1/* main.c - (formerly known as dldwd_cs.c, orinoco_cs.c and orinoco.c)
   2 *
   3 * A driver for Hermes or Prism 2 chipset based PCMCIA wireless
   4 * adaptors, with Lucent/Agere, Intersil or Symbol firmware.
   5 *
   6 * Current maintainers (as of 29 September 2003) are:
   7 *	Pavel Roskin <proski AT gnu.org>
   8 * and	David Gibson <hermes AT gibson.dropbear.id.au>
   9 *
  10 * (C) Copyright David Gibson, IBM Corporation 2001-2003.
  11 * Copyright (C) 2000 David Gibson, Linuxcare Australia.
  12 *	With some help from :
  13 * Copyright (C) 2001 Jean Tourrilhes, HP Labs
  14 * Copyright (C) 2001 Benjamin Herrenschmidt
  15 *
  16 * Based on dummy_cs.c 1.27 2000/06/12 21:27:25
  17 *
  18 * Portions based on wvlan_cs.c 1.0.6, Copyright Andreas Neuhaus <andy
  19 * AT fasta.fh-dortmund.de>
  20 *      http://www.stud.fh-dortmund.de/~andy/wvlan/
  21 *
  22 * The contents of this file are subject to the Mozilla Public License
  23 * Version 1.1 (the "License"); you may not use this file except in
  24 * compliance with the License. You may obtain a copy of the License
  25 * at http://www.mozilla.org/MPL/
  26 *
  27 * Software distributed under the License is distributed on an "AS IS"
  28 * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
  29 * the License for the specific language governing rights and
  30 * limitations under the License.
  31 *
  32 * The initial developer of the original code is David A. Hinds
  33 * <dahinds AT users.sourceforge.net>.  Portions created by David
  34 * A. Hinds are Copyright (C) 1999 David A. Hinds.  All Rights
  35 * Reserved.
  36 *
  37 * Alternatively, the contents of this file may be used under the
  38 * terms of the GNU General Public License version 2 (the "GPL"), in
  39 * which case the provisions of the GPL are applicable instead of the
  40 * above.  If you wish to allow the use of your version of this file
  41 * only under the terms of the GPL and not to allow others to use your
  42 * version of this file under the MPL, indicate your decision by
  43 * deleting the provisions above and replace them with the notice and
  44 * other provisions required by the GPL.  If you do not delete the
  45 * provisions above, a recipient may use your version of this file
  46 * under either the MPL or the GPL.  */
  47
  48/*
  49 * TODO
  50 *	o Handle de-encapsulation within network layer, provide 802.11
  51 *	  headers (patch from Thomas 'Dent' Mirlacher)
  52 *	o Fix possible races in SPY handling.
  53 *	o Disconnect wireless extensions from fundamental configuration.
  54 *	o (maybe) Software WEP support (patch from Stano Meduna).
  55 *	o (maybe) Use multiple Tx buffers - driver handling queue
  56 *	  rather than firmware.
  57 */
  58
  59/* Locking and synchronization:
  60 *
  61 * The basic principle is that everything is serialized through a
  62 * single spinlock, priv->lock.  The lock is used in user, bh and irq
  63 * context, so when taken outside hardirq context it should always be
  64 * taken with interrupts disabled.  The lock protects both the
  65 * hardware and the struct orinoco_private.
  66 *
  67 * Another flag, priv->hw_unavailable indicates that the hardware is
  68 * unavailable for an extended period of time (e.g. suspended, or in
  69 * the middle of a hard reset).  This flag is protected by the
  70 * spinlock.  All code which touches the hardware should check the
  71 * flag after taking the lock, and if it is set, give up on whatever
  72 * they are doing and drop the lock again.  The orinoco_lock()
  73 * function handles this (it unlocks and returns -EBUSY if
  74 * hw_unavailable is non-zero).
  75 */
  76
  77#define DRIVER_NAME "orinoco"
  78
  79#include <linux/module.h>
  80#include <linux/kernel.h>
  81#include <linux/slab.h>
  82#include <linux/init.h>
  83#include <linux/delay.h>
  84#include <linux/device.h>
  85#include <linux/netdevice.h>
  86#include <linux/etherdevice.h>
  87#include <linux/suspend.h>
  88#include <linux/if_arp.h>
  89#include <linux/wireless.h>
  90#include <linux/ieee80211.h>
  91#include <net/iw_handler.h>
  92#include <net/cfg80211.h>
  93
  94#include "hermes_rid.h"
  95#include "hermes_dld.h"
  96#include "hw.h"
  97#include "scan.h"
  98#include "mic.h"
  99#include "fw.h"
 100#include "wext.h"
 101#include "cfg.h"
 102#include "main.h"
 103
 104#include "orinoco.h"
 105
 106/********************************************************************/
 107/* Module information                                               */
 108/********************************************************************/
 109
 110MODULE_AUTHOR("Pavel Roskin <proski@gnu.org> & "
 111	      "David Gibson <hermes@gibson.dropbear.id.au>");
 112MODULE_DESCRIPTION("Driver for Lucent Orinoco, Prism II based "
 113		   "and similar wireless cards");
 114MODULE_LICENSE("Dual MPL/GPL");
 115
 116/* Level of debugging. Used in the macros in orinoco.h */
 117#ifdef ORINOCO_DEBUG
 118int orinoco_debug = ORINOCO_DEBUG;
 119EXPORT_SYMBOL(orinoco_debug);
 120module_param(orinoco_debug, int, 0644);
 121MODULE_PARM_DESC(orinoco_debug, "Debug level");
 122#endif
 123
 124static bool suppress_linkstatus; /* = 0 */
 125module_param(suppress_linkstatus, bool, 0644);
 126MODULE_PARM_DESC(suppress_linkstatus, "Don't log link status changes");
 127
 128static int ignore_disconnect; /* = 0 */
 129module_param(ignore_disconnect, int, 0644);
 130MODULE_PARM_DESC(ignore_disconnect,
 131		 "Don't report lost link to the network layer");
 132
 133int force_monitor; /* = 0 */
 134module_param(force_monitor, int, 0644);
 135MODULE_PARM_DESC(force_monitor, "Allow monitor mode for all firmware versions");
 136
 137/********************************************************************/
 138/* Internal constants                                               */
 139/********************************************************************/
 140
 141/* 802.2 LLC/SNAP header used for Ethernet encapsulation over 802.11 */
 142static const u8 encaps_hdr[] = {0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00};
 143#define ENCAPS_OVERHEAD		(sizeof(encaps_hdr) + 2)
 144
 145#define ORINOCO_MIN_MTU		256
 146#define ORINOCO_MAX_MTU		(IEEE80211_MAX_DATA_LEN - ENCAPS_OVERHEAD)
 147
 148#define MAX_IRQLOOPS_PER_IRQ	10
 149#define MAX_IRQLOOPS_PER_JIFFY	(20000 / HZ)	/* Based on a guestimate of
 150						 * how many events the
 151						 * device could
 152						 * legitimately generate */
 153
 154#define DUMMY_FID		0xFFFF
 155
 156/*#define MAX_MULTICAST(priv)	(priv->firmware_type == FIRMWARE_TYPE_AGERE ? \
 157  HERMES_MAX_MULTICAST : 0)*/
 158#define MAX_MULTICAST(priv)	(HERMES_MAX_MULTICAST)
 159
 160#define ORINOCO_INTEN		(HERMES_EV_RX | HERMES_EV_ALLOC \
 161				 | HERMES_EV_TX | HERMES_EV_TXEXC \
 162				 | HERMES_EV_WTERR | HERMES_EV_INFO \
 163				 | HERMES_EV_INFDROP)
 164
 165/********************************************************************/
 166/* Data types                                                       */
 167/********************************************************************/
 168
 169/* Beginning of the Tx descriptor, used in TxExc handling */
 170struct hermes_txexc_data {
 171	struct hermes_tx_descriptor desc;
 172	__le16 frame_ctl;
 173	__le16 duration_id;
 174	u8 addr1[ETH_ALEN];
 175} __packed;
 176
 177/* Rx frame header except compatibility 802.3 header */
 178struct hermes_rx_descriptor {
 179	/* Control */
 180	__le16 status;
 181	__le32 time;
 182	u8 silence;
 183	u8 signal;
 184	u8 rate;
 185	u8 rxflow;
 186	__le32 reserved;
 187
 188	/* 802.11 header */
 189	__le16 frame_ctl;
 190	__le16 duration_id;
 191	u8 addr1[ETH_ALEN];
 192	u8 addr2[ETH_ALEN];
 193	u8 addr3[ETH_ALEN];
 194	__le16 seq_ctl;
 195	u8 addr4[ETH_ALEN];
 196
 197	/* Data length */
 198	__le16 data_len;
 199} __packed;
 200
 201struct orinoco_rx_data {
 202	struct hermes_rx_descriptor *desc;
 203	struct sk_buff *skb;
 204	struct list_head list;
 205};
 206
 207struct orinoco_scan_data {
 208	void *buf;
 209	size_t len;
 210	int type;
 211	struct list_head list;
 212};
 213
 214/********************************************************************/
 215/* Function prototypes                                              */
 216/********************************************************************/
 217
 218static int __orinoco_set_multicast_list(struct net_device *dev);
 219static int __orinoco_up(struct orinoco_private *priv);
 220static int __orinoco_down(struct orinoco_private *priv);
 221static int __orinoco_commit(struct orinoco_private *priv);
 222
 223/********************************************************************/
 224/* Internal helper functions                                        */
 225/********************************************************************/
 226
 227void set_port_type(struct orinoco_private *priv)
 228{
 229	switch (priv->iw_mode) {
 230	case NL80211_IFTYPE_STATION:
 231		priv->port_type = 1;
 232		priv->createibss = 0;
 233		break;
 234	case NL80211_IFTYPE_ADHOC:
 235		if (priv->prefer_port3) {
 236			priv->port_type = 3;
 237			priv->createibss = 0;
 238		} else {
 239			priv->port_type = priv->ibss_port;
 240			priv->createibss = 1;
 241		}
 242		break;
 243	case NL80211_IFTYPE_MONITOR:
 244		priv->port_type = 3;
 245		priv->createibss = 0;
 246		break;
 247	default:
 248		printk(KERN_ERR "%s: Invalid priv->iw_mode in set_port_type()\n",
 249		       priv->ndev->name);
 250	}
 251}
 252
 253/********************************************************************/
 254/* Device methods                                                   */
 255/********************************************************************/
 256
 257int orinoco_open(struct net_device *dev)
 258{
 259	struct orinoco_private *priv = ndev_priv(dev);
 260	unsigned long flags;
 261	int err;
 262
 263	if (orinoco_lock(priv, &flags) != 0)
 264		return -EBUSY;
 265
 266	err = __orinoco_up(priv);
 267
 268	if (!err)
 269		priv->open = 1;
 270
 271	orinoco_unlock(priv, &flags);
 272
 273	return err;
 274}
 275EXPORT_SYMBOL(orinoco_open);
 276
 277int orinoco_stop(struct net_device *dev)
 278{
 279	struct orinoco_private *priv = ndev_priv(dev);
 280	int err = 0;
 281
 282	/* We mustn't use orinoco_lock() here, because we need to be
 283	   able to close the interface even if hw_unavailable is set
 284	   (e.g. as we're released after a PC Card removal) */
 285	orinoco_lock_irq(priv);
 286
 287	priv->open = 0;
 288
 289	err = __orinoco_down(priv);
 290
 291	orinoco_unlock_irq(priv);
 292
 293	return err;
 294}
 295EXPORT_SYMBOL(orinoco_stop);
 296
 
 
 
 
 
 
 
 
 297void orinoco_set_multicast_list(struct net_device *dev)
 298{
 299	struct orinoco_private *priv = ndev_priv(dev);
 300	unsigned long flags;
 301
 302	if (orinoco_lock(priv, &flags) != 0) {
 303		printk(KERN_DEBUG "%s: orinoco_set_multicast_list() "
 304		       "called when hw_unavailable\n", dev->name);
 305		return;
 306	}
 307
 308	__orinoco_set_multicast_list(dev);
 309	orinoco_unlock(priv, &flags);
 310}
 311EXPORT_SYMBOL(orinoco_set_multicast_list);
 312
 313int orinoco_change_mtu(struct net_device *dev, int new_mtu)
 314{
 315	struct orinoco_private *priv = ndev_priv(dev);
 316
 
 
 
 317	/* MTU + encapsulation + header length */
 318	if ((new_mtu + ENCAPS_OVERHEAD + sizeof(struct ieee80211_hdr)) >
 319	     (priv->nicbuf_size - ETH_HLEN))
 320		return -EINVAL;
 321
 322	dev->mtu = new_mtu;
 323
 324	return 0;
 325}
 326EXPORT_SYMBOL(orinoco_change_mtu);
 327
 328/********************************************************************/
 329/* Tx path                                                          */
 330/********************************************************************/
 331
 332/* Add encapsulation and MIC to the existing SKB.
