diff options
Diffstat (limited to 'target/linux/patches/6.17.2')
| -rw-r--r-- | target/linux/patches/6.17.2/0001-pcmcia-Add-Hitachi-HD6446x-PCMCIA-socket-support.patch | 720 | ||||
| -rw-r--r-- | target/linux/patches/6.17.2/orinoco.patch | 12933 |
2 files changed, 13653 insertions, 0 deletions
diff --git a/target/linux/patches/6.17.2/0001-pcmcia-Add-Hitachi-HD6446x-PCMCIA-socket-support.patch b/target/linux/patches/6.17.2/0001-pcmcia-Add-Hitachi-HD6446x-PCMCIA-socket-support.patch new file mode 100644 index 000000000..5c46fe5e4 --- /dev/null +++ b/target/linux/patches/6.17.2/0001-pcmcia-Add-Hitachi-HD6446x-PCMCIA-socket-support.patch @@ -0,0 +1,720 @@ +From b6ffbcb525539139a9b2255b992622f92757ea37 Mon Sep 17 00:00:00 2001 +From: Artur Rojek <contact@artur-rojek.eu> +Date: Fri, 1 Aug 2025 22:52:22 +0200 +Subject: [PATCH] pcmcia: Add Hitachi HD6446x PCMCIA socket support + +Introduce support for the PC Card Controller part of the Hitachi HD6446x +series of Intelligent Peripheral Controllers. + +WIP code. DO NOT UPSTREAM! +--- + arch/sh/boards/mach-hp6xx/setup.c | 45 ++- + arch/sh/cchips/hd6446x/hd64461.c | 56 +++- + arch/sh/include/asm/hd64461.h | 6 +- + drivers/pcmcia/Kconfig | 7 + + drivers/pcmcia/Makefile | 1 + + drivers/pcmcia/hd6446x_pcc.c | 453 ++++++++++++++++++++++++++++++ + include/pcmcia/hd6446x_pcc.h | 9 + + 7 files changed, 569 insertions(+), 8 deletions(-) + create mode 100644 drivers/pcmcia/hd6446x_pcc.c + create mode 100644 include/pcmcia/hd6446x_pcc.h + +diff --git a/arch/sh/boards/mach-hp6xx/setup.c b/arch/sh/boards/mach-hp6xx/setup.c +index 2ceead68d7bf..c697b8e1f5ac 100644 +--- a/arch/sh/boards/mach-hp6xx/setup.c ++++ b/arch/sh/boards/mach-hp6xx/setup.c +@@ -18,19 +18,23 @@ + #include <mach/hp6xx.h> + #include <cpu/dac.h> + ++#include <pcmcia/hd6446x_pcc.h> ++ + #define SCPCR 0xa4000116 + #define SCPDR 0xa4000136 + ++#define CF_MEM_ATTR (0x15000000 - 0) ++ + /* CF Slot */ + static struct resource cf_ide_resources[] = { + [0] = { +- .start = 0x15000000 + 0x1f0, +- .end = 0x15000000 + 0x1f0 + 0x08 - 0x01, ++ .start = CF_MEM_ATTR + 0x1f0, ++ .end = CF_MEM_ATTR + 0x1f0 + 0x08 - 0x01, + .flags = IORESOURCE_MEM, + }, + [1] = { +- .start = 0x15000000 + 0x1fe, +- .end = 0x15000000 + 0x1fe + 0x01, ++ .start = CF_MEM_ATTR + 0x1fe, ++ .end = CF_MEM_ATTR + 0x1fe + 0x01, + .flags = IORESOURCE_MEM, + }, + [2] = { +@@ -51,6 +55,36 @@ static struct platform_device jornadakbd_device = { + .id = -1, + }; + ++static struct resource hd6446x_pcc_resources[] = { ++ [0] = { ++ .start = HD64461_PCC0ISR, ++ .end = HD64461_PCC0ISR + 0x10, ++ .flags = IORESOURCE_MEM, ++ }, ++ [1] = { ++ .start = HD64461_PCC0_BASE, ++ .end = HD64461_PCC0_BASE + 0x4000000, ++ .flags = IORESOURCE_MEM, ++ }, ++ [2] = { ++ .start = HD64461_IRQ_PCC0, ++ .flags = IORESOURCE_IRQ, ++ }, ++}; ++ ++static struct hd6446x_pcc_plat_data hd6446x_pcc_platform_data = { ++ .slot_id = 1, ++ .io_support = true, ++}; ++ ++static struct platform_device hp6446x_pcc_device = { ++ .name = "hd6446x_pcc", ++ .id = -1, ++ .num_resources = ARRAY_SIZE(hd6446x_pcc_resources), ++ .resource = hd6446x_pcc_resources, ++ .dev.platform_data = &hd6446x_pcc_platform_data, ++}; ++ + static void dac_audio_start(struct dac_audio_pdata *pdata) + { + u16 v; +@@ -108,6 +142,7 @@ static struct platform_device *hp6xx_devices[] __initdata = { + &cf_ide_device, + &jornadakbd_device, + &dac_audio_device, ++ &hp6446x_pcc_device, + }; + + static void __init hp6xx_init_irq(void) +@@ -126,6 +161,8 @@ static void __init hp6xx_setup(char **cmdline_p) + u8 v8; + u16 v; + ++ __set_io_port_base(0); ++ + v = inw(HD64461_STBCR); + v |= HD64461_STBCR_SURTST | HD64461_STBCR_SIRST | + HD64461_STBCR_STM1ST | HD64461_STBCR_STM0ST | +diff --git a/arch/sh/cchips/hd6446x/hd64461.c b/arch/sh/cchips/hd6446x/hd64461.c +index 81764882d87d..965486584ee5 100644 +--- a/arch/sh/cchips/hd6446x/hd64461.c ++++ b/arch/sh/cchips/hd6446x/hd64461.c +@@ -4,7 +4,9 @@ + * Hitachi HD64461 companion chip support + */ + ++#include <linux/clkdev.h> + #include <linux/sched.h> ++#include <linux/sh_clk.h> + #include <linux/module.h> + #include <linux/kernel.h> + #include <linux/param.h> +@@ -45,7 +47,7 @@ static void hd64461_mask_and_ack_irq(struct irq_data *data) + hd64461_mask_irq(data); + + #ifdef CONFIG_HD64461_ENABLER +- if (data->irq == HD64461_IRQBASE + 13) ++ if (data->irq == HD64461_IRQ_PCC1) + __raw_writeb(0x00, HD64461_PCC1CSCR); + #endif + } +@@ -72,6 +74,51 @@ static void hd64461_irq_demux(struct irq_desc *desc) + } + } + ++static int hd64461_clk_enable(struct clk *clk) ++{ ++ u16 reg = __raw_readw(HD64461_STBCR); ++ ++ printk("clk enable: %d\n", clk->enable_bit); ++ ++ __raw_writew(reg & ~(1 << clk->enable_bit), HD64461_STBCR); ++ ++ return 0; ++} ++ ++static void hd64461_clk_disable(struct clk *clk) ++{ ++ u16 reg = __raw_readw(HD64461_STBCR); ++ ++ printk("clk disable: %d\n", clk->enable_bit); ++ //panic("clk disable: %d\n", clk->enable_bit); ++ ++ ++ __raw_writew(reg | (1 << clk->enable_bit), HD64461_STBCR); ++} ++ ++static struct sh_clk_ops hd64461_clk_ops = { ++ .enable = hd64461_clk_enable, ++ .disable = hd64461_clk_disable, ++}; ++ ++static struct clk hd64461_clk[] = { ++ { ++ .enable_bit = 5, ++ .ops = &hd64461_clk_ops, ++ .flags = CLK_ENABLE_ON_INIT, ++ }, ++ { ++ .enable_bit = 6, ++ .ops = &hd64461_clk_ops, ++ .flags = CLK_ENABLE_ON_INIT, ++ }, ++}; ++ ++static struct clk_lookup hd64461_clk_lookup[] = { ++ CLKDEV_CON_ID("pcc1", &hd64461_clk[0]), ++ CLKDEV_CON_ID("pcc0", &hd64461_clk[1]), ++}; ++ + static int __init setup_hd64461(void) + { + int irq_base, i; +@@ -106,6 +153,13 @@ static int __init setup_hd64461(void) + __raw_writeb(0x00, HD64461_PCC1CSCR); + #endif + ++// for (i = 0; i < ARRAY_SIZE(hd64461_clk); i++) ++// clk_register(&hd64461_clk[i]); ++ clk_register(&hd64461_clk[1]); ++ clkdev_add_table(hd64461_clk_lookup, ARRAY_SIZE(hd64461_clk_lookup)); ++ ++ printk("done with clk setup\n"); ++ + return 0; + } + +diff --git a/arch/sh/include/asm/hd64461.h b/arch/sh/include/asm/hd64461.h +index d2c485fa333b..91823ec07f79 100644 +--- a/arch/sh/include/asm/hd64461.h ++++ b/arch/sh/include/asm/hd64461.h +@@ -17,9 +17,9 @@ + #define HD64461_IOBASE 0xb0000000 + #define HD64461_IO_OFFSET(x) (HD64461_IOBASE + (x)) + #define HD64461_PCC0_BASE HD64461_IO_OFFSET(0x8000000) +-#define HD64461_PCC0_ATTR (HD64461_PCC0_BASE) /* 0xb80000000 */ +-#define HD64461_PCC0_COMM (HD64461_PCC0_BASE+HD64461_PCC_WINDOW) /* 0xb90000000 */ +-#define HD64461_PCC0_IO (HD64461_PCC0_BASE+2*HD64461_PCC_WINDOW) /* 0xba0000000 */ ++#define HD64461_PCC0_ATTR (HD64461_PCC0_BASE) /* 0xb8000000 */ ++#define HD64461_PCC0_COMM (HD64461_PCC0_BASE+HD64461_PCC_WINDOW) /* 0xb9000000 */ ++#define HD64461_PCC0_IO (HD64461_PCC0_BASE+2*HD64461_PCC_WINDOW) /* 0xba000000 */ + + /* Area 5 - Slot 1 - memory card only */ + #define HD64461_PCC1_BASE HD64461_IO_OFFSET(0x4000000) +diff --git a/drivers/pcmcia/Kconfig b/drivers/pcmcia/Kconfig +index dddb235dd020..f2434ca15c8e 100644 +--- a/drivers/pcmcia/Kconfig ++++ b/drivers/pcmcia/Kconfig +@@ -159,6 +159,13 @@ config PCMCIA_ALCHEMY_DEVBOARD + + This driver is also available as a module called db1xxx_ss.ko + ++config PCMCIA_HD6446X_PCC ++ tristate "Hitachi HD6446x PCMCIA socket support" ++ depends on PCMCIA && HD6446X_SERIES ++ help ++ Say Y here to include support for the PC Card Controller part of ++ the Hitachi HD6446x series of Intelligent Peripheral Controllers. ++ + config PCMCIA_XXS1500 + tristate "MyCable XXS1500 PCMCIA socket support" + depends on PCMCIA && MIPS_XXS1500 +diff --git a/drivers/pcmcia/Makefile b/drivers/pcmcia/Makefile +index c9d51b150682..764df19be544 100644 +--- a/drivers/pcmcia/Makefile ++++ b/drivers/pcmcia/Makefile +@@ -33,6 +33,7 @@ obj-$(CONFIG_OMAP_CF) += omap_cf.o + obj-$(CONFIG_ELECTRA_CF) += electra_cf.o + obj-$(CONFIG_PCMCIA_ALCHEMY_DEVBOARD) += db1xxx_ss.o + obj-$(CONFIG_PCMCIA_MAX1600) += max1600.o ++obj-$(CONFIG_PCMCIA_HD6446X_PCC) += hd6446x_pcc.o + + sa1111_cs-y += sa1111_generic.o + sa1111_cs-$(CONFIG_ASSABET_NEPONSET) += sa1111_neponset.o +diff --git a/drivers/pcmcia/hd6446x_pcc.c b/drivers/pcmcia/hd6446x_pcc.c +new file mode 100644 +index 000000000000..31074f93b55b +--- /dev/null ++++ b/drivers/pcmcia/hd6446x_pcc.c +@@ -0,0 +1,453 @@ ++// SPDX-License-Identifier: GPL-2.0 ++/* ++ * PC Card Controller driver for the Hitachi HD6446x series of Intelligent ++ * Peripheral Controllers. ++ * ++ * Copyright (c) 2023 - 2024 Artur Rojek <contact@artur-rojek.eu> ++ */ ++ ++#include <linux/clk.h> ++#include <linux/interrupt.h> ++#include <linux/of.h> ++#include <linux/platform_device.h> ++#include <pcmcia/hd6446x_pcc.h> ++#include <pcmcia/ss.h> ++#include <asm/hd64461.h> ++ ++#include "mach-common/mach/hp6xx.h" ++ ++#define HD6446X_PCC_ISR 0x00 ++#define HD6446X_PCC_GCR 0x02 ++#define HD6446X_PCC_CSCR 0x04 ++#define HD6446X_PCC_CSCIER 0x06 ++#define HD6446X_PCC_SCR 0x08 ++ ++#define HD6446X_PCC_ISR_CD (BIT(2) | BIT(3)) ++#define HD6446X_PCC_ISR_VS1 BIT(4) ++#define HD6446X_PCC_ISR_VS2 BIT(5) ++#define HD6446X_PCC_ISR_MWP BIT(6) ++#define HD6446X_PCC_ISR_READY BIT(7) ++ ++#define HD6446X_PCC_GCR_PMMOD BIT(3) ++#define HD6446X_PCC_GCR_VCC0 BIT(4) ++#define HD6446X_PCC_GCR_PCCT BIT(5) ++#define HD6446X_PCC_GCR_PCCR BIT(6) ++#define HD6446X_PCC_GCR_DRV BIT(7) ++ ++#define HD6446X_PCC_CSCR_BD BIT(0) ++#define HD6446X_PCC_CSCR_BW BIT(1) ++#define HD6446X_PCC_CSCR_RC BIT(2) ++#define HD6446X_PCC_CSCR_CDC BIT(3) ++#define HD6446X_PCC_CSCR_SC BIT(4) ++#define HD6446X_PCC_CSCR_IREQ BIT(5) ++#define HD6446X_PCC_CSCR_SCDI BIT(7) ++ ++#define HD6446X_PCC_CSCIER_BDE BIT(0) ++#define HD6446X_PCC_CSCIER_BWE BIT(1) ++#define HD6446X_PCC_CSCIER_RE BIT(2) ++#define HD6446X_PCC_CSCIER_CDE BIT(3) ++#define HD6446X_PCC_CSCIER_SCE BIT(4) ++#define HD6446X_PCC_CSCIER_IREQE_FALLING BIT(6) ++ ++#define HD6446X_PCC_SCR_VCC1 BIT(1) ++ ++#define HD6446X_PCC_WINDOW 0x1000000 /* 16 MiB */ ++ ++struct hd6446x_pcc { ++ const struct hd6446x_pcc_plat_data *pdata; ++ void __iomem *reg; ++ void __iomem *base; ++ struct clk *clk; ++ struct pcmcia_socket socket; ++ struct socket_state_t state; ++ bool memory_card; ++}; ++ ++static int hd64461_pcmcia_socket_set_voltage(struct hd6446x_pcc *pcc, int Vcc) ++{ ++ int gcr, scr, stbcr; ++ ++ gcr = readb(pcc->reg + HD6446X_PCC_GCR); ++ scr = readb(pcc->reg + HD6446X_PCC_SCR); ++ ++ switch (Vcc) { ++ case 0: ++ gcr |= HD6446X_PCC_GCR_VCC0; ++ scr |= HD6446X_PCC_SCR_VCC1; ++ break; ++ case 33: ++ gcr |= HD6446X_PCC_GCR_VCC0; ++ scr &= ~HD6446X_PCC_SCR_VCC1; ++ break; ++ case 50: ++ gcr &= ~HD6446X_PCC_GCR_VCC0; ++ scr &= ~HD6446X_PCC_SCR_VCC1; ++ break; ++ default: ++ printk("Unsupported voltage: %d\n", Vcc); ++ return -EINVAL; ++ } ++ ++ writeb(gcr, pcc->reg + HD6446X_PCC_GCR); ++ writeb(scr, pcc->reg + HD6446X_PCC_SCR); ++ ++// stbcr = readw(HD64461_STBCR); ++ ++ if (Vcc > 0) ++ clk_enable(pcc->clk); ++// stbcr &= ~HD64461_STBCR_SPC0ST; ++ else ++ clk_disable(pcc->clk); ++// stbcr |= HD64461_STBCR_SPC0ST; ++ ++// writew(stbcr, HD64461_STBCR); ++ ++ return 0; ++} ++ ++static int hd64461_pcmcia_socket_init(struct pcmcia_socket *sock) ++{ ++ struct hd6446x_pcc *pcc = sock->driver_data; ++ int reg; ++ ++ printk("socket_init\n"); ++ ++// printk("init BCR1: %04x\n", readw(0xffffff60)); ++ ++ (void)hd64461_pcmcia_socket_set_voltage(pcc, 0); ++ ++ reg = readb(HD64461_GPADR); ++ reg &= ~HD64461_GPADR_PCMCIA0; ++ writeb(reg, HD64461_GPADR); ++ ++ return 0; ++} ++ ++static int hd64461_pcmcia_socket_get_status(struct pcmcia_socket *sock, ++ unsigned int *value) ++{ ++// struct hd64461_pcmcia_socket *socket = sock->driver_data; ++ struct hd6446x_pcc *pcc = sock->driver_data; ++ unsigned int status = 0; ++ int reg; ++ ++ printk("get_status\n"); ++ ++ reg = readb(pcc->reg + HD6446X_PCC_ISR); ++ ++// printk("PCC0ISR: %02x\n", reg); ++ ++ if (reg & HD6446X_PCC_ISR_CD) ++ goto end; /* No card detected. */ ++ status |= SS_DETECT; ++ ++ if (pcc->memory_card) { ++ if (reg & HD6446X_PCC_ISR_READY) ++ status |= SS_READY; ++ ++ if (reg & HD6446X_PCC_ISR_MWP) ++ status |= SS_WRPROT; ++ } else ++ status |= SS_STSCHG; ++ ++ if (!(reg & HD6446X_PCC_ISR_VS1)) { ++ status |= SS_3VCARD; ++ printk("3v3 card\n"); ++ } ++ ++ if (!(reg & HD6446X_PCC_ISR_VS2)) { ++ status |= SS_XVCARD; ++ printk("X.Xv card\n"); ++ } ++ ++ if (pcc->state.Vcc || pcc->state.Vpp) ++ status |= SS_POWERON; ++ ++end: ++ *value = status; ++// printk("status: %x, memory: %d\n", status, socket->memory_card); ++ ++ return 0; ++} ++ ++static int hd64461_pcmcia_socket_configure(struct pcmcia_socket *sock, ++ struct socket_state_t *state) ++{ ++// struct hd64461_pcmcia_socket *socket = sock->driver_data; ++ struct hd6446x_pcc *pcc = sock->driver_data; ++ int reg = 0; ++// unsigned long flags; ++ ++ writeb(0x0, pcc->reg + HD6446X_PCC_CSCIER); ++ ++// local_irq_save(flags); ++ ++// printk("socket_configure, flags: %x, csc_mask: %x, Vcc: %d, Vpp: %d, io_irq: %x\n", ++// state->flags, state->csc_mask, state->Vcc, state->Vpp, state->io_irq); ++ ++ if (state->Vcc != pcc->state.Vcc || state->Vpp != pcc->state.Vpp) ++ if (hd64461_pcmcia_socket_set_voltage(pcc, state->Vcc)) { ++// local_irq_restore(flags); ++ return -EINVAL; ++ } ++ ++ //reg = readb(HD64461_PCC0CSCIER) & HD64461_PCCCSCIER_IREQE_MASK; ++ reg = HD6446X_PCC_CSCIER_IREQE_FALLING; ++// reg = 0; ++ ++ if (state->csc_mask & SS_DETECT) ++ reg |= HD6446X_PCC_CSCIER_CDE; ++ if (state->csc_mask & SS_READY) ++ reg |= HD6446X_PCC_CSCIER_RE; ++ if (state->csc_mask & SS_BATDEAD) ++ reg |= HD6446X_PCC_CSCIER_BDE; ++ if (state->csc_mask & SS_BATWARN) ++ reg |= HD6446X_PCC_CSCIER_BWE; ++ if (state->csc_mask & SS_STSCHG) ++ reg |= HD6446X_PCC_CSCIER_SCE; ++// if (state->flags & SS_IOCARD) ++// reg = HD64461_PCCCSCIER_IREQE_FALLING; ++ ++ ++ writeb(reg, pcc->reg + HD6446X_PCC_CSCIER); ++ ++// reg = readb(HD64461_PCC0GCR); ++// reg = 0; ++// reg = HD6446X_PCC_GCR_PMMOD; ++ reg = readb(pcc->reg + HD6446X_PCC_GCR) & ~(HD6446X_PCC_GCR_PCCT | ++ HD6446X_PCC_GCR_PCCR | ++ HD6446X_PCC_GCR_DRV); ++ ++ pcc->memory_card = !(state->flags & SS_IOCARD); ++ if (!pcc->memory_card) ++ reg |= HD6446X_PCC_GCR_PCCT; ++ if (state->flags & SS_RESET) ++ reg |= HD6446X_PCC_GCR_PCCR; ++ if (state->flags & SS_OUTPUT_ENA) ++ reg |= HD6446X_PCC_GCR_DRV; ++ ++#if 0 ++ if (socket->memory_card) ++ reg &= ~HD64461_PCCGCR_PCCT; ++ else ++ reg |= HD64461_PCCGCR_PCCT; ++ if (state->flags & SS_RESET) ++ reg |= HD64461_PCCGCR_PCCR; ++ else ++ reg &= ~HD64461_PCCGCR_PCCR; ++ if (state->flags & SS_OUTPUT_ENA) ++ reg |= HD64461_PCCGCR_DRVE; ++ else ++ reg &= ~HD64461_PCCGCR_DRVE; ++#endif ++ ++ writeb(reg, pcc->reg + HD6446X_PCC_GCR); ++ ++ pcc->state = *state; ++ ++// local_irq_restore(flags); ++ ++// printk("Configured: %x\n", state->flags); ++// printk("config BCR1: %04x\n", readw(0xffffff60)); ++ ++ return 0; ++} ++ ++static int hd6446x_pcc_set_io_map(struct pcmcia_socket *socket, ++ struct pccard_io_map *io) ++{ ++ /* We use a static map. */ ++ printk("hd6446x_pcc_set_io_map\n"); ++ return 0; ++} ++ ++static int hd64461_pcmcia_socket_set_mem_map(struct pcmcia_socket *sock, ++ struct pccard_mem_map *map) ++{ ++ struct hd6446x_pcc *pcc = sock->driver_data; ++// printk("set_mem_map\n"); ++ ++ if (map->map >= MAX_WIN) ++ return -EINVAL; ++ ++ map->static_start = (uintptr_t)pcc->base + map->card_start; ++// map->static_start = HD64461_PCC0_BASE + map->card_start; ++// map->static_start = 0x8000000 + map->card_start; ++ ++// printk("map->flags %d: %x\n", map->map, map->flags); ++ ++ if (!(map->flags & MAP_ATTRIB)) ++ map->static_start += HD6446X_PCC_WINDOW; ++ ++ return 0; ++} ++ ++static struct pccard_operations hd64461_pcmcia_socket_ops = { ++ .init = hd64461_pcmcia_socket_init, ++ .get_status = hd64461_pcmcia_socket_get_status, ++ .set_socket = hd64461_pcmcia_socket_configure, ++ .set_io_map = hd6446x_pcc_set_io_map, ++ .set_mem_map = hd64461_pcmcia_socket_set_mem_map, ++}; ++ ++static irqreturn_t hd64461_pcmcia_socket_irq(int irq, void *data) ++{ ++ struct hd6446x_pcc *pcc = data; ++ int reg = readb(pcc->reg + HD6446X_PCC_CSCR) & ~HD6446X_PCC_CSCR_SCDI; ++ unsigned int events = 0; ++ ++ if (reg & HD6446X_PCC_CSCR_IREQ) { ++ reg &= ~HD6446X_PCC_CSCR_IREQ; ++ writeb(reg, pcc->reg + HD6446X_PCC_CSCR); ++ ++ return IRQ_NONE; ++ } ++ ++ if (reg & HD6446X_PCC_CSCR_CDC) { ++ reg &= ~HD6446X_PCC_CSCR_CDC; ++ events |= SS_DETECT; ++ ++ /* Card has been ejected. */ ++ if (readb(pcc->reg + HD6446X_PCC_ISR) & HD6446X_PCC_ISR_CD) ++ reg &= ~(HD6446X_PCC_CSCR_RC | HD6446X_PCC_CSCR_BW | ++ HD6446X_PCC_CSCR_BD | HD6446X_PCC_CSCR_SC); ++ } ++ ++ if (pcc->memory_card) { ++ if (reg & HD6446X_PCC_CSCR_RC) { ++ reg &= ~HD6446X_PCC_CSCR_RC; ++ events |= SS_READY; ++ } ++ ++ if (reg & HD6446X_PCC_CSCR_BW) { ++ reg &= ~HD6446X_PCC_CSCR_BW; ++ events |= SS_BATWARN; ++ } ++ ++ if (reg & HD6446X_PCC_CSCR_BD) { ++ reg &= ~HD6446X_PCC_CSCR_BD; ++ events |= SS_BATDEAD; ++ } ++ } else if (reg & HD6446X_PCC_CSCR_SC) { ++ reg &= ~HD6446X_PCC_CSCR_SC; ++ events |= SS_STSCHG; ++ } ++ ++ writeb(reg, pcc->reg + HD6446X_PCC_CSCR); ++ ++ if (events) ++ pcmcia_parse_events(&pcc->socket, events); ++ ++// writeb(reg, HD64461_PCC0CSCR); ++ ++ return IRQ_HANDLED; ++} ++ ++static int hd64461_pcmcia_socket_probe(struct platform_device *pdev) ++{ ++ struct hd6446x_pcc *pcc; ++ struct device *dev = &pdev->dev; ++ struct pcmcia_socket *sock; ++ int irq; ++ int reg, ret; ++ ++ printk("pcc probe\n"); ++ ++// pcc = dev.platform_data; ++// socket = platform_get_drvdata(pdev); ++ ++ pcc = devm_kzalloc(dev, sizeof(*pcc), GFP_KERNEL); ++ if (!pcc) ++ return -ENOMEM; ++ ++ pcc->pdata = dev_get_platdata(dev); ++ if (!pcc->pdata) { ++ dev_err(dev, "Unable to get platform data\n"); ++ return -EINVAL; ++ } ++ ++ pcc->memory_card = true; ++ irq = platform_get_irq(pdev, 0); ++ ++ pcc->reg = devm_platform_ioremap_resource(pdev, 0); ++ if (IS_ERR(pcc->reg)) { ++ return PTR_ERR(pcc->reg); ++ } ++ ++ pcc->base = devm_platform_ioremap_resource(pdev, 1); ++ if (IS_ERR(pcc->base)) { ++ return PTR_ERR(pcc->base); ++ } ++ ++// pcc->reg = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++// pcc->base = platform_get_resource(pdev, IORESOURCE_MEM, 1); ++ ++ sock = &pcc->socket; ++ sock->driver_data = pcc; ++ sock->resource_ops = &pccard_static_ops; ++ sock->ops = &hd64461_pcmcia_socket_ops; ++ sock->owner = THIS_MODULE; ++ sock->dev.parent = &pdev->dev; ++ sock->features = SS_CAP_STATIC_MAP | SS_CAP_PCCARD | SS_CAP_PAGE_REGS; ++ sock->pci_irq = irq; ++ sock->irq_mask = 0xffde; ++ ++ sock->map_size = HD6446X_PCC_WINDOW; ++ sock->io_offset = (uintptr_t)pcc->base + sock->map_size * 2; ++// sock->io_offset = HD6446X_PCC_IO; ++// sock->io_offset = 0x8000000 + HD64461_PCC_WINDOW * 2; ++ ++ printk("sh_io_port_base: %lx\n", sh_io_port_base); ++ ++ ret = pcmcia_register_socket(sock); ++ if (ret) { ++ dev_err(dev, "Unable to register socket\n"); ++ return ret; ++ } ++ ++ /* Put the hardware in a known state. */ ++// printk("CSCIER: %x\n", readb(pcc->reg + HD6446X_PCC_CSCIER)); ++ writeb(HD6446X_PCC_CSCIER_IREQE_FALLING | HD6446X_PCC_CSCIER_CDE, ++ pcc->reg + HD6446X_PCC_CSCIER); ++ writeb(0x0, pcc->reg + HD6446X_PCC_CSCR); ++ writeb(HD6446X_PCC_GCR_PMMOD | HD6446X_PCC_GCR_DRV, pcc->reg + HD6446X_PCC_GCR); ++ ++ ret = devm_request_irq(dev, irq, hd64461_pcmcia_socket_irq, ++ IRQF_SHARED, dev_name(dev), pcc); ++ if (ret < 0) { ++ dev_err(dev, "Failed to request irq: %d\n", ret); ++ return ret; ++ } ++ ++ pcc->clk = devm_clk_get_prepared(dev, ++ pcc->pdata->slot_id ? "pcc0" : "pcc1"); ++ if (IS_ERR(pcc->clk)) { ++ dev_err(dev, "Unable to get clock\n"); ++ return PTR_ERR(pcc->clk); ++ } ++// clk_disable(pcc->clk); ++ ++ printk("reg: %lx, base: %lx, basep: %lx\n", ++ (uintptr_t)pcc->reg, ++ (uintptr_t)pcc->base, ++ virt_to_phys(pcc->base)); ++ ++ return 0; ++} ++ ++static void hd64461_pcmcia_socket_remove(struct platform_device *pdev) ++{ ++ struct hd6446x_pcc *pcc = platform_get_drvdata(pdev); ++ ++ pcmcia_unregister_socket(&pcc->socket); ++} ++ ++static struct platform_driver hd64461_pcmcia_socket_driver = { ++ .driver = { ++ .name = "hd6446x_pcc", ++ }, ++ .probe = hd64461_pcmcia_socket_probe, ++ .remove = hd64461_pcmcia_socket_remove, ++}; ++ ++module_platform_driver(hd64461_pcmcia_socket_driver); +diff --git a/include/pcmcia/hd6446x_pcc.h b/include/pcmcia/hd6446x_pcc.h +new file mode 100644 +index 000000000000..d1fe98f0a701 +--- /dev/null ++++ b/include/pcmcia/hd6446x_pcc.h +@@ -0,0 +1,9 @@ ++#ifndef _HD6446X_PCC_ ++#define _HD6446X_PCC_ ++ ++struct hd6446x_pcc_plat_data { ++ int slot_id; ++ bool io_support; ++}; ++ ++#endif /* _HD6446X_PCC_ */ +-- +2.50.1 + diff --git a/target/linux/patches/6.17.2/orinoco.patch b/target/linux/patches/6.17.2/orinoco.patch new file mode 100644 index 000000000..6401013fd --- /dev/null +++ b/target/linux/patches/6.17.2/orinoco.patch @@ -0,0 +1,12933 @@ +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/Kconfig linux-6.15.6/drivers/net/wireless/intersil/Kconfig +--- linux-6.15.6.orig/drivers/net/wireless/intersil/Kconfig 2025-07-10 16:08:55.000000000 +0200 ++++ linux-6.15.6/drivers/net/wireless/intersil/Kconfig 2025-08-03 00:20:27.566744589 +0200 +@@ -12,6 +12,7 @@ + + if WLAN_VENDOR_INTERSIL + ++source "drivers/net/wireless/intersil/orinoco/Kconfig" + source "drivers/net/wireless/intersil/p54/Kconfig" + + endif # WLAN_VENDOR_INTERSIL +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/Makefile linux-6.15.6/drivers/net/wireless/intersil/Makefile +--- linux-6.15.6.orig/drivers/net/wireless/intersil/Makefile 2025-07-10 16:08:55.000000000 +0200 ++++ linux-6.15.6/drivers/net/wireless/intersil/Makefile 2025-08-03 00:20:54.161967083 +0200 +@@ -1,2 +1,3 @@ + # SPDX-License-Identifier: GPL-2.0-only ++obj-$(CONFIG_HERMES) += orinoco/ + obj-$(CONFIG_P54_COMMON) += p54/ +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/airport.c linux-6.15.6/drivers/net/wireless/intersil/orinoco/airport.c +--- linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/airport.c 1970-01-01 01:00:00.000000000 +0100 ++++ linux-6.15.6/drivers/net/wireless/intersil/orinoco/airport.c 2025-08-03 15:01:59.313131673 +0200 +@@ -0,0 +1,268 @@ ++/* airport.c ++ * ++ * A driver for "Hermes" chipset based Apple Airport wireless ++ * card. ++ * ++ * Copyright notice & release notes in file main.c ++ * ++ * Note specific to airport stub: ++ * ++ * 0.05 : first version of the new split driver ++ * 0.06 : fix possible hang on powerup, add sleep support ++ */ ++ ++#define DRIVER_NAME "airport" ++#define PFX DRIVER_NAME ": " ++ ++#include <linux/module.h> ++#include <linux/kernel.h> ++#include <linux/init.h> ++#include <linux/delay.h> ++#include <linux/mod_devicetable.h> ++#include <asm/pmac_feature.h> ++ ++#include "orinoco.h" ++ ++#define AIRPORT_IO_LEN (0x1000) /* one page */ ++ ++struct airport { ++ struct macio_dev *mdev; ++ void __iomem *vaddr; ++ unsigned int irq; ++ int irq_requested; ++ int ndev_registered; ++}; ++ ++static int ++airport_suspend(struct macio_dev *mdev, pm_message_t state) ++{ ++ struct orinoco_private *priv = dev_get_drvdata(&mdev->ofdev.dev); ++ struct net_device *dev = priv->ndev; ++ struct airport *card = priv->card; ++ unsigned long flags; ++ int err; ++ ++ printk(KERN_DEBUG "%s: Airport entering sleep mode\n", dev->name); ++ ++ err = orinoco_lock(priv, &flags); ++ if (err) { ++ printk(KERN_ERR "%s: hw_unavailable on PBOOK_SLEEP_NOW\n", ++ dev->name); ++ return 0; ++ } ++ ++ orinoco_down(priv); ++ orinoco_unlock(priv, &flags); ++ ++ disable_irq(card->irq); ++ pmac_call_feature(PMAC_FTR_AIRPORT_ENABLE, ++ macio_get_of_node(mdev), 0, 0); ++ ++ return 0; ++} ++ ++static int ++airport_resume(struct macio_dev *mdev) ++{ ++ struct orinoco_private *priv = dev_get_drvdata(&mdev->ofdev.dev); ++ struct net_device *dev = priv->ndev; ++ struct airport *card = priv->card; ++ unsigned long flags; ++ int err; ++ ++ printk(KERN_DEBUG "%s: Airport waking up\n", dev->name); ++ ++ pmac_call_feature(PMAC_FTR_AIRPORT_ENABLE, ++ macio_get_of_node(mdev), 0, 1); ++ msleep(200); ++ ++ enable_irq(card->irq); ++ ++ priv->hw.ops->lock_irqsave(&priv->lock, &flags); ++ err = orinoco_up(priv); ++ priv->hw.ops->unlock_irqrestore(&priv->lock, &flags); ++ ++ return err; ++} ++ ++static int ++airport_detach(struct macio_dev *mdev) ++{ ++ struct orinoco_private *priv = dev_get_drvdata(&mdev->ofdev.dev); ++ struct airport *card = priv->card; ++ ++ if (card->ndev_registered) ++ orinoco_if_del(priv); ++ card->ndev_registered = 0; ++ ++ if (card->irq_requested) ++ free_irq(card->irq, priv); ++ card->irq_requested = 0; ++ ++ if (card->vaddr) ++ iounmap(card->vaddr); ++ card->vaddr = NULL; ++ ++ macio_release_resource(mdev, 0); ++ ++ pmac_call_feature(PMAC_FTR_AIRPORT_ENABLE, ++ macio_get_of_node(mdev), 0, 0); ++ ssleep(1); ++ ++ macio_set_drvdata(mdev, NULL); ++ free_orinocodev(priv); ++ ++ return 0; ++} ++ ++static int airport_hard_reset(struct orinoco_private *priv) ++{ ++ /* It would be nice to power cycle the Airport for a real hard ++ * reset, but for some reason although it appears to ++ * re-initialize properly, it falls in a screaming heap ++ * shortly afterwards. */ ++#if 0 ++ struct airport *card = priv->card; ++ ++ /* Vitally important. If we don't do this it seems we get an ++ * interrupt somewhere during the power cycle, since ++ * hw_unavailable is already set it doesn't get ACKed, we get ++ * into an interrupt loop and the PMU decides to turn us ++ * off. */ ++ disable_irq(card->irq); ++ ++ pmac_call_feature(PMAC_FTR_AIRPORT_ENABLE, ++ macio_get_of_node(card->mdev), 0, 0); ++ ssleep(1); ++ pmac_call_feature(PMAC_FTR_AIRPORT_ENABLE, ++ macio_get_of_node(card->mdev), 0, 1); ++ ssleep(1); ++ ++ enable_irq(card->irq); ++ ssleep(1); ++#endif ++ ++ return 0; ++} ++ ++static int ++airport_attach(struct macio_dev *mdev, const struct of_device_id *match) ++{ ++ struct orinoco_private *priv; ++ struct airport *card; ++ unsigned long phys_addr; ++ struct hermes *hw; ++ ++ if (macio_resource_count(mdev) < 1 || macio_irq_count(mdev) < 1) { ++ printk(KERN_ERR PFX "Wrong interrupt/addresses in OF tree\n"); ++ return -ENODEV; ++ } ++ ++ /* Allocate space for private device-specific data */ ++ priv = alloc_orinocodev(sizeof(*card), &mdev->ofdev.dev, ++ airport_hard_reset, NULL); ++ if (!priv) { ++ printk(KERN_ERR PFX "Cannot allocate network device\n"); ++ return -ENODEV; ++ } ++ card = priv->card; ++ ++ hw = &priv->hw; ++ card->mdev = mdev; ++ ++ if (macio_request_resource(mdev, 0, DRIVER_NAME)) { ++ printk(KERN_ERR PFX "can't request IO resource !\n"); ++ free_orinocodev(priv); ++ return -EBUSY; ++ } ++ ++ macio_set_drvdata(mdev, priv); ++ ++ /* Setup interrupts & base address */ ++ card->irq = macio_irq(mdev, 0); ++ phys_addr = macio_resource_start(mdev, 0); /* Physical address */ ++ printk(KERN_DEBUG PFX "Physical address %lx\n", phys_addr); ++ card->vaddr = ioremap(phys_addr, AIRPORT_IO_LEN); ++ if (!card->vaddr) { ++ printk(KERN_ERR PFX "ioremap() failed\n"); ++ goto failed; ++ } ++ ++ hermes_struct_init(hw, card->vaddr, HERMES_16BIT_REGSPACING); ++ ++ /* Power up card */ ++ pmac_call_feature(PMAC_FTR_AIRPORT_ENABLE, ++ macio_get_of_node(mdev), 0, 1); ++ ssleep(1); ++ ++ /* Reset it before we get the interrupt */ ++ hw->ops->init(hw); ++ ++ if (request_irq(card->irq, orinoco_interrupt, 0, DRIVER_NAME, priv)) { ++ printk(KERN_ERR PFX "Couldn't get IRQ %d\n", card->irq); ++ goto failed; ++ } ++ card->irq_requested = 1; ++ ++ /* Initialise the main driver */ ++ if (orinoco_init(priv) != 0) { ++ printk(KERN_ERR PFX "orinoco_init() failed\n"); ++ goto failed; ++ } ++ ++ /* Register an interface with the stack */ ++ if (orinoco_if_add(priv, phys_addr, card->irq, NULL) != 0) { ++ printk(KERN_ERR PFX "orinoco_if_add() failed\n"); ++ goto failed; ++ } ++ card->ndev_registered = 1; ++ return 0; ++ failed: ++ airport_detach(mdev); ++ return -ENODEV; ++} /* airport_attach */ ++ ++ ++static char version[] __initdata = DRIVER_NAME " " DRIVER_VERSION ++ " (Benjamin Herrenschmidt <benh@kernel.crashing.org>)"; ++MODULE_AUTHOR("Benjamin Herrenschmidt <benh@kernel.crashing.org>"); ++MODULE_DESCRIPTION("Driver for the Apple Airport wireless card."); ++MODULE_LICENSE("Dual MPL/GPL"); ++ ++static const struct of_device_id airport_match[] = { ++ { ++ .name = "radio", ++ }, ++ {}, ++}; ++ ++MODULE_DEVICE_TABLE(of, airport_match); ++ ++static struct macio_driver airport_driver = { ++ .driver = { ++ .name = DRIVER_NAME, ++ .owner = THIS_MODULE, ++ .of_match_table = airport_match, ++ }, ++ .probe = airport_attach, ++ .remove = airport_detach, ++ .suspend = airport_suspend, ++ .resume = airport_resume, ++}; ++ ++static int __init ++init_airport(void) ++{ ++ printk(KERN_DEBUG "%s\n", version); ++ ++ return macio_register_driver(&airport_driver); ++} ++ ++static void __exit ++exit_airport(void) ++{ ++ macio_unregister_driver(&airport_driver); ++} ++ ++module_init(init_airport); ++module_exit(exit_airport); +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/cfg.c linux-6.15.6/drivers/net/wireless/intersil/orinoco/cfg.c +--- linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/cfg.c 1970-01-01 01:00:00.000000000 +0100 ++++ linux-6.15.6/drivers/net/wireless/intersil/orinoco/cfg.c 2025-08-03 16:35:08.118093622 +0200 +@@ -0,0 +1,292 @@ ++/* cfg80211 support ++ * ++ * See copyright notice in main.c ++ */ ++#include <linux/ieee80211.h> ++#include <net/cfg80211.h> ++#include "hw.h" ++#include "main.h" ++#include "orinoco.h" ++ ++#include "cfg.h" ++ ++/* Supported bitrates. Must agree with hw.c */ ++static struct ieee80211_rate orinoco_rates[] = { ++ { .bitrate = 10 }, ++ { .bitrate = 20 }, ++ { .bitrate = 55 }, ++ { .bitrate = 110 }, ++}; ++ ++static const void * const orinoco_wiphy_privid = &orinoco_wiphy_privid; ++ ++/* Called after orinoco_private is allocated. */ ++void orinoco_wiphy_init(struct wiphy *wiphy) ++{ ++ struct orinoco_private *priv = wiphy_priv(wiphy); ++ ++ wiphy->privid = orinoco_wiphy_privid; ++ ++ set_wiphy_dev(wiphy, priv->dev); ++} ++ ++/* Called after firmware is initialised */ ++int orinoco_wiphy_register(struct wiphy *wiphy) ++{ ++ struct orinoco_private *priv = wiphy_priv(wiphy); ++ int i, channels = 0; ++ ++ if (priv->firmware_type == FIRMWARE_TYPE_AGERE) ++ wiphy->max_scan_ssids = 1; ++ else ++ wiphy->max_scan_ssids = 0; ++ ++ wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION); ++ ++ /* TODO: should we set if we only have demo ad-hoc? ++ * (priv->has_port3) ++ */ ++ if (priv->has_ibss) ++ wiphy->interface_modes |= BIT(NL80211_IFTYPE_ADHOC); ++ ++ if (!priv->broken_monitor || force_monitor) ++ wiphy->interface_modes |= BIT(NL80211_IFTYPE_MONITOR); ++ ++ priv->band.bitrates = orinoco_rates; ++ priv->band.n_bitrates = ARRAY_SIZE(orinoco_rates); ++ ++ /* Only support channels allowed by the card EEPROM */ ++ for (i = 0; i < NUM_CHANNELS; i++) { ++ if (priv->channel_mask & (1 << i)) { ++ priv->channels[i].center_freq = ++ ieee80211_channel_to_frequency(i + 1, ++ NL80211_BAND_2GHZ); ++ channels++; ++ } ++ } ++ priv->band.channels = priv->channels; ++ priv->band.n_channels = channels; ++ ++ wiphy->bands[NL80211_BAND_2GHZ] = &priv->band; ++ wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM; ++ ++ i = 0; ++ if (priv->has_wep) { ++ priv->cipher_suites[i] = WLAN_CIPHER_SUITE_WEP40; ++ i++; ++ ++ if (priv->has_big_wep) { ++ priv->cipher_suites[i] = WLAN_CIPHER_SUITE_WEP104; ++ i++; ++ } ++ } ++ if (priv->has_wpa) { ++ priv->cipher_suites[i] = WLAN_CIPHER_SUITE_TKIP; ++ i++; ++ } ++ wiphy->cipher_suites = priv->cipher_suites; ++ wiphy->n_cipher_suites = i; ++ ++ wiphy->rts_threshold = priv->rts_thresh; ++ if (!priv->has_mwo) ++ wiphy->frag_threshold = priv->frag_thresh + 1; ++ wiphy->retry_short = priv->short_retry_limit; ++ wiphy->retry_long = priv->long_retry_limit; ++ ++ return wiphy_register(wiphy); ++} ++ ++static int orinoco_change_vif(struct wiphy *wiphy, struct net_device *dev, ++ enum nl80211_iftype type, ++ struct vif_params *params) ++{ ++ struct orinoco_private *priv = wiphy_priv(wiphy); ++ int err = 0; ++ unsigned long lock; ++ ++ if (orinoco_lock(priv, &lock) != 0) ++ return -EBUSY; ++ ++ switch (type) { ++ case NL80211_IFTYPE_ADHOC: ++ if (!priv->has_ibss && !priv->has_port3) ++ err = -EINVAL; ++ break; ++ ++ case NL80211_IFTYPE_STATION: ++ break; ++ ++ case NL80211_IFTYPE_MONITOR: ++ if (priv->broken_monitor && !force_monitor) { ++ wiphy_warn(wiphy, ++ "Monitor mode support is buggy in this firmware, not enabling\n"); ++ err = -EINVAL; ++ } ++ break; ++ ++ default: ++ err = -EINVAL; ++ } ++ ++ if (!err) { ++ priv->iw_mode = type; ++ set_port_type(priv); ++ err = orinoco_commit(priv); ++ } ++ ++ orinoco_unlock(priv, &lock); ++ ++ return err; ++} ++ ++static int orinoco_scan(struct wiphy *wiphy, ++ struct cfg80211_scan_request *request) ++{ ++ struct orinoco_private *priv = wiphy_priv(wiphy); ++ int err; ++ ++ if (!request) ++ return -EINVAL; ++ ++ if (priv->scan_request && priv->scan_request != request) ++ return -EBUSY; ++ ++ priv->scan_request = request; ++ ++ err = orinoco_hw_trigger_scan(priv, request->ssids); ++ /* On error the we aren't processing the request */ ++ if (err) ++ priv->scan_request = NULL; ++ ++ return err; ++} ++ ++static int orinoco_set_monitor_channel(struct wiphy *wiphy, ++ struct net_device *dev, ++ struct cfg80211_chan_def *chandef) ++{ ++ struct orinoco_private *priv = wiphy_priv(wiphy); ++ int err = 0; ++ unsigned long flags; ++ int channel; ++ ++ if (!chandef->chan) ++ return -EINVAL; ++ ++ if (cfg80211_get_chandef_type(chandef) != NL80211_CHAN_NO_HT) ++ return -EINVAL; ++ ++ if (chandef->chan->band != NL80211_BAND_2GHZ) ++ return -EINVAL; ++ ++ channel = ieee80211_frequency_to_channel(chandef->chan->center_freq); ++ ++ if ((channel < 1) || (channel > NUM_CHANNELS) || ++ !(priv->channel_mask & (1 << (channel - 1)))) ++ return -EINVAL; ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ return -EBUSY; ++ ++ priv->channel = channel; ++ if (priv->iw_mode == NL80211_IFTYPE_MONITOR) { ++ /* Fast channel change - no commit if successful */ ++ struct hermes *hw = &priv->hw; ++ err = hw->ops->cmd_wait(hw, HERMES_CMD_TEST | ++ HERMES_TEST_SET_CHANNEL, ++ channel, NULL); ++ } ++ orinoco_unlock(priv, &flags); ++ ++ return err; ++} ++ ++static int orinoco_set_wiphy_params(struct wiphy *wiphy, u32 changed) ++{ ++ struct orinoco_private *priv = wiphy_priv(wiphy); ++ int frag_value = -1; ++ int rts_value = -1; ++ int err = 0; ++ ++ if (changed & WIPHY_PARAM_RETRY_SHORT) { ++ /* Setting short retry not supported */ ++ err = -EINVAL; ++ } ++ ++ if (changed & WIPHY_PARAM_RETRY_LONG) { ++ /* Setting long retry not supported */ ++ err = -EINVAL; ++ } ++ ++ if (changed & WIPHY_PARAM_FRAG_THRESHOLD) { ++ /* Set fragmentation */ ++ if (priv->has_mwo) { ++ if (wiphy->frag_threshold == -1) ++ frag_value = 0; ++ else { ++ printk(KERN_WARNING "%s: Fixed fragmentation " ++ "is not supported on this firmware. " ++ "Using MWO robust instead.\n", ++ priv->ndev->name); ++ frag_value = 1; ++ } ++ } else { ++ if (wiphy->frag_threshold == -1) ++ frag_value = 2346; ++ else if ((wiphy->frag_threshold < 257) || ++ (wiphy->frag_threshold > 2347)) ++ err = -EINVAL; ++ else ++ /* cfg80211 value is 257-2347 (odd only) ++ * orinoco rid has range 256-2346 (even only) */ ++ frag_value = wiphy->frag_threshold & ~0x1; ++ } ++ } ++ ++ if (changed & WIPHY_PARAM_RTS_THRESHOLD) { ++ /* Set RTS. ++ * ++ * Prism documentation suggests default of 2432, ++ * and a range of 0-3000. ++ * ++ * Current implementation uses 2347 as the default and ++ * the upper limit. ++ */ ++ ++ if (wiphy->rts_threshold == -1) ++ rts_value = 2347; ++ else if (wiphy->rts_threshold > 2347) ++ err = -EINVAL; ++ else ++ rts_value = wiphy->rts_threshold; ++ } ++ ++ if (!err) { ++ unsigned long flags; ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ return -EBUSY; ++ ++ if (frag_value >= 0) { ++ if (priv->has_mwo) ++ priv->mwo_robust = frag_value; ++ else ++ priv->frag_thresh = frag_value; ++ } ++ if (rts_value >= 0) ++ priv->rts_thresh = rts_value; ++ ++ err = orinoco_commit(priv); ++ ++ orinoco_unlock(priv, &flags); ++ } ++ ++ return err; ++} ++ ++const struct cfg80211_ops orinoco_cfg_ops = { ++ .change_virtual_intf = orinoco_change_vif, ++ .set_monitor_channel = orinoco_set_monitor_channel, ++ .scan = orinoco_scan, ++ .set_wiphy_params = orinoco_set_wiphy_params, ++}; +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/cfg.h linux-6.15.6/drivers/net/wireless/intersil/orinoco/cfg.h +--- linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/cfg.h 1970-01-01 01:00:00.000000000 +0100 ++++ linux-6.15.6/drivers/net/wireless/intersil/orinoco/cfg.h 2025-08-03 15:01:59.313131673 +0200 +@@ -0,0 +1,15 @@ ++/* cfg80211 support. ++ * ++ * See copyright notice in main.c ++ */ ++#ifndef ORINOCO_CFG_H ++#define ORINOCO_CFG_H ++ ++#include <net/cfg80211.h> ++ ++extern const struct cfg80211_ops orinoco_cfg_ops; ++ ++void orinoco_wiphy_init(struct wiphy *wiphy); ++int orinoco_wiphy_register(struct wiphy *wiphy); ++ ++#endif /* ORINOCO_CFG_H */ +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/fw.c linux-6.15.6/drivers/net/wireless/intersil/orinoco/fw.c +--- linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/fw.c 1970-01-01 01:00:00.000000000 +0100 ++++ linux-6.15.6/drivers/net/wireless/intersil/orinoco/fw.c 2025-08-03 15:01:59.313131673 +0200 +@@ -0,0 +1,387 @@ ++/* Firmware file reading and download helpers ++ * ++ * See copyright notice in main.c ++ */ ++#include <linux/kernel.h> ++#include <linux/slab.h> ++#include <linux/firmware.h> ++#include <linux/device.h> ++#include <linux/module.h> ++ ++#include "hermes.h" ++#include "hermes_dld.h" ++#include "orinoco.h" ++ ++#include "fw.h" ++ ++/* End markers (for Symbol firmware only) */ ++#define TEXT_END 0x1A /* End of text header */ ++ ++struct fw_info { ++ char *pri_fw; ++ char *sta_fw; ++ char *ap_fw; ++ u32 pda_addr; ++ u16 pda_size; ++}; ++ ++static const struct fw_info orinoco_fw[] = { ++ { NULL, "agere_sta_fw.bin", "agere_ap_fw.bin", 0x00390000, 1000 }, ++ { NULL, "prism_sta_fw.bin", "prism_ap_fw.bin", 0, 1024 }, ++ { "symbol_sp24t_prim_fw", "symbol_sp24t_sec_fw", NULL, 0x00003100, 512 } ++}; ++MODULE_FIRMWARE("agere_sta_fw.bin"); ++MODULE_FIRMWARE("agere_ap_fw.bin"); ++MODULE_FIRMWARE("prism_sta_fw.bin"); ++MODULE_FIRMWARE("prism_ap_fw.bin"); ++MODULE_FIRMWARE("symbol_sp24t_prim_fw"); ++MODULE_FIRMWARE("symbol_sp24t_sec_fw"); ++ ++/* Structure used to access fields in FW ++ * Make sure LE decoding macros are used ++ */ ++struct orinoco_fw_header { ++ char hdr_vers[6]; /* ASCII string for header version */ ++ __le16 headersize; /* Total length of header */ ++ __le32 entry_point; /* NIC entry point */ ++ __le32 blocks; /* Number of blocks to program */ ++ __le32 block_offset; /* Offset of block data from eof header */ ++ __le32 pdr_offset; /* Offset to PDR data from eof header */ ++ __le32 pri_offset; /* Offset to primary plug data */ ++ __le32 compat_offset; /* Offset to compatibility data*/ ++ char signature[]; /* FW signature length headersize-20 */ ++} __packed; ++ ++/* Check the range of various header entries. Return a pointer to a ++ * description of the problem, or NULL if everything checks out. */ ++static const char *validate_fw(const struct orinoco_fw_header *hdr, size_t len) ++{ ++ u16 hdrsize; ++ ++ if (len < sizeof(*hdr)) ++ return "image too small"; ++ if (memcmp(hdr->hdr_vers, "HFW", 3) != 0) ++ return "format not recognised"; ++ ++ hdrsize = le16_to_cpu(hdr->headersize); ++ if (hdrsize > len) ++ return "bad headersize"; ++ if ((hdrsize + le32_to_cpu(hdr->block_offset)) > len) ++ return "bad block offset"; ++ if ((hdrsize + le32_to_cpu(hdr->pdr_offset)) > len) ++ return "bad PDR offset"; ++ if ((hdrsize + le32_to_cpu(hdr->pri_offset)) > len) ++ return "bad PRI offset"; ++ if ((hdrsize + le32_to_cpu(hdr->compat_offset)) > len) ++ return "bad compat offset"; ++ ++ /* TODO: consider adding a checksum or CRC to the firmware format */ ++ return NULL; ++} ++ ++#if defined(CONFIG_HERMES_CACHE_FW_ON_INIT) || defined(CONFIG_PM_SLEEP) ++static inline const struct firmware * ++orinoco_cached_fw_get(struct orinoco_private *priv, bool primary) ++{ ++ if (primary) ++ return priv->cached_pri_fw; ++ else ++ return priv->cached_fw; ++} ++#else ++#define orinoco_cached_fw_get(priv, primary) (NULL) ++#endif ++ ++/* Download either STA or AP firmware into the card. */ ++static int ++orinoco_dl_firmware(struct orinoco_private *priv, ++ const struct fw_info *fw, ++ int ap) ++{ ++ /* Plug Data Area (PDA) */ ++ __le16 *pda; ++ ++ struct hermes *hw = &priv->hw; ++ const struct firmware *fw_entry; ++ const struct orinoco_fw_header *hdr; ++ const unsigned char *first_block; ++ const void *end; ++ const char *firmware; ++ const char *fw_err; ++ struct device *dev = priv->dev; ++ int err = 0; ++ ++ pda = kzalloc(fw->pda_size, GFP_KERNEL); ++ if (!pda) ++ return -ENOMEM; ++ ++ if (ap) ++ firmware = fw->ap_fw; ++ else ++ firmware = fw->sta_fw; ++ ++ dev_dbg(dev, "Attempting to download firmware %s\n", firmware); ++ ++ /* Read current plug data */ ++ err = hw->ops->read_pda(hw, pda, fw->pda_addr, fw->pda_size); ++ dev_dbg(dev, "Read PDA returned %d\n", err); ++ if (err) ++ goto free; ++ ++ if (!orinoco_cached_fw_get(priv, false)) { ++ err = request_firmware(&fw_entry, firmware, priv->dev); ++ ++ if (err) { ++ dev_err(dev, "Cannot find firmware %s\n", firmware); ++ err = -ENOENT; ++ goto free; ++ } ++ } else ++ fw_entry = orinoco_cached_fw_get(priv, false); ++ ++ hdr = (const struct orinoco_fw_header *) fw_entry->data; ++ ++ fw_err = validate_fw(hdr, fw_entry->size); ++ if (fw_err) { ++ dev_warn(dev, "Invalid firmware image detected (%s). " ++ "Aborting download\n", fw_err); ++ err = -EINVAL; ++ goto abort; ++ } ++ ++ /* Enable aux port to allow programming */ ++ err = hw->ops->program_init(hw, le32_to_cpu(hdr->entry_point)); ++ dev_dbg(dev, "Program init returned %d\n", err); ++ if (err != 0) ++ goto abort; ++ ++ /* Program data */ ++ first_block = (fw_entry->data + ++ le16_to_cpu(hdr->headersize) + ++ le32_to_cpu(hdr->block_offset)); ++ end = fw_entry->data + fw_entry->size; ++ ++ err = hermes_program(hw, first_block, end); ++ dev_dbg(dev, "Program returned %d\n", err); ++ if (err != 0) ++ goto abort; ++ ++ /* Update production data */ ++ first_block = (fw_entry->data + ++ le16_to_cpu(hdr->headersize) + ++ le32_to_cpu(hdr->pdr_offset)); ++ ++ err = hermes_apply_pda_with_defaults(hw, first_block, end, pda, ++ &pda[fw->pda_size / sizeof(*pda)]); ++ dev_dbg(dev, "Apply PDA returned %d\n", err); ++ if (err) ++ goto abort; ++ ++ /* Tell card we've finished */ ++ err = hw->ops->program_end(hw); ++ dev_dbg(dev, "Program end returned %d\n", err); ++ if (err != 0) ++ goto abort; ++ ++ /* Check if we're running */ ++ dev_dbg(dev, "hermes_present returned %d\n", hermes_present(hw)); ++ ++abort: ++ /* If we requested the firmware, release it. */ ++ if (!orinoco_cached_fw_get(priv, false)) ++ release_firmware(fw_entry); ++ ++free: ++ kfree(pda); ++ return err; ++} ++ ++/* ++ * Process a firmware image - stop the card, load the firmware, reset ++ * the card and make sure it responds. For the secondary firmware take ++ * care of the PDA - read it and then write it on top of the firmware. ++ */ ++static int ++symbol_dl_image(struct orinoco_private *priv, const struct fw_info *fw, ++ const unsigned char *image, const void *end, ++ int secondary) ++{ ++ struct hermes *hw = &priv->hw; ++ int ret = 0; ++ const unsigned char *ptr; ++ const unsigned char *first_block; ++ ++ /* Plug Data Area (PDA) */ ++ __le16 *pda = NULL; ++ ++ /* Binary block begins after the 0x1A marker */ ++ ptr = image; ++ while (*ptr++ != TEXT_END); ++ first_block = ptr; ++ ++ /* Read the PDA from EEPROM */ ++ if (secondary) { ++ pda = kzalloc(fw->pda_size, GFP_KERNEL); ++ if (!pda) ++ return -ENOMEM; ++ ++ ret = hw->ops->read_pda(hw, pda, fw->pda_addr, fw->pda_size); ++ if (ret) ++ goto free; ++ } ++ ++ /* Stop the firmware, so that it can be safely rewritten */ ++ if (priv->stop_fw) { ++ ret = priv->stop_fw(priv, 1); ++ if (ret) ++ goto free; ++ } ++ ++ /* Program the adapter with new firmware */ ++ ret = hermes_program(hw, first_block, end); ++ if (ret) ++ goto free; ++ ++ /* Write the PDA to the adapter */ ++ if (secondary) { ++ size_t len = hermes_blocks_length(first_block, end); ++ ptr = first_block + len; ++ ret = hermes_apply_pda(hw, ptr, end, pda, ++ &pda[fw->pda_size / sizeof(*pda)]); ++ kfree(pda); ++ if (ret) ++ return ret; ++ } ++ ++ /* Run the firmware */ ++ if (priv->stop_fw) { ++ ret = priv->stop_fw(priv, 0); ++ if (ret) ++ return ret; ++ } ++ ++ /* Reset hermes chip and make sure it responds */ ++ ret = hw->ops->init(hw); ++ ++ /* hermes_reset() should return 0 with the secondary firmware */ ++ if (secondary && ret != 0) ++ return -ENODEV; ++ ++ /* And this should work with any firmware */ ++ if (!hermes_present(hw)) ++ return -ENODEV; ++ ++ return 0; ++ ++free: ++ kfree(pda); ++ return ret; ++} ++ ++ ++/* ++ * Download the firmware into the card, this also does a PCMCIA soft ++ * reset on the card, to make sure it's in a sane state. ++ */ ++static int ++symbol_dl_firmware(struct orinoco_private *priv, ++ const struct fw_info *fw) ++{ ++ struct device *dev = priv->dev; ++ int ret; ++ const struct firmware *fw_entry; ++ ++ if (!orinoco_cached_fw_get(priv, true)) { ++ if (request_firmware(&fw_entry, fw->pri_fw, priv->dev) != 0) { ++ dev_err(dev, "Cannot find firmware: %s\n", fw->pri_fw); ++ return -ENOENT; ++ } ++ } else ++ fw_entry = orinoco_cached_fw_get(priv, true); ++ ++ /* Load primary firmware */ ++ ret = symbol_dl_image(priv, fw, fw_entry->data, ++ fw_entry->data + fw_entry->size, 0); ++ ++ if (!orinoco_cached_fw_get(priv, true)) ++ release_firmware(fw_entry); ++ if (ret) { ++ dev_err(dev, "Primary firmware download failed\n"); ++ return ret; ++ } ++ ++ if (!orinoco_cached_fw_get(priv, false)) { ++ if (request_firmware(&fw_entry, fw->sta_fw, priv->dev) != 0) { ++ dev_err(dev, "Cannot find firmware: %s\n", fw->sta_fw); ++ return -ENOENT; ++ } ++ } else ++ fw_entry = orinoco_cached_fw_get(priv, false); ++ ++ /* Load secondary firmware */ ++ ret = symbol_dl_image(priv, fw, fw_entry->data, ++ fw_entry->data + fw_entry->size, 1); ++ if (!orinoco_cached_fw_get(priv, false)) ++ release_firmware(fw_entry); ++ if (ret) ++ dev_err(dev, "Secondary firmware download failed\n"); ++ ++ return ret; ++} ++ ++int orinoco_download(struct orinoco_private *priv) ++{ ++ int err = 0; ++ /* Reload firmware */ ++ switch (priv->firmware_type) { ++ case FIRMWARE_TYPE_AGERE: ++ /* case FIRMWARE_TYPE_INTERSIL: */ ++ err = orinoco_dl_firmware(priv, ++ &orinoco_fw[priv->firmware_type], 0); ++ break; ++ ++ case FIRMWARE_TYPE_SYMBOL: ++ err = symbol_dl_firmware(priv, ++ &orinoco_fw[priv->firmware_type]); ++ break; ++ case FIRMWARE_TYPE_INTERSIL: ++ break; ++ } ++ /* TODO: if we fail we probably need to reinitialise ++ * the driver */ ++ ++ return err; ++} ++ ++#if defined(CONFIG_HERMES_CACHE_FW_ON_INIT) || defined(CONFIG_PM_SLEEP) ++void orinoco_cache_fw(struct orinoco_private *priv, int ap) ++{ ++ const struct firmware *fw_entry = NULL; ++ const char *pri_fw; ++ const char *fw; ++ ++ pri_fw = orinoco_fw[priv->firmware_type].pri_fw; ++ if (ap) ++ fw = orinoco_fw[priv->firmware_type].ap_fw; ++ else ++ fw = orinoco_fw[priv->firmware_type].sta_fw; ++ ++ if (pri_fw) { ++ if (request_firmware(&fw_entry, pri_fw, priv->dev) == 0) ++ priv->cached_pri_fw = fw_entry; ++ } ++ ++ if (fw) { ++ if (request_firmware(&fw_entry, fw, priv->dev) == 0) ++ priv->cached_fw = fw_entry; ++ } ++} ++ ++void orinoco_uncache_fw(struct orinoco_private *priv) ++{ ++ release_firmware(priv->cached_pri_fw); ++ release_firmware(priv->cached_fw); ++ priv->cached_pri_fw = NULL; ++ priv->cached_fw = NULL; ++} ++#endif +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/fw.h linux-6.15.6/drivers/net/wireless/intersil/orinoco/fw.h +--- linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/fw.h 1970-01-01 01:00:00.000000000 +0100 ++++ linux-6.15.6/drivers/net/wireless/intersil/orinoco/fw.h 2025-08-03 15:01:59.313131673 +0200 +@@ -0,0 +1,21 @@ ++/* Firmware file reading and download helpers ++ * ++ * See copyright notice in main.c ++ */ ++#ifndef _ORINOCO_FW_H_ ++#define _ORINOCO_FW_H_ ++ ++/* Forward declations */ ++struct orinoco_private; ++ ++int orinoco_download(struct orinoco_private *priv); ++ ++#if defined(CONFIG_HERMES_CACHE_FW_ON_INIT) || defined(CONFIG_PM_SLEEP) ++void orinoco_cache_fw(struct orinoco_private *priv, int ap); ++void orinoco_uncache_fw(struct orinoco_private *priv); ++#else ++#define orinoco_cache_fw(priv, ap) do { } while (0) ++#define orinoco_uncache_fw(priv) do { } while (0) ++#endif ++ ++#endif /* _ORINOCO_FW_H_ */ +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/hermes.c linux-6.15.6/drivers/net/wireless/intersil/orinoco/hermes.c +--- linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/hermes.c 1970-01-01 01:00:00.000000000 +0100 ++++ linux-6.15.6/drivers/net/wireless/intersil/orinoco/hermes.c 2025-08-03 22:42:47.279513981 +0200 +@@ -0,0 +1,778 @@ ++/* hermes.c ++ * ++ * Driver core for the "Hermes" wireless MAC controller, as used in ++ * the Lucent Orinoco and Cabletron RoamAbout cards. It should also ++ * work on the hfa3841 and hfa3842 MAC controller chips used in the ++ * Prism II chipsets. ++ * ++ * This is not a complete driver, just low-level access routines for ++ * the MAC controller itself. ++ * ++ * Based on the prism2 driver from Absolute Value Systems' linux-wlan ++ * project, the Linux wvlan_cs driver, Lucent's HCF-Light ++ * (wvlan_hcf.c) library, and the NetBSD wireless driver (in no ++ * particular order). ++ * ++ * Copyright (C) 2000, David Gibson, Linuxcare Australia. ++ * (C) Copyright David Gibson, IBM Corp. 2001-2003. ++ * ++ * The contents of this file are subject to the Mozilla Public License ++ * Version 1.1 (the "License"); you may not use this file except in ++ * compliance with the License. You may obtain a copy of the License ++ * at http://www.mozilla.org/MPL/ ++ * ++ * Software distributed under the License is distributed on an "AS IS" ++ * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See ++ * the License for the specific language governing rights and ++ * limitations under the License. ++ * ++ * Alternatively, the contents of this file may be used under the ++ * terms of the GNU General Public License version 2 (the "GPL"), in ++ * which case the provisions of the GPL are applicable instead of the ++ * above. If you wish to allow the use of your version of this file ++ * only under the terms of the GPL and not to allow others to use your ++ * version of this file under the MPL, indicate your decision by ++ * deleting the provisions above and replace them with the notice and ++ * other provisions required by the GPL. If you do not delete the ++ * provisions above, a recipient may use your version of this file ++ * under either the MPL or the GPL. ++ */ ++ ++#include <linux/net.h> ++#include <linux/module.h> ++#include <linux/kernel.h> ++#include <linux/delay.h> ++ ++#include "hermes.h" ++ ++/* These are maximum timeouts. Most often, card wil react much faster */ ++#define CMD_BUSY_TIMEOUT (100) /* In iterations of ~1us */ ++#define CMD_INIT_TIMEOUT (50000) /* in iterations of ~10us */ ++#define CMD_COMPL_TIMEOUT (20000) /* in iterations of ~10us */ ++#define ALLOC_COMPL_TIMEOUT (1000) /* in iterations of ~10us */ ++ ++/* ++ * AUX port access. To unlock the AUX port write the access keys to the ++ * PARAM0-2 registers, then write HERMES_AUX_ENABLE to the HERMES_CONTROL ++ * register. Then read it and make sure it's HERMES_AUX_ENABLED. ++ */ ++#define HERMES_AUX_ENABLE 0x8000 /* Enable auxiliary port access */ ++#define HERMES_AUX_DISABLE 0x4000 /* Disable to auxiliary port access */ ++#define HERMES_AUX_ENABLED 0xC000 /* Auxiliary port is open */ ++#define HERMES_AUX_DISABLED 0x0000 /* Auxiliary port is closed */ ++ ++#define HERMES_AUX_PW0 0xFE01 ++#define HERMES_AUX_PW1 0xDC23 ++#define HERMES_AUX_PW2 0xBA45 ++ ++/* HERMES_CMD_DOWNLD */ ++#define HERMES_PROGRAM_DISABLE (0x0000 | HERMES_CMD_DOWNLD) ++#define HERMES_PROGRAM_ENABLE_VOLATILE (0x0100 | HERMES_CMD_DOWNLD) ++#define HERMES_PROGRAM_ENABLE_NON_VOLATILE (0x0200 | HERMES_CMD_DOWNLD) ++#define HERMES_PROGRAM_NON_VOLATILE (0x0300 | HERMES_CMD_DOWNLD) ++ ++/* ++ * Debugging helpers ++ */ ++ ++#define DMSG(stuff...) do {printk(KERN_DEBUG "hermes @ %p: " , hw->iobase); \ ++ printk(stuff); } while (0) ++ ++#undef HERMES_DEBUG ++#ifdef HERMES_DEBUG ++ ++#define DEBUG(lvl, stuff...) if ((lvl) <= HERMES_DEBUG) DMSG(stuff) ++ ++#else /* ! HERMES_DEBUG */ ++ ++#define DEBUG(lvl, stuff...) do { } while (0) ++ ++#endif /* ! HERMES_DEBUG */ ++ ++static const struct hermes_ops hermes_ops_local; ++ ++/* ++ * Internal functions ++ */ ++ ++/* Issue a command to the chip. Waiting for it to complete is the caller's ++ problem. ++ ++ Returns -EBUSY if the command register is busy, 0 on success. ++ ++ Callable from any context. ++*/ ++static int hermes_issue_cmd(struct hermes *hw, u16 cmd, u16 param0, ++ u16 param1, u16 param2) ++{ ++ int k = CMD_BUSY_TIMEOUT; ++ u16 reg; ++ ++ /* First wait for the command register to unbusy */ ++ reg = hermes_read_regn(hw, CMD); ++ while ((reg & HERMES_CMD_BUSY) && k) { ++ k--; ++ udelay(1); ++ reg = hermes_read_regn(hw, CMD); ++ } ++ if (reg & HERMES_CMD_BUSY) ++ return -EBUSY; ++ ++ hermes_write_regn(hw, PARAM2, param2); ++ hermes_write_regn(hw, PARAM1, param1); ++ hermes_write_regn(hw, PARAM0, param0); ++ hermes_write_regn(hw, CMD, cmd); ++ ++ return 0; ++} ++ ++/* ++ * Function definitions ++ */ ++ ++/* For doing cmds that wipe the magic constant in SWSUPPORT0 */ ++static int hermes_doicmd_wait(struct hermes *hw, u16 cmd, ++ u16 parm0, u16 parm1, u16 parm2, ++ struct hermes_response *resp) ++{ ++ int err = 0; ++ int k; ++ u16 status, reg; ++ ++ err = hermes_issue_cmd(hw, cmd, parm0, parm1, parm2); ++ if (err) ++ return err; ++ ++ reg = hermes_read_regn(hw, EVSTAT); ++ k = CMD_INIT_TIMEOUT; ++ while ((!