Linux-2.6.12-rc2

Initial git repository build. I'm not bothering with the full history,
even though we have it. We can create a separate "historical" git
archive of that later if we want to, and in the meantime it's about
3.2GB when imported into git - space that would just make the early
git days unnecessarily complicated, when we don't have a lot of good
infrastructure for it.

Let it rip!
diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
new file mode 100644
index 0000000..0aaa12c
--- /dev/null
+++ b/drivers/net/wireless/Kconfig
@@ -0,0 +1,365 @@
+#
+# Wireless LAN device configuration
+#
+
+menu "Wireless LAN (non-hamradio)"
+	depends on NETDEVICES
+
+config NET_RADIO
+	bool "Wireless LAN drivers (non-hamradio) & Wireless Extensions"
+	---help---
+	  Support for wireless LANs and everything having to do with radio,
+	  but not with amateur radio or FM broadcasting.
+
+	  Saying Y here also enables the Wireless Extensions (creates
+	  /proc/net/wireless and enables iwconfig access). The Wireless
+	  Extension is a generic API allowing a driver to expose to the user
+	  space configuration and statistics specific to common Wireless LANs.
+	  The beauty of it is that a single set of tool can support all the
+	  variations of Wireless LANs, regardless of their type (as long as
+	  the driver supports Wireless Extension). Another advantage is that
+	  these parameters may be changed on the fly without restarting the
+	  driver (or Linux). If you wish to use Wireless Extensions with
+	  wireless PCMCIA (PC-) cards, you need to say Y here; you can fetch
+	  the tools from
+	  <http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/Tools.html>.
+
+	  Some user-level drivers for scarab devices which don't require
+	  special kernel support are available from
+	  <ftp://shadow.cabi.net/pub/Linux/>.
+
+# Note : the cards are obsolete (can't buy them anymore), but the drivers
+# are not, as people are still using them...
+comment "Obsolete Wireless cards support (pre-802.11)"
+	depends on NET_RADIO && (INET || ISA || PCMCIA)
+
+config STRIP
+	tristate "STRIP (Metricom starmode radio IP)"
+	depends on NET_RADIO && INET
+	---help---
+	  Say Y if you have a Metricom radio and intend to use Starmode Radio
+	  IP. STRIP is a radio protocol developed for the MosquitoNet project
+	  (on the WWW at <http://mosquitonet.stanford.edu/>) to send Internet
+	  traffic using Metricom radios.  Metricom radios are small, battery
+	  powered, 100kbit/sec packet radio transceivers, about the size and
+	  weight of a cellular telephone. (You may also have heard them called
+	  "Metricom modems" but we avoid the term "modem" because it misleads
+	  many people into thinking that you can plug a Metricom modem into a
+	  phone line and use it as a modem.)
+
+	  You can use STRIP on any Linux machine with a serial port, although
+	  it is obviously most useful for people with laptop computers. If you
+	  think you might get a Metricom radio in the future, there is no harm
+	  in saying Y to STRIP now, except that it makes the kernel a bit
+	  bigger.
+
+	  To compile this as a module, choose M here: the module will be
+	  called strip.
+
+config ARLAN
+	tristate "Aironet Arlan 655 & IC2200 DS support"
+	depends on NET_RADIO && ISA && !64BIT
+	---help---
+	  Aironet makes Arlan, a class of wireless LAN adapters. These use the
+	  www.Telxon.com chip, which is also used on several similar cards.
+	  This driver is tested on the 655 and IC2200 series cards. Look at
+	  <http://www.ylenurme.ee/~elmer/655/> for the latest information.
+
+	  The driver is built as two modules, arlan and arlan-proc. The latter
+	  is the /proc interface and is not needed most of time.
+
+	  On some computers the card ends up in non-valid state after some
+	  time. Use a ping-reset script to clear it.
+
+config WAVELAN
+	tristate "AT&T/Lucent old WaveLAN & DEC RoamAbout DS ISA support"
+	depends on NET_RADIO && ISA
+	---help---
+	  The Lucent WaveLAN (formerly NCR and AT&T; or DEC RoamAbout DS) is
+	  a Radio LAN (wireless Ethernet-like Local Area Network) using the
+	  radio frequencies 900 MHz and 2.4 GHz.
+
+	  This driver support the ISA version of the WaveLAN card.  A separate
+	  driver for the PCMCIA (PC-card) hardware is available in David
+	  Hinds' pcmcia-cs package (see the file <file:Documentation/Changes>
+	  for location).
+
+	  If you want to use an ISA WaveLAN card under Linux, say Y and read
+	  the Ethernet-HOWTO, available from
+	  <http://www.tldp.org/docs.html#howto>. Some more specific
+	  information is contained in
+	  <file:Documentation/networking/wavelan.txt> and in the source code
+	  <file:drivers/net/wavelan.p.h>.
+
+	  You will also need the wireless tools package available from
+	  <http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/Tools.html>.
+	  Please read the man pages contained therein.
+
+	  To compile this driver as a module, choose M here: the module will be
+	  called wavelan.
+
+config PCMCIA_WAVELAN
+	tristate "AT&T/Lucent old WaveLAN Pcmcia wireless support"
+	depends on NET_RADIO && PCMCIA
+	help
+	  Say Y here if you intend to attach an AT&T/Lucent Wavelan PCMCIA
+	  (PC-card) wireless Ethernet networking card to your computer.  This
+	  driver is for the non-IEEE-802.11 Wavelan cards.
+
+	  To compile this driver as a module, choose M here: the module will be
+	  called wavelan_cs.  If unsure, say N.
+
+config PCMCIA_NETWAVE
+	tristate "Xircom Netwave AirSurfer Pcmcia wireless support"
+	depends on NET_RADIO && PCMCIA
+	help
+	  Say Y here if you intend to attach this type of PCMCIA (PC-card)
+	  wireless Ethernet networking card to your computer.
+
+	  To compile this driver as a module, choose M here: the module will be
+	  called netwave_cs.  If unsure, say N.
+
+comment "Wireless 802.11 Frequency Hopping cards support"
+	depends on NET_RADIO && PCMCIA
+
+config PCMCIA_RAYCS
+	tristate "Aviator/Raytheon 2.4MHz wireless support"
+	depends on NET_RADIO && PCMCIA
+	---help---
+	  Say Y here if you intend to attach an Aviator/Raytheon PCMCIA
+	  (PC-card) wireless Ethernet networking card to your computer.
+	  Please read the file <file:Documentation/networking/ray_cs.txt> for
+	  details.
+
+	  To compile this driver as a module, choose M here: the module will be
+	  called ray_cs.  If unsure, say N.
+
+comment "Wireless 802.11b ISA/PCI cards support"
+	depends on NET_RADIO && (ISA || PCI || PPC_PMAC || PCMCIA)
+
+config AIRO
+	tristate "Cisco/Aironet 34X/35X/4500/4800 ISA and PCI cards"
+	depends on NET_RADIO && ISA && (PCI || BROKEN)
+	---help---
+	  This is the standard Linux driver to support Cisco/Aironet ISA and
+	  PCI 802.11 wireless cards.
+	  It supports the new 802.11b cards from Cisco (Cisco 34X, Cisco 35X
+	  - with or without encryption) as well as card before the Cisco
+	  aquisition (Aironet 4500, Aironet 4800, Aironet 4800B).
+
+	  This driver support both the standard Linux Wireless Extensions
+	  and Cisco proprietary API, so both the Linux Wireless Tools and the
+	  Cisco Linux utilities can be used to configure the card.
+
+	  The driver can be compiled as a module and will be named "airo".
+
+config HERMES
+	tristate "Hermes chipset 802.11b support (Orinoco/Prism2/Symbol)"
+	depends on NET_RADIO && (PPC_PMAC || PCI || PCMCIA)
+	---help---
+	  A driver for 802.11b wireless cards based based on the "Hermes" or
+	  Intersil HFA384x (Prism 2) MAC controller.  This includes the vast
+	  majority of the PCMCIA 802.11b cards (which are nearly all rebadges)
+	  - except for the Cisco/Aironet cards.  Cards supported include the
+	  Apple Airport (not a PCMCIA card), WavelanIEEE/Orinoco,
+	  Cabletron/EnteraSys Roamabout, ELSA AirLancer, MELCO Buffalo, Avaya,
+	  IBM High Rate Wireless, Farralon Syyline, Samsung MagicLAN, Netgear
+	  MA401, LinkSys WPC-11, D-Link DWL-650, 3Com AirConnect, Intel
+	  PRO/Wireless, and Symbol Spectrum24 High Rate amongst others.
+
+	  This option includes the guts of the driver, but in order to
+	  actually use a card you will also need to enable support for PCMCIA
+	  Hermes cards, PLX9052 based PCI adaptors or the Apple Airport below.
+
+	  You will also very likely also need the Wireless Tools in order to
+	  configure your card and that /etc/pcmcia/wireless.opts works :
+	  <http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/Tools.html>
+
+config APPLE_AIRPORT
+	tristate "Apple Airport support (built-in)"
+	depends on PPC_PMAC && HERMES
+	help
+	  Say Y here to support the Airport 802.11b wireless Ethernet hardware
+	  built into the Macintosh iBook and other recent PowerPC-based
+	  Macintosh machines. This is essentially a Lucent Orinoco card with 
+	  a non-standard interface
+
+config PLX_HERMES
+	tristate "Hermes in PLX9052 based PCI adaptor support (Netgear MA301 etc.) (EXPERIMENTAL)"
+	depends on PCI && HERMES && EXPERIMENTAL
+	help
+	  Enable support for PCMCIA cards supported by the "Hermes" (aka
+	  orinoco) driver when used in PLX9052 based PCI adaptors.  These
+	  adaptors are not a full PCMCIA controller but act as a more limited
+	  PCI <-> PCMCIA bridge.  Several vendors sell such adaptors so that
+	  802.11b PCMCIA cards can be used in desktop machines.  The Netgear
+	  MA301 is such an adaptor.
+
+	  Support for these adaptors is so far still incomplete and buggy.
+	  You have been warned.
+
+config TMD_HERMES
+	tristate "Hermes in TMD7160 based PCI adaptor support (EXPERIMENTAL)"
+	depends on PCI && HERMES && EXPERIMENTAL
+	help
+	  Enable support for PCMCIA cards supported by the "Hermes" (aka
+	  orinoco) driver when used in TMD7160 based PCI adaptors.  These
+	  adaptors are not a full PCMCIA controller but act as a more limited
+	  PCI <-> PCMCIA bridge.  Several vendors sell such adaptors so that
+	  802.11b PCMCIA cards can be used in desktop machines.
+
+	  Support for these adaptors is so far still incomplete and buggy.
+	  You have been warned.
+
+config PCI_HERMES
+	tristate "Prism 2.5 PCI 802.11b adaptor support (EXPERIMENTAL)"
+	depends on PCI && HERMES && EXPERIMENTAL
+	help
+	  Enable support for PCI and mini-PCI 802.11b wireless NICs based on
+	  the Prism 2.5 chipset.  These are true PCI cards, not the 802.11b
+	  PCMCIA cards bundled with PCI<->PCMCIA adaptors which are also
+	  common.  Some of the built-in wireless adaptors in laptops are of
+	  this variety.
+
+config ATMEL
+      tristate "Atmel at76c50x chipset  802.11b support"
+      depends on NET_RADIO && EXPERIMENTAL
+      select FW_LOADER
+      select CRC32
+       ---help---
+        A driver 802.11b wireless cards based on the Atmel fast-vnet
+        chips. This driver supports standard Linux wireless extensions. 
+ 
+        Many  cards based on this chipset do not have flash memory
+        and need their firmware loaded at start-up. If yours is 
+        one of these, you will need to provide a firmware image
+        to be loaded into the card by the driver. The Atmel
+        firmware package can be downloaded from
+        <http://www.thekelleys.org.uk/atmel>
+
+config PCI_ATMEL
+      tristate "Atmel at76c506 PCI cards"
+      depends on ATMEL && PCI
+       ---help---
+        Enable support for PCI and mini-PCI cards containing the
+        Atmel at76c506 chip.
+
+# If Pcmcia is compiled in, offer Pcmcia cards...
+comment "Wireless 802.11b Pcmcia/Cardbus cards support"
+	depends on NET_RADIO && PCMCIA
+
+config PCMCIA_HERMES
+	tristate "Hermes PCMCIA card support"
+	depends on NET_RADIO && PCMCIA && HERMES
+	---help---
+	  A driver for "Hermes" chipset based PCMCIA wireless adaptors, such
+	  as the Lucent WavelanIEEE/Orinoco cards and their OEM (Cabletron/
+	  EnteraSys RoamAbout 802.11, ELSA Airlancer, Melco Buffalo and
+	  others).  It should also be usable on various Prism II based cards
+	  such as the Linksys, D-Link and Farallon Skyline.  It should also
+	  work on Symbol cards such as the 3Com AirConnect and Ericsson WLAN.
+
+	  To use your PC-cards, you will need supporting software from David
+	  Hinds' pcmcia-cs package (see the file <file:Documentation/Changes>
+	  for location).  You also want to check out the PCMCIA-HOWTO,
+	  available from <http://www.tldp.org/docs.html#howto>.
+
+	  You will also very likely also need the Wireless Tools in order to
+	  configure your card and that /etc/pcmcia/wireless.opts works:
+	  <http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/Tools.html>.
+
+config AIRO_CS
+	tristate "Cisco/Aironet 34X/35X/4500/4800 PCMCIA cards"
+	depends on NET_RADIO && PCMCIA
+	---help---
+	  This is the standard Linux driver to support Cisco/Aironet PCMCIA
+	  802.11 wireless cards.  This driver is the same as the Aironet
+	  driver part of the Linux Pcmcia package.
+	  It supports the new 802.11b cards from Cisco (Cisco 34X, Cisco 35X
+	  - with or without encryption) as well as card before the Cisco
+	  aquisition (Aironet 4500, Aironet 4800, Aironet 4800B). It also
+	  supports OEM of Cisco such as the DELL TrueMobile 4800 and Xircom
+	  802.11b cards.
+
+	  This driver support both the standard Linux Wireless Extensions
+	  and Cisco proprietary API, so both the Linux Wireless Tools and the
+	  Cisco Linux utilities can be used to configure the card.
+
+	  To use your PC-cards, you will need supporting software from David
+	  Hinds' pcmcia-cs package (see the file <file:Documentation/Changes>
+	  for location).  You also want to check out the PCMCIA-HOWTO,
+	  available from <http://www.tldp.org/docs.html#howto>.
+
+config PCMCIA_ATMEL
+	tristate "Atmel at76c502/at76c504 PCMCIA cards"
+	depends on NET_RADIO && ATMEL && PCMCIA
+	select FW_LOADER
+	select CRC32
+	---help---
+	  Enable support for PCMCIA cards containing the
+	  Atmel at76c502 and at76c504 chips.
+
+config PCMCIA_WL3501
+      tristate "Planet WL3501 PCMCIA cards"
+      depends on NET_RADIO && EXPERIMENTAL && PCMCIA
+       ---help---
+         A driver for WL3501 PCMCIA 802.11 wireless cards made by Planet.
+	 It has basic support for Linux wireless extensions and initial
+	 micro support for ethtool.
+
+comment "Prism GT/Duette 802.11(a/b/g) PCI/Cardbus support"
+	depends on NET_RADIO && PCI
+config PRISM54
+	tristate 'Intersil Prism GT/Duette/Indigo PCI/Cardbus' 
+	depends on PCI && NET_RADIO && EXPERIMENTAL
+	select FW_LOADER
+	---help---
+	  Enable PCI and Cardbus support for the following chipset based cards:
+
+	  ISL3880 - Prism GT            802.11 b/g
+	  ISL3877 - Prism Indigo        802.11 a
+	  ISL3890 - Prism Duette        802.11 a/b/g
+	  
+	  For a complete list of supported cards visit <http://prism54.org>.
+	  Here is the latest confirmed list of supported cards:
+
+	  3com OfficeConnect 11g Cardbus Card aka 3CRWE154G72
+	  Allnet ALL0271 PCI Card
+	  Compex WL54G Cardbus Card
+	  Corega CG-WLCB54GT Cardbus Card
+	  D-Link Air Plus Xtreme G A1 Cardbus Card aka DWL-g650
+	  I-O Data WN-G54/CB Cardbus Card
+	  Kobishi XG-300 aka Z-Com Cardbus Card
+	  Netgear WG511 Cardbus Card
+	  Ovislink WL-5400PCI PCI Card
+	  Peabird WLG-PCI PCI Card
+	  Sitecom WL-100i Cardbus Card
+	  Sitecom WL-110i PCI Card
+	  SMC2802W -    EZ Connect g 2.4GHz 54 Mbps Wireless PCI Card
+	  SMC2835W -    EZ Connect g 2.4GHz 54 Mbps Wireless Cardbus Card
+	  SMC2835W-V2 - EZ Connect g 2.4GHz 54 Mbps Wireless Cardbus Card
+	  Z-Com XG-900 PCI Card
+	  Zyxel G-100 Cardbus Card
+
+	  If you enable this you will need a firmware file as well.
+	  You will need to copy this to /usr/lib/hotplug/firmware/isl3890.
+	  You can get this non-GPL'd firmware file from the Prism54 project page:
+	  <http://prism54.org>
+	  You will also need the /etc/hotplug/firmware.agent script from
+	  a current hotplug package.
+
+	  Note: You need a motherboard with DMA support to use any of these cards 
+	  
+	  If you want to compile the driver as a module ( = code which can be
+	  inserted in and removed from the running kernel whenever you want),
+	  say M here and read <file:Documentation/modules.txt>.  The module
+	  will be called prism54.ko.
+
+# yes, this works even when no drivers are selected
+config NET_WIRELESS
+	bool
+	depends on NET_RADIO && (ISA || PCI || PPC_PMAC || PCMCIA)
+	default y
+
+endmenu
+
diff --git a/drivers/net/wireless/Makefile b/drivers/net/wireless/Makefile
new file mode 100644
index 0000000..2b87841
--- /dev/null
+++ b/drivers/net/wireless/Makefile
@@ -0,0 +1,33 @@
+#
+# Makefile for the Linux Wireless network device drivers.
+#
+
+obj-$(CONFIG_STRIP) += strip.o
+obj-$(CONFIG_ARLAN) += arlan.o 
+
+arlan-objs := arlan-main.o arlan-proc.o
+
+# Obsolete cards
+obj-$(CONFIG_WAVELAN)		+= wavelan.o
+obj-$(CONFIG_PCMCIA_NETWAVE)	+= netwave_cs.o
+obj-$(CONFIG_PCMCIA_WAVELAN)	+= wavelan_cs.o
+
+obj-$(CONFIG_HERMES)		+= orinoco.o hermes.o
+obj-$(CONFIG_PCMCIA_HERMES)	+= orinoco_cs.o
+obj-$(CONFIG_APPLE_AIRPORT)	+= airport.o
+obj-$(CONFIG_PLX_HERMES)	+= orinoco_plx.o
+obj-$(CONFIG_PCI_HERMES)	+= orinoco_pci.o
+obj-$(CONFIG_TMD_HERMES)	+= orinoco_tmd.o
+
+obj-$(CONFIG_AIRO)		+= airo.o
+obj-$(CONFIG_AIRO_CS)		+= airo_cs.o airo.o
+
+obj-$(CONFIG_ATMEL)             += atmel.o
+obj-$(CONFIG_PCI_ATMEL)         += atmel_pci.o 
+obj-$(CONFIG_PCMCIA_ATMEL)      += atmel_cs.o
+
+obj-$(CONFIG_PRISM54)		+= prism54/
+
+# 16-bit wireless PCMCIA client drivers
+obj-$(CONFIG_PCMCIA_RAYCS)	+= ray_cs.o
+obj-$(CONFIG_PCMCIA_WL3501)	+= wl3501_cs.o
diff --git a/drivers/net/wireless/README b/drivers/net/wireless/README
new file mode 100644
index 0000000..0c274bf
--- /dev/null
+++ b/drivers/net/wireless/README
@@ -0,0 +1,25 @@
+	README
+	------
+
+	This directory is mostly for Wireless LAN drivers, in their
+various incarnations (ISA, PCI, Pcmcia...).
+	This separate directory is needed because a lot of driver work
+on different bus (typically PCI + Pcmcia) and share 95% of the
+code. This allow the code and the config options to be in one single
+place instead of scattered all over the driver tree, which is never
+100% satisfactory.
+
+	Note : if you want more info on the topic of Wireless LANs,
+you are kindly invited to have a look at the Wireless Howto :
+		http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/
+	Some Wireless LAN drivers, like orinoco_cs, require the use of
+Wireless Tools to be configured :
+		http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/Tools.html
+
+	Special notes for distribution maintainers :
+	1) wvlan_cs will be discontinued soon in favor of orinoco_cs
+	2) Please add Wireless Tools support in your scripts
+
+	Have fun...
+
+	Jean
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
new file mode 100644
index 0000000..2899144
--- /dev/null
+++ b/drivers/net/wireless/airo.c
@@ -0,0 +1,7667 @@
+/*======================================================================
+
+    Aironet driver for 4500 and 4800 series cards
+
+    This code is released under both the GPL version 2 and BSD licenses.
+    Either license may be used.  The respective licenses are found at
+    the end of this file.
+
+    This code was developed by Benjamin Reed <breed@users.sourceforge.net>
+    including portions of which come from the Aironet PC4500
+    Developer's Reference Manual and used with permission.  Copyright
+    (C) 1999 Benjamin Reed.  All Rights Reserved.  Permission to use
+    code in the Developer's manual was granted for this driver by
+    Aironet.  Major code contributions were received from Javier Achirica
+    <achirica@users.sourceforge.net> and Jean Tourrilhes <jt@hpl.hp.com>.
+    Code was also integrated from the Cisco Aironet driver for Linux.
+    Support for MPI350 cards was added by Fabrice Bellet
+    <fabrice@bellet.info>.
+
+======================================================================*/
+
+#include <linux/config.h>
+#include <linux/init.h>
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/proc_fs.h>
+#include <linux/smp_lock.h>
+
+#include <linux/sched.h>
+#include <linux/ptrace.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/timer.h>
+#include <linux/interrupt.h>
+#include <linux/in.h>
+#include <linux/bitops.h>
+#include <asm/io.h>
+#include <asm/system.h>
+
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/skbuff.h>
+#include <linux/if_arp.h>
+#include <linux/ioport.h>
+#include <linux/pci.h>
+#include <asm/uaccess.h>
+
+#ifdef CONFIG_PCI
+static struct pci_device_id card_ids[] = {
+	{ 0x14b9, 1, PCI_ANY_ID, PCI_ANY_ID, },
+	{ 0x14b9, 0x4500, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x14b9, 0x4800, PCI_ANY_ID, PCI_ANY_ID, },
+	{ 0x14b9, 0x0340, PCI_ANY_ID, PCI_ANY_ID, },
+	{ 0x14b9, 0x0350, PCI_ANY_ID, PCI_ANY_ID, },
+	{ 0x14b9, 0x5000, PCI_ANY_ID, PCI_ANY_ID, },
+	{ 0x14b9, 0xa504, PCI_ANY_ID, PCI_ANY_ID, },
+	{ 0, }
+};
+MODULE_DEVICE_TABLE(pci, card_ids);
+
+static int airo_pci_probe(struct pci_dev *, const struct pci_device_id *);
+static void airo_pci_remove(struct pci_dev *);
+static int airo_pci_suspend(struct pci_dev *pdev, u32 state);
+static int airo_pci_resume(struct pci_dev *pdev);
+
+static struct pci_driver airo_driver = {
+	.name     = "airo",
+	.id_table = card_ids,
+	.probe    = airo_pci_probe,
+	.remove   = __devexit_p(airo_pci_remove),
+	.suspend  = airo_pci_suspend,
+	.resume   = airo_pci_resume,
+};
+#endif /* CONFIG_PCI */
+
+/* Include Wireless Extension definition and check version - Jean II */
+#include <linux/wireless.h>
+#define WIRELESS_SPY		// enable iwspy support
+#include <net/iw_handler.h>	// New driver API
+
+#define CISCO_EXT		// enable Cisco extensions
+#ifdef CISCO_EXT
+#include <linux/delay.h>
+#endif
+
+/* Support Cisco MIC feature */
+#define MICSUPPORT
+
+#if defined(MICSUPPORT) && !defined(CONFIG_CRYPTO)
+#warning MIC support requires Crypto API
+#undef MICSUPPORT
+#endif
+
+/* Hack to do some power saving */
+#define POWER_ON_DOWN
+
+/* As you can see this list is HUGH!
+   I really don't know what a lot of these counts are about, but they
+   are all here for completeness.  If the IGNLABEL macro is put in
+   infront of the label, that statistic will not be included in the list
+   of statistics in the /proc filesystem */
+
+#define IGNLABEL(comment) NULL
+static char *statsLabels[] = {
+	"RxOverrun",
+	IGNLABEL("RxPlcpCrcErr"),
+	IGNLABEL("RxPlcpFormatErr"),
+	IGNLABEL("RxPlcpLengthErr"),
+	"RxMacCrcErr",
+	"RxMacCrcOk",
+	"RxWepErr",
+	"RxWepOk",
+	"RetryLong",
+	"RetryShort",
+	"MaxRetries",
+	"NoAck",
+	"NoCts",
+	"RxAck",
+	"RxCts",
+	"TxAck",
+	"TxRts",
+	"TxCts",
+	"TxMc",
+	"TxBc",
+	"TxUcFrags",
+	"TxUcPackets",
+	"TxBeacon",
+	"RxBeacon",
+	"TxSinColl",
+	"TxMulColl",
+	"DefersNo",
+	"DefersProt",
+	"DefersEngy",
+	"DupFram",
+	"RxFragDisc",
+	"TxAged",
+	"RxAged",
+	"LostSync-MaxRetry",
+	"LostSync-MissedBeacons",
+	"LostSync-ArlExceeded",
+	"LostSync-Deauth",
+	"LostSync-Disassoced",
+	"LostSync-TsfTiming",
+	"HostTxMc",
+	"HostTxBc",
+	"HostTxUc",
+	"HostTxFail",
+	"HostRxMc",
+	"HostRxBc",
+	"HostRxUc",
+	"HostRxDiscard",
+	IGNLABEL("HmacTxMc"),
+	IGNLABEL("HmacTxBc"),
+	IGNLABEL("HmacTxUc"),
+	IGNLABEL("HmacTxFail"),
+	IGNLABEL("HmacRxMc"),
+	IGNLABEL("HmacRxBc"),
+	IGNLABEL("HmacRxUc"),
+	IGNLABEL("HmacRxDiscard"),
+	IGNLABEL("HmacRxAccepted"),
+	"SsidMismatch",
+	"ApMismatch",
+	"RatesMismatch",
+	"AuthReject",
+	"AuthTimeout",
+	"AssocReject",
+	"AssocTimeout",
+	IGNLABEL("ReasonOutsideTable"),
+	IGNLABEL("ReasonStatus1"),
+	IGNLABEL("ReasonStatus2"),
+	IGNLABEL("ReasonStatus3"),
+	IGNLABEL("ReasonStatus4"),
+	IGNLABEL("ReasonStatus5"),
+	IGNLABEL("ReasonStatus6"),
+	IGNLABEL("ReasonStatus7"),
+	IGNLABEL("ReasonStatus8"),
+	IGNLABEL("ReasonStatus9"),
+	IGNLABEL("ReasonStatus10"),
+	IGNLABEL("ReasonStatus11"),
+	IGNLABEL("ReasonStatus12"),
+	IGNLABEL("ReasonStatus13"),
+	IGNLABEL("ReasonStatus14"),
+	IGNLABEL("ReasonStatus15"),
+	IGNLABEL("ReasonStatus16"),
+	IGNLABEL("ReasonStatus17"),
+	IGNLABEL("ReasonStatus18"),
+	IGNLABEL("ReasonStatus19"),
+	"RxMan",
+	"TxMan",
+	"RxRefresh",
+	"TxRefresh",
+	"RxPoll",
+	"TxPoll",
+	"HostRetries",
+	"LostSync-HostReq",
+	"HostTxBytes",
+	"HostRxBytes",
+	"ElapsedUsec",
+	"ElapsedSec",
+	"LostSyncBetterAP",
+	"PrivacyMismatch",
+	"Jammed",
+	"DiscRxNotWepped",
+	"PhyEleMismatch",
+	(char*)-1 };
+#ifndef RUN_AT
+#define RUN_AT(x) (jiffies+(x))
+#endif
+
+
+/* These variables are for insmod, since it seems that the rates
+   can only be set in setup_card.  Rates should be a comma separated
+   (no spaces) list of rates (up to 8). */
+
+static int rates[8];
+static int basic_rate;
+static char *ssids[3];
+
+static int io[4];
+static int irq[4];
+
+static
+int maxencrypt /* = 0 */; /* The highest rate that the card can encrypt at.
+		       0 means no limit.  For old cards this was 4 */
+
+static int auto_wep /* = 0 */; /* If set, it tries to figure out the wep mode */
+static int aux_bap /* = 0 */; /* Checks to see if the aux ports are needed to read
+		    the bap, needed on some older cards and buses. */
+static int adhoc;
+
+static int probe = 1;
+
+static int proc_uid /* = 0 */;
+
+static int proc_gid /* = 0 */;
+
+static int airo_perm = 0555;
+
+static int proc_perm = 0644;
+
+MODULE_AUTHOR("Benjamin Reed");
+MODULE_DESCRIPTION("Support for Cisco/Aironet 802.11 wireless ethernet \
+                   cards.  Direct support for ISA/PCI/MPI cards and support \
+		   for PCMCIA when used with airo_cs.");
+MODULE_LICENSE("Dual BSD/GPL");
+MODULE_SUPPORTED_DEVICE("Aironet 4500, 4800 and Cisco 340/350");
+module_param_array(io, int, NULL, 0);
+module_param_array(irq, int, NULL, 0);
+module_param(basic_rate, int, 0);
+module_param_array(rates, int, NULL, 0);
+module_param_array(ssids, charp, NULL, 0);
+module_param(auto_wep, int, 0);
+MODULE_PARM_DESC(auto_wep, "If non-zero, the driver will keep looping through \
+the authentication options until an association is made.  The value of \
+auto_wep is number of the wep keys to check.  A value of 2 will try using \
+the key at index 0 and index 1.");
+module_param(aux_bap, int, 0);
+MODULE_PARM_DESC(aux_bap, "If non-zero, the driver will switch into a mode \
+than seems to work better for older cards with some older buses.  Before \
+switching it checks that the switch is needed.");
+module_param(maxencrypt, int, 0);
+MODULE_PARM_DESC(maxencrypt, "The maximum speed that the card can do \
+encryption.  Units are in 512kbs.  Zero (default) means there is no limit. \
+Older cards used to be limited to 2mbs (4).");
+module_param(adhoc, int, 0);
+MODULE_PARM_DESC(adhoc, "If non-zero, the card will start in adhoc mode.");
+module_param(probe, int, 0);
+MODULE_PARM_DESC(probe, "If zero, the driver won't start the card.");
+
+module_param(proc_uid, int, 0);
+MODULE_PARM_DESC(proc_uid, "The uid that the /proc files will belong to.");
+module_param(proc_gid, int, 0);
+MODULE_PARM_DESC(proc_gid, "The gid that the /proc files will belong to.");
+module_param(airo_perm, int, 0);
+MODULE_PARM_DESC(airo_perm, "The permission bits of /proc/[driver/]aironet.");
+module_param(proc_perm, int, 0);
+MODULE_PARM_DESC(proc_perm, "The permission bits of the files in /proc");
+
+/* This is a kind of sloppy hack to get this information to OUT4500 and
+   IN4500.  I would be extremely interested in the situation where this
+   doesn't work though!!! */
+static int do8bitIO = 0;
+
+/* Return codes */
+#define SUCCESS 0
+#define ERROR -1
+#define NO_PACKET -2
+
+/* Commands */
+#define NOP2		0x0000
+#define MAC_ENABLE	0x0001
+#define MAC_DISABLE	0x0002
+#define CMD_LOSE_SYNC	0x0003 /* Not sure what this does... */
+#define CMD_SOFTRESET	0x0004
+#define HOSTSLEEP	0x0005
+#define CMD_MAGIC_PKT	0x0006
+#define CMD_SETWAKEMASK	0x0007
+#define CMD_READCFG	0x0008
+#define CMD_SETMODE	0x0009
+#define CMD_ALLOCATETX	0x000a
+#define CMD_TRANSMIT	0x000b
+#define CMD_DEALLOCATETX 0x000c
+#define NOP		0x0010
+#define CMD_WORKAROUND	0x0011
+#define CMD_ALLOCATEAUX 0x0020
+#define CMD_ACCESS	0x0021
+#define CMD_PCIBAP	0x0022
+#define CMD_PCIAUX	0x0023
+#define CMD_ALLOCBUF	0x0028
+#define CMD_GETTLV	0x0029
+#define CMD_PUTTLV	0x002a
+#define CMD_DELTLV	0x002b
+#define CMD_FINDNEXTTLV	0x002c
+#define CMD_PSPNODES	0x0030
+#define CMD_SETCW	0x0031    
+#define CMD_SETPCF	0x0032    
+#define CMD_SETPHYREG	0x003e
+#define CMD_TXTEST	0x003f
+#define MAC_ENABLETX	0x0101
+#define CMD_LISTBSS	0x0103
+#define CMD_SAVECFG	0x0108
+#define CMD_ENABLEAUX	0x0111
+#define CMD_WRITERID	0x0121
+#define CMD_USEPSPNODES	0x0130
+#define MAC_ENABLERX	0x0201
+
+/* Command errors */
+#define ERROR_QUALIF 0x00
+#define ERROR_ILLCMD 0x01
+#define ERROR_ILLFMT 0x02
+#define ERROR_INVFID 0x03
+#define ERROR_INVRID 0x04
+#define ERROR_LARGE 0x05
+#define ERROR_NDISABL 0x06
+#define ERROR_ALLOCBSY 0x07
+#define ERROR_NORD 0x0B
+#define ERROR_NOWR 0x0C
+#define ERROR_INVFIDTX 0x0D
+#define ERROR_TESTACT 0x0E
+#define ERROR_TAGNFND 0x12
+#define ERROR_DECODE 0x20
+#define ERROR_DESCUNAV 0x21
+#define ERROR_BADLEN 0x22
+#define ERROR_MODE 0x80
+#define ERROR_HOP 0x81
+#define ERROR_BINTER 0x82
+#define ERROR_RXMODE 0x83
+#define ERROR_MACADDR 0x84
+#define ERROR_RATES 0x85
+#define ERROR_ORDER 0x86
+#define ERROR_SCAN 0x87
+#define ERROR_AUTH 0x88
+#define ERROR_PSMODE 0x89
+#define ERROR_RTYPE 0x8A
+#define ERROR_DIVER 0x8B
+#define ERROR_SSID 0x8C
+#define ERROR_APLIST 0x8D
+#define ERROR_AUTOWAKE 0x8E
+#define ERROR_LEAP 0x8F
+
+/* Registers */
+#define COMMAND 0x00
+#define PARAM0 0x02
+#define PARAM1 0x04
+#define PARAM2 0x06
+#define STATUS 0x08
+#define RESP0 0x0a
+#define RESP1 0x0c
+#define RESP2 0x0e
+#define LINKSTAT 0x10
+#define SELECT0 0x18
+#define OFFSET0 0x1c
+#define RXFID 0x20
+#define TXALLOCFID 0x22
+#define TXCOMPLFID 0x24
+#define DATA0 0x36
+#define EVSTAT 0x30
+#define EVINTEN 0x32
+#define EVACK 0x34
+#define SWS0 0x28
+#define SWS1 0x2a
+#define SWS2 0x2c
+#define SWS3 0x2e
+#define AUXPAGE 0x3A
+#define AUXOFF 0x3C
+#define AUXDATA 0x3E
+
+#define FID_TX 1
+#define FID_RX 2
+/* Offset into aux memory for descriptors */
+#define AUX_OFFSET 0x800
+/* Size of allocated packets */
+#define PKTSIZE 1840
+#define RIDSIZE 2048
+/* Size of the transmit queue */
+#define MAXTXQ 64
+
+/* BAP selectors */
+#define BAP0 0 // Used for receiving packets
+#define BAP1 2 // Used for xmiting packets and working with RIDS
+
+/* Flags */
+#define COMMAND_BUSY 0x8000
+
+#define BAP_BUSY 0x8000
+#define BAP_ERR 0x4000
+#define BAP_DONE 0x2000
+
+#define PROMISC 0xffff
+#define NOPROMISC 0x0000
+
+#define EV_CMD 0x10
+#define EV_CLEARCOMMANDBUSY 0x4000
+#define EV_RX 0x01
+#define EV_TX 0x02
+#define EV_TXEXC 0x04
+#define EV_ALLOC 0x08
+#define EV_LINK 0x80
+#define EV_AWAKE 0x100
+#define EV_TXCPY 0x400
+#define EV_UNKNOWN 0x800
+#define EV_MIC 0x1000 /* Message Integrity Check Interrupt */
+#define EV_AWAKEN 0x2000
+#define STATUS_INTS (EV_AWAKE|EV_LINK|EV_TXEXC|EV_TX|EV_TXCPY|EV_RX|EV_MIC)
+
+#ifdef CHECK_UNKNOWN_INTS
+#define IGNORE_INTS ( EV_CMD | EV_UNKNOWN)
+#else
+#define IGNORE_INTS (~STATUS_INTS)
+#endif
+
+/* RID TYPES */
+#define RID_RW 0x20
+
+/* The RIDs */
+#define RID_CAPABILITIES 0xFF00
+#define RID_APINFO     0xFF01
+#define RID_RADIOINFO  0xFF02
+#define RID_UNKNOWN3   0xFF03
+#define RID_RSSI       0xFF04
+#define RID_CONFIG     0xFF10
+#define RID_SSID       0xFF11
+#define RID_APLIST     0xFF12
+#define RID_DRVNAME    0xFF13
+#define RID_ETHERENCAP 0xFF14
+#define RID_WEP_TEMP   0xFF15
+#define RID_WEP_PERM   0xFF16
+#define RID_MODULATION 0xFF17
+#define RID_OPTIONS    0xFF18
+#define RID_ACTUALCONFIG 0xFF20 /*readonly*/
+#define RID_FACTORYCONFIG 0xFF21
+#define RID_UNKNOWN22  0xFF22
+#define RID_LEAPUSERNAME 0xFF23
+#define RID_LEAPPASSWORD 0xFF24
+#define RID_STATUS     0xFF50
+#define RID_BEACON_HST 0xFF51
+#define RID_BUSY_HST   0xFF52
+#define RID_RETRIES_HST 0xFF53
+#define RID_UNKNOWN54  0xFF54
+#define RID_UNKNOWN55  0xFF55
+#define RID_UNKNOWN56  0xFF56
+#define RID_MIC        0xFF57
+#define RID_STATS16    0xFF60
+#define RID_STATS16DELTA 0xFF61
+#define RID_STATS16DELTACLEAR 0xFF62
+#define RID_STATS      0xFF68
+#define RID_STATSDELTA 0xFF69
+#define RID_STATSDELTACLEAR 0xFF6A
+#define RID_ECHOTEST_RID 0xFF70
+#define RID_ECHOTEST_RESULTS 0xFF71
+#define RID_BSSLISTFIRST 0xFF72
+#define RID_BSSLISTNEXT  0xFF73
+
+typedef struct {
+	u16 cmd;
+	u16 parm0;
+	u16 parm1;
+	u16 parm2;
+} Cmd;
+
+typedef struct {
+	u16 status;
+	u16 rsp0;
+	u16 rsp1;
+	u16 rsp2;
+} Resp;
+
+/*
+ * Rids and endian-ness:  The Rids will always be in cpu endian, since
+ * this all the patches from the big-endian guys end up doing that.
+ * so all rid access should use the read/writeXXXRid routines.
+ */
+
+/* This is redundant for x86 archs, but it seems necessary for ARM */
+#pragma pack(1)
+
+/* This structure came from an email sent to me from an engineer at
+   aironet for inclusion into this driver */
+typedef struct {
+	u16 len;
+	u16 kindex;
+	u8 mac[ETH_ALEN];
+	u16 klen;
+	u8 key[16];
+} WepKeyRid;
+
+/* These structures are from the Aironet's PC4500 Developers Manual */
+typedef struct {
+	u16 len;
+	u8 ssid[32];
+} Ssid;
+
+typedef struct {
+	u16 len;
+	Ssid ssids[3];
+} SsidRid;
+
+typedef struct {
+        u16 len;
+        u16 modulation;
+#define MOD_DEFAULT 0
+#define MOD_CCK 1
+#define MOD_MOK 2
+} ModulationRid;
+
+typedef struct {
+	u16 len; /* sizeof(ConfigRid) */
+	u16 opmode; /* operating mode */
+#define MODE_STA_IBSS 0
+#define MODE_STA_ESS 1
+#define MODE_AP 2
+#define MODE_AP_RPTR 3
+#define MODE_ETHERNET_HOST (0<<8) /* rx payloads converted */
+#define MODE_LLC_HOST (1<<8) /* rx payloads left as is */
+#define MODE_AIRONET_EXTEND (1<<9) /* enable Aironet extenstions */
+#define MODE_AP_INTERFACE (1<<10) /* enable ap interface extensions */
+#define MODE_ANTENNA_ALIGN (1<<11) /* enable antenna alignment */
+#define MODE_ETHER_LLC (1<<12) /* enable ethernet LLC */
+#define MODE_LEAF_NODE (1<<13) /* enable leaf node bridge */
+#define MODE_CF_POLLABLE (1<<14) /* enable CF pollable */
+#define MODE_MIC (1<<15) /* enable MIC */
+	u16 rmode; /* receive mode */
+#define RXMODE_BC_MC_ADDR 0
+#define RXMODE_BC_ADDR 1 /* ignore multicasts */
+#define RXMODE_ADDR 2 /* ignore multicast and broadcast */
+#define RXMODE_RFMON 3 /* wireless monitor mode */
+#define RXMODE_RFMON_ANYBSS 4
+#define RXMODE_LANMON 5 /* lan style monitor -- data packets only */
+#define RXMODE_DISABLE_802_3_HEADER (1<<8) /* disables 802.3 header on rx */
+#define RXMODE_NORMALIZED_RSSI (1<<9) /* return normalized RSSI */
+	u16 fragThresh;
+	u16 rtsThres;
+	u8 macAddr[ETH_ALEN];
+	u8 rates[8];
+	u16 shortRetryLimit;
+	u16 longRetryLimit;
+	u16 txLifetime; /* in kusec */
+	u16 rxLifetime; /* in kusec */
+	u16 stationary;
+	u16 ordering;
+	u16 u16deviceType; /* for overriding device type */
+	u16 cfpRate;
+	u16 cfpDuration;
+	u16 _reserved1[3];
+	/*---------- Scanning/Associating ----------*/
+	u16 scanMode;
+#define SCANMODE_ACTIVE 0
+#define SCANMODE_PASSIVE 1
+#define SCANMODE_AIROSCAN 2
+	u16 probeDelay; /* in kusec */
+	u16 probeEnergyTimeout; /* in kusec */
+        u16 probeResponseTimeout;
+	u16 beaconListenTimeout;
+	u16 joinNetTimeout;
+	u16 authTimeout;
+	u16 authType;
+#define AUTH_OPEN 0x1
+#define AUTH_ENCRYPT 0x101
+#define AUTH_SHAREDKEY 0x102
+#define AUTH_ALLOW_UNENCRYPTED 0x200
+	u16 associationTimeout;
+	u16 specifiedApTimeout;
+	u16 offlineScanInterval;
+	u16 offlineScanDuration;
+	u16 linkLossDelay;
+	u16 maxBeaconLostTime;
+	u16 refreshInterval;
+#define DISABLE_REFRESH 0xFFFF
+	u16 _reserved1a[1];
+	/*---------- Power save operation ----------*/
+	u16 powerSaveMode;
+#define POWERSAVE_CAM 0
+#define POWERSAVE_PSP 1
+#define POWERSAVE_PSPCAM 2
+	u16 sleepForDtims;
+	u16 listenInterval;
+	u16 fastListenInterval;
+	u16 listenDecay;
+	u16 fastListenDelay;
+	u16 _reserved2[2];
+	/*---------- Ap/Ibss config items ----------*/
+	u16 beaconPeriod;
+	u16 atimDuration;
+	u16 hopPeriod;
+	u16 channelSet;
+	u16 channel;
+	u16 dtimPeriod;
+	u16 bridgeDistance;
+	u16 radioID;
+	/*---------- Radio configuration ----------*/
+	u16 radioType;
+#define RADIOTYPE_DEFAULT 0
+#define RADIOTYPE_802_11 1
+#define RADIOTYPE_LEGACY 2
+	u8 rxDiversity;
+	u8 txDiversity;
+	u16 txPower;
+#define TXPOWER_DEFAULT 0
+	u16 rssiThreshold;
+#define RSSI_DEFAULT 0
+        u16 modulation;
+#define PREAMBLE_AUTO 0
+#define PREAMBLE_LONG 1
+#define PREAMBLE_SHORT 2
+	u16 preamble;
+	u16 homeProduct;
+	u16 radioSpecific;
+	/*---------- Aironet Extensions ----------*/
+	u8 nodeName[16];
+	u16 arlThreshold;
+	u16 arlDecay;
+	u16 arlDelay;
+	u16 _reserved4[1];
+	/*---------- Aironet Extensions ----------*/
+	u8 magicAction;
+#define MAGIC_ACTION_STSCHG 1
+#define MAGIC_ACTION_RESUME 2
+#define MAGIC_IGNORE_MCAST (1<<8)
+#define MAGIC_IGNORE_BCAST (1<<9)
+#define MAGIC_SWITCH_TO_PSP (0<<10)
+#define MAGIC_STAY_IN_CAM (1<<10)
+	u8 magicControl;
+	u16 autoWake;
+} ConfigRid;
+
+typedef struct {
+	u16 len;
+	u8 mac[ETH_ALEN];
+	u16 mode;
+	u16 errorCode;
+	u16 sigQuality;
+	u16 SSIDlen;
+	char SSID[32];
+	char apName[16];
+	u8 bssid[4][ETH_ALEN];
+	u16 beaconPeriod;
+	u16 dimPeriod;
+	u16 atimDuration;
+	u16 hopPeriod;
+	u16 channelSet;
+	u16 channel;
+	u16 hopsToBackbone;
+	u16 apTotalLoad;
+	u16 generatedLoad;
+	u16 accumulatedArl;
+	u16 signalQuality;
+	u16 currentXmitRate;
+	u16 apDevExtensions;
+	u16 normalizedSignalStrength;
+	u16 shortPreamble;
+	u8 apIP[4];
+	u8 noisePercent; /* Noise percent in last second */
+	u8 noisedBm; /* Noise dBm in last second */
+	u8 noiseAvePercent; /* Noise percent in last minute */
+	u8 noiseAvedBm; /* Noise dBm in last minute */
+	u8 noiseMaxPercent; /* Highest noise percent in last minute */
+	u8 noiseMaxdBm; /* Highest noise dbm in last minute */
+	u16 load;
+	u8 carrier[4];
+	u16 assocStatus;
+#define STAT_NOPACKETS 0
+#define STAT_NOCARRIERSET 10
+#define STAT_GOTCARRIERSET 11
+#define STAT_WRONGSSID 20
+#define STAT_BADCHANNEL 25
+#define STAT_BADBITRATES 30
+#define STAT_BADPRIVACY 35
+#define STAT_APFOUND 40
+#define STAT_APREJECTED 50
+#define STAT_AUTHENTICATING 60
+#define STAT_DEAUTHENTICATED 61
+#define STAT_AUTHTIMEOUT 62
+#define STAT_ASSOCIATING 70
+#define STAT_DEASSOCIATED 71
+#define STAT_ASSOCTIMEOUT 72
+#define STAT_NOTAIROAP 73
+#define STAT_ASSOCIATED 80
+#define STAT_LEAPING 90
+#define STAT_LEAPFAILED 91
+#define STAT_LEAPTIMEDOUT 92
+#define STAT_LEAPCOMPLETE 93
+} StatusRid;
+
+typedef struct {
+	u16 len;
+	u16 spacer;
+	u32 vals[100];
+} StatsRid;
+
+
+typedef struct {
+	u16 len;
+	u8 ap[4][ETH_ALEN];
+} APListRid;
+
+typedef struct {
+	u16 len;
+	char oui[3];
+	char zero;
+	u16 prodNum;
+	char manName[32];
+	char prodName[16];
+	char prodVer[8];
+	char factoryAddr[ETH_ALEN];
+	char aironetAddr[ETH_ALEN];
+	u16 radioType;
+	u16 country;
+	char callid[ETH_ALEN];
+	char supportedRates[8];
+	char rxDiversity;
+	char txDiversity;
+	u16 txPowerLevels[8];
+	u16 hardVer;
+	u16 hardCap;
+	u16 tempRange;
+	u16 softVer;
+	u16 softSubVer;
+	u16 interfaceVer;
+	u16 softCap;
+	u16 bootBlockVer;
+	u16 requiredHard;
+	u16 extSoftCap;
+} CapabilityRid;
+
+typedef struct {
+  u16 len;
+  u16 index; /* First is 0 and 0xffff means end of list */
+#define RADIO_FH 1 /* Frequency hopping radio type */
+#define RADIO_DS 2 /* Direct sequence radio type */
+#define RADIO_TMA 4 /* Proprietary radio used in old cards (2500) */
+  u16 radioType;
+  u8 bssid[ETH_ALEN]; /* Mac address of the BSS */
+  u8 zero;
+  u8 ssidLen;
+  u8 ssid[32];
+  u16 rssi;
+#define CAP_ESS (1<<0)
+#define CAP_IBSS (1<<1)
+#define CAP_PRIVACY (1<<4)
+#define CAP_SHORTHDR (1<<5)
+  u16 cap;
+  u16 beaconInterval;
+  u8 rates[8]; /* Same as rates for config rid */
+  struct { /* For frequency hopping only */
+    u16 dwell;
+    u8 hopSet;
+    u8 hopPattern;
+    u8 hopIndex;
+    u8 fill;
+  } fh;
+  u16 dsChannel;
+  u16 atimWindow;
+} BSSListRid;
+
+typedef struct {
+  u8 rssipct;
+  u8 rssidBm;
+} tdsRssiEntry;
+
+typedef struct {
+  u16 len;
+  tdsRssiEntry x[256];
+} tdsRssiRid;
+
+typedef struct {
+	u16 len;
+	u16 state;
+	u16 multicastValid;
+	u8  multicast[16];
+	u16 unicastValid;
+	u8  unicast[16];
+} MICRid;
+
+typedef struct {
+	u16 typelen;
+
+	union {
+	    u8 snap[8];
+	    struct {
+		u8 dsap;
+		u8 ssap;
+		u8 control;
+		u8 orgcode[3];
+		u8 fieldtype[2];
+	    } llc;
+	} u;
+	u32 mic;
+	u32 seq;
+} MICBuffer;
+
+typedef struct {
+	u8 da[ETH_ALEN];
+	u8 sa[ETH_ALEN];
+} etherHead;
+
+#pragma pack()
+
+#define TXCTL_TXOK (1<<1) /* report if tx is ok */
+#define TXCTL_TXEX (1<<2) /* report if tx fails */
+#define TXCTL_802_3 (0<<3) /* 802.3 packet */
+#define TXCTL_802_11 (1<<3) /* 802.11 mac packet */
+#define TXCTL_ETHERNET (0<<4) /* payload has ethertype */
+#define TXCTL_LLC (1<<4) /* payload is llc */
+#define TXCTL_RELEASE (0<<5) /* release after completion */
+#define TXCTL_NORELEASE (1<<5) /* on completion returns to host */
+
+#define BUSY_FID 0x10000
+
+#ifdef CISCO_EXT
+#define AIROMAGIC	0xa55a
+/* Warning : SIOCDEVPRIVATE may disapear during 2.5.X - Jean II */
+#ifdef SIOCIWFIRSTPRIV
+#ifdef SIOCDEVPRIVATE
+#define AIROOLDIOCTL	SIOCDEVPRIVATE
+#define AIROOLDIDIFC 	AIROOLDIOCTL + 1
+#endif /* SIOCDEVPRIVATE */
+#else /* SIOCIWFIRSTPRIV */
+#define SIOCIWFIRSTPRIV SIOCDEVPRIVATE
+#endif /* SIOCIWFIRSTPRIV */
+/* This may be wrong. When using the new SIOCIWFIRSTPRIV range, we probably
+ * should use only "GET" ioctls (last bit set to 1). "SET" ioctls are root
+ * only and don't return the modified struct ifreq to the application which
+ * is usually a problem. - Jean II */
+#define AIROIOCTL	SIOCIWFIRSTPRIV
+#define AIROIDIFC 	AIROIOCTL + 1
+
+/* Ioctl constants to be used in airo_ioctl.command */
+
+#define	AIROGCAP  		0	// Capability rid
+#define AIROGCFG		1       // USED A LOT
+#define AIROGSLIST		2	// System ID list
+#define AIROGVLIST		3       // List of specified AP's
+#define AIROGDRVNAM		4	//  NOTUSED
+#define AIROGEHTENC		5	// NOTUSED
+#define AIROGWEPKTMP		6
+#define AIROGWEPKNV		7
+#define AIROGSTAT		8
+#define AIROGSTATSC32		9
+#define AIROGSTATSD32		10
+#define AIROGMICRID		11
+#define AIROGMICSTATS		12
+#define AIROGFLAGS		13
+#define AIROGID			14
+#define AIRORRID		15
+#define AIRORSWVERSION		17
+
+/* Leave gap of 40 commands after AIROGSTATSD32 for future */
+
+#define AIROPCAP               	AIROGSTATSD32 + 40
+#define AIROPVLIST              AIROPCAP      + 1
+#define AIROPSLIST		AIROPVLIST    + 1
+#define AIROPCFG		AIROPSLIST    + 1
+#define AIROPSIDS		AIROPCFG      + 1
+#define AIROPAPLIST		AIROPSIDS     + 1
+#define AIROPMACON		AIROPAPLIST   + 1	/* Enable mac  */
+#define AIROPMACOFF		AIROPMACON    + 1 	/* Disable mac */
+#define AIROPSTCLR		AIROPMACOFF   + 1
+#define AIROPWEPKEY		AIROPSTCLR    + 1
+#define AIROPWEPKEYNV		AIROPWEPKEY   + 1
+#define AIROPLEAPPWD            AIROPWEPKEYNV + 1
+#define AIROPLEAPUSR            AIROPLEAPPWD  + 1
+
+/* Flash codes */
+
+#define AIROFLSHRST	       AIROPWEPKEYNV  + 40
+#define AIROFLSHGCHR           AIROFLSHRST    + 1
+#define AIROFLSHSTFL           AIROFLSHGCHR   + 1
+#define AIROFLSHPCHR           AIROFLSHSTFL   + 1
+#define AIROFLPUTBUF           AIROFLSHPCHR   + 1
+#define AIRORESTART            AIROFLPUTBUF   + 1
+
+#define FLASHSIZE	32768
+#define AUXMEMSIZE	(256 * 1024)
+
+typedef struct aironet_ioctl {
+	unsigned short command;		// What to do
+	unsigned short len;		// Len of data
+	unsigned short ridnum;		// rid number
+	unsigned char __user *data;	// d-data
+} aironet_ioctl;
+
+static char *swversion = "2.1";
+#endif /* CISCO_EXT */
+
+#define NUM_MODULES       2
+#define MIC_MSGLEN_MAX    2400
+#define EMMH32_MSGLEN_MAX MIC_MSGLEN_MAX
+
+typedef struct {
+	u32   size;            // size
+	u8    enabled;         // MIC enabled or not
+	u32   rxSuccess;       // successful packets received
+	u32   rxIncorrectMIC;  // pkts dropped due to incorrect MIC comparison
+	u32   rxNotMICed;      // pkts dropped due to not being MIC'd
+	u32   rxMICPlummed;    // pkts dropped due to not having a MIC plummed
+	u32   rxWrongSequence; // pkts dropped due to sequence number violation
+	u32   reserve[32];
+} mic_statistics;
+
+typedef struct {
+	u32 coeff[((EMMH32_MSGLEN_MAX)+3)>>2];
+	u64 accum;	// accumulated mic, reduced to u32 in final()
+	int position;	// current position (byte offset) in message
+	union {
+		u8  d8[4];
+		u32 d32;
+	} part;	// saves partial message word across update() calls
+} emmh32_context;
+
+typedef struct {
+	emmh32_context seed;	    // Context - the seed
+	u32		 rx;	    // Received sequence number
+	u32		 tx;	    // Tx sequence number
+	u32		 window;    // Start of window
+	u8		 valid;	    // Flag to say if context is valid or not
+	u8		 key[16];
+} miccntx;
+
+typedef struct {
+	miccntx mCtx;		// Multicast context
+	miccntx uCtx;		// Unicast context
+} mic_module;
+
+typedef struct {
+	unsigned int  rid: 16;
+	unsigned int  len: 15;
+	unsigned int  valid: 1;
+	dma_addr_t host_addr;
+} Rid;
+
+typedef struct {
+	unsigned int  offset: 15;
+	unsigned int  eoc: 1;
+	unsigned int  len: 15;
+	unsigned int  valid: 1;
+	dma_addr_t host_addr;
+} TxFid;
+
+typedef struct {
+	unsigned int  ctl: 15;
+	unsigned int  rdy: 1;
+	unsigned int  len: 15;
+	unsigned int  valid: 1;
+	dma_addr_t host_addr;
+} RxFid;
+
+/*
+ * Host receive descriptor
+ */
+typedef struct {
+	unsigned char __iomem *card_ram_off; /* offset into card memory of the
+						desc */
+	RxFid         rx_desc;		     /* card receive descriptor */
+	char          *virtual_host_addr;    /* virtual address of host receive
+					        buffer */
+	int           pending;
+} HostRxDesc;
+
+/*
+ * Host transmit descriptor
+ */
+typedef struct {
+	unsigned char __iomem *card_ram_off;	     /* offset into card memory of the
+						desc */
+	TxFid         tx_desc;		     /* card transmit descriptor */
+	char          *virtual_host_addr;    /* virtual address of host receive
+					        buffer */
+	int           pending;
+} HostTxDesc;
+
+/*
+ * Host RID descriptor
+ */
+typedef struct {
+	unsigned char __iomem *card_ram_off;      /* offset into card memory of the
+					     descriptor */
+	Rid           rid_desc;		  /* card RID descriptor */
+	char          *virtual_host_addr; /* virtual address of host receive
+					     buffer */
+} HostRidDesc;
+
+typedef struct {
+	u16 sw0;
+	u16 sw1;
+	u16 status;
+	u16 len;
+#define HOST_SET (1 << 0)
+#define HOST_INT_TX (1 << 1) /* Interrupt on successful TX */
+#define HOST_INT_TXERR (1 << 2) /* Interrupt on unseccessful TX */
+#define HOST_LCC_PAYLOAD (1 << 4) /* LLC payload, 0 = Ethertype */
+#define HOST_DONT_RLSE (1 << 5) /* Don't release buffer when done */
+#define HOST_DONT_RETRY (1 << 6) /* Don't retry trasmit */
+#define HOST_CLR_AID (1 << 7) /* clear AID failure */
+#define HOST_RTS (1 << 9) /* Force RTS use */
+#define HOST_SHORT (1 << 10) /* Do short preamble */
+	u16 ctl;
+	u16 aid;
+	u16 retries;
+	u16 fill;
+} TxCtlHdr;
+
+typedef struct {
+        u16 ctl;
+        u16 duration;
+        char addr1[6];
+        char addr2[6];
+        char addr3[6];
+        u16 seq;
+        char addr4[6];
+} WifiHdr;
+
+
+typedef struct {
+	TxCtlHdr ctlhdr;
+	u16 fill1;
+	u16 fill2;
+	WifiHdr wifihdr;
+	u16 gaplen;
+	u16 status;
+} WifiCtlHdr;
+
+WifiCtlHdr wifictlhdr8023 = {
+	.ctlhdr = {
+		.ctl	= HOST_DONT_RLSE,
+	}
+};
+
+#ifdef WIRELESS_EXT
+// Frequency list (map channels to frequencies)
+static const long frequency_list[] = { 2412, 2417, 2422, 2427, 2432, 2437, 2442,
+				2447, 2452, 2457, 2462, 2467, 2472, 2484 };
+
+// A few details needed for WEP (Wireless Equivalent Privacy)
+#define MAX_KEY_SIZE 13			// 128 (?) bits
+#define MIN_KEY_SIZE  5			// 40 bits RC4 - WEP
+typedef struct wep_key_t {
+	u16	len;
+	u8	key[16];	/* 40-bit and 104-bit keys */
+} wep_key_t;
+
+/* Backward compatibility */
+#ifndef IW_ENCODE_NOKEY
+#define IW_ENCODE_NOKEY         0x0800  /* Key is write only, so not present */
+#define IW_ENCODE_MODE  (IW_ENCODE_DISABLED | IW_ENCODE_RESTRICTED | IW_ENCODE_OPEN)
+#endif /* IW_ENCODE_NOKEY */
+
+/* List of Wireless Handlers (new API) */
+static const struct iw_handler_def	airo_handler_def;
+#endif /* WIRELESS_EXT */
+
+static const char version[] = "airo.c 0.6 (Ben Reed & Javier Achirica)";
+
+struct airo_info;
+
+static int get_dec_u16( char *buffer, int *start, int limit );
+static void OUT4500( struct airo_info *, u16 register, u16 value );
+static unsigned short IN4500( struct airo_info *, u16 register );
+static u16 setup_card(struct airo_info*, u8 *mac, int lock);
+static int enable_MAC( struct airo_info *ai, Resp *rsp, int lock );
+static void disable_MAC(struct airo_info *ai, int lock);
+static void enable_interrupts(struct airo_info*);
+static void disable_interrupts(struct airo_info*);
+static u16 issuecommand(struct airo_info*, Cmd *pCmd, Resp *pRsp);
+static int bap_setup(struct airo_info*, u16 rid, u16 offset, int whichbap);
+static int aux_bap_read(struct airo_info*, u16 *pu16Dst, int bytelen,
+			int whichbap);
+static int fast_bap_read(struct airo_info*, u16 *pu16Dst, int bytelen,
+			 int whichbap);
+static int bap_write(struct airo_info*, const u16 *pu16Src, int bytelen,
+		     int whichbap);
+static int PC4500_accessrid(struct airo_info*, u16 rid, u16 accmd);
+static int PC4500_readrid(struct airo_info*, u16 rid, void *pBuf, int len, int lock);
+static int PC4500_writerid(struct airo_info*, u16 rid, const void
+			   *pBuf, int len, int lock);
+static int do_writerid( struct airo_info*, u16 rid, const void *rid_data,
+			int len, int dummy );
+static u16 transmit_allocate(struct airo_info*, int lenPayload, int raw);
+static int transmit_802_3_packet(struct airo_info*, int len, char *pPacket);
+static int transmit_802_11_packet(struct airo_info*, int len, char *pPacket);
+
+static int mpi_send_packet (struct net_device *dev);
+static void mpi_unmap_card(struct pci_dev *pci);
+static void mpi_receive_802_3(struct airo_info *ai);
+static void mpi_receive_802_11(struct airo_info *ai);
+static int waitbusy (struct airo_info *ai);
+
+static irqreturn_t airo_interrupt( int irq, void* dev_id, struct pt_regs
+			    *regs);
+static int airo_thread(void *data);
+static void timer_func( struct net_device *dev );
+static int airo_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
+#ifdef WIRELESS_EXT
+struct iw_statistics *airo_get_wireless_stats (struct net_device *dev);
+static void airo_read_wireless_stats (struct airo_info *local);
+#endif /* WIRELESS_EXT */
+#ifdef CISCO_EXT
+static int readrids(struct net_device *dev, aironet_ioctl *comp);
+static int writerids(struct net_device *dev, aironet_ioctl *comp);
+int flashcard(struct net_device *dev, aironet_ioctl *comp);
+#endif /* CISCO_EXT */
+#ifdef MICSUPPORT
+static void micinit(struct airo_info *ai);
+static int micsetup(struct airo_info *ai);
+static int encapsulate(struct airo_info *ai, etherHead *pPacket, MICBuffer *buffer, int len);
+static int decapsulate(struct airo_info *ai, MICBuffer *mic, etherHead *pPacket, u16 payLen);
+
+#include <linux/crypto.h>
+#endif
+
+struct airo_info {
+	struct net_device_stats	stats;
+	struct net_device             *dev;
+	/* Note, we can have MAX_FIDS outstanding.  FIDs are 16-bits, so we
+	   use the high bit to mark whether it is in use. */
+#define MAX_FIDS 6
+#define MPI_MAX_FIDS 1
+	int                           fids[MAX_FIDS];
+	ConfigRid config;
+	char keyindex; // Used with auto wep
+	char defindex; // Used with auto wep
+	struct proc_dir_entry *proc_entry;
+        spinlock_t aux_lock;
+        unsigned long flags;
+#define FLAG_PROMISC	8	/* IFF_PROMISC 0x100 - include/linux/if.h */
+#define FLAG_RADIO_OFF	0	/* User disabling of MAC */
+#define FLAG_RADIO_DOWN	1	/* ifup/ifdown disabling of MAC */
+#define FLAG_RADIO_MASK 0x03
+#define FLAG_ENABLED	2
+#define FLAG_ADHOC	3	/* Needed by MIC */
+#define FLAG_MIC_CAPABLE 4
+#define FLAG_UPDATE_MULTI 5
+#define FLAG_UPDATE_UNI 6
+#define FLAG_802_11	7
+#define FLAG_PENDING_XMIT 9
+#define FLAG_PENDING_XMIT11 10
+#define FLAG_MPI	11
+#define FLAG_REGISTERED	12
+#define FLAG_COMMIT	13
+#define FLAG_RESET	14
+#define FLAG_FLASHING	15
+#define JOB_MASK	0x1ff0000
+#define JOB_DIE		16
+#define JOB_XMIT	17
+#define JOB_XMIT11	18
+#define JOB_STATS	19
+#define JOB_PROMISC	20
+#define JOB_MIC		21
+#define JOB_EVENT	22
+#define JOB_AUTOWEP	23
+#define JOB_WSTATS	24
+	int (*bap_read)(struct airo_info*, u16 *pu16Dst, int bytelen,
+			int whichbap);
+	unsigned short *flash;
+	tdsRssiEntry *rssi;
+	struct task_struct *task;
+	struct semaphore sem;
+	pid_t thr_pid;
+	wait_queue_head_t thr_wait;
+	struct completion thr_exited;
+	unsigned long expires;
+	struct {
+		struct sk_buff *skb;
+		int fid;
+	} xmit, xmit11;
+	struct net_device *wifidev;
+#ifdef WIRELESS_EXT
+	struct iw_statistics	wstats;		// wireless stats
+	unsigned long		scan_timestamp;	/* Time started to scan */
+	struct iw_spy_data	spy_data;
+	struct iw_public_data	wireless_data;
+#endif /* WIRELESS_EXT */
+#ifdef MICSUPPORT
+	/* MIC stuff */
+	struct crypto_tfm	*tfm;
+	mic_module		mod[2];
+	mic_statistics		micstats;
+#endif
+	HostRxDesc rxfids[MPI_MAX_FIDS]; // rx/tx/config MPI350 descriptors
+	HostTxDesc txfids[MPI_MAX_FIDS];
+	HostRidDesc config_desc;
+	unsigned long ridbus; // phys addr of config_desc
+	struct sk_buff_head txq;// tx queue used by mpi350 code
+	struct pci_dev          *pci;
+	unsigned char		__iomem *pcimem;
+	unsigned char		__iomem *pciaux;
+	unsigned char		*shared;
+	dma_addr_t		shared_dma;
+	int			power;
+	SsidRid			*SSID;
+	APListRid		*APList;
+#define	PCI_SHARED_LEN		2*MPI_MAX_FIDS*PKTSIZE+RIDSIZE
+	char			proc_name[IFNAMSIZ];
+};
+
+static inline int bap_read(struct airo_info *ai, u16 *pu16Dst, int bytelen,
+			   int whichbap) {
+	return ai->bap_read(ai, pu16Dst, bytelen, whichbap);
+}
+
+static int setup_proc_entry( struct net_device *dev,
+			     struct airo_info *apriv );
+static int takedown_proc_entry( struct net_device *dev,
+				struct airo_info *apriv );
+
+#ifdef MICSUPPORT
+/***********************************************************************
+ *                              MIC ROUTINES                           *
+ ***********************************************************************
+ */
+
+static int RxSeqValid (struct airo_info *ai,miccntx *context,int mcast,u32 micSeq);
+static void MoveWindow(miccntx *context, u32 micSeq);
+void emmh32_setseed(emmh32_context *context, u8 *pkey, int keylen, struct crypto_tfm *);
+void emmh32_init(emmh32_context *context);
+void emmh32_update(emmh32_context *context, u8 *pOctets, int len);
+void emmh32_final(emmh32_context *context, u8 digest[4]);
+
+/* micinit - Initialize mic seed */
+
+static void micinit(struct airo_info *ai)
+{
+	MICRid mic_rid;
+
+	clear_bit(JOB_MIC, &ai->flags);
+	PC4500_readrid(ai, RID_MIC, &mic_rid, sizeof(mic_rid), 0);
+	up(&ai->sem);
+
+	ai->micstats.enabled = (mic_rid.state & 0x00FF) ? 1 : 0;
+
+	if (ai->micstats.enabled) {
+		/* Key must be valid and different */
+		if (mic_rid.multicastValid && (!ai->mod[0].mCtx.valid ||
+		    (memcmp (ai->mod[0].mCtx.key, mic_rid.multicast,
+			     sizeof(ai->mod[0].mCtx.key)) != 0))) {
+			/* Age current mic Context */
+			memcpy(&ai->mod[1].mCtx,&ai->mod[0].mCtx,sizeof(miccntx));
+			/* Initialize new context */
+			memcpy(&ai->mod[0].mCtx.key,mic_rid.multicast,sizeof(mic_rid.multicast));
+			ai->mod[0].mCtx.window  = 33; //Window always points to the middle
+			ai->mod[0].mCtx.rx      = 0;  //Rx Sequence numbers
+			ai->mod[0].mCtx.tx      = 0;  //Tx sequence numbers
+			ai->mod[0].mCtx.valid   = 1;  //Key is now valid
+  
+			/* Give key to mic seed */
+			emmh32_setseed(&ai->mod[0].mCtx.seed,mic_rid.multicast,sizeof(mic_rid.multicast), ai->tfm);
+		}
+
+		/* Key must be valid and different */
+		if (mic_rid.unicastValid && (!ai->mod[0].uCtx.valid || 
+		    (memcmp(ai->mod[0].uCtx.key, mic_rid.unicast,
+			    sizeof(ai->mod[0].uCtx.key)) != 0))) {
+			/* Age current mic Context */
+			memcpy(&ai->mod[1].uCtx,&ai->mod[0].uCtx,sizeof(miccntx));
+			/* Initialize new context */
+			memcpy(&ai->mod[0].uCtx.key,mic_rid.unicast,sizeof(mic_rid.unicast));
+	
+			ai->mod[0].uCtx.window  = 33; //Window always points to the middle
+			ai->mod[0].uCtx.rx      = 0;  //Rx Sequence numbers
+			ai->mod[0].uCtx.tx      = 0;  //Tx sequence numbers
+			ai->mod[0].uCtx.valid   = 1;  //Key is now valid
+	
+			//Give key to mic seed
+			emmh32_setseed(&ai->mod[0].uCtx.seed, mic_rid.unicast, sizeof(mic_rid.unicast), ai->tfm);
+		}
+	} else {
+      /* So next time we have a valid key and mic is enabled, we will update
+       * the sequence number if the key is the same as before.
+       */
+		ai->mod[0].uCtx.valid = 0;
+		ai->mod[0].mCtx.valid = 0;
+	}
+}
+
+/* micsetup - Get ready for business */
+
+static int micsetup(struct airo_info *ai) {
+	int i;
+
+	if (ai->tfm == NULL)
+	        ai->tfm = crypto_alloc_tfm("aes", 0);
+
+        if (ai->tfm == NULL) {
+                printk(KERN_ERR "airo: failed to load transform for AES\n");
+                return ERROR;
+        }
+
+	for (i=0; i < NUM_MODULES; i++) {
+		memset(&ai->mod[i].mCtx,0,sizeof(miccntx));
+		memset(&ai->mod[i].uCtx,0,sizeof(miccntx));
+	}
+	return SUCCESS;
+}
+
+char micsnap[]= {0xAA,0xAA,0x03,0x00,0x40,0x96,0x00,0x02};
+
+/*===========================================================================
+ * Description: Mic a packet
+ *    
+ *      Inputs: etherHead * pointer to an 802.3 frame
+ *    
+ *     Returns: BOOLEAN if successful, otherwise false.
+ *             PacketTxLen will be updated with the mic'd packets size.
+ *
+ *    Caveats: It is assumed that the frame buffer will already
+ *             be big enough to hold the largets mic message possible.
+ *            (No memory allocation is done here).
+ *  
+ *    Author: sbraneky (10/15/01)
+ *    Merciless hacks by rwilcher (1/14/02)
+ */
+
+static int encapsulate(struct airo_info *ai ,etherHead *frame, MICBuffer *mic, int payLen)
+{
+	miccntx   *context;
+
+	// Determine correct context
+	// If not adhoc, always use unicast key
+
+	if (test_bit(FLAG_ADHOC, &ai->flags) && (frame->da[0] & 0x1))
+		context = &ai->mod[0].mCtx;
+	else
+		context = &ai->mod[0].uCtx;
+  
+	if (!context->valid)
+		return ERROR;
+
+	mic->typelen = htons(payLen + 16); //Length of Mic'd packet
+
+	memcpy(&mic->u.snap, micsnap, sizeof(micsnap)); // Add Snap
+
+	// Add Tx sequence
+	mic->seq = htonl(context->tx);
+	context->tx += 2;
+
+	emmh32_init(&context->seed); // Mic the packet
+	emmh32_update(&context->seed,frame->da,ETH_ALEN * 2); // DA,SA
+	emmh32_update(&context->seed,(u8*)&mic->typelen,10); // Type/Length and Snap
+	emmh32_update(&context->seed,(u8*)&mic->seq,sizeof(mic->seq)); //SEQ
+	emmh32_update(&context->seed,frame->da + ETH_ALEN * 2,payLen); //payload
+	emmh32_final(&context->seed, (u8*)&mic->mic);
+
+	/*    New Type/length ?????????? */
+	mic->typelen = 0; //Let NIC know it could be an oversized packet
+	return SUCCESS;
+}
+
+typedef enum {
+    NONE,
+    NOMIC,
+    NOMICPLUMMED,
+    SEQUENCE,
+    INCORRECTMIC,
+} mic_error;
+
+/*===========================================================================
+ *  Description: Decapsulates a MIC'd packet and returns the 802.3 packet
+ *               (removes the MIC stuff) if packet is a valid packet.
+ *      
+ *       Inputs: etherHead  pointer to the 802.3 packet             
+ *     
+ *      Returns: BOOLEAN - TRUE if packet should be dropped otherwise FALSE
+ *     
+ *      Author: sbraneky (10/15/01)
+ *    Merciless hacks by rwilcher (1/14/02)
+ *---------------------------------------------------------------------------
+ */
+
+static int decapsulate(struct airo_info *ai, MICBuffer *mic, etherHead *eth, u16 payLen)
+{
+	int      i;
+	u32      micSEQ;
+	miccntx  *context;
+	u8       digest[4];
+	mic_error micError = NONE;
+
+	// Check if the packet is a Mic'd packet
+
+	if (!ai->micstats.enabled) {
+		//No Mic set or Mic OFF but we received a MIC'd packet.
+		if (memcmp ((u8*)eth + 14, micsnap, sizeof(micsnap)) == 0) {
+			ai->micstats.rxMICPlummed++;
+			return ERROR;
+		}
+		return SUCCESS;
+	}
+
+	if (ntohs(mic->typelen) == 0x888E)
+		return SUCCESS;
+
+	if (memcmp (mic->u.snap, micsnap, sizeof(micsnap)) != 0) {
+	    // Mic enabled but packet isn't Mic'd
+		ai->micstats.rxMICPlummed++;
+	    	return ERROR;
+	}
+
+	micSEQ = ntohl(mic->seq);            //store SEQ as CPU order
+
+	//At this point we a have a mic'd packet and mic is enabled
+	//Now do the mic error checking.
+
+	//Receive seq must be odd
+	if ( (micSEQ & 1) == 0 ) {
+		ai->micstats.rxWrongSequence++;
+		return ERROR;
+	}
+
+	for (i = 0; i < NUM_MODULES; i++) {
+		int mcast = eth->da[0] & 1;
+		//Determine proper context 
+		context = mcast ? &ai->mod[i].mCtx : &ai->mod[i].uCtx;
+	
+		//Make sure context is valid
+		if (!context->valid) {
+			if (i == 0)
+				micError = NOMICPLUMMED;
+			continue;                
+		}
+	       	//DeMic it 
+
+		if (!mic->typelen)
+			mic->typelen = htons(payLen + sizeof(MICBuffer) - 2);
+	
+		emmh32_init(&context->seed);
+		emmh32_update(&context->seed, eth->da, ETH_ALEN*2); 
+		emmh32_update(&context->seed, (u8 *)&mic->typelen, sizeof(mic->typelen)+sizeof(mic->u.snap)); 
+		emmh32_update(&context->seed, (u8 *)&mic->seq,sizeof(mic->seq));	
+		emmh32_update(&context->seed, eth->da + ETH_ALEN*2,payLen);	
+		//Calculate MIC
+		emmh32_final(&context->seed, digest);
+	
+		if (memcmp(digest, &mic->mic, 4)) { //Make sure the mics match
+		  //Invalid Mic
+			if (i == 0)
+				micError = INCORRECTMIC;
+			continue;
+		}
+
+		//Check Sequence number if mics pass
+		if (RxSeqValid(ai, context, mcast, micSEQ) == SUCCESS) {
+			ai->micstats.rxSuccess++;
+			return SUCCESS;
+		}
+		if (i == 0)
+			micError = SEQUENCE;
+	}
+
+	// Update statistics
+	switch (micError) {
+		case NOMICPLUMMED: ai->micstats.rxMICPlummed++;   break;
+		case SEQUENCE:    ai->micstats.rxWrongSequence++; break;
+		case INCORRECTMIC: ai->micstats.rxIncorrectMIC++; break;
+		case NONE:  break;
+		case NOMIC: break;
+	}
+	return ERROR;
+}
+
+/*===========================================================================
+ * Description:  Checks the Rx Seq number to make sure it is valid
+ *               and hasn't already been received
+ *   
+ *     Inputs: miccntx - mic context to check seq against
+ *             micSeq  - the Mic seq number
+ *   
+ *    Returns: TRUE if valid otherwise FALSE. 
+ *
+ *    Author: sbraneky (10/15/01)
+ *    Merciless hacks by rwilcher (1/14/02)
+ *---------------------------------------------------------------------------
+ */
+
+static int RxSeqValid (struct airo_info *ai,miccntx *context,int mcast,u32 micSeq)
+{
+	u32 seq,index;
+
+	//Allow for the ap being rebooted - if it is then use the next 
+	//sequence number of the current sequence number - might go backwards
+
+	if (mcast) {
+		if (test_bit(FLAG_UPDATE_MULTI, &ai->flags)) {
+			clear_bit (FLAG_UPDATE_MULTI, &ai->flags);
+			context->window = (micSeq > 33) ? micSeq : 33;
+			context->rx     = 0;        // Reset rx
+		}
+	} else if (test_bit(FLAG_UPDATE_UNI, &ai->flags)) {
+		clear_bit (FLAG_UPDATE_UNI, &ai->flags);
+		context->window = (micSeq > 33) ? micSeq : 33; // Move window
+		context->rx     = 0;        // Reset rx
+	}
+
+	//Make sequence number relative to START of window
+	seq = micSeq - (context->window - 33);
+
+	//Too old of a SEQ number to check.
+	if ((s32)seq < 0)
+		return ERROR;
+    
+	if ( seq > 64 ) {
+		//Window is infinite forward
+		MoveWindow(context,micSeq);
+		return SUCCESS;
+	}
+
+	// We are in the window. Now check the context rx bit to see if it was already sent
+	seq >>= 1;         //divide by 2 because we only have odd numbers
+	index = 1 << seq;  //Get an index number
+
+	if (!(context->rx & index)) {
+		//micSEQ falls inside the window.
+		//Add seqence number to the list of received numbers.
+		context->rx |= index;
+
+		MoveWindow(context,micSeq);
+
+		return SUCCESS;
+	}
+	return ERROR;
+}
+
+static void MoveWindow(miccntx *context, u32 micSeq)
+{
+	u32 shift;
+
+	//Move window if seq greater than the middle of the window
+	if (micSeq > context->window) {
+		shift = (micSeq - context->window) >> 1;
+    
+		    //Shift out old
+		if (shift < 32)
+			context->rx >>= shift;
+		else
+			context->rx = 0;
+
+		context->window = micSeq;      //Move window
+	}
+}
+
+/*==============================================*/
+/*========== EMMH ROUTINES  ====================*/
+/*==============================================*/
+
+/* mic accumulate */
+#define MIC_ACCUM(val)	\
+	context->accum += (u64)(val) * context->coeff[coeff_position++];
+
+static unsigned char aes_counter[16];
+
+/* expand the key to fill the MMH coefficient array */
+void emmh32_setseed(emmh32_context *context, u8 *pkey, int keylen, struct crypto_tfm *tfm)
+{
+  /* take the keying material, expand if necessary, truncate at 16-bytes */
+  /* run through AES counter mode to generate context->coeff[] */
+  
+	int i,j;
+	u32 counter;
+	u8 *cipher, plain[16];
+	struct scatterlist sg[1];
+
+	crypto_cipher_setkey(tfm, pkey, 16);
+	counter = 0;
+	for (i = 0; i < (sizeof(context->coeff)/sizeof(context->coeff[0])); ) {
+		aes_counter[15] = (u8)(counter >> 0);
+		aes_counter[14] = (u8)(counter >> 8);
+		aes_counter[13] = (u8)(counter >> 16);
+		aes_counter[12] = (u8)(counter >> 24);
+		counter++;
+		memcpy (plain, aes_counter, 16);
+		sg[0].page = virt_to_page(plain);
+		sg[0].offset = ((long) plain & ~PAGE_MASK);
+		sg[0].length = 16;
+		crypto_cipher_encrypt(tfm, sg, sg, 16);
+		cipher = kmap(sg[0].page) + sg[0].offset;
+		for (j=0; (j<16) && (i< (sizeof(context->coeff)/sizeof(context->coeff[0]))); ) {
+			context->coeff[i++] = ntohl(*(u32 *)&cipher[j]);
+			j += 4;
+		}
+	}
+}
+
+/* prepare for calculation of a new mic */
+void emmh32_init(emmh32_context *context)
+{
+	/* prepare for new mic calculation */
+	context->accum = 0;
+	context->position = 0;
+}
+
+/* add some bytes to the mic calculation */
+void emmh32_update(emmh32_context *context, u8 *pOctets, int len)
+{
+	int	coeff_position, byte_position;
+  
+	if (len == 0) return;
+  
+	coeff_position = context->position >> 2;
+  
+	/* deal with partial 32-bit word left over from last update */
+	byte_position = context->position & 3;
+	if (byte_position) {
+		/* have a partial word in part to deal with */
+		do {
+			if (len == 0) return;
+			context->part.d8[byte_position++] = *pOctets++;
+			context->position++;
+			len--;
+		} while (byte_position < 4);
+		MIC_ACCUM(htonl(context->part.d32));
+	}
+
+	/* deal with full 32-bit words */
+	while (len >= 4) {
+		MIC_ACCUM(htonl(*(u32 *)pOctets));
+		context->position += 4;
+		pOctets += 4;
+		len -= 4;
+	}
+
+	/* deal with partial 32-bit word that will be left over from this update */
+	byte_position = 0;
+	while (len > 0) {
+		context->part.d8[byte_position++] = *pOctets++;
+		context->position++;
+		len--;
+	}
+}
+
+/* mask used to zero empty bytes for final partial word */
+static u32 mask32[4] = { 0x00000000L, 0xFF000000L, 0xFFFF0000L, 0xFFFFFF00L };
+
+/* calculate the mic */
+void emmh32_final(emmh32_context *context, u8 digest[4])
+{
+	int	coeff_position, byte_position;
+	u32	val;
+  
+	u64 sum, utmp;
+	s64 stmp;
+
+	coeff_position = context->position >> 2;
+  
+	/* deal with partial 32-bit word left over from last update */
+	byte_position = context->position & 3;
+	if (byte_position) {
+		/* have a partial word in part to deal with */
+		val = htonl(context->part.d32);
+		MIC_ACCUM(val & mask32[byte_position]);	/* zero empty bytes */
+	}
+
+	/* reduce the accumulated u64 to a 32-bit MIC */
+	sum = context->accum;
+	stmp = (sum  & 0xffffffffLL) - ((sum >> 32)  * 15);
+	utmp = (stmp & 0xffffffffLL) - ((stmp >> 32) * 15);
+	sum = utmp & 0xffffffffLL;
+	if (utmp > 0x10000000fLL)
+		sum -= 15;
+
+	val = (u32)sum;
+	digest[0] = (val>>24) & 0xFF;
+	digest[1] = (val>>16) & 0xFF;
+	digest[2] = (val>>8) & 0xFF;
+	digest[3] = val & 0xFF;
+}
+#endif
+
+static int readBSSListRid(struct airo_info *ai, int first,
+		      BSSListRid *list) {
+	int rc;
+			Cmd cmd;
+			Resp rsp;
+
+	if (first == 1) {
+			if (ai->flags & FLAG_RADIO_MASK) return -ENETDOWN;
+			memset(&cmd, 0, sizeof(cmd));
+			cmd.cmd=CMD_LISTBSS;
+			if (down_interruptible(&ai->sem))
+				return -ERESTARTSYS;
+			issuecommand(ai, &cmd, &rsp);
+			up(&ai->sem);
+			/* Let the command take effect */
+			ai->task = current;
+			ssleep(3);
+			ai->task = NULL;
+		}
+	rc = PC4500_readrid(ai, first ? RID_BSSLISTFIRST : RID_BSSLISTNEXT,
+			    list, sizeof(*list), 1);
+
+	list->len = le16_to_cpu(list->len);
+	list->index = le16_to_cpu(list->index);
+	list->radioType = le16_to_cpu(list->radioType);
+	list->cap = le16_to_cpu(list->cap);
+	list->beaconInterval = le16_to_cpu(list->beaconInterval);
+	list->fh.dwell = le16_to_cpu(list->fh.dwell);
+	list->dsChannel = le16_to_cpu(list->dsChannel);
+	list->atimWindow = le16_to_cpu(list->atimWindow);
+	return rc;
+}
+
+static int readWepKeyRid(struct airo_info*ai, WepKeyRid *wkr, int temp, int lock) {
+	int rc = PC4500_readrid(ai, temp ? RID_WEP_TEMP : RID_WEP_PERM,
+				wkr, sizeof(*wkr), lock);
+
+	wkr->len = le16_to_cpu(wkr->len);
+	wkr->kindex = le16_to_cpu(wkr->kindex);
+	wkr->klen = le16_to_cpu(wkr->klen);
+	return rc;
+}
+/* In the writeXXXRid routines we copy the rids so that we don't screwup
+ * the originals when we endian them... */
+static int writeWepKeyRid(struct airo_info*ai, WepKeyRid *pwkr, int perm, int lock) {
+	int rc;
+	WepKeyRid wkr = *pwkr;
+
+	wkr.len = cpu_to_le16(wkr.len);
+	wkr.kindex = cpu_to_le16(wkr.kindex);
+	wkr.klen = cpu_to_le16(wkr.klen);
+	rc = PC4500_writerid(ai, RID_WEP_TEMP, &wkr, sizeof(wkr), lock);
+	if (rc!=SUCCESS) printk(KERN_ERR "airo:  WEP_TEMP set %x\n", rc);
+	if (perm) {
+		rc = PC4500_writerid(ai, RID_WEP_PERM, &wkr, sizeof(wkr), lock);
+		if (rc!=SUCCESS) {
+			printk(KERN_ERR "airo:  WEP_PERM set %x\n", rc);
+		}
+	}
+	return rc;
+}
+
+static int readSsidRid(struct airo_info*ai, SsidRid *ssidr) {
+	int i;
+	int rc = PC4500_readrid(ai, RID_SSID, ssidr, sizeof(*ssidr), 1);
+
+	ssidr->len = le16_to_cpu(ssidr->len);
+	for(i = 0; i < 3; i++) {
+		ssidr->ssids[i].len = le16_to_cpu(ssidr->ssids[i].len);
+	}
+	return rc;
+}
+static int writeSsidRid(struct airo_info*ai, SsidRid *pssidr, int lock) {
+	int rc;
+	int i;
+	SsidRid ssidr = *pssidr;
+
+	ssidr.len = cpu_to_le16(ssidr.len);
+	for(i = 0; i < 3; i++) {
+		ssidr.ssids[i].len = cpu_to_le16(ssidr.ssids[i].len);
+	}
+	rc = PC4500_writerid(ai, RID_SSID, &ssidr, sizeof(ssidr), lock);
+	return rc;
+}
+static int readConfigRid(struct airo_info*ai, int lock) {
+	int rc;
+	u16 *s;
+	ConfigRid cfg;
+
+	if (ai->config.len)
+		return SUCCESS;
+
+	rc = PC4500_readrid(ai, RID_ACTUALCONFIG, &cfg, sizeof(cfg), lock);
+	if (rc != SUCCESS)
+		return rc;
+
+	for(s = &cfg.len; s <= &cfg.rtsThres; s++) *s = le16_to_cpu(*s);
+
+	for(s = &cfg.shortRetryLimit; s <= &cfg.radioType; s++)
+		*s = le16_to_cpu(*s);
+
+	for(s = &cfg.txPower; s <= &cfg.radioSpecific; s++)
+		*s = le16_to_cpu(*s);
+
+	for(s = &cfg.arlThreshold; s <= &cfg._reserved4[0]; s++)
+		*s = cpu_to_le16(*s);
+
+	for(s = &cfg.autoWake; s <= &cfg.autoWake; s++)
+		*s = cpu_to_le16(*s);
+
+	ai->config = cfg;
+	return SUCCESS;
+}
+static inline void checkThrottle(struct airo_info *ai) {
+	int i;
+/* Old hardware had a limit on encryption speed */
+	if (ai->config.authType != AUTH_OPEN && maxencrypt) {
+		for(i=0; i<8; i++) {
+			if (ai->config.rates[i] > maxencrypt) {
+				ai->config.rates[i] = 0;
+			}
+		}
+	}
+}
+static int writeConfigRid(struct airo_info*ai, int lock) {
+	u16 *s;
+	ConfigRid cfgr;
+
+	if (!test_bit (FLAG_COMMIT, &ai->flags))
+		return SUCCESS;
+
+	clear_bit (FLAG_COMMIT, &ai->flags);
+	clear_bit (FLAG_RESET, &ai->flags);
+	checkThrottle(ai);
+	cfgr = ai->config;
+
+	if ((cfgr.opmode & 0xFF) == MODE_STA_IBSS)
+		set_bit(FLAG_ADHOC, &ai->flags);
+	else
+		clear_bit(FLAG_ADHOC, &ai->flags);
+
+	for(s = &cfgr.len; s <= &cfgr.rtsThres; s++) *s = cpu_to_le16(*s);
+
+	for(s = &cfgr.shortRetryLimit; s <= &cfgr.radioType; s++)
+		*s = cpu_to_le16(*s);
+
+	for(s = &cfgr.txPower; s <= &cfgr.radioSpecific; s++)
+		*s = cpu_to_le16(*s);
+
+	for(s = &cfgr.arlThreshold; s <= &cfgr._reserved4[0]; s++)
+		*s = cpu_to_le16(*s);
+
+	for(s = &cfgr.autoWake; s <= &cfgr.autoWake; s++)
+		*s = cpu_to_le16(*s);
+
+	return PC4500_writerid( ai, RID_CONFIG, &cfgr, sizeof(cfgr), lock);
+}
+static int readStatusRid(struct airo_info*ai, StatusRid *statr, int lock) {
+	int rc = PC4500_readrid(ai, RID_STATUS, statr, sizeof(*statr), lock);
+	u16 *s;
+
+	statr->len = le16_to_cpu(statr->len);
+	for(s = &statr->mode; s <= &statr->SSIDlen; s++) *s = le16_to_cpu(*s);
+
+	for(s = &statr->beaconPeriod; s <= &statr->shortPreamble; s++)
+		*s = le16_to_cpu(*s);
+	statr->load = le16_to_cpu(statr->load);
+	statr->assocStatus = le16_to_cpu(statr->assocStatus);
+	return rc;
+}
+static int readAPListRid(struct airo_info*ai, APListRid *aplr) {
+	int rc =  PC4500_readrid(ai, RID_APLIST, aplr, sizeof(*aplr), 1);
+	aplr->len = le16_to_cpu(aplr->len);
+	return rc;
+}
+static int writeAPListRid(struct airo_info*ai, APListRid *aplr, int lock) {
+	int rc;
+	aplr->len = cpu_to_le16(aplr->len);
+	rc = PC4500_writerid(ai, RID_APLIST, aplr, sizeof(*aplr), lock);
+	return rc;
+}
+static int readCapabilityRid(struct airo_info*ai, CapabilityRid *capr, int lock) {
+	int rc = PC4500_readrid(ai, RID_CAPABILITIES, capr, sizeof(*capr), lock);
+	u16 *s;
+
+	capr->len = le16_to_cpu(capr->len);
+	capr->prodNum = le16_to_cpu(capr->prodNum);
+	capr->radioType = le16_to_cpu(capr->radioType);
+	capr->country = le16_to_cpu(capr->country);
+	for(s = &capr->txPowerLevels[0]; s <= &capr->requiredHard; s++)
+		*s = le16_to_cpu(*s);
+	return rc;
+}
+static int readStatsRid(struct airo_info*ai, StatsRid *sr, int rid, int lock) {
+	int rc = PC4500_readrid(ai, rid, sr, sizeof(*sr), lock);
+	u32 *i;
+
+	sr->len = le16_to_cpu(sr->len);
+	for(i = &sr->vals[0]; i <= &sr->vals[99]; i++) *i = le32_to_cpu(*i);
+	return rc;
+}
+
+static int airo_open(struct net_device *dev) {
+	struct airo_info *info = dev->priv;
+	Resp rsp;
+
+	if (test_bit(FLAG_FLASHING, &info->flags))
+		return -EIO;
+
+	/* Make sure the card is configured.
+	 * Wireless Extensions may postpone config changes until the card
+	 * is open (to pipeline changes and speed-up card setup). If
+	 * those changes are not yet commited, do it now - Jean II */
+	if (test_bit (FLAG_COMMIT, &info->flags)) {
+		disable_MAC(info, 1);
+		writeConfigRid(info, 1);
+	}
+
+	if (info->wifidev != dev) {
+		/* Power on the MAC controller (which may have been disabled) */
+		clear_bit(FLAG_RADIO_DOWN, &info->flags);
+		enable_interrupts(info);
+	}
+	enable_MAC(info, &rsp, 1);
+
+	netif_start_queue(dev);
+	return 0;
+}
+
+static int mpi_start_xmit(struct sk_buff *skb, struct net_device *dev) {
+	int npacks, pending;
+	unsigned long flags;
+	struct airo_info *ai = dev->priv;
+
+	if (!skb) {
+		printk(KERN_ERR "airo: %s: skb==NULL\n",__FUNCTION__);
+		return 0;
+	}
+	npacks = skb_queue_len (&ai->txq);
+
+	if (npacks >= MAXTXQ - 1) {
+		netif_stop_queue (dev);
+		if (npacks > MAXTXQ) {
+			ai->stats.tx_fifo_errors++;
+			return 1;
+		}
+		skb_queue_tail (&ai->txq, skb);
+		return 0;
+	}
+
+	spin_lock_irqsave(&ai->aux_lock, flags);
+	skb_queue_tail (&ai->txq, skb);
+	pending = test_bit(FLAG_PENDING_XMIT, &ai->flags);
+	spin_unlock_irqrestore(&ai->aux_lock,flags);
+	netif_wake_queue (dev);
+
+	if (pending == 0) {
+		set_bit(FLAG_PENDING_XMIT, &ai->flags);
+		mpi_send_packet (dev);
+	}
+	return 0;
+}
+
+/*
+ * @mpi_send_packet
+ *
+ * Attempt to transmit a packet. Can be called from interrupt
+ * or transmit . return number of packets we tried to send
+ */
+
+static int mpi_send_packet (struct net_device *dev)
+{
+	struct sk_buff *skb;
+	unsigned char *buffer;
+	s16 len, *payloadLen;
+	struct airo_info *ai = dev->priv;
+	u8 *sendbuf;
+
+	/* get a packet to send */
+
+	if ((skb = skb_dequeue(&ai->txq)) == 0) {
+		printk (KERN_ERR
+			"airo: %s: Dequeue'd zero in send_packet()\n",
+			__FUNCTION__);
+		return 0;
+	}
+
+	/* check min length*/
+	len = ETH_ZLEN < skb->len ? skb->len : ETH_ZLEN;
+	buffer = skb->data;
+
+	ai->txfids[0].tx_desc.offset = 0;
+	ai->txfids[0].tx_desc.valid = 1;
+	ai->txfids[0].tx_desc.eoc = 1;
+	ai->txfids[0].tx_desc.len =len+sizeof(WifiHdr);
+
+/*
+ * Magic, the cards firmware needs a length count (2 bytes) in the host buffer
+ * right after  TXFID_HDR.The TXFID_HDR contains the status short so payloadlen
+ * is immediatly after it. ------------------------------------------------
+ *                         |TXFIDHDR+STATUS|PAYLOADLEN|802.3HDR|PACKETDATA|
+ *                         ------------------------------------------------
+ */
+
+	memcpy((char *)ai->txfids[0].virtual_host_addr,
+		(char *)&wifictlhdr8023, sizeof(wifictlhdr8023));
+
+	payloadLen = (s16 *)(ai->txfids[0].virtual_host_addr +
+		sizeof(wifictlhdr8023));
+	sendbuf = ai->txfids[0].virtual_host_addr +
+		sizeof(wifictlhdr8023) + 2 ;
+
+	/*
+	 * Firmware automaticly puts 802 header on so
+	 * we don't need to account for it in the length
+	 */
+#ifdef MICSUPPORT
+	if (test_bit(FLAG_MIC_CAPABLE, &ai->flags) && ai->micstats.enabled &&
+		(ntohs(((u16 *)buffer)[6]) != 0x888E)) {
+		MICBuffer pMic;
+
+		if (encapsulate(ai, (etherHead *)buffer, &pMic, len - sizeof(etherHead)) != SUCCESS)
+			return ERROR;
+
+		*payloadLen = cpu_to_le16(len-sizeof(etherHead)+sizeof(pMic));
+		ai->txfids[0].tx_desc.len += sizeof(pMic);
+		/* copy data into airo dma buffer */
+		memcpy (sendbuf, buffer, sizeof(etherHead));
+		buffer += sizeof(etherHead);
+		sendbuf += sizeof(etherHead);
+		memcpy (sendbuf, &pMic, sizeof(pMic));
+		sendbuf += sizeof(pMic);
+		memcpy (sendbuf, buffer, len - sizeof(etherHead));
+	} else
+#endif
+	{
+		*payloadLen = cpu_to_le16(len - sizeof(etherHead));
+
+		dev->trans_start = jiffies;
+
+		/* copy data into airo dma buffer */
+		memcpy(sendbuf, buffer, len);
+	}
+
+	memcpy_toio(ai->txfids[0].card_ram_off,
+		&ai->txfids[0].tx_desc, sizeof(TxFid));
+
+	OUT4500(ai, EVACK, 8);
+
+	dev_kfree_skb_any(skb);
+	return 1;
+}
+
+static void get_tx_error(struct airo_info *ai, u32 fid)
+{
+	u16 status;
+
+	if (fid < 0)
+		status = ((WifiCtlHdr *)ai->txfids[0].virtual_host_addr)->ctlhdr.status;
+	else {
+		if (bap_setup(ai, ai->fids[fid] & 0xffff, 4, BAP0) != SUCCESS)
+			return;
+		bap_read(ai, &status, 2, BAP0);
+	}
+	if (le16_to_cpu(status) & 2) /* Too many retries */
+		ai->stats.tx_aborted_errors++;
+	if (le16_to_cpu(status) & 4) /* Transmit lifetime exceeded */
+		ai->stats.tx_heartbeat_errors++;
+	if (le16_to_cpu(status) & 8) /* Aid fail */
+		{ }
+	if (le16_to_cpu(status) & 0x10) /* MAC disabled */
+		ai->stats.tx_carrier_errors++;
+	if (le16_to_cpu(status) & 0x20) /* Association lost */
+		{ }
+	/* We produce a TXDROP event only for retry or lifetime
+	 * exceeded, because that's the only status that really mean
+	 * that this particular node went away.
+	 * Other errors means that *we* screwed up. - Jean II */
+	if ((le16_to_cpu(status) & 2) ||
+	     (le16_to_cpu(status) & 4)) {
+		union iwreq_data	wrqu;
+		char junk[0x18];
+
+		/* Faster to skip over useless data than to do
+		 * another bap_setup(). We are at offset 0x6 and
+		 * need to go to 0x18 and read 6 bytes - Jean II */
+		bap_read(ai, (u16 *) junk, 0x18, BAP0);
+
+		/* Copy 802.11 dest address.
+		 * We use the 802.11 header because the frame may
+		 * not be 802.3 or may be mangled...
+		 * In Ad-Hoc mode, it will be the node address.
+		 * In managed mode, it will be most likely the AP addr
+		 * User space will figure out how to convert it to
+		 * whatever it needs (IP address or else).
+		 * - Jean II */
+		memcpy(wrqu.addr.sa_data, junk + 0x12, ETH_ALEN);
+		wrqu.addr.sa_family = ARPHRD_ETHER;
+
+		/* Send event to user space */
+		wireless_send_event(ai->dev, IWEVTXDROP, &wrqu, NULL);
+	}
+}
+
+static void airo_end_xmit(struct net_device *dev) {
+	u16 status;
+	int i;
+	struct airo_info *priv = dev->priv;
+	struct sk_buff *skb = priv->xmit.skb;
+	int fid = priv->xmit.fid;
+	u32 *fids = priv->fids;
+
+	clear_bit(JOB_XMIT, &priv->flags);
+	clear_bit(FLAG_PENDING_XMIT, &priv->flags);
+	status = transmit_802_3_packet (priv, fids[fid], skb->data);
+	up(&priv->sem);
+
+	i = 0;
+	if ( status == SUCCESS ) {
+		dev->trans_start = jiffies;
+		for (; i < MAX_FIDS / 2 && (priv->fids[i] & 0xffff0000); i++);
+	} else {
+		priv->fids[fid] &= 0xffff;
+		priv->stats.tx_window_errors++;
+	}
+	if (i < MAX_FIDS / 2)
+		netif_wake_queue(dev);
+	dev_kfree_skb(skb);
+}
+
+static int airo_start_xmit(struct sk_buff *skb, struct net_device *dev) {
+	s16 len;
+	int i, j;
+	struct airo_info *priv = dev->priv;
+	u32 *fids = priv->fids;
+
+	if ( skb == NULL ) {
+		printk( KERN_ERR "airo:  skb == NULL!!!\n" );
+		return 0;
+	}
+
+	/* Find a vacant FID */
+	for( i = 0; i < MAX_FIDS / 2 && (fids[i] & 0xffff0000); i++ );
+	for( j = i + 1; j < MAX_FIDS / 2 && (fids[j] & 0xffff0000); j++ );
+
+	if ( j >= MAX_FIDS / 2 ) {
+		netif_stop_queue(dev);
+
+		if (i == MAX_FIDS / 2) {
+			priv->stats.tx_fifo_errors++;
+			return 1;
+		}
+	}
+	/* check min length*/
+	len = ETH_ZLEN < skb->len ? skb->len : ETH_ZLEN;
+        /* Mark fid as used & save length for later */
+	fids[i] |= (len << 16);
+	priv->xmit.skb = skb;
+	priv->xmit.fid = i;
+	if (down_trylock(&priv->sem) != 0) {
+		set_bit(FLAG_PENDING_XMIT, &priv->flags);
+		netif_stop_queue(dev);
+		set_bit(JOB_XMIT, &priv->flags);
+		wake_up_interruptible(&priv->thr_wait);
+	} else
+		airo_end_xmit(dev);
+	return 0;
+}
+
+static void airo_end_xmit11(struct net_device *dev) {
+	u16 status;
+	int i;
+	struct airo_info *priv = dev->priv;
+	struct sk_buff *skb = priv->xmit11.skb;
+	int fid = priv->xmit11.fid;
+	u32 *fids = priv->fids;
+
+	clear_bit(JOB_XMIT11, &priv->flags);
+	clear_bit(FLAG_PENDING_XMIT11, &priv->flags);
+	status = transmit_802_11_packet (priv, fids[fid], skb->data);
+	up(&priv->sem);
+
+	i = MAX_FIDS / 2;
+	if ( status == SUCCESS ) {
+		dev->trans_start = jiffies;
+		for (; i < MAX_FIDS && (priv->fids[i] & 0xffff0000); i++);
+	} else {
+		priv->fids[fid] &= 0xffff;
+		priv->stats.tx_window_errors++;
+	}
+	if (i < MAX_FIDS)
+		netif_wake_queue(dev);
+	dev_kfree_skb(skb);
+}
+
+static int airo_start_xmit11(struct sk_buff *skb, struct net_device *dev) {
+	s16 len;
+	int i, j;
+	struct airo_info *priv = dev->priv;
+	u32 *fids = priv->fids;
+
+	if (test_bit(FLAG_MPI, &priv->flags)) {
+		/* Not implemented yet for MPI350 */
+		netif_stop_queue(dev);
+		return -ENETDOWN;
+	}
+
+	if ( skb == NULL ) {
+		printk( KERN_ERR "airo:  skb == NULL!!!\n" );
+		return 0;
+	}
+
+	/* Find a vacant FID */
+	for( i = MAX_FIDS / 2; i < MAX_FIDS && (fids[i] & 0xffff0000); i++ );
+	for( j = i + 1; j < MAX_FIDS && (fids[j] & 0xffff0000); j++ );
+
+	if ( j >= MAX_FIDS ) {
+		netif_stop_queue(dev);
+
+		if (i == MAX_FIDS) {
+			priv->stats.tx_fifo_errors++;
+			return 1;
+		}
+	}
+	/* check min length*/
+	len = ETH_ZLEN < skb->len ? skb->len : ETH_ZLEN;
+        /* Mark fid as used & save length for later */
+	fids[i] |= (len << 16);
+	priv->xmit11.skb = skb;
+	priv->xmit11.fid = i;
+	if (down_trylock(&priv->sem) != 0) {
+		set_bit(FLAG_PENDING_XMIT11, &priv->flags);
+		netif_stop_queue(dev);
+		set_bit(JOB_XMIT11, &priv->flags);
+		wake_up_interruptible(&priv->thr_wait);
+	} else
+		airo_end_xmit11(dev);
+	return 0;
+}
+
+static void airo_read_stats(struct airo_info *ai) {
+	StatsRid stats_rid;
+	u32 *vals = stats_rid.vals;
+
+	clear_bit(JOB_STATS, &ai->flags);
+	if (ai->power) {
+		up(&ai->sem);
+		return;
+	}
+	readStatsRid(ai, &stats_rid, RID_STATS, 0);
+	up(&ai->sem);
+
+	ai->stats.rx_packets = vals[43] + vals[44] + vals[45];
+	ai->stats.tx_packets = vals[39] + vals[40] + vals[41];
+	ai->stats.rx_bytes = vals[92];
+	ai->stats.tx_bytes = vals[91];
+	ai->stats.rx_errors = vals[0] + vals[2] + vals[3] + vals[4];
+	ai->stats.tx_errors = vals[42] + ai->stats.tx_fifo_errors;
+	ai->stats.multicast = vals[43];
+	ai->stats.collisions = vals[89];
+
+	/* detailed rx_errors: */
+	ai->stats.rx_length_errors = vals[3];
+	ai->stats.rx_crc_errors = vals[4];
+	ai->stats.rx_frame_errors = vals[2];
+	ai->stats.rx_fifo_errors = vals[0];
+}
+
+struct net_device_stats *airo_get_stats(struct net_device *dev)
+{
+	struct airo_info *local =  dev->priv;
+
+	if (!test_bit(JOB_STATS, &local->flags)) {
+		/* Get stats out of the card if available */
+		if (down_trylock(&local->sem) != 0) {
+			set_bit(JOB_STATS, &local->flags);
+			wake_up_interruptible(&local->thr_wait);
+		} else
+			airo_read_stats(local);
+	}
+
+	return &local->stats;
+}
+
+static void airo_set_promisc(struct airo_info *ai) {
+	Cmd cmd;
+	Resp rsp;
+
+	memset(&cmd, 0, sizeof(cmd));
+	cmd.cmd=CMD_SETMODE;
+	clear_bit(JOB_PROMISC, &ai->flags);
+	cmd.parm0=(ai->flags&IFF_PROMISC) ? PROMISC : NOPROMISC;
+	issuecommand(ai, &cmd, &rsp);
+	up(&ai->sem);
+}
+
+static void airo_set_multicast_list(struct net_device *dev) {
+	struct airo_info *ai = dev->priv;
+
+	if ((dev->flags ^ ai->flags) & IFF_PROMISC) {
+		change_bit(FLAG_PROMISC, &ai->flags);
+		if (down_trylock(&ai->sem) != 0) {
+			set_bit(JOB_PROMISC, &ai->flags);
+			wake_up_interruptible(&ai->thr_wait);
+		} else
+			airo_set_promisc(ai);
+	}
+
+	if ((dev->flags&IFF_ALLMULTI)||dev->mc_count>0) {
+		/* Turn on multicast.  (Should be already setup...) */
+	}
+}
+
+static int airo_set_mac_address(struct net_device *dev, void *p)
+{
+	struct airo_info *ai = dev->priv;
+	struct sockaddr *addr = p;
+	Resp rsp;
+
+	readConfigRid(ai, 1);
+	memcpy (ai->config.macAddr, addr->sa_data, dev->addr_len);
+	set_bit (FLAG_COMMIT, &ai->flags);
+	disable_MAC(ai, 1);
+	writeConfigRid (ai, 1);
+	enable_MAC(ai, &rsp, 1);
+	memcpy (ai->dev->dev_addr, addr->sa_data, dev->addr_len);
+	if (ai->wifidev)
+		memcpy (ai->wifidev->dev_addr, addr->sa_data, dev->addr_len);
+	return 0;
+}
+
+static int airo_change_mtu(struct net_device *dev, int new_mtu)
+{
+	if ((new_mtu < 68) || (new_mtu > 2400))
+		return -EINVAL;
+	dev->mtu = new_mtu;
+	return 0;
+}
+
+
+static int airo_close(struct net_device *dev) {
+	struct airo_info *ai = dev->priv;
+
+	netif_stop_queue(dev);
+
+	if (ai->wifidev != dev) {
+#ifdef POWER_ON_DOWN
+		/* Shut power to the card. The idea is that the user can save
+		 * power when he doesn't need the card with "ifconfig down".
+		 * That's the method that is most friendly towards the network
+		 * stack (i.e. the network stack won't try to broadcast
+		 * anything on the interface and routes are gone. Jean II */
+		set_bit(FLAG_RADIO_DOWN, &ai->flags);
+		disable_MAC(ai, 1);
+#endif
+		disable_interrupts( ai );
+	}
+	return 0;
+}
+
+static void del_airo_dev( struct net_device *dev );
+
+void stop_airo_card( struct net_device *dev, int freeres )
+{
+	struct airo_info *ai = dev->priv;
+
+	set_bit(FLAG_RADIO_DOWN, &ai->flags);
+	disable_MAC(ai, 1);
+	disable_interrupts(ai);
+	free_irq( dev->irq, dev );
+	takedown_proc_entry( dev, ai );
+	if (test_bit(FLAG_REGISTERED, &ai->flags)) {
+		unregister_netdev( dev );
+		if (ai->wifidev) {
+			unregister_netdev(ai->wifidev);
+			free_netdev(ai->wifidev);
+			ai->wifidev = NULL;
+		}
+		clear_bit(FLAG_REGISTERED, &ai->flags);
+	}
+	set_bit(JOB_DIE, &ai->flags);
+	kill_proc(ai->thr_pid, SIGTERM, 1);
+	wait_for_completion(&ai->thr_exited);
+
+	/*
+	 * Clean out tx queue
+	 */
+	if (test_bit(FLAG_MPI, &ai->flags) && skb_queue_len (&ai->txq) > 0) {
+		struct sk_buff *skb = NULL;
+		for (;(skb = skb_dequeue(&ai->txq));)
+			dev_kfree_skb(skb);
+	}
+
+	if (ai->flash)
+		kfree(ai->flash);
+	if (ai->rssi)
+		kfree(ai->rssi);
+	if (ai->APList)
+		kfree(ai->APList);
+	if (ai->SSID)
+		kfree(ai->SSID);
+	if (freeres) {
+		/* PCMCIA frees this stuff, so only for PCI and ISA */
+	        release_region( dev->base_addr, 64 );
+		if (test_bit(FLAG_MPI, &ai->flags)) {
+			if (ai->pci)
+				mpi_unmap_card(ai->pci);
+			if (ai->pcimem)
+				iounmap(ai->pcimem);
+			if (ai->pciaux)
+				iounmap(ai->pciaux);
+			pci_free_consistent(ai->pci, PCI_SHARED_LEN,
+				ai->shared, ai->shared_dma);
+		}
+        }
+#ifdef MICSUPPORT
+	if (ai->tfm)
+		crypto_free_tfm(ai->tfm);
+#endif
+	del_airo_dev( dev );
+	free_netdev( dev );
+}
+
+EXPORT_SYMBOL(stop_airo_card);
+
+static int add_airo_dev( struct net_device *dev );
+
+int wll_header_parse(struct sk_buff *skb, unsigned char *haddr)
+{
+	memcpy(haddr, skb->mac.raw + 10, ETH_ALEN);
+	return ETH_ALEN;
+}
+
+static void mpi_unmap_card(struct pci_dev *pci)
+{
+	unsigned long mem_start = pci_resource_start(pci, 1);
+	unsigned long mem_len = pci_resource_len(pci, 1);
+	unsigned long aux_start = pci_resource_start(pci, 2);
+	unsigned long aux_len = AUXMEMSIZE;
+
+	release_mem_region(aux_start, aux_len);
+	release_mem_region(mem_start, mem_len);
+}
+
+/*************************************************************
+ *  This routine assumes that descriptors have been setup .
+ *  Run at insmod time or after reset  when the decriptors
+ *  have been initialized . Returns 0 if all is well nz
+ *  otherwise . Does not allocate memory but sets up card
+ *  using previously allocated descriptors.
+ */
+static int mpi_init_descriptors (struct airo_info *ai)
+{
+	Cmd cmd;
+	Resp rsp;
+	int i;
+	int rc = SUCCESS;
+
+	/* Alloc  card RX descriptors */
+	netif_stop_queue(ai->dev);
+
+	memset(&rsp,0,sizeof(rsp));
+	memset(&cmd,0,sizeof(cmd));
+
+	cmd.cmd = CMD_ALLOCATEAUX;
+	cmd.parm0 = FID_RX;
+	cmd.parm1 = (ai->rxfids[0].card_ram_off - ai->pciaux);
+	cmd.parm2 = MPI_MAX_FIDS;
+	rc=issuecommand(ai, &cmd, &rsp);
+	if (rc != SUCCESS) {
+		printk(KERN_ERR "airo:  Couldn't allocate RX FID\n");
+		return rc;
+	}
+
+	for (i=0; i<MPI_MAX_FIDS; i++) {
+		memcpy_toio(ai->rxfids[i].card_ram_off,
+			&ai->rxfids[i].rx_desc, sizeof(RxFid));
+	}
+
+	/* Alloc card TX descriptors */
+
+	memset(&rsp,0,sizeof(rsp));
+	memset(&cmd,0,sizeof(cmd));
+
+	cmd.cmd = CMD_ALLOCATEAUX;
+	cmd.parm0 = FID_TX;
+	cmd.parm1 = (ai->txfids[0].card_ram_off - ai->pciaux);
+	cmd.parm2 = MPI_MAX_FIDS;
+
+	for (i=0; i<MPI_MAX_FIDS; i++) {
+		ai->txfids[i].tx_desc.valid = 1;
+		memcpy_toio(ai->txfids[i].card_ram_off,
+			&ai->txfids[i].tx_desc, sizeof(TxFid));
+	}
+	ai->txfids[i-1].tx_desc.eoc = 1; /* Last descriptor has EOC set */
+
+	rc=issuecommand(ai, &cmd, &rsp);
+	if (rc != SUCCESS) {
+		printk(KERN_ERR "airo:  Couldn't allocate TX FID\n");
+		return rc;
+	}
+
+	/* Alloc card Rid descriptor */
+	memset(&rsp,0,sizeof(rsp));
+	memset(&cmd,0,sizeof(cmd));
+
+	cmd.cmd = CMD_ALLOCATEAUX;
+	cmd.parm0 = RID_RW;
+	cmd.parm1 = (ai->config_desc.card_ram_off - ai->pciaux);
+	cmd.parm2 = 1; /* Magic number... */
+	rc=issuecommand(ai, &cmd, &rsp);
+	if (rc != SUCCESS) {
+		printk(KERN_ERR "airo:  Couldn't allocate RID\n");
+		return rc;
+	}
+
+	memcpy_toio(ai->config_desc.card_ram_off,
+		&ai->config_desc.rid_desc, sizeof(Rid));
+
+	return rc;
+}
+
+/*
+ * We are setting up three things here:
+ * 1) Map AUX memory for descriptors: Rid, TxFid, or RxFid.
+ * 2) Map PCI memory for issueing commands.
+ * 3) Allocate memory (shared) to send and receive ethernet frames.
+ */
+static int mpi_map_card(struct airo_info *ai, struct pci_dev *pci,
+		    const char *name)
+{
+	unsigned long mem_start, mem_len, aux_start, aux_len;
+	int rc = -1;
+	int i;
+	unsigned char *busaddroff,*vpackoff;
+	unsigned char __iomem *pciaddroff;
+
+	mem_start = pci_resource_start(pci, 1);
+	mem_len = pci_resource_len(pci, 1);
+	aux_start = pci_resource_start(pci, 2);
+	aux_len = AUXMEMSIZE;
+
+	if (!request_mem_region(mem_start, mem_len, name)) {
+		printk(KERN_ERR "airo: Couldn't get region %x[%x] for %s\n",
+		       (int)mem_start, (int)mem_len, name);
+		goto out;
+	}
+	if (!request_mem_region(aux_start, aux_len, name)) {
+		printk(KERN_ERR "airo: Couldn't get region %x[%x] for %s\n",
+		       (int)aux_start, (int)aux_len, name);
+		goto free_region1;
+	}
+
+	ai->pcimem = ioremap(mem_start, mem_len);
+	if (!ai->pcimem) {
+		printk(KERN_ERR "airo: Couldn't map region %x[%x] for %s\n",
+		       (int)mem_start, (int)mem_len, name);
+		goto free_region2;
+	}
+	ai->pciaux = ioremap(aux_start, aux_len);
+	if (!ai->pciaux) {
+		printk(KERN_ERR "airo: Couldn't map region %x[%x] for %s\n",
+		       (int)aux_start, (int)aux_len, name);
+		goto free_memmap;
+	}
+
+	/* Reserve PKTSIZE for each fid and 2K for the Rids */
+	ai->shared = pci_alloc_consistent(pci, PCI_SHARED_LEN, &ai->shared_dma);
+	if (!ai->shared) {
+		printk(KERN_ERR "airo: Couldn't alloc_consistent %d\n",
+		       PCI_SHARED_LEN);
+		goto free_auxmap;
+	}
+
+	/*
+	 * Setup descriptor RX, TX, CONFIG
+	 */
+	busaddroff = (unsigned char *)ai->shared_dma;
+	pciaddroff = ai->pciaux + AUX_OFFSET;
+	vpackoff   = ai->shared;
+
+	/* RX descriptor setup */
+	for(i = 0; i < MPI_MAX_FIDS; i++) {
+		ai->rxfids[i].pending = 0;
+		ai->rxfids[i].card_ram_off = pciaddroff;
+		ai->rxfids[i].virtual_host_addr = vpackoff;
+		ai->rxfids[i].rx_desc.host_addr = (dma_addr_t) busaddroff;
+		ai->rxfids[i].rx_desc.valid = 1;
+		ai->rxfids[i].rx_desc.len = PKTSIZE;
+		ai->rxfids[i].rx_desc.rdy = 0;
+
+		pciaddroff += sizeof(RxFid);
+		busaddroff += PKTSIZE;
+		vpackoff   += PKTSIZE;
+	}
+
+	/* TX descriptor setup */
+	for(i = 0; i < MPI_MAX_FIDS; i++) {
+		ai->txfids[i].card_ram_off = pciaddroff;
+		ai->txfids[i].virtual_host_addr = vpackoff;
+		ai->txfids[i].tx_desc.valid = 1;
+		ai->txfids[i].tx_desc.host_addr = (dma_addr_t) busaddroff;
+		memcpy(ai->txfids[i].virtual_host_addr,
+			&wifictlhdr8023, sizeof(wifictlhdr8023));
+
+		pciaddroff += sizeof(TxFid);
+		busaddroff += PKTSIZE;
+		vpackoff   += PKTSIZE;
+	}
+	ai->txfids[i-1].tx_desc.eoc = 1; /* Last descriptor has EOC set */
+
+	/* Rid descriptor setup */
+	ai->config_desc.card_ram_off = pciaddroff;
+	ai->config_desc.virtual_host_addr = vpackoff;
+	ai->config_desc.rid_desc.host_addr = (dma_addr_t) busaddroff;
+	ai->ridbus = (dma_addr_t)busaddroff;
+	ai->config_desc.rid_desc.rid = 0;
+	ai->config_desc.rid_desc.len = RIDSIZE;
+	ai->config_desc.rid_desc.valid = 1;
+	pciaddroff += sizeof(Rid);
+	busaddroff += RIDSIZE;
+	vpackoff   += RIDSIZE;
+
+	/* Tell card about descriptors */
+	if (mpi_init_descriptors (ai) != SUCCESS)
+		goto free_shared;
+
+	return 0;
+ free_shared:
+	pci_free_consistent(pci, PCI_SHARED_LEN, ai->shared, ai->shared_dma);
+ free_auxmap:
+	iounmap(ai->pciaux);
+ free_memmap:
+	iounmap(ai->pcimem);
+ free_region2:
+	release_mem_region(aux_start, aux_len);
+ free_region1:
+	release_mem_region(mem_start, mem_len);
+ out:
+	return rc;
+}
+
+static void wifi_setup(struct net_device *dev)
+{
+	dev->hard_header        = NULL;
+	dev->rebuild_header     = NULL;
+	dev->hard_header_cache  = NULL;
+	dev->header_cache_update= NULL;
+
+	dev->hard_header_parse  = wll_header_parse;
+	dev->hard_start_xmit = &airo_start_xmit11;
+	dev->get_stats = &airo_get_stats;
+	dev->set_mac_address = &airo_set_mac_address;
+	dev->do_ioctl = &airo_ioctl;
+#ifdef WIRELESS_EXT
+	dev->wireless_handlers = &airo_handler_def;
+#endif /* WIRELESS_EXT */
+	dev->change_mtu = &airo_change_mtu;
+	dev->open = &airo_open;
+	dev->stop = &airo_close;
+
+	dev->type               = ARPHRD_IEEE80211;
+	dev->hard_header_len    = ETH_HLEN;
+	dev->mtu                = 2312;
+	dev->addr_len           = ETH_ALEN;
+	dev->tx_queue_len       = 100; 
+
+	memset(dev->broadcast,0xFF, ETH_ALEN);
+
+	dev->flags              = IFF_BROADCAST|IFF_MULTICAST;
+}
+
+static struct net_device *init_wifidev(struct airo_info *ai,
+					struct net_device *ethdev)
+{
+	int err;
+	struct net_device *dev = alloc_netdev(0, "wifi%d", wifi_setup);
+	if (!dev)
+		return NULL;
+	dev->priv = ethdev->priv;
+	dev->irq = ethdev->irq;
+	dev->base_addr = ethdev->base_addr;
+#ifdef WIRELESS_EXT
+	dev->wireless_data = ethdev->wireless_data;
+#endif /* WIRELESS_EXT */
+	memcpy(dev->dev_addr, ethdev->dev_addr, dev->addr_len);
+	err = register_netdev(dev);
+	if (err<0) {
+		free_netdev(dev);
+		return NULL;
+	}
+	return dev;
+}
+
+int reset_card( struct net_device *dev , int lock) {
+	struct airo_info *ai = dev->priv;
+
+	if (lock && down_interruptible(&ai->sem))
+		return -1;
+	waitbusy (ai);
+	OUT4500(ai,COMMAND,CMD_SOFTRESET);
+	msleep(200);
+	waitbusy (ai);
+	msleep(200);
+	if (lock)
+		up(&ai->sem);
+	return 0;
+}
+
+struct net_device *_init_airo_card( unsigned short irq, int port,
+				    int is_pcmcia, struct pci_dev *pci,
+				    struct device *dmdev )
+{
+	struct net_device *dev;
+	struct airo_info *ai;
+	int i, rc;
+
+	/* Create the network device object. */
+        dev = alloc_etherdev(sizeof(*ai));
+        if (!dev) {
+		printk(KERN_ERR "airo:  Couldn't alloc_etherdev\n");
+		return NULL;
+        }
+	if (dev_alloc_name(dev, dev->name) < 0) {
+		printk(KERN_ERR "airo:  Couldn't get name!\n");
+		goto err_out_free;
+	}
+
+	ai = dev->priv;
+	ai->wifidev = NULL;
+	ai->flags = 0;
+	if (pci && (pci->device == 0x5000 || pci->device == 0xa504)) {
+		printk(KERN_DEBUG "airo: Found an MPI350 card\n");
+		set_bit(FLAG_MPI, &ai->flags);
+	}
+        ai->dev = dev;
+	spin_lock_init(&ai->aux_lock);
+	sema_init(&ai->sem, 1);
+	ai->config.len = 0;
+	ai->pci = pci;
+	init_waitqueue_head (&ai->thr_wait);
+	init_completion (&ai->thr_exited);
+	ai->thr_pid = kernel_thread(airo_thread, dev, CLONE_FS | CLONE_FILES);
+	if (ai->thr_pid < 0)
+		goto err_out_free;
+#ifdef MICSUPPORT
+	ai->tfm = NULL;
+#endif
+	rc = add_airo_dev( dev );
+	if (rc)
+		goto err_out_thr;
+
+	/* The Airo-specific entries in the device structure. */
+	if (test_bit(FLAG_MPI,&ai->flags)) {
+		skb_queue_head_init (&ai->txq);
+		dev->hard_start_xmit = &mpi_start_xmit;
+	} else
+		dev->hard_start_xmit = &airo_start_xmit;
+	dev->get_stats = &airo_get_stats;
+	dev->set_multicast_list = &airo_set_multicast_list;
+	dev->set_mac_address = &airo_set_mac_address;
+	dev->do_ioctl = &airo_ioctl;
+#ifdef WIRELESS_EXT
+	dev->wireless_handlers = &airo_handler_def;
+	ai->wireless_data.spy_data = &ai->spy_data;
+	dev->wireless_data = &ai->wireless_data;
+#endif /* WIRELESS_EXT */
+	dev->change_mtu = &airo_change_mtu;
+	dev->open = &airo_open;
+	dev->stop = &airo_close;
+	dev->irq = irq;
+	dev->base_addr = port;
+
+	SET_NETDEV_DEV(dev, dmdev);
+
+
+	if (test_bit(FLAG_MPI,&ai->flags))
+		reset_card (dev, 1);
+
+	rc = request_irq( dev->irq, airo_interrupt, SA_SHIRQ, dev->name, dev );
+	if (rc) {
+		printk(KERN_ERR "airo: register interrupt %d failed, rc %d\n", irq, rc );
+		goto err_out_unlink;
+	}
+	if (!is_pcmcia) {
+		if (!request_region( dev->base_addr, 64, dev->name )) {
+			rc = -EBUSY;
+			printk(KERN_ERR "airo: Couldn't request region\n");
+			goto err_out_irq;
+		}
+	}
+
+	if (test_bit(FLAG_MPI,&ai->flags)) {
+		if (mpi_map_card(ai, pci, dev->name)) {
+			printk(KERN_ERR "airo: Could not map memory\n");
+			goto err_out_res;
+		}
+	}
+
+	if (probe) {
+		if ( setup_card( ai, dev->dev_addr, 1 ) != SUCCESS ) {
+			printk( KERN_ERR "airo: MAC could not be enabled\n" );
+			rc = -EIO;
+			goto err_out_map;
+		}
+	} else if (!test_bit(FLAG_MPI,&ai->flags)) {
+		ai->bap_read = fast_bap_read;
+		set_bit(FLAG_FLASHING, &ai->flags);
+	}
+
+	rc = register_netdev(dev);
+	if (rc) {
+		printk(KERN_ERR "airo: Couldn't register_netdev\n");
+		goto err_out_map;
+	}
+	ai->wifidev = init_wifidev(ai, dev);
+
+	set_bit(FLAG_REGISTERED,&ai->flags);
+	printk( KERN_INFO "airo: MAC enabled %s %x:%x:%x:%x:%x:%x\n",
+		dev->name,
+		dev->dev_addr[0], dev->dev_addr[1], dev->dev_addr[2],
+		dev->dev_addr[3], dev->dev_addr[4], dev->dev_addr[5] );
+
+	/* Allocate the transmit buffers */
+	if (probe && !test_bit(FLAG_MPI,&ai->flags))
+		for( i = 0; i < MAX_FIDS; i++ )
+			ai->fids[i] = transmit_allocate(ai,2312,i>=MAX_FIDS/2);
+
+	setup_proc_entry( dev, dev->priv ); /* XXX check for failure */
+	netif_start_queue(dev);
+	SET_MODULE_OWNER(dev);
+	return dev;
+
+err_out_map:
+	if (test_bit(FLAG_MPI,&ai->flags) && pci) {
+		pci_free_consistent(pci, PCI_SHARED_LEN, ai->shared, ai->shared_dma);
+		iounmap(ai->pciaux);
+		iounmap(ai->pcimem);
+		mpi_unmap_card(ai->pci);
+	}
+err_out_res:
+	if (!is_pcmcia)
+	        release_region( dev->base_addr, 64 );
+err_out_irq:
+	free_irq(dev->irq, dev);
+err_out_unlink:
+	del_airo_dev(dev);
+err_out_thr:
+	set_bit(JOB_DIE, &ai->flags);
+	kill_proc(ai->thr_pid, SIGTERM, 1);
+	wait_for_completion(&ai->thr_exited);
+err_out_free:
+	free_netdev(dev);
+	return NULL;
+}
+
+struct net_device *init_airo_card( unsigned short irq, int port, int is_pcmcia,
+				  struct device *dmdev)
+{
+	return _init_airo_card ( irq, port, is_pcmcia, NULL, dmdev);
+}
+
+EXPORT_SYMBOL(init_airo_card);
+
+static int waitbusy (struct airo_info *ai) {
+	int delay = 0;
+	while ((IN4500 (ai, COMMAND) & COMMAND_BUSY) & (delay < 10000)) {
+		udelay (10);
+		if ((++delay % 20) == 0)
+			OUT4500(ai, EVACK, EV_CLEARCOMMANDBUSY);
+	}
+	return delay < 10000;
+}
+
+int reset_airo_card( struct net_device *dev )
+{
+	int i;
+	struct airo_info *ai = dev->priv;
+
+	if (reset_card (dev, 1))
+		return -1;
+
+	if ( setup_card(ai, dev->dev_addr, 1 ) != SUCCESS ) {
+		printk( KERN_ERR "airo: MAC could not be enabled\n" );
+		return -1;
+	}
+	printk( KERN_INFO "airo: MAC enabled %s %x:%x:%x:%x:%x:%x\n", dev->name,
+			dev->dev_addr[0], dev->dev_addr[1], dev->dev_addr[2],
+			dev->dev_addr[3], dev->dev_addr[4], dev->dev_addr[5]);
+	/* Allocate the transmit buffers if needed */
+	if (!test_bit(FLAG_MPI,&ai->flags))
+		for( i = 0; i < MAX_FIDS; i++ )
+			ai->fids[i] = transmit_allocate (ai,2312,i>=MAX_FIDS/2);
+
+	enable_interrupts( ai );
+	netif_wake_queue(dev);
+	return 0;
+}
+
+EXPORT_SYMBOL(reset_airo_card);
+
+static void airo_send_event(struct net_device *dev) {
+	struct airo_info *ai = dev->priv;
+	union iwreq_data wrqu;
+	StatusRid status_rid;
+
+	clear_bit(JOB_EVENT, &ai->flags);
+	PC4500_readrid(ai, RID_STATUS, &status_rid, sizeof(status_rid), 0);
+	up(&ai->sem);
+	wrqu.data.length = 0;
+	wrqu.data.flags = 0;
+	memcpy(wrqu.ap_addr.sa_data, status_rid.bssid[0], ETH_ALEN);
+	wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+
+	/* Send event to user space */
+	wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
+}
+
+static int airo_thread(void *data) {
+	struct net_device *dev = data;
+	struct airo_info *ai = dev->priv;
+	int locked;
+	
+	daemonize("%s", dev->name);
+	allow_signal(SIGTERM);
+
+	while(1) {
+		if (signal_pending(current))
+			flush_signals(current);
+
+		/* make swsusp happy with our thread */
+		try_to_freeze(PF_FREEZE);
+
+		if (test_bit(JOB_DIE, &ai->flags))
+			break;
+
+		if (ai->flags & JOB_MASK) {
+			locked = down_interruptible(&ai->sem);
+		} else {
+			wait_queue_t wait;
+
+			init_waitqueue_entry(&wait, current);
+			add_wait_queue(&ai->thr_wait, &wait);
+			for (;;) {
+				set_current_state(TASK_INTERRUPTIBLE);
+				if (ai->flags & JOB_MASK)
+					break;
+				if (ai->expires) {
+					if (time_after_eq(jiffies,ai->expires)){
+						set_bit(JOB_AUTOWEP,&ai->flags);
+						break;
+					}
+					if (!signal_pending(current)) {
+						schedule_timeout(ai->expires - jiffies);
+						continue;
+					}
+				} else if (!signal_pending(current)) {
+					schedule();
+					continue;
+				}
+				break;
+			}
+			current->state = TASK_RUNNING;
+			remove_wait_queue(&ai->thr_wait, &wait);
+			locked = 1;
+		}
+
+		if (locked)
+			continue;
+
+		if (test_bit(JOB_DIE, &ai->flags)) {
+			up(&ai->sem);
+			break;
+		}
+
+		if (ai->power || test_bit(FLAG_FLASHING, &ai->flags)) {
+			up(&ai->sem);
+			continue;
+		}
+
+		if (test_bit(JOB_XMIT, &ai->flags))
+			airo_end_xmit(dev);
+		else if (test_bit(JOB_XMIT11, &ai->flags))
+			airo_end_xmit11(dev);
+		else if (test_bit(JOB_STATS, &ai->flags))
+			airo_read_stats(ai);
+		else if (test_bit(JOB_WSTATS, &ai->flags))
+			airo_read_wireless_stats(ai);
+		else if (test_bit(JOB_PROMISC, &ai->flags))
+			airo_set_promisc(ai);
+#ifdef MICSUPPORT
+		else if (test_bit(JOB_MIC, &ai->flags))
+			micinit(ai);
+#endif
+		else if (test_bit(JOB_EVENT, &ai->flags))
+			airo_send_event(dev);
+		else if (test_bit(JOB_AUTOWEP, &ai->flags))
+			timer_func(dev);
+	}
+	complete_and_exit (&ai->thr_exited, 0);
+}
+
+static irqreturn_t airo_interrupt ( int irq, void* dev_id, struct pt_regs *regs) {
+	struct net_device *dev = (struct net_device *)dev_id;
+	u16 status;
+	u16 fid;
+	struct airo_info *apriv = dev->priv;
+	u16 savedInterrupts = 0;
+	int handled = 0;
+
+	if (!netif_device_present(dev))
+		return IRQ_NONE;
+
+	for (;;) {
+		status = IN4500( apriv, EVSTAT );
+		if ( !(status & STATUS_INTS) || status == 0xffff ) break;
+
+		handled = 1;
+
+		if ( status & EV_AWAKE ) {
+			OUT4500( apriv, EVACK, EV_AWAKE );
+			OUT4500( apriv, EVACK, EV_AWAKE );
+		}
+
+		if (!savedInterrupts) {
+			savedInterrupts = IN4500( apriv, EVINTEN );
+			OUT4500( apriv, EVINTEN, 0 );
+		}
+
+		if ( status & EV_MIC ) {
+			OUT4500( apriv, EVACK, EV_MIC );
+#ifdef MICSUPPORT
+			if (test_bit(FLAG_MIC_CAPABLE, &apriv->flags)) {
+				set_bit(JOB_MIC, &apriv->flags);
+				wake_up_interruptible(&apriv->thr_wait);
+			}
+#endif
+		}
+		if ( status & EV_LINK ) {
+			union iwreq_data	wrqu;
+			/* The link status has changed, if you want to put a
+			   monitor hook in, do it here.  (Remember that
+			   interrupts are still disabled!)
+			*/
+			u16 newStatus = IN4500(apriv, LINKSTAT);
+			OUT4500( apriv, EVACK, EV_LINK);
+			/* Here is what newStatus means: */
+#define NOBEACON 0x8000 /* Loss of sync - missed beacons */
+#define MAXRETRIES 0x8001 /* Loss of sync - max retries */
+#define MAXARL 0x8002 /* Loss of sync - average retry level exceeded*/
+#define FORCELOSS 0x8003 /* Loss of sync - host request */
+#define TSFSYNC 0x8004 /* Loss of sync - TSF synchronization */
+#define DEAUTH 0x8100 /* Deauthentication (low byte is reason code) */
+#define DISASS 0x8200 /* Disassociation (low byte is reason code) */
+#define ASSFAIL 0x8400 /* Association failure (low byte is reason
+			  code) */
+#define AUTHFAIL 0x0300 /* Authentication failure (low byte is reason
+			   code) */
+#define ASSOCIATED 0x0400 /* Assocatied */
+#define RC_RESERVED 0 /* Reserved return code */
+#define RC_NOREASON 1 /* Unspecified reason */
+#define RC_AUTHINV 2 /* Previous authentication invalid */
+#define RC_DEAUTH 3 /* Deauthenticated because sending station is
+		       leaving */
+#define RC_NOACT 4 /* Disassociated due to inactivity */
+#define RC_MAXLOAD 5 /* Disassociated because AP is unable to handle
+			all currently associated stations */
+#define RC_BADCLASS2 6 /* Class 2 frame received from
+			  non-Authenticated station */
+#define RC_BADCLASS3 7 /* Class 3 frame received from
+			  non-Associated station */
+#define RC_STATLEAVE 8 /* Disassociated because sending station is
+			  leaving BSS */
+#define RC_NOAUTH 9 /* Station requesting (Re)Association is not
+		       Authenticated with the responding station */
+			if (newStatus != ASSOCIATED) {
+				if (auto_wep && !apriv->expires) {
+					apriv->expires = RUN_AT(3*HZ);
+					wake_up_interruptible(&apriv->thr_wait);
+				}
+			} else {
+				struct task_struct *task = apriv->task;
+				if (auto_wep)
+					apriv->expires = 0;
+				if (task)
+					wake_up_process (task);
+				set_bit(FLAG_UPDATE_UNI, &apriv->flags);
+				set_bit(FLAG_UPDATE_MULTI, &apriv->flags);
+			}
+			/* Question : is ASSOCIATED the only status
+			 * that is valid ? We want to catch handover
+			 * and reassociations as valid status
+			 * Jean II */
+			if(newStatus == ASSOCIATED) {
+				if (apriv->scan_timestamp) {
+					/* Send an empty event to user space.
+					 * We don't send the received data on
+					 * the event because it would require
+					 * us to do complex transcoding, and
+					 * we want to minimise the work done in
+					 * the irq handler. Use a request to
+					 * extract the data - Jean II */
+					wrqu.data.length = 0;
+					wrqu.data.flags = 0;
+					wireless_send_event(dev, SIOCGIWSCAN, &wrqu, NULL);
+					apriv->scan_timestamp = 0;
+				}
+				if (down_trylock(&apriv->sem) != 0) {
+					set_bit(JOB_EVENT, &apriv->flags);
+					wake_up_interruptible(&apriv->thr_wait);
+				} else
+					airo_send_event(dev);
+			} else {
+				memset(wrqu.ap_addr.sa_data, '\0', ETH_ALEN);
+				wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+
+				/* Send event to user space */
+				wireless_send_event(dev, SIOCGIWAP, &wrqu,NULL);
+			}
+		}
+
+		/* Check to see if there is something to receive */
+		if ( status & EV_RX  ) {
+			struct sk_buff *skb = NULL;
+			u16 fc, len, hdrlen = 0;
+#pragma pack(1)
+			struct {
+				u16 status, len;
+				u8 rssi[2];
+				u8 rate;
+				u8 freq;
+				u16 tmp[4];
+			} hdr;
+#pragma pack()
+			u16 gap;
+			u16 tmpbuf[4];
+			u16 *buffer;
+
+			if (test_bit(FLAG_MPI,&apriv->flags)) {
+				if (test_bit(FLAG_802_11, &apriv->flags))
+					mpi_receive_802_11(apriv);
+				else
+					mpi_receive_802_3(apriv);
+				OUT4500(apriv, EVACK, EV_RX);
+				goto exitrx;
+			}
+
+			fid = IN4500( apriv, RXFID );
+
+			/* Get the packet length */
+			if (test_bit(FLAG_802_11, &apriv->flags)) {
+				bap_setup (apriv, fid, 4, BAP0);
+				bap_read (apriv, (u16*)&hdr, sizeof(hdr), BAP0);
+				/* Bad CRC. Ignore packet */
+				if (le16_to_cpu(hdr.status) & 2)
+					hdr.len = 0;
+				if (apriv->wifidev == NULL)
+					hdr.len = 0;
+			} else {
+				bap_setup (apriv, fid, 0x36, BAP0);
+				bap_read (apriv, (u16*)&hdr.len, 2, BAP0);
+			}
+			len = le16_to_cpu(hdr.len);
+
+			if (len > 2312) {
+				printk( KERN_ERR "airo: Bad size %d\n", len );
+				goto badrx;
+			}
+			if (len == 0)
+				goto badrx;
+
+			if (test_bit(FLAG_802_11, &apriv->flags)) {
+				bap_read (apriv, (u16*)&fc, sizeof(fc), BAP0);
+				fc = le16_to_cpu(fc);
+				switch (fc & 0xc) {
+					case 4:
+						if ((fc & 0xe0) == 0xc0)
+							hdrlen = 10;
+						else
+							hdrlen = 16;
+						break;
+					case 8:
+						if ((fc&0x300)==0x300){
+							hdrlen = 30;
+							break;
+						}
+					default:
+						hdrlen = 24;
+				}
+			} else
+				hdrlen = ETH_ALEN * 2;
+
+			skb = dev_alloc_skb( len + hdrlen + 2 + 2 );
+			if ( !skb ) {
+				apriv->stats.rx_dropped++;
+				goto badrx;
+			}
+			skb_reserve(skb, 2); /* This way the IP header is aligned */
+			buffer = (u16*)skb_put (skb, len + hdrlen);
+			if (test_bit(FLAG_802_11, &apriv->flags)) {
+				buffer[0] = fc;
+				bap_read (apriv, buffer + 1, hdrlen - 2, BAP0);
+				if (hdrlen == 24)
+					bap_read (apriv, tmpbuf, 6, BAP0);
+
+				bap_read (apriv, &gap, sizeof(gap), BAP0);
+				gap = le16_to_cpu(gap);
+				if (gap) {
+					if (gap <= 8)
+						bap_read (apriv, tmpbuf, gap, BAP0);
+					else
+						printk(KERN_ERR "airo: gaplen too big. Problems will follow...\n");
+				}
+				bap_read (apriv, buffer + hdrlen/2, len, BAP0);
+			} else {
+#ifdef MICSUPPORT
+				MICBuffer micbuf;
+#endif
+				bap_read (apriv, buffer, ETH_ALEN*2, BAP0);
+#ifdef MICSUPPORT
+				if (apriv->micstats.enabled) {
+					bap_read (apriv,(u16*)&micbuf,sizeof(micbuf),BAP0);
+					if (ntohs(micbuf.typelen) > 0x05DC)
+						bap_setup (apriv, fid, 0x44, BAP0);
+					else {
+						if (len <= sizeof(micbuf))
+							goto badmic;
+
+						len -= sizeof(micbuf);
+						skb_trim (skb, len + hdrlen);
+					}
+				}
+#endif
+				bap_read(apriv,buffer+ETH_ALEN,len,BAP0);
+#ifdef MICSUPPORT
+				if (decapsulate(apriv,&micbuf,(etherHead*)buffer,len)) {
+badmic:
+					dev_kfree_skb_irq (skb);
+#else
+				if (0) {
+#endif
+badrx:
+					OUT4500( apriv, EVACK, EV_RX);
+					goto exitrx;
+				}
+			}
+#ifdef WIRELESS_SPY
+			if (apriv->spy_data.spy_number > 0) {
+				char *sa;
+				struct iw_quality wstats;
+				/* Prepare spy data : addr + qual */
+				if (!test_bit(FLAG_802_11, &apriv->flags)) {
+					sa = (char*)buffer + 6;
+					bap_setup (apriv, fid, 8, BAP0);
+					bap_read (apriv, (u16*)hdr.rssi, 2, BAP0);
+				} else
+					sa = (char*)buffer + 10;
+				wstats.qual = hdr.rssi[0];
+				if (apriv->rssi)
+					wstats.level = 0x100 - apriv->rssi[hdr.rssi[1]].rssidBm;
+				else
+					wstats.level = (hdr.rssi[1] + 321) / 2;
+				wstats.updated = 3;	
+				/* Update spy records */
+				wireless_spy_update(dev, sa, &wstats);
+			}
+#endif /* WIRELESS_SPY */
+			OUT4500( apriv, EVACK, EV_RX);
+
+			if (test_bit(FLAG_802_11, &apriv->flags)) {
+				skb->mac.raw = skb->data;
+				skb->pkt_type = PACKET_OTHERHOST;
+				skb->dev = apriv->wifidev;
+				skb->protocol = htons(ETH_P_802_2);
+			} else {
+				skb->dev = dev;
+				skb->protocol = eth_type_trans(skb,dev);
+			}
+			skb->dev->last_rx = jiffies;
+			skb->ip_summed = CHECKSUM_NONE;
+
+			netif_rx( skb );
+		}
+exitrx:
+
+		/* Check to see if a packet has been transmitted */
+		if (  status & ( EV_TX|EV_TXCPY|EV_TXEXC ) ) {
+			int i;
+			int len = 0;
+			int index = -1;
+
+			if (test_bit(FLAG_MPI,&apriv->flags)) {
+				unsigned long flags;
+
+				if (status & EV_TXEXC)
+					get_tx_error(apriv, -1);
+				spin_lock_irqsave(&apriv->aux_lock, flags);
+				if (skb_queue_len (&apriv->txq)) {
+					spin_unlock_irqrestore(&apriv->aux_lock,flags);
+					mpi_send_packet (dev);
+				} else {
+					clear_bit(FLAG_PENDING_XMIT, &apriv->flags);
+					spin_unlock_irqrestore(&apriv->aux_lock,flags);
+					netif_wake_queue (dev);
+				}
+				OUT4500( apriv, EVACK,
+					status & (EV_TX|EV_TXCPY|EV_TXEXC));
+				goto exittx;
+			}
+
+			fid = IN4500(apriv, TXCOMPLFID);
+
+			for( i = 0; i < MAX_FIDS; i++ ) {
+				if ( ( apriv->fids[i] & 0xffff ) == fid ) {
+					len = apriv->fids[i] >> 16;
+					index = i;
+				}
+			}
+			if (index != -1) {
+				if (status & EV_TXEXC)
+					get_tx_error(apriv, index);
+				OUT4500( apriv, EVACK, status & (EV_TX | EV_TXEXC));
+				/* Set up to be used again */
+				apriv->fids[index] &= 0xffff;
+				if (index < MAX_FIDS / 2) {
+					if (!test_bit(FLAG_PENDING_XMIT, &apriv->flags))
+						netif_wake_queue(dev);
+				} else {
+					if (!test_bit(FLAG_PENDING_XMIT11, &apriv->flags))
+						netif_wake_queue(apriv->wifidev);
+				}
+			} else {
+				OUT4500( apriv, EVACK, status & (EV_TX | EV_TXCPY | EV_TXEXC));
+				printk( KERN_ERR "airo: Unallocated FID was used to xmit\n" );
+			}
+		}
+exittx:
+		if ( status & ~STATUS_INTS & ~IGNORE_INTS )
+			printk( KERN_WARNING "airo: Got weird status %x\n",
+				status & ~STATUS_INTS & ~IGNORE_INTS );
+	}
+
+	if (savedInterrupts)
+		OUT4500( apriv, EVINTEN, savedInterrupts );
+
+	/* done.. */
+	return IRQ_RETVAL(handled);
+}
+
+/*
+ *  Routines to talk to the card
+ */
+
+/*
+ *  This was originally written for the 4500, hence the name
+ *  NOTE:  If use with 8bit mode and SMP bad things will happen!
+ *         Why would some one do 8 bit IO in an SMP machine?!?
+ */
+static void OUT4500( struct airo_info *ai, u16 reg, u16 val ) {
+	if (test_bit(FLAG_MPI,&ai->flags))
+		reg <<= 1;
+	if ( !do8bitIO )
+		outw( val, ai->dev->base_addr + reg );
+	else {
+		outb( val & 0xff, ai->dev->base_addr + reg );
+		outb( val >> 8, ai->dev->base_addr + reg + 1 );
+	}
+}
+
+static u16 IN4500( struct airo_info *ai, u16 reg ) {
+	unsigned short rc;
+
+	if (test_bit(FLAG_MPI,&ai->flags))
+		reg <<= 1;
+	if ( !do8bitIO )
+		rc = inw( ai->dev->base_addr + reg );
+	else {
+		rc = inb( ai->dev->base_addr + reg );
+		rc += ((int)inb( ai->dev->base_addr + reg + 1 )) << 8;
+	}
+	return rc;
+}
+
+static int enable_MAC( struct airo_info *ai, Resp *rsp, int lock ) {
+	int rc;
+        Cmd cmd;
+
+	/* FLAG_RADIO_OFF : Radio disabled via /proc or Wireless Extensions
+	 * FLAG_RADIO_DOWN : Radio disabled via "ifconfig ethX down"
+	 * Note : we could try to use !netif_running(dev) in enable_MAC()
+	 * instead of this flag, but I don't trust it *within* the
+	 * open/close functions, and testing both flags together is
+	 * "cheaper" - Jean II */
+	if (ai->flags & FLAG_RADIO_MASK) return SUCCESS;
+
+	if (lock && down_interruptible(&ai->sem))
+		return -ERESTARTSYS;
+
+	if (!test_bit(FLAG_ENABLED, &ai->flags)) {
+		memset(&cmd, 0, sizeof(cmd));
+		cmd.cmd = MAC_ENABLE;
+		rc = issuecommand(ai, &cmd, rsp);
+		if (rc == SUCCESS)
+			set_bit(FLAG_ENABLED, &ai->flags);
+	} else
+		rc = SUCCESS;
+
+	if (lock)
+	    up(&ai->sem);
+
+	if (rc)
+		printk(KERN_ERR "%s: Cannot enable MAC, err=%d\n",
+			__FUNCTION__,rc);
+	return rc;
+}
+
+static void disable_MAC( struct airo_info *ai, int lock ) {
+        Cmd cmd;
+	Resp rsp;
+
+	if (lock && down_interruptible(&ai->sem))
+		return;
+
+	if (test_bit(FLAG_ENABLED, &ai->flags)) {
+		memset(&cmd, 0, sizeof(cmd));
+		cmd.cmd = MAC_DISABLE; // disable in case already enabled
+		issuecommand(ai, &cmd, &rsp);
+		clear_bit(FLAG_ENABLED, &ai->flags);
+	}
+	if (lock)
+		up(&ai->sem);
+}
+
+static void enable_interrupts( struct airo_info *ai ) {
+	/* Enable the interrupts */
+	OUT4500( ai, EVINTEN, STATUS_INTS );
+}
+
+static void disable_interrupts( struct airo_info *ai ) {
+	OUT4500( ai, EVINTEN, 0 );
+}
+
+static void mpi_receive_802_3(struct airo_info *ai)
+{
+	RxFid rxd;
+	int len = 0;
+	struct sk_buff *skb;
+	char *buffer;
+#ifdef MICSUPPORT
+	int off = 0;
+	MICBuffer micbuf;
+#endif
+
+	memcpy_fromio(&rxd, ai->rxfids[0].card_ram_off, sizeof(rxd));
+	/* Make sure we got something */
+	if (rxd.rdy && rxd.valid == 0) {
+		len = rxd.len + 12;
+		if (len < 12 || len > 2048)
+			goto badrx;
+
+		skb = dev_alloc_skb(len);
+		if (!skb) {
+			ai->stats.rx_dropped++;
+			goto badrx;
+		}
+		buffer = skb_put(skb,len);
+#ifdef MICSUPPORT
+		memcpy(buffer, ai->rxfids[0].virtual_host_addr, ETH_ALEN * 2);
+		if (ai->micstats.enabled) {
+			memcpy(&micbuf,
+				ai->rxfids[0].virtual_host_addr + ETH_ALEN * 2,
+				sizeof(micbuf));
+			if (ntohs(micbuf.typelen) <= 0x05DC) {
+				if (len <= sizeof(micbuf) + ETH_ALEN * 2)
+					goto badmic;
+
+				off = sizeof(micbuf);
+				skb_trim (skb, len - off);
+			}
+		}
+		memcpy(buffer + ETH_ALEN * 2,
+			ai->rxfids[0].virtual_host_addr + ETH_ALEN * 2 + off,
+			len - ETH_ALEN * 2 - off);
+		if (decapsulate (ai, &micbuf, (etherHead*)buffer, len - off - ETH_ALEN * 2)) {
+badmic:
+			dev_kfree_skb_irq (skb);
+			goto badrx;
+		}
+#else
+		memcpy(buffer, ai->rxfids[0].virtual_host_addr, len);
+#endif
+#ifdef WIRELESS_SPY
+		if (ai->spy_data.spy_number > 0) {
+			char *sa;
+			struct iw_quality wstats;
+			/* Prepare spy data : addr + qual */
+			sa = buffer + ETH_ALEN;
+			wstats.qual = 0; /* XXX Where do I get that info from ??? */
+			wstats.level = 0;
+			wstats.updated = 0;
+			/* Update spy records */
+			wireless_spy_update(ai->dev, sa, &wstats);
+		}
+#endif /* WIRELESS_SPY */
+
+		skb->dev = ai->dev;
+		skb->ip_summed = CHECKSUM_NONE;
+		skb->protocol = eth_type_trans(skb, ai->dev);
+		skb->dev->last_rx = jiffies;
+		netif_rx(skb);
+	}
+badrx:
+	if (rxd.valid == 0) {
+		rxd.valid = 1;
+		rxd.rdy = 0;
+		rxd.len = PKTSIZE;
+		memcpy_toio(ai->rxfids[0].card_ram_off, &rxd, sizeof(rxd));
+	}
+}
+
+void mpi_receive_802_11 (struct airo_info *ai)
+{
+	RxFid rxd;
+	struct sk_buff *skb = NULL;
+	u16 fc, len, hdrlen = 0;
+#pragma pack(1)
+	struct {
+		u16 status, len;
+		u8 rssi[2];
+		u8 rate;
+		u8 freq;
+		u16 tmp[4];
+	} hdr;
+#pragma pack()
+	u16 gap;
+	u16 *buffer;
+	char *ptr = ai->rxfids[0].virtual_host_addr+4;
+
+	memcpy_fromio(&rxd, ai->rxfids[0].card_ram_off, sizeof(rxd));
+	memcpy ((char *)&hdr, ptr, sizeof(hdr));
+	ptr += sizeof(hdr);
+	/* Bad CRC. Ignore packet */
+	if (le16_to_cpu(hdr.status) & 2)
+		hdr.len = 0;
+	if (ai->wifidev == NULL)
+		hdr.len = 0;
+	len = le16_to_cpu(hdr.len);
+	if (len > 2312) {
+		printk( KERN_ERR "airo: Bad size %d\n", len );
+		goto badrx;
+	}
+	if (len == 0)
+		goto badrx;
+
+	memcpy ((char *)&fc, ptr, sizeof(fc));
+	fc = le16_to_cpu(fc);
+	switch (fc & 0xc) {
+		case 4:
+			if ((fc & 0xe0) == 0xc0)
+				hdrlen = 10;
+			else
+				hdrlen = 16;
+			break;
+		case 8:
+			if ((fc&0x300)==0x300){
+				hdrlen = 30;
+				break;
+			}
+		default:
+			hdrlen = 24;
+	}
+
+	skb = dev_alloc_skb( len + hdrlen + 2 );
+	if ( !skb ) {
+		ai->stats.rx_dropped++;
+		goto badrx;
+	}
+	buffer = (u16*)skb_put (skb, len + hdrlen);
+	memcpy ((char *)buffer, ptr, hdrlen);
+	ptr += hdrlen;
+	if (hdrlen == 24)
+		ptr += 6;
+	memcpy ((char *)&gap, ptr, sizeof(gap));
+	ptr += sizeof(gap);
+	gap = le16_to_cpu(gap);
+	if (gap) {
+		if (gap <= 8)
+			ptr += gap;
+		else
+			printk(KERN_ERR
+			    "airo: gaplen too big. Problems will follow...\n");
+	}
+	memcpy ((char *)buffer + hdrlen, ptr, len);
+	ptr += len;
+#ifdef IW_WIRELESS_SPY	  /* defined in iw_handler.h */
+	if (ai->spy_data.spy_number > 0) {
+		char *sa;
+		struct iw_quality wstats;
+		/* Prepare spy data : addr + qual */
+		sa = (char*)buffer + 10;
+		wstats.qual = hdr.rssi[0];
+		if (ai->rssi)
+			wstats.level = 0x100 - ai->rssi[hdr.rssi[1]].rssidBm;
+		else
+			wstats.level = (hdr.rssi[1] + 321) / 2;
+		wstats.updated = 3;
+		/* Update spy records */
+		wireless_spy_update(ai->dev, sa, &wstats);
+	}
+#endif /* IW_WIRELESS_SPY */
+	skb->mac.raw = skb->data;
+	skb->pkt_type = PACKET_OTHERHOST;
+	skb->dev = ai->wifidev;
+	skb->protocol = htons(ETH_P_802_2);
+	skb->dev->last_rx = jiffies;
+	skb->ip_summed = CHECKSUM_NONE;
+	netif_rx( skb );
+badrx:
+	if (rxd.valid == 0) {
+		rxd.valid = 1;
+		rxd.rdy = 0;
+		rxd.len = PKTSIZE;
+		memcpy_toio(ai->rxfids[0].card_ram_off, &rxd, sizeof(rxd));
+	}
+}
+
+static u16 setup_card(struct airo_info *ai, u8 *mac, int lock)
+{
+	Cmd cmd;
+	Resp rsp;
+	int status;
+	int i;
+	SsidRid mySsid;
+	u16 lastindex;
+	WepKeyRid wkr;
+	int rc;
+
+	memset( &mySsid, 0, sizeof( mySsid ) );
+	if (ai->flash) {
+		kfree (ai->flash);
+		ai->flash = NULL;
+	}
+
+	/* The NOP is the first step in getting the card going */
+	cmd.cmd = NOP;
+	cmd.parm0 = cmd.parm1 = cmd.parm2 = 0;
+	if (lock && down_interruptible(&ai->sem))
+		return ERROR;
+	if ( issuecommand( ai, &cmd, &rsp ) != SUCCESS ) {
+		if (lock)
+			up(&ai->sem);
+		return ERROR;
+	}
+	disable_MAC( ai, 0);
+
+	// Let's figure out if we need to use the AUX port
+	if (!test_bit(FLAG_MPI,&ai->flags)) {
+		cmd.cmd = CMD_ENABLEAUX;
+		if (issuecommand(ai, &cmd, &rsp) != SUCCESS) {
+			if (lock)
+				up(&ai->sem);
+			printk(KERN_ERR "airo: Error checking for AUX port\n");
+			return ERROR;
+		}
+		if (!aux_bap || rsp.status & 0xff00) {
+			ai->bap_read = fast_bap_read;
+			printk(KERN_DEBUG "airo: Doing fast bap_reads\n");
+		} else {
+			ai->bap_read = aux_bap_read;
+			printk(KERN_DEBUG "airo: Doing AUX bap_reads\n");
+		}
+	}
+	if (lock)
+		up(&ai->sem);
+	if (ai->config.len == 0) {
+		tdsRssiRid rssi_rid;
+		CapabilityRid cap_rid;
+
+		if (ai->APList) {
+			kfree(ai->APList);
+			ai->APList = NULL;
+		}
+		if (ai->SSID) {
+			kfree(ai->SSID);
+			ai->SSID = NULL;
+		}
+		// general configuration (read/modify/write)
+		status = readConfigRid(ai, lock);
+		if ( status != SUCCESS ) return ERROR;
+
+		status = readCapabilityRid(ai, &cap_rid, lock);
+		if ( status != SUCCESS ) return ERROR;
+
+		status = PC4500_readrid(ai,RID_RSSI,&rssi_rid,sizeof(rssi_rid),lock);
+		if ( status == SUCCESS ) {
+			if (ai->rssi || (ai->rssi = kmalloc(512, GFP_KERNEL)) != NULL)
+				memcpy(ai->rssi, (u8*)&rssi_rid + 2, 512);
+		}
+		else {
+			if (ai->rssi) {
+				kfree(ai->rssi);
+				ai->rssi = NULL;
+			}
+			if (cap_rid.softCap & 8)
+				ai->config.rmode |= RXMODE_NORMALIZED_RSSI;
+			else
+				printk(KERN_WARNING "airo: unknown received signal level scale\n");
+		}
+		ai->config.opmode = adhoc ? MODE_STA_IBSS : MODE_STA_ESS;
+		ai->config.authType = AUTH_OPEN;
+		ai->config.modulation = MOD_CCK;
+
+#ifdef MICSUPPORT
+		if ((cap_rid.len>=sizeof(cap_rid)) && (cap_rid.extSoftCap&1) &&
+		    (micsetup(ai) == SUCCESS)) {
+			ai->config.opmode |= MODE_MIC;
+			set_bit(FLAG_MIC_CAPABLE, &ai->flags);
+		}
+#endif
+
+		/* Save off the MAC */
+		for( i = 0; i < ETH_ALEN; i++ ) {
+			mac[i] = ai->config.macAddr[i];
+		}
+
+		/* Check to see if there are any insmod configured
+		   rates to add */
+		if ( rates[0] ) {
+			int i = 0;
+			memset(ai->config.rates,0,sizeof(ai->config.rates));
+			for( i = 0; i < 8 && rates[i]; i++ ) {
+				ai->config.rates[i] = rates[i];
+			}
+		}
+		if ( basic_rate > 0 ) {
+			int i;
+			for( i = 0; i < 8; i++ ) {
+				if ( ai->config.rates[i] == basic_rate ||
+				     !ai->config.rates ) {
+					ai->config.rates[i] = basic_rate | 0x80;
+					break;
+				}
+			}
+		}
+		set_bit (FLAG_COMMIT, &ai->flags);
+	}
+
+	/* Setup the SSIDs if present */
+	if ( ssids[0] ) {
+		int i;
+		for( i = 0; i < 3 && ssids[i]; i++ ) {
+			mySsid.ssids[i].len = strlen(ssids[i]);
+			if ( mySsid.ssids[i].len > 32 )
+				mySsid.ssids[i].len = 32;
+			memcpy(mySsid.ssids[i].ssid, ssids[i],
+			       mySsid.ssids[i].len);
+		}
+		mySsid.len = sizeof(mySsid);
+	}
+
+	status = writeConfigRid(ai, lock);
+	if ( status != SUCCESS ) return ERROR;
+
+	/* Set up the SSID list */
+	if ( ssids[0] ) {
+		status = writeSsidRid(ai, &mySsid, lock);
+		if ( status != SUCCESS ) return ERROR;
+	}
+
+	status = enable_MAC(ai, &rsp, lock);
+	if ( status != SUCCESS || (rsp.status & 0xFF00) != 0) {
+		printk( KERN_ERR "airo: Bad MAC enable reason = %x, rid = %x, offset = %d\n", rsp.rsp0, rsp.rsp1, rsp.rsp2 );
+		return ERROR;
+	}
+
+	/* Grab the initial wep key, we gotta save it for auto_wep */
+	rc = readWepKeyRid(ai, &wkr, 1, lock);
+	if (rc == SUCCESS) do {
+		lastindex = wkr.kindex;
+		if (wkr.kindex == 0xffff) {
+			ai->defindex = wkr.mac[0];
+		}
+		rc = readWepKeyRid(ai, &wkr, 0, lock);
+	} while(lastindex != wkr.kindex);
+
+	if (auto_wep) {
+		ai->expires = RUN_AT(3*HZ);
+		wake_up_interruptible(&ai->thr_wait);
+	}
+
+	return SUCCESS;
+}
+
+static u16 issuecommand(struct airo_info *ai, Cmd *pCmd, Resp *pRsp) {
+        // Im really paranoid about letting it run forever!
+	int max_tries = 600000;
+
+	if (IN4500(ai, EVSTAT) & EV_CMD)
+		OUT4500(ai, EVACK, EV_CMD);
+
+	OUT4500(ai, PARAM0, pCmd->parm0);
+	OUT4500(ai, PARAM1, pCmd->parm1);
+	OUT4500(ai, PARAM2, pCmd->parm2);
+	OUT4500(ai, COMMAND, pCmd->cmd);
+
+	while (max_tries-- && (IN4500(ai, EVSTAT) & EV_CMD) == 0) {
+		if ((IN4500(ai, COMMAND)) == pCmd->cmd)
+			// PC4500 didn't notice command, try again
+			OUT4500(ai, COMMAND, pCmd->cmd);
+		if (!in_atomic() && (max_tries & 255) == 0)
+			schedule();
+	}
+
+	if ( max_tries == -1 ) {
+		printk( KERN_ERR
+			"airo: Max tries exceeded when issueing command\n" );
+		if (IN4500(ai, COMMAND) & COMMAND_BUSY)
+			OUT4500(ai, EVACK, EV_CLEARCOMMANDBUSY);
+		return ERROR;
+	}
+
+	// command completed
+	pRsp->status = IN4500(ai, STATUS);
+	pRsp->rsp0 = IN4500(ai, RESP0);
+	pRsp->rsp1 = IN4500(ai, RESP1);
+	pRsp->rsp2 = IN4500(ai, RESP2);
+	if ((pRsp->status & 0xff00)!=0 && pCmd->cmd != CMD_SOFTRESET) {
+		printk (KERN_ERR "airo: cmd= %x\n", pCmd->cmd);
+		printk (KERN_ERR "airo: status= %x\n", pRsp->status);
+		printk (KERN_ERR "airo: Rsp0= %x\n", pRsp->rsp0);
+		printk (KERN_ERR "airo: Rsp1= %x\n", pRsp->rsp1);
+		printk (KERN_ERR "airo: Rsp2= %x\n", pRsp->rsp2);
+	}
+
+	// clear stuck command busy if necessary
+	if (IN4500(ai, COMMAND) & COMMAND_BUSY) {
+		OUT4500(ai, EVACK, EV_CLEARCOMMANDBUSY);
+	}
+	// acknowledge processing the status/response
+	OUT4500(ai, EVACK, EV_CMD);
+
+	return SUCCESS;
+}
+
+/* Sets up the bap to start exchange data.  whichbap should
+ * be one of the BAP0 or BAP1 defines.  Locks should be held before
+ * calling! */
+static int bap_setup(struct airo_info *ai, u16 rid, u16 offset, int whichbap )
+{
+	int timeout = 50;
+	int max_tries = 3;
+
+	OUT4500(ai, SELECT0+whichbap, rid);
+	OUT4500(ai, OFFSET0+whichbap, offset);
+	while (1) {
+		int status = IN4500(ai, OFFSET0+whichbap);
+		if (status & BAP_BUSY) {
+                        /* This isn't really a timeout, but its kinda
+			   close */
+			if (timeout--) {
+				continue;
+			}
+		} else if ( status & BAP_ERR ) {
+			/* invalid rid or offset */
+			printk( KERN_ERR "airo: BAP error %x %d\n",
+				status, whichbap );
+			return ERROR;
+		} else if (status & BAP_DONE) { // success
+			return SUCCESS;
+		}
+		if ( !(max_tries--) ) {
+			printk( KERN_ERR
+				"airo: BAP setup error too many retries\n" );
+			return ERROR;
+		}
+		// -- PC4500 missed it, try again
+		OUT4500(ai, SELECT0+whichbap, rid);
+		OUT4500(ai, OFFSET0+whichbap, offset);
+		timeout = 50;
+	}
+}
+
+/* should only be called by aux_bap_read.  This aux function and the
+   following use concepts not documented in the developers guide.  I
+   got them from a patch given to my by Aironet */
+static u16 aux_setup(struct airo_info *ai, u16 page,
+		     u16 offset, u16 *len)
+{
+	u16 next;
+
+	OUT4500(ai, AUXPAGE, page);
+	OUT4500(ai, AUXOFF, 0);
+	next = IN4500(ai, AUXDATA);
+	*len = IN4500(ai, AUXDATA)&0xff;
+	if (offset != 4) OUT4500(ai, AUXOFF, offset);
+	return next;
+}
+
+/* requires call to bap_setup() first */
+static int aux_bap_read(struct airo_info *ai, u16 *pu16Dst,
+			int bytelen, int whichbap)
+{
+	u16 len;
+	u16 page;
+	u16 offset;
+	u16 next;
+	int words;
+	int i;
+	unsigned long flags;
+
+	spin_lock_irqsave(&ai->aux_lock, flags);
+	page = IN4500(ai, SWS0+whichbap);
+	offset = IN4500(ai, SWS2+whichbap);
+	next = aux_setup(ai, page, offset, &len);
+	words = (bytelen+1)>>1;
+
+	for (i=0; i<words;) {
+		int count;
+		count = (len>>1) < (words-i) ? (len>>1) : (words-i);
+		if ( !do8bitIO )
+			insw( ai->dev->base_addr+DATA0+whichbap,
+			      pu16Dst+i,count );
+		else
+			insb( ai->dev->base_addr+DATA0+whichbap,
+			      pu16Dst+i, count << 1 );
+		i += count;
+		if (i<words) {
+			next = aux_setup(ai, next, 4, &len);
+		}
+	}
+	spin_unlock_irqrestore(&ai->aux_lock, flags);
+	return SUCCESS;
+}
+
+
+/* requires call to bap_setup() first */
+static int fast_bap_read(struct airo_info *ai, u16 *pu16Dst,
+			 int bytelen, int whichbap)
+{
+	bytelen = (bytelen + 1) & (~1); // round up to even value
+	if ( !do8bitIO )
+		insw( ai->dev->base_addr+DATA0+whichbap, pu16Dst, bytelen>>1 );
+	else
+		insb( ai->dev->base_addr+DATA0+whichbap, pu16Dst, bytelen );
+	return SUCCESS;
+}
+
+/* requires call to bap_setup() first */
+static int bap_write(struct airo_info *ai, const u16 *pu16Src,
+		     int bytelen, int whichbap)
+{
+	bytelen = (bytelen + 1) & (~1); // round up to even value
+	if ( !do8bitIO )
+		outsw( ai->dev->base_addr+DATA0+whichbap,
+		       pu16Src, bytelen>>1 );
+	else
+		outsb( ai->dev->base_addr+DATA0+whichbap, pu16Src, bytelen );
+	return SUCCESS;
+}
+
+static int PC4500_accessrid(struct airo_info *ai, u16 rid, u16 accmd)
+{
+	Cmd cmd; /* for issuing commands */
+	Resp rsp; /* response from commands */
+	u16 status;
+
+	memset(&cmd, 0, sizeof(cmd));
+	cmd.cmd = accmd;
+	cmd.parm0 = rid;
+	status = issuecommand(ai, &cmd, &rsp);
+	if (status != 0) return status;
+	if ( (rsp.status & 0x7F00) != 0) {
+		return (accmd << 8) + (rsp.rsp0 & 0xFF);
+	}
+	return 0;
+}
+
+/*  Note, that we are using BAP1 which is also used by transmit, so
+ *  we must get a lock. */
+static int PC4500_readrid(struct airo_info *ai, u16 rid, void *pBuf, int len, int lock)
+{
+	u16 status;
+        int rc = SUCCESS;
+
+	if (lock) {
+		if (down_interruptible(&ai->sem))
+			return ERROR;
+	}
+	if (test_bit(FLAG_MPI,&ai->flags)) {
+		Cmd cmd;
+		Resp rsp;
+
+		memset(&cmd, 0, sizeof(cmd));
+		memset(&rsp, 0, sizeof(rsp));
+		ai->config_desc.rid_desc.valid = 1;
+		ai->config_desc.rid_desc.len = RIDSIZE;
+		ai->config_desc.rid_desc.rid = 0;
+		ai->config_desc.rid_desc.host_addr = ai->ridbus;
+
+		cmd.cmd = CMD_ACCESS;
+		cmd.parm0 = rid;
+
+		memcpy_toio(ai->config_desc.card_ram_off,
+			&ai->config_desc.rid_desc, sizeof(Rid));
+
+		rc = issuecommand(ai, &cmd, &rsp);
+
+		if (rsp.status & 0x7f00)
+			rc = rsp.rsp0;
+		if (!rc)
+			memcpy(pBuf, ai->config_desc.virtual_host_addr, len);
+		goto done;
+	} else {
+		if ((status = PC4500_accessrid(ai, rid, CMD_ACCESS))!=SUCCESS) {
+	                rc = status;
+	                goto done;
+	        }
+		if (bap_setup(ai, rid, 0, BAP1) != SUCCESS) {
+			rc = ERROR;
+	                goto done;
+	        }
+		// read the rid length field
+		bap_read(ai, pBuf, 2, BAP1);
+		// length for remaining part of rid
+		len = min(len, (int)le16_to_cpu(*(u16*)pBuf)) - 2;
+
+		if ( len <= 2 ) {
+			printk( KERN_ERR
+			"airo: Rid %x has a length of %d which is too short\n",
+				(int)rid, (int)len );
+			rc = ERROR;
+	                goto done;
+		}
+		// read remainder of the rid
+		rc = bap_read(ai, ((u16*)pBuf)+1, len, BAP1);
+	}
+done:
+	if (lock)
+		up(&ai->sem);
+	return rc;
+}
+
+/*  Note, that we are using BAP1 which is also used by transmit, so
+ *  make sure this isnt called when a transmit is happening */
+static int PC4500_writerid(struct airo_info *ai, u16 rid,
+			   const void *pBuf, int len, int lock)
+{
+	u16 status;
+	int rc = SUCCESS;
+
+	*(u16*)pBuf = cpu_to_le16((u16)len);
+
+	if (lock) {
+		if (down_interruptible(&ai->sem))
+			return ERROR;
+	}
+	if (test_bit(FLAG_MPI,&ai->flags)) {
+		Cmd cmd;
+		Resp rsp;
+
+		if (test_bit(FLAG_ENABLED, &ai->flags))
+			printk(KERN_ERR
+				"%s: MAC should be disabled (rid=%04x)\n",
+				__FUNCTION__, rid);
+		memset(&cmd, 0, sizeof(cmd));
+		memset(&rsp, 0, sizeof(rsp));
+
+		ai->config_desc.rid_desc.valid = 1;
+		ai->config_desc.rid_desc.len = *((u16 *)pBuf);
+		ai->config_desc.rid_desc.rid = 0;
+
+		cmd.cmd = CMD_WRITERID;
+		cmd.parm0 = rid;
+
+		memcpy_toio(ai->config_desc.card_ram_off,
+			&ai->config_desc.rid_desc, sizeof(Rid));
+
+		if (len < 4 || len > 2047) {
+			printk(KERN_ERR "%s: len=%d\n",__FUNCTION__,len);
+			rc = -1;
+		} else {
+			memcpy((char *)ai->config_desc.virtual_host_addr,
+				pBuf, len);
+
+			rc = issuecommand(ai, &cmd, &rsp);
+			if ((rc & 0xff00) != 0) {
+				printk(KERN_ERR "%s: Write rid Error %d\n",
+					__FUNCTION__,rc);
+				printk(KERN_ERR "%s: Cmd=%04x\n",
+						__FUNCTION__,cmd.cmd);
+			}
+
+			if ((rsp.status & 0x7f00))
+				rc = rsp.rsp0;
+		}
+	} else {
+		// --- first access so that we can write the rid data
+		if ( (status = PC4500_accessrid(ai, rid, CMD_ACCESS)) != 0) {
+	                rc = status;
+	                goto done;
+	        }
+		// --- now write the rid data
+		if (bap_setup(ai, rid, 0, BAP1) != SUCCESS) {
+	                rc = ERROR;
+	                goto done;
+	        }
+		bap_write(ai, pBuf, len, BAP1);
+		// ---now commit the rid data
+		rc = PC4500_accessrid(ai, rid, 0x100|CMD_ACCESS);
+	}
+done:
+	if (lock)
+		up(&ai->sem);
+        return rc;
+}
+
+/* Allocates a FID to be used for transmitting packets.  We only use
+   one for now. */
+static u16 transmit_allocate(struct airo_info *ai, int lenPayload, int raw)
+{
+	unsigned int loop = 3000;
+	Cmd cmd;
+	Resp rsp;
+	u16 txFid;
+	u16 txControl;
+
+	cmd.cmd = CMD_ALLOCATETX;
+	cmd.parm0 = lenPayload;
+	if (down_interruptible(&ai->sem))
+		return ERROR;
+	if (issuecommand(ai, &cmd, &rsp) != SUCCESS) {
+		txFid = ERROR;
+		goto done;
+	}
+	if ( (rsp.status & 0xFF00) != 0) {
+		txFid = ERROR;
+		goto done;
+	}
+	/* wait for the allocate event/indication
+	 * It makes me kind of nervous that this can just sit here and spin,
+	 * but in practice it only loops like four times. */
+	while (((IN4500(ai, EVSTAT) & EV_ALLOC) == 0) && --loop);
+	if (!loop) {
+		txFid = ERROR;
+		goto done;
+	}
+
+	// get the allocated fid and acknowledge
+	txFid = IN4500(ai, TXALLOCFID);
+	OUT4500(ai, EVACK, EV_ALLOC);
+
+	/*  The CARD is pretty cool since it converts the ethernet packet
+	 *  into 802.11.  Also note that we don't release the FID since we
+	 *  will be using the same one over and over again. */
+	/*  We only have to setup the control once since we are not
+	 *  releasing the fid. */
+	if (raw)
+		txControl = cpu_to_le16(TXCTL_TXOK | TXCTL_TXEX | TXCTL_802_11
+			| TXCTL_ETHERNET | TXCTL_NORELEASE);
+	else
+		txControl = cpu_to_le16(TXCTL_TXOK | TXCTL_TXEX | TXCTL_802_3
+			| TXCTL_ETHERNET | TXCTL_NORELEASE);
+	if (bap_setup(ai, txFid, 0x0008, BAP1) != SUCCESS)
+		txFid = ERROR;
+	else
+		bap_write(ai, &txControl, sizeof(txControl), BAP1);
+
+done:
+	up(&ai->sem);
+
+	return txFid;
+}
+
+/* In general BAP1 is dedicated to transmiting packets.  However,
+   since we need a BAP when accessing RIDs, we also use BAP1 for that.
+   Make sure the BAP1 spinlock is held when this is called. */
+static int transmit_802_3_packet(struct airo_info *ai, int len, char *pPacket)
+{
+	u16 payloadLen;
+	Cmd cmd;
+	Resp rsp;
+	int miclen = 0;
+	u16 txFid = len;
+	MICBuffer pMic;
+
+	len >>= 16;
+
+	if (len <= ETH_ALEN * 2) {
+		printk( KERN_WARNING "Short packet %d\n", len );
+		return ERROR;
+	}
+	len -= ETH_ALEN * 2;
+
+#ifdef MICSUPPORT
+	if (test_bit(FLAG_MIC_CAPABLE, &ai->flags) && ai->micstats.enabled && 
+	    (ntohs(((u16 *)pPacket)[6]) != 0x888E)) {
+		if (encapsulate(ai,(etherHead *)pPacket,&pMic,len) != SUCCESS)
+			return ERROR;
+		miclen = sizeof(pMic);
+	}
+#endif
+
+	// packet is destination[6], source[6], payload[len-12]
+	// write the payload length and dst/src/payload
+	if (bap_setup(ai, txFid, 0x0036, BAP1) != SUCCESS) return ERROR;
+	/* The hardware addresses aren't counted as part of the payload, so
+	 * we have to subtract the 12 bytes for the addresses off */
+	payloadLen = cpu_to_le16(len + miclen);
+	bap_write(ai, &payloadLen, sizeof(payloadLen),BAP1);
+	bap_write(ai, (const u16*)pPacket, sizeof(etherHead), BAP1);
+	if (miclen)
+		bap_write(ai, (const u16*)&pMic, miclen, BAP1);
+	bap_write(ai, (const u16*)(pPacket + sizeof(etherHead)), len, BAP1);
+	// issue the transmit command
+	memset( &cmd, 0, sizeof( cmd ) );
+	cmd.cmd = CMD_TRANSMIT;
+	cmd.parm0 = txFid;
+	if (issuecommand(ai, &cmd, &rsp) != SUCCESS) return ERROR;
+	if ( (rsp.status & 0xFF00) != 0) return ERROR;
+	return SUCCESS;
+}
+
+static int transmit_802_11_packet(struct airo_info *ai, int len, char *pPacket)
+{
+	u16 fc, payloadLen;
+	Cmd cmd;
+	Resp rsp;
+	int hdrlen;
+	struct {
+		u8 addr4[ETH_ALEN];
+		u16 gaplen;
+		u8 gap[6];
+	} gap;
+	u16 txFid = len;
+	len >>= 16;
+	gap.gaplen = 6;
+
+	fc = le16_to_cpu(*(const u16*)pPacket);
+	switch (fc & 0xc) {
+		case 4:
+			if ((fc & 0xe0) == 0xc0)
+				hdrlen = 10;
+			else
+				hdrlen = 16;
+			break;
+		case 8:
+			if ((fc&0x300)==0x300){
+				hdrlen = 30;
+				break;
+			}
+		default:
+			hdrlen = 24;
+	}
+
+	if (len < hdrlen) {
+		printk( KERN_WARNING "Short packet %d\n", len );
+		return ERROR;
+	}
+
+	/* packet is 802.11 header +  payload
+	 * write the payload length and dst/src/payload */
+	if (bap_setup(ai, txFid, 6, BAP1) != SUCCESS) return ERROR;
+	/* The 802.11 header aren't counted as part of the payload, so
+	 * we have to subtract the header bytes off */
+	payloadLen = cpu_to_le16(len-hdrlen);
+	bap_write(ai, &payloadLen, sizeof(payloadLen),BAP1);
+	if (bap_setup(ai, txFid, 0x0014, BAP1) != SUCCESS) return ERROR;
+	bap_write(ai, (const u16*)pPacket, hdrlen, BAP1);
+	bap_write(ai, hdrlen == 30 ?
+		(const u16*)&gap.gaplen : (const u16*)&gap, 38 - hdrlen, BAP1);
+
+	bap_write(ai, (const u16*)(pPacket + hdrlen), len - hdrlen, BAP1);
+	// issue the transmit command
+	memset( &cmd, 0, sizeof( cmd ) );
+	cmd.cmd = CMD_TRANSMIT;
+	cmd.parm0 = txFid;
+	if (issuecommand(ai, &cmd, &rsp) != SUCCESS) return ERROR;
+	if ( (rsp.status & 0xFF00) != 0) return ERROR;
+	return SUCCESS;
+}
+
+/*
+ *  This is the proc_fs routines.  It is a bit messier than I would
+ *  like!  Feel free to clean it up!
+ */
+
+static ssize_t proc_read( struct file *file,
+			  char __user *buffer,
+			  size_t len,
+			  loff_t *offset);
+
+static ssize_t proc_write( struct file *file,
+			   const char __user *buffer,
+			   size_t len,
+			   loff_t *offset );
+static int proc_close( struct inode *inode, struct file *file );
+
+static int proc_stats_open( struct inode *inode, struct file *file );
+static int proc_statsdelta_open( struct inode *inode, struct file *file );
+static int proc_status_open( struct inode *inode, struct file *file );
+static int proc_SSID_open( struct inode *inode, struct file *file );
+static int proc_APList_open( struct inode *inode, struct file *file );
+static int proc_BSSList_open( struct inode *inode, struct file *file );
+static int proc_config_open( struct inode *inode, struct file *file );
+static int proc_wepkey_open( struct inode *inode, struct file *file );
+
+static struct file_operations proc_statsdelta_ops = {
+	.read		= proc_read,
+	.open		= proc_statsdelta_open,
+	.release	= proc_close
+};
+
+static struct file_operations proc_stats_ops = {
+	.read		= proc_read,
+	.open		= proc_stats_open,
+	.release	= proc_close
+};
+
+static struct file_operations proc_status_ops = {
+	.read		= proc_read,
+	.open		= proc_status_open,
+	.release	= proc_close
+};
+
+static struct file_operations proc_SSID_ops = {
+	.read		= proc_read,
+	.write		= proc_write,
+	.open		= proc_SSID_open,
+	.release	= proc_close
+};
+
+static struct file_operations proc_BSSList_ops = {
+	.read		= proc_read,
+	.write		= proc_write,
+	.open		= proc_BSSList_open,
+	.release	= proc_close
+};
+
+static struct file_operations proc_APList_ops = {
+	.read		= proc_read,
+	.write		= proc_write,
+	.open		= proc_APList_open,
+	.release	= proc_close
+};
+
+static struct file_operations proc_config_ops = {
+	.read		= proc_read,
+	.write		= proc_write,
+	.open		= proc_config_open,
+	.release	= proc_close
+};
+
+static struct file_operations proc_wepkey_ops = {
+	.read		= proc_read,
+	.write		= proc_write,
+	.open		= proc_wepkey_open,
+	.release	= proc_close
+};
+
+static struct proc_dir_entry *airo_entry;
+
+struct proc_data {
+	int release_buffer;
+	int readlen;
+	char *rbuffer;
+	int writelen;
+	int maxwritelen;
+	char *wbuffer;
+	void (*on_close) (struct inode *, struct file *);
+};
+
+#ifndef SETPROC_OPS
+#define SETPROC_OPS(entry, ops) (entry)->proc_fops = &(ops)
+#endif
+
+static int setup_proc_entry( struct net_device *dev,
+			     struct airo_info *apriv ) {
+	struct proc_dir_entry *entry;
+	/* First setup the device directory */
+	strcpy(apriv->proc_name,dev->name);
+	apriv->proc_entry = create_proc_entry(apriv->proc_name,
+					      S_IFDIR|airo_perm,
+					      airo_entry);
+        apriv->proc_entry->uid = proc_uid;
+        apriv->proc_entry->gid = proc_gid;
+        apriv->proc_entry->owner = THIS_MODULE;
+
+	/* Setup the StatsDelta */
+	entry = create_proc_entry("StatsDelta",
+				  S_IFREG | (S_IRUGO&proc_perm),
+				  apriv->proc_entry);
+        entry->uid = proc_uid;
+        entry->gid = proc_gid;
+	entry->data = dev;
+        entry->owner = THIS_MODULE;
+	SETPROC_OPS(entry, proc_statsdelta_ops);
+
+	/* Setup the Stats */
+	entry = create_proc_entry("Stats",
+				  S_IFREG | (S_IRUGO&proc_perm),
+				  apriv->proc_entry);
+        entry->uid = proc_uid;
+        entry->gid = proc_gid;
+	entry->data = dev;
+        entry->owner = THIS_MODULE;
+	SETPROC_OPS(entry, proc_stats_ops);
+
+	/* Setup the Status */
+	entry = create_proc_entry("Status",
+				  S_IFREG | (S_IRUGO&proc_perm),
+				  apriv->proc_entry);
+        entry->uid = proc_uid;
+        entry->gid = proc_gid;
+	entry->data = dev;
+        entry->owner = THIS_MODULE;
+	SETPROC_OPS(entry, proc_status_ops);
+
+	/* Setup the Config */
+	entry = create_proc_entry("Config",
+				  S_IFREG | proc_perm,
+				  apriv->proc_entry);
+        entry->uid = proc_uid;
+        entry->gid = proc_gid;
+	entry->data = dev;
+        entry->owner = THIS_MODULE;
+	SETPROC_OPS(entry, proc_config_ops);
+
+	/* Setup the SSID */
+	entry = create_proc_entry("SSID",
+				  S_IFREG | proc_perm,
+				  apriv->proc_entry);
+        entry->uid = proc_uid;
+        entry->gid = proc_gid;
+	entry->data = dev;
+        entry->owner = THIS_MODULE;
+	SETPROC_OPS(entry, proc_SSID_ops);
+
+	/* Setup the APList */
+	entry = create_proc_entry("APList",
+				  S_IFREG | proc_perm,
+				  apriv->proc_entry);
+        entry->uid = proc_uid;
+        entry->gid = proc_gid;
+	entry->data = dev;
+        entry->owner = THIS_MODULE;
+	SETPROC_OPS(entry, proc_APList_ops);
+
+	/* Setup the BSSList */
+	entry = create_proc_entry("BSSList",
+				  S_IFREG | proc_perm,
+				  apriv->proc_entry);
+	entry->uid = proc_uid;
+	entry->gid = proc_gid;
+	entry->data = dev;
+        entry->owner = THIS_MODULE;
+	SETPROC_OPS(entry, proc_BSSList_ops);
+
+	/* Setup the WepKey */
+	entry = create_proc_entry("WepKey",
+				  S_IFREG | proc_perm,
+				  apriv->proc_entry);
+        entry->uid = proc_uid;
+        entry->gid = proc_gid;
+	entry->data = dev;
+        entry->owner = THIS_MODULE;
+	SETPROC_OPS(entry, proc_wepkey_ops);
+
+	return 0;
+}
+
+static int takedown_proc_entry( struct net_device *dev,
+				struct airo_info *apriv ) {
+	if ( !apriv->proc_entry->namelen ) return 0;
+	remove_proc_entry("Stats",apriv->proc_entry);
+	remove_proc_entry("StatsDelta",apriv->proc_entry);
+	remove_proc_entry("Status",apriv->proc_entry);
+	remove_proc_entry("Config",apriv->proc_entry);
+	remove_proc_entry("SSID",apriv->proc_entry);
+	remove_proc_entry("APList",apriv->proc_entry);
+	remove_proc_entry("BSSList",apriv->proc_entry);
+	remove_proc_entry("WepKey",apriv->proc_entry);
+	remove_proc_entry(apriv->proc_name,airo_entry);
+	return 0;
+}
+
+/*
+ *  What we want from the proc_fs is to be able to efficiently read
+ *  and write the configuration.  To do this, we want to read the
+ *  configuration when the file is opened and write it when the file is
+ *  closed.  So basically we allocate a read buffer at open and fill it
+ *  with data, and allocate a write buffer and read it at close.
+ */
+
+/*
+ *  The read routine is generic, it relies on the preallocated rbuffer
+ *  to supply the data.
+ */
+static ssize_t proc_read( struct file *file,
+			  char __user *buffer,
+			  size_t len,
+			  loff_t *offset )
+{
+	loff_t pos = *offset;
+	struct proc_data *priv = (struct proc_data*)file->private_data;
+
+	if (!priv->rbuffer)
+		return -EINVAL;
+
+	if (pos < 0)
+		return -EINVAL;
+	if (pos >= priv->readlen)
+		return 0;
+	if (len > priv->readlen - pos)
+		len = priv->readlen - pos;
+	if (copy_to_user(buffer, priv->rbuffer + pos, len))
+		return -EFAULT;
+	*offset = pos + len;
+	return len;
+}
+
+/*
+ *  The write routine is generic, it fills in a preallocated rbuffer
+ *  to supply the data.
+ */
+static ssize_t proc_write( struct file *file,
+			   const char __user *buffer,
+			   size_t len,
+			   loff_t *offset )
+{
+	loff_t pos = *offset;
+	struct proc_data *priv = (struct proc_data*)file->private_data;
+
+	if (!priv->wbuffer)
+		return -EINVAL;
+
+	if (pos < 0)
+		return -EINVAL;
+	if (pos >= priv->maxwritelen)
+		return 0;
+	if (len > priv->maxwritelen - pos)
+		len = priv->maxwritelen - pos;
+	if (copy_from_user(priv->wbuffer + pos, buffer, len))
+		return -EFAULT;
+	if ( pos + len > priv->writelen )
+		priv->writelen = len + file->f_pos;
+	*offset = pos + len;
+	return len;
+}
+
+static int proc_status_open( struct inode *inode, struct file *file ) {
+	struct proc_data *data;
+	struct proc_dir_entry *dp = PDE(inode);
+	struct net_device *dev = dp->data;
+	struct airo_info *apriv = dev->priv;
+	CapabilityRid cap_rid;
+	StatusRid status_rid;
+	int i;
+
+	if ((file->private_data = kmalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
+		return -ENOMEM;
+	memset(file->private_data, 0, sizeof(struct proc_data));
+	data = (struct proc_data *)file->private_data;
+	if ((data->rbuffer = kmalloc( 2048, GFP_KERNEL )) == NULL) {
+		kfree (file->private_data);
+		return -ENOMEM;
+	}
+
+	readStatusRid(apriv, &status_rid, 1);
+	readCapabilityRid(apriv, &cap_rid, 1);
+
+        i = sprintf(data->rbuffer, "Status: %s%s%s%s%s%s%s%s%s\n",
+                    status_rid.mode & 1 ? "CFG ": "",
+                    status_rid.mode & 2 ? "ACT ": "",
+                    status_rid.mode & 0x10 ? "SYN ": "",
+                    status_rid.mode & 0x20 ? "LNK ": "",
+                    status_rid.mode & 0x40 ? "LEAP ": "",
+                    status_rid.mode & 0x80 ? "PRIV ": "",
+                    status_rid.mode & 0x100 ? "KEY ": "",
+                    status_rid.mode & 0x200 ? "WEP ": "",
+                    status_rid.mode & 0x8000 ? "ERR ": "");
+	sprintf( data->rbuffer+i, "Mode: %x\n"
+		 "Signal Strength: %d\n"
+		 "Signal Quality: %d\n"
+		 "SSID: %-.*s\n"
+		 "AP: %-.16s\n"
+		 "Freq: %d\n"
+		 "BitRate: %dmbs\n"
+		 "Driver Version: %s\n"
+		 "Device: %s\nManufacturer: %s\nFirmware Version: %s\n"
+		 "Radio type: %x\nCountry: %x\nHardware Version: %x\n"
+		 "Software Version: %x\nSoftware Subversion: %x\n"
+		 "Boot block version: %x\n",
+		 (int)status_rid.mode,
+		 (int)status_rid.normalizedSignalStrength,
+		 (int)status_rid.signalQuality,
+		 (int)status_rid.SSIDlen,
+		 status_rid.SSID,
+		 status_rid.apName,
+		 (int)status_rid.channel,
+		 (int)status_rid.currentXmitRate/2,
+		 version,
+		 cap_rid.prodName,
+		 cap_rid.manName,
+		 cap_rid.prodVer,
+		 cap_rid.radioType,
+		 cap_rid.country,
+		 cap_rid.hardVer,
+		 (int)cap_rid.softVer,
+		 (int)cap_rid.softSubVer,
+		 (int)cap_rid.bootBlockVer );
+	data->readlen = strlen( data->rbuffer );
+	return 0;
+}
+
+static int proc_stats_rid_open(struct inode*, struct file*, u16);
+static int proc_statsdelta_open( struct inode *inode,
+				 struct file *file ) {
+	if (file->f_mode&FMODE_WRITE) {
+		return proc_stats_rid_open(inode, file, RID_STATSDELTACLEAR);
+	}
+	return proc_stats_rid_open(inode, file, RID_STATSDELTA);
+}
+
+static int proc_stats_open( struct inode *inode, struct file *file ) {
+	return proc_stats_rid_open(inode, file, RID_STATS);
+}
+
+static int proc_stats_rid_open( struct inode *inode,
+				struct file *file,
+				u16 rid ) {
+	struct proc_data *data;
+	struct proc_dir_entry *dp = PDE(inode);
+	struct net_device *dev = dp->data;
+	struct airo_info *apriv = dev->priv;
+	StatsRid stats;
+	int i, j;
+	u32 *vals = stats.vals;
+
+	if ((file->private_data = kmalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
+		return -ENOMEM;
+	memset(file->private_data, 0, sizeof(struct proc_data));
+	data = (struct proc_data *)file->private_data;
+	if ((data->rbuffer = kmalloc( 4096, GFP_KERNEL )) == NULL) {
+		kfree (file->private_data);
+		return -ENOMEM;
+	}
+
+	readStatsRid(apriv, &stats, rid, 1);
+
+        j = 0;
+	for(i=0; statsLabels[i]!=(char *)-1 &&
+		    i*4<stats.len; i++){
+		if (!statsLabels[i]) continue;
+		if (j+strlen(statsLabels[i])+16>4096) {
+			printk(KERN_WARNING
+			       "airo: Potentially disasterous buffer overflow averted!\n");
+			break;
+		}
+		j+=sprintf(data->rbuffer+j, "%s: %u\n", statsLabels[i], vals[i]);
+	}
+	if (i*4>=stats.len){
+		printk(KERN_WARNING
+		       "airo: Got a short rid\n");
+	}
+	data->readlen = j;
+	return 0;
+}
+
+static int get_dec_u16( char *buffer, int *start, int limit ) {
+	u16 value;
+	int valid = 0;
+	for( value = 0; buffer[*start] >= '0' &&
+		     buffer[*start] <= '9' &&
+		     *start < limit; (*start)++ ) {
+		valid = 1;
+		value *= 10;
+		value += buffer[*start] - '0';
+	}
+	if ( !valid ) return -1;
+	return value;
+}
+
+static int airo_config_commit(struct net_device *dev,
+			      struct iw_request_info *info, void *zwrq,
+			      char *extra);
+
+static void proc_config_on_close( struct inode *inode, struct file *file ) {
+	struct proc_data *data = file->private_data;
+	struct proc_dir_entry *dp = PDE(inode);
+	struct net_device *dev = dp->data;
+	struct airo_info *ai = dev->priv;
+	char *line;
+
+	if ( !data->writelen ) return;
+
+	readConfigRid(ai, 1);
+	set_bit (FLAG_COMMIT, &ai->flags);
+
+	line = data->wbuffer;
+	while( line[0] ) {
+/*** Mode processing */
+		if ( !strncmp( line, "Mode: ", 6 ) ) {
+			line += 6;
+			if ((ai->config.rmode & 0xff) >= RXMODE_RFMON)
+					set_bit (FLAG_RESET, &ai->flags);
+			ai->config.rmode &= 0xfe00;
+			clear_bit (FLAG_802_11, &ai->flags);
+			ai->config.opmode &= 0xFF00;
+			ai->config.scanMode = SCANMODE_ACTIVE;
+			if ( line[0] == 'a' ) {
+				ai->config.opmode |= 0;
+			} else {
+				ai->config.opmode |= 1;
+				if ( line[0] == 'r' ) {
+					ai->config.rmode |= RXMODE_RFMON | RXMODE_DISABLE_802_3_HEADER;
+					ai->config.scanMode = SCANMODE_PASSIVE;
+					set_bit (FLAG_802_11, &ai->flags);
+				} else if ( line[0] == 'y' ) {
+					ai->config.rmode |= RXMODE_RFMON_ANYBSS | RXMODE_DISABLE_802_3_HEADER;
+					ai->config.scanMode = SCANMODE_PASSIVE;
+					set_bit (FLAG_802_11, &ai->flags);
+				} else if ( line[0] == 'l' )
+					ai->config.rmode |= RXMODE_LANMON;
+			}
+			set_bit (FLAG_COMMIT, &ai->flags);
+		}
+
+/*** Radio status */
+		else if (!strncmp(line,"Radio: ", 7)) {
+			line += 7;
+			if (!strncmp(line,"off",3)) {
+				set_bit (FLAG_RADIO_OFF, &ai->flags);
+			} else {
+				clear_bit (FLAG_RADIO_OFF, &ai->flags);
+			}
+		}
+/*** NodeName processing */
+		else if ( !strncmp( line, "NodeName: ", 10 ) ) {
+			int j;
+
+			line += 10;
+			memset( ai->config.nodeName, 0, 16 );
+/* Do the name, assume a space between the mode and node name */
+			for( j = 0; j < 16 && line[j] != '\n'; j++ ) {
+				ai->config.nodeName[j] = line[j];
+			}
+			set_bit (FLAG_COMMIT, &ai->flags);
+		}
+
+/*** PowerMode processing */
+		else if ( !strncmp( line, "PowerMode: ", 11 ) ) {
+			line += 11;
+			if ( !strncmp( line, "PSPCAM", 6 ) ) {
+				ai->config.powerSaveMode = POWERSAVE_PSPCAM;
+				set_bit (FLAG_COMMIT, &ai->flags);
+			} else if ( !strncmp( line, "PSP", 3 ) ) {
+				ai->config.powerSaveMode = POWERSAVE_PSP;
+				set_bit (FLAG_COMMIT, &ai->flags);
+			} else {
+				ai->config.powerSaveMode = POWERSAVE_CAM;
+				set_bit (FLAG_COMMIT, &ai->flags);
+			}
+		} else if ( !strncmp( line, "DataRates: ", 11 ) ) {
+			int v, i = 0, k = 0; /* i is index into line,
+						k is index to rates */
+
+			line += 11;
+			while((v = get_dec_u16(line, &i, 3))!=-1) {
+				ai->config.rates[k++] = (u8)v;
+				line += i + 1;
+				i = 0;
+			}
+			set_bit (FLAG_COMMIT, &ai->flags);
+		} else if ( !strncmp( line, "Channel: ", 9 ) ) {
+			int v, i = 0;
+			line += 9;
+			v = get_dec_u16(line, &i, i+3);
+			if ( v != -1 ) {
+				ai->config.channelSet = (u16)v;
+				set_bit (FLAG_COMMIT, &ai->flags);
+			}
+		} else if ( !strncmp( line, "XmitPower: ", 11 ) ) {
+			int v, i = 0;
+			line += 11;
+			v = get_dec_u16(line, &i, i+3);
+			if ( v != -1 ) {
+				ai->config.txPower = (u16)v;
+				set_bit (FLAG_COMMIT, &ai->flags);
+			}
+		} else if ( !strncmp( line, "WEP: ", 5 ) ) {
+			line += 5;
+			switch( line[0] ) {
+			case 's':
+				ai->config.authType = (u16)AUTH_SHAREDKEY;
+				break;
+			case 'e':
+				ai->config.authType = (u16)AUTH_ENCRYPT;
+				break;
+			default:
+				ai->config.authType = (u16)AUTH_OPEN;
+				break;
+			}
+			set_bit (FLAG_COMMIT, &ai->flags);
+		} else if ( !strncmp( line, "LongRetryLimit: ", 16 ) ) {
+			int v, i = 0;
+
+			line += 16;
+			v = get_dec_u16(line, &i, 3);
+			v = (v<0) ? 0 : ((v>255) ? 255 : v);
+			ai->config.longRetryLimit = (u16)v;
+			set_bit (FLAG_COMMIT, &ai->flags);
+		} else if ( !strncmp( line, "ShortRetryLimit: ", 17 ) ) {
+			int v, i = 0;
+
+			line += 17;
+			v = get_dec_u16(line, &i, 3);
+			v = (v<0) ? 0 : ((v>255) ? 255 : v);
+			ai->config.shortRetryLimit = (u16)v;
+			set_bit (FLAG_COMMIT, &ai->flags);
+		} else if ( !strncmp( line, "RTSThreshold: ", 14 ) ) {
+			int v, i = 0;
+
+			line += 14;
+			v = get_dec_u16(line, &i, 4);
+			v = (v<0) ? 0 : ((v>2312) ? 2312 : v);
+			ai->config.rtsThres = (u16)v;
+			set_bit (FLAG_COMMIT, &ai->flags);
+		} else if ( !strncmp( line, "TXMSDULifetime: ", 16 ) ) {
+			int v, i = 0;
+
+			line += 16;
+			v = get_dec_u16(line, &i, 5);
+			v = (v<0) ? 0 : v;
+			ai->config.txLifetime = (u16)v;
+			set_bit (FLAG_COMMIT, &ai->flags);
+		} else if ( !strncmp( line, "RXMSDULifetime: ", 16 ) ) {
+			int v, i = 0;
+
+			line += 16;
+			v = get_dec_u16(line, &i, 5);
+			v = (v<0) ? 0 : v;
+			ai->config.rxLifetime = (u16)v;
+			set_bit (FLAG_COMMIT, &ai->flags);
+		} else if ( !strncmp( line, "TXDiversity: ", 13 ) ) {
+			ai->config.txDiversity =
+				(line[13]=='l') ? 1 :
+				((line[13]=='r')? 2: 3);
+			set_bit (FLAG_COMMIT, &ai->flags);
+		} else if ( !strncmp( line, "RXDiversity: ", 13 ) ) {
+			ai->config.rxDiversity =
+				(line[13]=='l') ? 1 :
+				((line[13]=='r')? 2: 3);
+			set_bit (FLAG_COMMIT, &ai->flags);
+		} else if ( !strncmp( line, "FragThreshold: ", 15 ) ) {
+			int v, i = 0;
+
+			line += 15;
+			v = get_dec_u16(line, &i, 4);
+			v = (v<256) ? 256 : ((v>2312) ? 2312 : v);
+			v = v & 0xfffe; /* Make sure its even */
+			ai->config.fragThresh = (u16)v;
+			set_bit (FLAG_COMMIT, &ai->flags);
+		} else if (!strncmp(line, "Modulation: ", 12)) {
+			line += 12;
+			switch(*line) {
+			case 'd':  ai->config.modulation=MOD_DEFAULT; set_bit(FLAG_COMMIT, &ai->flags); break;
+			case 'c':  ai->config.modulation=MOD_CCK; set_bit(FLAG_COMMIT, &ai->flags); break;
+			case 'm':  ai->config.modulation=MOD_MOK; set_bit(FLAG_COMMIT, &ai->flags); break;
+			default:
+				printk( KERN_WARNING "airo: Unknown modulation\n" );
+			}
+		} else if (!strncmp(line, "Preamble: ", 10)) {
+			line += 10;
+			switch(*line) {
+			case 'a': ai->config.preamble=PREAMBLE_AUTO; set_bit(FLAG_COMMIT, &ai->flags); break;
+			case 'l': ai->config.preamble=PREAMBLE_LONG; set_bit(FLAG_COMMIT, &ai->flags); break;
+			case 's': ai->config.preamble=PREAMBLE_SHORT; set_bit(FLAG_COMMIT, &ai->flags); break;
+		        default: printk(KERN_WARNING "airo: Unknown preamble\n");
+			}
+		} else {
+			printk( KERN_WARNING "Couldn't figure out %s\n", line );
+		}
+		while( line[0] && line[0] != '\n' ) line++;
+		if ( line[0] ) line++;
+	}
+	airo_config_commit(dev, NULL, NULL, NULL);
+}
+
+static char *get_rmode(u16 mode) {
+        switch(mode&0xff) {
+        case RXMODE_RFMON:  return "rfmon";
+        case RXMODE_RFMON_ANYBSS:  return "yna (any) bss rfmon";
+        case RXMODE_LANMON:  return "lanmon";
+        }
+        return "ESS";
+}
+
+static int proc_config_open( struct inode *inode, struct file *file ) {
+	struct proc_data *data;
+	struct proc_dir_entry *dp = PDE(inode);
+	struct net_device *dev = dp->data;
+	struct airo_info *ai = dev->priv;
+	int i;
+
+	if ((file->private_data = kmalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
+		return -ENOMEM;
+	memset(file->private_data, 0, sizeof(struct proc_data));
+	data = (struct proc_data *)file->private_data;
+	if ((data->rbuffer = kmalloc( 2048, GFP_KERNEL )) == NULL) {
+		kfree (file->private_data);
+		return -ENOMEM;
+	}
+	if ((data->wbuffer = kmalloc( 2048, GFP_KERNEL )) == NULL) {
+		kfree (data->rbuffer);
+		kfree (file->private_data);
+		return -ENOMEM;
+	}
+	memset( data->wbuffer, 0, 2048 );
+	data->maxwritelen = 2048;
+	data->on_close = proc_config_on_close;
+
+	readConfigRid(ai, 1);
+
+	i = sprintf( data->rbuffer,
+		     "Mode: %s\n"
+		     "Radio: %s\n"
+		     "NodeName: %-16s\n"
+		     "PowerMode: %s\n"
+		     "DataRates: %d %d %d %d %d %d %d %d\n"
+		     "Channel: %d\n"
+		     "XmitPower: %d\n",
+		     (ai->config.opmode & 0xFF) == 0 ? "adhoc" :
+		     (ai->config.opmode & 0xFF) == 1 ? get_rmode(ai->config.rmode):
+		     (ai->config.opmode & 0xFF) == 2 ? "AP" :
+		     (ai->config.opmode & 0xFF) == 3 ? "AP RPTR" : "Error",
+		     test_bit(FLAG_RADIO_OFF, &ai->flags) ? "off" : "on",
+		     ai->config.nodeName,
+		     ai->config.powerSaveMode == 0 ? "CAM" :
+		     ai->config.powerSaveMode == 1 ? "PSP" :
+		     ai->config.powerSaveMode == 2 ? "PSPCAM" : "Error",
+		     (int)ai->config.rates[0],
+		     (int)ai->config.rates[1],
+		     (int)ai->config.rates[2],
+		     (int)ai->config.rates[3],
+		     (int)ai->config.rates[4],
+		     (int)ai->config.rates[5],
+		     (int)ai->config.rates[6],
+		     (int)ai->config.rates[7],
+		     (int)ai->config.channelSet,
+		     (int)ai->config.txPower
+		);
+	sprintf( data->rbuffer + i,
+		 "LongRetryLimit: %d\n"
+		 "ShortRetryLimit: %d\n"
+		 "RTSThreshold: %d\n"
+		 "TXMSDULifetime: %d\n"
+		 "RXMSDULifetime: %d\n"
+		 "TXDiversity: %s\n"
+		 "RXDiversity: %s\n"
+		 "FragThreshold: %d\n"
+		 "WEP: %s\n"
+		 "Modulation: %s\n"
+		 "Preamble: %s\n",
+		 (int)ai->config.longRetryLimit,
+		 (int)ai->config.shortRetryLimit,
+		 (int)ai->config.rtsThres,
+		 (int)ai->config.txLifetime,
+		 (int)ai->config.rxLifetime,
+		 ai->config.txDiversity == 1 ? "left" :
+		 ai->config.txDiversity == 2 ? "right" : "both",
+		 ai->config.rxDiversity == 1 ? "left" :
+		 ai->config.rxDiversity == 2 ? "right" : "both",
+		 (int)ai->config.fragThresh,
+		 ai->config.authType == AUTH_ENCRYPT ? "encrypt" :
+		 ai->config.authType == AUTH_SHAREDKEY ? "shared" : "open",
+		 ai->config.modulation == 0 ? "default" :
+		 ai->config.modulation == MOD_CCK ? "cck" :
+		 ai->config.modulation == MOD_MOK ? "mok" : "error",
+		 ai->config.preamble == PREAMBLE_AUTO ? "auto" :
+		 ai->config.preamble == PREAMBLE_LONG ? "long" :
+		 ai->config.preamble == PREAMBLE_SHORT ? "short" : "error"
+		);
+	data->readlen = strlen( data->rbuffer );
+	return 0;
+}
+
+static void proc_SSID_on_close( struct inode *inode, struct file *file ) {
+	struct proc_data *data = (struct proc_data *)file->private_data;
+	struct proc_dir_entry *dp = PDE(inode);
+	struct net_device *dev = dp->data;
+	struct airo_info *ai = dev->priv;
+	SsidRid SSID_rid;
+	Resp rsp;
+	int i;
+	int offset = 0;
+
+	if ( !data->writelen ) return;
+
+	memset( &SSID_rid, 0, sizeof( SSID_rid ) );
+
+	for( i = 0; i < 3; i++ ) {
+		int j;
+		for( j = 0; j+offset < data->writelen && j < 32 &&
+			     data->wbuffer[offset+j] != '\n'; j++ ) {
+			SSID_rid.ssids[i].ssid[j] = data->wbuffer[offset+j];
+		}
+		if ( j == 0 ) break;
+		SSID_rid.ssids[i].len = j;
+		offset += j;
+		while( data->wbuffer[offset] != '\n' &&
+		       offset < data->writelen ) offset++;
+		offset++;
+	}
+	if (i)
+		SSID_rid.len = sizeof(SSID_rid);
+	disable_MAC(ai, 1);
+	writeSsidRid(ai, &SSID_rid, 1);
+	enable_MAC(ai, &rsp, 1);
+}
+
+inline static u8 hexVal(char c) {
+	if (c>='0' && c<='9') return c -= '0';
+	if (c>='a' && c<='f') return c -= 'a'-10;
+	if (c>='A' && c<='F') return c -= 'A'-10;
+	return 0;
+}
+
+static void proc_APList_on_close( struct inode *inode, struct file *file ) {
+	struct proc_data *data = (struct proc_data *)file->private_data;
+	struct proc_dir_entry *dp = PDE(inode);
+	struct net_device *dev = dp->data;
+	struct airo_info *ai = dev->priv;
+	APListRid APList_rid;
+	Resp rsp;
+	int i;
+
+	if ( !data->writelen ) return;
+
+	memset( &APList_rid, 0, sizeof(APList_rid) );
+	APList_rid.len = sizeof(APList_rid);
+
+	for( i = 0; i < 4 && data->writelen >= (i+1)*6*3; i++ ) {
+		int j;
+		for( j = 0; j < 6*3 && data->wbuffer[j+i*6*3]; j++ ) {
+			switch(j%3) {
+			case 0:
+				APList_rid.ap[i][j/3]=
+					hexVal(data->wbuffer[j+i*6*3])<<4;
+				break;
+			case 1:
+				APList_rid.ap[i][j/3]|=
+					hexVal(data->wbuffer[j+i*6*3]);
+				break;
+			}
+		}
+	}
+	disable_MAC(ai, 1);
+	writeAPListRid(ai, &APList_rid, 1);
+	enable_MAC(ai, &rsp, 1);
+}
+
+/* This function wraps PC4500_writerid with a MAC disable */
+static int do_writerid( struct airo_info *ai, u16 rid, const void *rid_data,
+			int len, int dummy ) {
+	int rc;
+	Resp rsp;
+
+	disable_MAC(ai, 1);
+	rc = PC4500_writerid(ai, rid, rid_data, len, 1);
+	enable_MAC(ai, &rsp, 1);
+	return rc;
+}
+
+/* Returns the length of the key at the index.  If index == 0xffff
+ * the index of the transmit key is returned.  If the key doesn't exist,
+ * -1 will be returned.
+ */
+static int get_wep_key(struct airo_info *ai, u16 index) {
+	WepKeyRid wkr;
+	int rc;
+	u16 lastindex;
+
+	rc = readWepKeyRid(ai, &wkr, 1, 1);
+	if (rc == SUCCESS) do {
+		lastindex = wkr.kindex;
+		if (wkr.kindex == index) {
+			if (index == 0xffff) {
+				return wkr.mac[0];
+			}
+			return wkr.klen;
+		}
+		readWepKeyRid(ai, &wkr, 0, 1);
+	} while(lastindex != wkr.kindex);
+	return -1;
+}
+
+static int set_wep_key(struct airo_info *ai, u16 index,
+		       const char *key, u16 keylen, int perm, int lock ) {
+	static const unsigned char macaddr[ETH_ALEN] = { 0x01, 0, 0, 0, 0, 0 };
+	WepKeyRid wkr;
+	Resp rsp;
+
+	memset(&wkr, 0, sizeof(wkr));
+	if (keylen == 0) {
+// We are selecting which key to use
+		wkr.len = sizeof(wkr);
+		wkr.kindex = 0xffff;
+		wkr.mac[0] = (char)index;
+		if (perm) printk(KERN_INFO "Setting transmit key to %d\n", index);
+		if (perm) ai->defindex = (char)index;
+	} else {
+// We are actually setting the key
+		wkr.len = sizeof(wkr);
+		wkr.kindex = index;
+		wkr.klen = keylen;
+		memcpy( wkr.key, key, keylen );
+		memcpy( wkr.mac, macaddr, ETH_ALEN );
+		printk(KERN_INFO "Setting key %d\n", index);
+	}
+
+	disable_MAC(ai, lock);
+	writeWepKeyRid(ai, &wkr, perm, lock);
+	enable_MAC(ai, &rsp, lock);
+	return 0;
+}
+
+static void proc_wepkey_on_close( struct inode *inode, struct file *file ) {
+	struct proc_data *data;
+	struct proc_dir_entry *dp = PDE(inode);
+	struct net_device *dev = dp->data;
+	struct airo_info *ai = dev->priv;
+	int i;
+	char key[16];
+	u16 index = 0;
+	int j = 0;
+
+	memset(key, 0, sizeof(key));
+
+	data = (struct proc_data *)file->private_data;
+	if ( !data->writelen ) return;
+
+	if (data->wbuffer[0] >= '0' && data->wbuffer[0] <= '3' &&
+	    (data->wbuffer[1] == ' ' || data->wbuffer[1] == '\n')) {
+		index = data->wbuffer[0] - '0';
+		if (data->wbuffer[1] == '\n') {
+			set_wep_key(ai, index, NULL, 0, 1, 1);
+			return;
+		}
+		j = 2;
+	} else {
+		printk(KERN_ERR "airo:  WepKey passed invalid key index\n");
+		return;
+	}
+
+	for( i = 0; i < 16*3 && data->wbuffer[i+j]; i++ ) {
+		switch(i%3) {
+		case 0:
+			key[i/3] = hexVal(data->wbuffer[i+j])<<4;
+			break;
+		case 1:
+			key[i/3] |= hexVal(data->wbuffer[i+j]);
+			break;
+		}
+	}
+	set_wep_key(ai, index, key, i/3, 1, 1);
+}
+
+static int proc_wepkey_open( struct inode *inode, struct file *file ) {
+	struct proc_data *data;
+	struct proc_dir_entry *dp = PDE(inode);
+	struct net_device *dev = dp->data;
+	struct airo_info *ai = dev->priv;
+	char *ptr;
+	WepKeyRid wkr;
+	u16 lastindex;
+	int j=0;
+	int rc;
+
+	if ((file->private_data = kmalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
+		return -ENOMEM;
+	memset(file->private_data, 0, sizeof(struct proc_data));
+	memset(&wkr, 0, sizeof(wkr));
+	data = (struct proc_data *)file->private_data;
+	if ((data->rbuffer = kmalloc( 180, GFP_KERNEL )) == NULL) {
+		kfree (file->private_data);
+		return -ENOMEM;
+	}
+	memset(data->rbuffer, 0, 180);
+	data->writelen = 0;
+	data->maxwritelen = 80;
+	if ((data->wbuffer = kmalloc( 80, GFP_KERNEL )) == NULL) {
+		kfree (data->rbuffer);
+		kfree (file->private_data);
+		return -ENOMEM;
+	}
+	memset( data->wbuffer, 0, 80 );
+	data->on_close = proc_wepkey_on_close;
+
+	ptr = data->rbuffer;
+	strcpy(ptr, "No wep keys\n");
+	rc = readWepKeyRid(ai, &wkr, 1, 1);
+	if (rc == SUCCESS) do {
+		lastindex = wkr.kindex;
+		if (wkr.kindex == 0xffff) {
+			j += sprintf(ptr+j, "Tx key = %d\n",
+				     (int)wkr.mac[0]);
+		} else {
+			j += sprintf(ptr+j, "Key %d set with length = %d\n",
+				     (int)wkr.kindex, (int)wkr.klen);
+		}
+		readWepKeyRid(ai, &wkr, 0, 1);
+	} while((lastindex != wkr.kindex) && (j < 180-30));
+
+	data->readlen = strlen( data->rbuffer );
+	return 0;
+}
+
+static int proc_SSID_open( struct inode *inode, struct file *file ) {
+	struct proc_data *data;
+	struct proc_dir_entry *dp = PDE(inode);
+	struct net_device *dev = dp->data;
+	struct airo_info *ai = dev->priv;
+	int i;
+	char *ptr;
+	SsidRid SSID_rid;
+
+	if ((file->private_data = kmalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
+		return -ENOMEM;
+	memset(file->private_data, 0, sizeof(struct proc_data));
+	data = (struct proc_data *)file->private_data;
+	if ((data->rbuffer = kmalloc( 104, GFP_KERNEL )) == NULL) {
+		kfree (file->private_data);
+		return -ENOMEM;
+	}
+	data->writelen = 0;
+	data->maxwritelen = 33*3;
+	if ((data->wbuffer = kmalloc( 33*3, GFP_KERNEL )) == NULL) {
+		kfree (data->rbuffer);
+		kfree (file->private_data);
+		return -ENOMEM;
+	}
+	memset( data->wbuffer, 0, 33*3 );
+	data->on_close = proc_SSID_on_close;
+
+	readSsidRid(ai, &SSID_rid);
+	ptr = data->rbuffer;
+	for( i = 0; i < 3; i++ ) {
+		int j;
+		if ( !SSID_rid.ssids[i].len ) break;
+		for( j = 0; j < 32 &&
+			     j < SSID_rid.ssids[i].len &&
+			     SSID_rid.ssids[i].ssid[j]; j++ ) {
+			*ptr++ = SSID_rid.ssids[i].ssid[j];
+		}
+		*ptr++ = '\n';
+	}
+	*ptr = '\0';
+	data->readlen = strlen( data->rbuffer );
+	return 0;
+}
+
+static int proc_APList_open( struct inode *inode, struct file *file ) {
+	struct proc_data *data;
+	struct proc_dir_entry *dp = PDE(inode);
+	struct net_device *dev = dp->data;
+	struct airo_info *ai = dev->priv;
+	int i;
+	char *ptr;
+	APListRid APList_rid;
+
+	if ((file->private_data = kmalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
+		return -ENOMEM;
+	memset(file->private_data, 0, sizeof(struct proc_data));
+	data = (struct proc_data *)file->private_data;
+	if ((data->rbuffer = kmalloc( 104, GFP_KERNEL )) == NULL) {
+		kfree (file->private_data);
+		return -ENOMEM;
+	}
+	data->writelen = 0;
+	data->maxwritelen = 4*6*3;
+	if ((data->wbuffer = kmalloc( data->maxwritelen, GFP_KERNEL )) == NULL) {
+		kfree (data->rbuffer);
+		kfree (file->private_data);
+		return -ENOMEM;
+	}
+	memset( data->wbuffer, 0, data->maxwritelen );
+	data->on_close = proc_APList_on_close;
+
+	readAPListRid(ai, &APList_rid);
+	ptr = data->rbuffer;
+	for( i = 0; i < 4; i++ ) {
+// We end when we find a zero MAC
+		if ( !*(int*)APList_rid.ap[i] &&
+		     !*(int*)&APList_rid.ap[i][2]) break;
+		ptr += sprintf(ptr, "%02x:%02x:%02x:%02x:%02x:%02x\n",
+			       (int)APList_rid.ap[i][0],
+			       (int)APList_rid.ap[i][1],
+			       (int)APList_rid.ap[i][2],
+			       (int)APList_rid.ap[i][3],
+			       (int)APList_rid.ap[i][4],
+			       (int)APList_rid.ap[i][5]);
+	}
+	if (i==0) ptr += sprintf(ptr, "Not using specific APs\n");
+
+	*ptr = '\0';
+	data->readlen = strlen( data->rbuffer );
+	return 0;
+}
+
+static int proc_BSSList_open( struct inode *inode, struct file *file ) {
+	struct proc_data *data;
+	struct proc_dir_entry *dp = PDE(inode);
+	struct net_device *dev = dp->data;
+	struct airo_info *ai = dev->priv;
+	char *ptr;
+	BSSListRid BSSList_rid;
+	int rc;
+	/* If doLoseSync is not 1, we won't do a Lose Sync */
+	int doLoseSync = -1;
+
+	if ((file->private_data = kmalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
+		return -ENOMEM;
+	memset(file->private_data, 0, sizeof(struct proc_data));
+	data = (struct proc_data *)file->private_data;
+	if ((data->rbuffer = kmalloc( 1024, GFP_KERNEL )) == NULL) {
+		kfree (file->private_data);
+		return -ENOMEM;
+	}
+	data->writelen = 0;
+	data->maxwritelen = 0;
+	data->wbuffer = NULL;
+	data->on_close = NULL;
+
+	if (file->f_mode & FMODE_WRITE) {
+		if (!(file->f_mode & FMODE_READ)) {
+			Cmd cmd;
+			Resp rsp;
+
+			if (ai->flags & FLAG_RADIO_MASK) return -ENETDOWN;
+			memset(&cmd, 0, sizeof(cmd));
+			cmd.cmd=CMD_LISTBSS;
+			if (down_interruptible(&ai->sem))
+				return -ERESTARTSYS;
+			issuecommand(ai, &cmd, &rsp);
+			up(&ai->sem);
+			data->readlen = 0;
+			return 0;
+		}
+		doLoseSync = 1;
+	}
+	ptr = data->rbuffer;
+	/* There is a race condition here if there are concurrent opens.