 333 * The main xmit routine will then send the whole lot to the card.
 334 * Need 8 bytes headroom
 335 * Need 8 bytes tailroom
 336 *
 337 *                          With encapsulated ethernet II frame
 338 *                          --------
 339 *                          803.3 header (14 bytes)
 340 *                           dst[6]
 341 * --------                  src[6]
 342 * 803.3 header (14 bytes)   len[2]
 343 *  dst[6]                  803.2 header (8 bytes)
 344 *  src[6]                   encaps[6]
 345 *  len[2] <- leave alone -> len[2]
 346 * --------                 -------- <-- 0
 347 * Payload                  Payload
 348 * ...                      ...
 349 *
 350 * --------                 --------
 351 *                          MIC (8 bytes)
 352 *                          --------
 353 *
 354 * returns 0 on success, -ENOMEM on error.
 355 */
 356int orinoco_process_xmit_skb(struct sk_buff *skb,
 357			     struct net_device *dev,
 358			     struct orinoco_private *priv,
 359			     int *tx_control,
 360			     u8 *mic_buf)
 361{
 362	struct orinoco_tkip_key *key;
 363	struct ethhdr *eh;
 364	int do_mic;
 365
 366	key = (struct orinoco_tkip_key *) priv->keys[priv->tx_key].key;
 367
 368	do_mic = ((priv->encode_alg == ORINOCO_ALG_TKIP) &&
 369		  (key != NULL));
 370
 371	if (do_mic)
 372		*tx_control |= (priv->tx_key << HERMES_MIC_KEY_ID_SHIFT) |
 373			HERMES_TXCTRL_MIC;
 374
 375	eh = (struct ethhdr *)skb->data;
 376
 377	/* Encapsulate Ethernet-II frames */
 378	if (ntohs(eh->h_proto) > ETH_DATA_LEN) { /* Ethernet-II frame */
 379		struct header_struct {
 380			struct ethhdr eth;	/* 802.3 header */
 381			u8 encap[6];		/* 802.2 header */
 382		} __packed hdr;
 383		int len = skb->len + sizeof(encaps_hdr) - (2 * ETH_ALEN);
 384
 385		if (skb_headroom(skb) < ENCAPS_OVERHEAD) {
 386			if (net_ratelimit())
 387				printk(KERN_ERR
 388				       "%s: Not enough headroom for 802.2 headers %d\n",
 389				       dev->name, skb_headroom(skb));
 390			return -ENOMEM;
 391		}
 392
 393		/* Fill in new header */
 394		memcpy(&hdr.eth, eh, 2 * ETH_ALEN);
 395		hdr.eth.h_proto = htons(len);
 396		memcpy(hdr.encap, encaps_hdr, sizeof(encaps_hdr));
 397
 398		/* Make room for the new header, and copy it in */
 399		eh = skb_push(skb, ENCAPS_OVERHEAD);
 400		memcpy(eh, &hdr, sizeof(hdr));
 401	}
 402
 403	/* Calculate Michael MIC */
 404	if (do_mic) {
 405		size_t len = skb->len - ETH_HLEN;
 406		u8 *mic = &mic_buf[0];
 407
 408		/* Have to write to an even address, so copy the spare
 409		 * byte across */
 410		if (skb->len % 2) {
 411			*mic = skb->data[skb->len - 1];
 412			mic++;
 413		}
 414
 415		orinoco_mic(priv->tx_tfm_mic, key->tx_mic,
 416			    eh->h_dest, eh->h_source, 0 /* priority */,
 417			    skb->data + ETH_HLEN,
 418			    len, mic);
 419	}
 420
 421	return 0;
 422}
 423EXPORT_SYMBOL(orinoco_process_xmit_skb);
 424
 425static netdev_tx_t orinoco_xmit(struct sk_buff *skb, struct net_device *dev)
 426{
 427	struct orinoco_private *priv = ndev_priv(dev);
 428	struct net_device_stats *stats = &dev->stats;
 429	struct hermes *hw = &priv->hw;
 430	int err = 0;
 431	u16 txfid = priv->txfid;
 432	int tx_control;
 433	unsigned long flags;
 434	u8 mic_buf[MICHAEL_MIC_LEN + 1];
 435
 436	if (!netif_running(dev)) {
 437		printk(KERN_ERR "%s: Tx on stopped device!\n",
 438		       dev->name);
 439		return NETDEV_TX_BUSY;
 440	}
 441
 442	if (netif_queue_stopped(dev)) {
 443		printk(KERN_DEBUG "%s: Tx while transmitter busy!\n",
 444		       dev->name);
 445		return NETDEV_TX_BUSY;
 446	}
 447
 448	if (orinoco_lock(priv, &flags) != 0) {
 449		printk(KERN_ERR "%s: orinoco_xmit() called while hw_unavailable\n",
 450		       dev->name);
 451		return NETDEV_TX_BUSY;
 452	}
 453
 454	if (!netif_carrier_ok(dev) ||
 455	    (priv->iw_mode == NL80211_IFTYPE_MONITOR)) {
 456		/* Oops, the firmware hasn't established a connection,
 457		   silently drop the packet (this seems to be the
 458		   safest approach). */
 459		goto drop;
 460	}
 461
 462	/* Check packet length */
 463	if (skb->len < ETH_HLEN)
 464		goto drop;
 465
 466	tx_control = HERMES_TXCTRL_TX_OK | HERMES_TXCTRL_TX_EX;
 467
 468	err = orinoco_process_xmit_skb(skb, dev, priv, &tx_control,
 469				       &mic_buf[0]);
 470	if (err)
 471		goto drop;
 472
 473	if (priv->has_alt_txcntl) {
 474		/* WPA enabled firmwares have tx_cntl at the end of
 475		 * the 802.11 header.  So write zeroed descriptor and
 476		 * 802.11 header at the same time
 477		 */
 478		char desc[HERMES_802_3_OFFSET];
 479		__le16 *txcntl = (__le16 *) &desc[HERMES_TXCNTL2_OFFSET];
 480
 481		memset(&desc, 0, sizeof(desc));
 482
 483		*txcntl = cpu_to_le16(tx_control);
 484		err = hw->ops->bap_pwrite(hw, USER_BAP, &desc, sizeof(desc),
 485					  txfid, 0);
 486		if (err) {
 487			if (net_ratelimit())
 488				printk(KERN_ERR "%s: Error %d writing Tx "
 489				       "descriptor to BAP\n", dev->name, err);
 490			goto busy;
 491		}
 492	} else {
 493		struct hermes_tx_descriptor desc;
 494
 495		memset(&desc, 0, sizeof(desc));
 496
 497		desc.tx_control = cpu_to_le16(tx_control);
 498		err = hw->ops->bap_pwrite(hw, USER_BAP, &desc, sizeof(desc),
 499					  txfid, 0);
 500		if (err) {
 501			if (net_ratelimit())
 502				printk(KERN_ERR "%s: Error %d writing Tx "
 503				       "descriptor to BAP\n", dev->name, err);
 504			goto busy;
 505		}
 506
 507		/* Clear the 802.11 header and data length fields - some
 508		 * firmwares (e.g. Lucent/Agere 8.xx) appear to get confused
 509		 * if this isn't done. */
 510		hermes_clear_words(hw, HERMES_DATA0,
 511				   HERMES_802_3_OFFSET - HERMES_802_11_OFFSET);
 512	}
 513
 514	err = hw->ops->bap_pwrite(hw, USER_BAP, skb->data, skb->len,
 515				  txfid, HERMES_802_3_OFFSET);
 516	if (err) {
 517		printk(KERN_ERR "%s: Error %d writing packet to BAP\n",
 518		       dev->name, err);
 519		goto busy;
 520	}
 521
 522	if (tx_control & HERMES_TXCTRL_MIC) {
 523		size_t offset = HERMES_802_3_OFFSET + skb->len;
 524		size_t len = MICHAEL_MIC_LEN;
 525
 526		if (offset % 2) {
 527			offset--;
 528			len++;
 529		}
 530		err = hw->ops->bap_pwrite(hw, USER_BAP, &mic_buf[0], len,
 531					  txfid, offset);
 532		if (err) {
 533			printk(KERN_ERR "%s: Error %d writing MIC to BAP\n",
 534			       dev->name, err);
 535			goto busy;
 536		}
 537	}
 538
 539	/* Finally, we actually initiate the send */
 540	netif_stop_queue(dev);
 541
 542	err = hw->ops->cmd_wait(hw, HERMES_CMD_TX | HERMES_CMD_RECL,
 543				txfid, NULL);
 544	if (err) {
 545		netif_start_queue(dev);
 546		if (net_ratelimit())
 547			printk(KERN_ERR "%s: Error %d transmitting packet\n",
 548				dev->name, err);
 549		goto busy;
 550	}
 551
 552	stats->tx_bytes += HERMES_802_3_OFFSET + skb->len;
 553	goto ok;
 554
 555 drop:
 556	stats->tx_errors++;
 557	stats->tx_dropped++;
 558
 559 ok:
 560	orinoco_unlock(priv, &flags);
 561	dev_kfree_skb(skb);
 562	return NETDEV_TX_OK;
 563
 564 busy:
 565	if (err == -EIO)
 566		schedule_work(&priv->reset_work);
 567	orinoco_unlock(priv, &flags);
 568	return NETDEV_TX_BUSY;
 569}
 570
 571static void __orinoco_ev_alloc(struct net_device *dev, struct hermes *hw)
 572{
 573	struct orinoco_private *priv = ndev_priv(dev);
 574	u16 fid = hermes_read_regn(hw, ALLOCFID);
 575
 576	if (fid != priv->txfid) {
 577		if (fid != DUMMY_FID)
 578			printk(KERN_WARNING "%s: Allocate event on unexpected fid (%04X)\n",
 579			       dev->name, fid);
 580		return;
 581	}
 582
 583	hermes_write_regn(hw, ALLOCFID, DUMMY_FID);
 584}
 585
 586static void __orinoco_ev_tx(struct net_device *dev, struct hermes *hw)
 587{
 588	dev->stats.tx_packets++;
 
 
 
 589
 590	netif_wake_queue(dev);
 591
 592	hermes_write_regn(hw, TXCOMPLFID, DUMMY_FID);
 593}
 594
 595static void __orinoco_ev_txexc(struct net_device *dev, struct hermes *hw)
 596{
 597	struct net_device_stats *stats = &dev->stats;
 
 598	u16 fid = hermes_read_regn(hw, TXCOMPLFID);
 599	u16 status;
 600	struct hermes_txexc_data hdr;
 601	int err = 0;
 602
 603	if (fid == DUMMY_FID)
 604		return; /* Nothing's really happened */
 605
 606	/* Read part of the frame header - we need status and addr1 */
 607	err = hw->ops->bap_pread(hw, IRQ_BAP, &hdr,
 608				 sizeof(struct hermes_txexc_data),
 609				 fid, 0);
 610
 611	hermes_write_regn(hw, TXCOMPLFID, DUMMY_FID);
 612	stats->tx_errors++;
 613
 614	if (err) {
 615		printk(KERN_WARNING "%s: Unable to read descriptor on Tx error "
 616		       "(FID=%04X error %d)\n",
 617		       dev->name, fid, err);
 618		return;
 619	}
 620
 621	DEBUG(1, "%s: Tx error, err %d (FID=%04X)\n", dev->name,
 622	      err, fid);
 623
 624	/* We produce a TXDROP event only for retry or lifetime
 625	 * exceeded, because that's the only status that really mean
 626	 * that this particular node went away.
