROR;
4263        if (issuecommand(ai, &cmd, &rsp) != SUCCESS) {
4264                txFid = ERROR;
4265                goto done;
4266        }
4267        if ( (rsp.status & 0xFF00) != 0) {
4268                txFid = ERROR;
4269                goto done;
4270        }
4271        /* wait for the allocate event/indication
4272         * It makes me kind of nervous that this can just sit here and spin,
4273         * but in practice it only loops like four times. */
4274        while (((IN4500(ai, EVSTAT) & EV_ALLOC) == 0) && --loop);
4275        if (!loop) {
4276                txFid = ERROR;
4277                goto done;
4278        }
4279
4280        // get the allocated fid and acknowledge
4281        txFid = IN4500(ai, TXALLOCFID);
4282        OUT4500(ai, EVACK, EV_ALLOC);
4283
4284        /*  The CARD is pretty cool since it converts the ethernet packet
4285         *  into 802.11.  Also note that we don't release the FID since we
4286         *  will be using the same one over and over again. */
4287        /*  We only have to setup the control once since we are not
4288         *  releasing the fid. */
4289        if (raw)
4290                txControl = cpu_to_le16(TXCTL_TXOK | TXCTL_TXEX | TXCTL_802_11
4291                        | TXCTL_ETHERNET | TXCTL_NORELEASE);
4292        else
4293                txControl = cpu_to_le16(TXCTL_TXOK | TXCTL_TXEX | TXCTL_802_3
4294                        | TXCTL_ETHERNET | TXCTL_NORELEASE);
4295        if (bap_setup(ai, txFid, 0x0008, BAP1) != SUCCESS)
4296                txFid = ERROR;
4297        else
4298                bap_write(ai, &txControl, sizeof(txControl), BAP1);
4299
4300done:
4301        up(&ai->sem);
4302
4303        return txFid;
4304}
4305
4306/* In general BAP1 is dedicated to transmiting packets.  However,
4307   since we need a BAP when accessing RIDs, we also use BAP1 for that.
4308   Make sure the BAP1 spinlock is held when this is called. */
4309static int transmit_802_3_packet(struct airo_info *ai, int len, char *pPacket)
4310{
4311        __le16 payloadLen;
4312        Cmd cmd;
4313        Resp rsp;
4314        int miclen = 0;
4315        u16 txFid = len;
4316        MICBuffer pMic;
4317
4318        len >>= 16;
4319
4320        if (len <= ETH_ALEN * 2) {
4321                airo_print_warn(ai->dev->name, "Short packet %d", len);
4322                return ERROR;
4323        }
4324        len -= ETH_ALEN * 2;
4325
4326        if (test_bit(FLAG_MIC_CAPABLE, &ai->flags) && ai->micstats.enabled && 
4327            (ntohs(((__be16 *)pPacket)[6]) != 0x888E)) {
4328                if (encapsulate(ai,(etherHead *)pPacket,&pMic,len) != SUCCESS)
4329                        return ERROR;
4330                miclen = sizeof(pMic);
4331        }
4332        // packet is destination[6], source[6], payload[len-12]
4333        // write the payload length and dst/src/payload
4334        if (bap_setup(ai, txFid, 0x0036, BAP1) != SUCCESS) return ERROR;
4335        /* The hardware addresses aren't counted as part of the payload, so
4336         * we have to subtract the 12 bytes for the addresses off */
4337        payloadLen = cpu_to_le16(len + miclen);
4338        bap_write(ai, &payloadLen, sizeof(payloadLen),BAP1);
4339        bap_write(ai, (__le16*)pPacket, sizeof(etherHead), BAP1);
4340        if (miclen)
4341                bap_write(ai, (__le16*)&pMic, miclen, BAP1);
4342        bap_write(ai, (__le16*)(pPacket + sizeof(etherHead)), len, BAP1);
4343        // issue the transmit command
4344        memset( &cmd, 0, sizeof( cmd ) );
4345        cmd.cmd = CMD_TRANSMIT;
4346        cmd.parm0 = txFid;
4347        if (issuecommand(ai, &cmd, &rsp) != SUCCESS) return ERROR;
4348        if ( (rsp.status & 0xFF00) != 0) return ERROR;
4349        return SUCCESS;
4350}
4351
4352static int transmit_802_11_packet(struct airo_info *ai, int len, char *pPacket)
4353{
4354        __le16 fc, payloadLen;
4355        Cmd cmd;
4356        Resp rsp;
4357        int hdrlen;
4358        static u8 tail[(30-10) + 2 + 6] = {[30-10] = 6};
4359        /* padding of header to full size + le16 gaplen (6) + gaplen bytes */
4360        u16 txFid = len;
4361        len >>= 16;
4362
4363        fc = *(__le16*)pPacket;
4364        hdrlen = header_len(fc);
4365
4366        if (len < hdrlen) {
4367                airo_print_warn(ai->dev->name, "Short packet %d", len);
4368                return ERROR;
4369        }
4370
4371        /* packet is 802.11 header +  payload