(reg & HERMES_EV_CMD)) && k) { ++ k--; ++ udelay(10); ++ reg = hermes_read_regn(hw, EVSTAT); ++ } ++ ++ hermes_write_regn(hw, SWSUPPORT0, HERMES_MAGIC); ++ ++ if (!hermes_present(hw)) { ++ DEBUG(0, "hermes @ 0x%x: Card removed during reset.\n", ++ hw->iobase); ++ err = -ENODEV; ++ goto out; ++ } ++ ++ if (!(reg & HERMES_EV_CMD)) { ++ printk(KERN_ERR "hermes @ %p: " ++ "Timeout waiting for card to reset (reg=0x%04x)!\n", ++ hw->iobase, reg); ++ err = -ETIMEDOUT; ++ goto out; ++ } ++ ++ status = hermes_read_regn(hw, STATUS); ++ if (resp) { ++ resp->status = status; ++ resp->resp0 = hermes_read_regn(hw, RESP0); ++ resp->resp1 = hermes_read_regn(hw, RESP1); ++ resp->resp2 = hermes_read_regn(hw, RESP2); ++ } ++ ++ hermes_write_regn(hw, EVACK, HERMES_EV_CMD); ++ ++ if (status & HERMES_STATUS_RESULT) ++ err = -EIO; ++out: ++ return err; ++} ++ ++void hermes_struct_init(struct hermes *hw, void __iomem *address, ++ int reg_spacing) ++{ ++ hw->iobase = address; ++ hw->reg_spacing = reg_spacing; ++ hw->inten = 0x0; ++ hw->eeprom_pda = false; ++ hw->ops = &hermes_ops_local; ++} ++EXPORT_SYMBOL(hermes_struct_init); ++ ++static int hermes_init(struct hermes *hw) ++{ ++ u16 reg; ++ int err = 0; ++ int k; ++ ++ /* We don't want to be interrupted while resetting the chipset */ ++ hw->inten = 0x0; ++ hermes_write_regn(hw, INTEN, 0); ++ hermes_write_regn(hw, EVACK, 0xffff); ++ ++ /* Normally it's a "can't happen" for the command register to ++ be busy when we go to issue a command because we are ++ serializing all commands. However we want to have some ++ chance of resetting the card even if it gets into a stupid ++ state, so we actually wait to see if the command register ++ will unbusy itself here. */ ++ k = CMD_BUSY_TIMEOUT; ++ reg = hermes_read_regn(hw, CMD); ++ while (k && (reg & HERMES_CMD_BUSY)) { ++ if (reg == 0xffff) /* Special case - the card has probably been ++ removed, so don't wait for the timeout */ ++ return -ENODEV; ++ ++ k--; ++ udelay(1); ++ reg = hermes_read_regn(hw, CMD); ++ } ++ ++ /* No need to explicitly handle the timeout - if we've timed ++ out hermes_issue_cmd() will probably return -EBUSY below */ ++ ++ /* According to the documentation, EVSTAT may contain ++ obsolete event occurrence information. We have to acknowledge ++ it by writing EVACK. */ ++ reg = hermes_read_regn(hw, EVSTAT); ++ hermes_write_regn(hw, EVACK, reg); ++ ++ /* We don't use hermes_docmd_wait here, because the reset wipes ++ the magic constant in SWSUPPORT0 away, and it gets confused */ ++ err = hermes_doicmd_wait(hw, HERMES_CMD_INIT, 0, 0, 0, NULL); ++ ++ return err; ++} ++ ++/* Issue a command to the chip, and (busy!) wait for it to ++ * complete. ++ * ++ * Returns: ++ * < 0 on internal error ++ * 0 on success ++ * > 0 on error returned by the firmware ++ * ++ * Callable from any context, but locking is your problem. */ ++static int hermes_docmd_wait(struct hermes *hw, u16 cmd, u16 parm0, ++ struct hermes_response *resp) ++{ ++ int err; ++ int k; ++ u16 reg; ++ u16 status; ++ ++ err = hermes_issue_cmd(hw, cmd, parm0, 0, 0); ++ if (err) { ++ if (!hermes_present(hw)) { ++ if (net_ratelimit()) ++ printk(KERN_WARNING "hermes @ %p: " ++ "Card removed while issuing command " ++ "0x%04x.\n", hw->iobase, cmd); ++ err = -ENODEV; ++ } else ++ if (net_ratelimit()) ++ printk(KERN_ERR "hermes @ %p: " ++ "Error %d issuing command 0x%04x.\n", ++ hw->iobase, err, cmd); ++ goto out; ++ } ++ ++ reg = hermes_read_regn(hw, EVSTAT); ++ k = CMD_COMPL_TIMEOUT; ++ while ((!(reg & HERMES_EV_CMD)) && k) { ++ k--; ++ udelay(10); ++ reg = hermes_read_regn(hw, EVSTAT); ++ } ++ ++ if (!hermes_present(hw)) { ++ printk(KERN_WARNING "hermes @ %p: Card removed " ++ "while waiting for command 0x%04x completion.\n", ++ hw->iobase, cmd); ++ err = -ENODEV; ++ goto out; ++ } ++ ++ if (!(reg & HERMES_EV_CMD)) { ++ printk(KERN_ERR "hermes @ %p: Timeout waiting for " ++ "command 0x%04x completion.\n", hw->iobase, cmd); ++ err = -ETIMEDOUT; ++ goto out; ++ } ++ ++ status = hermes_read_regn(hw, STATUS); ++ if (resp) { ++ resp->status = status; ++ resp->resp0 = hermes_read_regn(hw, RESP0); ++ resp->resp1 = hermes_read_regn(hw, RESP1); ++ resp->resp2 = hermes_read_regn(hw, RESP2); ++ } ++ ++ hermes_write_regn(hw, EVACK, HERMES_EV_CMD); ++ ++ if (status & HERMES_STATUS_RESULT) ++ err = -EIO; ++ ++ out: ++ return err; ++} ++ ++static int hermes_allocate(struct hermes *hw, u16 size, u16 *fid) ++{ ++ int err = 0; ++ int k; ++ u16 reg; ++ ++ if ((size < HERMES_ALLOC_LEN_MIN) || (size > HERMES_ALLOC_LEN_MAX)) ++ return -EINVAL; ++ ++ err = hermes_docmd_wait(hw, HERMES_CMD_ALLOC, size, NULL); ++ if (err) ++ return err; ++ ++ reg = hermes_read_regn(hw, EVSTAT); ++ k = ALLOC_COMPL_TIMEOUT; ++ while ((!(reg & HERMES_EV_ALLOC)) && k) { ++ k--; ++ udelay(10); ++ reg = hermes_read_regn(hw, EVSTAT); ++ } ++ ++ if (!hermes_present(hw)) { ++ printk(KERN_WARNING "hermes @ %p: " ++ "Card removed waiting for frame allocation.\n", ++ hw->iobase); ++ return -ENODEV; ++ } ++ ++ if (!(reg & HERMES_EV_ALLOC)) { ++ printk(KERN_ERR "hermes @ %p: " ++ "Timeout waiting for frame allocation\n", ++ hw->iobase); ++ return -ETIMEDOUT; ++ } ++ ++ *fid = hermes_read_regn(hw, ALLOCFID); ++ hermes_write_regn(hw, EVACK, HERMES_EV_ALLOC); ++ ++ return 0; ++} ++ ++/* Set up a BAP to read a particular chunk of data from card's internal buffer. ++ * ++ * Returns: ++ * < 0 on internal failure (errno) ++ * 0 on success ++ * > 0 on error ++ * from firmware ++ * ++ * Callable from any context */ ++static int hermes_bap_seek(struct hermes *hw, int bap, u16 id, u16 offset) ++{ ++ int sreg = bap ? HERMES_SELECT1 : HERMES_SELECT0; ++ int oreg = bap ? HERMES_OFFSET1 : HERMES_OFFSET0; ++ int k; ++ u16 reg; ++ ++ /* Paranoia.. */ ++ if ((offset > HERMES_BAP_OFFSET_MAX) || (offset % 2)) ++ return -EINVAL; ++ ++ k = HERMES_BAP_BUSY_TIMEOUT; ++ reg = hermes_read_reg(hw, oreg); ++ while ((reg & HERMES_OFFSET_BUSY) && k) { ++ k--; ++ udelay(1); ++ reg = hermes_read_reg(hw, oreg); ++ } ++ ++ if (reg & HERMES_OFFSET_BUSY) ++ return -ETIMEDOUT; ++ ++ /* Now we actually set up the transfer */ ++ hermes_write_reg(hw, sreg, id); ++ hermes_write_reg(hw, oreg, offset); ++ ++ /* Wait for the BAP to be ready */ ++ k = HERMES_BAP_BUSY_TIMEOUT; ++ reg = hermes_read_reg(hw, oreg); ++ while ((reg & (HERMES_OFFSET_BUSY | HERMES_OFFSET_ERR)) && k) { ++ k--; ++ udelay(1); ++ reg = hermes_read_reg(hw, oreg); ++ } ++ ++ if (reg != offset) { ++ printk(KERN_ERR "hermes @ %p: BAP%d offset %s: " ++ "reg=0x%x id=0x%x offset=0x%x\n", hw->iobase, bap, ++ (reg & HERMES_OFFSET_BUSY) ? "timeout" : "error", ++ reg, id, offset); ++ ++ if (reg & HERMES_OFFSET_BUSY) ++ return -ETIMEDOUT; ++ ++ return -EIO; /* error or wrong offset */ ++ } ++ ++ return 0; ++} ++ ++/* Read a block of data from the chip's buffer, via the ++ * BAP. Synchronization/serialization is the caller's problem. len ++ * must be even. ++ * ++ * Returns: ++ * < 0 on internal failure (errno) ++ * 0 on success ++ * > 0 on error from firmware ++ */ ++static int hermes_bap_pread(struct hermes *hw, int bap, void *buf, int len, ++ u16 id, u16 offset) ++{ ++ int dreg = bap ? HERMES_DATA1 : HERMES_DATA0; ++ int err = 0; ++ ++ if ((len < 0) || (len % 2)) ++ return -EINVAL; ++ ++ err = hermes_bap_seek(hw, bap, id, offset); ++ if (err) ++ goto out; ++ ++ /* Actually do the transfer */ ++ hermes_read_words(hw, dreg, buf, len / 2); ++ ++ out: ++ return err; ++} ++ ++/* Write a block of data to the chip's buffer, via the ++ * BAP. Synchronization/serialization is the caller's problem. ++ * ++ * Returns: ++ * < 0 on internal failure (errno) ++ * 0 on success ++ * > 0 on error from firmware ++ */ ++static int hermes_bap_pwrite(struct hermes *hw, int bap, const void *buf, ++ int len, u16 id, u16 offset) ++{ ++ int dreg = bap ? HERMES_DATA1 : HERMES_DATA0; ++ int err = 0; ++ ++ if (len < 0) ++ return -EINVAL; ++ ++ err = hermes_bap_seek(hw, bap, id, offset); ++ if (err) ++ goto out; ++ ++ /* Actually do the transfer */ ++ hermes_write_bytes(hw, dreg, buf, len); ++ ++ out: ++ return err; ++} ++ ++/* Read a Length-Type-Value record from the card. ++ * ++ * If length is NULL, we ignore the length read from the card, and ++ * read the entire buffer regardless. This is useful because some of ++ * the configuration records appear to have incorrect lengths in ++ * practice. ++ * ++ * Callable from user or bh context. */ ++static int hermes_read_ltv(struct hermes *hw, int bap, u16 rid, ++ unsigned bufsize, u16 *length, void *buf) ++{ ++ int err = 0; ++ int dreg = bap ? HERMES_DATA1 : HERMES_DATA0; ++ u16 rlength, rtype; ++ unsigned nwords; ++ ++ if (bufsize % 2) ++ return -EINVAL; ++ ++ err = hermes_docmd_wait(hw, HERMES_CMD_ACCESS, rid, NULL); ++ if (err) ++ return err; ++ ++ err = hermes_bap_seek(hw, bap, rid, 0); ++ if (err) ++ return err; ++ ++ rlength = hermes_read_reg(hw, dreg); ++ ++ if (!rlength) ++ return -ENODATA; ++ ++ rtype = hermes_read_reg(hw, dreg); ++ ++ if (length) ++ *length = rlength; ++ ++ if (rtype != rid) ++ printk(KERN_WARNING "hermes @ %p: %s(): " ++ "rid (0x%04x) does not match type (0x%04x)\n", ++ hw->iobase, __func__, rid, rtype); ++ if (HERMES_RECLEN_TO_BYTES(rlength) > bufsize) ++ printk(KERN_WARNING "hermes @ %p: " ++ "Truncating LTV record from %d to %d bytes. " ++ "(rid=0x%04x, len=0x%04x)\n", hw->iobase, ++ HERMES_RECLEN_TO_BYTES(rlength), bufsize, rid, rlength); ++ ++ nwords = min((unsigned)rlength - 1, bufsize / 2); ++ hermes_read_words(hw, dreg, buf, nwords); ++ ++ return 0; ++} ++ ++static int hermes_write_ltv(struct hermes *hw, int bap, u16 rid, ++ u16 length, const void *value) ++{ ++ int dreg = bap ? HERMES_DATA1 : HERMES_DATA0; ++ int err = 0; ++ unsigned count; ++ ++ if (length == 0) ++ return -EINVAL; ++ ++ err = hermes_bap_seek(hw, bap, rid, 0); ++ if (err) ++ return err; ++ ++ hermes_write_reg(hw, dreg, length); ++ hermes_write_reg(hw, dreg, rid); ++ ++ count = length - 1; ++ ++ hermes_write_bytes(hw, dreg, value, count << 1); ++ ++ err = hermes_docmd_wait(hw, HERMES_CMD_ACCESS | HERMES_CMD_WRITE, ++ rid, NULL); ++ ++ return err; ++} ++ ++/*** Hermes AUX control ***/ ++ ++static inline void ++hermes_aux_setaddr(struct hermes *hw, u32 addr) ++{ ++ hermes_write_reg(hw, HERMES_AUXPAGE, (u16) (addr >> 7)); ++ hermes_write_reg(hw, HERMES_AUXOFFSET, (u16) (addr & 0x7F)); ++} ++ ++static inline int ++hermes_aux_control(struct hermes *hw, int enabled) ++{ ++ int desired_state = enabled ? HERMES_AUX_ENABLED : HERMES_AUX_DISABLED; ++ int action = enabled ? HERMES_AUX_ENABLE : HERMES_AUX_DISABLE; ++ int i; ++ ++ /* Already open? */ ++ if (hermes_read_reg(hw, HERMES_CONTROL) == desired_state) ++ return 0; ++ ++ hermes_write_reg(hw, HERMES_PARAM0, HERMES_AUX_PW0); ++ hermes_write_reg(hw, HERMES_PARAM1, HERMES_AUX_PW1); ++ hermes_write_reg(hw, HERMES_PARAM2, HERMES_AUX_PW2); ++ hermes_write_reg(hw, HERMES_CONTROL, action); ++ ++ for (i = 0; i < 20; i++) { ++ udelay(10); ++ if (hermes_read_reg(hw, HERMES_CONTROL) == ++ desired_state) ++ return 0; ++ } ++ ++ return -EBUSY; ++} ++ ++/*** Hermes programming ***/ ++ ++/* About to start programming data (Hermes I) ++ * offset is the entry point ++ * ++ * Spectrum_cs' Symbol fw does not require this ++ * wl_lkm Agere fw does ++ * Don't know about intersil ++ */ ++static int hermesi_program_init(struct hermes *hw, u32 offset) ++{ ++ int err; ++ ++ /* Disable interrupts?*/ ++ /*hw->inten = 0x0;*/ ++ /*hermes_write_regn(hw, INTEN, 0);*/ ++ /*hermes_set_irqmask(hw, 0);*/ ++ ++ /* Acknowledge any outstanding command */ ++ hermes_write_regn(hw, EVACK, 0xFFFF); ++ ++ /* Using init_cmd_wait rather than cmd_wait */ ++ err = hw->ops->init_cmd_wait(hw, ++ 0x0100 | HERMES_CMD_INIT, ++ 0, 0, 0, NULL); ++ if (err) ++ return err; ++ ++ err = hw->ops->init_cmd_wait(hw, ++ 0x0000 | HERMES_CMD_INIT, ++ 0, 0, 0, NULL); ++ if (err) ++ return err; ++ ++ err = hermes_aux_control(hw, 1); ++ pr_debug("AUX enable returned %d\n", err); ++ ++ if (err) ++ return err; ++ ++ pr_debug("Enabling volatile, EP 0x%08x\n", offset); ++ err = hw->ops->init_cmd_wait(hw, ++ HERMES_PROGRAM_ENABLE_VOLATILE, ++ offset & 0xFFFFu, ++ offset >> 16, ++ 0, ++ NULL); ++ pr_debug("PROGRAM_ENABLE returned %d\n", err); ++ ++ return err; ++} ++ ++/* Done programming data (Hermes I) ++ * ++ * Spectrum_cs' Symbol fw does not require this ++ * wl_lkm Agere fw does ++ * Don't know about intersil ++ */ ++static int hermesi_program_end(struct hermes *hw) ++{ ++ struct hermes_response resp; ++ int rc = 0; ++ int err; ++ ++ rc = hw->ops->cmd_wait(hw, HERMES_PROGRAM_DISABLE, 0, &resp); ++ ++ pr_debug("PROGRAM_DISABLE returned %d, " ++ "r0 0x%04x, r1 0x%04x, r2 0x%04x\n", ++ rc, resp.resp0, resp.resp1, resp.resp2); ++ ++ if ((rc == 0) && ++ ((resp.status & HERMES_STATUS_CMDCODE) != HERMES_CMD_DOWNLD)) ++ rc = -EIO; ++ ++ err = hermes_aux_control(hw, 0); ++ pr_debug("AUX disable returned %d\n", err); ++ ++ /* Acknowledge any outstanding command */ ++ hermes_write_regn(hw, EVACK, 0xFFFF); ++ ++ /* Reinitialise, ignoring return */ ++ (void) hw->ops->init_cmd_wait(hw, 0x0000 | HERMES_CMD_INIT, ++ 0, 0, 0, NULL); ++ ++ return rc ? rc : err; ++} ++ ++static int hermes_program_bytes(struct hermes *hw, const char *data, ++ u32 addr, u32 len) ++{ ++ /* wl lkm splits the programming into chunks of 2000 bytes. ++ * This restriction appears to come from USB. The PCMCIA ++ * adapters can program the whole lot in one go */ ++ hermes_aux_setaddr(hw, addr); ++ hermes_write_bytes(hw, HERMES_AUXDATA, data, len); ++ return 0; ++} ++ ++/* Read PDA from the adapter */ ++static int hermes_read_pda(struct hermes *hw, __le16 *pda, u32 pda_addr, ++ u16 pda_len) ++{ ++ int ret; ++ u16 pda_size; ++ u16 data_len = pda_len; ++ __le16 *data = pda; ++ ++ if (hw->eeprom_pda) { ++ /* PDA of spectrum symbol is in eeprom */ ++ ++ /* Issue command to read EEPROM */ ++ ret = hw->ops->cmd_wait(hw, HERMES_CMD_READMIF, 0, NULL); ++ if (ret) ++ return ret; ++ } else { ++ /* wl_lkm does not include PDA size in the PDA area. ++ * We will pad the information into pda, so other routines ++ * don't have to be modified */ ++ pda[0] = cpu_to_le16(pda_len - 2); ++ /* Includes CFG_PROD_DATA but not itself */ ++ pda[1] = cpu_to_le16(0x0800); /* CFG_PROD_DATA */ ++ data_len = pda_len - 4; ++ data = pda + 2; ++ } ++ ++ /* Open auxiliary port */ ++ ret = hermes_aux_control(hw, 1); ++ pr_debug("AUX enable returned %d\n", ret); ++ if (ret) ++ return ret; ++ ++ /* Read PDA */ ++ hermes_aux_setaddr(hw, pda_addr); ++ hermes_read_words(hw, HERMES_AUXDATA, data, data_len / 2); ++ ++ /* Close aux port */ ++ ret = hermes_aux_control(hw, 0); ++ pr_debug("AUX disable returned %d\n", ret); ++ ++ /* Check PDA length */ ++ pda_size = le16_to_cpu(pda[0]); ++ pr_debug("Actual PDA length %d, Max allowed %d\n", ++ pda_size, pda_len); ++ if (pda_size > pda_len) ++ return -EINVAL; ++ ++ return 0; ++} ++ ++static void hermes_lock_irqsave(spinlock_t *lock, ++ unsigned long *flags) __acquires(lock) ++{ ++ spin_lock_irqsave(lock, *flags); ++} ++ ++static void hermes_unlock_irqrestore(spinlock_t *lock, ++ unsigned long *flags) __releases(lock) ++{ ++ spin_unlock_irqrestore(lock, *flags); ++} ++ ++static void hermes_lock_irq(spinlock_t *lock) __acquires(lock) ++{ ++ spin_lock_irq(lock); ++} ++ ++static void hermes_unlock_irq(spinlock_t *lock) __releases(lock) ++{ ++ spin_unlock_irq(lock); ++} ++ ++/* Hermes operations for local buses */ ++static const struct hermes_ops hermes_ops_local = { ++ .init = hermes_init, ++ .cmd_wait = hermes_docmd_wait, ++ .init_cmd_wait = hermes_doicmd_wait, ++ .allocate = hermes_allocate, ++ .read_ltv = hermes_read_ltv, ++ .read_ltv_pr = hermes_read_ltv, ++ .write_ltv = hermes_write_ltv, ++ .bap_pread = hermes_bap_pread, ++ .bap_pwrite = hermes_bap_pwrite, ++ .read_pda = hermes_read_pda, ++ .program_init = hermesi_program_init, ++ .program_end = hermesi_program_end, ++ .program = hermes_program_bytes, ++ .lock_irqsave = hermes_lock_irqsave, ++ .unlock_irqrestore = hermes_unlock_irqrestore, ++ .lock_irq = hermes_lock_irq, ++ .unlock_irq = hermes_unlock_irq, ++}; +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/hermes_dld.c linux-6.15.6/drivers/net/wireless/intersil/orinoco/hermes_dld.c +--- linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/hermes_dld.c 1970-01-01 01:00:00.000000000 +0100 ++++ linux-6.15.6/drivers/net/wireless/intersil/orinoco/hermes_dld.c 2025-08-03 15:01:59.325131328 +0200 +@@ -0,0 +1,477 @@ ++/* ++ * Hermes download helper. ++ * ++ * This helper: ++ * - is capable of writing to the volatile area of the hermes device ++ * - is currently not capable of writing to non-volatile areas ++ * - provide helpers to identify and update plugin data ++ * - is not capable of interpreting a fw image directly. That is up to ++ * the main card driver. ++ * - deals with Hermes I devices. It can probably be modified to deal ++ * with Hermes II devices ++ * ++ * Copyright (C) 2007, David Kilroy ++ * ++ * Plug data code slightly modified from spectrum_cs driver ++ * Copyright (C) 2002-2005 Pavel Roskin <proski@gnu.org> ++ * Portions based on information in wl_lkm_718 Agere driver ++ * COPYRIGHT (C) 2001-2004 by Agere Systems Inc. All Rights Reserved ++ * ++ * The contents of this file are subject to the Mozilla Public License ++ * Version 1.1 (the "License"); you may not use this file except in ++ * compliance with the License. You may obtain a copy of the License ++ * at http://www.mozilla.org/MPL/ ++ * ++ * Software distributed under the License is distributed on an "AS IS" ++ * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See ++ * the License for the specific language governing rights and ++ * limitations under the License. ++ * ++ * Alternatively, the contents of this file may be used under the ++ * terms of the GNU General Public License version 2 (the "GPL"), in ++ * which case the provisions of the GPL are applicable instead of the ++ * above. If you wish to allow the use of your version of this file ++ * only under the terms of the GPL and not to allow others to use your ++ * version of this file under the MPL, indicate your decision by ++ * deleting the provisions above and replace them with the notice and ++ * other provisions required by the GPL. If you do not delete the ++ * provisions above, a recipient may use your version of this file ++ * under either the MPL or the GPL. ++ */ ++ ++#include <linux/module.h> ++#include <linux/delay.h> ++#include "hermes.h" ++#include "hermes_dld.h" ++ ++#define PFX "hermes_dld: " ++ ++/* End markers used in dblocks */ ++#define PDI_END 0x00000000 /* End of PDA */ ++#define BLOCK_END 0xFFFFFFFF /* Last image block */ ++#define TEXT_END 0x1A /* End of text header */ ++ ++/* ++ * The following structures have little-endian fields denoted by ++ * the leading underscore. Don't access them directly - use inline ++ * functions defined below. ++ */ ++ ++/* ++ * The binary image to be downloaded consists of series of data blocks. ++ * Each block has the following structure. ++ */ ++struct dblock { ++ __le32 addr; /* adapter address where to write the block */ ++ __le16 len; /* length of the data only, in bytes */ ++ char data[]; /* data to be written */ ++} __packed; ++ ++/* ++ * Plug Data References are located in the image after the last data ++ * block. They refer to areas in the adapter memory where the plug data ++ * items with matching ID should be written. ++ */ ++struct pdr { ++ __le32 id; /* record ID */ ++ __le32 addr; /* adapter address where to write the data */ ++ __le32 len; /* expected length of the data, in bytes */ ++ char next[]; /* next PDR starts here */ ++} __packed; ++ ++/* ++ * Plug Data Items are located in the EEPROM read from the adapter by ++ * primary firmware. They refer to the device-specific data that should ++ * be plugged into the secondary firmware. ++ */ ++struct pdi { ++ __le16 len; /* length of ID and data, in words */ ++ __le16 id; /* record ID */ ++ char data[]; /* plug data */ ++} __packed; ++ ++/*** FW data block access functions ***/ ++ ++static inline u32 ++dblock_addr(const struct dblock *blk) ++{ ++ return le32_to_cpu(blk->addr); ++} ++ ++static inline u32 ++dblock_len(const struct dblock *blk) ++{ ++ return le16_to_cpu(blk->len); ++} ++ ++/*** PDR Access functions ***/ ++ ++static inline u32 ++pdr_id(const struct pdr *pdr) ++{ ++ return le32_to_cpu(pdr->id); ++} ++ ++static inline u32 ++pdr_addr(const struct pdr *pdr) ++{ ++ return le32_to_cpu(pdr->addr); ++} ++ ++static inline u32 ++pdr_len(const struct pdr *pdr) ++{ ++ return le32_to_cpu(pdr->len); ++} ++ ++/*** PDI Access functions ***/ ++ ++static inline u32 ++pdi_id(const struct pdi *pdi) ++{ ++ return le16_to_cpu(pdi->id); ++} ++ ++/* Return length of the data only, in bytes */ ++static inline u32 ++pdi_len(const struct pdi *pdi) ++{ ++ return 2 * (le16_to_cpu(pdi->len) - 1); ++} ++ ++/*** Plug Data Functions ***/ ++ ++/* ++ * Scan PDR for the record with the specified RECORD_ID. ++ * If it's not found, return NULL. ++ */ ++static const struct pdr * ++hermes_find_pdr(const struct pdr *first_pdr, u32 record_id, const void *end) ++{ ++ const struct pdr *pdr = first_pdr; ++ ++ end -= sizeof(struct pdr); ++ ++ while (((void *) pdr <= end) && ++ (pdr_id(pdr) != PDI_END)) { ++ /* ++ * PDR area is currently not terminated by PDI_END. ++ * It's followed by CRC records, which have the type ++ * field where PDR has length. The type can be 0 or 1. ++ */ ++ if (pdr_len(pdr) < 2) ++ return NULL; ++ ++ /* If the record ID matches, we are done */ ++ if (pdr_id(pdr) == record_id) ++ return pdr; ++ ++ pdr = (struct pdr *) pdr->next; ++ } ++ return NULL; ++} ++ ++/* Scan production data items for a particular entry */ ++static const struct pdi * ++hermes_find_pdi(const struct pdi *first_pdi, u32 record_id, const void *end) ++{ ++ const struct pdi *pdi = first_pdi; ++ ++ end -= sizeof(struct pdi); ++ ++ while (((void *) pdi <= end) && ++ (pdi_id(pdi) != PDI_END)) { ++ ++ /* If the record ID matches, we are done */ ++ if (pdi_id(pdi) == record_id) ++ return pdi; ++ ++ pdi = (struct pdi *) &pdi->data[pdi_len(pdi)]; ++ } ++ return NULL; ++} ++ ++/* Process one Plug Data Item - find corresponding PDR and plug it */ ++static int ++hermes_plug_pdi(struct hermes *hw, const struct pdr *first_pdr, ++ const struct pdi *pdi, const void *pdr_end) ++{ ++ const struct pdr *pdr; ++ ++ /* Find the PDR corresponding to this PDI */ ++ pdr = hermes_find_pdr(first_pdr, pdi_id(pdi), pdr_end); ++ ++ /* No match is found, safe to ignore */ ++ if (!pdr) ++ return 0; ++ ++ /* Lengths of the data in PDI and PDR must match */ ++ if (pdi_len(pdi) != pdr_len(pdr)) ++ return -EINVAL; ++ ++ /* do the actual plugging */ ++ hw->ops->program(hw, pdi->data, pdr_addr(pdr), pdi_len(pdi)); ++ ++ return 0; ++} ++ ++/* Parse PDA and write the records into the adapter ++ * ++ * Attempt to write every records that is in the specified pda ++ * which also has a valid production data record for the firmware. ++ */ ++int hermes_apply_pda(struct hermes *hw, ++ const char *first_pdr, ++ const void *pdr_end, ++ const __le16 *pda, ++ const void *pda_end) ++{ ++ int ret; ++ const struct pdi *pdi; ++ const struct pdr *pdr; ++ ++ pdr = (const struct pdr *) first_pdr; ++ pda_end -= sizeof(struct pdi); ++ ++ /* Go through every PDI and plug them into the adapter */ ++ pdi = (const struct pdi *) (pda + 2); ++ while (((void *) pdi <= pda_end) && ++ (pdi_id(pdi) != PDI_END)) { ++ ret = hermes_plug_pdi(hw, pdr, pdi, pdr_end); ++ if (ret) ++ return ret; ++ ++ /* Increment to the next PDI */ ++ pdi = (const struct pdi *) &pdi->data[pdi_len(pdi)]; ++ } ++ return 0; ++} ++ ++/* Identify the total number of bytes in all blocks ++ * including the header data. ++ */ ++size_t ++hermes_blocks_length(const char *first_block, const void *end) ++{ ++ const struct dblock *blk = (const struct dblock *) first_block; ++ int total_len = 0; ++ int len; ++ ++ end -= sizeof(*blk); ++ ++ /* Skip all blocks to locate Plug Data References ++ * (Spectrum CS) */ ++ while (((void *) blk <= end) && ++ (dblock_addr(blk) != BLOCK_END)) { ++ len = dblock_len(blk); ++ total_len += sizeof(*blk) + len; ++ blk = (struct dblock *) &blk->data[len]; ++ } ++ ++ return total_len; ++} ++ ++/*** Hermes programming ***/ ++ ++/* Program the data blocks */ ++int hermes_program(struct hermes *hw, const char *first_block, const void *end) ++{ ++ const struct dblock *blk; ++ u32 blkaddr; ++ u32 blklen; ++ int err = 0; ++ ++ blk = (const struct dblock *) first_block; ++ ++ if ((void *) blk > (end - sizeof(*blk))) ++ return -EIO; ++ ++ blkaddr = dblock_addr(blk); ++ blklen = dblock_len(blk); ++ ++ while ((blkaddr != BLOCK_END) && ++ (((void *) blk + blklen) <= end)) { ++ pr_debug(PFX "Programming block of length %d " ++ "to address 0x%08x\n", blklen, blkaddr); ++ ++ err = hw->ops->program(hw, blk->data, blkaddr, blklen); ++ if (err) ++ break; ++ ++ blk = (const struct dblock *) &blk->data[blklen]; ++ ++ if ((void *) blk > (end - sizeof(*blk))) ++ return -EIO; ++ ++ blkaddr = dblock_addr(blk); ++ blklen = dblock_len(blk); ++ } ++ return err; ++} ++ ++/*** Default plugging data for Hermes I ***/ ++/* Values from wl_lkm_718/hcf/dhf.c */ ++ ++#define DEFINE_DEFAULT_PDR(pid, length, data) \ ++static const struct { \ ++ __le16 len; \ ++ __le16 id; \ ++ u8 val[length]; \ ++} __packed default_pdr_data_##pid = { \ ++ cpu_to_le16((sizeof(default_pdr_data_##pid)/ \ ++ sizeof(__le16)) - 1), \ ++ cpu_to_le16(pid), \ ++ data \ ++} ++ ++#define DEFAULT_PDR(pid) default_pdr_data_##pid ++ ++/* HWIF Compatibility */ ++DEFINE_DEFAULT_PDR(0x0005, 10, "\x00\x00\x06\x00\x01\x00\x01\x00\x01\x00"); ++ ++/* PPPPSign */ ++DEFINE_DEFAULT_PDR(0x0108, 4, "\x00\x00\x00\x00"); ++ ++/* PPPPProf */ ++DEFINE_DEFAULT_PDR(0x0109, 10, "\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00"); ++ ++/* Antenna diversity */ ++DEFINE_DEFAULT_PDR(0x0150, 2, "\x00\x3F"); ++ ++/* Modem VCO band Set-up */ ++DEFINE_DEFAULT_PDR(0x0160, 28, ++ "\x00\x00\x00\x00\x00\x00\x00\x00" ++ "\x00\x00\x00\x00\x00\x00\x00\x00" ++ "\x00\x00\x00\x00\x00\x00\x00\x00" ++ "\x00\x00\x00\x00"); ++ ++/* Modem Rx Gain Table Values */ ++DEFINE_DEFAULT_PDR(0x0161, 256, ++ "\x3F\x01\x3F\01\x3F\x01\x3F\x01" ++ "\x3F\x01\x3F\01\x3F\x01\x3F\x01" ++ "\x3F\x01\x3F\01\x3F\x01\x3F\x01" ++ "\x3F\x01\x3F\01\x3F\x01\x3F\x01" ++ "\x3F\x01\x3E\01\x3E\x01\x3D\x01" ++ "\x3D\x01\x3C\01\x3C\x01\x3B\x01" ++ "\x3B\x01\x3A\01\x3A\x01\x39\x01" ++ "\x39\x01\x38\01\x38\x01\x37\x01" ++ "\x37\x01\x36\01\x36\x01\x35\x01" ++ "\x35\x01\x34\01\x34\x01\x33\x01" ++ "\x33\x01\x32\x01\x32\x01\x31\x01" ++ "\x31\x01\x30\x01\x30\x01\x7B\x01" ++ "\x7B\x01\x7A\x01\x7A\x01\x79\x01" ++ "\x79\x01\x78\x01\x78\x01\x77\x01" ++ "\x77\x01\x76\x01\x76\x01\x75\x01" ++ "\x75\x01\x74\x01\x74\x01\x73\x01" ++ "\x73\x01\x72\x01\x72\x01\x71\x01" ++ "\x71\x01\x70\x01\x70\x01\x68\x01" ++ "\x68\x01\x67\x01\x67\x01\x66\x01" ++ "\x66\x01\x65\x01\x65\x01\x57\x01" ++ "\x57\x01\x56\x01\x56\x01\x55\x01" ++ "\x55\x01\x54\x01\x54\x01\x53\x01" ++ "\x53\x01\x52\x01\x52\x01\x51\x01" ++ "\x51\x01\x50\x01\x50\x01\x48\x01" ++ "\x48\x01\x47\x01\x47\x01\x46\x01" ++ "\x46\x01\x45\x01\x45\x01\x44\x01" ++ "\x44\x01\x43\x01\x43\x01\x42\x01" ++ "\x42\x01\x41\x01\x41\x01\x40\x01" ++ "\x40\x01\x40\x01\x40\x01\x40\x01" ++ "\x40\x01\x40\x01\x40\x01\x40\x01" ++ "\x40\x01\x40\x01\x40\x01\x40\x01" ++ "\x40\x01\x40\x01\x40\x01\x40\x01"); ++ ++/* Write PDA according to certain rules. ++ * ++ * For every production data record, look for a previous setting in ++ * the pda, and use that. ++ * ++ * For certain records, use defaults if they are not found in pda. ++ */ ++int hermes_apply_pda_with_defaults(struct hermes *hw, ++ const char *first_pdr, ++ const void *pdr_end, ++ const __le16 *pda, ++ const void *pda_end) ++{ ++ const struct pdr *pdr = (const struct pdr *) first_pdr; ++ const struct pdi *first_pdi = (const struct pdi *) &pda[2]; ++ const struct pdi *pdi; ++ const struct pdi *default_pdi = NULL; ++ const struct pdi *outdoor_pdi; ++ int record_id; ++ ++ pdr_end -= sizeof(struct pdr); ++ ++ while (((void *) pdr <= pdr_end) && ++ (pdr_id(pdr) != PDI_END)) { ++ /* ++ * For spectrum_cs firmwares, ++ * PDR area is currently not terminated by PDI_END. ++ * It's followed by CRC records, which have the type ++ * field where PDR has length. The type can be 0 or 1. ++ */ ++ if (pdr_len(pdr) < 2) ++ break; ++ record_id = pdr_id(pdr); ++ ++ pdi = hermes_find_pdi(first_pdi, record_id, pda_end); ++ if (pdi) ++ pr_debug(PFX "Found record 0x%04x at %p\n", ++ record_id, pdi); ++ ++ switch (record_id) { ++ case 0x110: /* Modem REFDAC values */ ++ case 0x120: /* Modem VGDAC values */ ++ outdoor_pdi = hermes_find_pdi(first_pdi, record_id + 1, ++ pda_end); ++ default_pdi = NULL; ++ if (outdoor_pdi) { ++ pdi = outdoor_pdi; ++ pr_debug(PFX ++ "Using outdoor record 0x%04x at %p\n", ++ record_id + 1, pdi); ++ } ++ break; ++ case 0x5: /* HWIF Compatibility */ ++ default_pdi = (struct pdi *) &DEFAULT_PDR(0x0005); ++ break; ++ case 0x108: /* PPPPSign */ ++ default_pdi = (struct pdi *) &DEFAULT_PDR(0x0108); ++ break; ++ case 0x109: /* PPPPProf */ ++ default_pdi = (struct pdi *) &DEFAULT_PDR(0x0109); ++ break; ++ case 0x150: /* Antenna diversity */ ++ default_pdi = (struct pdi *) &DEFAULT_PDR(0x0150); ++ break; ++ case 0x160: /* Modem VCO band Set-up */ ++ default_pdi = (struct pdi *) &DEFAULT_PDR(0x0160); ++ break; ++ case 0x161: /* Modem Rx Gain Table Values */ ++ default_pdi = (struct pdi *) &DEFAULT_PDR(0x0161); ++ break; ++ default: ++ default_pdi = NULL; ++ break; ++ } ++ if (!pdi && default_pdi) { ++ /* Use default */ ++ pdi = default_pdi; ++ pr_debug(PFX "Using default record 0x%04x at %p\n", ++ record_id, pdi); ++ } ++ ++ if (pdi) { ++ /* Lengths of the data in PDI and PDR must match */ ++ if ((pdi_len(pdi) == pdr_len(pdr)) && ++ ((void *) pdi->data + pdi_len(pdi) < pda_end)) { ++ /* do the actual plugging */ ++ hw->ops->program(hw, pdi->data, pdr_addr(pdr), ++ pdi_len(pdi)); ++ } ++ } ++ ++ pdr++; ++ } ++ return 0; ++} +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/hermes_dld.h linux-6.15.6/drivers/net/wireless/intersil/orinoco/hermes_dld.h +--- linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/hermes_dld.h 1970-01-01 01:00:00.000000000 +0100 ++++ linux-6.15.6/drivers/net/wireless/intersil/orinoco/hermes_dld.h 2025-08-03 15:01:59.325131328 +0200 +@@ -0,0 +1,52 @@ ++/* ++ * Copyright (C) 2007, David Kilroy ++ * ++ * The contents of this file are subject to the Mozilla Public License ++ * Version 1.1 (the "License"); you may not use this file except in ++ * compliance with the License. You may obtain a copy of the License ++ * at http://www.mozilla.org/MPL/ ++ * ++ * Software distributed under the License is distributed on an "AS IS" ++ * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See ++ * the License for the specific language governing rights and ++ * limitations under the License. ++ * ++ * Alternatively, the contents of this file may be used under the ++ * terms of the GNU General Public License version 2 (the "GPL"), in ++ * which case the provisions of the GPL are applicable instead of the ++ * above. If you wish to allow the use of your version of this file ++ * only under the terms of the GPL and not to allow others to use your ++ * version of this file under the MPL, indicate your decision by ++ * deleting the provisions above and replace them with the notice and ++ * other provisions required by the GPL. If you do not delete the ++ * provisions above, a recipient may use your version of this file ++ * under either the MPL or the GPL. ++ */ ++#ifndef _HERMES_DLD_H ++#define _HERMES_DLD_H ++ ++#include "hermes.h" ++ ++int hermesi_program_init(struct hermes *hw, u32 offset); ++int hermesi_program_end(struct hermes *hw); ++int hermes_program(struct hermes *hw, const char *first_block, const void *end); ++ ++int hermes_read_pda(struct hermes *hw, ++ __le16 *pda, ++ u32 pda_addr, ++ u16 pda_len, ++ int use_eeprom); ++int hermes_apply_pda(struct hermes *hw, ++ const char *first_pdr, ++ const void *pdr_end, ++ const __le16 *pda, ++ const void *pda_end); ++int hermes_apply_pda_with_defaults(struct hermes *hw, ++ const char *first_pdr, ++ const void *pdr_end, ++ const __le16 *pda, ++ const void *pda_end); ++ ++size_t hermes_blocks_length(const char *first_block, const void *end); ++ ++#endif /* _HERMES_DLD_H */ +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/hermes.h linux-6.15.6/drivers/net/wireless/intersil/orinoco/hermes.h +--- linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/hermes.h 1970-01-01 01:00:00.000000000 +0100 ++++ linux-6.15.6/drivers/net/wireless/intersil/orinoco/hermes.h 2025-08-03 15:01:59.329131213 +0200 +@@ -0,0 +1,534 @@ ++/* SPDX-License-Identifier: GPL-2.0-only */ ++/* hermes.h ++ * ++ * Driver core for the "Hermes" wireless MAC controller, as used in ++ * the Lucent Orinoco and Cabletron RoamAbout cards. It should also ++ * work on the hfa3841 and hfa3842 MAC controller chips used in the ++ * Prism I & II chipsets. ++ * ++ * This is not a complete driver, just low-level access routines for ++ * the MAC controller itself. ++ * ++ * Based on the prism2 driver from Absolute Value Systems' linux-wlan ++ * project, the Linux wvlan_cs driver, Lucent's HCF-Light ++ * (wvlan_hcf.c) library, and the NetBSD wireless driver. ++ * ++ * Copyright (C) 2000, David Gibson, Linuxcare Australia. ++ * (C) Copyright David Gibson, IBM Corp. 2001-2003. ++ * ++ * Portions taken from hfa384x.h. ++ * Copyright (C) 1999 AbsoluteValue Systems, Inc. All Rights Reserved. ++ */ ++ ++#ifndef _HERMES_H ++#define _HERMES_H ++ ++/* Notes on locking: ++ * ++ * As a module of low level hardware access routines, there is no ++ * locking. Users of this module should ensure that they serialize ++ * access to the hermes structure, and to the hardware ++*/ ++ ++#include <linux/if_ether.h> ++#include <linux/io.h> ++ ++/* ++ * Limits and constants ++ */ ++#define HERMES_ALLOC_LEN_MIN (4) ++#define HERMES_ALLOC_LEN_MAX (2400) ++#define HERMES_LTV_LEN_MAX (34) ++#define HERMES_BAP_DATALEN_MAX (4096) ++#define HERMES_BAP_OFFSET_MAX (4096) ++#define HERMES_PORTID_MAX (7) ++#define HERMES_NUMPORTS_MAX (HERMES_PORTID_MAX + 1) ++#define HERMES_PDR_LEN_MAX (260) /* in bytes, from EK */ ++#define HERMES_PDA_RECS_MAX (200) /* a guess */ ++#define HERMES_PDA_LEN_MAX (1024) /* in bytes, from EK */ ++#define HERMES_SCANRESULT_MAX (35) ++#define HERMES_CHINFORESULT_MAX (8) ++#define HERMES_MAX_MULTICAST (16) ++#define HERMES_MAGIC (0x7d1f) ++ ++/* ++ * Hermes register offsets ++ */ ++#define HERMES_CMD (0x00) ++#define HERMES_PARAM0 (0x02) ++#define HERMES_PARAM1 (0x04) ++#define HERMES_PARAM2 (0x06) ++#define HERMES_STATUS (0x08) ++#define HERMES_RESP0 (0x0A) ++#define HERMES_RESP1 (0x0C) ++#define HERMES_RESP2 (0x0E) ++#define HERMES_INFOFID (0x10) ++#define HERMES_RXFID (0x20) ++#define HERMES_ALLOCFID (0x22) ++#define HERMES_TXCOMPLFID (0x24) ++#define HERMES_SELECT0 (0x18) ++#define HERMES_OFFSET0 (0x1C) ++#define HERMES_DATA0 (0x36) ++#define HERMES_SELECT1 (0x1A) ++#define HERMES_OFFSET1 (0x1E) ++#define HERMES_DATA1 (0x38) ++#define HERMES_EVSTAT (0x30) ++#define HERMES_INTEN (0x32) ++#define HERMES_EVACK (0x34) ++#define HERMES_CONTROL (0x14) ++#define HERMES_SWSUPPORT0 (0x28) ++#define HERMES_SWSUPPORT1 (0x2A) ++#define HERMES_SWSUPPORT2 (0x2C) ++#define HERMES_AUXPAGE (0x3A) ++#define HERMES_AUXOFFSET (0x3C) ++#define HERMES_AUXDATA (0x3E) ++ ++/* ++ * CMD register bitmasks ++ */ ++#define HERMES_CMD_BUSY (0x8000) ++#define HERMES_CMD_AINFO (0x7f00) ++#define HERMES_CMD_MACPORT (0x0700) ++#define HERMES_CMD_RECL (0x0100) ++#define HERMES_CMD_WRITE (0x0100) ++#define HERMES_CMD_PROGMODE (0x0300) ++#define HERMES_CMD_CMDCODE (0x003f) ++ ++/* ++ * STATUS register bitmasks ++ */ ++#define HERMES_STATUS_RESULT (0x7f00) ++#define HERMES_STATUS_CMDCODE (0x003f) ++ ++/* ++ * OFFSET register bitmasks ++ */ ++#define HERMES_OFFSET_BUSY (0x8000) ++#define HERMES_OFFSET_ERR (0x4000) ++#define HERMES_OFFSET_DATAOFF (0x0ffe) ++ ++/* ++ * Event register bitmasks (INTEN, EVSTAT, EVACK) ++ */ ++#define HERMES_EV_TICK (0x8000) ++#define HERMES_EV_WTERR (0x4000) ++#define HERMES_EV_INFDROP (0x2000) ++#define HERMES_EV_INFO (0x0080) ++#define HERMES_EV_DTIM (0x0020) ++#define HERMES_EV_CMD (0x0010) ++#define HERMES_EV_ALLOC (0x0008) ++#define HERMES_EV_TXEXC (0x0004) ++#define HERMES_EV_TX (0x0002) ++#define HERMES_EV_RX (0x0001) ++ ++/* ++ * Command codes ++ */ ++/*--- Controller Commands ----------------------------*/ ++#define HERMES_CMD_INIT (0x0000) ++#define HERMES_CMD_ENABLE (0x0001) ++#define HERMES_CMD_DISABLE (0x0002) ++#define HERMES_CMD_DIAG (0x0003) ++ ++/*--- Buffer Mgmt Commands ---------------------------*/ ++#define HERMES_CMD_ALLOC (0x000A) ++#define HERMES_CMD_TX (0x000B) ++ ++/*--- Regulate Commands ------------------------------*/ ++#define HERMES_CMD_NOTIFY (0x0010) ++#define HERMES_CMD_INQUIRE (0x0011) ++ ++/*--- Configure Commands -----------------------------*/ ++#define HERMES_CMD_ACCESS (0x0021) ++#define HERMES_CMD_DOWNLD (0x0022) ++ ++/*--- Serial I/O Commands ----------------------------*/ ++#define HERMES_CMD_READMIF (0x0030) ++#define HERMES_CMD_WRITEMIF (0x0031) ++ ++/*--- Debugging Commands -----------------------------*/ ++#define HERMES_CMD_TEST (0x0038) ++ ++ ++/* Test command arguments */ ++#define HERMES_TEST_SET_CHANNEL 0x0800 ++#define HERMES_TEST_MONITOR 0x0b00 ++#define HERMES_TEST_STOP 0x0f00 ++ ++/* Authentication algorithms */ ++#define HERMES_AUTH_OPEN 1 ++#define HERMES_AUTH_SHARED_KEY 2 ++ ++/* WEP settings */ ++#define HERMES_WEP_PRIVACY_INVOKED 0x0001 ++#define HERMES_WEP_EXCL_UNENCRYPTED 0x0002 ++#define HERMES_WEP_HOST_ENCRYPT 0x0010 ++#define HERMES_WEP_HOST_DECRYPT 0x0080 ++ ++/* Symbol hostscan options */ ++#define HERMES_HOSTSCAN_SYMBOL_5SEC 0x0001 ++#define HERMES_HOSTSCAN_SYMBOL_ONCE 0x0002 ++#define HERMES_HOSTSCAN_SYMBOL_PASSIVE 0x0040 ++#define HERMES_HOSTSCAN_SYMBOL_BCAST 0x0080 ++ ++/* ++ * Frame structures and constants ++ */ ++ ++#define HERMES_DESCRIPTOR_OFFSET 0 ++#define HERMES_802_11_OFFSET (14) ++#define HERMES_802_3_OFFSET (14 + 32) ++#define HERMES_802_2_OFFSET (14 + 32 + 14) ++#define HERMES_TXCNTL2_OFFSET (HERMES_802_3_OFFSET - 2) ++ ++#define HERMES_RXSTAT_ERR (0x0003) ++#define HERMES_RXSTAT_BADCRC (0x0001) ++#define HERMES_RXSTAT_UNDECRYPTABLE (0x0002) ++#define HERMES_RXSTAT_MIC (0x0010) /* Frame contains MIC */ ++#define HERMES_RXSTAT_MACPORT (0x0700) ++#define HERMES_RXSTAT_PCF (0x1000) /* Frame was received in CF period */ ++#define HERMES_RXSTAT_MIC_KEY_ID (0x1800) /* MIC key used */ ++#define HERMES_RXSTAT_MSGTYPE (0xE000) ++#define HERMES_RXSTAT_1042 (0x2000) /* RFC-1042 frame */ ++#define HERMES_RXSTAT_TUNNEL (0x4000) /* bridge-tunnel encoded frame */ ++#define HERMES_RXSTAT_WMP (0x6000) /* Wavelan-II Management Protocol frame */ ++ ++/* Shift amount for key ID in RXSTAT and TXCTRL */ ++#define HERMES_MIC_KEY_ID_SHIFT 11 ++ ++struct hermes_tx_descriptor { ++ __le16 status; ++ __le16 reserved1; ++ __le16 reserved2; ++ __le32 sw_support; ++ u8 retry_count; ++ u8 tx_rate; ++ __le16 tx_control; ++} __packed; ++ ++#define HERMES_TXSTAT_RETRYERR (0x0001) ++#define HERMES_TXSTAT_AGEDERR (0x0002) ++#define HERMES_TXSTAT_DISCON (0x0004) ++#define HERMES_TXSTAT_FORMERR (0x0008) ++ ++#define HERMES_TXCTRL_TX_OK (0x0002) /* ?? interrupt on Tx complete */ ++#define HERMES_TXCTRL_TX_EX (0x0004) /* ?? interrupt on Tx exception */ ++#define HERMES_TXCTRL_802_11 (0x0008) /* We supply 802.11 header */ ++#define HERMES_TXCTRL_MIC (0x0010) /* 802.3 + TKIP */ ++#define HERMES_TXCTRL_MIC_KEY_ID (0x1800) /* MIC Key ID mask */ ++#define HERMES_TXCTRL_ALT_RTRY (0x0020) ++ ++/* Inquiry constants and data types */ ++ ++#define HERMES_INQ_TALLIES (0xF100) ++#define HERMES_INQ_SCAN (0xF101) ++#define HERMES_INQ_CHANNELINFO (0xF102) ++#define HERMES_INQ_HOSTSCAN (0xF103) ++#define HERMES_INQ_HOSTSCAN_SYMBOL (0xF104) ++#define HERMES_INQ_LINKSTATUS (0xF200) ++#define HERMES_INQ_SEC_STAT_AGERE (0xF202) ++ ++struct hermes_tallies_frame { ++ __le16 TxUnicastFrames; ++ __le16 TxMulticastFrames; ++ __le16 TxFragments; ++ __le16 TxUnicastOctets; ++ __le16 TxMulticastOctets; ++ __le16 TxDeferredTransmissions; ++ __le16 TxSingleRetryFrames; ++ __le16 TxMultipleRetryFrames; ++ __le16 TxRetryLimitExceeded; ++ __le16 TxDiscards; ++ __le16 RxUnicastFrames; ++ __le16 RxMulticastFrames; ++ __le16 RxFragments; ++ __le16 RxUnicastOctets; ++ __le16 RxMulticastOctets; ++ __le16 RxFCSErrors; ++ __le16 RxDiscards_NoBuffer; ++ __le16 TxDiscardsWrongSA; ++ __le16 RxWEPUndecryptable; ++ __le16 RxMsgInMsgFragments; ++ __le16 RxMsgInBadMsgFragments; ++ /* Those last are probably not available in very old firmwares */ ++ __le16 RxDiscards_WEPICVError; ++ __le16 RxDiscards_WEPExcluded; ++} __packed; ++ ++/* Grabbed from wlan-ng - Thanks Mark... - Jean II ++ * This is the result of a scan inquiry command */ ++/* Structure describing info about an Access Point */ ++struct prism2_scan_apinfo { ++ __le16 channel; /* Channel where the AP sits */ ++ __le16 noise; /* Noise level */ ++ __le16 level; /* Signal level */ ++ u8 bssid[ETH_ALEN]; /* MAC address of the Access Point */ ++ __le16 beacon_interv; /* Beacon interval */ ++ __le16 capabilities; /* Capabilities */ ++ __le16 essid_len; /* ESSID length */ ++ u8 essid[32]; /* ESSID of the network */ ++ u8 rates[10]; /* Bit rate supported */ ++ __le16 proberesp_rate; /* Data rate of the response frame */ ++ __le16 atim; /* ATIM window time, Kus (hostscan only) */ ++} __packed; ++ ++/* Same stuff for the Lucent/Agere card. ++ * Thanks to h1kari <h1kari AT dachb0den.com> - Jean II */ ++struct agere_scan_apinfo { ++ __le16 channel; /* Channel where the AP sits */ ++ __le16 noise; /* Noise level */ ++ __le16 level; /* Signal level */ ++ u8 bssid[ETH_ALEN]; /* MAC address of the Access Point */ ++ __le16 beacon_interv; /* Beacon interval */ ++ __le16 capabilities; /* Capabilities */ ++ /* bits: 0-ess, 1-ibss, 4-privacy [wep] */ ++ __le16 essid_len; /* ESSID length */ ++ u8 essid[32]; /* ESSID of the network */ ++} __packed; ++ ++/* Moustafa: Scan structure for Symbol cards */ ++struct symbol_scan_apinfo { ++ u8 channel; /* Channel where the AP sits */ ++ u8 unknown1; /* 8 in 2.9x and 3.9x f/w, 0 otherwise */ ++ __le16 noise; /* Noise level */ ++ __le16 level; /* Signal level */ ++ u8 bssid[ETH_ALEN]; /* MAC address of the Access Point */ ++ __le16 beacon_interv; /* Beacon interval */ ++ __le16 capabilities; /* Capabilities */ ++ /* bits: 0-ess, 1-ibss, 4-privacy [wep] */ ++ __le16 essid_len; /* ESSID length */ ++ u8 essid[32]; /* ESSID of the network */ ++ __le16 rates[5]; /* Bit rate supported */ ++ __le16 basic_rates; /* Basic rates bitmask */ ++ u8 unknown2[6]; /* Always FF:FF:FF:FF:00:00 */ ++ u8 unknown3[8]; /* Always 0, appeared in f/w 3.91-68 */ ++} __packed; ++ ++union hermes_scan_info { ++ struct agere_scan_apinfo a; ++ struct prism2_scan_apinfo p; ++ struct symbol_scan_apinfo s; ++}; ++ ++/* Extended scan struct for HERMES_INQ_CHANNELINFO. ++ * wl_lkm calls this an ACS scan (Automatic Channel Select). ++ * Keep out of union hermes_scan_info because it is much bigger than ++ * the older scan structures. */ ++struct agere_ext_scan_info { ++ __le16 reserved0; ++ ++ u8 noise; ++ u8 level; ++ u8 rx_flow; ++ u8 rate; ++ __le16 reserved1[2]; ++ ++ __le16 frame_control; ++ __le16 dur_id; ++ u8 addr1[ETH_ALEN]; ++ u8 addr2[ETH_ALEN]; ++ u8 bssid[ETH_ALEN]; ++ __le16 sequence; ++ u8 addr4[ETH_ALEN]; ++ ++ __le16 data_length; ++ ++ /* Next 3 fields do not get filled in. */ ++ u8 daddr[ETH_ALEN]; ++ u8 saddr[ETH_ALEN]; ++ __le16 len_type; ++ ++ __le64 timestamp; ++ __le16 beacon_interval; ++ __le16 capabilities; ++ u8 data[]; ++} __packed; ++ ++#define HERMES_LINKSTATUS_NOT_CONNECTED (0x0000) ++#define HERMES_LINKSTATUS_CONNECTED (0x0001) ++#define HERMES_LINKSTATUS_DISCONNECTED (0x0002) ++#define HERMES_LINKSTATUS_AP_CHANGE (0x0003) ++#define HERMES_LINKSTATUS_AP_OUT_OF_RANGE (0x0004) ++#define HERMES_LINKSTATUS_AP_IN_RANGE (0x0005) ++#define HERMES_LINKSTATUS_ASSOC_FAILED (0x0006) ++ ++struct hermes_linkstatus { ++ __le16 linkstatus; /* Link status */ ++} __packed; ++ ++struct hermes_response { ++ u16 status, resp0, resp1, resp2; ++}; ++ ++/* "ID" structure - used for ESSID and station