drivers/net/wireless/atmel.c

   1 /*** -*- linux-c -*- **********************************************************
   2
   3      Driver for Atmel at76c502 at76c504 and at76c506 wireless cards.
   4
   5         Copyright 2000-2001 ATMEL Corporation.
   6         Copyright 2003-2004 Simon Kelley.
   7
   8     This code was developed from version 2.1.1 of the Atmel drivers,
   9     released by Atmel corp. under the GPL in December 2002. It also
  10     includes code from the Linux aironet drivers (C) Benjamin Reed,
  11     and the Linux PCMCIA package, (C) David Hinds and the Linux wireless
  12     extensions, (C) Jean Tourrilhes.
  13
  14     The firmware module for reading the MAC address of the card comes from
  15     net.russotto.AtmelMACFW, written by Matthew T. Russotto and copyright
  16     by him. net.russotto.AtmelMACFW is used under the GPL license version 2.
  17     This file contains the module in binary form and, under the terms
  18     of the GPL, in source form. The source is located at the end of the file.
  19
  20     This program is free software; you can redistribute it and/or modify
  21     it under the terms of the GNU General Public License as published by
  22     the Free Software Foundation; either version 2 of the License, or
  23     (at your option) any later version.
  24
  25     This software is distributed in the hope that it will be useful,
  26     but WITHOUT ANY WARRANTY; without even the implied warranty of
  27     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  28     GNU General Public License for more details.
  29
  30     You should have received a copy of the GNU General Public License
  31     along with Atmel wireless lan drivers; if not, write to the Free Software
  32     Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  33
  34     For all queries about this code, please contact the current author,
  35     Simon Kelley <simon@thekelleys.org.uk> and not Atmel Corporation.
  36
  37     Credit is due to HP UK and Cambridge Online Systems Ltd for supplying
  38     hardware used during development of this driver.
  39
  40 ******************************************************************************/
  41
  42 #include <linux/init.h>
  43
  44 #include <linux/kernel.h>
  45 #include <linux/ptrace.h>
  46 #include <linux/slab.h>
  47 #include <linux/string.h>
  48 #include <linux/ctype.h>
  49 #include <linux/timer.h>
  50 #include <asm/byteorder.h>
  51 #include <asm/io.h>
  52 #include <asm/system.h>
  53 #include <asm/uaccess.h>
  54 #include <linux/module.h>
  55 #include <linux/netdevice.h>
  56 #include <linux/etherdevice.h>
  57 #include <linux/skbuff.h>
  58 #include <linux/if_arp.h>
  59 #include <linux/ioport.h>
  60 #include <linux/fcntl.h>
  61 #include <linux/delay.h>
  62 #include <linux/wireless.h>
  63 #include <net/iw_handler.h>
  64 #include <linux/crc32.h>
  65 #include <linux/proc_fs.h>
  66 #include <linux/device.h>
  67 #include <linux/moduleparam.h>
  68 #include <linux/firmware.h>
  69 #include <linux/jiffies.h>
  70 #include <net/ieee80211.h>
  71 #include "atmel.h"
  72
  73 #define DRIVER_MAJOR 0
  74 #define DRIVER_MINOR 98
  75
  76 MODULE_AUTHOR("Simon Kelley");
  77 MODULE_DESCRIPTION("Support for Atmel at76c50x 802.11 wireless ethernet cards.");
  78 MODULE_LICENSE("GPL");
  79 MODULE_SUPPORTED_DEVICE("Atmel at76c50x wireless cards");
  80
  81 /* The name of the firmware file to be loaded
  82    over-rides any automatic selection */
  83 static char *firmware = NULL;
  84 module_param(firmware, charp, 0);
  85
  86 /* table of firmware file names */
  87 static struct {
  88         AtmelFWType fw_type;
  89         const char *fw_file;
  90         const char *fw_file_ext;
  91 } fw_table[] = {
  92         { ATMEL_FW_TYPE_502,      "atmel_at76c502",      "bin" },
  93         { ATMEL_FW_TYPE_502D,     "atmel_at76c502d",     "bin" },
  94         { ATMEL_FW_TYPE_502E,     "atmel_at76c502e",     "bin" },
  95         { ATMEL_FW_TYPE_502_3COM, "atmel_at76c502_3com", "bin" },
  96         { ATMEL_FW_TYPE_504,      "atmel_at76c504",      "bin" },
  97         { ATMEL_FW_TYPE_504_2958, "atmel_at76c504_2958", "bin" },
  98         { ATMEL_FW_TYPE_504A_2958,"atmel_at76c504a_2958","bin" },
  99         { ATMEL_FW_TYPE_506,      "atmel_at76c506",      "bin" },
 100         { ATMEL_FW_TYPE_NONE,      NULL,                  NULL }
 101 };
 102
 103 #define MAX_SSID_LENGTH 32
 104 #define MGMT_JIFFIES (256 * HZ / 100)
 105
 106 #define MAX_BSS_ENTRIES 64
 107
 108 /* registers */
 109 #define GCR  0x00    //      (SIR0)  General Configuration Register
 110 #define BSR  0x02    //      (SIR1)  Bank Switching Select Register
 111 #define AR   0x04
 112 #define DR   0x08
 113 #define MR1  0x12    //      Mirror Register 1
 114 #define MR2  0x14    //      Mirror Register 2
 115 #define MR3  0x16    //      Mirror Register 3
 116 #define MR4  0x18    //      Mirror Register 4
 117
 118 #define GPR1                            0x0c
 119 #define GPR2                            0x0e
 120 #define GPR3                            0x10
 121 //
 122 // Constants for the GCR register.
 123 //
 124 #define GCR_REMAP     0x0400          // Remap internal SRAM to 0
 125 #define GCR_SWRES     0x0080          // BIU reset (ARM and PAI are NOT reset)
 126 #define GCR_CORES     0x0060          // Core Reset (ARM and PAI are reset)
 127 #define GCR_ENINT     0x0002          // Enable Interrupts
 128 #define GCR_ACKINT    0x0008          // Acknowledge Interrupts
 129
 130 #define BSS_SRAM      0x0200          // AMBA module selection --> SRAM
 131 #define BSS_IRAM      0x0100          // AMBA module selection --> IRAM
 132 //
 133 // Constants for the MR registers.
 134 //
 135 #define MAC_INIT_COMPLETE       0x0001        // MAC init has been completed
 136 #define MAC_BOOT_COMPLETE       0x0010        // MAC boot has been completed
 137 #define MAC_INIT_OK             0x0002        // MAC boot has been completed
 138
 139 #define MIB_MAX_DATA_BYTES    212
 140 #define MIB_HEADER_SIZE       4    /* first four fields */
 141
 142 struct get_set_mib {
 143         u8 type;
 144         u8 size;
 145         u8 index;
 146         u8 reserved;
 147         u8 data[MIB_MAX_DATA_BYTES];
 148 };
 149
 150 struct rx_desc {
 151         u32          Next;
 152         u16          MsduPos;
 153         u16          MsduSize;
 154
 155         u8           State;
 156         u8           Status;
 157         u8           Rate;
 158         u8           Rssi;
 159         u8           LinkQuality;
 160         u8           PreambleType;
 161         u16          Duration;
 162         u32          RxTime;
 163 };
 164
 165 #define RX_DESC_FLAG_VALID       0x80
 166 #define RX_DESC_FLAG_CONSUMED    0x40
 167 #define RX_DESC_FLAG_IDLE        0x00
 168
 169 #define RX_STATUS_SUCCESS        0x00
 170
 171 #define RX_DESC_MSDU_POS_OFFSET      4
 172 #define RX_DESC_MSDU_SIZE_OFFSET     6
 173 #define RX_DESC_FLAGS_OFFSET         8
 174 #define RX_DESC_STATUS_OFFSET        9
 175 #define RX_DESC_RSSI_OFFSET          11
 176 #define RX_DESC_LINK_QUALITY_OFFSET  12
 177 #define RX_DESC_PREAMBLE_TYPE_OFFSET 13
 178 #define RX_DESC_DURATION_OFFSET      14
 179 #define RX_DESC_RX_TIME_OFFSET       16
 180
 181 struct tx_desc {
 182         u32       NextDescriptor;
 183         u16       TxStartOfFrame;
 184         u16       TxLength;
 185
 186         u8        TxState;
 187         u8        TxStatus;
 188         u8        RetryCount;
 189
 190         u8        TxRate;
 191
 192         u8        KeyIndex;
 193         u8        ChiperType;
 194         u8        ChipreLength;
 195         u8        Reserved1;
 196
 197         u8        Reserved;
 198         u8        PacketType;
 199         u16       HostTxLength;
 200 };
 201
 202 #define TX_DESC_NEXT_OFFSET          0
 203 #define TX_DESC_POS_OFFSET           4
 204 #define TX_DESC_SIZE_OFFSET          6
 205 #define TX_DESC_FLAGS_OFFSET         8
 206 #define TX_DESC_STATUS_OFFSET        9
 207 #define TX_DESC_RETRY_OFFSET         10
 208 #define TX_DESC_RATE_OFFSET          11
 209 #define TX_DESC_KEY_INDEX_OFFSET     12
 210 #define TX_DESC_CIPHER_TYPE_OFFSET   13
 211 #define TX_DESC_CIPHER_LENGTH_OFFSET 14
 212 #define TX_DESC_PACKET_TYPE_OFFSET   17
 213 #define TX_DESC_HOST_LENGTH_OFFSET   18
 214
 215 ///////////////////////////////////////////////////////
 216 // Host-MAC interface
 217 ///////////////////////////////////////////////////////
 218
 219 #define TX_STATUS_SUCCESS       0x00
 220
 221 #define TX_FIRM_OWN             0x80
 222 #define TX_DONE                 0x40
 223
 224 #define TX_ERROR                0x01
 225
 226 #define TX_PACKET_TYPE_DATA     0x01
 227 #define TX_PACKET_TYPE_MGMT     0x02
 228
 229 #define ISR_EMPTY               0x00        // no bits set in ISR
 230 #define ISR_TxCOMPLETE          0x01        // packet transmitted
 231 #define ISR_RxCOMPLETE          0x02        // packet received
 232 #define ISR_RxFRAMELOST         0x04        // Rx Frame lost
 233 #define ISR_FATAL_ERROR         0x08        // Fatal error
 234 #define ISR_COMMAND_COMPLETE    0x10        // command completed
 235 #define ISR_OUT_OF_RANGE        0x20        // command completed
 236 #define ISR_IBSS_MERGE          0x40        // (4.1.2.30): IBSS merge
 237 #define ISR_GENERIC_IRQ         0x80
 238
 239 #define Local_Mib_Type          0x01
 240 #define Mac_Address_Mib_Type    0x02
 241 #define Mac_Mib_Type            0x03
 242 #define Statistics_Mib_Type     0x04
 243 #define Mac_Mgmt_Mib_Type       0x05
 244 #define Mac_Wep_Mib_Type        0x06
 245 #define Phy_Mib_Type            0x07
 246 #define Multi_Domain_MIB        0x08
 247
 248 #define MAC_MGMT_MIB_CUR_BSSID_POS            14
 249 #define MAC_MIB_FRAG_THRESHOLD_POS            8
 250 #define MAC_MIB_RTS_THRESHOLD_POS             10
 251 #define MAC_MIB_SHORT_RETRY_POS               16
 252 #define MAC_MIB_LONG_RETRY_POS                17
 253 #define MAC_MIB_SHORT_RETRY_LIMIT_POS         16
 254 #define MAC_MGMT_MIB_BEACON_PER_POS           0
 255 #define MAC_MGMT_MIB_STATION_ID_POS           6
 256 #define MAC_MGMT_MIB_CUR_PRIVACY_POS          11
 257 #define MAC_MGMT_MIB_CUR_BSSID_POS            14
 258 #define MAC_MGMT_MIB_PS_MODE_POS              53
 259 #define MAC_MGMT_MIB_LISTEN_INTERVAL_POS      54
 260 #define MAC_MGMT_MIB_MULTI_DOMAIN_IMPLEMENTED 56
 261 #define MAC_MGMT_MIB_MULTI_DOMAIN_ENABLED     57
 262 #define PHY_MIB_CHANNEL_POS                   14
 263 #define PHY_MIB_RATE_SET_POS                  20
 264 #define PHY_MIB_REG_DOMAIN_POS                26
 265 #define LOCAL_MIB_AUTO_TX_RATE_POS            3
 266 #define LOCAL_MIB_SSID_SIZE                   5
 267 #define LOCAL_MIB_TX_PROMISCUOUS_POS          6
 268 #define LOCAL_MIB_TX_MGMT_RATE_POS            7
 269 #define LOCAL_MIB_TX_CONTROL_RATE_POS         8
 270 #define LOCAL_MIB_PREAMBLE_TYPE               9
 271 #define MAC_ADDR_MIB_MAC_ADDR_POS             0
 272
 273 #define         CMD_Set_MIB_Vars              0x01
 274 #define         CMD_Get_MIB_Vars              0x02
 275 #define         CMD_Scan                      0x03
 276 #define         CMD_Join                      0x04
 277 #define         CMD_Start                     0x05
 278 #define         CMD_EnableRadio               0x06
 279 #define         CMD_DisableRadio              0x07
 280 #define         CMD_SiteSurvey                0x0B
 281
 282 #define         CMD_STATUS_IDLE                   0x00
 283 #define         CMD_STATUS_COMPLETE               0x01
 284 #define         CMD_STATUS_UNKNOWN                0x02
 285 #define         CMD_STATUS_INVALID_PARAMETER      0x03
 286 #define         CMD_STATUS_FUNCTION_NOT_SUPPORTED 0x04
 287 #define         CMD_STATUS_TIME_OUT               0x07
 288 #define         CMD_STATUS_IN_PROGRESS            0x08
 289 #define         CMD_STATUS_REJECTED_RADIO_OFF     0x09
 290 #define         CMD_STATUS_HOST_ERROR             0xFF
 291 #define         CMD_STATUS_BUSY                   0xFE
 292
 293 #define CMD_BLOCK_COMMAND_OFFSET        0
 294 #define CMD_BLOCK_STATUS_OFFSET         1
 295 #define CMD_BLOCK_PARAMETERS_OFFSET     4
 296
 297 #define SCAN_OPTIONS_SITE_SURVEY        0x80
 298
 299 #define MGMT_FRAME_BODY_OFFSET          24
 300 #define MAX_AUTHENTICATION_RETRIES      3
 301 #define MAX_ASSOCIATION_RETRIES         3
 302
 303 #define AUTHENTICATION_RESPONSE_TIME_OUT  1000
 304
 305 #define MAX_WIRELESS_BODY  2316 /* mtu is 2312, CRC is 4 */
 306 #define LOOP_RETRY_LIMIT   500000
 307
 308 #define ACTIVE_MODE     1
 309 #define PS_MODE         2
 310
 311 #define MAX_ENCRYPTION_KEYS 4
 312 #define MAX_ENCRYPTION_KEY_SIZE 40
 313
 314 ///////////////////////////////////////////////////////////////////////////
 315 // 802.11 related definitions
 316 ///////////////////////////////////////////////////////////////////////////
 317
 318 //
 319 // Regulatory Domains
 320 //
 321
 322 #define REG_DOMAIN_FCC          0x10    //Channels      1-11    USA
 323 #define REG_DOMAIN_DOC          0x20    //Channel       1-11    Canada
 324 #define REG_DOMAIN_ETSI         0x30    //Channel       1-13    Europe (ex Spain/France)
 325 #define REG_DOMAIN_SPAIN        0x31    //Channel       10-11   Spain
 326 #define REG_DOMAIN_FRANCE       0x32    //Channel       10-13   France
 327 #define REG_DOMAIN_MKK          0x40    //Channel       14      Japan
 328 #define REG_DOMAIN_MKK1         0x41    //Channel       1-14    Japan(MKK1)
 329 #define REG_DOMAIN_ISRAEL       0x50    //Channel       3-9     ISRAEL
 330
 331 #define BSS_TYPE_AD_HOC         1
 332 #define BSS_TYPE_INFRASTRUCTURE 2
 333
 334 #define SCAN_TYPE_ACTIVE        0
 335 #define SCAN_TYPE_PASSIVE       1
 336
 337 #define LONG_PREAMBLE           0
 338 #define SHORT_PREAMBLE          1
 339 #define AUTO_PREAMBLE           2
 340
 341 #define DATA_FRAME_WS_HEADER_SIZE   30
 342
 343 /* promiscuous mode control */
 344 #define PROM_MODE_OFF                   0x0
 345 #define PROM_MODE_UNKNOWN               0x1
 346 #define PROM_MODE_CRC_FAILED            0x2
 347 #define PROM_MODE_DUPLICATED            0x4
 348 #define PROM_MODE_MGMT                  0x8
 349 #define PROM_MODE_CTRL                  0x10
 350 #define PROM_MODE_BAD_PROTOCOL          0x20
 351
 352 #define IFACE_INT_STATUS_OFFSET         0
 353 #define IFACE_INT_MASK_OFFSET           1
 354 #define IFACE_LOCKOUT_HOST_OFFSET       2
 355 #define IFACE_LOCKOUT_MAC_OFFSET        3
 356 #define IFACE_FUNC_CTRL_OFFSET          28
 357 #define IFACE_MAC_STAT_OFFSET           30
 358 #define IFACE_GENERIC_INT_TYPE_OFFSET   32
 359
 360 #define CIPHER_SUITE_NONE     0
 361 #define CIPHER_SUITE_WEP_64   1
 362 #define CIPHER_SUITE_TKIP     2
 363 #define CIPHER_SUITE_AES      3
 364 #define CIPHER_SUITE_CCX      4
 365 #define CIPHER_SUITE_WEP_128  5
 366
 367 //
 368 // IFACE MACROS & definitions
 369 //
 370 //
 371
 372 // FuncCtrl field:
 373 //
 374 #define FUNC_CTRL_TxENABLE              0x10
 375 #define FUNC_CTRL_RxENABLE              0x20
 376 #define FUNC_CTRL_INIT_COMPLETE         0x01
 377
 378 /* A stub firmware image which reads the MAC address from NVRAM on the card.