4372         * write the payload length and dst/src/payload */
4373        if (bap_setup(ai, txFid, 6, BAP1) != SUCCESS) return ERROR;
4374        /* The 802.11 header aren't counted as part of the payload, so
4375         * we have to subtract the header bytes off */
4376        payloadLen = cpu_to_le16(len-hdrlen);
4377        bap_write(ai, &payloadLen, sizeof(payloadLen),BAP1);
4378        if (bap_setup(ai, txFid, 0x0014, BAP1) != SUCCESS) return ERROR;
4379        bap_write(ai, (__le16 *)pPacket, hdrlen, BAP1);
4380        bap_write(ai, (__le16 *)(tail + (hdrlen - 10)), 38 - hdrlen, BAP1);
4381
4382        bap_write(ai, (__le16 *)(pPacket + hdrlen), len - hdrlen, BAP1);
4383        // issue the transmit command
4384        memset( &cmd, 0, sizeof( cmd ) );
4385        cmd.cmd = CMD_TRANSMIT;
4386        cmd.parm0 = txFid;
4387        if (issuecommand(ai, &cmd, &rsp) != SUCCESS) return ERROR;
4388        if ( (rsp.status & 0xFF00) != 0) return ERROR;
4389        return SUCCESS;
4390}
4391
4392/*
4393 *  This is the proc_fs routines.  It is a bit messier than I would
4394 *  like!  Feel free to clean it up!
4395 */
4396
4397static ssize_t proc_read( struct file *file,
4398                          char __user *buffer,
4399                          size_t len,
4400                          loff_t *offset);
4401
4402static ssize_t proc_write( struct file *file,
4403                           const char __user *buffer,
4404                           size_t len,
4405                           loff_t *offset );
4406static int proc_close( struct inode *inode, struct file *file );
4407
4408static int proc_stats_open( struct inode *inode, struct file *file );
4409static int proc_statsdelta_open( struct inode *inode, struct file *file );
4410static int proc_status_open( struct inode *inode, struct file *file );
4411static int proc_SSID_open( struct inode *inode, struct file *file );
4412static int proc_APList_open( struct inode *inode, struct file *file );
4413static int proc_BSSList_open( struct inode *inode, struct file *file );
4414static int proc_config_open( struct inode *inode, struct file *file );
4415static int proc_wepkey_open( struct inode *inode, struct file *file );
4416
4417static const struct file_operations proc_statsdelta_ops = {
4418        .owner          = THIS_MODULE,
4419        .read           = proc_read,
4420        .open           = proc_statsdelta_open,
4421        .release        = proc_close
4422};
4423
4424static const struct file_operations proc_stats_ops = {
4425        .owner          = THIS_MODULE,
4426        .read           = proc_read,
4427        .open           = proc_stats_open,
4428        .release        = proc_close
4429};
4430
4431static const struct file_operations proc_status_ops = {
4432        .owner          = THIS_MODULE,
4433        .read           = proc_read,
4434        .open           = proc_status_open,
4435        .release        = proc_close
4436};
4437
4438static const struct file_operations proc_SSID_ops = {
4439        .owner          = THIS_MODULE,
4440        .read           = proc_read,
4441        .write          = proc_write,
4442        .open           = proc_SSID_open,
4443        .release        = proc_close
4444};
4445
4446static const struct file_operations proc_BSSList_ops = {
4447        .owner          = THIS_MODULE,
4448        .read           = proc_read,
4449        .write          = proc_write,
4450        .open           = proc_BSSList_open,
4451        .release        = proc_close
4452};
4453
4454static const struct file_operations proc_APList_ops = {
4455        .owner          = THIS_MODULE,
4456        .read           = proc_read,
4457        .write          = proc_write,
4458        .open           = proc_APList_open,
4459        .release        = proc_close
4460};
4461
4462static const struct file_operations proc_config_ops = {
4463        .owner          = THIS_MODULE,
4464        .read           = proc_read,
4465        .write          = proc_write,
4466        .open           = proc_config_open,
4467        .release        = proc_close
4468};
4469
4470static const struct file_operations proc_wepkey_ops = {
4471        .owner          = THIS_MODULE,
4472        .read           = proc_read,
4473        .write          = proc_write,
4474        .open           = proc_wepkey_open,
4475        .release        = proc_close
4476};
4477
4478static struct proc_dir_entry *airo_entry;
4479
4480struct proc_data {
4481        int release_buffer;
4482        int readlen;
