drivers/net/wireless/atmel.c

   1 /*** -*- linux-c -*- **********************************************************
   2
   3      Driver for Atmel at76c502 at76c504 and at76c506 wireless cards.
   4
   5         Copyright 2000-2001 ATMEL Corporation.
   6         Copyright 2003-2004 Simon Kelley.
   7
   8     This code was developed from version 2.1.1 of the Atmel drivers,
   9     released by Atmel corp. under the GPL in December 2002. It also
  10     includes code from the Linux aironet drivers (C) Benjamin Reed,
  11     and the Linux PCMCIA package, (C) David Hinds and the Linux wireless
  12     extensions, (C) Jean Tourrilhes.
  13
  14     The firmware module for reading the MAC address of the card comes from
  15     net.russotto.AtmelMACFW, written by Matthew T. Russotto and copyright
  16     by him. net.russotto.AtmelMACFW is used under the GPL license version 2.
  17     This file contains the module in binary form and, under the terms
  18     of the GPL, in source form. The source is located at the end of the file.
  19
  20     This program is free software; you can redistribute it and/or modify
  21     it under the terms of the GNU General Public License as published by
  22     the Free Software Foundation; either version 2 of the License, or
  23     (at your option) any later version.
  24
  25     This software is distributed in the hope that it will be useful,
  26     but WITHOUT ANY WARRANTY; without even the implied warranty of
  27     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  28     GNU General Public License for more details.
  29
  30     You should have received a copy of the GNU General Public License
  31     along with Atmel wireless lan drivers; if not, write to the Free Software
  32     Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  33
  34     For all queries about this code, please contact the current author,
  35     Simon Kelley <simon@thekelleys.org.uk> and not Atmel Corporation.
  36
  37     Credit is due to HP UK and Cambridge Online Systems Ltd for supplying
  38     hardware used during development of this driver.
  39
  40 ******************************************************************************/
  41
  42 #include <linux/init.h>
  43
  44 #include <linux/kernel.h>
  45 #include <linux/ptrace.h>
  46 #include <linux/slab.h>
  47 #include <linux/string.h>
  48 #include <linux/ctype.h>
  49 #include <linux/timer.h>
  50 #include <asm/byteorder.h>
  51 #include <asm/io.h>
  52 #include <asm/system.h>
  53 #include <asm/uaccess.h>
  54 #include <linux/module.h>
  55 #include <linux/netdevice.h>
  56 #include <linux/etherdevice.h>
  57 #include <linux/skbuff.h>
  58 #include <linux/if_arp.h>
  59 #include <linux/ioport.h>
  60 #include <linux/fcntl.h>
  61 #include <linux/delay.h>
  62 #include <linux/wireless.h>
  63 #include <net/iw_handler.h>
  64 #include <linux/crc32.h>
  65 #include <linux/proc_fs.h>
  66 #include <linux/device.h>
  67 #include <linux/moduleparam.h>
  68 #include <linux/firmware.h>
  69 #include <linux/jiffies.h>
  70 #include <net/ieee80211.h>
  71 #include "atmel.h"
  72
  73 #define DRIVER_MAJOR 0
  74 #define DRIVER_MINOR 98
  75
  76 MODULE_AUTHOR("Simon Kelley");
  77 MODULE_DESCRIPTION("Support for Atmel at76c50x 802.11 wireless ethernet cards.");
  78 MODULE_LICENSE("GPL");
  79 MODULE_SUPPORTED_DEVICE("Atmel at76c50x wireless cards");
  80
  81 /* The name of the firmware file to be loaded
  82    over-rides any automatic selection */
  83 static char *firmware = NULL;
  84 module_param(firmware, charp, 0);
  85
  86 /* table of firmware file names */
  87 static struct {
  88         AtmelFWType fw_type;
  89         const char *fw_file;
  90         const char *fw_file_ext;
  91 } fw_table[] = {
  92         { ATMEL_FW_TYPE_502,      "atmel_at76c502",      "bin" },
  93         { ATMEL_FW_TYPE_502D,     "atmel_at76c502d",     "bin" },
  94         { ATMEL_FW_TYPE_502E,     "atmel_at76c502e",     "bin" },
  95         { ATMEL_FW_TYPE_502_3COM, "atmel_at76c502_3com", "bin" },
  96         { ATMEL_FW_TYPE_504,      "atmel_at76c504",      "bin" },
  97         { ATMEL_FW_TYPE_504_2958, "atmel_at76c504_2958", "bin" },
  98         { ATMEL_FW_TYPE_504A_2958,"atmel_at76c504a_2958","bin" },
  99         { ATMEL_FW_TYPE_506,      "atmel_at76c506",      "bin" },
 100         { ATMEL_FW_TYPE_NONE,      NULL,                  NULL }
 101 };
 102
 103 #define MAX_SSID_LENGTH 32
 104 #define MGMT_JIFFIES (256 * HZ / 100)
 105
 106 #define MAX_BSS_ENTRIES 64
 107
 108 /* registers */
 109 #define GCR  0x00    //      (SIR0)  General Configuration Register
 110 #define BSR  0x02    //      (SIR1)  Bank Switching Select Register
 111 #define AR   0x04
 112 #define DR   0x08
 113 #define MR1  0x12    //      Mirror Register 1
 114 #define MR2  0x14    //      Mirror Register 2
 115 #define MR3  0x16    //      Mirror Register 3
 116 #define MR4  0x18    //      Mirror Register 4
 117
 118 #define GPR1                            0x0c
 119 #define GPR2                            0x0e
 120 #define GPR3                            0x10
 121 //
 122 // Constants for the GCR register.
 123 //
 124 #define GCR_REMAP     0x0400          // Remap internal SRAM to 0
 125 #define GCR_SWRES     0x0080          // BIU reset (ARM and PAI are NOT reset)
 126 #define GCR_CORES     0x0060          // Core Reset (ARM and PAI are reset)
 127 #define GCR_ENINT     0x0002          // Enable Interrupts
 128 #define GCR_ACKINT    0x0008          // Acknowledge Interrupts
 129
 130 #define BSS_SRAM      0x0200          // AMBA module selection --> SRAM
 131 #define BSS_IRAM      0x0100          // AMBA module selection --> IRAM
 132 //
 133 // Constants for the MR registers.
 134 //
 135 #define MAC_INIT_COMPLETE       0x0001        // MAC init has been completed
 136 #define MAC_BOOT_COMPLETE       0x0010        // MAC boot has been completed
 137 #define MAC_INIT_OK             0x0002        // MAC boot has been completed
 138
 139 #define MIB_MAX_DATA_BYTES    212
 140 #define MIB_HEADER_SIZE       4    /* first four fields */
 141
 142 struct get_set_mib {
 143         u8 type;
 144         u8 size;
 145         u8 index;
 146         u8 reserved;
 147         u8 data[MIB_MAX_DATA_BYTES];
 148 };
 149
 150 struct rx_desc {
 151         u32          Next;
 152         u16          MsduPos;
 153         u16          MsduSize;
 154
 155         u8           State;
 156         u8           Status;
 157         u8           Rate;
 158         u8           Rssi;
 159         u8           LinkQuality;
 160         u8           PreambleType;
 161         u16          Duration;
 162         u32          RxTime;
 163 };
 164
 165 #define RX_DESC_FLAG_VALID       0x80
 166 #define RX_DESC_FLAG_CONSUMED    0x40
 167 #define RX_DESC_FLAG_IDLE        0x00
 168
 169 #define RX_STATUS_SUCCESS        0x00
 170
 171 #define RX_DESC_MSDU_POS_OFFSET      4
 172 #define RX_DESC_MSDU_SIZE_OFFSET     6
 173 #define RX_DESC_FLAGS_OFFSET         8
 174 #define RX_DESC_STATUS_OFFSET        9
 175 #define RX_DESC_RSSI_OFFSET          11
 176 #define RX_DESC_LINK_QUALITY_OFFSET  12
 177 #define RX_DESC_PREAMBLE_TYPE_OFFSET 13
 178 #define RX_DESC_DURATION_OFFSET      14
 179 #define RX_DESC_RX_TIME_OFFSET       16
 180
 181 struct tx_desc {
 182         u32       NextDescriptor;
 183         u16       TxStartOfFrame;
 184         u16       TxLength;
 185
 186         u8        TxState;
 187         u8        TxStatus;
 188         u8        RetryCount;
 189
 190         u8        TxRate;
 191
 192         u8        KeyIndex;
 193         u8        ChiperType;
 194         u8        ChipreLength;
 195         u8        Reserved1;
 196
 197         u8        Reserved;
 198         u8        PacketType;
 199         u16       HostTxLength;
 200 };
 201
 202 #define TX_DESC_NEXT_OFFSET          0
 203 #define TX_DESC_POS_OFFSET           4
 204 #define TX_DESC_SIZE_OFFSET          6
 205 #define TX_DESC_FLAGS_OFFSET         8
 206 #define TX_DESC_STATUS_OFFSET        9
 207 #define TX_DESC_RETRY_OFFSET         10
 208 #define TX_DESC_RATE_OFFSET          11
 209 #define TX_DESC_KEY_INDEX_OFFSET     12
 210 #define TX_DESC_CIPHER_TYPE_OFFSET   13
 211 #define TX_DESC_CIPHER_LENGTH_OFFSET 14
 212 #define TX_DESC_PACKET_TYPE_OFFSET   17
 213 #define TX_DESC_HOST_LENGTH_OFFSET   18
 214
 215 ///////////////////////////////////////////////////////
 216 // Host-MAC interface
 217 ///////////////////////////////////////////////////////
 218
 219 #define TX_STATUS_SUCCESS       0x00
 220
 221 #define TX_FIRM_OWN             0x80
 222 #define TX_DONE                 0x40
 223
 224 #define TX_ERROR                0x01
 225
 226 #define TX_PACKET_TYPE_DATA     0x01
 227 #define TX_PACKET_TYPE_MGMT     0x02
 228
 229 #define ISR_EMPTY               0x00        // no bits set in ISR
 230 #define ISR_TxCOMPLETE          0x01        // packet transmitted
 231 #define ISR_RxCOMPLETE          0x02        // packet received
 232 #define ISR_RxFRAMELOST         0x04        // Rx Frame lost
 233 #define ISR_FATAL_ERROR         0x08        // Fatal error
 234 #define ISR_COMMAND_COMPLETE    0x10        // command completed
 235 #define ISR_OUT_OF_RANGE        0x20        // command completed
 236 #define ISR_IBSS_MERGE          0x40        // (4.1.2.30): IBSS merge
 237 #define ISR_GENERIC_IRQ         0x80
 238
 239 #define Local_Mib_Type          0x01
 240 #define Mac_Address_Mib_Type    0x02
 241 #define Mac_Mib_Type            0x03
 242 #define Statistics_Mib_Type     0x04
 243 #define Mac_Mgmt_Mib_Type       0x05
 244 #define Mac_Wep_Mib_Type        0x06
 245 #define Phy_Mib_Type            0x07
 246 #define Multi_Domain_MIB        0x08
 247
 248 #define MAC_MGMT_MIB_CUR_BSSID_POS            14
 249 #define MAC_MIB_FRAG_THRESHOLD_POS            8
 250 #define MAC_MIB_RTS_THRESHOLD_POS             10
 251 #define MAC_MIB_SHORT_RETRY_POS               16
 252 #define MAC_MIB_LONG_RETRY_POS                17
 253 #define MAC_MIB_SHORT_RETRY_LIMIT_POS         16
 254 #define MAC_MGMT_MIB_BEACON_PER_POS           0
 255 #define MAC_MGMT_MIB_STATION_ID_POS           6
 256 #define MAC_MGMT_MIB_CUR_PRIVACY_POS          11
 257 #define MAC_MGMT_MIB_CUR_BSSID_POS            14
 258 #define MAC_MGMT_MIB_PS_MODE_POS              53
 259 #define MAC_MGMT_MIB_LISTEN_INTERVAL_POS      54
 260 #define MAC_MGMT_MIB_MULTI_DOMAIN_IMPLEMENTED 56
 261 #define MAC_MGMT_MIB_MULTI_DOMAIN_ENABLED     57
 262 #define PHY_MIB_CHANNEL_POS                   14
 263 #define PHY_MIB_RATE_SET_POS                  20
 264 #define PHY_MIB_REG_DOMAIN_POS                26
 265 #define LOCAL_MIB_AUTO_TX_RATE_POS            3
 266 #define LOCAL_MIB_SSID_SIZE                   5
 267 #define LOCAL_MIB_TX_PROMISCUOUS_POS          6
 268 #define LOCAL_MIB_TX_MGMT_RATE_POS            7
 269 #define LOCAL_MIB_TX_CONTROL_RATE_POS         8
 270 #define LOCAL_MIB_PREAMBLE_TYPE               9
 271 #define MAC_ADDR_MIB_MAC_ADDR_POS             0
 272
 273 #define         CMD_Set_MIB_Vars              0x01
 274 #define         CMD_Get_MIB_Vars              0x02
 275 #define         CMD_Scan                      0x03
 276 #define         CMD_Join                      0x04
 277 #define         CMD_Start                     0x05
 278 #define         CMD_EnableRadio               0x06
 279 #define         CMD_DisableRadio              0x07
 280 #define         CMD_SiteSurvey                0x0B
 281
 282 #define         CMD_STATUS_IDLE                   0x00
 283 #define         CMD_STATUS_COMPLETE               0x01
 284 #define         CMD_STATUS_UNKNOWN                0x02
 285 #define         CMD_STATUS_INVALID_PARAMETER      0x03
 286 #define         CMD_STATUS_FUNCTION_NOT_SUPPORTED 0x04
 287 #define         CMD_STATUS_TIME_OUT               0x07
 288 #define         CMD_STATUS_IN_PROGRESS            0x08
 289 #define         CMD_STATUS_REJECTED_RADIO_OFF     0x09
 290 #define         CMD_STATUS_HOST_ERROR             0xFF
 291 #define         CMD_STATUS_BUSY                   0xFE
 292
 293 #define CMD_BLOCK_COMMAND_OFFSET        0
 294 #define CMD_BLOCK_STATUS_OFFSET         1
 295 #define CMD_BLOCK_PARAMETERS_OFFSET     4
 296
 297 #define SCAN_OPTIONS_SITE_SURVEY        0x80
 298
 299 #define MGMT_FRAME_BODY_OFFSET          24
 300 #define MAX_AUTHENTICATION_RETRIES      3
 301 #define MAX_ASSOCIATION_RETRIES         3
 302
 303 #define AUTHENTICATION_RESPONSE_TIME_OUT  1000
 304
 305 #define MAX_WIRELESS_BODY  2316 /* mtu is 2312, CRC is 4 */
 306 #define LOOP_RETRY_LIMIT   500000
 307
 308 #define ACTIVE_MODE     1
 309 #define PS_MODE         2
 310
 311 #define MAX_ENCRYPTION_KEYS 4
 312 #define MAX_ENCRYPTION_KEY_SIZE 40
 313
 314 ///////////////////////////////////////////////////////////////////////////
 315 // 802.11 related definitions
 316 ///////////////////////////////////////////////////////////////////////////
 317
 318 //
 319 // Regulatory Domains
 320 //
 321
 322 #define REG_DOMAIN_FCC          0x10    //Channels      1-11    USA
 323 #define REG_DOMAIN_DOC          0x20    //Channel       1-11    Canada
 324 #define REG_DOMAIN_ETSI         0x30    //Channel       1-13    Europe (ex Spain/France)
 325 #define REG_DOMAIN_SPAIN        0x31    //Channel       10-11   Spain
 326 #define REG_DOMAIN_FRANCE       0x32    //Channel       10-13   France
 327 #define REG_DOMAIN_MKK          0x40    //Channel       14      Japan
 328 #define REG_DOMAIN_MKK1         0x41    //Channel       1-14    Japan(MKK1)
 329 #define REG_DOMAIN_ISRAEL       0x50    //Channel       3-9     ISRAEL
 330
 331 #define BSS_TYPE_AD_HOC         1
 332 #define BSS_TYPE_INFRASTRUCTURE 2
 333
 334 #define SCAN_TYPE_ACTIVE        0
 335 #define SCAN_TYPE_PASSIVE       1
 336
 337 #define LONG_PREAMBLE           0
 338 #define SHORT_PREAMBLE          1
 339 #define AUTO_PREAMBLE           2
 340
 341 #define DATA_FRAME_WS_HEADER_SIZE   30
 342
 343 /* promiscuous mode control */
 344 #define PROM_MODE_OFF                   0x0
 345 #define PROM_MODE_UNKNOWN               0x1
 346 #define PROM_MODE_CRC_FAILED            0x2
 347 #define PROM_MODE_DUPLICATED            0x4
 348 #define PROM_MODE_MGMT                  0x8
 349 #define PROM_MODE_CTRL                  0x10
 350 #define PROM_MODE_BAD_PROTOCOL          0x20
 351
 352 #define IFACE_INT_STATUS_OFFSET         0
 353 #define IFACE_INT_MASK_OFFSET           1
 354 #define IFACE_LOCKOUT_HOST_OFFSET       2
 355 #define IFACE_LOCKOUT_MAC_OFFSET        3
 356 #define IFACE_FUNC_CTRL_OFFSET          28
 357 #define IFACE_MAC_STAT_OFFSET           30
 358 #define IFACE_GENERIC_INT_TYPE_OFFSET   32
 359
 360 #define CIPHER_SUITE_NONE     0
 361 #define CIPHER_SUITE_WEP_64   1
 362 #define CIPHER_SUITE_TKIP     2
 363 #define CIPHER_SUITE_AES      3
 364 #define CIPHER_SUITE_CCX      4
 365 #define CIPHER_SUITE_WEP_128  5
 366
 367 //
 368 // IFACE MACROS & definitions
 369 //
 370 //
 371
 372 // FuncCtrl field:
 373 //
 374 #define FUNC_CTRL_TxENABLE              0x10
 375 #define FUNC_CTRL_RxENABLE              0x20
 376 #define FUNC_CTRL_INIT_COMPLETE         0x01
 377
 378 /* A stub firmware image which reads the MAC address from NVRAM on the card.