nickname */ ++struct hermes_idstring { ++ __le16 len; ++ __le16 val[16]; ++} __packed; ++ ++struct hermes_multicast { ++ u8 addr[HERMES_MAX_MULTICAST][ETH_ALEN]; ++} __packed; ++ ++/* Timeouts */ ++#define HERMES_BAP_BUSY_TIMEOUT (10000) /* In iterations of ~1us */ ++ ++struct hermes; ++ ++/* Functions to access hardware */ ++struct hermes_ops { ++ int (*init)(struct hermes *hw); ++ int (*cmd_wait)(struct hermes *hw, u16 cmd, u16 parm0, ++ struct hermes_response *resp); ++ int (*init_cmd_wait)(struct hermes *hw, u16 cmd, ++ u16 parm0, u16 parm1, u16 parm2, ++ struct hermes_response *resp); ++ int (*allocate)(struct hermes *hw, u16 size, u16 *fid); ++ int (*read_ltv)(struct hermes *hw, int bap, u16 rid, unsigned buflen, ++ u16 *length, void *buf); ++ int (*read_ltv_pr)(struct hermes *hw, int bap, u16 rid, ++ unsigned buflen, u16 *length, void *buf); ++ int (*write_ltv)(struct hermes *hw, int bap, u16 rid, ++ u16 length, const void *value); ++ int (*bap_pread)(struct hermes *hw, int bap, void *buf, int len, ++ u16 id, u16 offset); ++ int (*bap_pwrite)(struct hermes *hw, int bap, const void *buf, ++ int len, u16 id, u16 offset); ++ int (*read_pda)(struct hermes *hw, __le16 *pda, ++ u32 pda_addr, u16 pda_len); ++ int (*program_init)(struct hermes *hw, u32 entry_point); ++ int (*program_end)(struct hermes *hw); ++ int (*program)(struct hermes *hw, const char *buf, ++ u32 addr, u32 len); ++ void (*lock_irqsave)(spinlock_t *lock, unsigned long *flags); ++ void (*unlock_irqrestore)(spinlock_t *lock, unsigned long *flags); ++ void (*lock_irq)(spinlock_t *lock); ++ void (*unlock_irq)(spinlock_t *lock); ++}; ++ ++/* Basic control structure */ ++struct hermes { ++ void __iomem *iobase; ++ int reg_spacing; ++#define HERMES_16BIT_REGSPACING 0 ++#define HERMES_32BIT_REGSPACING 1 ++ u16 inten; /* Which interrupts should be enabled? */ ++ bool eeprom_pda; ++ const struct hermes_ops *ops; ++ void *priv; ++}; ++ ++/* Register access convenience macros */ ++#define hermes_read_reg(hw, off) \ ++ (ioread16((hw)->iobase + ((off) << (hw)->reg_spacing))) ++#define hermes_write_reg(hw, off, val) \ ++ (iowrite16((val), (hw)->iobase + ((off) << (hw)->reg_spacing))) ++#define hermes_read_regn(hw, name) hermes_read_reg((hw), HERMES_##name) ++#define hermes_write_regn(hw, name, val) \ ++ hermes_write_reg((hw), HERMES_##name, (val)) ++ ++/* Function prototypes */ ++void hermes_struct_init(struct hermes *hw, void __iomem *address, ++ int reg_spacing); ++ ++/* Inline functions */ ++ ++static inline int hermes_present(struct hermes *hw) ++{ ++ return hermes_read_regn(hw, SWSUPPORT0) == HERMES_MAGIC; ++} ++ ++static inline void hermes_set_irqmask(struct hermes *hw, u16 events) ++{ ++ hw->inten = events; ++ hermes_write_regn(hw, INTEN, events); ++} ++ ++static inline int hermes_enable_port(struct hermes *hw, int port) ++{ ++ return hw->ops->cmd_wait(hw, HERMES_CMD_ENABLE | (port << 8), ++ 0, NULL); ++} ++ ++static inline int hermes_disable_port(struct hermes *hw, int port) ++{ ++ return hw->ops->cmd_wait(hw, HERMES_CMD_DISABLE | (port << 8), ++ 0, NULL); ++} ++ ++/* Initiate an INQUIRE command (tallies or scan). The result will come as an ++ * information frame in __orinoco_ev_info() */ ++static inline int hermes_inquire(struct hermes *hw, u16 rid) ++{ ++ return hw->ops->cmd_wait(hw, HERMES_CMD_INQUIRE, rid, NULL); ++} ++ ++#define HERMES_BYTES_TO_RECLEN(n) ((((n) + 1) / 2) + 1) ++#define HERMES_RECLEN_TO_BYTES(n) (((n) - 1) * 2) ++ ++/* Note that for the next two, the count is in 16-bit words, not bytes */ ++static inline void hermes_read_words(struct hermes *hw, int off, ++ void *buf, unsigned count) ++{ ++ off = off << hw->reg_spacing; ++ ioread16_rep(hw->iobase + off, buf, count); ++} ++ ++static inline void hermes_write_bytes(struct hermes *hw, int off, ++ const char *buf, unsigned count) ++{ ++ off = off << hw->reg_spacing; ++ iowrite16_rep(hw->iobase + off, buf, count >> 1); ++ if (unlikely(count & 1)) ++ iowrite8(buf[count - 1], hw->iobase + off); ++} ++ ++static inline void hermes_clear_words(struct hermes *hw, int off, ++ unsigned count) ++{ ++ unsigned i; ++ ++ off = off << hw->reg_spacing; ++ ++ for (i = 0; i < count; i++) ++ iowrite16(0, hw->iobase + off); ++} ++ ++#define HERMES_READ_RECORD(hw, bap, rid, buf) \ ++ (hw->ops->read_ltv((hw), (bap), (rid), sizeof(*buf), NULL, (buf))) ++#define HERMES_READ_RECORD_PR(hw, bap, rid, buf) \ ++ (hw->ops->read_ltv_pr((hw), (bap), (rid), sizeof(*buf), NULL, (buf))) ++#define HERMES_WRITE_RECORD(hw, bap, rid, buf) \ ++ (hw->ops->write_ltv((hw), (bap), (rid), \ ++ HERMES_BYTES_TO_RECLEN(sizeof(*buf)), (buf))) ++ ++static inline int hermes_read_wordrec(struct hermes *hw, int bap, u16 rid, ++ u16 *word) ++{ ++ __le16 rec; ++ int err; ++ ++ err = HERMES_READ_RECORD(hw, bap, rid, &rec); ++ *word = le16_to_cpu(rec); ++ return err; ++} ++ ++static inline int hermes_read_wordrec_pr(struct hermes *hw, int bap, u16 rid, ++ u16 *word) ++{ ++ __le16 rec; ++ int err; ++ ++ err = HERMES_READ_RECORD_PR(hw, bap, rid, &rec); ++ *word = le16_to_cpu(rec); ++ return err; ++} ++ ++static inline int hermes_write_wordrec(struct hermes *hw, int bap, u16 rid, ++ u16 word) ++{ ++ __le16 rec = cpu_to_le16(word); ++ return HERMES_WRITE_RECORD(hw, bap, rid, &rec); ++} ++ ++#endif /* _HERMES_H */ +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/hermes_rid.h linux-6.15.6/drivers/net/wireless/intersil/orinoco/hermes_rid.h +--- linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/hermes_rid.h 1970-01-01 01:00:00.000000000 +0100 ++++ linux-6.15.6/drivers/net/wireless/intersil/orinoco/hermes_rid.h 2025-08-03 15:01:59.341130868 +0200 +@@ -0,0 +1,165 @@ ++#ifndef _HERMES_RID_H ++#define _HERMES_RID_H ++ ++/* ++ * Configuration RIDs ++ */ ++#define HERMES_RID_CNFPORTTYPE 0xFC00 ++#define HERMES_RID_CNFOWNMACADDR 0xFC01 ++#define HERMES_RID_CNFDESIREDSSID 0xFC02 ++#define HERMES_RID_CNFOWNCHANNEL 0xFC03 ++#define HERMES_RID_CNFOWNSSID 0xFC04 ++#define HERMES_RID_CNFOWNATIMWINDOW 0xFC05 ++#define HERMES_RID_CNFSYSTEMSCALE 0xFC06 ++#define HERMES_RID_CNFMAXDATALEN 0xFC07 ++#define HERMES_RID_CNFWDSADDRESS 0xFC08 ++#define HERMES_RID_CNFPMENABLED 0xFC09 ++#define HERMES_RID_CNFPMEPS 0xFC0A ++#define HERMES_RID_CNFMULTICASTRECEIVE 0xFC0B ++#define HERMES_RID_CNFMAXSLEEPDURATION 0xFC0C ++#define HERMES_RID_CNFPMHOLDOVERDURATION 0xFC0D ++#define HERMES_RID_CNFOWNNAME 0xFC0E ++#define HERMES_RID_CNFOWNDTIMPERIOD 0xFC10 ++#define HERMES_RID_CNFWDSADDRESS1 0xFC11 ++#define HERMES_RID_CNFWDSADDRESS2 0xFC12 ++#define HERMES_RID_CNFWDSADDRESS3 0xFC13 ++#define HERMES_RID_CNFWDSADDRESS4 0xFC14 ++#define HERMES_RID_CNFWDSADDRESS5 0xFC15 ++#define HERMES_RID_CNFWDSADDRESS6 0xFC16 ++#define HERMES_RID_CNFMULTICASTPMBUFFERING 0xFC17 ++#define HERMES_RID_CNFWEPENABLED_AGERE 0xFC20 ++#define HERMES_RID_CNFAUTHENTICATION_AGERE 0xFC21 ++#define HERMES_RID_CNFMANDATORYBSSID_SYMBOL 0xFC21 ++#define HERMES_RID_CNFDROPUNENCRYPTED 0xFC22 ++#define HERMES_RID_CNFWEPDEFAULTKEYID 0xFC23 ++#define HERMES_RID_CNFDEFAULTKEY0 0xFC24 ++#define HERMES_RID_CNFDEFAULTKEY1 0xFC25 ++#define HERMES_RID_CNFMWOROBUST_AGERE 0xFC25 ++#define HERMES_RID_CNFDEFAULTKEY2 0xFC26 ++#define HERMES_RID_CNFDEFAULTKEY3 0xFC27 ++#define HERMES_RID_CNFWEPFLAGS_INTERSIL 0xFC28 ++#define HERMES_RID_CNFWEPKEYMAPPINGTABLE 0xFC29 ++#define HERMES_RID_CNFAUTHENTICATION 0xFC2A ++#define HERMES_RID_CNFMAXASSOCSTA 0xFC2B ++#define HERMES_RID_CNFKEYLENGTH_SYMBOL 0xFC2B ++#define HERMES_RID_CNFTXCONTROL 0xFC2C ++#define HERMES_RID_CNFROAMINGMODE 0xFC2D ++#define HERMES_RID_CNFHOSTAUTHENTICATION 0xFC2E ++#define HERMES_RID_CNFRCVCRCERROR 0xFC30 ++#define HERMES_RID_CNFMMLIFE 0xFC31 ++#define HERMES_RID_CNFALTRETRYCOUNT 0xFC32 ++#define HERMES_RID_CNFBEACONINT 0xFC33 ++#define HERMES_RID_CNFAPPCFINFO 0xFC34 ++#define HERMES_RID_CNFSTAPCFINFO 0xFC35 ++#define HERMES_RID_CNFPRIORITYQUSAGE 0xFC37 ++#define HERMES_RID_CNFTIMCTRL 0xFC40 ++#define HERMES_RID_CNFTHIRTY2TALLY 0xFC42 ++#define HERMES_RID_CNFENHSECURITY 0xFC43 ++#define HERMES_RID_CNFGROUPADDRESSES 0xFC80 ++#define HERMES_RID_CNFCREATEIBSS 0xFC81 ++#define HERMES_RID_CNFFRAGMENTATIONTHRESHOLD 0xFC82 ++#define HERMES_RID_CNFRTSTHRESHOLD 0xFC83 ++#define HERMES_RID_CNFTXRATECONTROL 0xFC84 ++#define HERMES_RID_CNFPROMISCUOUSMODE 0xFC85 ++#define HERMES_RID_CNFBASICRATES_SYMBOL 0xFC8A ++#define HERMES_RID_CNFPREAMBLE_SYMBOL 0xFC8C ++#define HERMES_RID_CNFFRAGMENTATIONTHRESHOLD0 0xFC90 ++#define HERMES_RID_CNFFRAGMENTATIONTHRESHOLD1 0xFC91 ++#define HERMES_RID_CNFFRAGMENTATIONTHRESHOLD2 0xFC92 ++#define HERMES_RID_CNFFRAGMENTATIONTHRESHOLD3 0xFC93 ++#define HERMES_RID_CNFFRAGMENTATIONTHRESHOLD4 0xFC94 ++#define HERMES_RID_CNFFRAGMENTATIONTHRESHOLD5 0xFC95 ++#define HERMES_RID_CNFFRAGMENTATIONTHRESHOLD6 0xFC96 ++#define HERMES_RID_CNFRTSTHRESHOLD0 0xFC97 ++#define HERMES_RID_CNFRTSTHRESHOLD1 0xFC98 ++#define HERMES_RID_CNFRTSTHRESHOLD2 0xFC99 ++#define HERMES_RID_CNFRTSTHRESHOLD3 0xFC9A ++#define HERMES_RID_CNFRTSTHRESHOLD4 0xFC9B ++#define HERMES_RID_CNFRTSTHRESHOLD5 0xFC9C ++#define HERMES_RID_CNFRTSTHRESHOLD6 0xFC9D ++#define HERMES_RID_CNFHOSTSCAN_SYMBOL 0xFCAB ++#define HERMES_RID_CNFSHORTPREAMBLE 0xFCB0 ++#define HERMES_RID_CNFWEPKEYS_AGERE 0xFCB0 ++#define HERMES_RID_CNFEXCLUDELONGPREAMBLE 0xFCB1 ++#define HERMES_RID_CNFTXKEY_AGERE 0xFCB1 ++#define HERMES_RID_CNFAUTHENTICATIONRSPTO 0xFCB2 ++#define HERMES_RID_CNFSCANSSID_AGERE 0xFCB2 ++#define HERMES_RID_CNFBASICRATES 0xFCB3 ++#define HERMES_RID_CNFSUPPORTEDRATES 0xFCB4 ++#define HERMES_RID_CNFADDDEFAULTTKIPKEY_AGERE 0xFCB4 ++#define HERMES_RID_CNFSETWPAAUTHMGMTSUITE_AGERE 0xFCB5 ++#define HERMES_RID_CNFREMDEFAULTTKIPKEY_AGERE 0xFCB6 ++#define HERMES_RID_CNFADDMAPPEDTKIPKEY_AGERE 0xFCB7 ++#define HERMES_RID_CNFREMMAPPEDTKIPKEY_AGERE 0xFCB8 ++#define HERMES_RID_CNFSETWPACAPABILITIES_AGERE 0xFCB9 ++#define HERMES_RID_CNFCACHEDPMKADDRESS 0xFCBA ++#define HERMES_RID_CNFREMOVEPMKADDRESS 0xFCBB ++#define HERMES_RID_CNFSCANCHANNELS2GHZ 0xFCC2 ++#define HERMES_RID_CNFDISASSOCIATE 0xFCC8 ++#define HERMES_RID_CNFTICKTIME 0xFCE0 ++#define HERMES_RID_CNFSCANREQUEST 0xFCE1 ++#define HERMES_RID_CNFJOINREQUEST 0xFCE2 ++#define HERMES_RID_CNFAUTHENTICATESTATION 0xFCE3 ++#define HERMES_RID_CNFCHANNELINFOREQUEST 0xFCE4 ++#define HERMES_RID_CNFHOSTSCAN 0xFCE5 ++ ++/* ++ * Information RIDs ++ */ ++#define HERMES_RID_MAXLOADTIME 0xFD00 ++#define HERMES_RID_DOWNLOADBUFFER 0xFD01 ++#define HERMES_RID_PRIID 0xFD02 ++#define HERMES_RID_PRISUPRANGE 0xFD03 ++#define HERMES_RID_CFIACTRANGES 0xFD04 ++#define HERMES_RID_NICSERNUM 0xFD0A ++#define HERMES_RID_NICID 0xFD0B ++#define HERMES_RID_MFISUPRANGE 0xFD0C ++#define HERMES_RID_CFISUPRANGE 0xFD0D ++#define HERMES_RID_CHANNELLIST 0xFD10 ++#define HERMES_RID_REGULATORYDOMAINS 0xFD11 ++#define HERMES_RID_TEMPTYPE 0xFD12 ++#define HERMES_RID_CIS 0xFD13 ++#define HERMES_RID_STAID 0xFD20 ++#define HERMES_RID_STASUPRANGE 0xFD21 ++#define HERMES_RID_MFIACTRANGES 0xFD22 ++#define HERMES_RID_CFIACTRANGES2 0xFD23 ++#define HERMES_RID_SECONDARYVERSION_SYMBOL 0xFD24 ++#define HERMES_RID_PORTSTATUS 0xFD40 ++#define HERMES_RID_CURRENTSSID 0xFD41 ++#define HERMES_RID_CURRENTBSSID 0xFD42 ++#define HERMES_RID_COMMSQUALITY 0xFD43 ++#define HERMES_RID_CURRENTTXRATE 0xFD44 ++#define HERMES_RID_CURRENTBEACONINTERVAL 0xFD45 ++#define HERMES_RID_CURRENTSCALETHRESHOLDS 0xFD46 ++#define HERMES_RID_PROTOCOLRSPTIME 0xFD47 ++#define HERMES_RID_SHORTRETRYLIMIT 0xFD48 ++#define HERMES_RID_LONGRETRYLIMIT 0xFD49 ++#define HERMES_RID_MAXTRANSMITLIFETIME 0xFD4A ++#define HERMES_RID_MAXRECEIVELIFETIME 0xFD4B ++#define HERMES_RID_CFPOLLABLE 0xFD4C ++#define HERMES_RID_AUTHENTICATIONALGORITHMS 0xFD4D ++#define HERMES_RID_PRIVACYOPTIONIMPLEMENTED 0xFD4F ++#define HERMES_RID_DBMCOMMSQUALITY_INTERSIL 0xFD51 ++#define HERMES_RID_CURRENTTXRATE1 0xFD80 ++#define HERMES_RID_CURRENTTXRATE2 0xFD81 ++#define HERMES_RID_CURRENTTXRATE3 0xFD82 ++#define HERMES_RID_CURRENTTXRATE4 0xFD83 ++#define HERMES_RID_CURRENTTXRATE5 0xFD84 ++#define HERMES_RID_CURRENTTXRATE6 0xFD85 ++#define HERMES_RID_OWNMACADDR 0xFD86 ++#define HERMES_RID_SCANRESULTSTABLE 0xFD88 ++#define HERMES_RID_CURRENT_COUNTRY_INFO 0xFD89 ++#define HERMES_RID_CURRENT_WPA_IE 0xFD8A ++#define HERMES_RID_CURRENT_TKIP_IV 0xFD8B ++#define HERMES_RID_CURRENT_ASSOC_REQ_INFO 0xFD8C ++#define HERMES_RID_CURRENT_ASSOC_RESP_INFO 0xFD8D ++#define HERMES_RID_TXQUEUEEMPTY 0xFD91 ++#define HERMES_RID_PHYTYPE 0xFDC0 ++#define HERMES_RID_CURRENTCHANNEL 0xFDC1 ++#define HERMES_RID_CURRENTPOWERSTATE 0xFDC2 ++#define HERMES_RID_CCAMODE 0xFDC3 ++#define HERMES_RID_SUPPORTEDDATARATES 0xFDC6 ++#define HERMES_RID_BUILDSEQ 0xFFFE ++#define HERMES_RID_FWID 0xFFFF ++ ++#endif +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/hw.c linux-6.15.6/drivers/net/wireless/intersil/orinoco/hw.c +--- linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/hw.c 1970-01-01 01:00:00.000000000 +0100 ++++ linux-6.15.6/drivers/net/wireless/intersil/orinoco/hw.c 2025-08-03 15:01:59.341130868 +0200 +@@ -0,0 +1,1362 @@ ++/* Encapsulate basic setting changes and retrieval on Hermes hardware ++ * ++ * See copyright notice in main.c ++ */ ++#include <linux/kernel.h> ++#include <linux/device.h> ++#include <linux/if_arp.h> ++#include <linux/ieee80211.h> ++#include <linux/wireless.h> ++#include <net/cfg80211.h> ++#include "hermes.h" ++#include "hermes_rid.h" ++#include "orinoco.h" ++ ++#include "hw.h" ++ ++#define SYMBOL_MAX_VER_LEN (14) ++ ++/* Symbol firmware has a bug allocating buffers larger than this */ ++#define TX_NICBUF_SIZE_BUG 1585 ++ ++/********************************************************************/ ++/* Data tables */ ++/********************************************************************/ ++ ++/* This tables gives the actual meanings of the bitrate IDs returned ++ * by the firmware. */ ++static const struct { ++ int bitrate; /* in 100s of kilobits */ ++ int automatic; ++ u16 agere_txratectrl; ++ u16 intersil_txratectrl; ++} bitrate_table[] = { ++ {110, 1, 3, 15}, /* Entry 0 is the default */ ++ {10, 0, 1, 1}, ++ {10, 1, 1, 1}, ++ {20, 0, 2, 2}, ++ {20, 1, 6, 3}, ++ {55, 0, 4, 4}, ++ {55, 1, 7, 7}, ++ {110, 0, 5, 8}, ++}; ++#define BITRATE_TABLE_SIZE ARRAY_SIZE(bitrate_table) ++ ++/* Firmware version encoding */ ++struct comp_id { ++ u16 id, variant, major, minor; ++} __packed; ++ ++static inline enum fwtype determine_firmware_type(struct comp_id *nic_id) ++{ ++ if (nic_id->id < 0x8000) ++ return FIRMWARE_TYPE_AGERE; ++ else if (nic_id->id == 0x8000 && nic_id->major == 0) ++ return FIRMWARE_TYPE_SYMBOL; ++ else ++ return FIRMWARE_TYPE_INTERSIL; ++} ++ ++/* Set priv->firmware type, determine firmware properties ++ * This function can be called before we have registerred with netdev, ++ * so all errors go out with dev_* rather than printk ++ * ++ * If non-NULL stores a firmware description in fw_name. ++ * If non-NULL stores a HW version in hw_ver ++ * ++ * These are output via generic cfg80211 ethtool support. ++ */ ++int determine_fw_capabilities(struct orinoco_private *priv, ++ char *fw_name, size_t fw_name_len, ++ u32 *hw_ver) ++{ ++ struct device *dev = priv->dev; ++ struct hermes *hw = &priv->hw; ++ int err; ++ struct comp_id nic_id, sta_id; ++ unsigned int firmver; ++ char tmp[SYMBOL_MAX_VER_LEN + 1] __attribute__((aligned(2))); ++ ++ /* Get the hardware version */ ++ err = HERMES_READ_RECORD_PR(hw, USER_BAP, HERMES_RID_NICID, &nic_id); ++ if (err) { ++ dev_err(dev, "Cannot read hardware identity: error %d\n", ++ err); ++ return err; ++ } ++ ++ le16_to_cpus(&nic_id.id); ++ le16_to_cpus(&nic_id.variant); ++ le16_to_cpus(&nic_id.major); ++ le16_to_cpus(&nic_id.minor); ++ dev_info(dev, "Hardware identity %04x:%04x:%04x:%04x\n", ++ nic_id.id, nic_id.variant, nic_id.major, nic_id.minor); ++ ++ if (hw_ver) ++ *hw_ver = (((nic_id.id & 0xff) << 24) | ++ ((nic_id.variant & 0xff) << 16) | ++ ((nic_id.major & 0xff) << 8) | ++ (nic_id.minor & 0xff)); ++ ++ priv->firmware_type = determine_firmware_type(&nic_id); ++ ++ /* Get the firmware version */ ++ err = HERMES_READ_RECORD_PR(hw, USER_BAP, HERMES_RID_STAID, &sta_id); ++ if (err) { ++ dev_err(dev, "Cannot read station identity: error %d\n", ++ err); ++ return err; ++ } ++ ++ le16_to_cpus(&sta_id.id); ++ le16_to_cpus(&sta_id.variant); ++ le16_to_cpus(&sta_id.major); ++ le16_to_cpus(&sta_id.minor); ++ dev_info(dev, "Station identity %04x:%04x:%04x:%04x\n", ++ sta_id.id, sta_id.variant, sta_id.major, sta_id.minor); ++ ++ switch (sta_id.id) { ++ case 0x15: ++ dev_err(dev, "Primary firmware is active\n"); ++ return -ENODEV; ++ case 0x14b: ++ dev_err(dev, "Tertiary firmware is active\n"); ++ return -ENODEV; ++ case 0x1f: /* Intersil, Agere, Symbol Spectrum24 */ ++ case 0x21: /* Symbol Spectrum24 Trilogy */ ++ break; ++ default: ++ dev_notice(dev, "Unknown station ID, please report\n"); ++ break; ++ } ++ ++ /* Default capabilities */ ++ priv->has_sensitivity = 1; ++ priv->has_mwo = 0; ++ priv->has_preamble = 0; ++ priv->has_port3 = 1; ++ priv->has_ibss = 1; ++ priv->has_wep = 0; ++ priv->has_big_wep = 0; ++ priv->has_alt_txcntl = 0; ++ priv->has_ext_scan = 0; ++ priv->has_wpa = 0; ++ priv->do_fw_download = 0; ++ ++ /* Determine capabilities from the firmware version */ ++ switch (priv->firmware_type) { ++ case FIRMWARE_TYPE_AGERE: ++ /* Lucent Wavelan IEEE, Lucent Orinoco, Cabletron RoamAbout, ++ ELSA, Melco, HP, IBM, Dell 1150, Compaq 110/210 */ ++ if (fw_name) ++ snprintf(fw_name, fw_name_len, "Lucent/Agere %d.%02d", ++ sta_id.major, sta_id.minor); ++ ++ firmver = ((unsigned long)sta_id.major << 16) | sta_id.minor; ++ ++ priv->has_ibss = (firmver >= 0x60006); ++ priv->has_wep = (firmver >= 0x40020); ++ priv->has_big_wep = 1; /* FIXME: this is wrong - how do we tell ++ Gold cards from the others? */ ++ priv->has_mwo = (firmver >= 0x60000); ++ priv->has_pm = (firmver >= 0x40020); /* Don't work in 7.52 ? */ ++ priv->ibss_port = 1; ++ priv->has_hostscan = (firmver >= 0x8000a); ++ priv->do_fw_download = 1; ++ priv->broken_monitor = (firmver >= 0x80000); ++ priv->has_alt_txcntl = (firmver >= 0x90000); /* All 9.x ? */ ++ priv->has_ext_scan = (firmver >= 0x90000); /* All 9.x ? */ ++ priv->has_wpa = (firmver >= 0x9002a); ++ /* Tested with Agere firmware : ++ * 1.16 ; 4.08 ; 4.52 ; 6.04 ; 6.16 ; 7.28 => Jean II ++ * Tested CableTron firmware : 4.32 => Anton */ ++ break; ++ case FIRMWARE_TYPE_SYMBOL: ++ /* Symbol , 3Com AirConnect, Intel, Ericsson WLAN */ ++ /* Intel MAC : 00:02:B3:* */ ++ /* 3Com MAC : 00:50:DA:* */ ++ memset(tmp, 0, sizeof(tmp)); ++ /* Get the Symbol firmware version */ ++ err = hw->ops->read_ltv_pr(hw, USER_BAP, ++ HERMES_RID_SECONDARYVERSION_SYMBOL, ++ SYMBOL_MAX_VER_LEN, NULL, &tmp); ++ if (err) { ++ dev_warn(dev, "Error %d reading Symbol firmware info. " ++ "Wildly guessing capabilities...\n", err); ++ firmver = 0; ++ tmp[0] = '\0'; ++ } else { ++ /* The firmware revision is a string, the format is ++ * something like : "V2.20-01". ++ * Quick and dirty parsing... - Jean II ++ */ ++ firmver = ((tmp[1] - '0') << 16) ++ | ((tmp[3] - '0') << 12) ++ | ((tmp[4] - '0') << 8) ++ | ((tmp[6] - '0') << 4) ++ | (tmp[7] - '0'); ++ ++ tmp[SYMBOL_MAX_VER_LEN] = '\0'; ++ } ++ ++ if (fw_name) ++ snprintf(fw_name, fw_name_len, "Symbol %s", tmp); ++ ++ priv->has_ibss = (firmver >= 0x20000); ++ priv->has_wep = (firmver >= 0x15012); ++ priv->has_big_wep = (firmver >= 0x20000); ++ priv->has_pm = (firmver >= 0x20000 && firmver < 0x22000) || ++ (firmver >= 0x29000 && firmver < 0x30000) || ++ firmver >= 0x31000; ++ priv->has_preamble = (firmver >= 0x20000); ++ priv->ibss_port = 4; ++ ++ /* Symbol firmware is found on various cards, but ++ * there has been no attempt to check firmware ++ * download on non-spectrum_cs based cards. ++ * ++ * Given that the Agere firmware download works ++ * differently, we should avoid doing a firmware ++ * download with the Symbol algorithm on non-spectrum ++ * cards. ++ * ++ * For now we can identify a spectrum_cs based card ++ * because it has a firmware reset function. ++ */ ++ priv->do_fw_download = (priv->stop_fw != NULL); ++ ++ priv->broken_disableport = (firmver == 0x25013) || ++ (firmver >= 0x30000 && firmver <= 0x31000); ++ priv->has_hostscan = (firmver >= 0x31001) || ++ (firmver >= 0x29057 && firmver < 0x30000); ++ /* Tested with Intel firmware : 0x20015 => Jean II */ ++ /* Tested with 3Com firmware : 0x15012 & 0x22001 => Jean II */ ++ break; ++ case FIRMWARE_TYPE_INTERSIL: ++ /* D-Link, Linksys, Adtron, ZoomAir, and many others... ++ * Samsung, Compaq 100/200 and Proxim are slightly ++ * different and less well tested */ ++ /* D-Link MAC : 00:40:05:* */ ++ /* Addtron MAC : 00:90:D1:* */ ++ if (fw_name) ++ snprintf(fw_name, fw_name_len, "Intersil %d.%d.%d", ++ sta_id.major, sta_id.minor, sta_id.variant); ++ ++ firmver = ((unsigned long)sta_id.major << 16) | ++ ((unsigned long)sta_id.minor << 8) | sta_id.variant; ++ ++ priv->has_ibss = (firmver >= 0x000700); /* FIXME */ ++ priv->has_big_wep = priv->has_wep = (firmver >= 0x000800); ++ priv->has_pm = (firmver >= 0x000700); ++ priv->has_hostscan = (firmver >= 0x010301); ++ ++ if (firmver >= 0x000800) ++ priv->ibss_port = 0; ++ else { ++ dev_notice(dev, "Intersil firmware earlier than v0.8.x" ++ " - several features not supported\n"); ++ priv->ibss_port = 1; ++ } ++ break; ++ } ++ if (fw_name) ++ dev_info(dev, "Firmware determined as %s\n", fw_name); ++ ++#ifndef CONFIG_HERMES_PRISM ++ if (priv->firmware_type == FIRMWARE_TYPE_INTERSIL) { ++ dev_err(dev, "Support for Prism chipset is not enabled\n"); ++ return -ENODEV; ++ } ++#endif ++ ++ return 0; ++} ++ ++/* Read settings from EEPROM into our private structure. ++ * MAC address gets dropped into callers buffer ++ * Can be called before netdev registration. ++ */ ++int orinoco_hw_read_card_settings(struct orinoco_private *priv, u8 *dev_addr) ++{ ++ struct device *dev = priv->dev; ++ struct hermes_idstring nickbuf; ++ struct hermes *hw = &priv->hw; ++ int len; ++ int err; ++ u16 reclen; ++ ++ /* Get the MAC address */ ++ err = hw->ops->read_ltv_pr(hw, USER_BAP, HERMES_RID_CNFOWNMACADDR, ++ ETH_ALEN, NULL, dev_addr); ++ if (err) { ++ dev_warn(dev, "Failed to read MAC address!\n"); ++ goto out; ++ } ++ ++ dev_dbg(dev, "MAC address %pM\n", dev_addr); ++ ++ /* Get the station name */ ++ err = hw->ops->read_ltv_pr(hw, USER_BAP, HERMES_RID_CNFOWNNAME, ++ sizeof(nickbuf), &reclen, &nickbuf); ++ if (err) { ++ dev_err(dev, "failed to read station name\n"); ++ goto out; ++ } ++ if (nickbuf.len) ++ len = min(IW_ESSID_MAX_SIZE, (int)le16_to_cpu(nickbuf.len)); ++ else ++ len = min(IW_ESSID_MAX_SIZE, 2 * reclen); ++ memcpy(priv->nick, &nickbuf.val, len); ++ priv->nick[len] = '\0'; ++ ++ dev_dbg(dev, "Station name \"%s\"\n", priv->nick); ++ ++ /* Get allowed channels */ ++ err = hermes_read_wordrec_pr(hw, USER_BAP, HERMES_RID_CHANNELLIST, ++ &priv->channel_mask); ++ if (err) { ++ dev_err(dev, "Failed to read channel list!\n"); ++ goto out; ++ } ++ ++ /* Get initial AP density */ ++ err = hermes_read_wordrec_pr(hw, USER_BAP, HERMES_RID_CNFSYSTEMSCALE, ++ &priv->ap_density); ++ if (err || priv->ap_density < 1 || priv->ap_density > 3) ++ priv->has_sensitivity = 0; ++ ++ /* Get initial RTS threshold */ ++ err = hermes_read_wordrec_pr(hw, USER_BAP, HERMES_RID_CNFRTSTHRESHOLD, ++ &priv->rts_thresh); ++ if (err) { ++ dev_err(dev, "Failed to read RTS threshold!\n"); ++ goto out; ++ } ++ ++ /* Get initial fragmentation settings */ ++ if (priv->has_mwo) ++ err = hermes_read_wordrec_pr(hw, USER_BAP, ++ HERMES_RID_CNFMWOROBUST_AGERE, ++ &priv->mwo_robust); ++ else ++ err = hermes_read_wordrec_pr(hw, USER_BAP, ++ HERMES_RID_CNFFRAGMENTATIONTHRESHOLD, ++ &priv->frag_thresh); ++ if (err) { ++ dev_err(dev, "Failed to read fragmentation settings!\n"); ++ goto out; ++ } ++ ++ /* Power management setup */ ++ if (priv->has_pm) { ++ priv->pm_on = 0; ++ priv->pm_mcast = 1; ++ err = hermes_read_wordrec_pr(hw, USER_BAP, ++ HERMES_RID_CNFMAXSLEEPDURATION, ++ &priv->pm_period); ++ if (err) { ++ dev_err(dev, "Failed to read power management " ++ "period!\n"); ++ goto out; ++ } ++ err = hermes_read_wordrec_pr(hw, USER_BAP, ++ HERMES_RID_CNFPMHOLDOVERDURATION, ++ &priv->pm_timeout); ++ if (err) { ++ dev_err(dev, "Failed to read power management " ++ "timeout!\n"); ++ goto out; ++ } ++ } ++ ++ /* Preamble setup */ ++ if (priv->has_preamble) { ++ err = hermes_read_wordrec_pr(hw, USER_BAP, ++ HERMES_RID_CNFPREAMBLE_SYMBOL, ++ &priv->preamble); ++ if (err) { ++ dev_err(dev, "Failed to read preamble setup\n"); ++ goto out; ++ } ++ } ++ ++ /* Retry settings */ ++ err = hermes_read_wordrec_pr(hw, USER_BAP, HERMES_RID_SHORTRETRYLIMIT, ++ &priv->short_retry_limit); ++ if (err) { ++ dev_err(dev, "Failed to read short retry limit\n"); ++ goto out; ++ } ++ ++ err = hermes_read_wordrec_pr(hw, USER_BAP, HERMES_RID_LONGRETRYLIMIT, ++ &priv->long_retry_limit); ++ if (err) { ++ dev_err(dev, "Failed to read long retry limit\n"); ++ goto out; ++ } ++ ++ err = hermes_read_wordrec_pr(hw, USER_BAP, HERMES_RID_MAXTRANSMITLIFETIME, ++ &priv->retry_lifetime); ++ if (err) { ++ dev_err(dev, "Failed to read max retry lifetime\n"); ++ goto out; ++ } ++ ++out: ++ return err; ++} ++ ++/* Can be called before netdev registration */ ++int orinoco_hw_allocate_fid(struct orinoco_private *priv) ++{ ++ struct device *dev = priv->dev; ++ struct hermes *hw = &priv->hw; ++ int err; ++ ++ err = hw->ops->allocate(hw, priv->nicbuf_size, &priv->txfid); ++ if (err == -EIO && priv->nicbuf_size > TX_NICBUF_SIZE_BUG) { ++ /* Try workaround for old Symbol firmware bug */ ++ priv->nicbuf_size = TX_NICBUF_SIZE_BUG; ++ err = hw->ops->allocate(hw, priv->nicbuf_size, &priv->txfid); ++ ++ dev_warn(dev, "Firmware ALLOC bug detected " ++ "(old Symbol firmware?). Work around %s\n", ++ err ? "failed!" : "ok."); ++ } ++ ++ return err; ++} ++ ++int orinoco_get_bitratemode(int bitrate, int automatic) ++{ ++ int ratemode = -1; ++ int i; ++ ++ if ((bitrate != 10) && (bitrate != 20) && ++ (bitrate != 55) && (bitrate != 110)) ++ return ratemode; ++ ++ for (i = 0; i < BITRATE_TABLE_SIZE; i++) { ++ if ((bitrate_table[i].bitrate == bitrate) && ++ (bitrate_table[i].automatic == automatic)) { ++ ratemode = i; ++ break; ++ } ++ } ++ return ratemode; ++} ++ ++void orinoco_get_ratemode_cfg(int ratemode, int *bitrate, int *automatic) ++{ ++ BUG_ON((ratemode < 0) || (ratemode >= BITRATE_TABLE_SIZE)); ++ ++ *bitrate = bitrate_table[ratemode].bitrate * 100000; ++ *automatic = bitrate_table[ratemode].automatic; ++} ++ ++int orinoco_hw_program_rids(struct orinoco_private *priv) ++{ ++ struct net_device *dev = priv->ndev; ++ struct wireless_dev *wdev = netdev_priv(dev); ++ struct hermes *hw = &priv->hw; ++ int err; ++ struct hermes_idstring idbuf; ++ ++ /* Set the MAC address */ ++ err = hw->ops->write_ltv(hw, USER_BAP, HERMES_RID_CNFOWNMACADDR, ++ HERMES_BYTES_TO_RECLEN(ETH_ALEN), ++ dev->dev_addr); ++ if (err) { ++ printk(KERN_ERR "%s: Error %d setting MAC address\n", ++ dev->name, err); ++ return err; ++ } ++ ++ /* Set up the link mode */ ++ err = hermes_write_wordrec(hw, USER_BAP, HERMES_RID_CNFPORTTYPE, ++ priv->port_type); ++ if (err) { ++ printk(KERN_ERR "%s: Error %d setting port type\n", ++ dev->name, err); ++ return err; ++ } ++ /* Set the channel/frequency */ ++ if (priv->channel != 0 && priv->iw_mode != NL80211_IFTYPE_STATION) { ++ err = hermes_write_wordrec(hw, USER_BAP, ++ HERMES_RID_CNFOWNCHANNEL, ++ priv->channel); ++ if (err) { ++ printk(KERN_ERR "%s: Error %d setting channel %d\n", ++ dev->name, err, priv->channel); ++ return err; ++ } ++ } ++ ++ if (priv->has_ibss) { ++ u16 createibss; ++ ++ if ((strlen(priv->desired_essid) == 0) && (priv->createibss)) { ++ printk(KERN_WARNING "%s: This firmware requires an " ++ "ESSID in IBSS-Ad-Hoc mode.\n", dev->name); ++ /* With wvlan_cs, in this case, we would crash. ++ * hopefully, this driver will behave better... ++ * Jean II */ ++ createibss = 0; ++ } else { ++ createibss = priv->createibss; ++ } ++ ++ err = hermes_write_wordrec(hw, USER_BAP, ++ HERMES_RID_CNFCREATEIBSS, ++ createibss); ++ if (err) { ++ printk(KERN_ERR "%s: Error %d setting CREATEIBSS\n", ++ dev->name, err); ++ return err; ++ } ++ } ++ ++ /* Set the desired BSSID */ ++ err = __orinoco_hw_set_wap(priv); ++ if (err) { ++ printk(KERN_ERR "%s: Error %d setting AP address\n", ++ dev->name, err); ++ return err; ++ } ++ ++ /* Set the desired ESSID */ ++ idbuf.len = cpu_to_le16(strlen(priv->desired_essid)); ++ memcpy(&idbuf.val, priv->desired_essid, sizeof(idbuf.val)); ++ /* WinXP wants partner to configure OWNSSID even in IBSS mode. (jimc) */ ++ err = hw->ops->write_ltv(hw, USER_BAP, HERMES_RID_CNFOWNSSID, ++ HERMES_BYTES_TO_RECLEN(strlen(priv->desired_essid) + 2), ++ &idbuf); ++ if (err) { ++ printk(KERN_ERR "%s: Error %d setting OWNSSID\n", ++ dev->name, err); ++ return err; ++ } ++ err = hw->ops->write_ltv(hw, USER_BAP, HERMES_RID_CNFDESIREDSSID, ++ HERMES_BYTES_TO_RECLEN(strlen(priv->desired_essid) + 2), ++ &idbuf); ++ if (err) { ++ printk(KERN_ERR "%s: Error %d setting DESIREDSSID\n", ++ dev->name, err); ++ return err; ++ } ++ ++ /* Set the station name */ ++ idbuf.len = cpu_to_le16(strlen(priv->nick)); ++ memcpy(&idbuf.val, priv->nick, sizeof(idbuf.val)); ++ err = hw->ops->write_ltv(hw, USER_BAP, HERMES_RID_CNFOWNNAME, ++ HERMES_BYTES_TO_RECLEN(strlen(priv->nick) + 2), ++ &idbuf); ++ if (err) { ++ printk(KERN_ERR "%s: Error %d setting nickname\n", ++ dev->name, err); ++ return err; ++ } ++ ++ /* Set AP density */ ++ if (priv->has_sensitivity) { ++ err = hermes_write_wordrec(hw, USER_BAP, ++ HERMES_RID_CNFSYSTEMSCALE, ++ priv->ap_density); ++ if (err) { ++ printk(KERN_WARNING "%s: Error %d setting SYSTEMSCALE. " ++ "Disabling sensitivity control\n", ++ dev->name, err); ++ ++ priv->has_sensitivity = 0; ++ } ++ } ++ ++ /* Set RTS threshold */ ++ err = hermes_write_wordrec(hw, USER_BAP, HERMES_RID_CNFRTSTHRESHOLD, ++ priv->rts_thresh); ++ if (err) { ++ printk(KERN_ERR "%s: Error %d setting RTS threshold\n", ++ dev->name, err); ++ return err; ++ } ++ ++ /* Set fragmentation threshold or MWO robustness */ ++ if (priv->has_mwo) ++ err = hermes_write_wordrec(hw, USER_BAP, ++ HERMES_RID_CNFMWOROBUST_AGERE, ++ priv->mwo_robust); ++ else ++ err = hermes_write_wordrec(hw, USER_BAP, ++ HERMES_RID_CNFFRAGMENTATIONTHRESHOLD, ++ priv->frag_thresh); ++ if (err) { ++ printk(KERN_ERR "%s: Error %d setting fragmentation\n", ++ dev->name, err); ++ return err; ++ } ++ ++ /* Set bitrate */ ++ err = __orinoco_hw_set_bitrate(priv); ++ if (err) { ++ printk(KERN_ERR "%s: Error %d setting bitrate\n", ++ dev->name, err); ++ return err; ++ } ++ ++ /* Set power management */ ++ if (priv->has_pm) { ++ err = hermes_write_wordrec(hw, USER_BAP, ++ HERMES_RID_CNFPMENABLED, ++ priv->pm_on); ++ if (err) { ++ printk(KERN_ERR "%s: Error %d setting up PM\n", ++ dev->name, err); ++ return err; ++ } ++ ++ err = hermes_write_wordrec(hw, USER_BAP, ++ HERMES_RID_CNFMULTICASTRECEIVE, ++ priv->pm_mcast); ++ if (err) { ++ printk(KERN_ERR "%s: Error %d setting up PM\n", ++ dev->name, err); ++ return err; ++ } ++ err = hermes_write_wordrec(hw, USER_BAP, ++ HERMES_RID_CNFMAXSLEEPDURATION, ++ priv->pm_period); ++ if (err) { ++ printk(KERN_ERR "%s: Error %d setting up PM\n", ++ dev->name, err); ++ return err; ++ } ++ err = hermes_write_wordrec(hw, USER_BAP, ++ HERMES_RID_CNFPMHOLDOVERDURATION, ++ priv->pm_timeout); ++ if (err) { ++ printk(KERN_ERR "%s: Error %d setting up PM\n", ++ dev->name, err); ++ return err; ++ } ++ } ++ ++ /* Set preamble - only for Symbol so far... */ ++ if (priv->has_preamble) { ++ err = hermes_write_wordrec(hw, USER_BAP, ++ HERMES_RID_CNFPREAMBLE_SYMBOL, ++ priv->preamble); ++ if (err) { ++ printk(KERN_ERR "%s: Error %d setting preamble\n", ++ dev->name, err); ++ return err; ++ } ++ } ++ ++ /* Set up encryption */ ++ if (priv->has_wep || priv->has_wpa) { ++ err = __orinoco_hw_setup_enc(priv); ++ if (err) { ++ printk(KERN_ERR "%s: Error %d activating encryption\n", ++ dev->name, err); ++ return err; ++ } ++ } ++ ++ if (priv->iw_mode == NL80211_IFTYPE_MONITOR) { ++ /* Enable monitor mode */ ++ dev->type = ARPHRD_IEEE80211; ++ err = hw->ops->cmd_wait(hw, HERMES_CMD_TEST | ++ HERMES_TEST_MONITOR, 0, NULL); ++ } else { ++ /* Disable monitor mode */ ++ dev->type = ARPHRD_ETHER; ++ err = hw->ops->cmd_wait(hw, HERMES_CMD_TEST | ++ HERMES_TEST_STOP, 0, NULL); ++ } ++ if (err) ++ return err; ++ ++ /* Reset promiscuity / multicast*/ ++ priv->promiscuous = 0; ++ priv->mc_count = 0; ++ ++ /* Record mode change */ ++ wdev->iftype = priv->iw_mode; ++ ++ return 0; ++} ++ ++/* Get tsc from the firmware */ ++int orinoco_hw_get_tkip_iv(struct orinoco_private *priv, int key, u8 *tsc) ++{ ++ struct hermes *hw = &priv->hw; ++ int err = 0; ++ u8 tsc_arr[4][ORINOCO_SEQ_LEN]; ++ ++ if ((key < 0) || (key >= 4)) ++ return -EINVAL; ++ ++ err = hw->ops->read_ltv(hw, USER_BAP, HERMES_RID_CURRENT_TKIP_IV, ++ sizeof(tsc_arr), NULL, &tsc_arr); ++ if (!err) ++ memcpy(tsc, &tsc_arr[key][0], sizeof(tsc_arr[0])); ++ ++ return err; ++} ++ ++int __orinoco_hw_set_bitrate(struct orinoco_private *priv) ++{ ++ struct hermes *hw = &priv->hw; ++ int ratemode = priv->bitratemode; ++ int err = 0; ++ ++ if (ratemode >= BITRATE_TABLE_SIZE) { ++ printk(KERN_ERR "%s: BUG: Invalid bitrate mode %d\n", ++ priv->ndev->name, ratemode); ++ return -EINVAL; ++ } ++ ++ switch (priv->firmware_type) { ++ case FIRMWARE_TYPE_AGERE: ++ err = hermes_write_wordrec(hw, USER_BAP, ++ HERMES_RID_CNFTXRATECONTROL, ++ bitrate_table[ratemode].agere_txratectrl); ++ break; ++ case FIRMWARE_TYPE_INTERSIL: ++ case FIRMWARE_TYPE_SYMBOL: ++ err = hermes_write_wordrec(hw, USER_BAP, ++ HERMES_RID_CNFTXRATECONTROL, ++ bitrate_table[ratemode].intersil_txratectrl); ++ break; ++ default: ++ BUG(); ++ } ++ ++ return err; ++} ++ ++int orinoco_hw_get_act_bitrate(struct orinoco_private *priv, int *bitrate) ++{ ++ struct hermes *hw = &priv->hw; ++ int i; ++ int err = 0; ++ u16 val; ++ ++ err = hermes_read_wordrec(hw, USER_BAP, ++ HERMES_RID_CURRENTTXRATE, &val); ++ if (err) ++ return err; ++ ++ switch (priv->firmware_type) { ++ case FIRMWARE_TYPE_AGERE: /* Lucent style rate */ ++ /* Note : in Lucent firmware, the return value of ++ * HERMES_RID_CURRENTTXRATE is the bitrate in Mb/s, ++ * and therefore is totally different from the ++ * encoding of HERMES_RID_CNFTXRATECONTROL. ++ * Don't forget that 6Mb/s is really 5.5Mb/s */ ++ if (val == 6) ++ *bitrate = 5500000; ++ else ++ *bitrate = val * 1000000; ++ break; ++ case FIRMWARE_TYPE_INTERSIL: /* Intersil style rate */ ++ case FIRMWARE_TYPE_SYMBOL: /* Symbol style rate */ ++ for (i = 0; i < BITRATE_TABLE_SIZE; i++) ++ if (bitrate_table[i].intersil_txratectrl == val) { ++ *bitrate = bitrate_table[i].bitrate * 100000; ++ break; ++ } ++ ++ if (i >= BITRATE_TABLE_SIZE) { ++ printk(KERN_INFO "%s: Unable to determine current bitrate (0x%04hx)\n", ++ priv->ndev->name, val); ++ err = -EIO; ++ } ++ ++ break; ++ default: ++ BUG(); ++ } ++ ++ return err; ++} ++ ++/* Set fixed AP address */ ++int __orinoco_hw_set_wap(struct orinoco_private *priv) ++{ ++ int roaming_flag; ++ int err = 0; ++ struct hermes *hw = &priv->hw; ++ ++ switch (priv->firmware_type) { ++ case FIRMWARE_TYPE_AGERE: ++ /* not supported */ ++ break; ++ case FIRMWARE_TYPE_INTERSIL: ++ if (priv->bssid_fixed) ++ roaming_flag = 2; ++ else ++ roaming_flag = 1; ++ ++ err = hermes_write_wordrec(hw, USER_BAP, ++ HERMES_RID_CNFROAMINGMODE, ++ roaming_flag); ++ break; ++ case FIRMWARE_TYPE_SYMBOL: ++ err = HERMES_WRITE_RECORD(hw, USER_BAP, ++ HERMES_RID_CNFMANDATORYBSSID_SYMBOL, ++ &priv->desired_bssid); ++ break; ++ } ++ return err; ++} ++ ++/* Change the WEP keys and/or the current keys. Can be called ++ * either from __orinoco_hw_setup_enc() or directly from ++ * orinoco_ioctl_setiwencode(). In the later case the association ++ * with the AP is not broken (if the firmware can handle it), ++ * which is needed for 802.1x implementations. */ ++int __orinoco_hw_setup_wepkeys(struct orinoco_private *priv) ++{ ++ struct hermes *hw = &priv->hw; ++ int err = 0; ++ int i; ++ ++ switch (priv->firmware_type) { ++ case FIRMWARE_TYPE_AGERE: ++ { ++ struct orinoco_key keys[ORINOCO_MAX_KEYS]; ++ ++ memset(&keys, 0, sizeof(keys)); ++ for (i = 0; i < ORINOCO_MAX_KEYS; i++) { ++ int len = min(priv->keys[i].key_len, ++ ORINOCO_MAX_KEY_SIZE); ++ memcpy(&keys[i].data, priv->keys[i].key, len); ++ if (len > SMALL_KEY_SIZE) ++ keys[i].len = cpu_to_le16(LARGE_KEY_SIZE); ++ else if (len > 0) ++ keys[i].len = cpu_to_le16(SMALL_KEY_SIZE); ++ else ++ keys[i].len = cpu_to_le16(0); ++ } ++ ++ err = HERMES_WRITE_RECORD(hw, USER_BAP, ++ HERMES_RID_CNFWEPKEYS_AGERE, ++ &keys); ++ if (err) ++ return err; ++ err = hermes_write_wordrec(hw, USER_BAP, ++ HERMES_RID_CNFTXKEY_AGERE, ++ priv->tx_key); ++ if (err) ++ return err; ++ break; ++ } ++ case FIRMWARE_TYPE_INTERSIL: ++ case FIRMWARE_TYPE_SYMBOL: ++ { ++ int keylen; ++ ++ /* Force uniform key length to work around ++ * firmware bugs */ ++ keylen = priv->keys[priv->tx_key].key_len; ++ ++ if (keylen > LARGE_KEY_SIZE) { ++ printk(KERN_ERR "%s: BUG: Key %d has oversize length %d.\n", ++ priv->ndev->name, priv->tx_key, keylen); ++ return -E2BIG; ++ } else if (keylen > SMALL_KEY_SIZE) ++ keylen = LARGE_KEY_SIZE; ++ else if (keylen > 0) ++ keylen = SMALL_KEY_SIZE; ++ else ++ keylen = 0; ++ ++ /* Write all 4 keys */ ++ for (i = 0; i < ORINOCO_MAX_KEYS; i++) { ++ u8 key[LARGE_KEY_SIZE] = { 0 }; ++ ++ memcpy(key, priv->keys[i].key, ++ priv->keys[i].key_len); ++ ++ err = hw->ops->write_ltv(hw, USER_BAP, ++ HERMES_RID_CNFDEFAULTKEY0 + i, ++ HERMES_BYTES_TO_RECLEN(keylen), ++ key); ++ if (err) ++ return err; ++ } ++ ++ /* Write the index of the key used in transmission */ ++ err = hermes_write_wordrec(hw, USER_BAP, ++ HERMES_RID_CNFWEPDEFAULTKEYID, ++ priv->tx_key); ++ if (err) ++ return err; ++ } ++ break; ++ } ++ ++ return 0; ++} ++ ++int __orinoco_hw_setup_enc(struct orinoco_private *priv) ++{ ++ struct hermes *hw = &priv->hw; ++ int err = 0; ++ int master_wep_flag; ++ int auth_flag; ++ int enc_flag; ++ ++ /* Setup WEP keys */ ++ if (priv->encode_alg == ORINOCO_ALG_WEP) ++ __orinoco_hw_setup_wepkeys(priv); ++ ++ if (priv->wep_restrict) ++ auth_flag = HERMES_AUTH_SHARED_KEY; ++ else ++ auth_flag = HERMES_AUTH_OPEN; ++ ++ if (priv->wpa_enabled) ++ enc_flag = 2; ++ else if (priv->encode_alg == ORINOCO_ALG_WEP) ++ enc_flag = 1; ++ else ++ enc_flag = 0; ++ ++ switch (priv->firmware_type) { ++ case FIRMWARE_TYPE_AGERE: /* Agere style WEP */ ++ if (priv->encode_alg == ORINOCO_ALG_WEP) { ++ /* Enable the shared-key authentication. */ ++ err = hermes_write_wordrec(hw, USER_BAP, ++ HERMES_RID_CNFAUTHENTICATION_AGERE, ++ auth_flag); ++ if (err) ++ return err; ++ } ++ err = hermes_write_wordrec(hw, USER_BAP, ++ HERMES_RID_CNFWEPENABLED_AGERE, ++ enc_flag); ++ if (err) ++ return err; ++ ++ if (priv->has_wpa) { ++ /* Set WPA key management */ ++ err = hermes_write_wordrec(hw, USER_BAP, ++ HERMES_RID_CNFSETWPAAUTHMGMTSUITE_AGERE, ++ priv->key_mgmt); ++ if (err) ++ return err; ++ } ++ ++ break; ++ ++ case FIRMWARE_TYPE_INTERSIL: /* Intersil style WEP */ ++ case FIRMWARE_TYPE_SYMBOL: /* Symbol style WEP */ ++ if (priv->encode_alg == ORINOCO_ALG_WEP) { ++ if (priv->wep_restrict || ++ (priv->firmware_type == FIRMWARE_TYPE_SYMBOL)) ++ master_wep_flag = HERMES_WEP_PRIVACY_INVOKED | ++ HERMES_WEP_EXCL_UNENCRYPTED; ++ else ++ master_wep_flag = HERMES_WEP_PRIVACY_INVOKED; ++ ++ err = hermes_write_wordrec(hw, USER_BAP, ++ HERMES_RID_CNFAUTHENTICATION, ++ auth_flag); ++ if (err) ++ return err; ++ } else ++ master_wep_flag = 0; ++ ++ if (priv->iw_mode == NL80211_IFTYPE_MONITOR) ++ master_wep_flag |= HERMES_WEP_HOST_DECRYPT; ++ ++ /* Master WEP setting : on/off */ ++ err = hermes_write_wordrec(hw, USER_BAP, ++ HERMES_RID_CNFWEPFLAGS_INTERSIL, ++ master_wep_flag); ++ if (err) ++ return err; ++ ++ break; ++ } ++ ++ return 0; ++} ++ ++/* key must be 32 bytes, including the tx and rx MIC keys. ++ * rsc must be NULL or up to 8 bytes ++ * tsc must be NULL or up to 8 bytes ++ */ ++int __orinoco_hw_set_tkip_key(struct orinoco_private *priv, int key_idx, ++ int set_tx, const u8 *key, size_t key_len, ++ const u8 *rsc, size_t rsc_len, ++ const u8 *tsc, size_t tsc_len) ++{ ++ struct { ++ __le16 idx; ++ u8 rsc[ORINOCO_SEQ_LEN]; ++ struct { ++ u8 key[TKIP_KEYLEN]; ++ u8 tx_mic[MIC_KEYLEN]; ++ u8 rx_mic[MIC_KEYLEN]; ++ } tkip; ++ u8 tsc[ORINOCO_SEQ_LEN]; ++ } __packed buf; ++ struct hermes *hw = &priv->hw; ++ int ret; ++ int err; ++ int k; ++ u16 xmitting; ++ ++ key_idx &= 0x3; ++ ++ if (set_tx) ++ key_idx |= 0x8000; ++ ++ buf.idx = cpu_to_le16(key_idx); ++ if (key_len != sizeof(buf.tkip)) ++ return -EINVAL; ++ memcpy(&buf.tkip, key, sizeof(buf.tkip)); ++ ++ if (rsc_len > sizeof(buf.rsc)) ++ rsc_len = sizeof(buf.rsc); ++ ++ if (tsc_len > sizeof(buf.tsc)) ++ tsc_len = sizeof(buf.tsc); ++ ++ memset(buf.rsc, 0, sizeof(buf.rsc)); ++ memset(buf.tsc, 0, sizeof(buf.tsc)); ++ ++ if (rsc != NULL) ++ memcpy(buf.rsc, rsc, rsc_len); ++ ++ if (tsc != NULL) ++ memcpy(buf.tsc, tsc, tsc_len); ++ else ++ buf.tsc[4] = 0x10; ++ ++ /* Wait up to 100ms for tx queue to empty */ ++ for (k = 100; k > 0; k--) { ++ udelay(1000); ++ ret = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_TXQUEUEEMPTY, ++ &xmitting); ++ if (ret || !xmitting) ++ break; ++ } ++ ++ if (k == 0) ++ ret = -ETIMEDOUT; ++ ++ err = HERMES_WRITE_RECORD(hw, USER_BAP, ++ HERMES_RID_CNFADDDEFAULTTKIPKEY_AGERE, ++ &buf); ++ ++ return ret ? ret : err; ++} ++ ++int orinoco_clear_tkip_key(struct orinoco_private *priv, int key_idx) ++{ ++ struct hermes *hw = &priv->hw; ++ int err; ++ ++ err = hermes_write_wordrec(hw, USER_BAP, ++ HERMES_RID_CNFREMDEFAULTTKIPKEY_AGERE, ++ key_idx); ++ if (err) ++ printk(KERN_WARNING "%s: Error %d clearing TKIP key %d\n", ++ priv->ndev->name, err, key_idx); ++ return err; ++} ++ ++int __orinoco_hw_set_multicast_list(struct orinoco_private *priv, ++ struct net_device *dev, ++ int mc_count, int promisc) ++{ ++ struct hermes *hw = &priv->hw; ++ int err = 0; ++ ++ if (promisc != priv->promiscuous) { ++ err = hermes_write_wordrec(hw, USER_BAP, ++ HERMES_RID_CNFPROMISCUOUSMODE, ++ promisc); ++ if (err) { ++ printk(KERN_ERR "%s: Error %d setting PROMISCUOUSMODE to 1.\n", ++ priv->ndev->name, err); ++ } else ++ priv->promiscuous = promisc; ++ } ++ ++ /* If we're not in promiscuous mode, then we need to set the ++ * group address if either we want to multicast, or if we were ++ * multicasting and want to stop */ ++ if (!promisc && (mc_count || priv->mc_count)) { ++ struct netdev_hw_addr *ha; ++ struct hermes_multicast mclist; ++ int i = 0; ++ ++ netdev_for_each_mc_addr(ha, dev) { ++ if (i == mc_count) ++ break; ++ memcpy(mclist.addr[i++], ha->addr, ETH_ALEN); ++ } ++ ++ err = hw->ops->write_ltv(hw, USER_BAP, ++ HERMES_RID_CNFGROUPADDRESSES, ++ HERMES_BYTES_TO_RECLEN(mc_count * ETH_ALEN), ++ &mclist); ++ if (err) ++ printk(KERN_ERR "%s: Error %d setting multicast list.\n", ++ priv->ndev->name, err); ++ else ++ priv->mc_count = mc_count; ++ } ++ return err; ++} ++ ++/* Return : < 0 -> error code ; >= 0 -> length */ ++int orinoco_hw_get_essid(struct orinoco_private *priv, int *active, ++ char buf[IW_ESSID_MAX_SIZE + 1]) ++{ ++ struct hermes *hw = &priv->hw; ++ int err = 0; ++ struct hermes_idstring essidbuf; ++ char *p = (char *)(&essidbuf.val); ++ int len; ++ unsigned long flags; ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ return -EBUSY; ++ ++ if (strlen(priv->desired_essid) > 0) { ++ /* We read the desired SSID from the hardware rather ++ than from priv->desired_essid, just in case the ++ firmware is allowed to change it on us. I'm not ++ sure about this */ ++ /* My guess is that the OWNSSID should always be whatever ++ * we set to the card, whereas CURRENT_SSID is the one that ++ * may change... - Jean II */ ++ u16 rid; ++ ++ *active = 1; ++ ++ rid = (priv->port_type == 3) ? HERMES_RID_CNFOWNSSID : ++ HERMES_RID_CNFDESIREDSSID; ++ ++ err = hw->ops->read_ltv(hw, USER_BAP, rid, sizeof(essidbuf), ++ NULL, &essidbuf); ++ if (err) ++ goto fail_unlock; ++ } else { ++ *active = 0; ++ ++ err = hw->ops->read_ltv(hw, USER_BAP, HERMES_RID_CURRENTSSID, ++ sizeof(essidbuf), NULL, &essidbuf); ++ if (err) ++ goto fail_unlock; ++ } ++ ++ len = le16_to_cpu(essidbuf.len); ++ BUG_ON(len > IW_ESSID_MAX_SIZE); ++ ++ memset(buf, 0, IW_ESSID_MAX_SIZE); ++ memcpy(buf, p, len); ++ err = len; ++ ++ fail_unlock: ++ orinoco_unlock(priv, &flags); ++ ++ return err; ++} ++ ++int orinoco_hw_get_freq(struct orinoco_private *priv) ++{ ++ struct hermes *hw = &priv->hw; ++ int err = 0; ++ u16 channel; ++ int freq = 0; ++ unsigned long flags; ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ return -EBUSY; ++ ++ err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_CURRENTCHANNEL, ++ &channel); ++ if (err) ++ goto out; ++ ++ /* Intersil firmware 1.3.5 returns 0 when the interface is down */ ++ if (channel == 0) { ++ err = -EBUSY; ++ goto out; ++ } ++ ++ if ((channel < 1) || (channel > NUM_CHANNELS)) { ++ printk(KERN_WARNING "%s: Channel out of range (%d)!