 379    For copyright information and source see the end of this file. */
 380 static u8 mac_reader[] = {
 381         0x06,0x00,0x00,0xea,0x04,0x00,0x00,0xea,0x03,0x00,0x00,0xea,0x02,0x00,0x00,0xea,
 382         0x01,0x00,0x00,0xea,0x00,0x00,0x00,0xea,0xff,0xff,0xff,0xea,0xfe,0xff,0xff,0xea,
 383         0xd3,0x00,0xa0,0xe3,0x00,0xf0,0x21,0xe1,0x0e,0x04,0xa0,0xe3,0x00,0x10,0xa0,0xe3,
 384         0x81,0x11,0xa0,0xe1,0x00,0x10,0x81,0xe3,0x00,0x10,0x80,0xe5,0x1c,0x10,0x90,0xe5,
 385         0x10,0x10,0xc1,0xe3,0x1c,0x10,0x80,0xe5,0x01,0x10,0xa0,0xe3,0x08,0x10,0x80,0xe5,
 386         0x02,0x03,0xa0,0xe3,0x00,0x10,0xa0,0xe3,0xb0,0x10,0xc0,0xe1,0xb4,0x10,0xc0,0xe1,
 387         0xb8,0x10,0xc0,0xe1,0xbc,0x10,0xc0,0xe1,0x56,0xdc,0xa0,0xe3,0x21,0x00,0x00,0xeb,
 388         0x0a,0x00,0xa0,0xe3,0x1a,0x00,0x00,0xeb,0x10,0x00,0x00,0xeb,0x07,0x00,0x00,0xeb,
 389         0x02,0x03,0xa0,0xe3,0x02,0x14,0xa0,0xe3,0xb4,0x10,0xc0,0xe1,0x4c,0x10,0x9f,0xe5,
 390         0xbc,0x10,0xc0,0xe1,0x10,0x10,0xa0,0xe3,0xb8,0x10,0xc0,0xe1,0xfe,0xff,0xff,0xea,
 391         0x00,0x40,0x2d,0xe9,0x00,0x20,0xa0,0xe3,0x02,0x3c,0xa0,0xe3,0x00,0x10,0xa0,0xe3,
 392         0x28,0x00,0x9f,0xe5,0x37,0x00,0x00,0xeb,0x00,0x40,0xbd,0xe8,0x1e,0xff,0x2f,0xe1,
 393         0x00,0x40,0x2d,0xe9,0x12,0x2e,0xa0,0xe3,0x06,0x30,0xa0,0xe3,0x00,0x10,0xa0,0xe3,
 394         0x02,0x04,0xa0,0xe3,0x2f,0x00,0x00,0xeb,0x00,0x40,0xbd,0xe8,0x1e,0xff,0x2f,0xe1,
 395         0x00,0x02,0x00,0x02,0x80,0x01,0x90,0xe0,0x01,0x00,0x00,0x0a,0x01,0x00,0x50,0xe2,
 396         0xfc,0xff,0xff,0xea,0x1e,0xff,0x2f,0xe1,0x80,0x10,0xa0,0xe3,0xf3,0x06,0xa0,0xe3,
 397         0x00,0x10,0x80,0xe5,0x00,0x10,0xa0,0xe3,0x00,0x10,0x80,0xe5,0x01,0x10,0xa0,0xe3,
 398         0x04,0x10,0x80,0xe5,0x00,0x10,0x80,0xe5,0x0e,0x34,0xa0,0xe3,0x1c,0x10,0x93,0xe5,
 399         0x02,0x1a,0x81,0xe3,0x1c,0x10,0x83,0xe5,0x58,0x11,0x9f,0xe5,0x30,0x10,0x80,0xe5,
 400         0x54,0x11,0x9f,0xe5,0x34,0x10,0x80,0xe5,0x38,0x10,0x80,0xe5,0x3c,0x10,0x80,0xe5,
 401         0x10,0x10,0x90,0xe5,0x08,0x00,0x90,0xe5,0x1e,0xff,0x2f,0xe1,0xf3,0x16,0xa0,0xe3,
 402         0x08,0x00,0x91,0xe5,0x05,0x00,0xa0,0xe3,0x0c,0x00,0x81,0xe5,0x10,0x00,0x91,0xe5,
 403         0x02,0x00,0x10,0xe3,0xfc,0xff,0xff,0x0a,0xff,0x00,0xa0,0xe3,0x0c,0x00,0x81,0xe5,
 404         0x10,0x00,0x91,0xe5,0x02,0x00,0x10,0xe3,0xfc,0xff,0xff,0x0a,0x08,0x00,0x91,0xe5,
 405         0x10,0x00,0x91,0xe5,0x01,0x00,0x10,0xe3,0xfc,0xff,0xff,0x0a,0x08,0x00,0x91,0xe5,
 406         0xff,0x00,0x00,0xe2,0x1e,0xff,0x2f,0xe1,0x30,0x40,0x2d,0xe9,0x00,0x50,0xa0,0xe1,
 407         0x03,0x40,0xa0,0xe1,0xa2,0x02,0xa0,0xe1,0x08,0x00,0x00,0xe2,0x03,0x00,0x80,0xe2,
 408         0xd8,0x10,0x9f,0xe5,0x00,0x00,0xc1,0xe5,0x01,0x20,0xc1,0xe5,0xe2,0xff,0xff,0xeb,
 409         0x01,0x00,0x10,0xe3,0xfc,0xff,0xff,0x1a,0x14,0x00,0xa0,0xe3,0xc4,0xff,0xff,0xeb,
 410         0x04,0x20,0xa0,0xe1,0x05,0x10,0xa0,0xe1,0x02,0x00,0xa0,0xe3,0x01,0x00,0x00,0xeb,
 411         0x30,0x40,0xbd,0xe8,0x1e,0xff,0x2f,0xe1,0x70,0x40,0x2d,0xe9,0xf3,0x46,0xa0,0xe3,
 412         0x00,0x30,0xa0,0xe3,0x00,0x00,0x50,0xe3,0x08,0x00,0x00,0x9a,0x8c,0x50,0x9f,0xe5,
 413         0x03,0x60,0xd5,0xe7,0x0c,0x60,0x84,0xe5,0x10,0x60,0x94,0xe5,0x02,0x00,0x16,0xe3,
 414         0xfc,0xff,0xff,0x0a,0x01,0x30,0x83,0xe2,0x00,0x00,0x53,0xe1,0xf7,0xff,0xff,0x3a,
 415         0xff,0x30,0xa0,0xe3,0x0c,0x30,0x84,0xe5,0x08,0x00,0x94,0xe5,0x10,0x00,0x94,0xe5,
 416         0x01,0x00,0x10,0xe3,0xfc,0xff,0xff,0x0a,0x08,0x00,0x94,0xe5,0x00,0x00,0xa0,0xe3,
 417         0x00,0x00,0x52,0xe3,0x0b,0x00,0x00,0x9a,0x10,0x50,0x94,0xe5,0x02,0x00,0x15,0xe3,
 418         0xfc,0xff,0xff,0x0a,0x0c,0x30,0x84,0xe5,0x10,0x50,0x94,0xe5,0x01,0x00,0x15,0xe3,
 419         0xfc,0xff,0xff,0x0a,0x08,0x50,0x94,0xe5,0x01,0x50,0xc1,0xe4,0x01,0x00,0x80,0xe2,
 420         0x02,0x00,0x50,0xe1,0xf3,0xff,0xff,0x3a,0xc8,0x00,0xa0,0xe3,0x98,0xff,0xff,0xeb,
 421         0x70,0x40,0xbd,0xe8,0x1e,0xff,0x2f,0xe1,0x01,0x0c,0x00,0x02,0x01,0x02,0x00,0x02,
 422         0x00,0x01,0x00,0x02
 423 };
 424
 425 struct atmel_private {
 426         void *card; /* Bus dependent stucture varies for PCcard */
 427         int (*present_callback)(void *); /* And callback which uses it */
 428         char firmware_id[32];
 429         AtmelFWType firmware_type;
 430         u8 *firmware;
 431         int firmware_length;
 432         struct timer_list management_timer;
 433         struct net_device *dev;
 434         struct device *sys_dev;
 435         struct iw_statistics wstats;
 436         spinlock_t irqlock, timerlock;  // spinlocks
 437         enum { BUS_TYPE_PCCARD, BUS_TYPE_PCI } bus_type;
 438         enum {
 439                 CARD_TYPE_PARALLEL_FLASH,
 440                 CARD_TYPE_SPI_FLASH,
 441                 CARD_TYPE_EEPROM
 442         } card_type;
 443         int do_rx_crc; /* If we need to CRC incoming packets */
 444         int probe_crc; /* set if we don't yet know */
 445         int crc_ok_cnt, crc_ko_cnt; /* counters for probing */
 446         u16 rx_desc_head;
 447         u16 tx_desc_free, tx_desc_head, tx_desc_tail, tx_desc_previous;
 448         u16 tx_free_mem, tx_buff_head, tx_buff_tail;
 449
 450         u16 frag_seq, frag_len, frag_no;
 451         u8 frag_source[6];
 452
 453         u8 wep_is_on, default_key, exclude_unencrypted, encryption_level;
 454         u8 group_cipher_suite, pairwise_cipher_suite;
 455         u8 wep_keys[MAX_ENCRYPTION_KEYS][MAX_ENCRYPTION_KEY_SIZE];
 456         int wep_key_len[MAX_ENCRYPTION_KEYS];
 457         int use_wpa, radio_on_broken; /* firmware dependent stuff. */
 458
 459         u16 host_info_base;
 460         struct host_info_struct {
 461                 /* NB this is matched to the hardware, don't change. */
 462                 u8 volatile int_status;
 463                 u8 volatile int_mask;
 464                 u8 volatile lockout_host;
 465                 u8 volatile lockout_mac;
 466
 467                 u16 tx_buff_pos;
 468                 u16 tx_buff_size;
 469                 u16 tx_desc_pos;
 470                 u16 tx_desc_count;
 471
 472                 u16 rx_buff_pos;
 473                 u16 rx_buff_size;
 474                 u16 rx_desc_pos;
 475                 u16 rx_desc_count;
 476
 477                 u16 build_version;
 478                 u16 command_pos;
 479
 480                 u16 major_version;
 481                 u16 minor_version;
 482
 483                 u16 func_ctrl;
 484                 u16 mac_status;
 485                 u16 generic_IRQ_type;
 486                 u8  reserved[2];
 487         } host_info;
 488
 489         enum {
 490                 STATION_STATE_SCANNING,
 491                 STATION_STATE_JOINNING,
 492                 STATION_STATE_AUTHENTICATING,
 493                 STATION_STATE_ASSOCIATING,
 494                 STATION_STATE_READY,
 495                 STATION_STATE_REASSOCIATING,
 496                 STATION_STATE_DOWN,
 497                 STATION_STATE_MGMT_ERROR
 498         } station_state;
 499
 500         int operating_mode, power_mode;
 501         time_t last_qual;
 502         int beacons_this_sec;
 503         int channel;
 504         int reg_domain, config_reg_domain;
 505         int tx_rate;
 506         int auto_tx_rate;
 507         int rts_threshold;
 508         int frag_threshold;
 509         int long_retry, short_retry;
 510         int preamble;
 511         int default_beacon_period, beacon_period, listen_interval;
 512         int CurrentAuthentTransactionSeqNum, ExpectedAuthentTransactionSeqNum;
 513         int AuthenticationRequestRetryCnt, AssociationRequestRetryCnt, ReAssociationRequestRetryCnt;
 514         enum {
 515                 SITE_SURVEY_IDLE,
 516                 SITE_SURVEY_IN_PROGRESS,
 517                 SITE_SURVEY_COMPLETED
 518         } site_survey_state;
 519         unsigned long last_survey;
 520
 521         int station_was_associated, station_is_associated;
 522         int fast_scan;
 523
 524         struct bss_info {
 525                 int channel;
 526                 int SSIDsize;
 527                 int RSSI;
 528                 int UsingWEP;
 529                 int preamble;
 530                 int beacon_period;
 531                 int BSStype;
 532                 u8 BSSID[6];
 533                 u8 SSID[MAX_SSID_LENGTH];
 534         } BSSinfo[MAX_BSS_ENTRIES];
 535         int BSS_list_entries, current_BSS;
 536         int connect_to_any_BSS;
 537         int SSID_size, new_SSID_size;
 538         u8 CurrentBSSID[6], BSSID[6];
 539         u8 SSID[MAX_SSID_LENGTH], new_SSID[MAX_SSID_LENGTH];
 540         u64 last_beacon_timestamp;
 541         u8 rx_buf[MAX_WIRELESS_BODY];
 542 };
 543
 544 static u8 atmel_basic_rates[4] = {0x82,0x84,0x0b,0x16};
 545
 546 static const struct {
 547         int reg_domain;
 548         int min, max;
 549         char *name;
 550 } channel_table[] = { { REG_DOMAIN_FCC, 1, 11, "USA" },
 551                       { REG_DOMAIN_DOC, 1, 11, "Canada" },
 552                       { REG_DOMAIN_ETSI, 1, 13, "Europe" },
 553                       { REG_DOMAIN_SPAIN, 10, 11, "Spain" },
 554                       { REG_DOMAIN_FRANCE, 10, 13, "France" },
 555                       { REG_DOMAIN_MKK, 14, 14, "MKK" },
 556                       { REG_DOMAIN_MKK1, 1, 14, "MKK1" },
 557                       { REG_DOMAIN_ISRAEL, 3, 9, "Israel"} };
 558
 559 static void build_wpa_mib(struct atmel_private *priv);
 560 static int atmel_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
 561 static void atmel_copy_to_card(struct net_device *dev, u16 dest,
 562                                const unsigned char *src, u16 len);
 563 static void atmel_copy_to_host(struct net_device *dev, unsigned char *dest,
 564                                u16 src, u16 len);
 565 static void atmel_set_gcr(struct net_device *dev, u16 mask);
 566 static void atmel_clear_gcr(struct net_device *dev, u16 mask);
 567 static int atmel_lock_mac(struct atmel_private *priv);
 568 static void atmel_wmem32(struct atmel_private *priv, u16 pos, u32 data);
 569 static void atmel_command_irq(struct atmel_private *priv);
 570 static int atmel_validate_channel(struct atmel_private *priv, int channel);
 571 static void atmel_management_frame(struct atmel_private *priv,
 572                                    struct ieee80211_hdr_4addr *header,
 573                                    u16 frame_len, u8 rssi);
 574 static void atmel_management_timer(u_long a);
 575 static void atmel_send_command(struct atmel_private *priv, int command,
 576                                void *cmd, int cmd_size);
 577 static int atmel_send_command_wait(struct atmel_private *priv, int command,
 578                                    void *cmd, int cmd_size);
 579 static void atmel_transmit_management_frame(struct atmel_private *priv,
 580                                             struct ieee80211_hdr_4addr *header,
 581                                             u8 *body, int body_len);
 582
 583 static u8 atmel_get_mib8(struct atmel_private *priv, u8 type, u8 index);
 584 static void atmel_set_mib8(struct atmel_private *priv, u8 type, u8 index,
 585                            u8 data);
 586 static void atmel_set_mib16(struct atmel_private *priv, u8 type, u8 index,
 587                             u16 data);
 588 static void atmel_set_mib(struct atmel_private *priv, u8 type, u8 index,
 589                           u8 *data, int data_len);
 590 static void atmel_get_mib(struct atmel_private *priv, u8 type, u8 index,
 591                           u8 *data, int data_len);
 592 static void atmel_scan(struct atmel_private *priv, int specific_ssid);
 593 static void atmel_join_bss(struct atmel_private *priv, int bss_index);
 594 static void atmel_smooth_qual(struct atmel_private *priv);
 595 static void atmel_writeAR(struct net_device *dev, u16 data);
 596 static int probe_atmel_card(struct net_device *dev);
 597 static int reset_atmel_card(struct net_device *dev);
 598 static void atmel_enter_state(struct atmel_private *priv, int new_state);
 599 int atmel_open (struct net_device *dev);
 600
 601 static inline u16 atmel_hi(struct atmel_private *priv, u16 offset)
 602 {
 603         return priv->host_info_base + offset;
 604 }
 605
 606 static inline u16 atmel_co(struct atmel_private *priv, u16 offset)
 607 {
 608         return priv->host_info.command_pos + offset;
 609 }
 610
 611 static inline u16 atmel_rx(struct atmel_private *priv, u16 offset, u16 desc)
 612 {
 613         return priv->host_info.rx_desc_pos + (sizeof(struct rx_desc) * desc) + offset;
 614 }
 615
 616 static inline u16 atmel_tx(struct atmel_private *priv, u16 offset, u16 desc)
 617 {
 618         return priv->host_info.tx_desc_pos + (sizeof(struct tx_desc) * desc) + offset;
 619 }
 620
 621 static inline u8 atmel_read8(struct net_device *dev, u16 offset)
 622 {
 623         return inb(dev->base_addr + offset);
 624 }
 625
 626 static inline void atmel_write8(struct net_device *dev, u16 offset, u8 data)
 627 {
 628         outb(data, dev->base_addr + offset);
 629 }
 630
 631 static inline u16 atmel_read16(struct net_device *dev, u16 offset)
 632 {
 633         return inw(dev->base_addr + offset);
 634 }
 635
 636 static inline void atmel_write16(struct net_device *dev, u16 offset, u16 data)
 637 {
 638         outw(data, dev->base_addr + offset);
 639 }
 640
 641 static inline u8 atmel_rmem8(struct atmel_private *priv, u16 pos)
 642 {
 643         atmel_writeAR(priv->dev, pos);
 644         return atmel_read8(priv->dev, DR);
 645 }
 646
 647 static inline void atmel_wmem8(struct atmel_private *priv, u16 pos, u16 data)
 648 {
 649         atmel_writeAR(priv->dev, pos);
 650         atmel_write8(priv->dev, DR, data);
 651 }
 652
 653 static inline u16 atmel_rmem16(struct atmel_private *priv, u16 pos)
 654 {
 655         atmel_writeAR(priv->dev, pos);
 656         return atmel_read16(priv->dev, DR);
 657 }
 658
 659 static inline void atmel_wmem16(struct atmel_private *priv, u16 pos, u16 data)
 660 {
 661         atmel_writeAR(priv->dev, pos);
 662         atmel_write16(priv->dev, DR, data);
 663 }
 664
 665 static const struct iw_handler_def atmel_handler_def;
 666
 667 static void tx_done_irq(struct atmel_private *priv)
 668 {
 669         int i;
 670
 671         for (i = 0;
 672              atmel_rmem8(priv, atmel_tx(priv, TX_DESC_FLAGS_OFFSET, priv->tx_desc_head)) == TX_DONE &&
 673                      i < priv->host_info.tx_desc_count;
 674              i++) {
 675                 u8 status = atmel_rmem8(priv, atmel_tx(priv, TX_DESC_STATUS_OFFSET, priv->tx_desc_head));
 676                 u16 msdu_size = atmel_rmem16(priv, atmel_tx(priv, TX_DESC_SIZE_OFFSET, priv->tx_desc_head));
 677                 u8 type = atmel_rmem8(priv, atmel_tx(priv, TX_DESC_PACKET_TYPE_OFFSET, priv->tx_desc_head));
 678
 679                 atmel_wmem8(priv, atmel_tx(priv, TX_DESC_FLAGS_OFFSET, priv->tx_desc_head), 0);
 680
 681                 priv->tx_free_mem += msdu_size;
 682                 priv->tx_desc_free++;
 683
 684                 if (priv->tx_buff_head + msdu_size > (priv->host_info.tx_buff_pos + priv->host_info.tx_buff_size))
 685                         priv->tx_buff_head = 0;
 686                 else
 687                         priv->tx_buff_head += msdu_size;
 688
 689                 if (priv->tx_desc_head < (priv->host_info.tx_desc_count - 1))
 690                         priv->tx_desc_head++ ;
 691                 else
 692                         priv->tx_desc_head = 0;
 693
 694                 if (type == TX_PACKET_TYPE_DATA) {
 695                         if (status == TX_STATUS_SUCCESS)
 696                                 priv->dev->stats.tx_packets++;
 697                         else
 698                                 priv->dev->stats.tx_errors++;
 699                         netif_wake_queue(priv->dev);
 700                 }
 701         }
 702 }
 703
 704 static u16 find_tx_buff(struct atmel_private *priv, u16 len)
 705 {
 706         u16 bottom_free = priv->host_info.tx_buff_size - priv->tx_buff_tail;
 707
 708         if (priv->tx_desc_free == 3 || priv->tx_free_mem < len)
 709                 return 0;
 710
 711         if (bottom_free >= len)
 712                 return priv->host_info.tx_buff_pos + priv->tx_buff_tail;
 713
 714         if (priv->tx_free_mem - bottom_free >= len) {
 715                 priv->tx_buff_tail = 0;
 716                 return priv->host_info.tx_buff_pos;
 717         }
 718
 719         return 0;
 720 }
 721
 722 static void tx_update_descriptor(struct atmel_private *priv, int is_bcast,
 723                                  u16 len, u16 buff, u8 type)
 724 {
 725         atmel_wmem16(priv, atmel_tx(priv, TX_DESC_POS_OFFSET, priv->tx_desc_tail), buff);
 726         atmel_wmem16(priv, atmel_tx(priv, TX_DESC_SIZE_OFFSET, priv->tx_desc_tail), len);
 727         if (!priv->use_wpa)
 728                 atmel_wmem16(priv, atmel_tx(priv, TX_DESC_HOST_LENGTH_OFFSET, priv->tx_desc_tail), len);
 729         atmel_wmem8(priv, atmel_tx(priv, TX_DESC_PACKET_TYPE_OFFSET, priv->tx_desc_tail), type);
 730         atmel_wmem8(priv, atmel_tx(priv, TX_DESC_RATE_OFFSET, priv->tx_desc_tail), priv->tx_rate);
 731         atmel_wmem8(priv, atmel_tx(priv, TX_DESC_RETRY_OFFSET, priv->tx_desc_tail), 0);
 732         if (priv->use_wpa) {
 733                 int cipher_type, cipher_length;
 734                 if (is_bcast) {
 735                         cipher_type = priv->group_cipher_suite;
 736                         if (cipher_type == CIPHER_SUITE_WEP_64 ||
 737                             cipher_type == CIPHER_SUITE_WEP_128)
 738                                 cipher_length = 8;
 739                         else if (cipher_type == CIPHER_SUITE_TKIP)
 740                                 cipher_length = 12;
 741                         else if (priv->pairwise_cipher_suite == CIPHER_SUITE_WEP_64 ||
 742                                  priv->pairwise_cipher_suite == CIPHER_SUITE_WEP_128) {
 743                                 cipher_type = priv->pairwise_cipher_suite;
 744                                 cipher_length = 8;
 745                         } else {
 746                                 cipher_type = CIPHER_SUITE_NONE;
 747                                 cipher_length = 0;
 748                         }
 749                 } else {
 750                         cipher_type = priv->pairwise_cipher_suite;
 751                         if (cipher_type == CIPHER_SUITE_WEP_64 ||
 752                             cipher_type == CIPHER_SUITE_WEP_128)
 753                                 cipher_length = 8;
 754                         else if (cipher_type == CIPHER_SUITE_TKIP)
 755                                 cipher_length = 12;
 756                         else if (priv->group_cipher_suite == CIPHER_SUITE_WEP_64 ||
 757                                  priv->group_cipher_suite == CIPHER_SUITE_WEP_128) {
 758                                 cipher_type = priv->group_cipher_suite;
 759                                 cipher_length = 8;
 760                         } else {
 761                                 cipher_type = CIPHER_SUITE_NONE;
 762                                 cipher_length = 0;
 763                         }
 764                 }
 765
 766                 atmel_wmem8(priv, atmel_tx(priv, TX_DESC_CIPHER_TYPE_OFFSET, priv->tx_desc_tail),
 767                             cipher_type);
 768                 atmel_wmem8(priv, atmel_tx(priv, TX_DESC_CIPHER_LENGTH_OFFSET, priv->tx_desc_tail),
 769                             cipher_length);
 770         }
 771         atmel_wmem32(priv, atmel_tx(priv, TX_DESC_NEXT_OFFSET, priv->tx_desc_tail), 0x80000000L);
 772         atmel_wmem8(priv, atmel_tx(priv, TX_DESC_FLAGS_OFFSET, priv->tx_desc_tail), TX_FIRM_OWN);
 773         if (priv->tx_desc_previous != priv->tx_desc_tail)
 774                 atmel_wmem32(priv, atmel_tx(priv, TX_DESC_NEXT_OFFSET, priv->tx_desc_previous), 0);
 775         priv->tx_desc_previous = priv->tx_desc_tail;
 776         if (priv->tx_desc_tail < (priv->host_info.tx_desc_count - 1))
 777                 priv->tx_desc_tail++;
 778         else
 779                 priv->tx_desc_tail = 0;
 780         priv->tx_desc_free--;
 781         priv->tx_free_mem -= len;
 782 }
 783
 784 static int start_tx(struct sk_buff *skb, struct net_device *dev)
 785 {
 786         static const u8 SNAP_RFC1024[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
 787         struct atmel_private *priv = netdev_priv(dev);
 788         struct ieee80211_hdr_4addr header;
 789         unsigned long flags;
 790         u16 buff, frame_ctl, len = (ETH_ZLEN < skb->len) ? skb->len : ETH_ZLEN;
 791
 792         if (priv->card && priv->present_callback &&
 793             !(*priv->present_callback)(priv->card)) {
 794                 dev->stats.tx_errors++;
 795                 dev_kfree_skb(skb);
 796                 return 0;
 797         }
 798
 799         if (priv->station_state != STATION_STATE_READY) {
 800                 dev->stats.tx_errors++;
 801                 dev_kfree_skb(skb);
 802                 return 0;
 803         }
 804
 805         /* first ensure the timer func cannot run */
 806         spin_lock_bh(&priv->timerlock);
 807         /* then stop the hardware ISR */
 808         spin_lock_irqsave(&priv->irqlock, flags);
 809         /* nb doing the above in the opposite order will deadlock */
 810
 811         /* The Wireless Header is 30 bytes. In the Ethernet packet we "cut" the
 812            12 first bytes (containing DA/SA) and put them in the appropriate
 813            fields of the Wireless Header. Thus the packet length is then the
 814            initial + 18 (+30-12) */
 815
 816         if (!(buff = find_tx_buff(priv, len + 18))) {
 817                 dev->stats.tx_dropped++;
 818                 spin_unlock_irqrestore(&priv->irqlock, flags);
 819                 spin_unlock_bh(&priv->timerlock);
 820                 netif_stop_queue(dev);
 821                 return 1;
 822         }
 823
 824         frame_ctl = IEEE80211_FTYPE_DATA;
 825         header.duration_id = 0;
 826         header.seq_ctl = 0;
 827         if (priv->wep_is_on)
 828                 frame_ctl |= IEEE80211_FCTL_PROTECTED;
 829         if (priv->operating_mode == IW_MODE_ADHOC) {
 830                 skb_copy_from_linear_data(skb, &header.addr1, 6);
 831                 memcpy(&header.addr2, dev->dev_addr, 6);
 832                 memcpy(&header.addr3, priv->BSSID, 6);
 833         } else {
 834                 frame_ctl |= IEEE80211_FCTL_TODS;
 835                 memcpy(&header.addr1, priv->CurrentBSSID, 6);
 836                 memcpy(&header.addr2, dev->dev_addr, 6);
 837                 skb_copy_from_linear_data(skb, &header.addr3, 6);
 838         }
 839
 840         if (priv->use_wpa)
 841                 memcpy(&header.addr4, SNAP_RFC1024, 6);
 842
 843         header.frame_ctl = cpu_to_le16(frame_ctl);
 844         /* Copy the wireless header into the card */
 845         atmel_copy_to_card(dev, buff, (unsigned char *)&header, DATA_FRAME_WS_HEADER_SIZE);
 846         /* Copy the packet sans its 802.3 header addresses which have been replaced */
 847         atmel_copy_to_card(dev, buff + DATA_FRAME_WS_HEADER_SIZE, skb->data + 12, len - 12);
 848         priv->tx_buff_tail += len - 12 + DATA_FRAME_WS_HEADER_SIZE;
 849
 850         /* low bit of first byte of destination tells us if broadcast */
 851         tx_update_descriptor(priv, *(skb->data) & 0x01, len + 18, buff, TX_PACKET_TYPE_DATA);
 852         dev->trans_start = jiffies;
 853         dev->stats.tx_bytes += len;
 854
 855         spin_unlock_irqrestore(&priv->irqlock, flags);
 856         spin_unlock_bh(&priv->timerlock);
 857         dev_kfree_skb(skb);
 858
 859         return 0;
 860 }
 861
 862 static void atmel_transmit_management_frame(struct atmel_private *priv,
 863                                             struct ieee80211_hdr_4addr *header,
 864                                             u8 *body, int body_len)
 865 {
 866         u16 buff;
 867         int len = MGMT_FRAME_BODY_OFFSET + body_len;
 868
 869         if (!(buff = find_tx_buff(priv, len)))
 870                 return;
 871
 872         atmel_copy_to_card(priv->dev, buff, (u8 *)header, MGMT_FRAME_BODY_OFFSET);
 873         atmel_copy_to_card(priv->dev, buff + MGMT_FRAME_BODY_OFFSET, body, body_len);
 874         priv->tx_buff_tail += len;
 875         tx_update_descriptor(priv, header->addr1[0] & 0x01, len, buff, TX_PACKET_TYPE_MGMT);
 876 }
 877
 878 static void fast_rx_path(struct atmel_private *priv,
 879                          struct ieee80211_hdr_4addr *header,
 880                          u16 msdu_size, u16 rx_packet_loc, u32 crc)
 881 {
 882         /* fast path: unfragmented packet copy directly into skbuf */
 883         u8 mac4[6];
 884         struct sk_buff  *skb;
 885         unsigned char *skbp;
 886
 887         /* get the final, mac 4 header field, this tells us encapsulation */
 888         atmel_copy_to_host(priv->dev, mac4, rx_packet_loc + 24, 6);
 889         msdu_size -= 6;
 890
 891         if (priv->do_rx_crc) {
 892                 crc = crc32_le(crc, mac4, 6);
 893                 msdu_size -= 4;
 894         }
 895
 896         if (!(skb = dev_alloc_skb(msdu_size + 14))) {
 897                 priv->dev->stats.rx_dropped++;
 898                 return;
 899         }
 900
 901         skb_reserve(skb, 2);
 902         skbp = skb_put(skb, msdu_size + 12);
 903         atmel_copy_to_host(priv->dev, skbp + 12, rx_packet_loc + 30, msdu_size);
 904
 905         if (priv->do_rx_crc) {
 906                 u32 netcrc;
 907                 crc = crc32_le(crc, skbp + 12, msdu_size);
 908                 atmel_copy_to_host(priv->dev, (void *)&netcrc, rx_packet_loc + 30 + msdu_size, 4);
 909                 if ((crc ^ 0xffffffff) != netcrc) {
 910                         priv->dev->stats.rx_crc_errors++;
 911                         dev_kfree_skb(skb);
 912                         return;
 913                 }
 914         }
 915
 916         memcpy(skbp, header->addr1, 6); /* destination address */
 917         if (le16_to_cpu(header->frame_ctl) & IEEE80211_FCTL_FROMDS)
 918                 memcpy(&skbp[6], header->addr3, 6);
 919         else
 920                 memcpy(&skbp[6], header->addr2, 6); /* source address */
 921
 922         priv->dev->last_rx = jiffies;
 923         skb->protocol = eth_type_trans(skb, priv->dev);
 924         skb->ip_summed = CHECKSUM_NONE;
 925         netif_rx(skb);
 926         priv->dev->stats.rx_bytes += 12 + msdu_size;
 927         priv->dev->stats.rx_packets++;
 928 }
 929
 930 /* Test to see if the packet in card memory at packet_loc has a valid CRC
 931    It doesn't matter that this is slow: it is only used to proble the first few
 932    packets. */
 933 static int probe_crc(struct atmel_private *priv, u16 packet_loc, u16 msdu_size)
 934 {
 935         int i = msdu_size - 4;
 936         u32 netcrc, crc = 0xffffffff;
 937
 938         if (msdu_size < 4)
 939                 return 0;
 940
 941         atmel_copy_to_host(priv->dev, (void *)&netcrc, packet_loc + i, 4);
 942
 943         atmel_writeAR(priv->dev, packet_loc);
 944         while (i--) {
 945                 u8 octet = atmel_read8(priv->dev, DR);
 946                 crc = crc32_le(crc, &octet, 1);
 947         }
 948
 949         return (crc ^ 0xffffffff) == netcrc;
 950 }
 951
 952 static void frag_rx_path(struct atmel_private *priv,
 953                          struct ieee80211_hdr_4addr *header,
 954                          u16 msdu_size, u16 rx_packet_loc, u32 crc, u16 seq_no,
 955                          u8 frag_no, int more_frags)
 956 {
 957         u8 mac4[6];
 958         u8 source[6];
 959         struct sk_buff *skb;
 960
 961         if (le16_to_cpu(header->frame_ctl) & IEEE80211_FCTL_FROMDS)
 962                 memcpy(source, header->addr3, 6);
 963         else
 964                 memcpy(source, header->addr2, 6);
 965
 966         rx_packet_loc += 24; /* skip header */
 967
 968         if (priv->do_rx_crc)
 969                 msdu_size -= 4;
 970
 971         if (frag_no == 0) { /* first fragment */
 972                 atmel_copy_to_host(priv->dev, mac4, rx_packet_loc, 6);
 973                 msdu_size -= 6;
 974                 rx_packet_loc += 6;
 975
 976                 if (priv->do_rx_crc)
 977                         crc = crc32_le(crc, mac4, 6);
 978
 979                 priv->frag_seq = seq_no;
 980                 priv->frag_no = 1;
 981                 priv->frag_len = msdu_size;
 982                 memcpy(priv->frag_source, source, 6);
 983                 memcpy(&priv->rx_buf[6], source, 6);
 984                 memcpy(priv->rx_buf, header->addr1, 6);
 985
 986                 atmel_copy_to_host(priv->dev, &priv->rx_buf[12], rx_packet_loc, msdu_size);
 987
 988                 if (priv->do_rx_crc) {
 989                         u32 netcrc;
 990                         crc = crc32_le(crc, &priv->rx_buf[12], msdu_size);
 991                         atmel_copy_to_host(priv->dev, (void *)&netcrc, rx_packet_loc + msdu_size, 4);
 992                         if ((crc ^ 0xffffffff) != netcrc) {
 993                                 priv->dev->stats.rx_crc_errors++;
 994                                 memset(priv->frag_source, 0xff, 6);
 995                         }
 996                 }
 997
 998         } else if (priv->frag_no == frag_no &&
 999                    priv->frag_seq == seq_no &&
1000                    memcmp(priv->frag_source, source, 6) == 0) {
1001
1002                 atmel_copy_to_host(priv->dev, &priv->rx_buf[12 + priv->frag_len],
1003                                    rx_packet_loc, msdu_size);
1004                 if (priv->do_rx_crc) {
1005                         u32 netcrc;
1006                         crc = crc32_le(crc,
1007                                        &priv->rx_buf[12 + priv->frag_len],
1008                                        msdu_size);
