1 /*** -*- linux-c -*- **********************************************************
2 
3      Driver for Atmel at76c502 at76c504 and at76c506 wireless cards.
4 
5 	Copyright 2000-2001 ATMEL Corporation.
6 	Copyright 2003-2004 Simon Kelley.
7 
8     This code was developed from version 2.1.1 of the Atmel drivers,
9     released by Atmel corp. under the GPL in December 2002. It also
10     includes code from the Linux aironet drivers (C) Benjamin Reed,
11     and the Linux PCMCIA package, (C) David Hinds and the Linux wireless
12     extensions, (C) Jean Tourrilhes.
13 
14     The firmware module for reading the MAC address of the card comes from
15     net.russotto.AtmelMACFW, written by Matthew T. Russotto and copyright
16     by him. net.russotto.AtmelMACFW is used under the GPL license version 2.
17     This file contains the module in binary form and, under the terms
18     of the GPL, in source form. The source is located at the end of the file.
19 
20     This program is free software; you can redistribute it and/or modify
21     it under the terms of the GNU General Public License as published by
22     the Free Software Foundation; either version 2 of the License, or
23     (at your option) any later version.
24 
25     This software is distributed in the hope that it will be useful,
26     but WITHOUT ANY WARRANTY; without even the implied warranty of
27     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
28     GNU General Public License for more details.
29 
30     You should have received a copy of the GNU General Public License
31     along with Atmel wireless lan drivers; if not, see
32     <http://www.gnu.org/licenses/>.
33 
34     For all queries about this code, please contact the current author,
35     Simon Kelley <simon@thekelleys.org.uk> and not Atmel Corporation.
36 
37     Credit is due to HP UK and Cambridge Online Systems Ltd for supplying
38     hardware used during development of this driver.
39 
40 ******************************************************************************/
41 
42 #include <linux/interrupt.h>
43 
44 #include <linux/kernel.h>
45 #include <linux/ptrace.h>
46 #include <linux/slab.h>
47 #include <linux/string.h>
48 #include <linux/timer.h>
49 #include <asm/byteorder.h>
50 #include <asm/io.h>
51 #include <linux/uaccess.h>
52 #include <linux/module.h>
53 #include <linux/netdevice.h>
54 #include <linux/etherdevice.h>
55 #include <linux/skbuff.h>
56 #include <linux/if_arp.h>
57 #include <linux/ioport.h>
58 #include <linux/fcntl.h>
59 #include <linux/delay.h>
60 #include <linux/wireless.h>
61 #include <net/iw_handler.h>
62 #include <linux/crc32.h>
63 #include <linux/proc_fs.h>
64 #include <linux/seq_file.h>
65 #include <linux/device.h>
66 #include <linux/moduleparam.h>
67 #include <linux/firmware.h>
68 #include <linux/jiffies.h>
69 #include <net/cfg80211.h>
70 #include "atmel.h"
71 
72 #define DRIVER_MAJOR 0
73 #define DRIVER_MINOR 98
74 
75 MODULE_AUTHOR("Simon Kelley");
76 MODULE_DESCRIPTION("Support for Atmel at76c50x 802.11 wireless ethernet cards.");
77 MODULE_LICENSE("GPL");
78 
79 /* The name of the firmware file to be loaded
80    over-rides any automatic selection */
81 static char *firmware = NULL;
82 module_param(firmware, charp, 0);
83 
84 /* table of firmware file names */
85 static struct {
86 	AtmelFWType fw_type;
87 	const char *fw_file;
88 	const char *fw_file_ext;
89 } fw_table[] = {
90 	{ ATMEL_FW_TYPE_502,		"atmel_at76c502",	"bin" },
91 	{ ATMEL_FW_TYPE_502D,		"atmel_at76c502d",	"bin" },
92 	{ ATMEL_FW_TYPE_502E,		"atmel_at76c502e",	"bin" },
93 	{ ATMEL_FW_TYPE_502_3COM,	"atmel_at76c502_3com",	"bin" },
94 	{ ATMEL_FW_TYPE_504,		"atmel_at76c504",	"bin" },
95 	{ ATMEL_FW_TYPE_504_2958,	"atmel_at76c504_2958",	"bin" },
96 	{ ATMEL_FW_TYPE_504A_2958,	"atmel_at76c504a_2958",	"bin" },
97 	{ ATMEL_FW_TYPE_506,		"atmel_at76c506",	"bin" },
98 	{ ATMEL_FW_TYPE_NONE,		NULL,			NULL }
99 };
100 MODULE_FIRMWARE("atmel_at76c502-wpa.bin");
101 MODULE_FIRMWARE("atmel_at76c502.bin");
102 MODULE_FIRMWARE("atmel_at76c502d-wpa.bin");
103 MODULE_FIRMWARE("atmel_at76c502d.bin");
104 MODULE_FIRMWARE("atmel_at76c502e-wpa.bin");
105 MODULE_FIRMWARE("atmel_at76c502e.bin");
106 MODULE_FIRMWARE("atmel_at76c502_3com-wpa.bin");
107 MODULE_FIRMWARE("atmel_at76c502_3com.bin");
108 MODULE_FIRMWARE("atmel_at76c504-wpa.bin");
109 MODULE_FIRMWARE("atmel_at76c504.bin");
110 MODULE_FIRMWARE("atmel_at76c504_2958-wpa.bin");
111 MODULE_FIRMWARE("atmel_at76c504_2958.bin");
112 MODULE_FIRMWARE("atmel_at76c504a_2958-wpa.bin");
113 MODULE_FIRMWARE("atmel_at76c504a_2958.bin");
114 MODULE_FIRMWARE("atmel_at76c506-wpa.bin");
115 MODULE_FIRMWARE("atmel_at76c506.bin");
116 
117 #define MAX_SSID_LENGTH 32
118 #define MGMT_JIFFIES (256 * HZ / 100)
119 
120 #define MAX_BSS_ENTRIES	64
121 
122 /* registers */
123 #define GCR  0x00    /* (SIR0)  General Configuration Register */
124 #define BSR  0x02    /* (SIR1)  Bank Switching Select Register */
125 #define AR   0x04
126 #define DR   0x08
127 #define MR1  0x12    /* Mirror Register 1 */
128 #define MR2  0x14    /* Mirror Register 2 */
129 #define MR3  0x16    /* Mirror Register 3 */
130 #define MR4  0x18    /* Mirror Register 4 */
131 
132 #define GPR1                            0x0c
133 #define GPR2                            0x0e
134 #define GPR3                            0x10
135 /*
136  * Constants for the GCR register.
137  */
138 #define GCR_REMAP     0x0400          /* Remap internal SRAM to 0 */
139 #define GCR_SWRES     0x0080          /* BIU reset (ARM and PAI are NOT reset) */
140 #define GCR_CORES     0x0060          /* Core Reset (ARM and PAI are reset) */
141 #define GCR_ENINT     0x0002          /* Enable Interrupts */
142 #define GCR_ACKINT    0x0008          /* Acknowledge Interrupts */
143 
144 #define BSS_SRAM      0x0200          /* AMBA module selection --> SRAM */
145 #define BSS_IRAM      0x0100          /* AMBA module selection --> IRAM */
146 /*
147  *Constants for the MR registers.
148  */
149 #define MAC_INIT_COMPLETE       0x0001        /* MAC init has been completed */
150 #define MAC_BOOT_COMPLETE       0x0010        /* MAC boot has been completed */
151 #define MAC_INIT_OK             0x0002        /* MAC boot has been completed */
152 
153 #define MIB_MAX_DATA_BYTES    212
154 #define MIB_HEADER_SIZE       4    /* first four fields */
155 
156 struct get_set_mib {
157 	u8 type;
158 	u8 size;
159 	u8 index;
160 	u8 reserved;
161 	u8 data[MIB_MAX_DATA_BYTES];
162 };
163 
164 struct rx_desc {
165 	u32          Next;
166 	u16          MsduPos;
167 	u16          MsduSize;
168 
169 	u8           State;
170 	u8           Status;
171 	u8           Rate;
172 	u8           Rssi;
173 	u8           LinkQuality;
174 	u8           PreambleType;
175 	u16          Duration;
176 	u32          RxTime;
177 };
178 
179 #define RX_DESC_FLAG_VALID       0x80
180 #define RX_DESC_FLAG_CONSUMED    0x40
181 #define RX_DESC_FLAG_IDLE        0x00
182 
183 #define RX_STATUS_SUCCESS        0x00
184 
185 #define RX_DESC_MSDU_POS_OFFSET      4
186 #define RX_DESC_MSDU_SIZE_OFFSET     6
187 #define RX_DESC_FLAGS_OFFSET         8
188 #define RX_DESC_STATUS_OFFSET        9
189 #define RX_DESC_RSSI_OFFSET          11
190 #define RX_DESC_LINK_QUALITY_OFFSET  12
191 #define RX_DESC_PREAMBLE_TYPE_OFFSET 13
192 #define RX_DESC_DURATION_OFFSET      14
193 #define RX_DESC_RX_TIME_OFFSET       16
194 
195 struct tx_desc {
196 	u32       NextDescriptor;
197 	u16       TxStartOfFrame;
198 	u16       TxLength;
199 
200 	u8        TxState;
201 	u8        TxStatus;
202 	u8        RetryCount;
203 
204 	u8        TxRate;
205 
206 	u8        KeyIndex;
207 	u8        ChiperType;
208 	u8        ChipreLength;
209 	u8        Reserved1;
210 
211 	u8        Reserved;
212 	u8        PacketType;
213 	u16       HostTxLength;
214 };
215 
216 #define TX_DESC_NEXT_OFFSET          0
217 #define TX_DESC_POS_OFFSET           4
218 #define TX_DESC_SIZE_OFFSET          6
219 #define TX_DESC_FLAGS_OFFSET         8
220 #define TX_DESC_STATUS_OFFSET        9
221 #define TX_DESC_RETRY_OFFSET         10
222 #define TX_DESC_RATE_OFFSET          11
223 #define TX_DESC_KEY_INDEX_OFFSET     12
224 #define TX_DESC_CIPHER_TYPE_OFFSET   13
225 #define TX_DESC_CIPHER_LENGTH_OFFSET 14
226 #define TX_DESC_PACKET_TYPE_OFFSET   17
227 #define TX_DESC_HOST_LENGTH_OFFSET   18
228 
229 /*
230  * Host-MAC interface
231  */
232 
233 #define TX_STATUS_SUCCESS       0x00
234 
235 #define TX_FIRM_OWN             0x80
236 #define TX_DONE                 0x40
237 
238 #define TX_ERROR                0x01
239 
240 #define TX_PACKET_TYPE_DATA     0x01
241 #define TX_PACKET_TYPE_MGMT     0x02
242 
243 #define ISR_EMPTY               0x00        /* no bits set in ISR */
244 #define ISR_TxCOMPLETE          0x01        /* packet transmitted */
245 #define ISR_RxCOMPLETE          0x02        /* packet received */
246 #define ISR_RxFRAMELOST         0x04        /* Rx Frame lost */
247 #define ISR_FATAL_ERROR         0x08        /* Fatal error */
248 #define ISR_COMMAND_COMPLETE    0x10        /* command completed */
249 #define ISR_OUT_OF_RANGE        0x20        /* command completed */
250 #define ISR_IBSS_MERGE          0x40        /* (4.1.2.30): IBSS merge */
251 #define ISR_GENERIC_IRQ         0x80
252 
253 #define Local_Mib_Type          0x01
254 #define Mac_Address_Mib_Type    0x02
255 #define Mac_Mib_Type            0x03
256 #define Statistics_Mib_Type     0x04
257 #define Mac_Mgmt_Mib_Type       0x05
258 #define Mac_Wep_Mib_Type        0x06
259 #define Phy_Mib_Type            0x07
260 #define Multi_Domain_MIB        0x08
261 
262 #define MAC_MGMT_MIB_CUR_BSSID_POS            14
263 #define MAC_MIB_FRAG_THRESHOLD_POS            8
264 #define MAC_MIB_RTS_THRESHOLD_POS             10
265 #define MAC_MIB_SHORT_RETRY_POS               16
266 #define MAC_MIB_LONG_RETRY_POS                17
267 #define MAC_MIB_SHORT_RETRY_LIMIT_POS         16
268 #define MAC_MGMT_MIB_BEACON_PER_POS           0
269 #define MAC_MGMT_MIB_STATION_ID_POS           6
270 #define MAC_MGMT_MIB_CUR_PRIVACY_POS          11
271 #define MAC_MGMT_MIB_CUR_BSSID_POS            14
272 #define MAC_MGMT_MIB_PS_MODE_POS              53
273 #define MAC_MGMT_MIB_LISTEN_INTERVAL_POS      54
274 #define MAC_MGMT_MIB_MULTI_DOMAIN_IMPLEMENTED 56
275 #define MAC_MGMT_MIB_MULTI_DOMAIN_ENABLED     57
276 #define PHY_MIB_CHANNEL_POS                   14
277 #define PHY_MIB_RATE_SET_POS                  20
278 #define PHY_MIB_REG_DOMAIN_POS                26
279 #define LOCAL_MIB_AUTO_TX_RATE_POS            3
280 #define LOCAL_MIB_SSID_SIZE                   5
281 #define LOCAL_MIB_TX_PROMISCUOUS_POS          6
282 #define LOCAL_MIB_TX_MGMT_RATE_POS            7
283 #define LOCAL_MIB_TX_CONTROL_RATE_POS         8
284 #define LOCAL_MIB_PREAMBLE_TYPE               9
285 #define MAC_ADDR_MIB_MAC_ADDR_POS             0
286 
287 #define         CMD_Set_MIB_Vars              0x01
288 #define         CMD_Get_MIB_Vars              0x02
289 #define         CMD_Scan                      0x03
290 #define         CMD_Join                      0x04
291 #define         CMD_Start                     0x05
292 #define         CMD_EnableRadio               0x06
293 #define         CMD_DisableRadio              0x07
294 #define         CMD_SiteSurvey                0x0B
295 
296 #define         CMD_STATUS_IDLE                   0x00
297 #define         CMD_STATUS_COMPLETE               0x01
298 #define         CMD_STATUS_UNKNOWN                0x02
299 #define         CMD_STATUS_INVALID_PARAMETER      0x03
300 #define         CMD_STATUS_FUNCTION_NOT_SUPPORTED 0x04
301 #define         CMD_STATUS_TIME_OUT               0x07
302 #define         CMD_STATUS_IN_PROGRESS            0x08
303 #define         CMD_STATUS_REJECTED_RADIO_OFF     0x09
304 #define         CMD_STATUS_HOST_ERROR             0xFF
305 #define         CMD_STATUS_BUSY                   0xFE
306 
307 #define CMD_BLOCK_COMMAND_OFFSET        0
308 #define CMD_BLOCK_STATUS_OFFSET         1
309 #define CMD_BLOCK_PARAMETERS_OFFSET     4
310 
311 #define SCAN_OPTIONS_SITE_SURVEY        0x80
312 
313 #define MGMT_FRAME_BODY_OFFSET		24
314 #define MAX_AUTHENTICATION_RETRIES	3
315 #define MAX_ASSOCIATION_RETRIES		3
316 
317 #define AUTHENTICATION_RESPONSE_TIME_OUT  1000
318 
319 #define MAX_WIRELESS_BODY  2316 /* mtu is 2312, CRC is 4 */
320 #define LOOP_RETRY_LIMIT   500000
321 
322 #define ACTIVE_MODE	1
323 #define PS_MODE		2
324 
325 #define MAX_ENCRYPTION_KEYS 4
326 #define MAX_ENCRYPTION_KEY_SIZE 40
327 
328 /*
329  * 802.11 related definitions
330  */
331 
332 /*
333  * Regulatory Domains
334  */
335 
336 #define REG_DOMAIN_FCC		0x10	/* Channels	1-11	USA				*/
337 #define REG_DOMAIN_DOC		0x20	/* Channel	1-11	Canada				*/
338 #define REG_DOMAIN_ETSI		0x30	/* Channel	1-13	Europe (ex Spain/France)	*/
339 #define REG_DOMAIN_SPAIN	0x31	/* Channel	10-11	Spain				*/
340 #define REG_DOMAIN_FRANCE	0x32	/* Channel	10-13	France				*/
341 #define REG_DOMAIN_MKK		0x40	/* Channel	14	Japan				*/
342 #define REG_DOMAIN_MKK1		0x41	/* Channel	1-14	Japan(MKK1)			*/
343 #define REG_DOMAIN_ISRAEL	0x50	/* Channel	3-9	ISRAEL				*/
344 
345 #define BSS_TYPE_AD_HOC		1
346 #define BSS_TYPE_INFRASTRUCTURE 2
347 
348 #define SCAN_TYPE_ACTIVE	0
349 #define SCAN_TYPE_PASSIVE	1
350 
351 #define LONG_PREAMBLE		0
352 #define SHORT_PREAMBLE		1
353 #define AUTO_PREAMBLE		2
354 
355 #define DATA_FRAME_WS_HEADER_SIZE   30
356 
357 /* promiscuous mode control */
358 #define PROM_MODE_OFF			0x0
359 #define PROM_MODE_UNKNOWN		0x1
360 #define PROM_MODE_CRC_FAILED		0x2
361 #define PROM_MODE_DUPLICATED		0x4
362 #define PROM_MODE_MGMT			0x8
363 #define PROM_MODE_CTRL			0x10
364 #define PROM_MODE_BAD_PROTOCOL		0x20
365 
366 #define IFACE_INT_STATUS_OFFSET		0
367 #define IFACE_INT_MASK_OFFSET		1
368 #define IFACE_LOCKOUT_HOST_OFFSET	2
369 #define IFACE_LOCKOUT_MAC_OFFSET	3
370 #define IFACE_FUNC_CTRL_OFFSET		28
371 #define IFACE_MAC_STAT_OFFSET		30
372 #define IFACE_GENERIC_INT_TYPE_OFFSET	32
373 
374 #define CIPHER_SUITE_NONE     0
375 #define CIPHER_SUITE_WEP_64   1
376 #define CIPHER_SUITE_TKIP     2
377 #define CIPHER_SUITE_AES      3
378 #define CIPHER_SUITE_CCX      4
379 #define CIPHER_SUITE_WEP_128  5
380 
381 /*
382  * IFACE MACROS & definitions
383  */
384 
385 /*
386  * FuncCtrl field:
387  */
388 #define FUNC_CTRL_TxENABLE		0x10
389 #define FUNC_CTRL_RxENABLE		0x20
390 #define FUNC_CTRL_INIT_COMPLETE		0x01
391 
392 /* A stub firmware image which reads the MAC address from NVRAM on the card.
393    For copyright information and source see the end of this file. */
394 static u8 mac_reader[] = {
395 	0x06, 0x00, 0x00, 0xea, 0x04, 0x00, 0x00, 0xea, 0x03, 0x00, 0x00, 0xea, 0x02, 0x00, 0x00, 0xea,
396 	0x01, 0x00, 0x00, 0xea, 0x00, 0x00, 0x00, 0xea, 0xff, 0xff, 0xff, 0xea, 0xfe, 0xff, 0xff, 0xea,
397 	0xd3, 0x00, 0xa0, 0xe3, 0x00, 0xf0, 0x21, 0xe1, 0x0e, 0x04, 0xa0, 0xe3, 0x00, 0x10, 0xa0, 0xe3,
398 	0x81, 0x11, 0xa0, 0xe1, 0x00, 0x10, 0x81, 0xe3, 0x00, 0x10, 0x80, 0xe5, 0x1c, 0x10, 0x90, 0xe5,
399 	0x10, 0x10, 0xc1, 0xe3, 0x1c, 0x10, 0x80, 0xe5, 0x01, 0x10, 0xa0, 0xe3, 0x08, 0x10, 0x80, 0xe5,
400 	0x02, 0x03, 0xa0, 0xe3, 0x00, 0x10, 0xa0, 0xe3, 0xb0, 0x10, 0xc0, 0xe1, 0xb4, 0x10, 0xc0, 0xe1,
401 	0xb8, 0x10, 0xc0, 0xe1, 0xbc, 0x10, 0xc0, 0xe1, 0x56, 0xdc, 0xa0, 0xe3, 0x21, 0x00, 0x00, 0xeb,
402 	0x0a, 0x00, 0xa0, 0xe3, 0x1a, 0x00, 0x00, 0xeb, 0x10, 0x00, 0x00, 0xeb, 0x07, 0x00, 0x00, 0xeb,
403 	0x02, 0x03, 0xa0, 0xe3, 0x02, 0x14, 0xa0, 0xe3, 0xb4, 0x10, 0xc0, 0xe1, 0x4c, 0x10, 0x9f, 0xe5,
404 	0xbc, 0x10, 0xc0, 0xe1, 0x10, 0x10, 0xa0, 0xe3, 0xb8, 0x10, 0xc0, 0xe1, 0xfe, 0xff, 0xff, 0xea,
405 	0x00, 0x40, 0x2d, 0xe9, 0x00, 0x20, 0xa0, 0xe3, 0x02, 0x3c, 0xa0, 0xe3, 0x00, 0x10, 0xa0, 0xe3,
406 	0x28, 0x00, 0x9f, 0xe5, 0x37, 0x00, 0x00, 0xeb, 0x00, 0x40, 0xbd, 0xe8, 0x1e, 0xff, 0x2f, 0xe1,
407 	0x00, 0x40, 0x2d, 0xe9, 0x12, 0x2e, 0xa0, 0xe3, 0x06, 0x30, 0xa0, 0xe3, 0x00, 0x10, 0xa0, 0xe3,
408 	0x02, 0x04, 0xa0, 0xe3, 0x2f, 0x00, 0x00, 0xeb, 0x00, 0x40, 0xbd, 0xe8, 0x1e, 0xff, 0x2f, 0xe1,
409 	0x00, 0x02, 0x00, 0x02, 0x80, 0x01, 0x90, 0xe0, 0x01, 0x00, 0x00, 0x0a, 0x01, 0x00, 0x50, 0xe2,
410 	0xfc, 0xff, 0xff, 0xea, 0x1e, 0xff, 0x2f, 0xe1, 0x80, 0x10, 0xa0, 0xe3, 0xf3, 0x06, 0xa0, 0xe3,
411 	0x00, 0x10, 0x80, 0xe5, 0x00, 0x10, 0xa0, 0xe3, 0x00, 0x10, 0x80, 0xe5, 0x01, 0x10, 0xa0, 0xe3,
412 	0x04, 0x10, 0x80, 0xe5, 0x00, 0x10, 0x80, 0xe5, 0x0e, 0x34, 0xa0, 0xe3, 0x1c, 0x10, 0x93, 0xe5,
413 	0x02, 0x1a, 0x81, 0xe3, 0x1c, 0x10, 0x83, 0xe5, 0x58, 0x11, 0x9f, 0xe5, 0x30, 0x10, 0x80, 0xe5,
414 	0x54, 0x11, 0x9f, 0xe5, 0x34, 0x10, 0x80, 0xe5, 0x38, 0x10, 0x80, 0xe5, 0x3c, 0x10, 0x80, 0xe5,
415 	0x10, 0x10, 0x90, 0xe5, 0x08, 0x00, 0x90, 0xe5, 0x1e, 0xff, 0x2f, 0xe1, 0xf3, 0x16, 0xa0, 0xe3,
416 	0x08, 0x00, 0x91, 0xe5, 0x05, 0x00, 0xa0, 0xe3, 0x0c, 0x00, 0x81, 0xe5, 0x10, 0x00, 0x91, 0xe5,
417 	0x02, 0x00, 0x10, 0xe3, 0xfc, 0xff, 0xff, 0x0a, 0xff, 0x00, 0xa0, 0xe3, 0x0c, 0x00, 0x81, 0xe5,
418 	0x10, 0x00, 0x91, 0xe5, 0x02, 0x00, 0x10, 0xe3, 0xfc, 0xff, 0xff, 0x0a, 0x08, 0x00, 0x91, 0xe5,
419 	0x10, 0x00, 0x91, 0xe5, 0x01, 0x00, 0x10, 0xe3, 0xfc, 0xff, 0xff, 0x0a, 0x08, 0x00, 0x91, 0xe5,
420 	0xff, 0x00, 0x00, 0xe2, 0x1e, 0xff, 0x2f, 0xe1, 0x30, 0x40, 0x2d, 0xe9, 0x00, 0x50, 0xa0, 0xe1,
421 	0x03, 0x40, 0xa0, 0xe1, 0xa2, 0x02, 0xa0, 0xe1, 0x08, 0x00, 0x00, 0xe2, 0x03, 0x00, 0x80, 0xe2,
422 	0xd8, 0x10, 0x9f, 0xe5, 0x00, 0x00, 0xc1, 0xe5, 0x01, 0x20, 0xc1, 0xe5, 0xe2, 0xff, 0xff, 0xeb,
423 	0x01, 0x00, 0x10, 0xe3, 0xfc, 0xff, 0xff, 0x1a, 0x14, 0x00, 0xa0, 0xe3, 0xc4, 0xff, 0xff, 0xeb,
424 	0x04, 0x20, 0xa0, 0xe1, 0x05, 0x10, 0xa0, 0xe1, 0x02, 0x00, 0xa0, 0xe3, 0x01, 0x00, 0x00, 0xeb,
425 	0x30, 0x40, 0xbd, 0xe8, 0x1e, 0xff, 0x2f, 0xe1, 0x70, 0x40, 0x2d, 0xe9, 0xf3, 0x46, 0xa0, 0xe3,
426 	0x00, 0x30, 0xa0, 0xe3, 0x00, 0x00, 0x50, 0xe3, 0x08, 0x00, 0x00, 0x9a, 0x8c, 0x50, 0x9f, 0xe5,
427 	0x03, 0x60, 0xd5, 0xe7, 0x0c, 0x60, 0x84, 0xe5, 0x10, 0x60, 0x94, 0xe5, 0x02, 0x00, 0x16, 0xe3,
428 	0xfc, 0xff, 0xff, 0x0a, 0x01, 0x30, 0x83, 0xe2, 0x00, 0x00, 0x53, 0xe1, 0xf7, 0xff, 0xff, 0x3a,
429 	0xff, 0x30, 0xa0, 0xe3, 0x0c, 0x30, 0x84, 0xe5, 0x08, 0x00, 0x94, 0xe5, 0x10, 0x00, 0x94, 0xe5,
430 	0x01, 0x00, 0x10, 0xe3, 0xfc, 0xff, 0xff, 0x0a, 0x08, 0x00, 0x94, 0xe5, 0x00, 0x00, 0xa0, 0xe3,
431 	0x00, 0x00, 0x52, 0xe3, 0x0b, 0x00, 0x00, 0x9a, 0x10, 0x50, 0x94, 0xe5, 0x02, 0x00, 0x15, 0xe3,
432 	0xfc, 0xff, 0xff, 0x0a, 0x0c, 0x30, 0x84, 0xe5, 0x10, 0x50, 0x94, 0xe5, 0x01, 0x00, 0x15, 0xe3,
433 	0xfc, 0xff, 0xff, 0x0a, 0x08, 0x50, 0x94, 0xe5, 0x01, 0x50, 0xc1, 0xe4, 0x01, 0x00, 0x80, 0xe2,
434 	0x02, 0x00, 0x50, 0xe1, 0xf3, 0xff, 0xff, 0x3a, 0xc8, 0x00, 0xa0, 0xe3, 0x98, 0xff, 0xff, 0xeb,
435 	0x70, 0x40, 0xbd, 0xe8, 0x1e, 0xff, 0x2f, 0xe1, 0x01, 0x0c, 0x00, 0x02, 0x01, 0x02, 0x00, 0x02,
436 	0x00, 0x01, 0x00, 0x02
437 };
438 
439 struct atmel_private {
440 	void *card; /* Bus dependent structure varies for PCcard */
441 	int (*present_callback)(void *); /* And callback which uses it */
442 	char firmware_id[32];
443 	AtmelFWType firmware_type;
444 	u8 *firmware;
445 	int firmware_length;
446 	struct timer_list management_timer;
447 	struct net_device *dev;
448 	struct device *sys_dev;
449 	struct iw_statistics wstats;
450 	spinlock_t irqlock, timerlock;	/* spinlocks */
451 	enum { BUS_TYPE_PCCARD, BUS_TYPE_PCI } bus_type;
452 	enum {
453 		CARD_TYPE_PARALLEL_FLASH,
454 		CARD_TYPE_SPI_FLASH,
455 		CARD_TYPE_EEPROM
456 	} card_type;
457 	int do_rx_crc; /* If we need to CRC incoming packets */
458 	int probe_crc; /* set if we don't yet know */
459 	int crc_ok_cnt, crc_ko_cnt; /* counters for probing */
460 	u16 rx_desc_head;
461 	u16 tx_desc_free, tx_desc_head, tx_desc_tail, tx_desc_previous;
462 	u16 tx_free_mem, tx_buff_head, tx_buff_tail;
463 
464 	u16 frag_seq, frag_len, frag_no;
465 	u8 frag_source[6];
466 
467 	u8 wep_is_on, default_key, exclude_unencrypted, encryption_level;
468 	u8 group_cipher_suite, pairwise_cipher_suite;
469 	u8 wep_keys[MAX_ENCRYPTION_KEYS][MAX_ENCRYPTION_KEY_SIZE];
470 	int wep_key_len[MAX_ENCRYPTION_KEYS];
471 	int use_wpa, radio_on_broken; /* firmware dependent stuff. */
472 
473 	u16 host_info_base;
474 	struct host_info_struct {
475 		/* NB this is matched to the hardware, don't change. */
476 		u8 volatile int_status;
477 		u8 volatile int_mask;
478 		u8 volatile lockout_host;
479 		u8 volatile lockout_mac;
480 
481 		u16 tx_buff_pos;
482 		u16 tx_buff_size;
483 		u16 tx_desc_pos;
484 		u16 tx_desc_count;
485 
486 		u16 rx_buff_pos;
487 		u16 rx_buff_size;
488 		u16 rx_desc_pos;
489 		u16 rx_desc_count;
490 
491 		u16 build_version;
492 		u16 command_pos;
493 
494 		u16 major_version;
495 		u16 minor_version;
496 
497 		u16 func_ctrl;
498 		u16 mac_status;
499 		u16 generic_IRQ_type;
500 		u8  reserved[2];
501 	} host_info;
502 
503 	enum {
504 		STATION_STATE_SCANNING,
505 		STATION_STATE_JOINNING,
506 		STATION_STATE_AUTHENTICATING,
507 		STATION_STATE_ASSOCIATING,
508 		STATION_STATE_READY,
509 		STATION_STATE_REASSOCIATING,
510 		STATION_STATE_DOWN,
511 		STATION_STATE_MGMT_ERROR
512 	} station_state;
513 
514 	int operating_mode, power_mode;
515 	unsigned long last_qual;
516 	int beacons_this_sec;
517 	int channel;
518 	int reg_domain, config_reg_domain;
519 	int tx_rate;
520 	int auto_tx_rate;
521 	int rts_threshold;
522 	int frag_threshold;
523 	int long_retry, short_retry;
524 	int preamble;
525 	int default_beacon_period, beacon_period, listen_interval;
