git.oblomov.eu Git - linux-2.6/blob - drivers/net/wireless/atmel.c

   1 /*** -*- linux-c -*- **********************************************************
   2
   3      Driver for Atmel at76c502 at76c504 and at76c506 wireless cards.
   4
   5         Copyright 2000-2001 ATMEL Corporation.
   6         Copyright 2003-2004 Simon Kelley.
   7
   8     This code was developed from version 2.1.1 of the Atmel drivers,
   9     released by Atmel corp. under the GPL in December 2002. It also
  10     includes code from the Linux aironet drivers (C) Benjamin Reed,
  11     and the Linux PCMCIA package, (C) David Hinds and the Linux wireless
  12     extensions, (C) Jean Tourrilhes.
  13
  14     The firmware module for reading the MAC address of the card comes from
  15     net.russotto.AtmelMACFW, written by Matthew T. Russotto and copyright
  16     by him. net.russotto.AtmelMACFW is used under the GPL license version 2.
  17     This file contains the module in binary form and, under the terms
  18     of the GPL, in source form. The source is located at the end of the file.
  19
  20     This program is free software; you can redistribute it and/or modify
  21     it under the terms of the GNU General Public License as published by
  22     the Free Software Foundation; either version 2 of the License, or
  23     (at your option) any later version.
  24
  25     This software is distributed in the hope that it will be useful,
  26     but WITHOUT ANY WARRANTY; without even the implied warranty of
  27     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  28     GNU General Public License for more details.
  29
  30     You should have received a copy of the GNU General Public License
  31     along with Atmel wireless lan drivers; if not, write to the Free Software
  32     Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  33
  34     For all queries about this code, please contact the current author,
  35     Simon Kelley <simon@thekelleys.org.uk> and not Atmel Corporation.
  36
  37     Credit is due to HP UK and Cambridge Online Systems Ltd for supplying
  38     hardware used during development of this driver.
  39
  40 ******************************************************************************/
  41
  42 #include <linux/init.h>
  43
  44 #include <linux/kernel.h>
  45 #include <linux/ptrace.h>
  46 #include <linux/slab.h>
  47 #include <linux/string.h>
  48 #include <linux/ctype.h>
  49 #include <linux/timer.h>
  50 #include <asm/io.h>
  51 #include <asm/system.h>
  52 #include <asm/uaccess.h>
  53 #include <linux/module.h>
  54 #include <linux/netdevice.h>
  55 #include <linux/etherdevice.h>
  56 #include <linux/skbuff.h>
  57 #include <linux/if_arp.h>
  58 #include <linux/ioport.h>
  59 #include <linux/fcntl.h>
  60 #include <linux/delay.h>
  61 #include <linux/wireless.h>
  62 #include <net/iw_handler.h>
  63 #include <linux/byteorder/generic.h>
  64 #include <linux/crc32.h>
  65 #include <linux/proc_fs.h>
  66 #include <linux/device.h>
  67 #include <linux/moduleparam.h>
  68 #include <linux/firmware.h>
  69 #include <net/ieee80211.h>
  70 #include "atmel.h"
  71
  72 #define DRIVER_MAJOR 0
  73 #define DRIVER_MINOR 98
  74
  75 MODULE_AUTHOR("Simon Kelley");
  76 MODULE_DESCRIPTION("Support for Atmel at76c50x 802.11 wireless ethernet cards.");
  77 MODULE_LICENSE("GPL");
  78 MODULE_SUPPORTED_DEVICE("Atmel at76c50x wireless cards");
  79
  80 /* The name of the firmware file to be loaded
  81    over-rides any automatic selection */
  82 static char *firmware = NULL;
  83 module_param(firmware, charp, 0);
  84
  85 /* table of firmware file names */
  86 static struct {
  87         AtmelFWType fw_type;
  88         const char *fw_file;
  89         const char *fw_file_ext;
  90 } fw_table[] = {
  91         { ATMEL_FW_TYPE_502,      "atmel_at76c502",      "bin" },
  92         { ATMEL_FW_TYPE_502D,     "atmel_at76c502d",     "bin" },
  93         { ATMEL_FW_TYPE_502E,     "atmel_at76c502e",     "bin" },
  94         { ATMEL_FW_TYPE_502_3COM, "atmel_at76c502_3com", "bin" },
  95         { ATMEL_FW_TYPE_504,      "atmel_at76c504",      "bin" },
  96         { ATMEL_FW_TYPE_504_2958, "atmel_at76c504_2958", "bin" },
  97         { ATMEL_FW_TYPE_504A_2958,"atmel_at76c504a_2958","bin" },
  98         { ATMEL_FW_TYPE_506,      "atmel_at76c506",      "bin" },
  99         { ATMEL_FW_TYPE_NONE,      NULL,                  NULL }
 100 };
 101
 102 #define MAX_SSID_LENGTH 32
 103 #define MGMT_JIFFIES (256 * HZ / 100)
 104
 105 #define MAX_BSS_ENTRIES 64
 106
 107 /* registers */
 108 #define GCR  0x00    //      (SIR0)  General Configuration Register
 109 #define BSR  0x02    //      (SIR1)  Bank Switching Select Register
 110 #define AR   0x04
 111 #define DR   0x08
 112 #define MR1  0x12    //      Mirror Register 1
 113 #define MR2  0x14    //      Mirror Register 2
 114 #define MR3  0x16    //      Mirror Register 3
 115 #define MR4  0x18    //      Mirror Register 4
 116
 117 #define GPR1                            0x0c
 118 #define GPR2                            0x0e
 119 #define GPR3                            0x10
 120 //
 121 // Constants for the GCR register.
 122 //
 123 #define GCR_REMAP     0x0400          // Remap internal SRAM to 0
 124 #define GCR_SWRES     0x0080          // BIU reset (ARM and PAI are NOT reset)
 125 #define GCR_CORES     0x0060          // Core Reset (ARM and PAI are reset)
 126 #define GCR_ENINT     0x0002          // Enable Interrupts
 127 #define GCR_ACKINT    0x0008          // Acknowledge Interrupts
 128
 129 #define BSS_SRAM      0x0200          // AMBA module selection --> SRAM
 130 #define BSS_IRAM      0x0100          // AMBA module selection --> IRAM
 131 //
 132 // Constants for the MR registers.
 133 //
 134 #define MAC_INIT_COMPLETE       0x0001        // MAC init has been completed
 135 #define MAC_BOOT_COMPLETE       0x0010        // MAC boot has been completed
 136 #define MAC_INIT_OK             0x0002        // MAC boot has been completed
 137
 138 #define MIB_MAX_DATA_BYTES    212
 139 #define MIB_HEADER_SIZE       4    /* first four fields */
 140
 141 struct get_set_mib {
 142         u8 type;
 143         u8 size;
 144         u8 index;
 145         u8 reserved;
 146         u8 data[MIB_MAX_DATA_BYTES];
 147 };
 148
 149 struct rx_desc {
 150         u32          Next;
 151         u16          MsduPos;
 152         u16          MsduSize;
 153
 154         u8           State;
 155         u8           Status;
 156         u8           Rate;
 157         u8           Rssi;
 158         u8           LinkQuality;
 159         u8           PreambleType;
 160         u16          Duration;
 161         u32          RxTime;
 162 };
 163
 164 #define RX_DESC_FLAG_VALID       0x80
 165 #define RX_DESC_FLAG_CONSUMED    0x40
 166 #define RX_DESC_FLAG_IDLE        0x00
 167
 168 #define RX_STATUS_SUCCESS        0x00
 169
 170 #define RX_DESC_MSDU_POS_OFFSET      4
 171 #define RX_DESC_MSDU_SIZE_OFFSET     6
 172 #define RX_DESC_FLAGS_OFFSET         8
 173 #define RX_DESC_STATUS_OFFSET        9
 174 #define RX_DESC_RSSI_OFFSET          11
 175 #define RX_DESC_LINK_QUALITY_OFFSET  12
 176 #define RX_DESC_PREAMBLE_TYPE_OFFSET 13
 177 #define RX_DESC_DURATION_OFFSET      14
 178 #define RX_DESC_RX_TIME_OFFSET       16
 179
 180 struct tx_desc {
 181         u32       NextDescriptor;
 182         u16       TxStartOfFrame;
 183         u16       TxLength;
 184
 185         u8        TxState;
 186         u8        TxStatus;
 187         u8        RetryCount;
 188
 189         u8        TxRate;
 190
 191         u8        KeyIndex;
 192         u8        ChiperType;
 193         u8        ChipreLength;
 194         u8        Reserved1;
 195
 196         u8        Reserved;
 197         u8        PacketType;
 198         u16       HostTxLength;
 199 };
 200
 201 #define TX_DESC_NEXT_OFFSET          0
 202 #define TX_DESC_POS_OFFSET           4
 203 #define TX_DESC_SIZE_OFFSET          6
 204 #define TX_DESC_FLAGS_OFFSET         8
 205 #define TX_DESC_STATUS_OFFSET        9
 206 #define TX_DESC_RETRY_OFFSET         10
 207 #define TX_DESC_RATE_OFFSET          11
 208 #define TX_DESC_KEY_INDEX_OFFSET     12
 209 #define TX_DESC_CIPHER_TYPE_OFFSET   13
 210 #define TX_DESC_CIPHER_LENGTH_OFFSET 14
 211 #define TX_DESC_PACKET_TYPE_OFFSET   17
 212 #define TX_DESC_HOST_LENGTH_OFFSET   18
 213
 214 ///////////////////////////////////////////////////////
 215 // Host-MAC interface
 216 ///////////////////////////////////////////////////////
 217
 218 #define TX_STATUS_SUCCESS       0x00
 219
 220 #define TX_FIRM_OWN             0x80
 221 #define TX_DONE                 0x40
 222
 223 #define TX_ERROR                0x01
 224
 225 #define TX_PACKET_TYPE_DATA     0x01
 226 #define TX_PACKET_TYPE_MGMT     0x02
 227
 228 #define ISR_EMPTY               0x00        // no bits set in ISR
 229 #define ISR_TxCOMPLETE          0x01        // packet transmitted
 230 #define ISR_RxCOMPLETE          0x02        // packet received
 231 #define ISR_RxFRAMELOST         0x04        // Rx Frame lost
 232 #define ISR_FATAL_ERROR         0x08        // Fatal error
 233 #define ISR_COMMAND_COMPLETE    0x10        // command completed
 234 #define ISR_OUT_OF_RANGE        0x20        // command completed
 235 #define ISR_IBSS_MERGE          0x40        // (4.1.2.30): IBSS merge
 236 #define ISR_GENERIC_IRQ         0x80
 237
 238 #define Local_Mib_Type          0x01
 239 #define Mac_Address_Mib_Type    0x02
 240 #define Mac_Mib_Type            0x03
 241 #define Statistics_Mib_Type     0x04
 242 #define Mac_Mgmt_Mib_Type       0x05
 243 #define Mac_Wep_Mib_Type        0x06
 244 #define Phy_Mib_Type            0x07
 245 #define Multi_Domain_MIB        0x08
 246
 247 #define MAC_MGMT_MIB_CUR_BSSID_POS            14
 248 #define MAC_MIB_FRAG_THRESHOLD_POS            8
 249 #define MAC_MIB_RTS_THRESHOLD_POS             10
 250 #define MAC_MIB_SHORT_RETRY_POS               16
 251 #define MAC_MIB_LONG_RETRY_POS                17
 252 #define MAC_MIB_SHORT_RETRY_LIMIT_POS         16
 253 #define MAC_MGMT_MIB_BEACON_PER_POS           0
 254 #define MAC_MGMT_MIB_STATION_ID_POS           6
 255 #define MAC_MGMT_MIB_CUR_PRIVACY_POS          11
 256 #define MAC_MGMT_MIB_CUR_BSSID_POS            14
 257 #define MAC_MGMT_MIB_PS_MODE_POS              53
 258 #define MAC_MGMT_MIB_LISTEN_INTERVAL_POS      54
 259 #define MAC_MGMT_MIB_MULTI_DOMAIN_IMPLEMENTED 56
 260 #define MAC_MGMT_MIB_MULTI_DOMAIN_ENABLED     57
 261 #define PHY_MIB_CHANNEL_POS                   14
 262 #define PHY_MIB_RATE_SET_POS                  20
 263 #define PHY_MIB_REG_DOMAIN_POS                26
 264 #define LOCAL_MIB_AUTO_TX_RATE_POS            3
 265 #define LOCAL_MIB_SSID_SIZE                   5
 266 #define LOCAL_MIB_TX_PROMISCUOUS_POS          6
 267 #define LOCAL_MIB_TX_MGMT_RATE_POS            7
 268 #define LOCAL_MIB_TX_CONTROL_RATE_POS         8
 269 #define LOCAL_MIB_PREAMBLE_TYPE               9
 270 #define MAC_ADDR_MIB_MAC_ADDR_POS             0
 271
 272 #define         CMD_Set_MIB_Vars              0x01
 273 #define         CMD_Get_MIB_Vars              0x02
 274 #define         CMD_Scan                      0x03
 275 #define         CMD_Join                      0x04
 276 #define         CMD_Start                     0x05
 277 #define         CMD_EnableRadio               0x06
 278 #define         CMD_DisableRadio              0x07
 279 #define         CMD_SiteSurvey                0x0B
 280
 281 #define         CMD_STATUS_IDLE                   0x00
 282 #define         CMD_STATUS_COMPLETE               0x01
 283 #define         CMD_STATUS_UNKNOWN                0x02
 284 #define         CMD_STATUS_INVALID_PARAMETER      0x03
 285 #define         CMD_STATUS_FUNCTION_NOT_SUPPORTED 0x04
 286 #define         CMD_STATUS_TIME_OUT               0x07
 287 #define         CMD_STATUS_IN_PROGRESS            0x08
 288 #define         CMD_STATUS_REJECTED_RADIO_OFF     0x09
 289 #define         CMD_STATUS_HOST_ERROR             0xFF
 290 #define         CMD_STATUS_BUSY                   0xFE
 291
 292 #define CMD_BLOCK_COMMAND_OFFSET        0
 293 #define CMD_BLOCK_STATUS_OFFSET         1
 294 #define CMD_BLOCK_PARAMETERS_OFFSET     4
 295
 296 #define SCAN_OPTIONS_SITE_SURVEY        0x80
 297
 298 #define MGMT_FRAME_BODY_OFFSET          24
 299 #define MAX_AUTHENTICATION_RETRIES      3
 300 #define MAX_ASSOCIATION_RETRIES         3
 301
 302 #define AUTHENTICATION_RESPONSE_TIME_OUT  1000
 303
 304 #define MAX_WIRELESS_BODY  2316 /* mtu is 2312, CRC is 4 */
 305 #define LOOP_RETRY_LIMIT   500000
 306
 307 #define ACTIVE_MODE     1
 308 #define PS_MODE         2
 309
 310 #define MAX_ENCRYPTION_KEYS 4
 311 #define MAX_ENCRYPTION_KEY_SIZE 40
 312
 313 ///////////////////////////////////////////////////////////////////////////
 314 // 802.11 related definitions
 315 ///////////////////////////////////////////////////////////////////////////
 316
 317 //
 318 // Regulatory Domains
 319 //
 320
 321 #define REG_DOMAIN_FCC          0x10    //Channels      1-11    USA
 322 #define REG_DOMAIN_DOC          0x20    //Channel       1-11    Canada
 323 #define REG_DOMAIN_ETSI         0x30    //Channel       1-13    Europe (ex Spain/France)
 324 #define REG_DOMAIN_SPAIN        0x31    //Channel       10-11   Spain
 325 #define REG_DOMAIN_FRANCE       0x32    //Channel       10-13   France
 326 #define REG_DOMAIN_MKK          0x40    //Channel       14      Japan
 327 #define REG_DOMAIN_MKK1         0x41    //Channel       1-14    Japan(MKK1)
 328 #define REG_DOMAIN_ISRAEL       0x50    //Channel       3-9     ISRAEL
 329
 330 #define BSS_TYPE_AD_HOC         1
 331 #define BSS_TYPE_INFRASTRUCTURE 2
 332
 333 #define SCAN_TYPE_ACTIVE        0
 334 #define SCAN_TYPE_PASSIVE       1
 335
 336 #define LONG_PREAMBLE           0
 337 #define SHORT_PREAMBLE          1
 338 #define AUTO_PREAMBLE           2
 339
 340 #define DATA_FRAME_WS_HEADER_SIZE   30
 341
 342 /* promiscuous mode control */
 343 #define PROM_MODE_OFF                   0x0
 344 #define PROM_MODE_UNKNOWN               0x1
 345 #define PROM_MODE_CRC_FAILED            0x2
 346 #define PROM_MODE_DUPLICATED            0x4
 347 #define PROM_MODE_MGMT                  0x8
 348 #define PROM_MODE_CTRL                  0x10
 349 #define PROM_MODE_BAD_PROTOCOL          0x20
 350
 351 #define IFACE_INT_STATUS_OFFSET         0
 352 #define IFACE_INT_MASK_OFFSET           1
 353 #define IFACE_LOCKOUT_HOST_OFFSET       2
 354 #define IFACE_LOCKOUT_MAC_OFFSET        3
 355 #define IFACE_FUNC_CTRL_OFFSET          28
 356 #define IFACE_MAC_STAT_OFFSET           30
 357 #define IFACE_GENERIC_INT_TYPE_OFFSET   32
 358
 359 #define CIPHER_SUITE_NONE     0
 360 #define CIPHER_SUITE_WEP_64   1
 361 #define CIPHER_SUITE_TKIP     2
 362 #define CIPHER_SUITE_AES      3
 363 #define CIPHER_SUITE_CCX      4
 364 #define CIPHER_SUITE_WEP_128  5
 365
 366 //
 367 // IFACE MACROS & definitions
 368 //
 369 //
 370
 371 // FuncCtrl field:
 372 //
 373 #define FUNC_CTRL_TxENABLE              0x10
 374 #define FUNC_CTRL_RxENABLE              0x20
 375 #define FUNC_CTRL_INIT_COMPLETE         0x01
 376
 377 /* A stub firmware image which reads the MAC address from NVRAM on the card.