\n", ++ priv->ndev->name, channel); ++ err = -EBUSY; ++ goto out; ++ ++ } ++ freq = ieee80211_channel_to_frequency(channel, NL80211_BAND_2GHZ); ++ ++ out: ++ orinoco_unlock(priv, &flags); ++ ++ if (err > 0) ++ err = -EBUSY; ++ return err ? err : freq; ++} ++ ++int orinoco_hw_get_bitratelist(struct orinoco_private *priv, ++ int *numrates, s32 *rates, int max) ++{ ++ struct hermes *hw = &priv->hw; ++ struct hermes_idstring list; ++ unsigned char *p = (unsigned char *)&list.val; ++ int err = 0; ++ int num; ++ int i; ++ unsigned long flags; ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ return -EBUSY; ++ ++ err = hw->ops->read_ltv(hw, USER_BAP, HERMES_RID_SUPPORTEDDATARATES, ++ sizeof(list), NULL, &list); ++ orinoco_unlock(priv, &flags); ++ ++ if (err) ++ return err; ++ ++ num = le16_to_cpu(list.len); ++ *numrates = num; ++ num = min(num, max); ++ ++ for (i = 0; i < num; i++) ++ rates[i] = (p[i] & 0x7f) * 500000; /* convert to bps */ ++ ++ return 0; ++} ++ ++int orinoco_hw_trigger_scan(struct orinoco_private *priv, ++ const struct cfg80211_ssid *ssid) ++{ ++ struct net_device *dev = priv->ndev; ++ struct hermes *hw = &priv->hw; ++ unsigned long flags; ++ int err = 0; ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ return -EBUSY; ++ ++ /* Scanning with port 0 disabled would fail */ ++ if (!netif_running(dev)) { ++ err = -ENETDOWN; ++ goto out; ++ } ++ ++ /* In monitor mode, the scan results are always empty. ++ * Probe responses are passed to the driver as received ++ * frames and could be processed in software. */ ++ if (priv->iw_mode == NL80211_IFTYPE_MONITOR) { ++ err = -EOPNOTSUPP; ++ goto out; ++ } ++ ++ if (priv->has_hostscan) { ++ switch (priv->firmware_type) { ++ case FIRMWARE_TYPE_SYMBOL: ++ err = hermes_write_wordrec(hw, USER_BAP, ++ HERMES_RID_CNFHOSTSCAN_SYMBOL, ++ HERMES_HOSTSCAN_SYMBOL_ONCE | ++ HERMES_HOSTSCAN_SYMBOL_BCAST); ++ break; ++ case FIRMWARE_TYPE_INTERSIL: { ++ __le16 req[3]; ++ ++ req[0] = cpu_to_le16(0x3fff); /* All channels */ ++ req[1] = cpu_to_le16(0x0001); /* rate 1 Mbps */ ++ req[2] = 0; /* Any ESSID */ ++ err = HERMES_WRITE_RECORD(hw, USER_BAP, ++ HERMES_RID_CNFHOSTSCAN, &req); ++ break; ++ } ++ case FIRMWARE_TYPE_AGERE: ++ if (ssid->ssid_len > 0) { ++ struct hermes_idstring idbuf; ++ size_t len = ssid->ssid_len; ++ ++ idbuf.len = cpu_to_le16(len); ++ memcpy(idbuf.val, ssid->ssid, len); ++ ++ err = hw->ops->write_ltv(hw, USER_BAP, ++ HERMES_RID_CNFSCANSSID_AGERE, ++ HERMES_BYTES_TO_RECLEN(len + 2), ++ &idbuf); ++ } else ++ err = hermes_write_wordrec(hw, USER_BAP, ++ HERMES_RID_CNFSCANSSID_AGERE, ++ 0); /* Any ESSID */ ++ if (err) ++ break; ++ ++ if (priv->has_ext_scan) { ++ err = hermes_write_wordrec(hw, USER_BAP, ++ HERMES_RID_CNFSCANCHANNELS2GHZ, ++ 0x7FFF); ++ if (err) ++ goto out; ++ ++ err = hermes_inquire(hw, ++ HERMES_INQ_CHANNELINFO); ++ } else ++ err = hermes_inquire(hw, HERMES_INQ_SCAN); ++ ++ break; ++ } ++ } else ++ err = hermes_inquire(hw, HERMES_INQ_SCAN); ++ ++ out: ++ orinoco_unlock(priv, &flags); ++ ++ return err; ++} ++ ++/* Disassociate from node with BSSID addr */ ++int orinoco_hw_disassociate(struct orinoco_private *priv, ++ u8 *addr, u16 reason_code) ++{ ++ struct hermes *hw = &priv->hw; ++ int err; ++ ++ struct { ++ u8 addr[ETH_ALEN]; ++ __le16 reason_code; ++ } __packed buf; ++ ++ /* Currently only supported by WPA enabled Agere fw */ ++ if (!priv->has_wpa) ++ return -EOPNOTSUPP; ++ ++ memcpy(buf.addr, addr, ETH_ALEN); ++ buf.reason_code = cpu_to_le16(reason_code); ++ err = HERMES_WRITE_RECORD(hw, USER_BAP, ++ HERMES_RID_CNFDISASSOCIATE, ++ &buf); ++ return err; ++} ++ ++int orinoco_hw_get_current_bssid(struct orinoco_private *priv, ++ u8 *addr) ++{ ++ struct hermes *hw = &priv->hw; ++ int err; ++ ++ err = hw->ops->read_ltv(hw, USER_BAP, HERMES_RID_CURRENTBSSID, ++ ETH_ALEN, NULL, addr); ++ ++ return err; ++} +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/hw.h linux-6.15.6/drivers/net/wireless/intersil/orinoco/hw.h +--- linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/hw.h 1970-01-01 01:00:00.000000000 +0100 ++++ linux-6.15.6/drivers/net/wireless/intersil/orinoco/hw.h 2025-08-03 15:01:59.341130868 +0200 +@@ -0,0 +1,60 @@ ++/* Encapsulate basic setting changes on Hermes hardware ++ * ++ * See copyright notice in main.c ++ */ ++#ifndef _ORINOCO_HW_H_ ++#define _ORINOCO_HW_H_ ++ ++#include <linux/types.h> ++#include <linux/wireless.h> ++#include <net/cfg80211.h> ++ ++/* Hardware BAPs */ ++#define USER_BAP 0 ++#define IRQ_BAP 1 ++ ++/* WEP key sizes */ ++#define SMALL_KEY_SIZE 5 ++#define LARGE_KEY_SIZE 13 ++ ++/* Number of supported channels */ ++#define NUM_CHANNELS 14 ++ ++/* Forward declarations */ ++struct orinoco_private; ++ ++int determine_fw_capabilities(struct orinoco_private *priv, char *fw_name, ++ size_t fw_name_len, u32 *hw_ver); ++int orinoco_hw_read_card_settings(struct orinoco_private *priv, u8 *dev_addr); ++int orinoco_hw_allocate_fid(struct orinoco_private *priv); ++int orinoco_get_bitratemode(int bitrate, int automatic); ++void orinoco_get_ratemode_cfg(int ratemode, int *bitrate, int *automatic); ++ ++int orinoco_hw_program_rids(struct orinoco_private *priv); ++int orinoco_hw_get_tkip_iv(struct orinoco_private *priv, int key, u8 *tsc); ++int __orinoco_hw_set_bitrate(struct orinoco_private *priv); ++int orinoco_hw_get_act_bitrate(struct orinoco_private *priv, int *bitrate); ++int __orinoco_hw_set_wap(struct orinoco_private *priv); ++int __orinoco_hw_setup_wepkeys(struct orinoco_private *priv); ++int __orinoco_hw_setup_enc(struct orinoco_private *priv); ++int __orinoco_hw_set_tkip_key(struct orinoco_private *priv, int key_idx, ++ int set_tx, const u8 *key, size_t key_len, ++ const u8 *rsc, size_t rsc_len, ++ const u8 *tsc, size_t tsc_len); ++int orinoco_clear_tkip_key(struct orinoco_private *priv, int key_idx); ++int __orinoco_hw_set_multicast_list(struct orinoco_private *priv, ++ struct net_device *dev, ++ int mc_count, int promisc); ++int orinoco_hw_get_essid(struct orinoco_private *priv, int *active, ++ char buf[IW_ESSID_MAX_SIZE + 1]); ++int orinoco_hw_get_freq(struct orinoco_private *priv); ++int orinoco_hw_get_bitratelist(struct orinoco_private *priv, ++ int *numrates, s32 *rates, int max); ++int orinoco_hw_trigger_scan(struct orinoco_private *priv, ++ const struct cfg80211_ssid *ssid); ++int orinoco_hw_disassociate(struct orinoco_private *priv, ++ u8 *addr, u16 reason_code); ++int orinoco_hw_get_current_bssid(struct orinoco_private *priv, ++ u8 *addr); ++ ++#endif /* _ORINOCO_HW_H_ */ +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/Kconfig linux-6.15.6/drivers/net/wireless/intersil/orinoco/Kconfig +--- linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/Kconfig 1970-01-01 01:00:00.000000000 +0100 ++++ linux-6.15.6/drivers/net/wireless/intersil/orinoco/Kconfig 2025-08-03 15:01:59.341130868 +0200 +@@ -0,0 +1,143 @@ ++# SPDX-License-Identifier: GPL-2.0-only ++config HERMES ++ tristate "Hermes chipset 802.11b support (Orinoco/Prism2/Symbol)" ++ depends on (PPC_PMAC || PCI || PCMCIA) ++ depends on CFG80211 ++ select CFG80211_WEXT_EXPORT ++ select WIRELESS_EXT ++ select WEXT_SPY ++ select WEXT_PRIV ++ select FW_LOADER ++ select CRYPTO ++ select CRYPTO_MICHAEL_MIC ++ help ++ A driver for 802.11b wireless cards based on the "Hermes" or ++ Intersil HFA384x (Prism 2) MAC controller. This includes the vast ++ majority of the PCMCIA 802.11b cards (which are nearly all rebadges) ++ - except for the Cisco/Aironet cards. Cards supported include the ++ Apple Airport (not a PCMCIA card), WavelanIEEE/Orinoco, ++ Cabletron/EnteraSys Roamabout, ELSA AirLancer, MELCO Buffalo, Avaya, ++ IBM High Rate Wireless, Farralon Syyline, Samsung MagicLAN, Netgear ++ MA401, LinkSys WPC-11, D-Link DWL-650, 3Com AirConnect, Intel ++ IPW2011, and Symbol Spectrum24 High Rate amongst others. ++ ++ This option includes the guts of the driver, but in order to ++ actually use a card you will also need to enable support for PCMCIA ++ Hermes cards, PLX9052 based PCI adaptors or the Apple Airport below. ++ ++ You will also very likely also need the Wireless Tools in order to ++ configure your card and that /etc/pcmcia/wireless.opts works : ++ <https://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/Tools.html> ++ ++config HERMES_PRISM ++ bool "Support Prism 2/2.5 chipset" ++ depends on HERMES ++ help ++ ++ Say Y to enable support for Prism 2 and 2.5 chipsets. These ++ chipsets are better handled by the hostap driver. This driver ++ would not support WPA or firmware download for Prism chipset. ++ ++ If you are not sure, say N. ++ ++config HERMES_CACHE_FW_ON_INIT ++ bool "Cache Hermes firmware on driver initialisation" ++ depends on HERMES ++ default y ++ help ++ Say Y to cache any firmware required by the Hermes drivers ++ on startup. The firmware will remain cached until the ++ driver is unloaded. The cache uses 64K of RAM. ++ ++ Otherwise load the firmware from userspace as required. In ++ this case the driver should be unloaded and restarted ++ whenever the firmware is changed. ++ ++ If you are not sure, say Y. ++ ++config APPLE_AIRPORT ++ tristate "Apple Airport support (built-in)" ++ depends on PPC_PMAC && HERMES ++ help ++ Say Y here to support the Airport 802.11b wireless Ethernet hardware ++ built into the Macintosh iBook and other recent PowerPC-based ++ Macintosh machines. This is essentially a Lucent Orinoco card with ++ a non-standard interface. ++ ++ This driver does not support the Airport Extreme (802.11b/g). Use ++ the BCM43xx driver for Airport Extreme cards. ++ ++config PLX_HERMES ++ tristate "Hermes in PLX9052 based PCI adaptor support (Netgear MA301 etc.)" ++ depends on PCI && HERMES ++ help ++ Enable support for PCMCIA cards supported by the "Hermes" (aka ++ orinoco) driver when used in PLX9052 based PCI adaptors. These ++ adaptors are not a full PCMCIA controller but act as a more limited ++ PCI <-> PCMCIA bridge. Several vendors sell such adaptors so that ++ 802.11b PCMCIA cards can be used in desktop machines. The Netgear ++ MA301 is such an adaptor. ++ ++config TMD_HERMES ++ tristate "Hermes in TMD7160 based PCI adaptor support" ++ depends on PCI && HERMES ++ help ++ Enable support for PCMCIA cards supported by the "Hermes" (aka ++ orinoco) driver when used in TMD7160 based PCI adaptors. These ++ adaptors are not a full PCMCIA controller but act as a more limited ++ PCI <-> PCMCIA bridge. Several vendors sell such adaptors so that ++ 802.11b PCMCIA cards can be used in desktop machines. ++ ++config NORTEL_HERMES ++ tristate "Nortel emobility PCI adaptor support" ++ depends on PCI && HERMES ++ help ++ Enable support for PCMCIA cards supported by the "Hermes" (aka ++ orinoco) driver when used in Nortel emobility PCI adaptors. These ++ adaptors are not full PCMCIA controllers, but act as a more limited ++ PCI <-> PCMCIA bridge. ++ ++config PCI_HERMES ++ tristate "Prism 2.5 PCI 802.11b adaptor support" ++ depends on PCI && HERMES && HERMES_PRISM ++ help ++ Enable support for PCI and mini-PCI 802.11b wireless NICs based on ++ the Prism 2.5 chipset. These are true PCI cards, not the 802.11b ++ PCMCIA cards bundled with PCI<->PCMCIA adaptors which are also ++ common. Some of the built-in wireless adaptors in laptops are of ++ this variety. ++ ++config PCMCIA_HERMES ++ tristate "Hermes PCMCIA card support" ++ depends on PCMCIA && HERMES && HAS_IOPORT_MAP ++ help ++ A driver for "Hermes" chipset based PCMCIA wireless adaptors, such ++ as the Lucent WavelanIEEE/Orinoco cards and their OEM (Cabletron/ ++ EnteraSys RoamAbout 802.11, ELSA Airlancer, Melco Buffalo and ++ others). It should also be usable on various Prism II based cards ++ such as the Linksys, D-Link and Farallon Skyline. It should also ++ work on Symbol cards such as the 3Com AirConnect and Ericsson WLAN. ++ ++ You will very likely need the Wireless Tools in order to ++ configure your card and that /etc/pcmcia/wireless.opts works: ++ <https://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/Tools.html>. ++ ++config PCMCIA_SPECTRUM ++ tristate "Symbol Spectrum24 Trilogy PCMCIA card support" ++ depends on PCMCIA && HERMES && HAS_IOPORT_MAP ++ help ++ ++ This is a driver for 802.11b cards using RAM-loadable Symbol ++ firmware, such as Symbol Wireless Networker LA4100, CompactFlash ++ cards by Socket Communications and Intel PRO/Wireless 2011B. ++ ++ This driver requires firmware download on startup. Utilities ++ for downloading Symbol firmware are available at ++ <http://sourceforge.net/projects/orinoco/> ++ ++config ORINOCO_USB ++ tristate "Agere Orinoco USB support" ++ depends on USB && HERMES ++ select FW_LOADER ++ help ++ This driver is for USB versions of the Agere Orinoco card. +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/main.c linux-6.15.6/drivers/net/wireless/intersil/orinoco/main.c +--- linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/main.c 1970-01-01 01:00:00.000000000 +0100 ++++ linux-6.15.6/drivers/net/wireless/intersil/orinoco/main.c 2025-08-03 16:31:03.372980267 +0200 +@@ -0,0 +1,2414 @@ ++/* main.c - (formerly known as dldwd_cs.c, orinoco_cs.c and orinoco.c) ++ * ++ * A driver for Hermes or Prism 2 chipset based PCMCIA wireless ++ * adaptors, with Lucent/Agere, Intersil or Symbol firmware. ++ * ++ * Current maintainers (as of 29 September 2003) are: ++ * Pavel Roskin <proski AT gnu.org> ++ * and David Gibson <hermes AT gibson.dropbear.id.au> ++ * ++ * (C) Copyright David Gibson, IBM Corporation 2001-2003. ++ * Copyright (C) 2000 David Gibson, Linuxcare Australia. ++ * With some help from : ++ * Copyright (C) 2001 Jean Tourrilhes, HP Labs ++ * Copyright (C) 2001 Benjamin Herrenschmidt ++ * ++ * Based on dummy_cs.c 1.27 2000/06/12 21:27:25 ++ * ++ * Portions based on wvlan_cs.c 1.0.6, Copyright Andreas Neuhaus <andy ++ * AT fasta.fh-dortmund.de> ++ * http://www.stud.fh-dortmund.de/~andy/wvlan/ ++ * ++ * The contents of this file are subject to the Mozilla Public License ++ * Version 1.1 (the "License"); you may not use this file except in ++ * compliance with the License. You may obtain a copy of the License ++ * at http://www.mozilla.org/MPL/ ++ * ++ * Software distributed under the License is distributed on an "AS IS" ++ * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See ++ * the License for the specific language governing rights and ++ * limitations under the License. ++ * ++ * The initial developer of the original code is David A. Hinds ++ * <dahinds AT users.sourceforge.net>. Portions created by David ++ * A. Hinds are Copyright (C) 1999 David A. Hinds. All Rights ++ * Reserved. ++ * ++ * Alternatively, the contents of this file may be used under the ++ * terms of the GNU General Public License version 2 (the "GPL"), in ++ * which case the provisions of the GPL are applicable instead of the ++ * above. If you wish to allow the use of your version of this file ++ * only under the terms of the GPL and not to allow others to use your ++ * version of this file under the MPL, indicate your decision by ++ * deleting the provisions above and replace them with the notice and ++ * other provisions required by the GPL. If you do not delete the ++ * provisions above, a recipient may use your version of this file ++ * under either the MPL or the GPL. */ ++ ++/* ++ * TODO ++ * o Handle de-encapsulation within network layer, provide 802.11 ++ * headers (patch from Thomas 'Dent' Mirlacher) ++ * o Fix possible races in SPY handling. ++ * o Disconnect wireless extensions from fundamental configuration. ++ * o (maybe) Software WEP support (patch from Stano Meduna). ++ * o (maybe) Use multiple Tx buffers - driver handling queue ++ * rather than firmware. ++ */ ++ ++/* Locking and synchronization: ++ * ++ * The basic principle is that everything is serialized through a ++ * single spinlock, priv->lock. The lock is used in user, bh and irq ++ * context, so when taken outside hardirq context it should always be ++ * taken with interrupts disabled. The lock protects both the ++ * hardware and the struct orinoco_private. ++ * ++ * Another flag, priv->hw_unavailable indicates that the hardware is ++ * unavailable for an extended period of time (e.g. suspended, or in ++ * the middle of a hard reset). This flag is protected by the ++ * spinlock. All code which touches the hardware should check the ++ * flag after taking the lock, and if it is set, give up on whatever ++ * they are doing and drop the lock again. The orinoco_lock() ++ * function handles this (it unlocks and returns -EBUSY if ++ * hw_unavailable is non-zero). ++ */ ++ ++#define DRIVER_NAME "orinoco" ++ ++#include <linux/module.h> ++#include <linux/kernel.h> ++#include <linux/slab.h> ++#include <linux/init.h> ++#include <linux/delay.h> ++#include <linux/device.h> ++#include <linux/netdevice.h> ++#include <linux/etherdevice.h> ++#include <linux/suspend.h> ++#include <linux/if_arp.h> ++#include <linux/wireless.h> ++#include <linux/ieee80211.h> ++#include <net/iw_handler.h> ++#include <net/cfg80211.h> ++ ++#include "hermes_rid.h" ++#include "hermes_dld.h" ++#include "hw.h" ++#include "scan.h" ++#include "mic.h" ++#include "fw.h" ++#include "wext.h" ++#include "cfg.h" ++#include "main.h" ++ ++#include "orinoco.h" ++ ++/********************************************************************/ ++/* Module information */ ++/********************************************************************/ ++ ++MODULE_AUTHOR("Pavel Roskin <proski@gnu.org> & " ++ "David Gibson <hermes@gibson.dropbear.id.au>"); ++MODULE_DESCRIPTION("Driver for Lucent Orinoco, Prism II based " ++ "and similar wireless cards"); ++MODULE_LICENSE("Dual MPL/GPL"); ++ ++/* Level of debugging. Used in the macros in orinoco.h */ ++#ifdef ORINOCO_DEBUG ++int orinoco_debug = ORINOCO_DEBUG; ++EXPORT_SYMBOL(orinoco_debug); ++module_param(orinoco_debug, int, 0644); ++MODULE_PARM_DESC(orinoco_debug, "Debug level"); ++#endif ++ ++static bool suppress_linkstatus; /* = 0 */ ++module_param(suppress_linkstatus, bool, 0644); ++MODULE_PARM_DESC(suppress_linkstatus, "Don't log link status changes"); ++ ++static int ignore_disconnect; /* = 0 */ ++module_param(ignore_disconnect, int, 0644); ++MODULE_PARM_DESC(ignore_disconnect, ++ "Don't report lost link to the network layer"); ++ ++int force_monitor; /* = 0 */ ++module_param(force_monitor, int, 0644); ++MODULE_PARM_DESC(force_monitor, "Allow monitor mode for all firmware versions"); ++ ++/********************************************************************/ ++/* Internal constants */ ++/********************************************************************/ ++ ++/* 802.2 LLC/SNAP header used for Ethernet encapsulation over 802.11 */ ++static const u8 encaps_hdr[] = {0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00}; ++#define ENCAPS_OVERHEAD (sizeof(encaps_hdr) + 2) ++ ++#define ORINOCO_MIN_MTU 256 ++#define ORINOCO_MAX_MTU (IEEE80211_MAX_DATA_LEN - ENCAPS_OVERHEAD) ++ ++#define MAX_IRQLOOPS_PER_IRQ 10 ++#define MAX_IRQLOOPS_PER_JIFFY (20000 / HZ) /* Based on a guestimate of ++ * how many events the ++ * device could ++ * legitimately generate */ ++ ++#define DUMMY_FID 0xFFFF ++ ++/*#define MAX_MULTICAST(priv) (priv->firmware_type == FIRMWARE_TYPE_AGERE ? \ ++ HERMES_MAX_MULTICAST : 0)*/ ++#define MAX_MULTICAST(priv) (HERMES_MAX_MULTICAST) ++ ++#define ORINOCO_INTEN (HERMES_EV_RX | HERMES_EV_ALLOC \ ++ | HERMES_EV_TX | HERMES_EV_TXEXC \ ++ | HERMES_EV_WTERR | HERMES_EV_INFO \ ++ | HERMES_EV_INFDROP) ++ ++/********************************************************************/ ++/* Data types */ ++/********************************************************************/ ++ ++/* Beginning of the Tx descriptor, used in TxExc handling */ ++struct hermes_txexc_data { ++ struct hermes_tx_descriptor desc; ++ __le16 frame_ctl; ++ __le16 duration_id; ++ u8 addr1[ETH_ALEN]; ++} __packed; ++ ++/* Rx frame header except compatibility 802.3 header */ ++struct hermes_rx_descriptor { ++ /* Control */ ++ __le16 status; ++ __le32 time; ++ u8 silence; ++ u8 signal; ++ u8 rate; ++ u8 rxflow; ++ __le32 reserved; ++ ++ /* 802.11 header */ ++ __le16 frame_ctl; ++ __le16 duration_id; ++ u8 addr1[ETH_ALEN]; ++ u8 addr2[ETH_ALEN]; ++ u8 addr3[ETH_ALEN]; ++ __le16 seq_ctl; ++ u8 addr4[ETH_ALEN]; ++ ++ /* Data length */ ++ __le16 data_len; ++} __packed; ++ ++struct orinoco_rx_data { ++ struct hermes_rx_descriptor *desc; ++ struct sk_buff *skb; ++ struct list_head list; ++}; ++ ++struct orinoco_scan_data { ++ void *buf; ++ size_t len; ++ int type; ++ struct list_head list; ++}; ++ ++/********************************************************************/ ++/* Function prototypes */ ++/********************************************************************/ ++ ++static int __orinoco_set_multicast_list(struct net_device *dev); ++static int __orinoco_up(struct orinoco_private *priv); ++static int __orinoco_down(struct orinoco_private *priv); ++static int __orinoco_commit(struct orinoco_private *priv); ++ ++/********************************************************************/ ++/* Internal helper functions */ ++/********************************************************************/ ++ ++void set_port_type(struct orinoco_private *priv) ++{ ++ switch (priv->iw_mode) { ++ case NL80211_IFTYPE_STATION: ++ priv->port_type = 1; ++ priv->createibss = 0; ++ break; ++ case NL80211_IFTYPE_ADHOC: ++ if (priv->prefer_port3) { ++ priv->port_type = 3; ++ priv->createibss = 0; ++ } else { ++ priv->port_type = priv->ibss_port; ++ priv->createibss = 1; ++ } ++ break; ++ case NL80211_IFTYPE_MONITOR: ++ priv->port_type = 3; ++ priv->createibss = 0; ++ break; ++ default: ++ printk(KERN_ERR "%s: Invalid priv->iw_mode in set_port_type()\n", ++ priv->ndev->name); ++ } ++} ++ ++/********************************************************************/ ++/* Device methods */ ++/********************************************************************/ ++ ++int orinoco_open(struct net_device *dev) ++{ ++ struct orinoco_private *priv = ndev_priv(dev); ++ unsigned long flags; ++ int err; ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ return -EBUSY; ++ ++ err = __orinoco_up(priv); ++ ++ if (!err) ++ priv->open = 1; ++ ++ orinoco_unlock(priv, &flags); ++ ++ return err; ++} ++EXPORT_SYMBOL(orinoco_open); ++ ++int orinoco_stop(struct net_device *dev) ++{ ++ struct orinoco_private *priv = ndev_priv(dev); ++ int err = 0; ++ ++ /* We mustn't use orinoco_lock() here, because we need to be ++ able to close the interface even if hw_unavailable is set ++ (e.g. as we're released after a PC Card removal) */ ++ orinoco_lock_irq(priv); ++ ++ priv->open = 0; ++ ++ err = __orinoco_down(priv); ++ ++ orinoco_unlock_irq(priv); ++ ++ return err; ++} ++EXPORT_SYMBOL(orinoco_stop); ++ ++void orinoco_set_multicast_list(struct net_device *dev) ++{ ++ struct orinoco_private *priv = ndev_priv(dev); ++ unsigned long flags; ++ ++ if (orinoco_lock(priv, &flags) != 0) { ++ printk(KERN_DEBUG "%s: orinoco_set_multicast_list() " ++ "called when hw_unavailable\n", dev->name); ++ return; ++ } ++ ++ __orinoco_set_multicast_list(dev); ++ orinoco_unlock(priv, &flags); ++} ++EXPORT_SYMBOL(orinoco_set_multicast_list); ++ ++int orinoco_change_mtu(struct net_device *dev, int new_mtu) ++{ ++ struct orinoco_private *priv = ndev_priv(dev); ++ ++ /* MTU + encapsulation + header length */ ++ if ((new_mtu + ENCAPS_OVERHEAD + sizeof(struct ieee80211_hdr)) > ++ (priv->nicbuf_size - ETH_HLEN)) ++ return -EINVAL; ++ ++ dev->mtu = new_mtu; ++ ++ return 0; ++} ++EXPORT_SYMBOL(orinoco_change_mtu); ++ ++/********************************************************************/ ++/* Tx path */ ++/********************************************************************/ ++ ++/* Add encapsulation and MIC to the existing SKB. ++ * The main xmit routine will then send the whole lot to the card. ++ * Need 8 bytes headroom ++ * Need 8 bytes tailroom ++ * ++ * With encapsulated ethernet II frame ++ * -------- ++ * 803.3 header (14 bytes) ++ * dst[6] ++ * -------- src[6] ++ * 803.3 header (14 bytes) len[2] ++ * dst[6] 803.2 header (8 bytes) ++ * src[6] encaps[6] ++ * len[2] <- leave alone -> len[2] ++ * -------- -------- <-- 0 ++ * Payload Payload ++ * ... ... ++ * ++ * -------- -------- ++ * MIC (8 bytes) ++ * -------- ++ * ++ * returns 0 on success, -ENOMEM on error. ++ */ ++int orinoco_process_xmit_skb(struct sk_buff *skb, ++ struct net_device *dev, ++ struct orinoco_private *priv, ++ int *tx_control, ++ u8 *mic_buf) ++{ ++ struct orinoco_tkip_key *key; ++ struct ethhdr *eh; ++ int do_mic; ++ ++ key = (struct orinoco_tkip_key *) priv->keys[priv->tx_key].key; ++ ++ do_mic = ((priv->encode_alg == ORINOCO_ALG_TKIP) && ++ (key != NULL)); ++ ++ if (do_mic) ++ *tx_control |= (priv->tx_key << HERMES_MIC_KEY_ID_SHIFT) | ++ HERMES_TXCTRL_MIC; ++ ++ eh = (struct ethhdr *)skb->data; ++ ++ /* Encapsulate Ethernet-II frames */ ++ if (ntohs(eh->h_proto) > ETH_DATA_LEN) { /* Ethernet-II frame */ ++ struct header_struct { ++ struct ethhdr eth; /* 802.3 header */ ++ u8 encap[6]; /* 802.2 header */ ++ } __packed hdr; ++ int len = skb->len + sizeof(encaps_hdr) - (2 * ETH_ALEN); ++ ++ if (skb_headroom(skb) < ENCAPS_OVERHEAD) { ++ if (net_ratelimit()) ++ printk(KERN_ERR ++ "%s: Not enough headroom for 802.2 headers %d\n", ++ dev->name, skb_headroom(skb)); ++ return -ENOMEM; ++ } ++ ++ /* Fill in new header */ ++ memcpy(&hdr.eth, eh, 2 * ETH_ALEN); ++ hdr.eth.h_proto = htons(len); ++ memcpy(hdr.encap, encaps_hdr, sizeof(encaps_hdr)); ++ ++ /* Make room for the new header, and copy it in */ ++ eh = skb_push(skb, ENCAPS_OVERHEAD); ++ memcpy(eh, &hdr, sizeof(hdr)); ++ } ++ ++ /* Calculate Michael MIC */ ++ if (do_mic) { ++ size_t len = skb->len - ETH_HLEN; ++ u8 *mic = &mic_buf[0]; ++ ++ /* Have to write to an even address, so copy the spare ++ * byte across */ ++ if (skb->len % 2) { ++ *mic = skb->data[skb->len - 1]; ++ mic++; ++ } ++ ++ orinoco_mic(priv->tx_tfm_mic, key->tx_mic, ++ eh->h_dest, eh->h_source, 0 /* priority */, ++ skb->data + ETH_HLEN, ++ len, mic); ++ } ++ ++ return 0; ++} ++EXPORT_SYMBOL(orinoco_process_xmit_skb); ++ ++static netdev_tx_t orinoco_xmit(struct sk_buff *skb, struct net_device *dev) ++{ ++ struct orinoco_private *priv = ndev_priv(dev); ++ struct net_device_stats *stats = &dev->stats; ++ struct hermes *hw = &priv->hw; ++ int err = 0; ++ u16 txfid = priv->txfid; ++ int tx_control; ++ unsigned long flags; ++ u8 mic_buf[MICHAEL_MIC_LEN + 1]; ++ ++ if (!netif_running(dev)) { ++ printk(KERN_ERR "%s: Tx on stopped device!\n", ++ dev->name); ++ return NETDEV_TX_BUSY; ++ } ++ ++ if (netif_queue_stopped(dev)) { ++ printk(KERN_DEBUG "%s: Tx while transmitter busy!\n", ++ dev->name); ++ return NETDEV_TX_BUSY; ++ } ++ ++ if (orinoco_lock(priv, &flags) != 0) { ++ printk(KERN_ERR "%s: orinoco_xmit() called while hw_unavailable\n", ++ dev->name); ++ return NETDEV_TX_BUSY; ++ } ++ ++ if (!netif_carrier_ok(dev) || ++ (priv->iw_mode == NL80211_IFTYPE_MONITOR)) { ++ /* Oops, the firmware hasn't established a connection, ++ silently drop the packet (this seems to be the ++ safest approach). */ ++ goto drop; ++ } ++ ++ /* Check packet length */ ++ if (skb->len < ETH_HLEN) ++ goto drop; ++ ++ tx_control = HERMES_TXCTRL_TX_OK | HERMES_TXCTRL_TX_EX; ++ ++ err = orinoco_process_xmit_skb(skb, dev, priv, &tx_control, ++ &mic_buf[0]); ++ if (err) ++ goto drop; ++ ++ if (priv->has_alt_txcntl) { ++ /* WPA enabled firmwares have tx_cntl at the end of ++ * the 802.11 header. So write zeroed descriptor and ++ * 802.11 header at the same time ++ */ ++ char desc[HERMES_802_3_OFFSET]; ++ __le16 *txcntl = (__le16 *) &desc[HERMES_TXCNTL2_OFFSET]; ++ ++ memset(&desc, 0, sizeof(desc)); ++ ++ *txcntl = cpu_to_le16(tx_control); ++ err = hw->ops->bap_pwrite(hw, USER_BAP, &desc, sizeof(desc), ++ txfid, 0); ++ if (err) { ++ if (net_ratelimit()) ++ printk(KERN_ERR "%s: Error %d writing Tx " ++ "descriptor to BAP\n", dev->name, err); ++ goto busy; ++ } ++ } else { ++ struct hermes_tx_descriptor desc; ++ ++ memset(&desc, 0, sizeof(desc)); ++ ++ desc.tx_control = cpu_to_le16(tx_control); ++ err = hw->ops->bap_pwrite(hw, USER_BAP, &desc, sizeof(desc), ++ txfid, 0); ++ if (err) { ++ if (net_ratelimit()) ++ printk(KERN_ERR "%s: Error %d writing Tx " ++ "descriptor to BAP\n", dev->name, err); ++ goto busy; ++ } ++ ++ /* Clear the 802.11 header and data length fields - some ++ * firmwares (e.g. Lucent/Agere 8.xx) appear to get confused ++ * if this isn't done. */ ++ hermes_clear_words(hw, HERMES_DATA0, ++ HERMES_802_3_OFFSET - HERMES_802_11_OFFSET); ++ } ++ ++ err = hw->ops->bap_pwrite(hw, USER_BAP, skb->data, skb->len, ++ txfid, HERMES_802_3_OFFSET); ++ if (err) { ++ printk(KERN_ERR "%s: Error %d writing packet to BAP\n", ++ dev->name, err); ++ goto busy; ++ } ++ ++ if (tx_control & HERMES_TXCTRL_MIC) { ++ size_t offset = HERMES_802_3_OFFSET + skb->len; ++ size_t len = MICHAEL_MIC_LEN; ++ ++ if (offset % 2) { ++ offset--; ++ len++; ++ } ++ err = hw->ops->bap_pwrite(hw, USER_BAP, &mic_buf[0], len, ++ txfid, offset); ++ if (err) { ++ printk(KERN_ERR "%s: Error %d writing MIC to BAP\n", ++ dev->name, err); ++ goto busy; ++ } ++ } ++ ++ /* Finally, we actually initiate the send */ ++ netif_stop_queue(dev); ++ ++ err = hw->ops->cmd_wait(hw, HERMES_CMD_TX | HERMES_CMD_RECL, ++ txfid, NULL); ++ if (err) { ++ netif_start_queue(dev); ++ if (net_ratelimit()) ++ printk(KERN_ERR "%s: Error %d transmitting packet\n", ++ dev->name, err); ++ goto busy; ++ } ++ ++ stats->tx_bytes += HERMES_802_3_OFFSET + skb->len; ++ goto ok; ++ ++ drop: ++ stats->tx_errors++; ++ stats->tx_dropped++; ++ ++ ok: ++ orinoco_unlock(priv, &flags); ++ dev_kfree_skb(skb); ++ return NETDEV_TX_OK; ++ ++ busy: ++ if (err == -EIO) ++ schedule_work(&priv->reset_work); ++ orinoco_unlock(priv, &flags); ++ return NETDEV_TX_BUSY; ++} ++ ++static void __orinoco_ev_alloc(struct net_device *dev, struct hermes *hw) ++{ ++ struct orinoco_private *priv = ndev_priv(dev); ++ u16 fid = hermes_read_regn(hw, ALLOCFID); ++ ++ if (fid != priv->txfid) { ++ if (fid != DUMMY_FID) ++ printk(KERN_WARNING "%s: Allocate event on unexpected fid (%04X)\n", ++ dev->name, fid); ++ return; ++ } ++ ++ hermes_write_regn(hw, ALLOCFID, DUMMY_FID); ++} ++ ++static void __orinoco_ev_tx(struct net_device *dev, struct hermes *hw) ++{ ++ dev->stats.tx_packets++; ++ ++ netif_wake_queue(dev); ++ ++ hermes_write_regn(hw, TXCOMPLFID, DUMMY_FID); ++} ++ ++static void __orinoco_ev_txexc(struct net_device *dev, struct hermes *hw) ++{ ++ struct net_device_stats *stats = &dev->stats; ++ u16 fid = hermes_read_regn(hw, TXCOMPLFID); ++ u16 status; ++ struct hermes_txexc_data hdr; ++ int err = 0; ++ ++ if (fid == DUMMY_FID) ++ return; /* Nothing's really happened */ ++ ++ /* Read part of the frame header - we need status and addr1 */ ++ err = hw->ops->bap_pread(hw, IRQ_BAP, &hdr, ++ sizeof(struct hermes_txexc_data), ++ fid, 0); ++ ++ hermes_write_regn(hw, TXCOMPLFID, DUMMY_FID); ++ stats->tx_errors++; ++ ++ if (err) { ++ printk(KERN_WARNING "%s: Unable to read descriptor on Tx error " ++ "(FID=%04X error %d)\n", ++ dev->name, fid, err); ++ return; ++ } ++ ++ DEBUG(1, "%s: Tx error, err %d (FID=%04X)\n", dev->name, ++ err, fid); ++ ++ /* We produce a TXDROP event only for retry or lifetime ++ * exceeded, because that's the only status that really mean ++ * that this particular node went away. ++ * Other errors means that *we* screwed up. - Jean II */ ++ status = le16_to_cpu(hdr.desc.status); ++ if (status & (HERMES_TXSTAT_RETRYERR | HERMES_TXSTAT_AGEDERR)) { ++ union iwreq_data wrqu; ++ ++ /* Copy 802.11 dest address. ++ * We use the 802.11 header because the frame may ++ * not be 802.3 or may be mangled... ++ * In Ad-Hoc mode, it will be the node address. ++ * In managed mode, it will be most likely the AP addr ++ * User space will figure out how to convert it to ++ * whatever it needs (IP address or else). ++ * - Jean II */ ++ memcpy(wrqu.addr.sa_data, hdr.addr1, ETH_ALEN); ++ wrqu.addr.sa_family = ARPHRD_ETHER; ++ ++ /* Send event to user space */ ++ wireless_send_event(dev, IWEVTXDROP, &wrqu, NULL); ++ } ++ ++ netif_wake_queue(dev); ++} ++ ++void orinoco_tx_timeout(struct net_device *dev, unsigned int txqueue) ++{ ++ struct orinoco_private *priv = ndev_priv(dev); ++ struct net_device_stats *stats = &dev->stats; ++ struct hermes *hw = &priv->hw; ++ ++ printk(KERN_WARNING "%s: Tx timeout! " ++ "ALLOCFID=%04x, TXCOMPLFID=%04x, EVSTAT=%04x\n", ++ dev->name, hermes_read_regn(hw, ALLOCFID), ++ hermes_read_regn(hw, TXCOMPLFID), hermes_read_regn(hw, EVSTAT)); ++ ++ stats->tx_errors++; ++ ++ schedule_work(&priv->reset_work); ++} ++EXPORT_SYMBOL(orinoco_tx_timeout); ++ ++/********************************************************************/ ++/* Rx path (data frames) */ ++/********************************************************************/ ++ ++/* Does the frame have a SNAP header indicating it should be ++ * de-encapsulated to Ethernet-II? */ ++static inline int is_ethersnap(void *_hdr) ++{ ++ u8 *hdr = _hdr; ++ ++ /* We de-encapsulate all packets which, a) have SNAP headers ++ * (i.e. SSAP=DSAP=0xaa and CTRL=0x3 in the 802.2 LLC header ++ * and where b) the OUI of the SNAP header is 00:00:00 or ++ * 00:00:f8 - we need both because different APs appear to use ++ * different OUIs for some reason */ ++ return (memcmp(hdr, &encaps_hdr, 5) == 0) ++ && ((hdr[5] == 0x00) || (hdr[5] == 0xf8)); ++} ++ ++static inline void orinoco_spy_gather(struct net_device *dev, u_char *mac, ++ int level, int noise) ++{ ++ struct iw_quality wstats; ++ wstats.level = level - 0x95; ++ wstats.noise = noise - 0x95; ++ wstats.qual = (level > noise) ? (level - noise) : 0; ++ wstats.updated = IW_QUAL_ALL_UPDATED | IW_QUAL_DBM; ++ /* Update spy records */ ++ //wireless_spy_update(dev, mac, &wstats); ++} ++ ++static void orinoco_stat_gather(struct net_device *dev, ++ struct sk_buff *skb, ++ struct hermes_rx_descriptor *desc) ++{ ++ struct orinoco_private *priv = ndev_priv(dev); ++ ++ /* Using spy support with lots of Rx packets, like in an ++ * infrastructure (AP), will really slow down everything, because ++ * the MAC address must be compared to each entry of the spy list. ++ * If the user really asks for it (set some address in the ++ * spy list), we do it, but he will pay the price. ++ * Note that to get here, you need both WIRELESS_SPY ++ * compiled in AND some addresses in the list !!! ++ */ ++ /* Note : gcc will optimise the whole section away if ++ * WIRELESS_SPY is not defined... - Jean II */ ++ if (SPY_NUMBER(priv)) { ++ orinoco_spy_gather(dev, skb_mac_header(skb) + ETH_ALEN, ++ desc->signal, desc->silence); ++ } ++} ++ ++/* ++ * orinoco_rx_monitor - handle received monitor frames. ++ * ++ * Arguments: ++ * dev network device ++ * rxfid received FID ++ * desc rx descriptor of the frame ++ * ++ * Call context: interrupt ++ */ ++static void orinoco_rx_monitor(struct net_device *dev, u16 rxfid, ++ struct hermes_rx_descriptor *desc) ++{ ++ u32 hdrlen = 30; /* return full header by default */ ++ u32 datalen = 0; ++ u16 fc; ++ int err; ++ int len; ++ struct sk_buff *skb; ++ struct orinoco_private *priv = ndev_priv(dev); ++ struct net_device_stats *stats = &dev->stats; ++ struct hermes *hw = &priv->hw; ++ ++ len = le16_to_cpu(desc->data_len); ++ ++ /* Determine the size of the header and the data */ ++ fc = le16_to_cpu(desc->frame_ctl); ++ switch (fc & IEEE80211_FCTL_FTYPE) { ++ case IEEE80211_FTYPE_DATA: ++ if ((fc & IEEE80211_FCTL_TODS) ++ && (fc & IEEE80211_FCTL_FROMDS)) ++ hdrlen = 30; ++ else ++ hdrlen = 24; ++ datalen = len; ++ break; ++ case IEEE80211_FTYPE_MGMT: ++ hdrlen = 24; ++ datalen = len; ++ break; ++ case IEEE80211_FTYPE_CTL: ++ switch (fc & IEEE80211_FCTL_STYPE) { ++ case IEEE80211_STYPE_PSPOLL: ++ case IEEE80211_STYPE_RTS: ++ case IEEE80211_STYPE_CFEND: ++ case IEEE80211_STYPE_CFENDACK: ++ hdrlen = 16; ++ break; ++ case IEEE80211_STYPE_CTS: ++ case IEEE80211_STYPE_ACK: ++ hdrlen = 10; ++ break; ++ } ++ break; ++ default: ++ /* Unknown frame type */ ++ break; ++ } ++ ++ /* sanity check the length */ ++ if (datalen > IEEE80211_MAX_DATA_LEN + 12) { ++ printk(KERN_DEBUG "%s: oversized monitor frame, " ++ "data length = %d\n", dev->name, datalen); ++ stats->rx_length_errors++; ++ goto update_stats; ++ } ++ ++ skb = dev_alloc_skb(hdrlen + datalen); ++ if (!skb) { ++ printk(KERN_WARNING "%s: Cannot allocate skb for monitor frame\n", ++ dev->name); ++ goto update_stats; ++ } ++ ++ /* Copy the 802.11 header to the skb */ ++ skb_put_data(skb, &(desc->frame_ctl), hdrlen); ++ skb_reset_mac_header(skb); ++ ++ /* If any, copy the data from the card to the skb */ ++ if (datalen > 0) { ++ err = hw->ops->bap_pread(hw, IRQ_BAP, skb_put(skb, datalen), ++ ALIGN(datalen, 2), rxfid, ++ HERMES_802_2_OFFSET); ++ if (err) { ++ printk(KERN_ERR "%s: error %d reading monitor frame\n", ++ dev->name, err); ++ goto drop; ++ } ++ } ++ ++ skb->dev = dev; ++ skb->ip_summed = CHECKSUM_NONE; ++ skb->pkt_type = PACKET_OTHERHOST; ++ skb->protocol = cpu_to_be16(ETH_P_802_2); ++ ++ stats->rx_packets++; ++ stats->rx_bytes += skb->len; ++ ++ netif_rx(skb); ++ return; ++ ++ drop: ++ dev_kfree_skb_irq(skb); ++ update_stats: ++ stats->rx_errors++; ++ stats->rx_dropped++; ++} ++ ++void __orinoco_ev_rx(struct net_device *dev, struct hermes *hw) ++{ ++ struct orinoco_private *priv = ndev_priv(dev); ++ struct net_device_stats *stats = &dev->stats; ++ struct iw_statistics *wstats = &priv->wstats; ++ struct sk_buff *skb = NULL; ++ u16 rxfid, status; ++ int length; ++ struct hermes_rx_descriptor *desc; ++ struct orinoco_rx_data *rx_data; ++ int err; ++ ++ desc = kmalloc(sizeof(*desc), GFP_ATOMIC); ++ if (!desc) ++ goto update_stats; ++ ++ rxfid = hermes_read_regn(hw, RXFID); ++ ++ err = hw->ops->bap_pread(hw, IRQ_BAP, desc, sizeof(*desc), ++ rxfid, 0); ++ if (err) { ++ printk(KERN_ERR "%s: error %d reading Rx descriptor. " ++ "Frame dropped.\n", dev->name, err); ++ goto update_stats; ++ } ++ ++ status = le16_to_cpu(desc->status); ++ ++ if (status & HERMES_RXSTAT_BADCRC) { ++ DEBUG(1, "%s: Bad CRC on Rx. Frame dropped.\n", ++ dev->name); ++ stats->rx_crc_errors++; ++ goto update_stats; ++ } ++ ++ /* Handle frames in monitor mode */ ++ if (priv->iw_mode == NL80211_IFTYPE_MONITOR) { ++ orinoco_rx_monitor(dev, rxfid, desc); ++ goto out; ++ } ++ ++ if (status & HERMES_RXSTAT_UNDECRYPTABLE) { ++ DEBUG(1, "%s: Undecryptable frame on Rx. Frame dropped.\n", ++ dev->name); ++ wstats->discard.code++; ++ goto update_stats; ++ } ++ ++ length = le16_to_cpu(desc->data_len); ++ ++ /* Sanity checks */ ++ if (length < 3) { /* No for even an 802.2 LLC header */ ++ /* At least on Symbol firmware with PCF we get quite a ++ lot of these legitimately - Poll frames with no ++ data. */ ++ goto out; ++ } ++ if (length > IEEE80211_MAX_DATA_LEN) { ++ printk(KERN_WARNING "%s: Oversized frame received (%d bytes)\n", ++ dev->name, length); ++ stats->rx_length_errors++; ++ goto update_stats; ++ } ++ ++ /* Payload size does not include Michael MIC. Increase payload ++ * size to read it together with the data. */ ++ if (status & HERMES_RXSTAT_MIC) ++ length += MICHAEL_MIC_LEN; ++ ++ /* We need space for the packet data itself, plus an ethernet ++ header, plus 2 bytes so we can align the IP header on a ++ 32bit boundary, plus 1 byte so we can read in odd length ++ packets from the card, which has an IO granularity of 16 ++ bits */ ++ skb = dev_alloc_skb(length + ETH_HLEN + 2 + 1); ++ if (!skb) { ++ printk(KERN_WARNING "%s: Can't allocate skb for Rx\n", ++ dev->name); ++ goto update_stats; ++ } ++ ++ /* We'll prepend the header, so reserve space for it. The worst ++ case is no decapsulation, when 802.3 header is prepended and ++ nothing is removed. 2 is for aligning the IP header. */ ++ skb_reserve(skb, ETH_HLEN + 2); ++ ++ err = hw->ops->bap_pread(hw, IRQ_BAP, skb_put(skb, length), ++ ALIGN(length, 2), rxfid, ++ HERMES_802_2_OFFSET); ++ if (err) { ++ printk(KERN_ERR "%s: error %d reading frame. " ++ "Frame dropped.\n", dev->name, err); ++ goto drop; ++ } ++ ++ /* Add desc and skb to rx queue */ ++ rx_data = kzalloc(sizeof(*rx_data), GFP_ATOMIC); ++ if (!rx_data) ++ goto drop; ++ ++ rx_data->desc = desc; ++ rx_data->skb = skb; ++ list_add_tail(&rx_data->list, &priv->rx_list); ++ tasklet_schedule(&priv->rx_tasklet); ++ ++ return; ++ ++drop: ++ dev_kfree_skb_irq(skb); ++update_stats: ++ stats->rx_errors++; ++ stats->rx_dropped++; ++out: ++ kfree(desc); ++} ++EXPORT_SYMBOL(__orinoco_ev_rx); ++ ++static void orinoco_rx(struct net_device *dev, ++ struct hermes_rx_descriptor *desc, ++ struct sk_buff *skb) ++{ ++ struct orinoco_private *priv = ndev_priv(dev); ++ struct net_device_stats *stats = &dev->stats; ++ u16 status, fc; ++ int length; ++ struct ethhdr *hdr; ++ ++ status = le16_to_cpu(desc->status); ++ length = le16_to_cpu(desc->data_len); ++ fc = le16_to_cpu(desc->frame_ctl); ++ ++ /* Calculate and check MIC */ ++ if (status & HERMES_RXSTAT_MIC) { ++ struct orinoco_tkip_key *key; ++ int key_id = ((status & HERMES_RXSTAT_MIC_KEY_ID) >> ++ HERMES_MIC_KEY_ID_SHIFT); ++ u8 mic[MICHAEL_MIC_LEN]; ++ u8 *rxmic; ++ u8 *src = (fc & IEEE80211_FCTL_FROMDS) ? ++ desc->addr3 : desc->addr2; ++ ++ /* Extract Michael MIC from payload */ ++ rxmic = skb->data + skb->len - MICHAEL_MIC_LEN; ++ ++ skb_trim(skb, skb->len - MICHAEL_MIC_LEN); ++ length -= MICHAEL_MIC_LEN; ++ ++ key = (struct orinoco_tkip_key *) priv->keys[key_id].key; ++ ++ if (!key) { ++ printk(KERN_WARNING "%s: Received encrypted frame from " ++ "%pM using key %i, but key is not installed\n", ++ dev->name, src, key_id); ++ goto drop; ++ } ++ ++ orinoco_mic(priv->rx_tfm_mic, key->rx_mic, desc->addr1, src, ++ 0, /* priority or QoS? */ ++ skb->data, skb->len, &mic[0]); ++ ++ if (memcmp(mic, rxmic, ++ MICHAEL_MIC_LEN)) { ++ union iwreq_data wrqu; ++ struct iw_michaelmicfailure wxmic; ++ ++ printk(KERN_WARNING "%s: " ++ "Invalid Michael MIC in data frame from %pM, " ++ "using key %i\n", ++ dev->name, src, key_id); ++ ++ /* TODO: update stats */ ++ ++ /* Notify userspace */ ++ memset(&wxmic, 0, sizeof(wxmic)); ++ wxmic.flags = key_id & IW_MICFAILURE_KEY_ID; ++ wxmic.flags |= (desc->addr1[0] & 1) ? ++ IW_MICFAILURE_GROUP : IW_MICFAILURE_PAIRWISE; ++ wxmic.src_addr.sa_family = ARPHRD_ETHER; ++ memcpy(wxmic.src_addr.sa_data, src, ETH_ALEN); ++ ++ (void) orinoco_hw_get_tkip_iv(priv, key_id, ++ &wxmic.tsc[0]); ++ ++ memset(&wrqu, 0, sizeof(wrqu)); ++ wrqu.data.length = sizeof(wxmic); ++ wireless_send_event(dev, IWEVMICHAELMICFAILURE, &wrqu, ++ (char *) &wxmic); ++ ++ goto drop; ++ } ++ } ++ ++ /* Handle decapsulation ++ * In most cases, the firmware tell us about SNAP frames. ++ * For some reason, the SNAP frames sent by LinkSys APs ++ * are not properly recognised by most firmwares. ++ * So, check ourselves */ ++ if (length >= ENCAPS_OVERHEAD && ++ (((status & HERMES_RXSTAT_MSGTYPE) == HERMES_RXSTAT_1042) || ++ ((status & HERMES_RXSTAT_MSGTYPE) == HERMES_RXSTAT_TUNNEL) || ++ is_ethersnap(skb->data))) { ++ /* These indicate a SNAP within 802.2 LLC within ++ 802.11 frame which we'll need to de-encapsulate to ++ the original EthernetII frame. */ ++ hdr = skb_push(skb, ETH_HLEN - ENCAPS_OVERHEAD); ++ } else { ++ /* 802.3 frame - prepend 802.3 header as is */ ++ hdr = skb_push(skb, ETH_HLEN); ++ hdr->h_proto = htons(length); ++ } ++ memcpy(hdr->h_dest, desc->addr1, ETH_ALEN); ++ if (fc & IEEE80211_FCTL_FROMDS) ++ memcpy(hdr->h_source, desc->addr3, ETH_ALEN); ++ else ++ memcpy(hdr->h_source, desc->addr2, ETH_ALEN); ++ ++ skb->protocol = eth_type_trans(skb, dev); ++ skb->ip_summed = CHECKSUM_NONE; ++ if (fc & IEEE80211_FCTL_TODS) ++ skb->pkt_type = PACKET_OTHERHOST; ++ ++ /* Process the wireless stats if needed */ ++ orinoco_stat_gather(dev, skb, desc); ++ ++ /* Pass the packet to the networking stack */ ++ netif_rx(skb); ++ stats->rx_packets++; ++ stats->rx_bytes += length; ++ ++ return; ++ ++ drop: ++ dev_kfree_skb(skb); ++ stats->rx_errors++; ++ stats->rx_dropped++; ++} ++ ++static void orinoco_rx_isr_tasklet(struct tasklet_struct *t) ++{ ++ struct orinoco_private *priv = from_tasklet(priv, t, rx_tasklet); ++ struct net_device *dev = priv->ndev; ++ struct orinoco_rx_data *rx_data, *temp; ++ struct hermes_rx_descriptor *desc; ++ struct sk_buff *skb; ++ unsigned long flags; ++ ++ /* orinoco_rx requires the driver lock, and we also need to ++ * protect priv->rx_list, so just hold the lock over the ++ * lot. ++ * ++ * If orinoco_lock fails, we've unplugged the card. In this ++ * case just abort. */ ++ if (orinoco_lock(priv, &flags) != 0) ++ return; ++ ++ /* extract desc and skb from queue */ ++ list_for_each_entry_safe(rx_data, temp, &priv->rx_list, list) { ++ desc = rx_data->desc; ++ skb = rx_data->skb; ++ list_del(&rx_data->list); ++ kfree(rx_data); ++ ++ orinoco_rx(dev, desc, skb); ++ ++ kfree(desc); ++ } ++ ++ orinoco_unlock(priv, &flags); ++} ++ ++/********************************************************************/ ++/* Rx path (info frames) */ ++/********************************************************************/ ++ ++static void print_linkstatus(struct net_device *dev, u16 status) ++{ ++ char *s; ++ ++ if (suppress_linkstatus) ++ return; ++ ++ switch (status) { ++ case HERMES_LINKSTATUS_NOT_CONNECTED: ++ s = "Not Connected"; ++ break; ++ case HERMES_LINKSTATUS_CONNECTED: ++ s = "Connected"; ++ break; ++ case HERMES_LINKSTATUS_DISCONNECTED: ++ s = "Disconnected"; ++ break; ++ case HERMES_LINKSTATUS_AP_CHANGE: ++ s = "AP Changed"; ++ break; ++ case HERMES_LINKSTATUS_AP_OUT_OF_RANGE: ++ s = "AP Out of Range"; ++ break; ++ case HERMES_LINKSTATUS_AP_IN_RANGE: ++ s = "AP In Range"; ++ break; ++ case HERMES_LINKSTATUS_ASSOC_FAILED: ++ s = "Association Failed"; ++ break; ++ default: ++ s = "UNKNOWN"; ++ } ++ ++ printk(KERN_DEBUG "%s: New link status: %s (%04x)\n", ++ dev->name, s, status); ++} ++ ++/* Search scan results for requested BSSID, join it if found */ ++static void orinoco_join_ap(struct work_struct *work) ++{ ++ struct orinoco_private *priv = ++ container_of(work, struct orinoco_private, join_work); ++ struct net_device *dev = priv->ndev; ++ struct hermes *hw = &priv->hw; ++ int err; ++ unsigned long flags; ++ struct join_req { ++ u8 bssid[ETH_ALEN]; ++ __le16 channel; ++ } __packed req; ++ const int atom_len = offsetof(struct prism2_scan_apinfo, atim); ++ struct prism2_scan_apinfo *atom = NULL; ++ int offset = 4; ++ int found = 0; ++ u8 *buf; ++ u16 len; ++ ++ /* Allocate buffer for scan results */ ++ buf = kmalloc(MAX_SCAN_LEN, GFP_KERNEL); ++ if (!buf) ++ return; ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ goto fail_lock; ++ ++ /* Sanity checks in case user changed something in the meantime */ ++ if (!priv->bssid_fixed) ++ goto out; ++ ++ if (strlen(priv->desired_essid) == 0) ++ goto out; ++ ++ /* Read scan results from the firmware */ ++ err = hw->ops->read_ltv(hw, USER_BAP, ++ HERMES_RID_SCANRESULTSTABLE, ++ MAX_SCAN_LEN, &len, buf); ++ if (err) { ++ printk(KERN_ERR "%s: Cannot read scan results\n", ++ dev->name); ++ goto out; ++ } ++ ++ len = HERMES_RECLEN_TO_BYTES(len); ++ ++ /* Go through the scan results looking for the channel of the AP ++ * we were requested to join */ ++ for (; offset + atom_len <= len; offset += atom_len) { ++ atom = (struct prism2_scan_apinfo *) (buf + offset); ++ if (memcmp(&atom->bssid, priv->desired_bssid, ETH_ALEN) == 0) { ++ found = 1; ++ break; ++ } ++ } ++ ++ if (!found) { ++ DEBUG(1, "%s: Requested AP not found in scan results\n", ++ dev->name); ++ goto out; ++ } ++ ++ memcpy(req.bssid, priv->desired_bssid, ETH_ALEN); ++ req.channel = atom->channel; /* both are little-endian */ ++ err = HERMES_WRITE_RECORD(hw, USER_BAP, HERMES_RID_CNFJOINREQUEST, ++ &req); ++ if (err) ++ printk(KERN_ERR "%s: Error issuing join request\n", dev->name); ++ ++ out: ++ orinoco_unlock(priv, &flags); ++ ++ fail_lock: ++ kfree(buf); ++} ++ ++/* Send new BSSID to userspace */ ++static void orinoco_send_bssid_wevent(struct orinoco_private *priv) ++{ ++ struct net_device *dev = priv->ndev; ++ struct hermes *hw = &priv->hw; ++ union iwreq_data wrqu; ++ int err; ++ ++ err = hw->ops->read_ltv(hw, USER_BAP, HERMES_RID_CURRENTBSSID, ++ ETH_ALEN, NULL, wrqu.ap_addr.sa_data); ++ if (err != 0) ++ return; ++ ++ wrqu.ap_addr.sa_family = ARPHRD_ETHER; ++ ++ /* Send event to user space */ ++ wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL); ++} ++ ++static void orinoco_send_assocreqie_wevent(struct orinoco_private *priv) ++{ ++ struct net_device *dev = priv->ndev; ++ struct hermes *hw = &priv->hw; ++ union iwreq_data wrqu; ++ int err; ++ u8 buf[88]; ++ u8 *ie; ++ ++ if (!priv->has_wpa) ++ return; ++ ++ err = hw->ops->read_ltv(hw, USER_BAP, HERMES_RID_CURRENT_ASSOC_REQ_INFO, ++ sizeof(buf), NULL, &buf); ++ if (err != 0) ++ return; ++ ++ ie = orinoco_get_wpa_ie(buf, sizeof(buf)); ++ if (ie) { ++ int rem = sizeof(buf) - (ie - &buf[0]); ++ wrqu.data.length = ie[1] + 2; ++ if (wrqu.data.length > rem) ++ wrqu.data.length = rem; ++ ++ if (wrqu.data.length) ++ /* Send event to user space */ ++ wireless_send_event(dev, IWEVASSOCREQIE, &wrqu, ie); ++ } ++} ++ ++static void orinoco_send_assocrespie_wevent(struct orinoco_private *priv) ++{ ++ struct net_device *dev = priv->ndev; ++ struct hermes *hw = &priv->hw; ++ union iwreq_data wrqu; ++ int err; ++ u8 buf[88]; /* TODO: verify max size or IW_GENERIC_IE_MAX */ ++ u8 *ie; ++ ++ if (!priv->has_wpa) ++ return; ++ ++ err = hw->ops->read_ltv(hw, USER_BAP, ++ HERMES_RID_CURRENT_ASSOC_RESP_INFO, ++ sizeof(buf), NULL, &buf); ++ if (err != 0) ++ return; ++ ++ ie = orinoco_get_wpa_ie(buf, sizeof(buf)); ++ if (ie) { ++ int rem = sizeof(buf) - (ie - &buf[0]); ++ wrqu.data.length = ie[1] + 2; ++ if (wrqu.data.length > rem) ++ wrqu.data.length = rem; ++ ++ if (wrqu.data.length) ++ /* Send event to user space */ ++ wireless_send_event(dev, IWEVASSOCRESPIE, &wrqu, ie); ++ } ++} ++ ++static void orinoco_send_wevents(struct work_struct *work) ++{ ++ struct orinoco_private *priv = ++ container_of(work, struct orinoco_private, wevent_work); ++ unsigned long flags; ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ return; ++ ++ orinoco_send_assocreqie_wevent(priv); ++ orinoco_send_assocrespie_wevent(priv); ++ orinoco_send_bssid_wevent(priv); ++ ++ orinoco_unlock(priv, &flags); ++} ++ ++static void qbuf_scan(struct orinoco_private *priv, void *buf, ++ int len, int type) ++{ ++ struct orinoco_scan_data *sd; ++ unsigned long flags; ++ ++ sd = kmalloc(sizeof(*sd), GFP_ATOMIC); ++ if (!sd) ++ return; ++ ++ sd->buf = buf; ++ sd->len = len; ++ sd->type = type; ++ ++ spin_lock_irqsave(&priv->scan_lock, flags); ++ list_add_tail(&sd->list, &priv->scan_list); ++ spin_unlock_irqrestore(&priv->scan_lock, flags); ++ ++ schedule_work(&priv->process_scan); ++} ++ ++static void qabort_scan(struct orinoco_private *priv) ++{ ++ struct orinoco_scan_data *sd; ++ unsigned long flags; ++ ++ sd = kmalloc(sizeof(*sd), GFP_ATOMIC); ++ if (!sd) ++ return; ++ ++ sd->len = -1; /* Abort */ ++ ++ spin_lock_irqsave(&priv->scan_lock, flags); ++ list_add_tail(&sd->list, &priv->scan_list); ++ spin_unlock_irqrestore(&priv->scan_lock, flags); ++ ++ schedule_work(&priv->process_scan); ++} ++ ++static void orinoco_process_scan_results(struct work_struct *work) ++{ ++ struct orinoco_private *priv = ++ container_of(work, struct orinoco_private, process_scan); ++ struct orinoco_scan_data *sd, *temp; ++ unsigned long flags; ++ void *buf; ++ int len; ++ int type; ++ ++ spin_lock_irqsave(&priv->scan_lock, flags); ++ list_for_each_entry_safe(sd, temp, &priv->scan_list, list) { ++ ++ buf = sd->buf; ++ len = sd->len; ++ type = sd->type; ++ ++ list_del(&sd->list); ++ spin_unlock_irqrestore(&priv->scan_lock, flags); ++ kfree(sd); ++ ++ if (len > 0) { ++ if (type == HERMES_INQ_CHANNELINFO) ++ orinoco_add_extscan_result(priv, buf, len); ++ else ++ orinoco_add_hostscan_results(priv, buf, len); ++ ++ kfree(buf); ++ } else { ++ /* Either abort or complete the scan */ ++ orinoco_scan_done(priv, (len < 0)); ++ } ++ ++ spin_lock_irqsave(&priv->scan_lock, flags); ++ } ++ spin_unlock_irqrestore(&priv->scan_lock, flags); ++} ++ ++void __orinoco_ev_info(struct net_device *dev, struct hermes *hw) ++{ ++ struct orinoco_private *priv = ndev_priv(dev); ++ u16 infofid; ++ struct { ++ __le16 len; ++ __le16 type; ++ } __packed info; ++ int len, type; ++ int err; ++ ++ /* This is an answer to an INQUIRE command that we did earlier, ++ * or an information "event" generated by the card ++ * The controller return to us a pseudo frame containing ++ * the information in question - Jean II */ ++ infofid = hermes_read_regn(hw, INFOFID); ++ ++ /* Read the info frame header - don't try too hard */ ++ err = hw->ops->bap_pread(hw, IRQ_BAP, &info, sizeof(info), ++ infofid, 0); ++ if (err) { ++ printk(KERN_ERR "%s: error %d reading info frame. " ++ "Frame dropped.