 627	 * Other errors means that *we* screwed up. - Jean II */
 628	status = le16_to_cpu(hdr.desc.status);
 629	if (status & (HERMES_TXSTAT_RETRYERR | HERMES_TXSTAT_AGEDERR)) {
 630		union iwreq_data	wrqu;
 631
 632		/* Copy 802.11 dest address.
 633		 * We use the 802.11 header because the frame may
 634		 * not be 802.3 or may be mangled...
 635		 * In Ad-Hoc mode, it will be the node address.
 636		 * In managed mode, it will be most likely the AP addr
 637		 * User space will figure out how to convert it to
 638		 * whatever it needs (IP address or else).
 639		 * - Jean II */
 640		memcpy(wrqu.addr.sa_data, hdr.addr1, ETH_ALEN);
 641		wrqu.addr.sa_family = ARPHRD_ETHER;
 642
 643		/* Send event to user space */
 644		wireless_send_event(dev, IWEVTXDROP, &wrqu, NULL);
 645	}
 646
 647	netif_wake_queue(dev);
 648}
 649
 650void orinoco_tx_timeout(struct net_device *dev)
 651{
 652	struct orinoco_private *priv = ndev_priv(dev);
 653	struct net_device_stats *stats = &dev->stats;
 654	struct hermes *hw = &priv->hw;
 655
 656	printk(KERN_WARNING "%s: Tx timeout! "
 657	       "ALLOCFID=%04x, TXCOMPLFID=%04x, EVSTAT=%04x\n",
 658	       dev->name, hermes_read_regn(hw, ALLOCFID),
 659	       hermes_read_regn(hw, TXCOMPLFID), hermes_read_regn(hw, EVSTAT));
 660
 661	stats->tx_errors++;
 662
 663	schedule_work(&priv->reset_work);
 664}
 665EXPORT_SYMBOL(orinoco_tx_timeout);
 666
 667/********************************************************************/
 668/* Rx path (data frames)                                            */
 669/********************************************************************/
 670
 671/* Does the frame have a SNAP header indicating it should be
 672 * de-encapsulated to Ethernet-II? */
 673static inline int is_ethersnap(void *_hdr)
 674{
 675	u8 *hdr = _hdr;
 676
 677	/* We de-encapsulate all packets which, a) have SNAP headers
 678	 * (i.e. SSAP=DSAP=0xaa and CTRL=0x3 in the 802.2 LLC header
 679	 * and where b) the OUI of the SNAP header is 00:00:00 or
 680	 * 00:00:f8 - we need both because different APs appear to use
 681	 * different OUIs for some reason */
 682	return (memcmp(hdr, &encaps_hdr, 5) == 0)
 683		&& ((hdr[5] == 0x00) || (hdr[5] == 0xf8));
 684}
 685
 686static inline void orinoco_spy_gather(struct net_device *dev, u_char *mac,
 687				      int level, int noise)
 688{
 689	struct iw_quality wstats;
 690	wstats.level = level - 0x95;
 691	wstats.noise = noise - 0x95;
 692	wstats.qual = (level > noise) ? (level - noise) : 0;
 693	wstats.updated = IW_QUAL_ALL_UPDATED | IW_QUAL_DBM;
 694	/* Update spy records */
 695	wireless_spy_update(dev, mac, &wstats);
 696}
 697
 698static void orinoco_stat_gather(struct net_device *dev,
 699				struct sk_buff *skb,
 700				struct hermes_rx_descriptor *desc)
 701{
 702	struct orinoco_private *priv = ndev_priv(dev);
 703
 704	/* Using spy support with lots of Rx packets, like in an
 705	 * infrastructure (AP), will really slow down everything, because
 706	 * the MAC address must be compared to each entry of the spy list.
 707	 * If the user really asks for it (set some address in the
 708	 * spy list), we do it, but he will pay the price.
 709	 * Note that to get here, you need both WIRELESS_SPY
 710	 * compiled in AND some addresses in the list !!!
 711	 */
 712	/* Note : gcc will optimise the whole section away if
 713	 * WIRELESS_SPY is not defined... - Jean II */
 714	if (SPY_NUMBER(priv)) {
 715		orinoco_spy_gather(dev, skb_mac_header(skb) + ETH_ALEN,
 716				   desc->signal, desc->silence);
 717	}
 718}
 719
 720/*
 721 * orinoco_rx_monitor - handle received monitor frames.
 722 *
 723 * Arguments:
 724 *	dev		network device
 725 *	rxfid		received FID
 726 *	desc		rx descriptor of the frame
 727 *
 728 * Call context: interrupt
 729 */
 730static void orinoco_rx_monitor(struct net_device *dev, u16 rxfid,
 731			       struct hermes_rx_descriptor *desc)
 732{
 733	u32 hdrlen = 30;	/* return full header by default */
 734	u32 datalen = 0;
 735	u16 fc;
 736	int err;
 737	int len;
 738	struct sk_buff *skb;
 739	struct orinoco_private *priv = ndev_priv(dev);
 740	struct net_device_stats *stats = &dev->stats;
 741	struct hermes *hw = &priv->hw;
 742
 743	len = le16_to_cpu(desc->data_len);
 744
 745	/* Determine the size of the header and the data */
 746	fc = le16_to_cpu(desc->frame_ctl);
 747	switch (fc & IEEE80211_FCTL_FTYPE) {
 748	case IEEE80211_FTYPE_DATA:
 749		if ((fc & IEEE80211_FCTL_TODS)
 750		    && (fc & IEEE80211_FCTL_FROMDS))
 751			hdrlen = 30;
 752		else
 753			hdrlen = 24;
 754		datalen = len;
 755		break;
 756	case IEEE80211_FTYPE_MGMT:
 757		hdrlen = 24;
 758		datalen = len;
 759		break;
 760	case IEEE80211_FTYPE_CTL:
 761		switch (fc & IEEE80211_FCTL_STYPE) {
 762		case IEEE80211_STYPE_PSPOLL:
 763		case IEEE80211_STYPE_RTS:
 764		case IEEE80211_STYPE_CFEND:
 765		case IEEE80211_STYPE_CFENDACK:
 766			hdrlen = 16;
 767			break;
 768		case IEEE80211_STYPE_CTS:
 769		case IEEE80211_STYPE_ACK:
 770			hdrlen = 10;
 771			break;
 772		}
 773		break;
 774	default:
 775		/* Unknown frame type */
 776		break;
 777	}
 778
 779	/* sanity check the length */
 780	if (datalen > IEEE80211_MAX_DATA_LEN + 12) {
 781		printk(KERN_DEBUG "%s: oversized monitor frame, "
 782		       "data length = %d\n", dev->name, datalen);
 783		stats->rx_length_errors++;
 784		goto update_stats;
 785	}
 786
 787	skb = dev_alloc_skb(hdrlen + datalen);
 788	if (!skb) {
 789		printk(KERN_WARNING "%s: Cannot allocate skb for monitor frame\n",
 790		       dev->name);
 791		goto update_stats;
 792	}
 793
 794	/* Copy the 802.11 header to the skb */
 795	skb_put_data(skb, &(desc->frame_ctl), hdrlen);
 796	skb_reset_mac_header(skb);
 797
 798	/* If any, copy the data from the card to the skb */
 799	if (datalen > 0) {
 800		err = hw->ops->bap_pread(hw, IRQ_BAP, skb_put(skb, datalen),
 801					 ALIGN(datalen, 2), rxfid,
 802					 HERMES_802_2_OFFSET);
 803		if (err) {
 804			printk(KERN_ERR "%s: error %d reading monitor frame\n",
 805			       dev->name, err);
 806			goto drop;
 807		}
 808	}
 809
 810	skb->dev = dev;
 811	skb->ip_summed = CHECKSUM_NONE;
 812	skb->pkt_type = PACKET_OTHERHOST;
 813	skb->protocol = cpu_to_be16(ETH_P_802_2);
 814
 815	stats->rx_packets++;
 816	stats->rx_bytes += skb->len;
 817
 818	netif_rx(skb);
 819	return;
 820
 821 drop:
 822	dev_kfree_skb_irq(skb);
 823 update_stats:
 824	stats->rx_errors++;
 825	stats->rx_dropped++;
 826}
 827
 828void __orinoco_ev_rx(struct net_device *dev, struct hermes *hw)
 829{
 830	struct orinoco_private *priv = ndev_priv(dev);
 831	struct net_device_stats *stats = &dev->stats;
 832	struct iw_statistics *wstats = &priv->wstats;
 833	struct sk_buff *skb = NULL;
 834	u16 rxfid, status;
 835	int length;
 836	struct hermes_rx_descriptor *desc;
 837	struct orinoco_rx_data *rx_data;
 838	int err;
 839
 840	desc = kmalloc(sizeof(*desc), GFP_ATOMIC);
 841	if (!desc)
 842		goto update_stats;
 843
 844	rxfid = hermes_read_regn(hw, RXFID);
 845
 846	err = hw->ops->bap_pread(hw, IRQ_BAP, desc, sizeof(*desc),
 847				 rxfid, 0);
 848	if (err) {
 849		printk(KERN_ERR "%s: error %d reading Rx descriptor. "
 850		       "Frame dropped.\n", dev->name, err);