+           Since it is a rare condition, we'll just live with it, otherwise
+           we have to add a spin lock... */
+	rc = readBSSListRid(ai, doLoseSync, &BSSList_rid);
+	while(rc == 0 && BSSList_rid.index != 0xffff) {
+		ptr += sprintf(ptr, "%02x:%02x:%02x:%02x:%02x:%02x %*s rssi = %d",
+				(int)BSSList_rid.bssid[0],
+				(int)BSSList_rid.bssid[1],
+				(int)BSSList_rid.bssid[2],
+				(int)BSSList_rid.bssid[3],
+				(int)BSSList_rid.bssid[4],
+				(int)BSSList_rid.bssid[5],
+				(int)BSSList_rid.ssidLen,
+				BSSList_rid.ssid,
+				(int)BSSList_rid.rssi);
+		ptr += sprintf(ptr, " channel = %d %s %s %s %s\n",
+				(int)BSSList_rid.dsChannel,
+				BSSList_rid.cap & CAP_ESS ? "ESS" : "",
+				BSSList_rid.cap & CAP_IBSS ? "adhoc" : "",
+				BSSList_rid.cap & CAP_PRIVACY ? "wep" : "",
+				BSSList_rid.cap & CAP_SHORTHDR ? "shorthdr" : "");
+		rc = readBSSListRid(ai, 0, &BSSList_rid);
+	}
+	*ptr = '\0';
+	data->readlen = strlen( data->rbuffer );
+	return 0;
+}
+
+static int proc_close( struct inode *inode, struct file *file )
+{
+	struct proc_data *data = (struct proc_data *)file->private_data;
+	if ( data->on_close != NULL ) data->on_close( inode, file );
+	if ( data->rbuffer ) kfree( data->rbuffer );
+	if ( data->wbuffer ) kfree( data->wbuffer );
+	kfree( data );
+	return 0;
+}
+
+static struct net_device_list {
+	struct net_device *dev;
+	struct net_device_list *next;
+} *airo_devices;
+
+/* Since the card doesn't automatically switch to the right WEP mode,
+   we will make it do it.  If the card isn't associated, every secs we
+   will switch WEP modes to see if that will help.  If the card is
+   associated we will check every minute to see if anything has
+   changed. */
+static void timer_func( struct net_device *dev ) {
+	struct airo_info *apriv = dev->priv;
+	Resp rsp;
+
+/* We don't have a link so try changing the authtype */
+	readConfigRid(apriv, 0);
+	disable_MAC(apriv, 0);
+	switch(apriv->config.authType) {
+		case AUTH_ENCRYPT:
+/* So drop to OPEN */
+			apriv->config.authType = AUTH_OPEN;
+			break;
+		case AUTH_SHAREDKEY:
+			if (apriv->keyindex < auto_wep) {
+				set_wep_key(apriv, apriv->keyindex, NULL, 0, 0, 0);
+				apriv->config.authType = AUTH_SHAREDKEY;
+				apriv->keyindex++;
+			} else {
+			        /* Drop to ENCRYPT */
+				apriv->keyindex = 0;
+				set_wep_key(apriv, apriv->defindex, NULL, 0, 0, 0);
+				apriv->config.authType = AUTH_ENCRYPT;
+			}
+			break;
+		default:  /* We'll escalate to SHAREDKEY */
+			apriv->config.authType = AUTH_SHAREDKEY;
+	}
+	set_bit (FLAG_COMMIT, &apriv->flags);
+	writeConfigRid(apriv, 0);
+	enable_MAC(apriv, &rsp, 0);
+	up(&apriv->sem);
+
+/* Schedule check to see if the change worked */
+	clear_bit(JOB_AUTOWEP, &apriv->flags);
+	apriv->expires = RUN_AT(HZ*3);
+}
+
+static int add_airo_dev( struct net_device *dev ) {
+	struct net_device_list *node = kmalloc( sizeof( *node ), GFP_KERNEL );
+	if ( !node )
+		return -ENOMEM;
+
+	node->dev = dev;
+	node->next = airo_devices;
+	airo_devices = node;
+
+	return 0;
+}
+
+static void del_airo_dev( struct net_device *dev ) {
+	struct net_device_list **p = &airo_devices;
+	while( *p && ( (*p)->dev != dev ) )
+		p = &(*p)->next;
+	if ( *p && (*p)->dev == dev )
+		*p = (*p)->next;
+}
+
+#ifdef CONFIG_PCI
+static int __devinit airo_pci_probe(struct pci_dev *pdev,
+				    const struct pci_device_id *pent)
+{
+	struct net_device *dev;
+
+	if (pci_enable_device(pdev))
+		return -ENODEV;
+	pci_set_master(pdev);
+
+	if (pdev->device == 0x5000 || pdev->device == 0xa504)
+			dev = _init_airo_card(pdev->irq, pdev->resource[0].start, 0, pdev, &pdev->dev);
+	else
+			dev = _init_airo_card(pdev->irq, pdev->resource[2].start, 0, pdev, &pdev->dev);
+	if (!dev)
+		return -ENODEV;
+
+	pci_set_drvdata(pdev, dev);
+	return 0;
+}
+
+static void __devexit airo_pci_remove(struct pci_dev *pdev)
+{
+}
+
+static int airo_pci_suspend(struct pci_dev *pdev, u32 state)
+{
+	struct net_device *dev = pci_get_drvdata(pdev);
+	struct airo_info *ai = dev->priv;
+	Cmd cmd;
+	Resp rsp;
+
+	if ((ai->APList == NULL) &&
+		(ai->APList = kmalloc(sizeof(APListRid), GFP_KERNEL)) == NULL)
+		return -ENOMEM;
+	if ((ai->SSID == NULL) &&
+		(ai->SSID = kmalloc(sizeof(SsidRid), GFP_KERNEL)) == NULL)
+		return -ENOMEM;
+	readAPListRid(ai, ai->APList);
+	readSsidRid(ai, ai->SSID);
+	memset(&cmd, 0, sizeof(cmd));
+	/* the lock will be released at the end of the resume callback */
+	if (down_interruptible(&ai->sem))
+		return -EAGAIN;
+	disable_MAC(ai, 0);
+	netif_device_detach(dev);
+	ai->power = state;
+	cmd.cmd=HOSTSLEEP;
+	issuecommand(ai, &cmd, &rsp);
+
+	pci_enable_wake(pdev, state, 1);
+	pci_save_state(pdev);
+	return pci_set_power_state(pdev, state);
+}
+
+static int airo_pci_resume(struct pci_dev *pdev)
+{
+	struct net_device *dev = pci_get_drvdata(pdev);
+	struct airo_info *ai = dev->priv;
+	Resp rsp;
+
+	pci_set_power_state(pdev, 0);
+	pci_restore_state(pdev);
+	pci_enable_wake(pdev, ai->power, 0);
+
+	if (ai->power > 1) {
+		reset_card(dev, 0);
+		mpi_init_descriptors(ai);
+		setup_card(ai, dev->dev_addr, 0);
+		clear_bit(FLAG_RADIO_OFF, &ai->flags);
+		clear_bit(FLAG_PENDING_XMIT, &ai->flags);
+	} else {
+		OUT4500(ai, EVACK, EV_AWAKEN);
+		OUT4500(ai, EVACK, EV_AWAKEN);
+		msleep(100);
+	}
+
+	set_bit (FLAG_COMMIT, &ai->flags);
+	disable_MAC(ai, 0);
+        msleep(200);
+	if (ai->SSID) {
+		writeSsidRid(ai, ai->SSID, 0);
+		kfree(ai->SSID);
+		ai->SSID = NULL;
+	}
+	if (ai->APList) {
+		writeAPListRid(ai, ai->APList, 0);
+		kfree(ai->APList);
+		ai->APList = NULL;
+	}
+	writeConfigRid(ai, 0);
+	enable_MAC(ai, &rsp, 0);
+	ai->power = 0;
+	netif_device_attach(dev);
+	netif_wake_queue(dev);
+	enable_interrupts(ai);
+	up(&ai->sem);
+	return 0;
+}
+#endif
+
+static int __init airo_init_module( void )
+{
+	int i, have_isa_dev = 0;
+
+	airo_entry = create_proc_entry("aironet",
+				       S_IFDIR | airo_perm,
+				       proc_root_driver);
+        airo_entry->uid = proc_uid;
+        airo_entry->gid = proc_gid;
+
+	for( i = 0; i < 4 && io[i] && irq[i]; i++ ) {
+		printk( KERN_INFO
+			"airo:  Trying to configure ISA adapter at irq=%d io=0x%x\n",
+			irq[i], io[i] );
+		if (init_airo_card( irq[i], io[i], 0, NULL ))
+			have_isa_dev = 1;
+	}
+
+#ifdef CONFIG_PCI
+	printk( KERN_INFO "airo:  Probing for PCI adapters\n" );
+	pci_register_driver(&airo_driver);
+	printk( KERN_INFO "airo:  Finished probing for PCI adapters\n" );
+#endif
+
+	/* Always exit with success, as we are a library module
+	 * as well as a driver module
+	 */
+	return 0;
+}
+
+static void __exit airo_cleanup_module( void )
+{
+	while( airo_devices ) {
+		printk( KERN_INFO "airo: Unregistering %s\n", airo_devices->dev->name );
+		stop_airo_card( airo_devices->dev, 1 );
+	}
+#ifdef CONFIG_PCI
+	pci_unregister_driver(&airo_driver);
+#endif
+	remove_proc_entry("aironet", proc_root_driver);
+}
+
+#ifdef WIRELESS_EXT
+/*
+ * Initial Wireless Extension code for Aironet driver by :
+ *	Jean Tourrilhes <jt@hpl.hp.com> - HPL - 17 November 00
+ * Conversion to new driver API by :
+ *	Jean Tourrilhes <jt@hpl.hp.com> - HPL - 26 March 02
+ * Javier also did a good amount of work here, adding some new extensions
+ * and fixing my code. Let's just say that without him this code just
+ * would not work at all... - Jean II
+ */
+
+static int airo_get_quality (StatusRid *status_rid, CapabilityRid *cap_rid)
+{
+	int quality = 0;
+
+	if ((status_rid->mode & 0x3f) == 0x3f && (cap_rid->hardCap & 8)) {
+		if (memcmp(cap_rid->prodName, "350", 3))
+			if (status_rid->signalQuality > 0x20)
+				quality = 0;
+			else
+				quality = 0x20 - status_rid->signalQuality;
+		else
+			if (status_rid->signalQuality > 0xb0)
+				quality = 0;
+			else if (status_rid->signalQuality < 0x10)
+				quality = 0xa0;
+			else
+				quality = 0xb0 - status_rid->signalQuality;
+	}
+	return quality;
+}
+
+#define airo_get_max_quality(cap_rid) (memcmp((cap_rid)->prodName, "350", 3) ? 0x20 : 0xa0)
+#define airo_get_avg_quality(cap_rid) (memcmp((cap_rid)->prodName, "350", 3) ? 0x10 : 0x50);
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : get protocol name
+ */
+static int airo_get_name(struct net_device *dev,
+			 struct iw_request_info *info,
+			 char *cwrq,
+			 char *extra)
+{
+	strcpy(cwrq, "IEEE 802.11-DS");
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : set frequency
+ */
+static int airo_set_freq(struct net_device *dev,
+			 struct iw_request_info *info,
+			 struct iw_freq *fwrq,
+			 char *extra)
+{
+	struct airo_info *local = dev->priv;
+	int rc = -EINPROGRESS;		/* Call commit handler */
+
+	/* If setting by frequency, convert to a channel */
+	if((fwrq->e == 1) &&
+	   (fwrq->m >= (int) 2.412e8) &&
+	   (fwrq->m <= (int) 2.487e8)) {
+		int f = fwrq->m / 100000;
+		int c = 0;
+		while((c < 14) && (f != frequency_list[c]))
+			c++;
+		/* Hack to fall through... */
+		fwrq->e = 0;
+		fwrq->m = c + 1;
+	}
+	/* Setting by channel number */
+	if((fwrq->m > 1000) || (fwrq->e > 0))
+		rc = -EOPNOTSUPP;
+	else {
+		int channel = fwrq->m;
+		/* We should do a better check than that,
+		 * based on the card capability !!! */
+		if((channel < 1) || (channel > 16)) {
+			printk(KERN_DEBUG "%s: New channel value of %d is invalid!\n", dev->name, fwrq->m);
+			rc = -EINVAL;
+		} else {
+			readConfigRid(local, 1);
+			/* Yes ! We can set it !!! */
+			local->config.channelSet = (u16)(channel - 1);
+			set_bit (FLAG_COMMIT, &local->flags);
+		}
+	}
+	return rc;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : get frequency
+ */
+static int airo_get_freq(struct net_device *dev,
+			 struct iw_request_info *info,
+			 struct iw_freq *fwrq,
+			 char *extra)
+{
+	struct airo_info *local = dev->priv;
+	StatusRid status_rid;		/* Card status info */
+
+	readConfigRid(local, 1);
+	if ((local->config.opmode & 0xFF) == MODE_STA_ESS)
+		status_rid.channel = local->config.channelSet;
+	else
+		readStatusRid(local, &status_rid, 1);
+
+#ifdef WEXT_USECHANNELS
+	fwrq->m = ((int)status_rid.channel) + 1;
+	fwrq->e = 0;
+#else
+	{
+		int f = (int)status_rid.channel;
+		fwrq->m = frequency_list[f] * 100000;
+		fwrq->e = 1;
+	}
+#endif
+
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : set ESSID
+ */
+static int airo_set_essid(struct net_device *dev,
+			  struct iw_request_info *info,
+			  struct iw_point *dwrq,
+			  char *extra)
+{
+	struct airo_info *local = dev->priv;
+	Resp rsp;
+	SsidRid SSID_rid;		/* SSIDs */
+
+	/* Reload the list of current SSID */
+	readSsidRid(local, &SSID_rid);
+
+	/* Check if we asked for `any' */
+	if(dwrq->flags == 0) {
+		/* Just send an empty SSID list */
+		memset(&SSID_rid, 0, sizeof(SSID_rid));
+	} else {
+		int	index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
+
+		/* Check the size of the string */
+		if(dwrq->length > IW_ESSID_MAX_SIZE+1) {
+			return -E2BIG ;
+		}
+		/* Check if index is valid */
+		if((index < 0) || (index >= 4)) {
+			return -EINVAL;
+		}
+
+		/* Set the SSID */
+		memset(SSID_rid.ssids[index].ssid, 0,
+		       sizeof(SSID_rid.ssids[index].ssid));
+		memcpy(SSID_rid.ssids[index].ssid, extra, dwrq->length);
+		SSID_rid.ssids[index].len = dwrq->length - 1;
+	}
+	SSID_rid.len = sizeof(SSID_rid);
+	/* Write it to the card */
+	disable_MAC(local, 1);
+	writeSsidRid(local, &SSID_rid, 1);
+	enable_MAC(local, &rsp, 1);
+
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : get ESSID
+ */
+static int airo_get_essid(struct net_device *dev,
+			  struct iw_request_info *info,
+			  struct iw_point *dwrq,
+			  char *extra)
+{
+	struct airo_info *local = dev->priv;
+	StatusRid status_rid;		/* Card status info */
+
+	readStatusRid(local, &status_rid, 1);
+
+	/* Note : if dwrq->flags != 0, we should
+	 * get the relevant SSID from the SSID list... */
+
+	/* Get the current SSID */
+	memcpy(extra, status_rid.SSID, status_rid.SSIDlen);
+	extra[status_rid.SSIDlen] = '\0';
+	/* If none, we may want to get the one that was set */
+
+	/* Push it out ! */
+	dwrq->length = status_rid.SSIDlen + 1;
+	dwrq->flags = 1; /* active */
+
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : set AP address
+ */
+static int airo_set_wap(struct net_device *dev,
+			struct iw_request_info *info,
+			struct sockaddr *awrq,
+			char *extra)
+{
+	struct airo_info *local = dev->priv;
+	Cmd cmd;
+	Resp rsp;
+	APListRid APList_rid;
+	static const unsigned char bcast[ETH_ALEN] = { 255, 255, 255, 255, 255, 255 };
+
+	if (awrq->sa_family != ARPHRD_ETHER)
+		return -EINVAL;
+	else if (!memcmp(bcast, awrq->sa_data, ETH_ALEN)) {
+		memset(&cmd, 0, sizeof(cmd));
+		cmd.cmd=CMD_LOSE_SYNC;
+		if (down_interruptible(&local->sem))
+			return -ERESTARTSYS;
+		issuecommand(local, &cmd, &rsp);
+		up(&local->sem);
+	} else {
+		memset(&APList_rid, 0, sizeof(APList_rid));
+		APList_rid.len = sizeof(APList_rid);
+		memcpy(APList_rid.ap[0], awrq->sa_data, ETH_ALEN);
+		disable_MAC(local, 1);
+		writeAPListRid(local, &APList_rid, 1);
+		enable_MAC(local, &rsp, 1);
+	}
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : get AP address
+ */
+static int airo_get_wap(struct net_device *dev,
+			struct iw_request_info *info,
+			struct sockaddr *awrq,
+			char *extra)
+{
+	struct airo_info *local = dev->priv;
+	StatusRid status_rid;		/* Card status info */
+
+	readStatusRid(local, &status_rid, 1);
+
+	/* Tentative. This seems to work, wow, I'm lucky !!! */
+	memcpy(awrq->sa_data, status_rid.bssid[0], ETH_ALEN);
+	awrq->sa_family = ARPHRD_ETHER;
+
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : set Nickname
+ */
+static int airo_set_nick(struct net_device *dev,
+			 struct iw_request_info *info,
+			 struct iw_point *dwrq,
+			 char *extra)
+{
+	struct airo_info *local = dev->priv;
+
+	/* Check the size of the string */
+	if(dwrq->length > 16 + 1) {
+		return -E2BIG;
+	}
+	readConfigRid(local, 1);
+	memset(local->config.nodeName, 0, sizeof(local->config.nodeName));
+	memcpy(local->config.nodeName, extra, dwrq->length);
+	set_bit (FLAG_COMMIT, &local->flags);
+
+	return -EINPROGRESS;		/* Call commit handler */
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : get Nickname
+ */
+static int airo_get_nick(struct net_device *dev,
+			 struct iw_request_info *info,
+			 struct iw_point *dwrq,
+			 char *extra)
+{
+	struct airo_info *local = dev->priv;
+
+	readConfigRid(local, 1);
+	strncpy(extra, local->config.nodeName, 16);
+	extra[16] = '\0';
+	dwrq->length = strlen(extra) + 1;
+
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : set Bit-Rate
+ */
+static int airo_set_rate(struct net_device *dev,
+			 struct iw_request_info *info,
+			 struct iw_param *vwrq,
+			 char *extra)
+{
+	struct airo_info *local = dev->priv;
+	CapabilityRid cap_rid;		/* Card capability info */
+	u8	brate = 0;
+	int	i;
+
+	/* First : get a valid bit rate value */
+	readCapabilityRid(local, &cap_rid, 1);
+
+	/* Which type of value ? */
+	if((vwrq->value < 8) && (vwrq->value >= 0)) {
+		/* Setting by rate index */
+		/* Find value in the magic rate table */
+		brate = cap_rid.supportedRates[vwrq->value];
+	} else {
+		/* Setting by frequency value */
+		u8	normvalue = (u8) (vwrq->value/500000);
+
+		/* Check if rate is valid */
+		for(i = 0 ; i < 8 ; i++) {
+			if(normvalue == cap_rid.supportedRates[i]) {
+				brate = normvalue;
+				break;
+			}
+		}
+	}
+	/* -1 designed the max rate (mostly auto mode) */
+	if(vwrq->value == -1) {
+		/* Get the highest available rate */
+		for(i = 0 ; i < 8 ; i++) {
+			if(cap_rid.supportedRates[i] == 0)
+				break;
+		}
+		if(i != 0)
+			brate = cap_rid.supportedRates[i - 1];
+	}
+	/* Check that it is valid */
+	if(brate == 0) {
+		return -EINVAL;
+	}
+
+	readConfigRid(local, 1);
+	/* Now, check if we want a fixed or auto value */
+	if(vwrq->fixed == 0) {
+		/* Fill all the rates up to this max rate */
+		memset(local->config.rates, 0, 8);
+		for(i = 0 ; i < 8 ; i++) {
+			local->config.rates[i] = cap_rid.supportedRates[i];
+			if(local->config.rates[i] == brate)
+				break;
+		}
+	} else {
+		/* Fixed mode */
+		/* One rate, fixed */
+		memset(local->config.rates, 0, 8);
+		local->config.rates[0] = brate;
+	}
+	set_bit (FLAG_COMMIT, &local->flags);
+
+	return -EINPROGRESS;		/* Call commit handler */
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : get Bit-Rate
+ */
+static int airo_get_rate(struct net_device *dev,
+			 struct iw_request_info *info,
+			 struct iw_param *vwrq,
+			 char *extra)
+{
+	struct airo_info *local = dev->priv;
+	StatusRid status_rid;		/* Card status info */
+
+	readStatusRid(local, &status_rid, 1);
+
+	vwrq->value = status_rid.currentXmitRate * 500000;
+	/* If more than one rate, set auto */
+	readConfigRid(local, 1);
+	vwrq->fixed = (local->config.rates[1] == 0);
+
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : set RTS threshold
+ */
+static int airo_set_rts(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_param *vwrq,
+			char *extra)
+{
+	struct airo_info *local = dev->priv;
+	int rthr = vwrq->value;
+
+	if(vwrq->disabled)
+		rthr = 2312;
+	if((rthr < 0) || (rthr > 2312)) {
+		return -EINVAL;
+	}
+	readConfigRid(local, 1);
+	local->config.rtsThres = rthr;
+	set_bit (FLAG_COMMIT, &local->flags);
+
+	return -EINPROGRESS;		/* Call commit handler */
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : get RTS threshold
+ */
+static int airo_get_rts(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_param *vwrq,
+			char *extra)
+{
+	struct airo_info *local = dev->priv;
+
+	readConfigRid(local, 1);
+	vwrq->value = local->config.rtsThres;
+	vwrq->disabled = (vwrq->value >= 2312);
+	vwrq->fixed = 1;
+
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : set Fragmentation threshold
+ */
+static int airo_set_frag(struct net_device *dev,
+			 struct iw_request_info *info,
+			 struct iw_param *vwrq,
+			 char *extra)
+{
+	struct airo_info *local = dev->priv;
+	int fthr = vwrq->value;
+
+	if(vwrq->disabled)
+		fthr = 2312;
+	if((fthr < 256) || (fthr > 2312)) {
+		return -EINVAL;
+	}
+	fthr &= ~0x1;	/* Get an even value - is it really needed ??? */
+	readConfigRid(local, 1);
+	local->config.fragThresh = (u16)fthr;
+	set_bit (FLAG_COMMIT, &local->flags);
+
+	return -EINPROGRESS;		/* Call commit handler */
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : get Fragmentation threshold
+ */
+static int airo_get_frag(struct net_device *dev,
+			 struct iw_request_info *info,
+			 struct iw_param *vwrq,
+			 char *extra)
+{
+	struct airo_info *local = dev->priv;
+
+	readConfigRid(local, 1);
+	vwrq->value = local->config.fragThresh;
+	vwrq->disabled = (vwrq->value >= 2312);
+	vwrq->fixed = 1;
+
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : set Mode of Operation
+ */
+static int airo_set_mode(struct net_device *dev,
+			 struct iw_request_info *info,
+			 __u32 *uwrq,
+			 char *extra)
+{
+	struct airo_info *local = dev->priv;
+	int reset = 0;
+
+	readConfigRid(local, 1);
+	if ((local->config.rmode & 0xff) >= RXMODE_RFMON)
+		reset = 1;
+
+	switch(*uwrq) {
+		case IW_MODE_ADHOC:
+			local->config.opmode &= 0xFF00;
+			local->config.opmode |= MODE_STA_IBSS;
+			local->config.rmode &= 0xfe00;
+			local->config.scanMode = SCANMODE_ACTIVE;
+			clear_bit (FLAG_802_11, &local->flags);
+			break;
+		case IW_MODE_INFRA:
+			local->config.opmode &= 0xFF00;
+			local->config.opmode |= MODE_STA_ESS;
+			local->config.rmode &= 0xfe00;
+			local->config.scanMode = SCANMODE_ACTIVE;
+			clear_bit (FLAG_802_11, &local->flags);
+			break;
+		case IW_MODE_MASTER:
+			local->config.opmode &= 0xFF00;
+			local->config.opmode |= MODE_AP;
+			local->config.rmode &= 0xfe00;
+			local->config.scanMode = SCANMODE_ACTIVE;
+			clear_bit (FLAG_802_11, &local->flags);
+			break;
+		case IW_MODE_REPEAT:
+			local->config.opmode &= 0xFF00;
+			local->config.opmode |= MODE_AP_RPTR;
+			local->config.rmode &= 0xfe00;
+			local->config.scanMode = SCANMODE_ACTIVE;
+			clear_bit (FLAG_802_11, &local->flags);
+			break;
+		case IW_MODE_MONITOR:
+			local->config.opmode &= 0xFF00;
+			local->config.opmode |= MODE_STA_ESS;
+			local->config.rmode &= 0xfe00;
+			local->config.rmode |= RXMODE_RFMON | RXMODE_DISABLE_802_3_HEADER;
+			local->config.scanMode = SCANMODE_PASSIVE;
+			set_bit (FLAG_802_11, &local->flags);
+			break;
+		default:
+			return -EINVAL;
+	}
+	if (reset)
+		set_bit (FLAG_RESET, &local->flags);
+	set_bit (FLAG_COMMIT, &local->flags);
+
+	return -EINPROGRESS;		/* Call commit handler */
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : get Mode of Operation
+ */
+static int airo_get_mode(struct net_device *dev,
+			 struct iw_request_info *info,
+			 __u32 *uwrq,
+			 char *extra)
+{
+	struct airo_info *local = dev->priv;
+
+	readConfigRid(local, 1);
+	/* If not managed, assume it's ad-hoc */
+	switch (local->config.opmode & 0xFF) {
+		case MODE_STA_ESS:
+			*uwrq = IW_MODE_INFRA;
+			break;
+		case MODE_AP:
+			*uwrq = IW_MODE_MASTER;
+			break;
+		case MODE_AP_RPTR:
+			*uwrq = IW_MODE_REPEAT;
+			break;
+		default:
+			*uwrq = IW_MODE_ADHOC;
+	}
+
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : set Encryption Key
+ */
+static int airo_set_encode(struct net_device *dev,
+			   struct iw_request_info *info,
+			   struct iw_point *dwrq,
+			   char *extra)
+{
+	struct airo_info *local = dev->priv;
+	CapabilityRid cap_rid;		/* Card capability info */
+
+	/* Is WEP supported ? */
+	readCapabilityRid(local, &cap_rid, 1);
+	/* Older firmware doesn't support this...
+	if(!(cap_rid.softCap & 2)) {
+		return -EOPNOTSUPP;
+	} */
+	readConfigRid(local, 1);
+
+	/* Basic checking: do we have a key to set ?
+	 * Note : with the new API, it's impossible to get a NULL pointer.
+	 * Therefore, we need to check a key size == 0 instead.
+	 * New version of iwconfig properly set the IW_ENCODE_NOKEY flag
+	 * when no key is present (only change flags), but older versions
+	 * don't do it. - Jean II */
+	if (dwrq->length > 0) {
+		wep_key_t key;
+		int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
+		int current_index = get_wep_key(local, 0xffff);
+		/* Check the size of the key */
+		if (dwrq->length > MAX_KEY_SIZE) {
+			return -EINVAL;
+		}
+		/* Check the index (none -> use current) */
+		if ((index < 0) || (index >= ((cap_rid.softCap & 0x80) ? 4:1)))
+			index = current_index;
+		/* Set the length */
+		if (dwrq->length > MIN_KEY_SIZE)
+			key.len = MAX_KEY_SIZE;
+		else
+			if (dwrq->length > 0)
+				key.len = MIN_KEY_SIZE;
+			else
+				/* Disable the key */
+				key.len = 0;
+		/* Check if the key is not marked as invalid */
+		if(!(dwrq->flags & IW_ENCODE_NOKEY)) {
+			/* Cleanup */
+			memset(key.key, 0, MAX_KEY_SIZE);
+			/* Copy the key in the driver */
+			memcpy(key.key, extra, dwrq->length);
+			/* Send the key to the card */
+			set_wep_key(local, index, key.key, key.len, 1, 1);
+		}
+		/* WE specify that if a valid key is set, encryption
+		 * should be enabled (user may turn it off later)
+		 * This is also how "iwconfig ethX key on" works */
+		if((index == current_index) && (key.len > 0) &&
+		   (local->config.authType == AUTH_OPEN)) {
+			local->config.authType = AUTH_ENCRYPT;
+			set_bit (FLAG_COMMIT, &local->flags);
+		}
+	} else {
+		/* Do we want to just set the transmit key index ? */
+		int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
+		if ((index >= 0) && (index < ((cap_rid.softCap & 0x80)?4:1))) {
+			set_wep_key(local, index, NULL, 0, 1, 1);
+		} else
+			/* Don't complain if only change the mode */
+			if(!dwrq->flags & IW_ENCODE_MODE) {
+				return -EINVAL;
+			}
+	}
+	/* Read the flags */
+	if(dwrq->flags & IW_ENCODE_DISABLED)
+		local->config.authType = AUTH_OPEN;	// disable encryption
+	if(dwrq->flags & IW_ENCODE_RESTRICTED)
+		local->config.authType = AUTH_SHAREDKEY;	// Only Both
+	if(dwrq->flags & IW_ENCODE_OPEN)
+		local->config.authType = AUTH_ENCRYPT;	// Only Wep
+	/* Commit the changes to flags if needed */
+	if(dwrq->flags & IW_ENCODE_MODE)
+		set_bit (FLAG_COMMIT, &local->flags);
+	return -EINPROGRESS;		/* Call commit handler */
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : get Encryption Key
+ */
+static int airo_get_encode(struct net_device *dev,
+			   struct iw_request_info *info,
+			   struct iw_point *dwrq,
+			   char *extra)
+{
+	struct airo_info *local = dev->priv;
+	int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
+	CapabilityRid cap_rid;		/* Card capability info */
+
+	/* Is it supported ? */
+	readCapabilityRid(local, &cap_rid, 1);
+	if(!(cap_rid.softCap & 2)) {
+		return -EOPNOTSUPP;
+	}
+	readConfigRid(local, 1);
+	/* Check encryption mode */
+	switch(local->config.authType)	{
+		case AUTH_ENCRYPT:
+			dwrq->flags = IW_ENCODE_OPEN;
+			break;
+		case AUTH_SHAREDKEY:
+			dwrq->flags = IW_ENCODE_RESTRICTED;
+			break;
+		default:
+		case AUTH_OPEN:
+			dwrq->flags = IW_ENCODE_DISABLED;
+			break;
+	}
+	/* We can't return the key, so set the proper flag and return zero */
+	dwrq->flags |= IW_ENCODE_NOKEY;
+	memset(extra, 0, 16);
+
+	/* Which key do we want ? -1 -> tx index */
+	if ((index < 0) || (index >= ((cap_rid.softCap & 0x80) ? 4 : 1)))
+		index = get_wep_key(local, 0xffff);
+	dwrq->flags |= index + 1;
+	/* Copy the key to the user buffer */
+	dwrq->length = get_wep_key(local, index);
+	if (dwrq->length > 16) {
+		dwrq->length=0;
+	}
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : set Tx-Power
+ */
+static int airo_set_txpow(struct net_device *dev,
+			  struct iw_request_info *info,
+			  struct iw_param *vwrq,
+			  char *extra)
+{
+	struct airo_info *local = dev->priv;
+	CapabilityRid cap_rid;		/* Card capability info */
+	int i;
+	int rc = -EINVAL;
+
+	readCapabilityRid(local, &cap_rid, 1);
+
+	if (vwrq->disabled) {
+		set_bit (FLAG_RADIO_OFF, &local->flags);
+		set_bit (FLAG_COMMIT, &local->flags);
+		return -EINPROGRESS;		/* Call commit handler */
+	}
+	if (vwrq->flags != IW_TXPOW_MWATT) {
+		return -EINVAL;
+	}
+	clear_bit (FLAG_RADIO_OFF, &local->flags);
+	for (i = 0; cap_rid.txPowerLevels[i] && (i < 8); i++)
+		if ((vwrq->value==cap_rid.txPowerLevels[i])) {
+			readConfigRid(local, 1);
+			local->config.txPower = vwrq->value;
+			set_bit (FLAG_COMMIT, &local->flags);
+			rc = -EINPROGRESS;	/* Call commit handler */
+			break;
+		}
+	return rc;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : get Tx-Power
+ */
+static int airo_get_txpow(struct net_device *dev,
+			  struct iw_request_info *info,
+			  struct iw_param *vwrq,
+			  char *extra)
+{
+	struct airo_info *local = dev->priv;
+
+	readConfigRid(local, 1);
+	vwrq->value = local->config.txPower;
+	vwrq->fixed = 1;	/* No power control */
+	vwrq->disabled = test_bit(FLAG_RADIO_OFF, &local->flags);
+	vwrq->flags = IW_TXPOW_MWATT;
+
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : set Retry limits
+ */
+static int airo_set_retry(struct net_device *dev,
+			  struct iw_request_info *info,
+			  struct iw_param *vwrq,
+			  char *extra)
+{
+	struct airo_info *local = dev->priv;
+	int rc = -EINVAL;
+
+	if(vwrq->disabled) {
+		return -EINVAL;
+	}
+	readConfigRid(local, 1);
+	if(vwrq->flags & IW_RETRY_LIMIT) {
+		if(vwrq->flags & IW_RETRY_MAX)
+			local->config.longRetryLimit = vwrq->value;
+		else if (vwrq->flags & IW_RETRY_MIN)
+			local->config.shortRetryLimit = vwrq->value;
+		else {
+			/* No modifier : set both */
+			local->config.longRetryLimit = vwrq->value;
+			local->config.shortRetryLimit = vwrq->value;
+		}
+		set_bit (FLAG_COMMIT, &local->flags);
+		rc = -EINPROGRESS;		/* Call commit handler */
+	}
+	if(vwrq->flags & IW_RETRY_LIFETIME) {
+		local->config.txLifetime = vwrq->value / 1024;
+		set_bit (FLAG_COMMIT, &local->flags);
+		rc = -EINPROGRESS;		/* Call commit handler */
+	}
+	return rc;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : get Retry limits
+ */
+static int airo_get_retry(struct net_device *dev,
+			  struct iw_request_info *info,
+			  struct iw_param *vwrq,
+			  char *extra)
+{
+	struct airo_info *local = dev->priv;
+
+	vwrq->disabled = 0;      /* Can't be disabled */
+
+	readConfigRid(local, 1);
+	/* Note : by default, display the min retry number */
+	if((vwrq->flags & IW_RETRY_TYPE) == IW_RETRY_LIFETIME) {
+		vwrq->flags = IW_RETRY_LIFETIME;
+		vwrq->value = (int)local->config.txLifetime * 1024;
+	} else if((vwrq->flags & IW_RETRY_MAX)) {
+		vwrq->flags = IW_RETRY_LIMIT | IW_RETRY_MAX;
+		vwrq->value = (int)local->config.longRetryLimit;
+	} else {
+		vwrq->flags = IW_RETRY_LIMIT;
+		vwrq->value = (int)local->config.shortRetryLimit;
+		if((int)local->config.shortRetryLimit != (int)local->config.longRetryLimit)
+			vwrq->flags |= IW_RETRY_MIN;
+	}
+
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : get range info
+ */
+static int airo_get_range(struct net_device *dev,
+			  struct iw_request_info *info,
+			  struct iw_point *dwrq,
+			  char *extra)
+{
+	struct airo_info *local = dev->priv;
+	struct iw_range *range = (struct iw_range *) extra;
+	CapabilityRid cap_rid;		/* Card capability info */
+	int		i;
+	int		k;
+
+	readCapabilityRid(local, &cap_rid, 1);
+
+	dwrq->length = sizeof(struct iw_range);
+	memset(range, 0, sizeof(*range));
+	range->min_nwid = 0x0000;
+	range->max_nwid = 0x0000;
+	range->num_channels = 14;
+	/* Should be based on cap_rid.country to give only
+	 * what the current card support */
+	k = 0;
+	for(i = 0; i < 14; i++) {
+		range->freq[k].i = i + 1; /* List index */
+		range->freq[k].m = frequency_list[i] * 100000;
+		range->freq[k++].e = 1;	/* Values in table in MHz -> * 10^5 * 10 */
+	}
+	range->num_frequency = k;
+
+	/* Hum... Should put the right values there */
+	range->max_qual.qual = airo_get_max_quality(&cap_rid);
+	range->max_qual.level = 0x100 - 120;	/* -120 dBm */
+	range->max_qual.noise = 0;
+	range->sensitivity = 65535;
+
+	for(i = 0 ; i < 8 ; i++) {
+		range->bitrate[i] = cap_rid.supportedRates[i] * 500000;
+		if(range->bitrate[i] == 0)
+			break;
+	}
+	range->num_bitrates = i;
+
+	/* Set an indication of the max TCP throughput
+	 * in bit/s that we can expect using this interface.
+	 * May be use for QoS stuff... Jean II */
+	if(i > 2)
+		range->throughput = 5000 * 1000;
+	else
+		range->throughput = 1500 * 1000;
+
+	range->min_rts = 0;
+	range->max_rts = 2312;
+	range->min_frag = 256;
+	range->max_frag = 2312;
+
+	if(cap_rid.softCap & 2) {
+		// WEP: RC4 40 bits
+		range->encoding_size[0] = 5;
+		// RC4 ~128 bits
+		if (cap_rid.softCap & 0x100) {
+			range->encoding_size[1] = 13;
+			range->num_encoding_sizes = 2;
+		} else
+			range->num_encoding_sizes = 1;
+		range->max_encoding_tokens = (cap_rid.softCap & 0x80) ? 4 : 1;
+	} else {
+		range->num_encoding_sizes = 0;
+		range->max_encoding_tokens = 0;
+	}
+	range->min_pmp = 0;
+	range->max_pmp = 5000000;	/* 5 secs */
+	range->min_pmt = 0;
+	range->max_pmt = 65535 * 1024;	/* ??? */
+	range->pmp_flags = IW_POWER_PERIOD;
+	range->pmt_flags = IW_POWER_TIMEOUT;
+	range->pm_capa = IW_POWER_PERIOD | IW_POWER_TIMEOUT | IW_POWER_ALL_R;
+
+	/* Transmit Power - values are in mW */
+	for(i = 0 ; i < 8 ; i++) {
+		range->txpower[i] = cap_rid.txPowerLevels[i];
+		if(range->txpower[i] == 0)
+			break;
+	}
+	range->num_txpower = i;
+	range->txpower_capa = IW_TXPOW_MWATT;
+	range->we_version_source = 12;
+	range->we_version_compiled = WIRELESS_EXT;
+	range->retry_capa = IW_RETRY_LIMIT | IW_RETRY_LIFETIME;
+	range->retry_flags = IW_RETRY_LIMIT;
+	range->r_time_flags = IW_RETRY_LIFETIME;
+	range->min_retry = 1;
+	range->max_retry = 65535;
+	range->min_r_time = 1024;
+	range->max_r_time = 65535 * 1024;
+	/* Experimental measurements - boundary 11/5.5 Mb/s */
+	/* Note : with or without the (local->rssi), results
+	 * are somewhat different. - Jean II */
+	range->avg_qual.qual = airo_get_avg_quality(&cap_rid);
+	if (local->rssi)
+		range->avg_qual.level = 186;	/* -70 dBm */
+	else
+		range->avg_qual.level = 176;	/* -80 dBm */
+	range->avg_qual.noise = 0;
+
+	/* Event capability (kernel + driver) */
+	range->event_capa[0] = (IW_EVENT_CAPA_K_0 |
+				IW_EVENT_CAPA_MASK(SIOCGIWTHRSPY) |
+				IW_EVENT_CAPA_MASK(SIOCGIWAP) |
+				IW_EVENT_CAPA_MASK(SIOCGIWSCAN));
+	range->event_capa[1] = IW_EVENT_CAPA_K_1;
+	range->event_capa[4] = IW_EVENT_CAPA_MASK(IWEVTXDROP);
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : set Power Management
+ */
+static int airo_set_power(struct net_device *dev,
+			  struct iw_request_info *info,
+			  struct iw_param *vwrq,
+			  char *extra)
+{
+	struct airo_info *local = dev->priv;
+
+	readConfigRid(local, 1);
+	if (vwrq->disabled) {
+		if ((local->config.rmode & 0xFF) >= RXMODE_RFMON) {
+			return -EINVAL;
+		}
+		local->config.powerSaveMode = POWERSAVE_CAM;
+		local->config.rmode &= 0xFF00;
+		local->config.rmode |= RXMODE_BC_MC_ADDR;
+		set_bit (FLAG_COMMIT, &local->flags);
+		return -EINPROGRESS;		/* Call commit handler */
+	}
+	if ((vwrq->flags & IW_POWER_TYPE) == IW_POWER_TIMEOUT) {
+		local->config.fastListenDelay = (vwrq->value + 500) / 1024;
+		local->config.powerSaveMode = POWERSAVE_PSPCAM;
+		set_bit (FLAG_COMMIT, &local->flags);
+	} else if ((vwrq->flags & IW_POWER_TYPE) == IW_POWER_PERIOD) {
+		local->config.fastListenInterval = local->config.listenInterval = (vwrq->value + 500) / 1024;
+		local->config.powerSaveMode = POWERSAVE_PSPCAM;
+		set_bit (FLAG_COMMIT, &local->flags);
+	}
+	switch (vwrq->flags & IW_POWER_MODE) {
+		case IW_POWER_UNICAST_R:
+			if ((local->config.rmode & 0xFF) >= RXMODE_RFMON) {
+				return -EINVAL;
+			}
+			local->config.rmode &= 0xFF00;
+			local->config.rmode |= RXMODE_ADDR;
+			set_bit (FLAG_COMMIT, &local->flags);
+			break;
+		case IW_POWER_ALL_R:
+			if ((local->config.rmode & 0xFF) >= RXMODE_RFMON) {
+				return -EINVAL;
+			}
+			local->config.rmode &= 0xFF00;
+			local->config.rmode |= RXMODE_BC_MC_ADDR;
+			set_bit (FLAG_COMMIT, &local->flags);
+		case IW_POWER_ON:
+			break;
+		default:
+			return -EINVAL;
+	}
+	// Note : we may want to factor local->need_commit here
+	// Note2 : may also want to factor RXMODE_RFMON test
+	return -EINPROGRESS;		/* Call commit handler */
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : get Power Management
+ */
+static int airo_get_power(struct net_device *dev,
+			  struct iw_request_info *info,
+			  struct iw_param *vwrq,
+			  char *extra)
+{
+	struct airo_info *local = dev->priv;
+	int mode;
+
+	readConfigRid(local, 1);
+	mode = local->config.powerSaveMode;
+	if ((vwrq->disabled = (mode == POWERSAVE_CAM)))
+		return 0;
+	if ((vwrq->flags & IW_POWER_TYPE) == IW_POWER_TIMEOUT) {
+		vwrq->value = (int)local->config.fastListenDelay * 1024;
+		vwrq->flags = IW_POWER_TIMEOUT;
+	} else {
+		vwrq->value = (int)local->config.fastListenInterval * 1024;
+		vwrq->flags = IW_POWER_PERIOD;
+	}
+	if ((local->config.rmode & 0xFF) == RXMODE_ADDR)
+		vwrq->flags |= IW_POWER_UNICAST_R;
+	else
+		vwrq->flags |= IW_POWER_ALL_R;
+
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : set Sensitivity
+ */
+static int airo_set_sens(struct net_device *dev,
+			 struct iw_request_info *info,
+			 struct iw_param *vwrq,
+			 char *extra)
+{
+	struct airo_info *local = dev->priv;
+
+	readConfigRid(local, 1);
+	local->config.rssiThreshold = vwrq->disabled ? RSSI_DEFAULT : vwrq->value;
+	set_bit (FLAG_COMMIT, &local->flags);
+
+	return -EINPROGRESS;		/* Call commit handler */
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : get Sensitivity
+ */
+static int airo_get_sens(struct net_device *dev,
+			 struct iw_request_info *info,
+			 struct iw_param *vwrq,
+			 char *extra)
+{
+	struct airo_info *local = dev->priv;
+
+	readConfigRid(local, 1);
+	vwrq->value = local->config.rssiThreshold;
+	vwrq->disabled = (vwrq->value == 0);
+	vwrq->fixed = 1;
+
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : get AP List
+ * Note : this is deprecated in favor of IWSCAN
+ */
+static int airo_get_aplist(struct net_device *dev,
+			   struct iw_request_info *info,
+			   struct iw_point *dwrq,
+			   char *extra)
+{
+	struct airo_info *local = dev->priv;
+	struct sockaddr *address = (struct sockaddr *) extra;
+	struct iw_quality qual[IW_MAX_AP];
+	BSSListRid BSSList;
+	int i;
+	int loseSync = capable(CAP_NET_ADMIN) ? 1: -1;
+
+	for (i = 0; i < IW_MAX_AP; i++) {
+		if (readBSSListRid(local, loseSync, &BSSList))
+			break;
+		loseSync = 0;
+		memcpy(address[i].sa_data, BSSList.bssid, ETH_ALEN);
+		address[i].sa_family = ARPHRD_ETHER;
+		if (local->rssi)
+			qual[i].level = 0x100 - local->rssi[BSSList.rssi].rssidBm;
+		else
+			qual[i].level = (BSSList.rssi + 321) / 2;
+		qual[i].qual = qual[i].noise = 0;
+		qual[i].updated = 2;
+		if (BSSList.index == 0xffff)
+			break;
+	}
+	if (!i) {
+		StatusRid status_rid;		/* Card status info */
+		readStatusRid(local, &status_rid, 1);
+		for (i = 0;
+		     i < min(IW_MAX_AP, 4) &&
+			     (status_rid.bssid[i][0]
+			      & status_rid.bssid[i][1]
+			      & status_rid.bssid[i][2]
+			      & status_rid.bssid[i][3]
+			      & status_rid.bssid[i][4]
+			      & status_rid.bssid[i][5])!=0xff &&
+			     (status_rid.bssid[i][0]
+			      | status_rid.bssid[i][1]
+			      | status_rid.bssid[i][2]
+			      | status_rid.bssid[i][3]
+			      | status_rid.bssid[i][4]
+			      | status_rid.bssid[i][5]);
+		     i++) {
+			memcpy(address[i].sa_data,
+			       status_rid.bssid[i], ETH_ALEN);
+			address[i].sa_family = ARPHRD_ETHER;
+		}
+	} else {
+		dwrq->flags = 1; /* Should be define'd */
+		memcpy(extra + sizeof(struct sockaddr)*i,
+		       &qual,  sizeof(struct iw_quality)*i);
+	}
+	dwrq->length = i;
+
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : Initiate Scan
+ */
+static int airo_set_scan(struct net_device *dev,
+			 struct iw_request_info *info,
+			 struct iw_param *vwrq,
+			 char *extra)
+{
+	struct airo_info *ai = dev->priv;
+	Cmd cmd;
+	Resp rsp;
+
+	/* Note : you may have realised that, as this is a SET operation,
+	 * this is privileged and therefore a normal user can't
+	 * perform scanning.
+	 * This is not an error, while the device perform scanning,
+	 * traffic doesn't flow, so it's a perfect DoS...
+	 * Jean II */
+	if (ai->flags & FLAG_RADIO_MASK) return -ENETDOWN;
+
+	/* Initiate a scan command */
+	memset(&cmd, 0, sizeof(cmd));
+	cmd.cmd=CMD_LISTBSS;
+	if (down_interruptible(&ai->sem))
+		return -ERESTARTSYS;
+	issuecommand(ai, &cmd, &rsp);
+	ai->scan_timestamp = jiffies;
+	up(&ai->sem);
+
+	/* At this point, just return to the user. */
+
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Translate scan data returned from the card to a card independent
+ * format that the Wireless Tools will understand - Jean II
+ */
+static inline char *airo_translate_scan(struct net_device *dev,
+					char *current_ev,
+					char *end_buf,
+					BSSListRid *list)
+{
+	struct airo_info *ai = dev->priv;
+	struct iw_event		iwe;		/* Temporary buffer */
+	u16			capabilities;
+	char *			current_val;	/* For rates */
+	int			i;
+
+	/* First entry *MUST* be the AP MAC address */
+	iwe.cmd = SIOCGIWAP;
+	iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
+	memcpy(iwe.u.ap_addr.sa_data, list->bssid, ETH_ALEN);
+	current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe, IW_EV_ADDR_LEN);
+
+	/* Other entries will be displayed in the order we give them */
+
+	/* Add the ESSID */
+	iwe.u.data.length = list->ssidLen;
+	if(iwe.u.data.length > 32)
+		iwe.u.data.length = 32;
+	iwe.cmd = SIOCGIWESSID;
+	iwe.u.data.flags = 1;
+	current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe, list->ssid);
+
+	/* Add mode */
+	iwe.cmd = SIOCGIWMODE;
+	capabilities = le16_to_cpu(list->cap);
+	if(capabilities & (CAP_ESS | CAP_IBSS)) {
+		if(capabilities & CAP_ESS)
+			iwe.u.mode = IW_MODE_MASTER;
+		else
+			iwe.u.mode = IW_MODE_ADHOC;
+		current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe, IW_EV_UINT_LEN);
+	}
+
+	/* Add frequency */
+	iwe.cmd = SIOCGIWFREQ;
+	iwe.u.freq.m = le16_to_cpu(list->dsChannel);
+	iwe.u.freq.m = frequency_list[iwe.u.freq.m] * 100000;
+	iwe.u.freq.e = 1;
+	current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe, IW_EV_FREQ_LEN);
+
+	/* Add quality statistics */
+	iwe.cmd = IWEVQUAL;
+	if (ai->rssi)
+		iwe.u.qual.level = 0x100 - ai->rssi[list->rssi].rssidBm;
+	else
+		iwe.u.qual.level = (list->rssi + 321) / 2;
+	iwe.u.qual.noise = 0;
+	iwe.u.qual.qual = 0;
+	current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe, IW_EV_QUAL_LEN);
+
+	/* Add encryption capability */
+	iwe.cmd = SIOCGIWENCODE;
+	if(capabilities & CAP_PRIVACY)
+		iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
+	else
+		iwe.u.data.flags = IW_ENCODE_DISABLED;
+	iwe.u.data.length = 0;
+	current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe, list->ssid);
+
+	/* Rate : stuffing multiple values in a single event require a bit
+	 * more of magic - Jean II */
+	current_val = current_ev + IW_EV_LCP_LEN;
+
+	iwe.cmd = SIOCGIWRATE;
+	/* Those two flags are ignored... */
+	iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
+	/* Max 8 values */
+	for(i = 0 ; i < 8 ; i++) {
+		/* NULL terminated */
+		if(list->rates[i] == 0)
+			break;
+		/* Bit rate given in 500 kb/s units (+ 0x80) */
+		iwe.u.bitrate.value = ((list->rates[i] & 0x7f) * 500000);
+		/* Add new value to event */
+		current_val = iwe_stream_add_value(current_ev, current_val, end_buf, &iwe, IW_EV_PARAM_LEN);
+	}
+	/* Check if we added any event */
+	if((current_val - current_ev) > IW_EV_LCP_LEN)
+		current_ev = current_val;
+
+	/* The other data in the scan result are not really
+	 * interesting, so for now drop it - Jean II */
+	return current_ev;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : Read Scan Results
+ */
+static int airo_get_scan(struct net_device *dev,
+			 struct iw_request_info *info,
+			 struct iw_point *dwrq,
+			 char *extra)
+{
+	struct airo_info *ai = dev->priv;
+	BSSListRid BSSList;
+	int rc;
+	char *current_ev = extra;
+
+	/* When we are associated again, the scan has surely finished.
+	 * Just in case, let's make sure enough time has elapsed since
+	 * we started the scan. - Javier */
+	if(ai->scan_timestamp && time_before(jiffies,ai->scan_timestamp+3*HZ)) {
+		/* Important note : we don't want to block the caller
+		 * until results are ready for various reasons.
+		 * First, managing wait queues is complex and racy
+		 * (there may be multiple simultaneous callers).
+		 * Second, we grab some rtnetlink lock before comming
+		 * here (in dev_ioctl()).
+		 * Third, the caller can wait on the Wireless Event
+		 * - Jean II */
+		return -EAGAIN;
+	}
+	ai->scan_timestamp = 0;
+
+	/* There's only a race with proc_BSSList_open(), but its
+	 * consequences are begnign. So I don't bother fixing it - Javier */
+
+	/* Try to read the first entry of the scan result */
+	rc = PC4500_readrid(ai, RID_BSSLISTFIRST, &BSSList, sizeof(BSSList), 1);
+	if((rc) || (BSSList.index == 0xffff)) {
+		/* Client error, no scan results...
+		 * The caller need to restart the scan. */
+		return -ENODATA;
+	}
+
+	/* Read and parse all entries */
+	while((!rc) && (BSSList.index != 0xffff)) {
+		/* Translate to WE format this entry */
+		current_ev = airo_translate_scan(dev, current_ev,
+						 extra + dwrq->length,
+						 &BSSList);
+
+		/* Check if there is space for one more entry */
+		if((extra + dwrq->length - current_ev) <= IW_EV_ADDR_LEN) {
+			/* Ask user space to try again with a bigger buffer */
+			return -E2BIG;
+		}
+
+		/* Read next entry */
+		rc = PC4500_readrid(ai, RID_BSSLISTNEXT,
+				    &BSSList, sizeof(BSSList), 1);
+	}
+	/* Length of data */
+	dwrq->length = (current_ev - extra);
+	dwrq->flags = 0;	/* todo */
+
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Commit handler : called after a bunch of SET operations
+ */
+static int airo_config_commit(struct net_device *dev,
+			      struct iw_request_info *info,	/* NULL */
+			      void *zwrq,			/* NULL */
+			      char *extra)			/* NULL */
+{
+	struct airo_info *local = dev->priv;
+	Resp rsp;
+
+	if (!test_bit (FLAG_COMMIT, &local->flags))
+		return 0;
+
+	/* Some of the "SET" function may have modified some of the
+	 * parameters. It's now time to commit them in the card */
+	disable_MAC(local, 1);
+	if (test_bit (FLAG_RESET, &local->flags)) {
+		APListRid APList_rid;
+		SsidRid SSID_rid;
+
+		readAPListRid(local, &APList_rid);
+		readSsidRid(local, &SSID_rid);
+		if (test_bit(FLAG_MPI,&local->flags))
+			setup_card(local, dev->dev_addr, 1 );
+		else
+			reset_airo_card(dev);
+		disable_MAC(local, 1);
+		writeSsidRid(local, &SSID_rid, 1);
+		writeAPListRid(local, &APList_rid, 1);
+	}
+	if (down_interruptible(&local->sem))
+		return -ERESTARTSYS;
+	writeConfigRid(local, 0);
+	enable_MAC(local, &rsp, 0);
+	if (test_bit (FLAG_RESET, &local->flags))
+		airo_set_promisc(local);
+	else
+		up(&local->sem);
+
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Structures to export the Wireless Handlers
+ */
+
+static const struct iw_priv_args airo_private_args[] = {
+/*{ cmd,         set_args,                            get_args, name } */
+  { AIROIOCTL, IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | sizeof (aironet_ioctl),
+    IW_PRIV_TYPE_BYTE | 2047, "airoioctl" },
+  { AIROIDIFC, IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | sizeof (aironet_ioctl),
+    IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "airoidifc" },
+};
+
+static const iw_handler		airo_handler[] =
+{
+	(iw_handler) airo_config_commit,	/* SIOCSIWCOMMIT */
+	(iw_handler) airo_get_name,		/* SIOCGIWNAME */
+	(iw_handler) NULL,			/* SIOCSIWNWID */
+	(iw_handler) NULL,			/* SIOCGIWNWID */
+	(iw_handler) airo_set_freq,		/* SIOCSIWFREQ */
+	(iw_handler) airo_get_freq,		/* SIOCGIWFREQ */
+	(iw_handler) airo_set_mode,		/* SIOCSIWMODE */
+	(iw_handler) airo_get_mode,		/* SIOCGIWMODE */
+	(iw_handler) airo_set_sens,		/* SIOCSIWSENS */
+	(iw_handler) airo_get_sens,		/* SIOCGIWSENS */
+	(iw_handler) NULL,			/* SIOCSIWRANGE */
+	(iw_handler) airo_get_range,		/* SIOCGIWRANGE */
+	(iw_handler) NULL,			/* SIOCSIWPRIV */
+	(iw_handler) NULL,			/* SIOCGIWPRIV */
+	(iw_handler) NULL,			/* SIOCSIWSTATS */
+	(iw_handler) NULL,			/* SIOCGIWSTATS */
+	iw_handler_set_spy,			/* SIOCSIWSPY */
+	iw_handler_get_spy,			/* SIOCGIWSPY */
+	iw_handler_set_thrspy,			/* SIOCSIWTHRSPY */
+	iw_handler_get_thrspy,			/* SIOCGIWTHRSPY */
+	(iw_handler) airo_set_wap,		/* SIOCSIWAP */
+	(iw_handler) airo_get_wap,		/* SIOCGIWAP */
+	(iw_handler) NULL,			/* -- hole -- */
+	(iw_handler) airo_get_aplist,		/* SIOCGIWAPLIST */
+	(iw_handler) airo_set_scan,		/* SIOCSIWSCAN */
+	(iw_handler) airo_get_scan,		/* SIOCGIWSCAN */
+	(iw_handler) airo_set_essid,		/* SIOCSIWESSID */
+	(iw_handler) airo_get_essid,		/* SIOCGIWESSID */
+	(iw_handler) airo_set_nick,		/* SIOCSIWNICKN */
+	(iw_handler) airo_get_nick,		/* SIOCGIWNICKN */
+	(iw_handler) NULL,			/* -- hole -- */
+	(iw_handler) NULL,			/* -- hole -- */
+	(iw_handler) airo_set_rate,		/* SIOCSIWRATE */
+	(iw_handler) airo_get_rate,		/* SIOCGIWRATE */
+	(iw_handler) airo_set_rts,		/* SIOCSIWRTS */
+	(iw_handler) airo_get_rts,		/* SIOCGIWRTS */
+	(iw_handler) airo_set_frag,		/* SIOCSIWFRAG */
+	(iw_handler) airo_get_frag,		/* SIOCGIWFRAG */
+	(iw_handler) airo_set_txpow,		/* SIOCSIWTXPOW */
+	(iw_handler) airo_get_txpow,		/* SIOCGIWTXPOW */
+	(iw_handler) airo_set_retry,		/* SIOCSIWRETRY */
+	(iw_handler) airo_get_retry,		/* SIOCGIWRETRY */
+	(iw_handler) airo_set_encode,		/* SIOCSIWENCODE */
+	(iw_handler) airo_get_encode,		/* SIOCGIWENCODE */
+	(iw_handler) airo_set_power,		/* SIOCSIWPOWER */
+	(iw_handler) airo_get_power,		/* SIOCGIWPOWER */
+};
+
+/* Note : don't describe AIROIDIFC and AIROOLDIDIFC in here.
+ * We want to force the use of the ioctl code, because those can't be
+ * won't work the iw_handler code (because they simultaneously read
+ * and write data and iw_handler can't do that).
+ * Note that it's perfectly legal to read/write on a single ioctl command,
+ * you just can't use iwpriv and need to force it via the ioctl handler.
+ * Jean II */
+static const iw_handler		airo_private_handler[] =
+{
+	NULL,				/* SIOCIWFIRSTPRIV */
+};
+
+static const struct iw_handler_def	airo_handler_def =
+{
+	.num_standard	= sizeof(airo_handler)/sizeof(iw_handler),
+	.num_private	= sizeof(airo_private_handler)/sizeof(iw_handler),
+	.num_private_args = sizeof(airo_private_args)/sizeof(struct iw_priv_args),
+	.standard	= airo_handler,
+	.private	= airo_private_handler,
+	.private_args	= airo_private_args,
+	.get_wireless_stats = airo_get_wireless_stats,
+};
+
+#endif /* WIRELESS_EXT */
+
+/*
+ * This defines the configuration part of the Wireless Extensions
+ * Note : irq and spinlock protection will occur in the subroutines
+ *
+ * TODO :
+ *	o Check input value more carefully and fill correct values in range
+ *	o Test and shakeout the bugs (if any)
+ *
+ * Jean II
+ *
+ * Javier Achirica did a great job of merging code from the unnamed CISCO
+ * developer that added support for flashing the card.
+ */
+static int airo_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
+{
+	int rc = 0;
+	struct airo_info *ai = (struct airo_info *)dev->priv;
+
+	if (ai->power)
+		return 0;
+
+	switch (cmd) {
+#ifdef CISCO_EXT
+	case AIROIDIFC:
+#ifdef AIROOLDIDIFC
+	case AIROOLDIDIFC:
+#endif
+	{
+		int val = AIROMAGIC;
+		aironet_ioctl com;
+		if (copy_from_user(&com,rq->ifr_data,sizeof(com)))
+			rc = -EFAULT;
+		else if (copy_to_user(com.data,(char *)&val,sizeof(val)))
+			rc = -EFAULT;
+	}
+	break;
+
+	case AIROIOCTL:
+#ifdef AIROOLDIOCTL
+	case AIROOLDIOCTL:
+#endif
+		/* Get the command struct and hand it off for evaluation by
+		 * the proper subfunction
+		 */
+	{
+		aironet_ioctl com;
+		if (copy_from_user(&com,rq->ifr_data,sizeof(com))) {
+			rc = -EFAULT;
+			break;
+		}
+
+		/* Separate R/W functions bracket legality here
+		 */
+		if ( com.command == AIRORSWVERSION ) {
+			if (copy_to_user(com.data, swversion, sizeof(swversion)))
+				rc = -EFAULT;
+			else
+				rc = 0;
+		}
+		else if ( com.command <= AIRORRID)
+			rc = readrids(dev,&com);
+		else if ( com.command >= AIROPCAP && com.command <= (AIROPLEAPUSR+2) )
+			rc = writerids(dev,&com);
+		else if ( com.command >= AIROFLSHRST && com.command <= AIRORESTART )
+			rc = flashcard(dev,&com);
+		else
+			rc = -EINVAL;      /* Bad command in ioctl */
+	}
+	break;
+#endif /* CISCO_EXT */
+
+	// All other calls are currently unsupported
+	default:
+		rc = -EOPNOTSUPP;
+	}
+	return rc;
+}
+
+#ifdef WIRELESS_EXT
+/*
+ * Get the Wireless stats out of the driver
+ * Note : irq and spinlock protection will occur in the subroutines
+ *
+ * TODO :
+ *	o Check if work in Ad-Hoc mode (otherwise, use SPY, as in wvlan_cs)
+ *
+ * Jean
+ */
+static void airo_read_wireless_stats(struct airo_info *local)
+{
+	StatusRid status_rid;
+	StatsRid stats_rid;
+	CapabilityRid cap_rid;
+	u32 *vals = stats_rid.vals;
+
+	/* Get stats out of the card */
+	clear_bit(JOB_WSTATS, &local->flags);
+	if (local->power) {
+		up(&local->sem);
+		return;
+	}
+	readCapabilityRid(local, &cap_rid, 0);
+	readStatusRid(local, &status_rid, 0);
+	readStatsRid(local, &stats_rid, RID_STATS, 0);
+	up(&local->sem);
+
+	/* The status */
+	local->wstats.status = status_rid.mode;
+
+	/* Signal quality and co. But where is the noise level ??? */
+	local->wstats.qual.qual = airo_get_quality(&status_rid, &cap_rid);
+	if (local->rssi)
+		local->wstats.qual.level = 0x100 - local->rssi[status_rid.sigQuality].rssidBm;
+	else
+		local->wstats.qual.level = (status_rid.normalizedSignalStrength + 321) / 2;
+	if (status_rid.len >= 124) {
+		local->wstats.qual.noise = 256 - status_rid.noisedBm;
+		local->wstats.qual.updated = 7;
+	} else {
+		local->wstats.qual.noise = 0;
+		local->wstats.qual.updated = 3;
+	}
+
+	/* Packets discarded in the wireless adapter due to wireless
+	 * specific problems */
+	local->wstats.discard.nwid = vals[56] + vals[57] + vals[58];/* SSID Mismatch */
+	local->wstats.discard.code = vals[6];/* RxWepErr */
+	local->wstats.discard.fragment = vals[30];
+	local->wstats.discard.retries = vals[10];
+	local->wstats.discard.misc = vals[1] + vals[32];
+	local->wstats.miss.beacon = vals[34];
+}
+
+struct iw_statistics *airo_get_wireless_stats(struct net_device *dev)
+{
+	struct airo_info *local =  dev->priv;
+
+	if (!test_bit(JOB_WSTATS, &local->flags)) {
+		/* Get stats out of the card if available */
+		if (down_trylock(&local->sem) != 0) {
+			set_bit(JOB_WSTATS, &local->flags);
+			wake_up_interruptible(&local->thr_wait);
+		} else
+			airo_read_wireless_stats(local);
+	}
+
+	return &local->wstats;
+}
+#endif /* WIRELESS_EXT */
+
+#ifdef CISCO_EXT
+/*
+ * This just translates from driver IOCTL codes to the command codes to
+ * feed to the radio's host interface. Things can be added/deleted
+ * as needed.  This represents the READ side of control I/O to
+ * the card
+ */
+static int readrids(struct net_device *dev, aironet_ioctl *comp) {
+	unsigned short ridcode;
+	unsigned char *iobuf;
+	int len;
+	struct airo_info *ai = dev->priv;
+	Resp rsp;
+
+	if (test_bit(FLAG_FLASHING, &ai->flags))
+		return -EIO;
+
+	switch(comp->command)
+	{
+	case AIROGCAP:      ridcode = RID_CAPABILITIES; break;
+	case AIROGCFG:      ridcode = RID_CONFIG;
+		if (test_bit(FLAG_COMMIT, &ai->flags)) {
+			disable_MAC (ai, 1);
+			writeConfigRid (ai, 1);
+			enable_MAC (ai, &rsp, 1);
+		}
+		break;
+	case AIROGSLIST:    ridcode = RID_SSID;         break;
+	case AIROGVLIST:    ridcode = RID_APLIST;       break;
+	case AIROGDRVNAM:   ridcode = RID_DRVNAME;      break;
+	case AIROGEHTENC:   ridcode = RID_ETHERENCAP;   break;
+	case AIROGWEPKTMP:  ridcode = RID_WEP_TEMP;
+		/* Only super-user can read WEP keys */
+		if (!capable(CAP_NET_ADMIN))
+			return -EPERM;
+		break;
+	case AIROGWEPKNV:   ridcode = RID_WEP_PERM;
+		/* Only super-user can read WEP keys */
+		if (!capable(CAP_NET_ADMIN))
+			return -EPERM;
+		break;
+	case AIROGSTAT:     ridcode = RID_STATUS;       break;
+	case AIROGSTATSD32: ridcode = RID_STATSDELTA;   break;
+	case AIROGSTATSC32: ridcode = RID_STATS;        break;
+#ifdef MICSUPPORT
+	case AIROGMICSTATS:
+		if (copy_to_user(comp->data, &ai->micstats,
+				 min((int)comp->len,(int)sizeof(ai->micstats))))
+			return -EFAULT;
+		return 0;
+#endif
+	case AIRORRID:      ridcode = comp->ridnum;     break;
+	default:
+		return -EINVAL;
+		break;
+	}
+
+	if ((iobuf = kmalloc(RIDSIZE, GFP_KERNEL)) == NULL)
+		return -ENOMEM;
+
+	PC4500_readrid(ai,ridcode,iobuf,RIDSIZE, 1);
+	/* get the count of bytes in the rid  docs say 1st 2 bytes is it.
+	 * then return it to the user
+	 * 9/22/2000 Honor user given length
+	 */
+	len = comp->len;
+
+	if (copy_to_user(comp->data, iobuf, min(len, (int)RIDSIZE))) {
+		kfree (iobuf);
+		return -EFAULT;
+	}
+	kfree (iobuf);
+	return 0;
+}
+
+/*
+ * Danger Will Robinson write the rids here
+ */
+
+static int writerids(struct net_device *dev, aironet_ioctl *comp) {
+	struct airo_info *ai = dev->priv;
+	int  ridcode;
+#ifdef MICSUPPORT
+        int  enabled;
+#endif
+	Resp      rsp;
+	static int (* writer)(struct airo_info *, u16 rid, const void *, int, int);
+	unsigned char *iobuf;
+
+	/* Only super-user can write RIDs */
+	if (!capable(CAP_NET_ADMIN))
+		return -EPERM;
+
+	if (test_bit(FLAG_FLASHING, &ai->flags))
+		return -EIO;
+
+	ridcode = 0;
+	writer = do_writerid;
+
+	switch(comp->command)
+	{
+	case AIROPSIDS:     ridcode = RID_SSID;         break;
+	case AIROPCAP:      ridcode = RID_CAPABILITIES; break;
+	case AIROPAPLIST:   ridcode = RID_APLIST;       break;
+	case AIROPCFG: ai->config.len = 0;
+			    clear_bit(FLAG_COMMIT, &ai->flags);
+			    ridcode = RID_CONFIG;       break;
+	case AIROPWEPKEYNV: ridcode = RID_WEP_PERM;     break;
+	case AIROPLEAPUSR:  ridcode = RID_LEAPUSERNAME; break;
+	case AIROPLEAPPWD:  ridcode = RID_LEAPPASSWORD; break;
+	case AIROPWEPKEY:   ridcode = RID_WEP_TEMP; writer = PC4500_writerid;
+		break;
+	case AIROPLEAPUSR+1: ridcode = 0xFF2A;          break;
+	case AIROPLEAPUSR+2: ridcode = 0xFF2B;          break;
+
+		/* this is not really a rid but a command given to the card
+		 * same with MAC off
+		 */
+	case AIROPMACON:
+		if (enable_MAC(ai, &rsp, 1) != 0)
+			return -EIO;
+		return 0;
+
+		/*
+		 * Evidently this code in the airo driver does not get a symbol
+		 * as disable_MAC. it's probably so short the compiler does not gen one.
+		 */
+	case AIROPMACOFF:
+		disable_MAC(ai, 1);
+		return 0;
+
+		/* This command merely clears the counts does not actually store any data
+		 * only reads rid. But as it changes the cards state, I put it in the
+		 * writerid routines.
+		 */
+	case AIROPSTCLR:
+		if ((iobuf = kmalloc(RIDSIZE, GFP_KERNEL)) == NULL)
+			return -ENOMEM;
+
+		PC4500_readrid(ai,RID_STATSDELTACLEAR,iobuf,RIDSIZE, 1);
+
+#ifdef MICSUPPORT
+		enabled = ai->micstats.enabled;
+		memset(&ai->micstats,0,sizeof(ai->micstats));
+		ai->micstats.enabled = enabled;
+#endif
+
+		if (copy_to_user(comp->data, iobuf,
+				 min((int)comp->len, (int)RIDSIZE))) {
+			kfree (iobuf);
+			return -EFAULT;
+		}
+		kfree (iobuf);
+		return 0;
+
+	default:
+		return -EOPNOTSUPP;	/* Blarg! */
+	}
+	if(comp->len > RIDSIZE)
+		return -EINVAL;
+
+	if ((iobuf = kmalloc(RIDSIZE, GFP_KERNEL)) == NULL)
+		return -ENOMEM;
+
+	if (copy_from_user(iobuf,comp->data,comp->len)) {
+		kfree (iobuf);
+		return -EFAULT;
+	}
+
+	if (comp->command == AIROPCFG) {
+		ConfigRid *cfg = (ConfigRid *)iobuf;
+
+		if (test_bit(FLAG_MIC_CAPABLE, &ai->flags))
+			cfg->opmode |= MODE_MIC;
+
+		if ((cfg->opmode & 0xFF) == MODE_STA_IBSS)
+			set_bit (FLAG_ADHOC, &ai->flags);
+		else
+			clear_bit (FLAG_ADHOC, &ai->flags);
+	}
+
+	if((*writer)(ai, ridcode, iobuf,comp->len,1)) {
+		kfree (iobuf);
+		return -EIO;
+	}
+	kfree (iobuf);
+	return 0;
+}
+
+/*****************************************************************************
+ * Ancillary flash / mod functions much black magic lurkes here              *
+ *****************************************************************************
+ */
+
+/*
+ * Flash command switch table
+ */
+
+int flashcard(struct net_device *dev, aironet_ioctl *comp) {
+	int z;
+	int cmdreset(struct airo_info *);
+	int setflashmode(struct airo_info *);
+	int flashgchar(struct airo_info *,int,int);
+	int flashpchar(struct airo_info *,int,int);
+	int flashputbuf(struct airo_info *);
+	int flashrestart(struct airo_info *,struct net_device *);
+
+	/* Only super-user can modify flash */
+	if (!capable(CAP_NET_ADMIN))
+		return -EPERM;
+
+	switch(comp->command)
+	{
+	case AIROFLSHRST:
+		return cmdreset((struct airo_info *)dev->priv);
+
+	case AIROFLSHSTFL:
+		if (!((struct airo_info *)dev->priv)->flash &&
+			(((struct airo_info *)dev->priv)->flash = kmalloc (FLASHSIZE, GFP_KERNEL)) == NULL)
+			return -ENOMEM;
+		return setflashmode((struct airo_info *)dev->priv);
+
+	case AIROFLSHGCHR: /* Get char from aux */
+		if(comp->len != sizeof(int))
+			return -EINVAL;
+		if (copy_from_user(&z,comp->data,comp->len))
+			return -EFAULT;
+		return flashgchar((struct airo_info *)dev->priv,z,8000);
+
+	case AIROFLSHPCHR: /* Send char to card. */
+		if(comp->len != sizeof(int))
+			return -EINVAL;
+		if (copy_from_user(&z,comp->data,comp->len))
+			return -EFAULT;
+		return flashpchar((struct airo_info *)dev->priv,z,8000);
+
+	case AIROFLPUTBUF: /* Send 32k to card */
+		if (!((struct airo_info *)dev->priv)->flash)
+			return -ENOMEM;
+		if(comp->len > FLASHSIZE)
+			return -EINVAL;
+		if(copy_from_user(((struct airo_info *)dev->priv)->flash,comp->data,comp->len))
+			return -EFAULT;
+
+		flashputbuf((struct airo_info *)dev->priv);
+		return 0;
+
+	case AIRORESTART:
+		if(flashrestart((struct airo_info *)dev->priv,dev))
+			return -EIO;
+		return 0;
+	}
+	return -EINVAL;
+}
+
+#define FLASH_COMMAND  0x7e7e
+
+/*
+ * STEP 1)
+ * Disable MAC and do soft reset on
+ * card.
+ */
+
+int cmdreset(struct airo_info *ai) {
+	disable_MAC(ai, 1);
+
+	if(!waitbusy (ai)){
+		printk(KERN_INFO "Waitbusy hang before RESET\n");
+		return -EBUSY;
+	}
+
+	OUT4500(ai,COMMAND,CMD_SOFTRESET);
+
+	ssleep(1);			/* WAS 600 12/7/00 */
+
+	if(!waitbusy (ai)){
+		printk(KERN_INFO "Waitbusy hang AFTER RESET\n");
+		return -EBUSY;
+	}
+	return 0;
+}
+
+/* STEP 2)
+ * Put the card in legendary flash
+ * mode
+ */
+
+int setflashmode (struct airo_info *ai) {
+	set_bit (FLAG_FLASHING, &ai->flags);
+
+	OUT4500(ai, SWS0, FLASH_COMMAND);
+	OUT4500(ai, SWS1, FLASH_COMMAND);
+	if (probe) {
+		OUT4500(ai, SWS0, FLASH_COMMAND);
+		OUT4500(ai, COMMAND,0x10);
+	} else {
+		OUT4500(ai, SWS2, FLASH_COMMAND);
+		OUT4500(ai, SWS3, FLASH_COMMAND);
+		OUT4500(ai, COMMAND,0);
+	}
+	msleep(500);		/* 500ms delay */
+
+	if(!waitbusy(ai)) {
+		clear_bit (FLAG_FLASHING, &ai->flags);
+		printk(KERN_INFO "Waitbusy hang after setflash mode\n");
+		return -EIO;
+	}
+	return 0;
+}
+
+/* Put character to SWS0 wait for dwelltime
+ * x 50us for  echo .
+ */
+
+int flashpchar(struct airo_info *ai,int byte,int dwelltime) {
+	int echo;
+	int waittime;
+
+	byte |= 0x8000;
+
+	if(dwelltime == 0 )
+		dwelltime = 200;
+
+	waittime=dwelltime;
+
+	/* Wait for busy bit d15 to go false indicating buffer empty */
+	while ((IN4500 (ai, SWS0) & 0x8000) && waittime > 0) {
+		udelay (50);
+		waittime -= 50;
+	}
+
+	/* timeout for busy clear wait */
+	if(waittime <= 0 ){
+		printk(KERN_INFO "flash putchar busywait timeout! \n");
+		return -EBUSY;
+	}
+
+	/* Port is clear now write byte and wait for it to echo back */
+	do {
+		OUT4500(ai,SWS0,byte);
+		udelay(50);
+		dwelltime -= 50;
+		echo = IN4500(ai,SWS1);
+	} while (dwelltime >= 0 && echo != byte);
+
+	OUT4500(ai,SWS1,0);
+
+	return (echo == byte) ? 0 : -EIO;
+}
+
+/*
+ * Get a character from the card matching matchbyte
+ * Step 3)
+ */
+int flashgchar(struct airo_info *ai,int matchbyte,int dwelltime){
+	int           rchar;
+	unsigned char rbyte=0;
+
+	do {
+		rchar = IN4500(ai,SWS1);
+
+		if(dwelltime && !(0x8000 & rchar)){
+			dwelltime -= 10;
+			mdelay(10);
+			continue;
+		}
+		rbyte = 0xff & rchar;
+
+		if( (rbyte == matchbyte) && (0x8000 & rchar) ){
+			OUT4500(ai,SWS1,0);
+			return 0;
+		}
+		if( rbyte == 0x81 || rbyte == 0x82 || rbyte == 0x83 || rbyte == 0x1a || 0xffff == rchar)
+			break;
+		OUT4500(ai,SWS1,0);
+
+	}while(dwelltime > 0);
+	return -EIO;
+}
+
+/*
+ * Transfer 32k of firmware data from user buffer to our buffer and
+ * send to the card
+ */
+
+int flashputbuf(struct airo_info *ai){
+	int            nwords;
+
+	/* Write stuff */
+	if (test_bit(FLAG_MPI,&ai->flags))
+		memcpy_toio(ai->pciaux + 0x8000, ai->flash, FLASHSIZE);
+	else {
+		OUT4500(ai,AUXPAGE,0x100);
+		OUT4500(ai,AUXOFF,0);
+
+		for(nwords=0;nwords != FLASHSIZE / 2;nwords++){
+			OUT4500(ai,AUXDATA,ai->flash[nwords] & 0xffff);
+		}
+	}
+	OUT4500(ai,SWS0,0x8000);
+
+	return 0;
+}
+
+/*
+ *
+ */
+int flashrestart(struct airo_info *ai,struct net_device *dev){
+	int    i,status;
+
+	ssleep(1);			/* Added 12/7/00 */
+	clear_bit (FLAG_FLASHING, &ai->flags);
+	if (test_bit(FLAG_MPI, &ai->flags)) {
+		status = mpi_init_descriptors(ai);
+		if (status != SUCCESS)
+			return status;
+	}
+	status = setup_card(ai, dev->dev_addr, 1);
+
+	if (!test_bit(FLAG_MPI,&ai->flags))
+		for( i = 0; i < MAX_FIDS; i++ ) {
+			ai->fids[i] = transmit_allocate
+				( ai, 2312, i >= MAX_FIDS / 2 );
+		}
+
+	ssleep(1);			/* Added 12/7/00 */
+	return status;
+}
+#endif /* CISCO_EXT */
+
+/*
+    This program is free software; you can redistribute it and/or
+    modify it under the terms of the GNU General Public License
+    as published by the Free Software Foundation; either version 2
+    of the License, or (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    In addition:
+
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions
+    are met:
+
+    1. Redistributions of source code must retain the above copyright
+       notice, this list of conditions and the following disclaimer.
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+    3. The name of the author may not be used to endorse or promote
+       products derived from this software without specific prior written
+       permission.
+
+    THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+    IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+    WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+    ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
+    INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+    (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+    SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+    HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+    STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+    IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+*/
+
+module_init(airo_init_module);
+module_exit(airo_cleanup_module);
diff --git a/drivers/net/wireless/airo_cs.c b/drivers/net/wireless/airo_cs.c
new file mode 100644
index 0000000..fbf53af
--- /dev/null
+++ b/drivers/net/wireless/airo_cs.c
@@ -0,0 +1,622 @@
+/*======================================================================
+
+    Aironet driver for 4500 and 4800 series cards
+
+    This code is released under both the GPL version 2 and BSD licenses.
+    Either license may be used.  The respective licenses are found at
+    the end of this file.
+
+    This code was developed by Benjamin Reed <breed@users.sourceforge.net>
+    including portions of which come from the Aironet PC4500
+    Developer's Reference Manual and used with permission.  Copyright
+    (C) 1999 Benjamin Reed.  All Rights Reserved.  Permission to use
+    code in the Developer's manual was granted for this driver by
+    Aironet.
+
+    In addition this module was derived from dummy_cs.
+    The initial developer of dummy_cs is David A. Hinds
+    <dahinds@users.sourceforge.net>.  Portions created by David A. Hinds
+    are Copyright (C) 1999 David A. Hinds.  All Rights Reserved.    
+    
+======================================================================*/
+
+#include <linux/config.h>
+#ifdef __IN_PCMCIA_PACKAGE__
+#include <pcmcia/k_compat.h>
+#endif
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/ptrace.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/timer.h>
+#include <linux/netdevice.h>
+
+#include <pcmcia/version.h>
+#include <pcmcia/cs_types.h>
+#include <pcmcia/cs.h>
+#include <pcmcia/cistpl.h>
+#include <pcmcia/cisreg.h>
+#include <pcmcia/ds.h>
+
+#include <asm/io.h>
+#include <asm/system.h>
+
+/*
+   All the PCMCIA modules use PCMCIA_DEBUG to control debugging.  If
+   you do not define PCMCIA_DEBUG at all, all the debug code will be
+   left out.  If you compile with PCMCIA_DEBUG=0, the debug code will
+   be present but disabled -- but it can then be enabled for specific
+   modules at load time with a 'pc_debug=#' option to insmod.
+*/
+#ifdef PCMCIA_DEBUG
+static int pc_debug = PCMCIA_DEBUG;
+module_param(pc_debug, int, 0);
+static char *version = "$Revision: 1.2 $";
+#define DEBUG(n, args...) if (pc_debug>(n)) printk(KERN_DEBUG args);
+#else
+#define DEBUG(n, args...)
+#endif
+
+/*====================================================================*/
+
+MODULE_AUTHOR("Benjamin Reed");
+MODULE_DESCRIPTION("Support for Cisco/Aironet 802.11 wireless ethernet \
+                   cards.  This is the module that links the PCMCIA card \
+		   with the airo module.");
+MODULE_LICENSE("Dual BSD/GPL");
+MODULE_SUPPORTED_DEVICE("Aironet 4500, 4800 and Cisco 340 PCMCIA cards");
+
+/*====================================================================*/
+
+/*
+   The event() function is this driver's Card Services event handler.
+   It will be called by Card Services when an appropriate card status
+   event is received.  The config() and release() entry points are
+   used to configure or release a socket, in response to card
+   insertion and ejection events.  They are invoked from the airo_cs
+   event handler. 
+*/
+
+struct net_device *init_airo_card( int, int, int, struct device * );
+void stop_airo_card( struct net_device *, int );
+int reset_airo_card( struct net_device * );
+
+static void airo_config(dev_link_t *link);
+static void airo_release(dev_link_t *link);
+static int airo_event(event_t event, int priority,
+		       event_callback_args_t *args);
+
+/*
+   The attach() and detach() entry points are used to create and destroy
+   "instances" of the driver, where each instance represents everything
+   needed to manage one actual PCMCIA card.
+*/
+
+static dev_link_t *airo_attach(void);
+static void airo_detach(dev_link_t *);
+
+/*
+   You'll also need to prototype all the functions that will actually
+   be used to talk to your device.  See 'pcmem_cs' for a good example
+   of a fully self-sufficient driver; the other drivers rely more or
+   less on other parts of the kernel.
+*/
+
+/*
+   The dev_info variable is the "key" that is used to match up this
+   device driver with appropriate cards, through the card configuration
+   database.
+*/
+
+static dev_info_t dev_info = "airo_cs";
+
+/*
+   A linked list of "instances" of the  aironet device.  Each actual
+   PCMCIA card corresponds to one device instance, and is described
+   by one dev_link_t structure (defined in ds.h).
+
+   You may not want to use a linked list for this -- for example, the
+   memory card driver uses an array of dev_link_t pointers, where minor
+   device numbers are used to derive the corresponding array index.
+*/
+
+static dev_link_t *dev_list = NULL;
+
+/*
+   A dev_link_t structure has fields for most things that are needed
+   to keep track of a socket, but there will usually be some device
+   specific information that also needs to be kept track of.  The
+   'priv' pointer in a dev_link_t structure can be used to point to
+   a device-specific private data structure, like this.
+
+   A driver needs to provide a dev_node_t structure for each device
+   on a card.  In some cases, there is only one device per card (for
+   example, ethernet cards, modems).  In other cases, there may be
+   many actual or logical devices (SCSI adapters, memory cards with
+   multiple partitions).  The dev_node_t structures need to be kept
+   in a linked list starting at the 'dev' field of a dev_link_t
+   structure.  We allocate them in the card's private data structure,
+   because they generally shouldn't be allocated dynamically.
+
+   In this case, we also provide a flag to indicate if a device is
+   "stopped" due to a power management event, or card ejection.  The
+   device IO routines can use a flag like this to throttle IO to a
+   card that is not ready to accept it.
+*/
+   
+typedef struct local_info_t {
+	dev_node_t	node;
+	struct net_device *eth_dev;
+} local_info_t;
+
+/*======================================================================
+  
+  airo_attach() creates an "instance" of the driver, allocating
+  local data structures for one device.  The device is registered
+  with Card Services.
+  
+  The dev_link structure is initialized, but we don't actually
+  configure the card at this point -- we wait until we receive a
+  card insertion event.
+  
+  ======================================================================*/
+
+static dev_link_t *airo_attach(void)
+{
+	client_reg_t client_reg;
+	dev_link_t *link;
+	local_info_t *local;
+	int ret;
+	
+	DEBUG(0, "airo_attach()\n");
+
+	/* Initialize the dev_link_t structure */
+	link = kmalloc(sizeof(struct dev_link_t), GFP_KERNEL);
+	if (!link) {
+		printk(KERN_ERR "airo_cs: no memory for new device\n");
+		return NULL;
+	}
+	memset(link, 0, sizeof(struct dev_link_t));
+	
+	/* Interrupt setup */
+	link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
+	link->irq.IRQInfo1 = IRQ_LEVEL_ID;
+	link->irq.Handler = NULL;
+	
+	/*
+	  General socket configuration defaults can go here.  In this
+	  client, we assume very little, and rely on the CIS for almost
+	  everything.  In most clients, many details (i.e., number, sizes,
+	  and attributes of IO windows) are fixed by the nature of the
+	  device, and can be hard-wired here.
+	*/
+	link->conf.Attributes = 0;
+	link->conf.Vcc = 50;
+	link->conf.IntType = INT_MEMORY_AND_IO;
+	
+	/* Allocate space for private device-specific data */
+	local = kmalloc(sizeof(local_info_t), GFP_KERNEL);
+	if (!local) {
+		printk(KERN_ERR "airo_cs: no memory for new device\n");
+		kfree (link);
+		return NULL;
+	}
+	memset(local, 0, sizeof(local_info_t));
+	link->priv = local;
+	
+	/* Register with Card Services */
+	link->next = dev_list;
+	dev_list = link;
+	client_reg.dev_info = &dev_info;
+	client_reg.EventMask =
+		CS_EVENT_CARD_INSERTION | CS_EVENT_CARD_REMOVAL |
+		CS_EVENT_RESET_PHYSICAL | CS_EVENT_CARD_RESET |
+		CS_EVENT_PM_SUSPEND | CS_EVENT_PM_RESUME;
+	client_reg.event_handler = &airo_event;
+	client_reg.Version = 0x0210;
+	client_reg.event_callback_args.client_data = link;
+	ret = pcmcia_register_client(&link->handle, &client_reg);
+	if (ret != 0) {
+		cs_error(link->handle, RegisterClient, ret);
+		airo_detach(link);
+		return NULL;
+	}
+	
+	return link;
+} /* airo_attach */
+
+/*======================================================================
+  
+  This deletes a driver "instance".  The device is de-registered
+  with Card Services.  If it has been released, all local data
+  structures are freed.  Otherwise, the structures will be freed
+  when the device is released.
+  
+  ======================================================================*/
+
+static void airo_detach(dev_link_t *link)
+{
+	dev_link_t **linkp;
+	
+	DEBUG(0, "airo_detach(0x%p)\n", link);
+	
+	/* Locate device structure */
+	for (linkp = &dev_list; *linkp; linkp = &(*linkp)->next)
+		if (*linkp == link) break;
+	if (*linkp == NULL)
+		return;
+	
+	if (link->state & DEV_CONFIG)
+		airo_release(link);
+	
+	if ( ((local_info_t*)link->priv)->eth_dev ) {
+		stop_airo_card( ((local_info_t*)link->priv)->eth_dev, 0 );
+	}
+	((local_info_t*)link->priv)->eth_dev = NULL;   
+	
+	/* Break the link with Card Services */
+	if (link->handle)
+		pcmcia_deregister_client(link->handle);
+	
+	
+	
+	/* Unlink device structure, free pieces */
+	*linkp = link->next;
+	if (link->priv) {
+		kfree(link->priv);
+	}
+	kfree(link);
+	
+} /* airo_detach */
+
+/*======================================================================
+  
+  airo_config() is scheduled to run after a CARD_INSERTION event
+  is received, to configure the PCMCIA socket, and to make the
+  device available to the system.
+  
+  ======================================================================*/
+
+#define CS_CHECK(fn, ret) \
+do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
+
+static void airo_config(dev_link_t *link)
+{
+	client_handle_t handle;
+	tuple_t tuple;
+	cisparse_t parse;
+	local_info_t *dev;
+	int last_fn, last_ret;
+	u_char buf[64];
+	win_req_t req;
+	memreq_t map;
+	
+	handle = link->handle;
+	dev = link->priv;
+
+	DEBUG(0, "airo_config(0x%p)\n", link);
+	
+	/*
+	  This reads the card's CONFIG tuple to find its configuration
+	  registers.
+	*/
+	tuple.DesiredTuple = CISTPL_CONFIG;
+	tuple.Attributes = 0;
+	tuple.TupleData = buf;
+	tuple.TupleDataMax = sizeof(buf);
+	tuple.TupleOffset = 0;
+	CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+	CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
+	CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+	link->conf.ConfigBase = parse.config.base;
+	link->conf.Present = parse.config.rmask[0];
+	
+	/* Configure card */
+	link->state |= DEV_CONFIG;
+	
+	/*
+	  In this loop, we scan the CIS for configuration table entries,
+	  each of which describes a valid card configuration, including
+	  voltage, IO window, memory window, and interrupt settings.
+	  
+	  We make no assumptions about the card to be configured: we use
+	  just the information available in the CIS.  In an ideal world,
+	  this would work for any PCMCIA card, but it requires a complete
+	  and accurate CIS.  In practice, a driver usually "knows" most of
+	  these things without consulting the CIS, and most client drivers
+	  will only use the CIS to fill in implementation-defined details.
+	*/
+	tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
+	CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+	while (1) {
+		cistpl_cftable_entry_t dflt = { 0 };
+		cistpl_cftable_entry_t *cfg = &(parse.cftable_entry);
+		if (pcmcia_get_tuple_data(handle, &tuple) != 0 ||
+				pcmcia_parse_tuple(handle, &tuple, &parse) != 0)
+			goto next_entry;
+		
+		if (cfg->flags & CISTPL_CFTABLE_DEFAULT) dflt = *cfg;
+		if (cfg->index == 0) goto next_entry;
+		link->conf.ConfigIndex = cfg->index;
+		
+		/* Does this card need audio output? */
+		if (cfg->flags & CISTPL_CFTABLE_AUDIO) {
+			link->conf.Attributes |= CONF_ENABLE_SPKR;
+			link->conf.Status = CCSR_AUDIO_ENA;
+		}
+		
+		/* Use power settings for Vcc and Vpp if present */
+		/*  Note that the CIS values need to be rescaled */
+		if (cfg->vcc.present & (1<<CISTPL_POWER_VNOM))
+			link->conf.Vcc = cfg->vcc.param[CISTPL_POWER_VNOM]/10000;
+		else if (dflt.vcc.present & (1<<CISTPL_POWER_VNOM))
+			link->conf.Vcc = dflt.vcc.param[CISTPL_POWER_VNOM]/10000;
+		
+		if (cfg->vpp1.present & (1<<CISTPL_POWER_VNOM))
+			link->conf.Vpp1 = link->conf.Vpp2 =
+				cfg->vpp1.param[CISTPL_POWER_VNOM]/10000;
+		else if (dflt.vpp1.present & (1<<CISTPL_POWER_VNOM))
+			link->conf.Vpp1 = link->conf.Vpp2 =
+				dflt.vpp1.param[CISTPL_POWER_VNOM]/10000;
+		
+		/* Do we need to allocate an interrupt? */
+		if (cfg->irq.IRQInfo1 || dflt.irq.IRQInfo1)
+			link->conf.Attributes |= CONF_ENABLE_IRQ;
+		
+		/* IO window settings */
+		link->io.NumPorts1 = link->io.NumPorts2 = 0;
+		if ((cfg->io.nwin > 0) || (dflt.io.nwin > 0)) {
+			cistpl_io_t *io = (cfg->io.nwin) ? &cfg->io : &dflt.io;
+			link->io.Attributes1 = IO_DATA_PATH_WIDTH_AUTO;
+			if (!(io->flags & CISTPL_IO_8BIT))
+				link->io.Attributes1 = IO_DATA_PATH_WIDTH_16;
+			if (!(io->flags & CISTPL_IO_16BIT))
+				link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
+			link->io.BasePort1 = io->win[0].base;
+			link->io.NumPorts1 = io->win[0].len;
+			if (io->nwin > 1) {
+				link->io.Attributes2 = link->io.Attributes1;
+				link->io.BasePort2 = io->win[1].base;
+				link->io.NumPorts2 = io->win[1].len;
+			}
+		}
+		
+		/* This reserves IO space but doesn't actually enable it */
+		if (pcmcia_request_io(link->handle, &link->io) != 0)
+			goto next_entry;
+		
+		/*
+		  Now set up a common memory window, if needed.  There is room
+		  in the dev_link_t structure for one memory window handle,
+		  but if the base addresses need to be saved, or if multiple
+		  windows are needed, the info should go in the private data
+		  structure for this device.
+		  
+		  Note that the memory window base is a physical address, and
+		  needs to be mapped to virtual space with ioremap() before it
+		  is used.
+		*/
+		if ((cfg->mem.nwin > 0) || (dflt.mem.nwin > 0)) {
+			cistpl_mem_t *mem =
+				(cfg->mem.nwin) ? &cfg->mem : &dflt.mem;
+			req.Attributes = WIN_DATA_WIDTH_16|WIN_MEMORY_TYPE_CM;
+			req.Base = mem->win[0].host_addr;
+			req.Size = mem->win[0].len;
+			req.AccessSpeed = 0;
+			if (pcmcia_request_window(&link->handle, &req, &link->win) != 0)
+				goto next_entry;
+			map.Page = 0; map.CardOffset = mem->win[0].card_addr;
+			if (pcmcia_map_mem_page(link->win, &map) != 0)
+				goto next_entry;
+		}
+		/* If we got this far, we're cool! */
+		break;
+		
+	next_entry:
+		CS_CHECK(GetNextTuple, pcmcia_get_next_tuple(handle, &tuple));
+	}
+	
+    /*
+      Allocate an interrupt line.  Note that this does not assign a
+      handler to the interrupt, unless the 'Handler' member of the
+      irq structure is initialized.
+    */
+	if (link->conf.Attributes & CONF_ENABLE_IRQ)
+		CS_CHECK(RequestIRQ, pcmcia_request_irq(link->handle, &link->irq));
+	
+	/*
+	  This actually configures the PCMCIA socket -- setting up
+	  the I/O windows and the interrupt mapping, and putting the
+	  card and host interface into "Memory and IO" mode.
+	*/
+	CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link->handle, &link->conf));
+	((local_info_t*)link->priv)->eth_dev = 
+		init_airo_card( link->irq.AssignedIRQ,
+				link->io.BasePort1, 1, &handle_to_dev(handle) );
+	if (!((local_info_t*)link->priv)->eth_dev) goto cs_failed;
+	
+	/*
+	  At this point, the dev_node_t structure(s) need to be
+	  initialized and arranged in a linked list at link->dev.
+	*/
+	strcpy(dev->node.dev_name, ((local_info_t*)link->priv)->eth_dev->name );
+	dev->node.major = dev->node.minor = 0;
+	link->dev = &dev->node;
+	
+	/* Finally, report what we've done */
+	printk(KERN_INFO "%s: index 0x%02x: Vcc %d.%d",
+	       dev->node.dev_name, link->conf.ConfigIndex,
+	       link->conf.Vcc/10, link->conf.Vcc%10);
+	if (link->conf.Vpp1)
+		printk(", Vpp %d.%d", link->conf.Vpp1/10, link->conf.Vpp1%10);
+	if (link->conf.Attributes & CONF_ENABLE_IRQ)
+		printk(", irq %d", link->irq.AssignedIRQ);
+	if (link->io.NumPorts1)
+		printk(", io 0x%04x-0x%04x", link->io.BasePort1,
+		       link->io.BasePort1+link->io.NumPorts1-1);
+	if (link->io.NumPorts2)
+		printk(" & 0x%04x-0x%04x", link->io.BasePort2,
+		       link->io.BasePort2+link->io.NumPorts2-1);
+	if (link->win)
+		printk(", mem 0x%06lx-0x%06lx", req.Base,
+		       req.Base+req.Size-1);
+	printk("\n");
+	
+	link->state &= ~DEV_CONFIG_PENDING;
+	return;
+	
+ cs_failed:
+	cs_error(link->handle, last_fn, last_ret);
+	airo_release(link);
+	
+} /* airo_config */
+
+/*======================================================================
+  
+  After a card is removed, airo_release() will unregister the
+  device, and release the PCMCIA configuration.  If the device is
+  still open, this will be postponed until it is closed.
+  
+  ======================================================================*/
+
+static void airo_release(dev_link_t *link)
+{
+	DEBUG(0, "airo_release(0x%p)\n", link);
+	
+	/* Unlink the device chain */
+	link->dev = NULL;
+	
+	/*
+	  In a normal driver, additional code may be needed to release
+	  other kernel data structures associated with this device. 
+	*/
+	
+	/* Don't bother checking to see if these succeed or not */
+	if (link->win)
+		pcmcia_release_window(link->win);
+	pcmcia_release_configuration(link->handle);
+	if (link->io.NumPorts1)
+		pcmcia_release_io(link->handle, &link->io);
+	if (link->irq.AssignedIRQ)
+		pcmcia_release_irq(link->handle, &link->irq);
+	link->state &= ~DEV_CONFIG;
+}
+
+/*======================================================================
+  
+  The card status event handler.  Mostly, this schedules other
+  stuff to run after an event is received.
+
+  When a CARD_REMOVAL event is received, we immediately set a
+  private flag to block future accesses to this device.  All the
+  functions that actually access the device should check this flag
+  to make sure the card is still present.
+  
+  ======================================================================*/
+
+static int airo_event(event_t event, int priority,
+		      event_callback_args_t *args)
+{
+	dev_link_t *link = args->client_data;
+	local_info_t *local = link->priv;
+	
+	DEBUG(1, "airo_event(0x%06x)\n", event);
+	
+	switch (event) {
+	case CS_EVENT_CARD_REMOVAL:
+		link->state &= ~DEV_PRESENT;
+		if (link->state & DEV_CONFIG) {
+			netif_device_detach(local->eth_dev);
+			airo_release(link);
+		}
+		break;
+	case CS_EVENT_CARD_INSERTION:
+		link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
+		airo_config(link);
+		break;
+	case CS_EVENT_PM_SUSPEND:
+		link->state |= DEV_SUSPEND;
+		/* Fall through... */
+	case CS_EVENT_RESET_PHYSICAL:
+		if (link->state & DEV_CONFIG) {
+			netif_device_detach(local->eth_dev);
+			pcmcia_release_configuration(link->handle);
+		}
+		break;
+	case CS_EVENT_PM_RESUME:
+		link->state &= ~DEV_SUSPEND;
+		/* Fall through... */
+	case CS_EVENT_CARD_RESET:
+		if (link->state & DEV_CONFIG) {
+			pcmcia_request_configuration(link->handle, &link->conf);
+			reset_airo_card(local->eth_dev);
+			netif_device_attach(local->eth_dev);
+		}
+		break;
+	}
+	return 0;
+} /* airo_event */
+
+static struct pcmcia_driver airo_driver = {
+	.owner		= THIS_MODULE,
+	.drv		= {
+		.name	= "airo_cs",
+	},
+	.attach		= airo_attach,
+	.detach		= airo_detach,
+};
+
+static int airo_cs_init(void)
+{
+	return pcmcia_register_driver(&airo_driver);
+}
+
+static void airo_cs_cleanup(void)
+{
+	pcmcia_unregister_driver(&airo_driver);
+	BUG_ON(dev_list != NULL);
+}
+
+/*
+    This program is free software; you can redistribute it and/or
+    modify it under the terms of the GNU General Public License
+    as published by the Free Software Foundation; either version 2
+    of the License, or (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    In addition:
+
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions
+    are met:
+
+    1. Redistributions of source code must retain the above copyright
+       notice, this list of conditions and the following disclaimer.
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+    3. The name of the author may not be used to endorse or promote
+       products derived from this software without specific prior written
+       permission.
+
+    THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+    IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+    WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+    ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
+    INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+    (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+    SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+    HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+    STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+    IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.    
+*/
+
+module_init(airo_cs_init);
+module_exit(airo_cs_cleanup);
diff --git a/drivers/net/wireless/airport.c b/drivers/net/wireless/airport.c
new file mode 100644
index 0000000..a1dc2a1
--- /dev/null
+++ b/drivers/net/wireless/airport.c
@@ -0,0 +1,304 @@
+/* airport.c
+ *
+ * A driver for "Hermes" chipset based Apple Airport wireless
+ * card.
+ *
+ * Copyright notice & release notes in file orinoco.c
+ * 
+ * Note specific to airport stub:
+ * 
+ *  0.05 : first version of the new split driver
+ *  0.06 : fix possible hang on powerup, add sleep support
+ */
+
+#define DRIVER_NAME "airport"
+#define PFX DRIVER_NAME ": "
+
+#include <linux/config.h>
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/ptrace.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/timer.h>
+#include <linux/ioport.h>
+#include <linux/netdevice.h>
+#include <linux/if_arp.h>
+#include <linux/etherdevice.h>
+#include <linux/wireless.h>
+
+#include <asm/io.h>
+#include <asm/system.h>
+#include <asm/current.h>
+#include <asm/prom.h>
+#include <asm/machdep.h>
+#include <asm/pmac_feature.h>
+#include <asm/irq.h>
+#include <asm/uaccess.h>
+
+#include "orinoco.h"
+
+#define AIRPORT_IO_LEN	(0x1000)	/* one page */
+
+struct airport {
+	struct macio_dev *mdev;
+	void __iomem *vaddr;
+	int irq_requested;
+	int ndev_registered;
+};
+
+static int
+airport_suspend(struct macio_dev *mdev, u32 state)
+{
+	struct net_device *dev = dev_get_drvdata(&mdev->ofdev.dev);
+	struct orinoco_private *priv = netdev_priv(dev);
+	unsigned long flags;
+	int err;
+
+	printk(KERN_DEBUG "%s: Airport entering sleep mode\n", dev->name);
+
+	err = orinoco_lock(priv, &flags);
+	if (err) {
+		printk(KERN_ERR "%s: hw_unavailable on PBOOK_SLEEP_NOW\n",
+		       dev->name);
+		return 0;
+	}
+
+	err = __orinoco_down(dev);
+	if (err)
+		printk(KERN_WARNING "%s: PBOOK_SLEEP_NOW: Error %d downing interface\n",
+		       dev->name, err);
+
+	netif_device_detach(dev);
+
+	priv->hw_unavailable++;
+
+	orinoco_unlock(priv, &flags);
+
+	disable_irq(dev->irq);
+	pmac_call_feature(PMAC_FTR_AIRPORT_ENABLE, macio_get_of_node(mdev), 0, 0);
+
+	return 0;
+}
+
+static int
+airport_resume(struct macio_dev *mdev)
+{
+	struct net_device *dev = dev_get_drvdata(&mdev->ofdev.dev);
+	struct orinoco_private *priv = netdev_priv(dev);
+	unsigned long flags;
+	int err;
+
+	printk(KERN_DEBUG "%s: Airport waking up\n", dev->name);
+
+	pmac_call_feature(PMAC_FTR_AIRPORT_ENABLE, macio_get_of_node(mdev), 0, 1);
+	msleep(200);
+
+	enable_irq(dev->irq);
+
+	err = orinoco_reinit_firmware(dev);
+	if (err) {
+		printk(KERN_ERR "%s: Error %d re-initializing firmware on PBOOK_WAKE\n",
+		       dev->name, err);
+		return 0;
+	}
+
+	spin_lock_irqsave(&priv->lock, flags);
+
+	netif_device_attach(dev);
+
+	priv->hw_unavailable--;
+
+	if (priv->open && (! priv->hw_unavailable)) {
+		err = __orinoco_up(dev);
+		if (err)
+			printk(KERN_ERR "%s: Error %d restarting card on PBOOK_WAKE\n",
+			       dev->name, err);
+	}
+
+
+	spin_unlock_irqrestore(&priv->lock, flags);
+
+	return 0;
+}
+
+static int
+airport_detach(struct macio_dev *mdev)
+{
+	struct net_device *dev = dev_get_drvdata(&mdev->ofdev.dev);
+	struct orinoco_private *priv = netdev_priv(dev);
+	struct airport *card = priv->card;
+
+	if (card->ndev_registered)
+		unregister_netdev(dev);
+	card->ndev_registered = 0;
+
+	if (card->irq_requested)
+		free_irq(dev->irq, dev);
+	card->irq_requested = 0;
+
+	if (card->vaddr)
+		iounmap(card->vaddr);
+	card->vaddr = NULL;
+
+	macio_release_resource(mdev, 0);
+
+	pmac_call_feature(PMAC_FTR_AIRPORT_ENABLE, macio_get_of_node(mdev), 0, 0);
+	ssleep(1);
+
+	macio_set_drvdata(mdev, NULL);
+	free_orinocodev(dev);
+
+	return 0;
+}
+
+static int airport_hard_reset(struct orinoco_private *priv)
+{
+	/* It would be nice to power cycle the Airport for a real hard
+	 * reset, but for some reason although it appears to
+	 * re-initialize properly, it falls in a screaming heap
+	 * shortly afterwards. */
+#if 0
+	struct net_device *dev = priv->ndev;
+	struct airport *card = priv->card;
+
+	/* Vitally important.  If we don't do this it seems we get an
+	 * interrupt somewhere during the power cycle, since
+	 * hw_unavailable is already set it doesn't get ACKed, we get
+	 * into an interrupt loop and the the PMU decides to turn us
+	 * off. */
+	disable_irq(dev->irq);
+
+	pmac_call_feature(PMAC_FTR_AIRPORT_ENABLE, macio_get_of_node(card->mdev), 0, 0);
+	ssleep(1);
+	pmac_call_feature(PMAC_FTR_AIRPORT_ENABLE, macio_get_of_node(card->mdev), 0, 1);
+	ssleep(1);
+
+	enable_irq(dev->irq);
+	ssleep(1);
+#endif
+
+	return 0;
+}
+
+static int
+airport_attach(struct macio_dev *mdev, const struct of_match *match)
+{
+	struct orinoco_private *priv;
+	struct net_device *dev;
+	struct airport *card;
+	unsigned long phys_addr;
+	hermes_t *hw;
+
+	if (macio_resource_count(mdev) < 1 || macio_irq_count(mdev) < 1) {
+		printk(KERN_ERR PFX "Wrong interrupt/addresses in OF tree\n");
+		return -ENODEV;
+	}
+
+	/* Allocate space for private device-specific data */
+	dev = alloc_orinocodev(sizeof(*card), airport_hard_reset);
+	if (! dev) {
+		printk(KERN_ERR PFX "Cannot allocate network device\n");
+		return -ENODEV;
+	}
+	priv = netdev_priv(dev);
+	card = priv->card;
+
+	hw = &priv->hw;
+	card->mdev = mdev;
+
+	if (macio_request_resource(mdev, 0, "airport")) {
+		printk(KERN_ERR PFX "can't request IO resource !\n");
+		free_orinocodev(dev);
+		return -EBUSY;
+	}
+
+	SET_MODULE_OWNER(dev);
+	SET_NETDEV_DEV(dev, &mdev->ofdev.dev);
+
+	macio_set_drvdata(mdev, dev);
+
+	/* Setup interrupts & base address */
+	dev->irq = macio_irq(mdev, 0);
+	phys_addr = macio_resource_start(mdev, 0);  /* Physical address */
+	printk(KERN_DEBUG PFX "Physical address %lx\n", phys_addr);
+	dev->base_addr = phys_addr;
+	card->vaddr = ioremap(phys_addr, AIRPORT_IO_LEN);
+	if (!card->vaddr) {
+		printk(KERN_ERR PFX "ioremap() failed\n");
+		goto failed;
+	}
+
+	hermes_struct_init(hw, card->vaddr, HERMES_16BIT_REGSPACING);
+		
+	/* Power up card */
+	pmac_call_feature(PMAC_FTR_AIRPORT_ENABLE, macio_get_of_node(mdev), 0, 1);
+	ssleep(1);
+
+	/* Reset it before we get the interrupt */
+	hermes_init(hw);
+
+	if (request_irq(dev->irq, orinoco_interrupt, 0, dev->name, dev)) {
+		printk(KERN_ERR PFX "Couldn't get IRQ %d\n", dev->irq);
+		goto failed;
+	}
+	card->irq_requested = 1;
+
+	/* Tell the stack we exist */
+	if (register_netdev(dev) != 0) {
+		printk(KERN_ERR PFX "register_netdev() failed\n");
+		goto failed;
+	}
+	printk(KERN_DEBUG PFX "Card registered for interface %s\n", dev->name);
+	card->ndev_registered = 1;
+	return 0;
+ failed:
+	airport_detach(mdev);
+	return -ENODEV;
+}				/* airport_attach */
+
+
+static char version[] __initdata = DRIVER_NAME " " DRIVER_VERSION
+	" (Benjamin Herrenschmidt <benh@kernel.crashing.org>)";
+MODULE_AUTHOR("Benjamin Herrenschmidt <benh@kernel.crashing.org>");
+MODULE_DESCRIPTION("Driver for the Apple Airport wireless card.");
+MODULE_LICENSE("Dual MPL/GPL");
+
+static struct of_match airport_match[] = 
+{
+	{
+	.name 		= "radio",
+	.type		= OF_ANY_MATCH,
+	.compatible	= OF_ANY_MATCH
+	},
+	{},
+};
+
+static struct macio_driver airport_driver = 
+{
+	.name 		= DRIVER_NAME,
+	.match_table	= airport_match,
+	.probe		= airport_attach,
+	.remove		= airport_detach,
+	.suspend	= airport_suspend,
+	.resume		= airport_resume,
+};
+
+static int __init
+init_airport(void)
+{
+	printk(KERN_DEBUG "%s\n", version);
+
+	return macio_register_driver(&airport_driver);
+}
+
+static void __exit
+exit_airport(void)
+{
+	return macio_unregister_driver(&airport_driver);
+}
+
+module_init(init_airport);
+module_exit(exit_airport);
diff --git a/drivers/net/wireless/arlan-main.c b/drivers/net/wireless/arlan-main.c
new file mode 100644
index 0000000..4f304c6e
--- /dev/null
+++ b/drivers/net/wireless/arlan-main.c
@@ -0,0 +1,1896 @@
+/*
+ *  Copyright (C) 1997 Cullen Jennings
+ *  Copyright (C) 1998 Elmer Joandiu, elmer@ylenurme.ee
+ *  GNU General Public License applies
+ * This module provides support for the Arlan 655 card made by Aironet
+ */
+
+#include <linux/config.h>
+#include "arlan.h"
+
+#if BITS_PER_LONG != 32
+#  error FIXME: this driver requires a 32-bit platform
+#endif
+
+static const char *arlan_version = "C.Jennigs 97 & Elmer.Joandi@ut.ee  Oct'98, http://www.ylenurme.ee/~elmer/655/";
+
+struct net_device *arlan_device[MAX_ARLANS];
+
+static int SID = SIDUNKNOWN;
+static int radioNodeId = radioNodeIdUNKNOWN;
+static char encryptionKey[12] = {'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h'};
+int arlan_debug = debugUNKNOWN;
+static int spreadingCode = spreadingCodeUNKNOWN;
+static int channelNumber = channelNumberUNKNOWN;
+static int channelSet = channelSetUNKNOWN;
+static int systemId = systemIdUNKNOWN;
+static int registrationMode = registrationModeUNKNOWN;
+static int keyStart;
+static int tx_delay_ms;
+static int retries = 5;
+static int tx_queue_len = 1;
+static int arlan_EEPROM_bad;
+
+#ifdef ARLAN_DEBUGGING
+
+static int arlan_entry_debug;
+static int arlan_exit_debug;
+static int testMemory = testMemoryUNKNOWN;
+static int irq = irqUNKNOWN;
+static int txScrambled = 1;
+static int mdebug;
+
+module_param(irq, int, 0);
+module_param(mdebug, int, 0);
+module_param(testMemory, int, 0);
+module_param(arlan_entry_debug, int, 0);
+module_param(arlan_exit_debug, int, 0);
+module_param(txScrambled, int, 0);
+MODULE_PARM_DESC(irq, "(unused)");
+MODULE_PARM_DESC(testMemory, "(unused)");
+MODULE_PARM_DESC(mdebug, "Arlan multicast debugging (0-1)");
+#endif
+
+module_param(arlan_debug, int, 0);
+module_param(spreadingCode, int, 0);
+module_param(channelNumber, int, 0);
+module_param(channelSet, int, 0);
+module_param(systemId, int, 0);
+module_param(registrationMode, int, 0);
+module_param(radioNodeId, int, 0);
+module_param(SID, int, 0);
+module_param(keyStart, int, 0);
+module_param(tx_delay_ms, int, 0);
+module_param(retries, int, 0);
+module_param(tx_queue_len, int, 0);
+module_param(arlan_EEPROM_bad, int, 0);
+MODULE_PARM_DESC(arlan_debug, "Arlan debug enable (0-1)");
+MODULE_PARM_DESC(retries, "Arlan maximum packet retransmisions");
+#ifdef ARLAN_ENTRY_EXIT_DEBUGGING
+MODULE_PARM_DESC(arlan_entry_debug, "Arlan driver function entry debugging");
+MODULE_PARM_DESC(arlan_exit_debug, "Arlan driver function exit debugging");
+MODULE_PARM_DESC(arlan_entry_and_exit_debug, "Arlan driver function entry and exit debugging");
+#else
+MODULE_PARM_DESC(arlan_entry_debug, "(ignored)");
+MODULE_PARM_DESC(arlan_exit_debug, "(ignored)");
+MODULE_PARM_DESC(arlan_entry_and_exit_debug, "(ignored)");
+#endif
+
+struct arlan_conf_stru arlan_conf[MAX_ARLANS];
+static int arlans_found;
+
+static  int 	arlan_open(struct net_device *dev);
+static  int 	arlan_tx(struct sk_buff *skb, struct net_device *dev);
+static  irqreturn_t arlan_interrupt(int irq, void *dev_id, struct pt_regs *regs);
+static  int 	arlan_close(struct net_device *dev);
+static  struct net_device_stats *
+		arlan_statistics		(struct net_device *dev);
+static  void 	arlan_set_multicast		(struct net_device *dev);
+static  int 	arlan_hw_tx			(struct net_device* dev, char *buf, int length );
+static  int	arlan_hw_config			(struct net_device * dev);
+static  void 	arlan_tx_done_interrupt		(struct net_device * dev, int status);
+static  void	arlan_rx_interrupt		(struct net_device * dev, u_char rxStatus, u_short, u_short);
+static  void	arlan_process_interrupt		(struct net_device * dev);
+static	void	arlan_tx_timeout		(struct net_device *dev);
+
+static inline long us2ticks(int us)
+{
+	return us * (1000000 / HZ);
+}
+
+
+#ifdef ARLAN_ENTRY_EXIT_DEBUGGING
+#define ARLAN_DEBUG_ENTRY(name) \
+	{\
+	struct timeval timev;\
+	do_gettimeofday(&timev);\
+		if (arlan_entry_debug || arlan_entry_and_exit_debug)\
+			printk("--->>>" name " %ld " "\n",((long int) timev.tv_sec * 1000000 + timev.tv_usec));\
+	}
+#define ARLAN_DEBUG_EXIT(name) \
+	{\
+	struct timeval timev;\
+	do_gettimeofday(&timev);\
+		if (arlan_exit_debug || arlan_entry_and_exit_debug)\
+			printk("<<<---" name " %ld " "\n",((long int) timev.tv_sec * 1000000 + timev.tv_usec) );\
+	}
+#else
+#define ARLAN_DEBUG_ENTRY(name)
+#define ARLAN_DEBUG_EXIT(name)
+#endif
+
+
+#define arlan_interrupt_ack(dev)\
+        clearClearInterrupt(dev);\
+        setClearInterrupt(dev);
+
+static inline int arlan_drop_tx(struct net_device *dev)
+{
+	struct arlan_private *priv = netdev_priv(dev);
+
+	priv->stats.tx_errors++;
+	if (priv->Conf->tx_delay_ms)
+	{
+		priv->tx_done_delayed = jiffies + priv->Conf->tx_delay_ms * HZ / 1000 + 1;
+	}
+	else
+	{
+		priv->waiting_command_mask &= ~ARLAN_COMMAND_TX;
+		TXHEAD(dev).offset = 0;
+		TXTAIL(dev).offset = 0;
+		priv->txLast = 0;
+		priv->bad = 0;
+		if (!priv->under_reset && !priv->under_config)
+			netif_wake_queue (dev);
+	}
+	return 1;
+}
+
+
+int arlan_command(struct net_device *dev, int command_p)
+{
+	struct arlan_private *priv = netdev_priv(dev);
+	volatile struct arlan_shmem __iomem *arlan = priv->card;
+	struct arlan_conf_stru *conf = priv->Conf;
+	int udelayed = 0;
+	int i = 0;
+	unsigned long flags;
+
+	ARLAN_DEBUG_ENTRY("arlan_command");
+
+	if (priv->card_polling_interval)
+		priv->card_polling_interval = 1;
+
+	if (arlan_debug & ARLAN_DEBUG_CHAIN_LOCKS)
+		printk(KERN_DEBUG "arlan_command, %lx commandByte %x waiting %lx incoming %x \n",
+		jiffies, READSHMB(arlan->commandByte),
+		       priv->waiting_command_mask, command_p);
+
+	priv->waiting_command_mask |= command_p;
+
+	if (priv->waiting_command_mask & ARLAN_COMMAND_RESET)
+		if (time_after(jiffies, priv->lastReset + 5 * HZ))
+			priv->waiting_command_mask &= ~ARLAN_COMMAND_RESET;
+
+	if (priv->waiting_command_mask & ARLAN_COMMAND_INT_ACK)
+	{
+		arlan_interrupt_ack(dev);
+		priv->waiting_command_mask &= ~ARLAN_COMMAND_INT_ACK;
+	}
+	if (priv->waiting_command_mask & ARLAN_COMMAND_INT_ENABLE)
+	{
+		setInterruptEnable(dev);
+		priv->waiting_command_mask &= ~ARLAN_COMMAND_INT_ENABLE;
+	}
+
+	/* Card access serializing lock */
+	spin_lock_irqsave(&priv->lock, flags);
+
+	/* Check cards status and waiting */
+
+	if (priv->waiting_command_mask & (ARLAN_COMMAND_LONG_WAIT_NOW | ARLAN_COMMAND_WAIT_NOW))
+	{
+		while (priv->waiting_command_mask & (ARLAN_COMMAND_LONG_WAIT_NOW | ARLAN_COMMAND_WAIT_NOW))
+		{
+			if (READSHMB(arlan->resetFlag) ||
+				READSHMB(arlan->commandByte))	/* || 
+								   (readControlRegister(dev) & ARLAN_ACCESS))
+								 */
+				udelay(40);
+			else
+				priv->waiting_command_mask &= ~(ARLAN_COMMAND_LONG_WAIT_NOW | ARLAN_COMMAND_WAIT_NOW);
+
+			udelayed++;
+
+			if (priv->waiting_command_mask & ARLAN_COMMAND_LONG_WAIT_NOW)
+			{
+				if (udelayed * 40 > 1000000)
+				{
+					printk(KERN_ERR "%s long wait too long \n", dev->name);
+					priv->waiting_command_mask |= ARLAN_COMMAND_RESET;
+					break;
+				}
+			}
+			else if (priv->waiting_command_mask & ARLAN_COMMAND_WAIT_NOW)
+			{
+				if (udelayed * 40 > 1000)
+				{
+					printk(KERN_ERR "%s short wait too long \n", dev->name);
+					goto bad_end;
+				}
+			}
+		}
+	}
+	else
+	{
+		i = 0;
+		while ((READSHMB(arlan->resetFlag) ||
+			READSHMB(arlan->commandByte)) &&
+			conf->pre_Command_Wait > (i++) * 10)
+			udelay(10);
+
+
+		if ((READSHMB(arlan->resetFlag) ||
+			READSHMB(arlan->commandByte)) &&
+			!(priv->waiting_command_mask & ARLAN_COMMAND_RESET))
+		{
+			goto card_busy_end;
+		}
+	}
+	if (priv->waiting_command_mask & ARLAN_COMMAND_RESET)
+		priv->under_reset = 1;
+	if (priv->waiting_command_mask & ARLAN_COMMAND_CONF)
+		priv->under_config = 1;
+
+	/* Issuing command */
+	arlan_lock_card_access(dev);
+	if (priv->waiting_command_mask & ARLAN_COMMAND_POWERUP)
+	{
+	//     if (readControlRegister(dev) & (ARLAN_ACCESS && ARLAN_POWER))
+		setPowerOn(dev);
+		arlan_interrupt_lancpu(dev);
+		priv->waiting_command_mask &= ~ARLAN_COMMAND_POWERUP;
+		priv->waiting_command_mask |= ARLAN_COMMAND_RESET;
+		priv->card_polling_interval = HZ / 10;
+	}
+	else if (priv->waiting_command_mask & ARLAN_COMMAND_ACTIVATE)
+	{
+		WRITESHMB(arlan->commandByte, ARLAN_COM_ACTIVATE);
+		arlan_interrupt_lancpu(dev);
+		priv->waiting_command_mask &= ~ARLAN_COMMAND_ACTIVATE;
+		priv->card_polling_interval = HZ / 10;
+	}
+	else if (priv->waiting_command_mask & ARLAN_COMMAND_RX_ABORT)
+	{
+		if (priv->rx_command_given)
+		{
+			WRITESHMB(arlan->commandByte, ARLAN_COM_RX_ABORT);
+			arlan_interrupt_lancpu(dev);
+			priv->rx_command_given = 0;
+		}
+		priv->waiting_command_mask &= ~ARLAN_COMMAND_RX_ABORT;
+		priv->card_polling_interval = 1;
+	}
+	else if (priv->waiting_command_mask & ARLAN_COMMAND_TX_ABORT)
+	{
+		if (priv->tx_command_given)
+		{
+			WRITESHMB(arlan->commandByte, ARLAN_COM_TX_ABORT);
+			arlan_interrupt_lancpu(dev);
+			priv->tx_command_given = 0;
+		}
+		priv->waiting_command_mask &= ~ARLAN_COMMAND_TX_ABORT;
+		priv->card_polling_interval = 1;
+	}
+	else if (priv->waiting_command_mask & ARLAN_COMMAND_RESET)
+	{
+		priv->under_reset=1;
+		netif_stop_queue (dev);
+
+		arlan_drop_tx(dev);
+		if (priv->tx_command_given || priv->rx_command_given)
+		{
+			printk(KERN_ERR "%s: Reset under tx or rx command \n", dev->name);
+		}
+		netif_stop_queue (dev);
+		if (arlan_debug & ARLAN_DEBUG_RESET)
+			printk(KERN_ERR "%s: Doing chip reset\n", dev->name);
+		priv->lastReset = jiffies;
+		WRITESHM(arlan->commandByte, 0, u_char);
+		/* hold card in reset state */
+		setHardwareReset(dev);
+		/* set reset flag and then release reset */
+		WRITESHM(arlan->resetFlag, 0xff, u_char);
+		clearChannelAttention(dev);
+		clearHardwareReset(dev);
+		priv->card_polling_interval = HZ / 4;
+		priv->waiting_command_mask &= ~ARLAN_COMMAND_RESET;
+		priv->waiting_command_mask |= ARLAN_COMMAND_INT_RACK;
+//		priv->waiting_command_mask |= ARLAN_COMMAND_INT_RENABLE; 
+//		priv->waiting_command_mask |= ARLAN_COMMAND_RX;
+	}
+	else if (priv->waiting_command_mask & ARLAN_COMMAND_INT_RACK)
+	{
+		clearHardwareReset(dev);
+		clearClearInterrupt(dev);
+		setClearInterrupt(dev);
+		setInterruptEnable(dev);
+		priv->waiting_command_mask &= ~ARLAN_COMMAND_INT_RACK;
+		priv->waiting_command_mask |= ARLAN_COMMAND_CONF;
+		priv->under_config = 1;
+		priv->under_reset = 0;
+	}
+	else if (priv->waiting_command_mask & ARLAN_COMMAND_INT_RENABLE)
+	{
+		setInterruptEnable(dev);
+		priv->waiting_command_mask &= ~ARLAN_COMMAND_INT_RENABLE;
+	}
+	else if (priv->waiting_command_mask & ARLAN_COMMAND_CONF)
+	{
+		if (priv->tx_command_given || priv->rx_command_given)
+		{
+			printk(KERN_ERR "%s: Reset under tx or rx command \n", dev->name);
+		}
+		arlan_drop_tx(dev);
+		setInterruptEnable(dev);
+		arlan_hw_config(dev);
+		arlan_interrupt_lancpu(dev);
+		priv->waiting_command_mask &= ~ARLAN_COMMAND_CONF;
+		priv->card_polling_interval = HZ / 10;
+//		priv->waiting_command_mask |= ARLAN_COMMAND_INT_RACK;   
+//		priv->waiting_command_mask |= ARLAN_COMMAND_INT_ENABLE; 
+		priv->waiting_command_mask |= ARLAN_COMMAND_CONF_WAIT;
+	}
+	else if (priv->waiting_command_mask & ARLAN_COMMAND_CONF_WAIT)
+	{
+		if (READSHMB(arlan->configuredStatusFlag) != 0 &&
+			READSHMB(arlan->diagnosticInfo) == 0xff)
+		{
+			priv->waiting_command_mask &= ~ARLAN_COMMAND_CONF_WAIT;
+			priv->waiting_command_mask |= ARLAN_COMMAND_RX;
+			priv->waiting_command_mask |= ARLAN_COMMAND_TBUSY_CLEAR;
+			priv->card_polling_interval = HZ / 10;
+			priv->tx_command_given = 0;
+			priv->under_config = 0;
+		}
+		else
+		{
+			priv->card_polling_interval = 1;
+			if (arlan_debug & ARLAN_DEBUG_TIMING)
+				printk(KERN_ERR "configure delayed \n");
+		}
+	}
+	else if (priv->waiting_command_mask & ARLAN_COMMAND_RX)
+	{
+		if (!registrationBad(dev))
+		{
+			setInterruptEnable(dev);
+			memset_io(arlan->commandParameter, 0, 0xf);
+			WRITESHMB(arlan->commandByte, ARLAN_COM_INT | ARLAN_COM_RX_ENABLE);
+			WRITESHMB(arlan->commandParameter[0], conf->rxParameter);
+			arlan_interrupt_lancpu(dev);
+			priv->rx_command_given = 0; // mnjah, bad
+			priv->waiting_command_mask &= ~ARLAN_COMMAND_RX;
+			priv->card_polling_interval = 1;
+		}
+		else
+			priv->card_polling_interval = 2;
+	}
+	else if (priv->waiting_command_mask & ARLAN_COMMAND_TBUSY_CLEAR)
+	{
+		if ( !registrationBad(dev) &&
+		     (netif_queue_stopped(dev) || !netif_running(dev)) )
+			{
+				priv->waiting_command_mask &= ~ARLAN_COMMAND_TBUSY_CLEAR;
+				netif_wake_queue (dev);
+			}
+	}
+	else if (priv->waiting_command_mask & ARLAN_COMMAND_TX)
+	{
+		if (!test_and_set_bit(0, (void *) &priv->tx_command_given))
+		{
+			if (time_after(jiffies, 
+				       priv->tx_last_sent + us2ticks(conf->rx_tweak1))
+			    || time_before(jiffies,
+					   priv->last_rx_int_ack_time + us2ticks(conf->rx_tweak2)))
+			{
+				setInterruptEnable(dev);
+				memset_io(arlan->commandParameter, 0, 0xf);
+				WRITESHMB(arlan->commandByte, ARLAN_COM_TX_ENABLE | ARLAN_COM_INT);
+				memcpy_toio(arlan->commandParameter, &TXLAST(dev), 14);
+//				for ( i=1 ; i < 15 ; i++) printk("%02x:",READSHMB(arlan->commandParameter[i]));
+				priv->tx_last_sent = jiffies;
+				arlan_interrupt_lancpu(dev);
+				priv->tx_command_given = 1;
+				priv->waiting_command_mask &= ~ARLAN_COMMAND_TX;
+				priv->card_polling_interval = 1;
+			}
+			else
+			{
+				priv->tx_command_given = 0;
+				priv->card_polling_interval = 1;
+			}
+		} 
+		else if (arlan_debug & ARLAN_DEBUG_CHAIN_LOCKS)
+			printk(KERN_ERR "tx command when tx chain locked \n");
+	}
+	else if (priv->waiting_command_mask & ARLAN_COMMAND_NOOPINT)
+	{
+		{
+			WRITESHMB(arlan->commandByte, ARLAN_COM_NOP | ARLAN_COM_INT);
+		}
+		arlan_interrupt_lancpu(dev);
+		priv->waiting_command_mask &= ~ARLAN_COMMAND_NOOPINT;
+		priv->card_polling_interval = HZ / 3;
+	}
+	else if (priv->waiting_command_mask & ARLAN_COMMAND_NOOP)
+	{
+		WRITESHMB(arlan->commandByte, ARLAN_COM_NOP);
+		arlan_interrupt_lancpu(dev);
+		priv->waiting_command_mask &= ~ARLAN_COMMAND_NOOP;
+		priv->card_polling_interval = HZ / 3;
+	}
+	else if (priv->waiting_command_mask & ARLAN_COMMAND_SLOW_POLL)
+	{
+		WRITESHMB(arlan->commandByte, ARLAN_COM_GOTO_SLOW_POLL);
+		arlan_interrupt_lancpu(dev);
+		priv->waiting_command_mask &= ~ARLAN_COMMAND_SLOW_POLL;
+		priv->card_polling_interval = HZ / 3;
+	} 
+	else if (priv->waiting_command_mask & ARLAN_COMMAND_POWERDOWN)
+	{
+		setPowerOff(dev);
+		if (arlan_debug & ARLAN_DEBUG_CARD_STATE)
+			printk(KERN_WARNING "%s: Arlan Going Standby\n", dev->name);
+		priv->waiting_command_mask &= ~ARLAN_COMMAND_POWERDOWN;
+		priv->card_polling_interval = 3 * HZ;
+	}
+	arlan_unlock_card_access(dev);
+	for (i = 0; READSHMB(arlan->commandByte) && i < 20; i++)
+		udelay(10);
+	if (READSHMB(arlan->commandByte))
+		if (arlan_debug & ARLAN_DEBUG_CARD_STATE)
+			printk(KERN_ERR "card busy leaving command %lx\n", priv->waiting_command_mask);
+
+	spin_unlock_irqrestore(&priv->lock, flags);
+	ARLAN_DEBUG_EXIT("arlan_command");
+	priv->last_command_buff_free_time = jiffies;
+	return 0;
+
+card_busy_end:
+	if (time_after(jiffies, priv->last_command_buff_free_time + HZ))
+		priv->waiting_command_mask |= ARLAN_COMMAND_CLEAN_AND_RESET;
+
+	if (arlan_debug & ARLAN_DEBUG_CARD_STATE)
+		printk(KERN_ERR "%s arlan_command card busy end \n", dev->name);
+	spin_unlock_irqrestore(&priv->lock, flags);
+	ARLAN_DEBUG_EXIT("arlan_command");
+	return 1;
+
+bad_end:
+	printk(KERN_ERR "%s arlan_command bad end \n", dev->name);
+
+	spin_unlock_irqrestore(&priv->lock, flags);
+	ARLAN_DEBUG_EXIT("arlan_command");
+
+	return -1;
+}
+
+static inline void arlan_command_process(struct net_device *dev)
+{
+	struct arlan_private *priv = netdev_priv(dev);
+
+	int times = 0;
+	while (priv->waiting_command_mask && times < 8)
+	{
+		if (priv->waiting_command_mask)
+		{
+			if (arlan_command(dev, 0))
+				break;
+			times++;
+		}
+		/* if long command, we won't repeat trying */ ;
+		if (priv->card_polling_interval > 1)
+			break;
+		times++;
+	}
+}
+
+
+static inline void arlan_retransmit_now(struct net_device *dev)
+{
+	struct arlan_private *priv = netdev_priv(dev);
+
+
+	ARLAN_DEBUG_ENTRY("arlan_retransmit_now");
+	if (TXLAST(dev).offset == 0)
+	{
+		if (TXHEAD(dev).offset)
+		{
+			priv->txLast = 0;
+			IFDEBUG(ARLAN_DEBUG_TX_CHAIN) printk(KERN_DEBUG "TX buff switch to head \n");
+
+		}
+		else if (TXTAIL(dev).offset)
+		{
+			IFDEBUG(ARLAN_DEBUG_TX_CHAIN) printk(KERN_DEBUG "TX buff switch to tail \n");
+			priv->txLast = 1;
+		}
+		else
+			IFDEBUG(ARLAN_DEBUG_TX_CHAIN) printk(KERN_ERR "ReTransmit buff empty");
+		netif_wake_queue (dev);
+		return;
+
+	}
+	arlan_command(dev, ARLAN_COMMAND_TX);
+
+	priv->Conf->driverRetransmissions++;
+	priv->retransmissions++;
+
+	IFDEBUG(ARLAN_DEBUG_TX_CHAIN) printk("Retransmit %d bytes \n", TXLAST(dev).length);
+
+	ARLAN_DEBUG_EXIT("arlan_retransmit_now");
+}
+
+
+
+static void arlan_registration_timer(unsigned long data)
+{
+	struct net_device *dev = (struct net_device *) data;
+	struct arlan_private *priv = netdev_priv(dev);
+	int bh_mark_needed = 0;
+	int next_tick = 1;
+	long lostTime = ((long)jiffies - (long)priv->registrationLastSeen)
+			* (1000/HZ);
+
+	if (registrationBad(dev))
+	{
+		priv->registrationLostCount++;
+		if (lostTime > 7000 && lostTime < 7200)
+		{
+			printk(KERN_NOTICE "%s registration Lost \n", dev->name);
+		}
+		if (lostTime / priv->reRegisterExp > 2000)
+			arlan_command(dev, ARLAN_COMMAND_CLEAN_AND_CONF);
+		if (lostTime / (priv->reRegisterExp) > 3500)
+			arlan_command(dev, ARLAN_COMMAND_CLEAN_AND_RESET);
+		if (priv->reRegisterExp < 400)
+			priv->reRegisterExp += 2;
+		if (lostTime > 7200)
+		{
+			next_tick = HZ;
+			arlan_command(dev, ARLAN_COMMAND_CLEAN_AND_RESET);
+		}
+	}
+	else
+	{
+		if (priv->Conf->registrationMode && lostTime > 10000 &&
+			priv->registrationLostCount)
+		{
+			printk(KERN_NOTICE "%s registration is back after %ld milliseconds\n",
+			       dev->name, lostTime);
+		}
+		priv->registrationLastSeen = jiffies;
+		priv->registrationLostCount = 0;
+		priv->reRegisterExp = 1;
+		if (!netif_running(dev) )
+			netif_wake_queue(dev);
+		if (time_after(priv->tx_last_sent,priv->tx_last_cleared) &&
+		    time_after(jiffies, priv->tx_last_sent * 5*HZ) ){
+			arlan_command(dev, ARLAN_COMMAND_CLEAN_AND_RESET);		
+			priv->tx_last_cleared = jiffies;
+		}
+	}
+
+
+	if (!registrationBad(dev) && priv->ReTransmitRequested)
+	{
+		IFDEBUG(ARLAN_DEBUG_TX_CHAIN)
+			printk(KERN_ERR "Retransmit from timer \n");
+		priv->ReTransmitRequested = 0;
+		arlan_retransmit_now(dev);
+	}
+	if (!registrationBad(dev) &&
+		time_after(jiffies, priv->tx_done_delayed) &&
+		priv->tx_done_delayed != 0)
+	{
+		TXLAST(dev).offset = 0;
+		if (priv->txLast)
+			priv->txLast = 0;
+		else if (TXTAIL(dev).offset)
+			priv->txLast = 1;
+		if (TXLAST(dev).offset)
+		{
+			arlan_retransmit_now(dev);
+			dev->trans_start = jiffies;
+		}
+		if (!(TXHEAD(dev).offset && TXTAIL(dev).offset))
+		{
+			netif_wake_queue (dev);
+		}
+		priv->tx_done_delayed = 0;
+		bh_mark_needed = 1;
+	}
+	if (bh_mark_needed)
+	{
+		netif_wake_queue (dev);
+	}
+	arlan_process_interrupt(dev);
+
+	if (next_tick < priv->card_polling_interval)
+		next_tick = priv->card_polling_interval;
+
+	priv->timer.expires = jiffies + next_tick;
+
+	add_timer(&priv->timer);
+}
+
+
+#ifdef ARLAN_DEBUGGING
+
+static void arlan_print_registers(struct net_device *dev, int line)
+{
+	struct arlan_private *priv = netdev_priv(dev);
+	volatile struct arlan_shmem *arlan = priv->card;
+
+	u_char hostcpuLock, lancpuLock, controlRegister, cntrlRegImage,
+		txStatus, rxStatus, interruptInProgress, commandByte;
+
+
+	ARLAN_DEBUG_ENTRY("arlan_print_registers");
+	READSHM(interruptInProgress, arlan->interruptInProgress, u_char);
+	READSHM(hostcpuLock, arlan->hostcpuLock, u_char);
+	READSHM(lancpuLock, arlan->lancpuLock, u_char);
+	READSHM(controlRegister, arlan->controlRegister, u_char);
+	READSHM(cntrlRegImage, arlan->cntrlRegImage, u_char);
+	READSHM(txStatus, arlan->txStatus, u_char);
+	READSHM(rxStatus, arlan->rxStatus, u_char);
+	READSHM(commandByte, arlan->commandByte, u_char);
+
+	printk(KERN_WARNING "line %04d IP %02x HL %02x LL %02x CB %02x CR %02x CRI %02x TX %02x RX %02x\n",
+		line, interruptInProgress, hostcpuLock, lancpuLock, commandByte,
+		controlRegister, cntrlRegImage, txStatus, rxStatus);
+
+	ARLAN_DEBUG_EXIT("arlan_print_registers");
+}
+#endif
+
+
+static int arlan_hw_tx(struct net_device *dev, char *buf, int length)
+{
+	int i;
+
+	struct arlan_private *priv = netdev_priv(dev);
+	volatile struct arlan_shmem __iomem *arlan = priv->card;
+	struct arlan_conf_stru *conf = priv->Conf;
+
+	int tailStarts = 0x800;
+	int headEnds = 0x0;
+
+
+	ARLAN_DEBUG_ENTRY("arlan_hw_tx");
+	if (TXHEAD(dev).offset)
+		headEnds = (((TXHEAD(dev).offset + TXHEAD(dev).length - offsetof(struct arlan_shmem, txBuffer)) / 64) + 1) * 64;
+	if (TXTAIL(dev).offset)
+		tailStarts = 0x800 - (((TXTAIL(dev).offset - offsetof(struct arlan_shmem, txBuffer)) / 64) + 2) * 64;
+
+
+	if (!TXHEAD(dev).offset && length < tailStarts)
+	{
+		IFDEBUG(ARLAN_DEBUG_TX_CHAIN)
+			printk(KERN_ERR "TXHEAD insert, tailStart %d\n", tailStarts);
+
+		TXHEAD(dev).offset =
+			offsetof(struct arlan_shmem, txBuffer);
+		TXHEAD(dev).length = length - ARLAN_FAKE_HDR_LEN;
+		for (i = 0; i < 6; i++)
+			TXHEAD(dev).dest[i] = buf[i];
+		TXHEAD(dev).clear = conf->txClear;
+		TXHEAD(dev).retries = conf->txRetries;	/* 0 is use default */
+		TXHEAD(dev).routing = conf->txRouting;
+		TXHEAD(dev).scrambled = conf->txScrambled;
+		memcpy_toio((char __iomem *)arlan + TXHEAD(dev).offset, buf + ARLAN_FAKE_HDR_LEN, TXHEAD(dev).length);
+	}
+	else if (!TXTAIL(dev).offset && length < (0x800 - headEnds))
+	{
+		IFDEBUG(ARLAN_DEBUG_TX_CHAIN)
+			printk(KERN_ERR "TXTAIL insert, headEnd %d\n", headEnds);
+
+		TXTAIL(dev).offset =
+			offsetof(struct arlan_shmem, txBuffer) + 0x800 - (length / 64 + 2) * 64;
+		TXTAIL(dev).length = length - ARLAN_FAKE_HDR_LEN;
+		for (i = 0; i < 6; i++)
+			TXTAIL(dev).dest[i] = buf[i];
+		TXTAIL(dev).clear = conf->txClear;
+		TXTAIL(dev).retries = conf->txRetries;
+		TXTAIL(dev).routing = conf->txRouting;
+		TXTAIL(dev).scrambled = conf->txScrambled;
+		memcpy_toio(((char __iomem *)arlan + TXTAIL(dev).offset), buf + ARLAN_FAKE_HDR_LEN, TXTAIL(dev).length);
+	}
+	else
+	{
+		netif_stop_queue (dev);
+		IFDEBUG(ARLAN_DEBUG_TX_CHAIN)
+			printk(KERN_ERR "TX TAIL & HEAD full, return, tailStart %d headEnd %d\n", tailStarts, headEnds);
+		return -1;
+	}
+	priv->out_bytes += length;
+	priv->out_bytes10 += length;
+	if (conf->measure_rate < 1)
+		conf->measure_rate = 1;
+	if (time_after(jiffies, priv->out_time + conf->measure_rate * HZ))
+	{
+		conf->out_speed = priv->out_bytes / conf->measure_rate;
+		priv->out_bytes = 0;
+		priv->out_time = jiffies;
+	}
+	if (time_after(jiffies, priv->out_time10 + conf->measure_rate * 10*HZ))
+	{
+		conf->out_speed10 = priv->out_bytes10 / (10 * conf->measure_rate);
+		priv->out_bytes10 = 0;
+		priv->out_time10 = jiffies;
+	}
+	if (TXHEAD(dev).offset && TXTAIL(dev).offset)
+	{
+		netif_stop_queue (dev);
+		return 0;
+	}
+	else
+		netif_start_queue (dev);
+
+
+	IFDEBUG(ARLAN_DEBUG_HEADER_DUMP)
+		printk(KERN_WARNING "%s Transmit t %2x:%2x:%2x:%2x:%2x:%2x f %2x:%2x:%2x:%2x:%2x:%2x \n", dev->name,
+		   (unsigned char) buf[0], (unsigned char) buf[1], (unsigned char) buf[2], (unsigned char) buf[3],
+		   (unsigned char) buf[4], (unsigned char) buf[5], (unsigned char) buf[6], (unsigned char) buf[7],
+		   (unsigned char) buf[8], (unsigned char) buf[9], (unsigned char) buf[10], (unsigned char) buf[11]);
+
+	IFDEBUG(ARLAN_DEBUG_TX_CHAIN) printk(KERN_ERR "TX command prepare for buffer %d\n", priv->txLast);
+
+	arlan_command(dev, ARLAN_COMMAND_TX);
+
+	priv->tx_last_sent = jiffies;
+
+	IFDEBUG(ARLAN_DEBUG_TX_CHAIN) printk("%s TX Qued %d bytes \n", dev->name, length);
+
+	ARLAN_DEBUG_EXIT("arlan_hw_tx");
+
+	return 0;
+}
+
+
+static int arlan_hw_config(struct net_device *dev)
+{
+	struct arlan_private *priv = netdev_priv(dev);
+	volatile struct arlan_shmem __iomem *arlan = priv->card;
+	struct arlan_conf_stru *conf = priv->Conf;
+
+	ARLAN_DEBUG_ENTRY("arlan_hw_config");
+
+	printk(KERN_NOTICE "%s arlan configure called \n", dev->name);
+	if (arlan_EEPROM_bad)
+		printk(KERN_NOTICE "arlan configure with eeprom bad option \n");
+
+
+	WRITESHM(arlan->spreadingCode, conf->spreadingCode, u_char);
+	WRITESHM(arlan->channelSet, conf->channelSet, u_char);
+
+	if (arlan_EEPROM_bad)
+		WRITESHM(arlan->defaultChannelSet, conf->channelSet, u_char);
+
+	WRITESHM(arlan->channelNumber, conf->channelNumber, u_char);
+
+	WRITESHM(arlan->scramblingDisable, conf->scramblingDisable, u_char);
+	WRITESHM(arlan->txAttenuation, conf->txAttenuation, u_char);
+
+	WRITESHM(arlan->systemId, conf->systemId, u_int);
+
+	WRITESHM(arlan->maxRetries, conf->maxRetries, u_char);
+	WRITESHM(arlan->receiveMode, conf->receiveMode, u_char);
+	WRITESHM(arlan->priority, conf->priority, u_char);
+	WRITESHM(arlan->rootOrRepeater, conf->rootOrRepeater, u_char);
+	WRITESHM(arlan->SID, conf->SID, u_int);
+
+	WRITESHM(arlan->registrationMode, conf->registrationMode, u_char);
+
+	WRITESHM(arlan->registrationFill, conf->registrationFill, u_char);
+	WRITESHM(arlan->localTalkAddress, conf->localTalkAddress, u_char);
+	WRITESHM(arlan->codeFormat, conf->codeFormat, u_char);
+	WRITESHM(arlan->numChannels, conf->numChannels, u_char);
+	WRITESHM(arlan->channel1, conf->channel1, u_char);
+	WRITESHM(arlan->channel2, conf->channel2, u_char);
+	WRITESHM(arlan->channel3, conf->channel3, u_char);
+	WRITESHM(arlan->channel4, conf->channel4, u_char);
+	WRITESHM(arlan->radioNodeId, conf->radioNodeId, u_short);
+	WRITESHM(arlan->SID, conf->SID, u_int);
+	WRITESHM(arlan->waitTime, conf->waitTime, u_short);
+	WRITESHM(arlan->lParameter, conf->lParameter, u_short);
+	memcpy_toio(&(arlan->_15), &(conf->_15), 3);
+	WRITESHM(arlan->_15, conf->_15, u_short);
+	WRITESHM(arlan->headerSize, conf->headerSize, u_short);
+	if (arlan_EEPROM_bad)
+		WRITESHM(arlan->hardwareType, conf->hardwareType, u_char);
+	WRITESHM(arlan->radioType, conf->radioType, u_char);
+	if (arlan_EEPROM_bad)
+		WRITESHM(arlan->radioModule, conf->radioType, u_char);
+
+	memcpy_toio(arlan->encryptionKey + keyStart, encryptionKey, 8);
+	memcpy_toio(arlan->name, conf->siteName, 16);
+
+	WRITESHMB(arlan->commandByte, ARLAN_COM_INT | ARLAN_COM_CONF);	/* do configure */
+	memset_io(arlan->commandParameter, 0, 0xf);	/* 0xf */
+	memset_io(arlan->commandParameter + 1, 0, 2);
+	if (conf->writeEEPROM)
+	{
+		  memset_io(arlan->commandParameter, conf->writeEEPROM, 1);
+//		conf->writeEEPROM=0;
+	}
+	if (conf->registrationMode && conf->registrationInterrupts)
+		memset_io(arlan->commandParameter + 3, 1, 1);
+	else
+		memset_io(arlan->commandParameter + 3, 0, 1);
+
+	priv->irq_test_done = 0;
+
+	if (conf->tx_queue_len)
+		dev->tx_queue_len = conf->tx_queue_len;
+	udelay(100);
+
+	ARLAN_DEBUG_EXIT("arlan_hw_config");
+	return 0;
+}
+
+
+static int arlan_read_card_configuration(struct net_device *dev)
+{
+	u_char tlx415;
+	struct arlan_private *priv = netdev_priv(dev);
+	volatile struct arlan_shmem __iomem *arlan = priv->card;
+	struct arlan_conf_stru *conf = priv->Conf;
+
+	ARLAN_DEBUG_ENTRY("arlan_read_card_configuration");
+
+	if (radioNodeId == radioNodeIdUNKNOWN)
+	{
+		READSHM(conf->radioNodeId, arlan->radioNodeId, u_short);
+	}
+	else
+		conf->radioNodeId = radioNodeId;
+		
+	if (SID == SIDUNKNOWN)
+	{
+		READSHM(conf->SID, arlan->SID, u_int);
+	}
+	else conf->SID = SID;
+		
+	if (spreadingCode == spreadingCodeUNKNOWN)
+	{
+		  READSHM(conf->spreadingCode, arlan->spreadingCode, u_char);
+	}
+	else
+		conf->spreadingCode = spreadingCode;
+		
+	if (channelSet == channelSetUNKNOWN)
+	{
+		READSHM(conf->channelSet, arlan->channelSet, u_char);
+	}
+	else conf->channelSet = channelSet;
+
+	if (channelNumber == channelNumberUNKNOWN)
+	{
+		READSHM(conf->channelNumber, arlan->channelNumber, u_char);
+	}
+	else conf->channelNumber = channelNumber;
+	
+	READSHM(conf->scramblingDisable, arlan->scramblingDisable, u_char);
+	READSHM(conf->txAttenuation, arlan->txAttenuation, u_char);
+	
+	if (systemId == systemIdUNKNOWN)
+	{
+		READSHM(conf->systemId, arlan->systemId, u_int);
+	} 
+	else conf->systemId = systemId;
+	
+	READSHM(conf->maxDatagramSize, arlan->maxDatagramSize, u_short);
+	READSHM(conf->maxFrameSize, arlan->maxFrameSize, u_short);
+	READSHM(conf->maxRetries, arlan->maxRetries, u_char);
+	READSHM(conf->receiveMode, arlan->receiveMode, u_char);
+	READSHM(conf->priority, arlan->priority, u_char);
+	READSHM(conf->rootOrRepeater, arlan->rootOrRepeater, u_char);
+
+	if (SID == SIDUNKNOWN)
+	{
+		  READSHM(conf->SID, arlan->SID, u_int);
+	}
+	else conf->SID = SID;
+	
+	if (registrationMode == registrationModeUNKNOWN)
+	{
+		  READSHM(conf->registrationMode, arlan->registrationMode, u_char);
+	}
+	else conf->registrationMode = registrationMode;
+	
+	READSHM(conf->registrationFill, arlan->registrationFill, u_char);
+	READSHM(conf->localTalkAddress, arlan->localTalkAddress, u_char);
+	READSHM(conf->codeFormat, arlan->codeFormat, u_char);
+	READSHM(conf->numChannels, arlan->numChannels, u_char);
+	READSHM(conf->channel1, arlan->channel1, u_char);
+	READSHM(conf->channel2, arlan->channel2, u_char);
+	READSHM(conf->channel3, arlan->channel3, u_char);
+	READSHM(conf->channel4, arlan->channel4, u_char);
+	READSHM(conf->waitTime, arlan->waitTime, u_short);
+	READSHM(conf->lParameter, arlan->lParameter, u_short);
+	READSHM(conf->_15, arlan->_15, u_short);
+	READSHM(conf->headerSize, arlan->headerSize, u_short);
+	READSHM(conf->hardwareType, arlan->hardwareType, u_char);
+	READSHM(conf->radioType, arlan->radioModule, u_char);
+	
+	if (conf->radioType == 0)
+		conf->radioType = 0xc;
+
+	WRITESHM(arlan->configStatus, 0xA5, u_char);
+	READSHM(tlx415, arlan->configStatus, u_char);
+	
+	if (tlx415 != 0xA5)
+		printk(KERN_INFO "%s tlx415 chip \n", dev->name);
+	
+	conf->txClear = 0;
+	conf->txRetries = 1;
+	conf->txRouting = 1;
+	conf->txScrambled = 0;
+	conf->rxParameter = 1;
+	conf->txTimeoutMs = 4000;
+	conf->waitCardTimeout = 100000;
+	conf->receiveMode = ARLAN_RCV_CLEAN;
+	memcpy_fromio(conf->siteName, arlan->name, 16);
+	conf->siteName[16] = '\0';
+	conf->retries = retries;
+	conf->tx_delay_ms = tx_delay_ms;
+	conf->ReTransmitPacketMaxSize = 200;
+	conf->waitReTransmitPacketMaxSize = 200;
+	conf->txAckTimeoutMs = 900;
+	conf->fastReTransCount = 3;
+
+	ARLAN_DEBUG_EXIT("arlan_read_card_configuration");
+
+	return 0;
+}
+
+
+static int lastFoundAt = 0xbe000;
+
+
+/*
+ * This is the real probe routine. Linux has a history of friendly device
+ * probes on the ISA bus. A good device probes avoids doing writes, and
+ * verifies that the correct device exists and functions.
+ */
+#define ARLAN_SHMEM_SIZE	0x2000
+static int __init arlan_check_fingerprint(unsigned long memaddr)
+{
+	static const char probeText[] = "TELESYSTEM SLW INC.    ARLAN \0";
+	volatile struct arlan_shmem __iomem *arlan = (struct arlan_shmem *) memaddr;
+	unsigned long paddr = virt_to_phys((void *) memaddr);
+	char tempBuf[49];
+
+	ARLAN_DEBUG_ENTRY("arlan_check_fingerprint");
+
+	if (!request_mem_region(paddr, ARLAN_SHMEM_SIZE, "arlan")) {
+		// printk(KERN_WARNING "arlan: memory region %lx excluded from probing \n",paddr);
+		return -ENODEV;
+	}
+
+	memcpy_fromio(tempBuf, arlan->textRegion, 29);
+	tempBuf[30] = 0;
+
+	/* check for card at this address */
+	if (0 != strncmp(tempBuf, probeText, 29)){
+ 		release_mem_region(paddr, ARLAN_SHMEM_SIZE);
+		return -ENODEV;
+	}
+
+//   printk(KERN_INFO "arlan found at 0x%x \n",memaddr);
+	ARLAN_DEBUG_EXIT("arlan_check_fingerprint");
+
+	return 0;
+}
+
+static int arlan_change_mtu(struct net_device *dev, int new_mtu)
+{
+	struct arlan_private *priv = netdev_priv(dev);
+	struct arlan_conf_stru *conf = priv->Conf;
+
+	ARLAN_DEBUG_ENTRY("arlan_change_mtu");
+	if (new_mtu > 2032)
+		return -EINVAL;
+	dev->mtu = new_mtu;
+	if (new_mtu < 256)
+		new_mtu = 256;	/* cards book suggests 1600 */
+	conf->maxDatagramSize = new_mtu;
+	conf->maxFrameSize = new_mtu + 48;
+
+	arlan_command(dev, ARLAN_COMMAND_CLEAN_AND_CONF);
+	printk(KERN_NOTICE "%s mtu changed to %d \n", dev->name, new_mtu);
+
+	ARLAN_DEBUG_EXIT("arlan_change_mtu");
+
+	return 0;
+}
+
+static int arlan_mac_addr(struct net_device *dev, void *p)
+{
+	struct sockaddr *addr = p;
+
+
+	ARLAN_DEBUG_ENTRY("arlan_mac_addr");
+	return -EINVAL;
+
+	if (!netif_running(dev))
+		return -EBUSY;
+	memcpy(dev->dev_addr, addr->sa_data, dev->addr_len);
+
+	ARLAN_DEBUG_EXIT("arlan_mac_addr");
+	return 0;
+}
+
+
+
+static int __init arlan_setup_device(struct net_device *dev, int num)
+{
+	struct arlan_private *ap = netdev_priv(dev);
+	int err;
+
+	ARLAN_DEBUG_ENTRY("arlan_setup_device");
+
+	ap->conf = (struct arlan_shmem *)(ap+1);
+
+	dev->tx_queue_len = tx_queue_len;
+	dev->open = arlan_open;
+	dev->stop = arlan_close;
+	dev->hard_start_xmit = arlan_tx;
+	dev->get_stats = arlan_statistics;
+	dev->set_multicast_list = arlan_set_multicast;
+	dev->change_mtu = arlan_change_mtu;
+	dev->set_mac_address = arlan_mac_addr;
+	dev->tx_timeout = arlan_tx_timeout;
+	dev->watchdog_timeo = 3*HZ;
+	
+	ap->irq_test_done = 0;
+	ap->Conf = &arlan_conf[num];
+
+	ap->Conf->pre_Command_Wait = 40;
+	ap->Conf->rx_tweak1 = 30;
+	ap->Conf->rx_tweak2 = 0;
+
+
+	err = register_netdev(dev);
+	if (err) {
+		release_mem_region(virt_to_phys((void *) dev->mem_start), 
+			   ARLAN_SHMEM_SIZE);
+		free_netdev(dev);
+		return err;
+	}
+	arlan_device[num] = dev;
+	ARLAN_DEBUG_EXIT("arlan_setup_device");
+	return 0;
+}
+
+static int __init arlan_probe_here(struct net_device *dev, 
+				   unsigned long memaddr)
+{
+	struct arlan_private *ap = netdev_priv(dev);
+
+	ARLAN_DEBUG_ENTRY("arlan_probe_here");
+
+	if (arlan_check_fingerprint(memaddr))
+		return -ENODEV;
+
+	printk(KERN_NOTICE "%s: Arlan found at %x, \n ", dev->name, 
+	       (int) virt_to_phys((void*)memaddr));
+
+	ap->card = (void *) memaddr;
+	dev->mem_start = memaddr;
+	dev->mem_end = memaddr + ARLAN_SHMEM_SIZE-1;
+
+	if (dev->irq < 2)
+	{
+		READSHM(dev->irq, ap->card->irqLevel, u_char);
+	} else if (dev->irq == 2)
+		dev->irq = 9;
+
+	arlan_read_card_configuration(dev);
+
+	ARLAN_DEBUG_EXIT("arlan_probe_here");
+	return 0;
+}
+
+
+static int arlan_open(struct net_device *dev)
+{
+	struct arlan_private *priv = netdev_priv(dev);
+	volatile struct arlan_shmem __iomem *arlan = priv->card;
+	int ret = 0;
+
+	ARLAN_DEBUG_ENTRY("arlan_open");
+
+	ret = request_irq(dev->irq, &arlan_interrupt, 0, dev->name, dev);
+	if (ret)
+	{
+		printk(KERN_ERR "%s: unable to get IRQ %d .\n",
+			dev->name, dev->irq);
+		return ret;
+	}
+
+
+	priv->bad = 0;
+	priv->lastReset = 0;
+	priv->reset = 0;
+	memcpy_fromio(dev->dev_addr, arlan->lanCardNodeId, 6);
+	memset(dev->broadcast, 0xff, 6);
+	dev->tx_queue_len = tx_queue_len;
+	priv->interrupt_processing_active = 0;
+	spin_lock_init(&priv->lock);
+
+	netif_start_queue (dev);
+
+	priv->registrationLostCount = 0;
+	priv->registrationLastSeen = jiffies;
+	priv->txLast = 0;
+	priv->tx_command_given = 0;
+	priv->rx_command_given = 0;
+	
+	priv->reRegisterExp = 1;
+	priv->tx_last_sent = jiffies - 1;
+	priv->tx_last_cleared = jiffies;
+	priv->Conf->writeEEPROM = 0;
+	priv->Conf->registrationInterrupts = 1;
+
+	init_timer(&priv->timer);
+	priv->timer.expires = jiffies + HZ / 10;
+	priv->timer.data = (unsigned long) dev;
+	priv->timer.function = &arlan_registration_timer;	/* timer handler */
+
+	arlan_command(dev, ARLAN_COMMAND_POWERUP | ARLAN_COMMAND_LONG_WAIT_NOW);
+	mdelay(200);
+	add_timer(&priv->timer);
+
+	ARLAN_DEBUG_EXIT("arlan_open");
+	return 0;
+}
+
+
+static void arlan_tx_timeout (struct net_device *dev)
+{
+	printk(KERN_ERR "%s: arlan transmit timed out, kernel decided\n", dev->name);
+	/* Try to restart the adaptor. */
+	arlan_command(dev, ARLAN_COMMAND_CLEAN_AND_RESET);
+	// dev->trans_start = jiffies;
+	// netif_start_queue (dev);
+}
+
+
+static int arlan_tx(struct sk_buff *skb, struct net_device *dev)
+{
+	short length;
+	unsigned char *buf;
+
+	ARLAN_DEBUG_ENTRY("arlan_tx");
+	
+	length = ETH_ZLEN < skb->len ? skb->len : ETH_ZLEN;
+	buf = skb->data;
+
+	if (length + 0x12 > 0x800) {
+		printk(KERN_ERR "TX RING overflow \n");
+		netif_stop_queue (dev);
+	}
+
+	if (arlan_hw_tx(dev, buf, length) == -1)
+		goto bad_end;
+
+	dev->trans_start = jiffies;
+
+	dev_kfree_skb(skb);
+
+	arlan_process_interrupt(dev);
+	ARLAN_DEBUG_EXIT("arlan_tx");
+	return 0;
+
+bad_end:
+	arlan_process_interrupt(dev);
+	netif_stop_queue (dev);
+	ARLAN_DEBUG_EXIT("arlan_tx");
+	return 1;
+}
+
+
+static inline int DoNotReTransmitCrap(struct net_device *dev)
+{
+	struct arlan_private *priv = netdev_priv(dev);
+
+	if (TXLAST(dev).length < priv->Conf->ReTransmitPacketMaxSize)
+		return 1;
+	return 0;
+
+}
+
+static inline int DoNotWaitReTransmitCrap(struct net_device *dev)
+{
+	struct arlan_private *priv = netdev_priv(dev);
+
+	if (TXLAST(dev).length < priv->Conf->waitReTransmitPacketMaxSize)
+		return 1;
+	return 0;
+}
+
+static inline void arlan_queue_retransmit(struct net_device *dev)
+{
+	struct arlan_private *priv = netdev_priv(dev);
+
+	ARLAN_DEBUG_ENTRY("arlan_queue_retransmit");
+
+	if (DoNotWaitReTransmitCrap(dev))
+	{
+		  arlan_drop_tx(dev);
+	} else
+		priv->ReTransmitRequested++;
+
+	ARLAN_DEBUG_EXIT("arlan_queue_retransmit");
+}
+
+static inline void RetryOrFail(struct net_device *dev)
+{
+	struct arlan_private *priv = netdev_priv(dev);
+
+	ARLAN_DEBUG_ENTRY("RetryOrFail");
+
+	if (priv->retransmissions > priv->Conf->retries ||
+	    DoNotReTransmitCrap(dev))
+	{
+		arlan_drop_tx(dev);
+	}
+	else if (priv->bad <= priv->Conf->fastReTransCount)
+	{
+		arlan_retransmit_now(dev);
+	}
+	else arlan_queue_retransmit(dev);
+
+	ARLAN_DEBUG_EXIT("RetryOrFail");
+}
+
+
+static void arlan_tx_done_interrupt(struct net_device *dev, int status)
+{
+	struct arlan_private *priv = netdev_priv(dev);
+
+	ARLAN_DEBUG_ENTRY("arlan_tx_done_interrupt");
+
+	priv->tx_last_cleared = jiffies;
+	priv->tx_command_given = 0;
+	switch (status)
+	{
+		case 1:
+		{
+			IFDEBUG(ARLAN_DEBUG_TX_CHAIN)
+				printk("arlan intr: transmit OK\n");
+			priv->stats.tx_packets++;
+			priv->bad = 0;
+			priv->reset = 0;
+			priv->retransmissions = 0;
+			if (priv->Conf->tx_delay_ms)
+			{
+				priv->tx_done_delayed = jiffies + (priv->Conf->tx_delay_ms * HZ) / 1000 + 1;
+			}
+			else
+			{
+				TXLAST(dev).offset = 0;
+				if (priv->txLast)
+					priv->txLast = 0;
+				else if (TXTAIL(dev).offset)
+					priv->txLast = 1;
+				if (TXLAST(dev).offset)
+				{
+					arlan_retransmit_now(dev);
+					dev->trans_start = jiffies;
+				}
+				if (!TXHEAD(dev).offset || !TXTAIL(dev).offset)
+				{
+					netif_wake_queue (dev);
+				}
+			}
+		}
+		break;
+		
+		case 2:
+		{
+			IFDEBUG(ARLAN_DEBUG_TX_CHAIN)
+				printk("arlan intr: transmit timed out\n");
+			priv->bad += 1;
+			//arlan_queue_retransmit(dev);
+			RetryOrFail(dev);
+		}
+		break;
+
+		case 3:
+		{
+			IFDEBUG(ARLAN_DEBUG_TX_CHAIN)
+				printk("arlan intr: transmit max retries\n");
+			priv->bad += 1;
+			priv->reset = 0;
+			//arlan_queue_retransmit(dev);
+			RetryOrFail(dev);
+		}
+		break;
+		
+		case 4:
+		{
+			IFDEBUG(ARLAN_DEBUG_TX_CHAIN)
+				printk("arlan intr: transmit aborted\n");
+			priv->bad += 1;
+			arlan_queue_retransmit(dev);
+			//RetryOrFail(dev);
+		}
+		break;
+
+		case 5:
+		{
+			IFDEBUG(ARLAN_DEBUG_TX_CHAIN)
+				printk("arlan intr: transmit not registered\n");
+			priv->bad += 1;
+			//debug=101;
+			arlan_queue_retransmit(dev);
+		}
+		break;
+
+		case 6:
+		{
+			IFDEBUG(ARLAN_DEBUG_TX_CHAIN) 
+				printk("arlan intr: transmit destination full\n");
+			priv->bad += 1;
+			priv->reset = 0;
+			//arlan_drop_tx(dev);
+			arlan_queue_retransmit(dev);
+		}
+		break;
+
+		case 7:
+		{
+			IFDEBUG(ARLAN_DEBUG_TX_CHAIN)
+				printk("arlan intr: transmit unknown ack\n");
+			priv->bad += 1;
+			priv->reset = 0;
+			arlan_queue_retransmit(dev);
+		}
+		break;
+		
+		case 8:
+		{
+			IFDEBUG(ARLAN_DEBUG_TX_CHAIN)
+				printk("arlan intr: transmit dest mail box full\n");
+			priv->bad += 1;
+			priv->reset = 0;
+			//arlan_drop_tx(dev);
+			arlan_queue_retransmit(dev);
+		}
+		break;
+
+		case 9:
+		{
+			IFDEBUG(ARLAN_DEBUG_TX_CHAIN)
+				printk("arlan intr: transmit root dest not reg.\n");
+			priv->bad += 1;
+			priv->reset = 1;
+			//arlan_drop_tx(dev);
+			arlan_queue_retransmit(dev);
+		}
+		break;
+
+		default:
+		{
+			printk(KERN_ERR "arlan intr: transmit status unknown\n");
+			priv->bad += 1;
+			priv->reset = 1;
+			arlan_drop_tx(dev);
+		}
+	}
+
+	ARLAN_DEBUG_EXIT("arlan_tx_done_interrupt");
+}
+
+
+static void arlan_rx_interrupt(struct net_device *dev, u_char rxStatus, u_short rxOffset, u_short pkt_len)
+{
+	char *skbtmp;
+	int i = 0;
+
+	struct arlan_private *priv = netdev_priv(dev);
+	volatile struct arlan_shmem __iomem *arlan = priv->card;
+	struct arlan_conf_stru *conf = priv->Conf;
+
+
+	ARLAN_DEBUG_ENTRY("arlan_rx_interrupt");
+	// by spec,   not                WRITESHMB(arlan->rxStatus,0x00);
+	// prohibited here              arlan_command(dev, ARLAN_COMMAND_RX);
+
+	if (pkt_len < 10 || pkt_len > 2048)
+	{
+		printk(KERN_WARNING "%s: got too short or long packet, len %d \n", dev->name, pkt_len);
+		return;
+	}
+	if (rxOffset + pkt_len > 0x2000)
+	{
+		printk("%s: got too long packet, len %d offset %x\n", dev->name, pkt_len, rxOffset);
+		return;
+	}
+	priv->in_bytes += pkt_len;
+	priv->in_bytes10 += pkt_len;
+	if (conf->measure_rate < 1)
+		conf->measure_rate = 1;
+	if (time_after(jiffies, priv->in_time + conf->measure_rate * HZ))
+	{
+		conf->in_speed = priv->in_bytes / conf->measure_rate;
+		priv->in_bytes = 0;
+		priv->in_time = jiffies;
+	}
+	if (time_after(jiffies, priv->in_time10 + conf->measure_rate * 10*HZ))
+	{
+		conf->in_speed10 = priv->in_bytes10 / (10 * conf->measure_rate);
+		priv->in_bytes10 = 0;
+		priv->in_time10 = jiffies;
+	}
+	DEBUGSHM(1, "arlan rcv pkt rxStatus= %d ", arlan->rxStatus, u_char);
+	switch (rxStatus)
+	{
+		case 1:
+		case 2:
+		case 3:
+		{
+			/* Malloc up new buffer. */
+			struct sk_buff *skb;
+
+			DEBUGSHM(50, "arlan recv pkt offs=%d\n", arlan->rxOffset, u_short);
+			DEBUGSHM(1, "arlan rxFrmType = %d \n", arlan->rxFrmType, u_char);
+			DEBUGSHM(1, KERN_INFO "arlan rx scrambled = %d \n", arlan->scrambled, u_char);
+
+			/* here we do multicast filtering to avoid slow 8-bit memcopy */
+#ifdef ARLAN_MULTICAST
+			if (!(dev->flags & IFF_ALLMULTI) &&
+				!(dev->flags & IFF_PROMISC) &&
+				dev->mc_list)
+			{
+				char hw_dst_addr[6];
+				struct dev_mc_list *dmi = dev->mc_list;
+				int i;
+
+				memcpy_fromio(hw_dst_addr, arlan->ultimateDestAddress, 6);
+				if (hw_dst_addr[0] == 0x01)
+				{
+					if (mdebug)
+						if (hw_dst_addr[1] == 0x00)
+							printk(KERN_ERR "%s mcast 0x0100 \n", dev->name);
+						else if (hw_dst_addr[1] == 0x40)
+							printk(KERN_ERR "%s m/bcast 0x0140 \n", dev->name);
+					while (dmi)
+					{							if (dmi->dmi_addrlen == 6)
+						{
+							if (arlan_debug & ARLAN_DEBUG_HEADER_DUMP)
+								printk(KERN_ERR "%s mcl %2x:%2x:%2x:%2x:%2x:%2x \n", dev->name,
+										 dmi->dmi_addr[0], dmi->dmi_addr[1], dmi->dmi_addr[2],
+										 dmi->dmi_addr[3], dmi->dmi_addr[4], dmi->dmi_addr[5]);
+							for (i = 0; i < 6; i++)
+								if (dmi->dmi_addr[i] != hw_dst_addr[i])
+									break;
+							if (i == 6)
+								break;
+						}
+						else
+							printk(KERN_ERR "%s: invalid multicast address length given.\n", dev->name);
+						dmi = dmi->next;
+					}
+					/* we reach here if multicast filtering is on and packet 
+					 * is multicast and not for receive */
+					goto end_of_interrupt;
+				}
+			}
+#endif				// ARLAN_MULTICAST
+			/* multicast filtering ends here */
+			pkt_len += ARLAN_FAKE_HDR_LEN;
+
+			skb = dev_alloc_skb(pkt_len + 4);
+			if (skb == NULL)
+			{
+				printk(KERN_ERR "%s: Memory squeeze, dropping packet.\n", dev->name);
+				priv->stats.rx_dropped++;
+				break;
+			}
+			skb_reserve(skb, 2);
+			skb->dev = dev;
+			skbtmp = skb_put(skb, pkt_len);
+
+			memcpy_fromio(skbtmp + ARLAN_FAKE_HDR_LEN, ((char __iomem *) arlan) + rxOffset, pkt_len - ARLAN_FAKE_HDR_LEN);
+			memcpy_fromio(skbtmp, arlan->ultimateDestAddress, 6);
+			memcpy_fromio(skbtmp + 6, arlan->rxSrc, 6);
+			WRITESHMB(arlan->rxStatus, 0x00);
+			arlan_command(dev, ARLAN_COMMAND_RX);
+
+			IFDEBUG(ARLAN_DEBUG_HEADER_DUMP)
+			{
+				char immedDestAddress[6];
+				char immedSrcAddress[6];
+				memcpy_fromio(immedDestAddress, arlan->immedDestAddress, 6);
+				memcpy_fromio(immedSrcAddress, arlan->immedSrcAddress, 6);
+
+				printk(KERN_WARNING "%s t %2x:%2x:%2x:%2x:%2x:%2x f %2x:%2x:%2x:%2x:%2x:%2x imd %2x:%2x:%2x:%2x:%2x:%2x ims %2x:%2x:%2x:%2x:%2x:%2x\n", dev->name,
+					(unsigned char) skbtmp[0], (unsigned char) skbtmp[1], (unsigned char) skbtmp[2], (unsigned char) skbtmp[3],
+					(unsigned char) skbtmp[4], (unsigned char) skbtmp[5], (unsigned char) skbtmp[6], (unsigned char) skbtmp[7],
+					(unsigned char) skbtmp[8], (unsigned char) skbtmp[9], (unsigned char) skbtmp[10], (unsigned char) skbtmp[11],
+					immedDestAddress[0], immedDestAddress[1], immedDestAddress[2],
+					immedDestAddress[3], immedDestAddress[4], immedDestAddress[5],
+					immedSrcAddress[0], immedSrcAddress[1], immedSrcAddress[2],
+					immedSrcAddress[3], immedSrcAddress[4], immedSrcAddress[5]);
+			}
+			skb->protocol = eth_type_trans(skb, dev);
+			IFDEBUG(ARLAN_DEBUG_HEADER_DUMP)
+				if (skb->protocol != 0x608 && skb->protocol != 0x8)
+				{
+					for (i = 0; i <= 22; i++)
+						printk("%02x:", (u_char) skbtmp[i + 12]);
+					printk(KERN_ERR "\n");
+					printk(KERN_WARNING "arlan kernel pkt type trans %x \n", skb->protocol);
+				}
+			netif_rx(skb);
+			dev->last_rx = jiffies;
+			priv->stats.rx_packets++;
+			priv->stats.rx_bytes += pkt_len;
+		}
+		break;
+		
+		default:
+			printk(KERN_ERR "arlan intr: received unknown status\n");
+			priv->stats.rx_crc_errors++;
+			break;
+	}
+	ARLAN_DEBUG_EXIT("arlan_rx_interrupt");
+}
+
+static void arlan_process_interrupt(struct net_device *dev)
+{
+	struct arlan_private *priv = netdev_priv(dev);
+	volatile struct arlan_shmem __iomem *arlan = priv->card;
+	u_char rxStatus = READSHMB(arlan->rxStatus);
+	u_char txStatus = READSHMB(arlan->txStatus);
+	u_short rxOffset = READSHMS(arlan->rxOffset);
+	u_short pkt_len = READSHMS(arlan->rxLength);
+	int interrupt_count = 0;
+
+	ARLAN_DEBUG_ENTRY("arlan_process_interrupt");
+
+	if (test_and_set_bit(0, (void *) &priv->interrupt_processing_active))
+	{
+		if (arlan_debug & ARLAN_DEBUG_CHAIN_LOCKS)
+			printk(KERN_ERR "interrupt chain reentering \n");
+		goto end_int_process;
+	}
+	while ((rxStatus || txStatus || priv->interrupt_ack_requested)
+			&& (interrupt_count < 5))
+	{
+		if (rxStatus)
+			priv->last_rx_int_ack_time = jiffies;
+
+		arlan_command(dev, ARLAN_COMMAND_INT_ACK);
+		arlan_command(dev, ARLAN_COMMAND_INT_ENABLE);
+		
+		IFDEBUG(ARLAN_DEBUG_INTERRUPT)
+			printk(KERN_ERR "%s:  got IRQ rx %x tx %x comm %x rxOff %x rxLen %x \n",
+					dev->name, rxStatus, txStatus, READSHMB(arlan->commandByte),
+					rxOffset, pkt_len);
+
+		if (rxStatus == 0 && txStatus == 0)
+		{
+			if (priv->irq_test_done)
+			{
+				if (!registrationBad(dev))
+					IFDEBUG(ARLAN_DEBUG_INTERRUPT) printk(KERN_ERR "%s unknown interrupt(nop? regLost ?) reason tx %d rx %d ",
+										    dev->name, txStatus, rxStatus);
+			} else {
+				IFDEBUG(ARLAN_DEBUG_INTERRUPT)
+					printk(KERN_INFO "%s irq $%d test OK \n", dev->name, dev->irq);
+
+			}
+			priv->interrupt_ack_requested = 0;
+			goto ends;
+		}
+		if (txStatus != 0)
+		{
+			WRITESHMB(arlan->txStatus, 0x00);
+			arlan_tx_done_interrupt(dev, txStatus);
+			goto ends;
+		}
+		if (rxStatus == 1 || rxStatus == 2)
+		{		/* a packet waiting */
+			arlan_rx_interrupt(dev, rxStatus, rxOffset, pkt_len);
+			goto ends;
+		}
+		if (rxStatus > 2 && rxStatus < 0xff)
+		{
+			WRITESHMB(arlan->rxStatus, 0x00);
+			printk(KERN_ERR "%s unknown rxStatus reason tx %d rx %d ",
+				dev->name, txStatus, rxStatus);
+			goto ends;
+		}
+		if (rxStatus == 0xff)
+		{
+			WRITESHMB(arlan->rxStatus, 0x00);
+			arlan_command(dev, ARLAN_COMMAND_RX);
+			if (registrationBad(dev))
+				netif_device_detach(dev);
+			if (!registrationBad(dev))
+			{
+				priv->registrationLastSeen = jiffies;
+				if (!netif_queue_stopped(dev) && !priv->under_reset && !priv->under_config)
+					netif_wake_queue (dev);
+			}
+			goto ends;
+		}
+ends:
+
+		arlan_command_process(dev);
+
+		rxStatus = READSHMB(arlan->rxStatus);
+		txStatus = READSHMB(arlan->txStatus);
+		rxOffset = READSHMS(arlan->rxOffset);
+		pkt_len = READSHMS(arlan->rxLength);
+
+
+		priv->irq_test_done = 1;
+
+		interrupt_count++;
+	}
+	priv->interrupt_processing_active = 0;
+
+end_int_process:
+	arlan_command_process(dev);
+
+	ARLAN_DEBUG_EXIT("arlan_process_interrupt");
+	return;
+}
+
+static irqreturn_t arlan_interrupt(int irq, void *dev_id, struct pt_regs *regs)
+{
+	struct net_device *dev = dev_id;
+	struct arlan_private *priv = netdev_priv(dev);
+	volatile struct arlan_shmem __iomem *arlan = priv->card;
+	u_char rxStatus = READSHMB(arlan->rxStatus);
+	u_char txStatus = READSHMB(arlan->txStatus);
+
+	ARLAN_DEBUG_ENTRY("arlan_interrupt");
+
+
+	if (!rxStatus && !txStatus)
+		priv->interrupt_ack_requested++;
+
+	arlan_process_interrupt(dev);
+	
+	priv->irq_test_done = 1;
+
+	ARLAN_DEBUG_EXIT("arlan_interrupt");
+	return IRQ_HANDLED;
+
+}
+
+
+static int arlan_close(struct net_device *dev)
+{
+	struct arlan_private *priv = netdev_priv(dev);
+
+	ARLAN_DEBUG_ENTRY("arlan_close");
+
+	del_timer_sync(&priv->timer);
+
+	arlan_command(dev, ARLAN_COMMAND_POWERDOWN);
+
+	IFDEBUG(ARLAN_DEBUG_STARTUP)
+		printk(KERN_NOTICE "%s: Closing device\n", dev->name);
+
+	netif_stop_queue(dev);
+	free_irq(dev->irq, dev);
+
+	ARLAN_DEBUG_EXIT("arlan_close");
+	return 0;
+}
+
+#ifdef ARLAN_DEBUGGING
+static long alignLong(volatile u_char * ptr)
+{
+	long ret;
+	memcpy_fromio(&ret, (void *) ptr, 4);
+	return ret;
+}
+#endif
+
+/*
+ * Get the current statistics.
+ * This may be called with the card open or closed.
+ */
+
+static struct net_device_stats *arlan_statistics(struct net_device *dev)
+{
+	struct arlan_private *priv = netdev_priv(dev);
+	volatile struct arlan_shmem __iomem *arlan = priv->card;
+
+
+	ARLAN_DEBUG_ENTRY("arlan_statistics");
+
+	/* Update the statistics from the device registers. */
+
+	READSHM(priv->stats.collisions, arlan->numReTransmissions, u_int);
+	READSHM(priv->stats.rx_crc_errors, arlan->numCRCErrors, u_int);
+	READSHM(priv->stats.rx_dropped, arlan->numFramesDiscarded, u_int);
+	READSHM(priv->stats.rx_fifo_errors, arlan->numRXBufferOverflows, u_int);
+	READSHM(priv->stats.rx_frame_errors, arlan->numReceiveFramesLost, u_int);
+	READSHM(priv->stats.rx_over_errors, arlan->numRXOverruns, u_int);
+	READSHM(priv->stats.rx_packets, arlan->numDatagramsReceived, u_int);
+	READSHM(priv->stats.tx_aborted_errors, arlan->numAbortErrors, u_int);
+	READSHM(priv->stats.tx_carrier_errors, arlan->numStatusTimeouts, u_int);
+	READSHM(priv->stats.tx_dropped, arlan->numDatagramsDiscarded, u_int);
+	READSHM(priv->stats.tx_fifo_errors, arlan->numTXUnderruns, u_int);
+	READSHM(priv->stats.tx_packets, arlan->numDatagramsTransmitted, u_int);
+	READSHM(priv->stats.tx_window_errors, arlan->numHoldOffs, u_int);
+
+	ARLAN_DEBUG_EXIT("arlan_statistics");
+
+	return &priv->stats;
+}
+
+
+static void arlan_set_multicast(struct net_device *dev)
+{
+	struct arlan_private *priv = netdev_priv(dev);
+	volatile struct arlan_shmem __iomem *arlan = priv->card;
+	struct arlan_conf_stru *conf = priv->Conf;
+	int board_conf_needed = 0;
+
+
+	ARLAN_DEBUG_ENTRY("arlan_set_multicast");
+
+	if (dev->flags & IFF_PROMISC)
+	{
+		unsigned char recMode;
+		READSHM(recMode, arlan->receiveMode, u_char);
+		conf->receiveMode = (ARLAN_RCV_PROMISC | ARLAN_RCV_CONTROL);
+		if (conf->receiveMode != recMode)
+			board_conf_needed = 1;
+	}
+	else
+	{
+		/* turn off promiscuous mode  */
+		unsigned char recMode;
+		READSHM(recMode, arlan->receiveMode, u_char);
+		conf->receiveMode = ARLAN_RCV_CLEAN | ARLAN_RCV_CONTROL;
+		if (conf->receiveMode != recMode)
+			board_conf_needed = 1;
+	}
+	if (board_conf_needed)
+		arlan_command(dev, ARLAN_COMMAND_CONF);
+
+	ARLAN_DEBUG_EXIT("arlan_set_multicast");
+}
+
+
+struct net_device * __init arlan_probe(int unit)
+{
+	struct net_device *dev;
+	int err;
+	int m;
+
+	ARLAN_DEBUG_ENTRY("arlan_probe");
+
+	if (arlans_found == MAX_ARLANS)
+		return ERR_PTR(-ENODEV);
+
+	/* 
+	 * Reserve space for local data and a copy of the shared memory
+	 * that is used by the /proc interface.
+	 */
+	dev = alloc_etherdev(sizeof(struct arlan_private)
+			     + sizeof(struct arlan_shmem));
+	if (!dev)
+		return ERR_PTR(-ENOMEM);
+
+	SET_MODULE_OWNER(dev);
+
+	if (unit >= 0) {
+		sprintf(dev->name, "eth%d", unit);
+		netdev_boot_setup_check(dev);
+		
+		if (dev->mem_start) {
+			if (arlan_probe_here(dev, dev->mem_start) == 0)
+				goto found;
+			goto not_found;
+		}
+			
+	}
+
+
+	for (m = (int)phys_to_virt(lastFoundAt) + ARLAN_SHMEM_SIZE; 
+	     m <= (int)phys_to_virt(0xDE000); 
+	     m += ARLAN_SHMEM_SIZE)
+	{
+		if (arlan_probe_here(dev, m) == 0)
+		{
+			lastFoundAt = (int)virt_to_phys((void*)m);
+			goto found;
+		}
+	}
+
+	if (lastFoundAt == 0xbe000)
+		printk(KERN_ERR "arlan: No Arlan devices found \n");
+
+ not_found:
+	free_netdev(dev);
+	return ERR_PTR(-ENODEV);
+
+ found:
+	err = arlan_setup_device(dev, arlans_found);
+	if (err)
+		dev = ERR_PTR(err);
+	else if (!arlans_found++)
+		printk(KERN_INFO "Arlan driver %s\n", arlan_version);
+
+	return dev;
+}
+
+#ifdef  MODULE
+int init_module(void)
+{
+	int i = 0;
+
+	ARLAN_DEBUG_ENTRY("init_module");
+
+	if (channelSet != channelSetUNKNOWN || channelNumber != channelNumberUNKNOWN || systemId != systemIdUNKNOWN)
+		return -EINVAL;
+
+	for (i = 0; i < MAX_ARLANS; i++) {
+		struct net_device *dev = arlan_probe(i);
+
+		if (IS_ERR(dev)) 
+			return PTR_ERR(dev);
+	}
+	init_arlan_proc();
+	printk(KERN_INFO "Arlan driver %s\n", arlan_version);
+	ARLAN_DEBUG_EXIT("init_module");
+	return 0;
+}
+
+
+void cleanup_module(void)
+{
+	int i = 0;
+	struct net_device *dev;
+
+	ARLAN_DEBUG_ENTRY("cleanup_module");
+
+	IFDEBUG(ARLAN_DEBUG_SHUTDOWN)
+		printk(KERN_INFO "arlan: unloading module\n");
+
+	cleanup_arlan_proc();
+
+	for (i = 0; i < MAX_ARLANS; i++)
+	{
+		dev = arlan_device[i];
+		if (dev) {
+			arlan_command(dev, ARLAN_COMMAND_POWERDOWN );
+
+			unregister_netdev(dev);
+			release_mem_region(virt_to_phys((void *) dev->mem_start), 
+					   ARLAN_SHMEM_SIZE);
+			free_netdev(dev);
+			arlan_device[i] = NULL;
+		}
+	}
+
+	ARLAN_DEBUG_EXIT("cleanup_module");
+}
+
+
+#endif
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/wireless/arlan-proc.c b/drivers/net/wireless/arlan-proc.c
new file mode 100644
index 0000000..a2cca52
--- /dev/null
+++ b/drivers/net/wireless/arlan-proc.c
@@ -0,0 +1,1262 @@
+#include <linux/config.h>
+#include "arlan.h"
+
+#include <linux/sysctl.h>
+
+#ifdef CONFIG_PROC_FS
+
+/* void enableReceive(struct net_device* dev);
+*/
+
+
+
+#define ARLAN_STR_SIZE 	0x2ff0
+#define DEV_ARLAN_INFO 	1
+#define DEV_ARLAN 	1
+#define SARLG(type,var) {\
+	pos += sprintf(arlan_drive_info+pos, "%s\t=\t0x%x\n", #var, READSHMB(priva->card->var));	\
+	}
+
+#define SARLBN(type,var,nn) {\
+	pos += sprintf(arlan_drive_info+pos, "%s\t=\t0x",#var);\
+	for (i=0; i < nn; i++ ) pos += sprintf(arlan_drive_info+pos, "%02x",READSHMB(priva->card->var[i]));\
+	pos += sprintf(arlan_drive_info+pos, "\n");	\
+	}
+
+#define SARLBNpln(type,var,nn) {\
+	for (i=0; i < nn; i++ ) pos += sprintf(arlan_drive_info+pos, "%02x",READSHMB(priva->card->var[i]));\
+	}
+
+#define SARLSTR(var,nn) {\
+	char tmpStr[400];\
+	int  tmpLn = nn;\
+	if (nn > 399 ) tmpLn = 399; \
+	memcpy(tmpStr,(char *) priva->conf->var,tmpLn);\
+	tmpStr[tmpLn] = 0; \
+	pos += sprintf(arlan_drive_info+pos, "%s\t=\t%s \n",#var,priva->conf->var);\
+	}
+
+#define SARLUC(var)  	SARLG(u_char, var)
+#define SARLUCN(var,nn) SARLBN(u_char,var, nn)
+#define SARLUS(var)	SARLG(u_short, var)
+#define SARLUSN(var,nn)	SARLBN(u_short,var, nn)
+#define SARLUI(var)	SARLG(u_int, var)
+
+#define SARLUSA(var) {\
+	u_short tmpVar;\
+	memcpy(&tmpVar, (short *) priva->conf->var,2); \
+	pos += sprintf(arlan_drive_info+pos, "%s\t=\t0x%x\n",#var, tmpVar);\
+}
+
+#define SARLUIA(var) {\
+	u_int tmpVar;\
+	memcpy(&tmpVar, (int* )priva->conf->var,4); \
+	pos += sprintf(arlan_drive_info+pos, "%s\t=\t0x%x\n",#var, tmpVar);\
+}
+
+
+static const char *arlan_diagnostic_info_string(struct net_device *dev)
+{
+
+	struct arlan_private *priv = netdev_priv(dev);
+	volatile struct arlan_shmem __iomem *arlan = priv->card;
+	u_char diagnosticInfo;
+
+	READSHM(diagnosticInfo, arlan->diagnosticInfo, u_char);
+
+	switch (diagnosticInfo)
+	{
+		case 0xFF:
+			return "Diagnostic info is OK";
+		case 0xFE:
+			return "ERROR EPROM Checksum error ";
+		case 0xFD:
+			return "ERROR Local Ram Test Failed ";
+		case 0xFC:
+			return "ERROR SCC failure ";
+		case 0xFB:
+			return "ERROR BackBone failure ";
+		case 0xFA:
+			return "ERROR transceiver not found ";
+		case 0xF9:
+			return "ERROR no more address space ";
+		case 0xF8:
+			return "ERROR Checksum error  ";
+		case 0xF7:
+			return "ERROR Missing SS Code";
+		case 0xF6:
+			return "ERROR Invalid config format";
+		case 0xF5:
+			return "ERROR Reserved errorcode F5";
+		case 0xF4:
+			return "ERROR Invalid spreading code/channel number";
+		case 0xF3:
+			return "ERROR Load Code Error";
+		case 0xF2:
+			return "ERROR Reserver errorcode F2 ";
+		case 0xF1:
+			return "ERROR Invalid command receivec by LAN card ";
+		case 0xF0:
+			return "ERROR Invalid parameter found in command ";
+		case 0xEF:
+			return "ERROR On-chip timer failure ";
+		case 0xEE:
+			return "ERROR T410 timer failure ";
+		case 0xED:
+			return "ERROR Too Many TxEnable commands ";
+		case 0xEC:
+			return "ERROR EEPROM error on radio module ";
+		default:
+			return "ERROR unknown Diagnostic info reply code ";
+	  }
+}
+
+static const char *arlan_hardware_type_string(struct net_device *dev)
+{
+	u_char hardwareType;
+	struct arlan_private *priv = netdev_priv(dev);
+	volatile struct arlan_shmem __iomem *arlan = priv->card;
+
+	READSHM(hardwareType, arlan->hardwareType, u_char);
+	switch (hardwareType)
+	{
+		case 0x00:
+			return "type A450";
+		case 0x01:
+			return "type A650 ";
+		case 0x04:
+			return "type TMA coproc";
+		case 0x0D:
+			return "type A650E ";
+		case 0x18:
+			return "type TMA coproc Australian";
+		case 0x19:
+			return "type A650A ";
+		case 0x26:
+			return "type TMA coproc European";
+		case 0x2E:
+			return "type A655 ";
+		case 0x2F:
+			return "type A655A ";
+		case 0x30:
+			return "type A655E ";
+		case 0x0B:
+			return "type A670 ";
+		case 0x0C:
+			return "type A670E ";
+		case 0x2D:
+			return "type A670A ";
+		case 0x0F:
+			return "type A411T";
+		case 0x16:
+			return "type A411TA";
+		case 0x1B:
+			return "type A440T";
+		case 0x1C:
+			return "type A412T";
+		case 0x1E:
+			return "type A412TA";
+		case 0x22:
+			return "type A411TE";
+		case 0x24:
+			return "type A412TE";
+		case 0x27:
+			return "type A671T ";
+		case 0x29:
+			return "type A671TA ";
+		case 0x2B:
+			return "type A671TE ";
+		case 0x31:
+			return "type A415T ";
+		case 0x33:
+			return "type A415TA ";
+		case 0x35:
+			return "type A415TE ";
+		case 0x37:
+			return "type A672";
+		case 0x39:
+			return "type A672A ";
+		case 0x3B:
+			return "type A672T";
+		case 0x6B:
+			return "type IC2200";
+		default:
+			return "type A672T";
+	}
+}
+#ifdef ARLAN_DEBUGGING
+static void arlan_print_diagnostic_info(struct net_device *dev)
+{
+	int i;
+	u_char diagnosticInfo;
+	u_short diagnosticOffset;
+	u_char hardwareType;
+	struct arlan_private *priv = netdev_priv(dev);
+	volatile struct arlan_shmem __iomem *arlan = priv->card;
+
+	//  ARLAN_DEBUG_ENTRY("arlan_print_diagnostic_info");
+
+	if (READSHMB(arlan->configuredStatusFlag) == 0)
+		printk("Arlan: Card NOT configured\n");
+	else
+		printk("Arlan: Card is configured\n");
+
+	READSHM(diagnosticInfo, arlan->diagnosticInfo, u_char);
+	READSHM(diagnosticOffset, arlan->diagnosticOffset, u_short);
+
+	printk(KERN_INFO "%s\n", arlan_diagnostic_info_string(dev));
+
+	if (diagnosticInfo != 0xff)
+		printk("%s arlan: Diagnostic Offset %d \n", dev->name, diagnosticOffset);
+
+	printk("arlan: LAN CODE ID = ");
+	for (i = 0; i < 6; i++)
+		DEBUGSHM(1, "%03d:", arlan->lanCardNodeId[i], u_char);
+	printk("\n");
+
+	printk("arlan: Arlan BroadCast address  = ");
+	for (i = 0; i < 6; i++)
+		DEBUGSHM(1, "%03d:", arlan->broadcastAddress[i], u_char);
+	printk("\n");
+
+	READSHM(hardwareType, arlan->hardwareType, u_char);
+	printk(KERN_INFO "%s\n", arlan_hardware_type_string(dev));
+
+
+	DEBUGSHM(1, "arlan: channelNumber=%d\n", arlan->channelNumber, u_char);
+	DEBUGSHM(1, "arlan: channelSet=%d\n", arlan->channelSet, u_char);
+	DEBUGSHM(1, "arlan: spreadingCode=%d\n", arlan->spreadingCode, u_char);
+	DEBUGSHM(1, "arlan: radioNodeId=%d\n", arlan->radioNodeId, u_short);
+	DEBUGSHM(1, "arlan: SID	=%d\n", arlan->SID, u_short);
+	DEBUGSHM(1, "arlan: rxOffset=%d\n", arlan->rxOffset, u_short);
+
+	DEBUGSHM(1, "arlan: registration mode is %d\n", arlan->registrationMode, u_char);
+
+	printk("arlan: name= ");
+	IFDEBUG(1)
+	
+	for (i = 0; i < 16; i++)
+	{
+		char c;
+		READSHM(c, arlan->name[i], char);
+		if (c)
+			printk("%c", c);
+	}
+	printk("\n");
+
+//   ARLAN_DEBUG_EXIT("arlan_print_diagnostic_info");
+
+}
+
+
+/******************************		TEST 	MEMORY	**************/
+
+static int arlan_hw_test_memory(struct net_device *dev)
+{
+	u_char *ptr;
+	int i;
+	int memlen = sizeof(struct arlan_shmem) - 0xF;	/* avoid control register */
+	volatile char *arlan_mem = (char *) (dev->mem_start);
+	struct arlan_private *priv = netdev_priv(dev);
+	volatile struct arlan_shmem __iomem *arlan = priv->card;
+	char pattern;
+
+	ptr = NULL;
+
+	/* hold card in reset state */
+	setHardwareReset(dev);
+
+	/* test memory */
+	pattern = 0;
+	for (i = 0; i < memlen; i++)
+		WRITESHM(arlan_mem[i], ((u_char) pattern++), u_char);
+
+	pattern = 0;
+	for (i = 0; i < memlen; i++)
+	{
+		char res;
+		READSHM(res, arlan_mem[i], char);
+		if (res != pattern++)
+		{
+			printk(KERN_ERR "Arlan driver memory test 1 failed \n");
+			return -1;
+		}
+	}
+
+	pattern = 0;
+	for (i = 0; i < memlen; i++)
+		WRITESHM(arlan_mem[i], ~(pattern++), char);
+
+	pattern = 0;
+	for (i = 0; i < memlen; i++)
+	{
+		char res;
+		READSHM(res, arlan_mem[i], char);
+		if (res != ~(pattern++))
+		{
+			printk(KERN_ERR "Arlan driver memory test 2 failed \n");
+			return -1;
+		}
+	}
+
+	/* zero memory */
+	for (i = 0; i < memlen; i++)
+		WRITESHM(arlan_mem[i], 0x00, char);
+
+	IFDEBUG(1) printk(KERN_INFO "Arlan: memory tests ok\n");
+
+	/* set reset flag and then release reset */
+	WRITESHM(arlan->resetFlag, 0xff, u_char);
+
+	clearChannelAttention(dev);
+	clearHardwareReset(dev);
+
+	/* wait for reset flag to become zero, we'll wait for two seconds */
+	if (arlan_command(dev, ARLAN_COMMAND_LONG_WAIT_NOW))
+	{
+		printk(KERN_ERR "%s arlan: failed to come back from memory test\n", dev->name);
+		return -1;
+	}
+	return 0;
+}
+
+static int arlan_setup_card_by_book(struct net_device *dev)
+{
+	u_char irqLevel, configuredStatusFlag;
+	struct arlan_private *priv = netdev_priv(dev);
+	volatile struct arlan_shmem __iomem *arlan = priv->card;
+
+//	ARLAN_DEBUG_ENTRY("arlan_setup_card");
+
+	READSHM(configuredStatusFlag, arlan->configuredStatusFlag, u_char);
+
+	IFDEBUG(10)
+	if (configuredStatusFlag != 0)
+		IFDEBUG(10) printk("arlan: CARD IS CONFIGURED\n");
+	else
+		IFDEBUG(10) printk("arlan: card is NOT configured\n");
+
+	if (testMemory || (READSHMB(arlan->diagnosticInfo) != 0xff))
+		if (arlan_hw_test_memory(dev))
+			return -1;
+
+	DEBUGSHM(4, "arlan configuredStatus = %d \n", arlan->configuredStatusFlag, u_char);
+	DEBUGSHM(4, "arlan driver diagnostic: 0x%2x\n", arlan->diagnosticInfo, u_char);
+
+	/* issue nop command - no interrupt */
+	arlan_command(dev, ARLAN_COMMAND_NOOP);
+	if (arlan_command(dev, ARLAN_COMMAND_WAIT_NOW) != 0)
+		return -1;
+
+	IFDEBUG(50) printk("1st Noop successfully executed !!\n");
+
+	/* try to turn on the arlan interrupts */
+	clearClearInterrupt(dev);
+	setClearInterrupt(dev);
+	setInterruptEnable(dev);
+
+	/* issue nop command - with interrupt */
+
+	arlan_command(dev, ARLAN_COMMAND_NOOPINT);
+	if (arlan_command(dev, ARLAN_COMMAND_WAIT_NOW) != 0)
+		return -1;
+
+
+	IFDEBUG(50) printk("2nd Noop successfully executed !!\n");
+
+	READSHM(irqLevel, arlan->irqLevel, u_char)
+	
+	if (irqLevel != dev->irq)
+	{
+		IFDEBUG(1) printk(KERN_WARNING "arlan dip switches set irq to %d\n", irqLevel);
+		printk(KERN_WARNING "device driver irq set to %d - does not match\n", dev->irq);
+		dev->irq = irqLevel;
+	}
+	else
+		IFDEBUG(2) printk("irq level is OK\n");
+
+
+	IFDEBUG(3) arlan_print_diagnostic_info(dev);
+
+	arlan_command(dev, ARLAN_COMMAND_CONF);
+
+	READSHM(configuredStatusFlag, arlan->configuredStatusFlag, u_char);
+	if (configuredStatusFlag == 0)
+	{
+		printk(KERN_WARNING "arlan configure failed\n");
+		return -1;
+	}
+	arlan_command(dev, ARLAN_COMMAND_LONG_WAIT_NOW);
+	arlan_command(dev, ARLAN_COMMAND_RX);
+	arlan_command(dev, ARLAN_COMMAND_LONG_WAIT_NOW);
+	printk(KERN_NOTICE "%s: arlan driver version %s loaded\n",
+	       dev->name, arlan_version);
+
+//	ARLAN_DEBUG_EXIT("arlan_setup_card");
+
+	return 0;		/* no errors */
+}
+#endif
+
+#ifdef ARLAN_PROC_INTERFACE
+#ifdef ARLAN_PROC_SHM_DUMP
+
+static char arlan_drive_info[ARLAN_STR_SIZE] = "A655\n\0";
+
+static int arlan_sysctl_info(ctl_table * ctl, int write, struct file *filp,
+		      void __user *buffer, size_t * lenp, loff_t *ppos)
+{
+	int i;
+	int retv, pos, devnum;
+	struct arlan_private *priva = NULL;
+	struct net_device *dev;
+	pos = 0;
+	if (write)
+	{
+		printk("wrirte: ");
+		for (i = 0; i < 100; i++)
+			printk("adi %x \n", arlan_drive_info[i]);
+	}
+	if (ctl->procname == NULL || arlan_drive_info == NULL)
+	{
+		printk(KERN_WARNING " procname is NULL in sysctl_table or arlan_drive_info is NULL \n at arlan module\n ");
+		return -1;
+	}
+	devnum = ctl->procname[5] - '0';
+	if (devnum < 0 || devnum > MAX_ARLANS - 1)
+	{
+		printk(KERN_WARNING "too strange devnum in procfs parse\n ");
+		return -1;
+	}
+	else if (arlan_device[devnum] == NULL)
+	{
+		if (ctl->procname)
+			pos += sprintf(arlan_drive_info + pos, "\t%s\n\n", ctl->procname);
+		pos += sprintf(arlan_drive_info + pos, "No device found here \n");
+		goto final;
+	}
+	else
+		priva = arlan_device[devnum]->priv;
+
+	if (priva == NULL)
+	{
+		printk(KERN_WARNING " Could not find the device private in arlan procsys, bad\n ");
+		return -1;
+	}
+	dev = arlan_device[devnum];
+
+	memcpy_fromio(priva->conf, priva->card, sizeof(struct arlan_shmem));
+
+	pos = sprintf(arlan_drive_info, "Arlan  info \n");
+	/* Header Signature */
+	SARLSTR(textRegion, 48);
+	SARLUC(resetFlag);
+	pos += sprintf(arlan_drive_info + pos, "diagnosticInfo\t=\t%s \n", arlan_diagnostic_info_string(dev));
+	SARLUC(diagnosticInfo);
+	SARLUS(diagnosticOffset);
+	SARLUCN(_1, 12);
+	SARLUCN(lanCardNodeId, 6);
+	SARLUCN(broadcastAddress, 6);
+	pos += sprintf(arlan_drive_info + pos, "hardwareType =\t  %s \n", arlan_hardware_type_string(dev));
+	SARLUC(hardwareType);
+	SARLUC(majorHardwareVersion);
+	SARLUC(minorHardwareVersion);
+	SARLUC(radioModule);
+	SARLUC(defaultChannelSet);
+	SARLUCN(_2, 47);
+
+	/* Control/Status Block - 0x0080 */
+	SARLUC(interruptInProgress);
+	SARLUC(cntrlRegImage);
+
+	SARLUCN(_3, 14);
+	SARLUC(commandByte);
+	SARLUCN(commandParameter, 15);
+
+	/* Receive Status - 0x00a0 */
+	SARLUC(rxStatus);
+	SARLUC(rxFrmType);
+	SARLUS(rxOffset);
+	SARLUS(rxLength);
+	SARLUCN(rxSrc, 6);
+	SARLUC(rxBroadcastFlag);
+	SARLUC(rxQuality);
+	SARLUC(scrambled);
+	SARLUCN(_4, 1);
+
+	/* Transmit Status - 0x00b0 */
+	SARLUC(txStatus);
+	SARLUC(txAckQuality);
+	SARLUC(numRetries);
+	SARLUCN(_5, 14);
+	SARLUCN(registeredRouter, 6);
+	SARLUCN(backboneRouter, 6);
+	SARLUC(registrationStatus);
+	SARLUC(configuredStatusFlag);
+	SARLUCN(_6, 1);
+	SARLUCN(ultimateDestAddress, 6);
+	SARLUCN(immedDestAddress, 6);
+	SARLUCN(immedSrcAddress, 6);
+	SARLUS(rxSequenceNumber);
+	SARLUC(assignedLocaltalkAddress);
+	SARLUCN(_7, 27);
+
+	/* System Parameter Block */
+
+	/* - Driver Parameters (Novell Specific) */
+
+	SARLUS(txTimeout);
+	SARLUS(transportTime);
+	SARLUCN(_8, 4);
+
+	/* - Configuration Parameters */
+	SARLUC(irqLevel);
+	SARLUC(spreadingCode);
+	SARLUC(channelSet);
+	SARLUC(channelNumber);
+	SARLUS(radioNodeId);
+	SARLUCN(_9, 2);
+	SARLUC(scramblingDisable);
+	SARLUC(radioType);
+	SARLUS(routerId);
+	SARLUCN(_10, 9);
+	SARLUC(txAttenuation);
+	SARLUIA(systemId);
+	SARLUS(globalChecksum);
+	SARLUCN(_11, 4);
+	SARLUS(maxDatagramSize);
+	SARLUS(maxFrameSize);
+	SARLUC(maxRetries);
+	SARLUC(receiveMode);
+	SARLUC(priority);
+	SARLUC(rootOrRepeater);
+	SARLUCN(specifiedRouter, 6);
+	SARLUS(fastPollPeriod);
+	SARLUC(pollDecay);
+	SARLUSA(fastPollDelay);
+	SARLUC(arlThreshold);
+	SARLUC(arlDecay);
+	SARLUCN(_12, 1);
+	SARLUS(specRouterTimeout);
+	SARLUCN(_13, 5);
+
+	/* Scrambled Area */
+	SARLUIA(SID);
+	SARLUCN(encryptionKey, 12);
+	SARLUIA(_14);
+	SARLUSA(waitTime);
+	SARLUSA(lParameter);
+	SARLUCN(_15, 3);
+	SARLUS(headerSize);
+	SARLUS(sectionChecksum);
+
+	SARLUC(registrationMode);
+	SARLUC(registrationFill);
+	SARLUS(pollPeriod);
+	SARLUS(refreshPeriod);
+	SARLSTR(name, 16);
+	SARLUCN(NID, 6);
+	SARLUC(localTalkAddress);
+	SARLUC(codeFormat);
+	SARLUC(numChannels);
+	SARLUC(channel1);
+	SARLUC(channel2);
+	SARLUC(channel3);
+	SARLUC(channel4);
+	SARLUCN(SSCode, 59);
+
+/*      SARLUCN( _16, 0x140);
+ */
+	/* Statistics Block - 0x0300 */
+	SARLUC(hostcpuLock);
+	SARLUC(lancpuLock);
+	SARLUCN(resetTime, 18);
+	SARLUIA(numDatagramsTransmitted);
+	SARLUIA(numReTransmissions);
+	SARLUIA(numFramesDiscarded);
+	SARLUIA(numDatagramsReceived);
+	SARLUIA(numDuplicateReceivedFrames);
+	SARLUIA(numDatagramsDiscarded);
+	SARLUS(maxNumReTransmitDatagram);
+	SARLUS(maxNumReTransmitFrames);
+	SARLUS(maxNumConsecutiveDuplicateFrames);
+	/* misaligned here so we have to go to characters */
+	SARLUIA(numBytesTransmitted);
+	SARLUIA(numBytesReceived);
+	SARLUIA(numCRCErrors);
+	SARLUIA(numLengthErrors);
+	SARLUIA(numAbortErrors);
+	SARLUIA(numTXUnderruns);
+	SARLUIA(numRXOverruns);
+	SARLUIA(numHoldOffs);
+	SARLUIA(numFramesTransmitted);
+	SARLUIA(numFramesReceived);
+	SARLUIA(numReceiveFramesLost);
+	SARLUIA(numRXBufferOverflows);
+	SARLUIA(numFramesDiscardedAddrMismatch);
+	SARLUIA(numFramesDiscardedSIDMismatch);
+	SARLUIA(numPollsTransmistted);
+	SARLUIA(numPollAcknowledges);
+	SARLUIA(numStatusTimeouts);
+	SARLUIA(numNACKReceived);
+	SARLUS(auxCmd);
+	SARLUCN(dumpPtr, 4);
+	SARLUC(dumpVal);
+	SARLUC(wireTest);
+	
+	/* next 4 seems too long for procfs, over single page ?