\n", dev->name, err); ++ return; ++ } ++ ++ len = HERMES_RECLEN_TO_BYTES(le16_to_cpu(info.len)); ++ type = le16_to_cpu(info.type); ++ ++ switch (type) { ++ case HERMES_INQ_TALLIES: { ++ struct hermes_tallies_frame tallies; ++ struct iw_statistics *wstats = &priv->wstats; ++ ++ if (len > sizeof(tallies)) { ++ printk(KERN_WARNING "%s: Tallies frame too long (%d bytes)\n", ++ dev->name, len); ++ len = sizeof(tallies); ++ } ++ ++ err = hw->ops->bap_pread(hw, IRQ_BAP, &tallies, len, ++ infofid, sizeof(info)); ++ if (err) ++ break; ++ ++ /* Increment our various counters */ ++ /* wstats->discard.nwid - no wrong BSSID stuff */ ++ wstats->discard.code += ++ le16_to_cpu(tallies.RxWEPUndecryptable); ++ if (len == sizeof(tallies)) ++ wstats->discard.code += ++ le16_to_cpu(tallies.RxDiscards_WEPICVError) + ++ le16_to_cpu(tallies.RxDiscards_WEPExcluded); ++ wstats->discard.misc += ++ le16_to_cpu(tallies.TxDiscardsWrongSA); ++ wstats->discard.fragment += ++ le16_to_cpu(tallies.RxMsgInBadMsgFragments); ++ wstats->discard.retries += ++ le16_to_cpu(tallies.TxRetryLimitExceeded); ++ /* wstats->miss.beacon - no match */ ++ } ++ break; ++ case HERMES_INQ_LINKSTATUS: { ++ struct hermes_linkstatus linkstatus; ++ u16 newstatus; ++ int connected; ++ ++ if (priv->iw_mode == NL80211_IFTYPE_MONITOR) ++ break; ++ ++ if (len != sizeof(linkstatus)) { ++ printk(KERN_WARNING "%s: Unexpected size for linkstatus frame (%d bytes)\n", ++ dev->name, len); ++ break; ++ } ++ ++ err = hw->ops->bap_pread(hw, IRQ_BAP, &linkstatus, len, ++ infofid, sizeof(info)); ++ if (err) ++ break; ++ newstatus = le16_to_cpu(linkstatus.linkstatus); ++ ++ /* Symbol firmware uses "out of range" to signal that ++ * the hostscan frame can be requested. */ ++ if (newstatus == HERMES_LINKSTATUS_AP_OUT_OF_RANGE && ++ priv->firmware_type == FIRMWARE_TYPE_SYMBOL && ++ priv->has_hostscan && priv->scan_request) { ++ hermes_inquire(hw, HERMES_INQ_HOSTSCAN_SYMBOL); ++ break; ++ } ++ ++ connected = (newstatus == HERMES_LINKSTATUS_CONNECTED) ++ || (newstatus == HERMES_LINKSTATUS_AP_CHANGE) ++ || (newstatus == HERMES_LINKSTATUS_AP_IN_RANGE); ++ ++ if (connected) ++ netif_carrier_on(dev); ++ else if (!ignore_disconnect) ++ netif_carrier_off(dev); ++ ++ if (newstatus != priv->last_linkstatus) { ++ priv->last_linkstatus = newstatus; ++ print_linkstatus(dev, newstatus); ++ /* The info frame contains only one word which is the ++ * status (see hermes.h). The status is pretty boring ++ * in itself, that's why we export the new BSSID... ++ * Jean II */ ++ schedule_work(&priv->wevent_work); ++ } ++ } ++ break; ++ case HERMES_INQ_SCAN: ++ if (!priv->scan_request && priv->bssid_fixed && ++ priv->firmware_type == FIRMWARE_TYPE_INTERSIL) { ++ schedule_work(&priv->join_work); ++ break; ++ } ++ fallthrough; ++ case HERMES_INQ_HOSTSCAN: ++ case HERMES_INQ_HOSTSCAN_SYMBOL: { ++ /* Result of a scanning. Contains information about ++ * cells in the vicinity - Jean II */ ++ unsigned char *buf; ++ ++ /* Sanity check */ ++ if (len > 4096) { ++ printk(KERN_WARNING "%s: Scan results too large (%d bytes)\n", ++ dev->name, len); ++ qabort_scan(priv); ++ break; ++ } ++ ++ /* Allocate buffer for results */ ++ buf = kmalloc(len, GFP_ATOMIC); ++ if (buf == NULL) { ++ /* No memory, so can't printk()... */ ++ qabort_scan(priv); ++ break; ++ } ++ ++ /* Read scan data */ ++ err = hw->ops->bap_pread(hw, IRQ_BAP, (void *) buf, len, ++ infofid, sizeof(info)); ++ if (err) { ++ kfree(buf); ++ qabort_scan(priv); ++ break; ++ } ++ ++#ifdef ORINOCO_DEBUG ++ { ++ int i; ++ printk(KERN_DEBUG "Scan result [%02X", buf[0]); ++ for (i = 1; i < (len * 2); i++) ++ printk(":%02X", buf[i]); ++ printk("]\n"); ++ } ++#endif /* ORINOCO_DEBUG */ ++ ++ qbuf_scan(priv, buf, len, type); ++ } ++ break; ++ case HERMES_INQ_CHANNELINFO: ++ { ++ struct agere_ext_scan_info *bss; ++ ++ if (!priv->scan_request) { ++ printk(KERN_DEBUG "%s: Got chaninfo without scan, " ++ "len=%d\n", dev->name, len); ++ break; ++ } ++ ++ /* An empty result indicates that the scan is complete */ ++ if (len == 0) { ++ qbuf_scan(priv, NULL, len, type); ++ break; ++ } ++ ++ /* Sanity check */ ++ else if (len < (offsetof(struct agere_ext_scan_info, ++ data) + 2)) { ++ /* Drop this result now so we don't have to ++ * keep checking later */ ++ printk(KERN_WARNING ++ "%s: Ext scan results too short (%d bytes)\n", ++ dev->name, len); ++ break; ++ } ++ ++ bss = kmalloc(len, GFP_ATOMIC); ++ if (bss == NULL) ++ break; ++ ++ /* Read scan data */ ++ err = hw->ops->bap_pread(hw, IRQ_BAP, (void *) bss, len, ++ infofid, sizeof(info)); ++ if (err) ++ kfree(bss); ++ else ++ qbuf_scan(priv, bss, len, type); ++ ++ break; ++ } ++ case HERMES_INQ_SEC_STAT_AGERE: ++ /* Security status (Agere specific) */ ++ /* Ignore this frame for now */ ++ if (priv->firmware_type == FIRMWARE_TYPE_AGERE) ++ break; ++ fallthrough; ++ default: ++ printk(KERN_DEBUG "%s: Unknown information frame received: " ++ "type 0x%04x, length %d\n", dev->name, type, len); ++ /* We don't actually do anything about it */ ++ break; ++ } ++} ++EXPORT_SYMBOL(__orinoco_ev_info); ++ ++static void __orinoco_ev_infdrop(struct net_device *dev, struct hermes *hw) ++{ ++ if (net_ratelimit()) ++ printk(KERN_DEBUG "%s: Information frame lost.\n", dev->name); ++} ++ ++/********************************************************************/ ++/* Internal hardware control routines */ ++/********************************************************************/ ++ ++static int __orinoco_up(struct orinoco_private *priv) ++{ ++ struct net_device *dev = priv->ndev; ++ struct hermes *hw = &priv->hw; ++ int err; ++ ++ netif_carrier_off(dev); /* just to make sure */ ++ ++ err = __orinoco_commit(priv); ++ if (err) { ++ printk(KERN_ERR "%s: Error %d configuring card\n", ++ dev->name, err); ++ return err; ++ } ++ ++ /* Fire things up again */ ++ hermes_set_irqmask(hw, ORINOCO_INTEN); ++ err = hermes_enable_port(hw, 0); ++ if (err) { ++ printk(KERN_ERR "%s: Error %d enabling MAC port\n", ++ dev->name, err); ++ return err; ++ } ++ ++ netif_start_queue(dev); ++ ++ return 0; ++} ++ ++static int __orinoco_down(struct orinoco_private *priv) ++{ ++ struct net_device *dev = priv->ndev; ++ struct hermes *hw = &priv->hw; ++ int err; ++ ++ netif_stop_queue(dev); ++ ++ if (!priv->hw_unavailable) { ++ if (!priv->broken_disableport) { ++ err = hermes_disable_port(hw, 0); ++ if (err) { ++ /* Some firmwares (e.g. Intersil 1.3.x) seem ++ * to have problems disabling the port, oh ++ * well, too bad. */ ++ printk(KERN_WARNING "%s: Error %d disabling MAC port\n", ++ dev->name, err); ++ priv->broken_disableport = 1; ++ } ++ } ++ hermes_set_irqmask(hw, 0); ++ hermes_write_regn(hw, EVACK, 0xffff); ++ } ++ ++ orinoco_scan_done(priv, true); ++ ++ /* firmware will have to reassociate */ ++ netif_carrier_off(dev); ++ priv->last_linkstatus = 0xffff; ++ ++ return 0; ++} ++ ++static int orinoco_reinit_firmware(struct orinoco_private *priv) ++{ ++ struct hermes *hw = &priv->hw; ++ int err; ++ ++ err = hw->ops->init(hw); ++ if (priv->do_fw_download && !err) { ++ err = orinoco_download(priv); ++ if (err) ++ priv->do_fw_download = 0; ++ } ++ if (!err) ++ err = orinoco_hw_allocate_fid(priv); ++ ++ return err; ++} ++ ++static int ++__orinoco_set_multicast_list(struct net_device *dev) ++{ ++ struct orinoco_private *priv = ndev_priv(dev); ++ int err = 0; ++ int promisc, mc_count; ++ ++ /* The Hermes doesn't seem to have an allmulti mode, so we go ++ * into promiscuous mode and let the upper levels deal. */ ++ if ((dev->flags & IFF_PROMISC) || (dev->flags & IFF_ALLMULTI) || ++ (netdev_mc_count(dev) > MAX_MULTICAST(priv))) { ++ promisc = 1; ++ mc_count = 0; ++ } else { ++ promisc = 0; ++ mc_count = netdev_mc_count(dev); ++ } ++ ++ err = __orinoco_hw_set_multicast_list(priv, dev, mc_count, promisc); ++ ++ return err; ++} ++ ++/* This must be called from user context, without locks held - use ++ * schedule_work() */ ++void orinoco_reset(struct work_struct *work) ++{ ++ struct orinoco_private *priv = ++ container_of(work, struct orinoco_private, reset_work); ++ struct net_device *dev = priv->ndev; ++ struct hermes *hw = &priv->hw; ++ int err; ++ unsigned long flags; ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ /* When the hardware becomes available again, whatever ++ * detects that is responsible for re-initializing ++ * it. So no need for anything further */ ++ return; ++ ++ netif_stop_queue(dev); ++ ++ /* Shut off interrupts. Depending on what state the hardware ++ * is in, this might not work, but we'll try anyway */ ++ hermes_set_irqmask(hw, 0); ++ hermes_write_regn(hw, EVACK, 0xffff); ++ ++ priv->hw_unavailable++; ++ priv->last_linkstatus = 0xffff; /* firmware will have to reassociate */ ++ netif_carrier_off(dev); ++ ++ orinoco_unlock(priv, &flags); ++ ++ /* Scanning support: Notify scan cancellation */ ++ orinoco_scan_done(priv, true); ++ ++ if (priv->hard_reset) { ++ err = (*priv->hard_reset)(priv); ++ if (err) { ++ printk(KERN_ERR "%s: orinoco_reset: Error %d " ++ "performing hard reset\n", dev->name, err); ++ goto disable; ++ } ++ } ++ ++ err = orinoco_reinit_firmware(priv); ++ if (err) { ++ printk(KERN_ERR "%s: orinoco_reset: Error %d re-initializing firmware\n", ++ dev->name, err); ++ goto disable; ++ } ++ ++ /* This has to be called from user context */ ++ orinoco_lock_irq(priv); ++ ++ priv->hw_unavailable--; ++ ++ /* priv->open or priv->hw_unavailable might have changed while ++ * we dropped the lock */ ++ if (priv->open && (!priv->hw_unavailable)) { ++ err = __orinoco_up(priv); ++ if (err) { ++ printk(KERN_ERR "%s: orinoco_reset: Error %d reenabling card\n", ++ dev->name, err); ++ } else ++ netif_trans_update(dev); ++ } ++ ++ orinoco_unlock_irq(priv); ++ ++ return; ++ disable: ++ hermes_set_irqmask(hw, 0); ++ netif_device_detach(dev); ++ printk(KERN_ERR "%s: Device has been disabled!\n", dev->name); ++} ++ ++static int __orinoco_commit(struct orinoco_private *priv) ++{ ++ struct net_device *dev = priv->ndev; ++ int err = 0; ++ ++ /* If we've called commit, we are reconfiguring or bringing the ++ * interface up. Maintaining countermeasures across this would ++ * be confusing, so note that we've disabled them. The port will ++ * be enabled later in orinoco_commit or __orinoco_up. */ ++ priv->tkip_cm_active = 0; ++ ++ err = orinoco_hw_program_rids(priv); ++ ++ /* FIXME: what about netif_tx_lock */ ++ (void) __orinoco_set_multicast_list(dev); ++ ++ return err; ++} ++ ++/* Ensures configuration changes are applied. May result in a reset. ++ * The caller should hold priv->lock ++ */ ++int orinoco_commit(struct orinoco_private *priv) ++{ ++ struct net_device *dev = priv->ndev; ++ struct hermes *hw = &priv->hw; ++ int err; ++ ++ if (priv->broken_disableport) { ++ schedule_work(&priv->reset_work); ++ return 0; ++ } ++ ++ err = hermes_disable_port(hw, 0); ++ if (err) { ++ printk(KERN_WARNING "%s: Unable to disable port " ++ "while reconfiguring card\n", dev->name); ++ priv->broken_disableport = 1; ++ goto out; ++ } ++ ++ err = __orinoco_commit(priv); ++ if (err) { ++ printk(KERN_WARNING "%s: Unable to reconfigure card\n", ++ dev->name); ++ goto out; ++ } ++ ++ err = hermes_enable_port(hw, 0); ++ if (err) { ++ printk(KERN_WARNING "%s: Unable to enable port while reconfiguring card\n", ++ dev->name); ++ goto out; ++ } ++ ++ out: ++ if (err) { ++ printk(KERN_WARNING "%s: Resetting instead...\n", dev->name); ++ schedule_work(&priv->reset_work); ++ err = 0; ++ } ++ return err; ++} ++ ++/********************************************************************/ ++/* Interrupt handler */ ++/********************************************************************/ ++ ++static void __orinoco_ev_tick(struct net_device *dev, struct hermes *hw) ++{ ++ printk(KERN_DEBUG "%s: TICK\n", dev->name); ++} ++ ++static void __orinoco_ev_wterr(struct net_device *dev, struct hermes *hw) ++{ ++ /* This seems to happen a fair bit under load, but ignoring it ++ seems to work fine...*/ ++ printk(KERN_DEBUG "%s: MAC controller error (WTERR). Ignoring.\n", ++ dev->name); ++} ++ ++irqreturn_t orinoco_interrupt(int irq, void *dev_id) ++{ ++ struct orinoco_private *priv = dev_id; ++ struct net_device *dev = priv->ndev; ++ struct hermes *hw = &priv->hw; ++ int count = MAX_IRQLOOPS_PER_IRQ; ++ u16 evstat, events; ++ /* These are used to detect a runaway interrupt situation. ++ * ++ * If we get more than MAX_IRQLOOPS_PER_JIFFY iterations in a jiffy, ++ * we panic and shut down the hardware ++ */ ++ /* jiffies value the last time we were called */ ++ static int last_irq_jiffy; /* = 0 */ ++ static int loops_this_jiffy; /* = 0 */ ++ unsigned long flags; ++ ++ if (orinoco_lock(priv, &flags) != 0) { ++ /* If hw is unavailable - we don't know if the irq was ++ * for us or not */ ++ return IRQ_HANDLED; ++ } ++ ++ evstat = hermes_read_regn(hw, EVSTAT); ++ events = evstat & hw->inten; ++ if (!events) { ++ orinoco_unlock(priv, &flags); ++ return IRQ_NONE; ++ } ++ ++ if (jiffies != last_irq_jiffy) ++ loops_this_jiffy = 0; ++ last_irq_jiffy = jiffies; ++ ++ while (events && count--) { ++ if (++loops_this_jiffy > MAX_IRQLOOPS_PER_JIFFY) { ++ printk(KERN_WARNING "%s: IRQ handler is looping too " ++ "much! Resetting.\n", dev->name); ++ /* Disable interrupts for now */ ++ hermes_set_irqmask(hw, 0); ++ schedule_work(&priv->reset_work); ++ break; ++ } ++ ++ /* Check the card hasn't been removed */ ++ if (!hermes_present(hw)) { ++ DEBUG(0, "orinoco_interrupt(): card removed\n"); ++ break; ++ } ++ ++ if (events & HERMES_EV_TICK) ++ __orinoco_ev_tick(dev, hw); ++ if (events & HERMES_EV_WTERR) ++ __orinoco_ev_wterr(dev, hw); ++ if (events & HERMES_EV_INFDROP) ++ __orinoco_ev_infdrop(dev, hw); ++ if (events & HERMES_EV_INFO) ++ __orinoco_ev_info(dev, hw); ++ if (events & HERMES_EV_RX) ++ __orinoco_ev_rx(dev, hw); ++ if (events & HERMES_EV_TXEXC) ++ __orinoco_ev_txexc(dev, hw); ++ if (events & HERMES_EV_TX) ++ __orinoco_ev_tx(dev, hw); ++ if (events & HERMES_EV_ALLOC) ++ __orinoco_ev_alloc(dev, hw); ++ ++ hermes_write_regn(hw, EVACK, evstat); ++ ++ evstat = hermes_read_regn(hw, EVSTAT); ++ events = evstat & hw->inten; ++ } ++ ++ orinoco_unlock(priv, &flags); ++ return IRQ_HANDLED; ++} ++EXPORT_SYMBOL(orinoco_interrupt); ++ ++/********************************************************************/ ++/* Power management */ ++/********************************************************************/ ++#if defined(CONFIG_PM_SLEEP) && !defined(CONFIG_HERMES_CACHE_FW_ON_INIT) ++static int orinoco_pm_notifier(struct notifier_block *notifier, ++ unsigned long pm_event, ++ void *unused) ++{ ++ struct orinoco_private *priv = container_of(notifier, ++ struct orinoco_private, ++ pm_notifier); ++ ++ /* All we need to do is cache the firmware before suspend, and ++ * release it when we come out. ++ * ++ * Only need to do this if we're downloading firmware. */ ++ if (!priv->do_fw_download) ++ return NOTIFY_DONE; ++ ++ switch (pm_event) { ++ case PM_HIBERNATION_PREPARE: ++ case PM_SUSPEND_PREPARE: ++ orinoco_cache_fw(priv, 0); ++ break; ++ ++ case PM_POST_RESTORE: ++ /* Restore from hibernation failed. We need to clean ++ * up in exactly the same way, so fall through. */ ++ case PM_POST_HIBERNATION: ++ case PM_POST_SUSPEND: ++ orinoco_uncache_fw(priv); ++ break; ++ ++ case PM_RESTORE_PREPARE: ++ default: ++ break; ++ } ++ ++ return NOTIFY_DONE; ++} ++ ++static void orinoco_register_pm_notifier(struct orinoco_private *priv) ++{ ++ priv->pm_notifier.notifier_call = orinoco_pm_notifier; ++ register_pm_notifier(&priv->pm_notifier); ++} ++ ++static void orinoco_unregister_pm_notifier(struct orinoco_private *priv) ++{ ++ unregister_pm_notifier(&priv->pm_notifier); ++} ++#else /* !PM_SLEEP || HERMES_CACHE_FW_ON_INIT */ ++#define orinoco_register_pm_notifier(priv) do { } while (0) ++#define orinoco_unregister_pm_notifier(priv) do { } while (0) ++#endif ++ ++/********************************************************************/ ++/* Initialization */ ++/********************************************************************/ ++ ++int orinoco_init(struct orinoco_private *priv) ++{ ++ struct device *dev = priv->dev; ++ struct wiphy *wiphy = priv_to_wiphy(priv); ++ struct hermes *hw = &priv->hw; ++ int err = 0; ++ ++ /* No need to lock, the hw_unavailable flag is already set in ++ * alloc_orinocodev() */ ++ priv->nicbuf_size = IEEE80211_MAX_FRAME_LEN + ETH_HLEN; ++ ++ /* Initialize the firmware */ ++ err = hw->ops->init(hw); ++ if (err != 0) { ++ dev_err(dev, "Failed to initialize firmware (err = %d)\n", ++ err); ++ goto out; ++ } ++ ++ err = determine_fw_capabilities(priv, wiphy->fw_version, ++ sizeof(wiphy->fw_version), ++ &wiphy->hw_version); ++ if (err != 0) { ++ dev_err(dev, "Incompatible firmware, aborting\n"); ++ goto out; ++ } ++ ++ if (priv->do_fw_download) { ++#ifdef CONFIG_HERMES_CACHE_FW_ON_INIT ++ orinoco_cache_fw(priv, 0); ++#endif ++ ++ err = orinoco_download(priv); ++ if (err) ++ priv->do_fw_download = 0; ++ ++ /* Check firmware version again */ ++ err = determine_fw_capabilities(priv, wiphy->fw_version, ++ sizeof(wiphy->fw_version), ++ &wiphy->hw_version); ++ if (err != 0) { ++ dev_err(dev, "Incompatible firmware, aborting\n"); ++ goto out; ++ } ++ } ++ ++ if (priv->has_port3) ++ dev_info(dev, "Ad-hoc demo mode supported\n"); ++ if (priv->has_ibss) ++ dev_info(dev, "IEEE standard IBSS ad-hoc mode supported\n"); ++ if (priv->has_wep) ++ dev_info(dev, "WEP supported, %s-bit key\n", ++ priv->has_big_wep ? "104" : "40"); ++ if (priv->has_wpa) { ++ dev_info(dev, "WPA-PSK supported\n"); ++ if (orinoco_mic_init(priv)) { ++ dev_err(dev, "Failed to setup MIC crypto algorithm. " ++ "Disabling WPA support\n"); ++ priv->has_wpa = 0; ++ } ++ } ++ ++ err = orinoco_hw_read_card_settings(priv, wiphy->perm_addr); ++ if (err) ++ goto out; ++ ++ err = orinoco_hw_allocate_fid(priv); ++ if (err) { ++ dev_err(dev, "Failed to allocate NIC buffer!\n"); ++ goto out; ++ } ++ ++ /* Set up the default configuration */ ++ priv->iw_mode = NL80211_IFTYPE_STATION; ++ /* By default use IEEE/IBSS ad-hoc mode if we have it */ ++ priv->prefer_port3 = priv->has_port3 && (!priv->has_ibss); ++ set_port_type(priv); ++ priv->channel = 0; /* use firmware default */ ++ ++ priv->promiscuous = 0; ++ priv->encode_alg = ORINOCO_ALG_NONE; ++ priv->tx_key = 0; ++ priv->wpa_enabled = 0; ++ priv->tkip_cm_active = 0; ++ priv->key_mgmt = 0; ++ priv->wpa_ie_len = 0; ++ priv->wpa_ie = NULL; ++ ++ if (orinoco_wiphy_register(wiphy)) { ++ err = -ENODEV; ++ goto out; ++ } ++ ++ /* Make the hardware available, as long as it hasn't been ++ * removed elsewhere (e.g. by PCMCIA hot unplug) */ ++ orinoco_lock_irq(priv); ++ priv->hw_unavailable--; ++ orinoco_unlock_irq(priv); ++ ++ dev_dbg(dev, "Ready\n"); ++ ++ out: ++ return err; ++} ++EXPORT_SYMBOL(orinoco_init); ++ ++static const struct net_device_ops orinoco_netdev_ops = { ++ .ndo_open = orinoco_open, ++ .ndo_stop = orinoco_stop, ++ .ndo_start_xmit = orinoco_xmit, ++ .ndo_set_rx_mode = orinoco_set_multicast_list, ++ .ndo_change_mtu = orinoco_change_mtu, ++ .ndo_set_mac_address = eth_mac_addr, ++ .ndo_validate_addr = eth_validate_addr, ++ .ndo_tx_timeout = orinoco_tx_timeout, ++}; ++ ++/* Allocate private data. ++ * ++ * This driver has a number of structures associated with it ++ * netdev - Net device structure for each network interface ++ * wiphy - structure associated with wireless phy ++ * wireless_dev (wdev) - structure for each wireless interface ++ * hw - structure for hermes chip info ++ * card - card specific structure for use by the card driver ++ * (airport, orinoco_cs) ++ * priv - orinoco private data ++ * device - generic linux device structure ++ * ++ * +---------+ +---------+ ++ * | wiphy | | netdev | ++ * | +-------+ | +-------+ ++ * | | priv | | | wdev | ++ * | | +-----+ +-+-------+ ++ * | | | hw | ++ * | +-+-----+ ++ * | | card | ++ * +-+-------+ ++ * ++ * priv has a link to netdev and device ++ * wdev has a link to wiphy ++ */ ++struct orinoco_private ++*alloc_orinocodev(int sizeof_card, ++ struct device *device, ++ int (*hard_reset)(struct orinoco_private *), ++ int (*stop_fw)(struct orinoco_private *, int)) ++{ ++ struct orinoco_private *priv; ++ struct wiphy *wiphy; ++ ++ /* allocate wiphy ++ * NOTE: We only support a single virtual interface ++ * but this may change when monitor mode is added ++ */ ++ wiphy = wiphy_new(&orinoco_cfg_ops, ++ sizeof(struct orinoco_private) + sizeof_card); ++ if (!wiphy) ++ return NULL; ++ ++ priv = wiphy_priv(wiphy); ++ priv->dev = device; ++ ++ if (sizeof_card) ++ priv->card = (void *)((unsigned long)priv ++ + sizeof(struct orinoco_private)); ++ else ++ priv->card = NULL; ++ ++ orinoco_wiphy_init(wiphy); ++ ++#ifdef WIRELESS_SPY ++ priv->wireless_data.spy_data = &priv->spy_data; ++#endif ++ ++ /* Set up default callbacks */ ++ priv->hard_reset = hard_reset; ++ priv->stop_fw = stop_fw; ++ ++ spin_lock_init(&priv->lock); ++ priv->open = 0; ++ priv->hw_unavailable = 1; /* orinoco_init() must clear this ++ * before anything else touches the ++ * hardware */ ++ INIT_WORK(&priv->reset_work, orinoco_reset); ++ INIT_WORK(&priv->join_work, orinoco_join_ap); ++ INIT_WORK(&priv->wevent_work, orinoco_send_wevents); ++ ++ INIT_LIST_HEAD(&priv->rx_list); ++ tasklet_setup(&priv->rx_tasklet, orinoco_rx_isr_tasklet); ++ ++ spin_lock_init(&priv->scan_lock); ++ INIT_LIST_HEAD(&priv->scan_list); ++ INIT_WORK(&priv->process_scan, orinoco_process_scan_results); ++ ++ priv->last_linkstatus = 0xffff; ++ ++#if defined(CONFIG_HERMES_CACHE_FW_ON_INIT) || defined(CONFIG_PM_SLEEP) ++ priv->cached_pri_fw = NULL; ++ priv->cached_fw = NULL; ++#endif ++ ++ /* Register PM notifiers */ ++ orinoco_register_pm_notifier(priv); ++ ++ return priv; ++} ++EXPORT_SYMBOL(alloc_orinocodev); ++ ++/* We can only support a single interface. We provide a separate ++ * function to set it up to distinguish between hardware ++ * initialisation and interface setup. ++ * ++ * The base_addr and irq parameters are passed on to netdev for use ++ * with SIOCGIFMAP. ++ */ ++int orinoco_if_add(struct orinoco_private *priv, ++ unsigned long base_addr, ++ unsigned int irq, ++ const struct net_device_ops *ops) ++{ ++ struct wiphy *wiphy = priv_to_wiphy(priv); ++ struct wireless_dev *wdev; ++ struct net_device *dev; ++ int ret; ++ ++ dev = alloc_etherdev(sizeof(struct wireless_dev)); ++ ++ if (!dev) ++ return -ENOMEM; ++ ++ /* Initialise wireless_dev */ ++ wdev = netdev_priv(dev); ++ wdev->wiphy = wiphy; ++ wdev->iftype = NL80211_IFTYPE_STATION; ++ ++ /* Setup / override net_device fields */ ++ dev->ieee80211_ptr = wdev; ++ dev->watchdog_timeo = HZ; /* 1 second timeout */ ++ dev->wireless_handlers = &orinoco_handler_def; ++#ifdef WIRELESS_SPY ++ dev->wireless_data = &priv->wireless_data; ++#endif ++ /* Default to standard ops if not set */ ++ if (ops) ++ dev->netdev_ops = ops; ++ else ++ dev->netdev_ops = &orinoco_netdev_ops; ++ ++ /* we use the default eth_mac_addr for setting the MAC addr */ ++ ++ /* Reserve space in skb for the SNAP header */ ++ dev->needed_headroom = ENCAPS_OVERHEAD; ++ ++ netif_carrier_off(dev); ++ ++ eth_hw_addr_set(dev, wiphy->perm_addr); ++ ++ dev->base_addr = base_addr; ++ dev->irq = irq; ++ ++ dev->min_mtu = ORINOCO_MIN_MTU; ++ dev->max_mtu = ORINOCO_MAX_MTU; ++ ++ SET_NETDEV_DEV(dev, priv->dev); ++ ret = register_netdev(dev); ++ if (ret) ++ goto fail; ++ ++ priv->ndev = dev; ++ ++ /* Report what we've done */ ++ dev_dbg(priv->dev, "Registered interface %s.\n", dev->name); ++ ++ return 0; ++ ++ fail: ++ free_netdev(dev); ++ return ret; ++} ++EXPORT_SYMBOL(orinoco_if_add); ++ ++void orinoco_if_del(struct orinoco_private *priv) ++{ ++ struct net_device *dev = priv->ndev; ++ ++ unregister_netdev(dev); ++ free_netdev(dev); ++} ++EXPORT_SYMBOL(orinoco_if_del); ++ ++void free_orinocodev(struct orinoco_private *priv) ++{ ++ struct wiphy *wiphy = priv_to_wiphy(priv); ++ struct orinoco_rx_data *rx_data, *temp; ++ struct orinoco_scan_data *sd, *sdtemp; ++ ++ /* If the tasklet is scheduled when we call tasklet_kill it ++ * will run one final time. However the tasklet will only ++ * drain priv->rx_list if the hw is still available. */ ++ tasklet_kill(&priv->rx_tasklet); ++ ++ /* Explicitly drain priv->rx_list */ ++ list_for_each_entry_safe(rx_data, temp, &priv->rx_list, list) { ++ list_del(&rx_data->list); ++ ++ dev_kfree_skb(rx_data->skb); ++ kfree(rx_data->desc); ++ kfree(rx_data); ++ } ++ ++ cancel_work_sync(&priv->process_scan); ++ /* Explicitly drain priv->scan_list */ ++ list_for_each_entry_safe(sd, sdtemp, &priv->scan_list, list) { ++ list_del(&sd->list); ++ ++ if (sd->len > 0) ++ kfree(sd->buf); ++ kfree(sd); ++ } ++ ++ orinoco_unregister_pm_notifier(priv); ++ orinoco_uncache_fw(priv); ++ ++ priv->wpa_ie_len = 0; ++ kfree(priv->wpa_ie); ++ orinoco_mic_free(priv); ++ wiphy_free(wiphy); ++} ++EXPORT_SYMBOL(free_orinocodev); ++ ++int orinoco_up(struct orinoco_private *priv) ++{ ++ struct net_device *dev = priv->ndev; ++ unsigned long flags; ++ int err; ++ ++ priv->hw.ops->lock_irqsave(&priv->lock, &flags); ++ ++ err = orinoco_reinit_firmware(priv); ++ if (err) { ++ printk(KERN_ERR "%s: Error %d re-initializing firmware\n", ++ dev->name, err); ++ goto exit; ++ } ++ ++ netif_device_attach(dev); ++ priv->hw_unavailable--; ++ ++ if (priv->open && !priv->hw_unavailable) { ++ err = __orinoco_up(priv); ++ if (err) ++ printk(KERN_ERR "%s: Error %d restarting card\n", ++ dev->name, err); ++ } ++ ++exit: ++ priv->hw.ops->unlock_irqrestore(&priv->lock, &flags); ++ ++ return 0; ++} ++EXPORT_SYMBOL(orinoco_up); ++ ++void orinoco_down(struct orinoco_private *priv) ++{ ++ struct net_device *dev = priv->ndev; ++ unsigned long flags; ++ int err; ++ ++ priv->hw.ops->lock_irqsave(&priv->lock, &flags); ++ err = __orinoco_down(priv); ++ if (err) ++ printk(KERN_WARNING "%s: Error %d downing interface\n", ++ dev->name, err); ++ ++ netif_device_detach(dev); ++ priv->hw_unavailable++; ++ priv->hw.ops->unlock_irqrestore(&priv->lock, &flags); ++} ++EXPORT_SYMBOL(orinoco_down); ++ ++/********************************************************************/ ++/* Module initialization */ ++/********************************************************************/ ++ ++/* Can't be declared "const" or the whole __initdata section will ++ * become const */ ++static char version[] __initdata = DRIVER_NAME " " DRIVER_VERSION ++ " (David Gibson <hermes@gibson.dropbear.id.au>, " ++ "Pavel Roskin <proski@gnu.org>, et al)"; ++ ++static int __init init_orinoco(void) ++{ ++ printk(KERN_DEBUG "%s\n", version); ++ return 0; ++} ++ ++static void __exit exit_orinoco(void) ++{ ++} ++ ++module_init(init_orinoco); ++module_exit(exit_orinoco); +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/main.h linux-6.15.6/drivers/net/wireless/intersil/orinoco/main.h +--- linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/main.h 1970-01-01 01:00:00.000000000 +0100 ++++ linux-6.15.6/drivers/net/wireless/intersil/orinoco/main.h 2025-08-03 15:01:59.349130638 +0200 +@@ -0,0 +1,50 @@ ++/* Exports from main to helper modules ++ * ++ * See copyright notice in main.c ++ */ ++#ifndef _ORINOCO_MAIN_H_ ++#define _ORINOCO_MAIN_H_ ++ ++#include <linux/ieee80211.h> ++#include "orinoco.h" ++ ++/********************************************************************/ ++/* Compile time configuration and compatibility stuff */ ++/********************************************************************/ ++ ++/* We do this this way to avoid ifdefs in the actual code */ ++#ifdef WIRELESS_SPY ++#define SPY_NUMBER(priv) (priv->spy_data.spy_number) ++#else ++#define SPY_NUMBER(priv) 0 ++#endif /* WIRELESS_SPY */ ++ ++/********************************************************************/ ++ ++/* Export module parameter */ ++extern int force_monitor; ++ ++/* Forward declarations */ ++struct net_device; ++struct work_struct; ++ ++void set_port_type(struct orinoco_private *priv); ++int orinoco_commit(struct orinoco_private *priv); ++void orinoco_reset(struct work_struct *work); ++ ++/* Information element helpers - find a home for these... */ ++#define WPA_OUI_TYPE "\x00\x50\xF2\x01" ++#define WPA_SELECTOR_LEN 4 ++static inline u8 *orinoco_get_wpa_ie(u8 *data, size_t len) ++{ ++ u8 *p = data; ++ while ((p + 2 + WPA_SELECTOR_LEN) < (data + len)) { ++ if ((p[0] == WLAN_EID_VENDOR_SPECIFIC) && ++ (memcmp(&p[2], WPA_OUI_TYPE, WPA_SELECTOR_LEN) == 0)) ++ return p; ++ p += p[1] + 2; ++ } ++ return NULL; ++} ++ ++#endif /* _ORINOCO_MAIN_H_ */ +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/Makefile linux-6.15.6/drivers/net/wireless/intersil/orinoco/Makefile +--- linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/Makefile 1970-01-01 01:00:00.000000000 +0100 ++++ linux-6.15.6/drivers/net/wireless/intersil/orinoco/Makefile 2025-08-03 15:01:59.349130638 +0200 +@@ -0,0 +1,15 @@ ++# SPDX-License-Identifier: GPL-2.0 ++# ++# Makefile for the orinoco wireless device drivers. ++# ++orinoco-objs := main.o fw.o hw.o mic.o scan.o wext.o hermes_dld.o hermes.o cfg.o ++ ++obj-$(CONFIG_HERMES) += orinoco.o ++obj-$(CONFIG_PCMCIA_HERMES) += orinoco_cs.o ++obj-$(CONFIG_APPLE_AIRPORT) += airport.o ++obj-$(CONFIG_PLX_HERMES) += orinoco_plx.o ++obj-$(CONFIG_PCI_HERMES) += orinoco_pci.o ++obj-$(CONFIG_TMD_HERMES) += orinoco_tmd.o ++obj-$(CONFIG_NORTEL_HERMES) += orinoco_nortel.o ++obj-$(CONFIG_PCMCIA_SPECTRUM) += spectrum_cs.o ++obj-$(CONFIG_ORINOCO_USB) += orinoco_usb.o +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/mic.c linux-6.15.6/drivers/net/wireless/intersil/orinoco/mic.c +--- linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/mic.c 1970-01-01 01:00:00.000000000 +0100 ++++ linux-6.15.6/drivers/net/wireless/intersil/orinoco/mic.c 2025-08-03 15:01:59.349130638 +0200 +@@ -0,0 +1,89 @@ ++/* Orinoco MIC helpers ++ * ++ * See copyright notice in main.c ++ */ ++#include <linux/kernel.h> ++#include <linux/string.h> ++#include <linux/if_ether.h> ++#include <linux/scatterlist.h> ++#include <crypto/hash.h> ++ ++#include "orinoco.h" ++#include "mic.h" ++ ++/********************************************************************/ ++/* Michael MIC crypto setup */ ++/********************************************************************/ ++int orinoco_mic_init(struct orinoco_private *priv) ++{ ++ priv->tx_tfm_mic = crypto_alloc_shash("michael_mic", 0, 0); ++ if (IS_ERR(priv->tx_tfm_mic)) { ++ printk(KERN_DEBUG "%s: could not allocate " ++ "crypto API michael_mic\n", __func__); ++ priv->tx_tfm_mic = NULL; ++ return -ENOMEM; ++ } ++ ++ priv->rx_tfm_mic = crypto_alloc_shash("michael_mic", 0, 0); ++ if (IS_ERR(priv->rx_tfm_mic)) { ++ printk(KERN_DEBUG "%s: could not allocate " ++ "crypto API michael_mic\n", __func__); ++ priv->rx_tfm_mic = NULL; ++ return -ENOMEM; ++ } ++ ++ return 0; ++} ++ ++void orinoco_mic_free(struct orinoco_private *priv) ++{ ++ if (priv->tx_tfm_mic) ++ crypto_free_shash(priv->tx_tfm_mic); ++ if (priv->rx_tfm_mic) ++ crypto_free_shash(priv->rx_tfm_mic); ++} ++ ++int orinoco_mic(struct crypto_shash *tfm_michael, u8 *key, ++ u8 *da, u8 *sa, u8 priority, ++ u8 *data, size_t data_len, u8 *mic) ++{ ++ SHASH_DESC_ON_STACK(desc, tfm_michael); ++ u8 hdr[ETH_HLEN + 2]; /* size of header + padding */ ++ int err; ++ ++ if (tfm_michael == NULL) { ++ printk(KERN_WARNING "%s: tfm_michael == NULL\n", __func__); ++ return -1; ++ } ++ ++ /* Copy header into buffer. We need the padding on the end zeroed */ ++ memcpy(&hdr[0], da, ETH_ALEN); ++ memcpy(&hdr[ETH_ALEN], sa, ETH_ALEN); ++ hdr[ETH_ALEN * 2] = priority; ++ hdr[ETH_ALEN * 2 + 1] = 0; ++ hdr[ETH_ALEN * 2 + 2] = 0; ++ hdr[ETH_ALEN * 2 + 3] = 0; ++ ++ desc->tfm = tfm_michael; ++ ++ err = crypto_shash_setkey(tfm_michael, key, MIC_KEYLEN); ++ if (err) ++ return err; ++ ++ err = crypto_shash_init(desc); ++ if (err) ++ return err; ++ ++ err = crypto_shash_update(desc, hdr, sizeof(hdr)); ++ if (err) ++ return err; ++ ++ err = crypto_shash_update(desc, data, data_len); ++ if (err) ++ return err; ++ ++ err = crypto_shash_final(desc, mic); ++ shash_desc_zero(desc); ++ ++ return err; ++} +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/mic.h linux-6.15.6/drivers/net/wireless/intersil/orinoco/mic.h +--- linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/mic.h 1970-01-01 01:00:00.000000000 +0100 ++++ linux-6.15.6/drivers/net/wireless/intersil/orinoco/mic.h 2025-08-03 15:01:59.349130638 +0200 +@@ -0,0 +1,23 @@ ++/* Orinoco MIC helpers ++ * ++ * See copyright notice in main.c ++ */ ++#ifndef _ORINOCO_MIC_H_ ++#define _ORINOCO_MIC_H_ ++ ++#include <linux/types.h> ++#include <crypto/hash.h> ++ ++#define MICHAEL_MIC_LEN 8 ++ ++/* Forward declarations */ ++struct orinoco_private; ++struct crypto_ahash; ++ ++int orinoco_mic_init(struct orinoco_private *priv); ++void orinoco_mic_free(struct orinoco_private *priv); ++int orinoco_mic(struct crypto_shash *tfm_michael, u8 *key, ++ u8 *da, u8 *sa, u8 priority, ++ u8 *data, size_t data_len, u8 *mic); ++ ++#endif /* ORINOCO_MIC_H */ +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/orinoco_cs.c linux-6.15.6/drivers/net/wireless/intersil/orinoco/orinoco_cs.c +--- linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/orinoco_cs.c 1970-01-01 01:00:00.000000000 +0100 ++++ linux-6.15.6/drivers/net/wireless/intersil/orinoco/orinoco_cs.c 2025-08-03 15:01:59.353130523 +0200 +@@ -0,0 +1,350 @@ ++/* orinoco_cs.c (formerly known as dldwd_cs.c) ++ * ++ * A driver for "Hermes" chipset based PCMCIA wireless adaptors, such ++ * as the Lucent WavelanIEEE/Orinoco cards and their OEM (Cabletron/ ++ * EnteraSys RoamAbout 802.11, ELSA Airlancer, Melco Buffalo and others). ++ * It should also be usable on various Prism II based cards such as the ++ * Linksys, D-Link and Farallon Skyline. It should also work on Symbol ++ * cards such as the 3Com AirConnect and Ericsson WLAN. ++ * ++ * Copyright notice & release notes in file main.c ++ */ ++ ++#define DRIVER_NAME "orinoco_cs" ++#define PFX DRIVER_NAME ": " ++ ++#include <linux/module.h> ++#include <linux/kernel.h> ++#include <linux/delay.h> ++#include <pcmcia/cistpl.h> ++#include <pcmcia/cisreg.h> ++#include <pcmcia/ds.h> ++ ++#include "orinoco.h" ++ ++/********************************************************************/ ++/* Module stuff */ ++/********************************************************************/ ++ ++MODULE_AUTHOR("David Gibson <hermes@gibson.dropbear.id.au>"); ++MODULE_DESCRIPTION("Driver for PCMCIA Lucent Orinoco," ++ " Prism II based and similar wireless cards"); ++MODULE_LICENSE("Dual MPL/GPL"); ++ ++/* Module parameters */ ++ ++/* Some D-Link cards have buggy CIS. They do work at 5v properly, but ++ * don't have any CIS entry for it. This workaround it... */ ++static int ignore_cis_vcc; /* = 0 */ ++module_param(ignore_cis_vcc, int, 0); ++MODULE_PARM_DESC(ignore_cis_vcc, "Allow voltage mismatch between card and socket"); ++ ++/********************************************************************/ ++/* Data structures */ ++/********************************************************************/ ++ ++/* PCMCIA specific device information (goes in the card field of ++ * struct orinoco_private */ ++struct orinoco_pccard { ++ struct pcmcia_device *p_dev; ++ ++ /* Used to handle hard reset */ ++ /* yuck, we need this hack to work around the insanity of the ++ * PCMCIA layer */ ++ unsigned long hard_reset_in_progress; ++}; ++ ++ ++/********************************************************************/ ++/* Function prototypes */ ++/********************************************************************/ ++ ++static int orinoco_cs_config(struct pcmcia_device *link); ++static void orinoco_cs_release(struct pcmcia_device *link); ++static void orinoco_cs_detach(struct pcmcia_device *p_dev); ++ ++/********************************************************************/ ++/* Device methods */ ++/********************************************************************/ ++ ++static int ++orinoco_cs_hard_reset(struct orinoco_private *priv) ++{ ++ struct orinoco_pccard *card = priv->card; ++ struct pcmcia_device *link = card->p_dev; ++ int err; ++ ++ /* We need atomic ops here, because we're not holding the lock */ ++ set_bit(0, &card->hard_reset_in_progress); ++ ++ err = pcmcia_reset_card(link->socket); ++ if (err) ++ return err; ++ ++ msleep(100); ++ clear_bit(0, &card->hard_reset_in_progress); ++ ++ return 0; ++} ++ ++/********************************************************************/ ++/* PCMCIA stuff */ ++/********************************************************************/ ++ ++static int ++orinoco_cs_probe(struct pcmcia_device *link) ++{ ++ struct orinoco_private *priv; ++ struct orinoco_pccard *card; ++ int ret; ++ ++ priv = alloc_orinocodev(sizeof(*card), &link->dev, ++ orinoco_cs_hard_reset, NULL); ++ if (!priv) ++ return -ENOMEM; ++ card = priv->card; ++ ++ /* Link both structures together */ ++ card->p_dev = link; ++ link->priv = priv; ++ ++ ret = orinoco_cs_config(link); ++ if (ret) ++ goto err_free_orinocodev; ++ ++ return 0; ++ ++err_free_orinocodev: ++ free_orinocodev(priv); ++ return ret; ++} ++ ++static void orinoco_cs_detach(struct pcmcia_device *link) ++{ ++ struct orinoco_private *priv = link->priv; ++ ++ orinoco_if_del(priv); ++ ++ orinoco_cs_release(link); ++ ++ wiphy_unregister(priv_to_wiphy(priv)); ++ free_orinocodev(priv); ++} /* orinoco_cs_detach */ ++ ++static int orinoco_cs_config_check(struct pcmcia_device *p_dev, void *priv_data) ++{ ++ if (p_dev->config_index == 0) ++ return -EINVAL; ++ ++ return pcmcia_request_io(p_dev); ++}; ++ ++static int ++orinoco_cs_config(struct pcmcia_device *link) ++{ ++ struct orinoco_private *priv = link->priv; ++ struct hermes *hw = &priv->hw; ++ int ret; ++ void __iomem *mem; ++ ++ link->config_flags |= CONF_AUTO_SET_VPP | CONF_AUTO_CHECK_VCC | ++ CONF_AUTO_SET_IO | CONF_ENABLE_IRQ; ++ if (ignore_cis_vcc) ++ link->config_flags &= ~CONF_AUTO_CHECK_VCC; ++ ret = pcmcia_loop_config(link, orinoco_cs_config_check, NULL); ++ if (ret) { ++ if (!ignore_cis_vcc) ++ printk(KERN_ERR PFX "GetNextTuple(): No matching " ++ "CIS configuration. Maybe you need the " ++ "ignore_cis_vcc=1 parameter.\n"); ++ goto failed; ++ } ++ ++ mem = ioport_map(link->resource[0]->start, ++ resource_size(link->resource[0])); ++ if (!mem) ++ goto failed; ++ ++ /* We initialize the hermes structure before completing PCMCIA ++ * configuration just in case the interrupt handler gets ++ * called. */ ++ hermes_struct_init(hw, mem, HERMES_16BIT_REGSPACING); ++ ++ ret = pcmcia_request_irq(link, orinoco_interrupt); ++ if (ret) ++ goto failed; ++ ++ ret = pcmcia_enable_device(link); ++ if (ret) ++ goto failed; ++ ++ /* Initialise the main driver */ ++ if (orinoco_init(priv) != 0) { ++ printk(KERN_ERR PFX "orinoco_init() failed\n"); ++ goto failed; ++ } ++ ++ /* Register an interface with the stack */ ++ if (orinoco_if_add(priv, link->resource[0]->start, ++ link->irq, NULL) != 0) { ++ printk(KERN_ERR PFX "orinoco_if_add() failed\n"); ++ goto failed; ++ } ++ ++ return 0; ++ ++ failed: ++ orinoco_cs_release(link); ++ return -ENODEV; ++} /* orinoco_cs_config */ ++ ++static void ++orinoco_cs_release(struct pcmcia_device *link) ++{ ++ struct orinoco_private *priv = link->priv; ++ unsigned long flags; ++ ++ /* We're committed to taking the device away now, so mark the ++ * hardware as unavailable */ ++ priv->hw.ops->lock_irqsave(&priv->lock, &flags); ++ priv->hw_unavailable++; ++ priv->hw.ops->unlock_irqrestore(&priv->lock, &flags); ++ ++ pcmcia_disable_device(link); ++ if (priv->hw.iobase) ++ ioport_unmap(priv->hw.iobase); ++} /* orinoco_cs_release */ ++ ++static int orinoco_cs_suspend(struct pcmcia_device *link) ++{ ++ struct orinoco_private *priv = link->priv; ++ struct orinoco_pccard *card = priv->card; ++ ++ /* This is probably racy, but I can't think of ++ a better way, short of rewriting the PCMCIA ++ layer to not suck :-( */ ++ if (!test_bit(0, &card->hard_reset_in_progress)) ++ orinoco_down(priv); ++ ++ return 0; ++} ++ ++static int orinoco_cs_resume(struct pcmcia_device *link) ++{ ++ struct orinoco_private *priv = link->priv; ++ struct orinoco_pccard *card = priv->card; ++ int err = 0; ++ ++ if (!test_bit(0, &card->hard_reset_in_progress)) ++ err = orinoco_up(priv); ++ ++ return err; ++} ++ ++ ++/********************************************************************/ ++/* Module initialization */ ++/********************************************************************/ ++ ++static const struct pcmcia_device_id orinoco_cs_ids[] = { ++ PCMCIA_DEVICE_MANF_CARD(0x0101, 0x0777), /* 3Com AirConnect PCI 777A */ ++ PCMCIA_DEVICE_MANF_CARD(0x016b, 0x0001), /* Ericsson WLAN Card C11 */ ++ PCMCIA_DEVICE_MANF_CARD(0x01eb, 0x080a), /* Nortel Networks eMobility 802.11 Wireless Adapter */ ++ PCMCIA_DEVICE_MANF_CARD(0x0261, 0x0002), /* AirWay 802.11 Adapter (PCMCIA) */ ++ PCMCIA_DEVICE_MANF_CARD(0x0268, 0x0001), /* ARtem Onair */ ++ PCMCIA_DEVICE_MANF_CARD(0x0268, 0x0003), /* ARtem Onair Comcard 11 */ ++ PCMCIA_DEVICE_MANF_CARD(0x026f, 0x0305), /* Buffalo WLI-PCM-S11 */ ++ PCMCIA_DEVICE_MANF_CARD(0x02aa, 0x0002), /* ASUS SpaceLink WL-100 */ ++ PCMCIA_DEVICE_MANF_CARD(0x02ac, 0x0002), /* SpeedStream SS1021 Wireless Adapter */ ++ PCMCIA_DEVICE_MANF_CARD(0x02ac, 0x3021), /* SpeedStream Wireless Adapter */ ++ PCMCIA_DEVICE_MANF_CARD(0x14ea, 0xb001), /* PLANEX RoadLannerWave GW-NS11H */ ++ PCMCIA_DEVICE_PROD_ID12("3Com", "3CRWE737A AirConnect Wireless LAN PC Card", 0x41240e5b, 0x56010af3), ++ PCMCIA_DEVICE_PROD_ID12("Allied Telesyn", "AT-WCL452 Wireless PCMCIA Radio", 0x5cd01705, 0x4271660f), ++ PCMCIA_DEVICE_PROD_ID12("ASUS", "802_11B_CF_CARD_25", 0x78fc06ee, 0x45a50c1e), ++ PCMCIA_DEVICE_PROD_ID12("ASUS", "802_11b_PC_CARD_25", 0x78fc06ee, 0xdb9aa842), ++ PCMCIA_DEVICE_PROD_ID12("Avaya Communication", "Avaya Wireless PC Card", 0xd8a43b78, 0x0d341169), ++ PCMCIA_DEVICE_PROD_ID12("BENQ", "AWL100 PCMCIA ADAPTER", 0x35dadc74, 0x01f7fedb), ++ PCMCIA_DEVICE_PROD_ID12("Cabletron", "RoamAbout 802.11 DS", 0x32d445f5, 0xedeffd90), ++ PCMCIA_DEVICE_PROD_ID12("D-Link Corporation", "D-Link DWL-650H 11Mbps WLAN Adapter", 0xef544d24, 0xcd8ea916), ++ PCMCIA_DEVICE_PROD_ID12("ELSA", "AirLancer MC-11", 0x4507a33a, 0xef54f0e3), ++ PCMCIA_DEVICE_PROD_ID12("HyperLink", "Wireless PC Card 11Mbps", 0x56cc3f1a, 0x0bcf220c), ++ PCMCIA_DEVICE_PROD_ID12("Intel", "PRO/Wireless 2011 LAN PC Card", 0x816cc815, 0x07f58077), ++ PCMCIA_DEVICE_PROD_ID12("LeArtery", "SYNCBYAIR 11Mbps Wireless LAN PC Card", 0x7e3b326a, 0x49893e92), ++ PCMCIA_DEVICE_PROD_ID12("Lucent Technologies", "WaveLAN/IEEE", 0x23eb9949, 0xc562e72a), ++ PCMCIA_DEVICE_PROD_ID12("MELCO", "WLI-PCM-L11", 0x481e0094, 0x7360e410), ++ PCMCIA_DEVICE_PROD_ID12("MELCO", "WLI-PCM-L11G", 0x481e0094, 0xf57ca4b3), ++ PCMCIA_DEVICE_PROD_ID12("NCR", "WaveLAN/IEEE", 0x24358cd4, 0xc562e72a), ++ PCMCIA_DEVICE_PROD_ID12("Nortel Networks", "emobility 802.11 Wireless LAN PC Card", 0x2d617ea0, 0x88cd5767), ++ PCMCIA_DEVICE_PROD_ID12("OTC", "Wireless AirEZY 2411-PCC WLAN Card", 0x4ac44287, 0x235a6bed), ++ PCMCIA_DEVICE_PROD_ID12("PROXIM", "LAN PC CARD HARMONY 80211B", 0xc6536a5e, 0x090c3cd9), ++ PCMCIA_DEVICE_PROD_ID12("PROXIM", "LAN PCI CARD HARMONY 80211B", 0xc6536a5e, 0x9f494e26), ++ PCMCIA_DEVICE_PROD_ID12("SAMSUNG", "11Mbps WLAN Card", 0x43d74cb4, 0x579bd91b), ++ PCMCIA_DEVICE_PROD_ID12("Symbol Technologies", "LA4111 Spectrum24 Wireless LAN PC Card", 0x3f02b4d6, 0x3663cb0e), ++ PCMCIA_DEVICE_MANF_CARD_PROD_ID3(0x0156, 0x0002, "Version 01.01", 0xd27deb1a), /* Lucent Orinoco */ ++#ifdef CONFIG_HERMES_PRISM ++ /* Only entries that certainly identify Prism chipset */ ++ PCMCIA_DEVICE_MANF_CARD(0x000b, 0x7100), /* SonicWALL Long Range Wireless Card */ ++ PCMCIA_DEVICE_MANF_CARD(0x000b, 0x7300), /* Sohoware NCP110, Philips 802.11b */ ++ PCMCIA_DEVICE_MANF_CARD(0x0089, 0x0002), /* AnyPoint(TM) Wireless II PC Card */ ++ PCMCIA_DEVICE_MANF_CARD(0x0126, 0x8000), /* PROXIM RangeLAN-DS/LAN PC CARD */ ++ PCMCIA_DEVICE_MANF_CARD(0x0138, 0x0002), /* Compaq WL100 11 Mbps Wireless Adapter */ ++ PCMCIA_DEVICE_MANF_CARD(0x01ff, 0x0008), /* Intermec MobileLAN 11Mbps 802.11b WLAN Card */ ++ PCMCIA_DEVICE_MANF_CARD(0x0250, 0x0002), /* Samsung SWL2000-N 11Mb/s WLAN Card */ ++ PCMCIA_DEVICE_MANF_CARD(0x0274, 0x1612), /* Linksys WPC11 Version 2.5 */ ++ PCMCIA_DEVICE_MANF_CARD(0x0274, 0x1613), /* Linksys WPC11 Version 3 */ ++ PCMCIA_DEVICE_MANF_CARD(0x028a, 0x0002), /* Compaq HNW-100 11 Mbps Wireless Adapter */ ++ PCMCIA_DEVICE_MANF_CARD(0x028a, 0x0673), /* Linksys WCF12 Wireless CompactFlash Card */ ++ PCMCIA_DEVICE_MANF_CARD(0x50c2, 0x7300), /* Airvast WN-100 */ ++ PCMCIA_DEVICE_MANF_CARD(0x9005, 0x0021), /* Adaptec Ultra Wireless ANW-8030 */ ++ PCMCIA_DEVICE_MANF_CARD(0xc001, 0x0008), /* CONTEC FLEXSCAN/FX-DDS110-PCC */ ++ PCMCIA_DEVICE_MANF_CARD(0xc250, 0x0002), /* Conceptronic CON11Cpro, EMTAC A2424i */ ++ PCMCIA_DEVICE_MANF_CARD(0xd601, 0x0002), /* Safeway 802.11b, ZCOMAX AirRunner/XI-300 */ ++ PCMCIA_DEVICE_MANF_CARD(0xd601, 0x0005), /* D-Link DCF660, Sandisk Connect SDWCFB-000 */ ++ PCMCIA_DEVICE_PROD_ID123("Instant Wireless ", " Network PC CARD", "Version 01.02", 0x11d901af, 0x6e9bd926, 0x4b74baa0), ++ PCMCIA_DEVICE_PROD_ID12("ACTIONTEC", "PRISM Wireless LAN PC Card", 0x393089da, 0xa71e69d5), ++ PCMCIA_DEVICE_PROD_ID12("Addtron", "AWP-100 Wireless PCMCIA", 0xe6ec52ce, 0x08649af2), ++ PCMCIA_DEVICE_PROD_ID12("BUFFALO", "WLI-CF-S11G", 0x2decece3, 0x82067c18), ++ PCMCIA_DEVICE_PROD_ID12("BUFFALO", "WLI-PCM-L11G", 0x2decece3, 0xf57ca4b3), ++ PCMCIA_DEVICE_PROD_ID12("Compaq", "WL200_11Mbps_Wireless_PCI_Card", 0x54f7c49c, 0x15a75e5b), ++ PCMCIA_DEVICE_PROD_ID12("corega K.K.", "Wireless LAN PCC-11", 0x5261440f, 0xa6405584), ++ PCMCIA_DEVICE_PROD_ID12("corega K.K.", "Wireless LAN PCCA-11", 0x5261440f, 0xdf6115f9), ++ PCMCIA_DEVICE_PROD_ID12("corega_K.K.", "Wireless_LAN_PCCB-11", 0x29e33311, 0xee7a27ae), ++ PCMCIA_DEVICE_PROD_ID12("Digital Data Communications", "WPC-0100", 0xfdd73470, 0xe0b6f146), ++ PCMCIA_DEVICE_PROD_ID12("D", "Link DRC-650 11Mbps WLAN Card", 0x71b18589, 0xf144e3ac), ++ PCMCIA_DEVICE_PROD_ID12("D", "Link DWL-650 11Mbps WLAN Card", 0x71b18589, 0xb6f1b0ab), ++ PCMCIA_DEVICE_PROD_ID12(" ", "IEEE 802.11 Wireless LAN/PC Card", 0x3b6e20c8, 0xefccafe9), ++ PCMCIA_DEVICE_PROD_ID12("INTERSIL", "HFA384x/IEEE", 0x74c5e40d, 0xdb472a18), ++ PCMCIA_DEVICE_PROD_ID12("INTERSIL", "I-GATE 11M PC Card / PC Card plus", 0x74c5e40d, 0x8304ff77), ++ PCMCIA_DEVICE_PROD_ID12("Intersil", "PRISM 2_5 PCMCIA ADAPTER", 0x4b801a17, 0x6345a0bf), ++ PCMCIA_DEVICE_PROD_ID12("Linksys", "Wireless CompactFlash Card", 0x0733cc81, 0x0c52f395), ++ PCMCIA_DEVICE_PROD_ID12("Microsoft", "Wireless Notebook Adapter MN-520", 0x5961bf85, 0x6eec8c01), ++ PCMCIA_DEVICE_PROD_ID12("NETGEAR MA401RA Wireless PC", "Card", 0x0306467f, 0x9762e8f1), ++ PCMCIA_DEVICE_PROD_ID12("NETGEAR MA401 Wireless PC", "Card", 0xa37434e9, 0x9762e8f1), ++ PCMCIA_DEVICE_PROD_ID12("OEM", "PRISM2 IEEE 802.11 PC-Card", 0xfea54c90, 0x48f2bdd6), ++ PCMCIA_DEVICE_PROD_ID12("PLANEX", "GeoWave/GW-CF110", 0x209f40ab, 0xd9715264), ++ PCMCIA_DEVICE_PROD_ID12("PLANEX", "GeoWave/GW-NS110", 0x209f40ab, 0x46263178), ++ PCMCIA_DEVICE_PROD_ID12("SMC", "SMC2532W-B EliteConnect Wireless Adapter", 0xc4f8b18b, 0x196bd757), ++ PCMCIA_DEVICE_PROD_ID12("SMC", "SMC2632W", 0xc4f8b18b, 0x474a1f2a), ++ PCMCIA_DEVICE_PROD_ID12("ZoomAir 11Mbps High", "Rate wireless Networking", 0x273fe3db, 0x32a1eaee), ++ PCMCIA_DEVICE_PROD_ID3("HFA3863", 0x355cb092), ++ PCMCIA_DEVICE_PROD_ID3("ISL37100P", 0x630d52b2), ++ PCMCIA_DEVICE_PROD_ID3("ISL37101P-10", 0xdd97a26b), ++ PCMCIA_DEVICE_PROD_ID3("ISL37300P", 0xc9049a39), ++ ++ /* This may be Agere or Intersil Firmware */ ++ PCMCIA_DEVICE_MANF_CARD(0x0156, 0x0002), ++#endif ++ PCMCIA_DEVICE_NULL, ++}; ++MODULE_DEVICE_TABLE(pcmcia, orinoco_cs_ids); ++ ++static struct pcmcia_driver orinoco_driver = { ++ .owner = THIS_MODULE, ++ .name = DRIVER_NAME, ++ .probe = orinoco_cs_probe, ++ .remove = orinoco_cs_detach, ++ .id_table = orinoco_cs_ids, ++ .suspend = orinoco_cs_suspend, ++ .resume = orinoco_cs_resume, ++}; ++module_pcmcia_driver(orinoco_driver); +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/orinoco.h linux-6.15.6/drivers/net/wireless/intersil/orinoco/orinoco.h +--- linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/orinoco.h 1970-01-01 01:00:00.000000000 +0100 ++++ linux-6.15.6/drivers/net/wireless/intersil/orinoco/orinoco.h 2025-08-03 22:43:06.558981951 +0200 +@@ -0,0 +1,249 @@ ++/* orinoco.h ++ * ++ * Common definitions to all pieces of the various orinoco ++ * drivers ++ */ ++ ++#ifndef _ORINOCO_H ++#define _ORINOCO_H ++ ++#define DRIVER_VERSION "0.15" ++ ++#include <linux/interrupt.h> ++#include <linux/suspend.h> ++#include <linux/netdevice.h> ++#include <linux/wireless.h> ++#include <net/iw_handler.h> ++#include <net/cfg80211.h> ++ ++#include "hermes.h" ++ ++/* To enable debug messages */ ++/*#define ORINOCO_DEBUG 3*/ ++ ++#define MAX_SCAN_LEN 4096 ++ ++#define ORINOCO_SEQ_LEN 8 ++#define ORINOCO_MAX_KEY_SIZE 14 ++#define ORINOCO_MAX_KEYS 4 ++ ++struct orinoco_key { ++ __le16 len; /* always stored as little-endian */ ++ char data[ORINOCO_MAX_KEY_SIZE]; ++} __packed; ++ ++#define TKIP_KEYLEN 16 ++#define MIC_KEYLEN 8 ++ ++struct orinoco_tkip_key { ++ u8 tkip[TKIP_KEYLEN]; ++ u8 tx_mic[MIC_KEYLEN]; ++ u8 rx_mic[MIC_KEYLEN]; ++}; ++ ++enum orinoco_alg { ++ ORINOCO_ALG_NONE, ++ ORINOCO_ALG_WEP, ++ ORINOCO_ALG_TKIP ++}; ++ ++enum fwtype { ++ FIRMWARE_TYPE_AGERE, ++ FIRMWARE_TYPE_INTERSIL, ++ FIRMWARE_TYPE_SYMBOL ++}; ++ ++struct firmware; ++ ++struct orinoco_private { ++ void *card; /* Pointer to card dependent structure */ ++ struct device *dev; ++ int (*hard_reset)(struct orinoco_private *); ++ int (*stop_fw)(struct orinoco_private *, int); ++ ++ struct ieee80211_supported_band band; ++ struct ieee80211_channel channels[14]; ++ u32 cipher_suites[3]; ++ ++ /* Synchronisation stuff */ ++ spinlock_t lock; ++ int hw_unavailable; ++ struct work_struct reset_work; ++ ++ /* Interrupt tasklets */ ++ struct tasklet_struct rx_tasklet; ++ struct list_head rx_list; ++ ++ /* driver state */ ++ int open; ++ u16 last_linkstatus; ++ struct work_struct join_work; ++ struct work_struct wevent_work; ++ ++ /* Net device stuff */ ++ struct net_device *ndev; ++ struct iw_statistics wstats; ++ ++ /* Hardware control variables */ ++ struct hermes hw; ++ u16 txfid; ++ ++ /* Capabilities of the hardware/firmware */ ++ enum fwtype firmware_type; ++ int ibss_port; ++ int nicbuf_size; ++ u16 channel_mask; ++ ++ /* Boolean capabilities */ ++ unsigned int has_ibss:1; ++ unsigned int has_port3:1; ++ unsigned int has_wep:1; ++ unsigned int has_big_wep:1; ++ unsigned int has_mwo:1; ++ unsigned int has_pm:1; ++ unsigned int has_preamble:1; ++ unsigned int has_sensitivity:1; ++ unsigned int has_hostscan:1; ++ unsigned int has_alt_txcntl:1; ++ unsigned int has_ext_scan:1; ++ unsigned int has_wpa:1; ++ unsigned int do_fw_download:1; ++ unsigned int broken_disableport:1; ++ unsigned int broken_monitor:1; ++ unsigned int prefer_port3:1; ++ ++ /* Configuration paramaters */ ++ enum nl80211_iftype iw_mode; ++ enum orinoco_alg encode_alg; ++ u16 wep_restrict, tx_key; ++ struct key_params keys[ORINOCO_MAX_KEYS]; ++ ++ int bitratemode; ++ char nick[IW_ESSID_MAX_SIZE + 1]; ++ char desired_essid[IW_ESSID_MAX_SIZE + 1]; ++ char desired_bssid[ETH_ALEN]; ++ int bssid_fixed; ++ u16 frag_thresh, mwo_robust; ++ u16 channel; ++ u16 ap_density, rts_thresh; ++ u16 pm_on, pm_mcast, pm_period, pm_timeout; ++ u16 preamble; ++ u16 short_retry_limit, long_retry_limit; ++ u16 retry_lifetime; ++#ifdef WIRELESS_SPY ++ struct iw_spy_data spy_data; /* iwspy support */ ++ struct iw_public_data wireless_data; ++#endif ++ ++ /* Configuration dependent variables */ ++ int port_type, createibss; ++ int promiscuous, mc_count; ++ ++ /* Scanning support */ ++ struct cfg80211_scan_request *scan_request; ++ struct work_struct process_scan; ++ struct list_head scan_list; ++ spinlock_t scan_lock; /* protects the scan list */ ++ ++ /* WPA support */ ++ u8 *wpa_ie; ++ int wpa_ie_len; ++ ++ struct crypto_shash *rx_tfm_mic; ++ struct crypto_shash *tx_tfm_mic; ++ ++ unsigned int wpa_enabled:1; ++ unsigned int tkip_cm_active:1; ++ unsigned int key_mgmt:3; ++ ++#if defined(CONFIG_HERMES_CACHE_FW_ON_INIT) || defined(CONFIG_PM_SLEEP) ++ /* Cached in memory firmware to use during ->resume. */ ++ const struct firmware *cached_pri_fw; ++ const struct firmware *cached_fw; ++#endif ++ ++ struct notifier_block pm_notifier; ++}; ++ ++#ifdef ORINOCO_DEBUG ++extern int orinoco_debug; ++#define DEBUG(n, args...) do { \ ++ if (orinoco_debug > (n)) \ ++ printk(KERN_DEBUG args); \ ++} while (0) ++#else ++#define DEBUG(n, args...) do { } while (0) ++#endif /* ORINOCO_DEBUG */ ++ ++/********************************************************************/ ++/* Exported prototypes */ ++/********************************************************************/ ++ ++struct orinoco_private *alloc_orinocodev(int sizeof_card, struct device *device, ++ int (*hard_reset)(struct orinoco_private *), ++ int (*stop_fw)(struct orinoco_private *, int)); ++void free_orinocodev(struct orinoco_private *priv); ++int orinoco_init(struct orinoco_private *priv); ++int orinoco_if_add(struct orinoco_private *priv, unsigned long base_addr, ++ unsigned int irq, const struct net_device_ops *ops); ++void orinoco_if_del(struct orinoco_private *priv); ++int orinoco_up(struct orinoco_private *priv); ++void orinoco_down(struct orinoco_private *priv); ++irqreturn_t orinoco_interrupt(int irq, void *dev_id); ++ ++void __orinoco_ev_info(struct net_device *dev, struct hermes *hw); ++void __orinoco_ev_rx(struct net_device *dev, struct hermes *hw); ++ ++int orinoco_process_xmit_skb(struct sk_buff *skb, ++ struct net_device *dev, ++ struct orinoco_private *priv, ++ int *tx_control, ++ u8 *mic); ++ ++/* Common ndo functions exported for reuse by orinoco_usb */ ++int orinoco_open(struct net_device *dev); ++int orinoco_stop(struct net_device *dev); ++void orinoco_set_multicast_list(struct net_device *dev); ++int orinoco_change_mtu(struct net_device *dev, int new_mtu); ++void orinoco_tx_timeout(struct net_device *dev, unsigned int txqueue); ++ ++/********************************************************************/ ++/* Locking and synchronization functions */ ++/********************************************************************/ ++ ++static inline int orinoco_lock(struct orinoco_private *priv, ++ unsigned long *flags) ++{ ++ priv->hw.ops->lock_irqsave(&priv->lock, flags); ++ if (priv->hw_unavailable) { ++ DEBUG(1, "orinoco_lock() called with hw_unavailable (dev=%p)\n", ++ priv->ndev); ++ priv->hw.ops->unlock_irqrestore(&priv->lock, flags); ++ return -EBUSY; ++ } ++ return 0; ++} ++ ++static inline void orinoco_unlock(struct orinoco_private *priv, ++ unsigned long *flags) ++{ ++ priv->hw.ops->unlock_irqrestore(&priv->lock, flags); ++} ++ ++static inline void orinoco_lock_irq(struct orinoco_private *priv) ++{ ++ priv->hw.ops->lock_irq(&priv->lock); ++} ++ ++static inline void orinoco_unlock_irq(struct orinoco_private *priv) ++{ ++ priv->hw.ops->unlock_irq(&priv->lock); ++} ++ ++/*** Navigate from net_device to orinoco_private ***/ ++static inline struct orinoco_private *ndev_priv(struct net_device *dev) ++{ ++ struct wireless_dev *wdev = netdev_priv(dev); ++ return wdev_priv(wdev); ++} ++#endif /* _ORINOCO_H */ +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/orinoco_nortel.c linux-6.15.6/drivers/net/wireless/intersil/orinoco/orinoco_nortel.c +--- linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/orinoco_nortel.c 1970-01-01 01:00:00.000000000 +0100 ++++ linux-6.15.6/drivers/net/wireless/intersil/orinoco/orinoco_nortel.c 2025-08-03 15:01:59.353130523 +0200 +@@ -0,0 +1,314 @@ ++/* orinoco_nortel.c ++ * ++ * Driver for Prism II devices which would usually be driven by orinoco_cs, ++ * but are connected to the PCI bus by a PCI-to-PCMCIA adapter used in ++ * Nortel emobility, Symbol LA-4113 and Symbol LA-4123. ++ * ++ * Copyright (C) 2002 Tobias Hoffmann ++ * (C) 2003 Christoph Jungegger <disdos@traum404.de> ++ * ++ * Some of this code is borrowed from orinoco_plx.c ++ * Copyright (C) 2001 Daniel Barlow ++ * Some of this code is borrowed from orinoco_pci.c ++ * Copyright (C) 2001 Jean Tourrilhes ++ * Some of this code is "inspired" by linux-wlan-ng-0.1.10, but nothing ++ * has been copied from it. linux-wlan-ng-0.1.10 is originally : ++ * Copyright (C) 1999 AbsoluteValue Systems, Inc. All Rights Reserved. ++ * ++ * The contents of this file are subject to the Mozilla Public License ++ * Version 1.1 (the "License"); you may not use this file except in ++ * compliance with the License. You may obtain a copy of the License ++ * at http://www.mozilla.org/MPL/ ++ * ++ * Software distributed under the License is distributed on an "AS IS" ++ * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See ++ * the License for the specific language governing rights and ++ * limitations under the License. ++ * ++ * Alternatively, the contents of this file may be used under the ++ * terms of the GNU General Public License version 2 (the "GPL"), in ++ * which case the provisions of the GPL are applicable instead of the ++ * above. If you wish to allow the use of your version of this file ++ * only under the terms of the GPL and not to allow others to use your ++ * version of this file under the MPL, indicate your decision by ++ * deleting the provisions above and replace them with the notice and ++ * other provisions required by the GPL. If you do not delete the ++ * provisions above, a recipient may use your version of this file ++ * under either the MPL or the GPL. ++ */ ++ ++#define DRIVER_NAME "orinoco_nortel" ++#define PFX DRIVER_NAME ": " ++ ++#include <linux/module.h> ++#include <linux/kernel.h> ++#include <linux/init.h> ++#include <linux/delay.h> ++#include <linux/pci.h> ++#include <pcmcia/cisreg.h> ++ ++#include "orinoco.h" ++#include "orinoco_pci.h" ++ ++#define COR_OFFSET (0xe0) /* COR attribute offset of Prism2 PC card */ ++#define COR_VALUE (COR_LEVEL_REQ | COR_FUNC_ENA) /* Enable PC card with interrupt in level trigger */ ++ ++ ++/* ++ * Do a soft reset of the card using the Configuration Option Register ++ * We need this to get going... ++ * This is the part of the code that is strongly inspired from wlan-ng ++ * ++ * Note bis : Don't try to access HERMES_CMD during the reset phase. ++ * It just won't work ! ++ */ ++static int orinoco_nortel_cor_reset(struct orinoco_private *priv) ++{ ++ struct orinoco_pci_card *card = priv->card; ++ ++ /* Assert the reset until the card notices */ ++ iowrite16(8, card->bridge_io + 2); ++ ioread16(card->attr_io + COR_OFFSET); ++ iowrite16(0x80, card->attr_io + COR_OFFSET); ++ mdelay(1); ++ ++ /* Give time for the card to recover from this hard effort */ ++ iowrite16(0, card->attr_io + COR_OFFSET); ++ iowrite16(0, card->attr_io + COR_OFFSET); ++ mdelay(1); ++ ++ /* Set COR as usual */ ++ iowrite16(COR_VALUE, card->attr_io + COR_OFFSET); ++ iowrite16(COR_VALUE, card->attr_io + COR_OFFSET); ++ mdelay(1); ++ ++ iowrite16(0x228, card->bridge_io + 2); ++ ++ return 0; ++} ++ ++static int orinoco_nortel_hw_init(struct orinoco_pci_card *card) ++{ ++ int i; ++ u32 reg; ++ ++ /* Setup bridge */ ++ if (ioread16(card->bridge_io) & 1) { ++ printk(KERN_ERR PFX "brg1 answer1 wrong\n"); ++ return -EBUSY; ++ } ++ iowrite16(0x118, card->bridge_io + 2); ++ iowrite16(0x108, card->bridge_io + 2); ++ mdelay(30); ++ iowrite16(0x8, card->bridge_io + 2); ++ for (i = 0; i < 30; i++) { ++ mdelay(30); ++ if (ioread16(card->bridge_io) & 0x10) ++ break; ++ } ++ if (i == 30) { ++ printk(KERN_ERR PFX "brg1 timed out\n"); ++ return -EBUSY; ++ } ++ if (ioread16(card->attr_io + COR_OFFSET) & 1) { ++ printk(KERN_ERR PFX "brg2 answer1 wrong\n"); ++ return -EBUSY; ++ } ++ if (ioread16(card->attr_io + COR_OFFSET + 2) & 1) { ++ printk(KERN_ERR PFX "brg2 answer2 wrong\n"); ++ return -EBUSY; ++ } ++ if (ioread16(card->attr_io + COR_OFFSET + 4) & 1) { ++ printk(KERN_ERR PFX "brg2 answer3 wrong\n"); ++ return -EBUSY; ++ } ++ ++ /* Set the PCMCIA COR register */ ++ iowrite16(COR_VALUE, card->attr_io + COR_OFFSET); ++ mdelay(1); ++ reg = ioread16(card->attr_io + COR_OFFSET); ++ if (reg != COR_VALUE) { ++ printk(KERN_ERR PFX "Error setting COR value (reg=%x)\n", ++ reg); ++ return -EBUSY; ++ } ++ ++ /* Set LEDs */ ++ iowrite16(1, card->bridge_io + 10); ++ return 0; ++} ++ ++static int orinoco_nortel_init_one(struct pci_dev *pdev, ++ const struct pci_device_id *ent) ++{ ++ int err; ++ struct orinoco_private *priv; ++ struct orinoco_pci_card *card; ++ void __iomem *hermes_io, *bridge_io, *attr_io; ++ ++ err = pci_enable_device(pdev); ++ if (err) { ++ printk(KERN_ERR PFX "Cannot enable PCI device\n"); ++ return err; ++ } ++ ++ err = pci_request_regions(pdev, DRIVER_NAME); ++ if (err) { ++ printk(KERN_ERR PFX "Cannot obtain PCI resources\n"); ++ goto fail_resources; ++ } ++ ++ bridge_io = pci_iomap(pdev, 0, 0); ++ if (!bridge_io) { ++ printk(KERN_ERR PFX "Cannot map bridge registers\n"); ++ err = -EIO; ++ goto fail_map_bridge; ++ } ++ ++ attr_io = pci_iomap(pdev, 1, 0); ++ if (!attr_io) { ++ printk(KERN_ERR PFX "Cannot map PCMCIA attributes\n"); ++ err = -EIO; ++ goto fail_map_attr; ++ } ++ ++ hermes_io = pci_iomap(pdev, 2, 0); ++ if (!hermes_io) { ++ printk(KERN_ERR PFX "Cannot map chipset registers\n"); ++ err = -EIO; ++ goto fail_map_hermes; ++ } ++ ++ /* Allocate network device */ ++ priv = alloc_orinocodev(sizeof(*card), &pdev->dev, ++ orinoco_nortel_cor_reset, NULL); ++ if (!priv) { ++ printk(KERN_ERR PFX "Cannot allocate network device\n"); ++ err = -ENOMEM; ++ goto fail_alloc; ++ } ++ ++ card = priv->card; ++ card->bridge_io = bridge_io; ++ card->attr_io = attr_io; ++ ++ hermes_struct_init(&priv->hw, hermes_io, HERMES_16BIT_REGSPACING); ++ ++ err = request_irq(pdev->irq, orinoco_interrupt, IRQF_SHARED, ++ DRIVER_NAME, priv); ++ if (err) { ++ printk(KERN_ERR PFX "Cannot allocate IRQ %d\n", pdev->irq); ++ err = -EBUSY; ++ goto fail_irq; ++ } ++ ++ err = orinoco_nortel_hw_init(card); ++ if (err) { ++ printk(KERN_ERR PFX "Hardware initialization failed\n"); ++ goto fail; ++ } ++ ++ err = orinoco_nortel_cor_reset(priv); ++ if (err) { ++ printk(KERN_ERR PFX "Initial reset failed\n"); ++ goto fail; ++ } ++ ++ err = orinoco_init(priv); ++ if (err) { ++ printk(KERN_ERR PFX "orinoco_init() failed\n"); ++ goto fail; ++ } ++ ++ err = orinoco_if_add(priv, 0, 0, NULL); ++ if (err) { ++ printk(KERN_ERR PFX "orinoco_if_add() failed\n"); ++ goto fail_wiphy; ++ } ++ ++ pci_set_drvdata(pdev, priv); ++ ++ return 0; ++ ++ fail_wiphy: ++ wiphy_unregister(priv_to_wiphy(priv)); ++ fail: ++ free_irq(pdev->irq, priv); ++ ++ fail_irq: ++ free_orinocodev(priv); ++ ++ fail_alloc: ++ pci_iounmap(pdev, hermes_io); ++ ++ fail_map_hermes: ++ pci_iounmap(pdev, attr_io); ++ ++ fail_map_attr: ++ pci_iounmap(pdev, bridge_io); ++ ++ fail_map_bridge: ++ pci_release_regions(pdev); ++ ++ fail_resources: ++ pci_disable_device(pdev); ++ ++ return err; ++} ++ ++static void orinoco_nortel_remove_one(struct pci_dev *pdev) ++{ ++ struct orinoco_private *priv = pci_get_drvdata(pdev); ++ struct orinoco_pci_card *card = priv->card; ++ ++ /* Clear LEDs */ ++ iowrite16(0, card->bridge_io + 10); ++ ++ orinoco_if_del(priv); ++ wiphy_unregister(priv_to_wiphy(priv)); ++ free_irq(pdev->irq, priv); ++ free_orinocodev(priv); ++ pci_iounmap(pdev, priv->hw.iobase); ++ pci_iounmap(pdev, card->attr_io); ++ pci_iounmap(pdev, card->bridge_io); ++ pci_release_regions(pdev); ++ pci_disable_device(pdev); ++} ++ ++static const struct pci_device_id orinoco_nortel_id_table[] = { ++ /* Nortel emobility PCI */ ++ {0x126c, 0x8030, PCI_ANY_ID, PCI_ANY_ID,}, ++ /* Symbol LA-4123 PCI */ ++ {0x1562, 0x0001, PCI_ANY_ID, PCI_ANY_ID,}, ++ {0,}, ++}; ++ ++MODULE_DEVICE_TABLE(pci, orinoco_nortel_id_table); ++ ++static struct pci_driver orinoco_nortel_driver = { ++ .name = DRIVER_NAME, ++ .id_table = orinoco_nortel_id_table, ++ .probe = orinoco_nortel_init_one, ++ .remove = orinoco_nortel_remove_one, ++ .driver.pm = &orinoco_pci_pm_ops, ++}; ++ ++static char version[] __initdata = DRIVER_NAME " " DRIVER_VERSION ++ " (Tobias Hoffmann & Christoph Jungegger <disdos@traum404.de>)"; ++MODULE_AUTHOR("Christoph Jungegger <disdos@traum404.de>"); ++MODULE_DESCRIPTION("Driver for wireless LAN cards using the Nortel PCI bridge"); ++MODULE_LICENSE("Dual MPL/GPL"); ++ ++static int __init orinoco_nortel_init(void) ++{ ++ printk(KERN_DEBUG "%s\n", version); ++ return pci_register_driver(&orinoco_nortel_driver); ++} ++ ++static void __exit orinoco_nortel_exit(void) ++{ ++ pci_unregister_driver(&orinoco_nortel_driver); ++} ++ ++module_init(orinoco_nortel_init); ++module_exit(orinoco_nortel_exit); +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/orinoco_pci.c linux-6.15.6/drivers/net/wireless/intersil/orinoco/orinoco_pci.c +--- linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/orinoco_pci.c 1970-01-01 01:00:00.000000000 +0100 ++++ linux-6.15.6/drivers/net/wireless/intersil/orinoco/orinoco_pci.c 2025-08-03 15:01:59.353130523 +0200 +@@ -0,0 +1,257 @@ ++/* orinoco_pci.c ++ * ++ * Driver for Prism 2.5/3 devices that have a direct PCI interface ++ * (i.e. these are not PCMCIA cards in a PCMCIA-to-PCI bridge). ++ * The card contains only one PCI region, which contains all the usual ++ * hermes registers, as well as the COR register. ++ * ++ * Current maintainers are: ++ * Pavel Roskin <proski AT gnu.org> ++ * and David Gibson <hermes AT gibson.dropbear.id.au> ++ * ++ * Some of this code is borrowed from orinoco_plx.c ++ * Copyright (C) 2001 Daniel Barlow <dan AT telent.net> ++ * Some of this code is "inspired" by linux-wlan-ng-0.1.10, but nothing ++ * has been copied from it. linux-wlan-ng-0.1.10 is originally : ++ * Copyright (C) 1999 AbsoluteValue Systems, Inc. All Rights Reserved. ++ * This file originally written by: ++ * Copyright (C) 2001 Jean Tourrilhes <jt AT hpl.hp.com> ++ * And is now maintained by: ++ * (C) Copyright David Gibson, IBM Corp. 2002-2003. ++ * ++ * The contents of this file are subject to the Mozilla Public License ++ * Version 1.1 (the "License"); you may not use this file except in ++ * compliance with the License. You may obtain a copy of the License ++ * at http://www.mozilla.org/MPL/ ++ * ++ * Software distributed under the License is distributed on an "AS IS" ++ * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See ++ * the License for the specific language governing rights and ++ * limitations under the License. ++ * ++ * Alternatively, the contents of this file may be used under the ++ * terms of the GNU General Public License version 2 (the "GPL"), in ++ * which case the provisions of the GPL are applicable instead of the ++ * above. If you wish to allow the use of your version of this file ++ * only under the terms of the GPL and not to allow others to use your ++ * version of this file under the MPL, indicate your decision by ++ * deleting the provisions above and replace them with the notice and ++ * other provisions required by the GPL. If you do not delete the ++ * provisions above, a recipient may use your version of this file ++ * under either the MPL or the GPL. ++ */ ++ ++#define DRIVER_NAME "orinoco_pci" ++#define PFX DRIVER_NAME ": " ++ ++#include <linux/module.h> ++#include <linux/kernel.h> ++#include <linux/init.h> ++#include <linux/delay.h> ++#include <linux/pci.h> ++ ++#include "orinoco.h" ++#include "orinoco_pci.h" ++ ++/* Offset of the COR register of the PCI card */ ++#define HERMES_PCI_COR (0x26) ++ ++/* Bitmask to reset the card */ ++#define HERMES_PCI_COR_MASK (0x0080) ++ ++/* Magic timeouts for doing the reset. ++ * Those times are straight from wlan-ng, and it is claimed that they ++ * are necessary. Alan will kill me. Take your time and grab a coffee. */ ++#define HERMES_PCI_COR_ONT (250) /* ms */ ++#define HERMES_PCI_COR_OFFT (500) /* ms */ ++#define HERMES_PCI_COR_BUSYT (500) /* ms */ ++ ++/* ++ * Do a soft reset of the card using the Configuration Option Register ++ * We need this to get going... ++ * This is the part of the code that is strongly inspired from wlan-ng ++ * ++ * Note : This code is done with irq enabled. This mean that many ++ * interrupts will occur while we are there. This is why we use the ++ * jiffies to regulate time instead of a straight mdelay(). Usually we ++ * need only around 245 iteration of the loop to do 250 ms delay. ++ * ++ * Note bis : Don't try to access HERMES_CMD during the reset phase. ++ * It just won't work ! ++ */ ++static int orinoco_pci_cor_reset(struct orinoco_private *priv) ++{ ++ struct hermes *hw = &priv->hw; ++ unsigned long timeout; ++ u16 reg; ++ ++ /* Assert the reset until the card notices */ ++ hermes_write_regn(hw, PCI_COR, HERMES_PCI_COR_MASK); ++ mdelay(HERMES_PCI_COR_ONT); ++ ++ /* Give time for the card to recover from this hard effort */ ++ hermes_write_regn(hw, PCI_COR, 0x0000); ++ mdelay(HERMES_PCI_COR_OFFT); ++ ++ /* The card is ready when it's no longer busy */ ++ timeout = jiffies + msecs_to_jiffies(HERMES_PCI_COR_BUSYT); ++ reg = hermes_read_regn(hw, CMD); ++ while (time_before(jiffies, timeout) && (reg & HERMES_CMD_BUSY)) { ++ mdelay(1); ++ reg = hermes_read_regn(hw, CMD); ++ } ++ ++ /* Still busy? */ ++ if (reg & HERMES_CMD_BUSY) { ++ printk(KERN_ERR PFX "Busy timeout\n"); ++ return -ETIMEDOUT; ++ } ++ ++ return 0; ++} ++ ++static int orinoco_pci_init_one(struct pci_dev *pdev, ++ const struct pci_device_id *ent) ++{ ++ int err; ++ struct orinoco_private *priv; ++ struct orinoco_pci_card *card; ++ void __iomem *hermes_io; ++ ++ err = pci_enable_device(pdev); ++ if (err) { ++ printk(KERN_ERR PFX "Cannot enable PCI device\n"); ++ return err; ++ } ++ ++ err = pci_request_regions(pdev, DRIVER_NAME); ++ if (err) { ++ printk(KERN_ERR PFX "Cannot obtain PCI resources\n"); ++ goto fail_resources; ++ } ++ ++ hermes_io = pci_iomap(pdev, 0, 0); ++ if (!hermes_io) { ++ printk(KERN_ERR PFX "Cannot remap chipset registers\n"); ++ err = -EIO; ++ goto fail_map_hermes; ++ } ++ ++ /* Allocate network device */ ++ priv = alloc_orinocodev(sizeof(*card), &pdev->dev, ++ orinoco_pci_cor_reset, NULL); ++ if (!priv) { ++ printk(KERN_ERR PFX "Cannot allocate network device\n"); ++ err = -ENOMEM; ++ goto fail_alloc; ++ } ++ ++ card = priv->card; ++ ++ hermes_struct_init(&priv->hw, hermes_io, HERMES_32BIT_REGSPACING); ++ ++ err = request_irq(pdev->irq, orinoco_interrupt, IRQF_SHARED, ++ DRIVER_NAME, priv); ++ if (err) { ++ printk(KERN_ERR PFX "Cannot allocate IRQ %d\n", pdev->irq); ++ err = -EBUSY; ++ goto fail_irq; ++ } ++ ++ err = orinoco_pci_cor_reset(priv); ++ if (err) { ++ printk(KERN_ERR PFX "Initial reset failed\n"); ++ goto fail; ++ } ++ ++ err = orinoco_init(priv); ++ if (err) { ++ printk(KERN_ERR PFX "orinoco_init() failed\n"); ++ goto fail; ++ } ++ ++ err = orinoco_if_add(priv, 0, 0, NULL); ++ if (err) { ++ printk(KERN_ERR PFX "orinoco_if_add() failed\n"); ++ goto fail_wiphy; ++ } ++ ++ pci_set_drvdata(pdev, priv); ++ ++ return 0; ++ ++ fail_wiphy: ++ wiphy_unregister(priv_to_wiphy(priv)); ++ fail: ++ free_irq(pdev->irq, priv); ++ ++ fail_irq: ++ free_orinocodev(priv); ++ ++ fail_alloc: ++ pci_iounmap(pdev, hermes_io); ++ ++ fail_map_hermes: ++ pci_release_regions(pdev); ++ ++ fail_resources: ++ pci_disable_device(pdev); ++ ++ return err; ++} ++ ++static void orinoco_pci_remove_one(struct pci_dev *pdev) ++{ ++ struct orinoco_private *priv = pci_get_drvdata(pdev); ++ ++ orinoco_if_del(priv); ++ wiphy_unregister(priv_to_wiphy(priv)); ++ free_irq(pdev->irq, priv); ++ free_orinocodev(priv); ++ pci_iounmap(pdev, priv->hw.iobase); ++ pci_release_regions(pdev); ++ pci_disable_device(pdev); ++} ++ ++static const struct pci_device_id orinoco_pci_id_table[] = { ++ /* Intersil Prism 3 */ ++ {0x1260, 0x3872, PCI_ANY_ID, PCI_ANY_ID,}, ++ /* Intersil Prism 2.5 */ ++ {0x1260, 0x3873, PCI_ANY_ID, PCI_ANY_ID,}, ++ /* Samsung MagicLAN SWL-2210P */ ++ {0x167d, 0xa000, PCI_ANY_ID, PCI_ANY_ID,}, ++ {0,}, ++}; ++ ++MODULE_DEVICE_TABLE(pci, orinoco_pci_id_table); ++ ++static struct pci_driver orinoco_pci_driver = { ++ .name = DRIVER_NAME, ++ .id_table = orinoco_pci_id_table, ++ .probe = orinoco_pci_init_one, ++ .remove = orinoco_pci_remove_one, ++ .driver.pm = &orinoco_pci_pm_ops, ++}; ++ ++static char version[] __initdata = DRIVER_NAME " " DRIVER_VERSION ++ " (Pavel Roskin <proski@gnu.org>," ++ " David Gibson <hermes@gibson.dropbear.id.au> &" ++ " Jean Tourrilhes <jt@hpl.hp.com>)"; ++MODULE_AUTHOR("Pavel Roskin <proski@gnu.org> &" ++ " David Gibson <hermes@gibson.dropbear.id.au>"); ++MODULE_DESCRIPTION("Driver for wireless LAN cards using direct PCI interface"); ++MODULE_LICENSE("Dual MPL/GPL"); ++ ++static int __init orinoco_pci_init(void) ++{ ++ printk(KERN_DEBUG "%s\n", version); ++ return pci_register_driver(&orinoco_pci_driver); ++} ++ ++static void __exit orinoco_pci_exit(void) ++{ ++ pci_unregister_driver(&orinoco_pci_driver); ++} ++ ++module_init(orinoco_pci_init); ++module_exit(orinoco_pci_exit); +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/orinoco_pci.h linux-6.15.6/drivers/net/wireless/intersil/orinoco/orinoco_pci.h +--- linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/orinoco_pci.h 1970-01-01 01:00:00.000000000 +0100 ++++ linux-6.15.6/drivers/net/wireless/intersil/orinoco/orinoco_pci.h 2025-08-03 15:01:59.365130178 +0200 +@@ -0,0 +1,54 @@ ++/* orinoco_pci.h ++ * ++ * Common code for all Orinoco drivers for PCI devices, including ++ * both native PCI and PCMCIA-to-PCI bridges. ++ * ++ * Copyright (C) 2005, Pavel Roskin. ++ * See main.c for license. ++ */ ++ ++#ifndef _ORINOCO_PCI_H ++#define _ORINOCO_PCI_H ++ ++#include <linux/netdevice.h> ++ ++/* Driver specific data */ ++struct orinoco_pci_card { ++ void __iomem *bridge_io; ++ void __iomem *attr_io; ++}; ++ ++static int __maybe_unused orinoco_pci_suspend(struct device *dev_d) ++{ ++ struct pci_dev *pdev = to_pci_dev(dev_d); ++ struct orinoco_private *priv = pci_get_drvdata(pdev); ++ ++ orinoco_down(priv); ++ free_irq(pdev->irq, priv); ++ ++ return 0; ++} ++ ++static int __maybe_unused orinoco_pci_resume(struct device *dev_d) ++{ ++ struct pci_dev *pdev = to_pci_dev(dev_d); ++ struct orinoco_private *priv = pci_get_drvdata(pdev); ++ struct net_device *dev = priv->ndev; ++ int err; ++ ++ err = request_irq(pdev->irq, orinoco_interrupt, IRQF_SHARED, ++ dev->name, priv); ++ if (err) { ++ printk(KERN_ERR "%s: cannot re-allocate IRQ on resume\n", ++ dev->name); ++ return -EBUSY; ++ } ++ ++ return orinoco_up(priv); ++} ++ ++static SIMPLE_DEV_PM_OPS(orinoco_pci_pm_ops, ++ orinoco_pci_suspend, ++ orinoco_pci_resume); ++ ++#endif /* _ORINOCO_PCI_H */ +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/orinoco_plx.c linux-6.15.6/drivers/net/wireless/intersil/orinoco/orinoco_plx.c +--- linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/orinoco_plx.c 1970-01-01 01:00:00.000000000 +0100 ++++ linux-6.15.6/drivers/net/wireless/intersil/orinoco/orinoco_plx.c 2025-08-03 15:01:59.365130178 +0200 +@@ -0,0 +1,362 @@ ++/* orinoco_plx.c ++ * ++ * Driver for Prism II devices which would usually be driven by orinoco_cs, ++ * but are connected to the PCI bus by a PLX9052. ++ * ++ * Current maintainers are: ++ * Pavel Roskin <proski AT gnu.org> ++ * and David Gibson <hermes AT gibson.dropbear.id.au> ++ * ++ * (C) Copyright David Gibson, IBM Corp. 2001-2003. ++ * Copyright (C) 2001 Daniel Barlow ++ * ++ * The contents of this file are subject to the Mozilla Public License ++ * Version 1.1 (the "License"); you may not use this file except in ++ * compliance with the License. You may obtain a copy of the License ++ * at http://www.mozilla.org/MPL/ ++ * ++ * Software distributed under the License is distributed on an "AS IS" ++ * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See ++ * the License for the specific language governing rights and ++ * limitations under the License. ++ * ++ * Alternatively, the contents of this file may be used under the ++ * terms of the GNU General Public License version 2 (the "GPL"), in ++ * which case the provisions of the GPL are applicable instead of the ++ * above. If you wish to allow the use of your version of this file ++ * only under the terms of the GPL and not to allow others to use your ++ * version of this file under the MPL, indicate your decision by ++ * deleting the provisions above and replace them with the notice and ++ * other provisions required by the GPL. If you do not delete the ++ * provisions above, a recipient may use your version of this file ++ * under either the MPL or the GPL. ++ * ++ * Here's the general details on how the PLX9052 adapter works: ++ * ++ * - Two PCI I/O address spaces, one 0x80 long which contains the ++ * PLX9052 registers, and one that's 0x40 long mapped to the PCMCIA ++ * slot I/O address space. ++ * ++ * - One PCI memory address space, mapped to the PCMCIA attribute space ++ * (containing the CIS). ++ * ++ * Using the later, you can read through the CIS data to make sure the ++ * card is compatible with the driver. Keep in mind that the PCMCIA ++ * spec specifies the CIS as the lower 8 bits of each word read from ++ * the CIS, so to read the bytes of the CIS, read every other byte ++ * (0,2,4,...). Passing that test, you need to enable the I/O address ++ * space on the PCMCIA card via the PCMCIA COR register. This is the ++ * first byte following the CIS. In my case (which may not have any ++ * relation to what's on the PRISM2 cards), COR was at offset 0x800 ++ * within the PCI memory space. Write 0x41 to the COR register to ++ * enable I/O mode and to select level triggered interrupts. To ++ * confirm you actually succeeded, read the COR register back and make ++ * sure it actually got set to 0x41, in case you have an unexpected ++ * card inserted. ++ * ++ * Following that, you can treat the second PCI I/O address space (the ++ * one that's not 0x80 in length) as the PCMCIA I/O space. ++ * ++ * Note that in the Eumitcom's source for their drivers, they register ++ * the interrupt as edge triggered when registering it with the ++ * Windows kernel. I don't recall how to register edge triggered on ++ * Linux (if it can be done at all). But in some experimentation, I ++ * don't see much operational difference between using either ++ * interrupt mode. Don't mess with the interrupt mode in the COR ++ * register though, as the PLX9052 wants level triggers with the way ++ * the serial EEPROM configures it on the WL11000. ++ * ++ * There's some other little quirks related to timing that I bumped ++ * into, but I don't recall right now. Also, there's two variants of ++ * the WL11000 I've seen, revision A1 and T2. These seem to differ ++ * slightly in the timings configured in the wait-state generator in ++ * the PLX9052. There have also been some comments from Eumitcom that ++ * cards shouldn't be hot swapped, apparently due to risk of cooking ++ * the PLX9052. I'm unsure why they believe this, as I can't see ++ * anything in the design that would really cause a problem, except ++ * for crashing drivers not written to expect it. And having developed ++ * drivers for the WL11000, I'd say it's quite tricky to write code ++ * that will successfully deal with a hot unplug. Very odd things ++ * happen on the I/O side of things. But anyway, be warned. Despite ++ * that, I've hot-swapped a number of times during debugging and ++ * driver development for various reasons (stuck WAIT# line after the ++ * radio card's firmware locks up). ++ */ ++ ++#define DRIVER_NAME "orinoco_plx" ++#define PFX DRIVER_NAME ": " ++ ++#include <linux/module.h> ++#include <linux/kernel.h> ++#include <linux/init.h> ++#include <linux/delay.h> ++#include <linux/pci.h> ++#include <pcmcia/cisreg.h> ++ ++#include "orinoco.h" ++#include "orinoco_pci.h" ++ ++#define COR_OFFSET (0x3e0) /* COR attribute offset of Prism2 PC card */ ++#define COR_VALUE (COR_LEVEL_REQ | COR_FUNC_ENA) /* Enable PC card with interrupt in level trigger */ ++#define COR_RESET (0x80) /* reset bit in the COR register */ ++#define PLX_RESET_TIME (500) /* milliseconds */ ++ ++#define PLX_INTCSR 0x4c /* Interrupt Control & Status Register */ ++#define PLX_INTCSR_INTEN (1 << 6) /* Interrupt Enable bit */ ++ ++/* ++ * Do a soft reset of the card using the Configuration Option Register ++ */ ++static int orinoco_plx_cor_reset(struct orinoco_private *priv) ++{ ++ struct hermes *hw = &priv->hw; ++ struct orinoco_pci_card *card = priv->card; ++ unsigned long timeout; ++ u16 reg; ++ ++ iowrite8(COR_VALUE | COR_RESET, card->attr_io + COR_OFFSET); ++ mdelay(1); ++ ++ iowrite8(COR_VALUE, card->attr_io + COR_OFFSET); ++ mdelay(1); ++ ++ /* Just in case, wait more until the card is no longer busy */ ++ timeout = jiffies + msecs_to_jiffies(PLX_RESET_TIME); ++ reg = hermes_read_regn(hw, CMD); ++ while (time_before(jiffies, timeout) && (reg & HERMES_CMD_BUSY)) { ++ mdelay(1); ++ reg = hermes_read_regn(hw, CMD); ++ } ++ ++ /* Still busy? */ ++ if (reg & HERMES_CMD_BUSY) { ++ printk(KERN_ERR PFX "Busy timeout\n"); ++ return -ETIMEDOUT; ++ } ++ ++ return 0; ++} ++ ++static int orinoco_plx_hw_init(struct orinoco_pci_card *card) ++{ ++ int i; ++ u32 csr_reg; ++ static const u8 cis_magic[] = { ++ 0x01, 0x03, 0x00, 0x00, 0xff, 0x17, 0x04, 0x67 ++ }; ++ ++ printk(KERN_DEBUG PFX "CIS: "); ++ for (i = 0; i < 16; i++) ++ printk("%02X:", ioread8(card->attr_io + (i << 1))); ++ printk("\n"); ++ ++ /* Verify whether a supported PC card is present */ ++ /* FIXME: we probably need to be smarted about this */ ++ for (i = 0; i < sizeof(cis_magic); i++) { ++ if (cis_magic[i] != ioread8(card->attr_io + (i << 1))) { ++ printk(KERN_ERR PFX "The CIS value of Prism2 PC " ++ "card is unexpected\n"); ++ return -ENODEV; ++ } ++ } ++ ++ /* bjoern: We need to tell the card to enable interrupts, in ++ case the serial eprom didn't do this already. See the ++ PLX9052 data book, p8-1 and 8-24 for reference. */ ++ csr_reg = ioread32(card->bridge_io + PLX_INTCSR); ++ if (!(csr_reg & PLX_INTCSR_INTEN)) { ++ csr_reg |= PLX_INTCSR_INTEN; ++ iowrite32(csr_reg, card->bridge_io + PLX_INTCSR); ++ csr_reg = ioread32(card->bridge_io + PLX_INTCSR); ++ if (!(csr_reg & PLX_INTCSR_INTEN)) { ++ printk(KERN_ERR PFX "Cannot enable interrupts\n"); ++ return -EIO; ++ } ++ } ++ ++ return 0; ++} ++ ++static int orinoco_plx_init_one(struct pci_dev *pdev, ++ const struct pci_device_id *ent) ++{ ++ int err; ++ struct orinoco_private *priv; ++ struct orinoco_pci_card *card; ++ void __iomem *hermes_io, *attr_io, *bridge_io; ++ ++ err = pci_enable_device(pdev); ++ if (err) { ++ printk(KERN_ERR PFX "Cannot enable PCI device\n"); ++ return err; ++ } ++ ++ err = pci_request_regions(pdev, DRIVER_NAME); ++ if (err) { ++ printk(KERN_ERR PFX "Cannot obtain PCI resources\n"); ++ goto fail_resources; ++ } ++ ++ bridge_io = pci_iomap(pdev, 1, 0); ++ if (!bridge_io) { ++ printk(KERN_ERR PFX "Cannot map bridge registers\n"); ++ err = -EIO; ++ goto fail_map_bridge; ++ } ++ ++ attr_io = pci_iomap(pdev, 2, 0); ++ if (!attr_io) { ++ printk(KERN_ERR PFX "Cannot map PCMCIA attributes\n"); ++ err = -EIO; ++ goto fail_map_attr; ++ } ++ ++ hermes_io = pci_iomap(pdev, 3, 0); ++ if (!hermes_io) { ++ printk(KERN_ERR PFX "Cannot map chipset registers\n"); ++ err = -EIO; ++ goto fail_map_hermes; ++ } ++ ++ /* Allocate network device */ ++ priv = alloc_orinocodev(sizeof(*card), &pdev->dev, ++ orinoco_plx_cor_reset, NULL); ++ if (!priv) { ++ printk(KERN_ERR PFX "Cannot allocate network device\n"); ++ err = -ENOMEM; ++ goto fail_alloc; ++ } ++ ++ card = priv->card; ++ card->bridge_io = bridge_io; ++ card->attr_io = attr_io; ++ ++ hermes_struct_init(&priv->hw, hermes_io, HERMES_16BIT_REGSPACING); ++ ++ err = request_irq(pdev->irq, orinoco_interrupt, IRQF_SHARED, ++ DRIVER_NAME, priv); ++ if (err) { ++ printk(KERN_ERR PFX "Cannot allocate IRQ %d\n", pdev->irq); ++ err = -EBUSY; ++ goto fail_irq; ++ } ++ ++ err = orinoco_plx_hw_init(card); ++ if (err) { ++ printk(KERN_ERR PFX "Hardware initialization failed\n"); ++ goto fail; ++ } ++ ++ err = orinoco_plx_cor_reset(priv); ++ if (err) { ++ printk(KERN_ERR PFX "Initial reset failed\n"); ++ goto fail; ++ } ++ ++ err = orinoco_init(priv); ++ if (err) { ++ printk(KERN_ERR PFX "orinoco_init() failed\n"); ++ goto fail; ++ } ++ ++ err = orinoco_if_add(priv, 0, 0, NULL); ++ if (err) { ++ printk(KERN_ERR PFX "orinoco_if_add() failed\n"); ++ goto fail_wiphy; ++ } ++ ++ pci_set_drvdata(pdev, priv); ++ ++ return 0; ++ ++ fail_wiphy: ++ wiphy_unregister(priv_to_wiphy(priv)); ++ fail: ++ free_irq(pdev->irq, priv); ++ ++ fail_irq: ++ free_orinocodev(priv); ++ ++ fail_alloc: ++ pci_iounmap(pdev, hermes_io); ++ ++ fail_map_hermes: ++ pci_iounmap(pdev, attr_io); ++ ++ fail_map_attr: ++ pci_iounmap(pdev, bridge_io); ++ ++ fail_map_bridge: ++ pci_release_regions(pdev); ++ ++ fail_resources: ++ pci_disable_device(pdev); ++ ++ return err; ++} ++ ++static void orinoco_plx_remove_one(struct pci_dev *pdev) ++{ ++ struct orinoco_private *priv = pci_get_drvdata(pdev); ++ struct orinoco_pci_card *card = priv->card; ++ ++ orinoco_if_del(priv); ++ wiphy_unregister(priv_to_wiphy(priv)); ++ free_irq(pdev->irq, priv); ++ free_orinocodev(priv); ++ pci_iounmap(pdev, priv->hw.iobase); ++ pci_iounmap(pdev, card->attr_io); ++ pci_iounmap(pdev, card->bridge_io); ++ pci_release_regions(pdev); ++ pci_disable_device(pdev); ++} ++ ++static const struct pci_device_id orinoco_plx_id_table[] = { ++ {0x111a, 0x1023, PCI_ANY_ID, PCI_ANY_ID,}, /* Siemens SpeedStream SS1023 */ ++ {0x1385, 0x4100, PCI_ANY_ID, PCI_ANY_ID,}, /* Netgear MA301 */ ++ {0x15e8, 0x0130, PCI_ANY_ID, PCI_ANY_ID,}, /* Correga - does this work? */ ++ {0x1638, 0x1100, PCI_ANY_ID, PCI_ANY_ID,}, /* SMC EZConnect SMC2602W, ++ Eumitcom PCI WL11000, ++ Addtron AWA-100 */ ++ {0x16ab, 0x1100, PCI_ANY_ID, PCI_ANY_ID,}, /* Global Sun Tech GL24110P */ ++ {0x16ab, 0x1101, PCI_ANY_ID, PCI_ANY_ID,}, /* Reported working, but unknown */ ++ {0x16ab, 0x1102, PCI_ANY_ID, PCI_ANY_ID,}, /* Linksys WDT11 */ ++ {0x16ec, 0x3685, PCI_ANY_ID, PCI_ANY_ID,}, /* USR 2415 */ ++ {0xec80, 0xec00, PCI_ANY_ID, PCI_ANY_ID,}, /* Belkin F5D6000 tested by ++ Brendan W. McAdams <rit AT jacked-in.org> */ ++ {0x10b7, 0x7770, PCI_ANY_ID, PCI_ANY_ID,}, /* 3Com AirConnect PCI tested by ++ Damien Persohn <damien AT persohn.net> */ ++ {0,}, ++}; ++ ++MODULE_DEVICE_TABLE(pci, orinoco_plx_id_table); ++ ++static struct pci_driver orinoco_plx_driver = { ++ .name = DRIVER_NAME, ++ .id_table = orinoco_plx_id_table, ++ .probe = orinoco_plx_init_one, ++ .remove = orinoco_plx_remove_one, ++ .driver.pm = &orinoco_pci_pm_ops, ++}; ++ ++static char version[] __initdata = DRIVER_NAME " " DRIVER_VERSION ++ " (Pavel Roskin <proski@gnu.org>," ++ " David Gibson <hermes@gibson.dropbear.id.au>," ++ " Daniel Barlow <dan@telent.net>)"; ++MODULE_AUTHOR("Daniel Barlow <dan@telent.net>"); ++MODULE_DESCRIPTION("Driver for wireless LAN cards using the PLX9052 PCI bridge"); ++MODULE_LICENSE("Dual MPL/GPL"); ++ ++static int __init orinoco_plx_init(void) ++{ ++ printk(KERN_DEBUG "%s\n", version); ++ return pci_register_driver(&orinoco_plx_driver); ++} ++ ++static void __exit orinoco_plx_exit(void) ++{ ++ pci_unregister_driver(&orinoco_plx_driver); ++} ++ ++module_init(orinoco_plx_init); ++module_exit(orinoco_plx_exit); +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/orinoco_tmd.c linux-6.15.6/drivers/net/wireless/intersil/orinoco/orinoco_tmd.c +--- linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/orinoco_tmd.c 1970-01-01 01:00:00.000000000 +0100 ++++ linux-6.15.6/drivers/net/wireless/intersil/orinoco/orinoco_tmd.c 2025-08-03 15:01:59.365130178 +0200 +@@ -0,0 +1,237 @@ ++/* orinoco_tmd.c ++ * ++ * Driver for Prism II devices which would usually be driven by orinoco_cs, ++ * but are connected to the PCI bus by a TMD7160. ++ * ++ * Copyright (C) 2003 Joerg Dorchain <joerg AT dorchain.net> ++ * based heavily upon orinoco_plx.c Copyright (C) 2001 Daniel Barlow ++ * ++ * The contents of this file are subject to the Mozilla Public License ++ * Version 1.1 (the "License"); you may not use this file except in ++ * compliance with the License. You may obtain a copy of the License ++ * at http://www.mozilla.org/MPL/ ++ * ++ * Software distributed under the License is distributed on an "AS IS" ++ * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See ++ * the License for the specific language governing rights and ++ * limitations under the License. ++ * ++ * Alternatively, the contents of this file may be used under the ++ * terms of the GNU General Public License version 2 (the "GPL"), in ++ * which case the provisions of the GPL are applicable instead of the ++ * above. If you wish to allow the use of your version of this file ++ * only under the terms of the GPL and not to allow others to use your ++ * version of this file under the MPL, indicate your decision by ++ * deleting the provisions above and replace them with the notice and ++ * other provisions required by the GPL. If you do not delete the ++ * provisions above, a recipient may use your version of this file ++ * under either the MPL or the GPL. ++ * ++ * The actual driving is done by main.c, this is just resource ++ * allocation stuff. ++ * ++ * This driver is modeled after the orinoco_plx driver. The main ++ * difference is that the TMD chip has only IO port ranges and doesn't ++ * provide access to the PCMCIA attribute space. ++ * ++ * Pheecom sells cards with the TMD chip as "ASIC version" ++ */ ++ ++#define DRIVER_NAME "orinoco_tmd" ++#define PFX DRIVER_NAME ": " ++ ++#include <linux/module.h> ++#include <linux/kernel.h> ++#include <linux/init.h> ++#include <linux/delay.h> ++#include <linux/pci.h> ++#include <pcmcia/cisreg.h> ++ ++#include "orinoco.h" ++#include "orinoco_pci.h" ++ ++#define COR_VALUE (COR_LEVEL_REQ | COR_FUNC_ENA) /* Enable PC card with interrupt in level trigger */ ++#define COR_RESET (0x80) /* reset bit in the COR register */ ++#define TMD_RESET_TIME (500) /* milliseconds */ ++ ++/* ++ * Do a soft reset of the card using the Configuration Option Register ++ */ ++static int orinoco_tmd_cor_reset(struct orinoco_private *priv) ++{ ++ struct hermes *hw = &priv->hw; ++ struct orinoco_pci_card *card = priv->card; ++ unsigned long timeout; ++ u16 reg; ++ ++ iowrite8(COR_VALUE | COR_RESET, card->bridge_io); ++ mdelay(1); ++ ++ iowrite8(COR_VALUE, card->bridge_io); ++ mdelay(1); ++ ++ /* Just in case, wait more until the card is no longer busy */ ++ timeout = jiffies + msecs_to_jiffies(TMD_RESET_TIME); ++ reg = hermes_read_regn(hw, CMD); ++ while (time_before(jiffies, timeout) && (reg & HERMES_CMD_BUSY)) { ++ mdelay(1); ++ reg = hermes_read_regn(hw, CMD); ++ } ++ ++ /* Still busy? */ ++ if (reg & HERMES_CMD_BUSY) { ++ printk(KERN_ERR PFX "Busy timeout\n"); ++ return -ETIMEDOUT; ++ } ++ ++ return 0; ++} ++ ++ ++static int orinoco_tmd_init_one(struct pci_dev *pdev, ++ const struct pci_device_id *ent) ++{ ++ int err; ++ struct orinoco_private *priv; ++ struct orinoco_pci_card *card; ++ void __iomem *hermes_io, *bridge_io; ++ ++ err = pci_enable_device(pdev); ++ if (err) { ++ printk(KERN_ERR PFX "Cannot enable PCI device\n"); ++ return err; ++ } ++ ++ err = pci_request_regions(pdev, DRIVER_NAME); ++ if (err) { ++ printk(KERN_ERR PFX "Cannot obtain PCI resources\n"); ++ goto fail_resources; ++ } ++ ++ bridge_io = pci_iomap(pdev, 1, 0); ++ if (!bridge_io) { ++ printk(KERN_ERR PFX "Cannot map bridge registers\n"); ++ err = -EIO; ++ goto fail_map_bridge; ++ } ++ ++ hermes_io = pci_iomap(pdev, 2, 0); ++ if (!hermes_io) { ++ printk(KERN_ERR PFX "Cannot map chipset registers\n"); ++ err = -EIO; ++ goto fail_map_hermes; ++ } ++ ++ /* Allocate network device */ ++ priv = alloc_orinocodev(sizeof(*card), &pdev->dev, ++ orinoco_tmd_cor_reset, NULL); ++ if (!priv) { ++ printk(KERN_ERR PFX "Cannot allocate network device\n"); ++ err = -ENOMEM; ++ goto fail_alloc; ++ } ++ ++ card = priv->card; ++ card->bridge_io = bridge_io; ++ ++ hermes_struct_init(&priv->hw, hermes_io, HERMES_16BIT_REGSPACING); ++ ++ err = request_irq(pdev->irq, orinoco_interrupt, IRQF_SHARED, ++ DRIVER_NAME, priv); ++ if (err) { ++ printk(KERN_ERR PFX "Cannot allocate IRQ %d\n", pdev->irq); ++ err = -EBUSY; ++ goto fail_irq; ++ } ++ ++ err = orinoco_tmd_cor_reset(priv); ++ if (err) { ++ printk(KERN_ERR PFX "Initial reset failed\n"); ++ goto fail; ++ } ++ ++ err = orinoco_init(priv); ++ if (err) { ++ printk(KERN_ERR PFX "orinoco_init() failed\n"); ++ goto fail; ++ } ++ ++ err = orinoco_if_add(priv, 0, 0, NULL); ++ if (err) { ++ printk(KERN_ERR PFX "orinoco_if_add() failed\n"); ++ goto fail; ++ } ++ ++ pci_set_drvdata(pdev, priv); ++ ++ return 0; ++ ++ fail: ++ free_irq(pdev->irq, priv); ++ ++ fail_irq: ++ free_orinocodev(priv); ++ ++ fail_alloc: ++ pci_iounmap(pdev, hermes_io); ++ ++ fail_map_hermes: ++ pci_iounmap(pdev, bridge_io); ++ ++ fail_map_bridge: ++ pci_release_regions(pdev); ++ ++ fail_resources: ++ pci_disable_device(pdev); ++ ++ return err; ++} ++ ++static void orinoco_tmd_remove_one(struct pci_dev *pdev) ++{ ++ struct orinoco_private *priv = pci_get_drvdata(pdev); ++ struct orinoco_pci_card *card = priv->card; ++ ++ orinoco_if_del(priv); ++ free_irq(pdev->irq, priv); ++ free_orinocodev(priv); ++ pci_iounmap(pdev, priv->hw.iobase); ++ pci_iounmap(pdev, card->bridge_io); ++ pci_release_regions(pdev); ++ pci_disable_device(pdev); ++} ++ ++static const struct pci_device_id orinoco_tmd_id_table[] = { ++ {0x15e8, 0x0131, PCI_ANY_ID, PCI_ANY_ID,}, /* NDC and OEMs, e.g. pheecom */ ++ {0,}, ++}; ++ ++MODULE_DEVICE_TABLE(pci, orinoco_tmd_id_table); ++ ++static struct pci_driver orinoco_tmd_driver = { ++ .name = DRIVER_NAME, ++ .id_table = orinoco_tmd_id_table, ++ .probe = orinoco_tmd_init_one, ++ .remove = orinoco_tmd_remove_one, ++ .driver.pm = &orinoco_pci_pm_ops, ++}; ++ ++static char version[] __initdata = DRIVER_NAME " " DRIVER_VERSION ++ " (Joerg Dorchain <joerg@dorchain.net>)"; ++MODULE_AUTHOR("Joerg Dorchain <joerg@dorchain.net>"); ++MODULE_DESCRIPTION("Driver for wireless LAN cards using the TMD7160 PCI bridge"); ++MODULE_LICENSE("Dual MPL/GPL"); ++ ++static int __init orinoco_tmd_init(void) ++{ ++ printk(KERN_DEBUG "%s\n", version); ++ return pci_register_driver(&orinoco_tmd_driver); ++} ++ ++static void __exit orinoco_tmd_exit(void) ++{ ++ pci_unregister_driver(&orinoco_tmd_driver); ++} ++ ++module_init(orinoco_tmd_init); ++module_exit(orinoco_tmd_exit); +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/orinoco_usb.c linux-6.15.6/drivers/net/wireless/intersil/orinoco/orinoco_usb.c +--- linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/orinoco_usb.c 1970-01-01 01:00:00.000000000 +0100 ++++ linux-6.15.6/drivers/net/wireless/intersil/orinoco/orinoco_usb.c 2025-08-03 15:01:59.365130178 +0200 +@@ -0,0 +1,1787 @@ ++/* ++ * USB Orinoco driver ++ * ++ * Copyright (c) 2003 Manuel Estrada Sainz ++ * ++ * The contents of this file are subject to the Mozilla Public License ++ * Version 1.1 (the "License"); you may not use this file except in ++ * compliance with the License. You may obtain a copy of the License ++ * at http://www.mozilla.org/MPL/ ++ * ++ * Software distributed under the License is distributed on an "AS IS" ++ * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See ++ * the License for the specific language governing rights and ++ * limitations under the License. ++ * ++ * Alternatively, the contents of this file may be used under the ++ * terms of the GNU General Public License version 2 (the "GPL"), in ++ * which case the provisions of the GPL are applicable instead of the ++ * above. If you wish to allow the use of your version of this file ++ * only under the terms of the GPL and not to allow others to use your ++ * version of this file under the MPL, indicate your decision by ++ * deleting the provisions above and replace them with the notice and ++ * other provisions required by the GPL. If you do not delete the ++ * provisions above, a recipient may use your version of this file ++ * under either the MPL or the GPL. ++ * ++ * Queueing code based on linux-wlan-ng 0.2.1-pre5 ++ * ++ * Copyright (C) 1999 AbsoluteValue Systems, Inc. All Rights Reserved. ++ * ++ * The license is the same as above. ++ * ++ * Initialy based on USB Skeleton driver - 0.7 ++ * ++ * Copyright (c) 2001 Greg Kroah-Hartman (greg@kroah.com) ++ * ++ * This program is free software; you can redistribute it and/or ++ * modify it under the terms of the GNU General Public License as ++ * published by the Free Software Foundation; either version 2 of ++ * the License, or (at your option) any later version. ++ * ++ * NOTE: The original USB Skeleton driver is GPL, but all that code is ++ * gone so MPL/GPL applies. ++ */ ++ ++#define DRIVER_NAME "orinoco_usb" ++#define PFX DRIVER_NAME ": " ++ ++#include <linux/module.h> ++#include <linux/kernel.h> ++#include <linux/sched.h> ++#include <linux/signal.h> ++#include <linux/errno.h> ++#include <linux/poll.h> ++#include <linux/slab.h> ++#include <linux/fcntl.h> ++#include <linux/spinlock.h> ++#include <linux/list.h> ++#include <linux/usb.h> ++#include <linux/timer.h> ++ ++#include <linux/netdevice.h> ++#include <linux/if_arp.h> ++#include <linux/etherdevice.h> ++#include <linux/wireless.h> ++#include <linux/firmware.h> ++#include <linux/refcount.h> ++ ++#include "mic.h" ++#include "orinoco.h" ++ ++#ifndef URB_ASYNC_UNLINK ++#define URB_ASYNC_UNLINK 0 ++#endif ++ ++struct header_struct { ++ /* 802.3 */ ++ u8 dest[ETH_ALEN]; ++ u8 src[ETH_ALEN]; ++ __be16 len; ++ /* 802.2 */ ++ u8 dsap; ++ u8 ssap; ++ u8 ctrl; ++ /* SNAP */ ++ u8 oui[3]; ++ __be16 ethertype; ++} __packed; ++ ++struct ez_usb_fw { ++ u16 size; ++ const u8 *code; ++}; ++ ++static struct ez_usb_fw firmware = { ++ .size = 0, ++ .code = NULL, ++}; ++ ++/* Debugging macros */ ++#undef err ++#define err(format, arg...) \ ++ do { printk(KERN_ERR PFX format "\n", ## arg); } while (0) ++ ++MODULE_FIRMWARE("orinoco_ezusb_fw"); ++ ++/* ++ * Under some conditions, the card gets stuck and stops paying attention ++ * to the world (i.e. data communication stalls) until we do something to ++ * it. Sending an INQ_TALLIES command seems to be enough and should be ++ * harmless otherwise. This behaviour has been observed when using the ++ * driver on a systemimager client during installation. In the past a ++ * timer was used to send INQ_TALLIES commands when there was no other ++ * activity, but it was troublesome and was removed. ++ */ ++ ++#define USB_COMPAQ_VENDOR_ID 0x049f /* Compaq Computer Corp. */ ++#define USB_COMPAQ_WL215_ID 0x001f /* Compaq WL215 USB Adapter */ ++#define USB_COMPAQ_W200_ID 0x0076 /* Compaq W200 USB Adapter */ ++#define USB_HP_WL215_ID 0x0082 /* Compaq WL215 USB Adapter */ ++ ++#define USB_MELCO_VENDOR_ID 0x0411 ++#define USB_BUFFALO_L11_ID 0x0006 /* BUFFALO WLI-USB-L11 */ ++#define USB_BUFFALO_L11G_WR_ID 0x000B /* BUFFALO WLI-USB-L11G-WR */ ++#define USB_BUFFALO_L11G_ID 0x000D /* BUFFALO WLI-USB-L11G */ ++ ++#define