 379    For copyright information and source see the end of this file. */
 380 static u8 mac_reader[] = {
 381         0x06,0x00,0x00,0xea,0x04,0x00,0x00,0xea,0x03,0x00,0x00,0xea,0x02,0x00,0x00,0xea,
 382         0x01,0x00,0x00,0xea,0x00,0x00,0x00,0xea,0xff,0xff,0xff,0xea,0xfe,0xff,0xff,0xea,
 383         0xd3,0x00,0xa0,0xe3,0x00,0xf0,0x21,0xe1,0x0e,0x04,0xa0,0xe3,0x00,0x10,0xa0,0xe3,
 384         0x81,0x11,0xa0,0xe1,0x00,0x10,0x81,0xe3,0x00,0x10,0x80,0xe5,0x1c,0x10,0x90,0xe5,
 385         0x10,0x10,0xc1,0xe3,0x1c,0x10,0x80,0xe5,0x01,0x10,0xa0,0xe3,0x08,0x10,0x80,0xe5,
 386         0x02,0x03,0xa0,0xe3,0x00,0x10,0xa0,0xe3,0xb0,0x10,0xc0,0xe1,0xb4,0x10,0xc0,0xe1,
 387         0xb8,0x10,0xc0,0xe1,0xbc,0x10,0xc0,0xe1,0x56,0xdc,0xa0,0xe3,0x21,0x00,0x00,0xeb,
 388         0x0a,0x00,0xa0,0xe3,0x1a,0x00,0x00,0xeb,0x10,0x00,0x00,0xeb,0x07,0x00,0x00,0xeb,
 389         0x02,0x03,0xa0,0xe3,0x02,0x14,0xa0,0xe3,0xb4,0x10,0xc0,0xe1,0x4c,0x10,0x9f,0xe5,
 390         0xbc,0x10,0xc0,0xe1,0x10,0x10,0xa0,0xe3,0xb8,0x10,0xc0,0xe1,0xfe,0xff,0xff,0xea,
 391         0x00,0x40,0x2d,0xe9,0x00,0x20,0xa0,0xe3,0x02,0x3c,0xa0,0xe3,0x00,0x10,0xa0,0xe3,
 392         0x28,0x00,0x9f,0xe5,0x37,0x00,0x00,0xeb,0x00,0x40,0xbd,0xe8,0x1e,0xff,0x2f,0xe1,
 393         0x00,0x40,0x2d,0xe9,0x12,0x2e,0xa0,0xe3,0x06,0x30,0xa0,0xe3,0x00,0x10,0xa0,0xe3,
 394         0x02,0x04,0xa0,0xe3,0x2f,0x00,0x00,0xeb,0x00,0x40,0xbd,0xe8,0x1e,0xff,0x2f,0xe1,
 395         0x00,0x02,0x00,0x02,0x80,0x01,0x90,0xe0,0x01,0x00,0x00,0x0a,0x01,0x00,0x50,0xe2,
 396         0xfc,0xff,0xff,0xea,0x1e,0xff,0x2f,0xe1,0x80,0x10,0xa0,0xe3,0xf3,0x06,0xa0,0xe3,
 397         0x00,0x10,0x80,0xe5,0x00,0x10,0xa0,0xe3,0x00,0x10,0x80,0xe5,0x01,0x10,0xa0,0xe3,
 398         0x04,0x10,0x80,0xe5,0x00,0x10,0x80,0xe5,0x0e,0x34,0xa0,0xe3,0x1c,0x10,0x93,0xe5,
 399         0x02,0x1a,0x81,0xe3,0x1c,0x10,0x83,0xe5,0x58,0x11,0x9f,0xe5,0x30,0x10,0x80,0xe5,
 400         0x54,0x11,0x9f,0xe5,0x34,0x10,0x80,0xe5,0x38,0x10,0x80,0xe5,0x3c,0x10,0x80,0xe5,
 401         0x10,0x10,0x90,0xe5,0x08,0x00,0x90,0xe5,0x1e,0xff,0x2f,0xe1,0xf3,0x16,0xa0,0xe3,
 402         0x08,0x00,0x91,0xe5,0x05,0x00,0xa0,0xe3,0x0c,0x00,0x81,0xe5,0x10,0x00,0x91,0xe5,
 403         0x02,0x00,0x10,0xe3,0xfc,0xff,0xff,0x0a,0xff,0x00,0xa0,0xe3,0x0c,0x00,0x81,0xe5,
 404         0x10,0x00,0x91,0xe5,0x02,0x00,0x10,0xe3,0xfc,0xff,0xff,0x0a,0x08,0x00,0x91,0xe5,
 405         0x10,0x00,0x91,0xe5,0x01,0x00,0x10,0xe3,0xfc,0xff,0xff,0x0a,0x08,0x00,0x91,0xe5,
 406         0xff,0x00,0x00,0xe2,0x1e,0xff,0x2f,0xe1,0x30,0x40,0x2d,0xe9,0x00,0x50,0xa0,0xe1,
 407         0x03,0x40,0xa0,0xe1,0xa2,0x02,0xa0,0xe1,0x08,0x00,0x00,0xe2,0x03,0x00,0x80,0xe2,
 408         0xd8,0x10,0x9f,0xe5,0x00,0x00,0xc1,0xe5,0x01,0x20,0xc1,0xe5,0xe2,0xff,0xff,0xeb,
 409         0x01,0x00,0x10,0xe3,0xfc,0xff,0xff,0x1a,0x14,0x00,0xa0,0xe3,0xc4,0xff,0xff,0xeb,
 410         0x04,0x20,0xa0,0xe1,0x05,0x10,0xa0,0xe1,0x02,0x00,0xa0,0xe3,0x01,0x00,0x00,0xeb,
 411         0x30,0x40,0xbd,0xe8,0x1e,0xff,0x2f,0xe1,0x70,0x40,0x2d,0xe9,0xf3,0x46,0xa0,0xe3,
 412         0x00,0x30,0xa0,0xe3,0x00,0x00,0x50,0xe3,0x08,0x00,0x00,0x9a,0x8c,0x50,0x9f,0xe5,
 413         0x03,0x60,0xd5,0xe7,0x0c,0x60,0x84,0xe5,0x10,0x60,0x94,0xe5,0x02,0x00,0x16,0xe3,
 414         0xfc,0xff,0xff,0x0a,0x01,0x30,0x83,0xe2,0x00,0x00,0x53,0xe1,0xf7,0xff,0xff,0x3a,
 415         0xff,0x30,0xa0,0xe3,0x0c,0x30,0x84,0xe5,0x08,0x00,0x94,0xe5,0x10,0x00,0x94,0xe5,
 416         0x01,0x00,0x10,0xe3,0xfc,0xff,0xff,0x0a,0x08,0x00,0x94,0xe5,0x00,0x00,0xa0,0xe3,
 417         0x00,0x00,0x52,0xe3,0x0b,0x00,0x00,0x9a,0x10,0x50,0x94,0xe5,0x02,0x00,0x15,0xe3,
 418         0xfc,0xff,0xff,0x0a,0x0c,0x30,0x84,0xe5,0x10,0x50,0x94,0xe5,0x01,0x00,0x15,0xe3,
 419         0xfc,0xff,0xff,0x0a,0x08,0x50,0x94,0xe5,0x01,0x50,0xc1,0xe4,0x01,0x00,0x80,0xe2,
 420         0x02,0x00,0x50,0xe1,0xf3,0xff,0xff,0x3a,0xc8,0x00,0xa0,0xe3,0x98,0xff,0xff,0xeb,
 421         0x70,0x40,0xbd,0xe8,0x1e,0xff,0x2f,0xe1,0x01,0x0c,0x00,0x02,0x01,0x02,0x00,0x02,
 422         0x00,0x01,0x00,0x02
 423 };
 424
 425 struct atmel_private {
 426         void *card; /* Bus dependent stucture varies for PCcard */
 427         int (*present_callback)(void *); /* And callback which uses it */
 428         char firmware_id[32];
 429         AtmelFWType firmware_type;
 430         u8 *firmware;
 431         int firmware_length;
 432         struct timer_list management_timer;
 433         struct net_device *dev;
 434         struct device *sys_dev;
 435         struct iw_statistics wstats;
 436         spinlock_t irqlock, timerlock;  // spinlocks
 437         enum { BUS_TYPE_PCCARD, BUS_TYPE_PCI } bus_type;
 438         enum {
 439                 CARD_TYPE_PARALLEL_FLASH,
 440                 CARD_TYPE_SPI_FLASH,
 441                 CARD_TYPE_EEPROM
 442         } card_type;
 443         int do_rx_crc; /* If we need to CRC incoming packets */
 444         int probe_crc; /* set if we don't yet know */
 445         int crc_ok_cnt, crc_ko_cnt; /* counters for probing */
 446         u16 rx_desc_head;
 447         u16 tx_desc_free, tx_desc_head, tx_desc_tail, tx_desc_previous;
 448         u16 tx_free_mem, tx_buff_head, tx_buff_tail;
 449
 450         u16 frag_seq, frag_len, frag_no;
 451         u8 frag_source[6];
 452
 453         u8 wep_is_on, default_key, exclude_unencrypted, encryption_level;
 454         u8 group_cipher_suite, pairwise_cipher_suite;
 455         u8 wep_keys[MAX_ENCRYPTION_KEYS][MAX_ENCRYPTION_KEY_SIZE];
 456         int wep_key_len[MAX_ENCRYPTION_KEYS];
 457         int use_wpa, radio_on_broken; /* firmware dependent stuff. */
 458
 459         u16 host_info_base;
 460         struct host_info_struct {
 461                 /* NB this is matched to the hardware, don't change. */
 462                 u8 volatile int_status;
 463                 u8 volatile int_mask;
 464                 u8 volatile lockout_host;
 465                 u8 volatile lockout_mac;
 466
 467                 u16 tx_buff_pos;
 468                 u16 tx_buff_size;
 469                 u16 tx_desc_pos;
 470                 u16 tx_desc_count;
 471
 472                 u16 rx_buff_pos;
 473                 u16 rx_buff_size;
 474                 u16 rx_desc_pos;
 475                 u16 rx_desc_count;
 476
 477                 u16 build_version;
 478                 u16 command_pos;
 479
 480                 u16 major_version;
 481                 u16 minor_version;
 482
 483                 u16 func_ctrl;
 484                 u16 mac_status;
 485                 u16 generic_IRQ_type;
 486                 u8  reserved[2];
 487         } host_info;
 488
 489         enum {
 490                 STATION_STATE_SCANNING,
 491                 STATION_STATE_JOINNING,
 492                 STATION_STATE_AUTHENTICATING,
 493                 STATION_STATE_ASSOCIATING,
 494                 STATION_STATE_READY,
 495                 STATION_STATE_REASSOCIATING,
 496                 STATION_STATE_DOWN,
 497                 STATION_STATE_MGMT_ERROR
 498         } station_state;
 499
 500         int operating_mode, power_mode;
 501         time_t last_qual;
 502         int beacons_this_sec;
 503         int channel;
 504         int reg_domain, config_reg_domain;
 505         int tx_rate;
 506         int auto_tx_rate;
 507         int rts_threshold;
 508         int frag_threshold;
 509         int long_retry, short_retry;
 510         int preamble;
 511         int default_beacon_period, beacon_period, listen_interval;
 512         int CurrentAuthentTransactionSeqNum, ExpectedAuthentTransactionSeqNum;
 513         int AuthenticationRequestRetryCnt, AssociationRequestRetryCnt, ReAssociationRequestRetryCnt;
 514         enum {
 515                 SITE_SURVEY_IDLE,
 516                 SITE_SURVEY_IN_PROGRESS,
 517                 SITE_SURVEY_COMPLETED
 518         } site_survey_state;
 519         unsigned long last_survey;
 520
 521         int station_was_associated, station_is_associated;
 522         int fast_scan;
 523
 524         struct bss_info {
 525                 int channel;
 526                 int SSIDsize;
 527                 int RSSI;
 528                 int UsingWEP;
 529                 int preamble;
 530                 int beacon_period;
 531                 int BSStype;
 532                 u8 BSSID[6];
 533                 u8 SSID[MAX_SSID_LENGTH];
 534         } BSSinfo[MAX_BSS_ENTRIES];
 535         int BSS_list_entries, current_BSS;
 536         int connect_to_any_BSS;
 537         int SSID_size, new_SSID_size;
 538         u8 CurrentBSSID[6], BSSID[6];
 539         u8 SSID[MAX_SSID_LENGTH], new_SSID[MAX_SSID_LENGTH];
 540         u64 last_beacon_timestamp;
 541         u8 rx_buf[MAX_WIRELESS_BODY];
 542 };
 543
 544 static u8 atmel_basic_rates[4] = {0x82,0x84,0x0b,0x16};
 545
 546 static const struct {
 547         int reg_domain;
 548         int min, max;
 549         char *name;
 550 } channel_table[] = { { REG_DOMAIN_FCC, 1, 11, "USA" },
 551                       { REG_DOMAIN_DOC, 1, 11, "Canada" },
 552                       { REG_DOMAIN_ETSI, 1, 13, "Europe" },
 553                       { REG_DOMAIN_SPAIN, 10, 11, "Spain" },
 554                       { REG_DOMAIN_FRANCE, 10, 13, "France" },
 555                       { REG_DOMAIN_MKK, 14, 14, "MKK" },
 556                       { REG_DOMAIN_MKK1, 1, 14, "MKK1" },
 557                       { REG_DOMAIN_ISRAEL, 3, 9, "Israel"} };
 558
 559 static void build_wpa_mib(struct atmel_private *priv);
 560 static int atmel_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
 561 static void atmel_copy_to_card(struct net_device *dev, u16 dest,
 562                                const unsigned char *src, u16 len);
 563 static void atmel_copy_to_host(struct net_device *dev, unsigned char *dest,
 564                                u16 src, u16 len);
 565 static void atmel_set_gcr(struct net_device *dev, u16 mask);
 566 static void atmel_clear_gcr(struct net_device *dev, u16 mask);
 567 static int atmel_lock_mac(struct atmel_private *priv);
 568 static void atmel_wmem32(struct atmel_private *priv, u16 pos, u32 data);
 569 static void atmel_command_irq(struct atmel_private *priv);
 570 static int atmel_validate_channel(struct atmel_private *priv, int channel);
 571 static void atmel_management_frame(struct atmel_private *priv,
 572                                    struct ieee80211_hdr_4addr *header,
 573                                    u16 frame_len, u8 rssi);
 574 static void atmel_management_timer(u_long a);
 575 static void atmel_send_command(struct atmel_private *priv, int command,
 576                                void *cmd, int cmd_size);
 577 static int atmel_send_command_wait(struct atmel_private *priv, int command,
 578                                    void *cmd, int cmd_size);
 579 static void atmel_transmit_management_frame(struct atmel_private *priv,
 580                                             struct ieee80211_hdr_4addr *header,
 581                                             u8 *body, int body_len);
 582
 583 static u8 atmel_get_mib8(struct atmel_private *priv, u8 type, u8 index);
 584 static void atmel_set_mib8(struct atmel_private *priv, u8 type, u8 index,
 585                            u8 data);
 586 static void atmel_set_mib16(struct atmel_private *priv, u8 type, u8 index,
 587                             u16 data);
 588 static void atmel_set_mib(struct atmel_private *priv, u8 type, u8 index,
 589                           u8 *data, int data_len);
 590 static void atmel_get_mib(struct atmel_private *priv, u8 type, u8 index,
 591                           u8 *data, int data_len);
 592 static void atmel_scan(struct atmel_private *priv, int specific_ssid);
 593 static void atmel_join_bss(struct atmel_private *priv, int bss_index);
 594 static void atmel_smooth_qual(struct atmel_private *priv);
 595 static void atmel_writeAR(struct net_device *dev, u16 data);
 596 static int probe_atmel_card(struct net_device *dev);
 597 static int reset_atmel_card(struct net_device *dev);
 598 static void atmel_enter_state(struct atmel_private *priv, int new_state);
 599 int atmel_open (struct net_device *dev);
 600
 601 static inline u16 atmel_hi(struct atmel_private *priv, u16 offset)
 602 {
 603         return priv->host_info_base + offset;
 604 }
 605
 606 static inline u16 atmel_co(struct atmel_private *priv, u16 offset)
 607 {
 608         return priv->host_info.command_pos + offset;
 609 }
 610
 611 static inline u16 atmel_rx(struct atmel_private *priv, u16 offset, u16 desc)
 612 {
 613         return priv->host_info.rx_desc_pos + (sizeof(struct rx_desc) * desc) + offset;
 614 }
 615
 616 static inline u16 atmel_tx(struct atmel_private *priv, u16 offset, u16 desc)
 617 {
 618         return priv->host_info.tx_desc_pos + (sizeof(struct tx_desc) * desc) + offset;
 619 }
 620
 621 static inline u8 atmel_read8(struct net_device *dev, u16 offset)
 622 {
 623         return inb(dev->base_addr + offset);
 624 }
 625
 626 static inline void atmel_write8(struct net_device *dev, u16 offset, u8 data)
 627 {
 628         outb(data, dev->base_addr + offset);
 629 }
 630
 631 static inline u16 atmel_read16(struct net_device *dev, u16 offset)
 632 {
 633         return inw(dev->base_addr + offset);
 634 }
 635
 636 static inline void atmel_write16(struct net_device *dev, u16 offset, u16 data)
 637 {
 638         outw(data, dev->base_addr + offset);
 639 }
 640
 641 static inline u8 atmel_rmem8(struct atmel_private *priv, u16 pos)
 642 {
 643         atmel_writeAR(priv->dev, pos);
 644         return atmel_read8(priv->dev, DR);
 645 }
 646
 647 static inline void atmel_wmem8(struct atmel_private *priv, u16 pos, u16 data)
 648 {
 649         atmel_writeAR(priv->dev, pos);
 650         atmel_write8(priv->dev, DR, data);
 651 }
 652
 653 static inline u16 atmel_rmem16(struct atmel_private *priv, u16 pos)
 654 {
 655         atmel_writeAR(priv->dev, pos);
 656         return atmel_read16(priv->dev, DR);
 657 }
 658
 659 static inline void atmel_wmem16(struct atmel_private *priv, u16 pos, u16 data)
 660 {
 661         atmel_writeAR(priv->dev, pos);
 662         atmel_write16(priv->dev, DR, data);
 663 }
 664
 665 static const struct iw_handler_def atmel_handler_def;
 666
 667 static void tx_done_irq(struct atmel_private *priv)
 668 {
 669         int i;
 670
 671         for (i = 0;
 672              atmel_rmem8(priv, atmel_tx(priv, TX_DESC_FLAGS_OFFSET, priv->tx_desc_head)) == TX_DONE &&
 673                      i < priv->host_info.tx_desc_count;
 674              i++) {
 675                 u8 status = atmel_rmem8(priv, atmel_tx(priv, TX_DESC_STATUS_OFFSET, priv->tx_desc_head));
 676                 u16 msdu_size = atmel_rmem16(priv, atmel_tx(priv, TX_DESC_SIZE_OFFSET, priv->tx_desc_head));
 677                 u8 type = atmel_rmem8(priv, atmel_tx(priv, TX_DESC_PACKET_TYPE_OFFSET, priv->tx_desc_head));
 678
 679                 atmel_wmem8(priv, atmel_tx(priv, TX_DESC_FLAGS_OFFSET, priv->tx_desc_head), 0);
 680
 681                 priv->tx_free_mem += msdu_size;
 682                 priv->tx_desc_free++;
 683
 684                 if (priv->tx_buff_head + msdu_size > (priv->host_info.tx_buff_pos + priv->host_info.tx_buff_size))
 685                         priv->tx_buff_head = 0;
 686                 else
 687                         priv->tx_buff_head += msdu_size;
 688
 689                 if (priv->tx_desc_head < (priv->host_info.tx_desc_count - 1))
 690                         priv->tx_desc_head++ ;
 691                 else
 692                         priv->tx_desc_head = 0;
 693
 694                 if (type == TX_PACKET_TYPE_DATA) {
 695                         if (status == TX_STATUS_SUCCESS)
 696                                 priv->dev->stats.tx_packets++;
 697                         else
 698                                 priv->dev->stats.tx_errors++;
 699                         netif_wake_queue(priv->dev);
 700                 }
 701         }
 702 }
 703
 704 static u16 find_tx_buff(struct atmel_private *priv, u16 len)
 705 {
 706         u16 bottom_free = priv->host_info.tx_buff_size - priv->tx_buff_tail;
 707
 708         if (priv->tx_desc_free == 3 || priv->tx_free_mem < len)
 709                 return 0;
 710
 711         if (bottom_free >= len)
 712                 return priv->host_info.tx_buff_pos + priv->tx_buff_tail;
 713
 714         if (priv->tx_free_mem - bottom_free >= len) {
 715                 priv->tx_buff_tail = 0;
 716                 return priv->host_info.tx_buff_pos;
 717         }
 718
 719         return 0;
 720 }
 721
 722 static void tx_update_descriptor(struct atmel_private *priv, int is_bcast,
 723                                  u16 len, u16 buff, u8 type)
 724 {
 725         atmel_wmem16(priv, atmel_tx(priv, TX_DESC_POS_OFFSET, priv->tx_desc_tail), buff);
 726         atmel_wmem16(priv, atmel_tx(priv, TX_DESC_SIZE_OFFSET, priv->tx_desc_tail), len);
 727         if (!priv->use_wpa)
 728                 atmel_wmem16(priv, atmel_tx(priv, TX_DESC_HOST_LENGTH_OFFSET, priv->tx_desc_tail), len);
 729         atmel_wmem8(priv, atmel_tx(priv, TX_DESC_PACKET_TYPE_OFFSET, priv->tx_desc_tail), type);
 730         atmel_wmem8(priv, atmel_tx(priv, TX_DESC_RATE_OFFSET, priv->tx_desc_tail), priv->tx_rate);
 731         atmel_wmem8(priv, atmel_tx(priv, TX_DESC_RETRY_OFFSET, priv->tx_desc_tail), 0);
 732         if (priv->use_wpa) {
 733                 int cipher_type, cipher_length;
 734                 if (is_bcast) {
 735                         cipher_type = priv->group_cipher_suite;
 736                         if (cipher_type == CIPHER_SUITE_WEP_64 ||
 737                             cipher_type == CIPHER_SUITE_WEP_128)
 738                                 cipher_length = 8;
 739                         else if (cipher_type == CIPHER_SUITE_TKIP)
 740                                 cipher_length = 12;
 741                         else if (priv->pairwise_cipher_suite == CIPHER_SUITE_WEP_64 ||
 742                                  priv->pairwise_cipher_suite == CIPHER_SUITE_WEP_128) {
 743                                 cipher_type = priv->pairwise_cipher_suite;
 744                                 cipher_length = 8;
 745                         } else {
 746                                 cipher_type = CIPHER_SUITE_NONE;
 747                                 cipher_length = 0;
 748                         }
 749                 } else {
 750                         cipher_type = priv->pairwise_cipher_suite;
 751                         if (cipher_type == CIPHER_SUITE_WEP_64 ||
 752                             cipher_type == CIPHER_SUITE_WEP_128)
 753                                 cipher_length = 8;
 754                         else if (cipher_type == CIPHER_SUITE_TKIP)
 755                                 cipher_length = 12;
 756                         else if (priv->group_cipher_suite == CIPHER_SUITE_WEP_64 ||
 757                                  priv->group_cipher_suite == CIPHER_SUITE_WEP_128) {
 758                                 cipher_type = priv->group_cipher_suite;
 759                                 cipher_length = 8;
 760                         } else {
 761                                 cipher_type = CIPHER_SUITE_NONE;
 762                                 cipher_length = 0;
 763                         }
 764                 }
 765
 766                 atmel_wmem8(priv, atmel_tx(priv, TX_DESC_CIPHER_TYPE_OFFSET, priv->tx_desc_tail),
 767                             cipher_type);
 768                 atmel_wmem8(priv, atmel_tx(priv, TX_DESC_CIPHER_LENGTH_OFFSET, priv->tx_desc_tail),
 769                             cipher_length);
 770         }
 771         atmel_wmem32(priv, atmel_tx(priv, TX_DESC_NEXT_OFFSET, priv->tx_desc_tail), 0x80000000L);
 772         atmel_wmem8(priv, atmel_tx(priv, TX_DESC_FLAGS_OFFSET, priv->tx_desc_tail), TX_FIRM_OWN);
 773         if (priv->tx_desc_previous != priv->tx_desc_tail)
 774                 atmel_wmem32(priv, atmel_tx(priv, TX_DESC_NEXT_OFFSET, priv->tx_desc_previous), 0);
 775         priv->tx_desc_previous = priv->tx_desc_tail;
 776         if (priv->tx_desc_tail < (priv->host_info.tx_desc_count - 1))
 777                 priv->tx_desc_tail++;
 778         else
 779                 priv->tx_desc_tail = 0;
 780         priv->tx_desc_free--;
 781         priv->tx_free_mem -= len;
 782 }
 783
 784 static int start_tx(struct sk_buff *skb, struct net_device *dev)
 785 {
 786         static const u8 SNAP_RFC1024[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
 787         struct atmel_private *priv = netdev_priv(dev);
 788         struct ieee80211_hdr_4addr header;
 789         unsigned long flags;
 790         u16 buff, frame_ctl, len = (ETH_ZLEN < skb->len) ? skb->len : ETH_ZLEN;
 791
 792         if (priv->card && priv->present_callback &&
 793             !(*priv->present_callback)(priv->card)) {
 794                 dev->stats.tx_errors++;
 795                 dev_kfree_skb(skb);
 796                 return 0;
 797         }
 798
 799         if (priv->station_state != STATION_STATE_READY) {
 800                 dev->stats.tx_errors++;
 801                 dev_kfree_skb(skb);
 802                 return 0;
 803         }
 804
 805         /* first ensure the timer func cannot run */
 806         spin_lock_bh(&priv->timerlock);
 807         /* then stop the hardware ISR */
 808         spin_lock_irqsave(&priv->irqlock, flags);
 809         /* nb doing the above in the opposite order will deadlock */
 810
 811         /* The Wireless Header is 30 bytes. In the Ethernet packet we "cut" the
 812            12 first bytes (containing DA/SA) and put them in the appropriate
 813            fields of the Wireless Header. Thus the packet length is then the
 814            initial + 18 (+30-12) */
 815
 816         if (!(buff = find_tx_buff(priv, len + 18))) {
 817                 dev->stats.tx_dropped++;
 818                 spin_unlock_irqrestore(&priv->irqlock, flags);
 819                 spin_unlock_bh(&priv->timerlock);
 820                 netif_stop_queue(dev);
 821                 return 1;
 822         }
 823
 824         frame_ctl = IEEE80211_FTYPE_DATA;
 825         header.duration_id = 0;
 826         header.seq_ctl = 0;
 827         if (priv->wep_is_on)
 828                 frame_ctl |= IEEE80211_FCTL_PROTECTED;
 829         if (priv->operating_mode == IW_MODE_ADHOC) {
 830                 skb_copy_from_linear_data(skb, &header.addr1, 6);
 831                 memcpy(&header.addr2, dev->dev_addr, 6);
 832                 memcpy(&header.addr3, priv->BSSID, 6);
 833         } else {
 834                 frame_ctl |= IEEE80211_FCTL_TODS;
 835                 memcpy(&header.addr1, priv->CurrentBSSID, 6);
 836                 memcpy(&header.addr2, dev->dev_addr, 6);
 837                 skb_copy_from_linear_data(skb, &header.addr3, 6);
 838         }
 839
 840         if (priv->use_wpa)
 841                 memcpy(&header.addr4, SNAP_RFC1024, 6);
 842
 843         header.frame_ctl = cpu_to_le16(frame_ctl);
 844         /* Copy the wireless header into the card */
 845         atmel_copy_to_card(dev, buff, (unsigned char *)&header, DATA_FRAME_WS_HEADER_SIZE);
 846         /* Copy the packet sans its 802.3 header addresses which have been replaced */
 847         atmel_copy_to_card(dev, buff + DATA_FRAME_WS_HEADER_SIZE, skb->data + 12, len - 12);
 848         priv->tx_buff_tail += len - 12 + DATA_FRAME_WS_HEADER_SIZE;
 849
 850         /* low bit of first byte of destination tells us if broadcast */
 851         tx_update_descriptor(priv, *(skb->data) & 0x01, len + 18, buff, TX_PACKET_TYPE_DATA);
 852         dev->trans_start = jiffies;
 853         dev->stats.tx_bytes += len;
 854
 855         spin_unlock_irqrestore(&priv->irqlock, flags);
 856         spin_unlock_bh(&priv->timerlock);
 857         dev_kfree_skb(skb);
 858
 859         return 0;
 860 }
 861
 862 static void atmel_transmit_management_frame(struct atmel_private *priv,
 863                                             struct ieee80211_hdr_4addr *header,
 864                                             u8 *body, int body_len)
 865 {
 866         u16 buff;
 867         int len = MGMT_FRAME_BODY_OFFSET + body_len;
 868
 869         if (!(buff = find_tx_buff(priv, len)))
 870                 return;
 871
 872         atmel_copy_to_card(priv->dev, buff, (u8 *)header, MGMT_FRAME_BODY_OFFSET);
 873         atmel_copy_to_card(priv->dev, buff + MGMT_FRAME_BODY_OFFSET, body, body_len);
 874         priv->tx_buff_tail += len;
 875         tx_update_descriptor(priv, header->addr1[0] & 0x01, len, buff, TX_PACKET_TYPE_MGMT);
 876 }
 877
 878 static void fast_rx_path(struct atmel_private *priv,
 879                          struct ieee80211_hdr_4addr *header,
 880                          u16 msdu_size, u16 rx_packet_loc, u32 crc)
 881 {
 882         /* fast path: unfragmented packet copy directly into skbuf */
 883         u8 mac4[6];
 884         struct sk_buff  *skb;
 885         unsigned char *skbp;
 886
 887         /* get the final, mac 4 header field, this tells us encapsulation */
 888         atmel_copy_to_host(priv->dev, mac4, rx_packet_loc + 24, 6);
 889         msdu_size -= 6;
 890
 891         if (priv->do_rx_crc) {
 892                 crc = crc32_le(crc, mac4, 6);
 893                 msdu_size -= 4;
 894         }
 895
 896         if (!(skb = dev_alloc_skb(msdu_size + 14))) {
 897                 priv->dev->stats.rx_dropped++;
 898                 return;
 899         }
 900
 901         skb_reserve(skb, 2);
 902         skbp = skb_put(skb, msdu_size + 12);
 903         atmel_copy_to_host(priv->dev, skbp + 12, rx_packet_loc + 30, msdu_size);
 904
 905         if (priv->do_rx_crc) {
 906                 u32 netcrc;
 907                 crc = crc32_le(crc, skbp + 12, msdu_size);
 908                 atmel_copy_to_host(priv->dev, (void *)&netcrc, rx_packet_loc + 30 + msdu_size, 4);
 909                 if ((crc ^ 0xffffffff) != netcrc) {
 910                         priv->dev->stats.rx_crc_errors++;
 911                         dev_kfree_skb(skb);
 912                         return;
 913                 }
 914         }
 915
 916         memcpy(skbp, header->addr1, 6); /* destination address */
 917         if (le16_to_cpu(header->frame_ctl) & IEEE80211_FCTL_FROMDS)
 918                 memcpy(&skbp[6], header->addr3, 6);
 919         else
 920                 memcpy(&skbp[6], header->addr2, 6); /* source address */
 921
 922         priv->dev->last_rx = jiffies;
 923         skb->protocol = eth_type_trans(skb, priv->dev);
 924         skb->ip_summed = CHECKSUM_NONE;
 925         netif_rx(skb);
 926         priv->dev->stats.rx_bytes += 12 + msdu_size;
 927         priv->dev->stats.rx_packets++;
 928 }
 929
 930 /* Test to see if the packet in card memory at packet_loc has a valid CRC
 931    It doesn't matter that this is slow: it is only used to proble the first few
 932    packets. */
 933 static int probe_crc(struct atmel_private *priv, u16 packet_loc, u16 msdu_size)
 934 {
 935         int i = msdu_size - 4;
 936         u32 netcrc, crc = 0xffffffff;
 937
 938         if (msdu_size < 4)
 939                 return 0;
 940
 941         atmel_copy_to_host(priv->dev, (void *)&netcrc, packet_loc + i, 4);
 942
 943         atmel_writeAR(priv->dev, packet_loc);
 944         while (i--) {
 945                 u8 octet = atmel_read8(priv->dev, DR);
 946                 crc = crc32_le(crc, &octet, 1);
 947         }
 948
 949         return (crc ^ 0xffffffff) == netcrc;
 950 }
 951
 952 static void frag_rx_path(struct atmel_private *priv,
 953                          struct ieee80211_hdr_4addr *header,
 954                          u16 msdu_size, u16 rx_packet_loc, u32 crc, u16 seq_no,
 955                          u8 frag_no, int more_frags)
 956 {
 957         u8 mac4[6];
 958         u8 source[6];
 959         struct sk_buff *skb;
 960
 961         if (le16_to_cpu(header->frame_ctl) & IEEE80211_FCTL_FROMDS)
 962                 memcpy(source, header->addr3, 6);
 963         else
 964                 memcpy(source, header->addr2, 6);
 965
 966         rx_packet_loc += 24; /* skip header */
 967
 968         if (priv->do_rx_crc)
 969                 msdu_size -= 4;
 970
 971         if (frag_no == 0) { /* first fragment */
 972                 atmel_copy_to_host(priv->dev, mac4, rx_packet_loc, 6);
 973                 msdu_size -= 6;
 974                 rx_packet_loc += 6;
 975
 976                 if (priv->do_rx_crc)
 977                         crc = crc32_le(crc, mac4, 6);
 978
 979                 priv->frag_seq = seq_no;
 980                 priv->frag_no = 1;
 981                 priv->frag_len = msdu_size;
 982                 memcpy(priv->frag_source, source, 6);
 983                 memcpy(&priv->rx_buf[6], source, 6);
 984                 memcpy(priv->rx_buf, header->addr1, 6);
 985
 986                 atmel_copy_to_host(priv->dev, &priv->rx_buf[12], rx_packet_loc, msdu_size);
 987
 988                 if (priv->do_rx_crc) {
 989                         u32 netcrc;
 990                         crc = crc32_le(crc, &priv->rx_buf[12], msdu_size);
 991                         atmel_copy_to_host(priv->dev, (void *)&netcrc, rx_packet_loc + msdu_size, 4);
 992                         if ((crc ^ 0xffffffff) != netcrc) {
 993                                 priv->dev->stats.rx_crc_errors++;
 994                                 memset(priv->frag_source, 0xff, 6);
 995                         }
 996                 }
 997
 998         } else if (priv->frag_no == frag_no &&
 999                    priv->frag_seq == seq_no &&
1000                    memcmp(priv->frag_source, source, 6) == 0) {
1001
1002                 atmel_copy_to_host(priv->dev, &priv->rx_buf[12 + priv->frag_len],
1003                                    rx_packet_loc, msdu_size);
1004                 if (priv->do_rx_crc) {
1005                         u32 netcrc;
1006                         crc = crc32_le(crc,
1007                                        &priv->rx_buf[12 + priv->frag_len],
1008                                        msdu_size);