1009                         atmel_copy_to_host(priv->dev, (void *)&netcrc, rx_packet_loc + msdu_size, 4);
1010                         if ((crc ^ 0xffffffff) != netcrc) {
1011                                 priv->dev->stats.rx_crc_errors++;
1012                                 memset(priv->frag_source, 0xff, 6);
1013                                 more_frags = 1; /* don't send broken assembly */
1014                         }
1015                 }
1016
1017                 priv->frag_len += msdu_size;
1018                 priv->frag_no++;
1019
1020                 if (!more_frags) { /* last one */
1021                         memset(priv->frag_source, 0xff, 6);
1022                         if (!(skb = dev_alloc_skb(priv->frag_len + 14))) {
1023                                 priv->dev->stats.rx_dropped++;
1024                         } else {
1025                                 skb_reserve(skb, 2);
1026                                 memcpy(skb_put(skb, priv->frag_len + 12),
1027                                        priv->rx_buf,
1028                                        priv->frag_len + 12);
1029                                 priv->dev->last_rx = jiffies;
1030                                 skb->protocol = eth_type_trans(skb, priv->dev);
1031                                 skb->ip_summed = CHECKSUM_NONE;
1032                                 netif_rx(skb);
1033                                 priv->dev->stats.rx_bytes += priv->frag_len + 12;
1034                                 priv->dev->stats.rx_packets++;
1035                         }
1036                 }
1037         } else
1038                 priv->wstats.discard.fragment++;
1039 }
1040
1041 static void rx_done_irq(struct atmel_private *priv)
1042 {
1043         int i;
1044         struct ieee80211_hdr_4addr header;
1045
1046         for (i = 0;
1047              atmel_rmem8(priv, atmel_rx(priv, RX_DESC_FLAGS_OFFSET, priv->rx_desc_head)) == RX_DESC_FLAG_VALID &&
1048                      i < priv->host_info.rx_desc_count;
1049              i++) {
1050
1051                 u16 msdu_size, rx_packet_loc, frame_ctl, seq_control;
1052                 u8 status = atmel_rmem8(priv, atmel_rx(priv, RX_DESC_STATUS_OFFSET, priv->rx_desc_head));
1053                 u32 crc = 0xffffffff;
1054
1055                 if (status != RX_STATUS_SUCCESS) {
1056                         if (status == 0xc1) /* determined by experiment */
1057                                 priv->wstats.discard.nwid++;
1058                         else
1059                                 priv->dev->stats.rx_errors++;
1060                         goto next;
1061                 }
1062
1063                 msdu_size = atmel_rmem16(priv, atmel_rx(priv, RX_DESC_MSDU_SIZE_OFFSET, priv->rx_desc_head));
1064                 rx_packet_loc = atmel_rmem16(priv, atmel_rx(priv, RX_DESC_MSDU_POS_OFFSET, priv->rx_desc_head));
1065
1066                 if (msdu_size < 30) {
1067                         priv->dev->stats.rx_errors++;
1068                         goto next;
1069                 }
1070
1071                 /* Get header as far as end of seq_ctl */
1072                 atmel_copy_to_host(priv->dev, (char *)&header, rx_packet_loc, 24);
1073                 frame_ctl = le16_to_cpu(header.frame_ctl);
1074                 seq_control = le16_to_cpu(header.seq_ctl);
1075
1076                 /* probe for CRC use here if needed  once five packets have
1077                    arrived with the same crc status, we assume we know what's
1078                    happening and stop probing */
1079                 if (priv->probe_crc) {
1080                         if (!priv->wep_is_on || !(frame_ctl & IEEE80211_FCTL_PROTECTED)) {
1081                                 priv->do_rx_crc = probe_crc(priv, rx_packet_loc, msdu_size);
1082                         } else {
1083                                 priv->do_rx_crc = probe_crc(priv, rx_packet_loc + 24, msdu_size - 24);
1084                         }
1085                         if (priv->do_rx_crc) {
1086                                 if (priv->crc_ok_cnt++ > 5)
1087                                         priv->probe_crc = 0;
1088                         } else {
1089                                 if (priv->crc_ko_cnt++ > 5)
1090                                         priv->probe_crc = 0;
1091                         }
1092                 }
1093
1094                 /* don't CRC header when WEP in use */
1095                 if (priv->do_rx_crc && (!priv->wep_is_on || !(frame_ctl & IEEE80211_FCTL_PROTECTED))) {
1096                         crc = crc32_le(0xffffffff, (unsigned char *)&header, 24);
1097                 }
1098                 msdu_size -= 24; /* header */
1099
1100                 if ((frame_ctl & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA) {
1101                         int more_fragments = frame_ctl & IEEE80211_FCTL_MOREFRAGS;
1102                         u8 packet_fragment_no = seq_control & IEEE80211_SCTL_FRAG;
1103                         u16 packet_sequence_no = (seq_control & IEEE80211_SCTL_SEQ) >> 4;
1104
1105                         if (!more_fragments && packet_fragment_no == 0) {
1106                                 fast_rx_path(priv, &header, msdu_size, rx_packet_loc, crc);
1107                         } else {
1108                                 frag_rx_path(priv, &header, msdu_size, rx_packet_loc, crc,
1109                                              packet_sequence_no, packet_fragment_no, more_fragments);
1110                         }
1111                 }
1112
1113                 if ((frame_ctl & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT) {
1114                         /* copy rest of packet into buffer */
1115                         atmel_copy_to_host(priv->dev, (unsigned char *)&priv->rx_buf, rx_packet_loc + 24, msdu_size);
1116
1117                         /* we use the same buffer for frag reassembly and control packets */
1118                         memset(priv->frag_source, 0xff, 6);
1119
1120                         if (priv->do_rx_crc) {
1121                                 /* last 4 octets is crc */
1122                                 msdu_size -= 4;
1123                                 crc = crc32_le(crc, (unsigned char *)&priv->rx_buf, msdu_size);
1124                                 if ((crc ^ 0xffffffff) != (*((u32 *)&priv->rx_buf[msdu_size]))) {
1125                                         priv->dev->stats.rx_crc_errors++;
1126                                         goto next;
1127                                 }
1128                         }
1129
1130                         atmel_management_frame(priv, &header, msdu_size,
1131                                                atmel_rmem8(priv, atmel_rx(priv, RX_DESC_RSSI_OFFSET, priv->rx_desc_head)));
1132                 }
1133
1134 next:
1135                 /* release descriptor */
1136                 atmel_wmem8(priv, atmel_rx(priv, RX_DESC_FLAGS_OFFSET, priv->rx_desc_head), RX_DESC_FLAG_CONSUMED);
1137
1138                 if (priv->rx_desc_head < (priv->host_info.rx_desc_count - 1))
1139                         priv->rx_desc_head++;
1140                 else
1141                         priv->rx_desc_head = 0;
1142         }
1143 }
1144
1145 static irqreturn_t service_interrupt(int irq, void *dev_id)
1146 {
1147         struct net_device *dev = (struct net_device *) dev_id;
1148         struct atmel_private *priv = netdev_priv(dev);
1149         u8 isr;
1150         int i = -1;
1151         static u8 irq_order[] = {
1152                 ISR_OUT_OF_RANGE,
1153                 ISR_RxCOMPLETE,
1154                 ISR_TxCOMPLETE,
1155                 ISR_RxFRAMELOST,
1156                 ISR_FATAL_ERROR,
1157                 ISR_COMMAND_COMPLETE,
1158                 ISR_IBSS_MERGE,
1159                 ISR_GENERIC_IRQ
1160         };
1161
1162         if (priv->card && priv->present_callback &&
1163             !(*priv->present_callback)(priv->card))
1164                 return IRQ_HANDLED;
1165
1166         /* In this state upper-level code assumes it can mess with
1167            the card unhampered by interrupts which may change register state.
1168            Note that even though the card shouldn't generate interrupts
1169            the inturrupt line may be shared. This allows card setup
1170            to go on without disabling interrupts for a long time. */
1171         if (priv->station_state == STATION_STATE_DOWN)
1172                 return IRQ_NONE;
1173
1174         atmel_clear_gcr(dev, GCR_ENINT); /* disable interrupts */
1175
1176         while (1) {
1177                 if (!atmel_lock_mac(priv)) {
1178                         /* failed to contact card */
1179                         printk(KERN_ALERT "%s: failed to contact MAC.\n", dev->name);
1180                         return IRQ_HANDLED;
1181                 }
1182
1183                 isr = atmel_rmem8(priv, atmel_hi(priv, IFACE_INT_STATUS_OFFSET));
1184                 atmel_wmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_MAC_OFFSET), 0);
1185
1186                 if (!isr) {
1187                         atmel_set_gcr(dev, GCR_ENINT); /* enable interrupts */
1188                         return i == -1 ? IRQ_NONE : IRQ_HANDLED;
1189                 }
1190
1191                 atmel_set_gcr(dev, GCR_ACKINT); /* acknowledge interrupt */
1192
1193                 for (i = 0; i < ARRAY_SIZE(irq_order); i++)
1194                         if (isr & irq_order[i])
1195                                 break;
1196
1197                 if (!atmel_lock_mac(priv)) {
1198                         /* failed to contact card */
1199                         printk(KERN_ALERT "%s: failed to contact MAC.\n", dev->name);
1200                         return IRQ_HANDLED;
1201                 }
1202
1203                 isr = atmel_rmem8(priv, atmel_hi(priv, IFACE_INT_STATUS_OFFSET));
1204                 isr ^= irq_order[i];
1205                 atmel_wmem8(priv, atmel_hi(priv, IFACE_INT_STATUS_OFFSET), isr);
1206                 atmel_wmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_MAC_OFFSET), 0);
1207
1208                 switch (irq_order[i]) {
1209
1210                 case ISR_OUT_OF_RANGE:
1211                         if (priv->operating_mode == IW_MODE_INFRA &&
1212                             priv->station_state == STATION_STATE_READY) {
1213                                 priv->station_is_associated = 0;
1214                                 atmel_scan(priv, 1);
1215                         }
1216                         break;
1217
1218                 case ISR_RxFRAMELOST:
1219                         priv->wstats.discard.misc++;
1220                         /* fall through */
1221                 case ISR_RxCOMPLETE:
1222                         rx_done_irq(priv);
1223                         break;
1224
1225                 case ISR_TxCOMPLETE:
1226                         tx_done_irq(priv);
1227                         break;
1228
1229                 case ISR_FATAL_ERROR:
1230                         printk(KERN_ALERT "%s: *** FATAL error interrupt ***\n", dev->name);
1231                         atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
1232                         break;
1233
1234                 case ISR_COMMAND_COMPLETE:
1235                         atmel_command_irq(priv);
1236                         break;
1237
1238                 case ISR_IBSS_MERGE:
1239                         atmel_get_mib(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_CUR_BSSID_POS,
1240                                       priv->CurrentBSSID, 6);
1241                         /* The WPA stuff cares about the current AP address */
1242                         if (priv->use_wpa)
1243                                 build_wpa_mib(priv);
1244                         break;
1245                 case ISR_GENERIC_IRQ:
1246                         printk(KERN_INFO "%s: Generic_irq received.\n", dev->name);
1247                         break;
1248                 }
1249         }
1250 }
1251
1252 static struct iw_statistics *atmel_get_wireless_stats(struct net_device *dev)
1253 {
1254         struct atmel_private *priv = netdev_priv(dev);
1255
1256         /* update the link quality here in case we are seeing no beacons
1257            at all to drive the process */
1258         atmel_smooth_qual(priv);
1259
1260         priv->wstats.status = priv->station_state;
1261
1262         if (priv->operating_mode == IW_MODE_INFRA) {
1263                 if (priv->station_state != STATION_STATE_READY) {
1264                         priv->wstats.qual.qual = 0;
1265                         priv->wstats.qual.level = 0;
1266                         priv->wstats.qual.updated = (IW_QUAL_QUAL_INVALID
1267                                         | IW_QUAL_LEVEL_INVALID);
1268                 }
1269                 priv->wstats.qual.noise = 0;
1270                 priv->wstats.qual.updated |= IW_QUAL_NOISE_INVALID;
1271         } else {
1272                 /* Quality levels cannot be determined in ad-hoc mode,
1273                    because we can 'hear' more that one remote station. */
1274                 priv->wstats.qual.qual = 0;
1275                 priv->wstats.qual.level = 0;
1276                 priv->wstats.qual.noise = 0;
1277                 priv->wstats.qual.updated = IW_QUAL_QUAL_INVALID
1278                                         | IW_QUAL_LEVEL_INVALID
1279                                         | IW_QUAL_NOISE_INVALID;
1280                 priv->wstats.miss.beacon = 0;
1281         }
1282
1283         return &priv->wstats;
1284 }
1285
1286 static int atmel_change_mtu(struct net_device *dev, int new_mtu)
1287 {
1288         if ((new_mtu < 68) || (new_mtu > 2312))
1289                 return -EINVAL;
1290         dev->mtu = new_mtu;
1291         return 0;
1292 }
1293
1294 static int atmel_set_mac_address(struct net_device *dev, void *p)
1295 {
1296         struct sockaddr *addr = p;
1297
1298         memcpy (dev->dev_addr, addr->sa_data, dev->addr_len);
1299         return atmel_open(dev);
1300 }
1301
1302 EXPORT_SYMBOL(atmel_open);
1303
1304 int atmel_open(struct net_device *dev)
1305 {
1306         struct atmel_private *priv = netdev_priv(dev);
1307         int i, channel, err;
1308
1309         /* any scheduled timer is no longer needed and might screw things up.. */
1310         del_timer_sync(&priv->management_timer);
1311
1312         /* Interrupts will not touch the card once in this state... */
1313         priv->station_state = STATION_STATE_DOWN;
1314
1315         if (priv->new_SSID_size) {
1316                 memcpy(priv->SSID, priv->new_SSID, priv->new_SSID_size);
1317                 priv->SSID_size = priv->new_SSID_size;
1318                 priv->new_SSID_size = 0;
1319         }
1320         priv->BSS_list_entries = 0;
1321
1322         priv->AuthenticationRequestRetryCnt = 0;
1323         priv->AssociationRequestRetryCnt = 0;
1324         priv->ReAssociationRequestRetryCnt = 0;
1325         priv->CurrentAuthentTransactionSeqNum = 0x0001;
1326         priv->ExpectedAuthentTransactionSeqNum = 0x0002;
1327
1328         priv->site_survey_state = SITE_SURVEY_IDLE;
1329         priv->station_is_associated = 0;
1330
1331         err = reset_atmel_card(dev);
1332         if (err)
1333                 return err;
1334
1335         if (priv->config_reg_domain) {
1336                 priv->reg_domain = priv->config_reg_domain;
1337                 atmel_set_mib8(priv, Phy_Mib_Type, PHY_MIB_REG_DOMAIN_POS, priv->reg_domain);
1338         } else {
1339                 priv->reg_domain = atmel_get_mib8(priv, Phy_Mib_Type, PHY_MIB_REG_DOMAIN_POS);
1340                 for (i = 0; i < ARRAY_SIZE(channel_table); i++)
1341                         if (priv->reg_domain == channel_table[i].reg_domain)
1342                                 break;
1343                 if (i == ARRAY_SIZE(channel_table)) {
1344                         priv->reg_domain = REG_DOMAIN_MKK1;
1345                         printk(KERN_ALERT "%s: failed to get regulatory domain: assuming MKK1.\n", dev->name);
1346                 }
1347         }
1348
1349         if ((channel = atmel_validate_channel(priv, priv->channel)))
1350                 priv->channel = channel;
1351
1352         /* this moves station_state on.... */
1353         atmel_scan(priv, 1);
1354
1355         atmel_set_gcr(priv->dev, GCR_ENINT); /* enable interrupts */
1356         return 0;
1357 }
1358
1359 static int atmel_close(struct net_device *dev)
1360 {
1361         struct atmel_private *priv = netdev_priv(dev);
1362
1363         /* Send event to userspace that we are disassociating */
1364         if (priv->station_state == STATION_STATE_READY) {
1365                 union iwreq_data wrqu;
1366
1367                 wrqu.data.length = 0;
1368                 wrqu.data.flags = 0;
1369                 wrqu.ap_addr.sa_family = ARPHRD_ETHER;
1370                 memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
1371                 wireless_send_event(priv->dev, SIOCGIWAP, &wrqu, NULL);
1372         }
1373
1374         atmel_enter_state(priv, STATION_STATE_DOWN);
1375
1376         if (priv->bus_type == BUS_TYPE_PCCARD)
1377                 atmel_write16(dev, GCR, 0x0060);
1378         atmel_write16(dev, GCR, 0x0040);
1379         return 0;
1380 }
1381
1382 static int atmel_validate_channel(struct atmel_private *priv, int channel)
1383 {
1384         /* check that channel is OK, if so return zero,
1385            else return suitable default channel */
1386         int i;
1387
1388         for (i = 0; i < ARRAY_SIZE(channel_table); i++)
1389                 if (priv->reg_domain == channel_table[i].reg_domain) {
1390                         if (channel >= channel_table[i].min &&
1391                             channel <= channel_table[i].max)
1392                                 return 0;
1393                         else
1394                                 return channel_table[i].min;
1395                 }
1396         return 0;
1397 }
1398
1399 static int atmel_proc_output (char *buf, struct atmel_private *priv)
1400 {
1401         int i;
1402         char *p = buf;
1403         char *s, *r, *c;
1404
1405         p += sprintf(p, "Driver version:\t\t%d.%d\n",
1406                      DRIVER_MAJOR, DRIVER_MINOR);
1407
1408         if (priv->station_state != STATION_STATE_DOWN) {
1409                 p += sprintf(p, "Firmware version:\t%d.%d build %d\n"
1410                                 "Firmware location:\t",
1411                              priv->host_info.major_version,
1412                              priv->host_info.minor_version,
1413                              priv->host_info.build_version);
1414
1415                 if (priv->card_type != CARD_TYPE_EEPROM)
1416                         p += sprintf(p, "on card\n");
1417                 else if (priv->firmware)
1418                         p += sprintf(p, "%s loaded by host\n",
1419                                      priv->firmware_id);
1420                 else
1421                         p += sprintf(p, "%s loaded by hotplug\n",
1422                                      priv->firmware_id);
1423
1424                 switch (priv->card_type) {
1425                 case CARD_TYPE_PARALLEL_FLASH: c = "Parallel flash"; break;
1426                 case CARD_TYPE_SPI_FLASH: c = "SPI flash\n"; break;
1427                 case CARD_TYPE_EEPROM: c = "EEPROM"; break;
1428                 default: c = "<unknown>";
1429                 }
1430
1431                 r = "<unknown>";
1432                 for (i = 0; i < ARRAY_SIZE(channel_table); i++)
1433                         if (priv->reg_domain == channel_table[i].reg_domain)
1434                                 r = channel_table[i].name;
1435
1436                 p += sprintf(p, "MAC memory type:\t%s\n", c);
1437                 p += sprintf(p, "Regulatory domain:\t%s\n", r);
1438                 p += sprintf(p, "Host CRC checking:\t%s\n",
1439                              priv->do_rx_crc ? "On" : "Off");
1440                 p += sprintf(p, "WPA-capable firmware:\t%s\n",
1441                              priv->use_wpa ? "Yes" : "No");
1442         }
1443
1444         switch(priv->station_state) {
1445         case STATION_STATE_SCANNING: s = "Scanning"; break;
1446         case STATION_STATE_JOINNING: s = "Joining"; break;
1447         case STATION_STATE_AUTHENTICATING: s = "Authenticating"; break;
1448         case STATION_STATE_ASSOCIATING: s = "Associating"; break;
1449         case STATION_STATE_READY: s = "Ready"; break;
1450         case STATION_STATE_REASSOCIATING: s = "Reassociating"; break;
1451         case STATION_STATE_MGMT_ERROR: s = "Management error"; break;
1452         case STATION_STATE_DOWN: s = "Down"; break;
1453         default: s = "<unknown>";
1454         }
1455
1456         p += sprintf(p, "Current state:\t\t%s\n", s);
1457         return p - buf;
1458 }
1459
1460 static int atmel_read_proc(char *page, char **start, off_t off,
1461                            int count, int *eof, void *data)
1462 {
1463         struct atmel_private *priv = data;
1464         int len = atmel_proc_output (page, priv);
1465         if (len <= off+count) *eof = 1;
1466         *start = page + off;
1467         len -= off;
1468         if (len>count) len = count;
1469         if (len<0) len = 0;
1470         return len;
1471 }
1472
1473 struct net_device *init_atmel_card(unsigned short irq, unsigned long port,
1474                                    const AtmelFWType fw_type,
1475                                    struct device *sys_dev,
1476                                    int (*card_present)(void *), void *card)
1477 {
1478         struct proc_dir_entry *ent;
1479         struct net_device *dev;
1480         struct atmel_private *priv;
1481         int rc;
1482         DECLARE_MAC_BUF(mac);
1483
1484         /* Create the network device object. */
1485         dev = alloc_etherdev(sizeof(*priv));
1486         if (!dev) {
1487                 printk(KERN_ERR "atmel: Couldn't alloc_etherdev\n");
1488                 return NULL;
1489         }
1490         if (dev_alloc_name(dev, dev->name) < 0) {
1491                 printk(KERN_ERR "atmel: Couldn't get name!\n");
1492                 goto err_out_free;
1493         }
1494
1495         priv = netdev_priv(dev);
1496         priv->dev = dev;
1497         priv->sys_dev = sys_dev;
1498         priv->present_callback = card_present;
1499         priv->card = card;
1500         priv->firmware = NULL;
1501         priv->firmware_id[0] = '\0';
1502         priv->firmware_type = fw_type;
1503         if (firmware) /* module parameter */
1504                 strcpy(priv->firmware_id, firmware);
1505         priv->bus_type = card_present ? BUS_TYPE_PCCARD : BUS_TYPE_PCI;
1506         priv->station_state = STATION_STATE_DOWN;
1507         priv->do_rx_crc = 0;
1508         /* For PCMCIA cards, some chips need CRC, some don't
1509            so we have to probe. */
1510         if (priv->bus_type == BUS_TYPE_PCCARD) {
1511                 priv->probe_crc = 1;
1512                 priv->crc_ok_cnt = priv->crc_ko_cnt = 0;
1513         } else
1514                 priv->probe_crc = 0;
1515         priv->last_qual = jiffies;
1516         priv->last_beacon_timestamp = 0;
1517         memset(priv->frag_source, 0xff, sizeof(priv->frag_source));
1518         memset(priv->BSSID, 0, 6);
1519         priv->CurrentBSSID[0] = 0xFF; /* Initialize to something invalid.... */
1520         priv->station_was_associated = 0;
1521
1522         priv->last_survey = jiffies;
1523         priv->preamble = LONG_PREAMBLE;
1524         priv->operating_mode = IW_MODE_INFRA;
1525         priv->connect_to_any_BSS = 0;
1526         priv->config_reg_domain = 0;
1527         priv->reg_domain = 0;
1528         priv->tx_rate = 3;
1529         priv->auto_tx_rate = 1;
1530         priv->channel = 4;
1531         priv->power_mode = 0;
1532         priv->SSID[0] = '\0';
1533         priv->SSID_size = 0;
1534         priv->new_SSID_size = 0;
1535         priv->frag_threshold = 2346;
1536         priv->rts_threshold = 2347;
1537         priv->short_retry = 7;
1538         priv->long_retry = 4;
1539
1540         priv->wep_is_on = 0;
1541         priv->default_key = 0;
1542         priv->encryption_level = 0;
1543         priv->exclude_unencrypted = 0;
1544         priv->group_cipher_suite = priv->pairwise_cipher_suite = CIPHER_SUITE_NONE;
1545         priv->use_wpa = 0;
1546         memset(priv->wep_keys, 0, sizeof(priv->wep_keys));
1547         memset(priv->wep_key_len, 0, sizeof(priv->wep_key_len));
1548
1549         priv->default_beacon_period = priv->beacon_period = 100;
1550         priv->listen_interval = 1;
1551
1552         init_timer(&priv->management_timer);
1553         spin_lock_init(&priv->irqlock);
1554         spin_lock_init(&priv->timerlock);
1555         priv->management_timer.function = atmel_management_timer;
1556         priv->management_timer.data = (unsigned long) dev;
1557
1558         dev->open = atmel_open;
1559         dev->stop = atmel_close;
1560         dev->change_mtu = atmel_change_mtu;
1561         dev->set_mac_address = atmel_set_mac_address;
1562         dev->hard_start_xmit = start_tx;
1563         dev->wireless_handlers = (struct iw_handler_def *)&atmel_handler_def;
1564         dev->do_ioctl = atmel_ioctl;
1565         dev->irq = irq;
1566         dev->base_addr = port;
1567
1568         SET_NETDEV_DEV(dev, sys_dev);
1569
1570         if ((rc = request_irq(dev->irq, service_interrupt, IRQF_SHARED, dev->name, dev))) {
1571                 printk(KERN_ERR "%s: register interrupt %d failed, rc %d\n", dev->name, irq, rc);
1572                 goto err_out_free;
1573         }
1574
1575         if (!request_region(dev->base_addr, 32,
1576                             priv->bus_type == BUS_TYPE_PCCARD ?  "atmel_cs" : "atmel_pci")) {
1577                 goto err_out_irq;
1578         }
1579
1580         if (register_netdev(dev))
1581                 goto err_out_res;
1582
1583         if (!probe_atmel_card(dev)){
1584                 unregister_netdev(dev);
1585                 goto err_out_res;
1586         }
1587
1588         netif_carrier_off(dev);
1589
1590         ent = create_proc_read_entry ("driver/atmel", 0, NULL, atmel_read_proc, priv);
1591         if (!ent)
1592                 printk(KERN_WARNING "atmel: unable to create /proc entry.\n");
1593
1594         printk(KERN_INFO "%s: Atmel at76c50x. Version %d.%d. MAC %s\n",
1595                dev->name, DRIVER_MAJOR, DRIVER_MINOR, print_mac(mac, dev->dev_addr));
1596
1597         return dev;
1598
1599 err_out_res:
1600         release_region( dev->base_addr, 32);
1601 err_out_irq:
1602         free_irq(dev->irq, dev);
1603 err_out_free:
1604         free_netdev(dev);
1605         return NULL;
1606 }
1607
1608 EXPORT_SYMBOL(init_atmel_card);
1609
1610 void stop_atmel_card(struct net_device *dev)
1611 {
1612         struct atmel_private *priv = netdev_priv(dev);
1613
1614         /* put a brick on it... */
1615         if (priv->bus_type == BUS_TYPE_PCCARD)
1616                 atmel_write16(dev, GCR, 0x0060);
1617         atmel_write16(dev, GCR, 0x0040);
1618
1619         del_timer_sync(&priv->management_timer);
1620         unregister_netdev(dev);
1621         remove_proc_entry("driver/atmel", NULL);
1622         free_irq(dev->irq, dev);
1623         kfree(priv->firmware);
1624         release_region(dev->base_addr, 32);
1625         free_netdev(dev);
1626 }
1627
1628 EXPORT_SYMBOL(stop_atmel_card);
1629
1630 static int atmel_set_essid(struct net_device *dev,
1631                            struct iw_request_info *info,
1632                            struct iw_point *dwrq,
1633                            char *extra)
1634 {
1635         struct atmel_private *priv = netdev_priv(dev);
1636
1637         /* Check if we asked for `any' */
1638         if(dwrq->flags == 0) {
1639                 priv->connect_to_any_BSS = 1;
1640         } else {
1641                 int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
1642
1643                 priv->connect_to_any_BSS = 0;
1644
1645                 /* Check the size of the string */
1646                 if (dwrq->length > MAX_SSID_LENGTH)
1647                          return -E2BIG;
1648                 if (index != 0)
1649                         return -EINVAL;
1650
1651                 memcpy(priv->new_SSID, extra, dwrq->length);
1652                 priv->new_SSID_size = dwrq->length;
1653         }
1654
1655         return -EINPROGRESS;
1656 }
1657
1658 static int atmel_get_essid(struct net_device *dev,
1659                            struct iw_request_info *info,
1660                            struct iw_point *dwrq,
1661                            char *extra)
1662 {
1663         struct atmel_private *priv = netdev_priv(dev);
1664
1665         /* Get the current SSID */
1666         if (priv->new_SSID_size != 0) {
1667                 memcpy(extra, priv->new_SSID, priv->new_SSID_size);
1668                 dwrq->length = priv->new_SSID_size;
1669         } else {
1670                 memcpy(extra, priv->SSID, priv->SSID_size);
1671                 dwrq->length = priv->SSID_size;
1672         }
1673
1674         dwrq->flags = !priv->connect_to_any_BSS; /* active */
1675
1676         return 0;
1677 }
1678
1679 static int atmel_get_wap(struct net_device *dev,
1680                          struct iw_request_info *info,
1681                          struct sockaddr *awrq,
1682                          char *extra)
1683 {
1684         struct atmel_private *priv = netdev_priv(dev);
1685         memcpy(awrq->sa_data, priv->CurrentBSSID, 6);
1686         awrq->sa_family = ARPHRD_ETHER;
1687
1688         return 0;
1689 }
1690
1691 static int atmel_set_encode(struct net_device *dev,
1692                             struct iw_request_info *info,
1693                             struct iw_point *dwrq,
1694                             char *extra)
1695 {
1696         struct atmel_private *priv = netdev_priv(dev);
1697
1698         /* Basic checking: do we have a key to set ?