+	SARLUCN( _17, 0x86);
+	SARLUCN( txBuffer, 0x800);
+	SARLUCN( rxBuffer,  0x800); 
+	SARLUCN( _18, 0x0bff);
+	 */
+
+	pos += sprintf(arlan_drive_info + pos, "rxRing\t=\t0x");
+	for (i = 0; i < 0x50; i++)
+		pos += sprintf(arlan_drive_info + pos, "%02x", ((char *) priva->conf)[priva->conf->rxOffset + i]);
+	pos += sprintf(arlan_drive_info + pos, "\n");
+
+	SARLUC(configStatus);
+	SARLUC(_22);
+	SARLUC(progIOCtrl);
+	SARLUC(shareMBase);
+	SARLUC(controlRegister);
+
+	pos += sprintf(arlan_drive_info + pos, " total %d chars\n", pos);
+	if (ctl)
+		if (ctl->procname)
+			pos += sprintf(arlan_drive_info + pos, " driver name : %s\n", ctl->procname);
+final:
+	*lenp = pos;
+
+	if (!write)
+		retv = proc_dostring(ctl, write, filp, buffer, lenp, ppos);
+	else
+	{
+		*lenp = 0;
+		return -1;
+	}
+	return retv;
+}
+
+
+static int arlan_sysctl_info161719(ctl_table * ctl, int write, struct file *filp,
+			    void __user *buffer, size_t * lenp, loff_t *ppos)
+{
+	int i;
+	int retv, pos, devnum;
+	struct arlan_private *priva = NULL;
+
+	pos = 0;
+	devnum = ctl->procname[5] - '0';
+	if (arlan_device[devnum] == NULL)
+	{
+		pos += sprintf(arlan_drive_info + pos, "No device found here \n");
+		goto final;
+	}
+	else
+		priva = arlan_device[devnum]->priv;
+	if (priva == NULL)
+	{
+		printk(KERN_WARNING " Could not find the device private in arlan procsys, bad\n ");
+		return -1;
+	}
+	memcpy_fromio(priva->conf, priva->card, sizeof(struct arlan_shmem));
+	SARLUCN(_16, 0xC0);
+	SARLUCN(_17, 0x6A);
+	SARLUCN(_18, 14);
+	SARLUCN(_19, 0x86);
+	SARLUCN(_21, 0x3fd);
+
+final:
+	*lenp = pos;
+	retv = proc_dostring(ctl, write, filp, buffer, lenp, ppos);
+	return retv;
+}
+
+static int arlan_sysctl_infotxRing(ctl_table * ctl, int write, struct file *filp,
+			    void __user *buffer, size_t * lenp, loff_t *ppos)
+{
+	int i;
+	int retv, pos, devnum;
+	struct arlan_private *priva = NULL;
+
+	pos = 0;
+	devnum = ctl->procname[5] - '0';
+	if (arlan_device[devnum] == NULL)
+	{
+		  pos += sprintf(arlan_drive_info + pos, "No device found here \n");
+		  goto final;
+	}
+	else
+		priva = arlan_device[devnum]->priv;
+	if (priva == NULL)
+	{
+		printk(KERN_WARNING " Could not find the device private in arlan procsys, bad\n ");
+		return -1;
+	}
+	memcpy_fromio(priva->conf, priva->card, sizeof(struct arlan_shmem));
+	SARLBNpln(u_char, txBuffer, 0x800);
+final:
+	*lenp = pos;
+	retv = proc_dostring(ctl, write, filp, buffer, lenp, ppos);
+	return retv;
+}
+
+static int arlan_sysctl_inforxRing(ctl_table * ctl, int write, struct file *filp,
+			    void __user *buffer, size_t * lenp, loff_t *ppos)
+{
+	int i;
+	int retv, pos, devnum;
+	struct arlan_private *priva = NULL;
+
+	pos = 0;
+	devnum = ctl->procname[5] - '0';
+	if (arlan_device[devnum] == NULL)
+	{
+		  pos += sprintf(arlan_drive_info + pos, "No device found here \n");
+		  goto final;
+	} else
+		priva = arlan_device[devnum]->priv;
+	if (priva == NULL)
+	{
+		printk(KERN_WARNING " Could not find the device private in arlan procsys, bad\n ");
+		return -1;
+	}
+	memcpy_fromio(priva->conf, priva->card, sizeof(struct arlan_shmem));
+	SARLBNpln(u_char, rxBuffer, 0x800);
+final:
+	*lenp = pos;
+	retv = proc_dostring(ctl, write, filp, buffer, lenp, ppos);
+	return retv;
+}
+
+static int arlan_sysctl_info18(ctl_table * ctl, int write, struct file *filp,
+			void __user *buffer, size_t * lenp, loff_t *ppos)
+{
+	int i;
+	int retv, pos, devnum;
+	struct arlan_private *priva = NULL;
+
+	pos = 0;
+	devnum = ctl->procname[5] - '0';
+	if (arlan_device[devnum] == NULL)
+	{
+		pos += sprintf(arlan_drive_info + pos, "No device found here \n");
+		goto final;
+	}
+	else
+		priva = arlan_device[devnum]->priv;
+	if (priva == NULL)
+	{
+		printk(KERN_WARNING " Could not find the device private in arlan procsys, bad\n ");
+		return -1;
+	}
+	memcpy_fromio(priva->conf, priva->card, sizeof(struct arlan_shmem));
+	SARLBNpln(u_char, _18, 0x800);
+
+final:
+	*lenp = pos;
+	retv = proc_dostring(ctl, write, filp, buffer, lenp, ppos);
+	return retv;
+}
+
+
+#endif				/* #ifdef ARLAN_PROC_SHM_DUMP */
+
+
+static char conf_reset_result[200];
+
+static int arlan_configure(ctl_table * ctl, int write, struct file *filp,
+		    void __user *buffer, size_t * lenp, loff_t *ppos)
+{
+	int pos = 0;
+	int devnum = ctl->procname[6] - '0';
+	struct arlan_private *priv;
+
+	if (devnum < 0 || devnum > MAX_ARLANS - 1)
+	{
+		  printk(KERN_WARNING "too strange devnum in procfs parse\n ");
+		  return -1;
+	}
+	else if (arlan_device[devnum] != NULL)
+	{
+		  priv = arlan_device[devnum]->priv;
+
+		  arlan_command(arlan_device[devnum], ARLAN_COMMAND_CLEAN_AND_CONF);
+	}
+	else
+		return -1;
+
+	*lenp = pos;
+	return proc_dostring(ctl, write, filp, buffer, lenp, ppos);
+}
+
+static int arlan_sysctl_reset(ctl_table * ctl, int write, struct file *filp,
+		       void __user *buffer, size_t * lenp, loff_t *ppos)
+{
+	int pos = 0;
+	int devnum = ctl->procname[5] - '0';
+	struct arlan_private *priv;
+
+	if (devnum < 0 || devnum > MAX_ARLANS - 1)
+	{
+		  printk(KERN_WARNING "too strange devnum in procfs parse\n ");
+		  return -1;
+	}
+	else if (arlan_device[devnum] != NULL)
+	{
+		priv = arlan_device[devnum]->priv;
+		arlan_command(arlan_device[devnum], ARLAN_COMMAND_CLEAN_AND_RESET);
+
+	} else
+		return -1;
+	*lenp = pos + 3;
+	return proc_dostring(ctl, write, filp, buffer, lenp, ppos);
+}
+
+
+/* Place files in /proc/sys/dev/arlan */
+#define CTBLN(num,card,nam) \
+        { .ctl_name = num,\
+          .procname = #nam,\
+          .data = &(arlan_conf[card].nam),\
+          .maxlen = sizeof(int), .mode = 0600, .proc_handler = &proc_dointvec}
+#ifdef ARLAN_DEBUGGING
+
+#define ARLAN_PROC_DEBUG_ENTRIES \
+        { .ctl_name = 48, .procname = "entry_exit_debug",\
+          .data = &arlan_entry_and_exit_debug,\
+          .maxlen = sizeof(int), .mode = 0600, .proc_handler = &proc_dointvec},\
+	{ .ctl_name = 49, .procname = "debug", .data = &arlan_debug,\
+          .maxlen = sizeof(int), .mode = 0600, .proc_handler = &proc_dointvec},
+#else 
+#define ARLAN_PROC_DEBUG_ENTRIES
+#endif
+
+#define ARLAN_SYSCTL_TABLE_TOTAL(cardNo)\
+	CTBLN(1,cardNo,spreadingCode),\
+	CTBLN(2,cardNo, channelNumber),\
+	CTBLN(3,cardNo, scramblingDisable),\
+	CTBLN(4,cardNo, txAttenuation),\
+	CTBLN(5,cardNo, systemId), \
+	CTBLN(6,cardNo, maxDatagramSize),\
+	CTBLN(7,cardNo, maxFrameSize),\
+	CTBLN(8,cardNo, maxRetries),\
+	CTBLN(9,cardNo, receiveMode),\
+	CTBLN(10,cardNo, priority),\
+	CTBLN(11,cardNo, rootOrRepeater),\
+	CTBLN(12,cardNo, SID),\
+	CTBLN(13,cardNo, registrationMode),\
+	CTBLN(14,cardNo, registrationFill),\
+	CTBLN(15,cardNo, localTalkAddress),\
+	CTBLN(16,cardNo, codeFormat),\
+	CTBLN(17,cardNo, numChannels),\
+	CTBLN(18,cardNo, channel1),\
+	CTBLN(19,cardNo, channel2),\
+	CTBLN(20,cardNo, channel3),\
+	CTBLN(21,cardNo, channel4),\
+	CTBLN(22,cardNo, txClear),\
+	CTBLN(23,cardNo, txRetries),\
+	CTBLN(24,cardNo, txRouting),\
+	CTBLN(25,cardNo, txScrambled),\
+	CTBLN(26,cardNo, rxParameter),\
+	CTBLN(27,cardNo, txTimeoutMs),\
+	CTBLN(28,cardNo, waitCardTimeout),\
+	CTBLN(29,cardNo, channelSet), \
+	{.ctl_name = 30, .procname = "name",\
+	 .data = arlan_conf[cardNo].siteName,\
+	 .maxlen = 16, .mode = 0600, .proc_handler = &proc_dostring},\
+	CTBLN(31,cardNo,waitTime),\
+	CTBLN(32,cardNo,lParameter),\
+	CTBLN(33,cardNo,_15),\
+	CTBLN(34,cardNo,headerSize),\
+	CTBLN(36,cardNo,tx_delay_ms),\
+	CTBLN(37,cardNo,retries),\
+	CTBLN(38,cardNo,ReTransmitPacketMaxSize),\
+	CTBLN(39,cardNo,waitReTransmitPacketMaxSize),\
+	CTBLN(40,cardNo,fastReTransCount),\
+	CTBLN(41,cardNo,driverRetransmissions),\
+	CTBLN(42,cardNo,txAckTimeoutMs),\
+	CTBLN(43,cardNo,registrationInterrupts),\
+	CTBLN(44,cardNo,hardwareType),\
+	CTBLN(45,cardNo,radioType),\
+	CTBLN(46,cardNo,writeEEPROM),\
+	CTBLN(47,cardNo,writeRadioType),\
+	ARLAN_PROC_DEBUG_ENTRIES\
+	CTBLN(50,cardNo,in_speed),\
+	CTBLN(51,cardNo,out_speed),\
+	CTBLN(52,cardNo,in_speed10),\
+	CTBLN(53,cardNo,out_speed10),\
+	CTBLN(54,cardNo,in_speed_max),\
+	CTBLN(55,cardNo,out_speed_max),\
+	CTBLN(56,cardNo,measure_rate),\
+	CTBLN(57,cardNo,pre_Command_Wait),\
+	CTBLN(58,cardNo,rx_tweak1),\
+	CTBLN(59,cardNo,rx_tweak2),\
+	CTBLN(60,cardNo,tx_queue_len),\
+
+
+
+static ctl_table arlan_conf_table0[] =
+{
+	ARLAN_SYSCTL_TABLE_TOTAL(0)
+
+#ifdef ARLAN_PROC_SHM_DUMP
+	{
+		.ctl_name	= 150,
+		.procname	= "arlan0-txRing",
+		.data		= &arlan_drive_info,
+		.maxlen		= ARLAN_STR_SIZE,
+		.mode		= 0400,
+		.proc_handler	= &arlan_sysctl_infotxRing,
+	},
+	{
+		.ctl_name	= 151,
+		.procname	= "arlan0-rxRing",
+		.data		= &arlan_drive_info,
+		.maxlen		= ARLAN_STR_SIZE,
+		.mode		= 0400,
+		.proc_handler	= &arlan_sysctl_inforxRing,
+	},
+	{
+		.ctl_name	= 152,
+		.procname	= "arlan0-18",
+		.data		= &arlan_drive_info,
+		.maxlen		= ARLAN_STR_SIZE,
+		.mode		= 0400,
+		.proc_handler	= &arlan_sysctl_info18,
+	},
+	{
+		.ctl_name	= 153,
+		.procname	= "arlan0-ring",
+		.data		= &arlan_drive_info,
+		.maxlen		= ARLAN_STR_SIZE,
+		.mode		= 0400,
+		.proc_handler	= &arlan_sysctl_info161719,
+	},
+	{
+		.ctl_name	= 154,
+		.procname	= "arlan0-shm-cpy",
+		.data		= &arlan_drive_info,
+		.maxlen		= ARLAN_STR_SIZE,
+		.mode		= 0400,
+		.proc_handler	= &arlan_sysctl_info,
+	},
+#endif
+	{
+		.ctl_name	= 155,
+		.procname	= "config0",
+		.data		= &conf_reset_result,
+		.maxlen		= 100,
+		.mode		= 0400,
+		.proc_handler	= &arlan_configure
+	},
+	{
+		.ctl_name	= 156,
+		.procname	= "reset0",
+		.data		= &conf_reset_result,
+		.maxlen		= 100,
+		.mode		= 0400,
+		.proc_handler	= &arlan_sysctl_reset,
+	},
+	{ .ctl_name = 0 }
+};
+
+static ctl_table arlan_conf_table1[] =
+{
+
+	ARLAN_SYSCTL_TABLE_TOTAL(1)
+
+#ifdef ARLAN_PROC_SHM_DUMP
+	{
+		.ctl_name	= 150,
+		.procname	= "arlan1-txRing",
+		.data		= &arlan_drive_info,
+		.maxlen		= ARLAN_STR_SIZE,
+		.mode		= 0400,
+		.proc_handler	= &arlan_sysctl_infotxRing,
+	},
+	{
+		.ctl_name	= 151,
+		.procname	= "arlan1-rxRing",
+		.data		= &arlan_drive_info,
+		.maxlen		= ARLAN_STR_SIZE,
+		.mode		= 0400,
+		.proc_handler	= &arlan_sysctl_inforxRing,
+	},
+	{
+		.ctl_name	= 152,
+		.procname	= "arlan1-18",
+		.data		= &arlan_drive_info,
+		.maxlen		= ARLAN_STR_SIZE,
+		.mode		= 0400,
+		.proc_handler	= &arlan_sysctl_info18,
+	},
+	{
+		.ctl_name	= 153,
+		.procname	= "arlan1-ring",
+		.data		= &arlan_drive_info,
+		.maxlen		= ARLAN_STR_SIZE,
+		.mode		= 0400,
+		.proc_handler	= &arlan_sysctl_info161719,
+	},
+	{
+		.ctl_name	= 154,
+		.procname	= "arlan1-shm-cpy",
+		.data		= &arlan_drive_info,
+		.maxlen		= ARLAN_STR_SIZE,
+		.mode		= 0400,
+		.proc_handler	= &arlan_sysctl_info,
+	},
+#endif
+	{
+		.ctl_name	= 155,
+		.procname	= "config1",
+		.data		= &conf_reset_result,
+		.maxlen		= 100,
+		.mode		= 0400,
+		.proc_handler	= &arlan_configure,
+	},
+	{
+		.ctl_name	= 156,
+		.procname	= "reset1",
+		.data		= &conf_reset_result,
+		.maxlen		= 100,
+		.mode		= 0400,
+		.proc_handler	= &arlan_sysctl_reset,
+	},
+	{ .ctl_name = 0 }
+};
+
+static ctl_table arlan_conf_table2[] =
+{
+
+	ARLAN_SYSCTL_TABLE_TOTAL(2)
+
+#ifdef ARLAN_PROC_SHM_DUMP
+	{
+		.ctl_name	= 150,
+		.procname	= "arlan2-txRing",
+		.data		= &arlan_drive_info,
+		.maxlen		= ARLAN_STR_SIZE,
+		.mode		= 0400,
+		.proc_handler	= &arlan_sysctl_infotxRing,
+	},
+	{
+		.ctl_name	= 151,
+		.procname	= "arlan2-rxRing",
+		.data		= &arlan_drive_info,
+		.maxlen		= ARLAN_STR_SIZE,
+		.mode		= 0400,
+		.proc_handler	= &arlan_sysctl_inforxRing,
+	},
+	{
+		.ctl_name	= 152,
+		.procname	= "arlan2-18",
+		.data		= &arlan_drive_info,
+		.maxlen		= ARLAN_STR_SIZE,
+		.mode		= 0400,
+		.proc_handler	= &arlan_sysctl_info18,
+	},
+	{
+		.ctl_name	= 153,
+		.procname	= "arlan2-ring",
+		.data		= &arlan_drive_info,
+		.maxlen		= ARLAN_STR_SIZE,
+		.mode		= 0400,
+		.proc_handler	= &arlan_sysctl_info161719,
+	},
+	{
+		.ctl_name	= 154,
+		.procname	= "arlan2-shm-cpy",
+		.data		= &arlan_drive_info,
+		.maxlen		= ARLAN_STR_SIZE,
+		.mode		= 0400,
+		.proc_handler	= &arlan_sysctl_info,
+	},
+#endif
+	{
+		.ctl_name	= 155,
+		.procname	= "config2",
+		.data		= &conf_reset_result,
+		.maxlen		= 100,
+		.mode		= 0400,
+		.proc_handler	= &arlan_configure,
+	},
+	{
+		.ctl_name	= 156,
+		.procname	= "reset2",
+		.data		= &conf_reset_result,
+		.maxlen		= 100,
+		.mode		= 0400,
+		.proc_handler	= &arlan_sysctl_reset,
+	},
+	{ .ctl_name = 0 }
+};
+
+static ctl_table arlan_conf_table3[] =
+{
+
+	ARLAN_SYSCTL_TABLE_TOTAL(3)
+
+#ifdef ARLAN_PROC_SHM_DUMP
+	{
+		.ctl_name	= 150,
+		.procname	= "arlan3-txRing",
+		.data		= &arlan_drive_info,
+		.maxlen		= ARLAN_STR_SIZE,
+		.mode		= 0400,
+		.proc_handler	= &arlan_sysctl_infotxRing,
+	},
+	{
+		.ctl_name	= 151,
+		.procname	= "arlan3-rxRing",
+		.data		= &arlan_drive_info,
+		.maxlen		= ARLAN_STR_SIZE,
+		.mode		= 0400,
+		.proc_handler	= &arlan_sysctl_inforxRing,
+	},
+	{
+		.ctl_name	= 152,
+		.procname	= "arlan3-18",
+		.data		= &arlan_drive_info,
+		.maxlen		= ARLAN_STR_SIZE,
+		.mode		= 0400,
+		.proc_handler	= &arlan_sysctl_info18,
+	},
+	{
+		.ctl_name	= 153,
+		.procname	= "arlan3-ring",
+		.data		= &arlan_drive_info,
+		.maxlen		= ARLAN_STR_SIZE,
+		.mode		= 0400,
+		.proc_handler	= &arlan_sysctl_info161719,
+	},
+	{
+		.ctl_name	= 154,
+		.procname	= "arlan3-shm-cpy",
+		.data		= &arlan_drive_info,
+		.maxlen		= ARLAN_STR_SIZE,
+		.mode		= 0400,
+		.proc_handler	= &arlan_sysctl_info,
+	},
+#endif
+	{
+		.ctl_name	= 155,
+		.procname	= "config3",
+		.data		= &conf_reset_result,
+		.maxlen		= 100,
+		.mode		= 0400,
+		.proc_handler	= &arlan_configure,
+	},
+	{
+		.ctl_name	= 156,
+		.procname	= "reset3",
+		.data		= &conf_reset_result,
+		.maxlen		= 100,
+		.mode		= 0400,
+		.proc_handler	= &arlan_sysctl_reset,
+	},
+	{ .ctl_name = 0 }
+};
+
+
+
+static ctl_table arlan_table[] =
+{
+	{
+		.ctl_name	= 0,
+		.procname	= "arlan0",
+		.maxlen		= 0,
+		.mode		= 0600,
+		.child		= arlan_conf_table0,
+	},
+	{
+		.ctl_name	= 0,
+		.procname	= "arlan1",
+		.maxlen		= 0,
+		.mode		= 0600,
+		.child		= arlan_conf_table1,
+	},
+	{
+		.ctl_name	= 0,
+		.procname	= "arlan2",
+		.maxlen		= 0,
+		.mode		= 0600,
+		.child		= arlan_conf_table2,
+	},
+	{
+		.ctl_name	= 0,
+		.procname	= "arlan3",
+		.maxlen		= 0,
+		.mode		= 0600,
+		.child		= arlan_conf_table3,
+	},
+	{ .ctl_name = 0 }
+};
+
+#else
+
+static ctl_table arlan_table[MAX_ARLANS + 1] =
+{
+	{ .ctl_name = 0 }
+};
+#endif
+#else
+
+static ctl_table arlan_table[MAX_ARLANS + 1] =
+{
+	{ .ctl_name = 0 }
+};
+#endif
+
+
+// static int mmtu = 1234;
+
+static ctl_table arlan_root_table[] =
+{
+	{
+		.ctl_name	= 254,
+		.procname	= "arlan",
+		.maxlen		= 0,
+		.mode		= 0555,
+		.child		= arlan_table,
+	},
+	{ .ctl_name = 0 }
+};
+
+/* Make sure that /proc/sys/dev is there */
+//static ctl_table arlan_device_root_table[] =
+//{
+//	{CTL_DEV, "dev", NULL, 0, 0555, arlan_root_table},
+//	{0}
+//};
+
+
+#ifdef CONFIG_PROC_FS
+static struct ctl_table_header *arlan_device_sysctl_header;
+
+int __init init_arlan_proc(void)
+{
+
+	int i = 0;
+	if (arlan_device_sysctl_header)
+		return 0;
+	for (i = 0; i < MAX_ARLANS && arlan_device[i]; i++)
+		arlan_table[i].ctl_name = i + 1;
+	arlan_device_sysctl_header = register_sysctl_table(arlan_root_table, 0);
+	if (!arlan_device_sysctl_header)
+		return -1;
+
+	return 0;
+
+}
+
+void __exit cleanup_arlan_proc(void)
+{
+	unregister_sysctl_table(arlan_device_sysctl_header);
+	arlan_device_sysctl_header = NULL;
+
+}
+#endif
diff --git a/drivers/net/wireless/arlan.h b/drivers/net/wireless/arlan.h
new file mode 100644
index 0000000..70a6d7b
--- /dev/null
+++ b/drivers/net/wireless/arlan.h
@@ -0,0 +1,541 @@
+/*
+ *  Copyright (C) 1997 Cullen Jennings
+ *  Copyright (C) 1998 Elmer.Joandi@ut.ee, +37-255-13500	
+ *  GNU General Public License applies
+ */
+
+#include <linux/module.h>
+#include <linux/config.h>
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/skbuff.h>
+#include <linux/if_ether.h>	/* For the statistics structure. */
+#include <linux/if_arp.h>	/* For ARPHRD_ETHER */
+#include <linux/ptrace.h>
+#include <linux/ioport.h>
+#include <linux/in.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/timer.h>
+
+#include <linux/init.h>
+#include <linux/bitops.h>
+#include <asm/system.h>
+#include <asm/io.h>
+#include <linux/errno.h>
+#include <linux/delay.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+
+
+//#define ARLAN_DEBUGGING 1
+
+#define ARLAN_PROC_INTERFACE
+#define MAX_ARLANS 4 /* not more than 4 ! */
+#define ARLAN_PROC_SHM_DUMP /* shows all card registers, makes driver way larger */
+
+#define ARLAN_MAX_MULTICAST_ADDRS 16
+#define ARLAN_RCV_CLEAN 	0
+#define ARLAN_RCV_PROMISC 1
+#define ARLAN_RCV_CONTROL 2
+
+#ifdef CONFIG_PROC_FS
+extern int init_arlan_proc(void);
+extern void cleanup_arlan_proc(void);
+#else
+#define init_arlan_proc()	({ 0; })
+#define cleanup_arlan_proc()	do { } while (0)
+#endif
+
+extern struct net_device *arlan_device[MAX_ARLANS];
+extern int	arlan_debug;
+extern int	arlan_entry_debug;
+extern int	arlan_exit_debug;
+extern int	testMemory;
+extern int     arlan_command(struct net_device * dev, int command);
+ 
+#define SIDUNKNOWN -1
+#define radioNodeIdUNKNOWN -1
+#define irqUNKNOWN 0
+#define debugUNKNOWN 0
+#define testMemoryUNKNOWN 1
+#define spreadingCodeUNKNOWN 0
+#define channelNumberUNKNOWN 0
+#define channelSetUNKNOWN 0
+#define systemIdUNKNOWN -1
+#define registrationModeUNKNOWN -1
+
+
+#define IFDEBUG( L ) if ( (L) & arlan_debug ) 
+#define ARLAN_FAKE_HDR_LEN 12 
+
+#ifdef ARLAN_DEBUGGING
+	#define DEBUG 1
+	#define ARLAN_ENTRY_EXIT_DEBUGGING 1
+	#define ARLAN_DEBUG(a,b) printk(KERN_DEBUG a, b)
+#else
+	#define ARLAN_DEBUG(a,b) 
+#endif
+
+#define ARLAN_SHMEM_SIZE	0x2000
+
+struct arlan_shmem
+{
+      /* Header Signature */ 
+      volatile	char textRegion[48];
+      volatile	u_char resetFlag;
+      volatile	u_char  diagnosticInfo;
+      volatile	u_short diagnosticOffset;
+      volatile	u_char _1[12];
+      volatile	u_char lanCardNodeId[6];
+      volatile	u_char broadcastAddress[6];
+      volatile	u_char hardwareType;
+      volatile	u_char majorHardwareVersion;
+      volatile	u_char minorHardwareVersion;
+      volatile	u_char radioModule;// shows EEPROM, can be overridden at 0x111
+      volatile	u_char defaultChannelSet; // shows EEProm, can be overriiden at 0x10A
+      volatile	u_char _2[47];
+      
+      /* Control/Status Block - 0x0080 */
+      volatile	u_char interruptInProgress; /* not used by lancpu */
+      volatile	u_char cntrlRegImage; /* not used by lancpu */
+      volatile	u_char _3[13];
+      volatile	u_char dumpByte;
+      volatile	u_char commandByte; /* non-zero = active */
+      volatile	u_char commandParameter[15];
+
+      /* Receive Status - 0x00a0 */
+      volatile	u_char rxStatus; /* 1- data, 2-control, 0xff - registr change */
+      volatile	u_char rxFrmType;
+      volatile	u_short rxOffset;
+      volatile	u_short rxLength;
+      volatile	u_char rxSrc[6];
+      volatile	u_char rxBroadcastFlag;
+      volatile	u_char rxQuality;
+      volatile	u_char scrambled;
+      volatile	u_char _4[1];
+      
+      /* Transmit Status - 0x00b0 */
+      volatile	u_char txStatus;
+      volatile	u_char txAckQuality;
+      volatile	u_char numRetries;
+      volatile	u_char _5[14];
+      volatile	u_char registeredRouter[6];
+      volatile	u_char backboneRouter[6];
+      volatile	u_char registrationStatus;
+      volatile	u_char configuredStatusFlag;
+      volatile	u_char _6[1];
+      volatile	u_char ultimateDestAddress[6];
+      volatile	u_char immedDestAddress[6];
+      volatile	u_char immedSrcAddress[6];
+      volatile	u_short rxSequenceNumber;
+      volatile	u_char assignedLocaltalkAddress;
+      volatile	u_char _7[27];
+
+      /* System Parameter Block */
+
+      /* - Driver Parameters (Novell Specific) */
+
+      volatile	u_short txTimeout;
+      volatile	u_short transportTime;
+      volatile	u_char _8[4];
+
+      /* - Configuration Parameters */
+      volatile	u_char irqLevel;
+      volatile	u_char spreadingCode;
+      volatile	u_char channelSet;
+      volatile	u_char channelNumber;
+      volatile	u_short radioNodeId;
+      volatile	u_char _9[2];
+      volatile	u_char scramblingDisable;
+      volatile	u_char radioType;
+      volatile	u_short routerId;
+      volatile	u_char _10[9];
+      volatile	u_char txAttenuation;
+      volatile	u_char systemId[4]; 
+      volatile	u_short globalChecksum;
+      volatile	u_char _11[4];
+      volatile	u_short maxDatagramSize;
+      volatile	u_short maxFrameSize;
+      volatile	u_char maxRetries;
+      volatile	u_char receiveMode;
+      volatile	u_char priority;
+      volatile	u_char rootOrRepeater;
+      volatile	u_char specifiedRouter[6];
+      volatile	u_short fastPollPeriod;
+      volatile	u_char pollDecay;
+      volatile	u_char fastPollDelay[2];
+      volatile	u_char arlThreshold;
+      volatile	u_char arlDecay;
+      volatile	u_char _12[1];
+      volatile	u_short specRouterTimeout;
+      volatile	u_char _13[5];
+
+      /* Scrambled Area */
+      volatile	u_char SID[4];
+      volatile	u_char encryptionKey[12];
+      volatile	u_char _14[2];
+      volatile	u_char waitTime[2];
+      volatile	u_char lParameter[2];
+      volatile	u_char _15[3];
+      volatile	u_short headerSize;
+      volatile	u_short sectionChecksum;
+
+      volatile	u_char registrationMode;
+      volatile	u_char registrationFill;
+      volatile	u_short pollPeriod;
+      volatile	u_short refreshPeriod;
+      volatile	u_char name[16];
+      volatile	u_char NID[6];
+      volatile	u_char localTalkAddress;
+      volatile	u_char codeFormat;
+      volatile	u_char numChannels;
+      volatile	u_char channel1;
+      volatile	u_char channel2;
+      volatile	u_char channel3;
+      volatile	u_char channel4;
+      volatile	u_char SSCode[59];
+
+      volatile	u_char _16[0xC0];
+      volatile	u_short auxCmd;
+      volatile	u_char  dumpPtr[4];
+      volatile	u_char dumpVal;
+      volatile	u_char _17[0x6A];
+      volatile	u_char wireTest;
+      volatile	u_char _18[14];
+
+      /* Statistics Block - 0x0300 */
+      volatile	u_char hostcpuLock;
+      volatile	u_char lancpuLock;
+      volatile	u_char resetTime[18];
+      
+      volatile	u_char numDatagramsTransmitted[4];
+      volatile	u_char numReTransmissions[4];
+      volatile	u_char numFramesDiscarded[4];
+      volatile	u_char numDatagramsReceived[4];
+      volatile	u_char numDuplicateReceivedFrames[4];
+      volatile	u_char numDatagramsDiscarded[4];
+      
+      volatile	u_short maxNumReTransmitDatagram;
+      volatile	u_short maxNumReTransmitFrames;
+      volatile	u_short maxNumConsecutiveDuplicateFrames;
+      /* misaligned here so we have to go to characters */
+     
+      volatile	u_char numBytesTransmitted[4];
+      volatile	u_char numBytesReceived[4];
+      volatile	u_char numCRCErrors[4];
+      volatile	u_char numLengthErrors[4];
+      volatile	u_char numAbortErrors[4];
+      volatile	u_char numTXUnderruns[4];
+      volatile	u_char numRXOverruns[4];
+      volatile	u_char numHoldOffs[4];
+      volatile	u_char numFramesTransmitted[4];
+      volatile	u_char numFramesReceived[4];
+      volatile	u_char numReceiveFramesLost[4];
+      volatile	u_char numRXBufferOverflows[4];
+      volatile	u_char numFramesDiscardedAddrMismatch[4];
+      volatile	u_char numFramesDiscardedSIDMismatch[4];
+      volatile	u_char numPollsTransmistted[4];
+      volatile	u_char numPollAcknowledges[4];
+      volatile	u_char numStatusTimeouts[4];
+      volatile	u_char numNACKReceived[4];
+
+      volatile	u_char _19[0x86];
+
+      volatile	u_char txBuffer[0x800];
+      volatile	u_char rxBuffer[0x800];
+
+      volatile	u_char _20[0x800];
+      volatile	u_char _21[0x3fb];
+      volatile	u_char configStatus;
+      volatile	u_char _22;
+      volatile	u_char progIOCtrl;
+      volatile	u_char shareMBase;
+      volatile	u_char controlRegister;
+};
+
+struct arlan_conf_stru {
+      int spreadingCode;
+      int channelSet;
+      int channelNumber;
+      int scramblingDisable;
+      int txAttenuation;
+      int systemId; 
+      int maxDatagramSize;
+      int maxFrameSize;
+      int maxRetries;
+      int receiveMode;
+      int priority;
+      int rootOrRepeater;
+      int SID;
+      int radioNodeId;
+      int registrationMode;
+      int registrationFill;
+      int localTalkAddress;
+      int codeFormat;
+      int numChannels;
+      int channel1;
+      int channel2;
+      int channel3;
+      int channel4;
+      int txClear;
+      int txRetries;
+      int txRouting;
+      int txScrambled;
+      int rxParameter;
+      int txTimeoutMs;
+      int txAckTimeoutMs;
+      int waitCardTimeout;
+      int	waitTime;
+      int	lParameter;
+      int	_15;
+      int	headerSize;
+      int retries;
+      int tx_delay_ms;
+      int waitReTransmitPacketMaxSize;
+      int ReTransmitPacketMaxSize;
+      int fastReTransCount;
+      int driverRetransmissions;
+      int registrationInterrupts;
+      int hardwareType;
+      int radioType;
+      int writeRadioType;
+      int writeEEPROM;
+      char siteName[17];
+      int measure_rate;
+      int in_speed;
+      int out_speed;
+      int in_speed10;
+      int out_speed10;
+      int in_speed_max;
+      int out_speed_max;
+      int pre_Command_Wait;
+      int rx_tweak1;
+      int rx_tweak2;
+      int tx_queue_len;
+};
+
+extern struct arlan_conf_stru arlan_conf[MAX_ARLANS];
+
+struct TxParam
+{
+      volatile	short 		offset;
+      volatile 	short 		length;
+      volatile	u_char 		dest[6];
+      volatile	unsigned	char clear;
+      volatile	unsigned	char retries;
+      volatile	unsigned	char routing;
+      volatile	unsigned	char scrambled;
+};
+
+#define TX_RING_SIZE 2
+/* Information that need to be kept for each board. */
+struct arlan_private {
+      struct net_device_stats stats;
+      struct arlan_shmem __iomem * card;
+      struct arlan_shmem * conf;
+
+      struct arlan_conf_stru * Conf;	     
+      int	bad;
+      int 	reset;
+      unsigned long lastReset;
+      struct timer_list timer;
+      struct timer_list tx_delay_timer;
+      struct timer_list tx_retry_timer;
+      struct timer_list rx_check_timer;
+
+      int registrationLostCount;
+      int reRegisterExp;
+      int irq_test_done;
+
+      struct TxParam txRing[TX_RING_SIZE];
+      char reTransmitBuff[0x800];
+      int txLast;
+      unsigned ReTransmitRequested;
+      unsigned long tx_done_delayed;
+      unsigned long registrationLastSeen;
+
+      unsigned long	tx_last_sent;
+      unsigned long	tx_last_cleared;
+      unsigned long	retransmissions;
+      unsigned long 	interrupt_ack_requested;
+      spinlock_t	lock;
+      unsigned long	waiting_command_mask;
+      unsigned long 	card_polling_interval;
+      unsigned long 	last_command_buff_free_time;
+
+      int 		under_reset;
+      int 		under_config;
+      int 		rx_command_given;
+      int	 	tx_command_given;
+      unsigned  long	interrupt_processing_active;
+      unsigned long	last_rx_int_ack_time;
+      unsigned long	in_bytes;
+      unsigned long 	out_bytes;
+      unsigned long	in_time;
+      unsigned long	out_time;
+      unsigned long	in_time10;
+      unsigned long	out_time10;
+      unsigned long	in_bytes10;
+      unsigned long 	out_bytes10;
+      int	init_etherdev_alloc;
+};
+
+
+
+#define ARLAN_CLEAR		0x00
+#define ARLAN_RESET 		0x01
+#define ARLAN_CHANNEL_ATTENTION 0x02
+#define ARLAN_INTERRUPT_ENABLE 	0x04
+#define ARLAN_CLEAR_INTERRUPT 	0x08
+#define ARLAN_POWER 		0x40
+#define ARLAN_ACCESS		0x80
+
+#define ARLAN_COM_CONF                0x01
+#define ARLAN_COM_RX_ENABLE           0x03
+#define ARLAN_COM_RX_ABORT            0x04
+#define ARLAN_COM_TX_ENABLE           0x05
+#define ARLAN_COM_TX_ABORT            0x06
+#define ARLAN_COM_NOP		      0x07
+#define ARLAN_COM_STANDBY             0x08
+#define ARLAN_COM_ACTIVATE            0x09
+#define ARLAN_COM_GOTO_SLOW_POLL      0x0a
+#define ARLAN_COM_INT                 0x80
+
+
+#define TXLAST(dev) (((struct arlan_private *)netdev_priv(dev))->txRing[((struct arlan_private *)netdev_priv(dev))->txLast])
+#define TXHEAD(dev) (((struct arlan_private *)netdev_priv(dev))->txRing[0])
+#define TXTAIL(dev) (((struct arlan_private *)netdev_priv(dev))->txRing[1])
+
+#define TXBuffStart(dev) offsetof(struct arlan_shmem, txBuffer)
+#define TXBuffEnd(dev) offsetof(struct arlan_shmem, xxBuffer)
+ 
+#define READSHM(to,from,atype) {\
+	atype tmp;\
+	memcpy_fromio(&(tmp),&(from),sizeof(atype));\
+	to = tmp;\
+	}
+
+#define READSHMEM(from,atype)\
+	atype from; \
+	READSHM(from, arlan->from, atype);
+
+#define WRITESHM(to,from,atype) \
+	{ atype tmpSHM = from;\
+	memcpy_toio(&(to),&tmpSHM,sizeof(atype));\
+	}
+
+#define DEBUGSHM(levelSHM,stringSHM,stuff,atype) \
+	{	atype tmpSHM; \
+		memcpy_fromio(&tmpSHM,&(stuff),sizeof(atype));\
+		IFDEBUG(levelSHM) printk(stringSHM,tmpSHM);\
+	}
+
+#define WRITESHMB(to, val) \
+	writeb(val,&(to))
+#define READSHMB(to) \
+	readb(&(to))
+#define WRITESHMS(to, val) \
+	writew(val,&(to))
+#define READSHMS(to) \
+	readw(&(to))
+#define WRITESHMI(to, val) \
+	writel(val,&(to))
+#define READSHMI(to) \
+	readl(&(to))
+
+
+
+
+
+#define registrationBad(dev)\
+   ( (   READSHMB(((struct arlan_private *)netdev_priv(dev))->card->registrationMode)    > 0) && \
+     (   READSHMB(((struct arlan_private *)netdev_priv(dev))->card->registrationStatus) == 0)    )
+
+
+#define readControlRegister(dev)\
+ 	READSHMB(((struct arlan_private *)netdev_priv(dev))->card->cntrlRegImage)
+
+#define writeControlRegister(dev, v){\
+   WRITESHMB(((struct arlan_private *)netdev_priv(dev))->card->cntrlRegImage	,((v) &0xF) );\
+   WRITESHMB(((struct arlan_private *)netdev_priv(dev))->card->controlRegister	,(v) 	);}
+
+
+#define arlan_interrupt_lancpu(dev) {\
+   int cr;   \
+   \
+   cr = readControlRegister(dev);\
+   if (cr & ARLAN_CHANNEL_ATTENTION){ \
+      writeControlRegister(dev, (cr & ~ARLAN_CHANNEL_ATTENTION));\
+   }else  \
+      writeControlRegister(dev, (cr | ARLAN_CHANNEL_ATTENTION));\
+}
+
+#define clearChannelAttention(dev){ \
+   writeControlRegister(dev,readControlRegister(dev) & ~ARLAN_CHANNEL_ATTENTION);}
+#define setHardwareReset(dev) {\
+   writeControlRegister(dev,readControlRegister(dev) | ARLAN_RESET);}
+#define clearHardwareReset(dev) {\
+   writeControlRegister(dev,readControlRegister(dev) & ~ARLAN_RESET);}
+#define setInterruptEnable(dev){\
+   writeControlRegister(dev,readControlRegister(dev) | ARLAN_INTERRUPT_ENABLE)  ;}
+#define clearInterruptEnable(dev){\
+   writeControlRegister(dev,readControlRegister(dev) & ~ARLAN_INTERRUPT_ENABLE)  ;}
+#define setClearInterrupt(dev){\
+   writeControlRegister(dev,readControlRegister(dev) | ARLAN_CLEAR_INTERRUPT)   ;}
+#define clearClearInterrupt(dev){\
+   writeControlRegister(dev,readControlRegister(dev) & ~ARLAN_CLEAR_INTERRUPT);}
+#define setPowerOff(dev){\
+   writeControlRegister(dev,readControlRegister(dev) | (ARLAN_POWER && ARLAN_ACCESS));\
+   writeControlRegister(dev,readControlRegister(dev) & ~ARLAN_ACCESS);}
+#define setPowerOn(dev){\
+   writeControlRegister(dev,readControlRegister(dev) & ~(ARLAN_POWER));   }
+#define arlan_lock_card_access(dev){\
+   writeControlRegister(dev,readControlRegister(dev) & ~ARLAN_ACCESS);}
+#define arlan_unlock_card_access(dev){\
+   writeControlRegister(dev,readControlRegister(dev) | ARLAN_ACCESS ); }  
+
+
+
+
+#define ARLAN_COMMAND_RX		0x000001
+#define ARLAN_COMMAND_NOOP		0x000002
+#define ARLAN_COMMAND_NOOPINT		0x000004
+#define ARLAN_COMMAND_TX		0x000008
+#define ARLAN_COMMAND_CONF		0x000010
+#define ARLAN_COMMAND_RESET		0x000020
+#define ARLAN_COMMAND_TX_ABORT		0x000040
+#define ARLAN_COMMAND_RX_ABORT		0x000080
+#define ARLAN_COMMAND_POWERDOWN		0x000100
+#define ARLAN_COMMAND_POWERUP		0x000200
+#define ARLAN_COMMAND_SLOW_POLL 	0x000400
+#define ARLAN_COMMAND_ACTIVATE 		0x000800
+#define ARLAN_COMMAND_INT_ACK		0x001000
+#define ARLAN_COMMAND_INT_ENABLE	0x002000
+#define ARLAN_COMMAND_WAIT_NOW		0x004000
+#define ARLAN_COMMAND_LONG_WAIT_NOW	0x008000
+#define ARLAN_COMMAND_STANDBY		0x010000
+#define ARLAN_COMMAND_INT_RACK		0x020000
+#define ARLAN_COMMAND_INT_RENABLE	0x040000
+#define ARLAN_COMMAND_CONF_WAIT		0x080000
+#define ARLAN_COMMAND_TBUSY_CLEAR	0x100000
+#define ARLAN_COMMAND_CLEAN_AND_CONF	(ARLAN_COMMAND_TX_ABORT\
+					| ARLAN_COMMAND_RX_ABORT\
+					| ARLAN_COMMAND_CONF)
+#define ARLAN_COMMAND_CLEAN_AND_RESET   (ARLAN_COMMAND_TX_ABORT\
+					| ARLAN_COMMAND_RX_ABORT\
+					| ARLAN_COMMAND_RESET)
+
+
+ 
+#define ARLAN_DEBUG_CHAIN_LOCKS		0x00001
+#define ARLAN_DEBUG_RESET		0x00002
+#define ARLAN_DEBUG_TIMING		0x00004
+#define ARLAN_DEBUG_CARD_STATE		0x00008
+#define ARLAN_DEBUG_TX_CHAIN		0x00010
+#define ARLAN_DEBUG_MULTICAST		0x00020
+#define ARLAN_DEBUG_HEADER_DUMP		0x00040
+#define ARLAN_DEBUG_INTERRUPT		0x00080
+#define ARLAN_DEBUG_STARTUP		0x00100
+#define ARLAN_DEBUG_SHUTDOWN		0x00200
+ 
diff --git a/drivers/net/wireless/atmel.c b/drivers/net/wireless/atmel.c
new file mode 100644
index 0000000..18a7d38
--- /dev/null
+++ b/drivers/net/wireless/atmel.c
@@ -0,0 +1,4272 @@
+/*** -*- linux-c -*- **********************************************************
+
+     Driver for Atmel at76c502 at76c504 and at76c506 wireless cards.
+
+        Copyright 2000-2001 ATMEL Corporation.
+        Copyright 2003-2004 Simon Kelley.
+
+    This code was developed from version 2.1.1 of the Atmel drivers, 
+    released by Atmel corp. under the GPL in December 2002. It also 
+    includes code from the Linux aironet drivers (C) Benjamin Reed, 
+    and the Linux PCMCIA package, (C) David Hinds and the Linux wireless
+    extensions, (C) Jean Tourrilhes.
+
+    The firmware module for reading the MAC address of the card comes from
+    net.russotto.AtmelMACFW, written by Matthew T. Russotto and copyright
+    by him. net.russotto.AtmelMACFW is used under the GPL license version 2.
+    This file contains the module in binary form and, under the terms
+    of the GPL, in source form. The source is located at the end of the file.
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This software is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with Atmel wireless lan drivers; if not, write to the Free Software
+    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+    For all queries about this code, please contact the current author, 
+    Simon Kelley <simon@thekelleys.org.uk> and not Atmel Corporation.
+
+    Credit is due to HP UK and Cambridge Online Systems Ltd for supplying
+    hardware used during development of this driver.
+
+******************************************************************************/
+
+#include <linux/config.h>
+#include <linux/init.h>
+
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/ptrace.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/ctype.h>
+#include <linux/timer.h>
+#include <asm/io.h>
+#include <asm/system.h>
+#include <asm/uaccess.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/skbuff.h>
+#include <linux/if_arp.h>
+#include <linux/ioport.h>
+#include <linux/fcntl.h>
+#include <linux/delay.h>
+#include <linux/wireless.h>
+#include <net/iw_handler.h>
+#include <linux/byteorder/generic.h>
+#include <linux/crc32.h>
+#include <linux/proc_fs.h>
+#include <linux/device.h>
+#include <linux/moduleparam.h>
+#include <linux/firmware.h>
+#include "ieee802_11.h"
+#include "atmel.h"
+
+#define DRIVER_MAJOR 0
+#define DRIVER_MINOR 96
+
+MODULE_AUTHOR("Simon Kelley");
+MODULE_DESCRIPTION("Support for Atmel at76c50x 802.11 wireless ethernet cards.");
+MODULE_LICENSE("GPL");
+MODULE_SUPPORTED_DEVICE("Atmel at76c50x wireless cards");
+
+/* The name of the firmware file to be loaded 
+   over-rides any automatic selection */
+static char *firmware = NULL;
+module_param(firmware, charp, 0);
+
+/* table of firmware file names */
+static struct { 
+	AtmelFWType fw_type;
+	const char *fw_file;
+	const char *fw_file_ext;
+} fw_table[] = {
+	{ ATMEL_FW_TYPE_502,      "atmel_at76c502",      "bin" },
+	{ ATMEL_FW_TYPE_502D,     "atmel_at76c502d",     "bin" },
+	{ ATMEL_FW_TYPE_502E,     "atmel_at76c502e",     "bin" },
+	{ ATMEL_FW_TYPE_502_3COM, "atmel_at76c502_3com", "bin" },
+	{ ATMEL_FW_TYPE_504,      "atmel_at76c504",      "bin" },
+	{ ATMEL_FW_TYPE_504_2958, "atmel_at76c504_2958", "bin" },
+	{ ATMEL_FW_TYPE_504A_2958,"atmel_at76c504a_2958","bin" },
+	{ ATMEL_FW_TYPE_506,      "atmel_at76c506",      "bin" },
+	{ ATMEL_FW_TYPE_NONE,      NULL,                  NULL }
+};
+
+#define MAX_SSID_LENGTH 32
+#define MGMT_JIFFIES (256 * HZ / 100)
+
+#define MAX_BSS_ENTRIES	64	
+
+/* registers */
+#define GCR  0x00    //      (SIR0)  General Configuration Register        
+#define BSR  0x02    //      (SIR1)  Bank Switching Select Register 
+#define AR   0x04
+#define DR   0x08
+#define MR1  0x12    //      Mirror Register 1                  
+#define MR2  0x14    //      Mirror Register 2  
+#define MR3  0x16    //      Mirror Register 3  
+#define MR4  0x18    //      Mirror Register 4   
+
+#define GPR1                            0x0c
+#define GPR2                            0x0e
+#define GPR3                            0x10
+//
+// Constants for the GCR register.
+//
+#define GCR_REMAP     0x0400          // Remap internal SRAM to 0
+#define GCR_SWRES     0x0080          // BIU reset (ARM and PAI are NOT reset) 
+#define GCR_CORES     0x0060          // Core Reset (ARM and PAI are reset)
+#define GCR_ENINT     0x0002          // Enable Interrupts    
+#define GCR_ACKINT    0x0008          // Acknowledge Interrupts
+
+#define BSS_SRAM      0x0200          // AMBA module selection --> SRAM
+#define BSS_IRAM      0x0100          // AMBA module selection --> IRAM
+//
+// Constants for the MR registers.
+//
+#define MAC_INIT_COMPLETE       0x0001        // MAC init has been completed
+#define MAC_BOOT_COMPLETE       0x0010        // MAC boot has been completed
+#define MAC_INIT_OK             0x0002        // MAC boot has been completed
+
+#define C80211_SUBTYPE_MGMT_ASS_REQUEST                 0x00
+#define C80211_SUBTYPE_MGMT_ASS_RESPONSE                0x10
+#define C80211_SUBTYPE_MGMT_REASS_REQUEST               0x20
+#define C80211_SUBTYPE_MGMT_REASS_RESPONSE              0x30
+#define C80211_SUBTYPE_MGMT_ProbeRequest                0x40
+#define C80211_SUBTYPE_MGMT_ProbeResponse               0x50
+#define C80211_SUBTYPE_MGMT_BEACON                      0x80
+#define C80211_SUBTYPE_MGMT_ATIM                        0x90
+#define C80211_SUBTYPE_MGMT_DISASSOSIATION              0xA0
+#define C80211_SUBTYPE_MGMT_Authentication              0xB0
+#define C80211_SUBTYPE_MGMT_Deauthentication    0xC0
+
+#define C80211_MGMT_AAN_OPENSYSTEM              0x0000
+#define C80211_MGMT_AAN_SHAREDKEY               0x0001
+
+#define C80211_MGMT_CAPABILITY_ESS              0x0001  // see 802.11 p.58
+#define C80211_MGMT_CAPABILITY_IBSS             0x0002  //      - " -
+#define C80211_MGMT_CAPABILITY_CFPollable       0x0004  //      - " -
+#define C80211_MGMT_CAPABILITY_CFPollRequest    0x0008  //      - " -
+#define C80211_MGMT_CAPABILITY_Privacy          0x0010  //      - " -
+
+#define C80211_MGMT_SC_Success                  0
+#define C80211_MGMT_SC_Unspecified              1
+#define C80211_MGMT_SC_SupportCapabilities      10
+#define C80211_MGMT_SC_ReassDenied              11
+#define C80211_MGMT_SC_AssDenied                12
+#define C80211_MGMT_SC_AuthAlgNotSupported      13
+#define C80211_MGMT_SC_AuthTransSeqNumError     14
+#define C80211_MGMT_SC_AuthRejectChallenge      15
+#define C80211_MGMT_SC_AuthRejectTimeout        16
+#define C80211_MGMT_SC_AssDeniedHandleAP        17
+#define C80211_MGMT_SC_AssDeniedBSSRate         18
+
+#define C80211_MGMT_ElementID_SSID              0
+#define C80211_MGMT_ElementID_SupportedRates    1
+#define C80211_MGMT_ElementID_ChallengeText     16
+#define C80211_MGMT_CAPABILITY_ShortPreamble    0x0020
+
+#define MIB_MAX_DATA_BYTES    212
+#define MIB_HEADER_SIZE       4    /* first four fields */
+
+struct get_set_mib {
+        u8 type;
+        u8 size;
+        u8 index;
+        u8 reserved;
+        u8 data[MIB_MAX_DATA_BYTES];
+};
+
+struct rx_desc {
+        u32          Next;
+        u16          MsduPos;
+        u16          MsduSize;
+	
+        u8           State;
+        u8           Status;
+        u8           Rate;
+        u8           Rssi;
+        u8           LinkQuality;
+        u8           PreambleType;
+        u16          Duration;
+        u32          RxTime;
+
+};
+
+#define RX_DESC_FLAG_VALID       0x80
+#define RX_DESC_FLAG_CONSUMED    0x40
+#define RX_DESC_FLAG_IDLE        0x00
+
+#define RX_STATUS_SUCCESS        0x00
+
+#define RX_DESC_MSDU_POS_OFFSET      4
+#define RX_DESC_MSDU_SIZE_OFFSET     6
+#define RX_DESC_FLAGS_OFFSET         8
+#define RX_DESC_STATUS_OFFSET        9
+#define RX_DESC_RSSI_OFFSET          11
+#define RX_DESC_LINK_QUALITY_OFFSET  12
+#define RX_DESC_PREAMBLE_TYPE_OFFSET 13
+#define RX_DESC_DURATION_OFFSET      14
+#define RX_DESC_RX_TIME_OFFSET       16
+
+
+struct tx_desc {
+	u32       NextDescriptor;
+	u16       TxStartOfFrame;
+	u16       TxLength;
+	
+	u8        TxState;
+	u8        TxStatus;
+	u8        RetryCount;
+	
+	u8        TxRate;
+
+	u8        KeyIndex;
+	u8        ChiperType;
+	u8        ChipreLength;
+        u8        Reserved1;
+
+	u8        Reserved;
+	u8        PacketType;
+	u16       HostTxLength;
+	
+};
+
+
+#define TX_DESC_NEXT_OFFSET          0
+#define TX_DESC_POS_OFFSET           4
+#define TX_DESC_SIZE_OFFSET          6
+#define TX_DESC_FLAGS_OFFSET         8
+#define TX_DESC_STATUS_OFFSET        9
+#define TX_DESC_RETRY_OFFSET         10
+#define TX_DESC_RATE_OFFSET          11
+#define TX_DESC_KEY_INDEX_OFFSET     12
+#define TX_DESC_CIPHER_TYPE_OFFSET   13
+#define TX_DESC_CIPHER_LENGTH_OFFSET 14
+#define TX_DESC_PACKET_TYPE_OFFSET   17
+#define TX_DESC_HOST_LENGTH_OFFSET   18
+
+
+
+///////////////////////////////////////////////////////
+// Host-MAC interface
+///////////////////////////////////////////////////////
+
+#define TX_STATUS_SUCCESS       0x00
+
+#define TX_FIRM_OWN             0x80
+#define TX_DONE                 0x40
+
+
+#define TX_ERROR                0x01
+
+#define TX_PACKET_TYPE_DATA     0x01
+#define TX_PACKET_TYPE_MGMT     0x02
+
+#define ISR_EMPTY               0x00        // no bits set in ISR
+#define ISR_TxCOMPLETE          0x01        // packet transmitted
+#define ISR_RxCOMPLETE          0x02        // packet received
+#define ISR_RxFRAMELOST         0x04        // Rx Frame lost
+#define ISR_FATAL_ERROR         0x08        // Fatal error
+#define ISR_COMMAND_COMPLETE    0x10        // command completed
+#define ISR_OUT_OF_RANGE        0x20        // command completed
+#define ISR_IBSS_MERGE          0x40        // (4.1.2.30): IBSS merge
+#define ISR_GENERIC_IRQ         0x80                
+
+
+#define Local_Mib_Type          0x01
+#define Mac_Address_Mib_Type    0x02
+#define Mac_Mib_Type            0x03
+#define Statistics_Mib_Type     0x04
+#define Mac_Mgmt_Mib_Type       0x05
+#define Mac_Wep_Mib_Type        0x06
+#define Phy_Mib_Type            0x07
+#define Multi_Domain_MIB        0x08
+
+#define MAC_MGMT_MIB_CUR_BSSID_POS            14
+#define MAC_MIB_FRAG_THRESHOLD_POS            8
+#define MAC_MIB_RTS_THRESHOLD_POS             10
+#define MAC_MIB_SHORT_RETRY_POS               16
+#define MAC_MIB_LONG_RETRY_POS                17
+#define MAC_MIB_SHORT_RETRY_LIMIT_POS         16
+#define MAC_MGMT_MIB_BEACON_PER_POS           0
+#define MAC_MGMT_MIB_STATION_ID_POS           6
+#define MAC_MGMT_MIB_CUR_PRIVACY_POS          11
+#define MAC_MGMT_MIB_CUR_BSSID_POS            14
+#define MAC_MGMT_MIB_PS_MODE_POS              53
+#define MAC_MGMT_MIB_LISTEN_INTERVAL_POS      54
+#define MAC_MGMT_MIB_MULTI_DOMAIN_IMPLEMENTED 56
+#define MAC_MGMT_MIB_MULTI_DOMAIN_ENABLED     57
+#define PHY_MIB_CHANNEL_POS                   14
+#define PHY_MIB_RATE_SET_POS                  20
+#define PHY_MIB_REG_DOMAIN_POS                26
+#define LOCAL_MIB_AUTO_TX_RATE_POS            3
+#define LOCAL_MIB_SSID_SIZE                   5
+#define LOCAL_MIB_TX_PROMISCUOUS_POS          6
+#define LOCAL_MIB_TX_MGMT_RATE_POS            7
+#define LOCAL_MIB_TX_CONTROL_RATE_POS         8
+#define LOCAL_MIB_PREAMBLE_TYPE               9
+#define MAC_ADDR_MIB_MAC_ADDR_POS             0
+
+
+#define         CMD_Set_MIB_Vars              0x01
+#define         CMD_Get_MIB_Vars              0x02
+#define         CMD_Scan                      0x03
+#define         CMD_Join                      0x04
+#define         CMD_Start                     0x05
+#define         CMD_EnableRadio               0x06
+#define         CMD_DisableRadio              0x07
+#define         CMD_SiteSurvey                0x0B
+
+#define         CMD_STATUS_IDLE                   0x00
+#define         CMD_STATUS_COMPLETE               0x01
+#define         CMD_STATUS_UNKNOWN                0x02
+#define         CMD_STATUS_INVALID_PARAMETER      0x03
+#define         CMD_STATUS_FUNCTION_NOT_SUPPORTED 0x04
+#define         CMD_STATUS_TIME_OUT               0x07
+#define         CMD_STATUS_IN_PROGRESS            0x08
+#define         CMD_STATUS_REJECTED_RADIO_OFF     0x09
+#define         CMD_STATUS_HOST_ERROR             0xFF
+#define         CMD_STATUS_BUSY                   0xFE
+
+
+#define CMD_BLOCK_COMMAND_OFFSET        0
+#define CMD_BLOCK_STATUS_OFFSET         1
+#define CMD_BLOCK_PARAMETERS_OFFSET     4
+
+#define SCAN_OPTIONS_SITE_SURVEY        0x80
+
+#define MGMT_FRAME_BODY_OFFSET		24
+#define MAX_AUTHENTICATION_RETRIES	3
+#define MAX_ASSOCIATION_RETRIES 	3
+
+#define AUTHENTICATION_RESPONSE_TIME_OUT  1000
+
+#define MAX_WIRELESS_BODY  2316 /* mtu is 2312, CRC is 4 */
+#define LOOP_RETRY_LIMIT   500000
+
+#define ACTIVE_MODE 	1
+#define PS_MODE 	2
+
+#define MAX_ENCRYPTION_KEYS 4
+#define MAX_ENCRYPTION_KEY_SIZE 40
+
+///////////////////////////////////////////////////////////////////////////
+// 802.11 related definitions
+///////////////////////////////////////////////////////////////////////////
+
+//
+// Regulatory Domains
+//
+
+#define REG_DOMAIN_FCC		0x10	//Channels	1-11	USA
+#define REG_DOMAIN_DOC		0x20	//Channel	1-11	Canada
+#define REG_DOMAIN_ETSI		0x30	//Channel	1-13	Europe (ex Spain/France)
+#define REG_DOMAIN_SPAIN	0x31	//Channel	10-11	Spain
+#define REG_DOMAIN_FRANCE	0x32	//Channel	10-13	France
+#define REG_DOMAIN_MKK		0x40	//Channel	14	Japan
+#define REG_DOMAIN_MKK1		0x41	//Channel	1-14	Japan(MKK1)
+#define REG_DOMAIN_ISRAEL	0x50	//Channel	3-9	ISRAEL
+
+#define BSS_TYPE_AD_HOC 	1
+#define BSS_TYPE_INFRASTRUCTURE 2
+
+#define SCAN_TYPE_ACTIVE	0
+#define SCAN_TYPE_PASSIVE	1
+
+#define LONG_PREAMBLE		0
+#define SHORT_PREAMBLE		1
+#define AUTO_PREAMBLE		2
+
+#define DATA_FRAME_WS_HEADER_SIZE   30
+
+/* promiscuous mode control */ 
+#define PROM_MODE_OFF			0x0
+#define PROM_MODE_UNKNOWN		0x1
+#define PROM_MODE_CRC_FAILED		0x2
+#define PROM_MODE_DUPLICATED		0x4
+#define PROM_MODE_MGMT			0x8
+#define PROM_MODE_CTRL			0x10
+#define PROM_MODE_BAD_PROTOCOL		0x20
+
+
+#define IFACE_INT_STATUS_OFFSET 	0
+#define IFACE_INT_MASK_OFFSET		1
+#define IFACE_LOCKOUT_HOST_OFFSET	2
+#define IFACE_LOCKOUT_MAC_OFFSET	3
+#define IFACE_FUNC_CTRL_OFFSET		28
+#define IFACE_MAC_STAT_OFFSET		30
+#define IFACE_GENERIC_INT_TYPE_OFFSET	32
+
+#define CIPHER_SUITE_NONE     0 
+#define CIPHER_SUITE_WEP_64   1
+#define CIPHER_SUITE_TKIP     2
+#define CIPHER_SUITE_AES      3
+#define CIPHER_SUITE_CCX      4
+#define CIPHER_SUITE_WEP_128  5
+
+//
+// IFACE MACROS & definitions
+//
+//
+
+// FuncCtrl field: 
+//
+#define FUNC_CTRL_TxENABLE		0x10
+#define FUNC_CTRL_RxENABLE		0x20
+#define FUNC_CTRL_INIT_COMPLETE 	0x01
+
+/* A stub firmware image which reads the MAC address from NVRAM on the card.
+   For copyright information and source see the end of this file. */
+static u8 mac_reader[] = {
+	0x06,0x00,0x00,0xea,0x04,0x00,0x00,0xea,0x03,0x00,0x00,0xea,0x02,0x00,0x00,0xea,
+	0x01,0x00,0x00,0xea,0x00,0x00,0x00,0xea,0xff,0xff,0xff,0xea,0xfe,0xff,0xff,0xea,
+	0xd3,0x00,0xa0,0xe3,0x00,0xf0,0x21,0xe1,0x0e,0x04,0xa0,0xe3,0x00,0x10,0xa0,0xe3,
+	0x81,0x11,0xa0,0xe1,0x00,0x10,0x81,0xe3,0x00,0x10,0x80,0xe5,0x1c,0x10,0x90,0xe5,
+	0x10,0x10,0xc1,0xe3,0x1c,0x10,0x80,0xe5,0x01,0x10,0xa0,0xe3,0x08,0x10,0x80,0xe5,
+	0x02,0x03,0xa0,0xe3,0x00,0x10,0xa0,0xe3,0xb0,0x10,0xc0,0xe1,0xb4,0x10,0xc0,0xe1,
+	0xb8,0x10,0xc0,0xe1,0xbc,0x10,0xc0,0xe1,0x56,0xdc,0xa0,0xe3,0x21,0x00,0x00,0xeb,
+	0x0a,0x00,0xa0,0xe3,0x1a,0x00,0x00,0xeb,0x10,0x00,0x00,0xeb,0x07,0x00,0x00,0xeb,
+	0x02,0x03,0xa0,0xe3,0x02,0x14,0xa0,0xe3,0xb4,0x10,0xc0,0xe1,0x4c,0x10,0x9f,0xe5,
+	0xbc,0x10,0xc0,0xe1,0x10,0x10,0xa0,0xe3,0xb8,0x10,0xc0,0xe1,0xfe,0xff,0xff,0xea,
+	0x00,0x40,0x2d,0xe9,0x00,0x20,0xa0,0xe3,0x02,0x3c,0xa0,0xe3,0x00,0x10,0xa0,0xe3,
+	0x28,0x00,0x9f,0xe5,0x37,0x00,0x00,0xeb,0x00,0x40,0xbd,0xe8,0x1e,0xff,0x2f,0xe1,
+	0x00,0x40,0x2d,0xe9,0x12,0x2e,0xa0,0xe3,0x06,0x30,0xa0,0xe3,0x00,0x10,0xa0,0xe3,
+	0x02,0x04,0xa0,0xe3,0x2f,0x00,0x00,0xeb,0x00,0x40,0xbd,0xe8,0x1e,0xff,0x2f,0xe1,
+	0x00,0x02,0x00,0x02,0x80,0x01,0x90,0xe0,0x01,0x00,0x00,0x0a,0x01,0x00,0x50,0xe2,
+	0xfc,0xff,0xff,0xea,0x1e,0xff,0x2f,0xe1,0x80,0x10,0xa0,0xe3,0xf3,0x06,0xa0,0xe3,
+	0x00,0x10,0x80,0xe5,0x00,0x10,0xa0,0xe3,0x00,0x10,0x80,0xe5,0x01,0x10,0xa0,0xe3,
+	0x04,0x10,0x80,0xe5,0x00,0x10,0x80,0xe5,0x0e,0x34,0xa0,0xe3,0x1c,0x10,0x93,0xe5,
+	0x02,0x1a,0x81,0xe3,0x1c,0x10,0x83,0xe5,0x58,0x11,0x9f,0xe5,0x30,0x10,0x80,0xe5,
+	0x54,0x11,0x9f,0xe5,0x34,0x10,0x80,0xe5,0x38,0x10,0x80,0xe5,0x3c,0x10,0x80,0xe5,
+	0x10,0x10,0x90,0xe5,0x08,0x00,0x90,0xe5,0x1e,0xff,0x2f,0xe1,0xf3,0x16,0xa0,0xe3,
+	0x08,0x00,0x91,0xe5,0x05,0x00,0xa0,0xe3,0x0c,0x00,0x81,0xe5,0x10,0x00,0x91,0xe5,
+	0x02,0x00,0x10,0xe3,0xfc,0xff,0xff,0x0a,0xff,0x00,0xa0,0xe3,0x0c,0x00,0x81,0xe5,
+	0x10,0x00,0x91,0xe5,0x02,0x00,0x10,0xe3,0xfc,0xff,0xff,0x0a,0x08,0x00,0x91,0xe5,
+	0x10,0x00,0x91,0xe5,0x01,0x00,0x10,0xe3,0xfc,0xff,0xff,0x0a,0x08,0x00,0x91,0xe5,
+	0xff,0x00,0x00,0xe2,0x1e,0xff,0x2f,0xe1,0x30,0x40,0x2d,0xe9,0x00,0x50,0xa0,0xe1,
+	0x03,0x40,0xa0,0xe1,0xa2,0x02,0xa0,0xe1,0x08,0x00,0x00,0xe2,0x03,0x00,0x80,0xe2,
+	0xd8,0x10,0x9f,0xe5,0x00,0x00,0xc1,0xe5,0x01,0x20,0xc1,0xe5,0xe2,0xff,0xff,0xeb,
+	0x01,0x00,0x10,0xe3,0xfc,0xff,0xff,0x1a,0x14,0x00,0xa0,0xe3,0xc4,0xff,0xff,0xeb,
+	0x04,0x20,0xa0,0xe1,0x05,0x10,0xa0,0xe1,0x02,0x00,0xa0,0xe3,0x01,0x00,0x00,0xeb,
+	0x30,0x40,0xbd,0xe8,0x1e,0xff,0x2f,0xe1,0x70,0x40,0x2d,0xe9,0xf3,0x46,0xa0,0xe3,
+	0x00,0x30,0xa0,0xe3,0x00,0x00,0x50,0xe3,0x08,0x00,0x00,0x9a,0x8c,0x50,0x9f,0xe5,
+	0x03,0x60,0xd5,0xe7,0x0c,0x60,0x84,0xe5,0x10,0x60,0x94,0xe5,0x02,0x00,0x16,0xe3,
+	0xfc,0xff,0xff,0x0a,0x01,0x30,0x83,0xe2,0x00,0x00,0x53,0xe1,0xf7,0xff,0xff,0x3a,
+	0xff,0x30,0xa0,0xe3,0x0c,0x30,0x84,0xe5,0x08,0x00,0x94,0xe5,0x10,0x00,0x94,0xe5,
+	0x01,0x00,0x10,0xe3,0xfc,0xff,0xff,0x0a,0x08,0x00,0x94,0xe5,0x00,0x00,0xa0,0xe3,
+	0x00,0x00,0x52,0xe3,0x0b,0x00,0x00,0x9a,0x10,0x50,0x94,0xe5,0x02,0x00,0x15,0xe3,
+	0xfc,0xff,0xff,0x0a,0x0c,0x30,0x84,0xe5,0x10,0x50,0x94,0xe5,0x01,0x00,0x15,0xe3,
+	0xfc,0xff,0xff,0x0a,0x08,0x50,0x94,0xe5,0x01,0x50,0xc1,0xe4,0x01,0x00,0x80,0xe2,
+	0x02,0x00,0x50,0xe1,0xf3,0xff,0xff,0x3a,0xc8,0x00,0xa0,0xe3,0x98,0xff,0xff,0xeb,
+	0x70,0x40,0xbd,0xe8,0x1e,0xff,0x2f,0xe1,0x01,0x0c,0x00,0x02,0x01,0x02,0x00,0x02,
+	0x00,0x01,0x00,0x02
+};
+
+struct atmel_private {
+	void *card; /* Bus dependent stucture varies for PCcard */
+	int (*present_callback)(void *); /* And callback which uses it */
+	char firmware_id[32];
+	AtmelFWType firmware_type;
+	u8 *firmware;
+	int firmware_length;
+	struct timer_list management_timer;
+	struct net_device *dev;
+	struct device *sys_dev;
+	struct iw_statistics wstats;
+	struct net_device_stats	stats;	// device stats
+	spinlock_t irqlock, timerlock;	// spinlocks
+	enum { BUS_TYPE_PCCARD, BUS_TYPE_PCI } bus_type;
+	enum { 
+		CARD_TYPE_PARALLEL_FLASH, 
+		CARD_TYPE_SPI_FLASH,
+		CARD_TYPE_EEPROM 
+	} card_type;
+	int do_rx_crc; /* If we need to CRC incoming packets */
+	int probe_crc; /* set if we don't yet know */
+	int crc_ok_cnt, crc_ko_cnt; /* counters for probing */
+	u16 rx_desc_head;
+	u16 tx_desc_free, tx_desc_head, tx_desc_tail, tx_desc_previous;
+	u16 tx_free_mem, tx_buff_head, tx_buff_tail;
+	
+	u16 frag_seq, frag_len, frag_no;
+	u8 frag_source[6]; 
+	
+	u8 wep_is_on, default_key, exclude_unencrypted, encryption_level;
+	u8 group_cipher_suite, pairwise_cipher_suite;
+	u8 wep_keys[MAX_ENCRYPTION_KEYS][MAX_ENCRYPTION_KEY_SIZE];
+	int wep_key_len[MAX_ENCRYPTION_KEYS]; 
+	int use_wpa, radio_on_broken; /* firmware dependent stuff. */
+
+	u16 host_info_base;
+	struct host_info_struct { 
+		/* NB this is matched to the hardware, don't change. */
+		u8 volatile int_status;
+		u8 volatile int_mask;
+		u8 volatile lockout_host;
+		u8 volatile lockout_mac;
+
+		u16 tx_buff_pos;
+		u16 tx_buff_size;
+		u16 tx_desc_pos;
+		u16 tx_desc_count;
+
+		u16 rx_buff_pos;
+		u16 rx_buff_size;
+		u16 rx_desc_pos;
+		u16 rx_desc_count;
+		
+		u16 build_version;
+		u16 command_pos; 	
+		
+		u16 major_version;
+		u16 minor_version;
+		
+		u16 func_ctrl;
+		u16 mac_status;
+		u16 generic_IRQ_type;
+		u8  reserved[2];
+	} host_info;
+
+	enum { 
+		STATION_STATE_SCANNING,
+		STATION_STATE_JOINNING,
+		STATION_STATE_AUTHENTICATING,
+		STATION_STATE_ASSOCIATING,
+		STATION_STATE_READY,
+		STATION_STATE_REASSOCIATING,
+		STATION_STATE_DOWN,
+		STATION_STATE_MGMT_ERROR
+	} station_state;
+	
+	int operating_mode, power_mode;
+	time_t last_qual;
+	int beacons_this_sec;
+	int channel;
+	int reg_domain, config_reg_domain;
+	int tx_rate;
+	int auto_tx_rate;
+	int rts_threshold;
+	int frag_threshold;
+	int long_retry, short_retry;
+	int preamble;
+	int default_beacon_period, beacon_period, listen_interval;
+	int CurrentAuthentTransactionSeqNum, ExpectedAuthentTransactionSeqNum;	
+	int AuthenticationRequestRetryCnt, AssociationRequestRetryCnt, ReAssociationRequestRetryCnt;
+	enum {
+		SITE_SURVEY_IDLE,
+		SITE_SURVEY_IN_PROGRESS,
+		SITE_SURVEY_COMPLETED 
+	} site_survey_state;
+	time_t last_survey;
+
+	int station_was_associated, station_is_associated;
+	int fast_scan;
+				
+	struct bss_info {
+		int channel;
+		int SSIDsize;
+		int RSSI;
+		int UsingWEP;
+		int preamble;
+		int beacon_period;
+		int BSStype;
+		u8 BSSID[6];
+		u8 SSID[MAX_SSID_LENGTH];
+	} BSSinfo[MAX_BSS_ENTRIES];
+	int BSS_list_entries, current_BSS;
+	int connect_to_any_BSS; 
+	int SSID_size, new_SSID_size;
+	u8 CurrentBSSID[6], BSSID[6];
+	u8 SSID[MAX_SSID_LENGTH], new_SSID[MAX_SSID_LENGTH];
+	u64 last_beacon_timestamp;
+	u8 rx_buf[MAX_WIRELESS_BODY];
+	
+};
+
+static u8 atmel_basic_rates[4] = {0x82,0x84,0x0b,0x16};
+
+static const struct {
+	int reg_domain;
+	int min, max;
+	char *name; 
+} channel_table[] = { { REG_DOMAIN_FCC, 1, 11, "USA" },
+		      { REG_DOMAIN_DOC, 1, 11, "Canada" },
+		      { REG_DOMAIN_ETSI, 1, 13, "Europe" },
+		      { REG_DOMAIN_SPAIN, 10, 11, "Spain" },
+		      { REG_DOMAIN_FRANCE, 10, 13, "France" }, 
+		      { REG_DOMAIN_MKK, 14, 14, "MKK" },
+		      { REG_DOMAIN_MKK1, 1, 14, "MKK1" },
+		      { REG_DOMAIN_ISRAEL, 3, 9, "Israel"} };
+
+static void build_wpa_mib(struct atmel_private *priv);
+static int atmel_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
+static void atmel_copy_to_card(struct net_device *dev, u16 dest, unsigned char *src, u16 len);
+static void atmel_copy_to_host(struct net_device *dev, unsigned char *dest, u16 src, u16 len);
+static void atmel_set_gcr(struct net_device *dev, u16 mask);
+static void atmel_clear_gcr(struct net_device *dev, u16 mask);
+static int atmel_lock_mac(struct atmel_private *priv);
+static void atmel_wmem32(struct atmel_private *priv, u16 pos, u32 data);
+static void atmel_command_irq(struct atmel_private *priv);
+static int atmel_validate_channel(struct atmel_private *priv, int channel);
+static void atmel_management_frame(struct atmel_private *priv, struct ieee802_11_hdr *header, 
+				   u16 frame_len, u8 rssi);
+static void atmel_management_timer(u_long a);
+static void atmel_send_command(struct atmel_private *priv, int command, void *cmd, int cmd_size);
+static int atmel_send_command_wait(struct atmel_private *priv, int command, void *cmd, int cmd_size);
+static void atmel_transmit_management_frame(struct atmel_private *priv, struct ieee802_11_hdr *header,
+					    u8 *body, int body_len);
+
+static u8 atmel_get_mib8(struct atmel_private *priv, u8 type, u8 index);
+static void atmel_set_mib8(struct atmel_private *priv, u8 type, u8 index, u8 data);
+static void atmel_set_mib16(struct atmel_private *priv, u8 type, u8 index, u16 data);
+static void atmel_set_mib(struct atmel_private *priv, u8 type, u8 index, u8 *data, int data_len);
+static void atmel_get_mib(struct atmel_private *priv, u8 type, u8 index, u8 *data, int data_len);
+static void atmel_scan(struct atmel_private *priv, int specific_ssid);
+static void atmel_join_bss(struct atmel_private *priv, int bss_index);
+static void atmel_smooth_qual(struct atmel_private *priv);
+static void atmel_writeAR(struct net_device *dev, u16 data);
+static int probe_atmel_card(struct net_device *dev);
+static int reset_atmel_card(struct net_device *dev );
+static void atmel_enter_state(struct atmel_private *priv, int new_state);
+int atmel_open (struct net_device *dev);
+
+static inline u16 atmel_hi(struct atmel_private *priv, u16 offset)
+{
+	return priv->host_info_base + offset;
+}
+
+static inline u16 atmel_co(struct atmel_private *priv, u16 offset)
+{
+	return priv->host_info.command_pos + offset;
+}
+
+static inline u16 atmel_rx(struct atmel_private *priv, u16 offset, u16  desc)
+{
+	return priv->host_info.rx_desc_pos + (sizeof(struct rx_desc) * desc) + offset;
+}
+
+static inline u16 atmel_tx(struct atmel_private *priv, u16 offset, u16  desc)
+{
+	return priv->host_info.tx_desc_pos + (sizeof(struct tx_desc) * desc) + offset;
+}
+
+static inline u8 atmel_read8(struct net_device *dev, u16 offset)
+{
+	return inb(dev->base_addr + offset);
+}
+
+static inline void atmel_write8(struct net_device *dev, u16 offset, u8 data)
+{
+	outb(data, dev->base_addr + offset);
+}
+
+static inline u16 atmel_read16(struct net_device *dev, u16 offset)
+{
+	return inw(dev->base_addr + offset);
+}
+
+static inline void atmel_write16(struct net_device *dev, u16 offset, u16 data)
+{
+	outw(data, dev->base_addr + offset);
+}
+
+static inline u8 atmel_rmem8(struct atmel_private *priv, u16 pos)
+{
+	atmel_writeAR(priv->dev, pos);	
+	return atmel_read8(priv->dev, DR);
+}
+
+static inline void atmel_wmem8(struct atmel_private *priv, u16 pos, u16 data)
+{
+	atmel_writeAR(priv->dev, pos);	
+	atmel_write8(priv->dev, DR, data);
+}
+
+static inline u16 atmel_rmem16(struct atmel_private *priv, u16 pos)
+{
+       	atmel_writeAR(priv->dev, pos);	
+	return atmel_read16(priv->dev, DR);
+}
+
+static inline void atmel_wmem16(struct atmel_private *priv, u16 pos, u16 data)
+{
+       	atmel_writeAR(priv->dev, pos);	
+	atmel_write16(priv->dev, DR, data);
+}
+
+static const struct iw_handler_def atmel_handler_def;
+
+static void tx_done_irq(struct atmel_private *priv)
+{
+	int i;
+
+	for (i = 0; 
+	     atmel_rmem8(priv, atmel_tx(priv, TX_DESC_FLAGS_OFFSET, priv->tx_desc_head)) == TX_DONE &&
+		     i < priv->host_info.tx_desc_count;
+	     i++) {
+		
+		u8 status = atmel_rmem8(priv, atmel_tx(priv, TX_DESC_STATUS_OFFSET, priv->tx_desc_head));
+		u16 msdu_size = atmel_rmem16(priv, atmel_tx(priv, TX_DESC_SIZE_OFFSET, priv->tx_desc_head));
+		u8 type = atmel_rmem8(priv, atmel_tx(priv, TX_DESC_PACKET_TYPE_OFFSET, priv->tx_desc_head));
+
+		atmel_wmem8(priv, atmel_tx(priv, TX_DESC_FLAGS_OFFSET, priv->tx_desc_head), 0);
+
+		priv->tx_free_mem += msdu_size;
+		priv->tx_desc_free++;
+
+		if (priv->tx_buff_head + msdu_size > (priv->host_info.tx_buff_pos + priv->host_info.tx_buff_size))
+			priv->tx_buff_head = 0;
+		else
+			priv->tx_buff_head += msdu_size;
+			
+		if (priv->tx_desc_head < (priv->host_info.tx_desc_count - 1))
+			priv->tx_desc_head++ ;					
+		else
+			priv->tx_desc_head = 0;
+		
+		if (type == TX_PACKET_TYPE_DATA) {
+			if (status == TX_STATUS_SUCCESS)
+				priv->stats.tx_packets++;
+			else 
+				priv->stats.tx_errors++;
+			netif_wake_queue(priv->dev);
+		}
+	}
+}
+
+static u16 find_tx_buff(struct atmel_private *priv, u16 len)
+{
+	u16 bottom_free = priv->host_info.tx_buff_size - priv->tx_buff_tail;
+
+	if (priv->tx_desc_free == 3 || priv->tx_free_mem < len) 
+		return 0;
+	
+	if (bottom_free >= len)
+		return priv->host_info.tx_buff_pos + priv->tx_buff_tail;
+	
+	if (priv->tx_free_mem - bottom_free >= len) {
+		priv->tx_buff_tail = 0;
+		return priv->host_info.tx_buff_pos;
+	}
+	
+	return 0;
+}
+
+static void tx_update_descriptor(struct atmel_private *priv, int is_bcast, u16 len, u16 buff, u8 type)
+{
+	atmel_wmem16(priv, atmel_tx(priv, TX_DESC_POS_OFFSET, priv->tx_desc_tail), buff);
+	atmel_wmem16(priv, atmel_tx(priv, TX_DESC_SIZE_OFFSET, priv->tx_desc_tail), len);
+	if (!priv->use_wpa)
+		atmel_wmem16(priv, atmel_tx(priv, TX_DESC_HOST_LENGTH_OFFSET, priv->tx_desc_tail), len);
+	atmel_wmem8(priv, atmel_tx(priv, TX_DESC_PACKET_TYPE_OFFSET, priv->tx_desc_tail), type);
+	atmel_wmem8(priv, atmel_tx(priv, TX_DESC_RATE_OFFSET, priv->tx_desc_tail), priv->tx_rate);
+	atmel_wmem8(priv, atmel_tx(priv, TX_DESC_RETRY_OFFSET, priv->tx_desc_tail), 0);
+	if (priv->use_wpa) {
+		int cipher_type, cipher_length;
+		if (is_bcast) {
+			cipher_type = priv->group_cipher_suite;
+			if (cipher_type == CIPHER_SUITE_WEP_64 || 
+			    cipher_type == CIPHER_SUITE_WEP_128 )
+				cipher_length = 8;
+			else if (cipher_type == CIPHER_SUITE_TKIP)
+				cipher_length = 12;
+			else if (priv->pairwise_cipher_suite == CIPHER_SUITE_WEP_64 ||
+				 priv->pairwise_cipher_suite == CIPHER_SUITE_WEP_128) {
+				cipher_type = priv->pairwise_cipher_suite;
+				cipher_length = 8;
+			} else {
+				cipher_type = CIPHER_SUITE_NONE;
+				cipher_length = 0;
+			}
+		} else {
+			cipher_type = priv->pairwise_cipher_suite;
+			if (cipher_type == CIPHER_SUITE_WEP_64 || 
+			    cipher_type == CIPHER_SUITE_WEP_128 )
+				cipher_length = 8;
+			else if (cipher_type == CIPHER_SUITE_TKIP)
+				cipher_length = 12;
+			else if (priv->group_cipher_suite == CIPHER_SUITE_WEP_64 ||
+				 priv->group_cipher_suite == CIPHER_SUITE_WEP_128) {
+				cipher_type = priv->group_cipher_suite;
+				cipher_length = 8;
+			} else {
+				cipher_type = CIPHER_SUITE_NONE;
+				cipher_length = 0;
+			}
+		}
+		
+		atmel_wmem8(priv, atmel_tx(priv, TX_DESC_CIPHER_TYPE_OFFSET, priv->tx_desc_tail),
+			    cipher_type);	
+		atmel_wmem8(priv, atmel_tx(priv, TX_DESC_CIPHER_LENGTH_OFFSET, priv->tx_desc_tail),
+			    cipher_length);
+	}
+	atmel_wmem32(priv, atmel_tx(priv, TX_DESC_NEXT_OFFSET, priv->tx_desc_tail), 0x80000000L);
+	atmel_wmem8(priv, atmel_tx(priv, TX_DESC_FLAGS_OFFSET, priv->tx_desc_tail), TX_FIRM_OWN);
+	if (priv->tx_desc_previous != priv->tx_desc_tail)
+		atmel_wmem32(priv, atmel_tx(priv, TX_DESC_NEXT_OFFSET, priv->tx_desc_previous), 0);
+	priv->tx_desc_previous = priv->tx_desc_tail;
+	if (priv->tx_desc_tail < (priv->host_info.tx_desc_count -1 ))
+		priv->tx_desc_tail++;
+	else
+		priv->tx_desc_tail = 0;
+	priv->tx_desc_free--;
+	priv->tx_free_mem -= len;
+
+}
+
+static int start_tx (struct sk_buff *skb, struct net_device *dev)
+{
+	struct atmel_private *priv = netdev_priv(dev);
+	struct ieee802_11_hdr header;
+	unsigned long flags;
+	u16 buff, frame_ctl, len = (ETH_ZLEN < skb->len) ? skb->len : ETH_ZLEN;
+	u8 SNAP_RFC1024[6] = {0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00};
+ 
+	if (priv->card && priv->present_callback && 
+	    !(*priv->present_callback)(priv->card)) {
+		priv->stats.tx_errors++;
+		dev_kfree_skb(skb);
+		return 0;
+	}
+	
+	if (priv->station_state != STATION_STATE_READY) {
+		priv->stats.tx_errors++;
+		dev_kfree_skb(skb);
+		return 0;
+	}
+	
+	/* first ensure the timer func cannot run */
+	spin_lock_bh(&priv->timerlock); 
+	/* then stop the hardware ISR */
+	spin_lock_irqsave(&priv->irqlock, flags); 
+	/* nb doing the above in the opposite order will deadlock */
+	
+	/* The Wireless Header is 30 bytes. In the Ethernet packet we "cut" the
+	   12 first bytes (containing DA/SA) and put them in the appropriate fields of
+	   the Wireless Header. Thus the packet length is then the initial + 18 (+30-12) */
+	
+	if (!(buff = find_tx_buff(priv, len + 18))) {
+		priv->stats.tx_dropped++;
+		spin_unlock_irqrestore(&priv->irqlock, flags);
+		spin_unlock_bh(&priv->timerlock);
+		netif_stop_queue(dev);
+		return 1;
+	}
+	
+	frame_ctl = IEEE802_11_FTYPE_DATA;
+	header.duration_id = 0;
+	header.seq_ctl = 0;
+	if (priv->wep_is_on)
+		frame_ctl |= IEEE802_11_FCTL_WEP;
+	if (priv->operating_mode == IW_MODE_ADHOC) {
+		memcpy(&header.addr1, skb->data, 6);
+		memcpy(&header.addr2, dev->dev_addr, 6);
+		memcpy(&header.addr3, priv->BSSID, 6);
+	} else {
+		frame_ctl |= IEEE802_11_FCTL_TODS;
+		memcpy(&header.addr1, priv->CurrentBSSID, 6);
+		memcpy(&header.addr2, dev->dev_addr, 6);
+		memcpy(&header.addr3, skb->data, 6);
+	}
+	
+	if (priv->use_wpa)
+		memcpy(&header.addr4, SNAP_RFC1024, 6);
+
+	header.frame_ctl = cpu_to_le16(frame_ctl);
+	/* Copy the wireless header into the card */
+	atmel_copy_to_card(dev, buff, (unsigned char *)&header, DATA_FRAME_WS_HEADER_SIZE);
+	/* Copy the packet sans its 802.3 header addresses which have been replaced */
+	atmel_copy_to_card(dev, buff + DATA_FRAME_WS_HEADER_SIZE, skb->data + 12, len - 12);
+	priv->tx_buff_tail += len - 12 + DATA_FRAME_WS_HEADER_SIZE;
+	
+	/* low bit of first byte of destination tells us if broadcast */
+	tx_update_descriptor(priv, *(skb->data) & 0x01, len + 18, buff, TX_PACKET_TYPE_DATA);
+	dev->trans_start = jiffies;
+	priv->stats.tx_bytes += len;
+	
+	spin_unlock_irqrestore(&priv->irqlock, flags);
+	spin_unlock_bh(&priv->timerlock);
+	dev_kfree_skb(skb);
+	
+	return 0;	
+}
+
+static void atmel_transmit_management_frame(struct atmel_private *priv, 
+					    struct ieee802_11_hdr *header,
+					    u8 *body, int body_len)
+{
+	u16 buff;
+	int len =  MGMT_FRAME_BODY_OFFSET + body_len;
+	
+	if (!(buff = find_tx_buff(priv, len))) 
+		return;
+
+	atmel_copy_to_card(priv->dev, buff, (u8 *)header, MGMT_FRAME_BODY_OFFSET);
+	atmel_copy_to_card(priv->dev, buff + MGMT_FRAME_BODY_OFFSET, body, body_len);
+	priv->tx_buff_tail += len;
+	tx_update_descriptor(priv, header->addr1[0] & 0x01, len, buff, TX_PACKET_TYPE_MGMT);
+}
+	
+static void fast_rx_path(struct atmel_private *priv, struct ieee802_11_hdr *header, 
+			 u16 msdu_size, u16 rx_packet_loc, u32 crc)
+{
+	/* fast path: unfragmented packet copy directly into skbuf */
+	u8 mac4[6]; 
+	struct sk_buff 	*skb;
+	unsigned char *skbp;
+	
+	/* get the final, mac 4 header field, this tells us encapsulation */
+	atmel_copy_to_host(priv->dev, mac4, rx_packet_loc + 24, 6);
+	msdu_size -= 6;
+	
+	if (priv->do_rx_crc) {
+		crc = crc32_le(crc, mac4, 6);
+		msdu_size -= 4;
+	}
+	
+	if (!(skb = dev_alloc_skb(msdu_size + 14))) {
+		priv->stats.rx_dropped++;
+		return;
+	}
+
+	skb_reserve(skb, 2);
+	skbp = skb_put(skb, msdu_size + 12);
+	atmel_copy_to_host(priv->dev, skbp + 12, rx_packet_loc + 30, msdu_size);
+	
+	if (priv->do_rx_crc) {
+		u32 netcrc;
+		crc = crc32_le(crc, skbp + 12, msdu_size);
+		atmel_copy_to_host(priv->dev, (void *)&netcrc, rx_packet_loc + 30 + msdu_size, 4);
+		if ((crc ^ 0xffffffff) != netcrc) {
+			priv->stats.rx_crc_errors++;
+			dev_kfree_skb(skb);
+			return;
+		}
+	}
+	
+	memcpy(skbp, header->addr1, 6); /* destination address */
+	if (le16_to_cpu(header->frame_ctl) & IEEE802_11_FCTL_FROMDS) 
+		memcpy(&skbp[6], header->addr3, 6);
+	else
+		memcpy(&skbp[6], header->addr2, 6); /* source address */
+	
+	priv->dev->last_rx=jiffies;
+	skb->dev = priv->dev;
+	skb->protocol = eth_type_trans(skb, priv->dev);
+	skb->ip_summed = CHECKSUM_NONE;	
+	netif_rx(skb);
+	priv->stats.rx_bytes += 12 + msdu_size;
+	priv->stats.rx_packets++;
+}
+
+/* Test to see if the packet in card memory at packet_loc has a valid CRC
+   It doesn't matter that this is slow: it is only used to proble the first few packets. */
+static int probe_crc(struct atmel_private *priv, u16 packet_loc, u16 msdu_size)
+{
+	int i = msdu_size - 4;
+	u32 netcrc, crc = 0xffffffff;
+
+	if (msdu_size < 4)
+		return 0;
+
+	atmel_copy_to_host(priv->dev, (void *)&netcrc, packet_loc + i, 4);
+	
+	atmel_writeAR(priv->dev, packet_loc);
+	while (i--) {
+		u8 octet = atmel_read8(priv->dev, DR);
+		crc = crc32_le(crc, &octet, 1);
+	}
+
+	return (crc ^ 0xffffffff) == netcrc;
+}
+
+static void frag_rx_path(struct atmel_private *priv, struct ieee802_11_hdr *header, 
+			 u16 msdu_size, u16 rx_packet_loc, u32 crc, u16 seq_no, u8 frag_no, int more_frags)
+{
+	u8 mac4[6]; 
+	u8 source[6];
+	struct sk_buff *skb;
+
+	if (le16_to_cpu(header->frame_ctl) & IEEE802_11_FCTL_FROMDS) 
+		memcpy(source, header->addr3, 6);
+	else
+		memcpy(source, header->addr2, 6); 
+	
+	rx_packet_loc += 24; /* skip header */
+	
+	if (priv->do_rx_crc)
+		msdu_size -= 4;
+
+	if (frag_no == 0) { /* first fragment */
+		atmel_copy_to_host(priv->dev, mac4, rx_packet_loc, 6);
+		msdu_size -= 6;
+		rx_packet_loc += 6;
+
+		if (priv->do_rx_crc) 
+			crc = crc32_le(crc, mac4, 6);
+	       
+		priv->frag_seq = seq_no;
+		priv->frag_no = 1;
+		priv->frag_len = msdu_size;
+		memcpy(priv->frag_source, source, 6); 
+		memcpy(&priv->rx_buf[6], source, 6);
+		memcpy(priv->rx_buf, header->addr1, 6);
+				
+		atmel_copy_to_host(priv->dev, &priv->rx_buf[12], rx_packet_loc, msdu_size);
+
+		if (priv->do_rx_crc) {
+			u32 netcrc;
+			crc = crc32_le(crc, &priv->rx_buf[12], msdu_size);
+			atmel_copy_to_host(priv->dev, (void *)&netcrc, rx_packet_loc + msdu_size, 4);
+			if ((crc ^ 0xffffffff) != netcrc) {
+				priv->stats.rx_crc_errors++;
+				memset(priv->frag_source, 0xff, 6);
+			}
+		}
+		
+	} else if (priv->frag_no == frag_no &&
+		   priv->frag_seq == seq_no &&
+		   memcmp(priv->frag_source, source, 6) == 0) {
+		
+		atmel_copy_to_host(priv->dev, &priv->rx_buf[12 + priv->frag_len], 
+				   rx_packet_loc, msdu_size);
+		if (priv->do_rx_crc) {
+			u32 netcrc;
+			crc = crc32_le(crc, 
+				       &priv->rx_buf[12 + priv->frag_len], 
+				       msdu_size);
+			atmel_copy_to_host(priv->dev, (void *)&netcrc, rx_packet_loc + msdu_size, 4);
+			if ((crc ^ 0xffffffff) != netcrc) {
+				priv->stats.rx_crc_errors++;
+				memset(priv->frag_source, 0xff, 6);
+				more_frags = 1; /* don't send broken assembly */
+			}
+		}
+		
+		priv->frag_len += msdu_size;
+		priv->frag_no++;
+
+		if (!more_frags) { /* last one */
+			memset(priv->frag_source, 0xff, 6);
+			if (!(skb = dev_alloc_skb(priv->frag_len + 14))) {
+				priv->stats.rx_dropped++;
+			} else {
+				skb_reserve(skb, 2);
+				memcpy(skb_put(skb, priv->frag_len + 12), 
+				       priv->rx_buf,
+				       priv->frag_len + 12);
+				priv->dev->last_rx = jiffies;
+				skb->dev = priv->dev;
+				skb->protocol = eth_type_trans(skb, priv->dev);
+				skb->ip_summed = CHECKSUM_NONE;	
+				netif_rx(skb);
+				priv->stats.rx_bytes += priv->frag_len + 12;
+				priv->stats.rx_packets++;
+			}
+		}
+		
+	} else
+		priv->wstats.discard.fragment++;
+}
+		
+static void rx_done_irq(struct atmel_private *priv)
+{
+	int i;
+	struct ieee802_11_hdr header;
+	
+	for (i = 0; 
+	     atmel_rmem8(priv, atmel_rx(priv, RX_DESC_FLAGS_OFFSET, priv->rx_desc_head)) == RX_DESC_FLAG_VALID &&
+		     i < priv->host_info.rx_desc_count;
+	     i++) {
+				
+		u16 msdu_size, rx_packet_loc, frame_ctl, seq_control;
+		u8 status = atmel_rmem8(priv, atmel_rx(priv, RX_DESC_STATUS_OFFSET, priv->rx_desc_head));
+		u32 crc = 0xffffffff;
+		
+		if (status != RX_STATUS_SUCCESS) {
+			if (status == 0xc1) /* determined by experiment */
+				priv->wstats.discard.nwid++;
+			else
+				priv->stats.rx_errors++; 
+			goto next;
+		}
+
+		msdu_size = atmel_rmem16(priv, atmel_rx(priv, RX_DESC_MSDU_SIZE_OFFSET, priv->rx_desc_head));
+		rx_packet_loc = atmel_rmem16(priv, atmel_rx(priv, RX_DESC_MSDU_POS_OFFSET, priv->rx_desc_head));
+		
+		if (msdu_size < 30) {
+			priv->stats.rx_errors++; 
+			goto next;
+		}
+		
+		/* Get header as far as end of seq_ctl */
+		atmel_copy_to_host(priv->dev, (char *)&header, rx_packet_loc, 24);
+		frame_ctl = le16_to_cpu(header.frame_ctl);
+		seq_control = le16_to_cpu(header.seq_ctl);
+
+		/* probe for CRC use here if needed  once five packets have arrived with
+		   the same crc status, we assume we know what's happening and stop probing */
+		if (priv->probe_crc) {
+			if (!priv->wep_is_on || !(frame_ctl & IEEE802_11_FCTL_WEP)) {
+				priv->do_rx_crc = probe_crc(priv, rx_packet_loc, msdu_size);
+			} else {
+				priv->do_rx_crc = probe_crc(priv, rx_packet_loc + 24, msdu_size - 24);
+			}
+			if (priv->do_rx_crc) {
+				if (priv->crc_ok_cnt++ > 5)
+					priv->probe_crc = 0;
+			} else {
+				if (priv->crc_ko_cnt++ > 5)
+					priv->probe_crc = 0;
+			}
+		}
+		    
+		/* don't CRC header when WEP in use */
+		if (priv->do_rx_crc && (!priv->wep_is_on || !(frame_ctl & IEEE802_11_FCTL_WEP))) {
+			crc = crc32_le(0xffffffff, (unsigned char *)&header, 24);
+		}
+		msdu_size -= 24; /* header */
+
+		if ((frame_ctl & IEEE802_11_FCTL_FTYPE) == IEEE802_11_FTYPE_DATA) { 
+			
+			int more_fragments = frame_ctl & IEEE802_11_FCTL_MOREFRAGS;
+			u8 packet_fragment_no = seq_control & IEEE802_11_SCTL_FRAG;
+			u16 packet_sequence_no = (seq_control & IEEE802_11_SCTL_SEQ) >> 4;
+			
+			if (!more_fragments && packet_fragment_no == 0 ) {
+				fast_rx_path(priv, &header, msdu_size, rx_packet_loc, crc);
+			} else {
+				frag_rx_path(priv, &header, msdu_size, rx_packet_loc, crc,
+					     packet_sequence_no, packet_fragment_no, more_fragments);
+			}
+		}
+		
+		if ((frame_ctl & IEEE802_11_FCTL_FTYPE) == IEEE802_11_FTYPE_MGMT) {
+			/* copy rest of packet into buffer */
+			atmel_copy_to_host(priv->dev, (unsigned char *)&priv->rx_buf, rx_packet_loc + 24, msdu_size);
+			
+			/* we use the same buffer for frag reassembly and control packets */
+			memset(priv->frag_source, 0xff, 6);
+			
+			if (priv->do_rx_crc) {
+				/* last 4 octets is crc */
+				msdu_size -= 4;
+				crc = crc32_le(crc, (unsigned char *)&priv->rx_buf, msdu_size);
+				if ((crc ^ 0xffffffff) != (*((u32 *)&priv->rx_buf[msdu_size]))) {
+					priv->stats.rx_crc_errors++;
+					goto next;
+				}
+			}
+
+			atmel_management_frame(priv, &header, msdu_size,
+					       atmel_rmem8(priv, atmel_rx(priv, RX_DESC_RSSI_OFFSET, priv->rx_desc_head)));
+		} 
+
+	next:
+		/* release descriptor */
+		atmel_wmem8(priv, atmel_rx(priv, RX_DESC_FLAGS_OFFSET, priv->rx_desc_head), RX_DESC_FLAG_CONSUMED);  
+		
+		if (priv->rx_desc_head < (priv->host_info.rx_desc_count - 1))
+			priv->rx_desc_head++;					
+		else
+			priv->rx_desc_head = 0;
+	}
+}	
+
+static irqreturn_t service_interrupt(int irq, void *dev_id, struct pt_regs *regs)
+{
+	struct net_device *dev = (struct net_device *) dev_id;
+	struct atmel_private *priv = netdev_priv(dev);
+	u8 isr;
+	int i = -1;
+	static u8 irq_order[] = { 
+		ISR_OUT_OF_RANGE,
+		ISR_RxCOMPLETE,
+		ISR_TxCOMPLETE,
+		ISR_RxFRAMELOST,
+		ISR_FATAL_ERROR,
+		ISR_COMMAND_COMPLETE,
+		ISR_IBSS_MERGE,
+		ISR_GENERIC_IRQ
+	};
+		
+
+	if (priv->card && priv->present_callback && 
+	    !(*priv->present_callback)(priv->card))
+		return IRQ_HANDLED;
+
+	/* In this state upper-level code assumes it can mess with
+	   the card unhampered by interrupts which may change register state.
+	   Note that even though the card shouldn't generate interrupts
+	   the inturrupt line may be shared. This allows card setup 
+	   to go on without disabling interrupts for a long time. */
+	if (priv->station_state == STATION_STATE_DOWN)
+		return IRQ_NONE;
+     	
+	atmel_clear_gcr(dev, GCR_ENINT); /* disable interrupts */
+
+	while (1) {
+		if (!atmel_lock_mac(priv)) {
+			/* failed to contact card */
+			printk(KERN_ALERT "%s: failed to contact MAC.\n", dev->name);
+			return IRQ_HANDLED;
+		}
+		
+		isr = atmel_rmem8(priv, atmel_hi(priv, IFACE_INT_STATUS_OFFSET));
+		atmel_wmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_MAC_OFFSET), 0);
+		
+		if (!isr) {
+			atmel_set_gcr(dev, GCR_ENINT); /* enable interrupts */
+			return i == -1 ? IRQ_NONE : IRQ_HANDLED;
+		}
+		
+		atmel_set_gcr(dev, GCR_ACKINT); /* acknowledge interrupt */
+		
+		for (i = 0; i < sizeof(irq_order)/sizeof(u8); i++)
+			if (isr & irq_order[i])
+				break;
+		
+		if (!atmel_lock_mac(priv)) {
+			/* failed to contact card */
+			printk(KERN_ALERT "%s: failed to contact MAC.\n", dev->name);
+			return IRQ_HANDLED;
+		}
+		
+		isr = atmel_rmem8(priv, atmel_hi(priv, IFACE_INT_STATUS_OFFSET));
+		isr ^= irq_order[i];
+		atmel_wmem8(priv, atmel_hi(priv, IFACE_INT_STATUS_OFFSET), isr);
+		atmel_wmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_MAC_OFFSET), 0);
+		
+		switch (irq_order[i]) {
+			
+		case ISR_OUT_OF_RANGE: 
+			if (priv->operating_mode == IW_MODE_INFRA && 
+			    priv->station_state == STATION_STATE_READY) {
+				priv->station_is_associated = 0;
+				atmel_scan(priv, 1);
+			}
+			break;
+
+		case ISR_RxFRAMELOST:
+			priv->wstats.discard.misc++;
+			/* fall through */
+		case ISR_RxCOMPLETE:
+			rx_done_irq(priv); 
+			break;
+			
+		case ISR_TxCOMPLETE:
+			tx_done_irq(priv); 
+			break;
+			
+		case ISR_FATAL_ERROR:
+			printk(KERN_ALERT "%s: *** FATAL error interrupt ***\n", dev->name);
+			atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
+			break;
+			
+		case ISR_COMMAND_COMPLETE: 
+			atmel_command_irq(priv);
+			break;
+
+		case ISR_IBSS_MERGE:
+			atmel_get_mib(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_CUR_BSSID_POS, 
+				      priv->CurrentBSSID, 6);
+			/* The WPA stuff cares about the current AP address */
+			if (priv->use_wpa)
+				build_wpa_mib(priv);
+			break;
+		case ISR_GENERIC_IRQ:
+			printk(KERN_INFO "%s: Generic_irq received.\n", dev->name);
+			break;
+		}
+	}	
+}
+
+
+static struct net_device_stats *atmel_get_stats (struct net_device *dev)
+{
+	struct atmel_private *priv = netdev_priv(dev);
+	return &priv->stats;
+}
+
+static struct iw_statistics *atmel_get_wireless_stats (struct net_device *dev)
+{
+	struct atmel_private *priv = netdev_priv(dev);
+
+	/* update the link quality here in case we are seeing no beacons 
+	   at all to drive the process */
+	atmel_smooth_qual(priv);
+	
+	priv->wstats.status = priv->station_state;
+
+	if (priv->operating_mode == IW_MODE_INFRA) {
+		if (priv->station_state != STATION_STATE_READY) {
+			priv->wstats.qual.qual = 0;
+			priv->wstats.qual.level = 0;
+			priv->wstats.qual.updated = (IW_QUAL_QUAL_INVALID
+					| IW_QUAL_LEVEL_INVALID);
+		}
+		priv->wstats.qual.noise = 0;
+		priv->wstats.qual.updated |= IW_QUAL_NOISE_INVALID;
+	} else {
+		/* Quality levels cannot be determined in ad-hoc mode,
+		   because we can 'hear' more that one remote station. */
+		priv->wstats.qual.qual = 0;
+		priv->wstats.qual.level	= 0;
+		priv->wstats.qual.noise	= 0;
+		priv->wstats.qual.updated = IW_QUAL_QUAL_INVALID
+					| IW_QUAL_LEVEL_INVALID
+					| IW_QUAL_NOISE_INVALID;
+		priv->wstats.miss.beacon = 0;
+	}
+	
+	return (&priv->wstats);
+}
+
+static int atmel_change_mtu(struct net_device *dev, int new_mtu)
+{
+        if ((new_mtu < 68) || (new_mtu > 2312))
+                return -EINVAL;
+        dev->mtu = new_mtu;
+        return 0;
+}
+
+static int atmel_set_mac_address(struct net_device *dev, void *p)
+{
+	struct sockaddr *addr = p;
+        
+        memcpy (dev->dev_addr, addr->sa_data, dev->addr_len);
+	return atmel_open(dev);
+}
+
+EXPORT_SYMBOL(atmel_open);
+
+int atmel_open (struct net_device *dev)
+{
+	struct atmel_private *priv = netdev_priv(dev);
+	int i, channel;
+
+	/* any scheduled timer is no longer needed and might screw things up.. */
+	del_timer_sync(&priv->management_timer);
+	
+	/* Interrupts will not touch the card once in this state... */
+	priv->station_state = STATION_STATE_DOWN;
+
+	if (priv->new_SSID_size) {
+		memcpy(priv->SSID, priv->new_SSID, priv->new_SSID_size);
+		priv->SSID_size = priv->new_SSID_size;
+		priv->new_SSID_size = 0;
+	}
+	priv->BSS_list_entries = 0;
+
+	priv->AuthenticationRequestRetryCnt = 0;
+	priv->AssociationRequestRetryCnt = 0;
+	priv->ReAssociationRequestRetryCnt = 0;
+	priv->CurrentAuthentTransactionSeqNum = 0x0001;
+	priv->ExpectedAuthentTransactionSeqNum = 0x0002;
+
+	priv->site_survey_state = SITE_SURVEY_IDLE;
+	priv->station_is_associated = 0;
+
+	if (!reset_atmel_card(dev)) 
+		return -EAGAIN;
+
+	if (priv->config_reg_domain) {
+		priv->reg_domain = priv->config_reg_domain;
+		atmel_set_mib8(priv, Phy_Mib_Type, PHY_MIB_REG_DOMAIN_POS, priv->reg_domain);
+	} else {
+		priv->reg_domain = atmel_get_mib8(priv, Phy_Mib_Type, PHY_MIB_REG_DOMAIN_POS);
+		for (i = 0; i < sizeof(channel_table)/sizeof(channel_table[0]); i++)
+			if (priv->reg_domain == channel_table[i].reg_domain)
+				break;
+		if (i == sizeof(channel_table)/sizeof(channel_table[0])) {
+			priv->reg_domain = REG_DOMAIN_MKK1;
+			printk(KERN_ALERT "%s: failed to get regulatory domain: assuming MKK1.\n", dev->name);
+		} 
+	}
+	
+	if ((channel = atmel_validate_channel(priv, priv->channel)))
+		priv->channel = channel;
+
+	/* this moves station_state on.... */ 
+	atmel_scan(priv, 1);	
+
+	atmel_set_gcr(priv->dev, GCR_ENINT); /* enable interrupts */
+	return 0;
+}
+
+static int atmel_close (struct net_device *dev)
+{
+	struct atmel_private *priv = netdev_priv(dev);
+		
+	atmel_enter_state(priv, STATION_STATE_DOWN);
+	
+	if (priv->bus_type == BUS_TYPE_PCCARD) 
+		atmel_write16(dev, GCR, 0x0060);
+	atmel_write16(dev, GCR, 0x0040);
+	return 0;
+}
+
+static int atmel_validate_channel(struct atmel_private *priv, int channel)
+{
+	/* check that channel is OK, if so return zero,
+	   else return suitable default channel */
+	int i;
+
+	for (i = 0; i < sizeof(channel_table)/sizeof(channel_table[0]); i++)
+		if (priv->reg_domain == channel_table[i].reg_domain) {
+			if (channel >= channel_table[i].min &&
+			    channel <= channel_table[i].max)
+				return 0;
+			else
+				return channel_table[i].min;
+		}
+	return 0;
+}
+
+static int atmel_proc_output (char *buf, struct atmel_private *priv)
+{
+	int i;
+	char *p = buf;
+	char *s, *r, *c;
+	
+	p += sprintf(p, "Driver version:\t\t%d.%d\n", DRIVER_MAJOR, DRIVER_MINOR);
+	
+	if (priv->station_state != STATION_STATE_DOWN) {
+		p += sprintf(p, "Firmware version:\t%d.%d build %d\nFirmware location:\t", 
+			     priv->host_info.major_version,
+			     priv->host_info.minor_version,
+			     priv->host_info.build_version);
+		
+		if (priv->card_type != CARD_TYPE_EEPROM) 
+			p += sprintf(p, "on card\n");
+		else if (priv->firmware) 
+			p += sprintf(p, "%s loaded by host\n", priv->firmware_id);
+		else
+			p += sprintf(p, "%s loaded by hotplug\n", priv->firmware_id);
+		
+		switch(priv->card_type) {
+		case CARD_TYPE_PARALLEL_FLASH: c = "Parallel flash"; break;
+		case CARD_TYPE_SPI_FLASH: c = "SPI flash\n"; break;
+		case CARD_TYPE_EEPROM: c = "EEPROM"; break;
+		default: c = "<unknown>";
+		}
+
+		
+		r = "<unknown>";
+		for (i = 0; i < sizeof(channel_table)/sizeof(channel_table[0]); i++)
+			if (priv->reg_domain == channel_table[i].reg_domain)
+				r = channel_table[i].name;
+		
+		p += sprintf(p, "MAC memory type:\t%s\n", c);
+		p += sprintf(p, "Regulatory domain:\t%s\n", r);
+		p += sprintf(p, "Host CRC checking:\t%s\n", 
+			     priv->do_rx_crc ? "On" : "Off");
+		p += sprintf(p, "WPA-capable firmware:\t%s\n",
+			     priv->use_wpa ? "Yes" : "No");
+	}
+	
+	switch(priv->station_state) {
+	case STATION_STATE_SCANNING: s = "Scanning"; break;
+	case STATION_STATE_JOINNING: s = "Joining"; break;
+	case STATION_STATE_AUTHENTICATING: s = "Authenticating"; break;
+	case STATION_STATE_ASSOCIATING: s = "Associating"; break;
+	case STATION_STATE_READY: s = "Ready"; break;
+	case STATION_STATE_REASSOCIATING: s = "Reassociating"; break;
+	case STATION_STATE_MGMT_ERROR: s = "Management error"; break;
+	case STATION_STATE_DOWN: s = "Down"; break;
+	default: s = "<unknown>";
+	}
+      
+	p += sprintf(p, "Current state:\t\t%s\n", s);
+	return  p - buf;
+}
+
+static int atmel_read_proc(char *page, char **start, off_t off,
+			   int count, int *eof, void *data)
+{
+        struct atmel_private *priv = data;
+	int len = atmel_proc_output (page, priv);
+        if (len <= off+count) *eof = 1;
+        *start = page + off;
+        len -= off;
+        if (len>count) len = count;
+        if (len<0) len = 0;
+        return len;
+}
+
+struct net_device *init_atmel_card( unsigned short irq, int port, const AtmelFWType fw_type,  
+				    struct device *sys_dev, int (*card_present)(void *), void *card)
+{
+	struct net_device *dev;
+	struct atmel_private *priv;
+	int rc;
+
+	/* Create the network device object. */
+        dev = alloc_etherdev(sizeof(*priv));
+        if (!dev) {
+		printk(KERN_ERR "atmel:  Couldn't alloc_etherdev\n");
+		return NULL;
+        }
+	if (dev_alloc_name(dev, dev->name) < 0) {
+		printk(KERN_ERR "atmel:  Couldn't get name!\n");
+		goto err_out_free;
+	}
+
+	priv = netdev_priv(dev);
+	priv->dev = dev;
+	priv->sys_dev = sys_dev;
+	priv->present_callback = card_present;
+	priv->card = card;
+	priv->firmware = NULL;
+	priv->firmware_id[0] = '\0';
+	priv->firmware_type = fw_type;
+	if (firmware) /* module parameter */
+		strcpy(priv->firmware_id, firmware);
+	priv->bus_type = card_present ? BUS_TYPE_PCCARD : BUS_TYPE_PCI;
+	priv->station_state = STATION_STATE_DOWN;
+	priv->do_rx_crc = 0;
+	/* For PCMCIA cards, some chips need CRC, some don't
+	   so we have to probe. */
+	if (priv->bus_type == BUS_TYPE_PCCARD) {
+		priv->probe_crc = 1;
+		priv->crc_ok_cnt = priv->crc_ko_cnt = 0;
+	} else
+		priv->probe_crc = 0;
+	memset(&priv->stats, 0, sizeof(priv->stats));
+	memset(&priv->wstats, 0, sizeof(priv->wstats));
+	priv->last_qual = jiffies;
+	priv->last_beacon_timestamp = 0;
+	memset(priv->frag_source, 0xff, sizeof(priv->frag_source));
+	memset(priv->BSSID, 0, 6);
+	priv->CurrentBSSID[0] = 0xFF; /* Initialize to something invalid.... */
+	priv->station_was_associated = 0;
+	
+	priv->last_survey = jiffies;
+	priv->preamble = LONG_PREAMBLE;
+	priv->operating_mode = IW_MODE_INFRA;
+	priv->connect_to_any_BSS = 0;
+	priv->config_reg_domain = 0;
+	priv->reg_domain = 0;
+	priv->tx_rate = 3;
+	priv->auto_tx_rate = 1;
+	priv->channel = 4;
+	priv->power_mode = 0;
+	priv->SSID[0] = '\0';
+	priv->SSID_size = 0;
+	priv->new_SSID_size = 0;
+	priv->frag_threshold = 2346;
+	priv->rts_threshold = 2347;
+	priv->short_retry = 7;
+	priv->long_retry = 4;
+
+	priv->wep_is_on = 0;
+	priv->default_key = 0;
+	priv->encryption_level = 0;
+	priv->exclude_unencrypted = 0;
+	priv->group_cipher_suite = priv->pairwise_cipher_suite = CIPHER_SUITE_NONE;
+	priv->use_wpa = 0;
+	memset(priv->wep_keys, 0, sizeof(priv->wep_keys));
+	memset(priv->wep_key_len, 0, sizeof(priv->wep_key_len));
+
+	priv->default_beacon_period = priv->beacon_period = 100;
+	priv->listen_interval = 1;
+
+	init_timer(&priv->management_timer);
+	spin_lock_init(&priv->irqlock);
+	spin_lock_init(&priv->timerlock);
+	priv->management_timer.function = atmel_management_timer;
+	priv->management_timer.data = (unsigned long) dev;
+	
+	dev->open = atmel_open;
+	dev->stop = atmel_close;
+	dev->change_mtu = atmel_change_mtu;
+	dev->set_mac_address = atmel_set_mac_address;
+	dev->hard_start_xmit = start_tx;
+	dev->get_stats = atmel_get_stats;
+	dev->get_wireless_stats = atmel_get_wireless_stats;
+	dev->wireless_handlers = (struct iw_handler_def *)&atmel_handler_def;
+	dev->do_ioctl = atmel_ioctl;
+	dev->irq = irq;
+	dev->base_addr = port;
+	
+	SET_NETDEV_DEV(dev, sys_dev);
+	
+	if ((rc = request_irq(dev->irq, service_interrupt, SA_SHIRQ, dev->name, dev))) {
+		printk(KERN_ERR "%s: register interrupt %d failed, rc %d\n", dev->name, irq, rc );
+		goto err_out_free;
+	}
+
+	if (priv->bus_type == BUS_TYPE_PCI &&
+	    !request_region( dev->base_addr, 64, dev->name )) {
+		goto err_out_irq;
+	}
+	
+	if (register_netdev(dev))
+		goto err_out_res;
+	
+	if (!probe_atmel_card(dev)){
+		unregister_netdev(dev);
+		goto err_out_res;
+	}
+	
+	netif_carrier_off(dev);
+	
+	create_proc_read_entry ("driver/atmel", 0, NULL, atmel_read_proc, priv);	
+	
+	printk(KERN_INFO "%s: Atmel at76c50x wireless. Version %d.%d simon@thekelleys.org.uk\n",
+	       dev->name, DRIVER_MAJOR, DRIVER_MINOR);
+	
+	SET_MODULE_OWNER(dev);
+	return dev;
+	
+ err_out_res:
+	if (priv->bus_type == BUS_TYPE_PCI)
+	        release_region( dev->base_addr, 64 );
+ err_out_irq:
+	free_irq(dev->irq, dev);
+ err_out_free:
+	free_netdev(dev);
+	return NULL;
+}
+
+EXPORT_SYMBOL(init_atmel_card);
+
+void stop_atmel_card(struct net_device *dev, int freeres)
+{
+	struct atmel_private *priv = netdev_priv(dev);
+		
+	/* put a brick on it... */
+	if (priv->bus_type == BUS_TYPE_PCCARD) 
+		atmel_write16(dev, GCR, 0x0060);
+	atmel_write16(dev, GCR, 0x0040);
+	
+	del_timer_sync(&priv->management_timer);
+	unregister_netdev(dev);
+	remove_proc_entry("driver/atmel", NULL);
+	free_irq(dev->irq, dev);
+	if (priv->firmware)
+		kfree(priv->firmware);
+	if (freeres) {
+		/* PCMCIA frees this stuff, so only for PCI */
+	        release_region(dev->base_addr, 64);
+        }
+	free_netdev(dev);
+}
+
+EXPORT_SYMBOL(stop_atmel_card);
+
+static int atmel_set_essid(struct net_device *dev,
+			   struct iw_request_info *info,
+			   struct iw_point *dwrq,
+			   char *extra)
+{
+	struct atmel_private *priv = netdev_priv(dev);
+
+	/* Check if we asked for `any' */
+	if(dwrq->flags == 0) {
+		priv->connect_to_any_BSS = 1;
+	} else {
+		int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
+
+		priv->connect_to_any_BSS = 0;
+		
+		/* Check the size of the string */
+		if (dwrq->length > MAX_SSID_LENGTH + 1)
+			 return -E2BIG ;
+		if (index != 0)
+			return -EINVAL;
+		
+		memcpy(priv->new_SSID, extra, dwrq->length - 1);
+		priv->new_SSID_size = dwrq->length - 1;
+	}
+
+	return -EINPROGRESS;
+}
+
+static int atmel_get_essid(struct net_device *dev,
+			   struct iw_request_info *info,
+			   struct iw_point *dwrq,
+			   char *extra)
+{
+	struct atmel_private *priv = netdev_priv(dev);
+
+	/* Get the current SSID */
+	if (priv->new_SSID_size != 0) {
+		memcpy(extra, priv->new_SSID, priv->new_SSID_size);
+		extra[priv->new_SSID_size] = '\0';
+		dwrq->length = priv->new_SSID_size + 1;
+	} else {
+		memcpy(extra, priv->SSID, priv->SSID_size);
+		extra[priv->SSID_size] = '\0';
+		dwrq->length = priv->SSID_size + 1;
+	}
+	
+	dwrq->flags = !priv->connect_to_any_BSS; /* active */
+
+	return 0;
+}
+
+static int atmel_get_wap(struct net_device *dev,
+			 struct iw_request_info *info,
+			 struct sockaddr *awrq,
+			 char *extra)
+{
+	struct atmel_private *priv = netdev_priv(dev);
+	memcpy(awrq->sa_data, priv->CurrentBSSID, 6);
+	awrq->sa_family = ARPHRD_ETHER;
+
+	return 0;
+}
+
+static int atmel_set_encode(struct net_device *dev,
+			    struct iw_request_info *info,
+			    struct iw_point *dwrq,
+			    char *extra)
+{
+	struct atmel_private *priv = netdev_priv(dev);
+
+	/* Basic checking: do we have a key to set ?
+	 * Note : with the new API, it's impossible to get a NULL pointer.
+	 * Therefore, we need to check a key size == 0 instead.
+	 * New version of iwconfig properly set the IW_ENCODE_NOKEY flag
+	 * when no key is present (only change flags), but older versions
+	 * don't do it. - Jean II */
+	if (dwrq->length > 0) {
+		int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
+		int current_index = priv->default_key;
+		/* Check the size of the key */
+		if (dwrq->length > 13) {
+			return -EINVAL;
+		}
+		/* Check the index (none -> use current) */
+		if (index < 0 || index >= 4)
+			index = current_index;
+		else
+			priv->default_key = index;
+		/* Set the length */
+		if (dwrq->length > 5)
+			priv->wep_key_len[index] = 13;
+		else
+			if (dwrq->length > 0)
+				priv->wep_key_len[index] = 5;
+			else
+				/* Disable the key */
+				priv->wep_key_len[index] = 0;
+		/* Check if the key is not marked as invalid */
+		if(!(dwrq->flags & IW_ENCODE_NOKEY)) {
+			/* Cleanup */
+			memset(priv->wep_keys[index], 0, 13);
+			/* Copy the key in the driver */
+			memcpy(priv->wep_keys[index], extra, dwrq->length);
+		}
+		/* WE specify that if a valid key is set, encryption
+		 * should be enabled (user may turn it off later)
+		 * This is also how "iwconfig ethX key on" works */
+		if (index == current_index && 
+		    priv->wep_key_len[index] > 0) {
+			priv->wep_is_on = 1;
+			priv->exclude_unencrypted = 1;
+			if (priv->wep_key_len[index] > 5) {
+				priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_64;
+				priv->encryption_level = 2;
+			} else {
+				priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_128;
+				priv->encryption_level = 1;
+			}
+		}
+	} else {
+		/* Do we want to just set the transmit key index ? */
+		int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
+		if ( index>=0 && index < 4 ) {
+			priv->default_key = index;
+		} else
+			/* Don't complain if only change the mode */
+			if(!dwrq->flags & IW_ENCODE_MODE) {
+				return -EINVAL;
+			}
+	}
+	/* Read the flags */
+	if(dwrq->flags & IW_ENCODE_DISABLED) {
+		priv->wep_is_on = 0;
+		priv->encryption_level = 0; 	
+		priv->pairwise_cipher_suite = CIPHER_SUITE_NONE;
+	} else {
+		priv->wep_is_on = 1;
+		if (priv->wep_key_len[priv->default_key] > 5) {
+			priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_128;
+			priv->encryption_level = 2;
+		} else {
+			priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_64;
+			priv->encryption_level = 1;
+		}
+	}
+	if(dwrq->flags & IW_ENCODE_RESTRICTED)
+		priv->exclude_unencrypted = 1;
+	if(dwrq->flags & IW_ENCODE_OPEN)
+		priv->exclude_unencrypted = 0;
+	
+	return -EINPROGRESS;		/* Call commit handler */
+}
+
+
+static int atmel_get_encode(struct net_device *dev,
+			    struct iw_request_info *info,
+			    struct iw_point *dwrq,
+			    char *extra)
+{
+	struct atmel_private *priv = netdev_priv(dev);
+	int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
+	
+	if (!priv->wep_is_on)
+		dwrq->flags = IW_ENCODE_DISABLED;
+	else if (priv->exclude_unencrypted)
+		dwrq->flags = IW_ENCODE_RESTRICTED;
+	else
+		dwrq->flags = IW_ENCODE_OPEN;
+		
+		/* Which key do we want ? -1 -> tx index */
+	if (index < 0 || index >= 4)
+		index = priv->default_key;
+	dwrq->flags |= index + 1;
+	/* Copy the key to the user buffer */
+	dwrq->length = priv->wep_key_len[index];
+	if (dwrq->length > 16) {
+		dwrq->length=0;
+	} else {
+		memset(extra, 0, 16);
+		memcpy(extra, priv->wep_keys[index], dwrq->length);
+	}
+	
+	return 0;
+}
+
+static int atmel_get_name(struct net_device *dev,
+			  struct iw_request_info *info,
+			  char *cwrq,
+			  char *extra)
+{
+	strcpy(cwrq, "IEEE 802.11-DS");
+	return 0;
+}
+
+static int atmel_set_rate(struct net_device *dev,
+			  struct iw_request_info *info,
+			  struct iw_param *vwrq,
+			  char *extra)
+{
+	struct atmel_private *priv = netdev_priv(dev);
+	
+	if (vwrq->fixed == 0) {
+		priv->tx_rate = 3;
+		priv->auto_tx_rate = 1;
+	} else {
+		priv->auto_tx_rate = 0;
+		
+		/* Which type of value ? */
+		if((vwrq->value < 4) && (vwrq->value >= 0)) {
+			/* Setting by rate index */
+		priv->tx_rate = vwrq->value;
+		} else {
+		/* Setting by frequency value */
+			switch (vwrq->value) {
+			case  1000000: priv->tx_rate = 0; break;
+			case  2000000: priv->tx_rate = 1; break;
+			case  5500000: priv->tx_rate = 2; break;
+			case 11000000: priv->tx_rate = 3; break;
+			default: return -EINVAL;
+			}
+		}
+	}
+
+	return -EINPROGRESS;
+}
+
+static int atmel_set_mode(struct net_device *dev,
+			  struct iw_request_info *info,
+			  __u32 *uwrq,
+			  char *extra)
+{
+	struct atmel_private *priv = netdev_priv(dev);
+
+	if (*uwrq != IW_MODE_ADHOC && *uwrq != IW_MODE_INFRA)
+		return -EINVAL;
+
+	priv->operating_mode = *uwrq;
+	return -EINPROGRESS;  
+}
+
+static int atmel_get_mode(struct net_device *dev,
+			  struct iw_request_info *info,
+			  __u32 *uwrq,
+			  char *extra)
+{
+	struct atmel_private *priv = netdev_priv(dev);
+	
+	*uwrq = priv->operating_mode;
+	return 0;
+}
+
+static int atmel_get_rate(struct net_device *dev,
+			 struct iw_request_info *info,
+			 struct iw_param *vwrq,
+			 char *extra)
+{
+	struct atmel_private *priv = netdev_priv(dev);
+
+	if (priv->auto_tx_rate) {
+		vwrq->fixed = 0;
+		vwrq->value = 11000000;
+	} else {
+		vwrq->fixed = 1;
+		switch(priv->tx_rate) {
+		case 0: vwrq->value =  1000000; break;
+		case 1: vwrq->value =  2000000; break;
+		case 2: vwrq->value =  5500000; break;
+		case 3: vwrq->value = 11000000; break;
+		}
+	}
+	return 0;
+}
+
+static int atmel_set_power(struct net_device *dev,
+			   struct iw_request_info *info,
+			   struct iw_param *vwrq,
+			   char *extra)
+{
+	struct atmel_private *priv = netdev_priv(dev);
+	priv->power_mode = vwrq->disabled ? 0 : 1;
+	return -EINPROGRESS;
+}
+
+static int atmel_get_power(struct net_device *dev,
+			   struct iw_request_info *info,
+			   struct iw_param *vwrq,
+			   char *extra)
+{
+	struct atmel_private *priv = netdev_priv(dev);
+	vwrq->disabled = priv->power_mode ? 0 : 1;
+	vwrq->flags = IW_POWER_ON;
+	return 0;
+}
+
+static int atmel_set_retry(struct net_device *dev,
+			   struct iw_request_info *info,
+			   struct iw_param *vwrq,
+			   char *extra)
+{
+	struct atmel_private *priv = netdev_priv(dev);
+	
+	if(!vwrq->disabled && (vwrq->flags & IW_RETRY_LIMIT)) {
+		if(vwrq->flags & IW_RETRY_MAX)
+			priv->long_retry = vwrq->value;
+		else if (vwrq->flags & IW_RETRY_MIN)
+			priv->short_retry = vwrq->value;
+		else {
+			/* No modifier : set both */
+			priv->long_retry = vwrq->value;
+			priv->short_retry = vwrq->value;
+		}
+		return -EINPROGRESS;		
+	}
+	   
+	return -EINVAL;
+}
+
+static int atmel_get_retry(struct net_device *dev,
+			   struct iw_request_info *info,
+			   struct iw_param *vwrq,
+			   char *extra)
+{
+	struct atmel_private *priv = netdev_priv(dev);
+
+	vwrq->disabled = 0;      /* Can't be disabled */
+
+	/* Note : by default, display the min retry number */
+	if((vwrq->flags & IW_RETRY_MAX)) {
+		vwrq->flags = IW_RETRY_LIMIT | IW_RETRY_MAX;
+		vwrq->value = priv->long_retry;
+	} else {
+		vwrq->flags = IW_RETRY_LIMIT;
+		vwrq->value = priv->short_retry;
+		if(priv->long_retry != priv->short_retry)
+			vwrq->flags |= IW_RETRY_MIN;
+	}
+
+	return 0;
+}
+
+static int atmel_set_rts(struct net_device *dev,
+			 struct iw_request_info *info,
+			 struct iw_param *vwrq,
+			 char *extra)
+{
+	struct atmel_private *priv = netdev_priv(dev);
+	int rthr = vwrq->value;
+
+	if(vwrq->disabled)
+		rthr = 2347;
+	if((rthr < 0) || (rthr > 2347)) {
+		return -EINVAL;
+	}
+	priv->rts_threshold = rthr;
+	
+	return -EINPROGRESS;		/* Call commit handler */
+}
+
+static int atmel_get_rts(struct net_device *dev,
+			 struct iw_request_info *info,
+			 struct iw_param *vwrq,
+			 char *extra)
+{
+	struct atmel_private *priv = netdev_priv(dev);
+	
+	vwrq->value = priv->rts_threshold;
+	vwrq->disabled = (vwrq->value >= 2347);
+	vwrq->fixed = 1;
+
+	return 0;
+}
+
+static int atmel_set_frag(struct net_device *dev,
+			  struct iw_request_info *info,
+			  struct iw_param *vwrq,
+			  char *extra)
+{
+	struct atmel_private *priv = netdev_priv(dev);
+	int fthr = vwrq->value;
+
+	if(vwrq->disabled)
+		fthr = 2346;
+	if((fthr < 256) || (fthr > 2346)) {
+		return -EINVAL;
+	}
+	fthr &= ~0x1;	/* Get an even value - is it really needed ??? */
+	priv->frag_threshold = fthr;
+	
+	return -EINPROGRESS;		/* Call commit handler */
+}
+
+static int atmel_get_frag(struct net_device *dev,
+			  struct iw_request_info *info,
+			  struct iw_param *vwrq,
+			  char *extra)
+{
+	struct atmel_private *priv = netdev_priv(dev);
+
+	vwrq->value = priv->frag_threshold;
+	vwrq->disabled = (vwrq->value >= 2346);
+	vwrq->fixed = 1;
+
+	return 0;
+}
+
+static const long frequency_list[] = { 2412, 2417, 2422, 2427, 2432, 2437, 2442,
+				2447, 2452, 2457, 2462, 2467, 2472, 2484 };
+
+static int atmel_set_freq(struct net_device *dev,
+			  struct iw_request_info *info,
+			  struct iw_freq *fwrq,
+			  char *extra)
+{
+	struct atmel_private *priv = netdev_priv(dev);
+	int rc = -EINPROGRESS;		/* Call commit handler */
+	
+	/* If setting by frequency, convert to a channel */
+	if((fwrq->e == 1) &&
+	   (fwrq->m >= (int) 241200000) &&
+	   (fwrq->m <= (int) 248700000)) {
+		int f = fwrq->m / 100000;
+		int c = 0;
+		while((c < 14) && (f != frequency_list[c]))
+			c++;
+		/* Hack to fall through... */
+		fwrq->e = 0;
+		fwrq->m = c + 1;
+	}
+	/* Setting by channel number */
+	if((fwrq->m > 1000) || (fwrq->e > 0))
+		rc = -EOPNOTSUPP;
+	else {
+		int channel = fwrq->m;
+		if (atmel_validate_channel(priv, channel) == 0) {
+			priv->channel = channel;
+		} else {
+			rc = -EINVAL;
+		} 
+	}
+	return rc;
+}
+
+static int atmel_get_freq(struct net_device *dev,
+			  struct iw_request_info *info,
+			  struct iw_freq *fwrq,
+			  char *extra)
+{
+	struct atmel_private *priv = netdev_priv(dev);
+
+	fwrq->m = priv->channel;
+	fwrq->e = 0;
+	return 0;
+}
+
+static int atmel_set_scan(struct net_device *dev,
+			  struct iw_request_info *info,
+			  struct iw_param *vwrq,
+			  char *extra)
+{
+	struct atmel_private *priv = netdev_priv(dev);
+	unsigned long flags;
+
+	/* Note : you may have realised that, as this is a SET operation,
+	 * this is privileged and therefore a normal user can't
+	 * perform scanning.
+	 * This is not an error, while the device perform scanning,
+	 * traffic doesn't flow, so it's a perfect DoS...
+	 * Jean II */
+	
+	if (priv->station_state == STATION_STATE_DOWN)
+		return -EAGAIN;
+
+	/* Timeout old surveys. */
+	if ((jiffies - priv->last_survey) > (20 * HZ))
+		priv->site_survey_state = SITE_SURVEY_IDLE;
+	priv->last_survey = jiffies;
+
+	/* Initiate a scan command */
+	if (priv->site_survey_state == SITE_SURVEY_IN_PROGRESS)
+		return -EBUSY;
+		
+	del_timer_sync(&priv->management_timer);
+	spin_lock_irqsave(&priv->irqlock, flags);
+	
+	priv->site_survey_state = SITE_SURVEY_IN_PROGRESS;
+	priv->fast_scan = 0;
+	atmel_scan(priv, 0);
+	spin_unlock_irqrestore(&priv->irqlock, flags);
+	
+	return 0;
+}
+
+static int atmel_get_scan(struct net_device *dev,
+			  struct iw_request_info *info,
+			  struct iw_point *dwrq,
+			  char *extra)
+{
+	struct atmel_private *priv = netdev_priv(dev);
+	int i;
+	char *current_ev = extra;
+	struct iw_event	iwe;
+	
+	if (priv->site_survey_state != SITE_SURVEY_COMPLETED)
+		return -EAGAIN;
+	
+	for(i=0; i<priv->BSS_list_entries; i++) { 
+		iwe.cmd = SIOCGIWAP;
+		iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
+		memcpy(iwe.u.ap_addr.sa_data, priv->BSSinfo[i].BSSID, 6);
+		current_ev = iwe_stream_add_event(current_ev, extra + IW_SCAN_MAX_DATA, &iwe, IW_EV_ADDR_LEN);
+
+		iwe.u.data.length =  priv->BSSinfo[i].SSIDsize;
+		if (iwe.u.data.length > 32)
+			iwe.u.data.length = 32;
+		iwe.cmd = SIOCGIWESSID;
+		iwe.u.data.flags = 1;
+		current_ev = iwe_stream_add_point(current_ev, extra + IW_SCAN_MAX_DATA, &iwe, priv->BSSinfo[i].SSID);
+		
+		iwe.cmd = SIOCGIWMODE;
+		iwe.u.mode = priv->BSSinfo[i].BSStype;
+		current_ev = iwe_stream_add_event(current_ev, extra + IW_SCAN_MAX_DATA, &iwe, IW_EV_UINT_LEN);
+	
+		iwe.cmd = SIOCGIWFREQ;
+		iwe.u.freq.m = priv->BSSinfo[i].channel;
+		iwe.u.freq.e = 0;
+		current_ev = iwe_stream_add_event(current_ev, extra + IW_SCAN_MAX_DATA, &iwe, IW_EV_FREQ_LEN);
+		
+		iwe.cmd = SIOCGIWENCODE;
+		if (priv->BSSinfo[i].UsingWEP)
+			iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
+		else
+			iwe.u.data.flags = IW_ENCODE_DISABLED;
+		iwe.u.data.length = 0;
+		current_ev = iwe_stream_add_point(current_ev, extra + IW_SCAN_MAX_DATA, &iwe, NULL);
+		
+	}
+
+	/* Length of data */
+	dwrq->length = (current_ev - extra);
+	dwrq->flags = 0;   
+	
+	return 0;
+}
+
+static int atmel_get_range(struct net_device *dev,
+			   struct iw_request_info *info,
+			   struct iw_point *dwrq,
+			   char *extra)
+{
+	struct atmel_private *priv = netdev_priv(dev);
+	struct iw_range *range = (struct iw_range *) extra;
+	int k,i,j;
+
+	dwrq->length = sizeof(struct iw_range);
+	memset(range, 0, sizeof(range));
+	range->min_nwid = 0x0000;
+	range->max_nwid = 0x0000;
+	range->num_channels = 0;
+	for (j = 0; j < sizeof(channel_table)/sizeof(channel_table[0]); j++)
+		if (priv->reg_domain == channel_table[j].reg_domain) {
+			range->num_channels = channel_table[j].max - channel_table[j].min + 1;
+			break;
+		}
+	if (range->num_channels != 0) {
+		for(k = 0, i = channel_table[j].min; i <= channel_table[j].max; i++) {
+			range->freq[k].i = i; /* List index */
+			range->freq[k].m = frequency_list[i-1] * 100000;
+			range->freq[k++].e = 1;	/* Values in table in MHz -> * 10^5 * 10 */
+		}
+		range->num_frequency = k;
+	}
+	
+	range->max_qual.qual = 100;
+	range->max_qual.level = 100;
+	range->max_qual.noise = 0;
+	range->max_qual.updated = IW_QUAL_NOISE_INVALID;
+
+	range->avg_qual.qual = 50;
+	range->avg_qual.level = 50;
+	range->avg_qual.noise = 0;
+	range->avg_qual.updated = IW_QUAL_NOISE_INVALID;
+
+	range->sensitivity = 0;
+
+	range->bitrate[0] =  1000000;
+	range->bitrate[1] =  2000000;
+	range->bitrate[2] =  5500000;
+	range->bitrate[3] = 11000000;
+	range->num_bitrates = 4;
+
+	range->min_rts = 0;
+	range->max_rts = 2347;
+	range->min_frag = 256;
+	range->max_frag = 2346;
+
+	range->encoding_size[0] = 5;
+	range->encoding_size[1] = 13;
+	range->num_encoding_sizes = 2;
+	range->max_encoding_tokens = 4;
+	
+	range->pmp_flags = IW_POWER_ON;
+	range->pmt_flags = IW_POWER_ON;
+	range->pm_capa = 0;
+	
+	range->we_version_source = WIRELESS_EXT;
+	range->we_version_compiled = WIRELESS_EXT;
+	range->retry_capa = IW_RETRY_LIMIT ;
+	range->retry_flags = IW_RETRY_LIMIT;
+	range->r_time_flags = 0;
+	range->min_retry = 1;
+	range->max_retry = 65535;
+
+	return 0;
+}
+
+static int atmel_set_wap(struct net_device *dev,
+			 struct iw_request_info *info,
+			 struct sockaddr *awrq,
+			 char *extra)
+{
+	struct atmel_private *priv = netdev_priv(dev);
+	int i;
+	static const u8 bcast[] = { 255, 255, 255, 255, 255, 255 };
+	unsigned long flags;
+
+	if (awrq->sa_family != ARPHRD_ETHER)
+		return -EINVAL;
+	
+	if (memcmp(bcast, awrq->sa_data, 6) == 0) {
+		del_timer_sync(&priv->management_timer);
+		spin_lock_irqsave(&priv->irqlock, flags);
+		atmel_scan(priv, 1);
+		spin_unlock_irqrestore(&priv->irqlock, flags);
+		return 0;
+	}
+	
+	for(i=0; i<priv->BSS_list_entries; i++) {
+		if (memcmp(priv->BSSinfo[i].BSSID, awrq->sa_data, 6) == 0) {
+			if (!priv->wep_is_on && priv->BSSinfo[i].UsingWEP) {
+				return -EINVAL;
+			} else if  (priv->wep_is_on && !priv->BSSinfo[i].UsingWEP) {
+				return -EINVAL;
+			} else {
+				del_timer_sync(&priv->management_timer);
+				spin_lock_irqsave(&priv->irqlock, flags);
+				atmel_join_bss(priv, i);
+				spin_unlock_irqrestore(&priv->irqlock, flags);
+				return 0;
+			}
+		}
+	}
+		
+	return -EINVAL;
+}
+	
+static int atmel_config_commit(struct net_device *dev,
+			       struct iw_request_info *info,	/* NULL */
+			       void *zwrq,			/* NULL */
+			       char *extra)			/* NULL */
+{
+	return atmel_open(dev);
+}
+
+static const iw_handler		atmel_handler[] =
+{
+	(iw_handler) atmel_config_commit,	/* SIOCSIWCOMMIT */
+	(iw_handler) atmel_get_name,    	/* SIOCGIWNAME */
+	(iw_handler) NULL,			/* SIOCSIWNWID */
+	(iw_handler) NULL,			/* SIOCGIWNWID */
+	(iw_handler) atmel_set_freq,		/* SIOCSIWFREQ */
+	(iw_handler) atmel_get_freq,		/* SIOCGIWFREQ */
+	(iw_handler) atmel_set_mode,		/* SIOCSIWMODE */
+	(iw_handler) atmel_get_mode,		/* SIOCGIWMODE */
+	(iw_handler) NULL,                  	/* SIOCSIWSENS */
+	(iw_handler) NULL,           		/* SIOCGIWSENS */
+	(iw_handler) NULL,			/* SIOCSIWRANGE */
+	(iw_handler) atmel_get_range,           /* SIOCGIWRANGE */
+	(iw_handler) NULL,			/* SIOCSIWPRIV */
+	(iw_handler) NULL,			/* SIOCGIWPRIV */
+	(iw_handler) NULL,			/* SIOCSIWSTATS */
+	(iw_handler) NULL,			/* SIOCGIWSTATS */
+	(iw_handler) NULL,			/* SIOCSIWSPY */
+	(iw_handler) NULL,			/* SIOCGIWSPY */
+	(iw_handler) NULL,			/* -- hole -- */
+	(iw_handler) NULL,			/* -- hole -- */
+	(iw_handler) atmel_set_wap,		/* SIOCSIWAP */
+	(iw_handler) atmel_get_wap,		/* SIOCGIWAP */
+	(iw_handler) NULL,			/* -- hole -- */
+	(iw_handler) NULL,       		/* SIOCGIWAPLIST */
+	(iw_handler) atmel_set_scan,		/* SIOCSIWSCAN */
+	(iw_handler) atmel_get_scan,		/* SIOCGIWSCAN */
+	(iw_handler) atmel_set_essid,		/* SIOCSIWESSID */
+	(iw_handler) atmel_get_essid,		/* SIOCGIWESSID */
+	(iw_handler) NULL,         		/* SIOCSIWNICKN */
+	(iw_handler) NULL,          		/* SIOCGIWNICKN */
+	(iw_handler) NULL,			/* -- hole -- */
+	(iw_handler) NULL,			/* -- hole -- */
+	(iw_handler) atmel_set_rate,		/* SIOCSIWRATE */
+	(iw_handler) atmel_get_rate,		/* SIOCGIWRATE */
+	(iw_handler) atmel_set_rts,		/* SIOCSIWRTS */
+	(iw_handler) atmel_get_rts,		/* SIOCGIWRTS */
+	(iw_handler) atmel_set_frag,		/* SIOCSIWFRAG */
+	(iw_handler) atmel_get_frag,		/* SIOCGIWFRAG */
+	(iw_handler) NULL,         		/* SIOCSIWTXPOW */
+	(iw_handler) NULL,          		/* SIOCGIWTXPOW */
+	(iw_handler) atmel_set_retry,		/* SIOCSIWRETRY */
+	(iw_handler) atmel_get_retry,		/* SIOCGIWRETRY */
+	(iw_handler) atmel_set_encode,		/* SIOCSIWENCODE */
+	(iw_handler) atmel_get_encode,		/* SIOCGIWENCODE */
+	(iw_handler) atmel_set_power,		/* SIOCSIWPOWER */
+	(iw_handler) atmel_get_power,		/* SIOCGIWPOWER */
+};
+
+
+static const iw_handler		atmel_private_handler[] =
+{
+	NULL,				/* SIOCIWFIRSTPRIV */
+};
+
+typedef struct atmel_priv_ioctl {
+	char id[32];
+	unsigned char __user *data;		
+	unsigned short len;		
+} atmel_priv_ioctl;
+
+	
+#define ATMELFWL SIOCIWFIRSTPRIV
+#define ATMELIDIFC ATMELFWL + 1
+#define ATMELRD ATMELFWL + 2
+#define ATMELMAGIC 0x51807 
+#define REGDOMAINSZ 20
+
+static const struct iw_priv_args atmel_private_args[] = {
+/*{ cmd,         set_args,                            get_args, name } */
+  { ATMELFWL, IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | sizeof (atmel_priv_ioctl), IW_PRIV_TYPE_NONE, "atmelfwl" },
+  { ATMELIDIFC, IW_PRIV_TYPE_NONE, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "atmelidifc" },
+  { ATMELRD, IW_PRIV_TYPE_CHAR | REGDOMAINSZ, IW_PRIV_TYPE_NONE, "regdomain" },
+};
+
+static const struct iw_handler_def	atmel_handler_def =
+{
+	.num_standard	= sizeof(atmel_handler)/sizeof(iw_handler),
+	.num_private	= sizeof(atmel_private_handler)/sizeof(iw_handler), 
+	.num_private_args = sizeof(atmel_private_args)/sizeof(struct iw_priv_args), 
+	.standard	= (iw_handler *) atmel_handler,
+	.private	= (iw_handler *) atmel_private_handler, 
+	.private_args	= (struct iw_priv_args *) atmel_private_args
+};
+
+static int atmel_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
+{
+	int i, rc = 0;
+	struct atmel_private *priv = netdev_priv(dev);
+	atmel_priv_ioctl com;
+	struct iwreq *wrq = (struct iwreq *) rq;
+	unsigned char *new_firmware;
+	char domain[REGDOMAINSZ+1];
+
+	switch (cmd) {
+	case SIOCGIWPRIV:
+		if(wrq->u.data.pointer) {
+			/* Set the number of ioctl available */
+			wrq->u.data.length = sizeof(atmel_private_args) / sizeof(atmel_private_args[0]);
+			
+			/* Copy structure to the user buffer */
+			if (copy_to_user(wrq->u.data.pointer,
+					 (u_char *) atmel_private_args,
+					 sizeof(atmel_private_args)))
+				rc = -EFAULT;
+		}
+		break;
+
+	case ATMELIDIFC:
+		wrq->u.param.value = ATMELMAGIC;		
+		break;
+	
+	case ATMELFWL:
+		if (copy_from_user(&com, rq->ifr_data, sizeof(com))) {
+			rc = -EFAULT;
+			break;
+		}
+
+		if (!capable(CAP_NET_ADMIN)) {
+			rc = -EPERM;
+			break;
+		}
+
+		if (!(new_firmware = kmalloc(com.len, GFP_KERNEL))) {
+			rc = -ENOMEM;
+			break;
+		}
+
+		if (copy_from_user(new_firmware, com.data, com.len)) {
+			kfree(new_firmware);
+			rc = -EFAULT;
+			break;
+		}
+
+		if (priv->firmware)
+			kfree(priv->firmware);
+		
+		priv->firmware = new_firmware;
+		priv->firmware_length = com.len;
+		strncpy(priv->firmware_id, com.id, 31);
+		priv->firmware_id[31] = '\0';
+		break;
+
+	case ATMELRD:
+		if (copy_from_user(domain, rq->ifr_data, REGDOMAINSZ)) {
+			rc = -EFAULT;
+			break;
+		}
+		
+		if (!capable(CAP_NET_ADMIN)) {
+			rc = -EPERM;
+			break;
+		}
+
+		domain[REGDOMAINSZ] = 0;
+		rc = -EINVAL;
+		for (i = 0; i < sizeof(channel_table)/sizeof(channel_table[0]); i++) {
+			/* strcasecmp doesn't exist in the library */
+			char *a = channel_table[i].name;
+			char *b = domain;
+			while (*a) {
+				char c1 = *a++;
+				char c2 = *b++;
+				if (tolower(c1) != tolower(c2))
+					break;
+			}
+			if (!*a && !*b) {
+				priv->config_reg_domain = channel_table[i].reg_domain;
+				rc = 0;
+			}
+		}
+		
+		if (rc == 0 &&  priv->station_state != STATION_STATE_DOWN)
+			rc = atmel_open(dev);
+		break;
+		
+	default:
+		rc = -EOPNOTSUPP;
+	}
+	
+	return rc;
+}
+
+struct auth_body {
+	u16 alg;
+	u16 trans_seq;
+	u16 status;
+	u8 el_id;
+	u8 chall_text_len;
+	u8 chall_text[253];
+}; 
+
+static void atmel_enter_state(struct atmel_private *priv, int new_state)
+{
+	int old_state = priv->station_state;
+		
+	if (new_state == old_state)
+		return;
+	
+	priv->station_state = new_state;
+		
+	if (new_state == STATION_STATE_READY) {
+		netif_start_queue(priv->dev);
+		netif_carrier_on(priv->dev);
+	}
+
+	if (old_state == STATION_STATE_READY) {
+		netif_carrier_off(priv->dev);
+		if (netif_running(priv->dev))
+			netif_stop_queue(priv->dev);
+		priv->last_beacon_timestamp = 0;
+	}
+}
+
+static void atmel_scan(struct atmel_private *priv, int specific_ssid)
+{
+	struct {
+		u8 BSSID[6];
+		u8 SSID[MAX_SSID_LENGTH];
+		u8 scan_type;
+		u8 channel;
+		u16 BSS_type;
+		u16 min_channel_time;
+		u16 max_channel_time;
+		u8 options;
+		u8 SSID_size;
+	} cmd;
+	
+	memset(cmd.BSSID, 0xff, 6);
+
+	if (priv->fast_scan) {
+		cmd.SSID_size = priv->SSID_size;
+		memcpy(cmd.SSID, priv->SSID, priv->SSID_size);
+		cmd.min_channel_time = cpu_to_le16(10);
+		cmd.max_channel_time = cpu_to_le16(50);
+	} else {
+		priv->BSS_list_entries = 0;
+		cmd.SSID_size = 0;
+		cmd.min_channel_time = cpu_to_le16(10);
+		cmd.max_channel_time = cpu_to_le16(120);
+	}
+	
+	cmd.options = 0;
+	
+	if (!specific_ssid)
+		cmd.options |= SCAN_OPTIONS_SITE_SURVEY;
+	
+	cmd.channel = (priv->channel & 0x7f); 
+	cmd.scan_type = SCAN_TYPE_ACTIVE;
+	cmd.BSS_type = cpu_to_le16(priv->operating_mode == IW_MODE_ADHOC ? 
+		BSS_TYPE_AD_HOC : BSS_TYPE_INFRASTRUCTURE);
+	
+	atmel_send_command(priv, CMD_Scan, &cmd, sizeof(cmd));
+
+	/* This must come after all hardware access to avoid being messed up
+	   by stuff happening in interrupt context after we leave STATE_DOWN */
+	atmel_enter_state(priv, STATION_STATE_SCANNING);
+}
+
+static void join(struct atmel_private *priv, int type)
+{
+	struct {
+		u8 BSSID[6];
+		u8 SSID[MAX_SSID_LENGTH];
+		u8 BSS_type; /* this is a short in a scan command - weird */
+		u8 channel;
+		u16 timeout;
+		u8 SSID_size;
+		u8 reserved;
+	} cmd;
+
+	cmd.SSID_size = priv->SSID_size;
+	memcpy(cmd.SSID, priv->SSID, priv->SSID_size);
+	memcpy(cmd.BSSID, priv->CurrentBSSID, 6);
+	cmd.channel = (priv->channel & 0x7f);
+	cmd.BSS_type = type;
+	cmd.timeout = cpu_to_le16(2000);
+
+ 	atmel_send_command(priv, CMD_Join, &cmd, sizeof(cmd));
+}
+
+
+static void start(struct atmel_private *priv, int type)
+{
+	struct {
+		u8 BSSID[6];
+		u8 SSID[MAX_SSID_LENGTH];
+		u8 BSS_type;                                
+		u8 channel;
+		u8 SSID_size;
+		u8 reserved[3];
+	} cmd;
+
+	cmd.SSID_size = priv->SSID_size;
+	memcpy(cmd.SSID, priv->SSID, priv->SSID_size);
+	memcpy(cmd.BSSID, priv->BSSID, 6);
+	cmd.BSS_type = type;
+	cmd.channel = (priv->channel & 0x7f);
+
+	atmel_send_command(priv, CMD_Start, &cmd, sizeof(cmd)); 
+}
+
+static void handle_beacon_probe(struct atmel_private *priv, u16 capability, u8 channel)
+{
+	int rejoin = 0;
+	int new = capability  & C80211_MGMT_CAPABILITY_ShortPreamble ? 
+		SHORT_PREAMBLE : LONG_PREAMBLE;
+
+	if (priv->preamble != new) {
+		priv->preamble = new;
+		rejoin = 1;
+		atmel_set_mib8(priv, Local_Mib_Type, LOCAL_MIB_PREAMBLE_TYPE, new);
+	}
+		
+	if (priv->channel != channel) {
+		priv->channel = channel;
+		rejoin = 1;
+		atmel_set_mib8(priv, Phy_Mib_Type, PHY_MIB_CHANNEL_POS, channel);
+	}
+	
+	if (rejoin) {
+		priv->station_is_associated = 0;
+		atmel_enter_state(priv, STATION_STATE_JOINNING);
+		
+		if (priv->operating_mode == IW_MODE_INFRA)
+			join(priv, BSS_TYPE_INFRASTRUCTURE);
+		else 
+			join(priv, BSS_TYPE_AD_HOC);
+	} 
+}
+
+ 
+static void send_authentication_request(struct atmel_private *priv, u8 *challenge, int challenge_len)
+{
+	struct ieee802_11_hdr header;
+	struct auth_body auth;
+	
+	header.frame_ctl = cpu_to_le16(IEEE802_11_FTYPE_MGMT | IEEE802_11_STYPE_AUTH); 
+	header.duration_id	= cpu_to_le16(0x8000);	
+	header.seq_ctl = 0;
+	memcpy(header.addr1, priv->CurrentBSSID, 6);
+	memcpy(header.addr2, priv->dev->dev_addr, 6);
+	memcpy(header.addr3, priv->CurrentBSSID, 6);
+	
+	if (priv->wep_is_on) {
+		auth.alg = cpu_to_le16(C80211_MGMT_AAN_SHAREDKEY); 
+		/* no WEP for authentication frames with TrSeqNo 1 */
+		if (priv->CurrentAuthentTransactionSeqNum != 1)
+			header.frame_ctl |=  cpu_to_le16(IEEE802_11_FCTL_WEP); 
+	} else {
+		auth.alg = cpu_to_le16(C80211_MGMT_AAN_OPENSYSTEM);
+	}
+
+	auth.status = 0;
+	auth.trans_seq = cpu_to_le16(priv->CurrentAuthentTransactionSeqNum);
+	priv->ExpectedAuthentTransactionSeqNum = priv->CurrentAuthentTransactionSeqNum+1; 
+	priv->CurrentAuthentTransactionSeqNum += 2;
+	
+	if (challenge_len != 0)	{
+		auth.el_id = 16; /* challenge_text */
+		auth.chall_text_len = challenge_len;
+		memcpy(auth.chall_text, challenge, challenge_len);
+		atmel_transmit_management_frame(priv, &header, (u8 *)&auth, 8 + challenge_len);
+	} else {
+		atmel_transmit_management_frame(priv, &header, (u8 *)&auth, 6);
+	}
+}
+
+static void send_association_request(struct atmel_private *priv, int is_reassoc)
+{
+	u8 *ssid_el_p;
+	int bodysize;
+	struct ieee802_11_hdr header;
+	struct ass_req_format {
+		u16 capability;
+		u16 listen_interval; 
+		u8 ap[6]; /* nothing after here directly accessible */
+		u8 ssid_el_id;
+		u8 ssid_len;
+		u8 ssid[MAX_SSID_LENGTH];
+		u8 sup_rates_el_id;
+		u8 sup_rates_len;
+		u8 rates[4];
+	} body;
+		
+	header.frame_ctl = cpu_to_le16(IEEE802_11_FTYPE_MGMT | 
+		(is_reassoc ? IEEE802_11_STYPE_REASSOC_REQ : IEEE802_11_STYPE_ASSOC_REQ));
+	header.duration_id = cpu_to_le16(0x8000);
+	header.seq_ctl = 0;
+
+	memcpy(header.addr1, priv->CurrentBSSID, 6); 
+	memcpy(header.addr2, priv->dev->dev_addr, 6);
+	memcpy(header.addr3, priv->CurrentBSSID, 6); 
+
+	body.capability = cpu_to_le16(C80211_MGMT_CAPABILITY_ESS);
+	if (priv->wep_is_on)
+		body.capability |= cpu_to_le16(C80211_MGMT_CAPABILITY_Privacy);
+	if (priv->preamble == SHORT_PREAMBLE)
+		body.capability |= cpu_to_le16(C80211_MGMT_CAPABILITY_ShortPreamble);
+
+	body.listen_interval = cpu_to_le16(priv->listen_interval * priv->beacon_period);
+	
+	/* current AP address - only in reassoc frame */
+	if (is_reassoc) {
+		memcpy(body.ap,  priv->CurrentBSSID, 6);
+		ssid_el_p = (u8 *)&body.ssid_el_id;
+		bodysize = 18 + priv->SSID_size;
+	} else {
+		ssid_el_p = (u8 *)&body.ap[0];
+		bodysize = 12 + priv->SSID_size;
+	}
+		
+	ssid_el_p[0]= C80211_MGMT_ElementID_SSID;
+	ssid_el_p[1] = priv->SSID_size;
+	memcpy(ssid_el_p + 2, priv->SSID, priv->SSID_size);
+	ssid_el_p[2 + priv->SSID_size] = C80211_MGMT_ElementID_SupportedRates;
+	ssid_el_p[3 + priv->SSID_size] = 4; /* len of suported rates */
+	memcpy(ssid_el_p + 4 + priv->SSID_size, atmel_basic_rates, 4);
+
+	atmel_transmit_management_frame(priv, &header, (void *)&body, bodysize);
+}
+
+static int is_frame_from_current_bss(struct atmel_private *priv, struct ieee802_11_hdr *header)
+{
+	if (le16_to_cpu(header->frame_ctl) & IEEE802_11_FCTL_FROMDS)
+		return memcmp(header->addr3, priv->CurrentBSSID, 6) == 0;
+	else
+		return memcmp(header->addr2, priv->CurrentBSSID, 6) == 0;
+}
+
+static int retrieve_bss(struct atmel_private *priv)
+{
+	int i;
+	int max_rssi = -128;
+	int max_index = -1;
+	
+	if (priv->BSS_list_entries == 0)
+		return -1;
+			
+	if (priv->connect_to_any_BSS) {
+		/* Select a BSS with the max-RSSI but of the same type and of the same WEP mode
+		   and that it is not marked as 'bad' (i.e. we had previously failed to connect to
+		   this BSS with the settings that we currently use) */
+		priv->current_BSS = 0;
+		for(i=0; i<priv->BSS_list_entries; i++) { 
+			if (priv->operating_mode == priv->BSSinfo[i].BSStype &&
+			    ((!priv->wep_is_on && !priv->BSSinfo[i].UsingWEP) || 
+			     (priv->wep_is_on && priv->BSSinfo[i].UsingWEP)) &&
+			    !(priv->BSSinfo[i].channel & 0x80)) {
+				max_rssi = priv->BSSinfo[i].RSSI;
+				priv->current_BSS = max_index = i;
+			}
+			
+		}
+		return max_index;
+	}
+		
+	for(i=0; i<priv->BSS_list_entries; i++) {
+		if (priv->SSID_size == priv->BSSinfo[i].SSIDsize &&
+		    memcmp(priv->SSID, priv->BSSinfo[i].SSID, priv->SSID_size) == 0 &&
+		    priv->operating_mode == priv->BSSinfo[i].BSStype &&
+		    atmel_validate_channel(priv, priv->BSSinfo[i].channel) == 0) {
+			if (priv->BSSinfo[i].RSSI >= max_rssi) {
+				max_rssi = priv->BSSinfo[i].RSSI;
+				max_index = i;
+			}
+		}
+	}
+	return max_index;
+}
+
+
+static void store_bss_info(struct atmel_private *priv, struct ieee802_11_hdr *header,
+			   u16 capability, u16 beacon_period, u8 channel, u8 rssi, 
+			   u8 ssid_len, u8 *ssid, int is_beacon)
+{
+	u8 *bss = capability & C80211_MGMT_CAPABILITY_ESS ? header->addr2 : header->addr3;
+	int i, index;
+		
+	for (index = -1, i = 0; i < priv->BSS_list_entries; i++) 
+		if (memcmp(bss, priv->BSSinfo[i].BSSID, 6) == 0) 
+			index = i;
+
+        /* If we process a probe and an entry from this BSS exists 
+	   we will update the BSS entry with the info from this BSS.
+	   If we process a beacon we will only update RSSI */
+
+	if (index == -1) {
+		if (priv->BSS_list_entries == MAX_BSS_ENTRIES)
+			return;
+		index = priv->BSS_list_entries++;
+		memcpy(priv->BSSinfo[index].BSSID, bss, 6);
+		priv->BSSinfo[index].RSSI = rssi;
+	} else {
+		if (rssi > priv->BSSinfo[index].RSSI)
+			priv->BSSinfo[index].RSSI = rssi;
+		if (is_beacon)
+			return;
+	}
+
+	priv->BSSinfo[index].channel = channel;
+	priv->BSSinfo[index].beacon_period = beacon_period;
+	priv->BSSinfo[index].UsingWEP = capability & C80211_MGMT_CAPABILITY_Privacy;
+	memcpy(priv->BSSinfo[index].SSID, ssid, ssid_len);
+	priv->BSSinfo[index].SSIDsize = ssid_len;
+
+	if (capability & C80211_MGMT_CAPABILITY_IBSS)
+		priv->BSSinfo[index].BSStype = IW_MODE_ADHOC;
+	else if (capability & C80211_MGMT_CAPABILITY_ESS)
+		priv->BSSinfo[index].BSStype =IW_MODE_INFRA;
+	
+	priv->BSSinfo[index].preamble = capability  & C80211_MGMT_CAPABILITY_ShortPreamble ? 
+		SHORT_PREAMBLE : LONG_PREAMBLE;
+}
+
+static void authenticate(struct atmel_private *priv, u16 frame_len)
+{
+	struct auth_body *auth = (struct auth_body *)priv->rx_buf;
+	u16 status = le16_to_cpu(auth->status);
+	u16 trans_seq_no = le16_to_cpu(auth->trans_seq);
+	
+	if (status == C80211_MGMT_SC_Success && !priv->wep_is_on) { 
+		/* no WEP */
+		if (priv->station_was_associated) {
+			atmel_enter_state(priv, STATION_STATE_REASSOCIATING);
+			send_association_request(priv, 1);
+			return;
+		} else {
+			atmel_enter_state(priv, STATION_STATE_ASSOCIATING);
+			send_association_request(priv, 0);
+			return;
+		} 
+	}
+		
+	if (status == C80211_MGMT_SC_Success && priv->wep_is_on) { 
+		/* WEP */
+		if (trans_seq_no != priv->ExpectedAuthentTransactionSeqNum)
+			return;
+				
+		if (trans_seq_no == 0x0002 &&
+		    auth->el_id == C80211_MGMT_ElementID_ChallengeText) {
+			send_authentication_request(priv, auth->chall_text, auth->chall_text_len);
+			return;
+		}
+		
+		if (trans_seq_no == 0x0004) {
+			if(priv->station_was_associated) {
+				atmel_enter_state(priv, STATION_STATE_REASSOCIATING);
+				send_association_request(priv, 1);
+				return;
+			} else {
+				atmel_enter_state(priv, STATION_STATE_ASSOCIATING);
+				send_association_request(priv, 0);
+				return;
+			} 
+		}
+	}			
+	
+	if (status == C80211_MGMT_SC_AuthAlgNotSupported && priv->connect_to_any_BSS) {
+		int bss_index;
+		
+		priv->BSSinfo[(int)(priv->current_BSS)].channel |= 0x80;
+		
+		if ((bss_index  = retrieve_bss(priv)) != -1) {
+			atmel_join_bss(priv, bss_index);
+			return;
+		}
+	}
+	
+	
+	priv->AuthenticationRequestRetryCnt = 0;
+	atmel_enter_state(priv,  STATION_STATE_MGMT_ERROR);
+	priv->station_is_associated = 0;
+}
+
+static void associate(struct atmel_private *priv, u16 frame_len, u16 subtype)
+{
+	struct ass_resp_format {
+		u16 capability;
+		u16 status;
+		u16 ass_id;
+		u8 el_id;
+		u8 length;
+		u8 rates[4];
+	} *ass_resp = (struct ass_resp_format *)priv->rx_buf;
+	
+       	u16 status = le16_to_cpu(ass_resp->status);
+	u16 ass_id = le16_to_cpu(ass_resp->ass_id);
+   	u16 rates_len = ass_resp->length > 4 ? 4 : ass_resp->length;
+	
+	if (frame_len < 8 + rates_len)
+		return;
+	
+	if (status == C80211_MGMT_SC_Success) {
+		if (subtype == C80211_SUBTYPE_MGMT_ASS_RESPONSE)
+			priv->AssociationRequestRetryCnt = 0;
+		else
+			priv->ReAssociationRequestRetryCnt = 0;
+		
+		atmel_set_mib16(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_STATION_ID_POS, ass_id & 0x3fff);
+		atmel_set_mib(priv, Phy_Mib_Type, PHY_MIB_RATE_SET_POS, ass_resp->rates, rates_len);
+		if (priv->power_mode == 0) {
+			priv->listen_interval = 1;
+			atmel_set_mib8(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_PS_MODE_POS,  ACTIVE_MODE);
+			atmel_set_mib16(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_LISTEN_INTERVAL_POS, 1);
+		} else {
+			priv->listen_interval = 2;
+			atmel_set_mib8(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_PS_MODE_POS,  PS_MODE);
+			atmel_set_mib16(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_LISTEN_INTERVAL_POS, 2);
+		}
+		
+		priv->station_is_associated = 1;
+		priv->station_was_associated = 1;
+		atmel_enter_state(priv, STATION_STATE_READY);
+		return;
+	}
+	
+	if (subtype == C80211_SUBTYPE_MGMT_ASS_RESPONSE &&
+	    status != C80211_MGMT_SC_AssDeniedBSSRate &&
+	    status != C80211_MGMT_SC_SupportCapabilities &&
+	    priv->AssociationRequestRetryCnt < MAX_ASSOCIATION_RETRIES) {
+		mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
+		priv->AssociationRequestRetryCnt++;
+		send_association_request(priv, 0);
+		return;
+	}
+		
+	if (subtype == C80211_SUBTYPE_MGMT_REASS_RESPONSE &&
+	    status != C80211_MGMT_SC_AssDeniedBSSRate &&
+	    status != C80211_MGMT_SC_SupportCapabilities &&
+	    priv->AssociationRequestRetryCnt < MAX_ASSOCIATION_RETRIES) {
+		mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
+		priv->ReAssociationRequestRetryCnt++;
+		send_association_request(priv, 1);
+		return;
+	}
+	
+	atmel_enter_state(priv,  STATION_STATE_MGMT_ERROR);
+	priv->station_is_associated = 0;
+	
+	if(priv->connect_to_any_BSS) {
+		int bss_index;
+		priv->BSSinfo[(int)(priv->current_BSS)].channel |= 0x80;
+		
+		if ((bss_index = retrieve_bss(priv)) != -1) 
+			atmel_join_bss(priv, bss_index);
+		
+	}
+}
+
+void atmel_join_bss(struct atmel_private *priv, int bss_index)
+{
+	struct bss_info *bss =  &priv->BSSinfo[bss_index];
+
+	memcpy(priv->CurrentBSSID, bss->BSSID, 6);
+	memcpy(priv->SSID, bss->SSID, priv->SSID_size = bss->SSIDsize);
+
+	/* The WPA stuff cares about the current AP address */
+	if (priv->use_wpa)
+		build_wpa_mib(priv);
+	
+	/* When switching to AdHoc turn OFF Power Save if needed */
+
+	if (bss->BSStype == IW_MODE_ADHOC &&
+	    priv->operating_mode != IW_MODE_ADHOC &&
+	    priv->power_mode) {
+		priv->power_mode = 0;
+		priv->listen_interval = 1;
+		atmel_set_mib8(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_PS_MODE_POS,  ACTIVE_MODE);
+		atmel_set_mib16(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_LISTEN_INTERVAL_POS, 1);
+	}
+		
+	priv->operating_mode = bss->BSStype;
+	priv->channel = bss->channel & 0x7f; 	
+	priv->beacon_period = bss->beacon_period;
+	
+	if (priv->preamble != bss->preamble) {
+		priv->preamble = bss->preamble;
+		atmel_set_mib8(priv, Local_Mib_Type, LOCAL_MIB_PREAMBLE_TYPE, bss->preamble);
+	}
+	
+	if (!priv->wep_is_on && bss->UsingWEP) {
+		atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
+		priv->station_is_associated = 0;
+		return;
+	}
+		
+	if (priv->wep_is_on && !bss->UsingWEP) {
+		atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
+		priv->station_is_associated = 0;
+		return;
+	}
+
+	atmel_enter_state(priv, STATION_STATE_JOINNING);
+	
+	if (priv->operating_mode == IW_MODE_INFRA)
+		join(priv, BSS_TYPE_INFRASTRUCTURE);
+	else 
+		join(priv, BSS_TYPE_AD_HOC);
+}
+
+
+static void restart_search(struct atmel_private *priv)
+{
+	int bss_index;
+	
+	if (!priv->connect_to_any_BSS) {
+		atmel_scan(priv, 1);
+	} else {
+		priv->BSSinfo[(int)(priv->current_BSS)].channel |= 0x80;
+		
+		if ((bss_index = retrieve_bss(priv)) != -1) 
+			atmel_join_bss(priv, bss_index);
+		else
+			atmel_scan(priv, 0);
+		
+	} 
+}	
+
+static void smooth_rssi(struct atmel_private *priv, u8 rssi)
+{
+	u8 old = priv->wstats.qual.level;
+	u8 max_rssi = 42; /* 502-rmfd-revd max by experiment, default for now */
+
+	switch (priv->firmware_type) {
+		case ATMEL_FW_TYPE_502E:
+			max_rssi = 63; /* 502-rmfd-reve max by experiment */
+			break;
+		default:
+			break;
+	}
+
+	rssi = rssi * 100 / max_rssi;
+	if((rssi + old) % 2)
+		priv->wstats.qual.level =  ((rssi + old)/2) + 1;
+	else
+		priv->wstats.qual.level =  ((rssi + old)/2);		
+	priv->wstats.qual.updated |= IW_QUAL_LEVEL_UPDATED;
+	priv->wstats.qual.updated &= ~IW_QUAL_LEVEL_INVALID;
+}
+
+static void atmel_smooth_qual(struct atmel_private *priv)
+{
+	unsigned long time_diff = (jiffies - priv->last_qual)/HZ;
+	while (time_diff--) {
+		priv->last_qual += HZ;
+		priv->wstats.qual.qual = priv->wstats.qual.qual/2;
+		priv->wstats.qual.qual += 
+			priv->beacons_this_sec * priv->beacon_period * (priv->wstats.qual.level + 100) / 4000;
+		priv->beacons_this_sec = 0;
+	}
+	priv->wstats.qual.updated |= IW_QUAL_QUAL_UPDATED;
+	priv->wstats.qual.updated &= ~IW_QUAL_QUAL_INVALID;
+}
+
+/* deals with incoming managment frames. */
+static void atmel_management_frame(struct atmel_private *priv, struct ieee802_11_hdr *header, 
+		      u16 frame_len, u8 rssi)
+{
+	u16 subtype;
+	
+	switch (subtype = le16_to_cpu(header->frame_ctl) & IEEE802_11_FCTL_STYPE) {
+	case C80211_SUBTYPE_MGMT_BEACON :
+	case C80211_SUBTYPE_MGMT_ProbeResponse:
+		
+		/* beacon frame has multiple variable-length fields -
+		   never let an engineer loose with a data structure design. */
+		{
+			struct beacon_format {
+				u64 timestamp;
+				u16 interval;
+				u16 capability;
+				u8 ssid_el_id;
+				u8 ssid_length;
+				/* ssid here */
+				u8 rates_el_id;
+				u8 rates_length;
+				/* rates here */
+				u8 ds_el_id;
+				u8 ds_length;
+				/* ds here */
+			} *beacon = (struct beacon_format *)priv->rx_buf;
+			
+			u8 channel, rates_length, ssid_length;
+			u64 timestamp = le64_to_cpu(beacon->timestamp);
+			u16 beacon_interval = le16_to_cpu(beacon->interval);
+			u16 capability = le16_to_cpu(beacon->capability);
+			u8 *beaconp = priv->rx_buf;
+			ssid_length = beacon->ssid_length;
+			/* this blows chunks. */
+			if (frame_len < 14 || frame_len < ssid_length + 15) 
+				return;
+			rates_length = beaconp[beacon->ssid_length + 15];
+			if (frame_len < ssid_length + rates_length + 18)
+				return;
+			if (ssid_length >  MAX_SSID_LENGTH)
+				return;
+			channel = beaconp[ssid_length + rates_length + 18];
+		       
+			if (priv->station_state == STATION_STATE_READY) {
+				smooth_rssi(priv, rssi);
+				if (is_frame_from_current_bss(priv, header)) { 
+					priv->beacons_this_sec++;
+					atmel_smooth_qual(priv);
+					if (priv->last_beacon_timestamp) {
+						/* Note truncate this to 32 bits - kernel can't divide a long long */
+						u32 beacon_delay = timestamp - priv->last_beacon_timestamp;
+						int beacons = beacon_delay / (beacon_interval * 1000);
+						if (beacons > 1)
+							priv->wstats.miss.beacon += beacons - 1;
+					}
+					priv->last_beacon_timestamp = timestamp;
+					handle_beacon_probe(priv, capability, channel);
+				}
+			}
+			
+			if (priv->station_state == STATION_STATE_SCANNING ) 
+				store_bss_info(priv, header, capability, beacon_interval, channel,
+					       rssi, ssid_length, &beacon->rates_el_id,
+					       subtype == C80211_SUBTYPE_MGMT_BEACON) ;
+		}
+		break;
+		
+	case C80211_SUBTYPE_MGMT_Authentication:
+
+		if (priv->station_state == STATION_STATE_AUTHENTICATING)
+			authenticate(priv, frame_len);
+	
+		break;
+		
+	case C80211_SUBTYPE_MGMT_ASS_RESPONSE:
+	case C80211_SUBTYPE_MGMT_REASS_RESPONSE:
+		
+		if (priv->station_state == STATION_STATE_ASSOCIATING || 
+		    priv->station_state == STATION_STATE_REASSOCIATING)
+			associate(priv, frame_len, subtype);
+		
+		break;
+
+	case C80211_SUBTYPE_MGMT_DISASSOSIATION:
+		if (priv->station_is_associated && 
+		    priv->operating_mode == IW_MODE_INFRA && 
+		    is_frame_from_current_bss(priv, header)) {
+			priv->station_was_associated = 0;
+			priv->station_is_associated = 0;
+			
+			atmel_enter_state(priv, STATION_STATE_JOINNING);
+			join(priv, BSS_TYPE_INFRASTRUCTURE);
+		}
+		
+		break;
+
+	case C80211_SUBTYPE_MGMT_Deauthentication:
+		if (priv->operating_mode == IW_MODE_INFRA &&
+		    is_frame_from_current_bss(priv, header)) {
+			priv->station_was_associated = 0;
+
+			atmel_enter_state(priv, STATION_STATE_JOINNING);
+			join(priv, BSS_TYPE_INFRASTRUCTURE);
+		}
+		
+		break;
+	}
+}
+
+/* run when timer expires */
+static void atmel_management_timer(u_long a)
+{
+  struct net_device *dev = (struct net_device *) a;
+  struct atmel_private *priv = netdev_priv(dev);
+  unsigned long flags;
+  
+  /* Check if the card has been yanked. */
+  if (priv->card && priv->present_callback && 
+      !(*priv->present_callback)(priv->card))
+	  return;
+  
+  spin_lock_irqsave(&priv->irqlock, flags);
+
+  switch (priv->station_state) {
+	  
+  case STATION_STATE_AUTHENTICATING:
+	  if (priv->AuthenticationRequestRetryCnt >= MAX_AUTHENTICATION_RETRIES) {
+		  atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
+		  priv->station_is_associated = 0;
+		  priv->AuthenticationRequestRetryCnt = 0;
+		  restart_search(priv);
+	  } else {
+		  priv->AuthenticationRequestRetryCnt++;
+		  priv->CurrentAuthentTransactionSeqNum = 0x0001;
+		  mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
+		  send_authentication_request(priv, NULL, 0);
+	  }
+	  
+	  break;
+
+  case STATION_STATE_ASSOCIATING:
+	  if (priv->AssociationRequestRetryCnt == MAX_ASSOCIATION_RETRIES) {
+		  atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
+		  priv->station_is_associated = 0;
+		  priv->AssociationRequestRetryCnt = 0;
+		  restart_search(priv);
+	  } else {
+		  priv->AssociationRequestRetryCnt++;
+		  mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
+		  send_association_request(priv, 0);
+	  }
+
+	  break;
+		  
+  case STATION_STATE_REASSOCIATING:	
+	  if (priv->ReAssociationRequestRetryCnt == MAX_ASSOCIATION_RETRIES) {
+		  atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
+		  priv->station_is_associated = 0;
+		  priv->ReAssociationRequestRetryCnt = 0;
+		  restart_search(priv);
+	  } else {
+		  priv->ReAssociationRequestRetryCnt++;
+		  mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
+		  send_association_request(priv, 1);
+	  }
+
+	  break;
+  
+  default:
+	  break;
+  }
+  
+  spin_unlock_irqrestore(&priv->irqlock, flags);
+}
+  
+static void atmel_command_irq(struct atmel_private *priv)
+{
+	u8 status = atmel_rmem8(priv, atmel_co(priv, CMD_BLOCK_STATUS_OFFSET));
+	u8 command = atmel_rmem8(priv, atmel_co(priv, CMD_BLOCK_COMMAND_OFFSET));
+	int fast_scan;
+	
+	if (status == CMD_STATUS_IDLE || 
+	    status == CMD_STATUS_IN_PROGRESS)
+		return;
+
+	switch (command){
+
+	case CMD_Start:
+		if (status == CMD_STATUS_COMPLETE) {
+			priv->station_was_associated = priv->station_is_associated;
+			atmel_get_mib(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_CUR_BSSID_POS,
+				      (u8 *)priv->CurrentBSSID, 6);
+			atmel_enter_state(priv, STATION_STATE_READY);
+		}			
+		break;
+		
+	case CMD_Scan:
+		fast_scan = priv->fast_scan;
+		priv->fast_scan = 0;
+		
+		if (status != CMD_STATUS_COMPLETE) {
+			atmel_scan(priv, 1);
+		} else {
+			int bss_index = retrieve_bss(priv);
+			if (bss_index != -1) {
+				atmel_join_bss(priv, bss_index);
+			} else if (priv->operating_mode == IW_MODE_ADHOC && 
+				   priv->SSID_size != 0) {
+				start(priv, BSS_TYPE_AD_HOC);
+			} else {
+				priv->fast_scan = !fast_scan;
+				atmel_scan(priv, 1);
+			}
+			priv->site_survey_state = SITE_SURVEY_COMPLETED;
+		}
+		break;
+		
+	case CMD_SiteSurvey:
+		priv->fast_scan = 0;
+		
+		if (status != CMD_STATUS_COMPLETE)
+			return;
+		
+		priv->site_survey_state = SITE_SURVEY_COMPLETED;
+		if (priv->station_is_associated) {
+			atmel_enter_state(priv, STATION_STATE_READY);				
+		} else {
+			atmel_scan(priv, 1);
+		}
+		break;
+
+	case CMD_Join:
+		if (status == CMD_STATUS_COMPLETE) {
+			if (priv->operating_mode == IW_MODE_ADHOC) {
+				priv->station_was_associated = priv->station_is_associated;
+				atmel_enter_state(priv, STATION_STATE_READY);
+			} else {
+				priv->AuthenticationRequestRetryCnt = 0;
+				atmel_enter_state(priv, STATION_STATE_AUTHENTICATING);
+				
+				mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
+				priv->CurrentAuthentTransactionSeqNum = 0x0001;
+				send_authentication_request(priv, NULL, 0);
+			}
+			return;
+		}
+		
+		atmel_scan(priv, 1);
+		
+	}
+}
+
+static int atmel_wakeup_firmware(struct atmel_private *priv)
+{
+	struct host_info_struct *iface = &priv->host_info;
+	u16 mr1, mr3;
+	int i;
+
+	if (priv->card_type == CARD_TYPE_SPI_FLASH)
+		atmel_set_gcr(priv->dev, GCR_REMAP);
+	
+	/* wake up on-board processor */
+	atmel_clear_gcr(priv->dev, 0x0040);
+	atmel_write16(priv->dev, BSR, BSS_SRAM);
+	
+	if (priv->card_type == CARD_TYPE_SPI_FLASH)
+		mdelay(100);
+
+	/* and wait for it */
+	for (i =  LOOP_RETRY_LIMIT; i; i--) {
+		mr1 = atmel_read16(priv->dev, MR1);
+		mr3 = atmel_read16(priv->dev, MR3);
+		
+		if (mr3 & MAC_BOOT_COMPLETE) 
+			break;
+		if (mr1 & MAC_BOOT_COMPLETE &&
+		    priv->bus_type == BUS_TYPE_PCCARD)
+			break;
+	}
+
+	if (i == 0) {
+		printk(KERN_ALERT "%s: MAC failed to boot.\n", priv->dev->name);
+		return 0;
+	}
+		
+	if ((priv->host_info_base = atmel_read16(priv->dev, MR2)) == 0xffff) {
+		printk(KERN_ALERT "%s: card missing.\n", priv->dev->name);
+		return 0;
+	}
+	
+	/* now check for completion of MAC initialization through  
+	   the FunCtrl field of the IFACE, poll MR1 to detect completion of	  
+	   MAC initialization, check completion status, set interrupt mask,  
+	   enables interrupts and calls Tx and Rx initialization functions */  
+	
+	atmel_wmem8(priv, atmel_hi(priv, IFACE_FUNC_CTRL_OFFSET), FUNC_CTRL_INIT_COMPLETE);
+	
+	for (i =  LOOP_RETRY_LIMIT; i; i--) {
+		mr1 = atmel_read16(priv->dev, MR1);
+		mr3 = atmel_read16(priv->dev, MR3);
+		
+		if (mr3 & MAC_INIT_COMPLETE) 
+			break;
+		if (mr1 & MAC_INIT_COMPLETE &&
+		    priv->bus_type == BUS_TYPE_PCCARD)
+			break;
+	}
+	
+	if (i == 0) {
+		printk(KERN_ALERT "%s: MAC failed to initialise.\n", priv->dev->name);
+		return 0;
+	}
+	
+	/* Check for MAC_INIT_OK only on the register that the MAC_INIT_OK was set */
+	if ((mr3 & MAC_INIT_COMPLETE) &&
+	    !(atmel_read16(priv->dev, MR3) & MAC_INIT_OK)) {
+		printk(KERN_ALERT "%s: MAC failed MR3 self-test.\n", priv->dev->name);
+		return 0;
+	}
+	if ((mr1 & MAC_INIT_COMPLETE) &&
+	    !(atmel_read16(priv->dev, MR1) & MAC_INIT_OK)) {
+		printk(KERN_ALERT "%s: MAC failed MR1 self-test.\n", priv->dev->name);
+		return 0;
+	}
+
+	atmel_copy_to_host(priv->dev, (unsigned char *)iface, 
+			   priv->host_info_base, sizeof(*iface));
+        
+	iface->tx_buff_pos = le16_to_cpu(iface->tx_buff_pos);
+	iface->tx_buff_size = le16_to_cpu(iface->tx_buff_size);
+	iface->tx_desc_pos = le16_to_cpu(iface->tx_desc_pos);
+	iface->tx_desc_count = le16_to_cpu(iface->tx_desc_count);
+	iface->rx_buff_pos = le16_to_cpu(iface->rx_buff_pos);
+	iface->rx_buff_size = le16_to_cpu(iface->rx_buff_size);
+	iface->rx_desc_pos = le16_to_cpu(iface->rx_desc_pos);
+	iface->rx_desc_count = le16_to_cpu(iface->rx_desc_count);
+	iface->build_version = le16_to_cpu(iface->build_version);
+	iface->command_pos = le16_to_cpu(iface->command_pos);
+	iface->major_version = le16_to_cpu(iface->major_version);
+	iface->minor_version = le16_to_cpu(iface->minor_version);
+	iface->func_ctrl = le16_to_cpu(iface->func_ctrl);
+	iface->mac_status = le16_to_cpu(iface->mac_status);
+
+	return 1;
+}
+
+/* determine type of memory and MAC address */
+static int probe_atmel_card(struct net_device *dev)
+{
+	int rc = 0;
+	struct atmel_private *priv = netdev_priv(dev);
+	 
+	/* reset pccard */
+	if (priv->bus_type == BUS_TYPE_PCCARD) 
+		atmel_write16(dev, GCR, 0x0060);
+	
+	atmel_write16(dev, GCR, 0x0040);
+	mdelay(500);
+	
+	if (atmel_read16(dev, MR2) == 0) {
+		/* No stored firmware so load a small stub which just 
+		   tells us the MAC address */
+		int i;
+		priv->card_type = CARD_TYPE_EEPROM;
+		atmel_write16(dev, BSR, BSS_IRAM);
+		atmel_copy_to_card(dev, 0, mac_reader, sizeof(mac_reader));
+		atmel_set_gcr(dev, GCR_REMAP);
+		atmel_clear_gcr(priv->dev, 0x0040);
+		atmel_write16(dev, BSR, BSS_SRAM);
+		for (i =  LOOP_RETRY_LIMIT; i; i--) 
+			if (atmel_read16(dev, MR3) & MAC_BOOT_COMPLETE)
+				break;
+		if (i == 0) {
+			printk(KERN_ALERT "%s: MAC failed to boot MAC address reader.\n", dev->name);
+		} else {
+			atmel_copy_to_host(dev, dev->dev_addr, atmel_read16(dev, MR2), 6);
+			/* got address, now squash it again until the network
+			   interface is opened */
+			if (priv->bus_type == BUS_TYPE_PCCARD) 
+				atmel_write16(dev, GCR, 0x0060);
+			atmel_write16(dev, GCR, 0x0040);
+			rc = 1;
+		}
+	} else if (atmel_read16(dev, MR4) == 0) {
+		/* Mac address easy in this case. */
+		priv->card_type = CARD_TYPE_PARALLEL_FLASH;
+		atmel_write16(dev,  BSR, 1);	
+		atmel_copy_to_host(dev, dev->dev_addr, 0xc000, 6);
+		atmel_write16(dev,  BSR, 0x200);
+		rc = 1;
+	} else {
+		/* Standard firmware in flash, boot it up and ask
+		   for the Mac Address */
+		priv->card_type = CARD_TYPE_SPI_FLASH;
+		if (atmel_wakeup_firmware(priv)) {
+			atmel_get_mib(priv, Mac_Address_Mib_Type, 0, dev->dev_addr, 6);
+			
+			/* got address, now squash it again until the network
+			   interface is opened */
+			if (priv->bus_type == BUS_TYPE_PCCARD) 
+				atmel_write16(dev, GCR, 0x0060);
+			atmel_write16(dev, GCR, 0x0040);
+			rc = 1;
+		}
+	}
+	
+	if (rc) {
+		if (dev->dev_addr[0] == 0xFF) {
+			u8 default_mac[] = {0x00,0x04, 0x25, 0x00, 0x00, 0x00};
+			printk(KERN_ALERT "%s: *** Invalid MAC address. UPGRADE Firmware ****\n", dev->name);
+			memcpy(dev->dev_addr, default_mac, 6);
+		}
+		printk(KERN_INFO "%s: MAC address %.2x:%.2x:%.2x:%.2x:%.2x:%.2x\n",
+		       dev->name,
+		       dev->dev_addr[0], dev->dev_addr[1], dev->dev_addr[2],
+		       dev->dev_addr[3], dev->dev_addr[4], dev->dev_addr[5] );
+		
+	}
+	
+	return rc;
+}
+
+static void build_wep_mib(struct atmel_private *priv)
+/* Move the encyption information on the MIB structure.
+   This routine is for the pre-WPA firmware: later firmware has
+   a different format MIB and a different routine. */
+{
+	struct { /* NB this is matched to the hardware, don't change. */
+		u8 wep_is_on;                 
+		u8 default_key; /* 0..3 */
+		u8 reserved;
+		u8 exclude_unencrypted;
+		
+		u32 WEPICV_error_count;
+		u32 WEP_excluded_count;
+		
+		u8 wep_keys[MAX_ENCRYPTION_KEYS][13];
+ 		u8 encryption_level; /* 0, 1, 2 */
+		u8 reserved2[3]; 
+	} mib;
+	int i;
+
+	mib.wep_is_on = priv->wep_is_on;
+	if (priv->wep_is_on) {
+		if (priv->wep_key_len[priv->default_key] > 5)
+			mib.encryption_level = 2;
+		else
+			mib.encryption_level = 1;	
+	} else {
+		mib.encryption_level = 0;
+	}
+
+	mib.default_key = priv->default_key;
+	mib.exclude_unencrypted = priv->exclude_unencrypted;
+	
+	for(i = 0; i < MAX_ENCRYPTION_KEYS;  i++)
+		memcpy(mib.wep_keys[i], priv->wep_keys[i], 13);
+		
+	atmel_set_mib(priv, Mac_Wep_Mib_Type, 0, (u8 *)&mib, sizeof(mib));
+}
+
+static void build_wpa_mib(struct atmel_private *priv)
+{
+	/* This is for the later (WPA enabled) firmware. */	   
+
+	struct { /* NB this is matched to the hardware, don't change. */
+		u8 cipher_default_key_value[MAX_ENCRYPTION_KEYS][MAX_ENCRYPTION_KEY_SIZE];
+		u8 receiver_address[6];
+		u8 wep_is_on;                 
+		u8 default_key; /* 0..3 */
+		u8 group_key;
+		u8 exclude_unencrypted;
+		u8 encryption_type;
+		u8 reserved;
+		
+		u32 WEPICV_error_count;
+		u32 WEP_excluded_count;
+		
+		u8 key_RSC[4][8];
+	} mib;
+	
+	int i;
+
+	mib.wep_is_on = priv->wep_is_on;
+	mib.exclude_unencrypted = priv->exclude_unencrypted;
+	memcpy(mib.receiver_address, priv->CurrentBSSID, 6);
+	
+	/* zero all the keys before adding in valid ones. */
+	memset(mib.cipher_default_key_value, 0, sizeof(mib.cipher_default_key_value));
+	
+	if (priv->wep_is_on) {
+		/* There's a comment in the Atmel code to the effect that this is only valid
+		   when still using WEP, it may need to be set to something to use WPA */
+		memset(mib.key_RSC, 0, sizeof(mib.key_RSC));
+		
+		mib.default_key = mib.group_key = 255;
+		for (i = 0; i < MAX_ENCRYPTION_KEYS; i++) {
+			if (priv->wep_key_len[i] > 0) {
+				memcpy(mib.cipher_default_key_value[i], priv->wep_keys[i], MAX_ENCRYPTION_KEY_SIZE);
+				if (i == priv->default_key) {
+					mib.default_key = i;
+					mib.cipher_default_key_value[i][MAX_ENCRYPTION_KEY_SIZE-1] = 7;
+					mib.cipher_default_key_value[i][MAX_ENCRYPTION_KEY_SIZE-2] = priv->pairwise_cipher_suite; 
+				} else {
+					mib.group_key = i;
+					priv->group_cipher_suite = priv->pairwise_cipher_suite;
+				        mib.cipher_default_key_value[i][MAX_ENCRYPTION_KEY_SIZE-1] = 1;
+					mib.cipher_default_key_value[i][MAX_ENCRYPTION_KEY_SIZE-2] = priv->group_cipher_suite;	
+				}
+			}
+		}
+		if (mib.default_key == 255)
+			mib.default_key = mib.group_key != 255 ? mib.group_key : 0;
+		if (mib.group_key == 255)
+			mib.group_key = mib.default_key;
+		
+	}
+	
+	atmel_set_mib(priv, Mac_Wep_Mib_Type, 0, (u8 *)&mib, sizeof(mib));
+}
+					
+static int reset_atmel_card(struct net_device *dev) 
+{
+	/* do everything necessary to wake up the hardware, including
+	   waiting for the lightning strike and throwing the knife switch....
+
+	   set all the Mib values which matter in the card to match 
+	   their settings in the atmel_private structure. Some of these
+	   can be altered on the fly, but many (WEP, infrastucture or ad-hoc)
+	   can only be changed by tearing down the world and coming back through
+	   here.
+
+	   This routine is also responsible for initialising some 
+	   hardware-specific fields in the atmel_private structure, 
+	   including a copy of the firmware's hostinfo stucture
+	   which is the route into the rest of the firmare datastructures. */
+
+	struct atmel_private *priv = netdev_priv(dev);
+	u8 configuration;
+	
+	/* data to add to the firmware names, in priority order
+	   this implemenents firmware versioning */
+	
+	static char *firmware_modifier[] = {
+		"-wpa",
+		"",
+		NULL
+	};
+		
+	/* reset pccard */
+	if (priv->bus_type == BUS_TYPE_PCCARD) 
+		atmel_write16(priv->dev, GCR, 0x0060);
+		
+	/* stop card , disable interrupts */
+	atmel_write16(priv->dev, GCR, 0x0040);
+		
+	if (priv->card_type == CARD_TYPE_EEPROM) {
+		/* copy in firmware if needed */
+		const struct firmware *fw_entry = NULL;
+		unsigned char *fw;
+		int len = priv->firmware_length;
+		if (!(fw = priv->firmware)) {
+			if (priv->firmware_type == ATMEL_FW_TYPE_NONE) {
+				if (strlen(priv->firmware_id) == 0) {
+					printk(KERN_INFO
+					       "%s: card type is unknown: assuming at76c502 firmware is OK.\n",
+					       dev->name);
+					printk(KERN_INFO
+					       "%s: if not, use the firmware= module parameter.\n", 
+					       dev->name);
+					strcpy(priv->firmware_id, "atmel_at76c502.bin");
+				}
+				if (request_firmware(&fw_entry, priv->firmware_id, priv->sys_dev) != 0) {
+					printk(KERN_ALERT 
+					       "%s: firmware %s is missing, cannot continue.\n", 
+					       dev->name, priv->firmware_id);
+					return 0;
+				}
+			} else {
+				int fw_index = 0;
+				int success = 0;
+
+				/* get firmware filename entry based on firmware type ID */
+				while (fw_table[fw_index].fw_type != priv->firmware_type
+						&& fw_table[fw_index].fw_type != ATMEL_FW_TYPE_NONE)
+					fw_index++;
+				
+				/* construct the actual firmware file name */
+				if (fw_table[fw_index].fw_type != ATMEL_FW_TYPE_NONE) {
+					int i;
+					for (i = 0; firmware_modifier[i]; i++) {
+						snprintf(priv->firmware_id, 32, "%s%s.%s", fw_table[fw_index].fw_file,
+							firmware_modifier[i], fw_table[fw_index].fw_file_ext);
+						priv->firmware_id[31] = '\0';
+						if (request_firmware(&fw_entry, priv->firmware_id, priv->sys_dev) == 0) {
+							success = 1;
+							break;
+						}
+					}
+				}
+				if (!success) {
+					printk(KERN_ALERT 
+					       "%s: firmware %s is missing, cannot start.\n", 
+					       dev->name, priv->firmware_id);
+					priv->firmware_id[0] = '\0';
+					return 0;	
+				}
+			}
+			
+			fw = fw_entry->data;
+			len = fw_entry->size;
+		}
+		
+	        if (len <= 0x6000) {
+			atmel_write16(priv->dev, BSR, BSS_IRAM);
+			atmel_copy_to_card(priv->dev, 0, fw, len);
+			atmel_set_gcr(priv->dev, GCR_REMAP);
+		} else {
+			/* Remap */ 
+			atmel_set_gcr(priv->dev, GCR_REMAP);
+			atmel_write16(priv->dev, BSR, BSS_IRAM);
+			atmel_copy_to_card(priv->dev, 0, fw, 0x6000);
+			atmel_write16(priv->dev, BSR, 0x2ff);
+			atmel_copy_to_card(priv->dev, 0x8000, &fw[0x6000], len - 0x6000);
+		}
+
+		if (fw_entry)
+			release_firmware(fw_entry);
+	}
+
+	if (!atmel_wakeup_firmware(priv))
+		return 0;
+
+	/* Check the version and set the correct flag for wpa stuff,
+	   old and new firmware is incompatible.
+	   The pre-wpa 3com firmware reports major version 5,
+	   the wpa 3com firmware is major version 4 and doesn't need
+	   the 3com broken-ness filter. */
+	priv->use_wpa = (priv->host_info.major_version == 4);
+	priv->radio_on_broken = (priv->host_info.major_version == 5);
+	
+        /* unmask all irq sources */
+	atmel_wmem8(priv, atmel_hi(priv, IFACE_INT_MASK_OFFSET), 0xff);
+	
+	/* int Tx system and enable Tx */
+	atmel_wmem8(priv, atmel_tx(priv, TX_DESC_FLAGS_OFFSET, 0), 0);
+	atmel_wmem32(priv, atmel_tx(priv, TX_DESC_NEXT_OFFSET, 0), 0x80000000L);
+	atmel_wmem16(priv, atmel_tx(priv, TX_DESC_POS_OFFSET, 0), 0);
+	atmel_wmem16(priv, atmel_tx(priv, TX_DESC_SIZE_OFFSET, 0), 0);
+
+	priv->tx_desc_free = priv->host_info.tx_desc_count;		
+	priv->tx_desc_head = 0;									
+	priv->tx_desc_tail = 0;									
+	priv->tx_desc_previous = 0;
+	priv->tx_free_mem = priv->host_info.tx_buff_size;
+	priv->tx_buff_head = 0;	
+	priv->tx_buff_tail = 0;	
+		
+	configuration = atmel_rmem8(priv, atmel_hi(priv, IFACE_FUNC_CTRL_OFFSET)); 
+	atmel_wmem8(priv, atmel_hi(priv, IFACE_FUNC_CTRL_OFFSET), 
+				   configuration | FUNC_CTRL_TxENABLE);
+
+	/* init Rx system and enable */
+	priv->rx_desc_head = 0;
+	
+	configuration = atmel_rmem8(priv, atmel_hi(priv, IFACE_FUNC_CTRL_OFFSET)); 
+	atmel_wmem8(priv, atmel_hi(priv, IFACE_FUNC_CTRL_OFFSET), 
+				   configuration | FUNC_CTRL_RxENABLE);
+			
+	if (!priv->radio_on_broken) {
+		if (atmel_send_command_wait(priv, CMD_EnableRadio, NULL, 0) == 
+		    CMD_STATUS_REJECTED_RADIO_OFF) {
+			printk(KERN_INFO 
+			       "%s: cannot turn the radio on. (Hey radio, you're beautiful!)\n",
+			       dev->name);
+                        return 0;
+		}
+	}
+	
+	/* set up enough MIB values to run. */
+	atmel_set_mib8(priv, Local_Mib_Type, LOCAL_MIB_AUTO_TX_RATE_POS, priv->auto_tx_rate);
+	atmel_set_mib8(priv, Local_Mib_Type,  LOCAL_MIB_TX_PROMISCUOUS_POS,  PROM_MODE_OFF);
+	atmel_set_mib16(priv, Mac_Mib_Type, MAC_MIB_RTS_THRESHOLD_POS, priv->rts_threshold);
+	atmel_set_mib16(priv, Mac_Mib_Type, MAC_MIB_FRAG_THRESHOLD_POS, priv->frag_threshold);
+	atmel_set_mib8(priv, Mac_Mib_Type, MAC_MIB_SHORT_RETRY_POS, priv->short_retry);
+	atmel_set_mib8(priv, Mac_Mib_Type, MAC_MIB_LONG_RETRY_POS, priv->long_retry);
+	atmel_set_mib8(priv, Local_Mib_Type, LOCAL_MIB_PREAMBLE_TYPE, priv->preamble);
+	atmel_set_mib(priv, Mac_Address_Mib_Type, MAC_ADDR_MIB_MAC_ADDR_POS, 
+		      priv->dev->dev_addr, 6);
+	atmel_set_mib8(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_PS_MODE_POS, ACTIVE_MODE);
+	atmel_set_mib16(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_LISTEN_INTERVAL_POS, 1);
+	atmel_set_mib16(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_BEACON_PER_POS, priv->default_beacon_period);
+	atmel_set_mib(priv, Phy_Mib_Type, PHY_MIB_RATE_SET_POS, atmel_basic_rates, 4);
+	atmel_set_mib8(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_CUR_PRIVACY_POS, priv->wep_is_on);
+	if (priv->use_wpa)
+		build_wpa_mib(priv);
+	else
+		build_wep_mib(priv);
+	
+	return 1;
+}
+
+static void atmel_send_command(struct atmel_private *priv, int command, void *cmd, int cmd_size)
+{
+	if (cmd)
+		atmel_copy_to_card(priv->dev, atmel_co(priv, CMD_BLOCK_PARAMETERS_OFFSET), 
+				   cmd, cmd_size);
+	
+	atmel_wmem8(priv, atmel_co(priv, CMD_BLOCK_COMMAND_OFFSET), command);
+	atmel_wmem8(priv, atmel_co(priv, CMD_BLOCK_STATUS_OFFSET), 0);
+}
+	
+static int atmel_send_command_wait(struct atmel_private *priv, int command, void *cmd, int cmd_size)
+{
+	int i, status;
+	
+	atmel_send_command(priv, command, cmd, cmd_size);
+	
+	for (i = 5000; i; i--) {
+		status = atmel_rmem8(priv, atmel_co(priv, CMD_BLOCK_STATUS_OFFSET));
+		if (status != CMD_STATUS_IDLE && 
+		    status != CMD_STATUS_IN_PROGRESS)
+			break;
+		udelay(20);
+	}
+	
+	if (i == 0) {
+		printk(KERN_ALERT "%s: failed to contact MAC.\n", priv->dev->name);
+		status =  CMD_STATUS_HOST_ERROR;
+	} else { 
+		if (command != CMD_EnableRadio)
+			status = CMD_STATUS_COMPLETE;
+	}
+	
+	return status;
+}
+
+static u8 atmel_get_mib8(struct atmel_private *priv, u8 type, u8 index)
+{
+	struct get_set_mib m;
+	m.type = type;
+	m.size = 1;
+	m.index = index;
+
+	atmel_send_command_wait(priv, CMD_Get_MIB_Vars, &m, MIB_HEADER_SIZE + 1);
+	return atmel_rmem8(priv, atmel_co(priv, CMD_BLOCK_PARAMETERS_OFFSET + MIB_HEADER_SIZE));
+}
+
+static void atmel_set_mib8(struct atmel_private *priv, u8 type, u8 index, u8 data)
+{
+	struct get_set_mib m;
+	m.type = type;
+	m.size = 1;
+	m.index = index;
+	m.data[0] = data;
+
+	atmel_send_command_wait(priv, CMD_Set_MIB_Vars, &m, MIB_HEADER_SIZE + 1);
+}
+
+static void atmel_set_mib16(struct atmel_private *priv, u8 type, u8 index, u16 data)
+{
+	struct get_set_mib m;
+	m.type = type;
+	m.size = 2;
+	m.index = index;
+	m.data[0] = data;
+	m.data[1] = data >> 8;
+
+	atmel_send_command_wait(priv, CMD_Set_MIB_Vars, &m, MIB_HEADER_SIZE + 2);
+}
+
+static void atmel_set_mib(struct atmel_private *priv, u8 type, u8 index, u8 *data, int data_len)
+{
+	struct get_set_mib m;
+	m.type = type;
+	m.size = data_len;
+	m.index = index;
+
+	if (data_len > MIB_MAX_DATA_BYTES)
+		printk(KERN_ALERT "%s: MIB buffer too small.\n", priv->dev->name);
+	
+	memcpy(m.data, data, data_len);
+	atmel_send_command_wait(priv, CMD_Set_MIB_Vars, &m, MIB_HEADER_SIZE + data_len);
+}
+
+static void atmel_get_mib(struct atmel_private *priv, u8 type, u8 index, u8 *data, int data_len)
+{
+	struct get_set_mib m;
+	m.type = type;
+	m.size = data_len;
+	m.index = index;
+	
+	if (data_len > MIB_MAX_DATA_BYTES)
+		printk(KERN_ALERT "%s: MIB buffer too small.\n", priv->dev->name);
+	
+	atmel_send_command_wait(priv, CMD_Get_MIB_Vars, &m, MIB_HEADER_SIZE + data_len);
+	atmel_copy_to_host(priv->dev, data, 
+			   atmel_co(priv, CMD_BLOCK_PARAMETERS_OFFSET + MIB_HEADER_SIZE), data_len);
+}
+
+static void atmel_writeAR(struct net_device *dev, u16 data)
+{
+	int i;
+	outw(data, dev->base_addr + AR);
+	/* Address register appears to need some convincing..... */
+	for (i = 0; data != inw(dev->base_addr + AR) && i<10; i++)
+		outw(data, dev->base_addr + AR);
+}
+
+static void atmel_copy_to_card(struct net_device *dev, u16 dest, unsigned char *src, u16 len)
+{
+	int i;
+	atmel_writeAR(dev, dest);
+	if (dest % 2) {
+		atmel_write8(dev, DR, *src);
+		src++; len--;
+	}
+	for (i = len; i > 1 ; i -= 2) {
+		u8 lb = *src++;
+		u8 hb = *src++;
+		atmel_write16(dev, DR, lb | (hb << 8));
+	}
+	if (i)
+		atmel_write8(dev, DR, *src);
+}
+
+static void atmel_copy_to_host(struct net_device *dev, unsigned char *dest, u16 src, u16 len)
+{
+	int i;
+	atmel_writeAR(dev, src);
+	if (src % 2) {
+		*dest = atmel_read8(dev, DR);
+		dest++; len--;
+	}
+	for (i = len; i > 1 ; i -= 2) {
+		u16 hw = atmel_read16(dev, DR);
+		*dest++ = hw;
+		*dest++ = hw >> 8;
+	}
+	if (i)
+		*dest = atmel_read8(dev, DR);
+}
+
+static void atmel_set_gcr(struct net_device *dev, u16 mask)
+{
+	outw(inw(dev->base_addr + GCR) | mask, dev->base_addr + GCR);
+}
+
+static void atmel_clear_gcr(struct net_device *dev, u16 mask)
+{
+	outw(inw(dev->base_addr + GCR) & ~mask, dev->base_addr + GCR);
+}
+
+static int atmel_lock_mac(struct atmel_private *priv)
+{
+	int i, j = 20;
+ retry:
+	for (i = 5000; i; i--) {
+		if (!atmel_rmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_HOST_OFFSET)))
+			break;
+		udelay(20);
+	}
+	
+	if (!i) return 0; /* timed out */
+	
+	atmel_wmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_MAC_OFFSET), 1);
+	if (atmel_rmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_HOST_OFFSET))) {
+		atmel_wmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_MAC_OFFSET), 0);
+		if (!j--) return 0; /* timed out */
+		goto retry;
+	}
+	
+	return 1;
+}
+
+static void atmel_wmem32(struct atmel_private *priv, u16 pos, u32 data)
+{
+       	atmel_writeAR(priv->dev, pos);	
+	atmel_write16(priv->dev, DR, data); /* card is little-endian */
+	atmel_write16(priv->dev, DR, data >> 16);
+}
+
+/***************************************************************************/
+/* There follows the source form of the MAC address reading firmware       */
+/***************************************************************************/
+#if 0
+
+/* Copyright 2003 Matthew T. Russotto                                      */
+/* But derived from the Atmel 76C502 firmware written by Atmel and         */
+/* included in "atmel wireless lan drivers" package                        */
+/**
+    This file is part of net.russotto.AtmelMACFW, hereto referred to
+    as AtmelMACFW
+
+    AtmelMACFW is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License version 2
+    as published by the Free Software Foundation.
+
+    AtmelMACFW is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with AtmelMACFW; if not, write to the Free Software
+    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+****************************************************************************/
+/* This firmware should work on the 76C502 RFMD, RFMD_D, and RFMD_E        */
+/* It will probably work on the 76C504 and 76C502 RFMD_3COM                */
+/* It only works on SPI EEPROM versions of the card.                       */
+
+/* This firmware initializes the SPI controller and clock, reads the MAC   */
+/* address from the EEPROM into SRAM, and puts the SRAM offset of the MAC  */
+/* address in MR2, and sets MR3 to 0x10 to indicate it is done             */
+/* It also puts a complete copy of the EEPROM in SRAM with the offset in   */
+/* MR4, for investigational purposes (maybe we can determine chip type     */
+/* from that?)                                                             */
+
+	.org 0
+    .set MRBASE, 0x8000000
+	.set CPSR_INITIAL, 0xD3 /* IRQ/FIQ disabled, ARM mode, Supervisor state */
+	.set CPSR_USER, 0xD1 /* IRQ/FIQ disabled, ARM mode, USER state */
+	.set SRAM_BASE,  0x02000000
+	.set SP_BASE,    0x0F300000
+	.set UNK_BASE,   0x0F000000 /* Some internal device, but which one? */
+	.set SPI_CGEN_BASE,  0x0E000000 /* Some internal device, but which one? */
+	.set UNK3_BASE,  0x02014000 /* Some internal device, but which one? */
+	.set STACK_BASE, 0x5600
+	.set SP_SR, 0x10
+	.set SP_TDRE, 2 /* status register bit -- TDR empty */
+	.set SP_RDRF, 1 /* status register bit -- RDR full */
+	.set SP_SWRST, 0x80
+	.set SP_SPIEN, 0x1
+	.set SP_CR, 0   /* control register */
+	.set SP_MR, 4   /* mode register */
+	.set SP_RDR, 0x08 /* Read Data Register */
+	.set SP_TDR, 0x0C /* Transmit Data Register */
+	.set SP_CSR0, 0x30 /* chip select registers */
+	.set SP_CSR1, 0x34
+	.set SP_CSR2, 0x38
+	.set SP_CSR3, 0x3C
+	.set NVRAM_CMD_RDSR, 5 /* read status register */
+	.set NVRAM_CMD_READ, 3 /* read data */
+	.set NVRAM_SR_RDY, 1 /* RDY bit.  This bit is inverted */
+	.set SPI_8CLOCKS, 0xFF /* Writing this to the TDR doesn't do anything to the
+				  serial output, since SO is normally high.  But it
+				  does cause 8 clock cycles and thus 8 bits to be
+				  clocked in to the chip.  See Atmel's SPI
+				  controller (e.g. AT91M55800) timing and 4K 
+				  SPI EEPROM manuals */
+				 
+	.set NVRAM_SCRATCH, 0x02000100  /* arbitrary area for scratchpad memory */
+	.set NVRAM_IMAGE, 0x02000200
+	.set NVRAM_LENGTH, 0x0200
+	.set MAC_ADDRESS_MIB, SRAM_BASE
+	.set MAC_ADDRESS_LENGTH, 6
+        .set MAC_BOOT_FLAG, 0x10
+	.set MR1, 0
+	.set MR2, 4
+	.set MR3, 8
+	.set MR4, 0xC
+RESET_VECTOR:
+        b RESET_HANDLER
+UNDEF_VECTOR:  
+        b HALT1
+SWI_VECTOR:            
+        b HALT1
+IABORT_VECTOR: 
+        b HALT1
+DABORT_VECTOR:         
+RESERVED_VECTOR:    
+        b HALT1
+IRQ_VECTOR:    
+        b HALT1
+FIQ_VECTOR:    
+	b HALT1
+HALT1:	b HALT1
+RESET_HANDLER:
+	mov     r0, #CPSR_INITIAL
+	msr	CPSR_c, r0	/* This is probably unnecessary */
+			
+/* I'm guessing this is initializing clock generator electronics for SPI */
+	ldr	r0, =SPI_CGEN_BASE
+	mov	r1, #0
+	mov	r1, r1, lsl #3
+	orr	r1,r1, #0
+	str	r1, [r0]
+	ldr	r1, [r0, #28]
+	bic	r1, r1, #16
+	str	r1, [r0, #28]
+	mov	r1, #1
+	str	r1, [r0, #8]
+	
+	ldr	r0, =MRBASE
+	mov	r1, #0
+	strh	r1, [r0, #MR1]
+	strh	r1, [r0, #MR2]
+	strh	r1, [r0, #MR3]
+	strh	r1, [r0, #MR4]
+
+	mov	sp, #STACK_BASE
+	bl	SP_INIT
+	mov	r0, #10
+	bl	DELAY9
+	bl	GET_MAC_ADDR
+	bl	GET_WHOLE_NVRAM
+	ldr	r0, =MRBASE
+	ldr	r1, =MAC_ADDRESS_MIB
+	strh	r1, [r0, #MR2]
+	ldr	r1, =NVRAM_IMAGE
+	strh	r1, [r0, #MR4]
+	mov	r1, #MAC_BOOT_FLAG
+	strh	r1, [r0, #MR3]
+HALT2:	b HALT2
+.func Get_Whole_NVRAM, GET_WHOLE_NVRAM
+GET_WHOLE_NVRAM:
+	stmdb	sp!, {lr}
+	mov	r2, #0 /* 0th bytes of NVRAM */
+	mov	r3, #NVRAM_LENGTH
+	mov	r1, #0		/* not used in routine */
+	ldr	r0, =NVRAM_IMAGE
+	bl	NVRAM_XFER
+	ldmia	sp!, {lr}
+	bx	lr
+.endfunc
+	
+.func Get_MAC_Addr, GET_MAC_ADDR
+GET_MAC_ADDR:
+	stmdb	sp!, {lr}
+	mov	r2, #0x120	/* address of MAC Address within NVRAM */
+	mov	r3, #MAC_ADDRESS_LENGTH
+	mov	r1, #0		/* not used in routine */
+	ldr	r0, =MAC_ADDRESS_MIB
+	bl	NVRAM_XFER
+	ldmia	sp!, {lr}
+	bx	lr
+.endfunc
+.ltorg
+.func Delay9, DELAY9
+DELAY9:
+	adds	r0, r0, r0, LSL #3   /* r0 = r0 * 9 */
+DELAYLOOP:	
+	beq	DELAY9_done
+	subs	r0, r0, #1
+	b	DELAYLOOP
+DELAY9_done:	
+	bx	lr
+.endfunc	
+
+.func SP_Init, SP_INIT
+SP_INIT:
+	mov	r1, #SP_SWRST
+	ldr	r0, =SP_BASE
+	str	r1, [r0, #SP_CR] /* reset the SPI */
+	mov	r1, #0
+	str	r1, [r0, #SP_CR] /* release SPI from reset state */
+	mov	r1, #SP_SPIEN
+	str	r1, [r0, #SP_MR] /* set the SPI to MASTER mode*/
+	str	r1, [r0, #SP_CR] /* enable the SPI */
+
+/*  My guess would be this turns on the SPI clock */
+	ldr	r3, =SPI_CGEN_BASE
+	ldr	r1, [r3, #28]
+	orr	r1, r1, #0x2000
+	str	r1, [r3, #28]
+
+	ldr	r1, =0x2000c01
+	str	r1, [r0, #SP_CSR0]
+	ldr	r1, =0x2000201
+	str	r1, [r0, #SP_CSR1]
+	str	r1, [r0, #SP_CSR2]
+	str	r1, [r0, #SP_CSR3]
+	ldr	r1, [r0, #SP_SR]
+	ldr	r0, [r0, #SP_RDR]
+	bx	lr
+.endfunc
+.func NVRAM_Init, NVRAM_INIT	
+NVRAM_INIT:
+	ldr	r1, =SP_BASE
+	ldr	r0, [r1, #SP_RDR]
+	mov	r0, #NVRAM_CMD_RDSR
+	str	r0, [r1, #SP_TDR]
+SP_loop1:	
+	ldr	r0, [r1, #SP_SR]
+	tst	r0, #SP_TDRE
+	beq	SP_loop1
+
+	mov	r0, #SPI_8CLOCKS
+	str	r0, [r1, #SP_TDR] 
+SP_loop2:	
+	ldr	r0, [r1, #SP_SR]
+	tst	r0, #SP_TDRE
+	beq	SP_loop2
+
+	ldr	r0, [r1, #SP_RDR]
+SP_loop3:	
+	ldr	r0, [r1, #SP_SR]
+	tst	r0, #SP_RDRF
+	beq	SP_loop3
+
+	ldr	r0, [r1, #SP_RDR]
+	and	r0, r0, #255
+	bx	lr
+.endfunc
+	
+.func NVRAM_Xfer, NVRAM_XFER
+	/* r0 = dest address */
+	/* r1 = not used */
+	/* r2 = src address within NVRAM */
+	/* r3 = length */
+NVRAM_XFER:
+	stmdb	sp!, {r4, r5, lr}
+	mov	r5, r0		/* save r0 (dest address) */
+	mov	r4, r3		/* save r3 (length) */
+	mov	r0, r2, LSR #5 /*  SPI memories put A8 in the command field */
+	and	r0, r0, #8
+	add	r0, r0, #NVRAM_CMD_READ 
+	ldr	r1, =NVRAM_SCRATCH
+	strb	r0, [r1, #0]	/* save command in NVRAM_SCRATCH[0] */
+	strb	r2, [r1, #1]    /* save low byte of source address in NVRAM_SCRATCH[1] */
+_local1:	
+	bl	NVRAM_INIT
+	tst	r0, #NVRAM_SR_RDY
+	bne	_local1
+	mov	r0, #20
+	bl	DELAY9
+	mov	r2, r4		/* length */
+	mov	r1, r5		/* dest address */
+	mov	r0, #2		/* bytes to transfer in command */
+	bl	NVRAM_XFER2
+	ldmia	sp!, {r4, r5, lr}
+	bx	lr
+.endfunc
+
+.func NVRAM_Xfer2, NVRAM_XFER2
+NVRAM_XFER2:
+	stmdb	sp!, {r4, r5, r6, lr}
+	ldr	r4, =SP_BASE
+	mov	r3, #0
+	cmp	r0, #0
+	bls	_local2
+	ldr	r5, =NVRAM_SCRATCH
+_local4:	
+	ldrb	r6, [r5, r3]
+	str	r6, [r4, #SP_TDR]
+_local3:
+	ldr	r6, [r4, #SP_SR]
+	tst	r6, #SP_TDRE
+	beq	_local3
+	add	r3, r3, #1
+	cmp	r3, r0 /* r0 is # of bytes to send out (command+addr) */
+	blo	_local4
+_local2:
+	mov	r3, #SPI_8CLOCKS
+	str	r3, [r4, #SP_TDR]
+	ldr	r0, [r4, #SP_RDR]
+_local5:	
+	ldr	r0, [r4, #SP_SR]
+	tst	r0, #SP_RDRF
+	beq	_local5
+	ldr	r0, [r4, #SP_RDR] /* what's this byte?  It's the byte read while writing the TDR -- nonsense, because the NVRAM doesn't read and write at the same time */
+	mov	r0, #0
+	cmp	r2, #0  /* r2 is # of bytes to copy in */
+	bls	_local6
+_local7:	
+	ldr	r5, [r4, #SP_SR]
+	tst	r5, #SP_TDRE
+	beq	_local7
+	str	r3, [r4, #SP_TDR]  /* r3 has SPI_8CLOCKS */
+_local8:	
+	ldr	r5, [r4, #SP_SR]
+	tst	r5, #SP_RDRF
+	beq	_local8
+	ldr	r5, [r4, #SP_RDR] /* but didn't we read this byte above? */
+	strb	r5, [r1], #1 /* postindexed */
+	add	r0, r0, #1
+	cmp	r0, r2
+	blo	_local7 /* since we don't send another address, the NVRAM must be capable of sequential reads */
+_local6:
+	mov	r0, #200
+	bl	DELAY9
+	ldmia	sp!, {r4, r5, r6, lr}
+	bx	lr
+#endif
diff --git a/drivers/net/wireless/atmel.h b/drivers/net/wireless/atmel.h
new file mode 100644
index 0000000..825000e
--- /dev/null
+++ b/drivers/net/wireless/atmel.h
@@ -0,0 +1,43 @@
+/*** -*- linux-c -*- **********************************************************
+
+     Driver for Atmel at76c502 at76c504 and at76c506 wireless cards.
+
+         Copyright 2005 Dan Williams and Red Hat, Inc.
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This software is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with Atmel wireless lan drivers; if not, write to the Free Software
+    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+******************************************************************************/
+
+#ifndef _ATMEL_H
+#define _ATMEL_H
+
+typedef enum {
+	ATMEL_FW_TYPE_NONE = 0,
+	ATMEL_FW_TYPE_502,
+	ATMEL_FW_TYPE_502D,
+	ATMEL_FW_TYPE_502E,
+	ATMEL_FW_TYPE_502_3COM,
+	ATMEL_FW_TYPE_504,
+	ATMEL_FW_TYPE_504_2958,
+	ATMEL_FW_TYPE_504A_2958,
+	ATMEL_FW_TYPE_506
+} AtmelFWType;
+
+struct net_device *init_atmel_card(unsigned short, int, const AtmelFWType, struct device *, 
+				    int (*present_func)(void *), void * );
+void stop_atmel_card( struct net_device *, int );
+int atmel_open( struct net_device * );
+
+#endif
diff --git a/drivers/net/wireless/atmel_cs.c b/drivers/net/wireless/atmel_cs.c
new file mode 100644
index 0000000..a91b507
--- /dev/null
+++ b/drivers/net/wireless/atmel_cs.c
@@ -0,0 +1,708 @@
+/*** -*- linux-c -*- **********************************************************
+
+     Driver for Atmel at76c502 at76c504 and at76c506 wireless cards.
+
+        Copyright 2000-2001 ATMEL Corporation.
+        Copyright 2003 Simon Kelley.
+
+    This code was developed from version 2.1.1 of the Atmel drivers, 
+    released by Atmel corp. under the GPL in December 2002. It also 
+    includes code from the Linux aironet drivers (C) Benjamin Reed, 
+    and the Linux PCMCIA package, (C) David Hinds. 
+
+    For all queries about this code, please contact the current author, 
+    Simon Kelley <simon@thekelleys.org.uk> and not Atmel Corporation.
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This software is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with Atmel wireless lan drivers; if not, write to the Free Software
+    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+******************************************************************************/
+
+#include <linux/config.h>
+#ifdef __IN_PCMCIA_PACKAGE__
+#include <pcmcia/k_compat.h>
+#endif
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/ptrace.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/netdevice.h>
+#include <linux/moduleparam.h>
+#include <linux/device.h>
+
+#include <pcmcia/version.h>
+#include <pcmcia/cs_types.h>
+#include <pcmcia/cs.h>
+#include <pcmcia/cistpl.h>
+#include <pcmcia/cisreg.h>
+#include <pcmcia/ds.h>
+#include <pcmcia/ciscode.h>
+
+#include <asm/io.h>
+#include <asm/system.h>
+#include <linux/wireless.h>
+
+#include "atmel.h"
+
+/*
+   All the PCMCIA modules use PCMCIA_DEBUG to control debugging.  If
+   you do not define PCMCIA_DEBUG at all, all the debug code will be
+   left out.  If you compile with PCMCIA_DEBUG=0, the debug code will
+   be present but disabled -- but it can then be enabled for specific
+   modules at load time with a 'pc_debug=#' option to insmod.
+*/
+#ifdef PCMCIA_DEBUG
+static int pc_debug = PCMCIA_DEBUG;
+module_param(pc_debug, int, 0);
+static char *version = "$Revision: 1.2 $";
+#define DEBUG(n, args...) if (pc_debug>(n)) printk(KERN_DEBUG args);
+#else
+#define DEBUG(n, args...)