1009                         atmel_copy_to_host(priv->dev, (void *)&netcrc, rx_packet_loc + msdu_size, 4);
1010                         if ((crc ^ 0xffffffff) != netcrc) {
1011                                 priv->dev->stats.rx_crc_errors++;
1012                                 memset(priv->frag_source, 0xff, 6);
1013                                 more_frags = 1; /* don't send broken assembly */
1014                         }
1015                 }
1016
1017                 priv->frag_len += msdu_size;
1018                 priv->frag_no++;
1019
1020                 if (!more_frags) { /* last one */
1021                         memset(priv->frag_source, 0xff, 6);
1022                         if (!(skb = dev_alloc_skb(priv->frag_len + 14))) {
1023                                 priv->dev->stats.rx_dropped++;
1024                         } else {
1025                                 skb_reserve(skb, 2);
1026                                 memcpy(skb_put(skb, priv->frag_len + 12),
1027                                        priv->rx_buf,
1028                                        priv->frag_len + 12);
1029                                 priv->dev->last_rx = jiffies;
1030                                 skb->protocol = eth_type_trans(skb, priv->dev);
1031                                 skb->ip_summed = CHECKSUM_NONE;
1032                                 netif_rx(skb);
1033                                 priv->dev->stats.rx_bytes += priv->frag_len + 12;
1034                                 priv->dev->stats.rx_packets++;
1035                         }
1036                 }
1037         } else
1038                 priv->wstats.discard.fragment++;
1039 }
1040
1041 static void rx_done_irq(struct atmel_private *priv)
1042 {
1043         int i;
1044         struct ieee80211_hdr_4addr header;
1045
1046         for (i = 0;
1047              atmel_rmem8(priv, atmel_rx(priv, RX_DESC_FLAGS_OFFSET, priv->rx_desc_head)) == RX_DESC_FLAG_VALID &&
1048                      i < priv->host_info.rx_desc_count;
1049              i++) {
1050
1051                 u16 msdu_size, rx_packet_loc, frame_ctl, seq_control;
1052                 u8 status = atmel_rmem8(priv, atmel_rx(priv, RX_DESC_STATUS_OFFSET, priv->rx_desc_head));
1053                 u32 crc = 0xffffffff;
1054
1055                 if (status != RX_STATUS_SUCCESS) {
1056                         if (status == 0xc1) /* determined by experiment */
1057                                 priv->wstats.discard.nwid++;
1058                         else
1059                                 priv->dev->stats.rx_errors++;
1060                         goto next;
1061                 }
1062
1063                 msdu_size = atmel_rmem16(priv, atmel_rx(priv, RX_DESC_MSDU_SIZE_OFFSET, priv->rx_desc_head));
1064                 rx_packet_loc = atmel_rmem16(priv, atmel_rx(priv, RX_DESC_MSDU_POS_OFFSET, priv->rx_desc_head));
1065
1066                 if (msdu_size < 30) {
1067                         priv->dev->stats.rx_errors++;
1068                         goto next;
1069                 }
1070
1071                 /* Get header as far as end of seq_ctl */
1072                 atmel_copy_to_host(priv->dev, (char *)&header, rx_packet_loc, 24);
1073                 frame_ctl = le16_to_cpu(header.frame_ctl);
1074                 seq_control = le16_to_cpu(header.seq_ctl);
1075
1076                 /* probe for CRC use here if needed  once five packets have
1077                    arrived with the same crc status, we assume we know what's
1078                    happening and stop probing */
1079                 if (priv->probe_crc) {
1080                         if (!priv->wep_is_on || !(frame_ctl & IEEE80211_FCTL_PROTECTED)) {
1081                                 priv->do_rx_crc = probe_crc(priv, rx_packet_loc, msdu_size);
1082                         } else {
1083                                 priv->do_rx_crc = probe_crc(priv, rx_packet_loc + 24, msdu_size - 24);
1084                         }
1085                         if (priv->do_rx_crc) {
1086                                 if (priv->crc_ok_cnt++ > 5)
1087                                         priv->probe_crc = 0;
1088                         } else {
1089                                 if (priv->crc_ko_cnt++ > 5)
1090                                         priv->probe_crc = 0;
1091                         }
1092                 }
1093
1094                 /* don't CRC header when WEP in use */
1095                 if (priv->do_rx_crc && (!priv->wep_is_on || !(frame_ctl & IEEE80211_FCTL_PROTECTED))) {
1096                         crc = crc32_le(0xffffffff, (unsigned char *)&header, 24);
1097                 }
1098                 msdu_size -= 24; /* header */
1099
1100                 if ((frame_ctl & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA) {
1101                         int more_fragments = frame_ctl & IEEE80211_FCTL_MOREFRAGS;
1102                         u8 packet_fragment_no = seq_control & IEEE80211_SCTL_FRAG;
1103                         u16 packet_sequence_no = (seq_control & IEEE80211_SCTL_SEQ) >> 4;
1104
1105                         if (!more_fragments && packet_fragment_no == 0) {
1106                                 fast_rx_path(priv, &header, msdu_size, rx_packet_loc, crc);
1107                         } else {
1108                                 frag_rx_path(priv, &header, msdu_size, rx_packet_loc, crc,
1109                                              packet_sequence_no, packet_fragment_no, more_fragments);
1110                         }
1111                 }
1112
1113                 if ((frame_ctl & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT) {
1114                         /* copy rest of packet into buffer */
1115                         atmel_copy_to_host(priv->dev, (unsigned char *)&priv->rx_buf, rx_packet_loc + 24, msdu_size);
1116
1117                         /* we use the same buffer for frag reassembly and control packets */
1118                         memset(priv->frag_source, 0xff, 6);
1119
1120                         if (priv->do_rx_crc) {
1121                                 /* last 4 octets is crc */
1122                                 msdu_size -= 4;
1123                                 crc = crc32_le(crc, (unsigned char *)&priv->rx_buf, msdu_size);
1124                                 if ((crc ^ 0xffffffff) != (*((u32 *)&priv->rx_buf[msdu_size]))) {
1125                                         priv->dev->stats.rx_crc_errors++;
1126                                         goto next;
1127                                 }
1128                         }
1129
1130                         atmel_management_frame(priv, &header, msdu_size,
1131                                                atmel_rmem8(priv, atmel_rx(priv, RX_DESC_RSSI_OFFSET, priv->rx_desc_head)));
1132                 }
1133
1134 next:
1135                 /* release descriptor */
1136                 atmel_wmem8(priv, atmel_rx(priv, RX_DESC_FLAGS_OFFSET, priv->rx_desc_head), RX_DESC_FLAG_CONSUMED);
1137
1138                 if (priv->rx_desc_head < (priv->host_info.rx_desc_count - 1))
1139                         priv->rx_desc_head++;
1140                 else
1141                         priv->rx_desc_head = 0;
1142         }
1143 }
1144
1145 static irqreturn_t service_interrupt(int irq, void *dev_id)
1146 {
1147         struct net_device *dev = (struct net_device *) dev_id;
1148         struct atmel_private *priv = netdev_priv(dev);
1149         u8 isr;
1150         int i = -1;
1151         static u8 irq_order[] = {
1152                 ISR_OUT_OF_RANGE,
1153                 ISR_RxCOMPLETE,
1154                 ISR_TxCOMPLETE,
1155                 ISR_RxFRAMELOST,
1156                 ISR_FATAL_ERROR,
1157                 ISR_COMMAND_COMPLETE,
1158                 ISR_IBSS_MERGE,
1159                 ISR_GENERIC_IRQ
1160         };
1161
1162         if (priv->card && priv->present_callback &&
1163             !(*priv->present_callback)(priv->card))
1164                 return IRQ_HANDLED;
1165
1166         /* In this state upper-level code assumes it can mess with
1167            the card unhampered by interrupts which may change register state.
1168            Note that even though the card shouldn't generate interrupts
1169            the inturrupt line may be shared. This allows card setup
1170            to go on without disabling interrupts for a long time. */
1171         if (priv->station_state == STATION_STATE_DOWN)
1172                 return IRQ_NONE;
1173
1174         atmel_clear_gcr(dev, GCR_ENINT); /* disable interrupts */
1175
1176         while (1) {
1177                 if (!atmel_lock_mac(priv)) {
1178                         /* failed to contact card */
1179                         printk(KERN_ALERT "%s: failed to contact MAC.\n", dev->name);
1180                         return IRQ_HANDLED;
1181                 }
1182
1183                 isr = atmel_rmem8(priv, atmel_hi(priv, IFACE_INT_STATUS_OFFSET));
1184                 atmel_wmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_MAC_OFFSET), 0);
1185
1186                 if (!isr) {
1187                         atmel_set_gcr(dev, GCR_ENINT); /* enable interrupts */
1188                         return i == -1 ? IRQ_NONE : IRQ_HANDLED;
1189                 }
1190
1191                 atmel_set_gcr(dev, GCR_ACKINT); /* acknowledge interrupt */
1192
1193                 for (i = 0; i < ARRAY_SIZE(irq_order); i++)
1194                         if (isr & irq_order[i])
1195                                 break;
1196
1197                 if (!atmel_lock_mac(priv)) {
1198                         /* failed to contact card */
1199                         printk(KERN_ALERT "%s: failed to contact MAC.\n", dev->name);
1200                         return IRQ_HANDLED;
1201                 }
1202
1203                 isr = atmel_rmem8(priv, atmel_hi(priv, IFACE_INT_STATUS_OFFSET));
1204                 isr ^= irq_order[i];
1205                 atmel_wmem8(priv, atmel_hi(priv, IFACE_INT_STATUS_OFFSET), isr);
1206                 atmel_wmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_MAC_OFFSET), 0);
1207
1208                 switch (irq_order[i]) {
1209
1210                 case ISR_OUT_OF_RANGE:
1211                         if (priv->operating_mode == IW_MODE_INFRA &&
1212                             priv->station_state == STATION_STATE_READY) {
1213                                 priv->station_is_associated = 0;
1214                                 atmel_scan(priv, 1);
1215                         }
1216                         break;
1217
1218                 case ISR_RxFRAMELOST:
1219                         priv->wstats.discard.misc++;
1220                         /* fall through */
1221                 case ISR_RxCOMPLETE:
1222                         rx_done_irq(priv);
1223                         break;
1224
1225                 case ISR_TxCOMPLETE:
1226                         tx_done_irq(priv);
1227                         break;
1228
1229                 case ISR_FATAL_ERROR:
1230                         printk(KERN_ALERT "%s: *** FATAL error interrupt ***\n", dev->name);
1231                         atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
1232                         break;
1233
1234                 case ISR_COMMAND_COMPLETE:
1235                         atmel_command_irq(priv);
1236                         break;
1237
1238                 case ISR_IBSS_MERGE:
1239                         atmel_get_mib(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_CUR_BSSID_POS,
1240                                       priv->CurrentBSSID, 6);
1241                         /* The WPA stuff cares about the current AP address */
1242                         if (priv->use_wpa)
1243                                 build_wpa_mib(priv);
1244                         break;
1245                 case ISR_GENERIC_IRQ:
1246                         printk(KERN_INFO "%s: Generic_irq received.\n", dev->name);
1247                         break;
1248                 }
1249         }
1250 }
1251
1252 static struct iw_statistics *atmel_get_wireless_stats(struct net_device *dev)
1253 {
1254         struct atmel_private *priv = netdev_priv(dev);
1255
1256         /* update the link quality here in case we are seeing no beacons
1257            at all to drive the process */
1258         atmel_smooth_qual(priv);
1259
1260         priv->wstats.status = priv->station_state;
1261
1262         if (priv->operating_mode == IW_MODE_INFRA) {
1263                 if (priv->station_state != STATION_STATE_READY) {
1264                         priv->wstats.qual.qual = 0;
1265                         priv->wstats.qual.level = 0;
1266                         priv->wstats.qual.updated = (IW_QUAL_QUAL_INVALID
1267                                         | IW_QUAL_LEVEL_INVALID);
1268                 }
1269                 priv->wstats.qual.noise = 0;
1270                 priv->wstats.qual.updated |= IW_QUAL_NOISE_INVALID;
1271         } else {
1272                 /* Quality levels cannot be determined in ad-hoc mode,
1273                    because we can 'hear' more that one remote station. */
1274                 priv->wstats.qual.qual = 0;
1275                 priv->wstats.qual.level = 0;
1276                 priv->wstats.qual.noise = 0;
1277                 priv->wstats.qual.updated = IW_QUAL_QUAL_INVALID
1278                                         | IW_QUAL_LEVEL_INVALID
1279                                         | IW_QUAL_NOISE_INVALID;
1280                 priv->wstats.miss.beacon = 0;
1281         }
1282
1283         return &priv->wstats;
1284 }
1285
1286 static int atmel_change_mtu(struct net_device *dev, int new_mtu)
1287 {
1288         if ((new_mtu < 68) || (new_mtu > 2312))
1289                 return -EINVAL;
1290         dev->mtu = new_mtu;
1291         return 0;
1292 }
1293
1294 static int atmel_set_mac_address(struct net_device *dev, void *p)
1295 {
1296         struct sockaddr *addr = p;
1297
1298         memcpy (dev->dev_addr, addr->sa_data, dev->addr_len);
1299         return atmel_open(dev);
1300 }
1301
1302 EXPORT_SYMBOL(atmel_open);
1303
1304 int atmel_open(struct net_device *dev)
1305 {
1306         struct atmel_private *priv = netdev_priv(dev);
1307         int i, channel, err;
1308
1309         /* any scheduled timer is no longer needed and might screw things up.. */
1310         del_timer_sync(&priv->management_timer);
1311
1312         /* Interrupts will not touch the card once in this state... */
1313         priv->station_state = STATION_STATE_DOWN;
1314
1315         if (priv->new_SSID_size) {
1316                 memcpy(priv->SSID, priv->new_SSID, priv->new_SSID_size);
1317                 priv->SSID_size = priv->new_SSID_size;
1318                 priv->new_SSID_size = 0;
1319         }
1320         priv->BSS_list_entries = 0;
1321
1322         priv->AuthenticationRequestRetryCnt = 0;
1323         priv->AssociationRequestRetryCnt = 0;
1324         priv->ReAssociationRequestRetryCnt = 0;
1325         priv->CurrentAuthentTransactionSeqNum = 0x0001;
1326         priv->ExpectedAuthentTransactionSeqNum = 0x0002;
1327
1328         priv->site_survey_state = SITE_SURVEY_IDLE;
1329         priv->station_is_associated = 0;
1330
1331         err = reset_atmel_card(dev);
1332         if (err)
1333                 return err;
1334
1335         if (priv->config_reg_domain) {
1336                 priv->reg_domain = priv->config_reg_domain;
1337                 atmel_set_mib8(priv, Phy_Mib_Type, PHY_MIB_REG_DOMAIN_POS, priv->reg_domain);
1338         } else {
1339                 priv->reg_domain = atmel_get_mib8(priv, Phy_Mib_Type, PHY_MIB_REG_DOMAIN_POS);
1340                 for (i = 0; i < ARRAY_SIZE(channel_table); i++)
1341                         if (priv->reg_domain == channel_table[i].reg_domain)
1342                                 break;
1343                 if (i == ARRAY_SIZE(channel_table)) {
1344                         priv->reg_domain = REG_DOMAIN_MKK1;
1345                         printk(KERN_ALERT "%s: failed to get regulatory domain: assuming MKK1.\n", dev->name);
1346                 }
1347         }
1348
1349         if ((channel = atmel_validate_channel(priv, priv->channel)))
1350                 priv->channel = channel;
1351
1352         /* this moves station_state on.... */
1353         atmel_scan(priv, 1);
1354
1355         atmel_set_gcr(priv->dev, GCR_ENINT); /* enable interrupts */
1356         return 0;
1357 }
1358
1359 static int atmel_close(struct net_device *dev)
1360 {
1361         struct atmel_private *priv = netdev_priv(dev);
1362
1363         /* Send event to userspace that we are disassociating */
1364         if (priv->station_state == STATION_STATE_READY) {
1365                 union iwreq_data wrqu;
1366
1367                 wrqu.data.length = 0;
1368                 wrqu.data.flags = 0;
1369                 wrqu.ap_addr.sa_family = ARPHRD_ETHER;
1370                 memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
1371                 wireless_send_event(priv->dev, SIOCGIWAP, &wrqu, NULL);
1372         }
1373
1374         atmel_enter_state(priv, STATION_STATE_DOWN);
1375
1376         if (priv->bus_type == BUS_TYPE_PCCARD)
1377                 atmel_write16(dev, GCR, 0x0060);
1378         atmel_write16(dev, GCR, 0x0040);
1379         return 0;
1380 }
1381
1382 static int atmel_validate_channel(struct atmel_private *priv, int channel)
1383 {
1384         /* check that channel is OK, if so return zero,
1385            else return suitable default channel */
1386         int i;
1387
1388         for (i = 0; i < ARRAY_SIZE(channel_table); i++)
1389                 if (priv->reg_domain == channel_table[i].reg_domain) {
1390                         if (channel >= channel_table[i].min &&
1391                             channel <= channel_table[i].max)
1392                                 return 0;
1393                         else
1394                                 return channel_table[i].min;
1395                 }
1396         return 0;
1397 }
1398
1399 static int atmel_proc_output (char *buf, struct atmel_private *priv)
1400 {
1401         int i;
1402         char *p = buf;
1403         char *s, *r, *c;
1404
1405         p += sprintf(p, "Driver version:\t\t%d.%d\n",
1406                      DRIVER_MAJOR, DRIVER_MINOR);
1407
1408         if (priv->station_state != STATION_STATE_DOWN) {
1409                 p += sprintf(p, "Firmware version:\t%d.%d build %d\n"
1410                                 "Firmware location:\t",
1411                              priv->host_info.major_version,
1412                              priv->host_info.minor_version,
1413                              priv->host_info.build_version);
1414
1415                 if (priv->card_type != CARD_TYPE_EEPROM)
1416                         p += sprintf(p, "on card\n");
1417                 else if (priv->firmware)
1418                         p += sprintf(p, "%s loaded by host\n",
1419                                      priv->firmware_id);
1420                 else
1421                         p += sprintf(p, "%s loaded by hotplug\n",
1422                                      priv->firmware_id);
1423
1424                 switch (priv->card_type) {
1425                 case CARD_TYPE_PARALLEL_FLASH: c = "Parallel flash"; break;
1426                 case CARD_TYPE_SPI_FLASH: c = "SPI flash\n"; break;
1427                 case CARD_TYPE_EEPROM: c = "EEPROM"; break;
1428                 default: c = "<unknown>";
1429                 }
1430
1431                 r = "<unknown>";
1432                 for (i = 0; i < ARRAY_SIZE(channel_table); i++)
1433                         if (priv->reg_domain == channel_table[i].reg_domain)
1434                                 r = channel_table[i].name;
1435
1436                 p += sprintf(p, "MAC memory type:\t%s\n", c);
1437                 p += sprintf(p, "Regulatory domain:\t%s\n", r);
1438                 p += sprintf(p, "Host CRC checking:\t%s\n",
1439                              priv->do_rx_crc ? "On" : "Off");
1440                 p += sprintf(p, "WPA-capable firmware:\t%s\n",
1441                              priv->use_wpa ? "Yes" : "No");
1442         }
1443
1444         switch(priv->station_state) {
1445         case STATION_STATE_SCANNING: s = "Scanning"; break;
1446         case STATION_STATE_JOINNING: s = "Joining"; break;
1447         case STATION_STATE_AUTHENTICATING: s = "Authenticating"; break;
1448         case STATION_STATE_ASSOCIATING: s = "Associating"; break;
1449         case STATION_STATE_READY: s = "Ready"; break;
1450         case STATION_STATE_REASSOCIATING: s = "Reassociating"; break;
1451         case STATION_STATE_MGMT_ERROR: s = "Management error"; break;
1452         case STATION_STATE_DOWN: s = "Down"; break;
1453         default: s = "<unknown>";
1454         }
1455
1456         p += sprintf(p, "Current state:\t\t%s\n", s);
1457         return p - buf;
1458 }
1459
1460 static int atmel_read_proc(char *page, char **start, off_t off,
1461                            int count, int *eof, void *data)
1462 {
1463         struct atmel_private *priv = data;
1464         int len = atmel_proc_output (page, priv);
1465         if (len <= off+count) *eof = 1;
1466         *start = page + off;
1467         len -= off;
1468         if (len>count) len = count;
1469         if (len<0) len = 0;
1470         return len;
1471 }
1472
1473 struct net_device *init_atmel_card(unsigned short irq, unsigned long port,
1474                                    const AtmelFWType fw_type,
1475                                    struct device *sys_dev,
1476                                    int (*card_present)(void *), void *card)
1477 {
1478         struct proc_dir_entry *ent;
1479         struct net_device *dev;
1480         struct atmel_private *priv;
1481         int rc;
1482         DECLARE_MAC_BUF(mac);
1483
1484         /* Create the network device object. */
1485         dev = alloc_etherdev(sizeof(*priv));
1486         if (!dev) {
1487                 printk(KERN_ERR "atmel: Couldn't alloc_etherdev\n");
1488                 return NULL;
1489         }
1490         if (dev_alloc_name(dev, dev->name) < 0) {
1491                 printk(KERN_ERR "atmel: Couldn't get name!\n");
1492                 goto err_out_free;
1493         }
1494
1495         priv = netdev_priv(dev);
1496         priv->dev = dev;
1497         priv->sys_dev = sys_dev;
1498         priv->present_callback = card_present;
1499         priv->card = card;
1500         priv->firmware = NULL;
1501         priv->firmware_id[0] = '\0';
1502         priv->firmware_type = fw_type;
1503         if (firmware) /* module parameter */
1504                 strcpy(priv->firmware_id, firmware);
1505         priv->bus_type = card_present ? BUS_TYPE_PCCARD : BUS_TYPE_PCI;
1506         priv->station_state = STATION_STATE_DOWN;
1507         priv->do_rx_crc = 0;
1508         /* For PCMCIA cards, some chips need CRC, some don't
1509            so we have to probe. */
1510         if (priv->bus_type == BUS_TYPE_PCCARD) {
1511                 priv->probe_crc = 1;
1512                 priv->crc_ok_cnt = priv->crc_ko_cnt = 0;
1513         } else
1514                 priv->probe_crc = 0;
1515         priv->last_qual = jiffies;
1516         priv->last_beacon_timestamp = 0;
1517         memset(priv->frag_source, 0xff, sizeof(priv->frag_source));
1518         memset(priv->BSSID, 0, 6);
1519         priv->CurrentBSSID[0] = 0xFF; /* Initialize to something invalid.... */
1520         priv->station_was_associated = 0;
1521
1522         priv->last_survey = jiffies;
1523         priv->preamble = LONG_PREAMBLE;
1524         priv->operating_mode = IW_MODE_INFRA;
1525         priv->connect_to_any_BSS = 0;
1526         priv->config_reg_domain = 0;
1527         priv->reg_domain = 0;
1528         priv->tx_rate = 3;
1529         priv->auto_tx_rate = 1;
1530         priv->channel = 4;
1531         priv->power_mode = 0;
1532         priv->SSID[0] = '\0';
1533         priv->SSID_size = 0;
1534         priv->new_SSID_size = 0;
1535         priv->frag_threshold = 2346;
1536         priv->rts_threshold = 2347;
1537         priv->short_retry = 7;
1538         priv->long_retry = 4;
1539
1540         priv->wep_is_on = 0;
1541         priv->default_key = 0;
1542         priv->encryption_level = 0;
1543         priv->exclude_unencrypted = 0;
1544         priv->group_cipher_suite = priv->pairwise_cipher_suite = CIPHER_SUITE_NONE;
1545         priv->use_wpa = 0;
1546         memset(priv->wep_keys, 0, sizeof(priv->wep_keys));
1547         memset(priv->wep_key_len, 0, sizeof(priv->wep_key_len));
1548
1549         priv->default_beacon_period = priv->beacon_period = 100;
1550         priv->listen_interval = 1;
1551
1552         init_timer(&priv->management_timer);
1553         spin_lock_init(&priv->irqlock);
1554         spin_lock_init(&priv->timerlock);
1555         priv->management_timer.function = atmel_management_timer;
1556         priv->management_timer.data = (unsigned long) dev;
1557
1558         dev->open = atmel_open;
1559         dev->stop = atmel_close;
1560         dev->change_mtu = atmel_change_mtu;
1561         dev->set_mac_address = atmel_set_mac_address;
1562         dev->hard_start_xmit = start_tx;
1563         dev->wireless_handlers = (struct iw_handler_def *)&atmel_handler_def;
1564         dev->do_ioctl = atmel_ioctl;
1565         dev->irq = irq;
1566         dev->base_addr = port;
1567
1568         SET_NETDEV_DEV(dev, sys_dev);
1569
1570         if ((rc = request_irq(dev->irq, service_interrupt, IRQF_SHARED, dev->name, dev))) {
1571                 printk(KERN_ERR "%s: register interrupt %d failed, rc %d\n", dev->name, irq, rc);
1572                 goto err_out_free;
1573         }
1574
1575         if (!request_region(dev->base_addr, 32,
1576                             priv->bus_type == BUS_TYPE_PCCARD ?  "atmel_cs" : "atmel_pci")) {
1577                 goto err_out_irq;
1578         }
1579
1580         if (register_netdev(dev))
1581                 goto err_out_res;
1582
1583         if (!probe_atmel_card(dev)){
1584                 unregister_netdev(dev);
1585                 goto err_out_res;
1586         }
1587
1588         netif_carrier_off(dev);
1589
1590         ent = create_proc_read_entry ("driver/atmel", 0, NULL, atmel_read_proc, priv);
1591         if (!ent)
1592                 printk(KERN_WARNING "atmel: unable to create /proc entry.\n");
1593
1594         printk(KERN_INFO "%s: Atmel at76c50x. Version %d.%d. MAC %s\n",
1595                dev->name, DRIVER_MAJOR, DRIVER_MINOR, print_mac(mac, dev->dev_addr));
1596
1597         return dev;
1598
1599 err_out_res:
1600         release_region( dev->base_addr, 32);
1601 err_out_irq:
1602         free_irq(dev->irq, dev);
1603 err_out_free:
1604         free_netdev(dev);
1605         return NULL;
1606 }
1607
1608 EXPORT_SYMBOL(init_atmel_card);
1609
1610 void stop_atmel_card(struct net_device *dev)
1611 {
1612         struct atmel_private *priv = netdev_priv(dev);
1613
1614         /* put a brick on it... */
1615         if (priv->bus_type == BUS_TYPE_PCCARD)
1616                 atmel_write16(dev, GCR, 0x0060);
1617         atmel_write16(dev, GCR, 0x0040);
1618
1619         del_timer_sync(&priv->management_timer);
1620         unregister_netdev(dev);
1621         remove_proc_entry("driver/atmel", NULL);
1622         free_irq(dev->irq, dev);
1623         kfree(priv->firmware);
1624         release_region(dev->base_addr, 32);
1625         free_netdev(dev);
1626 }
1627
1628 EXPORT_SYMBOL(stop_atmel_card);
1629
1630 static int atmel_set_essid(struct net_device *dev,
1631                            struct iw_request_info *info,
1632                            struct iw_point *dwrq,
1633                            char *extra)
1634 {
1635         struct atmel_private *priv = netdev_priv(dev);
1636
1637         /* Check if we asked for `any' */
1638         if(dwrq->flags == 0) {
1639                 priv->connect_to_any_BSS = 1;
1640         } else {
1641                 int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
1642
1643                 priv->connect_to_any_BSS = 0;
1644
1645                 /* Check the size of the string */
1646                 if (dwrq->length > MAX_SSID_LENGTH)
1647                          return -E2BIG;
1648                 if (index != 0)
1649                         return -EINVAL;
1650
1651                 memcpy(priv->new_SSID, extra, dwrq->length);
1652                 priv->new_SSID_size = dwrq->length;
1653         }
1654
1655         return -EINPROGRESS;
1656 }
1657
1658 static int atmel_get_essid(struct net_device *dev,
1659                            struct iw_request_info *info,
1660                            struct iw_point *dwrq,
1661                            char *extra)
1662 {
1663         struct atmel_private *priv = netdev_priv(dev);
1664
1665         /* Get the current SSID */
1666         if (priv->new_SSID_size != 0) {
1667                 memcpy(extra, priv->new_SSID, priv->new_SSID_size);
1668                 dwrq->length = priv->new_SSID_size;
1669         } else {
1670                 memcpy(extra, priv->SSID, priv->SSID_size);
1671                 dwrq->length = priv->SSID_size;
1672         }
1673
1674         dwrq->flags = !priv->connect_to_any_BSS; /* active */
1675
1676         return 0;
1677 }
1678
1679 static int atmel_get_wap(struct net_device *dev,
1680                          struct iw_request_info *info,
1681                          struct sockaddr *awrq,
1682                          char *extra)
1683 {
1684         struct atmel_private *priv = netdev_priv(dev);
1685         memcpy(awrq->sa_data, priv->CurrentBSSID, 6);
1686         awrq->sa_family = ARPHRD_ETHER;
1687
1688         return 0;
1689 }
1690
1691 static int atmel_set_encode(struct net_device *dev,
1692                             struct iw_request_info *info,
1693                             struct iw_point *dwrq,
1694                             char *extra)
1695 {
1696         struct atmel_private *priv = netdev_priv(dev);
1697
1698         /* Basic checking: do we have a key to set ?