4483        char *rbuffer;
4484        int writelen;
4485        int maxwritelen;
4486        char *wbuffer;
4487        void (*on_close) (struct inode *, struct file *);
4488};
4489
4490static int setup_proc_entry( struct net_device *dev,
4491                             struct airo_info *apriv ) {
4492        struct proc_dir_entry *entry;
4493        /* First setup the device directory */
4494        strcpy(apriv->proc_name,dev->name);
4495        apriv->proc_entry = create_proc_entry(apriv->proc_name,
4496                                              S_IFDIR|airo_perm,
4497                                              airo_entry);
4498        if (!apriv->proc_entry)
4499                goto fail;
4500        apriv->proc_entry->uid = proc_uid;
4501        apriv->proc_entry->gid = proc_gid;
4502
4503        /* Setup the StatsDelta */
4504        entry = proc_create_data("StatsDelta",
4505                                 S_IFREG | (S_IRUGO&proc_perm),
4506                                 apriv->proc_entry, &proc_statsdelta_ops, dev);
4507        if (!entry)
4508                goto fail_stats_delta;
4509        entry->uid = proc_uid;
4510        entry->gid = proc_gid;
4511
4512        /* Setup the Stats */
4513        entry = proc_create_data("Stats",
4514                                 S_IFREG | (S_IRUGO&proc_perm),
4515                                 apriv->proc_entry, &proc_stats_ops, dev);
4516        if (!entry)
4517                goto fail_stats;
4518        entry->uid = proc_uid;
4519        entry->gid = proc_gid;
4520
4521        /* Setup the Status */
4522        entry = proc_create_data("Status",
4523                                 S_IFREG | (S_IRUGO&proc_perm),
4524                                 apriv->proc_entry, &proc_status_ops, dev);
4525        if (!entry)
4526                goto fail_status;
4527        entry->uid = proc_uid;
4528        entry->gid = proc_gid;
4529
4530        /* Setup the Config */
4531        entry = proc_create_data("Config",
4532                                 S_IFREG | proc_perm,
4533                                 apriv->proc_entry, &proc_config_ops, dev);
4534        if (!entry)
4535                goto fail_config;
4536        entry->uid = proc_uid;
4537        entry->gid = proc_gid;
4538
4539        /* Setup the SSID */
4540        entry = proc_create_data("SSID",
4541                                 S_IFREG | proc_perm,
4542                                 apriv->proc_entry, &proc_SSID_ops, dev);
4543        if (!entry)
4544                goto fail_ssid;
4545        entry->uid = proc_uid;
4546        entry->gid = proc_gid;
4547
4548        /* Setup the APList */
4549        entry = proc_create_data("APList",
4550                                 S_IFREG | proc_perm,
4551                                 apriv->proc_entry, &proc_APList_ops, dev);
4552        if (!entry)
4553                goto fail_aplist;
4554        entry->uid = proc_uid;
4555        entry->gid = proc_gid;
4556
4557        /* Setup the BSSList */
4558        entry = proc_create_data("BSSList",
4559                                 S_IFREG | proc_perm,
4560                                 apriv->proc_entry, &proc_BSSList_ops, dev);
4561        if (!entry)
4562                goto fail_bsslist;
4563        entry->uid = proc_uid;
4564        entry->gid = proc_gid;
4565
4566        /* Setup the WepKey */
4567        entry = proc_create_data("WepKey",
4568                                 S_IFREG | proc_perm,
4569                                 apriv->proc_entry, &proc_wepkey_ops, dev);
4570        if (!entry)
4571                goto fail_wepkey;
4572        entry->uid = proc_uid;
4573        entry->gid = proc_gid;
4574
4575        return 0;
4576
4577fail_wepkey:
4578        remove_proc_entry("BSSList", apriv->proc_entry);
4579fail_bsslist:
4580        remove_proc_entry("APList", apriv->proc_entry);
4581fail_aplist:
4582        remove_proc_entry("SSID", apriv->proc_entry);
4583fail_ssid:
4584        remove_proc_entry("Config", apriv->proc_entry);
4585fail_config:
4586        remove_proc_entry("Status", apriv->proc_entry);
4587fail_status:
4588        remove_proc_entry("Stats", apriv->proc_entry);
4589fail_stats:
4590        remove_proc_entry("StatsDelta", apriv->proc_entry);
4591fail_stats_delta:
4592        remove_proc_entry(apriv->proc_name, airo_entry);
4593fail:
4594        return -ENOMEM;
4595}
4596
4597static int takedown_proc_entry( struct net_device *dev,