1699          * Note : with the new API, it's impossible to get a NULL pointer.
1700          * Therefore, we need to check a key size == 0 instead.
1701          * New version of iwconfig properly set the IW_ENCODE_NOKEY flag
1702          * when no key is present (only change flags), but older versions
1703          * don't do it. - Jean II */
1704         if (dwrq->length > 0) {
1705                 int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
1706                 int current_index = priv->default_key;
1707                 /* Check the size of the key */
1708                 if (dwrq->length > 13) {
1709                         return -EINVAL;
1710                 }
1711                 /* Check the index (none -> use current) */
1712                 if (index < 0 || index >= 4)
1713                         index = current_index;
1714                 else
1715                         priv->default_key = index;
1716                 /* Set the length */
1717                 if (dwrq->length > 5)
1718                         priv->wep_key_len[index] = 13;
1719                 else
1720                         if (dwrq->length > 0)
1721                                 priv->wep_key_len[index] = 5;
1722                         else
1723                                 /* Disable the key */
1724                                 priv->wep_key_len[index] = 0;
1725                 /* Check if the key is not marked as invalid */
1726                 if (!(dwrq->flags & IW_ENCODE_NOKEY)) {
1727                         /* Cleanup */
1728                         memset(priv->wep_keys[index], 0, 13);
1729                         /* Copy the key in the driver */
1730                         memcpy(priv->wep_keys[index], extra, dwrq->length);
1731                 }
1732                 /* WE specify that if a valid key is set, encryption
1733                  * should be enabled (user may turn it off later)
1734                  * This is also how "iwconfig ethX key on" works */
1735                 if (index == current_index &&
1736                     priv->wep_key_len[index] > 0) {
1737                         priv->wep_is_on = 1;
1738                         priv->exclude_unencrypted = 1;
1739                         if (priv->wep_key_len[index] > 5) {
1740                                 priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_128;
1741                                 priv->encryption_level = 2;
1742                         } else {
1743                                 priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_64;
1744                                 priv->encryption_level = 1;
1745                         }
1746                 }
1747         } else {
1748                 /* Do we want to just set the transmit key index ? */
1749                 int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
1750                 if (index >= 0 && index < 4) {
1751                         priv->default_key = index;
1752                 } else
1753                         /* Don't complain if only change the mode */
1754                         if (!(dwrq->flags & IW_ENCODE_MODE))
1755                                 return -EINVAL;
1756         }
1757         /* Read the flags */
1758         if (dwrq->flags & IW_ENCODE_DISABLED) {
1759                 priv->wep_is_on = 0;
1760                 priv->encryption_level = 0;
1761                 priv->pairwise_cipher_suite = CIPHER_SUITE_NONE;
1762         } else {
1763                 priv->wep_is_on = 1;
1764                 if (priv->wep_key_len[priv->default_key] > 5) {
1765                         priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_128;
1766                         priv->encryption_level = 2;
1767                 } else {
1768                         priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_64;
1769                         priv->encryption_level = 1;
1770                 }
1771         }
1772         if (dwrq->flags & IW_ENCODE_RESTRICTED)
1773                 priv->exclude_unencrypted = 1;
1774         if(dwrq->flags & IW_ENCODE_OPEN)
1775                 priv->exclude_unencrypted = 0;
1776
1777         return -EINPROGRESS;            /* Call commit handler */
1778 }
1779
1780 static int atmel_get_encode(struct net_device *dev,
1781                             struct iw_request_info *info,
1782                             struct iw_point *dwrq,
1783                             char *extra)
1784 {
1785         struct atmel_private *priv = netdev_priv(dev);
1786         int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
1787
1788         if (!priv->wep_is_on)
1789                 dwrq->flags = IW_ENCODE_DISABLED;
1790         else {
1791                 if (priv->exclude_unencrypted)
1792                         dwrq->flags = IW_ENCODE_RESTRICTED;
1793                 else
1794                         dwrq->flags = IW_ENCODE_OPEN;
1795         }
1796                 /* Which key do we want ? -1 -> tx index */
1797         if (index < 0 || index >= 4)
1798                 index = priv->default_key;
1799         dwrq->flags |= index + 1;
1800         /* Copy the key to the user buffer */
1801         dwrq->length = priv->wep_key_len[index];
1802         if (dwrq->length > 16) {
1803                 dwrq->length=0;
1804         } else {
1805                 memset(extra, 0, 16);
1806                 memcpy(extra, priv->wep_keys[index], dwrq->length);
1807         }
1808
1809         return 0;
1810 }
1811
1812 static int atmel_set_encodeext(struct net_device *dev,
1813                             struct iw_request_info *info,
1814                             union iwreq_data *wrqu,
1815                             char *extra)
1816 {
1817         struct atmel_private *priv = netdev_priv(dev);
1818         struct iw_point *encoding = &wrqu->encoding;
1819         struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
1820         int idx, key_len, alg = ext->alg, set_key = 1;
1821
1822         /* Determine and validate the key index */
1823         idx = encoding->flags & IW_ENCODE_INDEX;
1824         if (idx) {
1825                 if (idx < 1 || idx > WEP_KEYS)
1826                         return -EINVAL;
1827                 idx--;
1828         } else
1829                 idx = priv->default_key;
1830
1831         if (encoding->flags & IW_ENCODE_DISABLED)
1832             alg = IW_ENCODE_ALG_NONE;
1833
1834         if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY) {
1835                 priv->default_key = idx;
1836                 set_key = ext->key_len > 0 ? 1 : 0;
1837         }
1838
1839         if (set_key) {
1840                 /* Set the requested key first */
1841                 switch (alg) {
1842                 case IW_ENCODE_ALG_NONE:
1843                         priv->wep_is_on = 0;
1844                         priv->encryption_level = 0;
1845                         priv->pairwise_cipher_suite = CIPHER_SUITE_NONE;
1846                         break;
1847                 case IW_ENCODE_ALG_WEP:
1848                         if (ext->key_len > 5) {
1849                                 priv->wep_key_len[idx] = 13;
1850                                 priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_128;
1851                                 priv->encryption_level = 2;
1852                         } else if (ext->key_len > 0) {
1853                                 priv->wep_key_len[idx] = 5;
1854                                 priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_64;
1855                                 priv->encryption_level = 1;
1856                         } else {
1857                                 return -EINVAL;
1858                         }
1859                         priv->wep_is_on = 1;
1860                         memset(priv->wep_keys[idx], 0, 13);
1861                         key_len = min ((int)ext->key_len, priv->wep_key_len[idx]);
1862                         memcpy(priv->wep_keys[idx], ext->key, key_len);
1863                         break;
1864                 default:
1865                         return -EINVAL;
1866                 }
1867         }
1868
1869         return -EINPROGRESS;
1870 }
1871
1872 static int atmel_get_encodeext(struct net_device *dev,
1873                             struct iw_request_info *info,
1874                             union iwreq_data *wrqu,
1875                             char *extra)
1876 {
1877         struct atmel_private *priv = netdev_priv(dev);
1878         struct iw_point *encoding = &wrqu->encoding;
1879         struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
1880         int idx, max_key_len;
1881
1882         max_key_len = encoding->length - sizeof(*ext);
1883         if (max_key_len < 0)
1884                 return -EINVAL;
1885
1886         idx = encoding->flags & IW_ENCODE_INDEX;
1887         if (idx) {
1888                 if (idx < 1 || idx > WEP_KEYS)
1889                         return -EINVAL;
1890                 idx--;
1891         } else
1892                 idx = priv->default_key;
1893
1894         encoding->flags = idx + 1;
1895         memset(ext, 0, sizeof(*ext));
1896
1897         if (!priv->wep_is_on) {
1898                 ext->alg = IW_ENCODE_ALG_NONE;
1899                 ext->key_len = 0;
1900                 encoding->flags |= IW_ENCODE_DISABLED;
1901         } else {
1902                 if (priv->encryption_level > 0)
1903                         ext->alg = IW_ENCODE_ALG_WEP;
1904                 else
1905                         return -EINVAL;
1906
1907                 ext->key_len = priv->wep_key_len[idx];
1908                 memcpy(ext->key, priv->wep_keys[idx], ext->key_len);
1909                 encoding->flags |= IW_ENCODE_ENABLED;
1910         }
1911
1912         return 0;
1913 }
1914
1915 static int atmel_set_auth(struct net_device *dev,
1916                                struct iw_request_info *info,
1917                                union iwreq_data *wrqu, char *extra)
1918 {
1919         struct atmel_private *priv = netdev_priv(dev);
1920         struct iw_param *param = &wrqu->param;
1921
1922         switch (param->flags & IW_AUTH_INDEX) {
1923         case IW_AUTH_WPA_VERSION:
1924         case IW_AUTH_CIPHER_PAIRWISE:
1925         case IW_AUTH_CIPHER_GROUP:
1926         case IW_AUTH_KEY_MGMT:
1927         case IW_AUTH_RX_UNENCRYPTED_EAPOL:
1928         case IW_AUTH_PRIVACY_INVOKED:
1929                 /*
1930                  * atmel does not use these parameters
1931                  */
1932                 break;
1933
1934         case IW_AUTH_DROP_UNENCRYPTED:
1935                 priv->exclude_unencrypted = param->value ? 1 : 0;
1936                 break;
1937
1938         case IW_AUTH_80211_AUTH_ALG: {
1939                         if (param->value & IW_AUTH_ALG_SHARED_KEY) {
1940                                 priv->exclude_unencrypted = 1;
1941                         } else if (param->value & IW_AUTH_ALG_OPEN_SYSTEM) {
1942                                 priv->exclude_unencrypted = 0;
1943                         } else
1944                                 return -EINVAL;
1945                         break;
1946                 }
1947
1948         case IW_AUTH_WPA_ENABLED:
1949                 /* Silently accept disable of WPA */
1950                 if (param->value > 0)
1951                         return -EOPNOTSUPP;
1952                 break;
1953
1954         default:
1955                 return -EOPNOTSUPP;
1956         }
1957         return -EINPROGRESS;
1958 }
1959
1960 static int atmel_get_auth(struct net_device *dev,
1961                                struct iw_request_info *info,
1962                                union iwreq_data *wrqu, char *extra)
1963 {
1964         struct atmel_private *priv = netdev_priv(dev);
1965         struct iw_param *param = &wrqu->param;
1966
1967         switch (param->flags & IW_AUTH_INDEX) {
1968         case IW_AUTH_DROP_UNENCRYPTED:
1969                 param->value = priv->exclude_unencrypted;
1970                 break;
1971
1972         case IW_AUTH_80211_AUTH_ALG:
1973                 if (priv->exclude_unencrypted == 1)
1974                         param->value = IW_AUTH_ALG_SHARED_KEY;
1975                 else
1976                         param->value = IW_AUTH_ALG_OPEN_SYSTEM;
1977                 break;
1978
1979         case IW_AUTH_WPA_ENABLED:
1980                 param->value = 0;
1981                 break;
1982
1983         default:
1984                 return -EOPNOTSUPP;
1985         }
1986         return 0;
1987 }
1988
1989
1990 static int atmel_get_name(struct net_device *dev,
1991                           struct iw_request_info *info,
1992                           char *cwrq,
1993                           char *extra)
1994 {
1995         strcpy(cwrq, "IEEE 802.11-DS");
1996         return 0;
1997 }
1998
1999 static int atmel_set_rate(struct net_device *dev,
2000                           struct iw_request_info *info,
2001                           struct iw_param *vwrq,
2002                           char *extra)
2003 {
2004         struct atmel_private *priv = netdev_priv(dev);
2005
2006         if (vwrq->fixed == 0) {
2007                 priv->tx_rate = 3;
2008                 priv->auto_tx_rate = 1;
2009         } else {
2010                 priv->auto_tx_rate = 0;
2011
2012                 /* Which type of value ? */
2013                 if ((vwrq->value < 4) && (vwrq->value >= 0)) {
2014                         /* Setting by rate index */
2015                         priv->tx_rate = vwrq->value;
2016                 } else {
2017                 /* Setting by frequency value */
2018                         switch (vwrq->value) {
2019                         case  1000000: priv->tx_rate = 0; break;
2020                         case  2000000: priv->tx_rate = 1; break;
2021                         case  5500000: priv->tx_rate = 2; break;
2022                         case 11000000: priv->tx_rate = 3; break;
2023                         default: return -EINVAL;
2024                         }
2025                 }
2026         }
2027
2028         return -EINPROGRESS;
2029 }
2030
2031 static int atmel_set_mode(struct net_device *dev,
2032                           struct iw_request_info *info,
2033                           __u32 *uwrq,
2034                           char *extra)
2035 {
2036         struct atmel_private *priv = netdev_priv(dev);
2037
2038         if (*uwrq != IW_MODE_ADHOC && *uwrq != IW_MODE_INFRA)
2039                 return -EINVAL;
2040
2041         priv->operating_mode = *uwrq;
2042         return -EINPROGRESS;
2043 }
2044
2045 static int atmel_get_mode(struct net_device *dev,
2046                           struct iw_request_info *info,
2047                           __u32 *uwrq,
2048                           char *extra)
2049 {
2050         struct atmel_private *priv = netdev_priv(dev);
2051
2052         *uwrq = priv->operating_mode;
2053         return 0;
2054 }
2055
2056 static int atmel_get_rate(struct net_device *dev,
2057                          struct iw_request_info *info,
2058                          struct iw_param *vwrq,
2059                          char *extra)
2060 {
2061         struct atmel_private *priv = netdev_priv(dev);
2062
2063         if (priv->auto_tx_rate) {
2064                 vwrq->fixed = 0;
2065                 vwrq->value = 11000000;
2066         } else {
2067                 vwrq->fixed = 1;
2068                 switch(priv->tx_rate) {
2069                 case 0: vwrq->value =  1000000; break;
2070                 case 1: vwrq->value =  2000000; break;
2071                 case 2: vwrq->value =  5500000; break;
2072                 case 3: vwrq->value = 11000000; break;
2073                 }
2074         }
2075         return 0;
2076 }
2077
2078 static int atmel_set_power(struct net_device *dev,
2079                            struct iw_request_info *info,
2080                            struct iw_param *vwrq,
2081                            char *extra)
2082 {
2083         struct atmel_private *priv = netdev_priv(dev);
2084         priv->power_mode = vwrq->disabled ? 0 : 1;
2085         return -EINPROGRESS;
2086 }
2087
2088 static int atmel_get_power(struct net_device *dev,
2089                            struct iw_request_info *info,
2090                            struct iw_param *vwrq,
2091                            char *extra)
2092 {
2093         struct atmel_private *priv = netdev_priv(dev);
2094         vwrq->disabled = priv->power_mode ? 0 : 1;
2095         vwrq->flags = IW_POWER_ON;
2096         return 0;
2097 }
2098
2099 static int atmel_set_retry(struct net_device *dev,
2100                            struct iw_request_info *info,
2101                            struct iw_param *vwrq,
2102                            char *extra)
2103 {
2104         struct atmel_private *priv = netdev_priv(dev);
2105
2106         if (!vwrq->disabled && (vwrq->flags & IW_RETRY_LIMIT)) {
2107                 if (vwrq->flags & IW_RETRY_LONG)
2108                         priv->long_retry = vwrq->value;
2109                 else if (vwrq->flags & IW_RETRY_SHORT)
2110                         priv->short_retry = vwrq->value;
2111                 else {
2112                         /* No modifier : set both */
2113                         priv->long_retry = vwrq->value;
2114                         priv->short_retry = vwrq->value;
2115                 }
2116                 return -EINPROGRESS;
2117         }
2118
2119         return -EINVAL;
2120 }
2121
2122 static int atmel_get_retry(struct net_device *dev,
2123                            struct iw_request_info *info,
2124                            struct iw_param *vwrq,
2125                            char *extra)
2126 {
2127         struct atmel_private *priv = netdev_priv(dev);
2128
2129         vwrq->disabled = 0;      /* Can't be disabled */
2130
2131         /* Note : by default, display the short retry number */
2132         if (vwrq->flags & IW_RETRY_LONG) {
2133                 vwrq->flags = IW_RETRY_LIMIT | IW_RETRY_LONG;
2134                 vwrq->value = priv->long_retry;
2135         } else {
2136                 vwrq->flags = IW_RETRY_LIMIT;
2137                 vwrq->value = priv->short_retry;
2138                 if (priv->long_retry != priv->short_retry)
2139                         vwrq->flags |= IW_RETRY_SHORT;
2140         }
2141
2142         return 0;
2143 }
2144
2145 static int atmel_set_rts(struct net_device *dev,
2146                          struct iw_request_info *info,
2147                          struct iw_param *vwrq,
2148                          char *extra)
2149 {
2150         struct atmel_private *priv = netdev_priv(dev);
2151         int rthr = vwrq->value;
2152
2153         if (vwrq->disabled)
2154                 rthr = 2347;
2155         if ((rthr < 0) || (rthr > 2347)) {
2156                 return -EINVAL;
2157         }
2158         priv->rts_threshold = rthr;
2159
2160         return -EINPROGRESS;            /* Call commit handler */
2161 }
2162
2163 static int atmel_get_rts(struct net_device *dev,
2164                          struct iw_request_info *info,
2165                          struct iw_param *vwrq,
2166                          char *extra)
2167 {
2168         struct atmel_private *priv = netdev_priv(dev);
2169
2170         vwrq->value = priv->rts_threshold;
2171         vwrq->disabled = (vwrq->value >= 2347);
2172         vwrq->fixed = 1;
2173
2174         return 0;
2175 }
2176
2177 static int atmel_set_frag(struct net_device *dev,
2178                           struct iw_request_info *info,
2179                           struct iw_param *vwrq,
2180                           char *extra)
2181 {
2182         struct atmel_private *priv = netdev_priv(dev);
2183         int fthr = vwrq->value;
2184
2185         if (vwrq->disabled)
2186                 fthr = 2346;
2187         if ((fthr < 256) || (fthr > 2346)) {
2188                 return -EINVAL;
2189         }
2190         fthr &= ~0x1;   /* Get an even value - is it really needed ??? */
2191         priv->frag_threshold = fthr;
2192
2193         return -EINPROGRESS;            /* Call commit handler */
2194 }
2195
2196 static int atmel_get_frag(struct net_device *dev,
2197                           struct iw_request_info *info,
2198                           struct iw_param *vwrq,
2199                           char *extra)
2200 {
2201         struct atmel_private *priv = netdev_priv(dev);
2202
2203         vwrq->value = priv->frag_threshold;
2204         vwrq->disabled = (vwrq->value >= 2346);
2205         vwrq->fixed = 1;
2206
2207         return 0;
2208 }
2209
2210 static const long frequency_list[] = { 2412, 2417, 2422, 2427, 2432, 2437, 2442,
2211                                 2447, 2452, 2457, 2462, 2467, 2472, 2484 };
2212
2213 static int atmel_set_freq(struct net_device *dev,
2214                           struct iw_request_info *info,
2215                           struct iw_freq *fwrq,
2216                           char *extra)
2217 {
2218         struct atmel_private *priv = netdev_priv(dev);
2219         int rc = -EINPROGRESS;          /* Call commit handler */
2220
2221         /* If setting by frequency, convert to a channel */
2222         if ((fwrq->e == 1) &&
2223             (fwrq->m >= (int) 241200000) &&
2224             (fwrq->m <= (int) 248700000)) {
2225                 int f = fwrq->m / 100000;
2226                 int c = 0;
2227                 while ((c < 14) && (f != frequency_list[c]))
2228                         c++;
2229                 /* Hack to fall through... */
2230                 fwrq->e = 0;
2231                 fwrq->m = c + 1;
2232         }
2233         /* Setting by channel number */
2234         if ((fwrq->m > 1000) || (fwrq->e > 0))
2235                 rc = -EOPNOTSUPP;
2236         else {
2237                 int channel = fwrq->m;
2238                 if (atmel_validate_channel(priv, channel) == 0) {
2239                         priv->channel = channel;
2240                 } else {
2241                         rc = -EINVAL;
2242                 }
2243         }
2244         return rc;
2245 }
2246
2247 static int atmel_get_freq(struct net_device *dev,
2248                           struct iw_request_info *info,
2249                           struct iw_freq *fwrq,
2250                           char *extra)
2251 {
2252         struct atmel_private *priv = netdev_priv(dev);
2253
2254         fwrq->m = priv->channel;
2255         fwrq->e = 0;
2256         return 0;
2257 }
2258
2259 static int atmel_set_scan(struct net_device *dev,
2260                           struct iw_request_info *info,
2261                           struct iw_param *vwrq,
2262                           char *extra)
2263 {
2264         struct atmel_private *priv = netdev_priv(dev);
2265         unsigned long flags;
2266
2267         /* Note : you may have realised that, as this is a SET operation,
2268          * this is privileged and therefore a normal user can't
2269          * perform scanning.