1699          * Note : with the new API, it's impossible to get a NULL pointer.
1700          * Therefore, we need to check a key size == 0 instead.
1701          * New version of iwconfig properly set the IW_ENCODE_NOKEY flag
1702          * when no key is present (only change flags), but older versions
1703          * don't do it. - Jean II */
1704         if (dwrq->length > 0) {
1705                 int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
1706                 int current_index = priv->default_key;
1707                 /* Check the size of the key */
1708                 if (dwrq->length > 13) {
1709                         return -EINVAL;
1710                 }
1711                 /* Check the index (none -> use current) */
1712                 if (index < 0 || index >= 4)
1713                         index = current_index;
1714                 else
1715                         priv->default_key = index;
1716                 /* Set the length */
1717                 if (dwrq->length > 5)
1718                         priv->wep_key_len[index] = 13;
1719                 else
1720                         if (dwrq->length > 0)
1721                                 priv->wep_key_len[index] = 5;
1722                         else
1723                                 /* Disable the key */
1724                                 priv->wep_key_len[index] = 0;
1725                 /* Check if the key is not marked as invalid */
1726                 if (!(dwrq->flags & IW_ENCODE_NOKEY)) {
1727                         /* Cleanup */
1728                         memset(priv->wep_keys[index], 0, 13);
1729                         /* Copy the key in the driver */
1730                         memcpy(priv->wep_keys[index], extra, dwrq->length);
1731                 }
1732                 /* WE specify that if a valid key is set, encryption
1733                  * should be enabled (user may turn it off later)
1734                  * This is also how "iwconfig ethX key on" works */
1735                 if (index == current_index &&
1736                     priv->wep_key_len[index] > 0) {
1737                         priv->wep_is_on = 1;
1738                         priv->exclude_unencrypted = 1;
1739                         if (priv->wep_key_len[index] > 5) {
1740                                 priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_128;
1741                                 priv->encryption_level = 2;
1742                         } else {
1743                                 priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_64;
1744                                 priv->encryption_level = 1;
1745                         }
1746                 }
1747         } else {
1748                 /* Do we want to just set the transmit key index ? */
1749                 int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
1750                 if (index >= 0 && index < 4) {
1751                         priv->default_key = index;
1752                 } else
1753                         /* Don't complain if only change the mode */
1754                         if (!(dwrq->flags & IW_ENCODE_MODE))
1755                                 return -EINVAL;
1756         }
1757         /* Read the flags */
1758         if (dwrq->flags & IW_ENCODE_DISABLED) {
1759                 priv->wep_is_on = 0;
1760                 priv->encryption_level = 0;
1761                 priv->pairwise_cipher_suite = CIPHER_SUITE_NONE;
1762         } else {
1763                 priv->wep_is_on = 1;
1764                 if (priv->wep_key_len[priv->default_key] > 5) {
1765                         priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_128;
1766                         priv->encryption_level = 2;
1767                 } else {
1768                         priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_64;
1769                         priv->encryption_level = 1;
1770                 }
1771         }
1772         if (dwrq->flags & IW_ENCODE_RESTRICTED)
1773                 priv->exclude_unencrypted = 1;
1774         if(dwrq->flags & IW_ENCODE_OPEN)
1775                 priv->exclude_unencrypted = 0;
1776
1777         return -EINPROGRESS;            /* Call commit handler */
1778 }
1779
1780 static int atmel_get_encode(struct net_device *dev,
1781                             struct iw_request_info *info,
1782                             struct iw_point *dwrq,
1783                             char *extra)
1784 {
1785         struct atmel_private *priv = netdev_priv(dev);
1786         int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
1787
1788         if (!priv->wep_is_on)
1789                 dwrq->flags = IW_ENCODE_DISABLED;
1790         else {
1791                 if (priv->exclude_unencrypted)
1792                         dwrq->flags = IW_ENCODE_RESTRICTED;
1793                 else
1794                         dwrq->flags = IW_ENCODE_OPEN;
1795         }
1796                 /* Which key do we want ? -1 -> tx index */
1797         if (index < 0 || index >= 4)
1798                 index = priv->default_key;
1799         dwrq->flags |= index + 1;
1800         /* Copy the key to the user buffer */
1801         dwrq->length = priv->wep_key_len[index];
1802         if (dwrq->length > 16) {
1803                 dwrq->length=0;
1804         } else {
1805                 memset(extra, 0, 16);
1806                 memcpy(extra, priv->wep_keys[index], dwrq->length);
1807         }
1808
1809         return 0;
1810 }
1811
1812 static int atmel_set_encodeext(struct net_device *dev,
1813                             struct iw_request_info *info,
1814                             union iwreq_data *wrqu,
1815                             char *extra)
1816 {
1817         struct atmel_private *priv = netdev_priv(dev);
1818         struct iw_point *encoding = &wrqu->encoding;
1819         struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
1820         int idx, key_len, alg = ext->alg, set_key = 1;
1821
1822         /* Determine and validate the key index */
1823         idx = encoding->flags & IW_ENCODE_INDEX;
1824         if (idx) {
1825                 if (idx < 1 || idx > WEP_KEYS)
1826                         return -EINVAL;
1827                 idx--;
1828         } else
1829                 idx = priv->default_key;
1830
1831         if (encoding->flags & IW_ENCODE_DISABLED)
1832             alg = IW_ENCODE_ALG_NONE;
1833
1834         if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY) {
1835                 priv->default_key = idx;
1836                 set_key = ext->key_len > 0 ? 1 : 0;
1837         }
1838
1839         if (set_key) {
1840                 /* Set the requested key first */
1841                 switch (alg) {
1842                 case IW_ENCODE_ALG_NONE:
1843                         priv->wep_is_on = 0;
1844                         priv->encryption_level = 0;
1845                         priv->pairwise_cipher_suite = CIPHER_SUITE_NONE;
1846                         break;
1847                 case IW_ENCODE_ALG_WEP:
1848                         if (ext->key_len > 5) {
1849                                 priv->wep_key_len[idx] = 13;
1850                                 priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_128;
1851                                 priv->encryption_level = 2;
1852                         } else if (ext->key_len > 0) {
1853                                 priv->wep_key_len[idx] = 5;
1854                                 priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_64;
1855                                 priv->encryption_level = 1;
1856                         } else {
1857                                 return -EINVAL;
1858                         }
1859                         priv->wep_is_on = 1;
1860                         memset(priv->wep_keys[idx], 0, 13);
1861                         key_len = min ((int)ext->key_len, priv->wep_key_len[idx]);
1862                         memcpy(priv->wep_keys[idx], ext->key, key_len);
1863                         break;
1864                 default:
1865                         return -EINVAL;
1866                 }
1867         }
1868
1869         return -EINPROGRESS;
1870 }
1871
1872 static int atmel_get_encodeext(struct net_device *dev,
1873                             struct iw_request_info *info,
1874                             union iwreq_data *wrqu,
1875                             char *extra)
1876 {
1877         struct atmel_private *priv = netdev_priv(dev);
1878         struct iw_point *encoding = &wrqu->encoding;
1879         struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
1880         int idx, max_key_len;
1881
1882         max_key_len = encoding->length - sizeof(*ext);
1883         if (max_key_len < 0)
1884                 return -EINVAL;
1885
1886         idx = encoding->flags & IW_ENCODE_INDEX;
1887         if (idx) {
1888                 if (idx < 1 || idx > WEP_KEYS)
1889                         return -EINVAL;
1890                 idx--;
1891         } else
1892                 idx = priv->default_key;
1893
1894         encoding->flags = idx + 1;
1895         memset(ext, 0, sizeof(*ext));
1896
1897         if (!priv->wep_is_on) {
1898                 ext->alg = IW_ENCODE_ALG_NONE;
1899                 ext->key_len = 0;
1900                 encoding->flags |= IW_ENCODE_DISABLED;
1901         } else {
1902                 if (priv->encryption_level > 0)
1903                         ext->alg = IW_ENCODE_ALG_WEP;
1904                 else
1905                         return -EINVAL;
1906
1907                 ext->key_len = priv->wep_key_len[idx];
1908                 memcpy(ext->key, priv->wep_keys[idx], ext->key_len);
1909                 encoding->flags |= IW_ENCODE_ENABLED;
1910         }
1911
1912         return 0;
1913 }
1914
1915 static int atmel_set_auth(struct net_device *dev,
1916                                struct iw_request_info *info,
1917                                union iwreq_data *wrqu, char *extra)
1918 {
1919         struct atmel_private *priv = netdev_priv(dev);
1920         struct iw_param *param = &wrqu->param;
1921
1922         switch (param->flags & IW_AUTH_INDEX) {
1923         case IW_AUTH_WPA_VERSION:
1924         case IW_AUTH_CIPHER_PAIRWISE:
1925         case IW_AUTH_CIPHER_GROUP:
1926         case IW_AUTH_KEY_MGMT:
1927         case IW_AUTH_RX_UNENCRYPTED_EAPOL:
1928         case IW_AUTH_PRIVACY_INVOKED:
1929                 /*
1930                  * atmel does not use these parameters
1931                  */
1932                 break;
1933
1934         case IW_AUTH_DROP_UNENCRYPTED:
1935                 priv->exclude_unencrypted = param->value ? 1 : 0;
1936                 break;
1937
1938         case IW_AUTH_80211_AUTH_ALG: {
1939                         if (param->value & IW_AUTH_ALG_SHARED_KEY) {
1940                                 priv->exclude_unencrypted = 1;
1941                         } else if (param->value & IW_AUTH_ALG_OPEN_SYSTEM) {
1942                                 priv->exclude_unencrypted = 0;
1943                         } else
1944                                 return -EINVAL;
1945                         break;
1946                 }
1947
1948         case IW_AUTH_WPA_ENABLED:
1949                 /* Silently accept disable of WPA */
1950                 if (param->value > 0)
1951                         return -EOPNOTSUPP;
1952                 break;
1953
1954         default:
1955                 return -EOPNOTSUPP;
1956         }
1957         return -EINPROGRESS;
1958 }
1959
1960 static int atmel_get_auth(struct net_device *dev,
1961                                struct iw_request_info *info,
1962                                union iwreq_data *wrqu, char *extra)
1963 {
1964         struct atmel_private *priv = netdev_priv(dev);
1965         struct iw_param *param = &wrqu->param;
1966
1967         switch (param->flags & IW_AUTH_INDEX) {
1968         case IW_AUTH_DROP_UNENCRYPTED:
1969                 param->value = priv->exclude_unencrypted;
1970                 break;
1971
1972         case IW_AUTH_80211_AUTH_ALG:
1973                 if (priv->exclude_unencrypted == 1)
1974                         param->value = IW_AUTH_ALG_SHARED_KEY;
1975                 else
1976                         param->value = IW_AUTH_ALG_OPEN_SYSTEM;
1977                 break;
1978
1979         case IW_AUTH_WPA_ENABLED:
1980                 param->value = 0;
1981                 break;
1982
1983         default:
1984                 return -EOPNOTSUPP;
1985         }
1986         return 0;
1987 }
1988
1989
1990 static int atmel_get_name(struct net_device *dev,
1991                           struct iw_request_info *info,
1992                           char *cwrq,
1993                           char *extra)
1994 {
1995         strcpy(cwrq, "IEEE 802.11-DS");
1996         return 0;
1997 }
1998
1999 static int atmel_set_rate(struct net_device *dev,
2000                           struct iw_request_info *info,
2001                           struct iw_param *vwrq,
2002                           char *extra)
2003 {
2004         struct atmel_private *priv = netdev_priv(dev);
2005
2006         if (vwrq->fixed == 0) {
2007                 priv->tx_rate = 3;
2008                 priv->auto_tx_rate = 1;
2009         } else {
2010                 priv->auto_tx_rate = 0;
2011
2012                 /* Which type of value ? */
2013                 if ((vwrq->value < 4) && (vwrq->value >= 0)) {
2014                         /* Setting by rate index */
2015                         priv->tx_rate = vwrq->value;
2016                 } else {
2017                 /* Setting by frequency value */
2018                         switch (vwrq->value) {
2019                         case  1000000: priv->tx_rate = 0; break;
2020                         case  2000000: priv->tx_rate = 1; break;
2021                         case  5500000: priv->tx_rate = 2; break;
2022                         case 11000000: priv->tx_rate = 3; break;
2023                         default: return -EINVAL;
2024                         }
2025                 }
2026         }
2027
2028         return -EINPROGRESS;
2029 }
2030
2031 static int atmel_set_mode(struct net_device *dev,
2032                           struct iw_request_info *info,
2033                           __u32 *uwrq,
2034                           char *extra)
2035 {
2036         struct atmel_private *priv = netdev_priv(dev);
2037
2038         if (*uwrq != IW_MODE_ADHOC && *uwrq != IW_MODE_INFRA)
2039                 return -EINVAL;
2040
2041         priv->operating_mode = *uwrq;
2042         return -EINPROGRESS;
2043 }
2044
2045 static int atmel_get_mode(struct net_device *dev,
2046                           struct iw_request_info *info,
2047                           __u32 *uwrq,
2048                           char *extra)
2049 {
2050         struct atmel_private *priv = netdev_priv(dev);
2051
2052         *uwrq = priv->operating_mode;
2053         return 0;
2054 }
2055
2056 static int atmel_get_rate(struct net_device *dev,
2057                          struct iw_request_info *info,
2058                          struct iw_param *vwrq,
2059                          char *extra)
2060 {
2061         struct atmel_private *priv = netdev_priv(dev);
2062
2063         if (priv->auto_tx_rate) {
2064                 vwrq->fixed = 0;
2065                 vwrq->value = 11000000;
2066         } else {
2067                 vwrq->fixed = 1;
2068                 switch(priv->tx_rate) {
2069                 case 0: vwrq->value =  1000000; break;
2070                 case 1: vwrq->value =  2000000; break;
2071                 case 2: vwrq->value =  5500000; break;
2072                 case 3: vwrq->value = 11000000; break;
2073                 }
2074         }
2075         return 0;
2076 }
2077
2078 static int atmel_set_power(struct net_device *dev,
2079                            struct iw_request_info *info,
2080                            struct iw_param *vwrq,
2081                            char *extra)
2082 {
2083         struct atmel_private *priv = netdev_priv(dev);
2084         priv->power_mode = vwrq->disabled ? 0 : 1;
2085         return -EINPROGRESS;
2086 }
2087
2088 static int atmel_get_power(struct net_device *dev,
2089                            struct iw_request_info *info,
2090                            struct iw_param *vwrq,
2091                            char *extra)
2092 {
2093         struct atmel_private *priv = netdev_priv(dev);
2094         vwrq->disabled = priv->power_mode ? 0 : 1;
2095         vwrq->flags = IW_POWER_ON;
2096         return 0;
2097 }
2098
2099 static int atmel_set_retry(struct net_device *dev,
2100                            struct iw_request_info *info,
2101                            struct iw_param *vwrq,
2102                            char *extra)
2103 {
2104         struct atmel_private *priv = netdev_priv(dev);
2105
2106         if (!vwrq->disabled && (vwrq->flags & IW_RETRY_LIMIT)) {
2107                 if (vwrq->flags & IW_RETRY_LONG)
2108                         priv->long_retry = vwrq->value;
2109                 else if (vwrq->flags & IW_RETRY_SHORT)
2110                         priv->short_retry = vwrq->value;
2111                 else {
2112                         /* No modifier : set both */
2113                         priv->long_retry = vwrq->value;
2114                         priv->short_retry = vwrq->value;
2115                 }
2116                 return -EINPROGRESS;
2117         }
2118
2119         return -EINVAL;
2120 }
2121
2122 static int atmel_get_retry(struct net_device *dev,
2123                            struct iw_request_info *info,
2124                            struct iw_param *vwrq,
2125                            char *extra)
2126 {
2127         struct atmel_private *priv = netdev_priv(dev);
2128
2129         vwrq->disabled = 0;      /* Can't be disabled */
2130
2131         /* Note : by default, display the short retry number */
2132         if (vwrq->flags & IW_RETRY_LONG) {
2133                 vwrq->flags = IW_RETRY_LIMIT | IW_RETRY_LONG;
2134                 vwrq->value = priv->long_retry;
2135         } else {
2136                 vwrq->flags = IW_RETRY_LIMIT;
2137                 vwrq->value = priv->short_retry;
2138                 if (priv->long_retry != priv->short_retry)
2139                         vwrq->flags |= IW_RETRY_SHORT;
2140         }
2141
2142         return 0;
2143 }
2144
2145 static int atmel_set_rts(struct net_device *dev,
2146                          struct iw_request_info *info,
2147                          struct iw_param *vwrq,
2148                          char *extra)
2149 {
2150         struct atmel_private *priv = netdev_priv(dev);
2151         int rthr = vwrq->value;
2152
2153         if (vwrq->disabled)
2154                 rthr = 2347;
2155         if ((rthr < 0) || (rthr > 2347)) {
2156                 return -EINVAL;
2157         }
2158         priv->rts_threshold = rthr;
2159
2160         return -EINPROGRESS;            /* Call commit handler */
2161 }
2162
2163 static int atmel_get_rts(struct net_device *dev,
2164                          struct iw_request_info *info,
2165                          struct iw_param *vwrq,
2166                          char *extra)
2167 {
2168         struct atmel_private *priv = netdev_priv(dev);
2169
2170         vwrq->value = priv->rts_threshold;
2171         vwrq->disabled = (vwrq->value >= 2347);
2172         vwrq->fixed = 1;
2173
2174         return 0;
2175 }
2176
2177 static int atmel_set_frag(struct net_device *dev,
2178                           struct iw_request_info *info,
2179                           struct iw_param *vwrq,
2180                           char *extra)
2181 {
2182         struct atmel_private *priv = netdev_priv(dev);
2183         int fthr = vwrq->value;
2184
2185         if (vwrq->disabled)
2186                 fthr = 2346;
2187         if ((fthr < 256) || (fthr > 2346)) {
2188                 return -EINVAL;
2189         }
2190         fthr &= ~0x1;   /* Get an even value - is it really needed ??? */
2191         priv->frag_threshold = fthr;
2192
2193         return -EINPROGRESS;            /* Call commit handler */
2194 }
2195
2196 static int atmel_get_frag(struct net_device *dev,
2197                           struct iw_request_info *info,
2198                           struct iw_param *vwrq,
2199                           char *extra)
2200 {
2201         struct atmel_private *priv = netdev_priv(dev);
2202
2203         vwrq->value = priv->frag_threshold;
2204         vwrq->disabled = (vwrq->value >= 2346);
2205         vwrq->fixed = 1;
2206
2207         return 0;
2208 }
2209
2210 static const long frequency_list[] = { 2412, 2417, 2422, 2427, 2432, 2437, 2442,
2211                                 2447, 2452, 2457, 2462, 2467, 2472, 2484 };
2212
2213 static int atmel_set_freq(struct net_device *dev,
2214                           struct iw_request_info *info,
2215                           struct iw_freq *fwrq,
2216                           char *extra)
2217 {
2218         struct atmel_private *priv = netdev_priv(dev);
2219         int rc = -EINPROGRESS;          /* Call commit handler */
2220
2221         /* If setting by frequency, convert to a channel */
2222         if ((fwrq->e == 1) &&
2223             (fwrq->m >= (int) 241200000) &&
2224             (fwrq->m <= (int) 248700000)) {
2225                 int f = fwrq->m / 100000;
2226                 int c = 0;
2227                 while ((c < 14) && (f != frequency_list[c]))
2228                         c++;
2229                 /* Hack to fall through... */
2230                 fwrq->e = 0;
2231                 fwrq->m = c + 1;
2232         }
2233         /* Setting by channel number */
2234         if ((fwrq->m > 1000) || (fwrq->e > 0))
2235                 rc = -EOPNOTSUPP;
2236         else {
2237                 int channel = fwrq->m;
2238                 if (atmel_validate_channel(priv, channel) == 0) {
2239                         priv->channel = channel;
2240                 } else {
2241                         rc = -EINVAL;
2242                 }
2243         }
2244         return rc;
2245 }
2246
2247 static int atmel_get_freq(struct net_device *dev,
2248                           struct iw_request_info *info,
2249                           struct iw_freq *fwrq,
2250                           char *extra)
2251 {
2252         struct atmel_private *priv = netdev_priv(dev);
2253
2254         fwrq->m = priv->channel;
2255         fwrq->e = 0;
2256         return 0;
2257 }
2258
2259 static int atmel_set_scan(struct net_device *dev,
2260                           struct iw_request_info *info,
2261                           struct iw_param *vwrq,
2262                           char *extra)
2263 {
2264         struct atmel_private *priv = netdev_priv(dev);
2265         unsigned long flags;
2266
2267         /* Note : you may have realised that, as this is a SET operation,
2268          * this is privileged and therefore a normal user can't
2269          * perform scanning.