USB_LUCENT_VENDOR_ID 0x047E /* Lucent Technologies */ ++#define USB_LUCENT_ORINOCO_ID 0x0300 /* Lucent/Agere Orinoco USB Client */ ++ ++#define USB_AVAYA8_VENDOR_ID 0x0D98 ++#define USB_AVAYAE_VENDOR_ID 0x0D9E ++#define USB_AVAYA_WIRELESS_ID 0x0300 /* Avaya USB Wireless Card */ ++ ++#define USB_AGERE_VENDOR_ID 0x0D4E /* Agere Systems */ ++#define USB_AGERE_MODEL0801_ID 0x1000 /* USB Wireless Card Model 0801 */ ++#define USB_AGERE_MODEL0802_ID 0x1001 /* USB Wireless Card Model 0802 */ ++#define USB_AGERE_REBRANDED_ID 0x047A /* USB WLAN Card */ ++ ++#define USB_ELSA_VENDOR_ID 0x05CC ++#define USB_ELSA_AIRLANCER_ID 0x3100 /* ELSA AirLancer USB-11 */ ++ ++#define USB_LEGEND_VENDOR_ID 0x0E7C ++#define USB_LEGEND_JOYNET_ID 0x0300 /* Joynet USB WLAN Card */ ++ ++#define USB_SAMSUNG_VENDOR_ID 0x04E8 ++#define USB_SAMSUNG_SEW2001U1_ID 0x5002 /* Samsung SEW-2001u Card */ ++#define USB_SAMSUNG_SEW2001U2_ID 0x5B11 /* Samsung SEW-2001u Card */ ++#define USB_SAMSUNG_SEW2003U_ID 0x7011 /* Samsung SEW-2003U Card */ ++ ++#define USB_IGATE_VENDOR_ID 0x0681 ++#define USB_IGATE_IGATE_11M_ID 0x0012 /* I-GATE 11M USB Card */ ++ ++#define USB_FUJITSU_VENDOR_ID 0x0BF8 ++#define USB_FUJITSU_E1100_ID 0x1002 /* connect2AIR WLAN E-1100 USB */ ++ ++#define USB_2WIRE_VENDOR_ID 0x1630 ++#define USB_2WIRE_WIRELESS_ID 0xff81 /* 2Wire USB Wireless adapter */ ++ ++ ++#define EZUSB_REQUEST_FW_TRANS 0xA0 ++#define EZUSB_REQUEST_TRIGGER 0xAA ++#define EZUSB_REQUEST_TRIG_AC 0xAC ++#define EZUSB_CPUCS_REG 0x7F92 ++ ++#define EZUSB_RID_TX 0x0700 ++#define EZUSB_RID_RX 0x0701 ++#define EZUSB_RID_INIT1 0x0702 ++#define EZUSB_RID_ACK 0x0710 ++#define EZUSB_RID_READ_PDA 0x0800 ++#define EZUSB_RID_PROG_INIT 0x0852 ++#define EZUSB_RID_PROG_SET_ADDR 0x0853 ++#define EZUSB_RID_PROG_BYTES 0x0854 ++#define EZUSB_RID_PROG_END 0x0855 ++#define EZUSB_RID_DOCMD 0x0860 ++ ++/* Recognize info frames */ ++#define EZUSB_IS_INFO(id) ((id >= 0xF000) && (id <= 0xF2FF)) ++ ++#define EZUSB_MAGIC 0x0210 ++ ++#define EZUSB_FRAME_DATA 1 ++#define EZUSB_FRAME_CONTROL 2 ++ ++#define DEF_TIMEOUT (3 * HZ) ++ ++#define BULK_BUF_SIZE 2048 ++ ++#define MAX_DL_SIZE (BULK_BUF_SIZE - sizeof(struct ezusb_packet)) ++ ++#define FW_BUF_SIZE 64 ++#define FW_VAR_OFFSET_PTR 0x359 ++#define FW_VAR_VALUE 0 ++#define FW_HOLE_START 0x100 ++#define FW_HOLE_END 0x300 ++ ++struct ezusb_packet { ++ __le16 magic; /* 0x0210 */ ++ u8 req_reply_count; ++ u8 ans_reply_count; ++ __le16 frame_type; /* 0x01 for data frames, 0x02 otherwise */ ++ __le16 size; /* transport size */ ++ __le16 crc; /* CRC up to here */ ++ __le16 hermes_len; ++ __le16 hermes_rid; ++ u8 data[]; ++} __packed; ++ ++/* Table of devices that work or may work with this driver */ ++static const struct usb_device_id ezusb_table[] = { ++ {USB_DEVICE(USB_COMPAQ_VENDOR_ID, USB_COMPAQ_WL215_ID)}, ++ {USB_DEVICE(USB_COMPAQ_VENDOR_ID, USB_HP_WL215_ID)}, ++ {USB_DEVICE(USB_COMPAQ_VENDOR_ID, USB_COMPAQ_W200_ID)}, ++ {USB_DEVICE(USB_MELCO_VENDOR_ID, USB_BUFFALO_L11_ID)}, ++ {USB_DEVICE(USB_MELCO_VENDOR_ID, USB_BUFFALO_L11G_WR_ID)}, ++ {USB_DEVICE(USB_MELCO_VENDOR_ID, USB_BUFFALO_L11G_ID)}, ++ {USB_DEVICE(USB_LUCENT_VENDOR_ID, USB_LUCENT_ORINOCO_ID)}, ++ {USB_DEVICE(USB_AVAYA8_VENDOR_ID, USB_AVAYA_WIRELESS_ID)}, ++ {USB_DEVICE(USB_AVAYAE_VENDOR_ID, USB_AVAYA_WIRELESS_ID)}, ++ {USB_DEVICE(USB_AGERE_VENDOR_ID, USB_AGERE_MODEL0801_ID)}, ++ {USB_DEVICE(USB_AGERE_VENDOR_ID, USB_AGERE_MODEL0802_ID)}, ++ {USB_DEVICE(USB_ELSA_VENDOR_ID, USB_ELSA_AIRLANCER_ID)}, ++ {USB_DEVICE(USB_LEGEND_VENDOR_ID, USB_LEGEND_JOYNET_ID)}, ++ {USB_DEVICE_VER(USB_SAMSUNG_VENDOR_ID, USB_SAMSUNG_SEW2001U1_ID, ++ 0, 0)}, ++ {USB_DEVICE(USB_SAMSUNG_VENDOR_ID, USB_SAMSUNG_SEW2001U2_ID)}, ++ {USB_DEVICE(USB_SAMSUNG_VENDOR_ID, USB_SAMSUNG_SEW2003U_ID)}, ++ {USB_DEVICE(USB_IGATE_VENDOR_ID, USB_IGATE_IGATE_11M_ID)}, ++ {USB_DEVICE(USB_FUJITSU_VENDOR_ID, USB_FUJITSU_E1100_ID)}, ++ {USB_DEVICE(USB_2WIRE_VENDOR_ID, USB_2WIRE_WIRELESS_ID)}, ++ {USB_DEVICE(USB_AGERE_VENDOR_ID, USB_AGERE_REBRANDED_ID)}, ++ {} /* Terminating entry */ ++}; ++ ++MODULE_DEVICE_TABLE(usb, ezusb_table); ++ ++/* Structure to hold all of our device specific stuff */ ++struct ezusb_priv { ++ struct usb_device *udev; ++ struct net_device *dev; ++ struct mutex mtx; ++ spinlock_t req_lock; ++ struct list_head req_pending; ++ struct list_head req_active; ++ spinlock_t reply_count_lock; ++ u16 hermes_reg_fake[0x40]; ++ u8 *bap_buf; ++ struct urb *read_urb; ++ int read_pipe; ++ int write_pipe; ++ u8 reply_count; ++}; ++ ++enum ezusb_state { ++ EZUSB_CTX_START, ++ EZUSB_CTX_QUEUED, ++ EZUSB_CTX_REQ_SUBMITTED, ++ EZUSB_CTX_REQ_COMPLETE, ++ EZUSB_CTX_RESP_RECEIVED, ++ EZUSB_CTX_REQ_TIMEOUT, ++ EZUSB_CTX_REQ_FAILED, ++ EZUSB_CTX_RESP_TIMEOUT, ++ EZUSB_CTX_REQSUBMIT_FAIL, ++ EZUSB_CTX_COMPLETE, ++}; ++ ++struct request_context { ++ struct list_head list; ++ refcount_t refcount; ++ struct completion done; /* Signals that CTX is dead */ ++ int killed; ++ struct urb *outurb; /* OUT for req pkt */ ++ struct ezusb_priv *upriv; ++ struct ezusb_packet *buf; ++ int buf_length; ++ struct timer_list timer; /* Timeout handling */ ++ enum ezusb_state state; /* Current state */ ++ /* the RID that we will wait for */ ++ u16 out_rid; ++ u16 in_rid; ++}; ++ ++ ++/* Forward declarations */ ++static void ezusb_ctx_complete(struct request_context *ctx); ++static void ezusb_req_queue_run(struct ezusb_priv *upriv); ++static void ezusb_bulk_in_callback(struct urb *urb); ++ ++static inline u8 ezusb_reply_inc(u8 count) ++{ ++ if (count < 0x7F) ++ return count + 1; ++ else ++ return 1; ++} ++ ++static void ezusb_request_context_put(struct request_context *ctx) ++{ ++ if (!refcount_dec_and_test(&ctx->refcount)) ++ return; ++ ++ WARN_ON(!ctx->done.done); ++ BUG_ON(ctx->outurb->status == -EINPROGRESS); ++ BUG_ON(timer_pending(&ctx->timer)); ++ usb_free_urb(ctx->outurb); ++ kfree(ctx->buf); ++ kfree(ctx); ++} ++ ++static inline void ezusb_mod_timer(struct ezusb_priv *upriv, ++ struct timer_list *timer, ++ unsigned long expire) ++{ ++ if (!upriv->udev) ++ return; ++ mod_timer(timer, expire); ++} ++ ++static void ezusb_request_timerfn(struct timer_list *t) ++{ ++ struct request_context *ctx = from_timer(ctx, t, timer); ++ ++ ctx->outurb->transfer_flags |= URB_ASYNC_UNLINK; ++ if (usb_unlink_urb(ctx->outurb) == -EINPROGRESS) { ++ ctx->state = EZUSB_CTX_REQ_TIMEOUT; ++ } else { ++ ctx->state = EZUSB_CTX_RESP_TIMEOUT; ++ dev_dbg(&ctx->outurb->dev->dev, "couldn't unlink\n"); ++ refcount_inc(&ctx->refcount); ++ ctx->killed = 1; ++ ezusb_ctx_complete(ctx); ++ ezusb_request_context_put(ctx); ++ } ++}; ++ ++static struct request_context *ezusb_alloc_ctx(struct ezusb_priv *upriv, ++ u16 out_rid, u16 in_rid) ++{ ++ struct request_context *ctx; ++ ++ ctx = kzalloc(sizeof(*ctx), GFP_ATOMIC); ++ if (!ctx) ++ return NULL; ++ ++ ctx->buf = kmalloc(BULK_BUF_SIZE, GFP_ATOMIC); ++ if (!ctx->buf) { ++ kfree(ctx); ++ return NULL; ++ } ++ ctx->outurb = usb_alloc_urb(0, GFP_ATOMIC); ++ if (!ctx->outurb) { ++ kfree(ctx->buf); ++ kfree(ctx); ++ return NULL; ++ } ++ ++ ctx->upriv = upriv; ++ ctx->state = EZUSB_CTX_START; ++ ctx->out_rid = out_rid; ++ ctx->in_rid = in_rid; ++ ++ refcount_set(&ctx->refcount, 1); ++ init_completion(&ctx->done); ++ ++ timer_setup(&ctx->timer, ezusb_request_timerfn, 0); ++ return ctx; ++} ++ ++static void ezusb_ctx_complete(struct request_context *ctx) ++{ ++ struct ezusb_priv *upriv = ctx->upriv; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&upriv->req_lock, flags); ++ ++ list_del_init(&ctx->list); ++ if (upriv->udev) { ++ spin_unlock_irqrestore(&upriv->req_lock, flags); ++ ezusb_req_queue_run(upriv); ++ spin_lock_irqsave(&upriv->req_lock, flags); ++ } ++ ++ switch (ctx->state) { ++ case EZUSB_CTX_COMPLETE: ++ case EZUSB_CTX_REQSUBMIT_FAIL: ++ case EZUSB_CTX_REQ_FAILED: ++ case EZUSB_CTX_REQ_TIMEOUT: ++ case EZUSB_CTX_RESP_TIMEOUT: ++ spin_unlock_irqrestore(&upriv->req_lock, flags); ++ ++ if ((ctx->out_rid == EZUSB_RID_TX) && upriv->dev) { ++ struct net_device *dev = upriv->dev; ++ struct net_device_stats *stats = &dev->stats; ++ ++ if (ctx->state != EZUSB_CTX_COMPLETE) ++ stats->tx_errors++; ++ else ++ stats->tx_packets++; ++ ++ netif_wake_queue(dev); ++ } ++ complete_all(&ctx->done); ++ ezusb_request_context_put(ctx); ++ break; ++ ++ default: ++ spin_unlock_irqrestore(&upriv->req_lock, flags); ++ if (!upriv->udev) { ++ /* This is normal, as all request contexts get flushed ++ * when the device is disconnected */ ++ err("Called, CTX not terminating, but device gone"); ++ complete_all(&ctx->done); ++ ezusb_request_context_put(ctx); ++ break; ++ } ++ ++ err("Called, CTX not in terminating state."); ++ /* Things are really bad if this happens. Just leak ++ * the CTX because it may still be linked to the ++ * queue or the OUT urb may still be active. ++ * Just leaking at least prevents an Oops or Panic. ++ */ ++ break; ++ } ++} ++ ++/* ++ * ezusb_req_queue_run: ++ * Description: ++ * Note: Only one active CTX at any one time, because there's no ++ * other (reliable) way to match the response URB to the correct ++ * CTX. ++ */ ++static void ezusb_req_queue_run(struct ezusb_priv *upriv) ++{ ++ unsigned long flags; ++ struct request_context *ctx; ++ int result; ++ ++ spin_lock_irqsave(&upriv->req_lock, flags); ++ ++ if (!list_empty(&upriv->req_active)) ++ goto unlock; ++ ++ if (list_empty(&upriv->req_pending)) ++ goto unlock; ++ ++ ctx = ++ list_entry(upriv->req_pending.next, struct request_context, ++ list); ++ ++ if (!ctx->upriv->udev) ++ goto unlock; ++ ++ /* We need to split this off to avoid a race condition */ ++ list_move_tail(&ctx->list, &upriv->req_active); ++ ++ if (ctx->state == EZUSB_CTX_QUEUED) { ++ refcount_inc(&ctx->refcount); ++ result = usb_submit_urb(ctx->outurb, GFP_ATOMIC); ++ if (result) { ++ ctx->state = EZUSB_CTX_REQSUBMIT_FAIL; ++ ++ spin_unlock_irqrestore(&upriv->req_lock, flags); ++ ++ err("Fatal, failed to submit command urb." ++ " error=%d\n", result); ++ ++ ezusb_ctx_complete(ctx); ++ ezusb_request_context_put(ctx); ++ goto done; ++ } ++ ++ ctx->state = EZUSB_CTX_REQ_SUBMITTED; ++ ezusb_mod_timer(ctx->upriv, &ctx->timer, ++ jiffies + DEF_TIMEOUT); ++ } ++ ++ unlock: ++ spin_unlock_irqrestore(&upriv->req_lock, flags); ++ ++ done: ++ return; ++} ++ ++static void ezusb_req_enqueue_run(struct ezusb_priv *upriv, ++ struct request_context *ctx) ++{ ++ unsigned long flags; ++ ++ spin_lock_irqsave(&upriv->req_lock, flags); ++ ++ if (!ctx->upriv->udev) { ++ spin_unlock_irqrestore(&upriv->req_lock, flags); ++ goto done; ++ } ++ refcount_inc(&ctx->refcount); ++ list_add_tail(&ctx->list, &upriv->req_pending); ++ spin_unlock_irqrestore(&upriv->req_lock, flags); ++ ++ ctx->state = EZUSB_CTX_QUEUED; ++ ezusb_req_queue_run(upriv); ++ ++ done: ++ return; ++} ++ ++static void ezusb_request_out_callback(struct urb *urb) ++{ ++ unsigned long flags; ++ enum ezusb_state state; ++ struct request_context *ctx = urb->context; ++ struct ezusb_priv *upriv = ctx->upriv; ++ ++ spin_lock_irqsave(&upriv->req_lock, flags); ++ ++ del_timer(&ctx->timer); ++ ++ if (ctx->killed) { ++ spin_unlock_irqrestore(&upriv->req_lock, flags); ++ pr_warn("interrupt called with dead ctx\n"); ++ goto out; ++ } ++ ++ state = ctx->state; ++ ++ if (urb->status == 0) { ++ switch (state) { ++ case EZUSB_CTX_REQ_SUBMITTED: ++ if (ctx->in_rid) { ++ ctx->state = EZUSB_CTX_REQ_COMPLETE; ++ /* reply URB still pending */ ++ ezusb_mod_timer(upriv, &ctx->timer, ++ jiffies + DEF_TIMEOUT); ++ spin_unlock_irqrestore(&upriv->req_lock, ++ flags); ++ break; ++ } ++ fallthrough; ++ case EZUSB_CTX_RESP_RECEIVED: ++ /* IN already received before this OUT-ACK */ ++ ctx->state = EZUSB_CTX_COMPLETE; ++ spin_unlock_irqrestore(&upriv->req_lock, flags); ++ ezusb_ctx_complete(ctx); ++ break; ++ ++ default: ++ spin_unlock_irqrestore(&upriv->req_lock, flags); ++ err("Unexpected state(0x%x, %d) in OUT URB", ++ state, urb->status); ++ break; ++ } ++ } else { ++ /* If someone cancels the OUT URB then its status ++ * should be either -ECONNRESET or -ENOENT. ++ */ ++ switch (state) { ++ case EZUSB_CTX_REQ_SUBMITTED: ++ case EZUSB_CTX_RESP_RECEIVED: ++ ctx->state = EZUSB_CTX_REQ_FAILED; ++ fallthrough; ++ ++ case EZUSB_CTX_REQ_FAILED: ++ case EZUSB_CTX_REQ_TIMEOUT: ++ spin_unlock_irqrestore(&upriv->req_lock, flags); ++ ++ ezusb_ctx_complete(ctx); ++ break; ++ ++ default: ++ spin_unlock_irqrestore(&upriv->req_lock, flags); ++ ++ err("Unexpected state(0x%x, %d) in OUT URB", ++ state, urb->status); ++ break; ++ } ++ } ++ out: ++ ezusb_request_context_put(ctx); ++} ++ ++static void ezusb_request_in_callback(struct ezusb_priv *upriv, ++ struct urb *urb) ++{ ++ struct ezusb_packet *ans = urb->transfer_buffer; ++ struct request_context *ctx = NULL; ++ enum ezusb_state state; ++ unsigned long flags; ++ ++ /* Find the CTX on the active queue that requested this URB */ ++ spin_lock_irqsave(&upriv->req_lock, flags); ++ if (upriv->udev) { ++ struct list_head *item; ++ ++ list_for_each(item, &upriv->req_active) { ++ struct request_context *c; ++ int reply_count; ++ ++ c = list_entry(item, struct request_context, list); ++ reply_count = ++ ezusb_reply_inc(c->buf->req_reply_count); ++ if ((ans->ans_reply_count == reply_count) ++ && (le16_to_cpu(ans->hermes_rid) == c->in_rid)) { ++ ctx = c; ++ break; ++ } ++ netdev_dbg(upriv->dev, "Skipped (0x%x/0x%x) (%d/%d)\n", ++ le16_to_cpu(ans->hermes_rid), c->in_rid, ++ ans->ans_reply_count, reply_count); ++ } ++ } ++ ++ if (ctx == NULL) { ++ spin_unlock_irqrestore(&upriv->req_lock, flags); ++ err("%s: got unexpected RID: 0x%04X", __func__, ++ le16_to_cpu(ans->hermes_rid)); ++ ezusb_req_queue_run(upriv); ++ return; ++ } ++ ++ /* The data we want is in the in buffer, exchange */ ++ urb->transfer_buffer = ctx->buf; ++ ctx->buf = (void *) ans; ++ ctx->buf_length = urb->actual_length; ++ ++ state = ctx->state; ++ switch (state) { ++ case EZUSB_CTX_REQ_SUBMITTED: ++ /* We have received our response URB before ++ * our request has been acknowledged. Do NOT ++ * destroy our CTX yet, because our OUT URB ++ * is still alive ... ++ */ ++ ctx->state = EZUSB_CTX_RESP_RECEIVED; ++ spin_unlock_irqrestore(&upriv->req_lock, flags); ++ ++ /* Let the machine continue running. */ ++ break; ++ ++ case EZUSB_CTX_REQ_COMPLETE: ++ /* This is the usual path: our request ++ * has already been acknowledged, and ++ * we have now received the reply. ++ */ ++ ctx->state = EZUSB_CTX_COMPLETE; ++ ++ /* Stop the intimer */ ++ del_timer(&ctx->timer); ++ spin_unlock_irqrestore(&upriv->req_lock, flags); ++ ++ /* Call the completion handler */ ++ ezusb_ctx_complete(ctx); ++ break; ++ ++ default: ++ spin_unlock_irqrestore(&upriv->req_lock, flags); ++ ++ pr_warn("Matched IN URB, unexpected context state(0x%x)\n", ++ state); ++ /* Throw this CTX away and try submitting another */ ++ del_timer(&ctx->timer); ++ ctx->outurb->transfer_flags |= URB_ASYNC_UNLINK; ++ usb_unlink_urb(ctx->outurb); ++ ezusb_req_queue_run(upriv); ++ break; ++ } /* switch */ ++} ++ ++typedef void (*ezusb_ctx_wait)(struct ezusb_priv *, struct request_context *); ++ ++static void ezusb_req_ctx_wait_compl(struct ezusb_priv *upriv, ++ struct request_context *ctx) ++{ ++ switch (ctx->state) { ++ case EZUSB_CTX_QUEUED: ++ case EZUSB_CTX_REQ_SUBMITTED: ++ case EZUSB_CTX_REQ_COMPLETE: ++ case EZUSB_CTX_RESP_RECEIVED: ++ wait_for_completion(&ctx->done); ++ break; ++ default: ++ /* Done or failed - nothing to wait for */ ++ break; ++ } ++} ++ ++static void ezusb_req_ctx_wait_poll(struct ezusb_priv *upriv, ++ struct request_context *ctx) ++{ ++ int msecs; ++ ++ switch (ctx->state) { ++ case EZUSB_CTX_QUEUED: ++ case EZUSB_CTX_REQ_SUBMITTED: ++ case EZUSB_CTX_REQ_COMPLETE: ++ case EZUSB_CTX_RESP_RECEIVED: ++ /* If we get called from a timer or with our lock acquired, then ++ * we can't wait for the completion and have to poll. This won't ++ * happen if the USB controller completes the URB requests in ++ * BH. ++ */ ++ msecs = DEF_TIMEOUT * (1000 / HZ); ++ ++ while (!try_wait_for_completion(&ctx->done) && msecs--) ++ udelay(1000); ++ break; ++ default: ++ /* Done or failed - nothing to wait for */ ++ break; ++ } ++} ++ ++static void ezusb_req_ctx_wait_skip(struct ezusb_priv *upriv, ++ struct request_context *ctx) ++{ ++ WARN(1, "Shouldn't be invoked for in_rid\n"); ++} ++ ++static inline u16 build_crc(struct ezusb_packet *data) ++{ ++ u16 crc = 0; ++ u8 *bytes = (u8 *)data; ++ int i; ++ ++ for (i = 0; i < 8; i++) ++ crc = (crc << 1) + bytes[i]; ++ ++ return crc; ++} ++ ++/* ++ * ezusb_fill_req: ++ * ++ * if data == NULL and length > 0 the data is assumed to be already in ++ * the target buffer and only the header is filled. ++ * ++ */ ++static int ezusb_fill_req(struct ezusb_packet *req, u16 length, u16 rid, ++ const void *data, u16 frame_type, u8 reply_count) ++{ ++ int total_size = sizeof(*req) + length; ++ ++ BUG_ON(total_size > BULK_BUF_SIZE); ++ ++ req->magic = cpu_to_le16(EZUSB_MAGIC); ++ req->req_reply_count = reply_count; ++ req->ans_reply_count = 0; ++ req->frame_type = cpu_to_le16(frame_type); ++ req->size = cpu_to_le16(length + 4); ++ req->crc = cpu_to_le16(build_crc(req)); ++ req->hermes_len = cpu_to_le16(HERMES_BYTES_TO_RECLEN(length)); ++ req->hermes_rid = cpu_to_le16(rid); ++ if (data) ++ memcpy(req->data, data, length); ++ return total_size; ++} ++ ++static int ezusb_submit_in_urb(struct ezusb_priv *upriv) ++{ ++ int retval = 0; ++ void *cur_buf = upriv->read_urb->transfer_buffer; ++ ++ if (upriv->read_urb->status == -EINPROGRESS) { ++ netdev_dbg(upriv->dev, "urb busy, not resubmiting\n"); ++ retval = -EBUSY; ++ goto exit; ++ } ++ usb_fill_bulk_urb(upriv->read_urb, upriv->udev, upriv->read_pipe, ++ cur_buf, BULK_BUF_SIZE, ++ ezusb_bulk_in_callback, upriv); ++ upriv->read_urb->transfer_flags = 0; ++ retval = usb_submit_urb(upriv->read_urb, GFP_ATOMIC); ++ if (retval) ++ err("%s submit failed %d", __func__, retval); ++ ++ exit: ++ return retval; ++} ++ ++static inline int ezusb_8051_cpucs(struct ezusb_priv *upriv, int reset) ++{ ++ int ret; ++ u8 *res_val = NULL; ++ ++ if (!upriv->udev) { ++ err("%s: !upriv->udev", __func__); ++ return -EFAULT; ++ } ++ ++ res_val = kmalloc(sizeof(*res_val), GFP_KERNEL); ++ ++ if (!res_val) ++ return -ENOMEM; ++ ++ *res_val = reset; /* avoid argument promotion */ ++ ++ ret = usb_control_msg(upriv->udev, ++ usb_sndctrlpipe(upriv->udev, 0), ++ EZUSB_REQUEST_FW_TRANS, ++ USB_TYPE_VENDOR | USB_RECIP_DEVICE | ++ USB_DIR_OUT, EZUSB_CPUCS_REG, 0, res_val, ++ sizeof(*res_val), DEF_TIMEOUT); ++ ++ kfree(res_val); ++ ++ return ret; ++} ++ ++static int ezusb_firmware_download(struct ezusb_priv *upriv, ++ struct ez_usb_fw *fw) ++{ ++ u8 *fw_buffer; ++ int retval, addr; ++ int variant_offset; ++ ++ fw_buffer = kmalloc(FW_BUF_SIZE, GFP_KERNEL); ++ if (!fw_buffer) { ++ printk(KERN_ERR PFX "Out of memory for firmware buffer.\n"); ++ return -ENOMEM; ++ } ++ /* ++ * This byte is 1 and should be replaced with 0. The offset is ++ * 0x10AD in version 0.0.6. The byte in question should follow ++ * the end of the code pointed to by the jump in the beginning ++ * of the firmware. Also, it is read by code located at 0x358. ++ */ ++ variant_offset = be16_to_cpup((__be16 *) &fw->code[FW_VAR_OFFSET_PTR]); ++ if (variant_offset >= fw->size) { ++ printk(KERN_ERR PFX "Invalid firmware variant offset: " ++ "0x%04x\n", variant_offset); ++ retval = -EINVAL; ++ goto fail; ++ } ++ ++ retval = ezusb_8051_cpucs(upriv, 1); ++ if (retval < 0) ++ goto fail; ++ for (addr = 0; addr < fw->size; addr += FW_BUF_SIZE) { ++ /* 0x100-0x300 should be left alone, it contains card ++ * specific data, like USB enumeration information */ ++ if ((addr >= FW_HOLE_START) && (addr < FW_HOLE_END)) ++ continue; ++ ++ memcpy(fw_buffer, &fw->code[addr], FW_BUF_SIZE); ++ if (variant_offset >= addr && ++ variant_offset < addr + FW_BUF_SIZE) { ++ netdev_dbg(upriv->dev, ++ "Patching card_variant byte at 0x%04X\n", ++ variant_offset); ++ fw_buffer[variant_offset - addr] = FW_VAR_VALUE; ++ } ++ retval = usb_control_msg(upriv->udev, ++ usb_sndctrlpipe(upriv->udev, 0), ++ EZUSB_REQUEST_FW_TRANS, ++ USB_TYPE_VENDOR | USB_RECIP_DEVICE ++ | USB_DIR_OUT, ++ addr, 0x0, ++ fw_buffer, FW_BUF_SIZE, ++ DEF_TIMEOUT); ++ ++ if (retval < 0) ++ goto fail; ++ } ++ retval = ezusb_8051_cpucs(upriv, 0); ++ if (retval < 0) ++ goto fail; ++ ++ goto exit; ++ fail: ++ printk(KERN_ERR PFX "Firmware download failed, error %d\n", ++ retval); ++ exit: ++ kfree(fw_buffer); ++ return retval; ++} ++ ++static int ezusb_access_ltv(struct ezusb_priv *upriv, ++ struct request_context *ctx, ++ u16 length, const void *data, u16 frame_type, ++ void *ans_buff, unsigned ans_size, u16 *ans_length, ++ ezusb_ctx_wait ezusb_ctx_wait_func) ++{ ++ int req_size; ++ int retval = 0; ++ enum ezusb_state state; ++ ++ if (!upriv->udev) { ++ retval = -ENODEV; ++ goto exit; ++ } ++ ++ if (upriv->read_urb->status != -EINPROGRESS) ++ err("%s: in urb not pending", __func__); ++ ++ /* protect upriv->reply_count, guarantee sequential numbers */ ++ spin_lock_bh(&upriv->reply_count_lock); ++ req_size = ezusb_fill_req(ctx->buf, length, ctx->out_rid, data, ++ frame_type, upriv->reply_count); ++ usb_fill_bulk_urb(ctx->outurb, upriv->udev, upriv->write_pipe, ++ ctx->buf, req_size, ++ ezusb_request_out_callback, ctx); ++ ++ if (ctx->in_rid) ++ upriv->reply_count = ezusb_reply_inc(upriv->reply_count); ++ ++ ezusb_req_enqueue_run(upriv, ctx); ++ ++ spin_unlock_bh(&upriv->reply_count_lock); ++ ++ if (ctx->in_rid) ++ ezusb_ctx_wait_func(upriv, ctx); ++ ++ state = ctx->state; ++ switch (state) { ++ case EZUSB_CTX_COMPLETE: ++ retval = ctx->outurb->status; ++ break; ++ ++ case EZUSB_CTX_QUEUED: ++ case EZUSB_CTX_REQ_SUBMITTED: ++ if (!ctx->in_rid) ++ break; ++ fallthrough; ++ default: ++ err("%s: Unexpected context state %d", __func__, ++ state); ++ fallthrough; ++ case EZUSB_CTX_REQ_TIMEOUT: ++ case EZUSB_CTX_REQ_FAILED: ++ case EZUSB_CTX_RESP_TIMEOUT: ++ case EZUSB_CTX_REQSUBMIT_FAIL: ++ printk(KERN_ERR PFX "Access failed, resetting (state %d," ++ " reply_count %d)\n", state, upriv->reply_count); ++ upriv->reply_count = 0; ++ if (state == EZUSB_CTX_REQ_TIMEOUT ++ || state == EZUSB_CTX_RESP_TIMEOUT) { ++ printk(KERN_ERR PFX "ctx timed out\n"); ++ retval = -ETIMEDOUT; ++ } else { ++ printk(KERN_ERR PFX "ctx failed\n"); ++ retval = -EFAULT; ++ } ++ goto exit; ++ } ++ if (ctx->in_rid) { ++ struct ezusb_packet *ans = ctx->buf; ++ unsigned exp_len; ++ ++ if (ans->hermes_len != 0) ++ exp_len = le16_to_cpu(ans->hermes_len) * 2 + 12; ++ else ++ exp_len = 14; ++ ++ if (exp_len != ctx->buf_length) { ++ err("%s: length mismatch for RID 0x%04x: " ++ "expected %d, got %d", __func__, ++ ctx->in_rid, exp_len, ctx->buf_length); ++ retval = -EIO; ++ goto exit; ++ } ++ ++ if (ans_buff) ++ memcpy(ans_buff, ans->data, min(exp_len, ans_size)); ++ if (ans_length) ++ *ans_length = le16_to_cpu(ans->hermes_len); ++ } ++ exit: ++ ezusb_request_context_put(ctx); ++ return retval; ++} ++ ++static int __ezusb_write_ltv(struct hermes *hw, int bap, u16 rid, ++ u16 length, const void *data, ++ ezusb_ctx_wait ezusb_ctx_wait_func) ++{ ++ struct ezusb_priv *upriv = hw->priv; ++ u16 frame_type; ++ struct request_context *ctx; ++ ++ if (length == 0) ++ return -EINVAL; ++ ++ length = HERMES_RECLEN_TO_BYTES(length); ++ ++ /* On memory mapped devices HERMES_RID_CNFGROUPADDRESSES can be ++ * set to be empty, but the USB bridge doesn't like it */ ++ if (length == 0) ++ return 0; ++ ++ ctx = ezusb_alloc_ctx(upriv, rid, EZUSB_RID_ACK); ++ if (!ctx) ++ return -ENOMEM; ++ ++ if (rid == EZUSB_RID_TX) ++ frame_type = EZUSB_FRAME_DATA; ++ else ++ frame_type = EZUSB_FRAME_CONTROL; ++ ++ return ezusb_access_ltv(upriv, ctx, length, data, frame_type, ++ NULL, 0, NULL, ezusb_ctx_wait_func); ++} ++ ++static int ezusb_write_ltv(struct hermes *hw, int bap, u16 rid, ++ u16 length, const void *data) ++{ ++ return __ezusb_write_ltv(hw, bap, rid, length, data, ++ ezusb_req_ctx_wait_poll); ++} ++ ++static int __ezusb_read_ltv(struct hermes *hw, int bap, u16 rid, ++ unsigned bufsize, u16 *length, void *buf, ++ ezusb_ctx_wait ezusb_ctx_wait_func) ++ ++{ ++ struct ezusb_priv *upriv = hw->priv; ++ struct request_context *ctx; ++ ++ if (bufsize % 2) ++ return -EINVAL; ++ ++ ctx = ezusb_alloc_ctx(upriv, rid, rid); ++ if (!ctx) ++ return -ENOMEM; ++ ++ return ezusb_access_ltv(upriv, ctx, 0, NULL, EZUSB_FRAME_CONTROL, ++ buf, bufsize, length, ezusb_req_ctx_wait_poll); ++} ++ ++static int ezusb_read_ltv(struct hermes *hw, int bap, u16 rid, ++ unsigned bufsize, u16 *length, void *buf) ++{ ++ return __ezusb_read_ltv(hw, bap, rid, bufsize, length, buf, ++ ezusb_req_ctx_wait_poll); ++} ++ ++static int ezusb_read_ltv_preempt(struct hermes *hw, int bap, u16 rid, ++ unsigned bufsize, u16 *length, void *buf) ++{ ++ return __ezusb_read_ltv(hw, bap, rid, bufsize, length, buf, ++ ezusb_req_ctx_wait_compl); ++} ++ ++static int ezusb_doicmd_wait(struct hermes *hw, u16 cmd, u16 parm0, u16 parm1, ++ u16 parm2, struct hermes_response *resp) ++{ ++ WARN_ON_ONCE(1); ++ return -EINVAL; ++} ++ ++static int __ezusb_docmd_wait(struct hermes *hw, u16 cmd, u16 parm0, ++ struct hermes_response *resp, ++ ezusb_ctx_wait ezusb_ctx_wait_func) ++{ ++ struct ezusb_priv *upriv = hw->priv; ++ struct request_context *ctx; ++ ++ __le16 data[4] = { ++ cpu_to_le16(cmd), ++ cpu_to_le16(parm0), ++ 0, ++ 0, ++ }; ++ netdev_dbg(upriv->dev, "0x%04X, parm0 0x%04X\n", cmd, parm0); ++ ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_DOCMD, EZUSB_RID_ACK); ++ if (!ctx) ++ return -ENOMEM; ++ ++ return ezusb_access_ltv(upriv, ctx, sizeof(data), &data, ++ EZUSB_FRAME_CONTROL, NULL, 0, NULL, ++ ezusb_ctx_wait_func); ++} ++ ++static int ezusb_docmd_wait(struct hermes *hw, u16 cmd, u16 parm0, ++ struct hermes_response *resp) ++{ ++ return __ezusb_docmd_wait(hw, cmd, parm0, resp, ezusb_req_ctx_wait_poll); ++} ++ ++static int ezusb_bap_pread(struct hermes *hw, int bap, ++ void *buf, int len, u16 id, u16 offset) ++{ ++ struct ezusb_priv *upriv = hw->priv; ++ struct ezusb_packet *ans = (void *) upriv->read_urb->transfer_buffer; ++ int actual_length = upriv->read_urb->actual_length; ++ ++ if (id == EZUSB_RID_RX) { ++ if ((sizeof(*ans) + offset + len) > actual_length) { ++ printk(KERN_ERR PFX "BAP read beyond buffer end " ++ "in rx frame\n"); ++ return -EINVAL; ++ } ++ memcpy(buf, ans->data + offset, len); ++ return 0; ++ } ++ ++ if (EZUSB_IS_INFO(id)) { ++ /* Include 4 bytes for length/type */ ++ if ((sizeof(*ans) + offset + len - 4) > actual_length) { ++ printk(KERN_ERR PFX "BAP read beyond buffer end " ++ "in info frame\n"); ++ return -EFAULT; ++ } ++ memcpy(buf, ans->data + offset - 4, len); ++ } else { ++ printk(KERN_ERR PFX "Unexpected fid 0x%04x\n", id); ++ return -EINVAL; ++ } ++ ++ return 0; ++} ++ ++static int ezusb_read_pda(struct hermes *hw, __le16 *pda, ++ u32 pda_addr, u16 pda_len) ++{ ++ struct ezusb_priv *upriv = hw->priv; ++ struct request_context *ctx; ++ __le16 data[] = { ++ cpu_to_le16(pda_addr & 0xffff), ++ cpu_to_le16(pda_len - 4) ++ }; ++ ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_READ_PDA, EZUSB_RID_READ_PDA); ++ if (!ctx) ++ return -ENOMEM; ++ ++ /* wl_lkm does not include PDA size in the PDA area. ++ * We will pad the information into pda, so other routines ++ * don't have to be modified */ ++ pda[0] = cpu_to_le16(pda_len - 2); ++ /* Includes CFG_PROD_DATA but not itself */ ++ pda[1] = cpu_to_le16(0x0800); /* CFG_PROD_DATA */ ++ ++ return ezusb_access_ltv(upriv, ctx, sizeof(data), &data, ++ EZUSB_FRAME_CONTROL, &pda[2], pda_len - 4, ++ NULL, ezusb_req_ctx_wait_compl); ++} ++ ++static int ezusb_program_init(struct hermes *hw, u32 entry_point) ++{ ++ struct ezusb_priv *upriv = hw->priv; ++ struct request_context *ctx; ++ __le32 data = cpu_to_le32(entry_point); ++ ++ ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_PROG_INIT, EZUSB_RID_ACK); ++ if (!ctx) ++ return -ENOMEM; ++ ++ return ezusb_access_ltv(upriv, ctx, sizeof(data), &data, ++ EZUSB_FRAME_CONTROL, NULL, 0, NULL, ++ ezusb_req_ctx_wait_compl); ++} ++ ++static int ezusb_program_end(struct hermes *hw) ++{ ++ struct ezusb_priv *upriv = hw->priv; ++ struct request_context *ctx; ++ ++ ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_PROG_END, EZUSB_RID_ACK); ++ if (!ctx) ++ return -ENOMEM; ++ ++ return ezusb_access_ltv(upriv, ctx, 0, NULL, ++ EZUSB_FRAME_CONTROL, NULL, 0, NULL, ++ ezusb_req_ctx_wait_compl); ++} ++ ++static int ezusb_program_bytes(struct hermes *hw, const char *buf, ++ u32 addr, u32 len) ++{ ++ struct ezusb_priv *upriv = hw->priv; ++ struct request_context *ctx; ++ __le32 data = cpu_to_le32(addr); ++ int err; ++ ++ ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_PROG_SET_ADDR, EZUSB_RID_ACK); ++ if (!ctx) ++ return -ENOMEM; ++ ++ err = ezusb_access_ltv(upriv, ctx, sizeof(data), &data, ++ EZUSB_FRAME_CONTROL, NULL, 0, NULL, ++ ezusb_req_ctx_wait_compl); ++ if (err) ++ return err; ++ ++ ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_PROG_BYTES, EZUSB_RID_ACK); ++ if (!ctx) ++ return -ENOMEM; ++ ++ return ezusb_access_ltv(upriv, ctx, len, buf, ++ EZUSB_FRAME_CONTROL, NULL, 0, NULL, ++ ezusb_req_ctx_wait_compl); ++} ++ ++static int ezusb_program(struct hermes *hw, const char *buf, ++ u32 addr, u32 len) ++{ ++ u32 ch_addr; ++ u32 ch_len; ++ int err = 0; ++ ++ /* We can only send 2048 bytes out of the bulk xmit at a time, ++ * so we have to split any programming into chunks of <2048 ++ * bytes. */ ++ ++ ch_len = (len < MAX_DL_SIZE) ? len : MAX_DL_SIZE; ++ ch_addr = addr; ++ ++ while (ch_addr < (addr + len)) { ++ pr_debug("Programming subblock of length %d " ++ "to address 0x%08x. Data @ %p\n", ++ ch_len, ch_addr, &buf[ch_addr - addr]); ++ ++ err = ezusb_program_bytes(hw, &buf[ch_addr - addr], ++ ch_addr, ch_len); ++ if (err) ++ break; ++ ++ ch_addr += ch_len; ++ ch_len = ((addr + len - ch_addr) < MAX_DL_SIZE) ? ++ (addr + len - ch_addr) : MAX_DL_SIZE; ++ } ++ ++ return err; ++} ++ ++static netdev_tx_t ezusb_xmit(struct sk_buff *skb, struct net_device *dev) ++{ ++ struct orinoco_private *priv = ndev_priv(dev); ++ struct net_device_stats *stats = &dev->stats; ++ struct ezusb_priv *upriv = priv->card; ++ u8 mic[MICHAEL_MIC_LEN + 1]; ++ int err = 0; ++ int tx_control; ++ unsigned long flags; ++ struct request_context *ctx; ++ u8 *buf; ++ int tx_size; ++ ++ if (!netif_running(dev)) { ++ printk(KERN_ERR "%s: Tx on stopped device!\n", ++ dev->name); ++ return NETDEV_TX_BUSY; ++ } ++ ++ if (netif_queue_stopped(dev)) { ++ printk(KERN_DEBUG "%s: Tx while transmitter busy!\n", ++ dev->name); ++ return NETDEV_TX_BUSY; ++ } ++ ++ if (orinoco_lock(priv, &flags) != 0) { ++ printk(KERN_ERR ++ "%s: ezusb_xmit() called while hw_unavailable\n", ++ dev->name); ++ return NETDEV_TX_BUSY; ++ } ++ ++ if (!netif_carrier_ok(dev) || ++ (priv->iw_mode == NL80211_IFTYPE_MONITOR)) { ++ /* Oops, the firmware hasn't established a connection, ++ silently drop the packet (this seems to be the ++ safest approach). */ ++ goto drop; ++ } ++ ++ /* Check packet length */ ++ if (skb->len < ETH_HLEN) ++ goto drop; ++ ++ tx_control = 0; ++ ++ err = orinoco_process_xmit_skb(skb, dev, priv, &tx_control, ++ &mic[0]); ++ if (err) ++ goto drop; ++ ++ ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_TX, 0); ++ if (!ctx) ++ goto drop; ++ ++ memset(ctx->buf, 0, BULK_BUF_SIZE); ++ buf = ctx->buf->data; ++ ++ { ++ __le16 *tx_cntl = (__le16 *)buf; ++ *tx_cntl = cpu_to_le16(tx_control); ++ buf += sizeof(*tx_cntl); ++ } ++ ++ memcpy(buf, skb->data, skb->len); ++ buf += skb->len; ++ ++ if (tx_control & HERMES_TXCTRL_MIC) { ++ u8 *m = mic; ++ /* Mic has been offset so it can be copied to an even ++ * address. We're copying eveything anyway, so we ++ * don't need to copy that first byte. */ ++ if (skb->len % 2) ++ m++; ++ memcpy(buf, m, MICHAEL_MIC_LEN); ++ buf += MICHAEL_MIC_LEN; ++ } ++ ++ /* Finally, we actually initiate the send */ ++ netif_stop_queue(dev); ++ ++ /* The card may behave better if we send evenly sized usb transfers */ ++ tx_size = ALIGN(buf - ctx->buf->data, 2); ++ ++ err = ezusb_access_ltv(upriv, ctx, tx_size, NULL, ++ EZUSB_FRAME_DATA, NULL, 0, NULL, ++ ezusb_req_ctx_wait_skip); ++ ++ if (err) { ++ netif_start_queue(dev); ++ if (net_ratelimit()) ++ printk(KERN_ERR "%s: Error %d transmitting packet\n", ++ dev->name, err); ++ goto busy; ++ } ++ ++ netif_trans_update(dev); ++ stats->tx_bytes += skb->len; ++ goto ok; ++ ++ drop: ++ stats->tx_errors++; ++ stats->tx_dropped++; ++ ++ ok: ++ orinoco_unlock(priv, &flags); ++ dev_kfree_skb(skb); ++ return NETDEV_TX_OK; ++ ++ busy: ++ orinoco_unlock(priv, &flags); ++ return NETDEV_TX_BUSY; ++} ++ ++static int ezusb_allocate(struct hermes *hw, u16 size, u16 *fid) ++{ ++ *fid = EZUSB_RID_TX; ++ return 0; ++} ++ ++ ++static int ezusb_hard_reset(struct orinoco_private *priv) ++{ ++ struct ezusb_priv *upriv = priv->card; ++ int retval = ezusb_8051_cpucs(upriv, 1); ++ ++ if (retval < 0) { ++ err("Failed to reset"); ++ return retval; ++ } ++ ++ retval = ezusb_8051_cpucs(upriv, 0); ++ if (retval < 0) { ++ err("Failed to unreset"); ++ return retval; ++ } ++ ++ netdev_dbg(upriv->dev, "sending control message\n"); ++ retval = usb_control_msg(upriv->udev, ++ usb_sndctrlpipe(upriv->udev, 0), ++ EZUSB_REQUEST_TRIGGER, ++ USB_TYPE_VENDOR | USB_RECIP_DEVICE | ++ USB_DIR_OUT, 0x0, 0x0, NULL, 0, ++ DEF_TIMEOUT); ++ if (retval < 0) { ++ err("EZUSB_REQUEST_TRIGGER failed retval %d", retval); ++ return retval; ++ } ++#if 0 ++ dbg("Sending EZUSB_REQUEST_TRIG_AC"); ++ retval = usb_control_msg(upriv->udev, ++ usb_sndctrlpipe(upriv->udev, 0), ++ EZUSB_REQUEST_TRIG_AC, ++ USB_TYPE_VENDOR | USB_RECIP_DEVICE | ++ USB_DIR_OUT, 0x00FA, 0x0, NULL, 0, ++ DEF_TIMEOUT); ++ if (retval < 0) { ++ err("EZUSB_REQUEST_TRIG_AC failed retval %d", retval); ++ return retval; ++ } ++#endif ++ ++ return 0; ++} ++ ++ ++static int ezusb_init(struct hermes *hw) ++{ ++ struct ezusb_priv *upriv = hw->priv; ++ int retval; ++ ++ if (!upriv) ++ return -EINVAL; ++ ++ upriv->reply_count = 0; ++ /* Write the MAGIC number on the simulated registers to keep ++ * orinoco.c happy */ ++ hermes_write_regn(hw, SWSUPPORT0, HERMES_MAGIC); ++ hermes_write_regn(hw, RXFID, EZUSB_RID_RX); ++ ++ usb_kill_urb(upriv->read_urb); ++ ezusb_submit_in_urb(upriv); ++ ++ retval = __ezusb_write_ltv(hw, 0, EZUSB_RID_INIT1, ++ HERMES_BYTES_TO_RECLEN(2), "\x10\x00", ++ ezusb_req_ctx_wait_compl); ++ if (retval < 0) { ++ printk(KERN_ERR PFX "EZUSB_RID_INIT1 error %d\n", retval); ++ return retval; ++ } ++ ++ retval = __ezusb_docmd_wait(hw, HERMES_CMD_INIT, 0, NULL, ++ ezusb_req_ctx_wait_compl); ++ if (retval < 0) { ++ printk(KERN_ERR PFX "HERMES_CMD_INIT error %d\n", retval); ++ return retval; ++ } ++ ++ return 0; ++} ++ ++static void ezusb_bulk_in_callback(struct urb *urb) ++{ ++ struct ezusb_priv *upriv = (struct ezusb_priv *) urb->context; ++ struct ezusb_packet *ans = urb->transfer_buffer; ++ u16 crc; ++ u16 hermes_rid; ++ ++ if (upriv->udev == NULL) ++ return; ++ ++ if (urb->status == -ETIMEDOUT) { ++ /* When a device gets unplugged we get this every time ++ * we resubmit, flooding the logs. Since we don't use ++ * USB timeouts, it shouldn't happen any other time*/ ++ pr_warn("%s: urb timed out, not resubmitting\n", __func__); ++ return; ++ } ++ if (urb->status == -ECONNABORTED) { ++ pr_warn("%s: connection abort, resubmitting urb\n", ++ __func__); ++ goto resubmit; ++ } ++ if ((urb->status == -EILSEQ) ++ || (urb->status == -ENOENT) ++ || (urb->status == -ECONNRESET)) { ++ netdev_dbg(upriv->dev, "status %d, not resubmiting\n", ++ urb->status); ++ return; ++ } ++ if (urb->status) ++ netdev_dbg(upriv->dev, "status: %d length: %d\n", ++ urb->status, urb->actual_length); ++ if (urb->actual_length < sizeof(*ans)) { ++ err("%s: short read, ignoring", __func__); ++ goto resubmit; ++ } ++ crc = build_crc(ans); ++ if (le16_to_cpu(ans->crc) != crc) { ++ err("CRC error, ignoring packet"); ++ goto resubmit; ++ } ++ ++ hermes_rid = le16_to_cpu(ans->hermes_rid); ++ if ((hermes_rid != EZUSB_RID_RX) && !EZUSB_IS_INFO(hermes_rid)) { ++ ezusb_request_in_callback(upriv, urb); ++ } else if (upriv->dev) { ++ struct net_device *dev = upriv->dev; ++ struct orinoco_private *priv = ndev_priv(dev); ++ struct hermes *hw = &priv->hw; ++ ++ if (hermes_rid == EZUSB_RID_RX) { ++ __orinoco_ev_rx(dev, hw); ++ } else { ++ hermes_write_regn(hw, INFOFID, ++ le16_to_cpu(ans->hermes_rid)); ++ __orinoco_ev_info(dev, hw); ++ } ++ } ++ ++ resubmit: ++ if (upriv->udev) ++ ezusb_submit_in_urb(upriv); ++} ++ ++static inline void ezusb_delete(struct ezusb_priv *upriv) ++{ ++ struct list_head *item; ++ struct list_head *tmp_item; ++ unsigned long flags; ++ ++ BUG_ON(!upriv); ++ ++ mutex_lock(&upriv->mtx); ++ ++ upriv->udev = NULL; /* No timer will be rearmed from here */ ++ ++ usb_kill_urb(upriv->read_urb); ++ ++ spin_lock_irqsave(&upriv->req_lock, flags); ++ list_for_each_safe(item, tmp_item, &upriv->req_active) { ++ struct request_context *ctx; ++ int err; ++ ++ ctx = list_entry(item, struct request_context, list); ++ refcount_inc(&ctx->refcount); ++ ++ ctx->outurb->transfer_flags |= URB_ASYNC_UNLINK; ++ err = usb_unlink_urb(ctx->outurb); ++ ++ spin_unlock_irqrestore(&upriv->req_lock, flags); ++ if (err == -EINPROGRESS) ++ wait_for_completion(&ctx->done); ++ ++ del_timer_sync(&ctx->timer); ++ /* FIXME: there is an slight chance for the irq handler to ++ * be running */ ++ if (!list_empty(&ctx->list)) ++ ezusb_ctx_complete(ctx); ++ ++ ezusb_request_context_put(ctx); ++ spin_lock_irqsave(&upriv->req_lock, flags); ++ } ++ spin_unlock_irqrestore(&upriv->req_lock, flags); ++ ++ list_for_each_safe(item, tmp_item, &upriv->req_pending) ++ ezusb_ctx_complete(list_entry(item, ++ struct request_context, list)); ++ ++ if (upriv->read_urb && upriv->read_urb->status == -EINPROGRESS) ++ printk(KERN_ERR PFX "Some URB in progress\n"); ++ ++ mutex_unlock(&upriv->mtx); ++ ++ if (upriv->read_urb) { ++ kfree(upriv->read_urb->transfer_buffer); ++ usb_free_urb(upriv->read_urb); ++ } ++ kfree(upriv->bap_buf); ++ if (upriv->dev) { ++ struct orinoco_private *priv = ndev_priv(upriv->dev); ++ orinoco_if_del(priv); ++ wiphy_unregister(priv_to_wiphy(upriv)); ++ free_orinocodev(priv); ++ } ++} ++ ++static void ezusb_lock_irqsave(spinlock_t *lock, ++ unsigned long *flags) __acquires(lock) ++{ ++ spin_lock_bh(lock); ++} ++ ++static void ezusb_unlock_irqrestore(spinlock_t *lock, ++ unsigned long *flags) __releases(lock) ++{ ++ spin_unlock_bh(lock); ++} ++ ++static void ezusb_lock_irq(spinlock_t *lock) __acquires(lock) ++{ ++ spin_lock_bh(lock); ++} ++ ++static void ezusb_unlock_irq(spinlock_t *lock) __releases(lock) ++{ ++ spin_unlock_bh(lock); ++} ++ ++static const struct hermes_ops ezusb_ops = { ++ .init = ezusb_init, ++ .cmd_wait = ezusb_docmd_wait, ++ .init_cmd_wait = ezusb_doicmd_wait, ++ .allocate = ezusb_allocate, ++ .read_ltv = ezusb_read_ltv, ++ .read_ltv_pr = ezusb_read_ltv_preempt, ++ .write_ltv = ezusb_write_ltv, ++ .bap_pread = ezusb_bap_pread, ++ .read_pda = ezusb_read_pda, ++ .program_init = ezusb_program_init, ++ .program_end = ezusb_program_end, ++ .program = ezusb_program, ++ .lock_irqsave = ezusb_lock_irqsave, ++ .unlock_irqrestore = ezusb_unlock_irqrestore, ++ .lock_irq = ezusb_lock_irq, ++ .unlock_irq = ezusb_unlock_irq, ++}; ++ ++static const struct net_device_ops ezusb_netdev_ops = { ++ .ndo_open = orinoco_open, ++ .ndo_stop = orinoco_stop, ++ .ndo_start_xmit = ezusb_xmit, ++ .ndo_set_rx_mode = orinoco_set_multicast_list, ++ .ndo_change_mtu = orinoco_change_mtu, ++ .ndo_set_mac_address = eth_mac_addr, ++ .ndo_validate_addr = eth_validate_addr, ++ .ndo_tx_timeout = orinoco_tx_timeout, ++}; ++ ++static int ezusb_probe(struct usb_interface *interface, ++ const struct usb_device_id *id) ++{ ++ struct usb_device *udev = interface_to_usbdev(interface); ++ struct orinoco_private *priv; ++ struct hermes *hw; ++ struct ezusb_priv *upriv = NULL; ++ struct usb_interface_descriptor *iface_desc; ++ struct usb_endpoint_descriptor *ep; ++ const struct firmware *fw_entry = NULL; ++ int retval = 0; ++ int i; ++ ++ priv = alloc_orinocodev(sizeof(*upriv), &udev->dev, ++ ezusb_hard_reset, NULL); ++ if (!priv) { ++ err("Couldn't allocate orinocodev"); ++ retval = -ENOMEM; ++ goto exit; ++ } ++ ++ hw = &priv->hw; ++ ++ upriv = priv->card; ++ ++ mutex_init(&upriv->mtx); ++ spin_lock_init(&upriv->reply_count_lock); ++ ++ spin_lock_init(&upriv->req_lock); ++ INIT_LIST_HEAD(&upriv->req_pending); ++ INIT_LIST_HEAD(&upriv->req_active); ++ ++ upriv->udev = udev; ++ ++ hw->iobase = (void __force __iomem *) &upriv->hermes_reg_fake; ++ hw->reg_spacing = HERMES_16BIT_REGSPACING; ++ hw->priv = upriv; ++ hw->ops = &ezusb_ops; ++ ++ /* set up the endpoint information */ ++ /* check out the endpoints */ ++ ++ iface_desc = &interface->cur_altsetting->desc; ++ for (i = 0; i < iface_desc->bNumEndpoints; ++i) { ++ ep = &interface->cur_altsetting->endpoint[i].desc; ++ ++ if (usb_endpoint_is_bulk_in(ep)) { ++ /* we found a bulk in endpoint */ ++ if (upriv->read_urb != NULL) { ++ pr_warn("Found a second bulk in ep, ignored\n"); ++ continue; ++ } ++ ++ upriv->read_urb = usb_alloc_urb(0, GFP_KERNEL); ++ if (!upriv->read_urb) ++ goto error; ++ if (le16_to_cpu(ep->wMaxPacketSize) != 64) ++ pr_warn("bulk in: wMaxPacketSize!= 64\n"); ++ if (ep->bEndpointAddress != (2 | USB_DIR_IN)) ++ pr_warn("bulk in: bEndpointAddress: %d\n", ++ ep->bEndpointAddress); ++ upriv->read_pipe = usb_rcvbulkpipe(udev, ++ ep-> ++ bEndpointAddress); ++ upriv->read_urb->transfer_buffer = ++ kmalloc(BULK_BUF_SIZE, GFP_KERNEL); ++ if (!upriv->read_urb->transfer_buffer) { ++ err("Couldn't allocate IN buffer"); ++ goto error; ++ } ++ } ++ ++ if (usb_endpoint_is_bulk_out(ep)) { ++ /* we found a bulk out endpoint */ ++ if (upriv->bap_buf != NULL) { ++ pr_warn("Found a second bulk out ep, ignored\n"); ++ continue; ++ } ++ ++ if (le16_to_cpu(ep->wMaxPacketSize) != 64) ++ pr_warn("bulk out: wMaxPacketSize != 64\n"); ++ if (ep->bEndpointAddress != 2) ++ pr_warn("bulk out: bEndpointAddress: %d\n", ++ ep->bEndpointAddress); ++ upriv->write_pipe = usb_sndbulkpipe(udev, ++ ep-> ++ bEndpointAddress); ++ upriv->bap_buf = kmalloc(BULK_BUF_SIZE, GFP_KERNEL); ++ if (!upriv->bap_buf) { ++ err("Couldn't allocate bulk_out_buffer"); ++ goto error; ++ } ++ } ++ } ++ if (!upriv->bap_buf || !upriv->read_urb) { ++ err("Didn't find the required bulk endpoints"); ++ goto error; ++ } ++ ++ if (request_firmware(&fw_entry, "orinoco_ezusb_fw", ++ &interface->dev) == 0) { ++ firmware.size = fw_entry->size; ++ firmware.code = fw_entry->data; ++ } ++ if (firmware.size && firmware.code) { ++ if (ezusb_firmware_download(upriv, &firmware) < 0) ++ goto error; ++ } else { ++ err("No firmware to download"); ++ goto error; ++ } ++ ++ if (ezusb_hard_reset(priv) < 0) { ++ err("Cannot reset the device"); ++ goto error; ++ } ++ ++ /* If the firmware is already downloaded orinoco.c will call ++ * ezusb_init but if the firmware is not already there, that will make ++ * the kernel very unstable, so we try initializing here and quit in ++ * case of error */ ++ if (ezusb_init(hw) < 0) { ++ err("Couldn't initialize the device"); ++ err("Firmware may not be downloaded or may be wrong."); ++ goto error; ++ } ++ ++ /* Initialise the main driver */ ++ if (orinoco_init(priv) != 0) { ++ err("orinoco_init() failed\n"); ++ goto error; ++ } ++ ++ if (orinoco_if_add(priv, 0, 0, &ezusb_netdev_ops) != 0) { ++ upriv->dev = NULL; ++ err("%s: orinoco_if_add() failed", __func__); ++ wiphy_unregister(priv_to_wiphy(priv)); ++ goto error; ++ } ++ upriv->dev = priv->ndev; ++ ++ goto exit; ++ ++ error: ++ ezusb_delete(upriv); ++ if (upriv->dev) { ++ /* upriv->dev was 0, so ezusb_delete() didn't free it */ ++ free_orinocodev(priv); ++ } ++ upriv = NULL; ++ retval = -EFAULT; ++ exit: ++ if (fw_entry) { ++ firmware.code = NULL; ++ firmware.size = 0; ++ release_firmware(fw_entry); ++ } ++ usb_set_intfdata(interface, upriv); ++ return retval; ++} ++ ++ ++static void ezusb_disconnect(struct usb_interface *intf) ++{ ++ struct ezusb_priv *upriv = usb_get_intfdata(intf); ++ usb_set_intfdata(intf, NULL); ++ ezusb_delete(upriv); ++ printk(KERN_INFO PFX "Disconnected\n"); ++} ++ ++ ++/* usb specific object needed to register this driver with the usb subsystem */ ++static struct usb_driver orinoco_driver = { ++ .name = DRIVER_NAME, ++ .probe = ezusb_probe, ++ .disconnect = ezusb_disconnect, ++ .id_table = ezusb_table, ++ .disable_hub_initiated_lpm = 1, ++}; ++ ++module_usb_driver(orinoco_driver); ++ ++MODULE_AUTHOR("Manuel Estrada Sainz"); ++MODULE_DESCRIPTION("Driver for Orinoco wireless LAN cards using EZUSB bridge"); ++MODULE_LICENSE("Dual MPL/GPL"); +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/scan.c linux-6.15.6/drivers/net/wireless/intersil/orinoco/scan.c +--- linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/scan.c 1970-01-01 01:00:00.000000000 +0100 ++++ linux-6.15.6/drivers/net/wireless/intersil/orinoco/scan.c 2025-08-03 15:01:59.385129604 +0200 +@@ -0,0 +1,259 @@ ++/* Helpers for managing scan queues ++ * ++ * See copyright notice in main.c ++ */ ++ ++#include <linux/gfp.h> ++#include <linux/kernel.h> ++#include <linux/string.h> ++#include <linux/ieee80211.h> ++#include <net/cfg80211.h> ++ ++#include "hermes.h" ++#include "orinoco.h" ++#include "main.h" ++ ++#include "scan.h" ++ ++#define ZERO_DBM_OFFSET 0x95 ++#define MAX_SIGNAL_LEVEL 0x8A ++#define MIN_SIGNAL_LEVEL 0x2F ++ ++#define SIGNAL_TO_DBM(x) \ ++ (clamp_t(s32, (x), MIN_SIGNAL_LEVEL, MAX_SIGNAL_LEVEL) \ ++ - ZERO_DBM_OFFSET) ++#define SIGNAL_TO_MBM(x) (SIGNAL_TO_DBM(x) * 100) ++ ++static int symbol_build_supp_rates(u8 *buf, const __le16 *rates) ++{ ++ int i; ++ u8 rate; ++ ++ buf[0] = WLAN_EID_SUPP_RATES; ++ for (i = 0; i < 5; i++) { ++ rate = le16_to_cpu(rates[i]); ++ /* NULL terminated */ ++ if (rate == 0x0) ++ break; ++ buf[i + 2] = rate; ++ } ++ buf[1] = i; ++ ++ return i + 2; ++} ++ ++static int prism_build_supp_rates(u8 *buf, const u8 *rates) ++{ ++ int i; ++ ++ buf[0] = WLAN_EID_SUPP_RATES; ++ for (i = 0; i < 8; i++) { ++ /* NULL terminated */ ++ if (rates[i] == 0x0) ++ break; ++ buf[i + 2] = rates[i]; ++ } ++ buf[1] = i; ++ ++ /* We might still have another 2 rates, which need to go in ++ * extended supported rates */ ++ if (i == 8 && rates[i] > 0) { ++ buf[10] = WLAN_EID_EXT_SUPP_RATES; ++ for (; i < 10; i++) { ++ /* NULL terminated */ ++ if (rates[i] == 0x0) ++ break; ++ buf[i + 2] = rates[i]; ++ } ++ buf[11] = i - 8; ++ } ++ ++ return (i < 8) ? i + 2 : i + 4; ++} ++ ++static void orinoco_add_hostscan_result(struct orinoco_private *priv, ++ const union hermes_scan_info *bss) ++{ ++ struct wiphy *wiphy = priv_to_wiphy(priv); ++ struct ieee80211_channel *channel; ++ struct cfg80211_bss *cbss; ++ u8 *ie; ++ u8 ie_buf[46]; ++ u64 timestamp; ++ s32 signal; ++ u16 capability; ++ u16 beacon_interval; ++ int ie_len; ++ int freq; ++ int len; ++ ++ len = le16_to_cpu(bss->a.essid_len); ++ ++ /* Reconstruct SSID and bitrate IEs to pass up */ ++ ie_buf[0] = WLAN_EID_SSID; ++ ie_buf[1] = len; ++ memcpy(&ie_buf[2], bss->a.essid, len); ++ ++ ie = ie_buf + len + 2; ++ ie_len = ie_buf[1] + 2; ++ switch (priv->firmware_type) { ++ case FIRMWARE_TYPE_SYMBOL: ++ ie_len += symbol_build_supp_rates(ie, bss->s.rates); ++ break; ++ ++ case FIRMWARE_TYPE_INTERSIL: ++ ie_len += prism_build_supp_rates(ie, bss->p.rates); ++ break; ++ ++ case FIRMWARE_TYPE_AGERE: ++ default: ++ break; ++ } ++ ++ freq = ieee80211_channel_to_frequency( ++ le16_to_cpu(bss->a.channel), NL80211_BAND_2GHZ); ++ channel = ieee80211_get_channel(wiphy, freq); ++ if (!channel) { ++ printk(KERN_DEBUG "Invalid channel designation %04X(%04X)", ++ bss->a.channel, freq); ++ return; /* Then ignore it for now */ ++ } ++ timestamp = 0; ++ capability = le16_to_cpu(bss->a.capabilities); ++ beacon_interval = le16_to_cpu(bss->a.beacon_interv); ++ signal = SIGNAL_TO_MBM(le16_to_cpu(bss->a.level)); ++ ++ cbss = cfg80211_inform_bss(wiphy, channel, CFG80211_BSS_FTYPE_UNKNOWN, ++ bss->a.bssid, timestamp, capability, ++ beacon_interval, ie_buf, ie_len, signal, ++ GFP_KERNEL); ++ cfg80211_put_bss(wiphy, cbss); ++} ++ ++void orinoco_add_extscan_result(struct orinoco_private *priv, ++ struct agere_ext_scan_info *bss, ++ size_t len) ++{ ++ struct wiphy *wiphy = priv_to_wiphy(priv); ++ struct ieee80211_channel *channel; ++ struct cfg80211_bss *cbss; ++ const u8 *ie; ++ u64 timestamp; ++ s32 signal; ++ u16 capability; ++ u16 beacon_interval; ++ size_t ie_len; ++ int chan, freq; ++ ++ ie_len = len - sizeof(*bss); ++ ie = cfg80211_find_ie(WLAN_EID_DS_PARAMS, bss->data, ie_len); ++ chan = ie ? ie[2] : 0; ++ freq = ieee80211_channel_to_frequency(chan, NL80211_BAND_2GHZ); ++ channel = ieee80211_get_channel(wiphy, freq); ++ ++ timestamp = le64_to_cpu(bss->timestamp); ++ capability = le16_to_cpu(bss->capabilities); ++ beacon_interval = le16_to_cpu(bss->beacon_interval); ++ ie = bss->data; ++ signal = SIGNAL_TO_MBM(bss->level); ++ ++ cbss = cfg80211_inform_bss(wiphy, channel, CFG80211_BSS_FTYPE_UNKNOWN, ++ bss->bssid, timestamp, capability, ++ beacon_interval, ie, ie_len, signal, ++ GFP_KERNEL); ++ cfg80211_put_bss(wiphy, cbss); ++} ++ ++void orinoco_add_hostscan_results(struct orinoco_private *priv, ++ unsigned char *buf, ++ size_t len) ++{ ++ int offset; /* In the scan data */ ++ size_t atom_len; ++ bool abort = false; ++ ++ switch (priv->firmware_type) { ++ case FIRMWARE_TYPE_AGERE: ++ atom_len = sizeof(struct agere_scan_apinfo); ++ offset = 0; ++ break; ++ ++ case FIRMWARE_TYPE_SYMBOL: ++ /* Lack of documentation necessitates this hack. ++ * Different firmwares have 68 or 76 byte long atoms. ++ * We try modulo first. If the length divides by both, ++ * we check what would be the channel in the second ++ * frame for a 68-byte atom. 76-byte atoms have 0 there. ++ * Valid channel cannot be 0. */ ++ if (len % 76) ++ atom_len = 68; ++ else if (len % 68) ++ atom_len = 76; ++ else if (len >= 1292 && buf[68] == 0) ++ atom_len = 76; ++ else ++ atom_len = 68; ++ offset = 0; ++ break; ++ ++ case FIRMWARE_TYPE_INTERSIL: ++ offset = 4; ++ if (priv->has_hostscan) { ++ atom_len = le16_to_cpup((__le16 *)buf); ++ /* Sanity check for atom_len */ ++ if (atom_len < sizeof(struct prism2_scan_apinfo)) { ++ printk(KERN_ERR "%s: Invalid atom_len in scan " ++ "data: %zu\n", priv->ndev->name, ++ atom_len); ++ abort = true; ++ goto scan_abort; ++ } ++ } else ++ atom_len = offsetof(struct prism2_scan_apinfo, atim); ++ break; ++ ++ default: ++ abort = true; ++ goto scan_abort; ++ } ++ ++ /* Check that we got an whole number of atoms */ ++ if ((len - offset) % atom_len) { ++ printk(KERN_ERR "%s: Unexpected scan data length %zu, " ++ "atom_len %zu, offset %d\n", priv->ndev->name, len, ++ atom_len, offset); ++ abort = true; ++ goto scan_abort; ++ } ++ ++ /* Process the entries one by one */ ++ for (; offset + atom_len <= len; offset += atom_len) { ++ union hermes_scan_info *atom; ++ ++ atom = (union hermes_scan_info *) (buf + offset); ++ ++ orinoco_add_hostscan_result(priv, atom); ++ } ++ ++ scan_abort: ++ if (priv->scan_request) { ++ struct cfg80211_scan_info info = { ++ .aborted = abort, ++ }; ++ ++ cfg80211_scan_done(priv->scan_request, &info); ++ priv->scan_request = NULL; ++ } ++} ++ ++void orinoco_scan_done(struct orinoco_private *priv, bool abort) ++{ ++ if (priv->scan_request) { ++ struct cfg80211_scan_info info = { ++ .aborted = abort, ++ }; ++ ++ cfg80211_scan_done(priv->scan_request, &info); ++ priv->scan_request = NULL; ++ } ++} +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/scan.h linux-6.15.6/drivers/net/wireless/intersil/orinoco/scan.h +--- linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/scan.h 1970-01-01 01:00:00.000000000 +0100 ++++ linux-6.15.6/drivers/net/wireless/intersil/orinoco/scan.h 2025-08-03 15:01:59.385129604 +0200 +@@ -0,0 +1,21 @@ ++/* Helpers for managing scan queues ++ * ++ * See copyright notice in main.c ++ */ ++#ifndef _ORINOCO_SCAN_H_ ++#define _ORINOCO_SCAN_H_ ++ ++/* Forward declarations */ ++struct orinoco_private; ++struct agere_ext_scan_info; ++ ++/* Add scan results */ ++void orinoco_add_extscan_result(struct orinoco_private *priv, ++ struct agere_ext_scan_info *atom, ++ size_t len); ++void orinoco_add_hostscan_results(struct orinoco_private *dev, ++ unsigned char *buf, ++ size_t len); ++void orinoco_scan_done(struct orinoco_private *priv, bool abort); ++ ++#endif /* _ORINOCO_SCAN_H_ */ +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/spectrum_cs.c linux-6.15.6/drivers/net/wireless/intersil/orinoco/spectrum_cs.c +--- linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/spectrum_cs.c 1970-01-01 01:00:00.000000000 +0100 ++++ linux-6.15.6/drivers/net/wireless/intersil/orinoco/spectrum_cs.c 2025-08-03 15:01:59.385129604 +0200 +@@ -0,0 +1,328 @@ ++/* ++ * Driver for 802.11b cards using RAM-loadable Symbol firmware, such as ++ * Symbol Wireless Networker LA4137, CompactFlash cards by Socket ++ * Communications and Intel PRO/Wireless 2011B. ++ * ++ * The driver implements Symbol firmware download. The rest is handled ++ * in hermes.c and main.c. ++ * ++ * Utilities for downloading the Symbol firmware are available at ++ * http://sourceforge.net/projects/orinoco/ ++ * ++ * Copyright (C) 2002-2005 Pavel Roskin <proski@gnu.org> ++ * Portions based on orinoco_cs.c: ++ * Copyright (C) David Gibson, Linuxcare Australia ++ * Portions based on Spectrum24tDnld.c from original spectrum24 driver: ++ * Copyright (C) Symbol Technologies. ++ * ++ * See copyright notice in file main.c. ++ */ ++ ++#define DRIVER_NAME "spectrum_cs" ++#define PFX DRIVER_NAME ": " ++ ++#include <linux/module.h> ++#include <linux/kernel.h> ++#include <linux/delay.h> ++#include <pcmcia/cistpl.h> ++#include <pcmcia/cisreg.h> ++#include <pcmcia/ds.h> ++ ++#include "orinoco.h" ++ ++/********************************************************************/ ++/* Module stuff */ ++/********************************************************************/ ++ ++MODULE_AUTHOR("Pavel Roskin <proski@gnu.org>"); ++MODULE_DESCRIPTION("Driver for Symbol Spectrum24 Trilogy cards with firmware downloader"); ++MODULE_LICENSE("Dual MPL/GPL"); ++ ++/* Module parameters */ ++ ++/* Some D-Link cards have buggy CIS. They do work at 5v properly, but ++ * don't have any CIS entry for it. This workaround it... */ ++static int ignore_cis_vcc; /* = 0 */ ++module_param(ignore_cis_vcc, int, 0); ++MODULE_PARM_DESC(ignore_cis_vcc, "Allow voltage mismatch between card and socket"); ++ ++/********************************************************************/ ++/* Data structures */ ++/********************************************************************/ ++ ++/* PCMCIA specific device information (goes in the card field of ++ * struct orinoco_private */ ++struct orinoco_pccard { ++ struct pcmcia_device *p_dev; ++}; ++ ++/********************************************************************/ ++/* Function prototypes */ ++/********************************************************************/ ++ ++static int spectrum_cs_config(struct pcmcia_device *link); ++static void spectrum_cs_release(struct pcmcia_device *link); ++ ++/* Constants for the CISREG_CCSR register */ ++#define HCR_RUN 0x07 /* run firmware after reset */ ++#define HCR_IDLE 0x0E /* don't run firmware after reset */ ++#define HCR_MEM16 0x10 /* memory width bit, should be preserved */ ++ ++ ++/* ++ * Reset the card using configuration registers COR and CCSR. ++ * If IDLE is 1, stop the firmware, so that it can be safely rewritten. ++ */ ++static int ++spectrum_reset(struct pcmcia_device *link, int idle) ++{ ++ int ret; ++ u8 save_cor; ++ u8 ccsr; ++ ++ /* Doing it if hardware is gone is guaranteed crash */ ++ if (!pcmcia_dev_present(link)) ++ return -ENODEV; ++ ++ /* Save original COR value */ ++ ret = pcmcia_read_config_byte(link, CISREG_COR, &save_cor); ++ if (ret) ++ goto failed; ++ ++ /* Soft-Reset card */ ++ ret = pcmcia_write_config_byte(link, CISREG_COR, ++ (save_cor | COR_SOFT_RESET)); ++ if (ret) ++ goto failed; ++ udelay(1000); ++ ++ /* Read CCSR */ ++ ret = pcmcia_read_config_byte(link, CISREG_CCSR, &ccsr); ++ if (ret) ++ goto failed; ++ ++ /* ++ * Start or stop the firmware. Memory width bit should be ++ * preserved from the value we've just read. ++ */ ++ ccsr = (idle ? HCR_IDLE : HCR_RUN) | (ccsr & HCR_MEM16); ++ ret = pcmcia_write_config_byte(link, CISREG_CCSR, ccsr); ++ if (ret) ++ goto failed; ++ udelay(1000); ++ ++ /* Restore original COR configuration index */ ++ ret = pcmcia_write_config_byte(link, CISREG_COR, ++ (save_cor & ~COR_SOFT_RESET)); ++ if (ret) ++ goto failed; ++ udelay(1000); ++ return 0; ++ ++failed: ++ return -ENODEV; ++} ++ ++/********************************************************************/ ++/* Device methods */ ++/********************************************************************/ ++ ++static int ++spectrum_cs_hard_reset(struct orinoco_private *priv) ++{ ++ struct orinoco_pccard *card = priv->card; ++ struct pcmcia_device *link = card->p_dev; ++ ++ /* Soft reset using COR and HCR */ ++ spectrum_reset(link, 0); ++ ++ return 0; ++} ++ ++static int ++spectrum_cs_stop_firmware(struct orinoco_private *priv, int idle) ++{ ++ struct orinoco_pccard *card = priv->card; ++ struct pcmcia_device *link = card->p_dev; ++ ++ return spectrum_reset(link, idle); ++} ++ ++/********************************************************************/ ++/* PCMCIA stuff */ ++/********************************************************************/ ++ ++static int ++spectrum_cs_probe(struct pcmcia_device *link) ++{ ++ struct orinoco_private *priv; ++ struct orinoco_pccard *card; ++ int ret; ++ ++ priv = alloc_orinocodev(sizeof(*card), &link->dev, ++ spectrum_cs_hard_reset, ++ spectrum_cs_stop_firmware); ++ if (!priv) ++ return -ENOMEM; ++ card = priv->card; ++ ++ /* Link both structures together */ ++ card->p_dev = link; ++ link->priv = priv; ++ ++ ret = spectrum_cs_config(link); ++ if (ret) ++ goto err_free_orinocodev; ++ ++ return 0; ++ ++err_free_orinocodev: ++ free_orinocodev(priv); ++ return ret; ++} ++ ++static void spectrum_cs_detach(struct pcmcia_device *link) ++{ ++ struct orinoco_private *priv = link->priv; ++ ++ orinoco_if_del(priv); ++ ++ spectrum_cs_release(link); ++ ++ free_orinocodev(priv); ++} /* spectrum_cs_detach */ ++ ++static int spectrum_cs_config_check(struct pcmcia_device *p_dev, ++ void *priv_data) ++{ ++ if (p_dev->config_index == 0) ++ return -EINVAL; ++ ++ return pcmcia_request_io(p_dev); ++}; ++ ++static int ++spectrum_cs_config(struct pcmcia_device *link) ++{ ++ struct orinoco_private *priv = link->priv; ++ struct hermes *hw = &priv->hw; ++ int ret; ++ void __iomem *mem; ++ ++ link->config_flags |= CONF_AUTO_SET_VPP | CONF_AUTO_CHECK_VCC | ++ CONF_AUTO_SET_IO | CONF_ENABLE_IRQ; ++ if (ignore_cis_vcc) ++ link->config_flags &= ~CONF_AUTO_CHECK_VCC; ++ ret = pcmcia_loop_config(link, spectrum_cs_config_check, NULL); ++ if (ret) { ++ if (!ignore_cis_vcc) ++ printk(KERN_ERR PFX "GetNextTuple(): No matching " ++ "CIS configuration. Maybe you need the " ++ "ignore_cis_vcc=1 parameter.\n"); ++ goto failed; ++ } ++ ++ mem = ioport_map(link->resource[0]->start, ++ resource_size(link->resource[0])); ++ if (!mem) ++ goto failed; ++ ++ /* We initialize the hermes structure before completing PCMCIA ++ * configuration just in case the interrupt handler gets ++ * called. */ ++ hermes_struct_init(hw, mem, HERMES_16BIT_REGSPACING); ++ hw->eeprom_pda = true; ++ ++ ret = pcmcia_request_irq(link, orinoco_interrupt); ++ if (ret) ++ goto failed; ++ ++ ret = pcmcia_enable_device(link); ++ if (ret) ++ goto failed; ++ ++ /* Reset card */ ++ if (spectrum_cs_hard_reset(priv) != 0) ++ goto failed; ++ ++ /* Initialise the main driver */ ++ if (orinoco_init(priv) != 0) { ++ printk(KERN_ERR PFX "orinoco_init() failed\n"); ++ goto failed; ++ } ++ ++ /* Register an interface with the stack */ ++ if (orinoco_if_add(priv, link->resource[0]->start, ++ link->irq, NULL) != 0) { ++ printk(KERN_ERR PFX "orinoco_if_add() failed\n"); ++ goto failed; ++ } ++ ++ return 0; ++ ++ failed: ++ spectrum_cs_release(link); ++ return -ENODEV; ++} /* spectrum_cs_config */ ++ ++static void ++spectrum_cs_release(struct pcmcia_device *link) ++{ ++ struct orinoco_private *priv = link->priv; ++ unsigned long flags; ++ ++ /* We're committed to taking the device away now, so mark the ++ * hardware as unavailable */ ++ priv->hw.ops->lock_irqsave(&priv->lock, &flags); ++ priv->hw_unavailable++; ++ priv->hw.ops->unlock_irqrestore(&priv->lock, &flags); ++ ++ pcmcia_disable_device(link); ++ if (priv->hw.iobase) ++ ioport_unmap(priv->hw.iobase); ++} /* spectrum_cs_release */ ++ ++ ++static int ++spectrum_cs_suspend(struct pcmcia_device *link) ++{ ++ struct orinoco_private *priv = link->priv; ++ ++ /* Mark the device as stopped, to block IO until later */ ++ orinoco_down(priv); ++ ++ return 0; ++} ++ ++static int ++spectrum_cs_resume(struct pcmcia_device *link) ++{ ++ struct orinoco_private *priv = link->priv; ++ int err = orinoco_up(priv); ++ ++ return err; ++} ++ ++ ++/********************************************************************/ ++/* Module initialization */ ++/********************************************************************/ ++ ++static const struct pcmcia_device_id spectrum_cs_ids[] = { ++ PCMCIA_DEVICE_MANF_CARD(0x026c, 0x0001), /* Symbol Spectrum24 LA4137 */ ++ PCMCIA_DEVICE_MANF_CARD(0x0104, 0x0001), /* Socket Communications CF */ ++ PCMCIA_DEVICE_PROD_ID12("Intel", "PRO/Wireless LAN PC Card", 0x816cc815, 0x6fbf459a), /* 2011B, not 2011 */ ++ PCMCIA_DEVICE_NULL, ++}; ++MODULE_DEVICE_TABLE(pcmcia, spectrum_cs_ids); ++ ++static struct pcmcia_driver orinoco_driver = { ++ .owner = THIS_MODULE, ++ .name = DRIVER_NAME, ++ .probe = spectrum_cs_probe, ++ .remove = spectrum_cs_detach, ++ .suspend = spectrum_cs_suspend, ++ .resume = spectrum_cs_resume, ++ .id_table = spectrum_cs_ids, ++}; ++module_pcmcia_driver(orinoco_driver); +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/wext.c linux-6.15.6/drivers/net/wireless/intersil/orinoco/wext.c +--- linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/wext.c 1970-01-01 01:00:00.000000000 +0100 ++++ linux-6.15.6/drivers/net/wireless/intersil/orinoco/wext.c 2025-08-03 16:32:17.782885098 +0200 +@@ -0,0 +1,1415 @@ ++/* Wireless extensions support. ++ * ++ * See copyright notice in main.c ++ */ ++#include <linux/slab.h> ++#include <linux/kernel.h> ++#include <linux/if_arp.h> ++#include <linux/wireless.h> ++#include <linux/ieee80211.h> ++#include <linux/etherdevice.h> ++#include <net/iw_handler.h> ++#include <net/cfg80211.h> ++#include <net/cfg80211-wext.h> ++ ++#include "hermes.h" ++#include "hermes_rid.h" ++#include "orinoco.h" ++ ++#include "hw.h" ++#include "mic.h" ++#include "scan.h" ++#include "main.h" ++ ++#include "wext.h" ++ ++#define MAX_RID_LEN 1024 ++ ++/* Helper routine to record keys ++ * It is called under orinoco_lock so it may not sleep */ ++static int orinoco_set_key(struct orinoco_private *priv, int index, ++ enum orinoco_alg alg, const u8 *key, int key_len, ++ const u8 *seq, int seq_len) ++{ ++ kfree_sensitive(priv->keys[index].key); ++ kfree_sensitive(priv->keys[index].seq); ++ ++ if (key_len) { ++ priv->keys[index].key = kzalloc(key_len, GFP_ATOMIC); ++ if (!priv->keys[index].key) ++ goto nomem; ++ } else ++ priv->keys[index].key = NULL; ++ ++ if (seq_len) { ++ priv->keys[index].seq = kzalloc(seq_len, GFP_ATOMIC); ++ if (!priv->keys[index].seq) ++ goto free_key; ++ } else ++ priv->keys[index].seq = NULL; ++ ++ priv->keys[index].key_len = key_len; ++ priv->keys[index].seq_len = seq_len; ++ ++ if (key_len) ++ memcpy((void *)priv->keys[index].key, key, key_len); ++ if (seq_len) ++ memcpy((void *)priv->keys[index].seq, seq, seq_len); ++ ++ switch (alg) { ++ case ORINOCO_ALG_TKIP: ++ priv->keys[index].cipher = WLAN_CIPHER_SUITE_TKIP; ++ break; ++ ++ case ORINOCO_ALG_WEP: ++ priv->keys[index].cipher = (key_len > SMALL_KEY_SIZE) ? ++ WLAN_CIPHER_SUITE_WEP104 : WLAN_CIPHER_SUITE_WEP40; ++ break; ++ ++ case ORINOCO_ALG_NONE: ++ default: ++ priv->keys[index].cipher = 0; ++ break; ++ } ++ ++ return 0; ++ ++free_key: ++ kfree(priv->keys[index].key); ++ priv->keys[index].key = NULL; ++ ++nomem: ++ priv->keys[index].key_len = 0; ++ priv->keys[index].seq_len = 0; ++ priv->keys[index].cipher = 0; ++ ++ return -ENOMEM; ++} ++ ++static struct iw_statistics *orinoco_get_wireless_stats(struct net_device *dev) ++{ ++ struct orinoco_private *priv = ndev_priv(dev); ++ struct hermes *hw = &priv->hw; ++ struct iw_statistics *wstats = &priv->wstats; ++ int err; ++ unsigned long flags; ++ ++ if (!netif_device_present(dev)) { ++ printk(KERN_WARNING "%s: get_wireless_stats() called while device not present\n", ++ dev->name); ++ return NULL; /* FIXME: Can we do better than this? */ ++ } ++ ++ /* If busy, return the old stats. Returning NULL may cause ++ * the interface to disappear from /proc/net/wireless */ ++ if (orinoco_lock(priv, &flags) != 0) ++ return wstats; ++ ++ /* We can't really wait for the tallies inquiry command to ++ * complete, so we just use the previous results and trigger ++ * a new tallies inquiry command for next time - Jean II */ ++ /* FIXME: Really we should wait for the inquiry to come back - ++ * as it is the stats we give don't make a whole lot of sense. ++ * Unfortunately, it's not clear how to do that within the ++ * wireless extensions framework: I think we're in user ++ * context, but a lock seems to be held by the time we get in ++ * here so we're not safe to sleep here. */ ++ hermes_inquire(hw, HERMES_INQ_TALLIES); ++ ++ if (priv->iw_mode == NL80211_IFTYPE_ADHOC) { ++ memset(&wstats->qual, 0, sizeof(wstats->qual)); ++ } else { ++ struct { ++ __le16 qual, signal, noise, unused; ++ } __packed cq; ++ ++ err = HERMES_READ_RECORD(hw, USER_BAP, ++ HERMES_RID_COMMSQUALITY, &cq); ++ ++ if (!err) { ++ wstats->qual.qual = (int)le16_to_cpu(cq.qual); ++ wstats->qual.level = (int)le16_to_cpu(cq.signal) - 0x95; ++ wstats->qual.noise = (int)le16_to_cpu(cq.noise) - 0x95; ++ wstats->qual.updated = ++ IW_QUAL_ALL_UPDATED | IW_QUAL_DBM; ++ } ++ } ++ ++ orinoco_unlock(priv, &flags); ++ return wstats; ++} ++ ++/********************************************************************/ ++/* Wireless extensions */ ++/********************************************************************/ ++ ++static int orinoco_ioctl_setwap(struct net_device *dev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct sockaddr *ap_addr = &wrqu->ap_addr; ++ struct orinoco_private *priv = ndev_priv(dev); ++ int err = -EINPROGRESS; /* Call commit handler */ ++ unsigned long flags; ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ return -EBUSY; ++ ++ /* Enable automatic roaming - no sanity checks are needed */ ++ if (is_zero_ether_addr(ap_addr->sa_data) || ++ is_broadcast_ether_addr(ap_addr->sa_data)) { ++ priv->bssid_fixed = 0; ++ eth_zero_addr(priv->desired_bssid); ++ ++ /* "off" means keep existing connection */ ++ if (ap_addr->sa_data[0] == 0) { ++ __orinoco_hw_set_wap(priv); ++ err = 0; ++ } ++ goto out; ++ } ++ ++ if (priv->firmware_type == FIRMWARE_TYPE_AGERE) { ++ printk(KERN_WARNING "%s: Lucent/Agere firmware doesn't " ++ "support manual roaming\n", ++ dev->name); ++ err = -EOPNOTSUPP; ++ goto out; ++ } ++ ++ if (priv->iw_mode != NL80211_IFTYPE_STATION) { ++ printk(KERN_WARNING "%s: Manual roaming supported only in " ++ "managed mode\n", dev->name); ++ err = -EOPNOTSUPP; ++ goto out; ++ } ++ ++ /* Intersil firmware hangs without Desired ESSID */ ++ if (priv->firmware_type == FIRMWARE_TYPE_INTERSIL && ++ strlen(priv->desired_essid) == 0) { ++ printk(KERN_WARNING "%s: Desired ESSID must be set for " ++ "manual roaming\n", dev->name); ++ err = -EOPNOTSUPP; ++ goto out; ++ } ++ ++ /* Finally, enable manual roaming */ ++ priv->bssid_fixed = 1; ++ memcpy(priv->desired_bssid, &ap_addr->sa_data, ETH_ALEN); ++ ++ out: ++ orinoco_unlock(priv, &flags); ++ return err; ++} ++ ++static int orinoco_ioctl_getwap(struct net_device *dev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct sockaddr *ap_addr = &wrqu->ap_addr; ++ struct orinoco_private *priv = ndev_priv(dev); ++ ++ int err = 0; ++ unsigned long flags; ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ return -EBUSY; ++ ++ ap_addr->sa_family = ARPHRD_ETHER; ++ err = orinoco_hw_get_current_bssid(priv, ap_addr->sa_data); ++ ++ orinoco_unlock(priv, &flags); ++ ++ return err; ++} ++ ++static int orinoco_ioctl_setiwencode(struct net_device *dev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *keybuf) ++{ ++ struct iw_point *erq = &wrqu->encoding; ++ struct orinoco_private *priv = ndev_priv(dev); ++ int index = (erq->flags & IW_ENCODE_INDEX) - 1; ++ int setindex = priv->tx_key; ++ enum orinoco_alg encode_alg = priv->encode_alg; ++ int restricted = priv->wep_restrict; ++ int err = -EINPROGRESS; /* Call commit handler */ ++ unsigned long flags; ++ ++ if (!priv->has_wep) ++ return -EOPNOTSUPP; ++ ++ if (erq->pointer) { ++ /* We actually have a key to set - check its length */ ++ if (erq->length > LARGE_KEY_SIZE) ++ return -E2BIG; ++ ++ if ((erq->length > SMALL_KEY_SIZE) && !priv->has_big_wep) ++ return -E2BIG; ++ } ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ return -EBUSY; ++ ++ /* Clear any TKIP key we have */ ++ if ((priv->has_wpa) && (priv->encode_alg == ORINOCO_ALG_TKIP)) ++ (void) orinoco_clear_tkip_key(priv, setindex); ++ ++ if (erq->length > 0) { ++ if ((index < 0) || (index >= ORINOCO_MAX_KEYS)) ++ index = priv->tx_key; ++ ++ /* Switch on WEP if off */ ++ if (encode_alg != ORINOCO_ALG_WEP) { ++ setindex = index; ++ encode_alg = ORINOCO_ALG_WEP; ++ } ++ } else { ++ /* Important note : if the user do "iwconfig eth0 enc off", ++ * we will arrive there with an index of -1. This is valid ++ * but need to be taken care off... Jean II */ ++ if ((index < 0) || (index >= ORINOCO_MAX_KEYS)) { ++ if ((index != -1) || (erq->flags == 0)) { ++ err = -EINVAL; ++ goto out; ++ } ++ } else { ++ /* Set the index : Check that the key is valid */ ++ if (priv->keys[index].key_len == 0) { ++ err = -EINVAL; ++ goto out; ++ } ++ setindex = index; ++ } ++ } ++ ++ if (erq->flags & IW_ENCODE_DISABLED) ++ encode_alg = ORINOCO_ALG_NONE; ++ if (erq->flags & IW_ENCODE_OPEN) ++ restricted = 0; ++ if (erq->flags & IW_ENCODE_RESTRICTED) ++ restricted = 1; ++ ++ if (erq->pointer && erq->length > 0) { ++ err = orinoco_set_key(priv, index, ORINOCO_ALG_WEP, keybuf, ++ erq->length, NULL, 0); ++ } ++ priv->tx_key = setindex; ++ ++ /* Try fast key change if connected and only keys are changed */ ++ if ((priv->encode_alg == encode_alg) && ++ (priv->wep_restrict == restricted) && ++ netif_carrier_ok(dev)) { ++ err = __orinoco_hw_setup_wepkeys(priv); ++ /* No need to commit if successful */ ++ goto out; ++ } ++ ++ priv->encode_alg = encode_alg; ++ priv->wep_restrict = restricted; ++ ++ out: ++ orinoco_unlock(priv, &flags); ++ ++ return err; ++} ++ ++static int orinoco_ioctl_getiwencode(struct net_device *dev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *keybuf) ++{ ++ struct iw_point *erq = &wrqu->encoding; ++ struct orinoco_private *priv = ndev_priv(dev); ++ int index = (erq->flags & IW_ENCODE_INDEX) - 1; ++ unsigned long flags; ++ ++ if (!priv->has_wep) ++ return -EOPNOTSUPP; ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ return -EBUSY; ++ ++ if ((index < 0) || (index >= ORINOCO_MAX_KEYS)) ++ index = priv->tx_key; ++ ++ erq->flags = 0; ++ if (!priv->encode_alg) ++ erq->flags |= IW_ENCODE_DISABLED; ++ erq->flags |= index + 1; ++ ++ if (priv->wep_restrict) ++ erq->flags |= IW_ENCODE_RESTRICTED; ++ else ++ erq->flags |= IW_ENCODE_OPEN; ++ ++ erq->length = priv->keys[index].key_len; ++ ++ memcpy(keybuf, priv->keys[index].key, erq->length); ++ ++ orinoco_unlock(priv, &flags); ++ return 0; ++} ++ ++static int orinoco_ioctl_setessid(struct net_device *dev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *essidbuf) ++{ ++ struct iw_point *erq = &wrqu->essid; ++ struct orinoco_private *priv = ndev_priv(dev); ++ unsigned long flags; ++ ++ /* Note : ESSID is ignored in Ad-Hoc demo mode, but we can set it ++ * anyway... - Jean II */ ++ ++ /* Hum... Should not use Wireless Extension constant (may change), ++ * should use our own... - Jean II */ ++ if (erq->length > IW_ESSID_MAX_SIZE) ++ return -E2BIG; ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ return -EBUSY; ++ ++ /* NULL the string (for NULL termination & ESSID = ANY) - Jean II */ ++ memset(priv->desired_essid, 0, sizeof(priv->desired_essid)); ++ ++ /* If not ANY, get the new ESSID */ ++ if (erq->flags) ++ memcpy(priv->desired_essid, essidbuf, erq->length); ++ ++ orinoco_unlock(priv, &flags); ++ ++ return -EINPROGRESS; /* Call commit handler */ ++} ++ ++static int orinoco_ioctl_getessid(struct net_device *dev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *essidbuf) ++{ ++ struct iw_point *erq = &wrqu->essid; ++ struct orinoco_private *priv = ndev_priv(dev); ++ int active; ++ int err = 0; ++ unsigned long flags; ++ ++ if (netif_running(dev)) { ++ err = orinoco_hw_get_essid(priv, &active, essidbuf); ++ if (err < 0) ++ return err; ++ erq->length = err; ++ } else { ++ if (orinoco_lock(priv, &flags) != 0) ++ return -EBUSY; ++ memcpy(essidbuf, priv->desired_essid, IW_ESSID_MAX_SIZE); ++ erq->length = strlen(priv->desired_essid); ++ orinoco_unlock(priv, &flags); ++ } ++ ++ erq->flags = 1; ++ ++ return 0; ++} ++ ++static int orinoco_ioctl_setfreq(struct net_device *dev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_freq *frq = &wrqu->freq; ++ struct orinoco_private *priv = ndev_priv(dev); ++ int chan = -1; ++ unsigned long flags; ++ int err = -EINPROGRESS; /* Call commit handler */ ++ ++ /* In infrastructure mode the AP sets the channel */ ++ if (priv->iw_mode == NL80211_IFTYPE_STATION) ++ return -EBUSY; ++ ++ if ((frq->e == 0) && (frq->m <= 1000)) { ++ /* Setting by channel number */ ++ chan = frq->m; ++ } else { ++ /* Setting by frequency */ ++ int denom = 1; ++ int i; ++ ++ /* Calculate denominator to rescale to MHz */ ++ for (i = 0; i < (6 - frq->e); i++) ++ denom *= 10; ++ ++ chan = ieee80211_frequency_to_channel(frq->m / denom); ++ } ++ ++ if ((chan < 1) || (chan > NUM_CHANNELS) || ++ !(priv->channel_mask & (1 << (chan - 1)))) ++ return -EINVAL; ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ return -EBUSY; ++ ++ priv->channel = chan; ++ if (priv->iw_mode == NL80211_IFTYPE_MONITOR) { ++ /* Fast channel change - no commit if successful */ ++ struct hermes *hw = &priv->hw; ++ err = hw->ops->cmd_wait(hw, HERMES_CMD_TEST | ++ HERMES_TEST_SET_CHANNEL, ++ chan, NULL); ++ } ++ orinoco_unlock(priv, &flags); ++ ++ return err; ++} ++ ++static int orinoco_ioctl_getfreq(struct net_device *dev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_freq *frq = &wrqu->freq; ++ struct orinoco_private *priv = ndev_priv(dev); ++ int tmp; ++ ++ /* Locking done in there */ ++ tmp = orinoco_hw_get_freq(priv); ++ if (tmp < 0) ++ return tmp; ++ ++ frq->m = tmp * 100000; ++ frq->e = 1; ++ ++ return 0; ++} ++ ++static int orinoco_ioctl_getsens(struct net_device *dev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_param *srq = &wrqu->sens; ++ struct orinoco_private *priv = ndev_priv(dev); ++ struct hermes *hw = &priv->hw; ++ u16 val; ++ int err; ++ unsigned long flags; ++ ++ if (!priv->has_sensitivity) ++ return -EOPNOTSUPP; ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ return -EBUSY; ++ err = hermes_read_wordrec(hw, USER_BAP, ++ HERMES_RID_CNFSYSTEMSCALE, &val); ++ orinoco_unlock(priv, &flags); ++ ++ if (err) ++ return err; ++ ++ srq->value = val; ++ srq->fixed = 0; /* auto */ ++ ++ return 0; ++} ++ ++static int orinoco_ioctl_setsens(struct net_device *dev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_param *srq = &wrqu->sens; ++ struct orinoco_private *priv = ndev_priv(dev); ++ int val = srq->value; ++ unsigned long flags; ++ ++ if (!priv->has_sensitivity) ++ return -EOPNOTSUPP; ++ ++ if ((val < 1) || (val > 3)) ++ return -EINVAL; ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ return -EBUSY; ++ priv->ap_density = val; ++ orinoco_unlock(priv, &flags); ++ ++ return -EINPROGRESS; /* Call commit handler */ ++} ++ ++static int orinoco_ioctl_setrate(struct net_device *dev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_param *rrq = &wrqu->bitrate; ++ struct orinoco_private *priv = ndev_priv(dev); ++ int ratemode; ++ int bitrate; /* 100s of kilobits */ ++ unsigned long flags; ++ ++ /* As the user space doesn't know our highest rate, it uses -1 ++ * to ask us to set the highest rate. Test it using "iwconfig ++ * ethX rate auto" - Jean II */ ++ if (rrq->value == -1) ++ bitrate = 110; ++ else { ++ if (rrq->value % 100000) ++ return -EINVAL; ++ bitrate = rrq->value / 100000; ++ } ++ ++ ratemode = orinoco_get_bitratemode(bitrate, !rrq->fixed); ++ ++ if (ratemode == -1) ++ return -EINVAL; ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ return -EBUSY; ++ priv->bitratemode = ratemode; ++ orinoco_unlock(priv, &flags); ++ ++ return -EINPROGRESS; ++} ++ ++static int orinoco_ioctl_getrate(struct net_device *dev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_param *rrq = &wrqu->bitrate; ++ struct orinoco_private *priv = ndev_priv(dev); ++ int err = 0; ++ int bitrate, automatic; ++ unsigned long flags; ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ return -EBUSY; ++ ++ orinoco_get_ratemode_cfg(priv->bitratemode, &bitrate, &automatic); ++ ++ /* If the interface is running we try to find more about the ++ current mode */ ++ if (netif_running(dev)) { ++ int act_bitrate; ++ int lerr; ++ ++ /* Ignore errors if we can't get the actual bitrate */ ++ lerr = orinoco_hw_get_act_bitrate(priv, &act_bitrate); ++ if (!lerr) ++ bitrate = act_bitrate; ++ } ++ ++ orinoco_unlock(priv, &flags); ++ ++ rrq->value = bitrate; ++ rrq->fixed = !automatic; ++ rrq->disabled = 0; ++ ++ return err; ++} ++ ++static int orinoco_ioctl_setpower(struct net_device *dev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_param *prq = &wrqu->power; ++ struct orinoco_private *priv = ndev_priv(dev); ++ int err = -EINPROGRESS; /* Call commit handler */ ++ unsigned long flags; ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ return -EBUSY; ++ ++ if (prq->disabled) { ++ priv->pm_on = 0; ++ } else { ++ switch (prq->flags & IW_POWER_MODE) { ++ case IW_POWER_UNICAST_R: ++ priv->pm_mcast = 0; ++ priv->pm_on = 1; ++ break; ++ case IW_POWER_ALL_R: ++ priv->pm_mcast = 1; ++ priv->pm_on = 1; ++ break; ++ case IW_POWER_ON: ++ /* No flags : but we may have a value - Jean II */ ++ break; ++ default: ++ err = -EINVAL; ++ goto out; ++ } ++ ++ if (prq->flags & IW_POWER_TIMEOUT) { ++ priv->pm_on = 1; ++ priv->pm_timeout = prq->value / 1000; ++ } ++ if (prq->flags & IW_POWER_PERIOD) { ++ priv->pm_on = 1; ++ priv->pm_period = prq->value / 1000; ++ } ++ /* It's valid to not have a value if we are just toggling ++ * the flags... Jean II */ ++ if (!priv->pm_on) { ++ err = -EINVAL; ++ goto out; ++ } ++ } ++ ++ out: ++ orinoco_unlock(priv, &flags); ++ ++ return err; ++} ++ ++static int orinoco_ioctl_getpower(struct net_device *dev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_param *prq = &wrqu->power; ++ struct orinoco_private *priv = ndev_priv(dev); ++ struct hermes *hw = &priv->hw; ++ int err = 0; ++ u16 enable, period, timeout, mcast; ++ unsigned long flags; ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ return -EBUSY; ++ ++ err = hermes_read_wordrec(hw, USER_BAP, ++ HERMES_RID_CNFPMENABLED, &enable); ++ if (err) ++ goto out; ++ ++ err = hermes_read_wordrec(hw, USER_BAP, ++ HERMES_RID_CNFMAXSLEEPDURATION, &period); ++ if (err) ++ goto out; ++ ++ err = hermes_read_wordrec(hw, USER_BAP, ++ HERMES_RID_CNFPMHOLDOVERDURATION, &timeout); ++ if (err) ++ goto out; ++ ++ err = hermes_read_wordrec(hw, USER_BAP, ++ HERMES_RID_CNFMULTICASTRECEIVE, &mcast); ++ if (err) ++ goto out; ++ ++ prq->disabled = !enable; ++ /* Note : by default, display the period */ ++ if ((prq->flags & IW_POWER_TYPE) == IW_POWER_TIMEOUT) { ++ prq->flags = IW_POWER_TIMEOUT; ++ prq->value = timeout * 1000; ++ } else { ++ prq->flags = IW_POWER_PERIOD; ++ prq->value = period * 1000; ++ } ++ if (mcast) ++ prq->flags |= IW_POWER_ALL_R; ++ else ++ prq->flags |= IW_POWER_UNICAST_R; ++ ++ out: ++ orinoco_unlock(priv, &flags); ++ ++ return err; ++} ++ ++static int orinoco_ioctl_set_encodeext(struct net_device *dev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct orinoco_private *priv = ndev_priv(dev); ++ struct iw_point *encoding = &wrqu->encoding; ++ struct iw_encode_ext *ext = (struct iw_encode_ext *)extra; ++ int idx, alg = ext->alg, set_key = 1; ++ unsigned long flags; ++ int err = -EINVAL; ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ return -EBUSY; ++ ++ /* Determine and validate the key index */ ++ idx = encoding->flags & IW_ENCODE_INDEX; ++ if (idx) { ++ if ((idx < 1) || (idx > 4)) ++ goto out; ++ idx--; ++ } else ++ idx = priv->tx_key; ++ ++ if (encoding->flags & IW_ENCODE_DISABLED) ++ alg = IW_ENCODE_ALG_NONE; ++ ++ if (priv->has_wpa && (alg != IW_ENCODE_ALG_TKIP)) { ++ /* Clear any TKIP TX key we had */ ++ (void) orinoco_clear_tkip_key(priv, priv->tx_key); ++ } ++ ++ if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY) { ++ priv->tx_key = idx; ++ set_key = ((alg == IW_ENCODE_ALG_TKIP) || ++ (ext->key_len > 0)) ? 1 : 0; ++ } ++ ++ if (set_key) { ++ /* Set the requested key first */ ++ switch (alg) { ++ case IW_ENCODE_ALG_NONE: ++ priv->encode_alg = ORINOCO_ALG_NONE; ++ err = orinoco_set_key(priv, idx, ORINOCO_ALG_NONE, ++ NULL, 0, NULL, 0); ++ break; ++ ++ case IW_ENCODE_ALG_WEP: ++ if (ext->key_len <= 0) ++ goto out; ++ ++ priv->encode_alg = ORINOCO_ALG_WEP; ++ err = orinoco_set_key(priv, idx, ORINOCO_ALG_WEP, ++ ext->key, ext->key_len, NULL, 0); ++ break; ++ ++ case IW_ENCODE_ALG_TKIP: ++ { ++ u8 *tkip_iv = NULL; ++ ++ if (!priv->has_wpa || ++ (ext->key_len > sizeof(struct orinoco_tkip_key))) ++ goto out; ++ ++ priv->encode_alg = ORINOCO_ALG_TKIP; ++ ++ if (ext->ext_flags & IW_ENCODE_EXT_RX_SEQ_VALID) ++ tkip_iv = &ext->rx_seq[0]; ++ ++ err = orinoco_set_key(priv, idx, ORINOCO_ALG_TKIP, ++ ext->key, ext->key_len, tkip_iv, ++ ORINOCO_SEQ_LEN); ++ ++ err = __orinoco_hw_set_tkip_key(priv, idx, ++ ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY, ++ priv->keys[idx].key, priv->keys[idx].key_len, ++ tkip_iv, ORINOCO_SEQ_LEN, NULL, 0); ++ if (err) ++ printk(KERN_ERR "%s: Error %d setting TKIP key" ++ "\n", dev->name, err); ++ ++ goto out; ++ } ++ default: ++ goto out; ++ } ++ } ++ err = -EINPROGRESS; ++ out: ++ orinoco_unlock(priv, &flags); ++ ++ return err; ++} ++ ++static int orinoco_ioctl_get_encodeext(struct net_device *dev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct orinoco_private *priv = ndev_priv(dev); ++ struct iw_point *encoding = &wrqu->encoding; ++ struct iw_encode_ext *ext = (struct iw_encode_ext *)extra; ++ int idx, max_key_len; ++ unsigned long flags; ++ int err; ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ return -EBUSY; ++ ++ err = -EINVAL; ++ max_key_len = encoding->length - sizeof(*ext); ++ if (max_key_len < 0) ++ goto out; ++ ++ idx = encoding->flags & IW_ENCODE_INDEX; ++ if (idx) { ++ if ((idx < 1) || (idx > 4)) ++ goto out; ++ idx--; ++ } else ++ idx = priv->tx_key; ++ ++ encoding->flags = idx + 1; ++ memset(ext, 0, sizeof(*ext)); ++ ++ switch (priv->encode_alg) { ++ case ORINOCO_ALG_NONE: ++ ext->alg = IW_ENCODE_ALG_NONE; ++ ext->key_len = 0; ++ encoding->flags |= IW_ENCODE_DISABLED; ++ break; ++ case ORINOCO_ALG_WEP: ++ ext->alg = IW_ENCODE_ALG_WEP; ++ ext->key_len = min(priv->keys[idx].key_len, max_key_len); ++ memcpy(ext->key, priv->keys[idx].key, ext->key_len); ++ encoding->flags |= IW_ENCODE_ENABLED; ++ break; ++ case ORINOCO_ALG_TKIP: ++ ext->alg = IW_ENCODE_ALG_TKIP; ++ ext->key_len = min(priv->keys[idx].key_len, max_key_len); ++ memcpy(ext->key, priv->keys[idx].key, ext->key_len); ++ encoding->flags |= IW_ENCODE_ENABLED; ++ break; ++ } ++ ++ err = 0; ++ out: ++ orinoco_unlock(priv, &flags); ++ ++ return err; ++} ++ ++static int orinoco_ioctl_set_auth(struct net_device *dev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, char *extra) ++{ ++ struct orinoco_private *priv = ndev_priv(dev); ++ struct hermes *hw = &priv->hw; ++ struct iw_param *param = &wrqu->param; ++ unsigned long flags; ++ int ret = -EINPROGRESS; ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ return -EBUSY; ++ ++ switch (param->flags & IW_AUTH_INDEX) { ++ case IW_AUTH_WPA_VERSION: ++ case IW_AUTH_CIPHER_PAIRWISE: ++ case IW_AUTH_CIPHER_GROUP: ++ case IW_AUTH_RX_UNENCRYPTED_EAPOL: ++ case IW_AUTH_PRIVACY_INVOKED: ++ case IW_AUTH_DROP_UNENCRYPTED: ++ /* ++ * orinoco does not use these parameters ++ */ ++ break; ++ ++ case IW_AUTH_MFP: ++ /* Management Frame Protection not supported. ++ * Only fail if set to required. ++ */ ++ if (param->value == IW_AUTH_MFP_REQUIRED) ++ ret = -EINVAL; ++ break; ++ ++ case IW_AUTH_KEY_MGMT: ++ /* wl_lkm implies value 2 == PSK for Hermes I ++ * which ties in with WEXT ++ * no other hints tho :( ++ */ ++ priv->key_mgmt = param->value; ++ break; ++ ++ case IW_AUTH_TKIP_COUNTERMEASURES: ++ /* When countermeasures are enabled, shut down the ++ * card; when disabled, re-enable the card. This must ++ * take effect immediately. ++ * ++ * TODO: Make sure that the EAPOL message is getting ++ * out before card disabled ++ */ ++ if (param->value) { ++ priv->tkip_cm_active = 1; ++ ret = hermes_disable_port(hw, 0); ++ } else { ++ priv->tkip_cm_active = 0; ++ ret = hermes_enable_port(hw, 0); ++ } ++ break; ++ ++ case IW_AUTH_80211_AUTH_ALG: ++ if (param->value & IW_AUTH_ALG_SHARED_KEY) ++ priv->wep_restrict = 1; ++ else if (param->value & IW_AUTH_ALG_OPEN_SYSTEM) ++ priv->wep_restrict = 0; ++ else ++ ret = -EINVAL; ++ break; ++ ++ case IW_AUTH_WPA_ENABLED: ++ if (priv->has_wpa) { ++ priv->wpa_enabled = param->value ? 1 : 0; ++ } else { ++ if (param->value) ++ ret = -EOPNOTSUPP; ++ /* else silently accept disable of WPA */ ++ priv->wpa_enabled = 0; ++ } ++ break; ++ ++ default: ++ ret = -EOPNOTSUPP; ++ } ++ ++ orinoco_unlock(priv, &flags); ++ return ret; ++} ++ ++static int orinoco_ioctl_get_auth(struct net_device *dev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, char *extra) ++{ ++ struct orinoco_private *priv = ndev_priv(dev); ++ struct iw_param *param = &wrqu->param; ++ unsigned long flags; ++ int ret = 0; ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ return -EBUSY; ++ ++ switch (param->flags & IW_AUTH_INDEX) { ++ case IW_AUTH_KEY_MGMT: ++ param->value = priv->key_mgmt; ++ break; ++ ++ case IW_AUTH_TKIP_COUNTERMEASURES: ++ param->value = priv->tkip_cm_active; ++ break; ++ ++ case IW_AUTH_80211_AUTH_ALG: ++ if (priv->wep_restrict) ++ param->value = IW_AUTH_ALG_SHARED_KEY; ++ else ++ param->value = IW_AUTH_ALG_OPEN_SYSTEM; ++ break; ++ ++ case IW_AUTH_WPA_ENABLED: ++ param->value = priv->wpa_enabled; ++ break; ++ ++ default: ++ ret = -EOPNOTSUPP; ++ } ++ ++ orinoco_unlock(priv, &flags); ++ return ret; ++} ++ ++static int orinoco_ioctl_set_genie(struct net_device *dev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, char *extra) ++{ ++ struct orinoco_private *priv = ndev_priv(dev); ++ u8 *buf; ++ unsigned long flags; ++ ++ /* cut off at IEEE80211_MAX_DATA_LEN */ ++ if ((wrqu->data.length > IEEE80211_MAX_DATA_LEN) || ++ (wrqu->data.length && (extra == NULL))) ++ return -EINVAL; ++ ++ if (wrqu->data.length) { ++ buf = kmemdup(extra, wrqu->data.length, GFP_KERNEL); ++ if (buf == NULL) ++ return -ENOMEM; ++ } else ++ buf = NULL; ++ ++ if (orinoco_lock(priv, &flags) != 0) { ++ kfree(buf); ++ return -EBUSY; ++ } ++ ++ kfree(priv->wpa_ie); ++ priv->wpa_ie = buf; ++ priv->wpa_ie_len = wrqu->data.length; ++ ++ if (priv->wpa_ie) { ++ /* Looks like wl_lkm wants to check the auth alg, and ++ * somehow pass it to the firmware. ++ * Instead it just calls the key mgmt rid ++ * - we do this in set auth. ++ */ ++ } ++ ++ orinoco_unlock(priv, &flags); ++ return 0; ++} ++ ++static int orinoco_ioctl_get_genie(struct net_device *dev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, char *extra) ++{ ++ struct orinoco_private *priv = ndev_priv(dev); ++ unsigned long flags; ++ int err = 0; ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ return -EBUSY; ++ ++ if ((priv->wpa_ie_len == 0) || (priv->wpa_ie == NULL)) { ++ wrqu->data.length = 0; ++ goto out; ++ } ++ ++ if (wrqu->data.length < priv->wpa_ie_len) { ++ err = -E2BIG; ++ goto out; ++ } ++ ++ wrqu->data.length = priv->wpa_ie_len; ++ memcpy(extra, priv->wpa_ie, priv->wpa_ie_len); ++ ++out: ++ orinoco_unlock(priv, &flags); ++ return err; ++} ++ ++static int orinoco_ioctl_set_mlme(struct net_device *dev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, char *extra) ++{ ++ struct orinoco_private *priv = ndev_priv(dev); ++ struct iw_mlme *mlme = (struct iw_mlme *)extra; ++ unsigned long flags; ++ int ret = 0; ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ return -EBUSY; ++ ++ switch (mlme->cmd) { ++ case IW_MLME_DEAUTH: ++ /* silently ignore */ ++ break; ++ ++ case IW_MLME_DISASSOC: ++ ++ ret = orinoco_hw_disassociate(priv, mlme->addr.sa_data, ++ mlme->reason_code); ++ break; ++ ++ default: ++ ret = -EOPNOTSUPP; ++ } ++ ++ orinoco_unlock(priv, &flags); ++ return ret; ++} ++ ++static int orinoco_ioctl_reset(struct net_device *dev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct orinoco_private *priv = ndev_priv(dev); ++ ++ if (!capable(CAP_NET_ADMIN)) ++ return -EPERM; ++ ++ if (info->cmd == (SIOCIWFIRSTPRIV + 0x1)) { ++ printk(KERN_DEBUG "%s: Forcing reset!\n", dev->name); ++ ++ /* Firmware reset */ ++ orinoco_reset(&priv->reset_work); ++ } else { ++ printk(KERN_DEBUG "%s: Force scheduling reset!\n", dev->name); ++ ++ schedule_work(&priv->reset_work); ++ } ++ ++ return 0; ++} ++ ++static int orinoco_ioctl_setibssport(struct net_device *dev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++ ++{ ++ struct orinoco_private *priv = ndev_priv(dev); ++ int val = *((int *) extra); ++ unsigned long flags; ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ return -EBUSY; ++ ++ priv->ibss_port = val; ++ ++ /* Actually update the mode we are using */ ++ set_port_type(priv); ++ ++ orinoco_unlock(priv, &flags); ++ return -EINPROGRESS; /* Call commit handler */ ++} ++ ++static int orinoco_ioctl_getibssport(struct net_device *dev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct orinoco_private *priv = ndev_priv(dev); ++ int *val = (int *) extra; ++ ++ *val = priv->ibss_port; ++ return 0; ++} ++ ++static int orinoco_ioctl_setport3(struct net_device *dev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct orinoco_private *priv = ndev_priv(dev); ++ int val = *((int *) extra); ++ int err = 0; ++ unsigned long flags; ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ return -EBUSY; ++ ++ switch (val) { ++ case 0: /* Try to do IEEE ad-hoc mode */ ++ if (!priv->has_ibss) { ++ err = -EINVAL; ++ break; ++ } ++ priv->prefer_port3 = 0; ++ ++ break; ++ ++ case 1: /* Try to do Lucent proprietary ad-hoc mode */ ++ if (!priv->has_port3) { ++ err = -EINVAL; ++ break; ++ } ++ priv->prefer_port3 = 1; ++ break; ++ ++ default: ++ err = -EINVAL; ++ } ++ ++ if (!err) { ++ /* Actually update the mode we are using */ ++ set_port_type(priv); ++ err = -EINPROGRESS; ++ } ++ ++ orinoco_unlock(priv, &flags); ++ ++ return err; ++} ++ ++static int orinoco_ioctl_getport3(struct net_device *dev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct orinoco_private *priv = ndev_priv(dev); ++ int *val = (int *) extra; ++ ++ *val = priv->prefer_port3; ++ return 0; ++} ++ ++static int orinoco_ioctl_setpreamble(struct net_device *dev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct orinoco_private *priv = ndev_priv(dev); ++ unsigned long flags; ++ int val; ++ ++ if (!priv->has_preamble) ++ return -EOPNOTSUPP; ++ ++ /* 802.11b has recently defined some short preamble. ++ * Basically, the Phy header has been reduced in size. ++ * This increase performance, especially at high rates ++ * (the preamble is transmitted at 1Mb/s), unfortunately ++ * this give compatibility troubles... - Jean II */ ++ val = *((int *) extra); ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ return -EBUSY; ++ ++ if (val) ++ priv->preamble = 1; ++ else ++ priv->preamble = 0; ++ ++ orinoco_unlock(priv, &flags); ++ ++ return -EINPROGRESS; /* Call commit handler */ ++} ++ ++static int orinoco_ioctl_getpreamble(struct net_device *dev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct orinoco_private *priv = ndev_priv(dev); ++ int *val = (int *) extra; ++ ++ if (!priv->has_preamble) ++ return -EOPNOTSUPP; ++ ++ *val = priv->preamble; ++ return 0; ++} ++ ++/* ioctl interface to hermes_read_ltv() ++ * To use with iwpriv, pass the RID as the token argument, e.g. ++ * iwpriv get_rid [0xfc00] ++ * At least Wireless Tools 25 is required to use iwpriv. ++ * For Wireless Tools 25 and 26 append "dummy" are the end. */ ++static int orinoco_ioctl_getrid(struct net_device *dev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_point *data = &wrqu->data; ++ struct orinoco_private *priv = ndev_priv(dev); ++ struct hermes *hw = &priv->hw; ++ int rid = data->flags; ++ u16 length; ++ int err; ++ unsigned long flags; ++ ++ /* It's a "get" function, but we don't want users to access the ++ * WEP key and other raw firmware data */ ++ if (!capable(CAP_NET_ADMIN)) ++ return -EPERM; ++ ++ if (rid < 0xfc00 || rid > 0xffff) ++ return -EINVAL; ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ return -EBUSY; ++ ++ err = hw->ops->read_ltv(hw, USER_BAP, rid, MAX_RID_LEN, &length, ++ extra); ++ if (err) ++ goto out; ++ ++ data->length = min_t(u16, HERMES_RECLEN_TO_BYTES(length), ++ MAX_RID_LEN); ++ ++ out: ++ orinoco_unlock(priv, &flags); ++ return err; ++} ++ ++ ++/* Commit handler, called after set operations */ ++static int orinoco_ioctl_commit(struct net_device *dev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct orinoco_private *priv = ndev_priv(dev); ++ unsigned long flags; ++ int err = 0; ++ ++ if (!priv->open) ++ return 0; ++ ++ if (orinoco_lock(priv, &flags) != 0) ++ return err; ++ ++ err = orinoco_commit(priv); ++ ++ orinoco_unlock(priv, &flags); ++ return err; ++} ++ ++static const struct iw_priv_args orinoco_privtab[] = { ++ { SIOCIWFIRSTPRIV + 0x0, 0, 0, "force_reset" }, ++ { SIOCIWFIRSTPRIV + 0x1, 0, 0, "card_reset" }, ++ { SIOCIWFIRSTPRIV + 0x2, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, ++ 0, "set_port3" }, ++ { SIOCIWFIRSTPRIV + 0x3, 0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, ++ "get_port3" }, ++ { SIOCIWFIRSTPRIV + 0x4, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, ++ 0, "set_preamble" }, ++ { SIOCIWFIRSTPRIV + 0x5, 0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, ++ "get_preamble" }, ++ { SIOCIWFIRSTPRIV + 0x6, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, ++ 0, "set_ibssport" }, ++ { SIOCIWFIRSTPRIV + 0x7, 0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, ++ "get_ibssport" }, ++ { SIOCIWFIRSTPRIV + 0x9, 0, IW_PRIV_TYPE_BYTE | MAX_RID_LEN, ++ "get_rid" }, ++}; ++ ++ ++/* ++ * Structures to export the Wireless Handlers ++ */ ++ ++static const iw_handler orinoco_handler[] = { ++ IW_HANDLER(SIOCSIWCOMMIT, orinoco_ioctl_commit), ++ IW_HANDLER(SIOCGIWNAME, cfg80211_wext_giwname), ++ IW_HANDLER(SIOCSIWFREQ, orinoco_ioctl_setfreq), ++ IW_HANDLER(SIOCGIWFREQ, orinoco_ioctl_getfreq), ++ IW_HANDLER(SIOCSIWMODE, cfg80211_wext_siwmode), ++ IW_HANDLER(SIOCGIWMODE, cfg80211_wext_giwmode), ++ IW_HANDLER(SIOCSIWSENS, orinoco_ioctl_setsens), ++ IW_HANDLER(SIOCGIWSENS, orinoco_ioctl_getsens), ++ IW_HANDLER(SIOCGIWRANGE, cfg80211_wext_giwrange), ++ IW_HANDLER(SIOCSIWAP, orinoco_ioctl_setwap), ++ IW_HANDLER(SIOCGIWAP, orinoco_ioctl_getwap), ++ IW_HANDLER(SIOCSIWSCAN, cfg80211_wext_siwscan), ++ IW_HANDLER(SIOCGIWSCAN, cfg80211_wext_giwscan), ++ IW_HANDLER(SIOCSIWESSID, orinoco_ioctl_setessid), ++ IW_HANDLER(SIOCGIWESSID, orinoco_ioctl_getessid), ++ IW_HANDLER(SIOCSIWRATE, orinoco_ioctl_setrate), ++ IW_HANDLER(SIOCGIWRATE, orinoco_ioctl_getrate), ++ IW_HANDLER(SIOCSIWRTS, cfg80211_wext_siwrts), ++ IW_HANDLER(SIOCGIWRTS, cfg80211_wext_giwrts), ++ IW_HANDLER(SIOCSIWFRAG, cfg80211_wext_siwfrag), ++ IW_HANDLER(SIOCGIWFRAG, cfg80211_wext_giwfrag), ++ IW_HANDLER(SIOCGIWRETRY, cfg80211_wext_giwretry), ++ IW_HANDLER(SIOCSIWENCODE, orinoco_ioctl_setiwencode), ++ IW_HANDLER(SIOCGIWENCODE, orinoco_ioctl_getiwencode), ++ IW_HANDLER(SIOCSIWPOWER, orinoco_ioctl_setpower), ++ IW_HANDLER(SIOCGIWPOWER, orinoco_ioctl_getpower), ++ IW_HANDLER(SIOCSIWGENIE, orinoco_ioctl_set_genie), ++ IW_HANDLER(SIOCGIWGENIE, orinoco_ioctl_get_genie), ++ IW_HANDLER(SIOCSIWMLME, orinoco_ioctl_set_mlme), ++ IW_HANDLER(SIOCSIWAUTH, orinoco_ioctl_set_auth), ++ IW_HANDLER(SIOCGIWAUTH, orinoco_ioctl_get_auth), ++ IW_HANDLER(SIOCSIWENCODEEXT, orinoco_ioctl_set_encodeext), ++ IW_HANDLER(SIOCGIWENCODEEXT, orinoco_ioctl_get_encodeext), ++}; ++ ++ ++/* ++ Added typecasting since we no longer use iwreq_data -- Moustafa ++ */ ++static const iw_handler orinoco_private_handler[] = { ++ [0] = orinoco_ioctl_reset, ++ [1] = orinoco_ioctl_reset, ++ [2] = orinoco_ioctl_setport3, ++ [3] = orinoco_ioctl_getport3, ++ [4] = orinoco_ioctl_setpreamble, ++ [5] = orinoco_ioctl_getpreamble, ++ [6] = orinoco_ioctl_setibssport, ++ [7] = orinoco_ioctl_getibssport, ++ [9] = orinoco_ioctl_getrid, ++}; ++ ++const struct iw_handler_def orinoco_handler_def = { ++ .num_standard = ARRAY_SIZE(orinoco_handler), ++ .num_private = ARRAY_SIZE(orinoco_private_handler), ++ .num_private_args = ARRAY_SIZE(orinoco_privtab), ++ .standard = orinoco_handler, ++ .private = orinoco_private_handler, ++ .private_args = orinoco_privtab, ++ .get_wireless_stats = orinoco_get_wireless_stats, ++}; +diff -Nur linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/wext.h linux-6.15.6/drivers/net/wireless/intersil/orinoco/wext.h +--- linux-6.15.6.orig/drivers/net/wireless/intersil/orinoco/wext.h 1970-01-01 01:00:00.000000000 +0100 ++++ linux-6.15.6/drivers/net/wireless/intersil/orinoco/wext.h 2025-08-03 15:01:59.393129374 +0200 +@@ -0,0 +1,13 @@ ++/* Wireless extensions support. ++ * ++ * See copyright notice in main.c ++ */ ++#ifndef _ORINOCO_WEXT_H_ ++#define _ORINOCO_WEXT_H_ ++ ++#include <net/iw_handler.h> ++ ++/* Structure defining all our WEXT handlers */ ++extern const struct iw_handler_def orinoco_handler_def; ++ ++#endif /* _ORINOCO_WEXT_H_ */ |