526 	int CurrentAuthentTransactionSeqNum, ExpectedAuthentTransactionSeqNum;
527 	int AuthenticationRequestRetryCnt, AssociationRequestRetryCnt, ReAssociationRequestRetryCnt;
528 	enum {
529 		SITE_SURVEY_IDLE,
530 		SITE_SURVEY_IN_PROGRESS,
531 		SITE_SURVEY_COMPLETED
532 	} site_survey_state;
533 	unsigned long last_survey;
534 
535 	int station_was_associated, station_is_associated;
536 	int fast_scan;
537 
538 	struct bss_info {
539 		int channel;
540 		int SSIDsize;
541 		int RSSI;
542 		int UsingWEP;
543 		int preamble;
544 		int beacon_period;
545 		int BSStype;
546 		u8 BSSID[6];
547 		u8 SSID[MAX_SSID_LENGTH];
548 	} BSSinfo[MAX_BSS_ENTRIES];
549 	int BSS_list_entries, current_BSS;
550 	int connect_to_any_BSS;
551 	int SSID_size, new_SSID_size;
552 	u8 CurrentBSSID[6], BSSID[6];
553 	u8 SSID[MAX_SSID_LENGTH], new_SSID[MAX_SSID_LENGTH];
554 	u64 last_beacon_timestamp;
555 	u8 rx_buf[MAX_WIRELESS_BODY];
556 };
557 
558 static u8 atmel_basic_rates[4] = {0x82, 0x84, 0x0b, 0x16};
559 
560 static const struct {
561 	int reg_domain;
562 	int min, max;
563 	char *name;
564 } channel_table[] = { { REG_DOMAIN_FCC, 1, 11, "USA" },
565 		      { REG_DOMAIN_DOC, 1, 11, "Canada" },
566 		      { REG_DOMAIN_ETSI, 1, 13, "Europe" },
567 		      { REG_DOMAIN_SPAIN, 10, 11, "Spain" },
568 		      { REG_DOMAIN_FRANCE, 10, 13, "France" },
569 		      { REG_DOMAIN_MKK, 14, 14, "MKK" },
570 		      { REG_DOMAIN_MKK1, 1, 14, "MKK1" },
571 		      { REG_DOMAIN_ISRAEL, 3, 9, "Israel"} };
572 
573 static void build_wpa_mib(struct atmel_private *priv);
574 static int atmel_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
575 static void atmel_copy_to_card(struct net_device *dev, u16 dest,
576 			       const unsigned char *src, u16 len);
577 static void atmel_copy_to_host(struct net_device *dev, unsigned char *dest,
578 			       u16 src, u16 len);
579 static void atmel_set_gcr(struct net_device *dev, u16 mask);
580 static void atmel_clear_gcr(struct net_device *dev, u16 mask);
581 static int atmel_lock_mac(struct atmel_private *priv);
582 static void atmel_wmem32(struct atmel_private *priv, u16 pos, u32 data);
583 static void atmel_command_irq(struct atmel_private *priv);
584 static int atmel_validate_channel(struct atmel_private *priv, int channel);
585 static void atmel_management_frame(struct atmel_private *priv,
586 				   struct ieee80211_hdr *header,
587 				   u16 frame_len, u8 rssi);
588 static void atmel_management_timer(struct timer_list *t);
589 static void atmel_send_command(struct atmel_private *priv, int command,
590 			       void *cmd, int cmd_size);
591 static int atmel_send_command_wait(struct atmel_private *priv, int command,
592 				   void *cmd, int cmd_size);
593 static void atmel_transmit_management_frame(struct atmel_private *priv,
594 					    struct ieee80211_hdr *header,
595 					    u8 *body, int body_len);
596 
597 static u8 atmel_get_mib8(struct atmel_private *priv, u8 type, u8 index);
598 static void atmel_set_mib8(struct atmel_private *priv, u8 type, u8 index,
599 			   u8 data);
600 static void atmel_set_mib16(struct atmel_private *priv, u8 type, u8 index,
601 			    u16 data);
602 static void atmel_set_mib(struct atmel_private *priv, u8 type, u8 index,
603 			  const u8 *data, int data_len);
604 static void atmel_get_mib(struct atmel_private *priv, u8 type, u8 index,
605 			  u8 *data, int data_len);
606 static void atmel_scan(struct atmel_private *priv, int specific_ssid);
607 static void atmel_join_bss(struct atmel_private *priv, int bss_index);
608 static void atmel_smooth_qual(struct atmel_private *priv);
609 static void atmel_writeAR(struct net_device *dev, u16 data);
610 static int probe_atmel_card(struct net_device *dev);
611 static int reset_atmel_card(struct net_device *dev);
612 static void atmel_enter_state(struct atmel_private *priv, int new_state);
613 int atmel_open (struct net_device *dev);
614 
atmel_hi(struct atmel_private * priv,u16 offset)615 static inline u16 atmel_hi(struct atmel_private *priv, u16 offset)
616 {
617 	return priv->host_info_base + offset;
618 }
619 
atmel_co(struct atmel_private * priv,u16 offset)620 static inline u16 atmel_co(struct atmel_private *priv, u16 offset)
621 {
622 	return priv->host_info.command_pos + offset;
623 }
624 
atmel_rx(struct atmel_private * priv,u16 offset,u16 desc)625 static inline u16 atmel_rx(struct atmel_private *priv, u16 offset, u16 desc)
626 {
627 	return priv->host_info.rx_desc_pos + (sizeof(struct rx_desc) * desc) + offset;
628 }
629 
atmel_tx(struct atmel_private * priv,u16 offset,u16 desc)630 static inline u16 atmel_tx(struct atmel_private *priv, u16 offset, u16 desc)
631 {
632 	return priv->host_info.tx_desc_pos + (sizeof(struct tx_desc) * desc) + offset;
633 }
634 
atmel_read8(struct net_device * dev,u16 offset)635 static inline u8 atmel_read8(struct net_device *dev, u16 offset)
636 {
637 	return inb(dev->base_addr + offset);
638 }
639 
atmel_write8(struct net_device * dev,u16 offset,u8 data)640 static inline void atmel_write8(struct net_device *dev, u16 offset, u8 data)
641 {
642 	outb(data, dev->base_addr + offset);
643 }
644 
atmel_read16(struct net_device * dev,u16 offset)645 static inline u16 atmel_read16(struct net_device *dev, u16 offset)
646 {
647 	return inw(dev->base_addr + offset);
648 }
649 
atmel_write16(struct net_device * dev,u16 offset,u16 data)650 static inline void atmel_write16(struct net_device *dev, u16 offset, u16 data)
651 {
652 	outw(data, dev->base_addr + offset);
653 }
654 
atmel_rmem8(struct atmel_private * priv,u16 pos)655 static inline u8 atmel_rmem8(struct atmel_private *priv, u16 pos)
656 {
657 	atmel_writeAR(priv->dev, pos);
658 	return atmel_read8(priv->dev, DR);
659 }
660 
atmel_wmem8(struct atmel_private * priv,u16 pos,u16 data)661 static inline void atmel_wmem8(struct atmel_private *priv, u16 pos, u16 data)
662 {
663 	atmel_writeAR(priv->dev, pos);
664 	atmel_write8(priv->dev, DR, data);
665 }
666 
atmel_rmem16(struct atmel_private * priv,u16 pos)667 static inline u16 atmel_rmem16(struct atmel_private *priv, u16 pos)
668 {
669 	atmel_writeAR(priv->dev, pos);
670 	return atmel_read16(priv->dev, DR);
671 }
672 
atmel_wmem16(struct atmel_private * priv,u16 pos,u16 data)673 static inline void atmel_wmem16(struct atmel_private *priv, u16 pos, u16 data)
674 {
675 	atmel_writeAR(priv->dev, pos);
676 	atmel_write16(priv->dev, DR, data);
677 }
678 
679 static const struct iw_handler_def atmel_handler_def;
680 
tx_done_irq(struct atmel_private * priv)681 static void tx_done_irq(struct atmel_private *priv)
682 {
683 	int i;
684 
685 	for (i = 0;
686 	     atmel_rmem8(priv, atmel_tx(priv, TX_DESC_FLAGS_OFFSET, priv->tx_desc_head)) == TX_DONE &&
687 		     i < priv->host_info.tx_desc_count;
688 	     i++) {
689 		u8 status = atmel_rmem8(priv, atmel_tx(priv, TX_DESC_STATUS_OFFSET, priv->tx_desc_head));
690 		u16 msdu_size = atmel_rmem16(priv, atmel_tx(priv, TX_DESC_SIZE_OFFSET, priv->tx_desc_head));
691 		u8 type = atmel_rmem8(priv, atmel_tx(priv, TX_DESC_PACKET_TYPE_OFFSET, priv->tx_desc_head));
692 
693 		atmel_wmem8(priv, atmel_tx(priv, TX_DESC_FLAGS_OFFSET, priv->tx_desc_head), 0);
694 
695 		priv->tx_free_mem += msdu_size;
696 		priv->tx_desc_free++;
697 
698 		if (priv->tx_buff_head + msdu_size > (priv->host_info.tx_buff_pos + priv->host_info.tx_buff_size))
699 			priv->tx_buff_head = 0;
700 		else
701 			priv->tx_buff_head += msdu_size;
702 
703 		if (priv->tx_desc_head < (priv->host_info.tx_desc_count - 1))
704 			priv->tx_desc_head++ ;
705 		else
706 			priv->tx_desc_head = 0;
707 
708 		if (type == TX_PACKET_TYPE_DATA) {
709 			if (status == TX_STATUS_SUCCESS)
710 				priv->dev->stats.tx_packets++;
711 			else
712 				priv->dev->stats.tx_errors++;
713 			netif_wake_queue(priv->dev);
714 		}
715 	}
716 }
717 
find_tx_buff(struct atmel_private * priv,u16 len)718 static u16 find_tx_buff(struct atmel_private *priv, u16 len)
719 {
720 	u16 bottom_free = priv->host_info.tx_buff_size - priv->tx_buff_tail;
721 
722 	if (priv->tx_desc_free == 3 || priv->tx_free_mem < len)
723 		return 0;
724 
725 	if (bottom_free >= len)
726 		return priv->host_info.tx_buff_pos + priv->tx_buff_tail;
727 
728 	if (priv->tx_free_mem - bottom_free >= len) {
729 		priv->tx_buff_tail = 0;
730 		return priv->host_info.tx_buff_pos;
731 	}
732 
733 	return 0;
734 }
735 
tx_update_descriptor(struct atmel_private * priv,int is_bcast,u16 len,u16 buff,u8 type)736 static void tx_update_descriptor(struct atmel_private *priv, int is_bcast,
737 				 u16 len, u16 buff, u8 type)
738 {
739 	atmel_wmem16(priv, atmel_tx(priv, TX_DESC_POS_OFFSET, priv->tx_desc_tail), buff);
740 	atmel_wmem16(priv, atmel_tx(priv, TX_DESC_SIZE_OFFSET, priv->tx_desc_tail), len);
741 	if (!priv->use_wpa)
742 		atmel_wmem16(priv, atmel_tx(priv, TX_DESC_HOST_LENGTH_OFFSET, priv->tx_desc_tail), len);
743 	atmel_wmem8(priv, atmel_tx(priv, TX_DESC_PACKET_TYPE_OFFSET, priv->tx_desc_tail), type);
744 	atmel_wmem8(priv, atmel_tx(priv, TX_DESC_RATE_OFFSET, priv->tx_desc_tail), priv->tx_rate);
745 	atmel_wmem8(priv, atmel_tx(priv, TX_DESC_RETRY_OFFSET, priv->tx_desc_tail), 0);
746 	if (priv->use_wpa) {
747 		int cipher_type, cipher_length;
748 		if (is_bcast) {
749 			cipher_type = priv->group_cipher_suite;
750 			if (cipher_type == CIPHER_SUITE_WEP_64 ||
751 			    cipher_type == CIPHER_SUITE_WEP_128)
752 				cipher_length = 8;
753 			else if (cipher_type == CIPHER_SUITE_TKIP)
754 				cipher_length = 12;
755 			else if (priv->pairwise_cipher_suite == CIPHER_SUITE_WEP_64 ||
756 				 priv->pairwise_cipher_suite == CIPHER_SUITE_WEP_128) {
757 				cipher_type = priv->pairwise_cipher_suite;
758 				cipher_length = 8;
759 			} else {
760 				cipher_type = CIPHER_SUITE_NONE;
761 				cipher_length = 0;
762 			}
763 		} else {
764 			cipher_type = priv->pairwise_cipher_suite;
765 			if (cipher_type == CIPHER_SUITE_WEP_64 ||
766 			    cipher_type == CIPHER_SUITE_WEP_128)
767 				cipher_length = 8;
768 			else if (cipher_type == CIPHER_SUITE_TKIP)
769 				cipher_length = 12;
770 			else if (priv->group_cipher_suite == CIPHER_SUITE_WEP_64 ||
771 				 priv->group_cipher_suite == CIPHER_SUITE_WEP_128) {
772 				cipher_type = priv->group_cipher_suite;
773 				cipher_length = 8;
774 			} else {
775 				cipher_type = CIPHER_SUITE_NONE;
776 				cipher_length = 0;
777 			}
778 		}
779 
780 		atmel_wmem8(priv, atmel_tx(priv, TX_DESC_CIPHER_TYPE_OFFSET, priv->tx_desc_tail),
781 			    cipher_type);
782 		atmel_wmem8(priv, atmel_tx(priv, TX_DESC_CIPHER_LENGTH_OFFSET, priv->tx_desc_tail),
783 			    cipher_length);
784 	}
785 	atmel_wmem32(priv, atmel_tx(priv, TX_DESC_NEXT_OFFSET, priv->tx_desc_tail), 0x80000000L);
786 	atmel_wmem8(priv, atmel_tx(priv, TX_DESC_FLAGS_OFFSET, priv->tx_desc_tail), TX_FIRM_OWN);
787 	if (priv->tx_desc_previous != priv->tx_desc_tail)
788 		atmel_wmem32(priv, atmel_tx(priv, TX_DESC_NEXT_OFFSET, priv->tx_desc_previous), 0);
789 	priv->tx_desc_previous = priv->tx_desc_tail;
790 	if (priv->tx_desc_tail < (priv->host_info.tx_desc_count - 1))
791 		priv->tx_desc_tail++;
792 	else
793 		priv->tx_desc_tail = 0;
794 	priv->tx_desc_free--;
795 	priv->tx_free_mem -= len;
796 }
797 
start_tx(struct sk_buff * skb,struct net_device * dev)798 static netdev_tx_t start_tx(struct sk_buff *skb, struct net_device *dev)
799 {
800 	struct atmel_private *priv = netdev_priv(dev);
801 	struct ieee80211_hdr header;
802 	unsigned long flags;
803 	u16 buff, frame_ctl, len = (ETH_ZLEN < skb->len) ? skb->len : ETH_ZLEN;
804 
805 	if (priv->card && priv->present_callback &&
806 	    !(*priv->present_callback)(priv->card)) {
807 		dev->stats.tx_errors++;
808 		dev_kfree_skb(skb);
809 		return NETDEV_TX_OK;
810 	}
811 
812 	if (priv->station_state != STATION_STATE_READY) {
813 		dev->stats.tx_errors++;
814 		dev_kfree_skb(skb);
815 		return NETDEV_TX_OK;
816 	}
817 
818 	/* first ensure the timer func cannot run */
819 	spin_lock_bh(&priv->timerlock);
820 	/* then stop the hardware ISR */
821 	spin_lock_irqsave(&priv->irqlock, flags);
822 	/* nb doing the above in the opposite order will deadlock */
823 
824 	/* The Wireless Header is 30 bytes. In the Ethernet packet we "cut" the
825 	   12 first bytes (containing DA/SA) and put them in the appropriate
826 	   fields of the Wireless Header. Thus the packet length is then the
827 	   initial + 18 (+30-12) */
828 
829 	if (!(buff = find_tx_buff(priv, len + 18))) {
830 		dev->stats.tx_dropped++;
831 		spin_unlock_irqrestore(&priv->irqlock, flags);
832 		spin_unlock_bh(&priv->timerlock);
833 		netif_stop_queue(dev);
834 		return NETDEV_TX_BUSY;
835 	}
836 
837 	frame_ctl = IEEE80211_FTYPE_DATA;
838 	header.duration_id = 0;
839 	header.seq_ctrl = 0;
840 	if (priv->wep_is_on)
841 		frame_ctl |= IEEE80211_FCTL_PROTECTED;
842 	if (priv->operating_mode == IW_MODE_ADHOC) {
843 		skb_copy_from_linear_data(skb, &header.addr1, ETH_ALEN);
844 		memcpy(&header.addr2, dev->dev_addr, ETH_ALEN);
845 		memcpy(&header.addr3, priv->BSSID, ETH_ALEN);
846 	} else {
847 		frame_ctl |= IEEE80211_FCTL_TODS;
848 		memcpy(&header.addr1, priv->CurrentBSSID, ETH_ALEN);
849 		memcpy(&header.addr2, dev->dev_addr, ETH_ALEN);
850 		skb_copy_from_linear_data(skb, &header.addr3, ETH_ALEN);
851 	}
852 
853 	if (priv->use_wpa)
854 		memcpy(&header.addr4, rfc1042_header, ETH_ALEN);
855 
856 	header.frame_control = cpu_to_le16(frame_ctl);
857 	/* Copy the wireless header into the card */
858 	atmel_copy_to_card(dev, buff, (unsigned char *)&header, DATA_FRAME_WS_HEADER_SIZE);
859 	/* Copy the packet sans its 802.3 header addresses which have been replaced */
860 	atmel_copy_to_card(dev, buff + DATA_FRAME_WS_HEADER_SIZE, skb->data + 12, len - 12);
861 	priv->tx_buff_tail += len - 12 + DATA_FRAME_WS_HEADER_SIZE;
862 
863 	/* low bit of first byte of destination tells us if broadcast */
864 	tx_update_descriptor(priv, *(skb->data) & 0x01, len + 18, buff, TX_PACKET_TYPE_DATA);
865 	dev->stats.tx_bytes += len;
866 
867 	spin_unlock_irqrestore(&priv->irqlock, flags);
868 	spin_unlock_bh(&priv->timerlock);
869 	dev_kfree_skb(skb);
870 
871 	return NETDEV_TX_OK;
872 }
873 
atmel_transmit_management_frame(struct atmel_private * priv,struct ieee80211_hdr * header,u8 * body,int body_len)874 static void atmel_transmit_management_frame(struct atmel_private *priv,
875 					    struct ieee80211_hdr *header,
876 					    u8 *body, int body_len)
877 {
878 	u16 buff;
879 	int len = MGMT_FRAME_BODY_OFFSET + body_len;
880 
881 	if (!(buff = find_tx_buff(priv, len)))
882 		return;
883 
884 	atmel_copy_to_card(priv->dev, buff, (u8 *)header, MGMT_FRAME_BODY_OFFSET);
885 	atmel_copy_to_card(priv->dev, buff + MGMT_FRAME_BODY_OFFSET, body, body_len);
886 	priv->tx_buff_tail += len;
887 	tx_update_descriptor(priv, header->addr1[0] & 0x01, len, buff, TX_PACKET_TYPE_MGMT);
888 }
889 
fast_rx_path(struct atmel_private * priv,struct ieee80211_hdr * header,u16 msdu_size,u16 rx_packet_loc,u32 crc)890 static void fast_rx_path(struct atmel_private *priv,
891 			 struct ieee80211_hdr *header,
892 			 u16 msdu_size, u16 rx_packet_loc, u32 crc)
893 {
894 	/* fast path: unfragmented packet copy directly into skbuf */
895 	u8 mac4[6];
896 	struct sk_buff	*skb;
897 	unsigned char *skbp;
898 
899 	/* get the final, mac 4 header field, this tells us encapsulation */
900 	atmel_copy_to_host(priv->dev, mac4, rx_packet_loc + 24, 6);
901 	msdu_size -= 6;
902 
903 	if (priv->do_rx_crc) {
904 		crc = crc32_le(crc, mac4, 6);
905 		msdu_size -= 4;
906 	}
907 
908 	if (!(skb = dev_alloc_skb(msdu_size + 14))) {
909 		priv->dev->stats.rx_dropped++;
910 		return;
911 	}
912 
913 	skb_reserve(skb, 2);
914 	skbp = skb_put(skb, msdu_size + 12);
915 	atmel_copy_to_host(priv->dev, skbp + 12, rx_packet_loc + 30, msdu_size);
916 
917 	if (priv->do_rx_crc) {
918 		u32 netcrc;
919 		crc = crc32_le(crc, skbp + 12, msdu_size);
920 		atmel_copy_to_host(priv->dev, (void *)&netcrc, rx_packet_loc + 30 + msdu_size, 4);
921 		if ((crc ^ 0xffffffff) != netcrc) {
922 			priv->dev->stats.rx_crc_errors++;
923 			dev_kfree_skb(skb);
924 			return;
925 		}
926 	}
927 
928 	memcpy(skbp, header->addr1, ETH_ALEN); /* destination address */
929 	if (le16_to_cpu(header->frame_control) & IEEE80211_FCTL_FROMDS)
930 		memcpy(&skbp[ETH_ALEN], header->addr3, ETH_ALEN);
931 	else
932 		memcpy(&skbp[ETH_ALEN], header->addr2, ETH_ALEN); /* source address */
933 
934 	skb->protocol = eth_type_trans(skb, priv->dev);
935 	skb->ip_summed = CHECKSUM_NONE;
936 	netif_rx(skb);
937 	priv->dev->stats.rx_bytes += 12 + msdu_size;
938 	priv->dev->stats.rx_packets++;
939 }
940 
941 /* Test to see if the packet in card memory at packet_loc has a valid CRC
942    It doesn't matter that this is slow: it is only used to proble the first few
943    packets. */
probe_crc(struct atmel_private * priv,u16 packet_loc,u16 msdu_size)944 static int probe_crc(struct atmel_private *priv, u16 packet_loc, u16 msdu_size)
945 {
946 	int i = msdu_size - 4;
947 	u32 netcrc, crc = 0xffffffff;
948 
949 	if (msdu_size < 4)
950 		return 0;
951 
952 	atmel_copy_to_host(priv->dev, (void *)&netcrc, packet_loc + i, 4);
953 
954 	atmel_writeAR(priv->dev, packet_loc);
955 	while (i--) {
956 		u8 octet = atmel_read8(priv->dev, DR);
957 		crc = crc32_le(crc, &octet, 1);
958 	}
959 
960 	return (crc ^ 0xffffffff) == netcrc;
961 }
962 
frag_rx_path(struct atmel_private * priv,struct ieee80211_hdr * header,u16 msdu_size,u16 rx_packet_loc,u32 crc,u16 seq_no,u8 frag_no,int more_frags)963 static void frag_rx_path(struct atmel_private *priv,
964 			 struct ieee80211_hdr *header,
965 			 u16 msdu_size, u16 rx_packet_loc, u32 crc, u16 seq_no,
966 			 u8 frag_no, int more_frags)
967 {
968 	u8 mac4[ETH_ALEN];
969 	u8 source[ETH_ALEN];
970 	struct sk_buff *skb;
971 
972 	if (le16_to_cpu(header->frame_control) & IEEE80211_FCTL_FROMDS)
973 		memcpy(source, header->addr3, ETH_ALEN);
974 	else
975 		memcpy(source, header->addr2, ETH_ALEN);
976 
977 	rx_packet_loc += 24; /* skip header */
978 
979 	if (priv->do_rx_crc)
980 		msdu_size -= 4;
981 
982 	if (frag_no == 0) { /* first fragment */
983 		atmel_copy_to_host(priv->dev, mac4, rx_packet_loc, ETH_ALEN);
984 		msdu_size -= ETH_ALEN;
985 		rx_packet_loc += ETH_ALEN;
986 
987 		if (priv->do_rx_crc)
988 			crc = crc32_le(crc, mac4, 6);
989 
990 		priv->frag_seq = seq_no;
991 		priv->frag_no = 1;
992 		priv->frag_len = msdu_size;
993 		memcpy(priv->frag_source, source, ETH_ALEN);
994 		memcpy(&priv->rx_buf[ETH_ALEN], source, ETH_ALEN);
995 		memcpy(priv->rx_buf, header->addr1, ETH_ALEN);
996 
997 		atmel_copy_to_host(priv->dev, &priv->rx_buf[12], rx_packet_loc, msdu_size);
998 
999 		if (priv->do_rx_crc) {
1000 			u32 netcrc;
1001 			crc = crc32_le(crc, &priv->rx_buf[12], msdu_size);
1002 			atmel_copy_to_host(priv->dev, (void *)&netcrc, rx_packet_loc + msdu_size, 4);
1003 			if ((crc ^ 0xffffffff) != netcrc) {
1004 				priv->dev->stats.rx_crc_errors++;
1005 				eth_broadcast_addr(priv->frag_source);
1006 			}
1007 		}
1008 
1009 	} else if (priv->frag_no == frag_no &&
1010 		   priv->frag_seq == seq_no &&
1011 		   memcmp(priv->frag_source, source, ETH_ALEN) == 0) {
1012 
1013 		atmel_copy_to_host(priv->dev, &priv->rx_buf[12 + priv->frag_len],
1014 				   rx_packet_loc, msdu_size);
1015 		if (priv->do_rx_crc) {
1016 			u32 netcrc;
1017 			crc = crc32_le(crc,
1018 				       &priv->rx_buf[12 + priv->frag_len],
1019 				       msdu_size);
1020 			atmel_copy_to_host(priv->dev, (void *)&netcrc, rx_packet_loc + msdu_size, 4);
1021 			if ((crc ^ 0xffffffff) != netcrc) {
1022 				priv->dev->stats.rx_crc_errors++;
1023 				eth_broadcast_addr(priv->frag_source);
1024 				more_frags = 1; /* don't send broken assembly */
1025 			}
1026 		}
1027 
1028 		priv->frag_len += msdu_size;
1029 		priv->frag_no++;
1030 
1031 		if (!more_frags) { /* last one */
1032 			eth_broadcast_addr(priv->frag_source);
1033 			if (!(skb = dev_alloc_skb(priv->frag_len + 14))) {
1034 				priv->dev->stats.rx_dropped++;
1035 			} else {
1036 				skb_reserve(skb, 2);
1037 				skb_put_data(skb, priv->rx_buf,
1038 				             priv->frag_len + 12);
1039 				skb->protocol = eth_type_trans(skb, priv->dev);
1040 				skb->ip_summed = CHECKSUM_NONE;
1041 				netif_rx(skb);
1042 				priv->dev->stats.rx_bytes += priv->frag_len + 12;
1043 				priv->dev->stats.rx_packets++;
1044 			}
1045 		}
1046 	} else
1047 		priv->wstats.discard.fragment++;
1048 }
1049 
rx_done_irq(struct atmel_private * priv)1050 static void rx_done_irq(struct atmel_private *priv)
1051 {
1052 	int i;
1053 	struct ieee80211_hdr header;
1054 
1055 	for (i = 0;
1056 	     atmel_rmem8(priv, atmel_rx(priv, RX_DESC_FLAGS_OFFSET, priv->rx_desc_head)) == RX_DESC_FLAG_VALID &&
1057 		     i < priv->host_info.rx_desc_count;
1058 	     i++) {
1059 
1060 		u16 msdu_size, rx_packet_loc, frame_ctl, seq_control;
1061 		u8 status = atmel_rmem8(priv, atmel_rx(priv, RX_DESC_STATUS_OFFSET, priv->rx_desc_head));
1062 		u32 crc = 0xffffffff;
1063 
1064 		if (status != RX_STATUS_SUCCESS) {
1065 			if (status == 0xc1) /* determined by experiment */
1066 				priv->wstats.discard.nwid++;
1067 			else
1068 				priv->dev->stats.rx_errors++;
1069 			goto next;
1070 		}
1071 
1072 		msdu_size = atmel_rmem16(priv, atmel_rx(priv, RX_DESC_MSDU_SIZE_OFFSET, priv->rx_desc_head));
1073 		rx_packet_loc = atmel_rmem16(priv, atmel_rx(priv, RX_DESC_MSDU_POS_OFFSET, priv->rx_desc_head));
1074 
1075 		if (msdu_size < 30) {
1076 			priv->dev->stats.rx_errors++;
1077 			goto next;
1078 		}
1079 
1080 		/* Get header as far as end of seq_ctrl */