+#endif
+
+/*====================================================================*/
+
+MODULE_AUTHOR("Simon Kelley");
+MODULE_DESCRIPTION("Support for Atmel at76c50x 802.11 wireless ethernet cards.");
+MODULE_LICENSE("GPL");
+MODULE_SUPPORTED_DEVICE("Atmel at76c50x PCMCIA cards");
+
+/*====================================================================*/
+
+/*
+   The event() function is this driver's Card Services event handler.
+   It will be called by Card Services when an appropriate card status
+   event is received.  The config() and release() entry points are
+   used to configure or release a socket, in response to card
+   insertion and ejection events.  They are invoked from the atmel_cs
+   event handler. 
+*/
+
+static void atmel_config(dev_link_t *link);
+static void atmel_release(dev_link_t *link);
+static int atmel_event(event_t event, int priority,
+		       event_callback_args_t *args);
+
+/*
+   The attach() and detach() entry points are used to create and destroy
+   "instances" of the driver, where each instance represents everything
+   needed to manage one actual PCMCIA card.
+*/
+
+static dev_link_t *atmel_attach(void);
+static void atmel_detach(dev_link_t *);
+
+/*
+   You'll also need to prototype all the functions that will actually
+   be used to talk to your device.  See 'pcmem_cs' for a good example
+   of a fully self-sufficient driver; the other drivers rely more or
+   less on other parts of the kernel.
+*/
+
+/*
+   The dev_info variable is the "key" that is used to match up this
+   device driver with appropriate cards, through the card configuration
+   database.
+*/
+
+static dev_info_t dev_info = "atmel_cs";
+
+/*
+   A linked list of "instances" of the  atmelnet device.  Each actual
+   PCMCIA card corresponds to one device instance, and is described
+   by one dev_link_t structure (defined in ds.h).
+
+   You may not want to use a linked list for this -- for example, the
+   memory card driver uses an array of dev_link_t pointers, where minor
+   device numbers are used to derive the corresponding array index.
+*/
+
+static dev_link_t *dev_list = NULL;
+
+/*
+   A dev_link_t structure has fields for most things that are needed
+   to keep track of a socket, but there will usually be some device
+   specific information that also needs to be kept track of.  The
+   'priv' pointer in a dev_link_t structure can be used to point to
+   a device-specific private data structure, like this.
+
+   A driver needs to provide a dev_node_t structure for each device
+   on a card.  In some cases, there is only one device per card (for
+   example, ethernet cards, modems).  In other cases, there may be
+   many actual or logical devices (SCSI adapters, memory cards with
+   multiple partitions).  The dev_node_t structures need to be kept
+   in a linked list starting at the 'dev' field of a dev_link_t
+   structure.  We allocate them in the card's private data structure,
+   because they generally shouldn't be allocated dynamically.
+
+   In this case, we also provide a flag to indicate if a device is
+   "stopped" due to a power management event, or card ejection.  The
+   device IO routines can use a flag like this to throttle IO to a
+   card that is not ready to accept it.
+*/
+   
+typedef struct local_info_t {
+	dev_node_t	node;
+	struct net_device *eth_dev;
+} local_info_t;
+
+/*======================================================================
+  
+  atmel_attach() creates an "instance" of the driver, allocating
+  local data structures for one device.  The device is registered
+  with Card Services.
+  
+  The dev_link structure is initialized, but we don't actually
+  configure the card at this point -- we wait until we receive a
+  card insertion event.
+  
+  ======================================================================*/
+
+static dev_link_t *atmel_attach(void)
+{
+	client_reg_t client_reg;
+	dev_link_t *link;
+	local_info_t *local;
+	int ret;
+	
+	DEBUG(0, "atmel_attach()\n");
+
+	/* Initialize the dev_link_t structure */
+	link = kmalloc(sizeof(struct dev_link_t), GFP_KERNEL);
+	if (!link) {
+		printk(KERN_ERR "atmel_cs: no memory for new device\n");
+		return NULL;
+	}
+	memset(link, 0, sizeof(struct dev_link_t));
+	
+	/* Interrupt setup */
+	link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
+	link->irq.IRQInfo1 = IRQ_LEVEL_ID;
+	link->irq.Handler = NULL;
+	
+	/*
+	  General socket configuration defaults can go here.  In this
+	  client, we assume very little, and rely on the CIS for almost
+	  everything.  In most clients, many details (i.e., number, sizes,
+	  and attributes of IO windows) are fixed by the nature of the
+	  device, and can be hard-wired here.
+	*/
+	link->conf.Attributes = 0;
+	link->conf.Vcc = 50;
+	link->conf.IntType = INT_MEMORY_AND_IO;
+	
+	/* Allocate space for private device-specific data */
+	local = kmalloc(sizeof(local_info_t), GFP_KERNEL);
+	if (!local) {
+		printk(KERN_ERR "atmel_cs: no memory for new device\n");
+		kfree (link);
+		return NULL;
+	}
+	memset(local, 0, sizeof(local_info_t));
+	link->priv = local;
+	
+	/* Register with Card Services */
+	link->next = dev_list;
+	dev_list = link;
+	client_reg.dev_info = &dev_info;
+	client_reg.EventMask =
+		CS_EVENT_CARD_INSERTION | CS_EVENT_CARD_REMOVAL |
+		CS_EVENT_RESET_PHYSICAL | CS_EVENT_CARD_RESET |
+		CS_EVENT_PM_SUSPEND | CS_EVENT_PM_RESUME;
+	client_reg.event_handler = &atmel_event;
+	client_reg.Version = 0x0210;
+	client_reg.event_callback_args.client_data = link;
+	ret = pcmcia_register_client(&link->handle, &client_reg);
+	if (ret != 0) {
+		cs_error(link->handle, RegisterClient, ret);
+		atmel_detach(link);
+		return NULL;
+	}
+	
+	return link;
+} /* atmel_attach */
+
+/*======================================================================
+  
+  This deletes a driver "instance".  The device is de-registered
+  with Card Services.  If it has been released, all local data
+  structures are freed.  Otherwise, the structures will be freed
+  when the device is released.
+  
+  ======================================================================*/
+
+static void atmel_detach(dev_link_t *link)
+{
+	dev_link_t **linkp;
+	
+	DEBUG(0, "atmel_detach(0x%p)\n", link);
+	
+	/* Locate device structure */
+	for (linkp = &dev_list; *linkp; linkp = &(*linkp)->next)
+		if (*linkp == link) break;
+	if (*linkp == NULL)
+		return;
+
+	if (link->state & DEV_CONFIG)
+		atmel_release(link);
+		
+	/* Break the link with Card Services */
+	if (link->handle)
+		pcmcia_deregister_client(link->handle);
+
+	/* Unlink device structure, free pieces */
+	*linkp = link->next;
+	if (link->priv)
+		kfree(link->priv);
+	kfree(link);
+}
+
+/*======================================================================
+  
+  atmel_config() is scheduled to run after a CARD_INSERTION event
+  is received, to configure the PCMCIA socket, and to make the
+  device available to the system.
+  
+  ======================================================================*/
+
+#define CS_CHECK(fn, ret) \
+do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
+
+/* Call-back function to interrogate PCMCIA-specific information
+   about the current existance of the card */
+static int card_present(void *arg)
+{ 
+	dev_link_t *link = (dev_link_t *)arg;
+	if (link->state & DEV_SUSPEND)
+		return 0;
+	else if (link->state & DEV_PRESENT)
+		return 1;
+	
+	return 0;
+}
+
+/* list of cards we know about and their firmware requirements.
+   Go either by Manfid or version strings.
+   Cards not in this list will need a firmware parameter to the module
+   in all probability. Note that the SMC 2632 V2 and V3 have the same
+   manfids, so we ignore those and use the version1 strings. */
+
+static struct { 
+	int manf, card;
+	char *ver1;
+	AtmelFWType firmware;
+	char *name;
+} card_table[] = {
+	{ 0, 0, "WLAN/802.11b PC CARD", ATMEL_FW_TYPE_502D, "Actiontec 802CAT1" },  
+	{ 0, 0, "ATMEL/AT76C502AR", ATMEL_FW_TYPE_502, "NoName-RFMD" }, 
+	{ 0, 0, "ATMEL/AT76C502AR_D", ATMEL_FW_TYPE_502D, "NoName-revD" }, 
+	{ 0, 0, "ATMEL/AT76C502AR_E", ATMEL_FW_TYPE_502E, "NoName-revE" },
+	{ 0, 0, "ATMEL/AT76C504", ATMEL_FW_TYPE_504, "NoName-504" },
+	{ 0, 0, "ATMEL/AT76C504A", ATMEL_FW_TYPE_504A_2958, "NoName-504a-2958" },
+	{ 0, 0, "ATMEL/AT76C504_R", ATMEL_FW_TYPE_504_2958, "NoName-504-2958" },
+	{ MANFID_3COM, 0x0620, NULL, ATMEL_FW_TYPE_502_3COM, "3com 3CRWE62092B" }, 
+	{ MANFID_3COM, 0x0696, NULL, ATMEL_FW_TYPE_502_3COM, "3com 3CRSHPW196" }, 
+	{ 0, 0, "SMC/2632W-V2", ATMEL_FW_TYPE_502, "SMC 2632W-V2" },
+	{ 0, 0, "SMC/2632W", ATMEL_FW_TYPE_502D, "SMC 2632W-V3" },
+	{ 0xd601, 0x0007, NULL, ATMEL_FW_TYPE_502, "Sitecom WLAN-011" }, 
+	{ 0x01bf, 0x3302, NULL, ATMEL_FW_TYPE_502E, "Belkin F5D6020-V2" }, 
+	{ 0, 0, "BT/Voyager 1020 Laptop Adapter", ATMEL_FW_TYPE_502, "BT Voyager 1020" },
+	{ 0, 0, "IEEE 802.11b/Wireless LAN PC Card", ATMEL_FW_TYPE_502, "Siemens Gigaset PC Card II" },
+	{ 0, 0, "CNet/CNWLC 11Mbps Wireless PC Card V-5", ATMEL_FW_TYPE_502E, "CNet CNWLC-811ARL" },
+	{ 0, 0, "Wireless/PC_CARD", ATMEL_FW_TYPE_502D, "Planet WL-3552" },
+	{ 0, 0, "OEM/11Mbps Wireless LAN PC Card V-3", ATMEL_FW_TYPE_502, "OEM 11Mbps WLAN PCMCIA Card" },
+	{ 0, 0, "11WAVE/11WP611AL-E", ATMEL_FW_TYPE_502E, "11WAVE WaveBuddy" },
+	{ 0, 0, "LG/LW2100N", ATMEL_FW_TYPE_502E, "LG LW2100N 11Mbps WLAN PCMCIA Card" },
+};
+
+static void atmel_config(dev_link_t *link)
+{
+	client_handle_t handle;
+	tuple_t tuple;
+	cisparse_t parse;
+	local_info_t *dev;
+	int last_fn, last_ret;
+	u_char buf[64];
+	int card_index = -1, done = 0;
+	
+	handle = link->handle;
+	dev = link->priv;
+
+	DEBUG(0, "atmel_config(0x%p)\n", link);
+	
+	tuple.Attributes = 0;
+	tuple.TupleData = buf;
+	tuple.TupleDataMax = sizeof(buf);
+	tuple.TupleOffset = 0;
+	
+	tuple.DesiredTuple = CISTPL_MANFID;
+	if (pcmcia_get_first_tuple(handle, &tuple) == 0) {
+		int i;
+		cistpl_manfid_t *manfid;
+		CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
+		CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+		manfid = &(parse.manfid);
+		for (i = 0; i < sizeof(card_table)/sizeof(card_table[0]); i++) {
+			if (!card_table[i].ver1 &&
+			    manfid->manf == card_table[i].manf &&
+			    manfid->card == card_table[i].card) {
+				card_index = i;
+				done = 1;
+			}
+		}
+	}
+
+	tuple.DesiredTuple = CISTPL_VERS_1;
+	if (!done && (pcmcia_get_first_tuple(handle, &tuple) == 0)) {
+		int i, j, k;
+		cistpl_vers_1_t *ver1;
+		CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
+		CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+		ver1 = &(parse.version_1);
+		
+		for (i = 0; i < sizeof(card_table)/sizeof(card_table[0]); i++) {
+			for (j = 0; j < ver1->ns; j++) {
+				char *p = card_table[i].ver1;
+				char *q = &ver1->str[ver1->ofs[j]];
+				if (!p)
+					goto mismatch;
+				for (k = 0; k < j; k++) {
+					while ((*p != '\0') && (*p != '/')) p++;
+					if (*p == '\0') {
+						if (*q != '\0')
+							goto mismatch;
+					} else {
+						p++;
+					}
+				}
+				while((*q != '\0') && (*p != '\0') && 
+				      (*p != '/') && (*p == *q)) p++, q++;
+				if (((*p != '\0') && *p != '/') || *q != '\0')
+					goto mismatch;
+			}
+			card_index = i;
+			break;	/* done */
+			
+		mismatch:
+			j = 0; /* dummy stmt to shut up compiler */
+		}
+	}		
+
+	/*
+	  This reads the card's CONFIG tuple to find its configuration
+	  registers.
+	*/
+	tuple.DesiredTuple = CISTPL_CONFIG;
+	CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+	CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
+	CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+	link->conf.ConfigBase = parse.config.base;
+	link->conf.Present = parse.config.rmask[0];
+	
+	/* Configure card */
+	link->state |= DEV_CONFIG;
+	
+	/*
+	  In this loop, we scan the CIS for configuration table entries,
+	  each of which describes a valid card configuration, including
+	  voltage, IO window, memory window, and interrupt settings.
+	  
+	  We make no assumptions about the card to be configured: we use
+	  just the information available in the CIS.  In an ideal world,
+	  this would work for any PCMCIA card, but it requires a complete
+	  and accurate CIS.  In practice, a driver usually "knows" most of
+	  these things without consulting the CIS, and most client drivers
+	  will only use the CIS to fill in implementation-defined details.
+	*/
+	tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
+	CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+	while (1) {
+		cistpl_cftable_entry_t dflt = { 0 };
+		cistpl_cftable_entry_t *cfg = &(parse.cftable_entry);
+		if (pcmcia_get_tuple_data(handle, &tuple) != 0 ||
+				pcmcia_parse_tuple(handle, &tuple, &parse) != 0)
+			goto next_entry;
+		
+		if (cfg->flags & CISTPL_CFTABLE_DEFAULT) dflt = *cfg;
+		if (cfg->index == 0) goto next_entry;
+		link->conf.ConfigIndex = cfg->index;
+		
+		/* Does this card need audio output? */
+		if (cfg->flags & CISTPL_CFTABLE_AUDIO) {
+			link->conf.Attributes |= CONF_ENABLE_SPKR;
+			link->conf.Status = CCSR_AUDIO_ENA;
+		}
+		
+		/* Use power settings for Vcc and Vpp if present */
+		/*  Note that the CIS values need to be rescaled */
+		if (cfg->vcc.present & (1<<CISTPL_POWER_VNOM))
+			link->conf.Vcc = cfg->vcc.param[CISTPL_POWER_VNOM]/10000;
+		else if (dflt.vcc.present & (1<<CISTPL_POWER_VNOM))
+			link->conf.Vcc = dflt.vcc.param[CISTPL_POWER_VNOM]/10000;
+		
+		if (cfg->vpp1.present & (1<<CISTPL_POWER_VNOM))
+			link->conf.Vpp1 = link->conf.Vpp2 =
+				cfg->vpp1.param[CISTPL_POWER_VNOM]/10000;
+		else if (dflt.vpp1.present & (1<<CISTPL_POWER_VNOM))
+			link->conf.Vpp1 = link->conf.Vpp2 =
+				dflt.vpp1.param[CISTPL_POWER_VNOM]/10000;
+		
+		/* Do we need to allocate an interrupt? */
+		if (cfg->irq.IRQInfo1 || dflt.irq.IRQInfo1)
+			link->conf.Attributes |= CONF_ENABLE_IRQ;
+		
+		/* IO window settings */
+		link->io.NumPorts1 = link->io.NumPorts2 = 0;
+		if ((cfg->io.nwin > 0) || (dflt.io.nwin > 0)) {
+			cistpl_io_t *io = (cfg->io.nwin) ? &cfg->io : &dflt.io;
+			link->io.Attributes1 = IO_DATA_PATH_WIDTH_AUTO;
+			if (!(io->flags & CISTPL_IO_8BIT))
+				link->io.Attributes1 = IO_DATA_PATH_WIDTH_16;
+			if (!(io->flags & CISTPL_IO_16BIT))
+				link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
+			link->io.BasePort1 = io->win[0].base;
+			link->io.NumPorts1 = io->win[0].len;
+			if (io->nwin > 1) {
+				link->io.Attributes2 = link->io.Attributes1;
+				link->io.BasePort2 = io->win[1].base;
+				link->io.NumPorts2 = io->win[1].len;
+			}
+		}
+		
+		/* This reserves IO space but doesn't actually enable it */
+		if (pcmcia_request_io(link->handle, &link->io) != 0)
+			goto next_entry;
+
+		/* If we got this far, we're cool! */
+		break;
+		
+	next_entry:
+		CS_CHECK(GetNextTuple, pcmcia_get_next_tuple(handle, &tuple));
+	}
+	
+	/*
+	  Allocate an interrupt line.  Note that this does not assign a
+	  handler to the interrupt, unless the 'Handler' member of the
+	  irq structure is initialized.
+	*/
+	if (link->conf.Attributes & CONF_ENABLE_IRQ)
+		CS_CHECK(RequestIRQ, pcmcia_request_irq(link->handle, &link->irq));
+	
+	/*
+	  This actually configures the PCMCIA socket -- setting up
+	  the I/O windows and the interrupt mapping, and putting the
+	  card and host interface into "Memory and IO" mode.
+	*/
+	CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link->handle, &link->conf));
+	
+	if (link->irq.AssignedIRQ == 0) {
+		printk(KERN_ALERT 
+		       "atmel: cannot assign IRQ: check that CONFIG_ISA is set in kernel config.");
+		goto cs_failed;
+	}
+       
+	((local_info_t*)link->priv)->eth_dev = 
+		init_atmel_card(link->irq.AssignedIRQ,
+				link->io.BasePort1,
+				card_index == -1 ? ATMEL_FW_TYPE_NONE :  card_table[card_index].firmware,
+				&handle_to_dev(handle),
+				card_present, 
+				link);
+	if (!((local_info_t*)link->priv)->eth_dev) 
+		goto cs_failed;
+	
+	/*
+	  At this point, the dev_node_t structure(s) need to be
+	  initialized and arranged in a linked list at link->dev.
+	*/
+	strcpy(dev->node.dev_name, ((local_info_t*)link->priv)->eth_dev->name );
+	dev->node.major = dev->node.minor = 0;
+	link->dev = &dev->node;
+	
+	/* Finally, report what we've done */
+	printk(KERN_INFO "%s: %s%sindex 0x%02x: Vcc %d.%d",
+	       dev->node.dev_name,
+	       card_index == -1 ? "" :  card_table[card_index].name,
+	       card_index == -1 ? "" : " ",
+	       link->conf.ConfigIndex,
+	       link->conf.Vcc/10, link->conf.Vcc%10);
+	if (link->conf.Vpp1)
+		printk(", Vpp %d.%d", link->conf.Vpp1/10, link->conf.Vpp1%10);
+	if (link->conf.Attributes & CONF_ENABLE_IRQ)
+		printk(", irq %d", link->irq.AssignedIRQ);
+	if (link->io.NumPorts1)
+		printk(", io 0x%04x-0x%04x", link->io.BasePort1,
+		       link->io.BasePort1+link->io.NumPorts1-1);
+	if (link->io.NumPorts2)
+		printk(" & 0x%04x-0x%04x", link->io.BasePort2,
+		       link->io.BasePort2+link->io.NumPorts2-1);
+	printk("\n");
+	
+	link->state &= ~DEV_CONFIG_PENDING;
+	return;
+	
+ cs_failed:
+	cs_error(link->handle, last_fn, last_ret);
+	atmel_release(link);
+}
+
+/*======================================================================
+  
+  After a card is removed, atmel_release() will unregister the
+  device, and release the PCMCIA configuration.  If the device is
+  still open, this will be postponed until it is closed.
+  
+  ======================================================================*/
+
+static void atmel_release(dev_link_t *link)
+{
+	struct net_device *dev = ((local_info_t*)link->priv)->eth_dev;
+		
+	DEBUG(0, "atmel_release(0x%p)\n", link);
+	
+	/* Unlink the device chain */
+	link->dev = NULL;
+	
+	if (dev) 
+		stop_atmel_card(dev, 0);
+	((local_info_t*)link->priv)->eth_dev = NULL; 
+	
+	/* Don't bother checking to see if these succeed or not */
+	pcmcia_release_configuration(link->handle);
+	if (link->io.NumPorts1)
+		pcmcia_release_io(link->handle, &link->io);
+	if (link->irq.AssignedIRQ)
+		pcmcia_release_irq(link->handle, &link->irq);
+	link->state &= ~DEV_CONFIG;
+}
+
+/*======================================================================
+  
+  The card status event handler.  Mostly, this schedules other
+  stuff to run after an event is received.
+
+  When a CARD_REMOVAL event is received, we immediately set a
+  private flag to block future accesses to this device.  All the
+  functions that actually access the device should check this flag
+  to make sure the card is still present.
+  
+  ======================================================================*/
+
+static int atmel_event(event_t event, int priority,
+		      event_callback_args_t *args)
+{
+	dev_link_t *link = args->client_data;
+	local_info_t *local = link->priv;
+	
+	DEBUG(1, "atmel_event(0x%06x)\n", event);
+	
+	switch (event) {
+	case CS_EVENT_CARD_REMOVAL:
+		link->state &= ~DEV_PRESENT;
+		if (link->state & DEV_CONFIG) {
+			netif_device_detach(local->eth_dev);
+			atmel_release(link);
+		}
+		break;
+	case CS_EVENT_CARD_INSERTION:
+		link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
+		atmel_config(link);
+		break;
+	case CS_EVENT_PM_SUSPEND:
+		link->state |= DEV_SUSPEND;
+		/* Fall through... */
+	case CS_EVENT_RESET_PHYSICAL:
+		if (link->state & DEV_CONFIG) {
+			netif_device_detach(local->eth_dev);
+			pcmcia_release_configuration(link->handle);
+		}
+		break;
+	case CS_EVENT_PM_RESUME:
+		link->state &= ~DEV_SUSPEND;
+		/* Fall through... */
+	case CS_EVENT_CARD_RESET:
+		if (link->state & DEV_CONFIG) {
+			pcmcia_request_configuration(link->handle, &link->conf);
+			atmel_open(local->eth_dev);
+			netif_device_attach(local->eth_dev);
+		}
+		break;
+	}
+	return 0;
+} /* atmel_event */
+
+/*====================================================================*/
+static struct pcmcia_driver atmel_driver = {
+        .owner          = THIS_MODULE,
+        .drv            = {
+                .name   = "atmel_cs",
+        },
+        .attach         = atmel_attach,
+        .detach         = atmel_detach,
+};
+
+static int atmel_cs_init(void)
+{
+        return pcmcia_register_driver(&atmel_driver);
+}
+
+static void atmel_cs_cleanup(void)
+{
+        pcmcia_unregister_driver(&atmel_driver);
+	BUG_ON(dev_list != NULL);
+}
+
+/*
+    This program is free software; you can redistribute it and/or
+    modify it under the terms of the GNU General Public License
+    as published by the Free Software Foundation; either version 2
+    of the License, or (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    In addition:
+
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions
+    are met:
+
+    1. Redistributions of source code must retain the above copyright
+       notice, this list of conditions and the following disclaimer.
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+    3. The name of the author may not be used to endorse or promote
+       products derived from this software without specific prior written
+       permission.
+
+    THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+    IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+    WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+    ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
+    INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+    (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+    SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+    HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+    STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+    IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.    
+*/
+
+module_init(atmel_cs_init);
+module_exit(atmel_cs_cleanup);
diff --git a/drivers/net/wireless/atmel_pci.c b/drivers/net/wireless/atmel_pci.c
new file mode 100644
index 0000000..2eb00a9
--- /dev/null
+++ b/drivers/net/wireless/atmel_pci.c
@@ -0,0 +1,89 @@
+/*** -*- linux-c -*- **********************************************************
+
+     Driver for Atmel at76c502 at76c504 and at76c506 wireless cards.
+
+         Copyright 2004 Simon Kelley.
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This software is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with Atmel wireless lan drivers; if not, write to the Free Software
+    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+******************************************************************************/
+#include <linux/config.h>
+#include <linux/pci.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/netdevice.h>
+#include "atmel.h"
+
+MODULE_AUTHOR("Simon Kelley");
+MODULE_DESCRIPTION("Support for Atmel at76c50x 802.11 wireless ethernet cards.");
+MODULE_LICENSE("GPL");
+MODULE_SUPPORTED_DEVICE("Atmel at76c506 PCI wireless cards");
+
+static struct pci_device_id card_ids[] = {
+	{ 0x1114, 0x0506, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0, }
+};
+
+MODULE_DEVICE_TABLE(pci, card_ids);
+
+static int atmel_pci_probe(struct pci_dev *, const struct pci_device_id *);
+static void atmel_pci_remove(struct pci_dev *);
+
+static struct pci_driver atmel_driver = {
+	.name     = "atmel",
+	.id_table = card_ids,
+	.probe    = atmel_pci_probe,
+	.remove   = __devexit_p(atmel_pci_remove),
+};
+
+
+static int __devinit atmel_pci_probe(struct pci_dev *pdev,
+				     const struct pci_device_id *pent)
+{
+	struct net_device *dev;
+		
+	if (pci_enable_device(pdev))
+		return -ENODEV;
+	
+	pci_set_master(pdev);
+	
+	dev = init_atmel_card(pdev->irq, pdev->resource[1].start, 
+			      ATMEL_FW_TYPE_506,
+			      &pdev->dev, NULL, NULL);
+	if (!dev)
+		return -ENODEV;
+	
+	pci_set_drvdata(pdev, dev);
+	return 0;
+}
+
+static void __devexit atmel_pci_remove(struct pci_dev *pdev)
+{
+	stop_atmel_card(pci_get_drvdata(pdev), 1);
+}
+
+static int __init atmel_init_module(void)
+{
+	return pci_module_init(&atmel_driver);
+}
+
+static void __exit atmel_cleanup_module(void)
+{
+	pci_unregister_driver(&atmel_driver);
+}
+
+module_init(atmel_init_module);
+module_exit(atmel_cleanup_module);
diff --git a/drivers/net/wireless/hermes.c b/drivers/net/wireless/hermes.c
new file mode 100644
index 0000000..21c3d0d
--- /dev/null
+++ b/drivers/net/wireless/hermes.c
@@ -0,0 +1,554 @@
+/* hermes.c
+ *
+ * Driver core for the "Hermes" wireless MAC controller, as used in
+ * the Lucent Orinoco and Cabletron RoamAbout cards. It should also
+ * work on the hfa3841 and hfa3842 MAC controller chips used in the
+ * Prism II chipsets.
+ *
+ * This is not a complete driver, just low-level access routines for
+ * the MAC controller itself.
+ *
+ * Based on the prism2 driver from Absolute Value Systems' linux-wlan
+ * project, the Linux wvlan_cs driver, Lucent's HCF-Light
+ * (wvlan_hcf.c) library, and the NetBSD wireless driver (in no
+ * particular order).
+ *
+ * Copyright (C) 2000, David Gibson, Linuxcare Australia.
+ * (C) Copyright David Gibson, IBM Corp. 2001-2003.
+ * 
+ * The contents of this file are subject to the Mozilla Public License
+ * Version 1.1 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License
+ * at http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS"
+ * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+ * the License for the specific language governing rights and
+ * limitations under the License.
+ *
+ * Alternatively, the contents of this file may be used under the
+ * terms of the GNU General Public License version 2 (the "GPL"), in
+ * which case the provisions of the GPL are applicable instead of the
+ * above.  If you wish to allow the use of your version of this file
+ * only under the terms of the GPL and not to allow others to use your
+ * version of this file under the MPL, indicate your decision by
+ * deleting the provisions above and replace them with the notice and
+ * other provisions required by the GPL.  If you do not delete the
+ * provisions above, a recipient may use your version of this file
+ * under either the MPL or the GPL.
+ */
+
+#include <linux/config.h>
+
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/threads.h>
+#include <linux/smp.h>
+#include <asm/io.h>
+#include <linux/delay.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/net.h>
+#include <asm/errno.h>
+
+#include "hermes.h"
+
+MODULE_DESCRIPTION("Low-level driver helper for Lucent Hermes chipset and Prism II HFA384x wireless MAC controller");
+MODULE_AUTHOR("Pavel Roskin <proski@gnu.org>"
+	" & David Gibson <hermes@gibson.dropbear.id.au>");
+MODULE_LICENSE("Dual MPL/GPL");
+
+/* These are maximum timeouts. Most often, card wil react much faster */
+#define CMD_BUSY_TIMEOUT (100) /* In iterations of ~1us */
+#define CMD_INIT_TIMEOUT (50000) /* in iterations of ~10us */
+#define CMD_COMPL_TIMEOUT (20000) /* in iterations of ~10us */
+#define ALLOC_COMPL_TIMEOUT (1000) /* in iterations of ~10us */
+
+/*
+ * Debugging helpers
+ */
+
+#define DMSG(stuff...) do {printk(KERN_DEBUG "hermes @ %p: " , hw->iobase); \
+			printk(stuff);} while (0)
+
+#undef HERMES_DEBUG
+#ifdef HERMES_DEBUG
+#include <stdarg.h>
+
+#define DEBUG(lvl, stuff...) if ( (lvl) <= HERMES_DEBUG) DMSG(stuff)
+
+#else /* ! HERMES_DEBUG */
+
+#define DEBUG(lvl, stuff...) do { } while (0)
+
+#endif /* ! HERMES_DEBUG */
+
+
+/*
+ * Internal functions
+ */
+
+/* Issue a command to the chip. Waiting for it to complete is the caller's
+   problem.
+
+   Returns -EBUSY if the command register is busy, 0 on success.
+
+   Callable from any context.
+*/
+static int hermes_issue_cmd(hermes_t *hw, u16 cmd, u16 param0)
+{
+	int k = CMD_BUSY_TIMEOUT;
+	u16 reg;
+
+	/* First wait for the command register to unbusy */
+	reg = hermes_read_regn(hw, CMD);
+	while ( (reg & HERMES_CMD_BUSY) && k ) {
+		k--;
+		udelay(1);
+		reg = hermes_read_regn(hw, CMD);
+	}
+	if (reg & HERMES_CMD_BUSY) {
+		return -EBUSY;
+	}
+
+	hermes_write_regn(hw, PARAM2, 0);
+	hermes_write_regn(hw, PARAM1, 0);
+	hermes_write_regn(hw, PARAM0, param0);
+	hermes_write_regn(hw, CMD, cmd);
+	
+	return 0;
+}
+
+/*
+ * Function definitions
+ */
+
+void hermes_struct_init(hermes_t *hw, void __iomem *address, int reg_spacing)
+{
+	hw->iobase = address;
+	hw->reg_spacing = reg_spacing;
+	hw->inten = 0x0;
+
+#ifdef HERMES_DEBUG_BUFFER
+	hw->dbufp = 0;
+	memset(&hw->dbuf, 0xff, sizeof(hw->dbuf));
+	memset(&hw->profile, 0, sizeof(hw->profile));
+#endif
+}
+
+int hermes_init(hermes_t *hw)
+{
+	u16 status, reg;
+	int err = 0;
+	int k;
+
+	/* We don't want to be interrupted while resetting the chipset */
+	hw->inten = 0x0;
+	hermes_write_regn(hw, INTEN, 0);
+	hermes_write_regn(hw, EVACK, 0xffff);
+
+	/* Normally it's a "can't happen" for the command register to
+           be busy when we go to issue a command because we are
+           serializing all commands.  However we want to have some
+           chance of resetting the card even if it gets into a stupid
+           state, so we actually wait to see if the command register
+           will unbusy itself here. */
+	k = CMD_BUSY_TIMEOUT;
+	reg = hermes_read_regn(hw, CMD);
+	while (k && (reg & HERMES_CMD_BUSY)) {
+		if (reg == 0xffff) /* Special case - the card has probably been removed,
+				      so don't wait for the timeout */
+			return -ENODEV;
+
+		k--;
+		udelay(1);
+		reg = hermes_read_regn(hw, CMD);
+	}
+	
+	/* No need to explicitly handle the timeout - if we've timed
+	   out hermes_issue_cmd() will probably return -EBUSY below */
+
+	/* According to the documentation, EVSTAT may contain
+	   obsolete event occurrence information.  We have to acknowledge
+	   it by writing EVACK. */
+	reg = hermes_read_regn(hw, EVSTAT);
+	hermes_write_regn(hw, EVACK, reg);
+
+	/* We don't use hermes_docmd_wait here, because the reset wipes
+	   the magic constant in SWSUPPORT0 away, and it gets confused */
+	err = hermes_issue_cmd(hw, HERMES_CMD_INIT, 0);
+	if (err)
+		return err;
+
+	reg = hermes_read_regn(hw, EVSTAT);
+	k = CMD_INIT_TIMEOUT;
+	while ( (! (reg & HERMES_EV_CMD)) && k) {
+		k--;
+		udelay(10);
+		reg = hermes_read_regn(hw, EVSTAT);
+	}
+
+	hermes_write_regn(hw, SWSUPPORT0, HERMES_MAGIC);
+
+	if (! hermes_present(hw)) {
+		DEBUG(0, "hermes @ 0x%x: Card removed during reset.\n",
+		       hw->iobase);
+		err = -ENODEV;
+		goto out;
+	}
+		
+	if (! (reg & HERMES_EV_CMD)) {
+		printk(KERN_ERR "hermes @ %p: " 
+		       "Timeout waiting for card to reset (reg=0x%04x)!\n",
+		       hw->iobase, reg);
+		err = -ETIMEDOUT;
+		goto out;
+	}
+
+	status = hermes_read_regn(hw, STATUS);
+
+	hermes_write_regn(hw, EVACK, HERMES_EV_CMD);
+
+	if (status & HERMES_STATUS_RESULT)
+		err = -EIO;
+
+ out:
+	return err;
+}
+
+/* Issue a command to the chip, and (busy!) wait for it to
+ * complete.
+ *
+ * Returns: < 0 on internal error, 0 on success, > 0 on error returned by the firmware
+ *
+ * Callable from any context, but locking is your problem. */
+int hermes_docmd_wait(hermes_t *hw, u16 cmd, u16 parm0,
+		      struct hermes_response *resp)
+{
+	int err;
+	int k;
+	u16 reg;
+	u16 status;
+
+	err = hermes_issue_cmd(hw, cmd, parm0);
+	if (err) {
+		if (! hermes_present(hw)) {
+			if (net_ratelimit())
+				printk(KERN_WARNING "hermes @ %p: "
+				       "Card removed while issuing command "
+				       "0x%04x.\n", hw->iobase, cmd);
+			err = -ENODEV;
+		} else 
+			if (net_ratelimit())
+				printk(KERN_ERR "hermes @ %p: "
+				       "Error %d issuing command 0x%04x.\n",
+				       hw->iobase, err, cmd);
+		goto out;
+	}
+
+	reg = hermes_read_regn(hw, EVSTAT);
+	k = CMD_COMPL_TIMEOUT;
+	while ( (! (reg & HERMES_EV_CMD)) && k) {
+		k--;
+		udelay(10);
+		reg = hermes_read_regn(hw, EVSTAT);
+	}
+
+	if (! hermes_present(hw)) {
+		printk(KERN_WARNING "hermes @ %p: Card removed "
+		       "while waiting for command 0x%04x completion.\n",
+		       hw->iobase, cmd);
+		err = -ENODEV;
+		goto out;
+	}
+		
+	if (! (reg & HERMES_EV_CMD)) {
+		printk(KERN_ERR "hermes @ %p: Timeout waiting for "
+		       "command 0x%04x completion.\n", hw->iobase, cmd);
+		err = -ETIMEDOUT;
+		goto out;
+	}
+
+	status = hermes_read_regn(hw, STATUS);
+	if (resp) {
+		resp->status = status;
+		resp->resp0 = hermes_read_regn(hw, RESP0);
+		resp->resp1 = hermes_read_regn(hw, RESP1);
+		resp->resp2 = hermes_read_regn(hw, RESP2);
+	}
+
+	hermes_write_regn(hw, EVACK, HERMES_EV_CMD);
+
+	if (status & HERMES_STATUS_RESULT)
+		err = -EIO;
+
+ out:
+	return err;
+}
+
+int hermes_allocate(hermes_t *hw, u16 size, u16 *fid)
+{
+	int err = 0;
+	int k;
+	u16 reg;
+	
+	if ( (size < HERMES_ALLOC_LEN_MIN) || (size > HERMES_ALLOC_LEN_MAX) )
+		return -EINVAL;
+
+	err = hermes_docmd_wait(hw, HERMES_CMD_ALLOC, size, NULL);
+	if (err) {
+		return err;
+	}
+
+	reg = hermes_read_regn(hw, EVSTAT);
+	k = ALLOC_COMPL_TIMEOUT;
+	while ( (! (reg & HERMES_EV_ALLOC)) && k) {
+		k--;
+		udelay(10);
+		reg = hermes_read_regn(hw, EVSTAT);
+	}
+	
+	if (! hermes_present(hw)) {
+		printk(KERN_WARNING "hermes @ %p: "
+		       "Card removed waiting for frame allocation.\n",
+		       hw->iobase);
+		return -ENODEV;
+	}
+		
+	if (! (reg & HERMES_EV_ALLOC)) {
+		printk(KERN_ERR "hermes @ %p: "
+		       "Timeout waiting for frame allocation\n",
+		       hw->iobase);
+		return -ETIMEDOUT;
+	}
+
+	*fid = hermes_read_regn(hw, ALLOCFID);
+	hermes_write_regn(hw, EVACK, HERMES_EV_ALLOC);
+	
+	return 0;
+}
+
+
+/* Set up a BAP to read a particular chunk of data from card's internal buffer.
+ *
+ * Returns: < 0 on internal failure (errno), 0 on success, >0 on error
+ * from firmware
+ *
+ * Callable from any context */
+static int hermes_bap_seek(hermes_t *hw, int bap, u16 id, u16 offset)
+{
+	int sreg = bap ? HERMES_SELECT1 : HERMES_SELECT0;
+	int oreg = bap ? HERMES_OFFSET1 : HERMES_OFFSET0;
+	int k;
+	u16 reg;
+
+	/* Paranoia.. */
+	if ( (offset > HERMES_BAP_OFFSET_MAX) || (offset % 2) )
+		return -EINVAL;
+
+	k = HERMES_BAP_BUSY_TIMEOUT;
+	reg = hermes_read_reg(hw, oreg);
+	while ((reg & HERMES_OFFSET_BUSY) && k) {
+		k--;
+		udelay(1);
+		reg = hermes_read_reg(hw, oreg);
+	}
+
+#ifdef HERMES_DEBUG_BUFFER
+	hw->profile[HERMES_BAP_BUSY_TIMEOUT - k]++;
+
+	if (k < HERMES_BAP_BUSY_TIMEOUT) {
+		struct hermes_debug_entry *e = 
+			&hw->dbuf[(hw->dbufp++) % HERMES_DEBUG_BUFSIZE];
+		e->bap = bap;
+		e->id = id;
+		e->offset = offset;
+		e->cycles = HERMES_BAP_BUSY_TIMEOUT - k;
+	}
+#endif
+
+	if (reg & HERMES_OFFSET_BUSY)
+		return -ETIMEDOUT;
+
+	/* Now we actually set up the transfer */
+	hermes_write_reg(hw, sreg, id);
+	hermes_write_reg(hw, oreg, offset);
+
+	/* Wait for the BAP to be ready */
+	k = HERMES_BAP_BUSY_TIMEOUT;
+	reg = hermes_read_reg(hw, oreg);
+	while ( (reg & (HERMES_OFFSET_BUSY | HERMES_OFFSET_ERR)) && k) {
+		k--;
+		udelay(1);
+		reg = hermes_read_reg(hw, oreg);
+	}
+
+	if (reg != offset) {
+		printk(KERN_ERR "hermes @ %p: BAP%d offset %s: "
+		       "reg=0x%x id=0x%x offset=0x%x\n", hw->iobase, bap,
+		       (reg & HERMES_OFFSET_BUSY) ? "timeout" : "error",
+		       reg, id, offset);
+
+		if (reg & HERMES_OFFSET_BUSY) {
+			return -ETIMEDOUT;
+		}
+
+		return -EIO;		/* error or wrong offset */
+	}
+
+	return 0;
+}
+
+/* Read a block of data from the chip's buffer, via the
+ * BAP. Synchronization/serialization is the caller's problem.  len
+ * must be even.
+ *
+ * Returns: < 0 on internal failure (errno), 0 on success, > 0 on error from firmware
+ */
+int hermes_bap_pread(hermes_t *hw, int bap, void *buf, unsigned len,
+		     u16 id, u16 offset)
+{
+	int dreg = bap ? HERMES_DATA1 : HERMES_DATA0;
+	int err = 0;
+
+	if ( (len < 0) || (len % 2) )
+		return -EINVAL;
+
+	err = hermes_bap_seek(hw, bap, id, offset);
+	if (err)
+		goto out;
+
+	/* Actually do the transfer */
+	hermes_read_words(hw, dreg, buf, len/2);
+
+ out:
+	return err;
+}
+
+/* Write a block of data to the chip's buffer, via the
+ * BAP. Synchronization/serialization is the caller's problem. len
+ * must be even.
+ *
+ * Returns: < 0 on internal failure (errno), 0 on success, > 0 on error from firmware
+ */
+int hermes_bap_pwrite(hermes_t *hw, int bap, const void *buf, unsigned len,
+		      u16 id, u16 offset)
+{
+	int dreg = bap ? HERMES_DATA1 : HERMES_DATA0;
+	int err = 0;
+
+	if ( (len < 0) || (len % 2) )
+		return -EINVAL;
+
+	err = hermes_bap_seek(hw, bap, id, offset);
+	if (err)
+		goto out;
+	
+	/* Actually do the transfer */
+	hermes_write_words(hw, dreg, buf, len/2);
+
+ out:	
+	return err;
+}
+
+/* Read a Length-Type-Value record from the card.
+ *
+ * If length is NULL, we ignore the length read from the card, and
+ * read the entire buffer regardless. This is useful because some of
+ * the configuration records appear to have incorrect lengths in
+ * practice.
+ *
+ * Callable from user or bh context.  */
+int hermes_read_ltv(hermes_t *hw, int bap, u16 rid, unsigned bufsize,
+		    u16 *length, void *buf)
+{
+	int err = 0;
+	int dreg = bap ? HERMES_DATA1 : HERMES_DATA0;
+	u16 rlength, rtype;
+	unsigned nwords;
+
+	if ( (bufsize < 0) || (bufsize % 2) )
+		return -EINVAL;
+
+	err = hermes_docmd_wait(hw, HERMES_CMD_ACCESS, rid, NULL);
+	if (err)
+		return err;
+
+	err = hermes_bap_seek(hw, bap, rid, 0);
+	if (err)
+		return err;
+
+	rlength = hermes_read_reg(hw, dreg);
+
+	if (! rlength)
+		return -ENODATA;
+
+	rtype = hermes_read_reg(hw, dreg);
+
+	if (length)
+		*length = rlength;
+
+	if (rtype != rid)
+		printk(KERN_WARNING "hermes @ %p: %s(): "
+		       "rid (0x%04x) does not match type (0x%04x)\n",
+		       hw->iobase, __FUNCTION__, rid, rtype);
+	if (HERMES_RECLEN_TO_BYTES(rlength) > bufsize)
+		printk(KERN_WARNING "hermes @ %p: "
+		       "Truncating LTV record from %d to %d bytes. "
+		       "(rid=0x%04x, len=0x%04x)\n", hw->iobase,
+		       HERMES_RECLEN_TO_BYTES(rlength), bufsize, rid, rlength);
+
+	nwords = min((unsigned)rlength - 1, bufsize / 2);
+	hermes_read_words(hw, dreg, buf, nwords);
+
+	return 0;
+}
+
+int hermes_write_ltv(hermes_t *hw, int bap, u16 rid, 
+		     u16 length, const void *value)
+{
+	int dreg = bap ? HERMES_DATA1 : HERMES_DATA0;
+	int err = 0;
+	unsigned count;
+
+	if (length == 0)
+		return -EINVAL;
+
+	err = hermes_bap_seek(hw, bap, rid, 0);
+	if (err)
+		return err;
+
+	hermes_write_reg(hw, dreg, length);
+	hermes_write_reg(hw, dreg, rid);
+
+	count = length - 1;
+
+	hermes_write_words(hw, dreg, value, count);
+
+	err = hermes_docmd_wait(hw, HERMES_CMD_ACCESS | HERMES_CMD_WRITE, 
+				rid, NULL);
+
+	return err;
+}
+
+EXPORT_SYMBOL(hermes_struct_init);
+EXPORT_SYMBOL(hermes_init);
+EXPORT_SYMBOL(hermes_docmd_wait);
+EXPORT_SYMBOL(hermes_allocate);
+
+EXPORT_SYMBOL(hermes_bap_pread);
+EXPORT_SYMBOL(hermes_bap_pwrite);
+EXPORT_SYMBOL(hermes_read_ltv);
+EXPORT_SYMBOL(hermes_write_ltv);
+
+static int __init init_hermes(void)
+{
+	return 0;
+}
+
+static void __exit exit_hermes(void)
+{
+}
+
+module_init(init_hermes);
+module_exit(exit_hermes);
diff --git a/drivers/net/wireless/hermes.h b/drivers/net/wireless/hermes.h
new file mode 100644
index 0000000..8c9e874
--- /dev/null
+++ b/drivers/net/wireless/hermes.h
@@ -0,0 +1,481 @@
+/* hermes.h
+ *
+ * Driver core for the "Hermes" wireless MAC controller, as used in
+ * the Lucent Orinoco and Cabletron RoamAbout cards. It should also
+ * work on the hfa3841 and hfa3842 MAC controller chips used in the
+ * Prism I & II chipsets.
+ *
+ * This is not a complete driver, just low-level access routines for
+ * the MAC controller itself.
+ *
+ * Based on the prism2 driver from Absolute Value Systems' linux-wlan
+ * project, the Linux wvlan_cs driver, Lucent's HCF-Light
+ * (wvlan_hcf.c) library, and the NetBSD wireless driver.
+ *
+ * Copyright (C) 2000, David Gibson, Linuxcare Australia.
+ * (C) Copyright David Gibson, IBM Corp. 2001-2003.
+ *
+ * Portions taken from hfa384x.h, Copyright (C) 1999 AbsoluteValue Systems, Inc. All Rights Reserved.
+ *
+ * This file distributed under the GPL, version 2.
+ */
+
+#ifndef _HERMES_H
+#define _HERMES_H
+
+/* Notes on locking:
+ *
+ * As a module of low level hardware access routines, there is no
+ * locking. Users of this module should ensure that they serialize
+ * access to the hermes_t structure, and to the hardware
+*/
+
+#include <linux/delay.h>
+#include <linux/if_ether.h>
+#include <asm/byteorder.h>
+
+/*
+ * Limits and constants
+ */
+#define		HERMES_ALLOC_LEN_MIN		(4)
+#define		HERMES_ALLOC_LEN_MAX		(2400)
+#define		HERMES_LTV_LEN_MAX		(34)
+#define		HERMES_BAP_DATALEN_MAX		(4096)
+#define		HERMES_BAP_OFFSET_MAX		(4096)
+#define		HERMES_PORTID_MAX		(7)
+#define		HERMES_NUMPORTS_MAX		(HERMES_PORTID_MAX+1)
+#define		HERMES_PDR_LEN_MAX		(260)	/* in bytes, from EK */
+#define		HERMES_PDA_RECS_MAX		(200)	/* a guess */
+#define		HERMES_PDA_LEN_MAX		(1024)	/* in bytes, from EK */
+#define		HERMES_SCANRESULT_MAX		(35)
+#define		HERMES_CHINFORESULT_MAX		(8)
+#define		HERMES_MAX_MULTICAST		(16)
+#define		HERMES_MAGIC			(0x7d1f)
+
+/*
+ * Hermes register offsets
+ */
+#define		HERMES_CMD			(0x00)
+#define		HERMES_PARAM0			(0x02)
+#define		HERMES_PARAM1			(0x04)
+#define		HERMES_PARAM2			(0x06)
+#define		HERMES_STATUS			(0x08)
+#define		HERMES_RESP0			(0x0A)
+#define		HERMES_RESP1			(0x0C)
+#define		HERMES_RESP2			(0x0E)
+#define		HERMES_INFOFID			(0x10)
+#define		HERMES_RXFID			(0x20)
+#define		HERMES_ALLOCFID			(0x22)
+#define		HERMES_TXCOMPLFID		(0x24)
+#define		HERMES_SELECT0			(0x18)
+#define		HERMES_OFFSET0			(0x1C)
+#define		HERMES_DATA0			(0x36)
+#define		HERMES_SELECT1			(0x1A)
+#define		HERMES_OFFSET1			(0x1E)
+#define		HERMES_DATA1			(0x38)
+#define		HERMES_EVSTAT			(0x30)
+#define		HERMES_INTEN			(0x32)
+#define		HERMES_EVACK			(0x34)
+#define		HERMES_CONTROL			(0x14)
+#define		HERMES_SWSUPPORT0		(0x28)
+#define		HERMES_SWSUPPORT1		(0x2A)
+#define		HERMES_SWSUPPORT2		(0x2C)
+#define		HERMES_AUXPAGE			(0x3A)
+#define		HERMES_AUXOFFSET		(0x3C)
+#define		HERMES_AUXDATA			(0x3E)
+
+/*
+ * CMD register bitmasks
+ */
+#define		HERMES_CMD_BUSY			(0x8000)
+#define		HERMES_CMD_AINFO		(0x7f00)
+#define		HERMES_CMD_MACPORT		(0x0700)
+#define		HERMES_CMD_RECL			(0x0100)
+#define		HERMES_CMD_WRITE		(0x0100)
+#define		HERMES_CMD_PROGMODE		(0x0300)
+#define		HERMES_CMD_CMDCODE		(0x003f)
+
+/*
+ * STATUS register bitmasks
+ */
+#define		HERMES_STATUS_RESULT		(0x7f00)
+#define		HERMES_STATUS_CMDCODE		(0x003f)
+
+/*
+ * OFFSET register bitmasks
+ */
+#define		HERMES_OFFSET_BUSY		(0x8000)
+#define		HERMES_OFFSET_ERR		(0x4000)
+#define		HERMES_OFFSET_DATAOFF		(0x0ffe)
+
+/*
+ * Event register bitmasks (INTEN, EVSTAT, EVACK)
+ */
+#define		HERMES_EV_TICK			(0x8000)
+#define		HERMES_EV_WTERR			(0x4000)
+#define		HERMES_EV_INFDROP		(0x2000)
+#define		HERMES_EV_INFO			(0x0080)
+#define		HERMES_EV_DTIM			(0x0020)
+#define		HERMES_EV_CMD			(0x0010)
+#define		HERMES_EV_ALLOC			(0x0008)
+#define		HERMES_EV_TXEXC			(0x0004)
+#define		HERMES_EV_TX			(0x0002)
+#define		HERMES_EV_RX			(0x0001)
+
+/*
+ * Command codes
+ */
+/*--- Controller Commands ----------------------------*/
+#define		HERMES_CMD_INIT			(0x0000)
+#define		HERMES_CMD_ENABLE		(0x0001)
+#define		HERMES_CMD_DISABLE		(0x0002)
+#define		HERMES_CMD_DIAG			(0x0003)
+
+/*--- Buffer Mgmt Commands ---------------------------*/
+#define		HERMES_CMD_ALLOC		(0x000A)
+#define		HERMES_CMD_TX			(0x000B)
+
+/*--- Regulate Commands ------------------------------*/
+#define		HERMES_CMD_NOTIFY		(0x0010)
+#define		HERMES_CMD_INQUIRE		(0x0011)
+
+/*--- Configure Commands -----------------------------*/
+#define		HERMES_CMD_ACCESS		(0x0021)
+#define		HERMES_CMD_DOWNLD		(0x0022)
+
+/*--- Serial I/O Commands ----------------------------*/
+#define		HERMES_CMD_READMIF		(0x0030)
+#define		HERMES_CMD_WRITEMIF		(0x0031)
+
+/*--- Debugging Commands -----------------------------*/
+#define 	HERMES_CMD_TEST			(0x0038)
+
+
+/* Test command arguments */
+#define		HERMES_TEST_SET_CHANNEL		0x0800
+#define		HERMES_TEST_MONITOR		0x0b00
+#define		HERMES_TEST_STOP		0x0f00
+
+/* Authentication algorithms */
+#define		HERMES_AUTH_OPEN		1
+#define		HERMES_AUTH_SHARED_KEY		2
+
+/* WEP settings */
+#define		HERMES_WEP_PRIVACY_INVOKED	0x0001
+#define		HERMES_WEP_EXCL_UNENCRYPTED	0x0002
+#define		HERMES_WEP_HOST_ENCRYPT		0x0010
+#define		HERMES_WEP_HOST_DECRYPT		0x0080
+
+/* Symbol hostscan options */
+#define		HERMES_HOSTSCAN_SYMBOL_5SEC	0x0001
+#define		HERMES_HOSTSCAN_SYMBOL_ONCE	0x0002
+#define		HERMES_HOSTSCAN_SYMBOL_PASSIVE	0x0040
+#define		HERMES_HOSTSCAN_SYMBOL_BCAST	0x0080
+
+/*
+ * Frame structures and constants
+ */
+
+#define HERMES_DESCRIPTOR_OFFSET	0
+#define HERMES_802_11_OFFSET		(14)
+#define HERMES_802_3_OFFSET		(14+32)
+#define HERMES_802_2_OFFSET		(14+32+14)
+
+#define HERMES_RXSTAT_ERR		(0x0003)
+#define	HERMES_RXSTAT_BADCRC		(0x0001)
+#define	HERMES_RXSTAT_UNDECRYPTABLE	(0x0002)
+#define	HERMES_RXSTAT_MACPORT		(0x0700)
+#define HERMES_RXSTAT_PCF		(0x1000)	/* Frame was received in CF period */
+#define	HERMES_RXSTAT_MSGTYPE		(0xE000)
+#define	HERMES_RXSTAT_1042		(0x2000)	/* RFC-1042 frame */
+#define	HERMES_RXSTAT_TUNNEL		(0x4000)	/* bridge-tunnel encoded frame */
+#define	HERMES_RXSTAT_WMP		(0x6000)	/* Wavelan-II Management Protocol frame */
+
+struct hermes_tx_descriptor {
+	u16 status;
+	u16 reserved1;
+	u16 reserved2;
+	u32 sw_support;
+	u8 retry_count;
+	u8 tx_rate;
+	u16 tx_control;	
+} __attribute__ ((packed));
+
+#define HERMES_TXSTAT_RETRYERR		(0x0001)
+#define HERMES_TXSTAT_AGEDERR		(0x0002)
+#define HERMES_TXSTAT_DISCON		(0x0004)
+#define HERMES_TXSTAT_FORMERR		(0x0008)
+
+#define HERMES_TXCTRL_TX_OK		(0x0002)	/* ?? interrupt on Tx complete */
+#define HERMES_TXCTRL_TX_EX		(0x0004)	/* ?? interrupt on Tx exception */
+#define HERMES_TXCTRL_802_11		(0x0008)	/* We supply 802.11 header */
+#define HERMES_TXCTRL_ALT_RTRY		(0x0020)
+
+/* Inquiry constants and data types */
+
+#define HERMES_INQ_TALLIES		(0xF100)
+#define HERMES_INQ_SCAN			(0xF101)
+#define HERMES_INQ_CHANNELINFO		(0xF102)
+#define HERMES_INQ_HOSTSCAN		(0xF103)
+#define HERMES_INQ_HOSTSCAN_SYMBOL	(0xF104)
+#define HERMES_INQ_LINKSTATUS		(0xF200)
+#define HERMES_INQ_SEC_STAT_AGERE	(0xF202)
+
+struct hermes_tallies_frame {
+	u16 TxUnicastFrames;
+	u16 TxMulticastFrames;
+	u16 TxFragments;
+	u16 TxUnicastOctets;
+	u16 TxMulticastOctets;
+	u16 TxDeferredTransmissions;
+	u16 TxSingleRetryFrames;
+	u16 TxMultipleRetryFrames;
+	u16 TxRetryLimitExceeded;
+	u16 TxDiscards;
+	u16 RxUnicastFrames;
+	u16 RxMulticastFrames;
+	u16 RxFragments;
+	u16 RxUnicastOctets;
+	u16 RxMulticastOctets;
+	u16 RxFCSErrors;
+	u16 RxDiscards_NoBuffer;
+	u16 TxDiscardsWrongSA;
+	u16 RxWEPUndecryptable;
+	u16 RxMsgInMsgFragments;
+	u16 RxMsgInBadMsgFragments;
+	/* Those last are probably not available in very old firmwares */
+	u16 RxDiscards_WEPICVError;
+	u16 RxDiscards_WEPExcluded;
+} __attribute__ ((packed));
+
+/* Grabbed from wlan-ng - Thanks Mark... - Jean II
+ * This is the result of a scan inquiry command */
+/* Structure describing info about an Access Point */
+struct prism2_scan_apinfo {
+	u16 channel;		/* Channel where the AP sits */
+	u16 noise;		/* Noise level */
+	u16 level;		/* Signal level */
+	u8 bssid[ETH_ALEN];	/* MAC address of the Access Point */
+	u16 beacon_interv;	/* Beacon interval */
+	u16 capabilities;	/* Capabilities */
+	u16 essid_len;		/* ESSID length */
+	u8 essid[32];		/* ESSID of the network */
+	u8 rates[10];		/* Bit rate supported */
+	u16 proberesp_rate;	/* Data rate of the response frame */
+	u16 atim;		/* ATIM window time, Kus (hostscan only) */
+} __attribute__ ((packed));
+
+/* Same stuff for the Lucent/Agere card.
+ * Thanks to h1kari <h1kari AT dachb0den.com> - Jean II */
+struct agere_scan_apinfo {
+	u16 channel;		/* Channel where the AP sits */
+	u16 noise;		/* Noise level */
+	u16 level;		/* Signal level */
+	u8 bssid[ETH_ALEN];	/* MAC address of the Access Point */
+	u16 beacon_interv;	/* Beacon interval */
+	u16 capabilities;	/* Capabilities */
+	/* bits: 0-ess, 1-ibss, 4-privacy [wep] */
+	u16 essid_len;		/* ESSID length */
+	u8 essid[32];		/* ESSID of the network */
+} __attribute__ ((packed));
+
+/* Moustafa: Scan structure for Symbol cards */
+struct symbol_scan_apinfo {
+	u8 channel;		/* Channel where the AP sits */
+	u8 unknown1;		/* 8 in 2.9x and 3.9x f/w, 0 otherwise */
+	u16 noise;		/* Noise level */
+	u16 level;		/* Signal level */
+	u8 bssid[ETH_ALEN];	/* MAC address of the Access Point */
+	u16 beacon_interv;	/* Beacon interval */
+	u16 capabilities;	/* Capabilities */
+	/* bits: 0-ess, 1-ibss, 4-privacy [wep] */
+	u16 essid_len;		/* ESSID length */
+	u8 essid[32];		/* ESSID of the network */
+    	u16 rates[5];		/* Bit rate supported */
+	u16 basic_rates;	/* Basic rates bitmask */
+	u8 unknown2[6];		/* Always FF:FF:FF:FF:00:00 */
+	u8 unknown3[8];		/* Always 0, appeared in f/w 3.91-68 */
+} __attribute__ ((packed));
+
+union hermes_scan_info {
+	struct agere_scan_apinfo	a;
+	struct prism2_scan_apinfo	p;
+	struct symbol_scan_apinfo	s;
+};
+
+#define HERMES_LINKSTATUS_NOT_CONNECTED   (0x0000)  
+#define HERMES_LINKSTATUS_CONNECTED       (0x0001)
+#define HERMES_LINKSTATUS_DISCONNECTED    (0x0002)
+#define HERMES_LINKSTATUS_AP_CHANGE       (0x0003)
+#define HERMES_LINKSTATUS_AP_OUT_OF_RANGE (0x0004)
+#define HERMES_LINKSTATUS_AP_IN_RANGE     (0x0005)
+#define HERMES_LINKSTATUS_ASSOC_FAILED    (0x0006)
+  
+struct hermes_linkstatus {
+	u16 linkstatus;         /* Link status */
+} __attribute__ ((packed));
+
+struct hermes_response {
+	u16 status, resp0, resp1, resp2;
+};
+
+/* "ID" structure - used for ESSID and station nickname */
+struct hermes_idstring {
+	u16 len;
+	u16 val[16];
+} __attribute__ ((packed));
+
+struct hermes_multicast {
+	u8 addr[HERMES_MAX_MULTICAST][ETH_ALEN];
+} __attribute__ ((packed));
+
+// #define HERMES_DEBUG_BUFFER 1
+#define HERMES_DEBUG_BUFSIZE 4096
+struct hermes_debug_entry {
+	int bap;
+	u16 id, offset;
+	int cycles;
+};
+
+#ifdef __KERNEL__
+
+/* Timeouts */
+#define HERMES_BAP_BUSY_TIMEOUT (10000) /* In iterations of ~1us */
+
+/* Basic control structure */
+typedef struct hermes {
+	void __iomem *iobase;
+	int reg_spacing;
+#define HERMES_16BIT_REGSPACING	0
+#define HERMES_32BIT_REGSPACING	1
+
+	u16 inten; /* Which interrupts should be enabled? */
+
+#ifdef HERMES_DEBUG_BUFFER
+	struct hermes_debug_entry dbuf[HERMES_DEBUG_BUFSIZE];
+	unsigned long dbufp;
+	unsigned long profile[HERMES_BAP_BUSY_TIMEOUT+1];
+#endif
+} hermes_t;
+
+/* Register access convenience macros */
+#define hermes_read_reg(hw, off) \
+	(ioread16((hw)->iobase + ( (off) << (hw)->reg_spacing )))
+#define hermes_write_reg(hw, off, val) \
+	(iowrite16((val), (hw)->iobase + ((off) << (hw)->reg_spacing)))
+#define hermes_read_regn(hw, name) hermes_read_reg((hw), HERMES_##name)
+#define hermes_write_regn(hw, name, val) hermes_write_reg((hw), HERMES_##name, (val))
+
+/* Function prototypes */
+void hermes_struct_init(hermes_t *hw, void __iomem *address, int reg_spacing);
+int hermes_init(hermes_t *hw);
+int hermes_docmd_wait(hermes_t *hw, u16 cmd, u16 parm0,
+		      struct hermes_response *resp);
+int hermes_allocate(hermes_t *hw, u16 size, u16 *fid);
+
+int hermes_bap_pread(hermes_t *hw, int bap, void *buf, unsigned len,
+		       u16 id, u16 offset);
+int hermes_bap_pwrite(hermes_t *hw, int bap, const void *buf, unsigned len,
+			u16 id, u16 offset);
+int hermes_read_ltv(hermes_t *hw, int bap, u16 rid, unsigned buflen,
+		    u16 *length, void *buf);
+int hermes_write_ltv(hermes_t *hw, int bap, u16 rid,
+		      u16 length, const void *value);
+
+/* Inline functions */
+
+static inline int hermes_present(hermes_t *hw)
+{
+	return hermes_read_regn(hw, SWSUPPORT0) == HERMES_MAGIC;
+}
+
+static inline void hermes_set_irqmask(hermes_t *hw, u16 events)
+{
+	hw->inten = events;
+	hermes_write_regn(hw, INTEN, events);
+}
+
+static inline int hermes_enable_port(hermes_t *hw, int port)
+{
+	return hermes_docmd_wait(hw, HERMES_CMD_ENABLE | (port << 8),
+				 0, NULL);
+}
+
+static inline int hermes_disable_port(hermes_t *hw, int port)
+{
+	return hermes_docmd_wait(hw, HERMES_CMD_DISABLE | (port << 8), 
+				 0, NULL);
+}
+
+/* Initiate an INQUIRE command (tallies or scan).  The result will come as an
+ * information frame in __orinoco_ev_info() */
+static inline int hermes_inquire(hermes_t *hw, u16 rid)
+{
+	return hermes_docmd_wait(hw, HERMES_CMD_INQUIRE, rid, NULL);
+}
+
+#define HERMES_BYTES_TO_RECLEN(n) ( (((n)+1)/2) + 1 )
+#define HERMES_RECLEN_TO_BYTES(n) ( ((n)-1) * 2 )
+
+/* Note that for the next two, the count is in 16-bit words, not bytes */
+static inline void hermes_read_words(struct hermes *hw, int off, void *buf, unsigned count)
+{
+	off = off << hw->reg_spacing;
+	ioread16_rep(hw->iobase + off, buf, count);
+}
+
+static inline void hermes_write_words(struct hermes *hw, int off, const void *buf, unsigned count)
+{
+	off = off << hw->reg_spacing;
+	iowrite16_rep(hw->iobase + off, buf, count);
+}
+
+static inline void hermes_clear_words(struct hermes *hw, int off, unsigned count)
+{
+	unsigned i;
+
+	off = off << hw->reg_spacing;
+
+	for (i = 0; i < count; i++)
+		iowrite16(0, hw->iobase + off);
+}
+
+#define HERMES_READ_RECORD(hw, bap, rid, buf) \
+	(hermes_read_ltv((hw),(bap),(rid), sizeof(*buf), NULL, (buf)))
+#define HERMES_WRITE_RECORD(hw, bap, rid, buf) \
+	(hermes_write_ltv((hw),(bap),(rid),HERMES_BYTES_TO_RECLEN(sizeof(*buf)),(buf)))
+
+static inline int hermes_read_wordrec(hermes_t *hw, int bap, u16 rid, u16 *word)
+{
+	u16 rec;
+	int err;
+
+	err = HERMES_READ_RECORD(hw, bap, rid, &rec);
+	*word = le16_to_cpu(rec);
+	return err;
+}
+
+static inline int hermes_write_wordrec(hermes_t *hw, int bap, u16 rid, u16 word)
+{
+	u16 rec = cpu_to_le16(word);
+	return HERMES_WRITE_RECORD(hw, bap, rid, &rec);
+}
+
+#else /* ! __KERNEL__ */
+
+/* These are provided for the benefit of userspace drivers and testing programs
+   which use ioperm() or iopl() */
+
+#define hermes_read_reg(base, off) (inw((base) + (off)))
+#define hermes_write_reg(base, off, val) (outw((val), (base) + (off)))
+
+#define hermes_read_regn(base, name) (hermes_read_reg((base), HERMES_##name))
+#define hermes_write_regn(base, name, val) (hermes_write_reg((base), HERMES_##name, (val)))
+
+/* Note that for the next two, the count is in 16-bit words, not bytes */
+#define hermes_read_data(base, off, buf, count) (insw((base) + (off), (buf), (count)))
+#define hermes_write_data(base, off, buf, count) (outsw((base) + (off), (buf), (count)))
+
+#endif /* ! __KERNEL__ */
+
+#endif  /* _HERMES_H */
diff --git a/drivers/net/wireless/hermes_rid.h b/drivers/net/wireless/hermes_rid.h
new file mode 100644
index 0000000..4f46b48
--- /dev/null
+++ b/drivers/net/wireless/hermes_rid.h
@@ -0,0 +1,148 @@
+#ifndef _HERMES_RID_H
+#define _HERMES_RID_H
+
+/*
+ * Configuration RIDs
+ */
+#define HERMES_RID_CNFPORTTYPE			0xFC00
+#define HERMES_RID_CNFOWNMACADDR		0xFC01
+#define HERMES_RID_CNFDESIREDSSID		0xFC02
+#define HERMES_RID_CNFOWNCHANNEL		0xFC03
+#define HERMES_RID_CNFOWNSSID			0xFC04
+#define HERMES_RID_CNFOWNATIMWINDOW		0xFC05
+#define HERMES_RID_CNFSYSTEMSCALE		0xFC06
+#define HERMES_RID_CNFMAXDATALEN		0xFC07
+#define HERMES_RID_CNFWDSADDRESS		0xFC08
+#define HERMES_RID_CNFPMENABLED			0xFC09
+#define HERMES_RID_CNFPMEPS			0xFC0A
+#define HERMES_RID_CNFMULTICASTRECEIVE		0xFC0B
+#define HERMES_RID_CNFMAXSLEEPDURATION		0xFC0C
+#define HERMES_RID_CNFPMHOLDOVERDURATION	0xFC0D
+#define HERMES_RID_CNFOWNNAME			0xFC0E
+#define HERMES_RID_CNFOWNDTIMPERIOD		0xFC10
+#define HERMES_RID_CNFWDSADDRESS1		0xFC11
+#define HERMES_RID_CNFWDSADDRESS2		0xFC12
+#define HERMES_RID_CNFWDSADDRESS3		0xFC13
+#define HERMES_RID_CNFWDSADDRESS4		0xFC14
+#define HERMES_RID_CNFWDSADDRESS5		0xFC15
+#define HERMES_RID_CNFWDSADDRESS6		0xFC16
+#define HERMES_RID_CNFMULTICASTPMBUFFERING	0xFC17
+#define HERMES_RID_CNFWEPENABLED_AGERE		0xFC20
+#define HERMES_RID_CNFAUTHENTICATION_AGERE	0xFC21
+#define HERMES_RID_CNFMANDATORYBSSID_SYMBOL	0xFC21
+#define HERMES_RID_CNFWEPDEFAULTKEYID		0xFC23
+#define HERMES_RID_CNFDEFAULTKEY0		0xFC24
+#define HERMES_RID_CNFDEFAULTKEY1		0xFC25
+#define HERMES_RID_CNFMWOROBUST_AGERE		0xFC25
+#define HERMES_RID_CNFDEFAULTKEY2		0xFC26
+#define HERMES_RID_CNFDEFAULTKEY3		0xFC27
+#define HERMES_RID_CNFWEPFLAGS_INTERSIL		0xFC28
+#define HERMES_RID_CNFWEPKEYMAPPINGTABLE	0xFC29
+#define HERMES_RID_CNFAUTHENTICATION		0xFC2A
+#define HERMES_RID_CNFMAXASSOCSTA		0xFC2B
+#define	HERMES_RID_CNFKEYLENGTH_SYMBOL		0xFC2B
+#define HERMES_RID_CNFTXCONTROL			0xFC2C
+#define HERMES_RID_CNFROAMINGMODE		0xFC2D
+#define HERMES_RID_CNFHOSTAUTHENTICATION	0xFC2E
+#define HERMES_RID_CNFRCVCRCERROR		0xFC30
+#define HERMES_RID_CNFMMLIFE			0xFC31
+#define HERMES_RID_CNFALTRETRYCOUNT		0xFC32
+#define HERMES_RID_CNFBEACONINT			0xFC33
+#define HERMES_RID_CNFAPPCFINFO			0xFC34
+#define HERMES_RID_CNFSTAPCFINFO		0xFC35
+#define HERMES_RID_CNFPRIORITYQUSAGE		0xFC37
+#define HERMES_RID_CNFTIMCTRL			0xFC40
+#define HERMES_RID_CNFTHIRTY2TALLY		0xFC42
+#define HERMES_RID_CNFENHSECURITY		0xFC43
+#define HERMES_RID_CNFGROUPADDRESSES		0xFC80
+#define HERMES_RID_CNFCREATEIBSS		0xFC81
+#define HERMES_RID_CNFFRAGMENTATIONTHRESHOLD	0xFC82
+#define HERMES_RID_CNFRTSTHRESHOLD		0xFC83
+#define HERMES_RID_CNFTXRATECONTROL		0xFC84
+#define HERMES_RID_CNFPROMISCUOUSMODE		0xFC85
+#define HERMES_RID_CNFBASICRATES_SYMBOL		0xFC8A
+#define HERMES_RID_CNFPREAMBLE_SYMBOL		0xFC8C
+#define HERMES_RID_CNFFRAGMENTATIONTHRESHOLD0	0xFC90
+#define HERMES_RID_CNFFRAGMENTATIONTHRESHOLD1	0xFC91
+#define HERMES_RID_CNFFRAGMENTATIONTHRESHOLD2	0xFC92
+#define HERMES_RID_CNFFRAGMENTATIONTHRESHOLD3	0xFC93
+#define HERMES_RID_CNFFRAGMENTATIONTHRESHOLD4	0xFC94
+#define HERMES_RID_CNFFRAGMENTATIONTHRESHOLD5	0xFC95
+#define HERMES_RID_CNFFRAGMENTATIONTHRESHOLD6	0xFC96
+#define HERMES_RID_CNFRTSTHRESHOLD0		0xFC97
+#define HERMES_RID_CNFRTSTHRESHOLD1		0xFC98
+#define HERMES_RID_CNFRTSTHRESHOLD2		0xFC99
+#define HERMES_RID_CNFRTSTHRESHOLD3		0xFC9A
+#define HERMES_RID_CNFRTSTHRESHOLD4		0xFC9B
+#define HERMES_RID_CNFRTSTHRESHOLD5		0xFC9C
+#define HERMES_RID_CNFRTSTHRESHOLD6		0xFC9D
+#define HERMES_RID_CNFHOSTSCAN_SYMBOL		0xFCAB
+#define HERMES_RID_CNFSHORTPREAMBLE		0xFCB0
+#define HERMES_RID_CNFWEPKEYS_AGERE		0xFCB0
+#define HERMES_RID_CNFEXCLUDELONGPREAMBLE	0xFCB1
+#define HERMES_RID_CNFTXKEY_AGERE		0xFCB1
+#define HERMES_RID_CNFAUTHENTICATIONRSPTO	0xFCB2
+#define HERMES_RID_CNFSCANSSID_AGERE		0xFCB2
+#define HERMES_RID_CNFBASICRATES		0xFCB3
+#define HERMES_RID_CNFSUPPORTEDRATES		0xFCB4
+#define HERMES_RID_CNFTICKTIME			0xFCE0
+#define HERMES_RID_CNFSCANREQUEST		0xFCE1
+#define HERMES_RID_CNFJOINREQUEST		0xFCE2
+#define HERMES_RID_CNFAUTHENTICATESTATION	0xFCE3
+#define HERMES_RID_CNFCHANNELINFOREQUEST	0xFCE4
+#define HERMES_RID_CNFHOSTSCAN			0xFCE5
+
+/*
+ * Information RIDs
+ */
+#define HERMES_RID_MAXLOADTIME			0xFD00
+#define HERMES_RID_DOWNLOADBUFFER		0xFD01
+#define HERMES_RID_PRIID			0xFD02
+#define HERMES_RID_PRISUPRANGE			0xFD03
+#define HERMES_RID_CFIACTRANGES			0xFD04
+#define HERMES_RID_NICSERNUM			0xFD0A
+#define HERMES_RID_NICID			0xFD0B
+#define HERMES_RID_MFISUPRANGE			0xFD0C
+#define HERMES_RID_CFISUPRANGE			0xFD0D
+#define HERMES_RID_CHANNELLIST			0xFD10
+#define HERMES_RID_REGULATORYDOMAINS		0xFD11
+#define HERMES_RID_TEMPTYPE			0xFD12
+#define HERMES_RID_CIS				0xFD13
+#define HERMES_RID_STAID			0xFD20
+#define HERMES_RID_STASUPRANGE			0xFD21
+#define HERMES_RID_MFIACTRANGES			0xFD22
+#define HERMES_RID_CFIACTRANGES2		0xFD23
+#define HERMES_RID_SECONDARYVERSION_SYMBOL	0xFD24
+#define HERMES_RID_PORTSTATUS			0xFD40
+#define HERMES_RID_CURRENTSSID			0xFD41
+#define HERMES_RID_CURRENTBSSID			0xFD42
+#define HERMES_RID_COMMSQUALITY			0xFD43
+#define HERMES_RID_CURRENTTXRATE		0xFD44
+#define HERMES_RID_CURRENTBEACONINTERVAL	0xFD45
+#define HERMES_RID_CURRENTSCALETHRESHOLDS	0xFD46
+#define HERMES_RID_PROTOCOLRSPTIME		0xFD47
+#define HERMES_RID_SHORTRETRYLIMIT		0xFD48
+#define HERMES_RID_LONGRETRYLIMIT		0xFD49
+#define HERMES_RID_MAXTRANSMITLIFETIME		0xFD4A
+#define HERMES_RID_MAXRECEIVELIFETIME		0xFD4B
+#define HERMES_RID_CFPOLLABLE			0xFD4C
+#define HERMES_RID_AUTHENTICATIONALGORITHMS	0xFD4D
+#define HERMES_RID_PRIVACYOPTIONIMPLEMENTED	0xFD4F
+#define HERMES_RID_DBMCOMMSQUALITY_INTERSIL	0xFD51
+#define HERMES_RID_CURRENTTXRATE1		0xFD80
+#define HERMES_RID_CURRENTTXRATE2		0xFD81
+#define HERMES_RID_CURRENTTXRATE3		0xFD82
+#define HERMES_RID_CURRENTTXRATE4		0xFD83
+#define HERMES_RID_CURRENTTXRATE5		0xFD84
+#define HERMES_RID_CURRENTTXRATE6		0xFD85
+#define HERMES_RID_OWNMACADDR			0xFD86
+#define HERMES_RID_SCANRESULTSTABLE		0xFD88
+#define HERMES_RID_PHYTYPE			0xFDC0
+#define HERMES_RID_CURRENTCHANNEL		0xFDC1
+#define HERMES_RID_CURRENTPOWERSTATE		0xFDC2
+#define HERMES_RID_CCAMODE			0xFDC3
+#define HERMES_RID_SUPPORTEDDATARATES		0xFDC6
+#define HERMES_RID_BUILDSEQ			0xFFFE
+#define HERMES_RID_FWID				0xFFFF
+
+#endif
diff --git a/drivers/net/wireless/i82586.h b/drivers/net/wireless/i82586.h
new file mode 100644
index 0000000..5f65b25
--- /dev/null
+++ b/drivers/net/wireless/i82586.h
@@ -0,0 +1,413 @@
+/*
+ * Intel 82586 IEEE 802.3 Ethernet LAN Coprocessor.
+ *
+ * See:
+ *	Intel Microcommunications 1991
+ *	p1-1 to p1-37
+ *	Intel order No. 231658
+ *	ISBN 1-55512-119-5
+ *
+ *     Unfortunately, the above chapter mentions neither
+ * the System Configuration Pointer (SCP) nor the
+ * Intermediate System Configuration Pointer (ISCP),
+ * so we probably need to look elsewhere for the
+ * whole story -- some recommend the "Intel LAN
+ * Components manual" but I have neither a copy
+ * nor a full reference.  But "elsewhere" may be
+ * in the same publication...
+ *     The description of a later device, the
+ * "82596CA High-Performance 32-Bit Local Area Network
+ * Coprocessor", (ibid. p1-38 to p1-109) does mention
+ * the SCP and ISCP and also has an i82586 compatibility
+ * mode.  Even more useful is "AP-235 An 82586 Data Link
+ * Driver" (ibid. p1-337 to p1-417).
+ */
+
+#define	I82586_MEMZ	(64 * 1024)
+
+#define	I82586_SCP_ADDR	(I82586_MEMZ - sizeof(scp_t))
+
+#define	ADDR_LEN	6
+#define	I82586NULL	0xFFFF
+
+#define	toff(t,p,f) 	(unsigned short)((void *)(&((t *)((void *)0 + (p)))->f) - (void *)0)
+
+/*
+ * System Configuration Pointer (SCP).
+ */
+typedef struct scp_t	scp_t;
+struct scp_t
+{
+	unsigned short	scp_sysbus;	/* 82586 bus width:	*/
+#define		SCP_SY_16BBUS	(0x0 << 0)	/* 16 bits */
+#define		SCP_SY_8BBUS	(0x1 << 0)	/*  8 bits. */
+	unsigned short	scp_junk[2];	/* Unused */
+	unsigned short	scp_iscpl;	/* lower 16 bits of ISCP_ADDR */
+	unsigned short	scp_iscph;	/* upper 16 bits of ISCP_ADDR */
+};
+
+/*
+ * Intermediate System Configuration Pointer (ISCP).
+ */
+typedef struct iscp_t	iscp_t;
+struct iscp_t
+{
+	unsigned short	iscp_busy;	/* set by CPU before first CA,	*/
+					/* cleared by 82586 after read.	*/
+	unsigned short	iscp_offset;	/* offset of SCB		*/
+	unsigned short	iscp_basel;	/* base of SCB			*/
+	unsigned short	iscp_baseh;	/*  "				*/
+};
+
+/*
+ * System Control Block (SCB).
+ *	The 82586 writes its status to scb_status and then
+ *	raises an interrupt to alert the CPU.
+ *	The CPU writes a command to scb_command and
+ *	then issues a Channel Attention (CA) to alert the 82586.
+ */
+typedef struct scb_t	scb_t;
+struct scb_t
+{
+	unsigned short	scb_status;	/* Status of 82586		*/
+#define		SCB_ST_INT	(0xF << 12)	/* Some of:		*/
+#define		SCB_ST_CX	(0x1 << 15)	/* Cmd completed	*/
+#define		SCB_ST_FR	(0x1 << 14)	/* Frame received	*/
+#define		SCB_ST_CNA	(0x1 << 13)	/* Cmd unit not active	*/
+#define		SCB_ST_RNR	(0x1 << 12)	/* Rcv unit not ready	*/
+#define		SCB_ST_JUNK0	(0x1 << 11)	/* 0			*/
+#define		SCB_ST_CUS	(0x7 <<  8)	/* Cmd unit status	*/
+#define			SCB_ST_CUS_IDLE	(0 << 8)	/* Idle		*/
+#define			SCB_ST_CUS_SUSP	(1 << 8)	/* Suspended	*/
+#define			SCB_ST_CUS_ACTV	(2 << 8)	/* Active	*/
+#define		SCB_ST_JUNK1	(0x1 <<  7)	/* 0			*/
+#define		SCB_ST_RUS	(0x7 <<  4)	/* Rcv unit status	*/
+#define			SCB_ST_RUS_IDLE	(0 << 4)	/* Idle		*/
+#define			SCB_ST_RUS_SUSP	(1 << 4)	/* Suspended	*/
+#define			SCB_ST_RUS_NRES	(2 << 4)	/* No resources	*/
+#define			SCB_ST_RUS_RDY	(4 << 4)	/* Ready	*/
+	unsigned short	scb_command;	/* Next command			*/
+#define		SCB_CMD_ACK_CX	(0x1 << 15)	/* Ack cmd completion	*/
+#define		SCB_CMD_ACK_FR	(0x1 << 14)	/* Ack frame received	*/
+#define		SCB_CMD_ACK_CNA	(0x1 << 13)	/* Ack CU not active	*/
+#define		SCB_CMD_ACK_RNR	(0x1 << 12)	/* Ack RU not ready	*/
+#define		SCB_CMD_JUNKX	(0x1 << 11)	/* Unused		*/
+#define		SCB_CMD_CUC	(0x7 <<  8)	/* Command Unit command	*/
+#define			SCB_CMD_CUC_NOP	(0 << 8)	/* Nop		*/
+#define			SCB_CMD_CUC_GO	(1 << 8)	/* Start cbl_offset */
+#define			SCB_CMD_CUC_RES	(2 << 8)	/* Resume execution */
+#define			SCB_CMD_CUC_SUS	(3 << 8)	/* Suspend   "	*/
+#define			SCB_CMD_CUC_ABT	(4 << 8)	/* Abort     "	*/
+#define		SCB_CMD_RESET	(0x1 <<  7)	/* Reset chip (hardware) */
+#define		SCB_CMD_RUC	(0x7 <<  4)	/* Receive Unit command	*/
+#define			SCB_CMD_RUC_NOP	(0 << 4)	/* Nop		*/
+#define			SCB_CMD_RUC_GO	(1 << 4)	/* Start rfa_offset */
+#define			SCB_CMD_RUC_RES	(2 << 4)	/* Resume reception */
+#define			SCB_CMD_RUC_SUS	(3 << 4)	/* Suspend   "	*/
+#define			SCB_CMD_RUC_ABT	(4 << 4)	/* Abort     "	*/
+	unsigned short	scb_cbl_offset;	/* Offset of first command unit	*/
+					/* Action Command		*/
+	unsigned short	scb_rfa_offset;	/* Offset of first Receive	*/
+					/* Frame Descriptor in the	*/
+					/* Receive Frame Area		*/
+	unsigned short	scb_crcerrs;	/* Properly aligned frames	*/
+					/* received with a CRC error	*/
+	unsigned short	scb_alnerrs;	/* Misaligned frames received	*/
+					/* with a CRC error		*/
+	unsigned short	scb_rscerrs;	/* Frames lost due to no space	*/
+	unsigned short	scb_ovrnerrs;	/* Frames lost due to slow bus	*/
+};
+
+#define	scboff(p,f) 	toff(scb_t, p, f)
+
+/*
+ * The eight Action Commands.
+ */
+typedef enum acmd_e	acmd_e;
+enum acmd_e
+{
+	acmd_nop	= 0,	/* Do nothing				*/
+	acmd_ia_setup	= 1,	/* Load an (ethernet) address into the	*/
+				/* 82586				*/
+	acmd_configure	= 2,	/* Update the 82586 operating parameters */
+	acmd_mc_setup	= 3,	/* Load a list of (ethernet) multicast	*/
+				/* addresses into the 82586		*/
+	acmd_transmit	= 4,	/* Transmit a frame			*/
+	acmd_tdr	= 5,	/* Perform a Time Domain Reflectometer	*/
+				/* test on the serial link		*/
+	acmd_dump	= 6,	/* Copy 82586 registers to memory	*/
+	acmd_diagnose	= 7,	/* Run an internal self test		*/
+};
+
+/*
+ * Generic Action Command header.
+ */
+typedef struct ach_t	ach_t;
+struct ach_t
+{
+	unsigned short	ac_status;		/* Command status:	*/
+#define		AC_SFLD_C	(0x1 << 15)	/* Command completed	*/
+#define		AC_SFLD_B	(0x1 << 14)	/* Busy executing	*/
+#define		AC_SFLD_OK	(0x1 << 13)	/* Completed error free	*/
+#define		AC_SFLD_A	(0x1 << 12)	/* Command aborted	*/
+#define		AC_SFLD_FAIL	(0x1 << 11)	/* Selftest failed	*/
+#define		AC_SFLD_S10	(0x1 << 10)	/* No carrier sense	*/
+						/* during transmission	*/
+#define		AC_SFLD_S9	(0x1 <<  9)	/* Tx unsuccessful:	*/
+						/* (stopped) lost CTS	*/
+#define		AC_SFLD_S8	(0x1 <<  8)	/* Tx unsuccessful:	*/
+						/* (stopped) slow DMA	*/
+#define		AC_SFLD_S7	(0x1 <<  7)	/* Tx deferred:		*/
+						/* other link traffic	*/
+#define		AC_SFLD_S6	(0x1 <<  6)	/* Heart Beat: collision */
+						/* detect after last tx	*/
+#define		AC_SFLD_S5	(0x1 <<  5)	/* Tx stopped:		*/
+						/* excessive collisions	*/
+#define		AC_SFLD_MAXCOL	(0xF <<  0)	/* Collision count  	*/
+	unsigned short	ac_command;		/* Command specifier:	*/
+#define		AC_CFLD_EL	(0x1 << 15)	/* End of command list	*/
+#define		AC_CFLD_S	(0x1 << 14)	/* Suspend on completion */
+#define		AC_CFLD_I	(0x1 << 13)	/* Interrupt on completion */
+#define		AC_CFLD_CMD	(0x7 <<  0)	/* acmd_e		*/
+	unsigned short	ac_link;		/* Next Action Command	*/
+};
+
+#define	acoff(p,f) 	toff(ach_t, p, f)
+
+/*
+ * The Nop Action Command.
+ */
+typedef struct ac_nop_t	ac_nop_t;
+struct ac_nop_t
+{
+	ach_t	nop_h;
+};
+
+/*
+ * The IA-Setup Action Command.
+ */
+typedef struct ac_ias_t	ac_ias_t;
+struct ac_ias_t
+{
+	ach_t		ias_h;
+	unsigned char	ias_addr[ADDR_LEN]; /* The (ethernet) address	*/
+};
+
+/*
+ * The Configure Action Command.
+ */
+typedef struct ac_cfg_t	ac_cfg_t;
+struct ac_cfg_t
+{
+	ach_t		cfg_h;
+	unsigned char	cfg_byte_cnt;	/* Size foll data: 4-12	*/
+#define	AC_CFG_BYTE_CNT(v)	(((v) & 0xF) << 0)
+	unsigned char	cfg_fifolim;	/* FIFO threshold	*/
+#define	AC_CFG_FIFOLIM(v)	(((v) & 0xF) << 0)
+	unsigned char	cfg_byte8;
+#define	AC_CFG_SAV_BF(v) 	(((v) & 0x1) << 7)	/* Save rxd bad frames	*/
+#define	AC_CFG_SRDY(v) 		(((v) & 0x1) << 6)	/* SRDY/ARDY pin means	*/
+							/* external sync.	*/
+	unsigned char	cfg_byte9;
+#define	AC_CFG_ELPBCK(v)	(((v) & 0x1) << 7)	/* External loopback	*/
+#define	AC_CFG_ILPBCK(v)	(((v) & 0x1) << 6)	/* Internal loopback	*/
+#define	AC_CFG_PRELEN(v)	(((v) & 0x3) << 4)	/* Preamble length	*/
+#define		AC_CFG_PLEN_2		0		/*  2 bytes	*/
+#define		AC_CFG_PLEN_4		1		/*  4 bytes	*/
+#define		AC_CFG_PLEN_8		2		/*  8 bytes	*/
+#define		AC_CFG_PLEN_16		3		/* 16 bytes	*/
+#define	AC_CFG_ALOC(v)		(((v) & 0x1) << 3)	/* Addr/len data is	*/
+							/* explicit in buffers	*/
+#define	AC_CFG_ADDRLEN(v)	(((v) & 0x7) << 0)	/* Bytes per address	*/
+	unsigned char	cfg_byte10;
+#define	AC_CFG_BOFMET(v)	(((v) & 0x1) << 7)	/* Use alternate expo.	*/
+							/* backoff method	*/
+#define	AC_CFG_ACR(v)		(((v) & 0x7) << 4)	/* Accelerated cont. res. */
+#define	AC_CFG_LINPRIO(v)	(((v) & 0x7) << 0)	/* Linear priority	*/
+	unsigned char	cfg_ifs;	/* Interframe spacing		*/
+	unsigned char	cfg_slotl;	/* Slot time (low byte)		*/
+	unsigned char	cfg_byte13;
+#define	AC_CFG_RETRYNUM(v)	(((v) & 0xF) << 4)	/* Max. collision retry	*/
+#define	AC_CFG_SLTTMHI(v)	(((v) & 0x7) << 0)	/* Slot time (high bits) */
+	unsigned char	cfg_byte14;
+#define	AC_CFG_FLGPAD(v)	(((v) & 0x1) << 7)	/* Pad with HDLC flags	*/
+#define	AC_CFG_BTSTF(v)		(((v) & 0x1) << 6)	/* Do HDLC bitstuffing	*/
+#define	AC_CFG_CRC16(v)		(((v) & 0x1) << 5)	/* 16 bit CCITT CRC	*/
+#define	AC_CFG_NCRC(v)		(((v) & 0x1) << 4)	/* Insert no CRC	*/
+#define	AC_CFG_TNCRS(v)		(((v) & 0x1) << 3)	/* Tx even if no carrier */
+#define	AC_CFG_MANCH(v)		(((v) & 0x1) << 2)	/* Manchester coding	*/
+#define	AC_CFG_BCDIS(v)		(((v) & 0x1) << 1)	/* Disable broadcast	*/
+#define	AC_CFG_PRM(v)		(((v) & 0x1) << 0)	/* Promiscuous mode	*/
+	unsigned char	cfg_byte15;
+#define	AC_CFG_ICDS(v)		(((v) & 0x1) << 7)	/* Internal collision	*/
+							/* detect source	*/
+#define	AC_CFG_CDTF(v)		(((v) & 0x7) << 4)	/* Collision detect	*/
+							/* filter in bit times	*/
+#define	AC_CFG_ICSS(v)		(((v) & 0x1) << 3)	/* Internal carrier	*/
+							/* sense source		*/
+#define	AC_CFG_CSTF(v)		(((v) & 0x7) << 0)	/* Carrier sense	*/
+							/* filter in bit times	*/
+	unsigned short	cfg_min_frm_len;
+#define	AC_CFG_MNFRM(v)		(((v) & 0xFF) << 0)	/* Min. bytes/frame (<= 255) */
+};
+
+/*
+ * The MC-Setup Action Command.
+ */
+typedef struct ac_mcs_t	ac_mcs_t;
+struct ac_mcs_t
+{
+	ach_t		mcs_h;
+	unsigned short	mcs_cnt;	/* No. of bytes of MC addresses	*/
+#if 0
+	unsigned char	mcs_data[ADDR_LEN]; /* The first MC address ..	*/
+	...
+#endif
+};
+
+#define I82586_MAX_MULTICAST_ADDRESSES	128	/* Hardware hashed filter */
+
+/*
+ * The Transmit Action Command.
+ */
+typedef struct ac_tx_t	ac_tx_t;
+struct ac_tx_t
+{
+	ach_t		tx_h;
+	unsigned short	tx_tbd_offset;	/* Address of list of buffers.	*/
+#if	0
+Linux packets are passed down with the destination MAC address
+and length/type field already prepended to the data,
+so we do not need to insert it.  Consistent with this
+we must also set the AC_CFG_ALOC(..) flag during the
+ac_cfg_t action command.
+	unsigned char	tx_addr[ADDR_LEN]; /* The frame dest. address	*/
+	unsigned short	tx_length;	/* The frame length		*/
+#endif	/* 0 */
+};
+
+/*
+ * The Time Domain Reflectometer Action Command.
+ */
+typedef struct ac_tdr_t	ac_tdr_t;
+struct ac_tdr_t
+{
+	ach_t		tdr_h;
+	unsigned short	tdr_result;	/* Result.	*/
+#define		AC_TDR_LNK_OK	(0x1 << 15)	/* No link problem	*/
+#define		AC_TDR_XCVR_PRB	(0x1 << 14)	/* Txcvr cable problem	*/
+#define		AC_TDR_ET_OPN	(0x1 << 13)	/* Open on the link	*/
+#define		AC_TDR_ET_SRT	(0x1 << 12)	/* Short on the link	*/
+#define		AC_TDR_TIME	(0x7FF << 0)	/* Distance to problem	*/
+						/* site	in transmit	*/
+						/* clock cycles		*/
+};
+
+/*
+ * The Dump Action Command.
+ */
+typedef struct ac_dmp_t	ac_dmp_t;
+struct ac_dmp_t
+{
+	ach_t		dmp_h;
+	unsigned short	dmp_offset;	/* Result.	*/
+};
+
+/*
+ * Size of the result of the dump command.
+ */
+#define	DUMPBYTES	170
+
+/*
+ * The Diagnose Action Command.
+ */
+typedef struct ac_dgn_t	ac_dgn_t;
+struct ac_dgn_t
+{
+	ach_t		dgn_h;
+};
+
+/*
+ * Transmit Buffer Descriptor (TBD).
+ */
+typedef struct tbd_t	tbd_t;
+struct tbd_t
+{
+	unsigned short	tbd_status;		/* Written by the CPU	*/
+#define		TBD_STATUS_EOF	(0x1 << 15)	/* This TBD is the	*/
+						/* last for this frame	*/
+#define		TBD_STATUS_ACNT	(0x3FFF << 0)	/* Actual count of data	*/
+						/* bytes in this buffer	*/
+	unsigned short	tbd_next_bd_offset;	/* Next in list		*/
+	unsigned short	tbd_bufl;		/* Buffer address (low)	*/
+	unsigned short	tbd_bufh;		/*    "	     "	(high)	*/
+};
+
+/*
+ * Receive Buffer Descriptor (RBD).
+ */
+typedef struct rbd_t	rbd_t;
+struct rbd_t
+{
+	unsigned short	rbd_status;		/* Written by the 82586	*/
+#define		RBD_STATUS_EOF	(0x1 << 15)	/* This RBD is the	*/
+						/* last for this frame	*/
+#define		RBD_STATUS_F	(0x1 << 14)	/* ACNT field is valid	*/
+#define		RBD_STATUS_ACNT	(0x3FFF << 0)	/* Actual no. of data	*/
+						/* bytes in this buffer	*/
+	unsigned short	rbd_next_rbd_offset;	/* Next rbd in list	*/
+	unsigned short	rbd_bufl;		/* Data pointer (low)	*/
+	unsigned short	rbd_bufh;		/*  "	   "    (high)	*/
+	unsigned short	rbd_el_size;		/* EL+Data buf. size	*/
+#define		RBD_EL	(0x1 << 15)		/* This BD is the	*/
+						/* last in the list	*/
+#define		RBD_SIZE (0x3FFF << 0)		/* No. of bytes the	*/
+						/* buffer can hold	*/
+};
+
+#define	rbdoff(p,f) 	toff(rbd_t, p, f)
+
+/*
+ * Frame Descriptor (FD).
+ */
+typedef struct fd_t	fd_t;
+struct fd_t
+{
+	unsigned short	fd_status;		/* Written by the 82586	*/
+#define		FD_STATUS_C	(0x1 << 15)	/* Completed storing frame */
+#define		FD_STATUS_B	(0x1 << 14)	/* FD was consumed by RU */
+#define		FD_STATUS_OK	(0x1 << 13)	/* Frame rxd successfully */
+#define		FD_STATUS_S11	(0x1 << 11)	/* CRC error		*/
+#define		FD_STATUS_S10	(0x1 << 10)	/* Alignment error	*/
+#define		FD_STATUS_S9	(0x1 <<  9)	/* Ran out of resources	*/
+#define		FD_STATUS_S8	(0x1 <<  8)	/* Rx DMA overrun	*/
+#define		FD_STATUS_S7	(0x1 <<  7)	/* Frame too short	*/
+#define		FD_STATUS_S6	(0x1 <<  6)	/* No EOF flag		*/
+	unsigned short	fd_command;		/* Command		*/
+#define		FD_COMMAND_EL	(0x1 << 15)	/* Last FD in list	*/
+#define		FD_COMMAND_S	(0x1 << 14)	/* Suspend RU after rx	*/
+	unsigned short	fd_link_offset;		/* Next FD		*/
+	unsigned short	fd_rbd_offset;		/* First RBD (data)	*/
+						/* Prepared by CPU,	*/
+						/* updated by 82586	*/
+#if	0
+I think the rest is unused since we
+have set AC_CFG_ALOC(..).  However, just
+in case, we leave the space.
+#endif	/* 0 */
+	unsigned char	fd_dest[ADDR_LEN];	/* Destination address	*/
+						/* Written by 82586	*/
+	unsigned char	fd_src[ADDR_LEN];	/* Source address	*/
+						/* Written by 82586	*/
+	unsigned short	fd_length;		/* Frame length or type	*/
+						/* Written by 82586	*/
+};
+
+#define	fdoff(p,f) 	toff(fd_t, p, f)
+
+/*
+ * This software may only be used and distributed
+ * according to the terms of the GNU General Public License.
+ *
+ * For more details, see wavelan.c.
+ */
diff --git a/drivers/net/wireless/i82593.h b/drivers/net/wireless/i82593.h
new file mode 100644
index 0000000..33acb8a
--- /dev/null
+++ b/drivers/net/wireless/i82593.h
@@ -0,0 +1,224 @@
+/*
+ * Definitions for Intel 82593 CSMA/CD Core LAN Controller
+ * The definitions are taken from the 1992 users manual with Intel
+ * order number 297125-001.
+ *
+ * /usr/src/pc/RCS/i82593.h,v 1.1 1996/07/17 15:23:12 root Exp
+ *
+ * Copyright 1994, Anders Klemets <klemets@it.kth.se>
+ *
+ * This software may be freely distributed for noncommercial purposes
+ * as long as this notice is retained.
+ * 
+ * HISTORY
+ * i82593.h,v
+ * Revision 1.1  1996/07/17 15:23:12  root
+ * Initial revision
+ *
+ * Revision 1.3  1995/04/05  15:13:58  adj
+ * Initial alpha release
+ *
+ * Revision 1.2  1994/06/16  23:57:31  klemets
+ * Mirrored all the fields in the configuration block.
+ *
+ * Revision 1.1  1994/06/02  20:25:34  klemets
+ * Initial revision
+ *
+ *
+ */
+#ifndef	_I82593_H
+#define	_I82593_H
+
+/* Intel 82593 CSMA/CD Core LAN Controller */
+
+/* Port 0 Command Register definitions */
+
+/* Execution operations */
+#define OP0_NOP			0	/* CHNL = 0 */
+#define OP0_SWIT_TO_PORT_1	0	/* CHNL = 1 */
+#define OP0_IA_SETUP		1
+#define OP0_CONFIGURE		2
+#define OP0_MC_SETUP		3
+#define OP0_TRANSMIT		4
+#define OP0_TDR			5
+#define OP0_DUMP		6
+#define OP0_DIAGNOSE		7
+#define OP0_TRANSMIT_NO_CRC	9
+#define OP0_RETRANSMIT		12
+#define OP0_ABORT		13
+/* Reception operations */
+#define OP0_RCV_ENABLE		8
+#define OP0_RCV_DISABLE		10
+#define OP0_STOP_RCV		11
+/* Status pointer control operations */
+#define OP0_FIX_PTR		15	/* CHNL = 1 */
+#define OP0_RLS_PTR		15	/* CHNL = 0 */
+#define OP0_RESET		14
+
+#define CR0_CHNL		(1 << 4)	/* 0=Channel 0, 1=Channel 1 */
+#define CR0_STATUS_0		0x00
+#define CR0_STATUS_1		0x20
+#define CR0_STATUS_2		0x40
+#define CR0_STATUS_3		0x60
+#define CR0_INT_ACK		(1 << 7)	/* 0=No ack, 1=acknowledge */
+
+/* Port 0 Status Register definitions */
+
+#define SR0_NO_RESULT		0		/* dummy */
+#define SR0_EVENT_MASK		0x0f
+#define SR0_IA_SETUP_DONE	1
+#define SR0_CONFIGURE_DONE	2
+#define SR0_MC_SETUP_DONE	3
+#define SR0_TRANSMIT_DONE	4
+#define SR0_TDR_DONE		5
+#define SR0_DUMP_DONE		6
+#define SR0_DIAGNOSE_PASSED	7
+#define SR0_TRANSMIT_NO_CRC_DONE 9
+#define SR0_RETRANSMIT_DONE	12
+#define SR0_EXECUTION_ABORTED	13
+#define SR0_END_OF_FRAME	8
+#define SR0_RECEPTION_ABORTED	10
+#define SR0_DIAGNOSE_FAILED	15
+#define SR0_STOP_REG_HIT	11
+
+#define SR0_CHNL		(1 << 4)
+#define SR0_EXECUTION		(1 << 5)
+#define SR0_RECEPTION		(1 << 6)
+#define SR0_INTERRUPT		(1 << 7)
+#define SR0_BOTH_RX_TX		(SR0_EXECUTION | SR0_RECEPTION)
+
+#define SR3_EXEC_STATE_MASK	0x03
+#define SR3_EXEC_IDLE		0
+#define SR3_TX_ABORT_IN_PROGRESS 1
+#define SR3_EXEC_ACTIVE		2
+#define SR3_ABORT_IN_PROGRESS	3
+#define SR3_EXEC_CHNL		(1 << 2)
+#define SR3_STP_ON_NO_RSRC	(1 << 3)
+#define SR3_RCVING_NO_RSRC	(1 << 4)
+#define SR3_RCV_STATE_MASK	0x60
+#define SR3_RCV_IDLE		0x00
+#define SR3_RCV_READY		0x20
+#define SR3_RCV_ACTIVE		0x40
+#define SR3_RCV_STOP_IN_PROG	0x60
+#define SR3_RCV_CHNL		(1 << 7)
+
+/* Port 1 Command Register definitions */
+
+#define OP1_NOP			0
+#define OP1_SWIT_TO_PORT_0	1
+#define OP1_INT_DISABLE		2
+#define OP1_INT_ENABLE		3
+#define OP1_SET_TS		5
+#define OP1_RST_TS		7
+#define OP1_POWER_DOWN		8
+#define OP1_RESET_RING_MNGMT	11
+#define OP1_RESET		14
+#define OP1_SEL_RST		15
+
+#define CR1_STATUS_4		0x00
+#define CR1_STATUS_5		0x20
+#define CR1_STATUS_6		0x40
+#define CR1_STOP_REG_UPDATE	(1 << 7)
+
+/* Receive frame status bits */
+
+#define	RX_RCLD			(1 << 0)
+#define RX_IA_MATCH		(1 << 1)
+#define	RX_NO_AD_MATCH		(1 << 2)
+#define RX_NO_SFD		(1 << 3)
+#define RX_SRT_FRM		(1 << 7)
+#define RX_OVRRUN		(1 << 8)
+#define RX_ALG_ERR		(1 << 10)
+#define RX_CRC_ERR		(1 << 11)
+#define RX_LEN_ERR		(1 << 12)
+#define RX_RCV_OK		(1 << 13)
+#define RX_TYP_LEN		(1 << 15)
+
+/* Transmit status bits */
+
+#define TX_NCOL_MASK		0x0f
+#define TX_FRTL			(1 << 4)
+#define TX_MAX_COL		(1 << 5)
+#define TX_HRT_BEAT		(1 << 6)
+#define TX_DEFER		(1 << 7)
+#define TX_UND_RUN		(1 << 8)
+#define TX_LOST_CTS		(1 << 9)
+#define TX_LOST_CRS		(1 << 10)
+#define TX_LTCOL		(1 << 11)
+#define TX_OK			(1 << 13)
+#define TX_COLL			(1 << 15)
+
+struct i82593_conf_block {
+  u_char fifo_limit : 4,
+  	 forgnesi   : 1,
+  	 fifo_32    : 1,
+  	 d6mod      : 1,
+  	 throttle_enb : 1;
+  u_char throttle   : 6,
+	 cntrxint   : 1,
+	 contin	    : 1;
+  u_char addr_len   : 3,
+  	 acloc 	    : 1,
+ 	 preamb_len : 2,
+  	 loopback   : 2;
+  u_char lin_prio   : 3,
+	 tbofstop   : 1,
+	 exp_prio   : 3,
+	 bof_met    : 1;
+  u_char	    : 4,
+	 ifrm_spc   : 4;
+  u_char	    : 5,
+	 slottim_low : 3;
+  u_char slottim_hi : 3,
+		    : 1,
+	 max_retr   : 4;
+  u_char prmisc     : 1,
+	 bc_dis     : 1,
+  		    : 1,
+	 crs_1	    : 1,
+	 nocrc_ins  : 1,
+	 crc_1632   : 1,
+  	 	    : 1,
+  	 crs_cdt    : 1;
+  u_char cs_filter  : 3,
+	 crs_src    : 1,
+	 cd_filter  : 3,
+		    : 1;
+  u_char	    : 2,
+  	 min_fr_len : 6;
+  u_char lng_typ    : 1,
+	 lng_fld    : 1,
+	 rxcrc_xf   : 1,
+	 artx	    : 1,
+	 sarec	    : 1,
+	 tx_jabber  : 1,	/* why is this called max_len in the manual? */
+	 hash_1	    : 1,
+  	 lbpkpol    : 1;
+  u_char	    : 6,
+  	 fdx	    : 1,
+  	  	    : 1;
+  u_char dummy_6    : 6,	/* supposed to be ones */
+  	 mult_ia    : 1,
+  	 dis_bof    : 1;
+  u_char dummy_1    : 1,	/* supposed to be one */
+	 tx_ifs_retrig : 2,
+	 mc_all     : 1,
+	 rcv_mon    : 2,
+	 frag_acpt  : 1,
+  	 tstrttrs   : 1;
+  u_char fretx	    : 1,
+	 runt_eop   : 1,
+	 hw_sw_pin  : 1,
+	 big_endn   : 1,
+	 syncrqs    : 1,
+	 sttlen     : 1,
+	 tx_eop     : 1,
+  	 rx_eop	    : 1;
+  u_char rbuf_size  : 5,
+	 rcvstop    : 1,
+  	 	    : 2;
+};
+
+#define I82593_MAX_MULTICAST_ADDRESSES	128	/* Hardware hashed filter */
+
+#endif /* _I82593_H */
diff --git a/drivers/net/wireless/ieee802_11.h b/drivers/net/wireless/ieee802_11.h
new file mode 100644
index 0000000..53dd524
--- /dev/null
+++ b/drivers/net/wireless/ieee802_11.h
@@ -0,0 +1,78 @@
+#ifndef _IEEE802_11_H
+#define _IEEE802_11_H
+
+#define IEEE802_11_DATA_LEN		2304
+/* Maximum size for the MA-UNITDATA primitive, 802.11 standard section
+   6.2.1.1.2.
+
+   The figure in section 7.1.2 suggests a body size of up to 2312
+   bytes is allowed, which is a bit confusing, I suspect this
+   represents the 2304 bytes of real data, plus a possible 8 bytes of
+   WEP IV and ICV. (this interpretation suggested by Ramiro Barreiro) */
+
+
+#define IEEE802_11_HLEN			30
+#define IEEE802_11_FRAME_LEN		(IEEE802_11_DATA_LEN + IEEE802_11_HLEN)
+
+struct ieee802_11_hdr {
+	u16 frame_ctl;
+	u16 duration_id;
+	u8 addr1[ETH_ALEN];
+	u8 addr2[ETH_ALEN];
+	u8 addr3[ETH_ALEN];
+	u16 seq_ctl;
+	u8 addr4[ETH_ALEN];
+} __attribute__ ((packed));
+
+/* Frame control field constants */
+#define IEEE802_11_FCTL_VERS		0x0002
+#define IEEE802_11_FCTL_FTYPE		0x000c
+#define IEEE802_11_FCTL_STYPE		0x00f0
+#define IEEE802_11_FCTL_TODS		0x0100
+#define IEEE802_11_FCTL_FROMDS		0x0200
+#define IEEE802_11_FCTL_MOREFRAGS	0x0400
+#define IEEE802_11_FCTL_RETRY		0x0800
+#define IEEE802_11_FCTL_PM		0x1000
+#define IEEE802_11_FCTL_MOREDATA	0x2000
+#define IEEE802_11_FCTL_WEP		0x4000
+#define IEEE802_11_FCTL_ORDER		0x8000
+
+#define IEEE802_11_FTYPE_MGMT		0x0000
+#define IEEE802_11_FTYPE_CTL		0x0004
+#define IEEE802_11_FTYPE_DATA		0x0008
+
+/* management */
+#define IEEE802_11_STYPE_ASSOC_REQ	0x0000
+#define IEEE802_11_STYPE_ASSOC_RESP 	0x0010
+#define IEEE802_11_STYPE_REASSOC_REQ	0x0020
+#define IEEE802_11_STYPE_REASSOC_RESP	0x0030
+#define IEEE802_11_STYPE_PROBE_REQ	0x0040
+#define IEEE802_11_STYPE_PROBE_RESP	0x0050
+#define IEEE802_11_STYPE_BEACON		0x0080
+#define IEEE802_11_STYPE_ATIM		0x0090
+#define IEEE802_11_STYPE_DISASSOC	0x00A0
+#define IEEE802_11_STYPE_AUTH		0x00B0
+#define IEEE802_11_STYPE_DEAUTH		0x00C0
+
+/* control */
+#define IEEE802_11_STYPE_PSPOLL		0x00A0
+#define IEEE802_11_STYPE_RTS		0x00B0
+#define IEEE802_11_STYPE_CTS		0x00C0
+#define IEEE802_11_STYPE_ACK		0x00D0
+#define IEEE802_11_STYPE_CFEND		0x00E0
+#define IEEE802_11_STYPE_CFENDACK	0x00F0
+
+/* data */
+#define IEEE802_11_STYPE_DATA		0x0000
+#define IEEE802_11_STYPE_DATA_CFACK	0x0010
+#define IEEE802_11_STYPE_DATA_CFPOLL	0x0020
+#define IEEE802_11_STYPE_DATA_CFACKPOLL	0x0030
+#define IEEE802_11_STYPE_NULLFUNC	0x0040
+#define IEEE802_11_STYPE_CFACK		0x0050
+#define IEEE802_11_STYPE_CFPOLL		0x0060
+#define IEEE802_11_STYPE_CFACKPOLL	0x0070
+
+#define IEEE802_11_SCTL_FRAG		0x000F
+#define IEEE802_11_SCTL_SEQ		0xFFF0
+
+#endif /* _IEEE802_11_H */
diff --git a/drivers/net/wireless/netwave_cs.c b/drivers/net/wireless/netwave_cs.c
new file mode 100644
index 0000000..382241e
--- /dev/null
+++ b/drivers/net/wireless/netwave_cs.c
@@ -0,0 +1,1736 @@
+/*********************************************************************
+ *                
+ * Filename:      netwave_cs.c
+ * Version:       0.4.1
+ * Description:   Netwave AirSurfer Wireless LAN PC Card driver
+ * Status:        Experimental.
+ * Authors:       John Markus Bjørndalen <johnm@cs.uit.no>
+ *                Dag Brattli <dagb@cs.uit.no>
+ *                David Hinds <dahinds@users.sourceforge.net>
+ * Created at:    A long time ago!
+ * Modified at:   Mon Nov 10 11:54:37 1997
+ * Modified by:   Dag Brattli <dagb@cs.uit.no>
+ * 
+ *     Copyright (c) 1997 University of Tromsø, Norway
+ *
+ * Revision History:
+ *
+ *   08-Nov-97 15:14:47   John Markus Bjørndalen <johnm@cs.uit.no>
+ *    - Fixed some bugs in netwave_rx and cleaned it up a bit. 
+ *      (One of the bugs would have destroyed packets when receiving
+ *      multiple packets per interrupt). 
+ *    - Cleaned up parts of newave_hw_xmit. 
+ *    - A few general cleanups. 
+ *   24-Oct-97 13:17:36   Dag Brattli <dagb@cs.uit.no>
+ *    - Fixed netwave_rx receive function (got updated docs)
+ *   Others:
+ *    - Changed name from xircnw to netwave, take a look at 
+ *      http://www.netwave-wireless.com
+ *    - Some reorganizing of the code
+ *    - Removed possible race condition between interrupt handler and transmit
+ *      function
+ *    - Started to add wireless extensions, but still needs some coding
+ *    - Added watchdog for better handling of transmission timeouts 
+ *      (hopefully this works better)
+ ********************************************************************/
+
+/* To have statistics (just packets sent) define this */
+#undef NETWAVE_STATS
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/types.h>
+#include <linux/fcntl.h>
+#include <linux/interrupt.h>
+#include <linux/ptrace.h>
+#include <linux/ioport.h>
+#include <linux/in.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/timer.h>
+#include <linux/errno.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/skbuff.h>
+#include <linux/bitops.h>
+#ifdef CONFIG_NET_RADIO
+#include <linux/wireless.h>
+#if WIRELESS_EXT > 12
+#include <net/iw_handler.h>
+#endif	/* WIRELESS_EXT > 12 */
+#endif
+
+#include <pcmcia/version.h>
+#include <pcmcia/cs_types.h>
+#include <pcmcia/cs.h>
+#include <pcmcia/cistpl.h>
+#include <pcmcia/cisreg.h>
+#include <pcmcia/ds.h>
+#include <pcmcia/mem_op.h>
+
+#include <asm/system.h>
+#include <asm/io.h>
+#include <asm/dma.h>
+
+#define NETWAVE_REGOFF         0x8000
+/* The Netwave IO registers, offsets to iobase */
+#define NETWAVE_REG_COR        0x0
+#define NETWAVE_REG_CCSR       0x2
+#define NETWAVE_REG_ASR        0x4
+#define NETWAVE_REG_IMR        0xa
+#define NETWAVE_REG_PMR        0xc
+#define NETWAVE_REG_IOLOW      0x6
+#define NETWAVE_REG_IOHI       0x7
+#define NETWAVE_REG_IOCONTROL  0x8
+#define NETWAVE_REG_DATA       0xf
+/* The Netwave Extended IO registers, offsets to RamBase */
+#define NETWAVE_EREG_ASCC      0x114
+#define NETWAVE_EREG_RSER      0x120
+#define NETWAVE_EREG_RSERW     0x124
+#define NETWAVE_EREG_TSER      0x130
+#define NETWAVE_EREG_TSERW     0x134
+#define NETWAVE_EREG_CB        0x100
+#define NETWAVE_EREG_SPCQ      0x154
+#define NETWAVE_EREG_SPU       0x155
+#define NETWAVE_EREG_LIF       0x14e
+#define NETWAVE_EREG_ISPLQ     0x156
+#define NETWAVE_EREG_HHC       0x158
+#define NETWAVE_EREG_NI        0x16e
+#define NETWAVE_EREG_MHS       0x16b
+#define NETWAVE_EREG_TDP       0x140
+#define NETWAVE_EREG_RDP       0x150
+#define NETWAVE_EREG_PA        0x160
+#define NETWAVE_EREG_EC        0x180
+#define NETWAVE_EREG_CRBP      0x17a
+#define NETWAVE_EREG_ARW       0x166
+
+/*
+ * Commands used in the extended command buffer
+ * NETWAVE_EREG_CB (0x100-0x10F) 
+ */
+#define NETWAVE_CMD_NOP        0x00
+#define NETWAVE_CMD_SRC        0x01
+#define NETWAVE_CMD_STC        0x02
+#define NETWAVE_CMD_AMA        0x03
+#define NETWAVE_CMD_DMA        0x04
+#define NETWAVE_CMD_SAMA       0x05
+#define NETWAVE_CMD_ER         0x06
+#define NETWAVE_CMD_DR         0x07
+#define NETWAVE_CMD_TL         0x08
+#define NETWAVE_CMD_SRP        0x09
+#define NETWAVE_CMD_SSK        0x0a
+#define NETWAVE_CMD_SMD        0x0b
+#define NETWAVE_CMD_SAPD       0x0c
+#define NETWAVE_CMD_SSS        0x11
+/* End of Command marker */
+#define NETWAVE_CMD_EOC        0x00
+
+/* ASR register bits */
+#define NETWAVE_ASR_RXRDY   0x80
+#define NETWAVE_ASR_TXBA    0x01
+
+#define TX_TIMEOUT		((32*HZ)/100)
+
+static const unsigned int imrConfRFU1 = 0x10; /* RFU interrupt mask, keep high */
+static const unsigned int imrConfIENA = 0x02; /* Interrupt enable */
+
+static const unsigned int corConfIENA   = 0x01; /* Interrupt enable */
+static const unsigned int corConfLVLREQ = 0x40; /* Keep high */
+
+static const unsigned int rxConfRxEna  = 0x80; /* Receive Enable */
+static const unsigned int rxConfMAC    = 0x20; /* MAC host receive mode*/ 
+static const unsigned int rxConfPro    = 0x10; /* Promiscuous */
+static const unsigned int rxConfAMP    = 0x08; /* Accept Multicast Packets */
+static const unsigned int rxConfBcast  = 0x04; /* Accept Broadcast Packets */
+
+static const unsigned int txConfTxEna  = 0x80; /* Transmit Enable */
+static const unsigned int txConfMAC    = 0x20; /* Host sends MAC mode */
+static const unsigned int txConfEUD    = 0x10; /* Enable Uni-Data packets */
+static const unsigned int txConfKey    = 0x02; /* Scramble data packets */
+static const unsigned int txConfLoop   = 0x01; /* Loopback mode */
+
+/*
+   All the PCMCIA modules use PCMCIA_DEBUG to control debugging.  If
+   you do not define PCMCIA_DEBUG at all, all the debug code will be
+   left out.  If you compile with PCMCIA_DEBUG=0, the debug code will
+   be present but disabled -- but it can then be enabled for specific
+   modules at load time with a 'pc_debug=#' option to insmod.
+*/
+
+#ifdef PCMCIA_DEBUG
+static int pc_debug = PCMCIA_DEBUG;
+module_param(pc_debug, int, 0);
+#define DEBUG(n, args...) if (pc_debug>(n)) printk(KERN_DEBUG args)
+static char *version =
+"netwave_cs.c 0.3.0 Thu Jul 17 14:36:02 1997 (John Markus Bjørndalen)\n";
+#else
+#define DEBUG(n, args...)
+#endif
+
+static dev_info_t dev_info = "netwave_cs";
+
+/*====================================================================*/
+
+/* Parameters that can be set with 'insmod' */
+
+/* Choose the domain, default is 0x100 */
+static u_int  domain = 0x100;
+
+/* Scramble key, range from 0x0 to 0xffff.  
+ * 0x0 is no scrambling. 
+ */
+static u_int  scramble_key = 0x0;
+
+/* Shared memory speed, in ns. The documentation states that 
+ * the card should not be read faster than every 400ns. 
+ * This timing should be provided by the HBA. If it becomes a 
+ * problem, try setting mem_speed to 400. 
+ */
+static int mem_speed;
+
+module_param(domain, int, 0);
+module_param(scramble_key, int, 0);
+module_param(mem_speed, int, 0);
+
+/*====================================================================*/
+
+/* PCMCIA (Card Services) related functions */
+static void netwave_release(dev_link_t *link);     /* Card removal */
+static int  netwave_event(event_t event, int priority, 
+					      event_callback_args_t *args);
+static void netwave_pcmcia_config(dev_link_t *arg); /* Runs after card 
+													   insertion */
+static dev_link_t *netwave_attach(void);     /* Create instance */
+static void netwave_detach(dev_link_t *);    /* Destroy instance */
+
+/* Hardware configuration */
+static void netwave_doreset(kio_addr_t iobase, u_char __iomem *ramBase);
+static void netwave_reset(struct net_device *dev);
+
+/* Misc device stuff */
+static int netwave_open(struct net_device *dev);  /* Open the device */
+static int netwave_close(struct net_device *dev); /* Close the device */
+
+/* Packet transmission and Packet reception */
+static int netwave_start_xmit( struct sk_buff *skb, struct net_device *dev);
+static int netwave_rx( struct net_device *dev);
+
+/* Interrupt routines */
+static irqreturn_t netwave_interrupt(int irq, void *dev_id, struct pt_regs *regs);
+static void netwave_watchdog(struct net_device *);
+
+/* Statistics */
+static void update_stats(struct net_device *dev);
+static struct net_device_stats *netwave_get_stats(struct net_device *dev);
+
+/* Wireless extensions */
+#ifdef WIRELESS_EXT
+static struct iw_statistics* netwave_get_wireless_stats(struct net_device *dev);
+#endif
+static int netwave_ioctl(struct net_device *, struct ifreq *, int);
+
+static void set_multicast_list(struct net_device *dev);
+
+/*
+   A linked list of "instances" of the skeleton device.  Each actual
+   PCMCIA card corresponds to one device instance, and is described
+   by one dev_link_t structure (defined in ds.h).
+
+   You may not want to use a linked list for this -- for example, the
+   memory card driver uses an array of dev_link_t pointers, where minor
+   device numbers are used to derive the corresponding array index.
+*/
+static dev_link_t *dev_list;
+
+/*
+   A dev_link_t structure has fields for most things that are needed
+   to keep track of a socket, but there will usually be some device
+   specific information that also needs to be kept track of.  The
+   'priv' pointer in a dev_link_t structure can be used to point to
+   a device-specific private data structure, like this.
+
+   A driver needs to provide a dev_node_t structure for each device
+   on a card.  In some cases, there is only one device per card (for
+   example, ethernet cards, modems).  In other cases, there may be
+   many actual or logical devices (SCSI adapters, memory cards with
+   multiple partitions).  The dev_node_t structures need to be kept
+   in a linked list starting at the 'dev' field of a dev_link_t
+   structure.  We allocate them in the card's private data structure,
+   because they generally can't be allocated dynamically.
+*/
+
+#if WIRELESS_EXT <= 12
+/* Wireless extensions backward compatibility */
+
+/* Part of iw_handler prototype we need */
+struct iw_request_info
+{
+	__u16		cmd;		/* Wireless Extension command */
+	__u16		flags;		/* More to come ;-) */
+};
+
+/* Wireless Extension Backward compatibility - Jean II
+ * If the new wireless device private ioctl range is not defined,
+ * default to standard device private ioctl range */
+#ifndef SIOCIWFIRSTPRIV
+#define SIOCIWFIRSTPRIV	SIOCDEVPRIVATE
+#endif /* SIOCIWFIRSTPRIV */
+
+#else	/* WIRELESS_EXT <= 12 */
+static const struct iw_handler_def	netwave_handler_def;
+#endif	/* WIRELESS_EXT <= 12 */
+
+#define SIOCGIPSNAP	SIOCIWFIRSTPRIV	+ 1	/* Site Survey Snapshot */
+
+#define MAX_ESA 10
+
+typedef struct net_addr {
+    u_char addr48[6];
+} net_addr;
+
+struct site_survey {
+    u_short length;
+    u_char  struct_revision;
+    u_char  roaming_state;
+	
+    u_char  sp_existsFlag;
+    u_char  sp_link_quality;
+    u_char  sp_max_link_quality;
+    u_char  linkQualityGoodFairBoundary;
+    u_char  linkQualityFairPoorBoundary;
+    u_char  sp_utilization;
+    u_char  sp_goodness;
+    u_char  sp_hotheadcount;
+    u_char  roaming_condition;
+	
+    net_addr sp;
+    u_char   numAPs;
+    net_addr nearByAccessPoints[MAX_ESA];
+};	
+   
+typedef struct netwave_private {
+    dev_link_t link;
+    spinlock_t	spinlock;	/* Serialize access to the hardware (SMP) */
+    dev_node_t node;
+    u_char     __iomem *ramBase;
+    int        timeoutCounter;
+    int        lastExec;
+    struct timer_list      watchdog;	/* To avoid blocking state */
+    struct site_survey     nss;
+    struct net_device_stats stats;
+#ifdef WIRELESS_EXT
+    struct iw_statistics   iw_stats;    /* Wireless stats */
+#endif
+} netwave_private;
+
+#ifdef NETWAVE_STATS
+static struct net_device_stats *netwave_get_stats(struct net_device *dev);
+#endif
+
+/*
+ * The Netwave card is little-endian, so won't work for big endian
+ * systems.
+ */
+static inline unsigned short get_uint16(u_char __iomem *staddr) 
+{
+    return readw(staddr); /* Return only 16 bits */
+}
+
+static inline short get_int16(u_char __iomem * staddr)
+{
+    return readw(staddr);
+}
+
+/* 
+ * Wait until the WOC (Write Operation Complete) bit in the 
+ * ASR (Adapter Status Register) is asserted. 
+ * This should have aborted if it takes too long time. 
+ */
+static inline void wait_WOC(unsigned int iobase)
+{
+    /* Spin lock */
+    while ((inb(iobase + NETWAVE_REG_ASR) & 0x8) != 0x8) ; 
+}
+
+#ifdef WIRELESS_EXT
+static void netwave_snapshot(netwave_private *priv, u_char __iomem *ramBase, 
+			     kio_addr_t iobase) {
+    u_short resultBuffer;
+
+    /* if time since last snapshot is > 1 sec. (100 jiffies?)  then take 
+     * new snapshot, else return cached data. This is the recommended rate.  
+     */
+    if ( jiffies - priv->lastExec > 100) { 
+	/* Take site survey  snapshot */ 
+	/*printk( KERN_DEBUG "Taking new snapshot. %ld\n", jiffies -
+	  priv->lastExec); */
+	wait_WOC(iobase); 
+	writeb(NETWAVE_CMD_SSS, ramBase + NETWAVE_EREG_CB + 0); 
+	writeb(NETWAVE_CMD_EOC, ramBase + NETWAVE_EREG_CB + 1); 
+	wait_WOC(iobase); 
+
+	/* Get result and copy to cach */ 
+	resultBuffer = readw(ramBase + NETWAVE_EREG_CRBP); 
+	copy_from_pc( &priv->nss, ramBase+resultBuffer, 
+		      sizeof(struct site_survey)); 
+    } 
+}
+#endif
+
+#ifdef WIRELESS_EXT
+/*
+ * Function netwave_get_wireless_stats (dev)
+ *
+ *    Wireless extensions statistics
+ *
+ */
+static struct iw_statistics *netwave_get_wireless_stats(struct net_device *dev)
+{	
+    unsigned long flags;
+    kio_addr_t iobase = dev->base_addr;
+    netwave_private *priv = netdev_priv(dev);
+    u_char __iomem *ramBase = priv->ramBase;
+    struct iw_statistics* wstats;
+	
+    wstats = &priv->iw_stats;
+
+    spin_lock_irqsave(&priv->spinlock, flags);
+	
+    netwave_snapshot( priv, ramBase, iobase);
+
+    wstats->status = priv->nss.roaming_state;
+    wstats->qual.qual = readb( ramBase + NETWAVE_EREG_SPCQ); 
+    wstats->qual.level = readb( ramBase + NETWAVE_EREG_ISPLQ);
+    wstats->qual.noise = readb( ramBase + NETWAVE_EREG_SPU) & 0x3f;
+    wstats->discard.nwid = 0L;
+    wstats->discard.code = 0L;
+    wstats->discard.misc = 0L;
+
+    spin_unlock_irqrestore(&priv->spinlock, flags);
+    
+    return &priv->iw_stats;
+}
+#endif
+
+/*
+ * Function netwave_attach (void)
+ *
+ *     Creates an "instance" of the driver, allocating local data 
+ *     structures for one device.  The device is registered with Card 
+ *     Services.
+ *
+ *     The dev_link structure is initialized, but we don't actually
+ *     configure the card at this point -- we wait until we receive a
+ *     card insertion event.
+ */
+static dev_link_t *netwave_attach(void)
+{
+    client_reg_t client_reg;
+    dev_link_t *link;
+    struct net_device *dev;
+    netwave_private *priv;
+    int ret;
+    
+    DEBUG(0, "netwave_attach()\n");
+    
+    /* Initialize the dev_link_t structure */
+    dev = alloc_etherdev(sizeof(netwave_private));
+    if (!dev)
+	return NULL;
+    priv = netdev_priv(dev);
+    link = &priv->link;
+    link->priv = dev;
+
+    /* The io structure describes IO port mapping */
+    link->io.NumPorts1 = 16;
+    link->io.Attributes1 = IO_DATA_PATH_WIDTH_16;
+    /* link->io.NumPorts2 = 16; 
+       link->io.Attributes2 = IO_DATA_PATH_WIDTH_16; */
+    link->io.IOAddrLines = 5;
+    
+    /* Interrupt setup */
+    link->irq.Attributes = IRQ_TYPE_EXCLUSIVE | IRQ_HANDLE_PRESENT;
+    link->irq.IRQInfo1 = IRQ_LEVEL_ID;
+    link->irq.Handler = &netwave_interrupt;
+    
+    /* General socket configuration */
+    link->conf.Attributes = CONF_ENABLE_IRQ;
+    link->conf.Vcc = 50;
+    link->conf.IntType = INT_MEMORY_AND_IO;
+    link->conf.ConfigIndex = 1;
+    link->conf.Present = PRESENT_OPTION;
+
+    /* Netwave private struct init. link/dev/node already taken care of,
+     * other stuff zero'd - Jean II */
+    spin_lock_init(&priv->spinlock);
+
+    /* Netwave specific entries in the device structure */
+    SET_MODULE_OWNER(dev);
+    dev->hard_start_xmit = &netwave_start_xmit;
+    dev->get_stats  = &netwave_get_stats;
+    dev->set_multicast_list = &set_multicast_list;
+    /* wireless extensions */
+#ifdef WIRELESS_EXT
+    dev->get_wireless_stats = &netwave_get_wireless_stats;
+#if WIRELESS_EXT > 12
+    dev->wireless_handlers = (struct iw_handler_def *)&netwave_handler_def;
+#endif /* WIRELESS_EXT > 12 */
+#endif /* WIRELESS_EXT */
+    dev->do_ioctl = &netwave_ioctl;
+
+    dev->tx_timeout = &netwave_watchdog;
+    dev->watchdog_timeo = TX_TIMEOUT;
+
+    dev->open = &netwave_open;
+    dev->stop = &netwave_close;
+    link->irq.Instance = dev;
+    
+    /* Register with Card Services */
+    link->next = dev_list;
+    dev_list = link;
+    client_reg.dev_info = &dev_info;
+    client_reg.EventMask =
+	CS_EVENT_CARD_INSERTION | CS_EVENT_CARD_REMOVAL |
+	CS_EVENT_RESET_PHYSICAL | CS_EVENT_CARD_RESET |
+	CS_EVENT_PM_SUSPEND | CS_EVENT_PM_RESUME;
+    client_reg.event_handler = &netwave_event;
+    client_reg.Version = 0x0210;
+    client_reg.event_callback_args.client_data = link;
+    ret = pcmcia_register_client(&link->handle, &client_reg);
+    if (ret != 0) {
+	cs_error(link->handle, RegisterClient, ret);
+	netwave_detach(link);
+	return NULL;
+    }
+
+    return link;
+} /* netwave_attach */
+
+/*
+ * Function netwave_detach (link)
+ *
+ *    This deletes a driver "instance".  The device is de-registered
+ *    with Card Services.  If it has been released, all local data
+ *    structures are freed.  Otherwise, the structures will be freed
+ *    when the device is released.
+ */
+static void netwave_detach(dev_link_t *link)
+{
+    struct net_device *dev = link->priv;
+    dev_link_t **linkp;
+
+    DEBUG(0, "netwave_detach(0x%p)\n", link);
+  
+    /*
+	  If the device is currently configured and active, we won't
+	  actually delete it yet.  Instead, it is marked so that when
+	  the release() function is called, that will trigger a proper
+	  detach().
+	*/
+    if (link->state & DEV_CONFIG)
+	netwave_release(link);
+	
+    /* Break the link with Card Services */
+    if (link->handle)
+	pcmcia_deregister_client(link->handle);
+    
+    /* Locate device structure */
+    for (linkp = &dev_list; *linkp; linkp = &(*linkp)->next)
+	if (*linkp == link) break;
+    if (*linkp == NULL)
+      {
+	DEBUG(1, "netwave_cs: detach fail, '%s' not in list\n",
+	      link->dev->dev_name);
+	return;
+      }
+
+    /* Unlink device structure, free pieces */
+    *linkp = link->next;
+    if (link->dev) 
+	unregister_netdev(dev);
+    free_netdev(dev);
+    
+} /* netwave_detach */
+
+/*
+ * Wireless Handler : get protocol name
+ */
+static int netwave_get_name(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu,
+			    char *extra)
+{
+	strcpy(wrqu->name, "Netwave");
+	return 0;
+}
+
+/*
+ * Wireless Handler : set Network ID
+ */
+static int netwave_set_nwid(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu,
+			    char *extra)
+{
+	unsigned long flags;
+	kio_addr_t iobase = dev->base_addr;
+	netwave_private *priv = netdev_priv(dev);
+	u_char __iomem *ramBase = priv->ramBase;
+
+	/* Disable interrupts & save flags */
+	spin_lock_irqsave(&priv->spinlock, flags);
+
+#if WIRELESS_EXT > 8
+	if(!wrqu->nwid.disabled) {
+	    domain = wrqu->nwid.value;
+#else	/* WIRELESS_EXT > 8 */
+	if(wrqu->nwid.on) {
+	    domain = wrqu->nwid.nwid;
+#endif	/* WIRELESS_EXT > 8 */
+	    printk( KERN_DEBUG "Setting domain to 0x%x%02x\n", 
+		    (domain >> 8) & 0x01, domain & 0xff);
+	    wait_WOC(iobase);
+	    writeb(NETWAVE_CMD_SMD, ramBase + NETWAVE_EREG_CB + 0);
+	    writeb( domain & 0xff, ramBase + NETWAVE_EREG_CB + 1);
+	    writeb((domain >>8 ) & 0x01,ramBase + NETWAVE_EREG_CB+2);
+	    writeb(NETWAVE_CMD_EOC, ramBase + NETWAVE_EREG_CB + 3);
+	}
+
+	/* ReEnable interrupts & restore flags */
+	spin_unlock_irqrestore(&priv->spinlock, flags);
+    
+	return 0;
+}
+
+/*
+ * Wireless Handler : get Network ID
+ */
+static int netwave_get_nwid(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu,
+			    char *extra)
+{
+#if WIRELESS_EXT > 8
+	wrqu->nwid.value = domain;
+	wrqu->nwid.disabled = 0;
+	wrqu->nwid.fixed = 1;
+#else	/* WIRELESS_EXT > 8 */
+	wrqu->nwid.nwid = domain;
+	wrqu->nwid.on = 1;
+#endif	/* WIRELESS_EXT > 8 */
+
+	return 0;
+}
+
+/*
+ * Wireless Handler : set scramble key
+ */
+static int netwave_set_scramble(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu,
+				char *key)
+{
+	unsigned long flags;
+	kio_addr_t iobase = dev->base_addr;
+	netwave_private *priv = netdev_priv(dev);
+	u_char __iomem *ramBase = priv->ramBase;
+
+	/* Disable interrupts & save flags */
+	spin_lock_irqsave(&priv->spinlock, flags);
+
+	scramble_key = (key[0] << 8) | key[1];
+	wait_WOC(iobase);
+	writeb(NETWAVE_CMD_SSK, ramBase + NETWAVE_EREG_CB + 0);
+	writeb(scramble_key & 0xff, ramBase + NETWAVE_EREG_CB + 1);
+	writeb((scramble_key>>8) & 0xff, ramBase + NETWAVE_EREG_CB + 2);
+	writeb(NETWAVE_CMD_EOC, ramBase + NETWAVE_EREG_CB + 3);
+
+	/* ReEnable interrupts & restore flags */
+	spin_unlock_irqrestore(&priv->spinlock, flags);
+    
+	return 0;
+}
+
+/*
+ * Wireless Handler : get scramble key
+ */
+static int netwave_get_scramble(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu,
+				char *key)
+{
+	key[1] = scramble_key & 0xff;
+	key[0] = (scramble_key>>8) & 0xff;
+#if WIRELESS_EXT > 8
+	wrqu->encoding.flags = IW_ENCODE_ENABLED;
+	wrqu->encoding.length = 2;
+#else /* WIRELESS_EXT > 8 */
+	wrqu->encoding.method = 1;
+#endif	/* WIRELESS_EXT > 8 */
+
+	return 0;
+}
+
+#if WIRELESS_EXT > 8
+/*
+ * Wireless Handler : get mode
+ */
+static int netwave_get_mode(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu,
+			    char *extra)
+{
+	if(domain & 0x100)
+		wrqu->mode = IW_MODE_INFRA;
+	else
+		wrqu->mode = IW_MODE_ADHOC;
+
+	return 0;
+}
+#endif	/* WIRELESS_EXT > 8 */
+
+/*
+ * Wireless Handler : get range info
+ */
+static int netwave_get_range(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu,
+			     char *extra)
+{
+	struct iw_range *range = (struct iw_range *) extra;
+	int ret = 0;
+
+	/* Set the length (very important for backward compatibility) */
+	wrqu->data.length = sizeof(struct iw_range);
+
+	/* Set all the info we don't care or don't know about to zero */
+	memset(range, 0, sizeof(struct iw_range));
+
+#if WIRELESS_EXT > 10
+	/* Set the Wireless Extension versions */
+	range->we_version_compiled = WIRELESS_EXT;
+	range->we_version_source = 9;	/* Nothing for us in v10 and v11 */
+#endif /* WIRELESS_EXT > 10 */
+		   
+	/* Set information in the range struct */
+	range->throughput = 450 * 1000;	/* don't argue on this ! */
+	range->min_nwid = 0x0000;
+	range->max_nwid = 0x01FF;
+
+	range->num_channels = range->num_frequency = 0;
+		   
+	range->sensitivity = 0x3F;
+	range->max_qual.qual = 255;
+	range->max_qual.level = 255;
+	range->max_qual.noise = 0;
+		   
+#if WIRELESS_EXT > 7
+	range->num_bitrates = 1;
+	range->bitrate[0] = 1000000;	/* 1 Mb/s */
+#endif /* WIRELESS_EXT > 7 */
+
+#if WIRELESS_EXT > 8
+	range->encoding_size[0] = 2;		/* 16 bits scrambling */
+	range->num_encoding_sizes = 1;
+	range->max_encoding_tokens = 1;	/* Only one key possible */
+#endif /* WIRELESS_EXT > 8 */
+
+	return ret;
+}
+
+/*
+ * Wireless Private Handler : get snapshot
+ */
+static int netwave_get_snap(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu,
+			    char *extra)
+{
+	unsigned long flags;
+	kio_addr_t iobase = dev->base_addr;
+	netwave_private *priv = netdev_priv(dev);
+	u_char __iomem *ramBase = priv->ramBase;
+
+	/* Disable interrupts & save flags */
+	spin_lock_irqsave(&priv->spinlock, flags);
+
+	/* Take snapshot of environment */
+	netwave_snapshot( priv, ramBase, iobase);
+	wrqu->data.length = priv->nss.length;
+	memcpy(extra, (u_char *) &priv->nss, sizeof( struct site_survey));
+
+	priv->lastExec = jiffies;
+
+	/* ReEnable interrupts & restore flags */
+	spin_unlock_irqrestore(&priv->spinlock, flags);
+    
+	return(0);
+}
+
+/*
+ * Structures to export the Wireless Handlers
+ *     This is the stuff that are treated the wireless extensions (iwconfig)
+ */
+
+static const struct iw_priv_args netwave_private_args[] = {
+/*{ cmd,         set_args,                            get_args, name } */
+  { SIOCGIPSNAP, 0, 
+    IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | sizeof(struct site_survey), 
+    "getsitesurvey" },
+};
+
+#if WIRELESS_EXT > 12
+
+static const iw_handler		netwave_handler[] =
+{
+	NULL,				/* SIOCSIWNAME */
+	netwave_get_name,		/* SIOCGIWNAME */
+	netwave_set_nwid,		/* SIOCSIWNWID */
+	netwave_get_nwid,		/* SIOCGIWNWID */
+	NULL,				/* SIOCSIWFREQ */
+	NULL,				/* SIOCGIWFREQ */
+	NULL,				/* SIOCSIWMODE */
+	netwave_get_mode,		/* SIOCGIWMODE */
+	NULL,				/* SIOCSIWSENS */
+	NULL,				/* SIOCGIWSENS */
+	NULL,				/* SIOCSIWRANGE */
+	netwave_get_range,		/* SIOCGIWRANGE */
+	NULL,				/* SIOCSIWPRIV */
+	NULL,				/* SIOCGIWPRIV */
+	NULL,				/* SIOCSIWSTATS */
+	NULL,				/* SIOCGIWSTATS */
+	NULL,				/* SIOCSIWSPY */
+	NULL,				/* SIOCGIWSPY */
+	NULL,				/* -- hole -- */
+	NULL,				/* -- hole -- */
+	NULL,				/* SIOCSIWAP */
+	NULL,				/* SIOCGIWAP */
+	NULL,				/* -- hole -- */
+	NULL,				/* SIOCGIWAPLIST */
+	NULL,				/* -- hole -- */
+	NULL,				/* -- hole -- */
+	NULL,				/* SIOCSIWESSID */
+	NULL,				/* SIOCGIWESSID */
+	NULL,				/* SIOCSIWNICKN */
+	NULL,				/* SIOCGIWNICKN */
+	NULL,				/* -- hole -- */
+	NULL,				/* -- hole -- */
+	NULL,				/* SIOCSIWRATE */
+	NULL,				/* SIOCGIWRATE */
+	NULL,				/* SIOCSIWRTS */
+	NULL,				/* SIOCGIWRTS */
+	NULL,				/* SIOCSIWFRAG */
+	NULL,				/* SIOCGIWFRAG */
+	NULL,				/* SIOCSIWTXPOW */
+	NULL,				/* SIOCGIWTXPOW */
+	NULL,				/* SIOCSIWRETRY */
+	NULL,				/* SIOCGIWRETRY */
+	netwave_set_scramble,		/* SIOCSIWENCODE */
+	netwave_get_scramble,		/* SIOCGIWENCODE */
+};
+
+static const iw_handler		netwave_private_handler[] =
+{
+	NULL,				/* SIOCIWFIRSTPRIV */
+	netwave_get_snap,		/* SIOCIWFIRSTPRIV + 1 */
+};
+
+static const struct iw_handler_def	netwave_handler_def =
+{
+	.num_standard	= sizeof(netwave_handler)/sizeof(iw_handler),
+	.num_private	= sizeof(netwave_private_handler)/sizeof(iw_handler),
+	.num_private_args = sizeof(netwave_private_args)/sizeof(struct iw_priv_args),
+	.standard	= (iw_handler *) netwave_handler,
+	.private	= (iw_handler *) netwave_private_handler,
+	.private_args	= (struct iw_priv_args *) netwave_private_args,
+};
+#endif /* WIRELESS_EXT > 12 */
+
+/*
+ * Function netwave_ioctl (dev, rq, cmd)
+ *
+ *     Perform ioctl : config & info stuff
+ *     This is the stuff that are treated the wireless extensions (iwconfig)
+ *
+ */
+static int netwave_ioctl(struct net_device *dev, /* ioctl device */
+			 struct ifreq *rq,	 /* Data passed */
+			 int	cmd)	     /* Ioctl number */
+{
+    int			ret = 0;
+#ifdef WIRELESS_EXT
+#if WIRELESS_EXT <= 12
+    struct iwreq *wrq = (struct iwreq *) rq;
+#endif
+#endif
+	
+    DEBUG(0, "%s: ->netwave_ioctl(cmd=0x%X)\n", dev->name, cmd);
+	
+    /* Look what is the request */
+    switch(cmd) {
+	/* --------------- WIRELESS EXTENSIONS --------------- */
+#ifdef WIRELESS_EXT
+#if WIRELESS_EXT <= 12
+    case SIOCGIWNAME:
+	netwave_get_name(dev, NULL, &(wrq->u), NULL);
+	break;
+    case SIOCSIWNWID:
+	ret = netwave_set_nwid(dev, NULL, &(wrq->u), NULL);
+	break;
+    case SIOCGIWNWID:
+	ret = netwave_get_nwid(dev, NULL, &(wrq->u), NULL);
+	break;
+#if WIRELESS_EXT > 8	/* Note : The API did change... */
+    case SIOCGIWENCODE:
+	/* Get scramble key */
+	if(wrq->u.encoding.pointer != (caddr_t) 0)
+	  {
+	    char	key[2];
+	    ret = netwave_get_scramble(dev, NULL, &(wrq->u), key);
+	    if(copy_to_user(wrq->u.encoding.pointer, key, 2))
+	      ret = -EFAULT;
+	  }
+	break;
+    case SIOCSIWENCODE:
+	/* Set  scramble key */
+	if(wrq->u.encoding.pointer != (caddr_t) 0)
+	  {
+	    char	key[2];
+	    if(copy_from_user(key, wrq->u.encoding.pointer, 2))
+	      {
+		ret = -EFAULT;
+		break;
+	      }
+	    ret = netwave_set_scramble(dev, NULL, &(wrq->u), key);
+	  }
+	break;
+    case SIOCGIWMODE:
+	/* Mode of operation */
+	ret = netwave_get_mode(dev, NULL, &(wrq->u), NULL);
+	break;
+#else /* WIRELESS_EXT > 8 */
+    case SIOCGIWENCODE:
+	/* Get scramble key */
+	ret = netwave_get_scramble(dev, NULL, &(wrq->u),
+				   (char *) &wrq->u.encoding.code);
+	break;
+    case SIOCSIWENCODE:
+	/* Set  scramble key */
+	ret = netwave_set_scramble(dev, NULL, &(wrq->u),
+				   (char *) &wrq->u.encoding.code);
+	break;
+#endif /* WIRELESS_EXT > 8 */
+   case SIOCGIWRANGE:
+       /* Basic checking... */
+       if(wrq->u.data.pointer != (caddr_t) 0) {
+           struct iw_range range;
+	   ret = netwave_get_range(dev, NULL, &(wrq->u), (char *) &range);
+	   if (copy_to_user(wrq->u.data.pointer, &range,
+			    sizeof(struct iw_range)))
+	       ret = -EFAULT;
+       }
+       break;
+    case SIOCGIWPRIV:
+	/* Basic checking... */
+	if(wrq->u.data.pointer != (caddr_t) 0) {
+	    /* Set the number of ioctl available */
+	    wrq->u.data.length = sizeof(netwave_private_args) / sizeof(netwave_private_args[0]);
+			
+	    /* Copy structure to the user buffer */
+	    if(copy_to_user(wrq->u.data.pointer,
+			    (u_char *) netwave_private_args,
+			    sizeof(netwave_private_args)))
+	      ret = -EFAULT;
+	} 
+	break;
+    case SIOCGIPSNAP:
+	if(wrq->u.data.pointer != (caddr_t) 0) {
+	    char buffer[sizeof( struct site_survey)];
+	    ret = netwave_get_snap(dev, NULL, &(wrq->u), buffer);
+	    /* Copy structure to the user buffer */
+	    if(copy_to_user(wrq->u.data.pointer, 
+			    buffer,
+			    sizeof( struct site_survey)))
+	      {
+		printk(KERN_DEBUG "Bad buffer!\n");
+		break;
+	      }
+	}
+	break;
+#endif /* WIRELESS_EXT <= 12 */
+#endif /* WIRELESS_EXT */
+    default:
+	ret = -EOPNOTSUPP;
+    }
+	
+    return ret;
+}
+
+/*
+ * Function netwave_pcmcia_config (link)
+ *
+ *     netwave_pcmcia_config() is scheduled to run after a CARD_INSERTION 
+ *     event is received, to configure the PCMCIA socket, and to make the
+ *     device available to the system. 
+ *
+ */
+
+#define CS_CHECK(fn, ret) \
+do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
+
+static void netwave_pcmcia_config(dev_link_t *link) {
+    client_handle_t handle = link->handle;
+    struct net_device *dev = link->priv;
+    netwave_private *priv = netdev_priv(dev);
+    tuple_t tuple;
+    cisparse_t parse;
+    int i, j, last_ret, last_fn;
+    u_char buf[64];
+    win_req_t req;
+    memreq_t mem;
+    u_char __iomem *ramBase = NULL;
+
+    DEBUG(0, "netwave_pcmcia_config(0x%p)\n", link);
+
+    /*
+      This reads the card's CONFIG tuple to find its configuration
+      registers.
+    */
+    tuple.Attributes = 0;
+    tuple.TupleData = (cisdata_t *) buf;
+    tuple.TupleDataMax = 64;
+    tuple.TupleOffset = 0;
+    tuple.DesiredTuple = CISTPL_CONFIG;
+    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
+    CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+    link->conf.ConfigBase = parse.config.base;
+    link->conf.Present = parse.config.rmask[0];
+
+    /* Configure card */
+    link->state |= DEV_CONFIG;
+
+    /*
+     *  Try allocating IO ports.  This tries a few fixed addresses.
+     *  If you want, you can also read the card's config table to
+     *  pick addresses -- see the serial driver for an example.
+     */
+    for (i = j = 0x0; j < 0x400; j += 0x20) {
+	link->io.BasePort1 = j ^ 0x300;
+	i = pcmcia_request_io(link->handle, &link->io);
+	if (i == CS_SUCCESS) break;
+    }
+    if (i != CS_SUCCESS) {
+	cs_error(link->handle, RequestIO, i);
+	goto failed;
+    }
+
+    /*
+     *  Now allocate an interrupt line.  Note that this does not
+     *  actually assign a handler to the interrupt.
+     */
+    CS_CHECK(RequestIRQ, pcmcia_request_irq(handle, &link->irq));
+
+    /*
+     *  This actually configures the PCMCIA socket -- setting up
+     *  the I/O windows and the interrupt mapping.
+     */
+    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(handle, &link->conf));
+
+    /*
+     *  Allocate a 32K memory window.  Note that the dev_link_t
+     *  structure provides space for one window handle -- if your
+     *  device needs several windows, you'll need to keep track of
+     *  the handles in your private data structure, dev->priv.
+     */
+    DEBUG(1, "Setting mem speed of %d\n", mem_speed);
+
+    req.Attributes = WIN_DATA_WIDTH_8|WIN_MEMORY_TYPE_CM|WIN_ENABLE;
+    req.Base = 0; req.Size = 0x8000;
+    req.AccessSpeed = mem_speed;
+    CS_CHECK(RequestWindow, pcmcia_request_window(&link->handle, &req, &link->win));
+    mem.CardOffset = 0x20000; mem.Page = 0; 
+    CS_CHECK(MapMemPage, pcmcia_map_mem_page(link->win, &mem));
+
+    /* Store base address of the common window frame */
+    ramBase = ioremap(req.Base, 0x8000);
+    priv->ramBase = ramBase;
+
+    dev->irq = link->irq.AssignedIRQ;
+    dev->base_addr = link->io.BasePort1;
+    SET_NETDEV_DEV(dev, &handle_to_dev(handle));
+
+    if (register_netdev(dev) != 0) {
+	printk(KERN_DEBUG "netwave_cs: register_netdev() failed\n");
+	goto failed;
+    }
+
+    strcpy(priv->node.dev_name, dev->name);
+    link->dev = &priv->node;
+    link->state &= ~DEV_CONFIG_PENDING;
+
+    /* Reset card before reading physical address */
+    netwave_doreset(dev->base_addr, ramBase);
+
+    /* Read the ethernet address and fill in the Netwave registers. */
+    for (i = 0; i < 6; i++) 
+	dev->dev_addr[i] = readb(ramBase + NETWAVE_EREG_PA + i);
+
+    printk(KERN_INFO "%s: Netwave: port %#3lx, irq %d, mem %lx id "
+	   "%c%c, hw_addr ", dev->name, dev->base_addr, dev->irq,
+	   (u_long) ramBase, (int) readb(ramBase+NETWAVE_EREG_NI),
+	   (int) readb(ramBase+NETWAVE_EREG_NI+1));
+    for (i = 0; i < 6; i++)
+	printk("%02X%s", dev->dev_addr[i], ((i<5) ? ":" : "\n"));
+
+    /* get revision words */
+    printk(KERN_DEBUG "Netwave_reset: revision %04x %04x\n", 
+	   get_uint16(ramBase + NETWAVE_EREG_ARW),
+	   get_uint16(ramBase + NETWAVE_EREG_ARW+2));
+    return;
+
+cs_failed:
+    cs_error(link->handle, last_fn, last_ret);
+failed:
+    netwave_release(link);
+} /* netwave_pcmcia_config */
+
+/*
+ * Function netwave_release (arg)
+ *
+ *    After a card is removed, netwave_release() will unregister the net
+ *    device, and release the PCMCIA configuration.  If the device is
+ *    still open, this will be postponed until it is closed.
+ */
+static void netwave_release(dev_link_t *link)
+{
+    struct net_device *dev = link->priv;
+    netwave_private *priv = netdev_priv(dev);
+
+    DEBUG(0, "netwave_release(0x%p)\n", link);
+
+    /* Don't bother checking to see if these succeed or not */
+    if (link->win) {
+	iounmap(priv->ramBase);
+	pcmcia_release_window(link->win);
+    }
+    pcmcia_release_configuration(link->handle);
+    pcmcia_release_io(link->handle, &link->io);
+    pcmcia_release_irq(link->handle, &link->irq);
+
+    link->state &= ~DEV_CONFIG;
+}
+
+/*
+ * Function netwave_event (event, priority, args)
+ *
+ *    The card status event handler.  Mostly, this schedules other
+ *    stuff to run after an event is received.  A CARD_REMOVAL event
+ *    also sets some flags to discourage the net drivers from trying
+ *    to talk to the card any more.
+ *
+ *    When a CARD_REMOVAL event is received, we immediately set a flag
+ *    to block future accesses to this device.  All the functions that
+ *    actually access the device should check this flag to make sure
+ *    the card is still present.
+ *
+ */
+static int netwave_event(event_t event, int priority,
+			 event_callback_args_t *args)
+{
+    dev_link_t *link = args->client_data;
+    struct net_device *dev = link->priv;
+	
+    DEBUG(1, "netwave_event(0x%06x)\n", event);
+  
+    switch (event) {
+    case CS_EVENT_REGISTRATION_COMPLETE:
+	DEBUG(0, "netwave_cs: registration complete\n");
+	break;
+
+    case CS_EVENT_CARD_REMOVAL:
+	link->state &= ~DEV_PRESENT;
+	if (link->state & DEV_CONFIG) {
+	    netif_device_detach(dev);
+	    netwave_release(link);
+	}
+	break;
+    case CS_EVENT_CARD_INSERTION:
+	link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
+	netwave_pcmcia_config( link);
+	break;
+    case CS_EVENT_PM_SUSPEND:
+	link->state |= DEV_SUSPEND;
+	/* Fall through... */
+    case CS_EVENT_RESET_PHYSICAL:
+	if (link->state & DEV_CONFIG) {
+	    if (link->open)
+		netif_device_detach(dev);
+	    pcmcia_release_configuration(link->handle);
+	}
+	break;
+    case CS_EVENT_PM_RESUME:
+	link->state &= ~DEV_SUSPEND;
+	/* Fall through... */
+    case CS_EVENT_CARD_RESET:
+	if (link->state & DEV_CONFIG) {
+	    pcmcia_request_configuration(link->handle, &link->conf);
+	    if (link->open) {
+		netwave_reset(dev);
+		netif_device_attach(dev);
+	    }
+	}
+	break;
+    }
+    return 0;
+} /* netwave_event */
+
+/*
+ * Function netwave_doreset (ioBase, ramBase)
+ *
+ *    Proper hardware reset of the card.
+ */
+static void netwave_doreset(kio_addr_t ioBase, u_char __iomem *ramBase)
+{
+    /* Reset card */
+    wait_WOC(ioBase);
+    outb(0x80, ioBase + NETWAVE_REG_PMR);
+    writeb(0x08, ramBase + NETWAVE_EREG_ASCC); /* Bit 3 is WOC */
+    outb(0x0, ioBase + NETWAVE_REG_PMR); /* release reset */
+}
+
+/*
+ * Function netwave_reset (dev)
+ *
+ *    Reset and restore all of the netwave registers 
+ */
+static void netwave_reset(struct net_device *dev) {
+    /* u_char state; */
+    netwave_private *priv = netdev_priv(dev);
+    u_char __iomem *ramBase = priv->ramBase;
+    kio_addr_t iobase = dev->base_addr;
+
+    DEBUG(0, "netwave_reset: Done with hardware reset\n");
+
+    priv->timeoutCounter = 0;
+
+    /* Reset card */
+    netwave_doreset(iobase, ramBase);
+    printk(KERN_DEBUG "netwave_reset: Done with hardware reset\n");
+	
+    /* Write a NOP to check the card */
+    wait_WOC(iobase);
+    writeb(NETWAVE_CMD_NOP, ramBase + NETWAVE_EREG_CB + 0);
+    writeb(NETWAVE_CMD_EOC, ramBase + NETWAVE_EREG_CB + 1);
+	
+    /* Set receive conf */
+    wait_WOC(iobase);
+    writeb(NETWAVE_CMD_SRC, ramBase + NETWAVE_EREG_CB + 0);
+    writeb(rxConfRxEna + rxConfBcast, ramBase + NETWAVE_EREG_CB + 1);
+    writeb(NETWAVE_CMD_EOC, ramBase + NETWAVE_EREG_CB + 2);
+    
+    /* Set transmit conf */
+    wait_WOC(iobase);
+    writeb(NETWAVE_CMD_STC, ramBase + NETWAVE_EREG_CB + 0);
+    writeb(txConfTxEna, ramBase + NETWAVE_EREG_CB + 1);
+    writeb(NETWAVE_CMD_EOC, ramBase + NETWAVE_EREG_CB + 2);
+    
+    /* Now set the MU Domain */
+    printk(KERN_DEBUG "Setting domain to 0x%x%02x\n", (domain >> 8) & 0x01, domain & 0xff);
+    wait_WOC(iobase);
+    writeb(NETWAVE_CMD_SMD, ramBase + NETWAVE_EREG_CB + 0);
+    writeb(domain & 0xff, ramBase + NETWAVE_EREG_CB + 1);
+    writeb((domain>>8) & 0x01, ramBase + NETWAVE_EREG_CB + 2);
+    writeb(NETWAVE_CMD_EOC, ramBase + NETWAVE_EREG_CB + 3);
+	
+    /* Set scramble key */
+    printk(KERN_DEBUG "Setting scramble key to 0x%x\n", scramble_key);
+    wait_WOC(iobase);
+    writeb(NETWAVE_CMD_SSK, ramBase + NETWAVE_EREG_CB + 0);
+    writeb(scramble_key & 0xff, ramBase + NETWAVE_EREG_CB + 1);
+    writeb((scramble_key>>8) & 0xff, ramBase + NETWAVE_EREG_CB + 2);
+    writeb(NETWAVE_CMD_EOC, ramBase + NETWAVE_EREG_CB + 3);
+
+    /* Enable interrupts, bit 4 high to keep unused
+     * source from interrupting us, bit 2 high to 
+     * set interrupt enable, 567 to enable TxDN, 
+     * RxErr and RxRdy
+     */
+    wait_WOC(iobase);
+    outb(imrConfIENA+imrConfRFU1, iobase + NETWAVE_REG_IMR);
+
+    /* Hent 4 bytes fra 0x170. Skal vaere 0a,29,88,36
+     * waitWOC
+     * skriv 80 til d000:3688
+     * sjekk om det ble 80
+     */
+    
+    /* Enable Receiver */
+    wait_WOC(iobase);
+    writeb(NETWAVE_CMD_ER, ramBase + NETWAVE_EREG_CB + 0);
+    writeb(NETWAVE_CMD_EOC, ramBase + NETWAVE_EREG_CB + 1);
+	
+    /* Set the IENA bit in COR */
+    wait_WOC(iobase);
+    outb(corConfIENA + corConfLVLREQ, iobase + NETWAVE_REG_COR);
+}
+
+/*
+ * Function netwave_hw_xmit (data, len, dev)    
+ */
+static int netwave_hw_xmit(unsigned char* data, int len,
+			   struct net_device* dev) {
+    unsigned long flags;
+    unsigned int TxFreeList,
+	         curBuff,
+	         MaxData, 
+                 DataOffset;
+    int tmpcount; 
+	
+    netwave_private *priv = netdev_priv(dev);
+    u_char __iomem * ramBase = priv->ramBase;
+    kio_addr_t iobase = dev->base_addr;
+
+    /* Disable interrupts & save flags */
+    spin_lock_irqsave(&priv->spinlock, flags);
+
+    /* Check if there are transmit buffers available */
+    wait_WOC(iobase);
+    if ((inb(iobase+NETWAVE_REG_ASR) & NETWAVE_ASR_TXBA) == 0) {
+	/* No buffers available */
+	printk(KERN_DEBUG "netwave_hw_xmit: %s - no xmit buffers available.\n",
+	       dev->name);
+	spin_unlock_irqrestore(&priv->spinlock, flags);
+	return 1;
+    }
+
+    priv->stats.tx_bytes += len;
+
+    DEBUG(3, "Transmitting with SPCQ %x SPU %x LIF %x ISPLQ %x\n",
+	  readb(ramBase + NETWAVE_EREG_SPCQ),
+	  readb(ramBase + NETWAVE_EREG_SPU),
+	  readb(ramBase + NETWAVE_EREG_LIF),
+	  readb(ramBase + NETWAVE_EREG_ISPLQ));
+
+    /* Now try to insert it into the adapters free memory */
+    wait_WOC(iobase);
+    TxFreeList = get_uint16(ramBase + NETWAVE_EREG_TDP);
+    MaxData    = get_uint16(ramBase + NETWAVE_EREG_TDP+2);
+    DataOffset = get_uint16(ramBase + NETWAVE_EREG_TDP+4);
+	
+    DEBUG(3, "TxFreeList %x, MaxData %x, DataOffset %x\n",
+	  TxFreeList, MaxData, DataOffset);
+
+    /* Copy packet to the adapter fragment buffers */
+    curBuff = TxFreeList; 
+    tmpcount = 0; 
+    while (tmpcount < len) {
+	int tmplen = len - tmpcount; 
+	copy_to_pc(ramBase + curBuff + DataOffset, data + tmpcount, 
+		   (tmplen < MaxData) ? tmplen : MaxData);
+	tmpcount += MaxData;
+			
+	/* Advance to next buffer */
+	curBuff = get_uint16(ramBase + curBuff);
+    }
+    
+    /* Now issue transmit list */
+    wait_WOC(iobase);
+    writeb(NETWAVE_CMD_TL, ramBase + NETWAVE_EREG_CB + 0);
+    writeb(len & 0xff, ramBase + NETWAVE_EREG_CB + 1);
+    writeb((len>>8) & 0xff, ramBase + NETWAVE_EREG_CB + 2);
+    writeb(NETWAVE_CMD_EOC, ramBase + NETWAVE_EREG_CB + 3);
+
+    spin_unlock_irqrestore(&priv->spinlock, flags);
+    return 0;
+}
+
+static int netwave_start_xmit(struct sk_buff *skb, struct net_device *dev) {
+	/* This flag indicate that the hardware can't perform a transmission.
+	 * Theoritically, NET3 check it before sending a packet to the driver,
+	 * but in fact it never do that and pool continuously.
+	 * As the watchdog will abort too long transmissions, we are quite safe...
+	 */
+
+    netif_stop_queue(dev);
+
+    {
+	short length = ETH_ZLEN < skb->len ? skb->len : ETH_ZLEN;
+	unsigned char* buf = skb->data;
+	
+	if (netwave_hw_xmit( buf, length, dev) == 1) {
+	    /* Some error, let's make them call us another time? */
+	    netif_start_queue(dev);
+	}
+	dev->trans_start = jiffies;
+    }
+    dev_kfree_skb(skb);
+    
+    return 0;
+} /* netwave_start_xmit */
+
+/*
+ * Function netwave_interrupt (irq, dev_id, regs)
+ *
+ *    This function is the interrupt handler for the Netwave card. This
+ *    routine will be called whenever: 
+ *	  1. A packet is received.
+ *	  2. A packet has successfully been transferred and the unit is
+ *	     ready to transmit another packet.
+ *	  3. A command has completed execution.
+ */
+static irqreturn_t netwave_interrupt(int irq, void* dev_id, struct pt_regs *regs)
+{
+    kio_addr_t iobase;
+    u_char __iomem *ramBase;
+    struct net_device *dev = (struct net_device *)dev_id;
+    struct netwave_private *priv = netdev_priv(dev);
+    dev_link_t *link = &priv->link;
+    int i;
+    
+    if (!netif_device_present(dev))
+	return IRQ_NONE;
+    
+    iobase = dev->base_addr;
+    ramBase = priv->ramBase;
+	
+    /* Now find what caused the interrupt, check while interrupts ready */
+    for (i = 0; i < 10; i++) {
+	u_char status;
+		
+	wait_WOC(iobase);	
+	if (!(inb(iobase+NETWAVE_REG_CCSR) & 0x02))
+	    break; /* None of the interrupt sources asserted (normal exit) */
+	
+        status = inb(iobase + NETWAVE_REG_ASR);
+		
+	if (!DEV_OK(link)) {
+	    DEBUG(1, "netwave_interrupt: Interrupt with status 0x%x "
+		  "from removed or suspended card!\n", status);
+	    break;
+	}
+		
+	/* RxRdy */
+	if (status & 0x80) {
+	    netwave_rx(dev);
+	    /* wait_WOC(iobase); */
+	    /* RxRdy cannot be reset directly by the host */
+	}
+	/* RxErr */
+	if (status & 0x40) {
+	    u_char rser;
+			
+	    rser = readb(ramBase + NETWAVE_EREG_RSER);			
+	    
+	    if (rser & 0x04) {
+		++priv->stats.rx_dropped; 
+		++priv->stats.rx_crc_errors;
+	    }
+	    if (rser & 0x02)
+		++priv->stats.rx_frame_errors;
+			
+	    /* Clear the RxErr bit in RSER. RSER+4 is the
+	     * write part. Also clear the RxCRC (0x04) and 
+	     * RxBig (0x02) bits if present */
+	    wait_WOC(iobase);
+	    writeb(0x40 | (rser & 0x06), ramBase + NETWAVE_EREG_RSER + 4);
+
+	    /* Write bit 6 high to ASCC to clear RxErr in ASR,
+	     * WOC must be set first! 
+	     */
+	    wait_WOC(iobase);
+	    writeb(0x40, ramBase + NETWAVE_EREG_ASCC);
+
+	    /* Remember to count up priv->stats on error packets */
+	    ++priv->stats.rx_errors;
+	}
+	/* TxDN */
+	if (status & 0x20) {
+	    int txStatus;
+
+	    txStatus = readb(ramBase + NETWAVE_EREG_TSER);
+	    DEBUG(3, "Transmit done. TSER = %x id %x\n", 
+		  txStatus, readb(ramBase + NETWAVE_EREG_TSER + 1));
+	    
+	    if (txStatus & 0x20) {
+		/* Transmitting was okay, clear bits */
+		wait_WOC(iobase);
+		writeb(0x2f, ramBase + NETWAVE_EREG_TSER + 4);
+		++priv->stats.tx_packets;
+	    }
+			
+	    if (txStatus & 0xd0) {
+		if (txStatus & 0x80) {
+		    ++priv->stats.collisions; /* Because of /proc/net/dev*/
+		    /* ++priv->stats.tx_aborted_errors; */
+		    /* printk("Collision. %ld\n", jiffies - dev->trans_start); */
+		}
+		if (txStatus & 0x40) 
+		    ++priv->stats.tx_carrier_errors;
+		/* 0x80 TxGU Transmit giveup - nine times and no luck
+		 * 0x40 TxNOAP No access point. Discarded packet.
+		 * 0x10 TxErr Transmit error. Always set when 
+		 *      TxGU and TxNOAP is set. (Those are the only ones
+		 *      to set TxErr).
+		 */
+		DEBUG(3, "netwave_interrupt: TxDN with error status %x\n", 
+		      txStatus);
+		
+		/* Clear out TxGU, TxNOAP, TxErr and TxTrys */
+		wait_WOC(iobase);
+		writeb(0xdf & txStatus, ramBase+NETWAVE_EREG_TSER+4);
+		++priv->stats.tx_errors;
+	    }
+	    DEBUG(3, "New status is TSER %x ASR %x\n",
+		  readb(ramBase + NETWAVE_EREG_TSER),
+		  inb(iobase + NETWAVE_REG_ASR));
+
+	    netif_wake_queue(dev);
+	}
+	/* TxBA, this would trigger on all error packets received */
+	/* if (status & 0x01) {
+	   DEBUG(4, "Transmit buffers available, %x\n", status);
+	   }
+	   */
+    }
+    /* Handled if we looped at least one time - Jean II */
+    return IRQ_RETVAL(i);
+} /* netwave_interrupt */
+
+/*
+ * Function netwave_watchdog (a)
+ *
+ *    Watchdog : when we start a transmission, we set a timer in the
+ *    kernel.  If the transmission complete, this timer is disabled. If
+ *    it expire, we reset the card.
+ *
+ */
+static void netwave_watchdog(struct net_device *dev) {
+
+    DEBUG(1, "%s: netwave_watchdog: watchdog timer expired\n", dev->name);
+    netwave_reset(dev);
+    dev->trans_start = jiffies;
+    netif_wake_queue(dev);
+} /* netwave_watchdog */
+
+static struct net_device_stats *netwave_get_stats(struct net_device *dev) {
+    netwave_private *priv = netdev_priv(dev);
+
+    update_stats(dev);
+
+    DEBUG(2, "netwave: SPCQ %x SPU %x LIF %x ISPLQ %x MHS %x rxtx %x"
+	  " %x tx %x %x %x %x\n", 
+	  readb(priv->ramBase + NETWAVE_EREG_SPCQ),
+	  readb(priv->ramBase + NETWAVE_EREG_SPU),
+	  readb(priv->ramBase + NETWAVE_EREG_LIF),
+	  readb(priv->ramBase + NETWAVE_EREG_ISPLQ),
+	  readb(priv->ramBase + NETWAVE_EREG_MHS),
+	  readb(priv->ramBase + NETWAVE_EREG_EC + 0xe),
+	  readb(priv->ramBase + NETWAVE_EREG_EC + 0xf),
+	  readb(priv->ramBase + NETWAVE_EREG_EC + 0x18),
+	  readb(priv->ramBase + NETWAVE_EREG_EC + 0x19),
+	  readb(priv->ramBase + NETWAVE_EREG_EC + 0x1a),
+	  readb(priv->ramBase + NETWAVE_EREG_EC + 0x1b));
+
+    return &priv->stats;
+}
+
+static void update_stats(struct net_device *dev) {
+    //unsigned long flags;
+/*     netwave_private *priv = netdev_priv(dev); */
+
+    //spin_lock_irqsave(&priv->spinlock, flags);
+
+/*    priv->stats.rx_packets = readb(priv->ramBase + 0x18e); 
+    priv->stats.tx_packets = readb(priv->ramBase + 0x18f); */
+
+    //spin_unlock_irqrestore(&priv->spinlock, flags);
+}
+
+static int netwave_rx(struct net_device *dev)
+{
+    netwave_private *priv = netdev_priv(dev);
+    u_char __iomem *ramBase = priv->ramBase;
+    kio_addr_t iobase = dev->base_addr;
+    u_char rxStatus;
+    struct sk_buff *skb = NULL;
+    unsigned int curBuffer,
+		rcvList;
+    int rcvLen;
+    int tmpcount = 0;
+    int dataCount, dataOffset;
+    int i;
+    u_char *ptr;
+	
+    DEBUG(3, "xinw_rx: Receiving ... \n");
+
+    /* Receive max 10 packets for now. */
+    for (i = 0; i < 10; i++) {
+	/* Any packets? */
+	wait_WOC(iobase);
+	rxStatus = readb(ramBase + NETWAVE_EREG_RSER);		
+	if ( !( rxStatus & 0x80)) /* No more packets */
+	    break;
+		
+	/* Check if multicast/broadcast or other */
+	/* multicast = (rxStatus & 0x20);  */
+		
+	/* The receive list pointer and length of the packet */
+	wait_WOC(iobase);
+	rcvLen  = get_int16( ramBase + NETWAVE_EREG_RDP);
+	rcvList = get_uint16( ramBase + NETWAVE_EREG_RDP + 2);
+		
+	if (rcvLen < 0) {
+	    printk(KERN_DEBUG "netwave_rx: Receive packet with len %d\n", 
+		   rcvLen);
+	    return 0;
+	}
+		
+	skb = dev_alloc_skb(rcvLen+5);
+	if (skb == NULL) {
+	    DEBUG(1, "netwave_rx: Could not allocate an sk_buff of "
+		  "length %d\n", rcvLen);
+	    ++priv->stats.rx_dropped; 
+	    /* Tell the adapter to skip the packet */
+	    wait_WOC(iobase);
+	    writeb(NETWAVE_CMD_SRP, ramBase + NETWAVE_EREG_CB + 0);
+	    writeb(NETWAVE_CMD_EOC, ramBase + NETWAVE_EREG_CB + 1);
+	    return 0;
+	}
+
+	skb_reserve( skb, 2);  /* Align IP on 16 byte */
+	skb_put( skb, rcvLen);
+	skb->dev = dev;
+
+	/* Copy packet fragments to the skb data area */
+	ptr = (u_char*) skb->data;
+	curBuffer = rcvList;
+	tmpcount = 0; 
+	while ( tmpcount < rcvLen) {
+	    /* Get length and offset of current buffer */
+	    dataCount  = get_uint16( ramBase+curBuffer+2);
+	    dataOffset = get_uint16( ramBase+curBuffer+4);
+		
+	    copy_from_pc( ptr + tmpcount,
+			  ramBase+curBuffer+dataOffset, dataCount);
+
+	    tmpcount += dataCount;
+		
+	    /* Point to next buffer */
+	    curBuffer = get_uint16(ramBase + curBuffer);
+	}
+	
+	skb->protocol = eth_type_trans(skb,dev);
+	/* Queue packet for network layer */
+	netif_rx(skb);
+
+	dev->last_rx = jiffies;
+	priv->stats.rx_packets++;
+	priv->stats.rx_bytes += rcvLen;
+
+	/* Got the packet, tell the adapter to skip it */
+	wait_WOC(iobase);
+	writeb(NETWAVE_CMD_SRP, ramBase + NETWAVE_EREG_CB + 0);
+	writeb(NETWAVE_CMD_EOC, ramBase + NETWAVE_EREG_CB + 1);
+	DEBUG(3, "Packet reception ok\n");
+    }
+    return 0;
+}
+
+static int netwave_open(struct net_device *dev) {
+    netwave_private *priv = netdev_priv(dev);
+    dev_link_t *link = &priv->link;
+
+    DEBUG(1, "netwave_open: starting.\n");
+    
+    if (!DEV_OK(link))
+	return -ENODEV;
+
+    link->open++;
+
+    netif_start_queue(dev);
+    netwave_reset(dev);
+	
+    return 0;
+}
+
+static int netwave_close(struct net_device *dev) {
+    netwave_private *priv = netdev_priv(dev);
+    dev_link_t *link = &priv->link;
+
+    DEBUG(1, "netwave_close: finishing.\n");
+
+    link->open--;
+    netif_stop_queue(dev);
+
+    return 0;
+}
+
+static struct pcmcia_driver netwave_driver = {
+	.owner		= THIS_MODULE,
+	.drv		= {
+		.name	= "netwave_cs",
+	},
+	.attach		= netwave_attach,
+	.detach		= netwave_detach,
+};
+
+static int __init init_netwave_cs(void)
+{
+	return pcmcia_register_driver(&netwave_driver);
+}
+
+static void __exit exit_netwave_cs(void)
+{
+	pcmcia_unregister_driver(&netwave_driver);
+	BUG_ON(dev_list != NULL);
+}
+
+module_init(init_netwave_cs);
+module_exit(exit_netwave_cs);
+
+/* Set or clear the multicast filter for this adaptor.
+   num_addrs == -1	Promiscuous mode, receive all packets
+   num_addrs == 0	Normal mode, clear multicast list
+   num_addrs > 0	Multicast mode, receive normal and MC packets, and do
+   best-effort filtering.
+ */
+static void set_multicast_list(struct net_device *dev)
+{
+    kio_addr_t iobase = dev->base_addr;
+    netwave_private *priv = netdev_priv(dev);
+    u_char __iomem * ramBase = priv->ramBase;
+    u_char  rcvMode = 0;
+   
+#ifdef PCMCIA_DEBUG
+    if (pc_debug > 2) {
+	static int old;
+	if (old != dev->mc_count) {
+	    old = dev->mc_count;
+	    DEBUG(0, "%s: setting Rx mode to %d addresses.\n",
+		  dev->name, dev->mc_count);
+	}
+    }
+#endif
+	
+    if (dev->mc_count || (dev->flags & IFF_ALLMULTI)) {
+	/* Multicast Mode */
+	rcvMode = rxConfRxEna + rxConfAMP + rxConfBcast;
+    } else if (dev->flags & IFF_PROMISC) {
+	/* Promiscous mode */
+	rcvMode = rxConfRxEna + rxConfPro + rxConfAMP + rxConfBcast;
+    } else {
+	/* Normal mode */
+	rcvMode = rxConfRxEna + rxConfBcast;
+    }
+	
+    /* printk("netwave set_multicast_list: rcvMode to %x\n", rcvMode);*/
+    /* Now set receive mode */
+    wait_WOC(iobase);
+    writeb(NETWAVE_CMD_SRC, ramBase + NETWAVE_EREG_CB + 0);
+    writeb(rcvMode, ramBase + NETWAVE_EREG_CB + 1);
+    writeb(NETWAVE_CMD_EOC, ramBase + NETWAVE_EREG_CB + 2);
+}
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/wireless/orinoco.c b/drivers/net/wireless/orinoco.c
new file mode 100644
index 0000000..a3a3243
--- /dev/null
+++ b/drivers/net/wireless/orinoco.c
@@ -0,0 +1,4243 @@
+/* orinoco.c - (formerly known as dldwd_cs.c and orinoco_cs.c)
+ *
+ * A driver for Hermes or Prism 2 chipset based PCMCIA wireless
+ * adaptors, with Lucent/Agere, Intersil or Symbol firmware.
+ *
+ * Current maintainers (as of 29 September 2003) are:
+ * 	Pavel Roskin <proski AT gnu.org>
+ * and	David Gibson <hermes AT gibson.dropbear.id.au>
+ *
+ * (C) Copyright David Gibson, IBM Corporation 2001-2003.
+ * Copyright (C) 2000 David Gibson, Linuxcare Australia.
+ *	With some help from :
+ * Copyright (C) 2001 Jean Tourrilhes, HP Labs
+ * Copyright (C) 2001 Benjamin Herrenschmidt
+ *
+ * Based on dummy_cs.c 1.27 2000/06/12 21:27:25
+ *
+ * Portions based on wvlan_cs.c 1.0.6, Copyright Andreas Neuhaus <andy
+ * AT fasta.fh-dortmund.de>
+ *      http://www.stud.fh-dortmund.de/~andy/wvlan/
+ *
+ * The contents of this file are subject to the Mozilla Public License
+ * Version 1.1 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License
+ * at http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS"
+ * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+ * the License for the specific language governing rights and
+ * limitations under the License.
+ *
+ * The initial developer of the original code is David A. Hinds
+ * <dahinds AT users.sourceforge.net>.  Portions created by David
+ * A. Hinds are Copyright (C) 1999 David A. Hinds.  All Rights
+ * Reserved.
+ *
+ * Alternatively, the contents of this file may be used under the
+ * terms of the GNU General Public License version 2 (the "GPL"), in
+ * which case the provisions of the GPL are applicable instead of the
+ * above.  If you wish to allow the use of your version of this file
+ * only under the terms of the GPL and not to allow others to use your
+ * version of this file under the MPL, indicate your decision by
+ * deleting the provisions above and replace them with the notice and
+ * other provisions required by the GPL.  If you do not delete the
+ * provisions above, a recipient may use your version of this file
+ * under either the MPL or the GPL.  */
+
+/*
+ * v0.01 -> v0.02 - 21/3/2001 - Jean II
+ *	o Allow to use regular ethX device name instead of dldwdX
+ *	o Warning on IBSS with ESSID=any for firmware 6.06
+ *	o Put proper range.throughput values (optimistic)
+ *	o IWSPY support (IOCTL and stat gather in Rx path)
+ *	o Allow setting frequency in Ad-Hoc mode
+ *	o Disable WEP setting if !has_wep to work on old firmware
+ *	o Fix txpower range
+ *	o Start adding support for Samsung/Compaq firmware
+ *
+ * v0.02 -> v0.03 - 23/3/2001 - Jean II
+ *	o Start adding Symbol support - need to check all that
+ *	o Fix Prism2/Symbol WEP to accept 128 bits keys
+ *	o Add Symbol WEP (add authentication type)
+ *	o Add Prism2/Symbol rate
+ *	o Add PM timeout (holdover duration)
+ *	o Enable "iwconfig eth0 key off" and friends (toggle flags)
+ *	o Enable "iwconfig eth0 power unicast/all" (toggle flags)
+ *	o Try with an Intel card. It report firmware 1.01, behave like
+ *	  an antiquated firmware, however on windows it says 2.00. Yuck !
+ *	o Workaround firmware bug in allocate buffer (Intel 1.01)
+ *	o Finish external renaming to orinoco...
+ *	o Testing with various Wavelan firmwares
+ *
+ * v0.03 -> v0.04 - 30/3/2001 - Jean II
+ *	o Update to Wireless 11 -> add retry limit/lifetime support
+ *	o Tested with a D-Link DWL 650 card, fill in firmware support
+ *	o Warning on Vcc mismatch (D-Link 3.3v card in Lucent 5v only slot)
+ *	o Fixed the Prism2 WEP bugs that I introduced in v0.03 :-(
+ *	  It works on D-Link *only* after a tcpdump. Weird...
+ *	  And still doesn't work on Intel card. Grrrr...
+ *	o Update the mode after a setport3
+ *	o Add preamble setting for Symbol cards (not yet enabled)
+ *	o Don't complain as much about Symbol cards...
+ *
+ * v0.04 -> v0.04b - 22/4/2001 - David Gibson
+ *      o Removed the 'eth' parameter - always use ethXX as the
+ *        interface name instead of dldwdXX.  The other was racy
+ *        anyway.
+ *	o Clean up RID definitions in hermes.h, other cleanups
+ *
+ * v0.04b -> v0.04c - 24/4/2001 - Jean II
+ *	o Tim Hurley <timster AT seiki.bliztech.com> reported a D-Link card
+ *	  with vendor 02 and firmware 0.08. Added in the capabilities...
+ *	o Tested Lucent firmware 7.28, everything works...
+ *
+ * v0.04c -> v0.05 - 3/5/2001 - Benjamin Herrenschmidt
+ *	o Spin-off Pcmcia code. This file is renamed orinoco.c,
+ *	  and orinoco_cs.c now contains only the Pcmcia specific stuff
+ *	o Add Airport driver support on top of orinoco.c (see airport.c)
+ *
+ * v0.05 -> v0.05a - 4/5/2001 - Jean II
+ *	o Revert to old Pcmcia code to fix breakage of Ben's changes...
+ *
+ * v0.05a -> v0.05b - 4/5/2001 - Jean II
+ *	o add module parameter 'ignore_cis_vcc' for D-Link @ 5V
+ *	o D-Link firmware doesn't support multicast. We just print a few
+ *	  error messages, but otherwise everything works...
+ *	o For David : set/getport3 works fine, just upgrade iwpriv...
+ *
+ * v0.05b -> v0.05c - 5/5/2001 - Benjamin Herrenschmidt
+ *	o Adapt airport.c to latest changes in orinoco.c
+ *	o Remove deferred power enabling code
+ *
+ * v0.05c -> v0.05d - 5/5/2001 - Jean II
+ *	o Workaround to SNAP decapsulate frame from Linksys AP
+ *	  original patch from : Dong Liu <dliu AT research.bell-labs.com>
+ *	  (note : the memcmp bug was mine - fixed)
+ *	o Remove set_retry stuff, no firmware support it (bloat--).
+ *
+ * v0.05d -> v0.06 - 25/5/2001 - Jean II
+ *		Original patch from "Hong Lin" <alin AT redhat.com>,
+ *		"Ian Kinner" <ikinner AT redhat.com>
+ *		and "David Smith" <dsmith AT redhat.com>
+ *	o Init of priv->tx_rate_ctrl in firmware specific section.
+ *	o Prism2/Symbol rate, upto should be 0xF and not 0x15. Doh !
+ *	o Spectrum card always need cor_reset (for every reset)
+ *	o Fix cor_reset to not lose bit 7 in the register
+ *	o flush_stale_links to remove zombie Pcmcia instances
+ *	o Ack previous hermes event before reset
+ *		Me (with my little hands)
+ *	o Allow orinoco.c to call cor_reset via priv->card_reset_handler
+ *	o Add priv->need_card_reset to toggle this feature
+ *	o Fix various buglets when setting WEP in Symbol firmware
+ *	  Now, encryption is fully functional on Symbol cards. Youpi !
+ *
+ * v0.06 -> v0.06b - 25/5/2001 - Jean II
+ *	o IBSS on Symbol use port_mode = 4. Please don't ask...
+ *
+ * v0.06b -> v0.06c - 29/5/2001 - Jean II
+ *	o Show first spy address in /proc/net/wireless for IBSS mode as well
+ *
+ * v0.06c -> v0.06d - 6/7/2001 - David Gibson
+ *      o Change a bunch of KERN_INFO messages to KERN_DEBUG, as per Linus'
+ *        wishes to reduce the number of unnecessary messages.
+ *	o Removed bogus message on CRC error.
+ *	o Merged fixes for v0.08 Prism 2 firmware from William Waghorn
+ *	  <willwaghorn AT yahoo.co.uk>
+ *	o Slight cleanup/re-arrangement of firmware detection code.
+ *
+ * v0.06d -> v0.06e - 1/8/2001 - David Gibson
+ *	o Removed some redundant global initializers (orinoco_cs.c).
+ *	o Added some module metadata
+ *
+ * v0.06e -> v0.06f - 14/8/2001 - David Gibson
+ *	o Wording fix to license
+ *	o Added a 'use_alternate_encaps' module parameter for APs which need an
+ *	  oui of 00:00:00.  We really need a better way of handling this, but
+ *	  the module flag is better than nothing for now.
+ *
+ * v0.06f -> v0.07 - 20/8/2001 - David Gibson
+ *	o Removed BAP error retries from hermes_bap_seek().  For Tx we now
+ *	  let the upper layers handle the retry, we retry explicitly in the
+ *	  Rx path, but don't make as much noise about it.
+ *	o Firmware detection cleanups.
+ *
+ * v0.07 -> v0.07a - 1/10/3001 - Jean II
+ *	o Add code to read Symbol firmware revision, inspired by latest code
+ *	  in Spectrum24 by Lee John Keyser-Allen - Thanks Lee !
+ *	o Thanks to Jared Valentine <hidden AT xmission.com> for "providing" me
+ *	  a 3Com card with a recent firmware, fill out Symbol firmware
+ *	  capabilities of latest rev (2.20), as well as older Symbol cards.
+ *	o Disable Power Management in newer Symbol firmware, the API 
+ *	  has changed (documentation needed).
+ *
+ * v0.07a -> v0.08 - 3/10/2001 - David Gibson
+ *	o Fixed a possible buffer overrun found by the Stanford checker (in
+ *	  dldwd_ioctl_setiwencode()).  Can only be called by root anyway, so not
+ *	  a big problem.
+ *	o Turned has_big_wep on for Intersil cards.  That's not true for all of
+ *	  them but we should at least let the capable ones try.
+ *	o Wait for BUSY to clear at the beginning of hermes_bap_seek().  I
+ *	  realized that my assumption that the driver's serialization
+ *	  would prevent the BAP being busy on entry was possibly false, because
+ *	  things other than seeks may make the BAP busy.
+ *	o Use "alternate" (oui 00:00:00) encapsulation by default.
+ *	  Setting use_old_encaps will mimic the old behaviour, but I think we
+ *	  will be able to eliminate this.
+ *	o Don't try to make __initdata const (the version string).  This can't
+ *	  work because of the way the __initdata sectioning works.
+ *	o Added MODULE_LICENSE tags.
+ *	o Support for PLX (transparent PCMCIA->PCI bridge) cards.
+ *	o Changed to using the new type-fascist min/max.
+ *
+ * v0.08 -> v0.08a - 9/10/2001 - David Gibson
+ *	o Inserted some missing acknowledgements/info into the Changelog.
+ *	o Fixed some bugs in the normalization of signal level reporting.
+ *	o Fixed bad bug in WEP key handling on Intersil and Symbol firmware,
+ *	  which led to an instant crash on big-endian machines.
+ *
+ * v0.08a -> v0.08b - 20/11/2001 - David Gibson
+ *	o Lots of cleanup and bugfixes in orinoco_plx.c
+ *	o Cleanup to handling of Tx rate setting.
+ *	o Removed support for old encapsulation method.
+ *	o Removed old "dldwd" names.
+ *	o Split RID constants into a new file hermes_rid.h
+ *	o Renamed RID constants to match linux-wlan-ng and prism2.o
+ *	o Bugfixes in hermes.c
+ *	o Poke the PLX's INTCSR register, so it actually starts
+ *	  generating interrupts.  These cards might actually work now.
+ *	o Update to wireless extensions v12 (Jean II)
+ *	o Support for tallies and inquire command (Jean II)
+ *	o Airport updates for newer PPC kernels (BenH)
+ *
+ * v0.08b -> v0.09 - 21/12/2001 - David Gibson
+ *	o Some new PCI IDs for PLX cards.
+ *	o Removed broken attempt to do ALLMULTI reception.  Just use
+ *	  promiscuous mode instead
+ *	o Preliminary work for list-AP (Jean II)
+ *	o Airport updates from (BenH)
+ *	o Eliminated racy hw_ready stuff
+ *	o Fixed generation of fake events in irq handler.  This should
+ *	  finally kill the EIO problems (Jean II & dgibson)
+ *	o Fixed breakage of bitrate set/get on Agere firmware (Jean II)
+ *
+ * v0.09 -> v0.09a - 2/1/2002 - David Gibson
+ *	o Fixed stupid mistake in multicast list handling, triggering
+ *	  a BUG()
+ *
+ * v0.09a -> v0.09b - 16/1/2002 - David Gibson
+ *	o Fixed even stupider mistake in new interrupt handling, which
+ *	  seriously broke things on big-endian machines.
+ *	o Removed a bunch of redundant includes and exports.
+ *	o Removed a redundant MOD_{INC,DEC}_USE_COUNT pair in airport.c
+ *	o Don't attempt to do hardware level multicast reception on
+ *	  Intersil firmware, just go promisc instead.
+ *	o Typo fixed in hermes_issue_cmd()
+ *	o Eliminated WIRELESS_SPY #ifdefs
+ *	o Status code reported on Tx exceptions
+ *	o Moved netif_wake_queue() from ALLOC interrupts to TX and TXEXC
+ *	  interrupts, which should fix the timeouts we're seeing.
+ *
+ * v0.09b -> v0.10 - 25 Feb 2002 - David Gibson
+ *	o Removed nested structures used for header parsing, so the
+ *	  driver should now work without hackery on ARM
+ *	o Fix for WEP handling on Intersil (Hawk Newton)
+ *	o Eliminated the /proc/hermes/ethXX/regs debugging file.  It
+ *	  was never very useful.
+ *	o Make Rx errors less noisy.
+ *
+ * v0.10 -> v0.11 - 5 Apr 2002 - David Gibson
+ *	o Laid the groundwork in hermes.[ch] for devices which map
+ *	  into PCI memory space rather than IO space.
+ *	o Fixed bug in multicast handling (cleared multicast list when
+ *	  leaving promiscuous mode).
+ *	o Relegated Tx error messages to debug.
+ *	o Cleaned up / corrected handling of allocation lengths.
+ *	o Set OWNSSID in IBSS mode for WinXP interoperability (jimc).
+ *	o Change to using alloc_etherdev() for structure allocations. 
+ *	o Check for and drop undersized packets.
+ *	o Fixed a race in stopping/waking the queue.  This should fix
+ *	  the timeout problems (Pavel Roskin)
+ *	o Reverted to netif_wake_queue() on the ALLOC event.
+ *	o Fixes for recent Symbol firmwares which lack AP density
+ *	  (Pavel Roskin).
+ *
+ * v0.11 -> v0.11a - 29 Apr 2002 - David Gibson
+ *	o Handle different register spacing, necessary for Prism 2.5
+ *	  PCI adaptors (Steve Hill).
+ *	o Cleaned up initialization of card structures in orinoco_cs
+ *	  and airport.  Removed card->priv field.
+ *	o Make response structure optional for hermes_docmd_wait()
+ *	  Pavel Roskin)
+ *	o Added PCI id for Nortel emobility to orinoco_plx.c.
+ *	o Cleanup to handling of Symbol's allocation bug. (Pavel Roskin)
+ *	o Cleanups to firmware capability detection.
+ *	o Arrange for orinoco_pci.c to override firmware detection.
+ *	  We should be able to support the PCI Intersil cards now.
+ *	o Cleanup handling of reset_cor and hard_reset (Pavel Roskin).
+ *	o Remove erroneous use of USER_BAP in the TxExc handler (Jouni
+ *	  Malinen).
+ *	o Makefile changes for better integration into David Hinds
+ *	  pcmcia-cs package.
+ *
+ * v0.11a -> v0.11b - 1 May 2002 - David Gibson
+ *	o Better error reporting in orinoco_plx_init_one()
+ *	o Fixed multiple bad kfree() bugs introduced by the
+ *	  alloc_orinocodev() changes.
+ *
+ * v0.11b -> v0.12 - 19 Jun 2002 - David Gibson
+ *	o Support changing the MAC address.
+ *	o Correct display of Intersil firmware revision numbers.
+ *	o Entirely revised locking scheme.  Should be both simpler and
+ *	   better.
+ *	o Merged some common code in orinoco_plx, orinoco_pci and
+ *	  airport by creating orinoco_default_{open,stop,reset}()
+ *	  which are used as the dev->open, dev->stop, priv->reset
+ *	  callbacks if none are specified when alloc_orinocodev() is
+ *	  called.
+ *	o Removed orinoco_plx_interrupt() and orinoco_pci_interrupt().
+ *	  They didn't do anything.
+ *
+ * v0.12 -> v0.12a - 4 Jul 2002 - David Gibson
+ *	o Some rearrangement of code.
+ *	o Numerous fixups to locking and rest handling, particularly
+ *	  for PCMCIA.
+ *	o This allows open and stop net_device methods to be in
+ *	  orinoco.c now, rather than in the init modules.
+ *	o In orinoco_cs.c link->priv now points to the struct
+ *	  net_device not to the struct orinoco_private.
+ *	o Added a check for undersized SNAP frames, which could cause
+ *	  crashes.
+ *
+ * v0.12a -> v0.12b - 11 Jul 2002 - David Gibson
+ *	o Fix hw->num_init testing code, so num_init is actually
+ *	  incremented.
+ *	o Fix very stupid bug in orinoco_cs which broke compile with
+ *	  CONFIG_SMP.
+ *	o Squashed a warning.
+ *
+ * v0.12b -> v0.12c - 26 Jul 2002 - David Gibson
+ *	o Change to C9X style designated initializers.
+ *	o Add support for 3Com AirConnect PCI.
+ *	o No longer ignore the hard_reset argument to
+ *	  alloc_orinocodev().  Oops.
+ *
+ * v0.12c -> v0.13beta1 - 13 Sep 2002 - David Gibson
+ *	o Revert the broken 0.12* locking scheme and go to a new yet
+ *	  simpler scheme.
+ *	o Do firmware resets only in orinoco_init() and when waking
+ *	  the card from hard sleep.
+ *
+ * v0.13beta1 -> v0.13 - 27 Sep 2002 - David Gibson
+ *	o Re-introduced full resets (via schedule_task()) on Tx
+ *	  timeout.
+ *
+ * v0.13 -> v0.13a - 30 Sep 2002 - David Gibson
+ *	o Minor cleanups to info frame handling.  Add basic support
+ *	  for linkstatus info frames.
+ *	o Include required kernel headers in orinoco.h, to avoid
+ *	  compile problems.
+ *
+ * v0.13a -> v0.13b - 10 Feb 2003 - David Gibson
+ *	o Implemented hard reset for Airport cards
+ *	o Experimental suspend/resume implementation for orinoco_pci
+ *	o Abolished /proc debugging support, replaced with a debugging
+ *	  iwpriv.  Now it's ugly and simple instead of ugly and complex.
+ *	o Bugfix in hermes.c if the firmware returned a record length
+ *	  of 0, we could go clobbering memory.
+ *	o Bugfix in orinoco_stop() - it used to fail if hw_unavailable
+ *	  was set, which was usually true on PCMCIA hot removes.
+ * 	o Track LINKSTATUS messages, silently drop Tx packets before
+ * 	  we are connected (avoids confusing the firmware), and only
+ * 	  give LINKSTATUS printk()s if the status has changed.
+ *
+ * v0.13b -> v0.13c - 11 Mar 2003 - David Gibson
+ *	o Cleanup: use dev instead of priv in various places.
+ *	o Bug fix: Don't ReleaseConfiguration on RESET_PHYSICAL event
+ *	  if we're in the middle of a (driver initiated) hard reset.
+ *	o Bug fix: ETH_ZLEN is supposed to include the header
+ *	  (Dionysus Blazakis & Manish Karir)
+ *	o Convert to using workqueues instead of taskqueues (and
+ *	  backwards compatibility macros for pre 2.5.41 kernels).
+ *	o Drop redundant (I think...) MOD_{INC,DEC}_USE_COUNT in
+ *	  airport.c
+ *	o New orinoco_tmd.c init module from Joerg Dorchain for
+ *	  TMD7160 based PCI to PCMCIA bridges (similar to
+ *	  orinoco_plx.c).
+ *
+ * v0.13c -> v0.13d - 22 Apr 2003 - David Gibson
+ *	o Make hw_unavailable a counter, rather than just a flag, this
+ *	  is necessary to avoid some races (such as a card being
+ *	  removed in the middle of orinoco_reset().
+ *	o Restore Release/RequestConfiguration in the PCMCIA event handler
+ *	  when dealing with a driver initiated hard reset.  This is
+ *	  necessary to prevent hangs due to a spurious interrupt while
+ *	  the reset is in progress.
+ *	o Clear the 802.11 header when transmitting, even though we
+ *	  don't use it.  This fixes a long standing bug on some
+ *	  firmwares, which seem to get confused if that isn't done.
+ *	o Be less eager to de-encapsulate SNAP frames, only do so if
+ *	  the OUI is 00:00:00 or 00:00:f8, leave others alone.  The old
+ *	  behaviour broke CDP (Cisco Discovery Protocol).
+ *	o Use dev instead of priv for free_irq() as well as
+ *	  request_irq() (oops).
+ *	o Attempt to reset rather than giving up if we get too many
+ *	  IRQs.
+ *	o Changed semantics of __orinoco_down() so it can be called
+ *	  safely with hw_unavailable set.  It also now clears the
+ *	  linkstatus (since we're going to have to reassociate).
+ *
+ * v0.13d -> v0.13e - 12 May 2003 - David Gibson
+ *	o Support for post-2.5.68 return values from irq handler.
+ *	o Fixed bug where underlength packets would be double counted
+ *	  in the rx_dropped statistics.
+ *	o Provided a module parameter to suppress linkstatus messages.
+ *
+ * v0.13e -> v0.14alpha1 - 30 Sep 2003 - David Gibson
+ *	o Replaced priv->connected logic with netif_carrier_on/off()
+ *	  calls.
+ *	o Remove has_ibss_any and never set the CREATEIBSS RID when
+ *	  the ESSID is empty.  Too many firmwares break if we do.
+ *	o 2.6 merges: Replace pdev->slot_name with pci_name(), remove
+ *	  __devinitdata from PCI ID tables, use free_netdev().
+ *	o Enabled shared-key authentication for Agere firmware (from
+ *	  Robert J. Moore <Robert.J.Moore AT allanbank.com>
+ *	o Move netif_wake_queue() (back) to the Tx completion from the
+ *	  ALLOC event.  This seems to prevent/mitigate the rolling
+ *	  error -110 problems at least on some Intersil firmwares.
+ *	  Theoretically reduces performance, but I can't measure it.
+ *	  Patch from Andrew Tridgell <tridge AT samba.org>
+ *
+ * v0.14alpha1 -> v0.14alpha2 - 20 Oct 2003 - David Gibson
+ *	o Correctly turn off shared-key authentication when requested
+ *	  (bugfix from Robert J. Moore).
+ *	o Correct airport sleep interfaces for current 2.6 kernels.
+ *	o Add code for key change without disabling/enabling the MAC
+ *	  port.  This is supposed to allow 802.1x to work sanely, but
+ *	  doesn't seem to yet.
+ *
+ * TODO
+ *	o New wireless extensions API (patch from Moustafa
+ *	  Youssef, updated by Jim Carter and Pavel Roskin).
+ *	o Handle de-encapsulation within network layer, provide 802.11
+ *	  headers (patch from Thomas 'Dent' Mirlacher)
+ *	o RF monitor mode support
+ *	o Fix possible races in SPY handling.
+ *	o Disconnect wireless extensions from fundamental configuration.
+ *	o (maybe) Software WEP support (patch from Stano Meduna).
+ *	o (maybe) Use multiple Tx buffers - driver handling queue
+ *	  rather than firmware.
+ */
+
+/* Locking and synchronization:
+ *
+ * The basic principle is that everything is serialized through a
+ * single spinlock, priv->lock.  The lock is used in user, bh and irq
+ * context, so when taken outside hardirq context it should always be
+ * taken with interrupts disabled.  The lock protects both the
+ * hardware and the struct orinoco_private.
+ *
+ * Another flag, priv->hw_unavailable indicates that the hardware is
+ * unavailable for an extended period of time (e.g. suspended, or in
+ * the middle of a hard reset).  This flag is protected by the
+ * spinlock.  All code which touches the hardware should check the
+ * flag after taking the lock, and if it is set, give up on whatever
+ * they are doing and drop the lock again.  The orinoco_lock()
+ * function handles this (it unlocks and returns -EBUSY if
+ * hw_unavailable is non-zero).
+ */
+
+#define DRIVER_NAME "orinoco"
+
+#include <linux/config.h>
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/ptrace.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/timer.h>
+#include <linux/ioport.h>
+#include <linux/netdevice.h>
+#include <linux/if_arp.h>
+#include <linux/etherdevice.h>
+#include <linux/wireless.h>
+
+#include <asm/uaccess.h>
+#include <asm/io.h>
+#include <asm/system.h>
+
+#include "hermes.h"
+#include "hermes_rid.h"
+#include "orinoco.h"
+#include "ieee802_11.h"
+
+/********************************************************************/
+/* Module information                                               */
+/********************************************************************/
+
+MODULE_AUTHOR("Pavel Roskin <proski@gnu.org> & David Gibson <hermes@gibson.dropbear.id.au>");
+MODULE_DESCRIPTION("Driver for Lucent Orinoco, Prism II based and similar wireless cards");
+MODULE_LICENSE("Dual MPL/GPL");
+
+/* Level of debugging. Used in the macros in orinoco.h */
+#ifdef ORINOCO_DEBUG
+int orinoco_debug = ORINOCO_DEBUG;
+module_param(orinoco_debug, int, 0644);
+MODULE_PARM_DESC(orinoco_debug, "Debug level");
+EXPORT_SYMBOL(orinoco_debug);
+#endif
+
+static int suppress_linkstatus; /* = 0 */
+module_param(suppress_linkstatus, bool, 0644);
+MODULE_PARM_DESC(suppress_linkstatus, "Don't log link status changes");
+
+/********************************************************************/
+/* Compile time configuration and compatibility stuff               */
+/********************************************************************/
+
+/* We do this this way to avoid ifdefs in the actual code */
+#ifdef WIRELESS_SPY
+#define SPY_NUMBER(priv)	(priv->spy_number)
+#else
+#define SPY_NUMBER(priv)	0
+#endif /* WIRELESS_SPY */
+
+/********************************************************************/
+/* Internal constants                                               */
+/********************************************************************/
+
+#define ORINOCO_MIN_MTU		256
+#define ORINOCO_MAX_MTU		(IEEE802_11_DATA_LEN - ENCAPS_OVERHEAD)
+
+#define SYMBOL_MAX_VER_LEN	(14)
+#define USER_BAP		0
+#define IRQ_BAP			1
+#define MAX_IRQLOOPS_PER_IRQ	10
+#define MAX_IRQLOOPS_PER_JIFFY	(20000/HZ) /* Based on a guestimate of
+					    * how many events the
+					    * device could
+					    * legitimately generate */
+#define SMALL_KEY_SIZE		5
+#define LARGE_KEY_SIZE		13
+#define TX_NICBUF_SIZE_BUG	1585		/* Bug in Symbol firmware */
+
+#define DUMMY_FID		0xFFFF
+
+/*#define MAX_MULTICAST(priv)	(priv->firmware_type == FIRMWARE_TYPE_AGERE ? \
+  HERMES_MAX_MULTICAST : 0)*/
+#define MAX_MULTICAST(priv)	(HERMES_MAX_MULTICAST)
+
+#define ORINOCO_INTEN	 	(HERMES_EV_RX | HERMES_EV_ALLOC \
+				 | HERMES_EV_TX | HERMES_EV_TXEXC \
+				 | HERMES_EV_WTERR | HERMES_EV_INFO \
+				 | HERMES_EV_INFDROP )
+
+/********************************************************************/
+/* Data tables                                                      */
+/********************************************************************/
+
+/* The frequency of each channel in MHz */
+static const long channel_frequency[] = {
+	2412, 2417, 2422, 2427, 2432, 2437, 2442,
+	2447, 2452, 2457, 2462, 2467, 2472, 2484
+};
+#define NUM_CHANNELS ARRAY_SIZE(channel_frequency)
+
+/* This tables gives the actual meanings of the bitrate IDs returned
+ * by the firmware. */
+static struct {
+	int bitrate; /* in 100s of kilobits */
+	int automatic;
+	u16 agere_txratectrl;
+	u16 intersil_txratectrl;
+} bitrate_table[] = {
+	{110, 1,  3, 15}, /* Entry 0 is the default */
+	{10,  0,  1,  1},
+	{10,  1,  1,  1},
+	{20,  0,  2,  2},
+	{20,  1,  6,  3},
+	{55,  0,  4,  4},
+	{55,  1,  7,  7},
+	{110, 0,  5,  8},
+};
+#define BITRATE_TABLE_SIZE ARRAY_SIZE(bitrate_table)
+
+/********************************************************************/
+/* Data types                                                       */
+/********************************************************************/
+
+struct header_struct {
+	/* 802.3 */
+	u8 dest[ETH_ALEN];
+	u8 src[ETH_ALEN];
+	u16 len;
+	/* 802.2 */
+	u8 dsap;
+	u8 ssap;
+	u8 ctrl;
+	/* SNAP */
+	u8 oui[3];
+	u16 ethertype;
+} __attribute__ ((packed));
+
+/* 802.2 LLC/SNAP header used for Ethernet encapsulation over 802.11 */
+u8 encaps_hdr[] = {0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00};
+
+#define ENCAPS_OVERHEAD		(sizeof(encaps_hdr) + 2)
+
+struct hermes_rx_descriptor {
+	u16 status;
+	u32 time;
+	u8 silence;
+	u8 signal;
+	u8 rate;
+	u8 rxflow;
+	u32 reserved;
+} __attribute__ ((packed));
+
+/********************************************************************/
+/* Function prototypes                                              */
+/********************************************************************/
+
+static int orinoco_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
+static int __orinoco_program_rids(struct net_device *dev);
+static void __orinoco_set_multicast_list(struct net_device *dev);
+static int orinoco_debug_dump_recs(struct net_device *dev);
+
+/********************************************************************/
+/* Internal helper functions                                        */
+/********************************************************************/
+
+static inline void set_port_type(struct orinoco_private *priv)
+{
+	switch (priv->iw_mode) {
+	case IW_MODE_INFRA:
+		priv->port_type = 1;
+		priv->createibss = 0;
+		break;
+	case IW_MODE_ADHOC:
+		if (priv->prefer_port3) {
+			priv->port_type = 3;
+			priv->createibss = 0;
+		} else {
+			priv->port_type = priv->ibss_port;
+			priv->createibss = 1;
+		}
+		break;
+	default:
+		printk(KERN_ERR "%s: Invalid priv->iw_mode in set_port_type()\n",
+		       priv->ndev->name);
+	}
+}
+
+/********************************************************************/
+/* Device methods                                                   */
+/********************************************************************/
+
+static int orinoco_open(struct net_device *dev)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	unsigned long flags;
+	int err;
+
+	if (orinoco_lock(priv, &flags) != 0)
+		return -EBUSY;
+
+	err = __orinoco_up(dev);
+
+	if (! err)
+		priv->open = 1;
+
+	orinoco_unlock(priv, &flags);
+
+	return err;
+}
+
+int orinoco_stop(struct net_device *dev)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	int err = 0;
+
+	/* We mustn't use orinoco_lock() here, because we need to be
+	   able to close the interface even if hw_unavailable is set
+	   (e.g. as we're released after a PC Card removal) */
+	spin_lock_irq(&priv->lock);
+
+	priv->open = 0;
+
+	err = __orinoco_down(dev);
+
+	spin_unlock_irq(&priv->lock);
+
+	return err;
+}
+
+static struct net_device_stats *orinoco_get_stats(struct net_device *dev)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	
+	return &priv->stats;
+}
+
+static struct iw_statistics *orinoco_get_wireless_stats(struct net_device *dev)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	hermes_t *hw = &priv->hw;
+	struct iw_statistics *wstats = &priv->wstats;
+	int err = 0;
+	unsigned long flags;
+
+	if (! netif_device_present(dev)) {
+		printk(KERN_WARNING "%s: get_wireless_stats() called while device not present\n",
+		       dev->name);
+		return NULL; /* FIXME: Can we do better than this? */
+	}
+
+	if (orinoco_lock(priv, &flags) != 0)
+		return NULL;  /* FIXME: Erg, we've been signalled, how
+			       * do we propagate this back up? */
+
+	if (priv->iw_mode == IW_MODE_ADHOC) {
+		memset(&wstats->qual, 0, sizeof(wstats->qual));
+		/* If a spy address is defined, we report stats of the
+		 * first spy address - Jean II */
+		if (SPY_NUMBER(priv)) {
+			wstats->qual.qual = priv->spy_stat[0].qual;
+			wstats->qual.level = priv->spy_stat[0].level;
+			wstats->qual.noise = priv->spy_stat[0].noise;
+			wstats->qual.updated = priv->spy_stat[0].updated;
+		}
+	} else {
+		struct {
+			u16 qual, signal, noise;
+		} __attribute__ ((packed)) cq;
+
+		err = HERMES_READ_RECORD(hw, USER_BAP,
+					 HERMES_RID_COMMSQUALITY, &cq);
+		
+		wstats->qual.qual = (int)le16_to_cpu(cq.qual);
+		wstats->qual.level = (int)le16_to_cpu(cq.signal) - 0x95;
+		wstats->qual.noise = (int)le16_to_cpu(cq.noise) - 0x95;
+		wstats->qual.updated = 7;
+	}
+
+	/* We can't really wait for the tallies inquiry command to
+	 * complete, so we just use the previous results and trigger
+	 * a new tallies inquiry command for next time - Jean II */
+	/* FIXME: We're in user context (I think?), so we should just
+           wait for the tallies to come through */
+	err = hermes_inquire(hw, HERMES_INQ_TALLIES);
+               
+	orinoco_unlock(priv, &flags);
+
+	if (err)
+		return NULL;
+		
+	return wstats;
+}
+
+static void orinoco_set_multicast_list(struct net_device *dev)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	unsigned long flags;
+
+	if (orinoco_lock(priv, &flags) != 0) {
+		printk(KERN_DEBUG "%s: orinoco_set_multicast_list() "
+		       "called when hw_unavailable\n", dev->name);
+		return;
+	}
+
+	__orinoco_set_multicast_list(dev);
+	orinoco_unlock(priv, &flags);
+}
+
+static int orinoco_change_mtu(struct net_device *dev, int new_mtu)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+
+	if ( (new_mtu < ORINOCO_MIN_MTU) || (new_mtu > ORINOCO_MAX_MTU) )
+		return -EINVAL;
+
+	if ( (new_mtu + ENCAPS_OVERHEAD + IEEE802_11_HLEN) >
+	     (priv->nicbuf_size - ETH_HLEN) )
+		return -EINVAL;
+
+	dev->mtu = new_mtu;
+
+	return 0;
+}
+
+/********************************************************************/
+/* Tx path                                                          */
+/********************************************************************/
+
+static int orinoco_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	struct net_device_stats *stats = &priv->stats;
+	hermes_t *hw = &priv->hw;
+	int err = 0;
+	u16 txfid = priv->txfid;
+	char *p;
+	struct ethhdr *eh;
+	int len, data_len, data_off;
+	struct hermes_tx_descriptor desc;
+	unsigned long flags;
+
+	TRACE_ENTER(dev->name);
+
+	if (! netif_running(dev)) {
+		printk(KERN_ERR "%s: Tx on stopped device!\n",
+		       dev->name);
+		TRACE_EXIT(dev->name);
+		return 1;
+	}
+	
+	if (netif_queue_stopped(dev)) {
+		printk(KERN_DEBUG "%s: Tx while transmitter busy!\n", 
+		       dev->name);
+		TRACE_EXIT(dev->name);
+		return 1;
+	}
+	
+	if (orinoco_lock(priv, &flags) != 0) {
+		printk(KERN_ERR "%s: orinoco_xmit() called while hw_unavailable\n",
+		       dev->name);
+		TRACE_EXIT(dev->name);
+		return 1;
+	}
+
+	if (! netif_carrier_ok(dev)) {
+		/* Oops, the firmware hasn't established a connection,
+                   silently drop the packet (this seems to be the
+                   safest approach). */
+		stats->tx_errors++;
+		orinoco_unlock(priv, &flags);
+		dev_kfree_skb(skb);
+		TRACE_EXIT(dev->name);
+		return 0;
+	}
+
+	/* Length of the packet body */
+	/* FIXME: what if the skb is smaller than this? */
+	len = max_t(int,skb->len - ETH_HLEN, ETH_ZLEN - ETH_HLEN);
+
+	eh = (struct ethhdr *)skb->data;
+
+	memset(&desc, 0, sizeof(desc));
+ 	desc.tx_control = cpu_to_le16(HERMES_TXCTRL_TX_OK | HERMES_TXCTRL_TX_EX);
+	err = hermes_bap_pwrite(hw, USER_BAP, &desc, sizeof(desc), txfid, 0);
+	if (err) {
+		if (net_ratelimit())
+			printk(KERN_ERR "%s: Error %d writing Tx descriptor "
+			       "to BAP\n", dev->name, err);
+		stats->tx_errors++;
+		goto fail;
+	}
+
+	/* Clear the 802.11 header and data length fields - some
+	 * firmwares (e.g. Lucent/Agere 8.xx) appear to get confused
+	 * if this isn't done. */
+	hermes_clear_words(hw, HERMES_DATA0,
+			   HERMES_802_3_OFFSET - HERMES_802_11_OFFSET);
+
+	/* Encapsulate Ethernet-II frames */
+	if (ntohs(eh->h_proto) > ETH_DATA_LEN) { /* Ethernet-II frame */
+		struct header_struct hdr;
+		data_len = len;
+		data_off = HERMES_802_3_OFFSET + sizeof(hdr);
+		p = skb->data + ETH_HLEN;
+
+		/* 802.3 header */
+		memcpy(hdr.dest, eh->h_dest, ETH_ALEN);
+		memcpy(hdr.src, eh->h_source, ETH_ALEN);
+		hdr.len = htons(data_len + ENCAPS_OVERHEAD);
+		
+		/* 802.2 header */
+		memcpy(&hdr.dsap, &encaps_hdr, sizeof(encaps_hdr));
+			
+		hdr.ethertype = eh->h_proto;
+		err  = hermes_bap_pwrite(hw, USER_BAP, &hdr, sizeof(hdr),
+					 txfid, HERMES_802_3_OFFSET);
+		if (err) {
+			if (net_ratelimit())
+				printk(KERN_ERR "%s: Error %d writing packet "
+				       "header to BAP\n", dev->name, err);
+			stats->tx_errors++;
+			goto fail;
+		}
+	} else { /* IEEE 802.3 frame */
+		data_len = len + ETH_HLEN;
+		data_off = HERMES_802_3_OFFSET;
+		p = skb->data;
+	}
+
+	/* Round up for odd length packets */
+	err = hermes_bap_pwrite(hw, USER_BAP, p, ALIGN(data_len, 2),
+				txfid, data_off);
+	if (err) {
+		printk(KERN_ERR "%s: Error %d writing packet to BAP\n",
+		       dev->name, err);
+		stats->tx_errors++;
+		goto fail;
+	}
+
+	/* Finally, we actually initiate the send */
+	netif_stop_queue(dev);
+
+	err = hermes_docmd_wait(hw, HERMES_CMD_TX | HERMES_CMD_RECL,
+				txfid, NULL);
+	if (err) {
+		netif_start_queue(dev);
+		printk(KERN_ERR "%s: Error %d transmitting packet\n",
+		       dev->name, err);
+		stats->tx_errors++;
+		goto fail;
+	}
+
+	dev->trans_start = jiffies;
+	stats->tx_bytes += data_off + data_len;
+
+	orinoco_unlock(priv, &flags);
+
+	dev_kfree_skb(skb);
+
+	TRACE_EXIT(dev->name);
+
+	return 0;
+ fail:
+	TRACE_EXIT(dev->name);
+
+	orinoco_unlock(priv, &flags);
+	return err;
+}
+
+static void __orinoco_ev_alloc(struct net_device *dev, hermes_t *hw)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	u16 fid = hermes_read_regn(hw, ALLOCFID);
+
+	if (fid != priv->txfid) {
+		if (fid != DUMMY_FID)
+			printk(KERN_WARNING "%s: Allocate event on unexpected fid (%04X)\n",
+			       dev->name, fid);
+		return;
+	}
+
+	hermes_write_regn(hw, ALLOCFID, DUMMY_FID);
+}
+
+static void __orinoco_ev_tx(struct net_device *dev, hermes_t *hw)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	struct net_device_stats *stats = &priv->stats;
+
+	stats->tx_packets++;
+
+	netif_wake_queue(dev);
+
+	hermes_write_regn(hw, TXCOMPLFID, DUMMY_FID);
+}
+
+static void __orinoco_ev_txexc(struct net_device *dev, hermes_t *hw)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	struct net_device_stats *stats = &priv->stats;
+	u16 fid = hermes_read_regn(hw, TXCOMPLFID);
+	struct hermes_tx_descriptor desc;
+	int err = 0;
+
+	if (fid == DUMMY_FID)
+		return; /* Nothing's really happened */
+
+	err = hermes_bap_pread(hw, IRQ_BAP, &desc, sizeof(desc), fid, 0);
+	if (err) {
+		printk(KERN_WARNING "%s: Unable to read descriptor on Tx error "
+		       "(FID=%04X error %d)\n",
+		       dev->name, fid, err);
+	} else {
+		DEBUG(1, "%s: Tx error, status %d\n",
+		      dev->name, le16_to_cpu(desc.status));
+	}
+	
+	stats->tx_errors++;
+
+	netif_wake_queue(dev);
+	hermes_write_regn(hw, TXCOMPLFID, DUMMY_FID);
+}
+
+static void orinoco_tx_timeout(struct net_device *dev)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	struct net_device_stats *stats = &priv->stats;
+	struct hermes *hw = &priv->hw;
+
+	printk(KERN_WARNING "%s: Tx timeout! "
+	       "ALLOCFID=%04x, TXCOMPLFID=%04x, EVSTAT=%04x\n",
+	       dev->name, hermes_read_regn(hw, ALLOCFID),
+	       hermes_read_regn(hw, TXCOMPLFID), hermes_read_regn(hw, EVSTAT));
+
+	stats->tx_errors++;
+
+	schedule_work(&priv->reset_work);
+}
+
+/********************************************************************/
+/* Rx path (data frames)                                            */
+/********************************************************************/
+
+/* Does the frame have a SNAP header indicating it should be
+ * de-encapsulated to Ethernet-II? */
+static inline int is_ethersnap(void *_hdr)
+{
+	u8 *hdr = _hdr;
+
+	/* We de-encapsulate all packets which, a) have SNAP headers
+	 * (i.e. SSAP=DSAP=0xaa and CTRL=0x3 in the 802.2 LLC header
+	 * and where b) the OUI of the SNAP header is 00:00:00 or
+	 * 00:00:f8 - we need both because different APs appear to use
+	 * different OUIs for some reason */
+	return (memcmp(hdr, &encaps_hdr, 5) == 0)
+		&& ( (hdr[5] == 0x00) || (hdr[5] == 0xf8) );
+}
+
+static inline void orinoco_spy_gather(struct net_device *dev, u_char *mac,
+				      int level, int noise)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	int i;
+
+	/* Gather wireless spy statistics: for each packet, compare the
+	 * source address with out list, and if match, get the stats... */
+	for (i = 0; i < priv->spy_number; i++)
+		if (!memcmp(mac, priv->spy_address[i], ETH_ALEN)) {
+			priv->spy_stat[i].level = level - 0x95;
+			priv->spy_stat[i].noise = noise - 0x95;
+			priv->spy_stat[i].qual = (level > noise) ? (level - noise) : 0;
+			priv->spy_stat[i].updated = 7;
+		}
+}
+
+static void orinoco_stat_gather(struct net_device *dev,
+				struct sk_buff *skb,
+				struct hermes_rx_descriptor *desc)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+
+	/* Using spy support with lots of Rx packets, like in an
+	 * infrastructure (AP), will really slow down everything, because
+	 * the MAC address must be compared to each entry of the spy list.