 378    For copyright information and source see the end of this file. */
 379 static u8 mac_reader[] = {
 380         0x06,0x00,0x00,0xea,0x04,0x00,0x00,0xea,0x03,0x00,0x00,0xea,0x02,0x00,0x00,0xea,
 381         0x01,0x00,0x00,0xea,0x00,0x00,0x00,0xea,0xff,0xff,0xff,0xea,0xfe,0xff,0xff,0xea,
 382         0xd3,0x00,0xa0,0xe3,0x00,0xf0,0x21,0xe1,0x0e,0x04,0xa0,0xe3,0x00,0x10,0xa0,0xe3,
 383         0x81,0x11,0xa0,0xe1,0x00,0x10,0x81,0xe3,0x00,0x10,0x80,0xe5,0x1c,0x10,0x90,0xe5,
 384         0x10,0x10,0xc1,0xe3,0x1c,0x10,0x80,0xe5,0x01,0x10,0xa0,0xe3,0x08,0x10,0x80,0xe5,
 385         0x02,0x03,0xa0,0xe3,0x00,0x10,0xa0,0xe3,0xb0,0x10,0xc0,0xe1,0xb4,0x10,0xc0,0xe1,
 386         0xb8,0x10,0xc0,0xe1,0xbc,0x10,0xc0,0xe1,0x56,0xdc,0xa0,0xe3,0x21,0x00,0x00,0xeb,
 387         0x0a,0x00,0xa0,0xe3,0x1a,0x00,0x00,0xeb,0x10,0x00,0x00,0xeb,0x07,0x00,0x00,0xeb,
 388         0x02,0x03,0xa0,0xe3,0x02,0x14,0xa0,0xe3,0xb4,0x10,0xc0,0xe1,0x4c,0x10,0x9f,0xe5,
 389         0xbc,0x10,0xc0,0xe1,0x10,0x10,0xa0,0xe3,0xb8,0x10,0xc0,0xe1,0xfe,0xff,0xff,0xea,
 390         0x00,0x40,0x2d,0xe9,0x00,0x20,0xa0,0xe3,0x02,0x3c,0xa0,0xe3,0x00,0x10,0xa0,0xe3,
 391         0x28,0x00,0x9f,0xe5,0x37,0x00,0x00,0xeb,0x00,0x40,0xbd,0xe8,0x1e,0xff,0x2f,0xe1,
 392         0x00,0x40,0x2d,0xe9,0x12,0x2e,0xa0,0xe3,0x06,0x30,0xa0,0xe3,0x00,0x10,0xa0,0xe3,
 393         0x02,0x04,0xa0,0xe3,0x2f,0x00,0x00,0xeb,0x00,0x40,0xbd,0xe8,0x1e,0xff,0x2f,0xe1,
 394         0x00,0x02,0x00,0x02,0x80,0x01,0x90,0xe0,0x01,0x00,0x00,0x0a,0x01,0x00,0x50,0xe2,
 395         0xfc,0xff,0xff,0xea,0x1e,0xff,0x2f,0xe1,0x80,0x10,0xa0,0xe3,0xf3,0x06,0xa0,0xe3,
 396         0x00,0x10,0x80,0xe5,0x00,0x10,0xa0,0xe3,0x00,0x10,0x80,0xe5,0x01,0x10,0xa0,0xe3,
 397         0x04,0x10,0x80,0xe5,0x00,0x10,0x80,0xe5,0x0e,0x34,0xa0,0xe3,0x1c,0x10,0x93,0xe5,
 398         0x02,0x1a,0x81,0xe3,0x1c,0x10,0x83,0xe5,0x58,0x11,0x9f,0xe5,0x30,0x10,0x80,0xe5,
 399         0x54,0x11,0x9f,0xe5,0x34,0x10,0x80,0xe5,0x38,0x10,0x80,0xe5,0x3c,0x10,0x80,0xe5,
 400         0x10,0x10,0x90,0xe5,0x08,0x00,0x90,0xe5,0x1e,0xff,0x2f,0xe1,0xf3,0x16,0xa0,0xe3,
 401         0x08,0x00,0x91,0xe5,0x05,0x00,0xa0,0xe3,0x0c,0x00,0x81,0xe5,0x10,0x00,0x91,0xe5,
 402         0x02,0x00,0x10,0xe3,0xfc,0xff,0xff,0x0a,0xff,0x00,0xa0,0xe3,0x0c,0x00,0x81,0xe5,
 403         0x10,0x00,0x91,0xe5,0x02,0x00,0x10,0xe3,0xfc,0xff,0xff,0x0a,0x08,0x00,0x91,0xe5,
 404         0x10,0x00,0x91,0xe5,0x01,0x00,0x10,0xe3,0xfc,0xff,0xff,0x0a,0x08,0x00,0x91,0xe5,
 405         0xff,0x00,0x00,0xe2,0x1e,0xff,0x2f,0xe1,0x30,0x40,0x2d,0xe9,0x00,0x50,0xa0,0xe1,
 406         0x03,0x40,0xa0,0xe1,0xa2,0x02,0xa0,0xe1,0x08,0x00,0x00,0xe2,0x03,0x00,0x80,0xe2,
 407         0xd8,0x10,0x9f,0xe5,0x00,0x00,0xc1,0xe5,0x01,0x20,0xc1,0xe5,0xe2,0xff,0xff,0xeb,
 408         0x01,0x00,0x10,0xe3,0xfc,0xff,0xff,0x1a,0x14,0x00,0xa0,0xe3,0xc4,0xff,0xff,0xeb,
 409         0x04,0x20,0xa0,0xe1,0x05,0x10,0xa0,0xe1,0x02,0x00,0xa0,0xe3,0x01,0x00,0x00,0xeb,
 410         0x30,0x40,0xbd,0xe8,0x1e,0xff,0x2f,0xe1,0x70,0x40,0x2d,0xe9,0xf3,0x46,0xa0,0xe3,
 411         0x00,0x30,0xa0,0xe3,0x00,0x00,0x50,0xe3,0x08,0x00,0x00,0x9a,0x8c,0x50,0x9f,0xe5,
 412         0x03,0x60,0xd5,0xe7,0x0c,0x60,0x84,0xe5,0x10,0x60,0x94,0xe5,0x02,0x00,0x16,0xe3,
 413         0xfc,0xff,0xff,0x0a,0x01,0x30,0x83,0xe2,0x00,0x00,0x53,0xe1,0xf7,0xff,0xff,0x3a,
 414         0xff,0x30,0xa0,0xe3,0x0c,0x30,0x84,0xe5,0x08,0x00,0x94,0xe5,0x10,0x00,0x94,0xe5,
 415         0x01,0x00,0x10,0xe3,0xfc,0xff,0xff,0x0a,0x08,0x00,0x94,0xe5,0x00,0x00,0xa0,0xe3,
 416         0x00,0x00,0x52,0xe3,0x0b,0x00,0x00,0x9a,0x10,0x50,0x94,0xe5,0x02,0x00,0x15,0xe3,
 417         0xfc,0xff,0xff,0x0a,0x0c,0x30,0x84,0xe5,0x10,0x50,0x94,0xe5,0x01,0x00,0x15,0xe3,
 418         0xfc,0xff,0xff,0x0a,0x08,0x50,0x94,0xe5,0x01,0x50,0xc1,0xe4,0x01,0x00,0x80,0xe2,
 419         0x02,0x00,0x50,0xe1,0xf3,0xff,0xff,0x3a,0xc8,0x00,0xa0,0xe3,0x98,0xff,0xff,0xeb,
 420         0x70,0x40,0xbd,0xe8,0x1e,0xff,0x2f,0xe1,0x01,0x0c,0x00,0x02,0x01,0x02,0x00,0x02,
 421         0x00,0x01,0x00,0x02
 422 };
 423
 424 struct atmel_private {
 425         void *card; /* Bus dependent stucture varies for PCcard */
 426         int (*present_callback)(void *); /* And callback which uses it */
 427         char firmware_id[32];
 428         AtmelFWType firmware_type;
 429         u8 *firmware;
 430         int firmware_length;
 431         struct timer_list management_timer;
 432         struct net_device *dev;
 433         struct device *sys_dev;
 434         struct iw_statistics wstats;
 435         struct net_device_stats stats;  // device stats
 436         spinlock_t irqlock, timerlock;  // spinlocks
 437         enum { BUS_TYPE_PCCARD, BUS_TYPE_PCI } bus_type;
 438         enum {
 439                 CARD_TYPE_PARALLEL_FLASH,
 440                 CARD_TYPE_SPI_FLASH,
 441                 CARD_TYPE_EEPROM
 442         } card_type;
 443         int do_rx_crc; /* If we need to CRC incoming packets */
 444         int probe_crc; /* set if we don't yet know */
 445         int crc_ok_cnt, crc_ko_cnt; /* counters for probing */
 446         u16 rx_desc_head;
 447         u16 tx_desc_free, tx_desc_head, tx_desc_tail, tx_desc_previous;
 448         u16 tx_free_mem, tx_buff_head, tx_buff_tail;
 449
 450         u16 frag_seq, frag_len, frag_no;
 451         u8 frag_source[6];
 452
 453         u8 wep_is_on, default_key, exclude_unencrypted, encryption_level;
 454         u8 group_cipher_suite, pairwise_cipher_suite;
 455         u8 wep_keys[MAX_ENCRYPTION_KEYS][MAX_ENCRYPTION_KEY_SIZE];
 456         int wep_key_len[MAX_ENCRYPTION_KEYS];
 457         int use_wpa, radio_on_broken; /* firmware dependent stuff. */
 458
 459         u16 host_info_base;
 460         struct host_info_struct {
 461                 /* NB this is matched to the hardware, don't change. */
 462                 u8 volatile int_status;
 463                 u8 volatile int_mask;
 464                 u8 volatile lockout_host;
 465                 u8 volatile lockout_mac;
 466
 467                 u16 tx_buff_pos;
 468                 u16 tx_buff_size;
 469                 u16 tx_desc_pos;
 470                 u16 tx_desc_count;
 471
 472                 u16 rx_buff_pos;
 473                 u16 rx_buff_size;
 474                 u16 rx_desc_pos;
 475                 u16 rx_desc_count;
 476
 477                 u16 build_version;
 478                 u16 command_pos;
 479
 480                 u16 major_version;
 481                 u16 minor_version;
 482
 483                 u16 func_ctrl;
 484                 u16 mac_status;
 485                 u16 generic_IRQ_type;
 486                 u8  reserved[2];
 487         } host_info;
 488
 489         enum {
 490                 STATION_STATE_SCANNING,
 491                 STATION_STATE_JOINNING,
 492                 STATION_STATE_AUTHENTICATING,
 493                 STATION_STATE_ASSOCIATING,
 494                 STATION_STATE_READY,
 495                 STATION_STATE_REASSOCIATING,
 496                 STATION_STATE_DOWN,
 497                 STATION_STATE_MGMT_ERROR
 498         } station_state;
 499
 500         int operating_mode, power_mode;
 501         time_t last_qual;
 502         int beacons_this_sec;
 503         int channel;
 504         int reg_domain, config_reg_domain;
 505         int tx_rate;
 506         int auto_tx_rate;
 507         int rts_threshold;
 508         int frag_threshold;
 509         int long_retry, short_retry;
 510         int preamble;
 511         int default_beacon_period, beacon_period, listen_interval;
 512         int CurrentAuthentTransactionSeqNum, ExpectedAuthentTransactionSeqNum;
 513         int AuthenticationRequestRetryCnt, AssociationRequestRetryCnt, ReAssociationRequestRetryCnt;
 514         enum {
 515                 SITE_SURVEY_IDLE,
 516                 SITE_SURVEY_IN_PROGRESS,
 517                 SITE_SURVEY_COMPLETED
 518         } site_survey_state;
 519         time_t last_survey;
 520
 521         int station_was_associated, station_is_associated;
 522         int fast_scan;
 523
 524         struct bss_info {
 525                 int channel;
 526                 int SSIDsize;
 527                 int RSSI;
 528                 int UsingWEP;
 529                 int preamble;
 530                 int beacon_period;
 531                 int BSStype;
 532                 u8 BSSID[6];
 533                 u8 SSID[MAX_SSID_LENGTH];
 534         } BSSinfo[MAX_BSS_ENTRIES];
 535         int BSS_list_entries, current_BSS;
 536         int connect_to_any_BSS;
 537         int SSID_size, new_SSID_size;
 538         u8 CurrentBSSID[6], BSSID[6];
 539         u8 SSID[MAX_SSID_LENGTH], new_SSID[MAX_SSID_LENGTH];
 540         u64 last_beacon_timestamp;
 541         u8 rx_buf[MAX_WIRELESS_BODY];
 542 };
 543
 544 static u8 atmel_basic_rates[4] = {0x82,0x84,0x0b,0x16};
 545
 546 static const struct {
 547         int reg_domain;
 548         int min, max;
 549         char *name;
 550 } channel_table[] = { { REG_DOMAIN_FCC, 1, 11, "USA" },
 551                       { REG_DOMAIN_DOC, 1, 11, "Canada" },
 552                       { REG_DOMAIN_ETSI, 1, 13, "Europe" },
 553                       { REG_DOMAIN_SPAIN, 10, 11, "Spain" },
 554                       { REG_DOMAIN_FRANCE, 10, 13, "France" },
 555                       { REG_DOMAIN_MKK, 14, 14, "MKK" },
 556                       { REG_DOMAIN_MKK1, 1, 14, "MKK1" },
 557                       { REG_DOMAIN_ISRAEL, 3, 9, "Israel"} };
 558
 559 static void build_wpa_mib(struct atmel_private *priv);
 560 static int atmel_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
 561 static void atmel_copy_to_card(struct net_device *dev, u16 dest,
 562                                unsigned char *src, u16 len);
 563 static void atmel_copy_to_host(struct net_device *dev, unsigned char *dest,
 564                                u16 src, u16 len);
 565 static void atmel_set_gcr(struct net_device *dev, u16 mask);
 566 static void atmel_clear_gcr(struct net_device *dev, u16 mask);
 567 static int atmel_lock_mac(struct atmel_private *priv);
 568 static void atmel_wmem32(struct atmel_private *priv, u16 pos, u32 data);
 569 static void atmel_command_irq(struct atmel_private *priv);
 570 static int atmel_validate_channel(struct atmel_private *priv, int channel);
 571 static void atmel_management_frame(struct atmel_private *priv,
 572                                    struct ieee80211_hdr_4addr *header,
 573                                    u16 frame_len, u8 rssi);
 574 static void atmel_management_timer(u_long a);
 575 static void atmel_send_command(struct atmel_private *priv, int command,
 576                                void *cmd, int cmd_size);
 577 static int atmel_send_command_wait(struct atmel_private *priv, int command,
 578                                    void *cmd, int cmd_size);
 579 static void atmel_transmit_management_frame(struct atmel_private *priv,
 580                                             struct ieee80211_hdr_4addr *header,
 581                                             u8 *body, int body_len);
 582
 583 static u8 atmel_get_mib8(struct atmel_private *priv, u8 type, u8 index);
 584 static void atmel_set_mib8(struct atmel_private *priv, u8 type, u8 index,
 585                            u8 data);
 586 static void atmel_set_mib16(struct atmel_private *priv, u8 type, u8 index,
 587                             u16 data);
 588 static void atmel_set_mib(struct atmel_private *priv, u8 type, u8 index,
 589                           u8 *data, int data_len);
 590 static void atmel_get_mib(struct atmel_private *priv, u8 type, u8 index,
 591                           u8 *data, int data_len);
 592 static void atmel_scan(struct atmel_private *priv, int specific_ssid);
 593 static void atmel_join_bss(struct atmel_private *priv, int bss_index);
 594 static void atmel_smooth_qual(struct atmel_private *priv);
 595 static void atmel_writeAR(struct net_device *dev, u16 data);
 596 static int probe_atmel_card(struct net_device *dev);
 597 static int reset_atmel_card(struct net_device *dev);
 598 static void atmel_enter_state(struct atmel_private *priv, int new_state);
 599 int atmel_open (struct net_device *dev);
 600
 601 static inline u16 atmel_hi(struct atmel_private *priv, u16 offset)
 602 {
 603         return priv->host_info_base + offset;
 604 }
 605
 606 static inline u16 atmel_co(struct atmel_private *priv, u16 offset)
 607 {
 608         return priv->host_info.command_pos + offset;
 609 }
 610
 611 static inline u16 atmel_rx(struct atmel_private *priv, u16 offset, u16 desc)
 612 {
 613         return priv->host_info.rx_desc_pos + (sizeof(struct rx_desc) * desc) + offset;
 614 }
 615
 616 static inline u16 atmel_tx(struct atmel_private *priv, u16 offset, u16 desc)
 617 {
 618         return priv->host_info.tx_desc_pos + (sizeof(struct tx_desc) * desc) + offset;
 619 }
 620
 621 static inline u8 atmel_read8(struct net_device *dev, u16 offset)
 622 {
 623         return inb(dev->base_addr + offset);
 624 }
 625
 626 static inline void atmel_write8(struct net_device *dev, u16 offset, u8 data)
 627 {
 628         outb(data, dev->base_addr + offset);
 629 }
 630
 631 static inline u16 atmel_read16(struct net_device *dev, u16 offset)
 632 {
 633         return inw(dev->base_addr + offset);
 634 }
 635
 636 static inline void atmel_write16(struct net_device *dev, u16 offset, u16 data)
 637 {
 638         outw(data, dev->base_addr + offset);
 639 }
 640
 641 static inline u8 atmel_rmem8(struct atmel_private *priv, u16 pos)
 642 {
 643         atmel_writeAR(priv->dev, pos);
 644         return atmel_read8(priv->dev, DR);
 645 }
 646
 647 static inline void atmel_wmem8(struct atmel_private *priv, u16 pos, u16 data)
 648 {
 649         atmel_writeAR(priv->dev, pos);
 650         atmel_write8(priv->dev, DR, data);
 651 }
 652
 653 static inline u16 atmel_rmem16(struct atmel_private *priv, u16 pos)
 654 {
 655         atmel_writeAR(priv->dev, pos);
 656         return atmel_read16(priv->dev, DR);
 657 }
 658
 659 static inline void atmel_wmem16(struct atmel_private *priv, u16 pos, u16 data)
 660 {
 661         atmel_writeAR(priv->dev, pos);
 662         atmel_write16(priv->dev, DR, data);
 663 }
 664
 665 static const struct iw_handler_def atmel_handler_def;
 666
 667 static void tx_done_irq(struct atmel_private *priv)
 668 {
 669         int i;
 670
 671         for (i = 0;
 672              atmel_rmem8(priv, atmel_tx(priv, TX_DESC_FLAGS_OFFSET, priv->tx_desc_head)) == TX_DONE &&
 673                      i < priv->host_info.tx_desc_count;
 674              i++) {
 675                 u8 status = atmel_rmem8(priv, atmel_tx(priv, TX_DESC_STATUS_OFFSET, priv->tx_desc_head));
 676                 u16 msdu_size = atmel_rmem16(priv, atmel_tx(priv, TX_DESC_SIZE_OFFSET, priv->tx_desc_head));
 677                 u8 type = atmel_rmem8(priv, atmel_tx(priv, TX_DESC_PACKET_TYPE_OFFSET, priv->tx_desc_head));
 678
 679                 atmel_wmem8(priv, atmel_tx(priv, TX_DESC_FLAGS_OFFSET, priv->tx_desc_head), 0);
 680
 681                 priv->tx_free_mem += msdu_size;
 682                 priv->tx_desc_free++;
 683
 684                 if (priv->tx_buff_head + msdu_size > (priv->host_info.tx_buff_pos + priv->host_info.tx_buff_size))
 685                         priv->tx_buff_head = 0;
 686                 else
 687                         priv->tx_buff_head += msdu_size;
 688
 689                 if (priv->tx_desc_head < (priv->host_info.tx_desc_count - 1))
 690                         priv->tx_desc_head++ ;
 691                 else
 692                         priv->tx_desc_head = 0;
 693
 694                 if (type == TX_PACKET_TYPE_DATA) {
 695                         if (status == TX_STATUS_SUCCESS)
 696                                 priv->stats.tx_packets++;
 697                         else
 698                                 priv->stats.tx_errors++;
 699                         netif_wake_queue(priv->dev);
 700                 }
 701         }
 702 }
 703
 704 static u16 find_tx_buff(struct atmel_private *priv, u16 len)
 705 {
 706         u16 bottom_free = priv->host_info.tx_buff_size - priv->tx_buff_tail;
 707
 708         if (priv->tx_desc_free == 3 || priv->tx_free_mem < len)
 709                 return 0;
 710
 711         if (bottom_free >= len)
 712                 return priv->host_info.tx_buff_pos + priv->tx_buff_tail;
 713
 714         if (priv->tx_free_mem - bottom_free >= len) {
 715                 priv->tx_buff_tail = 0;
 716                 return priv->host_info.tx_buff_pos;
 717         }
 718
 719         return 0;
 720 }
 721
 722 static void tx_update_descriptor(struct atmel_private *priv, int is_bcast,
 723                                  u16 len, u16 buff, u8 type)
 724 {
 725         atmel_wmem16(priv, atmel_tx(priv, TX_DESC_POS_OFFSET, priv->tx_desc_tail), buff);
 726         atmel_wmem16(priv, atmel_tx(priv, TX_DESC_SIZE_OFFSET, priv->tx_desc_tail), len);
 727         if (!priv->use_wpa)
 728                 atmel_wmem16(priv, atmel_tx(priv, TX_DESC_HOST_LENGTH_OFFSET, priv->tx_desc_tail), len);
 729         atmel_wmem8(priv, atmel_tx(priv, TX_DESC_PACKET_TYPE_OFFSET, priv->tx_desc_tail), type);
 730         atmel_wmem8(priv, atmel_tx(priv, TX_DESC_RATE_OFFSET, priv->tx_desc_tail), priv->tx_rate);
 731         atmel_wmem8(priv, atmel_tx(priv, TX_DESC_RETRY_OFFSET, priv->tx_desc_tail), 0);
 732         if (priv->use_wpa) {
 733                 int cipher_type, cipher_length;
 734                 if (is_bcast) {
 735                         cipher_type = priv->group_cipher_suite;
 736                         if (cipher_type == CIPHER_SUITE_WEP_64 ||
 737                             cipher_type == CIPHER_SUITE_WEP_128)
 738                                 cipher_length = 8;
 739                         else if (cipher_type == CIPHER_SUITE_TKIP)
 740                                 cipher_length = 12;
 741                         else if (priv->pairwise_cipher_suite == CIPHER_SUITE_WEP_64 ||
 742                                  priv->pairwise_cipher_suite == CIPHER_SUITE_WEP_128) {
 743                                 cipher_type = priv->pairwise_cipher_suite;
 744                                 cipher_length = 8;
 745                         } else {
 746                                 cipher_type = CIPHER_SUITE_NONE;
 747                                 cipher_length = 0;
 748                         }
 749                 } else {
 750                         cipher_type = priv->pairwise_cipher_suite;
 751                         if (cipher_type == CIPHER_SUITE_WEP_64 ||
 752                             cipher_type == CIPHER_SUITE_WEP_128)
 753                                 cipher_length = 8;
 754                         else if (cipher_type == CIPHER_SUITE_TKIP)
 755                                 cipher_length = 12;
 756                         else if (priv->group_cipher_suite == CIPHER_SUITE_WEP_64 ||
 757                                  priv->group_cipher_suite == CIPHER_SUITE_WEP_128) {
 758                                 cipher_type = priv->group_cipher_suite;
 759                                 cipher_length = 8;
 760                         } else {
 761                                 cipher_type = CIPHER_SUITE_NONE;
 762                                 cipher_length = 0;
 763                         }
 764                 }
 765
 766                 atmel_wmem8(priv, atmel_tx(priv, TX_DESC_CIPHER_TYPE_OFFSET, priv->tx_desc_tail),
 767                             cipher_type);
 768                 atmel_wmem8(priv, atmel_tx(priv, TX_DESC_CIPHER_LENGTH_OFFSET, priv->tx_desc_tail),
 769                             cipher_length);
 770         }
 771         atmel_wmem32(priv, atmel_tx(priv, TX_DESC_NEXT_OFFSET, priv->tx_desc_tail), 0x80000000L);
 772         atmel_wmem8(priv, atmel_tx(priv, TX_DESC_FLAGS_OFFSET, priv->tx_desc_tail), TX_FIRM_OWN);
 773         if (priv->tx_desc_previous != priv->tx_desc_tail)
 774                 atmel_wmem32(priv, atmel_tx(priv, TX_DESC_NEXT_OFFSET, priv->tx_desc_previous), 0);
 775         priv->tx_desc_previous = priv->tx_desc_tail;
 776         if (priv->tx_desc_tail < (priv->host_info.tx_desc_count - 1))
 777                 priv->tx_desc_tail++;
 778         else
 779                 priv->tx_desc_tail = 0;
 780         priv->tx_desc_free--;
 781         priv->tx_free_mem -= len;
 782 }
 783
 784 static int start_tx(struct sk_buff *skb, struct net_device *dev)
 785 {
 786         static const u8 SNAP_RFC1024[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
 787         struct atmel_private *priv = netdev_priv(dev);
 788         struct ieee80211_hdr_4addr header;
 789         unsigned long flags;
 790         u16 buff, frame_ctl, len = (ETH_ZLEN < skb->len) ? skb->len : ETH_ZLEN;
 791
 792         if (priv->card && priv->present_callback &&
 793             !(*priv->present_callback)(priv->card)) {
 794                 priv->stats.tx_errors++;
 795                 dev_kfree_skb(skb);
 796                 return 0;
 797         }
 798
 799         if (priv->station_state != STATION_STATE_READY) {
 800                 priv->stats.tx_errors++;
 801                 dev_kfree_skb(skb);
 802                 return 0;
 803         }
 804
 805         /* first ensure the timer func cannot run */
 806         spin_lock_bh(&priv->timerlock);
 807         /* then stop the hardware ISR */
 808         spin_lock_irqsave(&priv->irqlock, flags);
 809         /* nb doing the above in the opposite order will deadlock */
 810
 811         /* The Wireless Header is 30 bytes. In the Ethernet packet we "cut" the
 812            12 first bytes (containing DA/SA) and put them in the appropriate
 813            fields of the Wireless Header. Thus the packet length is then the
 814            initial + 18 (+30-12) */
 815
 816         if (!(buff = find_tx_buff(priv, len + 18))) {
 817                 priv->stats.tx_dropped++;
 818                 spin_unlock_irqrestore(&priv->irqlock, flags);
 819                 spin_unlock_bh(&priv->timerlock);
 820                 netif_stop_queue(dev);
 821                 return 1;
 822         }
 823
 824         frame_ctl = IEEE80211_FTYPE_DATA;
 825         header.duration_id = 0;
 826         header.seq_ctl = 0;
 827         if (priv->wep_is_on)
 828                 frame_ctl |= IEEE80211_FCTL_PROTECTED;
 829         if (priv->operating_mode == IW_MODE_ADHOC) {
 830                 memcpy(&header.addr1, skb->data, 6);
 831                 memcpy(&header.addr2, dev->dev_addr, 6);
 832                 memcpy(&header.addr3, priv->BSSID, 6);
 833         } else {
 834                 frame_ctl |= IEEE80211_FCTL_TODS;
 835                 memcpy(&header.addr1, priv->CurrentBSSID, 6);
 836                 memcpy(&header.addr2, dev->dev_addr, 6);
 837                 memcpy(&header.addr3, skb->data, 6);
 838         }
 839
 840         if (priv->use_wpa)
 841                 memcpy(&header.addr4, SNAP_RFC1024, 6);
 842
 843         header.frame_ctl = cpu_to_le16(frame_ctl);
 844         /* Copy the wireless header into the card */
 845         atmel_copy_to_card(dev, buff, (unsigned char *)&header, DATA_FRAME_WS_HEADER_SIZE);
 846         /* Copy the packet sans its 802.3 header addresses which have been replaced */
 847         atmel_copy_to_card(dev, buff + DATA_FRAME_WS_HEADER_SIZE, skb->data + 12, len - 12);
 848         priv->tx_buff_tail += len - 12 + DATA_FRAME_WS_HEADER_SIZE;
 849
 850         /* low bit of first byte of destination tells us if broadcast */
 851         tx_update_descriptor(priv, *(skb->data) & 0x01, len + 18, buff, TX_PACKET_TYPE_DATA);
 852         dev->trans_start = jiffies;
 853         priv->stats.tx_bytes += len;
 854
 855         spin_unlock_irqrestore(&priv->irqlock, flags);
 856         spin_unlock_bh(&priv->timerlock);
 857         dev_kfree_skb(skb);
 858
 859         return 0;
 860 }
 861
 862 static void atmel_transmit_management_frame(struct atmel_private *priv,
 863                                             struct ieee80211_hdr_4addr *header,
 864                                             u8 *body, int body_len)
 865 {
 866         u16 buff;
 867         int len = MGMT_FRAME_BODY_OFFSET + body_len;
 868
 869         if (!(buff = find_tx_buff(priv, len)))
 870                 return;
 871
 872         atmel_copy_to_card(priv->dev, buff, (u8 *)header, MGMT_FRAME_BODY_OFFSET);
 873         atmel_copy_to_card(priv->dev, buff + MGMT_FRAME_BODY_OFFSET, body, body_len);
 874         priv->tx_buff_tail += len;
 875         tx_update_descriptor(priv, header->addr1[0] & 0x01, len, buff, TX_PACKET_TYPE_MGMT);
 876 }
 877
 878 static void fast_rx_path(struct atmel_private *priv,
 879                          struct ieee80211_hdr_4addr *header,
 880                          u16 msdu_size, u16 rx_packet_loc, u32 crc)
 881 {
 882         /* fast path: unfragmented packet copy directly into skbuf */
 883         u8 mac4[6];
 884         struct sk_buff  *skb;
 885         unsigned char *skbp;
 886
 887         /* get the final, mac 4 header field, this tells us encapsulation */
 888         atmel_copy_to_host(priv->dev, mac4, rx_packet_loc + 24, 6);
 889         msdu_size -= 6;
 890
 891         if (priv->do_rx_crc) {
 892                 crc = crc32_le(crc, mac4, 6);
 893                 msdu_size -= 4;
 894         }
 895
 896         if (!(skb = dev_alloc_skb(msdu_size + 14))) {
 897                 priv->stats.rx_dropped++;
 898                 return;
 899         }
 900
 901         skb_reserve(skb, 2);
 902         skbp = skb_put(skb, msdu_size + 12);
 903         atmel_copy_to_host(priv->dev, skbp + 12, rx_packet_loc + 30, msdu_size);
 904
 905         if (priv->do_rx_crc) {
 906                 u32 netcrc;
 907                 crc = crc32_le(crc, skbp + 12, msdu_size);
 908                 atmel_copy_to_host(priv->dev, (void *)&netcrc, rx_packet_loc + 30 + msdu_size, 4);
 909                 if ((crc ^ 0xffffffff) != netcrc) {
 910                         priv->stats.rx_crc_errors++;
 911                         dev_kfree_skb(skb);
 912                         return;
 913                 }
 914         }
 915
 916         memcpy(skbp, header->addr1, 6); /* destination address */
 917         if (le16_to_cpu(header->frame_ctl) & IEEE80211_FCTL_FROMDS)
 918                 memcpy(&skbp[6], header->addr3, 6);
 919         else
 920                 memcpy(&skbp[6], header->addr2, 6); /* source address */
 921
 922         priv->dev->last_rx = jiffies;
 923         skb->dev = priv->dev;
 924         skb->protocol = eth_type_trans(skb, priv->dev);
 925         skb->ip_summed = CHECKSUM_NONE;
 926         netif_rx(skb);
 927         priv->stats.rx_bytes += 12 + msdu_size;
 928         priv->stats.rx_packets++;
 929 }
 930
 931 /* Test to see if the packet in card memory at packet_loc has a valid CRC
 932    It doesn't matter that this is slow: it is only used to proble the first few
 933    packets. */
 934 static int probe_crc(struct atmel_private *priv, u16 packet_loc, u16 msdu_size)
 935 {
 936         int i = msdu_size - 4;
 937         u32 netcrc, crc = 0xffffffff;
 938
 939         if (msdu_size < 4)
 940                 return 0;
 941
 942         atmel_copy_to_host(priv->dev, (void *)&netcrc, packet_loc + i, 4);
 943
 944         atmel_writeAR(priv->dev, packet_loc);
 945         while (i--) {
 946                 u8 octet = atmel_read8(priv->dev, DR);
 947                 crc = crc32_le(crc, &octet, 1);
 948         }
 949
 950         return (crc ^ 0xffffffff) == netcrc;
 951 }
 952
 953 static void frag_rx_path(struct atmel_private *priv,
 954                          struct ieee80211_hdr_4addr *header,
 955                          u16 msdu_size, u16 rx_packet_loc, u32 crc, u16 seq_no,
 956                          u8 frag_no, int more_frags)
 957 {
 958         u8 mac4[6];
 959         u8 source[6];
 960         struct sk_buff *skb;
 961
 962         if (le16_to_cpu(header->frame_ctl) & IEEE80211_FCTL_FROMDS)
 963                 memcpy(source, header->addr3, 6);
 964         else
 965                 memcpy(source, header->addr2, 6);
 966
 967         rx_packet_loc += 24; /* skip header */
 968
 969         if (priv->do_rx_crc)
 970                 msdu_size -= 4;
 971
 972         if (frag_no == 0) { /* first fragment */
 973                 atmel_copy_to_host(priv->dev, mac4, rx_packet_loc, 6);
 974                 msdu_size -= 6;
 975                 rx_packet_loc += 6;
 976
 977                 if (priv->do_rx_crc)
 978                         crc = crc32_le(crc, mac4, 6);
 979
 980                 priv->frag_seq = seq_no;
 981                 priv->frag_no = 1;
 982                 priv->frag_len = msdu_size;
 983                 memcpy(priv->frag_source, source, 6);
 984                 memcpy(&priv->rx_buf[6], source, 6);
 985                 memcpy(priv->rx_buf, header->addr1, 6);
 986
 987                 atmel_copy_to_host(priv->dev, &priv->rx_buf[12], rx_packet_loc, msdu_size);
 988
 989                 if (priv->do_rx_crc) {
 990                         u32 netcrc;
 991                         crc = crc32_le(crc, &priv->rx_buf[12], msdu_size);
 992                         atmel_copy_to_host(priv->dev, (void *)&netcrc, rx_packet_loc + msdu_size, 4);
 993                         if ((crc ^ 0xffffffff) != netcrc) {
 994                                 priv->stats.rx_crc_errors++;
 995                                 memset(priv->frag_source, 0xff, 6);
 996                         }
 997                 }
 998
 999         } else if (priv->frag_no == frag_no &&
1000                    priv->frag_seq == seq_no &&
1001                    memcmp(priv->frag_source, source, 6) == 0) {
1002
1003                 atmel_copy_to_host(priv->dev, &priv->rx_buf[12 + priv->frag_len],
1004                                    rx_packet_loc, msdu_size);
1005                 if (priv->do_rx_crc) {
1006                         u32 netcrc;
1007                         crc = crc32_le(crc,
1008                                        &priv->rx_buf[12 + priv->frag_len],
1009                                        msdu_size);
1010                         atmel_copy_to_host(priv->dev, (void *)&netcrc, rx_packet_loc + msdu_size, 4);
1011                         if ((crc ^ 0xffffffff) != netcrc) {
1012                                 priv->stats.rx_crc_errors++;
1013                                 memset(priv->frag_source, 0xff, 6);