1081 		atmel_copy_to_host(priv->dev, (char *)&header, rx_packet_loc, 24);
1082 		frame_ctl = le16_to_cpu(header.frame_control);
1083 		seq_control = le16_to_cpu(header.seq_ctrl);
1084 
1085 		/* probe for CRC use here if needed  once five packets have
1086 		   arrived with the same crc status, we assume we know what's
1087 		   happening and stop probing */
1088 		if (priv->probe_crc) {
1089 			if (!priv->wep_is_on || !(frame_ctl & IEEE80211_FCTL_PROTECTED)) {
1090 				priv->do_rx_crc = probe_crc(priv, rx_packet_loc, msdu_size);
1091 			} else {
1092 				priv->do_rx_crc = probe_crc(priv, rx_packet_loc + 24, msdu_size - 24);
1093 			}
1094 			if (priv->do_rx_crc) {
1095 				if (priv->crc_ok_cnt++ > 5)
1096 					priv->probe_crc = 0;
1097 			} else {
1098 				if (priv->crc_ko_cnt++ > 5)
1099 					priv->probe_crc = 0;
1100 			}
1101 		}
1102 
1103 		/* don't CRC header when WEP in use */
1104 		if (priv->do_rx_crc && (!priv->wep_is_on || !(frame_ctl & IEEE80211_FCTL_PROTECTED))) {
1105 			crc = crc32_le(0xffffffff, (unsigned char *)&header, 24);
1106 		}
1107 		msdu_size -= 24; /* header */
1108 
1109 		if ((frame_ctl & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA) {
1110 			int more_fragments = frame_ctl & IEEE80211_FCTL_MOREFRAGS;
1111 			u8 packet_fragment_no = seq_control & IEEE80211_SCTL_FRAG;
1112 			u16 packet_sequence_no = (seq_control & IEEE80211_SCTL_SEQ) >> 4;
1113 
1114 			if (!more_fragments && packet_fragment_no == 0) {
1115 				fast_rx_path(priv, &header, msdu_size, rx_packet_loc, crc);
1116 			} else {
1117 				frag_rx_path(priv, &header, msdu_size, rx_packet_loc, crc,
1118 					     packet_sequence_no, packet_fragment_no, more_fragments);
1119 			}
1120 		}
1121 
1122 		if ((frame_ctl & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT) {
1123 			/* copy rest of packet into buffer */
1124 			atmel_copy_to_host(priv->dev, (unsigned char *)&priv->rx_buf, rx_packet_loc + 24, msdu_size);
1125 
1126 			/* we use the same buffer for frag reassembly and control packets */
1127 			eth_broadcast_addr(priv->frag_source);
1128 
1129 			if (priv->do_rx_crc) {
1130 				/* last 4 octets is crc */
1131 				msdu_size -= 4;
1132 				crc = crc32_le(crc, (unsigned char *)&priv->rx_buf, msdu_size);
1133 				if ((crc ^ 0xffffffff) != (*((u32 *)&priv->rx_buf[msdu_size]))) {
1134 					priv->dev->stats.rx_crc_errors++;
1135 					goto next;
1136 				}
1137 			}
1138 
1139 			atmel_management_frame(priv, &header, msdu_size,
1140 					       atmel_rmem8(priv, atmel_rx(priv, RX_DESC_RSSI_OFFSET, priv->rx_desc_head)));
1141 		}
1142 
1143 next:
1144 		/* release descriptor */
1145 		atmel_wmem8(priv, atmel_rx(priv, RX_DESC_FLAGS_OFFSET, priv->rx_desc_head), RX_DESC_FLAG_CONSUMED);
1146 
1147 		if (priv->rx_desc_head < (priv->host_info.rx_desc_count - 1))
1148 			priv->rx_desc_head++;
1149 		else
1150 			priv->rx_desc_head = 0;
1151 	}
1152 }
1153 
service_interrupt(int irq,void * dev_id)1154 static irqreturn_t service_interrupt(int irq, void *dev_id)
1155 {
1156 	struct net_device *dev = (struct net_device *) dev_id;
1157 	struct atmel_private *priv = netdev_priv(dev);
1158 	u8 isr;
1159 	int i = -1;
1160 	static const u8 irq_order[] = {
1161 		ISR_OUT_OF_RANGE,
1162 		ISR_RxCOMPLETE,
1163 		ISR_TxCOMPLETE,
1164 		ISR_RxFRAMELOST,
1165 		ISR_FATAL_ERROR,
1166 		ISR_COMMAND_COMPLETE,
1167 		ISR_IBSS_MERGE,
1168 		ISR_GENERIC_IRQ
1169 	};
1170 
1171 	if (priv->card && priv->present_callback &&
1172 	    !(*priv->present_callback)(priv->card))
1173 		return IRQ_HANDLED;
1174 
1175 	/* In this state upper-level code assumes it can mess with
1176 	   the card unhampered by interrupts which may change register state.
1177 	   Note that even though the card shouldn't generate interrupts
1178 	   the inturrupt line may be shared. This allows card setup
1179 	   to go on without disabling interrupts for a long time. */
1180 	if (priv->station_state == STATION_STATE_DOWN)
1181 		return IRQ_NONE;
1182 
1183 	atmel_clear_gcr(dev, GCR_ENINT); /* disable interrupts */
1184 
1185 	while (1) {
1186 		if (!atmel_lock_mac(priv)) {
1187 			/* failed to contact card */
1188 			printk(KERN_ALERT "%s: failed to contact MAC.\n", dev->name);
1189 			return IRQ_HANDLED;
1190 		}
1191 
1192 		isr = atmel_rmem8(priv, atmel_hi(priv, IFACE_INT_STATUS_OFFSET));
1193 		atmel_wmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_MAC_OFFSET), 0);
1194 
1195 		if (!isr) {
1196 			atmel_set_gcr(dev, GCR_ENINT); /* enable interrupts */
1197 			return i == -1 ? IRQ_NONE : IRQ_HANDLED;
1198 		}
1199 
1200 		atmel_set_gcr(dev, GCR_ACKINT); /* acknowledge interrupt */
1201 
1202 		for (i = 0; i < ARRAY_SIZE(irq_order); i++)
1203 			if (isr & irq_order[i])
1204 				break;
1205 
1206 		if (!atmel_lock_mac(priv)) {
1207 			/* failed to contact card */
1208 			printk(KERN_ALERT "%s: failed to contact MAC.\n", dev->name);
1209 			return IRQ_HANDLED;
1210 		}
1211 
1212 		isr = atmel_rmem8(priv, atmel_hi(priv, IFACE_INT_STATUS_OFFSET));
1213 		isr ^= irq_order[i];
1214 		atmel_wmem8(priv, atmel_hi(priv, IFACE_INT_STATUS_OFFSET), isr);
1215 		atmel_wmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_MAC_OFFSET), 0);
1216 
1217 		switch (irq_order[i]) {
1218 
1219 		case ISR_OUT_OF_RANGE:
1220 			if (priv->operating_mode == IW_MODE_INFRA &&
1221 			    priv->station_state == STATION_STATE_READY) {
1222 				priv->station_is_associated = 0;
1223 				atmel_scan(priv, 1);
1224 			}
1225 			break;
1226 
1227 		case ISR_RxFRAMELOST:
1228 			priv->wstats.discard.misc++;
1229 			fallthrough;
1230 		case ISR_RxCOMPLETE:
1231 			rx_done_irq(priv);
1232 			break;
1233 
1234 		case ISR_TxCOMPLETE:
1235 			tx_done_irq(priv);
1236 			break;
1237 
1238 		case ISR_FATAL_ERROR:
1239 			printk(KERN_ALERT "%s: *** FATAL error interrupt ***\n", dev->name);
1240 			atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
1241 			break;
1242 
1243 		case ISR_COMMAND_COMPLETE:
1244 			atmel_command_irq(priv);
1245 			break;
1246 
1247 		case ISR_IBSS_MERGE:
1248 			atmel_get_mib(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_CUR_BSSID_POS,
1249 				      priv->CurrentBSSID, 6);
1250 			/* The WPA stuff cares about the current AP address */
1251 			if (priv->use_wpa)
1252 				build_wpa_mib(priv);
1253 			break;
1254 		case ISR_GENERIC_IRQ:
1255 			printk(KERN_INFO "%s: Generic_irq received.\n", dev->name);
1256 			break;
1257 		}
1258 	}
1259 }
1260 
atmel_get_wireless_stats(struct net_device * dev)1261 static struct iw_statistics *atmel_get_wireless_stats(struct net_device *dev)
1262 {
1263 	struct atmel_private *priv = netdev_priv(dev);
1264 
1265 	/* update the link quality here in case we are seeing no beacons
1266 	   at all to drive the process */
1267 	atmel_smooth_qual(priv);
1268 
1269 	priv->wstats.status = priv->station_state;
1270 
1271 	if (priv->operating_mode == IW_MODE_INFRA) {
1272 		if (priv->station_state != STATION_STATE_READY) {
1273 			priv->wstats.qual.qual = 0;
1274 			priv->wstats.qual.level = 0;
1275 			priv->wstats.qual.updated = (IW_QUAL_QUAL_INVALID
1276 					| IW_QUAL_LEVEL_INVALID);
1277 		}
1278 		priv->wstats.qual.noise = 0;
1279 		priv->wstats.qual.updated |= IW_QUAL_NOISE_INVALID;
1280 	} else {
1281 		/* Quality levels cannot be determined in ad-hoc mode,
1282 		   because we can 'hear' more that one remote station. */
1283 		priv->wstats.qual.qual = 0;
1284 		priv->wstats.qual.level	= 0;
1285 		priv->wstats.qual.noise	= 0;
1286 		priv->wstats.qual.updated = IW_QUAL_QUAL_INVALID
1287 					| IW_QUAL_LEVEL_INVALID
1288 					| IW_QUAL_NOISE_INVALID;
1289 		priv->wstats.miss.beacon = 0;
1290 	}
1291 
1292 	return &priv->wstats;
1293 }
1294 
atmel_set_mac_address(struct net_device * dev,void * p)1295 static int atmel_set_mac_address(struct net_device *dev, void *p)
1296 {
1297 	struct sockaddr *addr = p;
1298 
1299 	eth_hw_addr_set(dev, addr->sa_data);
1300 	return atmel_open(dev);
1301 }
1302 
1303 EXPORT_SYMBOL(atmel_open);
1304 
atmel_open(struct net_device * dev)1305 int atmel_open(struct net_device *dev)
1306 {
1307 	struct atmel_private *priv = netdev_priv(dev);
1308 	int i, channel, err;
1309 
1310 	/* any scheduled timer is no longer needed and might screw things up.. */
1311 	del_timer_sync(&priv->management_timer);
1312 
1313 	/* Interrupts will not touch the card once in this state... */
1314 	priv->station_state = STATION_STATE_DOWN;
1315 
1316 	if (priv->new_SSID_size) {
1317 		memcpy(priv->SSID, priv->new_SSID, priv->new_SSID_size);
1318 		priv->SSID_size = priv->new_SSID_size;
1319 		priv->new_SSID_size = 0;
1320 	}
1321 	priv->BSS_list_entries = 0;
1322 
1323 	priv->AuthenticationRequestRetryCnt = 0;
1324 	priv->AssociationRequestRetryCnt = 0;
1325 	priv->ReAssociationRequestRetryCnt = 0;
1326 	priv->CurrentAuthentTransactionSeqNum = 0x0001;
1327 	priv->ExpectedAuthentTransactionSeqNum = 0x0002;
1328 
1329 	priv->site_survey_state = SITE_SURVEY_IDLE;
1330 	priv->station_is_associated = 0;
1331 
1332 	err = reset_atmel_card(dev);
1333 	if (err)
1334 		return err;
1335 
1336 	if (priv->config_reg_domain) {
1337 		priv->reg_domain = priv->config_reg_domain;
1338 		atmel_set_mib8(priv, Phy_Mib_Type, PHY_MIB_REG_DOMAIN_POS, priv->reg_domain);
1339 	} else {
1340 		priv->reg_domain = atmel_get_mib8(priv, Phy_Mib_Type, PHY_MIB_REG_DOMAIN_POS);
1341 		for (i = 0; i < ARRAY_SIZE(channel_table); i++)
1342 			if (priv->reg_domain == channel_table[i].reg_domain)
1343 				break;
1344 		if (i == ARRAY_SIZE(channel_table)) {
1345 			priv->reg_domain = REG_DOMAIN_MKK1;
1346 			printk(KERN_ALERT "%s: failed to get regulatory domain: assuming MKK1.\n", dev->name);
1347 		}
1348 	}
1349 
1350 	if ((channel = atmel_validate_channel(priv, priv->channel)))
1351 		priv->channel = channel;
1352 
1353 	/* this moves station_state on.... */
1354 	atmel_scan(priv, 1);
1355 
1356 	atmel_set_gcr(priv->dev, GCR_ENINT); /* enable interrupts */
1357 	return 0;
1358 }
1359 
atmel_close(struct net_device * dev)1360 static int atmel_close(struct net_device *dev)
1361 {
1362 	struct atmel_private *priv = netdev_priv(dev);
1363 
1364 	/* Send event to userspace that we are disassociating */
1365 	if (priv->station_state == STATION_STATE_READY) {
1366 		union iwreq_data wrqu;
1367 
1368 		wrqu.data.length = 0;
1369 		wrqu.data.flags = 0;
1370 		wrqu.ap_addr.sa_family = ARPHRD_ETHER;
1371 		eth_zero_addr(wrqu.ap_addr.sa_data);
1372 		wireless_send_event(priv->dev, SIOCGIWAP, &wrqu, NULL);
1373 	}
1374 
1375 	atmel_enter_state(priv, STATION_STATE_DOWN);
1376 
1377 	if (priv->bus_type == BUS_TYPE_PCCARD)
1378 		atmel_write16(dev, GCR, 0x0060);
1379 	atmel_write16(dev, GCR, 0x0040);
1380 	return 0;
1381 }
1382 
atmel_validate_channel(struct atmel_private * priv,int channel)1383 static int atmel_validate_channel(struct atmel_private *priv, int channel)
1384 {
1385 	/* check that channel is OK, if so return zero,
1386 	   else return suitable default channel */
1387 	int i;
1388 
1389 	for (i = 0; i < ARRAY_SIZE(channel_table); i++)
1390 		if (priv->reg_domain == channel_table[i].reg_domain) {
1391 			if (channel >= channel_table[i].min &&
1392 			    channel <= channel_table[i].max)
1393 				return 0;
1394 			else
1395 				return channel_table[i].min;
1396 		}
1397 	return 0;
1398 }
1399 
1400 #ifdef CONFIG_PROC_FS
atmel_proc_show(struct seq_file * m,void * v)1401 static int atmel_proc_show(struct seq_file *m, void *v)
1402 {
1403 	struct atmel_private *priv = m->private;
1404 	int i;
1405 	char *s, *r, *c;
1406 
1407 	seq_printf(m, "Driver version:\t\t%d.%d\n", DRIVER_MAJOR, DRIVER_MINOR);
1408 
1409 	if (priv->station_state != STATION_STATE_DOWN) {
1410 		seq_printf(m,
1411 			   "Firmware version:\t%d.%d build %d\n"
1412 			   "Firmware location:\t",
1413 			   priv->host_info.major_version,
1414 			   priv->host_info.minor_version,
1415 			   priv->host_info.build_version);
1416 
1417 		if (priv->card_type != CARD_TYPE_EEPROM)
1418 			seq_puts(m, "on card\n");
1419 		else if (priv->firmware)
1420 			seq_printf(m, "%s loaded by host\n", priv->firmware_id);
1421 		else
1422 			seq_printf(m, "%s loaded by hotplug\n", priv->firmware_id);
1423 
1424 		switch (priv->card_type) {
1425 		case CARD_TYPE_PARALLEL_FLASH:
1426 			c = "Parallel flash";
1427 			break;
1428 		case CARD_TYPE_SPI_FLASH:
1429 			c = "SPI flash\n";
1430 			break;
1431 		case CARD_TYPE_EEPROM:
1432 			c = "EEPROM";
1433 			break;
1434 		default:
1435 			c = "<unknown>";
1436 		}
1437 
1438 		r = "<unknown>";
1439 		for (i = 0; i < ARRAY_SIZE(channel_table); i++)
1440 			if (priv->reg_domain == channel_table[i].reg_domain)
1441 				r = channel_table[i].name;
1442 
1443 		seq_printf(m, "MAC memory type:\t%s\n", c);
1444 		seq_printf(m, "Regulatory domain:\t%s\n", r);
1445 		seq_printf(m, "Host CRC checking:\t%s\n",
1446 			 priv->do_rx_crc ? "On" : "Off");
1447 		seq_printf(m, "WPA-capable firmware:\t%s\n",
1448 			 priv->use_wpa ? "Yes" : "No");
1449 	}
1450 
1451 	switch (priv->station_state) {
1452 	case STATION_STATE_SCANNING:
1453 		s = "Scanning";
1454 		break;
1455 	case STATION_STATE_JOINNING:
1456 		s = "Joining";
1457 		break;
1458 	case STATION_STATE_AUTHENTICATING:
1459 		s = "Authenticating";
1460 		break;
1461 	case STATION_STATE_ASSOCIATING:
1462 		s = "Associating";
1463 		break;
1464 	case STATION_STATE_READY:
1465 		s = "Ready";
1466 		break;
1467 	case STATION_STATE_REASSOCIATING:
1468 		s = "Reassociating";
1469 		break;
1470 	case STATION_STATE_MGMT_ERROR:
1471 		s = "Management error";
1472 		break;
1473 	case STATION_STATE_DOWN:
1474 		s = "Down";
1475 		break;
1476 	default:
1477 		s = "<unknown>";
1478 	}
1479 
1480 	seq_printf(m, "Current state:\t\t%s\n", s);
1481 	return 0;
1482 }
1483 #endif
1484 
1485 static const struct net_device_ops atmel_netdev_ops = {
1486 	.ndo_open 		= atmel_open,
1487 	.ndo_stop		= atmel_close,
1488 	.ndo_set_mac_address 	= atmel_set_mac_address,
1489 	.ndo_start_xmit 	= start_tx,
1490 	.ndo_do_ioctl 		= atmel_ioctl,
1491 	.ndo_validate_addr	= eth_validate_addr,
1492 };
1493 
init_atmel_card(unsigned short irq,unsigned long port,const AtmelFWType fw_type,struct device * sys_dev,int (* card_present)(void *),void * card)1494 struct net_device *init_atmel_card(unsigned short irq, unsigned long port,
1495 				   const AtmelFWType fw_type,
1496 				   struct device *sys_dev,
1497 				   int (*card_present)(void *), void *card)
1498 {
1499 	struct net_device *dev;
1500 	struct atmel_private *priv;
1501 	int rc;
1502 
1503 	/* Create the network device object. */
1504 	dev = alloc_etherdev(sizeof(*priv));
1505 	if (!dev)
1506 		return NULL;
1507 
1508 	if (dev_alloc_name(dev, dev->name) < 0) {
1509 		printk(KERN_ERR "atmel: Couldn't get name!\n");
1510 		goto err_out_free;
1511 	}
1512 
1513 	priv = netdev_priv(dev);
1514 	priv->dev = dev;
1515 	priv->sys_dev = sys_dev;
1516 	priv->present_callback = card_present;
1517 	priv->card = card;
1518 	priv->firmware = NULL;
1519 	priv->firmware_type = fw_type;
1520 	if (firmware) /* module parameter */
1521 		strlcpy(priv->firmware_id, firmware, sizeof(priv->firmware_id));
1522 	priv->bus_type = card_present ? BUS_TYPE_PCCARD : BUS_TYPE_PCI;
1523 	priv->station_state = STATION_STATE_DOWN;
1524 	priv->do_rx_crc = 0;
1525 	/* For PCMCIA cards, some chips need CRC, some don't
1526 	   so we have to probe. */
1527 	if (priv->bus_type == BUS_TYPE_PCCARD) {
1528 		priv->probe_crc = 1;
1529 		priv->crc_ok_cnt = priv->crc_ko_cnt = 0;
1530 	} else
1531 		priv->probe_crc = 0;
1532 	priv->last_qual = jiffies;
1533 	priv->last_beacon_timestamp = 0;
1534 	memset(priv->frag_source, 0xff, sizeof(priv->frag_source));
1535 	eth_zero_addr(priv->BSSID);
1536 	priv->CurrentBSSID[0] = 0xFF; /* Initialize to something invalid.... */
1537 	priv->station_was_associated = 0;
1538 
1539 	priv->last_survey = jiffies;
1540 	priv->preamble = LONG_PREAMBLE;
1541 	priv->operating_mode = IW_MODE_INFRA;
1542 	priv->connect_to_any_BSS = 0;
1543 	priv->config_reg_domain = 0;
1544 	priv->reg_domain = 0;
1545 	priv->tx_rate = 3;
1546 	priv->auto_tx_rate = 1;
1547 	priv->channel = 4;
1548 	priv->power_mode = 0;
1549 	priv->SSID[0] = '\0';
1550 	priv->SSID_size = 0;
1551 	priv->new_SSID_size = 0;
1552 	priv->frag_threshold = 2346;
1553 	priv->rts_threshold = 2347;
1554 	priv->short_retry = 7;
1555 	priv->long_retry = 4;
1556 
1557 	priv->wep_is_on = 0;
1558 	priv->default_key = 0;
1559 	priv->encryption_level = 0;
1560 	priv->exclude_unencrypted = 0;
1561 	priv->group_cipher_suite = priv->pairwise_cipher_suite = CIPHER_SUITE_NONE;
1562 	priv->use_wpa = 0;
1563 	memset(priv->wep_keys, 0, sizeof(priv->wep_keys));
1564 	memset(priv->wep_key_len, 0, sizeof(priv->wep_key_len));
1565 
1566 	priv->default_beacon_period = priv->beacon_period = 100;
1567 	priv->listen_interval = 1;
1568 
1569 	timer_setup(&priv->management_timer, atmel_management_timer, 0);
1570 	spin_lock_init(&priv->irqlock);
1571 	spin_lock_init(&priv->timerlock);
1572 
1573 	dev->netdev_ops = &atmel_netdev_ops;
1574 	dev->wireless_handlers = &atmel_handler_def;
1575 	dev->irq = irq;
1576 	dev->base_addr = port;
1577 
1578 	/* MTU range: 68 - 2312 */
1579 	dev->min_mtu = 68;
1580 	dev->max_mtu = MAX_WIRELESS_BODY - ETH_FCS_LEN;
1581 
1582 	SET_NETDEV_DEV(dev, sys_dev);
1583 
1584 	if ((rc = request_irq(dev->irq, service_interrupt, IRQF_SHARED, dev->name, dev))) {
1585 		printk(KERN_ERR "%s: register interrupt %d failed, rc %d\n", dev->name, irq, rc);
1586 		goto err_out_free;
1587 	}
1588 
1589 	if (!request_region(dev->base_addr, 32,
1590 			    priv->bus_type == BUS_TYPE_PCCARD ?  "atmel_cs" : "atmel_pci")) {
1591 		goto err_out_irq;
1592 	}
1593 
1594 	if (register_netdev(dev))
1595 		goto err_out_res;
1596 
1597 	if (!probe_atmel_card(dev)) {
1598 		unregister_netdev(dev);
1599 		goto err_out_res;
1600 	}
1601 
1602 	netif_carrier_off(dev);
1603 
1604 	if (!proc_create_single_data("driver/atmel", 0, NULL, atmel_proc_show,
1605 			priv))
1606 		printk(KERN_WARNING "atmel: unable to create /proc entry.\n");
1607 
1608 	printk(KERN_INFO "%s: Atmel at76c50x. Version %d.%d. MAC %pM\n",
1609 	       dev->name, DRIVER_MAJOR, DRIVER_MINOR, dev->dev_addr);
1610 
1611 	return dev;
1612 
1613 err_out_res:
1614 	release_region(dev->base_addr, 32);
1615 err_out_irq:
1616 	free_irq(dev->irq, dev);
1617 err_out_free:
1618 	free_netdev(dev);
1619 	return NULL;
1620 }
1621 
1622 EXPORT_SYMBOL(init_atmel_card);
1623 
stop_atmel_card(struct net_device * dev)1624 void stop_atmel_card(struct net_device *dev)
1625 {
1626 	struct atmel_private *priv = netdev_priv(dev);
1627 
1628 	/* put a brick on it... */
1629 	if (priv->bus_type == BUS_TYPE_PCCARD)
1630 		atmel_write16(dev, GCR, 0x0060);
1631 	atmel_write16(dev, GCR, 0x0040);
1632 
1633 	del_timer_sync(&priv->management_timer);
1634 	unregister_netdev(dev);
1635 	remove_proc_entry("driver/atmel", NULL);
1636 	free_irq(dev->irq, dev);
1637 	kfree(priv->firmware);
1638 	release_region(dev->base_addr, 32);
1639 	free_netdev(dev);
1640 }
1641 
1642 EXPORT_SYMBOL(stop_atmel_card);
1643 
atmel_set_essid(struct net_device * dev,struct iw_request_info * info,struct iw_point * dwrq,char * extra)1644 static int atmel_set_essid(struct net_device *dev,
1645 			   struct iw_request_info *info,
1646 			   struct iw_point *dwrq,
1647 			   char *extra)
1648 {
1649 	struct atmel_private *priv = netdev_priv(dev);
1650 
1651 	/* Check if we asked for `any' */
1652 	if (dwrq->flags == 0) {
1653 		priv->connect_to_any_BSS = 1;
1654 	} else {
1655 		int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
1656 
1657 		priv->connect_to_any_BSS = 0;
1658 
1659 		/* Check the size of the string */
1660 		if (dwrq->length > MAX_SSID_LENGTH)
1661 			 return -E2BIG;
1662 		if (index != 0)
1663 			return -EINVAL;
1664 
1665 		memcpy(priv->new_SSID, extra, dwrq->length);
1666 		priv->new_SSID_size = dwrq->length;
1667 	}
1668 
1669 	return -EINPROGRESS;
1670 }
1671 
atmel_get_essid(struct net_device * dev,struct iw_request_info * info,struct iw_point * dwrq,char * extra)1672 static int atmel_get_essid(struct net_device *dev,
1673 			   struct iw_request_info *info,
1674 			   struct iw_point *dwrq,
1675 			   char *extra)
1676 {
1677 	struct atmel_private *priv = netdev_priv(dev);
1678 
1679 	/* Get the current SSID */
1680 	if (priv->new_SSID_size != 0) {
1681 		memcpy(extra, priv->new_SSID, priv->new_SSID_size);
1682 		dwrq->length = priv->new_SSID_size;
1683 	} else {
1684 		memcpy(extra, priv->SSID, priv->SSID_size);
1685 		dwrq->length = priv->SSID_size;
1686 	}
1687 
1688 	dwrq->flags = !priv->connect_to_any_BSS; /* active */
1689 
1690 	return 0;
1691 }
1692 
atmel_get_wap(struct net_device * dev,struct iw_request_info * info,struct sockaddr * awrq,char * extra)1693 static int atmel_get_wap(struct net_device *dev,
1694 			 struct iw_request_info *info,
1695 			 struct sockaddr *awrq,
1696 			 char *extra)
1697 {
1698 	struct atmel_private *priv = netdev_priv(dev);
1699 	memcpy(awrq->sa_data, priv->CurrentBSSID, ETH_ALEN);
1700 	awrq->sa_family = ARPHRD_ETHER;
1701 
1702 	return 0;
1703 }
1704 
atmel_set_encode(struct net_device * dev,struct iw_request_info * info,struct iw_point * dwrq,char * extra)1705 static int atmel_set_encode(struct net_device *dev,
1706 			    struct iw_request_info *info,
1707 			    struct iw_point *dwrq,
1708 			    char *extra)
1709 {
1710 	struct atmel_private *priv = netdev_priv(dev);
1711 
1712 	/* Basic checking: do we have a key to set ?