+	 * If the user really asks for it (set some address in the
+	 * spy list), we do it, but he will pay the price.
+	 * Note that to get here, you need both WIRELESS_SPY
+	 * compiled in AND some addresses in the list !!!
+	 */
+	/* Note : gcc will optimise the whole section away if
+	 * WIRELESS_SPY is not defined... - Jean II */
+	if (SPY_NUMBER(priv)) {
+		orinoco_spy_gather(dev, skb->mac.raw + ETH_ALEN,
+				   desc->signal, desc->silence);
+	}
+}
+
+static void __orinoco_ev_rx(struct net_device *dev, hermes_t *hw)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	struct net_device_stats *stats = &priv->stats;
+	struct iw_statistics *wstats = &priv->wstats;
+	struct sk_buff *skb = NULL;
+	u16 rxfid, status;
+	int length, data_len, data_off;
+	char *p;
+	struct hermes_rx_descriptor desc;
+	struct header_struct hdr;
+	struct ethhdr *eh;
+	int err;
+
+	rxfid = hermes_read_regn(hw, RXFID);
+
+	err = hermes_bap_pread(hw, IRQ_BAP, &desc, sizeof(desc),
+			       rxfid, 0);
+	if (err) {
+		printk(KERN_ERR "%s: error %d reading Rx descriptor. "
+		       "Frame dropped.\n", dev->name, err);
+		stats->rx_errors++;
+		goto drop;
+	}
+
+	status = le16_to_cpu(desc.status);
+
+	if (status & HERMES_RXSTAT_ERR) {
+		if (status & HERMES_RXSTAT_UNDECRYPTABLE) {
+			wstats->discard.code++;
+			DEBUG(1, "%s: Undecryptable frame on Rx. Frame dropped.\n",
+			       dev->name);
+		} else {
+			stats->rx_crc_errors++;
+			DEBUG(1, "%s: Bad CRC on Rx. Frame dropped.\n", dev->name);
+		}
+		stats->rx_errors++;
+		goto drop;
+	}
+
+	/* For now we ignore the 802.11 header completely, assuming
+           that the card's firmware has handled anything vital */
+
+	err = hermes_bap_pread(hw, IRQ_BAP, &hdr, sizeof(hdr),
+			       rxfid, HERMES_802_3_OFFSET);
+	if (err) {
+		printk(KERN_ERR "%s: error %d reading frame header. "
+		       "Frame dropped.\n", dev->name, err);
+		stats->rx_errors++;
+		goto drop;
+	}
+
+	length = ntohs(hdr.len);
+	
+	/* Sanity checks */
+	if (length < 3) { /* No for even an 802.2 LLC header */
+		/* At least on Symbol firmware with PCF we get quite a
+                   lot of these legitimately - Poll frames with no
+                   data. */
+		stats->rx_dropped++;
+		goto drop;
+	}
+	if (length > IEEE802_11_DATA_LEN) {
+		printk(KERN_WARNING "%s: Oversized frame received (%d bytes)\n",
+		       dev->name, length);
+		stats->rx_length_errors++;
+		stats->rx_errors++;
+		goto drop;
+	}
+
+	/* We need space for the packet data itself, plus an ethernet
+	   header, plus 2 bytes so we can align the IP header on a
+	   32bit boundary, plus 1 byte so we can read in odd length
+	   packets from the card, which has an IO granularity of 16
+	   bits */  
+	skb = dev_alloc_skb(length+ETH_HLEN+2+1);
+	if (!skb) {
+		printk(KERN_WARNING "%s: Can't allocate skb for Rx\n",
+		       dev->name);
+		goto drop;
+	}
+
+	skb_reserve(skb, 2); /* This way the IP header is aligned */
+
+	/* Handle decapsulation
+	 * In most cases, the firmware tell us about SNAP frames.
+	 * For some reason, the SNAP frames sent by LinkSys APs
+	 * are not properly recognised by most firmwares.
+	 * So, check ourselves */
+	if (((status & HERMES_RXSTAT_MSGTYPE) == HERMES_RXSTAT_1042) ||
+	    ((status & HERMES_RXSTAT_MSGTYPE) == HERMES_RXSTAT_TUNNEL) ||
+	    is_ethersnap(&hdr)) {
+		/* These indicate a SNAP within 802.2 LLC within
+		   802.11 frame which we'll need to de-encapsulate to
+		   the original EthernetII frame. */
+
+		if (length < ENCAPS_OVERHEAD) { /* No room for full LLC+SNAP */
+			stats->rx_length_errors++;
+			goto drop;
+		}
+
+		/* Remove SNAP header, reconstruct EthernetII frame */
+		data_len = length - ENCAPS_OVERHEAD;
+		data_off = HERMES_802_3_OFFSET + sizeof(hdr);
+
+		eh = (struct ethhdr *)skb_put(skb, ETH_HLEN);
+
+		memcpy(eh, &hdr, 2 * ETH_ALEN);
+		eh->h_proto = hdr.ethertype;
+	} else {
+		/* All other cases indicate a genuine 802.3 frame.  No
+		   decapsulation needed.  We just throw the whole
+		   thing in, and hope the protocol layer can deal with
+		   it as 802.3 */
+		data_len = length;
+		data_off = HERMES_802_3_OFFSET;
+		/* FIXME: we re-read from the card data we already read here */
+	}
+
+	p = skb_put(skb, data_len);
+	err = hermes_bap_pread(hw, IRQ_BAP, p, ALIGN(data_len, 2),
+			       rxfid, data_off);
+	if (err) {
+		printk(KERN_ERR "%s: error %d reading frame. "
+		       "Frame dropped.\n", dev->name, err);
+		stats->rx_errors++;
+		goto drop;
+	}
+
+	dev->last_rx = jiffies;
+	skb->dev = dev;
+	skb->protocol = eth_type_trans(skb, dev);
+	skb->ip_summed = CHECKSUM_NONE;
+	
+	/* Process the wireless stats if needed */
+	orinoco_stat_gather(dev, skb, &desc);
+
+	/* Pass the packet to the networking stack */
+	netif_rx(skb);
+	stats->rx_packets++;
+	stats->rx_bytes += length;
+
+	return;
+
+ drop:	
+	stats->rx_dropped++;
+
+	if (skb)
+		dev_kfree_skb_irq(skb);
+	return;
+}
+
+/********************************************************************/
+/* Rx path (info frames)                                            */
+/********************************************************************/
+
+static void print_linkstatus(struct net_device *dev, u16 status)
+{
+	char * s;
+
+	if (suppress_linkstatus)
+		return;
+
+	switch (status) {
+	case HERMES_LINKSTATUS_NOT_CONNECTED:
+		s = "Not Connected";
+		break;
+	case HERMES_LINKSTATUS_CONNECTED:
+		s = "Connected";
+		break;
+	case HERMES_LINKSTATUS_DISCONNECTED:
+		s = "Disconnected";
+		break;
+	case HERMES_LINKSTATUS_AP_CHANGE:
+		s = "AP Changed";
+		break;
+	case HERMES_LINKSTATUS_AP_OUT_OF_RANGE:
+		s = "AP Out of Range";
+		break;
+	case HERMES_LINKSTATUS_AP_IN_RANGE:
+		s = "AP In Range";
+		break;
+	case HERMES_LINKSTATUS_ASSOC_FAILED:
+		s = "Association Failed";
+		break;
+	default:
+		s = "UNKNOWN";
+	}
+	
+	printk(KERN_INFO "%s: New link status: %s (%04x)\n",
+	       dev->name, s, status);
+}
+
+static void __orinoco_ev_info(struct net_device *dev, hermes_t *hw)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	u16 infofid;
+	struct {
+		u16 len;
+		u16 type;
+	} __attribute__ ((packed)) info;
+	int len, type;
+	int err;
+
+	/* This is an answer to an INQUIRE command that we did earlier,
+	 * or an information "event" generated by the card
+	 * The controller return to us a pseudo frame containing
+	 * the information in question - Jean II */
+	infofid = hermes_read_regn(hw, INFOFID);
+
+	/* Read the info frame header - don't try too hard */
+	err = hermes_bap_pread(hw, IRQ_BAP, &info, sizeof(info),
+			       infofid, 0);
+	if (err) {
+		printk(KERN_ERR "%s: error %d reading info frame. "
+		       "Frame dropped.\n", dev->name, err);
+		return;
+	}
+	
+	len = HERMES_RECLEN_TO_BYTES(le16_to_cpu(info.len));
+	type = le16_to_cpu(info.type);
+
+	switch (type) {
+	case HERMES_INQ_TALLIES: {
+		struct hermes_tallies_frame tallies;
+		struct iw_statistics *wstats = &priv->wstats;
+		
+		if (len > sizeof(tallies)) {
+			printk(KERN_WARNING "%s: Tallies frame too long (%d bytes)\n",
+			       dev->name, len);
+			len = sizeof(tallies);
+		}
+		
+		/* Read directly the data (no seek) */
+		hermes_read_words(hw, HERMES_DATA1, (void *) &tallies,
+				  len / 2); /* FIXME: blech! */
+		
+		/* Increment our various counters */
+		/* wstats->discard.nwid - no wrong BSSID stuff */
+		wstats->discard.code +=
+			le16_to_cpu(tallies.RxWEPUndecryptable);
+		if (len == sizeof(tallies))  
+			wstats->discard.code +=
+				le16_to_cpu(tallies.RxDiscards_WEPICVError) +
+				le16_to_cpu(tallies.RxDiscards_WEPExcluded);
+		wstats->discard.misc +=
+			le16_to_cpu(tallies.TxDiscardsWrongSA);
+		wstats->discard.fragment +=
+			le16_to_cpu(tallies.RxMsgInBadMsgFragments);
+		wstats->discard.retries +=
+			le16_to_cpu(tallies.TxRetryLimitExceeded);
+		/* wstats->miss.beacon - no match */
+	}
+	break;
+	case HERMES_INQ_LINKSTATUS: {
+		struct hermes_linkstatus linkstatus;
+		u16 newstatus;
+		int connected;
+
+		if (len != sizeof(linkstatus)) {
+			printk(KERN_WARNING "%s: Unexpected size for linkstatus frame (%d bytes)\n",
+			       dev->name, len);
+			break;
+		}
+
+		hermes_read_words(hw, HERMES_DATA1, (void *) &linkstatus,
+				  len / 2);
+		newstatus = le16_to_cpu(linkstatus.linkstatus);
+
+		connected = (newstatus == HERMES_LINKSTATUS_CONNECTED)
+			|| (newstatus == HERMES_LINKSTATUS_AP_CHANGE)
+			|| (newstatus == HERMES_LINKSTATUS_AP_IN_RANGE);
+
+		if (connected)
+			netif_carrier_on(dev);
+		else
+			netif_carrier_off(dev);
+
+		if (newstatus != priv->last_linkstatus)
+			print_linkstatus(dev, newstatus);
+
+		priv->last_linkstatus = newstatus;
+	}
+	break;
+	default:
+		printk(KERN_DEBUG "%s: Unknown information frame received: "
+		       "type 0x%04x, length %d\n", dev->name, type, len);
+		/* We don't actually do anything about it */
+		break;
+	}
+}
+
+static void __orinoco_ev_infdrop(struct net_device *dev, hermes_t *hw)
+{
+	if (net_ratelimit())
+		printk(KERN_DEBUG "%s: Information frame lost.\n", dev->name);
+}
+
+/********************************************************************/
+/* Internal hardware control routines                               */
+/********************************************************************/
+
+int __orinoco_up(struct net_device *dev)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	struct hermes *hw = &priv->hw;
+	int err;
+
+	err = __orinoco_program_rids(dev);
+	if (err) {
+		printk(KERN_ERR "%s: Error %d configuring card\n",
+		       dev->name, err);
+		return err;
+	}
+
+	/* Fire things up again */
+	hermes_set_irqmask(hw, ORINOCO_INTEN);
+	err = hermes_enable_port(hw, 0);
+	if (err) {
+		printk(KERN_ERR "%s: Error %d enabling MAC port\n",
+		       dev->name, err);
+		return err;
+	}
+
+	netif_start_queue(dev);
+
+	return 0;
+}
+
+int __orinoco_down(struct net_device *dev)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	struct hermes *hw = &priv->hw;
+	int err;
+
+	netif_stop_queue(dev);
+
+	if (! priv->hw_unavailable) {
+		if (! priv->broken_disableport) {
+			err = hermes_disable_port(hw, 0);
+			if (err) {
+				/* Some firmwares (e.g. Intersil 1.3.x) seem
+				 * to have problems disabling the port, oh
+				 * well, too bad. */
+				printk(KERN_WARNING "%s: Error %d disabling MAC port\n",
+				       dev->name, err);
+				priv->broken_disableport = 1;
+			}
+		}
+		hermes_set_irqmask(hw, 0);
+		hermes_write_regn(hw, EVACK, 0xffff);
+	}
+	
+	/* firmware will have to reassociate */
+	netif_carrier_off(dev);
+	priv->last_linkstatus = 0xffff;
+
+	return 0;
+}
+
+int orinoco_reinit_firmware(struct net_device *dev)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	struct hermes *hw = &priv->hw;
+	int err;
+
+	err = hermes_init(hw);
+	if (err)
+		return err;
+
+	err = hermes_allocate(hw, priv->nicbuf_size, &priv->txfid);
+	if (err == -EIO) {
+		/* Try workaround for old Symbol firmware bug */
+		printk(KERN_WARNING "%s: firmware ALLOC bug detected "
+		       "(old Symbol firmware?). Trying to work around... ",
+		       dev->name);
+		
+		priv->nicbuf_size = TX_NICBUF_SIZE_BUG;
+		err = hermes_allocate(hw, priv->nicbuf_size, &priv->txfid);
+		if (err)
+			printk("failed!\n");
+		else
+			printk("ok.\n");
+	}
+
+	return err;
+}
+
+static int __orinoco_hw_set_bitrate(struct orinoco_private *priv)
+{
+	hermes_t *hw = &priv->hw;
+	int err = 0;
+
+	if (priv->bitratemode >= BITRATE_TABLE_SIZE) {
+		printk(KERN_ERR "%s: BUG: Invalid bitrate mode %d\n",
+		       priv->ndev->name, priv->bitratemode);
+		return -EINVAL;
+	}
+
+	switch (priv->firmware_type) {
+	case FIRMWARE_TYPE_AGERE:
+		err = hermes_write_wordrec(hw, USER_BAP,
+					   HERMES_RID_CNFTXRATECONTROL,
+					   bitrate_table[priv->bitratemode].agere_txratectrl);
+		break;
+	case FIRMWARE_TYPE_INTERSIL:
+	case FIRMWARE_TYPE_SYMBOL:
+		err = hermes_write_wordrec(hw, USER_BAP,
+					   HERMES_RID_CNFTXRATECONTROL,
+					   bitrate_table[priv->bitratemode].intersil_txratectrl);
+		break;
+	default:
+		BUG();
+	}
+
+	return err;
+}
+
+/* Change the WEP keys and/or the current keys.  Can be called
+ * either from __orinoco_hw_setup_wep() or directly from
+ * orinoco_ioctl_setiwencode().  In the later case the association
+ * with the AP is not broken (if the firmware can handle it),
+ * which is needed for 802.1x implementations. */
+static int __orinoco_hw_setup_wepkeys(struct orinoco_private *priv)
+{
+	hermes_t *hw = &priv->hw;
+	int err = 0;
+
+	switch (priv->firmware_type) {
+	case FIRMWARE_TYPE_AGERE:
+		err = HERMES_WRITE_RECORD(hw, USER_BAP,
+					  HERMES_RID_CNFWEPKEYS_AGERE,
+					  &priv->keys);
+		if (err)
+			return err;
+		err = hermes_write_wordrec(hw, USER_BAP,
+					   HERMES_RID_CNFTXKEY_AGERE,
+					   priv->tx_key);
+		if (err)
+			return err;
+		break;
+	case FIRMWARE_TYPE_INTERSIL:
+	case FIRMWARE_TYPE_SYMBOL:
+		{
+			int keylen;
+			int i;
+
+			/* Force uniform key length to work around firmware bugs */
+			keylen = le16_to_cpu(priv->keys[priv->tx_key].len);
+			
+			if (keylen > LARGE_KEY_SIZE) {
+				printk(KERN_ERR "%s: BUG: Key %d has oversize length %d.\n",
+				       priv->ndev->name, priv->tx_key, keylen);
+				return -E2BIG;
+			}
+
+			/* Write all 4 keys */
+			for(i = 0; i < ORINOCO_MAX_KEYS; i++) {
+				err = hermes_write_ltv(hw, USER_BAP,
+						       HERMES_RID_CNFDEFAULTKEY0 + i,
+						       HERMES_BYTES_TO_RECLEN(keylen),
+						       priv->keys[i].data);
+				if (err)
+					return err;
+			}
+
+			/* Write the index of the key used in transmission */
+			err = hermes_write_wordrec(hw, USER_BAP,
+						   HERMES_RID_CNFWEPDEFAULTKEYID,
+						   priv->tx_key);
+			if (err)
+				return err;
+		}
+		break;
+	}
+
+	return 0;
+}
+
+static int __orinoco_hw_setup_wep(struct orinoco_private *priv)
+{
+	hermes_t *hw = &priv->hw;
+	int err = 0;
+	int master_wep_flag;
+	int auth_flag;
+
+	if (priv->wep_on)
+		__orinoco_hw_setup_wepkeys(priv);
+
+	if (priv->wep_restrict)
+		auth_flag = HERMES_AUTH_SHARED_KEY;
+	else
+		auth_flag = HERMES_AUTH_OPEN;
+
+	switch (priv->firmware_type) {
+	case FIRMWARE_TYPE_AGERE: /* Agere style WEP */
+		if (priv->wep_on) {
+			/* Enable the shared-key authentication. */
+			err = hermes_write_wordrec(hw, USER_BAP,
+						   HERMES_RID_CNFAUTHENTICATION_AGERE,
+						   auth_flag);
+		}
+		err = hermes_write_wordrec(hw, USER_BAP,
+					   HERMES_RID_CNFWEPENABLED_AGERE,
+					   priv->wep_on);
+		if (err)
+			return err;
+		break;
+
+	case FIRMWARE_TYPE_INTERSIL: /* Intersil style WEP */
+	case FIRMWARE_TYPE_SYMBOL: /* Symbol style WEP */
+		if (priv->wep_on) {
+			if (priv->wep_restrict ||
+			    (priv->firmware_type == FIRMWARE_TYPE_SYMBOL))
+				master_wep_flag = HERMES_WEP_PRIVACY_INVOKED |
+						  HERMES_WEP_EXCL_UNENCRYPTED;
+			else
+				master_wep_flag = HERMES_WEP_PRIVACY_INVOKED;
+
+			err = hermes_write_wordrec(hw, USER_BAP,
+						   HERMES_RID_CNFAUTHENTICATION,
+						   auth_flag);
+			if (err)
+				return err;
+		} else
+			master_wep_flag = 0;
+
+		if (priv->iw_mode == IW_MODE_MONITOR)
+			master_wep_flag |= HERMES_WEP_HOST_DECRYPT;
+
+		/* Master WEP setting : on/off */
+		err = hermes_write_wordrec(hw, USER_BAP,
+					   HERMES_RID_CNFWEPFLAGS_INTERSIL,
+					   master_wep_flag);
+		if (err)
+			return err;	
+
+		break;
+	}
+
+	return 0;
+}
+
+static int __orinoco_program_rids(struct net_device *dev)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	hermes_t *hw = &priv->hw;
+	int err;
+	struct hermes_idstring idbuf;
+
+	/* Set the MAC address */
+	err = hermes_write_ltv(hw, USER_BAP, HERMES_RID_CNFOWNMACADDR,
+			       HERMES_BYTES_TO_RECLEN(ETH_ALEN), dev->dev_addr);
+	if (err) {
+		printk(KERN_ERR "%s: Error %d setting MAC address\n",
+		       dev->name, err);
+		return err;
+	}
+
+	/* Set up the link mode */
+	err = hermes_write_wordrec(hw, USER_BAP, HERMES_RID_CNFPORTTYPE,
+				   priv->port_type);
+	if (err) {
+		printk(KERN_ERR "%s: Error %d setting port type\n",
+		       dev->name, err);
+		return err;
+	}
+	/* Set the channel/frequency */
+	if (priv->channel == 0) {
+		printk(KERN_DEBUG "%s: Channel is 0 in __orinoco_program_rids()\n", dev->name);
+		if (priv->createibss)
+			priv->channel = 10;
+	}
+	err = hermes_write_wordrec(hw, USER_BAP, HERMES_RID_CNFOWNCHANNEL,
+				   priv->channel);
+	if (err) {
+		printk(KERN_ERR "%s: Error %d setting channel\n",
+		       dev->name, err);
+		return err;
+	}
+
+	if (priv->has_ibss) {
+		u16 createibss;
+
+		if ((strlen(priv->desired_essid) == 0) && (priv->createibss)) {
+			printk(KERN_WARNING "%s: This firmware requires an "
+			       "ESSID in IBSS-Ad-Hoc mode.\n", dev->name);
+			/* With wvlan_cs, in this case, we would crash.
+			 * hopefully, this driver will behave better...
+			 * Jean II */
+			createibss = 0;
+		} else {
+			createibss = priv->createibss;
+		}
+		
+		err = hermes_write_wordrec(hw, USER_BAP,
+					   HERMES_RID_CNFCREATEIBSS,
+					   createibss);
+		if (err) {
+			printk(KERN_ERR "%s: Error %d setting CREATEIBSS\n",
+			       dev->name, err);
+			return err;
+		}
+	}
+
+	/* Set the desired ESSID */
+	idbuf.len = cpu_to_le16(strlen(priv->desired_essid));
+	memcpy(&idbuf.val, priv->desired_essid, sizeof(idbuf.val));
+	/* WinXP wants partner to configure OWNSSID even in IBSS mode. (jimc) */
+	err = hermes_write_ltv(hw, USER_BAP, HERMES_RID_CNFOWNSSID,
+			       HERMES_BYTES_TO_RECLEN(strlen(priv->desired_essid)+2),
+			       &idbuf);
+	if (err) {
+		printk(KERN_ERR "%s: Error %d setting OWNSSID\n",
+		       dev->name, err);
+		return err;
+	}
+	err = hermes_write_ltv(hw, USER_BAP, HERMES_RID_CNFDESIREDSSID,
+			       HERMES_BYTES_TO_RECLEN(strlen(priv->desired_essid)+2),
+			       &idbuf);
+	if (err) {
+		printk(KERN_ERR "%s: Error %d setting DESIREDSSID\n",
+		       dev->name, err);
+		return err;
+	}
+
+	/* Set the station name */
+	idbuf.len = cpu_to_le16(strlen(priv->nick));
+	memcpy(&idbuf.val, priv->nick, sizeof(idbuf.val));
+	err = hermes_write_ltv(hw, USER_BAP, HERMES_RID_CNFOWNNAME,
+			       HERMES_BYTES_TO_RECLEN(strlen(priv->nick)+2),
+			       &idbuf);
+	if (err) {
+		printk(KERN_ERR "%s: Error %d setting nickname\n",
+		       dev->name, err);
+		return err;
+	}
+
+	/* Set AP density */
+	if (priv->has_sensitivity) {
+		err = hermes_write_wordrec(hw, USER_BAP,
+					   HERMES_RID_CNFSYSTEMSCALE,
+					   priv->ap_density);
+		if (err) {
+			printk(KERN_WARNING "%s: Error %d setting SYSTEMSCALE.  "
+			       "Disabling sensitivity control\n",
+			       dev->name, err);
+
+			priv->has_sensitivity = 0;
+		}
+	}
+
+	/* Set RTS threshold */
+	err = hermes_write_wordrec(hw, USER_BAP, HERMES_RID_CNFRTSTHRESHOLD,
+				   priv->rts_thresh);
+	if (err) {
+		printk(KERN_ERR "%s: Error %d setting RTS threshold\n",
+		       dev->name, err);
+		return err;
+	}
+
+	/* Set fragmentation threshold or MWO robustness */
+	if (priv->has_mwo)
+		err = hermes_write_wordrec(hw, USER_BAP,
+					   HERMES_RID_CNFMWOROBUST_AGERE,
+					   priv->mwo_robust);
+	else
+		err = hermes_write_wordrec(hw, USER_BAP,
+					   HERMES_RID_CNFFRAGMENTATIONTHRESHOLD,
+					   priv->frag_thresh);
+	if (err) {
+		printk(KERN_ERR "%s: Error %d setting fragmentation\n",
+		       dev->name, err);
+		return err;
+	}
+
+	/* Set bitrate */
+	err = __orinoco_hw_set_bitrate(priv);
+	if (err) {
+		printk(KERN_ERR "%s: Error %d setting bitrate\n",
+		       dev->name, err);
+		return err;
+	}
+
+	/* Set power management */
+	if (priv->has_pm) {
+		err = hermes_write_wordrec(hw, USER_BAP,
+					   HERMES_RID_CNFPMENABLED,
+					   priv->pm_on);
+		if (err) {
+			printk(KERN_ERR "%s: Error %d setting up PM\n",
+			       dev->name, err);
+			return err;
+		}
+
+		err = hermes_write_wordrec(hw, USER_BAP,
+					   HERMES_RID_CNFMULTICASTRECEIVE,
+					   priv->pm_mcast);
+		if (err) {
+			printk(KERN_ERR "%s: Error %d setting up PM\n",
+			       dev->name, err);
+			return err;
+		}
+		err = hermes_write_wordrec(hw, USER_BAP,
+					   HERMES_RID_CNFMAXSLEEPDURATION,
+					   priv->pm_period);
+		if (err) {
+			printk(KERN_ERR "%s: Error %d setting up PM\n",
+			       dev->name, err);
+			return err;
+		}
+		err = hermes_write_wordrec(hw, USER_BAP,
+					   HERMES_RID_CNFPMHOLDOVERDURATION,
+					   priv->pm_timeout);
+		if (err) {
+			printk(KERN_ERR "%s: Error %d setting up PM\n",
+			       dev->name, err);
+			return err;
+		}
+	}
+
+	/* Set preamble - only for Symbol so far... */
+	if (priv->has_preamble) {
+		err = hermes_write_wordrec(hw, USER_BAP,
+					   HERMES_RID_CNFPREAMBLE_SYMBOL,
+					   priv->preamble);
+		if (err) {
+			printk(KERN_ERR "%s: Error %d setting preamble\n",
+			       dev->name, err);
+			return err;
+		}
+	}
+
+	/* Set up encryption */
+	if (priv->has_wep) {
+		err = __orinoco_hw_setup_wep(priv);
+		if (err) {
+			printk(KERN_ERR "%s: Error %d activating WEP\n",
+			       dev->name, err);
+			return err;
+		}
+	}
+
+	/* Set promiscuity / multicast*/
+	priv->promiscuous = 0;
+	priv->mc_count = 0;
+	__orinoco_set_multicast_list(dev); /* FIXME: what about the xmit_lock */
+
+	return 0;
+}
+
+/* FIXME: return int? */
+static void
+__orinoco_set_multicast_list(struct net_device *dev)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	hermes_t *hw = &priv->hw;
+	int err = 0;
+	int promisc, mc_count;
+
+	/* The Hermes doesn't seem to have an allmulti mode, so we go
+	 * into promiscuous mode and let the upper levels deal. */
+	if ( (dev->flags & IFF_PROMISC) || (dev->flags & IFF_ALLMULTI) ||
+	     (dev->mc_count > MAX_MULTICAST(priv)) ) {
+		promisc = 1;
+		mc_count = 0;
+	} else {
+		promisc = 0;
+		mc_count = dev->mc_count;
+	}
+
+	if (promisc != priv->promiscuous) {
+		err = hermes_write_wordrec(hw, USER_BAP,
+					   HERMES_RID_CNFPROMISCUOUSMODE,
+					   promisc);
+		if (err) {
+			printk(KERN_ERR "%s: Error %d setting PROMISCUOUSMODE to 1.\n",
+			       dev->name, err);
+		} else 
+			priv->promiscuous = promisc;
+	}
+
+	if (! promisc && (mc_count || priv->mc_count) ) {
+		struct dev_mc_list *p = dev->mc_list;
+		struct hermes_multicast mclist;
+		int i;
+
+		for (i = 0; i < mc_count; i++) {
+			/* paranoia: is list shorter than mc_count? */
+			BUG_ON(! p);
+			/* paranoia: bad address size in list? */
+			BUG_ON(p->dmi_addrlen != ETH_ALEN);
+			
+			memcpy(mclist.addr[i], p->dmi_addr, ETH_ALEN);
+			p = p->next;
+		}
+		
+		if (p)
+			printk(KERN_WARNING "%s: Multicast list is "
+			       "longer than mc_count\n", dev->name);
+
+		err = hermes_write_ltv(hw, USER_BAP, HERMES_RID_CNFGROUPADDRESSES,
+				       HERMES_BYTES_TO_RECLEN(priv->mc_count * ETH_ALEN),
+				       &mclist);
+		if (err)
+			printk(KERN_ERR "%s: Error %d setting multicast list.\n",
+			       dev->name, err);
+		else
+			priv->mc_count = mc_count;
+	}
+
+	/* Since we can set the promiscuous flag when it wasn't asked
+	   for, make sure the net_device knows about it. */
+	if (priv->promiscuous)
+		dev->flags |= IFF_PROMISC;
+	else
+		dev->flags &= ~IFF_PROMISC;
+}
+
+static int orinoco_reconfigure(struct net_device *dev)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	struct hermes *hw = &priv->hw;
+	unsigned long flags;
+	int err = 0;
+
+	if (priv->broken_disableport) {
+		schedule_work(&priv->reset_work);
+		return 0;
+	}
+
+	if (orinoco_lock(priv, &flags) != 0)
+		return -EBUSY;
+		
+	err = hermes_disable_port(hw, 0);
+	if (err) {
+		printk(KERN_WARNING "%s: Unable to disable port while reconfiguring card\n",
+		       dev->name);
+		priv->broken_disableport = 1;
+		goto out;
+	}
+
+	err = __orinoco_program_rids(dev);
+	if (err) {
+		printk(KERN_WARNING "%s: Unable to reconfigure card\n",
+		       dev->name);
+		goto out;
+	}
+
+	err = hermes_enable_port(hw, 0);
+	if (err) {
+		printk(KERN_WARNING "%s: Unable to enable port while reconfiguring card\n",
+		       dev->name);
+		goto out;
+	}
+
+ out:
+	if (err) {
+		printk(KERN_WARNING "%s: Resetting instead...\n", dev->name);
+		schedule_work(&priv->reset_work);
+		err = 0;
+	}
+
+	orinoco_unlock(priv, &flags);
+	return err;
+
+}
+
+/* This must be called from user context, without locks held - use
+ * schedule_work() */
+static void orinoco_reset(struct net_device *dev)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	struct hermes *hw = &priv->hw;
+	int err = 0;
+	unsigned long flags;
+
+	if (orinoco_lock(priv, &flags) != 0)
+		/* When the hardware becomes available again, whatever
+		 * detects that is responsible for re-initializing
+		 * it. So no need for anything further */
+		return;
+
+	netif_stop_queue(dev);
+
+	/* Shut off interrupts.  Depending on what state the hardware
+	 * is in, this might not work, but we'll try anyway */
+	hermes_set_irqmask(hw, 0);
+	hermes_write_regn(hw, EVACK, 0xffff);
+
+	priv->hw_unavailable++;
+	priv->last_linkstatus = 0xffff; /* firmware will have to reassociate */
+	netif_carrier_off(dev);
+
+	orinoco_unlock(priv, &flags);
+
+	if (priv->hard_reset)
+		err = (*priv->hard_reset)(priv);
+	if (err) {
+		printk(KERN_ERR "%s: orinoco_reset: Error %d "
+		       "performing  hard reset\n", dev->name, err);
+		/* FIXME: shutdown of some sort */
+		return;
+	}
+
+	err = orinoco_reinit_firmware(dev);
+	if (err) {
+		printk(KERN_ERR "%s: orinoco_reset: Error %d re-initializing firmware\n",
+		       dev->name, err);
+		return;
+	}
+
+	spin_lock_irq(&priv->lock); /* This has to be called from user context */
+
+	priv->hw_unavailable--;
+
+	/* priv->open or priv->hw_unavailable might have changed while
+	 * we dropped the lock */
+	if (priv->open && (! priv->hw_unavailable)) {
+		err = __orinoco_up(dev);
+		if (err) {
+			printk(KERN_ERR "%s: orinoco_reset: Error %d reenabling card\n",
+			       dev->name, err);
+		} else
+			dev->trans_start = jiffies;
+	}
+
+	spin_unlock_irq(&priv->lock);
+
+	return;
+}
+
+/********************************************************************/
+/* Interrupt handler                                                */
+/********************************************************************/
+
+static void __orinoco_ev_tick(struct net_device *dev, hermes_t *hw)
+{
+	printk(KERN_DEBUG "%s: TICK\n", dev->name);
+}
+
+static void __orinoco_ev_wterr(struct net_device *dev, hermes_t *hw)
+{
+	/* This seems to happen a fair bit under load, but ignoring it
+	   seems to work fine...*/
+	printk(KERN_DEBUG "%s: MAC controller error (WTERR). Ignoring.\n",
+	       dev->name);
+}
+
+irqreturn_t orinoco_interrupt(int irq, void *dev_id, struct pt_regs *regs)
+{
+	struct net_device *dev = (struct net_device *)dev_id;
+	struct orinoco_private *priv = netdev_priv(dev);
+	hermes_t *hw = &priv->hw;
+	int count = MAX_IRQLOOPS_PER_IRQ;
+	u16 evstat, events;
+	/* These are used to detect a runaway interrupt situation */
+	/* If we get more than MAX_IRQLOOPS_PER_JIFFY iterations in a jiffy,
+	 * we panic and shut down the hardware */
+	static int last_irq_jiffy = 0; /* jiffies value the last time
+					* we were called */
+	static int loops_this_jiffy = 0;
+	unsigned long flags;
+
+	if (orinoco_lock(priv, &flags) != 0) {
+		/* If hw is unavailable - we don't know if the irq was
+		 * for us or not */
+		return IRQ_HANDLED;
+	}
+
+	evstat = hermes_read_regn(hw, EVSTAT);
+	events = evstat & hw->inten;
+	if (! events) {
+		orinoco_unlock(priv, &flags);
+		return IRQ_NONE;
+	}
+	
+	if (jiffies != last_irq_jiffy)
+		loops_this_jiffy = 0;
+	last_irq_jiffy = jiffies;
+
+	while (events && count--) {
+		if (++loops_this_jiffy > MAX_IRQLOOPS_PER_JIFFY) {
+			printk(KERN_WARNING "%s: IRQ handler is looping too "
+			       "much! Resetting.\n", dev->name);
+			/* Disable interrupts for now */
+			hermes_set_irqmask(hw, 0);
+			schedule_work(&priv->reset_work);
+			break;
+		}
+
+		/* Check the card hasn't been removed */
+		if (! hermes_present(hw)) {
+			DEBUG(0, "orinoco_interrupt(): card removed\n");
+			break;
+		}
+
+		if (events & HERMES_EV_TICK)
+			__orinoco_ev_tick(dev, hw);
+		if (events & HERMES_EV_WTERR)
+			__orinoco_ev_wterr(dev, hw);
+		if (events & HERMES_EV_INFDROP)
+			__orinoco_ev_infdrop(dev, hw);
+		if (events & HERMES_EV_INFO)
+			__orinoco_ev_info(dev, hw);
+		if (events & HERMES_EV_RX)
+			__orinoco_ev_rx(dev, hw);
+		if (events & HERMES_EV_TXEXC)
+			__orinoco_ev_txexc(dev, hw);
+		if (events & HERMES_EV_TX)
+			__orinoco_ev_tx(dev, hw);
+		if (events & HERMES_EV_ALLOC)
+			__orinoco_ev_alloc(dev, hw);
+		
+		hermes_write_regn(hw, EVACK, events);
+
+		evstat = hermes_read_regn(hw, EVSTAT);
+		events = evstat & hw->inten;
+	};
+
+	orinoco_unlock(priv, &flags);
+	return IRQ_HANDLED;
+}
+
+/********************************************************************/
+/* Initialization                                                   */
+/********************************************************************/
+
+struct comp_id {
+	u16 id, variant, major, minor;
+} __attribute__ ((packed));
+
+static inline fwtype_t determine_firmware_type(struct comp_id *nic_id)
+{
+	if (nic_id->id < 0x8000)
+		return FIRMWARE_TYPE_AGERE;
+	else if (nic_id->id == 0x8000 && nic_id->major == 0)
+		return FIRMWARE_TYPE_SYMBOL;
+	else
+		return FIRMWARE_TYPE_INTERSIL;
+}
+
+/* Set priv->firmware type, determine firmware properties */
+static int determine_firmware(struct net_device *dev)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	hermes_t *hw = &priv->hw;
+	int err;
+	struct comp_id nic_id, sta_id;
+	unsigned int firmver;
+	char tmp[SYMBOL_MAX_VER_LEN+1];
+
+	/* Get the hardware version */
+	err = HERMES_READ_RECORD(hw, USER_BAP, HERMES_RID_NICID, &nic_id);
+	if (err) {
+		printk(KERN_ERR "%s: Cannot read hardware identity: error %d\n",
+		       dev->name, err);
+		return err;
+	}
+
+	le16_to_cpus(&nic_id.id);
+	le16_to_cpus(&nic_id.variant);
+	le16_to_cpus(&nic_id.major);
+	le16_to_cpus(&nic_id.minor);
+	printk(KERN_DEBUG "%s: Hardware identity %04x:%04x:%04x:%04x\n",
+	       dev->name, nic_id.id, nic_id.variant,
+	       nic_id.major, nic_id.minor);
+
+	priv->firmware_type = determine_firmware_type(&nic_id);
+
+	/* Get the firmware version */
+	err = HERMES_READ_RECORD(hw, USER_BAP, HERMES_RID_STAID, &sta_id);
+	if (err) {
+		printk(KERN_ERR "%s: Cannot read station identity: error %d\n",
+		       dev->name, err);
+		return err;
+	}
+
+	le16_to_cpus(&sta_id.id);
+	le16_to_cpus(&sta_id.variant);
+	le16_to_cpus(&sta_id.major);
+	le16_to_cpus(&sta_id.minor);
+	printk(KERN_DEBUG "%s: Station identity  %04x:%04x:%04x:%04x\n",
+	       dev->name, sta_id.id, sta_id.variant,
+	       sta_id.major, sta_id.minor);
+
+	switch (sta_id.id) {
+	case 0x15:
+		printk(KERN_ERR "%s: Primary firmware is active\n",
+		       dev->name);
+		return -ENODEV;
+	case 0x14b:
+		printk(KERN_ERR "%s: Tertiary firmware is active\n",
+		       dev->name);
+		return -ENODEV;
+	case 0x1f:	/* Intersil, Agere, Symbol Spectrum24 */
+	case 0x21:	/* Symbol Spectrum24 Trilogy */
+		break;
+	default:
+		printk(KERN_NOTICE "%s: Unknown station ID, please report\n",
+		       dev->name);
+		break;
+	}
+
+	/* Default capabilities */
+	priv->has_sensitivity = 1;
+	priv->has_mwo = 0;
+	priv->has_preamble = 0;
+	priv->has_port3 = 1;
+	priv->has_ibss = 1;
+	priv->has_wep = 0;
+	priv->has_big_wep = 0;
+
+	/* Determine capabilities from the firmware version */
+	switch (priv->firmware_type) {
+	case FIRMWARE_TYPE_AGERE:
+		/* Lucent Wavelan IEEE, Lucent Orinoco, Cabletron RoamAbout,
+		   ELSA, Melco, HP, IBM, Dell 1150, Compaq 110/210 */
+		snprintf(priv->fw_name, sizeof(priv->fw_name) - 1,
+			 "Lucent/Agere %d.%02d", sta_id.major, sta_id.minor);
+
+		firmver = ((unsigned long)sta_id.major << 16) | sta_id.minor;
+
+		priv->has_ibss = (firmver >= 0x60006);
+		priv->has_wep = (firmver >= 0x40020);
+		priv->has_big_wep = 1; /* FIXME: this is wrong - how do we tell
+					  Gold cards from the others? */
+		priv->has_mwo = (firmver >= 0x60000);
+		priv->has_pm = (firmver >= 0x40020); /* Don't work in 7.52 ? */
+		priv->ibss_port = 1;
+
+		/* Tested with Agere firmware :
+		 *	1.16 ; 4.08 ; 4.52 ; 6.04 ; 6.16 ; 7.28 => Jean II
+		 * Tested CableTron firmware : 4.32 => Anton */
+		break;
+	case FIRMWARE_TYPE_SYMBOL:
+		/* Symbol , 3Com AirConnect, Intel, Ericsson WLAN */
+		/* Intel MAC : 00:02:B3:* */
+		/* 3Com MAC : 00:50:DA:* */
+		memset(tmp, 0, sizeof(tmp));
+		/* Get the Symbol firmware version */
+		err = hermes_read_ltv(hw, USER_BAP,
+				      HERMES_RID_SECONDARYVERSION_SYMBOL,
+				      SYMBOL_MAX_VER_LEN, NULL, &tmp);
+		if (err) {
+			printk(KERN_WARNING
+			       "%s: Error %d reading Symbol firmware info. Wildly guessing capabilities...\n",
+			       dev->name, err);
+			firmver = 0;
+			tmp[0] = '\0';
+		} else {
+			/* The firmware revision is a string, the format is
+			 * something like : "V2.20-01".
+			 * Quick and dirty parsing... - Jean II
+			 */
+			firmver = ((tmp[1] - '0') << 16) | ((tmp[3] - '0') << 12)
+				| ((tmp[4] - '0') << 8) | ((tmp[6] - '0') << 4)
+				| (tmp[7] - '0');
+
+			tmp[SYMBOL_MAX_VER_LEN] = '\0';
+		}
+
+		snprintf(priv->fw_name, sizeof(priv->fw_name) - 1,
+			 "Symbol %s", tmp);
+
+		priv->has_ibss = (firmver >= 0x20000);
+		priv->has_wep = (firmver >= 0x15012);
+		priv->has_big_wep = (firmver >= 0x20000);
+		priv->has_pm = (firmver >= 0x20000 && firmver < 0x22000) || 
+			       (firmver >= 0x29000 && firmver < 0x30000) ||
+			       firmver >= 0x31000;
+		priv->has_preamble = (firmver >= 0x20000);
+		priv->ibss_port = 4;
+		/* Tested with Intel firmware : 0x20015 => Jean II */
+		/* Tested with 3Com firmware : 0x15012 & 0x22001 => Jean II */
+		break;
+	case FIRMWARE_TYPE_INTERSIL:
+		/* D-Link, Linksys, Adtron, ZoomAir, and many others...
+		 * Samsung, Compaq 100/200 and Proxim are slightly
+		 * different and less well tested */
+		/* D-Link MAC : 00:40:05:* */
+		/* Addtron MAC : 00:90:D1:* */
+		snprintf(priv->fw_name, sizeof(priv->fw_name) - 1,
+			 "Intersil %d.%d.%d", sta_id.major, sta_id.minor,
+			 sta_id.variant);
+
+		firmver = ((unsigned long)sta_id.major << 16) |
+			((unsigned long)sta_id.minor << 8) | sta_id.variant;
+
+		priv->has_ibss = (firmver >= 0x000700); /* FIXME */
+		priv->has_big_wep = priv->has_wep = (firmver >= 0x000800);
+		priv->has_pm = (firmver >= 0x000700);
+
+		if (firmver >= 0x000800)
+			priv->ibss_port = 0;
+		else {
+			printk(KERN_NOTICE "%s: Intersil firmware earlier "
+			       "than v0.8.x - several features not supported\n",
+			       dev->name);
+			priv->ibss_port = 1;
+		}
+		break;
+	}
+	printk(KERN_DEBUG "%s: Firmware determined as %s\n", dev->name,
+	       priv->fw_name);
+
+	return 0;
+}
+
+static int orinoco_init(struct net_device *dev)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	hermes_t *hw = &priv->hw;
+	int err = 0;
+	struct hermes_idstring nickbuf;
+	u16 reclen;
+	int len;
+
+	TRACE_ENTER(dev->name);
+
+	/* No need to lock, the hw_unavailable flag is already set in
+	 * alloc_orinocodev() */
+	priv->nicbuf_size = IEEE802_11_FRAME_LEN + ETH_HLEN;
+
+	/* Initialize the firmware */
+	err = hermes_init(hw);
+	if (err != 0) {
+		printk(KERN_ERR "%s: failed to initialize firmware (err = %d)\n",
+		       dev->name, err);
+		goto out;
+	}
+
+	err = determine_firmware(dev);
+	if (err != 0) {
+		printk(KERN_ERR "%s: Incompatible firmware, aborting\n",
+		       dev->name);
+		goto out;
+	}
+
+	if (priv->has_port3)
+		printk(KERN_DEBUG "%s: Ad-hoc demo mode supported\n", dev->name);
+	if (priv->has_ibss)
+		printk(KERN_DEBUG "%s: IEEE standard IBSS ad-hoc mode supported\n",
+		       dev->name);
+	if (priv->has_wep) {
+		printk(KERN_DEBUG "%s: WEP supported, ", dev->name);
+		if (priv->has_big_wep)
+			printk("104-bit key\n");
+		else
+			printk("40-bit key\n");
+	}
+
+	/* Get the MAC address */
+	err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CNFOWNMACADDR,
+			      ETH_ALEN, NULL, dev->dev_addr);
+	if (err) {
+		printk(KERN_WARNING "%s: failed to read MAC address!\n",
+		       dev->name);
+		goto out;
+	}
+
+	printk(KERN_DEBUG "%s: MAC address %02X:%02X:%02X:%02X:%02X:%02X\n",
+	       dev->name, dev->dev_addr[0], dev->dev_addr[1],
+	       dev->dev_addr[2], dev->dev_addr[3], dev->dev_addr[4],
+	       dev->dev_addr[5]);
+
+	/* Get the station name */
+	err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CNFOWNNAME,
+			      sizeof(nickbuf), &reclen, &nickbuf);
+	if (err) {
+		printk(KERN_ERR "%s: failed to read station name\n",
+		       dev->name);
+		goto out;
+	}
+	if (nickbuf.len)
+		len = min(IW_ESSID_MAX_SIZE, (int)le16_to_cpu(nickbuf.len));
+	else
+		len = min(IW_ESSID_MAX_SIZE, 2 * reclen);
+	memcpy(priv->nick, &nickbuf.val, len);
+	priv->nick[len] = '\0';
+
+	printk(KERN_DEBUG "%s: Station name \"%s\"\n", dev->name, priv->nick);
+
+	/* Get allowed channels */
+	err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_CHANNELLIST,
+				  &priv->channel_mask);
+	if (err) {
+		printk(KERN_ERR "%s: failed to read channel list!\n",
+		       dev->name);
+		goto out;
+	}
+
+	/* Get initial AP density */
+	err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_CNFSYSTEMSCALE,
+				  &priv->ap_density);
+	if (err || priv->ap_density < 1 || priv->ap_density > 3) {
+		priv->has_sensitivity = 0;
+	}
+
+	/* Get initial RTS threshold */
+	err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_CNFRTSTHRESHOLD,
+				  &priv->rts_thresh);
+	if (err) {
+		printk(KERN_ERR "%s: failed to read RTS threshold!\n",
+		       dev->name);
+		goto out;
+	}
+
+	/* Get initial fragmentation settings */
+	if (priv->has_mwo)
+		err = hermes_read_wordrec(hw, USER_BAP,
+					  HERMES_RID_CNFMWOROBUST_AGERE,
+					  &priv->mwo_robust);
+	else
+		err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_CNFFRAGMENTATIONTHRESHOLD,
+					  &priv->frag_thresh);
+	if (err) {
+		printk(KERN_ERR "%s: failed to read fragmentation settings!\n",
+		       dev->name);
+		goto out;
+	}
+
+	/* Power management setup */
+	if (priv->has_pm) {
+		priv->pm_on = 0;
+		priv->pm_mcast = 1;
+		err = hermes_read_wordrec(hw, USER_BAP,
+					  HERMES_RID_CNFMAXSLEEPDURATION,
+					  &priv->pm_period);
+		if (err) {
+			printk(KERN_ERR "%s: failed to read power management period!\n",
+			       dev->name);
+			goto out;
+		}
+		err = hermes_read_wordrec(hw, USER_BAP,
+					  HERMES_RID_CNFPMHOLDOVERDURATION,
+					  &priv->pm_timeout);
+		if (err) {
+			printk(KERN_ERR "%s: failed to read power management timeout!\n",
+			       dev->name);
+			goto out;
+		}
+	}
+
+	/* Preamble setup */
+	if (priv->has_preamble) {
+		err = hermes_read_wordrec(hw, USER_BAP,
+					  HERMES_RID_CNFPREAMBLE_SYMBOL,
+					  &priv->preamble);
+		if (err)
+			goto out;
+	}
+		
+	/* Set up the default configuration */
+	priv->iw_mode = IW_MODE_INFRA;
+	/* By default use IEEE/IBSS ad-hoc mode if we have it */
+	priv->prefer_port3 = priv->has_port3 && (! priv->has_ibss);
+	set_port_type(priv);
+	priv->channel = 10; /* default channel, more-or-less arbitrary */
+
+	priv->promiscuous = 0;
+	priv->wep_on = 0;
+	priv->tx_key = 0;
+
+	err = hermes_allocate(hw, priv->nicbuf_size, &priv->txfid);
+	if (err == -EIO) {
+		/* Try workaround for old Symbol firmware bug */
+		printk(KERN_WARNING "%s: firmware ALLOC bug detected "
+		       "(old Symbol firmware?). Trying to work around... ",
+		       dev->name);
+		
+		priv->nicbuf_size = TX_NICBUF_SIZE_BUG;
+		err = hermes_allocate(hw, priv->nicbuf_size, &priv->txfid);
+		if (err)
+			printk("failed!\n");
+		else
+			printk("ok.\n");
+	}
+	if (err) {
+		printk("%s: Error %d allocating Tx buffer\n", dev->name, err);
+		goto out;
+	}
+
+	/* Make the hardware available, as long as it hasn't been
+	 * removed elsewhere (e.g. by PCMCIA hot unplug) */
+	spin_lock_irq(&priv->lock);
+	priv->hw_unavailable--;
+	spin_unlock_irq(&priv->lock);
+
+	printk(KERN_DEBUG "%s: ready\n", dev->name);
+
+ out:
+	TRACE_EXIT(dev->name);
+	return err;
+}
+
+struct net_device *alloc_orinocodev(int sizeof_card,
+				    int (*hard_reset)(struct orinoco_private *))
+{
+	struct net_device *dev;
+	struct orinoco_private *priv;
+
+	dev = alloc_etherdev(sizeof(struct orinoco_private) + sizeof_card);
+	if (! dev)
+		return NULL;
+	priv = netdev_priv(dev);
+	priv->ndev = dev;
+	if (sizeof_card)
+		priv->card = (void *)((unsigned long)netdev_priv(dev)
+				      + sizeof(struct orinoco_private));
+	else
+		priv->card = NULL;
+
+	/* Setup / override net_device fields */
+	dev->init = orinoco_init;
+	dev->hard_start_xmit = orinoco_xmit;
+	dev->tx_timeout = orinoco_tx_timeout;
+	dev->watchdog_timeo = HZ; /* 1 second timeout */
+	dev->get_stats = orinoco_get_stats;
+	dev->get_wireless_stats = orinoco_get_wireless_stats;
+	dev->do_ioctl = orinoco_ioctl;
+	dev->change_mtu = orinoco_change_mtu;
+	dev->set_multicast_list = orinoco_set_multicast_list;
+	/* we use the default eth_mac_addr for setting the MAC addr */
+
+	/* Set up default callbacks */
+	dev->open = orinoco_open;
+	dev->stop = orinoco_stop;
+	priv->hard_reset = hard_reset;
+
+	spin_lock_init(&priv->lock);
+	priv->open = 0;
+	priv->hw_unavailable = 1; /* orinoco_init() must clear this
+				   * before anything else touches the
+				   * hardware */
+	INIT_WORK(&priv->reset_work, (void (*)(void *))orinoco_reset, dev);
+
+	netif_carrier_off(dev);
+	priv->last_linkstatus = 0xffff;
+
+	return dev;
+
+}
+
+void free_orinocodev(struct net_device *dev)
+{
+	free_netdev(dev);
+}
+
+/********************************************************************/
+/* Wireless extensions                                              */
+/********************************************************************/
+
+static int orinoco_hw_get_bssid(struct orinoco_private *priv,
+				char buf[ETH_ALEN])
+{
+	hermes_t *hw = &priv->hw;
+	int err = 0;
+	unsigned long flags;
+
+	if (orinoco_lock(priv, &flags) != 0)
+		return -EBUSY;
+
+	err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CURRENTBSSID,
+			      ETH_ALEN, NULL, buf);
+
+	orinoco_unlock(priv, &flags);
+
+	return err;
+}
+
+static int orinoco_hw_get_essid(struct orinoco_private *priv, int *active,
+				char buf[IW_ESSID_MAX_SIZE+1])
+{
+	hermes_t *hw = &priv->hw;
+	int err = 0;
+	struct hermes_idstring essidbuf;
+	char *p = (char *)(&essidbuf.val);
+	int len;
+	unsigned long flags;
+
+	if (orinoco_lock(priv, &flags) != 0)
+		return -EBUSY;
+
+	if (strlen(priv->desired_essid) > 0) {
+		/* We read the desired SSID from the hardware rather
+		   than from priv->desired_essid, just in case the
+		   firmware is allowed to change it on us. I'm not
+		   sure about this */
+		/* My guess is that the OWNSSID should always be whatever
+		 * we set to the card, whereas CURRENT_SSID is the one that
+		 * may change... - Jean II */
+		u16 rid;
+
+		*active = 1;
+
+		rid = (priv->port_type == 3) ? HERMES_RID_CNFOWNSSID :
+			HERMES_RID_CNFDESIREDSSID;
+		
+		err = hermes_read_ltv(hw, USER_BAP, rid, sizeof(essidbuf),
+				      NULL, &essidbuf);
+		if (err)
+			goto fail_unlock;
+	} else {
+		*active = 0;
+
+		err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CURRENTSSID,
+				      sizeof(essidbuf), NULL, &essidbuf);
+		if (err)
+			goto fail_unlock;
+	}
+
+	len = le16_to_cpu(essidbuf.len);
+
+	memset(buf, 0, IW_ESSID_MAX_SIZE+1);
+	memcpy(buf, p, len);
+	buf[len] = '\0';
+
+ fail_unlock:
+	orinoco_unlock(priv, &flags);
+
+	return err;       
+}
+
+static long orinoco_hw_get_freq(struct orinoco_private *priv)
+{
+	
+	hermes_t *hw = &priv->hw;
+	int err = 0;
+	u16 channel;
+	long freq = 0;
+	unsigned long flags;
+
+	if (orinoco_lock(priv, &flags) != 0)
+		return -EBUSY;
+	
+	err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_CURRENTCHANNEL, &channel);
+	if (err)
+		goto out;
+
+	/* Intersil firmware 1.3.5 returns 0 when the interface is down */
+	if (channel == 0) {
+		err = -EBUSY;
+		goto out;
+	}
+
+	if ( (channel < 1) || (channel > NUM_CHANNELS) ) {
+		printk(KERN_WARNING "%s: Channel out of range (%d)!\n",
+		       priv->ndev->name, channel);
+		err = -EBUSY;
+		goto out;
+
+	}
+	freq = channel_frequency[channel-1] * 100000;
+
+ out:
+	orinoco_unlock(priv, &flags);
+
+	if (err > 0)
+		err = -EBUSY;
+	return err ? err : freq;
+}
+
+static int orinoco_hw_get_bitratelist(struct orinoco_private *priv,
+				      int *numrates, s32 *rates, int max)
+{
+	hermes_t *hw = &priv->hw;
+	struct hermes_idstring list;
+	unsigned char *p = (unsigned char *)&list.val;
+	int err = 0;
+	int num;
+	int i;
+	unsigned long flags;
+
+	if (orinoco_lock(priv, &flags) != 0)
+		return -EBUSY;
+
+	err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_SUPPORTEDDATARATES,
+			      sizeof(list), NULL, &list);
+	orinoco_unlock(priv, &flags);
+
+	if (err)
+		return err;
+	
+	num = le16_to_cpu(list.len);
+	*numrates = num;
+	num = min(num, max);
+
+	for (i = 0; i < num; i++) {
+		rates[i] = (p[i] & 0x7f) * 500000; /* convert to bps */
+	}
+
+	return 0;
+}
+
+static int orinoco_ioctl_getiwrange(struct net_device *dev, struct iw_point *rrq)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	int err = 0;
+	int mode;
+	struct iw_range range;
+	int numrates;
+	int i, k;
+	unsigned long flags;
+
+	TRACE_ENTER(dev->name);
+
+	if (!access_ok(VERIFY_WRITE, rrq->pointer, sizeof(range)))
+		return -EFAULT;
+
+	rrq->length = sizeof(range);
+
+	if (orinoco_lock(priv, &flags) != 0)
+		return -EBUSY;
+
+	mode = priv->iw_mode;
+	orinoco_unlock(priv, &flags);
+
+	memset(&range, 0, sizeof(range));
+
+	/* Much of this shamelessly taken from wvlan_cs.c. No idea
+	 * what it all means -dgibson */
+	range.we_version_compiled = WIRELESS_EXT;
+	range.we_version_source = 11;
+
+	range.min_nwid = range.max_nwid = 0; /* We don't use nwids */
+
+	/* Set available channels/frequencies */
+	range.num_channels = NUM_CHANNELS;
+	k = 0;
+	for (i = 0; i < NUM_CHANNELS; i++) {
+		if (priv->channel_mask & (1 << i)) {
+			range.freq[k].i = i + 1;
+			range.freq[k].m = channel_frequency[i] * 100000;
+			range.freq[k].e = 1;
+			k++;
+		}
+		
+		if (k >= IW_MAX_FREQUENCIES)
+			break;
+	}
+	range.num_frequency = k;
+
+	range.sensitivity = 3;
+
+	if ((mode == IW_MODE_ADHOC) && (priv->spy_number == 0)){
+		/* Quality stats meaningless in ad-hoc mode */
+		range.max_qual.qual = 0;
+		range.max_qual.level = 0;
+		range.max_qual.noise = 0;
+		range.avg_qual.qual = 0;
+		range.avg_qual.level = 0;
+		range.avg_qual.noise = 0;
+	} else {
+		range.max_qual.qual = 0x8b - 0x2f;
+		range.max_qual.level = 0x2f - 0x95 - 1;
+		range.max_qual.noise = 0x2f - 0x95 - 1;
+		/* Need to get better values */
+		range.avg_qual.qual = 0x24;
+		range.avg_qual.level = 0xC2;
+		range.avg_qual.noise = 0x9E;
+	}
+
+	err = orinoco_hw_get_bitratelist(priv, &numrates,
+					 range.bitrate, IW_MAX_BITRATES);
+	if (err)
+		return err;
+	range.num_bitrates = numrates;
+	
+	/* Set an indication of the max TCP throughput in bit/s that we can
+	 * expect using this interface. May be use for QoS stuff...
+	 * Jean II */
+	if(numrates > 2)
+		range.throughput = 5 * 1000 * 1000;	/* ~5 Mb/s */
+	else
+		range.throughput = 1.5 * 1000 * 1000;	/* ~1.5 Mb/s */
+
+	range.min_rts = 0;
+	range.max_rts = 2347;
+	range.min_frag = 256;
+	range.max_frag = 2346;
+
+	if (orinoco_lock(priv, &flags) != 0)
+		return -EBUSY;
+	if (priv->has_wep) {
+		range.max_encoding_tokens = ORINOCO_MAX_KEYS;
+
+		range.encoding_size[0] = SMALL_KEY_SIZE;
+		range.num_encoding_sizes = 1;
+
+		if (priv->has_big_wep) {
+			range.encoding_size[1] = LARGE_KEY_SIZE;
+			range.num_encoding_sizes = 2;
+		}
+	} else {
+		range.num_encoding_sizes = 0;
+		range.max_encoding_tokens = 0;
+	}
+	orinoco_unlock(priv, &flags);
+		
+	range.min_pmp = 0;
+	range.max_pmp = 65535000;
+	range.min_pmt = 0;
+	range.max_pmt = 65535 * 1000;	/* ??? */
+	range.pmp_flags = IW_POWER_PERIOD;
+	range.pmt_flags = IW_POWER_TIMEOUT;
+	range.pm_capa = IW_POWER_PERIOD | IW_POWER_TIMEOUT | IW_POWER_UNICAST_R;
+
+	range.num_txpower = 1;
+	range.txpower[0] = 15; /* 15dBm */
+	range.txpower_capa = IW_TXPOW_DBM;
+
+	range.retry_capa = IW_RETRY_LIMIT | IW_RETRY_LIFETIME;
+	range.retry_flags = IW_RETRY_LIMIT;
+	range.r_time_flags = IW_RETRY_LIFETIME;
+	range.min_retry = 0;
+	range.max_retry = 65535;	/* ??? */
+	range.min_r_time = 0;
+	range.max_r_time = 65535 * 1000;	/* ??? */
+
+	if (copy_to_user(rrq->pointer, &range, sizeof(range)))
+		return -EFAULT;
+
+	TRACE_EXIT(dev->name);
+
+	return 0;
+}
+
+static int orinoco_ioctl_setiwencode(struct net_device *dev, struct iw_point *erq)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	int index = (erq->flags & IW_ENCODE_INDEX) - 1;
+	int setindex = priv->tx_key;
+	int enable = priv->wep_on;
+	int restricted = priv->wep_restrict;
+	u16 xlen = 0;
+	int err = 0;
+	char keybuf[ORINOCO_MAX_KEY_SIZE];
+	unsigned long flags;
+
+	if (! priv->has_wep)
+		return -EOPNOTSUPP;
+
+	if (erq->pointer) {
+		/* We actually have a key to set - check its length */
+		if (erq->length > LARGE_KEY_SIZE)
+			return -E2BIG;
+
+		if ( (erq->length > SMALL_KEY_SIZE) && !priv->has_big_wep )
+			return -E2BIG;
+		
+		if (copy_from_user(keybuf, erq->pointer, erq->length))
+			return -EFAULT;
+	}
+
+	if (orinoco_lock(priv, &flags) != 0)
+		return -EBUSY;
+
+	if (erq->pointer) {
+		if ((index < 0) || (index >= ORINOCO_MAX_KEYS))
+			index = priv->tx_key;
+
+		/* Adjust key length to a supported value */
+		if (erq->length > SMALL_KEY_SIZE) {
+			xlen = LARGE_KEY_SIZE;
+		} else if (erq->length > 0) {
+			xlen = SMALL_KEY_SIZE;
+		} else
+			xlen = 0;
+
+		/* Switch on WEP if off */
+		if ((!enable) && (xlen > 0)) {
+			setindex = index;
+			enable = 1;
+		}
+	} else {
+		/* Important note : if the user do "iwconfig eth0 enc off",
+		 * we will arrive there with an index of -1. This is valid
+		 * but need to be taken care off... Jean II */
+		if ((index < 0) || (index >= ORINOCO_MAX_KEYS)) {
+			if((index != -1) || (erq->flags == 0)) {
+				err = -EINVAL;
+				goto out;
+			}
+		} else {
+			/* Set the index : Check that the key is valid */
+			if(priv->keys[index].len == 0) {
+				err = -EINVAL;
+				goto out;
+			}
+			setindex = index;
+		}
+	}
+
+	if (erq->flags & IW_ENCODE_DISABLED)
+		enable = 0;
+	if (erq->flags & IW_ENCODE_OPEN)
+		restricted = 0;
+	if (erq->flags & IW_ENCODE_RESTRICTED)
+		restricted = 1;
+
+	if (erq->pointer) {
+		priv->keys[index].len = cpu_to_le16(xlen);
+		memset(priv->keys[index].data, 0,
+		       sizeof(priv->keys[index].data));
+		memcpy(priv->keys[index].data, keybuf, erq->length);
+	}
+	priv->tx_key = setindex;
+
+	/* Try fast key change if connected and only keys are changed */
+	if (priv->wep_on && enable && (priv->wep_restrict == restricted) &&
+	    netif_carrier_ok(dev)) {
+		err = __orinoco_hw_setup_wepkeys(priv);
+		/* No need to commit if successful */
+		goto out;
+	}
+
+	priv->wep_on = enable;
+	priv->wep_restrict = restricted;
+
+ out:
+	orinoco_unlock(priv, &flags);
+
+	return err;
+}
+
+static int orinoco_ioctl_getiwencode(struct net_device *dev, struct iw_point *erq)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	int index = (erq->flags & IW_ENCODE_INDEX) - 1;
+	u16 xlen = 0;
+	char keybuf[ORINOCO_MAX_KEY_SIZE];
+	unsigned long flags;
+
+	if (! priv->has_wep)
+		return -EOPNOTSUPP;
+
+	if (orinoco_lock(priv, &flags) != 0)
+		return -EBUSY;
+
+	if ((index < 0) || (index >= ORINOCO_MAX_KEYS))
+		index = priv->tx_key;
+
+	erq->flags = 0;
+	if (! priv->wep_on)
+		erq->flags |= IW_ENCODE_DISABLED;
+	erq->flags |= index + 1;
+
+	if (priv->wep_restrict)
+		erq->flags |= IW_ENCODE_RESTRICTED;
+	else
+		erq->flags |= IW_ENCODE_OPEN;
+
+	xlen = le16_to_cpu(priv->keys[index].len);
+
+	erq->length = xlen;
+
+	memcpy(keybuf, priv->keys[index].data, ORINOCO_MAX_KEY_SIZE);
+
+	orinoco_unlock(priv, &flags);
+
+	if (erq->pointer) {
+		if (copy_to_user(erq->pointer, keybuf, xlen))
+			return -EFAULT;
+	}
+
+	return 0;
+}
+
+static int orinoco_ioctl_setessid(struct net_device *dev, struct iw_point *erq)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	char essidbuf[IW_ESSID_MAX_SIZE+1];
+	unsigned long flags;
+
+	/* Note : ESSID is ignored in Ad-Hoc demo mode, but we can set it
+	 * anyway... - Jean II */
+
+	memset(&essidbuf, 0, sizeof(essidbuf));
+
+	if (erq->flags) {
+		if (erq->length > IW_ESSID_MAX_SIZE)
+			return -E2BIG;
+		
+		if (copy_from_user(&essidbuf, erq->pointer, erq->length))
+			return -EFAULT;
+
+		essidbuf[erq->length] = '\0';
+	}
+
+	if (orinoco_lock(priv, &flags) != 0)
+		return -EBUSY;
+
+	memcpy(priv->desired_essid, essidbuf, sizeof(priv->desired_essid));
+
+	orinoco_unlock(priv, &flags);
+
+	return 0;
+}
+
+static int orinoco_ioctl_getessid(struct net_device *dev, struct iw_point *erq)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	char essidbuf[IW_ESSID_MAX_SIZE+1];
+	int active;
+	int err = 0;
+	unsigned long flags;
+
+	TRACE_ENTER(dev->name);
+
+	if (netif_running(dev)) {
+		err = orinoco_hw_get_essid(priv, &active, essidbuf);
+		if (err)
+			return err;
+	} else {
+		if (orinoco_lock(priv, &flags) != 0)
+			return -EBUSY;
+		memcpy(essidbuf, priv->desired_essid, sizeof(essidbuf));
+		orinoco_unlock(priv, &flags);
+	}
+
+	erq->flags = 1;
+	erq->length = strlen(essidbuf) + 1;
+	if (erq->pointer)
+		if (copy_to_user(erq->pointer, essidbuf, erq->length))
+			return -EFAULT;
+
+	TRACE_EXIT(dev->name);
+	
+	return 0;
+}
+
+static int orinoco_ioctl_setnick(struct net_device *dev, struct iw_point *nrq)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	char nickbuf[IW_ESSID_MAX_SIZE+1];
+	unsigned long flags;
+
+	if (nrq->length > IW_ESSID_MAX_SIZE)
+		return -E2BIG;
+
+	memset(nickbuf, 0, sizeof(nickbuf));
+
+	if (copy_from_user(nickbuf, nrq->pointer, nrq->length))
+		return -EFAULT;
+
+	nickbuf[nrq->length] = '\0';
+	
+	if (orinoco_lock(priv, &flags) != 0)
+		return -EBUSY;
+
+	memcpy(priv->nick, nickbuf, sizeof(priv->nick));
+
+	orinoco_unlock(priv, &flags);
+
+	return 0;
+}
+
+static int orinoco_ioctl_getnick(struct net_device *dev, struct iw_point *nrq)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	char nickbuf[IW_ESSID_MAX_SIZE+1];
+	unsigned long flags;
+
+	if (orinoco_lock(priv, &flags) != 0)
+		return -EBUSY;
+
+	memcpy(nickbuf, priv->nick, IW_ESSID_MAX_SIZE+1);
+	orinoco_unlock(priv, &flags);
+
+	nrq->length = strlen(nickbuf)+1;
+
+	if (copy_to_user(nrq->pointer, nickbuf, sizeof(nickbuf)))
+		return -EFAULT;
+
+	return 0;
+}
+
+static int orinoco_ioctl_setfreq(struct net_device *dev, struct iw_freq *frq)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	int chan = -1;
+	unsigned long flags;
+
+	/* We can only use this in Ad-Hoc demo mode to set the operating
+	 * frequency, or in IBSS mode to set the frequency where the IBSS
+	 * will be created - Jean II */
+	if (priv->iw_mode != IW_MODE_ADHOC)
+		return -EOPNOTSUPP;
+
+	if ( (frq->e == 0) && (frq->m <= 1000) ) {
+		/* Setting by channel number */
+		chan = frq->m;
+	} else {
+		/* Setting by frequency - search the table */
+		int mult = 1;
+		int i;
+
+		for (i = 0; i < (6 - frq->e); i++)
+			mult *= 10;
+
+		for (i = 0; i < NUM_CHANNELS; i++)
+			if (frq->m == (channel_frequency[i] * mult))
+				chan = i+1;
+	}
+
+	if ( (chan < 1) || (chan > NUM_CHANNELS) ||
+	     ! (priv->channel_mask & (1 << (chan-1)) ) )
+		return -EINVAL;
+
+	if (orinoco_lock(priv, &flags) != 0)
+		return -EBUSY;
+	priv->channel = chan;
+	orinoco_unlock(priv, &flags);
+
+	return 0;
+}
+
+static int orinoco_ioctl_getsens(struct net_device *dev, struct iw_param *srq)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	hermes_t *hw = &priv->hw;
+	u16 val;
+	int err;
+	unsigned long flags;
+
+	if (!priv->has_sensitivity)
+		return -EOPNOTSUPP;
+
+	if (orinoco_lock(priv, &flags) != 0)
+		return -EBUSY;
+	err = hermes_read_wordrec(hw, USER_BAP,
+				  HERMES_RID_CNFSYSTEMSCALE, &val);
+	orinoco_unlock(priv, &flags);
+
+	if (err)
+		return err;
+
+	srq->value = val;
+	srq->fixed = 0; /* auto */
+
+	return 0;
+}
+
+static int orinoco_ioctl_setsens(struct net_device *dev, struct iw_param *srq)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	int val = srq->value;
+	unsigned long flags;
+
+	if (!priv->has_sensitivity)
+		return -EOPNOTSUPP;
+
+	if ((val < 1) || (val > 3))
+		return -EINVAL;
+	
+	if (orinoco_lock(priv, &flags) != 0)
+		return -EBUSY;
+	priv->ap_density = val;
+	orinoco_unlock(priv, &flags);
+
+	return 0;
+}
+
+static int orinoco_ioctl_setrts(struct net_device *dev, struct iw_param *rrq)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	int val = rrq->value;
+	unsigned long flags;
+
+	if (rrq->disabled)
+		val = 2347;
+
+	if ( (val < 0) || (val > 2347) )
+		return -EINVAL;
+
+	if (orinoco_lock(priv, &flags) != 0)
+		return -EBUSY;
+
+	priv->rts_thresh = val;
+	orinoco_unlock(priv, &flags);
+
+	return 0;
+}
+
+static int orinoco_ioctl_setfrag(struct net_device *dev, struct iw_param *frq)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	int err = 0;
+	unsigned long flags;
+
+	if (orinoco_lock(priv, &flags) != 0)
+		return -EBUSY;
+
+	if (priv->has_mwo) {
+		if (frq->disabled)
+			priv->mwo_robust = 0;
+		else {
+			if (frq->fixed)
+				printk(KERN_WARNING "%s: Fixed fragmentation is "
+				       "not supported on this firmware. "
+				       "Using MWO robust instead.\n", dev->name);
+			priv->mwo_robust = 1;
+		}
+	} else {
+		if (frq->disabled)
+			priv->frag_thresh = 2346;
+		else {
+			if ( (frq->value < 256) || (frq->value > 2346) )
+				err = -EINVAL;
+			else
+				priv->frag_thresh = frq->value & ~0x1; /* must be even */
+		}
+	}
+
+	orinoco_unlock(priv, &flags);
+
+	return err;
+}
+
+static int orinoco_ioctl_getfrag(struct net_device *dev, struct iw_param *frq)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	hermes_t *hw = &priv->hw;
+	int err = 0;
+	u16 val;
+	unsigned long flags;
+
+	if (orinoco_lock(priv, &flags) != 0)
+		return -EBUSY;
+	
+	if (priv->has_mwo) {
+		err = hermes_read_wordrec(hw, USER_BAP,
+					  HERMES_RID_CNFMWOROBUST_AGERE,
+					  &val);
+		if (err)
+			val = 0;
+
+		frq->value = val ? 2347 : 0;
+		frq->disabled = ! val;
+		frq->fixed = 0;
+	} else {
+		err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_CNFFRAGMENTATIONTHRESHOLD,
+					  &val);
+		if (err)
+			val = 0;
+
+		frq->value = val;
+		frq->disabled = (val >= 2346);
+		frq->fixed = 1;
+	}
+
+	orinoco_unlock(priv, &flags);
+	
+	return err;
+}
+
+static int orinoco_ioctl_setrate(struct net_device *dev, struct iw_param *rrq)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	int err = 0;
+	int ratemode = -1;
+	int bitrate; /* 100s of kilobits */
+	int i;
+	unsigned long flags;
+	
+	/* As the user space doesn't know our highest rate, it uses -1
+	 * to ask us to set the highest rate.  Test it using "iwconfig
+	 * ethX rate auto" - Jean II */
+	if (rrq->value == -1)
+		bitrate = 110;
+	else {
+		if (rrq->value % 100000)
+			return -EINVAL;
+		bitrate = rrq->value / 100000;
+	}
+
+	if ( (bitrate != 10) && (bitrate != 20) &&
+	     (bitrate != 55) && (bitrate != 110) )
+		return -EINVAL;
+
+	for (i = 0; i < BITRATE_TABLE_SIZE; i++)
+		if ( (bitrate_table[i].bitrate == bitrate) &&
+		     (bitrate_table[i].automatic == ! rrq->fixed) ) {
+			ratemode = i;
+			break;
+		}
+	
+	if (ratemode == -1)
+		return -EINVAL;
+
+	if (orinoco_lock(priv, &flags) != 0)
+		return -EBUSY;
+	priv->bitratemode = ratemode;
+	orinoco_unlock(priv, &flags);
+
+	return err;
+}
+
+static int orinoco_ioctl_getrate(struct net_device *dev, struct iw_param *rrq)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	hermes_t *hw = &priv->hw;
+	int err = 0;
+	int ratemode;
+	int i;
+	u16 val;
+	unsigned long flags;
+
+	if (orinoco_lock(priv, &flags) != 0)
+		return -EBUSY;
+
+	ratemode = priv->bitratemode;
+
+	BUG_ON((ratemode < 0) || (ratemode >= BITRATE_TABLE_SIZE));
+
+	rrq->value = bitrate_table[ratemode].bitrate * 100000;
+	rrq->fixed = ! bitrate_table[ratemode].automatic;
+	rrq->disabled = 0;
+
+	/* If the interface is running we try to find more about the
+	   current mode */
+	if (netif_running(dev)) {
+		err = hermes_read_wordrec(hw, USER_BAP,
+					  HERMES_RID_CURRENTTXRATE, &val);
+		if (err)
+			goto out;
+		
+		switch (priv->firmware_type) {
+		case FIRMWARE_TYPE_AGERE: /* Lucent style rate */
+			/* Note : in Lucent firmware, the return value of
+			 * HERMES_RID_CURRENTTXRATE is the bitrate in Mb/s,
+			 * and therefore is totally different from the
+			 * encoding of HERMES_RID_CNFTXRATECONTROL.
+			 * Don't forget that 6Mb/s is really 5.5Mb/s */
+			if (val == 6)
+				rrq->value = 5500000;
+			else
+				rrq->value = val * 1000000;
+			break;
+		case FIRMWARE_TYPE_INTERSIL: /* Intersil style rate */
+		case FIRMWARE_TYPE_SYMBOL: /* Symbol style rate */
+			for (i = 0; i < BITRATE_TABLE_SIZE; i++)
+				if (bitrate_table[i].intersil_txratectrl == val) {
+					ratemode = i;
+					break;
+				}
+			if (i >= BITRATE_TABLE_SIZE)
+				printk(KERN_INFO "%s: Unable to determine current bitrate (0x%04hx)\n",
+				       dev->name, val);
+
+			rrq->value = bitrate_table[ratemode].bitrate * 100000;
+			break;
+		default:
+			BUG();
+		}
+	}
+
+ out:
+	orinoco_unlock(priv, &flags);
+
+	return err;
+}
+
+static int orinoco_ioctl_setpower(struct net_device *dev, struct iw_param *prq)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	int err = 0;
+	unsigned long flags;
+
+	if (orinoco_lock(priv, &flags) != 0)
+		return -EBUSY;
+
+	if (prq->disabled) {
+		priv->pm_on = 0;
+	} else {
+		switch (prq->flags & IW_POWER_MODE) {
+		case IW_POWER_UNICAST_R:
+			priv->pm_mcast = 0;
+			priv->pm_on = 1;
+			break;
+		case IW_POWER_ALL_R:
+			priv->pm_mcast = 1;
+			priv->pm_on = 1;
+			break;
+		case IW_POWER_ON:
+			/* No flags : but we may have a value - Jean II */
+			break;
+		default:
+			err = -EINVAL;
+		}
+		if (err)
+			goto out;
+		
+		if (prq->flags & IW_POWER_TIMEOUT) {
+			priv->pm_on = 1;
+			priv->pm_timeout = prq->value / 1000;
+		}
+		if (prq->flags & IW_POWER_PERIOD) {
+			priv->pm_on = 1;
+			priv->pm_period = prq->value / 1000;
+		}
+		/* It's valid to not have a value if we are just toggling
+		 * the flags... Jean II */
+		if(!priv->pm_on) {
+			err = -EINVAL;
+			goto out;
+		}			
+	}
+
+ out:
+	orinoco_unlock(priv, &flags);
+
+	return err;
+}
+
+static int orinoco_ioctl_getpower(struct net_device *dev, struct iw_param *prq)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	hermes_t *hw = &priv->hw;
+	int err = 0;
+	u16 enable, period, timeout, mcast;
+	unsigned long flags;
+
+	if (orinoco_lock(priv, &flags) != 0)
+		return -EBUSY;
+	
+	err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_CNFPMENABLED, &enable);
+	if (err)
+		goto out;
+
+	err = hermes_read_wordrec(hw, USER_BAP,
+				  HERMES_RID_CNFMAXSLEEPDURATION, &period);
+	if (err)
+		goto out;
+
+	err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_CNFPMHOLDOVERDURATION, &timeout);
+	if (err)
+		goto out;
+
+	err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_CNFMULTICASTRECEIVE, &mcast);
+	if (err)
+		goto out;
+
+	prq->disabled = !enable;
+	/* Note : by default, display the period */
+	if ((prq->flags & IW_POWER_TYPE) == IW_POWER_TIMEOUT) {
+		prq->flags = IW_POWER_TIMEOUT;
+		prq->value = timeout * 1000;
+	} else {
+		prq->flags = IW_POWER_PERIOD;
+		prq->value = period * 1000;
+	}
+	if (mcast)
+		prq->flags |= IW_POWER_ALL_R;
+	else
+		prq->flags |= IW_POWER_UNICAST_R;
+
+ out:
+	orinoco_unlock(priv, &flags);
+
+	return err;
+}
+
+static int orinoco_ioctl_getretry(struct net_device *dev, struct iw_param *rrq)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	hermes_t *hw = &priv->hw;
+	int err = 0;
+	u16 short_limit, long_limit, lifetime;
+	unsigned long flags;
+
+	if (orinoco_lock(priv, &flags) != 0)
+		return -EBUSY;
+	
+	err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_SHORTRETRYLIMIT,
+				  &short_limit);
+	if (err)
+		goto out;
+
+	err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_LONGRETRYLIMIT,
+				  &long_limit);
+	if (err)
+		goto out;
+
+	err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_MAXTRANSMITLIFETIME,
+				  &lifetime);
+	if (err)
+		goto out;
+
+	rrq->disabled = 0;		/* Can't be disabled */
+
+	/* Note : by default, display the retry number */
+	if ((rrq->flags & IW_RETRY_TYPE) == IW_RETRY_LIFETIME) {
+		rrq->flags = IW_RETRY_LIFETIME;
+		rrq->value = lifetime * 1000;	/* ??? */
+	} else {
+		/* By default, display the min number */
+		if ((rrq->flags & IW_RETRY_MAX)) {
+			rrq->flags = IW_RETRY_LIMIT | IW_RETRY_MAX;
+			rrq->value = long_limit;
+		} else {
+			rrq->flags = IW_RETRY_LIMIT;
+			rrq->value = short_limit;
+			if(short_limit != long_limit)
+				rrq->flags |= IW_RETRY_MIN;
+		}
+	}
+
+ out:
+	orinoco_unlock(priv, &flags);
+
+	return err;
+}
+
+static int orinoco_ioctl_setibssport(struct net_device *dev, struct iwreq *wrq)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	int val = *( (int *) wrq->u.name );
+	unsigned long flags;
+
+	if (orinoco_lock(priv, &flags) != 0)
+		return -EBUSY;
+
+	priv->ibss_port = val ;
+
+	/* Actually update the mode we are using */
+	set_port_type(priv);
+
+	orinoco_unlock(priv, &flags);
+	return 0;
+}
+
+static int orinoco_ioctl_getibssport(struct net_device *dev, struct iwreq *wrq)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	int *val = (int *)wrq->u.name;
+	unsigned long flags;
+
+	if (orinoco_lock(priv, &flags) != 0)
+		return -EBUSY;
+
+	*val = priv->ibss_port;
+	orinoco_unlock(priv, &flags);
+
+	return 0;
+}
+
+static int orinoco_ioctl_setport3(struct net_device *dev, struct iwreq *wrq)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	int val = *( (int *) wrq->u.name );
+	int err = 0;
+	unsigned long flags;
+
+	if (orinoco_lock(priv, &flags) != 0)
+		return -EBUSY;
+
+	switch (val) {
+	case 0: /* Try to do IEEE ad-hoc mode */
+		if (! priv->has_ibss) {
+			err = -EINVAL;
+			break;
+		}
+		priv->prefer_port3 = 0;
+			
+		break;
+
+	case 1: /* Try to do Lucent proprietary ad-hoc mode */
+		if (! priv->has_port3) {
+			err = -EINVAL;
+			break;
+		}
+		priv->prefer_port3 = 1;
+		break;
+
+	default:
+		err = -EINVAL;
+	}
+
+	if (! err)
+		/* Actually update the mode we are using */
+		set_port_type(priv);
+
+	orinoco_unlock(priv, &flags);
+
+	return err;
+}
+
+static int orinoco_ioctl_getport3(struct net_device *dev, struct iwreq *wrq)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	int *val = (int *)wrq->u.name;
+	unsigned long flags;
+
+	if (orinoco_lock(priv, &flags) != 0)
+		return -EBUSY;
+
+	*val = priv->prefer_port3;
+	orinoco_unlock(priv, &flags);
+	return 0;
+}
+
+/* Spy is used for link quality/strength measurements in Ad-Hoc mode
+ * Jean II */
+static int orinoco_ioctl_setspy(struct net_device *dev, struct iw_point *srq)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	struct sockaddr address[IW_MAX_SPY];
+	int number = srq->length;
+	int i;
+	int err = 0;
+	unsigned long flags;
+
+	/* Check the number of addresses */
+	if (number > IW_MAX_SPY)
+		return -E2BIG;
+
+	/* Get the data in the driver */
+	if (srq->pointer) {
+		if (copy_from_user(address, srq->pointer,
+				   sizeof(struct sockaddr) * number))
+			return -EFAULT;
+	}
+
+	/* Make sure nobody mess with the structure while we do */
+	if (orinoco_lock(priv, &flags) != 0)
+		return -EBUSY;
+
+	/* orinoco_lock() doesn't disable interrupts, so make sure the
+	 * interrupt rx path don't get confused while we copy */
+	priv->spy_number = 0;
+
+	if (number > 0) {
+		/* Extract the addresses */
+		for (i = 0; i < number; i++)
+			memcpy(priv->spy_address[i], address[i].sa_data,
+			       ETH_ALEN);
+		/* Reset stats */
+		memset(priv->spy_stat, 0,
+		       sizeof(struct iw_quality) * IW_MAX_SPY);
+		/* Set number of addresses */
+		priv->spy_number = number;
+	}
+
+	/* Now, let the others play */
+	orinoco_unlock(priv, &flags);
+
+	return err;
+}
+
+static int orinoco_ioctl_getspy(struct net_device *dev, struct iw_point *srq)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	struct sockaddr address[IW_MAX_SPY];
+	struct iw_quality spy_stat[IW_MAX_SPY];
+	int number;
+	int i;
+	unsigned long flags;
+
+	if (orinoco_lock(priv, &flags) != 0)
+		return -EBUSY;
+
+	number = priv->spy_number;
+	if ((number > 0) && (srq->pointer)) {
+		/* Create address struct */
+		for (i = 0; i < number; i++) {
+			memcpy(address[i].sa_data, priv->spy_address[i],
+			       ETH_ALEN);
+			address[i].sa_family = AF_UNIX;
+		}
+		/* Copy stats */
+		/* In theory, we should disable irqs while copying the stats
+		 * because the rx path might update it in the middle...
+		 * Bah, who care ? - Jean II */
+		memcpy(&spy_stat, priv->spy_stat,
+		       sizeof(struct iw_quality) * IW_MAX_SPY);
+		for (i=0; i < number; i++)
+			priv->spy_stat[i].updated = 0;
+	}
+
+	orinoco_unlock(priv, &flags);
+
+	/* Push stuff to user space */
+	srq->length = number;
+	if(copy_to_user(srq->pointer, address,
+			 sizeof(struct sockaddr) * number))
+		return -EFAULT;
+	if(copy_to_user(srq->pointer + (sizeof(struct sockaddr)*number),
+			&spy_stat, sizeof(struct iw_quality) * number))
+		return -EFAULT;
+
+	return 0;
+}
+
+static int
+orinoco_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	struct iwreq *wrq = (struct iwreq *)rq;
+	int err = 0;
+	int tmp;
+	int changed = 0;
+	unsigned long flags;
+
+	TRACE_ENTER(dev->name);
+
+	/* In theory, we could allow most of the the SET stuff to be
+	 * done. In practice, the lapse of time at startup when the
+	 * card is not ready is very short, so why bother...  Note
+	 * that netif_device_present is different from up/down
+	 * (ifconfig), when the device is not yet up, it is usually
+	 * already ready...  Jean II */
+	if (! netif_device_present(dev))
+		return -ENODEV;
+
+	switch (cmd) {
+	case SIOCGIWNAME:
+		strcpy(wrq->u.name, "IEEE 802.11-DS");
+		break;
+		
+	case SIOCGIWAP:
+		wrq->u.ap_addr.sa_family = ARPHRD_ETHER;
+		err = orinoco_hw_get_bssid(priv, wrq->u.ap_addr.sa_data);
+		break;
+
+	case SIOCGIWRANGE:
+		err = orinoco_ioctl_getiwrange(dev, &wrq->u.data);
+		break;
+
+	case SIOCSIWMODE:
+		if (orinoco_lock(priv, &flags) != 0)
+			return -EBUSY;
+		switch (wrq->u.mode) {
+		case IW_MODE_ADHOC:
+			if (! (priv->has_ibss || priv->has_port3) )
+				err = -EINVAL;
+			else {
+				priv->iw_mode = IW_MODE_ADHOC;
+				changed = 1;
+			}
+			break;
+
+		case IW_MODE_INFRA:
+			priv->iw_mode = IW_MODE_INFRA;
+			changed = 1;
+			break;
+
+		default:
+			err = -EINVAL;
+			break;
+		}
+		set_port_type(priv);
+		orinoco_unlock(priv, &flags);
+		break;
+
+	case SIOCGIWMODE:
+		if (orinoco_lock(priv, &flags) != 0)
+			return -EBUSY;
+		wrq->u.mode = priv->iw_mode;
+		orinoco_unlock(priv, &flags);
+		break;
+
+	case SIOCSIWENCODE:
+		err = orinoco_ioctl_setiwencode(dev, &wrq->u.encoding);
+		if (! err)
+			changed = 1;
+		break;
+
+	case SIOCGIWENCODE:
+		if (! capable(CAP_NET_ADMIN)) {
+			err = -EPERM;
+			break;
+		}
+
+		err = orinoco_ioctl_getiwencode(dev, &wrq->u.encoding);
+		break;
+
+	case SIOCSIWESSID:
+		err = orinoco_ioctl_setessid(dev, &wrq->u.essid);
+		if (! err)
+			changed = 1;
+		break;
+
+	case SIOCGIWESSID:
+		err = orinoco_ioctl_getessid(dev, &wrq->u.essid);
+		break;
+
+	case SIOCSIWNICKN:
+		err = orinoco_ioctl_setnick(dev, &wrq->u.data);
+		if (! err)
+			changed = 1;
+		break;
+
+	case SIOCGIWNICKN:
+		err = orinoco_ioctl_getnick(dev, &wrq->u.data);
+		break;
+
+	case SIOCGIWFREQ:
+		tmp = orinoco_hw_get_freq(priv);
+		if (tmp < 0) {
+			err = tmp;
+		} else {
+			wrq->u.freq.m = tmp;
+			wrq->u.freq.e = 1;
+		}
+		break;
+
+	case SIOCSIWFREQ:
+		err = orinoco_ioctl_setfreq(dev, &wrq->u.freq);
+		if (! err)
+			changed = 1;
+		break;
+
+	case SIOCGIWSENS:
+		err = orinoco_ioctl_getsens(dev, &wrq->u.sens);
+		break;
+
+	case SIOCSIWSENS:
+		err = orinoco_ioctl_setsens(dev, &wrq->u.sens);
+		if (! err)
+			changed = 1;
+		break;
+
+	case SIOCGIWRTS:
+		wrq->u.rts.value = priv->rts_thresh;
+		wrq->u.rts.disabled = (wrq->u.rts.value == 2347);
+		wrq->u.rts.fixed = 1;
+		break;
+
+	case SIOCSIWRTS:
+		err = orinoco_ioctl_setrts(dev, &wrq->u.rts);
+		if (! err)
+			changed = 1;
+		break;
+
+	case SIOCSIWFRAG:
+		err = orinoco_ioctl_setfrag(dev, &wrq->u.frag);
+		if (! err)
+			changed = 1;
+		break;
+
+	case SIOCGIWFRAG:
+		err = orinoco_ioctl_getfrag(dev, &wrq->u.frag);
+		break;
+
+	case SIOCSIWRATE:
+		err = orinoco_ioctl_setrate(dev, &wrq->u.bitrate);
+		if (! err)
+			changed = 1;
+		break;
+
+	case SIOCGIWRATE:
+		err = orinoco_ioctl_getrate(dev, &wrq->u.bitrate);
+		break;
+
+	case SIOCSIWPOWER:
+		err = orinoco_ioctl_setpower(dev, &wrq->u.power);
+		if (! err)
+			changed = 1;
+		break;
+
+	case SIOCGIWPOWER:
+		err = orinoco_ioctl_getpower(dev, &wrq->u.power);
+		break;
+
+	case SIOCGIWTXPOW:
+		/* The card only supports one tx power, so this is easy */
+		wrq->u.txpower.value = 15; /* dBm */
+		wrq->u.txpower.fixed = 1;
+		wrq->u.txpower.disabled = 0;
+		wrq->u.txpower.flags = IW_TXPOW_DBM;
+		break;
+
+	case SIOCSIWRETRY:
+		err = -EOPNOTSUPP;
+		break;
+
+	case SIOCGIWRETRY:
+		err = orinoco_ioctl_getretry(dev, &wrq->u.retry);
+		break;
+
+	case SIOCSIWSPY:
+		err = orinoco_ioctl_setspy(dev, &wrq->u.data);
+		break;
+
+	case SIOCGIWSPY:
+		err = orinoco_ioctl_getspy(dev, &wrq->u.data);
+		break;
+
+	case SIOCGIWPRIV:
+		if (wrq->u.data.pointer) {
+			struct iw_priv_args privtab[] = {
+				{ SIOCIWFIRSTPRIV + 0x0, 0, 0, "force_reset" },
+				{ SIOCIWFIRSTPRIV + 0x1, 0, 0, "card_reset" },
+				{ SIOCIWFIRSTPRIV + 0x2,
+				  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
+				  0, "set_port3" },
+				{ SIOCIWFIRSTPRIV + 0x3, 0,
+				  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
+				  "get_port3" },
+				{ SIOCIWFIRSTPRIV + 0x4,
+				  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
+				  0, "set_preamble" },
+				{ SIOCIWFIRSTPRIV + 0x5, 0,
+				  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
+				  "get_preamble" },
+				{ SIOCIWFIRSTPRIV + 0x6,
+				  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
+				  0, "set_ibssport" },
+				{ SIOCIWFIRSTPRIV + 0x7, 0,
+				  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
+				  "get_ibssport" },
+				{ SIOCIWLASTPRIV, 0, 0, "dump_recs" },
+			};
+
+			wrq->u.data.length = sizeof(privtab) / sizeof(privtab[0]);
+			if (copy_to_user(wrq->u.data.pointer, privtab, sizeof(privtab)))
+				err = -EFAULT;
+		}
+		break;
+	       
+	case SIOCIWFIRSTPRIV + 0x0: /* force_reset */
+	case SIOCIWFIRSTPRIV + 0x1: /* card_reset */
+		if (! capable(CAP_NET_ADMIN)) {
+			err = -EPERM;
+			break;
+		}
+		
+		printk(KERN_DEBUG "%s: Force scheduling reset!\n", dev->name);
+
+		schedule_work(&priv->reset_work);
+		break;
+
+	case SIOCIWFIRSTPRIV + 0x2: /* set_port3 */
+		if (! capable(CAP_NET_ADMIN)) {
+			err = -EPERM;
+			break;
+		}
+
+		err = orinoco_ioctl_setport3(dev, wrq);
+		if (! err)
+			changed = 1;
+		break;
+
+	case SIOCIWFIRSTPRIV + 0x3: /* get_port3 */
+		err = orinoco_ioctl_getport3(dev, wrq);
+		break;
+
+	case SIOCIWFIRSTPRIV + 0x4: /* set_preamble */
+		if (! capable(CAP_NET_ADMIN)) {
+			err = -EPERM;
+			break;
+		}
+
+		/* 802.11b has recently defined some short preamble.
+		 * Basically, the Phy header has been reduced in size.
+		 * This increase performance, especially at high rates
+		 * (the preamble is transmitted at 1Mb/s), unfortunately
+		 * this give compatibility troubles... - Jean II */
+		if(priv->has_preamble) {
+			int val = *( (int *) wrq->u.name );
+
+			if (orinoco_lock(priv, &flags) != 0)
+				return -EBUSY;
+			if (val)
+				priv->preamble = 1;
+			else
+				priv->preamble = 0;
+			orinoco_unlock(priv, &flags);
+			changed = 1;
+		} else
+			err = -EOPNOTSUPP;
+		break;
+
+	case SIOCIWFIRSTPRIV + 0x5: /* get_preamble */
+		if(priv->has_preamble) {
+			int *val = (int *)wrq->u.name;
+
+			if (orinoco_lock(priv, &flags) != 0)
+				return -EBUSY;
+			*val = priv->preamble;
+			orinoco_unlock(priv, &flags);
+		} else
+			err = -EOPNOTSUPP;
+		break;
+	case SIOCIWFIRSTPRIV + 0x6: /* set_ibssport */
+		if (! capable(CAP_NET_ADMIN)) {
+			err = -EPERM;
+			break;
+		}
+
+		err = orinoco_ioctl_setibssport(dev, wrq);
+		if (! err)
+			changed = 1;
+		break;
+
+	case SIOCIWFIRSTPRIV + 0x7: /* get_ibssport */
+		err = orinoco_ioctl_getibssport(dev, wrq);
+		break;
+
+	case SIOCIWLASTPRIV:
+		err = orinoco_debug_dump_recs(dev);
+		if (err)
+			printk(KERN_ERR "%s: Unable to dump records (%d)\n",
+			       dev->name, err);
+		break;
+
+
+	default:
+		err = -EOPNOTSUPP;
+	}
+	
+	if (! err && changed && netif_running(dev)) {
+		err = orinoco_reconfigure(dev);
+	}		
+
+	TRACE_EXIT(dev->name);
+
+	return err;
+}
+
+struct {
+	u16 rid;
+	char *name;
+	int displaytype;
+#define DISPLAY_WORDS	0
+#define DISPLAY_BYTES	1
+#define DISPLAY_STRING	2
+#define DISPLAY_XSTRING	3
+} record_table[] = {
+#define DEBUG_REC(name,type) { HERMES_RID_##name, #name, DISPLAY_##type }
+	DEBUG_REC(CNFPORTTYPE,WORDS),
+	DEBUG_REC(CNFOWNMACADDR,BYTES),
+	DEBUG_REC(CNFDESIREDSSID,STRING),
+	DEBUG_REC(CNFOWNCHANNEL,WORDS),
+	DEBUG_REC(CNFOWNSSID,STRING),
+	DEBUG_REC(CNFOWNATIMWINDOW,WORDS),
+	DEBUG_REC(CNFSYSTEMSCALE,WORDS),
+	DEBUG_REC(CNFMAXDATALEN,WORDS),
+	DEBUG_REC(CNFPMENABLED,WORDS),
+	DEBUG_REC(CNFPMEPS,WORDS),
+	DEBUG_REC(CNFMULTICASTRECEIVE,WORDS),
+	DEBUG_REC(CNFMAXSLEEPDURATION,WORDS),
+	DEBUG_REC(CNFPMHOLDOVERDURATION,WORDS),
+	DEBUG_REC(CNFOWNNAME,STRING),
+	DEBUG_REC(CNFOWNDTIMPERIOD,WORDS),
+	DEBUG_REC(CNFMULTICASTPMBUFFERING,WORDS),
+	DEBUG_REC(CNFWEPENABLED_AGERE,WORDS),
+	DEBUG_REC(CNFMANDATORYBSSID_SYMBOL,WORDS),
+	DEBUG_REC(CNFWEPDEFAULTKEYID,WORDS),
+	DEBUG_REC(CNFDEFAULTKEY0,BYTES),
+	DEBUG_REC(CNFDEFAULTKEY1,BYTES),
+	DEBUG_REC(CNFMWOROBUST_AGERE,WORDS),
+	DEBUG_REC(CNFDEFAULTKEY2,BYTES),
+	DEBUG_REC(CNFDEFAULTKEY3,BYTES),
+	DEBUG_REC(CNFWEPFLAGS_INTERSIL,WORDS),
+	DEBUG_REC(CNFWEPKEYMAPPINGTABLE,WORDS),
+	DEBUG_REC(CNFAUTHENTICATION,WORDS),
+	DEBUG_REC(CNFMAXASSOCSTA,WORDS),
+	DEBUG_REC(CNFKEYLENGTH_SYMBOL,WORDS),
+	DEBUG_REC(CNFTXCONTROL,WORDS),
+	DEBUG_REC(CNFROAMINGMODE,WORDS),
+	DEBUG_REC(CNFHOSTAUTHENTICATION,WORDS),
+	DEBUG_REC(CNFRCVCRCERROR,WORDS),
+	DEBUG_REC(CNFMMLIFE,WORDS),
+	DEBUG_REC(CNFALTRETRYCOUNT,WORDS),
+	DEBUG_REC(CNFBEACONINT,WORDS),
+	DEBUG_REC(CNFAPPCFINFO,WORDS),
+	DEBUG_REC(CNFSTAPCFINFO,WORDS),
+	DEBUG_REC(CNFPRIORITYQUSAGE,WORDS),
+	DEBUG_REC(CNFTIMCTRL,WORDS),
+	DEBUG_REC(CNFTHIRTY2TALLY,WORDS),
+	DEBUG_REC(CNFENHSECURITY,WORDS),
+	DEBUG_REC(CNFGROUPADDRESSES,BYTES),
+	DEBUG_REC(CNFCREATEIBSS,WORDS),
+	DEBUG_REC(CNFFRAGMENTATIONTHRESHOLD,WORDS),
+	DEBUG_REC(CNFRTSTHRESHOLD,WORDS),
+	DEBUG_REC(CNFTXRATECONTROL,WORDS),
+	DEBUG_REC(CNFPROMISCUOUSMODE,WORDS),
+	DEBUG_REC(CNFBASICRATES_SYMBOL,WORDS),
+	DEBUG_REC(CNFPREAMBLE_SYMBOL,WORDS),
+	DEBUG_REC(CNFSHORTPREAMBLE,WORDS),
+	DEBUG_REC(CNFWEPKEYS_AGERE,BYTES),
+	DEBUG_REC(CNFEXCLUDELONGPREAMBLE,WORDS),
+	DEBUG_REC(CNFTXKEY_AGERE,WORDS),
+	DEBUG_REC(CNFAUTHENTICATIONRSPTO,WORDS),
+	DEBUG_REC(CNFBASICRATES,WORDS),
+	DEBUG_REC(CNFSUPPORTEDRATES,WORDS),
+	DEBUG_REC(CNFTICKTIME,WORDS),
+	DEBUG_REC(CNFSCANREQUEST,WORDS),
+	DEBUG_REC(CNFJOINREQUEST,WORDS),
+	DEBUG_REC(CNFAUTHENTICATESTATION,WORDS),
+	DEBUG_REC(CNFCHANNELINFOREQUEST,WORDS),
+	DEBUG_REC(MAXLOADTIME,WORDS),
+	DEBUG_REC(DOWNLOADBUFFER,WORDS),
+	DEBUG_REC(PRIID,WORDS),
+	DEBUG_REC(PRISUPRANGE,WORDS),
+	DEBUG_REC(CFIACTRANGES,WORDS),
+	DEBUG_REC(NICSERNUM,XSTRING),
+	DEBUG_REC(NICID,WORDS),
+	DEBUG_REC(MFISUPRANGE,WORDS),
+	DEBUG_REC(CFISUPRANGE,WORDS),
+	DEBUG_REC(CHANNELLIST,WORDS),
+	DEBUG_REC(REGULATORYDOMAINS,WORDS),
+	DEBUG_REC(TEMPTYPE,WORDS),
+/*  	DEBUG_REC(CIS,BYTES), */
+	DEBUG_REC(STAID,WORDS),
+	DEBUG_REC(CURRENTSSID,STRING),
+	DEBUG_REC(CURRENTBSSID,BYTES),
+	DEBUG_REC(COMMSQUALITY,WORDS),
+	DEBUG_REC(CURRENTTXRATE,WORDS),
+	DEBUG_REC(CURRENTBEACONINTERVAL,WORDS),
+	DEBUG_REC(CURRENTSCALETHRESHOLDS,WORDS),
+	DEBUG_REC(PROTOCOLRSPTIME,WORDS),
+	DEBUG_REC(SHORTRETRYLIMIT,WORDS),
+	DEBUG_REC(LONGRETRYLIMIT,WORDS),
+	DEBUG_REC(MAXTRANSMITLIFETIME,WORDS),
+	DEBUG_REC(MAXRECEIVELIFETIME,WORDS),
+	DEBUG_REC(CFPOLLABLE,WORDS),
+	DEBUG_REC(AUTHENTICATIONALGORITHMS,WORDS),
+	DEBUG_REC(PRIVACYOPTIONIMPLEMENTED,WORDS),
+	DEBUG_REC(OWNMACADDR,BYTES),
+	DEBUG_REC(SCANRESULTSTABLE,WORDS),
+	DEBUG_REC(PHYTYPE,WORDS),
+	DEBUG_REC(CURRENTCHANNEL,WORDS),
+	DEBUG_REC(CURRENTPOWERSTATE,WORDS),
+	DEBUG_REC(CCAMODE,WORDS),
+	DEBUG_REC(SUPPORTEDDATARATES,WORDS),
+	DEBUG_REC(BUILDSEQ,BYTES),
+	DEBUG_REC(FWID,XSTRING)
+#undef DEBUG_REC
+};
+
+#define DEBUG_LTV_SIZE		128
+
+static int orinoco_debug_dump_recs(struct net_device *dev)
+{
+	struct orinoco_private *priv = netdev_priv(dev);
+	hermes_t *hw = &priv->hw;
+	u8 *val8;
+	u16 *val16;
+	int i,j;
+	u16 length;
+	int err;
+
+	/* I'm not sure: we might have a lock here, so we'd better go
+           atomic, just in case. */
+	val8 = kmalloc(DEBUG_LTV_SIZE + 2, GFP_ATOMIC);
+	if (! val8)
+		return -ENOMEM;
+	val16 = (u16 *)val8;
+
+	for (i = 0; i < ARRAY_SIZE(record_table); i++) {
+		u16 rid = record_table[i].rid;
+		int len;
+
+		memset(val8, 0, DEBUG_LTV_SIZE + 2);
+
+		err = hermes_read_ltv(hw, USER_BAP, rid, DEBUG_LTV_SIZE,
+				      &length, val8);
+		if (err) {
+			DEBUG(0, "Error %d reading RID 0x%04x\n", err, rid);
+			continue;
+		}
+		val16 = (u16 *)val8;
+		if (length == 0)
+			continue;
+
+		printk(KERN_DEBUG "%-15s (0x%04x): length=%d (%d bytes)\tvalue=",
+		       record_table[i].name,
+		       rid, length, (length-1)*2);
+		len = min(((int)length-1)*2, DEBUG_LTV_SIZE);
+
+		switch (record_table[i].displaytype) {
+		case DISPLAY_WORDS:
+			for (j = 0; j < len / 2; j++)
+				printk("%04X-", le16_to_cpu(val16[j]));
+			break;
+
+		case DISPLAY_BYTES:
+		default:
+			for (j = 0; j < len; j++)
+				printk("%02X:", val8[j]);
+			break;
+
+		case DISPLAY_STRING:
+			len = min(len, le16_to_cpu(val16[0])+2);
+			val8[len] = '\0';
+			printk("\"%s\"", (char *)&val16[1]);
+			break;
+
+		case DISPLAY_XSTRING:
+			printk("'%s'", (char *)val8);
+		}
+
+		printk("\n");
+	}
+
+	kfree(val8);
+
+	return 0;
+}
+
+/********************************************************************/
+/* Debugging                                                        */
+/********************************************************************/
+
+#if 0
+static void show_rx_frame(struct orinoco_rxframe_hdr *frame)
+{
+	printk(KERN_DEBUG "RX descriptor:\n");
+	printk(KERN_DEBUG "  status      = 0x%04x\n", frame->desc.status);
+	printk(KERN_DEBUG "  time        = 0x%08x\n", frame->desc.time);
+	printk(KERN_DEBUG "  silence     = 0x%02x\n", frame->desc.silence);
+	printk(KERN_DEBUG "  signal      = 0x%02x\n", frame->desc.signal);
+	printk(KERN_DEBUG "  rate        = 0x%02x\n", frame->desc.rate);
+	printk(KERN_DEBUG "  rxflow      = 0x%02x\n", frame->desc.rxflow);
+	printk(KERN_DEBUG "  reserved    = 0x%08x\n", frame->desc.reserved);
+
+	printk(KERN_DEBUG "IEEE 802.11 header:\n");
+	printk(KERN_DEBUG "  frame_ctl   = 0x%04x\n",
+	       frame->p80211.frame_ctl);
+	printk(KERN_DEBUG "  duration_id = 0x%04x\n",
+	       frame->p80211.duration_id);
+	printk(KERN_DEBUG "  addr1       = %02x:%02x:%02x:%02x:%02x:%02x\n",
+	       frame->p80211.addr1[0], frame->p80211.addr1[1],
+	       frame->p80211.addr1[2], frame->p80211.addr1[3],
+	       frame->p80211.addr1[4], frame->p80211.addr1[5]);
+	printk(KERN_DEBUG "  addr2       = %02x:%02x:%02x:%02x:%02x:%02x\n",
+	       frame->p80211.addr2[0], frame->p80211.addr2[1],
+	       frame->p80211.addr2[2], frame->p80211.addr2[3],
+	       frame->p80211.addr2[4], frame->p80211.addr2[5]);
+	printk(KERN_DEBUG "  addr3       = %02x:%02x:%02x:%02x:%02x:%02x\n",
+	       frame->p80211.addr3[0], frame->p80211.addr3[1],
+	       frame->p80211.addr3[2], frame->p80211.addr3[3],
+	       frame->p80211.addr3[4], frame->p80211.addr3[5]);
+	printk(KERN_DEBUG "  seq_ctl     = 0x%04x\n",
+	       frame->p80211.seq_ctl);
+	printk(KERN_DEBUG "  addr4       = %02x:%02x:%02x:%02x:%02x:%02x\n",
+	       frame->p80211.addr4[0], frame->p80211.addr4[1],
+	       frame->p80211.addr4[2], frame->p80211.addr4[3],
+	       frame->p80211.addr4[4], frame->p80211.addr4[5]);
+	printk(KERN_DEBUG "  data_len    = 0x%04x\n",
+	       frame->p80211.data_len);
+
+	printk(KERN_DEBUG "IEEE 802.3 header:\n");
+	printk(KERN_DEBUG "  dest        = %02x:%02x:%02x:%02x:%02x:%02x\n",
+	       frame->p8023.h_dest[0], frame->p8023.h_dest[1],
+	       frame->p8023.h_dest[2], frame->p8023.h_dest[3],
+	       frame->p8023.h_dest[4], frame->p8023.h_dest[5]);
+	printk(KERN_DEBUG "  src         = %02x:%02x:%02x:%02x:%02x:%02x\n",
+	       frame->p8023.h_source[0], frame->p8023.h_source[1],
+	       frame->p8023.h_source[2], frame->p8023.h_source[3],
+	       frame->p8023.h_source[4], frame->p8023.h_source[5]);
+	printk(KERN_DEBUG "  len         = 0x%04x\n", frame->p8023.h_proto);
+
+	printk(KERN_DEBUG "IEEE 802.2 LLC/SNAP header:\n");
+	printk(KERN_DEBUG "  DSAP        = 0x%02x\n", frame->p8022.dsap);
+	printk(KERN_DEBUG "  SSAP        = 0x%02x\n", frame->p8022.ssap);
+	printk(KERN_DEBUG "  ctrl        = 0x%02x\n", frame->p8022.ctrl);
+	printk(KERN_DEBUG "  OUI         = %02x:%02x:%02x\n",
+	       frame->p8022.oui[0], frame->p8022.oui[1], frame->p8022.oui[2]);
+	printk(KERN_DEBUG "  ethertype  = 0x%04x\n", frame->ethertype);
+}
+#endif /* 0 */
+
+/********************************************************************/
+/* Module initialization                                            */
+/********************************************************************/
+
+EXPORT_SYMBOL(alloc_orinocodev);
+EXPORT_SYMBOL(free_orinocodev);
+
+EXPORT_SYMBOL(__orinoco_up);
+EXPORT_SYMBOL(__orinoco_down);
+EXPORT_SYMBOL(orinoco_stop);
+EXPORT_SYMBOL(orinoco_reinit_firmware);
+
+EXPORT_SYMBOL(orinoco_interrupt);
+
+/* Can't be declared "const" or the whole __initdata section will
+ * become const */
+static char version[] __initdata = DRIVER_NAME " " DRIVER_VERSION
+	" (David Gibson <hermes@gibson.dropbear.id.au>, "
+	"Pavel Roskin <proski@gnu.org>, et al)";
+
+static int __init init_orinoco(void)
+{
+	printk(KERN_DEBUG "%s\n", version);
+	return 0;
+}
+
+static void __exit exit_orinoco(void)
+{
+}
+
+module_init(init_orinoco);
+module_exit(exit_orinoco);
diff --git a/drivers/net/wireless/orinoco.h b/drivers/net/wireless/orinoco.h
new file mode 100644
index 0000000..13e42c2
--- /dev/null
+++ b/drivers/net/wireless/orinoco.h
@@ -0,0 +1,153 @@
+/* orinoco.h
+ * 
+ * Common definitions to all pieces of the various orinoco
+ * drivers
+ */
+
+#ifndef _ORINOCO_H
+#define _ORINOCO_H
+
+#define DRIVER_VERSION "0.14alpha2"
+
+#include <linux/types.h>
+#include <linux/spinlock.h>
+#include <linux/netdevice.h>
+#include <linux/wireless.h>
+#include <linux/version.h>
+
+#include "hermes.h"
+
+/* To enable debug messages */
+//#define ORINOCO_DEBUG		3
+
+#define WIRELESS_SPY		// enable iwspy support
+
+#define ORINOCO_MAX_KEY_SIZE	14
+#define ORINOCO_MAX_KEYS	4
+
+struct orinoco_key {
+	u16 len;	/* always stored as little-endian */
+	char data[ORINOCO_MAX_KEY_SIZE];
+} __attribute__ ((packed));
+
+typedef enum {
+	FIRMWARE_TYPE_AGERE,
+	FIRMWARE_TYPE_INTERSIL,
+	FIRMWARE_TYPE_SYMBOL
+} fwtype_t;
+
+struct orinoco_private {
+	void *card;	/* Pointer to card dependent structure */
+	int (*hard_reset)(struct orinoco_private *);
+
+	/* Synchronisation stuff */
+	spinlock_t lock;
+	int hw_unavailable;
+	struct work_struct reset_work;
+
+	/* driver state */
+	int open;
+	u16 last_linkstatus;
+
+	/* Net device stuff */
+	struct net_device *ndev;
+	struct net_device_stats stats;
+	struct iw_statistics wstats;
+
+	/* Hardware control variables */
+	hermes_t hw;
+	u16 txfid;
+
+	/* Capabilities of the hardware/firmware */
+	fwtype_t firmware_type;
+	char fw_name[32];
+	int ibss_port;
+	int nicbuf_size;
+	u16 channel_mask;
+
+	/* Boolean capabilities */
+	unsigned int has_ibss:1;
+	unsigned int has_port3:1;
+	unsigned int has_wep:1;
+	unsigned int has_big_wep:1;
+	unsigned int has_mwo:1;
+	unsigned int has_pm:1;
+	unsigned int has_preamble:1;
+	unsigned int has_sensitivity:1;
+	unsigned int broken_disableport:1;
+
+	/* Configuration paramaters */
+	u32 iw_mode;
+	int prefer_port3;
+	u16 wep_on, wep_restrict, tx_key;
+	struct orinoco_key keys[ORINOCO_MAX_KEYS];
+	int bitratemode;
+ 	char nick[IW_ESSID_MAX_SIZE+1];
+	char desired_essid[IW_ESSID_MAX_SIZE+1];
+	u16 frag_thresh, mwo_robust;
+	u16 channel;
+	u16 ap_density, rts_thresh;
+	u16 pm_on, pm_mcast, pm_period, pm_timeout;
+	u16 preamble;
+#ifdef WIRELESS_SPY
+	int			spy_number;
+	u_char			spy_address[IW_MAX_SPY][ETH_ALEN];
+	struct iw_quality	spy_stat[IW_MAX_SPY];
+#endif
+
+	/* Configuration dependent variables */
+	int port_type, createibss;
+	int promiscuous, mc_count;
+};
+
+#ifdef ORINOCO_DEBUG
+extern int orinoco_debug;
+#define DEBUG(n, args...) do { if (orinoco_debug>(n)) printk(KERN_DEBUG args); } while(0)
+#else
+#define DEBUG(n, args...) do { } while (0)
+#endif	/* ORINOCO_DEBUG */
+
+#define TRACE_ENTER(devname) DEBUG(2, "%s: -> %s()\n", devname, __FUNCTION__);
+#define TRACE_EXIT(devname)  DEBUG(2, "%s: <- %s()\n", devname, __FUNCTION__);
+
+/********************************************************************/
+/* Exported prototypes                                              */
+/********************************************************************/
+
+extern struct net_device *alloc_orinocodev(int sizeof_card,
+					   int (*hard_reset)(struct orinoco_private *));
+extern void free_orinocodev(struct net_device *dev);
+extern int __orinoco_up(struct net_device *dev);
+extern int __orinoco_down(struct net_device *dev);
+extern int orinoco_stop(struct net_device *dev);
+extern int orinoco_reinit_firmware(struct net_device *dev);
+extern irqreturn_t orinoco_interrupt(int irq, void * dev_id, struct pt_regs *regs);
+
+/********************************************************************/
+/* Locking and synchronization functions                            */
+/********************************************************************/
+
+/* These functions *must* be inline or they will break horribly on
+ * SPARC, due to its weird semantics for save/restore flags. extern
+ * inline should prevent the kernel from linking or module from
+ * loading if they are not inlined. */
+extern inline int orinoco_lock(struct orinoco_private *priv,
+			       unsigned long *flags)
+{
+	spin_lock_irqsave(&priv->lock, *flags);
+	if (priv->hw_unavailable) {
+		DEBUG(1, "orinoco_lock() called with hw_unavailable (dev=%p)\n",
+		       priv->ndev);
+		spin_unlock_irqrestore(&priv->lock, *flags);
+		return -EBUSY;
+	}
+	return 0;
+}
+
+extern inline void orinoco_unlock(struct orinoco_private *priv,
+				  unsigned long *flags)
+{
+	spin_unlock_irqrestore(&priv->lock, *flags);
+}
+
+#endif /* _ORINOCO_H */
diff --git a/drivers/net/wireless/orinoco_cs.c b/drivers/net/wireless/orinoco_cs.c
new file mode 100644
index 0000000..74a8227
--- /dev/null
+++ b/drivers/net/wireless/orinoco_cs.c
@@ -0,0 +1,636 @@
+/* orinoco_cs.c (formerly known as dldwd_cs.c)
+ *
+ * A driver for "Hermes" chipset based PCMCIA wireless adaptors, such
+ * as the Lucent WavelanIEEE/Orinoco cards and their OEM (Cabletron/
+ * EnteraSys RoamAbout 802.11, ELSA Airlancer, Melco Buffalo and others).
+ * It should also be usable on various Prism II based cards such as the
+ * Linksys, D-Link and Farallon Skyline. It should also work on Symbol
+ * cards such as the 3Com AirConnect and Ericsson WLAN.
+ * 
+ * Copyright notice & release notes in file orinoco.c
+ */
+
+#define DRIVER_NAME "orinoco_cs"
+#define PFX DRIVER_NAME ": "
+
+#include <linux/config.h>
+#ifdef  __IN_PCMCIA_PACKAGE__
+#include <pcmcia/k_compat.h>
+#endif /* __IN_PCMCIA_PACKAGE__ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/sched.h>
+#include <linux/ptrace.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/ioport.h>
+#include <linux/netdevice.h>
+#include <linux/if_arp.h>
+#include <linux/etherdevice.h>
+#include <linux/wireless.h>
+
+#include <pcmcia/version.h>
+#include <pcmcia/cs_types.h>
+#include <pcmcia/cs.h>
+#include <pcmcia/cistpl.h>
+#include <pcmcia/cisreg.h>
+#include <pcmcia/ds.h>
+
+#include <asm/uaccess.h>
+#include <asm/io.h>
+#include <asm/system.h>
+
+#include "orinoco.h"
+
+/********************************************************************/
+/* Module stuff							    */
+/********************************************************************/
+
+MODULE_AUTHOR("David Gibson <hermes@gibson.dropbear.id.au>");
+MODULE_DESCRIPTION("Driver for PCMCIA Lucent Orinoco, Prism II based and similar wireless cards");
+MODULE_LICENSE("Dual MPL/GPL");
+
+/* Module parameters */
+
+/* Some D-Link cards have buggy CIS. They do work at 5v properly, but
+ * don't have any CIS entry for it. This workaround it... */
+static int ignore_cis_vcc; /* = 0 */
+module_param(ignore_cis_vcc, int, 0);
+MODULE_PARM_DESC(ignore_cis_vcc, "Allow voltage mismatch between card and socket");
+
+/********************************************************************/
+/* Magic constants						    */
+/********************************************************************/
+
+/*
+ * The dev_info variable is the "key" that is used to match up this
+ * device driver with appropriate cards, through the card
+ * configuration database.
+ */
+static dev_info_t dev_info = DRIVER_NAME;
+
+/********************************************************************/
+/* Data structures						    */
+/********************************************************************/
+
+/* PCMCIA specific device information (goes in the card field of
+ * struct orinoco_private */
+struct orinoco_pccard {
+	dev_link_t link;
+	dev_node_t node;
+
+	/* Used to handle hard reset */
+	/* yuck, we need this hack to work around the insanity of the
+         * PCMCIA layer */
+	unsigned long hard_reset_in_progress; 
+};
+
+/*
+ * A linked list of "instances" of the device.  Each actual PCMCIA
+ * card corresponds to one device instance, and is described by one
+ * dev_link_t structure (defined in ds.h).
+ */
+static dev_link_t *dev_list; /* = NULL */
+
+/********************************************************************/
+/* Function prototypes						    */
+/********************************************************************/
+
+/* device methods */
+static int orinoco_cs_hard_reset(struct orinoco_private *priv);
+
+/* PCMCIA gumpf */
+static void orinoco_cs_config(dev_link_t * link);
+static void orinoco_cs_release(dev_link_t * link);
+static int orinoco_cs_event(event_t event, int priority,
+			    event_callback_args_t * args);
+
+static dev_link_t *orinoco_cs_attach(void);
+static void orinoco_cs_detach(dev_link_t *);
+
+/********************************************************************/
+/* Device methods     						    */
+/********************************************************************/
+
+static int
+orinoco_cs_hard_reset(struct orinoco_private *priv)
+{
+	struct orinoco_pccard *card = priv->card;
+	dev_link_t *link = &card->link;
+	int err;
+
+	/* We need atomic ops here, because we're not holding the lock */
+	set_bit(0, &card->hard_reset_in_progress);
+
+	err = pcmcia_reset_card(link->handle, NULL);
+	if (err)
+		return err;
+
+	msleep(100);
+	clear_bit(0, &card->hard_reset_in_progress);
+
+	return 0;
+}
+
+/********************************************************************/
+/* PCMCIA stuff     						    */
+/********************************************************************/
+
+/*
+ * This creates an "instance" of the driver, allocating local data
+ * structures for one device.  The device is registered with Card
+ * Services.
+ * 
+ * The dev_link structure is initialized, but we don't actually
+ * configure the card at this point -- we wait until we receive a card
+ * insertion event.  */
+static dev_link_t *
+orinoco_cs_attach(void)
+{
+	struct net_device *dev;
+	struct orinoco_private *priv;
+	struct orinoco_pccard *card;
+	dev_link_t *link;
+	client_reg_t client_reg;
+	int ret;
+
+	dev = alloc_orinocodev(sizeof(*card), orinoco_cs_hard_reset);
+	if (! dev)
+		return NULL;
+	priv = netdev_priv(dev);
+	card = priv->card;
+
+	/* Link both structures together */
+	link = &card->link;
+	link->priv = dev;
+
+	/* Interrupt setup */
+	link->irq.Attributes = IRQ_TYPE_EXCLUSIVE | IRQ_HANDLE_PRESENT;
+	link->irq.IRQInfo1 = IRQ_LEVEL_ID;
+	link->irq.Handler = orinoco_interrupt;
+	link->irq.Instance = dev; 
+
+	/* General socket configuration defaults can go here.  In this
+	 * client, we assume very little, and rely on the CIS for
+	 * almost everything.  In most clients, many details (i.e.,
+	 * number, sizes, and attributes of IO windows) are fixed by
+	 * the nature of the device, and can be hard-wired here. */
+	link->conf.Attributes = 0;
+	link->conf.IntType = INT_MEMORY_AND_IO;
+
+	/* Register with Card Services */
+	/* FIXME: need a lock? */
+	link->next = dev_list;
+	dev_list = link;
+
+	client_reg.dev_info = &dev_info;
+	client_reg.EventMask =
+		CS_EVENT_CARD_INSERTION | CS_EVENT_CARD_REMOVAL |
+		CS_EVENT_RESET_PHYSICAL | CS_EVENT_CARD_RESET |
+		CS_EVENT_PM_SUSPEND | CS_EVENT_PM_RESUME;
+	client_reg.event_handler = &orinoco_cs_event;
+	client_reg.Version = 0x0210; /* FIXME: what does this mean? */
+	client_reg.event_callback_args.client_data = link;
+
+	ret = pcmcia_register_client(&link->handle, &client_reg);
+	if (ret != CS_SUCCESS) {
+		cs_error(link->handle, RegisterClient, ret);
+		orinoco_cs_detach(link);
+		return NULL;
+	}
+
+	return link;
+}				/* orinoco_cs_attach */
+
+/*
+ * This deletes a driver "instance".  The device is de-registered with
+ * Card Services.  If it has been released, all local data structures
+ * are freed.  Otherwise, the structures will be freed when the device
+ * is released.
+ */
+static void orinoco_cs_detach(dev_link_t *link)
+{
+	dev_link_t **linkp;
+	struct net_device *dev = link->priv;
+
+	/* Locate device structure */
+	for (linkp = &dev_list; *linkp; linkp = &(*linkp)->next)
+		if (*linkp == link)
+			break;
+
+	BUG_ON(*linkp == NULL);
+
+	if (link->state & DEV_CONFIG)
+		orinoco_cs_release(link);
+
+	/* Break the link with Card Services */
+	if (link->handle)
+		pcmcia_deregister_client(link->handle);
+
+	/* Unlink device structure, and free it */
+	*linkp = link->next;
+	DEBUG(0, PFX "detach: link=%p link->dev=%p\n", link, link->dev);
+	if (link->dev) {
+		DEBUG(0, PFX "About to unregister net device %p\n",
+		      dev);
+		unregister_netdev(dev);
+	}
+	free_orinocodev(dev);
+}				/* orinoco_cs_detach */
+
+/*
+ * orinoco_cs_config() is scheduled to run after a CARD_INSERTION
+ * event is received, to configure the PCMCIA socket, and to make the
+ * device available to the system.
+ */
+
+#define CS_CHECK(fn, ret) do { \
+		last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; \
+	} while (0)
+
+static void
+orinoco_cs_config(dev_link_t *link)
+{
+	struct net_device *dev = link->priv;
+	client_handle_t handle = link->handle;
+	struct orinoco_private *priv = netdev_priv(dev);
+	struct orinoco_pccard *card = priv->card;
+	hermes_t *hw = &priv->hw;
+	int last_fn, last_ret;
+	u_char buf[64];
+	config_info_t conf;
+	cisinfo_t info;
+	tuple_t tuple;
+	cisparse_t parse;
+	void __iomem *mem;
+
+	CS_CHECK(ValidateCIS, pcmcia_validate_cis(handle, &info));
+
+	/*
+	 * This reads the card's CONFIG tuple to find its
+	 * configuration registers.
+	 */
+	tuple.DesiredTuple = CISTPL_CONFIG;
+	tuple.Attributes = 0;
+	tuple.TupleData = buf;
+	tuple.TupleDataMax = sizeof(buf);
+	tuple.TupleOffset = 0;
+	CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+	CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
+	CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+	link->conf.ConfigBase = parse.config.base;
+	link->conf.Present = parse.config.rmask[0];
+
+	/* Configure card */
+	link->state |= DEV_CONFIG;
+
+	/* Look up the current Vcc */
+	CS_CHECK(GetConfigurationInfo,
+		 pcmcia_get_configuration_info(handle, &conf));
+	link->conf.Vcc = conf.Vcc;
+
+	/*
+	 * In this loop, we scan the CIS for configuration table
+	 * entries, each of which describes a valid card
+	 * configuration, including voltage, IO window, memory window,
+	 * and interrupt settings.
+	 *
+	 * We make no assumptions about the card to be configured: we
+	 * use just the information available in the CIS.  In an ideal
+	 * world, this would work for any PCMCIA card, but it requires
+	 * a complete and accurate CIS.  In practice, a driver usually
+	 * "knows" most of these things without consulting the CIS,
+	 * and most client drivers will only use the CIS to fill in
+	 * implementation-defined details.
+	 */
+	tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
+	CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+	while (1) {
+		cistpl_cftable_entry_t *cfg = &(parse.cftable_entry);
+		cistpl_cftable_entry_t dflt = { .index = 0 };
+
+		if ( (pcmcia_get_tuple_data(handle, &tuple) != 0)
+		    || (pcmcia_parse_tuple(handle, &tuple, &parse) != 0))
+			goto next_entry;
+
+		if (cfg->flags & CISTPL_CFTABLE_DEFAULT)
+			dflt = *cfg;
+		if (cfg->index == 0)
+			goto next_entry;
+		link->conf.ConfigIndex = cfg->index;
+
+		/* Does this card need audio output? */
+		if (cfg->flags & CISTPL_CFTABLE_AUDIO) {
+			link->conf.Attributes |= CONF_ENABLE_SPKR;
+			link->conf.Status = CCSR_AUDIO_ENA;
+		}
+
+		/* Use power settings for Vcc and Vpp if present */
+		/* Note that the CIS values need to be rescaled */
+		if (cfg->vcc.present & (1 << CISTPL_POWER_VNOM)) {
+			if (conf.Vcc != cfg->vcc.param[CISTPL_POWER_VNOM] / 10000) {
+				DEBUG(2, "orinoco_cs_config: Vcc mismatch (conf.Vcc = %d, CIS = %d)\n",  conf.Vcc, cfg->vcc.param[CISTPL_POWER_VNOM] / 10000);
+				if (!ignore_cis_vcc)
+					goto next_entry;
+			}
+		} else if (dflt.vcc.present & (1 << CISTPL_POWER_VNOM)) {
+			if (conf.Vcc != dflt.vcc.param[CISTPL_POWER_VNOM] / 10000) {
+				DEBUG(2, "orinoco_cs_config: Vcc mismatch (conf.Vcc = %d, CIS = %d)\n",  conf.Vcc, dflt.vcc.param[CISTPL_POWER_VNOM] / 10000);
+				if(!ignore_cis_vcc)
+					goto next_entry;
+			}
+		}
+
+		if (cfg->vpp1.present & (1 << CISTPL_POWER_VNOM))
+			link->conf.Vpp1 = link->conf.Vpp2 =
+			    cfg->vpp1.param[CISTPL_POWER_VNOM] / 10000;
+		else if (dflt.vpp1.present & (1 << CISTPL_POWER_VNOM))
+			link->conf.Vpp1 = link->conf.Vpp2 =
+			    dflt.vpp1.param[CISTPL_POWER_VNOM] / 10000;
+		
+		/* Do we need to allocate an interrupt? */
+		link->conf.Attributes |= CONF_ENABLE_IRQ;
+
+		/* IO window settings */
+		link->io.NumPorts1 = link->io.NumPorts2 = 0;
+		if ((cfg->io.nwin > 0) || (dflt.io.nwin > 0)) {
+			cistpl_io_t *io =
+			    (cfg->io.nwin) ? &cfg->io : &dflt.io;
+			link->io.Attributes1 = IO_DATA_PATH_WIDTH_AUTO;
+			if (!(io->flags & CISTPL_IO_8BIT))
+				link->io.Attributes1 =
+				    IO_DATA_PATH_WIDTH_16;
+			if (!(io->flags & CISTPL_IO_16BIT))
+				link->io.Attributes1 =
+				    IO_DATA_PATH_WIDTH_8;
+			link->io.IOAddrLines =
+			    io->flags & CISTPL_IO_LINES_MASK;
+			link->io.BasePort1 = io->win[0].base;
+			link->io.NumPorts1 = io->win[0].len;
+			if (io->nwin > 1) {
+				link->io.Attributes2 =
+				    link->io.Attributes1;
+				link->io.BasePort2 = io->win[1].base;
+				link->io.NumPorts2 = io->win[1].len;
+			}
+
+			/* This reserves IO space but doesn't actually enable it */
+			if (pcmcia_request_io(link->handle, &link->io) != 0)
+				goto next_entry;
+		}
+
+
+		/* If we got this far, we're cool! */
+
+		break;
+		
+	next_entry:
+		if (link->io.NumPorts1)
+			pcmcia_release_io(link->handle, &link->io);
+		last_ret = pcmcia_get_next_tuple(handle, &tuple);
+		if (last_ret  == CS_NO_MORE_ITEMS) {
+			printk(KERN_ERR PFX "GetNextTuple(): No matching "
+			       "CIS configuration.  Maybe you need the "
+			       "ignore_cis_vcc=1 parameter.\n");
+			goto cs_failed;
+		}
+	}
+
+	/*
+	 * Allocate an interrupt line.  Note that this does not assign
+	 * a handler to the interrupt, unless the 'Handler' member of
+	 * the irq structure is initialized.
+	 */
+	CS_CHECK(RequestIRQ, pcmcia_request_irq(link->handle, &link->irq));
+
+	/* We initialize the hermes structure before completing PCMCIA
+	 * configuration just in case the interrupt handler gets
+	 * called. */
+	mem = ioport_map(link->io.BasePort1, link->io.NumPorts1);
+	if (!mem)
+		goto cs_failed;
+
+	hermes_struct_init(hw, mem, HERMES_16BIT_REGSPACING);
+
+	/*
+	 * This actually configures the PCMCIA socket -- setting up
+	 * the I/O windows and the interrupt mapping, and putting the
+	 * card and host interface into "Memory and IO" mode.
+	 */
+	CS_CHECK(RequestConfiguration,
+		 pcmcia_request_configuration(link->handle, &link->conf));
+
+	/* Ok, we have the configuration, prepare to register the netdev */
+	dev->base_addr = link->io.BasePort1;
+	dev->irq = link->irq.AssignedIRQ;
+	SET_MODULE_OWNER(dev);
+	card->node.major = card->node.minor = 0;
+
+	SET_NETDEV_DEV(dev, &handle_to_dev(handle));
+	/* Tell the stack we exist */
+	if (register_netdev(dev) != 0) {
+		printk(KERN_ERR PFX "register_netdev() failed\n");
+		goto failed;
+	}
+
+	/* At this point, the dev_node_t structure(s) needs to be
+	 * initialized and arranged in a linked list at link->dev. */
+	strcpy(card->node.dev_name, dev->name);
+	link->dev = &card->node; /* link->dev being non-NULL is also
+                                    used to indicate that the
+                                    net_device has been registered */
+	link->state &= ~DEV_CONFIG_PENDING;
+
+	/* Finally, report what we've done */
+	printk(KERN_DEBUG "%s: index 0x%02x: Vcc %d.%d",
+	       dev->name, link->conf.ConfigIndex,
+	       link->conf.Vcc / 10, link->conf.Vcc % 10);
+	if (link->conf.Vpp1)
+		printk(", Vpp %d.%d", link->conf.Vpp1 / 10,
+		       link->conf.Vpp1 % 10);
+	printk(", irq %d", link->irq.AssignedIRQ);
+	if (link->io.NumPorts1)
+		printk(", io 0x%04x-0x%04x", link->io.BasePort1,
+		       link->io.BasePort1 + link->io.NumPorts1 - 1);
+	if (link->io.NumPorts2)
+		printk(" & 0x%04x-0x%04x", link->io.BasePort2,
+		       link->io.BasePort2 + link->io.NumPorts2 - 1);
+	printk("\n");
+
+	return;
+
+ cs_failed:
+	cs_error(link->handle, last_fn, last_ret);
+
+ failed:
+	orinoco_cs_release(link);
+}				/* orinoco_cs_config */
+
+/*
+ * After a card is removed, orinoco_cs_release() will unregister the
+ * device, and release the PCMCIA configuration.  If the device is
+ * still open, this will be postponed until it is closed.
+ */
+static void
+orinoco_cs_release(dev_link_t *link)
+{
+	struct net_device *dev = link->priv;
+	struct orinoco_private *priv = netdev_priv(dev);
+	unsigned long flags;
+
+	/* We're committed to taking the device away now, so mark the
+	 * hardware as unavailable */
+	spin_lock_irqsave(&priv->lock, flags);
+	priv->hw_unavailable++;
+	spin_unlock_irqrestore(&priv->lock, flags);
+
+	/* Don't bother checking to see if these succeed or not */
+	pcmcia_release_configuration(link->handle);
+	if (link->io.NumPorts1)
+		pcmcia_release_io(link->handle, &link->io);
+	if (link->irq.AssignedIRQ)
+		pcmcia_release_irq(link->handle, &link->irq);
+	link->state &= ~DEV_CONFIG;
+	if (priv->hw.iobase)
+		ioport_unmap(priv->hw.iobase);
+}				/* orinoco_cs_release */
+
+/*
+ * The card status event handler.  Mostly, this schedules other stuff
+ * to run after an event is received.
+ */
+static int
+orinoco_cs_event(event_t event, int priority,
+		       event_callback_args_t * args)
+{
+	dev_link_t *link = args->client_data;
+	struct net_device *dev = link->priv;
+	struct orinoco_private *priv = netdev_priv(dev);
+	struct orinoco_pccard *card = priv->card;
+	int err = 0;
+	unsigned long flags;
+
+	switch (event) {
+	case CS_EVENT_CARD_REMOVAL:
+		link->state &= ~DEV_PRESENT;
+		if (link->state & DEV_CONFIG) {
+			unsigned long flags;
+
+			spin_lock_irqsave(&priv->lock, flags);
+			netif_device_detach(dev);
+			priv->hw_unavailable++;
+			spin_unlock_irqrestore(&priv->lock, flags);
+		}
+		break;
+
+	case CS_EVENT_CARD_INSERTION:
+		link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
+		orinoco_cs_config(link);
+		break;
+
+	case CS_EVENT_PM_SUSPEND:
+		link->state |= DEV_SUSPEND;
+		/* Fall through... */
+	case CS_EVENT_RESET_PHYSICAL:
+		/* Mark the device as stopped, to block IO until later */
+		if (link->state & DEV_CONFIG) {
+			/* This is probably racy, but I can't think of
+                           a better way, short of rewriting the PCMCIA
+                           layer to not suck :-( */
+			if (! test_bit(0, &card->hard_reset_in_progress)) {
+				spin_lock_irqsave(&priv->lock, flags);
+
+				err = __orinoco_down(dev);
+				if (err)
+					printk(KERN_WARNING "%s: %s: Error %d downing interface\n",
+					       dev->name,
+					       event == CS_EVENT_PM_SUSPEND ? "SUSPEND" : "RESET_PHYSICAL",
+					       err);
+				
+				netif_device_detach(dev);
+				priv->hw_unavailable++;
+
+				spin_unlock_irqrestore(&priv->lock, flags);
+			}
+
+			pcmcia_release_configuration(link->handle);
+		}
+		break;
+
+	case CS_EVENT_PM_RESUME:
+		link->state &= ~DEV_SUSPEND;
+		/* Fall through... */
+	case CS_EVENT_CARD_RESET:
+		if (link->state & DEV_CONFIG) {
+			/* FIXME: should we double check that this is
+			 * the same card as we had before */
+			pcmcia_request_configuration(link->handle, &link->conf);
+
+			if (! test_bit(0, &card->hard_reset_in_progress)) {
+				err = orinoco_reinit_firmware(dev);
+				if (err) {
+					printk(KERN_ERR "%s: Error %d re-initializing firmware\n",
+					       dev->name, err);
+					break;
+				}
+				
+				spin_lock_irqsave(&priv->lock, flags);
+				
+				netif_device_attach(dev);
+				priv->hw_unavailable--;
+				
+				if (priv->open && ! priv->hw_unavailable) {
+					err = __orinoco_up(dev);
+					if (err)
+						printk(KERN_ERR "%s: Error %d restarting card\n",
+						       dev->name, err);
+					
+				}
+
+				spin_unlock_irqrestore(&priv->lock, flags);
+			}
+		}
+		break;
+	}
+
+	return err;
+}				/* orinoco_cs_event */
+
+/********************************************************************/
+/* Module initialization					    */
+/********************************************************************/
+
+/* Can't be declared "const" or the whole __initdata section will
+ * become const */
+static char version[] __initdata = DRIVER_NAME " " DRIVER_VERSION
+	" (David Gibson <hermes@gibson.dropbear.id.au>, "
+	"Pavel Roskin <proski@gnu.org>, et al)";
+
+static struct pcmcia_driver orinoco_driver = {
+	.owner		= THIS_MODULE,
+	.drv		= {
+		.name	= DRIVER_NAME,
+	},
+	.attach		= orinoco_cs_attach,
+	.detach		= orinoco_cs_detach,
+};
+
+static int __init
+init_orinoco_cs(void)
+{
+	printk(KERN_DEBUG "%s\n", version);
+
+	return pcmcia_register_driver(&orinoco_driver);
+}
+
+static void __exit
+exit_orinoco_cs(void)
+{
+	pcmcia_unregister_driver(&orinoco_driver);
+	BUG_ON(dev_list != NULL);
+}
+
+module_init(init_orinoco_cs);
+module_exit(exit_orinoco_cs);
diff --git a/drivers/net/wireless/orinoco_pci.c b/drivers/net/wireless/orinoco_pci.c
new file mode 100644
index 0000000..ff30d37e
--- /dev/null
+++ b/drivers/net/wireless/orinoco_pci.c
@@ -0,0 +1,417 @@
+/* orinoco_pci.c
+ * 
+ * Driver for Prism II devices that have a direct PCI interface
+ * (i.e., not in a Pcmcia or PLX bridge)
+ *
+ * Specifically here we're talking about the Linksys WMP11
+ *
+ * Current maintainers (as of 29 September 2003) are:
+ * 	Pavel Roskin <proski AT gnu.org>
+ * and	David Gibson <hermes AT gibson.dropbear.id.au>
+ *
+ * Some of this code is borrowed from orinoco_plx.c
+ *	Copyright (C) 2001 Daniel Barlow <dan AT telent.net>
+ * Some of this code is "inspired" by linux-wlan-ng-0.1.10, but nothing
+ * has been copied from it. linux-wlan-ng-0.1.10 is originally :
+ *	Copyright (C) 1999 AbsoluteValue Systems, Inc.  All Rights Reserved.
+ * This file originally written by:
+ *	Copyright (C) 2001 Jean Tourrilhes <jt AT hpl.hp.com>
+ * And is now maintained by:
+ *	(C) Copyright David Gibson, IBM Corp. 2002-2003.
+ *
+ * The contents of this file are subject to the Mozilla Public License
+ * Version 1.1 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License
+ * at http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS"
+ * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+ * the License for the specific language governing rights and
+ * limitations under the License.
+ *
+ * Alternatively, the contents of this file may be used under the
+ * terms of the GNU General Public License version 2 (the "GPL"), in
+ * which case the provisions of the GPL are applicable instead of the
+ * above.  If you wish to allow the use of your version of this file
+ * only under the terms of the GPL and not to allow others to use your
+ * version of this file under the MPL, indicate your decision by
+ * deleting the provisions above and replace them with the notice and
+ * other provisions required by the GPL.  If you do not delete the
+ * provisions above, a recipient may use your version of this file
+ * under either the MPL or the GPL.
+ */
+
+/*
+ * Theory of operation...
+ * -------------------
+ * Maybe you had a look in orinoco_plx. Well, this is totally different...
+ *
+ * The card contains only one PCI region, which contains all the usual
+ * hermes registers.
+ *
+ * The driver will memory map this region in normal memory. Because
+ * the hermes registers are mapped in normal memory and not in ISA I/O
+ * post space, we can't use the usual inw/outw macros and we need to
+ * use readw/writew.
+ * This slight difference force us to compile our own version of
+ * hermes.c with the register access macro changed. That's a bit
+ * hackish but works fine.
+ *
+ * Note that the PCI region is pretty big (4K). That's much more than
+ * the usual set of hermes register (0x0 -> 0x3E). I've got a strong
+ * suspicion that the whole memory space of the adapter is in fact in
+ * this region. Accessing directly the adapter memory instead of going
+ * through the usual register would speed up significantely the
+ * operations...
+ *
+ * Finally, the card looks like this :
+-----------------------
+  Bus  0, device  14, function  0:
+    Network controller: PCI device 1260:3873 (Harris Semiconductor) (rev 1).
+      IRQ 11.
+      Master Capable.  Latency=248.  
+      Prefetchable 32 bit memory at 0xffbcc000 [0xffbccfff].
+-----------------------
+00:0e.0 Network controller: Harris Semiconductor: Unknown device 3873 (rev 01)
+        Subsystem: Unknown device 1737:3874
+        Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B-
+        Status: Cap+ 66Mhz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR-
+        Latency: 248 set, cache line size 08
+        Interrupt: pin A routed to IRQ 11
+        Region 0: Memory at ffbcc000 (32-bit, prefetchable) [size=4K]
+        Capabilities: [dc] Power Management version 2
+                Flags: PMEClk- AuxPwr- DSI- D1+ D2+ PME+
+                Status: D0 PME-Enable- DSel=0 DScale=0 PME-
+-----------------------
+ *
+ * That's all..
+ *
+ * Jean II
+ */
+
+#define DRIVER_NAME "orinoco_pci"
+#define PFX DRIVER_NAME ": "
+
+#include <linux/config.h>
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/sched.h>
+#include <linux/ptrace.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/timer.h>
+#include <linux/ioport.h>
+#include <linux/netdevice.h>
+#include <linux/if_arp.h>
+#include <linux/etherdevice.h>
+#include <linux/list.h>
+#include <linux/pci.h>
+#include <linux/fcntl.h>
+
+#include <asm/uaccess.h>
+#include <asm/io.h>
+#include <asm/system.h>
+
+#include "hermes.h"
+#include "orinoco.h"
+
+/* All the magic there is from wlan-ng */
+/* Magic offset of the reset register of the PCI card */
+#define HERMES_PCI_COR		(0x26)
+/* Magic bitmask to reset the card */
+#define HERMES_PCI_COR_MASK	(0x0080)
+/* Magic timeouts for doing the reset.
+ * Those times are straight from wlan-ng, and it is claimed that they
+ * are necessary. Alan will kill me. Take your time and grab a coffee. */
+#define HERMES_PCI_COR_ONT	(250)		/* ms */
+#define HERMES_PCI_COR_OFFT	(500)		/* ms */
+#define HERMES_PCI_COR_BUSYT	(500)		/* ms */
+
+/* Orinoco PCI specific data */
+struct orinoco_pci_card {
+	void __iomem *pci_ioaddr;
+};
+
+/*
+ * Do a soft reset of the PCI card using the Configuration Option Register
+ * We need this to get going...
+ * This is the part of the code that is strongly inspired from wlan-ng
+ *
+ * Note : This code is done with irq enabled. This mean that many
+ * interrupts will occur while we are there. This is why we use the
+ * jiffies to regulate time instead of a straight mdelay(). Usually we
+ * need only around 245 iteration of the loop to do 250 ms delay.
+ *
+ * Note bis : Don't try to access HERMES_CMD during the reset phase.
+ * It just won't work !
+ */
+static int
+orinoco_pci_cor_reset(struct orinoco_private *priv)
+{
+	hermes_t *hw = &priv->hw;
+	unsigned long	timeout;
+	u16	reg;
+
+	/* Assert the reset until the card notice */
+	hermes_write_regn(hw, PCI_COR, HERMES_PCI_COR_MASK);
+	mdelay(HERMES_PCI_COR_ONT);
+
+	/* Give time for the card to recover from this hard effort */
+	hermes_write_regn(hw, PCI_COR, 0x0000);
+	mdelay(HERMES_PCI_COR_OFFT);
+
+	/* The card is ready when it's no longer busy */
+	timeout = jiffies + (HERMES_PCI_COR_BUSYT * HZ / 1000);
+	reg = hermes_read_regn(hw, CMD);
+	while (time_before(jiffies, timeout) && (reg & HERMES_CMD_BUSY)) {
+		mdelay(1);
+		reg = hermes_read_regn(hw, CMD);
+	}
+
+	/* Still busy? */
+	if (reg & HERMES_CMD_BUSY) {
+		printk(KERN_ERR PFX "Busy timeout\n");
+		return -ETIMEDOUT;
+	}
+
+	return 0;
+}
+
+/*
+ * Initialise a card. Mostly similar to PLX code.
+ */
+static int orinoco_pci_init_one(struct pci_dev *pdev,
+				const struct pci_device_id *ent)
+{
+	int err = 0;
+	unsigned long pci_iorange;
+	u16 __iomem *pci_ioaddr = NULL;
+	unsigned long pci_iolen;
+	struct orinoco_private *priv = NULL;
+	struct orinoco_pci_card *card;
+	struct net_device *dev = NULL;
+
+	err = pci_enable_device(pdev);
+	if (err) {
+		printk(KERN_ERR PFX "Cannot enable PCI device\n");
+		return err;
+	}
+
+	err = pci_request_regions(pdev, DRIVER_NAME);
+	if (err != 0) {
+		printk(KERN_ERR PFX "Cannot obtain PCI resources\n");
+		goto fail_resources;
+	}
+
+	/* Resource 0 is mapped to the hermes registers */
+	pci_iorange = pci_resource_start(pdev, 0);
+	pci_iolen = pci_resource_len(pdev, 0);
+	pci_ioaddr = ioremap(pci_iorange, pci_iolen);
+	if (!pci_iorange) {
+		printk(KERN_ERR PFX "Cannot remap hardware registers\n");
+		goto fail_map;
+	}
+
+	/* Allocate network device */
+	dev = alloc_orinocodev(sizeof(*card), orinoco_pci_cor_reset);
+	if (! dev) {
+		err = -ENOMEM;
+		goto fail_alloc;
+	}
+
+	priv = netdev_priv(dev);
+	card = priv->card;
+	card->pci_ioaddr = pci_ioaddr;
+	dev->mem_start = pci_iorange;
+	dev->mem_end = pci_iorange + pci_iolen - 1;
+	SET_MODULE_OWNER(dev);
+	SET_NETDEV_DEV(dev, &pdev->dev);
+
+	hermes_struct_init(&priv->hw, pci_ioaddr, HERMES_32BIT_REGSPACING);
+
+	printk(KERN_DEBUG PFX "Detected device %s, mem:0x%lx-0x%lx, irq %d\n",
+	       pci_name(pdev), dev->mem_start, dev->mem_end, pdev->irq);
+
+	err = request_irq(pdev->irq, orinoco_interrupt, SA_SHIRQ,
+			  dev->name, dev);
+	if (err) {
+		printk(KERN_ERR PFX "Cannot allocate IRQ %d\n", pdev->irq);
+		err = -EBUSY;
+		goto fail_irq;
+	}
+	dev->irq = pdev->irq;
+
+	/* Perform a COR reset to start the card */
+	err = orinoco_pci_cor_reset(priv);
+	if (err) {
+		printk(KERN_ERR PFX "Initial reset failed\n");
+		goto fail;
+	}
+
+	err = register_netdev(dev);
+	if (err) {
+		printk(KERN_ERR PFX "Failed to register net device\n");
+		goto fail;
+	}
+
+	pci_set_drvdata(pdev, dev);
+
+	return 0;
+
+ fail:
+	free_irq(pdev->irq, dev);
+
+ fail_irq:
+	pci_set_drvdata(pdev, NULL);
+	free_orinocodev(dev);
+
+ fail_alloc:
+	iounmap(pci_ioaddr);
+
+ fail_map:
+	pci_release_regions(pdev);
+
+ fail_resources:
+	pci_disable_device(pdev);
+
+	return err;
+}
+
+static void __devexit orinoco_pci_remove_one(struct pci_dev *pdev)
+{
+	struct net_device *dev = pci_get_drvdata(pdev);
+	struct orinoco_private *priv = netdev_priv(dev);
+	struct orinoco_pci_card *card = priv->card;
+
+	unregister_netdev(dev);
+	free_irq(dev->irq, dev);
+	pci_set_drvdata(pdev, NULL);
+	free_orinocodev(dev);
+	iounmap(card->pci_ioaddr);
+	pci_release_regions(pdev);
+	pci_disable_device(pdev);
+}
+
+static int orinoco_pci_suspend(struct pci_dev *pdev, u32 state)
+{
+	struct net_device *dev = pci_get_drvdata(pdev);
+	struct orinoco_private *priv = netdev_priv(dev);
+	unsigned long flags;
+	int err;
+	
+	printk(KERN_DEBUG "%s: Orinoco-PCI entering sleep mode (state=%d)\n",
+	       dev->name, state);
+
+	err = orinoco_lock(priv, &flags);
+	if (err) {
+		printk(KERN_ERR "%s: hw_unavailable on orinoco_pci_suspend\n",
+		       dev->name);
+		return err;
+	}
+
+	err = __orinoco_down(dev);
+	if (err)
+		printk(KERN_WARNING "%s: orinoco_pci_suspend(): Error %d downing interface\n",
+		       dev->name, err);
+	
+	netif_device_detach(dev);
+
+	priv->hw_unavailable++;
+	
+	orinoco_unlock(priv, &flags);
+
+	pci_save_state(pdev);
+	pci_set_power_state(pdev, 3);
+
+	return 0;
+}
+
+static int orinoco_pci_resume(struct pci_dev *pdev)
+{
+	struct net_device *dev = pci_get_drvdata(pdev);
+	struct orinoco_private *priv = netdev_priv(dev);
+	unsigned long flags;
+	int err;
+
+	printk(KERN_DEBUG "%s: Orinoco-PCI waking up\n", dev->name);
+
+	pci_set_power_state(pdev, 0);
+	pci_restore_state(pdev);
+
+	err = orinoco_reinit_firmware(dev);
+	if (err) {
+		printk(KERN_ERR "%s: Error %d re-initializing firmware on orinoco_pci_resume()\n",
+		       dev->name, err);
+		return err;
+	}
+
+	spin_lock_irqsave(&priv->lock, flags);
+
+	netif_device_attach(dev);
+
+	priv->hw_unavailable--;
+
+	if (priv->open && (! priv->hw_unavailable)) {
+		err = __orinoco_up(dev);
+		if (err)
+			printk(KERN_ERR "%s: Error %d restarting card on orinoco_pci_resume()\n",
+			       dev->name, err);
+	}
+	
+	spin_unlock_irqrestore(&priv->lock, flags);
+
+	return 0;
+}
+
+static struct pci_device_id orinoco_pci_pci_id_table[] = {
+	/* Intersil Prism 3 */
+	{0x1260, 0x3872, PCI_ANY_ID, PCI_ANY_ID,},
+	/* Intersil Prism 2.5 */
+	{0x1260, 0x3873, PCI_ANY_ID, PCI_ANY_ID,},
+	/* Samsung MagicLAN SWL-2210P */
+	{0x167d, 0xa000, PCI_ANY_ID, PCI_ANY_ID,},
+	{0,},
+};
+
+MODULE_DEVICE_TABLE(pci, orinoco_pci_pci_id_table);
+
+static struct pci_driver orinoco_pci_driver = {
+	.name		= DRIVER_NAME,
+	.id_table	= orinoco_pci_pci_id_table,
+	.probe		= orinoco_pci_init_one,
+	.remove		= __devexit_p(orinoco_pci_remove_one),
+	.suspend	= orinoco_pci_suspend,
+	.resume		= orinoco_pci_resume,
+};
+
+static char version[] __initdata = DRIVER_NAME " " DRIVER_VERSION
+	" (Pavel Roskin <proski@gnu.org>,"
+	" David Gibson <hermes@gibson.dropbear.id.au> &"
+	" Jean Tourrilhes <jt@hpl.hp.com>)";
+MODULE_AUTHOR("Pavel Roskin <proski@gnu.org> & David Gibson <hermes@gibson.dropbear.id.au>");
+MODULE_DESCRIPTION("Driver for wireless LAN cards using direct PCI interface");
+MODULE_LICENSE("Dual MPL/GPL");
+
+static int __init orinoco_pci_init(void)
+{
+	printk(KERN_DEBUG "%s\n", version);
+	return pci_module_init(&orinoco_pci_driver);
+}
+
+static void __exit orinoco_pci_exit(void)
+{
+	pci_unregister_driver(&orinoco_pci_driver);
+}
+
+module_init(orinoco_pci_init);
+module_exit(orinoco_pci_exit);
+
+/*
+ * Local variables:
+ *  c-indent-level: 8
+ *  c-basic-offset: 8
+ *  tab-width: 8
+ * End:
+ */
diff --git a/drivers/net/wireless/orinoco_plx.c b/drivers/net/wireless/orinoco_plx.c
new file mode 100644
index 0000000..7ab05b8
--- /dev/null
+++ b/drivers/net/wireless/orinoco_plx.c
@@ -0,0 +1,419 @@
+/* orinoco_plx.c
+ *
+ * Driver for Prism II devices which would usually be driven by orinoco_cs,
+ * but are connected to the PCI bus by a PLX9052.
+ *
+ * Current maintainers (as of 29 September 2003) are:
+ * 	Pavel Roskin <proski AT gnu.org>
+ * and	David Gibson <hermes AT gibson.dropbear.id.au>
+ *
+ * (C) Copyright David Gibson, IBM Corp. 2001-2003.
+ * Copyright (C) 2001 Daniel Barlow
+ *
+ * The contents of this file are subject to the Mozilla Public License
+ * Version 1.1 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License
+ * at http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS"
+ * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+ * the License for the specific language governing rights and
+ * limitations under the License.
+ *
+ * Alternatively, the contents of this file may be used under the
+ * terms of the GNU General Public License version 2 (the "GPL"), in
+ * which case the provisions of the GPL are applicable instead of the
+ * above.  If you wish to allow the use of your version of this file
+ * only under the terms of the GPL and not to allow others to use your
+ * version of this file under the MPL, indicate your decision by
+ * deleting the provisions above and replace them with the notice and
+ * other provisions required by the GPL.  If you do not delete the
+ * provisions above, a recipient may use your version of this file
+ * under either the MPL or the GPL.
+
+ * Caution: this is experimental and probably buggy.  For success and
+ * failure reports for different cards and adaptors, see
+ * orinoco_plx_pci_id_table near the end of the file.  If you have a
+ * card we don't have the PCI id for, and looks like it should work,
+ * drop me mail with the id and "it works"/"it doesn't work".
+ *
+ * Note: if everything gets detected fine but it doesn't actually send
+ * or receive packets, your first port of call should probably be to
+ * try newer firmware in the card.  Especially if you're doing Ad-Hoc
+ * modes.
+ *
+ * The actual driving is done by orinoco.c, this is just resource
+ * allocation stuff.  The explanation below is courtesy of Ryan Niemi
+ * on the linux-wlan-ng list at
+ * http://archives.neohapsis.com/archives/dev/linux-wlan/2001-q1/0026.html
+ *
+ * The PLX9052-based cards (WL11000 and several others) are a
+ * different beast than the usual PCMCIA-based PRISM2 configuration
+ * expected by wlan-ng.  Here's the general details on how the WL11000
+ * PCI adapter works:
+ *
+ * - Two PCI I/O address spaces, one 0x80 long which contains the
+ * PLX9052 registers, and one that's 0x40 long mapped to the PCMCIA
+ * slot I/O address space.
+ *
+ * - One PCI memory address space, mapped to the PCMCIA memory space
+ * (containing the CIS).
+ *
+ * After identifying the I/O and memory space, you can read through
+ * the memory space to confirm the CIS's device ID or manufacturer ID
+ * to make sure it's the expected card.  qKeep in mind that the PCMCIA
+ * spec specifies the CIS as the lower 8 bits of each word read from
+ * the CIS, so to read the bytes of the CIS, read every other byte
+ * (0,2,4,...). Passing that test, you need to enable the I/O address
+ * space on the PCMCIA card via the PCMCIA COR register. This is the
+ * first byte following the CIS. In my case (which may not have any
+ * relation to what's on the PRISM2 cards), COR was at offset 0x800
+ * within the PCI memory space. Write 0x41 to the COR register to
+ * enable I/O mode and to select level triggered interrupts. To
+ * confirm you actually succeeded, read the COR register back and make
+ * sure it actually got set to 0x41, incase you have an unexpected
+ * card inserted.
+ *
+ * Following that, you can treat the second PCI I/O address space (the
+ * one that's not 0x80 in length) as the PCMCIA I/O space.
+ *
+ * Note that in the Eumitcom's source for their drivers, they register
+ * the interrupt as edge triggered when registering it with the
+ * Windows kernel. I don't recall how to register edge triggered on
+ * Linux (if it can be done at all). But in some experimentation, I
+ * don't see much operational difference between using either
+ * interrupt mode. Don't mess with the interrupt mode in the COR
+ * register though, as the PLX9052 wants level triggers with the way
+ * the serial EEPROM configures it on the WL11000.
+ *
+ * There's some other little quirks related to timing that I bumped
+ * into, but I don't recall right now. Also, there's two variants of
+ * the WL11000 I've seen, revision A1 and T2. These seem to differ
+ * slightly in the timings configured in the wait-state generator in
+ * the PLX9052. There have also been some comments from Eumitcom that
+ * cards shouldn't be hot swapped, apparently due to risk of cooking
+ * the PLX9052. I'm unsure why they believe this, as I can't see
+ * anything in the design that would really cause a problem, except
+ * for crashing drivers not written to expect it. And having developed
+ * drivers for the WL11000, I'd say it's quite tricky to write code
+ * that will successfully deal with a hot unplug. Very odd things
+ * happen on the I/O side of things. But anyway, be warned. Despite
+ * that, I've hot-swapped a number of times during debugging and
+ * driver development for various reasons (stuck WAIT# line after the
+ * radio card's firmware locks up).
+ *
+ * Hope this is enough info for someone to add PLX9052 support to the
+ * wlan-ng card. In the case of the WL11000, the PCI ID's are
+ * 0x1639/0x0200, with matching subsystem ID's. Other PLX9052-based
+ * manufacturers other than Eumitcom (or on cards other than the
+ * WL11000) may have different PCI ID's.
+ *
+ * If anyone needs any more specific info, let me know. I haven't had
+ * time to implement support myself yet, and with the way things are
+ * going, might not have time for a while..
+ */
+
+#define DRIVER_NAME "orinoco_plx"
+#define PFX DRIVER_NAME ": "
+
+#include <linux/config.h>
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/sched.h>
+#include <linux/ptrace.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/timer.h>
+#include <linux/ioport.h>
+#include <asm/uaccess.h>
+#include <asm/io.h>
+#include <asm/system.h>
+#include <linux/netdevice.h>
+#include <linux/if_arp.h>
+#include <linux/etherdevice.h>
+#include <linux/list.h>
+#include <linux/pci.h>
+#include <linux/fcntl.h>
+
+#include <pcmcia/cisreg.h>
+
+#include "hermes.h"
+#include "orinoco.h"
+
+#define COR_OFFSET	(0x3e0)	/* COR attribute offset of Prism2 PC card */
+#define COR_VALUE	(COR_LEVEL_REQ | COR_FUNC_ENA) /* Enable PC card with interrupt in level trigger */
+#define COR_RESET     (0x80)	/* reset bit in the COR register */
+#define PLX_RESET_TIME	(500)	/* milliseconds */
+
+#define PLX_INTCSR		0x4c /* Interrupt Control & Status Register */
+#define PLX_INTCSR_INTEN	(1<<6) /* Interrupt Enable bit */
+
+static const u8 cis_magic[] = {
+	0x01, 0x03, 0x00, 0x00, 0xff, 0x17, 0x04, 0x67
+};
+
+/* Orinoco PLX specific data */
+struct orinoco_plx_card {
+	void __iomem *attr_mem;
+};
+
+/*
+ * Do a soft reset of the card using the Configuration Option Register
+ */
+static int orinoco_plx_cor_reset(struct orinoco_private *priv)
+{
+	hermes_t *hw = &priv->hw;
+	struct orinoco_plx_card *card = priv->card;
+	u8 __iomem *attr_mem = card->attr_mem;
+	unsigned long timeout;
+	u16 reg;
+
+	writeb(COR_VALUE | COR_RESET, attr_mem + COR_OFFSET);
+	mdelay(1);
+
+	writeb(COR_VALUE, attr_mem + COR_OFFSET);
+	mdelay(1);
+
+	/* Just in case, wait more until the card is no longer busy */
+	timeout = jiffies + (PLX_RESET_TIME * HZ / 1000);
+	reg = hermes_read_regn(hw, CMD);
+	while (time_before(jiffies, timeout) && (reg & HERMES_CMD_BUSY)) {
+		mdelay(1);
+		reg = hermes_read_regn(hw, CMD);
+	}
+
+	/* Did we timeout ? */
+	if (reg & HERMES_CMD_BUSY) {
+		printk(KERN_ERR PFX "Busy timeout\n");
+		return -ETIMEDOUT;
+	}
+
+	return 0;
+}
+
+
+static int orinoco_plx_init_one(struct pci_dev *pdev,
+				const struct pci_device_id *ent)
+{
+	int err = 0;
+	u8 __iomem *attr_mem = NULL;
+	u32 csr_reg, plx_addr;
+	struct orinoco_private *priv = NULL;
+	struct orinoco_plx_card *card;
+	unsigned long pccard_ioaddr = 0;
+	unsigned long pccard_iolen = 0;
+	struct net_device *dev = NULL;
+	void __iomem *mem;
+	int i;
+
+	err = pci_enable_device(pdev);
+	if (err) {
+		printk(KERN_ERR PFX "Cannot enable PCI device\n");
+		return err;
+	}
+
+	err = pci_request_regions(pdev, DRIVER_NAME);
+	if (err != 0) {
+		printk(KERN_ERR PFX "Cannot obtain PCI resources\n");
+		goto fail_resources;
+	}
+
+	/* Resource 1 is mapped to PLX-specific registers */
+	plx_addr = pci_resource_start(pdev, 1);
+
+	/* Resource 2 is mapped to the PCMCIA attribute memory */
+	attr_mem = ioremap(pci_resource_start(pdev, 2),
+			   pci_resource_len(pdev, 2));
+	if (!attr_mem) {
+		printk(KERN_ERR PFX "Cannot remap PCMCIA space\n");
+		goto fail_map_attr;
+	}
+
+	/* Resource 3 is mapped to the PCMCIA I/O address space */
+	pccard_ioaddr = pci_resource_start(pdev, 3);
+	pccard_iolen = pci_resource_len(pdev, 3);
+
+	mem = pci_iomap(pdev, 3, 0);
+	if (!mem) {
+		err = -ENOMEM;
+		goto fail_map_io;
+	}
+
+	/* Allocate network device */
+	dev = alloc_orinocodev(sizeof(*card), orinoco_plx_cor_reset);
+	if (!dev) {
+		printk(KERN_ERR PFX "Cannot allocate network device\n");
+		err = -ENOMEM;
+		goto fail_alloc;
+	}
+
+	priv = netdev_priv(dev);
+	card = priv->card;
+	card->attr_mem = attr_mem;
+	dev->base_addr = pccard_ioaddr;
+	SET_MODULE_OWNER(dev);
+	SET_NETDEV_DEV(dev, &pdev->dev);
+
+	hermes_struct_init(&priv->hw, mem, HERMES_16BIT_REGSPACING);
+
+	printk(KERN_DEBUG PFX "Detected Orinoco/Prism2 PLX device "
+	       "at %s irq:%d, io addr:0x%lx\n", pci_name(pdev), pdev->irq,
+	       pccard_ioaddr);
+
+	err = request_irq(pdev->irq, orinoco_interrupt, SA_SHIRQ,
+			  dev->name, dev);
+	if (err) {
+		printk(KERN_ERR PFX "Cannot allocate IRQ %d\n", pdev->irq);
+		err = -EBUSY;
+		goto fail_irq;
+	}
+	dev->irq = pdev->irq;
+
+	/* bjoern: We need to tell the card to enable interrupts, in
+	   case the serial eprom didn't do this already.  See the
+	   PLX9052 data book, p8-1 and 8-24 for reference. */
+	csr_reg = inl(plx_addr + PLX_INTCSR);
+	if (!(csr_reg & PLX_INTCSR_INTEN)) {
+		csr_reg |= PLX_INTCSR_INTEN;
+		outl(csr_reg, plx_addr + PLX_INTCSR);
+		csr_reg = inl(plx_addr + PLX_INTCSR);
+		if (!(csr_reg & PLX_INTCSR_INTEN)) {
+			printk(KERN_ERR PFX "Cannot enable interrupts\n");
+			goto fail;
+		}
+	}
+
+	err = orinoco_plx_cor_reset(priv);
+	if (err) {
+		printk(KERN_ERR PFX "Initial reset failed\n");
+		goto fail;
+	}
+
+	printk(KERN_DEBUG PFX "CIS: ");
+	for (i = 0; i < 16; i++) {
+		printk("%02X:", readb(attr_mem + 2*i));
+	}
+	printk("\n");
+
+	/* Verify whether a supported PC card is present */
+	/* FIXME: we probably need to be smarted about this */
+	for (i = 0; i < sizeof(cis_magic); i++) {
+		if (cis_magic[i] != readb(attr_mem +2*i)) {
+			printk(KERN_ERR PFX "The CIS value of Prism2 PC "
+			       "card is unexpected\n");
+			err = -EIO;
+			goto fail;
+		}
+	}
+
+	err = register_netdev(dev);
+	if (err) {
+		printk(KERN_ERR PFX "Cannot register network device\n");
+		goto fail;
+	}
+
+	pci_set_drvdata(pdev, dev);
+
+	return 0;
+
+ fail:
+	free_irq(pdev->irq, dev);
+
+ fail_irq:
+	pci_set_drvdata(pdev, NULL);
+	free_orinocodev(dev);
+
+ fail_alloc:
+	pci_iounmap(pdev, mem);
+
+ fail_map_io:
+	iounmap(attr_mem);
+
+ fail_map_attr:
+	pci_release_regions(pdev);
+
+ fail_resources:
+	pci_disable_device(pdev);
+
+	return err;
+}
+
+static void __devexit orinoco_plx_remove_one(struct pci_dev *pdev)
+{
+	struct net_device *dev = pci_get_drvdata(pdev);
+	struct orinoco_private *priv = netdev_priv(dev);
+	struct orinoco_plx_card *card = priv->card;
+	u8 __iomem *attr_mem = card->attr_mem;
+
+	BUG_ON(! dev);
+
+	unregister_netdev(dev);
+	free_irq(dev->irq, dev);
+	pci_set_drvdata(pdev, NULL);
+	free_orinocodev(dev);
+	pci_iounmap(pdev, priv->hw.iobase);
+	iounmap(attr_mem);
+	pci_release_regions(pdev);
+	pci_disable_device(pdev);
+}
+
+
+static struct pci_device_id orinoco_plx_pci_id_table[] = {
+	{0x111a, 0x1023, PCI_ANY_ID, PCI_ANY_ID,},	/* Siemens SpeedStream SS1023 */
+	{0x1385, 0x4100, PCI_ANY_ID, PCI_ANY_ID,},	/* Netgear MA301 */
+	{0x15e8, 0x0130, PCI_ANY_ID, PCI_ANY_ID,},	/* Correga  - does this work? */
+	{0x1638, 0x1100, PCI_ANY_ID, PCI_ANY_ID,},	/* SMC EZConnect SMC2602W,
+							   Eumitcom PCI WL11000,
+							   Addtron AWA-100 */
+	{0x16ab, 0x1100, PCI_ANY_ID, PCI_ANY_ID,},	/* Global Sun Tech GL24110P */
+	{0x16ab, 0x1101, PCI_ANY_ID, PCI_ANY_ID,},	/* Reported working, but unknown */
+	{0x16ab, 0x1102, PCI_ANY_ID, PCI_ANY_ID,},	/* Linksys WDT11 */
+	{0x16ec, 0x3685, PCI_ANY_ID, PCI_ANY_ID,},	/* USR 2415 */
+	{0xec80, 0xec00, PCI_ANY_ID, PCI_ANY_ID,},	/* Belkin F5D6000 tested by
+							   Brendan W. McAdams <rit AT jacked-in.org> */
+	{0x10b7, 0x7770, PCI_ANY_ID, PCI_ANY_ID,},	/* 3Com AirConnect PCI tested by
+							   Damien Persohn <damien AT persohn.net> */
+	{0,},
+};
+
+MODULE_DEVICE_TABLE(pci, orinoco_plx_pci_id_table);
+
+static struct pci_driver orinoco_plx_driver = {
+	.name		= DRIVER_NAME,
+	.id_table	= orinoco_plx_pci_id_table,
+	.probe		= orinoco_plx_init_one,
+	.remove		= __devexit_p(orinoco_plx_remove_one),
+};
+
+static char version[] __initdata = DRIVER_NAME " " DRIVER_VERSION
+	" (Pavel Roskin <proski@gnu.org>,"
+	" David Gibson <hermes@gibson.dropbear.id.au>,"
+	" Daniel Barlow <dan@telent.net>)";
+MODULE_AUTHOR("Daniel Barlow <dan@telent.net>");
+MODULE_DESCRIPTION("Driver for wireless LAN cards using the PLX9052 PCI bridge");
+MODULE_LICENSE("Dual MPL/GPL");
+
+static int __init orinoco_plx_init(void)
+{
+	printk(KERN_DEBUG "%s\n", version);
+	return pci_module_init(&orinoco_plx_driver);
+}
+
+static void __exit orinoco_plx_exit(void)
+{
+	pci_unregister_driver(&orinoco_plx_driver);
+	ssleep(1);
+}
+
+module_init(orinoco_plx_init);
+module_exit(orinoco_plx_exit);
+
+/*
+ * Local variables:
+ *  c-indent-level: 8
+ *  c-basic-offset: 8
+ *  tab-width: 8
+ * End:
+ */
diff --git a/drivers/net/wireless/orinoco_tmd.c b/drivers/net/wireless/orinoco_tmd.c
new file mode 100644
index 0000000..85893f4
--- /dev/null
+++ b/drivers/net/wireless/orinoco_tmd.c
@@ -0,0 +1,276 @@
+/* orinoco_tmd.c
+ * 
+ * Driver for Prism II devices which would usually be driven by orinoco_cs,
+ * but are connected to the PCI bus by a TMD7160. 
+ *
+ * Copyright (C) 2003 Joerg Dorchain <joerg AT dorchain.net>
+ * based heavily upon orinoco_plx.c Copyright (C) 2001 Daniel Barlow
+ *
+ * The contents of this file are subject to the Mozilla Public License
+ * Version 1.1 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License
+ * at http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS"
+ * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+ * the License for the specific language governing rights and
+ * limitations under the License.
+ *
+ * Alternatively, the contents of this file may be used under the
+ * terms of the GNU General Public License version 2 (the "GPL"), in
+ * which case the provisions of the GPL are applicable instead of the
+ * above.  If you wish to allow the use of your version of this file
+ * only under the terms of the GPL and not to allow others to use your
+ * version of this file under the MPL, indicate your decision by
+ * deleting the provisions above and replace them with the notice and
+ * other provisions required by the GPL.  If you do not delete the
+ * provisions above, a recipient may use your version of this file
+ * under either the MPL or the GPL.
+
+ * Caution: this is experimental and probably buggy.  For success and
+ * failure reports for different cards and adaptors, see
+ * orinoco_tmd_pci_id_table near the end of the file.  If you have a
+ * card we don't have the PCI id for, and looks like it should work,
+ * drop me mail with the id and "it works"/"it doesn't work".
+ *
+ * Note: if everything gets detected fine but it doesn't actually send
+ * or receive packets, your first port of call should probably be to   
+ * try newer firmware in the card.  Especially if you're doing Ad-Hoc
+ * modes
+ *
+ * The actual driving is done by orinoco.c, this is just resource
+ * allocation stuff.
+ *
+ * This driver is modeled after the orinoco_plx driver. The main
+ * difference is that the TMD chip has only IO port ranges and no
+ * memory space, i.e.  no access to the CIS. Compared to the PLX chip,
+ * the io range functionalities are exchanged.
+ *
+ * Pheecom sells cards with the TMD chip as "ASIC version"
+ */
+
+#define DRIVER_NAME "orinoco_tmd"
+#define PFX DRIVER_NAME ": "
+
+#include <linux/config.h>
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/sched.h>
+#include <linux/ptrace.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/timer.h>
+#include <linux/ioport.h>
+#include <asm/uaccess.h>
+#include <asm/io.h>
+#include <asm/system.h>
+#include <linux/netdevice.h>
+#include <linux/if_arp.h>
+#include <linux/etherdevice.h>
+#include <linux/list.h>
+#include <linux/pci.h>
+#include <linux/fcntl.h>
+
+#include <pcmcia/cisreg.h>
+
+#include "hermes.h"
+#include "orinoco.h"
+
+#define COR_VALUE	(COR_LEVEL_REQ | COR_FUNC_ENA) /* Enable PC card with interrupt in level trigger */
+#define COR_RESET     (0x80)	/* reset bit in the COR register */
+#define TMD_RESET_TIME	(500)	/* milliseconds */
+
+/* Orinoco TMD specific data */
+struct orinoco_tmd_card {
+	u32 tmd_io;
+};
+
+
+/*
+ * Do a soft reset of the card using the Configuration Option Register
+ */
+static int orinoco_tmd_cor_reset(struct orinoco_private *priv)
+{
+	hermes_t *hw = &priv->hw;
+	struct orinoco_tmd_card *card = priv->card;
+	u32 addr = card->tmd_io;
+	unsigned long timeout;
+	u16 reg;
+
+	outb(COR_VALUE | COR_RESET, addr);
+	mdelay(1);
+
+	outb(COR_VALUE, addr);
+	mdelay(1);
+
+	/* Just in case, wait more until the card is no longer busy */
+	timeout = jiffies + (TMD_RESET_TIME * HZ / 1000);
+	reg = hermes_read_regn(hw, CMD);
+	while (time_before(jiffies, timeout) && (reg & HERMES_CMD_BUSY)) {
+		mdelay(1);
+		reg = hermes_read_regn(hw, CMD);
+	}
+
+	/* Did we timeout ? */
+	if (reg & HERMES_CMD_BUSY) {
+		printk(KERN_ERR PFX "Busy timeout\n");
+		return -ETIMEDOUT;
+	}
+
+	return 0;
+}
+
+
+static int orinoco_tmd_init_one(struct pci_dev *pdev,
+				const struct pci_device_id *ent)
+{
+	int err = 0;
+	struct orinoco_private *priv = NULL;
+	struct orinoco_tmd_card *card;
+	struct net_device *dev = NULL;
+	void __iomem *mem;
+
+	err = pci_enable_device(pdev);
+	if (err) {
+		printk(KERN_ERR PFX "Cannot enable PCI device\n");
+		return err;
+	}
+
+	err = pci_request_regions(pdev, DRIVER_NAME);
+	if (err != 0) {
+		printk(KERN_ERR PFX "Cannot obtain PCI resources\n");
+		goto fail_resources;
+	}
+
+	mem = pci_iomap(pdev, 2, 0);
+	if (! mem) {
+		err = -ENOMEM;
+		goto fail_iomap;
+	}
+
+	/* Allocate network device */
+	dev = alloc_orinocodev(sizeof(*card), orinoco_tmd_cor_reset);
+	if (! dev) {
+		printk(KERN_ERR PFX "Cannot allocate network device\n");
+		err = -ENOMEM;
+		goto fail_alloc;
+	}
+
+	priv = netdev_priv(dev);
+	card = priv->card;
+	card->tmd_io = pci_resource_start(pdev, 1);
+	dev->base_addr = pci_resource_start(pdev, 2);
+	SET_MODULE_OWNER(dev);
+	SET_NETDEV_DEV(dev, &pdev->dev);
+
+	hermes_struct_init(&priv->hw, mem, HERMES_16BIT_REGSPACING);
+
+	printk(KERN_DEBUG PFX "Detected Orinoco/Prism2 TMD device "
+	       "at %s irq:%d, io addr:0x%lx\n", pci_name(pdev), pdev->irq,
+	       dev->base_addr);
+
+	err = request_irq(pdev->irq, orinoco_interrupt, SA_SHIRQ,
+			  dev->name, dev);
+	if (err) {
+		printk(KERN_ERR PFX "Cannot allocate IRQ %d\n", pdev->irq);
+		err = -EBUSY;
+		goto fail_irq;
+	}
+	dev->irq = pdev->irq;
+
+	err = orinoco_tmd_cor_reset(priv);
+	if (err) {
+		printk(KERN_ERR PFX "Initial reset failed\n");
+		goto fail;
+	}
+
+	err = register_netdev(dev);
+	if (err) {
+		printk(KERN_ERR PFX "Cannot register network device\n");
+		goto fail;
+	}
+
+	pci_set_drvdata(pdev, dev);
+
+	return 0;
+
+ fail:
+	free_irq(pdev->irq, dev);
+
+ fail_irq:
+	pci_set_drvdata(pdev, NULL);
+	free_orinocodev(dev);
+
+ fail_alloc:
+	pci_iounmap(pdev, mem);
+
+ fail_iomap:
+	pci_release_regions(pdev);
+
+ fail_resources:
+	pci_disable_device(pdev);
+
+	return err;
+}
+
+static void __devexit orinoco_tmd_remove_one(struct pci_dev *pdev)
+{
+	struct net_device *dev = pci_get_drvdata(pdev);
+	struct orinoco_private *priv = dev->priv;
+
+	BUG_ON(! dev);
+
+	unregister_netdev(dev);
+	free_irq(dev->irq, dev);
+	pci_set_drvdata(pdev, NULL);
+	free_orinocodev(dev);
+	pci_iounmap(pdev, priv->hw.iobase);
+	pci_release_regions(pdev);
+	pci_disable_device(pdev);
+}
+
+
+static struct pci_device_id orinoco_tmd_pci_id_table[] = {
+	{0x15e8, 0x0131, PCI_ANY_ID, PCI_ANY_ID,},      /* NDC and OEMs, e.g. pheecom */
+	{0,},
+};
+
+MODULE_DEVICE_TABLE(pci, orinoco_tmd_pci_id_table);
+
+static struct pci_driver orinoco_tmd_driver = {
+	.name		= DRIVER_NAME,
+	.id_table	= orinoco_tmd_pci_id_table,
+	.probe		= orinoco_tmd_init_one,
+	.remove		= __devexit_p(orinoco_tmd_remove_one),
+};
+
+static char version[] __initdata = DRIVER_NAME " " DRIVER_VERSION
+	" (Joerg Dorchain <joerg@dorchain.net>)";
+MODULE_AUTHOR("Joerg Dorchain <joerg@dorchain.net>");
+MODULE_DESCRIPTION("Driver for wireless LAN cards using the TMD7160 PCI bridge");
+MODULE_LICENSE("Dual MPL/GPL");
+
+static int __init orinoco_tmd_init(void)
+{
+	printk(KERN_DEBUG "%s\n", version);
+	return pci_module_init(&orinoco_tmd_driver);
+}
+
+static void __exit orinoco_tmd_exit(void)
+{
+	pci_unregister_driver(&orinoco_tmd_driver);
+	ssleep(1);
+}
+
+module_init(orinoco_tmd_init);
+module_exit(orinoco_tmd_exit);
+
+/*
+ * Local variables:
+ *  c-indent-level: 8
+ *  c-basic-offset: 8
+ *  tab-width: 8
+ * End:
+ */
diff --git a/drivers/net/wireless/prism54/Makefile b/drivers/net/wireless/prism54/Makefile
new file mode 100644
index 0000000..fad305c
--- /dev/null
+++ b/drivers/net/wireless/prism54/Makefile
@@ -0,0 +1,8 @@
+# $Id: Makefile.k26,v 1.7 2004/01/30 16:24:00 ajfa Exp $
+
+prism54-objs := islpci_eth.o islpci_mgt.o \
+                isl_38xx.o isl_ioctl.o islpci_dev.o \
+		islpci_hotplug.o oid_mgt.o
+
+obj-$(CONFIG_PRISM54) += prism54.o
+
diff --git a/drivers/net/wireless/prism54/isl_38xx.c b/drivers/net/wireless/prism54/isl_38xx.c
new file mode 100644
index 0000000..4481ec1
--- /dev/null
+++ b/drivers/net/wireless/prism54/isl_38xx.c
@@ -0,0 +1,260 @@
+/*
+ *  
+ *  Copyright (C) 2002 Intersil Americas Inc.
+ *  Copyright (C) 2003-2004 Luis R. Rodriguez <mcgrof@ruslug.rutgers.edu>_
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+
+#include <linux/version.h>
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/delay.h>
+
+#include <asm/uaccess.h>
+#include <asm/io.h>
+
+#include "prismcompat.h"
+#include "isl_38xx.h"
+#include "islpci_dev.h"
+#include "islpci_mgt.h"
+
+/******************************************************************************
+    Device Interface & Control functions
+******************************************************************************/
+
+/**
+ * isl38xx_disable_interrupts - disable all interrupts
+ * @device: pci memory base address
+ *
+ *  Instructs the device to disable all interrupt reporting by asserting 
+ *  the IRQ line. New events may still show up in the interrupt identification
+ *  register located at offset %ISL38XX_INT_IDENT_REG.
+ */
+void
+isl38xx_disable_interrupts(void __iomem *device)
+{
+	isl38xx_w32_flush(device, 0x00000000, ISL38XX_INT_EN_REG);
+	udelay(ISL38XX_WRITEIO_DELAY);
+}
+
+void
+isl38xx_handle_sleep_request(isl38xx_control_block *control_block,
+			     int *powerstate, void __iomem *device_base)
+{
+	/* device requests to go into sleep mode
+	 * check whether the transmit queues for data and management are empty */
+	if (isl38xx_in_queue(control_block, ISL38XX_CB_TX_DATA_LQ))
+		/* data tx queue not empty */
+		return;
+
+	if (isl38xx_in_queue(control_block, ISL38XX_CB_TX_MGMTQ))
+		/* management tx queue not empty */
+		return;
+
+	/* check also whether received frames are pending */
+	if (isl38xx_in_queue(control_block, ISL38XX_CB_RX_DATA_LQ))
+		/* data rx queue not empty */
+		return;
+
+	if (isl38xx_in_queue(control_block, ISL38XX_CB_RX_MGMTQ))
+		/* management rx queue not empty */
+		return;
+
+#if VERBOSE > SHOW_ERROR_MESSAGES
+	DEBUG(SHOW_TRACING, "Device going to sleep mode\n");
+#endif
+
+	/* all queues are empty, allow the device to go into sleep mode */
+	*powerstate = ISL38XX_PSM_POWERSAVE_STATE;
+
+	/* assert the Sleep interrupt in the Device Interrupt Register */
+	isl38xx_w32_flush(device_base, ISL38XX_DEV_INT_SLEEP,
+			  ISL38XX_DEV_INT_REG);
+	udelay(ISL38XX_WRITEIO_DELAY);
+}
+
+void
+isl38xx_handle_wakeup(isl38xx_control_block *control_block,
+		      int *powerstate, void __iomem *device_base)
+{
+	/* device is in active state, update the powerstate flag */
+	*powerstate = ISL38XX_PSM_ACTIVE_STATE;
+
+	/* now check whether there are frames pending for the card */
+	if (!isl38xx_in_queue(control_block, ISL38XX_CB_TX_DATA_LQ)
+	    && !isl38xx_in_queue(control_block, ISL38XX_CB_TX_MGMTQ))
+		return;
+
+#if VERBOSE > SHOW_ERROR_MESSAGES
+	DEBUG(SHOW_ANYTHING, "Wake up handler trigger the device\n");
+#endif
+
+	/* either data or management transmit queue has a frame pending
+	 * trigger the device by setting the Update bit in the Device Int reg */
+	isl38xx_w32_flush(device_base, ISL38XX_DEV_INT_UPDATE,
+			  ISL38XX_DEV_INT_REG);
+	udelay(ISL38XX_WRITEIO_DELAY);
+}
+
+void
+isl38xx_trigger_device(int asleep, void __iomem *device_base)
+{
+	struct timeval current_time;
+	u32 reg, counter = 0;
+
+#if VERBOSE > SHOW_ERROR_MESSAGES
+	DEBUG(SHOW_FUNCTION_CALLS, "isl38xx trigger device\n");
+#endif
+
+	/* check whether the device is in power save mode */
+	if (asleep) {
+		/* device is in powersave, trigger the device for wakeup */
+#if VERBOSE > SHOW_ERROR_MESSAGES
+		do_gettimeofday(&current_time);
+		DEBUG(SHOW_TRACING, "%08li.%08li Device wakeup triggered\n",
+		      current_time.tv_sec, (long)current_time.tv_usec);
+#endif
+
+		DEBUG(SHOW_TRACING, "%08li.%08li Device register read %08x\n",
+		      current_time.tv_sec, (long)current_time.tv_usec,
+		      readl(device_base + ISL38XX_CTRL_STAT_REG));
+		udelay(ISL38XX_WRITEIO_DELAY);
+
+		reg = readl(device_base + ISL38XX_INT_IDENT_REG);
+		if (reg == 0xabadface) {
+#if VERBOSE > SHOW_ERROR_MESSAGES
+			do_gettimeofday(&current_time);
+			DEBUG(SHOW_TRACING,
+			      "%08li.%08li Device register abadface\n",
+			      current_time.tv_sec, (long)current_time.tv_usec);
+#endif
+			/* read the Device Status Register until Sleepmode bit is set */
+			while (reg = readl(device_base + ISL38XX_CTRL_STAT_REG),
+			       (reg & ISL38XX_CTRL_STAT_SLEEPMODE) == 0) {
+				udelay(ISL38XX_WRITEIO_DELAY);
+				counter++;
+			}
+
+			DEBUG(SHOW_TRACING,
+			      "%08li.%08li Device register read %08x\n",
+			      current_time.tv_sec, (long)current_time.tv_usec,
+			      readl(device_base + ISL38XX_CTRL_STAT_REG));
+			udelay(ISL38XX_WRITEIO_DELAY);
+
+#if VERBOSE > SHOW_ERROR_MESSAGES
+			do_gettimeofday(&current_time);
+			DEBUG(SHOW_TRACING,
+			      "%08li.%08li Device asleep counter %i\n",
+			      current_time.tv_sec, (long)current_time.tv_usec,
+			      counter);
+#endif
+		}
+		/* assert the Wakeup interrupt in the Device Interrupt Register */
+		isl38xx_w32_flush(device_base, ISL38XX_DEV_INT_WAKEUP,
+				  ISL38XX_DEV_INT_REG);
+		udelay(ISL38XX_WRITEIO_DELAY);
+
+		/* perform another read on the Device Status Register */
+		reg = readl(device_base + ISL38XX_CTRL_STAT_REG);
+		udelay(ISL38XX_WRITEIO_DELAY);
+
+#if VERBOSE > SHOW_ERROR_MESSAGES
+		do_gettimeofday(&current_time);
+		DEBUG(SHOW_TRACING, "%08li.%08li Device register read %08x\n",
+		      current_time.tv_sec, (long)current_time.tv_usec, reg);
+#endif
+	} else {
+		/* device is (still) awake  */
+#if VERBOSE > SHOW_ERROR_MESSAGES
+		DEBUG(SHOW_TRACING, "Device is in active state\n");
+#endif
+		/* trigger the device by setting the Update bit in the Device Int reg */
+
+		isl38xx_w32_flush(device_base, ISL38XX_DEV_INT_UPDATE,
+				  ISL38XX_DEV_INT_REG);
+		udelay(ISL38XX_WRITEIO_DELAY);
+	}
+}
+
+void
+isl38xx_interface_reset(void __iomem *device_base, dma_addr_t host_address)
+{
+#if VERBOSE > SHOW_ERROR_MESSAGES
+	DEBUG(SHOW_FUNCTION_CALLS, "isl38xx_interface_reset\n");
+#endif
+
+	/* load the address of the control block in the device */
+	isl38xx_w32_flush(device_base, host_address, ISL38XX_CTRL_BLK_BASE_REG);
+	udelay(ISL38XX_WRITEIO_DELAY);
+
+	/* set the reset bit in the Device Interrupt Register */
+	isl38xx_w32_flush(device_base, ISL38XX_DEV_INT_RESET, ISL38XX_DEV_INT_REG);
+	udelay(ISL38XX_WRITEIO_DELAY);
+
+	/* enable the interrupt for detecting initialization */
+
+	/* Note: Do not enable other interrupts here. We want the
+	 * device to have come up first 100% before allowing any other 
+	 * interrupts. */
+	isl38xx_w32_flush(device_base, ISL38XX_INT_IDENT_INIT, ISL38XX_INT_EN_REG);
+	udelay(ISL38XX_WRITEIO_DELAY);  /* allow complete full reset */
+}
+
+void
+isl38xx_enable_common_interrupts(void __iomem *device_base) {
+	u32 reg;
+	reg = ( ISL38XX_INT_IDENT_UPDATE | 
+			ISL38XX_INT_IDENT_SLEEP | ISL38XX_INT_IDENT_WAKEUP);
+	isl38xx_w32_flush(device_base, reg, ISL38XX_INT_EN_REG);
+	udelay(ISL38XX_WRITEIO_DELAY);
+}
+
+int
+isl38xx_in_queue(isl38xx_control_block *cb, int queue)
+{
+	const s32 delta = (le32_to_cpu(cb->driver_curr_frag[queue]) -
+			   le32_to_cpu(cb->device_curr_frag[queue]));
+
+	/* determine the amount of fragments in the queue depending on the type
+	 * of the queue, either transmit or receive */
+
+	BUG_ON(delta < 0);	/* driver ptr must be ahead of device ptr */
+
+	switch (queue) {
+		/* send queues */
+	case ISL38XX_CB_TX_MGMTQ:
+		BUG_ON(delta > ISL38XX_CB_MGMT_QSIZE);
+	case ISL38XX_CB_TX_DATA_LQ:
+	case ISL38XX_CB_TX_DATA_HQ:
+		BUG_ON(delta > ISL38XX_CB_TX_QSIZE);
+		return delta;
+		break;
+
+		/* receive queues */
+	case ISL38XX_CB_RX_MGMTQ:
+		BUG_ON(delta > ISL38XX_CB_MGMT_QSIZE);
+		return ISL38XX_CB_MGMT_QSIZE - delta;
+		break;
+
+	case ISL38XX_CB_RX_DATA_LQ:
+	case ISL38XX_CB_RX_DATA_HQ:
+		BUG_ON(delta > ISL38XX_CB_RX_QSIZE);
+		return ISL38XX_CB_RX_QSIZE - delta;
+		break;
+	}
+	BUG();
+	return 0;
+}
diff --git a/drivers/net/wireless/prism54/isl_38xx.h b/drivers/net/wireless/prism54/isl_38xx.h
new file mode 100644
index 0000000..e83e491
--- /dev/null
+++ b/drivers/net/wireless/prism54/isl_38xx.h
@@ -0,0 +1,173 @@
+/*
+ *  
+ *  Copyright (C) 2002 Intersil Americas Inc.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+
+#ifndef _ISL_38XX_H
+#define _ISL_38XX_H
+
+#include <linux/version.h>
+#include <asm/io.h>
+#include <asm/byteorder.h>
+
+#define ISL38XX_CB_RX_QSIZE                     8
+#define ISL38XX_CB_TX_QSIZE                     32
+
+/* ISL38XX Access Point Specific definitions */
+#define ISL38XX_MAX_WDS_LINKS                   8
+
+/* ISL38xx Client Specific definitions */
+#define ISL38XX_PSM_ACTIVE_STATE                0
+#define ISL38XX_PSM_POWERSAVE_STATE             1
+
+/* ISL38XX Host Interface Definitions */
+#define ISL38XX_PCI_MEM_SIZE                    0x02000
+#define ISL38XX_MEMORY_WINDOW_SIZE              0x01000
+#define ISL38XX_DEV_FIRMWARE_ADDRES             0x20000
+#define ISL38XX_WRITEIO_DELAY                   10	/* in us */
+#define ISL38XX_RESET_DELAY                     50	/* in ms */
+#define ISL38XX_WAIT_CYCLE                      10	/* in 10ms */
+#define ISL38XX_MAX_WAIT_CYCLES                 10
+
+/* PCI Memory Area */
+#define ISL38XX_HARDWARE_REG                    0x0000
+#define ISL38XX_CARDBUS_CIS                     0x0800
+#define ISL38XX_DIRECT_MEM_WIN                  0x1000
+
+/* Hardware registers */
+#define ISL38XX_DEV_INT_REG                     0x0000
+#define ISL38XX_INT_IDENT_REG                   0x0010
+#define ISL38XX_INT_ACK_REG                     0x0014
+#define ISL38XX_INT_EN_REG                      0x0018
+#define ISL38XX_GEN_PURP_COM_REG_1              0x0020
+#define ISL38XX_GEN_PURP_COM_REG_2              0x0024
+#define ISL38XX_CTRL_BLK_BASE_REG               ISL38XX_GEN_PURP_COM_REG_1
+#define ISL38XX_DIR_MEM_BASE_REG                0x0030
+#define ISL38XX_CTRL_STAT_REG                   0x0078
+
+/* High end mobos queue up pci writes, the following
+ * is used to "read" from after a write to force flush */
+#define ISL38XX_PCI_POSTING_FLUSH		ISL38XX_INT_EN_REG
+
+/**
+ * isl38xx_w32_flush - PCI iomem write helper
+ * @base: (host) memory base address of the device
+ * @val: 32bit value (host order) to write
+ * @offset: byte offset into @base to write value to
+ * 
+ *  This helper takes care of writing a 32bit datum to the
+ *  specified offset into the device's pci memory space, and making sure 
+ *  the pci memory buffers get flushed by performing one harmless read 
+ *  from the %ISL38XX_PCI_POSTING_FLUSH offset.
+ */
+static inline void
+isl38xx_w32_flush(void __iomem *base, u32 val, unsigned long offset)
+{
+	writel(val, base + offset);
+	(void) readl(base + ISL38XX_PCI_POSTING_FLUSH);
+}
+
+/* Device Interrupt register bits */
+#define ISL38XX_DEV_INT_RESET                   0x0001
+#define ISL38XX_DEV_INT_UPDATE                  0x0002
+#define ISL38XX_DEV_INT_WAKEUP                  0x0008
+#define ISL38XX_DEV_INT_SLEEP                   0x0010
+
+/* Interrupt Identification/Acknowledge/Enable register bits */
+#define ISL38XX_INT_IDENT_UPDATE                0x0002
+#define ISL38XX_INT_IDENT_INIT                  0x0004
+#define ISL38XX_INT_IDENT_WAKEUP                0x0008
+#define ISL38XX_INT_IDENT_SLEEP                 0x0010
+#define ISL38XX_INT_SOURCES                     0x001E
+
+/* Control/Status register bits */
+/* Looks like there are other meaningful bits
+    0x20004400 seen in normal operation,
+    0x200044db at 'timeout waiting for mgmt response'
+*/
+#define ISL38XX_CTRL_STAT_SLEEPMODE             0x00000200
+#define	ISL38XX_CTRL_STAT_CLKRUN		0x00800000
+#define ISL38XX_CTRL_STAT_RESET                 0x10000000
+#define ISL38XX_CTRL_STAT_RAMBOOT               0x20000000
+#define ISL38XX_CTRL_STAT_STARTHALTED           0x40000000
+#define ISL38XX_CTRL_STAT_HOST_OVERRIDE         0x80000000
+
+/* Control Block definitions */
+#define ISL38XX_CB_RX_DATA_LQ                   0
+#define ISL38XX_CB_TX_DATA_LQ                   1
+#define ISL38XX_CB_RX_DATA_HQ                   2
+#define ISL38XX_CB_TX_DATA_HQ                   3
+#define ISL38XX_CB_RX_MGMTQ                     4
+#define ISL38XX_CB_TX_MGMTQ                     5
+#define ISL38XX_CB_QCOUNT                       6
+#define ISL38XX_CB_MGMT_QSIZE                   4
+#define ISL38XX_MIN_QTHRESHOLD                  4	/* fragments */
+
+/* Memory Manager definitions */
+#define MGMT_FRAME_SIZE                         1500	/* >= size struct obj_bsslist */
+#define MGMT_TX_FRAME_COUNT                     24	/* max 4 + spare 4 + 8 init */
+#define MGMT_RX_FRAME_COUNT                     24	/* 4*4 + spare 8 */
+#define MGMT_FRAME_COUNT                        (MGMT_TX_FRAME_COUNT + MGMT_RX_FRAME_COUNT)
+#define CONTROL_BLOCK_SIZE                      1024	/* should be enough */
+#define PSM_FRAME_SIZE                          1536
+#define PSM_MINIMAL_STATION_COUNT               64
+#define PSM_FRAME_COUNT                         PSM_MINIMAL_STATION_COUNT
+#define PSM_BUFFER_SIZE                         PSM_FRAME_SIZE * PSM_FRAME_COUNT
+#define MAX_TRAP_RX_QUEUE                       4
+#define HOST_MEM_BLOCK                          CONTROL_BLOCK_SIZE + PSM_BUFFER_SIZE
+
+/* Fragment package definitions */
+#define FRAGMENT_FLAG_MF                        0x0001
+#define MAX_FRAGMENT_SIZE                       1536
+
+/* In monitor mode frames have a header. I don't know exactly how big those
+ * frame can be but I've never seen any frame bigger than 1584... :
+ */
+#define MAX_FRAGMENT_SIZE_RX	                1600
+
+typedef struct {
+	u32 address;		/* physical address on host */
+	u16 size;		/* packet size */
+	u16 flags;		/* set of bit-wise flags */
+} isl38xx_fragment;
+
+struct isl38xx_cb {
+	u32 driver_curr_frag[ISL38XX_CB_QCOUNT];
+	u32 device_curr_frag[ISL38XX_CB_QCOUNT];
+	isl38xx_fragment rx_data_low[ISL38XX_CB_RX_QSIZE];
+	isl38xx_fragment tx_data_low[ISL38XX_CB_TX_QSIZE];
+	isl38xx_fragment rx_data_high[ISL38XX_CB_RX_QSIZE];
+	isl38xx_fragment tx_data_high[ISL38XX_CB_TX_QSIZE];
+	isl38xx_fragment rx_data_mgmt[ISL38XX_CB_MGMT_QSIZE];
+	isl38xx_fragment tx_data_mgmt[ISL38XX_CB_MGMT_QSIZE];
+};
+
+typedef struct isl38xx_cb isl38xx_control_block;
+
+/* determine number of entries currently in queue */
+int isl38xx_in_queue(isl38xx_control_block *cb, int queue);
+
+void isl38xx_disable_interrupts(void __iomem *);
+void isl38xx_enable_common_interrupts(void __iomem *);
+
+void isl38xx_handle_sleep_request(isl38xx_control_block *, int *,
+				  void __iomem *);
+void isl38xx_handle_wakeup(isl38xx_control_block *, int *, void __iomem *);
+void isl38xx_trigger_device(int, void __iomem *);
+void isl38xx_interface_reset(void __iomem *, dma_addr_t);
+
+#endif				/* _ISL_38XX_H */
diff --git a/drivers/net/wireless/prism54/isl_ioctl.c b/drivers/net/wireless/prism54/isl_ioctl.c
new file mode 100644
index 0000000..0f29a9c
--- /dev/null
+++ b/drivers/net/wireless/prism54/isl_ioctl.c
@@ -0,0 +1,2750 @@
+/*
+ *  
+ *  Copyright (C) 2002 Intersil Americas Inc.
+ *            (C) 2003,2004 Aurelien Alleaume <slts@free.fr>
+ *            (C) 2003 Herbert Valerio Riedel <hvr@gnu.org>
+ *            (C) 2003 Luis R. Rodriguez <mcgrof@ruslug.rutgers.edu>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+
+#include <linux/version.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/if_arp.h>
+#include <linux/pci.h>
+
+#include <asm/uaccess.h>
+
+#include "prismcompat.h"
+#include "isl_ioctl.h"
+#include "islpci_mgt.h"
+#include "isl_oid.h"		/* additional types and defs for isl38xx fw */
+#include "oid_mgt.h"
+
+#include <net/iw_handler.h>	/* New driver API */
+
+
+static void prism54_wpa_ie_add(islpci_private *priv, u8 *bssid,
+				u8 *wpa_ie, size_t wpa_ie_len);
+static size_t prism54_wpa_ie_get(islpci_private *priv, u8 *bssid, u8 *wpa_ie);
+static int prism54_set_wpa(struct net_device *, struct iw_request_info *,
+				__u32 *, char *);
+
+
+/**
+ * prism54_mib_mode_helper - MIB change mode helper function
+ * @mib: the &struct islpci_mib object to modify
+ * @iw_mode: new mode (%IW_MODE_*)
+ * 
+ *  This is a helper function, hence it does not lock. Make sure
+ *  caller deals with locking *if* necessary. This function sets the 
+ *  mode-dependent mib values and does the mapping of the Linux 
+ *  Wireless API modes to Device firmware modes. It also checks for 
+ *  correct valid Linux wireless modes. 
+ */
+static int
+prism54_mib_mode_helper(islpci_private *priv, u32 iw_mode)
+{
+	u32 config = INL_CONFIG_MANUALRUN;
+	u32 mode, bsstype;
+
+	/* For now, just catch early the Repeater and Secondary modes here */
+	if (iw_mode == IW_MODE_REPEAT || iw_mode == IW_MODE_SECOND) {
+		printk(KERN_DEBUG
+		       "%s(): Sorry, Repeater mode and Secondary mode "
+		       "are not yet supported by this driver.\n", __FUNCTION__);
+		return -EINVAL;
+	}
+
+	priv->iw_mode = iw_mode;
+
+	switch (iw_mode) {
+	case IW_MODE_AUTO:
+		mode = INL_MODE_CLIENT;
+		bsstype = DOT11_BSSTYPE_ANY;
+		break;
+	case IW_MODE_ADHOC:
+		mode = INL_MODE_CLIENT;
+		bsstype = DOT11_BSSTYPE_IBSS;
+		break;
+	case IW_MODE_INFRA:
+		mode = INL_MODE_CLIENT;
+		bsstype = DOT11_BSSTYPE_INFRA;
+		break;
+	case IW_MODE_MASTER:
+		mode = INL_MODE_AP;
+		bsstype = DOT11_BSSTYPE_INFRA;
+		break;
+	case IW_MODE_MONITOR:
+		mode = INL_MODE_PROMISCUOUS;
+		bsstype = DOT11_BSSTYPE_ANY;
+		config |= INL_CONFIG_RXANNEX;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	if (init_wds)
+		config |= INL_CONFIG_WDS;
+	mgt_set(priv, DOT11_OID_BSSTYPE, &bsstype);
+	mgt_set(priv, OID_INL_CONFIG, &config);
+	mgt_set(priv, OID_INL_MODE, &mode);
+
+	return 0;
+}
+
+/**
+ * prism54_mib_init - fill MIB cache with defaults
+ *
+ *  this function initializes the struct given as @mib with defaults,
+ *  of which many are retrieved from the global module parameter
+ *  variables.  
+ */
+
+void
+prism54_mib_init(islpci_private *priv)
+{
+	u32 channel, authen, wep, filter, dot1x, mlme, conformance, power, mode;
+	struct obj_buffer psm_buffer = {
+		.size = PSM_BUFFER_SIZE,
+		.addr = priv->device_psm_buffer
+	};
+
+	channel = CARD_DEFAULT_CHANNEL;
+	authen = CARD_DEFAULT_AUTHEN;
+	wep = CARD_DEFAULT_WEP;
+	filter = CARD_DEFAULT_FILTER; /* (0) Do not filter un-encrypted data */
+	dot1x = CARD_DEFAULT_DOT1X; 
+	mlme = CARD_DEFAULT_MLME_MODE;
+	conformance = CARD_DEFAULT_CONFORMANCE;
+	power = 127;
+	mode = CARD_DEFAULT_IW_MODE;
+
+	mgt_set(priv, DOT11_OID_CHANNEL, &channel);
+	mgt_set(priv, DOT11_OID_AUTHENABLE, &authen);
+	mgt_set(priv, DOT11_OID_PRIVACYINVOKED, &wep);
+	mgt_set(priv, DOT11_OID_PSMBUFFER, &psm_buffer);
+	mgt_set(priv, DOT11_OID_EXUNENCRYPTED, &filter);
+	mgt_set(priv, DOT11_OID_DOT1XENABLE, &dot1x);
+	mgt_set(priv, DOT11_OID_MLMEAUTOLEVEL, &mlme);
+	mgt_set(priv, OID_INL_DOT11D_CONFORMANCE, &conformance);
+	mgt_set(priv, OID_INL_OUTPUTPOWER, &power);
+
+	/* This sets all of the mode-dependent values */
+	prism54_mib_mode_helper(priv, mode);
+}
+
+/* this will be executed outside of atomic context thanks to
+ * schedule_work(), thus we can as well use sleeping semaphore
+ * locking */
+void
+prism54_update_stats(islpci_private *priv)
+{
+	char *data;
+	int j;
+	struct obj_bss bss, *bss2;
+	union oid_res_t r;
+
+	if (down_interruptible(&priv->stats_sem))
+		return;
+
+/* Noise floor.
+ * I'm not sure if the unit is dBm.
+ * Note : If we are not connected, this value seems to be irrelevant. */
+
+	mgt_get_request(priv, DOT11_OID_NOISEFLOOR, 0, NULL, &r);
+	priv->local_iwstatistics.qual.noise = r.u;
+
+/* Get the rssi of the link. To do this we need to retrieve a bss. */
+
+	/* First get the MAC address of the AP we are associated with. */
+	mgt_get_request(priv, DOT11_OID_BSSID, 0, NULL, &r);
+	data = r.ptr;
+
+	/* copy this MAC to the bss */
+	memcpy(bss.address, data, 6);
+	kfree(data);
+
+	/* now ask for the corresponding bss */
+	j = mgt_get_request(priv, DOT11_OID_BSSFIND, 0, (void *) &bss, &r);
+	bss2 = r.ptr;
+	/* report the rssi and use it to calculate
+	 *  link quality through a signal-noise
+	 *  ratio */
+	priv->local_iwstatistics.qual.level = bss2->rssi;
+	priv->local_iwstatistics.qual.qual =
+	    bss2->rssi - priv->iwstatistics.qual.noise;
+
+	kfree(bss2);
+
+	/* report that the stats are new */
+	priv->local_iwstatistics.qual.updated = 0x7;
+
+/* Rx : unable to decrypt the MPDU */
+	mgt_get_request(priv, DOT11_OID_PRIVRXFAILED, 0, NULL, &r);
+	priv->local_iwstatistics.discard.code = r.u;
+
+/* Tx : Max MAC retries num reached */
+	mgt_get_request(priv, DOT11_OID_MPDUTXFAILED, 0, NULL, &r);
+	priv->local_iwstatistics.discard.retries = r.u;
+
+	up(&priv->stats_sem);
+
+	return;
+}
+
+struct iw_statistics *
+prism54_get_wireless_stats(struct net_device *ndev)
+{
+	islpci_private *priv = netdev_priv(ndev);
+
+	/* If the stats are being updated return old data */
+	if (down_trylock(&priv->stats_sem) == 0) {
+		memcpy(&priv->iwstatistics, &priv->local_iwstatistics,
+		       sizeof (struct iw_statistics));
+		/* They won't be marked updated for the next time */
+		priv->local_iwstatistics.qual.updated = 0;
+		up(&priv->stats_sem);
+	} else
+		priv->iwstatistics.qual.updated = 0;
+
+	/* Update our wireless stats, but do not schedule to often 
+	 * (max 1 HZ) */
+	if ((priv->stats_timestamp == 0) ||
+	    time_after(jiffies, priv->stats_timestamp + 1 * HZ)) {
+		schedule_work(&priv->stats_work);
+		priv->stats_timestamp = jiffies;
+	}
+
+	return &priv->iwstatistics;
+}
+
+static int
+prism54_commit(struct net_device *ndev, struct iw_request_info *info,
+	       char *cwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+
+	/* simply re-set the last set SSID, this should commit most stuff */
+
+	/* Commit in Monitor mode is not necessary, also setting essid
+	 * in Monitor mode does not make sense and isn't allowed for this
+	 * device's firmware */
+	if (priv->iw_mode != IW_MODE_MONITOR)
+		return mgt_set_request(priv, DOT11_OID_SSID, 0, NULL);
+	return 0;
+}
+
+static int
+prism54_get_name(struct net_device *ndev, struct iw_request_info *info,
+		 char *cwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	char *capabilities;
+	union oid_res_t r;
+	int rvalue;
+
+	if (islpci_get_state(priv) < PRV_STATE_INIT) {
+		strncpy(cwrq, "NOT READY!", IFNAMSIZ);
+		return 0;
+	}
+	rvalue = mgt_get_request(priv, OID_INL_PHYCAPABILITIES, 0, NULL, &r);
+
+	switch (r.u) {
+	case INL_PHYCAP_5000MHZ:
+		capabilities = "IEEE 802.11a/b/g";
+		break;
+	case INL_PHYCAP_FAA:
+		capabilities = "IEEE 802.11b/g - FAA Support";
+		break;
+	case INL_PHYCAP_2400MHZ:
+	default:
+		capabilities = "IEEE 802.11b/g";	/* Default */
+		break;
+	}
+	strncpy(cwrq, capabilities, IFNAMSIZ);
+	return rvalue;
+}
+
+static int
+prism54_set_freq(struct net_device *ndev, struct iw_request_info *info,
+		 struct iw_freq *fwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	int rvalue;
+	u32 c;
+
+	if (fwrq->m < 1000)
+		/* we have a channel number */
+		c = fwrq->m;
+	else
+		c = (fwrq->e == 1) ? channel_of_freq(fwrq->m / 100000) : 0;
+
+	rvalue = c ? mgt_set_request(priv, DOT11_OID_CHANNEL, 0, &c) : -EINVAL;
+
+	/* Call commit handler */
+	return (rvalue ? rvalue : -EINPROGRESS);
+}
+
+static int
+prism54_get_freq(struct net_device *ndev, struct iw_request_info *info,
+		 struct iw_freq *fwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	union oid_res_t r;
+	int rvalue;
+
+	rvalue = mgt_get_request(priv, DOT11_OID_CHANNEL, 0, NULL, &r);
+	fwrq->i = r.u;
+	rvalue |= mgt_get_request(priv, DOT11_OID_FREQUENCY, 0, NULL, &r);
+	fwrq->m = r.u;
+	fwrq->e = 3;
+
+	return rvalue;
+}
+
+static int
+prism54_set_mode(struct net_device *ndev, struct iw_request_info *info,
+		 __u32 * uwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	u32 mlmeautolevel = CARD_DEFAULT_MLME_MODE;
+
+	/* Let's see if the user passed a valid Linux Wireless mode */
+	if (*uwrq > IW_MODE_MONITOR || *uwrq < IW_MODE_AUTO) {
+		printk(KERN_DEBUG
+		       "%s: %s() You passed a non-valid init_mode.\n",
+		       priv->ndev->name, __FUNCTION__);
+		return -EINVAL;
+	}
+
+	down_write(&priv->mib_sem);
+
+	if (prism54_mib_mode_helper(priv, *uwrq)) {
+		up_write(&priv->mib_sem);
+		return -EOPNOTSUPP;
+	}
+
+	/* the ACL code needs an intermediate mlmeautolevel. The wpa stuff an
+	 * extended one.
+	 */
+	if ((*uwrq == IW_MODE_MASTER) && (priv->acl.policy != MAC_POLICY_OPEN))
+		mlmeautolevel = DOT11_MLME_INTERMEDIATE;
+	if (priv->wpa)
+		mlmeautolevel = DOT11_MLME_EXTENDED;
+
+	mgt_set(priv, DOT11_OID_MLMEAUTOLEVEL, &mlmeautolevel);
+
+	if (mgt_commit(priv)) {
+		up_write(&priv->mib_sem);
+		return -EIO;
+	}
+	priv->ndev->type = (priv->iw_mode == IW_MODE_MONITOR)
+	    ? priv->monitor_type : ARPHRD_ETHER;
+	up_write(&priv->mib_sem);
+
+	return 0;
+}
+
+/* Use mib cache */
+static int
+prism54_get_mode(struct net_device *ndev, struct iw_request_info *info,
+		 __u32 * uwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+
+	BUG_ON((priv->iw_mode < IW_MODE_AUTO) || (priv->iw_mode >
+						  IW_MODE_MONITOR));
+	*uwrq = priv->iw_mode;
+
+	return 0;
+}
+
+/* we use DOT11_OID_EDTHRESHOLD. From what I guess the card will not try to
+ * emit data if (sensitivity > rssi - noise) (in dBm).
+ * prism54_set_sens does not seem to work.
+ */
+
+static int
+prism54_set_sens(struct net_device *ndev, struct iw_request_info *info,
+		 struct iw_param *vwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	u32 sens;
+
+	/* by default  the card sets this to 20. */
+	sens = vwrq->disabled ? 20 : vwrq->value;
+
+	return mgt_set_request(priv, DOT11_OID_EDTHRESHOLD, 0, &sens);
+}
+
+static int
+prism54_get_sens(struct net_device *ndev, struct iw_request_info *info,
+		 struct iw_param *vwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	union oid_res_t r;
+	int rvalue;
+
+	rvalue = mgt_get_request(priv, DOT11_OID_EDTHRESHOLD, 0, NULL, &r);
+
+	vwrq->value = r.u;
+	vwrq->disabled = (vwrq->value == 0);
+	vwrq->fixed = 1;
+
+	return rvalue;
+}
+
+static int
+prism54_get_range(struct net_device *ndev, struct iw_request_info *info,
+		  struct iw_point *dwrq, char *extra)
+{
+	struct iw_range *range = (struct iw_range *) extra;
+	islpci_private *priv = netdev_priv(ndev);
+	u8 *data;
+	int i, m, rvalue;
+	struct obj_frequencies *freq;
+	union oid_res_t r;
+
+	memset(range, 0, sizeof (struct iw_range));
+	dwrq->length = sizeof (struct iw_range);
+
+	/* set the wireless extension version number */
+	range->we_version_source = SUPPORTED_WIRELESS_EXT;
+	range->we_version_compiled = WIRELESS_EXT;
+
+	/* Now the encoding capabilities */
+	range->num_encoding_sizes = 3;
+	/* 64(40) bits WEP */
+	range->encoding_size[0] = 5;
+	/* 128(104) bits WEP */
+	range->encoding_size[1] = 13;
+	/* 256 bits for WPA-PSK */
+	range->encoding_size[2] = 32;
+	/* 4 keys are allowed */
+	range->max_encoding_tokens = 4;
+
+	/* we don't know the quality range... */
+	range->max_qual.level = 0;
+	range->max_qual.noise = 0;
+	range->max_qual.qual = 0;
+	/* these value describe an average quality. Needs more tweaking... */
+	range->avg_qual.level = -80;	/* -80 dBm */
+	range->avg_qual.noise = 0;	/* don't know what to put here */
+	range->avg_qual.qual = 0;
+
+	range->sensitivity = 200;
+
+	/* retry limit capabilities */
+	range->retry_capa = IW_RETRY_LIMIT | IW_RETRY_LIFETIME;
+	range->retry_flags = IW_RETRY_LIMIT;
+	range->r_time_flags = IW_RETRY_LIFETIME;
+
+	/* I don't know the range. Put stupid things here */
+	range->min_retry = 1;
+	range->max_retry = 65535;
+	range->min_r_time = 1024;
+	range->max_r_time = 65535 * 1024;
+
+	/* txpower is supported in dBm's */
+	range->txpower_capa = IW_TXPOW_DBM;
+
+#if WIRELESS_EXT > 16
+	/* Event capability (kernel + driver) */
+	range->event_capa[0] = (IW_EVENT_CAPA_K_0 |
+	IW_EVENT_CAPA_MASK(SIOCGIWTHRSPY) |
+	IW_EVENT_CAPA_MASK(SIOCGIWAP));
+	range->event_capa[1] = IW_EVENT_CAPA_K_1;
+	range->event_capa[4] = IW_EVENT_CAPA_MASK(IWEVCUSTOM);
+#endif /* WIRELESS_EXT > 16 */
+
+	if (islpci_get_state(priv) < PRV_STATE_INIT)
+		return 0;
+
+	/* Request the device for the supported frequencies
+	 * not really relevant since some devices will report the 5 GHz band
+	 * frequencies even if they don't support them.