4598                                struct airo_info *apriv ) {
4599        if ( !apriv->proc_entry->namelen ) return 0;
4600        remove_proc_entry("Stats",apriv->proc_entry);
4601        remove_proc_entry("StatsDelta",apriv->proc_entry);
4602        remove_proc_entry("Status",apriv->proc_entry);
4603        remove_proc_entry("Config",apriv->proc_entry);
4604        remove_proc_entry("SSID",apriv->proc_entry);
4605        remove_proc_entry("APList",apriv->proc_entry);
4606        remove_proc_entry("BSSList",apriv->proc_entry);
4607        remove_proc_entry("WepKey",apriv->proc_entry);
4608        remove_proc_entry(apriv->proc_name,airo_entry);
4609        return 0;
4610}
4611
4612/*
4613 *  What we want from the proc_fs is to be able to efficiently read
4614 *  and write the configuration.  To do this, we want to read the
4615 *  configuration when the file is opened and write it when the file is
4616 *  closed.  So basically we allocate a read buffer at open and fill it
4617 *  with data, and allocate a write buffer and read it at close.
4618 */
4619
4620/*
4621 *  The read routine is generic, it relies on the preallocated rbuffer
4622 *  to supply the data.
4623 */
4624static ssize_t proc_read( struct file *file,
4625                          char __user *buffer,
4626                          size_t len,
4627                          loff_t *offset )
4628{
4629        struct proc_data *priv = file->private_data;
4630
4631        if (!priv->rbuffer)
4632                return -EINVAL;
4633
4634        return simple_read_from_buffer(buffer, len, offset, priv->rbuffer,
4635                                        priv->readlen);
4636}
4637
4638/*
4639 *  The write routine is generic, it fills in a preallocated rbuffer
4640 *  to supply the data.
4641 */
4642static ssize_t proc_write( struct file *file,
4643                           const char __user *buffer,
4644                           size_t len,
4645                           loff_t *offset )
4646{
4647        loff_t pos = *offset;
4648        struct proc_data *priv = (struct proc_data*)file->private_data;
4649
4650        if (!priv->wbuffer)
4651                return -EINVAL;
4652
4653        if (pos < 0)
4654                return -EINVAL;
4655        if (pos >= priv->maxwritelen)
4656                return 0;
4657        if (len > priv->maxwritelen - pos)
4658                len = priv->maxwritelen - pos;
4659        if (copy_from_user(priv->wbuffer + pos, buffer, len))
4660                return -EFAULT;
4661        if ( pos + len > priv->writelen )
4662                priv->writelen = len + file->f_pos;
4663        *offset = pos + len;
4664        return len;
4665}
4666
4667static int proc_status_open(struct inode *inode, struct file *file)
4668{
4669        struct proc_data *data;
4670        struct proc_dir_entry *dp = PDE(inode);
4671        struct net_device *dev = dp->data;
4672        struct airo_info *apriv = dev->ml_priv;
4673        CapabilityRid cap_rid;
4674        StatusRid status_rid;
4675        u16 mode;
4676        int i;
4677
4678        if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
4679                return -ENOMEM;
4680        data = (struct proc_data *)file->private_data;
4681        if ((data->rbuffer = kmalloc( 2048, GFP_KERNEL )) == NULL) {
4682                kfree (file->private_data);
4683                return -ENOMEM;
4684        }
4685
4686        readStatusRid(apriv, &status_rid, 1);
4687        readCapabilityRid(apriv, &cap_rid, 1);
4688
4689        mode = le16_to_cpu(status_rid.mode);
4690
4691        i = sprintf(data->rbuffer, "Status: %s%s%s%s%s%s%s%s%s\n",
4692                    mode & 1 ? "CFG ": "",
4693                    mode & 2 ? "ACT ": "",
4694                    mode & 0x10 ? "SYN ": "",
4695                    mode & 0x20 ? "LNK ": "",
4696                    mode & 0x40 ? "LEAP ": "",
4697                    mode & 0x80 ? "PRIV ": "",
4698                    mode & 0x100 ? "KEY ": "",
4699                    mode & 0x200 ? "WEP ": "",
4700                    mode & 0x8000 ? "ERR ": "");
4701        sprintf( data->rbuffer+i, "Mode: %x\n"
4702                 "Signal Strength: %d\n"
4703                 "Signal Quality: %d\n"
4704                 "SSID: %-.*s\n"
4705                 "AP: %-.16s\n"
4706                 "Freq: %d\n"
4707                 "BitRate: %dmbs\n"
4708                 "Driver Version: %s\n"
4709                 "Device: %s\nManufacturer: %s\nFirmware Version: %s\n"