2270          * This is not an error, while the device perform scanning,
2271          * traffic doesn't flow, so it's a perfect DoS...
2272          * Jean II */
2273
2274         if (priv->station_state == STATION_STATE_DOWN)
2275                 return -EAGAIN;
2276
2277         /* Timeout old surveys. */
2278         if (time_after(jiffies, priv->last_survey + 20 * HZ))
2279                 priv->site_survey_state = SITE_SURVEY_IDLE;
2280         priv->last_survey = jiffies;
2281
2282         /* Initiate a scan command */
2283         if (priv->site_survey_state == SITE_SURVEY_IN_PROGRESS)
2284                 return -EBUSY;
2285
2286         del_timer_sync(&priv->management_timer);
2287         spin_lock_irqsave(&priv->irqlock, flags);
2288
2289         priv->site_survey_state = SITE_SURVEY_IN_PROGRESS;
2290         priv->fast_scan = 0;
2291         atmel_scan(priv, 0);
2292         spin_unlock_irqrestore(&priv->irqlock, flags);
2293
2294         return 0;
2295 }
2296
2297 static int atmel_get_scan(struct net_device *dev,
2298                           struct iw_request_info *info,
2299                           struct iw_point *dwrq,
2300                           char *extra)
2301 {
2302         struct atmel_private *priv = netdev_priv(dev);
2303         int i;
2304         char *current_ev = extra;
2305         struct iw_event iwe;
2306
2307         if (priv->site_survey_state != SITE_SURVEY_COMPLETED)
2308                 return -EAGAIN;
2309
2310         for (i = 0; i < priv->BSS_list_entries; i++) {
2311                 iwe.cmd = SIOCGIWAP;
2312                 iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
2313                 memcpy(iwe.u.ap_addr.sa_data, priv->BSSinfo[i].BSSID, 6);
2314                 current_ev = iwe_stream_add_event(info, current_ev,
2315                                                   extra + IW_SCAN_MAX_DATA,
2316                                                   &iwe, IW_EV_ADDR_LEN);
2317
2318                 iwe.u.data.length =  priv->BSSinfo[i].SSIDsize;
2319                 if (iwe.u.data.length > 32)
2320                         iwe.u.data.length = 32;
2321                 iwe.cmd = SIOCGIWESSID;
2322                 iwe.u.data.flags = 1;
2323                 current_ev = iwe_stream_add_point(info, current_ev,
2324                                                   extra + IW_SCAN_MAX_DATA,
2325                                                   &iwe, priv->BSSinfo[i].SSID);
2326
2327                 iwe.cmd = SIOCGIWMODE;
2328                 iwe.u.mode = priv->BSSinfo[i].BSStype;
2329                 current_ev = iwe_stream_add_event(info, current_ev,
2330                                                   extra + IW_SCAN_MAX_DATA,
2331                                                   &iwe, IW_EV_UINT_LEN);
2332
2333                 iwe.cmd = SIOCGIWFREQ;
2334                 iwe.u.freq.m = priv->BSSinfo[i].channel;
2335                 iwe.u.freq.e = 0;
2336                 current_ev = iwe_stream_add_event(info, current_ev,
2337                                                   extra + IW_SCAN_MAX_DATA,
2338                                                   &iwe, IW_EV_FREQ_LEN);
2339
2340                 /* Add quality statistics */
2341                 iwe.cmd = IWEVQUAL;
2342                 iwe.u.qual.level = priv->BSSinfo[i].RSSI;
2343                 iwe.u.qual.qual  = iwe.u.qual.level;
2344                 /* iwe.u.qual.noise  = SOMETHING */
2345                 current_ev = iwe_stream_add_event(info, current_ev,
2346                                                   extra + IW_SCAN_MAX_DATA,
2347                                                   &iwe, IW_EV_QUAL_LEN);
2348
2349
2350                 iwe.cmd = SIOCGIWENCODE;
2351                 if (priv->BSSinfo[i].UsingWEP)
2352                         iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
2353                 else
2354                         iwe.u.data.flags = IW_ENCODE_DISABLED;
2355                 iwe.u.data.length = 0;
2356                 current_ev = iwe_stream_add_point(info, current_ev,
2357                                                   extra + IW_SCAN_MAX_DATA,
2358                                                   &iwe, NULL);
2359         }
2360
2361         /* Length of data */
2362         dwrq->length = (current_ev - extra);
2363         dwrq->flags = 0;
2364
2365         return 0;
2366 }
2367
2368 static int atmel_get_range(struct net_device *dev,
2369                            struct iw_request_info *info,
2370                            struct iw_point *dwrq,
2371                            char *extra)
2372 {
2373         struct atmel_private *priv = netdev_priv(dev);
2374         struct iw_range *range = (struct iw_range *) extra;
2375         int k, i, j;
2376
2377         dwrq->length = sizeof(struct iw_range);
2378         memset(range, 0, sizeof(struct iw_range));
2379         range->min_nwid = 0x0000;
2380         range->max_nwid = 0x0000;
2381         range->num_channels = 0;
2382         for (j = 0; j < ARRAY_SIZE(channel_table); j++)
2383                 if (priv->reg_domain == channel_table[j].reg_domain) {
2384                         range->num_channels = channel_table[j].max - channel_table[j].min + 1;
2385                         break;
2386                 }
2387         if (range->num_channels != 0) {
2388                 for (k = 0, i = channel_table[j].min; i <= channel_table[j].max; i++) {
2389                         range->freq[k].i = i; /* List index */
2390                         range->freq[k].m = frequency_list[i - 1] * 100000;
2391                         range->freq[k++].e = 1; /* Values in table in MHz -> * 10^5 * 10 */
2392                 }
2393                 range->num_frequency = k;
2394         }
2395
2396         range->max_qual.qual = 100;
2397         range->max_qual.level = 100;
2398         range->max_qual.noise = 0;
2399         range->max_qual.updated = IW_QUAL_NOISE_INVALID;
2400
2401         range->avg_qual.qual = 50;
2402         range->avg_qual.level = 50;
2403         range->avg_qual.noise = 0;
2404         range->avg_qual.updated = IW_QUAL_NOISE_INVALID;
2405
2406         range->sensitivity = 0;
2407
2408         range->bitrate[0] =  1000000;
2409         range->bitrate[1] =  2000000;
2410         range->bitrate[2] =  5500000;
2411         range->bitrate[3] = 11000000;
2412         range->num_bitrates = 4;
2413
2414         range->min_rts = 0;
2415         range->max_rts = 2347;
2416         range->min_frag = 256;
2417         range->max_frag = 2346;
2418
2419         range->encoding_size[0] = 5;
2420         range->encoding_size[1] = 13;
2421         range->num_encoding_sizes = 2;
2422         range->max_encoding_tokens = 4;
2423
2424         range->pmp_flags = IW_POWER_ON;
2425         range->pmt_flags = IW_POWER_ON;
2426         range->pm_capa = 0;
2427
2428         range->we_version_source = WIRELESS_EXT;
2429         range->we_version_compiled = WIRELESS_EXT;
2430         range->retry_capa = IW_RETRY_LIMIT ;
2431         range->retry_flags = IW_RETRY_LIMIT;
2432         range->r_time_flags = 0;
2433         range->min_retry = 1;
2434         range->max_retry = 65535;
2435
2436         return 0;
2437 }
2438
2439 static int atmel_set_wap(struct net_device *dev,
2440                          struct iw_request_info *info,
2441                          struct sockaddr *awrq,
2442                          char *extra)
2443 {
2444         struct atmel_private *priv = netdev_priv(dev);
2445         int i;
2446         static const u8 any[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
2447         static const u8 off[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
2448         unsigned long flags;
2449
2450         if (awrq->sa_family != ARPHRD_ETHER)
2451                 return -EINVAL;
2452
2453         if (!memcmp(any, awrq->sa_data, 6) ||
2454             !memcmp(off, awrq->sa_data, 6)) {
2455                 del_timer_sync(&priv->management_timer);
2456                 spin_lock_irqsave(&priv->irqlock, flags);
2457                 atmel_scan(priv, 1);
2458                 spin_unlock_irqrestore(&priv->irqlock, flags);
2459                 return 0;
2460         }
2461
2462         for (i = 0; i < priv->BSS_list_entries; i++) {
2463                 if (memcmp(priv->BSSinfo[i].BSSID, awrq->sa_data, 6) == 0) {
2464                         if (!priv->wep_is_on && priv->BSSinfo[i].UsingWEP) {
2465                                 return -EINVAL;
2466                         } else if  (priv->wep_is_on && !priv->BSSinfo[i].UsingWEP) {
2467                                 return -EINVAL;
2468                         } else {
2469                                 del_timer_sync(&priv->management_timer);
2470                                 spin_lock_irqsave(&priv->irqlock, flags);
2471                                 atmel_join_bss(priv, i);
2472                                 spin_unlock_irqrestore(&priv->irqlock, flags);
2473                                 return 0;
2474                         }
2475                 }
2476         }
2477
2478         return -EINVAL;
2479 }
2480
2481 static int atmel_config_commit(struct net_device *dev,
2482                                struct iw_request_info *info,    /* NULL */
2483                                void *zwrq,                      /* NULL */
2484                                char *extra)                     /* NULL */
2485 {
2486         return atmel_open(dev);
2487 }
2488
2489 static const iw_handler atmel_handler[] =
2490 {
2491         (iw_handler) atmel_config_commit,       /* SIOCSIWCOMMIT */
2492         (iw_handler) atmel_get_name,            /* SIOCGIWNAME */
2493         (iw_handler) NULL,                      /* SIOCSIWNWID */
2494         (iw_handler) NULL,                      /* SIOCGIWNWID */
2495         (iw_handler) atmel_set_freq,            /* SIOCSIWFREQ */
2496         (iw_handler) atmel_get_freq,            /* SIOCGIWFREQ */
2497         (iw_handler) atmel_set_mode,            /* SIOCSIWMODE */
2498         (iw_handler) atmel_get_mode,            /* SIOCGIWMODE */
2499         (iw_handler) NULL,                      /* SIOCSIWSENS */
2500         (iw_handler) NULL,                      /* SIOCGIWSENS */
2501         (iw_handler) NULL,                      /* SIOCSIWRANGE */
2502         (iw_handler) atmel_get_range,           /* SIOCGIWRANGE */
2503         (iw_handler) NULL,                      /* SIOCSIWPRIV */
2504         (iw_handler) NULL,                      /* SIOCGIWPRIV */
2505         (iw_handler) NULL,                      /* SIOCSIWSTATS */
2506         (iw_handler) NULL,                      /* SIOCGIWSTATS */
2507         (iw_handler) NULL,                      /* SIOCSIWSPY */
2508         (iw_handler) NULL,                      /* SIOCGIWSPY */
2509         (iw_handler) NULL,                      /* -- hole -- */
2510         (iw_handler) NULL,                      /* -- hole -- */
2511         (iw_handler) atmel_set_wap,             /* SIOCSIWAP */
2512         (iw_handler) atmel_get_wap,             /* SIOCGIWAP */
2513         (iw_handler) NULL,                      /* -- hole -- */
2514         (iw_handler) NULL,                      /* SIOCGIWAPLIST */
2515         (iw_handler) atmel_set_scan,            /* SIOCSIWSCAN */
2516         (iw_handler) atmel_get_scan,            /* SIOCGIWSCAN */
2517         (iw_handler) atmel_set_essid,           /* SIOCSIWESSID */
2518         (iw_handler) atmel_get_essid,           /* SIOCGIWESSID */
2519         (iw_handler) NULL,                      /* SIOCSIWNICKN */
2520         (iw_handler) NULL,                      /* SIOCGIWNICKN */
2521         (iw_handler) NULL,                      /* -- hole -- */
2522         (iw_handler) NULL,                      /* -- hole -- */
2523         (iw_handler) atmel_set_rate,            /* SIOCSIWRATE */
2524         (iw_handler) atmel_get_rate,            /* SIOCGIWRATE */
2525         (iw_handler) atmel_set_rts,             /* SIOCSIWRTS */
2526         (iw_handler) atmel_get_rts,             /* SIOCGIWRTS */
2527         (iw_handler) atmel_set_frag,            /* SIOCSIWFRAG */
2528         (iw_handler) atmel_get_frag,            /* SIOCGIWFRAG */
2529         (iw_handler) NULL,                      /* SIOCSIWTXPOW */
2530         (iw_handler) NULL,                      /* SIOCGIWTXPOW */
2531         (iw_handler) atmel_set_retry,           /* SIOCSIWRETRY */
2532         (iw_handler) atmel_get_retry,           /* SIOCGIWRETRY */
2533         (iw_handler) atmel_set_encode,          /* SIOCSIWENCODE */
2534         (iw_handler) atmel_get_encode,          /* SIOCGIWENCODE */
2535         (iw_handler) atmel_set_power,           /* SIOCSIWPOWER */
2536         (iw_handler) atmel_get_power,           /* SIOCGIWPOWER */
2537         (iw_handler) NULL,                      /* -- hole -- */
2538         (iw_handler) NULL,                      /* -- hole -- */
2539         (iw_handler) NULL,                      /* SIOCSIWGENIE */
2540         (iw_handler) NULL,                      /* SIOCGIWGENIE */
2541         (iw_handler) atmel_set_auth,            /* SIOCSIWAUTH */
2542         (iw_handler) atmel_get_auth,            /* SIOCGIWAUTH */
2543         (iw_handler) atmel_set_encodeext,       /* SIOCSIWENCODEEXT */
2544         (iw_handler) atmel_get_encodeext,       /* SIOCGIWENCODEEXT */
2545         (iw_handler) NULL,                      /* SIOCSIWPMKSA */
2546 };
2547
2548 static const iw_handler atmel_private_handler[] =
2549 {
2550         NULL,                           /* SIOCIWFIRSTPRIV */
2551 };
2552
2553 typedef struct atmel_priv_ioctl {
2554         char id[32];
2555         unsigned char __user *data;
2556         unsigned short len;
2557 } atmel_priv_ioctl;
2558
2559 #define ATMELFWL        SIOCIWFIRSTPRIV
2560 #define ATMELIDIFC      ATMELFWL + 1
2561 #define ATMELRD         ATMELFWL + 2
2562 #define ATMELMAGIC 0x51807
2563 #define REGDOMAINSZ 20
2564
2565 static const struct iw_priv_args atmel_private_args[] = {
2566         {
2567                 .cmd = ATMELFWL,
2568                 .set_args = IW_PRIV_TYPE_BYTE
2569                                 | IW_PRIV_SIZE_FIXED
2570                                 | sizeof (atmel_priv_ioctl),
2571                 .get_args = IW_PRIV_TYPE_NONE,
2572                 .name = "atmelfwl"
2573         }, {
2574                 .cmd = ATMELIDIFC,
2575                 .set_args = IW_PRIV_TYPE_NONE,
2576                 .get_args = IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
2577                 .name = "atmelidifc"
2578         }, {
2579                 .cmd = ATMELRD,
2580                 .set_args = IW_PRIV_TYPE_CHAR | REGDOMAINSZ,
2581                 .get_args = IW_PRIV_TYPE_NONE,
2582                 .name = "regdomain"
2583         },
2584 };
2585
2586 static const struct iw_handler_def atmel_handler_def =
2587 {
2588         .num_standard   = ARRAY_SIZE(atmel_handler),
2589         .num_private    = ARRAY_SIZE(atmel_private_handler),
2590         .num_private_args = ARRAY_SIZE(atmel_private_args),
2591         .standard       = (iw_handler *) atmel_handler,
2592         .private        = (iw_handler *) atmel_private_handler,
2593         .private_args   = (struct iw_priv_args *) atmel_private_args,
2594         .get_wireless_stats = atmel_get_wireless_stats
2595 };
2596
2597 static int atmel_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
2598 {
2599         int i, rc = 0;
2600         struct atmel_private *priv = netdev_priv(dev);
2601         atmel_priv_ioctl com;
2602         struct iwreq *wrq = (struct iwreq *) rq;
2603         unsigned char *new_firmware;
2604         char domain[REGDOMAINSZ + 1];
2605
2606         switch (cmd) {
2607         case ATMELIDIFC:
2608                 wrq->u.param.value = ATMELMAGIC;
2609                 break;
2610
2611         case ATMELFWL:
2612                 if (copy_from_user(&com, rq->ifr_data, sizeof(com))) {
2613                         rc = -EFAULT;
2614                         break;
2615                 }
2616
2617                 if (!capable(CAP_NET_ADMIN)) {
2618                         rc = -EPERM;
2619                         break;
2620                 }
2621
2622                 if (!(new_firmware = kmalloc(com.len, GFP_KERNEL))) {
2623                         rc = -ENOMEM;
2624                         break;
2625                 }
2626
2627                 if (copy_from_user(new_firmware, com.data, com.len)) {
2628                         kfree(new_firmware);
2629                         rc = -EFAULT;
2630                         break;
2631                 }
2632
2633                 kfree(priv->firmware);
2634
2635                 priv->firmware = new_firmware;
2636                 priv->firmware_length = com.len;
2637                 strncpy(priv->firmware_id, com.id, 31);
2638                 priv->firmware_id[31] = '\0';
2639                 break;
2640
2641         case ATMELRD:
2642                 if (copy_from_user(domain, rq->ifr_data, REGDOMAINSZ)) {
2643                         rc = -EFAULT;
2644                         break;
2645                 }
2646
2647                 if (!capable(CAP_NET_ADMIN)) {
2648                         rc = -EPERM;
2649                         break;
2650                 }
2651
2652                 domain[REGDOMAINSZ] = 0;
2653                 rc = -EINVAL;
2654                 for (i = 0; i < ARRAY_SIZE(channel_table); i++) {
2655                         /* strcasecmp doesn't exist in the library */
2656                         char *a = channel_table[i].name;
2657                         char *b = domain;
2658                         while (*a) {
2659                                 char c1 = *a++;
2660                                 char c2 = *b++;
2661                                 if (tolower(c1) != tolower(c2))
2662                                         break;
2663                         }
2664                         if (!*a && !*b) {
2665                                 priv->config_reg_domain = channel_table[i].reg_domain;
2666                                 rc = 0;
2667                         }
2668                 }
2669
2670                 if (rc == 0 &&  priv->station_state != STATION_STATE_DOWN)
2671                         rc = atmel_open(dev);
2672                 break;
2673
2674         default:
2675                 rc = -EOPNOTSUPP;
2676         }
2677
2678         return rc;
2679 }
2680
2681 struct auth_body {
2682         __le16 alg;
2683         __le16 trans_seq;
2684         __le16 status;
2685         u8 el_id;
2686         u8 chall_text_len;
2687         u8 chall_text[253];
2688 };
2689
2690 static void atmel_enter_state(struct atmel_private *priv, int new_state)
2691 {
2692         int old_state = priv->station_state;
2693
2694         if (new_state == old_state)
2695                 return;
2696
2697         priv->station_state = new_state;
2698
2699         if (new_state == STATION_STATE_READY) {
2700                 netif_start_queue(priv->dev);
2701                 netif_carrier_on(priv->dev);
2702         }
2703
2704         if (old_state == STATION_STATE_READY) {
2705                 netif_carrier_off(priv->dev);
2706                 if (netif_running(priv->dev))
2707                         netif_stop_queue(priv->dev);
2708                 priv->last_beacon_timestamp = 0;
2709         }
2710 }
2711
2712 static void atmel_scan(struct atmel_private *priv, int specific_ssid)
2713 {
2714         struct {
2715                 u8 BSSID[6];
2716                 u8 SSID[MAX_SSID_LENGTH];
2717                 u8 scan_type;
2718                 u8 channel;
2719                 __le16 BSS_type;
2720                 __le16 min_channel_time;
2721                 __le16 max_channel_time;
2722                 u8 options;
2723                 u8 SSID_size;
2724         } cmd;
2725
2726         memset(cmd.BSSID, 0xff, 6);
2727
2728         if (priv->fast_scan) {
2729                 cmd.SSID_size = priv->SSID_size;
2730                 memcpy(cmd.SSID, priv->SSID, priv->SSID_size);
2731                 cmd.min_channel_time = cpu_to_le16(10);
2732                 cmd.max_channel_time = cpu_to_le16(50);
2733         } else {
2734                 priv->BSS_list_entries = 0;
2735                 cmd.SSID_size = 0;
2736                 cmd.min_channel_time = cpu_to_le16(10);
2737                 cmd.max_channel_time = cpu_to_le16(120);
2738         }
2739
2740         cmd.options = 0;
2741
2742         if (!specific_ssid)
2743                 cmd.options |= SCAN_OPTIONS_SITE_SURVEY;
2744
2745         cmd.channel = (priv->channel & 0x7f);
2746         cmd.scan_type = SCAN_TYPE_ACTIVE;
2747         cmd.BSS_type = cpu_to_le16(priv->operating_mode == IW_MODE_ADHOC ?
2748                 BSS_TYPE_AD_HOC : BSS_TYPE_INFRASTRUCTURE);
2749
2750         atmel_send_command(priv, CMD_Scan, &cmd, sizeof(cmd));
2751
2752         /* This must come after all hardware access to avoid being messed up
2753            by stuff happening in interrupt context after we leave STATE_DOWN */
2754         atmel_enter_state(priv, STATION_STATE_SCANNING);
2755 }
2756
2757 static void join(struct atmel_private *priv, int type)
2758 {
2759         struct {
2760                 u8 BSSID[6];
2761                 u8 SSID[MAX_SSID_LENGTH];
2762                 u8 BSS_type; /* this is a short in a scan command - weird */
2763                 u8 channel;
2764                 __le16 timeout;
2765                 u8 SSID_size;
2766                 u8 reserved;
2767         } cmd;
2768
2769         cmd.SSID_size = priv->SSID_size;
2770         memcpy(cmd.SSID, priv->SSID, priv->SSID_size);
2771         memcpy(cmd.BSSID, priv->CurrentBSSID, 6);
2772         cmd.channel = (priv->channel & 0x7f);
2773         cmd.BSS_type = type;
2774         cmd.timeout = cpu_to_le16(2000);
2775
2776         atmel_send_command(priv, CMD_Join, &cmd, sizeof(cmd));
2777 }
2778
2779 static void start(struct atmel_private *priv, int type)
2780 {
2781         struct {
2782                 u8 BSSID[6];
2783                 u8 SSID[MAX_SSID_LENGTH];
2784                 u8 BSS_type;
2785                 u8 channel;
2786                 u8 SSID_size;
2787                 u8 reserved[3];
2788         } cmd;
2789
2790         cmd.SSID_size = priv->SSID_size;
2791         memcpy(cmd.SSID, priv->SSID, priv->SSID_size);
2792         memcpy(cmd.BSSID, priv->BSSID, 6);
2793         cmd.BSS_type = type;
2794         cmd.channel = (priv->channel & 0x7f);
2795
2796         atmel_send_command(priv, CMD_Start, &cmd, sizeof(cmd));
2797 }
2798
2799 static void handle_beacon_probe(struct atmel_private *priv, u16 capability,
2800                                 u8 channel)
2801 {
2802         int rejoin = 0;
2803         int new = capability & MFIE_TYPE_POWER_CONSTRAINT ?