+	 */
+	rvalue =
+	    mgt_get_request(priv, DOT11_OID_SUPPORTEDFREQUENCIES, 0, NULL, &r);
+	freq = r.ptr;
+
+	range->num_channels = freq->nr;
+	range->num_frequency = freq->nr;
+
+	m = min(IW_MAX_FREQUENCIES, (int) freq->nr);
+	for (i = 0; i < m; i++) {
+		range->freq[i].m = freq->mhz[i];
+		range->freq[i].e = 6;
+		range->freq[i].i = channel_of_freq(freq->mhz[i]);
+	}
+	kfree(freq);
+
+	rvalue |= mgt_get_request(priv, DOT11_OID_SUPPORTEDRATES, 0, NULL, &r);
+	data = r.ptr;
+
+	/* We got an array of char. It is NULL terminated. */
+	i = 0;
+	while ((i < IW_MAX_BITRATES) && (*data != 0)) {
+		/*       the result must be in bps. The card gives us 500Kbps */
+		range->bitrate[i] = *data * 500000;
+		i++;
+		data++;
+	}
+	range->num_bitrates = i;
+	kfree(r.ptr);
+
+	return rvalue;
+}
+
+/* Set AP address*/
+
+static int
+prism54_set_wap(struct net_device *ndev, struct iw_request_info *info,
+		struct sockaddr *awrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	char bssid[6];
+	int rvalue;
+
+	if (awrq->sa_family != ARPHRD_ETHER)
+		return -EINVAL;
+
+	/* prepare the structure for the set object */
+	memcpy(&bssid[0], awrq->sa_data, 6);
+
+	/* set the bssid -- does this make sense when in AP mode? */
+	rvalue = mgt_set_request(priv, DOT11_OID_BSSID, 0, &bssid);
+
+	return (rvalue ? rvalue : -EINPROGRESS);	/* Call commit handler */
+}
+
+/* get AP address*/
+
+static int
+prism54_get_wap(struct net_device *ndev, struct iw_request_info *info,
+		struct sockaddr *awrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	union oid_res_t r;
+	int rvalue;
+
+	rvalue = mgt_get_request(priv, DOT11_OID_BSSID, 0, NULL, &r);
+	memcpy(awrq->sa_data, r.ptr, 6);
+	awrq->sa_family = ARPHRD_ETHER;
+	kfree(r.ptr);
+
+	return rvalue;
+}
+
+static int
+prism54_set_scan(struct net_device *dev, struct iw_request_info *info,
+		 struct iw_param *vwrq, char *extra)
+{
+	/* hehe the device does this automagicaly */
+	return 0;
+}
+
+/* a little helper that will translate our data into a card independent
+ * format that the Wireless Tools will understand. This was inspired by
+ * the "Aironet driver for 4500 and 4800 series cards" (GPL)
+ */
+
+static char *
+prism54_translate_bss(struct net_device *ndev, char *current_ev,
+		      char *end_buf, struct obj_bss *bss, char noise)
+{
+	struct iw_event iwe;	/* Temporary buffer */
+	short cap;
+	islpci_private *priv = netdev_priv(ndev);
+
+	/* The first entry must be the MAC address */
+	memcpy(iwe.u.ap_addr.sa_data, bss->address, 6);
+	iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
+	iwe.cmd = SIOCGIWAP;
+	current_ev =
+	    iwe_stream_add_event(current_ev, end_buf, &iwe, IW_EV_ADDR_LEN);
+
+	/* The following entries will be displayed in the same order we give them */
+
+	/* The ESSID. */
+	iwe.u.data.length = bss->ssid.length;
+	iwe.u.data.flags = 1;
+	iwe.cmd = SIOCGIWESSID;
+	current_ev = iwe_stream_add_point(current_ev, end_buf,
+					  &iwe, bss->ssid.octets);
+
+	/* Capabilities */
+#define CAP_ESS 0x01
+#define CAP_IBSS 0x02
+#define CAP_CRYPT 0x10
+
+	/* Mode */
+	cap = bss->capinfo;
+	iwe.u.mode = 0;
+	if (cap & CAP_ESS)
+		iwe.u.mode = IW_MODE_MASTER;
+	else if (cap & CAP_IBSS)
+		iwe.u.mode = IW_MODE_ADHOC;
+	iwe.cmd = SIOCGIWMODE;
+	if (iwe.u.mode)
+		current_ev =
+		    iwe_stream_add_event(current_ev, end_buf, &iwe,
+					 IW_EV_UINT_LEN);
+
+	/* Encryption capability */
+	if (cap & CAP_CRYPT)
+		iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
+	else
+		iwe.u.data.flags = IW_ENCODE_DISABLED;
+	iwe.u.data.length = 0;
+	iwe.cmd = SIOCGIWENCODE;
+	current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe, NULL);
+
+	/* Add frequency. (short) bss->channel is the frequency in MHz */
+	iwe.u.freq.m = bss->channel;
+	iwe.u.freq.e = 6;
+	iwe.cmd = SIOCGIWFREQ;
+	current_ev =
+	    iwe_stream_add_event(current_ev, end_buf, &iwe, IW_EV_FREQ_LEN);
+
+	/* Add quality statistics */
+	iwe.u.qual.level = bss->rssi;
+	iwe.u.qual.noise = noise;
+	/* do a simple SNR for quality */
+	iwe.u.qual.qual = bss->rssi - noise;
+	iwe.cmd = IWEVQUAL;
+	current_ev =
+	    iwe_stream_add_event(current_ev, end_buf, &iwe, IW_EV_QUAL_LEN);
+
+	if (priv->wpa) {
+		u8 wpa_ie[MAX_WPA_IE_LEN];
+		char *buf, *p;
+		size_t wpa_ie_len;
+		int i;
+
+		wpa_ie_len = prism54_wpa_ie_get(priv, bss->address, wpa_ie);
+		if (wpa_ie_len > 0 &&
+		    (buf = kmalloc(wpa_ie_len * 2 + 10, GFP_ATOMIC))) {
+			p = buf;
+			p += sprintf(p, "wpa_ie=");
+			for (i = 0; i < wpa_ie_len; i++) {
+				p += sprintf(p, "%02x", wpa_ie[i]);
+			}
+			memset(&iwe, 0, sizeof (iwe));
+			iwe.cmd = IWEVCUSTOM;
+			iwe.u.data.length = strlen(buf);
+			current_ev = iwe_stream_add_point(current_ev, end_buf,
+							  &iwe, buf);
+			kfree(buf);
+		}
+	}
+	return current_ev;
+}
+
+static int
+prism54_get_scan(struct net_device *ndev, struct iw_request_info *info,
+		 struct iw_point *dwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	int i, rvalue;
+	struct obj_bsslist *bsslist;
+	u32 noise = 0;
+	char *current_ev = extra;
+	union oid_res_t r;
+
+	if (islpci_get_state(priv) < PRV_STATE_INIT) {
+		/* device is not ready, fail gently */
+		dwrq->length = 0;
+		return 0;
+	}
+
+	/* first get the noise value. We will use it to report the link quality */
+	rvalue = mgt_get_request(priv, DOT11_OID_NOISEFLOOR, 0, NULL, &r);
+	noise = r.u;
+
+	/* Ask the device for a list of known bss.
+	* The old API, using SIOCGIWAPLIST, had a hard limit of IW_MAX_AP=64.
+	* The new API, using SIOCGIWSCAN, is only limited by the buffer size.
+	* WE-14->WE-16, the buffer is limited to IW_SCAN_MAX_DATA bytes.
+	* Starting with WE-17, the buffer can be as big as needed.
+	* But the device won't repport anything if you change the value
+	* of IWMAX_BSS=24. */
+	
+	rvalue |= mgt_get_request(priv, DOT11_OID_BSSLIST, 0, NULL, &r);
+	bsslist = r.ptr;
+
+	/* ok now, scan the list and translate its info */
+	for (i = 0; i < (int) bsslist->nr; i++) {
+		current_ev = prism54_translate_bss(ndev, current_ev,
+						   extra + dwrq->length,
+						   &(bsslist->bsslist[i]),
+						   noise);
+#if WIRELESS_EXT > 16
+		/* Check if there is space for one more entry */
+		if((extra + dwrq->length - current_ev) <= IW_EV_ADDR_LEN) {
+			/* Ask user space to try again with a bigger buffer */
+			rvalue = -E2BIG;
+			break;
+		}
+#endif /* WIRELESS_EXT > 16 */
+	}
+
+	kfree(bsslist);
+	dwrq->length = (current_ev - extra);
+	dwrq->flags = 0;	/* todo */
+
+	return rvalue;
+}
+
+static int
+prism54_set_essid(struct net_device *ndev, struct iw_request_info *info,
+		  struct iw_point *dwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	struct obj_ssid essid;
+
+	memset(essid.octets, 0, 33);
+
+	/* Check if we were asked for `any' */
+	if (dwrq->flags && dwrq->length) {
+		if (dwrq->length > min(33, IW_ESSID_MAX_SIZE + 1))
+			return -E2BIG;
+		essid.length = dwrq->length - 1;
+		memcpy(essid.octets, extra, dwrq->length);
+	} else
+		essid.length = 0;
+
+	if (priv->iw_mode != IW_MODE_MONITOR)
+		return mgt_set_request(priv, DOT11_OID_SSID, 0, &essid);
+
+	/* If in monitor mode, just save to mib */
+	mgt_set(priv, DOT11_OID_SSID, &essid);
+	return 0;
+
+}
+
+static int
+prism54_get_essid(struct net_device *ndev, struct iw_request_info *info,
+		  struct iw_point *dwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	struct obj_ssid *essid;
+	union oid_res_t r;
+	int rvalue;
+
+	rvalue = mgt_get_request(priv, DOT11_OID_SSID, 0, NULL, &r);
+	essid = r.ptr;
+
+	if (essid->length) {
+		dwrq->flags = 1;	/* set ESSID to ON for Wireless Extensions */
+		/* if it is to big, trunk it */
+		dwrq->length = min(IW_ESSID_MAX_SIZE, essid->length + 1);
+	} else {
+		dwrq->flags = 0;
+		dwrq->length = 0;
+	}
+	essid->octets[essid->length] = '\0';
+	memcpy(extra, essid->octets, dwrq->length);
+	kfree(essid);
+
+	return rvalue;
+}
+
+/* Provides no functionality, just completes the ioctl. In essence this is a 
+ * just a cosmetic ioctl.
+ */
+static int
+prism54_set_nick(struct net_device *ndev, struct iw_request_info *info,
+		 struct iw_point *dwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+
+	if (dwrq->length > IW_ESSID_MAX_SIZE)
+		return -E2BIG;
+
+	down_write(&priv->mib_sem);
+	memset(priv->nickname, 0, sizeof (priv->nickname));
+	memcpy(priv->nickname, extra, dwrq->length);
+	up_write(&priv->mib_sem);
+
+	return 0;
+}
+
+static int
+prism54_get_nick(struct net_device *ndev, struct iw_request_info *info,
+		 struct iw_point *dwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+
+	dwrq->length = 0;
+
+	down_read(&priv->mib_sem);
+	dwrq->length = strlen(priv->nickname) + 1;
+	memcpy(extra, priv->nickname, dwrq->length);
+	up_read(&priv->mib_sem);
+
+	return 0;
+}
+
+/* Set the allowed Bitrates */
+
+static int
+prism54_set_rate(struct net_device *ndev,
+		 struct iw_request_info *info,
+		 struct iw_param *vwrq, char *extra)
+{
+
+	islpci_private *priv = netdev_priv(ndev);
+	u32 rate, profile;
+	char *data;
+	int ret, i;
+	union oid_res_t r;
+
+	if (vwrq->value == -1) {
+		/* auto mode. No limit. */
+		profile = 1;
+		return mgt_set_request(priv, DOT11_OID_PROFILES, 0, &profile);
+	}
+
+	ret = mgt_get_request(priv, DOT11_OID_SUPPORTEDRATES, 0, NULL, &r);
+	if (ret) {
+		kfree(r.ptr);
+		return ret;
+	}
+
+	rate = (u32) (vwrq->value / 500000);
+	data = r.ptr;
+	i = 0;
+
+	while (data[i]) {
+		if (rate && (data[i] == rate)) {
+			break;
+		}
+		if (vwrq->value == i) {
+			break;
+		}
+		data[i] |= 0x80;
+		i++;
+	}
+
+	if (!data[i]) {
+		kfree(r.ptr);
+		return -EINVAL;
+	}
+
+	data[i] |= 0x80;
+	data[i + 1] = 0;
+
+	/* Now, check if we want a fixed or auto value */
+	if (vwrq->fixed) {
+		data[0] = data[i];
+		data[1] = 0;
+	}
+
+/*
+	i = 0;
+	printk("prism54 rate: ");
+	while(data[i]) {
+		printk("%u ", data[i]);
+		i++;
+	}
+	printk("0\n");
+*/
+	profile = -1;
+	ret = mgt_set_request(priv, DOT11_OID_PROFILES, 0, &profile);
+	ret |= mgt_set_request(priv, DOT11_OID_EXTENDEDRATES, 0, data);
+	ret |= mgt_set_request(priv, DOT11_OID_RATES, 0, data);
+
+	kfree(r.ptr);
+
+	return ret;
+}
+
+/* Get the current bit rate */
+static int
+prism54_get_rate(struct net_device *ndev,
+		 struct iw_request_info *info,
+		 struct iw_param *vwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	int rvalue;
+	char *data;
+	union oid_res_t r;
+
+	/* Get the current bit rate */
+	if ((rvalue = mgt_get_request(priv, GEN_OID_LINKSTATE, 0, NULL, &r)))
+		return rvalue;
+	vwrq->value = r.u * 500000;
+
+	/* request the device for the enabled rates */
+	rvalue = mgt_get_request(priv, DOT11_OID_RATES, 0, NULL, &r);
+	if (rvalue) {
+		kfree(r.ptr);
+		return rvalue;
+	}
+	data = r.ptr;
+	vwrq->fixed = (data[0] != 0) && (data[1] == 0);
+	kfree(r.ptr);
+
+	return 0;
+}
+
+static int
+prism54_set_rts(struct net_device *ndev, struct iw_request_info *info,
+		struct iw_param *vwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+
+	return mgt_set_request(priv, DOT11_OID_RTSTHRESH, 0, &vwrq->value);
+}
+
+static int
+prism54_get_rts(struct net_device *ndev, struct iw_request_info *info,
+		struct iw_param *vwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	union oid_res_t r;
+	int rvalue;
+
+	/* get the rts threshold */
+	rvalue = mgt_get_request(priv, DOT11_OID_RTSTHRESH, 0, NULL, &r);
+	vwrq->value = r.u;
+
+	return rvalue;
+}
+
+static int
+prism54_set_frag(struct net_device *ndev, struct iw_request_info *info,
+		 struct iw_param *vwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+
+	return mgt_set_request(priv, DOT11_OID_FRAGTHRESH, 0, &vwrq->value);
+}
+
+static int
+prism54_get_frag(struct net_device *ndev, struct iw_request_info *info,
+		 struct iw_param *vwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	union oid_res_t r;
+	int rvalue;
+
+	rvalue = mgt_get_request(priv, DOT11_OID_FRAGTHRESH, 0, NULL, &r);
+	vwrq->value = r.u;
+
+	return rvalue;
+}
+
+/* Here we have (min,max) = max retries for (small frames, big frames). Where
+ * big frame <=>  bigger than the rts threshold
+ * small frame <=>  smaller than the rts threshold
+ * This is not really the behavior expected by the wireless tool but it seems
+ * to be a common behavior in other drivers.
+ */
+
+static int
+prism54_set_retry(struct net_device *ndev, struct iw_request_info *info,
+		  struct iw_param *vwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	u32 slimit = 0, llimit = 0;	/* short and long limit */
+	u32 lifetime = 0;
+	int rvalue = 0;
+
+	if (vwrq->disabled)
+		/* we cannot disable this feature */
+		return -EINVAL;
+
+	if (vwrq->flags & IW_RETRY_LIMIT) {
+		if (vwrq->flags & IW_RETRY_MIN)
+			slimit = vwrq->value;
+		else if (vwrq->flags & IW_RETRY_MAX)
+			llimit = vwrq->value;
+		else {
+			/* we are asked to set both */
+			slimit = vwrq->value;
+			llimit = vwrq->value;
+		}
+	}
+	if (vwrq->flags & IW_RETRY_LIFETIME)
+		/* Wireless tools use us unit while the device uses 1024 us unit */
+		lifetime = vwrq->value / 1024;
+
+	/* now set what is requested */
+	if (slimit)
+		rvalue =
+		    mgt_set_request(priv, DOT11_OID_SHORTRETRIES, 0, &slimit);
+	if (llimit)
+		rvalue |=
+		    mgt_set_request(priv, DOT11_OID_LONGRETRIES, 0, &llimit);
+	if (lifetime)
+		rvalue |=
+		    mgt_set_request(priv, DOT11_OID_MAXTXLIFETIME, 0,
+				    &lifetime);
+	return rvalue;
+}
+
+static int
+prism54_get_retry(struct net_device *ndev, struct iw_request_info *info,
+		  struct iw_param *vwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	union oid_res_t r;
+	int rvalue = 0;
+	vwrq->disabled = 0;	/* It cannot be disabled */
+
+	if ((vwrq->flags & IW_RETRY_TYPE) == IW_RETRY_LIFETIME) {
+		/* we are asked for the life time */
+		rvalue =
+		    mgt_get_request(priv, DOT11_OID_MAXTXLIFETIME, 0, NULL, &r);
+		vwrq->value = r.u * 1024;
+		vwrq->flags = IW_RETRY_LIFETIME;
+	} else if ((vwrq->flags & IW_RETRY_MAX)) {
+		/* we are asked for the long retry limit */
+		rvalue |=
+		    mgt_get_request(priv, DOT11_OID_LONGRETRIES, 0, NULL, &r);
+		vwrq->value = r.u;
+		vwrq->flags = IW_RETRY_LIMIT | IW_RETRY_MAX;
+	} else {
+		/* default. get the  short retry limit */
+		rvalue |=
+		    mgt_get_request(priv, DOT11_OID_SHORTRETRIES, 0, NULL, &r);
+		vwrq->value = r.u;
+		vwrq->flags = IW_RETRY_LIMIT | IW_RETRY_MIN;
+	}
+
+	return rvalue;
+}
+
+static int
+prism54_set_encode(struct net_device *ndev, struct iw_request_info *info,
+		   struct iw_point *dwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	int rvalue = 0, force = 0;
+	int authen = DOT11_AUTH_OS, invoke = 0, exunencrypt = 0;
+	union oid_res_t r;
+
+	/* with the new API, it's impossible to get a NULL pointer.
+	 * New version of iwconfig set the IW_ENCODE_NOKEY flag
+	 * when no key is given, but older versions don't. */
+
+	if (dwrq->length > 0) {
+		/* we have a key to set */
+		int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
+		int current_index;
+		struct obj_key key = { DOT11_PRIV_WEP, 0, "" };
+
+		/* get the current key index */
+		rvalue = mgt_get_request(priv, DOT11_OID_DEFKEYID, 0, NULL, &r);
+		current_index = r.u;
+		/* Verify that the key is not marked as invalid */
+		if (!(dwrq->flags & IW_ENCODE_NOKEY)) {
+			key.length = dwrq->length > sizeof (key.key) ?
+			    sizeof (key.key) : dwrq->length;
+			memcpy(key.key, extra, key.length);
+			if (key.length == 32)
+				/* we want WPA-PSK */
+				key.type = DOT11_PRIV_TKIP;
+			if ((index < 0) || (index > 3))
+				/* no index provided use the current one */
+				index = current_index;
+
+			/* now send the key to the card  */
+			rvalue |=
+			    mgt_set_request(priv, DOT11_OID_DEFKEYX, index,
+					    &key);
+		}
+		/*
+		 * If a valid key is set, encryption should be enabled 
+		 * (user may turn it off later).
+		 * This is also how "iwconfig ethX key on" works
+		 */
+		if ((index == current_index) && (key.length > 0))
+			force = 1;
+	} else {
+		int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
+		if ((index >= 0) && (index <= 3)) {
+			/* we want to set the key index */
+			rvalue |=
+			    mgt_set_request(priv, DOT11_OID_DEFKEYID, 0,
+					    &index);
+		} else {
+			if (!dwrq->flags & IW_ENCODE_MODE) {
+				/* we cannot do anything. Complain. */
+				return -EINVAL;
+			}
+		}
+	}
+	/* now read the flags */
+	if (dwrq->flags & IW_ENCODE_DISABLED) {
+		/* Encoding disabled, 
+		 * authen = DOT11_AUTH_OS;
+		 * invoke = 0;
+		 * exunencrypt = 0; */
+	}
+	if (dwrq->flags & IW_ENCODE_OPEN)
+		/* Encode but accept non-encoded packets. No auth */
+		invoke = 1;
+	if ((dwrq->flags & IW_ENCODE_RESTRICTED) || force) {
+		/* Refuse non-encoded packets. Auth */
+		authen = DOT11_AUTH_BOTH;
+		invoke = 1;
+		exunencrypt = 1;
+	}
+	/* do the change if requested  */
+	if ((dwrq->flags & IW_ENCODE_MODE) || force) {
+		rvalue |=
+		    mgt_set_request(priv, DOT11_OID_AUTHENABLE, 0, &authen);
+		rvalue |=
+		    mgt_set_request(priv, DOT11_OID_PRIVACYINVOKED, 0, &invoke);
+		rvalue |=
+		    mgt_set_request(priv, DOT11_OID_EXUNENCRYPTED, 0,
+				    &exunencrypt);
+	}
+	return rvalue;
+}
+
+static int
+prism54_get_encode(struct net_device *ndev, struct iw_request_info *info,
+		   struct iw_point *dwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	struct obj_key *key;
+	u32 devindex, index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
+	u32 authen = 0, invoke = 0, exunencrypt = 0;
+	int rvalue;
+	union oid_res_t r;
+
+	/* first get the flags */
+	rvalue = mgt_get_request(priv, DOT11_OID_AUTHENABLE, 0, NULL, &r);
+	authen = r.u;
+	rvalue |= mgt_get_request(priv, DOT11_OID_PRIVACYINVOKED, 0, NULL, &r);
+	invoke = r.u;
+	rvalue |= mgt_get_request(priv, DOT11_OID_EXUNENCRYPTED, 0, NULL, &r);
+	exunencrypt = r.u;
+
+	if (invoke && (authen == DOT11_AUTH_BOTH) && exunencrypt)
+		dwrq->flags = IW_ENCODE_RESTRICTED;
+	else if ((authen == DOT11_AUTH_OS) && !exunencrypt) {
+		if (invoke)
+			dwrq->flags = IW_ENCODE_OPEN;
+		else
+			dwrq->flags = IW_ENCODE_DISABLED;
+	} else
+		/* The card should not work in this state */
+		dwrq->flags = 0;
+
+	/* get the current device key index */
+	rvalue |= mgt_get_request(priv, DOT11_OID_DEFKEYID, 0, NULL, &r);
+	devindex = r.u;
+	/* Now get the key, return it */
+	if ((index < 0) || (index > 3))
+		/* no index provided, use the current one */
+		index = devindex;
+	rvalue |= mgt_get_request(priv, DOT11_OID_DEFKEYX, index, NULL, &r);
+	key = r.ptr;
+	dwrq->length = key->length;
+	memcpy(extra, key->key, dwrq->length);
+	kfree(key);
+	/* return the used key index */
+	dwrq->flags |= devindex + 1;
+
+	return rvalue;
+}
+
+static int
+prism54_get_txpower(struct net_device *ndev, struct iw_request_info *info,
+		    struct iw_param *vwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	union oid_res_t r;
+	int rvalue;
+
+	rvalue = mgt_get_request(priv, OID_INL_OUTPUTPOWER, 0, NULL, &r);
+	/* intersil firmware operates in 0.25 dBm (1/4 dBm) */
+	vwrq->value = (s32) r.u / 4;
+	vwrq->fixed = 1;
+	/* radio is not turned of
+	 * btw: how is possible to turn off only the radio 
+	 */
+	vwrq->disabled = 0;
+
+	return rvalue;
+}
+
+static int
+prism54_set_txpower(struct net_device *ndev, struct iw_request_info *info,
+		    struct iw_param *vwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	s32 u = vwrq->value;
+
+	/* intersil firmware operates in 0.25 dBm (1/4) */
+	u *= 4;
+	if (vwrq->disabled) {
+		/* don't know how to disable radio */
+		printk(KERN_DEBUG
+		       "%s: %s() disabling radio is not yet supported.\n",
+		       priv->ndev->name, __FUNCTION__);
+		return -ENOTSUPP;
+	} else if (vwrq->fixed)
+		/* currently only fixed value is supported */
+		return mgt_set_request(priv, OID_INL_OUTPUTPOWER, 0, &u);
+	else {
+		printk(KERN_DEBUG
+		       "%s: %s() auto power will be implemented later.\n",
+		       priv->ndev->name, __FUNCTION__);
+		return -ENOTSUPP;
+	}
+}
+
+static int
+prism54_reset(struct net_device *ndev, struct iw_request_info *info,
+	      __u32 * uwrq, char *extra)
+{
+	islpci_reset(netdev_priv(ndev), 0);
+
+	return 0;
+}
+
+static int
+prism54_get_oid(struct net_device *ndev, struct iw_request_info *info,
+		struct iw_point *dwrq, char *extra)
+{
+	union oid_res_t r;
+	int rvalue;
+	enum oid_num_t n = dwrq->flags;
+
+	rvalue = mgt_get_request((islpci_private *) ndev->priv, n, 0, NULL, &r);
+	dwrq->length = mgt_response_to_str(n, &r, extra);
+	if ((isl_oid[n].flags & OID_FLAG_TYPE) != OID_TYPE_U32)
+		kfree(r.ptr);
+	return rvalue;
+}
+
+static int
+prism54_set_u32(struct net_device *ndev, struct iw_request_info *info,
+		__u32 * uwrq, char *extra)
+{
+	u32 oid = uwrq[0], u = uwrq[1];
+
+	return mgt_set_request((islpci_private *) ndev->priv, oid, 0, &u);
+}
+
+static int
+prism54_set_raw(struct net_device *ndev, struct iw_request_info *info,
+		struct iw_point *dwrq, char *extra)
+{
+	u32 oid = dwrq->flags;
+
+	return mgt_set_request((islpci_private *) ndev->priv, oid, 0, extra);
+}
+
+void
+prism54_acl_init(struct islpci_acl *acl)
+{
+	sema_init(&acl->sem, 1);
+	INIT_LIST_HEAD(&acl->mac_list);
+	acl->size = 0;
+	acl->policy = MAC_POLICY_OPEN;
+}
+
+static void
+prism54_clear_mac(struct islpci_acl *acl)
+{
+	struct list_head *ptr, *next;
+	struct mac_entry *entry;
+
+	if (down_interruptible(&acl->sem))
+		return;
+
+	if (acl->size == 0) {
+		up(&acl->sem);
+		return;
+	}
+
+	for (ptr = acl->mac_list.next, next = ptr->next;
+	     ptr != &acl->mac_list; ptr = next, next = ptr->next) {
+		entry = list_entry(ptr, struct mac_entry, _list);
+		list_del(ptr);
+		kfree(entry);
+	}
+	acl->size = 0;
+	up(&acl->sem);
+}
+
+void
+prism54_acl_clean(struct islpci_acl *acl)
+{
+	prism54_clear_mac(acl);
+}
+
+static int
+prism54_add_mac(struct net_device *ndev, struct iw_request_info *info,
+		struct sockaddr *awrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	struct islpci_acl *acl = &priv->acl;
+	struct mac_entry *entry;
+	struct sockaddr *addr = (struct sockaddr *) extra;
+
+	if (addr->sa_family != ARPHRD_ETHER)
+		return -EOPNOTSUPP;
+
+	entry = kmalloc(sizeof (struct mac_entry), GFP_KERNEL);
+	if (entry == NULL)
+		return -ENOMEM;
+
+	memcpy(entry->addr, addr->sa_data, ETH_ALEN);
+
+	if (down_interruptible(&acl->sem)) {
+		kfree(entry);
+		return -ERESTARTSYS;
+	}
+	list_add_tail(&entry->_list, &acl->mac_list);
+	acl->size++;
+	up(&acl->sem);
+
+	return 0;
+}
+
+static int
+prism54_del_mac(struct net_device *ndev, struct iw_request_info *info,
+		struct sockaddr *awrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	struct islpci_acl *acl = &priv->acl;
+	struct mac_entry *entry;
+	struct list_head *ptr;
+	struct sockaddr *addr = (struct sockaddr *) extra;
+
+	if (addr->sa_family != ARPHRD_ETHER)
+		return -EOPNOTSUPP;
+
+	if (down_interruptible(&acl->sem))
+		return -ERESTARTSYS;
+	for (ptr = acl->mac_list.next; ptr != &acl->mac_list; ptr = ptr->next) {
+		entry = list_entry(ptr, struct mac_entry, _list);
+
+		if (memcmp(entry->addr, addr->sa_data, ETH_ALEN) == 0) {
+			list_del(ptr);
+			acl->size--;
+			kfree(entry);
+			up(&acl->sem);
+			return 0;
+		}
+	}
+	up(&acl->sem);
+	return -EINVAL;
+}
+
+static int
+prism54_get_mac(struct net_device *ndev, struct iw_request_info *info,
+		struct iw_point *dwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	struct islpci_acl *acl = &priv->acl;
+	struct mac_entry *entry;
+	struct list_head *ptr;
+	struct sockaddr *dst = (struct sockaddr *) extra;
+
+	dwrq->length = 0;
+
+	if (down_interruptible(&acl->sem))
+		return -ERESTARTSYS;
+
+	for (ptr = acl->mac_list.next; ptr != &acl->mac_list; ptr = ptr->next) {
+		entry = list_entry(ptr, struct mac_entry, _list);
+
+		memcpy(dst->sa_data, entry->addr, ETH_ALEN);
+		dst->sa_family = ARPHRD_ETHER;
+		dwrq->length++;
+		dst++;
+	}
+	up(&acl->sem);
+	return 0;
+}
+
+/* Setting policy also clears the MAC acl, even if we don't change the defaut
+ * policy
+ */
+
+static int
+prism54_set_policy(struct net_device *ndev, struct iw_request_info *info,
+		   __u32 * uwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	struct islpci_acl *acl = &priv->acl;
+	u32 mlmeautolevel;
+
+	prism54_clear_mac(acl);
+
+	if ((*uwrq < MAC_POLICY_OPEN) || (*uwrq > MAC_POLICY_REJECT))
+		return -EINVAL;
+
+	down_write(&priv->mib_sem);
+
+	acl->policy = *uwrq;
+
+	/* the ACL code needs an intermediate mlmeautolevel */
+	if ((priv->iw_mode == IW_MODE_MASTER) &&
+	    (acl->policy != MAC_POLICY_OPEN))
+		mlmeautolevel = DOT11_MLME_INTERMEDIATE;
+	else
+		mlmeautolevel = CARD_DEFAULT_MLME_MODE;
+	if (priv->wpa)
+		mlmeautolevel = DOT11_MLME_EXTENDED;
+	mgt_set(priv, DOT11_OID_MLMEAUTOLEVEL, &mlmeautolevel);
+	/* restart the card with our new policy */
+	if (mgt_commit(priv)) {
+		up_write(&priv->mib_sem);
+		return -EIO;
+	}
+	up_write(&priv->mib_sem);
+
+	return 0;
+}
+
+static int
+prism54_get_policy(struct net_device *ndev, struct iw_request_info *info,
+		   __u32 * uwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	struct islpci_acl *acl = &priv->acl;
+
+	*uwrq = acl->policy;
+
+	return 0;
+}
+
+/* Return 1 only if client should be accepted. */
+
+static int
+prism54_mac_accept(struct islpci_acl *acl, char *mac)
+{
+	struct list_head *ptr;
+	struct mac_entry *entry;
+	int res = 0;
+
+	if (down_interruptible(&acl->sem))
+		return -ERESTARTSYS;
+
+	if (acl->policy == MAC_POLICY_OPEN) {
+		up(&acl->sem);
+		return 1;
+	}
+
+	for (ptr = acl->mac_list.next; ptr != &acl->mac_list; ptr = ptr->next) {
+		entry = list_entry(ptr, struct mac_entry, _list);
+		if (memcmp(entry->addr, mac, ETH_ALEN) == 0) {
+			res = 1;
+			break;
+		}
+	}
+	res = (acl->policy == MAC_POLICY_ACCEPT) ? !res : res;
+	up(&acl->sem);
+
+	return res;
+}
+
+static int
+prism54_kick_all(struct net_device *ndev, struct iw_request_info *info,
+		 struct iw_point *dwrq, char *extra)
+{
+	struct obj_mlme *mlme;
+	int rvalue;
+
+	mlme = kmalloc(sizeof (struct obj_mlme), GFP_KERNEL);
+	if (mlme == NULL)
+		return -ENOMEM;
+
+	/* Tell the card to kick every client */
+	mlme->id = 0;
+	rvalue =
+	    mgt_set_request(netdev_priv(ndev), DOT11_OID_DISASSOCIATE, 0, mlme);
+	kfree(mlme);
+
+	return rvalue;
+}
+
+static int
+prism54_kick_mac(struct net_device *ndev, struct iw_request_info *info,
+		 struct sockaddr *awrq, char *extra)
+{
+	struct obj_mlme *mlme;
+	struct sockaddr *addr = (struct sockaddr *) extra;
+	int rvalue;
+
+	if (addr->sa_family != ARPHRD_ETHER)
+		return -EOPNOTSUPP;
+
+	mlme = kmalloc(sizeof (struct obj_mlme), GFP_KERNEL);
+	if (mlme == NULL)
+		return -ENOMEM;
+
+	/* Tell the card to only kick the corresponding bastard */
+	memcpy(mlme->address, addr->sa_data, ETH_ALEN);
+	mlme->id = -1;
+	rvalue =
+	    mgt_set_request(netdev_priv(ndev), DOT11_OID_DISASSOCIATE, 0, mlme);
+
+	kfree(mlme);
+
+	return rvalue;
+}
+
+/* Translate a TRAP oid into a wireless event. Called in islpci_mgt_receive. */
+
+static void
+format_event(islpci_private *priv, char *dest, const char *str,
+	     const struct obj_mlme *mlme, u16 *length, int error)
+{
+	const u8 *a = mlme->address;
+	int n = snprintf(dest, IW_CUSTOM_MAX,
+			 "%s %s %2.2X:%2.2X:%2.2X:%2.2X:%2.2X:%2.2X %s (%2.2X)",
+			 str,
+			 ((priv->iw_mode == IW_MODE_MASTER) ? "from" : "to"),
+			 a[0], a[1], a[2], a[3], a[4], a[5],
+			 (error ? (mlme->code ? " : REJECTED " : " : ACCEPTED ")
+			  : ""), mlme->code);
+	BUG_ON(n > IW_CUSTOM_MAX);
+	*length = n;
+}
+
+static void
+send_formatted_event(islpci_private *priv, const char *str,
+		     const struct obj_mlme *mlme, int error)
+{
+	union iwreq_data wrqu;
+	char *memptr;
+
+	memptr = kmalloc(IW_CUSTOM_MAX, GFP_KERNEL);
+	if (!memptr)
+		return;
+	wrqu.data.pointer = memptr;
+	wrqu.data.length = 0;
+	format_event(priv, memptr, str, mlme, &wrqu.data.length,
+		     error);
+	wireless_send_event(priv->ndev, IWEVCUSTOM, &wrqu, memptr);
+	kfree(memptr);
+}
+
+static void
+send_simple_event(islpci_private *priv, const char *str)
+{
+	union iwreq_data wrqu;
+	char *memptr;
+	int n = strlen(str);
+
+	memptr = kmalloc(IW_CUSTOM_MAX, GFP_KERNEL);
+	if (!memptr)
+		return;
+	BUG_ON(n > IW_CUSTOM_MAX);
+	wrqu.data.pointer = memptr;
+	wrqu.data.length = n;
+	strcpy(memptr, str);
+	wireless_send_event(priv->ndev, IWEVCUSTOM, &wrqu, memptr);
+	kfree(memptr);
+}
+
+static void
+link_changed(struct net_device *ndev, u32 bitrate)
+{
+	islpci_private *priv = netdev_priv(ndev);
+
+	if (bitrate) {
+		if (priv->iw_mode == IW_MODE_INFRA) {
+			union iwreq_data uwrq;
+			prism54_get_wap(ndev, NULL, (struct sockaddr *) &uwrq,
+					NULL);
+			wireless_send_event(ndev, SIOCGIWAP, &uwrq, NULL);
+		} else
+			send_simple_event(netdev_priv(ndev),
+					  "Link established");
+	} else
+		send_simple_event(netdev_priv(ndev), "Link lost");
+}
+
+/* Beacon/ProbeResp payload header */
+struct ieee80211_beacon_phdr {
+	u8 timestamp[8];
+	u16 beacon_int;
+	u16 capab_info;
+} __attribute__ ((packed));
+
+#define WLAN_EID_GENERIC 0xdd
+static u8 wpa_oid[4] = { 0x00, 0x50, 0xf2, 1 };
+
+#define MAC2STR(a) (a)[0], (a)[1], (a)[2], (a)[3], (a)[4], (a)[5]
+#define MACSTR "%02x:%02x:%02x:%02x:%02x:%02x"
+
+static void
+prism54_wpa_ie_add(islpci_private *priv, u8 *bssid,
+		   u8 *wpa_ie, size_t wpa_ie_len)
+{
+	struct list_head *ptr;
+	struct islpci_bss_wpa_ie *bss = NULL;
+
+	if (wpa_ie_len > MAX_WPA_IE_LEN)
+		wpa_ie_len = MAX_WPA_IE_LEN;
+
+	if (down_interruptible(&priv->wpa_sem))
+		return;
+
+	/* try to use existing entry */
+	list_for_each(ptr, &priv->bss_wpa_list) {
+		bss = list_entry(ptr, struct islpci_bss_wpa_ie, list);
+		if (memcmp(bss->bssid, bssid, ETH_ALEN) == 0) {
+			list_move(&bss->list, &priv->bss_wpa_list);
+			break;
+		}
+		bss = NULL;
+	}
+
+	if (bss == NULL) {
+		/* add a new BSS entry; if max number of entries is already
+		 * reached, replace the least recently updated */
+		if (priv->num_bss_wpa >= MAX_BSS_WPA_IE_COUNT) {
+			bss = list_entry(priv->bss_wpa_list.prev,
+					 struct islpci_bss_wpa_ie, list);
+			list_del(&bss->list);
+		} else {
+			bss = kmalloc(sizeof (*bss), GFP_ATOMIC);
+			if (bss != NULL) {
+				priv->num_bss_wpa++;
+				memset(bss, 0, sizeof (*bss));
+			}
+		}
+		if (bss != NULL) {
+			memcpy(bss->bssid, bssid, ETH_ALEN);
+			list_add(&bss->list, &priv->bss_wpa_list);
+		}
+	}
+
+	if (bss != NULL) {
+		memcpy(bss->wpa_ie, wpa_ie, wpa_ie_len);
+		bss->wpa_ie_len = wpa_ie_len;
+		bss->last_update = jiffies;
+	} else {
+		printk(KERN_DEBUG "Failed to add BSS WPA entry for " MACSTR
+		       "\n", MAC2STR(bssid));
+	}
+
+	/* expire old entries from WPA list */
+	while (priv->num_bss_wpa > 0) {
+		bss = list_entry(priv->bss_wpa_list.prev,
+				 struct islpci_bss_wpa_ie, list);
+		if (!time_after(jiffies, bss->last_update + 60 * HZ))
+			break;
+
+		list_del(&bss->list);
+		priv->num_bss_wpa--;
+		kfree(bss);
+	}
+
+	up(&priv->wpa_sem);
+}
+
+static size_t
+prism54_wpa_ie_get(islpci_private *priv, u8 *bssid, u8 *wpa_ie)
+{
+	struct list_head *ptr;
+	struct islpci_bss_wpa_ie *bss = NULL;
+	size_t len = 0;
+
+	if (down_interruptible(&priv->wpa_sem))
+		return 0;
+
+	list_for_each(ptr, &priv->bss_wpa_list) {
+		bss = list_entry(ptr, struct islpci_bss_wpa_ie, list);
+		if (memcmp(bss->bssid, bssid, ETH_ALEN) == 0)
+			break;
+		bss = NULL;
+	}
+	if (bss) {
+		len = bss->wpa_ie_len;
+		memcpy(wpa_ie, bss->wpa_ie, len);
+	}
+	up(&priv->wpa_sem);
+
+	return len;
+}
+
+void
+prism54_wpa_ie_init(islpci_private *priv)
+{
+	INIT_LIST_HEAD(&priv->bss_wpa_list);
+	sema_init(&priv->wpa_sem, 1);
+}
+
+void
+prism54_wpa_ie_clean(islpci_private *priv)
+{
+	struct list_head *ptr, *n;
+
+	list_for_each_safe(ptr, n, &priv->bss_wpa_list) {
+		struct islpci_bss_wpa_ie *bss;
+		bss = list_entry(ptr, struct islpci_bss_wpa_ie, list);
+		kfree(bss);
+	}
+}
+
+static void
+prism54_process_bss_data(islpci_private *priv, u32 oid, u8 *addr,
+			 u8 *payload, size_t len)
+{
+	struct ieee80211_beacon_phdr *hdr;
+	u8 *pos, *end;
+
+	if (!priv->wpa)
+		return;
+
+	hdr = (struct ieee80211_beacon_phdr *) payload;
+	pos = (u8 *) (hdr + 1);
+	end = payload + len;
+	while (pos < end) {
+		if (pos + 2 + pos[1] > end) {
+			printk(KERN_DEBUG "Parsing Beacon/ProbeResp failed "
+			       "for " MACSTR "\n", MAC2STR(addr));
+			return;
+		}
+		if (pos[0] == WLAN_EID_GENERIC && pos[1] >= 4 &&
+		    memcmp(pos + 2, wpa_oid, 4) == 0) {
+			prism54_wpa_ie_add(priv, addr, pos, pos[1] + 2);
+			return;
+		}
+		pos += 2 + pos[1];
+	}
+}
+
+static void
+handle_request(islpci_private *priv, struct obj_mlme *mlme, enum oid_num_t oid)
+{
+	if (((mlme->state == DOT11_STATE_AUTHING) ||
+	     (mlme->state == DOT11_STATE_ASSOCING))
+	    && mgt_mlme_answer(priv)) {
+		/* Someone is requesting auth and we must respond. Just send back
+		 * the trap with error code set accordingly.
+		 */
+		mlme->code = prism54_mac_accept(&priv->acl,
+						mlme->address) ? 0 : 1;
+		mgt_set_request(priv, oid, 0, mlme);
+	}
+}
+
+static int
+prism54_process_trap_helper(islpci_private *priv, enum oid_num_t oid,
+			    char *data)
+{
+	struct obj_mlme *mlme = (struct obj_mlme *) data;
+	struct obj_mlmeex *mlmeex = (struct obj_mlmeex *) data;
+	struct obj_mlmeex *confirm;
+	u8 wpa_ie[MAX_WPA_IE_LEN];
+	int wpa_ie_len;
+	size_t len = 0; /* u16, better? */
+	u8 *payload = NULL, *pos = NULL;
+	int ret;
+
+	/* I think all trapable objects are listed here.
+	 * Some oids have a EX version. The difference is that they are emitted
+	 * in DOT11_MLME_EXTENDED mode (set with DOT11_OID_MLMEAUTOLEVEL)
+	 * with more info.
+	 * The few events already defined by the wireless tools are not really
+	 * suited. We use the more flexible custom event facility.
+	 */
+
+	if (oid >= DOT11_OID_BEACON) {
+		len = mlmeex->size;
+		payload = pos = mlmeex->data;
+	}
+
+	/* I fear prism54_process_bss_data won't work with big endian data */
+	if ((oid == DOT11_OID_BEACON) || (oid == DOT11_OID_PROBE))
+		prism54_process_bss_data(priv, oid, mlmeex->address,
+					 payload, len);
+
+	mgt_le_to_cpu(isl_oid[oid].flags & OID_FLAG_TYPE, (void *) mlme);
+
+	switch (oid) {
+
+	case GEN_OID_LINKSTATE:
+		link_changed(priv->ndev, (u32) *data);
+		break;
+
+	case DOT11_OID_MICFAILURE:
+		send_simple_event(priv, "Mic failure");
+		break;
+
+	case DOT11_OID_DEAUTHENTICATE:
+		send_formatted_event(priv, "DeAuthenticate request", mlme, 0);
+		break;
+
+	case DOT11_OID_AUTHENTICATE:
+		handle_request(priv, mlme, oid);
+		send_formatted_event(priv, "Authenticate request", mlme, 1);
+		break;
+
+	case DOT11_OID_DISASSOCIATE:
+		send_formatted_event(priv, "Disassociate request", mlme, 0);
+		break;
+
+	case DOT11_OID_ASSOCIATE:
+		handle_request(priv, mlme, oid);
+		send_formatted_event(priv, "Associate request", mlme, 1);
+		break;
+
+	case DOT11_OID_REASSOCIATE:
+		handle_request(priv, mlme, oid);
+		send_formatted_event(priv, "ReAssociate request", mlme, 1);
+		break;
+
+	case DOT11_OID_BEACON:
+		send_formatted_event(priv,
+				     "Received a beacon from an unkown AP",
+				     mlme, 0);
+		break;
+
+	case DOT11_OID_PROBE:
+		/* we received a probe from a client. */
+		send_formatted_event(priv, "Received a probe from client", mlme,
+				     0);
+		break;
+
+		/* Note : "mlme" is actually a "struct obj_mlmeex *" here, but this
+		 * is backward compatible layout-wise with "struct obj_mlme".
+		 */
+
+	case DOT11_OID_DEAUTHENTICATEEX:
+		send_formatted_event(priv, "DeAuthenticate request", mlme, 0);
+		break;
+
+	case DOT11_OID_AUTHENTICATEEX:
+		handle_request(priv, mlme, oid);
+		send_formatted_event(priv, "Authenticate request (ex)", mlme, 1);
+
+		if (priv->iw_mode != IW_MODE_MASTER 
+				&& mlmeex->state != DOT11_STATE_AUTHING)
+			break;
+
+		confirm = kmalloc(sizeof(struct obj_mlmeex) + 6, GFP_ATOMIC);
+
+		if (!confirm) 
+			break;
+
+		memcpy(&confirm->address, mlmeex->address, ETH_ALEN);
+		printk(KERN_DEBUG "Authenticate from: address:\t%02x:%02x:%02x:%02x:%02x:%02x\n", 
+				mlmeex->address[0],
+				mlmeex->address[1],
+				mlmeex->address[2],
+				mlmeex->address[3],
+				mlmeex->address[4],
+				mlmeex->address[5]
+				);
+		confirm->id = -1; /* or mlmeex->id ? */
+		confirm->state = 0; /* not used */
+		confirm->code = 0;
+		confirm->size = 6;
+		confirm->data[0] = 0x00;
+		confirm->data[1] = 0x00;
+		confirm->data[2] = 0x02;
+		confirm->data[3] = 0x00;
+		confirm->data[4] = 0x00;
+		confirm->data[5] = 0x00;
+
+		ret = mgt_set_varlen(priv, DOT11_OID_ASSOCIATEEX, confirm, 6);
+
+		kfree(confirm);
+		if (ret)
+			return ret;
+		break;
+
+	case DOT11_OID_DISASSOCIATEEX:
+		send_formatted_event(priv, "Disassociate request (ex)", mlme, 0);
+		break;
+
+	case DOT11_OID_ASSOCIATEEX:
+		handle_request(priv, mlme, oid);
+		send_formatted_event(priv, "Associate request (ex)", mlme, 1);
+
+		if (priv->iw_mode != IW_MODE_MASTER 
+				&& mlmeex->state != DOT11_STATE_AUTHING)
+			break;
+		
+		confirm = kmalloc(sizeof(struct obj_mlmeex), GFP_ATOMIC);
+
+		if (!confirm)
+			break;
+
+		memcpy(&confirm->address, mlmeex->address, ETH_ALEN);
+
+		confirm->id = ((struct obj_mlmeex *)mlme)->id;
+		confirm->state = 0; /* not used */
+		confirm->code = 0;
+
+		wpa_ie_len = prism54_wpa_ie_get(priv, mlmeex->address, wpa_ie);
+
+		if (!wpa_ie_len) {
+			printk(KERN_DEBUG "No WPA IE found from "
+					"address:\t%02x:%02x:%02x:%02x:%02x:%02x\n", 
+				mlmeex->address[0],
+				mlmeex->address[1],
+				mlmeex->address[2],
+				mlmeex->address[3],
+				mlmeex->address[4],
+				mlmeex->address[5]
+				);
+			kfree(confirm);
+			break;
+		}
+
+		confirm->size = wpa_ie_len;
+		memcpy(&confirm->data, wpa_ie, wpa_ie_len);
+
+		mgt_set_varlen(priv, oid, confirm, wpa_ie_len);
+
+		kfree(confirm);
+		
+		break;
+
+	case DOT11_OID_REASSOCIATEEX:
+		handle_request(priv, mlme, oid);
+		send_formatted_event(priv, "Reassociate request (ex)", mlme, 1);
+
+		if (priv->iw_mode != IW_MODE_MASTER 
+				&& mlmeex->state != DOT11_STATE_ASSOCING)
+			break;
+
+		confirm = kmalloc(sizeof(struct obj_mlmeex), GFP_ATOMIC);
+
+		if (!confirm)
+			break;
+
+		memcpy(&confirm->address, mlmeex->address, ETH_ALEN);
+
+		confirm->id = mlmeex->id;
+		confirm->state = 0; /* not used */
+		confirm->code = 0;
+
+		wpa_ie_len = prism54_wpa_ie_get(priv, mlmeex->address, wpa_ie);
+
+		if (!wpa_ie_len) {
+			printk(KERN_DEBUG "No WPA IE found from "
+					"address:\t%02x:%02x:%02x:%02x:%02x:%02x\n", 
+				mlmeex->address[0],
+				mlmeex->address[1],
+				mlmeex->address[2],
+				mlmeex->address[3],
+				mlmeex->address[4],
+				mlmeex->address[5]
+				);
+			kfree(confirm);
+			break;
+		}
+
+		confirm->size = wpa_ie_len; 
+		memcpy(&confirm->data, wpa_ie, wpa_ie_len);
+
+		mgt_set_varlen(priv, oid, confirm, wpa_ie_len);
+
+		kfree(confirm);
+		
+		break;
+
+	default:
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+/*
+ * Process a device trap.  This is called via schedule_work(), outside of
+ * interrupt context, no locks held.
+ */
+void
+prism54_process_trap(void *data)
+{
+	struct islpci_mgmtframe *frame = data;
+	struct net_device *ndev = frame->ndev;
+	enum oid_num_t n = mgt_oidtonum(frame->header->oid);
+
+	if (n != OID_NUM_LAST)
+		prism54_process_trap_helper(netdev_priv(ndev), n, frame->data);
+	islpci_mgt_release(frame);
+}
+
+int
+prism54_set_mac_address(struct net_device *ndev, void *addr)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	int ret;
+
+	if (ndev->addr_len != 6)
+		return -EINVAL;
+	ret = mgt_set_request(priv, GEN_OID_MACADDRESS, 0,
+			      &((struct sockaddr *) addr)->sa_data);
+	if (!ret)
+		memcpy(priv->ndev->dev_addr,
+		       &((struct sockaddr *) addr)->sa_data, 6);
+
+	return ret;
+}
+
+/* Note: currently, use hostapd ioctl from the Host AP driver for WPA
+ * support. This is to be replaced with Linux wireless extensions once they
+ * get WPA support. */
+
+/* Note II: please leave all this together as it will be easier to remove later,
+ * once wireless extensions add WPA support -mcgrof */
+
+/* PRISM54_HOSTAPD ioctl() cmd: */
+enum {
+	PRISM2_SET_ENCRYPTION = 6,
+	PRISM2_HOSTAPD_SET_GENERIC_ELEMENT = 12,
+	PRISM2_HOSTAPD_MLME = 13,
+	PRISM2_HOSTAPD_SCAN_REQ = 14,
+};
+
+#define PRISM54_SET_WPA			SIOCIWFIRSTPRIV+12
+#define PRISM54_HOSTAPD			SIOCIWFIRSTPRIV+25
+#define PRISM54_DROP_UNENCRYPTED	SIOCIWFIRSTPRIV+26
+
+#define PRISM2_HOSTAPD_MAX_BUF_SIZE 1024
+#define PRISM2_HOSTAPD_GENERIC_ELEMENT_HDR_LEN \
+((int) (&((struct prism2_hostapd_param *) 0)->u.generic_elem.data))
+
+/* Maximum length for algorithm names (-1 for nul termination) 
+ * used in ioctl() */
+#define HOSTAP_CRYPT_ALG_NAME_LEN 16
+	
+struct prism2_hostapd_param {
+	u32 cmd;
+	u8 sta_addr[ETH_ALEN];
+	union {
+	       struct {
+		       u8 alg[HOSTAP_CRYPT_ALG_NAME_LEN];
+		       u32 flags;
+		       u32 err;
+		       u8 idx;
+		       u8 seq[8]; /* sequence counter (set: RX, get: TX) */
+		       u16 key_len;
+		       u8 key[0];
+		       } crypt;
+               struct {
+                       u8 len;
+                       u8 data[0];
+               } generic_elem;
+               struct {
+#define MLME_STA_DEAUTH 0
+#define MLME_STA_DISASSOC 1
+                       u16 cmd;
+                       u16 reason_code;
+               } mlme;
+               struct {
+                       u8 ssid_len;
+                       u8 ssid[32];
+               } scan_req;
+       } u;
+};
+
+
+static int
+prism2_ioctl_set_encryption(struct net_device *dev,
+	struct prism2_hostapd_param *param,
+	int param_len)
+{
+	islpci_private *priv = netdev_priv(dev);
+	int rvalue = 0, force = 0;
+	int authen = DOT11_AUTH_OS, invoke = 0, exunencrypt = 0;
+	union oid_res_t r;
+
+	/* with the new API, it's impossible to get a NULL pointer.
+	 * New version of iwconfig set the IW_ENCODE_NOKEY flag
+	 * when no key is given, but older versions don't. */
+
+	if (param->u.crypt.key_len > 0) {
+		/* we have a key to set */
+		int index = param->u.crypt.idx;
+		int current_index;
+		struct obj_key key = { DOT11_PRIV_TKIP, 0, "" };
+
+		/* get the current key index */
+		rvalue = mgt_get_request(priv, DOT11_OID_DEFKEYID, 0, NULL, &r);
+		current_index = r.u;
+		/* Verify that the key is not marked as invalid */
+		if (!(param->u.crypt.flags & IW_ENCODE_NOKEY)) {
+			key.length = param->u.crypt.key_len > sizeof (param->u.crypt.key) ?
+			    sizeof (param->u.crypt.key) : param->u.crypt.key_len;
+			memcpy(key.key, param->u.crypt.key, key.length);
+			if (key.length == 32)
+				/* we want WPA-PSK */
+				key.type = DOT11_PRIV_TKIP;
+			if ((index < 0) || (index > 3))
+				/* no index provided use the current one */
+				index = current_index;
+
+			/* now send the key to the card  */
+			rvalue |=
+			    mgt_set_request(priv, DOT11_OID_DEFKEYX, index,
+					    &key);
+		}
+		/*
+		 * If a valid key is set, encryption should be enabled 
+		 * (user may turn it off later).
+		 * This is also how "iwconfig ethX key on" works
+		 */
+		if ((index == current_index) && (key.length > 0))
+			force = 1;
+	} else {
+		int index = (param->u.crypt.flags & IW_ENCODE_INDEX) - 1;
+		if ((index >= 0) && (index <= 3)) {
+			/* we want to set the key index */
+			rvalue |=
+			    mgt_set_request(priv, DOT11_OID_DEFKEYID, 0,
+					    &index);
+		} else {
+			if (!param->u.crypt.flags & IW_ENCODE_MODE) {
+				/* we cannot do anything. Complain. */
+				return -EINVAL;
+			}
+		}
+	}
+	/* now read the flags */
+	if (param->u.crypt.flags & IW_ENCODE_DISABLED) {
+		/* Encoding disabled, 
+		 * authen = DOT11_AUTH_OS;
+		 * invoke = 0;
+		 * exunencrypt = 0; */
+	}
+	if (param->u.crypt.flags & IW_ENCODE_OPEN)
+		/* Encode but accept non-encoded packets. No auth */
+		invoke = 1;
+	if ((param->u.crypt.flags & IW_ENCODE_RESTRICTED) || force) {
+		/* Refuse non-encoded packets. Auth */
+		authen = DOT11_AUTH_BOTH;
+		invoke = 1;
+		exunencrypt = 1;
+	}
+	/* do the change if requested  */
+	if ((param->u.crypt.flags & IW_ENCODE_MODE) || force) {
+		rvalue |=
+		    mgt_set_request(priv, DOT11_OID_AUTHENABLE, 0, &authen);
+		rvalue |=
+		    mgt_set_request(priv, DOT11_OID_PRIVACYINVOKED, 0, &invoke);
+		rvalue |=
+		    mgt_set_request(priv, DOT11_OID_EXUNENCRYPTED, 0,
+				    &exunencrypt);
+	}
+	return rvalue;
+}
+
+static int
+prism2_ioctl_set_generic_element(struct net_device *ndev,
+	struct prism2_hostapd_param *param,
+	int param_len)
+{
+       islpci_private *priv = netdev_priv(ndev);
+       int max_len, len, alen, ret=0;
+       struct obj_attachment *attach;
+
+       len = param->u.generic_elem.len;
+       max_len = param_len - PRISM2_HOSTAPD_GENERIC_ELEMENT_HDR_LEN;
+       if (max_len < 0 || max_len < len)
+               return -EINVAL;
+
+       alen = sizeof(*attach) + len;
+       attach = kmalloc(alen, GFP_KERNEL);
+       if (attach == NULL)
+               return -ENOMEM;
+
+       memset(attach, 0, alen);
+#define WLAN_FC_TYPE_MGMT 0
+#define WLAN_FC_STYPE_ASSOC_REQ 0
+#define WLAN_FC_STYPE_REASSOC_REQ 2
+
+       /* Note: endianness is covered by mgt_set_varlen */
+
+       attach->type = (WLAN_FC_TYPE_MGMT << 2) |
+               (WLAN_FC_STYPE_ASSOC_REQ << 4);
+       attach->id = -1;
+       attach->size = len;
+       memcpy(attach->data, param->u.generic_elem.data, len);
+
+       ret = mgt_set_varlen(priv, DOT11_OID_ATTACHMENT, attach, len);
+
+       if (ret == 0) {
+               attach->type = (WLAN_FC_TYPE_MGMT << 2) |
+                       (WLAN_FC_STYPE_REASSOC_REQ << 4);
+
+	       ret = mgt_set_varlen(priv, DOT11_OID_ATTACHMENT, attach, len);
+
+	       if (ret == 0) 
+		       printk(KERN_DEBUG "%s: WPA IE Attachment was set\n",
+				       ndev->name);
+       }
+
+       kfree(attach);
+       return ret;
+
+}
+
+static int
+prism2_ioctl_mlme(struct net_device *dev, struct prism2_hostapd_param *param)
+{
+	return -EOPNOTSUPP;
+}
+
+static int
+prism2_ioctl_scan_req(struct net_device *ndev,
+                     struct prism2_hostapd_param *param)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	int i, rvalue;
+	struct obj_bsslist *bsslist;
+	u32 noise = 0;
+	char *extra = "";
+	char *current_ev = "foo";
+	union oid_res_t r;
+
+	if (islpci_get_state(priv) < PRV_STATE_INIT) {
+		/* device is not ready, fail gently */
+		return 0;
+	}
+
+	/* first get the noise value. We will use it to report the link quality */
+	rvalue = mgt_get_request(priv, DOT11_OID_NOISEFLOOR, 0, NULL, &r);
+	noise = r.u;
+
+	/* Ask the device for a list of known bss. We can report at most
+	 * IW_MAX_AP=64 to the range struct. But the device won't repport anything
+	 * if you change the value of IWMAX_BSS=24.
+	 */
+	rvalue |= mgt_get_request(priv, DOT11_OID_BSSLIST, 0, NULL, &r);
+	bsslist = r.ptr;
+
+	/* ok now, scan the list and translate its info */
+	for (i = 0; i < min(IW_MAX_AP, (int) bsslist->nr); i++)
+		current_ev = prism54_translate_bss(ndev, current_ev,
+						   extra + IW_SCAN_MAX_DATA,
+						   &(bsslist->bsslist[i]),
+						   noise);
+	kfree(bsslist);
+
+	return rvalue;
+}
+
+static int
+prism54_hostapd(struct net_device *ndev, struct iw_point *p)
+{
+       struct prism2_hostapd_param *param;
+       int ret = 0;
+       u32 uwrq;
+
+       printk(KERN_DEBUG "prism54_hostapd - len=%d\n", p->length);
+       if (p->length < sizeof(struct prism2_hostapd_param) ||
+           p->length > PRISM2_HOSTAPD_MAX_BUF_SIZE || !p->pointer)
+               return -EINVAL;
+
+       param = (struct prism2_hostapd_param *) kmalloc(p->length, GFP_KERNEL);
+       if (param == NULL)
+               return -ENOMEM;
+
+       if (copy_from_user(param, p->pointer, p->length)) {
+               kfree(param);
+               return -EFAULT;
+       }
+
+       switch (param->cmd) {
+       case PRISM2_SET_ENCRYPTION:
+	       printk(KERN_DEBUG "%s: Caught WPA supplicant set encryption request\n",
+			       ndev->name);
+               ret = prism2_ioctl_set_encryption(ndev, param, p->length);
+               break;
+       case PRISM2_HOSTAPD_SET_GENERIC_ELEMENT:
+	       printk(KERN_DEBUG "%s: Caught WPA supplicant set WPA IE request\n",
+			       ndev->name);
+               ret = prism2_ioctl_set_generic_element(ndev, param,
+                                                      p->length);
+               break;
+       case PRISM2_HOSTAPD_MLME:
+	       printk(KERN_DEBUG "%s: Caught WPA supplicant MLME request\n",
+			       ndev->name);
+               ret = prism2_ioctl_mlme(ndev, param);
+               break;
+       case PRISM2_HOSTAPD_SCAN_REQ:
+	       printk(KERN_DEBUG "%s: Caught WPA supplicant scan request\n",
+			       ndev->name);
+               ret = prism2_ioctl_scan_req(ndev, param);
+               break;
+	case PRISM54_SET_WPA:
+	       printk(KERN_DEBUG "%s: Caught WPA supplicant wpa init request\n",
+			       ndev->name);
+	       uwrq = 1;
+	       ret = prism54_set_wpa(ndev, NULL, &uwrq, NULL);
+	       break;
+	case PRISM54_DROP_UNENCRYPTED:
+	       printk(KERN_DEBUG "%s: Caught WPA drop unencrypted request\n",
+			       ndev->name);
+#if 0
+	       uwrq = 0x01;
+	       mgt_set(priv, DOT11_OID_EXUNENCRYPTED, &uwrq);
+	       down_write(&priv->mib_sem);
+	       mgt_commit(priv);
+	       up_write(&priv->mib_sem);
+#endif
+	       /* Not necessary, as set_wpa does it, should we just do it here though? */
+	       ret = 0;
+	       break;
+       default:
+	       printk(KERN_DEBUG "%s: Caught a WPA supplicant request that is not supported\n",
+			       ndev->name);
+               ret = -EOPNOTSUPP;
+               break;
+       }
+
+       if (ret == 0 && copy_to_user(p->pointer, param, p->length))
+               ret = -EFAULT;
+
+       kfree(param);
+
+       return ret;
+}
+
+static int
+prism54_set_wpa(struct net_device *ndev, struct iw_request_info *info,
+		__u32 * uwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	u32 mlme, authen, dot1x, filter, wep;
+
+	if (islpci_get_state(priv) < PRV_STATE_INIT)
+		return 0;
+
+	wep = 1; /* For privacy invoked */
+	filter = 1; /* Filter out all unencrypted frames */
+	dot1x = 0x01; /* To enable eap filter */
+	mlme = DOT11_MLME_EXTENDED;
+	authen = DOT11_AUTH_OS; /* Only WEP uses _SK and _BOTH */
+
+	down_write(&priv->mib_sem);
+	priv->wpa = *uwrq;
+
+	switch (priv->wpa) {
+		default:
+		case 0: /* Clears/disables WPA and friends */
+			wep = 0;
+			filter = 0; /* Do not filter un-encrypted data */
+			dot1x = 0;
+			mlme = DOT11_MLME_AUTO;
+			printk("%s: Disabling WPA\n", ndev->name);
+			break;
+		case 2: 
+		case 1: /* WPA */
+			printk("%s: Enabling WPA\n", ndev->name);
+			break;
+	}
+	up_write(&priv->mib_sem);
+
+	mgt_set_request(priv, DOT11_OID_AUTHENABLE, 0, &authen);
+	mgt_set_request(priv, DOT11_OID_PRIVACYINVOKED, 0, &wep);
+	mgt_set_request(priv, DOT11_OID_EXUNENCRYPTED, 0, &filter);
+	mgt_set_request(priv, DOT11_OID_DOT1XENABLE, 0, &dot1x);
+	mgt_set_request(priv, DOT11_OID_MLMEAUTOLEVEL, 0, &mlme);
+
+	return 0;
+}
+
+static int
+prism54_get_wpa(struct net_device *ndev, struct iw_request_info *info,
+		__u32 * uwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	*uwrq = priv->wpa;
+	return 0;
+}
+
+static int
+prism54_set_prismhdr(struct net_device *ndev, struct iw_request_info *info,
+		     __u32 * uwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	priv->monitor_type =
+	    (*uwrq ? ARPHRD_IEEE80211_PRISM : ARPHRD_IEEE80211);
+	if (priv->iw_mode == IW_MODE_MONITOR)
+		priv->ndev->type = priv->monitor_type;
+
+	return 0;
+}
+
+static int
+prism54_get_prismhdr(struct net_device *ndev, struct iw_request_info *info,
+		     __u32 * uwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	*uwrq = (priv->monitor_type == ARPHRD_IEEE80211_PRISM);
+	return 0;
+}
+
+static int
+prism54_debug_oid(struct net_device *ndev, struct iw_request_info *info,
+		  __u32 * uwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+
+	priv->priv_oid = *uwrq;
+	printk("%s: oid 0x%08X\n", ndev->name, *uwrq);
+
+	return 0;
+}
+
+static int
+prism54_debug_get_oid(struct net_device *ndev, struct iw_request_info *info,
+		      struct iw_point *data, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	struct islpci_mgmtframe *response;
+	int ret = -EIO;
+
+	printk("%s: get_oid 0x%08X\n", ndev->name, priv->priv_oid);
+	data->length = 0;
+
+	if (islpci_get_state(priv) >= PRV_STATE_INIT) {
+		ret =
+		    islpci_mgt_transaction(priv->ndev, PIMFOR_OP_GET,
+					   priv->priv_oid, extra, 256,
+					   &response);
+		printk("%s: ret: %i\n", ndev->name, ret);
+		if (ret || !response
+		    || response->header->operation == PIMFOR_OP_ERROR) {
+			if (response) {
+				islpci_mgt_release(response);
+			}
+			printk("%s: EIO\n", ndev->name);
+			ret = -EIO;
+		}
+		if (!ret) {
+			data->length = response->header->length;
+			memcpy(extra, response->data, data->length);
+			islpci_mgt_release(response);
+			printk("%s: len: %i\n", ndev->name, data->length);
+		}
+	}
+
+	return ret;
+}
+
+static int
+prism54_debug_set_oid(struct net_device *ndev, struct iw_request_info *info,
+		      struct iw_point *data, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	struct islpci_mgmtframe *response;
+	int ret = 0, response_op = PIMFOR_OP_ERROR;
+
+	printk("%s: set_oid 0x%08X\tlen: %d\n", ndev->name, priv->priv_oid,
+	       data->length);
+
+	if (islpci_get_state(priv) >= PRV_STATE_INIT) {
+		ret =
+		    islpci_mgt_transaction(priv->ndev, PIMFOR_OP_SET,
+					   priv->priv_oid, extra, data->length,
+					   &response);
+		printk("%s: ret: %i\n", ndev->name, ret);
+		if (ret || !response
+		    || response->header->operation == PIMFOR_OP_ERROR) {
+			if (response) {
+				islpci_mgt_release(response);
+			}
+			printk("%s: EIO\n", ndev->name);
+			ret = -EIO;
+		}
+		if (!ret) {
+			response_op = response->header->operation;
+			printk("%s: response_op: %i\n", ndev->name,
+			       response_op);
+			islpci_mgt_release(response);
+		}
+	}
+
+	return (ret ? ret : -EINPROGRESS);
+}
+
+static int
+prism54_set_spy(struct net_device *ndev,
+		struct iw_request_info *info,
+		union iwreq_data *uwrq, char *extra)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	u32 u, oid = OID_INL_CONFIG;
+
+	down_write(&priv->mib_sem);
+	mgt_get(priv, OID_INL_CONFIG, &u);
+
+	if ((uwrq->data.length == 0) && (priv->spy_data.spy_number > 0))
+		/* disable spy */
+		u &= ~INL_CONFIG_RXANNEX;
+	else if ((uwrq->data.length > 0) && (priv->spy_data.spy_number == 0))
+		/* enable spy */
+		u |= INL_CONFIG_RXANNEX;
+
+	mgt_set(priv, OID_INL_CONFIG, &u);
+	mgt_commit_list(priv, &oid, 1);
+	up_write(&priv->mib_sem);
+
+	return iw_handler_set_spy(ndev, info, uwrq, extra);
+}
+
+static const iw_handler prism54_handler[] = {
+	(iw_handler) prism54_commit,	/* SIOCSIWCOMMIT */
+	(iw_handler) prism54_get_name,	/* SIOCGIWNAME */
+	(iw_handler) NULL,	/* SIOCSIWNWID */
+	(iw_handler) NULL,	/* SIOCGIWNWID */
+	(iw_handler) prism54_set_freq,	/* SIOCSIWFREQ */
+	(iw_handler) prism54_get_freq,	/* SIOCGIWFREQ */
+	(iw_handler) prism54_set_mode,	/* SIOCSIWMODE */
+	(iw_handler) prism54_get_mode,	/* SIOCGIWMODE */
+	(iw_handler) prism54_set_sens,	/* SIOCSIWSENS */
+	(iw_handler) prism54_get_sens,	/* SIOCGIWSENS */
+	(iw_handler) NULL,	/* SIOCSIWRANGE */
+	(iw_handler) prism54_get_range,	/* SIOCGIWRANGE */
+	(iw_handler) NULL,	/* SIOCSIWPRIV */
+	(iw_handler) NULL,	/* SIOCGIWPRIV */
+	(iw_handler) NULL,	/* SIOCSIWSTATS */
+	(iw_handler) NULL,	/* SIOCGIWSTATS */
+	prism54_set_spy,	/* SIOCSIWSPY */
+	iw_handler_get_spy,	/* SIOCGIWSPY */
+	iw_handler_set_thrspy,	/* SIOCSIWTHRSPY */
+	iw_handler_get_thrspy,	/* SIOCGIWTHRSPY */
+	(iw_handler) prism54_set_wap,	/* SIOCSIWAP */
+	(iw_handler) prism54_get_wap,	/* SIOCGIWAP */
+	(iw_handler) NULL,	/* -- hole -- */
+	(iw_handler) NULL,	/* SIOCGIWAPLIST depreciated */
+	(iw_handler) prism54_set_scan,	/* SIOCSIWSCAN */
+	(iw_handler) prism54_get_scan,	/* SIOCGIWSCAN */
+	(iw_handler) prism54_set_essid,	/* SIOCSIWESSID */
+	(iw_handler) prism54_get_essid,	/* SIOCGIWESSID */
+	(iw_handler) prism54_set_nick,	/* SIOCSIWNICKN */
+	(iw_handler) prism54_get_nick,	/* SIOCGIWNICKN */
+	(iw_handler) NULL,	/* -- hole -- */
+	(iw_handler) NULL,	/* -- hole -- */
+	(iw_handler) prism54_set_rate,	/* SIOCSIWRATE */
+	(iw_handler) prism54_get_rate,	/* SIOCGIWRATE */
+	(iw_handler) prism54_set_rts,	/* SIOCSIWRTS */
+	(iw_handler) prism54_get_rts,	/* SIOCGIWRTS */
+	(iw_handler) prism54_set_frag,	/* SIOCSIWFRAG */
+	(iw_handler) prism54_get_frag,	/* SIOCGIWFRAG */
+	(iw_handler) prism54_set_txpower,	/* SIOCSIWTXPOW */
+	(iw_handler) prism54_get_txpower,	/* SIOCGIWTXPOW */
+	(iw_handler) prism54_set_retry,	/* SIOCSIWRETRY */
+	(iw_handler) prism54_get_retry,	/* SIOCGIWRETRY */
+	(iw_handler) prism54_set_encode,	/* SIOCSIWENCODE */
+	(iw_handler) prism54_get_encode,	/* SIOCGIWENCODE */
+	(iw_handler) NULL,	/* SIOCSIWPOWER */
+	(iw_handler) NULL,	/* SIOCGIWPOWER */
+};
+
+/* The low order bit identify a SET (0) or a GET (1) ioctl.  */
+
+#define PRISM54_RESET		SIOCIWFIRSTPRIV
+#define PRISM54_GET_POLICY	SIOCIWFIRSTPRIV+1
+#define PRISM54_SET_POLICY	SIOCIWFIRSTPRIV+2
+#define PRISM54_GET_MAC		SIOCIWFIRSTPRIV+3
+#define PRISM54_ADD_MAC		SIOCIWFIRSTPRIV+4
+
+#define PRISM54_DEL_MAC		SIOCIWFIRSTPRIV+6
+
+#define PRISM54_KICK_MAC	SIOCIWFIRSTPRIV+8
+
+#define PRISM54_KICK_ALL	SIOCIWFIRSTPRIV+10
+
+#define PRISM54_GET_WPA		SIOCIWFIRSTPRIV+11
+#define PRISM54_SET_WPA		SIOCIWFIRSTPRIV+12
+
+#define PRISM54_DBG_OID		SIOCIWFIRSTPRIV+14
+#define PRISM54_DBG_GET_OID	SIOCIWFIRSTPRIV+15
+#define PRISM54_DBG_SET_OID	SIOCIWFIRSTPRIV+16
+
+#define PRISM54_GET_OID		SIOCIWFIRSTPRIV+17
+#define PRISM54_SET_OID_U32	SIOCIWFIRSTPRIV+18
+#define	PRISM54_SET_OID_STR	SIOCIWFIRSTPRIV+20
+#define	PRISM54_SET_OID_ADDR	SIOCIWFIRSTPRIV+22
+
+#define PRISM54_GET_PRISMHDR	SIOCIWFIRSTPRIV+23
+#define PRISM54_SET_PRISMHDR	SIOCIWFIRSTPRIV+24
+
+#define IWPRIV_SET_U32(n,x)	{ n, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "s_"x }
+#define IWPRIV_SET_SSID(n,x)	{ n, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | 1, 0, "s_"x }
+#define IWPRIV_SET_ADDR(n,x)	{ n, IW_PRIV_TYPE_ADDR | IW_PRIV_SIZE_FIXED | 1, 0, "s_"x }
+#define IWPRIV_GET(n,x)	{ n, 0, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | PRIV_STR_SIZE, "g_"x }
+
+#define IWPRIV_U32(n,x)		IWPRIV_SET_U32(n,x), IWPRIV_GET(n,x)
+#define IWPRIV_SSID(n,x)	IWPRIV_SET_SSID(n,x), IWPRIV_GET(n,x)
+#define IWPRIV_ADDR(n,x)	IWPRIV_SET_ADDR(n,x), IWPRIV_GET(n,x)
+
+/* Note : limited to 128 private ioctls (wireless tools 26) */
+
+static const struct iw_priv_args prism54_private_args[] = {
+/*{ cmd, set_args, get_args, name } */
+	{PRISM54_RESET, 0, 0, "reset"},
+	{PRISM54_GET_PRISMHDR, 0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
+	 "get_prismhdr"},
+	{PRISM54_SET_PRISMHDR, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0,
+	 "set_prismhdr"},
+	{PRISM54_GET_POLICY, 0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
+	 "getPolicy"},
+	{PRISM54_SET_POLICY, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0,
+	 "setPolicy"},
+	{PRISM54_GET_MAC, 0, IW_PRIV_TYPE_ADDR | 64, "getMac"},
+	{PRISM54_ADD_MAC, IW_PRIV_TYPE_ADDR | IW_PRIV_SIZE_FIXED | 1, 0,
+	 "addMac"},
+	{PRISM54_DEL_MAC, IW_PRIV_TYPE_ADDR | IW_PRIV_SIZE_FIXED | 1, 0,
+	 "delMac"},
+	{PRISM54_KICK_MAC, IW_PRIV_TYPE_ADDR | IW_PRIV_SIZE_FIXED | 1, 0,
+	 "kickMac"},
+	{PRISM54_KICK_ALL, 0, 0, "kickAll"},
+	{PRISM54_GET_WPA, 0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
+	 "get_wpa"},
+	{PRISM54_SET_WPA, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0,
+	 "set_wpa"},
+	{PRISM54_DBG_OID, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0,
+	 "dbg_oid"},
+	{PRISM54_DBG_GET_OID, 0, IW_PRIV_TYPE_BYTE | 256, "dbg_get_oid"},
+	{PRISM54_DBG_SET_OID, IW_PRIV_TYPE_BYTE | 256, 0, "dbg_set_oid"},
+	/* --- sub-ioctls handlers --- */
+	{PRISM54_GET_OID,
+	 0, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | PRIV_STR_SIZE, ""},
+	{PRISM54_SET_OID_U32,
+	 IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, ""},
+	{PRISM54_SET_OID_STR,
+	 IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | 1, 0, ""},
+	{PRISM54_SET_OID_ADDR,
+	 IW_PRIV_TYPE_ADDR | IW_PRIV_SIZE_FIXED | 1, 0, ""},
+	/* --- sub-ioctls definitions --- */
+	IWPRIV_ADDR(GEN_OID_MACADDRESS, "addr"),
+	IWPRIV_GET(GEN_OID_LINKSTATE, "linkstate"),
+	IWPRIV_U32(DOT11_OID_BSSTYPE, "bsstype"),
+	IWPRIV_ADDR(DOT11_OID_BSSID, "bssid"),
+	IWPRIV_U32(DOT11_OID_STATE, "state"),
+	IWPRIV_U32(DOT11_OID_AID, "aid"),
+
+	IWPRIV_SSID(DOT11_OID_SSIDOVERRIDE, "ssidoverride"),
+
+	IWPRIV_U32(DOT11_OID_MEDIUMLIMIT, "medlimit"),
+	IWPRIV_U32(DOT11_OID_BEACONPERIOD, "beacon"),
+	IWPRIV_U32(DOT11_OID_DTIMPERIOD, "dtimperiod"),
+
+	IWPRIV_U32(DOT11_OID_AUTHENABLE, "authenable"),
+	IWPRIV_U32(DOT11_OID_PRIVACYINVOKED, "privinvok"),
+	IWPRIV_U32(DOT11_OID_EXUNENCRYPTED, "exunencrypt"),
+
+	IWPRIV_U32(DOT11_OID_REKEYTHRESHOLD, "rekeythresh"),
+
+	IWPRIV_U32(DOT11_OID_MAXTXLIFETIME, "maxtxlife"),
+	IWPRIV_U32(DOT11_OID_MAXRXLIFETIME, "maxrxlife"),
+	IWPRIV_U32(DOT11_OID_ALOFT_FIXEDRATE, "fixedrate"),
+	IWPRIV_U32(DOT11_OID_MAXFRAMEBURST, "frameburst"),
+	IWPRIV_U32(DOT11_OID_PSM, "psm"),
+
+	IWPRIV_U32(DOT11_OID_BRIDGELOCAL, "bridge"),
+	IWPRIV_U32(DOT11_OID_CLIENTS, "clients"),
+	IWPRIV_U32(DOT11_OID_CLIENTSASSOCIATED, "clientassoc"),
+	IWPRIV_U32(DOT11_OID_DOT1XENABLE, "dot1xenable"),
+	IWPRIV_U32(DOT11_OID_ANTENNARX, "rxant"),
+	IWPRIV_U32(DOT11_OID_ANTENNATX, "txant"),
+	IWPRIV_U32(DOT11_OID_ANTENNADIVERSITY, "antdivers"),
+	IWPRIV_U32(DOT11_OID_EDTHRESHOLD, "edthresh"),
+	IWPRIV_U32(DOT11_OID_PREAMBLESETTINGS, "preamble"),
+	IWPRIV_GET(DOT11_OID_RATES, "rates"),
+	IWPRIV_U32(DOT11_OID_OUTPUTPOWER, ".11outpower"),
+	IWPRIV_GET(DOT11_OID_SUPPORTEDRATES, "supprates"),
+	IWPRIV_GET(DOT11_OID_SUPPORTEDFREQUENCIES, "suppfreq"),
+
+	IWPRIV_U32(DOT11_OID_NOISEFLOOR, "noisefloor"),
+	IWPRIV_GET(DOT11_OID_FREQUENCYACTIVITY, "freqactivity"),
+	IWPRIV_U32(DOT11_OID_NONERPPROTECTION, "nonerpprotec"),
+	IWPRIV_U32(DOT11_OID_PROFILES, "profile"),
+	IWPRIV_GET(DOT11_OID_EXTENDEDRATES, "extrates"),
+	IWPRIV_U32(DOT11_OID_MLMEAUTOLEVEL, "mlmelevel"),
+
+	IWPRIV_GET(DOT11_OID_BSSS, "bsss"),
+	IWPRIV_GET(DOT11_OID_BSSLIST, "bsslist"),
+	IWPRIV_U32(OID_INL_MODE, "mode"),
+	IWPRIV_U32(OID_INL_CONFIG, "config"),
+	IWPRIV_U32(OID_INL_DOT11D_CONFORMANCE, ".11dconform"),
+	IWPRIV_GET(OID_INL_PHYCAPABILITIES, "phycapa"),
+	IWPRIV_U32(OID_INL_OUTPUTPOWER, "outpower"),
+};
+
+static const iw_handler prism54_private_handler[] = {
+	(iw_handler) prism54_reset,
+	(iw_handler) prism54_get_policy,
+	(iw_handler) prism54_set_policy,
+	(iw_handler) prism54_get_mac,
+	(iw_handler) prism54_add_mac,
+	(iw_handler) NULL,
+	(iw_handler) prism54_del_mac,
+	(iw_handler) NULL,
+	(iw_handler) prism54_kick_mac,
+	(iw_handler) NULL,
+	(iw_handler) prism54_kick_all,
+	(iw_handler) prism54_get_wpa,
+	(iw_handler) prism54_set_wpa,
+	(iw_handler) NULL,
+	(iw_handler) prism54_debug_oid,
+	(iw_handler) prism54_debug_get_oid,
+	(iw_handler) prism54_debug_set_oid,
+	(iw_handler) prism54_get_oid,
+	(iw_handler) prism54_set_u32,
+	(iw_handler) NULL,
+	(iw_handler) prism54_set_raw,
+	(iw_handler) NULL,
+	(iw_handler) prism54_set_raw,
+	(iw_handler) prism54_get_prismhdr,
+	(iw_handler) prism54_set_prismhdr,
+};
+
+const struct iw_handler_def prism54_handler_def = {
+	.num_standard = sizeof (prism54_handler) / sizeof (iw_handler),
+	.num_private = sizeof (prism54_private_handler) / sizeof (iw_handler),
+	.num_private_args =
+	    sizeof (prism54_private_args) / sizeof (struct iw_priv_args),
+	.standard = (iw_handler *) prism54_handler,
+	.private = (iw_handler *) prism54_private_handler,
+	.private_args = (struct iw_priv_args *) prism54_private_args,
+#if WIRELESS_EXT == 16
+	.spy_offset = offsetof(islpci_private, spy_data),
+#endif /* WIRELESS_EXT == 16 */
+};
+
+/* For wpa_supplicant */
+
+int
+prism54_ioctl(struct net_device *ndev, struct ifreq *rq, int cmd)
+{
+	struct iwreq *wrq = (struct iwreq *) rq;
+	int ret = -1;
+	switch (cmd) {
+		case PRISM54_HOSTAPD:
+		if (!capable(CAP_NET_ADMIN))
+		return -EPERM;
+		ret = prism54_hostapd(ndev, &wrq->u.data);
+		return ret;
+	}
+	return -EOPNOTSUPP;
+}
diff --git a/drivers/net/wireless/prism54/isl_ioctl.h b/drivers/net/wireless/prism54/isl_ioctl.h
new file mode 100644
index 0000000..46d5cde
--- /dev/null
+++ b/drivers/net/wireless/prism54/isl_ioctl.h
@@ -0,0 +1,51 @@
+/*
+ *  
+ *  Copyright (C) 2002 Intersil Americas Inc.
+ *            (C) 2003 Aurelien Alleaume <slts@free.fr>
+ *            (C) 2003 Luis R. Rodriguez <mcgrof@ruslug.rutgers.edu>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+
+#ifndef _ISL_IOCTL_H
+#define _ISL_IOCTL_H
+
+#include "islpci_mgt.h"
+#include "islpci_dev.h"
+
+#include <net/iw_handler.h>	/* New driver API */
+
+#define SUPPORTED_WIRELESS_EXT                  16
+
+void prism54_mib_init(islpci_private *);
+
+struct iw_statistics *prism54_get_wireless_stats(struct net_device *);
+void prism54_update_stats(islpci_private *);
+
+void prism54_acl_init(struct islpci_acl *);
+void prism54_acl_clean(struct islpci_acl *);
+
+void prism54_process_trap(void *);
+
+void prism54_wpa_ie_init(islpci_private *priv);
+void prism54_wpa_ie_clean(islpci_private *priv);
+
+int prism54_set_mac_address(struct net_device *, void *);
+
+int prism54_ioctl(struct net_device *, struct ifreq *, int);
+
+extern const struct iw_handler_def prism54_handler_def;
+
+#endif				/* _ISL_IOCTL_H */
diff --git a/drivers/net/wireless/prism54/isl_oid.h b/drivers/net/wireless/prism54/isl_oid.h
new file mode 100644
index 0000000..419edf7
--- /dev/null
+++ b/drivers/net/wireless/prism54/isl_oid.h
@@ -0,0 +1,507 @@
+/*
+ *
+ *  
+ *  Copyright (C) 2003 Herbert Valerio Riedel <hvr@gnu.org>
+ *  Copyright (C) 2004 Luis R. Rodriguez <mcgrof@ruslug.rutgers.edu>
+ *  Copyright (C) 2004 Aurelien Alleaume <slts@free.fr>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+
+#if !defined(_ISL_OID_H)
+#define _ISL_OID_H
+
+/* 
+ * MIB related constant and structure definitions for communicating
+ * with the device firmware
+ */
+
+struct obj_ssid {
+	u8 length;
+	char octets[33];
+} __attribute__ ((packed));
+
+struct obj_key {
+	u8 type;		/* dot11_priv_t */
+	u8 length;
+	char key[32];
+} __attribute__ ((packed));
+
+struct obj_mlme {
+	u8 address[6];
+	u16 id;
+	u16 state;
+	u16 code;
+} __attribute__ ((packed));
+
+struct obj_mlmeex {
+	u8 address[6];
+	u16 id;
+	u16 state;
+	u16 code;
+	u16 size;
+	u8 data[0];
+} __attribute__ ((packed));
+
+struct obj_buffer {
+	u32 size;
+	u32 addr;		/* 32bit bus address */
+} __attribute__ ((packed));
+
+struct obj_bss {
+	u8 address[6];
+	int:16;			/* padding */
+
+	char state;
+	char reserved;
+	short age;
+
+	char quality;
+	char rssi;
+
+	struct obj_ssid ssid;
+	short channel;
+	char beacon_period;
+	char dtim_period;
+	short capinfo;
+	short rates;
+	short basic_rates;
+	int:16;			/* padding */
+} __attribute__ ((packed));
+
+struct obj_bsslist {
+	u32 nr;
+	struct obj_bss bsslist[0];
+} __attribute__ ((packed));
+
+struct obj_frequencies {
+	u16 nr;
+	u16 mhz[0];
+} __attribute__ ((packed));
+
+struct obj_attachment {
+	char type;
+	char reserved;
+	short id;
+	short size;
+	char data[0];
+} __attribute__((packed));
+
+/* 
+ * in case everything's ok, the inlined function below will be
+ * optimized away by the compiler...
+ */
+static inline void
+__bug_on_wrong_struct_sizes(void)
+{
+	BUG_ON(sizeof (struct obj_ssid) != 34);
+	BUG_ON(sizeof (struct obj_key) != 34);
+	BUG_ON(sizeof (struct obj_mlme) != 12);
+	BUG_ON(sizeof (struct obj_mlmeex) != 14);
+	BUG_ON(sizeof (struct obj_buffer) != 8);
+	BUG_ON(sizeof (struct obj_bss) != 60);
+	BUG_ON(sizeof (struct obj_bsslist) != 4);
+	BUG_ON(sizeof (struct obj_frequencies) != 2);
+}
+
+enum dot11_state_t {
+	DOT11_STATE_NONE = 0,
+	DOT11_STATE_AUTHING = 1,
+	DOT11_STATE_AUTH = 2,
+	DOT11_STATE_ASSOCING = 3,
+
+	DOT11_STATE_ASSOC = 5,
+	DOT11_STATE_IBSS = 6,
+	DOT11_STATE_WDS = 7
+};
+
+enum dot11_bsstype_t {
+	DOT11_BSSTYPE_NONE = 0,
+	DOT11_BSSTYPE_INFRA = 1,
+	DOT11_BSSTYPE_IBSS = 2,
+	DOT11_BSSTYPE_ANY = 3
+};
+
+enum dot11_auth_t {
+	DOT11_AUTH_NONE = 0,
+	DOT11_AUTH_OS = 1,
+	DOT11_AUTH_SK = 2,
+	DOT11_AUTH_BOTH = 3
+};
+
+enum dot11_mlme_t {
+	DOT11_MLME_AUTO = 0,
+	DOT11_MLME_INTERMEDIATE = 1,
+	DOT11_MLME_EXTENDED = 2
+};
+
+enum dot11_priv_t {
+	DOT11_PRIV_WEP = 0,
+	DOT11_PRIV_TKIP = 1
+};
+
+/* Prism "Nitro" / Frameburst / "Packet Frame Grouping"
+ * Value is in microseconds. Represents the # microseconds
+ * the firmware will take to group frames before sending out then out 
+ * together with a CSMA contention. Without this all frames are
+ * sent with a CSMA contention. 
+ * Bibliography: 
+ * http://www.hpl.hp.com/personal/Jean_Tourrilhes/Papers/Packet.Frame.Grouping.html
+ */
+enum dot11_maxframeburst_t { 
+	/* Values for DOT11_OID_MAXFRAMEBURST */
+	DOT11_MAXFRAMEBURST_OFF = 0, /* Card firmware default */
+	DOT11_MAXFRAMEBURST_MIXED_SAFE = 650, /* 802.11 a,b,g safe */
+	DOT11_MAXFRAMEBURST_IDEAL = 1300, /* Theoretical ideal level */
+	DOT11_MAXFRAMEBURST_MAX = 5000, /* Use this as max,
+		* Note: firmware allows for greater values. This is a
+		* recommended max. I'll update this as I find
+		* out what the real MAX is. Also note that you don't necessarily
+		* get better results with a greater value here.
+		*/
+};
+
+/* Support for 802.11 long and short frame preambles.
+ * Long	 preamble uses 128-bit sync field, 8-bit  CRC
+ * Short preamble uses 56-bit  sync field, 16-bit CRC
+ * 
+ * 802.11a -- not sure, both optionally ?
+ * 802.11b supports long and optionally short 
+ * 802.11g supports both */
+enum dot11_preamblesettings_t {
+	DOT11_PREAMBLESETTING_LONG = 0,
+		/* Allows *only* long 802.11 preambles */
+	DOT11_PREAMBLESETTING_SHORT = 1,
+		/* Allows *only* short 802.11 preambles */
+	DOT11_PREAMBLESETTING_DYNAMIC = 2
+		/* AutomatiGically set */
+};
+
+/* Support for 802.11 slot timing (time between packets).
+ *
+ * Long uses 802.11a slot timing  (9 usec ?)
+ * Short uses 802.11b slot timing (20 use ?) */
+enum dot11_slotsettings_t {
+	DOT11_SLOTSETTINGS_LONG = 0, 
+		/* Allows *only* long 802.11b slot timing */
+	DOT11_SLOTSETTINGS_SHORT = 1,
+		/* Allows *only* long 802.11a slot timing */
+	DOT11_SLOTSETTINGS_DYNAMIC = 2
+		/* AutomatiGically set */
+};
+
+/* All you need to know, ERP is "Extended Rate PHY".
+ * An Extended Rate PHY (ERP) STA or AP shall support three different 
+ * preamble and header formats:
+ * Long  preamble (refer to above)
+ * Short preamble (refer to above)
+ * OFDM  preamble ( ? )
+ *
+ * I'm assuming here Protection tells the AP
+ * to be careful, a STA which cannot handle the long pre-amble
+ * has joined.
+ */
+enum do11_nonerpstatus_t {
+	DOT11_ERPSTAT_NONEPRESENT = 0,
+	DOT11_ERPSTAT_USEPROTECTION = 1
+};
+
+/* (ERP is "Extended Rate PHY") Way to read NONERP is NON-ERP-*
+ * The key here is DOT11 NON ERP NEVER protects against
+ * NON ERP STA's. You *don't* want this unless
+ * you know what you are doing. It means you will only 
+ * get Extended Rate capabilities */
+enum dot11_nonerpprotection_t {
+	DOT11_NONERP_NEVER = 0,
+	DOT11_NONERP_ALWAYS = 1,
+	DOT11_NONERP_DYNAMIC = 2
+};
+
+/* Preset OID configuration for 802.11 modes 
+ * Note: DOT11_OID_CW[MIN|MAX] hold the values of the 
+ * DCS MIN|MAX backoff used */
+enum dot11_profile_t { /* And set/allowed values */
+	/* Allowed values for DOT11_OID_PROFILES */
+	DOT11_PROFILE_B_ONLY = 0,
+		/* DOT11_OID_RATES: 1, 2, 5.5, 11Mbps 
+		 * DOT11_OID_PREAMBLESETTINGS: DOT11_PREAMBLESETTING_DYNAMIC
+		 * DOT11_OID_CWMIN: 31
+		 * DOT11_OID_NONEPROTECTION: DOT11_NOERP_DYNAMIC
+		 * DOT11_OID_SLOTSETTINGS: DOT11_SLOTSETTINGS_LONG
+		 */
+	DOT11_PROFILE_MIXED_G_WIFI = 1,
+		/* DOT11_OID_RATES: 1, 2, 5.5, 11, 6, 9, 12, 18, 24, 36, 48, 54Mbs
+		 * DOT11_OID_PREAMBLESETTINGS: DOT11_PREAMBLESETTING_DYNAMIC
+		 * DOT11_OID_CWMIN: 15
+		 * DOT11_OID_NONEPROTECTION: DOT11_NOERP_DYNAMIC
+		 * DOT11_OID_SLOTSETTINGS: DOT11_SLOTSETTINGS_DYNAMIC
+		 */
+	DOT11_PROFILE_MIXED_LONG = 2, /* "Long range" */
+		/* Same as Profile MIXED_G_WIFI */
+	DOT11_PROFILE_G_ONLY = 3,
+		/* Same as Profile MIXED_G_WIFI */
+	DOT11_PROFILE_TEST = 4,
+		/* Same as Profile MIXED_G_WIFI except:
+		 * DOT11_OID_PREAMBLESETTINGS: DOT11_PREAMBLESETTING_SHORT
+		 * DOT11_OID_NONEPROTECTION: DOT11_NOERP_NEVER
+		 * DOT11_OID_SLOTSETTINGS: DOT11_SLOTSETTINGS_SHORT
+		 */
+	DOT11_PROFILE_B_WIFI = 5,
+		/* Same as Profile B_ONLY */
+	DOT11_PROFILE_A_ONLY = 6,
+		/* Same as Profile MIXED_G_WIFI except:
+		 * DOT11_OID_RATES: 6, 9, 12, 18, 24, 36, 48, 54Mbs
+		 */
+	DOT11_PROFILE_MIXED_SHORT = 7
+		/* Same as MIXED_G_WIFI */
+};
+
+
+/* The dot11d conformance level configures the 802.11d conformance levels.
+ * The following conformance levels exist:*/
+enum oid_inl_conformance_t {
+	OID_INL_CONFORMANCE_NONE = 0,	/* Perform active scanning */
+	OID_INL_CONFORMANCE_STRICT = 1,	/* Strictly adhere to 802.11d */
+	OID_INL_CONFORMANCE_FLEXIBLE = 2,	/* Use passed 802.11d info to
+		* determine channel AND/OR just make assumption that active 
+		* channels are valid  channels */
+};
+
+enum oid_inl_mode_t {
+	INL_MODE_NONE = -1,
+	INL_MODE_PROMISCUOUS = 0,
+	INL_MODE_CLIENT = 1,
+	INL_MODE_AP = 2,
+	INL_MODE_SNIFFER = 3
+};
+
+enum oid_inl_config_t {
+	INL_CONFIG_NOTHING = 0x00,
+	INL_CONFIG_MANUALRUN = 0x01,
+	INL_CONFIG_FRAMETRAP = 0x02,
+	INL_CONFIG_RXANNEX = 0x04,
+	INL_CONFIG_TXANNEX = 0x08,
+	INL_CONFIG_WDS = 0x10
+};
+
+enum oid_inl_phycap_t {
+	INL_PHYCAP_2400MHZ = 1,
+	INL_PHYCAP_5000MHZ = 2,
+	INL_PHYCAP_FAA = 0x80000000,	/* Means card supports the FAA switch */
+};
+
+
+enum oid_num_t {
+	GEN_OID_MACADDRESS = 0,
+	GEN_OID_LINKSTATE,
+	GEN_OID_WATCHDOG,
+	GEN_OID_MIBOP,
+	GEN_OID_OPTIONS,
+	GEN_OID_LEDCONFIG,
+
+	/* 802.11 */
+	DOT11_OID_BSSTYPE,
+	DOT11_OID_BSSID,
+	DOT11_OID_SSID,
+	DOT11_OID_STATE,
+	DOT11_OID_AID,
+	DOT11_OID_COUNTRYSTRING,
+	DOT11_OID_SSIDOVERRIDE,
+
+	DOT11_OID_MEDIUMLIMIT,
+	DOT11_OID_BEACONPERIOD,
+	DOT11_OID_DTIMPERIOD,
+	DOT11_OID_ATIMWINDOW,
+	DOT11_OID_LISTENINTERVAL,
+	DOT11_OID_CFPPERIOD,
+	DOT11_OID_CFPDURATION,
+
+	DOT11_OID_AUTHENABLE,
+	DOT11_OID_PRIVACYINVOKED,
+	DOT11_OID_EXUNENCRYPTED,
+	DOT11_OID_DEFKEYID,
+	DOT11_OID_DEFKEYX,	/* DOT11_OID_DEFKEY1,...DOT11_OID_DEFKEY4 */
+	DOT11_OID_STAKEY,
+	DOT11_OID_REKEYTHRESHOLD,
+	DOT11_OID_STASC,
+
+	DOT11_OID_PRIVTXREJECTED,
+	DOT11_OID_PRIVRXPLAIN,
+	DOT11_OID_PRIVRXFAILED,
+	DOT11_OID_PRIVRXNOKEY,
+
+	DOT11_OID_RTSTHRESH,
+	DOT11_OID_FRAGTHRESH,
+	DOT11_OID_SHORTRETRIES,
+	DOT11_OID_LONGRETRIES,
+	DOT11_OID_MAXTXLIFETIME,
+	DOT11_OID_MAXRXLIFETIME,
+	DOT11_OID_AUTHRESPTIMEOUT,
+	DOT11_OID_ASSOCRESPTIMEOUT,
+
+	DOT11_OID_ALOFT_TABLE,
+	DOT11_OID_ALOFT_CTRL_TABLE,
+	DOT11_OID_ALOFT_RETREAT,
+	DOT11_OID_ALOFT_PROGRESS,
+	DOT11_OID_ALOFT_FIXEDRATE,
+	DOT11_OID_ALOFT_RSSIGRAPH,
+	DOT11_OID_ALOFT_CONFIG,
+
+	DOT11_OID_VDCFX,
+	DOT11_OID_MAXFRAMEBURST,
+
+	DOT11_OID_PSM,
+	DOT11_OID_CAMTIMEOUT,
+	DOT11_OID_RECEIVEDTIMS,
+	DOT11_OID_ROAMPREFERENCE,
+
+	DOT11_OID_BRIDGELOCAL,
+	DOT11_OID_CLIENTS,
+	DOT11_OID_CLIENTSASSOCIATED,
+	DOT11_OID_CLIENTX,	/* DOT11_OID_CLIENTX,...DOT11_OID_CLIENT2007 */
+
+	DOT11_OID_CLIENTFIND,
+	DOT11_OID_WDSLINKADD,
+	DOT11_OID_WDSLINKREMOVE,
+	DOT11_OID_EAPAUTHSTA,
+	DOT11_OID_EAPUNAUTHSTA,
+	DOT11_OID_DOT1XENABLE,
+	DOT11_OID_MICFAILURE,
+	DOT11_OID_REKEYINDICATE,
+
+	DOT11_OID_MPDUTXSUCCESSFUL,
+	DOT11_OID_MPDUTXONERETRY,
+	DOT11_OID_MPDUTXMULTIPLERETRIES,
+	DOT11_OID_MPDUTXFAILED,
+	DOT11_OID_MPDURXSUCCESSFUL,
+	DOT11_OID_MPDURXDUPS,
+	DOT11_OID_RTSSUCCESSFUL,
+	DOT11_OID_RTSFAILED,
+	DOT11_OID_ACKFAILED,
+	DOT11_OID_FRAMERECEIVES,
+	DOT11_OID_FRAMEERRORS,
+	DOT11_OID_FRAMEABORTS,
+	DOT11_OID_FRAMEABORTSPHY,
+
+	DOT11_OID_SLOTTIME,
+	DOT11_OID_CWMIN, /* MIN DCS backoff */
+	DOT11_OID_CWMAX, /* MAX DCS backoff */
+	DOT11_OID_ACKWINDOW,
+	DOT11_OID_ANTENNARX,
+	DOT11_OID_ANTENNATX,
+	DOT11_OID_ANTENNADIVERSITY,
+	DOT11_OID_CHANNEL,
+	DOT11_OID_EDTHRESHOLD,
+	DOT11_OID_PREAMBLESETTINGS,
+	DOT11_OID_RATES,
+	DOT11_OID_CCAMODESUPPORTED,
+	DOT11_OID_CCAMODE,
+	DOT11_OID_RSSIVECTOR,
+	DOT11_OID_OUTPUTPOWERTABLE,
+	DOT11_OID_OUTPUTPOWER,
+	DOT11_OID_SUPPORTEDRATES,
+	DOT11_OID_FREQUENCY,
+	DOT11_OID_SUPPORTEDFREQUENCIES,
+	DOT11_OID_NOISEFLOOR,
+	DOT11_OID_FREQUENCYACTIVITY,
+	DOT11_OID_IQCALIBRATIONTABLE,
+	DOT11_OID_NONERPPROTECTION,
+	DOT11_OID_SLOTSETTINGS,
+	DOT11_OID_NONERPTIMEOUT,
+	DOT11_OID_PROFILES,
+	DOT11_OID_EXTENDEDRATES,
+
+	DOT11_OID_DEAUTHENTICATE,
+	DOT11_OID_AUTHENTICATE,
+	DOT11_OID_DISASSOCIATE,
+	DOT11_OID_ASSOCIATE,
+	DOT11_OID_SCAN,
+	DOT11_OID_BEACON,
+	DOT11_OID_PROBE,
+	DOT11_OID_DEAUTHENTICATEEX,
+	DOT11_OID_AUTHENTICATEEX,
+	DOT11_OID_DISASSOCIATEEX,
+	DOT11_OID_ASSOCIATEEX,
+	DOT11_OID_REASSOCIATE,
+	DOT11_OID_REASSOCIATEEX,
+
+	DOT11_OID_NONERPSTATUS,
+
+	DOT11_OID_STATIMEOUT,
+	DOT11_OID_MLMEAUTOLEVEL,
+	DOT11_OID_BSSTIMEOUT,
+	DOT11_OID_ATTACHMENT,
+	DOT11_OID_PSMBUFFER,
+
+	DOT11_OID_BSSS,
+	DOT11_OID_BSSX,		/*DOT11_OID_BSS1,...,DOT11_OID_BSS64 */
+	DOT11_OID_BSSFIND,
+	DOT11_OID_BSSLIST,
+
+	OID_INL_TUNNEL,
+	OID_INL_MEMADDR,
+	OID_INL_MEMORY,
+	OID_INL_MODE,
+	OID_INL_COMPONENT_NR,
+	OID_INL_VERSION,
+	OID_INL_INTERFACE_ID,
+	OID_INL_COMPONENT_ID,
+	OID_INL_CONFIG,
+	OID_INL_DOT11D_CONFORMANCE,
+	OID_INL_PHYCAPABILITIES,
+	OID_INL_OUTPUTPOWER,
+
+	OID_NUM_LAST
+};
+
+#define OID_FLAG_CACHED		0x80
+#define OID_FLAG_TYPE		0x7f
+
+#define OID_TYPE_U32		0x01
+#define OID_TYPE_SSID		0x02
+#define OID_TYPE_KEY		0x03
+#define OID_TYPE_BUFFER		0x04
+#define OID_TYPE_BSS		0x05
+#define OID_TYPE_BSSLIST	0x06
+#define OID_TYPE_FREQUENCIES	0x07
+#define OID_TYPE_MLME		0x08
+#define OID_TYPE_MLMEEX		0x09
+#define OID_TYPE_ADDR		0x0A
+#define OID_TYPE_RAW		0x0B
+#define OID_TYPE_ATTACH		0x0C
+
+/* OID_TYPE_MLMEEX is special because of a variable size field when sending.
+ * Not yet implemented (not used in driver anyway).
+ */
+
+struct oid_t {
+	enum oid_num_t oid;
+	short range;		/* to define a range of oid */
+	short size;		/* max size of the associated data */
+	char flags;
+};
+
+union oid_res_t {
+	void *ptr;
+	u32 u;
+};
+
+#define	IWMAX_BITRATES	20
+#define	IWMAX_BSS	24
+#define IWMAX_FREQ	30
+#define PRIV_STR_SIZE	1024
+
+#endif				/* !defined(_ISL_OID_H) */
+/* EOF */
diff --git a/drivers/net/wireless/prism54/islpci_dev.c b/drivers/net/wireless/prism54/islpci_dev.c
new file mode 100644
index 0000000..efab07e
--- /dev/null
+++ b/drivers/net/wireless/prism54/islpci_dev.c
@@ -0,0 +1,956 @@
+/*
+ *  
+ *  Copyright (C) 2002 Intersil Americas Inc.
+ *  Copyright (C) 2003 Herbert Valerio Riedel <hvr@gnu.org>
+ *  Copyright (C) 2003 Luis R. Rodriguez <mcgrof@ruslug.rutgers.edu>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+
+#include <linux/version.h>
+#include <linux/module.h>
+
+#include <linux/netdevice.h>
+#include <linux/pci.h>
+#include <linux/etherdevice.h>
+#include <linux/delay.h>
+#include <linux/if_arp.h>
+
+#include <asm/io.h>
+
+#include "prismcompat.h"
+#include "isl_38xx.h"
+#include "isl_ioctl.h"
+#include "islpci_dev.h"
+#include "islpci_mgt.h"
+#include "islpci_eth.h"
+#include "oid_mgt.h"
+
+#define ISL3877_IMAGE_FILE	"isl3877"
+#define ISL3886_IMAGE_FILE	"isl3886"
+#define ISL3890_IMAGE_FILE	"isl3890"
+
+static int prism54_bring_down(islpci_private *);
+static int islpci_alloc_memory(islpci_private *);
+static struct net_device_stats *islpci_statistics(struct net_device *);
+
+/* Temporary dummy MAC address to use until firmware is loaded.
+ * The idea there is that some tools (such as nameif) may query
+ * the MAC address before the netdev is 'open'. By using a valid
+ * OUI prefix, they can process the netdev properly.
+ * Of course, this is not the final/real MAC address. It doesn't
+ * matter, as you are suppose to be able to change it anytime via
+ * ndev->set_mac_address. Jean II */
+static const unsigned char	dummy_mac[6] = { 0x00, 0x30, 0xB4, 0x00, 0x00, 0x00 };
+
+static int
+isl_upload_firmware(islpci_private *priv)
+{
+	u32 reg, rc;
+	void __iomem *device_base = priv->device_base;
+
+	/* clear the RAMBoot and the Reset bit */
+	reg = readl(device_base + ISL38XX_CTRL_STAT_REG);
+	reg &= ~ISL38XX_CTRL_STAT_RESET;
+	reg &= ~ISL38XX_CTRL_STAT_RAMBOOT;
+	writel(reg, device_base + ISL38XX_CTRL_STAT_REG);
+	wmb();
+	udelay(ISL38XX_WRITEIO_DELAY);
+
+	/* set the Reset bit without reading the register ! */
+	reg |= ISL38XX_CTRL_STAT_RESET;
+	writel(reg, device_base + ISL38XX_CTRL_STAT_REG);
+	wmb();
+	udelay(ISL38XX_WRITEIO_DELAY);
+
+	/* clear the Reset bit */
+	reg &= ~ISL38XX_CTRL_STAT_RESET;
+	writel(reg, device_base + ISL38XX_CTRL_STAT_REG);
+	wmb();
+
+	/* wait a while for the device to reboot */
+	mdelay(50);
+
+	{
+		const struct firmware *fw_entry = NULL;
+		long fw_len;
+		const u32 *fw_ptr;
+
+		rc = request_firmware(&fw_entry, priv->firmware, PRISM_FW_PDEV);
+		if (rc) {
+			printk(KERN_ERR
+			       "%s: request_firmware() failed for '%s'\n",
+			       "prism54", priv->firmware);
+			return rc;
+		}
+		/* prepare the Direct Memory Base register */
+		reg = ISL38XX_DEV_FIRMWARE_ADDRES;
+
+		fw_ptr = (u32 *) fw_entry->data;
+		fw_len = fw_entry->size;
+
+		if (fw_len % 4) {
+			printk(KERN_ERR
+			       "%s: firmware '%s' size is not multiple of 32bit, aborting!\n",
+			       "prism54", priv->firmware);
+			release_firmware(fw_entry);
+			return -EILSEQ; /* Illegal byte sequence  */;
+		}
+
+		while (fw_len > 0) {
+			long _fw_len =
+			    (fw_len >
+			     ISL38XX_MEMORY_WINDOW_SIZE) ?
+			    ISL38XX_MEMORY_WINDOW_SIZE : fw_len;
+			u32 __iomem *dev_fw_ptr = device_base + ISL38XX_DIRECT_MEM_WIN;
+
+			/* set the cards base address for writting the data */
+			isl38xx_w32_flush(device_base, reg,
+					  ISL38XX_DIR_MEM_BASE_REG);
+			wmb();	/* be paranoid */
+
+			/* increment the write address for next iteration */
+			reg += _fw_len;
+			fw_len -= _fw_len;
+
+			/* write the data to the Direct Memory Window 32bit-wise */
+			/* memcpy_toio() doesn't guarantee 32bit writes :-| */
+			while (_fw_len > 0) {
+				/* use non-swapping writel() */
+				__raw_writel(*fw_ptr, dev_fw_ptr);
+				fw_ptr++, dev_fw_ptr++;
+				_fw_len -= 4;
+			}
+
+			/* flush PCI posting */
+			(void) readl(device_base + ISL38XX_PCI_POSTING_FLUSH);
+			wmb();	/* be paranoid again */
+
+			BUG_ON(_fw_len != 0);
+		}
+
+		BUG_ON(fw_len != 0);
+
+		/* Firmware version is at offset 40 (also for "newmac") */
+		printk(KERN_DEBUG "%s: firmware version: %.8s\n",
+		       priv->ndev->name, fw_entry->data + 40);
+
+		release_firmware(fw_entry);
+	}
+
+	/* now reset the device
+	 * clear the Reset & ClkRun bit, set the RAMBoot bit */
+	reg = readl(device_base + ISL38XX_CTRL_STAT_REG);
+	reg &= ~ISL38XX_CTRL_STAT_CLKRUN;
+	reg &= ~ISL38XX_CTRL_STAT_RESET;
+	reg |= ISL38XX_CTRL_STAT_RAMBOOT;
+	isl38xx_w32_flush(device_base, reg, ISL38XX_CTRL_STAT_REG);
+	wmb();
+	udelay(ISL38XX_WRITEIO_DELAY);
+
+	/* set the reset bit latches the host override and RAMBoot bits
+	 * into the device for operation when the reset bit is reset */
+	reg |= ISL38XX_CTRL_STAT_RESET;
+	writel(reg, device_base + ISL38XX_CTRL_STAT_REG);
+	/* don't do flush PCI posting here! */
+	wmb();
+	udelay(ISL38XX_WRITEIO_DELAY);
+
+	/* clear the reset bit should start the whole circus */
+	reg &= ~ISL38XX_CTRL_STAT_RESET;
+	writel(reg, device_base + ISL38XX_CTRL_STAT_REG);
+	/* don't do flush PCI posting here! */
+	wmb();
+	udelay(ISL38XX_WRITEIO_DELAY);
+
+	return 0;
+}
+
+/******************************************************************************
+    Device Interrupt Handler
+******************************************************************************/
+
+irqreturn_t
+islpci_interrupt(int irq, void *config, struct pt_regs *regs)
+{
+	u32 reg;
+	islpci_private *priv = config;
+	struct net_device *ndev = priv->ndev;
+	void __iomem *device = priv->device_base;
+	int powerstate = ISL38XX_PSM_POWERSAVE_STATE;
+
+	/* lock the interrupt handler */
+	spin_lock(&priv->slock);
+
+	/* received an interrupt request on a shared IRQ line
+	 * first check whether the device is in sleep mode */
+	reg = readl(device + ISL38XX_CTRL_STAT_REG);
+	if (reg & ISL38XX_CTRL_STAT_SLEEPMODE)
+		/* device is in sleep mode, IRQ was generated by someone else */
+	{
+#if VERBOSE > SHOW_ERROR_MESSAGES
+		DEBUG(SHOW_TRACING, "Assuming someone else called the IRQ\n");
+#endif
+		spin_unlock(&priv->slock);
+		return IRQ_NONE;
+	}
+
+
+	/* check whether there is any source of interrupt on the device */
+	reg = readl(device + ISL38XX_INT_IDENT_REG);
+
+	/* also check the contents of the Interrupt Enable Register, because this
+	 * will filter out interrupt sources from other devices on the same irq ! */
+	reg &= readl(device + ISL38XX_INT_EN_REG);
+	reg &= ISL38XX_INT_SOURCES;
+
+	if (reg != 0) {
+		if (islpci_get_state(priv) != PRV_STATE_SLEEP)
+			powerstate = ISL38XX_PSM_ACTIVE_STATE;
+
+		/* reset the request bits in the Identification register */
+		isl38xx_w32_flush(device, reg, ISL38XX_INT_ACK_REG);
+
+#if VERBOSE > SHOW_ERROR_MESSAGES
+		DEBUG(SHOW_FUNCTION_CALLS,
+		      "IRQ: Identification register 0x%p 0x%x \n", device, reg);
+#endif
+
+		/* check for each bit in the register separately */
+		if (reg & ISL38XX_INT_IDENT_UPDATE) {
+#if VERBOSE > SHOW_ERROR_MESSAGES
+			/* Queue has been updated */
+			DEBUG(SHOW_TRACING, "IRQ: Update flag \n");
+
+			DEBUG(SHOW_QUEUE_INDEXES,
+			      "CB drv Qs: [%i][%i][%i][%i][%i][%i]\n",
+			      le32_to_cpu(priv->control_block->
+					  driver_curr_frag[0]),
+			      le32_to_cpu(priv->control_block->
+					  driver_curr_frag[1]),
+			      le32_to_cpu(priv->control_block->
+					  driver_curr_frag[2]),
+			      le32_to_cpu(priv->control_block->
+					  driver_curr_frag[3]),
+			      le32_to_cpu(priv->control_block->
+					  driver_curr_frag[4]),
+			      le32_to_cpu(priv->control_block->
+					  driver_curr_frag[5])
+			    );
+
+			DEBUG(SHOW_QUEUE_INDEXES,
+			      "CB dev Qs: [%i][%i][%i][%i][%i][%i]\n",
+			      le32_to_cpu(priv->control_block->
+					  device_curr_frag[0]),
+			      le32_to_cpu(priv->control_block->
+					  device_curr_frag[1]),
+			      le32_to_cpu(priv->control_block->
+					  device_curr_frag[2]),
+			      le32_to_cpu(priv->control_block->
+					  device_curr_frag[3]),
+			      le32_to_cpu(priv->control_block->
+					  device_curr_frag[4]),
+			      le32_to_cpu(priv->control_block->
+					  device_curr_frag[5])
+			    );
+#endif
+
+			/* cleanup the data low transmit queue */
+			islpci_eth_cleanup_transmit(priv, priv->control_block);
+
+			/* device is in active state, update the
+			 * powerstate flag if necessary */
+			powerstate = ISL38XX_PSM_ACTIVE_STATE;
+
+			/* check all three queues in priority order
+			 * call the PIMFOR receive function until the
+			 * queue is empty */
+			if (isl38xx_in_queue(priv->control_block,
+						ISL38XX_CB_RX_MGMTQ) != 0) {
+#if VERBOSE > SHOW_ERROR_MESSAGES
+				DEBUG(SHOW_TRACING,
+				      "Received frame in Management Queue\n");
+#endif
+				islpci_mgt_receive(ndev);
+
+				islpci_mgt_cleanup_transmit(ndev);
+
+				/* Refill slots in receive queue */
+				islpci_mgmt_rx_fill(ndev);
+
+				/* no need to trigger the device, next
+                                   islpci_mgt_transaction does it */
+			}
+
+			while (isl38xx_in_queue(priv->control_block,
+						ISL38XX_CB_RX_DATA_LQ) != 0) {
+#if VERBOSE > SHOW_ERROR_MESSAGES
+				DEBUG(SHOW_TRACING,
+				      "Received frame in Data Low Queue \n");
+#endif
+				islpci_eth_receive(priv);
+			}
+
+			/* check whether the data transmit queues were full */
+			if (priv->data_low_tx_full) {
+				/* check whether the transmit is not full anymore */
+				if (ISL38XX_CB_TX_QSIZE -
+				    isl38xx_in_queue(priv->control_block,
+						     ISL38XX_CB_TX_DATA_LQ) >=
+				    ISL38XX_MIN_QTHRESHOLD) {
+					/* nope, the driver is ready for more network frames */
+					netif_wake_queue(priv->ndev);
+
+					/* reset the full flag */
+					priv->data_low_tx_full = 0;
+				}
+			}
+		}
+
+		if (reg & ISL38XX_INT_IDENT_INIT) {
+			/* Device has been initialized */
+#if VERBOSE > SHOW_ERROR_MESSAGES
+			DEBUG(SHOW_TRACING,
+			      "IRQ: Init flag, device initialized \n");
+#endif
+			wake_up(&priv->reset_done);
+		}
+
+		if (reg & ISL38XX_INT_IDENT_SLEEP) {
+			/* Device intends to move to powersave state */
+#if VERBOSE > SHOW_ERROR_MESSAGES
+			DEBUG(SHOW_TRACING, "IRQ: Sleep flag \n");
+#endif
+			isl38xx_handle_sleep_request(priv->control_block,
+						     &powerstate,
+						     priv->device_base);
+		}
+
+		if (reg & ISL38XX_INT_IDENT_WAKEUP) {
+			/* Device has been woken up to active state */
+#if VERBOSE > SHOW_ERROR_MESSAGES
+			DEBUG(SHOW_TRACING, "IRQ: Wakeup flag \n");
+#endif
+
+			isl38xx_handle_wakeup(priv->control_block,
+					      &powerstate, priv->device_base);
+		}
+	} else {
+#if VERBOSE > SHOW_ERROR_MESSAGES
+		DEBUG(SHOW_TRACING, "Assuming someone else called the IRQ\n");
+#endif
+		spin_unlock(&priv->slock);
+		return IRQ_NONE;
+	}
+
+	/* sleep -> ready */
+	if (islpci_get_state(priv) == PRV_STATE_SLEEP
+	    && powerstate == ISL38XX_PSM_ACTIVE_STATE)
+		islpci_set_state(priv, PRV_STATE_READY);
+
+	/* !sleep -> sleep */
+	if (islpci_get_state(priv) != PRV_STATE_SLEEP
+	    && powerstate == ISL38XX_PSM_POWERSAVE_STATE)
+		islpci_set_state(priv, PRV_STATE_SLEEP);
+
+	/* unlock the interrupt handler */
+	spin_unlock(&priv->slock);
+
+	return IRQ_HANDLED;
+}
+
+/******************************************************************************
+    Network Interface Control & Statistical functions
+******************************************************************************/
+static int
+islpci_open(struct net_device *ndev)
+{
+	u32 rc;
+	islpci_private *priv = netdev_priv(ndev);
+
+	/* reset data structures, upload firmware and reset device */
+	rc = islpci_reset(priv,1);
+	if (rc) {
+		prism54_bring_down(priv);
+		return rc; /* Returns informative message */
+	}
+
+	netif_start_queue(ndev);
+/*      netif_mark_up( ndev ); */
+
+	return 0;
+}
+
+static int
+islpci_close(struct net_device *ndev)
+{
+	islpci_private *priv = netdev_priv(ndev);
+
+	printk(KERN_DEBUG "%s: islpci_close ()\n", ndev->name);
+
+	netif_stop_queue(ndev);
+
+	return prism54_bring_down(priv);
+}
+
+static int
+prism54_bring_down(islpci_private *priv)
+{
+	void __iomem *device_base = priv->device_base;
+	u32 reg;
+	/* we are going to shutdown the device */
+	islpci_set_state(priv, PRV_STATE_PREBOOT);
+
+	/* disable all device interrupts in case they weren't */
+	isl38xx_disable_interrupts(priv->device_base);  
+
+	/* For safety reasons, we may want to ensure that no DMA transfer is
+	 * currently in progress by emptying the TX and RX queues. */
+
+	/* wait until interrupts have finished executing on other CPUs */
+	synchronize_irq(priv->pdev->irq);
+
+	reg = readl(device_base + ISL38XX_CTRL_STAT_REG);
+	reg &= ~(ISL38XX_CTRL_STAT_RESET | ISL38XX_CTRL_STAT_RAMBOOT);
+	writel(reg, device_base + ISL38XX_CTRL_STAT_REG);
+	wmb();
+	udelay(ISL38XX_WRITEIO_DELAY);
+
+	reg |= ISL38XX_CTRL_STAT_RESET;
+	writel(reg, device_base + ISL38XX_CTRL_STAT_REG);
+	wmb();
+	udelay(ISL38XX_WRITEIO_DELAY);
+
+	/* clear the Reset bit */
+	reg &= ~ISL38XX_CTRL_STAT_RESET;
+	writel(reg, device_base + ISL38XX_CTRL_STAT_REG);
+	wmb();
+
+	/* wait a while for the device to reset */
+	set_current_state(TASK_UNINTERRUPTIBLE);
+	schedule_timeout(50*HZ/1000);
+
+	return 0;
+}
+
+static int
+islpci_upload_fw(islpci_private *priv)
+{
+	islpci_state_t old_state;
+	u32 rc;
+
+	old_state = islpci_set_state(priv, PRV_STATE_BOOT);
+
+	printk(KERN_DEBUG "%s: uploading firmware...\n", priv->ndev->name);
+
+	rc = isl_upload_firmware(priv);
+	if (rc) {
+		/* error uploading the firmware */
+		printk(KERN_ERR "%s: could not upload firmware ('%s')\n",
+		       priv->ndev->name, priv->firmware);
+
+		islpci_set_state(priv, old_state);
+		return rc;
+	}
+
+	printk(KERN_DEBUG "%s: firmware upload complete\n",
+	       priv->ndev->name);
+
+	islpci_set_state(priv, PRV_STATE_POSTBOOT);
+
+	return 0;
+}
+
+static int
+islpci_reset_if(islpci_private *priv)
+{
+	long remaining;
+	int result = -ETIME;
+	int count;
+
+	DEFINE_WAIT(wait);
+	prepare_to_wait(&priv->reset_done, &wait, TASK_UNINTERRUPTIBLE);
+	
+	/* now the last step is to reset the interface */
+	isl38xx_interface_reset(priv->device_base, priv->device_host_address);
+	islpci_set_state(priv, PRV_STATE_PREINIT);
+
+        for(count = 0; count < 2 && result; count++) {
+		/* The software reset acknowledge needs about 220 msec here.
+		 * Be conservative and wait for up to one second. */
+	
+		set_current_state(TASK_UNINTERRUPTIBLE);
+		remaining = schedule_timeout(HZ);
+
+		if(remaining > 0) {
+			result = 0;
+			break;
+		}
+
+		/* If we're here it's because our IRQ hasn't yet gone through. 
+		 * Retry a bit more...
+		 */
+		printk(KERN_ERR "%s: no 'reset complete' IRQ seen - retrying\n",
+			priv->ndev->name);
+	}
+
+	finish_wait(&priv->reset_done, &wait);
+
+	if (result) {
+		printk(KERN_ERR "%s: interface reset failure\n", priv->ndev->name);
+		return result;
+	}
+
+	islpci_set_state(priv, PRV_STATE_INIT);
+
+	/* Now that the device is 100% up, let's allow
+	 * for the other interrupts --
+	 * NOTE: this is not *yet* true since we've only allowed the 
+	 * INIT interrupt on the IRQ line. We can perhaps poll
+	 * the IRQ line until we know for sure the reset went through */
+	isl38xx_enable_common_interrupts(priv->device_base);
+
+	down_write(&priv->mib_sem);
+	result = mgt_commit(priv);
+	if (result) {
+		printk(KERN_ERR "%s: interface reset failure\n", priv->ndev->name);
+		up_write(&priv->mib_sem);
+		return result;
+	}
+	up_write(&priv->mib_sem);
+
+	islpci_set_state(priv, PRV_STATE_READY);
+
+	printk(KERN_DEBUG "%s: interface reset complete\n", priv->ndev->name);
+	return 0;
+}
+
+int
+islpci_reset(islpci_private *priv, int reload_firmware)
+{
+	isl38xx_control_block *cb =    /* volatile not needed */
+		(isl38xx_control_block *) priv->control_block;
+	unsigned counter;
+	int rc;
+
+	if (reload_firmware)
+		islpci_set_state(priv, PRV_STATE_PREBOOT);
+	else
+		islpci_set_state(priv, PRV_STATE_POSTBOOT);
+
+	printk(KERN_DEBUG "%s: resetting device...\n", priv->ndev->name);
+
+	/* disable all device interrupts in case they weren't */
+	isl38xx_disable_interrupts(priv->device_base);
+
+	/* flush all management queues */
+	priv->index_mgmt_tx = 0;
+	priv->index_mgmt_rx = 0;
+
+	/* clear the indexes in the frame pointer */
+	for (counter = 0; counter < ISL38XX_CB_QCOUNT; counter++) {
+		cb->driver_curr_frag[counter] = cpu_to_le32(0);
+		cb->device_curr_frag[counter] = cpu_to_le32(0);
+	}
+
+	/* reset the mgmt receive queue */
+	for (counter = 0; counter < ISL38XX_CB_MGMT_QSIZE; counter++) {
+		isl38xx_fragment *frag = &cb->rx_data_mgmt[counter];
+		frag->size = cpu_to_le16(MGMT_FRAME_SIZE);
+		frag->flags = 0;
+		frag->address = cpu_to_le32(priv->mgmt_rx[counter].pci_addr);
+	}
+
+	for (counter = 0; counter < ISL38XX_CB_RX_QSIZE; counter++) {
+		cb->rx_data_low[counter].address =
+		    cpu_to_le32((u32) priv->pci_map_rx_address[counter]);
+	}
+
+	/* since the receive queues are filled with empty fragments, now we can
+	 * set the corresponding indexes in the Control Block */
+	priv->control_block->driver_curr_frag[ISL38XX_CB_RX_DATA_LQ] =
+	    cpu_to_le32(ISL38XX_CB_RX_QSIZE);
+	priv->control_block->driver_curr_frag[ISL38XX_CB_RX_MGMTQ] =
+	    cpu_to_le32(ISL38XX_CB_MGMT_QSIZE);
+
+	/* reset the remaining real index registers and full flags */
+	priv->free_data_rx = 0;
+	priv->free_data_tx = 0;
+	priv->data_low_tx_full = 0;
+
+	if (reload_firmware) { /* Should we load the firmware ? */
+	/* now that the data structures are cleaned up, upload
+	 * firmware and reset interface */
+		rc = islpci_upload_fw(priv);
+		if (rc) {
+			printk(KERN_ERR "%s: islpci_reset: failure\n",
+				priv->ndev->name);
+			return rc;
+		}
+	}
+
+	/* finally reset interface */
+	rc = islpci_reset_if(priv);
+	if (rc)
+		printk(KERN_ERR "prism54: Your card/socket may be faulty, or IRQ line too busy :(\n");
+	return rc;
+}
+
+static struct net_device_stats *
+islpci_statistics(struct net_device *ndev)
+{
+	islpci_private *priv = netdev_priv(ndev);
+
+#if VERBOSE > SHOW_ERROR_MESSAGES
+	DEBUG(SHOW_FUNCTION_CALLS, "islpci_statistics\n");
+#endif
+
+	return &priv->statistics;
+}
+
+/******************************************************************************
+    Network device configuration functions
+******************************************************************************/
+static int
+islpci_alloc_memory(islpci_private *priv)
+{
+	int counter;
+
+#if VERBOSE > SHOW_ERROR_MESSAGES
+	printk(KERN_DEBUG "islpci_alloc_memory\n");
+#endif
+
+	/* remap the PCI device base address to accessable */
+	if (!(priv->device_base =
+	      ioremap(pci_resource_start(priv->pdev, 0),
+		      ISL38XX_PCI_MEM_SIZE))) {
+		/* error in remapping the PCI device memory address range */
+		printk(KERN_ERR "PCI memory remapping failed \n");
+		return -1;
+	}
+
+	/* memory layout for consistent DMA region:
+	 *
+	 * Area 1: Control Block for the device interface
+	 * Area 2: Power Save Mode Buffer for temporary frame storage. Be aware that
+	 *         the number of supported stations in the AP determines the minimal
+	 *         size of the buffer !
+	 */
+
+	/* perform the allocation */
+	priv->driver_mem_address = pci_alloc_consistent(priv->pdev,
+							HOST_MEM_BLOCK,
+							&priv->
+							device_host_address);
+
+	if (!priv->driver_mem_address) {
+		/* error allocating the block of PCI memory */
+		printk(KERN_ERR "%s: could not allocate DMA memory, aborting!",
+		       "prism54");
+		return -1;
+	}
+
+	/* assign the Control Block to the first address of the allocated area */
+	priv->control_block =
+	    (isl38xx_control_block *) priv->driver_mem_address;
+
+	/* set the Power Save Buffer pointer directly behind the CB */
+	priv->device_psm_buffer =
+		priv->device_host_address + CONTROL_BLOCK_SIZE;
+
+	/* make sure all buffer pointers are initialized */
+	for (counter = 0; counter < ISL38XX_CB_QCOUNT; counter++) {
+		priv->control_block->driver_curr_frag[counter] = cpu_to_le32(0);
+		priv->control_block->device_curr_frag[counter] = cpu_to_le32(0);
+	}
+
+	priv->index_mgmt_rx = 0;
+	memset(priv->mgmt_rx, 0, sizeof(priv->mgmt_rx));
+	memset(priv->mgmt_tx, 0, sizeof(priv->mgmt_tx));
+
+	/* allocate rx queue for management frames */
+	if (islpci_mgmt_rx_fill(priv->ndev) < 0)
+		goto out_free;
+
+	/* now get the data rx skb's */
+	memset(priv->data_low_rx, 0, sizeof (priv->data_low_rx));
+	memset(priv->pci_map_rx_address, 0, sizeof (priv->pci_map_rx_address));
+
+	for (counter = 0; counter < ISL38XX_CB_RX_QSIZE; counter++) {
+		struct sk_buff *skb;
+
+		/* allocate an sk_buff for received data frames storage
+		 * each frame on receive size consists of 1 fragment
+		 * include any required allignment operations */
+		if (!(skb = dev_alloc_skb(MAX_FRAGMENT_SIZE_RX + 2))) {
+			/* error allocating an sk_buff structure elements */
+			printk(KERN_ERR "Error allocating skb.\n");
+			skb = NULL;
+			goto out_free;
+		}
+		skb_reserve(skb, (4 - (long) skb->data) & 0x03);
+		/* add the new allocated sk_buff to the buffer array */
+		priv->data_low_rx[counter] = skb;
+
+		/* map the allocated skb data area to pci */
+		priv->pci_map_rx_address[counter] =
+		    pci_map_single(priv->pdev, (void *) skb->data,
+				   MAX_FRAGMENT_SIZE_RX + 2,
+				   PCI_DMA_FROMDEVICE);
+		if (!priv->pci_map_rx_address[counter]) {
+			/* error mapping the buffer to device
+			   accessable memory address */
+			printk(KERN_ERR "failed to map skb DMA'able\n");
+			goto out_free;
+		}
+	}
+
+	prism54_acl_init(&priv->acl);
+	prism54_wpa_ie_init(priv);
+	if (mgt_init(priv)) 
+		goto out_free;
+
+	return 0;
+ out_free:
+	islpci_free_memory(priv);
+	return -1;
+}
+
+int
+islpci_free_memory(islpci_private *priv)
+{
+	int counter;
+
+	if (priv->device_base)
+		iounmap(priv->device_base);
+	priv->device_base = NULL;
+
+	/* free consistent DMA area... */
+	if (priv->driver_mem_address)
+		pci_free_consistent(priv->pdev, HOST_MEM_BLOCK,
+				    priv->driver_mem_address,
+				    priv->device_host_address);
+
+	/* clear some dangling pointers */
+	priv->driver_mem_address = NULL;
+	priv->device_host_address = 0;
+	priv->device_psm_buffer = 0;
+	priv->control_block = NULL;
+
+        /* clean up mgmt rx buffers */
+        for (counter = 0; counter < ISL38XX_CB_MGMT_QSIZE; counter++) {
+		struct islpci_membuf *buf = &priv->mgmt_rx[counter];
+		if (buf->pci_addr)
+			pci_unmap_single(priv->pdev, buf->pci_addr,
+					 buf->size, PCI_DMA_FROMDEVICE);
+		buf->pci_addr = 0;
+		if (buf->mem)
+			kfree(buf->mem);
+		buf->size = 0;
+		buf->mem = NULL;
+        }
+
+	/* clean up data rx buffers */
+	for (counter = 0; counter < ISL38XX_CB_RX_QSIZE; counter++) {
+		if (priv->pci_map_rx_address[counter])
+			pci_unmap_single(priv->pdev,
+					 priv->pci_map_rx_address[counter],
+					 MAX_FRAGMENT_SIZE_RX + 2,
+					 PCI_DMA_FROMDEVICE);
+		priv->pci_map_rx_address[counter] = 0;
+
+		if (priv->data_low_rx[counter])
+			dev_kfree_skb(priv->data_low_rx[counter]);
+		priv->data_low_rx[counter] = NULL;
+	}
+
+	/* Free the acces control list and the WPA list */
+	prism54_acl_clean(&priv->acl);
+	prism54_wpa_ie_clean(priv);
+	mgt_clean(priv);
+
+	return 0;
+}
+
+#if 0
+static void
+islpci_set_multicast_list(struct net_device *dev)
+{
+	/* put device into promisc mode and let network layer handle it */
+}
+#endif
+
+struct net_device *
+islpci_setup(struct pci_dev *pdev)
+{
+	islpci_private *priv;
+	struct net_device *ndev = alloc_etherdev(sizeof (islpci_private));
+
+	if (!ndev)
+		return ndev;
+
+	SET_MODULE_OWNER(ndev);
+	pci_set_drvdata(pdev, ndev);
+#if defined(SET_NETDEV_DEV)
+	SET_NETDEV_DEV(ndev, &pdev->dev);
+#endif
+
+	/* setup the structure members */
+	ndev->base_addr = pci_resource_start(pdev, 0);
+	ndev->irq = pdev->irq;
+
+	/* initialize the function pointers */
+	ndev->open = &islpci_open;
+	ndev->stop = &islpci_close;
+	ndev->get_stats = &islpci_statistics;
+	ndev->get_wireless_stats = &prism54_get_wireless_stats;
+	ndev->do_ioctl = &prism54_ioctl;
+	ndev->wireless_handlers =
+	    (struct iw_handler_def *) &prism54_handler_def;
+
+	ndev->hard_start_xmit = &islpci_eth_transmit;
+	/* ndev->set_multicast_list = &islpci_set_multicast_list; */
+	ndev->addr_len = ETH_ALEN;
+	ndev->set_mac_address = &prism54_set_mac_address;
+	/* Get a non-zero dummy MAC address for nameif. Jean II */
+	memcpy(ndev->dev_addr, dummy_mac, 6);
+
+#ifdef HAVE_TX_TIMEOUT
+	ndev->watchdog_timeo = ISLPCI_TX_TIMEOUT;
+	ndev->tx_timeout = &islpci_eth_tx_timeout;
+#endif
+
+	/* allocate a private device structure to the network device  */
+	priv = netdev_priv(ndev);
+	priv->ndev = ndev;
+	priv->pdev = pdev;
+	priv->monitor_type = ARPHRD_IEEE80211;
+	priv->ndev->type = (priv->iw_mode == IW_MODE_MONITOR) ?
+		priv->monitor_type : ARPHRD_ETHER;
+
+#if WIRELESS_EXT > 16
+	/* Add pointers to enable iwspy support. */
+	priv->wireless_data.spy_data = &priv->spy_data;
+	ndev->wireless_data = &priv->wireless_data;
+#endif /* WIRELESS_EXT > 16 */
+
+	/* save the start and end address of the PCI memory area */
+	ndev->mem_start = (unsigned long) priv->device_base;
+	ndev->mem_end = ndev->mem_start + ISL38XX_PCI_MEM_SIZE;
+
+#if VERBOSE > SHOW_ERROR_MESSAGES
+	DEBUG(SHOW_TRACING, "PCI Memory remapped to 0x%p\n", priv->device_base);
+#endif
+
+	init_waitqueue_head(&priv->reset_done);
+
+	/* init the queue read locks, process wait counter */
+	sema_init(&priv->mgmt_sem, 1);
+	priv->mgmt_received = NULL;
+	init_waitqueue_head(&priv->mgmt_wqueue);
+	sema_init(&priv->stats_sem, 1);
+	spin_lock_init(&priv->slock);
+
+	/* init state machine with off#1 state */
+	priv->state = PRV_STATE_OFF;
+	priv->state_off = 1;
+
+	/* initialize workqueue's */
+	INIT_WORK(&priv->stats_work,
+		  (void (*)(void *)) prism54_update_stats, priv);
+	priv->stats_timestamp = 0;
+
+	INIT_WORK(&priv->reset_task, islpci_do_reset_and_wake, priv);
+	priv->reset_task_pending = 0;
+
+	/* allocate various memory areas */
+	if (islpci_alloc_memory(priv))
+		goto do_free_netdev;
+
+	/* select the firmware file depending on the device id */
+	switch (pdev->device) {
+	case 0x3877:
+		strcpy(priv->firmware, ISL3877_IMAGE_FILE);
+		break;
+
+	case 0x3886:
+		strcpy(priv->firmware, ISL3886_IMAGE_FILE);
+		break;
+
+	default:
+		strcpy(priv->firmware, ISL3890_IMAGE_FILE);
+		break;
+	}
+
+	if (register_netdev(ndev)) {
+		DEBUG(SHOW_ERROR_MESSAGES,
+		      "ERROR: register_netdev() failed \n");
+		goto do_islpci_free_memory;
+	}
+
+	return ndev;
+
+      do_islpci_free_memory:
+	islpci_free_memory(priv);
+      do_free_netdev:
+	pci_set_drvdata(pdev, NULL);
+	free_netdev(ndev);
+	priv = NULL;
+	return NULL;
+}
+
+islpci_state_t
+islpci_set_state(islpci_private *priv, islpci_state_t new_state)
+{
+	islpci_state_t old_state;
+
+	/* lock */
+	old_state = priv->state;
+
+	/* this means either a race condition or some serious error in
+	 * the driver code */
+	switch (new_state) {
+	case PRV_STATE_OFF:
+		priv->state_off++;
+	default:
+		priv->state = new_state;
+		break;
+
+	case PRV_STATE_PREBOOT:
+		/* there are actually many off-states, enumerated by
+		 * state_off */
+		if (old_state == PRV_STATE_OFF)
+			priv->state_off--;
+
+		/* only if hw_unavailable is zero now it means we either
+		 * were in off#1 state, or came here from
+		 * somewhere else */
+		if (!priv->state_off)
+			priv->state = new_state;
+		break;
+	};
+#if 0
+	printk(KERN_DEBUG "%s: state transition %d -> %d (off#%d)\n",
+	       priv->ndev->name, old_state, new_state, priv->state_off);
+#endif
+
+	/* invariants */
+	BUG_ON(priv->state_off < 0);
+	BUG_ON(priv->state_off && (priv->state != PRV_STATE_OFF));
+	BUG_ON(!priv->state_off && (priv->state == PRV_STATE_OFF));
+
+	/* unlock */
+	return old_state;
+}
diff --git a/drivers/net/wireless/prism54/islpci_dev.h b/drivers/net/wireless/prism54/islpci_dev.h
new file mode 100644
index 0000000..32a1019
--- /dev/null
+++ b/drivers/net/wireless/prism54/islpci_dev.h
@@ -0,0 +1,216 @@
+/*
+ *  
+ *  Copyright (C) 2002 Intersil Americas Inc. 
+ *  Copyright (C) 2003 Herbert Valerio Riedel <hvr@gnu.org>
+ *  Copyright (C) 2003 Luis R. Rodriguez <mcgrof@ruslug.rutgers.edu>
+ *  Copyright (C) 2003 Aurelien Alleaume <slts@free.fr>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+
+#ifndef _ISLPCI_DEV_H
+#define _ISLPCI_DEV_H
+
+#include <linux/version.h>
+#include <linux/netdevice.h>
+#include <linux/wireless.h>
+#include <net/iw_handler.h>
+#include <linux/list.h>
+
+#include "isl_38xx.h"
+#include "isl_oid.h"
+#include "islpci_mgt.h"
+
+/* some states might not be superflous and may be removed when
+   design is finalized (hvr) */
+typedef enum {
+	PRV_STATE_OFF = 0,	/* this means hw_unavailable is != 0 */
+	PRV_STATE_PREBOOT,	/* we are in a pre-boot state (empty RAM) */
+	PRV_STATE_BOOT,		/* boot state (fw upload, run fw) */
+	PRV_STATE_POSTBOOT,	/* after boot state, need reset now */
+	PRV_STATE_PREINIT,	/* pre-init state */
+	PRV_STATE_INIT,		/* init state (restore MIB backup to device) */
+	PRV_STATE_READY,	/* driver&device are in operational state */
+	PRV_STATE_SLEEP		/* device in sleep mode */
+} islpci_state_t;
+
+/* ACL using MAC address */
+struct mac_entry {
+   struct list_head _list;
+   char addr[ETH_ALEN];
+};
+
+struct islpci_acl {
+   enum { MAC_POLICY_OPEN=0, MAC_POLICY_ACCEPT=1, MAC_POLICY_REJECT=2 } policy;
+   struct list_head mac_list;  /* a list of mac_entry */
+   int size;   /* size of queue */
+   struct semaphore sem;   /* accessed in ioctls and trap_work */
+};
+
+struct islpci_membuf {
+	int size;                   /* size of memory */
+	void *mem;                  /* address of memory as seen by CPU */
+	dma_addr_t pci_addr;        /* address of memory as seen by device */
+};
+
+#define MAX_BSS_WPA_IE_COUNT 64
+#define MAX_WPA_IE_LEN 64
+struct islpci_bss_wpa_ie {
+	struct list_head list;
+	unsigned long last_update;
+	u8 bssid[ETH_ALEN];
+	u8 wpa_ie[MAX_WPA_IE_LEN];
+	size_t wpa_ie_len;
+	
+};
+
+typedef struct {
+	spinlock_t slock;	/* generic spinlock; */
+	
+	u32 priv_oid;
+
+	/* our mib cache */
+	u32 iw_mode;
+        struct rw_semaphore mib_sem;
+	void **mib;
+	char nickname[IW_ESSID_MAX_SIZE+1];
+	
+	/* Take care of the wireless stats */
+	struct work_struct stats_work;
+	struct semaphore stats_sem;
+	/* remember when we last updated the stats */
+	unsigned long stats_timestamp;
+	/* The first is accessed under semaphore locking.
+	 * The second is the clean one we return to iwconfig.
+	 */
+	struct iw_statistics local_iwstatistics;
+	struct iw_statistics iwstatistics;
+
+	struct iw_spy_data spy_data; /* iwspy support */
+
+#if WIRELESS_EXT > 16
+	struct iw_public_data wireless_data;
+#endif /* WIRELESS_EXT > 16 */
+
+	int monitor_type; /* ARPHRD_IEEE80211 or ARPHRD_IEEE80211_PRISM */
+
+	struct islpci_acl acl;
+
+	/* PCI bus allocation & configuration members */
+	struct pci_dev *pdev;	/* PCI structure information */
+	char firmware[33];
+
+	void __iomem *device_base;	/* ioremapped device base address */
+
+	/* consistent DMA region */
+	void *driver_mem_address;	/* base DMA address */
+	dma_addr_t device_host_address;	/* base DMA address (bus address) */
+	dma_addr_t device_psm_buffer;	/* host memory for PSM buffering (bus address) */
+
+	/* our network_device structure  */
+	struct net_device *ndev;
+
+	/* device queue interface members */
+	struct isl38xx_cb *control_block;	/* device control block 
+							   (== driver_mem_address!) */
+
+	/* Each queue has three indexes:
+	 *   free/index_mgmt/data_rx/tx (called index, see below),
+	 *   driver_curr_frag, and device_curr_frag (in the control block)
+	 * All indexes are ever-increasing, but interpreted modulo the
+	 * device queue size when used.
+	 *   index <= device_curr_frag <= driver_curr_frag  at all times
+	 * For rx queues, [index, device_curr_frag) contains fragments
+	 * that the interrupt processing needs to handle (owned by driver).
+	 * [device_curr_frag, driver_curr_frag) is the free space in the
+	 * rx queue, waiting for data (owned by device).  The driver
+	 * increments driver_curr_frag to indicate to the device that more
+	 * buffers are available.
+	 * If device_curr_frag == driver_curr_frag, no more rx buffers are
+	 * available, and the rx DMA engine of the device is halted.
+	 * For tx queues, [index, device_curr_frag) contains fragments
+	 * where tx is done; they need to be freed (owned by driver).
+	 * [device_curr_frag, driver_curr_frag) contains the frames
+	 * that are being transferred (owned by device).  The driver
+	 * increments driver_curr_frag to indicate that more tx work
+	 * needs to be done.
+	 */
+	u32 index_mgmt_rx;              /* real index mgmt rx queue */
+	u32 index_mgmt_tx;              /* read index mgmt tx queue */
+	u32 free_data_rx;	/* free pointer data rx queue */
+	u32 free_data_tx;	/* free pointer data tx queue */
+	u32 data_low_tx_full;	/* full detected flag */
+
+	/* frame memory buffers for the device queues */
+	struct islpci_membuf mgmt_tx[ISL38XX_CB_MGMT_QSIZE];
+	struct islpci_membuf mgmt_rx[ISL38XX_CB_MGMT_QSIZE];
+	struct sk_buff *data_low_tx[ISL38XX_CB_TX_QSIZE];
+	struct sk_buff *data_low_rx[ISL38XX_CB_RX_QSIZE];
+	dma_addr_t pci_map_tx_address[ISL38XX_CB_TX_QSIZE];
+	dma_addr_t pci_map_rx_address[ISL38XX_CB_RX_QSIZE];
+
+	/* driver network interface members */
+	struct net_device_stats statistics;
+
+	/* wait for a reset interrupt */
+	wait_queue_head_t reset_done;
+
+	/* used by islpci_mgt_transaction */
+	struct semaphore mgmt_sem; /* serialize access to mailbox and wqueue */
+	struct islpci_mgmtframe *mgmt_received;	  /* mbox for incoming frame */
+	wait_queue_head_t mgmt_wqueue;            /* waitqueue for mbox */
+
+	/* state machine */
+	islpci_state_t state;
+	int state_off;		/* enumeration of off-state, if 0 then
+				 * we're not in any off-state */
+
+	/* WPA stuff */
+	int wpa; /* WPA mode enabled */
+	struct list_head bss_wpa_list;
+	int num_bss_wpa;
+	struct semaphore wpa_sem;
+
+	struct work_struct reset_task;
+	int reset_task_pending;
+} islpci_private;
+
+static inline islpci_state_t
+islpci_get_state(islpci_private *priv)
+{
+	/* lock */
+	return priv->state;
+	/* unlock */
+}
+
+islpci_state_t islpci_set_state(islpci_private *priv, islpci_state_t new_state);
+
+#define ISLPCI_TX_TIMEOUT               (2*HZ)
+
+irqreturn_t islpci_interrupt(int, void *, struct pt_regs *);
+
+int prism54_post_setup(islpci_private *, int);
+int islpci_reset(islpci_private *, int);
+
+static inline void
+islpci_trigger(islpci_private *priv)
+{
+	isl38xx_trigger_device(islpci_get_state(priv) == PRV_STATE_SLEEP,
+			       priv->device_base);
+}
+
+int islpci_free_memory(islpci_private *);
+struct net_device *islpci_setup(struct pci_dev *);
+#endif				/* _ISLPCI_DEV_H */
diff --git a/drivers/net/wireless/prism54/islpci_eth.c b/drivers/net/wireless/prism54/islpci_eth.c
new file mode 100644
index 0000000..5952e996
--- /dev/null
+++ b/drivers/net/wireless/prism54/islpci_eth.c
@@ -0,0 +1,519 @@
+/*
+ *  
+ *  Copyright (C) 2002 Intersil Americas Inc.
+ *  Copyright (C) 2004 Aurelien Alleaume <slts@free.fr>
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+
+#include <linux/version.h>
+#include <linux/module.h>
+
+#include <linux/pci.h>
+#include <linux/delay.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/if_arp.h>
+
+#include "prismcompat.h"
+#include "isl_38xx.h"
+#include "islpci_eth.h"
+#include "islpci_mgt.h"
+#include "oid_mgt.h"
+
+/******************************************************************************
+    Network Interface functions
+******************************************************************************/
+void
+islpci_eth_cleanup_transmit(islpci_private *priv,
+			    isl38xx_control_block *control_block)
+{
+	struct sk_buff *skb;
+	u32 index;
+
+	/* compare the control block read pointer with the free pointer */
+	while (priv->free_data_tx !=
+	       le32_to_cpu(control_block->
+			   device_curr_frag[ISL38XX_CB_TX_DATA_LQ])) {
+		/* read the index of the first fragment to be freed */
+		index = priv->free_data_tx % ISL38XX_CB_TX_QSIZE;
+
+		/* check for holes in the arrays caused by multi fragment frames 
+		 * searching for the last fragment of a frame */
+		if (priv->pci_map_tx_address[index] != (dma_addr_t) NULL) {
+			/* entry is the last fragment of a frame
+			 * free the skb structure and unmap pci memory */
+			skb = priv->data_low_tx[index];
+
+#if VERBOSE > SHOW_ERROR_MESSAGES
+			DEBUG(SHOW_TRACING,
+			      "cleanup skb %p skb->data %p skb->len %u truesize %u\n ",
+			      skb, skb->data, skb->len, skb->truesize);
+#endif
+
+			pci_unmap_single(priv->pdev,
+					 priv->pci_map_tx_address[index],
+					 skb->len, PCI_DMA_TODEVICE);
+			dev_kfree_skb_irq(skb);
+			skb = NULL;
+		}
+		/* increment the free data low queue pointer */
+		priv->free_data_tx++;
+	}
+}
+
+int
+islpci_eth_transmit(struct sk_buff *skb, struct net_device *ndev)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	isl38xx_control_block *cb = priv->control_block;
+	u32 index;
+	dma_addr_t pci_map_address;
+	int frame_size;
+	isl38xx_fragment *fragment;
+	int offset;
+	struct sk_buff *newskb;
+	int newskb_offset;
+	unsigned long flags;
+	unsigned char wds_mac[6];
+	u32 curr_frag;
+	int err = 0;
+
+#if VERBOSE > SHOW_ERROR_MESSAGES
+	DEBUG(SHOW_FUNCTION_CALLS, "islpci_eth_transmit \n");
+#endif
+
+	/* lock the driver code */
+	spin_lock_irqsave(&priv->slock, flags);
+
+	/* determine the amount of fragments needed to store the frame */
+
+	frame_size = skb->len < ETH_ZLEN ? ETH_ZLEN : skb->len;
+	if (init_wds)
+		frame_size += 6;
+
+	/* check whether the destination queue has enough fragments for the frame */
+	curr_frag = le32_to_cpu(cb->driver_curr_frag[ISL38XX_CB_TX_DATA_LQ]);
+	if (unlikely(curr_frag - priv->free_data_tx >= ISL38XX_CB_TX_QSIZE)) {
+		printk(KERN_ERR "%s: transmit device queue full when awake\n",
+		       ndev->name);
+		netif_stop_queue(ndev);
+
+		/* trigger the device */
+		isl38xx_w32_flush(priv->device_base, ISL38XX_DEV_INT_UPDATE,
+				  ISL38XX_DEV_INT_REG);
+		udelay(ISL38XX_WRITEIO_DELAY);
+
+		err = -EBUSY;
+		goto drop_free;
+	}
+	/* Check alignment and WDS frame formatting. The start of the packet should
+	 * be aligned on a 4-byte boundary. If WDS is enabled add another 6 bytes
+	 * and add WDS address information */
+	if (likely(((long) skb->data & 0x03) | init_wds)) {
+		/* get the number of bytes to add and re-allign */
+		offset = (4 - (long) skb->data) & 0x03;
+		offset += init_wds ? 6 : 0;
+
+		/* check whether the current skb can be used  */
+		if (!skb_cloned(skb) && (skb_tailroom(skb) >= offset)) {
+			unsigned char *src = skb->data;
+
+#if VERBOSE > SHOW_ERROR_MESSAGES
+			DEBUG(SHOW_TRACING, "skb offset %i wds %i\n", offset,
+			      init_wds);
+#endif
+
+			/* align the buffer on 4-byte boundary */
+			skb_reserve(skb, (4 - (long) skb->data) & 0x03);
+			if (init_wds) {
+				/* wds requires an additional address field of 6 bytes */
+				skb_put(skb, 6);
+#ifdef ISLPCI_ETH_DEBUG
+				printk("islpci_eth_transmit:wds_mac\n");
+#endif
+				memmove(skb->data + 6, src, skb->len);
+				memcpy(skb->data, wds_mac, 6);
+			} else {
+				memmove(skb->data, src, skb->len);
+			}
+
+#if VERBOSE > SHOW_ERROR_MESSAGES
+			DEBUG(SHOW_TRACING, "memmove %p %p %i \n", skb->data,
+			      src, skb->len);
+#endif
+		} else {
+			newskb =
+			    dev_alloc_skb(init_wds ? skb->len + 6 : skb->len);
+			if (unlikely(newskb == NULL)) {
+				printk(KERN_ERR "%s: Cannot allocate skb\n",
+				       ndev->name);
+				err = -ENOMEM;
+				goto drop_free;
+			}
+			newskb_offset = (4 - (long) newskb->data) & 0x03;
+
+			/* Check if newskb->data is aligned */
+			if (newskb_offset)
+				skb_reserve(newskb, newskb_offset);
+
+			skb_put(newskb, init_wds ? skb->len + 6 : skb->len);
+			if (init_wds) {
+				memcpy(newskb->data + 6, skb->data, skb->len);
+				memcpy(newskb->data, wds_mac, 6);
+#ifdef ISLPCI_ETH_DEBUG
+				printk("islpci_eth_transmit:wds_mac\n");
+#endif
+			} else
+				memcpy(newskb->data, skb->data, skb->len);
+
+#if VERBOSE > SHOW_ERROR_MESSAGES
+			DEBUG(SHOW_TRACING, "memcpy %p %p %i wds %i\n",
+			      newskb->data, skb->data, skb->len, init_wds);
+#endif
+
+			newskb->dev = skb->dev;
+			dev_kfree_skb(skb);
+			skb = newskb;
+		}
+	}
+	/* display the buffer contents for debugging */
+#if VERBOSE > SHOW_ERROR_MESSAGES
+	DEBUG(SHOW_BUFFER_CONTENTS, "\ntx %p ", skb->data);
+	display_buffer((char *) skb->data, skb->len);
+#endif
+
+	/* map the skb buffer to pci memory for DMA operation */
+	pci_map_address = pci_map_single(priv->pdev,
+					 (void *) skb->data, skb->len,
+					 PCI_DMA_TODEVICE);
+	if (unlikely(pci_map_address == 0)) {
+		printk(KERN_WARNING "%s: cannot map buffer to PCI\n",
+		       ndev->name);
+
+		err = -EIO;
+		goto drop_free;
+	}
+	/* Place the fragment in the control block structure. */
+	index = curr_frag % ISL38XX_CB_TX_QSIZE;
+	fragment = &cb->tx_data_low[index];
+
+	priv->pci_map_tx_address[index] = pci_map_address;
+	/* store the skb address for future freeing  */
+	priv->data_low_tx[index] = skb;
+	/* set the proper fragment start address and size information */
+	fragment->size = cpu_to_le16(frame_size);
+	fragment->flags = cpu_to_le16(0);	/* set to 1 if more fragments */
+	fragment->address = cpu_to_le32(pci_map_address);
+	curr_frag++;
+
+	/* The fragment address in the control block must have been
+	 * written before announcing the frame buffer to device. */
+	wmb();
+	cb->driver_curr_frag[ISL38XX_CB_TX_DATA_LQ] = cpu_to_le32(curr_frag);
+
+	if (curr_frag - priv->free_data_tx + ISL38XX_MIN_QTHRESHOLD
+	    > ISL38XX_CB_TX_QSIZE) {
+		/* stop sends from upper layers */
+		netif_stop_queue(ndev);
+
+		/* set the full flag for the transmission queue */
+		priv->data_low_tx_full = 1;
+	}
+
+	/* trigger the device */
+	islpci_trigger(priv);
+
+	/* unlock the driver code */
+	spin_unlock_irqrestore(&priv->slock, flags);
+
+	/* set the transmission time */
+	ndev->trans_start = jiffies;
+	priv->statistics.tx_packets++;
+	priv->statistics.tx_bytes += skb->len;
+
+	return 0;
+
+      drop_free:
+	/* free the skbuf structure before aborting */
+	dev_kfree_skb(skb);
+	skb = NULL;
+
+	priv->statistics.tx_dropped++;
+	spin_unlock_irqrestore(&priv->slock, flags);
+	return err;
+}
+
+static inline int
+islpci_monitor_rx(islpci_private *priv, struct sk_buff **skb)
+{
+	/* The card reports full 802.11 packets but with a 20 bytes
+	 * header and without the FCS. But there a is a bit that
+	 * indicates if the packet is corrupted :-) */
+	struct rfmon_header *hdr = (struct rfmon_header *) (*skb)->data;
+	if (hdr->flags & 0x01)
+		/* This one is bad. Drop it ! */
+		return -1;
+	if (priv->ndev->type == ARPHRD_IEEE80211_PRISM) {
+		struct avs_80211_1_header *avs;
+		/* extract the relevant data from the header */
+		u32 clock = le32_to_cpu(hdr->clock);
+		u8 rate = hdr->rate;
+		u16 freq = le16_to_cpu(hdr->freq);
+		u8 rssi = hdr->rssi;
+
+		skb_pull(*skb, sizeof (struct rfmon_header));
+
+		if (skb_headroom(*skb) < sizeof (struct avs_80211_1_header)) {
+			struct sk_buff *newskb = skb_copy_expand(*skb,
+								 sizeof (struct
+									 avs_80211_1_header),
+								 0, GFP_ATOMIC);
+			if (newskb) {
+				dev_kfree_skb_irq(*skb);
+				*skb = newskb;
+			} else
+				return -1;
+			/* This behavior is not very subtile... */
+		}
+
+		/* make room for the new header and fill it. */
+		avs =
+		    (struct avs_80211_1_header *) skb_push(*skb,
+							   sizeof (struct
+								   avs_80211_1_header));
+		
+		avs->version = cpu_to_be32(P80211CAPTURE_VERSION);
+		avs->length = cpu_to_be32(sizeof (struct avs_80211_1_header));
+		avs->mactime = cpu_to_be64(le64_to_cpu(clock));
+		avs->hosttime = cpu_to_be64(jiffies);
+		avs->phytype = cpu_to_be32(6);	/*OFDM: 6 for (g), 8 for (a) */
+		avs->channel = cpu_to_be32(channel_of_freq(freq));
+		avs->datarate = cpu_to_be32(rate * 5);
+		avs->antenna = cpu_to_be32(0);	/*unknown */
+		avs->priority = cpu_to_be32(0);	/*unknown */
+		avs->ssi_type = cpu_to_be32(3);	/*2: dBm, 3: raw RSSI */
+		avs->ssi_signal = cpu_to_be32(rssi & 0x7f);
+		avs->ssi_noise = cpu_to_be32(priv->local_iwstatistics.qual.noise);	/*better than 'undefined', I assume */
+		avs->preamble = cpu_to_be32(0);	/*unknown */
+		avs->encoding = cpu_to_be32(0);	/*unknown */
+	} else
+		skb_pull(*skb, sizeof (struct rfmon_header));
+
+	(*skb)->protocol = htons(ETH_P_802_2);
+	(*skb)->mac.raw = (*skb)->data;
+	(*skb)->pkt_type = PACKET_OTHERHOST;
+
+	return 0;
+}
+
+int
+islpci_eth_receive(islpci_private *priv)
+{
+	struct net_device *ndev = priv->ndev;
+	isl38xx_control_block *control_block = priv->control_block;
+	struct sk_buff *skb;
+	u16 size;
+	u32 index, offset;
+	unsigned char *src;
+	int discard = 0;
+
+#if VERBOSE > SHOW_ERROR_MESSAGES
+	DEBUG(SHOW_FUNCTION_CALLS, "islpci_eth_receive \n");
+#endif
+
+	/* the device has written an Ethernet frame in the data area
+	 * of the sk_buff without updating the structure, do it now */
+	index = priv->free_data_rx % ISL38XX_CB_RX_QSIZE;
+	size = le16_to_cpu(control_block->rx_data_low[index].size);
+	skb = priv->data_low_rx[index];
+	offset = ((unsigned long)
+		  le32_to_cpu(control_block->rx_data_low[index].address) -
+		  (unsigned long) skb->data) & 3;
+
+#if VERBOSE > SHOW_ERROR_MESSAGES
+	DEBUG(SHOW_TRACING,
+	      "frq->addr %x skb->data %p skb->len %u offset %u truesize %u\n ",
+	      control_block->rx_data_low[priv->free_data_rx].address, skb->data,
+	      skb->len, offset, skb->truesize);
+#endif
+
+	/* delete the streaming DMA mapping before processing the skb */
+	pci_unmap_single(priv->pdev,
+			 priv->pci_map_rx_address[index],
+			 MAX_FRAGMENT_SIZE_RX + 2, PCI_DMA_FROMDEVICE);
+
+	/* update the skb structure and allign the buffer */
+	skb_put(skb, size);
+	if (offset) {
+		/* shift the buffer allocation offset bytes to get the right frame */
+		skb_pull(skb, 2);
+		skb_put(skb, 2);
+	}
+#if VERBOSE > SHOW_ERROR_MESSAGES
+	/* display the buffer contents for debugging */
+	DEBUG(SHOW_BUFFER_CONTENTS, "\nrx %p ", skb->data);
+	display_buffer((char *) skb->data, skb->len);
+#endif
+
+	/* check whether WDS is enabled and whether the data frame is a WDS frame */
+
+	if (init_wds) {
+		/* WDS enabled, check for the wds address on the first 6 bytes of the buffer */
+		src = skb->data + 6;
+		memmove(skb->data, src, skb->len - 6);
+		skb_trim(skb, skb->len - 6);
+	}
+#if VERBOSE > SHOW_ERROR_MESSAGES
+	DEBUG(SHOW_TRACING, "Fragment size %i in skb at %p\n", size, skb);
+	DEBUG(SHOW_TRACING, "Skb data at %p, length %i\n", skb->data, skb->len);
+
+	/* display the buffer contents for debugging */
+	DEBUG(SHOW_BUFFER_CONTENTS, "\nrx %p ", skb->data);
+	display_buffer((char *) skb->data, skb->len);
+#endif
+
+	/* do some additional sk_buff and network layer parameters */
+	skb->dev = ndev;
+
+	/* take care of monitor mode and spy monitoring. */
+	if (unlikely(priv->iw_mode == IW_MODE_MONITOR))
+		discard = islpci_monitor_rx(priv, &skb);
+	else {
+		if (unlikely(skb->data[2 * ETH_ALEN] == 0)) {
+			/* The packet has a rx_annex. Read it for spy monitoring, Then
+			 * remove it, while keeping the 2 leading MAC addr.
+			 */
+			struct iw_quality wstats;
+			struct rx_annex_header *annex =
+			    (struct rx_annex_header *) skb->data;
+			wstats.level = annex->rfmon.rssi;
+			/* The noise value can be a bit outdated if nobody's 
+			 * reading wireless stats... */
+			wstats.noise = priv->local_iwstatistics.qual.noise;
+			wstats.qual = wstats.level - wstats.noise;
+			wstats.updated = 0x07;
+			/* Update spy records */
+			wireless_spy_update(ndev, annex->addr2, &wstats);
+
+			memcpy(skb->data + sizeof (struct rfmon_header),
+			       skb->data, 2 * ETH_ALEN);
+			skb_pull(skb, sizeof (struct rfmon_header));
+		}
+		skb->protocol = eth_type_trans(skb, ndev);
+	}
+	skb->ip_summed = CHECKSUM_NONE;
+	priv->statistics.rx_packets++;
+	priv->statistics.rx_bytes += size;
+
+	/* deliver the skb to the network layer */
+#ifdef ISLPCI_ETH_DEBUG
+	printk
+	    ("islpci_eth_receive:netif_rx %2.2X %2.2X %2.2X %2.2X %2.2X %2.2X\n",
+	     skb->data[0], skb->data[1], skb->data[2], skb->data[3],
+	     skb->data[4], skb->data[5]);
+#endif
+	if (unlikely(discard)) {
+		dev_kfree_skb_irq(skb);
+		skb = NULL;
+	} else
+		netif_rx(skb);
+
+	/* increment the read index for the rx data low queue */
+	priv->free_data_rx++;
+
+	/* add one or more sk_buff structures */
+	while (index =
+	       le32_to_cpu(control_block->
+			   driver_curr_frag[ISL38XX_CB_RX_DATA_LQ]),
+	       index - priv->free_data_rx < ISL38XX_CB_RX_QSIZE) {
+		/* allocate an sk_buff for received data frames storage
+		 * include any required allignment operations */
+		skb = dev_alloc_skb(MAX_FRAGMENT_SIZE_RX + 2);
+		if (unlikely(skb == NULL)) {
+			/* error allocating an sk_buff structure elements */
+			DEBUG(SHOW_ERROR_MESSAGES, "Error allocating skb \n");
+			break;
+		}
+		skb_reserve(skb, (4 - (long) skb->data) & 0x03);
+		/* store the new skb structure pointer */
+		index = index % ISL38XX_CB_RX_QSIZE;
+		priv->data_low_rx[index] = skb;
+
+#if VERBOSE > SHOW_ERROR_MESSAGES
+		DEBUG(SHOW_TRACING,
+		      "new alloc skb %p skb->data %p skb->len %u index %u truesize %u\n ",
+		      skb, skb->data, skb->len, index, skb->truesize);
+#endif
+
+		/* set the streaming DMA mapping for proper PCI bus operation */
+		priv->pci_map_rx_address[index] =
+		    pci_map_single(priv->pdev, (void *) skb->data,
+				   MAX_FRAGMENT_SIZE_RX + 2,
+				   PCI_DMA_FROMDEVICE);
+		if (unlikely(priv->pci_map_rx_address[index] == (dma_addr_t) NULL)) {
+			/* error mapping the buffer to device accessable memory address */
+			DEBUG(SHOW_ERROR_MESSAGES,
+			      "Error mapping DMA address\n");
+
+			/* free the skbuf structure before aborting */
+			dev_kfree_skb_irq((struct sk_buff *) skb);
+			skb = NULL;
+			break;
+		}
+		/* update the fragment address */
+		control_block->rx_data_low[index].address = cpu_to_le32((u32)
+									priv->
+									pci_map_rx_address
+									[index]);
+		wmb();
+
+		/* increment the driver read pointer */
+		add_le32p((u32 *) &control_block->
+			  driver_curr_frag[ISL38XX_CB_RX_DATA_LQ], 1);
+	}
+
+	/* trigger the device */
+	islpci_trigger(priv);
+
+	return 0;
+}
+
+void
+islpci_do_reset_and_wake(void *data)
+{
+	islpci_private *priv = (islpci_private *) data;
+	islpci_reset(priv, 1);
+	netif_wake_queue(priv->ndev);
+	priv->reset_task_pending = 0;
+}
+
+void
+islpci_eth_tx_timeout(struct net_device *ndev)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	struct net_device_stats *statistics = &priv->statistics;
+
+	/* increment the transmit error counter */
+	statistics->tx_errors++;
+
+	printk(KERN_WARNING "%s: tx_timeout", ndev->name);
+	if (!priv->reset_task_pending) {
+		priv->reset_task_pending = 1;
+		printk(", scheduling a reset");
+		netif_stop_queue(ndev);
+		schedule_work(&priv->reset_task);
+	}
+	printk("\n");
+}
diff --git a/drivers/net/wireless/prism54/islpci_eth.h b/drivers/net/wireless/prism54/islpci_eth.h
new file mode 100644
index 0000000..bc9d7a6
--- /dev/null
+++ b/drivers/net/wireless/prism54/islpci_eth.h
@@ -0,0 +1,73 @@
+/*
+ *  
+ *  Copyright (C) 2002 Intersil Americas Inc.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+
+#ifndef _ISLPCI_ETH_H
+#define _ISLPCI_ETH_H
+
+#include "isl_38xx.h"
+#include "islpci_dev.h"
+
+struct rfmon_header {
+	u16 unk0;		/* = 0x0000 */
+	u16 length;		/* = 0x1400 */
+	u32 clock;		/* 1MHz clock */
+	u8 flags;
+	u8 unk1;
+	u8 rate;
+	u8 unk2;
+	u16 freq;
+	u16 unk3;
+	u8 rssi;
+	u8 padding[3];
+} __attribute__ ((packed));
+
+struct rx_annex_header {
+	u8 addr1[ETH_ALEN];
+	u8 addr2[ETH_ALEN];
+	struct rfmon_header rfmon;
+} __attribute__ ((packed));
+
+/* wlan-ng (and hopefully others) AVS header, version one.  Fields in
+ * network byte order. */
+#define P80211CAPTURE_VERSION 0x80211001
+
+struct avs_80211_1_header {
+	uint32_t version;
+	uint32_t length;
+	uint64_t mactime;
+	uint64_t hosttime;
+	uint32_t phytype;
+	uint32_t channel;
+	uint32_t datarate;
+	uint32_t antenna;
+	uint32_t priority;
+	uint32_t ssi_type;
+	int32_t ssi_signal;
+	int32_t ssi_noise;
+	uint32_t preamble;
+	uint32_t encoding;
+};
+
+void islpci_eth_cleanup_transmit(islpci_private *, isl38xx_control_block *);
+int islpci_eth_transmit(struct sk_buff *, struct net_device *);
+int islpci_eth_receive(islpci_private *);
+void islpci_eth_tx_timeout(struct net_device *);
+void islpci_do_reset_and_wake(void *data);
+
+#endif				/* _ISL_GEN_H */
diff --git a/drivers/net/wireless/prism54/islpci_hotplug.c b/drivers/net/wireless/prism54/islpci_hotplug.c
new file mode 100644
index 0000000..efd4d21
--- /dev/null
+++ b/drivers/net/wireless/prism54/islpci_hotplug.c
@@ -0,0 +1,339 @@
+/*
+ *  
+ *  Copyright (C) 2002 Intersil Americas Inc.
+ *  Copyright (C) 2003 Herbert Valerio Riedel <hvr@gnu.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+
+#include <linux/version.h>
+#include <linux/module.h>
+#include <linux/pci.h>
+#include <linux/delay.h>
+#include <linux/init.h> /* For __init, __exit */
+
+#include "prismcompat.h"
+#include "islpci_dev.h"
+#include "islpci_mgt.h"		/* for pc_debug */
+#include "isl_oid.h"
+
+#define DRV_NAME	"prism54"
+#define DRV_VERSION	"1.2"
+
+MODULE_AUTHOR("[Intersil] R.Bastings and W.Termorshuizen, The prism54.org Development Team <prism54-devel@prism54.org>");
+MODULE_DESCRIPTION("The Prism54 802.11 Wireless LAN adapter");
+MODULE_LICENSE("GPL");
+
+static int	init_pcitm = 0;
+module_param(init_pcitm, int, 0);
+
+/* In this order: vendor, device, subvendor, subdevice, class, class_mask,
+ * driver_data 
+ * If you have an update for this please contact prism54-devel@prism54.org 
+ * The latest list can be found at http://prism54.org/supported_cards.php */
+static const struct pci_device_id prism54_id_tbl[] = {
+	/* Intersil PRISM Duette/Prism GT Wireless LAN adapter */
+	{
+	 0x1260, 0x3890,
+	 PCI_ANY_ID, PCI_ANY_ID,
+	 0, 0, 0
+	},
+
+	/* 3COM 3CRWE154G72 Wireless LAN adapter */
+	{
+	 0x10b7, 0x6001,
+	 PCI_ANY_ID, PCI_ANY_ID,
+	 0, 0, 0
+	},
+
+	/* Intersil PRISM Indigo Wireless LAN adapter */
+	{
+	 0x1260, 0x3877,
+	 PCI_ANY_ID, PCI_ANY_ID,
+	 0, 0, 0
+	},
+
+	/* Intersil PRISM Javelin/Xbow Wireless LAN adapter */
+	{
+	 0x1260, 0x3886,
+	 PCI_ANY_ID, PCI_ANY_ID,
+	 0, 0, 0
+	},
+
+	/* End of list */
+	{0,0,0,0,0,0,0}
+};
+
+/* register the device with the Hotplug facilities of the kernel */
+MODULE_DEVICE_TABLE(pci, prism54_id_tbl);
+
+static int prism54_probe(struct pci_dev *, const struct pci_device_id *);
+static void prism54_remove(struct pci_dev *);
+static int prism54_suspend(struct pci_dev *, u32 state);
+static int prism54_resume(struct pci_dev *);
+
+static struct pci_driver prism54_driver = {
+	.name = DRV_NAME,
+	.id_table = prism54_id_tbl,
+	.probe = prism54_probe,
+	.remove = prism54_remove,
+	.suspend = prism54_suspend,
+	.resume = prism54_resume,
+	/* .enable_wake ; we don't support this yet */
+};
+
+/******************************************************************************
+    Module initialization functions
+******************************************************************************/
+
+int
+prism54_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+{
+	struct net_device *ndev;
+	u8 latency_tmr;
+	u32 mem_addr;
+	islpci_private *priv;
+	int rvalue;
+
+	/* Enable the pci device */
+	if (pci_enable_device(pdev)) {
+		printk(KERN_ERR "%s: pci_enable_device() failed.\n", DRV_NAME);
+		return -ENODEV;
+	}
+
+	/* check whether the latency timer is set correctly */
+	pci_read_config_byte(pdev, PCI_LATENCY_TIMER, &latency_tmr);
+#if VERBOSE > SHOW_ERROR_MESSAGES
+	DEBUG(SHOW_TRACING, "latency timer: %x\n", latency_tmr);
+#endif
+	if (latency_tmr < PCIDEVICE_LATENCY_TIMER_MIN) {
+		/* set the latency timer */
+		pci_write_config_byte(pdev, PCI_LATENCY_TIMER,
+				      PCIDEVICE_LATENCY_TIMER_VAL);
+	}
+
+	/* enable PCI DMA */
+	if (pci_set_dma_mask(pdev, 0xffffffff)) {
+		printk(KERN_ERR "%s: 32-bit PCI DMA not supported", DRV_NAME);
+		goto do_pci_disable_device;
+        }
+
+	/* 0x40 is the programmable timer to configure the response timeout (TRDY_TIMEOUT)
+	 * 0x41 is the programmable timer to configure the retry timeout (RETRY_TIMEOUT)
+	 * 	The RETRY_TIMEOUT is used to set the number of retries that the core, as a
+	 * 	Master, will perform before abandoning a cycle. The default value for
+	 * 	RETRY_TIMEOUT is 0x80, which far exceeds the PCI 2.1 requirement for new
+	 * 	devices. A write of zero to the RETRY_TIMEOUT register disables this
+	 * 	function to allow use with any non-compliant legacy devices that may
+	 * 	execute more retries.
+	 *
+	 * 	Writing zero to both these two registers will disable both timeouts and
+	 * 	*can* solve problems caused by devices that are slow to respond.
+	 *	Make this configurable - MSW
+	 */
+	if ( init_pcitm >= 0 ) {
+		pci_write_config_byte(pdev, 0x40, (u8)init_pcitm);
+		pci_write_config_byte(pdev, 0x41, (u8)init_pcitm);
+	} else {
+		printk(KERN_INFO "PCI TRDY/RETRY unchanged\n");
+	}
+
+	/* request the pci device I/O regions */
+	rvalue = pci_request_regions(pdev, DRV_NAME);
+	if (rvalue) {
+		printk(KERN_ERR "%s: pci_request_regions failure (rc=%d)\n",
+		       DRV_NAME, rvalue);
+		goto do_pci_disable_device;
+	}
+
+	/* check if the memory window is indeed set */
+	rvalue = pci_read_config_dword(pdev, PCI_BASE_ADDRESS_0, &mem_addr);
+	if (rvalue || !mem_addr) {
+		printk(KERN_ERR "%s: PCI device memory region not configured; fix your BIOS or CardBus bridge/drivers\n",
+		       DRV_NAME);
+		goto do_pci_release_regions;
+	}
+
+	/* enable PCI bus-mastering */
+	DEBUG(SHOW_TRACING, "%s: pci_set_master(pdev)\n", DRV_NAME);
+	pci_set_master(pdev);
+
+	/* enable MWI */
+	pci_set_mwi(pdev);
+
+	/* setup the network device interface and its structure */
+	if (!(ndev = islpci_setup(pdev))) {
+		/* error configuring the driver as a network device */
+		printk(KERN_ERR "%s: could not configure network device\n",
+		       DRV_NAME);
+		goto do_pci_release_regions;
+	}
+
+	priv = netdev_priv(ndev);
+	islpci_set_state(priv, PRV_STATE_PREBOOT); /* we are attempting to boot */
+
+	/* card is in unknown state yet, might have some interrupts pending */
+	isl38xx_disable_interrupts(priv->device_base);
+
+	/* request for the interrupt before uploading the firmware */
+	rvalue = request_irq(pdev->irq, &islpci_interrupt,
+			     SA_SHIRQ, ndev->name, priv);
+
+	if (rvalue) {
+		/* error, could not hook the handler to the irq */
+		printk(KERN_ERR "%s: could not install IRQ handler\n",
+		       ndev->name);
+		goto do_unregister_netdev;
+	}
+
+	/* firmware upload is triggered in islpci_open */
+
+	return 0;
+
+      do_unregister_netdev:
+	unregister_netdev(ndev);
+	islpci_free_memory(priv);
+	pci_set_drvdata(pdev, NULL);
+	free_netdev(ndev);
+	priv = NULL;
+      do_pci_release_regions:
+	pci_release_regions(pdev);
+      do_pci_disable_device:
+	pci_disable_device(pdev);
+	return -EIO;
+}
+
+/* set by cleanup_module */
+static volatile int __in_cleanup_module = 0;
+
+/* this one removes one(!!) instance only */
+void
+prism54_remove(struct pci_dev *pdev)
+{
+	struct net_device *ndev = pci_get_drvdata(pdev);
+	islpci_private *priv = ndev ? netdev_priv(ndev) : NULL;
+	BUG_ON(!priv);
+
+	if (!__in_cleanup_module) {
+		printk(KERN_DEBUG "%s: hot unplug detected\n", ndev->name);
+		islpci_set_state(priv, PRV_STATE_OFF);
+	}
+
+	printk(KERN_DEBUG "%s: removing device\n", ndev->name);
+
+	unregister_netdev(ndev);
+
+	/* free the interrupt request */
+
+	if (islpci_get_state(priv) != PRV_STATE_OFF) {
+		isl38xx_disable_interrupts(priv->device_base);
+		islpci_set_state(priv, PRV_STATE_OFF);
+		/* This bellow causes a lockup at rmmod time. It might be
+		 * because some interrupts still linger after rmmod time, 
+		 * see bug #17 */
+		/* pci_set_power_state(pdev, 3);*/	/* try to power-off */
+	}
+
+	free_irq(pdev->irq, priv);
+
+	/* free the PCI memory and unmap the remapped page */
+	islpci_free_memory(priv);
+
+	pci_set_drvdata(pdev, NULL);
+	free_netdev(ndev);
+	priv = NULL;
+
+	pci_release_regions(pdev);
+
+	pci_disable_device(pdev);
+}
+
+int
+prism54_suspend(struct pci_dev *pdev, u32 state)
+{
+	struct net_device *ndev = pci_get_drvdata(pdev);
+	islpci_private *priv = ndev ? netdev_priv(ndev) : NULL;
+	BUG_ON(!priv);
+
+	printk(KERN_NOTICE "%s: got suspend request (state %d)\n",
+	       ndev->name, state);
+
+	pci_save_state(pdev);
+
+	/* tell the device not to trigger interrupts for now... */
+	isl38xx_disable_interrupts(priv->device_base);
+
+	/* from now on assume the hardware was already powered down
+	   and don't touch it anymore */
+	islpci_set_state(priv, PRV_STATE_OFF);
+
+	netif_stop_queue(ndev);
+	netif_device_detach(ndev);
+
+	return 0;
+}
+
+int
+prism54_resume(struct pci_dev *pdev)
+{
+	struct net_device *ndev = pci_get_drvdata(pdev);
+	islpci_private *priv = ndev ? netdev_priv(ndev) : NULL;
+	BUG_ON(!priv);
+
+	pci_enable_device(pdev);
+
+	printk(KERN_NOTICE "%s: got resume request\n", ndev->name);
+
+	pci_restore_state(pdev);
+
+	/* alright let's go into the PREBOOT state */
+	islpci_reset(priv, 1);
+
+	netif_device_attach(ndev);
+	netif_start_queue(ndev);
+
+	return 0;
+}
+
+static int __init
+prism54_module_init(void)
+{
+	printk(KERN_INFO "Loaded %s driver, version %s\n",
+	       DRV_NAME, DRV_VERSION);
+
+	__bug_on_wrong_struct_sizes ();
+
+	return pci_module_init(&prism54_driver);
+}
+
+/* by the time prism54_module_exit() terminates, as a postcondition
+ * all instances will have been destroyed by calls to
+ * prism54_remove() */
+static void __exit
+prism54_module_exit(void)
+{
+	__in_cleanup_module = 1;
+
+	pci_unregister_driver(&prism54_driver);
+
+	printk(KERN_INFO "Unloaded %s driver\n", DRV_NAME);
+
+	__in_cleanup_module = 0;
+}
+
+/* register entry points */
+module_init(prism54_module_init);
+module_exit(prism54_module_exit);
+/* EOF */
diff --git a/drivers/net/wireless/prism54/islpci_mgt.c b/drivers/net/wireless/prism54/islpci_mgt.c
new file mode 100644
index 0000000..b6f2e5a
--- /dev/null
+++ b/drivers/net/wireless/prism54/islpci_mgt.c
@@ -0,0 +1,513 @@
+/*
+ *  
+ *  Copyright (C) 2002 Intersil Americas Inc.
+ *  Copyright 2004 Jens Maurer <Jens.Maurer@gmx.net>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+
+#include <linux/config.h>
+#include <linux/netdevice.h>
+#include <linux/module.h>
+#include <linux/pci.h>
+
+#include <asm/io.h>
+#include <asm/system.h>
+#include <linux/if_arp.h>
+
+#include "prismcompat.h"
+#include "isl_38xx.h"
+#include "islpci_mgt.h"
+#include "isl_oid.h"		/* additional types and defs for isl38xx fw */
+#include "isl_ioctl.h"
+
+#include <net/iw_handler.h>
+
+/******************************************************************************
+        Global variable definition section
+******************************************************************************/
+int pc_debug = VERBOSE;
+module_param(pc_debug, int, 0);
+
+/******************************************************************************
+    Driver general functions
+******************************************************************************/
+#if VERBOSE > SHOW_ERROR_MESSAGES
+void
+display_buffer(char *buffer, int length)
+{
+	if ((pc_debug & SHOW_BUFFER_CONTENTS) == 0)
+		return;
+
+	while (length > 0) {
+		printk("[%02x]", *buffer & 255);
+		length--;
+		buffer++;
+	}
+
+	printk("\n");
+}
+#endif
+
+/*****************************************************************************
+    Queue handling for management frames
+******************************************************************************/
+
+/*
+ * Helper function to create a PIMFOR management frame header.
+ */
+static void
+pimfor_encode_header(int operation, u32 oid, u32 length, pimfor_header_t *h)
+{
+	h->version = PIMFOR_VERSION;
+	h->operation = operation;
+	h->device_id = PIMFOR_DEV_ID_MHLI_MIB;
+	h->flags = 0;
+	h->oid = cpu_to_be32(oid);
+	h->length = cpu_to_be32(length);
+}
+
+/*
+ * Helper function to analyze a PIMFOR management frame header.
+ */
+static pimfor_header_t *
+pimfor_decode_header(void *data, int len)
+{
+	pimfor_header_t *h = data;
+
+	while ((void *) h < data + len) {
+		if (h->flags & PIMFOR_FLAG_LITTLE_ENDIAN) {
+			le32_to_cpus(&h->oid);
+			le32_to_cpus(&h->length);
+		} else {
+			be32_to_cpus(&h->oid);
+			be32_to_cpus(&h->length);
+		}
+		if (h->oid != OID_INL_TUNNEL)
+			return h;
+		h++;
+	}
+	return NULL;
+}
+
+/*
+ * Fill the receive queue for management frames with fresh buffers.
+ */
+int
+islpci_mgmt_rx_fill(struct net_device *ndev)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	isl38xx_control_block *cb =	/* volatile not needed */
+	    (isl38xx_control_block *) priv->control_block;
+	u32 curr = le32_to_cpu(cb->driver_curr_frag[ISL38XX_CB_RX_MGMTQ]);
+
+#if VERBOSE > SHOW_ERROR_MESSAGES
+	DEBUG(SHOW_FUNCTION_CALLS, "islpci_mgmt_rx_fill \n");
+#endif
+
+	while (curr - priv->index_mgmt_rx < ISL38XX_CB_MGMT_QSIZE) {
+		u32 index = curr % ISL38XX_CB_MGMT_QSIZE;
+		struct islpci_membuf *buf = &priv->mgmt_rx[index];
+		isl38xx_fragment *frag = &cb->rx_data_mgmt[index];
+
+		if (buf->mem == NULL) {
+			buf->mem = kmalloc(MGMT_FRAME_SIZE, GFP_ATOMIC);
+			if (!buf->mem) {
+				printk(KERN_WARNING
+				       "Error allocating management frame.\n");
+				return -ENOMEM;
+			}
+			buf->size = MGMT_FRAME_SIZE;
+		}
+		if (buf->pci_addr == 0) {
+			buf->pci_addr = pci_map_single(priv->pdev, buf->mem,
+						       MGMT_FRAME_SIZE,
+						       PCI_DMA_FROMDEVICE);
+			if (!buf->pci_addr) {
+				printk(KERN_WARNING
+				       "Failed to make memory DMA'able\n.");
+				return -ENOMEM;
+			}
+		}
+
+		/* be safe: always reset control block information */
+		frag->size = cpu_to_le16(MGMT_FRAME_SIZE);
+		frag->flags = 0;
+		frag->address = cpu_to_le32(buf->pci_addr);
+		curr++;
+
+		/* The fragment address in the control block must have
+		 * been written before announcing the frame buffer to
+		 * device */
+		wmb();
+		cb->driver_curr_frag[ISL38XX_CB_RX_MGMTQ] = cpu_to_le32(curr);
+	}
+	return 0;
+}
+
+/*
+ * Create and transmit a management frame using "operation" and "oid",
+ * with arguments data/length.
+ * We either return an error and free the frame, or we return 0 and
+ * islpci_mgt_cleanup_transmit() frees the frame in the tx-done
+ * interrupt.
+ */
+static int
+islpci_mgt_transmit(struct net_device *ndev, int operation, unsigned long oid,
+		    void *data, int length)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	isl38xx_control_block *cb =
+	    (isl38xx_control_block *) priv->control_block;
+	void *p;
+	int err = -EINVAL;
+	unsigned long flags;
+	isl38xx_fragment *frag;
+	struct islpci_membuf buf;
+	u32 curr_frag;
+	int index;
+	int frag_len = length + PIMFOR_HEADER_SIZE;
+
+#if VERBOSE > SHOW_ERROR_MESSAGES
+	DEBUG(SHOW_FUNCTION_CALLS, "islpci_mgt_transmit\n");
+#endif
+
+	if (frag_len > MGMT_FRAME_SIZE) {
+		printk(KERN_DEBUG "%s: mgmt frame too large %d\n",
+		       ndev->name, frag_len);
+		goto error;
+	}
+
+	err = -ENOMEM;
+	p = buf.mem = kmalloc(frag_len, GFP_KERNEL);
+	if (!buf.mem) {
+		printk(KERN_DEBUG "%s: cannot allocate mgmt frame\n",
+		       ndev->name);
+		goto error;
+	}
+	buf.size = frag_len;
+
+	/* create the header directly in the fragment data area */
+	pimfor_encode_header(operation, oid, length, (pimfor_header_t *) p);
+	p += PIMFOR_HEADER_SIZE;
+
+	if (data)
+		memcpy(p, data, length);
+	else
+		memset(p, 0, length);
+
+#if VERBOSE > SHOW_ERROR_MESSAGES
+	{
+		pimfor_header_t *h = buf.mem;
+		DEBUG(SHOW_PIMFOR_FRAMES,
+		      "PIMFOR: op %i, oid 0x%08lx, device %i, flags 0x%x length 0x%x \n",
+		      h->operation, oid, h->device_id, h->flags, length);
+
+		/* display the buffer contents for debugging */
+		display_buffer((char *) h, sizeof (pimfor_header_t));
+		display_buffer(p, length);
+	}
+#endif
+
+	err = -ENOMEM;
+	buf.pci_addr = pci_map_single(priv->pdev, buf.mem, frag_len,
+				      PCI_DMA_TODEVICE);
+	if (!buf.pci_addr) {
+		printk(KERN_WARNING "%s: cannot map PCI memory for mgmt\n",
+		       ndev->name);
+		goto error_free;
+	}
+
+	/* Protect the control block modifications against interrupts. */
+	spin_lock_irqsave(&priv->slock, flags);
+	curr_frag = le32_to_cpu(cb->driver_curr_frag[ISL38XX_CB_TX_MGMTQ]);
+	if (curr_frag - priv->index_mgmt_tx >= ISL38XX_CB_MGMT_QSIZE) {
+		printk(KERN_WARNING "%s: mgmt tx queue is still full\n",
+		       ndev->name);
+		goto error_unlock;
+	}
+
+	/* commit the frame to the tx device queue */
+	index = curr_frag % ISL38XX_CB_MGMT_QSIZE;
+	priv->mgmt_tx[index] = buf;
+	frag = &cb->tx_data_mgmt[index];
+	frag->size = cpu_to_le16(frag_len);
+	frag->flags = 0;	/* for any other than the last fragment, set to 1 */
+	frag->address = cpu_to_le32(buf.pci_addr);
+
+	/* The fragment address in the control block must have
+	 * been written before announcing the frame buffer to
+	 * device */
+	wmb();
+	cb->driver_curr_frag[ISL38XX_CB_TX_MGMTQ] = cpu_to_le32(curr_frag + 1);
+	spin_unlock_irqrestore(&priv->slock, flags);
+
+	/* trigger the device */
+	islpci_trigger(priv);
+	return 0;
+
+      error_unlock:
+	spin_unlock_irqrestore(&priv->slock, flags);
+      error_free:
+	kfree(buf.mem);
+      error:
+	return err;
+}
+
+/*
+ * Receive a management frame from the device.
+ * This can be an arbitrary number of traps, and at most one response
+ * frame for a previous request sent via islpci_mgt_transmit().
+ */
+int
+islpci_mgt_receive(struct net_device *ndev)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	isl38xx_control_block *cb =
+	    (isl38xx_control_block *) priv->control_block;
+	u32 curr_frag;
+
+#if VERBOSE > SHOW_ERROR_MESSAGES
+	DEBUG(SHOW_FUNCTION_CALLS, "islpci_mgt_receive \n");
+#endif
+
+	/* Only once per interrupt, determine fragment range to
+	 * process.  This avoids an endless loop (i.e. lockup) if
+	 * frames come in faster than we can process them. */
+	curr_frag = le32_to_cpu(cb->device_curr_frag[ISL38XX_CB_RX_MGMTQ]);
+	barrier();
+
+	for (; priv->index_mgmt_rx < curr_frag; priv->index_mgmt_rx++) {
+		pimfor_header_t *header;
+		u32 index = priv->index_mgmt_rx % ISL38XX_CB_MGMT_QSIZE;
+		struct islpci_membuf *buf = &priv->mgmt_rx[index];
+		u16 frag_len;
+		int size;
+		struct islpci_mgmtframe *frame;
+
+		/* I have no idea (and no documentation) if flags != 0
+		 * is possible.  Drop the frame, reuse the buffer. */
+		if (le16_to_cpu(cb->rx_data_mgmt[index].flags) != 0) {
+			printk(KERN_WARNING "%s: unknown flags 0x%04x\n",
+			       ndev->name,
+			       le16_to_cpu(cb->rx_data_mgmt[index].flags));
+			continue;
+		}
+
+		/* The device only returns the size of the header(s) here. */
+		frag_len = le16_to_cpu(cb->rx_data_mgmt[index].size);
+
+		/*
+		 * We appear to have no way to tell the device the
+		 * size of a receive buffer.  Thus, if this check
+		 * triggers, we likely have kernel heap corruption. */
+		if (frag_len > MGMT_FRAME_SIZE) {
+			printk(KERN_WARNING
+				"%s: Bogus packet size of %d (%#x).\n",
+				ndev->name, frag_len, frag_len);
+			frag_len = MGMT_FRAME_SIZE;
+		}
+
+		/* Ensure the results of device DMA are visible to the CPU. */
+		pci_dma_sync_single_for_cpu(priv->pdev, buf->pci_addr,
+					    buf->size, PCI_DMA_FROMDEVICE);
+
+		/* Perform endianess conversion for PIMFOR header in-place. */
+		header = pimfor_decode_header(buf->mem, frag_len);
+		if (!header) {
+			printk(KERN_WARNING "%s: no PIMFOR header found\n",
+			       ndev->name);
+			continue;
+		}
+
+		/* The device ID from the PIMFOR packet received from
+		 * the MVC is always 0.  We forward a sensible device_id.
+		 * Not that anyone upstream would care... */
+		header->device_id = priv->ndev->ifindex;
+
+#if VERBOSE > SHOW_ERROR_MESSAGES
+		DEBUG(SHOW_PIMFOR_FRAMES,
+		      "PIMFOR: op %i, oid 0x%08x, device %i, flags 0x%x length 0x%x \n",
+		      header->operation, header->oid, header->device_id,
+		      header->flags, header->length);
+
+		/* display the buffer contents for debugging */
+		display_buffer((char *) header, PIMFOR_HEADER_SIZE);
+		display_buffer((char *) header + PIMFOR_HEADER_SIZE,
+			       header->length);
+#endif
+
+		/* nobody sends these */
+		if (header->flags & PIMFOR_FLAG_APPLIC_ORIGIN) {
+			printk(KERN_DEBUG
+			       "%s: errant PIMFOR application frame\n",
+			       ndev->name);
+			continue;
+		}
+
+		/* Determine frame size, skipping OID_INL_TUNNEL headers. */
+		size = PIMFOR_HEADER_SIZE + header->length;
+		frame = kmalloc(sizeof (struct islpci_mgmtframe) + size,
+				GFP_ATOMIC);
+		if (!frame) {
+			printk(KERN_WARNING
+			       "%s: Out of memory, cannot handle oid 0x%08x\n",
+			       ndev->name, header->oid);
+			continue;
+		}
+		frame->ndev = ndev;
+		memcpy(&frame->buf, header, size);
+		frame->header = (pimfor_header_t *) frame->buf;
+		frame->data = frame->buf + PIMFOR_HEADER_SIZE;
+
+#if VERBOSE > SHOW_ERROR_MESSAGES
+		DEBUG(SHOW_PIMFOR_FRAMES,
+		      "frame: header: %p, data: %p, size: %d\n",
+		      frame->header, frame->data, size);
+#endif
+
+		if (header->operation == PIMFOR_OP_TRAP) {
+#if VERBOSE > SHOW_ERROR_MESSAGES
+			printk(KERN_DEBUG
+			       "TRAP: oid 0x%x, device %i, flags 0x%x length %i\n",
+			       header->oid, header->device_id, header->flags,
+			       header->length);
+#endif
+
+			/* Create work to handle trap out of interrupt
+			 * context. */
+			INIT_WORK(&frame->ws, prism54_process_trap, frame);
+			schedule_work(&frame->ws);
+
+		} else {
+			/* Signal the one waiting process that a response
+			 * has been received. */
+			if ((frame = xchg(&priv->mgmt_received, frame)) != NULL) {
+				printk(KERN_WARNING
+				       "%s: mgmt response not collected\n",
+				       ndev->name);
+				kfree(frame);
+			}
+#if VERBOSE > SHOW_ERROR_MESSAGES
+			DEBUG(SHOW_TRACING, "Wake up Mgmt Queue\n");
+#endif
+			wake_up(&priv->mgmt_wqueue);
+		}
+
+	}
+
+	return 0;
+}
+
+/*
+ * Cleanup the transmit queue by freeing all frames handled by the device.
+ */
+void
+islpci_mgt_cleanup_transmit(struct net_device *ndev)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	isl38xx_control_block *cb =	/* volatile not needed */
+	    (isl38xx_control_block *) priv->control_block;
+	u32 curr_frag;
+
+#if VERBOSE > SHOW_ERROR_MESSAGES
+	DEBUG(SHOW_FUNCTION_CALLS, "islpci_mgt_cleanup_transmit\n");
+#endif
+
+	/* Only once per cleanup, determine fragment range to
+	 * process.  This avoids an endless loop (i.e. lockup) if
+	 * the device became confused, incrementing device_curr_frag
+	 * rapidly. */
+	curr_frag = le32_to_cpu(cb->device_curr_frag[ISL38XX_CB_TX_MGMTQ]);
+	barrier();
+
+	for (; priv->index_mgmt_tx < curr_frag; priv->index_mgmt_tx++) {
+		int index = priv->index_mgmt_tx % ISL38XX_CB_MGMT_QSIZE;
+		struct islpci_membuf *buf = &priv->mgmt_tx[index];
+		pci_unmap_single(priv->pdev, buf->pci_addr, buf->size,
+				 PCI_DMA_TODEVICE);
+		buf->pci_addr = 0;
+		kfree(buf->mem);
+		buf->mem = NULL;
+		buf->size = 0;
+	}
+}
+
+/*
+ * Perform one request-response transaction to the device.
+ */
+int
+islpci_mgt_transaction(struct net_device *ndev,
+		       int operation, unsigned long oid,
+		       void *senddata, int sendlen,
+		       struct islpci_mgmtframe **recvframe)
+{
+	islpci_private *priv = netdev_priv(ndev);
+	const long wait_cycle_jiffies = (ISL38XX_WAIT_CYCLE * 10 * HZ) / 1000;
+	long timeout_left = ISL38XX_MAX_WAIT_CYCLES * wait_cycle_jiffies;
+	int err;
+	DEFINE_WAIT(wait);
+
+	*recvframe = NULL;
+
+	if (down_interruptible(&priv->mgmt_sem))
+		return -ERESTARTSYS;
+
+	prepare_to_wait(&priv->mgmt_wqueue, &wait, TASK_UNINTERRUPTIBLE);
+	err = islpci_mgt_transmit(ndev, operation, oid, senddata, sendlen);
+	if (err)
+		goto out;
+
+	err = -ETIMEDOUT;
+	while (timeout_left > 0) {
+		int timeleft;
+		struct islpci_mgmtframe *frame;
+
+		set_current_state(TASK_UNINTERRUPTIBLE);
+		timeleft = schedule_timeout(wait_cycle_jiffies);
+		frame = xchg(&priv->mgmt_received, NULL);
+		if (frame) {
+			if (frame->header->oid == oid) {
+				*recvframe = frame;
+				err = 0;
+				goto out;
+			} else {
+				printk(KERN_DEBUG
+				       "%s: expecting oid 0x%x, received 0x%x.\n",
+				       ndev->name, (unsigned int) oid,
+				       frame->header->oid);
+				kfree(frame);
+				frame = NULL;
+			}
+		}
+		if (timeleft == 0) {
+			printk(KERN_DEBUG
+				"%s: timeout waiting for mgmt response %lu, "
+				"triggering device\n",
+				ndev->name, timeout_left);
+			islpci_trigger(priv);
+		}
+		timeout_left += timeleft - wait_cycle_jiffies;
+	}
+	printk(KERN_WARNING "%s: timeout waiting for mgmt response\n",
+	       ndev->name);
+
+	/* TODO: we should reset the device here */     
+ out:
+	finish_wait(&priv->mgmt_wqueue, &wait);
+	up(&priv->mgmt_sem);
+	return err;
+}
+
diff --git a/drivers/net/wireless/prism54/islpci_mgt.h b/drivers/net/wireless/prism54/islpci_mgt.h
new file mode 100644
index 0000000..2982be3
--- /dev/null
+++ b/drivers/net/wireless/prism54/islpci_mgt.h
@@ -0,0 +1,145 @@
+/*
+ *  
+ *  Copyright (C) 2002 Intersil Americas Inc.
+ *  Copyright (C) 2003 Luis R. Rodriguez <mcgrof@ruslug.rutgers.edu>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+
+#ifndef _ISLPCI_MGT_H
+#define _ISLPCI_MGT_H
+
+#include <linux/wireless.h>
+#include <linux/skbuff.h>
+
+/*
+ *  Function definitions
+ */
+
+#define K_DEBUG(f, m, args...) do { if(f & m) printk(KERN_DEBUG args); } while(0)
+#define DEBUG(f, args...) K_DEBUG(f, pc_debug, args)
+
+extern int pc_debug;
+#define init_wds 0	/* help compiler optimize away dead code */
+
+
+/* General driver definitions */
+#define PCIDEVICE_LATENCY_TIMER_MIN 		0x40
+#define PCIDEVICE_LATENCY_TIMER_VAL 		0x50
+
+/* Debugging verbose definitions */
+#define SHOW_NOTHING                            0x00	/* overrules everything */
+#define SHOW_ANYTHING                           0xFF
+#define SHOW_ERROR_MESSAGES                     0x01
+#define SHOW_TRAPS                              0x02
+#define SHOW_FUNCTION_CALLS                     0x04
+#define SHOW_TRACING                            0x08
+#define SHOW_QUEUE_INDEXES                      0x10
+#define SHOW_PIMFOR_FRAMES                      0x20
+#define SHOW_BUFFER_CONTENTS                    0x40
+#define VERBOSE                                 0x01
+
+/* Default card definitions */
+#define CARD_DEFAULT_CHANNEL                    6
+#define CARD_DEFAULT_MODE                       INL_MODE_CLIENT
+#define CARD_DEFAULT_IW_MODE			IW_MODE_INFRA
+#define CARD_DEFAULT_BSSTYPE                    DOT11_BSSTYPE_INFRA
+#define CARD_DEFAULT_CLIENT_SSID		""
+#define CARD_DEFAULT_AP_SSID			"default"
+#define CARD_DEFAULT_KEY1                       "default_key_1"
+#define CARD_DEFAULT_KEY2                       "default_key_2"
+#define CARD_DEFAULT_KEY3                       "default_key_3"
+#define CARD_DEFAULT_KEY4                       "default_key_4"
+#define CARD_DEFAULT_WEP                        0
+#define CARD_DEFAULT_FILTER                     0
+#define CARD_DEFAULT_WDS                        0
+#define	CARD_DEFAULT_AUTHEN                     DOT11_AUTH_OS
+#define	CARD_DEFAULT_DOT1X			0
+#define CARD_DEFAULT_MLME_MODE			DOT11_MLME_AUTO
+#define CARD_DEFAULT_CONFORMANCE                OID_INL_CONFORMANCE_NONE
+#define CARD_DEFAULT_PROFILE			DOT11_PROFILE_MIXED_G_WIFI
+#define CARD_DEFAULT_MAXFRAMEBURST		DOT11_MAXFRAMEBURST_MIXED_SAFE
+
+/* PIMFOR package definitions */
+#define PIMFOR_ETHERTYPE                        0x8828
+#define PIMFOR_HEADER_SIZE                      12
+#define PIMFOR_VERSION                          1
+#define PIMFOR_OP_GET                           0
+#define PIMFOR_OP_SET                           1
+#define PIMFOR_OP_RESPONSE                      2
+#define PIMFOR_OP_ERROR                         3
+#define PIMFOR_OP_TRAP                          4
+#define PIMFOR_OP_RESERVED                      5	/* till 255 */
+#define PIMFOR_DEV_ID_MHLI_MIB                  0
+#define PIMFOR_FLAG_APPLIC_ORIGIN               0x01
+#define PIMFOR_FLAG_LITTLE_ENDIAN               0x02
+
+static inline void
+add_le32p(u32 * le_number, u32 add)
+{
+	*le_number = cpu_to_le32(le32_to_cpup(le_number) + add);
+}
+
+void display_buffer(char *, int);
+
+/*
+ *  Type definition section
+ *
+ *  the structure defines only the header allowing copyless
+ *  frame handling
+ */
+typedef struct {
+	u8 version;
+	u8 operation;
+	u32 oid;
+	u8 device_id;
+	u8 flags;
+	u32 length;
+} __attribute__ ((packed))
+pimfor_header_t;
+
+/* A received and interrupt-processed management frame, either for
+ * schedule_work(prism54_process_trap) or for priv->mgmt_received,
+ * processed by islpci_mgt_transaction(). */
+struct islpci_mgmtframe {
+	struct net_device *ndev;      /* pointer to network device */
+	pimfor_header_t *header;      /* payload header, points into buf */
+	void *data;		      /* payload ex header, points into buf */
+        struct work_struct ws;	      /* argument for schedule_work() */
+	char buf[0];		      /* fragment buffer */
+};
+
+int
+islpci_mgt_receive(struct net_device *ndev);
+
+int
+islpci_mgmt_rx_fill(struct net_device *ndev);
+
+void
+islpci_mgt_cleanup_transmit(struct net_device *ndev);
+
+int
+islpci_mgt_transaction(struct net_device *ndev,
+                       int operation, unsigned long oid,
+		       void *senddata, int sendlen,
+		       struct islpci_mgmtframe **recvframe);
+
+static inline void
+islpci_mgt_release(struct islpci_mgmtframe *frame)
+{
+        kfree(frame);
+}
+
+#endif				/* _ISLPCI_MGT_H */
diff --git a/drivers/net/wireless/prism54/oid_mgt.c b/drivers/net/wireless/prism54/oid_mgt.c
new file mode 100644
index 0000000..12123e2
--- /dev/null
+++ b/drivers/net/wireless/prism54/oid_mgt.c
@@ -0,0 +1,907 @@
+/*   
+ *  Copyright (C) 2003,2004 Aurelien Alleaume <slts@free.fr>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+
+#include "prismcompat.h"
+#include "islpci_dev.h"
+#include "islpci_mgt.h"
+#include "isl_oid.h"
+#include "oid_mgt.h"
+#include "isl_ioctl.h"
+
+/* to convert between channel and freq */
+static const int frequency_list_bg[] = { 2412, 2417, 2422, 2427, 2432,
+	2437, 2442, 2447, 2452, 2457, 2462, 2467, 2472, 2484
+};
+
+int
+channel_of_freq(int f)
+{
+	int c = 0;
+
+	if ((f >= 2412) && (f <= 2484)) {
+		while ((c < 14) && (f != frequency_list_bg[c]))
+			c++;
+		return (c >= 14) ? 0 : ++c;
+	} else if ((f >= (int) 5000) && (f <= (int) 6000)) {
+		return ( (f - 5000) / 5 );
+	} else
+		return 0;
+}
+
+#define OID_STRUCT(name,oid,s,t) [name] = {oid, 0, sizeof(s), t}
+#define OID_STRUCT_C(name,oid,s,t) OID_STRUCT(name,oid,s,t | OID_FLAG_CACHED)
+#define OID_U32(name,oid) OID_STRUCT(name,oid,u32,OID_TYPE_U32)
+#define OID_U32_C(name,oid) OID_STRUCT_C(name,oid,u32,OID_TYPE_U32)
+#define OID_STRUCT_MLME(name,oid) OID_STRUCT(name,oid,struct obj_mlme,OID_TYPE_MLME)
+#define OID_STRUCT_MLMEEX(name,oid) OID_STRUCT(name,oid,struct obj_mlmeex,OID_TYPE_MLMEEX)
+
+#define OID_UNKNOWN(name,oid) OID_STRUCT(name,oid,0,0)
+
+struct oid_t isl_oid[] = {
+	OID_STRUCT(GEN_OID_MACADDRESS, 0x00000000, u8[6], OID_TYPE_ADDR),
+	OID_U32(GEN_OID_LINKSTATE, 0x00000001),
+	OID_UNKNOWN(GEN_OID_WATCHDOG, 0x00000002),
+	OID_UNKNOWN(GEN_OID_MIBOP, 0x00000003),
+	OID_UNKNOWN(GEN_OID_OPTIONS, 0x00000004),
+	OID_UNKNOWN(GEN_OID_LEDCONFIG, 0x00000005),
+
+	/* 802.11 */
+	OID_U32_C(DOT11_OID_BSSTYPE, 0x10000000),
+	OID_STRUCT_C(DOT11_OID_BSSID, 0x10000001, u8[6], OID_TYPE_RAW),
+	OID_STRUCT_C(DOT11_OID_SSID, 0x10000002, struct obj_ssid,
+		     OID_TYPE_SSID),
+	OID_U32(DOT11_OID_STATE, 0x10000003),
+	OID_U32(DOT11_OID_AID, 0x10000004),
+	OID_STRUCT(DOT11_OID_COUNTRYSTRING, 0x10000005, u8[4], OID_TYPE_RAW),
+	OID_STRUCT_C(DOT11_OID_SSIDOVERRIDE, 0x10000006, struct obj_ssid,
+		     OID_TYPE_SSID),
+
+	OID_U32(DOT11_OID_MEDIUMLIMIT, 0x11000000),
+	OID_U32_C(DOT11_OID_BEACONPERIOD, 0x11000001),
+	OID_U32(DOT11_OID_DTIMPERIOD, 0x11000002),
+	OID_U32(DOT11_OID_ATIMWINDOW, 0x11000003),
+	OID_U32(DOT11_OID_LISTENINTERVAL, 0x11000004),
+	OID_U32(DOT11_OID_CFPPERIOD, 0x11000005),
+	OID_U32(DOT11_OID_CFPDURATION, 0x11000006),
+
+	OID_U32_C(DOT11_OID_AUTHENABLE, 0x12000000),
+	OID_U32_C(DOT11_OID_PRIVACYINVOKED, 0x12000001),
+	OID_U32_C(DOT11_OID_EXUNENCRYPTED, 0x12000002),
+	OID_U32_C(DOT11_OID_DEFKEYID, 0x12000003),
+	[DOT11_OID_DEFKEYX] = {0x12000004, 3, sizeof (struct obj_key),
+			       OID_FLAG_CACHED | OID_TYPE_KEY},	/* DOT11_OID_DEFKEY1,...DOT11_OID_DEFKEY4 */
+	OID_UNKNOWN(DOT11_OID_STAKEY, 0x12000008),
+	OID_U32(DOT11_OID_REKEYTHRESHOLD, 0x12000009),
+	OID_UNKNOWN(DOT11_OID_STASC, 0x1200000a),
+
+	OID_U32(DOT11_OID_PRIVTXREJECTED, 0x1a000000),
+	OID_U32(DOT11_OID_PRIVRXPLAIN, 0x1a000001),
+	OID_U32(DOT11_OID_PRIVRXFAILED, 0x1a000002),
+	OID_U32(DOT11_OID_PRIVRXNOKEY, 0x1a000003),
+
+	OID_U32_C(DOT11_OID_RTSTHRESH, 0x13000000),
+	OID_U32_C(DOT11_OID_FRAGTHRESH, 0x13000001),
+	OID_U32_C(DOT11_OID_SHORTRETRIES, 0x13000002),
+	OID_U32_C(DOT11_OID_LONGRETRIES, 0x13000003),
+	OID_U32_C(DOT11_OID_MAXTXLIFETIME, 0x13000004),
+	OID_U32(DOT11_OID_MAXRXLIFETIME, 0x13000005),
+	OID_U32(DOT11_OID_AUTHRESPTIMEOUT, 0x13000006),
+	OID_U32(DOT11_OID_ASSOCRESPTIMEOUT, 0x13000007),
+
+	OID_UNKNOWN(DOT11_OID_ALOFT_TABLE, 0x1d000000),
+	OID_UNKNOWN(DOT11_OID_ALOFT_CTRL_TABLE, 0x1d000001),
+	OID_UNKNOWN(DOT11_OID_ALOFT_RETREAT, 0x1d000002),
+	OID_UNKNOWN(DOT11_OID_ALOFT_PROGRESS, 0x1d000003),
+	OID_U32(DOT11_OID_ALOFT_FIXEDRATE, 0x1d000004),
+	OID_UNKNOWN(DOT11_OID_ALOFT_RSSIGRAPH, 0x1d000005),
+	OID_UNKNOWN(DOT11_OID_ALOFT_CONFIG, 0x1d000006),
+
+	[DOT11_OID_VDCFX] = {0x1b000000, 7, 0, 0},
+	OID_U32(DOT11_OID_MAXFRAMEBURST, 0x1b000008),
+
+	OID_U32(DOT11_OID_PSM, 0x14000000),
+	OID_U32(DOT11_OID_CAMTIMEOUT, 0x14000001),
+	OID_U32(DOT11_OID_RECEIVEDTIMS, 0x14000002),
+	OID_U32(DOT11_OID_ROAMPREFERENCE, 0x14000003),
+
+	OID_U32(DOT11_OID_BRIDGELOCAL, 0x15000000),
+	OID_U32(DOT11_OID_CLIENTS, 0x15000001),
+	OID_U32(DOT11_OID_CLIENTSASSOCIATED, 0x15000002),
+	[DOT11_OID_CLIENTX] = {0x15000003, 2006, 0, 0},	/* DOT11_OID_CLIENTX,...DOT11_OID_CLIENT2007 */
+
+	OID_STRUCT(DOT11_OID_CLIENTFIND, 0x150007DB, u8[6], OID_TYPE_ADDR),
+	OID_STRUCT(DOT11_OID_WDSLINKADD, 0x150007DC, u8[6], OID_TYPE_ADDR),
+	OID_STRUCT(DOT11_OID_WDSLINKREMOVE, 0x150007DD, u8[6], OID_TYPE_ADDR),
+	OID_STRUCT(DOT11_OID_EAPAUTHSTA, 0x150007DE, u8[6], OID_TYPE_ADDR),
+	OID_STRUCT(DOT11_OID_EAPUNAUTHSTA, 0x150007DF, u8[6], OID_TYPE_ADDR),
+	OID_U32_C(DOT11_OID_DOT1XENABLE, 0x150007E0),
+	OID_UNKNOWN(DOT11_OID_MICFAILURE, 0x150007E1),
+	OID_UNKNOWN(DOT11_OID_REKEYINDICATE, 0x150007E2),
+
+	OID_U32(DOT11_OID_MPDUTXSUCCESSFUL, 0x16000000),
+	OID_U32(DOT11_OID_MPDUTXONERETRY, 0x16000001),
+	OID_U32(DOT11_OID_MPDUTXMULTIPLERETRIES, 0x16000002),
+	OID_U32(DOT11_OID_MPDUTXFAILED, 0x16000003),
+	OID_U32(DOT11_OID_MPDURXSUCCESSFUL, 0x16000004),
+	OID_U32(DOT11_OID_MPDURXDUPS, 0x16000005),
+	OID_U32(DOT11_OID_RTSSUCCESSFUL, 0x16000006),
+	OID_U32(DOT11_OID_RTSFAILED, 0x16000007),
+	OID_U32(DOT11_OID_ACKFAILED, 0x16000008),
+	OID_U32(DOT11_OID_FRAMERECEIVES, 0x16000009),
+	OID_U32(DOT11_OID_FRAMEERRORS, 0x1600000A),
+	OID_U32(DOT11_OID_FRAMEABORTS, 0x1600000B),
+	OID_U32(DOT11_OID_FRAMEABORTSPHY, 0x1600000C),
+
+	OID_U32(DOT11_OID_SLOTTIME, 0x17000000),
+	OID_U32(DOT11_OID_CWMIN, 0x17000001),
+	OID_U32(DOT11_OID_CWMAX, 0x17000002),
+	OID_U32(DOT11_OID_ACKWINDOW, 0x17000003),
+	OID_U32(DOT11_OID_ANTENNARX, 0x17000004),
+	OID_U32(DOT11_OID_ANTENNATX, 0x17000005),
+	OID_U32(DOT11_OID_ANTENNADIVERSITY, 0x17000006),
+	OID_U32_C(DOT11_OID_CHANNEL, 0x17000007),
+	OID_U32_C(DOT11_OID_EDTHRESHOLD, 0x17000008),
+	OID_U32(DOT11_OID_PREAMBLESETTINGS, 0x17000009),
+	OID_STRUCT(DOT11_OID_RATES, 0x1700000A, u8[IWMAX_BITRATES + 1],
+		   OID_TYPE_RAW),
+	OID_U32(DOT11_OID_CCAMODESUPPORTED, 0x1700000B),
+	OID_U32(DOT11_OID_CCAMODE, 0x1700000C),
+	OID_UNKNOWN(DOT11_OID_RSSIVECTOR, 0x1700000D),
+	OID_UNKNOWN(DOT11_OID_OUTPUTPOWERTABLE, 0x1700000E),
+	OID_U32(DOT11_OID_OUTPUTPOWER, 0x1700000F),
+	OID_STRUCT(DOT11_OID_SUPPORTEDRATES, 0x17000010,
+		   u8[IWMAX_BITRATES + 1], OID_TYPE_RAW),
+	OID_U32_C(DOT11_OID_FREQUENCY, 0x17000011),
+	[DOT11_OID_SUPPORTEDFREQUENCIES] =
+	    {0x17000012, 0, sizeof (struct obj_frequencies)
+	     + sizeof (u16) * IWMAX_FREQ, OID_TYPE_FREQUENCIES},
+
+	OID_U32(DOT11_OID_NOISEFLOOR, 0x17000013),
+	OID_STRUCT(DOT11_OID_FREQUENCYACTIVITY, 0x17000014, u8[IWMAX_FREQ + 1],
+		   OID_TYPE_RAW),
+	OID_UNKNOWN(DOT11_OID_IQCALIBRATIONTABLE, 0x17000015),
+	OID_U32(DOT11_OID_NONERPPROTECTION, 0x17000016),
+	OID_U32(DOT11_OID_SLOTSETTINGS, 0x17000017),
+	OID_U32(DOT11_OID_NONERPTIMEOUT, 0x17000018),
+	OID_U32(DOT11_OID_PROFILES, 0x17000019),
+	OID_STRUCT(DOT11_OID_EXTENDEDRATES, 0x17000020,
+		   u8[IWMAX_BITRATES + 1], OID_TYPE_RAW),
+
+	OID_STRUCT_MLME(DOT11_OID_DEAUTHENTICATE, 0x18000000),
+	OID_STRUCT_MLME(DOT11_OID_AUTHENTICATE, 0x18000001),
+	OID_STRUCT_MLME(DOT11_OID_DISASSOCIATE, 0x18000002),
+	OID_STRUCT_MLME(DOT11_OID_ASSOCIATE, 0x18000003),
+	OID_UNKNOWN(DOT11_OID_SCAN, 0x18000004),
+	OID_STRUCT_MLMEEX(DOT11_OID_BEACON, 0x18000005),
+	OID_STRUCT_MLMEEX(DOT11_OID_PROBE, 0x18000006),
+	OID_STRUCT_MLMEEX(DOT11_OID_DEAUTHENTICATEEX, 0x18000007),
+	OID_STRUCT_MLMEEX(DOT11_OID_AUTHENTICATEEX, 0x18000008),
+	OID_STRUCT_MLMEEX(DOT11_OID_DISASSOCIATEEX, 0x18000009),
+	OID_STRUCT_MLMEEX(DOT11_OID_ASSOCIATEEX, 0x1800000A),
+	OID_STRUCT_MLMEEX(DOT11_OID_REASSOCIATE, 0x1800000B),
+	OID_STRUCT_MLMEEX(DOT11_OID_REASSOCIATEEX, 0x1800000C),
+
+	OID_U32(DOT11_OID_NONERPSTATUS, 0x1E000000),
+
+	OID_U32(DOT11_OID_STATIMEOUT, 0x19000000),
+	OID_U32_C(DOT11_OID_MLMEAUTOLEVEL, 0x19000001),
+	OID_U32(DOT11_OID_BSSTIMEOUT, 0x19000002),
+	[DOT11_OID_ATTACHMENT] = {0x19000003, 0,
+		sizeof(struct obj_attachment), OID_TYPE_ATTACH},
+	OID_STRUCT_C(DOT11_OID_PSMBUFFER, 0x19000004, struct obj_buffer,
+		     OID_TYPE_BUFFER),
+
+	OID_U32(DOT11_OID_BSSS, 0x1C000000),
+	[DOT11_OID_BSSX] = {0x1C000001, 63, sizeof (struct obj_bss),
+			    OID_TYPE_BSS},	/*DOT11_OID_BSS1,...,DOT11_OID_BSS64 */
+	OID_STRUCT(DOT11_OID_BSSFIND, 0x1C000042, struct obj_bss, OID_TYPE_BSS),
+	[DOT11_OID_BSSLIST] = {0x1C000043, 0, sizeof (struct
+						      obj_bsslist) +
+			       sizeof (struct obj_bss[IWMAX_BSS]),
+			       OID_TYPE_BSSLIST},
+
+	OID_UNKNOWN(OID_INL_TUNNEL, 0xFF020000),
+	OID_UNKNOWN(OID_INL_MEMADDR, 0xFF020001),
+	OID_UNKNOWN(OID_INL_MEMORY, 0xFF020002),
+	OID_U32_C(OID_INL_MODE, 0xFF020003),
+	OID_UNKNOWN(OID_INL_COMPONENT_NR, 0xFF020004),
+	OID_STRUCT(OID_INL_VERSION, 0xFF020005, u8[8], OID_TYPE_RAW),
+	OID_UNKNOWN(OID_INL_INTERFACE_ID, 0xFF020006),
+	OID_UNKNOWN(OID_INL_COMPONENT_ID, 0xFF020007),
+	OID_U32_C(OID_INL_CONFIG, 0xFF020008),
+	OID_U32_C(OID_INL_DOT11D_CONFORMANCE, 0xFF02000C),
+	OID_U32(OID_INL_PHYCAPABILITIES, 0xFF02000D),
+	OID_U32_C(OID_INL_OUTPUTPOWER, 0xFF02000F),
+
+};
+
+int
+mgt_init(islpci_private *priv)
+{
+	int i;
+
+	priv->mib = kmalloc(OID_NUM_LAST * sizeof (void *), GFP_KERNEL);
+	if (!priv->mib)
+		return -ENOMEM;
+
+	memset(priv->mib, 0, OID_NUM_LAST * sizeof (void *));
+
+	/* Alloc the cache */
+	for (i = 0; i < OID_NUM_LAST; i++) {
+		if (isl_oid[i].flags & OID_FLAG_CACHED) {
+			priv->mib[i] = kmalloc(isl_oid[i].size *
+					       (isl_oid[i].range + 1),
+					       GFP_KERNEL);
+			if (!priv->mib[i])
+				return -ENOMEM;
+			memset(priv->mib[i], 0,
+			       isl_oid[i].size * (isl_oid[i].range + 1));
+		} else
+			priv->mib[i] = NULL;
+	}
+
+	init_rwsem(&priv->mib_sem);
+	prism54_mib_init(priv);
+
+	return 0;
+}
+
+void
+mgt_clean(islpci_private *priv)
+{
+	int i;
+
+	if (!priv->mib)
+		return;
+	for (i = 0; i < OID_NUM_LAST; i++)
+		if (priv->mib[i]) {
+			kfree(priv->mib[i]);
+			priv->mib[i] = NULL;
+		}
+	kfree(priv->mib);
+	priv->mib = NULL;
+}
+
+void
+mgt_le_to_cpu(int type, void *data)
+{
+	switch (type) {
+	case OID_TYPE_U32:
+		*(u32 *) data = le32_to_cpu(*(u32 *) data);
+		break;
+	case OID_TYPE_BUFFER:{
+			struct obj_buffer *buff = data;
+			buff->size = le32_to_cpu(buff->size);
+			buff->addr = le32_to_cpu(buff->addr);
+			break;
+		}
+	case OID_TYPE_BSS:{
+			struct obj_bss *bss = data;
+			bss->age = le16_to_cpu(bss->age);
+			bss->channel = le16_to_cpu(bss->channel);
+			bss->capinfo = le16_to_cpu(bss->capinfo);
+			bss->rates = le16_to_cpu(bss->rates);
+			bss->basic_rates = le16_to_cpu(bss->basic_rates);
+			break;
+		}
+	case OID_TYPE_BSSLIST:{
+			struct obj_bsslist *list = data;
+			int i;
+			list->nr = le32_to_cpu(list->nr);
+			for (i = 0; i < list->nr; i++)
+				mgt_le_to_cpu(OID_TYPE_BSS, &list->bsslist[i]);
+			break;
+		}
+	case OID_TYPE_FREQUENCIES:{
+			struct obj_frequencies *freq = data;
+			int i;
+			freq->nr = le16_to_cpu(freq->nr);
+			for (i = 0; i < freq->nr; i++)
+				freq->mhz[i] = le16_to_cpu(freq->mhz[i]);
+			break;
+		}
+	case OID_TYPE_MLME:{
+			struct obj_mlme *mlme = data;
+			mlme->id = le16_to_cpu(mlme->id);
+			mlme->state = le16_to_cpu(mlme->state);
+			mlme->code = le16_to_cpu(mlme->code);
+			break;
+		}
+	case OID_TYPE_MLMEEX:{
+			struct obj_mlmeex *mlme = data;
+			mlme->id = le16_to_cpu(mlme->id);
+			mlme->state = le16_to_cpu(mlme->state);
+			mlme->code = le16_to_cpu(mlme->code);
+			mlme->size = le16_to_cpu(mlme->size);
+			break;
+		}
+	case OID_TYPE_ATTACH:{
+			struct obj_attachment *attach = data;
+			attach->id = le16_to_cpu(attach->id);
+			attach->size = le16_to_cpu(attach->size);; 
+			break;
+	}
+	case OID_TYPE_SSID:
+	case OID_TYPE_KEY:
+	case OID_TYPE_ADDR:
+	case OID_TYPE_RAW:
+		break;
+	default:
+		BUG();
+	}
+}
+
+static void
+mgt_cpu_to_le(int type, void *data)
+{
+	switch (type) {
+	case OID_TYPE_U32:
+		*(u32 *) data = cpu_to_le32(*(u32 *) data);
+		break;
+	case OID_TYPE_BUFFER:{
+			struct obj_buffer *buff = data;
+			buff->size = cpu_to_le32(buff->size);
+			buff->addr = cpu_to_le32(buff->addr);
+			break;
+		}
+	case OID_TYPE_BSS:{
+			struct obj_bss *bss = data;
+			bss->age = cpu_to_le16(bss->age);
+			bss->channel = cpu_to_le16(bss->channel);
+			bss->capinfo = cpu_to_le16(bss->capinfo);
+			bss->rates = cpu_to_le16(bss->rates);
+			bss->basic_rates = cpu_to_le16(bss->basic_rates);
+			break;
+		}
+	case OID_TYPE_BSSLIST:{
+			struct obj_bsslist *list = data;
+			int i;
+			list->nr = cpu_to_le32(list->nr);
+			for (i = 0; i < list->nr; i++)
+				mgt_cpu_to_le(OID_TYPE_BSS, &list->bsslist[i]);
+			break;
+		}
+	case OID_TYPE_FREQUENCIES:{
+			struct obj_frequencies *freq = data;
+			int i;
+			freq->nr = cpu_to_le16(freq->nr);
+			for (i = 0; i < freq->nr; i++)
+				freq->mhz[i] = cpu_to_le16(freq->mhz[i]);
+			break;
+		}
+	case OID_TYPE_MLME:{
+			struct obj_mlme *mlme = data;
+			mlme->id = cpu_to_le16(mlme->id);
+			mlme->state = cpu_to_le16(mlme->state);
+			mlme->code = cpu_to_le16(mlme->code);
+			break;
+		}
+	case OID_TYPE_MLMEEX:{
+			struct obj_mlmeex *mlme = data;
+			mlme->id = cpu_to_le16(mlme->id);
+			mlme->state = cpu_to_le16(mlme->state);
+			mlme->code = cpu_to_le16(mlme->code);
+			mlme->size = cpu_to_le16(mlme->size);
+			break;
+		}
+	case OID_TYPE_ATTACH:{
+			struct obj_attachment *attach = data;
+			attach->id = cpu_to_le16(attach->id);
+			attach->size = cpu_to_le16(attach->size);; 
+			break;
+	}
+	case OID_TYPE_SSID:
+	case OID_TYPE_KEY:
+	case OID_TYPE_ADDR:
+	case OID_TYPE_RAW:
+		break;
+	default:
+		BUG();
+	}
+}
+
+/* Note : data is modified during this function */
+
+int
+mgt_set_request(islpci_private *priv, enum oid_num_t n, int extra, void *data)
+{
+	int ret = 0;
+	struct islpci_mgmtframe *response = NULL;
+	int response_op = PIMFOR_OP_ERROR;
+	int dlen;
+	void *cache, *_data = data;
+	u32 oid;
+
+	BUG_ON(OID_NUM_LAST <= n);
+	BUG_ON(extra > isl_oid[n].range);
+
+	if (!priv->mib)
+		/* memory has been freed */
+		return -1;
+
+	dlen = isl_oid[n].size;
+	cache = priv->mib[n];
+	cache += (cache ? extra * dlen : 0);
+	oid = isl_oid[n].oid + extra;
+
+	if (_data == NULL)
+		/* we are requested to re-set a cached value */
+		_data = cache;
+	else
+		mgt_cpu_to_le(isl_oid[n].flags & OID_FLAG_TYPE, _data);
+	/* If we are going to write to the cache, we don't want anyone to read
+	 * it -> acquire write lock.