 851		goto update_stats;
 852	}
 853
 854	status = le16_to_cpu(desc->status);
 855
 856	if (status & HERMES_RXSTAT_BADCRC) {
 857		DEBUG(1, "%s: Bad CRC on Rx. Frame dropped.\n",
 858		      dev->name);
 859		stats->rx_crc_errors++;
 860		goto update_stats;
 861	}
 862
 863	/* Handle frames in monitor mode */
 864	if (priv->iw_mode == NL80211_IFTYPE_MONITOR) {
 865		orinoco_rx_monitor(dev, rxfid, desc);
 866		goto out;
 867	}
 868
 869	if (status & HERMES_RXSTAT_UNDECRYPTABLE) {
 870		DEBUG(1, "%s: Undecryptable frame on Rx. Frame dropped.\n",
 871		      dev->name);
 872		wstats->discard.code++;
 873		goto update_stats;
 874	}
 875
 876	length = le16_to_cpu(desc->data_len);
 877
 878	/* Sanity checks */
 879	if (length < 3) { /* No for even an 802.2 LLC header */
 880		/* At least on Symbol firmware with PCF we get quite a
 881		   lot of these legitimately - Poll frames with no
 882		   data. */
 883		goto out;
 884	}
 885	if (length > IEEE80211_MAX_DATA_LEN) {
 886		printk(KERN_WARNING "%s: Oversized frame received (%d bytes)\n",
 887		       dev->name, length);
 888		stats->rx_length_errors++;
 889		goto update_stats;
 890	}
 891
 892	/* Payload size does not include Michael MIC. Increase payload
 893	 * size to read it together with the data. */
 894	if (status & HERMES_RXSTAT_MIC)
 895		length += MICHAEL_MIC_LEN;
 896
 897	/* We need space for the packet data itself, plus an ethernet
 898	   header, plus 2 bytes so we can align the IP header on a
 899	   32bit boundary, plus 1 byte so we can read in odd length
 900	   packets from the card, which has an IO granularity of 16
 901	   bits */
 902	skb = dev_alloc_skb(length + ETH_HLEN + 2 + 1);
 903	if (!skb) {
 904		printk(KERN_WARNING "%s: Can't allocate skb for Rx\n",
 905		       dev->name);
 906		goto update_stats;
 907	}
 908
 909	/* We'll prepend the header, so reserve space for it.  The worst
 910	   case is no decapsulation, when 802.3 header is prepended and
 911	   nothing is removed.  2 is for aligning the IP header.  */
 912	skb_reserve(skb, ETH_HLEN + 2);
 913
 914	err = hw->ops->bap_pread(hw, IRQ_BAP, skb_put(skb, length),
 915				 ALIGN(length, 2), rxfid,
 916				 HERMES_802_2_OFFSET);
 917	if (err) {
 918		printk(KERN_ERR "%s: error %d reading frame. "
 919		       "Frame dropped.\n", dev->name, err);
 920		goto drop;
 921	}
 922
 923	/* Add desc and skb to rx queue */
 924	rx_data = kzalloc(sizeof(*rx_data), GFP_ATOMIC);
 925	if (!rx_data)
 926		goto drop;
 927
 928	rx_data->desc = desc;
 929	rx_data->skb = skb;
 930	list_add_tail(&rx_data->list, &priv->rx_list);
 931	tasklet_schedule(&priv->rx_tasklet);
 932
 933	return;
 934
 935drop:
 936	dev_kfree_skb_irq(skb);
 937update_stats:
 938	stats->rx_errors++;
 939	stats->rx_dropped++;
 940out:
 941	kfree(desc);
 942}
 943EXPORT_SYMBOL(__orinoco_ev_rx);
 944
 945static void orinoco_rx(struct net_device *dev,
 946		       struct hermes_rx_descriptor *desc,
 947		       struct sk_buff *skb)
 948{
 949	struct orinoco_private *priv = ndev_priv(dev);
 950	struct net_device_stats *stats = &dev->stats;
 951	u16 status, fc;
 952	int length;
 953	struct ethhdr *hdr;
 954
 955	status = le16_to_cpu(desc->status);
 956	length = le16_to_cpu(desc->data_len);
 957	fc = le16_to_cpu(desc->frame_ctl);
 958
 959	/* Calculate and check MIC */
 960	if (status & HERMES_RXSTAT_MIC) {
 961		struct orinoco_tkip_key *key;
 962		int key_id = ((status & HERMES_RXSTAT_MIC_KEY_ID) >>
 963			      HERMES_MIC_KEY_ID_SHIFT);
 964		u8 mic[MICHAEL_MIC_LEN];
 965		u8 *rxmic;
 966		u8 *src = (fc & IEEE80211_FCTL_FROMDS) ?
 967			desc->addr3 : desc->addr2;
 968
 969		/* Extract Michael MIC from payload */
 970		rxmic = skb->data + skb->len - MICHAEL_MIC_LEN;
 971
 972		skb_trim(skb, skb->len - MICHAEL_MIC_LEN);
 973		length -= MICHAEL_MIC_LEN;
 974
 975		key = (struct orinoco_tkip_key *) priv->keys[key_id].key;
 976
 977		if (!key) {
 978			printk(KERN_WARNING "%s: Received encrypted frame from "
 979			       "%pM using key %i, but key is not installed\n",
 980			       dev->name, src, key_id);
 981			goto drop;
 982		}
 983
 984		orinoco_mic(priv->rx_tfm_mic, key->rx_mic, desc->addr1, src,
 985			    0, /* priority or QoS? */
 986			    skb->data, skb->len, &mic[0]);
 987
 988		if (memcmp(mic, rxmic,
 989			   MICHAEL_MIC_LEN)) {
 990			union iwreq_data wrqu;
 991			struct iw_michaelmicfailure wxmic;
 992
 993			printk(KERN_WARNING "%s: "
 994			       "Invalid Michael MIC in data frame from %pM, "
 995			       "using key %i\n",
 996			       dev->name, src, key_id);
 997
 998			/* TODO: update stats */
 999
1000			/* Notify userspace */
1001			memset(&wxmic, 0, sizeof(wxmic));
1002			wxmic.flags = key_id & IW_MICFAILURE_KEY_ID;
1003			wxmic.flags |= (desc->addr1[0] & 1) ?
1004				IW_MICFAILURE_GROUP : IW_MICFAILURE_PAIRWISE;
1005			wxmic.src_addr.sa_family = ARPHRD_ETHER;
1006			memcpy(wxmic.src_addr.sa_data, src, ETH_ALEN);
1007
1008			(void) orinoco_hw_get_tkip_iv(priv, key_id,
1009						      &wxmic.tsc[0]);
1010
1011			memset(&wrqu, 0, sizeof(wrqu));
1012			wrqu.data.length = sizeof(wxmic);
1013			wireless_send_event(dev, IWEVMICHAELMICFAILURE, &wrqu,
1014					    (char *) &wxmic);
1015
1016			goto drop;
1017		}
1018	}
1019
1020	/* Handle decapsulation
1021	 * In most cases, the firmware tell us about SNAP frames.
1022	 * For some reason, the SNAP frames sent by LinkSys APs
1023	 * are not properly recognised by most firmwares.
1024	 * So, check ourselves */
1025	if (length >= ENCAPS_OVERHEAD &&
1026	    (((status & HERMES_RXSTAT_MSGTYPE) == HERMES_RXSTAT_1042) ||
1027	     ((status & HERMES_RXSTAT_MSGTYPE) == HERMES_RXSTAT_TUNNEL) ||
1028	     is_ethersnap(skb->data))) {
1029		/* These indicate a SNAP within 802.2 LLC within
1030		   802.11 frame which we'll need to de-encapsulate to
1031		   the original EthernetII frame. */
1032		hdr = skb_push(skb, ETH_HLEN - ENCAPS_OVERHEAD);
 
1033	} else {
1034		/* 802.3 frame - prepend 802.3 header as is */
1035		hdr = skb_push(skb, ETH_HLEN);
1036		hdr->h_proto = htons(length);
1037	}
1038	memcpy(hdr->h_dest, desc->addr1, ETH_ALEN);
1039	if (fc & IEEE80211_FCTL_FROMDS)
1040		memcpy(hdr->h_source, desc->addr3, ETH_ALEN);
1041	else
1042		memcpy(hdr->h_source, desc->addr2, ETH_ALEN);
1043
1044	skb->protocol = eth_type_trans(skb, dev);
1045	skb->ip_summed = CHECKSUM_NONE;
1046	if (fc & IEEE80211_FCTL_TODS)
1047		skb->pkt_type = PACKET_OTHERHOST;
1048
1049	/* Process the wireless stats if needed */
1050	orinoco_stat_gather(dev, skb, desc);
1051
1052	/* Pass the packet to the networking stack */
1053	netif_rx(skb);
1054	stats->rx_packets++;
1055	stats->rx_bytes += length;
1056
1057	return;
1058
1059 drop:
1060	dev_kfree_skb(skb);
1061	stats->rx_errors++;
1062	stats->rx_dropped++;
1063}
1064
1065static void orinoco_rx_isr_tasklet(unsigned long data)
1066{
1067	struct orinoco_private *priv = (struct orinoco_private *) data;
1068	struct net_device *dev = priv->ndev;
1069	struct orinoco_rx_data *rx_data, *temp;
1070	struct hermes_rx_descriptor *desc;
1071	struct sk_buff *skb;
1072	unsigned long flags;
1073
1074	/* orinoco_rx requires the driver lock, and we also need to
1075	 * protect priv->rx_list, so just hold the lock over the
1076	 * lot.