2270          * This is not an error, while the device perform scanning,
2271          * traffic doesn't flow, so it's a perfect DoS...
2272          * Jean II */
2273
2274         if (priv->station_state == STATION_STATE_DOWN)
2275                 return -EAGAIN;
2276
2277         /* Timeout old surveys. */
2278         if (time_after(jiffies, priv->last_survey + 20 * HZ))
2279                 priv->site_survey_state = SITE_SURVEY_IDLE;
2280         priv->last_survey = jiffies;
2281
2282         /* Initiate a scan command */
2283         if (priv->site_survey_state == SITE_SURVEY_IN_PROGRESS)
2284                 return -EBUSY;
2285
2286         del_timer_sync(&priv->management_timer);
2287         spin_lock_irqsave(&priv->irqlock, flags);
2288
2289         priv->site_survey_state = SITE_SURVEY_IN_PROGRESS;
2290         priv->fast_scan = 0;
2291         atmel_scan(priv, 0);
2292         spin_unlock_irqrestore(&priv->irqlock, flags);
2293
2294         return 0;
2295 }
2296
2297 static int atmel_get_scan(struct net_device *dev,
2298                           struct iw_request_info *info,
2299                           struct iw_point *dwrq,
2300                           char *extra)
2301 {
2302         struct atmel_private *priv = netdev_priv(dev);
2303         int i;
2304         char *current_ev = extra;
2305         struct iw_event iwe;
2306
2307         if (priv->site_survey_state != SITE_SURVEY_COMPLETED)
2308                 return -EAGAIN;
2309
2310         for (i = 0; i < priv->BSS_list_entries; i++) {
2311                 iwe.cmd = SIOCGIWAP;
2312                 iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
2313                 memcpy(iwe.u.ap_addr.sa_data, priv->BSSinfo[i].BSSID, 6);
2314                 current_ev = iwe_stream_add_event(info, current_ev,
2315                                                   extra + IW_SCAN_MAX_DATA,
2316                                                   &iwe, IW_EV_ADDR_LEN);
2317
2318                 iwe.u.data.length =  priv->BSSinfo[i].SSIDsize;
2319                 if (iwe.u.data.length > 32)
2320                         iwe.u.data.length = 32;
2321                 iwe.cmd = SIOCGIWESSID;
2322                 iwe.u.data.flags = 1;
2323                 current_ev = iwe_stream_add_point(info, current_ev,
2324                                                   extra + IW_SCAN_MAX_DATA,
2325                                                   &iwe, priv->BSSinfo[i].SSID);
2326
2327                 iwe.cmd = SIOCGIWMODE;
2328                 iwe.u.mode = priv->BSSinfo[i].BSStype;
2329                 current_ev = iwe_stream_add_event(info, current_ev,
2330                                                   extra + IW_SCAN_MAX_DATA,
2331                                                   &iwe, IW_EV_UINT_LEN);
2332
2333                 iwe.cmd = SIOCGIWFREQ;
2334                 iwe.u.freq.m = priv->BSSinfo[i].channel;
2335                 iwe.u.freq.e = 0;
2336                 current_ev = iwe_stream_add_event(info, current_ev,
2337                                                   extra + IW_SCAN_MAX_DATA,
2338                                                   &iwe, IW_EV_FREQ_LEN);
2339
2340                 /* Add quality statistics */
2341                 iwe.cmd = IWEVQUAL;
2342                 iwe.u.qual.level = priv->BSSinfo[i].RSSI;
2343                 iwe.u.qual.qual  = iwe.u.qual.level;
2344                 /* iwe.u.qual.noise  = SOMETHING */
2345                 current_ev = iwe_stream_add_event(info, current_ev,
2346                                                   extra + IW_SCAN_MAX_DATA,
2347                                                   &iwe, IW_EV_QUAL_LEN);
2348
2349
2350                 iwe.cmd = SIOCGIWENCODE;
2351                 if (priv->BSSinfo[i].UsingWEP)
2352                         iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
2353                 else
2354                         iwe.u.data.flags = IW_ENCODE_DISABLED;
2355                 iwe.u.data.length = 0;
2356                 current_ev = iwe_stream_add_point(info, current_ev,
2357                                                   extra + IW_SCAN_MAX_DATA,
2358                                                   &iwe, NULL);
2359         }
2360
2361         /* Length of data */
2362         dwrq->length = (current_ev - extra);
2363         dwrq->flags = 0;
2364
2365         return 0;
2366 }
2367
2368 static int atmel_get_range(struct net_device *dev,
2369                            struct iw_request_info *info,
2370                            struct iw_point *dwrq,
2371                            char *extra)
2372 {
2373         struct atmel_private *priv = netdev_priv(dev);
2374         struct iw_range *range = (struct iw_range *) extra;
2375         int k, i, j;
2376
2377         dwrq->length = sizeof(struct iw_range);
2378         memset(range, 0, sizeof(struct iw_range));
2379         range->min_nwid = 0x0000;
2380         range->max_nwid = 0x0000;
2381         range->num_channels = 0;
2382         for (j = 0; j < ARRAY_SIZE(channel_table); j++)
2383                 if (priv->reg_domain == channel_table[j].reg_domain) {
2384                         range->num_channels = channel_table[j].max - channel_table[j].min + 1;
2385                         break;
2386                 }
2387         if (range->num_channels != 0) {
2388                 for (k = 0, i = channel_table[j].min; i <= channel_table[j].max; i++) {
2389                         range->freq[k].i = i; /* List index */
2390                         range->freq[k].m = frequency_list[i - 1] * 100000;
2391                         range->freq[k++].e = 1; /* Values in table in MHz -> * 10^5 * 10 */
2392                 }
2393                 range->num_frequency = k;
2394         }
2395
2396         range->max_qual.qual = 100;
2397         range->max_qual.level = 100;
2398         range->max_qual.noise = 0;
2399         range->max_qual.updated = IW_QUAL_NOISE_INVALID;
2400
2401         range->avg_qual.qual = 50;
2402         range->avg_qual.level = 50;
2403         range->avg_qual.noise = 0;
2404         range->avg_qual.updated = IW_QUAL_NOISE_INVALID;
2405
2406         range->sensitivity = 0;
2407
2408         range->bitrate[0] =  1000000;
2409         range->bitrate[1] =  2000000;
2410         range->bitrate[2] =  5500000;
2411         range->bitrate[3] = 11000000;
2412         range->num_bitrates = 4;
2413
2414         range->min_rts = 0;
2415         range->max_rts = 2347;
2416         range->min_frag = 256;
2417         range->max_frag = 2346;
2418
2419         range->encoding_size[0] = 5;
2420         range->encoding_size[1] = 13;
2421         range->num_encoding_sizes = 2;
2422         range->max_encoding_tokens = 4;
2423
2424         range->pmp_flags = IW_POWER_ON;
2425         range->pmt_flags = IW_POWER_ON;
2426         range->pm_capa = 0;
2427
2428         range->we_version_source = WIRELESS_EXT;
2429         range->we_version_compiled = WIRELESS_EXT;
2430         range->retry_capa = IW_RETRY_LIMIT ;
2431         range->retry_flags = IW_RETRY_LIMIT;
2432         range->r_time_flags = 0;
2433         range->min_retry = 1;
2434         range->max_retry = 65535;
2435
2436         return 0;
2437 }
2438
2439 static int atmel_set_wap(struct net_device *dev,
2440                          struct iw_request_info *info,
2441                          struct sockaddr *awrq,
2442                          char *extra)
2443 {
2444         struct atmel_private *priv = netdev_priv(dev);
2445         int i;
2446         static const u8 any[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
2447         static const u8 off[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
2448         unsigned long flags;
2449
2450         if (awrq->sa_family != ARPHRD_ETHER)
2451                 return -EINVAL;
2452
2453         if (!memcmp(any, awrq->sa_data, 6) ||
2454             !memcmp(off, awrq->sa_data, 6)) {
2455                 del_timer_sync(&priv->management_timer);
2456                 spin_lock_irqsave(&priv->irqlock, flags);
2457                 atmel_scan(priv, 1);
2458                 spin_unlock_irqrestore(&priv->irqlock, flags);
2459                 return 0;
2460         }
2461
2462         for (i = 0; i < priv->BSS_list_entries; i++) {
2463                 if (memcmp(priv->BSSinfo[i].BSSID, awrq->sa_data, 6) == 0) {
2464                         if (!priv->wep_is_on && priv->BSSinfo[i].UsingWEP) {
2465                                 return -EINVAL;
2466                         } else if  (priv->wep_is_on && !priv->BSSinfo[i].UsingWEP) {
2467                                 return -EINVAL;
2468                         } else {
2469                                 del_timer_sync(&priv->management_timer);
2470                                 spin_lock_irqsave(&priv->irqlock, flags);
2471                                 atmel_join_bss(priv, i);
2472                                 spin_unlock_irqrestore(&priv->irqlock, flags);
2473                                 return 0;
2474                         }
2475                 }
2476         }
2477
2478         return -EINVAL;
2479 }
2480
2481 static int atmel_config_commit(struct net_device *dev,
2482                                struct iw_request_info *info,    /* NULL */
2483                                void *zwrq,                      /* NULL */
2484                                char *extra)                     /* NULL */
2485 {
2486         return atmel_open(dev);
2487 }
2488
2489 static const iw_handler atmel_handler[] =
2490 {
2491         (iw_handler) atmel_config_commit,       /* SIOCSIWCOMMIT */
2492         (iw_handler) atmel_get_name,            /* SIOCGIWNAME */
2493         (iw_handler) NULL,                      /* SIOCSIWNWID */
2494         (iw_handler) NULL,                      /* SIOCGIWNWID */
2495         (iw_handler) atmel_set_freq,            /* SIOCSIWFREQ */
2496         (iw_handler) atmel_get_freq,            /* SIOCGIWFREQ */
2497         (iw_handler) atmel_set_mode,            /* SIOCSIWMODE */
2498         (iw_handler) atmel_get_mode,            /* SIOCGIWMODE */
2499         (iw_handler) NULL,                      /* SIOCSIWSENS */
2500         (iw_handler) NULL,                      /* SIOCGIWSENS */
2501         (iw_handler) NULL,                      /* SIOCSIWRANGE */
2502         (iw_handler) atmel_get_range,           /* SIOCGIWRANGE */
2503         (iw_handler) NULL,                      /* SIOCSIWPRIV */
2504         (iw_handler) NULL,                      /* SIOCGIWPRIV */
2505         (iw_handler) NULL,                      /* SIOCSIWSTATS */
2506         (iw_handler) NULL,                      /* SIOCGIWSTATS */
2507         (iw_handler) NULL,                      /* SIOCSIWSPY */
2508         (iw_handler) NULL,                      /* SIOCGIWSPY */
2509         (iw_handler) NULL,                      /* -- hole -- */
2510         (iw_handler) NULL,                      /* -- hole -- */
2511         (iw_handler) atmel_set_wap,             /* SIOCSIWAP */
2512         (iw_handler) atmel_get_wap,             /* SIOCGIWAP */
2513         (iw_handler) NULL,                      /* -- hole -- */
2514         (iw_handler) NULL,                      /* SIOCGIWAPLIST */
2515         (iw_handler) atmel_set_scan,            /* SIOCSIWSCAN */
2516         (iw_handler) atmel_get_scan,            /* SIOCGIWSCAN */
2517         (iw_handler) atmel_set_essid,           /* SIOCSIWESSID */
2518         (iw_handler) atmel_get_essid,           /* SIOCGIWESSID */
2519         (iw_handler) NULL,                      /* SIOCSIWNICKN */
2520         (iw_handler) NULL,                      /* SIOCGIWNICKN */
2521         (iw_handler) NULL,                      /* -- hole -- */
2522         (iw_handler) NULL,                      /* -- hole -- */
2523         (iw_handler) atmel_set_rate,            /* SIOCSIWRATE */
2524         (iw_handler) atmel_get_rate,            /* SIOCGIWRATE */
2525         (iw_handler) atmel_set_rts,             /* SIOCSIWRTS */
2526         (iw_handler) atmel_get_rts,             /* SIOCGIWRTS */
2527         (iw_handler) atmel_set_frag,            /* SIOCSIWFRAG */
2528         (iw_handler) atmel_get_frag,            /* SIOCGIWFRAG */
2529         (iw_handler) NULL,                      /* SIOCSIWTXPOW */
2530         (iw_handler) NULL,                      /* SIOCGIWTXPOW */
2531         (iw_handler) atmel_set_retry,           /* SIOCSIWRETRY */
2532         (iw_handler) atmel_get_retry,           /* SIOCGIWRETRY */
2533         (iw_handler) atmel_set_encode,          /* SIOCSIWENCODE */
2534         (iw_handler) atmel_get_encode,          /* SIOCGIWENCODE */
2535         (iw_handler) atmel_set_power,           /* SIOCSIWPOWER */
2536         (iw_handler) atmel_get_power,           /* SIOCGIWPOWER */
2537         (iw_handler) NULL,                      /* -- hole -- */
2538         (iw_handler) NULL,                      /* -- hole -- */
2539         (iw_handler) NULL,                      /* SIOCSIWGENIE */
2540         (iw_handler) NULL,                      /* SIOCGIWGENIE */
2541         (iw_handler) atmel_set_auth,            /* SIOCSIWAUTH */
2542         (iw_handler) atmel_get_auth,            /* SIOCGIWAUTH */
2543         (iw_handler) atmel_set_encodeext,       /* SIOCSIWENCODEEXT */
2544         (iw_handler) atmel_get_encodeext,       /* SIOCGIWENCODEEXT */
2545         (iw_handler) NULL,                      /* SIOCSIWPMKSA */
2546 };
2547
2548 static const iw_handler atmel_private_handler[] =
2549 {
2550         NULL,                           /* SIOCIWFIRSTPRIV */
2551 };
2552
2553 typedef struct atmel_priv_ioctl {
2554         char id[32];
2555         unsigned char __user *data;
2556         unsigned short len;
2557 } atmel_priv_ioctl;
2558
2559 #define ATMELFWL        SIOCIWFIRSTPRIV
2560 #define ATMELIDIFC      ATMELFWL + 1
2561 #define ATMELRD         ATMELFWL + 2
2562 #define ATMELMAGIC 0x51807
2563 #define REGDOMAINSZ 20
2564
2565 static const struct iw_priv_args atmel_private_args[] = {
2566         {
2567                 .cmd = ATMELFWL,
2568                 .set_args = IW_PRIV_TYPE_BYTE
2569                                 | IW_PRIV_SIZE_FIXED
2570                                 | sizeof (atmel_priv_ioctl),
2571                 .get_args = IW_PRIV_TYPE_NONE,
2572                 .name = "atmelfwl"
2573         }, {
2574                 .cmd = ATMELIDIFC,
2575                 .set_args = IW_PRIV_TYPE_NONE,
2576                 .get_args = IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
2577                 .name = "atmelidifc"
2578         }, {
2579                 .cmd = ATMELRD,
2580                 .set_args = IW_PRIV_TYPE_CHAR | REGDOMAINSZ,
2581                 .get_args = IW_PRIV_TYPE_NONE,
2582                 .name = "regdomain"
2583         },
2584 };
2585
2586 static const struct iw_handler_def atmel_handler_def =
2587 {
2588         .num_standard   = ARRAY_SIZE(atmel_handler),
2589         .num_private    = ARRAY_SIZE(atmel_private_handler),
2590         .num_private_args = ARRAY_SIZE(atmel_private_args),
2591         .standard       = (iw_handler *) atmel_handler,
2592         .private        = (iw_handler *) atmel_private_handler,
2593         .private_args   = (struct iw_priv_args *) atmel_private_args,
2594         .get_wireless_stats = atmel_get_wireless_stats
2595 };
2596
2597 static int atmel_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
2598 {
2599         int i, rc = 0;
2600         struct atmel_private *priv = netdev_priv(dev);
2601         atmel_priv_ioctl com;
2602         struct iwreq *wrq = (struct iwreq *) rq;
2603         unsigned char *new_firmware;
2604         char domain[REGDOMAINSZ + 1];
2605
2606         switch (cmd) {
2607         case ATMELIDIFC:
2608                 wrq->u.param.value = ATMELMAGIC;
2609                 break;
2610
2611         case ATMELFWL:
2612                 if (copy_from_user(&com, rq->ifr_data, sizeof(com))) {
2613                         rc = -EFAULT;
2614                         break;
2615                 }
2616
2617                 if (!capable(CAP_NET_ADMIN)) {
2618                         rc = -EPERM;
2619                         break;
2620                 }
2621
2622                 if (!(new_firmware = kmalloc(com.len, GFP_KERNEL))) {
2623                         rc = -ENOMEM;
2624                         break;
2625                 }
2626
2627                 if (copy_from_user(new_firmware, com.data, com.len)) {
2628                         kfree(new_firmware);
2629                         rc = -EFAULT;
2630                         break;
2631                 }
2632
2633                 kfree(priv->firmware);
2634
2635                 priv->firmware = new_firmware;
2636                 priv->firmware_length = com.len;
2637                 strncpy(priv->firmware_id, com.id, 31);
2638                 priv->firmware_id[31] = '\0';
2639                 break;
2640
2641         case ATMELRD:
2642                 if (copy_from_user(domain, rq->ifr_data, REGDOMAINSZ)) {
2643                         rc = -EFAULT;
2644                         break;
2645                 }
2646
2647                 if (!capable(CAP_NET_ADMIN)) {
2648                         rc = -EPERM;
2649                         break;
2650                 }
2651
2652                 domain[REGDOMAINSZ] = 0;
2653                 rc = -EINVAL;
2654                 for (i = 0; i < ARRAY_SIZE(channel_table); i++) {
2655                         /* strcasecmp doesn't exist in the library */
2656                         char *a = channel_table[i].name;
2657                         char *b = domain;
2658                         while (*a) {
2659                                 char c1 = *a++;
2660                                 char c2 = *b++;
2661                                 if (tolower(c1) != tolower(c2))
2662                                         break;
2663                         }
2664                         if (!*a && !*b) {
2665                                 priv->config_reg_domain = channel_table[i].reg_domain;
2666                                 rc = 0;
2667                         }
2668                 }
2669
2670                 if (rc == 0 &&  priv->station_state != STATION_STATE_DOWN)
2671                         rc = atmel_open(dev);
2672                 break;
2673
2674         default:
2675                 rc = -EOPNOTSUPP;
2676         }
2677
2678         return rc;
2679 }
2680
2681 struct auth_body {
2682         __le16 alg;
2683         __le16 trans_seq;
2684         __le16 status;
2685         u8 el_id;
2686         u8 chall_text_len;
2687         u8 chall_text[253];
2688 };
2689
2690 static void atmel_enter_state(struct atmel_private *priv, int new_state)
2691 {
2692         int old_state = priv->station_state;
2693
2694         if (new_state == old_state)
2695                 return;
2696
2697         priv->station_state = new_state;
2698
2699         if (new_state == STATION_STATE_READY) {
2700                 netif_start_queue(priv->dev);
2701                 netif_carrier_on(priv->dev);
2702         }
2703
2704         if (old_state == STATION_STATE_READY) {
2705                 netif_carrier_off(priv->dev);
2706                 if (netif_running(priv->dev))
2707                         netif_stop_queue(priv->dev);
2708                 priv->last_beacon_timestamp = 0;
2709         }
2710 }
2711
2712 static void atmel_scan(struct atmel_private *priv, int specific_ssid)
2713 {
2714         struct {
2715                 u8 BSSID[6];
2716                 u8 SSID[MAX_SSID_LENGTH];
2717                 u8 scan_type;
2718                 u8 channel;
2719                 __le16 BSS_type;
2720                 __le16 min_channel_time;
2721                 __le16 max_channel_time;
2722                 u8 options;
2723                 u8 SSID_size;
2724         } cmd;
2725
2726         memset(cmd.BSSID, 0xff, 6);
2727
2728         if (priv->fast_scan) {
2729                 cmd.SSID_size = priv->SSID_size;
2730                 memcpy(cmd.SSID, priv->SSID, priv->SSID_size);
2731                 cmd.min_channel_time = cpu_to_le16(10);
2732                 cmd.max_channel_time = cpu_to_le16(50);
2733         } else {
2734                 priv->BSS_list_entries = 0;
2735                 cmd.SSID_size = 0;
2736                 cmd.min_channel_time = cpu_to_le16(10);
2737                 cmd.max_channel_time = cpu_to_le16(120);
2738         }
2739
2740         cmd.options = 0;
2741
2742         if (!specific_ssid)
2743                 cmd.options |= SCAN_OPTIONS_SITE_SURVEY;
2744
2745         cmd.channel = (priv->channel & 0x7f);
2746         cmd.scan_type = SCAN_TYPE_ACTIVE;
2747         cmd.BSS_type = cpu_to_le16(priv->operating_mode == IW_MODE_ADHOC ?
2748                 BSS_TYPE_AD_HOC : BSS_TYPE_INFRASTRUCTURE);
2749
2750         atmel_send_command(priv, CMD_Scan, &cmd, sizeof(cmd));
2751
2752         /* This must come after all hardware access to avoid being messed up
2753            by stuff happening in interrupt context after we leave STATE_DOWN */
2754         atmel_enter_state(priv, STATION_STATE_SCANNING);
2755 }
2756
2757 static void join(struct atmel_private *priv, int type)
2758 {
2759         struct {
2760                 u8 BSSID[6];
2761                 u8 SSID[MAX_SSID_LENGTH];
2762                 u8 BSS_type; /* this is a short in a scan command - weird */
2763                 u8 channel;
2764                 __le16 timeout;
2765                 u8 SSID_size;
2766                 u8 reserved;
2767         } cmd;
2768
2769         cmd.SSID_size = priv->SSID_size;
2770         memcpy(cmd.SSID, priv->SSID, priv->SSID_size);
2771         memcpy(cmd.BSSID, priv->CurrentBSSID, 6);
2772         cmd.channel = (priv->channel & 0x7f);
2773         cmd.BSS_type = type;
2774         cmd.timeout = cpu_to_le16(2000);
2775
2776         atmel_send_command(priv, CMD_Join, &cmd, sizeof(cmd));
2777 }
2778
2779 static void start(struct atmel_private *priv, int type)
2780 {
2781         struct {
2782                 u8 BSSID[6];
2783                 u8 SSID[MAX_SSID_LENGTH];
2784                 u8 BSS_type;
2785                 u8 channel;
2786                 u8 SSID_size;
2787                 u8 reserved[3];
2788         } cmd;
2789
2790         cmd.SSID_size = priv->SSID_size;
2791         memcpy(cmd.SSID, priv->SSID, priv->SSID_size);
2792         memcpy(cmd.BSSID, priv->BSSID, 6);
2793         cmd.BSS_type = type;
2794         cmd.channel = (priv->channel & 0x7f);
2795
2796         atmel_send_command(priv, CMD_Start, &cmd, sizeof(cmd));
2797 }
2798
2799 static void handle_beacon_probe(struct atmel_private *priv, u16 capability,
2800                                 u8 channel)
2801 {
2802         int rejoin = 0;
2803         int new = capability & MFIE_TYPE_POWER_CONSTRAINT ?