1713 	 * Note : with the new API, it's impossible to get a NULL pointer.
1714 	 * Therefore, we need to check a key size == 0 instead.
1715 	 * New version of iwconfig properly set the IW_ENCODE_NOKEY flag
1716 	 * when no key is present (only change flags), but older versions
1717 	 * don't do it. - Jean II */
1718 	if (dwrq->length > 0) {
1719 		int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
1720 		int current_index = priv->default_key;
1721 		/* Check the size of the key */
1722 		if (dwrq->length > 13) {
1723 			return -EINVAL;
1724 		}
1725 		/* Check the index (none -> use current) */
1726 		if (index < 0 || index >= 4)
1727 			index = current_index;
1728 		else
1729 			priv->default_key = index;
1730 		/* Set the length */
1731 		if (dwrq->length > 5)
1732 			priv->wep_key_len[index] = 13;
1733 		else
1734 			if (dwrq->length > 0)
1735 				priv->wep_key_len[index] = 5;
1736 			else
1737 				/* Disable the key */
1738 				priv->wep_key_len[index] = 0;
1739 		/* Check if the key is not marked as invalid */
1740 		if (!(dwrq->flags & IW_ENCODE_NOKEY)) {
1741 			/* Cleanup */
1742 			memset(priv->wep_keys[index], 0, 13);
1743 			/* Copy the key in the driver */
1744 			memcpy(priv->wep_keys[index], extra, dwrq->length);
1745 		}
1746 		/* WE specify that if a valid key is set, encryption
1747 		 * should be enabled (user may turn it off later)
1748 		 * This is also how "iwconfig ethX key on" works */
1749 		if (index == current_index &&
1750 		    priv->wep_key_len[index] > 0) {
1751 			priv->wep_is_on = 1;
1752 			priv->exclude_unencrypted = 1;
1753 			if (priv->wep_key_len[index] > 5) {
1754 				priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_128;
1755 				priv->encryption_level = 2;
1756 			} else {
1757 				priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_64;
1758 				priv->encryption_level = 1;
1759 			}
1760 		}
1761 	} else {
1762 		/* Do we want to just set the transmit key index ? */
1763 		int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
1764 		if (index >= 0 && index < 4) {
1765 			priv->default_key = index;
1766 		} else
1767 			/* Don't complain if only change the mode */
1768 			if (!(dwrq->flags & IW_ENCODE_MODE))
1769 				return -EINVAL;
1770 	}
1771 	/* Read the flags */
1772 	if (dwrq->flags & IW_ENCODE_DISABLED) {
1773 		priv->wep_is_on = 0;
1774 		priv->encryption_level = 0;
1775 		priv->pairwise_cipher_suite = CIPHER_SUITE_NONE;
1776 	} else {
1777 		priv->wep_is_on = 1;
1778 		if (priv->wep_key_len[priv->default_key] > 5) {
1779 			priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_128;
1780 			priv->encryption_level = 2;
1781 		} else {
1782 			priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_64;
1783 			priv->encryption_level = 1;
1784 		}
1785 	}
1786 	if (dwrq->flags & IW_ENCODE_RESTRICTED)
1787 		priv->exclude_unencrypted = 1;
1788 	if (dwrq->flags & IW_ENCODE_OPEN)
1789 		priv->exclude_unencrypted = 0;
1790 
1791 	return -EINPROGRESS;		/* Call commit handler */
1792 }
1793 
atmel_get_encode(struct net_device * dev,struct iw_request_info * info,struct iw_point * dwrq,char * extra)1794 static int atmel_get_encode(struct net_device *dev,
1795 			    struct iw_request_info *info,
1796 			    struct iw_point *dwrq,
1797 			    char *extra)
1798 {
1799 	struct atmel_private *priv = netdev_priv(dev);
1800 	int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
1801 
1802 	if (!priv->wep_is_on)
1803 		dwrq->flags = IW_ENCODE_DISABLED;
1804 	else {
1805 		if (priv->exclude_unencrypted)
1806 			dwrq->flags = IW_ENCODE_RESTRICTED;
1807 		else
1808 			dwrq->flags = IW_ENCODE_OPEN;
1809 	}
1810 		/* Which key do we want ? -1 -> tx index */
1811 	if (index < 0 || index >= 4)
1812 		index = priv->default_key;
1813 	dwrq->flags |= index + 1;
1814 	/* Copy the key to the user buffer */
1815 	dwrq->length = priv->wep_key_len[index];
1816 	if (dwrq->length > 16) {
1817 		dwrq->length = 0;
1818 	} else {
1819 		memset(extra, 0, 16);
1820 		memcpy(extra, priv->wep_keys[index], dwrq->length);
1821 	}
1822 
1823 	return 0;
1824 }
1825 
atmel_set_encodeext(struct net_device * dev,struct iw_request_info * info,union iwreq_data * wrqu,char * extra)1826 static int atmel_set_encodeext(struct net_device *dev,
1827 			    struct iw_request_info *info,
1828 			    union iwreq_data *wrqu,
1829 			    char *extra)
1830 {
1831 	struct atmel_private *priv = netdev_priv(dev);
1832 	struct iw_point *encoding = &wrqu->encoding;
1833 	struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
1834 	int idx, key_len, alg = ext->alg, set_key = 1;
1835 
1836 	/* Determine and validate the key index */
1837 	idx = encoding->flags & IW_ENCODE_INDEX;
1838 	if (idx) {
1839 		if (idx < 1 || idx > 4)
1840 			return -EINVAL;
1841 		idx--;
1842 	} else
1843 		idx = priv->default_key;
1844 
1845 	if (encoding->flags & IW_ENCODE_DISABLED)
1846 	    alg = IW_ENCODE_ALG_NONE;
1847 
1848 	if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY) {
1849 		priv->default_key = idx;
1850 		set_key = ext->key_len > 0 ? 1 : 0;
1851 	}
1852 
1853 	if (set_key) {
1854 		/* Set the requested key first */
1855 		switch (alg) {
1856 		case IW_ENCODE_ALG_NONE:
1857 			priv->wep_is_on = 0;
1858 			priv->encryption_level = 0;
1859 			priv->pairwise_cipher_suite = CIPHER_SUITE_NONE;
1860 			break;
1861 		case IW_ENCODE_ALG_WEP:
1862 			if (ext->key_len > 5) {
1863 				priv->wep_key_len[idx] = 13;
1864 				priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_128;
1865 				priv->encryption_level = 2;
1866 			} else if (ext->key_len > 0) {
1867 				priv->wep_key_len[idx] = 5;
1868 				priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_64;
1869 				priv->encryption_level = 1;
1870 			} else {
1871 				return -EINVAL;
1872 			}
1873 			priv->wep_is_on = 1;
1874 			memset(priv->wep_keys[idx], 0, 13);
1875 			key_len = min ((int)ext->key_len, priv->wep_key_len[idx]);
1876 			memcpy(priv->wep_keys[idx], ext->key, key_len);
1877 			break;
1878 		default:
1879 			return -EINVAL;
1880 		}
1881 	}
1882 
1883 	return -EINPROGRESS;
1884 }
1885 
atmel_get_encodeext(struct net_device * dev,struct iw_request_info * info,union iwreq_data * wrqu,char * extra)1886 static int atmel_get_encodeext(struct net_device *dev,
1887 			    struct iw_request_info *info,
1888 			    union iwreq_data *wrqu,
1889 			    char *extra)
1890 {
1891 	struct atmel_private *priv = netdev_priv(dev);
1892 	struct iw_point *encoding = &wrqu->encoding;
1893 	struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
1894 	int idx, max_key_len;
1895 
1896 	max_key_len = encoding->length - sizeof(*ext);
1897 	if (max_key_len < 0)
1898 		return -EINVAL;
1899 
1900 	idx = encoding->flags & IW_ENCODE_INDEX;
1901 	if (idx) {
1902 		if (idx < 1 || idx > 4)
1903 			return -EINVAL;
1904 		idx--;
1905 	} else
1906 		idx = priv->default_key;
1907 
1908 	encoding->flags = idx + 1;
1909 	memset(ext, 0, sizeof(*ext));
1910 
1911 	if (!priv->wep_is_on) {
1912 		ext->alg = IW_ENCODE_ALG_NONE;
1913 		ext->key_len = 0;
1914 		encoding->flags |= IW_ENCODE_DISABLED;
1915 	} else {
1916 		if (priv->encryption_level > 0)
1917 			ext->alg = IW_ENCODE_ALG_WEP;
1918 		else
1919 			return -EINVAL;
1920 
1921 		ext->key_len = priv->wep_key_len[idx];
1922 		memcpy(ext->key, priv->wep_keys[idx], ext->key_len);
1923 		encoding->flags |= IW_ENCODE_ENABLED;
1924 	}
1925 
1926 	return 0;
1927 }
1928 
atmel_set_auth(struct net_device * dev,struct iw_request_info * info,union iwreq_data * wrqu,char * extra)1929 static int atmel_set_auth(struct net_device *dev,
1930 			       struct iw_request_info *info,
1931 			       union iwreq_data *wrqu, char *extra)
1932 {
1933 	struct atmel_private *priv = netdev_priv(dev);
1934 	struct iw_param *param = &wrqu->param;
1935 
1936 	switch (param->flags & IW_AUTH_INDEX) {
1937 	case IW_AUTH_WPA_VERSION:
1938 	case IW_AUTH_CIPHER_PAIRWISE:
1939 	case IW_AUTH_CIPHER_GROUP:
1940 	case IW_AUTH_KEY_MGMT:
1941 	case IW_AUTH_RX_UNENCRYPTED_EAPOL:
1942 	case IW_AUTH_PRIVACY_INVOKED:
1943 		/*
1944 		 * atmel does not use these parameters
1945 		 */
1946 		break;
1947 
1948 	case IW_AUTH_DROP_UNENCRYPTED:
1949 		priv->exclude_unencrypted = param->value ? 1 : 0;
1950 		break;
1951 
1952 	case IW_AUTH_80211_AUTH_ALG: {
1953 			if (param->value & IW_AUTH_ALG_SHARED_KEY) {
1954 				priv->exclude_unencrypted = 1;
1955 			} else if (param->value & IW_AUTH_ALG_OPEN_SYSTEM) {
1956 				priv->exclude_unencrypted = 0;
1957 			} else
1958 				return -EINVAL;
1959 			break;
1960 		}
1961 
1962 	case IW_AUTH_WPA_ENABLED:
1963 		/* Silently accept disable of WPA */
1964 		if (param->value > 0)
1965 			return -EOPNOTSUPP;
1966 		break;
1967 
1968 	default:
1969 		return -EOPNOTSUPP;
1970 	}
1971 	return -EINPROGRESS;
1972 }
1973 
atmel_get_auth(struct net_device * dev,struct iw_request_info * info,union iwreq_data * wrqu,char * extra)1974 static int atmel_get_auth(struct net_device *dev,
1975 			       struct iw_request_info *info,
1976 			       union iwreq_data *wrqu, char *extra)
1977 {
1978 	struct atmel_private *priv = netdev_priv(dev);
1979 	struct iw_param *param = &wrqu->param;
1980 
1981 	switch (param->flags & IW_AUTH_INDEX) {
1982 	case IW_AUTH_DROP_UNENCRYPTED:
1983 		param->value = priv->exclude_unencrypted;
1984 		break;
1985 
1986 	case IW_AUTH_80211_AUTH_ALG:
1987 		if (priv->exclude_unencrypted == 1)
1988 			param->value = IW_AUTH_ALG_SHARED_KEY;
1989 		else
1990 			param->value = IW_AUTH_ALG_OPEN_SYSTEM;
1991 		break;
1992 
1993 	case IW_AUTH_WPA_ENABLED:
1994 		param->value = 0;
1995 		break;
1996 
1997 	default:
1998 		return -EOPNOTSUPP;
1999 	}
2000 	return 0;
2001 }
2002 
2003 
atmel_get_name(struct net_device * dev,struct iw_request_info * info,char * cwrq,char * extra)2004 static int atmel_get_name(struct net_device *dev,
2005 			  struct iw_request_info *info,
2006 			  char *cwrq,
2007 			  char *extra)
2008 {
2009 	strcpy(cwrq, "IEEE 802.11-DS");
2010 	return 0;
2011 }
2012 
atmel_set_rate(struct net_device * dev,struct iw_request_info * info,struct iw_param * vwrq,char * extra)2013 static int atmel_set_rate(struct net_device *dev,
2014 			  struct iw_request_info *info,
2015 			  struct iw_param *vwrq,
2016 			  char *extra)
2017 {
2018 	struct atmel_private *priv = netdev_priv(dev);
2019 
2020 	if (vwrq->fixed == 0) {
2021 		priv->tx_rate = 3;
2022 		priv->auto_tx_rate = 1;
2023 	} else {
2024 		priv->auto_tx_rate = 0;
2025 
2026 		/* Which type of value ? */
2027 		if ((vwrq->value < 4) && (vwrq->value >= 0)) {
2028 			/* Setting by rate index */
2029 			priv->tx_rate = vwrq->value;
2030 		} else {
2031 		/* Setting by frequency value */
2032 			switch (vwrq->value) {
2033 			case  1000000:
2034 				priv->tx_rate = 0;
2035 				break;
2036 			case  2000000:
2037 				priv->tx_rate = 1;
2038 				break;
2039 			case  5500000:
2040 				priv->tx_rate = 2;
2041 				break;
2042 			case 11000000:
2043 				priv->tx_rate = 3;
2044 				break;
2045 			default:
2046 				return -EINVAL;
2047 			}
2048 		}
2049 	}
2050 
2051 	return -EINPROGRESS;
2052 }
2053 
atmel_set_mode(struct net_device * dev,struct iw_request_info * info,__u32 * uwrq,char * extra)2054 static int atmel_set_mode(struct net_device *dev,
2055 			  struct iw_request_info *info,
2056 			  __u32 *uwrq,
2057 			  char *extra)
2058 {
2059 	struct atmel_private *priv = netdev_priv(dev);
2060 
2061 	if (*uwrq != IW_MODE_ADHOC && *uwrq != IW_MODE_INFRA)
2062 		return -EINVAL;
2063 
2064 	priv->operating_mode = *uwrq;
2065 	return -EINPROGRESS;
2066 }
2067 
atmel_get_mode(struct net_device * dev,struct iw_request_info * info,__u32 * uwrq,char * extra)2068 static int atmel_get_mode(struct net_device *dev,
2069 			  struct iw_request_info *info,
2070 			  __u32 *uwrq,
2071 			  char *extra)
2072 {
2073 	struct atmel_private *priv = netdev_priv(dev);
2074 
2075 	*uwrq = priv->operating_mode;
2076 	return 0;
2077 }
2078 
atmel_get_rate(struct net_device * dev,struct iw_request_info * info,struct iw_param * vwrq,char * extra)2079 static int atmel_get_rate(struct net_device *dev,
2080 			 struct iw_request_info *info,
2081 			 struct iw_param *vwrq,
2082 			 char *extra)
2083 {
2084 	struct atmel_private *priv = netdev_priv(dev);
2085 
2086 	if (priv->auto_tx_rate) {
2087 		vwrq->fixed = 0;
2088 		vwrq->value = 11000000;
2089 	} else {
2090 		vwrq->fixed = 1;
2091 		switch (priv->tx_rate) {
2092 		case 0:
2093 			vwrq->value =  1000000;
2094 			break;
2095 		case 1:
2096 			vwrq->value =  2000000;
2097 			break;
2098 		case 2:
2099 			vwrq->value =  5500000;
2100 			break;
2101 		case 3:
2102 			vwrq->value = 11000000;
2103 			break;
2104 		}
2105 	}
2106 	return 0;
2107 }
2108 
atmel_set_power(struct net_device * dev,struct iw_request_info * info,struct iw_param * vwrq,char * extra)2109 static int atmel_set_power(struct net_device *dev,
2110 			   struct iw_request_info *info,
2111 			   struct iw_param *vwrq,
2112 			   char *extra)
2113 {
2114 	struct atmel_private *priv = netdev_priv(dev);
2115 	priv->power_mode = vwrq->disabled ? 0 : 1;
2116 	return -EINPROGRESS;
2117 }
2118 
atmel_get_power(struct net_device * dev,struct iw_request_info * info,struct iw_param * vwrq,char * extra)2119 static int atmel_get_power(struct net_device *dev,
2120 			   struct iw_request_info *info,
2121 			   struct iw_param *vwrq,
2122 			   char *extra)
2123 {
2124 	struct atmel_private *priv = netdev_priv(dev);
2125 	vwrq->disabled = priv->power_mode ? 0 : 1;
2126 	vwrq->flags = IW_POWER_ON;
2127 	return 0;
2128 }
2129 
atmel_set_retry(struct net_device * dev,struct iw_request_info * info,struct iw_param * vwrq,char * extra)2130 static int atmel_set_retry(struct net_device *dev,
2131 			   struct iw_request_info *info,
2132 			   struct iw_param *vwrq,
2133 			   char *extra)
2134 {
2135 	struct atmel_private *priv = netdev_priv(dev);
2136 
2137 	if (!vwrq->disabled && (vwrq->flags & IW_RETRY_LIMIT)) {
2138 		if (vwrq->flags & IW_RETRY_LONG)
2139 			priv->long_retry = vwrq->value;
2140 		else if (vwrq->flags & IW_RETRY_SHORT)
2141 			priv->short_retry = vwrq->value;
2142 		else {
2143 			/* No modifier : set both */
2144 			priv->long_retry = vwrq->value;
2145 			priv->short_retry = vwrq->value;
2146 		}
2147 		return -EINPROGRESS;
2148 	}
2149 
2150 	return -EINVAL;
2151 }
2152 
atmel_get_retry(struct net_device * dev,struct iw_request_info * info,struct iw_param * vwrq,char * extra)2153 static int atmel_get_retry(struct net_device *dev,
2154 			   struct iw_request_info *info,
2155 			   struct iw_param *vwrq,
2156 			   char *extra)
2157 {
2158 	struct atmel_private *priv = netdev_priv(dev);
2159 
2160 	vwrq->disabled = 0;      /* Can't be disabled */
2161 
2162 	/* Note : by default, display the short retry number */
2163 	if (vwrq->flags & IW_RETRY_LONG) {
2164 		vwrq->flags = IW_RETRY_LIMIT | IW_RETRY_LONG;
2165 		vwrq->value = priv->long_retry;
2166 	} else {
2167 		vwrq->flags = IW_RETRY_LIMIT;
2168 		vwrq->value = priv->short_retry;
2169 		if (priv->long_retry != priv->short_retry)
2170 			vwrq->flags |= IW_RETRY_SHORT;
2171 	}
2172 
2173 	return 0;
2174 }
2175 
atmel_set_rts(struct net_device * dev,struct iw_request_info * info,struct iw_param * vwrq,char * extra)2176 static int atmel_set_rts(struct net_device *dev,
2177 			 struct iw_request_info *info,
2178 			 struct iw_param *vwrq,
2179 			 char *extra)
2180 {
2181 	struct atmel_private *priv = netdev_priv(dev);
2182 	int rthr = vwrq->value;
2183 
2184 	if (vwrq->disabled)
2185 		rthr = 2347;
2186 	if ((rthr < 0) || (rthr > 2347)) {
2187 		return -EINVAL;
2188 	}
2189 	priv->rts_threshold = rthr;
2190 
2191 	return -EINPROGRESS;		/* Call commit handler */
2192 }
2193 
atmel_get_rts(struct net_device * dev,struct iw_request_info * info,struct iw_param * vwrq,char * extra)2194 static int atmel_get_rts(struct net_device *dev,
2195 			 struct iw_request_info *info,
2196 			 struct iw_param *vwrq,
2197 			 char *extra)
2198 {
2199 	struct atmel_private *priv = netdev_priv(dev);
2200 
2201 	vwrq->value = priv->rts_threshold;
2202 	vwrq->disabled = (vwrq->value >= 2347);
2203 	vwrq->fixed = 1;
2204 
2205 	return 0;
2206 }
2207 
atmel_set_frag(struct net_device * dev,struct iw_request_info * info,struct iw_param * vwrq,char * extra)2208 static int atmel_set_frag(struct net_device *dev,
2209 			  struct iw_request_info *info,
2210 			  struct iw_param *vwrq,
2211 			  char *extra)
2212 {
2213 	struct atmel_private *priv = netdev_priv(dev);
2214 	int fthr = vwrq->value;
2215 
2216 	if (vwrq->disabled)
2217 		fthr = 2346;
2218 	if ((fthr < 256) || (fthr > 2346)) {
2219 		return -EINVAL;
2220 	}
2221 	fthr &= ~0x1;	/* Get an even value - is it really needed ??? */
2222 	priv->frag_threshold = fthr;
2223 
2224 	return -EINPROGRESS;		/* Call commit handler */
2225 }
2226 
atmel_get_frag(struct net_device * dev,struct iw_request_info * info,struct iw_param * vwrq,char * extra)2227 static int atmel_get_frag(struct net_device *dev,
2228 			  struct iw_request_info *info,
2229 			  struct iw_param *vwrq,
2230 			  char *extra)
2231 {
2232 	struct atmel_private *priv = netdev_priv(dev);
2233 
2234 	vwrq->value = priv->frag_threshold;
2235 	vwrq->disabled = (vwrq->value >= 2346);
2236 	vwrq->fixed = 1;
2237 
2238 	return 0;
2239 }
2240 
atmel_set_freq(struct net_device * dev,struct iw_request_info * info,struct iw_freq * fwrq,char * extra)2241 static int atmel_set_freq(struct net_device *dev,
2242 			  struct iw_request_info *info,
2243 			  struct iw_freq *fwrq,
2244 			  char *extra)
2245 {
2246 	struct atmel_private *priv = netdev_priv(dev);
2247 	int rc = -EINPROGRESS;		/* Call commit handler */
2248 
2249 	/* If setting by frequency, convert to a channel */
2250 	if (fwrq->e == 1) {
2251 		int f = fwrq->m / 100000;
2252 
2253 		/* Hack to fall through... */
2254 		fwrq->e = 0;
2255 		fwrq->m = ieee80211_frequency_to_channel(f);
2256 	}
2257 	/* Setting by channel number */
2258 	if (fwrq->m < 0 || fwrq->m > 1000 || fwrq->e > 0)
2259 		rc = -EOPNOTSUPP;
2260 	else {
2261 		int channel = fwrq->m;
2262 		if (atmel_validate_channel(priv, channel) == 0) {
2263 			priv->channel = channel;
2264 		} else {
2265 			rc = -EINVAL;
2266 		}
2267 	}
2268 	return rc;
2269 }
2270 
atmel_get_freq(struct net_device * dev,struct iw_request_info * info,struct iw_freq * fwrq,char * extra)2271 static int atmel_get_freq(struct net_device *dev,
2272 			  struct iw_request_info *info,
2273 			  struct iw_freq *fwrq,
2274 			  char *extra)
2275 {
2276 	struct atmel_private *priv = netdev_priv(dev);
2277 
2278 	fwrq->m = priv->channel;
2279 	fwrq->e = 0;
2280 	return 0;
2281 }
2282 
atmel_set_scan(struct net_device * dev,struct iw_request_info * info,struct iw_point * dwrq,char * extra)2283 static int atmel_set_scan(struct net_device *dev,
2284 			  struct iw_request_info *info,
2285 			  struct iw_point *dwrq,
2286 			  char *extra)
2287 {
2288 	struct atmel_private *priv = netdev_priv(dev);
2289 	unsigned long flags;
2290 
2291 	/* Note : you may have realised that, as this is a SET operation,
2292 	 * this is privileged and therefore a normal user can't
2293 	 * perform scanning.