2804                 SHORT_PREAMBLE : LONG_PREAMBLE;
2805
2806         if (priv->preamble != new) {
2807                 priv->preamble = new;
2808                 rejoin = 1;
2809                 atmel_set_mib8(priv, Local_Mib_Type, LOCAL_MIB_PREAMBLE_TYPE, new);
2810         }
2811
2812         if (priv->channel != channel) {
2813                 priv->channel = channel;
2814                 rejoin = 1;
2815                 atmel_set_mib8(priv, Phy_Mib_Type, PHY_MIB_CHANNEL_POS, channel);
2816         }
2817
2818         if (rejoin) {
2819                 priv->station_is_associated = 0;
2820                 atmel_enter_state(priv, STATION_STATE_JOINNING);
2821
2822                 if (priv->operating_mode == IW_MODE_INFRA)
2823                         join(priv, BSS_TYPE_INFRASTRUCTURE);
2824                 else
2825                         join(priv, BSS_TYPE_AD_HOC);
2826         }
2827 }
2828
2829 static void send_authentication_request(struct atmel_private *priv, u16 system,
2830                                         u8 *challenge, int challenge_len)
2831 {
2832         struct ieee80211_hdr_4addr header;
2833         struct auth_body auth;
2834
2835         header.frame_ctl = cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_AUTH);
2836         header.duration_id = cpu_to_le16(0x8000);
2837         header.seq_ctl = 0;
2838         memcpy(header.addr1, priv->CurrentBSSID, 6);
2839         memcpy(header.addr2, priv->dev->dev_addr, 6);
2840         memcpy(header.addr3, priv->CurrentBSSID, 6);
2841
2842         if (priv->wep_is_on && priv->CurrentAuthentTransactionSeqNum != 1)
2843                 /* no WEP for authentication frames with TrSeqNo 1 */
2844                 header.frame_ctl |=  cpu_to_le16(IEEE80211_FCTL_PROTECTED);
2845
2846         auth.alg = cpu_to_le16(system);
2847
2848         auth.status = 0;
2849         auth.trans_seq = cpu_to_le16(priv->CurrentAuthentTransactionSeqNum);
2850         priv->ExpectedAuthentTransactionSeqNum = priv->CurrentAuthentTransactionSeqNum+1;
2851         priv->CurrentAuthentTransactionSeqNum += 2;
2852
2853         if (challenge_len != 0) {
2854                 auth.el_id = 16; /* challenge_text */
2855                 auth.chall_text_len = challenge_len;
2856                 memcpy(auth.chall_text, challenge, challenge_len);
2857                 atmel_transmit_management_frame(priv, &header, (u8 *)&auth, 8 + challenge_len);
2858         } else {
2859                 atmel_transmit_management_frame(priv, &header, (u8 *)&auth, 6);
2860         }
2861 }
2862
2863 static void send_association_request(struct atmel_private *priv, int is_reassoc)
2864 {
2865         u8 *ssid_el_p;
2866         int bodysize;
2867         struct ieee80211_hdr_4addr header;
2868         struct ass_req_format {
2869                 __le16 capability;
2870                 __le16 listen_interval;
2871                 u8 ap[6]; /* nothing after here directly accessible */
2872                 u8 ssid_el_id;
2873                 u8 ssid_len;
2874                 u8 ssid[MAX_SSID_LENGTH];
2875                 u8 sup_rates_el_id;
2876                 u8 sup_rates_len;
2877                 u8 rates[4];
2878         } body;
2879
2880         header.frame_ctl = cpu_to_le16(IEEE80211_FTYPE_MGMT |
2881                 (is_reassoc ? IEEE80211_STYPE_REASSOC_REQ : IEEE80211_STYPE_ASSOC_REQ));
2882         header.duration_id = cpu_to_le16(0x8000);
2883         header.seq_ctl = 0;
2884
2885         memcpy(header.addr1, priv->CurrentBSSID, 6);
2886         memcpy(header.addr2, priv->dev->dev_addr, 6);
2887         memcpy(header.addr3, priv->CurrentBSSID, 6);
2888
2889         body.capability = cpu_to_le16(WLAN_CAPABILITY_ESS);
2890         if (priv->wep_is_on)
2891                 body.capability |= cpu_to_le16(WLAN_CAPABILITY_PRIVACY);
2892         if (priv->preamble == SHORT_PREAMBLE)
2893                 body.capability |= cpu_to_le16(MFIE_TYPE_POWER_CONSTRAINT);
2894
2895         body.listen_interval = cpu_to_le16(priv->listen_interval * priv->beacon_period);
2896
2897         /* current AP address - only in reassoc frame */
2898         if (is_reassoc) {
2899                 memcpy(body.ap, priv->CurrentBSSID, 6);
2900                 ssid_el_p = (u8 *)&body.ssid_el_id;
2901                 bodysize = 18 + priv->SSID_size;
2902         } else {
2903                 ssid_el_p = (u8 *)&body.ap[0];
2904                 bodysize = 12 + priv->SSID_size;
2905         }
2906
2907         ssid_el_p[0] = MFIE_TYPE_SSID;
2908         ssid_el_p[1] = priv->SSID_size;
2909         memcpy(ssid_el_p + 2, priv->SSID, priv->SSID_size);
2910         ssid_el_p[2 + priv->SSID_size] = MFIE_TYPE_RATES;
2911         ssid_el_p[3 + priv->SSID_size] = 4; /* len of suported rates */
2912         memcpy(ssid_el_p + 4 + priv->SSID_size, atmel_basic_rates, 4);
2913
2914         atmel_transmit_management_frame(priv, &header, (void *)&body, bodysize);
2915 }
2916
2917 static int is_frame_from_current_bss(struct atmel_private *priv,
2918                                      struct ieee80211_hdr_4addr *header)
2919 {
2920         if (le16_to_cpu(header->frame_ctl) & IEEE80211_FCTL_FROMDS)
2921                 return memcmp(header->addr3, priv->CurrentBSSID, 6) == 0;
2922         else
2923                 return memcmp(header->addr2, priv->CurrentBSSID, 6) == 0;
2924 }
2925
2926 static int retrieve_bss(struct atmel_private *priv)
2927 {
2928         int i;
2929         int max_rssi = -128;
2930         int max_index = -1;
2931
2932         if (priv->BSS_list_entries == 0)
2933                 return -1;
2934
2935         if (priv->connect_to_any_BSS) {
2936                 /* Select a BSS with the max-RSSI but of the same type and of
2937                    the same WEP mode and that it is not marked as 'bad' (i.e.
2938                    we had previously failed to connect to this BSS with the
2939                    settings that we currently use) */
2940                 priv->current_BSS = 0;
2941                 for (i = 0; i < priv->BSS_list_entries; i++) {
2942                         if (priv->operating_mode == priv->BSSinfo[i].BSStype &&
2943                             ((!priv->wep_is_on && !priv->BSSinfo[i].UsingWEP) ||
2944                              (priv->wep_is_on && priv->BSSinfo[i].UsingWEP)) &&
2945                             !(priv->BSSinfo[i].channel & 0x80)) {
2946                                 max_rssi = priv->BSSinfo[i].RSSI;
2947                                 priv->current_BSS = max_index = i;
2948                         }
2949                 }
2950                 return max_index;
2951         }
2952
2953         for (i = 0; i < priv->BSS_list_entries; i++) {
2954                 if (priv->SSID_size == priv->BSSinfo[i].SSIDsize &&
2955                     memcmp(priv->SSID, priv->BSSinfo[i].SSID, priv->SSID_size) == 0 &&
2956                     priv->operating_mode == priv->BSSinfo[i].BSStype &&
2957                     atmel_validate_channel(priv, priv->BSSinfo[i].channel) == 0) {
2958                         if (priv->BSSinfo[i].RSSI >= max_rssi) {
2959                                 max_rssi = priv->BSSinfo[i].RSSI;
2960                                 max_index = i;
2961                         }
2962                 }
2963         }
2964         return max_index;
2965 }
2966
2967 static void store_bss_info(struct atmel_private *priv,
2968                            struct ieee80211_hdr_4addr *header, u16 capability,
2969                            u16 beacon_period, u8 channel, u8 rssi, u8 ssid_len,
2970                            u8 *ssid, int is_beacon)
2971 {
2972         u8 *bss = capability & WLAN_CAPABILITY_ESS ? header->addr2 : header->addr3;
2973         int i, index;
2974
2975         for (index = -1, i = 0; i < priv->BSS_list_entries; i++)
2976                 if (memcmp(bss, priv->BSSinfo[i].BSSID, 6) == 0)
2977                         index = i;
2978
2979         /* If we process a probe and an entry from this BSS exists
2980            we will update the BSS entry with the info from this BSS.
2981            If we process a beacon we will only update RSSI */
2982
2983         if (index == -1) {
2984                 if (priv->BSS_list_entries == MAX_BSS_ENTRIES)
2985                         return;
2986                 index = priv->BSS_list_entries++;
2987                 memcpy(priv->BSSinfo[index].BSSID, bss, 6);
2988                 priv->BSSinfo[index].RSSI = rssi;
2989         } else {
2990                 if (rssi > priv->BSSinfo[index].RSSI)
2991                         priv->BSSinfo[index].RSSI = rssi;
2992                 if (is_beacon)
2993                         return;
2994         }
2995
2996         priv->BSSinfo[index].channel = channel;
2997         priv->BSSinfo[index].beacon_period = beacon_period;
2998         priv->BSSinfo[index].UsingWEP = capability & WLAN_CAPABILITY_PRIVACY;
2999         memcpy(priv->BSSinfo[index].SSID, ssid, ssid_len);
3000         priv->BSSinfo[index].SSIDsize = ssid_len;
3001
3002         if (capability & WLAN_CAPABILITY_IBSS)
3003                 priv->BSSinfo[index].BSStype = IW_MODE_ADHOC;
3004         else if (capability & WLAN_CAPABILITY_ESS)
3005                 priv->BSSinfo[index].BSStype =IW_MODE_INFRA;
3006
3007         priv->BSSinfo[index].preamble = capability & MFIE_TYPE_POWER_CONSTRAINT ?
3008                 SHORT_PREAMBLE : LONG_PREAMBLE;
3009 }
3010
3011 static void authenticate(struct atmel_private *priv, u16 frame_len)
3012 {
3013         struct auth_body *auth = (struct auth_body *)priv->rx_buf;
3014         u16 status = le16_to_cpu(auth->status);
3015         u16 trans_seq_no = le16_to_cpu(auth->trans_seq);
3016         u16 system = le16_to_cpu(auth->alg);
3017
3018         if (status == WLAN_STATUS_SUCCESS && !priv->wep_is_on) {
3019                 /* no WEP */
3020                 if (priv->station_was_associated) {
3021                         atmel_enter_state(priv, STATION_STATE_REASSOCIATING);
3022                         send_association_request(priv, 1);
3023                         return;
3024                 } else {
3025                         atmel_enter_state(priv, STATION_STATE_ASSOCIATING);
3026                         send_association_request(priv, 0);
3027                         return;
3028                 }
3029         }
3030
3031         if (status == WLAN_STATUS_SUCCESS && priv->wep_is_on) {
3032                 int should_associate = 0;
3033                 /* WEP */
3034                 if (trans_seq_no != priv->ExpectedAuthentTransactionSeqNum)
3035                         return;
3036
3037                 if (system == WLAN_AUTH_OPEN) {
3038                         if (trans_seq_no == 0x0002) {
3039                                 should_associate = 1;
3040                         }
3041                 } else if (system == WLAN_AUTH_SHARED_KEY) {
3042                         if (trans_seq_no == 0x0002 &&
3043                             auth->el_id == MFIE_TYPE_CHALLENGE) {
3044                                 send_authentication_request(priv, system, auth->chall_text, auth->chall_text_len);
3045                                 return;
3046                         } else if (trans_seq_no == 0x0004) {
3047                                 should_associate = 1;
3048                         }
3049                 }
3050
3051                 if (should_associate) {
3052                         if(priv->station_was_associated) {
3053                                 atmel_enter_state(priv, STATION_STATE_REASSOCIATING);
3054                                 send_association_request(priv, 1);
3055                                 return;
3056                         } else {
3057                                 atmel_enter_state(priv, STATION_STATE_ASSOCIATING);
3058                                 send_association_request(priv, 0);
3059                                 return;
3060                         }
3061                 }
3062         }
3063
3064         if (status == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) {
3065                 /* Flip back and forth between WEP auth modes until the max
3066                  * authentication tries has been exceeded.
3067                  */
3068                 if (system == WLAN_AUTH_OPEN) {
3069                         priv->CurrentAuthentTransactionSeqNum = 0x001;
3070                         priv->exclude_unencrypted = 1;
3071                         send_authentication_request(priv, WLAN_AUTH_SHARED_KEY, NULL, 0);
3072                         return;
3073                 } else if (   system == WLAN_AUTH_SHARED_KEY
3074                            && priv->wep_is_on) {
3075                         priv->CurrentAuthentTransactionSeqNum = 0x001;
3076                         priv->exclude_unencrypted = 0;
3077                         send_authentication_request(priv, WLAN_AUTH_OPEN, NULL, 0);
3078                         return;
3079                 } else if (priv->connect_to_any_BSS) {
3080                         int bss_index;
3081
3082                         priv->BSSinfo[(int)(priv->current_BSS)].channel |= 0x80;
3083
3084                         if ((bss_index  = retrieve_bss(priv)) != -1) {
3085                                 atmel_join_bss(priv, bss_index);
3086                                 return;
3087                         }
3088                 }
3089         }
3090
3091         priv->AuthenticationRequestRetryCnt = 0;
3092         atmel_enter_state(priv,  STATION_STATE_MGMT_ERROR);
3093         priv->station_is_associated = 0;
3094 }
3095
3096 static void associate(struct atmel_private *priv, u16 frame_len, u16 subtype)
3097 {
3098         struct ass_resp_format {
3099                 __le16 capability;
3100                 __le16 status;
3101                 __le16 ass_id;
3102                 u8 el_id;
3103                 u8 length;
3104                 u8 rates[4];
3105         } *ass_resp = (struct ass_resp_format *)priv->rx_buf;
3106
3107         u16 status = le16_to_cpu(ass_resp->status);
3108         u16 ass_id = le16_to_cpu(ass_resp->ass_id);
3109         u16 rates_len = ass_resp->length > 4 ? 4 : ass_resp->length;
3110
3111         union iwreq_data wrqu;
3112
3113         if (frame_len < 8 + rates_len)
3114                 return;
3115
3116         if (status == WLAN_STATUS_SUCCESS) {
3117                 if (subtype == IEEE80211_STYPE_ASSOC_RESP)
3118                         priv->AssociationRequestRetryCnt = 0;
3119                 else
3120                         priv->ReAssociationRequestRetryCnt = 0;
3121
3122                 atmel_set_mib16(priv, Mac_Mgmt_Mib_Type,
3123                                 MAC_MGMT_MIB_STATION_ID_POS, ass_id & 0x3fff);
3124                 atmel_set_mib(priv, Phy_Mib_Type,
3125                               PHY_MIB_RATE_SET_POS, ass_resp->rates, rates_len);
3126                 if (priv->power_mode == 0) {
3127                         priv->listen_interval = 1;
3128                         atmel_set_mib8(priv, Mac_Mgmt_Mib_Type,
3129                                        MAC_MGMT_MIB_PS_MODE_POS, ACTIVE_MODE);
3130                         atmel_set_mib16(priv, Mac_Mgmt_Mib_Type,
3131                                         MAC_MGMT_MIB_LISTEN_INTERVAL_POS, 1);
3132                 } else {
3133                         priv->listen_interval = 2;
3134                         atmel_set_mib8(priv, Mac_Mgmt_Mib_Type,
3135                                        MAC_MGMT_MIB_PS_MODE_POS,  PS_MODE);
3136                         atmel_set_mib16(priv, Mac_Mgmt_Mib_Type,
3137                                         MAC_MGMT_MIB_LISTEN_INTERVAL_POS, 2);
3138                 }
3139
3140                 priv->station_is_associated = 1;
3141                 priv->station_was_associated = 1;
3142                 atmel_enter_state(priv, STATION_STATE_READY);
3143
3144                 /* Send association event to userspace */
3145                 wrqu.data.length = 0;
3146                 wrqu.data.flags = 0;
3147                 memcpy(wrqu.ap_addr.sa_data, priv->CurrentBSSID, ETH_ALEN);
3148                 wrqu.ap_addr.sa_family = ARPHRD_ETHER;
3149                 wireless_send_event(priv->dev, SIOCGIWAP, &wrqu, NULL);
3150
3151                 return;
3152         }
3153
3154         if (subtype == IEEE80211_STYPE_ASSOC_RESP &&
3155             status != WLAN_STATUS_ASSOC_DENIED_RATES &&
3156             status != WLAN_STATUS_CAPS_UNSUPPORTED &&
3157             priv->AssociationRequestRetryCnt < MAX_ASSOCIATION_RETRIES) {
3158                 mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
3159                 priv->AssociationRequestRetryCnt++;
3160                 send_association_request(priv, 0);
3161                 return;
3162         }
3163
3164         if (subtype == IEEE80211_STYPE_REASSOC_RESP &&
3165             status != WLAN_STATUS_ASSOC_DENIED_RATES &&
3166             status != WLAN_STATUS_CAPS_UNSUPPORTED &&
3167             priv->AssociationRequestRetryCnt < MAX_ASSOCIATION_RETRIES) {
3168                 mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
3169                 priv->ReAssociationRequestRetryCnt++;
3170                 send_association_request(priv, 1);
3171                 return;
3172         }
3173
3174         atmel_enter_state(priv,  STATION_STATE_MGMT_ERROR);
3175         priv->station_is_associated = 0;
3176
3177         if (priv->connect_to_any_BSS) {
3178                 int bss_index;
3179                 priv->BSSinfo[(int)(priv->current_BSS)].channel |= 0x80;
3180
3181                 if ((bss_index = retrieve_bss(priv)) != -1)
3182                         atmel_join_bss(priv, bss_index);
3183         }
3184 }
3185
3186 void atmel_join_bss(struct atmel_private *priv, int bss_index)
3187 {
3188         struct bss_info *bss =  &priv->BSSinfo[bss_index];
3189
3190         memcpy(priv->CurrentBSSID, bss->BSSID, 6);
3191         memcpy(priv->SSID, bss->SSID, priv->SSID_size = bss->SSIDsize);
3192
3193         /* The WPA stuff cares about the current AP address */
3194         if (priv->use_wpa)
3195                 build_wpa_mib(priv);
3196
3197         /* When switching to AdHoc turn OFF Power Save if needed */
3198
3199         if (bss->BSStype == IW_MODE_ADHOC &&
3200             priv->operating_mode != IW_MODE_ADHOC &&
3201             priv->power_mode) {
3202                 priv->power_mode = 0;
3203                 priv->listen_interval = 1;
3204                 atmel_set_mib8(priv, Mac_Mgmt_Mib_Type,
3205                                MAC_MGMT_MIB_PS_MODE_POS,  ACTIVE_MODE);
3206                 atmel_set_mib16(priv, Mac_Mgmt_Mib_Type,
3207                                 MAC_MGMT_MIB_LISTEN_INTERVAL_POS, 1);
3208         }
3209
3210         priv->operating_mode = bss->BSStype;
3211         priv->channel = bss->channel & 0x7f;
3212         priv->beacon_period = bss->beacon_period;
3213
3214         if (priv->preamble != bss->preamble) {
3215                 priv->preamble = bss->preamble;
3216                 atmel_set_mib8(priv, Local_Mib_Type,
3217                                LOCAL_MIB_PREAMBLE_TYPE, bss->preamble);
3218         }
3219
3220         if (!priv->wep_is_on && bss->UsingWEP) {
3221                 atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
3222                 priv->station_is_associated = 0;
3223                 return;
3224         }
3225
3226         if (priv->wep_is_on && !bss->UsingWEP) {
3227                 atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
3228                 priv->station_is_associated = 0;
3229                 return;
3230         }
3231
3232         atmel_enter_state(priv, STATION_STATE_JOINNING);
3233
3234         if (priv->operating_mode == IW_MODE_INFRA)
3235                 join(priv, BSS_TYPE_INFRASTRUCTURE);
3236         else
3237                 join(priv, BSS_TYPE_AD_HOC);
3238 }
3239
3240 static void restart_search(struct atmel_private *priv)
3241 {
3242         int bss_index;
3243
3244         if (!priv->connect_to_any_BSS) {
3245                 atmel_scan(priv, 1);
3246         } else {
3247                 priv->BSSinfo[(int)(priv->current_BSS)].channel |= 0x80;
3248
3249                 if ((bss_index = retrieve_bss(priv)) != -1)
3250                         atmel_join_bss(priv, bss_index);
3251                 else
3252                         atmel_scan(priv, 0);
3253         }
3254 }
3255
3256 static void smooth_rssi(struct atmel_private *priv, u8 rssi)
3257 {
3258         u8 old = priv->wstats.qual.level;
3259         u8 max_rssi = 42; /* 502-rmfd-revd max by experiment, default for now */
3260
3261         switch (priv->firmware_type) {
3262                 case ATMEL_FW_TYPE_502E:
3263                         max_rssi = 63; /* 502-rmfd-reve max by experiment */
3264                         break;
3265                 default:
3266                         break;
3267         }
3268
3269         rssi = rssi * 100 / max_rssi;
3270         if ((rssi + old) % 2)
3271                 priv->wstats.qual.level = (rssi + old) / 2 + 1;
3272         else
3273                 priv->wstats.qual.level = (rssi + old) / 2;
3274         priv->wstats.qual.updated |= IW_QUAL_LEVEL_UPDATED;
3275         priv->wstats.qual.updated &= ~IW_QUAL_LEVEL_INVALID;
3276 }
3277
3278 static void atmel_smooth_qual(struct atmel_private *priv)
3279 {
3280         unsigned long time_diff = (jiffies - priv->last_qual) / HZ;
3281         while (time_diff--) {
3282                 priv->last_qual += HZ;
3283                 priv->wstats.qual.qual = priv->wstats.qual.qual / 2;
3284                 priv->wstats.qual.qual +=
3285                         priv->beacons_this_sec * priv->beacon_period * (priv->wstats.qual.level + 100) / 4000;
3286                 priv->beacons_this_sec = 0;
3287         }
3288         priv->wstats.qual.updated |= IW_QUAL_QUAL_UPDATED;
3289         priv->wstats.qual.updated &= ~IW_QUAL_QUAL_INVALID;
3290 }
3291
3292 /* deals with incoming managment frames. */
3293 static void atmel_management_frame(struct atmel_private *priv,
3294                                    struct ieee80211_hdr_4addr *header,
3295                                    u16 frame_len, u8 rssi)
3296 {
3297         u16 subtype;
3298
3299         subtype = le16_to_cpu(header->frame_ctl) & IEEE80211_FCTL_STYPE;
3300         switch (subtype) {
3301         case IEEE80211_STYPE_BEACON:
3302         case IEEE80211_STYPE_PROBE_RESP:
3303
3304                 /* beacon frame has multiple variable-length fields -
3305                    never let an engineer loose with a data structure design. */
3306                 {
3307                         struct beacon_format {
3308                                 __le64 timestamp;
3309                                 __le16 interval;
3310                                 __le16 capability;
3311                                 u8 ssid_el_id;
3312                                 u8 ssid_length;
3313                                 /* ssid here */
3314                                 u8 rates_el_id;
3315                                 u8 rates_length;
3316                                 /* rates here */
3317                                 u8 ds_el_id;
3318                                 u8 ds_length;
3319                                 /* ds here */
3320                         } *beacon = (struct beacon_format *)priv->rx_buf;
3321
3322                         u8 channel, rates_length, ssid_length;
3323                         u64 timestamp = le64_to_cpu(beacon->timestamp);
3324                         u16 beacon_interval = le16_to_cpu(beacon->interval);
3325                         u16 capability = le16_to_cpu(beacon->capability);
3326                         u8 *beaconp = priv->rx_buf;
3327                         ssid_length = beacon->ssid_length;
3328                         /* this blows chunks. */
3329                         if (frame_len < 14 || frame_len < ssid_length + 15)
3330                                 return;
3331                         rates_length = beaconp[beacon->ssid_length + 15];
3332                         if (frame_len < ssid_length + rates_length + 18)
3333                                 return;
3334                         if (ssid_length >  MAX_SSID_LENGTH)
3335                                 return;
3336                         channel = beaconp[ssid_length + rates_length + 18];
3337
3338                         if (priv->station_state == STATION_STATE_READY) {
3339                                 smooth_rssi(priv, rssi);
3340                                 if (is_frame_from_current_bss(priv, header)) {
3341                                         priv->beacons_this_sec++;
3342                                         atmel_smooth_qual(priv);
3343                                         if (priv->last_beacon_timestamp) {
3344                                                 /* Note truncate this to 32 bits - kernel can't divide a long long */
3345                                                 u32 beacon_delay = timestamp - priv->last_beacon_timestamp;
3346                                                 int beacons = beacon_delay / (beacon_interval * 1000);
3347                                                 if (beacons > 1)
3348                                                         priv->wstats.miss.beacon += beacons - 1;
3349                                         }
3350                                         priv->last_beacon_timestamp = timestamp;
3351                                         handle_beacon_probe(priv, capability, channel);
3352                                 }
3353                         }
3354
3355                         if (priv->station_state == STATION_STATE_SCANNING)
3356                                 store_bss_info(priv, header, capability,
3357                                                beacon_interval, channel, rssi,
3358                                                ssid_length,
3359                                                &beacon->rates_el_id,
3360                                                subtype == IEEE80211_STYPE_BEACON);
3361                 }
3362                 break;
3363
3364         case IEEE80211_STYPE_AUTH:
3365
3366                 if (priv->station_state == STATION_STATE_AUTHENTICATING)
3367                         authenticate(priv, frame_len);
3368
3369                 break;
3370
3371         case IEEE80211_STYPE_ASSOC_RESP:
3372         case IEEE80211_STYPE_REASSOC_RESP:
3373
3374                 if (priv->station_state == STATION_STATE_ASSOCIATING ||
3375                     priv->station_state == STATION_STATE_REASSOCIATING)
3376                         associate(priv, frame_len, subtype);
3377
3378                 break;
3379
3380         case IEEE80211_STYPE_DISASSOC:
3381                 if (priv->station_is_associated &&