2804                 SHORT_PREAMBLE : LONG_PREAMBLE;
2805
2806         if (priv->preamble != new) {
2807                 priv->preamble = new;
2808                 rejoin = 1;
2809                 atmel_set_mib8(priv, Local_Mib_Type, LOCAL_MIB_PREAMBLE_TYPE, new);
2810         }
2811
2812         if (priv->channel != channel) {
2813                 priv->channel = channel;
2814                 rejoin = 1;
2815                 atmel_set_mib8(priv, Phy_Mib_Type, PHY_MIB_CHANNEL_POS, channel);
2816         }
2817
2818         if (rejoin) {
2819                 priv->station_is_associated = 0;
2820                 atmel_enter_state(priv, STATION_STATE_JOINNING);
2821
2822                 if (priv->operating_mode == IW_MODE_INFRA)
2823                         join(priv, BSS_TYPE_INFRASTRUCTURE);
2824                 else
2825                         join(priv, BSS_TYPE_AD_HOC);
2826         }
2827 }
2828
2829 static void send_authentication_request(struct atmel_private *priv, u16 system,
2830                                         u8 *challenge, int challenge_len)
2831 {
2832         struct ieee80211_hdr_4addr header;
2833         struct auth_body auth;
2834
2835         header.frame_ctl = cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_AUTH);
2836         header.duration_id = cpu_to_le16(0x8000);
2837         header.seq_ctl = 0;
2838         memcpy(header.addr1, priv->CurrentBSSID, 6);
2839         memcpy(header.addr2, priv->dev->dev_addr, 6);
2840         memcpy(header.addr3, priv->CurrentBSSID, 6);
2841
2842         if (priv->wep_is_on && priv->CurrentAuthentTransactionSeqNum != 1)
2843                 /* no WEP for authentication frames with TrSeqNo 1 */
2844                 header.frame_ctl |=  cpu_to_le16(IEEE80211_FCTL_PROTECTED);
2845
2846         auth.alg = cpu_to_le16(system);
2847
2848         auth.status = 0;
2849         auth.trans_seq = cpu_to_le16(priv->CurrentAuthentTransactionSeqNum);
2850         priv->ExpectedAuthentTransactionSeqNum = priv->CurrentAuthentTransactionSeqNum+1;
2851         priv->CurrentAuthentTransactionSeqNum += 2;
2852
2853         if (challenge_len != 0) {
2854                 auth.el_id = 16; /* challenge_text */
2855                 auth.chall_text_len = challenge_len;
2856                 memcpy(auth.chall_text, challenge, challenge_len);
2857                 atmel_transmit_management_frame(priv, &header, (u8 *)&auth, 8 + challenge_len);
2858         } else {
2859                 atmel_transmit_management_frame(priv, &header, (u8 *)&auth, 6);
2860         }
2861 }
2862
2863 static void send_association_request(struct atmel_private *priv, int is_reassoc)
2864 {
2865         u8 *ssid_el_p;
2866         int bodysize;
2867         struct ieee80211_hdr_4addr header;
2868         struct ass_req_format {
2869                 __le16 capability;
2870                 __le16 listen_interval;
2871                 u8 ap[6]; /* nothing after here directly accessible */
2872                 u8 ssid_el_id;
2873                 u8 ssid_len;
2874                 u8 ssid[MAX_SSID_LENGTH];
2875                 u8 sup_rates_el_id;
2876                 u8 sup_rates_len;
2877                 u8 rates[4];
2878         } body;
2879
2880         header.frame_ctl = cpu_to_le16(IEEE80211_FTYPE_MGMT |
2881                 (is_reassoc ? IEEE80211_STYPE_REASSOC_REQ : IEEE80211_STYPE_ASSOC_REQ));
2882         header.duration_id = cpu_to_le16(0x8000);
2883         header.seq_ctl = 0;
2884
2885         memcpy(header.addr1, priv->CurrentBSSID, 6);
2886         memcpy(header.addr2, priv->dev->dev_addr, 6);
2887         memcpy(header.addr3, priv->CurrentBSSID, 6);
2888
2889         body.capability = cpu_to_le16(WLAN_CAPABILITY_ESS);
2890         if (priv->wep_is_on)
2891                 body.capability |= cpu_to_le16(WLAN_CAPABILITY_PRIVACY);
2892         if (priv->preamble == SHORT_PREAMBLE)
2893                 body.capability |= cpu_to_le16(MFIE_TYPE_POWER_CONSTRAINT);
2894
2895         body.listen_interval = cpu_to_le16(priv->listen_interval * priv->beacon_period);
2896
2897         /* current AP address - only in reassoc frame */
2898         if (is_reassoc) {
2899                 memcpy(body.ap, priv->CurrentBSSID, 6);
2900                 ssid_el_p = (u8 *)&body.ssid_el_id;
2901                 bodysize = 18 + priv->SSID_size;
2902         } else {
2903                 ssid_el_p = (u8 *)&body.ap[0];
2904                 bodysize = 12 + priv->SSID_size;
2905         }
2906
2907         ssid_el_p[0] = MFIE_TYPE_SSID;
2908         ssid_el_p[1] = priv->SSID_size;
2909         memcpy(ssid_el_p + 2, priv->SSID, priv->SSID_size);
2910         ssid_el_p[2 + priv->SSID_size] = MFIE_TYPE_RATES;
2911         ssid_el_p[3 + priv->SSID_size] = 4; /* len of suported rates */
2912         memcpy(ssid_el_p + 4 + priv->SSID_size, atmel_basic_rates, 4);
2913
2914         atmel_transmit_management_frame(priv, &header, (void *)&body, bodysize);
2915 }
2916
2917 static int is_frame_from_current_bss(struct atmel_private *priv,
2918                                      struct ieee80211_hdr_4addr *header)
2919 {
2920         if (le16_to_cpu(header->frame_ctl) & IEEE80211_FCTL_FROMDS)
2921                 return memcmp(header->addr3, priv->CurrentBSSID, 6) == 0;
2922         else
2923                 return memcmp(header->addr2, priv->CurrentBSSID, 6) == 0;
2924 }
2925
2926 static int retrieve_bss(struct atmel_private *priv)
2927 {
2928         int i;
2929         int max_rssi = -128;
2930         int max_index = -1;
2931
2932         if (priv->BSS_list_entries == 0)
2933                 return -1;
2934
2935         if (priv->connect_to_any_BSS) {
2936                 /* Select a BSS with the max-RSSI but of the same type and of
2937                    the same WEP mode and that it is not marked as 'bad' (i.e.
2938                    we had previously failed to connect to this BSS with the
2939                    settings that we currently use) */
2940                 priv->current_BSS = 0;
2941                 for (i = 0; i < priv->BSS_list_entries; i++) {
2942                         if (priv->operating_mode == priv->BSSinfo[i].BSStype &&
2943                             ((!priv->wep_is_on && !priv->BSSinfo[i].UsingWEP) ||
2944                              (priv->wep_is_on && priv->BSSinfo[i].UsingWEP)) &&
2945                             !(priv->BSSinfo[i].channel & 0x80)) {
2946                                 max_rssi = priv->BSSinfo[i].RSSI;
2947                                 priv->current_BSS = max_index = i;
2948                         }
2949                 }
2950                 return max_index;
2951         }
2952
2953         for (i = 0; i < priv->BSS_list_entries; i++) {
2954                 if (priv->SSID_size == priv->BSSinfo[i].SSIDsize &&
2955                     memcmp(priv->SSID, priv->BSSinfo[i].SSID, priv->SSID_size) == 0 &&
2956                     priv->operating_mode == priv->BSSinfo[i].BSStype &&
2957                     atmel_validate_channel(priv, priv->BSSinfo[i].channel) == 0) {
2958                         if (priv->BSSinfo[i].RSSI >= max_rssi) {
2959                                 max_rssi = priv->BSSinfo[i].RSSI;
2960                                 max_index = i;
2961                         }
2962                 }
2963         }
2964         return max_index;
2965 }
2966
2967 static void store_bss_info(struct atmel_private *priv,
2968                            struct ieee80211_hdr_4addr *header, u16 capability,
2969                            u16 beacon_period, u8 channel, u8 rssi, u8 ssid_len,
2970                            u8 *ssid, int is_beacon)
2971 {
2972         u8 *bss = capability & WLAN_CAPABILITY_ESS ? header->addr2 : header->addr3;
2973         int i, index;
2974
2975         for (index = -1, i = 0; i < priv->BSS_list_entries; i++)
2976                 if (memcmp(bss, priv->BSSinfo[i].BSSID, 6) == 0)
2977                         index = i;
2978
2979         /* If we process a probe and an entry from this BSS exists
2980            we will update the BSS entry with the info from this BSS.
2981            If we process a beacon we will only update RSSI */
2982
2983         if (index == -1) {
2984                 if (priv->BSS_list_entries == MAX_BSS_ENTRIES)
2985                         return;
2986                 index = priv->BSS_list_entries++;
2987                 memcpy(priv->BSSinfo[index].BSSID, bss, 6);
2988                 priv->BSSinfo[index].RSSI = rssi;
2989         } else {
2990                 if (rssi > priv->BSSinfo[index].RSSI)
2991                         priv->BSSinfo[index].RSSI = rssi;
2992                 if (is_beacon)
2993                         return;
2994         }
2995
2996         priv->BSSinfo[index].channel = channel;
2997         priv->BSSinfo[index].beacon_period = beacon_period;
2998         priv->BSSinfo[index].UsingWEP = capability & WLAN_CAPABILITY_PRIVACY;
2999         memcpy(priv->BSSinfo[index].SSID, ssid, ssid_len);
3000         priv->BSSinfo[index].SSIDsize = ssid_len;
3001
3002         if (capability & WLAN_CAPABILITY_IBSS)
3003                 priv->BSSinfo[index].BSStype = IW_MODE_ADHOC;
3004         else if (capability & WLAN_CAPABILITY_ESS)
3005                 priv->BSSinfo[index].BSStype =IW_MODE_INFRA;
3006
3007         priv->BSSinfo[index].preamble = capability & MFIE_TYPE_POWER_CONSTRAINT ?
3008                 SHORT_PREAMBLE : LONG_PREAMBLE;
3009 }
3010
3011 static void authenticate(struct atmel_private *priv, u16 frame_len)
3012 {
3013         struct auth_body *auth = (struct auth_body *)priv->rx_buf;
3014         u16 status = le16_to_cpu(auth->status);
3015         u16 trans_seq_no = le16_to_cpu(auth->trans_seq);
3016         u16 system = le16_to_cpu(auth->alg);
3017
3018         if (status == WLAN_STATUS_SUCCESS && !priv->wep_is_on) {
3019                 /* no WEP */
3020                 if (priv->station_was_associated) {
3021                         atmel_enter_state(priv, STATION_STATE_REASSOCIATING);
3022                         send_association_request(priv, 1);
3023                         return;
3024                 } else {
3025                         atmel_enter_state(priv, STATION_STATE_ASSOCIATING);
3026                         send_association_request(priv, 0);
3027                         return;
3028                 }
3029         }
3030
3031         if (status == WLAN_STATUS_SUCCESS && priv->wep_is_on) {
3032                 int should_associate = 0;
3033                 /* WEP */
3034                 if (trans_seq_no != priv->ExpectedAuthentTransactionSeqNum)
3035                         return;
3036
3037                 if (system == WLAN_AUTH_OPEN) {
3038                         if (trans_seq_no == 0x0002) {
3039                                 should_associate = 1;
3040                         }
3041                 } else if (system == WLAN_AUTH_SHARED_KEY) {
3042                         if (trans_seq_no == 0x0002 &&
3043                             auth->el_id == MFIE_TYPE_CHALLENGE) {
3044                                 send_authentication_request(priv, system, auth->chall_text, auth->chall_text_len);
3045                                 return;
3046                         } else if (trans_seq_no == 0x0004) {
3047                                 should_associate = 1;
3048                         }
3049                 }
3050
3051                 if (should_associate) {
3052                         if(priv->station_was_associated) {
3053                                 atmel_enter_state(priv, STATION_STATE_REASSOCIATING);
3054                                 send_association_request(priv, 1);
3055                                 return;
3056                         } else {
3057                                 atmel_enter_state(priv, STATION_STATE_ASSOCIATING);
3058                                 send_association_request(priv, 0);
3059                                 return;
3060                         }
3061                 }
3062         }
3063
3064         if (status == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) {
3065                 /* Do opensystem first, then try sharedkey */
3066                 if (system == WLAN_AUTH_OPEN) {
3067                         priv->CurrentAuthentTransactionSeqNum = 0x001;
3068                         priv->exclude_unencrypted = 1;
3069                         send_authentication_request(priv, WLAN_AUTH_SHARED_KEY, NULL, 0);
3070                         return;
3071                 } else if (priv->connect_to_any_BSS) {
3072                         int bss_index;
3073
3074                         priv->BSSinfo[(int)(priv->current_BSS)].channel |= 0x80;
3075
3076                         if ((bss_index  = retrieve_bss(priv)) != -1) {
3077                                 atmel_join_bss(priv, bss_index);
3078                                 return;
3079                         }
3080                 }
3081         }
3082
3083         priv->AuthenticationRequestRetryCnt = 0;
3084         atmel_enter_state(priv,  STATION_STATE_MGMT_ERROR);
3085         priv->station_is_associated = 0;
3086 }
3087
3088 static void associate(struct atmel_private *priv, u16 frame_len, u16 subtype)
3089 {
3090         struct ass_resp_format {
3091                 __le16 capability;
3092                 __le16 status;
3093                 __le16 ass_id;
3094                 u8 el_id;
3095                 u8 length;
3096                 u8 rates[4];
3097         } *ass_resp = (struct ass_resp_format *)priv->rx_buf;
3098
3099         u16 status = le16_to_cpu(ass_resp->status);
3100         u16 ass_id = le16_to_cpu(ass_resp->ass_id);
3101         u16 rates_len = ass_resp->length > 4 ? 4 : ass_resp->length;
3102
3103         union iwreq_data wrqu;
3104
3105         if (frame_len < 8 + rates_len)
3106                 return;
3107
3108         if (status == WLAN_STATUS_SUCCESS) {
3109                 if (subtype == IEEE80211_STYPE_ASSOC_RESP)
3110                         priv->AssociationRequestRetryCnt = 0;
3111                 else
3112                         priv->ReAssociationRequestRetryCnt = 0;
3113
3114                 atmel_set_mib16(priv, Mac_Mgmt_Mib_Type,
3115                                 MAC_MGMT_MIB_STATION_ID_POS, ass_id & 0x3fff);
3116                 atmel_set_mib(priv, Phy_Mib_Type,
3117                               PHY_MIB_RATE_SET_POS, ass_resp->rates, rates_len);
3118                 if (priv->power_mode == 0) {
3119                         priv->listen_interval = 1;
3120                         atmel_set_mib8(priv, Mac_Mgmt_Mib_Type,
3121                                        MAC_MGMT_MIB_PS_MODE_POS, ACTIVE_MODE);
3122                         atmel_set_mib16(priv, Mac_Mgmt_Mib_Type,
3123                                         MAC_MGMT_MIB_LISTEN_INTERVAL_POS, 1);
3124                 } else {
3125                         priv->listen_interval = 2;
3126                         atmel_set_mib8(priv, Mac_Mgmt_Mib_Type,
3127                                        MAC_MGMT_MIB_PS_MODE_POS,  PS_MODE);
3128                         atmel_set_mib16(priv, Mac_Mgmt_Mib_Type,
3129                                         MAC_MGMT_MIB_LISTEN_INTERVAL_POS, 2);
3130                 }
3131
3132                 priv->station_is_associated = 1;
3133                 priv->station_was_associated = 1;
3134                 atmel_enter_state(priv, STATION_STATE_READY);
3135
3136                 /* Send association event to userspace */
3137                 wrqu.data.length = 0;
3138                 wrqu.data.flags = 0;
3139                 memcpy(wrqu.ap_addr.sa_data, priv->CurrentBSSID, ETH_ALEN);
3140                 wrqu.ap_addr.sa_family = ARPHRD_ETHER;
3141                 wireless_send_event(priv->dev, SIOCGIWAP, &wrqu, NULL);
3142
3143                 return;
3144         }
3145
3146         if (subtype == IEEE80211_STYPE_ASSOC_RESP &&
3147             status != WLAN_STATUS_ASSOC_DENIED_RATES &&
3148             status != WLAN_STATUS_CAPS_UNSUPPORTED &&
3149             priv->AssociationRequestRetryCnt < MAX_ASSOCIATION_RETRIES) {
3150                 mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
3151                 priv->AssociationRequestRetryCnt++;
3152                 send_association_request(priv, 0);
3153                 return;
3154         }
3155
3156         if (subtype == IEEE80211_STYPE_REASSOC_RESP &&
3157             status != WLAN_STATUS_ASSOC_DENIED_RATES &&
3158             status != WLAN_STATUS_CAPS_UNSUPPORTED &&
3159             priv->AssociationRequestRetryCnt < MAX_ASSOCIATION_RETRIES) {
3160                 mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
3161                 priv->ReAssociationRequestRetryCnt++;
3162                 send_association_request(priv, 1);
3163                 return;
3164         }
3165
3166         atmel_enter_state(priv,  STATION_STATE_MGMT_ERROR);
3167         priv->station_is_associated = 0;
3168
3169         if (priv->connect_to_any_BSS) {
3170                 int bss_index;
3171                 priv->BSSinfo[(int)(priv->current_BSS)].channel |= 0x80;
3172
3173                 if ((bss_index = retrieve_bss(priv)) != -1)
3174                         atmel_join_bss(priv, bss_index);
3175         }
3176 }
3177
3178 void atmel_join_bss(struct atmel_private *priv, int bss_index)
3179 {
3180         struct bss_info *bss =  &priv->BSSinfo[bss_index];
3181
3182         memcpy(priv->CurrentBSSID, bss->BSSID, 6);
3183         memcpy(priv->SSID, bss->SSID, priv->SSID_size = bss->SSIDsize);
3184
3185         /* The WPA stuff cares about the current AP address */
3186         if (priv->use_wpa)
3187                 build_wpa_mib(priv);
3188
3189         /* When switching to AdHoc turn OFF Power Save if needed */
3190
3191         if (bss->BSStype == IW_MODE_ADHOC &&
3192             priv->operating_mode != IW_MODE_ADHOC &&
3193             priv->power_mode) {
3194                 priv->power_mode = 0;
3195                 priv->listen_interval = 1;
3196                 atmel_set_mib8(priv, Mac_Mgmt_Mib_Type,
3197                                MAC_MGMT_MIB_PS_MODE_POS,  ACTIVE_MODE);
3198                 atmel_set_mib16(priv, Mac_Mgmt_Mib_Type,
3199                                 MAC_MGMT_MIB_LISTEN_INTERVAL_POS, 1);
3200         }
3201
3202         priv->operating_mode = bss->BSStype;
3203         priv->channel = bss->channel & 0x7f;
3204         priv->beacon_period = bss->beacon_period;
3205
3206         if (priv->preamble != bss->preamble) {
3207                 priv->preamble = bss->preamble;
3208                 atmel_set_mib8(priv, Local_Mib_Type,
3209                                LOCAL_MIB_PREAMBLE_TYPE, bss->preamble);
3210         }
3211
3212         if (!priv->wep_is_on && bss->UsingWEP) {
3213                 atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
3214                 priv->station_is_associated = 0;
3215                 return;
3216         }
3217
3218         if (priv->wep_is_on && !bss->UsingWEP) {
3219                 atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
3220                 priv->station_is_associated = 0;
3221                 return;
3222         }
3223
3224         atmel_enter_state(priv, STATION_STATE_JOINNING);
3225
3226         if (priv->operating_mode == IW_MODE_INFRA)
3227                 join(priv, BSS_TYPE_INFRASTRUCTURE);
3228         else
3229                 join(priv, BSS_TYPE_AD_HOC);
3230 }
3231
3232 static void restart_search(struct atmel_private *priv)
3233 {
3234         int bss_index;
3235
3236         if (!priv->connect_to_any_BSS) {
3237                 atmel_scan(priv, 1);
3238         } else {
3239                 priv->BSSinfo[(int)(priv->current_BSS)].channel |= 0x80;
3240
3241                 if ((bss_index = retrieve_bss(priv)) != -1)
3242                         atmel_join_bss(priv, bss_index);
3243                 else
3244                         atmel_scan(priv, 0);
3245         }
3246 }
3247
3248 static void smooth_rssi(struct atmel_private *priv, u8 rssi)
3249 {
3250         u8 old = priv->wstats.qual.level;
3251         u8 max_rssi = 42; /* 502-rmfd-revd max by experiment, default for now */
3252
3253         switch (priv->firmware_type) {
3254                 case ATMEL_FW_TYPE_502E:
3255                         max_rssi = 63; /* 502-rmfd-reve max by experiment */
3256                         break;
3257                 default:
3258                         break;
3259         }
3260
3261         rssi = rssi * 100 / max_rssi;
3262         if ((rssi + old) % 2)
3263                 priv->wstats.qual.level = (rssi + old) / 2 + 1;
3264         else
3265                 priv->wstats.qual.level = (rssi + old) / 2;
3266         priv->wstats.qual.updated |= IW_QUAL_LEVEL_UPDATED;
3267         priv->wstats.qual.updated &= ~IW_QUAL_LEVEL_INVALID;
3268 }
3269
3270 static void atmel_smooth_qual(struct atmel_private *priv)
3271 {
3272         unsigned long time_diff = (jiffies - priv->last_qual) / HZ;
3273         while (time_diff--) {
3274                 priv->last_qual += HZ;
3275                 priv->wstats.qual.qual = priv->wstats.qual.qual / 2;
3276                 priv->wstats.qual.qual +=
3277                         priv->beacons_this_sec * priv->beacon_period * (priv->wstats.qual.level + 100) / 4000;
3278                 priv->beacons_this_sec = 0;
3279         }
3280         priv->wstats.qual.updated |= IW_QUAL_QUAL_UPDATED;
3281         priv->wstats.qual.updated &= ~IW_QUAL_QUAL_INVALID;
3282 }
3283
3284 /* deals with incoming managment frames. */
3285 static void atmel_management_frame(struct atmel_private *priv,
3286                                    struct ieee80211_hdr_4addr *header,
3287                                    u16 frame_len, u8 rssi)
3288 {
3289         u16 subtype;
3290
3291         subtype = le16_to_cpu(header->frame_ctl) & IEEE80211_FCTL_STYPE;
3292         switch (subtype) {
3293         case IEEE80211_STYPE_BEACON:
3294         case IEEE80211_STYPE_PROBE_RESP:
3295
3296                 /* beacon frame has multiple variable-length fields -
3297                    never let an engineer loose with a data structure design. */
3298                 {
3299                         struct beacon_format {
3300                                 __le64 timestamp;
3301                                 __le16 interval;
3302                                 __le16 capability;
3303                                 u8 ssid_el_id;
3304                                 u8 ssid_length;
3305                                 /* ssid here */
3306                                 u8 rates_el_id;
3307                                 u8 rates_length;
3308                                 /* rates here */
3309                                 u8 ds_el_id;
3310                                 u8 ds_length;
3311                                 /* ds here */
3312                         } *beacon = (struct beacon_format *)priv->rx_buf;
3313
3314                         u8 channel, rates_length, ssid_length;
3315                         u64 timestamp = le64_to_cpu(beacon->timestamp);
3316                         u16 beacon_interval = le16_to_cpu(beacon->interval);
3317                         u16 capability = le16_to_cpu(beacon->capability);
3318                         u8 *beaconp = priv->rx_buf;
3319                         ssid_length = beacon->ssid_length;
3320                         /* this blows chunks. */
3321                         if (frame_len < 14 || frame_len < ssid_length + 15)
3322                                 return;
3323                         rates_length = beaconp[beacon->ssid_length + 15];
3324                         if (frame_len < ssid_length + rates_length + 18)
3325                                 return;
3326                         if (ssid_length >  MAX_SSID_LENGTH)
3327                                 return;
3328                         channel = beaconp[ssid_length + rates_length + 18];
3329
3330                         if (priv->station_state == STATION_STATE_READY) {
3331                                 smooth_rssi(priv, rssi);
3332                                 if (is_frame_from_current_bss(priv, header)) {
3333                                         priv->beacons_this_sec++;
3334                                         atmel_smooth_qual(priv);
3335                                         if (priv->last_beacon_timestamp) {
3336                                                 /* Note truncate this to 32 bits - kernel can't divide a long long */
3337                                                 u32 beacon_delay = timestamp - priv->last_beacon_timestamp;
3338                                                 int beacons = beacon_delay / (beacon_interval * 1000);
3339                                                 if (beacons > 1)
3340                                                         priv->wstats.miss.beacon += beacons - 1;
3341                                         }
3342                                         priv->last_beacon_timestamp = timestamp;
3343                                         handle_beacon_probe(priv, capability, channel);
3344                                 }
3345                         }
3346
3347                         if (priv->station_state == STATION_STATE_SCANNING)
3348                                 store_bss_info(priv, header, capability,
3349                                                beacon_interval, channel, rssi,
3350                                                ssid_length,
3351                                                &beacon->rates_el_id,
3352                                                subtype == IEEE80211_STYPE_BEACON);
3353                 }
3354                 break;
3355
3356         case IEEE80211_STYPE_AUTH:
3357
3358                 if (priv->station_state == STATION_STATE_AUTHENTICATING)
3359                         authenticate(priv, frame_len);
3360
3361                 break;
3362
3363         case IEEE80211_STYPE_ASSOC_RESP:
3364         case IEEE80211_STYPE_REASSOC_RESP:
3365
3366                 if (priv->station_state == STATION_STATE_ASSOCIATING ||
3367                     priv->station_state == STATION_STATE_REASSOCIATING)
3368                         associate(priv, frame_len, subtype);
3369
3370                 break;
3371
3372         case IEEE80211_STYPE_DISASSOC:
3373                 if (priv->station_is_associated &&
3374                     priv->operating_mode == IW_MODE_INFRA &&
3375                     is_frame_from_current_bss(priv, header)) {
3376                         priv->station_was_associated = 0;
3377                         priv->station_is_associated = 0;