2294 	 * This is not an error, while the device perform scanning,
2295 	 * traffic doesn't flow, so it's a perfect DoS...
2296 	 * Jean II */
2297 
2298 	if (priv->station_state == STATION_STATE_DOWN)
2299 		return -EAGAIN;
2300 
2301 	/* Timeout old surveys. */
2302 	if (time_after(jiffies, priv->last_survey + 20 * HZ))
2303 		priv->site_survey_state = SITE_SURVEY_IDLE;
2304 	priv->last_survey = jiffies;
2305 
2306 	/* Initiate a scan command */
2307 	if (priv->site_survey_state == SITE_SURVEY_IN_PROGRESS)
2308 		return -EBUSY;
2309 
2310 	del_timer_sync(&priv->management_timer);
2311 	spin_lock_irqsave(&priv->irqlock, flags);
2312 
2313 	priv->site_survey_state = SITE_SURVEY_IN_PROGRESS;
2314 	priv->fast_scan = 0;
2315 	atmel_scan(priv, 0);
2316 	spin_unlock_irqrestore(&priv->irqlock, flags);
2317 
2318 	return 0;
2319 }
2320 
atmel_get_scan(struct net_device * dev,struct iw_request_info * info,struct iw_point * dwrq,char * extra)2321 static int atmel_get_scan(struct net_device *dev,
2322 			  struct iw_request_info *info,
2323 			  struct iw_point *dwrq,
2324 			  char *extra)
2325 {
2326 	struct atmel_private *priv = netdev_priv(dev);
2327 	int i;
2328 	char *current_ev = extra;
2329 	struct iw_event	iwe;
2330 
2331 	if (priv->site_survey_state != SITE_SURVEY_COMPLETED)
2332 		return -EAGAIN;
2333 
2334 	for (i = 0; i < priv->BSS_list_entries; i++) {
2335 		iwe.cmd = SIOCGIWAP;
2336 		iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
2337 		memcpy(iwe.u.ap_addr.sa_data, priv->BSSinfo[i].BSSID, ETH_ALEN);
2338 		current_ev = iwe_stream_add_event(info, current_ev,
2339 						  extra + IW_SCAN_MAX_DATA,
2340 						  &iwe, IW_EV_ADDR_LEN);
2341 
2342 		iwe.u.data.length =  priv->BSSinfo[i].SSIDsize;
2343 		if (iwe.u.data.length > 32)
2344 			iwe.u.data.length = 32;
2345 		iwe.cmd = SIOCGIWESSID;
2346 		iwe.u.data.flags = 1;
2347 		current_ev = iwe_stream_add_point(info, current_ev,
2348 						  extra + IW_SCAN_MAX_DATA,
2349 						  &iwe, priv->BSSinfo[i].SSID);
2350 
2351 		iwe.cmd = SIOCGIWMODE;
2352 		iwe.u.mode = priv->BSSinfo[i].BSStype;
2353 		current_ev = iwe_stream_add_event(info, current_ev,
2354 						  extra + IW_SCAN_MAX_DATA,
2355 						  &iwe, IW_EV_UINT_LEN);
2356 
2357 		iwe.cmd = SIOCGIWFREQ;
2358 		iwe.u.freq.m = priv->BSSinfo[i].channel;
2359 		iwe.u.freq.e = 0;
2360 		current_ev = iwe_stream_add_event(info, current_ev,
2361 						  extra + IW_SCAN_MAX_DATA,
2362 						  &iwe, IW_EV_FREQ_LEN);
2363 
2364 		/* Add quality statistics */
2365 		iwe.cmd = IWEVQUAL;
2366 		iwe.u.qual.level = priv->BSSinfo[i].RSSI;
2367 		iwe.u.qual.qual  = iwe.u.qual.level;
2368 		/* iwe.u.qual.noise  = SOMETHING */
2369 		current_ev = iwe_stream_add_event(info, current_ev,
2370 						  extra + IW_SCAN_MAX_DATA,
2371 						  &iwe, IW_EV_QUAL_LEN);
2372 
2373 
2374 		iwe.cmd = SIOCGIWENCODE;
2375 		if (priv->BSSinfo[i].UsingWEP)
2376 			iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
2377 		else
2378 			iwe.u.data.flags = IW_ENCODE_DISABLED;
2379 		iwe.u.data.length = 0;
2380 		current_ev = iwe_stream_add_point(info, current_ev,
2381 						  extra + IW_SCAN_MAX_DATA,
2382 						  &iwe, NULL);
2383 	}
2384 
2385 	/* Length of data */
2386 	dwrq->length = (current_ev - extra);
2387 	dwrq->flags = 0;
2388 
2389 	return 0;
2390 }
2391 
atmel_get_range(struct net_device * dev,struct iw_request_info * info,struct iw_point * dwrq,char * extra)2392 static int atmel_get_range(struct net_device *dev,
2393 			   struct iw_request_info *info,
2394 			   struct iw_point *dwrq,
2395 			   char *extra)
2396 {
2397 	struct atmel_private *priv = netdev_priv(dev);
2398 	struct iw_range *range = (struct iw_range *) extra;
2399 	int k, i, j;
2400 
2401 	dwrq->length = sizeof(struct iw_range);
2402 	memset(range, 0, sizeof(struct iw_range));
2403 	range->min_nwid = 0x0000;
2404 	range->max_nwid = 0x0000;
2405 	range->num_channels = 0;
2406 	for (j = 0; j < ARRAY_SIZE(channel_table); j++)
2407 		if (priv->reg_domain == channel_table[j].reg_domain) {
2408 			range->num_channels = channel_table[j].max - channel_table[j].min + 1;
2409 			break;
2410 		}
2411 	if (range->num_channels != 0) {
2412 		for (k = 0, i = channel_table[j].min; i <= channel_table[j].max; i++) {
2413 			range->freq[k].i = i; /* List index */
2414 
2415 			/* Values in MHz -> * 10^5 * 10 */
2416 			range->freq[k].m = 100000 *
2417 			 ieee80211_channel_to_frequency(i, NL80211_BAND_2GHZ);
2418 			range->freq[k++].e = 1;
2419 		}
2420 		range->num_frequency = k;
2421 	}
2422 
2423 	range->max_qual.qual = 100;
2424 	range->max_qual.level = 100;
2425 	range->max_qual.noise = 0;
2426 	range->max_qual.updated = IW_QUAL_NOISE_INVALID;
2427 
2428 	range->avg_qual.qual = 50;
2429 	range->avg_qual.level = 50;
2430 	range->avg_qual.noise = 0;
2431 	range->avg_qual.updated = IW_QUAL_NOISE_INVALID;
2432 
2433 	range->sensitivity = 0;
2434 
2435 	range->bitrate[0] =  1000000;
2436 	range->bitrate[1] =  2000000;
2437 	range->bitrate[2] =  5500000;
2438 	range->bitrate[3] = 11000000;
2439 	range->num_bitrates = 4;
2440 
2441 	range->min_rts = 0;
2442 	range->max_rts = 2347;
2443 	range->min_frag = 256;
2444 	range->max_frag = 2346;
2445 
2446 	range->encoding_size[0] = 5;
2447 	range->encoding_size[1] = 13;
2448 	range->num_encoding_sizes = 2;
2449 	range->max_encoding_tokens = 4;
2450 
2451 	range->pmp_flags = IW_POWER_ON;
2452 	range->pmt_flags = IW_POWER_ON;
2453 	range->pm_capa = 0;
2454 
2455 	range->we_version_source = WIRELESS_EXT;
2456 	range->we_version_compiled = WIRELESS_EXT;
2457 	range->retry_capa = IW_RETRY_LIMIT ;
2458 	range->retry_flags = IW_RETRY_LIMIT;
2459 	range->r_time_flags = 0;
2460 	range->min_retry = 1;
2461 	range->max_retry = 65535;
2462 
2463 	return 0;
2464 }
2465 
atmel_set_wap(struct net_device * dev,struct iw_request_info * info,struct sockaddr * awrq,char * extra)2466 static int atmel_set_wap(struct net_device *dev,
2467 			 struct iw_request_info *info,
2468 			 struct sockaddr *awrq,
2469 			 char *extra)
2470 {
2471 	struct atmel_private *priv = netdev_priv(dev);
2472 	int i;
2473 	static const u8 any[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
2474 	static const u8 off[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
2475 	unsigned long flags;
2476 
2477 	if (awrq->sa_family != ARPHRD_ETHER)
2478 		return -EINVAL;
2479 
2480 	if (!memcmp(any, awrq->sa_data, 6) ||
2481 	    !memcmp(off, awrq->sa_data, 6)) {
2482 		del_timer_sync(&priv->management_timer);
2483 		spin_lock_irqsave(&priv->irqlock, flags);
2484 		atmel_scan(priv, 1);
2485 		spin_unlock_irqrestore(&priv->irqlock, flags);
2486 		return 0;
2487 	}
2488 
2489 	for (i = 0; i < priv->BSS_list_entries; i++) {
2490 		if (memcmp(priv->BSSinfo[i].BSSID, awrq->sa_data, 6) == 0) {
2491 			if (!priv->wep_is_on && priv->BSSinfo[i].UsingWEP) {
2492 				return -EINVAL;
2493 			} else if  (priv->wep_is_on && !priv->BSSinfo[i].UsingWEP) {
2494 				return -EINVAL;
2495 			} else {
2496 				del_timer_sync(&priv->management_timer);
2497 				spin_lock_irqsave(&priv->irqlock, flags);
2498 				atmel_join_bss(priv, i);
2499 				spin_unlock_irqrestore(&priv->irqlock, flags);
2500 				return 0;
2501 			}
2502 		}
2503 	}
2504 
2505 	return -EINVAL;
2506 }
2507 
atmel_config_commit(struct net_device * dev,struct iw_request_info * info,void * zwrq,char * extra)2508 static int atmel_config_commit(struct net_device *dev,
2509 			       struct iw_request_info *info,	/* NULL */
2510 			       void *zwrq,			/* NULL */
2511 			       char *extra)			/* NULL */
2512 {
2513 	return atmel_open(dev);
2514 }
2515 
2516 static const iw_handler atmel_handler[] =
2517 {
2518 	(iw_handler) atmel_config_commit,	/* SIOCSIWCOMMIT */
2519 	(iw_handler) atmel_get_name,		/* SIOCGIWNAME */
2520 	(iw_handler) NULL,			/* SIOCSIWNWID */
2521 	(iw_handler) NULL,			/* SIOCGIWNWID */
2522 	(iw_handler) atmel_set_freq,		/* SIOCSIWFREQ */
2523 	(iw_handler) atmel_get_freq,		/* SIOCGIWFREQ */
2524 	(iw_handler) atmel_set_mode,		/* SIOCSIWMODE */
2525 	(iw_handler) atmel_get_mode,		/* SIOCGIWMODE */
2526 	(iw_handler) NULL,			/* SIOCSIWSENS */
2527 	(iw_handler) NULL,			/* SIOCGIWSENS */
2528 	(iw_handler) NULL,			/* SIOCSIWRANGE */
2529 	(iw_handler) atmel_get_range,           /* SIOCGIWRANGE */
2530 	(iw_handler) NULL,			/* SIOCSIWPRIV */
2531 	(iw_handler) NULL,			/* SIOCGIWPRIV */
2532 	(iw_handler) NULL,			/* SIOCSIWSTATS */
2533 	(iw_handler) NULL,			/* SIOCGIWSTATS */
2534 	(iw_handler) NULL,			/* SIOCSIWSPY */
2535 	(iw_handler) NULL,			/* SIOCGIWSPY */
2536 	(iw_handler) NULL,			/* -- hole -- */
2537 	(iw_handler) NULL,			/* -- hole -- */
2538 	(iw_handler) atmel_set_wap,		/* SIOCSIWAP */
2539 	(iw_handler) atmel_get_wap,		/* SIOCGIWAP */
2540 	(iw_handler) NULL,			/* -- hole -- */
2541 	(iw_handler) NULL,			/* SIOCGIWAPLIST */
2542 	(iw_handler) atmel_set_scan,		/* SIOCSIWSCAN */
2543 	(iw_handler) atmel_get_scan,		/* SIOCGIWSCAN */
2544 	(iw_handler) atmel_set_essid,		/* SIOCSIWESSID */
2545 	(iw_handler) atmel_get_essid,		/* SIOCGIWESSID */
2546 	(iw_handler) NULL,			/* SIOCSIWNICKN */
2547 	(iw_handler) NULL,			/* SIOCGIWNICKN */
2548 	(iw_handler) NULL,			/* -- hole -- */
2549 	(iw_handler) NULL,			/* -- hole -- */
2550 	(iw_handler) atmel_set_rate,		/* SIOCSIWRATE */
2551 	(iw_handler) atmel_get_rate,		/* SIOCGIWRATE */
2552 	(iw_handler) atmel_set_rts,		/* SIOCSIWRTS */
2553 	(iw_handler) atmel_get_rts,		/* SIOCGIWRTS */
2554 	(iw_handler) atmel_set_frag,		/* SIOCSIWFRAG */
2555 	(iw_handler) atmel_get_frag,		/* SIOCGIWFRAG */
2556 	(iw_handler) NULL,			/* SIOCSIWTXPOW */
2557 	(iw_handler) NULL,			/* SIOCGIWTXPOW */
2558 	(iw_handler) atmel_set_retry,		/* SIOCSIWRETRY */
2559 	(iw_handler) atmel_get_retry,		/* SIOCGIWRETRY */
2560 	(iw_handler) atmel_set_encode,		/* SIOCSIWENCODE */
2561 	(iw_handler) atmel_get_encode,		/* SIOCGIWENCODE */
2562 	(iw_handler) atmel_set_power,		/* SIOCSIWPOWER */
2563 	(iw_handler) atmel_get_power,		/* SIOCGIWPOWER */
2564 	(iw_handler) NULL,			/* -- hole -- */
2565 	(iw_handler) NULL,			/* -- hole -- */
2566 	(iw_handler) NULL,			/* SIOCSIWGENIE */
2567 	(iw_handler) NULL,			/* SIOCGIWGENIE */
2568 	(iw_handler) atmel_set_auth,		/* SIOCSIWAUTH */
2569 	(iw_handler) atmel_get_auth,		/* SIOCGIWAUTH */
2570 	(iw_handler) atmel_set_encodeext,	/* SIOCSIWENCODEEXT */
2571 	(iw_handler) atmel_get_encodeext,	/* SIOCGIWENCODEEXT */
2572 	(iw_handler) NULL,			/* SIOCSIWPMKSA */
2573 };
2574 
2575 static const iw_handler atmel_private_handler[] =
2576 {
2577 	NULL,				/* SIOCIWFIRSTPRIV */
2578 };
2579 
2580 struct atmel_priv_ioctl {
2581 	char id[32];
2582 	unsigned char __user *data;
2583 	unsigned short len;
2584 };
2585 
2586 #define ATMELFWL	SIOCIWFIRSTPRIV
2587 #define ATMELIDIFC	ATMELFWL + 1
2588 #define ATMELRD		ATMELFWL + 2
2589 #define ATMELMAGIC 0x51807
2590 #define REGDOMAINSZ 20
2591 
2592 static const struct iw_priv_args atmel_private_args[] = {
2593 	{
2594 		.cmd = ATMELFWL,
2595 		.set_args = IW_PRIV_TYPE_BYTE
2596 				| IW_PRIV_SIZE_FIXED
2597 				| sizeof(struct atmel_priv_ioctl),
2598 		.get_args = IW_PRIV_TYPE_NONE,
2599 		.name = "atmelfwl"
2600 	}, {
2601 		.cmd = ATMELIDIFC,
2602 		.set_args = IW_PRIV_TYPE_NONE,
2603 		.get_args = IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
2604 		.name = "atmelidifc"
2605 	}, {
2606 		.cmd = ATMELRD,
2607 		.set_args = IW_PRIV_TYPE_CHAR | REGDOMAINSZ,
2608 		.get_args = IW_PRIV_TYPE_NONE,
2609 		.name = "regdomain"
2610 	},
2611 };
2612 
2613 static const struct iw_handler_def atmel_handler_def = {
2614 	.num_standard	= ARRAY_SIZE(atmel_handler),
2615 	.num_private	= ARRAY_SIZE(atmel_private_handler),
2616 	.num_private_args = ARRAY_SIZE(atmel_private_args),
2617 	.standard	= (iw_handler *) atmel_handler,
2618 	.private	= (iw_handler *) atmel_private_handler,
2619 	.private_args	= (struct iw_priv_args *) atmel_private_args,
2620 	.get_wireless_stats = atmel_get_wireless_stats
2621 };
2622 
atmel_ioctl(struct net_device * dev,struct ifreq * rq,int cmd)2623 static int atmel_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
2624 {
2625 	int i, rc = 0;
2626 	struct atmel_private *priv = netdev_priv(dev);
2627 	struct atmel_priv_ioctl com;
2628 	struct iwreq *wrq = (struct iwreq *) rq;
2629 	unsigned char *new_firmware;
2630 	char domain[REGDOMAINSZ + 1];
2631 
2632 	switch (cmd) {
2633 	case ATMELIDIFC:
2634 		wrq->u.param.value = ATMELMAGIC;
2635 		break;
2636 
2637 	case ATMELFWL:
2638 		if (copy_from_user(&com, rq->ifr_data, sizeof(com))) {
2639 			rc = -EFAULT;
2640 			break;
2641 		}
2642 
2643 		if (!capable(CAP_NET_ADMIN)) {
2644 			rc = -EPERM;
2645 			break;
2646 		}
2647 
2648 		new_firmware = memdup_user(com.data, com.len);
2649 		if (IS_ERR(new_firmware)) {
2650 			rc = PTR_ERR(new_firmware);
2651 			break;
2652 		}
2653 
2654 		kfree(priv->firmware);
2655 
2656 		priv->firmware = new_firmware;
2657 		priv->firmware_length = com.len;
2658 		strncpy(priv->firmware_id, com.id, 31);
2659 		priv->firmware_id[31] = '\0';
2660 		break;
2661 
2662 	case ATMELRD:
2663 		if (copy_from_user(domain, rq->ifr_data, REGDOMAINSZ)) {
2664 			rc = -EFAULT;
2665 			break;
2666 		}
2667 
2668 		if (!capable(CAP_NET_ADMIN)) {
2669 			rc = -EPERM;
2670 			break;
2671 		}
2672 
2673 		domain[REGDOMAINSZ] = 0;
2674 		rc = -EINVAL;
2675 		for (i = 0; i < ARRAY_SIZE(channel_table); i++) {
2676 			if (!strcasecmp(channel_table[i].name, domain)) {
2677 				priv->config_reg_domain = channel_table[i].reg_domain;
2678 				rc = 0;
2679 			}
2680 		}
2681 
2682 		if (rc == 0 &&  priv->station_state != STATION_STATE_DOWN)
2683 			rc = atmel_open(dev);
2684 		break;
2685 
2686 	default:
2687 		rc = -EOPNOTSUPP;
2688 	}
2689 
2690 	return rc;
2691 }
2692 
2693 struct auth_body {
2694 	__le16 alg;
2695 	__le16 trans_seq;
2696 	__le16 status;
2697 	u8 el_id;
2698 	u8 chall_text_len;
2699 	u8 chall_text[253];
2700 };
2701 
atmel_enter_state(struct atmel_private * priv,int new_state)2702 static void atmel_enter_state(struct atmel_private *priv, int new_state)
2703 {
2704 	int old_state = priv->station_state;
2705 
2706 	if (new_state == old_state)
2707 		return;
2708 
2709 	priv->station_state = new_state;
2710 
2711 	if (new_state == STATION_STATE_READY) {
2712 		netif_start_queue(priv->dev);
2713 		netif_carrier_on(priv->dev);
2714 	}
2715 
2716 	if (old_state == STATION_STATE_READY) {
2717 		netif_carrier_off(priv->dev);
2718 		if (netif_running(priv->dev))
2719 			netif_stop_queue(priv->dev);
2720 		priv->last_beacon_timestamp = 0;
2721 	}
2722 }
2723 
atmel_scan(struct atmel_private * priv,int specific_ssid)2724 static void atmel_scan(struct atmel_private *priv, int specific_ssid)
2725 {
2726 	struct {
2727 		u8 BSSID[ETH_ALEN];
2728 		u8 SSID[MAX_SSID_LENGTH];
2729 		u8 scan_type;
2730 		u8 channel;
2731 		__le16 BSS_type;
2732 		__le16 min_channel_time;
2733 		__le16 max_channel_time;
2734 		u8 options;
2735 		u8 SSID_size;
2736 	} cmd;
2737 
2738 	eth_broadcast_addr(cmd.BSSID);
2739 
2740 	if (priv->fast_scan) {
2741 		cmd.SSID_size = priv->SSID_size;
2742 		memcpy(cmd.SSID, priv->SSID, priv->SSID_size);
2743 		cmd.min_channel_time = cpu_to_le16(10);
2744 		cmd.max_channel_time = cpu_to_le16(50);
2745 	} else {
2746 		priv->BSS_list_entries = 0;
2747 		cmd.SSID_size = 0;
2748 		cmd.min_channel_time = cpu_to_le16(10);
2749 		cmd.max_channel_time = cpu_to_le16(120);
2750 	}
2751 
2752 	cmd.options = 0;
2753 
2754 	if (!specific_ssid)
2755 		cmd.options |= SCAN_OPTIONS_SITE_SURVEY;
2756 
2757 	cmd.channel = (priv->channel & 0x7f);
2758 	cmd.scan_type = SCAN_TYPE_ACTIVE;
2759 	cmd.BSS_type = cpu_to_le16(priv->operating_mode == IW_MODE_ADHOC ?
2760 		BSS_TYPE_AD_HOC : BSS_TYPE_INFRASTRUCTURE);
2761 
2762 	atmel_send_command(priv, CMD_Scan, &cmd, sizeof(cmd));
2763 
2764 	/* This must come after all hardware access to avoid being messed up
2765 	   by stuff happening in interrupt context after we leave STATE_DOWN */
2766 	atmel_enter_state(priv, STATION_STATE_SCANNING);
2767 }
2768 
join(struct atmel_private * priv,int type)2769 static void join(struct atmel_private *priv, int type)
2770 {
2771 	struct {
2772 		u8 BSSID[6];
2773 		u8 SSID[MAX_SSID_LENGTH];
2774 		u8 BSS_type; /* this is a short in a scan command - weird */
2775 		u8 channel;
2776 		__le16 timeout;
2777 		u8 SSID_size;
2778 		u8 reserved;
2779 	} cmd;
2780 
2781 	cmd.SSID_size = priv->SSID_size;
2782 	memcpy(cmd.SSID, priv->SSID, priv->SSID_size);
2783 	memcpy(cmd.BSSID, priv->CurrentBSSID, ETH_ALEN);
2784 	cmd.channel = (priv->channel & 0x7f);
2785 	cmd.BSS_type = type;
2786 	cmd.timeout = cpu_to_le16(2000);
2787 
2788 	atmel_send_command(priv, CMD_Join, &cmd, sizeof(cmd));
2789 }
2790 
start(struct atmel_private * priv,int type)2791 static void start(struct atmel_private *priv, int type)
2792 {
2793 	struct {
2794 		u8 BSSID[6];
2795 		u8 SSID[MAX_SSID_LENGTH];
2796 		u8 BSS_type;
2797 		u8 channel;
2798 		u8 SSID_size;
2799 		u8 reserved[3];
2800 	} cmd;
2801 
2802 	cmd.SSID_size = priv->SSID_size;
2803 	memcpy(cmd.SSID, priv->SSID, priv->SSID_size);
2804 	memcpy(cmd.BSSID, priv->BSSID, ETH_ALEN);
2805 	cmd.BSS_type = type;
2806 	cmd.channel = (priv->channel & 0x7f);
2807 
2808 	atmel_send_command(priv, CMD_Start, &cmd, sizeof(cmd));
2809 }
2810 
handle_beacon_probe(struct atmel_private * priv,u16 capability,u8 channel)2811 static void handle_beacon_probe(struct atmel_private *priv, u16 capability,
2812 				u8 channel)
2813 {
2814 	int rejoin = 0;
2815 	int new = capability & WLAN_CAPABILITY_SHORT_PREAMBLE ?