3382                     priv->operating_mode == IW_MODE_INFRA &&
3383                     is_frame_from_current_bss(priv, header)) {
3384                         priv->station_was_associated = 0;
3385                         priv->station_is_associated = 0;
3386
3387                         atmel_enter_state(priv, STATION_STATE_JOINNING);
3388                         join(priv, BSS_TYPE_INFRASTRUCTURE);
3389                 }
3390
3391                 break;
3392
3393         case IEEE80211_STYPE_DEAUTH:
3394                 if (priv->operating_mode == IW_MODE_INFRA &&
3395                     is_frame_from_current_bss(priv, header)) {
3396                         priv->station_was_associated = 0;
3397
3398                         atmel_enter_state(priv, STATION_STATE_JOINNING);
3399                         join(priv, BSS_TYPE_INFRASTRUCTURE);
3400                 }
3401
3402                 break;
3403         }
3404 }
3405
3406 /* run when timer expires */
3407 static void atmel_management_timer(u_long a)
3408 {
3409         struct net_device *dev = (struct net_device *) a;
3410         struct atmel_private *priv = netdev_priv(dev);
3411         unsigned long flags;
3412
3413         /* Check if the card has been yanked. */
3414         if (priv->card && priv->present_callback &&
3415                 !(*priv->present_callback)(priv->card))
3416                 return;
3417
3418         spin_lock_irqsave(&priv->irqlock, flags);
3419
3420         switch (priv->station_state) {
3421
3422         case STATION_STATE_AUTHENTICATING:
3423                 if (priv->AuthenticationRequestRetryCnt >= MAX_AUTHENTICATION_RETRIES) {
3424                         atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
3425                         priv->station_is_associated = 0;
3426                         priv->AuthenticationRequestRetryCnt = 0;
3427                         restart_search(priv);
3428                 } else {
3429                         int auth = WLAN_AUTH_OPEN;
3430                         priv->AuthenticationRequestRetryCnt++;
3431                         priv->CurrentAuthentTransactionSeqNum = 0x0001;
3432                         mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
3433                         if (priv->wep_is_on && priv->exclude_unencrypted)
3434                                 auth = WLAN_AUTH_SHARED_KEY;
3435                         send_authentication_request(priv, auth, NULL, 0);
3436           }
3437           break;
3438
3439         case STATION_STATE_ASSOCIATING:
3440                 if (priv->AssociationRequestRetryCnt == MAX_ASSOCIATION_RETRIES) {
3441                         atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
3442                         priv->station_is_associated = 0;
3443                         priv->AssociationRequestRetryCnt = 0;
3444                         restart_search(priv);
3445                 } else {
3446                         priv->AssociationRequestRetryCnt++;
3447                         mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
3448                         send_association_request(priv, 0);
3449                 }
3450           break;
3451
3452         case STATION_STATE_REASSOCIATING:
3453                 if (priv->ReAssociationRequestRetryCnt == MAX_ASSOCIATION_RETRIES) {
3454                         atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
3455                         priv->station_is_associated = 0;
3456                         priv->ReAssociationRequestRetryCnt = 0;
3457                         restart_search(priv);
3458                 } else {
3459                         priv->ReAssociationRequestRetryCnt++;
3460                         mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
3461                         send_association_request(priv, 1);
3462                 }
3463                 break;
3464
3465         default:
3466                 break;
3467         }
3468
3469         spin_unlock_irqrestore(&priv->irqlock, flags);
3470 }
3471
3472 static void atmel_command_irq(struct atmel_private *priv)
3473 {
3474         u8 status = atmel_rmem8(priv, atmel_co(priv, CMD_BLOCK_STATUS_OFFSET));
3475         u8 command = atmel_rmem8(priv, atmel_co(priv, CMD_BLOCK_COMMAND_OFFSET));
3476         int fast_scan;
3477         union iwreq_data wrqu;
3478
3479         if (status == CMD_STATUS_IDLE ||
3480             status == CMD_STATUS_IN_PROGRESS)
3481                 return;
3482
3483         switch (command){
3484
3485         case CMD_Start:
3486                 if (status == CMD_STATUS_COMPLETE) {
3487                         priv->station_was_associated = priv->station_is_associated;
3488                         atmel_get_mib(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_CUR_BSSID_POS,
3489                                       (u8 *)priv->CurrentBSSID, 6);
3490                         atmel_enter_state(priv, STATION_STATE_READY);
3491                 }
3492                 break;
3493
3494         case CMD_Scan:
3495                 fast_scan = priv->fast_scan;
3496                 priv->fast_scan = 0;
3497
3498                 if (status != CMD_STATUS_COMPLETE) {
3499                         atmel_scan(priv, 1);
3500                 } else {
3501                         int bss_index = retrieve_bss(priv);
3502                         int notify_scan_complete = 1;
3503                         if (bss_index != -1) {
3504                                 atmel_join_bss(priv, bss_index);
3505                         } else if (priv->operating_mode == IW_MODE_ADHOC &&
3506                                    priv->SSID_size != 0) {
3507                                 start(priv, BSS_TYPE_AD_HOC);
3508                         } else {
3509                                 priv->fast_scan = !fast_scan;
3510                                 atmel_scan(priv, 1);
3511                                 notify_scan_complete = 0;
3512                         }
3513                         priv->site_survey_state = SITE_SURVEY_COMPLETED;
3514                         if (notify_scan_complete) {
3515                                 wrqu.data.length = 0;
3516                                 wrqu.data.flags = 0;
3517                                 wireless_send_event(priv->dev, SIOCGIWSCAN, &wrqu, NULL);
3518                         }
3519                 }
3520                 break;
3521
3522         case CMD_SiteSurvey:
3523                 priv->fast_scan = 0;
3524
3525                 if (status != CMD_STATUS_COMPLETE)
3526                         return;
3527
3528                 priv->site_survey_state = SITE_SURVEY_COMPLETED;
3529                 if (priv->station_is_associated) {
3530                         atmel_enter_state(priv, STATION_STATE_READY);
3531                         wrqu.data.length = 0;
3532                         wrqu.data.flags = 0;
3533                         wireless_send_event(priv->dev, SIOCGIWSCAN, &wrqu, NULL);
3534                 } else {
3535                         atmel_scan(priv, 1);
3536                 }
3537                 break;
3538
3539         case CMD_Join:
3540                 if (status == CMD_STATUS_COMPLETE) {
3541                         if (priv->operating_mode == IW_MODE_ADHOC) {
3542                                 priv->station_was_associated = priv->station_is_associated;
3543                                 atmel_enter_state(priv, STATION_STATE_READY);
3544                         } else {
3545                                 int auth = WLAN_AUTH_OPEN;
3546                                 priv->AuthenticationRequestRetryCnt = 0;
3547                                 atmel_enter_state(priv, STATION_STATE_AUTHENTICATING);
3548
3549                                 mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
3550                                 priv->CurrentAuthentTransactionSeqNum = 0x0001;
3551                                 if (priv->wep_is_on && priv->exclude_unencrypted)
3552                                         auth = WLAN_AUTH_SHARED_KEY;
3553                                 send_authentication_request(priv, auth, NULL, 0);
3554                         }
3555                         return;
3556                 }
3557
3558                 atmel_scan(priv, 1);
3559         }
3560 }
3561
3562 static int atmel_wakeup_firmware(struct atmel_private *priv)
3563 {
3564         struct host_info_struct *iface = &priv->host_info;
3565         u16 mr1, mr3;
3566         int i;
3567
3568         if (priv->card_type == CARD_TYPE_SPI_FLASH)
3569                 atmel_set_gcr(priv->dev, GCR_REMAP);
3570
3571         /* wake up on-board processor */
3572         atmel_clear_gcr(priv->dev, 0x0040);
3573         atmel_write16(priv->dev, BSR, BSS_SRAM);
3574
3575         if (priv->card_type == CARD_TYPE_SPI_FLASH)
3576                 mdelay(100);
3577
3578         /* and wait for it */
3579         for (i = LOOP_RETRY_LIMIT; i; i--) {
3580                 mr1 = atmel_read16(priv->dev, MR1);
3581                 mr3 = atmel_read16(priv->dev, MR3);
3582
3583                 if (mr3 & MAC_BOOT_COMPLETE)
3584                         break;
3585                 if (mr1 & MAC_BOOT_COMPLETE &&
3586                     priv->bus_type == BUS_TYPE_PCCARD)
3587                         break;
3588         }
3589
3590         if (i == 0) {
3591                 printk(KERN_ALERT "%s: MAC failed to boot.\n", priv->dev->name);
3592                 return -EIO;
3593         }
3594
3595         if ((priv->host_info_base = atmel_read16(priv->dev, MR2)) == 0xffff) {
3596                 printk(KERN_ALERT "%s: card missing.\n", priv->dev->name);
3597                 return -ENODEV;
3598         }
3599
3600         /* now check for completion of MAC initialization through
3601            the FunCtrl field of the IFACE, poll MR1 to detect completion of
3602            MAC initialization, check completion status, set interrupt mask,
3603            enables interrupts and calls Tx and Rx initialization functions */
3604
3605         atmel_wmem8(priv, atmel_hi(priv, IFACE_FUNC_CTRL_OFFSET), FUNC_CTRL_INIT_COMPLETE);
3606
3607         for (i = LOOP_RETRY_LIMIT; i; i--) {
3608                 mr1 = atmel_read16(priv->dev, MR1);
3609                 mr3 = atmel_read16(priv->dev, MR3);
3610
3611                 if (mr3 & MAC_INIT_COMPLETE)
3612                         break;
3613                 if (mr1 & MAC_INIT_COMPLETE &&
3614                     priv->bus_type == BUS_TYPE_PCCARD)
3615                         break;
3616         }
3617
3618         if (i == 0) {
3619                 printk(KERN_ALERT "%s: MAC failed to initialise.\n",
3620                                 priv->dev->name);
3621                 return -EIO;
3622         }
3623
3624         /* Check for MAC_INIT_OK only on the register that the MAC_INIT_OK was set */
3625         if ((mr3 & MAC_INIT_COMPLETE) &&
3626             !(atmel_read16(priv->dev, MR3) & MAC_INIT_OK)) {
3627                 printk(KERN_ALERT "%s: MAC failed MR3 self-test.\n", priv->dev->name);
3628                 return -EIO;
3629         }
3630         if ((mr1 & MAC_INIT_COMPLETE) &&
3631             !(atmel_read16(priv->dev, MR1) & MAC_INIT_OK)) {
3632                 printk(KERN_ALERT "%s: MAC failed MR1 self-test.\n", priv->dev->name);
3633                 return -EIO;
3634         }
3635
3636         atmel_copy_to_host(priv->dev, (unsigned char *)iface,
3637                            priv->host_info_base, sizeof(*iface));
3638
3639         iface->tx_buff_pos = le16_to_cpu(iface->tx_buff_pos);
3640         iface->tx_buff_size = le16_to_cpu(iface->tx_buff_size);
3641         iface->tx_desc_pos = le16_to_cpu(iface->tx_desc_pos);
3642         iface->tx_desc_count = le16_to_cpu(iface->tx_desc_count);
3643         iface->rx_buff_pos = le16_to_cpu(iface->rx_buff_pos);
3644         iface->rx_buff_size = le16_to_cpu(iface->rx_buff_size);
3645         iface->rx_desc_pos = le16_to_cpu(iface->rx_desc_pos);
3646         iface->rx_desc_count = le16_to_cpu(iface->rx_desc_count);
3647         iface->build_version = le16_to_cpu(iface->build_version);
3648         iface->command_pos = le16_to_cpu(iface->command_pos);
3649         iface->major_version = le16_to_cpu(iface->major_version);
3650         iface->minor_version = le16_to_cpu(iface->minor_version);
3651         iface->func_ctrl = le16_to_cpu(iface->func_ctrl);
3652         iface->mac_status = le16_to_cpu(iface->mac_status);
3653
3654         return 0;
3655 }
3656
3657 /* determine type of memory and MAC address */
3658 static int probe_atmel_card(struct net_device *dev)
3659 {
3660         int rc = 0;
3661         struct atmel_private *priv = netdev_priv(dev);
3662
3663         /* reset pccard */
3664         if (priv->bus_type == BUS_TYPE_PCCARD)
3665                 atmel_write16(dev, GCR, 0x0060);
3666
3667         atmel_write16(dev, GCR, 0x0040);
3668         mdelay(500);
3669
3670         if (atmel_read16(dev, MR2) == 0) {
3671                 /* No stored firmware so load a small stub which just
3672                    tells us the MAC address */
3673                 int i;
3674                 priv->card_type = CARD_TYPE_EEPROM;
3675                 atmel_write16(dev, BSR, BSS_IRAM);
3676                 atmel_copy_to_card(dev, 0, mac_reader, sizeof(mac_reader));
3677                 atmel_set_gcr(dev, GCR_REMAP);
3678                 atmel_clear_gcr(priv->dev, 0x0040);
3679                 atmel_write16(dev, BSR, BSS_SRAM);
3680                 for (i = LOOP_RETRY_LIMIT; i; i--)
3681                         if (atmel_read16(dev, MR3) & MAC_BOOT_COMPLETE)
3682                                 break;
3683                 if (i == 0) {
3684                         printk(KERN_ALERT "%s: MAC failed to boot MAC address reader.\n", dev->name);
3685                 } else {
3686                         atmel_copy_to_host(dev, dev->dev_addr, atmel_read16(dev, MR2), 6);
3687                         /* got address, now squash it again until the network
3688                            interface is opened */
3689                         if (priv->bus_type == BUS_TYPE_PCCARD)
3690                                 atmel_write16(dev, GCR, 0x0060);
3691                         atmel_write16(dev, GCR, 0x0040);
3692                         rc = 1;
3693                 }
3694         } else if (atmel_read16(dev, MR4) == 0) {
3695                 /* Mac address easy in this case. */
3696                 priv->card_type = CARD_TYPE_PARALLEL_FLASH;
3697                 atmel_write16(dev,  BSR, 1);
3698                 atmel_copy_to_host(dev, dev->dev_addr, 0xc000, 6);
3699                 atmel_write16(dev,  BSR, 0x200);
3700                 rc = 1;
3701         } else {
3702                 /* Standard firmware in flash, boot it up and ask
3703                    for the Mac Address */
3704                 priv->card_type = CARD_TYPE_SPI_FLASH;
3705                 if (atmel_wakeup_firmware(priv) == 0) {
3706                         atmel_get_mib(priv, Mac_Address_Mib_Type, 0, dev->dev_addr, 6);
3707
3708                         /* got address, now squash it again until the network
3709                            interface is opened */
3710                         if (priv->bus_type == BUS_TYPE_PCCARD)
3711                                 atmel_write16(dev, GCR, 0x0060);
3712                         atmel_write16(dev, GCR, 0x0040);
3713                         rc = 1;
3714                 }
3715         }
3716
3717         if (rc) {
3718                 if (dev->dev_addr[0] == 0xFF) {
3719                         u8 default_mac[] = {0x00,0x04, 0x25, 0x00, 0x00, 0x00};
3720                         printk(KERN_ALERT "%s: *** Invalid MAC address. UPGRADE Firmware ****\n", dev->name);
3721                         memcpy(dev->dev_addr, default_mac, 6);
3722                 }
3723         }
3724
3725         return rc;
3726 }
3727
3728 /* Move the encyption information on the MIB structure.
3729    This routine is for the pre-WPA firmware: later firmware has
3730    a different format MIB and a different routine. */
3731 static void build_wep_mib(struct atmel_private *priv)
3732 {
3733         struct { /* NB this is matched to the hardware, don't change. */
3734                 u8 wep_is_on;
3735                 u8 default_key; /* 0..3 */
3736                 u8 reserved;
3737                 u8 exclude_unencrypted;
3738
3739                 u32 WEPICV_error_count;
3740                 u32 WEP_excluded_count;
3741
3742                 u8 wep_keys[MAX_ENCRYPTION_KEYS][13];
3743                 u8 encryption_level; /* 0, 1, 2 */
3744                 u8 reserved2[3];
3745         } mib;
3746         int i;
3747
3748         mib.wep_is_on = priv->wep_is_on;
3749         if (priv->wep_is_on) {
3750                 if (priv->wep_key_len[priv->default_key] > 5)
3751                         mib.encryption_level = 2;
3752                 else
3753                         mib.encryption_level = 1;
3754         } else {
3755                 mib.encryption_level = 0;
3756         }
3757
3758         mib.default_key = priv->default_key;
3759         mib.exclude_unencrypted = priv->exclude_unencrypted;
3760
3761         for (i = 0; i < MAX_ENCRYPTION_KEYS; i++)
3762                 memcpy(mib.wep_keys[i], priv->wep_keys[i], 13);
3763
3764         atmel_set_mib(priv, Mac_Wep_Mib_Type, 0, (u8 *)&mib, sizeof(mib));
3765 }
3766
3767 static void build_wpa_mib(struct atmel_private *priv)
3768 {
3769         /* This is for the later (WPA enabled) firmware. */
3770
3771         struct { /* NB this is matched to the hardware, don't change. */
3772                 u8 cipher_default_key_value[MAX_ENCRYPTION_KEYS][MAX_ENCRYPTION_KEY_SIZE];
3773                 u8 receiver_address[6];
3774                 u8 wep_is_on;
3775                 u8 default_key; /* 0..3 */
3776                 u8 group_key;
3777                 u8 exclude_unencrypted;
3778                 u8 encryption_type;
3779                 u8 reserved;
3780
3781                 u32 WEPICV_error_count;
3782                 u32 WEP_excluded_count;
3783
3784                 u8 key_RSC[4][8];
3785         } mib;
3786
3787         int i;
3788
3789         mib.wep_is_on = priv->wep_is_on;
3790         mib.exclude_unencrypted = priv->exclude_unencrypted;
3791         memcpy(mib.receiver_address, priv->CurrentBSSID, 6);
3792
3793         /* zero all the keys before adding in valid ones. */
3794         memset(mib.cipher_default_key_value, 0, sizeof(mib.cipher_default_key_value));
3795
3796         if (priv->wep_is_on) {
3797                 /* There's a comment in the Atmel code to the effect that this
3798                    is only valid when still using WEP, it may need to be set to
3799                    something to use WPA */
3800                 memset(mib.key_RSC, 0, sizeof(mib.key_RSC));
3801
3802                 mib.default_key = mib.group_key = 255;
3803                 for (i = 0; i < MAX_ENCRYPTION_KEYS; i++) {
3804                         if (priv->wep_key_len[i] > 0) {
3805                                 memcpy(mib.cipher_default_key_value[i], priv->wep_keys[i], MAX_ENCRYPTION_KEY_SIZE);
3806                                 if (i == priv->default_key) {
3807                                         mib.default_key = i;
3808                                         mib.cipher_default_key_value[i][MAX_ENCRYPTION_KEY_SIZE-1] = 7;
3809                                         mib.cipher_default_key_value[i][MAX_ENCRYPTION_KEY_SIZE-2] = priv->pairwise_cipher_suite;
3810                                 } else {
3811                                         mib.group_key = i;
3812                                         priv->group_cipher_suite = priv->pairwise_cipher_suite;
3813                                         mib.cipher_default_key_value[i][MAX_ENCRYPTION_KEY_SIZE-1] = 1;
3814                                         mib.cipher_default_key_value[i][MAX_ENCRYPTION_KEY_SIZE-2] = priv->group_cipher_suite;
3815                                 }
3816                         }
3817                 }
3818                 if (mib.default_key == 255)
3819                         mib.default_key = mib.group_key != 255 ? mib.group_key : 0;
3820                 if (mib.group_key == 255)
3821                         mib.group_key = mib.default_key;
3822
3823         }
3824
3825         atmel_set_mib(priv, Mac_Wep_Mib_Type, 0, (u8 *)&mib, sizeof(mib));
3826 }
3827
3828 static int reset_atmel_card(struct net_device *dev)
3829 {
3830         /* do everything necessary to wake up the hardware, including
3831            waiting for the lightning strike and throwing the knife switch....
3832
3833            set all the Mib values which matter in the card to match
3834            their settings in the atmel_private structure. Some of these
3835            can be altered on the fly, but many (WEP, infrastucture or ad-hoc)
3836            can only be changed by tearing down the world and coming back through
3837            here.
3838
3839            This routine is also responsible for initialising some
3840            hardware-specific fields in the atmel_private structure,
3841            including a copy of the firmware's hostinfo stucture
3842            which is the route into the rest of the firmare datastructures. */
3843
3844         struct atmel_private *priv = netdev_priv(dev);
3845         u8 configuration;
3846         int old_state = priv->station_state;
3847         int err = 0;
3848
3849         /* data to add to the firmware names, in priority order
3850            this implemenents firmware versioning */
3851
3852         static char *firmware_modifier[] = {
3853                 "-wpa",
3854                 "",
3855                 NULL
3856         };
3857
3858         /* reset pccard */
3859         if (priv->bus_type == BUS_TYPE_PCCARD)
3860                 atmel_write16(priv->dev, GCR, 0x0060);
3861
3862         /* stop card , disable interrupts */
3863         atmel_write16(priv->dev, GCR, 0x0040);
3864
3865         if (priv->card_type == CARD_TYPE_EEPROM) {
3866                 /* copy in firmware if needed */
3867                 const struct firmware *fw_entry = NULL;
3868                 const unsigned char *fw;
3869                 int len = priv->firmware_length;
3870                 if (!(fw = priv->firmware)) {
3871                         if (priv->firmware_type == ATMEL_FW_TYPE_NONE) {
3872                                 if (strlen(priv->firmware_id) == 0) {
3873                                         printk(KERN_INFO
3874                                                "%s: card type is unknown: assuming at76c502 firmware is OK.\n",
3875                                                dev->name);
3876                                         printk(KERN_INFO
3877                                                "%s: if not, use the firmware= module parameter.\n",
3878                                                dev->name);
3879                                         strcpy(priv->firmware_id, "atmel_at76c502.bin");
3880                                 }
3881                                 err = request_firmware(&fw_entry, priv->firmware_id, priv->sys_dev);
3882                                 if (err != 0) {
3883                                         printk(KERN_ALERT
3884                                                "%s: firmware %s is missing, cannot continue.\n",
3885                                                dev->name, priv->firmware_id);
3886                                         return err;
3887                                 }
3888                         } else {
3889                                 int fw_index = 0;
3890                                 int success = 0;
3891
3892                                 /* get firmware filename entry based on firmware type ID */
3893                                 while (fw_table[fw_index].fw_type != priv->firmware_type
3894                                                 && fw_table[fw_index].fw_type != ATMEL_FW_TYPE_NONE)
3895                                         fw_index++;
3896
3897                                 /* construct the actual firmware file name */
3898                                 if (fw_table[fw_index].fw_type != ATMEL_FW_TYPE_NONE) {
3899                                         int i;
3900                                         for (i = 0; firmware_modifier[i]; i++) {
3901                                                 snprintf(priv->firmware_id, 32, "%s%s.%s", fw_table[fw_index].fw_file,
3902                                                         firmware_modifier[i], fw_table[fw_index].fw_file_ext);
3903                                                 priv->firmware_id[31] = '\0';
3904                                                 if (request_firmware(&fw_entry, priv->firmware_id, priv->sys_dev) == 0) {
3905                                                         success = 1;
3906                                                         break;
3907                                                 }
3908                                         }
3909                                 }
3910                                 if (!success) {
3911                                         printk(KERN_ALERT
3912                                                "%s: firmware %s is missing, cannot start.\n",
3913                                                dev->name, priv->firmware_id);
3914                                         priv->firmware_id[0] = '\0';
3915                                         return -ENOENT;
3916                                 }
3917                         }
3918
3919                         fw = fw_entry->data;
3920                         len = fw_entry->size;
3921                 }
3922
3923                 if (len <= 0x6000) {
3924                         atmel_write16(priv->dev, BSR, BSS_IRAM);
3925                         atmel_copy_to_card(priv->dev, 0, fw, len);
3926                         atmel_set_gcr(priv->dev, GCR_REMAP);
3927                 } else {
3928                         /* Remap */
3929                         atmel_set_gcr(priv->dev, GCR_REMAP);
3930                         atmel_write16(priv->dev, BSR, BSS_IRAM);
3931                         atmel_copy_to_card(priv->dev, 0, fw, 0x6000);
3932                         atmel_write16(priv->dev, BSR, 0x2ff);
3933                         atmel_copy_to_card(priv->dev, 0x8000, &fw[0x6000], len - 0x6000);
3934                 }
3935
3936                 if (fw_entry)
3937                         release_firmware(fw_entry);
3938         }
3939
3940         err = atmel_wakeup_firmware(priv);
3941         if (err != 0)
3942                 return err;
3943
3944         /* Check the version and set the correct flag for wpa stuff,
3945            old and new firmware is incompatible.