4710                 "Radio type: %x\nCountry: %x\nHardware Version: %x\n"
4711                 "Software Version: %x\nSoftware Subversion: %x\n"
4712                 "Boot block version: %x\n",
4713                 le16_to_cpu(status_rid.mode),
4714                 le16_to_cpu(status_rid.normalizedSignalStrength),
4715                 le16_to_cpu(status_rid.signalQuality),
4716                 le16_to_cpu(status_rid.SSIDlen),
4717                 status_rid.SSID,
4718                 status_rid.apName,
4719                 le16_to_cpu(status_rid.channel),
4720                 le16_to_cpu(status_rid.currentXmitRate) / 2,
4721                 version,
4722                 cap_rid.prodName,
4723                 cap_rid.manName,
4724                 cap_rid.prodVer,
4725                 le16_to_cpu(cap_rid.radioType),
4726                 le16_to_cpu(cap_rid.country),
4727                 le16_to_cpu(cap_rid.hardVer),
4728                 le16_to_cpu(cap_rid.softVer),
4729                 le16_to_cpu(cap_rid.softSubVer),
4730                 le16_to_cpu(cap_rid.bootBlockVer));
4731        data->readlen = strlen( data->rbuffer );
4732        return 0;
4733}
4734
4735static int proc_stats_rid_open(struct inode*, struct file*, u16);
4736static int proc_statsdelta_open( struct inode *inode,
4737                                 struct file *file ) {
4738        if (file->f_mode&FMODE_WRITE) {
4739                return proc_stats_rid_open(inode, file, RID_STATSDELTACLEAR);
4740        }
4741        return proc_stats_rid_open(inode, file, RID_STATSDELTA);
4742}
4743
4744static int proc_stats_open( struct inode *inode, struct file *file ) {
4745        return proc_stats_rid_open(inode, file, RID_STATS);
4746}
4747
4748static int proc_stats_rid_open( struct inode *inode,
4749                                struct file *file,
4750                                u16 rid )
4751{
4752        struct proc_data *data;
4753        struct proc_dir_entry *dp = PDE(inode);
4754        struct net_device *dev = dp->data;
4755        struct airo_info *apriv = dev->ml_priv;
4756        StatsRid stats;
4757        int i, j;
4758        __le32 *vals = stats.vals;
4759        int len;
4760
4761        if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
4762                return -ENOMEM;
4763        data = (struct proc_data *)file->private_data;
4764        if ((data->rbuffer = kmalloc( 4096, GFP_KERNEL )) == NULL) {
4765                kfree (file->private_data);
4766                return -ENOMEM;
4767        }
4768
4769        readStatsRid(apriv, &stats, rid, 1);
4770        len = le16_to_cpu(stats.len);
4771
4772        j = 0;
4773        for(i=0; statsLabels[i]!=(char *)-1 && i*4<len; i++) {
4774                if (!statsLabels[i]) continue;
4775                if (j+strlen(statsLabels[i])+16>4096) {
4776                        airo_print_warn(apriv->dev->name,
4777                               "Potentially disasterous buffer overflow averted!");
4778                        break;
4779                }
4780                j+=sprintf(data->rbuffer+j, "%s: %u\n", statsLabels[i],
4781                                le32_to_cpu(vals[i]));
4782        }
4783        if (i*4 >= len) {
4784                airo_print_warn(apriv->dev->name, "Got a short rid");
4785        }
4786        data->readlen = j;
4787        return 0;
4788}
4789
4790static int get_dec_u16( char *buffer, int *start, int limit ) {
4791        u16 value;
4792        int valid = 0;
4793        for (value = 0; *start < limit && buffer[*start] >= '0' &&
4794                        buffer[*start] <= '9'; (*start)++) {
4795                valid = 1;
4796                value *= 10;
4797                value += buffer[*start] - '0';
4798        }
4799        if ( !valid ) return -1;
4800        return value;
4801}
4802
4803static int airo_config_commit(struct net_device *dev,
4804                              struct iw_request_info *info, void *zwrq,
4805                              char *extra);
4806
4807static inline int sniffing_mode(struct airo_info *ai)
4808{
4809        return le16_to_cpu(ai->config.rmode & RXMODE_MASK) >=
4810                le16_to_cpu(RXMODE_RFMON);
4811}
4812
4813static void proc_config_on_close(struct inode *inode, struct file *file)
4814{
4815        struct proc_data *data = file->private_data;
4816        struct proc_dir_entry *dp = PDE(inode);
4817        struct net_device *dev = dp->data;
4818        struct airo_info *ai = dev->ml_priv;
4819        char *line;