1077	 *
1078	 * If orinoco_lock fails, we've unplugged the card. In this
1079	 * case just abort. */
1080	if (orinoco_lock(priv, &flags) != 0)
1081		return;
1082
1083	/* extract desc and skb from queue */
1084	list_for_each_entry_safe(rx_data, temp, &priv->rx_list, list) {
1085		desc = rx_data->desc;
1086		skb = rx_data->skb;
1087		list_del(&rx_data->list);
1088		kfree(rx_data);
1089
1090		orinoco_rx(dev, desc, skb);
1091
1092		kfree(desc);
1093	}
1094
1095	orinoco_unlock(priv, &flags);
1096}
1097
1098/********************************************************************/
1099/* Rx path (info frames)                                            */
1100/********************************************************************/
1101
1102static void print_linkstatus(struct net_device *dev, u16 status)
1103{
1104	char *s;
1105
1106	if (suppress_linkstatus)
1107		return;
1108
1109	switch (status) {
1110	case HERMES_LINKSTATUS_NOT_CONNECTED:
1111		s = "Not Connected";
1112		break;
1113	case HERMES_LINKSTATUS_CONNECTED:
1114		s = "Connected";
1115		break;
1116	case HERMES_LINKSTATUS_DISCONNECTED:
1117		s = "Disconnected";
1118		break;
1119	case HERMES_LINKSTATUS_AP_CHANGE:
1120		s = "AP Changed";
1121		break;
1122	case HERMES_LINKSTATUS_AP_OUT_OF_RANGE:
1123		s = "AP Out of Range";
1124		break;
1125	case HERMES_LINKSTATUS_AP_IN_RANGE:
1126		s = "AP In Range";
1127		break;
1128	case HERMES_LINKSTATUS_ASSOC_FAILED:
1129		s = "Association Failed";
1130		break;
1131	default:
1132		s = "UNKNOWN";
1133	}
1134
1135	printk(KERN_DEBUG "%s: New link status: %s (%04x)\n",
1136	       dev->name, s, status);
1137}
1138
1139/* Search scan results for requested BSSID, join it if found */
1140static void orinoco_join_ap(struct work_struct *work)
1141{
1142	struct orinoco_private *priv =
1143		container_of(work, struct orinoco_private, join_work);
1144	struct net_device *dev = priv->ndev;
1145	struct hermes *hw = &priv->hw;
1146	int err;
1147	unsigned long flags;
1148	struct join_req {
1149		u8 bssid[ETH_ALEN];
1150		__le16 channel;
1151	} __packed req;
1152	const int atom_len = offsetof(struct prism2_scan_apinfo, atim);
1153	struct prism2_scan_apinfo *atom = NULL;
1154	int offset = 4;
1155	int found = 0;
1156	u8 *buf;
1157	u16 len;
1158
1159	/* Allocate buffer for scan results */
1160	buf = kmalloc(MAX_SCAN_LEN, GFP_KERNEL);
1161	if (!buf)
1162		return;
1163
1164	if (orinoco_lock(priv, &flags) != 0)
1165		goto fail_lock;
1166
1167	/* Sanity checks in case user changed something in the meantime */
1168	if (!priv->bssid_fixed)
1169		goto out;
1170
1171	if (strlen(priv->desired_essid) == 0)
1172		goto out;
1173
1174	/* Read scan results from the firmware */
1175	err = hw->ops->read_ltv(hw, USER_BAP,
1176				HERMES_RID_SCANRESULTSTABLE,
1177				MAX_SCAN_LEN, &len, buf);
1178	if (err) {
1179		printk(KERN_ERR "%s: Cannot read scan results\n",
1180		       dev->name);
1181		goto out;
1182	}
1183
1184	len = HERMES_RECLEN_TO_BYTES(len);
1185
1186	/* Go through the scan results looking for the channel of the AP
1187	 * we were requested to join */
1188	for (; offset + atom_len <= len; offset += atom_len) {
1189		atom = (struct prism2_scan_apinfo *) (buf + offset);
1190		if (memcmp(&atom->bssid, priv->desired_bssid, ETH_ALEN) == 0) {
1191			found = 1;
1192			break;
1193		}
1194	}
1195
1196	if (!found) {
1197		DEBUG(1, "%s: Requested AP not found in scan results\n",
1198		      dev->name);
1199		goto out;
1200	}
1201
1202	memcpy(req.bssid, priv->desired_bssid, ETH_ALEN);
1203	req.channel = atom->channel;	/* both are little-endian */
1204	err = HERMES_WRITE_RECORD(hw, USER_BAP, HERMES_RID_CNFJOINREQUEST,
1205				  &req);
1206	if (err)
1207		printk(KERN_ERR "%s: Error issuing join request\n", dev->name);
1208
1209 out:
1210	orinoco_unlock(priv, &flags);
1211
1212 fail_lock:
1213	kfree(buf);
1214}
1215
1216/* Send new BSSID to userspace */
1217static void orinoco_send_bssid_wevent(struct orinoco_private *priv)
1218{
1219	struct net_device *dev = priv->ndev;
1220	struct hermes *hw = &priv->hw;
1221	union iwreq_data wrqu;
1222	int err;
1223
1224	err = hw->ops->read_ltv(hw, USER_BAP, HERMES_RID_CURRENTBSSID,
1225				ETH_ALEN, NULL, wrqu.ap_addr.sa_data);
1226	if (err != 0)
1227		return;
1228
1229	wrqu.ap_addr.sa_family = ARPHRD_ETHER;
1230
1231	/* Send event to user space */
1232	wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
1233}
1234
1235static void orinoco_send_assocreqie_wevent(struct orinoco_private *priv)
1236{
1237	struct net_device *dev = priv->ndev;
1238	struct hermes *hw = &priv->hw;
1239	union iwreq_data wrqu;
1240	int err;
1241	u8 buf[88];
1242	u8 *ie;
1243
1244	if (!priv->has_wpa)
1245		return;
1246
1247	err = hw->ops->read_ltv(hw, USER_BAP, HERMES_RID_CURRENT_ASSOC_REQ_INFO,
1248				sizeof(buf), NULL, &buf);
1249	if (err != 0)
1250		return;
1251
1252	ie = orinoco_get_wpa_ie(buf, sizeof(buf));
1253	if (ie) {
1254		int rem = sizeof(buf) - (ie - &buf[0]);
1255		wrqu.data.length = ie[1] + 2;
1256		if (wrqu.data.length > rem)
1257			wrqu.data.length = rem;
1258
1259		if (wrqu.data.length)
1260			/* Send event to user space */
1261			wireless_send_event(dev, IWEVASSOCREQIE, &wrqu, ie);
1262	}
1263}
1264
1265static void orinoco_send_assocrespie_wevent(struct orinoco_private *priv)
1266{
1267	struct net_device *dev = priv->ndev;
1268	struct hermes *hw = &priv->hw;
1269	union iwreq_data wrqu;
1270	int err;
1271	u8 buf[88]; /* TODO: verify max size or IW_GENERIC_IE_MAX */
1272	u8 *ie;
1273
1274	if (!priv->has_wpa)
1275		return;
1276
1277	err = hw->ops->read_ltv(hw, USER_BAP,
1278				HERMES_RID_CURRENT_ASSOC_RESP_INFO,
1279				sizeof(buf), NULL, &buf);
1280	if (err != 0)
1281		return;
1282
1283	ie = orinoco_get_wpa_ie(buf, sizeof(buf));
1284	if (ie) {
1285		int rem = sizeof(buf) - (ie - &buf[0]);
1286		wrqu.data.length = ie[1] + 2;
1287		if (wrqu.data.length > rem)
1288			wrqu.data.length = rem;
1289
1290		if (wrqu.data.length)
1291			/* Send event to user space */
1292			wireless_send_event(dev, IWEVASSOCRESPIE, &wrqu, ie);
1293	}
1294}
1295
1296static void orinoco_send_wevents(struct work_struct *work)
1297{
1298	struct orinoco_private *priv =
1299		container_of(work, struct orinoco_private, wevent_work);
1300	unsigned long flags;
1301
1302	if (orinoco_lock(priv, &flags) != 0)
1303		return;
1304
1305	orinoco_send_assocreqie_wevent(priv);
1306	orinoco_send_assocrespie_wevent(priv);
1307	orinoco_send_bssid_wevent(priv);
1308
1309	orinoco_unlock(priv, &flags);
1310}
1311
1312static void qbuf_scan(struct orinoco_private *priv, void *buf,
1313		      int len, int type)
1314{
1315	struct orinoco_scan_data *sd;
1316	unsigned long flags;
1317
1318	sd = kmalloc(sizeof(*sd), GFP_ATOMIC);
1319	if (!sd)
1320		return;
1321
1322	sd->buf = buf;
1323	sd->len = len;
1324	sd->type = type;
1325
1326	spin_lock_irqsave(&priv->scan_lock, flags);
1327	list_add_tail(&sd->list, &priv->scan_list);
1328	spin_unlock_irqrestore(&priv->scan_lock, flags);
1329
1330	schedule_work(&priv->process_scan);
1331}
1332
1333static void qabort_scan(struct orinoco_private *priv)
1334{
1335	struct orinoco_scan_data *sd;
1336	unsigned long flags;
1337
1338	sd = kmalloc(sizeof(*sd), GFP_ATOMIC);
1339	if (!sd)
1340		return;
1341
1342	sd->len = -1; /* Abort */
1343
1344	spin_lock_irqsave(&priv->scan_lock, flags);
1345	list_add_tail(&sd->list, &priv->scan_list);
1346	spin_unlock_irqrestore(&priv->scan_lock, flags);
1347
1348	schedule_work(&priv->process_scan);
1349}
1350
1351static void orinoco_process_scan_results(struct work_struct *work)
1352{
1353	struct orinoco_private *priv =
1354		container_of(work, struct orinoco_private, process_scan);
1355	struct orinoco_scan_data *sd, *temp;
1356	unsigned long flags;
1357	void *buf;
1358	int len;
1359	int type;
1360
1361	spin_lock_irqsave(&priv->scan_lock, flags);
1362	list_for_each_entry_safe(sd, temp, &priv->scan_list, list) {
1363
1364		buf = sd->buf;
1365		len = sd->len;
1366		type = sd->type;
1367
1368		list_del(&sd->list);
1369		spin_unlock_irqrestore(&priv->scan_lock, flags);
1370		kfree(sd);
1371
1372		if (len > 0) {
1373			if (type == HERMES_INQ_CHANNELINFO)
1374				orinoco_add_extscan_result(priv, buf, len);
1375			else
1376				orinoco_add_hostscan_results(priv, buf, len);
1377
1378			kfree(buf);
1379		} else {
1380			/* Either abort or complete the scan */
1381			orinoco_scan_done(priv, (len < 0));
1382		}
1383
1384		spin_lock_irqsave(&priv->scan_lock, flags);
1385	}
1386	spin_unlock_irqrestore(&priv->scan_lock, flags);
1387}
1388
1389void __orinoco_ev_info(struct net_device *dev, struct hermes *hw)
1390{
1391	struct orinoco_private *priv = ndev_priv(dev);
1392	u16 infofid;
1393	struct {
1394		__le16 len;
1395		__le16 type;
1396	} __packed info;
1397	int len, type;
1398	int err;
1399
1400	/* This is an answer to an INQUIRE command that we did earlier,
1401	 * or an information "event" generated by the card
1402	 * The controller return to us a pseudo frame containing
1403	 * the information in question - Jean II */
1404	infofid = hermes_read_regn(hw, INFOFID);
1405
1406	/* Read the info frame header - don't try too hard */
1407	err = hw->ops->bap_pread(hw, IRQ_BAP, &info, sizeof(info),
1408				 infofid, 0);
1409	if (err) {
1410		printk(KERN_ERR "%s: error %d reading info frame. "
1411		       "Frame dropped.\n", dev->name, err);
1412		return;
1413	}
1414
1415	len = HERMES_RECLEN_TO_BYTES(le16_to_cpu(info.len));
1416	type = le16_to_cpu(info.type);
1417
1418	switch (type) {
1419	case HERMES_INQ_TALLIES: {
1420		struct hermes_tallies_frame tallies;
1421		struct iw_statistics *wstats = &priv->wstats;
1422
1423		if (len > sizeof(tallies)) {
1424			printk(KERN_WARNING "%s: Tallies frame too long (%d bytes)\n",
1425			       dev->name, len);
1426			len = sizeof(tallies);
1427		}
1428
1429		err = hw->ops->bap_pread(hw, IRQ_BAP, &tallies, len,
1430					 infofid, sizeof(info));
1431		if (err)
1432			break;
1433
1434		/* Increment our various counters */
1435		/* wstats->discard.nwid - no wrong BSSID stuff */
1436		wstats->discard.code +=
1437			le16_to_cpu(tallies.RxWEPUndecryptable);
1438		if (len == sizeof(tallies))
1439			wstats->discard.code +=
1440				le16_to_cpu(tallies.RxDiscards_WEPICVError) +
1441				le16_to_cpu(tallies.RxDiscards_WEPExcluded);
1442		wstats->discard.misc +=
1443			le16_to_cpu(tallies.TxDiscardsWrongSA);
1444		wstats->discard.fragment +=
1445			le16_to_cpu(tallies.RxMsgInBadMsgFragments);
1446		wstats->discard.retries +=
1447			le16_to_cpu(tallies.TxRetryLimitExceeded);
1448		/* wstats->miss.beacon - no match */
1449	}
1450	break;
1451	case HERMES_INQ_LINKSTATUS: {
1452		struct hermes_linkstatus linkstatus;
1453		u16 newstatus;
1454		int connected;
1455
1456		if (priv->iw_mode == NL80211_IFTYPE_MONITOR)
1457			break;
1458
1459		if (len != sizeof(linkstatus)) {
1460			printk(KERN_WARNING "%s: Unexpected size for linkstatus frame (%d bytes)\n",
1461			       dev->name, len);
1462			break;
1463		}
1464
1465		err = hw->ops->bap_pread(hw, IRQ_BAP, &linkstatus, len,
1466					 infofid, sizeof(info));
1467		if (err)
1468			break;
1469		newstatus = le16_to_cpu(linkstatus.linkstatus);
1470
1471		/* Symbol firmware uses "out of range" to signal that
1472		 * the hostscan frame can be requested.  */
1473		if (newstatus == HERMES_LINKSTATUS_AP_OUT_OF_RANGE &&
1474		    priv->firmware_type == FIRMWARE_TYPE_SYMBOL &&
1475		    priv->has_hostscan && priv->scan_request) {
1476			hermes_inquire(hw, HERMES_INQ_HOSTSCAN_SYMBOL);
1477			break;
1478		}
1479
1480		connected = (newstatus == HERMES_LINKSTATUS_CONNECTED)
1481			|| (newstatus == HERMES_LINKSTATUS_AP_CHANGE)
1482			|| (newstatus == HERMES_LINKSTATUS_AP_IN_RANGE);
1483
1484		if (connected)
1485			netif_carrier_on(dev);
1486		else if (!ignore_disconnect)
1487			netif_carrier_off(dev);
1488
1489		if (newstatus != priv->last_linkstatus) {
1490			priv->last_linkstatus = newstatus;
1491			print_linkstatus(dev, newstatus);
1492			/* The info frame contains only one word which is the
1493			 * status (see hermes.h). The status is pretty boring
1494			 * in itself, that's why we export the new BSSID...