1014                                 more_frags = 1; /* don't send broken assembly */
1015                         }
1016                 }
1017
1018                 priv->frag_len += msdu_size;
1019                 priv->frag_no++;
1020
1021                 if (!more_frags) { /* last one */
1022                         memset(priv->frag_source, 0xff, 6);
1023                         if (!(skb = dev_alloc_skb(priv->frag_len + 14))) {
1024                                 priv->stats.rx_dropped++;
1025                         } else {
1026                                 skb_reserve(skb, 2);
1027                                 memcpy(skb_put(skb, priv->frag_len + 12),
1028                                        priv->rx_buf,
1029                                        priv->frag_len + 12);
1030                                 priv->dev->last_rx = jiffies;
1031                                 skb->dev = priv->dev;
1032                                 skb->protocol = eth_type_trans(skb, priv->dev);
1033                                 skb->ip_summed = CHECKSUM_NONE;
1034                                 netif_rx(skb);
1035                                 priv->stats.rx_bytes += priv->frag_len + 12;
1036                                 priv->stats.rx_packets++;
1037                         }
1038                 }
1039         } else
1040                 priv->wstats.discard.fragment++;
1041 }
1042
1043 static void rx_done_irq(struct atmel_private *priv)
1044 {
1045         int i;
1046         struct ieee80211_hdr_4addr header;
1047
1048         for (i = 0;
1049              atmel_rmem8(priv, atmel_rx(priv, RX_DESC_FLAGS_OFFSET, priv->rx_desc_head)) == RX_DESC_FLAG_VALID &&
1050                      i < priv->host_info.rx_desc_count;
1051              i++) {
1052
1053                 u16 msdu_size, rx_packet_loc, frame_ctl, seq_control;
1054                 u8 status = atmel_rmem8(priv, atmel_rx(priv, RX_DESC_STATUS_OFFSET, priv->rx_desc_head));
1055                 u32 crc = 0xffffffff;
1056
1057                 if (status != RX_STATUS_SUCCESS) {
1058                         if (status == 0xc1) /* determined by experiment */
1059                                 priv->wstats.discard.nwid++;
1060                         else
1061                                 priv->stats.rx_errors++;
1062                         goto next;
1063                 }
1064
1065                 msdu_size = atmel_rmem16(priv, atmel_rx(priv, RX_DESC_MSDU_SIZE_OFFSET, priv->rx_desc_head));
1066                 rx_packet_loc = atmel_rmem16(priv, atmel_rx(priv, RX_DESC_MSDU_POS_OFFSET, priv->rx_desc_head));
1067
1068                 if (msdu_size < 30) {
1069                         priv->stats.rx_errors++;
1070                         goto next;
1071                 }
1072
1073                 /* Get header as far as end of seq_ctl */
1074                 atmel_copy_to_host(priv->dev, (char *)&header, rx_packet_loc, 24);
1075                 frame_ctl = le16_to_cpu(header.frame_ctl);
1076                 seq_control = le16_to_cpu(header.seq_ctl);
1077
1078                 /* probe for CRC use here if needed  once five packets have
1079                    arrived with the same crc status, we assume we know what's
1080                    happening and stop probing */
1081                 if (priv->probe_crc) {
1082                         if (!priv->wep_is_on || !(frame_ctl & IEEE80211_FCTL_PROTECTED)) {
1083                                 priv->do_rx_crc = probe_crc(priv, rx_packet_loc, msdu_size);
1084                         } else {
1085                                 priv->do_rx_crc = probe_crc(priv, rx_packet_loc + 24, msdu_size - 24);
1086                         }
1087                         if (priv->do_rx_crc) {
1088                                 if (priv->crc_ok_cnt++ > 5)
1089                                         priv->probe_crc = 0;
1090                         } else {
1091                                 if (priv->crc_ko_cnt++ > 5)
1092                                         priv->probe_crc = 0;
1093                         }
1094                 }
1095
1096                 /* don't CRC header when WEP in use */
1097                 if (priv->do_rx_crc && (!priv->wep_is_on || !(frame_ctl & IEEE80211_FCTL_PROTECTED))) {
1098                         crc = crc32_le(0xffffffff, (unsigned char *)&header, 24);
1099                 }
1100                 msdu_size -= 24; /* header */
1101
1102                 if ((frame_ctl & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA) {
1103                         int more_fragments = frame_ctl & IEEE80211_FCTL_MOREFRAGS;
1104                         u8 packet_fragment_no = seq_control & IEEE80211_SCTL_FRAG;
1105                         u16 packet_sequence_no = (seq_control & IEEE80211_SCTL_SEQ) >> 4;
1106
1107                         if (!more_fragments && packet_fragment_no == 0) {
1108                                 fast_rx_path(priv, &header, msdu_size, rx_packet_loc, crc);
1109                         } else {
1110                                 frag_rx_path(priv, &header, msdu_size, rx_packet_loc, crc,
1111                                              packet_sequence_no, packet_fragment_no, more_fragments);
1112                         }
1113                 }
1114
1115                 if ((frame_ctl & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT) {
1116                         /* copy rest of packet into buffer */
1117                         atmel_copy_to_host(priv->dev, (unsigned char *)&priv->rx_buf, rx_packet_loc + 24, msdu_size);
1118
1119                         /* we use the same buffer for frag reassembly and control packets */
1120                         memset(priv->frag_source, 0xff, 6);
1121
1122                         if (priv->do_rx_crc) {
1123                                 /* last 4 octets is crc */
1124                                 msdu_size -= 4;
1125                                 crc = crc32_le(crc, (unsigned char *)&priv->rx_buf, msdu_size);
1126                                 if ((crc ^ 0xffffffff) != (*((u32 *)&priv->rx_buf[msdu_size]))) {
1127                                         priv->stats.rx_crc_errors++;
1128                                         goto next;
1129                                 }
1130                         }
1131
1132                         atmel_management_frame(priv, &header, msdu_size,
1133                                                atmel_rmem8(priv, atmel_rx(priv, RX_DESC_RSSI_OFFSET, priv->rx_desc_head)));
1134                 }
1135
1136 next:
1137                 /* release descriptor */
1138                 atmel_wmem8(priv, atmel_rx(priv, RX_DESC_FLAGS_OFFSET, priv->rx_desc_head), RX_DESC_FLAG_CONSUMED);
1139
1140                 if (priv->rx_desc_head < (priv->host_info.rx_desc_count - 1))
1141                         priv->rx_desc_head++;
1142                 else
1143                         priv->rx_desc_head = 0;
1144         }
1145 }
1146
1147 static irqreturn_t service_interrupt(int irq, void *dev_id)
1148 {
1149         struct net_device *dev = (struct net_device *) dev_id;
1150         struct atmel_private *priv = netdev_priv(dev);
1151         u8 isr;
1152         int i = -1;
1153         static u8 irq_order[] = {
1154                 ISR_OUT_OF_RANGE,
1155                 ISR_RxCOMPLETE,
1156                 ISR_TxCOMPLETE,
1157                 ISR_RxFRAMELOST,
1158                 ISR_FATAL_ERROR,
1159                 ISR_COMMAND_COMPLETE,
1160                 ISR_IBSS_MERGE,
1161                 ISR_GENERIC_IRQ
1162         };
1163
1164         if (priv->card && priv->present_callback &&
1165             !(*priv->present_callback)(priv->card))
1166                 return IRQ_HANDLED;
1167
1168         /* In this state upper-level code assumes it can mess with
1169            the card unhampered by interrupts which may change register state.
1170            Note that even though the card shouldn't generate interrupts
1171            the inturrupt line may be shared. This allows card setup
1172            to go on without disabling interrupts for a long time. */
1173         if (priv->station_state == STATION_STATE_DOWN)
1174                 return IRQ_NONE;
1175
1176         atmel_clear_gcr(dev, GCR_ENINT); /* disable interrupts */
1177
1178         while (1) {
1179                 if (!atmel_lock_mac(priv)) {
1180                         /* failed to contact card */
1181                         printk(KERN_ALERT "%s: failed to contact MAC.\n", dev->name);
1182                         return IRQ_HANDLED;
1183                 }
1184
1185                 isr = atmel_rmem8(priv, atmel_hi(priv, IFACE_INT_STATUS_OFFSET));
1186                 atmel_wmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_MAC_OFFSET), 0);
1187
1188                 if (!isr) {
1189                         atmel_set_gcr(dev, GCR_ENINT); /* enable interrupts */
1190                         return i == -1 ? IRQ_NONE : IRQ_HANDLED;
1191                 }
1192
1193                 atmel_set_gcr(dev, GCR_ACKINT); /* acknowledge interrupt */
1194
1195                 for (i = 0; i < ARRAY_SIZE(irq_order); i++)
1196                         if (isr & irq_order[i])
1197                                 break;
1198
1199                 if (!atmel_lock_mac(priv)) {
1200                         /* failed to contact card */
1201                         printk(KERN_ALERT "%s: failed to contact MAC.\n", dev->name);
1202                         return IRQ_HANDLED;
1203                 }
1204
1205                 isr = atmel_rmem8(priv, atmel_hi(priv, IFACE_INT_STATUS_OFFSET));
1206                 isr ^= irq_order[i];
1207                 atmel_wmem8(priv, atmel_hi(priv, IFACE_INT_STATUS_OFFSET), isr);
1208                 atmel_wmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_MAC_OFFSET), 0);
1209
1210                 switch (irq_order[i]) {
1211
1212                 case ISR_OUT_OF_RANGE:
1213                         if (priv->operating_mode == IW_MODE_INFRA &&
1214                             priv->station_state == STATION_STATE_READY) {
1215                                 priv->station_is_associated = 0;
1216                                 atmel_scan(priv, 1);
1217                         }
1218                         break;
1219
1220                 case ISR_RxFRAMELOST:
1221                         priv->wstats.discard.misc++;
1222                         /* fall through */
1223                 case ISR_RxCOMPLETE:
1224                         rx_done_irq(priv);
1225                         break;
1226
1227                 case ISR_TxCOMPLETE:
1228                         tx_done_irq(priv);
1229                         break;
1230
1231                 case ISR_FATAL_ERROR:
1232                         printk(KERN_ALERT "%s: *** FATAL error interrupt ***\n", dev->name);
1233                         atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
1234                         break;
1235
1236                 case ISR_COMMAND_COMPLETE:
1237                         atmel_command_irq(priv);
1238                         break;
1239
1240                 case ISR_IBSS_MERGE:
1241                         atmel_get_mib(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_CUR_BSSID_POS,
1242                                       priv->CurrentBSSID, 6);
1243                         /* The WPA stuff cares about the current AP address */
1244                         if (priv->use_wpa)
1245                                 build_wpa_mib(priv);
1246                         break;
1247                 case ISR_GENERIC_IRQ:
1248                         printk(KERN_INFO "%s: Generic_irq received.\n", dev->name);
1249                         break;
1250                 }
1251         }
1252 }
1253
1254 static struct net_device_stats *atmel_get_stats(struct net_device *dev)
1255 {
1256         struct atmel_private *priv = netdev_priv(dev);
1257         return &priv->stats;
1258 }
1259
1260 static struct iw_statistics *atmel_get_wireless_stats(struct net_device *dev)
1261 {
1262         struct atmel_private *priv = netdev_priv(dev);
1263
1264         /* update the link quality here in case we are seeing no beacons
1265            at all to drive the process */
1266         atmel_smooth_qual(priv);
1267
1268         priv->wstats.status = priv->station_state;
1269
1270         if (priv->operating_mode == IW_MODE_INFRA) {
1271                 if (priv->station_state != STATION_STATE_READY) {
1272                         priv->wstats.qual.qual = 0;
1273                         priv->wstats.qual.level = 0;
1274                         priv->wstats.qual.updated = (IW_QUAL_QUAL_INVALID
1275                                         | IW_QUAL_LEVEL_INVALID);
1276                 }
1277                 priv->wstats.qual.noise = 0;
1278                 priv->wstats.qual.updated |= IW_QUAL_NOISE_INVALID;
1279         } else {
1280                 /* Quality levels cannot be determined in ad-hoc mode,
1281                    because we can 'hear' more that one remote station. */
1282                 priv->wstats.qual.qual = 0;
1283                 priv->wstats.qual.level = 0;
1284                 priv->wstats.qual.noise = 0;
1285                 priv->wstats.qual.updated = IW_QUAL_QUAL_INVALID
1286                                         | IW_QUAL_LEVEL_INVALID
1287                                         | IW_QUAL_NOISE_INVALID;
1288                 priv->wstats.miss.beacon = 0;
1289         }
1290
1291         return &priv->wstats;
1292 }
1293
1294 static int atmel_change_mtu(struct net_device *dev, int new_mtu)
1295 {
1296         if ((new_mtu < 68) || (new_mtu > 2312))
1297                 return -EINVAL;
1298         dev->mtu = new_mtu;
1299         return 0;
1300 }
1301
1302 static int atmel_set_mac_address(struct net_device *dev, void *p)
1303 {
1304         struct sockaddr *addr = p;
1305
1306         memcpy (dev->dev_addr, addr->sa_data, dev->addr_len);
1307         return atmel_open(dev);
1308 }
1309
1310 EXPORT_SYMBOL(atmel_open);
1311
1312 int atmel_open(struct net_device *dev)
1313 {
1314         struct atmel_private *priv = netdev_priv(dev);
1315         int i, channel;
1316
1317         /* any scheduled timer is no longer needed and might screw things up.. */
1318         del_timer_sync(&priv->management_timer);
1319
1320         /* Interrupts will not touch the card once in this state... */
1321         priv->station_state = STATION_STATE_DOWN;
1322
1323         if (priv->new_SSID_size) {
1324                 memcpy(priv->SSID, priv->new_SSID, priv->new_SSID_size);
1325                 priv->SSID_size = priv->new_SSID_size;
1326                 priv->new_SSID_size = 0;
1327         }
1328         priv->BSS_list_entries = 0;
1329
1330         priv->AuthenticationRequestRetryCnt = 0;
1331         priv->AssociationRequestRetryCnt = 0;
1332         priv->ReAssociationRequestRetryCnt = 0;
1333         priv->CurrentAuthentTransactionSeqNum = 0x0001;
1334         priv->ExpectedAuthentTransactionSeqNum = 0x0002;
1335
1336         priv->site_survey_state = SITE_SURVEY_IDLE;
1337         priv->station_is_associated = 0;
1338
1339         if (!reset_atmel_card(dev))
1340                 return -EAGAIN;
1341
1342         if (priv->config_reg_domain) {
1343                 priv->reg_domain = priv->config_reg_domain;
1344                 atmel_set_mib8(priv, Phy_Mib_Type, PHY_MIB_REG_DOMAIN_POS, priv->reg_domain);
1345         } else {
1346                 priv->reg_domain = atmel_get_mib8(priv, Phy_Mib_Type, PHY_MIB_REG_DOMAIN_POS);
1347                 for (i = 0; i < ARRAY_SIZE(channel_table); i++)
1348                         if (priv->reg_domain == channel_table[i].reg_domain)
1349                                 break;
1350                 if (i == ARRAY_SIZE(channel_table)) {
1351                         priv->reg_domain = REG_DOMAIN_MKK1;
1352                         printk(KERN_ALERT "%s: failed to get regulatory domain: assuming MKK1.\n", dev->name);
1353                 }
1354         }
1355
1356         if ((channel = atmel_validate_channel(priv, priv->channel)))
1357                 priv->channel = channel;
1358
1359         /* this moves station_state on.... */
1360         atmel_scan(priv, 1);
1361
1362         atmel_set_gcr(priv->dev, GCR_ENINT); /* enable interrupts */
1363         return 0;
1364 }
1365
1366 static int atmel_close(struct net_device *dev)
1367 {
1368         struct atmel_private *priv = netdev_priv(dev);
1369
1370         /* Send event to userspace that we are disassociating */
1371         if (priv->station_state == STATION_STATE_READY) {
1372                 union iwreq_data wrqu;
1373
1374                 wrqu.data.length = 0;
1375                 wrqu.data.flags = 0;
1376                 wrqu.ap_addr.sa_family = ARPHRD_ETHER;
1377                 memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
1378                 wireless_send_event(priv->dev, SIOCGIWAP, &wrqu, NULL);
1379         }
1380
1381         atmel_enter_state(priv, STATION_STATE_DOWN);
1382
1383         if (priv->bus_type == BUS_TYPE_PCCARD)
1384                 atmel_write16(dev, GCR, 0x0060);
1385         atmel_write16(dev, GCR, 0x0040);
1386         return 0;
1387 }
1388
1389 static int atmel_validate_channel(struct atmel_private *priv, int channel)
1390 {
1391         /* check that channel is OK, if so return zero,
1392            else return suitable default channel */
1393         int i;
1394
1395         for (i = 0; i < ARRAY_SIZE(channel_table); i++)
1396                 if (priv->reg_domain == channel_table[i].reg_domain) {
1397                         if (channel >= channel_table[i].min &&
1398                             channel <= channel_table[i].max)
1399                                 return 0;
1400                         else
1401                                 return channel_table[i].min;
1402                 }
1403         return 0;
1404 }
1405
1406 static int atmel_proc_output (char *buf, struct atmel_private *priv)
1407 {
1408         int i;
1409         char *p = buf;
1410         char *s, *r, *c;
1411
1412         p += sprintf(p, "Driver version:\t\t%d.%d\n",
1413                      DRIVER_MAJOR, DRIVER_MINOR);
1414
1415         if (priv->station_state != STATION_STATE_DOWN) {
1416                 p += sprintf(p, "Firmware version:\t%d.%d build %d\n"
1417                                 "Firmware location:\t",
1418                              priv->host_info.major_version,
1419                              priv->host_info.minor_version,
1420                              priv->host_info.build_version);
1421
1422                 if (priv->card_type != CARD_TYPE_EEPROM)
1423                         p += sprintf(p, "on card\n");
1424                 else if (priv->firmware)
1425                         p += sprintf(p, "%s loaded by host\n",
1426                                      priv->firmware_id);
1427                 else
1428                         p += sprintf(p, "%s loaded by hotplug\n",
1429                                      priv->firmware_id);
1430
1431                 switch (priv->card_type) {
1432                 case CARD_TYPE_PARALLEL_FLASH: c = "Parallel flash"; break;
1433                 case CARD_TYPE_SPI_FLASH: c = "SPI flash\n"; break;
1434                 case CARD_TYPE_EEPROM: c = "EEPROM"; break;
1435                 default: c = "<unknown>";
1436                 }
1437
1438                 r = "<unknown>";
1439                 for (i = 0; i < ARRAY_SIZE(channel_table); i++)
1440                         if (priv->reg_domain == channel_table[i].reg_domain)
1441                                 r = channel_table[i].name;
1442
1443                 p += sprintf(p, "MAC memory type:\t%s\n", c);
1444                 p += sprintf(p, "Regulatory domain:\t%s\n", r);
1445                 p += sprintf(p, "Host CRC checking:\t%s\n",
1446                              priv->do_rx_crc ? "On" : "Off");
1447                 p += sprintf(p, "WPA-capable firmware:\t%s\n",
1448                              priv->use_wpa ? "Yes" : "No");
1449         }
1450
1451         switch(priv->station_state) {
1452         case STATION_STATE_SCANNING: s = "Scanning"; break;
1453         case STATION_STATE_JOINNING: s = "Joining"; break;
1454         case STATION_STATE_AUTHENTICATING: s = "Authenticating"; break;
1455         case STATION_STATE_ASSOCIATING: s = "Associating"; break;
1456         case STATION_STATE_READY: s = "Ready"; break;
1457         case STATION_STATE_REASSOCIATING: s = "Reassociating"; break;
1458         case STATION_STATE_MGMT_ERROR: s = "Management error"; break;
1459         case STATION_STATE_DOWN: s = "Down"; break;
1460         default: s = "<unknown>";
1461         }
1462
1463         p += sprintf(p, "Current state:\t\t%s\n", s);
1464         return p - buf;
1465 }
1466
1467 static int atmel_read_proc(char *page, char **start, off_t off,
1468                            int count, int *eof, void *data)
1469 {
1470         struct atmel_private *priv = data;
1471         int len = atmel_proc_output (page, priv);
1472         if (len <= off+count) *eof = 1;
1473         *start = page + off;
1474         len -= off;
1475         if (len>count) len = count;
1476         if (len<0) len = 0;
1477         return len;
1478 }
1479
1480 struct net_device *init_atmel_card(unsigned short irq, unsigned long port,
1481                                    const AtmelFWType fw_type,
1482                                    struct device *sys_dev,
1483                                    int (*card_present)(void *), void *card)
1484 {
1485         struct proc_dir_entry *ent;
1486         struct net_device *dev;
1487         struct atmel_private *priv;
1488         int rc;
1489
1490         /* Create the network device object. */
1491         dev = alloc_etherdev(sizeof(*priv));
1492         if (!dev) {
1493                 printk(KERN_ERR "atmel: Couldn't alloc_etherdev\n");
1494                 return NULL;
1495         }
1496         if (dev_alloc_name(dev, dev->name) < 0) {
1497                 printk(KERN_ERR "atmel: Couldn't get name!\n");
1498                 goto err_out_free;
1499         }
1500
1501         priv = netdev_priv(dev);
1502         priv->dev = dev;
1503         priv->sys_dev = sys_dev;
1504         priv->present_callback = card_present;
1505         priv->card = card;
1506         priv->firmware = NULL;
1507         priv->firmware_id[0] = '\0';
1508         priv->firmware_type = fw_type;
1509         if (firmware) /* module parameter */
1510                 strcpy(priv->firmware_id, firmware);
1511         priv->bus_type = card_present ? BUS_TYPE_PCCARD : BUS_TYPE_PCI;
1512         priv->station_state = STATION_STATE_DOWN;
1513         priv->do_rx_crc = 0;
1514         /* For PCMCIA cards, some chips need CRC, some don't
1515            so we have to probe. */
1516         if (priv->bus_type == BUS_TYPE_PCCARD) {
1517                 priv->probe_crc = 1;
1518                 priv->crc_ok_cnt = priv->crc_ko_cnt = 0;
1519         } else
1520                 priv->probe_crc = 0;
1521         memset(&priv->stats, 0, sizeof(priv->stats));
1522         memset(&priv->wstats, 0, sizeof(priv->wstats));
1523         priv->last_qual = jiffies;
1524         priv->last_beacon_timestamp = 0;
1525         memset(priv->frag_source, 0xff, sizeof(priv->frag_source));
1526         memset(priv->BSSID, 0, 6);
1527         priv->CurrentBSSID[0] = 0xFF; /* Initialize to something invalid.... */
1528         priv->station_was_associated = 0;
1529
1530         priv->last_survey = jiffies;
1531         priv->preamble = LONG_PREAMBLE;
1532         priv->operating_mode = IW_MODE_INFRA;
1533         priv->connect_to_any_BSS = 0;
1534         priv->config_reg_domain = 0;
1535         priv->reg_domain = 0;
1536         priv->tx_rate = 3;
1537         priv->auto_tx_rate = 1;
1538         priv->channel = 4;
1539         priv->power_mode = 0;
1540         priv->SSID[0] = '\0';
1541         priv->SSID_size = 0;
1542         priv->new_SSID_size = 0;
1543         priv->frag_threshold = 2346;
1544         priv->rts_threshold = 2347;
1545         priv->short_retry = 7;
1546         priv->long_retry = 4;
1547
1548         priv->wep_is_on = 0;
1549         priv->default_key = 0;
1550         priv->encryption_level = 0;
1551         priv->exclude_unencrypted = 0;
1552         priv->group_cipher_suite = priv->pairwise_cipher_suite = CIPHER_SUITE_NONE;
1553         priv->use_wpa = 0;
1554         memset(priv->wep_keys, 0, sizeof(priv->wep_keys));
1555         memset(priv->wep_key_len, 0, sizeof(priv->wep_key_len));
1556
1557         priv->default_beacon_period = priv->beacon_period = 100;
1558         priv->listen_interval = 1;
1559
1560         init_timer(&priv->management_timer);
1561         spin_lock_init(&priv->irqlock);
1562         spin_lock_init(&priv->timerlock);
1563         priv->management_timer.function = atmel_management_timer;
1564         priv->management_timer.data = (unsigned long) dev;
1565
1566         dev->open = atmel_open;
1567         dev->stop = atmel_close;
1568         dev->change_mtu = atmel_change_mtu;
1569         dev->set_mac_address = atmel_set_mac_address;
1570         dev->hard_start_xmit = start_tx;
1571         dev->get_stats = atmel_get_stats;
1572         dev->wireless_handlers = (struct iw_handler_def *)&atmel_handler_def;
1573         dev->do_ioctl = atmel_ioctl;
1574         dev->irq = irq;
1575         dev->base_addr = port;
1576
1577         SET_NETDEV_DEV(dev, sys_dev);
1578
1579         if ((rc = request_irq(dev->irq, service_interrupt, IRQF_SHARED, dev->name, dev))) {
1580                 printk(KERN_ERR "%s: register interrupt %d failed, rc %d\n", dev->name, irq, rc);
1581                 goto err_out_free;
1582         }
1583
1584         if (!request_region(dev->base_addr, 32,
1585                             priv->bus_type == BUS_TYPE_PCCARD ?  "atmel_cs" : "atmel_pci")) {
1586                 goto err_out_irq;
1587         }
1588
1589         if (register_netdev(dev))
1590                 goto err_out_res;
1591
1592         if (!probe_atmel_card(dev)){
1593                 unregister_netdev(dev);
1594                 goto err_out_res;
1595         }
1596
1597         netif_carrier_off(dev);
1598
1599         ent = create_proc_read_entry ("driver/atmel", 0, NULL, atmel_read_proc, priv);
1600         if (!ent)
1601                 printk(KERN_WARNING "atmel: unable to create /proc entry.\n");
1602
1603         printk(KERN_INFO "%s: Atmel at76c50x. Version %d.%d. MAC %.2x:%.2x:%.2x:%.2x:%.2x:%.2x\n",
1604                dev->name, DRIVER_MAJOR, DRIVER_MINOR,
1605                dev->dev_addr[0], dev->dev_addr[1], dev->dev_addr[2],
1606                dev->dev_addr[3], dev->dev_addr[4], dev->dev_addr[5] );
1607
1608         SET_MODULE_OWNER(dev);
1609         return dev;
1610
1611 err_out_res:
1612         release_region( dev->base_addr, 32);
1613 err_out_irq:
1614         free_irq(dev->irq, dev);
1615 err_out_free:
1616         free_netdev(dev);
1617         return NULL;
1618 }
1619
1620 EXPORT_SYMBOL(init_atmel_card);
1621
1622 void stop_atmel_card(struct net_device *dev)
1623 {
1624         struct atmel_private *priv = netdev_priv(dev);
1625
1626         /* put a brick on it... */
1627         if (priv->bus_type == BUS_TYPE_PCCARD)
1628                 atmel_write16(dev, GCR, 0x0060);
1629         atmel_write16(dev, GCR, 0x0040);
1630
1631         del_timer_sync(&priv->management_timer);
1632         unregister_netdev(dev);
1633         remove_proc_entry("driver/atmel", NULL);
1634         free_irq(dev->irq, dev);
1635         kfree(priv->firmware);
1636         release_region(dev->base_addr, 32);
1637         free_netdev(dev);
1638 }
1639
1640 EXPORT_SYMBOL(stop_atmel_card);
1641
1642 static int atmel_set_essid(struct net_device *dev,
1643                            struct iw_request_info *info,
1644                            struct iw_point *dwrq,
1645                            char *extra)
1646 {
1647         struct atmel_private *priv = netdev_priv(dev);
1648
1649         /* Check if we asked for `any' */
1650         if(dwrq->flags == 0) {
1651                 priv->connect_to_any_BSS = 1;
1652         } else {
1653                 int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
1654
1655                 priv->connect_to_any_BSS = 0;
1656
1657                 /* Check the size of the string */
1658                 if (dwrq->length > MAX_SSID_LENGTH)
1659                          return -E2BIG;
1660                 if (index != 0)
1661                         return -EINVAL;
1662
1663                 memcpy(priv->new_SSID, extra, dwrq->length);
1664                 priv->new_SSID_size = dwrq->length;
1665         }
1666
1667         return -EINPROGRESS;
1668 }
1669
1670 static int atmel_get_essid(struct net_device *dev,
1671                            struct iw_request_info *info,
1672                            struct iw_point *dwrq,
1673                            char *extra)
1674 {
1675         struct atmel_private *priv = netdev_priv(dev);
1676
1677         /* Get the current SSID */
1678         if (priv->new_SSID_size != 0) {
1679                 memcpy(extra, priv->new_SSID, priv->new_SSID_size);
1680                 dwrq->length = priv->new_SSID_size;
1681         } else {
1682                 memcpy(extra, priv->SSID, priv->SSID_size);
1683                 dwrq->length = priv->SSID_size;
1684         }
1685
1686         dwrq->flags = !priv->connect_to_any_BSS; /* active */
1687
1688         return 0;
1689 }
1690
1691 static int atmel_get_wap(struct net_device *dev,
1692                          struct iw_request_info *info,
1693                          struct sockaddr *awrq,
1694                          char *extra)
1695 {
1696         struct atmel_private *priv = netdev_priv(dev);
1697         memcpy(awrq->sa_data, priv->CurrentBSSID, 6);
1698         awrq->sa_family = ARPHRD_ETHER;
1699
1700         return 0;
1701 }
1702
1703 static int atmel_set_encode(struct net_device *dev,
1704                             struct iw_request_info *info,
1705                             struct iw_point *dwrq,
1706                             char *extra)
1707 {
1708         struct atmel_private *priv = netdev_priv(dev);
1709
1710         /* Basic checking: do we have a key to set ?