3378
3379                         atmel_enter_state(priv, STATION_STATE_JOINNING);
3380                         join(priv, BSS_TYPE_INFRASTRUCTURE);
3381                 }
3382
3383                 break;
3384
3385         case IEEE80211_STYPE_DEAUTH:
3386                 if (priv->operating_mode == IW_MODE_INFRA &&
3387                     is_frame_from_current_bss(priv, header)) {
3388                         priv->station_was_associated = 0;
3389
3390                         atmel_enter_state(priv, STATION_STATE_JOINNING);
3391                         join(priv, BSS_TYPE_INFRASTRUCTURE);
3392                 }
3393
3394                 break;
3395         }
3396 }
3397
3398 /* run when timer expires */
3399 static void atmel_management_timer(u_long a)
3400 {
3401         struct net_device *dev = (struct net_device *) a;
3402         struct atmel_private *priv = netdev_priv(dev);
3403         unsigned long flags;
3404
3405         /* Check if the card has been yanked. */
3406         if (priv->card && priv->present_callback &&
3407                 !(*priv->present_callback)(priv->card))
3408                 return;
3409
3410         spin_lock_irqsave(&priv->irqlock, flags);
3411
3412         switch (priv->station_state) {
3413
3414         case STATION_STATE_AUTHENTICATING:
3415                 if (priv->AuthenticationRequestRetryCnt >= MAX_AUTHENTICATION_RETRIES) {
3416                         atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
3417                         priv->station_is_associated = 0;
3418                         priv->AuthenticationRequestRetryCnt = 0;
3419                         restart_search(priv);
3420                 } else {
3421                         int auth = WLAN_AUTH_OPEN;
3422                         priv->AuthenticationRequestRetryCnt++;
3423                         priv->CurrentAuthentTransactionSeqNum = 0x0001;
3424                         mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
3425                         if (priv->wep_is_on && priv->exclude_unencrypted)
3426                                 auth = WLAN_AUTH_SHARED_KEY;
3427                         send_authentication_request(priv, auth, NULL, 0);
3428           }
3429           break;
3430
3431         case STATION_STATE_ASSOCIATING:
3432                 if (priv->AssociationRequestRetryCnt == MAX_ASSOCIATION_RETRIES) {
3433                         atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
3434                         priv->station_is_associated = 0;
3435                         priv->AssociationRequestRetryCnt = 0;
3436                         restart_search(priv);
3437                 } else {
3438                         priv->AssociationRequestRetryCnt++;
3439                         mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
3440                         send_association_request(priv, 0);
3441                 }
3442           break;
3443
3444         case STATION_STATE_REASSOCIATING:
3445                 if (priv->ReAssociationRequestRetryCnt == MAX_ASSOCIATION_RETRIES) {
3446                         atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
3447                         priv->station_is_associated = 0;
3448                         priv->ReAssociationRequestRetryCnt = 0;
3449                         restart_search(priv);
3450                 } else {
3451                         priv->ReAssociationRequestRetryCnt++;
3452                         mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
3453                         send_association_request(priv, 1);
3454                 }
3455                 break;
3456
3457         default:
3458                 break;
3459         }
3460
3461         spin_unlock_irqrestore(&priv->irqlock, flags);
3462 }
3463
3464 static void atmel_command_irq(struct atmel_private *priv)
3465 {
3466         u8 status = atmel_rmem8(priv, atmel_co(priv, CMD_BLOCK_STATUS_OFFSET));
3467         u8 command = atmel_rmem8(priv, atmel_co(priv, CMD_BLOCK_COMMAND_OFFSET));
3468         int fast_scan;
3469         union iwreq_data wrqu;
3470
3471         if (status == CMD_STATUS_IDLE ||
3472             status == CMD_STATUS_IN_PROGRESS)
3473                 return;
3474
3475         switch (command){
3476
3477         case CMD_Start:
3478                 if (status == CMD_STATUS_COMPLETE) {
3479                         priv->station_was_associated = priv->station_is_associated;
3480                         atmel_get_mib(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_CUR_BSSID_POS,
3481                                       (u8 *)priv->CurrentBSSID, 6);
3482                         atmel_enter_state(priv, STATION_STATE_READY);
3483                 }
3484                 break;
3485
3486         case CMD_Scan:
3487                 fast_scan = priv->fast_scan;
3488                 priv->fast_scan = 0;
3489
3490                 if (status != CMD_STATUS_COMPLETE) {
3491                         atmel_scan(priv, 1);
3492                 } else {
3493                         int bss_index = retrieve_bss(priv);
3494                         int notify_scan_complete = 1;
3495                         if (bss_index != -1) {
3496                                 atmel_join_bss(priv, bss_index);
3497                         } else if (priv->operating_mode == IW_MODE_ADHOC &&
3498                                    priv->SSID_size != 0) {
3499                                 start(priv, BSS_TYPE_AD_HOC);
3500                         } else {
3501                                 priv->fast_scan = !fast_scan;
3502                                 atmel_scan(priv, 1);
3503                                 notify_scan_complete = 0;
3504                         }
3505                         priv->site_survey_state = SITE_SURVEY_COMPLETED;
3506                         if (notify_scan_complete) {
3507                                 wrqu.data.length = 0;
3508                                 wrqu.data.flags = 0;
3509                                 wireless_send_event(priv->dev, SIOCGIWSCAN, &wrqu, NULL);
3510                         }
3511                 }
3512                 break;
3513
3514         case CMD_SiteSurvey:
3515                 priv->fast_scan = 0;
3516
3517                 if (status != CMD_STATUS_COMPLETE)
3518                         return;
3519
3520                 priv->site_survey_state = SITE_SURVEY_COMPLETED;
3521                 if (priv->station_is_associated) {
3522                         atmel_enter_state(priv, STATION_STATE_READY);
3523                         wrqu.data.length = 0;
3524                         wrqu.data.flags = 0;
3525                         wireless_send_event(priv->dev, SIOCGIWSCAN, &wrqu, NULL);
3526                 } else {
3527                         atmel_scan(priv, 1);
3528                 }
3529                 break;
3530
3531         case CMD_Join:
3532                 if (status == CMD_STATUS_COMPLETE) {
3533                         if (priv->operating_mode == IW_MODE_ADHOC) {
3534                                 priv->station_was_associated = priv->station_is_associated;
3535                                 atmel_enter_state(priv, STATION_STATE_READY);
3536                         } else {
3537                                 int auth = WLAN_AUTH_OPEN;
3538                                 priv->AuthenticationRequestRetryCnt = 0;
3539                                 atmel_enter_state(priv, STATION_STATE_AUTHENTICATING);
3540
3541                                 mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
3542                                 priv->CurrentAuthentTransactionSeqNum = 0x0001;
3543                                 if (priv->wep_is_on && priv->exclude_unencrypted)
3544                                         auth = WLAN_AUTH_SHARED_KEY;
3545                                 send_authentication_request(priv, auth, NULL, 0);
3546                         }
3547                         return;
3548                 }
3549
3550                 atmel_scan(priv, 1);
3551         }
3552 }
3553
3554 static int atmel_wakeup_firmware(struct atmel_private *priv)
3555 {
3556         struct host_info_struct *iface = &priv->host_info;
3557         u16 mr1, mr3;
3558         int i;
3559
3560         if (priv->card_type == CARD_TYPE_SPI_FLASH)
3561                 atmel_set_gcr(priv->dev, GCR_REMAP);
3562
3563         /* wake up on-board processor */
3564         atmel_clear_gcr(priv->dev, 0x0040);
3565         atmel_write16(priv->dev, BSR, BSS_SRAM);
3566
3567         if (priv->card_type == CARD_TYPE_SPI_FLASH)
3568                 mdelay(100);
3569
3570         /* and wait for it */
3571         for (i = LOOP_RETRY_LIMIT; i; i--) {
3572                 mr1 = atmel_read16(priv->dev, MR1);
3573                 mr3 = atmel_read16(priv->dev, MR3);
3574
3575                 if (mr3 & MAC_BOOT_COMPLETE)
3576                         break;
3577                 if (mr1 & MAC_BOOT_COMPLETE &&
3578                     priv->bus_type == BUS_TYPE_PCCARD)
3579                         break;
3580         }
3581
3582         if (i == 0) {
3583                 printk(KERN_ALERT "%s: MAC failed to boot.\n", priv->dev->name);
3584                 return -EIO;
3585         }
3586
3587         if ((priv->host_info_base = atmel_read16(priv->dev, MR2)) == 0xffff) {
3588                 printk(KERN_ALERT "%s: card missing.\n", priv->dev->name);
3589                 return -ENODEV;
3590         }
3591
3592         /* now check for completion of MAC initialization through
3593            the FunCtrl field of the IFACE, poll MR1 to detect completion of
3594            MAC initialization, check completion status, set interrupt mask,
3595            enables interrupts and calls Tx and Rx initialization functions */
3596
3597         atmel_wmem8(priv, atmel_hi(priv, IFACE_FUNC_CTRL_OFFSET), FUNC_CTRL_INIT_COMPLETE);
3598
3599         for (i = LOOP_RETRY_LIMIT; i; i--) {
3600                 mr1 = atmel_read16(priv->dev, MR1);
3601                 mr3 = atmel_read16(priv->dev, MR3);
3602
3603                 if (mr3 & MAC_INIT_COMPLETE)
3604                         break;
3605                 if (mr1 & MAC_INIT_COMPLETE &&
3606                     priv->bus_type == BUS_TYPE_PCCARD)
3607                         break;
3608         }
3609
3610         if (i == 0) {
3611                 printk(KERN_ALERT "%s: MAC failed to initialise.\n",
3612                                 priv->dev->name);
3613                 return -EIO;
3614         }
3615
3616         /* Check for MAC_INIT_OK only on the register that the MAC_INIT_OK was set */
3617         if ((mr3 & MAC_INIT_COMPLETE) &&
3618             !(atmel_read16(priv->dev, MR3) & MAC_INIT_OK)) {
3619                 printk(KERN_ALERT "%s: MAC failed MR3 self-test.\n", priv->dev->name);
3620                 return -EIO;
3621         }
3622         if ((mr1 & MAC_INIT_COMPLETE) &&
3623             !(atmel_read16(priv->dev, MR1) & MAC_INIT_OK)) {
3624                 printk(KERN_ALERT "%s: MAC failed MR1 self-test.\n", priv->dev->name);
3625                 return -EIO;
3626         }
3627
3628         atmel_copy_to_host(priv->dev, (unsigned char *)iface,
3629                            priv->host_info_base, sizeof(*iface));
3630
3631         iface->tx_buff_pos = le16_to_cpu(iface->tx_buff_pos);
3632         iface->tx_buff_size = le16_to_cpu(iface->tx_buff_size);
3633         iface->tx_desc_pos = le16_to_cpu(iface->tx_desc_pos);
3634         iface->tx_desc_count = le16_to_cpu(iface->tx_desc_count);
3635         iface->rx_buff_pos = le16_to_cpu(iface->rx_buff_pos);
3636         iface->rx_buff_size = le16_to_cpu(iface->rx_buff_size);
3637         iface->rx_desc_pos = le16_to_cpu(iface->rx_desc_pos);
3638         iface->rx_desc_count = le16_to_cpu(iface->rx_desc_count);
3639         iface->build_version = le16_to_cpu(iface->build_version);
3640         iface->command_pos = le16_to_cpu(iface->command_pos);
3641         iface->major_version = le16_to_cpu(iface->major_version);
3642         iface->minor_version = le16_to_cpu(iface->minor_version);
3643         iface->func_ctrl = le16_to_cpu(iface->func_ctrl);
3644         iface->mac_status = le16_to_cpu(iface->mac_status);
3645
3646         return 0;
3647 }
3648
3649 /* determine type of memory and MAC address */
3650 static int probe_atmel_card(struct net_device *dev)
3651 {
3652         int rc = 0;
3653         struct atmel_private *priv = netdev_priv(dev);
3654
3655         /* reset pccard */
3656         if (priv->bus_type == BUS_TYPE_PCCARD)
3657                 atmel_write16(dev, GCR, 0x0060);
3658
3659         atmel_write16(dev, GCR, 0x0040);
3660         mdelay(500);
3661
3662         if (atmel_read16(dev, MR2) == 0) {
3663                 /* No stored firmware so load a small stub which just
3664                    tells us the MAC address */
3665                 int i;
3666                 priv->card_type = CARD_TYPE_EEPROM;
3667                 atmel_write16(dev, BSR, BSS_IRAM);
3668                 atmel_copy_to_card(dev, 0, mac_reader, sizeof(mac_reader));
3669                 atmel_set_gcr(dev, GCR_REMAP);
3670                 atmel_clear_gcr(priv->dev, 0x0040);
3671                 atmel_write16(dev, BSR, BSS_SRAM);
3672                 for (i = LOOP_RETRY_LIMIT; i; i--)
3673                         if (atmel_read16(dev, MR3) & MAC_BOOT_COMPLETE)
3674                                 break;
3675                 if (i == 0) {
3676                         printk(KERN_ALERT "%s: MAC failed to boot MAC address reader.\n", dev->name);
3677                 } else {
3678                         atmel_copy_to_host(dev, dev->dev_addr, atmel_read16(dev, MR2), 6);
3679                         /* got address, now squash it again until the network
3680                            interface is opened */
3681                         if (priv->bus_type == BUS_TYPE_PCCARD)
3682                                 atmel_write16(dev, GCR, 0x0060);
3683                         atmel_write16(dev, GCR, 0x0040);
3684                         rc = 1;
3685                 }
3686         } else if (atmel_read16(dev, MR4) == 0) {
3687                 /* Mac address easy in this case. */
3688                 priv->card_type = CARD_TYPE_PARALLEL_FLASH;
3689                 atmel_write16(dev,  BSR, 1);
3690                 atmel_copy_to_host(dev, dev->dev_addr, 0xc000, 6);
3691                 atmel_write16(dev,  BSR, 0x200);
3692                 rc = 1;
3693         } else {
3694                 /* Standard firmware in flash, boot it up and ask
3695                    for the Mac Address */
3696                 priv->card_type = CARD_TYPE_SPI_FLASH;
3697                 if (atmel_wakeup_firmware(priv) == 0) {
3698                         atmel_get_mib(priv, Mac_Address_Mib_Type, 0, dev->dev_addr, 6);
3699
3700                         /* got address, now squash it again until the network
3701                            interface is opened */
3702                         if (priv->bus_type == BUS_TYPE_PCCARD)
3703                                 atmel_write16(dev, GCR, 0x0060);
3704                         atmel_write16(dev, GCR, 0x0040);
3705                         rc = 1;
3706                 }
3707         }
3708
3709         if (rc) {
3710                 if (dev->dev_addr[0] == 0xFF) {
3711                         u8 default_mac[] = {0x00,0x04, 0x25, 0x00, 0x00, 0x00};
3712                         printk(KERN_ALERT "%s: *** Invalid MAC address. UPGRADE Firmware ****\n", dev->name);
3713                         memcpy(dev->dev_addr, default_mac, 6);
3714                 }
3715         }
3716
3717         return rc;
3718 }
3719
3720 /* Move the encyption information on the MIB structure.
3721    This routine is for the pre-WPA firmware: later firmware has
3722    a different format MIB and a different routine. */
3723 static void build_wep_mib(struct atmel_private *priv)
3724 {
3725         struct { /* NB this is matched to the hardware, don't change. */
3726                 u8 wep_is_on;
3727                 u8 default_key; /* 0..3 */
3728                 u8 reserved;
3729                 u8 exclude_unencrypted;
3730
3731                 u32 WEPICV_error_count;
3732                 u32 WEP_excluded_count;
3733
3734                 u8 wep_keys[MAX_ENCRYPTION_KEYS][13];
3735                 u8 encryption_level; /* 0, 1, 2 */
3736                 u8 reserved2[3];
3737         } mib;
3738         int i;
3739
3740         mib.wep_is_on = priv->wep_is_on;
3741         if (priv->wep_is_on) {
3742                 if (priv->wep_key_len[priv->default_key] > 5)
3743                         mib.encryption_level = 2;
3744                 else
3745                         mib.encryption_level = 1;
3746         } else {
3747                 mib.encryption_level = 0;
3748         }
3749
3750         mib.default_key = priv->default_key;
3751         mib.exclude_unencrypted = priv->exclude_unencrypted;
3752
3753         for (i = 0; i < MAX_ENCRYPTION_KEYS; i++)
3754                 memcpy(mib.wep_keys[i], priv->wep_keys[i], 13);
3755
3756         atmel_set_mib(priv, Mac_Wep_Mib_Type, 0, (u8 *)&mib, sizeof(mib));
3757 }
3758
3759 static void build_wpa_mib(struct atmel_private *priv)
3760 {
3761         /* This is for the later (WPA enabled) firmware. */
3762
3763         struct { /* NB this is matched to the hardware, don't change. */
3764                 u8 cipher_default_key_value[MAX_ENCRYPTION_KEYS][MAX_ENCRYPTION_KEY_SIZE];
3765                 u8 receiver_address[6];
3766                 u8 wep_is_on;
3767                 u8 default_key; /* 0..3 */
3768                 u8 group_key;
3769                 u8 exclude_unencrypted;
3770                 u8 encryption_type;
3771                 u8 reserved;
3772
3773                 u32 WEPICV_error_count;
3774                 u32 WEP_excluded_count;
3775
3776                 u8 key_RSC[4][8];
3777         } mib;
3778
3779         int i;
3780
3781         mib.wep_is_on = priv->wep_is_on;
3782         mib.exclude_unencrypted = priv->exclude_unencrypted;
3783         memcpy(mib.receiver_address, priv->CurrentBSSID, 6);
3784
3785         /* zero all the keys before adding in valid ones. */
3786         memset(mib.cipher_default_key_value, 0, sizeof(mib.cipher_default_key_value));
3787
3788         if (priv->wep_is_on) {
3789                 /* There's a comment in the Atmel code to the effect that this
3790                    is only valid when still using WEP, it may need to be set to
3791                    something to use WPA */
3792                 memset(mib.key_RSC, 0, sizeof(mib.key_RSC));
3793
3794                 mib.default_key = mib.group_key = 255;
3795                 for (i = 0; i < MAX_ENCRYPTION_KEYS; i++) {
3796                         if (priv->wep_key_len[i] > 0) {
3797                                 memcpy(mib.cipher_default_key_value[i], priv->wep_keys[i], MAX_ENCRYPTION_KEY_SIZE);
3798                                 if (i == priv->default_key) {
3799                                         mib.default_key = i;
3800                                         mib.cipher_default_key_value[i][MAX_ENCRYPTION_KEY_SIZE-1] = 7;
3801                                         mib.cipher_default_key_value[i][MAX_ENCRYPTION_KEY_SIZE-2] = priv->pairwise_cipher_suite;
3802                                 } else {
3803                                         mib.group_key = i;
3804                                         priv->group_cipher_suite = priv->pairwise_cipher_suite;
3805                                         mib.cipher_default_key_value[i][MAX_ENCRYPTION_KEY_SIZE-1] = 1;
3806                                         mib.cipher_default_key_value[i][MAX_ENCRYPTION_KEY_SIZE-2] = priv->group_cipher_suite;
3807                                 }
3808                         }
3809                 }
3810                 if (mib.default_key == 255)
3811                         mib.default_key = mib.group_key != 255 ? mib.group_key : 0;
3812                 if (mib.group_key == 255)
3813                         mib.group_key = mib.default_key;
3814
3815         }
3816
3817         atmel_set_mib(priv, Mac_Wep_Mib_Type, 0, (u8 *)&mib, sizeof(mib));
3818 }
3819
3820 static int reset_atmel_card(struct net_device *dev)
3821 {
3822         /* do everything necessary to wake up the hardware, including
3823            waiting for the lightning strike and throwing the knife switch....
3824
3825            set all the Mib values which matter in the card to match
3826            their settings in the atmel_private structure. Some of these
3827            can be altered on the fly, but many (WEP, infrastucture or ad-hoc)
3828            can only be changed by tearing down the world and coming back through
3829            here.
3830
3831            This routine is also responsible for initialising some
3832            hardware-specific fields in the atmel_private structure,
3833            including a copy of the firmware's hostinfo stucture
3834            which is the route into the rest of the firmare datastructures. */
3835
3836         struct atmel_private *priv = netdev_priv(dev);
3837         u8 configuration;
3838         int old_state = priv->station_state;
3839         int err = 0;
3840
3841         /* data to add to the firmware names, in priority order
3842            this implemenents firmware versioning */
3843
3844         static char *firmware_modifier[] = {
3845                 "-wpa",
3846                 "",
3847                 NULL
3848         };
3849
3850         /* reset pccard */
3851         if (priv->bus_type == BUS_TYPE_PCCARD)
3852                 atmel_write16(priv->dev, GCR, 0x0060);
3853
3854         /* stop card , disable interrupts */
3855         atmel_write16(priv->dev, GCR, 0x0040);
3856
3857         if (priv->card_type == CARD_TYPE_EEPROM) {
3858                 /* copy in firmware if needed */
3859                 const struct firmware *fw_entry = NULL;
3860                 const unsigned char *fw;
3861                 int len = priv->firmware_length;
3862                 if (!(fw = priv->firmware)) {
3863                         if (priv->firmware_type == ATMEL_FW_TYPE_NONE) {
3864                                 if (strlen(priv->firmware_id) == 0) {
3865                                         printk(KERN_INFO
3866                                                "%s: card type is unknown: assuming at76c502 firmware is OK.\n",
3867                                                dev->name);
3868                                         printk(KERN_INFO
3869                                                "%s: if not, use the firmware= module parameter.\n",
3870                                                dev->name);
3871                                         strcpy(priv->firmware_id, "atmel_at76c502.bin");
3872                                 }
3873                                 err = request_firmware(&fw_entry, priv->firmware_id, priv->sys_dev);
3874                                 if (err != 0) {
3875                                         printk(KERN_ALERT
3876                                                "%s: firmware %s is missing, cannot continue.\n",
3877                                                dev->name, priv->firmware_id);
3878                                         return err;
3879                                 }
3880                         } else {
3881                                 int fw_index = 0;
3882                                 int success = 0;
3883
3884                                 /* get firmware filename entry based on firmware type ID */
3885                                 while (fw_table[fw_index].fw_type != priv->firmware_type
3886                                                 && fw_table[fw_index].fw_type != ATMEL_FW_TYPE_NONE)
3887                                         fw_index++;
3888
3889                                 /* construct the actual firmware file name */
3890                                 if (fw_table[fw_index].fw_type != ATMEL_FW_TYPE_NONE) {
3891                                         int i;
3892                                         for (i = 0; firmware_modifier[i]; i++) {
3893                                                 snprintf(priv->firmware_id, 32, "%s%s.%s", fw_table[fw_index].fw_file,
3894                                                         firmware_modifier[i], fw_table[fw_index].fw_file_ext);
3895                                                 priv->firmware_id[31] = '\0';
3896                                                 if (request_firmware(&fw_entry, priv->firmware_id, priv->sys_dev) == 0) {
3897                                                         success = 1;
3898                                                         break;
3899                                                 }
3900                                         }
3901                                 }
3902                                 if (!success) {
3903                                         printk(KERN_ALERT
3904                                                "%s: firmware %s is missing, cannot start.\n",
3905                                                dev->name, priv->firmware_id);
3906                                         priv->firmware_id[0] = '\0';
3907                                         return -ENOENT;
3908                                 }
3909                         }
3910
3911                         fw = fw_entry->data;
3912                         len = fw_entry->size;
3913                 }
3914
3915                 if (len <= 0x6000) {
3916                         atmel_write16(priv->dev, BSR, BSS_IRAM);
3917                         atmel_copy_to_card(priv->dev, 0, fw, len);
3918                         atmel_set_gcr(priv->dev, GCR_REMAP);
3919                 } else {
3920                         /* Remap */
3921                         atmel_set_gcr(priv->dev, GCR_REMAP);
3922                         atmel_write16(priv->dev, BSR, BSS_IRAM);
3923                         atmel_copy_to_card(priv->dev, 0, fw, 0x6000);
3924                         atmel_write16(priv->dev, BSR, 0x2ff);
3925                         atmel_copy_to_card(priv->dev, 0x8000, &fw[0x6000], len - 0x6000);
3926                 }
3927
3928                 if (fw_entry)
3929                         release_firmware(fw_entry);
3930         }
3931
3932         err = atmel_wakeup_firmware(priv);
3933         if (err != 0)
3934                 return err;
3935
3936         /* Check the version and set the correct flag for wpa stuff,
3937            old and new firmware is incompatible.