1495			 * Jean II */
1496			schedule_work(&priv->wevent_work);
1497		}
1498	}
1499	break;
1500	case HERMES_INQ_SCAN:
1501		if (!priv->scan_request && priv->bssid_fixed &&
1502		    priv->firmware_type == FIRMWARE_TYPE_INTERSIL) {
1503			schedule_work(&priv->join_work);
1504			break;
1505		}
1506		/* fall through */
1507	case HERMES_INQ_HOSTSCAN:
1508	case HERMES_INQ_HOSTSCAN_SYMBOL: {
1509		/* Result of a scanning. Contains information about
1510		 * cells in the vicinity - Jean II */
1511		unsigned char *buf;
1512
1513		/* Sanity check */
1514		if (len > 4096) {
1515			printk(KERN_WARNING "%s: Scan results too large (%d bytes)\n",
1516			       dev->name, len);
1517			qabort_scan(priv);
1518			break;
1519		}
1520
1521		/* Allocate buffer for results */
1522		buf = kmalloc(len, GFP_ATOMIC);
1523		if (buf == NULL) {
1524			/* No memory, so can't printk()... */
1525			qabort_scan(priv);
1526			break;
1527		}
1528
1529		/* Read scan data */
1530		err = hw->ops->bap_pread(hw, IRQ_BAP, (void *) buf, len,
1531					 infofid, sizeof(info));
1532		if (err) {
1533			kfree(buf);
1534			qabort_scan(priv);
1535			break;
1536		}
1537
1538#ifdef ORINOCO_DEBUG
1539		{
1540			int	i;
1541			printk(KERN_DEBUG "Scan result [%02X", buf[0]);
1542			for (i = 1; i < (len * 2); i++)
1543				printk(":%02X", buf[i]);
1544			printk("]\n");
1545		}
1546#endif	/* ORINOCO_DEBUG */
1547
1548		qbuf_scan(priv, buf, len, type);
1549	}
1550	break;
1551	case HERMES_INQ_CHANNELINFO:
1552	{
1553		struct agere_ext_scan_info *bss;
1554
1555		if (!priv->scan_request) {
1556			printk(KERN_DEBUG "%s: Got chaninfo without scan, "
1557			       "len=%d\n", dev->name, len);
1558			break;
1559		}
1560
1561		/* An empty result indicates that the scan is complete */
1562		if (len == 0) {
1563			qbuf_scan(priv, NULL, len, type);
1564			break;
1565		}
1566
1567		/* Sanity check */
1568		else if (len < (offsetof(struct agere_ext_scan_info,
1569					   data) + 2)) {
1570			/* Drop this result now so we don't have to
1571			 * keep checking later */
1572			printk(KERN_WARNING
1573			       "%s: Ext scan results too short (%d bytes)\n",
1574			       dev->name, len);
1575			break;
1576		}
1577
1578		bss = kmalloc(len, GFP_ATOMIC);
1579		if (bss == NULL)
1580			break;
1581
1582		/* Read scan data */
1583		err = hw->ops->bap_pread(hw, IRQ_BAP, (void *) bss, len,
1584					 infofid, sizeof(info));
1585		if (err)
1586			kfree(bss);
1587		else
1588			qbuf_scan(priv, bss, len, type);
1589
1590		break;
1591	}
1592	case HERMES_INQ_SEC_STAT_AGERE:
1593		/* Security status (Agere specific) */
1594		/* Ignore this frame for now */
1595		if (priv->firmware_type == FIRMWARE_TYPE_AGERE)
1596			break;
1597		/* fall through */
1598	default:
1599		printk(KERN_DEBUG "%s: Unknown information frame received: "
1600		       "type 0x%04x, length %d\n", dev->name, type, len);
1601		/* We don't actually do anything about it */
1602		break;
1603	}
1604}
1605EXPORT_SYMBOL(__orinoco_ev_info);
1606
1607static void __orinoco_ev_infdrop(struct net_device *dev, struct hermes *hw)
1608{
1609	if (net_ratelimit())
1610		printk(KERN_DEBUG "%s: Information frame lost.\n", dev->name);
1611}
1612
1613/********************************************************************/
1614/* Internal hardware control routines                               */
1615/********************************************************************/
1616
1617static int __orinoco_up(struct orinoco_private *priv)
1618{
1619	struct net_device *dev = priv->ndev;
1620	struct hermes *hw = &priv->hw;
1621	int err;
1622
1623	netif_carrier_off(dev); /* just to make sure */
1624
1625	err = __orinoco_commit(priv);
1626	if (err) {
1627		printk(KERN_ERR "%s: Error %d configuring card\n",
1628		       dev->name, err);
1629		return err;
1630	}
1631
1632	/* Fire things up again */
1633	hermes_set_irqmask(hw, ORINOCO_INTEN);
1634	err = hermes_enable_port(hw, 0);
1635	if (err) {
1636		printk(KERN_ERR "%s: Error %d enabling MAC port\n",
1637		       dev->name, err);
1638		return err;
1639	}
1640
1641	netif_start_queue(dev);
1642
1643	return 0;
1644}
1645
1646static int __orinoco_down(struct orinoco_private *priv)
1647{
1648	struct net_device *dev = priv->ndev;
1649	struct hermes *hw = &priv->hw;
1650	int err;
1651
1652	netif_stop_queue(dev);
1653
1654	if (!priv->hw_unavailable) {
1655		if (!priv->broken_disableport) {
1656			err = hermes_disable_port(hw, 0);
1657			if (err) {
1658				/* Some firmwares (e.g. Intersil 1.3.x) seem
1659				 * to have problems disabling the port, oh
1660				 * well, too bad. */
1661				printk(KERN_WARNING "%s: Error %d disabling MAC port\n",
1662				       dev->name, err);
1663				priv->broken_disableport = 1;
1664			}
1665		}
1666		hermes_set_irqmask(hw, 0);
1667		hermes_write_regn(hw, EVACK, 0xffff);
1668	}
1669
1670	orinoco_scan_done(priv, true);
1671
1672	/* firmware will have to reassociate */
1673	netif_carrier_off(dev);
1674	priv->last_linkstatus = 0xffff;
1675
1676	return 0;
1677}
1678
1679static int orinoco_reinit_firmware(struct orinoco_private *priv)
1680{
1681	struct hermes *hw = &priv->hw;
1682	int err;
1683
1684	err = hw->ops->init(hw);
1685	if (priv->do_fw_download && !err) {
1686		err = orinoco_download(priv);
1687		if (err)
1688			priv->do_fw_download = 0;
1689	}
1690	if (!err)
1691		err = orinoco_hw_allocate_fid(priv);
1692
1693	return err;
1694}
1695
1696static int
1697__orinoco_set_multicast_list(struct net_device *dev)
1698{
1699	struct orinoco_private *priv = ndev_priv(dev);
1700	int err = 0;
1701	int promisc, mc_count;
1702
1703	/* The Hermes doesn't seem to have an allmulti mode, so we go
1704	 * into promiscuous mode and let the upper levels deal. */
1705	if ((dev->flags & IFF_PROMISC) || (dev->flags & IFF_ALLMULTI) ||
1706	    (netdev_mc_count(dev) > MAX_MULTICAST(priv))) {
1707		promisc = 1;
1708		mc_count = 0;
1709	} else {
1710		promisc = 0;
1711		mc_count = netdev_mc_count(dev);
1712	}
1713
1714	err = __orinoco_hw_set_multicast_list(priv, dev, mc_count, promisc);
1715
1716	return err;
1717}
1718
1719/* This must be called from user context, without locks held - use
1720 * schedule_work() */
1721void orinoco_reset(struct work_struct *work)
1722{
1723	struct orinoco_private *priv =
1724		container_of(work, struct orinoco_private, reset_work);
1725	struct net_device *dev = priv->ndev;
1726	struct hermes *hw = &priv->hw;
1727	int err;
1728	unsigned long flags;
1729
1730	if (orinoco_lock(priv, &flags) != 0)
1731		/* When the hardware becomes available again, whatever
1732		 * detects that is responsible for re-initializing
1733		 * it. So no need for anything further */
1734		return;
1735
1736	netif_stop_queue(dev);
1737
1738	/* Shut off interrupts.  Depending on what state the hardware
1739	 * is in, this might not work, but we'll try anyway */
1740	hermes_set_irqmask(hw, 0);
1741	hermes_write_regn(hw, EVACK, 0xffff);
1742
1743	priv->hw_unavailable++;
1744	priv->last_linkstatus = 0xffff; /* firmware will have to reassociate */
1745	netif_carrier_off(dev);
1746
1747	orinoco_unlock(priv, &flags);
1748
1749	/* Scanning support: Notify scan cancellation */
1750	orinoco_scan_done(priv, true);
1751
1752	if (priv->hard_reset) {
1753		err = (*priv->hard_reset)(priv);
1754		if (err) {
1755			printk(KERN_ERR "%s: orinoco_reset: Error %d "
1756			       "performing hard reset\n", dev->name, err);
1757			goto disable;
1758		}
1759	}
1760
1761	err = orinoco_reinit_firmware(priv);
1762	if (err) {
1763		printk(KERN_ERR "%s: orinoco_reset: Error %d re-initializing firmware\n",
1764		       dev->name, err);
1765		goto disable;
1766	}
1767
1768	/* This has to be called from user context */
1769	orinoco_lock_irq(priv);
1770
1771	priv->hw_unavailable--;
1772
1773	/* priv->open or priv->hw_unavailable might have changed while
1774	 * we dropped the lock */
1775	if (priv->open && (!priv->hw_unavailable)) {
1776		err = __orinoco_up(priv);
1777		if (err) {
1778			printk(KERN_ERR "%s: orinoco_reset: Error %d reenabling card\n",
1779			       dev->name, err);
1780		} else
1781			netif_trans_update(dev);
1782	}
1783
1784	orinoco_unlock_irq(priv);
1785
1786	return;
1787 disable:
1788	hermes_set_irqmask(hw, 0);
1789	netif_device_detach(dev);
1790	printk(KERN_ERR "%s: Device has been disabled!\n", dev->name);
1791}
1792
1793static int __orinoco_commit(struct orinoco_private *priv)
1794{
1795	struct net_device *dev = priv->ndev;
1796	int err = 0;
1797
1798	/* If we've called commit, we are reconfiguring or bringing the
1799	 * interface up. Maintaining countermeasures across this would
1800	 * be confusing, so note that we've disabled them. The port will
1801	 * be enabled later in orinoco_commit or __orinoco_up. */
1802	priv->tkip_cm_active = 0;
1803
1804	err = orinoco_hw_program_rids(priv);
1805
1806	/* FIXME: what about netif_tx_lock */
1807	(void) __orinoco_set_multicast_list(dev);
1808
1809	return err;
1810}
1811
1812/* Ensures configuration changes are applied. May result in a reset.