1711          * Note : with the new API, it's impossible to get a NULL pointer.
1712          * Therefore, we need to check a key size == 0 instead.
1713          * New version of iwconfig properly set the IW_ENCODE_NOKEY flag
1714          * when no key is present (only change flags), but older versions
1715          * don't do it. - Jean II */
1716         if (dwrq->length > 0) {
1717                 int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
1718                 int current_index = priv->default_key;
1719                 /* Check the size of the key */
1720                 if (dwrq->length > 13) {
1721                         return -EINVAL;
1722                 }
1723                 /* Check the index (none -> use current) */
1724                 if (index < 0 || index >= 4)
1725                         index = current_index;
1726                 else
1727                         priv->default_key = index;
1728                 /* Set the length */
1729                 if (dwrq->length > 5)
1730                         priv->wep_key_len[index] = 13;
1731                 else
1732                         if (dwrq->length > 0)
1733                                 priv->wep_key_len[index] = 5;
1734                         else
1735                                 /* Disable the key */
1736                                 priv->wep_key_len[index] = 0;
1737                 /* Check if the key is not marked as invalid */
1738                 if (!(dwrq->flags & IW_ENCODE_NOKEY)) {
1739                         /* Cleanup */
1740                         memset(priv->wep_keys[index], 0, 13);
1741                         /* Copy the key in the driver */
1742                         memcpy(priv->wep_keys[index], extra, dwrq->length);
1743                 }
1744                 /* WE specify that if a valid key is set, encryption
1745                  * should be enabled (user may turn it off later)
1746                  * This is also how "iwconfig ethX key on" works */
1747                 if (index == current_index &&
1748                     priv->wep_key_len[index] > 0) {
1749                         priv->wep_is_on = 1;
1750                         priv->exclude_unencrypted = 1;
1751                         if (priv->wep_key_len[index] > 5) {
1752                                 priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_128;
1753                                 priv->encryption_level = 2;
1754                         } else {
1755                                 priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_64;
1756                                 priv->encryption_level = 1;
1757                         }
1758                 }
1759         } else {
1760                 /* Do we want to just set the transmit key index ? */
1761                 int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
1762                 if (index >= 0 && index < 4) {
1763                         priv->default_key = index;
1764                 } else
1765                         /* Don't complain if only change the mode */
1766                         if (!dwrq->flags & IW_ENCODE_MODE) {
1767                                 return -EINVAL;
1768                         }
1769         }
1770         /* Read the flags */
1771         if (dwrq->flags & IW_ENCODE_DISABLED) {
1772                 priv->wep_is_on = 0;
1773                 priv->encryption_level = 0;
1774                 priv->pairwise_cipher_suite = CIPHER_SUITE_NONE;
1775         } else {
1776                 priv->wep_is_on = 1;
1777                 if (priv->wep_key_len[priv->default_key] > 5) {
1778                         priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_128;
1779                         priv->encryption_level = 2;
1780                 } else {
1781                         priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_64;
1782                         priv->encryption_level = 1;
1783                 }
1784         }
1785         if (dwrq->flags & IW_ENCODE_RESTRICTED)
1786                 priv->exclude_unencrypted = 1;
1787         if(dwrq->flags & IW_ENCODE_OPEN)
1788                 priv->exclude_unencrypted = 0;
1789
1790         return -EINPROGRESS;            /* Call commit handler */
1791 }
1792
1793 static int atmel_get_encode(struct net_device *dev,
1794                             struct iw_request_info *info,
1795                             struct iw_point *dwrq,
1796                             char *extra)
1797 {
1798         struct atmel_private *priv = netdev_priv(dev);
1799         int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
1800
1801         if (!priv->wep_is_on)
1802                 dwrq->flags = IW_ENCODE_DISABLED;
1803         else {
1804                 if (priv->exclude_unencrypted)
1805                         dwrq->flags = IW_ENCODE_RESTRICTED;
1806                 else
1807                         dwrq->flags = IW_ENCODE_OPEN;
1808         }
1809                 /* Which key do we want ? -1 -> tx index */
1810         if (index < 0 || index >= 4)
1811                 index = priv->default_key;
1812         dwrq->flags |= index + 1;
1813         /* Copy the key to the user buffer */
1814         dwrq->length = priv->wep_key_len[index];
1815         if (dwrq->length > 16) {
1816                 dwrq->length=0;
1817         } else {
1818                 memset(extra, 0, 16);
1819                 memcpy(extra, priv->wep_keys[index], dwrq->length);
1820         }
1821
1822         return 0;
1823 }
1824
1825 static int atmel_set_encodeext(struct net_device *dev,
1826                             struct iw_request_info *info,
1827                             union iwreq_data *wrqu,
1828                             char *extra)
1829 {
1830         struct atmel_private *priv = netdev_priv(dev);
1831         struct iw_point *encoding = &wrqu->encoding;
1832         struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
1833         int idx, key_len, alg = ext->alg, set_key = 1;
1834
1835         /* Determine and validate the key index */
1836         idx = encoding->flags & IW_ENCODE_INDEX;
1837         if (idx) {
1838                 if (idx < 1 || idx > WEP_KEYS)
1839                         return -EINVAL;
1840                 idx--;
1841         } else
1842                 idx = priv->default_key;
1843
1844         if (encoding->flags & IW_ENCODE_DISABLED)
1845             alg = IW_ENCODE_ALG_NONE;
1846
1847         if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY) {
1848                 priv->default_key = idx;
1849                 set_key = ext->key_len > 0 ? 1 : 0;
1850         }
1851
1852         if (set_key) {
1853                 /* Set the requested key first */
1854                 switch (alg) {
1855                 case IW_ENCODE_ALG_NONE:
1856                         priv->wep_is_on = 0;
1857                         priv->encryption_level = 0;
1858                         priv->pairwise_cipher_suite = CIPHER_SUITE_NONE;
1859                         break;
1860                 case IW_ENCODE_ALG_WEP:
1861                         if (ext->key_len > 5) {
1862                                 priv->wep_key_len[idx] = 13;
1863                                 priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_128;
1864                                 priv->encryption_level = 2;
1865                         } else if (ext->key_len > 0) {
1866                                 priv->wep_key_len[idx] = 5;
1867                                 priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_64;
1868                                 priv->encryption_level = 1;
1869                         } else {
1870                                 return -EINVAL;
1871                         }
1872                         priv->wep_is_on = 1;
1873                         memset(priv->wep_keys[idx], 0, 13);
1874                         key_len = min ((int)ext->key_len, priv->wep_key_len[idx]);
1875                         memcpy(priv->wep_keys[idx], ext->key, key_len);
1876                         break;
1877                 default:
1878                         return -EINVAL;
1879                 }
1880         }
1881
1882         return -EINPROGRESS;
1883 }
1884
1885 static int atmel_get_encodeext(struct net_device *dev,
1886                             struct iw_request_info *info,
1887                             union iwreq_data *wrqu,
1888                             char *extra)
1889 {
1890         struct atmel_private *priv = netdev_priv(dev);
1891         struct iw_point *encoding = &wrqu->encoding;
1892         struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
1893         int idx, max_key_len;
1894
1895         max_key_len = encoding->length - sizeof(*ext);
1896         if (max_key_len < 0)
1897                 return -EINVAL;
1898
1899         idx = encoding->flags & IW_ENCODE_INDEX;
1900         if (idx) {
1901                 if (idx < 1 || idx > WEP_KEYS)
1902                         return -EINVAL;
1903                 idx--;
1904         } else
1905                 idx = priv->default_key;
1906
1907         encoding->flags = idx + 1;
1908         memset(ext, 0, sizeof(*ext));
1909
1910         if (!priv->wep_is_on) {
1911                 ext->alg = IW_ENCODE_ALG_NONE;
1912                 ext->key_len = 0;
1913                 encoding->flags |= IW_ENCODE_DISABLED;
1914         } else {
1915                 if (priv->encryption_level > 0)
1916                         ext->alg = IW_ENCODE_ALG_WEP;
1917                 else
1918                         return -EINVAL;
1919
1920                 ext->key_len = priv->wep_key_len[idx];
1921                 memcpy(ext->key, priv->wep_keys[idx], ext->key_len);
1922                 encoding->flags |= IW_ENCODE_ENABLED;
1923         }
1924
1925         return 0;
1926 }
1927
1928 static int atmel_set_auth(struct net_device *dev,
1929                                struct iw_request_info *info,
1930                                union iwreq_data *wrqu, char *extra)
1931 {
1932         struct atmel_private *priv = netdev_priv(dev);
1933         struct iw_param *param = &wrqu->param;
1934
1935         switch (param->flags & IW_AUTH_INDEX) {
1936         case IW_AUTH_WPA_VERSION:
1937         case IW_AUTH_CIPHER_PAIRWISE:
1938         case IW_AUTH_CIPHER_GROUP:
1939         case IW_AUTH_KEY_MGMT:
1940         case IW_AUTH_RX_UNENCRYPTED_EAPOL:
1941         case IW_AUTH_PRIVACY_INVOKED:
1942                 /*
1943                  * atmel does not use these parameters
1944                  */
1945                 break;
1946
1947         case IW_AUTH_DROP_UNENCRYPTED:
1948                 priv->exclude_unencrypted = param->value ? 1 : 0;
1949                 break;
1950
1951         case IW_AUTH_80211_AUTH_ALG: {
1952                         if (param->value & IW_AUTH_ALG_SHARED_KEY) {
1953                                 priv->exclude_unencrypted = 1;
1954                         } else if (param->value & IW_AUTH_ALG_OPEN_SYSTEM) {
1955                                 priv->exclude_unencrypted = 0;
1956                         } else
1957                                 return -EINVAL;
1958                         break;
1959                 }
1960
1961         case IW_AUTH_WPA_ENABLED:
1962                 /* Silently accept disable of WPA */
1963                 if (param->value > 0)
1964                         return -EOPNOTSUPP;
1965                 break;
1966
1967         default:
1968                 return -EOPNOTSUPP;
1969         }
1970         return -EINPROGRESS;
1971 }
1972
1973 static int atmel_get_auth(struct net_device *dev,
1974                                struct iw_request_info *info,
1975                                union iwreq_data *wrqu, char *extra)
1976 {
1977         struct atmel_private *priv = netdev_priv(dev);
1978         struct iw_param *param = &wrqu->param;
1979
1980         switch (param->flags & IW_AUTH_INDEX) {
1981         case IW_AUTH_DROP_UNENCRYPTED:
1982                 param->value = priv->exclude_unencrypted;
1983                 break;
1984
1985         case IW_AUTH_80211_AUTH_ALG:
1986                 if (priv->exclude_unencrypted == 1)
1987                         param->value = IW_AUTH_ALG_SHARED_KEY;
1988                 else
1989                         param->value = IW_AUTH_ALG_OPEN_SYSTEM;
1990                 break;
1991
1992         case IW_AUTH_WPA_ENABLED:
1993                 param->value = 0;
1994                 break;
1995
1996         default:
1997                 return -EOPNOTSUPP;
1998         }
1999         return 0;
2000 }
2001
2002
2003 static int atmel_get_name(struct net_device *dev,
2004                           struct iw_request_info *info,
2005                           char *cwrq,
2006                           char *extra)
2007 {
2008         strcpy(cwrq, "IEEE 802.11-DS");
2009         return 0;
2010 }
2011
2012 static int atmel_set_rate(struct net_device *dev,
2013                           struct iw_request_info *info,
2014                           struct iw_param *vwrq,
2015                           char *extra)
2016 {
2017         struct atmel_private *priv = netdev_priv(dev);
2018
2019         if (vwrq->fixed == 0) {
2020                 priv->tx_rate = 3;
2021                 priv->auto_tx_rate = 1;
2022         } else {
2023                 priv->auto_tx_rate = 0;
2024
2025                 /* Which type of value ? */
2026                 if ((vwrq->value < 4) && (vwrq->value >= 0)) {
2027                         /* Setting by rate index */
2028                         priv->tx_rate = vwrq->value;
2029                 } else {
2030                 /* Setting by frequency value */
2031                         switch (vwrq->value) {
2032                         case  1000000: priv->tx_rate = 0; break;
2033                         case  2000000: priv->tx_rate = 1; break;
2034                         case  5500000: priv->tx_rate = 2; break;
2035                         case 11000000: priv->tx_rate = 3; break;
2036                         default: return -EINVAL;
2037                         }
2038                 }
2039         }
2040
2041         return -EINPROGRESS;
2042 }
2043
2044 static int atmel_set_mode(struct net_device *dev,
2045                           struct iw_request_info *info,
2046                           __u32 *uwrq,
2047                           char *extra)
2048 {
2049         struct atmel_private *priv = netdev_priv(dev);
2050
2051         if (*uwrq != IW_MODE_ADHOC && *uwrq != IW_MODE_INFRA)
2052                 return -EINVAL;
2053
2054         priv->operating_mode = *uwrq;
2055         return -EINPROGRESS;
2056 }
2057
2058 static int atmel_get_mode(struct net_device *dev,
2059                           struct iw_request_info *info,
2060                           __u32 *uwrq,
2061                           char *extra)
2062 {
2063         struct atmel_private *priv = netdev_priv(dev);
2064
2065         *uwrq = priv->operating_mode;
2066         return 0;
2067 }
2068
2069 static int atmel_get_rate(struct net_device *dev,
2070                          struct iw_request_info *info,
2071                          struct iw_param *vwrq,
2072                          char *extra)
2073 {
2074         struct atmel_private *priv = netdev_priv(dev);
2075
2076         if (priv->auto_tx_rate) {
2077                 vwrq->fixed = 0;
2078                 vwrq->value = 11000000;
2079         } else {
2080                 vwrq->fixed = 1;
2081                 switch(priv->tx_rate) {
2082                 case 0: vwrq->value =  1000000; break;
2083                 case 1: vwrq->value =  2000000; break;
2084                 case 2: vwrq->value =  5500000; break;
2085                 case 3: vwrq->value = 11000000; break;
2086                 }
2087         }
2088         return 0;
2089 }
2090
2091 static int atmel_set_power(struct net_device *dev,
2092                            struct iw_request_info *info,
2093                            struct iw_param *vwrq,
2094                            char *extra)
2095 {
2096         struct atmel_private *priv = netdev_priv(dev);
2097         priv->power_mode = vwrq->disabled ? 0 : 1;
2098         return -EINPROGRESS;
2099 }
2100
2101 static int atmel_get_power(struct net_device *dev,
2102                            struct iw_request_info *info,
2103                            struct iw_param *vwrq,
2104                            char *extra)
2105 {
2106         struct atmel_private *priv = netdev_priv(dev);
2107         vwrq->disabled = priv->power_mode ? 0 : 1;
2108         vwrq->flags = IW_POWER_ON;
2109         return 0;
2110 }
2111
2112 static int atmel_set_retry(struct net_device *dev,
2113                            struct iw_request_info *info,
2114                            struct iw_param *vwrq,
2115                            char *extra)
2116 {
2117         struct atmel_private *priv = netdev_priv(dev);
2118
2119         if (!vwrq->disabled && (vwrq->flags & IW_RETRY_LIMIT)) {
2120                 if (vwrq->flags & IW_RETRY_LONG)
2121                         priv->long_retry = vwrq->value;
2122                 else if (vwrq->flags & IW_RETRY_SHORT)
2123                         priv->short_retry = vwrq->value;
2124                 else {
2125                         /* No modifier : set both */
2126                         priv->long_retry = vwrq->value;
2127                         priv->short_retry = vwrq->value;
2128                 }
2129                 return -EINPROGRESS;
2130         }
2131
2132         return -EINVAL;
2133 }
2134
2135 static int atmel_get_retry(struct net_device *dev,
2136                            struct iw_request_info *info,
2137                            struct iw_param *vwrq,
2138                            char *extra)
2139 {
2140         struct atmel_private *priv = netdev_priv(dev);
2141
2142         vwrq->disabled = 0;      /* Can't be disabled */
2143
2144         /* Note : by default, display the short retry number */
2145         if (vwrq->flags & IW_RETRY_LONG) {
2146                 vwrq->flags = IW_RETRY_LIMIT | IW_RETRY_LONG;
2147                 vwrq->value = priv->long_retry;
2148         } else {
2149                 vwrq->flags = IW_RETRY_LIMIT;
2150                 vwrq->value = priv->short_retry;
2151                 if (priv->long_retry != priv->short_retry)
2152                         vwrq->flags |= IW_RETRY_SHORT;
2153         }
2154
2155         return 0;
2156 }
2157
2158 static int atmel_set_rts(struct net_device *dev,
2159                          struct iw_request_info *info,
2160                          struct iw_param *vwrq,
2161                          char *extra)
2162 {
2163         struct atmel_private *priv = netdev_priv(dev);
2164         int rthr = vwrq->value;
2165
2166         if (vwrq->disabled)
2167                 rthr = 2347;
2168         if ((rthr < 0) || (rthr > 2347)) {
2169                 return -EINVAL;
2170         }
2171         priv->rts_threshold = rthr;
2172
2173         return -EINPROGRESS;            /* Call commit handler */
2174 }
2175
2176 static int atmel_get_rts(struct net_device *dev,
2177                          struct iw_request_info *info,
2178                          struct iw_param *vwrq,
2179                          char *extra)
2180 {
2181         struct atmel_private *priv = netdev_priv(dev);
2182
2183         vwrq->value = priv->rts_threshold;
2184         vwrq->disabled = (vwrq->value >= 2347);
2185         vwrq->fixed = 1;
2186
2187         return 0;
2188 }
2189
2190 static int atmel_set_frag(struct net_device *dev,
2191                           struct iw_request_info *info,
2192                           struct iw_param *vwrq,
2193                           char *extra)
2194 {
2195         struct atmel_private *priv = netdev_priv(dev);
2196         int fthr = vwrq->value;
2197
2198         if (vwrq->disabled)
2199                 fthr = 2346;
2200         if ((fthr < 256) || (fthr > 2346)) {
2201                 return -EINVAL;
2202         }
2203         fthr &= ~0x1;   /* Get an even value - is it really needed ??? */
2204         priv->frag_threshold = fthr;
2205
2206         return -EINPROGRESS;            /* Call commit handler */
2207 }
2208
2209 static int atmel_get_frag(struct net_device *dev,
2210                           struct iw_request_info *info,
2211                           struct iw_param *vwrq,
2212                           char *extra)
2213 {
2214         struct atmel_private *priv = netdev_priv(dev);
2215
2216         vwrq->value = priv->frag_threshold;
2217         vwrq->disabled = (vwrq->value >= 2346);
2218         vwrq->fixed = 1;
2219
2220         return 0;
2221 }
2222
2223 static const long frequency_list[] = { 2412, 2417, 2422, 2427, 2432, 2437, 2442,
2224                                 2447, 2452, 2457, 2462, 2467, 2472, 2484 };
2225
2226 static int atmel_set_freq(struct net_device *dev,
2227                           struct iw_request_info *info,
2228                           struct iw_freq *fwrq,
2229                           char *extra)
2230 {
2231         struct atmel_private *priv = netdev_priv(dev);
2232         int rc = -EINPROGRESS;          /* Call commit handler */
2233
2234         /* If setting by frequency, convert to a channel */
2235         if ((fwrq->e == 1) &&
2236             (fwrq->m >= (int) 241200000) &&
2237             (fwrq->m <= (int) 248700000)) {
2238                 int f = fwrq->m / 100000;
2239                 int c = 0;
2240                 while ((c < 14) && (f != frequency_list[c]))
2241                         c++;
2242                 /* Hack to fall through... */
2243                 fwrq->e = 0;
2244                 fwrq->m = c + 1;
2245         }
2246         /* Setting by channel number */
2247         if ((fwrq->m > 1000) || (fwrq->e > 0))
2248                 rc = -EOPNOTSUPP;
2249         else {
2250                 int channel = fwrq->m;
2251                 if (atmel_validate_channel(priv, channel) == 0) {
2252                         priv->channel = channel;
2253                 } else {
2254                         rc = -EINVAL;
2255                 }
2256         }
2257         return rc;
2258 }
2259
2260 static int atmel_get_freq(struct net_device *dev,
2261                           struct iw_request_info *info,
2262                           struct iw_freq *fwrq,
2263                           char *extra)
2264 {
2265         struct atmel_private *priv = netdev_priv(dev);
2266
2267         fwrq->m = priv->channel;
2268         fwrq->e = 0;
2269         return 0;
2270 }
2271
2272 static int atmel_set_scan(struct net_device *dev,
2273                           struct iw_request_info *info,
2274                           struct iw_param *vwrq,
2275                           char *extra)
2276 {
2277         struct atmel_private *priv = netdev_priv(dev);
2278         unsigned long flags;
2279
2280         /* Note : you may have realised that, as this is a SET operation,
2281          * this is privileged and therefore a normal user can't
2282          * perform scanning.
