Only in airo-021-dragorn/driver: Makefile
diff -u -r airo-021-pristine/driver/airo.c airo-021-dragorn/driver/airo.c
--- airo-021-pristine/driver/airo.c	2004-04-08 10:42:45.000000000 -0400
+++ airo-021-dragorn/driver/airo.c	2004-07-23 14:07:37.000000000 -0400
@@ -26,7 +26,25 @@
                           added driver version request
                           added RF monitor support
 			  fixed wireless-tools support
-    
+  
+    Kismet/Dragorn patch 0.1
+    Additional/repaired functionality for use with Kismet (and in general)
+    dragorn@kismetwireless.net
+    0.1         Monitor mode, wireless extentions turned on by default
+                Removed capabilities check for WEP (seems to be broken, at
+                 least on my hardware.)  This lets users set WEP keys
+                 normally.  This will probably break on something, but it
+                 works for me.
+                Fixed linktype in monitor mode (set to 80211, not ETHER)
+                Fixed packet type (RAW_80211 instead of ETHER in SKB)
+                Changed [s|g]etRFMonitor ioctls to use integers instead of
+                 chars (sorry, but 'on' and 'off' is just annoying.)
+                Fixed transmit queue to not inject 802.3 packets into the
+                 802.11 packet stream while in monitor mode
+                Added nasty kluge to remember the last channel set in the
+                 airo_info record since the firmware doesn't seem willing
+                 to give it to us, even in monitor mode.
+
 ======================================================================*/
 
 #ifndef __KERNEL__
@@ -147,16 +165,22 @@
                      must have WIRELESS_EXT (include linux/wireless.h)
 #define INCLUDE_RFMONITOR
  */
+#define INCLUDE_RFMONITOR
+
+// Define the raw packet SKB type
+#ifdef INCLUDE_RFMONITOR
+#define ETH_P_80211_RAW        (ETH_P_ECONET + 1)
+#endif
 
 /* Include Wireless Extension definition and check version - Jean II */
-/*
+
 #include <linux/wireless.h>
 #define WIRELESS_SPY		// enable iwspy support
 #if WIRELESS_EXT < 9
 #warning "Wireless extension v9 or newer required - please upgrade your kernel"
 #undef WIRELESS_EXT
 #endif
-*/
+
 #define CISCO_EXT		// enable Cisco extensions
 
 #ifdef CISCO_EXT
@@ -1001,6 +1025,8 @@
   int (*bap_read)(struct airo_info*, u16 *pu16Dst, int bytelen, 
 		  int whichbap);
 #ifdef WIRELESS_EXT
+  int   last_channel;  // Last channel we were set to since we can't 
+                       //get it, apparently, from firmware --dragorn
   int			need_commit;	// Need to set config
   struct iw_statistics	wstats;		// wireless stats
 #ifdef WIRELESS_SPY
@@ -1053,7 +1079,7 @@
     printk( KERN_ERR "airo:  skb == NULL!!!\n" );
     return 0;
   }
-	
+
   /* Find a vacant FID */
   spin_lock_irqsave(&priv->bap1_lock, flags);
   for( i = 0; i < MAX_FIDS; i++ ) {
@@ -1065,6 +1091,14 @@
     retval = -EBUSY;
     goto tx_done;
   }
+
+  /* Dump out an error counter if we try to transmit a frame while in
+     monitor mode.  We can stop the queue here, too -- dragorn */
+  if (priv->flags&FLAG_RFMONITOR) {
+      netif_stop_queue(dev);
+      retval = -EBUSY;
+      goto tx_done;
+  }
   