4820
4821        if ( !data->writelen ) return;
4822
4823        readConfigRid(ai, 1);
4824        set_bit (FLAG_COMMIT, &ai->flags);
4825
4826        line = data->wbuffer;
4827        while( line[0] ) {
4828/*** Mode processing */
4829                if ( !strncmp( line, "Mode: ", 6 ) ) {
4830                        line += 6;
4831                        if (sniffing_mode(ai))
4832                                set_bit (FLAG_RESET, &ai->flags);
4833                        ai->config.rmode &= ~RXMODE_FULL_MASK;
4834                        clear_bit (FLAG_802_11, &ai->flags);
4835                        ai->config.opmode &= ~MODE_CFG_MASK;
4836                        ai->config.scanMode = SCANMODE_ACTIVE;
4837                        if ( line[0] == 'a' ) {
4838                                ai->config.opmode |= MODE_STA_IBSS;
4839                        } else {
4840                                ai->config.opmode |= MODE_STA_ESS;
4841                                if ( line[0] == 'r' ) {
4842                                        ai->config.rmode |= RXMODE_RFMON | RXMODE_DISABLE_802_3_HEADER;
4843                                        ai->config.scanMode = SCANMODE_PASSIVE;
4844                                        set_bit (FLAG_802_11, &ai->flags);
4845                                } else if ( line[0] == 'y' ) {
4846                                        ai->config.rmode |= RXMODE_RFMON_ANYBSS | RXMODE_DISABLE_802_3_HEADER;
4847                                        ai->config.scanMode = SCANMODE_PASSIVE;
4848                                        set_bit (FLAG_802_11, &ai->flags);
4849                                } else if ( line[0] == 'l' )
4850                                        ai->config.rmode |= RXMODE_LANMON;
4851                        }
4852                        set_bit (FLAG_COMMIT, &ai->flags);
4853                }
4854
4855/*** Radio status */
4856                else if (!strncmp(line,"Radio: ", 7)) {
4857                        line += 7;
4858                        if (!strncmp(line,"off",3)) {
4859                                set_bit (FLAG_RADIO_OFF, &ai->flags);
4860                        } else {
4861                                clear_bit (FLAG_RADIO_OFF, &ai->flags);
4862                        }
4863                }
4864/*** NodeName processing */
4865                else if ( !strncmp( line, "NodeName: ", 10 ) ) {
4866                        int j;
4867
4868                        line += 10;
4869                        memset( ai->config.nodeName, 0, 16 );
4870/* Do the name, assume a space between the mode and node name */
4871                        for( j = 0; j < 16 && line[j] != '\n'; j++ ) {
4872                                ai->config.nodeName[j] = line[j];
4873                        }
4874                        set_bit (FLAG_COMMIT, &ai->flags);
4875                }
4876
4877/*** PowerMode processing */
4878                else if ( !strncmp( line, "PowerMode: ", 11 ) ) {
4879                        line += 11;
4880                        if ( !strncmp( line, "PSPCAM", 6 ) ) {
4881                                ai->config.powerSaveMode = POWERSAVE_PSPCAM;
4882                                set_bit (FLAG_COMMIT, &ai->flags);
4883                        } else if ( !strncmp( line, "PSP", 3 ) ) {
4884                                ai->config.powerSaveMode = POWERSAVE_PSP;
4885                                set_bit (FLAG_COMMIT, &ai->flags);
4886                        } else {
4887                                ai->config.powerSaveMode = POWERSAVE_CAM;
4888                                set_bit (FLAG_COMMIT, &ai->flags);
4889                        }
4890                } else if ( !strncmp( line, "DataRates: ", 11 ) ) {
4891                        int v, i = 0, k = 0; /* i is index into line,
4892                                                k is index to rates */
4893
4894                        line += 11;
4895                        while((v = get_dec_u16(line, &i, 3))!=-1) {
4896                                ai->config.rates[k++] = (u8)v;
4897                                line += i + 1;
4898                                i = 0;
4899                        }
4900                        set_bit (FLAG_COMMIT, &ai->flags);
4901                } else if ( !strncmp( line, "Channel: ", 9 ) ) {
4902                        int v, i = 0;
4903                        line += 9;
4904                        v = get_dec_u16(line, &i, i+3);