2816 		SHORT_PREAMBLE : LONG_PREAMBLE;
2817 
2818 	if (priv->preamble != new) {
2819 		priv->preamble = new;
2820 		rejoin = 1;
2821 		atmel_set_mib8(priv, Local_Mib_Type, LOCAL_MIB_PREAMBLE_TYPE, new);
2822 	}
2823 
2824 	if (priv->channel != channel) {
2825 		priv->channel = channel;
2826 		rejoin = 1;
2827 		atmel_set_mib8(priv, Phy_Mib_Type, PHY_MIB_CHANNEL_POS, channel);
2828 	}
2829 
2830 	if (rejoin) {
2831 		priv->station_is_associated = 0;
2832 		atmel_enter_state(priv, STATION_STATE_JOINNING);
2833 
2834 		if (priv->operating_mode == IW_MODE_INFRA)
2835 			join(priv, BSS_TYPE_INFRASTRUCTURE);
2836 		else
2837 			join(priv, BSS_TYPE_AD_HOC);
2838 	}
2839 }
2840 
send_authentication_request(struct atmel_private * priv,u16 system,u8 * challenge,int challenge_len)2841 static void send_authentication_request(struct atmel_private *priv, u16 system,
2842 					u8 *challenge, int challenge_len)
2843 {
2844 	struct ieee80211_hdr header;
2845 	struct auth_body auth;
2846 
2847 	header.frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_AUTH);
2848 	header.duration_id = cpu_to_le16(0x8000);
2849 	header.seq_ctrl = 0;
2850 	memcpy(header.addr1, priv->CurrentBSSID, ETH_ALEN);
2851 	memcpy(header.addr2, priv->dev->dev_addr, ETH_ALEN);
2852 	memcpy(header.addr3, priv->CurrentBSSID, ETH_ALEN);
2853 
2854 	if (priv->wep_is_on && priv->CurrentAuthentTransactionSeqNum != 1)
2855 		/* no WEP for authentication frames with TrSeqNo 1 */
2856 		header.frame_control |=  cpu_to_le16(IEEE80211_FCTL_PROTECTED);
2857 
2858 	auth.alg = cpu_to_le16(system);
2859 
2860 	auth.status = 0;
2861 	auth.trans_seq = cpu_to_le16(priv->CurrentAuthentTransactionSeqNum);
2862 	priv->ExpectedAuthentTransactionSeqNum = priv->CurrentAuthentTransactionSeqNum+1;
2863 	priv->CurrentAuthentTransactionSeqNum += 2;
2864 
2865 	if (challenge_len != 0)	{
2866 		auth.el_id = 16; /* challenge_text */
2867 		auth.chall_text_len = challenge_len;
2868 		memcpy(auth.chall_text, challenge, challenge_len);
2869 		atmel_transmit_management_frame(priv, &header, (u8 *)&auth, 8 + challenge_len);
2870 	} else {
2871 		atmel_transmit_management_frame(priv, &header, (u8 *)&auth, 6);
2872 	}
2873 }
2874 
send_association_request(struct atmel_private * priv,int is_reassoc)2875 static void send_association_request(struct atmel_private *priv, int is_reassoc)
2876 {
2877 	u8 *ssid_el_p;
2878 	int bodysize;
2879 	struct ieee80211_hdr header;
2880 	struct ass_req_format {
2881 		__le16 capability;
2882 		__le16 listen_interval;
2883 		u8 ap[ETH_ALEN]; /* nothing after here directly accessible */
2884 		u8 ssid_el_id;
2885 		u8 ssid_len;
2886 		u8 ssid[MAX_SSID_LENGTH];
2887 		u8 sup_rates_el_id;
2888 		u8 sup_rates_len;
2889 		u8 rates[4];
2890 	} body;
2891 
2892 	header.frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
2893 		(is_reassoc ? IEEE80211_STYPE_REASSOC_REQ : IEEE80211_STYPE_ASSOC_REQ));
2894 	header.duration_id = cpu_to_le16(0x8000);
2895 	header.seq_ctrl = 0;
2896 
2897 	memcpy(header.addr1, priv->CurrentBSSID, ETH_ALEN);
2898 	memcpy(header.addr2, priv->dev->dev_addr, ETH_ALEN);
2899 	memcpy(header.addr3, priv->CurrentBSSID, ETH_ALEN);
2900 
2901 	body.capability = cpu_to_le16(WLAN_CAPABILITY_ESS);
2902 	if (priv->wep_is_on)
2903 		body.capability |= cpu_to_le16(WLAN_CAPABILITY_PRIVACY);
2904 	if (priv->preamble == SHORT_PREAMBLE)
2905 		body.capability |= cpu_to_le16(WLAN_CAPABILITY_SHORT_PREAMBLE);
2906 
2907 	body.listen_interval = cpu_to_le16(priv->listen_interval * priv->beacon_period);
2908 
2909 	/* current AP address - only in reassoc frame */
2910 	if (is_reassoc) {
2911 		memcpy(body.ap, priv->CurrentBSSID, ETH_ALEN);
2912 		ssid_el_p = &body.ssid_el_id;
2913 		bodysize = 18 + priv->SSID_size;
2914 	} else {
2915 		ssid_el_p = &body.ap[0];
2916 		bodysize = 12 + priv->SSID_size;
2917 	}
2918 
2919 	ssid_el_p[0] = WLAN_EID_SSID;
2920 	ssid_el_p[1] = priv->SSID_size;
2921 	memcpy(ssid_el_p + 2, priv->SSID, priv->SSID_size);
2922 	ssid_el_p[2 + priv->SSID_size] = WLAN_EID_SUPP_RATES;
2923 	ssid_el_p[3 + priv->SSID_size] = 4; /* len of supported rates */
2924 	memcpy(ssid_el_p + 4 + priv->SSID_size, atmel_basic_rates, 4);
2925 
2926 	atmel_transmit_management_frame(priv, &header, (void *)&body, bodysize);
2927 }
2928 
is_frame_from_current_bss(struct atmel_private * priv,struct ieee80211_hdr * header)2929 static int is_frame_from_current_bss(struct atmel_private *priv,
2930 				     struct ieee80211_hdr *header)
2931 {
2932 	if (le16_to_cpu(header->frame_control) & IEEE80211_FCTL_FROMDS)
2933 		return memcmp(header->addr3, priv->CurrentBSSID, 6) == 0;
2934 	else
2935 		return memcmp(header->addr2, priv->CurrentBSSID, 6) == 0;
2936 }
2937 
retrieve_bss(struct atmel_private * priv)2938 static int retrieve_bss(struct atmel_private *priv)
2939 {
2940 	int i;
2941 	int max_rssi = -128;
2942 	int max_index = -1;
2943 
2944 	if (priv->BSS_list_entries == 0)
2945 		return -1;
2946 
2947 	if (priv->connect_to_any_BSS) {
2948 		/* Select a BSS with the max-RSSI but of the same type and of
2949 		   the same WEP mode and that it is not marked as 'bad' (i.e.
2950 		   we had previously failed to connect to this BSS with the
2951 		   settings that we currently use) */
2952 		priv->current_BSS = 0;
2953 		for (i = 0; i < priv->BSS_list_entries; i++) {
2954 			if (priv->operating_mode == priv->BSSinfo[i].BSStype &&
2955 			    ((!priv->wep_is_on && !priv->BSSinfo[i].UsingWEP) ||
2956 			     (priv->wep_is_on && priv->BSSinfo[i].UsingWEP)) &&
2957 			    !(priv->BSSinfo[i].channel & 0x80)) {
2958 				max_rssi = priv->BSSinfo[i].RSSI;
2959 				priv->current_BSS = max_index = i;
2960 			}
2961 		}
2962 		return max_index;
2963 	}
2964 
2965 	for (i = 0; i < priv->BSS_list_entries; i++) {
2966 		if (priv->SSID_size == priv->BSSinfo[i].SSIDsize &&
2967 		    memcmp(priv->SSID, priv->BSSinfo[i].SSID, priv->SSID_size) == 0 &&
2968 		    priv->operating_mode == priv->BSSinfo[i].BSStype &&
2969 		    atmel_validate_channel(priv, priv->BSSinfo[i].channel) == 0) {
2970 			if (priv->BSSinfo[i].RSSI >= max_rssi) {
2971 				max_rssi = priv->BSSinfo[i].RSSI;
2972 				max_index = i;
2973 			}
2974 		}
2975 	}
2976 	return max_index;
2977 }
2978 
store_bss_info(struct atmel_private * priv,struct ieee80211_hdr * header,u16 capability,u16 beacon_period,u8 channel,u8 rssi,u8 ssid_len,u8 * ssid,int is_beacon)2979 static void store_bss_info(struct atmel_private *priv,
2980 			   struct ieee80211_hdr *header, u16 capability,
2981 			   u16 beacon_period, u8 channel, u8 rssi, u8 ssid_len,
2982 			   u8 *ssid, int is_beacon)
2983 {
2984 	u8 *bss = capability & WLAN_CAPABILITY_ESS ? header->addr2 : header->addr3;
2985 	int i, index;
2986 
2987 	for (index = -1, i = 0; i < priv->BSS_list_entries; i++)
2988 		if (memcmp(bss, priv->BSSinfo[i].BSSID, ETH_ALEN) == 0)
2989 			index = i;
2990 
2991 	/* If we process a probe and an entry from this BSS exists
2992 	   we will update the BSS entry with the info from this BSS.
2993 	   If we process a beacon we will only update RSSI */
2994 
2995 	if (index == -1) {
2996 		if (priv->BSS_list_entries == MAX_BSS_ENTRIES)
2997 			return;
2998 		index = priv->BSS_list_entries++;
2999 		memcpy(priv->BSSinfo[index].BSSID, bss, ETH_ALEN);
3000 		priv->BSSinfo[index].RSSI = rssi;
3001 	} else {
3002 		if (rssi > priv->BSSinfo[index].RSSI)
3003 			priv->BSSinfo[index].RSSI = rssi;
3004 		if (is_beacon)
3005 			return;
3006 	}
3007 
3008 	priv->BSSinfo[index].channel = channel;
3009 	priv->BSSinfo[index].beacon_period = beacon_period;
3010 	priv->BSSinfo[index].UsingWEP = capability & WLAN_CAPABILITY_PRIVACY;
3011 	memcpy(priv->BSSinfo[index].SSID, ssid, ssid_len);
3012 	priv->BSSinfo[index].SSIDsize = ssid_len;
3013 
3014 	if (capability & WLAN_CAPABILITY_IBSS)
3015 		priv->BSSinfo[index].BSStype = IW_MODE_ADHOC;
3016 	else if (capability & WLAN_CAPABILITY_ESS)
3017 		priv->BSSinfo[index].BSStype = IW_MODE_INFRA;
3018 
3019 	priv->BSSinfo[index].preamble = capability & WLAN_CAPABILITY_SHORT_PREAMBLE ?
3020 		SHORT_PREAMBLE : LONG_PREAMBLE;
3021 }
3022 
authenticate(struct atmel_private * priv,u16 frame_len)3023 static void authenticate(struct atmel_private *priv, u16 frame_len)
3024 {
3025 	struct auth_body *auth = (struct auth_body *)priv->rx_buf;
3026 	u16 status = le16_to_cpu(auth->status);
3027 	u16 trans_seq_no = le16_to_cpu(auth->trans_seq);
3028 	u16 system = le16_to_cpu(auth->alg);
3029 
3030 	if (status == WLAN_STATUS_SUCCESS && !priv->wep_is_on) {
3031 		/* no WEP */
3032 		if (priv->station_was_associated) {
3033 			atmel_enter_state(priv, STATION_STATE_REASSOCIATING);
3034 			send_association_request(priv, 1);
3035 			return;
3036 		} else {
3037 			atmel_enter_state(priv, STATION_STATE_ASSOCIATING);
3038 			send_association_request(priv, 0);
3039 			return;
3040 		}
3041 	}
3042 
3043 	if (status == WLAN_STATUS_SUCCESS && priv->wep_is_on) {
3044 		int should_associate = 0;
3045 		/* WEP */
3046 		if (trans_seq_no != priv->ExpectedAuthentTransactionSeqNum)
3047 			return;
3048 
3049 		if (system == WLAN_AUTH_OPEN) {
3050 			if (trans_seq_no == 0x0002) {
3051 				should_associate = 1;
3052 			}
3053 		} else if (system == WLAN_AUTH_SHARED_KEY) {
3054 			if (trans_seq_no == 0x0002 &&
3055 			    auth->el_id == WLAN_EID_CHALLENGE) {
3056 				send_authentication_request(priv, system, auth->chall_text, auth->chall_text_len);
3057 				return;
3058 			} else if (trans_seq_no == 0x0004) {
3059 				should_associate = 1;
3060 			}
3061 		}
3062 
3063 		if (should_associate) {
3064 			if (priv->station_was_associated) {
3065 				atmel_enter_state(priv, STATION_STATE_REASSOCIATING);
3066 				send_association_request(priv, 1);
3067 				return;
3068 			} else {
3069 				atmel_enter_state(priv, STATION_STATE_ASSOCIATING);
3070 				send_association_request(priv, 0);
3071 				return;
3072 			}
3073 		}
3074 	}
3075 
3076 	if (status == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) {
3077 		/* Flip back and forth between WEP auth modes until the max
3078 		 * authentication tries has been exceeded.
3079 		 */
3080 		if (system == WLAN_AUTH_OPEN) {
3081 			priv->CurrentAuthentTransactionSeqNum = 0x001;
3082 			priv->exclude_unencrypted = 1;
3083 			send_authentication_request(priv, WLAN_AUTH_SHARED_KEY, NULL, 0);
3084 			return;
3085 		} else if (system == WLAN_AUTH_SHARED_KEY
3086 			   && priv->wep_is_on) {
3087 			priv->CurrentAuthentTransactionSeqNum = 0x001;
3088 			priv->exclude_unencrypted = 0;
3089 			send_authentication_request(priv, WLAN_AUTH_OPEN, NULL, 0);
3090 			return;
3091 		} else if (priv->connect_to_any_BSS) {
3092 			int bss_index;
3093 
3094 			priv->BSSinfo[(int)(priv->current_BSS)].channel |= 0x80;
3095 
3096 			if ((bss_index  = retrieve_bss(priv)) != -1) {
3097 				atmel_join_bss(priv, bss_index);
3098 				return;
3099 			}
3100 		}
3101 	}
3102 
3103 	priv->AuthenticationRequestRetryCnt = 0;
3104 	atmel_enter_state(priv,  STATION_STATE_MGMT_ERROR);
3105 	priv->station_is_associated = 0;
3106 }
3107 
associate(struct atmel_private * priv,u16 frame_len,u16 subtype)3108 static void associate(struct atmel_private *priv, u16 frame_len, u16 subtype)
3109 {
3110 	struct ass_resp_format {
3111 		__le16 capability;
3112 		__le16 status;
3113 		__le16 ass_id;
3114 		u8 el_id;
3115 		u8 length;
3116 		u8 rates[4];
3117 	} *ass_resp = (struct ass_resp_format *)priv->rx_buf;
3118 
3119 	u16 status = le16_to_cpu(ass_resp->status);
3120 	u16 ass_id = le16_to_cpu(ass_resp->ass_id);
3121 	u16 rates_len = ass_resp->length > 4 ? 4 : ass_resp->length;
3122 
3123 	union iwreq_data wrqu;
3124 
3125 	if (frame_len < 8 + rates_len)
3126 		return;
3127 
3128 	if (status == WLAN_STATUS_SUCCESS) {
3129 		if (subtype == IEEE80211_STYPE_ASSOC_RESP)
3130 			priv->AssociationRequestRetryCnt = 0;
3131 		else
3132 			priv->ReAssociationRequestRetryCnt = 0;
3133 
3134 		atmel_set_mib16(priv, Mac_Mgmt_Mib_Type,
3135 				MAC_MGMT_MIB_STATION_ID_POS, ass_id & 0x3fff);
3136 		atmel_set_mib(priv, Phy_Mib_Type,
3137 			      PHY_MIB_RATE_SET_POS, ass_resp->rates, rates_len);
3138 		if (priv->power_mode == 0) {
3139 			priv->listen_interval = 1;
3140 			atmel_set_mib8(priv, Mac_Mgmt_Mib_Type,
3141 				       MAC_MGMT_MIB_PS_MODE_POS, ACTIVE_MODE);
3142 			atmel_set_mib16(priv, Mac_Mgmt_Mib_Type,
3143 					MAC_MGMT_MIB_LISTEN_INTERVAL_POS, 1);
3144 		} else {
3145 			priv->listen_interval = 2;
3146 			atmel_set_mib8(priv, Mac_Mgmt_Mib_Type,
3147 				       MAC_MGMT_MIB_PS_MODE_POS,  PS_MODE);
3148 			atmel_set_mib16(priv, Mac_Mgmt_Mib_Type,
3149 					MAC_MGMT_MIB_LISTEN_INTERVAL_POS, 2);
3150 		}
3151 
3152 		priv->station_is_associated = 1;
3153 		priv->station_was_associated = 1;
3154 		atmel_enter_state(priv, STATION_STATE_READY);
3155 
3156 		/* Send association event to userspace */
3157 		wrqu.data.length = 0;
3158 		wrqu.data.flags = 0;
3159 		memcpy(wrqu.ap_addr.sa_data, priv->CurrentBSSID, ETH_ALEN);
3160 		wrqu.ap_addr.sa_family = ARPHRD_ETHER;
3161 		wireless_send_event(priv->dev, SIOCGIWAP, &wrqu, NULL);
3162 
3163 		return;
3164 	}
3165 
3166 	if (subtype == IEEE80211_STYPE_ASSOC_RESP &&
3167 	    status != WLAN_STATUS_ASSOC_DENIED_RATES &&
3168 	    status != WLAN_STATUS_CAPS_UNSUPPORTED &&
3169 	    priv->AssociationRequestRetryCnt < MAX_ASSOCIATION_RETRIES) {
3170 		mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
3171 		priv->AssociationRequestRetryCnt++;
3172 		send_association_request(priv, 0);
3173 		return;
3174 	}
3175 
3176 	if (subtype == IEEE80211_STYPE_REASSOC_RESP &&
3177 	    status != WLAN_STATUS_ASSOC_DENIED_RATES &&
3178 	    status != WLAN_STATUS_CAPS_UNSUPPORTED &&
3179 	    priv->ReAssociationRequestRetryCnt < MAX_ASSOCIATION_RETRIES) {
3180 		mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
3181 		priv->ReAssociationRequestRetryCnt++;
3182 		send_association_request(priv, 1);
3183 		return;
3184 	}
3185 
3186 	atmel_enter_state(priv,  STATION_STATE_MGMT_ERROR);
3187 	priv->station_is_associated = 0;
3188 
3189 	if (priv->connect_to_any_BSS) {
3190 		int bss_index;
3191 		priv->BSSinfo[(int)(priv->current_BSS)].channel |= 0x80;
3192 
3193 		if ((bss_index = retrieve_bss(priv)) != -1)
3194 			atmel_join_bss(priv, bss_index);
3195 	}
3196 }
3197 
atmel_join_bss(struct atmel_private * priv,int bss_index)3198 static void atmel_join_bss(struct atmel_private *priv, int bss_index)
3199 {
3200 	struct bss_info *bss =  &priv->BSSinfo[bss_index];
3201 
3202 	memcpy(priv->CurrentBSSID, bss->BSSID, ETH_ALEN);
3203 	memcpy(priv->SSID, bss->SSID, priv->SSID_size = bss->SSIDsize);
3204 
3205 	/* The WPA stuff cares about the current AP address */
3206 	if (priv->use_wpa)
3207 		build_wpa_mib(priv);
3208 
3209 	/* When switching to AdHoc turn OFF Power Save if needed */
3210 
3211 	if (bss->BSStype == IW_MODE_ADHOC &&
3212 	    priv->operating_mode != IW_MODE_ADHOC &&
3213 	    priv->power_mode) {
3214 		priv->power_mode = 0;
3215 		priv->listen_interval = 1;
3216 		atmel_set_mib8(priv, Mac_Mgmt_Mib_Type,
3217 			       MAC_MGMT_MIB_PS_MODE_POS,  ACTIVE_MODE);
3218 		atmel_set_mib16(priv, Mac_Mgmt_Mib_Type,
3219 				MAC_MGMT_MIB_LISTEN_INTERVAL_POS, 1);
3220 	}
3221 
3222 	priv->operating_mode = bss->BSStype;
3223 	priv->channel = bss->channel & 0x7f;
3224 	priv->beacon_period = bss->beacon_period;
3225 
3226 	if (priv->preamble != bss->preamble) {
3227 		priv->preamble = bss->preamble;
3228 		atmel_set_mib8(priv, Local_Mib_Type,
3229 			       LOCAL_MIB_PREAMBLE_TYPE, bss->preamble);
3230 	}
3231 
3232 	if (!priv->wep_is_on && bss->UsingWEP) {
3233 		atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
3234 		priv->station_is_associated = 0;
3235 		return;
3236 	}
3237 
3238 	if (priv->wep_is_on && !bss->UsingWEP) {
3239 		atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
3240 		priv->station_is_associated = 0;
3241 		return;
3242 	}
3243 
3244 	atmel_enter_state(priv, STATION_STATE_JOINNING);
3245 
3246 	if (priv->operating_mode == IW_MODE_INFRA)
3247 		join(priv, BSS_TYPE_INFRASTRUCTURE);
3248 	else
3249 		join(priv, BSS_TYPE_AD_HOC);
3250 }
3251 
restart_search(struct atmel_private * priv)3252 static void restart_search(struct atmel_private *priv)
3253 {
3254 	int bss_index;
3255 
3256 	if (!priv->connect_to_any_BSS) {
3257 		atmel_scan(priv, 1);
3258 	} else {
3259 		priv->BSSinfo[(int)(priv->current_BSS)].channel |= 0x80;
3260 
3261 		if ((bss_index = retrieve_bss(priv)) != -1)
3262 			atmel_join_bss(priv, bss_index);
3263 		else
3264 			atmel_scan(priv, 0);
3265 	}
3266 }
3267 
smooth_rssi(struct atmel_private * priv,u8 rssi)3268 static void smooth_rssi(struct atmel_private *priv, u8 rssi)
3269 {
3270 	u8 old = priv->wstats.qual.level;
3271 	u8 max_rssi = 42; /* 502-rmfd-revd max by experiment, default for now */
3272 
3273 	switch (priv->firmware_type) {
3274 	case ATMEL_FW_TYPE_502E:
3275 		max_rssi = 63; /* 502-rmfd-reve max by experiment */
3276 		break;
3277 	default:
3278 		break;
3279 	}
3280 
3281 	rssi = rssi * 100 / max_rssi;
3282 	if ((rssi + old) % 2)
3283 		priv->wstats.qual.level = (rssi + old) / 2 + 1;
3284 	else
3285 		priv->wstats.qual.level = (rssi + old) / 2;
3286 	priv->wstats.qual.updated |= IW_QUAL_LEVEL_UPDATED;
3287 	priv->wstats.qual.updated &= ~IW_QUAL_LEVEL_INVALID;
3288 }
3289 
atmel_smooth_qual(struct atmel_private * priv)3290 static void atmel_smooth_qual(struct atmel_private *priv)
3291 {
3292 	unsigned long time_diff = (jiffies - priv->last_qual) / HZ;
3293 	while (time_diff--) {
3294 		priv->last_qual += HZ;
3295 		priv->wstats.qual.qual = priv->wstats.qual.qual / 2;
3296 		priv->wstats.qual.qual +=
3297 			priv->beacons_this_sec * priv->beacon_period * (priv->wstats.qual.level + 100) / 4000;
3298 		priv->beacons_this_sec = 0;
3299 	}
3300 	priv->wstats.qual.updated |= IW_QUAL_QUAL_UPDATED;
3301 	priv->wstats.qual.updated &= ~IW_QUAL_QUAL_INVALID;
3302 }
3303 
3304 /* deals with incoming management frames. */
atmel_management_frame(struct atmel_private * priv,struct ieee80211_hdr * header,u16 frame_len,u8 rssi)3305 static void atmel_management_frame(struct atmel_private *priv,
3306 				   struct ieee80211_hdr *header,
3307 				   u16 frame_len, u8 rssi)
3308 {
3309 	u16 subtype;
3310 
3311 	subtype = le16_to_cpu(header->frame_control) & IEEE80211_FCTL_STYPE;
3312 	switch (subtype) {
3313 	case IEEE80211_STYPE_BEACON:
3314 	case IEEE80211_STYPE_PROBE_RESP:
3315 
3316 		/* beacon frame has multiple variable-length fields -
3317 		   never let an engineer loose with a data structure design. */
3318 		{
3319 			struct beacon_format {
3320 				__le64 timestamp;
3321 				__le16 interval;
3322 				__le16 capability;
3323 				u8 ssid_el_id;
3324 				u8 ssid_length;
3325 				/* ssid here */
3326 				u8 rates_el_id;
3327 				u8 rates_length;
3328 				/* rates here */
3329 				u8 ds_el_id;
3330 				u8 ds_length;
3331 				/* ds here */
3332 			} *beacon = (struct beacon_format *)priv->rx_buf;
3333 
3334 			u8 channel, rates_length, ssid_length;
3335 			u64 timestamp = le64_to_cpu(beacon->timestamp);
3336 			u16 beacon_interval = le16_to_cpu(beacon->interval);
3337 			u16 capability = le16_to_cpu(beacon->capability);
3338 			u8 *beaconp = priv->rx_buf;
3339 			ssid_length = beacon->ssid_length;
3340 			/* this blows chunks. */
3341 			if (frame_len < 14 || frame_len < ssid_length + 15)
3342 				return;
3343 			rates_length = beaconp[beacon->ssid_length + 15];
3344 			if (frame_len < ssid_length + rates_length + 18)
3345 				return;
3346 			if (ssid_length >  MAX_SSID_LENGTH)
3347 				return;
3348 			channel = beaconp[ssid_length + rates_length + 18];
3349 
3350 			if (priv->station_state == STATION_STATE_READY) {
3351 				smooth_rssi(priv, rssi);
3352 				if (is_frame_from_current_bss(priv, header)) {
3353 					priv->beacons_this_sec++;
3354 					atmel_smooth_qual(priv);
3355 					if (priv->last_beacon_timestamp) {
3356 						/* Note truncate this to 32 bits - kernel can't divide a long long */
3357 						u32 beacon_delay = timestamp - priv->last_beacon_timestamp;
3358 						int beacons = beacon_delay / (beacon_interval * 1000);
3359 						if (beacons > 1)
3360 							priv->wstats.miss.beacon += beacons - 1;
3361 					}
3362 					priv->last_beacon_timestamp = timestamp;
3363 					handle_beacon_probe(priv, capability, channel);
3364 				}
3365 			}
3366 
3367 			if (priv->station_state == STATION_STATE_SCANNING)
3368 				store_bss_info(priv, header, capability,
3369 					       beacon_interval, channel, rssi,
3370 					       ssid_length,
3371 					       &beacon->rates_el_id,
3372 					       subtype == IEEE80211_STYPE_BEACON);