2283          * This is not an error, while the device perform scanning,
2284          * traffic doesn't flow, so it's a perfect DoS...
2285          * Jean II */
2286
2287         if (priv->station_state == STATION_STATE_DOWN)
2288                 return -EAGAIN;
2289
2290         /* Timeout old surveys. */
2291         if ((jiffies - priv->last_survey) > (20 * HZ))
2292                 priv->site_survey_state = SITE_SURVEY_IDLE;
2293         priv->last_survey = jiffies;
2294
2295         /* Initiate a scan command */
2296         if (priv->site_survey_state == SITE_SURVEY_IN_PROGRESS)
2297                 return -EBUSY;
2298
2299         del_timer_sync(&priv->management_timer);
2300         spin_lock_irqsave(&priv->irqlock, flags);
2301
2302         priv->site_survey_state = SITE_SURVEY_IN_PROGRESS;
2303         priv->fast_scan = 0;
2304         atmel_scan(priv, 0);
2305         spin_unlock_irqrestore(&priv->irqlock, flags);
2306
2307         return 0;
2308 }
2309
2310 static int atmel_get_scan(struct net_device *dev,
2311                           struct iw_request_info *info,
2312                           struct iw_point *dwrq,
2313                           char *extra)
2314 {
2315         struct atmel_private *priv = netdev_priv(dev);
2316         int i;
2317         char *current_ev = extra;
2318         struct iw_event iwe;
2319
2320         if (priv->site_survey_state != SITE_SURVEY_COMPLETED)
2321                 return -EAGAIN;
2322
2323         for (i = 0; i < priv->BSS_list_entries; i++) {
2324                 iwe.cmd = SIOCGIWAP;
2325                 iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
2326                 memcpy(iwe.u.ap_addr.sa_data, priv->BSSinfo[i].BSSID, 6);
2327                 current_ev = iwe_stream_add_event(current_ev, extra + IW_SCAN_MAX_DATA, &iwe, IW_EV_ADDR_LEN);
2328
2329                 iwe.u.data.length =  priv->BSSinfo[i].SSIDsize;
2330                 if (iwe.u.data.length > 32)
2331                         iwe.u.data.length = 32;
2332                 iwe.cmd = SIOCGIWESSID;
2333                 iwe.u.data.flags = 1;
2334                 current_ev = iwe_stream_add_point(current_ev, extra + IW_SCAN_MAX_DATA, &iwe, priv->BSSinfo[i].SSID);
2335
2336                 iwe.cmd = SIOCGIWMODE;
2337                 iwe.u.mode = priv->BSSinfo[i].BSStype;
2338                 current_ev = iwe_stream_add_event(current_ev, extra + IW_SCAN_MAX_DATA, &iwe, IW_EV_UINT_LEN);
2339
2340                 iwe.cmd = SIOCGIWFREQ;
2341                 iwe.u.freq.m = priv->BSSinfo[i].channel;
2342                 iwe.u.freq.e = 0;
2343                 current_ev = iwe_stream_add_event(current_ev, extra + IW_SCAN_MAX_DATA, &iwe, IW_EV_FREQ_LEN);
2344
2345                 /* Add quality statistics */
2346                 iwe.cmd = IWEVQUAL;
2347                 iwe.u.qual.level = priv->BSSinfo[i].RSSI;
2348                 iwe.u.qual.qual  = iwe.u.qual.level;
2349                 /* iwe.u.qual.noise  = SOMETHING */
2350                 current_ev = iwe_stream_add_event(current_ev, extra + IW_SCAN_MAX_DATA , &iwe, IW_EV_QUAL_LEN);
2351
2352
2353                 iwe.cmd = SIOCGIWENCODE;
2354                 if (priv->BSSinfo[i].UsingWEP)
2355                         iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
2356                 else
2357                         iwe.u.data.flags = IW_ENCODE_DISABLED;
2358                 iwe.u.data.length = 0;
2359                 current_ev = iwe_stream_add_point(current_ev, extra + IW_SCAN_MAX_DATA, &iwe, NULL);
2360         }
2361
2362         /* Length of data */
2363         dwrq->length = (current_ev - extra);
2364         dwrq->flags = 0;
2365
2366         return 0;
2367 }
2368
2369 static int atmel_get_range(struct net_device *dev,
2370                            struct iw_request_info *info,
2371                            struct iw_point *dwrq,
2372                            char *extra)
2373 {
2374         struct atmel_private *priv = netdev_priv(dev);
2375         struct iw_range *range = (struct iw_range *) extra;
2376         int k, i, j;
2377
2378         dwrq->length = sizeof(struct iw_range);
2379         memset(range, 0, sizeof(struct iw_range));
2380         range->min_nwid = 0x0000;
2381         range->max_nwid = 0x0000;
2382         range->num_channels = 0;
2383         for (j = 0; j < ARRAY_SIZE(channel_table); j++)
2384                 if (priv->reg_domain == channel_table[j].reg_domain) {
2385                         range->num_channels = channel_table[j].max - channel_table[j].min + 1;
2386                         break;
2387                 }
2388         if (range->num_channels != 0) {
2389                 for (k = 0, i = channel_table[j].min; i <= channel_table[j].max; i++) {
2390                         range->freq[k].i = i; /* List index */
2391                         range->freq[k].m = frequency_list[i - 1] * 100000;
2392                         range->freq[k++].e = 1; /* Values in table in MHz -> * 10^5 * 10 */
2393                 }
2394                 range->num_frequency = k;
2395         }
2396
2397         range->max_qual.qual = 100;
2398         range->max_qual.level = 100;
2399         range->max_qual.noise = 0;
2400         range->max_qual.updated = IW_QUAL_NOISE_INVALID;
2401
2402         range->avg_qual.qual = 50;
2403         range->avg_qual.level = 50;
2404         range->avg_qual.noise = 0;
2405         range->avg_qual.updated = IW_QUAL_NOISE_INVALID;
2406
2407         range->sensitivity = 0;
2408
2409         range->bitrate[0] =  1000000;
2410         range->bitrate[1] =  2000000;
2411         range->bitrate[2] =  5500000;
2412         range->bitrate[3] = 11000000;
2413         range->num_bitrates = 4;
2414
2415         range->min_rts = 0;
2416         range->max_rts = 2347;
2417         range->min_frag = 256;
2418         range->max_frag = 2346;
2419
2420         range->encoding_size[0] = 5;
2421         range->encoding_size[1] = 13;
2422         range->num_encoding_sizes = 2;
2423         range->max_encoding_tokens = 4;
2424
2425         range->pmp_flags = IW_POWER_ON;
2426         range->pmt_flags = IW_POWER_ON;
2427         range->pm_capa = 0;
2428
2429         range->we_version_source = WIRELESS_EXT;
2430         range->we_version_compiled = WIRELESS_EXT;
2431         range->retry_capa = IW_RETRY_LIMIT ;
2432         range->retry_flags = IW_RETRY_LIMIT;
2433         range->r_time_flags = 0;
2434         range->min_retry = 1;
2435         range->max_retry = 65535;
2436
2437         return 0;
2438 }
2439
2440 static int atmel_set_wap(struct net_device *dev,
2441                          struct iw_request_info *info,
2442                          struct sockaddr *awrq,
2443                          char *extra)
2444 {
2445         struct atmel_private *priv = netdev_priv(dev);
2446         int i;
2447         static const u8 any[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
2448         static const u8 off[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
2449         unsigned long flags;
2450
2451         if (awrq->sa_family != ARPHRD_ETHER)
2452                 return -EINVAL;
2453
2454         if (!memcmp(any, awrq->sa_data, 6) ||
2455             !memcmp(off, awrq->sa_data, 6)) {
2456                 del_timer_sync(&priv->management_timer);
2457                 spin_lock_irqsave(&priv->irqlock, flags);
2458                 atmel_scan(priv, 1);
2459                 spin_unlock_irqrestore(&priv->irqlock, flags);
2460                 return 0;
2461         }
2462
2463         for (i = 0; i < priv->BSS_list_entries; i++) {
2464                 if (memcmp(priv->BSSinfo[i].BSSID, awrq->sa_data, 6) == 0) {
2465                         if (!priv->wep_is_on && priv->BSSinfo[i].UsingWEP) {
2466                                 return -EINVAL;
2467                         } else if  (priv->wep_is_on && !priv->BSSinfo[i].UsingWEP) {
2468                                 return -EINVAL;
2469                         } else {
2470                                 del_timer_sync(&priv->management_timer);
2471                                 spin_lock_irqsave(&priv->irqlock, flags);
2472                                 atmel_join_bss(priv, i);
2473                                 spin_unlock_irqrestore(&priv->irqlock, flags);
2474                                 return 0;
2475                         }
2476                 }
2477         }
2478
2479         return -EINVAL;
2480 }
2481
2482 static int atmel_config_commit(struct net_device *dev,
2483                                struct iw_request_info *info,    /* NULL */
2484                                void *zwrq,                      /* NULL */
2485                                char *extra)                     /* NULL */
2486 {
2487         return atmel_open(dev);
2488 }
2489
2490 static const iw_handler atmel_handler[] =
2491 {
2492         (iw_handler) atmel_config_commit,       /* SIOCSIWCOMMIT */
2493         (iw_handler) atmel_get_name,            /* SIOCGIWNAME */
2494         (iw_handler) NULL,                      /* SIOCSIWNWID */
2495         (iw_handler) NULL,                      /* SIOCGIWNWID */
2496         (iw_handler) atmel_set_freq,            /* SIOCSIWFREQ */
2497         (iw_handler) atmel_get_freq,            /* SIOCGIWFREQ */
2498         (iw_handler) atmel_set_mode,            /* SIOCSIWMODE */
2499         (iw_handler) atmel_get_mode,            /* SIOCGIWMODE */
2500         (iw_handler) NULL,                      /* SIOCSIWSENS */
2501         (iw_handler) NULL,                      /* SIOCGIWSENS */
2502         (iw_handler) NULL,                      /* SIOCSIWRANGE */
2503         (iw_handler) atmel_get_range,           /* SIOCGIWRANGE */
2504         (iw_handler) NULL,                      /* SIOCSIWPRIV */
2505         (iw_handler) NULL,                      /* SIOCGIWPRIV */
2506         (iw_handler) NULL,                      /* SIOCSIWSTATS */
2507         (iw_handler) NULL,                      /* SIOCGIWSTATS */
2508         (iw_handler) NULL,                      /* SIOCSIWSPY */
2509         (iw_handler) NULL,                      /* SIOCGIWSPY */
2510         (iw_handler) NULL,                      /* -- hole -- */
2511         (iw_handler) NULL,                      /* -- hole -- */
2512         (iw_handler) atmel_set_wap,             /* SIOCSIWAP */
2513         (iw_handler) atmel_get_wap,             /* SIOCGIWAP */
2514         (iw_handler) NULL,                      /* -- hole -- */
2515         (iw_handler) NULL,                      /* SIOCGIWAPLIST */
2516         (iw_handler) atmel_set_scan,            /* SIOCSIWSCAN */
2517         (iw_handler) atmel_get_scan,            /* SIOCGIWSCAN */
2518         (iw_handler) atmel_set_essid,           /* SIOCSIWESSID */
2519         (iw_handler) atmel_get_essid,           /* SIOCGIWESSID */
2520         (iw_handler) NULL,                      /* SIOCSIWNICKN */
2521         (iw_handler) NULL,                      /* SIOCGIWNICKN */
2522         (iw_handler) NULL,                      /* -- hole -- */
2523         (iw_handler) NULL,                      /* -- hole -- */
2524         (iw_handler) atmel_set_rate,            /* SIOCSIWRATE */
2525         (iw_handler) atmel_get_rate,            /* SIOCGIWRATE */
2526         (iw_handler) atmel_set_rts,             /* SIOCSIWRTS */
2527         (iw_handler) atmel_get_rts,             /* SIOCGIWRTS */
2528         (iw_handler) atmel_set_frag,            /* SIOCSIWFRAG */
2529         (iw_handler) atmel_get_frag,            /* SIOCGIWFRAG */
2530         (iw_handler) NULL,                      /* SIOCSIWTXPOW */
2531         (iw_handler) NULL,                      /* SIOCGIWTXPOW */
2532         (iw_handler) atmel_set_retry,           /* SIOCSIWRETRY */
2533         (iw_handler) atmel_get_retry,           /* SIOCGIWRETRY */
2534         (iw_handler) atmel_set_encode,          /* SIOCSIWENCODE */
2535         (iw_handler) atmel_get_encode,          /* SIOCGIWENCODE */
2536         (iw_handler) atmel_set_power,           /* SIOCSIWPOWER */
2537         (iw_handler) atmel_get_power,           /* SIOCGIWPOWER */
2538         (iw_handler) NULL,                      /* -- hole -- */
2539         (iw_handler) NULL,                      /* -- hole -- */
2540         (iw_handler) NULL,                      /* SIOCSIWGENIE */
2541         (iw_handler) NULL,                      /* SIOCGIWGENIE */
2542         (iw_handler) atmel_set_auth,            /* SIOCSIWAUTH */
2543         (iw_handler) atmel_get_auth,            /* SIOCGIWAUTH */
2544         (iw_handler) atmel_set_encodeext,       /* SIOCSIWENCODEEXT */
2545         (iw_handler) atmel_get_encodeext,       /* SIOCGIWENCODEEXT */
2546         (iw_handler) NULL,                      /* SIOCSIWPMKSA */
2547 };
2548
2549 static const iw_handler atmel_private_handler[] =
2550 {
2551         NULL,                           /* SIOCIWFIRSTPRIV */
2552 };
2553
2554 typedef struct atmel_priv_ioctl {
2555         char id[32];
2556         unsigned char __user *data;
2557         unsigned short len;
2558 } atmel_priv_ioctl;
2559
2560 #define ATMELFWL        SIOCIWFIRSTPRIV
2561 #define ATMELIDIFC      ATMELFWL + 1
2562 #define ATMELRD         ATMELFWL + 2
2563 #define ATMELMAGIC 0x51807
2564 #define REGDOMAINSZ 20
2565
2566 static const struct iw_priv_args atmel_private_args[] = {
2567         {
2568                 .cmd = ATMELFWL,
2569                 .set_args = IW_PRIV_TYPE_BYTE
2570                                 | IW_PRIV_SIZE_FIXED
2571                                 | sizeof (atmel_priv_ioctl),
2572                 .get_args = IW_PRIV_TYPE_NONE,
2573                 .name = "atmelfwl"
2574         }, {
2575                 .cmd = ATMELIDIFC,
2576                 .set_args = IW_PRIV_TYPE_NONE,
2577                 .get_args = IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
2578                 .name = "atmelidifc"
2579         }, {
2580                 .cmd = ATMELRD,
2581                 .set_args = IW_PRIV_TYPE_CHAR | REGDOMAINSZ,
2582                 .get_args = IW_PRIV_TYPE_NONE,
2583                 .name = "regdomain"
2584         },
2585 };
2586
2587 static const struct iw_handler_def atmel_handler_def =
2588 {
2589         .num_standard   = ARRAY_SIZE(atmel_handler),
2590         .num_private    = ARRAY_SIZE(atmel_private_handler),
2591         .num_private_args = ARRAY_SIZE(atmel_private_args),
2592         .standard       = (iw_handler *) atmel_handler,
2593         .private        = (iw_handler *) atmel_private_handler,
2594         .private_args   = (struct iw_priv_args *) atmel_private_args,
2595         .get_wireless_stats = atmel_get_wireless_stats
2596 };
2597
2598 static int atmel_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
2599 {
2600         int i, rc = 0;
2601         struct atmel_private *priv = netdev_priv(dev);
2602         atmel_priv_ioctl com;
2603         struct iwreq *wrq = (struct iwreq *) rq;
2604         unsigned char *new_firmware;
2605         char domain[REGDOMAINSZ + 1];
2606
2607         switch (cmd) {
2608         case ATMELIDIFC:
2609                 wrq->u.param.value = ATMELMAGIC;
2610                 break;
2611
2612         case ATMELFWL:
2613                 if (copy_from_user(&com, rq->ifr_data, sizeof(com))) {
2614                         rc = -EFAULT;
2615                         break;
2616                 }
2617
2618                 if (!capable(CAP_NET_ADMIN)) {
2619                         rc = -EPERM;
2620                         break;
2621                 }
2622
2623                 if (!(new_firmware = kmalloc(com.len, GFP_KERNEL))) {
2624                         rc = -ENOMEM;
2625                         break;
2626                 }
2627
2628                 if (copy_from_user(new_firmware, com.data, com.len)) {
2629                         kfree(new_firmware);
2630                         rc = -EFAULT;
2631                         break;
2632                 }
2633
2634                 kfree(priv->firmware);
2635
2636                 priv->firmware = new_firmware;
2637                 priv->firmware_length = com.len;
2638                 strncpy(priv->firmware_id, com.id, 31);
2639                 priv->firmware_id[31] = '\0';
2640                 break;
2641
2642         case ATMELRD:
2643                 if (copy_from_user(domain, rq->ifr_data, REGDOMAINSZ)) {
2644                         rc = -EFAULT;
2645                         break;
2646                 }
2647
2648                 if (!capable(CAP_NET_ADMIN)) {
2649                         rc = -EPERM;
2650                         break;
2651                 }
2652
2653                 domain[REGDOMAINSZ] = 0;
2654                 rc = -EINVAL;
2655                 for (i = 0; i < ARRAY_SIZE(channel_table); i++) {
2656                         /* strcasecmp doesn't exist in the library */
2657                         char *a = channel_table[i].name;
2658                         char *b = domain;
2659                         while (*a) {
2660                                 char c1 = *a++;
2661                                 char c2 = *b++;
2662                                 if (tolower(c1) != tolower(c2))
2663                                         break;
2664                         }
2665                         if (!*a && !*b) {
2666                                 priv->config_reg_domain = channel_table[i].reg_domain;
2667                                 rc = 0;
2668                         }
2669                 }
2670
2671                 if (rc == 0 &&  priv->station_state != STATION_STATE_DOWN)
2672                         rc = atmel_open(dev);
2673                 break;
2674
2675         default:
2676                 rc = -EOPNOTSUPP;
2677         }
2678
2679         return rc;
2680 }
2681
2682 struct auth_body {
2683         u16 alg;
2684         u16 trans_seq;
2685         u16 status;
2686         u8 el_id;
2687         u8 chall_text_len;
2688         u8 chall_text[253];
2689 };
2690
2691 static void atmel_enter_state(struct atmel_private *priv, int new_state)
2692 {
2693         int old_state = priv->station_state;
2694
2695         if (new_state == old_state)
2696                 return;
2697
2698         priv->station_state = new_state;
2699
2700         if (new_state == STATION_STATE_READY) {
2701                 netif_start_queue(priv->dev);
2702                 netif_carrier_on(priv->dev);
2703         }
2704
2705         if (old_state == STATION_STATE_READY) {
2706                 netif_carrier_off(priv->dev);
2707                 if (netif_running(priv->dev))
2708                         netif_stop_queue(priv->dev);
2709                 priv->last_beacon_timestamp = 0;
2710         }
2711 }
2712
2713 static void atmel_scan(struct atmel_private *priv, int specific_ssid)
2714 {
2715         struct {
2716                 u8 BSSID[6];
2717                 u8 SSID[MAX_SSID_LENGTH];
2718                 u8 scan_type;
2719                 u8 channel;
2720                 u16 BSS_type;
2721                 u16 min_channel_time;
2722                 u16 max_channel_time;
2723                 u8 options;
2724                 u8 SSID_size;
2725         } cmd;
2726
2727         memset(cmd.BSSID, 0xff, 6);
2728
2729         if (priv->fast_scan) {
2730                 cmd.SSID_size = priv->SSID_size;
2731                 memcpy(cmd.SSID, priv->SSID, priv->SSID_size);
2732                 cmd.min_channel_time = cpu_to_le16(10);
2733                 cmd.max_channel_time = cpu_to_le16(50);
2734         } else {
2735                 priv->BSS_list_entries = 0;
2736                 cmd.SSID_size = 0;
2737                 cmd.min_channel_time = cpu_to_le16(10);
2738                 cmd.max_channel_time = cpu_to_le16(120);
2739         }
2740
2741         cmd.options = 0;
2742
2743         if (!specific_ssid)
2744                 cmd.options |= SCAN_OPTIONS_SITE_SURVEY;
2745
2746         cmd.channel = (priv->channel & 0x7f);
2747         cmd.scan_type = SCAN_TYPE_ACTIVE;
2748         cmd.BSS_type = cpu_to_le16(priv->operating_mode == IW_MODE_ADHOC ?
2749                 BSS_TYPE_AD_HOC : BSS_TYPE_INFRASTRUCTURE);
2750
2751         atmel_send_command(priv, CMD_Scan, &cmd, sizeof(cmd));
2752
2753         /* This must come after all hardware access to avoid being messed up
2754            by stuff happening in interrupt context after we leave STATE_DOWN */
2755         atmel_enter_state(priv, STATION_STATE_SCANNING);
2756 }
2757
2758 static void join(struct atmel_private *priv, int type)
2759 {
2760         struct {
2761                 u8 BSSID[6];
2762                 u8 SSID[MAX_SSID_LENGTH];
2763                 u8 BSS_type; /* this is a short in a scan command - weird */
2764                 u8 channel;
2765                 u16 timeout;
2766                 u8 SSID_size;
2767                 u8 reserved;
2768         } cmd;
2769
2770         cmd.SSID_size = priv->SSID_size;
2771         memcpy(cmd.SSID, priv->SSID, priv->SSID_size);
2772         memcpy(cmd.BSSID, priv->CurrentBSSID, 6);
2773         cmd.channel = (priv->channel & 0x7f);
2774         cmd.BSS_type = type;
2775         cmd.timeout = cpu_to_le16(2000);
2776
2777         atmel_send_command(priv, CMD_Join, &cmd, sizeof(cmd));
2778 }
2779
2780 static void start(struct atmel_private *priv, int type)
2781 {
2782         struct {
2783                 u8 BSSID[6];
2784                 u8 SSID[MAX_SSID_LENGTH];
2785                 u8 BSS_type;
2786                 u8 channel;
2787                 u8 SSID_size;
2788                 u8 reserved[3];
2789         } cmd;
2790
2791         cmd.SSID_size = priv->SSID_size;
2792         memcpy(cmd.SSID, priv->SSID, priv->SSID_size);
2793         memcpy(cmd.BSSID, priv->BSSID, 6);
2794         cmd.BSS_type = type;
2795         cmd.channel = (priv->channel & 0x7f);
2796
2797         atmel_send_command(priv, CMD_Start, &cmd, sizeof(cmd));
2798 }
2799
2800 static void handle_beacon_probe(struct atmel_private *priv, u16 capability,
2801                                 u8 channel)
2802 {
2803         int rejoin = 0;
2804         int new = capability & MFIE_TYPE_POWER_CONSTRAINT ?