   len = ETH_ZLEN < skb->len ? skb->len : ETH_ZLEN; /* check min length*/
   buffer = skb->data;
@@ -1377,7 +1411,11 @@
           memcpy(buffer,apriv->micrxbuf+20,len);
           skb->mac.raw = skb->data;
           skb->pkt_type = PACKET_OTHERHOST;
+
+          /* What?  No.  These are raw 802.11 frames  -- dragorn
           skb->protocol = htons(ETH_P_802_2);
+          */
+          skb->protocol = htons(ETH_P_80211_RAW); 
           skb->dev = dev;
           skb->ip_summed = CHECKSUM_NONE;
           netif_rx( skb );
@@ -1567,9 +1605,16 @@
     configRid.refreshInterval = 0xffff;
     configRid.authType = AUTH_OPEN;
     PC4500_writerid(ai, 0xff10, &configRid, sizeof(ConfigRid));
+
+    /* Set the link type correctly.  -- Dragorn */
+    ai->dev->type = ARPHRD_IEEE80211;
+
   } else {
     PC4500_readrid(ai, 0xff21, &configRid, sizeof(ConfigRid));
     PC4500_writerid(ai, 0xff10, &configRid, sizeof(ConfigRid));
+  
+    /* Set the link type back -- Dragorn */
+    ai->dev->type = ARPHRD_ETHER;
   }
   memset(&cmd, 0, sizeof(cmd));
   cmd.cmd = MAC_ENABLE;
@@ -2046,7 +2091,7 @@
   Cmd cmd;
   Resp rsp;
   //  u8 mictxbuf[2048];
-	
+
   if (len < 12) {
     printk( KERN_WARNING "Short packet %d\n", len );
     return ERROR;
@@ -3537,6 +3582,7 @@
 			} else {
 				/* Yes ! We can set it !!! */
 				config.channelSet = (u16)cpu_to_le16(channel);
+                local->last_channel = channel - 1;
 				local->need_commit = 1;
 			}
 		}
@@ -3545,11 +3591,19 @@
 	// Get frequency/channel
 	case SIOCGIWFREQ:
 #ifdef WEXT_USECHANNELS
-		wrq->u.freq.m = ((int) le16_to_cpu(status_rid.channel) + 1);
+        /* Use the last set if we can't get it out of the status rid - dragorn */
+        if ((int) le16_to_cpu(status.channel) == 0) {
+            wrq->u.freq.m = local->last_channel;
+        } else {
+            wrq->u.freq.m = ((int) le16_to_cpu(config.channel) + 1);
+        }
 		wrq->u.freq.e = 0;
 #else
 		{
-			int f = (int) le16_to_cpu(status_rid.channel);
+            /* and again  -d */
+			int f = (int) le16_to_cpu(config.channel);
+            if (f == 0) 
+                f = local->last_channel;
 			wrq->u.freq.m = frequency_list[f] * 100000;
 			wrq->u.freq.e = 1;
 		}
@@ -3832,10 +3886,12 @@
 	// Set WEP keys and mode
 	case SIOCSIWENCODE:
 		/* Is WEP supported ? */
+        /* THis seems broken? --dragorn
 		if(!(cap_rid.softCap & 2)) {
 			rc = -EOPNOTSUPP;
 			break;
 		}
+        */
 		/* Basic checking: do we have a key to set ? */
 		if (wrq->u.encoding.pointer != (caddr_t) 0) {
 			wep_key_t key;
@@ -4228,13 +4284,14 @@
                           IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | 16,
                           "getProductName" },
 #ifdef INCLUDE_RFMONITOR
+                        /* Strings are no good.  Change to int.  --dragorn */
                         { SIOCIWFIRSTPRIV+12,
-                          IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | 3,
+                          IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
                           0,
                           "setRFMonitor" },
                         { SIOCIWFIRSTPRIV+13,
                           0,
-                          IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | 3,
+                          IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
                           "getRFMonitor" },
 #endif
 			};
@@ -4324,6 +4381,8 @@
 #ifdef INCLUDE_RFMONITOR
        case SIOCIWFIRSTPRIV+12:	/* rf monitor */
          rc = 0;
+
+         /* String-based controls?  This just sucks.  --dragorn
          if (!strcmp(wrq->u.name, "on")) {
            local->flags |= FLAG_RFMONITOR;
          } else if (!strcmp(wrq->u.name, "off")) {
@@ -4331,6 +4390,17 @@
          } else {
            rc = -EINVAL;
          }
+         */
+
+         /* Lets do this more nicely */
+         if (wrq->u.name[0] == 1) {
+             local->flags |= FLAG_RFMONITOR;
+         } else if (wrq->u.name[0] == 0) {
+             local->flags &= ~FLAG_RFMONITOR;
+         } else {
+             rc = -EINVAL;
+         }
+
          if (rc == 0) {
            set_rfmonitor(local);
          }
@@ -4338,9 +4408,15 @@
        case SIOCIWFIRSTPRIV+13:	/* rf monitor */
          PC4500_readrid(local, 0xff20, &config, sizeof(ConfigRid));
          if (config.rmode == (0x300 | RXMODE_RFMON_ANYBSS)) {
-           strcpy(wrq->u.name, "on");
+             /* Strings suck --dragorn 
+                strcpy(wrq->u.name, "on");
+              */
+             int *val = (int *) wrq->u.name;
+             (*val) = 1;
          } else {
-           strcpy(wrq->u.name, "off");
+             /* strcpy(wrq->u.name, "off"); */
+             int *val = (int *) wrq->u.name;
+             (*val) = 0;
          }
          rc = 0;
          break;
@@ -4415,6 +4491,8 @@
 
 		local->config = config;	/* ???? config is local !!! */
 		checkThrottle(&config);
+        printk(KERN_DEBUG "About to write config rid, mode %b channel is %d setchannel is %d\n",
+               config.opmode, config.channel, config.channelSet);
 		PC4500_writerid(local, RID_CONFIG, &config,
 				sizeof(config));
 		enable_MAC(local, &rsp);