+	 * Else we could acquire a read lock to be sure we don't bother the
+	 * commit process (which takes a write lock). But I'm not sure if it's
+	 * needed.
+	 */
+	if (cache)
+		down_write(&priv->mib_sem);
+
+	if (islpci_get_state(priv) >= PRV_STATE_READY) {
+		ret = islpci_mgt_transaction(priv->ndev, PIMFOR_OP_SET, oid,
+					     _data, dlen, &response);
+		if (!ret) {
+			response_op = response->header->operation;
+			islpci_mgt_release(response);
+		}
+		if (ret || response_op == PIMFOR_OP_ERROR)
+			ret = -EIO;
+	} else if (!cache)
+		ret = -EIO;
+
+	if (cache) {
+		if (!ret && data)
+			memcpy(cache, _data, dlen);
+		up_write(&priv->mib_sem);
+	}
+
+	/* re-set given data to what it was */
+	if (data)
+		mgt_le_to_cpu(isl_oid[n].flags & OID_FLAG_TYPE, data);
+
+	return ret;
+}
+
+/* None of these are cached */
+int
+mgt_set_varlen(islpci_private *priv, enum oid_num_t n, void *data, int extra_len)
+{
+	int ret = 0;
+	struct islpci_mgmtframe *response;
+	int response_op = PIMFOR_OP_ERROR;
+	int dlen;
+	u32 oid;
+
+	BUG_ON(OID_NUM_LAST <= n);
+
+	dlen = isl_oid[n].size;
+	oid = isl_oid[n].oid;
+
+	mgt_cpu_to_le(isl_oid[n].flags & OID_FLAG_TYPE, data);
+
+	if (islpci_get_state(priv) >= PRV_STATE_READY) {
+		ret = islpci_mgt_transaction(priv->ndev, PIMFOR_OP_SET, oid,
+					     data, dlen + extra_len, &response);
+		if (!ret) {
+			response_op = response->header->operation;
+			islpci_mgt_release(response);
+		}
+		if (ret || response_op == PIMFOR_OP_ERROR)
+			ret = -EIO;
+	} else 
+		ret = -EIO;
+
+	/* re-set given data to what it was */
+	if (data)
+		mgt_le_to_cpu(isl_oid[n].flags & OID_FLAG_TYPE, data);
+
+	return ret;
+}
+
+int
+mgt_get_request(islpci_private *priv, enum oid_num_t n, int extra, void *data,
+		union oid_res_t *res)
+{
+
+	int ret = -EIO;
+	int reslen = 0;
+	struct islpci_mgmtframe *response = NULL;
+
+	int dlen;
+	void *cache, *_res = NULL;
+	u32 oid;
+
+	BUG_ON(OID_NUM_LAST <= n);
+	BUG_ON(extra > isl_oid[n].range);
+
+	res->ptr = NULL;
+
+	if (!priv->mib)
+		/* memory has been freed */
+		return -1;
+
+	dlen = isl_oid[n].size;
+	cache = priv->mib[n];
+	cache += cache ? extra * dlen : 0;
+	oid = isl_oid[n].oid + extra;
+	reslen = dlen;
+
+	if (cache)
+		down_read(&priv->mib_sem);
+
+	if (islpci_get_state(priv) >= PRV_STATE_READY) {
+		ret = islpci_mgt_transaction(priv->ndev, PIMFOR_OP_GET,
+					     oid, data, dlen, &response);
+		if (ret || !response ||
+		    response->header->operation == PIMFOR_OP_ERROR) {
+			if (response)
+				islpci_mgt_release(response);
+			ret = -EIO;
+		}
+		if (!ret) {
+			_res = response->data;
+			reslen = response->header->length;
+		}
+	} else if (cache) {
+		_res = cache;
+		ret = 0;
+	}
+	if ((isl_oid[n].flags & OID_FLAG_TYPE) == OID_TYPE_U32)
+		res->u = ret ? 0 : le32_to_cpu(*(u32 *) _res);
+	else {
+		res->ptr = kmalloc(reslen, GFP_KERNEL);
+		BUG_ON(res->ptr == NULL);
+		if (ret)
+			memset(res->ptr, 0, reslen);
+		else {
+			memcpy(res->ptr, _res, reslen);
+			mgt_le_to_cpu(isl_oid[n].flags & OID_FLAG_TYPE,
+				      res->ptr);
+		}
+	}
+	if (cache)
+		up_read(&priv->mib_sem);
+
+	if (response && !ret)
+		islpci_mgt_release(response);
+
+	if (reslen > isl_oid[n].size)
+		printk(KERN_DEBUG
+		       "mgt_get_request(0x%x): received data length was bigger "
+		       "than expected (%d > %d). Memory is probably corrupted...",
+		       oid, reslen, isl_oid[n].size);
+
+	return ret;
+}
+
+/* lock outside */
+int
+mgt_commit_list(islpci_private *priv, enum oid_num_t *l, int n)
+{
+	int i, ret = 0;
+	struct islpci_mgmtframe *response;
+
+	for (i = 0; i < n; i++) {
+		struct oid_t *t = &(isl_oid[l[i]]);
+		void *data = priv->mib[l[i]];
+		int j = 0;
+		u32 oid = t->oid;
+		BUG_ON(data == NULL);
+		while (j <= t->range) {
+			int r = islpci_mgt_transaction(priv->ndev, PIMFOR_OP_SET,
+						      oid, data, t->size,
+						      &response);
+			if (response) {
+				r |= (response->header->operation == PIMFOR_OP_ERROR);
+				islpci_mgt_release(response);
+			}
+			if (r)
+				printk(KERN_ERR "%s: mgt_commit_list: failure. "
+					"oid=%08x err=%d\n",
+					priv->ndev->name, oid, r);
+			ret |= r;
+			j++;
+			oid++;
+			data += t->size;
+		}
+	}
+	return ret;
+}
+
+/* Lock outside */
+
+void
+mgt_set(islpci_private *priv, enum oid_num_t n, void *data)
+{
+	BUG_ON(OID_NUM_LAST <= n);
+	BUG_ON(priv->mib[n] == NULL);
+
+	memcpy(priv->mib[n], data, isl_oid[n].size);
+	mgt_cpu_to_le(isl_oid[n].flags & OID_FLAG_TYPE, priv->mib[n]);
+}
+
+void
+mgt_get(islpci_private *priv, enum oid_num_t n, void *res)
+{
+	BUG_ON(OID_NUM_LAST <= n);
+	BUG_ON(priv->mib[n] == NULL);
+	BUG_ON(res == NULL);
+
+	memcpy(res, priv->mib[n], isl_oid[n].size);
+	mgt_le_to_cpu(isl_oid[n].flags & OID_FLAG_TYPE, res);
+}
+
+/* Commits the cache. Lock outside. */
+
+static enum oid_num_t commit_part1[] = {
+	OID_INL_CONFIG,
+	OID_INL_MODE,
+	DOT11_OID_BSSTYPE,
+	DOT11_OID_CHANNEL,
+	DOT11_OID_MLMEAUTOLEVEL
+};
+
+static enum oid_num_t commit_part2[] = {
+	DOT11_OID_SSID,
+	DOT11_OID_PSMBUFFER,
+	DOT11_OID_AUTHENABLE,
+	DOT11_OID_PRIVACYINVOKED,
+	DOT11_OID_EXUNENCRYPTED,
+	DOT11_OID_DEFKEYX,	/* MULTIPLE */
+	DOT11_OID_DEFKEYID,
+	DOT11_OID_DOT1XENABLE,
+	OID_INL_DOT11D_CONFORMANCE,
+	/* Do not initialize this - fw < 1.0.4.3 rejects it
+	OID_INL_OUTPUTPOWER,
+	*/
+};
+
+/* update the MAC addr. */
+static int
+mgt_update_addr(islpci_private *priv)
+{
+	struct islpci_mgmtframe *res;
+	int ret;
+
+	ret = islpci_mgt_transaction(priv->ndev, PIMFOR_OP_GET,
+				     isl_oid[GEN_OID_MACADDRESS].oid, NULL,
+				     isl_oid[GEN_OID_MACADDRESS].size, &res);
+
+	if ((ret == 0) && res && (res->header->operation != PIMFOR_OP_ERROR))
+		memcpy(priv->ndev->dev_addr, res->data, 6);
+	else
+		ret = -EIO;
+	if (res)
+		islpci_mgt_release(res);
+
+	if (ret)
+		printk(KERN_ERR "%s: mgt_update_addr: failure\n", priv->ndev->name);
+	return ret;
+}
+
+#define VEC_SIZE(a) (sizeof(a)/sizeof(a[0]))
+
+int
+mgt_commit(islpci_private *priv)
+{
+	int rvalue;
+	u32 u;
+
+	if (islpci_get_state(priv) < PRV_STATE_INIT)
+		return 0;
+
+	rvalue = mgt_commit_list(priv, commit_part1, VEC_SIZE(commit_part1));
+
+	if (priv->iw_mode != IW_MODE_MONITOR)
+		rvalue |= mgt_commit_list(priv, commit_part2, VEC_SIZE(commit_part2));
+
+	u = OID_INL_MODE;
+	rvalue |= mgt_commit_list(priv, &u, 1);
+	rvalue |= mgt_update_addr(priv);
+
+	if (rvalue) {
+		/* some request have failed. The device might be in an
+		   incoherent state. We should reset it ! */
+		printk(KERN_DEBUG "%s: mgt_commit: failure\n", priv->ndev->name);
+	}
+	return rvalue;
+}
+
+/* The following OIDs need to be "unlatched":
+ *
+ * MEDIUMLIMIT,BEACONPERIOD,DTIMPERIOD,ATIMWINDOW,LISTENINTERVAL
+ * FREQUENCY,EXTENDEDRATES.
+ *
+ * The way to do this is to set ESSID. Note though that they may get 
+ * unlatch before though by setting another OID. */
+#if 0
+void
+mgt_unlatch_all(islpci_private *priv)
+{
+	u32 u;
+	int rvalue = 0;
+
+	if (islpci_get_state(priv) < PRV_STATE_INIT)
+		return;
+
+	u = DOT11_OID_SSID;
+	rvalue = mgt_commit_list(priv, &u, 1);
+	/* Necessary if in MANUAL RUN mode? */
+#if 0
+	u = OID_INL_MODE;
+	rvalue |= mgt_commit_list(priv, &u, 1);
+
+	u = DOT11_OID_MLMEAUTOLEVEL;
+	rvalue |= mgt_commit_list(priv, &u, 1);
+
+	u = OID_INL_MODE;
+	rvalue |= mgt_commit_list(priv, &u, 1);
+#endif
+
+	if (rvalue)
+		printk(KERN_DEBUG "%s: Unlatching OIDs failed\n", priv->ndev->name);
+}
+#endif
+
+/* This will tell you if you are allowed to answer a mlme(ex) request .*/
+
+int
+mgt_mlme_answer(islpci_private *priv)
+{
+	u32 mlmeautolevel;
+	/* Acquire a read lock because if we are in a mode change, it's
+	 * possible to answer true, while the card is leaving master to managed
+	 * mode. Answering to a mlme in this situation could hang the card.
+	 */
+	down_read(&priv->mib_sem);
+	mlmeautolevel =
+	    le32_to_cpu(*(u32 *) priv->mib[DOT11_OID_MLMEAUTOLEVEL]);
+	up_read(&priv->mib_sem);
+
+	return ((priv->iw_mode == IW_MODE_MASTER) &&
+		(mlmeautolevel >= DOT11_MLME_INTERMEDIATE));
+}
+
+enum oid_num_t
+mgt_oidtonum(u32 oid)
+{
+	int i;
+
+	for (i = 0; i < OID_NUM_LAST; i++)
+		if (isl_oid[i].oid == oid)
+			return i;
+
+	printk(KERN_DEBUG "looking for an unknown oid 0x%x", oid);
+
+	return OID_NUM_LAST;
+}
+
+int
+mgt_response_to_str(enum oid_num_t n, union oid_res_t *r, char *str)
+{
+	switch (isl_oid[n].flags & OID_FLAG_TYPE) {
+	case OID_TYPE_U32:
+		return snprintf(str, PRIV_STR_SIZE, "%u\n", r->u);
+		break;
+	case OID_TYPE_BUFFER:{
+			struct obj_buffer *buff = r->ptr;
+			return snprintf(str, PRIV_STR_SIZE,
+					"size=%u\naddr=0x%X\n", buff->size,
+					buff->addr);
+		}
+		break;
+	case OID_TYPE_BSS:{
+			struct obj_bss *bss = r->ptr;
+			return snprintf(str, PRIV_STR_SIZE,
+					"age=%u\nchannel=%u\n"
+					"capinfo=0x%X\nrates=0x%X\n"
+					"basic_rates=0x%X\n", bss->age,
+					bss->channel, bss->capinfo,
+					bss->rates, bss->basic_rates);
+		}
+		break;
+	case OID_TYPE_BSSLIST:{
+			struct obj_bsslist *list = r->ptr;
+			int i, k;
+			k = snprintf(str, PRIV_STR_SIZE, "nr=%u\n", list->nr);
+			for (i = 0; i < list->nr; i++)
+				k += snprintf(str + k, PRIV_STR_SIZE - k,
+					      "bss[%u] : \nage=%u\nchannel=%u\n"
+					      "capinfo=0x%X\nrates=0x%X\n"
+					      "basic_rates=0x%X\n",
+					      i, list->bsslist[i].age,
+					      list->bsslist[i].channel,
+					      list->bsslist[i].capinfo,
+					      list->bsslist[i].rates,
+					      list->bsslist[i].basic_rates);
+			return k;
+		}
+		break;
+	case OID_TYPE_FREQUENCIES:{
+			struct obj_frequencies *freq = r->ptr;
+			int i, t;
+			printk("nr : %u\n", freq->nr);
+			t = snprintf(str, PRIV_STR_SIZE, "nr=%u\n", freq->nr);
+			for (i = 0; i < freq->nr; i++)
+				t += snprintf(str + t, PRIV_STR_SIZE - t,
+					      "mhz[%u]=%u\n", i, freq->mhz[i]);
+			return t;
+		}
+		break;
+	case OID_TYPE_MLME:{
+			struct obj_mlme *mlme = r->ptr;
+			return snprintf(str, PRIV_STR_SIZE,
+					"id=0x%X\nstate=0x%X\ncode=0x%X\n",
+					mlme->id, mlme->state, mlme->code);
+		}
+		break;
+	case OID_TYPE_MLMEEX:{
+			struct obj_mlmeex *mlme = r->ptr;
+			return snprintf(str, PRIV_STR_SIZE,
+					"id=0x%X\nstate=0x%X\n"
+					"code=0x%X\nsize=0x%X\n", mlme->id,
+					mlme->state, mlme->code, mlme->size);
+		}
+		break;
+	case OID_TYPE_ATTACH:{
+			struct obj_attachment *attach = r->ptr;
+			return snprintf(str, PRIV_STR_SIZE,
+					"id=%d\nsize=%d\n",
+					attach->id,
+					attach->size);
+		}
+		break;
+	case OID_TYPE_SSID:{
+			struct obj_ssid *ssid = r->ptr;
+			return snprintf(str, PRIV_STR_SIZE,
+					"length=%u\noctets=%.*s\n",
+					ssid->length, ssid->length,
+					ssid->octets);
+		}
+		break;
+	case OID_TYPE_KEY:{
+			struct obj_key *key = r->ptr;
+			int t, i;
+			t = snprintf(str, PRIV_STR_SIZE,
+				     "type=0x%X\nlength=0x%X\nkey=0x",
+				     key->type, key->length);
+			for (i = 0; i < key->length; i++)
+				t += snprintf(str + t, PRIV_STR_SIZE - t,
+					      "%02X:", key->key[i]);
+			t += snprintf(str + t, PRIV_STR_SIZE - t, "\n");
+			return t;
+		}
+		break;
+	case OID_TYPE_RAW:
+	case OID_TYPE_ADDR:{
+			unsigned char *buff = r->ptr;
+			int t, i;
+			t = snprintf(str, PRIV_STR_SIZE, "hex data=");
+			for (i = 0; i < isl_oid[n].size; i++)
+				t += snprintf(str + t, PRIV_STR_SIZE - t,
+					      "%02X:", buff[i]);
+			t += snprintf(str + t, PRIV_STR_SIZE - t, "\n");
+			return t;
+		}
+		break;
+	default:
+		BUG();
+	}
+	return 0;
+}
diff --git a/drivers/net/wireless/prism54/oid_mgt.h b/drivers/net/wireless/prism54/oid_mgt.h
new file mode 100644
index 0000000..92c8a2d
--- /dev/null
+++ b/drivers/net/wireless/prism54/oid_mgt.h
@@ -0,0 +1,59 @@
+/*
+ *  Copyright (C) 2003 Aurelien Alleaume <slts@free.fr>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+
+#if !defined(_OID_MGT_H)
+#define _OID_MGT_H
+
+#include "isl_oid.h"
+#include "islpci_dev.h"
+
+extern struct oid_t isl_oid[];
+
+int mgt_init(islpci_private *);
+
+void mgt_clean(islpci_private *);
+
+/* I don't know where to put these 2 */
+extern const int frequency_list_a[];
+int channel_of_freq(int);
+
+void mgt_le_to_cpu(int, void *);
+
+int mgt_set_request(islpci_private *, enum oid_num_t, int, void *);
+int mgt_set_varlen(islpci_private *, enum oid_num_t, void *, int);
+
+
+int mgt_get_request(islpci_private *, enum oid_num_t, int, void *,
+		    union oid_res_t *);
+
+int mgt_commit_list(islpci_private *, enum oid_num_t *, int);
+
+void mgt_set(islpci_private *, enum oid_num_t, void *);
+
+void mgt_get(islpci_private *, enum oid_num_t, void *);
+
+int mgt_commit(islpci_private *);
+
+int mgt_mlme_answer(islpci_private *);
+
+enum oid_num_t mgt_oidtonum(u32 oid);
+
+int mgt_response_to_str(enum oid_num_t, union oid_res_t *, char *);
+
+#endif				/* !defined(_OID_MGT_H) */
+/* EOF */
diff --git a/drivers/net/wireless/prism54/prismcompat.h b/drivers/net/wireless/prism54/prismcompat.h
new file mode 100644
index 0000000..55541c0
--- /dev/null
+++ b/drivers/net/wireless/prism54/prismcompat.h
@@ -0,0 +1,44 @@
+/*  
+ *  (C) 2004 Margit Schubert-While <margitsw@t-online.de>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+
+/*  
+ *	Compatibility header file to aid support of different kernel versions
+ */
+
+#ifdef PRISM54_COMPAT24
+#include "prismcompat24.h"
+#else	/* PRISM54_COMPAT24 */
+
+#ifndef _PRISM_COMPAT_H
+#define _PRISM_COMPAT_H
+
+#include <linux/device.h>
+#include <linux/firmware.h>
+#include <linux/config.h>
+#include <linux/moduleparam.h>
+#include <linux/workqueue.h>
+#include <linux/compiler.h>
+
+#ifndef __iomem
+#define __iomem
+#endif
+
+#define PRISM_FW_PDEV		&priv->pdev->dev
+
+#endif				/* _PRISM_COMPAT_H */
+#endif				/* PRISM54_COMPAT24 */
diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c
new file mode 100644
index 0000000..6e5bda5
--- /dev/null
+++ b/drivers/net/wireless/ray_cs.c
@@ -0,0 +1,2957 @@
+/*=============================================================================
+ *
+ * A  PCMCIA client driver for the Raylink wireless LAN card.
+ * The starting point for this module was the skeleton.c in the
+ * PCMCIA 2.9.12 package written by David Hinds, dahinds@users.sourceforge.net
+ *
+ *
+ * Copyright (c) 1998  Corey Thomas (corey@world.std.com)
+ *
+ * This driver is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 only of the GNU General Public License as 
+ * published by the Free Software Foundation.
+ *
+ * It is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
+ *
+ * Changes:
+ * Arnaldo Carvalho de Melo <acme@conectiva.com.br> - 08/08/2000
+ * - reorganize kmallocs in ray_attach, checking all for failure
+ *   and releasing the previous allocations if one fails
+ *
+ * Daniele Bellucci <bellucda@tiscali.it> - 07/10/2003
+ * - Audit copy_to_user in ioctl(SIOCGIWESSID)
+ * 
+=============================================================================*/
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/proc_fs.h>
+#include <linux/ptrace.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/timer.h>
+#include <linux/init.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/if_arp.h>
+#include <linux/ioport.h>
+#include <linux/skbuff.h>
+#include <linux/ethtool.h>
+
+#include <pcmcia/version.h>
+#include <pcmcia/cs_types.h>
+#include <pcmcia/cs.h>
+#include <pcmcia/cistpl.h>
+#include <pcmcia/cisreg.h>
+#include <pcmcia/ds.h>
+#include <pcmcia/mem_op.h>
+
+#include <linux/wireless.h>
+
+#include <asm/io.h>
+#include <asm/system.h>
+#include <asm/byteorder.h>
+#include <asm/uaccess.h>
+
+/* Warning : these stuff will slow down the driver... */
+#define WIRELESS_SPY		/* Enable spying addresses */
+/* Definitions we need for spy */
+typedef struct iw_statistics	iw_stats;
+typedef struct iw_quality	iw_qual;
+typedef u_char	mac_addr[ETH_ALEN];	/* Hardware address */
+
+#include "rayctl.h"
+#include "ray_cs.h"
+
+/* All the PCMCIA modules use PCMCIA_DEBUG to control debugging.  If
+   you do not define PCMCIA_DEBUG at all, all the debug code will be
+   left out.  If you compile with PCMCIA_DEBUG=0, the debug code will
+   be present but disabled -- but it can then be enabled for specific
+   modules at load time with a 'pc_debug=#' option to insmod.
+*/
+
+#ifdef RAYLINK_DEBUG
+#define PCMCIA_DEBUG RAYLINK_DEBUG
+#endif
+#ifdef PCMCIA_DEBUG
+static int ray_debug;
+static int pc_debug = PCMCIA_DEBUG;
+module_param(pc_debug, int, 0);
+/* #define DEBUG(n, args...) if (pc_debug>(n)) printk(KERN_DEBUG args); */
+#define DEBUG(n, args...) if (pc_debug>(n)) printk(args);
+#else
+#define DEBUG(n, args...)
+#endif
+/** Prototypes based on PCMCIA skeleton driver *******************************/
+static void ray_config(dev_link_t *link);
+static void ray_release(dev_link_t *link);
+static int ray_event(event_t event, int priority, event_callback_args_t *args);
+static dev_link_t *ray_attach(void);
+static void ray_detach(dev_link_t *);
+
+/***** Prototypes indicated by device structure ******************************/
+static int ray_dev_close(struct net_device *dev);
+static int ray_dev_config(struct net_device *dev, struct ifmap *map);
+static struct net_device_stats *ray_get_stats(struct net_device *dev);
+static int ray_dev_init(struct net_device *dev);
+static int ray_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd);
+
+static struct ethtool_ops netdev_ethtool_ops;
+
+static int ray_open(struct net_device *dev);
+static int ray_dev_start_xmit(struct sk_buff *skb, struct net_device *dev);
+static void set_multicast_list(struct net_device *dev);
+static void ray_update_multi_list(struct net_device *dev, int all);
+static int translate_frame(ray_dev_t *local, struct tx_msg __iomem *ptx,
+                unsigned char *data, int len);
+static void ray_build_header(ray_dev_t *local, struct tx_msg __iomem *ptx, UCHAR msg_type,
+                unsigned char *data);
+static void untranslate(ray_dev_t *local, struct sk_buff *skb, int len);
+#if WIRELESS_EXT > 7	/* If wireless extension exist in the kernel */
+static iw_stats * ray_get_wireless_stats(struct net_device *	dev);
+#endif	/* WIRELESS_EXT > 7 */
+
+/***** Prototypes for raylink functions **************************************/
+static int asc_to_int(char a);
+static void authenticate(ray_dev_t *local);
+static int build_auth_frame(ray_dev_t *local, UCHAR *dest, int auth_type);
+static void authenticate_timeout(u_long);
+static int get_free_ccs(ray_dev_t *local);
+static int get_free_tx_ccs(ray_dev_t *local);
+static void init_startup_params(ray_dev_t *local);
+static int parse_addr(char *in_str, UCHAR *out);
+static int ray_hw_xmit(unsigned char* data, int len, struct net_device* dev, UCHAR type);
+static int ray_init(struct net_device *dev);
+static int interrupt_ecf(ray_dev_t *local, int ccs);
+static void ray_reset(struct net_device *dev);
+static void ray_update_parm(struct net_device *dev, UCHAR objid, UCHAR *value, int len);
+static void verify_dl_startup(u_long);
+
+/* Prototypes for interrpt time functions **********************************/
+static irqreturn_t ray_interrupt (int reg, void *dev_id, struct pt_regs *regs);
+static void clear_interrupt(ray_dev_t *local);
+static void rx_deauthenticate(ray_dev_t *local, struct rcs __iomem *prcs, 
+                       unsigned int pkt_addr, int rx_len);
+static int copy_from_rx_buff(ray_dev_t *local, UCHAR *dest, int pkt_addr, int len);
+static void ray_rx(struct net_device *dev, ray_dev_t *local, struct rcs __iomem *prcs);
+static void release_frag_chain(ray_dev_t *local, struct rcs __iomem *prcs);
+static void rx_authenticate(ray_dev_t *local, struct rcs __iomem *prcs,
+                     unsigned int pkt_addr, int rx_len);
+static void rx_data(struct net_device *dev, struct rcs __iomem *prcs, unsigned int pkt_addr, 
+             int rx_len);
+static void associate(ray_dev_t *local);
+
+/* Card command functions */
+static int dl_startup_params(struct net_device *dev);
+static void join_net(u_long local);
+static void start_net(u_long local);
+/* void start_net(ray_dev_t *local); */
+
+/*===========================================================================*/
+/* Parameters that can be set with 'insmod' */
+
+/* ADHOC=0, Infrastructure=1 */
+static int net_type = ADHOC;
+
+/* Hop dwell time in Kus (1024 us units defined by 802.11) */
+static int hop_dwell = 128;
+
+/* Beacon period in Kus */
+static int beacon_period = 256;
+
+/* power save mode (0 = off, 1 = save power) */
+static int psm;
+
+/* String for network's Extended Service Set ID. 32 Characters max */
+static char *essid;
+
+/* Default to encapsulation unless translation requested */
+static int translate = 1;
+
+static int country = USA;
+
+static int sniffer;
+
+static int bc;
+
+/* 48 bit physical card address if overriding card's real physical
+ * address is required.  Since IEEE 802.11 addresses are 48 bits
+ * like ethernet, an int can't be used, so a string is used. To
+ * allow use of addresses starting with a decimal digit, the first
+ * character must be a letter and will be ignored. This letter is
+ * followed by up to 12 hex digits which are the address.  If less
+ * than 12 digits are used, the address will be left filled with 0's.
+ * Note that bit 0 of the first byte is the broadcast bit, and evil
+ * things will happen if it is not 0 in a card address.
+ */
+static char *phy_addr = NULL;
+
+
+/* The dev_info variable is the "key" that is used to match up this
+   device driver with appropriate cards, through the card configuration
+   database.
+*/
+static dev_info_t dev_info = "ray_cs";
+
+/* A linked list of "instances" of the ray device.  Each actual
+   PCMCIA card corresponds to one device instance, and is described
+   by one dev_link_t structure (defined in ds.h).
+*/
+static dev_link_t *dev_list = NULL;
+
+/* A dev_link_t structure has fields for most things that are needed
+   to keep track of a socket, but there will usually be some device
+   specific information that also needs to be kept track of.  The
+   'priv' pointer in a dev_link_t structure can be used to point to
+   a device-specific private data structure, like this.
+*/
+static unsigned int ray_mem_speed = 500;
+
+MODULE_AUTHOR("Corey Thomas <corey@world.std.com>");
+MODULE_DESCRIPTION("Raylink/WebGear wireless LAN driver");
+MODULE_LICENSE("GPL");
+
+module_param(net_type, int, 0);
+module_param(hop_dwell, int, 0);
+module_param(beacon_period, int, 0);
+module_param(psm, int, 0);
+module_param(essid, charp, 0);
+module_param(translate, int, 0);
+module_param(country, int, 0);
+module_param(sniffer, int, 0);
+module_param(bc, int, 0);
+module_param(phy_addr, charp, 0);
+module_param(ray_mem_speed, int, 0);
+
+static UCHAR b5_default_startup_parms[] = {
+    0,   0,                         /* Adhoc station */
+   'L','I','N','U','X', 0,  0,  0,  /* 32 char ESSID */
+    0,  0,  0,  0,  0,  0,  0,  0,
+    0,  0,  0,  0,  0,  0,  0,  0,
+    0,  0,  0,  0,  0,  0,  0,  0,
+    1,  0,                          /* Active scan, CA Mode */
+    0,  0,  0,  0,  0,  0,          /* No default MAC addr  */
+    0x7f, 0xff,                     /* Frag threshold */
+    0x00, 0x80,                     /* Hop time 128 Kus*/
+    0x01, 0x00,                     /* Beacon period 256 Kus */
+    0x01, 0x07, 0xa3,               /* DTIM, retries, ack timeout*/
+    0x1d, 0x82, 0x4e,               /* SIFS, DIFS, PIFS */
+    0x7f, 0xff,                     /* RTS threshold */
+    0x04, 0xe2, 0x38, 0xA4,         /* scan_dwell, max_scan_dwell */
+    0x05,                           /* assoc resp timeout thresh */
+    0x08, 0x02, 0x08,               /* adhoc, infra, super cycle max*/
+    0,                              /* Promiscuous mode */
+    0x0c, 0x0bd,                    /* Unique word */
+    0x32,                           /* Slot time */
+    0xff, 0xff,                     /* roam-low snr, low snr count */
+    0x05, 0xff,                     /* Infra, adhoc missed bcn thresh */
+    0x01, 0x0b, 0x4f,               /* USA, hop pattern, hop pat length */
+/* b4 - b5 differences start here */
+    0x00, 0x3f,                     /* CW max */
+    0x00, 0x0f,                     /* CW min */
+    0x04, 0x08,                     /* Noise gain, limit offset */
+    0x28, 0x28,                     /* det rssi, med busy offsets */
+    7,                              /* det sync thresh */
+    0, 2, 2,                        /* test mode, min, max */
+    0,                              /* allow broadcast SSID probe resp */
+    0, 0,                           /* privacy must start, can join */
+    2, 0, 0, 0, 0, 0, 0, 0          /* basic rate set */
+};
+
+static UCHAR b4_default_startup_parms[] = {
+    0,   0,                         /* Adhoc station */
+   'L','I','N','U','X', 0,  0,  0,  /* 32 char ESSID */
+    0,  0,  0,  0,  0,  0,  0,  0,
+    0,  0,  0,  0,  0,  0,  0,  0,
+    0,  0,  0,  0,  0,  0,  0,  0,
+    1,  0,                          /* Active scan, CA Mode */
+    0,  0,  0,  0,  0,  0,          /* No default MAC addr  */
+    0x7f, 0xff,                     /* Frag threshold */
+    0x02, 0x00,                     /* Hop time */
+    0x00, 0x01,                     /* Beacon period */
+    0x01, 0x07, 0xa3,               /* DTIM, retries, ack timeout*/
+    0x1d, 0x82, 0xce,               /* SIFS, DIFS, PIFS */
+    0x7f, 0xff,                     /* RTS threshold */
+    0xfb, 0x1e, 0xc7, 0x5c,         /* scan_dwell, max_scan_dwell */
+    0x05,                           /* assoc resp timeout thresh */
+    0x04, 0x02, 0x4,                /* adhoc, infra, super cycle max*/
+    0,                              /* Promiscuous mode */
+    0x0c, 0x0bd,                    /* Unique word */
+    0x4e,                           /* Slot time (TBD seems wrong)*/
+    0xff, 0xff,                     /* roam-low snr, low snr count */
+    0x05, 0xff,                     /* Infra, adhoc missed bcn thresh */
+    0x01, 0x0b, 0x4e,               /* USA, hop pattern, hop pat length */
+/* b4 - b5 differences start here */
+    0x3f, 0x0f,                     /* CW max, min */
+    0x04, 0x08,                     /* Noise gain, limit offset */
+    0x28, 0x28,                     /* det rssi, med busy offsets */
+    7,                              /* det sync thresh */
+    0, 2, 2                         /* test mode, min, max*/
+};
+/*===========================================================================*/
+static unsigned char eth2_llc[] = {0xaa, 0xaa, 3, 0, 0, 0};
+
+static char hop_pattern_length[] = { 1,
+	     USA_HOP_MOD,             EUROPE_HOP_MOD,
+	     JAPAN_HOP_MOD,           KOREA_HOP_MOD,
+	     SPAIN_HOP_MOD,           FRANCE_HOP_MOD,
+	     ISRAEL_HOP_MOD,          AUSTRALIA_HOP_MOD,
+	     JAPAN_TEST_HOP_MOD
+};
+
+static char rcsid[] = "Raylink/WebGear wireless LAN - Corey <Thomas corey@world.std.com>";
+
+/*=============================================================================
+    ray_attach() creates an "instance" of the driver, allocating
+    local data structures for one device.  The device is registered
+    with Card Services.
+    The dev_link structure is initialized, but we don't actually
+    configure the card at this point -- we wait until we receive a
+    card insertion event.
+=============================================================================*/
+static dev_link_t *ray_attach(void)
+{
+    client_reg_t client_reg;
+    dev_link_t *link;
+    ray_dev_t *local;
+    int ret;
+    struct net_device *dev;
+    
+    DEBUG(1, "ray_attach()\n");
+
+    /* Initialize the dev_link_t structure */
+    link = kmalloc(sizeof(struct dev_link_t), GFP_KERNEL);
+
+    if (!link)
+	    return NULL;
+
+    /* Allocate space for private device-specific data */
+    dev = alloc_etherdev(sizeof(ray_dev_t));
+
+    if (!dev)
+	    goto fail_alloc_dev;
+
+    local = dev->priv;
+
+    memset(link, 0, sizeof(struct dev_link_t));
+
+    /* The io structure describes IO port mapping. None used here */
+    link->io.NumPorts1 = 0;
+    link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
+    link->io.IOAddrLines = 5;
+
+    /* Interrupt setup. For PCMCIA, driver takes what's given */
+    link->irq.Attributes = IRQ_TYPE_EXCLUSIVE | IRQ_HANDLE_PRESENT;
+    link->irq.IRQInfo1 = IRQ_LEVEL_ID;
+    link->irq.Handler = &ray_interrupt;
+
+    /* General socket configuration */
+    link->conf.Attributes = CONF_ENABLE_IRQ;
+    link->conf.Vcc = 50;
+    link->conf.IntType = INT_MEMORY_AND_IO;
+    link->conf.ConfigIndex = 1;
+    link->conf.Present = PRESENT_OPTION;
+
+    link->priv = dev;
+    link->irq.Instance = dev;
+    
+    local->finder = link;
+    local->card_status = CARD_INSERTED;
+    local->authentication_state = UNAUTHENTICATED;
+    local->num_multi = 0;
+    DEBUG(2,"ray_attach link = %p,  dev = %p,  local = %p, intr = %p\n",
+          link,dev,local,&ray_interrupt);
+
+    /* Raylink entries in the device structure */
+    dev->hard_start_xmit = &ray_dev_start_xmit;
+    dev->set_config = &ray_dev_config;
+    dev->get_stats  = &ray_get_stats;
+    dev->do_ioctl = &ray_dev_ioctl;
+    SET_ETHTOOL_OPS(dev, &netdev_ethtool_ops);
+#if WIRELESS_EXT > 7	/* If wireless extension exist in the kernel */
+    dev->get_wireless_stats = ray_get_wireless_stats;
+#endif
+
+    dev->set_multicast_list = &set_multicast_list;
+
+    DEBUG(2,"ray_cs ray_attach calling ether_setup.)\n");
+    SET_MODULE_OWNER(dev);
+    dev->init = &ray_dev_init;
+    dev->open = &ray_open;
+    dev->stop = &ray_dev_close;
+    netif_stop_queue(dev);
+
+    /* Register with Card Services */
+    link->next = dev_list;
+    dev_list = link;
+    client_reg.dev_info = &dev_info;
+    client_reg.EventMask =
+        CS_EVENT_CARD_INSERTION | CS_EVENT_CARD_REMOVAL |
+        CS_EVENT_RESET_PHYSICAL | CS_EVENT_CARD_RESET |
+        CS_EVENT_PM_SUSPEND | CS_EVENT_PM_RESUME;
+    client_reg.event_handler = &ray_event;
+    client_reg.Version = 0x0210;
+    client_reg.event_callback_args.client_data = link;
+
+    DEBUG(2,"ray_cs ray_attach calling pcmcia_register_client(...)\n");
+
+    init_timer(&local->timer);
+
+    ret = pcmcia_register_client(&link->handle, &client_reg);
+    if (ret != 0) {
+        printk("ray_cs ray_attach RegisterClient unhappy - detaching\n");
+        cs_error(link->handle, RegisterClient, ret);
+        ray_detach(link);
+        return NULL;
+    }
+    DEBUG(2,"ray_cs ray_attach ending\n");
+    return link;
+
+fail_alloc_dev:
+    kfree(link);
+    return NULL;
+} /* ray_attach */
+/*=============================================================================
+    This deletes a driver "instance".  The device is de-registered
+    with Card Services.  If it has been released, all local data
+    structures are freed.  Otherwise, the structures will be freed
+    when the device is released.
+=============================================================================*/
+static void ray_detach(dev_link_t *link)
+{
+    dev_link_t **linkp;
+
+    DEBUG(1, "ray_detach(0x%p)\n", link);
+    
+    /* Locate device structure */
+    for (linkp = &dev_list; *linkp; linkp = &(*linkp)->next)
+        if (*linkp == link) break;
+    if (*linkp == NULL)
+        return;
+
+    /* If the device is currently configured and active, we won't
+      actually delete it yet.  Instead, it is marked so that when
+      the release() function is called, that will trigger a proper
+      detach().
+    */
+    if (link->state & DEV_CONFIG)
+        ray_release(link);
+
+    /* Break the link with Card Services */
+    if (link->handle)
+        pcmcia_deregister_client(link->handle);
+    
+    /* Unlink device structure, free pieces */
+    *linkp = link->next;
+    if (link->priv) {
+        struct net_device *dev = link->priv;
+	if (link->dev) unregister_netdev(dev);
+        free_netdev(dev);
+    }
+    kfree(link);
+    DEBUG(2,"ray_cs ray_detach ending\n");
+} /* ray_detach */
+/*=============================================================================
+    ray_config() is run after a CARD_INSERTION event
+    is received, to configure the PCMCIA socket, and to make the
+    ethernet device available to the system.
+=============================================================================*/
+#define CS_CHECK(fn, ret) \
+do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
+#define MAX_TUPLE_SIZE 128
+static void ray_config(dev_link_t *link)
+{
+    client_handle_t handle = link->handle;
+    tuple_t tuple;
+    cisparse_t parse;
+    int last_fn = 0, last_ret = 0;
+    int i;
+    u_char buf[MAX_TUPLE_SIZE];
+    win_req_t req;
+    memreq_t mem;
+    struct net_device *dev = (struct net_device *)link->priv;
+    ray_dev_t *local = (ray_dev_t *)dev->priv;
+
+    DEBUG(1, "ray_config(0x%p)\n", link);
+
+    /* This reads the card's CONFIG tuple to find its configuration regs */
+    tuple.DesiredTuple = CISTPL_CONFIG;
+    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+    tuple.TupleData = buf;
+    tuple.TupleDataMax = MAX_TUPLE_SIZE;
+    tuple.TupleOffset = 0;
+    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
+    CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+    link->conf.ConfigBase = parse.config.base;
+    link->conf.Present = parse.config.rmask[0];
+
+    /* Determine card type and firmware version */
+    buf[0] = buf[MAX_TUPLE_SIZE - 1] = 0;
+    tuple.DesiredTuple = CISTPL_VERS_1;
+    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+    tuple.TupleData = buf;
+    tuple.TupleDataMax = MAX_TUPLE_SIZE;
+    tuple.TupleOffset = 2;
+    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
+
+    for (i=0; i<tuple.TupleDataLen - 4; i++) 
+        if (buf[i] == 0) buf[i] = ' ';
+    printk(KERN_INFO "ray_cs Detected: %s\n",buf);
+
+    /* Configure card */
+    link->state |= DEV_CONFIG;
+
+    /* Now allocate an interrupt line.  Note that this does not
+       actually assign a handler to the interrupt.
+    */
+    CS_CHECK(RequestIRQ, pcmcia_request_irq(link->handle, &link->irq));
+    dev->irq = link->irq.AssignedIRQ;
+    
+    /* This actually configures the PCMCIA socket -- setting up
+       the I/O windows and the interrupt mapping.
+    */
+    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link->handle, &link->conf));
+
+/*** Set up 32k window for shared memory (transmit and control) ************/
+    req.Attributes = WIN_DATA_WIDTH_8 | WIN_MEMORY_TYPE_CM | WIN_ENABLE | WIN_USE_WAIT;
+    req.Base = 0;
+    req.Size = 0x8000;
+    req.AccessSpeed = ray_mem_speed;
+    CS_CHECK(RequestWindow, pcmcia_request_window(&link->handle, &req, &link->win));
+    mem.CardOffset = 0x0000; mem.Page = 0;
+    CS_CHECK(MapMemPage, pcmcia_map_mem_page(link->win, &mem));
+    local->sram = ioremap(req.Base,req.Size);
+
+/*** Set up 16k window for shared memory (receive buffer) ***************/
+    req.Attributes = WIN_DATA_WIDTH_8 | WIN_MEMORY_TYPE_CM | WIN_ENABLE | WIN_USE_WAIT;
+    req.Base = 0;
+    req.Size = 0x4000;
+    req.AccessSpeed = ray_mem_speed;
+    CS_CHECK(RequestWindow, pcmcia_request_window(&link->handle, &req, &local->rmem_handle));
+    mem.CardOffset = 0x8000; mem.Page = 0;
+    CS_CHECK(MapMemPage, pcmcia_map_mem_page(local->rmem_handle, &mem));
+    local->rmem = ioremap(req.Base,req.Size);
+
+/*** Set up window for attribute memory ***********************************/
+    req.Attributes = WIN_DATA_WIDTH_8 | WIN_MEMORY_TYPE_AM | WIN_ENABLE | WIN_USE_WAIT;
+    req.Base = 0;
+    req.Size = 0x1000;
+    req.AccessSpeed = ray_mem_speed;
+    CS_CHECK(RequestWindow, pcmcia_request_window(&link->handle, &req, &local->amem_handle));
+    mem.CardOffset = 0x0000; mem.Page = 0;
+    CS_CHECK(MapMemPage, pcmcia_map_mem_page(local->amem_handle, &mem));
+    local->amem = ioremap(req.Base,req.Size);
+
+    DEBUG(3,"ray_config sram=%p\n",local->sram);
+    DEBUG(3,"ray_config rmem=%p\n",local->rmem);
+    DEBUG(3,"ray_config amem=%p\n",local->amem);
+    if (ray_init(dev) < 0) {
+        ray_release(link);
+        return;
+    }
+
+    SET_NETDEV_DEV(dev, &handle_to_dev(handle));
+    i = register_netdev(dev);
+    if (i != 0) {
+        printk("ray_config register_netdev() failed\n");
+        ray_release(link);
+        return;
+    }
+
+    strcpy(local->node.dev_name, dev->name);
+    link->dev = &local->node;
+
+    link->state &= ~DEV_CONFIG_PENDING;
+    printk(KERN_INFO "%s: RayLink, irq %d, hw_addr ",
+       dev->name, dev->irq);
+    for (i = 0; i < 6; i++)
+    printk("%02X%s", dev->dev_addr[i], ((i<5) ? ":" : "\n"));
+
+    return;
+
+cs_failed:
+    cs_error(link->handle, last_fn, last_ret);
+
+    ray_release(link);
+} /* ray_config */
+
+static inline struct ccs __iomem *ccs_base(ray_dev_t *dev)
+{
+	return dev->sram + CCS_BASE;
+}
+
+static inline struct rcs __iomem *rcs_base(ray_dev_t *dev)
+{
+	/*
+	 * This looks nonsensical, since there is a separate
+	 * RCS_BASE. But the difference between a "struct rcs"
+	 * and a "struct ccs" ends up being in the _index_ off
+	 * the base, so the base pointer is the same for both
+	 * ccs/rcs.
+	 */
+	return dev->sram + CCS_BASE;
+}
+
+/*===========================================================================*/
+static int ray_init(struct net_device *dev)
+{
+    int i;
+    UCHAR *p;
+    struct ccs __iomem *pccs;
+    ray_dev_t *local = (ray_dev_t *)dev->priv;
+    dev_link_t *link = local->finder;
+    DEBUG(1, "ray_init(0x%p)\n", dev);
+    if (!(link->state & DEV_PRESENT)) {
+        DEBUG(0,"ray_init - device not present\n");
+        return -1;
+    }
+
+    local->net_type = net_type;
+    local->sta_type = TYPE_STA;
+
+    /* Copy the startup results to local memory */
+    memcpy_fromio(&local->startup_res, local->sram + ECF_TO_HOST_BASE,\
+           sizeof(struct startup_res_6));
+
+    /* Check Power up test status and get mac address from card */
+    if (local->startup_res.startup_word != 0x80) {
+    printk(KERN_INFO "ray_init ERROR card status = %2x\n",
+           local->startup_res.startup_word);
+        local->card_status = CARD_INIT_ERROR;
+        return -1;
+    }
+
+    local->fw_ver = local->startup_res.firmware_version[0];
+    local->fw_bld = local->startup_res.firmware_version[1];
+    local->fw_var = local->startup_res.firmware_version[2];
+    DEBUG(1,"ray_init firmware version %d.%d \n",local->fw_ver, local->fw_bld);
+
+    local->tib_length = 0x20;
+    if ((local->fw_ver == 5) && (local->fw_bld >= 30))
+        local->tib_length = local->startup_res.tib_length;
+    DEBUG(2,"ray_init tib_length = 0x%02x\n", local->tib_length);
+    /* Initialize CCS's to buffer free state */
+    pccs = ccs_base(local);
+    for (i=0;  i<NUMBER_OF_CCS;  i++) {
+        writeb(CCS_BUFFER_FREE, &(pccs++)->buffer_status);
+    }
+    init_startup_params(local);
+
+    /* copy mac address to startup parameters */
+    if (parse_addr(phy_addr, local->sparm.b4.a_mac_addr))
+    {
+        p = local->sparm.b4.a_mac_addr;
+    }
+    else
+    {
+        memcpy(&local->sparm.b4.a_mac_addr,
+               &local->startup_res.station_addr, ADDRLEN);
+        p = local->sparm.b4.a_mac_addr;
+    }
+
+    clear_interrupt(local); /* Clear any interrupt from the card */
+    local->card_status = CARD_AWAITING_PARAM;
+    DEBUG(2,"ray_init ending\n");
+    return 0;
+} /* ray_init */
+/*===========================================================================*/
+/* Download startup parameters to the card and command it to read them       */
+static int dl_startup_params(struct net_device *dev)
+{
+    int ccsindex;
+    ray_dev_t *local = (ray_dev_t *)dev->priv;
+    struct ccs __iomem *pccs;
+    dev_link_t *link = local->finder;
+
+    DEBUG(1,"dl_startup_params entered\n");
+    if (!(link->state & DEV_PRESENT)) {
+        DEBUG(2,"ray_cs dl_startup_params - device not present\n");
+        return -1;
+    }
+    
+    /* Copy parameters to host to ECF area */
+    if (local->fw_ver == 0x55) 
+        memcpy_toio(local->sram + HOST_TO_ECF_BASE, &local->sparm.b4,
+               sizeof(struct b4_startup_params));
+    else
+        memcpy_toio(local->sram + HOST_TO_ECF_BASE, &local->sparm.b5,
+               sizeof(struct b5_startup_params));
+
+    
+    /* Fill in the CCS fields for the ECF */
+    if ((ccsindex = get_free_ccs(local)) < 0) return -1;
+    local->dl_param_ccs = ccsindex;
+    pccs = ccs_base(local) + ccsindex;
+    writeb(CCS_DOWNLOAD_STARTUP_PARAMS, &pccs->cmd);
+    DEBUG(2,"dl_startup_params start ccsindex = %d\n", local->dl_param_ccs);
+    /* Interrupt the firmware to process the command */
+    if (interrupt_ecf(local, ccsindex)) {
+        printk(KERN_INFO "ray dl_startup_params failed - "
+           "ECF not ready for intr\n");
+        local->card_status = CARD_DL_PARAM_ERROR;
+        writeb(CCS_BUFFER_FREE, &(pccs++)->buffer_status);
+        return -2;
+    }
+    local->card_status = CARD_DL_PARAM;
+    /* Start kernel timer to wait for dl startup to complete. */
+    local->timer.expires = jiffies + HZ/2;
+    local->timer.data = (long)local;
+    local->timer.function = &verify_dl_startup;
+    add_timer(&local->timer);
+    DEBUG(2,"ray_cs dl_startup_params started timer for verify_dl_startup\n");
+    return 0;
+} /* dl_startup_params */
+/*===========================================================================*/
+static void init_startup_params(ray_dev_t *local)
+{
+    int i; 
+
+    if (country > JAPAN_TEST) country = USA;
+    else
+        if (country < USA) country = USA;
+    /* structure for hop time and beacon period is defined here using 
+     * New 802.11D6.1 format.  Card firmware is still using old format
+     * until version 6.
+     *    Before                    After
+     *    a_hop_time ms byte        a_hop_time ms byte
+     *    a_hop_time 2s byte        a_hop_time ls byte
+     *    a_hop_time ls byte        a_beacon_period ms byte
+     *    a_beacon_period           a_beacon_period ls byte
+     *
+     *    a_hop_time = uS           a_hop_time = KuS
+     *    a_beacon_period = hops    a_beacon_period = KuS
+     */                             /* 64ms = 010000 */
+    if (local->fw_ver == 0x55)  {
+        memcpy((UCHAR *)&local->sparm.b4, b4_default_startup_parms, 
+               sizeof(struct b4_startup_params));
+        /* Translate sane kus input values to old build 4/5 format */
+        /* i = hop time in uS truncated to 3 bytes */
+        i = (hop_dwell * 1024) & 0xffffff;
+        local->sparm.b4.a_hop_time[0] = (i >> 16) & 0xff;
+        local->sparm.b4.a_hop_time[1] = (i >> 8) & 0xff;
+        local->sparm.b4.a_beacon_period[0] = 0;
+        local->sparm.b4.a_beacon_period[1] =
+            ((beacon_period/hop_dwell) - 1) & 0xff;
+        local->sparm.b4.a_curr_country_code = country;
+        local->sparm.b4.a_hop_pattern_length = 
+            hop_pattern_length[(int)country] - 1;
+        if (bc)
+        {
+            local->sparm.b4.a_ack_timeout = 0x50;
+            local->sparm.b4.a_sifs = 0x3f;
+        }
+    }
+    else {    /* Version 5 uses real kus values */
+        memcpy((UCHAR *)&local->sparm.b5, b5_default_startup_parms, 
+               sizeof(struct b5_startup_params));
+
+        local->sparm.b5.a_hop_time[0] = (hop_dwell >> 8) & 0xff;
+        local->sparm.b5.a_hop_time[1] = hop_dwell & 0xff;
+        local->sparm.b5.a_beacon_period[0] = (beacon_period >> 8) & 0xff;
+        local->sparm.b5.a_beacon_period[1] = beacon_period & 0xff;
+        if (psm)
+            local->sparm.b5.a_power_mgt_state = 1;
+        local->sparm.b5.a_curr_country_code = country;
+        local->sparm.b5.a_hop_pattern_length = 
+            hop_pattern_length[(int)country];
+    }
+    
+    local->sparm.b4.a_network_type = net_type & 0x01;
+    local->sparm.b4.a_acting_as_ap_status = TYPE_STA;
+
+    if (essid != NULL)
+        strncpy(local->sparm.b4.a_current_ess_id, essid, ESSID_SIZE);
+} /* init_startup_params */ 
+/*===========================================================================*/
+static void verify_dl_startup(u_long data)
+{
+    ray_dev_t *local = (ray_dev_t *)data;
+    struct ccs __iomem *pccs = ccs_base(local) + local->dl_param_ccs;
+    UCHAR status;
+    dev_link_t *link = local->finder;
+
+    if (!(link->state & DEV_PRESENT)) {
+        DEBUG(2,"ray_cs verify_dl_startup - device not present\n");
+        return;
+    }
+#ifdef PCMCIA_DEBUG
+    if (pc_debug > 2) {
+    int i;
+    printk(KERN_DEBUG "verify_dl_startup parameters sent via ccs %d:\n",
+           local->dl_param_ccs);
+        for (i=0; i<sizeof(struct b5_startup_params); i++) {
+            printk(" %2x", (unsigned int) readb(local->sram + HOST_TO_ECF_BASE + i));
+        }
+    printk("\n");
+    }
+#endif
+
+    status = readb(&pccs->buffer_status);
+    if (status!= CCS_BUFFER_FREE)
+    {
+        printk(KERN_INFO "Download startup params failed.  Status = %d\n",
+           status);
+        local->card_status = CARD_DL_PARAM_ERROR;
+        return;
+    }
+    if (local->sparm.b4.a_network_type == ADHOC)
+        start_net((u_long)local);
+    else
+        join_net((u_long)local);
+
+    return;
+} /* end verify_dl_startup */
+/*===========================================================================*/
+/* Command card to start a network */
+static void start_net(u_long data)
+{
+    ray_dev_t *local = (ray_dev_t *)data;
+    struct ccs __iomem *pccs;
+    int ccsindex;
+    dev_link_t *link = local->finder;
+    if (!(link->state & DEV_PRESENT)) {
+        DEBUG(2,"ray_cs start_net - device not present\n");
+        return;
+    }
+    /* Fill in the CCS fields for the ECF */
+    if ((ccsindex = get_free_ccs(local)) < 0) return;
+    pccs = ccs_base(local) + ccsindex;
+    writeb(CCS_START_NETWORK, &pccs->cmd);
+    writeb(0, &pccs->var.start_network.update_param);
+    /* Interrupt the firmware to process the command */
+    if (interrupt_ecf(local, ccsindex)) {
+        DEBUG(1,"ray start net failed - card not ready for intr\n");
+        writeb(CCS_BUFFER_FREE, &(pccs++)->buffer_status);
+        return;
+    }
+    local->card_status = CARD_DOING_ACQ;
+    return;
+} /* end start_net */
+/*===========================================================================*/
+/* Command card to join a network */
+static void join_net(u_long data)
+{
+    ray_dev_t *local = (ray_dev_t *)data;
+
+    struct ccs __iomem *pccs;
+    int ccsindex;
+    dev_link_t *link = local->finder;
+    
+    if (!(link->state & DEV_PRESENT)) {
+        DEBUG(2,"ray_cs join_net - device not present\n");
+        return;
+    }
+    /* Fill in the CCS fields for the ECF */
+    if ((ccsindex = get_free_ccs(local)) < 0) return;
+    pccs = ccs_base(local) + ccsindex;
+    writeb(CCS_JOIN_NETWORK, &pccs->cmd);
+    writeb(0, &pccs->var.join_network.update_param);
+    writeb(0, &pccs->var.join_network.net_initiated);
+    /* Interrupt the firmware to process the command */
+    if (interrupt_ecf(local, ccsindex)) {
+        DEBUG(1,"ray join net failed - card not ready for intr\n");
+        writeb(CCS_BUFFER_FREE, &(pccs++)->buffer_status);
+        return;
+    }
+    local->card_status = CARD_DOING_ACQ;
+    return;
+}
+/*============================================================================
+    After a card is removed, ray_release() will unregister the net
+    device, and release the PCMCIA configuration.  If the device is
+    still open, this will be postponed until it is closed.
+=============================================================================*/
+static void ray_release(dev_link_t *link)
+{
+    struct net_device *dev = link->priv; 
+    ray_dev_t *local = dev->priv;
+    int i;
+    
+    DEBUG(1, "ray_release(0x%p)\n", link);
+
+    del_timer(&local->timer);
+    link->state &= ~DEV_CONFIG;
+
+    iounmap(local->sram);
+    iounmap(local->rmem);
+    iounmap(local->amem);
+    /* Do bother checking to see if these succeed or not */
+    i = pcmcia_release_window(link->win);
+    if ( i != CS_SUCCESS ) DEBUG(0,"ReleaseWindow(link->win) ret = %x\n",i);
+    i = pcmcia_release_window(local->amem_handle);
+    if ( i != CS_SUCCESS ) DEBUG(0,"ReleaseWindow(local->amem) ret = %x\n",i);
+    i = pcmcia_release_window(local->rmem_handle);
+    if ( i != CS_SUCCESS ) DEBUG(0,"ReleaseWindow(local->rmem) ret = %x\n",i);
+    i = pcmcia_release_configuration(link->handle);
+    if ( i != CS_SUCCESS ) DEBUG(0,"ReleaseConfiguration ret = %x\n",i);
+    i = pcmcia_release_irq(link->handle, &link->irq);
+    if ( i != CS_SUCCESS ) DEBUG(0,"ReleaseIRQ ret = %x\n",i);
+
+    DEBUG(2,"ray_release ending\n");
+}
+
+/*=============================================================================
+    The card status event handler.  Mostly, this schedules other
+    stuff to run after an event is received.  A CARD_REMOVAL event
+    also sets some flags to discourage the net drivers from trying
+    to talk to the card any more.
+
+    When a CARD_REMOVAL event is received, we immediately set a flag
+    to block future accesses to this device.  All the functions that
+    actually access the device should check this flag to make sure
+    the card is still present.
+=============================================================================*/
+static int ray_event(event_t event, int priority,
+                     event_callback_args_t *args)
+{
+    dev_link_t *link = args->client_data;
+    struct net_device *dev = link->priv;
+    ray_dev_t *local = (ray_dev_t *)dev->priv;
+    DEBUG(1, "ray_event(0x%06x)\n", event);
+    
+    switch (event) {
+    case CS_EVENT_CARD_REMOVAL:
+        link->state &= ~DEV_PRESENT;
+        netif_device_detach(dev);
+        if (link->state & DEV_CONFIG) {
+	    ray_release(link);
+            del_timer(&local->timer);
+        }
+        break;
+    case CS_EVENT_CARD_INSERTION:
+        link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
+        ray_config(link);
+        break;
+    case CS_EVENT_PM_SUSPEND:
+        link->state |= DEV_SUSPEND;
+        /* Fall through... */
+    case CS_EVENT_RESET_PHYSICAL:
+        if (link->state & DEV_CONFIG) {
+            if (link->open)
+            	netif_device_detach(dev);
+
+            pcmcia_release_configuration(link->handle);
+        }
+        break;
+    case CS_EVENT_PM_RESUME:
+        link->state &= ~DEV_SUSPEND;
+        /* Fall through... */
+    case CS_EVENT_CARD_RESET:
+        if (link->state & DEV_CONFIG) {
+            pcmcia_request_configuration(link->handle, &link->conf);
+            if (link->open) {
+                ray_reset(dev);
+		netif_device_attach(dev);
+            }
+        }
+        break;
+    }
+    return 0;
+    DEBUG(2,"ray_event ending\n");
+} /* ray_event */
+/*===========================================================================*/
+int ray_dev_init(struct net_device *dev)
+{
+#ifdef RAY_IMMEDIATE_INIT
+    int i;
+#endif	/* RAY_IMMEDIATE_INIT */
+    ray_dev_t *local = dev->priv;
+    dev_link_t *link = local->finder;
+
+    DEBUG(1,"ray_dev_init(dev=%p)\n",dev);
+    if (!(link->state & DEV_PRESENT)) {
+        DEBUG(2,"ray_dev_init - device not present\n");
+        return -1;
+    }
+#ifdef RAY_IMMEDIATE_INIT
+    /* Download startup parameters */
+    if ( (i = dl_startup_params(dev)) < 0)
+    {
+        printk(KERN_INFO "ray_dev_init dl_startup_params failed - "
+           "returns 0x%x\n",i);
+        return -1;
+    }
+#else	/* RAY_IMMEDIATE_INIT */
+    /* Postpone the card init so that we can still configure the card,
+     * for example using the Wireless Extensions. The init will happen
+     * in ray_open() - Jean II */
+    DEBUG(1,"ray_dev_init: postponing card init to ray_open() ; Status = %d\n",
+	  local->card_status);
+#endif	/* RAY_IMMEDIATE_INIT */
+
+    /* copy mac and broadcast addresses to linux device */
+    memcpy(&dev->dev_addr, &local->sparm.b4.a_mac_addr, ADDRLEN);
+    memset(dev->broadcast, 0xff, ETH_ALEN);
+
+    DEBUG(2,"ray_dev_init ending\n");
+    return 0;
+}
+/*===========================================================================*/
+static int ray_dev_config(struct net_device *dev, struct ifmap *map)
+{
+    ray_dev_t *local = dev->priv;
+    dev_link_t *link = local->finder;
+    /* Dummy routine to satisfy device structure */
+    DEBUG(1,"ray_dev_config(dev=%p,ifmap=%p)\n",dev,map);
+    if (!(link->state & DEV_PRESENT)) {
+        DEBUG(2,"ray_dev_config - device not present\n");
+        return -1;
+    }
+
+    return 0;
+}
+/*===========================================================================*/
+static int ray_dev_start_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+    ray_dev_t *local = dev->priv;
+    dev_link_t *link = local->finder;
+    short length = skb->len;
+
+    if (!(link->state & DEV_PRESENT)) {
+        DEBUG(2,"ray_dev_start_xmit - device not present\n");
+        return -1;
+    }
+    DEBUG(3,"ray_dev_start_xmit(skb=%p, dev=%p)\n",skb,dev);
+    if (local->authentication_state == NEED_TO_AUTH) {
+        DEBUG(0,"ray_cs Sending authentication request.\n");
+        if (!build_auth_frame (local, local->auth_id, OPEN_AUTH_REQUEST)) {
+            local->authentication_state = AUTHENTICATED;
+            netif_stop_queue(dev);
+            return 1;
+        }
+    }
+
+    if (length < ETH_ZLEN)
+    {
+    	skb = skb_padto(skb, ETH_ZLEN);
+    	if (skb == NULL)
+    		return 0;
+    	length = ETH_ZLEN;
+    }
+    switch (ray_hw_xmit( skb->data, length, dev, DATA_TYPE)) {
+        case XMIT_NO_CCS:
+        case XMIT_NEED_AUTH:
+	    netif_stop_queue(dev);
+            return 1;
+        case XMIT_NO_INTR:
+        case XMIT_MSG_BAD:
+        case XMIT_OK:
+        default:
+            dev->trans_start = jiffies;
+            dev_kfree_skb(skb);
+            return 0;
+    }
+    return 0;
+} /* ray_dev_start_xmit */
+/*===========================================================================*/
+static int ray_hw_xmit(unsigned char* data, int len, struct net_device* dev, 
+                UCHAR msg_type)
+{
+    ray_dev_t *local = (ray_dev_t *)dev->priv;
+    struct ccs __iomem *pccs;
+    int ccsindex;
+    int offset;
+    struct tx_msg __iomem *ptx; /* Address of xmit buffer in PC space */
+    short int addr;     /* Address of xmit buffer in card space */
+    
+    DEBUG(3,"ray_hw_xmit(data=%p, len=%d, dev=%p)\n",data,len,dev);
+    if (len + TX_HEADER_LENGTH > TX_BUF_SIZE)
+    {
+        printk(KERN_INFO "ray_hw_xmit packet too large: %d bytes\n",len);
+        return XMIT_MSG_BAD;
+    }
+	switch (ccsindex = get_free_tx_ccs(local)) {
+	case ECCSBUSY:
+		DEBUG(2,"ray_hw_xmit tx_ccs table busy\n");
+	case ECCSFULL:
+        DEBUG(2,"ray_hw_xmit No free tx ccs\n");
+	case ECARDGONE:
+	netif_stop_queue(dev);
+        return XMIT_NO_CCS;
+	default:
+		break;
+	}
+    addr = TX_BUF_BASE + (ccsindex << 11);
+
+    if (msg_type == DATA_TYPE) {
+        local->stats.tx_bytes += len;
+        local->stats.tx_packets++;
+    }
+
+    ptx = local->sram + addr;
+
+    ray_build_header(local, ptx, msg_type, data);
+    if (translate) {
+        offset = translate_frame(local, ptx, data, len);
+    }
+    else { /* Encapsulate frame */
+        /* TBD TIB length will move address of ptx->var */
+        memcpy_toio(&ptx->var, data, len);
+        offset = 0;
+    }
+
+    /* fill in the CCS */
+    pccs = ccs_base(local) + ccsindex;
+    len += TX_HEADER_LENGTH + offset;
+    writeb(CCS_TX_REQUEST, &pccs->cmd);
+    writeb(addr >> 8, &pccs->var.tx_request.tx_data_ptr[0]);
+    writeb(local->tib_length, &pccs->var.tx_request.tx_data_ptr[1]);
+    writeb(len >> 8, &pccs->var.tx_request.tx_data_length[0]);
+    writeb(len & 0xff, &pccs->var.tx_request.tx_data_length[1]);
+/* TBD still need psm_cam? */
+    writeb(PSM_CAM, &pccs->var.tx_request.pow_sav_mode);
+    writeb(local->net_default_tx_rate, &pccs->var.tx_request.tx_rate);
+    writeb(0, &pccs->var.tx_request.antenna);
+    DEBUG(3,"ray_hw_xmit default_tx_rate = 0x%x\n",\
+          local->net_default_tx_rate);
+
+    /* Interrupt the firmware to process the command */
+    if (interrupt_ecf(local, ccsindex)) {
+        DEBUG(2,"ray_hw_xmit failed - ECF not ready for intr\n");
+/* TBD very inefficient to copy packet to buffer, and then not
+   send it, but the alternative is to queue the messages and that
+   won't be done for a while.  Maybe set tbusy until a CCS is free?
+*/
+        writeb(CCS_BUFFER_FREE, &pccs->buffer_status);
+        return XMIT_NO_INTR;
+    }
+    return XMIT_OK;
+} /* end ray_hw_xmit */
+/*===========================================================================*/
+static int translate_frame(ray_dev_t *local, struct tx_msg __iomem *ptx, unsigned char *data,
+                    int len)
+{
+    unsigned short int proto = ((struct ethhdr *)data)->h_proto;
+    if (ntohs(proto) >= 1536) { /* DIX II ethernet frame */
+        DEBUG(3,"ray_cs translate_frame DIX II\n");
+        /* Copy LLC header to card buffer */
+        memcpy_toio(&ptx->var, eth2_llc, sizeof(eth2_llc));
+        memcpy_toio( ((void __iomem *)&ptx->var) + sizeof(eth2_llc), (UCHAR *)&proto, 2);
+        if ((proto == 0xf380) || (proto == 0x3781)) {
+            /* This is the selective translation table, only 2 entries */
+            writeb(0xf8, &((struct snaphdr_t __iomem *)ptx->var)->org[3]);
+        }
+        /* Copy body of ethernet packet without ethernet header */
+        memcpy_toio((void __iomem *)&ptx->var + sizeof(struct snaphdr_t), \
+                    data + ETH_HLEN,  len - ETH_HLEN);
+        return (int) sizeof(struct snaphdr_t) - ETH_HLEN;
+    }
+    else { /* already  802 type, and proto is length */
+        DEBUG(3,"ray_cs translate_frame 802\n");
+        if (proto == 0xffff) { /* evil netware IPX 802.3 without LLC */
+        DEBUG(3,"ray_cs translate_frame evil IPX\n");
+            memcpy_toio(&ptx->var, data + ETH_HLEN,  len - ETH_HLEN);
+            return 0 - ETH_HLEN;
+        }
+        memcpy_toio(&ptx->var, data + ETH_HLEN,  len - ETH_HLEN);
+        return 0 - ETH_HLEN;
+    }
+    /* TBD do other frame types */
+} /* end translate_frame */
+/*===========================================================================*/
+static void ray_build_header(ray_dev_t *local, struct tx_msg __iomem *ptx, UCHAR msg_type,
+                unsigned char *data)
+{
+    writeb(PROTOCOL_VER | msg_type, &ptx->mac.frame_ctl_1);
+/*** IEEE 802.11 Address field assignments *************
+                TODS FROMDS   addr_1     addr_2          addr_3   addr_4
+Adhoc           0    0        dest       src (terminal)  BSSID    N/A
+AP to Terminal  0    1        dest       AP(BSSID)       source   N/A
+Terminal to AP  1    0        AP(BSSID)  src (terminal)  dest     N/A
+AP to AP        1    1        dest AP    src AP          dest     source      
+*******************************************************/
+    if (local->net_type == ADHOC) {   
+        writeb(0, &ptx->mac.frame_ctl_2);
+        memcpy_toio(ptx->mac.addr_1, ((struct ethhdr *)data)->h_dest, 2 * ADDRLEN);
+        memcpy_toio(ptx->mac.addr_3, local->bss_id, ADDRLEN);
+    }
+    else /* infrastructure */
+    {
+        if (local->sparm.b4.a_acting_as_ap_status)
+        {
+            writeb(FC2_FROM_DS, &ptx->mac.frame_ctl_2);
+            memcpy_toio(ptx->mac.addr_1, ((struct ethhdr *)data)->h_dest, ADDRLEN);
+            memcpy_toio(ptx->mac.addr_2, local->bss_id, 6);
+            memcpy_toio(ptx->mac.addr_3, ((struct ethhdr *)data)->h_source, ADDRLEN);
+        }
+        else /* Terminal */
+        {
+            writeb(FC2_TO_DS, &ptx->mac.frame_ctl_2);
+            memcpy_toio(ptx->mac.addr_1, local->bss_id, ADDRLEN);
+            memcpy_toio(ptx->mac.addr_2, ((struct ethhdr *)data)->h_source, ADDRLEN);
+            memcpy_toio(ptx->mac.addr_3, ((struct ethhdr *)data)->h_dest, ADDRLEN);
+        }
+    }
+} /* end encapsulate_frame */
+
+
+/*===========================================================================*/
+
+static void netdev_get_drvinfo(struct net_device *dev,
+			       struct ethtool_drvinfo *info)
+{
+	strcpy(info->driver, "ray_cs");
+}
+
+static struct ethtool_ops netdev_ethtool_ops = {
+	.get_drvinfo		= netdev_get_drvinfo,
+};
+
+/*====================================================================*/
+
+static int ray_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+{
+    ray_dev_t *local = (ray_dev_t *)dev->priv;
+    dev_link_t *link = local->finder;
+    int err = 0;
+#if WIRELESS_EXT > 7
+    struct iwreq *wrq = (struct iwreq *) ifr;
+#endif	/* WIRELESS_EXT > 7 */
+#ifdef WIRELESS_SPY
+    struct sockaddr	address[IW_MAX_SPY];
+#endif	/* WIRELESS_SPY */
+
+    if (!(link->state & DEV_PRESENT)) {
+        DEBUG(2,"ray_dev_ioctl - device not present\n");
+        return -1;
+    }
+    DEBUG(2,"ray_cs IOCTL dev=%p, ifr=%p, cmd = 0x%x\n",dev,ifr,cmd);
+    /* Validate the command */
+    switch (cmd)
+    {
+#if WIRELESS_EXT > 7
+      /* --------------- WIRELESS EXTENSIONS --------------- */
+      /* Get name */
+    case SIOCGIWNAME:
+      strcpy(wrq->u.name, "IEEE 802.11-FH");
+      break;
+
+      /* Get frequency/channel */
+    case SIOCGIWFREQ:
+      wrq->u.freq.m = local->sparm.b5.a_hop_pattern;
+      wrq->u.freq.e = 0;
+      break;
+
+      /* Set frequency/channel */
+    case SIOCSIWFREQ:
+      /* Reject if card is already initialised */
+      if(local->card_status != CARD_AWAITING_PARAM)
+	{
+	  err = -EBUSY;
+	  break;
+	}
+
+      /* Setting by channel number */
+      if ((wrq->u.freq.m > USA_HOP_MOD) || (wrq->u.freq.e > 0))
+	err = -EOPNOTSUPP;
+      else
+	  local->sparm.b5.a_hop_pattern = wrq->u.freq.m;
+      break;
+
+      /* Get current network name (ESSID) */
+    case SIOCGIWESSID:
+      if (wrq->u.data.pointer)
+	{
+	  char essid[IW_ESSID_MAX_SIZE + 1];
+	  /* Get the essid that was set */
+	  memcpy(essid, local->sparm.b5.a_current_ess_id,
+		 IW_ESSID_MAX_SIZE);
+	  essid[IW_ESSID_MAX_SIZE] = '\0';
+
+	  /* Push it out ! */
+	  wrq->u.data.length = strlen(essid) + 1;
+	  wrq->u.data.flags = 1; /* active */
+	  if (copy_to_user(wrq->u.data.pointer, essid, sizeof(essid)))
+		  err = -EFAULT;
+	}
+      break;
+
+      /* Set desired network name (ESSID) */
+    case SIOCSIWESSID:
+      /* Reject if card is already initialised */
+      if(local->card_status != CARD_AWAITING_PARAM)
+	{
+	  err = -EBUSY;
+	  break;
+	}
+
+	if (wrq->u.data.pointer)
+	{
+	    char	card_essid[IW_ESSID_MAX_SIZE + 1];
+	    
+	    /* Check if we asked for `any' */
+	    if(wrq->u.data.flags == 0)
+	    {
+		/* Corey : can you do that ? */
+		err = -EOPNOTSUPP;
+	    }
+	    else
+	    {
+		/* Check the size of the string */
+		if(wrq->u.data.length >
+		   IW_ESSID_MAX_SIZE + 1)
+		{
+		    err = -E2BIG;
+		    break;
+		}
+		if (copy_from_user(card_essid,
+				   wrq->u.data.pointer,
+				   wrq->u.data.length)) {
+			err = -EFAULT;
+			break;
+		}
+		card_essid[IW_ESSID_MAX_SIZE] = '\0';
+
+		/* Set the ESSID in the card */
+		memcpy(local->sparm.b5.a_current_ess_id, card_essid,
+		       IW_ESSID_MAX_SIZE);
+	    }
+	}
+	break;
+
+      /* Get current Access Point (BSSID in our case) */
+    case SIOCGIWAP:
+      memcpy(wrq->u.ap_addr.sa_data, local->bss_id, ETH_ALEN);
+      wrq->u.ap_addr.sa_family = ARPHRD_ETHER;
+      break;
+
+      /* Get the current bit-rate */
+    case SIOCGIWRATE:
+      if(local->net_default_tx_rate == 3)
+	wrq->u.bitrate.value = 2000000;		/* Hum... */
+      else
+	wrq->u.bitrate.value = local->net_default_tx_rate * 500000;
+      wrq->u.bitrate.fixed = 0;		/* We are in auto mode */
+      break;
+
+      /* Set the desired bit-rate */
+    case SIOCSIWRATE:
+      /* Check if rate is in range */
+      if((wrq->u.bitrate.value != 1000000) &&
+	 (wrq->u.bitrate.value != 2000000))
+	{
+	  err = -EINVAL;
+	  break;
+	}
+      /* Hack for 1.5 Mb/s instead of 2 Mb/s */
+      if((local->fw_ver == 0x55) &&		/* Please check */
+	 (wrq->u.bitrate.value == 2000000))
+	local->net_default_tx_rate = 3;
+      else
+	local->net_default_tx_rate = wrq->u.bitrate.value/500000;
+      break;
+
+      /* Get the current RTS threshold */
+    case SIOCGIWRTS:
+      wrq->u.rts.value = (local->sparm.b5.a_rts_threshold[0] << 8)
+	+ local->sparm.b5.a_rts_threshold[1];
+#if WIRELESS_EXT > 8
+      wrq->u.rts.disabled = (wrq->u.rts.value == 32767);
+#endif /* WIRELESS_EXT > 8 */
+      wrq->u.rts.fixed = 1;
+      break;
+
+      /* Set the desired RTS threshold */
+    case SIOCSIWRTS:
+    {
+	int rthr = wrq->u.rts.value;
+
+      /* Reject if card is already initialised */
+      if(local->card_status != CARD_AWAITING_PARAM)
+	{
+	  err = -EBUSY;
+	  break;
+	}
+
+	/* if(wrq->u.rts.fixed == 0) we should complain */
+#if WIRELESS_EXT > 8
+	if(wrq->u.rts.disabled)
+	    rthr = 32767;
+	else
+#endif /* WIRELESS_EXT > 8 */
+	    if((rthr < 0) || (rthr > 2347)) /* What's the max packet size ??? */
+	    {
+		err = -EINVAL;
+		break;
+	    }
+	local->sparm.b5.a_rts_threshold[0] = (rthr >> 8) & 0xFF;
+	local->sparm.b5.a_rts_threshold[1] = rthr & 0xFF;
+    }
+    break;
+
+      /* Get the current fragmentation threshold */
+    case SIOCGIWFRAG:
+      wrq->u.frag.value = (local->sparm.b5.a_frag_threshold[0] << 8)
+	+ local->sparm.b5.a_frag_threshold[1];
+#if WIRELESS_EXT > 8
+      wrq->u.frag.disabled = (wrq->u.frag.value == 32767);
+#endif /* WIRELESS_EXT > 8 */
+      wrq->u.frag.fixed = 1;
+      break;
+
+      /* Set the desired fragmentation threshold */
+    case SIOCSIWFRAG:
+    {
+	int fthr = wrq->u.frag.value;
+
+      /* Reject if card is already initialised */
+      if(local->card_status != CARD_AWAITING_PARAM)
+	{
+	  err = -EBUSY;
+	  break;
+	}
+
+	/* if(wrq->u.frag.fixed == 0) should complain */
+#if WIRELESS_EXT > 8
+	if(wrq->u.frag.disabled)
+	    fthr = 32767;
+	else
+#endif /* WIRELESS_EXT > 8 */
+	    if((fthr < 256) || (fthr > 2347)) /* To check out ! */
+	    {
+		err = -EINVAL;
+		break;
+	    }
+	local->sparm.b5.a_frag_threshold[0] = (fthr >> 8) & 0xFF;
+	local->sparm.b5.a_frag_threshold[1] = fthr & 0xFF;
+    }
+    break;
+
+#endif	/* WIRELESS_EXT > 7 */
+#if WIRELESS_EXT > 8
+
+      /* Get the current mode of operation */
+    case SIOCGIWMODE:
+      if(local->sparm.b5.a_network_type)
+	wrq->u.mode = IW_MODE_INFRA;
+      else
+	wrq->u.mode = IW_MODE_ADHOC;
+      break;
+
+      /* Set the current mode of operation */
+    case SIOCSIWMODE:
+    {
+	char card_mode = 1;
+	
+      /* Reject if card is already initialised */
+      if(local->card_status != CARD_AWAITING_PARAM)
+	{
+	  err = -EBUSY;
+	  break;
+	}
+
+	switch (wrq->u.mode)
+	{
+	case IW_MODE_ADHOC:
+	    card_mode = 0;
+	    // Fall through
+	case IW_MODE_INFRA:
+	    local->sparm.b5.a_network_type = card_mode;
+	    break;
+	default:
+	    err = -EINVAL;
+	}
+    }
+    break;
+
+#endif /* WIRELESS_EXT > 8 */
+#if WIRELESS_EXT > 7
+      /* ------------------ IWSPY SUPPORT ------------------ */
+      /* Define the range (variations) of above parameters */
+    case SIOCGIWRANGE:
+      /* Basic checking... */
+      if(wrq->u.data.pointer != (caddr_t) 0)
+	{
+	  struct iw_range	range;
+	  memset((char *) &range, 0, sizeof(struct iw_range));
+
+	  /* Set the length (very important for backward compatibility) */
+	  wrq->u.data.length = sizeof(struct iw_range);
+
+#if WIRELESS_EXT > 10
+	  /* Set the Wireless Extension versions */
+	  range.we_version_compiled = WIRELESS_EXT;
+	  range.we_version_source = 9;
+#endif /* WIRELESS_EXT > 10 */
+
+	  /* Set information in the range struct */
+	  range.throughput = 1.1 * 1000 * 1000;	/* Put the right number here */
+	  range.num_channels = hop_pattern_length[(int)country]; 
+	  range.num_frequency = 0;
+	  range.max_qual.qual = 0;
+	  range.max_qual.level = 255;	/* What's the correct value ? */
+	  range.max_qual.noise = 255;	/* Idem */
+	  range.num_bitrates = 2;
+	  range.bitrate[0] = 1000000;	/* 1 Mb/s */
+	  range.bitrate[1] = 2000000;	/* 2 Mb/s */
+
+	  /* Copy structure to the user buffer */
+	  if(copy_to_user(wrq->u.data.pointer, &range,
+			  sizeof(struct iw_range)))
+	    err = -EFAULT;
+	}
+      break;
+
+#ifdef WIRELESS_SPY
+      /* Set addresses to spy */
+    case SIOCSIWSPY:
+      /* Check the number of addresses */
+      if(wrq->u.data.length > IW_MAX_SPY)
+	{
+	  err = -E2BIG;
+	  break;
+	}
+      local->spy_number = wrq->u.data.length;
+
+      /* If there is some addresses to copy */
+      if(local->spy_number > 0)
+	{
+	  int			i;
+
+	  /* Copy addresses to the driver */
+	  if(copy_from_user(address, wrq->u.data.pointer,
+			    sizeof(struct sockaddr) * local->spy_number))
+	    {
+	      err = -EFAULT;
+	      break;
+	    }
+
+	  /* Copy addresses to the lp structure */
+	  for(i = 0; i < local->spy_number; i++)
+	    memcpy(local->spy_address[i], address[i].sa_data, ETH_ALEN);
+
+	  /* Reset structure... */
+	  memset(local->spy_stat, 0x00, sizeof(iw_qual) * IW_MAX_SPY);
+
+#ifdef DEBUG_IOCTL_INFO
+	  printk(KERN_DEBUG "SetSpy - Set of new addresses is :\n");
+	  for(i = 0; i < local->spy_number; i++)
+	    printk(KERN_DEBUG "%02X:%02X:%02X:%02X:%02X:%02X\n",
+		   local->spy_address[i][0],
+		   local->spy_address[i][1],
+		   local->spy_address[i][2],
+		   local->spy_address[i][3],
+		   local->spy_address[i][4],
+		   local->spy_address[i][5]);
+#endif	/* DEBUG_IOCTL_INFO */
+	}
+      break;
+
+      /* Get the spy list and spy stats */
+    case SIOCGIWSPY:
+      /* Set the number of addresses */
+      wrq->u.data.length = local->spy_number;
+
+      /* If the user want to have the addresses back... */
+      if((local->spy_number > 0) && (wrq->u.data.pointer != (caddr_t) 0))
+	{
+	  int			i;
+
+	  /* Copy addresses from the lp structure */
+	  for(i = 0; i < local->spy_number; i++)
+	    {
+	      memcpy(address[i].sa_data, local->spy_address[i], ETH_ALEN);
+	      address[i].sa_family = ARPHRD_ETHER;
+	    }
+
+	  /* Copy addresses to the user buffer */
+	  if(copy_to_user(wrq->u.data.pointer, address,
+		       sizeof(struct sockaddr) * local->spy_number))
+	    {
+	      err = -EFAULT;
+	      break;
+	    }
+
+	  /* Copy stats to the user buffer (just after) */
+	  if(copy_to_user(wrq->u.data.pointer +
+		       (sizeof(struct sockaddr) * local->spy_number),
+		       local->spy_stat, sizeof(iw_qual) * local->spy_number))
+	    {
+	      err = -EFAULT;
+	      break;
+	    }
+
+	  /* Reset updated flags */
+	  for(i = 0; i < local->spy_number; i++)
+	    local->spy_stat[i].updated = 0x0;
+	}	/* if(pointer != NULL) */
+
+      break;
+#endif	/* WIRELESS_SPY */
+
+      /* ------------------ PRIVATE IOCTL ------------------ */
+#ifndef SIOCIWFIRSTPRIV
+#define SIOCIWFIRSTPRIV	SIOCDEVPRIVATE
+#endif /* SIOCIWFIRSTPRIV */
+#define SIOCSIPFRAMING	SIOCIWFIRSTPRIV		/* Set framing mode */
+#define SIOCGIPFRAMING	SIOCIWFIRSTPRIV + 1	/* Get framing mode */
+#define SIOCGIPCOUNTRY	SIOCIWFIRSTPRIV + 3	/* Get country code */
+    case SIOCSIPFRAMING:
+      if(!capable(CAP_NET_ADMIN))	/* For private IOCTLs, we need to check permissions */
+	{
+	  err = -EPERM;
+	  break;
+	}
+      translate = *(wrq->u.name);	/* Set framing mode */
+      break;
+    case SIOCGIPFRAMING:
+      *(wrq->u.name) = translate;
+      break;
+    case SIOCGIPCOUNTRY:
+      *(wrq->u.name) = country;
+      break;
+    case SIOCGIWPRIV:
+      /* Export our "private" intercace */
+      if(wrq->u.data.pointer != (caddr_t) 0)
+	{
+	  struct iw_priv_args	priv[] =
+	  {	/* cmd,		set_args,	get_args,	name */
+	    { SIOCSIPFRAMING, IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 1, 0, "set_framing" },
+	    { SIOCGIPFRAMING, 0, IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 1, "get_framing" },
+	    { SIOCGIPCOUNTRY, 0, IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 1, "get_country" },
+	  };
+	  /* Set the number of ioctl available */
+	  wrq->u.data.length = 3;
+	  /* Copy structure to the user buffer */
+	  if(copy_to_user(wrq->u.data.pointer, (u_char *) priv,
+		       sizeof(priv)))
+	    err = -EFAULT;
+	}
+      break;
+#endif	/* WIRELESS_EXT > 7 */
+
+
+        default:
+            DEBUG(0,"ray_dev_ioctl cmd = 0x%x\n", cmd);
+            err = -EOPNOTSUPP;
+    }
+    return err;
+} /* end ray_dev_ioctl */
+/*===========================================================================*/
+#if WIRELESS_EXT > 7	/* If wireless extension exist in the kernel */
+static iw_stats * ray_get_wireless_stats(struct net_device *	dev)
+{
+  ray_dev_t *	local = (ray_dev_t *) dev->priv;
+  dev_link_t *link = local->finder;
+  struct status __iomem *p = local->sram + STATUS_BASE;
+
+  if(local == (ray_dev_t *) NULL)
+    return (iw_stats *) NULL;
+
+  local->wstats.status = local->card_status;
+#ifdef WIRELESS_SPY
+  if((local->spy_number > 0) && (local->sparm.b5.a_network_type == 0))
+    {
+      /* Get it from the first node in spy list */
+      local->wstats.qual.qual = local->spy_stat[0].qual;
+      local->wstats.qual.level = local->spy_stat[0].level;
+      local->wstats.qual.noise = local->spy_stat[0].noise;
+      local->wstats.qual.updated = local->spy_stat[0].updated;
+    }
+#endif /* WIRELESS_SPY */
+
+  if((link->state & DEV_PRESENT)) {
+    local->wstats.qual.noise = readb(&p->rxnoise);
+    local->wstats.qual.updated |= 4;
+  }
+
+  return &local->wstats;
+} /* end ray_get_wireless_stats */
+#endif	/* WIRELESS_EXT > 7 */
+/*===========================================================================*/
+static int ray_open(struct net_device *dev)
+{
+    dev_link_t *link;
+    ray_dev_t *local = (ray_dev_t *)dev->priv;
+    
+    DEBUG(1, "ray_open('%s')\n", dev->name);
+
+    for (link = dev_list; link; link = link->next)
+        if (link->priv == dev) break;
+    if (!DEV_OK(link)) {
+        return -ENODEV;
+    }
+
+    if (link->open == 0) local->num_multi = 0;
+    link->open++;
+
+    /* If the card is not started, time to start it ! - Jean II */
+    if(local->card_status == CARD_AWAITING_PARAM) {
+	int i;
+
+	DEBUG(1,"ray_open: doing init now !\n");
+
+	/* Download startup parameters */
+	if ( (i = dl_startup_params(dev)) < 0)
+	  {
+	    printk(KERN_INFO "ray_dev_init dl_startup_params failed - "
+		   "returns 0x%x\n",i);
+	    return -1;
+	  }
+     }
+
+    if (sniffer) netif_stop_queue(dev);
+    else         netif_start_queue(dev);
+
+    DEBUG(2,"ray_open ending\n");
+    return 0;
+} /* end ray_open */
+/*===========================================================================*/
+static int ray_dev_close(struct net_device *dev)
+{
+    dev_link_t *link;
+
+    DEBUG(1, "ray_dev_close('%s')\n", dev->name);
+
+    for (link = dev_list; link; link = link->next)
+        if (link->priv == dev) break;
+    if (link == NULL)
+        return -ENODEV;
+
+    link->open--;
+    netif_stop_queue(dev);
+
+    /* In here, we should stop the hardware (stop card from beeing active)
+     * and set local->card_status to CARD_AWAITING_PARAM, so that while the
+     * card is closed we can chage its configuration.
+     * Probably also need a COR reset to get sane state - Jean II */
+
+    return 0;
+} /* end ray_dev_close */
+/*===========================================================================*/
+static void ray_reset(struct net_device *dev) {
+    DEBUG(1,"ray_reset entered\n");
+    return;
+}
+/*===========================================================================*/
+/* Cause a firmware interrupt if it is ready for one                         */
+/* Return nonzero if not ready                                               */
+static int interrupt_ecf(ray_dev_t *local, int ccs)
+{
+    int i = 50;
+    dev_link_t *link = local->finder;
+
+    if (!(link->state & DEV_PRESENT)) {
+        DEBUG(2,"ray_cs interrupt_ecf - device not present\n");
+        return -1;
+    }
+    DEBUG(2,"interrupt_ecf(local=%p, ccs = 0x%x\n",local,ccs);
+
+    while ( i && 
+            (readb(local->amem + CIS_OFFSET + ECF_INTR_OFFSET) & ECF_INTR_SET))
+        i--;
+    if (i == 0) {
+        DEBUG(2,"ray_cs interrupt_ecf card not ready for interrupt\n");
+        return -1;
+    }
+	/* Fill the mailbox, then kick the card */
+    writeb(ccs, local->sram + SCB_BASE);
+    writeb(ECF_INTR_SET, local->amem + CIS_OFFSET + ECF_INTR_OFFSET);
+    return 0;
+} /* interrupt_ecf */
+/*===========================================================================*/
+/* Get next free transmit CCS                                                */
+/* Return - index of current tx ccs                                          */
+static int get_free_tx_ccs(ray_dev_t *local)
+{
+    int i;
+    struct ccs __iomem *pccs = ccs_base(local);
+    dev_link_t *link = local->finder;
+
+    if (!(link->state & DEV_PRESENT)) {
+        DEBUG(2,"ray_cs get_free_tx_ccs - device not present\n");
+        return ECARDGONE;
+    }
+
+    if (test_and_set_bit(0,&local->tx_ccs_lock)) {
+        DEBUG(1,"ray_cs tx_ccs_lock busy\n");
+        return ECCSBUSY;
+    } 
+
+    for (i=0; i < NUMBER_OF_TX_CCS; i++) {
+        if (readb(&(pccs+i)->buffer_status) == CCS_BUFFER_FREE) {
+            writeb(CCS_BUFFER_BUSY, &(pccs+i)->buffer_status);
+            writeb(CCS_END_LIST, &(pccs+i)->link);
+			local->tx_ccs_lock = 0;
+            return i;
+        }
+    }
+	local->tx_ccs_lock = 0;
+    DEBUG(2,"ray_cs ERROR no free tx CCS for raylink card\n");
+    return ECCSFULL;
+} /* get_free_tx_ccs */
+/*===========================================================================*/
+/* Get next free CCS                                                         */
+/* Return - index of current ccs                                             */
+static int get_free_ccs(ray_dev_t *local)
+{
+    int i;
+    struct ccs __iomem *pccs = ccs_base(local);
+    dev_link_t *link = local->finder;
+
+    if (!(link->state & DEV_PRESENT)) {
+        DEBUG(2,"ray_cs get_free_ccs - device not present\n");
+        return ECARDGONE;
+    }
+    if (test_and_set_bit(0,&local->ccs_lock)) {
+        DEBUG(1,"ray_cs ccs_lock busy\n");
+        return ECCSBUSY;
+    } 
+
+    for (i = NUMBER_OF_TX_CCS; i < NUMBER_OF_CCS; i++) {
+        if (readb(&(pccs+i)->buffer_status) == CCS_BUFFER_FREE) {
+            writeb(CCS_BUFFER_BUSY, &(pccs+i)->buffer_status);
+            writeb(CCS_END_LIST, &(pccs+i)->link);
+			local->ccs_lock = 0;
+            return i;
+        }
+    }
+	local->ccs_lock = 0;
+    DEBUG(1,"ray_cs ERROR no free CCS for raylink card\n");
+    return ECCSFULL;
+} /* get_free_ccs */
+/*===========================================================================*/
+static void authenticate_timeout(u_long data)
+{
+    ray_dev_t *local = (ray_dev_t *)data;
+    del_timer(&local->timer);
+    printk(KERN_INFO "ray_cs Authentication with access point failed"
+       " - timeout\n");
+    join_net((u_long)local);
+}
+/*===========================================================================*/
+static int asc_to_int(char a)
+{
+    if (a < '0') return -1;
+    if (a <= '9') return (a - '0');
+    if (a < 'A') return -1;
+    if (a <= 'F') return (10 + a - 'A');
+    if (a < 'a') return -1;
+    if (a <= 'f') return (10 + a - 'a');
+    return -1;
+}
+/*===========================================================================*/
+static int parse_addr(char *in_str, UCHAR *out)
+{
+    int len;
+    int i,j,k;
+    int status;
+    
+    if (in_str == NULL) return 0;
+    if ((len = strlen(in_str)) < 2) return 0;
+    memset(out, 0, ADDRLEN);
+
+    status = 1;
+    j = len - 1;
+    if (j > 12) j = 12;
+    i = 5;
+    
+    while (j > 0)
+    {
+        if ((k = asc_to_int(in_str[j--])) != -1) out[i] = k;
+        else return 0;
+
+        if (j == 0) break;
+        if ((k = asc_to_int(in_str[j--])) != -1) out[i] += k << 4;
+        else return 0;
+        if (!i--) break;
+    }
+    return status;
+}
+/*===========================================================================*/
+static struct net_device_stats *ray_get_stats(struct net_device *dev)
+{
+    ray_dev_t *local = (ray_dev_t *)dev->priv;
+    dev_link_t *link = local->finder;
+    struct status __iomem *p = local->sram + STATUS_BASE;
+    if (!(link->state & DEV_PRESENT)) {
+        DEBUG(2,"ray_cs net_device_stats - device not present\n");
+        return &local->stats;
+    }
+    if (readb(&p->mrx_overflow_for_host))
+    {
+        local->stats.rx_over_errors += ntohs(readb(&p->mrx_overflow));
+        writeb(0,&p->mrx_overflow);
+        writeb(0,&p->mrx_overflow_for_host);
+    }
+    if (readb(&p->mrx_checksum_error_for_host))
+    {
+        local->stats.rx_crc_errors += ntohs(readb(&p->mrx_checksum_error));
+        writeb(0,&p->mrx_checksum_error);
+        writeb(0,&p->mrx_checksum_error_for_host);
+    }
+    if (readb(&p->rx_hec_error_for_host))
+    {
+        local->stats.rx_frame_errors += ntohs(readb(&p->rx_hec_error));
+        writeb(0,&p->rx_hec_error);
+        writeb(0,&p->rx_hec_error_for_host);
+    }
+    return &local->stats;
+}
+/*===========================================================================*/
+static void ray_update_parm(struct net_device *dev, UCHAR objid, UCHAR *value, int len)
+{
+    ray_dev_t *local = (ray_dev_t *)dev->priv;
+    dev_link_t *link = local->finder;
+    int ccsindex;
+    int i;
+    struct ccs __iomem *pccs;
+
+    if (!(link->state & DEV_PRESENT)) {
+        DEBUG(2,"ray_update_parm - device not present\n");
+        return;
+    }
+
+    if ((ccsindex = get_free_ccs(local)) < 0)
+    {
+        DEBUG(0,"ray_update_parm - No free ccs\n");
+        return;
+    }
+    pccs = ccs_base(local) + ccsindex;
+    writeb(CCS_UPDATE_PARAMS, &pccs->cmd);
+    writeb(objid, &pccs->var.update_param.object_id);
+    writeb(1, &pccs->var.update_param.number_objects);
+    writeb(0, &pccs->var.update_param.failure_cause);
+    for (i=0; i<len; i++) {
+        writeb(value[i], local->sram + HOST_TO_ECF_BASE);
+    }
+    /* Interrupt the firmware to process the command */
+    if (interrupt_ecf(local, ccsindex)) {
+        DEBUG(0,"ray_cs associate failed - ECF not ready for intr\n");
+        writeb(CCS_BUFFER_FREE, &(pccs++)->buffer_status);
+    }
+}
+/*===========================================================================*/
+static void ray_update_multi_list(struct net_device *dev, int all)
+{
+    struct dev_mc_list *dmi, **dmip;
+    int ccsindex;
+    struct ccs __iomem *pccs;
+    int i = 0;
+    ray_dev_t *local = (ray_dev_t *)dev->priv;
+    dev_link_t *link = local->finder;
+    void __iomem *p = local->sram + HOST_TO_ECF_BASE;
+
+    if (!(link->state & DEV_PRESENT)) {
+        DEBUG(2,"ray_update_multi_list - device not present\n");
+        return;
+    }
+    else 
+        DEBUG(2,"ray_update_multi_list(%p)\n",dev);
+    if ((ccsindex = get_free_ccs(local)) < 0)
+    {
+        DEBUG(1,"ray_update_multi - No free ccs\n");
+        return;
+    }
+    pccs = ccs_base(local) + ccsindex;
+    writeb(CCS_UPDATE_MULTICAST_LIST, &pccs->cmd);
+
+    if (all) {
+        writeb(0xff, &pccs->var);
+        local->num_multi = 0xff;
+    }
+    else {
+        /* Copy the kernel's list of MC addresses to card */
+        for (dmip=&dev->mc_list; (dmi=*dmip)!=NULL; dmip=&dmi->next) {
+            memcpy_toio(p, dmi->dmi_addr, ETH_ALEN);
+            DEBUG(1,"ray_update_multi add addr %02x%02x%02x%02x%02x%02x\n",dmi->dmi_addr[0],dmi->dmi_addr[1],dmi->dmi_addr[2],dmi->dmi_addr[3],dmi->dmi_addr[4],dmi->dmi_addr[5]);
+            p += ETH_ALEN;
+            i++;
+        }
+        if (i > 256/ADDRLEN) i = 256/ADDRLEN;
+        writeb((UCHAR)i, &pccs->var);
+        DEBUG(1,"ray_cs update_multi %d addresses in list\n", i);
+        /* Interrupt the firmware to process the command */
+        local->num_multi = i;
+    }
+    if (interrupt_ecf(local, ccsindex)) {
+        DEBUG(1,"ray_cs update_multi failed - ECF not ready for intr\n");
+        writeb(CCS_BUFFER_FREE, &(pccs++)->buffer_status);
+    }
+} /* end ray_update_multi_list */
+/*===========================================================================*/
+static void set_multicast_list(struct net_device *dev)
+{
+    ray_dev_t *local = (ray_dev_t *)dev->priv;
+    UCHAR promisc;
+
+    DEBUG(2,"ray_cs set_multicast_list(%p)\n",dev);
+
+    if (dev->flags & IFF_PROMISC)
+    {
+        if (local->sparm.b5.a_promiscuous_mode == 0) {
+            DEBUG(1,"ray_cs set_multicast_list promisc on\n");
+            local->sparm.b5.a_promiscuous_mode = 1;
+            promisc = 1;
+            ray_update_parm(dev,  OBJID_promiscuous_mode, \
+                            &promisc, sizeof(promisc));
+        }
+    }
+    else {
+        if (local->sparm.b5.a_promiscuous_mode == 1) {
+            DEBUG(1,"ray_cs set_multicast_list promisc off\n");
+            local->sparm.b5.a_promiscuous_mode = 0;
+            promisc = 0;
+            ray_update_parm(dev,  OBJID_promiscuous_mode, \
+                            &promisc, sizeof(promisc));
+        }
+    }
+
+    if (dev->flags & IFF_ALLMULTI) ray_update_multi_list(dev, 1);
+    else
+    {
+        if (local->num_multi != dev->mc_count) ray_update_multi_list(dev, 0);
+    }
+} /* end set_multicast_list */
+/*=============================================================================
+ * All routines below here are run at interrupt time.
+=============================================================================*/
+static irqreturn_t ray_interrupt(int irq, void *dev_id, struct pt_regs * regs)
+{
+    struct net_device *dev = (struct net_device *)dev_id;
+    dev_link_t *link;
+    ray_dev_t *local;
+    struct ccs __iomem *pccs;
+    struct rcs __iomem *prcs;
+    UCHAR rcsindex;
+    UCHAR tmp;
+    UCHAR cmd;
+    UCHAR status;
+
+    if (dev == NULL) /* Note that we want interrupts with dev->start == 0 */
+	return IRQ_NONE;
+
+    DEBUG(4,"ray_cs: interrupt for *dev=%p\n",dev);
+
+    local = (ray_dev_t *)dev->priv;
+    link = (dev_link_t *)local->finder;
+    if ( ! (link->state & DEV_PRESENT) || link->state & DEV_SUSPEND ) {
+        DEBUG(2,"ray_cs interrupt from device not present or suspended.\n");
+        return IRQ_NONE;
+    }
+    rcsindex = readb(&((struct scb __iomem *)(local->sram))->rcs_index);
+
+    if (rcsindex >= (NUMBER_OF_CCS + NUMBER_OF_RCS))
+    {
+        DEBUG(1,"ray_cs interrupt bad rcsindex = 0x%x\n",rcsindex);
+        clear_interrupt(local);
+        return IRQ_HANDLED;
+    }
+    if (rcsindex < NUMBER_OF_CCS) /* If it's a returned CCS */
+    {
+        pccs = ccs_base(local) + rcsindex;
+        cmd = readb(&pccs->cmd);
+        status = readb(&pccs->buffer_status);
+        switch (cmd)
+        {
+        case CCS_DOWNLOAD_STARTUP_PARAMS: /* Happens in firmware someday */
+            del_timer(&local->timer);
+            if (status == CCS_COMMAND_COMPLETE) {
+                DEBUG(1,"ray_cs interrupt download_startup_parameters OK\n");
+            }
+            else {
+                DEBUG(1,"ray_cs interrupt download_startup_parameters fail\n");
+            }
+            break;
+        case CCS_UPDATE_PARAMS:
+            DEBUG(1,"ray_cs interrupt update params done\n");
+            if (status != CCS_COMMAND_COMPLETE) {
+                tmp = readb(&pccs->var.update_param.failure_cause);
+            DEBUG(0,"ray_cs interrupt update params failed - reason %d\n",tmp);
+            }
+            break;
+        case CCS_REPORT_PARAMS:
+            DEBUG(1,"ray_cs interrupt report params done\n");
+            break;
+        case CCS_UPDATE_MULTICAST_LIST: /* Note that this CCS isn't returned */
+            DEBUG(1,"ray_cs interrupt CCS Update Multicast List done\n");
+            break;
+        case CCS_UPDATE_POWER_SAVINGS_MODE:
+            DEBUG(1,"ray_cs interrupt update power save mode done\n");
+            break;
+        case CCS_START_NETWORK:
+        case CCS_JOIN_NETWORK:
+            if (status == CCS_COMMAND_COMPLETE) {
+                if (readb(&pccs->var.start_network.net_initiated) == 1) {
+                    DEBUG(0,"ray_cs interrupt network \"%s\" started\n",\
+                          local->sparm.b4.a_current_ess_id);
+                }
+                else {
+                    DEBUG(0,"ray_cs interrupt network \"%s\" joined\n",\
+                          local->sparm.b4.a_current_ess_id);
+                }
+                memcpy_fromio(&local->bss_id,pccs->var.start_network.bssid,ADDRLEN);
+
+                if (local->fw_ver == 0x55) local->net_default_tx_rate = 3;
+                else local->net_default_tx_rate = 
+                         readb(&pccs->var.start_network.net_default_tx_rate);
+                local->encryption = readb(&pccs->var.start_network.encryption);
+                if (!sniffer && (local->net_type == INFRA)
+                    && !(local->sparm.b4.a_acting_as_ap_status)) {
+                    authenticate(local);
+                }
+                local->card_status = CARD_ACQ_COMPLETE;
+            }
+            else {
+                local->card_status = CARD_ACQ_FAILED;
+
+                del_timer(&local->timer);
+                local->timer.expires = jiffies + HZ*5;
+                local->timer.data = (long)local;
+                if (status == CCS_START_NETWORK) {
+                    DEBUG(0,"ray_cs interrupt network \"%s\" start failed\n",\
+                          local->sparm.b4.a_current_ess_id);
+                    local->timer.function = &start_net;
+                }
+                else {
+                    DEBUG(0,"ray_cs interrupt network \"%s\" join failed\n",\
+                          local->sparm.b4.a_current_ess_id);
+                    local->timer.function = &join_net;
+                }
+                add_timer(&local->timer);
+            }
+            break;
+        case CCS_START_ASSOCIATION:
+            if (status == CCS_COMMAND_COMPLETE) {
+                local->card_status = CARD_ASSOC_COMPLETE;
+                DEBUG(0,"ray_cs association successful\n");
+            }
+            else
+            {
+                DEBUG(0,"ray_cs association failed,\n");
+                local->card_status = CARD_ASSOC_FAILED;
+                join_net((u_long)local);
+            }
+            break;
+        case CCS_TX_REQUEST:
+            if (status == CCS_COMMAND_COMPLETE) {
+                DEBUG(3,"ray_cs interrupt tx request complete\n");
+            }
+            else {
+                DEBUG(1,"ray_cs interrupt tx request failed\n");
+            }
+            if (!sniffer) netif_start_queue(dev);
+            netif_wake_queue(dev);
+            break;
+        case CCS_TEST_MEMORY:
+            DEBUG(1,"ray_cs interrupt mem test done\n");
+            break;
+        case CCS_SHUTDOWN:
+            DEBUG(1,"ray_cs interrupt Unexpected CCS returned - Shutdown\n");
+            break;
+        case CCS_DUMP_MEMORY:
+            DEBUG(1,"ray_cs interrupt dump memory done\n");
+            break;
+        case CCS_START_TIMER:
+            DEBUG(2,"ray_cs interrupt DING - raylink timer expired\n");
+            break;
+        default:
+            DEBUG(1,"ray_cs interrupt Unexpected CCS 0x%x returned 0x%x\n",\
+                  rcsindex, cmd);
+        }
+        writeb(CCS_BUFFER_FREE, &pccs->buffer_status);
+    }
+    else /* It's an RCS */
+    {
+        prcs = rcs_base(local) + rcsindex;
+    
+        switch (readb(&prcs->interrupt_id))
+        {
+        case PROCESS_RX_PACKET:
+            ray_rx(dev, local, prcs);
+            break;
+        case REJOIN_NET_COMPLETE:
+            DEBUG(1,"ray_cs interrupt rejoin net complete\n");
+            local->card_status = CARD_ACQ_COMPLETE;
+            /* do we need to clear tx buffers CCS's? */
+            if (local->sparm.b4.a_network_type == ADHOC) {
+                if (!sniffer) netif_start_queue(dev);
+            }
+            else {
+                memcpy_fromio(&local->bss_id, prcs->var.rejoin_net_complete.bssid, ADDRLEN);
+                DEBUG(1,"ray_cs new BSSID = %02x%02x%02x%02x%02x%02x\n",\
+                      local->bss_id[0], local->bss_id[1], local->bss_id[2],\
+                      local->bss_id[3], local->bss_id[4], local->bss_id[5]);
+                if (!sniffer) authenticate(local);
+            }
+            break;
+        case ROAMING_INITIATED:
+            DEBUG(1,"ray_cs interrupt roaming initiated\n"); 
+            netif_stop_queue(dev);
+            local->card_status = CARD_DOING_ACQ;
+            break;
+        case JAPAN_CALL_SIGN_RXD:
+            DEBUG(1,"ray_cs interrupt japan call sign rx\n");
+            break;
+        default:
+            DEBUG(1,"ray_cs Unexpected interrupt for RCS 0x%x cmd = 0x%x\n",\
+                  rcsindex, (unsigned int) readb(&prcs->interrupt_id));
+            break;
+        }
+        writeb(CCS_BUFFER_FREE, &prcs->buffer_status);
+    }
+    clear_interrupt(local);
+    return IRQ_HANDLED;
+} /* ray_interrupt */
+/*===========================================================================*/
+static void ray_rx(struct net_device *dev, ray_dev_t *local, struct rcs __iomem *prcs)
+{
+    int rx_len;
+    unsigned int pkt_addr;
+    void __iomem *pmsg;
+    DEBUG(4,"ray_rx process rx packet\n");
+
+    /* Calculate address of packet within Rx buffer */
+    pkt_addr = ((readb(&prcs->var.rx_packet.rx_data_ptr[0]) << 8)
+                + readb(&prcs->var.rx_packet.rx_data_ptr[1])) & RX_BUFF_END;
+    /* Length of first packet fragment */
+    rx_len = (readb(&prcs->var.rx_packet.rx_data_length[0]) << 8)
+        + readb(&prcs->var.rx_packet.rx_data_length[1]);
+
+    local->last_rsl = readb(&prcs->var.rx_packet.rx_sig_lev);
+    pmsg = local->rmem + pkt_addr;
+    switch(readb(pmsg))
+    {
+    case DATA_TYPE:
+        DEBUG(4,"ray_rx data type\n");
+        rx_data(dev, prcs, pkt_addr, rx_len);
+        break;
+    case AUTHENTIC_TYPE:
+        DEBUG(4,"ray_rx authentic type\n");
+        if (sniffer) rx_data(dev, prcs, pkt_addr, rx_len);
+        else rx_authenticate(local, prcs, pkt_addr, rx_len);
+        break;
+    case DEAUTHENTIC_TYPE:
+        DEBUG(4,"ray_rx deauth type\n");
+        if (sniffer) rx_data(dev, prcs, pkt_addr, rx_len);
+        else rx_deauthenticate(local, prcs, pkt_addr, rx_len);
+        break;
+    case NULL_MSG_TYPE:
+        DEBUG(3,"ray_cs rx NULL msg\n");
+        break;
+    case BEACON_TYPE:
+        DEBUG(4,"ray_rx beacon type\n");
+        if (sniffer) rx_data(dev, prcs, pkt_addr, rx_len);
+
+        copy_from_rx_buff(local, (UCHAR *)&local->last_bcn, pkt_addr, 
+                          rx_len < sizeof(struct beacon_rx) ? 
+                          rx_len : sizeof(struct beacon_rx));
+
+	local->beacon_rxed = 1;
+        /* Get the statistics so the card counters never overflow */
+        ray_get_stats(dev);
+            break;
+    default:
+        DEBUG(0,"ray_cs unknown pkt type %2x\n", (unsigned int) readb(pmsg));
+        break;
+    }
+
+} /* end ray_rx */
+/*===========================================================================*/
+static void rx_data(struct net_device *dev, struct rcs __iomem *prcs, unsigned int pkt_addr, 
+             int rx_len)
+{
+    struct sk_buff *skb = NULL;
+    struct rcs __iomem *prcslink = prcs;
+    ray_dev_t *local = dev->priv;
+    UCHAR *rx_ptr;
+    int total_len;
+    int tmp;
+#ifdef WIRELESS_SPY
+    int siglev = local->last_rsl;
+    u_char linksrcaddr[ETH_ALEN];	/* Other end of the wireless link */
+#endif
+
+    if (!sniffer) {
+        if (translate) {
+/* TBD length needs fixing for translated header */
+            if (rx_len < (ETH_HLEN + RX_MAC_HEADER_LENGTH) ||
+                rx_len > (dev->mtu + RX_MAC_HEADER_LENGTH + ETH_HLEN + FCS_LEN)) 
+            {
+                DEBUG(0,"ray_cs invalid packet length %d received \n",rx_len);
+                return;
+            }
+        }
+        else /* encapsulated ethernet */ {
+            if (rx_len < (ETH_HLEN + RX_MAC_HEADER_LENGTH) ||
+                rx_len > (dev->mtu + RX_MAC_HEADER_LENGTH + ETH_HLEN + FCS_LEN))
+            {
+                DEBUG(0,"ray_cs invalid packet length %d received \n",rx_len);
+                return;
+            }
+        }
+    }
+    DEBUG(4,"ray_cs rx_data packet\n");
+    /* If fragmented packet, verify sizes of fragments add up */
+    if (readb(&prcs->var.rx_packet.next_frag_rcs_index) != 0xFF) {
+        DEBUG(1,"ray_cs rx'ed fragment\n");
+        tmp = (readb(&prcs->var.rx_packet.totalpacketlength[0]) << 8)
+            +  readb(&prcs->var.rx_packet.totalpacketlength[1]);
+        total_len = tmp;
+        prcslink = prcs;
+        do {
+            tmp -= (readb(&prcslink->var.rx_packet.rx_data_length[0]) << 8)
+                +   readb(&prcslink->var.rx_packet.rx_data_length[1]);
+            if (readb(&prcslink->var.rx_packet.next_frag_rcs_index) == 0xFF
+                || tmp < 0) break;
+            prcslink = rcs_base(local)
+                + readb(&prcslink->link_field);
+        } while (1);
+
+        if (tmp < 0)
+        {
+            DEBUG(0,"ray_cs rx_data fragment lengths don't add up\n");
+            local->stats.rx_dropped++; 
+            release_frag_chain(local, prcs);
+            return;
+        }
+    }
+    else { /* Single unfragmented packet */
+        total_len = rx_len;
+    }
+
+    skb = dev_alloc_skb( total_len+5 );
+    if (skb == NULL)
+    {
+        DEBUG(0,"ray_cs rx_data could not allocate skb\n");
+        local->stats.rx_dropped++; 
+        if (readb(&prcs->var.rx_packet.next_frag_rcs_index) != 0xFF)
+            release_frag_chain(local, prcs);
+        return;
+    }
+    skb_reserve( skb, 2);   /* Align IP on 16 byte (TBD check this)*/
+    skb->dev = dev;
+
+    DEBUG(4,"ray_cs rx_data total_len = %x, rx_len = %x\n",total_len,rx_len);
+
+/************************/
+    /* Reserve enough room for the whole damn packet. */
+    rx_ptr = skb_put( skb, total_len);
+    /* Copy the whole packet to sk_buff */
+    rx_ptr += copy_from_rx_buff(local, rx_ptr, pkt_addr & RX_BUFF_END, rx_len);
+    /* Get source address */
+#ifdef WIRELESS_SPY
+    memcpy(linksrcaddr, ((struct mac_header *)skb->data)->addr_2, ETH_ALEN);
+#endif
+    /* Now, deal with encapsulation/translation/sniffer */
+    if (!sniffer) {
+        if (!translate) { 
+            /* Encapsulated ethernet, so just lop off 802.11 MAC header */
+/* TBD reserve            skb_reserve( skb, RX_MAC_HEADER_LENGTH); */
+            skb_pull( skb, RX_MAC_HEADER_LENGTH);
+        }
+        else {
+            /* Do translation */
+            untranslate(local, skb, total_len);
+        }
+    }
+    else 
+    {  /* sniffer mode, so just pass whole packet */  };
+
+/************************/
+    /* Now pick up the rest of the fragments if any */
+    tmp = 17; 
+    if (readb(&prcs->var.rx_packet.next_frag_rcs_index) != 0xFF) {
+        prcslink = prcs;
+        DEBUG(1,"ray_cs rx_data in fragment loop\n");
+        do {
+            prcslink = rcs_base(local)
+                + readb(&prcslink->var.rx_packet.next_frag_rcs_index);
+            rx_len = (( readb(&prcslink->var.rx_packet.rx_data_length[0]) << 8)
+                      + readb(&prcslink->var.rx_packet.rx_data_length[1]))
+                & RX_BUFF_END;
+            pkt_addr = (( readb(&prcslink->var.rx_packet.rx_data_ptr[0]) << 8)
+                        + readb(&prcslink->var.rx_packet.rx_data_ptr[1]))
+                & RX_BUFF_END;
+
+            rx_ptr += copy_from_rx_buff(local, rx_ptr, pkt_addr, rx_len);
+
+        } while (tmp-- && 
+                 readb(&prcslink->var.rx_packet.next_frag_rcs_index) != 0xFF);
+        release_frag_chain(local, prcs);
+    }
+
+    skb->protocol = eth_type_trans(skb,dev);
+    netif_rx(skb);
+    dev->last_rx = jiffies;
+    local->stats.rx_packets++;
+    local->stats.rx_bytes += total_len;
+
+    /* Gather signal strength per address */
+#ifdef WIRELESS_SPY
+    /* For the Access Point or the node having started the ad-hoc net
+     * note : ad-hoc work only in some specific configurations, but we
+     * kludge in ray_get_wireless_stats... */
+    if(!memcmp(linksrcaddr, local->bss_id, ETH_ALEN))
+      {
+	/* Update statistics */
+	/*local->wstats.qual.qual = none ? */
+	local->wstats.qual.level = siglev;
+	/*local->wstats.qual.noise = none ? */
+	local->wstats.qual.updated = 0x2;
+      }
+    /* Now, for the addresses in the spy list */
+    {
+      int	i;
+      /* Look all addresses */
+      for(i = 0; i < local->spy_number; i++)
+	/* If match */
+	if(!memcmp(linksrcaddr, local->spy_address[i], ETH_ALEN))
+	  {
+	    /* Update statistics */
+	    /*local->spy_stat[i].qual = none ? */
+	    local->spy_stat[i].level = siglev;
+	    /*local->spy_stat[i].noise = none ? */
+	    local->spy_stat[i].updated = 0x2;
+	  }
+    }
+#endif	/* WIRELESS_SPY */
+} /* end rx_data */
+/*===========================================================================*/
+static void untranslate(ray_dev_t *local, struct sk_buff *skb, int len)
+{
+    snaphdr_t *psnap = (snaphdr_t *)(skb->data + RX_MAC_HEADER_LENGTH);
+    struct mac_header *pmac = (struct mac_header *)skb->data;
+    unsigned short type = *(unsigned short *)psnap->ethertype;
+    unsigned int xsap = *(unsigned int *)psnap & 0x00ffffff;
+    unsigned int org = (*(unsigned int *)psnap->org) & 0x00ffffff;
+    int delta;
+    struct ethhdr *peth;
+    UCHAR srcaddr[ADDRLEN];
+    UCHAR destaddr[ADDRLEN];
+
+    if (pmac->frame_ctl_2 & FC2_FROM_DS) {
+	if (pmac->frame_ctl_2 & FC2_TO_DS) { /* AP to AP */
+	    memcpy(destaddr, pmac->addr_3, ADDRLEN);
+	    memcpy(srcaddr, ((unsigned char *)pmac->addr_3) + ADDRLEN, ADDRLEN);
+	} else { /* AP to terminal */
+	    memcpy(destaddr, pmac->addr_1, ADDRLEN);
+	    memcpy(srcaddr, pmac->addr_3, ADDRLEN); 
+	}
+    } else { /* Terminal to AP */
+	if (pmac->frame_ctl_2 & FC2_TO_DS) {
+	    memcpy(destaddr, pmac->addr_3, ADDRLEN);
+	    memcpy(srcaddr, pmac->addr_2, ADDRLEN); 
+	} else { /* Adhoc */
+	    memcpy(destaddr, pmac->addr_1, ADDRLEN);
+	    memcpy(srcaddr, pmac->addr_2, ADDRLEN); 
+	}
+    }
+
+#ifdef PCMCIA_DEBUG
+    if (pc_debug > 3) {
+    int i;
+    printk(KERN_DEBUG "skb->data before untranslate");
+    for (i=0;i<64;i++) 
+        printk("%02x ",skb->data[i]);
+    printk("\n" KERN_DEBUG "type = %08x, xsap = %08x, org = %08x\n",
+           type,xsap,org);
+    printk(KERN_DEBUG "untranslate skb->data = %p\n",skb->data);
+    }
+#endif
+
+    if ( xsap != SNAP_ID) {
+        /* not a snap type so leave it alone */
+        DEBUG(3,"ray_cs untranslate NOT SNAP %x\n", *(unsigned int *)psnap & 0x00ffffff);
+
+        delta = RX_MAC_HEADER_LENGTH - ETH_HLEN;
+        peth = (struct ethhdr *)(skb->data + delta);
+        peth->h_proto = htons(len - RX_MAC_HEADER_LENGTH);
+    }
+    else { /* Its a SNAP */
+        if (org == BRIDGE_ENCAP) { /* EtherII and nuke the LLC  */
+        DEBUG(3,"ray_cs untranslate Bridge encap\n");
+            delta = RX_MAC_HEADER_LENGTH 
+                + sizeof(struct snaphdr_t) - ETH_HLEN;
+            peth = (struct ethhdr *)(skb->data + delta);
+            peth->h_proto = type;
+        }
+        else {
+            if (org == RFC1042_ENCAP) {
+                switch (type) {
+                case RAY_IPX_TYPE:
+                case APPLEARP_TYPE:
+                    DEBUG(3,"ray_cs untranslate RFC IPX/AARP\n");
+                    delta = RX_MAC_HEADER_LENGTH - ETH_HLEN;
+                    peth = (struct ethhdr *)(skb->data + delta);
+                    peth->h_proto = htons(len - RX_MAC_HEADER_LENGTH);
+                    break;
+                default:
+                    DEBUG(3,"ray_cs untranslate RFC default\n");
+                    delta = RX_MAC_HEADER_LENGTH + 
+                        sizeof(struct snaphdr_t) - ETH_HLEN;
+                    peth = (struct ethhdr *)(skb->data + delta);
+                    peth->h_proto = type;
+                    break;
+                }
+            }
+            else {
+                printk("ray_cs untranslate very confused by packet\n");
+                delta = RX_MAC_HEADER_LENGTH - ETH_HLEN;
+                peth = (struct ethhdr *)(skb->data + delta);
+                peth->h_proto = type;
+            }
+        }
+    }
+/* TBD reserve  skb_reserve(skb, delta); */
+    skb_pull(skb, delta);
+    DEBUG(3,"untranslate after skb_pull(%d), skb->data = %p\n",delta,skb->data);
+    memcpy(peth->h_dest, destaddr, ADDRLEN);
+    memcpy(peth->h_source, srcaddr, ADDRLEN);
+#ifdef PCMCIA_DEBUG
+    if (pc_debug > 3) {
+    int i;
+    printk(KERN_DEBUG "skb->data after untranslate:");
+    for (i=0;i<64;i++)
+        printk("%02x ",skb->data[i]);
+    printk("\n");
+    }
+#endif
+} /* end untranslate */
+/*===========================================================================*/
+/* Copy data from circular receive buffer to PC memory.
+ * dest     = destination address in PC memory
+ * pkt_addr = source address in receive buffer
+ * len      = length of packet to copy
+ */
+static int copy_from_rx_buff(ray_dev_t *local, UCHAR *dest, int pkt_addr, int length)
+{
+    int wrap_bytes = (pkt_addr + length) - (RX_BUFF_END + 1);
+    if (wrap_bytes <= 0)
+    {
+        memcpy_fromio(dest,local->rmem + pkt_addr,length);
+    }
+    else /* Packet wrapped in circular buffer */
+    {
+        memcpy_fromio(dest,local->rmem+pkt_addr,length - wrap_bytes);
+        memcpy_fromio(dest + length - wrap_bytes, local->rmem, wrap_bytes);
+    }
+    return length;
+}
+/*===========================================================================*/
+static void release_frag_chain(ray_dev_t *local, struct rcs __iomem * prcs)
+{
+    struct rcs __iomem *prcslink = prcs;
+    int tmp = 17;
+    unsigned rcsindex = readb(&prcs->var.rx_packet.next_frag_rcs_index);
+
+    while (tmp--) {
+        writeb(CCS_BUFFER_FREE, &prcslink->buffer_status);
+        if (rcsindex >= (NUMBER_OF_CCS + NUMBER_OF_RCS)) {
+            DEBUG(1,"ray_cs interrupt bad rcsindex = 0x%x\n",rcsindex);
+            break;      
+        }   
+        prcslink = rcs_base(local) + rcsindex;
+        rcsindex = readb(&prcslink->var.rx_packet.next_frag_rcs_index);
+    }
+    writeb(CCS_BUFFER_FREE, &prcslink->buffer_status);
+}
+/*===========================================================================*/
+static void authenticate(ray_dev_t *local)
+{
+    dev_link_t *link = local->finder;
+    DEBUG(0,"ray_cs Starting authentication.\n");
+    if (!(link->state & DEV_PRESENT)) {
+        DEBUG(2,"ray_cs authenticate - device not present\n");
+        return;
+    }
+
+    del_timer(&local->timer);
+    if (build_auth_frame(local, local->bss_id, OPEN_AUTH_REQUEST)) {
+        local->timer.function = &join_net;
+    }
+    else {
+        local->timer.function = &authenticate_timeout;
+    }
+    local->timer.expires = jiffies + HZ*2;
+    local->timer.data = (long)local;
+    add_timer(&local->timer);
+    local->authentication_state = AWAITING_RESPONSE;
+} /* end authenticate */
+/*===========================================================================*/
+static void rx_authenticate(ray_dev_t *local, struct rcs __iomem *prcs,
+                     unsigned int pkt_addr, int rx_len)
+{
+    UCHAR buff[256];
+    struct rx_msg *msg = (struct rx_msg *)buff;
+    
+    del_timer(&local->timer);
+
+    copy_from_rx_buff(local, buff, pkt_addr, rx_len & 0xff);
+    /* if we are trying to get authenticated */
+    if (local->sparm.b4.a_network_type == ADHOC) {
+        DEBUG(1,"ray_cs rx_auth var= %02x %02x %02x %02x %02x %02x\n", msg->var[0],msg->var[1],msg->var[2],msg->var[3],msg->var[4],msg->var[5]);
+        if (msg->var[2] == 1) {
+                    DEBUG(0,"ray_cs Sending authentication response.\n");
+                    if (!build_auth_frame (local, msg->mac.addr_2, OPEN_AUTH_RESPONSE)) {
+                        local->authentication_state = NEED_TO_AUTH;
+                        memcpy(local->auth_id, msg->mac.addr_2, ADDRLEN);
+                    }
+        }
+    }
+    else /* Infrastructure network */
+    {
+        if (local->authentication_state == AWAITING_RESPONSE) {
+            /* Verify authentication sequence #2 and success */
+            if (msg->var[2] == 2) {
+                if ((msg->var[3] | msg->var[4]) == 0) {
+                    DEBUG(1,"Authentication successful\n");
+                    local->card_status = CARD_AUTH_COMPLETE;
+                    associate(local);
+                    local->authentication_state = AUTHENTICATED;
+                }
+                else {
+                    DEBUG(0,"Authentication refused\n");
+                    local->card_status = CARD_AUTH_REFUSED;
+                    join_net((u_long)local);
+                    local->authentication_state = UNAUTHENTICATED;
+                }
+            }
+        }
+    }
+
+} /* end rx_authenticate */
+/*===========================================================================*/
+static void associate(ray_dev_t *local)
+{
+    struct ccs __iomem *pccs;
+    dev_link_t *link = local->finder;
+    struct net_device *dev = link->priv;
+    int ccsindex;
+    if (!(link->state & DEV_PRESENT)) {
+        DEBUG(2,"ray_cs associate - device not present\n");
+        return;
+    }
+    /* If no tx buffers available, return*/
+    if ((ccsindex = get_free_ccs(local)) < 0)
+    {
+/* TBD should never be here but... what if we are? */
+        DEBUG(1,"ray_cs associate - No free ccs\n");
+        return;
+    }
+    DEBUG(1,"ray_cs Starting association with access point\n");
+    pccs = ccs_base(local) + ccsindex;
+    /* fill in the CCS */
+    writeb(CCS_START_ASSOCIATION, &pccs->cmd);
+    /* Interrupt the firmware to process the command */
+    if (interrupt_ecf(local, ccsindex)) {
+        DEBUG(1,"ray_cs associate failed - ECF not ready for intr\n");
+        writeb(CCS_BUFFER_FREE, &(pccs++)->buffer_status);
+
+        del_timer(&local->timer);
+        local->timer.expires = jiffies + HZ*2;
+        local->timer.data = (long)local;
+        local->timer.function = &join_net;
+        add_timer(&local->timer);
+        local->card_status = CARD_ASSOC_FAILED;
+        return;
+    }
+    if (!sniffer) netif_start_queue(dev);
+
+} /* end associate */
+/*===========================================================================*/
+static void rx_deauthenticate(ray_dev_t *local, struct rcs __iomem *prcs, 
+                       unsigned int pkt_addr, int rx_len)
+{
+/*  UCHAR buff[256];
+    struct rx_msg *msg = (struct rx_msg *)buff;
+*/
+    DEBUG(0,"Deauthentication frame received\n");
+    local->authentication_state = UNAUTHENTICATED;
+    /* Need to reauthenticate or rejoin depending on reason code */
+/*  copy_from_rx_buff(local, buff, pkt_addr, rx_len & 0xff);
+ */
+}
+/*===========================================================================*/
+static void clear_interrupt(ray_dev_t *local)
+{
+    writeb(0, local->amem + CIS_OFFSET + HCS_INTR_OFFSET);
+}
+/*===========================================================================*/
+#ifdef CONFIG_PROC_FS
+#define MAXDATA (PAGE_SIZE - 80)
+
+static char *card_status[] = {
+    "Card inserted - uninitialized",     /* 0 */
+    "Card not downloaded",               /* 1 */
+    "Waiting for download parameters",   /* 2 */
+    "Card doing acquisition",            /* 3 */
+    "Acquisition complete",              /* 4 */
+    "Authentication complete",           /* 5 */
+    "Association complete",              /* 6 */
+    "???", "???", "???", "???",          /* 7 8 9 10 undefined */
+    "Card init error",                   /* 11 */
+    "Download parameters error",         /* 12 */
+    "???",                               /* 13 */
+    "Acquisition failed",                /* 14 */
+    "Authentication refused",            /* 15 */
+    "Association failed"                 /* 16 */
+};
+
+static char *nettype[] = {"Adhoc", "Infra "};
+static char *framing[] = {"Encapsulation", "Translation"}
+;
+/*===========================================================================*/
+static int ray_cs_proc_read(char *buf, char **start, off_t offset, int len)
+{
+/* Print current values which are not available via other means
+ * eg ifconfig 
+ */
+    int i;
+    dev_link_t *link;
+    struct net_device *dev;
+    ray_dev_t *local;
+    UCHAR *p;
+    struct freq_hop_element *pfh;
+    UCHAR c[33];
+
+    link = dev_list;
+    if (!link)
+    	return 0;
+    dev = (struct net_device *)link->priv;
+    if (!dev)
+    	return 0;
+    local = (ray_dev_t *)dev->priv;
+    if (!local)
+    	return 0;
+
+    len = 0;
+
+    len += sprintf(buf + len, "Raylink Wireless LAN driver status\n");
+    len += sprintf(buf + len, "%s\n", rcsid);
+    /* build 4 does not report version, and field is 0x55 after memtest */
+    len += sprintf(buf + len, "Firmware version     = ");
+    if (local->fw_ver == 0x55)
+        len += sprintf(buf + len, "4 - Use dump_cis for more details\n");
+    else
+        len += sprintf(buf + len, "%2d.%02d.%02d\n",
+                   local->fw_ver, local->fw_bld, local->fw_var);
+
+    for (i=0; i<32; i++) c[i] = local->sparm.b5.a_current_ess_id[i];
+    c[32] = 0;
+    len += sprintf(buf + len, "%s network ESSID = \"%s\"\n", 
+                   nettype[local->sparm.b5.a_network_type], c);
+
+    p = local->bss_id;
+    len += sprintf(buf + len, 
+                   "BSSID                = %02x:%02x:%02x:%02x:%02x:%02x\n",
+                   p[0],p[1],p[2],p[3],p[4],p[5]);
+
+    len += sprintf(buf + len, "Country code         = %d\n", 
+                   local->sparm.b5.a_curr_country_code);
+
+    i = local->card_status;
+    if (i < 0) i = 10;
+    if (i > 16) i = 10;
+    len += sprintf(buf + len, "Card status          = %s\n", card_status[i]);
+
+    len += sprintf(buf + len, "Framing mode         = %s\n",framing[translate]);
+
+    len += sprintf(buf + len, "Last pkt signal lvl  = %d\n", local->last_rsl);
+
+    if (local->beacon_rxed) {
+	/* Pull some fields out of last beacon received */
+	len += sprintf(buf + len, "Beacon Interval      = %d Kus\n", 
+		       local->last_bcn.beacon_intvl[0]
+		       + 256 * local->last_bcn.beacon_intvl[1]);
+    
+    p = local->last_bcn.elements;
+    if (p[0] == C_ESSID_ELEMENT_ID) p += p[1] + 2;
+    else {
+        len += sprintf(buf + len, "Parse beacon failed at essid element id = %d\n",p[0]);
+        return len;
+    }
+
+    if (p[0] == C_SUPPORTED_RATES_ELEMENT_ID) {
+        len += sprintf(buf + len, "Supported rate codes = ");
+        for (i=2; i<p[1] + 2; i++) 
+            len += sprintf(buf + len, "0x%02x ", p[i]);
+        len += sprintf(buf + len, "\n");
+        p += p[1] + 2;
+    }
+    else {
+        len += sprintf(buf + len, "Parse beacon failed at rates element\n");
+        return len;
+    }
+
+	if (p[0] == C_FH_PARAM_SET_ELEMENT_ID) {
+	    pfh = (struct freq_hop_element *)p;
+	    len += sprintf(buf + len, "Hop dwell            = %d Kus\n",
+			   pfh->dwell_time[0] + 256 * pfh->dwell_time[1]);
+	    len += sprintf(buf + len, "Hop set              = %d \n", pfh->hop_set);
+	    len += sprintf(buf + len, "Hop pattern          = %d \n", pfh->hop_pattern);
+	    len += sprintf(buf + len, "Hop index            = %d \n", pfh->hop_index);
+	    p += p[1] + 2;
+	}
+	else {
+	    len += sprintf(buf + len, "Parse beacon failed at FH param element\n");
+	    return len;
+	}
+    } else {
+	len += sprintf(buf + len, "No beacons received\n");
+    }
+    return len;
+}
+
+#endif
+/*===========================================================================*/
+static int build_auth_frame(ray_dev_t *local, UCHAR *dest, int auth_type)
+{
+    int addr;
+    struct ccs __iomem *pccs;
+    struct tx_msg __iomem *ptx;
+    int ccsindex;
+
+    /* If no tx buffers available, return */
+    if ((ccsindex = get_free_tx_ccs(local)) < 0)
+    {
+        DEBUG(1,"ray_cs send authenticate - No free tx ccs\n");
+        return -1;
+    }
+
+    pccs = ccs_base(local) + ccsindex;
+
+    /* Address in card space */
+    addr = TX_BUF_BASE + (ccsindex << 11);
+    /* fill in the CCS */
+    writeb(CCS_TX_REQUEST, &pccs->cmd);
+    writeb(addr >> 8, pccs->var.tx_request.tx_data_ptr);
+    writeb(0x20, pccs->var.tx_request.tx_data_ptr + 1);
+    writeb(TX_AUTHENTICATE_LENGTH_MSB, pccs->var.tx_request.tx_data_length);
+    writeb(TX_AUTHENTICATE_LENGTH_LSB,pccs->var.tx_request.tx_data_length + 1);
+    writeb(0, &pccs->var.tx_request.pow_sav_mode);
+
+    ptx = local->sram + addr;
+    /* fill in the mac header */
+    writeb(PROTOCOL_VER | AUTHENTIC_TYPE, &ptx->mac.frame_ctl_1);
+    writeb(0, &ptx->mac.frame_ctl_2);
+
+    memcpy_toio(ptx->mac.addr_1, dest, ADDRLEN);
+    memcpy_toio(ptx->mac.addr_2, local->sparm.b4.a_mac_addr, ADDRLEN);
+    memcpy_toio(ptx->mac.addr_3, local->bss_id, ADDRLEN);
+
+    /* Fill in msg body with protocol 00 00, sequence 01 00 ,status 00 00 */
+    memset_io(ptx->var, 0, 6);
+    writeb(auth_type & 0xff, ptx->var + 2);
+
+    /* Interrupt the firmware to process the command */
+    if (interrupt_ecf(local, ccsindex)) {
+        DEBUG(1,"ray_cs send authentication request failed - ECF not ready for intr\n");
+        writeb(CCS_BUFFER_FREE, &(pccs++)->buffer_status);
+        return -1;
+    }
+    return 0;
+} /* End build_auth_frame */
+
+/*===========================================================================*/
+#ifdef CONFIG_PROC_FS
+static void raycs_write(const char *name, write_proc_t *w, void *data)
+{
+	struct proc_dir_entry * entry = create_proc_entry(name, S_IFREG | S_IWUSR, NULL);
+	if (entry) {
+		entry->write_proc = w;
+		entry->data = data;
+	}
+}
+
+static int write_essid(struct file *file, const char __user *buffer, unsigned long count, void *data)
+{
+	static char proc_essid[33];
+	int len = count;
+
+	if (len > 32)
+		len = 32;
+	memset(proc_essid, 0, 33);
+	if (copy_from_user(proc_essid, buffer, len))
+		return -EFAULT;
+	essid = proc_essid;
+	return count;
+}
+
+static int write_int(struct file *file, const char __user *buffer, unsigned long count, void *data)
+{
+	static char proc_number[10];
+	char *p;
+	int nr, len;
+
+	if (!count)
+		return 0;
+
+	if (count > 9)
+		return -EINVAL;
+	if (copy_from_user(proc_number, buffer, count))
+		return -EFAULT;
+	p = proc_number;
+	nr = 0;
+	len = count;
+	do {
+		unsigned int c = *p - '0';
+		if (c > 9)
+			return -EINVAL;
+		nr = nr*10 + c;
+		p++;
+	} while (--len);
+	*(int *)data = nr;
+	return count;
+}
+#endif
+
+static struct pcmcia_driver ray_driver = {
+	.owner		= THIS_MODULE,
+	.drv		= {
+		.name	= "ray_cs",
+	},
+	.attach		= ray_attach,
+	.detach		= ray_detach,
+};
+
+static int __init init_ray_cs(void)
+{
+    int rc;
+    
+    DEBUG(1, "%s\n", rcsid);
+    rc = pcmcia_register_driver(&ray_driver);
+    DEBUG(1, "raylink init_module register_pcmcia_driver returns 0x%x\n",rc);
+
+#ifdef CONFIG_PROC_FS
+    proc_mkdir("driver/ray_cs", NULL);
+
+    create_proc_info_entry("driver/ray_cs/ray_cs", 0, NULL, &ray_cs_proc_read);
+    raycs_write("driver/ray_cs/essid", write_essid, NULL);
+    raycs_write("driver/ray_cs/net_type", write_int, &net_type);
+    raycs_write("driver/ray_cs/translate", write_int, &translate);
+#endif
+    if (translate != 0) translate = 1;
+    return 0;
+} /* init_ray_cs */
+
+/*===========================================================================*/
+
+static void __exit exit_ray_cs(void)
+{
+    DEBUG(0, "ray_cs: cleanup_module\n");
+
+#ifdef CONFIG_PROC_FS
+    remove_proc_entry("driver/ray_cs/ray_cs", NULL);
+    remove_proc_entry("driver/ray_cs/essid", NULL);
+    remove_proc_entry("driver/ray_cs/net_type", NULL);
+    remove_proc_entry("driver/ray_cs/translate", NULL);
+    remove_proc_entry("driver/ray_cs", NULL);
+#endif
+
+    pcmcia_unregister_driver(&ray_driver);
+    BUG_ON(dev_list != NULL);
+} /* exit_ray_cs */
+
+module_init(init_ray_cs);
+module_exit(exit_ray_cs);
+
+/*===========================================================================*/
diff --git a/drivers/net/wireless/ray_cs.h b/drivers/net/wireless/ray_cs.h
new file mode 100644
index 0000000..c77afa1
--- /dev/null
+++ b/drivers/net/wireless/ray_cs.h
@@ -0,0 +1,78 @@
+/* Raytheon wireless LAN PCMCIA card driver for Linux 
+   A  PCMCIA client driver for the Raylink wireless network card
+   Written by Corey Thomas
+*/
+
+#ifndef RAYLINK_H
+
+struct beacon_rx {
+    struct mac_header mac;
+    UCHAR timestamp[8];
+    UCHAR beacon_intvl[2];
+    UCHAR capability[2];
+    UCHAR elements[sizeof(struct essid_element) 
+                  + sizeof(struct rates_element)
+                  + sizeof(struct freq_hop_element) 
+                  + sizeof(struct japan_call_sign_element)
+                  + sizeof(struct tim_element)];
+};
+
+/* Return values for get_free{,_tx}_ccs */
+#define ECCSFULL  (-1)
+#define ECCSBUSY  (-2)
+#define ECARDGONE (-3)
+
+typedef struct ray_dev_t {
+    int card_status;
+    int authentication_state;
+    dev_node_t  node;
+    window_handle_t amem_handle;   /* handle to window for attribute memory  */
+    window_handle_t rmem_handle;   /* handle to window for rx buffer on card */
+    void __iomem *sram;            /* pointer to beginning of shared RAM     */
+    void __iomem *amem;            /* pointer to attribute mem window        */
+    void __iomem *rmem;            /* pointer to receive buffer window       */
+    dev_link_t *finder;            /* pointer back to dev_link_t for card    */
+    struct timer_list timer;
+    long tx_ccs_lock;
+    long ccs_lock;
+    int   dl_param_ccs;
+    union {
+        struct b4_startup_params b4;
+        struct b5_startup_params b5;
+    } sparm;
+    int timeout_flag;
+    UCHAR supported_rates[8];
+    UCHAR japan_call_sign[12];
+    struct startup_res_6 startup_res;
+    int num_multi;
+    /* Network parameters from start/join */
+    UCHAR bss_id[6];
+    UCHAR auth_id[6];
+    UCHAR net_default_tx_rate;
+    UCHAR encryption;
+    struct net_device_stats stats;
+
+    UCHAR net_type;
+    UCHAR sta_type;
+    UCHAR fw_ver;
+    UCHAR fw_bld;
+    UCHAR fw_var;
+    UCHAR ASIC_version;
+    UCHAR assoc_id[2];
+    UCHAR tib_length;
+    UCHAR last_rsl;
+    int beacon_rxed;
+    struct beacon_rx last_bcn;
+#ifdef WIRELESS_EXT
+    iw_stats	wstats;		/* Wireless specific stats */
+#endif
+#ifdef WIRELESS_SPY
+    int		spy_number;		/* Number of addresses to spy */
+    mac_addr	spy_address[IW_MAX_SPY + 1];	/* The addresses to spy */
+    iw_qual	spy_stat[IW_MAX_SPY + 1];	/* Statistics gathered */
+#endif	/* WIRELESS_SPY */
+
+} ray_dev_t;
+/*****************************************************************************/
+
+#endif /* RAYLINK_H */
diff --git a/drivers/net/wireless/rayctl.h b/drivers/net/wireless/rayctl.h
new file mode 100644
index 0000000..49d9b26
--- /dev/null
+++ b/drivers/net/wireless/rayctl.h
@@ -0,0 +1,732 @@
+#ifndef RAYLINK_H
+
+typedef unsigned char UCHAR;
+
+/****** IEEE 802.11 constants ************************************************/
+#define ADDRLEN           6
+/* Frame control 1 bit fields */
+#define PROTOCOL_VER      0x00
+#define DATA_TYPE         0x08
+#define ASSOC_REQ_TYPE    0x00
+#define ASSOC_RESP_TYPE   0x10
+#define REASSOC_REQ_TYPE  0x20
+#define REASSOC_RESP_TYPE 0x30
+#define NULL_MSG_TYPE     0x48
+#define BEACON_TYPE       0x80
+#define DISASSOC_TYPE     0xA0
+#define PSPOLL_TYPE       0xA4
+#define AUTHENTIC_TYPE    0xB0
+#define DEAUTHENTIC_TYPE  0xC0
+/* Frame control 2 bit fields */
+#define FC2_TO_DS         0x01
+#define FC2_FROM_DS       0x02
+#define FC2_MORE_FRAG     0x04
+#define FC2_RETRY         0x08
+#define FC2_PSM           0x10
+#define FC2_MORE_DATA     0x20
+#define FC2_WEP           0x40
+#define FC2_ORDER         0x80
+/*****************************************************************************/
+/* 802.11 element ID's and lengths */
+#define C_BP_CAPABILITY_ESS             0x01
+#define C_BP_CAPABILITY_IBSS            0x02
+#define C_BP_CAPABILITY_CF_POLLABLE     0x04
+#define C_BP_CAPABILITY_CF_POLL_REQUEST 0x08
+#define C_BP_CAPABILITY_PRIVACY         0x10
+
+#define C_ESSID_ELEMENT_ID               0
+#define C_ESSID_ELEMENT_MAX_LENGTH       32
+
+#define C_SUPPORTED_RATES_ELEMENT_ID     1
+#define C_SUPPORTED_RATES_ELEMENT_LENGTH 2
+
+#define C_FH_PARAM_SET_ELEMENT_ID        2
+#define C_FH_PARAM_SET_ELEMENT_LNGTH     5
+
+#define C_CF_PARAM_SET_ELEMENT_ID        4
+#define C_CF_PARAM_SET_ELEMENT_LNGTH     6
+
+#define C_TIM_ELEMENT_ID                 5
+#define C_TIM_BITMAP_LENGTH            251
+#define C_TIM_BMCAST_BIT              0x01
+
+#define C_IBSS_ELEMENT_ID                6
+#define C_IBSS_ELEMENT_LENGTH            2
+
+#define C_JAPAN_CALL_SIGN_ELEMENT_ID    51
+#define C_JAPAN_CALL_SIGN_ELEMENT_LNGTH 12
+
+#define C_DISASSOC_REASON_CODE_LEN       2
+#define C_DISASSOC_REASON_CODE_DEFAULT   8
+
+#define C_CRC_LEN                        4
+#define C_NUM_SUPPORTED_RATES            8 
+/****** IEEE 802.11 mac header for type data packets *************************/
+struct mac_header {
+  UCHAR frame_ctl_1;                          
+  UCHAR frame_ctl_2;
+  UCHAR duration_lsb;
+  UCHAR duration_msb;
+  UCHAR addr_1[ADDRLEN];
+  UCHAR addr_2[ADDRLEN];
+  UCHAR addr_3[ADDRLEN];
+  UCHAR seq_frag_num[2];
+/*  UCHAR addr_4[ADDRLEN]; *//* only present for AP to AP (TO DS and FROM DS */
+};
+/****** IEEE 802.11 frame element structures *********************************/
+struct essid_element
+{
+  UCHAR id;
+  UCHAR length;
+  UCHAR text[C_ESSID_ELEMENT_MAX_LENGTH];
+};
+struct rates_element
+{
+  UCHAR id;
+  UCHAR length;
+  UCHAR value[8];
+};
+struct freq_hop_element
+{
+  UCHAR id;
+  UCHAR length;
+  UCHAR dwell_time[2];
+  UCHAR hop_set;
+  UCHAR hop_pattern;
+  UCHAR hop_index;
+};
+struct tim_element
+{
+  UCHAR id;
+  UCHAR length;
+  UCHAR dtim_count;
+  UCHAR dtim_period;    
+  UCHAR bitmap_control;
+  UCHAR tim[C_TIM_BITMAP_LENGTH];
+};
+struct ibss_element
+{
+  UCHAR id;
+  UCHAR length;
+  UCHAR atim_window[2];
+};
+struct japan_call_sign_element
+{
+  UCHAR id;
+  UCHAR length;
+  UCHAR call_sign[12];
+};
+/****** Beacon message structures ********************************************/
+/* .elements is a large lump of max size because elements are variable size  */
+struct infra_beacon
+{
+    UCHAR timestamp[8];
+    UCHAR beacon_intvl[2];
+    UCHAR capability[2];
+    UCHAR elements[sizeof(struct essid_element) 
+                  + sizeof(struct rates_element)
+                  + sizeof(struct freq_hop_element) 
+                  + sizeof(struct japan_call_sign_element)
+                  + sizeof(struct tim_element)];
+};
+struct adhoc_beacon
+{
+    UCHAR timestamp[8];
+    UCHAR beacon_intvl[2];
+    UCHAR capability[2];
+    UCHAR elements[sizeof(struct essid_element) 
+                  + sizeof(struct rates_element)
+                  + sizeof(struct freq_hop_element) 
+                  + sizeof(struct japan_call_sign_element)
+                  + sizeof(struct ibss_element)];
+};
+/*****************************************************************************/
+/*****************************************************************************/
+/* #define C_MAC_HDR_2_WEP 0x40 */
+/* TX/RX CCS constants */
+#define TX_HEADER_LENGTH 0x1C
+#define RX_MAC_HEADER_LENGTH 0x18
+#define TX_AUTHENTICATE_LENGTH (TX_HEADER_LENGTH + 6)
+#define TX_AUTHENTICATE_LENGTH_MSB (TX_AUTHENTICATE_LENGTH >> 8)
+#define TX_AUTHENTICATE_LENGTH_LSB (TX_AUTHENTICATE_LENGTH & 0xff)
+#define TX_DEAUTHENTICATE_LENGTH (TX_HEADER_LENGTH + 2)
+#define TX_DEAUTHENTICATE_LENGTH_MSB (TX_AUTHENTICATE_LENGTH >> 8)
+#define TX_DEAUTHENTICATE_LENGTH_LSB (TX_AUTHENTICATE_LENGTH & 0xff)
+#define FCS_LEN           4
+
+#define ADHOC                 0
+#define INFRA                 1
+
+#define TYPE_STA              0
+#define TYPE_AP               1
+
+#define PASSIVE_SCAN          1
+#define ACTIVE_SCAN           1
+
+#define PSM_CAM               0
+
+/* Country codes */
+#define USA                   1
+#define EUROPE                2
+#define JAPAN                 3
+#define KOREA                 4
+#define SPAIN                 5
+#define FRANCE                6
+#define ISRAEL                7
+#define AUSTRALIA             8
+#define JAPAN_TEST            9
+
+/* Hop pattern lengths */
+#define USA_HOP_MOD          79 
+#define EUROPE_HOP_MOD       79 
+#define JAPAN_HOP_MOD        23
+#define KOREA_HOP_MOD        23
+#define SPAIN_HOP_MOD        27
+#define FRANCE_HOP_MOD       35
+#define ISRAEL_HOP_MOD       35
+#define AUSTRALIA_HOP_MOD    47
+#define JAPAN_TEST_HOP_MOD   23
+
+#define ESSID_SIZE           32
+/**********************************************************************/
+/* CIS Register Constants */
+#define CIS_OFFSET             0x0f00
+/* Configuration Option Register (0x0F00) */
+#define COR_OFFSET             0x00
+#define COR_SOFT_RESET         0x80
+#define COR_LEVEL_IRQ          0x40
+#define COR_CONFIG_NUM         0x01
+#define COR_DEFAULT            (COR_LEVEL_IRQ | COR_CONFIG_NUM)
+
+/* Card Configuration and Status Register (0x0F01) */
+#define CCSR_OFFSET            0x01
+#define CCSR_HOST_INTR_PENDING 0x01
+#define CCSR_POWER_DOWN        0x04
+
+/* HCS Interrupt Register (0x0F05) */
+#define HCS_INTR_OFFSET        0x05
+/* #define HCS_INTR_OFFSET        0x0A */
+#define HCS_INTR_CLEAR         0x00
+
+/* ECF Interrupt Register (0x0F06) */
+#define ECF_INTR_OFFSET        0x06
+/* #define ECF_INTR_OFFSET        0x0C */
+#define ECF_INTR_SET           0x01
+
+/* Authorization Register 0 (0x0F08) */
+#define AUTH_0_ON              0x57
+
+/* Authorization Register 1 (0x0F09) */
+#define AUTH_1_ON              0x82
+
+/* Program Mode Register (0x0F0A) */
+#define PC2PM                  0x02
+#define PC2CAL                 0x10
+#define PC2MLSE                0x20
+
+/* PC Test Mode Register (0x0F0B) */
+#define PC_TEST_MODE           0x08
+
+/* Frequency Control Word (0x0F10) */
+/* Range 0x02 - 0xA6 */
+
+/* Test Mode Control 1-4 (0x0F14 - 0x0F17) */
+
+/**********************************************************************/
+
+/* Shared RAM Area */
+#define SCB_BASE               0x0000
+#define STATUS_BASE            0x0100
+#define HOST_TO_ECF_BASE       0x0200
+#define ECF_TO_HOST_BASE       0x0300
+#define CCS_BASE               0x0400
+#define RCS_BASE               0x0800
+#define INFRA_TIM_BASE         0x0C00
+#define SSID_LIST_BASE         0x0D00
+#define TX_BUF_BASE            0x1000
+#define RX_BUF_BASE            0x8000
+
+#define NUMBER_OF_CCS    64
+#define NUMBER_OF_RCS    64
+/*#define NUMBER_OF_TX_CCS 14 */
+#define NUMBER_OF_TX_CCS 14
+
+#define TX_BUF_SIZE      (2048 - sizeof(struct tx_msg))
+#define RX_BUFF_END      0x3FFF
+/* Values for buffer_status */
+#define CCS_BUFFER_FREE       0
+#define CCS_BUFFER_BUSY       1
+#define CCS_COMMAND_COMPLETE  2
+#define CCS_COMMAND_FAILED    3
+
+/* Values for cmd */
+#define CCS_DOWNLOAD_STARTUP_PARAMS    1
+#define CCS_UPDATE_PARAMS              2
+#define CCS_REPORT_PARAMS              3
+#define CCS_UPDATE_MULTICAST_LIST      4
+#define CCS_UPDATE_POWER_SAVINGS_MODE  5
+#define CCS_START_NETWORK              6
+#define CCS_JOIN_NETWORK               7
+#define CCS_START_ASSOCIATION          8
+#define CCS_TX_REQUEST                 9
+#define CCS_TEST_MEMORY              0xa
+#define CCS_SHUTDOWN                 0xb
+#define CCS_DUMP_MEMORY              0xc
+#define CCS_START_TIMER              0xe
+#define CCS_LAST_CMD                 CCS_START_TIMER
+
+/* Values for link field */
+#define CCS_END_LIST                 0xff
+
+/* values for buffer_status field */
+#define RCS_BUFFER_FREE       0
+#define RCS_BUFFER_BUSY       1
+#define RCS_COMPLETE          2
+#define RCS_FAILED            3
+#define RCS_BUFFER_RELEASE    0xFF
+
+/* values for interrupt_id field */
+#define PROCESS_RX_PACKET           0x80 /* */
+#define REJOIN_NET_COMPLETE         0x81 /* RCS ID: Rejoin Net Complete */
+#define ROAMING_INITIATED           0x82 /* RCS ID: Roaming Initiated   */
+#define JAPAN_CALL_SIGN_RXD         0x83 /* RCS ID: New Japan Call Sign */
+
+/*****************************************************************************/
+/* Memory types for dump memory command */
+#define C_MEM_PROG  0
+#define C_MEM_XDATA 1
+#define C_MEM_SFR   2
+#define C_MEM_IDATA 3
+
+/*** Return values for hw_xmit **********/
+#define XMIT_OK        (0)
+#define XMIT_MSG_BAD   (-1)
+#define XMIT_NO_CCS    (-2)
+#define XMIT_NO_INTR   (-3)
+#define XMIT_NEED_AUTH (-4)
+
+/*** Values for card status */
+#define CARD_INSERTED       (0)
+
+#define CARD_AWAITING_PARAM (1)
+#define CARD_INIT_ERROR     (11)
+
+#define CARD_DL_PARAM       (2)
+#define CARD_DL_PARAM_ERROR (12)
+
+#define CARD_DOING_ACQ      (3)
+
+#define CARD_ACQ_COMPLETE   (4)
+#define CARD_ACQ_FAILED     (14)
+
+#define CARD_AUTH_COMPLETE  (5)
+#define CARD_AUTH_REFUSED   (15)
+
+#define CARD_ASSOC_COMPLETE (6)
+#define CARD_ASSOC_FAILED   (16)
+
+/*** Values for authentication_state ***********************************/
+#define UNAUTHENTICATED     (0)
+#define AWAITING_RESPONSE   (1)
+#define AUTHENTICATED       (2)
+#define NEED_TO_AUTH        (3)
+
+/*** Values for authentication type ************************************/
+#define OPEN_AUTH_REQUEST   (1)
+#define OPEN_AUTH_RESPONSE  (2)
+#define BROADCAST_DEAUTH    (0xc0)
+/*** Values for timer functions ****************************************/
+#define TODO_NOTHING              (0)
+#define TODO_VERIFY_DL_START      (-1)
+#define TODO_START_NET            (-2)
+#define TODO_JOIN_NET             (-3)
+#define TODO_AUTHENTICATE_TIMEOUT (-4)
+#define TODO_SEND_CCS             (-5)
+/***********************************************************************/
+/* Parameter passing structure for update/report parameter CCS's */
+struct object_id {
+    void          *object_addr;
+    unsigned char object_length;
+};
+
+#define OBJID_network_type            0
+#define OBJID_acting_as_ap_status     1
+#define OBJID_current_ess_id          2
+#define OBJID_scanning_mode           3
+#define OBJID_power_mgt_state         4
+#define OBJID_mac_address             5
+#define OBJID_frag_threshold          6
+#define OBJID_hop_time                7
+#define OBJID_beacon_period           8
+#define OBJID_dtim_period             9
+#define OBJID_retry_max              10
+#define OBJID_ack_timeout            11
+#define OBJID_sifs                   12
+#define OBJID_difs                   13
+#define OBJID_pifs                   14
+#define OBJID_rts_threshold          15
+#define OBJID_scan_dwell_time        16
+#define OBJID_max_scan_dwell_time    17
+#define OBJID_assoc_resp_timeout     18
+#define OBJID_adhoc_scan_cycle_max   19
+#define OBJID_infra_scan_cycle_max   20
+#define OBJID_infra_super_cycle_max  21
+#define OBJID_promiscuous_mode       22
+#define OBJID_unique_word            23
+#define OBJID_slot_time              24
+#define OBJID_roaming_low_snr        25
+#define OBJID_low_snr_count_thresh   26
+#define OBJID_infra_missed_bcn       27
+#define OBJID_adhoc_missed_bcn       28
+#define OBJID_curr_country_code      29
+#define OBJID_hop_pattern            30
+#define OBJID_reserved               31
+#define OBJID_cw_max_msb             32
+#define OBJID_cw_min_msb             33
+#define OBJID_noise_filter_gain      34
+#define OBJID_noise_limit_offset     35
+#define OBJID_det_rssi_thresh_offset 36
+#define OBJID_med_busy_thresh_offset 37
+#define OBJID_det_sync_thresh        38
+#define OBJID_test_mode              39
+#define OBJID_test_min_chan_num      40
+#define OBJID_test_max_chan_num      41
+#define OBJID_allow_bcast_ID_prbrsp  42
+#define OBJID_privacy_must_start     43
+#define OBJID_privacy_can_join       44
+#define OBJID_basic_rate_set         45
+
+/**** Configuration/Status/Control Area ***************************/
+/*    System Control Block (SCB) Area
+ *    Located at Shared RAM offset 0
+ */
+struct scb {
+    UCHAR ccs_index;
+    UCHAR rcs_index;
+};
+
+/****** Status area at Shared RAM offset 0x0100 ******************************/
+struct status {
+    UCHAR mrx_overflow_for_host;         /* 0=ECF may write, 1=host may write*/
+    UCHAR mrx_checksum_error_for_host;   /* 0=ECF may write, 1=host may write*/
+    UCHAR rx_hec_error_for_host;         /* 0=ECF may write, 1=host may write*/
+    UCHAR reserved1;
+    short mrx_overflow;                  /* ECF increments on rx overflow    */
+    short mrx_checksum_error;            /* ECF increments on rx CRC error   */
+    short rx_hec_error;                  /* ECF incs on mac header CRC error */
+    UCHAR rxnoise;                       /* Average RSL measurement          */
+};
+
+/****** Host-to-ECF Data Area at Shared RAM offset 0x200 *********************/
+struct host_to_ecf_area {
+    
+};
+
+/****** ECF-to-Host Data Area at Shared RAM offset 0x0300 ********************/
+struct startup_res_518 {
+    UCHAR startup_word;
+    UCHAR station_addr[ADDRLEN];
+    UCHAR calc_prog_chksum;
+    UCHAR calc_cis_chksum;
+    UCHAR ecf_spare[7];
+    UCHAR japan_call_sign[12];
+};
+
+struct startup_res_6 {
+    UCHAR startup_word;
+    UCHAR station_addr[ADDRLEN];
+    UCHAR reserved;
+    UCHAR supp_rates[8];
+    UCHAR japan_call_sign[12];
+    UCHAR calc_prog_chksum;
+    UCHAR calc_cis_chksum;
+    UCHAR firmware_version[3];
+    UCHAR asic_version;
+    UCHAR tib_length;
+};
+
+struct start_join_net_params {
+    UCHAR net_type;
+    UCHAR ssid[ESSID_SIZE];
+    UCHAR reserved;
+    UCHAR privacy_can_join;
+};
+
+/****** Command Control Structure area at Shared ram offset 0x0400 ***********/
+/* Structures for command specific parameters (ccs.var) */
+struct update_param_cmd {
+    UCHAR object_id;
+    UCHAR number_objects;
+    UCHAR failure_cause;
+};
+struct report_param_cmd {
+    UCHAR object_id;
+    UCHAR number_objects;
+    UCHAR failure_cause;
+    UCHAR length;
+};
+struct start_network_cmd {
+    UCHAR update_param;
+    UCHAR bssid[ADDRLEN];
+    UCHAR net_initiated;
+    UCHAR net_default_tx_rate;
+    UCHAR encryption;
+};
+struct join_network_cmd {
+    UCHAR update_param;
+    UCHAR bssid[ADDRLEN];
+    UCHAR net_initiated;
+    UCHAR net_default_tx_rate;
+    UCHAR encryption;
+};
+struct tx_requested_cmd {
+ 
+    UCHAR tx_data_ptr[2];
+    UCHAR tx_data_length[2];
+    UCHAR host_reserved[2];
+    UCHAR reserved[3];
+    UCHAR tx_rate;
+    UCHAR pow_sav_mode;
+    UCHAR retries;
+    UCHAR antenna;
+};
+struct tx_requested_cmd_4 {
+ 
+    UCHAR tx_data_ptr[2];
+    UCHAR tx_data_length[2];
+    UCHAR dest_addr[ADDRLEN];
+    UCHAR pow_sav_mode;
+    UCHAR retries;
+    UCHAR station_id;
+};
+struct memory_dump_cmd {
+    UCHAR memory_type;
+    UCHAR memory_ptr[2];
+    UCHAR length;
+};
+struct update_association_cmd {
+    UCHAR status;
+    UCHAR aid[2];
+};
+struct start_timer_cmd {
+    UCHAR duration[2];
+};
+
+struct ccs {
+    UCHAR buffer_status;                 /* 0 = buffer free, 1 = buffer busy */
+                                         /* 2 = command complete, 3 = failed */
+    UCHAR cmd;                           /* command to ECF                   */
+    UCHAR link;                          /* link to next CCS, FF=end of list */
+    /* command specific parameters      */
+    union {
+        char reserved[13];
+        struct update_param_cmd update_param;
+        struct report_param_cmd report_param;
+        UCHAR nummulticast;
+        UCHAR mode;
+        struct start_network_cmd start_network;
+        struct join_network_cmd join_network;
+        struct tx_requested_cmd tx_request;
+        struct memory_dump_cmd memory_dump;
+        struct update_association_cmd update_assoc;
+        struct start_timer_cmd start_timer;
+    } var;
+};
+
+/*****************************************************************************/
+/* Transmit buffer structures */
+struct tib_structure {
+    UCHAR ccs_index;
+    UCHAR psm;
+    UCHAR pass_fail;
+    UCHAR retry_count;
+    UCHAR max_retries;
+    UCHAR frags_remaining;
+    UCHAR no_rb;
+    UCHAR rts_reqd;
+    UCHAR csma_tx_cntrl_2;
+    UCHAR sifs_tx_cntrl_2;
+    UCHAR tx_dma_addr_1[2];
+    UCHAR tx_dma_addr_2[2];
+    UCHAR var_dur_2mhz[2];
+    UCHAR var_dur_1mhz[2];
+    UCHAR max_dur_2mhz[2];
+    UCHAR max_dur_1mhz[2];
+    UCHAR hdr_len;
+    UCHAR max_frag_len[2];
+    UCHAR var_len[2];
+    UCHAR phy_hdr_4;
+    UCHAR mac_hdr_1;
+    UCHAR mac_hdr_2;
+    UCHAR sid[2];
+};
+
+struct phy_header {
+    UCHAR sfd[2];
+    UCHAR hdr_3;
+    UCHAR hdr_4;
+};
+struct rx_msg {
+    struct mac_header mac;
+    UCHAR  var[1];
+};
+
+struct tx_msg {
+    struct tib_structure tib;
+    struct phy_header phy;
+    struct mac_header mac;
+    UCHAR  var[1];
+};
+
+/****** ECF Receive Control Stucture (RCS) Area at Shared RAM offset 0x0800  */
+/* Structures for command specific parameters (rcs.var) */
+struct rx_packet_cmd {
+    UCHAR rx_data_ptr[2];
+    UCHAR rx_data_length[2];
+    UCHAR rx_sig_lev;
+    UCHAR next_frag_rcs_index;
+    UCHAR totalpacketlength[2];
+};
+struct rejoin_net_cmplt_cmd {
+    UCHAR reserved;
+    UCHAR bssid[ADDRLEN];
+};
+struct japan_call_sign_rxd {
+    UCHAR rxd_call_sign[8];
+    UCHAR reserved[5];
+};
+
+struct rcs {
+    UCHAR buffer_status;
+    UCHAR interrupt_id;
+    UCHAR link_field;
+    /* command specific parameters      */
+    union {
+        UCHAR reserved[13]; 
+        struct rx_packet_cmd rx_packet;
+        struct rejoin_net_cmplt_cmd rejoin_net_complete;
+        struct japan_call_sign_rxd japan_call_sign;
+    } var;
+};
+
+/****** Startup parameter structures for both versions of firmware ***********/
+struct b4_startup_params {
+    UCHAR a_network_type;                /* C_ADHOC, C_INFRA                 */
+    UCHAR a_acting_as_ap_status;         /* C_TYPE_STA, C_TYPE_AP            */
+    UCHAR a_current_ess_id[ESSID_SIZE];  /* Null terminated unless 32 long   */
+    UCHAR a_scanning_mode;               /* passive 0, active 1              */
+    UCHAR a_power_mgt_state;             /* CAM 0,                           */
+    UCHAR a_mac_addr[ADDRLEN];           /*                                  */
+    UCHAR a_frag_threshold[2];           /* 512                              */
+    UCHAR a_hop_time[2];                 /* 16k * 2**n, n=0-4 in Kus         */
+    UCHAR a_beacon_period[2];            /* n * a_hop_time  in Kus           */
+    UCHAR a_dtim_period;                 /* in beacons                       */
+    UCHAR a_retry_max;                   /*                                  */
+    UCHAR a_ack_timeout;                 /*                                  */
+    UCHAR a_sifs;                        /*                                  */
+    UCHAR a_difs;                        /*                                  */
+    UCHAR a_pifs;                        /*                                  */
+    UCHAR a_rts_threshold[2];            /*                                  */
+    UCHAR a_scan_dwell_time[2];          /*                                  */
+    UCHAR a_max_scan_dwell_time[2];      /*                                  */
+    UCHAR a_assoc_resp_timeout_thresh;   /*                                  */
+    UCHAR a_adhoc_scan_cycle_max;        /*                                  */
+    UCHAR a_infra_scan_cycle_max;        /*                                  */
+    UCHAR a_infra_super_scan_cycle_max;  /*                                  */
+    UCHAR a_promiscuous_mode;            /*                                  */
+    UCHAR a_unique_word[2];              /*                                  */
+    UCHAR a_slot_time;                   /*                                  */
+    UCHAR a_roaming_low_snr_thresh;      /*                                  */
+    UCHAR a_low_snr_count_thresh;        /*                                  */
+    UCHAR a_infra_missed_bcn_thresh;     /*                                  */
+    UCHAR a_adhoc_missed_bcn_thresh;     /*                                  */
+    UCHAR a_curr_country_code;           /* C_USA                            */
+    UCHAR a_hop_pattern;                 /*                                  */
+    UCHAR a_hop_pattern_length;          /*                                  */
+/* b4 - b5 differences start here */
+    UCHAR a_cw_max;                      /*                                  */
+    UCHAR a_cw_min;                      /*                                  */
+    UCHAR a_noise_filter_gain;           /*                                  */
+    UCHAR a_noise_limit_offset;          /*                                  */
+    UCHAR a_det_rssi_thresh_offset;      /*                                  */
+    UCHAR a_med_busy_thresh_offset;      /*                                  */
+    UCHAR a_det_sync_thresh;             /*                                  */
+    UCHAR a_test_mode;                   /*                                  */
+    UCHAR a_test_min_chan_num;           /*                                  */
+    UCHAR a_test_max_chan_num;           /*                                  */
+    UCHAR a_rx_tx_delay;                 /*                                  */
+    UCHAR a_current_bss_id[ADDRLEN];     /*                                  */
+    UCHAR a_hop_set;                     /*                                  */
+};
+struct b5_startup_params {
+    UCHAR a_network_type;                /* C_ADHOC, C_INFRA                 */
+    UCHAR a_acting_as_ap_status;         /* C_TYPE_STA, C_TYPE_AP            */
+    UCHAR a_current_ess_id[ESSID_SIZE];  /* Null terminated unless 32 long   */
+    UCHAR a_scanning_mode;               /* passive 0, active 1              */
+    UCHAR a_power_mgt_state;             /* CAM 0,                           */
+    UCHAR a_mac_addr[ADDRLEN];           /*                                  */
+    UCHAR a_frag_threshold[2];           /* 512                              */
+    UCHAR a_hop_time[2];                 /* 16k * 2**n, n=0-4 in Kus         */
+    UCHAR a_beacon_period[2];            /* n * a_hop_time  in Kus           */
+    UCHAR a_dtim_period;                 /* in beacons                       */
+    UCHAR a_retry_max;                   /* 4                                */
+    UCHAR a_ack_timeout;                 /*                                  */
+    UCHAR a_sifs;                        /*                                  */
+    UCHAR a_difs;                        /*                                  */
+    UCHAR a_pifs;                        /*                                  */
+    UCHAR a_rts_threshold[2];            /*                                  */
+    UCHAR a_scan_dwell_time[2];          /*                                  */
+    UCHAR a_max_scan_dwell_time[2];      /*                                  */
+    UCHAR a_assoc_resp_timeout_thresh;   /*                                  */
+    UCHAR a_adhoc_scan_cycle_max;        /*                                  */
+    UCHAR a_infra_scan_cycle_max;        /*                                  */
+    UCHAR a_infra_super_scan_cycle_max;  /*                                  */
+    UCHAR a_promiscuous_mode;            /*                                  */
+    UCHAR a_unique_word[2];              /*                                  */
+    UCHAR a_slot_time;                   /*                                  */
+    UCHAR a_roaming_low_snr_thresh;      /*                                  */
+    UCHAR a_low_snr_count_thresh;        /*                                  */
+    UCHAR a_infra_missed_bcn_thresh;     /*                                  */
+    UCHAR a_adhoc_missed_bcn_thresh;     /*                                  */
+    UCHAR a_curr_country_code;           /* C_USA                            */
+    UCHAR a_hop_pattern;                 /*                                  */
+    UCHAR a_hop_pattern_length;          /*                                  */
+/* b4 - b5 differences start here */
+    UCHAR a_cw_max[2];                   /*                                  */
+    UCHAR a_cw_min[2];                   /*                                  */
+    UCHAR a_noise_filter_gain;           /*                                  */
+    UCHAR a_noise_limit_offset;          /*                                  */
+    UCHAR a_det_rssi_thresh_offset;      /*                                  */
+    UCHAR a_med_busy_thresh_offset;      /*                                  */
+    UCHAR a_det_sync_thresh;             /*                                  */
+    UCHAR a_test_mode;                   /*                                  */
+    UCHAR a_test_min_chan_num;           /*                                  */
+    UCHAR a_test_max_chan_num;           /*                                  */
+    UCHAR a_allow_bcast_SSID_probe_rsp;
+    UCHAR a_privacy_must_start;
+    UCHAR a_privacy_can_join;
+    UCHAR a_basic_rate_set[8];
+};
+
+/*****************************************************************************/
+#define RAY_IOCG_PARMS (SIOCDEVPRIVATE)
+#define RAY_IOCS_PARMS (SIOCDEVPRIVATE + 1)
+#define RAY_DO_CMD     (SIOCDEVPRIVATE + 2)
+
+/****** ethernet <-> 802.11 translation **************************************/
+typedef struct snaphdr_t
+{
+  UCHAR   dsap;
+  UCHAR   ssap;
+  UCHAR   ctrl;
+  UCHAR   org[3];
+  UCHAR   ethertype[2];
+} snaphdr_t;
+
+#define BRIDGE_ENCAP  0xf80000
+#define RFC1042_ENCAP 0
+#define SNAP_ID       0x0003aaaa
+#define RAY_IPX_TYPE  0x8137
+#define APPLEARP_TYPE 0x80f3
+/*****************************************************************************/
+#endif /* #ifndef RAYLINK_H */
diff --git a/drivers/net/wireless/strip.c b/drivers/net/wireless/strip.c
new file mode 100644
index 0000000..ec8cf29f
--- /dev/null
+++ b/drivers/net/wireless/strip.c
@@ -0,0 +1,2843 @@
+/*
+ * Copyright 1996 The Board of Trustees of The Leland Stanford
+ * Junior University. All Rights Reserved.
+ *
+ * Permission to use, copy, modify, and distribute this
+ * software and its documentation for any purpose and without
+ * fee is hereby granted, provided that the above copyright
+ * notice appear in all copies.  Stanford University
+ * makes no representations about the suitability of this
+ * software for any purpose.  It is provided "as is" without
+ * express or implied warranty.
+ *
+ * strip.c	This module implements Starmode Radio IP (STRIP)
+ *		for kernel-based devices like TTY.  It interfaces between a
+ *		raw TTY, and the kernel's INET protocol layers (via DDI).
+ *
+ * Version:	@(#)strip.c	1.3	July 1997
+ *
+ * Author:	Stuart Cheshire <cheshire@cs.stanford.edu>
+ *
+ * Fixes:	v0.9 12th Feb 1996 (SC)
+ *		New byte stuffing (2+6 run-length encoding)
+ *		New watchdog timer task
+ *		New Protocol key (SIP0)
+ *		
+ *		v0.9.1 3rd March 1996 (SC)
+ *		Changed to dynamic device allocation -- no more compile
+ *		time (or boot time) limit on the number of STRIP devices.
+ *		
+ *		v0.9.2 13th March 1996 (SC)
+ *		Uses arp cache lookups (but doesn't send arp packets yet)
+ *		
+ *		v0.9.3 17th April 1996 (SC)
+ *		Fixed bug where STR_ERROR flag was getting set unneccessarily
+ *		(causing otherwise good packets to be unneccessarily dropped)
+ *		
+ *		v0.9.4 27th April 1996 (SC)
+ *		First attempt at using "&COMMAND" Starmode AT commands
+ *		
+ *		v0.9.5 29th May 1996 (SC)
+ *		First attempt at sending (unicast) ARP packets
+ *		
+ *		v0.9.6 5th June 1996 (Elliot)
+ *		Put "message level" tags in every "printk" statement
+ *		
+ *		v0.9.7 13th June 1996 (laik)
+ *		Added support for the /proc fs
+ *
+ *              v0.9.8 July 1996 (Mema)
+ *              Added packet logging
+ *
+ *              v1.0 November 1996 (SC)
+ *              Fixed (severe) memory leaks in the /proc fs code
+ *              Fixed race conditions in the logging code
+ *
+ *              v1.1 January 1997 (SC)
+ *              Deleted packet logging (use tcpdump instead)
+ *              Added support for Metricom Firmware v204 features
+ *              (like message checksums)
+ *
+ *              v1.2 January 1997 (SC)
+ *              Put portables list back in
+ *
+ *              v1.3 July 1997 (SC)
+ *              Made STRIP driver set the radio's baud rate automatically.
+ *              It is no longer necessarily to manually set the radio's
+ *              rate permanently to 115200 -- the driver handles setting
+ *              the rate automatically.
+ */
+
+#ifdef MODULE
+static const char StripVersion[] = "1.3A-STUART.CHESHIRE-MODULAR";
+#else
+static const char StripVersion[] = "1.3A-STUART.CHESHIRE";
+#endif
+
+#define TICKLE_TIMERS 0
+#define EXT_COUNTERS 1
+
+
+/************************************************************************/
+/* Header files								*/
+
+#include <linux/config.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/bitops.h>
+#include <asm/system.h>
+#include <asm/uaccess.h>
+
+# include <linux/ctype.h>
+#include <linux/string.h>
+#include <linux/mm.h>
+#include <linux/interrupt.h>
+#include <linux/in.h>
+#include <linux/tty.h>
+#include <linux/errno.h>
+#include <linux/netdevice.h>
+#include <linux/inetdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/skbuff.h>
+#include <linux/if_arp.h>
+#include <linux/if_strip.h>
+#include <linux/proc_fs.h>
+#include <linux/seq_file.h>
+#include <linux/serial.h>
+#include <linux/serialP.h>
+#include <linux/rcupdate.h>
+#include <net/arp.h>
+
+#include <linux/ip.h>
+#include <linux/tcp.h>
+#include <linux/time.h>
+
+
+/************************************************************************/
+/* Useful structures and definitions					*/
+
+/*
+ * A MetricomKey identifies the protocol being carried inside a Metricom
+ * Starmode packet.
+ */
+
+typedef union {
+	__u8 c[4];
+	__u32 l;
+} MetricomKey;
+
+/*
+ * An IP address can be viewed as four bytes in memory (which is what it is) or as
+ * a single 32-bit long (which is convenient for assignment, equality testing etc.)
+ */
+
+typedef union {
+	__u8 b[4];
+	__u32 l;
+} IPaddr;
+
+/*
+ * A MetricomAddressString is used to hold a printable representation of
+ * a Metricom address.
+ */
+
+typedef struct {
+	__u8 c[24];
+} MetricomAddressString;
+
+/* Encapsulation can expand packet of size x to 65/64x + 1
+ * Sent packet looks like "<CR>*<address>*<key><encaps payload><CR>"
+ *                           1 1   1-18  1  4         ?         1
+ * eg.                     <CR>*0000-1234*SIP0<encaps payload><CR>
+ * We allow 31 bytes for the stars, the key, the address and the <CR>s
+ */
+#define STRIP_ENCAP_SIZE(X) (32 + (X)*65L/64L)
+
+/*
+ * A STRIP_Header is never really sent over the radio, but making a dummy
+ * header for internal use within the kernel that looks like an Ethernet
+ * header makes certain other software happier. For example, tcpdump
+ * already understands Ethernet headers.
+ */
+
+typedef struct {
+	MetricomAddress dst_addr;	/* Destination address, e.g. "0000-1234"   */
+	MetricomAddress src_addr;	/* Source address, e.g. "0000-5678"        */
+	unsigned short protocol;	/* The protocol type, using Ethernet codes */
+} STRIP_Header;
+
+typedef struct {
+	char c[60];
+} MetricomNode;
+
+#define NODE_TABLE_SIZE 32
+typedef struct {
+	struct timeval timestamp;
+	int num_nodes;
+	MetricomNode node[NODE_TABLE_SIZE];
+} MetricomNodeTable;
+
+enum { FALSE = 0, TRUE = 1 };
+
+/*
+ * Holds the radio's firmware version.
+ */
+typedef struct {
+	char c[50];
+} FirmwareVersion;
+
+/*
+ * Holds the radio's serial number.
+ */
+typedef struct {
+	char c[18];
+} SerialNumber;
+
+/*
+ * Holds the radio's battery voltage.
+ */
+typedef struct {
+	char c[11];
+} BatteryVoltage;
+
+typedef struct {
+	char c[8];
+} char8;
+
+enum {
+	NoStructure = 0,	/* Really old firmware */
+	StructuredMessages = 1,	/* Parsable AT response msgs */
+	ChecksummedMessages = 2	/* Parsable AT response msgs with checksums */
+} FirmwareLevel;
+
+struct strip {
+	int magic;
+	/*
+	 * These are pointers to the malloc()ed frame buffers.
+	 */
+
+	unsigned char *rx_buff;	/* buffer for received IP packet */
+	unsigned char *sx_buff;	/* buffer for received serial data */
+	int sx_count;		/* received serial data counter */
+	int sx_size;		/* Serial buffer size           */
+	unsigned char *tx_buff;	/* transmitter buffer           */
+	unsigned char *tx_head;	/* pointer to next byte to XMIT */
+	int tx_left;		/* bytes left in XMIT queue     */
+	int tx_size;		/* Serial buffer size           */
+
+	/*
+	 * STRIP interface statistics.
+	 */
+
+	unsigned long rx_packets;	/* inbound frames counter       */
+	unsigned long tx_packets;	/* outbound frames counter      */
+	unsigned long rx_errors;	/* Parity, etc. errors          */
+	unsigned long tx_errors;	/* Planned stuff                */
+	unsigned long rx_dropped;	/* No memory for skb            */
+	unsigned long tx_dropped;	/* When MTU change              */
+	unsigned long rx_over_errors;	/* Frame bigger then STRIP buf. */
+
+	unsigned long pps_timer;	/* Timer to determine pps       */
+	unsigned long rx_pps_count;	/* Counter to determine pps     */
+	unsigned long tx_pps_count;	/* Counter to determine pps     */
+	unsigned long sx_pps_count;	/* Counter to determine pps     */
+	unsigned long rx_average_pps;	/* rx packets per second * 8    */
+	unsigned long tx_average_pps;	/* tx packets per second * 8    */
+	unsigned long sx_average_pps;	/* sent packets per second * 8  */
+
+#ifdef EXT_COUNTERS
+	unsigned long rx_bytes;		/* total received bytes */
+	unsigned long tx_bytes;		/* total received bytes */
+	unsigned long rx_rbytes;	/* bytes thru radio i/f */
+	unsigned long tx_rbytes;	/* bytes thru radio i/f */
+	unsigned long rx_sbytes;	/* tot bytes thru serial i/f */
+	unsigned long tx_sbytes;	/* tot bytes thru serial i/f */
+	unsigned long rx_ebytes;	/* tot stat/err bytes */
+	unsigned long tx_ebytes;	/* tot stat/err bytes */
+#endif
+
+	/*
+	 * Internal variables.
+	 */
+
+	struct list_head  list;		/* Linked list of devices */
+
+	int discard;			/* Set if serial error          */
+	int working;			/* Is radio working correctly?  */
+	int firmware_level;		/* Message structuring level    */
+	int next_command;		/* Next periodic command        */
+	unsigned int user_baud;		/* The user-selected baud rate  */
+	int mtu;			/* Our mtu (to spot changes!)   */
+	long watchdog_doprobe;		/* Next time to test the radio  */
+	long watchdog_doreset;		/* Time to do next reset        */
+	long gratuitous_arp;		/* Time to send next ARP refresh */
+	long arp_interval;		/* Next ARP interval            */
+	struct timer_list idle_timer;	/* For periodic wakeup calls    */
+	MetricomAddress true_dev_addr;	/* True address of radio        */
+	int manual_dev_addr;		/* Hack: See note below         */
+
+	FirmwareVersion firmware_version;	/* The radio's firmware version */
+	SerialNumber serial_number;	/* The radio's serial number    */
+	BatteryVoltage battery_voltage;	/* The radio's battery voltage  */
+
+	/*
+	 * Other useful structures.
+	 */
+
+	struct tty_struct *tty;		/* ptr to TTY structure         */
+	struct net_device *dev;		/* Our device structure         */
+
+	/*
+	 * Neighbour radio records
+	 */
+
+	MetricomNodeTable portables;
+	MetricomNodeTable poletops;
+};
+
+/*
+ * Note: manual_dev_addr hack
+ * 
+ * It is not possible to change the hardware address of a Metricom radio,
+ * or to send packets with a user-specified hardware source address, thus
+ * trying to manually set a hardware source address is a questionable
+ * thing to do.  However, if the user *does* manually set the hardware
+ * source address of a STRIP interface, then the kernel will believe it,
+ * and use it in certain places. For example, the hardware address listed
+ * by ifconfig will be the manual address, not the true one.
+ * (Both addresses are listed in /proc/net/strip.)
+ * Also, ARP packets will be sent out giving the user-specified address as
+ * the source address, not the real address. This is dangerous, because
+ * it means you won't receive any replies -- the ARP replies will go to
+ * the specified address, which will be some other radio. The case where
+ * this is useful is when that other radio is also connected to the same
+ * machine. This allows you to connect a pair of radios to one machine,
+ * and to use one exclusively for inbound traffic, and the other
+ * exclusively for outbound traffic. Pretty neat, huh?
+ * 
+ * Here's the full procedure to set this up:
+ * 
+ * 1. "slattach" two interfaces, e.g. st0 for outgoing packets,
+ *    and st1 for incoming packets
+ * 
+ * 2. "ifconfig" st0 (outbound radio) to have the hardware address
+ *    which is the real hardware address of st1 (inbound radio).
+ *    Now when it sends out packets, it will masquerade as st1, and
+ *    replies will be sent to that radio, which is exactly what we want.
+ * 
+ * 3. Set the route table entry ("route add default ..." or
+ *    "route add -net ...", as appropriate) to send packets via the st0
+ *    interface (outbound radio). Do not add any route which sends packets
+ *    out via the st1 interface -- that radio is for inbound traffic only.
+ * 
+ * 4. "ifconfig" st1 (inbound radio) to have hardware address zero.
+ *    This tells the STRIP driver to "shut down" that interface and not
+ *    send any packets through it. In particular, it stops sending the
+ *    periodic gratuitous ARP packets that a STRIP interface normally sends.
+ *    Also, when packets arrive on that interface, it will search the
+ *    interface list to see if there is another interface who's manual
+ *    hardware address matches its own real address (i.e. st0 in this
+ *    example) and if so it will transfer ownership of the skbuff to
+ *    that interface, so that it looks to the kernel as if the packet
+ *    arrived on that interface. This is necessary because when the
+ *    kernel sends an ARP packet on st0, it expects to get a reply on
+ *    st0, and if it sees the reply come from st1 then it will ignore
+ *    it (to be accurate, it puts the entry in the ARP table, but
+ *    labelled in such a way that st0 can't use it).
+ * 
+ * Thanks to Petros Maniatis for coming up with the idea of splitting
+ * inbound and outbound traffic between two interfaces, which turned
+ * out to be really easy to implement, even if it is a bit of a hack.
+ * 
+ * Having set a manual address on an interface, you can restore it
+ * to automatic operation (where the address is automatically kept
+ * consistent with the real address of the radio) by setting a manual
+ * address of all ones, e.g. "ifconfig st0 hw strip FFFFFFFFFFFF"
+ * This 'turns off' manual override mode for the device address.
+ * 
+ * Note: The IEEE 802 headers reported in tcpdump will show the *real*
+ * radio addresses the packets were sent and received from, so that you
+ * can see what is really going on with packets, and which interfaces
+ * they are really going through.
+ */
+
+
+/************************************************************************/
+/* Constants								*/
+
+/*
+ * CommandString1 works on all radios
+ * Other CommandStrings are only used with firmware that provides structured responses.
+ * 
+ * ats319=1 Enables Info message for node additions and deletions
+ * ats319=2 Enables Info message for a new best node
+ * ats319=4 Enables checksums
+ * ats319=8 Enables ACK messages
+ */
+
+static const int MaxCommandStringLength = 32;
+static const int CompatibilityCommand = 1;
+
+static const char CommandString0[] = "*&COMMAND*ATS319=7";	/* Turn on checksums & info messages */
+static const char CommandString1[] = "*&COMMAND*ATS305?";	/* Query radio name */
+static const char CommandString2[] = "*&COMMAND*ATS325?";	/* Query battery voltage */
+static const char CommandString3[] = "*&COMMAND*ATS300?";	/* Query version information */
+static const char CommandString4[] = "*&COMMAND*ATS311?";	/* Query poletop list */
+static const char CommandString5[] = "*&COMMAND*AT~LA";		/* Query portables list */
+typedef struct {
+	const char *string;
+	long length;
+} StringDescriptor;
+
+static const StringDescriptor CommandString[] = {
+	{CommandString0, sizeof(CommandString0) - 1},
+	{CommandString1, sizeof(CommandString1) - 1},
+	{CommandString2, sizeof(CommandString2) - 1},
+	{CommandString3, sizeof(CommandString3) - 1},
+	{CommandString4, sizeof(CommandString4) - 1},
+	{CommandString5, sizeof(CommandString5) - 1}
+};
+
+#define GOT_ALL_RADIO_INFO(S)      \
+    ((S)->firmware_version.c[0] && \
+     (S)->battery_voltage.c[0]  && \
+     memcmp(&(S)->true_dev_addr, zero_address.c, sizeof(zero_address)))
+
+static const char hextable[16] = "0123456789ABCDEF";
+
+static const MetricomAddress zero_address;
+static const MetricomAddress broadcast_address =
+    { {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF} };
+
+static const MetricomKey SIP0Key = { "SIP0" };
+static const MetricomKey ARP0Key = { "ARP0" };
+static const MetricomKey ATR_Key = { "ATR " };
+static const MetricomKey ACK_Key = { "ACK_" };
+static const MetricomKey INF_Key = { "INF_" };
+static const MetricomKey ERR_Key = { "ERR_" };
+
+static const long MaxARPInterval = 60 * HZ;	/* One minute */
+
+/*
+ * Maximum Starmode packet length is 1183 bytes. Allowing 4 bytes for
+ * protocol key, 4 bytes for checksum, one byte for CR, and 65/64 expansion
+ * for STRIP encoding, that translates to a maximum payload MTU of 1155.
+ * Note: A standard NFS 1K data packet is a total of 0x480 (1152) bytes
+ * long, including IP header, UDP header, and NFS header. Setting the STRIP
+ * MTU to 1152 allows us to send default sized NFS packets without fragmentation.
+ */
+static const unsigned short MAX_SEND_MTU = 1152;
+static const unsigned short MAX_RECV_MTU = 1500;	/* Hoping for Ethernet sized packets in the future! */
+static const unsigned short DEFAULT_STRIP_MTU = 1152;
+static const int STRIP_MAGIC = 0x5303;
+static const long LongTime = 0x7FFFFFFF;
+
+/************************************************************************/
+/* Global variables							*/
+
+static LIST_HEAD(strip_list);
+static DEFINE_SPINLOCK(strip_lock);
+
+/************************************************************************/
+/* Macros								*/
+
+/* Returns TRUE if text T begins with prefix P */
+#define has_prefix(T,L,P) (((L) >= sizeof(P)-1) && !strncmp((T), (P), sizeof(P)-1))
+
+/* Returns TRUE if text T of length L is equal to string S */
+#define text_equal(T,L,S) (((L) == sizeof(S)-1) && !strncmp((T), (S), sizeof(S)-1))
+
+#define READHEX(X) ((X)>='0' && (X)<='9' ? (X)-'0' :      \
+                    (X)>='a' && (X)<='f' ? (X)-'a'+10 :   \
+                    (X)>='A' && (X)<='F' ? (X)-'A'+10 : 0 )
+
+#define READHEX16(X) ((__u16)(READHEX(X)))
+
+#define READDEC(X) ((X)>='0' && (X)<='9' ? (X)-'0' : 0)
+
+#define ARRAY_END(X) (&((X)[ARRAY_SIZE(X)]))
+
+#define JIFFIE_TO_SEC(X) ((X) / HZ)
+
+
+/************************************************************************/
+/* Utility routines							*/
+
+static int arp_query(unsigned char *haddr, u32 paddr,
+		     struct net_device *dev)
+{
+	struct neighbour *neighbor_entry;
+
+	neighbor_entry = neigh_lookup(&arp_tbl, &paddr, dev);
+
+	if (neighbor_entry != NULL) {
+		neighbor_entry->used = jiffies;
+		if (neighbor_entry->nud_state & NUD_VALID) {
+			memcpy(haddr, neighbor_entry->ha, dev->addr_len);
+			return 1;
+		}
+	}
+	return 0;
+}
+
+static void DumpData(char *msg, struct strip *strip_info, __u8 * ptr,
+		     __u8 * end)
+{
+	static const int MAX_DumpData = 80;
+	__u8 pkt_text[MAX_DumpData], *p = pkt_text;
+
+	*p++ = '\"';
+
+	while (ptr < end && p < &pkt_text[MAX_DumpData - 4]) {
+		if (*ptr == '\\') {
+			*p++ = '\\';
+			*p++ = '\\';
+		} else {
+			if (*ptr >= 32 && *ptr <= 126) {
+				*p++ = *ptr;
+			} else {
+				sprintf(p, "\\%02X", *ptr);
+				p += 3;
+			}
+		}
+		ptr++;
+	}
+
+	if (ptr == end)
+		*p++ = '\"';
+	*p++ = 0;
+
+	printk(KERN_INFO "%s: %-13s%s\n", strip_info->dev->name, msg, pkt_text);
+}
+
+
+/************************************************************************/
+/* Byte stuffing/unstuffing routines					*/
+
+/* Stuffing scheme:
+ * 00    Unused (reserved character)
+ * 01-3F Run of 2-64 different characters
+ * 40-7F Run of 1-64 different characters plus a single zero at the end
+ * 80-BF Run of 1-64 of the same character
+ * C0-FF Run of 1-64 zeroes (ASCII 0)
+ */
+
+typedef enum {
+	Stuff_Diff = 0x00,
+	Stuff_DiffZero = 0x40,
+	Stuff_Same = 0x80,
+	Stuff_Zero = 0xC0,
+	Stuff_NoCode = 0xFF,	/* Special code, meaning no code selected */
+
+	Stuff_CodeMask = 0xC0,
+	Stuff_CountMask = 0x3F,
+	Stuff_MaxCount = 0x3F,
+	Stuff_Magic = 0x0D	/* The value we are eliminating */
+} StuffingCode;
+
+/* StuffData encodes the data starting at "src" for "length" bytes.
+ * It writes it to the buffer pointed to by "dst" (which must be at least
+ * as long as 1 + 65/64 of the input length). The output may be up to 1.6%
+ * larger than the input for pathological input, but will usually be smaller.
+ * StuffData returns the new value of the dst pointer as its result.
+ * "code_ptr_ptr" points to a "__u8 *" which is used to hold encoding state
+ * between calls, allowing an encoded packet to be incrementally built up
+ * from small parts. On the first call, the "__u8 *" pointed to should be
+ * initialized to NULL; between subsequent calls the calling routine should
+ * leave the value alone and simply pass it back unchanged so that the
+ * encoder can recover its current state.
+ */
+
+#define StuffData_FinishBlock(X) \
+(*code_ptr = (X) ^ Stuff_Magic, code = Stuff_NoCode)
+
+static __u8 *StuffData(__u8 * src, __u32 length, __u8 * dst,
+		       __u8 ** code_ptr_ptr)
+{
+	__u8 *end = src + length;
+	__u8 *code_ptr = *code_ptr_ptr;
+	__u8 code = Stuff_NoCode, count = 0;
+
+	if (!length)
+		return (dst);
+
+	if (code_ptr) {
+		/*
+		 * Recover state from last call, if applicable
+		 */
+		code = (*code_ptr ^ Stuff_Magic) & Stuff_CodeMask;
+		count = (*code_ptr ^ Stuff_Magic) & Stuff_CountMask;
+	}
+
+	while (src < end) {
+		switch (code) {
+			/* Stuff_NoCode: If no current code, select one */
+		case Stuff_NoCode:
+			/* Record where we're going to put this code */
+			code_ptr = dst++;
+			count = 0;	/* Reset the count (zero means one instance) */
+			/* Tentatively start a new block */
+			if (*src == 0) {
+				code = Stuff_Zero;
+				src++;
+			} else {
+				code = Stuff_Same;
+				*dst++ = *src++ ^ Stuff_Magic;
+			}
+			/* Note: We optimistically assume run of same -- */
+			/* which will be fixed later in Stuff_Same */
+			/* if it turns out not to be true. */
+			break;
+
+			/* Stuff_Zero: We already have at least one zero encoded */
+		case Stuff_Zero:
+			/* If another zero, count it, else finish this code block */
+			if (*src == 0) {
+				count++;
+				src++;
+			} else {
+				StuffData_FinishBlock(Stuff_Zero + count);
+			}
+			break;
+
+			/* Stuff_Same: We already have at least one byte encoded */
+		case Stuff_Same:
+			/* If another one the same, count it */
+			if ((*src ^ Stuff_Magic) == code_ptr[1]) {
+				count++;
+				src++;
+				break;
+			}
+			/* else, this byte does not match this block. */
+			/* If we already have two or more bytes encoded, finish this code block */
+			if (count) {
+				StuffData_FinishBlock(Stuff_Same + count);
+				break;
+			}
+			/* else, we only have one so far, so switch to Stuff_Diff code */
+			code = Stuff_Diff;
+			/* and fall through to Stuff_Diff case below
+			 * Note cunning cleverness here: case Stuff_Diff compares 
+			 * the current character with the previous two to see if it
+			 * has a run of three the same. Won't this be an error if
+			 * there aren't two previous characters stored to compare with?
+			 * No. Because we know the current character is *not* the same
+			 * as the previous one, the first test below will necessarily
+			 * fail and the send half of the "if" won't be executed.
+			 */
+
+			/* Stuff_Diff: We have at least two *different* bytes encoded */
+		case Stuff_Diff:
+			/* If this is a zero, must encode a Stuff_DiffZero, and begin a new block */
+			if (*src == 0) {
+				StuffData_FinishBlock(Stuff_DiffZero +
+						      count);
+			}
+			/* else, if we have three in a row, it is worth starting a Stuff_Same block */
+			else if ((*src ^ Stuff_Magic) == dst[-1]
+				 && dst[-1] == dst[-2]) {
+				/* Back off the last two characters we encoded */
+				code += count - 2;
+				/* Note: "Stuff_Diff + 0" is an illegal code */
+				if (code == Stuff_Diff + 0) {
+					code = Stuff_Same + 0;
+				}
+				StuffData_FinishBlock(code);
+				code_ptr = dst - 2;
+				/* dst[-1] already holds the correct value */
+				count = 2;	/* 2 means three bytes encoded */
+				code = Stuff_Same;
+			}
+			/* else, another different byte, so add it to the block */
+			else {
+				*dst++ = *src ^ Stuff_Magic;
+				count++;
+			}
+			src++;	/* Consume the byte */
+			break;
+		}
+		if (count == Stuff_MaxCount) {
+			StuffData_FinishBlock(code + count);
+		}
+	}
+	if (code == Stuff_NoCode) {
+		*code_ptr_ptr = NULL;
+	} else {
+		*code_ptr_ptr = code_ptr;
+		StuffData_FinishBlock(code + count);
+	}
+	return (dst);
+}
+
+/*
+ * UnStuffData decodes the data at "src", up to (but not including) "end".
+ * It writes the decoded data into the buffer pointed to by "dst", up to a
+ * maximum of "dst_length", and returns the new value of "src" so that a
+ * follow-on call can read more data, continuing from where the first left off.
+ * 
+ * There are three types of results:
+ * 1. The source data runs out before extracting "dst_length" bytes:
+ *    UnStuffData returns NULL to indicate failure.
+ * 2. The source data produces exactly "dst_length" bytes:
+ *    UnStuffData returns new_src = end to indicate that all bytes were consumed.
+ * 3. "dst_length" bytes are extracted, with more remaining.
+ *    UnStuffData returns new_src < end to indicate that there are more bytes
+ *    to be read.
+ * 
+ * Note: The decoding may be destructive, in that it may alter the source
+ * data in the process of decoding it (this is necessary to allow a follow-on
+ * call to resume correctly).
+ */
+
+static __u8 *UnStuffData(__u8 * src, __u8 * end, __u8 * dst,
+			 __u32 dst_length)
+{
+	__u8 *dst_end = dst + dst_length;
+	/* Sanity check */
+	if (!src || !end || !dst || !dst_length)
+		return (NULL);
+	while (src < end && dst < dst_end) {
+		int count = (*src ^ Stuff_Magic) & Stuff_CountMask;
+		switch ((*src ^ Stuff_Magic) & Stuff_CodeMask) {
+		case Stuff_Diff:
+			if (src + 1 + count >= end)
+				return (NULL);
+			do {
+				*dst++ = *++src ^ Stuff_Magic;
+			}
+			while (--count >= 0 && dst < dst_end);
+			if (count < 0)
+				src += 1;
+			else {
+				if (count == 0)
+					*src = Stuff_Same ^ Stuff_Magic;
+				else
+					*src =
+					    (Stuff_Diff +
+					     count) ^ Stuff_Magic;
+			}
+			break;
+		case Stuff_DiffZero:
+			if (src + 1 + count >= end)
+				return (NULL);
+			do {
+				*dst++ = *++src ^ Stuff_Magic;
+			}
+			while (--count >= 0 && dst < dst_end);
+			if (count < 0)
+				*src = Stuff_Zero ^ Stuff_Magic;
+			else
+				*src =
+				    (Stuff_DiffZero + count) ^ Stuff_Magic;
+			break;
+		case Stuff_Same:
+			if (src + 1 >= end)
+				return (NULL);
+			do {
+				*dst++ = src[1] ^ Stuff_Magic;
+			}
+			while (--count >= 0 && dst < dst_end);
+			if (count < 0)
+				src += 2;
+			else
+				*src = (Stuff_Same + count) ^ Stuff_Magic;
+			break;
+		case Stuff_Zero:
+			do {
+				*dst++ = 0;
+			}
+			while (--count >= 0 && dst < dst_end);
+			if (count < 0)
+				src += 1;
+			else
+				*src = (Stuff_Zero + count) ^ Stuff_Magic;
+			break;
+		}
+	}
+	if (dst < dst_end)
+		return (NULL);
+	else
+		return (src);
+}
+
+
+/************************************************************************/
+/* General routines for STRIP						*/
+
+/*
+ * get_baud returns the current baud rate, as one of the constants defined in
+ * termbits.h
+ * If the user has issued a baud rate override using the 'setserial' command
+ * and the logical current rate is set to 38.4, then the true baud rate
+ * currently in effect (57.6 or 115.2) is returned.
+ */
+static unsigned int get_baud(struct tty_struct *tty)
+{
+	if (!tty || !tty->termios)
+		return (0);
+	if ((tty->termios->c_cflag & CBAUD) == B38400 && tty->driver_data) {
+		struct async_struct *info =
+		    (struct async_struct *) tty->driver_data;
+		if ((info->flags & ASYNC_SPD_MASK) == ASYNC_SPD_HI)
+			return (B57600);
+		if ((info->flags & ASYNC_SPD_MASK) == ASYNC_SPD_VHI)
+			return (B115200);
+	}
+	return (tty->termios->c_cflag & CBAUD);
+}
+
+/*
+ * set_baud sets the baud rate to the rate defined by baudcode
+ * Note: The rate B38400 should be avoided, because the user may have
+ * issued a 'setserial' speed override to map that to a different speed.
+ * We could achieve a true rate of 38400 if we needed to by cancelling
+ * any user speed override that is in place, but that might annoy the
+ * user, so it is simplest to just avoid using 38400.
+ */
+static void set_baud(struct tty_struct *tty, unsigned int baudcode)
+{
+	struct termios old_termios = *(tty->termios);
+	tty->termios->c_cflag &= ~CBAUD;	/* Clear the old baud setting */
+	tty->termios->c_cflag |= baudcode;	/* Set the new baud setting */
+	tty->driver->set_termios(tty, &old_termios);
+}
+
+/*
+ * Convert a string to a Metricom Address.
+ */
+
+#define IS_RADIO_ADDRESS(p) (                                                 \
+  isdigit((p)[0]) && isdigit((p)[1]) && isdigit((p)[2]) && isdigit((p)[3]) && \
+  (p)[4] == '-' &&                                                            \
+  isdigit((p)[5]) && isdigit((p)[6]) && isdigit((p)[7]) && isdigit((p)[8])    )
+
+static int string_to_radio_address(MetricomAddress * addr, __u8 * p)
+{
+	if (!IS_RADIO_ADDRESS(p))
+		return (1);
+	addr->c[0] = 0;
+	addr->c[1] = 0;
+	addr->c[2] = READHEX(p[0]) << 4 | READHEX(p[1]);
+	addr->c[3] = READHEX(p[2]) << 4 | READHEX(p[3]);
+	addr->c[4] = READHEX(p[5]) << 4 | READHEX(p[6]);
+	addr->c[5] = READHEX(p[7]) << 4 | READHEX(p[8]);
+	return (0);
+}
+
+/*
+ * Convert a Metricom Address to a string.
+ */
+
+static __u8 *radio_address_to_string(const MetricomAddress * addr,
+				     MetricomAddressString * p)
+{
+	sprintf(p->c, "%02X%02X-%02X%02X", addr->c[2], addr->c[3],
+		addr->c[4], addr->c[5]);
+	return (p->c);
+}
+
+/*
+ * Note: Must make sure sx_size is big enough to receive a stuffed
+ * MAX_RECV_MTU packet. Additionally, we also want to ensure that it's
+ * big enough to receive a large radio neighbour list (currently 4K).
+ */
+
+static int allocate_buffers(struct strip *strip_info, int mtu)
+{
+	struct net_device *dev = strip_info->dev;
+	int sx_size = max_t(int, STRIP_ENCAP_SIZE(MAX_RECV_MTU), 4096);
+	int tx_size = STRIP_ENCAP_SIZE(mtu) + MaxCommandStringLength;
+	__u8 *r = kmalloc(MAX_RECV_MTU, GFP_ATOMIC);
+	__u8 *s = kmalloc(sx_size, GFP_ATOMIC);
+	__u8 *t = kmalloc(tx_size, GFP_ATOMIC);
+	if (r && s && t) {
+		strip_info->rx_buff = r;
+		strip_info->sx_buff = s;
+		strip_info->tx_buff = t;
+		strip_info->sx_size = sx_size;
+		strip_info->tx_size = tx_size;
+		strip_info->mtu = dev->mtu = mtu;
+		return (1);
+	}
+	if (r)
+		kfree(r);
+	if (s)
+		kfree(s);
+	if (t)
+		kfree(t);
+	return (0);
+}
+
+/*
+ * MTU has been changed by the IP layer. 
+ * We could be in
+ * an upcall from the tty driver, or in an ip packet queue.
+ */
+static int strip_change_mtu(struct net_device *dev, int new_mtu)
+{
+	struct strip *strip_info = netdev_priv(dev);
+	int old_mtu = strip_info->mtu;
+	unsigned char *orbuff = strip_info->rx_buff;
+	unsigned char *osbuff = strip_info->sx_buff;
+	unsigned char *otbuff = strip_info->tx_buff;
+
+	if (new_mtu > MAX_SEND_MTU) {
+		printk(KERN_ERR
+		       "%s: MTU exceeds maximum allowable (%d), MTU change cancelled.\n",
+		       strip_info->dev->name, MAX_SEND_MTU);
+		return -EINVAL;
+	}
+
+	spin_lock_bh(&strip_lock);
+	if (!allocate_buffers(strip_info, new_mtu)) {
+		printk(KERN_ERR "%s: unable to grow strip buffers, MTU change cancelled.\n",
+		       strip_info->dev->name);
+		spin_unlock_bh(&strip_lock);
+		return -ENOMEM;
+	}
+
+	if (strip_info->sx_count) {
+		if (strip_info->sx_count <= strip_info->sx_size)
+			memcpy(strip_info->sx_buff, osbuff,
+			       strip_info->sx_count);
+		else {
+			strip_info->discard = strip_info->sx_count;
+			strip_info->rx_over_errors++;
+		}
+	}
+
+	if (strip_info->tx_left) {
+		if (strip_info->tx_left <= strip_info->tx_size)
+			memcpy(strip_info->tx_buff, strip_info->tx_head,
+			       strip_info->tx_left);
+		else {
+			strip_info->tx_left = 0;
+			strip_info->tx_dropped++;
+		}
+	}
+	strip_info->tx_head = strip_info->tx_buff;
+	spin_unlock_bh(&strip_lock);
+
+	printk(KERN_NOTICE "%s: strip MTU changed fom %d to %d.\n",
+	       strip_info->dev->name, old_mtu, strip_info->mtu);
+
+	if (orbuff)
+		kfree(orbuff);
+	if (osbuff)
+		kfree(osbuff);
+	if (otbuff)
+		kfree(otbuff);
+
+	return 0;
+}
+
+static void strip_unlock(struct strip *strip_info)
+{
+	/*
+	 * Set the timer to go off in one second.
+	 */
+	strip_info->idle_timer.expires = jiffies + 1 * HZ;
+	add_timer(&strip_info->idle_timer);
+	netif_wake_queue(strip_info->dev);
+}
+
+
+
+/*
+ * If the time is in the near future, time_delta prints the number of
+ * seconds to go into the buffer and returns the address of the buffer.