2805                 SHORT_PREAMBLE : LONG_PREAMBLE;
2806
2807         if (priv->preamble != new) {
2808                 priv->preamble = new;
2809                 rejoin = 1;
2810                 atmel_set_mib8(priv, Local_Mib_Type, LOCAL_MIB_PREAMBLE_TYPE, new);
2811         }
2812
2813         if (priv->channel != channel) {
2814                 priv->channel = channel;
2815                 rejoin = 1;
2816                 atmel_set_mib8(priv, Phy_Mib_Type, PHY_MIB_CHANNEL_POS, channel);
2817         }
2818
2819         if (rejoin) {
2820                 priv->station_is_associated = 0;
2821                 atmel_enter_state(priv, STATION_STATE_JOINNING);
2822
2823                 if (priv->operating_mode == IW_MODE_INFRA)
2824                         join(priv, BSS_TYPE_INFRASTRUCTURE);
2825                 else
2826                         join(priv, BSS_TYPE_AD_HOC);
2827         }
2828 }
2829
2830 static void send_authentication_request(struct atmel_private *priv, u16 system,
2831                                         u8 *challenge, int challenge_len)
2832 {
2833         struct ieee80211_hdr_4addr header;
2834         struct auth_body auth;
2835
2836         header.frame_ctl = cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_AUTH);
2837         header.duration_id = cpu_to_le16(0x8000);
2838         header.seq_ctl = 0;
2839         memcpy(header.addr1, priv->CurrentBSSID, 6);
2840         memcpy(header.addr2, priv->dev->dev_addr, 6);
2841         memcpy(header.addr3, priv->CurrentBSSID, 6);
2842
2843         if (priv->wep_is_on && priv->CurrentAuthentTransactionSeqNum != 1)
2844                 /* no WEP for authentication frames with TrSeqNo 1 */
2845                 header.frame_ctl |=  cpu_to_le16(IEEE80211_FCTL_PROTECTED);
2846
2847         auth.alg = cpu_to_le16(system);
2848
2849         auth.status = 0;
2850         auth.trans_seq = cpu_to_le16(priv->CurrentAuthentTransactionSeqNum);
2851         priv->ExpectedAuthentTransactionSeqNum = priv->CurrentAuthentTransactionSeqNum+1;
2852         priv->CurrentAuthentTransactionSeqNum += 2;
2853
2854         if (challenge_len != 0) {
2855                 auth.el_id = 16; /* challenge_text */
2856                 auth.chall_text_len = challenge_len;
2857                 memcpy(auth.chall_text, challenge, challenge_len);
2858                 atmel_transmit_management_frame(priv, &header, (u8 *)&auth, 8 + challenge_len);
2859         } else {
2860                 atmel_transmit_management_frame(priv, &header, (u8 *)&auth, 6);
2861         }
2862 }
2863
2864 static void send_association_request(struct atmel_private *priv, int is_reassoc)
2865 {
2866         u8 *ssid_el_p;
2867         int bodysize;
2868         struct ieee80211_hdr_4addr header;
2869         struct ass_req_format {
2870                 u16 capability;
2871                 u16 listen_interval;
2872                 u8 ap[6]; /* nothing after here directly accessible */
2873                 u8 ssid_el_id;
2874                 u8 ssid_len;
2875                 u8 ssid[MAX_SSID_LENGTH];
2876                 u8 sup_rates_el_id;
2877                 u8 sup_rates_len;
2878                 u8 rates[4];
2879         } body;
2880
2881         header.frame_ctl = cpu_to_le16(IEEE80211_FTYPE_MGMT |
2882                 (is_reassoc ? IEEE80211_STYPE_REASSOC_REQ : IEEE80211_STYPE_ASSOC_REQ));
2883         header.duration_id = cpu_to_le16(0x8000);
2884         header.seq_ctl = 0;
2885
2886         memcpy(header.addr1, priv->CurrentBSSID, 6);
2887         memcpy(header.addr2, priv->dev->dev_addr, 6);
2888         memcpy(header.addr3, priv->CurrentBSSID, 6);
2889
2890         body.capability = cpu_to_le16(WLAN_CAPABILITY_ESS);
2891         if (priv->wep_is_on)
2892                 body.capability |= cpu_to_le16(WLAN_CAPABILITY_PRIVACY);
2893         if (priv->preamble == SHORT_PREAMBLE)
2894                 body.capability |= cpu_to_le16(MFIE_TYPE_POWER_CONSTRAINT);
2895
2896         body.listen_interval = cpu_to_le16(priv->listen_interval * priv->beacon_period);
2897
2898         /* current AP address - only in reassoc frame */
2899         if (is_reassoc) {
2900                 memcpy(body.ap, priv->CurrentBSSID, 6);
2901                 ssid_el_p = (u8 *)&body.ssid_el_id;
2902                 bodysize = 18 + priv->SSID_size;
2903         } else {
2904                 ssid_el_p = (u8 *)&body.ap[0];
2905                 bodysize = 12 + priv->SSID_size;
2906         }
2907
2908         ssid_el_p[0] = MFIE_TYPE_SSID;
2909         ssid_el_p[1] = priv->SSID_size;
2910         memcpy(ssid_el_p + 2, priv->SSID, priv->SSID_size);
2911         ssid_el_p[2 + priv->SSID_size] = MFIE_TYPE_RATES;
2912         ssid_el_p[3 + priv->SSID_size] = 4; /* len of suported rates */
2913         memcpy(ssid_el_p + 4 + priv->SSID_size, atmel_basic_rates, 4);
2914
2915         atmel_transmit_management_frame(priv, &header, (void *)&body, bodysize);
2916 }
2917
2918 static int is_frame_from_current_bss(struct atmel_private *priv,
2919                                      struct ieee80211_hdr_4addr *header)
2920 {
2921         if (le16_to_cpu(header->frame_ctl) & IEEE80211_FCTL_FROMDS)
2922                 return memcmp(header->addr3, priv->CurrentBSSID, 6) == 0;
2923         else
2924                 return memcmp(header->addr2, priv->CurrentBSSID, 6) == 0;
2925 }
2926
2927 static int retrieve_bss(struct atmel_private *priv)
2928 {
2929         int i;
2930         int max_rssi = -128;
2931         int max_index = -1;
2932
2933         if (priv->BSS_list_entries == 0)
2934                 return -1;
2935
2936         if (priv->connect_to_any_BSS) {
2937                 /* Select a BSS with the max-RSSI but of the same type and of
2938                    the same WEP mode and that it is not marked as 'bad' (i.e.
2939                    we had previously failed to connect to this BSS with the
2940                    settings that we currently use) */
2941                 priv->current_BSS = 0;
2942                 for (i = 0; i < priv->BSS_list_entries; i++) {
2943                         if (priv->operating_mode == priv->BSSinfo[i].BSStype &&
2944                             ((!priv->wep_is_on && !priv->BSSinfo[i].UsingWEP) ||
2945                              (priv->wep_is_on && priv->BSSinfo[i].UsingWEP)) &&
2946                             !(priv->BSSinfo[i].channel & 0x80)) {
2947                                 max_rssi = priv->BSSinfo[i].RSSI;
2948                                 priv->current_BSS = max_index = i;
2949                         }
2950                 }
2951                 return max_index;
2952         }
2953
2954         for (i = 0; i < priv->BSS_list_entries; i++) {
2955                 if (priv->SSID_size == priv->BSSinfo[i].SSIDsize &&
2956                     memcmp(priv->SSID, priv->BSSinfo[i].SSID, priv->SSID_size) == 0 &&
2957                     priv->operating_mode == priv->BSSinfo[i].BSStype &&
2958                     atmel_validate_channel(priv, priv->BSSinfo[i].channel) == 0) {
2959                         if (priv->BSSinfo[i].RSSI >= max_rssi) {
2960                                 max_rssi = priv->BSSinfo[i].RSSI;
2961                                 max_index = i;
2962                         }
2963                 }
2964         }
2965         return max_index;
2966 }
2967
2968 static void store_bss_info(struct atmel_private *priv,
2969                            struct ieee80211_hdr_4addr *header, u16 capability,
2970                            u16 beacon_period, u8 channel, u8 rssi, u8 ssid_len,
2971                            u8 *ssid, int is_beacon)
2972 {
2973         u8 *bss = capability & WLAN_CAPABILITY_ESS ? header->addr2 : header->addr3;
2974         int i, index;
2975
2976         for (index = -1, i = 0; i < priv->BSS_list_entries; i++)
2977                 if (memcmp(bss, priv->BSSinfo[i].BSSID, 6) == 0)
2978                         index = i;
2979
2980         /* If we process a probe and an entry from this BSS exists
2981            we will update the BSS entry with the info from this BSS.
2982            If we process a beacon we will only update RSSI */
2983
2984         if (index == -1) {
2985                 if (priv->BSS_list_entries == MAX_BSS_ENTRIES)
2986                         return;
2987                 index = priv->BSS_list_entries++;
2988                 memcpy(priv->BSSinfo[index].BSSID, bss, 6);
2989                 priv->BSSinfo[index].RSSI = rssi;
2990         } else {
2991                 if (rssi > priv->BSSinfo[index].RSSI)
2992                         priv->BSSinfo[index].RSSI = rssi;
2993                 if (is_beacon)
2994                         return;
2995         }
2996
2997         priv->BSSinfo[index].channel = channel;
2998         priv->BSSinfo[index].beacon_period = beacon_period;
2999         priv->BSSinfo[index].UsingWEP = capability & WLAN_CAPABILITY_PRIVACY;
3000         memcpy(priv->BSSinfo[index].SSID, ssid, ssid_len);
3001         priv->BSSinfo[index].SSIDsize = ssid_len;
3002
3003         if (capability & WLAN_CAPABILITY_IBSS)
3004                 priv->BSSinfo[index].BSStype = IW_MODE_ADHOC;
3005         else if (capability & WLAN_CAPABILITY_ESS)
3006                 priv->BSSinfo[index].BSStype =IW_MODE_INFRA;
3007
3008         priv->BSSinfo[index].preamble = capability & MFIE_TYPE_POWER_CONSTRAINT ?
3009                 SHORT_PREAMBLE : LONG_PREAMBLE;
3010 }
3011
3012 static void authenticate(struct atmel_private *priv, u16 frame_len)
3013 {
3014         struct auth_body *auth = (struct auth_body *)priv->rx_buf;
3015         u16 status = le16_to_cpu(auth->status);
3016         u16 trans_seq_no = le16_to_cpu(auth->trans_seq);
3017         u16 system = le16_to_cpu(auth->alg);
3018
3019         if (status == WLAN_STATUS_SUCCESS && !priv->wep_is_on) {
3020                 /* no WEP */
3021                 if (priv->station_was_associated) {
3022                         atmel_enter_state(priv, STATION_STATE_REASSOCIATING);
3023                         send_association_request(priv, 1);
3024                         return;
3025                 } else {
3026                         atmel_enter_state(priv, STATION_STATE_ASSOCIATING);
3027                         send_association_request(priv, 0);
3028                         return;
3029                 }
3030         }
3031
3032         if (status == WLAN_STATUS_SUCCESS && priv->wep_is_on) {
3033                 int should_associate = 0;
3034                 /* WEP */
3035                 if (trans_seq_no != priv->ExpectedAuthentTransactionSeqNum)
3036                         return;
3037
3038                 if (system == WLAN_AUTH_OPEN) {
3039                         if (trans_seq_no == 0x0002) {
3040                                 should_associate = 1;
3041                         }
3042                 } else if (system == WLAN_AUTH_SHARED_KEY) {
3043                         if (trans_seq_no == 0x0002 &&
3044                             auth->el_id == MFIE_TYPE_CHALLENGE) {
3045                                 send_authentication_request(priv, system, auth->chall_text, auth->chall_text_len);
3046                                 return;
3047                         } else if (trans_seq_no == 0x0004) {
3048                                 should_associate = 1;
3049                         }
3050                 }
3051
3052                 if (should_associate) {
3053                         if(priv->station_was_associated) {
3054                                 atmel_enter_state(priv, STATION_STATE_REASSOCIATING);
3055                                 send_association_request(priv, 1);
3056                                 return;
3057                         } else {
3058                                 atmel_enter_state(priv, STATION_STATE_ASSOCIATING);
3059                                 send_association_request(priv, 0);
3060                                 return;
3061                         }
3062                 }
3063         }
3064
3065         if (status == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) {
3066                 /* Do opensystem first, then try sharedkey */
3067                 if (system == WLAN_AUTH_OPEN) {
3068                         priv->CurrentAuthentTransactionSeqNum = 0x001;
3069                         priv->exclude_unencrypted = 1;
3070                         send_authentication_request(priv, WLAN_AUTH_SHARED_KEY, NULL, 0);
3071                         return;
3072                 } else if (priv->connect_to_any_BSS) {
3073                         int bss_index;
3074
3075                         priv->BSSinfo[(int)(priv->current_BSS)].channel |= 0x80;
3076
3077                         if ((bss_index  = retrieve_bss(priv)) != -1) {
3078                                 atmel_join_bss(priv, bss_index);
3079                                 return;
3080                         }
3081                 }
3082         }
3083
3084         priv->AuthenticationRequestRetryCnt = 0;
3085         atmel_enter_state(priv,  STATION_STATE_MGMT_ERROR);
3086         priv->station_is_associated = 0;
3087 }
3088
3089 static void associate(struct atmel_private *priv, u16 frame_len, u16 subtype)
3090 {
3091         struct ass_resp_format {
3092                 u16 capability;
3093                 u16 status;
3094                 u16 ass_id;
3095                 u8 el_id;
3096                 u8 length;
3097                 u8 rates[4];
3098         } *ass_resp = (struct ass_resp_format *)priv->rx_buf;
3099
3100         u16 status = le16_to_cpu(ass_resp->status);
3101         u16 ass_id = le16_to_cpu(ass_resp->ass_id);
3102         u16 rates_len = ass_resp->length > 4 ? 4 : ass_resp->length;
3103
3104         union iwreq_data wrqu;
3105
3106         if (frame_len < 8 + rates_len)
3107                 return;
3108
3109         if (status == WLAN_STATUS_SUCCESS) {
3110                 if (subtype == IEEE80211_STYPE_ASSOC_RESP)
3111                         priv->AssociationRequestRetryCnt = 0;
3112                 else
3113                         priv->ReAssociationRequestRetryCnt = 0;
3114
3115                 atmel_set_mib16(priv, Mac_Mgmt_Mib_Type,
3116                                 MAC_MGMT_MIB_STATION_ID_POS, ass_id & 0x3fff);
3117                 atmel_set_mib(priv, Phy_Mib_Type,
3118                               PHY_MIB_RATE_SET_POS, ass_resp->rates, rates_len);
3119                 if (priv->power_mode == 0) {
3120                         priv->listen_interval = 1;
3121                         atmel_set_mib8(priv, Mac_Mgmt_Mib_Type,
3122                                        MAC_MGMT_MIB_PS_MODE_POS, ACTIVE_MODE);
3123                         atmel_set_mib16(priv, Mac_Mgmt_Mib_Type,
3124                                         MAC_MGMT_MIB_LISTEN_INTERVAL_POS, 1);
3125                 } else {
3126                         priv->listen_interval = 2;
3127                         atmel_set_mib8(priv, Mac_Mgmt_Mib_Type,
3128                                        MAC_MGMT_MIB_PS_MODE_POS,  PS_MODE);
3129                         atmel_set_mib16(priv, Mac_Mgmt_Mib_Type,
3130                                         MAC_MGMT_MIB_LISTEN_INTERVAL_POS, 2);
3131                 }
3132
3133                 priv->station_is_associated = 1;
3134                 priv->station_was_associated = 1;
3135                 atmel_enter_state(priv, STATION_STATE_READY);
3136
3137                 /* Send association event to userspace */
3138                 wrqu.data.length = 0;
3139                 wrqu.data.flags = 0;
3140                 memcpy(wrqu.ap_addr.sa_data, priv->CurrentBSSID, ETH_ALEN);
3141                 wrqu.ap_addr.sa_family = ARPHRD_ETHER;
3142                 wireless_send_event(priv->dev, SIOCGIWAP, &wrqu, NULL);
3143
3144                 return;
3145         }
3146
3147         if (subtype == IEEE80211_STYPE_ASSOC_RESP &&
3148             status != WLAN_STATUS_ASSOC_DENIED_RATES &&
3149             status != WLAN_STATUS_CAPS_UNSUPPORTED &&
3150             priv->AssociationRequestRetryCnt < MAX_ASSOCIATION_RETRIES) {
3151                 mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
3152                 priv->AssociationRequestRetryCnt++;
3153                 send_association_request(priv, 0);
3154                 return;
3155         }
3156
3157         if (subtype == IEEE80211_STYPE_REASSOC_RESP &&
3158             status != WLAN_STATUS_ASSOC_DENIED_RATES &&
3159             status != WLAN_STATUS_CAPS_UNSUPPORTED &&
3160             priv->AssociationRequestRetryCnt < MAX_ASSOCIATION_RETRIES) {
3161                 mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
3162                 priv->ReAssociationRequestRetryCnt++;
3163                 send_association_request(priv, 1);
3164                 return;
3165         }
3166
3167         atmel_enter_state(priv,  STATION_STATE_MGMT_ERROR);
3168         priv->station_is_associated = 0;
3169
3170         if (priv->connect_to_any_BSS) {
3171                 int bss_index;
3172                 priv->BSSinfo[(int)(priv->current_BSS)].channel |= 0x80;
3173
3174                 if ((bss_index = retrieve_bss(priv)) != -1)
3175                         atmel_join_bss(priv, bss_index);
3176         }
3177 }
3178
3179 void atmel_join_bss(struct atmel_private *priv, int bss_index)
3180 {
3181         struct bss_info *bss =  &priv->BSSinfo[bss_index];
3182
3183         memcpy(priv->CurrentBSSID, bss->BSSID, 6);
3184         memcpy(priv->SSID, bss->SSID, priv->SSID_size = bss->SSIDsize);
3185
3186         /* The WPA stuff cares about the current AP address */
3187         if (priv->use_wpa)
3188                 build_wpa_mib(priv);
3189
3190         /* When switching to AdHoc turn OFF Power Save if needed */
3191
3192         if (bss->BSStype == IW_MODE_ADHOC &&
3193             priv->operating_mode != IW_MODE_ADHOC &&
3194             priv->power_mode) {
3195                 priv->power_mode = 0;
3196                 priv->listen_interval = 1;
3197                 atmel_set_mib8(priv, Mac_Mgmt_Mib_Type,
3198                                MAC_MGMT_MIB_PS_MODE_POS,  ACTIVE_MODE);
3199                 atmel_set_mib16(priv, Mac_Mgmt_Mib_Type,
3200                                 MAC_MGMT_MIB_LISTEN_INTERVAL_POS, 1);
3201         }
3202
3203         priv->operating_mode = bss->BSStype;
3204         priv->channel = bss->channel & 0x7f;
3205         priv->beacon_period = bss->beacon_period;
3206
3207         if (priv->preamble != bss->preamble) {
3208                 priv->preamble = bss->preamble;
3209                 atmel_set_mib8(priv, Local_Mib_Type,
3210                                LOCAL_MIB_PREAMBLE_TYPE, bss->preamble);
3211         }
3212
3213         if (!priv->wep_is_on && bss->UsingWEP) {
3214                 atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
3215                 priv->station_is_associated = 0;
3216                 return;
3217         }
3218
3219         if (priv->wep_is_on && !bss->UsingWEP) {
3220                 atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
3221                 priv->station_is_associated = 0;
3222                 return;
3223         }
3224
3225         atmel_enter_state(priv, STATION_STATE_JOINNING);
3226
3227         if (priv->operating_mode == IW_MODE_INFRA)
3228                 join(priv, BSS_TYPE_INFRASTRUCTURE);
3229         else
3230                 join(priv, BSS_TYPE_AD_HOC);
3231 }
3232
3233 static void restart_search(struct atmel_private *priv)
3234 {
3235         int bss_index;
3236
3237         if (!priv->connect_to_any_BSS) {
3238                 atmel_scan(priv, 1);
3239         } else {
3240                 priv->BSSinfo[(int)(priv->current_BSS)].channel |= 0x80;
3241
3242                 if ((bss_index = retrieve_bss(priv)) != -1)
3243                         atmel_join_bss(priv, bss_index);
3244                 else
3245                         atmel_scan(priv, 0);
3246         }
3247 }
3248
3249 static void smooth_rssi(struct atmel_private *priv, u8 rssi)
3250 {
3251         u8 old = priv->wstats.qual.level;
3252         u8 max_rssi = 42; /* 502-rmfd-revd max by experiment, default for now */
3253
3254         switch (priv->firmware_type) {
3255                 case ATMEL_FW_TYPE_502E:
3256                         max_rssi = 63; /* 502-rmfd-reve max by experiment */
3257                         break;
3258                 default:
3259                         break;
3260         }
3261
3262         rssi = rssi * 100 / max_rssi;
3263         if ((rssi + old) % 2)
3264                 priv->wstats.qual.level = (rssi + old) / 2 + 1;
3265         else
3266                 priv->wstats.qual.level = (rssi + old) / 2;
3267         priv->wstats.qual.updated |= IW_QUAL_LEVEL_UPDATED;
3268         priv->wstats.qual.updated &= ~IW_QUAL_LEVEL_INVALID;
3269 }
3270
3271 static void atmel_smooth_qual(struct atmel_private *priv)
3272 {
3273         unsigned long time_diff = (jiffies - priv->last_qual) / HZ;
3274         while (time_diff--) {
3275                 priv->last_qual += HZ;
3276                 priv->wstats.qual.qual = priv->wstats.qual.qual / 2;
3277                 priv->wstats.qual.qual +=
3278                         priv->beacons_this_sec * priv->beacon_period * (priv->wstats.qual.level + 100) / 4000;
3279                 priv->beacons_this_sec = 0;
3280         }
3281         priv->wstats.qual.updated |= IW_QUAL_QUAL_UPDATED;
3282         priv->wstats.qual.updated &= ~IW_QUAL_QUAL_INVALID;
3283 }
3284
3285 /* deals with incoming managment frames. */
3286 static void atmel_management_frame(struct atmel_private *priv,
3287                                    struct ieee80211_hdr_4addr *header,
3288                                    u16 frame_len, u8 rssi)
3289 {
3290         u16 subtype;
3291
3292         subtype = le16_to_cpu(header->frame_ctl) & IEEE80211_FCTL_STYPE;
3293         switch (subtype) {
3294         case IEEE80211_STYPE_BEACON:
3295         case IEEE80211_STYPE_PROBE_RESP:
3296
3297                 /* beacon frame has multiple variable-length fields -
3298                    never let an engineer loose with a data structure design. */
3299                 {
3300                         struct beacon_format {
3301                                 u64 timestamp;
3302                                 u16 interval;
3303                                 u16 capability;
3304                                 u8 ssid_el_id;
3305                                 u8 ssid_length;
3306                                 /* ssid here */
3307                                 u8 rates_el_id;
3308                                 u8 rates_length;
3309                                 /* rates here */
3310                                 u8 ds_el_id;
3311                                 u8 ds_length;
3312                                 /* ds here */
3313                         } *beacon = (struct beacon_format *)priv->rx_buf;
3314
3315                         u8 channel, rates_length, ssid_length;
3316                         u64 timestamp = le64_to_cpu(beacon->timestamp);
3317                         u16 beacon_interval = le16_to_cpu(beacon->interval);
3318                         u16 capability = le16_to_cpu(beacon->capability);
3319                         u8 *beaconp = priv->rx_buf;
3320                         ssid_length = beacon->ssid_length;
3321                         /* this blows chunks. */
3322                         if (frame_len < 14 || frame_len < ssid_length + 15)
3323                                 return;
3324                         rates_length = beaconp[beacon->ssid_length + 15];
3325                         if (frame_len < ssid_length + rates_length + 18)
3326                                 return;
3327                         if (ssid_length >  MAX_SSID_LENGTH)
3328                                 return;
3329                         channel = beaconp[ssid_length + rates_length + 18];
3330
3331                         if (priv->station_state == STATION_STATE_READY) {
3332                                 smooth_rssi(priv, rssi);
3333                                 if (is_frame_from_current_bss(priv, header)) {
3334                                         priv->beacons_this_sec++;
3335                                         atmel_smooth_qual(priv);
3336                                         if (priv->last_beacon_timestamp) {
3337                                                 /* Note truncate this to 32 bits - kernel can't divide a long long */
3338                                                 u32 beacon_delay = timestamp - priv->last_beacon_timestamp;
3339                                                 int beacons = beacon_delay / (beacon_interval * 1000);
3340                                                 if (beacons > 1)
3341                                                         priv->wstats.miss.beacon += beacons - 1;
3342                                         }
3343                                         priv->last_beacon_timestamp = timestamp;
3344                                         handle_beacon_probe(priv, capability, channel);
3345                                 }
3346                         }
3347
3348                         if (priv->station_state == STATION_STATE_SCANNING)
3349                                 store_bss_info(priv, header, capability,
3350                                                beacon_interval, channel, rssi,
3351                                                ssid_length,
3352                                                &beacon->rates_el_id,
3353                                                subtype == IEEE80211_STYPE_BEACON);
3354                 }
3355                 break;
3356
3357         case IEEE80211_STYPE_AUTH:
3358
3359                 if (priv->station_state == STATION_STATE_AUTHENTICATING)
3360                         authenticate(priv, frame_len);
3361
3362                 break;
3363
3364         case IEEE80211_STYPE_ASSOC_RESP:
3365         case IEEE80211_STYPE_REASSOC_RESP:
3366
3367                 if (priv->station_state == STATION_STATE_ASSOCIATING ||
3368                     priv->station_state == STATION_STATE_REASSOCIATING)
3369                         associate(priv, frame_len, subtype);
3370
3371                 break;
3372
3373         case IEEE80211_STYPE_DISASSOC:
3374                 if (priv->station_is_associated &&
3375                     priv->operating_mode == IW_MODE_INFRA &&
3376                     is_frame_from_current_bss(priv, header)) {
3377                         priv->station_was_associated = 0;