4905                        if ( v != -1 ) {
4906                                ai->config.channelSet = cpu_to_le16(v);
4907                                set_bit (FLAG_COMMIT, &ai->flags);
4908                        }
4909                } else if ( !strncmp( line, "XmitPower: ", 11 ) ) {
4910                        int v, i = 0;
4911                        line += 11;
4912                        v = get_dec_u16(line, &i, i+3);
4913                        if ( v != -1 ) {
4914                                ai->config.txPower = cpu_to_le16(v);
4915                                set_bit (FLAG_COMMIT, &ai->flags);
4916                        }
4917                } else if ( !strncmp( line, "WEP: ", 5 ) ) {
4918                        line += 5;
4919                        switch( line[0] ) {
4920                        case 's':
4921                                ai->config.authType = AUTH_SHAREDKEY;
4922                                break;
4923                        case 'e':
4924                                ai->config.authType = AUTH_ENCRYPT;
4925                                break;
4926                        default:
4927                                ai->config.authType = AUTH_OPEN;
4928                                break;
4929                        }
4930                        set_bit (FLAG_COMMIT, &ai->flags);
4931                } else if ( !strncmp( line, "LongRetryLimit: ", 16 ) ) {
4932                        int v, i = 0;
4933
4934                        line += 16;
4935                        v = get_dec_u16(line, &i, 3);
4936                        v = (v<0) ? 0 : ((v>255) ? 255 : v);
4937                        ai->config.longRetryLimit = cpu_to_le16(v);
4938                        set_bit (FLAG_COMMIT, &ai->flags);
4939                } else if ( !strncmp( line, "ShortRetryLimit: ", 17 ) ) {
4940                        int v, i = 0;
4941
4942                        line += 17;
4943                        v = get_dec_u16(line, &i, 3);
4944                        v = (v<0) ? 0 : ((v>255) ? 255 : v);
4945                        ai->config.shortRetryLimit = cpu_to_le16(v);
4946                        set_bit (FLAG_COMMIT, &ai->flags);
4947                } else if ( !strncmp( line, "RTSThreshold: ", 14 ) ) {
4948                        int v, i = 0;
4949
4950                        line += 14;
4951                        v = get_dec_u16(line, &i, 4);
4952                        v = (v<0) ? 0 : ((v>AIRO_DEF_MTU) ? AIRO_DEF_MTU : v);
4953                        ai->config.rtsThres = cpu_to_le16(v);
4954                        set_bit (FLAG_COMMIT, &ai->flags);
4955                } else if ( !strncmp( line, "TXMSDULifetime: ", 16 ) ) {
4956                        int v, i = 0;
4957
4958                        line += 16;
4959                        v = get_dec_u16(line, &i, 5);
4960                        v = (v<0) ? 0 : v;
4961                        ai->config.txLifetime = cpu_to_le16(v);
4962                        set_bit (FLAG_COMMIT, &ai->flags);
4963                } else if ( !strncmp( line, "RXMSDULifetime: ", 16 ) ) {
4964                        int v, i = 0;
4965
4966                        line += 16;
4967                        v = get_dec_u16(line, &i, 5);
4968                        v = (v<0) ? 0 : v;
4969                        ai->config.rxLifetime = cpu_to_le16(v);
4970                        set_bit (FLAG_COMMIT, &ai->flags);
4971                } else if ( !strncmp( line, "TXDiversity: ", 13 ) ) {
4972                        ai->config.txDiversity =
4973                                (line[13]=='l') ? 1 :
4974                                ((line[13]=='r')? 2: 3);
4975                        set_bit (FLAG_COMMIT, &ai->flags);
4976                } else if ( !strncmp( line, "RXDiversity: ", 13 ) ) {
4977                        ai->config.rxDiversity =
4978                                (line[13]=='l') ? 1 :
4979                                ((line[13]=='r')? 2: 3);
4980                        set_bit (FLAG_COMMIT, &ai->flags);
4981                } else if ( !strncmp( line, "FragThreshold: ", 15 ) ) {
4982                        int v, i = 0;
4983
4984                        line += 15;
4985                        v = get_dec_u16(line, &i, 4);
4986                        v = (v<256) ? 256 : ((v>AIRO_DEF_MTU) ? AIRO_DEF_MTU : v);
4987                        v = v & 0xfffe; /* Make sure its even */
4988                        ai->config.fragThresh = cpu_to_le16(v);