3373 		}
3374 		break;
3375 
3376 	case IEEE80211_STYPE_AUTH:
3377 
3378 		if (priv->station_state == STATION_STATE_AUTHENTICATING)
3379 			authenticate(priv, frame_len);
3380 
3381 		break;
3382 
3383 	case IEEE80211_STYPE_ASSOC_RESP:
3384 	case IEEE80211_STYPE_REASSOC_RESP:
3385 
3386 		if (priv->station_state == STATION_STATE_ASSOCIATING ||
3387 		    priv->station_state == STATION_STATE_REASSOCIATING)
3388 			associate(priv, frame_len, subtype);
3389 
3390 		break;
3391 
3392 	case IEEE80211_STYPE_DISASSOC:
3393 		if (priv->station_is_associated &&
3394 		    priv->operating_mode == IW_MODE_INFRA &&
3395 		    is_frame_from_current_bss(priv, header)) {
3396 			priv->station_was_associated = 0;
3397 			priv->station_is_associated = 0;
3398 
3399 			atmel_enter_state(priv, STATION_STATE_JOINNING);
3400 			join(priv, BSS_TYPE_INFRASTRUCTURE);
3401 		}
3402 
3403 		break;
3404 
3405 	case IEEE80211_STYPE_DEAUTH:
3406 		if (priv->operating_mode == IW_MODE_INFRA &&
3407 		    is_frame_from_current_bss(priv, header)) {
3408 			priv->station_was_associated = 0;
3409 
3410 			atmel_enter_state(priv, STATION_STATE_JOINNING);
3411 			join(priv, BSS_TYPE_INFRASTRUCTURE);
3412 		}
3413 
3414 		break;
3415 	}
3416 }
3417 
3418 /* run when timer expires */
atmel_management_timer(struct timer_list * t)3419 static void atmel_management_timer(struct timer_list *t)
3420 {
3421 	struct atmel_private *priv = from_timer(priv, t, management_timer);
3422 	unsigned long flags;
3423 
3424 	/* Check if the card has been yanked. */
3425 	if (priv->card && priv->present_callback &&
3426 		!(*priv->present_callback)(priv->card))
3427 		return;
3428 
3429 	spin_lock_irqsave(&priv->irqlock, flags);
3430 
3431 	switch (priv->station_state) {
3432 
3433 	case STATION_STATE_AUTHENTICATING:
3434 		if (priv->AuthenticationRequestRetryCnt >= MAX_AUTHENTICATION_RETRIES) {
3435 			atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
3436 			priv->station_is_associated = 0;
3437 			priv->AuthenticationRequestRetryCnt = 0;
3438 			restart_search(priv);
3439 		} else {
3440 			int auth = WLAN_AUTH_OPEN;
3441 			priv->AuthenticationRequestRetryCnt++;
3442 			priv->CurrentAuthentTransactionSeqNum = 0x0001;
3443 			mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
3444 			if (priv->wep_is_on && priv->exclude_unencrypted)
3445 				auth = WLAN_AUTH_SHARED_KEY;
3446 			send_authentication_request(priv, auth, NULL, 0);
3447 	  }
3448 	  break;
3449 
3450 	case STATION_STATE_ASSOCIATING:
3451 		if (priv->AssociationRequestRetryCnt == MAX_ASSOCIATION_RETRIES) {
3452 			atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
3453 			priv->station_is_associated = 0;
3454 			priv->AssociationRequestRetryCnt = 0;
3455 			restart_search(priv);
3456 		} else {
3457 			priv->AssociationRequestRetryCnt++;
3458 			mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
3459 			send_association_request(priv, 0);
3460 		}
3461 	  break;
3462 
3463 	case STATION_STATE_REASSOCIATING:
3464 		if (priv->ReAssociationRequestRetryCnt == MAX_ASSOCIATION_RETRIES) {
3465 			atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
3466 			priv->station_is_associated = 0;
3467 			priv->ReAssociationRequestRetryCnt = 0;
3468 			restart_search(priv);
3469 		} else {
3470 			priv->ReAssociationRequestRetryCnt++;
3471 			mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
3472 			send_association_request(priv, 1);
3473 		}
3474 		break;
3475 
3476 	default:
3477 		break;
3478 	}
3479 
3480 	spin_unlock_irqrestore(&priv->irqlock, flags);
3481 }
3482 
atmel_command_irq(struct atmel_private * priv)3483 static void atmel_command_irq(struct atmel_private *priv)
3484 {
3485 	u8 status = atmel_rmem8(priv, atmel_co(priv, CMD_BLOCK_STATUS_OFFSET));
3486 	u8 command = atmel_rmem8(priv, atmel_co(priv, CMD_BLOCK_COMMAND_OFFSET));
3487 	int fast_scan;
3488 	union iwreq_data wrqu;
3489 
3490 	if (status == CMD_STATUS_IDLE ||
3491 	    status == CMD_STATUS_IN_PROGRESS)
3492 		return;
3493 
3494 	switch (command) {
3495 	case CMD_Start:
3496 		if (status == CMD_STATUS_COMPLETE) {
3497 			priv->station_was_associated = priv->station_is_associated;
3498 			atmel_get_mib(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_CUR_BSSID_POS,
3499 				      (u8 *)priv->CurrentBSSID, 6);
3500 			atmel_enter_state(priv, STATION_STATE_READY);
3501 		}
3502 		break;
3503 
3504 	case CMD_Scan:
3505 		fast_scan = priv->fast_scan;
3506 		priv->fast_scan = 0;
3507 
3508 		if (status != CMD_STATUS_COMPLETE) {
3509 			atmel_scan(priv, 1);
3510 		} else {
3511 			int bss_index = retrieve_bss(priv);
3512 			int notify_scan_complete = 1;
3513 			if (bss_index != -1) {
3514 				atmel_join_bss(priv, bss_index);
3515 			} else if (priv->operating_mode == IW_MODE_ADHOC &&
3516 				   priv->SSID_size != 0) {
3517 				start(priv, BSS_TYPE_AD_HOC);
3518 			} else {
3519 				priv->fast_scan = !fast_scan;
3520 				atmel_scan(priv, 1);
3521 				notify_scan_complete = 0;
3522 			}
3523 			priv->site_survey_state = SITE_SURVEY_COMPLETED;
3524 			if (notify_scan_complete) {
3525 				wrqu.data.length = 0;
3526 				wrqu.data.flags = 0;
3527 				wireless_send_event(priv->dev, SIOCGIWSCAN, &wrqu, NULL);
3528 			}
3529 		}
3530 		break;
3531 
3532 	case CMD_SiteSurvey:
3533 		priv->fast_scan = 0;
3534 
3535 		if (status != CMD_STATUS_COMPLETE)
3536 			return;
3537 
3538 		priv->site_survey_state = SITE_SURVEY_COMPLETED;
3539 		if (priv->station_is_associated) {
3540 			atmel_enter_state(priv, STATION_STATE_READY);
3541 			wrqu.data.length = 0;
3542 			wrqu.data.flags = 0;
3543 			wireless_send_event(priv->dev, SIOCGIWSCAN, &wrqu, NULL);
3544 		} else {
3545 			atmel_scan(priv, 1);
3546 		}
3547 		break;
3548 
3549 	case CMD_Join:
3550 		if (status == CMD_STATUS_COMPLETE) {
3551 			if (priv->operating_mode == IW_MODE_ADHOC) {
3552 				priv->station_was_associated = priv->station_is_associated;
3553 				atmel_enter_state(priv, STATION_STATE_READY);
3554 			} else {
3555 				int auth = WLAN_AUTH_OPEN;
3556 				priv->AuthenticationRequestRetryCnt = 0;
3557 				atmel_enter_state(priv, STATION_STATE_AUTHENTICATING);
3558 
3559 				mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
3560 				priv->CurrentAuthentTransactionSeqNum = 0x0001;
3561 				if (priv->wep_is_on && priv->exclude_unencrypted)
3562 					auth = WLAN_AUTH_SHARED_KEY;
3563 				send_authentication_request(priv, auth, NULL, 0);
3564 			}
3565 			return;
3566 		}
3567 
3568 		atmel_scan(priv, 1);
3569 	}
3570 }
3571 
atmel_wakeup_firmware(struct atmel_private * priv)3572 static int atmel_wakeup_firmware(struct atmel_private *priv)
3573 {
3574 	struct host_info_struct *iface = &priv->host_info;
3575 	u16 mr1, mr3;
3576 	int i;
3577 
3578 	if (priv->card_type == CARD_TYPE_SPI_FLASH)
3579 		atmel_set_gcr(priv->dev, GCR_REMAP);
3580 
3581 	/* wake up on-board processor */
3582 	atmel_clear_gcr(priv->dev, 0x0040);
3583 	atmel_write16(priv->dev, BSR, BSS_SRAM);
3584 
3585 	if (priv->card_type == CARD_TYPE_SPI_FLASH)
3586 		mdelay(100);
3587 
3588 	/* and wait for it */
3589 	for (i = LOOP_RETRY_LIMIT; i; i--) {
3590 		mr1 = atmel_read16(priv->dev, MR1);
3591 		mr3 = atmel_read16(priv->dev, MR3);
3592 
3593 		if (mr3 & MAC_BOOT_COMPLETE)
3594 			break;
3595 		if (mr1 & MAC_BOOT_COMPLETE &&
3596 		    priv->bus_type == BUS_TYPE_PCCARD)
3597 			break;
3598 	}
3599 
3600 	if (i == 0) {
3601 		printk(KERN_ALERT "%s: MAC failed to boot.\n", priv->dev->name);
3602 		return -EIO;
3603 	}
3604 
3605 	if ((priv->host_info_base = atmel_read16(priv->dev, MR2)) == 0xffff) {
3606 		printk(KERN_ALERT "%s: card missing.\n", priv->dev->name);
3607 		return -ENODEV;
3608 	}
3609 
3610 	/* now check for completion of MAC initialization through
3611 	   the FunCtrl field of the IFACE, poll MR1 to detect completion of
3612 	   MAC initialization, check completion status, set interrupt mask,
3613 	   enables interrupts and calls Tx and Rx initialization functions */
3614 
3615 	atmel_wmem8(priv, atmel_hi(priv, IFACE_FUNC_CTRL_OFFSET), FUNC_CTRL_INIT_COMPLETE);
3616 
3617 	for (i = LOOP_RETRY_LIMIT; i; i--) {
3618 		mr1 = atmel_read16(priv->dev, MR1);
3619 		mr3 = atmel_read16(priv->dev, MR3);
3620 
3621 		if (mr3 & MAC_INIT_COMPLETE)
3622 			break;
3623 		if (mr1 & MAC_INIT_COMPLETE &&
3624 		    priv->bus_type == BUS_TYPE_PCCARD)
3625 			break;
3626 	}
3627 
3628 	if (i == 0) {
3629 		printk(KERN_ALERT "%s: MAC failed to initialise.\n",
3630 				priv->dev->name);
3631 		return -EIO;
3632 	}
3633 
3634 	/* Check for MAC_INIT_OK only on the register that the MAC_INIT_OK was set */
3635 	if ((mr3 & MAC_INIT_COMPLETE) &&
3636 	    !(atmel_read16(priv->dev, MR3) & MAC_INIT_OK)) {
3637 		printk(KERN_ALERT "%s: MAC failed MR3 self-test.\n", priv->dev->name);
3638 		return -EIO;
3639 	}
3640 	if ((mr1 & MAC_INIT_COMPLETE) &&
3641 	    !(atmel_read16(priv->dev, MR1) & MAC_INIT_OK)) {
3642 		printk(KERN_ALERT "%s: MAC failed MR1 self-test.\n", priv->dev->name);
3643 		return -EIO;
3644 	}
3645 
3646 	atmel_copy_to_host(priv->dev, (unsigned char *)iface,
3647 			   priv->host_info_base, sizeof(*iface));
3648 
3649 	iface->tx_buff_pos = le16_to_cpu(iface->tx_buff_pos);
3650 	iface->tx_buff_size = le16_to_cpu(iface->tx_buff_size);
3651 	iface->tx_desc_pos = le16_to_cpu(iface->tx_desc_pos);
3652 	iface->tx_desc_count = le16_to_cpu(iface->tx_desc_count);
3653 	iface->rx_buff_pos = le16_to_cpu(iface->rx_buff_pos);
3654 	iface->rx_buff_size = le16_to_cpu(iface->rx_buff_size);
3655 	iface->rx_desc_pos = le16_to_cpu(iface->rx_desc_pos);
3656 	iface->rx_desc_count = le16_to_cpu(iface->rx_desc_count);
3657 	iface->build_version = le16_to_cpu(iface->build_version);
3658 	iface->command_pos = le16_to_cpu(iface->command_pos);
3659 	iface->major_version = le16_to_cpu(iface->major_version);
3660 	iface->minor_version = le16_to_cpu(iface->minor_version);
3661 	iface->func_ctrl = le16_to_cpu(iface->func_ctrl);
3662 	iface->mac_status = le16_to_cpu(iface->mac_status);
3663 
3664 	return 0;
3665 }
3666 
3667 /* determine type of memory and MAC address */
probe_atmel_card(struct net_device * dev)3668 static int probe_atmel_card(struct net_device *dev)
3669 {
3670 	int rc = 0;
3671 	struct atmel_private *priv = netdev_priv(dev);
3672 	u8 addr[ETH_ALEN] = {};
3673 
3674 	/* reset pccard */
3675 	if (priv->bus_type == BUS_TYPE_PCCARD)
3676 		atmel_write16(dev, GCR, 0x0060);
3677 
3678 	atmel_write16(dev, GCR, 0x0040);
3679 	msleep(500);
3680 
3681 	if (atmel_read16(dev, MR2) == 0) {
3682 		/* No stored firmware so load a small stub which just
3683 		   tells us the MAC address */
3684 		int i;
3685 		priv->card_type = CARD_TYPE_EEPROM;
3686 		atmel_write16(dev, BSR, BSS_IRAM);
3687 		atmel_copy_to_card(dev, 0, mac_reader, sizeof(mac_reader));
3688 		atmel_set_gcr(dev, GCR_REMAP);
3689 		atmel_clear_gcr(priv->dev, 0x0040);
3690 		atmel_write16(dev, BSR, BSS_SRAM);
3691 		for (i = LOOP_RETRY_LIMIT; i; i--)
3692 			if (atmel_read16(dev, MR3) & MAC_BOOT_COMPLETE)
3693 				break;
3694 		if (i == 0) {
3695 			printk(KERN_ALERT "%s: MAC failed to boot MAC address reader.\n", dev->name);
3696 		} else {
3697 
3698 			atmel_copy_to_host(dev, addr, atmel_read16(dev, MR2), 6);
3699 			eth_hw_addr_set(dev, addr);
3700 			/* got address, now squash it again until the network
3701 			   interface is opened */
3702 			if (priv->bus_type == BUS_TYPE_PCCARD)
3703 				atmel_write16(dev, GCR, 0x0060);
3704 			atmel_write16(dev, GCR, 0x0040);
3705 			rc = 1;
3706 		}
3707 	} else if (atmel_read16(dev, MR4) == 0) {
3708 		/* Mac address easy in this case. */
3709 		priv->card_type = CARD_TYPE_PARALLEL_FLASH;
3710 		atmel_write16(dev,  BSR, 1);
3711 		atmel_copy_to_host(dev, addr, 0xc000, 6);
3712 		eth_hw_addr_set(dev, addr);
3713 		atmel_write16(dev,  BSR, 0x200);
3714 		rc = 1;
3715 	} else {
3716 		/* Standard firmware in flash, boot it up and ask
3717 		   for the Mac Address */
3718 		priv->card_type = CARD_TYPE_SPI_FLASH;
3719 		if (atmel_wakeup_firmware(priv) == 0) {
3720 			atmel_get_mib(priv, Mac_Address_Mib_Type, 0, addr, 6);
3721 			eth_hw_addr_set(dev, addr);
3722 
3723 			/* got address, now squash it again until the network
3724 			   interface is opened */
3725 			if (priv->bus_type == BUS_TYPE_PCCARD)
3726 				atmel_write16(dev, GCR, 0x0060);
3727 			atmel_write16(dev, GCR, 0x0040);
3728 			rc = 1;
3729 		}
3730 	}
3731 
3732 	if (rc) {
3733 		if (dev->dev_addr[0] == 0xFF) {
3734 			static const u8 default_mac[] = {
3735 				0x00, 0x04, 0x25, 0x00, 0x00, 0x00
3736 			};
3737 			printk(KERN_ALERT "%s: *** Invalid MAC address. UPGRADE Firmware ****\n", dev->name);
3738 			eth_hw_addr_set(dev, default_mac);
3739 		}
3740 	}
3741 
3742 	return rc;
3743 }
3744 
3745 /* Move the encyption information on the MIB structure.
3746    This routine is for the pre-WPA firmware: later firmware has
3747    a different format MIB and a different routine. */
build_wep_mib(struct atmel_private * priv)3748 static void build_wep_mib(struct atmel_private *priv)
3749 {
3750 	struct { /* NB this is matched to the hardware, don't change. */
3751 		u8 wep_is_on;
3752 		u8 default_key; /* 0..3 */
3753 		u8 reserved;
3754 		u8 exclude_unencrypted;
3755 
3756 		u32 WEPICV_error_count;
3757 		u32 WEP_excluded_count;
3758 
3759 		u8 wep_keys[MAX_ENCRYPTION_KEYS][13];
3760 		u8 encryption_level; /* 0, 1, 2 */
3761 		u8 reserved2[3];
3762 	} mib;
3763 	int i;
3764 
3765 	mib.wep_is_on = priv->wep_is_on;
3766 	if (priv->wep_is_on) {
3767 		if (priv->wep_key_len[priv->default_key] > 5)
3768 			mib.encryption_level = 2;
3769 		else
3770 			mib.encryption_level = 1;
3771 	} else {
3772 		mib.encryption_level = 0;
3773 	}
3774 
3775 	mib.default_key = priv->default_key;
3776 	mib.exclude_unencrypted = priv->exclude_unencrypted;
3777 
3778 	for (i = 0; i < MAX_ENCRYPTION_KEYS; i++)
3779 		memcpy(mib.wep_keys[i], priv->wep_keys[i], 13);
3780 
3781 	atmel_set_mib(priv, Mac_Wep_Mib_Type, 0, (u8 *)&mib, sizeof(mib));
3782 }
3783 
build_wpa_mib(struct atmel_private * priv)3784 static void build_wpa_mib(struct atmel_private *priv)
3785 {
3786 	/* This is for the later (WPA enabled) firmware. */
3787 
3788 	struct { /* NB this is matched to the hardware, don't change. */
3789 		u8 cipher_default_key_value[MAX_ENCRYPTION_KEYS][MAX_ENCRYPTION_KEY_SIZE];
3790 		u8 receiver_address[ETH_ALEN];
3791 		u8 wep_is_on;
3792 		u8 default_key; /* 0..3 */
3793 		u8 group_key;
3794 		u8 exclude_unencrypted;
3795 		u8 encryption_type;
3796 		u8 reserved;
3797 
3798 		u32 WEPICV_error_count;
3799 		u32 WEP_excluded_count;
3800 
3801 		u8 key_RSC[4][8];
3802 	} mib;
3803 
3804 	int i;
3805 
3806 	mib.wep_is_on = priv->wep_is_on;
3807 	mib.exclude_unencrypted = priv->exclude_unencrypted;
3808 	memcpy(mib.receiver_address, priv->CurrentBSSID, ETH_ALEN);
3809 
3810 	/* zero all the keys before adding in valid ones. */
3811 	memset(mib.cipher_default_key_value, 0, sizeof(mib.cipher_default_key_value));
3812 
3813 	if (priv->wep_is_on) {
3814 		/* There's a comment in the Atmel code to the effect that this
3815 		   is only valid when still using WEP, it may need to be set to
3816 		   something to use WPA */
3817 		memset(mib.key_RSC, 0, sizeof(mib.key_RSC));
3818 
3819 		mib.default_key = mib.group_key = 255;
3820 		for (i = 0; i < MAX_ENCRYPTION_KEYS; i++) {
3821 			if (priv->wep_key_len[i] > 0) {
3822 				memcpy(mib.cipher_default_key_value[i], priv->wep_keys[i], MAX_ENCRYPTION_KEY_SIZE);
3823 				if (i == priv->default_key) {
3824 					mib.default_key = i;
3825 					mib.cipher_default_key_value[i][MAX_ENCRYPTION_KEY_SIZE-1] = 7;
3826 					mib.cipher_default_key_value[i][MAX_ENCRYPTION_KEY_SIZE-2] = priv->pairwise_cipher_suite;
3827 				} else {
3828 					mib.group_key = i;
3829 					priv->group_cipher_suite = priv->pairwise_cipher_suite;
3830 					mib.cipher_default_key_value[i][MAX_ENCRYPTION_KEY_SIZE-1] = 1;
3831 					mib.cipher_default_key_value[i][MAX_ENCRYPTION_KEY_SIZE-2] = priv->group_cipher_suite;
3832 				}
3833 			}
3834 		}
3835 		if (mib.default_key == 255)
3836 			mib.default_key = mib.group_key != 255 ? mib.group_key : 0;
3837 		if (mib.group_key == 255)
3838 			mib.group_key = mib.default_key;
3839 
3840 	}
3841 
3842 	atmel_set_mib(priv, Mac_Wep_Mib_Type, 0, (u8 *)&mib, sizeof(mib));
3843 }
3844 
reset_atmel_card(struct net_device * dev)3845 static int reset_atmel_card(struct net_device *dev)
3846 {
3847 	/* do everything necessary to wake up the hardware, including
3848 	   waiting for the lightning strike and throwing the knife switch....
3849 
3850 	   set all the Mib values which matter in the card to match
3851 	   their settings in the atmel_private structure. Some of these
3852 	   can be altered on the fly, but many (WEP, infrastructure or ad-hoc)
3853 	   can only be changed by tearing down the world and coming back through
3854 	   here.
3855 
3856 	   This routine is also responsible for initialising some
3857 	   hardware-specific fields in the atmel_private structure,
3858 	   including a copy of the firmware's hostinfo structure
3859 	   which is the route into the rest of the firmware datastructures. */
3860 
3861 	struct atmel_private *priv = netdev_priv(dev);
3862 	u8 configuration;
3863 	int old_state = priv->station_state;
3864 	int err = 0;
3865 
3866 	/* data to add to the firmware names, in priority order
3867 	   this implemenents firmware versioning */
3868 
3869 	static char *firmware_modifier[] = {
3870 		"-wpa",
3871 		"",
3872 		NULL
3873 	};
3874 
3875 	/* reset pccard */
3876 	if (priv->bus_type == BUS_TYPE_PCCARD)
3877 		atmel_write16(priv->dev, GCR, 0x0060);
3878 
3879 	/* stop card , disable interrupts */
3880 	atmel_write16(priv->dev, GCR, 0x0040);
3881 
3882 	if (priv->card_type == CARD_TYPE_EEPROM) {
3883 		/* copy in firmware if needed */
3884 		const struct firmware *fw_entry = NULL;
3885 		const unsigned char *fw;
3886 		int len = priv->firmware_length;
3887 		if (!(fw = priv->firmware)) {
3888 			if (priv->firmware_type == ATMEL_FW_TYPE_NONE) {
3889 				if (strlen(priv->firmware_id) == 0) {
3890 					printk(KERN_INFO
3891 					       "%s: card type is unknown: assuming at76c502 firmware is OK.\n",
3892 					       dev->name);
3893 					printk(KERN_INFO
3894 					       "%s: if not, use the firmware= module parameter.\n",
3895 					       dev->name);
3896 					strcpy(priv->firmware_id, "atmel_at76c502.bin");
3897 				}
3898 				err = request_firmware(&fw_entry, priv->firmware_id, priv->sys_dev);
3899 				if (err != 0) {
3900 					printk(KERN_ALERT
3901 					       "%s: firmware %s is missing, cannot continue.\n",
3902 					       dev->name, priv->firmware_id);
3903 					return err;
3904 				}
3905 			} else {
3906 				int fw_index = 0;
3907 				int success = 0;
3908 
3909 				/* get firmware filename entry based on firmware type ID */
3910 				while (fw_table[fw_index].fw_type != priv->firmware_type
3911 						&& fw_table[fw_index].fw_type != ATMEL_FW_TYPE_NONE)
3912 					fw_index++;
3913 
3914 				/* construct the actual firmware file name */
3915 				if (fw_table[fw_index].fw_type != ATMEL_FW_TYPE_NONE) {
3916 					int i;
3917 					for (i = 0; firmware_modifier[i]; i++) {
3918 						snprintf(priv->firmware_id, 32, "%s%s.%s", fw_table[fw_index].fw_file,
3919 							firmware_modifier[i], fw_table[fw_index].fw_file_ext);
3920 						priv->firmware_id[31] = '\0';
3921 						if (request_firmware(&fw_entry, priv->firmware_id, priv->sys_dev) == 0) {
3922 							success = 1;
3923 							break;
3924 						}
3925 					}
3926 				}
3927 				if (!success) {
3928 					printk(KERN_ALERT
3929 					       "%s: firmware %s is missing, cannot start.\n",
3930 					       dev->name, priv->firmware_id);
3931 					priv->firmware_id[0] = '\0';
3932 					return -ENOENT;
3933 				}
3934 			}
3935 
3936 			fw = fw_entry->data;
3937 			len = fw_entry->size;
3938 		}
3939 
3940 		if (len <= 0x6000) {
3941 			atmel_write16(priv->dev, BSR, BSS_IRAM);
3942 			atmel_copy_to_card(priv->dev, 0, fw, len);
3943 			atmel_set_gcr(priv->dev, GCR_REMAP);
3944 		} else {
3945 			/* Remap */
3946 			atmel_set_gcr(priv->dev, GCR_REMAP);
3947 			atmel_write16(priv->dev, BSR, BSS_IRAM);
3948 			atmel_copy_to_card(priv->dev, 0, fw, 0x6000);
3949 			atmel_write16(priv->dev, BSR, 0x2ff);
3950 			atmel_copy_to_card(priv->dev, 0x8000, &fw[0x6000], len - 0x6000);
3951 		}
3952 
3953 		release_firmware(fw_entry);
3954 	}
3955 
3956 	err = atmel_wakeup_firmware(priv);
3957 	if (err != 0)
3958 		return err;
3959 
3960 	/* Check the version and set the correct flag for wpa stuff,
3961 	   old and new firmware is incompatible.