3378                         priv->station_is_associated = 0;
3379
3380                         atmel_enter_state(priv, STATION_STATE_JOINNING);
3381                         join(priv, BSS_TYPE_INFRASTRUCTURE);
3382                 }
3383
3384                 break;
3385
3386         case IEEE80211_STYPE_DEAUTH:
3387                 if (priv->operating_mode == IW_MODE_INFRA &&
3388                     is_frame_from_current_bss(priv, header)) {
3389                         priv->station_was_associated = 0;
3390
3391                         atmel_enter_state(priv, STATION_STATE_JOINNING);
3392                         join(priv, BSS_TYPE_INFRASTRUCTURE);
3393                 }
3394
3395                 break;
3396         }
3397 }
3398
3399 /* run when timer expires */
3400 static void atmel_management_timer(u_long a)
3401 {
3402         struct net_device *dev = (struct net_device *) a;
3403         struct atmel_private *priv = netdev_priv(dev);
3404         unsigned long flags;
3405
3406         /* Check if the card has been yanked. */
3407         if (priv->card && priv->present_callback &&
3408                 !(*priv->present_callback)(priv->card))
3409                 return;
3410
3411         spin_lock_irqsave(&priv->irqlock, flags);
3412
3413         switch (priv->station_state) {
3414
3415         case STATION_STATE_AUTHENTICATING:
3416                 if (priv->AuthenticationRequestRetryCnt >= MAX_AUTHENTICATION_RETRIES) {
3417                         atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
3418                         priv->station_is_associated = 0;
3419                         priv->AuthenticationRequestRetryCnt = 0;
3420                         restart_search(priv);
3421                 } else {
3422                         int auth = WLAN_AUTH_OPEN;
3423                         priv->AuthenticationRequestRetryCnt++;
3424                         priv->CurrentAuthentTransactionSeqNum = 0x0001;
3425                         mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
3426                         if (priv->wep_is_on && priv->exclude_unencrypted)
3427                                 auth = WLAN_AUTH_SHARED_KEY;
3428                         send_authentication_request(priv, auth, NULL, 0);
3429           }
3430           break;
3431
3432         case STATION_STATE_ASSOCIATING:
3433                 if (priv->AssociationRequestRetryCnt == MAX_ASSOCIATION_RETRIES) {
3434                         atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
3435                         priv->station_is_associated = 0;
3436                         priv->AssociationRequestRetryCnt = 0;
3437                         restart_search(priv);
3438                 } else {
3439                         priv->AssociationRequestRetryCnt++;
3440                         mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
3441                         send_association_request(priv, 0);
3442                 }
3443           break;
3444
3445         case STATION_STATE_REASSOCIATING:
3446                 if (priv->ReAssociationRequestRetryCnt == MAX_ASSOCIATION_RETRIES) {
3447                         atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
3448                         priv->station_is_associated = 0;
3449                         priv->ReAssociationRequestRetryCnt = 0;
3450                         restart_search(priv);
3451                 } else {
3452                         priv->ReAssociationRequestRetryCnt++;
3453                         mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
3454                         send_association_request(priv, 1);
3455                 }
3456                 break;
3457
3458         default:
3459                 break;
3460         }
3461
3462         spin_unlock_irqrestore(&priv->irqlock, flags);
3463 }
3464
3465 static void atmel_command_irq(struct atmel_private *priv)
3466 {
3467         u8 status = atmel_rmem8(priv, atmel_co(priv, CMD_BLOCK_STATUS_OFFSET));
3468         u8 command = atmel_rmem8(priv, atmel_co(priv, CMD_BLOCK_COMMAND_OFFSET));
3469         int fast_scan;
3470         union iwreq_data wrqu;
3471
3472         if (status == CMD_STATUS_IDLE ||
3473             status == CMD_STATUS_IN_PROGRESS)
3474                 return;
3475
3476         switch (command){
3477
3478         case CMD_Start:
3479                 if (status == CMD_STATUS_COMPLETE) {
3480                         priv->station_was_associated = priv->station_is_associated;
3481                         atmel_get_mib(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_CUR_BSSID_POS,
3482                                       (u8 *)priv->CurrentBSSID, 6);
3483                         atmel_enter_state(priv, STATION_STATE_READY);
3484                 }
3485                 break;
3486
3487         case CMD_Scan:
3488                 fast_scan = priv->fast_scan;
3489                 priv->fast_scan = 0;
3490
3491                 if (status != CMD_STATUS_COMPLETE) {
3492                         atmel_scan(priv, 1);
3493                 } else {
3494                         int bss_index = retrieve_bss(priv);
3495                         int notify_scan_complete = 1;
3496                         if (bss_index != -1) {
3497                                 atmel_join_bss(priv, bss_index);
3498                         } else if (priv->operating_mode == IW_MODE_ADHOC &&
3499                                    priv->SSID_size != 0) {
3500                                 start(priv, BSS_TYPE_AD_HOC);
3501                         } else {
3502                                 priv->fast_scan = !fast_scan;
3503                                 atmel_scan(priv, 1);
3504                                 notify_scan_complete = 0;
3505                         }
3506                         priv->site_survey_state = SITE_SURVEY_COMPLETED;
3507                         if (notify_scan_complete) {
3508                                 wrqu.data.length = 0;
3509                                 wrqu.data.flags = 0;
3510                                 wireless_send_event(priv->dev, SIOCGIWSCAN, &wrqu, NULL);
3511                         }
3512                 }
3513                 break;
3514
3515         case CMD_SiteSurvey:
3516                 priv->fast_scan = 0;
3517
3518                 if (status != CMD_STATUS_COMPLETE)
3519                         return;
3520
3521                 priv->site_survey_state = SITE_SURVEY_COMPLETED;
3522                 if (priv->station_is_associated) {
3523                         atmel_enter_state(priv, STATION_STATE_READY);
3524                         wrqu.data.length = 0;
3525                         wrqu.data.flags = 0;
3526                         wireless_send_event(priv->dev, SIOCGIWSCAN, &wrqu, NULL);
3527                 } else {
3528                         atmel_scan(priv, 1);
3529                 }
3530                 break;
3531
3532         case CMD_Join:
3533                 if (status == CMD_STATUS_COMPLETE) {
3534                         if (priv->operating_mode == IW_MODE_ADHOC) {
3535                                 priv->station_was_associated = priv->station_is_associated;
3536                                 atmel_enter_state(priv, STATION_STATE_READY);
3537                         } else {
3538                                 int auth = WLAN_AUTH_OPEN;
3539                                 priv->AuthenticationRequestRetryCnt = 0;
3540                                 atmel_enter_state(priv, STATION_STATE_AUTHENTICATING);
3541
3542                                 mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
3543                                 priv->CurrentAuthentTransactionSeqNum = 0x0001;
3544                                 if (priv->wep_is_on && priv->exclude_unencrypted)
3545                                         auth = WLAN_AUTH_SHARED_KEY;
3546                                 send_authentication_request(priv, auth, NULL, 0);
3547                         }
3548                         return;
3549                 }
3550
3551                 atmel_scan(priv, 1);
3552         }
3553 }
3554
3555 static int atmel_wakeup_firmware(struct atmel_private *priv)
3556 {
3557         struct host_info_struct *iface = &priv->host_info;
3558         u16 mr1, mr3;
3559         int i;
3560
3561         if (priv->card_type == CARD_TYPE_SPI_FLASH)
3562                 atmel_set_gcr(priv->dev, GCR_REMAP);
3563
3564         /* wake up on-board processor */
3565         atmel_clear_gcr(priv->dev, 0x0040);
3566         atmel_write16(priv->dev, BSR, BSS_SRAM);
3567
3568         if (priv->card_type == CARD_TYPE_SPI_FLASH)
3569                 mdelay(100);
3570
3571         /* and wait for it */
3572         for (i = LOOP_RETRY_LIMIT; i; i--) {
3573                 mr1 = atmel_read16(priv->dev, MR1);
3574                 mr3 = atmel_read16(priv->dev, MR3);
3575
3576                 if (mr3 & MAC_BOOT_COMPLETE)
3577                         break;
3578                 if (mr1 & MAC_BOOT_COMPLETE &&
3579                     priv->bus_type == BUS_TYPE_PCCARD)
3580                         break;
3581         }
3582
3583         if (i == 0) {
3584                 printk(KERN_ALERT "%s: MAC failed to boot.\n", priv->dev->name);
3585                 return 0;
3586         }
3587
3588         if ((priv->host_info_base = atmel_read16(priv->dev, MR2)) == 0xffff) {
3589                 printk(KERN_ALERT "%s: card missing.\n", priv->dev->name);
3590                 return 0;
3591         }
3592
3593         /* now check for completion of MAC initialization through
3594            the FunCtrl field of the IFACE, poll MR1 to detect completion of
3595            MAC initialization, check completion status, set interrupt mask,
3596            enables interrupts and calls Tx and Rx initialization functions */
3597
3598         atmel_wmem8(priv, atmel_hi(priv, IFACE_FUNC_CTRL_OFFSET), FUNC_CTRL_INIT_COMPLETE);
3599
3600         for (i = LOOP_RETRY_LIMIT; i; i--) {
3601                 mr1 = atmel_read16(priv->dev, MR1);
3602                 mr3 = atmel_read16(priv->dev, MR3);
3603
3604                 if (mr3 & MAC_INIT_COMPLETE)
3605                         break;
3606                 if (mr1 & MAC_INIT_COMPLETE &&
3607                     priv->bus_type == BUS_TYPE_PCCARD)
3608                         break;
3609         }
3610
3611         if (i == 0) {
3612                 printk(KERN_ALERT "%s: MAC failed to initialise.\n",
3613                                 priv->dev->name);
3614                 return 0;
3615         }
3616
3617         /* Check for MAC_INIT_OK only on the register that the MAC_INIT_OK was set */
3618         if ((mr3 & MAC_INIT_COMPLETE) &&
3619             !(atmel_read16(priv->dev, MR3) & MAC_INIT_OK)) {
3620                 printk(KERN_ALERT "%s: MAC failed MR3 self-test.\n", priv->dev->name);
3621                 return 0;
3622         }
3623         if ((mr1 & MAC_INIT_COMPLETE) &&
3624             !(atmel_read16(priv->dev, MR1) & MAC_INIT_OK)) {
3625                 printk(KERN_ALERT "%s: MAC failed MR1 self-test.\n", priv->dev->name);
3626                 return 0;
3627         }
3628
3629         atmel_copy_to_host(priv->dev, (unsigned char *)iface,
3630                            priv->host_info_base, sizeof(*iface));
3631
3632         iface->tx_buff_pos = le16_to_cpu(iface->tx_buff_pos);
3633         iface->tx_buff_size = le16_to_cpu(iface->tx_buff_size);
3634         iface->tx_desc_pos = le16_to_cpu(iface->tx_desc_pos);
3635         iface->tx_desc_count = le16_to_cpu(iface->tx_desc_count);
3636         iface->rx_buff_pos = le16_to_cpu(iface->rx_buff_pos);
3637         iface->rx_buff_size = le16_to_cpu(iface->rx_buff_size);
3638         iface->rx_desc_pos = le16_to_cpu(iface->rx_desc_pos);
3639         iface->rx_desc_count = le16_to_cpu(iface->rx_desc_count);
3640         iface->build_version = le16_to_cpu(iface->build_version);
3641         iface->command_pos = le16_to_cpu(iface->command_pos);
3642         iface->major_version = le16_to_cpu(iface->major_version);
3643         iface->minor_version = le16_to_cpu(iface->minor_version);
3644         iface->func_ctrl = le16_to_cpu(iface->func_ctrl);
3645         iface->mac_status = le16_to_cpu(iface->mac_status);
3646
3647         return 1;
3648 }
3649
3650 /* determine type of memory and MAC address */
3651 static int probe_atmel_card(struct net_device *dev)
3652 {
3653         int rc = 0;
3654         struct atmel_private *priv = netdev_priv(dev);
3655
3656         /* reset pccard */
3657         if (priv->bus_type == BUS_TYPE_PCCARD)
3658                 atmel_write16(dev, GCR, 0x0060);
3659
3660         atmel_write16(dev, GCR, 0x0040);
3661         mdelay(500);
3662
3663         if (atmel_read16(dev, MR2) == 0) {
3664                 /* No stored firmware so load a small stub which just
3665                    tells us the MAC address */
3666                 int i;
3667                 priv->card_type = CARD_TYPE_EEPROM;
3668                 atmel_write16(dev, BSR, BSS_IRAM);
3669                 atmel_copy_to_card(dev, 0, mac_reader, sizeof(mac_reader));
3670                 atmel_set_gcr(dev, GCR_REMAP);
3671                 atmel_clear_gcr(priv->dev, 0x0040);
3672                 atmel_write16(dev, BSR, BSS_SRAM);
3673                 for (i = LOOP_RETRY_LIMIT; i; i--)
3674                         if (atmel_read16(dev, MR3) & MAC_BOOT_COMPLETE)
3675                                 break;
3676                 if (i == 0) {
3677                         printk(KERN_ALERT "%s: MAC failed to boot MAC address reader.\n", dev->name);
3678                 } else {
3679                         atmel_copy_to_host(dev, dev->dev_addr, atmel_read16(dev, MR2), 6);
3680                         /* got address, now squash it again until the network
3681                            interface is opened */
3682                         if (priv->bus_type == BUS_TYPE_PCCARD)
3683                                 atmel_write16(dev, GCR, 0x0060);
3684                         atmel_write16(dev, GCR, 0x0040);
3685                         rc = 1;
3686                 }
3687         } else if (atmel_read16(dev, MR4) == 0) {
3688                 /* Mac address easy in this case. */
3689                 priv->card_type = CARD_TYPE_PARALLEL_FLASH;
3690                 atmel_write16(dev,  BSR, 1);
3691                 atmel_copy_to_host(dev, dev->dev_addr, 0xc000, 6);
3692                 atmel_write16(dev,  BSR, 0x200);
3693                 rc = 1;
3694         } else {
3695                 /* Standard firmware in flash, boot it up and ask
3696                    for the Mac Address */
3697                 priv->card_type = CARD_TYPE_SPI_FLASH;
3698                 if (atmel_wakeup_firmware(priv)) {
3699                         atmel_get_mib(priv, Mac_Address_Mib_Type, 0, dev->dev_addr, 6);
3700
3701                         /* got address, now squash it again until the network
3702                            interface is opened */
3703                         if (priv->bus_type == BUS_TYPE_PCCARD)
3704                                 atmel_write16(dev, GCR, 0x0060);
3705                         atmel_write16(dev, GCR, 0x0040);
3706                         rc = 1;
3707                 }
3708         }
3709
3710         if (rc) {
3711                 if (dev->dev_addr[0] == 0xFF) {
3712                         u8 default_mac[] = {0x00,0x04, 0x25, 0x00, 0x00, 0x00};
3713                         printk(KERN_ALERT "%s: *** Invalid MAC address. UPGRADE Firmware ****\n", dev->name);
3714                         memcpy(dev->dev_addr, default_mac, 6);
3715                 }
3716         }
3717
3718         return rc;
3719 }
3720
3721 /* Move the encyption information on the MIB structure.
3722    This routine is for the pre-WPA firmware: later firmware has
3723    a different format MIB and a different routine. */
3724 static void build_wep_mib(struct atmel_private *priv)
3725 {
3726         struct { /* NB this is matched to the hardware, don't change. */
3727                 u8 wep_is_on;
3728                 u8 default_key; /* 0..3 */
3729                 u8 reserved;
3730                 u8 exclude_unencrypted;
3731
3732                 u32 WEPICV_error_count;
3733                 u32 WEP_excluded_count;
3734
3735                 u8 wep_keys[MAX_ENCRYPTION_KEYS][13];
3736                 u8 encryption_level; /* 0, 1, 2 */
3737                 u8 reserved2[3];
3738         } mib;
3739         int i;
3740
3741         mib.wep_is_on = priv->wep_is_on;
3742         if (priv->wep_is_on) {
3743                 if (priv->wep_key_len[priv->default_key] > 5)
3744                         mib.encryption_level = 2;
3745                 else
3746                         mib.encryption_level = 1;
3747         } else {
3748                 mib.encryption_level = 0;
3749         }
3750
3751         mib.default_key = priv->default_key;
3752         mib.exclude_unencrypted = priv->exclude_unencrypted;
3753
3754         for (i = 0; i < MAX_ENCRYPTION_KEYS; i++)
3755                 memcpy(mib.wep_keys[i], priv->wep_keys[i], 13);
3756
3757         atmel_set_mib(priv, Mac_Wep_Mib_Type, 0, (u8 *)&mib, sizeof(mib));
3758 }
3759
3760 static void build_wpa_mib(struct atmel_private *priv)
3761 {
3762         /* This is for the later (WPA enabled) firmware. */
3763
3764         struct { /* NB this is matched to the hardware, don't change. */
3765                 u8 cipher_default_key_value[MAX_ENCRYPTION_KEYS][MAX_ENCRYPTION_KEY_SIZE];
3766                 u8 receiver_address[6];
3767                 u8 wep_is_on;
3768                 u8 default_key; /* 0..3 */
3769                 u8 group_key;
3770                 u8 exclude_unencrypted;
3771                 u8 encryption_type;
3772                 u8 reserved;
3773
3774                 u32 WEPICV_error_count;
3775                 u32 WEP_excluded_count;
3776
3777                 u8 key_RSC[4][8];
3778         } mib;
3779
3780         int i;
3781
3782         mib.wep_is_on = priv->wep_is_on;
3783         mib.exclude_unencrypted = priv->exclude_unencrypted;
3784         memcpy(mib.receiver_address, priv->CurrentBSSID, 6);
3785
3786         /* zero all the keys before adding in valid ones. */
3787         memset(mib.cipher_default_key_value, 0, sizeof(mib.cipher_default_key_value));
3788
3789         if (priv->wep_is_on) {
3790                 /* There's a comment in the Atmel code to the effect that this
3791                    is only valid when still using WEP, it may need to be set to
3792                    something to use WPA */
3793                 memset(mib.key_RSC, 0, sizeof(mib.key_RSC));
3794
3795                 mib.default_key = mib.group_key = 255;
3796                 for (i = 0; i < MAX_ENCRYPTION_KEYS; i++) {
3797                         if (priv->wep_key_len[i] > 0) {
3798                                 memcpy(mib.cipher_default_key_value[i], priv->wep_keys[i], MAX_ENCRYPTION_KEY_SIZE);
3799                                 if (i == priv->default_key) {
3800                                         mib.default_key = i;
3801                                         mib.cipher_default_key_value[i][MAX_ENCRYPTION_KEY_SIZE-1] = 7;
3802                                         mib.cipher_default_key_value[i][MAX_ENCRYPTION_KEY_SIZE-2] = priv->pairwise_cipher_suite;
3803                                 } else {
3804                                         mib.group_key = i;
3805                                         priv->group_cipher_suite = priv->pairwise_cipher_suite;
3806                                         mib.cipher_default_key_value[i][MAX_ENCRYPTION_KEY_SIZE-1] = 1;
3807                                         mib.cipher_default_key_value[i][MAX_ENCRYPTION_KEY_SIZE-2] = priv->group_cipher_suite;
3808                                 }
3809                         }
3810                 }
3811                 if (mib.default_key == 255)
3812                         mib.default_key = mib.group_key != 255 ? mib.group_key : 0;
3813                 if (mib.group_key == 255)
3814                         mib.group_key = mib.default_key;
3815
3816         }
3817
3818         atmel_set_mib(priv, Mac_Wep_Mib_Type, 0, (u8 *)&mib, sizeof(mib));
3819 }
3820
3821 static int reset_atmel_card(struct net_device *dev)
3822 {
3823         /* do everything necessary to wake up the hardware, including
3824            waiting for the lightning strike and throwing the knife switch....
3825
3826            set all the Mib values which matter in the card to match
3827            their settings in the atmel_private structure. Some of these
3828            can be altered on the fly, but many (WEP, infrastucture or ad-hoc)
3829            can only be changed by tearing down the world and coming back through
3830            here.
3831
3832            This routine is also responsible for initialising some
3833            hardware-specific fields in the atmel_private structure,
3834            including a copy of the firmware's hostinfo stucture
3835            which is the route into the rest of the firmare datastructures. */
3836
3837         struct atmel_private *priv = netdev_priv(dev);
3838         u8 configuration;
3839         int old_state = priv->station_state;
3840
3841         /* data to add to the firmware names, in priority order
3842            this implemenents firmware versioning */
3843
3844         static char *firmware_modifier[] = {
3845                 "-wpa",
3846                 "",
3847                 NULL
3848         };
3849
3850         /* reset pccard */
3851         if (priv->bus_type == BUS_TYPE_PCCARD)
3852                 atmel_write16(priv->dev, GCR, 0x0060);
3853
3854         /* stop card , disable interrupts */
3855         atmel_write16(priv->dev, GCR, 0x0040);
3856
3857         if (priv->card_type == CARD_TYPE_EEPROM) {
3858                 /* copy in firmware if needed */
3859                 const struct firmware *fw_entry = NULL;
3860                 unsigned char *fw;
3861                 int len = priv->firmware_length;
3862                 if (!(fw = priv->firmware)) {
3863                         if (priv->firmware_type == ATMEL_FW_TYPE_NONE) {
3864                                 if (strlen(priv->firmware_id) == 0) {
3865                                         printk(KERN_INFO
3866                                                "%s: card type is unknown: assuming at76c502 firmware is OK.\n",
3867                                                dev->name);
3868                                         printk(KERN_INFO
3869                                                "%s: if not, use the firmware= module parameter.\n",
3870                                                dev->name);
3871                                         strcpy(priv->firmware_id, "atmel_at76c502.bin");
3872                                 }
3873                                 if (request_firmware(&fw_entry, priv->firmware_id, priv->sys_dev) != 0) {
3874                                         printk(KERN_ALERT
3875                                                "%s: firmware %s is missing, cannot continue.\n",
3876                                                dev->name, priv->firmware_id);
3877                                         return 0;
3878                                 }
3879                         } else {
3880                                 int fw_index = 0;
3881                                 int success = 0;
3882
3883                                 /* get firmware filename entry based on firmware type ID */
3884                                 while (fw_table[fw_index].fw_type != priv->firmware_type
3885                                                 && fw_table[fw_index].fw_type != ATMEL_FW_TYPE_NONE)
3886                                         fw_index++;
3887
3888                                 /* construct the actual firmware file name */
3889                                 if (fw_table[fw_index].fw_type != ATMEL_FW_TYPE_NONE) {
3890                                         int i;
3891                                         for (i = 0; firmware_modifier[i]; i++) {
3892                                                 snprintf(priv->firmware_id, 32, "%s%s.%s", fw_table[fw_index].fw_file,
3893                                                         firmware_modifier[i], fw_table[fw_index].fw_file_ext);
3894                                                 priv->firmware_id[31] = '\0';
3895                                                 if (request_firmware(&fw_entry, priv->firmware_id, priv->sys_dev) == 0) {
3896                                                         success = 1;
3897                                                         break;
3898                                                 }
3899                                         }
3900                                 }
3901                                 if (!success) {
3902                                         printk(KERN_ALERT
3903                                                "%s: firmware %s is missing, cannot start.\n",
3904                                                dev->name, priv->firmware_id);
3905                                         priv->firmware_id[0] = '\0';
3906                                         return 0;
3907                                 }
3908                         }
3909
3910                         fw = fw_entry->data;
3911                         len = fw_entry->size;
3912                 }
3913
3914                 if (len <= 0x6000) {
3915                         atmel_write16(priv->dev, BSR, BSS_IRAM);
3916                         atmel_copy_to_card(priv->dev, 0, fw, len);
3917                         atmel_set_gcr(priv->dev, GCR_REMAP);
3918                 } else {
3919                         /* Remap */
3920                         atmel_set_gcr(priv->dev, GCR_REMAP);
3921                         atmel_write16(priv->dev, BSR, BSS_IRAM);
3922                         atmel_copy_to_card(priv->dev, 0, fw, 0x6000);
3923                         atmel_write16(priv->dev, BSR, 0x2ff);
3924                         atmel_copy_to_card(priv->dev, 0x8000, &fw[0x6000], len - 0x6000);
3925                 }
3926
3927                 if (fw_entry)
3928                         release_firmware(fw_entry);
3929         }
3930
3931         if (!atmel_wakeup_firmware(priv))
3932                 return 0;
3933
3934         /* Check the version and set the correct flag for wpa stuff,
3935            old and new firmware is incompatible.