4989                        set_bit (FLAG_COMMIT, &ai->flags);
4990                } else if (!strncmp(line, "Modulation: ", 12)) {
4991                        line += 12;
4992                        switch(*line) {
4993                        case 'd':  ai->config.modulation=MOD_DEFAULT; set_bit(FLAG_COMMIT, &ai->flags); break;
4994                        case 'c':  ai->config.modulation=MOD_CCK; set_bit(FLAG_COMMIT, &ai->flags); break;
4995                        case 'm':  ai->config.modulation=MOD_MOK; set_bit(FLAG_COMMIT, &ai->flags); break;
4996                        default: airo_print_warn(ai->dev->name, "Unknown modulation");
4997                        }
4998                } else if (!strncmp(line, "Preamble: ", 10)) {
4999                        line += 10;
5000                        switch(*line) {
5001                        case 'a': ai->config.preamble=PREAMBLE_AUTO; set_bit(FLAG_COMMIT, &ai->flags); break;
5002                        case 'l': ai->config.preamble=PREAMBLE_LONG; set_bit(FLAG_COMMIT, &ai->flags); break;
5003                        case 's': ai->config.preamble=PREAMBLE_SHORT; set_bit(FLAG_COMMIT, &ai->flags); break;
5004                        default: airo_print_warn(ai->dev->name, "Unknown preamble");
5005                        }
5006                } else {
5007                        airo_print_warn(ai->dev->name, "Couldn't figure out %s", line);
5008                }
5009                while( line[0] && line[0] != '\n' ) line++;
5010                if ( line[0] ) line++;
5011        }
5012        airo_config_commit(dev, NULL, NULL, NULL);
5013}
5014
5015static char *get_rmode(__le16 mode)
5016{
5017        switch(mode & RXMODE_MASK) {
5018        case RXMODE_RFMON:  return "rfmon";
5019        case RXMODE_RFMON_ANYBSS:  return "yna (any) bss rfmon";
5020        case RXMODE_LANMON:  return "lanmon";
5021        }
5022        return "ESS";
5023}
5024
5025static int proc_config_open(struct inode *inode, struct file *file)
5026{
5027        struct proc_data *data;
5028        struct proc_dir_entry *dp = PDE(inode);
5029        struct net_device *dev = dp->data;
5030        struct airo_info *ai = dev->ml_priv;
5031        int i;
5032        __le16 mode;
5033
5034        if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
5035                return -ENOMEM;
5036        data = (struct proc_data *)file->private_data;
5037        if ((data->rbuffer = kmalloc( 2048, GFP_KERNEL )) == NULL) {
5038                kfree (file->private_data);
5039                return -ENOMEM;
5040        }
5041        if ((data->wbuffer = kzalloc( 2048, GFP_KERNEL )) == NULL) {
5042                kfree (data->rbuffer);
5043                kfree (file->private_data);
5044                return -ENOMEM;
5045        }
5046        data->maxwritelen = 2048;
5047        data->on_close = proc_config_on_close;
5048
5049        readConfigRid(ai, 1);
5050
5051        mode = ai->config.opmode & MODE_CFG_MASK;
5052        i = sprintf( data->rbuffer,
5053                     "Mode: %s\n"
5054                     "Radio: %s\n"
5055                     "NodeName: %-16s\n"
5056                     "PowerMode: %s\n"
5057                     "DataRates: %d %d %d %d %d %d %d %d\n"
5058                     "Channel: %d\n"
5059                     "XmitPower: %d\n",
5060                     mode == MODE_STA_IBSS ? "adhoc" :
5061                     mode == MODE_STA_ESS ? get_rmode(ai->config.rmode):
5062                     mode == MODE_AP ? "AP" :
5063                     mode == MODE_AP_RPTR ? "AP RPTR" : "Error",
5064                     test_bit(FLAG_RADIO_OFF, &ai->flags) ? "off" : "on",
5065                     ai->config.nodeName,
5066                     ai->config.powerSaveMode == POWERSAVE_CAM ? "CAM" :
5067                     ai->config.powerSaveMode == POWERSAVE_PSP ? "PSP" :
5068                     ai->config.powerSaveMode == POWERSAVE_PSPCAM ? "PSPCAM" :
5069                     "Error",
5070                     (int)ai->config.rates[0],
5071                     (int)ai->config.rates[1],
5072                     (int)ai->config.rates[2],
5073                     (int)ai->config.rates[3],
5074                     (int)ai->config.rates[4],
5075                     (int)ai->config.rates[5],
5076                     (int)ai->config.rates[6],
5077                     (int)ai->config.rates[7],
5078                     le16_to_cpu(ai->config.channelSet),
5079                     le16_to_cpu(ai->config.