1813 * The caller should hold priv->lock
1814 */
1815int orinoco_commit(struct orinoco_private *priv)
1816{
1817	struct net_device *dev = priv->ndev;
1818	struct hermes *hw = &priv->hw;
1819	int err;
1820
1821	if (priv->broken_disableport) {
1822		schedule_work(&priv->reset_work);
1823		return 0;
1824	}
1825
1826	err = hermes_disable_port(hw, 0);
1827	if (err) {
1828		printk(KERN_WARNING "%s: Unable to disable port "
1829		       "while reconfiguring card\n", dev->name);
1830		priv->broken_disableport = 1;
1831		goto out;
1832	}
1833
1834	err = __orinoco_commit(priv);
1835	if (err) {
1836		printk(KERN_WARNING "%s: Unable to reconfigure card\n",
1837		       dev->name);
1838		goto out;
1839	}
1840
1841	err = hermes_enable_port(hw, 0);
1842	if (err) {
1843		printk(KERN_WARNING "%s: Unable to enable port while reconfiguring card\n",
1844		       dev->name);
1845		goto out;
1846	}
1847
1848 out:
1849	if (err) {
1850		printk(KERN_WARNING "%s: Resetting instead...\n", dev->name);
1851		schedule_work(&priv->reset_work);
1852		err = 0;
1853	}
1854	return err;
1855}
1856
1857/********************************************************************/
1858/* Interrupt handler                                                */
1859/********************************************************************/
1860
1861static void __orinoco_ev_tick(struct net_device *dev, struct hermes *hw)
1862{
1863	printk(KERN_DEBUG "%s: TICK\n", dev->name);
1864}
1865
1866static void __orinoco_ev_wterr(struct net_device *dev, struct hermes *hw)
1867{
1868	/* This seems to happen a fair bit under load, but ignoring it
1869	   seems to work fine...*/
1870	printk(KERN_DEBUG "%s: MAC controller error (WTERR). Ignoring.\n",
1871	       dev->name);
1872}
1873
1874irqreturn_t orinoco_interrupt(int irq, void *dev_id)
1875{
1876	struct orinoco_private *priv = dev_id;
1877	struct net_device *dev = priv->ndev;
1878	struct hermes *hw = &priv->hw;
1879	int count = MAX_IRQLOOPS_PER_IRQ;
1880	u16 evstat, events;
1881	/* These are used to detect a runaway interrupt situation.
1882	 *
1883	 * If we get more than MAX_IRQLOOPS_PER_JIFFY iterations in a jiffy,
1884	 * we panic and shut down the hardware
1885	 */
1886	/* jiffies value the last time we were called */
1887	static int last_irq_jiffy; /* = 0 */
1888	static int loops_this_jiffy; /* = 0 */
1889	unsigned long flags;
1890
1891	if (orinoco_lock(priv, &flags) != 0) {
1892		/* If hw is unavailable - we don't know if the irq was
1893		 * for us or not */
1894		return IRQ_HANDLED;
1895	}
1896
1897	evstat = hermes_read_regn(hw, EVSTAT);
1898	events = evstat & hw->inten;
1899	if (!events) {
1900		orinoco_unlock(priv, &flags);
1901		return IRQ_NONE;
1902	}
1903
1904	if (jiffies != last_irq_jiffy)
1905		loops_this_jiffy = 0;
1906	last_irq_jiffy = jiffies;
1907
1908	while (events && count--) {
1909		if (++loops_this_jiffy > MAX_IRQLOOPS_PER_JIFFY) {
1910			printk(KERN_WARNING "%s: IRQ handler is looping too "
1911			       "much! Resetting.\n", dev->name);
1912			/* Disable interrupts for now */
1913			hermes_set_irqmask(hw, 0);
1914			schedule_work(&priv->reset_work);
1915			break;
1916		}
1917
1918		/* Check the card hasn't been removed */
1919		if (!hermes_present(hw)) {
1920			DEBUG(0, "orinoco_interrupt(): card removed\n");
1921			break;
1922		}
1923
1924		if (events & HERMES_EV_TICK)
1925			__orinoco_ev_tick(dev, hw);
1926		if (events & HERMES_EV_WTERR)
1927			__orinoco_ev_wterr(dev, hw);
1928		if (events & HERMES_EV_INFDROP)
1929			__orinoco_ev_infdrop(dev, hw);
1930		if (events & HERMES_EV_INFO)
1931			__orinoco_ev_info(dev, hw);
1932		if (events & HERMES_EV_RX)
1933			__orinoco_ev_rx(dev, hw);
1934		if (events & HERMES_EV_TXEXC)
1935			__orinoco_ev_txexc(dev, hw);
1936		if (events & HERMES_EV_TX)
1937			__orinoco_ev_tx(dev, hw);
1938		if (events & HERMES_EV_ALLOC)
1939			__orinoco_ev_alloc(dev, hw);
1940
1941		hermes_write_regn(hw, EVACK, evstat);
1942
1943		evstat = hermes_read_regn(hw, EVSTAT);
1944		events = evstat & hw->inten;
1945	}
1946
1947	orinoco_unlock(priv, &flags);
1948	return IRQ_HANDLED;
1949}
1950EXPORT_SYMBOL(orinoco_interrupt);
1951
1952/********************************************************************/
1953/* Power management                                                 */
1954/********************************************************************/
1955#if defined(CONFIG_PM_SLEEP) && !defined(CONFIG_HERMES_CACHE_FW_ON_INIT)
1956static int orinoco_pm_notifier(struct notifier_block *notifier,
1957			       unsigned long pm_event,
1958			       void *unused)
1959{
1960	struct orinoco_private *priv = container_of(notifier,
1961						    struct orinoco_private,
1962						    pm_notifier);
1963
1964	/* All we need to do is cache the firmware before suspend, and
1965	 * release it when we come out.
1966	 *
1967	 * Only need to do this if we're downloading firmware. */
1968	if (!priv->do_fw_download)
1969		return NOTIFY_DONE;
1970
1971	switch (pm_event) {
1972	case PM_HIBERNATION_PREPARE:
1973	case PM_SUSPEND_PREPARE:
1974		orinoco_cache_fw(priv, 0);
1975		break;
1976
1977	case PM_POST_RESTORE:
1978		/* Restore from hibernation failed. We need to clean
1979		 * up in exactly the same way, so fall through. */
1980	case PM_POST_HIBERNATION:
1981	case PM_POST_SUSPEND:
1982		orinoco_uncache_fw(priv);
1983		break;
1984
1985	case PM_RESTORE_PREPARE:
1986	default:
1987		break;
1988	}
1989
1990	return NOTIFY_DONE;
1991}
1992
1993static void orinoco_register_pm_notifier(struct orinoco_private *priv)
1994{
1995	priv->pm_notifier.notifier_call = orinoco_pm_notifier;
1996	register_pm_notifier(&priv->pm_notifier);
1997}
1998
1999static void orinoco_unregister_pm_notifier(struct orinoco_private *priv)
2000{
2001	unregister_pm_notifier(&priv->pm_notifier);
2002}
2003#else /* !PM_SLEEP || HERMES_CACHE_FW_ON_INIT */
2004#define orinoco_register_pm_notifier(priv) do { } while (0)
2005#define orinoco_unregister_pm_notifier(priv) do { } while (0)
2006#endif
2007
2008/********************************************************************/
2009/* Initialization                                                   */
2010/********************************************************************/
2011
2012int orinoco_init(struct orinoco_private *priv)
2013{
2014	struct device *dev = priv->dev;
2015	struct wiphy *wiphy = priv_to_wiphy(priv);
2016	struct hermes *hw = &priv->hw;
2017	int err = 0;
2018
2019	/* No need to lock, the hw_unavailable flag is already set in
2020	 * alloc_orinocodev() */
2021	priv->nicbuf_size = IEEE80211_MAX_FRAME_LEN + ETH_HLEN;
2022
2023	/* Initialize the firmware */
2024	err = hw->ops->init(hw);
2025	if (err != 0) {
2026		dev_err(dev, "Failed to initialize firmware (err = %d)\n",
2027			err);
2028		goto out;
2029	}
2030
2031	err = determine_fw_capabilities(priv, wiphy->fw_version,
2032					sizeof(wiphy->fw_version),
2033					&wiphy->hw_version);
2034	if (err != 0) {
2035		dev_err(dev, "Incompatible firmware, aborting\n");
2036		goto out;
2037	}
2038
2039	if (priv->do_fw_download) {
2040#ifdef CONFIG_HERMES_CACHE_FW_ON_INIT
2041		orinoco_cache_fw(priv, 0);
2042#endif
2043
2044		err = orinoco_download(priv);
2045		if (err)
2046			priv->do_fw_download = 0;
2047
2048		/* Check firmware version again */
2049		err = determine_fw_capabilities(priv, wiphy->fw_version,
2050						sizeof(wiphy->fw_version),
2051						&wiphy->hw_version);
2052		if (err != 0) {
2053			dev_err(dev, "Incompatible firmware, aborting\n");
2054			goto out;
2055		}
2056	}
2057
2058	if (priv->has_port3)
2059		dev_info(dev, "Ad-hoc demo mode supported\n");
2060	if (priv->has_ibss)
2061		dev_info(dev, "IEEE standard IBSS ad-hoc mode supported\n");
2062	if (priv->has_wep)
2063		dev_info(dev, "WEP supported, %s-bit key\n",
2064			 priv->has_big_wep ? "104" : "40");
2065	if (priv->has_wpa) {
2066		dev_info(dev, "WPA-PSK supported\n");
2067		if (orinoco_mic_init(priv)) {
2068			dev_err(dev, "Failed to setup MIC crypto algorithm. "
2069				"Disabling WPA support\n");
2070			priv->has_wpa = 0;
2071		}
2072	}
2073
2074	err = orinoco_hw_read_card_settings(priv, wiphy->perm_addr);
2075	if (err)
2076		goto out;
2077
2078	err = orinoco_hw_allocate_fid(priv);
2079	if (err) {
2080		dev_err(dev, "Failed to allocate NIC buffer!\n");
2081		goto out;
2082	}
2083
2084	/* Set up the default configuration */
2085	priv->iw_mode = NL80211_IFTYPE_STATION;
2086	/* By default use IEEE/IBSS ad-hoc mode if we have it */
2087	priv->prefer_port3 = priv->has_port3 && (!priv->has_ibss);
2088	set_port_type(priv);
2089	priv->channel = 0; /* use firmware default */
2090
2091	priv->promiscuous = 0;
2092	priv->encode_alg = ORINOCO_ALG_NONE;
2093	priv->tx_key = 0;
2094	priv->wpa_enabled = 0;
2095	priv->tkip_cm_active = 0;
2096	priv->key_mgmt = 0;
2097	priv->wpa_ie_len = 0;
2098	priv->wpa_ie = NULL;
2099
2100	if (orinoco_wiphy_register(wiphy)) {
2101		err = -ENODEV;
2102		goto out;
2103	}
2104
2105	/* Make the hardware available, as long as it hasn't been
2106	 * removed elsewhere (e.g. by PCMCIA hot unplug) */
2107	orinoco_lock_irq(priv);
2108	priv->hw_unavailable--;
2109	orinoco_unlock_irq(priv);
2110
2111	dev_dbg(dev, "Ready\n");
2112
2113 out:
2114	return err;
2115}
2116EXPORT_SYMBOL(orinoco_init);
2117
2118static const struct net_device_ops orinoco_netdev_ops = {
2119	.ndo_open		= orinoco_open,
2120	.ndo_stop		= orinoco_stop,
2121	.ndo_start_xmit		= orinoco_xmit,
2122	.ndo_set_rx_mode	= orinoco_set_multicast_list,
2123	.ndo_change_mtu		= orinoco_change_mtu,
2124	.ndo_set_mac_address	= eth_mac_addr,
2125	.ndo_validate_addr	= eth_validate_addr,
2126	.ndo_tx_timeout		= orinoco_tx_timeout,
 
2127};
2128
2129/* Allocate private data.