3962 	   The pre-wpa 3com firmware reports major version 5,
3963 	   the wpa 3com firmware is major version 4 and doesn't need
3964 	   the 3com broken-ness filter. */
3965 	priv->use_wpa = (priv->host_info.major_version == 4);
3966 	priv->radio_on_broken = (priv->host_info.major_version == 5);
3967 
3968 	/* unmask all irq sources */
3969 	atmel_wmem8(priv, atmel_hi(priv, IFACE_INT_MASK_OFFSET), 0xff);
3970 
3971 	/* int Tx system and enable Tx */
3972 	atmel_wmem8(priv, atmel_tx(priv, TX_DESC_FLAGS_OFFSET, 0), 0);
3973 	atmel_wmem32(priv, atmel_tx(priv, TX_DESC_NEXT_OFFSET, 0), 0x80000000L);
3974 	atmel_wmem16(priv, atmel_tx(priv, TX_DESC_POS_OFFSET, 0), 0);
3975 	atmel_wmem16(priv, atmel_tx(priv, TX_DESC_SIZE_OFFSET, 0), 0);
3976 
3977 	priv->tx_desc_free = priv->host_info.tx_desc_count;
3978 	priv->tx_desc_head = 0;
3979 	priv->tx_desc_tail = 0;
3980 	priv->tx_desc_previous = 0;
3981 	priv->tx_free_mem = priv->host_info.tx_buff_size;
3982 	priv->tx_buff_head = 0;
3983 	priv->tx_buff_tail = 0;
3984 
3985 	configuration = atmel_rmem8(priv, atmel_hi(priv, IFACE_FUNC_CTRL_OFFSET));
3986 	atmel_wmem8(priv, atmel_hi(priv, IFACE_FUNC_CTRL_OFFSET),
3987 				   configuration | FUNC_CTRL_TxENABLE);
3988 
3989 	/* init Rx system and enable */
3990 	priv->rx_desc_head = 0;
3991 
3992 	configuration = atmel_rmem8(priv, atmel_hi(priv, IFACE_FUNC_CTRL_OFFSET));
3993 	atmel_wmem8(priv, atmel_hi(priv, IFACE_FUNC_CTRL_OFFSET),
3994 				   configuration | FUNC_CTRL_RxENABLE);
3995 
3996 	if (!priv->radio_on_broken) {
3997 		if (atmel_send_command_wait(priv, CMD_EnableRadio, NULL, 0) ==
3998 		    CMD_STATUS_REJECTED_RADIO_OFF) {
3999 			printk(KERN_INFO "%s: cannot turn the radio on.\n",
4000 			       dev->name);
4001 			return -EIO;
4002 		}
4003 	}
4004 
4005 	/* set up enough MIB values to run. */
4006 	atmel_set_mib8(priv, Local_Mib_Type, LOCAL_MIB_AUTO_TX_RATE_POS, priv->auto_tx_rate);
4007 	atmel_set_mib8(priv, Local_Mib_Type,  LOCAL_MIB_TX_PROMISCUOUS_POS,  PROM_MODE_OFF);
4008 	atmel_set_mib16(priv, Mac_Mib_Type, MAC_MIB_RTS_THRESHOLD_POS, priv->rts_threshold);
4009 	atmel_set_mib16(priv, Mac_Mib_Type, MAC_MIB_FRAG_THRESHOLD_POS, priv->frag_threshold);
4010 	atmel_set_mib8(priv, Mac_Mib_Type, MAC_MIB_SHORT_RETRY_POS, priv->short_retry);
4011 	atmel_set_mib8(priv, Mac_Mib_Type, MAC_MIB_LONG_RETRY_POS, priv->long_retry);
4012 	atmel_set_mib8(priv, Local_Mib_Type, LOCAL_MIB_PREAMBLE_TYPE, priv->preamble);
4013 	atmel_set_mib(priv, Mac_Address_Mib_Type, MAC_ADDR_MIB_MAC_ADDR_POS,
4014 		      priv->dev->dev_addr, 6);
4015 	atmel_set_mib8(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_PS_MODE_POS, ACTIVE_MODE);
4016 	atmel_set_mib16(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_LISTEN_INTERVAL_POS, 1);
4017 	atmel_set_mib16(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_BEACON_PER_POS, priv->default_beacon_period);
4018 	atmel_set_mib(priv, Phy_Mib_Type, PHY_MIB_RATE_SET_POS, atmel_basic_rates, 4);
4019 	atmel_set_mib8(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_CUR_PRIVACY_POS, priv->wep_is_on);
4020 	if (priv->use_wpa)
4021 		build_wpa_mib(priv);
4022 	else
4023 		build_wep_mib(priv);
4024 
4025 	if (old_state == STATION_STATE_READY) {
4026 		union iwreq_data wrqu;
4027 
4028 		wrqu.data.length = 0;
4029 		wrqu.data.flags = 0;
4030 		wrqu.ap_addr.sa_family = ARPHRD_ETHER;
4031 		eth_zero_addr(wrqu.ap_addr.sa_data);
4032 		wireless_send_event(priv->dev, SIOCGIWAP, &wrqu, NULL);
4033 	}
4034 
4035 	return 0;
4036 }
4037 
atmel_send_command(struct atmel_private * priv,int command,void * cmd,int cmd_size)4038 static void atmel_send_command(struct atmel_private *priv, int command,
4039 			       void *cmd, int cmd_size)
4040 {
4041 	if (cmd)
4042 		atmel_copy_to_card(priv->dev, atmel_co(priv, CMD_BLOCK_PARAMETERS_OFFSET),
4043 				   cmd, cmd_size);
4044 
4045 	atmel_wmem8(priv, atmel_co(priv, CMD_BLOCK_COMMAND_OFFSET), command);
4046 	atmel_wmem8(priv, atmel_co(priv, CMD_BLOCK_STATUS_OFFSET), 0);
4047 }
4048 
atmel_send_command_wait(struct atmel_private * priv,int command,void * cmd,int cmd_size)4049 static int atmel_send_command_wait(struct atmel_private *priv, int command,
4050 				   void *cmd, int cmd_size)
4051 {
4052 	int i, status;
4053 
4054 	atmel_send_command(priv, command, cmd, cmd_size);
4055 
4056 	for (i = 5000; i; i--) {
4057 		status = atmel_rmem8(priv, atmel_co(priv, CMD_BLOCK_STATUS_OFFSET));
4058 		if (status != CMD_STATUS_IDLE &&
4059 		    status != CMD_STATUS_IN_PROGRESS)
4060 			break;
4061 		udelay(20);
4062 	}
4063 
4064 	if (i == 0) {
4065 		printk(KERN_ALERT "%s: failed to contact MAC.\n", priv->dev->name);
4066 		status =  CMD_STATUS_HOST_ERROR;
4067 	} else {
4068 		if (command != CMD_EnableRadio)
4069 			status = CMD_STATUS_COMPLETE;
4070 	}
4071 
4072 	return status;
4073 }
4074 
atmel_get_mib8(struct atmel_private * priv,u8 type,u8 index)4075 static u8 atmel_get_mib8(struct atmel_private *priv, u8 type, u8 index)
4076 {
4077 	struct get_set_mib m;
4078 	m.type = type;
4079 	m.size = 1;
4080 	m.index = index;
4081 
4082 	atmel_send_command_wait(priv, CMD_Get_MIB_Vars, &m, MIB_HEADER_SIZE + 1);
4083 	return atmel_rmem8(priv, atmel_co(priv, CMD_BLOCK_PARAMETERS_OFFSET + MIB_HEADER_SIZE));
4084 }
4085 
atmel_set_mib8(struct atmel_private * priv,u8 type,u8 index,u8 data)4086 static void atmel_set_mib8(struct atmel_private *priv, u8 type, u8 index, u8 data)
4087 {
4088 	struct get_set_mib m;
4089 	m.type = type;
4090 	m.size = 1;
4091 	m.index = index;
4092 	m.data[0] = data;
4093 
4094 	atmel_send_command_wait(priv, CMD_Set_MIB_Vars, &m, MIB_HEADER_SIZE + 1);
4095 }
4096 
atmel_set_mib16(struct atmel_private * priv,u8 type,u8 index,u16 data)4097 static void atmel_set_mib16(struct atmel_private *priv, u8 type, u8 index,
4098 			    u16 data)
4099 {
4100 	struct get_set_mib m;
4101 	m.type = type;
4102 	m.size = 2;
4103 	m.index = index;
4104 	m.data[0] = data;
4105 	m.data[1] = data >> 8;
4106 
4107 	atmel_send_command_wait(priv, CMD_Set_MIB_Vars, &m, MIB_HEADER_SIZE + 2);
4108 }
4109 
atmel_set_mib(struct atmel_private * priv,u8 type,u8 index,const u8 * data,int data_len)4110 static void atmel_set_mib(struct atmel_private *priv, u8 type, u8 index,
4111 			  const u8 *data, int data_len)
4112 {
4113 	struct get_set_mib m;
4114 	m.type = type;
4115 	m.size = data_len;
4116 	m.index = index;
4117 
4118 	if (data_len > MIB_MAX_DATA_BYTES)
4119 		printk(KERN_ALERT "%s: MIB buffer too small.\n", priv->dev->name);
4120 
4121 	memcpy(m.data, data, data_len);
4122 	atmel_send_command_wait(priv, CMD_Set_MIB_Vars, &m, MIB_HEADER_SIZE + data_len);
4123 }
4124 
atmel_get_mib(struct atmel_private * priv,u8 type,u8 index,u8 * data,int data_len)4125 static void atmel_get_mib(struct atmel_private *priv, u8 type, u8 index,
4126 			  u8 *data, int data_len)
4127 {
4128 	struct get_set_mib m;
4129 	m.type = type;
4130 	m.size = data_len;
4131 	m.index = index;
4132 
4133 	if (data_len > MIB_MAX_DATA_BYTES)
4134 		printk(KERN_ALERT "%s: MIB buffer too small.\n", priv->dev->name);
4135 
4136 	atmel_send_command_wait(priv, CMD_Get_MIB_Vars, &m, MIB_HEADER_SIZE + data_len);
4137 	atmel_copy_to_host(priv->dev, data,
4138 			   atmel_co(priv, CMD_BLOCK_PARAMETERS_OFFSET + MIB_HEADER_SIZE), data_len);
4139 }
4140 
atmel_writeAR(struct net_device * dev,u16 data)4141 static void atmel_writeAR(struct net_device *dev, u16 data)
4142 {
4143 	int i;
4144 	outw(data, dev->base_addr + AR);
4145 	/* Address register appears to need some convincing..... */
4146 	for (i = 0; data != inw(dev->base_addr + AR) && i < 10; i++)
4147 		outw(data, dev->base_addr + AR);
4148 }
4149 
atmel_copy_to_card(struct net_device * dev,u16 dest,const unsigned char * src,u16 len)4150 static void atmel_copy_to_card(struct net_device *dev, u16 dest,
4151 			       const unsigned char *src, u16 len)
4152 {
4153 	int i;
4154 	atmel_writeAR(dev, dest);
4155 	if (dest % 2) {
4156 		atmel_write8(dev, DR, *src);
4157 		src++; len--;
4158 	}
4159 	for (i = len; i > 1 ; i -= 2) {
4160 		u8 lb = *src++;
4161 		u8 hb = *src++;
4162 		atmel_write16(dev, DR, lb | (hb << 8));
4163 	}
4164 	if (i)
4165 		atmel_write8(dev, DR, *src);
4166 }
4167 
atmel_copy_to_host(struct net_device * dev,unsigned char * dest,u16 src,u16 len)4168 static void atmel_copy_to_host(struct net_device *dev, unsigned char *dest,
4169 			       u16 src, u16 len)
4170 {
4171 	int i;
4172 	atmel_writeAR(dev, src);
4173 	if (src % 2) {
4174 		*dest = atmel_read8(dev, DR);
4175 		dest++; len--;
4176 	}
4177 	for (i = len; i > 1 ; i -= 2) {
4178 		u16 hw = atmel_read16(dev, DR);
4179 		*dest++ = hw;
4180 		*dest++ = hw >> 8;
4181 	}
4182 	if (i)
4183 		*dest = atmel_read8(dev, DR);
4184 }
4185 
atmel_set_gcr(struct net_device * dev,u16 mask)4186 static void atmel_set_gcr(struct net_device *dev, u16 mask)
4187 {
4188 	outw(inw(dev->base_addr + GCR) | mask, dev->base_addr + GCR);
4189 }
4190 
atmel_clear_gcr(struct net_device * dev,u16 mask)4191 static void atmel_clear_gcr(struct net_device *dev, u16 mask)
4192 {
4193 	outw(inw(dev->base_addr + GCR) & ~mask, dev->base_addr + GCR);
4194 }
4195 
atmel_lock_mac(struct atmel_private * priv)4196 static int atmel_lock_mac(struct atmel_private *priv)
4197 {
4198 	int i, j = 20;
4199  retry:
4200 	for (i = 5000; i; i--) {
4201 		if (!atmel_rmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_HOST_OFFSET)))
4202 			break;
4203 		udelay(20);
4204 	}
4205 
4206 	if (!i)
4207 		return 0; /* timed out */
4208 
4209 	atmel_wmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_MAC_OFFSET), 1);
4210 	if (atmel_rmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_HOST_OFFSET))) {
4211 		atmel_wmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_MAC_OFFSET), 0);
4212 		if (!j--)
4213 			return 0; /* timed out */
4214 		goto retry;
4215 	}
4216 
4217 	return 1;
4218 }
4219 
atmel_wmem32(struct atmel_private * priv,u16 pos,u32 data)4220 static void atmel_wmem32(struct atmel_private *priv, u16 pos, u32 data)
4221 {
4222 	atmel_writeAR(priv->dev, pos);
4223 	atmel_write16(priv->dev, DR, data); /* card is little-endian */
4224 	atmel_write16(priv->dev, DR, data >> 16);
4225 }
4226 
4227 /***************************************************************************/
4228 /* There follows the source form of the MAC address reading firmware       */
4229 /***************************************************************************/
4230 #if 0
4231 
4232 /* Copyright 2003 Matthew T. Russotto                                      */
4233 /* But derived from the Atmel 76C502 firmware written by Atmel and         */
4234 /* included in "atmel wireless lan drivers" package                        */
4235 /*
4236     This file is part of net.russotto.AtmelMACFW, hereto referred to
4237     as AtmelMACFW
4238 
4239     AtmelMACFW is free software; you can redistribute it and/or modify
4240     it under the terms of the GNU General Public License version 2
4241     as published by the Free Software Foundation.
4242 
4243     AtmelMACFW is distributed in the hope that it will be useful,
4244     but WITHOUT ANY WARRANTY; without even the implied warranty of
4245     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
4246     GNU General Public License for more details.
4247 
4248     You should have received a copy of the GNU General Public License
4249     along with AtmelMACFW; if not, see <http://www.gnu.org/licenses/>.
4250 
4251 ****************************************************************************/
4252 /* This firmware should work on the 76C502 RFMD, RFMD_D, and RFMD_E        */
4253 /* It will probably work on the 76C504 and 76C502 RFMD_3COM                */
4254 /* It only works on SPI EEPROM versions of the card.                       */
4255 
4256 /* This firmware initializes the SPI controller and clock, reads the MAC   */
4257 /* address from the EEPROM into SRAM, and puts the SRAM offset of the MAC  */
4258 /* address in MR2, and sets MR3 to 0x10 to indicate it is done             */
4259 /* It also puts a complete copy of the EEPROM in SRAM with the offset in   */
4260 /* MR4, for investigational purposes (maybe we can determine chip type     */
4261 /* from that?)                                                             */
4262 
4263 	.org 0
4264     .set MRBASE, 0x8000000
4265 	.set CPSR_INITIAL, 0xD3 /* IRQ/FIQ disabled, ARM mode, Supervisor state */
4266 	.set CPSR_USER, 0xD1 /* IRQ/FIQ disabled, ARM mode, USER state */
4267 	.set SRAM_BASE,  0x02000000
4268 	.set SP_BASE,    0x0F300000
4269 	.set UNK_BASE,   0x0F000000 /* Some internal device, but which one? */
4270 	.set SPI_CGEN_BASE,  0x0E000000 /* Some internal device, but which one? */
4271 	.set UNK3_BASE,  0x02014000 /* Some internal device, but which one? */
4272 	.set STACK_BASE, 0x5600
4273 	.set SP_SR, 0x10
4274 	.set SP_TDRE, 2 /* status register bit -- TDR empty */
4275 	.set SP_RDRF, 1 /* status register bit -- RDR full */
4276 	.set SP_SWRST, 0x80
4277 	.set SP_SPIEN, 0x1
4278 	.set SP_CR, 0   /* control register */
4279 	.set SP_MR, 4   /* mode register */
4280 	.set SP_RDR, 0x08 /* Read Data Register */
4281 	.set SP_TDR, 0x0C /* Transmit Data Register */
4282 	.set SP_CSR0, 0x30 /* chip select registers */
4283 	.set SP_CSR1, 0x34
4284 	.set SP_CSR2, 0x38
4285 	.set SP_CSR3, 0x3C
4286 	.set NVRAM_CMD_RDSR, 5 /* read status register */
4287 	.set NVRAM_CMD_READ, 3 /* read data */
4288 	.set NVRAM_SR_RDY, 1 /* RDY bit.  This bit is inverted */
4289 	.set SPI_8CLOCKS, 0xFF /* Writing this to the TDR doesn't do anything to the
4290 				  serial output, since SO is normally high.  But it
4291 				  does cause 8 clock cycles and thus 8 bits to be
4292 				  clocked in to the chip.  See Atmel's SPI
4293 				  controller (e.g. AT91M55800) timing and 4K
4294 				  SPI EEPROM manuals */
4295 
4296 	.set NVRAM_SCRATCH, 0x02000100  /* arbitrary area for scratchpad memory */
4297 	.set NVRAM_IMAGE, 0x02000200
4298 	.set NVRAM_LENGTH, 0x0200
4299 	.set MAC_ADDRESS_MIB, SRAM_BASE
4300 	.set MAC_ADDRESS_LENGTH, 6
4301 	.set MAC_BOOT_FLAG, 0x10
4302 	.set MR1, 0
4303 	.set MR2, 4
4304 	.set MR3, 8
4305 	.set MR4, 0xC
4306 RESET_VECTOR:
4307 	b RESET_HANDLER
4308 UNDEF_VECTOR:
4309 	b HALT1
4310 SWI_VECTOR:
4311 	b HALT1
4312 IABORT_VECTOR:
4313 	b HALT1
4314 DABORT_VECTOR:
4315 RESERVED_VECTOR:
4316 	b HALT1
4317 IRQ_VECTOR:
4318 	b HALT1
4319 FIQ_VECTOR:
4320 	b HALT1
4321 HALT1:	b HALT1
4322 RESET_HANDLER:
4323 	mov     r0, #CPSR_INITIAL
4324 	msr	CPSR_c, r0	/* This is probably unnecessary */
4325 
4326 /* I'm guessing this is initializing clock generator electronics for SPI */
4327 	ldr	r0, =SPI_CGEN_BASE
4328 	mov	r1, #0
4329 	mov	r1, r1, lsl #3
4330 	orr	r1, r1, #0
4331 	str	r1, [r0]
4332 	ldr	r1, [r0, #28]
4333 	bic	r1, r1, #16
4334 	str	r1, [r0, #28]
4335 	mov	r1, #1
4336 	str	r1, [r0, #8]
4337 
4338 	ldr	r0, =MRBASE
4339 	mov	r1, #0
4340 	strh	r1, [r0, #MR1]
4341 	strh	r1, [r0, #MR2]
4342 	strh	r1, [r0, #MR3]
4343 	strh	r1, [r0, #MR4]
4344 
4345 	mov	sp, #STACK_BASE
4346 	bl	SP_INIT
4347 	mov	r0, #10
4348 	bl	DELAY9
4349 	bl	GET_MAC_ADDR
4350 	bl	GET_WHOLE_NVRAM
4351 	ldr	r0, =MRBASE
4352 	ldr	r1, =MAC_ADDRESS_MIB
4353 	strh	r1, [r0, #MR2]
4354 	ldr	r1, =NVRAM_IMAGE
4355 	strh	r1, [r0, #MR4]
4356 	mov	r1, #MAC_BOOT_FLAG
4357 	strh	r1, [r0, #MR3]
4358 HALT2:	b HALT2
4359 .func Get_Whole_NVRAM, GET_WHOLE_NVRAM
4360 GET_WHOLE_NVRAM:
4361 	stmdb	sp!, {lr}
4362 	mov	r2, #0 /* 0th bytes of NVRAM */
4363 	mov	r3, #NVRAM_LENGTH
4364 	mov	r1, #0		/* not used in routine */
4365 	ldr	r0, =NVRAM_IMAGE
4366 	bl	NVRAM_XFER
4367 	ldmia	sp!, {lr}
4368 	bx	lr
4369 .endfunc
4370 
4371 .func Get_MAC_Addr, GET_MAC_ADDR
4372 GET_MAC_ADDR:
4373 	stmdb	sp!, {lr}
4374 	mov	r2, #0x120	/* address of MAC Address within NVRAM */
4375 	mov	r3, #MAC_ADDRESS_LENGTH
4376 	mov	r1, #0		/* not used in routine */
4377 	ldr	r0, =MAC_ADDRESS_MIB
4378 	bl	NVRAM_XFER
4379 	ldmia	sp!, {lr}
4380 	bx	lr
4381 .endfunc
4382 .ltorg
4383 .func Delay9, DELAY9
4384 DELAY9:
4385 	adds	r0, r0, r0, LSL #3   /* r0 = r0 * 9 */
4386 DELAYLOOP:
4387 	beq	DELAY9_done
4388 	subs	r0, r0, #1
4389 	b	DELAYLOOP
4390 DELAY9_done:
4391 	bx	lr
4392 .endfunc
4393 
4394 .func SP_Init, SP_INIT
4395 SP_INIT:
4396 	mov	r1, #SP_SWRST
4397 	ldr	r0, =SP_BASE
4398 	str	r1, [r0, #SP_CR] /* reset the SPI */
4399 	mov	r1, #0
4400 	str	r1, [r0, #SP_CR] /* release SPI from reset state */
4401 	mov	r1, #SP_SPIEN
4402 	str	r1, [r0, #SP_MR] /* set the SPI to MASTER mode*/
4403 	str	r1, [r0, #SP_CR] /* enable the SPI */
4404 
4405 /*  My guess would be this turns on the SPI clock */
4406 	ldr	r3, =SPI_CGEN_BASE
4407 	ldr	r1, [r3, #28]
4408 	orr	r1, r1, #0x2000
4409 	str	r1, [r3, #28]
4410 
4411 	ldr	r1, =0x2000c01
4412 	str	r1, [r0, #SP_CSR0]
4413 	ldr	r1, =0x2000201
4414 	str	r1, [r0, #SP_CSR1]
4415 	str	r1, [r0, #SP_CSR2]
4416 	str	r1, [r0, #SP_CSR3]
4417 	ldr	r1, [r0, #SP_SR]
4418 	ldr	r0, [r0, #SP_RDR]
4419 	bx	lr
4420 .endfunc
4421 .func NVRAM_Init, NVRAM_INIT
4422 NVRAM_INIT:
4423 	ldr	r1, =SP_BASE
4424 	ldr	r0, [r1, #SP_RDR]
4425 	mov	r0, #NVRAM_CMD_RDSR
4426 	str	r0, [r1, #SP_TDR]
4427 SP_loop1:
4428 	ldr	r0, [r1, #SP_SR]
4429 	tst	r0, #SP_TDRE
4430 	beq	SP_loop1
4431 
4432 	mov	r0, #SPI_8CLOCKS
4433 	str	r0, [r1, #SP_TDR]
4434 SP_loop2:
4435 	ldr	r0, [r1, #SP_SR]
4436 	tst	r0, #SP_TDRE
4437 	beq	SP_loop2
4438 
4439 	ldr	r0, [r1, #SP_RDR]
4440 SP_loop3:
4441 	ldr	r0, [r1, #SP_SR]
4442 	tst	r0, #SP_RDRF
4443 	beq	SP_loop3
4444 
4445 	ldr	r0, [r1, #SP_RDR]
4446 	and	r0, r0, #255
4447 	bx	lr
4448 .endfunc
4449 
4450 .func NVRAM_Xfer, NVRAM_XFER
4451 	/* r0 = dest address */
4452 	/* r1 = not used */
4453 	/* r2 = src address within NVRAM */
4454 	/* r3 = length */
4455 NVRAM_XFER:
4456 	stmdb	sp!, {r4, r5, lr}
4457 	mov	r5, r0		/* save r0 (dest address) */
4458 	mov	r4, r3		/* save r3 (length) */
4459 	mov	r0, r2, LSR #5 /*  SPI memories put A8 in the command field */
4460 	and	r0, r0, #8
4461 	add	r0, r0, #NVRAM_CMD_READ
4462 	ldr	r1, =NVRAM_SCRATCH
4463 	strb	r0, [r1, #0]	/* save command in NVRAM_SCRATCH[0] */
4464 	strb	r2, [r1, #1]    /* save low byte of source address in NVRAM_SCRATCH[1] */
4465 _local1:
4466 	bl	NVRAM_INIT
4467 	tst	r0, #NVRAM_SR_RDY
4468 	bne	_local1
4469 	mov	r0, #20
4470 	bl	DELAY9
4471 	mov	r2, r4		/* length */
4472 	mov	r1, r5		/* dest address */
4473 	mov	r0, #2		/* bytes to transfer in command */
4474 	bl	NVRAM_XFER2
4475 	ldmia	sp!, {r4, r5, lr}
4476 	bx	lr
4477 .endfunc
4478 
4479 .func NVRAM_Xfer2, NVRAM_XFER2
4480 NVRAM_XFER2:
4481 	stmdb	sp!, {r4, r5, r6, lr}
4482 	ldr	r4, =SP_BASE
4483 	mov	r3, #0
4484 	cmp	r0, #0
4485 	bls	_local2
4486 	ldr	r5, =NVRAM_SCRATCH
4487 _local4:
4488 	ldrb	r6, [r5, r3]
4489 	str	r6, [r4, #SP_TDR]
4490 _local3:
4491 	ldr	r6, [r4, #SP_SR]
4492 	tst	r6, #SP_TDRE
4493 	beq	_local3
4494 	add	r3, r3, #1
4495 	cmp	r3, r0 /* r0 is # of bytes to send out (command+addr) */
4496 	blo	_local4
4497 _local2:
4498 	mov	r3, #SPI_8CLOCKS
4499 	str	r3, [r4, #SP_TDR]
4500 	ldr	r0, [r4, #SP_RDR]
4501 _local5:
4502 	ldr	r0, [r4, #SP_SR]
4503 	tst	r0, #SP_RDRF
4504 	beq	_local5
4505 	ldr	r0, [r4, #SP_RDR] /* what's this byte?  It's the byte read while writing the TDR -- nonsense, because the NVRAM doesn't read and write at the same time */
4506 	mov	r0, #0
4507 	cmp	r2, #0  /* r2 is # of bytes to copy in */
4508 	bls	_local6
4509 _local7:
4510 	ldr	r5, [r4, #SP_SR]
4511 	tst	r5, #SP_TDRE
4512 	beq	_local7
4513 	str	r3, [r4, #SP_TDR]  /* r3 has SPI_8CLOCKS */
4514 _local8:
4515 	ldr	r5, [r4, #SP_SR]
4516 	tst	r5, #SP_RDRF
4517 	beq	_local8
4518 	ldr	r5, [r4, #SP_RDR] /* but didn't we read this byte above? */
4519 	strb	r5, [r1], #1 /* postindexed */
4520 	add	r0, r0, #1
4521 	cmp	r0, r2
4522 	blo	_local7 /* since we don't send another address, the NVRAM must be capable of sequential reads */
4523 _local6:
4524 	mov	r0, #200
4525 	bl	DELAY9
4526 	ldmia	sp!, {r4, r5, r6, lr}
4527 	bx	lr
4528 #endif
4529