3946            The pre-wpa 3com firmware reports major version 5,
3947            the wpa 3com firmware is major version 4 and doesn't need
3948            the 3com broken-ness filter. */
3949         priv->use_wpa = (priv->host_info.major_version == 4);
3950         priv->radio_on_broken = (priv->host_info.major_version == 5);
3951
3952         /* unmask all irq sources */
3953         atmel_wmem8(priv, atmel_hi(priv, IFACE_INT_MASK_OFFSET), 0xff);
3954
3955         /* int Tx system and enable Tx */
3956         atmel_wmem8(priv, atmel_tx(priv, TX_DESC_FLAGS_OFFSET, 0), 0);
3957         atmel_wmem32(priv, atmel_tx(priv, TX_DESC_NEXT_OFFSET, 0), 0x80000000L);
3958         atmel_wmem16(priv, atmel_tx(priv, TX_DESC_POS_OFFSET, 0), 0);
3959         atmel_wmem16(priv, atmel_tx(priv, TX_DESC_SIZE_OFFSET, 0), 0);
3960
3961         priv->tx_desc_free = priv->host_info.tx_desc_count;
3962         priv->tx_desc_head = 0;
3963         priv->tx_desc_tail = 0;
3964         priv->tx_desc_previous = 0;
3965         priv->tx_free_mem = priv->host_info.tx_buff_size;
3966         priv->tx_buff_head = 0;
3967         priv->tx_buff_tail = 0;
3968
3969         configuration = atmel_rmem8(priv, atmel_hi(priv, IFACE_FUNC_CTRL_OFFSET));
3970         atmel_wmem8(priv, atmel_hi(priv, IFACE_FUNC_CTRL_OFFSET),
3971                                    configuration | FUNC_CTRL_TxENABLE);
3972
3973         /* init Rx system and enable */
3974         priv->rx_desc_head = 0;
3975
3976         configuration = atmel_rmem8(priv, atmel_hi(priv, IFACE_FUNC_CTRL_OFFSET));
3977         atmel_wmem8(priv, atmel_hi(priv, IFACE_FUNC_CTRL_OFFSET),
3978                                    configuration | FUNC_CTRL_RxENABLE);
3979
3980         if (!priv->radio_on_broken) {
3981                 if (atmel_send_command_wait(priv, CMD_EnableRadio, NULL, 0) ==
3982                     CMD_STATUS_REJECTED_RADIO_OFF) {
3983                         printk(KERN_INFO "%s: cannot turn the radio on.\n",
3984                                dev->name);
3985                         return -EIO;
3986                 }
3987         }
3988
3989         /* set up enough MIB values to run. */
3990         atmel_set_mib8(priv, Local_Mib_Type, LOCAL_MIB_AUTO_TX_RATE_POS, priv->auto_tx_rate);
3991         atmel_set_mib8(priv, Local_Mib_Type,  LOCAL_MIB_TX_PROMISCUOUS_POS,  PROM_MODE_OFF);
3992         atmel_set_mib16(priv, Mac_Mib_Type, MAC_MIB_RTS_THRESHOLD_POS, priv->rts_threshold);
3993         atmel_set_mib16(priv, Mac_Mib_Type, MAC_MIB_FRAG_THRESHOLD_POS, priv->frag_threshold);
3994         atmel_set_mib8(priv, Mac_Mib_Type, MAC_MIB_SHORT_RETRY_POS, priv->short_retry);
3995         atmel_set_mib8(priv, Mac_Mib_Type, MAC_MIB_LONG_RETRY_POS, priv->long_retry);
3996         atmel_set_mib8(priv, Local_Mib_Type, LOCAL_MIB_PREAMBLE_TYPE, priv->preamble);
3997         atmel_set_mib(priv, Mac_Address_Mib_Type, MAC_ADDR_MIB_MAC_ADDR_POS,
3998                       priv->dev->dev_addr, 6);
3999         atmel_set_mib8(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_PS_MODE_POS, ACTIVE_MODE);
4000         atmel_set_mib16(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_LISTEN_INTERVAL_POS, 1);
4001         atmel_set_mib16(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_BEACON_PER_POS, priv->default_beacon_period);
4002         atmel_set_mib(priv, Phy_Mib_Type, PHY_MIB_RATE_SET_POS, atmel_basic_rates, 4);
4003         atmel_set_mib8(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_CUR_PRIVACY_POS, priv->wep_is_on);
4004         if (priv->use_wpa)
4005                 build_wpa_mib(priv);
4006         else
4007                 build_wep_mib(priv);
4008
4009         if (old_state == STATION_STATE_READY)
4010         {
4011                 union iwreq_data wrqu;
4012
4013                 wrqu.data.length = 0;
4014                 wrqu.data.flags = 0;
4015                 wrqu.ap_addr.sa_family = ARPHRD_ETHER;
4016                 memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
4017                 wireless_send_event(priv->dev, SIOCGIWAP, &wrqu, NULL);
4018         }
4019
4020         return 0;
4021 }
4022
4023 static void atmel_send_command(struct atmel_private *priv, int command,
4024                                void *cmd, int cmd_size)
4025 {
4026         if (cmd)
4027                 atmel_copy_to_card(priv->dev, atmel_co(priv, CMD_BLOCK_PARAMETERS_OFFSET),
4028                                    cmd, cmd_size);
4029
4030         atmel_wmem8(priv, atmel_co(priv, CMD_BLOCK_COMMAND_OFFSET), command);
4031         atmel_wmem8(priv, atmel_co(priv, CMD_BLOCK_STATUS_OFFSET), 0);
4032 }
4033
4034 static int atmel_send_command_wait(struct atmel_private *priv, int command,
4035                                    void *cmd, int cmd_size)
4036 {
4037         int i, status;
4038
4039         atmel_send_command(priv, command, cmd, cmd_size);
4040
4041         for (i = 5000; i; i--) {
4042                 status = atmel_rmem8(priv, atmel_co(priv, CMD_BLOCK_STATUS_OFFSET));
4043                 if (status != CMD_STATUS_IDLE &&
4044                     status != CMD_STATUS_IN_PROGRESS)
4045                         break;
4046                 udelay(20);
4047         }
4048
4049         if (i == 0) {
4050                 printk(KERN_ALERT "%s: failed to contact MAC.\n", priv->dev->name);
4051                 status =  CMD_STATUS_HOST_ERROR;
4052         } else {
4053                 if (command != CMD_EnableRadio)
4054                         status = CMD_STATUS_COMPLETE;
4055         }
4056
4057         return status;
4058 }
4059
4060 static u8 atmel_get_mib8(struct atmel_private *priv, u8 type, u8 index)
4061 {
4062         struct get_set_mib m;
4063         m.type = type;
4064         m.size = 1;
4065         m.index = index;
4066
4067         atmel_send_command_wait(priv, CMD_Get_MIB_Vars, &m, MIB_HEADER_SIZE + 1);
4068         return atmel_rmem8(priv, atmel_co(priv, CMD_BLOCK_PARAMETERS_OFFSET + MIB_HEADER_SIZE));
4069 }
4070
4071 static void atmel_set_mib8(struct atmel_private *priv, u8 type, u8 index, u8 data)
4072 {
4073         struct get_set_mib m;
4074         m.type = type;
4075         m.size = 1;
4076         m.index = index;
4077         m.data[0] = data;
4078
4079         atmel_send_command_wait(priv, CMD_Set_MIB_Vars, &m, MIB_HEADER_SIZE + 1);
4080 }
4081
4082 static void atmel_set_mib16(struct atmel_private *priv, u8 type, u8 index,
4083                             u16 data)
4084 {
4085         struct get_set_mib m;
4086         m.type = type;
4087         m.size = 2;
4088         m.index = index;
4089         m.data[0] = data;
4090         m.data[1] = data >> 8;
4091
4092         atmel_send_command_wait(priv, CMD_Set_MIB_Vars, &m, MIB_HEADER_SIZE + 2);
4093 }
4094
4095 static void atmel_set_mib(struct atmel_private *priv, u8 type, u8 index,
4096                           u8 *data, int data_len)
4097 {
4098         struct get_set_mib m;
4099         m.type = type;
4100         m.size = data_len;
4101         m.index = index;
4102
4103         if (data_len > MIB_MAX_DATA_BYTES)
4104                 printk(KERN_ALERT "%s: MIB buffer too small.\n", priv->dev->name);
4105
4106         memcpy(m.data, data, data_len);
4107         atmel_send_command_wait(priv, CMD_Set_MIB_Vars, &m, MIB_HEADER_SIZE + data_len);
4108 }
4109
4110 static void atmel_get_mib(struct atmel_private *priv, u8 type, u8 index,
4111                           u8 *data, int data_len)
4112 {
4113         struct get_set_mib m;
4114         m.type = type;
4115         m.size = data_len;
4116         m.index = index;
4117
4118         if (data_len > MIB_MAX_DATA_BYTES)
4119                 printk(KERN_ALERT "%s: MIB buffer too small.\n", priv->dev->name);
4120
4121         atmel_send_command_wait(priv, CMD_Get_MIB_Vars, &m, MIB_HEADER_SIZE + data_len);
4122         atmel_copy_to_host(priv->dev, data,
4123                            atmel_co(priv, CMD_BLOCK_PARAMETERS_OFFSET + MIB_HEADER_SIZE), data_len);
4124 }
4125
4126 static void atmel_writeAR(struct net_device *dev, u16 data)
4127 {
4128         int i;
4129         outw(data, dev->base_addr + AR);
4130         /* Address register appears to need some convincing..... */
4131         for (i = 0; data != inw(dev->base_addr + AR) && i < 10; i++)
4132                 outw(data, dev->base_addr + AR);
4133 }
4134
4135 static void atmel_copy_to_card(struct net_device *dev, u16 dest,
4136                                const unsigned char *src, u16 len)
4137 {
4138         int i;
4139         atmel_writeAR(dev, dest);
4140         if (dest % 2) {
4141                 atmel_write8(dev, DR, *src);
4142                 src++; len--;
4143         }
4144         for (i = len; i > 1 ; i -= 2) {
4145                 u8 lb = *src++;
4146                 u8 hb = *src++;
4147                 atmel_write16(dev, DR, lb | (hb << 8));
4148         }
4149         if (i)
4150                 atmel_write8(dev, DR, *src);
4151 }
4152
4153 static void atmel_copy_to_host(struct net_device *dev, unsigned char *dest,
4154                                u16 src, u16 len)
4155 {
4156         int i;
4157         atmel_writeAR(dev, src);
4158         if (src % 2) {
4159                 *dest = atmel_read8(dev, DR);
4160                 dest++; len--;
4161         }
4162         for (i = len; i > 1 ; i -= 2) {
4163                 u16 hw = atmel_read16(dev, DR);
4164                 *dest++ = hw;
4165                 *dest++ = hw >> 8;
4166         }
4167         if (i)
4168                 *dest = atmel_read8(dev, DR);
4169 }
4170
4171 static void atmel_set_gcr(struct net_device *dev, u16 mask)
4172 {
4173         outw(inw(dev->base_addr + GCR) | mask, dev->base_addr + GCR);
4174 }
4175
4176 static void atmel_clear_gcr(struct net_device *dev, u16 mask)
4177 {
4178         outw(inw(dev->base_addr + GCR) & ~mask, dev->base_addr + GCR);
4179 }
4180
4181 static int atmel_lock_mac(struct atmel_private *priv)
4182 {
4183         int i, j = 20;
4184  retry:
4185         for (i = 5000; i; i--) {
4186                 if (!atmel_rmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_HOST_OFFSET)))
4187                         break;
4188                 udelay(20);
4189         }
4190
4191         if (!i)
4192                 return 0; /* timed out */
4193
4194         atmel_wmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_MAC_OFFSET), 1);
4195         if (atmel_rmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_HOST_OFFSET))) {
4196                 atmel_wmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_MAC_OFFSET), 0);
4197                 if (!j--)
4198                         return 0; /* timed out */
4199                 goto retry;
4200         }
4201
4202         return 1;
4203 }
4204
4205 static void atmel_wmem32(struct atmel_private *priv, u16 pos, u32 data)
4206 {
4207         atmel_writeAR(priv->dev, pos);
4208         atmel_write16(priv->dev, DR, data); /* card is little-endian */
4209         atmel_write16(priv->dev, DR, data >> 16);
4210 }
4211
4212 /***************************************************************************/
4213 /* There follows the source form of the MAC address reading firmware       */
4214 /***************************************************************************/
4215 #if 0
4216
4217 /* Copyright 2003 Matthew T. Russotto                                      */
4218 /* But derived from the Atmel 76C502 firmware written by Atmel and         */
4219 /* included in "atmel wireless lan drivers" package                        */
4220 /**
4221     This file is part of net.russotto.AtmelMACFW, hereto referred to
4222     as AtmelMACFW
4223
4224     AtmelMACFW is free software; you can redistribute it and/or modify
4225     it under the terms of the GNU General Public License version 2
4226     as published by the Free Software Foundation.
4227
4228     AtmelMACFW is distributed in the hope that it will be useful,
4229     but WITHOUT ANY WARRANTY; without even the implied warranty of
4230     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
4231     GNU General Public License for more details.
4232
4233     You should have received a copy of the GNU General Public License
4234     along with AtmelMACFW; if not, write to the Free Software
4235     Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
4236
4237 ****************************************************************************/
4238 /* This firmware should work on the 76C502 RFMD, RFMD_D, and RFMD_E        */
4239 /* It will probably work on the 76C504 and 76C502 RFMD_3COM                */
4240 /* It only works on SPI EEPROM versions of the card.                       */
4241
4242 /* This firmware initializes the SPI controller and clock, reads the MAC   */
4243 /* address from the EEPROM into SRAM, and puts the SRAM offset of the MAC  */
4244 /* address in MR2, and sets MR3 to 0x10 to indicate it is done             */
4245 /* It also puts a complete copy of the EEPROM in SRAM with the offset in   */
4246 /* MR4, for investigational purposes (maybe we can determine chip type     */
4247 /* from that?)                                                             */
4248
4249         .org 0
4250     .set MRBASE, 0x8000000
4251         .set CPSR_INITIAL, 0xD3 /* IRQ/FIQ disabled, ARM mode, Supervisor state */
4252         .set CPSR_USER, 0xD1 /* IRQ/FIQ disabled, ARM mode, USER state */
4253         .set SRAM_BASE,  0x02000000
4254         .set SP_BASE,    0x0F300000
4255         .set UNK_BASE,   0x0F000000 /* Some internal device, but which one? */
4256         .set SPI_CGEN_BASE,  0x0E000000 /* Some internal device, but which one? */
4257         .set UNK3_BASE,  0x02014000 /* Some internal device, but which one? */
4258         .set STACK_BASE, 0x5600
4259         .set SP_SR, 0x10
4260         .set SP_TDRE, 2 /* status register bit -- TDR empty */
4261         .set SP_RDRF, 1 /* status register bit -- RDR full */
4262         .set SP_SWRST, 0x80
4263         .set SP_SPIEN, 0x1
4264         .set SP_CR, 0   /* control register */
4265         .set SP_MR, 4   /* mode register */
4266         .set SP_RDR, 0x08 /* Read Data Register */
4267         .set SP_TDR, 0x0C /* Transmit Data Register */
4268         .set SP_CSR0, 0x30 /* chip select registers */
4269         .set SP_CSR1, 0x34
4270         .set SP_CSR2, 0x38
4271         .set SP_CSR3, 0x3C
4272         .set NVRAM_CMD_RDSR, 5 /* read status register */
4273         .set NVRAM_CMD_READ, 3 /* read data */
4274         .set NVRAM_SR_RDY, 1 /* RDY bit.  This bit is inverted */
4275         .set SPI_8CLOCKS, 0xFF /* Writing this to the TDR doesn't do anything to the
4276                                   serial output, since SO is normally high.  But it
4277                                   does cause 8 clock cycles and thus 8 bits to be
4278                                   clocked in to the chip.  See Atmel's SPI
4279                                   controller (e.g. AT91M55800) timing and 4K
4280                                   SPI EEPROM manuals */
4281
4282         .set NVRAM_SCRATCH, 0x02000100  /* arbitrary area for scratchpad memory */
4283         .set NVRAM_IMAGE, 0x02000200
4284         .set NVRAM_LENGTH, 0x0200
4285         .set MAC_ADDRESS_MIB, SRAM_BASE
4286         .set MAC_ADDRESS_LENGTH, 6
4287         .set MAC_BOOT_FLAG, 0x10
4288         .set MR1, 0
4289         .set MR2, 4
4290         .set MR3, 8
4291         .set MR4, 0xC
4292 RESET_VECTOR:
4293         b RESET_HANDLER
4294 UNDEF_VECTOR:
4295         b HALT1
4296 SWI_VECTOR:
4297         b HALT1
4298 IABORT_VECTOR:
4299         b HALT1
4300 DABORT_VECTOR:
4301 RESERVED_VECTOR:
4302         b HALT1
4303 IRQ_VECTOR:
4304         b HALT1
4305 FIQ_VECTOR:
4306         b HALT1
4307 HALT1:  b HALT1
4308 RESET_HANDLER:
4309         mov     r0, #CPSR_INITIAL
4310         msr     CPSR_c, r0      /* This is probably unnecessary */
4311
4312 /* I'm guessing this is initializing clock generator electronics for SPI */
4313         ldr     r0, =SPI_CGEN_BASE
4314         mov     r1, #0
4315         mov     r1, r1, lsl #3
4316         orr     r1,r1, #0
4317         str     r1, [r0]
4318         ldr     r1, [r0, #28]
4319         bic     r1, r1, #16
4320         str     r1, [r0, #28]
4321         mov     r1, #1
4322         str     r1, [r0, #8]
4323
4324         ldr     r0, =MRBASE
4325         mov     r1, #0
4326         strh    r1, [r0, #MR1]
4327         strh    r1, [r0, #MR2]
4328         strh    r1, [r0, #MR3]
4329         strh    r1, [r0, #MR4]
4330
4331         mov     sp, #STACK_BASE
4332         bl      SP_INIT
4333         mov     r0, #10
4334         bl      DELAY9
4335         bl      GET_MAC_ADDR
4336         bl      GET_WHOLE_NVRAM
4337         ldr     r0, =MRBASE
4338         ldr     r1, =MAC_ADDRESS_MIB
4339         strh    r1, [r0, #MR2]
4340         ldr     r1, =NVRAM_IMAGE
4341         strh    r1, [r0, #MR4]
4342         mov     r1, #MAC_BOOT_FLAG
4343         strh    r1, [r0, #MR3]
4344 HALT2:  b HALT2
4345 .func Get_Whole_NVRAM, GET_WHOLE_NVRAM
4346 GET_WHOLE_NVRAM:
4347         stmdb   sp!, {lr}
4348         mov     r2, #0 /* 0th bytes of NVRAM */
4349         mov     r3, #NVRAM_LENGTH
4350         mov     r1, #0          /* not used in routine */
4351         ldr     r0, =NVRAM_IMAGE
4352         bl      NVRAM_XFER
4353         ldmia   sp!, {lr}
4354         bx      lr
4355 .endfunc
4356
4357 .func Get_MAC_Addr, GET_MAC_ADDR
4358 GET_MAC_ADDR:
4359         stmdb   sp!, {lr}
4360         mov     r2, #0x120      /* address of MAC Address within NVRAM */
4361         mov     r3, #MAC_ADDRESS_LENGTH
4362         mov     r1, #0          /* not used in routine */
4363         ldr     r0, =MAC_ADDRESS_MIB
4364         bl      NVRAM_XFER
4365         ldmia   sp!, {lr}
4366         bx      lr
4367 .endfunc
4368 .ltorg
4369 .func Delay9, DELAY9
4370 DELAY9:
4371         adds    r0, r0, r0, LSL #3   /* r0 = r0 * 9 */
4372 DELAYLOOP:
4373         beq     DELAY9_done
4374         subs    r0, r0, #1
4375         b       DELAYLOOP
4376 DELAY9_done:
4377         bx      lr
4378 .endfunc
4379
4380 .func SP_Init, SP_INIT
4381 SP_INIT:
4382         mov     r1, #SP_SWRST
4383         ldr     r0, =SP_BASE
4384         str     r1, [r0, #SP_CR] /* reset the SPI */
4385         mov     r1, #0
4386         str     r1, [r0, #SP_CR] /* release SPI from reset state */
4387         mov     r1, #SP_SPIEN
4388         str     r1, [r0, #SP_MR] /* set the SPI to MASTER mode*/
4389         str     r1, [r0, #SP_CR] /* enable the SPI */
4390
4391 /*  My guess would be this turns on the SPI clock */
4392         ldr     r3, =SPI_CGEN_BASE
4393         ldr     r1, [r3, #28]
4394         orr     r1, r1, #0x2000
4395         str     r1, [r3, #28]
4396
4397         ldr     r1, =0x2000c01
4398         str     r1, [r0, #SP_CSR0]
4399         ldr     r1, =0x2000201
4400         str     r1, [r0, #SP_CSR1]
4401         str     r1, [r0, #SP_CSR2]
4402         str     r1, [r0, #SP_CSR3]
4403         ldr     r1, [r0, #SP_SR]
4404         ldr     r0, [r0, #SP_RDR]
4405         bx      lr
4406 .endfunc
4407 .func NVRAM_Init, NVRAM_INIT
4408 NVRAM_INIT:
4409         ldr     r1, =SP_BASE
4410         ldr     r0, [r1, #SP_RDR]
4411         mov     r0, #NVRAM_CMD_RDSR
4412         str     r0, [r1, #SP_TDR]
4413 SP_loop1:
4414         ldr     r0, [r1, #SP_SR]
4415         tst     r0, #SP_TDRE
4416         beq     SP_loop1
4417
4418         mov     r0, #SPI_8CLOCKS
4419         str     r0, [r1, #SP_TDR]
4420 SP_loop2:
4421         ldr     r0, [r1, #SP_SR]
4422         tst     r0, #SP_TDRE
4423         beq     SP_loop2
4424
4425         ldr     r0, [r1, #SP_RDR]
4426 SP_loop3:
4427         ldr     r0, [r1, #SP_SR]
4428         tst     r0, #SP_RDRF
4429         beq     SP_loop3
4430
4431         ldr     r0, [r1, #SP_RDR]
4432         and     r0, r0, #255
4433         bx      lr
4434 .endfunc
4435
4436 .func NVRAM_Xfer, NVRAM_XFER
4437         /* r0 = dest address */
4438         /* r1 = not used */
4439         /* r2 = src address within NVRAM */
4440         /* r3 = length */
4441 NVRAM_XFER:
4442         stmdb   sp!, {r4, r5, lr}
4443         mov     r5, r0          /* save r0 (dest address) */
4444         mov     r4, r3          /* save r3 (length) */
4445         mov     r0, r2, LSR #5 /*  SPI memories put A8 in the command field */
4446         and     r0, r0, #8
4447         add     r0, r0, #NVRAM_CMD_READ
4448         ldr     r1, =NVRAM_SCRATCH
4449         strb    r0, [r1, #0]    /* save command in NVRAM_SCRATCH[0] */
4450         strb    r2, [r1, #1]    /* save low byte of source address in NVRAM_SCRATCH[1] */
4451 _local1:
4452         bl      NVRAM_INIT
4453         tst     r0, #NVRAM_SR_RDY
4454         bne     _local1
4455         mov     r0, #20
4456         bl      DELAY9
4457         mov     r2, r4          /* length */
4458         mov     r1, r5          /* dest address */
4459         mov     r0, #2          /* bytes to transfer in command */
4460         bl      NVRAM_XFER2
4461         ldmia   sp!, {r4, r5, lr}
4462         bx      lr
4463 .endfunc
4464
4465 .func NVRAM_Xfer2, NVRAM_XFER2
4466 NVRAM_XFER2:
4467         stmdb   sp!, {r4, r5, r6, lr}
4468         ldr     r4, =SP_BASE
4469         mov     r3, #0
4470         cmp     r0, #0
4471         bls     _local2
4472         ldr     r5, =NVRAM_SCRATCH
4473 _local4:
4474         ldrb    r6, [r5, r3]
4475         str     r6, [r4, #SP_TDR]
4476 _local3:
4477         ldr     r6, [r4, #SP_SR]
4478         tst     r6, #SP_TDRE
4479         beq     _local3
4480         add     r3, r3, #1
4481         cmp     r3, r0 /* r0 is # of bytes to send out (command+addr) */
4482         blo     _local4
4483 _local2:
4484         mov     r3, #SPI_8CLOCKS
4485         str     r3, [r4, #SP_TDR]
4486         ldr     r0, [r4, #SP_RDR]
4487 _local5:
4488         ldr     r0, [r4, #SP_SR]
4489         tst     r0, #SP_RDRF
4490         beq     _local5
4491         ldr     r0, [r4, #SP_RDR] /* what's this byte?  It's the byte read while writing the TDR -- nonsense, because the NVRAM doesn't read and write at the same time */
4492         mov     r0, #0
4493         cmp     r2, #0  /* r2 is # of bytes to copy in */
4494         bls     _local6
4495 _local7:
4496         ldr     r5, [r4, #SP_SR]
4497         tst     r5, #SP_TDRE
4498         beq     _local7
4499         str     r3, [r4, #SP_TDR]  /* r3 has SPI_8CLOCKS */
4500 _local8:
4501         ldr     r5, [r4, #SP_SR]
4502         tst     r5, #SP_RDRF
4503         beq     _local8
4504         ldr     r5, [r4, #SP_RDR] /* but didn't we read this byte above? */
4505         strb    r5, [r1], #1 /* postindexed */
4506         add     r0, r0, #1
4507         cmp     r0, r2
4508         blo     _local7 /* since we don't send another address, the NVRAM must be capable of sequential reads */
4509 _local6:
4510         mov     r0, #200
4511         bl      DELAY9
4512         ldmia   sp!, {r4, r5, r6, lr}
4513         bx      lr
4514 #endif