2130 *
2131 * This driver has a number of structures associated with it
2132 *  netdev - Net device structure for each network interface
2133 *  wiphy - structure associated with wireless phy
2134 *  wireless_dev (wdev) - structure for each wireless interface
2135 *  hw - structure for hermes chip info
2136 *  card - card specific structure for use by the card driver
2137 *         (airport, orinoco_cs)
2138 *  priv - orinoco private data
2139 *  device - generic linux device structure
2140 *
2141 *  +---------+    +---------+
2142 *  |  wiphy  |    | netdev  |
2143 *  | +-------+    | +-------+
2144 *  | | priv  |    | | wdev  |
2145 *  | | +-----+    +-+-------+
2146 *  | | | hw  |
2147 *  | +-+-----+
2148 *  | | card  |
2149 *  +-+-------+
2150 *
2151 * priv has a link to netdev and device
2152 * wdev has a link to wiphy
2153 */
2154struct orinoco_private
2155*alloc_orinocodev(int sizeof_card,
2156		  struct device *device,
2157		  int (*hard_reset)(struct orinoco_private *),
2158		  int (*stop_fw)(struct orinoco_private *, int))
2159{
2160	struct orinoco_private *priv;
2161	struct wiphy *wiphy;
2162
2163	/* allocate wiphy
2164	 * NOTE: We only support a single virtual interface
2165	 *       but this may change when monitor mode is added
2166	 */
2167	wiphy = wiphy_new(&orinoco_cfg_ops,
2168			  sizeof(struct orinoco_private) + sizeof_card);
2169	if (!wiphy)
2170		return NULL;
2171
2172	priv = wiphy_priv(wiphy);
2173	priv->dev = device;
2174
2175	if (sizeof_card)
2176		priv->card = (void *)((unsigned long)priv
2177				      + sizeof(struct orinoco_private));
2178	else
2179		priv->card = NULL;
2180
2181	orinoco_wiphy_init(wiphy);
2182
2183#ifdef WIRELESS_SPY
2184	priv->wireless_data.spy_data = &priv->spy_data;
2185#endif
2186
2187	/* Set up default callbacks */
2188	priv->hard_reset = hard_reset;
2189	priv->stop_fw = stop_fw;
2190
2191	spin_lock_init(&priv->lock);
2192	priv->open = 0;
2193	priv->hw_unavailable = 1; /* orinoco_init() must clear this
2194				   * before anything else touches the
2195				   * hardware */
2196	INIT_WORK(&priv->reset_work, orinoco_reset);
2197	INIT_WORK(&priv->join_work, orinoco_join_ap);
2198	INIT_WORK(&priv->wevent_work, orinoco_send_wevents);
2199
2200	INIT_LIST_HEAD(&priv->rx_list);
2201	tasklet_init(&priv->rx_tasklet, orinoco_rx_isr_tasklet,
2202		     (unsigned long) priv);
2203
2204	spin_lock_init(&priv->scan_lock);
2205	INIT_LIST_HEAD(&priv->scan_list);
2206	INIT_WORK(&priv->process_scan, orinoco_process_scan_results);
2207
2208	priv->last_linkstatus = 0xffff;
2209
2210#if defined(CONFIG_HERMES_CACHE_FW_ON_INIT) || defined(CONFIG_PM_SLEEP)
2211	priv->cached_pri_fw = NULL;
2212	priv->cached_fw = NULL;
2213#endif
2214
2215	/* Register PM notifiers */
2216	orinoco_register_pm_notifier(priv);
2217
2218	return priv;
2219}
2220EXPORT_SYMBOL(alloc_orinocodev);
2221
2222/* We can only support a single interface. We provide a separate
2223 * function to set it up to distinguish between hardware
2224 * initialisation and interface setup.
2225 *
2226 * The base_addr and irq parameters are passed on to netdev for use
2227 * with SIOCGIFMAP.
2228 */
2229int orinoco_if_add(struct orinoco_private *priv,
2230		   unsigned long base_addr,
2231		   unsigned int irq,
2232		   const struct net_device_ops *ops)
2233{
2234	struct wiphy *wiphy = priv_to_wiphy(priv);
2235	struct wireless_dev *wdev;
2236	struct net_device *dev;
2237	int ret;
2238
2239	dev = alloc_etherdev(sizeof(struct wireless_dev));
2240
2241	if (!dev)
2242		return -ENOMEM;
2243
2244	/* Initialise wireless_dev */
2245	wdev = netdev_priv(dev);
2246	wdev->wiphy = wiphy;
2247	wdev->iftype = NL80211_IFTYPE_STATION;
2248
2249	/* Setup / override net_device fields */
2250	dev->ieee80211_ptr = wdev;
2251	dev->watchdog_timeo = HZ; /* 1 second timeout */
2252	dev->wireless_handlers = &orinoco_handler_def;
2253#ifdef WIRELESS_SPY
2254	dev->wireless_data = &priv->wireless_data;
2255#endif
2256	/* Default to standard ops if not set */
2257	if (ops)
2258		dev->netdev_ops = ops;
2259	else
2260		dev->netdev_ops = &orinoco_netdev_ops;
2261
2262	/* we use the default eth_mac_addr for setting the MAC addr */
2263
2264	/* Reserve space in skb for the SNAP header */
2265	dev->needed_headroom = ENCAPS_OVERHEAD;
2266
2267	netif_carrier_off(dev);
2268
2269	memcpy(dev->dev_addr, wiphy->perm_addr, ETH_ALEN);
2270
2271	dev->base_addr = base_addr;
2272	dev->irq = irq;
2273
2274	dev->min_mtu = ORINOCO_MIN_MTU;
2275	dev->max_mtu = ORINOCO_MAX_MTU;
2276
2277	SET_NETDEV_DEV(dev, priv->dev);
2278	ret = register_netdev(dev);
2279	if (ret)
2280		goto fail;
2281
2282	priv->ndev = dev;
2283
2284	/* Report what we've done */
2285	dev_dbg(priv->dev, "Registered interface %s.\n", dev->name);
2286
2287	return 0;
2288
2289 fail:
2290	free_netdev(dev);
2291	return ret;
2292}
2293EXPORT_SYMBOL(orinoco_if_add);
2294
2295void orinoco_if_del(struct orinoco_private *priv)
2296{
2297	struct net_device *dev = priv->ndev;
2298
2299	unregister_netdev(dev);
2300	free_netdev(dev);
2301}
2302EXPORT_SYMBOL(orinoco_if_del);
2303
2304void free_orinocodev(struct orinoco_private *priv)
2305{
2306	struct wiphy *wiphy = priv_to_wiphy(priv);
2307	struct orinoco_rx_data *rx_data, *temp;
2308	struct orinoco_scan_data *sd, *sdtemp;
2309
2310	/* If the tasklet is scheduled when we call tasklet_kill it
2311	 * will run one final time. However the tasklet will only
2312	 * drain priv->rx_list if the hw is still available. */
2313	tasklet_kill(&priv->rx_tasklet);
2314
2315	/* Explicitly drain priv->rx_list */
2316	list_for_each_entry_safe(rx_data, temp, &priv->rx_list, list) {
2317		list_del(&rx_data->list);
2318
2319		dev_kfree_skb(rx_data->skb);
2320		kfree(rx_data->desc);
2321		kfree(rx_data);
2322	}
2323
2324	cancel_work_sync(&priv->process_scan);
2325	/* Explicitly drain priv->scan_list */
2326	list_for_each_entry_safe(sd, sdtemp, &priv->scan_list, list) {
2327		list_del(&sd->list);
2328
2329		if (sd->len > 0)
2330			kfree(sd->buf);
2331		kfree(sd);
2332	}
2333
2334	orinoco_unregister_pm_notifier(priv);
2335	orinoco_uncache_fw(priv);
2336
2337	priv->wpa_ie_len = 0;
2338	kfree(priv->wpa_ie);
2339	orinoco_mic_free(priv);
2340	wiphy_free(wiphy);
2341}
2342EXPORT_SYMBOL(free_orinocodev);
2343
2344int orinoco_up(struct orinoco_private *priv)
2345{
2346	struct net_device *dev = priv->ndev;
2347	unsigned long flags;
2348	int err;
2349
2350	priv->hw.ops->lock_irqsave(&priv->lock, &flags);
2351
2352	err = orinoco_reinit_firmware(priv);
2353	if (err) {
2354		printk(KERN_ERR "%s: Error %d re-initializing firmware\n",
2355		       dev->name, err);
2356		goto exit;
2357	}
2358
2359	netif_device_attach(dev);
2360	priv->hw_unavailable--;
2361
2362	if (priv->open && !priv->hw_unavailable) {
2363		err = __orinoco_up(priv);
2364		if (err)
2365			printk(KERN_ERR "%s: Error %d restarting card\n",
2366			       dev->name, err);
2367	}
2368
2369exit:
2370	priv->hw.ops->unlock_irqrestore(&priv->lock, &flags);
2371
2372	return 0;
2373}
2374EXPORT_SYMBOL(orinoco_up);
2375
2376void orinoco_down(struct orinoco_private *priv)
2377{
2378	struct net_device *dev = priv->ndev;
2379	unsigned long flags;
2380	int err;
2381
2382	priv->hw.ops->lock_irqsave(&priv->lock, &flags);
2383	err = __orinoco_down(priv);
2384	if (err)
2385		printk(KERN_WARNING "%s: Error %d downing interface\n",
2386		       dev->name, err);
2387
2388	netif_device_detach(dev);
2389	priv->hw_unavailable++;
2390	priv->hw.ops->unlock_irqrestore(&priv->lock, &flags);
2391}
2392EXPORT_SYMBOL(orinoco_down);
2393
2394/********************************************************************/
2395/* Module initialization                                            */
2396/********************************************************************/
2397
2398/* Can't be declared "const" or the whole __initdata section will
2399 * become const */
2400static char version[] __initdata = DRIVER_NAME " " DRIVER_VERSION
2401	" (David Gibson <hermes@gibson.dropbear.id.au>, "
2402	"Pavel Roskin <proski@gnu.org>, et al)";
2403
2404static int __init init_orinoco(void)
2405{
2406	printk(KERN_DEBUG "%s\n", version);
2407	return 0;
2408}
2409
2410static void __exit exit_orinoco(void)
2411{
2412}
2413
2414module_init(init_orinoco);
2415module_exit(exit_orinoco);