3938            The pre-wpa 3com firmware reports major version 5,
3939            the wpa 3com firmware is major version 4 and doesn't need
3940            the 3com broken-ness filter. */
3941         priv->use_wpa = (priv->host_info.major_version == 4);
3942         priv->radio_on_broken = (priv->host_info.major_version == 5);
3943
3944         /* unmask all irq sources */
3945         atmel_wmem8(priv, atmel_hi(priv, IFACE_INT_MASK_OFFSET), 0xff);
3946
3947         /* int Tx system and enable Tx */
3948         atmel_wmem8(priv, atmel_tx(priv, TX_DESC_FLAGS_OFFSET, 0), 0);
3949         atmel_wmem32(priv, atmel_tx(priv, TX_DESC_NEXT_OFFSET, 0), 0x80000000L);
3950         atmel_wmem16(priv, atmel_tx(priv, TX_DESC_POS_OFFSET, 0), 0);
3951         atmel_wmem16(priv, atmel_tx(priv, TX_DESC_SIZE_OFFSET, 0), 0);
3952
3953         priv->tx_desc_free = priv->host_info.tx_desc_count;
3954         priv->tx_desc_head = 0;
3955         priv->tx_desc_tail = 0;
3956         priv->tx_desc_previous = 0;
3957         priv->tx_free_mem = priv->host_info.tx_buff_size;
3958         priv->tx_buff_head = 0;
3959         priv->tx_buff_tail = 0;
3960
3961         configuration = atmel_rmem8(priv, atmel_hi(priv, IFACE_FUNC_CTRL_OFFSET));
3962         atmel_wmem8(priv, atmel_hi(priv, IFACE_FUNC_CTRL_OFFSET),
3963                                    configuration | FUNC_CTRL_TxENABLE);
3964
3965         /* init Rx system and enable */
3966         priv->rx_desc_head = 0;
3967
3968         configuration = atmel_rmem8(priv, atmel_hi(priv, IFACE_FUNC_CTRL_OFFSET));
3969         atmel_wmem8(priv, atmel_hi(priv, IFACE_FUNC_CTRL_OFFSET),
3970                                    configuration | FUNC_CTRL_RxENABLE);
3971
3972         if (!priv->radio_on_broken) {
3973                 if (atmel_send_command_wait(priv, CMD_EnableRadio, NULL, 0) ==
3974                     CMD_STATUS_REJECTED_RADIO_OFF) {
3975                         printk(KERN_INFO "%s: cannot turn the radio on.\n",
3976                                dev->name);
3977                         return -EIO;
3978                 }
3979         }
3980
3981         /* set up enough MIB values to run. */
3982         atmel_set_mib8(priv, Local_Mib_Type, LOCAL_MIB_AUTO_TX_RATE_POS, priv->auto_tx_rate);
3983         atmel_set_mib8(priv, Local_Mib_Type,  LOCAL_MIB_TX_PROMISCUOUS_POS,  PROM_MODE_OFF);
3984         atmel_set_mib16(priv, Mac_Mib_Type, MAC_MIB_RTS_THRESHOLD_POS, priv->rts_threshold);
3985         atmel_set_mib16(priv, Mac_Mib_Type, MAC_MIB_FRAG_THRESHOLD_POS, priv->frag_threshold);
3986         atmel_set_mib8(priv, Mac_Mib_Type, MAC_MIB_SHORT_RETRY_POS, priv->short_retry);
3987         atmel_set_mib8(priv, Mac_Mib_Type, MAC_MIB_LONG_RETRY_POS, priv->long_retry);
3988         atmel_set_mib8(priv, Local_Mib_Type, LOCAL_MIB_PREAMBLE_TYPE, priv->preamble);
3989         atmel_set_mib(priv, Mac_Address_Mib_Type, MAC_ADDR_MIB_MAC_ADDR_POS,
3990                       priv->dev->dev_addr, 6);
3991         atmel_set_mib8(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_PS_MODE_POS, ACTIVE_MODE);
3992         atmel_set_mib16(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_LISTEN_INTERVAL_POS, 1);
3993         atmel_set_mib16(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_BEACON_PER_POS, priv->default_beacon_period);
3994         atmel_set_mib(priv, Phy_Mib_Type, PHY_MIB_RATE_SET_POS, atmel_basic_rates, 4);
3995         atmel_set_mib8(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_CUR_PRIVACY_POS, priv->wep_is_on);
3996         if (priv->use_wpa)
3997                 build_wpa_mib(priv);
3998         else
3999                 build_wep_mib(priv);
4000
4001         if (old_state == STATION_STATE_READY)
4002         {
4003                 union iwreq_data wrqu;
4004
4005                 wrqu.data.length = 0;
4006                 wrqu.data.flags = 0;
4007                 wrqu.ap_addr.sa_family = ARPHRD_ETHER;
4008                 memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
4009                 wireless_send_event(priv->dev, SIOCGIWAP, &wrqu, NULL);
4010         }
4011
4012         return 0;
4013 }
4014
4015 static void atmel_send_command(struct atmel_private *priv, int command,
4016                                void *cmd, int cmd_size)
4017 {
4018         if (cmd)
4019                 atmel_copy_to_card(priv->dev, atmel_co(priv, CMD_BLOCK_PARAMETERS_OFFSET),
4020                                    cmd, cmd_size);
4021
4022         atmel_wmem8(priv, atmel_co(priv, CMD_BLOCK_COMMAND_OFFSET), command);
4023         atmel_wmem8(priv, atmel_co(priv, CMD_BLOCK_STATUS_OFFSET), 0);
4024 }
4025
4026 static int atmel_send_command_wait(struct atmel_private *priv, int command,
4027                                    void *cmd, int cmd_size)
4028 {
4029         int i, status;
4030
4031         atmel_send_command(priv, command, cmd, cmd_size);
4032
4033         for (i = 5000; i; i--) {
4034                 status = atmel_rmem8(priv, atmel_co(priv, CMD_BLOCK_STATUS_OFFSET));
4035                 if (status != CMD_STATUS_IDLE &&
4036                     status != CMD_STATUS_IN_PROGRESS)
4037                         break;
4038                 udelay(20);
4039         }
4040
4041         if (i == 0) {
4042                 printk(KERN_ALERT "%s: failed to contact MAC.\n", priv->dev->name);
4043                 status =  CMD_STATUS_HOST_ERROR;
4044         } else {
4045                 if (command != CMD_EnableRadio)
4046                         status = CMD_STATUS_COMPLETE;
4047         }
4048
4049         return status;
4050 }
4051
4052 static u8 atmel_get_mib8(struct atmel_private *priv, u8 type, u8 index)
4053 {
4054         struct get_set_mib m;
4055         m.type = type;
4056         m.size = 1;
4057         m.index = index;
4058
4059         atmel_send_command_wait(priv, CMD_Get_MIB_Vars, &m, MIB_HEADER_SIZE + 1);
4060         return atmel_rmem8(priv, atmel_co(priv, CMD_BLOCK_PARAMETERS_OFFSET + MIB_HEADER_SIZE));
4061 }
4062
4063 static void atmel_set_mib8(struct atmel_private *priv, u8 type, u8 index, u8 data)
4064 {
4065         struct get_set_mib m;
4066         m.type = type;
4067         m.size = 1;
4068         m.index = index;
4069         m.data[0] = data;
4070
4071         atmel_send_command_wait(priv, CMD_Set_MIB_Vars, &m, MIB_HEADER_SIZE + 1);
4072 }
4073
4074 static void atmel_set_mib16(struct atmel_private *priv, u8 type, u8 index,
4075                             u16 data)
4076 {
4077         struct get_set_mib m;
4078         m.type = type;
4079         m.size = 2;
4080         m.index = index;
4081         m.data[0] = data;
4082         m.data[1] = data >> 8;
4083
4084         atmel_send_command_wait(priv, CMD_Set_MIB_Vars, &m, MIB_HEADER_SIZE + 2);
4085 }
4086
4087 static void atmel_set_mib(struct atmel_private *priv, u8 type, u8 index,
4088                           u8 *data, int data_len)
4089 {
4090         struct get_set_mib m;
4091         m.type = type;
4092         m.size = data_len;
4093         m.index = index;
4094
4095         if (data_len > MIB_MAX_DATA_BYTES)
4096                 printk(KERN_ALERT "%s: MIB buffer too small.\n", priv->dev->name);
4097
4098         memcpy(m.data, data, data_len);
4099         atmel_send_command_wait(priv, CMD_Set_MIB_Vars, &m, MIB_HEADER_SIZE + data_len);
4100 }
4101
4102 static void atmel_get_mib(struct atmel_private *priv, u8 type, u8 index,
4103                           u8 *data, int data_len)
4104 {
4105         struct get_set_mib m;
4106         m.type = type;
4107         m.size = data_len;
4108         m.index = index;
4109
4110         if (data_len > MIB_MAX_DATA_BYTES)
4111                 printk(KERN_ALERT "%s: MIB buffer too small.\n", priv->dev->name);
4112
4113         atmel_send_command_wait(priv, CMD_Get_MIB_Vars, &m, MIB_HEADER_SIZE + data_len);
4114         atmel_copy_to_host(priv->dev, data,
4115                            atmel_co(priv, CMD_BLOCK_PARAMETERS_OFFSET + MIB_HEADER_SIZE), data_len);
4116 }
4117
4118 static void atmel_writeAR(struct net_device *dev, u16 data)
4119 {
4120         int i;
4121         outw(data, dev->base_addr + AR);
4122         /* Address register appears to need some convincing..... */
4123         for (i = 0; data != inw(dev->base_addr + AR) && i < 10; i++)
4124                 outw(data, dev->base_addr + AR);
4125 }
4126
4127 static void atmel_copy_to_card(struct net_device *dev, u16 dest,
4128                                const unsigned char *src, u16 len)
4129 {
4130         int i;
4131         atmel_writeAR(dev, dest);
4132         if (dest % 2) {
4133                 atmel_write8(dev, DR, *src);
4134                 src++; len--;
4135         }
4136         for (i = len; i > 1 ; i -= 2) {
4137                 u8 lb = *src++;
4138                 u8 hb = *src++;
4139                 atmel_write16(dev, DR, lb | (hb << 8));
4140         }
4141         if (i)
4142                 atmel_write8(dev, DR, *src);
4143 }
4144
4145 static void atmel_copy_to_host(struct net_device *dev, unsigned char *dest,
4146                                u16 src, u16 len)
4147 {
4148         int i;
4149         atmel_writeAR(dev, src);
4150         if (src % 2) {
4151                 *dest = atmel_read8(dev, DR);
4152                 dest++; len--;
4153         }
4154         for (i = len; i > 1 ; i -= 2) {
4155                 u16 hw = atmel_read16(dev, DR);
4156                 *dest++ = hw;
4157                 *dest++ = hw >> 8;
4158         }
4159         if (i)
4160                 *dest = atmel_read8(dev, DR);
4161 }
4162
4163 static void atmel_set_gcr(struct net_device *dev, u16 mask)
4164 {
4165         outw(inw(dev->base_addr + GCR) | mask, dev->base_addr + GCR);
4166 }
4167
4168 static void atmel_clear_gcr(struct net_device *dev, u16 mask)
4169 {
4170         outw(inw(dev->base_addr + GCR) & ~mask, dev->base_addr + GCR);
4171 }
4172
4173 static int atmel_lock_mac(struct atmel_private *priv)
4174 {
4175         int i, j = 20;
4176  retry:
4177         for (i = 5000; i; i--) {
4178                 if (!atmel_rmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_HOST_OFFSET)))
4179                         break;
4180                 udelay(20);
4181         }
4182
4183         if (!i)
4184                 return 0; /* timed out */
4185
4186         atmel_wmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_MAC_OFFSET), 1);
4187         if (atmel_rmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_HOST_OFFSET))) {
4188                 atmel_wmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_MAC_OFFSET), 0);
4189                 if (!j--)
4190                         return 0; /* timed out */
4191                 goto retry;
4192         }
4193
4194         return 1;
4195 }
4196
4197 static void atmel_wmem32(struct atmel_private *priv, u16 pos, u32 data)
4198 {
4199         atmel_writeAR(priv->dev, pos);
4200         atmel_write16(priv->dev, DR, data); /* card is little-endian */
4201         atmel_write16(priv->dev, DR, data >> 16);
4202 }
4203
4204 /***************************************************************************/
4205 /* There follows the source form of the MAC address reading firmware       */
4206 /***************************************************************************/
4207 #if 0
4208
4209 /* Copyright 2003 Matthew T. Russotto                                      */
4210 /* But derived from the Atmel 76C502 firmware written by Atmel and         */
4211 /* included in "atmel wireless lan drivers" package                        */
4212 /**
4213     This file is part of net.russotto.AtmelMACFW, hereto referred to
4214     as AtmelMACFW
4215
4216     AtmelMACFW is free software; you can redistribute it and/or modify
4217     it under the terms of the GNU General Public License version 2
4218     as published by the Free Software Foundation.
4219
4220     AtmelMACFW is distributed in the hope that it will be useful,
4221     but WITHOUT ANY WARRANTY; without even the implied warranty of
4222     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
4223     GNU General Public License for more details.
4224
4225     You should have received a copy of the GNU General Public License
4226     along with AtmelMACFW; if not, write to the Free Software
4227     Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
4228
4229 ****************************************************************************/
4230 /* This firmware should work on the 76C502 RFMD, RFMD_D, and RFMD_E        */
4231 /* It will probably work on the 76C504 and 76C502 RFMD_3COM                */
4232 /* It only works on SPI EEPROM versions of the card.                       */
4233
4234 /* This firmware initializes the SPI controller and clock, reads the MAC   */
4235 /* address from the EEPROM into SRAM, and puts the SRAM offset of the MAC  */
4236 /* address in MR2, and sets MR3 to 0x10 to indicate it is done             */
4237 /* It also puts a complete copy of the EEPROM in SRAM with the offset in   */
4238 /* MR4, for investigational purposes (maybe we can determine chip type     */
4239 /* from that?)                                                             */
4240
4241         .org 0
4242     .set MRBASE, 0x8000000
4243         .set CPSR_INITIAL, 0xD3 /* IRQ/FIQ disabled, ARM mode, Supervisor state */
4244         .set CPSR_USER, 0xD1 /* IRQ/FIQ disabled, ARM mode, USER state */
4245         .set SRAM_BASE,  0x02000000
4246         .set SP_BASE,    0x0F300000
4247         .set UNK_BASE,   0x0F000000 /* Some internal device, but which one? */
4248         .set SPI_CGEN_BASE,  0x0E000000 /* Some internal device, but which one? */
4249         .set UNK3_BASE,  0x02014000 /* Some internal device, but which one? */
4250         .set STACK_BASE, 0x5600
4251         .set SP_SR, 0x10
4252         .set SP_TDRE, 2 /* status register bit -- TDR empty */
4253         .set SP_RDRF, 1 /* status register bit -- RDR full */
4254         .set SP_SWRST, 0x80
4255         .set SP_SPIEN, 0x1
4256         .set SP_CR, 0   /* control register */
4257         .set SP_MR, 4   /* mode register */
4258         .set SP_RDR, 0x08 /* Read Data Register */
4259         .set SP_TDR, 0x0C /* Transmit Data Register */
4260         .set SP_CSR0, 0x30 /* chip select registers */
4261         .set SP_CSR1, 0x34
4262         .set SP_CSR2, 0x38
4263         .set SP_CSR3, 0x3C
4264         .set NVRAM_CMD_RDSR, 5 /* read status register */
4265         .set NVRAM_CMD_READ, 3 /* read data */
4266         .set NVRAM_SR_RDY, 1 /* RDY bit.  This bit is inverted */
4267         .set SPI_8CLOCKS, 0xFF /* Writing this to the TDR doesn't do anything to the
4268                                   serial output, since SO is normally high.  But it
4269                                   does cause 8 clock cycles and thus 8 bits to be
4270                                   clocked in to the chip.  See Atmel's SPI
4271                                   controller (e.g. AT91M55800) timing and 4K
4272                                   SPI EEPROM manuals */
4273
4274         .set NVRAM_SCRATCH, 0x02000100  /* arbitrary area for scratchpad memory */
4275         .set NVRAM_IMAGE, 0x02000200
4276         .set NVRAM_LENGTH, 0x0200
4277         .set MAC_ADDRESS_MIB, SRAM_BASE
4278         .set MAC_ADDRESS_LENGTH, 6
4279         .set MAC_BOOT_FLAG, 0x10
4280         .set MR1, 0
4281         .set MR2, 4
4282         .set MR3, 8
4283         .set MR4, 0xC
4284 RESET_VECTOR:
4285         b RESET_HANDLER
4286 UNDEF_VECTOR:
4287         b HALT1
4288 SWI_VECTOR:
4289         b HALT1
4290 IABORT_VECTOR:
4291         b HALT1
4292 DABORT_VECTOR:
4293 RESERVED_VECTOR:
4294         b HALT1
4295 IRQ_VECTOR:
4296         b HALT1
4297 FIQ_VECTOR:
4298         b HALT1
4299 HALT1:  b HALT1
4300 RESET_HANDLER:
4301         mov     r0, #CPSR_INITIAL
4302         msr     CPSR_c, r0      /* This is probably unnecessary */
4303
4304 /* I'm guessing this is initializing clock generator electronics for SPI */
4305         ldr     r0, =SPI_CGEN_BASE
4306         mov     r1, #0
4307         mov     r1, r1, lsl #3
4308         orr     r1,r1, #0
4309         str     r1, [r0]
4310         ldr     r1, [r0, #28]
4311         bic     r1, r1, #16
4312         str     r1, [r0, #28]
4313         mov     r1, #1
4314         str     r1, [r0, #8]
4315
4316         ldr     r0, =MRBASE
4317         mov     r1, #0
4318         strh    r1, [r0, #MR1]
4319         strh    r1, [r0, #MR2]
4320         strh    r1, [r0, #MR3]
4321         strh    r1, [r0, #MR4]
4322
4323         mov     sp, #STACK_BASE
4324         bl      SP_INIT
4325         mov     r0, #10
4326         bl      DELAY9
4327         bl      GET_MAC_ADDR
4328         bl      GET_WHOLE_NVRAM
4329         ldr     r0, =MRBASE
4330         ldr     r1, =MAC_ADDRESS_MIB
4331         strh    r1, [r0, #MR2]
4332         ldr     r1, =NVRAM_IMAGE
4333         strh    r1, [r0, #MR4]
4334         mov     r1, #MAC_BOOT_FLAG
4335         strh    r1, [r0, #MR3]
4336 HALT2:  b HALT2
4337 .func Get_Whole_NVRAM, GET_WHOLE_NVRAM
4338 GET_WHOLE_NVRAM:
4339         stmdb   sp!, {lr}
4340         mov     r2, #0 /* 0th bytes of NVRAM */
4341         mov     r3, #NVRAM_LENGTH
4342         mov     r1, #0          /* not used in routine */
4343         ldr     r0, =NVRAM_IMAGE
4344         bl      NVRAM_XFER
4345         ldmia   sp!, {lr}
4346         bx      lr
4347 .endfunc
4348
4349 .func Get_MAC_Addr, GET_MAC_ADDR
4350 GET_MAC_ADDR:
4351         stmdb   sp!, {lr}
4352         mov     r2, #0x120      /* address of MAC Address within NVRAM */
4353         mov     r3, #MAC_ADDRESS_LENGTH
4354         mov     r1, #0          /* not used in routine */
4355         ldr     r0, =MAC_ADDRESS_MIB
4356         bl      NVRAM_XFER
4357         ldmia   sp!, {lr}
4358         bx      lr
4359 .endfunc
4360 .ltorg
4361 .func Delay9, DELAY9
4362 DELAY9:
4363         adds    r0, r0, r0, LSL #3   /* r0 = r0 * 9 */
4364 DELAYLOOP:
4365         beq     DELAY9_done
4366         subs    r0, r0, #1
4367         b       DELAYLOOP
4368 DELAY9_done:
4369         bx      lr
4370 .endfunc
4371
4372 .func SP_Init, SP_INIT
4373 SP_INIT:
4374         mov     r1, #SP_SWRST
4375         ldr     r0, =SP_BASE
4376         str     r1, [r0, #SP_CR] /* reset the SPI */
4377         mov     r1, #0
4378         str     r1, [r0, #SP_CR] /* release SPI from reset state */
4379         mov     r1, #SP_SPIEN
4380         str     r1, [r0, #SP_MR] /* set the SPI to MASTER mode*/
4381         str     r1, [r0, #SP_CR] /* enable the SPI */
4382
4383 /*  My guess would be this turns on the SPI clock */
4384         ldr     r3, =SPI_CGEN_BASE
4385         ldr     r1, [r3, #28]
4386         orr     r1, r1, #0x2000
4387         str     r1, [r3, #28]
4388
4389         ldr     r1, =0x2000c01
4390         str     r1, [r0, #SP_CSR0]
4391         ldr     r1, =0x2000201
4392         str     r1, [r0, #SP_CSR1]
4393         str     r1, [r0, #SP_CSR2]
4394         str     r1, [r0, #SP_CSR3]
4395         ldr     r1, [r0, #SP_SR]
4396         ldr     r0, [r0, #SP_RDR]
4397         bx      lr
4398 .endfunc
4399 .func NVRAM_Init, NVRAM_INIT
4400 NVRAM_INIT:
4401         ldr     r1, =SP_BASE
4402         ldr     r0, [r1, #SP_RDR]
4403         mov     r0, #NVRAM_CMD_RDSR
4404         str     r0, [r1, #SP_TDR]
4405 SP_loop1:
4406         ldr     r0, [r1, #SP_SR]
4407         tst     r0, #SP_TDRE
4408         beq     SP_loop1
4409
4410         mov     r0, #SPI_8CLOCKS
4411         str     r0, [r1, #SP_TDR]
4412 SP_loop2:
4413         ldr     r0, [r1, #SP_SR]
4414         tst     r0, #SP_TDRE
4415         beq     SP_loop2
4416
4417         ldr     r0, [r1, #SP_RDR]
4418 SP_loop3:
4419         ldr     r0, [r1, #SP_SR]
4420         tst     r0, #SP_RDRF
4421         beq     SP_loop3
4422
4423         ldr     r0, [r1, #SP_RDR]
4424         and     r0, r0, #255
4425         bx      lr
4426 .endfunc
4427
4428 .func NVRAM_Xfer, NVRAM_XFER
4429         /* r0 = dest address */
4430         /* r1 = not used */
4431         /* r2 = src address within NVRAM */
4432         /* r3 = length */
4433 NVRAM_XFER:
4434         stmdb   sp!, {r4, r5, lr}
4435         mov     r5, r0          /* save r0 (dest address) */
4436         mov     r4, r3          /* save r3 (length) */
4437         mov     r0, r2, LSR #5 /*  SPI memories put A8 in the command field */
4438         and     r0, r0, #8
4439         add     r0, r0, #NVRAM_CMD_READ
4440         ldr     r1, =NVRAM_SCRATCH
4441         strb    r0, [r1, #0]    /* save command in NVRAM_SCRATCH[0] */
4442         strb    r2, [r1, #1]    /* save low byte of source address in NVRAM_SCRATCH[1] */
4443 _local1:
4444         bl      NVRAM_INIT
4445         tst     r0, #NVRAM_SR_RDY
4446         bne     _local1
4447         mov     r0, #20
4448         bl      DELAY9
4449         mov     r2, r4          /* length */
4450         mov     r1, r5          /* dest address */
4451         mov     r0, #2          /* bytes to transfer in command */
4452         bl      NVRAM_XFER2
4453         ldmia   sp!, {r4, r5, lr}
4454         bx      lr
4455 .endfunc
4456
4457 .func NVRAM_Xfer2, NVRAM_XFER2
4458 NVRAM_XFER2:
4459         stmdb   sp!, {r4, r5, r6, lr}
4460         ldr     r4, =SP_BASE
4461         mov     r3, #0
4462         cmp     r0, #0
4463         bls     _local2
4464         ldr     r5, =NVRAM_SCRATCH
4465 _local4:
4466         ldrb    r6, [r5, r3]
4467         str     r6, [r4, #SP_TDR]
4468 _local3:
4469         ldr     r6, [r4, #SP_SR]
4470         tst     r6, #SP_TDRE
4471         beq     _local3
4472         add     r3, r3, #1
4473         cmp     r3, r0 /* r0 is # of bytes to send out (command+addr) */
4474         blo     _local4
4475 _local2:
4476         mov     r3, #SPI_8CLOCKS
4477         str     r3, [r4, #SP_TDR]
4478         ldr     r0, [r4, #SP_RDR]
4479 _local5:
4480         ldr     r0, [r4, #SP_SR]
4481         tst     r0, #SP_RDRF
4482         beq     _local5
4483         ldr     r0, [r4, #SP_RDR] /* what's this byte?  It's the byte read while writing the TDR -- nonsense, because the NVRAM doesn't read and write at the same time */
4484         mov     r0, #0
4485         cmp     r2, #0  /* r2 is # of bytes to copy in */
4486         bls     _local6
4487 _local7:
4488         ldr     r5, [r4, #SP_SR]
4489         tst     r5, #SP_TDRE
4490         beq     _local7
4491         str     r3, [r4, #SP_TDR]  /* r3 has SPI_8CLOCKS */
4492 _local8:
4493         ldr     r5, [r4, #SP_SR]
4494         tst     r5, #SP_RDRF
4495         beq     _local8
4496         ldr     r5, [r4, #SP_RDR] /* but didn't we read this byte above? */
4497         strb    r5, [r1], #1 /* postindexed */
4498         add     r0, r0, #1
4499         cmp     r0, r2
4500         blo     _local7 /* since we don't send another address, the NVRAM must be capable of sequential reads */
4501 _local6:
4502         mov     r0, #200
4503         bl      DELAY9
4504         ldmia   sp!, {r4, r5, r6, lr}
4505         bx      lr
4506 #endif