3936            The pre-wpa 3com firmware reports major version 5,
3937            the wpa 3com firmware is major version 4 and doesn't need
3938            the 3com broken-ness filter. */
3939         priv->use_wpa = (priv->host_info.major_version == 4);
3940         priv->radio_on_broken = (priv->host_info.major_version == 5);
3941
3942         /* unmask all irq sources */
3943         atmel_wmem8(priv, atmel_hi(priv, IFACE_INT_MASK_OFFSET), 0xff);
3944
3945         /* int Tx system and enable Tx */
3946         atmel_wmem8(priv, atmel_tx(priv, TX_DESC_FLAGS_OFFSET, 0), 0);
3947         atmel_wmem32(priv, atmel_tx(priv, TX_DESC_NEXT_OFFSET, 0), 0x80000000L);
3948         atmel_wmem16(priv, atmel_tx(priv, TX_DESC_POS_OFFSET, 0), 0);
3949         atmel_wmem16(priv, atmel_tx(priv, TX_DESC_SIZE_OFFSET, 0), 0);
3950
3951         priv->tx_desc_free = priv->host_info.tx_desc_count;
3952         priv->tx_desc_head = 0;
3953         priv->tx_desc_tail = 0;
3954         priv->tx_desc_previous = 0;
3955         priv->tx_free_mem = priv->host_info.tx_buff_size;
3956         priv->tx_buff_head = 0;
3957         priv->tx_buff_tail = 0;
3958
3959         configuration = atmel_rmem8(priv, atmel_hi(priv, IFACE_FUNC_CTRL_OFFSET));
3960         atmel_wmem8(priv, atmel_hi(priv, IFACE_FUNC_CTRL_OFFSET),
3961                                    configuration | FUNC_CTRL_TxENABLE);
3962
3963         /* init Rx system and enable */
3964         priv->rx_desc_head = 0;
3965
3966         configuration = atmel_rmem8(priv, atmel_hi(priv, IFACE_FUNC_CTRL_OFFSET));
3967         atmel_wmem8(priv, atmel_hi(priv, IFACE_FUNC_CTRL_OFFSET),
3968                                    configuration | FUNC_CTRL_RxENABLE);
3969
3970         if (!priv->radio_on_broken) {
3971                 if (atmel_send_command_wait(priv, CMD_EnableRadio, NULL, 0) ==
3972                     CMD_STATUS_REJECTED_RADIO_OFF) {
3973                         printk(KERN_INFO
3974                                "%s: cannot turn the radio on. (Hey radio, you're beautiful!)\n",
3975                                dev->name);
3976                         return 0;
3977                 }
3978         }
3979
3980         /* set up enough MIB values to run. */
3981         atmel_set_mib8(priv, Local_Mib_Type, LOCAL_MIB_AUTO_TX_RATE_POS, priv->auto_tx_rate);
3982         atmel_set_mib8(priv, Local_Mib_Type,  LOCAL_MIB_TX_PROMISCUOUS_POS,  PROM_MODE_OFF);
3983         atmel_set_mib16(priv, Mac_Mib_Type, MAC_MIB_RTS_THRESHOLD_POS, priv->rts_threshold);
3984         atmel_set_mib16(priv, Mac_Mib_Type, MAC_MIB_FRAG_THRESHOLD_POS, priv->frag_threshold);
3985         atmel_set_mib8(priv, Mac_Mib_Type, MAC_MIB_SHORT_RETRY_POS, priv->short_retry);
3986         atmel_set_mib8(priv, Mac_Mib_Type, MAC_MIB_LONG_RETRY_POS, priv->long_retry);
3987         atmel_set_mib8(priv, Local_Mib_Type, LOCAL_MIB_PREAMBLE_TYPE, priv->preamble);
3988         atmel_set_mib(priv, Mac_Address_Mib_Type, MAC_ADDR_MIB_MAC_ADDR_POS,
3989                       priv->dev->dev_addr, 6);
3990         atmel_set_mib8(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_PS_MODE_POS, ACTIVE_MODE);
3991         atmel_set_mib16(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_LISTEN_INTERVAL_POS, 1);
3992         atmel_set_mib16(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_BEACON_PER_POS, priv->default_beacon_period);
3993         atmel_set_mib(priv, Phy_Mib_Type, PHY_MIB_RATE_SET_POS, atmel_basic_rates, 4);
3994         atmel_set_mib8(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_CUR_PRIVACY_POS, priv->wep_is_on);
3995         if (priv->use_wpa)
3996                 build_wpa_mib(priv);
3997         else
3998                 build_wep_mib(priv);
3999
4000         if (old_state == STATION_STATE_READY)
4001         {
4002                 union iwreq_data wrqu;
4003
4004                 wrqu.data.length = 0;
4005                 wrqu.data.flags = 0;
4006                 wrqu.ap_addr.sa_family = ARPHRD_ETHER;
4007                 memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
4008                 wireless_send_event(priv->dev, SIOCGIWAP, &wrqu, NULL);
4009         }
4010
4011         return 1;
4012 }
4013
4014 static void atmel_send_command(struct atmel_private *priv, int command,
4015                                void *cmd, int cmd_size)
4016 {
4017         if (cmd)
4018                 atmel_copy_to_card(priv->dev, atmel_co(priv, CMD_BLOCK_PARAMETERS_OFFSET),
4019                                    cmd, cmd_size);
4020
4021         atmel_wmem8(priv, atmel_co(priv, CMD_BLOCK_COMMAND_OFFSET), command);
4022         atmel_wmem8(priv, atmel_co(priv, CMD_BLOCK_STATUS_OFFSET), 0);
4023 }
4024
4025 static int atmel_send_command_wait(struct atmel_private *priv, int command,
4026                                    void *cmd, int cmd_size)
4027 {
4028         int i, status;
4029
4030         atmel_send_command(priv, command, cmd, cmd_size);
4031
4032         for (i = 5000; i; i--) {
4033                 status = atmel_rmem8(priv, atmel_co(priv, CMD_BLOCK_STATUS_OFFSET));
4034                 if (status != CMD_STATUS_IDLE &&
4035                     status != CMD_STATUS_IN_PROGRESS)
4036                         break;
4037                 udelay(20);
4038         }
4039
4040         if (i == 0) {
4041                 printk(KERN_ALERT "%s: failed to contact MAC.\n", priv->dev->name);
4042                 status =  CMD_STATUS_HOST_ERROR;
4043         } else {
4044                 if (command != CMD_EnableRadio)
4045                         status = CMD_STATUS_COMPLETE;
4046         }
4047
4048         return status;
4049 }
4050
4051 static u8 atmel_get_mib8(struct atmel_private *priv, u8 type, u8 index)
4052 {
4053         struct get_set_mib m;
4054         m.type = type;
4055         m.size = 1;
4056         m.index = index;
4057
4058         atmel_send_command_wait(priv, CMD_Get_MIB_Vars, &m, MIB_HEADER_SIZE + 1);
4059         return atmel_rmem8(priv, atmel_co(priv, CMD_BLOCK_PARAMETERS_OFFSET + MIB_HEADER_SIZE));
4060 }
4061
4062 static void atmel_set_mib8(struct atmel_private *priv, u8 type, u8 index, u8 data)
4063 {
4064         struct get_set_mib m;
4065         m.type = type;
4066         m.size = 1;
4067         m.index = index;
4068         m.data[0] = data;
4069
4070         atmel_send_command_wait(priv, CMD_Set_MIB_Vars, &m, MIB_HEADER_SIZE + 1);
4071 }
4072
4073 static void atmel_set_mib16(struct atmel_private *priv, u8 type, u8 index,
4074                             u16 data)
4075 {
4076         struct get_set_mib m;
4077         m.type = type;
4078         m.size = 2;
4079         m.index = index;
4080         m.data[0] = data;
4081         m.data[1] = data >> 8;
4082
4083         atmel_send_command_wait(priv, CMD_Set_MIB_Vars, &m, MIB_HEADER_SIZE + 2);
4084 }
4085
4086 static void atmel_set_mib(struct atmel_private *priv, u8 type, u8 index,
4087                           u8 *data, int data_len)
4088 {
4089         struct get_set_mib m;
4090         m.type = type;
4091         m.size = data_len;
4092         m.index = index;
4093
4094         if (data_len > MIB_MAX_DATA_BYTES)
4095                 printk(KERN_ALERT "%s: MIB buffer too small.\n", priv->dev->name);
4096
4097         memcpy(m.data, data, data_len);
4098         atmel_send_command_wait(priv, CMD_Set_MIB_Vars, &m, MIB_HEADER_SIZE + data_len);
4099 }
4100
4101 static void atmel_get_mib(struct atmel_private *priv, u8 type, u8 index,
4102                           u8 *data, int data_len)
4103 {
4104         struct get_set_mib m;
4105         m.type = type;
4106         m.size = data_len;
4107         m.index = index;
4108
4109         if (data_len > MIB_MAX_DATA_BYTES)
4110                 printk(KERN_ALERT "%s: MIB buffer too small.\n", priv->dev->name);
4111
4112         atmel_send_command_wait(priv, CMD_Get_MIB_Vars, &m, MIB_HEADER_SIZE + data_len);
4113         atmel_copy_to_host(priv->dev, data,
4114                            atmel_co(priv, CMD_BLOCK_PARAMETERS_OFFSET + MIB_HEADER_SIZE), data_len);
4115 }
4116
4117 static void atmel_writeAR(struct net_device *dev, u16 data)
4118 {
4119         int i;
4120         outw(data, dev->base_addr + AR);
4121         /* Address register appears to need some convincing..... */
4122         for (i = 0; data != inw(dev->base_addr + AR) && i < 10; i++)
4123                 outw(data, dev->base_addr + AR);
4124 }
4125
4126 static void atmel_copy_to_card(struct net_device *dev, u16 dest,
4127                                unsigned char *src, u16 len)
4128 {
4129         int i;
4130         atmel_writeAR(dev, dest);
4131         if (dest % 2) {
4132                 atmel_write8(dev, DR, *src);
4133                 src++; len--;
4134         }
4135         for (i = len; i > 1 ; i -= 2) {
4136                 u8 lb = *src++;
4137                 u8 hb = *src++;
4138                 atmel_write16(dev, DR, lb | (hb << 8));
4139         }
4140         if (i)
4141                 atmel_write8(dev, DR, *src);
4142 }
4143
4144 static void atmel_copy_to_host(struct net_device *dev, unsigned char *dest,
4145                                u16 src, u16 len)
4146 {
4147         int i;
4148         atmel_writeAR(dev, src);
4149         if (src % 2) {
4150                 *dest = atmel_read8(dev, DR);
4151                 dest++; len--;
4152         }
4153         for (i = len; i > 1 ; i -= 2) {
4154                 u16 hw = atmel_read16(dev, DR);
4155                 *dest++ = hw;
4156                 *dest++ = hw >> 8;
4157         }
4158         if (i)
4159                 *dest = atmel_read8(dev, DR);
4160 }
4161
4162 static void atmel_set_gcr(struct net_device *dev, u16 mask)
4163 {
4164         outw(inw(dev->base_addr + GCR) | mask, dev->base_addr + GCR);
4165 }
4166
4167 static void atmel_clear_gcr(struct net_device *dev, u16 mask)
4168 {
4169         outw(inw(dev->base_addr + GCR) & ~mask, dev->base_addr + GCR);
4170 }
4171
4172 static int atmel_lock_mac(struct atmel_private *priv)
4173 {
4174         int i, j = 20;
4175  retry:
4176         for (i = 5000; i; i--) {
4177                 if (!atmel_rmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_HOST_OFFSET)))
4178                         break;
4179                 udelay(20);
4180         }
4181
4182         if (!i)
4183                 return 0; /* timed out */
4184
4185         atmel_wmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_MAC_OFFSET), 1);
4186         if (atmel_rmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_HOST_OFFSET))) {
4187                 atmel_wmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_MAC_OFFSET), 0);
4188                 if (!j--)
4189                         return 0; /* timed out */
4190                 goto retry;
4191         }
4192
4193         return 1;
4194 }
4195
4196 static void atmel_wmem32(struct atmel_private *priv, u16 pos, u32 data)
4197 {
4198         atmel_writeAR(priv->dev, pos);
4199         atmel_write16(priv->dev, DR, data); /* card is little-endian */
4200         atmel_write16(priv->dev, DR, data >> 16);
4201 }
4202
4203 /***************************************************************************/
4204 /* There follows the source form of the MAC address reading firmware       */
4205 /***************************************************************************/
4206 #if 0
4207
4208 /* Copyright 2003 Matthew T. Russotto                                      */
4209 /* But derived from the Atmel 76C502 firmware written by Atmel and         */
4210 /* included in "atmel wireless lan drivers" package                        */
4211 /**
4212     This file is part of net.russotto.AtmelMACFW, hereto referred to
4213     as AtmelMACFW
4214
4215     AtmelMACFW is free software; you can redistribute it and/or modify
4216     it under the terms of the GNU General Public License version 2
4217     as published by the Free Software Foundation.
4218
4219     AtmelMACFW is distributed in the hope that it will be useful,
4220     but WITHOUT ANY WARRANTY; without even the implied warranty of
4221     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
4222     GNU General Public License for more details.
4223
4224     You should have received a copy of the GNU General Public License
4225     along with AtmelMACFW; if not, write to the Free Software
4226     Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
4227
4228 ****************************************************************************/
4229 /* This firmware should work on the 76C502 RFMD, RFMD_D, and RFMD_E        */
4230 /* It will probably work on the 76C504 and 76C502 RFMD_3COM                */
4231 /* It only works on SPI EEPROM versions of the card.                       */
4232
4233 /* This firmware initializes the SPI controller and clock, reads the MAC   */
4234 /* address from the EEPROM into SRAM, and puts the SRAM offset of the MAC  */
4235 /* address in MR2, and sets MR3 to 0x10 to indicate it is done             */
4236 /* It also puts a complete copy of the EEPROM in SRAM with the offset in   */
4237 /* MR4, for investigational purposes (maybe we can determine chip type     */
4238 /* from that?)                                                             */
4239
4240         .org 0
4241     .set MRBASE, 0x8000000
4242         .set CPSR_INITIAL, 0xD3 /* IRQ/FIQ disabled, ARM mode, Supervisor state */
4243         .set CPSR_USER, 0xD1 /* IRQ/FIQ disabled, ARM mode, USER state */
4244         .set SRAM_BASE,  0x02000000
4245         .set SP_BASE,    0x0F300000
4246         .set UNK_BASE,   0x0F000000 /* Some internal device, but which one? */
4247         .set SPI_CGEN_BASE,  0x0E000000 /* Some internal device, but which one? */
4248         .set UNK3_BASE,  0x02014000 /* Some internal device, but which one? */
4249         .set STACK_BASE, 0x5600
4250         .set SP_SR, 0x10
4251         .set SP_TDRE, 2 /* status register bit -- TDR empty */
4252         .set SP_RDRF, 1 /* status register bit -- RDR full */
4253         .set SP_SWRST, 0x80
4254         .set SP_SPIEN, 0x1
4255         .set SP_CR, 0   /* control register */
4256         .set SP_MR, 4   /* mode register */
4257         .set SP_RDR, 0x08 /* Read Data Register */
4258         .set SP_TDR, 0x0C /* Transmit Data Register */
4259         .set SP_CSR0, 0x30 /* chip select registers */
4260         .set SP_CSR1, 0x34
4261         .set SP_CSR2, 0x38
4262         .set SP_CSR3, 0x3C
4263         .set NVRAM_CMD_RDSR, 5 /* read status register */
4264         .set NVRAM_CMD_READ, 3 /* read data */
4265         .set NVRAM_SR_RDY, 1 /* RDY bit.  This bit is inverted */
4266         .set SPI_8CLOCKS, 0xFF /* Writing this to the TDR doesn't do anything to the
4267                                   serial output, since SO is normally high.  But it
4268                                   does cause 8 clock cycles and thus 8 bits to be
4269                                   clocked in to the chip.  See Atmel's SPI
4270                                   controller (e.g. AT91M55800) timing and 4K
4271                                   SPI EEPROM manuals */
4272
4273         .set NVRAM_SCRATCH, 0x02000100  /* arbitrary area for scratchpad memory */
4274         .set NVRAM_IMAGE, 0x02000200
4275         .set NVRAM_LENGTH, 0x0200
4276         .set MAC_ADDRESS_MIB, SRAM_BASE
4277         .set MAC_ADDRESS_LENGTH, 6
4278         .set MAC_BOOT_FLAG, 0x10
4279         .set MR1, 0
4280         .set MR2, 4
4281         .set MR3, 8
4282         .set MR4, 0xC
4283 RESET_VECTOR:
4284         b RESET_HANDLER
4285 UNDEF_VECTOR:
4286         b HALT1
4287 SWI_VECTOR:
4288         b HALT1
4289 IABORT_VECTOR:
4290         b HALT1
4291 DABORT_VECTOR:
4292 RESERVED_VECTOR:
4293         b HALT1
4294 IRQ_VECTOR:
4295         b HALT1
4296 FIQ_VECTOR:
4297         b HALT1
4298 HALT1:  b HALT1
4299 RESET_HANDLER:
4300         mov     r0, #CPSR_INITIAL
4301         msr     CPSR_c, r0      /* This is probably unnecessary */
4302
4303 /* I'm guessing this is initializing clock generator electronics for SPI */
4304         ldr     r0, =SPI_CGEN_BASE
4305         mov     r1, #0
4306         mov     r1, r1, lsl #3
4307         orr     r1,r1, #0
4308         str     r1, [r0]
4309         ldr     r1, [r0, #28]
4310         bic     r1, r1, #16
4311         str     r1, [r0, #28]
4312         mov     r1, #1
4313         str     r1, [r0, #8]
4314
4315         ldr     r0, =MRBASE
4316         mov     r1, #0
4317         strh    r1, [r0, #MR1]
4318         strh    r1, [r0, #MR2]
4319         strh    r1, [r0, #MR3]
4320         strh    r1, [r0, #MR4]
4321
4322         mov     sp, #STACK_BASE
4323         bl      SP_INIT
4324         mov     r0, #10
4325         bl      DELAY9
4326         bl      GET_MAC_ADDR
4327         bl      GET_WHOLE_NVRAM
4328         ldr     r0, =MRBASE
4329         ldr     r1, =MAC_ADDRESS_MIB
4330         strh    r1, [r0, #MR2]
4331         ldr     r1, =NVRAM_IMAGE
4332         strh    r1, [r0, #MR4]
4333         mov     r1, #MAC_BOOT_FLAG
4334         strh    r1, [r0, #MR3]
4335 HALT2:  b HALT2
4336 .func Get_Whole_NVRAM, GET_WHOLE_NVRAM
4337 GET_WHOLE_NVRAM:
4338         stmdb   sp!, {lr}
4339         mov     r2, #0 /* 0th bytes of NVRAM */
4340         mov     r3, #NVRAM_LENGTH
4341         mov     r1, #0          /* not used in routine */
4342         ldr     r0, =NVRAM_IMAGE
4343         bl      NVRAM_XFER
4344         ldmia   sp!, {lr}
4345         bx      lr
4346 .endfunc
4347
4348 .func Get_MAC_Addr, GET_MAC_ADDR
4349 GET_MAC_ADDR:
4350         stmdb   sp!, {lr}
4351         mov     r2, #0x120      /* address of MAC Address within NVRAM */
4352         mov     r3, #MAC_ADDRESS_LENGTH
4353         mov     r1, #0          /* not used in routine */
4354         ldr     r0, =MAC_ADDRESS_MIB
4355         bl      NVRAM_XFER
4356         ldmia   sp!, {lr}
4357         bx      lr
4358 .endfunc
4359 .ltorg
4360 .func Delay9, DELAY9
4361 DELAY9:
4362         adds    r0, r0, r0, LSL #3   /* r0 = r0 * 9 */
4363 DELAYLOOP:
4364         beq     DELAY9_done
4365         subs    r0, r0, #1
4366         b       DELAYLOOP
4367 DELAY9_done:
4368         bx      lr
4369 .endfunc
4370
4371 .func SP_Init, SP_INIT
4372 SP_INIT:
4373         mov     r1, #SP_SWRST
4374         ldr     r0, =SP_BASE
4375         str     r1, [r0, #SP_CR] /* reset the SPI */
4376         mov     r1, #0
4377         str     r1, [r0, #SP_CR] /* release SPI from reset state */
4378         mov     r1, #SP_SPIEN
4379         str     r1, [r0, #SP_MR] /* set the SPI to MASTER mode*/
4380         str     r1, [r0, #SP_CR] /* enable the SPI */
4381
4382 /*  My guess would be this turns on the SPI clock */
4383         ldr     r3, =SPI_CGEN_BASE
4384         ldr     r1, [r3, #28]
4385         orr     r1, r1, #0x2000
4386         str     r1, [r3, #28]
4387
4388         ldr     r1, =0x2000c01
4389         str     r1, [r0, #SP_CSR0]
4390         ldr     r1, =0x2000201
4391         str     r1, [r0, #SP_CSR1]
4392         str     r1, [r0, #SP_CSR2]
4393         str     r1, [r0, #SP_CSR3]
4394         ldr     r1, [r0, #SP_SR]
4395         ldr     r0, [r0, #SP_RDR]
4396         bx      lr
4397 .endfunc
4398 .func NVRAM_Init, NVRAM_INIT
4399 NVRAM_INIT:
4400         ldr     r1, =SP_BASE
4401         ldr     r0, [r1, #SP_RDR]
4402         mov     r0, #NVRAM_CMD_RDSR
4403         str     r0, [r1, #SP_TDR]
4404 SP_loop1:
4405         ldr     r0, [r1, #SP_SR]
4406         tst     r0, #SP_TDRE
4407         beq     SP_loop1
4408
4409         mov     r0, #SPI_8CLOCKS
4410         str     r0, [r1, #SP_TDR]
4411 SP_loop2:
4412         ldr     r0, [r1, #SP_SR]
4413         tst     r0, #SP_TDRE
4414         beq     SP_loop2
4415
4416         ldr     r0, [r1, #SP_RDR]
4417 SP_loop3:
4418         ldr     r0, [r1, #SP_SR]
4419         tst     r0, #SP_RDRF
4420         beq     SP_loop3
4421
4422         ldr     r0, [r1, #SP_RDR]
4423         and     r0, r0, #255
4424         bx      lr
4425 .endfunc
4426
4427 .func NVRAM_Xfer, NVRAM_XFER
4428         /* r0 = dest address */
4429         /* r1 = not used */
4430         /* r2 = src address within NVRAM */
4431         /* r3 = length */
4432 NVRAM_XFER:
4433         stmdb   sp!, {r4, r5, lr}
4434         mov     r5, r0          /* save r0 (dest address) */
4435         mov     r4, r3          /* save r3 (length) */
4436         mov     r0, r2, LSR #5 /*  SPI memories put A8 in the command field */
4437         and     r0, r0, #8
4438         add     r0, r0, #NVRAM_CMD_READ
4439         ldr     r1, =NVRAM_SCRATCH
4440         strb    r0, [r1, #0]    /* save command in NVRAM_SCRATCH[0] */
4441         strb    r2, [r1, #1]    /* save low byte of source address in NVRAM_SCRATCH[1] */
4442 _local1:
4443         bl      NVRAM_INIT
4444         tst     r0, #NVRAM_SR_RDY
4445         bne     _local1
4446         mov     r0, #20
4447         bl      DELAY9
4448         mov     r2, r4          /* length */
4449         mov     r1, r5          /* dest address */
4450         mov     r0, #2          /* bytes to transfer in command */
4451         bl      NVRAM_XFER2
4452         ldmia   sp!, {r4, r5, lr}
4453         bx      lr
4454 .endfunc
4455
4456 .func NVRAM_Xfer2, NVRAM_XFER2
4457 NVRAM_XFER2:
4458         stmdb   sp!, {r4, r5, r6, lr}
4459         ldr     r4, =SP_BASE
4460         mov     r3, #0
4461         cmp     r0, #0
4462         bls     _local2
4463         ldr     r5, =NVRAM_SCRATCH
4464 _local4:
4465         ldrb    r6, [r5, r3]
4466         str     r6, [r4, #SP_TDR]
4467 _local3:
4468         ldr     r6, [r4, #SP_SR]
4469         tst     r6, #SP_TDRE
4470         beq     _local3
4471         add     r3, r3, #1
4472         cmp     r3, r0 /* r0 is # of bytes to send out (command+addr) */
4473         blo     _local4
4474 _local2:
4475         mov     r3, #SPI_8CLOCKS
4476         str     r3, [r4, #SP_TDR]
4477         ldr     r0, [r4, #SP_RDR]
4478 _local5:
4479         ldr     r0, [r4, #SP_SR]
4480         tst     r0, #SP_RDRF
4481         beq     _local5
4482         ldr     r0, [r4, #SP_RDR] /* what's this byte?  It's the byte read while writing the TDR -- nonsense, because the NVRAM doesn't read and write at the same time */
4483         mov     r0, #0
4484         cmp     r2, #0  /* r2 is # of bytes to copy in */
4485         bls     _local6
4486 _local7:
4487         ldr     r5, [r4, #SP_SR]
4488         tst     r5, #SP_TDRE
4489         beq     _local7
4490         str     r3, [r4, #SP_TDR]  /* r3 has SPI_8CLOCKS */
4491 _local8:
4492         ldr     r5, [r4, #SP_SR]
4493         tst     r5, #SP_RDRF
4494         beq     _local8
4495         ldr     r5, [r4, #SP_RDR] /* but didn't we read this byte above? */
4496         strb    r5, [r1], #1 /* postindexed */
4497         add     r0, r0, #1
4498         cmp     r0, r2
4499         blo     _local7 /* since we don't send another address, the NVRAM must be capable of sequential reads */
4500 _local6:
4501         mov     r0, #200
4502         bl      DELAY9
4503         ldmia   sp!, {r4, r5, r6, lr}
4504         bx      lr
4505 #endif