+ * If the time is not in the near future, it returns the address of the
+ * string "Not scheduled" The buffer must be long enough to contain the
+ * ascii representation of the number plus 9 charactes for the " seconds"
+ * and the null character.
+ */
+#ifdef CONFIG_PROC_FS
+static char *time_delta(char buffer[], long time)
+{
+	time -= jiffies;
+	if (time > LongTime / 2)
+		return ("Not scheduled");
+	if (time < 0)
+		time = 0;	/* Don't print negative times */
+	sprintf(buffer, "%ld seconds", time / HZ);
+	return (buffer);
+}
+
+/* get Nth element of the linked list */
+static struct strip *strip_get_idx(loff_t pos) 
+{
+	struct list_head *l;
+	int i = 0;
+
+	list_for_each_rcu(l, &strip_list) {
+		if (pos == i)
+			return list_entry(l, struct strip, list);
+		++i;
+	}
+	return NULL;
+}
+
+static void *strip_seq_start(struct seq_file *seq, loff_t *pos)
+{
+	rcu_read_lock();
+	return *pos ? strip_get_idx(*pos - 1) : SEQ_START_TOKEN;
+}
+
+static void *strip_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+{
+	struct list_head *l;
+	struct strip *s;
+
+	++*pos;
+	if (v == SEQ_START_TOKEN)
+		return strip_get_idx(1);
+
+	s = v;
+	l = &s->list;
+	list_for_each_continue_rcu(l, &strip_list) {
+		return list_entry(l, struct strip, list);
+	}
+	return NULL;
+}
+
+static void strip_seq_stop(struct seq_file *seq, void *v)
+{
+	rcu_read_unlock();
+}
+
+static void strip_seq_neighbours(struct seq_file *seq,
+			   const MetricomNodeTable * table,
+			   const char *title)
+{
+	/* We wrap this in a do/while loop, so if the table changes */
+	/* while we're reading it, we just go around and try again. */
+	struct timeval t;
+
+	do {
+		int i;
+		t = table->timestamp;
+		if (table->num_nodes)
+			seq_printf(seq, "\n %s\n", title);
+		for (i = 0; i < table->num_nodes; i++) {
+			MetricomNode node;
+
+			spin_lock_bh(&strip_lock);
+			node = table->node[i];
+			spin_unlock_bh(&strip_lock);
+			seq_printf(seq, "  %s\n", node.c);
+		}
+	} while (table->timestamp.tv_sec != t.tv_sec
+		 || table->timestamp.tv_usec != t.tv_usec);
+}
+
+/*
+ * This function prints radio status information via the seq_file
+ * interface.  The interface takes care of buffer size and over
+ * run issues. 
+ *
+ * The buffer in seq_file is PAGESIZE (4K) 
+ * so this routine should never print more or it will get truncated.
+ * With the maximum of 32 portables and 32 poletops
+ * reported, the routine outputs 3107 bytes into the buffer.
+ */
+static void strip_seq_status_info(struct seq_file *seq, 
+				  const struct strip *strip_info)
+{
+	char temp[32];
+	MetricomAddressString addr_string;
+
+	/* First, we must copy all of our data to a safe place, */
+	/* in case a serial interrupt comes in and changes it.  */
+	int tx_left = strip_info->tx_left;
+	unsigned long rx_average_pps = strip_info->rx_average_pps;
+	unsigned long tx_average_pps = strip_info->tx_average_pps;
+	unsigned long sx_average_pps = strip_info->sx_average_pps;
+	int working = strip_info->working;
+	int firmware_level = strip_info->firmware_level;
+	long watchdog_doprobe = strip_info->watchdog_doprobe;
+	long watchdog_doreset = strip_info->watchdog_doreset;
+	long gratuitous_arp = strip_info->gratuitous_arp;
+	long arp_interval = strip_info->arp_interval;
+	FirmwareVersion firmware_version = strip_info->firmware_version;
+	SerialNumber serial_number = strip_info->serial_number;
+	BatteryVoltage battery_voltage = strip_info->battery_voltage;
+	char *if_name = strip_info->dev->name;
+	MetricomAddress true_dev_addr = strip_info->true_dev_addr;
+	MetricomAddress dev_dev_addr =
+	    *(MetricomAddress *) strip_info->dev->dev_addr;
+	int manual_dev_addr = strip_info->manual_dev_addr;
+#ifdef EXT_COUNTERS
+	unsigned long rx_bytes = strip_info->rx_bytes;
+	unsigned long tx_bytes = strip_info->tx_bytes;
+	unsigned long rx_rbytes = strip_info->rx_rbytes;
+	unsigned long tx_rbytes = strip_info->tx_rbytes;
+	unsigned long rx_sbytes = strip_info->rx_sbytes;
+	unsigned long tx_sbytes = strip_info->tx_sbytes;
+	unsigned long rx_ebytes = strip_info->rx_ebytes;
+	unsigned long tx_ebytes = strip_info->tx_ebytes;
+#endif
+
+	seq_printf(seq, "\nInterface name\t\t%s\n", if_name);
+	seq_printf(seq, " Radio working:\t\t%s\n", working ? "Yes" : "No");
+	radio_address_to_string(&true_dev_addr, &addr_string);
+	seq_printf(seq, " Radio address:\t\t%s\n", addr_string.c);
+	if (manual_dev_addr) {
+		radio_address_to_string(&dev_dev_addr, &addr_string);
+		seq_printf(seq, " Device address:\t%s\n", addr_string.c);
+	}
+	seq_printf(seq, " Firmware version:\t%s", !working ? "Unknown" :
+		     !firmware_level ? "Should be upgraded" :
+		     firmware_version.c);
+	if (firmware_level >= ChecksummedMessages)
+		seq_printf(seq, " (Checksums Enabled)");
+	seq_printf(seq, "\n");
+	seq_printf(seq, " Serial number:\t\t%s\n", serial_number.c);
+	seq_printf(seq, " Battery voltage:\t%s\n", battery_voltage.c);
+	seq_printf(seq, " Transmit queue (bytes):%d\n", tx_left);
+	seq_printf(seq, " Receive packet rate:   %ld packets per second\n",
+		     rx_average_pps / 8);
+	seq_printf(seq, " Transmit packet rate:  %ld packets per second\n",
+		     tx_average_pps / 8);
+	seq_printf(seq, " Sent packet rate:      %ld packets per second\n",
+		     sx_average_pps / 8);
+	seq_printf(seq, " Next watchdog probe:\t%s\n",
+		     time_delta(temp, watchdog_doprobe));
+	seq_printf(seq, " Next watchdog reset:\t%s\n",
+		     time_delta(temp, watchdog_doreset));
+	seq_printf(seq, " Next gratuitous ARP:\t");
+
+	if (!memcmp
+	    (strip_info->dev->dev_addr, zero_address.c,
+	     sizeof(zero_address)))
+		seq_printf(seq, "Disabled\n");
+	else {
+		seq_printf(seq, "%s\n", time_delta(temp, gratuitous_arp));
+		seq_printf(seq, " Next ARP interval:\t%ld seconds\n",
+			     JIFFIE_TO_SEC(arp_interval));
+	}
+
+	if (working) {
+#ifdef EXT_COUNTERS
+		seq_printf(seq, "\n");
+		seq_printf(seq,
+			     " Total bytes:         \trx:\t%lu\ttx:\t%lu\n",
+			     rx_bytes, tx_bytes);
+		seq_printf(seq,
+			     "  thru radio:         \trx:\t%lu\ttx:\t%lu\n",
+			     rx_rbytes, tx_rbytes);
+		seq_printf(seq,
+			     "  thru serial port:   \trx:\t%lu\ttx:\t%lu\n",
+			     rx_sbytes, tx_sbytes);
+		seq_printf(seq,
+			     " Total stat/err bytes:\trx:\t%lu\ttx:\t%lu\n",
+			     rx_ebytes, tx_ebytes);
+#endif
+		strip_seq_neighbours(seq, &strip_info->poletops,
+					"Poletops:");
+		strip_seq_neighbours(seq, &strip_info->portables,
+					"Portables:");
+	}
+}
+
+/*
+ * This function is exports status information from the STRIP driver through
+ * the /proc file system.
+ */
+static int strip_seq_show(struct seq_file *seq, void *v)
+{
+	if (v == SEQ_START_TOKEN)
+		seq_printf(seq, "strip_version: %s\n", StripVersion);
+	else
+		strip_seq_status_info(seq, (const struct strip *)v);
+	return 0;
+}
+
+
+static struct seq_operations strip_seq_ops = {
+	.start = strip_seq_start,
+	.next  = strip_seq_next,
+	.stop  = strip_seq_stop,
+	.show  = strip_seq_show,
+};
+
+static int strip_seq_open(struct inode *inode, struct file *file)
+{
+	return seq_open(file, &strip_seq_ops);
+}
+
+static struct file_operations strip_seq_fops = {
+	.owner	 = THIS_MODULE,
+	.open    = strip_seq_open,
+	.read    = seq_read,
+	.llseek  = seq_lseek,
+	.release = seq_release,
+};
+#endif
+
+
+
+/************************************************************************/
+/* Sending routines							*/
+
+static void ResetRadio(struct strip *strip_info)
+{
+	struct tty_struct *tty = strip_info->tty;
+	static const char init[] = "ate0q1dt**starmode\r**";
+	StringDescriptor s = { init, sizeof(init) - 1 };
+
+	/* 
+	 * If the radio isn't working anymore,
+	 * we should clear the old status information.
+	 */
+	if (strip_info->working) {
+		printk(KERN_INFO "%s: No response: Resetting radio.\n",
+		       strip_info->dev->name);
+		strip_info->firmware_version.c[0] = '\0';
+		strip_info->serial_number.c[0] = '\0';
+		strip_info->battery_voltage.c[0] = '\0';
+		strip_info->portables.num_nodes = 0;
+		do_gettimeofday(&strip_info->portables.timestamp);
+		strip_info->poletops.num_nodes = 0;
+		do_gettimeofday(&strip_info->poletops.timestamp);
+	}
+
+	strip_info->pps_timer = jiffies;
+	strip_info->rx_pps_count = 0;
+	strip_info->tx_pps_count = 0;
+	strip_info->sx_pps_count = 0;
+	strip_info->rx_average_pps = 0;
+	strip_info->tx_average_pps = 0;
+	strip_info->sx_average_pps = 0;
+
+	/* Mark radio address as unknown */
+	*(MetricomAddress *) & strip_info->true_dev_addr = zero_address;
+	if (!strip_info->manual_dev_addr)
+		*(MetricomAddress *) strip_info->dev->dev_addr =
+		    zero_address;
+	strip_info->working = FALSE;
+	strip_info->firmware_level = NoStructure;
+	strip_info->next_command = CompatibilityCommand;
+	strip_info->watchdog_doprobe = jiffies + 10 * HZ;
+	strip_info->watchdog_doreset = jiffies + 1 * HZ;
+
+	/* If the user has selected a baud rate above 38.4 see what magic we have to do */
+	if (strip_info->user_baud > B38400) {
+		/*
+		 * Subtle stuff: Pay attention :-)
+		 * If the serial port is currently at the user's selected (>38.4) rate,
+		 * then we temporarily switch to 19.2 and issue the ATS304 command
+		 * to tell the radio to switch to the user's selected rate.
+		 * If the serial port is not currently at that rate, that means we just
+		 * issued the ATS304 command last time through, so this time we restore
+		 * the user's selected rate and issue the normal starmode reset string.
+		 */
+		if (strip_info->user_baud == get_baud(tty)) {
+			static const char b0[] = "ate0q1s304=57600\r";
+			static const char b1[] = "ate0q1s304=115200\r";
+			static const StringDescriptor baudstring[2] =
+			    { {b0, sizeof(b0) - 1}
+			, {b1, sizeof(b1) - 1}
+			};
+			set_baud(tty, B19200);
+			if (strip_info->user_baud == B57600)
+				s = baudstring[0];
+			else if (strip_info->user_baud == B115200)
+				s = baudstring[1];
+			else
+				s = baudstring[1];	/* For now */
+		} else
+			set_baud(tty, strip_info->user_baud);
+	}
+
+	tty->driver->write(tty, s.string, s.length);
+#ifdef EXT_COUNTERS
+	strip_info->tx_ebytes += s.length;
+#endif
+}
+
+/*
+ * Called by the driver when there's room for more data.  If we have
+ * more packets to send, we send them here.
+ */
+
+static void strip_write_some_more(struct tty_struct *tty)
+{
+	struct strip *strip_info = (struct strip *) tty->disc_data;
+
+	/* First make sure we're connected. */
+	if (!strip_info || strip_info->magic != STRIP_MAGIC ||
+	    !netif_running(strip_info->dev))
+		return;
+
+	if (strip_info->tx_left > 0) {
+		int num_written =
+		    tty->driver->write(tty, strip_info->tx_head,
+				      strip_info->tx_left);
+		strip_info->tx_left -= num_written;
+		strip_info->tx_head += num_written;
+#ifdef EXT_COUNTERS
+		strip_info->tx_sbytes += num_written;
+#endif
+	} else {		/* Else start transmission of another packet */
+
+		tty->flags &= ~(1 << TTY_DO_WRITE_WAKEUP);
+		strip_unlock(strip_info);
+	}
+}
+
+static __u8 *add_checksum(__u8 * buffer, __u8 * end)
+{
+	__u16 sum = 0;
+	__u8 *p = buffer;
+	while (p < end)
+		sum += *p++;
+	end[3] = hextable[sum & 0xF];
+	sum >>= 4;
+	end[2] = hextable[sum & 0xF];
+	sum >>= 4;
+	end[1] = hextable[sum & 0xF];
+	sum >>= 4;
+	end[0] = hextable[sum & 0xF];
+	return (end + 4);
+}
+
+static unsigned char *strip_make_packet(unsigned char *buffer,
+					struct strip *strip_info,
+					struct sk_buff *skb)
+{
+	__u8 *ptr = buffer;
+	__u8 *stuffstate = NULL;
+	STRIP_Header *header = (STRIP_Header *) skb->data;
+	MetricomAddress haddr = header->dst_addr;
+	int len = skb->len - sizeof(STRIP_Header);
+	MetricomKey key;
+
+	/*HexDump("strip_make_packet", strip_info, skb->data, skb->data + skb->len); */
+
+	if (header->protocol == htons(ETH_P_IP))
+		key = SIP0Key;
+	else if (header->protocol == htons(ETH_P_ARP))
+		key = ARP0Key;
+	else {
+		printk(KERN_ERR
+		       "%s: strip_make_packet: Unknown packet type 0x%04X\n",
+		       strip_info->dev->name, ntohs(header->protocol));
+		return (NULL);
+	}
+
+	if (len > strip_info->mtu) {
+		printk(KERN_ERR
+		       "%s: Dropping oversized transmit packet: %d bytes\n",
+		       strip_info->dev->name, len);
+		return (NULL);
+	}
+
+	/*
+	 * If we're sending to ourselves, discard the packet.
+	 * (Metricom radios choke if they try to send a packet to their own address.)
+	 */
+	if (!memcmp(haddr.c, strip_info->true_dev_addr.c, sizeof(haddr))) {
+		printk(KERN_ERR "%s: Dropping packet addressed to self\n",
+		       strip_info->dev->name);
+		return (NULL);
+	}
+
+	/*
+	 * If this is a broadcast packet, send it to our designated Metricom
+	 * 'broadcast hub' radio (First byte of address being 0xFF means broadcast)
+	 */
+	if (haddr.c[0] == 0xFF) {
+		u32 brd = 0;
+		struct in_device *in_dev;
+
+		rcu_read_lock();
+		in_dev = __in_dev_get(strip_info->dev);
+		if (in_dev == NULL) {
+			rcu_read_unlock();
+			return NULL;
+		}
+		if (in_dev->ifa_list)
+			brd = in_dev->ifa_list->ifa_broadcast;
+		rcu_read_unlock();
+
+		/* arp_query returns 1 if it succeeds in looking up the address, 0 if it fails */
+		if (!arp_query(haddr.c, brd, strip_info->dev)) {
+			printk(KERN_ERR
+			       "%s: Unable to send packet (no broadcast hub configured)\n",
+			       strip_info->dev->name);
+			return (NULL);
+		}
+		/*
+		 * If we are the broadcast hub, don't bother sending to ourselves.
+		 * (Metricom radios choke if they try to send a packet to their own address.)
+		 */
+		if (!memcmp
+		    (haddr.c, strip_info->true_dev_addr.c, sizeof(haddr)))
+			return (NULL);
+	}
+
+	*ptr++ = 0x0D;
+	*ptr++ = '*';
+	*ptr++ = hextable[haddr.c[2] >> 4];
+	*ptr++ = hextable[haddr.c[2] & 0xF];
+	*ptr++ = hextable[haddr.c[3] >> 4];
+	*ptr++ = hextable[haddr.c[3] & 0xF];
+	*ptr++ = '-';
+	*ptr++ = hextable[haddr.c[4] >> 4];
+	*ptr++ = hextable[haddr.c[4] & 0xF];
+	*ptr++ = hextable[haddr.c[5] >> 4];
+	*ptr++ = hextable[haddr.c[5] & 0xF];
+	*ptr++ = '*';
+	*ptr++ = key.c[0];
+	*ptr++ = key.c[1];
+	*ptr++ = key.c[2];
+	*ptr++ = key.c[3];
+
+	ptr =
+	    StuffData(skb->data + sizeof(STRIP_Header), len, ptr,
+		      &stuffstate);
+
+	if (strip_info->firmware_level >= ChecksummedMessages)
+		ptr = add_checksum(buffer + 1, ptr);
+
+	*ptr++ = 0x0D;
+	return (ptr);
+}
+
+static void strip_send(struct strip *strip_info, struct sk_buff *skb)
+{
+	MetricomAddress haddr;
+	unsigned char *ptr = strip_info->tx_buff;
+	int doreset = (long) jiffies - strip_info->watchdog_doreset >= 0;
+	int doprobe = (long) jiffies - strip_info->watchdog_doprobe >= 0
+	    && !doreset;
+	u32 addr, brd;
+
+	/*
+	 * 1. If we have a packet, encapsulate it and put it in the buffer
+	 */
+	if (skb) {
+		char *newptr = strip_make_packet(ptr, strip_info, skb);
+		strip_info->tx_pps_count++;
+		if (!newptr)
+			strip_info->tx_dropped++;
+		else {
+			ptr = newptr;
+			strip_info->sx_pps_count++;
+			strip_info->tx_packets++;	/* Count another successful packet */
+#ifdef EXT_COUNTERS
+			strip_info->tx_bytes += skb->len;
+			strip_info->tx_rbytes += ptr - strip_info->tx_buff;
+#endif
+			/*DumpData("Sending:", strip_info, strip_info->tx_buff, ptr); */
+			/*HexDump("Sending", strip_info, strip_info->tx_buff, ptr); */
+		}
+	}
+
+	/*
+	 * 2. If it is time for another tickle, tack it on, after the packet
+	 */
+	if (doprobe) {
+		StringDescriptor ts = CommandString[strip_info->next_command];
+#if TICKLE_TIMERS
+		{
+			struct timeval tv;
+			do_gettimeofday(&tv);
+			printk(KERN_INFO "**** Sending tickle string %d      at %02d.%06d\n",
+			       strip_info->next_command, tv.tv_sec % 100,
+			       tv.tv_usec);
+		}
+#endif
+		if (ptr == strip_info->tx_buff)
+			*ptr++ = 0x0D;
+
+		*ptr++ = '*';	/* First send "**" to provoke an error message */
+		*ptr++ = '*';
+
+		/* Then add the command */
+		memcpy(ptr, ts.string, ts.length);
+
+		/* Add a checksum ? */
+		if (strip_info->firmware_level < ChecksummedMessages)
+			ptr += ts.length;
+		else
+			ptr = add_checksum(ptr, ptr + ts.length);
+
+		*ptr++ = 0x0D;	/* Terminate the command with a <CR> */
+
+		/* Cycle to next periodic command? */
+		if (strip_info->firmware_level >= StructuredMessages)
+			if (++strip_info->next_command >=
+			    ARRAY_SIZE(CommandString))
+				strip_info->next_command = 0;
+#ifdef EXT_COUNTERS
+		strip_info->tx_ebytes += ts.length;
+#endif
+		strip_info->watchdog_doprobe = jiffies + 10 * HZ;
+		strip_info->watchdog_doreset = jiffies + 1 * HZ;
+		/*printk(KERN_INFO "%s: Routine radio test.\n", strip_info->dev->name); */
+	}
+
+	/*
+	 * 3. Set up the strip_info ready to send the data (if any).
+	 */
+	strip_info->tx_head = strip_info->tx_buff;
+	strip_info->tx_left = ptr - strip_info->tx_buff;
+	strip_info->tty->flags |= (1 << TTY_DO_WRITE_WAKEUP);
+
+	/*
+	 * 4. Debugging check to make sure we're not overflowing the buffer.
+	 */
+	if (strip_info->tx_size - strip_info->tx_left < 20)
+		printk(KERN_ERR "%s: Sending%5d bytes;%5d bytes free.\n",
+		       strip_info->dev->name, strip_info->tx_left,
+		       strip_info->tx_size - strip_info->tx_left);
+
+	/*
+	 * 5. If watchdog has expired, reset the radio. Note: if there's data waiting in
+	 * the buffer, strip_write_some_more will send it after the reset has finished
+	 */
+	if (doreset) {
+		ResetRadio(strip_info);
+		return;
+	}
+
+	if (1) {
+		struct in_device *in_dev;
+
+		brd = addr = 0;
+		rcu_read_lock();
+		in_dev = __in_dev_get(strip_info->dev);
+		if (in_dev) {
+			if (in_dev->ifa_list) {
+				brd = in_dev->ifa_list->ifa_broadcast;
+				addr = in_dev->ifa_list->ifa_local;
+			}
+		}
+		rcu_read_unlock();
+	}
+
+
+	/*
+	 * 6. If it is time for a periodic ARP, queue one up to be sent.
+	 * We only do this if:
+	 *  1. The radio is working
+	 *  2. It's time to send another periodic ARP
+	 *  3. We really know what our address is (and it is not manually set to zero)
+	 *  4. We have a designated broadcast address configured
+	 * If we queue up an ARP packet when we don't have a designated broadcast
+	 * address configured, then the packet will just have to be discarded in
+	 * strip_make_packet. This is not fatal, but it causes misleading information
+	 * to be displayed in tcpdump. tcpdump will report that periodic APRs are
+	 * being sent, when in fact they are not, because they are all being dropped
+	 * in the strip_make_packet routine.
+	 */
+	if (strip_info->working
+	    && (long) jiffies - strip_info->gratuitous_arp >= 0
+	    && memcmp(strip_info->dev->dev_addr, zero_address.c,
+		      sizeof(zero_address))
+	    && arp_query(haddr.c, brd, strip_info->dev)) {
+		/*printk(KERN_INFO "%s: Sending gratuitous ARP with interval %ld\n",
+		   strip_info->dev->name, strip_info->arp_interval / HZ); */
+		strip_info->gratuitous_arp =
+		    jiffies + strip_info->arp_interval;
+		strip_info->arp_interval *= 2;
+		if (strip_info->arp_interval > MaxARPInterval)
+			strip_info->arp_interval = MaxARPInterval;
+		if (addr)
+			arp_send(ARPOP_REPLY, ETH_P_ARP, addr,	/* Target address of ARP packet is our address */
+				 strip_info->dev,	/* Device to send packet on */
+				 addr,	/* Source IP address this ARP packet comes from */
+				 NULL,	/* Destination HW address is NULL (broadcast it) */
+				 strip_info->dev->dev_addr,	/* Source HW address is our HW address */
+				 strip_info->dev->dev_addr);	/* Target HW address is our HW address (redundant) */
+	}
+
+	/*
+	 * 7. All ready. Start the transmission
+	 */
+	strip_write_some_more(strip_info->tty);
+}
+
+/* Encapsulate a datagram and kick it into a TTY queue. */
+static int strip_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+	struct strip *strip_info = netdev_priv(dev);
+
+	if (!netif_running(dev)) {
+		printk(KERN_ERR "%s: xmit call when iface is down\n",
+		       dev->name);
+		return (1);
+	}
+
+	netif_stop_queue(dev);
+
+	del_timer(&strip_info->idle_timer);
+
+
+	if (jiffies - strip_info->pps_timer > HZ) {
+		unsigned long t = jiffies - strip_info->pps_timer;
+		unsigned long rx_pps_count = (strip_info->rx_pps_count * HZ * 8 + t / 2) / t;
+		unsigned long tx_pps_count = (strip_info->tx_pps_count * HZ * 8 + t / 2) / t;
+		unsigned long sx_pps_count = (strip_info->sx_pps_count * HZ * 8 + t / 2) / t;
+
+		strip_info->pps_timer = jiffies;
+		strip_info->rx_pps_count = 0;
+		strip_info->tx_pps_count = 0;
+		strip_info->sx_pps_count = 0;
+
+		strip_info->rx_average_pps = (strip_info->rx_average_pps + rx_pps_count + 1) / 2;
+		strip_info->tx_average_pps = (strip_info->tx_average_pps + tx_pps_count + 1) / 2;
+		strip_info->sx_average_pps = (strip_info->sx_average_pps + sx_pps_count + 1) / 2;
+
+		if (rx_pps_count / 8 >= 10)
+			printk(KERN_INFO "%s: WARNING: Receiving %ld packets per second.\n",
+			       strip_info->dev->name, rx_pps_count / 8);
+		if (tx_pps_count / 8 >= 10)
+			printk(KERN_INFO "%s: WARNING: Tx        %ld packets per second.\n",
+			       strip_info->dev->name, tx_pps_count / 8);
+		if (sx_pps_count / 8 >= 10)
+			printk(KERN_INFO "%s: WARNING: Sending   %ld packets per second.\n",
+			       strip_info->dev->name, sx_pps_count / 8);
+	}
+
+	spin_lock_bh(&strip_lock);
+
+	strip_send(strip_info, skb);
+
+	spin_unlock_bh(&strip_lock);
+
+	if (skb)
+		dev_kfree_skb(skb);
+	return 0;
+}
+
+/*
+ * IdleTask periodically calls strip_xmit, so even when we have no IP packets
+ * to send for an extended period of time, the watchdog processing still gets
+ * done to ensure that the radio stays in Starmode
+ */
+
+static void strip_IdleTask(unsigned long parameter)
+{
+	strip_xmit(NULL, (struct net_device *) parameter);
+}
+
+/*
+ * Create the MAC header for an arbitrary protocol layer
+ *
+ * saddr!=NULL        means use this specific address (n/a for Metricom)
+ * saddr==NULL        means use default device source address
+ * daddr!=NULL        means use this destination address
+ * daddr==NULL        means leave destination address alone
+ *                 (e.g. unresolved arp -- kernel will call
+ *                 rebuild_header later to fill in the address)
+ */
+
+static int strip_header(struct sk_buff *skb, struct net_device *dev,
+			unsigned short type, void *daddr, void *saddr,
+			unsigned len)
+{
+	struct strip *strip_info = netdev_priv(dev);
+	STRIP_Header *header = (STRIP_Header *) skb_push(skb, sizeof(STRIP_Header));
+
+	/*printk(KERN_INFO "%s: strip_header 0x%04X %s\n", dev->name, type,
+	   type == ETH_P_IP ? "IP" : type == ETH_P_ARP ? "ARP" : ""); */
+
+	header->src_addr = strip_info->true_dev_addr;
+	header->protocol = htons(type);
+
+	/*HexDump("strip_header", netdev_priv(dev), skb->data, skb->data + skb->len); */
+
+	if (!daddr)
+		return (-dev->hard_header_len);
+
+	header->dst_addr = *(MetricomAddress *) daddr;
+	return (dev->hard_header_len);
+}
+
+/*
+ * Rebuild the MAC header. This is called after an ARP
+ * (or in future other address resolution) has completed on this
+ * sk_buff. We now let ARP fill in the other fields.
+ * I think this should return zero if packet is ready to send,
+ * or non-zero if it needs more time to do an address lookup
+ */
+
+static int strip_rebuild_header(struct sk_buff *skb)
+{
+#ifdef CONFIG_INET
+	STRIP_Header *header = (STRIP_Header *) skb->data;
+
+	/* Arp find returns zero if if knows the address, */
+	/* or if it doesn't know the address it sends an ARP packet and returns non-zero */
+	return arp_find(header->dst_addr.c, skb) ? 1 : 0;
+#else
+	return 0;
+#endif
+}
+
+
+/************************************************************************/
+/* Receiving routines							*/
+
+static int strip_receive_room(struct tty_struct *tty)
+{
+	return 0x10000;		/* We can handle an infinite amount of data. :-) */
+}
+
+/*
+ * This function parses the response to the ATS300? command,
+ * extracting the radio version and serial number.
+ */
+static void get_radio_version(struct strip *strip_info, __u8 * ptr, __u8 * end)
+{
+	__u8 *p, *value_begin, *value_end;
+	int len;
+
+	/* Determine the beginning of the second line of the payload */
+	p = ptr;
+	while (p < end && *p != 10)
+		p++;
+	if (p >= end)
+		return;
+	p++;
+	value_begin = p;
+
+	/* Determine the end of line */
+	while (p < end && *p != 10)
+		p++;
+	if (p >= end)
+		return;
+	value_end = p;
+	p++;
+
+	len = value_end - value_begin;
+	len = min_t(int, len, sizeof(FirmwareVersion) - 1);
+	if (strip_info->firmware_version.c[0] == 0)
+		printk(KERN_INFO "%s: Radio Firmware: %.*s\n",
+		       strip_info->dev->name, len, value_begin);
+	sprintf(strip_info->firmware_version.c, "%.*s", len, value_begin);
+
+	/* Look for the first colon */
+	while (p < end && *p != ':')
+		p++;
+	if (p >= end)
+		return;
+	/* Skip over the space */
+	p += 2;
+	len = sizeof(SerialNumber) - 1;
+	if (p + len <= end) {
+		sprintf(strip_info->serial_number.c, "%.*s", len, p);
+	} else {
+		printk(KERN_DEBUG
+		       "STRIP: radio serial number shorter (%zd) than expected (%d)\n",
+		       end - p, len);
+	}
+}
+
+/*
+ * This function parses the response to the ATS325? command,
+ * extracting the radio battery voltage.
+ */
+static void get_radio_voltage(struct strip *strip_info, __u8 * ptr, __u8 * end)
+{
+	int len;
+
+	len = sizeof(BatteryVoltage) - 1;
+	if (ptr + len <= end) {
+		sprintf(strip_info->battery_voltage.c, "%.*s", len, ptr);
+	} else {
+		printk(KERN_DEBUG
+		       "STRIP: radio voltage string shorter (%zd) than expected (%d)\n",
+		       end - ptr, len);
+	}
+}
+
+/*
+ * This function parses the responses to the AT~LA and ATS311 commands,
+ * which list the radio's neighbours.
+ */
+static void get_radio_neighbours(MetricomNodeTable * table, __u8 * ptr, __u8 * end)
+{
+	table->num_nodes = 0;
+	while (ptr < end && table->num_nodes < NODE_TABLE_SIZE) {
+		MetricomNode *node = &table->node[table->num_nodes++];
+		char *dst = node->c, *limit = dst + sizeof(*node) - 1;
+		while (ptr < end && *ptr <= 32)
+			ptr++;
+		while (ptr < end && dst < limit && *ptr != 10)
+			*dst++ = *ptr++;
+		*dst++ = 0;
+		while (ptr < end && ptr[-1] != 10)
+			ptr++;
+	}
+	do_gettimeofday(&table->timestamp);
+}
+
+static int get_radio_address(struct strip *strip_info, __u8 * p)
+{
+	MetricomAddress addr;
+
+	if (string_to_radio_address(&addr, p))
+		return (1);
+
+	/* See if our radio address has changed */
+	if (memcmp(strip_info->true_dev_addr.c, addr.c, sizeof(addr))) {
+		MetricomAddressString addr_string;
+		radio_address_to_string(&addr, &addr_string);
+		printk(KERN_INFO "%s: Radio address = %s\n",
+		       strip_info->dev->name, addr_string.c);
+		strip_info->true_dev_addr = addr;
+		if (!strip_info->manual_dev_addr)
+			*(MetricomAddress *) strip_info->dev->dev_addr =
+			    addr;
+		/* Give the radio a few seconds to get its head straight, then send an arp */
+		strip_info->gratuitous_arp = jiffies + 15 * HZ;
+		strip_info->arp_interval = 1 * HZ;
+	}
+	return (0);
+}
+
+static int verify_checksum(struct strip *strip_info)
+{
+	__u8 *p = strip_info->sx_buff;
+	__u8 *end = strip_info->sx_buff + strip_info->sx_count - 4;
+	u_short sum =
+	    (READHEX16(end[0]) << 12) | (READHEX16(end[1]) << 8) |
+	    (READHEX16(end[2]) << 4) | (READHEX16(end[3]));
+	while (p < end)
+		sum -= *p++;
+	if (sum == 0 && strip_info->firmware_level == StructuredMessages) {
+		strip_info->firmware_level = ChecksummedMessages;
+		printk(KERN_INFO "%s: Radio provides message checksums\n",
+		       strip_info->dev->name);
+	}
+	return (sum == 0);
+}
+
+static void RecvErr(char *msg, struct strip *strip_info)
+{
+	__u8 *ptr = strip_info->sx_buff;
+	__u8 *end = strip_info->sx_buff + strip_info->sx_count;
+	DumpData(msg, strip_info, ptr, end);
+	strip_info->rx_errors++;
+}
+
+static void RecvErr_Message(struct strip *strip_info, __u8 * sendername,
+			    const __u8 * msg, u_long len)
+{
+	if (has_prefix(msg, len, "001")) {	/* Not in StarMode! */
+		RecvErr("Error Msg:", strip_info);
+		printk(KERN_INFO "%s: Radio %s is not in StarMode\n",
+		       strip_info->dev->name, sendername);
+	}
+
+	else if (has_prefix(msg, len, "002")) {	/* Remap handle */
+		/* We ignore "Remap handle" messages for now */
+	}
+
+	else if (has_prefix(msg, len, "003")) {	/* Can't resolve name */
+		RecvErr("Error Msg:", strip_info);
+		printk(KERN_INFO "%s: Destination radio name is unknown\n",
+		       strip_info->dev->name);
+	}
+
+	else if (has_prefix(msg, len, "004")) {	/* Name too small or missing */
+		strip_info->watchdog_doreset = jiffies + LongTime;
+#if TICKLE_TIMERS
+		{
+			struct timeval tv;
+			do_gettimeofday(&tv);
+			printk(KERN_INFO
+			       "**** Got ERR_004 response         at %02d.%06d\n",
+			       tv.tv_sec % 100, tv.tv_usec);
+		}
+#endif
+		if (!strip_info->working) {
+			strip_info->working = TRUE;
+			printk(KERN_INFO "%s: Radio now in starmode\n",
+			       strip_info->dev->name);
+			/*
+			 * If the radio has just entered a working state, we should do our first
+			 * probe ASAP, so that we find out our radio address etc. without delay.
+			 */
+			strip_info->watchdog_doprobe = jiffies;
+		}
+		if (strip_info->firmware_level == NoStructure && sendername) {
+			strip_info->firmware_level = StructuredMessages;
+			strip_info->next_command = 0;	/* Try to enable checksums ASAP */
+			printk(KERN_INFO
+			       "%s: Radio provides structured messages\n",
+			       strip_info->dev->name);
+		}
+		if (strip_info->firmware_level >= StructuredMessages) {
+			/*
+			 * If this message has a valid checksum on the end, then the call to verify_checksum
+			 * will elevate the firmware_level to ChecksummedMessages for us. (The actual return
+			 * code from verify_checksum is ignored here.)
+			 */
+			verify_checksum(strip_info);
+			/*
+			 * If the radio has structured messages but we don't yet have all our information about it,
+			 * we should do probes without delay, until we have gathered all the information
+			 */
+			if (!GOT_ALL_RADIO_INFO(strip_info))
+				strip_info->watchdog_doprobe = jiffies;
+		}
+	}
+
+	else if (has_prefix(msg, len, "005"))	/* Bad count specification */
+		RecvErr("Error Msg:", strip_info);
+
+	else if (has_prefix(msg, len, "006"))	/* Header too big */
+		RecvErr("Error Msg:", strip_info);
+
+	else if (has_prefix(msg, len, "007")) {	/* Body too big */
+		RecvErr("Error Msg:", strip_info);
+		printk(KERN_ERR
+		       "%s: Error! Packet size too big for radio.\n",
+		       strip_info->dev->name);
+	}
+
+	else if (has_prefix(msg, len, "008")) {	/* Bad character in name */
+		RecvErr("Error Msg:", strip_info);
+		printk(KERN_ERR
+		       "%s: Radio name contains illegal character\n",
+		       strip_info->dev->name);
+	}
+
+	else if (has_prefix(msg, len, "009"))	/* No count or line terminator */
+		RecvErr("Error Msg:", strip_info);
+
+	else if (has_prefix(msg, len, "010"))	/* Invalid checksum */
+		RecvErr("Error Msg:", strip_info);
+
+	else if (has_prefix(msg, len, "011"))	/* Checksum didn't match */
+		RecvErr("Error Msg:", strip_info);
+
+	else if (has_prefix(msg, len, "012"))	/* Failed to transmit packet */
+		RecvErr("Error Msg:", strip_info);
+
+	else
+		RecvErr("Error Msg:", strip_info);
+}
+
+static void process_AT_response(struct strip *strip_info, __u8 * ptr,
+				__u8 * end)
+{
+	u_long len;
+	__u8 *p = ptr;
+	while (p < end && p[-1] != 10)
+		p++;		/* Skip past first newline character */
+	/* Now ptr points to the AT command, and p points to the text of the response. */
+	len = p - ptr;
+
+#if TICKLE_TIMERS
+	{
+		struct timeval tv;
+		do_gettimeofday(&tv);
+		printk(KERN_INFO "**** Got AT response %.7s      at %02d.%06d\n",
+		       ptr, tv.tv_sec % 100, tv.tv_usec);
+	}
+#endif
+
+	if (has_prefix(ptr, len, "ATS300?"))
+		get_radio_version(strip_info, p, end);
+	else if (has_prefix(ptr, len, "ATS305?"))
+		get_radio_address(strip_info, p);
+	else if (has_prefix(ptr, len, "ATS311?"))
+		get_radio_neighbours(&strip_info->poletops, p, end);
+	else if (has_prefix(ptr, len, "ATS319=7"))
+		verify_checksum(strip_info);
+	else if (has_prefix(ptr, len, "ATS325?"))
+		get_radio_voltage(strip_info, p, end);
+	else if (has_prefix(ptr, len, "AT~LA"))
+		get_radio_neighbours(&strip_info->portables, p, end);
+	else
+		RecvErr("Unknown AT Response:", strip_info);
+}
+
+static void process_ACK(struct strip *strip_info, __u8 * ptr, __u8 * end)
+{
+	/* Currently we don't do anything with ACKs from the radio */
+}
+
+static void process_Info(struct strip *strip_info, __u8 * ptr, __u8 * end)
+{
+	if (ptr + 16 > end)
+		RecvErr("Bad Info Msg:", strip_info);
+}
+
+static struct net_device *get_strip_dev(struct strip *strip_info)
+{
+	/* If our hardware address is *manually set* to zero, and we know our */
+	/* real radio hardware address, try to find another strip device that has been */
+	/* manually set to that address that we can 'transfer ownership' of this packet to  */
+	if (strip_info->manual_dev_addr &&
+	    !memcmp(strip_info->dev->dev_addr, zero_address.c,
+		    sizeof(zero_address))
+	    && memcmp(&strip_info->true_dev_addr, zero_address.c,
+		      sizeof(zero_address))) {
+		struct net_device *dev;
+		read_lock_bh(&dev_base_lock);
+		dev = dev_base;
+		while (dev) {
+			if (dev->type == strip_info->dev->type &&
+			    !memcmp(dev->dev_addr,
+				    &strip_info->true_dev_addr,
+				    sizeof(MetricomAddress))) {
+				printk(KERN_INFO
+				       "%s: Transferred packet ownership to %s.\n",
+				       strip_info->dev->name, dev->name);
+				read_unlock_bh(&dev_base_lock);
+				return (dev);
+			}
+			dev = dev->next;
+		}
+		read_unlock_bh(&dev_base_lock);
+	}
+	return (strip_info->dev);
+}
+
+/*
+ * Send one completely decapsulated datagram to the next layer.
+ */
+
+static void deliver_packet(struct strip *strip_info, STRIP_Header * header,
+			   __u16 packetlen)
+{
+	struct sk_buff *skb = dev_alloc_skb(sizeof(STRIP_Header) + packetlen);
+	if (!skb) {
+		printk(KERN_ERR "%s: memory squeeze, dropping packet.\n",
+		       strip_info->dev->name);
+		strip_info->rx_dropped++;
+	} else {
+		memcpy(skb_put(skb, sizeof(STRIP_Header)), header,
+		       sizeof(STRIP_Header));
+		memcpy(skb_put(skb, packetlen), strip_info->rx_buff,
+		       packetlen);
+		skb->dev = get_strip_dev(strip_info);
+		skb->protocol = header->protocol;
+		skb->mac.raw = skb->data;
+
+		/* Having put a fake header on the front of the sk_buff for the */
+		/* benefit of tools like tcpdump, skb_pull now 'consumes' that  */
+		/* fake header before we hand the packet up to the next layer.  */
+		skb_pull(skb, sizeof(STRIP_Header));
+
+		/* Finally, hand the packet up to the next layer (e.g. IP or ARP, etc.) */
+		strip_info->rx_packets++;
+		strip_info->rx_pps_count++;
+#ifdef EXT_COUNTERS
+		strip_info->rx_bytes += packetlen;
+#endif
+		skb->dev->last_rx = jiffies;
+		netif_rx(skb);
+	}
+}
+
+static void process_IP_packet(struct strip *strip_info,
+			      STRIP_Header * header, __u8 * ptr,
+			      __u8 * end)
+{
+	__u16 packetlen;
+
+	/* Decode start of the IP packet header */
+	ptr = UnStuffData(ptr, end, strip_info->rx_buff, 4);
+	if (!ptr) {
+		RecvErr("IP Packet too short", strip_info);
+		return;
+	}
+
+	packetlen = ((__u16) strip_info->rx_buff[2] << 8) | strip_info->rx_buff[3];
+
+	if (packetlen > MAX_RECV_MTU) {
+		printk(KERN_INFO "%s: Dropping oversized received IP packet: %d bytes\n",
+		       strip_info->dev->name, packetlen);
+		strip_info->rx_dropped++;
+		return;
+	}
+
+	/*printk(KERN_INFO "%s: Got %d byte IP packet\n", strip_info->dev->name, packetlen); */
+
+	/* Decode remainder of the IP packet */
+	ptr =
+	    UnStuffData(ptr, end, strip_info->rx_buff + 4, packetlen - 4);
+	if (!ptr) {
+		RecvErr("IP Packet too short", strip_info);
+		return;
+	}
+
+	if (ptr < end) {
+		RecvErr("IP Packet too long", strip_info);
+		return;
+	}
+
+	header->protocol = htons(ETH_P_IP);
+
+	deliver_packet(strip_info, header, packetlen);
+}
+
+static void process_ARP_packet(struct strip *strip_info,
+			       STRIP_Header * header, __u8 * ptr,
+			       __u8 * end)
+{
+	__u16 packetlen;
+	struct arphdr *arphdr = (struct arphdr *) strip_info->rx_buff;
+
+	/* Decode start of the ARP packet */
+	ptr = UnStuffData(ptr, end, strip_info->rx_buff, 8);
+	if (!ptr) {
+		RecvErr("ARP Packet too short", strip_info);
+		return;
+	}
+
+	packetlen = 8 + (arphdr->ar_hln + arphdr->ar_pln) * 2;
+
+	if (packetlen > MAX_RECV_MTU) {
+		printk(KERN_INFO
+		       "%s: Dropping oversized received ARP packet: %d bytes\n",
+		       strip_info->dev->name, packetlen);
+		strip_info->rx_dropped++;
+		return;
+	}
+
+	/*printk(KERN_INFO "%s: Got %d byte ARP %s\n",
+	   strip_info->dev->name, packetlen,
+	   ntohs(arphdr->ar_op) == ARPOP_REQUEST ? "request" : "reply"); */
+
+	/* Decode remainder of the ARP packet */
+	ptr =
+	    UnStuffData(ptr, end, strip_info->rx_buff + 8, packetlen - 8);
+	if (!ptr) {
+		RecvErr("ARP Packet too short", strip_info);
+		return;
+	}
+
+	if (ptr < end) {
+		RecvErr("ARP Packet too long", strip_info);
+		return;
+	}
+
+	header->protocol = htons(ETH_P_ARP);
+
+	deliver_packet(strip_info, header, packetlen);
+}
+
+/*
+ * process_text_message processes a <CR>-terminated block of data received
+ * from the radio that doesn't begin with a '*' character. All normal
+ * Starmode communication messages with the radio begin with a '*',
+ * so any text that does not indicates a serial port error, a radio that
+ * is in Hayes command mode instead of Starmode, or a radio with really
+ * old firmware that doesn't frame its Starmode responses properly.
+ */
+static void process_text_message(struct strip *strip_info)
+{
+	__u8 *msg = strip_info->sx_buff;
+	int len = strip_info->sx_count;
+
+	/* Check for anything that looks like it might be our radio name */
+	/* (This is here for backwards compatibility with old firmware)  */
+	if (len == 9 && get_radio_address(strip_info, msg) == 0)
+		return;
+
+	if (text_equal(msg, len, "OK"))
+		return;		/* Ignore 'OK' responses from prior commands */
+	if (text_equal(msg, len, "ERROR"))
+		return;		/* Ignore 'ERROR' messages */
+	if (has_prefix(msg, len, "ate0q1"))
+		return;		/* Ignore character echo back from the radio */
+
+	/* Catch other error messages */
+	/* (This is here for backwards compatibility with old firmware) */
+	if (has_prefix(msg, len, "ERR_")) {
+		RecvErr_Message(strip_info, NULL, &msg[4], len - 4);
+		return;
+	}
+
+	RecvErr("No initial *", strip_info);
+}
+
+/*
+ * process_message processes a <CR>-terminated block of data received
+ * from the radio. If the radio is not in Starmode or has old firmware,
+ * it may be a line of text in response to an AT command. Ideally, with
+ * a current radio that's properly in Starmode, all data received should
+ * be properly framed and checksummed radio message blocks, containing
+ * either a starmode packet, or a other communication from the radio
+ * firmware, like "INF_" Info messages and &COMMAND responses.
+ */
+static void process_message(struct strip *strip_info)
+{
+	STRIP_Header header = { zero_address, zero_address, 0 };
+	__u8 *ptr = strip_info->sx_buff;
+	__u8 *end = strip_info->sx_buff + strip_info->sx_count;
+	__u8 sendername[32], *sptr = sendername;
+	MetricomKey key;
+
+	/*HexDump("Receiving", strip_info, ptr, end); */
+
+	/* Check for start of address marker, and then skip over it */
+	if (*ptr == '*')
+		ptr++;
+	else {
+		process_text_message(strip_info);
+		return;
+	}
+
+	/* Copy out the return address */
+	while (ptr < end && *ptr != '*'
+	       && sptr < ARRAY_END(sendername) - 1)
+		*sptr++ = *ptr++;
+	*sptr = 0;		/* Null terminate the sender name */
+
+	/* Check for end of address marker, and skip over it */
+	if (ptr >= end || *ptr != '*') {
+		RecvErr("No second *", strip_info);
+		return;
+	}
+	ptr++;			/* Skip the second '*' */
+
+	/* If the sender name is "&COMMAND", ignore this 'packet'       */
+	/* (This is here for backwards compatibility with old firmware) */
+	if (!strcmp(sendername, "&COMMAND")) {
+		strip_info->firmware_level = NoStructure;
+		strip_info->next_command = CompatibilityCommand;
+		return;
+	}
+
+	if (ptr + 4 > end) {
+		RecvErr("No proto key", strip_info);
+		return;
+	}
+
+	/* Get the protocol key out of the buffer */
+	key.c[0] = *ptr++;
+	key.c[1] = *ptr++;
+	key.c[2] = *ptr++;
+	key.c[3] = *ptr++;
+
+	/* If we're using checksums, verify the checksum at the end of the packet */
+	if (strip_info->firmware_level >= ChecksummedMessages) {
+		end -= 4;	/* Chop the last four bytes off the packet (they're the checksum) */
+		if (ptr > end) {
+			RecvErr("Missing Checksum", strip_info);
+			return;
+		}
+		if (!verify_checksum(strip_info)) {
+			RecvErr("Bad Checksum", strip_info);
+			return;
+		}
+	}
+
+	/*printk(KERN_INFO "%s: Got packet from \"%s\".\n", strip_info->dev->name, sendername); */
+
+	/*
+	 * Fill in (pseudo) source and destination addresses in the packet.
+	 * We assume that the destination address was our address (the radio does not
+	 * tell us this). If the radio supplies a source address, then we use it.
+	 */
+	header.dst_addr = strip_info->true_dev_addr;
+	string_to_radio_address(&header.src_addr, sendername);
+
+#ifdef EXT_COUNTERS
+	if (key.l == SIP0Key.l) {
+		strip_info->rx_rbytes += (end - ptr);
+		process_IP_packet(strip_info, &header, ptr, end);
+	} else if (key.l == ARP0Key.l) {
+		strip_info->rx_rbytes += (end - ptr);
+		process_ARP_packet(strip_info, &header, ptr, end);
+	} else if (key.l == ATR_Key.l) {
+		strip_info->rx_ebytes += (end - ptr);
+		process_AT_response(strip_info, ptr, end);
+	} else if (key.l == ACK_Key.l) {
+		strip_info->rx_ebytes += (end - ptr);
+		process_ACK(strip_info, ptr, end);
+	} else if (key.l == INF_Key.l) {
+		strip_info->rx_ebytes += (end - ptr);
+		process_Info(strip_info, ptr, end);
+	} else if (key.l == ERR_Key.l) {
+		strip_info->rx_ebytes += (end - ptr);
+		RecvErr_Message(strip_info, sendername, ptr, end - ptr);
+	} else
+		RecvErr("Unrecognized protocol key", strip_info);
+#else
+	if (key.l == SIP0Key.l)
+		process_IP_packet(strip_info, &header, ptr, end);
+	else if (key.l == ARP0Key.l)
+		process_ARP_packet(strip_info, &header, ptr, end);
+	else if (key.l == ATR_Key.l)
+		process_AT_response(strip_info, ptr, end);
+	else if (key.l == ACK_Key.l)
+		process_ACK(strip_info, ptr, end);
+	else if (key.l == INF_Key.l)
+		process_Info(strip_info, ptr, end);
+	else if (key.l == ERR_Key.l)
+		RecvErr_Message(strip_info, sendername, ptr, end - ptr);
+	else
+		RecvErr("Unrecognized protocol key", strip_info);
+#endif
+}
+
+#define TTYERROR(X) ((X) == TTY_BREAK   ? "Break"            : \
+                     (X) == TTY_FRAME   ? "Framing Error"    : \
+                     (X) == TTY_PARITY  ? "Parity Error"     : \
+                     (X) == TTY_OVERRUN ? "Hardware Overrun" : "Unknown Error")
+
+/*
+ * Handle the 'receiver data ready' interrupt.
+ * This function is called by the 'tty_io' module in the kernel when
+ * a block of STRIP data has been received, which can now be decapsulated
+ * and sent on to some IP layer for further processing.
+ */
+
+static void strip_receive_buf(struct tty_struct *tty, const unsigned char *cp,
+		  char *fp, int count)
+{
+	struct strip *strip_info = (struct strip *) tty->disc_data;
+	const unsigned char *end = cp + count;
+
+	if (!strip_info || strip_info->magic != STRIP_MAGIC
+	    || !netif_running(strip_info->dev))
+		return;
+
+	spin_lock_bh(&strip_lock);
+#if 0
+	{
+		struct timeval tv;
+		do_gettimeofday(&tv);
+		printk(KERN_INFO
+		       "**** strip_receive_buf: %3d bytes at %02d.%06d\n",
+		       count, tv.tv_sec % 100, tv.tv_usec);
+	}
+#endif
+
+#ifdef EXT_COUNTERS
+	strip_info->rx_sbytes += count;
+#endif
+
+	/* Read the characters out of the buffer */
+	while (cp < end) {
+		if (fp && *fp)
+			printk(KERN_INFO "%s: %s on serial port\n",
+			       strip_info->dev->name, TTYERROR(*fp));
+		if (fp && *fp++ && !strip_info->discard) {	/* If there's a serial error, record it */
+			/* If we have some characters in the buffer, discard them */
+			strip_info->discard = strip_info->sx_count;
+			strip_info->rx_errors++;
+		}
+
+		/* Leading control characters (CR, NL, Tab, etc.) are ignored */
+		if (strip_info->sx_count > 0 || *cp >= ' ') {
+			if (*cp == 0x0D) {	/* If end of packet, decide what to do with it */
+				if (strip_info->sx_count > 3000)
+					printk(KERN_INFO
+					       "%s: Cut a %d byte packet (%zd bytes remaining)%s\n",
+					       strip_info->dev->name,
+					       strip_info->sx_count,
+					       end - cp - 1,
+					       strip_info->
+					       discard ? " (discarded)" :
+					       "");
+				if (strip_info->sx_count >
+				    strip_info->sx_size) {
+					strip_info->rx_over_errors++;
+					printk(KERN_INFO
+					       "%s: sx_buff overflow (%d bytes total)\n",
+					       strip_info->dev->name,
+					       strip_info->sx_count);
+				} else if (strip_info->discard)
+					printk(KERN_INFO
+					       "%s: Discarding bad packet (%d/%d)\n",
+					       strip_info->dev->name,
+					       strip_info->discard,
+					       strip_info->sx_count);
+				else
+					process_message(strip_info);
+				strip_info->discard = 0;
+				strip_info->sx_count = 0;
+			} else {
+				/* Make sure we have space in the buffer */
+				if (strip_info->sx_count <
+				    strip_info->sx_size)
+					strip_info->sx_buff[strip_info->
+							    sx_count] =
+					    *cp;
+				strip_info->sx_count++;
+			}
+		}
+		cp++;
+	}
+	spin_unlock_bh(&strip_lock);
+}
+
+
+/************************************************************************/
+/* General control routines						*/
+
+static int set_mac_address(struct strip *strip_info,
+			   MetricomAddress * addr)
+{
+	/*
+	 * We're using a manually specified address if the address is set
+	 * to anything other than all ones. Setting the address to all ones
+	 * disables manual mode and goes back to automatic address determination
+	 * (tracking the true address that the radio has).
+	 */
+	strip_info->manual_dev_addr =
+	    memcmp(addr->c, broadcast_address.c,
+		   sizeof(broadcast_address));
+	if (strip_info->manual_dev_addr)
+		*(MetricomAddress *) strip_info->dev->dev_addr = *addr;
+	else
+		*(MetricomAddress *) strip_info->dev->dev_addr =
+		    strip_info->true_dev_addr;
+	return 0;
+}
+
+static int strip_set_mac_address(struct net_device *dev, void *addr)
+{
+	struct strip *strip_info = netdev_priv(dev);
+	struct sockaddr *sa = addr;
+	printk(KERN_INFO "%s: strip_set_dev_mac_address called\n", dev->name);
+	set_mac_address(strip_info, (MetricomAddress *) sa->sa_data);
+	return 0;
+}
+
+static struct net_device_stats *strip_get_stats(struct net_device *dev)
+{
+	struct strip *strip_info = netdev_priv(dev);
+	static struct net_device_stats stats;
+
+	memset(&stats, 0, sizeof(struct net_device_stats));
+
+	stats.rx_packets = strip_info->rx_packets;
+	stats.tx_packets = strip_info->tx_packets;
+	stats.rx_dropped = strip_info->rx_dropped;
+	stats.tx_dropped = strip_info->tx_dropped;
+	stats.tx_errors = strip_info->tx_errors;
+	stats.rx_errors = strip_info->rx_errors;
+	stats.rx_over_errors = strip_info->rx_over_errors;
+	return (&stats);
+}
+
+
+/************************************************************************/
+/* Opening and closing							*/
+
+/*
+ * Here's the order things happen:
+ * When the user runs "slattach -p strip ..."
+ *  1. The TTY module calls strip_open
+ *  2. strip_open calls strip_alloc
+ *  3.                  strip_alloc calls register_netdev
+ *  4.                  register_netdev calls strip_dev_init
+ *  5. then strip_open finishes setting up the strip_info
+ *
+ * When the user runs "ifconfig st<x> up address netmask ..."
+ *  6. strip_open_low gets called
+ *
+ * When the user runs "ifconfig st<x> down"
+ *  7. strip_close_low gets called
+ *
+ * When the user kills the slattach process
+ *  8. strip_close gets called
+ *  9. strip_close calls dev_close
+ * 10. if the device is still up, then dev_close calls strip_close_low
+ * 11. strip_close calls strip_free
+ */
+
+/* Open the low-level part of the STRIP channel. Easy! */
+
+static int strip_open_low(struct net_device *dev)
+{
+	struct strip *strip_info = netdev_priv(dev);
+
+	if (strip_info->tty == NULL)
+		return (-ENODEV);
+
+	if (!allocate_buffers(strip_info, dev->mtu))
+		return (-ENOMEM);
+
+	strip_info->sx_count = 0;
+	strip_info->tx_left = 0;
+
+	strip_info->discard = 0;
+	strip_info->working = FALSE;
+	strip_info->firmware_level = NoStructure;
+	strip_info->next_command = CompatibilityCommand;
+	strip_info->user_baud = get_baud(strip_info->tty);
+
+	printk(KERN_INFO "%s: Initializing Radio.\n",
+	       strip_info->dev->name);
+	ResetRadio(strip_info);
+	strip_info->idle_timer.expires = jiffies + 1 * HZ;
+	add_timer(&strip_info->idle_timer);
+	netif_wake_queue(dev);
+	return (0);
+}
+
+
+/*
+ * Close the low-level part of the STRIP channel. Easy!
+ */
+
+static int strip_close_low(struct net_device *dev)
+{
+	struct strip *strip_info = netdev_priv(dev);
+
+	if (strip_info->tty == NULL)
+		return -EBUSY;
+	strip_info->tty->flags &= ~(1 << TTY_DO_WRITE_WAKEUP);
+
+	netif_stop_queue(dev);
+
+	/*
+	 * Free all STRIP frame buffers.
+	 */
+	if (strip_info->rx_buff) {
+		kfree(strip_info->rx_buff);
+		strip_info->rx_buff = NULL;
+	}
+	if (strip_info->sx_buff) {
+		kfree(strip_info->sx_buff);
+		strip_info->sx_buff = NULL;
+	}
+	if (strip_info->tx_buff) {
+		kfree(strip_info->tx_buff);
+		strip_info->tx_buff = NULL;
+	}
+	del_timer(&strip_info->idle_timer);
+	return 0;
+}
+
+/*
+ * This routine is called by DDI when the
+ * (dynamically assigned) device is registered
+ */
+
+static void strip_dev_setup(struct net_device *dev)
+{
+	/*
+	 * Finish setting up the DEVICE info.
+	 */
+
+	SET_MODULE_OWNER(dev);
+
+	dev->trans_start = 0;
+	dev->last_rx = 0;
+	dev->tx_queue_len = 30;	/* Drop after 30 frames queued */
+
+	dev->flags = 0;
+	dev->mtu = DEFAULT_STRIP_MTU;
+	dev->type = ARPHRD_METRICOM;	/* dtang */
+	dev->hard_header_len = sizeof(STRIP_Header);
+	/*
+	 *  dev->priv             Already holds a pointer to our struct strip
+	 */
+
+	*(MetricomAddress *) & dev->broadcast = broadcast_address;
+	dev->dev_addr[0] = 0;
+	dev->addr_len = sizeof(MetricomAddress);
+
+	/*
+	 * Pointers to interface service routines.
+	 */
+
+	dev->open = strip_open_low;
+	dev->stop = strip_close_low;
+	dev->hard_start_xmit = strip_xmit;
+	dev->hard_header = strip_header;
+	dev->rebuild_header = strip_rebuild_header;
+	dev->set_mac_address = strip_set_mac_address;
+	dev->get_stats = strip_get_stats;
+	dev->change_mtu = strip_change_mtu;
+}
+
+/*
+ * Free a STRIP channel.
+ */
+
+static void strip_free(struct strip *strip_info)
+{
+	spin_lock_bh(&strip_lock);
+	list_del_rcu(&strip_info->list);
+	spin_unlock_bh(&strip_lock);
+
+	strip_info->magic = 0;
+
+	free_netdev(strip_info->dev);
+}
+
+
+/*
+ * Allocate a new free STRIP channel
+ */
+static struct strip *strip_alloc(void)
+{
+	struct list_head *n;
+	struct net_device *dev;
+	struct strip *strip_info;
+
+	dev = alloc_netdev(sizeof(struct strip), "st%d",
+			   strip_dev_setup);
+
+	if (!dev)
+		return NULL;	/* If no more memory, return */
+
+
+	strip_info = dev->priv;
+	strip_info->dev = dev;
+
+	strip_info->magic = STRIP_MAGIC;
+	strip_info->tty = NULL;
+
+	strip_info->gratuitous_arp = jiffies + LongTime;
+	strip_info->arp_interval = 0;
+	init_timer(&strip_info->idle_timer);
+	strip_info->idle_timer.data = (long) dev;
+	strip_info->idle_timer.function = strip_IdleTask;
+
+
+	spin_lock_bh(&strip_lock);
+ rescan:
+	/*
+	 * Search the list to find where to put our new entry
+	 * (and in the process decide what channel number it is
+	 * going to be)
+	 */
+	list_for_each(n, &strip_list) {
+		struct strip *s = hlist_entry(n, struct strip, list);
+
+		if (s->dev->base_addr == dev->base_addr) {
+			++dev->base_addr;
+			goto rescan;
+		}
+	}
+
+	sprintf(dev->name, "st%ld", dev->base_addr);
+
+	list_add_tail_rcu(&strip_info->list, &strip_list);
+	spin_unlock_bh(&strip_lock);
+
+	return strip_info;
+}
+
+/*
+ * Open the high-level part of the STRIP channel.
+ * This function is called by the TTY module when the
+ * STRIP line discipline is called for.  Because we are
+ * sure the tty line exists, we only have to link it to
+ * a free STRIP channel...
+ */
+
+static int strip_open(struct tty_struct *tty)
+{
+	struct strip *strip_info = (struct strip *) tty->disc_data;
+
+	/*
+	 * First make sure we're not already connected.
+	 */
+
+	if (strip_info && strip_info->magic == STRIP_MAGIC)
+		return -EEXIST;
+
+	/*
+	 * OK.  Find a free STRIP channel to use.
+	 */
+	if ((strip_info = strip_alloc()) == NULL)
+		return -ENFILE;
+
+	/*
+	 * Register our newly created device so it can be ifconfig'd
+	 * strip_dev_init() will be called as a side-effect
+	 */
+
+	if (register_netdev(strip_info->dev) != 0) {
+		printk(KERN_ERR "strip: register_netdev() failed.\n");
+		strip_free(strip_info);
+		return -ENFILE;
+	}
+
+	strip_info->tty = tty;
+	tty->disc_data = strip_info;
+	if (tty->driver->flush_buffer)
+		tty->driver->flush_buffer(tty);
+
+	/*
+	 * Restore default settings
+	 */
+
+	strip_info->dev->type = ARPHRD_METRICOM;	/* dtang */
+
+	/*
+	 * Set tty options
+	 */
+
+	tty->termios->c_iflag |= IGNBRK | IGNPAR;	/* Ignore breaks and parity errors. */
+	tty->termios->c_cflag |= CLOCAL;	/* Ignore modem control signals. */
+	tty->termios->c_cflag &= ~HUPCL;	/* Don't close on hup */
+
+	printk(KERN_INFO "STRIP: device \"%s\" activated\n",
+	       strip_info->dev->name);
+
+	/*
+	 * Done.  We have linked the TTY line to a channel.
+	 */
+	return (strip_info->dev->base_addr);
+}
+
+/*
+ * Close down a STRIP channel.
+ * This means flushing out any pending queues, and then restoring the
+ * TTY line discipline to what it was before it got hooked to STRIP
+ * (which usually is TTY again).
+ */
+
+static void strip_close(struct tty_struct *tty)
+{
+	struct strip *strip_info = (struct strip *) tty->disc_data;
+
+	/*
+	 * First make sure we're connected.
+	 */
+
+	if (!strip_info || strip_info->magic != STRIP_MAGIC)
+		return;
+
+	unregister_netdev(strip_info->dev);
+
+	tty->disc_data = NULL;
+	strip_info->tty = NULL;
+	printk(KERN_INFO "STRIP: device \"%s\" closed down\n",
+	       strip_info->dev->name);
+	strip_free(strip_info);
+	tty->disc_data = NULL;
+}
+
+
+/************************************************************************/
+/* Perform I/O control calls on an active STRIP channel.		*/
+
+static int strip_ioctl(struct tty_struct *tty, struct file *file,
+		       unsigned int cmd, unsigned long arg)
+{
+	struct strip *strip_info = (struct strip *) tty->disc_data;
+
+	/*
+	 * First make sure we're connected.
+	 */
+
+	if (!strip_info || strip_info->magic != STRIP_MAGIC)
+		return -EINVAL;
+
+	switch (cmd) {
+	case SIOCGIFNAME:
+		if(copy_to_user((void __user *) arg, strip_info->dev->name, strlen(strip_info->dev->name) + 1))
+			return -EFAULT;
+		break;
+	case SIOCSIFHWADDR:
+	{
+		MetricomAddress addr;
+		//printk(KERN_INFO "%s: SIOCSIFHWADDR\n", strip_info->dev->name);
+		if(copy_from_user(&addr, (void __user *) arg, sizeof(MetricomAddress)))
+			return -EFAULT;
+		return set_mac_address(strip_info, &addr);
+	}
+	/*
+	 * Allow stty to read, but not set, the serial port
+	 */
+
+	case TCGETS:
+	case TCGETA:
+		return n_tty_ioctl(tty, file, cmd, arg);
+		break;
+	default:
+		return -ENOIOCTLCMD;
+		break;
+	}
+	return 0;
+}
+
+
+/************************************************************************/
+/* Initialization							*/
+
+static struct tty_ldisc strip_ldisc = {
+	.magic = TTY_LDISC_MAGIC,
+	.name = "strip",
+	.owner = THIS_MODULE,
+	.open = strip_open,
+	.close = strip_close,
+	.ioctl = strip_ioctl,
+	.receive_buf = strip_receive_buf,
+	.receive_room = strip_receive_room,
+	.write_wakeup = strip_write_some_more,
+};
+
+/*
+ * Initialize the STRIP driver.
+ * This routine is called at boot time, to bootstrap the multi-channel
+ * STRIP driver
+ */
+
+static char signon[] __initdata =
+    KERN_INFO "STRIP: Version %s (unlimited channels)\n";
+
+static int __init strip_init_driver(void)
+{
+	int status;
+
+	printk(signon, StripVersion);
+
+	
+	/*
+	 * Fill in our line protocol discipline, and register it
+	 */
+	if ((status = tty_register_ldisc(N_STRIP, &strip_ldisc)))
+		printk(KERN_ERR "STRIP: can't register line discipline (err = %d)\n",
+		       status);
+
+	/*
+	 * Register the status file with /proc
+	 */
+	proc_net_fops_create("strip", S_IFREG | S_IRUGO, &strip_seq_fops);
+
+	return status;
+}
+
+module_init(strip_init_driver);
+
+static const char signoff[] __exitdata =
+    KERN_INFO "STRIP: Module Unloaded\n";
+
+static void __exit strip_exit_driver(void)
+{
+	int i;
+	struct list_head *p,*n;
+
+	/* module ref count rules assure that all entries are unregistered */
+	list_for_each_safe(p, n, &strip_list) {
+		struct strip *s = list_entry(p, struct strip, list);
+		strip_free(s);
+	}
+
+	/* Unregister with the /proc/net file here. */
+	proc_net_remove("strip");
+
+	if ((i = tty_register_ldisc(N_STRIP, NULL)))
+		printk(KERN_ERR "STRIP: can't unregister line discipline (err = %d)\n", i);
+
+	printk(signoff);
+}
+
+module_exit(strip_exit_driver);
+
+MODULE_AUTHOR("Stuart Cheshire <cheshire@cs.stanford.edu>");
+MODULE_DESCRIPTION("Starmode Radio IP (STRIP) Device Driver");
+MODULE_LICENSE("Dual BSD/GPL");
+
+MODULE_SUPPORTED_DEVICE("Starmode Radio IP (STRIP) modem");
diff --git a/drivers/net/wireless/todo.txt b/drivers/net/wireless/todo.txt
new file mode 100644
index 0000000..3223401
--- /dev/null
+++ b/drivers/net/wireless/todo.txt
@@ -0,0 +1,15 @@
+	Wireless Todo
+	-------------
+
+1) Bring other kernel Wireless LAN drivers here
+	Completed
+
+2) Bring new Wireless LAN driver not yet in the kernel there
+	See my web page for details
+	In particular : HostAP
+
+3) Misc
+	o Mark wavelan, wavelan_cs, netwave_cs drivers as obsolete
+	o Maybe arlan.c, ray_cs.c and strip.c also deserve to be obsolete
+
+	Jean II
diff --git a/drivers/net/wireless/wavelan.c b/drivers/net/wireless/wavelan.c
new file mode 100644
index 0000000..7a5e20a
--- /dev/null
+++ b/drivers/net/wireless/wavelan.c
@@ -0,0 +1,4452 @@
+/*
+ *	WaveLAN ISA driver
+ *
+ *		Jean II - HPLB '96
+ *
+ * Reorganisation and extension of the driver.
+ * Original copyright follows (also see the end of this file).
+ * See wavelan.p.h for details.
+ *
+ *
+ *
+ * AT&T GIS (nee NCR) WaveLAN card:
+ *	An Ethernet-like radio transceiver
+ *	controlled by an Intel 82586 coprocessor.
+ */
+
+#include "wavelan.p.h"		/* Private header */
+
+/************************* MISC SUBROUTINES **************************/
+/*
+ * Subroutines which won't fit in one of the following category
+ * (WaveLAN modem or i82586)
+ */
+
+/*------------------------------------------------------------------*/
+/*
+ * Translate irq number to PSA irq parameter
+ */
+static u8 wv_irq_to_psa(int irq)
+{
+	if (irq < 0 || irq >= NELS(irqvals))
+		return 0;
+
+	return irqvals[irq];
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Translate PSA irq parameter to irq number 
+ */
+static int __init wv_psa_to_irq(u8 irqval)
+{
+	int irq;
+
+	for (irq = 0; irq < NELS(irqvals); irq++)
+		if (irqvals[irq] == irqval)
+			return irq;
+
+	return -1;
+}
+
+#ifdef STRUCT_CHECK
+/*------------------------------------------------------------------*/
+/*
+ * Sanity routine to verify the sizes of the various WaveLAN interface
+ * structures.
+ */
+static char *wv_struct_check(void)
+{
+#define	SC(t,s,n)	if (sizeof(t) != s) return(n);
+
+	SC(psa_t, PSA_SIZE, "psa_t");
+	SC(mmw_t, MMW_SIZE, "mmw_t");
+	SC(mmr_t, MMR_SIZE, "mmr_t");
+	SC(ha_t, HA_SIZE, "ha_t");
+
+#undef	SC
+
+	return ((char *) NULL);
+}				/* wv_struct_check */
+#endif				/* STRUCT_CHECK */
+
+/********************* HOST ADAPTER SUBROUTINES *********************/
+/*
+ * Useful subroutines to manage the WaveLAN ISA interface
+ *
+ * One major difference with the PCMCIA hardware (except the port mapping)
+ * is that we have to keep the state of the Host Control Register
+ * because of the interrupt enable & bus size flags.
+ */
+
+/*------------------------------------------------------------------*/
+/*
+ * Read from card's Host Adaptor Status Register.
+ */
+static inline u16 hasr_read(unsigned long ioaddr)
+{
+	return (inw(HASR(ioaddr)));
+}				/* hasr_read */
+
+/*------------------------------------------------------------------*/
+/*
+ * Write to card's Host Adapter Command Register.
+ */
+static inline void hacr_write(unsigned long ioaddr, u16 hacr)
+{
+	outw(hacr, HACR(ioaddr));
+}				/* hacr_write */
+
+/*------------------------------------------------------------------*/
+/*
+ * Write to card's Host Adapter Command Register. Include a delay for
+ * those times when it is needed.
+ */
+static inline void hacr_write_slow(unsigned long ioaddr, u16 hacr)
+{
+	hacr_write(ioaddr, hacr);
+	/* delay might only be needed sometimes */
+	mdelay(1);
+}				/* hacr_write_slow */
+
+/*------------------------------------------------------------------*/
+/*
+ * Set the channel attention bit.
+ */
+static inline void set_chan_attn(unsigned long ioaddr, u16 hacr)
+{
+	hacr_write(ioaddr, hacr | HACR_CA);
+}				/* set_chan_attn */
+
+/*------------------------------------------------------------------*/
+/*
+ * Reset, and then set host adaptor into default mode.
+ */
+static inline void wv_hacr_reset(unsigned long ioaddr)
+{
+	hacr_write_slow(ioaddr, HACR_RESET);
+	hacr_write(ioaddr, HACR_DEFAULT);
+}				/* wv_hacr_reset */
+
+/*------------------------------------------------------------------*/
+/*
+ * Set the I/O transfer over the ISA bus to 8-bit mode
+ */
+static inline void wv_16_off(unsigned long ioaddr, u16 hacr)
+{
+	hacr &= ~HACR_16BITS;
+	hacr_write(ioaddr, hacr);
+}				/* wv_16_off */
+
+/*------------------------------------------------------------------*/
+/*
+ * Set the I/O transfer over the ISA bus to 8-bit mode
+ */
+static inline void wv_16_on(unsigned long ioaddr, u16 hacr)
+{
+	hacr |= HACR_16BITS;
+	hacr_write(ioaddr, hacr);
+}				/* wv_16_on */
+
+/*------------------------------------------------------------------*/
+/*
+ * Disable interrupts on the WaveLAN hardware.
+ * (called by wv_82586_stop())
+ */
+static inline void wv_ints_off(struct net_device * dev)
+{
+	net_local *lp = (net_local *) dev->priv;
+	unsigned long ioaddr = dev->base_addr;
+	
+	lp->hacr &= ~HACR_INTRON;
+	hacr_write(ioaddr, lp->hacr);
+}				/* wv_ints_off */
+
+/*------------------------------------------------------------------*/
+/*
+ * Enable interrupts on the WaveLAN hardware.
+ * (called by wv_hw_reset())
+ */
+static inline void wv_ints_on(struct net_device * dev)
+{
+	net_local *lp = (net_local *) dev->priv;
+	unsigned long ioaddr = dev->base_addr;
+
+	lp->hacr |= HACR_INTRON;
+	hacr_write(ioaddr, lp->hacr);
+}				/* wv_ints_on */
+
+/******************* MODEM MANAGEMENT SUBROUTINES *******************/
+/*
+ * Useful subroutines to manage the modem of the WaveLAN
+ */
+
+/*------------------------------------------------------------------*/
+/*
+ * Read the Parameter Storage Area from the WaveLAN card's memory
+ */
+/*
+ * Read bytes from the PSA.
+ */
+static void psa_read(unsigned long ioaddr, u16 hacr, int o,	/* offset in PSA */
+		     u8 * b,	/* buffer to fill */
+		     int n)
+{				/* size to read */
+	wv_16_off(ioaddr, hacr);
+
+	while (n-- > 0) {
+		outw(o, PIOR2(ioaddr));
+		o++;
+		*b++ = inb(PIOP2(ioaddr));
+	}
+
+	wv_16_on(ioaddr, hacr);
+}				/* psa_read */
+
+/*------------------------------------------------------------------*/
+/*
+ * Write the Parameter Storage Area to the WaveLAN card's memory.
+ */
+static void psa_write(unsigned long ioaddr, u16 hacr, int o,	/* Offset in PSA */
+		      u8 * b,	/* Buffer in memory */
+		      int n)
+{				/* Length of buffer */
+	int count = 0;
+
+	wv_16_off(ioaddr, hacr);
+
+	while (n-- > 0) {
+		outw(o, PIOR2(ioaddr));
+		o++;
+
+		outb(*b, PIOP2(ioaddr));
+		b++;
+
+		/* Wait for the memory to finish its write cycle */
+		count = 0;
+		while ((count++ < 100) &&
+		       (hasr_read(ioaddr) & HASR_PSA_BUSY)) mdelay(1);
+	}
+
+	wv_16_on(ioaddr, hacr);
+}				/* psa_write */
+
+#ifdef SET_PSA_CRC
+/*------------------------------------------------------------------*/
+/*
+ * Calculate the PSA CRC
+ * Thanks to Valster, Nico <NVALSTER@wcnd.nl.lucent.com> for the code
+ * NOTE: By specifying a length including the CRC position the
+ * returned value should be zero. (i.e. a correct checksum in the PSA)
+ *
+ * The Windows drivers don't use the CRC, but the AP and the PtP tool
+ * depend on it.
+ */
+static inline u16 psa_crc(u8 * psa,	/* The PSA */
+			      int size)
+{				/* Number of short for CRC */
+	int byte_cnt;		/* Loop on the PSA */
+	u16 crc_bytes = 0;	/* Data in the PSA */
+	int bit_cnt;		/* Loop on the bits of the short */
+
+	for (byte_cnt = 0; byte_cnt < size; byte_cnt++) {
+		crc_bytes ^= psa[byte_cnt];	/* Its an xor */
+
+		for (bit_cnt = 1; bit_cnt < 9; bit_cnt++) {
+			if (crc_bytes & 0x0001)
+				crc_bytes = (crc_bytes >> 1) ^ 0xA001;
+			else
+				crc_bytes >>= 1;
+		}
+	}
+
+	return crc_bytes;
+}				/* psa_crc */
+#endif				/* SET_PSA_CRC */
+
+/*------------------------------------------------------------------*/
+/*
+ * update the checksum field in the Wavelan's PSA
+ */
+static void update_psa_checksum(struct net_device * dev, unsigned long ioaddr, u16 hacr)
+{
+#ifdef SET_PSA_CRC
+	psa_t psa;
+	u16 crc;
+
+	/* read the parameter storage area */
+	psa_read(ioaddr, hacr, 0, (unsigned char *) &psa, sizeof(psa));
+
+	/* update the checksum */
+	crc = psa_crc((unsigned char *) &psa,
+		      sizeof(psa) - sizeof(psa.psa_crc[0]) -
+		      sizeof(psa.psa_crc[1])
+		      - sizeof(psa.psa_crc_status));
+
+	psa.psa_crc[0] = crc & 0xFF;
+	psa.psa_crc[1] = (crc & 0xFF00) >> 8;
+
+	/* Write it ! */
+	psa_write(ioaddr, hacr, (char *) &psa.psa_crc - (char *) &psa,
+		  (unsigned char *) &psa.psa_crc, 2);
+
+#ifdef DEBUG_IOCTL_INFO
+	printk(KERN_DEBUG "%s: update_psa_checksum(): crc = 0x%02x%02x\n",
+	       dev->name, psa.psa_crc[0], psa.psa_crc[1]);
+
+	/* Check again (luxury !) */
+	crc = psa_crc((unsigned char *) &psa,
+		      sizeof(psa) - sizeof(psa.psa_crc_status));
+
+	if (crc != 0)
+		printk(KERN_WARNING
+		       "%s: update_psa_checksum(): CRC does not agree with PSA data (even after recalculating)\n",
+		       dev->name);
+#endif				/* DEBUG_IOCTL_INFO */
+#endif				/* SET_PSA_CRC */
+}				/* update_psa_checksum */
+
+/*------------------------------------------------------------------*/
+/*
+ * Write 1 byte to the MMC.
+ */
+static inline void mmc_out(unsigned long ioaddr, u16 o, u8 d)
+{
+	int count = 0;
+
+	/* Wait for MMC to go idle */
+	while ((count++ < 100) && (inw(HASR(ioaddr)) & HASR_MMC_BUSY))
+		udelay(10);
+
+	outw((u16) (((u16) d << 8) | (o << 1) | 1), MMCR(ioaddr));
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Routine to write bytes to the Modem Management Controller.
+ * We start at the end because it is the way it should be!
+ */
+static inline void mmc_write(unsigned long ioaddr, u8 o, u8 * b, int n)
+{
+	o += n;
+	b += n;
+
+	while (n-- > 0)
+		mmc_out(ioaddr, --o, *(--b));
+}				/* mmc_write */
+
+/*------------------------------------------------------------------*/
+/*
+ * Read a byte from the MMC.
+ * Optimised version for 1 byte, avoid using memory.
+ */
+static inline u8 mmc_in(unsigned long ioaddr, u16 o)
+{
+	int count = 0;
+
+	while ((count++ < 100) && (inw(HASR(ioaddr)) & HASR_MMC_BUSY))
+		udelay(10);
+	outw(o << 1, MMCR(ioaddr));
+
+	while ((count++ < 100) && (inw(HASR(ioaddr)) & HASR_MMC_BUSY))
+		udelay(10);
+	return (u8) (inw(MMCR(ioaddr)) >> 8);
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Routine to read bytes from the Modem Management Controller.
+ * The implementation is complicated by a lack of address lines,
+ * which prevents decoding of the low-order bit.
+ * (code has just been moved in the above function)
+ * We start at the end because it is the way it should be!
+ */
+static inline void mmc_read(unsigned long ioaddr, u8 o, u8 * b, int n)
+{
+	o += n;
+	b += n;
+
+	while (n-- > 0)
+		*(--b) = mmc_in(ioaddr, --o);
+}				/* mmc_read */
+
+/*------------------------------------------------------------------*/
+/*
+ * Get the type of encryption available.
+ */
+static inline int mmc_encr(unsigned long ioaddr)
+{				/* I/O port of the card */
+	int temp;
+
+	temp = mmc_in(ioaddr, mmroff(0, mmr_des_avail));
+	if ((temp != MMR_DES_AVAIL_DES) && (temp != MMR_DES_AVAIL_AES))
+		return 0;
+	else
+		return temp;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wait for the frequency EEPROM to complete a command.
+ * I hope this one will be optimally inlined.
+ */
+static inline void fee_wait(unsigned long ioaddr,	/* I/O port of the card */
+			    int delay,	/* Base delay to wait for */
+			    int number)
+{				/* Number of time to wait */
+	int count = 0;		/* Wait only a limited time */
+
+	while ((count++ < number) &&
+	       (mmc_in(ioaddr, mmroff(0, mmr_fee_status)) &
+		MMR_FEE_STATUS_BUSY)) udelay(delay);
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Read bytes from the Frequency EEPROM (frequency select cards).
+ */
+static void fee_read(unsigned long ioaddr,	/* I/O port of the card */
+		     u16 o,	/* destination offset */
+		     u16 * b,	/* data buffer */
+		     int n)
+{				/* number of registers */
+	b += n;			/* Position at the end of the area */
+
+	/* Write the address */
+	mmc_out(ioaddr, mmwoff(0, mmw_fee_addr), o + n - 1);
+
+	/* Loop on all buffer */
+	while (n-- > 0) {
+		/* Write the read command */
+		mmc_out(ioaddr, mmwoff(0, mmw_fee_ctrl),
+			MMW_FEE_CTRL_READ);
+
+		/* Wait until EEPROM is ready (should be quick). */
+		fee_wait(ioaddr, 10, 100);
+
+		/* Read the value. */
+		*--b = ((mmc_in(ioaddr, mmroff(0, mmr_fee_data_h)) << 8) |
+			mmc_in(ioaddr, mmroff(0, mmr_fee_data_l)));
+	}
+}
+
+#ifdef WIRELESS_EXT		/* if the wireless extension exists in the kernel */
+
+/*------------------------------------------------------------------*/
+/*
+ * Write bytes from the Frequency EEPROM (frequency select cards).
+ * This is a bit complicated, because the frequency EEPROM has to
+ * be unprotected and the write enabled.
+ * Jean II
+ */
+static void fee_write(unsigned long ioaddr,	/* I/O port of the card */
+		      u16 o,	/* destination offset */
+		      u16 * b,	/* data buffer */
+		      int n)
+{				/* number of registers */
+	b += n;			/* Position at the end of the area. */
+
+#ifdef EEPROM_IS_PROTECTED	/* disabled */
+#ifdef DOESNT_SEEM_TO_WORK	/* disabled */
+	/* Ask to read the protected register */
+	mmc_out(ioaddr, mmwoff(0, mmw_fee_ctrl), MMW_FEE_CTRL_PRREAD);
+
+	fee_wait(ioaddr, 10, 100);
+
+	/* Read the protected register. */
+	printk("Protected 2:  %02X-%02X\n",
+	       mmc_in(ioaddr, mmroff(0, mmr_fee_data_h)),
+	       mmc_in(ioaddr, mmroff(0, mmr_fee_data_l)));
+#endif				/* DOESNT_SEEM_TO_WORK */
+
+	/* Enable protected register. */
+	mmc_out(ioaddr, mmwoff(0, mmw_fee_addr), MMW_FEE_ADDR_EN);
+	mmc_out(ioaddr, mmwoff(0, mmw_fee_ctrl), MMW_FEE_CTRL_PREN);
+
+	fee_wait(ioaddr, 10, 100);
+
+	/* Unprotect area. */
+	mmc_out(ioaddr, mmwoff(0, mmw_fee_addr), o + n);
+	mmc_out(ioaddr, mmwoff(0, mmw_fee_ctrl), MMW_FEE_CTRL_PRWRITE);
+#ifdef DOESNT_SEEM_TO_WORK	/* disabled */
+	/* or use: */
+	mmc_out(ioaddr, mmwoff(0, mmw_fee_ctrl), MMW_FEE_CTRL_PRCLEAR);
+#endif				/* DOESNT_SEEM_TO_WORK */
+
+	fee_wait(ioaddr, 10, 100);
+#endif				/* EEPROM_IS_PROTECTED */
+
+	/* Write enable. */
+	mmc_out(ioaddr, mmwoff(0, mmw_fee_addr), MMW_FEE_ADDR_EN);
+	mmc_out(ioaddr, mmwoff(0, mmw_fee_ctrl), MMW_FEE_CTRL_WREN);
+
+	fee_wait(ioaddr, 10, 100);
+
+	/* Write the EEPROM address. */
+	mmc_out(ioaddr, mmwoff(0, mmw_fee_addr), o + n - 1);
+
+	/* Loop on all buffer */
+	while (n-- > 0) {
+		/* Write the value. */
+		mmc_out(ioaddr, mmwoff(0, mmw_fee_data_h), (*--b) >> 8);
+		mmc_out(ioaddr, mmwoff(0, mmw_fee_data_l), *b & 0xFF);
+
+		/* Write the write command. */
+		mmc_out(ioaddr, mmwoff(0, mmw_fee_ctrl),
+			MMW_FEE_CTRL_WRITE);
+
+		/* WaveLAN documentation says to wait at least 10 ms for EEBUSY = 0 */
+		mdelay(10);
+		fee_wait(ioaddr, 10, 100);
+	}
+
+	/* Write disable. */
+	mmc_out(ioaddr, mmwoff(0, mmw_fee_addr), MMW_FEE_ADDR_DS);
+	mmc_out(ioaddr, mmwoff(0, mmw_fee_ctrl), MMW_FEE_CTRL_WDS);
+
+	fee_wait(ioaddr, 10, 100);
+
+#ifdef EEPROM_IS_PROTECTED	/* disabled */
+	/* Reprotect EEPROM. */
+	mmc_out(ioaddr, mmwoff(0, mmw_fee_addr), 0x00);
+	mmc_out(ioaddr, mmwoff(0, mmw_fee_ctrl), MMW_FEE_CTRL_PRWRITE);
+
+	fee_wait(ioaddr, 10, 100);
+#endif				/* EEPROM_IS_PROTECTED */
+}
+#endif				/* WIRELESS_EXT */
+
+/************************ I82586 SUBROUTINES *************************/
+/*
+ * Useful subroutines to manage the Ethernet controller
+ */
+
+/*------------------------------------------------------------------*/
+/*
+ * Read bytes from the on-board RAM.
+ * Why does inlining this function make it fail?
+ */
+static /*inline */ void obram_read(unsigned long ioaddr,
+				   u16 o, u8 * b, int n)
+{
+	outw(o, PIOR1(ioaddr));
+	insw(PIOP1(ioaddr), (unsigned short *) b, (n + 1) >> 1);
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Write bytes to the on-board RAM.
+ */
+static inline void obram_write(unsigned long ioaddr, u16 o, u8 * b, int n)
+{
+	outw(o, PIOR1(ioaddr));
+	outsw(PIOP1(ioaddr), (unsigned short *) b, (n + 1) >> 1);
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Acknowledge the reading of the status issued by the i82586.
+ */
+static void wv_ack(struct net_device * dev)
+{
+	net_local *lp = (net_local *) dev->priv;
+	unsigned long ioaddr = dev->base_addr;
+	u16 scb_cs;
+	int i;
+
+	obram_read(ioaddr, scboff(OFFSET_SCB, scb_status),
+		   (unsigned char *) &scb_cs, sizeof(scb_cs));
+	scb_cs &= SCB_ST_INT;
+
+	if (scb_cs == 0)
+		return;
+
+	obram_write(ioaddr, scboff(OFFSET_SCB, scb_command),
+		    (unsigned char *) &scb_cs, sizeof(scb_cs));
+
+	set_chan_attn(ioaddr, lp->hacr);
+
+	for (i = 1000; i > 0; i--) {
+		obram_read(ioaddr, scboff(OFFSET_SCB, scb_command),
+			   (unsigned char *) &scb_cs, sizeof(scb_cs));
+		if (scb_cs == 0)
+			break;
+
+		udelay(10);
+	}
+	udelay(100);
+
+#ifdef DEBUG_CONFIG_ERROR
+	if (i <= 0)
+		printk(KERN_INFO
+		       "%s: wv_ack(): board not accepting command.\n",
+		       dev->name);
+#endif
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Set channel attention bit and busy wait until command has
+ * completed, then acknowledge completion of the command.
+ */
+static inline int wv_synchronous_cmd(struct net_device * dev, const char *str)
+{
+	net_local *lp = (net_local *) dev->priv;
+	unsigned long ioaddr = dev->base_addr;
+	u16 scb_cmd;
+	ach_t cb;
+	int i;
+
+	scb_cmd = SCB_CMD_CUC & SCB_CMD_CUC_GO;
+	obram_write(ioaddr, scboff(OFFSET_SCB, scb_command),
+		    (unsigned char *) &scb_cmd, sizeof(scb_cmd));
+
+	set_chan_attn(ioaddr, lp->hacr);
+
+	for (i = 1000; i > 0; i--) {
+		obram_read(ioaddr, OFFSET_CU, (unsigned char *) &cb,
+			   sizeof(cb));
+		if (cb.ac_status & AC_SFLD_C)
+			break;
+
+		udelay(10);
+	}
+	udelay(100);
+
+	if (i <= 0 || !(cb.ac_status & AC_SFLD_OK)) {
+#ifdef DEBUG_CONFIG_ERROR
+		printk(KERN_INFO "%s: %s failed; status = 0x%x\n",
+		       dev->name, str, cb.ac_status);
+#endif
+#ifdef DEBUG_I82586_SHOW
+		wv_scb_show(ioaddr);
+#endif
+		return -1;
+	}
+
+	/* Ack the status */
+	wv_ack(dev);
+
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Configuration commands completion interrupt.
+ * Check if done, and if OK.
+ */
+static inline int
+wv_config_complete(struct net_device * dev, unsigned long ioaddr, net_local * lp)
+{
+	unsigned short mcs_addr;
+	unsigned short status;
+	int ret;
+
+#ifdef DEBUG_INTERRUPT_TRACE
+	printk(KERN_DEBUG "%s: ->wv_config_complete()\n", dev->name);
+#endif
+
+	mcs_addr = lp->tx_first_in_use + sizeof(ac_tx_t) + sizeof(ac_nop_t)
+	    + sizeof(tbd_t) + sizeof(ac_cfg_t) + sizeof(ac_ias_t);
+
+	/* Read the status of the last command (set mc list). */
+	obram_read(ioaddr, acoff(mcs_addr, ac_status),
+		   (unsigned char *) &status, sizeof(status));
+
+	/* If not completed -> exit */
+	if ((status & AC_SFLD_C) == 0)
+		ret = 0;	/* Not ready to be scrapped */
+	else {
+#ifdef DEBUG_CONFIG_ERROR
+		unsigned short cfg_addr;
+		unsigned short ias_addr;
+
+		/* Check mc_config command */
+		if ((status & AC_SFLD_OK) != AC_SFLD_OK)
+			printk(KERN_INFO
+			       "%s: wv_config_complete(): set_multicast_address failed; status = 0x%x\n",
+			       dev->name, status);
+
+		/* check ia-config command */
+		ias_addr = mcs_addr - sizeof(ac_ias_t);
+		obram_read(ioaddr, acoff(ias_addr, ac_status),
+			   (unsigned char *) &status, sizeof(status));
+		if ((status & AC_SFLD_OK) != AC_SFLD_OK)
+			printk(KERN_INFO
+			       "%s: wv_config_complete(): set_MAC_address failed; status = 0x%x\n",
+			       dev->name, status);
+
+		/* Check config command. */
+		cfg_addr = ias_addr - sizeof(ac_cfg_t);
+		obram_read(ioaddr, acoff(cfg_addr, ac_status),
+			   (unsigned char *) &status, sizeof(status));
+		if ((status & AC_SFLD_OK) != AC_SFLD_OK)
+			printk(KERN_INFO
+			       "%s: wv_config_complete(): configure failed; status = 0x%x\n",
+			       dev->name, status);
+#endif	/* DEBUG_CONFIG_ERROR */
+
+		ret = 1;	/* Ready to be scrapped */
+	}
+
+#ifdef DEBUG_INTERRUPT_TRACE
+	printk(KERN_DEBUG "%s: <-wv_config_complete() - %d\n", dev->name,
+	       ret);
+#endif
+	return ret;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Command completion interrupt.
+ * Reclaim as many freed tx buffers as we can.
+ * (called in wavelan_interrupt()).
+ * Note : the spinlock is already grabbed for us.
+ */
+static int wv_complete(struct net_device * dev, unsigned long ioaddr, net_local * lp)
+{
+	int nreaped = 0;
+
+#ifdef DEBUG_INTERRUPT_TRACE
+	printk(KERN_DEBUG "%s: ->wv_complete()\n", dev->name);
+#endif
+
+	/* Loop on all the transmit buffers */
+	while (lp->tx_first_in_use != I82586NULL) {
+		unsigned short tx_status;
+
+		/* Read the first transmit buffer */
+		obram_read(ioaddr, acoff(lp->tx_first_in_use, ac_status),
+			   (unsigned char *) &tx_status,
+			   sizeof(tx_status));
+
+		/* If not completed -> exit */
+		if ((tx_status & AC_SFLD_C) == 0)
+			break;
+
+		/* Hack for reconfiguration */
+		if (tx_status == 0xFFFF)
+			if (!wv_config_complete(dev, ioaddr, lp))
+				break;	/* Not completed */
+
+		/* We now remove this buffer */
+		nreaped++;
+		--lp->tx_n_in_use;
+
+/*
+if (lp->tx_n_in_use > 0)
+	printk("%c", "0123456789abcdefghijk"[lp->tx_n_in_use]);
+*/
+
+		/* Was it the last one? */
+		if (lp->tx_n_in_use <= 0)
+			lp->tx_first_in_use = I82586NULL;
+		else {
+			/* Next one in the chain */
+			lp->tx_first_in_use += TXBLOCKZ;
+			if (lp->tx_first_in_use >=
+			    OFFSET_CU +
+			    NTXBLOCKS * TXBLOCKZ) lp->tx_first_in_use -=
+				    NTXBLOCKS * TXBLOCKZ;
+		}
+
+		/* Hack for reconfiguration */
+		if (tx_status == 0xFFFF)
+			continue;
+
+		/* Now, check status of the finished command */
+		if (tx_status & AC_SFLD_OK) {
+			int ncollisions;
+
+			lp->stats.tx_packets++;
+			ncollisions = tx_status & AC_SFLD_MAXCOL;
+			lp->stats.collisions += ncollisions;
+#ifdef DEBUG_TX_INFO
+			if (ncollisions > 0)
+				printk(KERN_DEBUG
+				       "%s: wv_complete(): tx completed after %d collisions.\n",
+				       dev->name, ncollisions);
+#endif
+		} else {
+			lp->stats.tx_errors++;
+			if (tx_status & AC_SFLD_S10) {
+				lp->stats.tx_carrier_errors++;
+#ifdef DEBUG_TX_FAIL
+				printk(KERN_DEBUG
+				       "%s: wv_complete(): tx error: no CS.\n",
+				       dev->name);
+#endif
+			}
+			if (tx_status & AC_SFLD_S9) {
+				lp->stats.tx_carrier_errors++;
+#ifdef DEBUG_TX_FAIL
+				printk(KERN_DEBUG
+				       "%s: wv_complete(): tx error: lost CTS.\n",
+				       dev->name);
+#endif
+			}
+			if (tx_status & AC_SFLD_S8) {
+				lp->stats.tx_fifo_errors++;
+#ifdef DEBUG_TX_FAIL
+				printk(KERN_DEBUG
+				       "%s: wv_complete(): tx error: slow DMA.\n",
+				       dev->name);
+#endif
+			}
+			if (tx_status & AC_SFLD_S6) {
+				lp->stats.tx_heartbeat_errors++;
+#ifdef DEBUG_TX_FAIL
+				printk(KERN_DEBUG
+				       "%s: wv_complete(): tx error: heart beat.\n",
+				       dev->name);
+#endif
+			}
+			if (tx_status & AC_SFLD_S5) {
+				lp->stats.tx_aborted_errors++;
+#ifdef DEBUG_TX_FAIL
+				printk(KERN_DEBUG
+				       "%s: wv_complete(): tx error: too many collisions.\n",
+				       dev->name);
+#endif
+			}
+		}
+
+#ifdef DEBUG_TX_INFO
+		printk(KERN_DEBUG
+		       "%s: wv_complete(): tx completed, tx_status 0x%04x\n",
+		       dev->name, tx_status);
+#endif
+	}
+
+#ifdef DEBUG_INTERRUPT_INFO
+	if (nreaped > 1)
+		printk(KERN_DEBUG "%s: wv_complete(): reaped %d\n",
+		       dev->name, nreaped);
+#endif
+
+	/*
+	 * Inform upper layers.
+	 */
+	if (lp->tx_n_in_use < NTXBLOCKS - 1) {
+		netif_wake_queue(dev);
+	}
+#ifdef DEBUG_INTERRUPT_TRACE
+	printk(KERN_DEBUG "%s: <-wv_complete()\n", dev->name);
+#endif
+	return nreaped;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Reconfigure the i82586, or at least ask for it.
+ * Because wv_82586_config uses a transmission buffer, we must do it
+ * when we are sure that there is one left, so we do it now
+ * or in wavelan_packet_xmit() (I can't find any better place,
+ * wavelan_interrupt is not an option), so you may experience
+ * delays sometimes.
+ */
+static inline void wv_82586_reconfig(struct net_device * dev)
+{
+	net_local *lp = (net_local *) dev->priv;
+	unsigned long flags;
+
+	/* Arm the flag, will be cleard in wv_82586_config() */
+	lp->reconfig_82586 = 1;
+
+	/* Check if we can do it now ! */
+	if((netif_running(dev)) && !(netif_queue_stopped(dev))) {
+		spin_lock_irqsave(&lp->spinlock, flags);
+		/* May fail */
+		wv_82586_config(dev);
+		spin_unlock_irqrestore(&lp->spinlock, flags);
+	}
+	else {
+#ifdef DEBUG_CONFIG_INFO
+		printk(KERN_DEBUG
+		       "%s: wv_82586_reconfig(): delayed (state = %lX)\n",
+			       dev->name, dev->state);
+#endif
+	}
+}
+
+/********************* DEBUG & INFO SUBROUTINES *********************/
+/*
+ * This routine is used in the code to show information for debugging.
+ * Most of the time, it dumps the contents of hardware structures.
+ */
+
+#ifdef DEBUG_PSA_SHOW
+/*------------------------------------------------------------------*/
+/*
+ * Print the formatted contents of the Parameter Storage Area.
+ */
+static void wv_psa_show(psa_t * p)
+{
+	printk(KERN_DEBUG "##### WaveLAN PSA contents: #####\n");
+	printk(KERN_DEBUG "psa_io_base_addr_1: 0x%02X %02X %02X %02X\n",
+	       p->psa_io_base_addr_1,
+	       p->psa_io_base_addr_2,
+	       p->psa_io_base_addr_3, p->psa_io_base_addr_4);
+	printk(KERN_DEBUG "psa_rem_boot_addr_1: 0x%02X %02X %02X\n",
+	       p->psa_rem_boot_addr_1,
+	       p->psa_rem_boot_addr_2, p->psa_rem_boot_addr_3);
+	printk(KERN_DEBUG "psa_holi_params: 0x%02x, ", p->psa_holi_params);
+	printk("psa_int_req_no: %d\n", p->psa_int_req_no);
+#ifdef DEBUG_SHOW_UNUSED
+	printk(KERN_DEBUG
+	       "psa_unused0[]: %02X:%02X:%02X:%02X:%02X:%02X:%02X\n",
+	       p->psa_unused0[0], p->psa_unused0[1], p->psa_unused0[2],
+	       p->psa_unused0[3], p->psa_unused0[4], p->psa_unused0[5],
+	       p->psa_unused0[6]);
+#endif				/* DEBUG_SHOW_UNUSED */
+	printk(KERN_DEBUG
+	       "psa_univ_mac_addr[]: %02x:%02x:%02x:%02x:%02x:%02x\n",
+	       p->psa_univ_mac_addr[0], p->psa_univ_mac_addr[1],
+	       p->psa_univ_mac_addr[2], p->psa_univ_mac_addr[3],
+	       p->psa_univ_mac_addr[4], p->psa_univ_mac_addr[5]);
+	printk(KERN_DEBUG
+	       "psa_local_mac_addr[]: %02x:%02x:%02x:%02x:%02x:%02x\n",
+	       p->psa_local_mac_addr[0], p->psa_local_mac_addr[1],
+	       p->psa_local_mac_addr[2], p->psa_local_mac_addr[3],
+	       p->psa_local_mac_addr[4], p->psa_local_mac_addr[5]);
+	printk(KERN_DEBUG "psa_univ_local_sel: %d, ",
+	       p->psa_univ_local_sel);
+	printk("psa_comp_number: %d, ", p->psa_comp_number);
+	printk("psa_thr_pre_set: 0x%02x\n", p->psa_thr_pre_set);
+	printk(KERN_DEBUG "psa_feature_select/decay_prm: 0x%02x, ",
+	       p->psa_feature_select);
+	printk("psa_subband/decay_update_prm: %d\n", p->psa_subband);
+	printk(KERN_DEBUG "psa_quality_thr: 0x%02x, ", p->psa_quality_thr);
+	printk("psa_mod_delay: 0x%02x\n", p->psa_mod_delay);
+	printk(KERN_DEBUG "psa_nwid: 0x%02x%02x, ", p->psa_nwid[0],
+	       p->psa_nwid[1]);
+	printk("psa_nwid_select: %d\n", p->psa_nwid_select);
+	printk(KERN_DEBUG "psa_encryption_select: %d, ",
+	       p->psa_encryption_select);
+	printk
+	    ("psa_encryption_key[]: %02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x\n",
+	     p->psa_encryption_key[0], p->psa_encryption_key[1],
+	     p->psa_encryption_key[2], p->psa_encryption_key[3],
+	     p->psa_encryption_key[4], p->psa_encryption_key[5],
+	     p->psa_encryption_key[6], p->psa_encryption_key[7]);
+	printk(KERN_DEBUG "psa_databus_width: %d\n", p->psa_databus_width);
+	printk(KERN_DEBUG "psa_call_code/auto_squelch: 0x%02x, ",
+	       p->psa_call_code[0]);
+	printk
+	    ("psa_call_code[]: %02X:%02X:%02X:%02X:%02X:%02X:%02X:%02X\n",
+	     p->psa_call_code[0], p->psa_call_code[1], p->psa_call_code[2],
+	     p->psa_call_code[3], p->psa_call_code[4], p->psa_call_code[5],
+	     p->psa_call_code[6], p->psa_call_code[7]);
+#ifdef DEBUG_SHOW_UNUSED
+	printk(KERN_DEBUG "psa_reserved[]: %02X:%02X:%02X:%02X\n",
+	       p->psa_reserved[0],
+	       p->psa_reserved[1], p->psa_reserved[2], p->psa_reserved[3]);
+#endif				/* DEBUG_SHOW_UNUSED */
+	printk(KERN_DEBUG "psa_conf_status: %d, ", p->psa_conf_status);
+	printk("psa_crc: 0x%02x%02x, ", p->psa_crc[0], p->psa_crc[1]);
+	printk("psa_crc_status: 0x%02x\n", p->psa_crc_status);
+}				/* wv_psa_show */
+#endif				/* DEBUG_PSA_SHOW */
+
+#ifdef DEBUG_MMC_SHOW
+/*------------------------------------------------------------------*/
+/*
+ * Print the formatted status of the Modem Management Controller.
+ * This function needs to be completed.
+ */
+static void wv_mmc_show(struct net_device * dev)
+{
+	unsigned long ioaddr = dev->base_addr;
+	net_local *lp = (net_local *) dev->priv;
+	mmr_t m;
+
+	/* Basic check */
+	if (hasr_read(ioaddr) & HASR_NO_CLK) {
+		printk(KERN_WARNING
+		       "%s: wv_mmc_show: modem not connected\n",
+		       dev->name);
+		return;
+	}
+
+	/* Read the mmc */
+	mmc_out(ioaddr, mmwoff(0, mmw_freeze), 1);
+	mmc_read(ioaddr, 0, (u8 *) & m, sizeof(m));
+	mmc_out(ioaddr, mmwoff(0, mmw_freeze), 0);
+
+#ifdef WIRELESS_EXT		/* if wireless extension exists in the kernel */
+	/* Don't forget to update statistics */
+	lp->wstats.discard.nwid +=
+	    (m.mmr_wrong_nwid_h << 8) | m.mmr_wrong_nwid_l;
+#endif				/* WIRELESS_EXT */
+
+	printk(KERN_DEBUG "##### WaveLAN modem status registers: #####\n");
+#ifdef DEBUG_SHOW_UNUSED
+	printk(KERN_DEBUG
+	       "mmc_unused0[]: %02X:%02X:%02X:%02X:%02X:%02X:%02X:%02X\n",
+	       m.mmr_unused0[0], m.mmr_unused0[1], m.mmr_unused0[2],
+	       m.mmr_unused0[3], m.mmr_unused0[4], m.mmr_unused0[5],
+	       m.mmr_unused0[6], m.mmr_unused0[7]);
+#endif				/* DEBUG_SHOW_UNUSED */
+	printk(KERN_DEBUG "Encryption algorithm: %02X - Status: %02X\n",
+	       m.mmr_des_avail, m.mmr_des_status);
+#ifdef DEBUG_SHOW_UNUSED
+	printk(KERN_DEBUG "mmc_unused1[]: %02X:%02X:%02X:%02X:%02X\n",
+	       m.mmr_unused1[0],
+	       m.mmr_unused1[1],
+	       m.mmr_unused1[2], m.mmr_unused1[3], m.mmr_unused1[4]);
+#endif				/* DEBUG_SHOW_UNUSED */
+	printk(KERN_DEBUG "dce_status: 0x%x [%s%s%s%s]\n",
+	       m.mmr_dce_status,
+	       (m.
+		mmr_dce_status & MMR_DCE_STATUS_RX_BUSY) ?
+	       "energy detected," : "",
+	       (m.
+		mmr_dce_status & MMR_DCE_STATUS_LOOPT_IND) ?
+	       "loop test indicated," : "",
+	       (m.
+		mmr_dce_status & MMR_DCE_STATUS_TX_BUSY) ?
+	       "transmitter on," : "",
+	       (m.
+		mmr_dce_status & MMR_DCE_STATUS_JBR_EXPIRED) ?
+	       "jabber timer expired," : "");
+	printk(KERN_DEBUG "Dsp ID: %02X\n", m.mmr_dsp_id);
+#ifdef DEBUG_SHOW_UNUSED
+	printk(KERN_DEBUG "mmc_unused2[]: %02X:%02X\n",
+	       m.mmr_unused2[0], m.mmr_unused2[1]);
+#endif				/* DEBUG_SHOW_UNUSED */
+	printk(KERN_DEBUG "# correct_nwid: %d, # wrong_nwid: %d\n",
+	       (m.mmr_correct_nwid_h << 8) | m.mmr_correct_nwid_l,
+	       (m.mmr_wrong_nwid_h << 8) | m.mmr_wrong_nwid_l);
+	printk(KERN_DEBUG "thr_pre_set: 0x%x [current signal %s]\n",
+	       m.mmr_thr_pre_set & MMR_THR_PRE_SET,
+	       (m.
+		mmr_thr_pre_set & MMR_THR_PRE_SET_CUR) ? "above" :
+	       "below");
+	printk(KERN_DEBUG "signal_lvl: %d [%s], ",
+	       m.mmr_signal_lvl & MMR_SIGNAL_LVL,
+	       (m.
+		mmr_signal_lvl & MMR_SIGNAL_LVL_VALID) ? "new msg" :
+	       "no new msg");
+	printk("silence_lvl: %d [%s], ",
+	       m.mmr_silence_lvl & MMR_SILENCE_LVL,
+	       (m.
+		mmr_silence_lvl & MMR_SILENCE_LVL_VALID) ? "update done" :
+	       "no new update");
+	printk("sgnl_qual: 0x%x [%s]\n", m.mmr_sgnl_qual & MMR_SGNL_QUAL,
+	       (m.
+		mmr_sgnl_qual & MMR_SGNL_QUAL_ANT) ? "Antenna 1" :
+	       "Antenna 0");
+#ifdef DEBUG_SHOW_UNUSED
+	printk(KERN_DEBUG "netw_id_l: %x\n", m.mmr_netw_id_l);
+#endif				/* DEBUG_SHOW_UNUSED */
+}				/* wv_mmc_show */
+#endif				/* DEBUG_MMC_SHOW */
+
+#ifdef DEBUG_I82586_SHOW
+/*------------------------------------------------------------------*/
+/*
+ * Print the last block of the i82586 memory.
+ */
+static void wv_scb_show(unsigned long ioaddr)
+{
+	scb_t scb;
+
+	obram_read(ioaddr, OFFSET_SCB, (unsigned char *) &scb,
+		   sizeof(scb));
+
+	printk(KERN_DEBUG "##### WaveLAN system control block: #####\n");
+
+	printk(KERN_DEBUG "status: ");
+	printk("stat 0x%x[%s%s%s%s] ",
+	       (scb.
+		scb_status & (SCB_ST_CX | SCB_ST_FR | SCB_ST_CNA |
+			      SCB_ST_RNR)) >> 12,
+	       (scb.
+		scb_status & SCB_ST_CX) ? "command completion interrupt," :
+	       "", (scb.scb_status & SCB_ST_FR) ? "frame received," : "",
+	       (scb.
+		scb_status & SCB_ST_CNA) ? "command unit not active," : "",
+	       (scb.
+		scb_status & SCB_ST_RNR) ? "receiving unit not ready," :
+	       "");
+	printk("cus 0x%x[%s%s%s] ", (scb.scb_status & SCB_ST_CUS) >> 8,
+	       ((scb.scb_status & SCB_ST_CUS) ==
+		SCB_ST_CUS_IDLE) ? "idle" : "",
+	       ((scb.scb_status & SCB_ST_CUS) ==
+		SCB_ST_CUS_SUSP) ? "suspended" : "",
+	       ((scb.scb_status & SCB_ST_CUS) ==
+		SCB_ST_CUS_ACTV) ? "active" : "");
+	printk("rus 0x%x[%s%s%s%s]\n", (scb.scb_status & SCB_ST_RUS) >> 4,
+	       ((scb.scb_status & SCB_ST_RUS) ==
+		SCB_ST_RUS_IDLE) ? "idle" : "",
+	       ((scb.scb_status & SCB_ST_RUS) ==
+		SCB_ST_RUS_SUSP) ? "suspended" : "",
+	       ((scb.scb_status & SCB_ST_RUS) ==
+		SCB_ST_RUS_NRES) ? "no resources" : "",
+	       ((scb.scb_status & SCB_ST_RUS) ==
+		SCB_ST_RUS_RDY) ? "ready" : "");
+
+	printk(KERN_DEBUG "command: ");
+	printk("ack 0x%x[%s%s%s%s] ",
+	       (scb.
+		scb_command & (SCB_CMD_ACK_CX | SCB_CMD_ACK_FR |
+			       SCB_CMD_ACK_CNA | SCB_CMD_ACK_RNR)) >> 12,
+	       (scb.
+		scb_command & SCB_CMD_ACK_CX) ? "ack cmd completion," : "",
+	       (scb.
+		scb_command & SCB_CMD_ACK_FR) ? "ack frame received," : "",
+	       (scb.
+		scb_command & SCB_CMD_ACK_CNA) ? "ack CU not active," : "",
+	       (scb.
+		scb_command & SCB_CMD_ACK_RNR) ? "ack RU not ready," : "");
+	printk("cuc 0x%x[%s%s%s%s%s] ",
+	       (scb.scb_command & SCB_CMD_CUC) >> 8,
+	       ((scb.scb_command & SCB_CMD_CUC) ==
+		SCB_CMD_CUC_NOP) ? "nop" : "",
+	       ((scb.scb_command & SCB_CMD_CUC) ==
+		SCB_CMD_CUC_GO) ? "start cbl_offset" : "",
+	       ((scb.scb_command & SCB_CMD_CUC) ==
+		SCB_CMD_CUC_RES) ? "resume execution" : "",
+	       ((scb.scb_command & SCB_CMD_CUC) ==
+		SCB_CMD_CUC_SUS) ? "suspend execution" : "",
+	       ((scb.scb_command & SCB_CMD_CUC) ==
+		SCB_CMD_CUC_ABT) ? "abort execution" : "");
+	printk("ruc 0x%x[%s%s%s%s%s]\n",
+	       (scb.scb_command & SCB_CMD_RUC) >> 4,
+	       ((scb.scb_command & SCB_CMD_RUC) ==
+		SCB_CMD_RUC_NOP) ? "nop" : "",
+	       ((scb.scb_command & SCB_CMD_RUC) ==
+		SCB_CMD_RUC_GO) ? "start rfa_offset" : "",
+	       ((scb.scb_command & SCB_CMD_RUC) ==
+		SCB_CMD_RUC_RES) ? "resume reception" : "",
+	       ((scb.scb_command & SCB_CMD_RUC) ==
+		SCB_CMD_RUC_SUS) ? "suspend reception" : "",
+	       ((scb.scb_command & SCB_CMD_RUC) ==
+		SCB_CMD_RUC_ABT) ? "abort reception" : "");
+
+	printk(KERN_DEBUG "cbl_offset 0x%x ", scb.scb_cbl_offset);
+	printk("rfa_offset 0x%x\n", scb.scb_rfa_offset);
+
+	printk(KERN_DEBUG "crcerrs %d ", scb.scb_crcerrs);
+	printk("alnerrs %d ", scb.scb_alnerrs);
+	printk("rscerrs %d ", scb.scb_rscerrs);
+	printk("ovrnerrs %d\n", scb.scb_ovrnerrs);
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Print the formatted status of the i82586's receive unit.
+ */
+static void wv_ru_show(struct net_device * dev)
+{
+	/* net_local *lp = (net_local *) dev->priv; */
+
+	printk(KERN_DEBUG
+	       "##### WaveLAN i82586 receiver unit status: #####\n");
+	printk(KERN_DEBUG "ru:");
+	/*
+	 * Not implemented yet
+	 */
+	printk("\n");
+}				/* wv_ru_show */
+
+/*------------------------------------------------------------------*/
+/*
+ * Display info about one control block of the i82586 memory.
+ */
+static void wv_cu_show_one(struct net_device * dev, net_local * lp, int i, u16 p)
+{
+	unsigned long ioaddr;
+	ac_tx_t actx;
+
+	ioaddr = dev->base_addr;
+
+	printk("%d: 0x%x:", i, p);
+
+	obram_read(ioaddr, p, (unsigned char *) &actx, sizeof(actx));
+	printk(" status=0x%x,", actx.tx_h.ac_status);
+	printk(" command=0x%x,", actx.tx_h.ac_command);
+
+	/*
+	   {
+	   tbd_t      tbd;
+
+	   obram_read(ioaddr, actx.tx_tbd_offset, (unsigned char *)&tbd, sizeof(tbd));
+	   printk(" tbd_status=0x%x,", tbd.tbd_status);
+	   }
+	 */
+
+	printk("|");
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Print status of the command unit of the i82586.
+ */
+static void wv_cu_show(struct net_device * dev)
+{
+	net_local *lp = (net_local *) dev->priv;
+	unsigned int i;
+	u16 p;
+
+	printk(KERN_DEBUG
+	       "##### WaveLAN i82586 command unit status: #####\n");
+
+	printk(KERN_DEBUG);
+	for (i = 0, p = lp->tx_first_in_use; i < NTXBLOCKS; i++) {
+		wv_cu_show_one(dev, lp, i, p);
+
+		p += TXBLOCKZ;
+		if (p >= OFFSET_CU + NTXBLOCKS * TXBLOCKZ)
+			p -= NTXBLOCKS * TXBLOCKZ;
+	}
+	printk("\n");
+}
+#endif				/* DEBUG_I82586_SHOW */
+
+#ifdef DEBUG_DEVICE_SHOW
+/*------------------------------------------------------------------*/
+/*
+ * Print the formatted status of the WaveLAN PCMCIA device driver.
+ */
+static void wv_dev_show(struct net_device * dev)
+{
+	printk(KERN_DEBUG "dev:");
+	printk(" state=%lX,", dev->state);
+	printk(" trans_start=%ld,", dev->trans_start);
+	printk(" flags=0x%x,", dev->flags);
+	printk("\n");
+}				/* wv_dev_show */
+
+/*------------------------------------------------------------------*/
+/*
+ * Print the formatted status of the WaveLAN PCMCIA device driver's
+ * private information.
+ */
+static void wv_local_show(struct net_device * dev)
+{
+	net_local *lp;
+
+	lp = (net_local *) dev->priv;
+
+	printk(KERN_DEBUG "local:");
+	printk(" tx_n_in_use=%d,", lp->tx_n_in_use);
+	printk(" hacr=0x%x,", lp->hacr);
+	printk(" rx_head=0x%x,", lp->rx_head);
+	printk(" rx_last=0x%x,", lp->rx_last);
+	printk(" tx_first_free=0x%x,", lp->tx_first_free);
+	printk(" tx_first_in_use=0x%x,", lp->tx_first_in_use);
+	printk("\n");
+}				/* wv_local_show */
+#endif				/* DEBUG_DEVICE_SHOW */
+
+#if defined(DEBUG_RX_INFO) || defined(DEBUG_TX_INFO)
+/*------------------------------------------------------------------*/
+/*
+ * Dump packet header (and content if necessary) on the screen
+ */
+static inline void wv_packet_info(u8 * p,	/* Packet to dump */
+				  int length,	/* Length of the packet */
+				  char *msg1,	/* Name of the device */
+				  char *msg2)
+{				/* Name of the function */
+	int i;
+	int maxi;
+
+	printk(KERN_DEBUG
+	       "%s: %s(): dest %02X:%02X:%02X:%02X:%02X:%02X, length %d\n",
+	       msg1, msg2, p[0], p[1], p[2], p[3], p[4], p[5], length);
+	printk(KERN_DEBUG
+	       "%s: %s(): src %02X:%02X:%02X:%02X:%02X:%02X, type 0x%02X%02X\n",
+	       msg1, msg2, p[6], p[7], p[8], p[9], p[10], p[11], p[12],
+	       p[13]);
+
+#ifdef DEBUG_PACKET_DUMP
+
+	printk(KERN_DEBUG "data=\"");
+
+	if ((maxi = length) > DEBUG_PACKET_DUMP)
+		maxi = DEBUG_PACKET_DUMP;
+	for (i = 14; i < maxi; i++)
+		if (p[i] >= ' ' && p[i] <= '~')
+			printk(" %c", p[i]);
+		else
+			printk("%02X", p[i]);
+	if (maxi < length)
+		printk("..");
+	printk("\"\n");
+	printk(KERN_DEBUG "\n");
+#endif				/* DEBUG_PACKET_DUMP */
+}
+#endif				/* defined(DEBUG_RX_INFO) || defined(DEBUG_TX_INFO) */
+
+/*------------------------------------------------------------------*/
+/*
+ * This is the information which is displayed by the driver at startup.
+ * There are lots of flags for configuring it to your liking.
+ */
+static inline void wv_init_info(struct net_device * dev)
+{
+	short ioaddr = dev->base_addr;
+	net_local *lp = (net_local *) dev->priv;
+	psa_t psa;
+	int i;
+
+	/* Read the parameter storage area */
+	psa_read(ioaddr, lp->hacr, 0, (unsigned char *) &psa, sizeof(psa));
+
+#ifdef DEBUG_PSA_SHOW
+	wv_psa_show(&psa);
+#endif
+#ifdef DEBUG_MMC_SHOW
+	wv_mmc_show(dev);
+#endif
+#ifdef DEBUG_I82586_SHOW
+	wv_cu_show(dev);
+#endif
+
+#ifdef DEBUG_BASIC_SHOW
+	/* Now, let's go for the basic stuff. */
+	printk(KERN_NOTICE "%s: WaveLAN at %#x,", dev->name, ioaddr);
+	for (i = 0; i < WAVELAN_ADDR_SIZE; i++)
+		printk("%s%02X", (i == 0) ? " " : ":", dev->dev_addr[i]);
+	printk(", IRQ %d", dev->irq);
+
+	/* Print current network ID. */
+	if (psa.psa_nwid_select)
+		printk(", nwid 0x%02X-%02X", psa.psa_nwid[0],
+		       psa.psa_nwid[1]);
+	else
+		printk(", nwid off");
+
+	/* If 2.00 card */
+	if (!(mmc_in(ioaddr, mmroff(0, mmr_fee_status)) &
+	      (MMR_FEE_STATUS_DWLD | MMR_FEE_STATUS_BUSY))) {
+		unsigned short freq;
+
+		/* Ask the EEPROM to read the frequency from the first area. */
+		fee_read(ioaddr, 0x00, &freq, 1);
+
+		/* Print frequency */
+		printk(", 2.00, %ld", (freq >> 6) + 2400L);
+
+		/* Hack! */
+		if (freq & 0x20)
+			printk(".5");
+	} else {
+		printk(", PC");
+		switch (psa.psa_comp_number) {
+		case PSA_COMP_PC_AT_915:
+		case PSA_COMP_PC_AT_2400:
+			printk("-AT");
+			break;
+		case PSA_COMP_PC_MC_915:
+		case PSA_COMP_PC_MC_2400:
+			printk("-MC");
+			break;
+		case PSA_COMP_PCMCIA_915:
+			printk("MCIA");
+			break;
+		default:
+			printk("?");
+		}
+		printk(", ");
+		switch (psa.psa_subband) {
+		case PSA_SUBBAND_915:
+			printk("915");
+			break;
+		case PSA_SUBBAND_2425:
+			printk("2425");
+			break;
+		case PSA_SUBBAND_2460:
+			printk("2460");
+			break;
+		case PSA_SUBBAND_2484:
+			printk("2484");
+			break;
+		case PSA_SUBBAND_2430_5:
+			printk("2430.5");
+			break;
+		default:
+			printk("?");
+		}
+	}
+
+	printk(" MHz\n");
+#endif				/* DEBUG_BASIC_SHOW */
+
+#ifdef DEBUG_VERSION_SHOW
+	/* Print version information */
+	printk(KERN_NOTICE "%s", version);
+#endif
+}				/* wv_init_info */
+
+/********************* IOCTL, STATS & RECONFIG *********************/
+/*
+ * We found here routines that are called by Linux on different
+ * occasions after the configuration and not for transmitting data
+ * These may be called when the user use ifconfig, /proc/net/dev
+ * or wireless extensions
+ */
+
+/*------------------------------------------------------------------*/
+/*
+ * Get the current Ethernet statistics. This may be called with the
+ * card open or closed.
+ * Used when the user read /proc/net/dev
+ */
+static en_stats *wavelan_get_stats(struct net_device * dev)
+{
+#ifdef DEBUG_IOCTL_TRACE
+	printk(KERN_DEBUG "%s: <>wavelan_get_stats()\n", dev->name);
+#endif
+
+	return (&((net_local *) dev->priv)->stats);
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Set or clear the multicast filter for this adaptor.
+ * num_addrs == -1	Promiscuous mode, receive all packets
+ * num_addrs == 0	Normal mode, clear multicast list
+ * num_addrs > 0	Multicast mode, receive normal and MC packets,
+ *			and do best-effort filtering.
+ */
+static void wavelan_set_multicast_list(struct net_device * dev)
+{
+	net_local *lp = (net_local *) dev->priv;
+
+#ifdef DEBUG_IOCTL_TRACE
+	printk(KERN_DEBUG "%s: ->wavelan_set_multicast_list()\n",
+	       dev->name);
+#endif
+
+#ifdef DEBUG_IOCTL_INFO
+	printk(KERN_DEBUG
+	       "%s: wavelan_set_multicast_list(): setting Rx mode %02X to %d addresses.\n",
+	       dev->name, dev->flags, dev->mc_count);
+#endif
+
+	/* Are we asking for promiscuous mode,
+	 * or all multicast addresses (we don't have that!)
+	 * or too many multicast addresses for the hardware filter? */
+	if ((dev->flags & IFF_PROMISC) ||
+	    (dev->flags & IFF_ALLMULTI) ||
+	    (dev->mc_count > I82586_MAX_MULTICAST_ADDRESSES)) {
+		/*
+		 * Enable promiscuous mode: receive all packets.
+		 */
+		if (!lp->promiscuous) {
+			lp->promiscuous = 1;
+			lp->mc_count = 0;
+
+			wv_82586_reconfig(dev);
+
+			/* Tell the kernel that we are doing a really bad job. */
+			dev->flags |= IFF_PROMISC;
+		}
+	} else
+		/* Are there multicast addresses to send? */
+	if (dev->mc_list != (struct dev_mc_list *) NULL) {
+		/*
+		 * Disable promiscuous mode, but receive all packets
+		 * in multicast list
+		 */
+#ifdef MULTICAST_AVOID
+		if (lp->promiscuous || (dev->mc_count != lp->mc_count))
+#endif
+		{
+			lp->promiscuous = 0;
+			lp->mc_count = dev->mc_count;
+
+			wv_82586_reconfig(dev);
+		}
+	} else {
+		/*
+		 * Switch to normal mode: disable promiscuous mode and 
+		 * clear the multicast list.
+		 */
+		if (lp->promiscuous || lp->mc_count == 0) {
+			lp->promiscuous = 0;
+			lp->mc_count = 0;
+
+			wv_82586_reconfig(dev);
+		}
+	}
+#ifdef DEBUG_IOCTL_TRACE
+	printk(KERN_DEBUG "%s: <-wavelan_set_multicast_list()\n",
+	       dev->name);
+#endif
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * This function doesn't exist.
+ * (Note : it was a nice way to test the reconfigure stuff...)
+ */
+#ifdef SET_MAC_ADDRESS
+static int wavelan_set_mac_address(struct net_device * dev, void *addr)
+{
+	struct sockaddr *mac = addr;
+
+	/* Copy the address. */
+	memcpy(dev->dev_addr, mac->sa_data, WAVELAN_ADDR_SIZE);
+
+	/* Reconfigure the beast. */
+	wv_82586_reconfig(dev);
+
+	return 0;
+}
+#endif				/* SET_MAC_ADDRESS */
+
+#ifdef WIRELESS_EXT		/* if wireless extensions exist in the kernel */
+
+/*------------------------------------------------------------------*/
+/*
+ * Frequency setting (for hardware capable of it)
+ * It's a bit complicated and you don't really want to look into it.
+ * (called in wavelan_ioctl)
+ */
+static inline int wv_set_frequency(unsigned long ioaddr,	/* I/O port of the card */
+				   iw_freq * frequency)
+{
+	const int BAND_NUM = 10;	/* Number of bands */
+	long freq = 0L;		/* offset to 2.4 GHz in .5 MHz */
+#ifdef DEBUG_IOCTL_INFO
+	int i;
+#endif
+
+	/* Setting by frequency */
+	/* Theoretically, you may set any frequency between
+	 * the two limits with a 0.5 MHz precision. In practice,
+	 * I don't want you to have trouble with local regulations.
+	 */
+	if ((frequency->e == 1) &&
+	    (frequency->m >= (int) 2.412e8)
+	    && (frequency->m <= (int) 2.487e8)) {
+		freq = ((frequency->m / 10000) - 24000L) / 5;
+	}
+
+	/* Setting by channel (same as wfreqsel) */
+	/* Warning: each channel is 22 MHz wide, so some of the channels
+	 * will interfere. */
+	if ((frequency->e == 0) && (frequency->m < BAND_NUM)) {
+		/* Get frequency offset. */
+		freq = channel_bands[frequency->m] >> 1;
+	}
+
+	/* Verify that the frequency is allowed. */
+	if (freq != 0L) {
+		u16 table[10];	/* Authorized frequency table */
+
+		/* Read the frequency table. */
+		fee_read(ioaddr, 0x71, table, 10);
+
+#ifdef DEBUG_IOCTL_INFO
+		printk(KERN_DEBUG "Frequency table: ");
+		for (i = 0; i < 10; i++) {
+			printk(" %04X", table[i]);
+		}
+		printk("\n");
+#endif
+
+		/* Look in the table to see whether the frequency is allowed. */
+		if (!(table[9 - ((freq - 24) / 16)] &
+		      (1 << ((freq - 24) % 16)))) return -EINVAL;	/* not allowed */
+	} else
+		return -EINVAL;
+
+	/* if we get a usable frequency */
+	if (freq != 0L) {
+		unsigned short area[16];
+		unsigned short dac[2];
+		unsigned short area_verify[16];
+		unsigned short dac_verify[2];
+		/* Corresponding gain (in the power adjust value table)
+		 * See AT&T WaveLAN Data Manual, REF 407-024689/E, page 3-8
+		 * and WCIN062D.DOC, page 6.2.9. */
+		unsigned short power_limit[] = { 40, 80, 120, 160, 0 };
+		int power_band = 0;	/* Selected band */
+		unsigned short power_adjust;	/* Correct value */
+
+		/* Search for the gain. */
+		power_band = 0;
+		while ((freq > power_limit[power_band]) &&
+		       (power_limit[++power_band] != 0));
+
+		/* Read the first area. */
+		fee_read(ioaddr, 0x00, area, 16);
+
+		/* Read the DAC. */
+		fee_read(ioaddr, 0x60, dac, 2);
+
+		/* Read the new power adjust value. */
+		fee_read(ioaddr, 0x6B - (power_band >> 1), &power_adjust,
+			 1);
+		if (power_band & 0x1)
+			power_adjust >>= 8;
+		else
+			power_adjust &= 0xFF;
+
+#ifdef DEBUG_IOCTL_INFO
+		printk(KERN_DEBUG "WaveLAN EEPROM Area 1: ");
+		for (i = 0; i < 16; i++) {
+			printk(" %04X", area[i]);
+		}
+		printk("\n");
+
+		printk(KERN_DEBUG "WaveLAN EEPROM DAC: %04X %04X\n",
+		       dac[0], dac[1]);
+#endif
+
+		/* Frequency offset (for info only) */
+		area[0] = ((freq << 5) & 0xFFE0) | (area[0] & 0x1F);
+
+		/* Receiver Principle main divider coefficient */
+		area[3] = (freq >> 1) + 2400L - 352L;
+		area[2] = ((freq & 0x1) << 4) | (area[2] & 0xFFEF);
+
+		/* Transmitter Main divider coefficient */
+		area[13] = (freq >> 1) + 2400L;
+		area[12] = ((freq & 0x1) << 4) | (area[2] & 0xFFEF);
+
+		/* Other parts of the area are flags, bit streams or unused. */
+
+		/* Set the value in the DAC. */
+		dac[1] = ((power_adjust >> 1) & 0x7F) | (dac[1] & 0xFF80);
+		dac[0] = ((power_adjust & 0x1) << 4) | (dac[0] & 0xFFEF);
+
+		/* Write the first area. */
+		fee_write(ioaddr, 0x00, area, 16);
+
+		/* Write the DAC. */
+		fee_write(ioaddr, 0x60, dac, 2);
+
+		/* We now should verify here that the writing of the EEPROM went OK. */
+
+		/* Reread the first area. */
+		fee_read(ioaddr, 0x00, area_verify, 16);
+
+		/* Reread the DAC. */
+		fee_read(ioaddr, 0x60, dac_verify, 2);
+
+		/* Compare. */
+		if (memcmp(area, area_verify, 16 * 2) ||
+		    memcmp(dac, dac_verify, 2 * 2)) {
+#ifdef DEBUG_IOCTL_ERROR
+			printk(KERN_INFO
+			       "WaveLAN: wv_set_frequency: unable to write new frequency to EEPROM(?).\n");
+#endif
+			return -EOPNOTSUPP;
+		}
+
+		/* We must download the frequency parameters to the
+		 * synthesizers (from the EEPROM - area 1)
+		 * Note: as the EEPROM is automatically decremented, we set the end
+		 * if the area... */
+		mmc_out(ioaddr, mmwoff(0, mmw_fee_addr), 0x0F);
+		mmc_out(ioaddr, mmwoff(0, mmw_fee_ctrl),
+			MMW_FEE_CTRL_READ | MMW_FEE_CTRL_DWLD);
+
+		/* Wait until the download is finished. */
+		fee_wait(ioaddr, 100, 100);
+
+		/* We must now download the power adjust value (gain) to
+		 * the synthesizers (from the EEPROM - area 7 - DAC). */
+		mmc_out(ioaddr, mmwoff(0, mmw_fee_addr), 0x61);
+		mmc_out(ioaddr, mmwoff(0, mmw_fee_ctrl),
+			MMW_FEE_CTRL_READ | MMW_FEE_CTRL_DWLD);
+
+		/* Wait for the download to finish. */
+		fee_wait(ioaddr, 100, 100);
+
+#ifdef DEBUG_IOCTL_INFO
+		/* Verification of what we have done */
+
+		printk(KERN_DEBUG "WaveLAN EEPROM Area 1: ");
+		for (i = 0; i < 16; i++) {
+			printk(" %04X", area_verify[i]);
+		}
+		printk("\n");
+
+		printk(KERN_DEBUG "WaveLAN EEPROM DAC:  %04X %04X\n",
+		       dac_verify[0], dac_verify[1]);
+#endif
+
+		return 0;
+	} else
+		return -EINVAL;	/* Bah, never get there... */
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Give the list of available frequencies.
+ */
+static inline int wv_frequency_list(unsigned long ioaddr,	/* I/O port of the card */
+				    iw_freq * list,	/* List of frequencies to fill */
+				    int max)
+{				/* Maximum number of frequencies */
+	u16 table[10];	/* Authorized frequency table */
+	long freq = 0L;		/* offset to 2.4 GHz in .5 MHz + 12 MHz */
+	int i;			/* index in the table */
+	int c = 0;		/* Channel number */
+
+	/* Read the frequency table. */
+	fee_read(ioaddr, 0x71 /* frequency table */ , table, 10);
+
+	/* Check all frequencies. */
+	i = 0;
+	for (freq = 0; freq < 150; freq++)
+		/* Look in the table if the frequency is allowed */
+		if (table[9 - (freq / 16)] & (1 << (freq % 16))) {
+			/* Compute approximate channel number */
+			while ((((channel_bands[c] >> 1) - 24) < freq) &&
+			       (c < NELS(channel_bands)))
+				c++;
+			list[i].i = c;	/* Set the list index */
+
+			/* put in the list */
+			list[i].m = (((freq + 24) * 5) + 24000L) * 10000;
+			list[i++].e = 1;
+
+			/* Check number. */
+			if (i >= max)
+				return (i);
+		}
+
+	return (i);
+}
+
+#ifdef IW_WIRELESS_SPY
+/*------------------------------------------------------------------*/
+/*
+ * Gather wireless spy statistics:  for each packet, compare the source
+ * address with our list, and if they match, get the statistics.
+ * Sorry, but this function really needs the wireless extensions.
+ */
+static inline void wl_spy_gather(struct net_device * dev,
+				 u8 *	mac,	/* MAC address */
+				 u8 *	stats)	/* Statistics to gather */
+{
+	struct iw_quality wstats;
+
+	wstats.qual = stats[2] & MMR_SGNL_QUAL;
+	wstats.level = stats[0] & MMR_SIGNAL_LVL;
+	wstats.noise = stats[1] & MMR_SILENCE_LVL;
+	wstats.updated = 0x7;
+
+	/* Update spy records */
+	wireless_spy_update(dev, mac, &wstats);
+}
+#endif /* IW_WIRELESS_SPY */
+
+#ifdef HISTOGRAM
+/*------------------------------------------------------------------*/
+/*
+ * This function calculates a histogram of the signal level.
+ * As the noise is quite constant, it's like doing it on the SNR.
+ * We have defined a set of interval (lp->his_range), and each time
+ * the level goes in that interval, we increment the count (lp->his_sum).
+ * With this histogram you may detect if one WaveLAN is really weak,
+ * or you may also calculate the mean and standard deviation of the level.
+ */
+static inline void wl_his_gather(struct net_device * dev, u8 * stats)
+{				/* Statistics to gather */
+	net_local *lp = (net_local *) dev->priv;
+	u8 level = stats[0] & MMR_SIGNAL_LVL;
+	int i;
+
+	/* Find the correct interval. */
+	i = 0;
+	while ((i < (lp->his_number - 1))
+	       && (level >= lp->his_range[i++]));
+
+	/* Increment interval counter. */
+	(lp->his_sum[i])++;
+}
+#endif /* HISTOGRAM */
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : get protocol name
+ */
+static int wavelan_get_name(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu,
+			    char *extra)
+{
+	strcpy(wrqu->name, "WaveLAN");
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : set NWID
+ */
+static int wavelan_set_nwid(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu,
+			    char *extra)
+{
+	unsigned long ioaddr = dev->base_addr;
+	net_local *lp = (net_local *) dev->priv;	/* lp is not unused */
+	psa_t psa;
+	mm_t m;
+	unsigned long flags;
+	int ret = 0;
+
+	/* Disable interrupts and save flags. */
+	spin_lock_irqsave(&lp->spinlock, flags);
+	
+	/* Set NWID in WaveLAN. */
+	if (!wrqu->nwid.disabled) {
+		/* Set NWID in psa */
+		psa.psa_nwid[0] = (wrqu->nwid.value & 0xFF00) >> 8;
+		psa.psa_nwid[1] = wrqu->nwid.value & 0xFF;
+		psa.psa_nwid_select = 0x01;
+		psa_write(ioaddr, lp->hacr,
+			  (char *) psa.psa_nwid - (char *) &psa,
+			  (unsigned char *) psa.psa_nwid, 3);
+
+		/* Set NWID in mmc. */
+		m.w.mmw_netw_id_l = psa.psa_nwid[1];
+		m.w.mmw_netw_id_h = psa.psa_nwid[0];
+		mmc_write(ioaddr,
+			  (char *) &m.w.mmw_netw_id_l -
+			  (char *) &m,
+			  (unsigned char *) &m.w.mmw_netw_id_l, 2);
+		mmc_out(ioaddr, mmwoff(0, mmw_loopt_sel), 0x00);
+	} else {
+		/* Disable NWID in the psa. */
+		psa.psa_nwid_select = 0x00;
+		psa_write(ioaddr, lp->hacr,
+			  (char *) &psa.psa_nwid_select -
+			  (char *) &psa,
+			  (unsigned char *) &psa.psa_nwid_select,
+			  1);
+
+		/* Disable NWID in the mmc (no filtering). */
+		mmc_out(ioaddr, mmwoff(0, mmw_loopt_sel),
+			MMW_LOOPT_SEL_DIS_NWID);
+	}
+	/* update the Wavelan checksum */
+	update_psa_checksum(dev, ioaddr, lp->hacr);
+
+	/* Enable interrupts and restore flags. */
+	spin_unlock_irqrestore(&lp->spinlock, flags);
+
+	return ret;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : get NWID 
+ */
+static int wavelan_get_nwid(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu,
+			    char *extra)
+{
+	unsigned long ioaddr = dev->base_addr;
+	net_local *lp = (net_local *) dev->priv;	/* lp is not unused */
+	psa_t psa;
+	unsigned long flags;
+	int ret = 0;
+
+	/* Disable interrupts and save flags. */
+	spin_lock_irqsave(&lp->spinlock, flags);
+	
+	/* Read the NWID. */
+	psa_read(ioaddr, lp->hacr,
+		 (char *) psa.psa_nwid - (char *) &psa,
+		 (unsigned char *) psa.psa_nwid, 3);
+	wrqu->nwid.value = (psa.psa_nwid[0] << 8) + psa.psa_nwid[1];
+	wrqu->nwid.disabled = !(psa.psa_nwid_select);
+	wrqu->nwid.fixed = 1;	/* Superfluous */
+
+	/* Enable interrupts and restore flags. */
+	spin_unlock_irqrestore(&lp->spinlock, flags);
+
+	return ret;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : set frequency
+ */
+static int wavelan_set_freq(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu,
+			    char *extra)
+{
+	unsigned long ioaddr = dev->base_addr;
+	net_local *lp = (net_local *) dev->priv;	/* lp is not unused */
+	unsigned long flags;
+	int ret;
+
+	/* Disable interrupts and save flags. */
+	spin_lock_irqsave(&lp->spinlock, flags);
+	
+	/* Attempt to recognise 2.00 cards (2.4 GHz frequency selectable). */
+	if (!(mmc_in(ioaddr, mmroff(0, mmr_fee_status)) &
+	      (MMR_FEE_STATUS_DWLD | MMR_FEE_STATUS_BUSY)))
+		ret = wv_set_frequency(ioaddr, &(wrqu->freq));
+	else
+		ret = -EOPNOTSUPP;
+
+	/* Enable interrupts and restore flags. */
+	spin_unlock_irqrestore(&lp->spinlock, flags);
+
+	return ret;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : get frequency
+ */
+static int wavelan_get_freq(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu,
+			    char *extra)
+{
+	unsigned long ioaddr = dev->base_addr;
+	net_local *lp = (net_local *) dev->priv;	/* lp is not unused */
+	psa_t psa;
+	unsigned long flags;
+	int ret = 0;
+
+	/* Disable interrupts and save flags. */
+	spin_lock_irqsave(&lp->spinlock, flags);
+	
+	/* Attempt to recognise 2.00 cards (2.4 GHz frequency selectable).
+	 * Does it work for everybody, especially old cards? */
+	if (!(mmc_in(ioaddr, mmroff(0, mmr_fee_status)) &
+	      (MMR_FEE_STATUS_DWLD | MMR_FEE_STATUS_BUSY))) {
+		unsigned short freq;
+
+		/* Ask the EEPROM to read the frequency from the first area. */
+		fee_read(ioaddr, 0x00, &freq, 1);
+		wrqu->freq.m = ((freq >> 5) * 5 + 24000L) * 10000;
+		wrqu->freq.e = 1;
+	} else {
+		psa_read(ioaddr, lp->hacr,
+			 (char *) &psa.psa_subband - (char *) &psa,
+			 (unsigned char *) &psa.psa_subband, 1);
+
+		if (psa.psa_subband <= 4) {
+			wrqu->freq.m = fixed_bands[psa.psa_subband];
+			wrqu->freq.e = (psa.psa_subband != 0);
+		} else
+			ret = -EOPNOTSUPP;
+	}
+
+	/* Enable interrupts and restore flags. */
+	spin_unlock_irqrestore(&lp->spinlock, flags);
+
+	return ret;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : set level threshold
+ */
+static int wavelan_set_sens(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu,
+			    char *extra)
+{
+	unsigned long ioaddr = dev->base_addr;
+	net_local *lp = (net_local *) dev->priv;	/* lp is not unused */
+	psa_t psa;
+	unsigned long flags;
+	int ret = 0;
+
+	/* Disable interrupts and save flags. */
+	spin_lock_irqsave(&lp->spinlock, flags);
+	
+	/* Set the level threshold. */
+	/* We should complain loudly if wrqu->sens.fixed = 0, because we
+	 * can't set auto mode... */
+	psa.psa_thr_pre_set = wrqu->sens.value & 0x3F;
+	psa_write(ioaddr, lp->hacr,
+		  (char *) &psa.psa_thr_pre_set - (char *) &psa,
+		  (unsigned char *) &psa.psa_thr_pre_set, 1);
+	/* update the Wavelan checksum */
+	update_psa_checksum(dev, ioaddr, lp->hacr);
+	mmc_out(ioaddr, mmwoff(0, mmw_thr_pre_set),
+		psa.psa_thr_pre_set);
+
+	/* Enable interrupts and restore flags. */
+	spin_unlock_irqrestore(&lp->spinlock, flags);
+
+	return ret;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : get level threshold
+ */
+static int wavelan_get_sens(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu,
+			    char *extra)
+{
+	unsigned long ioaddr = dev->base_addr;
+	net_local *lp = (net_local *) dev->priv;	/* lp is not unused */
+	psa_t psa;
+	unsigned long flags;
+	int ret = 0;
+
+	/* Disable interrupts and save flags. */
+	spin_lock_irqsave(&lp->spinlock, flags);
+	
+	/* Read the level threshold. */
+	psa_read(ioaddr, lp->hacr,
+		 (char *) &psa.psa_thr_pre_set - (char *) &psa,
+		 (unsigned char *) &psa.psa_thr_pre_set, 1);
+	wrqu->sens.value = psa.psa_thr_pre_set & 0x3F;
+	wrqu->sens.fixed = 1;
+
+	/* Enable interrupts and restore flags. */
+	spin_unlock_irqrestore(&lp->spinlock, flags);
+
+	return ret;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : set encryption key
+ */
+static int wavelan_set_encode(struct net_device *dev,
+			      struct iw_request_info *info,
+			      union iwreq_data *wrqu,
+			      char *extra)
+{
+	unsigned long ioaddr = dev->base_addr;
+	net_local *lp = (net_local *) dev->priv;	/* lp is not unused */
+	unsigned long flags;
+	psa_t psa;
+	int ret = 0;
+
+	/* Disable interrupts and save flags. */
+	spin_lock_irqsave(&lp->spinlock, flags);
+
+	/* Check if capable of encryption */
+	if (!mmc_encr(ioaddr)) {
+		ret = -EOPNOTSUPP;
+	}
+
+	/* Check the size of the key */
+	if((wrqu->encoding.length != 8) && (wrqu->encoding.length != 0)) {
+		ret = -EINVAL;
+	}
+
+	if(!ret) {
+		/* Basic checking... */
+		if (wrqu->encoding.length == 8) {
+			/* Copy the key in the driver */
+			memcpy(psa.psa_encryption_key, extra,
+			       wrqu->encoding.length);
+			psa.psa_encryption_select = 1;
+
+			psa_write(ioaddr, lp->hacr,
+				  (char *) &psa.psa_encryption_select -
+				  (char *) &psa,
+				  (unsigned char *) &psa.
+				  psa_encryption_select, 8 + 1);
+
+			mmc_out(ioaddr, mmwoff(0, mmw_encr_enable),
+				MMW_ENCR_ENABLE_EN | MMW_ENCR_ENABLE_MODE);
+			mmc_write(ioaddr, mmwoff(0, mmw_encr_key),
+				  (unsigned char *) &psa.
+				  psa_encryption_key, 8);
+		}
+
+		/* disable encryption */
+		if (wrqu->encoding.flags & IW_ENCODE_DISABLED) {
+			psa.psa_encryption_select = 0;
+			psa_write(ioaddr, lp->hacr,
+				  (char *) &psa.psa_encryption_select -
+				  (char *) &psa,
+				  (unsigned char *) &psa.
+				  psa_encryption_select, 1);
+
+			mmc_out(ioaddr, mmwoff(0, mmw_encr_enable), 0);
+		}
+		/* update the Wavelan checksum */
+		update_psa_checksum(dev, ioaddr, lp->hacr);
+	}
+
+	/* Enable interrupts and restore flags. */
+	spin_unlock_irqrestore(&lp->spinlock, flags);
+
+	return ret;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : get encryption key
+ */
+static int wavelan_get_encode(struct net_device *dev,
+			      struct iw_request_info *info,
+			      union iwreq_data *wrqu,
+			      char *extra)
+{
+	unsigned long ioaddr = dev->base_addr;
+	net_local *lp = (net_local *) dev->priv;	/* lp is not unused */
+	psa_t psa;
+	unsigned long flags;
+	int ret = 0;
+
+	/* Disable interrupts and save flags. */
+	spin_lock_irqsave(&lp->spinlock, flags);
+	
+	/* Check if encryption is available */
+	if (!mmc_encr(ioaddr)) {
+		ret = -EOPNOTSUPP;
+	} else {
+		/* Read the encryption key */
+		psa_read(ioaddr, lp->hacr,
+			 (char *) &psa.psa_encryption_select -
+			 (char *) &psa,
+			 (unsigned char *) &psa.
+			 psa_encryption_select, 1 + 8);
+
+		/* encryption is enabled ? */
+		if (psa.psa_encryption_select)
+			wrqu->encoding.flags = IW_ENCODE_ENABLED;
+		else
+			wrqu->encoding.flags = IW_ENCODE_DISABLED;
+		wrqu->encoding.flags |= mmc_encr(ioaddr);
+
+		/* Copy the key to the user buffer */
+		wrqu->encoding.length = 8;
+		memcpy(extra, psa.psa_encryption_key, wrqu->encoding.length);
+	}
+
+	/* Enable interrupts and restore flags. */
+	spin_unlock_irqrestore(&lp->spinlock, flags);
+
+	return ret;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : get range info
+ */
+static int wavelan_get_range(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu,
+			     char *extra)
+{
+	unsigned long ioaddr = dev->base_addr;
+	net_local *lp = (net_local *) dev->priv;	/* lp is not unused */
+	struct iw_range *range = (struct iw_range *) extra;
+	unsigned long flags;
+	int ret = 0;
+
+	/* Set the length (very important for backward compatibility) */
+	wrqu->data.length = sizeof(struct iw_range);
+
+	/* Set all the info we don't care or don't know about to zero */
+	memset(range, 0, sizeof(struct iw_range));
+
+	/* Set the Wireless Extension versions */
+	range->we_version_compiled = WIRELESS_EXT;
+	range->we_version_source = 9;
+
+	/* Set information in the range struct.  */
+	range->throughput = 1.6 * 1000 * 1000;	/* don't argue on this ! */
+	range->min_nwid = 0x0000;
+	range->max_nwid = 0xFFFF;
+
+	range->sensitivity = 0x3F;
+	range->max_qual.qual = MMR_SGNL_QUAL;
+	range->max_qual.level = MMR_SIGNAL_LVL;
+	range->max_qual.noise = MMR_SILENCE_LVL;
+	range->avg_qual.qual = MMR_SGNL_QUAL; /* Always max */
+	/* Need to get better values for those two */
+	range->avg_qual.level = 30;
+	range->avg_qual.noise = 8;
+
+	range->num_bitrates = 1;
+	range->bitrate[0] = 2000000;	/* 2 Mb/s */
+
+	/* Event capability (kernel + driver) */
+	range->event_capa[0] = (IW_EVENT_CAPA_MASK(0x8B02) |
+				IW_EVENT_CAPA_MASK(0x8B04));
+	range->event_capa[1] = IW_EVENT_CAPA_K_1;
+
+	/* Disable interrupts and save flags. */
+	spin_lock_irqsave(&lp->spinlock, flags);
+	
+	/* Attempt to recognise 2.00 cards (2.4 GHz frequency selectable). */
+	if (!(mmc_in(ioaddr, mmroff(0, mmr_fee_status)) &
+	      (MMR_FEE_STATUS_DWLD | MMR_FEE_STATUS_BUSY))) {
+		range->num_channels = 10;
+		range->num_frequency = wv_frequency_list(ioaddr, range->freq,
+							IW_MAX_FREQUENCIES);
+	} else
+		range->num_channels = range->num_frequency = 0;
+
+	/* Encryption supported ? */
+	if (mmc_encr(ioaddr)) {
+		range->encoding_size[0] = 8;	/* DES = 64 bits key */
+		range->num_encoding_sizes = 1;
+		range->max_encoding_tokens = 1;	/* Only one key possible */
+	} else {
+		range->num_encoding_sizes = 0;
+		range->max_encoding_tokens = 0;
+	}
+
+	/* Enable interrupts and restore flags. */
+	spin_unlock_irqrestore(&lp->spinlock, flags);
+
+	return ret;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Private Handler : set quality threshold
+ */
+static int wavelan_set_qthr(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu,
+			    char *extra)
+{
+	unsigned long ioaddr = dev->base_addr;
+	net_local *lp = (net_local *) dev->priv;	/* lp is not unused */
+	psa_t psa;
+	unsigned long flags;
+
+	/* Disable interrupts and save flags. */
+	spin_lock_irqsave(&lp->spinlock, flags);
+	
+	psa.psa_quality_thr = *(extra) & 0x0F;
+	psa_write(ioaddr, lp->hacr,
+		  (char *) &psa.psa_quality_thr - (char *) &psa,
+		  (unsigned char *) &psa.psa_quality_thr, 1);
+	/* update the Wavelan checksum */
+	update_psa_checksum(dev, ioaddr, lp->hacr);
+	mmc_out(ioaddr, mmwoff(0, mmw_quality_thr),
+		psa.psa_quality_thr);
+
+	/* Enable interrupts and restore flags. */
+	spin_unlock_irqrestore(&lp->spinlock, flags);
+
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Private Handler : get quality threshold
+ */
+static int wavelan_get_qthr(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu,
+			    char *extra)
+{
+	unsigned long ioaddr = dev->base_addr;
+	net_local *lp = (net_local *) dev->priv;	/* lp is not unused */
+	psa_t psa;
+	unsigned long flags;
+
+	/* Disable interrupts and save flags. */
+	spin_lock_irqsave(&lp->spinlock, flags);
+	
+	psa_read(ioaddr, lp->hacr,
+		 (char *) &psa.psa_quality_thr - (char *) &psa,
+		 (unsigned char *) &psa.psa_quality_thr, 1);
+	*(extra) = psa.psa_quality_thr & 0x0F;
+
+	/* Enable interrupts and restore flags. */
+	spin_unlock_irqrestore(&lp->spinlock, flags);
+
+	return 0;
+}
+
+#ifdef HISTOGRAM
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Private Handler : set histogram
+ */
+static int wavelan_set_histo(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu,
+			     char *extra)
+{
+	net_local *lp = (net_local *) dev->priv;	/* lp is not unused */
+
+	/* Check the number of intervals. */
+	if (wrqu->data.length > 16) {
+		return(-E2BIG);
+	}
+
+	/* Disable histo while we copy the addresses.
+	 * As we don't disable interrupts, we need to do this */
+	lp->his_number = 0;
+
+	/* Are there ranges to copy? */
+	if (wrqu->data.length > 0) {
+		/* Copy interval ranges to the driver */
+		memcpy(lp->his_range, extra, wrqu->data.length);
+
+		{
+		  int i;
+		  printk(KERN_DEBUG "Histo :");
+		  for(i = 0; i < wrqu->data.length; i++)
+		    printk(" %d", lp->his_range[i]);
+		  printk("\n");
+		}
+
+		/* Reset result structure. */
+		memset(lp->his_sum, 0x00, sizeof(long) * 16);
+	}
+
+	/* Now we can set the number of ranges */
+	lp->his_number = wrqu->data.length;
+
+	return(0);
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Private Handler : get histogram
+ */
+static int wavelan_get_histo(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu,
+			     char *extra)
+{
+	net_local *lp = (net_local *) dev->priv;	/* lp is not unused */
+
+	/* Set the number of intervals. */
+	wrqu->data.length = lp->his_number;
+
+	/* Give back the distribution statistics */
+	if(lp->his_number > 0)
+		memcpy(extra, lp->his_sum, sizeof(long) * lp->his_number);
+
+	return(0);
+}
+#endif			/* HISTOGRAM */
+
+/*------------------------------------------------------------------*/
+/*
+ * Structures to export the Wireless Handlers
+ */
+
+static const iw_handler		wavelan_handler[] =
+{
+	NULL,				/* SIOCSIWNAME */
+	wavelan_get_name,		/* SIOCGIWNAME */
+	wavelan_set_nwid,		/* SIOCSIWNWID */
+	wavelan_get_nwid,		/* SIOCGIWNWID */
+	wavelan_set_freq,		/* SIOCSIWFREQ */
+	wavelan_get_freq,		/* SIOCGIWFREQ */
+	NULL,				/* SIOCSIWMODE */
+	NULL,				/* SIOCGIWMODE */
+	wavelan_set_sens,		/* SIOCSIWSENS */
+	wavelan_get_sens,		/* SIOCGIWSENS */
+	NULL,				/* SIOCSIWRANGE */
+	wavelan_get_range,		/* SIOCGIWRANGE */
+	NULL,				/* SIOCSIWPRIV */
+	NULL,				/* SIOCGIWPRIV */
+	NULL,				/* SIOCSIWSTATS */
+	NULL,				/* SIOCGIWSTATS */
+	iw_handler_set_spy,		/* SIOCSIWSPY */
+	iw_handler_get_spy,		/* SIOCGIWSPY */
+	iw_handler_set_thrspy,		/* SIOCSIWTHRSPY */
+	iw_handler_get_thrspy,		/* SIOCGIWTHRSPY */
+	NULL,				/* SIOCSIWAP */
+	NULL,				/* SIOCGIWAP */
+	NULL,				/* -- hole -- */
+	NULL,				/* SIOCGIWAPLIST */
+	NULL,				/* -- hole -- */
+	NULL,				/* -- hole -- */
+	NULL,				/* SIOCSIWESSID */
+	NULL,				/* SIOCGIWESSID */
+	NULL,				/* SIOCSIWNICKN */
+	NULL,				/* SIOCGIWNICKN */
+	NULL,				/* -- hole -- */
+	NULL,				/* -- hole -- */
+	NULL,				/* SIOCSIWRATE */
+	NULL,				/* SIOCGIWRATE */
+	NULL,				/* SIOCSIWRTS */
+	NULL,				/* SIOCGIWRTS */
+	NULL,				/* SIOCSIWFRAG */
+	NULL,				/* SIOCGIWFRAG */
+	NULL,				/* SIOCSIWTXPOW */
+	NULL,				/* SIOCGIWTXPOW */
+	NULL,				/* SIOCSIWRETRY */
+	NULL,				/* SIOCGIWRETRY */
+	/* Bummer ! Why those are only at the end ??? */
+	wavelan_set_encode,		/* SIOCSIWENCODE */
+	wavelan_get_encode,		/* SIOCGIWENCODE */
+};
+
+static const iw_handler		wavelan_private_handler[] =
+{
+	wavelan_set_qthr,		/* SIOCIWFIRSTPRIV */
+	wavelan_get_qthr,		/* SIOCIWFIRSTPRIV + 1 */
+#ifdef HISTOGRAM
+	wavelan_set_histo,		/* SIOCIWFIRSTPRIV + 2 */
+	wavelan_get_histo,		/* SIOCIWFIRSTPRIV + 3 */
+#endif	/* HISTOGRAM */
+};
+
+static const struct iw_priv_args wavelan_private_args[] = {
+/*{ cmd,         set_args,                            get_args, name } */
+  { SIOCSIPQTHR, IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 1, 0, "setqualthr" },
+  { SIOCGIPQTHR, 0, IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 1, "getqualthr" },
+  { SIOCSIPHISTO, IW_PRIV_TYPE_BYTE | 16,                    0, "sethisto" },
+  { SIOCGIPHISTO, 0,                     IW_PRIV_TYPE_INT | 16, "gethisto" },
+};
+
+static const struct iw_handler_def	wavelan_handler_def =
+{
+	.num_standard	= sizeof(wavelan_handler)/sizeof(iw_handler),
+	.num_private	= sizeof(wavelan_private_handler)/sizeof(iw_handler),
+	.num_private_args = sizeof(wavelan_private_args)/sizeof(struct iw_priv_args),
+	.standard	= wavelan_handler,
+	.private	= wavelan_private_handler,
+	.private_args	= wavelan_private_args,
+	.get_wireless_stats = wavelan_get_wireless_stats,
+};
+
+/*------------------------------------------------------------------*/
+/*
+ * Get wireless statistics.
+ * Called by /proc/net/wireless
+ */
+static iw_stats *wavelan_get_wireless_stats(struct net_device * dev)
+{
+	unsigned long ioaddr = dev->base_addr;
+	net_local *lp = (net_local *) dev->priv;
+	mmr_t m;
+	iw_stats *wstats;
+	unsigned long flags;
+
+#ifdef DEBUG_IOCTL_TRACE
+	printk(KERN_DEBUG "%s: ->wavelan_get_wireless_stats()\n",
+	       dev->name);
+#endif
+
+	/* Check */
+	if (lp == (net_local *) NULL)
+		return (iw_stats *) NULL;
+	
+	/* Disable interrupts and save flags. */
+	spin_lock_irqsave(&lp->spinlock, flags);
+	
+	wstats = &lp->wstats;
+
+	/* Get data from the mmc. */
+	mmc_out(ioaddr, mmwoff(0, mmw_freeze), 1);
+
+	mmc_read(ioaddr, mmroff(0, mmr_dce_status), &m.mmr_dce_status, 1);
+	mmc_read(ioaddr, mmroff(0, mmr_wrong_nwid_l), &m.mmr_wrong_nwid_l,
+		 2);
+	mmc_read(ioaddr, mmroff(0, mmr_thr_pre_set), &m.mmr_thr_pre_set,
+		 4);
+
+	mmc_out(ioaddr, mmwoff(0, mmw_freeze), 0);
+
+	/* Copy data to wireless stuff. */
+	wstats->status = m.mmr_dce_status & MMR_DCE_STATUS;
+	wstats->qual.qual = m.mmr_sgnl_qual & MMR_SGNL_QUAL;
+	wstats->qual.level = m.mmr_signal_lvl & MMR_SIGNAL_LVL;
+	wstats->qual.noise = m.mmr_silence_lvl & MMR_SILENCE_LVL;
+	wstats->qual.updated = (((m. mmr_signal_lvl & MMR_SIGNAL_LVL_VALID) >> 7) 
+			| ((m.mmr_signal_lvl & MMR_SIGNAL_LVL_VALID) >> 6) 
+			| ((m.mmr_silence_lvl & MMR_SILENCE_LVL_VALID) >> 5));
+	wstats->discard.nwid += (m.mmr_wrong_nwid_h << 8) | m.mmr_wrong_nwid_l;
+	wstats->discard.code = 0L;
+	wstats->discard.misc = 0L;
+
+	/* Enable interrupts and restore flags. */
+	spin_unlock_irqrestore(&lp->spinlock, flags);
+
+#ifdef DEBUG_IOCTL_TRACE
+	printk(KERN_DEBUG "%s: <-wavelan_get_wireless_stats()\n",
+	       dev->name);
+#endif
+	return &lp->wstats;
+}
+#endif				/* WIRELESS_EXT */
+
+/************************* PACKET RECEPTION *************************/
+/*
+ * This part deals with receiving the packets.
+ * The interrupt handler gets an interrupt when a packet has been
+ * successfully received and calls this part.
+ */
+
+/*------------------------------------------------------------------*/
+/*
+ * This routine does the actual copying of data (including the Ethernet
+ * header structure) from the WaveLAN card to an sk_buff chain that
+ * will be passed up to the network interface layer. NOTE: we
+ * currently don't handle trailer protocols (neither does the rest of
+ * the network interface), so if that is needed, it will (at least in
+ * part) be added here.  The contents of the receive ring buffer are
+ * copied to a message chain that is then passed to the kernel.
+ *
+ * Note: if any errors occur, the packet is "dropped on the floor".
+ * (called by wv_packet_rcv())
+ */
+static inline void
+wv_packet_read(struct net_device * dev, u16 buf_off, int sksize)
+{
+	net_local *lp = (net_local *) dev->priv;
+	unsigned long ioaddr = dev->base_addr;
+	struct sk_buff *skb;
+
+#ifdef DEBUG_RX_TRACE
+	printk(KERN_DEBUG "%s: ->wv_packet_read(0x%X, %d)\n",
+	       dev->name, buf_off, sksize);
+#endif
+
+	/* Allocate buffer for the data */
+	if ((skb = dev_alloc_skb(sksize)) == (struct sk_buff *) NULL) {
+#ifdef DEBUG_RX_ERROR
+		printk(KERN_INFO
+		       "%s: wv_packet_read(): could not alloc_skb(%d, GFP_ATOMIC).\n",
+		       dev->name, sksize);
+#endif
+		lp->stats.rx_dropped++;
+		return;
+	}
+
+	skb->dev = dev;
+
+	/* Copy the packet to the buffer. */
+	obram_read(ioaddr, buf_off, skb_put(skb, sksize), sksize);
+	skb->protocol = eth_type_trans(skb, dev);
+
+#ifdef DEBUG_RX_INFO
+	wv_packet_info(skb->mac.raw, sksize, dev->name, "wv_packet_read");
+#endif				/* DEBUG_RX_INFO */
+
+	/* Statistics-gathering and associated stuff.
+	 * It seem a bit messy with all the define, but it's really
+	 * simple... */
+	if (
+#ifdef IW_WIRELESS_SPY		/* defined in iw_handler.h */
+		   (lp->spy_data.spy_number > 0) ||
+#endif /* IW_WIRELESS_SPY */
+#ifdef HISTOGRAM
+		   (lp->his_number > 0) ||
+#endif /* HISTOGRAM */
+		   0) {
+		u8 stats[3];	/* signal level, noise level, signal quality */
+
+		/* Read signal level, silence level and signal quality bytes */
+		/* Note: in the PCMCIA hardware, these are part of the frame.
+		 * It seems that for the ISA hardware, it's nowhere to be
+		 * found in the frame, so I'm obliged to do this (it has a
+		 * side effect on /proc/net/wireless).
+		 * Any ideas?
+		 */
+		mmc_out(ioaddr, mmwoff(0, mmw_freeze), 1);
+		mmc_read(ioaddr, mmroff(0, mmr_signal_lvl), stats, 3);
+		mmc_out(ioaddr, mmwoff(0, mmw_freeze), 0);
+
+#ifdef DEBUG_RX_INFO
+		printk(KERN_DEBUG
+		       "%s: wv_packet_read(): Signal level %d/63, Silence level %d/63, signal quality %d/16\n",
+		       dev->name, stats[0] & 0x3F, stats[1] & 0x3F,
+		       stats[2] & 0x0F);
+#endif
+
+		/* Spying stuff */
+#ifdef IW_WIRELESS_SPY
+		wl_spy_gather(dev, skb->mac.raw + WAVELAN_ADDR_SIZE,
+			      stats);
+#endif /* IW_WIRELESS_SPY */
+#ifdef HISTOGRAM
+		wl_his_gather(dev, stats);
+#endif /* HISTOGRAM */
+	}
+
+	/*
+	 * Hand the packet to the network module.
+	 */
+	netif_rx(skb);
+
+	/* Keep statistics up to date */
+	dev->last_rx = jiffies;
+	lp->stats.rx_packets++;
+	lp->stats.rx_bytes += sksize;
+
+#ifdef DEBUG_RX_TRACE
+	printk(KERN_DEBUG "%s: <-wv_packet_read()\n", dev->name);
+#endif
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Transfer as many packets as we can
+ * from the device RAM.
+ * (called in wavelan_interrupt()).
+ * Note : the spinlock is already grabbed for us.
+ */
+static inline void wv_receive(struct net_device * dev)
+{
+	unsigned long ioaddr = dev->base_addr;
+	net_local *lp = (net_local *) dev->priv;
+	fd_t fd;
+	rbd_t rbd;
+	int nreaped = 0;
+
+#ifdef DEBUG_RX_TRACE
+	printk(KERN_DEBUG "%s: ->wv_receive()\n", dev->name);
+#endif
+
+	/* Loop on each received packet. */
+	for (;;) {
+		obram_read(ioaddr, lp->rx_head, (unsigned char *) &fd,
+			   sizeof(fd));
+
+		/* Note about the status :
+		 * It start up to be 0 (the value we set). Then, when the RU
+		 * grab the buffer to prepare for reception, it sets the
+		 * FD_STATUS_B flag. When the RU has finished receiving the
+		 * frame, it clears FD_STATUS_B, set FD_STATUS_C to indicate
+		 * completion and set the other flags to indicate the eventual
+		 * errors. FD_STATUS_OK indicates that the reception was OK.
+		 */
+
+		/* If the current frame is not complete, we have reached the end. */
+		if ((fd.fd_status & FD_STATUS_C) != FD_STATUS_C)
+			break;	/* This is how we exit the loop. */
+
+		nreaped++;
+
+		/* Check whether frame was correctly received. */
+		if ((fd.fd_status & FD_STATUS_OK) == FD_STATUS_OK) {
+			/* Does the frame contain a pointer to the data?  Let's check. */
+			if (fd.fd_rbd_offset != I82586NULL) {
+				/* Read the receive buffer descriptor */
+				obram_read(ioaddr, fd.fd_rbd_offset,
+					   (unsigned char *) &rbd,
+					   sizeof(rbd));
+
+#ifdef DEBUG_RX_ERROR
+				if ((rbd.rbd_status & RBD_STATUS_EOF) !=
+				    RBD_STATUS_EOF) printk(KERN_INFO
+							   "%s: wv_receive(): missing EOF flag.\n",
+							   dev->name);
+
+				if ((rbd.rbd_status & RBD_STATUS_F) !=
+				    RBD_STATUS_F) printk(KERN_INFO
+							 "%s: wv_receive(): missing F flag.\n",
+							 dev->name);
+#endif				/* DEBUG_RX_ERROR */
+
+				/* Read the packet and transmit to Linux */
+				wv_packet_read(dev, rbd.rbd_bufl,
+					       rbd.
+					       rbd_status &
+					       RBD_STATUS_ACNT);
+			}
+#ifdef DEBUG_RX_ERROR
+			else	/* if frame has no data */
+				printk(KERN_INFO
+				       "%s: wv_receive(): frame has no data.\n",
+				       dev->name);
+#endif
+		} else {	/* If reception was no successful */
+
+			lp->stats.rx_errors++;
+
+#ifdef DEBUG_RX_INFO
+			printk(KERN_DEBUG
+			       "%s: wv_receive(): frame not received successfully (%X).\n",
+			       dev->name, fd.fd_status);
+#endif
+
+#ifdef DEBUG_RX_ERROR
+			if ((fd.fd_status & FD_STATUS_S6) != 0)
+				printk(KERN_INFO
+				       "%s: wv_receive(): no EOF flag.\n",
+				       dev->name);
+#endif
+
+			if ((fd.fd_status & FD_STATUS_S7) != 0) {
+				lp->stats.rx_length_errors++;
+#ifdef DEBUG_RX_FAIL
+				printk(KERN_DEBUG
+				       "%s: wv_receive(): frame too short.\n",
+				       dev->name);
+#endif
+			}
+
+			if ((fd.fd_status & FD_STATUS_S8) != 0) {
+				lp->stats.rx_over_errors++;
+#ifdef DEBUG_RX_FAIL
+				printk(KERN_DEBUG
+				       "%s: wv_receive(): rx DMA overrun.\n",
+				       dev->name);
+#endif
+			}
+
+			if ((fd.fd_status & FD_STATUS_S9) != 0) {
+				lp->stats.rx_fifo_errors++;
+#ifdef DEBUG_RX_FAIL
+				printk(KERN_DEBUG
+				       "%s: wv_receive(): ran out of resources.\n",
+				       dev->name);
+#endif
+			}
+
+			if ((fd.fd_status & FD_STATUS_S10) != 0) {
+				lp->stats.rx_frame_errors++;
+#ifdef DEBUG_RX_FAIL
+				printk(KERN_DEBUG
+				       "%s: wv_receive(): alignment error.\n",
+				       dev->name);
+#endif
+			}
+
+			if ((fd.fd_status & FD_STATUS_S11) != 0) {
+				lp->stats.rx_crc_errors++;
+#ifdef DEBUG_RX_FAIL
+				printk(KERN_DEBUG
+				       "%s: wv_receive(): CRC error.\n",
+				       dev->name);
+#endif
+			}
+		}
+
+		fd.fd_status = 0;
+		obram_write(ioaddr, fdoff(lp->rx_head, fd_status),
+			    (unsigned char *) &fd.fd_status,
+			    sizeof(fd.fd_status));
+
+		fd.fd_command = FD_COMMAND_EL;
+		obram_write(ioaddr, fdoff(lp->rx_head, fd_command),
+			    (unsigned char *) &fd.fd_command,
+			    sizeof(fd.fd_command));
+
+		fd.fd_command = 0;
+		obram_write(ioaddr, fdoff(lp->rx_last, fd_command),
+			    (unsigned char *) &fd.fd_command,
+			    sizeof(fd.fd_command));
+
+		lp->rx_last = lp->rx_head;
+		lp->rx_head = fd.fd_link_offset;
+	}			/* for(;;) -> loop on all frames */
+
+#ifdef DEBUG_RX_INFO
+	if (nreaped > 1)
+		printk(KERN_DEBUG "%s: wv_receive(): reaped %d\n",
+		       dev->name, nreaped);
+#endif
+#ifdef DEBUG_RX_TRACE
+	printk(KERN_DEBUG "%s: <-wv_receive()\n", dev->name);
+#endif
+}
+
+/*********************** PACKET TRANSMISSION ***********************/
+/*
+ * This part deals with sending packets through the WaveLAN.
+ *
+ */
+
+/*------------------------------------------------------------------*/
+/*
+ * This routine fills in the appropriate registers and memory
+ * locations on the WaveLAN card and starts the card off on
+ * the transmit.
+ *
+ * The principle:
+ * Each block contains a transmit command, a NOP command,
+ * a transmit block descriptor and a buffer.
+ * The CU read the transmit block which point to the tbd,
+ * read the tbd and the content of the buffer.
+ * When it has finish with it, it goes to the next command
+ * which in our case is the NOP. The NOP points on itself,
+ * so the CU stop here.
+ * When we add the next block, we modify the previous nop
+ * to make it point on the new tx command.
+ * Simple, isn't it ?
+ *
+ * (called in wavelan_packet_xmit())
+ */
+static inline int wv_packet_write(struct net_device * dev, void *buf, short length)
+{
+	net_local *lp = (net_local *) dev->priv;
+	unsigned long ioaddr = dev->base_addr;
+	unsigned short txblock;
+	unsigned short txpred;
+	unsigned short tx_addr;
+	unsigned short nop_addr;
+	unsigned short tbd_addr;
+	unsigned short buf_addr;
+	ac_tx_t tx;
+	ac_nop_t nop;
+	tbd_t tbd;
+	int clen = length;
+	unsigned long flags;
+
+#ifdef DEBUG_TX_TRACE
+	printk(KERN_DEBUG "%s: ->wv_packet_write(%d)\n", dev->name,
+	       length);
+#endif
+
+	spin_lock_irqsave(&lp->spinlock, flags);
+
+	/* Check nothing bad has happened */
+	if (lp->tx_n_in_use == (NTXBLOCKS - 1)) {
+#ifdef DEBUG_TX_ERROR
+		printk(KERN_INFO "%s: wv_packet_write(): Tx queue full.\n",
+		       dev->name);
+#endif
+		spin_unlock_irqrestore(&lp->spinlock, flags);
+		return 1;
+	}
+
+	/* Calculate addresses of next block and previous block. */
+	txblock = lp->tx_first_free;
+	txpred = txblock - TXBLOCKZ;
+	if (txpred < OFFSET_CU)
+		txpred += NTXBLOCKS * TXBLOCKZ;
+	lp->tx_first_free += TXBLOCKZ;
+	if (lp->tx_first_free >= OFFSET_CU + NTXBLOCKS * TXBLOCKZ)
+		lp->tx_first_free -= NTXBLOCKS * TXBLOCKZ;
+
+	lp->tx_n_in_use++;
+
+	/* Calculate addresses of the different parts of the block. */
+	tx_addr = txblock;
+	nop_addr = tx_addr + sizeof(tx);
+	tbd_addr = nop_addr + sizeof(nop);
+	buf_addr = tbd_addr + sizeof(tbd);
+
+	/*
+	 * Transmit command
+	 */
+	tx.tx_h.ac_status = 0;
+	obram_write(ioaddr, toff(ac_tx_t, tx_addr, tx_h.ac_status),
+		    (unsigned char *) &tx.tx_h.ac_status,
+		    sizeof(tx.tx_h.ac_status));
+
+	/*
+	 * NOP command
+	 */
+	nop.nop_h.ac_status = 0;
+	obram_write(ioaddr, toff(ac_nop_t, nop_addr, nop_h.ac_status),
+		    (unsigned char *) &nop.nop_h.ac_status,
+		    sizeof(nop.nop_h.ac_status));
+	nop.nop_h.ac_link = nop_addr;
+	obram_write(ioaddr, toff(ac_nop_t, nop_addr, nop_h.ac_link),
+		    (unsigned char *) &nop.nop_h.ac_link,
+		    sizeof(nop.nop_h.ac_link));
+
+	/*
+	 * Transmit buffer descriptor
+	 */
+	tbd.tbd_status = TBD_STATUS_EOF | (TBD_STATUS_ACNT & clen);
+	tbd.tbd_next_bd_offset = I82586NULL;
+	tbd.tbd_bufl = buf_addr;
+	tbd.tbd_bufh = 0;
+	obram_write(ioaddr, tbd_addr, (unsigned char *) &tbd, sizeof(tbd));
+
+	/*
+	 * Data
+	 */
+	obram_write(ioaddr, buf_addr, buf, length);
+
+	/*
+	 * Overwrite the predecessor NOP link
+	 * so that it points to this txblock.
+	 */
+	nop_addr = txpred + sizeof(tx);
+	nop.nop_h.ac_status = 0;
+	obram_write(ioaddr, toff(ac_nop_t, nop_addr, nop_h.ac_status),
+		    (unsigned char *) &nop.nop_h.ac_status,
+		    sizeof(nop.nop_h.ac_status));
+	nop.nop_h.ac_link = txblock;
+	obram_write(ioaddr, toff(ac_nop_t, nop_addr, nop_h.ac_link),
+		    (unsigned char *) &nop.nop_h.ac_link,
+		    sizeof(nop.nop_h.ac_link));
+
+	/* Make sure the watchdog will keep quiet for a while */
+	dev->trans_start = jiffies;
+
+	/* Keep stats up to date. */
+	lp->stats.tx_bytes += length;
+
+	if (lp->tx_first_in_use == I82586NULL)
+		lp->tx_first_in_use = txblock;
+
+	if (lp->tx_n_in_use < NTXBLOCKS - 1)
+		netif_wake_queue(dev);
+
+	spin_unlock_irqrestore(&lp->spinlock, flags);
+	
+#ifdef DEBUG_TX_INFO
+	wv_packet_info((u8 *) buf, length, dev->name,
+		       "wv_packet_write");
+#endif				/* DEBUG_TX_INFO */
+
+#ifdef DEBUG_TX_TRACE
+	printk(KERN_DEBUG "%s: <-wv_packet_write()\n", dev->name);
+#endif
+
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * This routine is called when we want to send a packet (NET3 callback)
+ * In this routine, we check if the harware is ready to accept
+ * the packet.  We also prevent reentrance.  Then we call the function
+ * to send the packet.
+ */
+static int wavelan_packet_xmit(struct sk_buff *skb, struct net_device * dev)
+{
+	net_local *lp = (net_local *) dev->priv;
+	unsigned long flags;
+
+#ifdef DEBUG_TX_TRACE
+	printk(KERN_DEBUG "%s: ->wavelan_packet_xmit(0x%X)\n", dev->name,
+	       (unsigned) skb);
+#endif
+
+	/*
+	 * Block a timer-based transmit from overlapping.
+	 * In other words, prevent reentering this routine.
+	 */
+	netif_stop_queue(dev);
+
+	/* If somebody has asked to reconfigure the controller, 
+	 * we can do it now.
+	 */
+	if (lp->reconfig_82586) {
+		spin_lock_irqsave(&lp->spinlock, flags);
+		wv_82586_config(dev);
+		spin_unlock_irqrestore(&lp->spinlock, flags);
+		/* Check that we can continue */
+		if (lp->tx_n_in_use == (NTXBLOCKS - 1))
+			return 1;
+	}
+#ifdef DEBUG_TX_ERROR
+	if (skb->next)
+		printk(KERN_INFO "skb has next\n");
+#endif
+
+	/* Do we need some padding? */
+	/* Note : on wireless the propagation time is in the order of 1us,
+	 * and we don't have the Ethernet specific requirement of beeing
+	 * able to detect collisions, therefore in theory we don't really
+	 * need to pad. Jean II */
+	if (skb->len < ETH_ZLEN) {
+		skb = skb_padto(skb, ETH_ZLEN);
+		if (skb == NULL)
+			return 0;
+	}
+
+	/* Write packet on the card */
+	if(wv_packet_write(dev, skb->data, skb->len))
+		return 1;	/* We failed */
+
+	dev_kfree_skb(skb);
+
+#ifdef DEBUG_TX_TRACE
+	printk(KERN_DEBUG "%s: <-wavelan_packet_xmit()\n", dev->name);
+#endif
+	return 0;
+}
+
+/*********************** HARDWARE CONFIGURATION ***********************/
+/*
+ * This part does the real job of starting and configuring the hardware.
+ */
+
+/*--------------------------------------------------------------------*/
+/*
+ * Routine to initialize the Modem Management Controller.
+ * (called by wv_hw_reset())
+ */
+static inline int wv_mmc_init(struct net_device * dev)
+{
+	unsigned long ioaddr = dev->base_addr;
+	net_local *lp = (net_local *) dev->priv;
+	psa_t psa;
+	mmw_t m;
+	int configured;
+
+#ifdef DEBUG_CONFIG_TRACE
+	printk(KERN_DEBUG "%s: ->wv_mmc_init()\n", dev->name);
+#endif
+
+	/* Read the parameter storage area. */
+	psa_read(ioaddr, lp->hacr, 0, (unsigned char *) &psa, sizeof(psa));
+
+#ifdef USE_PSA_CONFIG
+	configured = psa.psa_conf_status & 1;
+#else
+	configured = 0;
+#endif
+
+	/* Is the PSA is not configured */
+	if (!configured) {
+		/* User will be able to configure NWID later (with iwconfig). */
+		psa.psa_nwid[0] = 0;
+		psa.psa_nwid[1] = 0;
+
+		/* no NWID checking since NWID is not set */
+		psa.psa_nwid_select = 0;
+
+		/* Disable encryption */
+		psa.psa_encryption_select = 0;
+
+		/* Set to standard values:
+		 * 0x04 for AT,
+		 * 0x01 for MCA,
+		 * 0x04 for PCMCIA and 2.00 card (AT&T 407-024689/E document)
+		 */
+		if (psa.psa_comp_number & 1)
+			psa.psa_thr_pre_set = 0x01;
+		else
+			psa.psa_thr_pre_set = 0x04;
+		psa.psa_quality_thr = 0x03;
+
+		/* It is configured */
+		psa.psa_conf_status |= 1;
+
+#ifdef USE_PSA_CONFIG
+		/* Write the psa. */
+		psa_write(ioaddr, lp->hacr,
+			  (char *) psa.psa_nwid - (char *) &psa,
+			  (unsigned char *) psa.psa_nwid, 4);
+		psa_write(ioaddr, lp->hacr,
+			  (char *) &psa.psa_thr_pre_set - (char *) &psa,
+			  (unsigned char *) &psa.psa_thr_pre_set, 1);
+		psa_write(ioaddr, lp->hacr,
+			  (char *) &psa.psa_quality_thr - (char *) &psa,
+			  (unsigned char *) &psa.psa_quality_thr, 1);
+		psa_write(ioaddr, lp->hacr,
+			  (char *) &psa.psa_conf_status - (char *) &psa,
+			  (unsigned char *) &psa.psa_conf_status, 1);
+		/* update the Wavelan checksum */
+		update_psa_checksum(dev, ioaddr, lp->hacr);
+#endif
+	}
+
+	/* Zero the mmc structure. */
+	memset(&m, 0x00, sizeof(m));
+
+	/* Copy PSA info to the mmc. */
+	m.mmw_netw_id_l = psa.psa_nwid[1];
+	m.mmw_netw_id_h = psa.psa_nwid[0];
+
+	if (psa.psa_nwid_select & 1)
+		m.mmw_loopt_sel = 0x00;
+	else
+		m.mmw_loopt_sel = MMW_LOOPT_SEL_DIS_NWID;
+
+	memcpy(&m.mmw_encr_key, &psa.psa_encryption_key,
+	       sizeof(m.mmw_encr_key));
+
+	if (psa.psa_encryption_select)
+		m.mmw_encr_enable =
+		    MMW_ENCR_ENABLE_EN | MMW_ENCR_ENABLE_MODE;
+	else
+		m.mmw_encr_enable = 0;
+
+	m.mmw_thr_pre_set = psa.psa_thr_pre_set & 0x3F;
+	m.mmw_quality_thr = psa.psa_quality_thr & 0x0F;
+
+	/*
+	 * Set default modem control parameters.
+	 * See NCR document 407-0024326 Rev. A.
+	 */
+	m.mmw_jabber_enable = 0x01;
+	m.mmw_freeze = 0;
+	m.mmw_anten_sel = MMW_ANTEN_SEL_ALG_EN;
+	m.mmw_ifs = 0x20;
+	m.mmw_mod_delay = 0x04;
+	m.mmw_jam_time = 0x38;
+
+	m.mmw_des_io_invert = 0;
+	m.mmw_decay_prm = 0;
+	m.mmw_decay_updat_prm = 0;
+
+	/* Write all info to MMC. */
+	mmc_write(ioaddr, 0, (u8 *) & m, sizeof(m));
+
+	/* The following code starts the modem of the 2.00 frequency
+	 * selectable cards at power on.  It's not strictly needed for the
+	 * following boots.
+	 * The original patch was by Joe Finney for the PCMCIA driver, but
+	 * I've cleaned it up a bit and added documentation.
+	 * Thanks to Loeke Brederveld from Lucent for the info.
+	 */
+
+	/* Attempt to recognise 2.00 cards (2.4 GHz frequency selectable)
+	 * Does it work for everybody, especially old cards? */
+	/* Note: WFREQSEL verifies that it is able to read a sensible
+	 * frequency from EEPROM (address 0x00) and that MMR_FEE_STATUS_ID
+	 * is 0xA (Xilinx version) or 0xB (Ariadne version).
+	 * My test is more crude but does work. */
+	if (!(mmc_in(ioaddr, mmroff(0, mmr_fee_status)) &
+	      (MMR_FEE_STATUS_DWLD | MMR_FEE_STATUS_BUSY))) {
+		/* We must download the frequency parameters to the
+		 * synthesizers (from the EEPROM - area 1)
+		 * Note: as the EEPROM is automatically decremented, we set the end
+		 * if the area... */
+		m.mmw_fee_addr = 0x0F;
+		m.mmw_fee_ctrl = MMW_FEE_CTRL_READ | MMW_FEE_CTRL_DWLD;
+		mmc_write(ioaddr, (char *) &m.mmw_fee_ctrl - (char *) &m,
+			  (unsigned char *) &m.mmw_fee_ctrl, 2);
+
+		/* Wait until the download is finished. */
+		fee_wait(ioaddr, 100, 100);
+
+#ifdef DEBUG_CONFIG_INFO
+		/* The frequency was in the last word downloaded. */
+		mmc_read(ioaddr, (char *) &m.mmw_fee_data_l - (char *) &m,
+			 (unsigned char *) &m.mmw_fee_data_l, 2);
+
+		/* Print some info for the user. */
+		printk(KERN_DEBUG
+		       "%s: WaveLAN 2.00 recognised (frequency select).  Current frequency = %ld\n",
+		       dev->name,
+		       ((m.
+			 mmw_fee_data_h << 4) | (m.mmw_fee_data_l >> 4)) *
+		       5 / 2 + 24000L);
+#endif
+
+		/* We must now download the power adjust value (gain) to
+		 * the synthesizers (from the EEPROM - area 7 - DAC). */
+		m.mmw_fee_addr = 0x61;
+		m.mmw_fee_ctrl = MMW_FEE_CTRL_READ | MMW_FEE_CTRL_DWLD;
+		mmc_write(ioaddr, (char *) &m.mmw_fee_ctrl - (char *) &m,
+			  (unsigned char *) &m.mmw_fee_ctrl, 2);
+
+		/* Wait until the download is finished. */
+	}
+	/* if 2.00 card */
+#ifdef DEBUG_CONFIG_TRACE
+	printk(KERN_DEBUG "%s: <-wv_mmc_init()\n", dev->name);
+#endif
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Construct the fd and rbd structures.
+ * Start the receive unit.
+ * (called by wv_hw_reset())
+ */
+static inline int wv_ru_start(struct net_device * dev)
+{
+	net_local *lp = (net_local *) dev->priv;
+	unsigned long ioaddr = dev->base_addr;
+	u16 scb_cs;
+	fd_t fd;
+	rbd_t rbd;
+	u16 rx;
+	u16 rx_next;
+	int i;
+
+#ifdef DEBUG_CONFIG_TRACE
+	printk(KERN_DEBUG "%s: ->wv_ru_start()\n", dev->name);
+#endif
+
+	obram_read(ioaddr, scboff(OFFSET_SCB, scb_status),
+		   (unsigned char *) &scb_cs, sizeof(scb_cs));
+	if ((scb_cs & SCB_ST_RUS) == SCB_ST_RUS_RDY)
+		return 0;
+
+	lp->rx_head = OFFSET_RU;
+
+	for (i = 0, rx = lp->rx_head; i < NRXBLOCKS; i++, rx = rx_next) {
+		rx_next =
+		    (i == NRXBLOCKS - 1) ? lp->rx_head : rx + RXBLOCKZ;
+
+		fd.fd_status = 0;
+		fd.fd_command = (i == NRXBLOCKS - 1) ? FD_COMMAND_EL : 0;
+		fd.fd_link_offset = rx_next;
+		fd.fd_rbd_offset = rx + sizeof(fd);
+		obram_write(ioaddr, rx, (unsigned char *) &fd, sizeof(fd));
+
+		rbd.rbd_status = 0;
+		rbd.rbd_next_rbd_offset = I82586NULL;
+		rbd.rbd_bufl = rx + sizeof(fd) + sizeof(rbd);
+		rbd.rbd_bufh = 0;
+		rbd.rbd_el_size = RBD_EL | (RBD_SIZE & MAXDATAZ);
+		obram_write(ioaddr, rx + sizeof(fd),
+			    (unsigned char *) &rbd, sizeof(rbd));
+
+		lp->rx_last = rx;
+	}
+
+	obram_write(ioaddr, scboff(OFFSET_SCB, scb_rfa_offset),
+		    (unsigned char *) &lp->rx_head, sizeof(lp->rx_head));
+
+	scb_cs = SCB_CMD_RUC_GO;
+	obram_write(ioaddr, scboff(OFFSET_SCB, scb_command),
+		    (unsigned char *) &scb_cs, sizeof(scb_cs));
+
+	set_chan_attn(ioaddr, lp->hacr);
+
+	for (i = 1000; i > 0; i--) {
+		obram_read(ioaddr, scboff(OFFSET_SCB, scb_command),
+			   (unsigned char *) &scb_cs, sizeof(scb_cs));
+		if (scb_cs == 0)
+			break;
+
+		udelay(10);
+	}
+
+	if (i <= 0) {
+#ifdef DEBUG_CONFIG_ERROR
+		printk(KERN_INFO
+		       "%s: wavelan_ru_start(): board not accepting command.\n",
+		       dev->name);
+#endif
+		return -1;
+	}
+#ifdef DEBUG_CONFIG_TRACE
+	printk(KERN_DEBUG "%s: <-wv_ru_start()\n", dev->name);
+#endif
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Initialise the transmit blocks.
+ * Start the command unit executing the NOP
+ * self-loop of the first transmit block.
+ *
+ * Here we create the list of send buffers used to transmit packets
+ * between the PC and the command unit. For each buffer, we create a
+ * buffer descriptor (pointing on the buffer), a transmit command
+ * (pointing to the buffer descriptor) and a NOP command.
+ * The transmit command is linked to the NOP, and the NOP to itself.
+ * When we will have finished executing the transmit command, we will
+ * then loop on the NOP. By releasing the NOP link to a new command,
+ * we may send another buffer.
+ *
+ * (called by wv_hw_reset())
+ */
+static inline int wv_cu_start(struct net_device * dev)
+{
+	net_local *lp = (net_local *) dev->priv;
+	unsigned long ioaddr = dev->base_addr;
+	int i;
+	u16 txblock;
+	u16 first_nop;
+	u16 scb_cs;
+
+#ifdef DEBUG_CONFIG_TRACE
+	printk(KERN_DEBUG "%s: ->wv_cu_start()\n", dev->name);
+#endif
+
+	lp->tx_first_free = OFFSET_CU;
+	lp->tx_first_in_use = I82586NULL;
+
+	for (i = 0, txblock = OFFSET_CU;
+	     i < NTXBLOCKS; i++, txblock += TXBLOCKZ) {
+		ac_tx_t tx;
+		ac_nop_t nop;
+		tbd_t tbd;
+		unsigned short tx_addr;
+		unsigned short nop_addr;
+		unsigned short tbd_addr;
+		unsigned short buf_addr;
+
+		tx_addr = txblock;
+		nop_addr = tx_addr + sizeof(tx);
+		tbd_addr = nop_addr + sizeof(nop);
+		buf_addr = tbd_addr + sizeof(tbd);
+
+		tx.tx_h.ac_status = 0;
+		tx.tx_h.ac_command = acmd_transmit | AC_CFLD_I;
+		tx.tx_h.ac_link = nop_addr;
+		tx.tx_tbd_offset = tbd_addr;
+		obram_write(ioaddr, tx_addr, (unsigned char *) &tx,
+			    sizeof(tx));
+
+		nop.nop_h.ac_status = 0;
+		nop.nop_h.ac_command = acmd_nop;
+		nop.nop_h.ac_link = nop_addr;
+		obram_write(ioaddr, nop_addr, (unsigned char *) &nop,
+			    sizeof(nop));
+
+		tbd.tbd_status = TBD_STATUS_EOF;
+		tbd.tbd_next_bd_offset = I82586NULL;
+		tbd.tbd_bufl = buf_addr;
+		tbd.tbd_bufh = 0;
+		obram_write(ioaddr, tbd_addr, (unsigned char *) &tbd,
+			    sizeof(tbd));
+	}
+
+	first_nop =
+	    OFFSET_CU + (NTXBLOCKS - 1) * TXBLOCKZ + sizeof(ac_tx_t);
+	obram_write(ioaddr, scboff(OFFSET_SCB, scb_cbl_offset),
+		    (unsigned char *) &first_nop, sizeof(first_nop));
+
+	scb_cs = SCB_CMD_CUC_GO;
+	obram_write(ioaddr, scboff(OFFSET_SCB, scb_command),
+		    (unsigned char *) &scb_cs, sizeof(scb_cs));
+
+	set_chan_attn(ioaddr, lp->hacr);
+
+	for (i = 1000; i > 0; i--) {
+		obram_read(ioaddr, scboff(OFFSET_SCB, scb_command),
+			   (unsigned char *) &scb_cs, sizeof(scb_cs));
+		if (scb_cs == 0)
+			break;
+
+		udelay(10);
+	}
+
+	if (i <= 0) {
+#ifdef DEBUG_CONFIG_ERROR
+		printk(KERN_INFO
+		       "%s: wavelan_cu_start(): board not accepting command.\n",
+		       dev->name);
+#endif
+		return -1;
+	}
+
+	lp->tx_n_in_use = 0;
+	netif_start_queue(dev);
+#ifdef DEBUG_CONFIG_TRACE
+	printk(KERN_DEBUG "%s: <-wv_cu_start()\n", dev->name);
+#endif
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * This routine does a standard configuration of the WaveLAN 
+ * controller (i82586).
+ *
+ * It initialises the scp, iscp and scb structure
+ * The first two are just pointers to the next.
+ * The last one is used for basic configuration and for basic
+ * communication (interrupt status).
+ *
+ * (called by wv_hw_reset())
+ */
+static inline int wv_82586_start(struct net_device * dev)
+{
+	net_local *lp = (net_local *) dev->priv;
+	unsigned long ioaddr = dev->base_addr;
+	scp_t scp;		/* system configuration pointer */
+	iscp_t iscp;		/* intermediate scp */
+	scb_t scb;		/* system control block */
+	ach_t cb;		/* Action command header */
+	u8 zeroes[512];
+	int i;
+
+#ifdef DEBUG_CONFIG_TRACE
+	printk(KERN_DEBUG "%s: ->wv_82586_start()\n", dev->name);
+#endif
+
+	/*
+	 * Clear the onboard RAM.
+	 */
+	memset(&zeroes[0], 0x00, sizeof(zeroes));
+	for (i = 0; i < I82586_MEMZ; i += sizeof(zeroes))
+		obram_write(ioaddr, i, &zeroes[0], sizeof(zeroes));
+
+	/*
+	 * Construct the command unit structures:
+	 * scp, iscp, scb, cb.
+	 */
+	memset(&scp, 0x00, sizeof(scp));
+	scp.scp_sysbus = SCP_SY_16BBUS;
+	scp.scp_iscpl = OFFSET_ISCP;
+	obram_write(ioaddr, OFFSET_SCP, (unsigned char *) &scp,
+		    sizeof(scp));
+
+	memset(&iscp, 0x00, sizeof(iscp));
+	iscp.iscp_busy = 1;
+	iscp.iscp_offset = OFFSET_SCB;
+	obram_write(ioaddr, OFFSET_ISCP, (unsigned char *) &iscp,
+		    sizeof(iscp));
+
+	/* Our first command is to reset the i82586. */
+	memset(&scb, 0x00, sizeof(scb));
+	scb.scb_command = SCB_CMD_RESET;
+	scb.scb_cbl_offset = OFFSET_CU;
+	scb.scb_rfa_offset = OFFSET_RU;
+	obram_write(ioaddr, OFFSET_SCB, (unsigned char *) &scb,
+		    sizeof(scb));
+
+	set_chan_attn(ioaddr, lp->hacr);
+
+	/* Wait for command to finish. */
+	for (i = 1000; i > 0; i--) {
+		obram_read(ioaddr, OFFSET_ISCP, (unsigned char *) &iscp,
+			   sizeof(iscp));
+
+		if (iscp.iscp_busy == (unsigned short) 0)
+			break;
+
+		udelay(10);
+	}
+
+	if (i <= 0) {
+#ifdef DEBUG_CONFIG_ERROR
+		printk(KERN_INFO
+		       "%s: wv_82586_start(): iscp_busy timeout.\n",
+		       dev->name);
+#endif
+		return -1;
+	}
+
+	/* Check command completion. */
+	for (i = 15; i > 0; i--) {
+		obram_read(ioaddr, OFFSET_SCB, (unsigned char *) &scb,
+			   sizeof(scb));
+
+		if (scb.scb_status == (SCB_ST_CX | SCB_ST_CNA))
+			break;
+
+		udelay(10);
+	}
+
+	if (i <= 0) {
+#ifdef DEBUG_CONFIG_ERROR
+		printk(KERN_INFO
+		       "%s: wv_82586_start(): status: expected 0x%02x, got 0x%02x.\n",
+		       dev->name, SCB_ST_CX | SCB_ST_CNA, scb.scb_status);
+#endif
+		return -1;
+	}
+
+	wv_ack(dev);
+
+	/* Set the action command header. */
+	memset(&cb, 0x00, sizeof(cb));
+	cb.ac_command = AC_CFLD_EL | (AC_CFLD_CMD & acmd_diagnose);
+	cb.ac_link = OFFSET_CU;
+	obram_write(ioaddr, OFFSET_CU, (unsigned char *) &cb, sizeof(cb));
+
+	if (wv_synchronous_cmd(dev, "diag()") == -1)
+		return -1;
+
+	obram_read(ioaddr, OFFSET_CU, (unsigned char *) &cb, sizeof(cb));
+	if (cb.ac_status & AC_SFLD_FAIL) {
+#ifdef DEBUG_CONFIG_ERROR
+		printk(KERN_INFO
+		       "%s: wv_82586_start(): i82586 Self Test failed.\n",
+		       dev->name);
+#endif
+		return -1;
+	}
+#ifdef DEBUG_I82586_SHOW
+	wv_scb_show(ioaddr);
+#endif
+
+#ifdef DEBUG_CONFIG_TRACE
+	printk(KERN_DEBUG "%s: <-wv_82586_start()\n", dev->name);
+#endif
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * This routine does a standard configuration of the WaveLAN
+ * controller (i82586).
+ *
+ * This routine is a violent hack. We use the first free transmit block
+ * to make our configuration. In the buffer area, we create the three
+ * configuration commands (linked). We make the previous NOP point to
+ * the beginning of the buffer instead of the tx command. After, we go
+ * as usual to the NOP command.
+ * Note that only the last command (mc_set) will generate an interrupt.
+ *
+ * (called by wv_hw_reset(), wv_82586_reconfig(), wavelan_packet_xmit())
+ */
+static void wv_82586_config(struct net_device * dev)
+{
+	net_local *lp = (net_local *) dev->priv;
+	unsigned long ioaddr = dev->base_addr;
+	unsigned short txblock;
+	unsigned short txpred;
+	unsigned short tx_addr;
+	unsigned short nop_addr;
+	unsigned short tbd_addr;
+	unsigned short cfg_addr;
+	unsigned short ias_addr;
+	unsigned short mcs_addr;
+	ac_tx_t tx;
+	ac_nop_t nop;
+	ac_cfg_t cfg;		/* Configure action */
+	ac_ias_t ias;		/* IA-setup action */
+	ac_mcs_t mcs;		/* Multicast setup */
+	struct dev_mc_list *dmi;
+
+#ifdef DEBUG_CONFIG_TRACE
+	printk(KERN_DEBUG "%s: ->wv_82586_config()\n", dev->name);
+#endif
+
+	/* Check nothing bad has happened */
+	if (lp->tx_n_in_use == (NTXBLOCKS - 1)) {
+#ifdef DEBUG_CONFIG_ERROR
+		printk(KERN_INFO "%s: wv_82586_config(): Tx queue full.\n",
+		       dev->name);
+#endif
+		return;
+	}
+
+	/* Calculate addresses of next block and previous block. */
+	txblock = lp->tx_first_free;
+	txpred = txblock - TXBLOCKZ;
+	if (txpred < OFFSET_CU)
+		txpred += NTXBLOCKS * TXBLOCKZ;
+	lp->tx_first_free += TXBLOCKZ;
+	if (lp->tx_first_free >= OFFSET_CU + NTXBLOCKS * TXBLOCKZ)
+		lp->tx_first_free -= NTXBLOCKS * TXBLOCKZ;
+
+	lp->tx_n_in_use++;
+
+	/* Calculate addresses of the different parts of the block. */
+	tx_addr = txblock;
+	nop_addr = tx_addr + sizeof(tx);
+	tbd_addr = nop_addr + sizeof(nop);
+	cfg_addr = tbd_addr + sizeof(tbd_t);	/* beginning of the buffer */
+	ias_addr = cfg_addr + sizeof(cfg);
+	mcs_addr = ias_addr + sizeof(ias);
+
+	/*
+	 * Transmit command
+	 */
+	tx.tx_h.ac_status = 0xFFFF;	/* Fake completion value */
+	obram_write(ioaddr, toff(ac_tx_t, tx_addr, tx_h.ac_status),
+		    (unsigned char *) &tx.tx_h.ac_status,
+		    sizeof(tx.tx_h.ac_status));
+
+	/*
+	 * NOP command
+	 */
+	nop.nop_h.ac_status = 0;
+	obram_write(ioaddr, toff(ac_nop_t, nop_addr, nop_h.ac_status),
+		    (unsigned char *) &nop.nop_h.ac_status,
+		    sizeof(nop.nop_h.ac_status));
+	nop.nop_h.ac_link = nop_addr;
+	obram_write(ioaddr, toff(ac_nop_t, nop_addr, nop_h.ac_link),
+		    (unsigned char *) &nop.nop_h.ac_link,
+		    sizeof(nop.nop_h.ac_link));
+
+	/* Create a configure action. */
+	memset(&cfg, 0x00, sizeof(cfg));
+
+	/*
+	 * For Linux we invert AC_CFG_ALOC() so as to conform
+	 * to the way that net packets reach us from above.
+	 * (See also ac_tx_t.)
+	 *
+	 * Updated from Wavelan Manual WCIN085B
+	 */
+	cfg.cfg_byte_cnt =
+	    AC_CFG_BYTE_CNT(sizeof(ac_cfg_t) - sizeof(ach_t));
+	cfg.cfg_fifolim = AC_CFG_FIFOLIM(4);
+	cfg.cfg_byte8 = AC_CFG_SAV_BF(1) | AC_CFG_SRDY(0);
+	cfg.cfg_byte9 = AC_CFG_ELPBCK(0) |
+	    AC_CFG_ILPBCK(0) |
+	    AC_CFG_PRELEN(AC_CFG_PLEN_2) |
+	    AC_CFG_ALOC(1) | AC_CFG_ADDRLEN(WAVELAN_ADDR_SIZE);
+	cfg.cfg_byte10 = AC_CFG_BOFMET(1) |
+	    AC_CFG_ACR(6) | AC_CFG_LINPRIO(0);
+	cfg.cfg_ifs = 0x20;
+	cfg.cfg_slotl = 0x0C;
+	cfg.cfg_byte13 = AC_CFG_RETRYNUM(15) | AC_CFG_SLTTMHI(0);
+	cfg.cfg_byte14 = AC_CFG_FLGPAD(0) |
+	    AC_CFG_BTSTF(0) |
+	    AC_CFG_CRC16(0) |
+	    AC_CFG_NCRC(0) |
+	    AC_CFG_TNCRS(1) |
+	    AC_CFG_MANCH(0) |
+	    AC_CFG_BCDIS(0) | AC_CFG_PRM(lp->promiscuous);
+	cfg.cfg_byte15 = AC_CFG_ICDS(0) |
+	    AC_CFG_CDTF(0) | AC_CFG_ICSS(0) | AC_CFG_CSTF(0);
+/*
+  cfg.cfg_min_frm_len = AC_CFG_MNFRM(64);
+*/
+	cfg.cfg_min_frm_len = AC_CFG_MNFRM(8);
+
+	cfg.cfg_h.ac_command = (AC_CFLD_CMD & acmd_configure);
+	cfg.cfg_h.ac_link = ias_addr;
+	obram_write(ioaddr, cfg_addr, (unsigned char *) &cfg, sizeof(cfg));
+
+	/* Set up the MAC address */
+	memset(&ias, 0x00, sizeof(ias));
+	ias.ias_h.ac_command = (AC_CFLD_CMD & acmd_ia_setup);
+	ias.ias_h.ac_link = mcs_addr;
+	memcpy(&ias.ias_addr[0], (unsigned char *) &dev->dev_addr[0],
+	       sizeof(ias.ias_addr));
+	obram_write(ioaddr, ias_addr, (unsigned char *) &ias, sizeof(ias));
+
+	/* Initialize adapter's Ethernet multicast addresses */
+	memset(&mcs, 0x00, sizeof(mcs));
+	mcs.mcs_h.ac_command = AC_CFLD_I | (AC_CFLD_CMD & acmd_mc_setup);
+	mcs.mcs_h.ac_link = nop_addr;
+	mcs.mcs_cnt = WAVELAN_ADDR_SIZE * lp->mc_count;
+	obram_write(ioaddr, mcs_addr, (unsigned char *) &mcs, sizeof(mcs));
+
+	/* Any address to set? */
+	if (lp->mc_count) {
+		for (dmi = dev->mc_list; dmi; dmi = dmi->next)
+			outsw(PIOP1(ioaddr), (u16 *) dmi->dmi_addr,
+			      WAVELAN_ADDR_SIZE >> 1);
+
+#ifdef DEBUG_CONFIG_INFO
+		printk(KERN_DEBUG
+		       "%s: wv_82586_config(): set %d multicast addresses:\n",
+		       dev->name, lp->mc_count);
+		for (dmi = dev->mc_list; dmi; dmi = dmi->next)
+			printk(KERN_DEBUG
+			       " %02x:%02x:%02x:%02x:%02x:%02x\n",
+			       dmi->dmi_addr[0], dmi->dmi_addr[1],
+			       dmi->dmi_addr[2], dmi->dmi_addr[3],
+			       dmi->dmi_addr[4], dmi->dmi_addr[5]);
+#endif
+	}
+
+	/*
+	 * Overwrite the predecessor NOP link
+	 * so that it points to the configure action.
+	 */
+	nop_addr = txpred + sizeof(tx);
+	nop.nop_h.ac_status = 0;
+	obram_write(ioaddr, toff(ac_nop_t, nop_addr, nop_h.ac_status),
+		    (unsigned char *) &nop.nop_h.ac_status,
+		    sizeof(nop.nop_h.ac_status));
+	nop.nop_h.ac_link = cfg_addr;
+	obram_write(ioaddr, toff(ac_nop_t, nop_addr, nop_h.ac_link),
+		    (unsigned char *) &nop.nop_h.ac_link,
+		    sizeof(nop.nop_h.ac_link));
+
+	/* Job done, clear the flag */
+	lp->reconfig_82586 = 0;
+
+	if (lp->tx_first_in_use == I82586NULL)
+		lp->tx_first_in_use = txblock;
+
+	if (lp->tx_n_in_use == (NTXBLOCKS - 1))
+		netif_stop_queue(dev);
+
+#ifdef DEBUG_CONFIG_TRACE
+	printk(KERN_DEBUG "%s: <-wv_82586_config()\n", dev->name);
+#endif
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * This routine, called by wavelan_close(), gracefully stops the 
+ * WaveLAN controller (i82586).
+ * (called by wavelan_close())
+ */
+static inline void wv_82586_stop(struct net_device * dev)
+{
+	net_local *lp = (net_local *) dev->priv;
+	unsigned long ioaddr = dev->base_addr;
+	u16 scb_cmd;
+
+#ifdef DEBUG_CONFIG_TRACE
+	printk(KERN_DEBUG "%s: ->wv_82586_stop()\n", dev->name);
+#endif
+
+	/* Suspend both command unit and receive unit. */
+	scb_cmd =
+	    (SCB_CMD_CUC & SCB_CMD_CUC_SUS) | (SCB_CMD_RUC &
+					       SCB_CMD_RUC_SUS);
+	obram_write(ioaddr, scboff(OFFSET_SCB, scb_command),
+		    (unsigned char *) &scb_cmd, sizeof(scb_cmd));
+	set_chan_attn(ioaddr, lp->hacr);
+
+	/* No more interrupts */
+	wv_ints_off(dev);
+
+#ifdef DEBUG_CONFIG_TRACE
+	printk(KERN_DEBUG "%s: <-wv_82586_stop()\n", dev->name);
+#endif
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Totally reset the WaveLAN and restart it.
+ * Performs the following actions:
+ *	1. A power reset (reset DMA)
+ *	2. Initialize the radio modem (using wv_mmc_init)
+ *	3. Reset & Configure LAN controller (using wv_82586_start)
+ *	4. Start the LAN controller's command unit
+ *	5. Start the LAN controller's receive unit
+ * (called by wavelan_interrupt(), wavelan_watchdog() & wavelan_open())
+ */
+static int wv_hw_reset(struct net_device * dev)
+{
+	net_local *lp = (net_local *) dev->priv;
+	unsigned long ioaddr = dev->base_addr;
+
+#ifdef DEBUG_CONFIG_TRACE
+	printk(KERN_DEBUG "%s: ->wv_hw_reset(dev=0x%x)\n", dev->name,
+	       (unsigned int) dev);
+#endif
+
+	/* Increase the number of resets done. */
+	lp->nresets++;
+
+	wv_hacr_reset(ioaddr);
+	lp->hacr = HACR_DEFAULT;
+
+	if ((wv_mmc_init(dev) < 0) || (wv_82586_start(dev) < 0))
+		return -1;
+
+	/* Enable the card to send interrupts. */
+	wv_ints_on(dev);
+
+	/* Start card functions */
+	if (wv_cu_start(dev) < 0)
+		return -1;
+
+	/* Setup the controller and parameters */
+	wv_82586_config(dev);
+
+	/* Finish configuration with the receive unit */
+	if (wv_ru_start(dev) < 0)
+		return -1;
+
+#ifdef DEBUG_CONFIG_TRACE
+	printk(KERN_DEBUG "%s: <-wv_hw_reset()\n", dev->name);
+#endif
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Check if there is a WaveLAN at the specific base address.
+ * As a side effect, this reads the MAC address.
+ * (called in wavelan_probe() and init_module())
+ */
+static int wv_check_ioaddr(unsigned long ioaddr, u8 * mac)
+{
+	int i;			/* Loop counter */
+
+	/* Check if the base address if available. */
+	if (!request_region(ioaddr, sizeof(ha_t), "wavelan probe"))
+		return -EBUSY;		/* ioaddr already used */
+
+	/* Reset host interface */
+	wv_hacr_reset(ioaddr);
+
+	/* Read the MAC address from the parameter storage area. */
+	psa_read(ioaddr, HACR_DEFAULT, psaoff(0, psa_univ_mac_addr),
+		 mac, 6);
+
+	release_region(ioaddr, sizeof(ha_t));
+
+	/*
+	 * Check the first three octets of the address for the manufacturer's code.
+	 * Note: if this can't find your WaveLAN card, you've got a
+	 * non-NCR/AT&T/Lucent ISA card.  See wavelan.p.h for detail on
+	 * how to configure your card.
+	 */
+	for (i = 0; i < (sizeof(MAC_ADDRESSES) / sizeof(char) / 3); i++)
+		if ((mac[0] == MAC_ADDRESSES[i][0]) &&
+		    (mac[1] == MAC_ADDRESSES[i][1]) &&
+		    (mac[2] == MAC_ADDRESSES[i][2]))
+			return 0;
+
+#ifdef DEBUG_CONFIG_INFO
+	printk(KERN_WARNING
+	       "WaveLAN (0x%3X): your MAC address might be %02X:%02X:%02X.\n",
+	       ioaddr, mac[0], mac[1], mac[2]);
+#endif
+	return -ENODEV;
+}
+
+/************************ INTERRUPT HANDLING ************************/
+
+/*
+ * This function is the interrupt handler for the WaveLAN card. This
+ * routine will be called whenever: 
+ */
+static irqreturn_t wavelan_interrupt(int irq, void *dev_id, struct pt_regs *regs)
+{
+	struct net_device *dev;
+	unsigned long ioaddr;
+	net_local *lp;
+	u16 hasr;
+	u16 status;
+	u16 ack_cmd;
+
+	dev = dev_id;
+
+#ifdef DEBUG_INTERRUPT_TRACE
+	printk(KERN_DEBUG "%s: ->wavelan_interrupt()\n", dev->name);
+#endif
+
+	lp = (net_local *) dev->priv;
+	ioaddr = dev->base_addr;
+
+#ifdef DEBUG_INTERRUPT_INFO
+	/* Check state of our spinlock */
+	if(spin_is_locked(&lp->spinlock))
+		printk(KERN_DEBUG
+		       "%s: wavelan_interrupt(): spinlock is already locked !!!\n",
+		       dev->name);
+#endif
+
+	/* Prevent reentrancy. We need to do that because we may have
+	 * multiple interrupt handler running concurrently.
+	 * It is safe because interrupts are disabled before acquiring
+	 * the spinlock. */
+	spin_lock(&lp->spinlock);
+
+	/* We always had spurious interrupts at startup, but lately I
+	 * saw them comming *between* the request_irq() and the
+	 * spin_lock_irqsave() in wavelan_open(), so the spinlock
+	 * protection is no enough.
+	 * So, we also check lp->hacr that will tell us is we enabled
+	 * irqs or not (see wv_ints_on()).
+	 * We can't use netif_running(dev) because we depend on the
+	 * proper processing of the irq generated during the config. */
+
+	/* Which interrupt it is ? */
+	hasr = hasr_read(ioaddr);
+
+#ifdef DEBUG_INTERRUPT_INFO
+	printk(KERN_INFO
+	       "%s: wavelan_interrupt(): hasr 0x%04x; hacr 0x%04x.\n",
+	       dev->name, hasr, lp->hacr);
+#endif
+
+	/* Check modem interrupt */
+	if ((hasr & HASR_MMC_INTR) && (lp->hacr & HACR_MMC_INT_ENABLE)) {
+		u8 dce_status;
+
+		/*
+		 * Interrupt from the modem management controller.
+		 * This will clear it -- ignored for now.
+		 */
+		mmc_read(ioaddr, mmroff(0, mmr_dce_status), &dce_status,
+			 sizeof(dce_status));
+
+#ifdef DEBUG_INTERRUPT_ERROR
+		printk(KERN_INFO
+		       "%s: wavelan_interrupt(): unexpected mmc interrupt: status 0x%04x.\n",
+		       dev->name, dce_status);
+#endif
+	}
+
+	/* Check if not controller interrupt */
+	if (((hasr & HASR_82586_INTR) == 0) ||
+	    ((lp->hacr & HACR_82586_INT_ENABLE) == 0)) {
+#ifdef DEBUG_INTERRUPT_ERROR
+		printk(KERN_INFO
+		       "%s: wavelan_interrupt(): interrupt not coming from i82586 - hasr 0x%04x.\n",
+		       dev->name, hasr);
+#endif
+		spin_unlock (&lp->spinlock);
+		return IRQ_NONE;
+	}
+
+	/* Read interrupt data. */
+	obram_read(ioaddr, scboff(OFFSET_SCB, scb_status),
+		   (unsigned char *) &status, sizeof(status));
+
+	/*
+	 * Acknowledge the interrupt(s).
+	 */
+	ack_cmd = status & SCB_ST_INT;
+	obram_write(ioaddr, scboff(OFFSET_SCB, scb_command),
+		    (unsigned char *) &ack_cmd, sizeof(ack_cmd));
+	set_chan_attn(ioaddr, lp->hacr);
+
+#ifdef DEBUG_INTERRUPT_INFO
+	printk(KERN_DEBUG "%s: wavelan_interrupt(): status 0x%04x.\n",
+	       dev->name, status);
+#endif
+
+	/* Command completed. */
+	if ((status & SCB_ST_CX) == SCB_ST_CX) {
+#ifdef DEBUG_INTERRUPT_INFO
+		printk(KERN_DEBUG
+		       "%s: wavelan_interrupt(): command completed.\n",
+		       dev->name);
+#endif
+		wv_complete(dev, ioaddr, lp);
+	}
+
+	/* Frame received. */
+	if ((status & SCB_ST_FR) == SCB_ST_FR) {
+#ifdef DEBUG_INTERRUPT_INFO
+		printk(KERN_DEBUG
+		       "%s: wavelan_interrupt(): received packet.\n",
+		       dev->name);
+#endif
+		wv_receive(dev);
+	}
+
+	/* Check the state of the command unit. */
+	if (((status & SCB_ST_CNA) == SCB_ST_CNA) ||
+	    (((status & SCB_ST_CUS) != SCB_ST_CUS_ACTV) &&
+	     (netif_running(dev)))) {
+#ifdef DEBUG_INTERRUPT_ERROR
+		printk(KERN_INFO
+		       "%s: wavelan_interrupt(): CU inactive -- restarting\n",
+		       dev->name);
+#endif
+		wv_hw_reset(dev);
+	}
+
+	/* Check the state of the command unit. */
+	if (((status & SCB_ST_RNR) == SCB_ST_RNR) ||
+	    (((status & SCB_ST_RUS) != SCB_ST_RUS_RDY) &&
+	     (netif_running(dev)))) {
+#ifdef DEBUG_INTERRUPT_ERROR
+		printk(KERN_INFO
+		       "%s: wavelan_interrupt(): RU not ready -- restarting\n",
+		       dev->name);
+#endif
+		wv_hw_reset(dev);
+	}
+
+	/* Release spinlock */
+	spin_unlock (&lp->spinlock);
+
+#ifdef DEBUG_INTERRUPT_TRACE
+	printk(KERN_DEBUG "%s: <-wavelan_interrupt()\n", dev->name);
+#endif
+	return IRQ_HANDLED;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Watchdog: when we start a transmission, a timer is set for us in the
+ * kernel.  If the transmission completes, this timer is disabled. If
+ * the timer expires, we are called and we try to unlock the hardware.
+ */
+static void wavelan_watchdog(struct net_device *	dev)
+{
+	net_local *	lp = (net_local *)dev->priv;
+	u_long		ioaddr = dev->base_addr;
+	unsigned long	flags;
+	unsigned int	nreaped;
+
+#ifdef DEBUG_INTERRUPT_TRACE
+	printk(KERN_DEBUG "%s: ->wavelan_watchdog()\n", dev->name);
+#endif
+
+#ifdef DEBUG_INTERRUPT_ERROR
+	printk(KERN_INFO "%s: wavelan_watchdog: watchdog timer expired\n",
+	       dev->name);
+#endif
+
+	/* Check that we came here for something */
+	if (lp->tx_n_in_use <= 0) {
+		return;
+	}
+
+	spin_lock_irqsave(&lp->spinlock, flags);
+
+	/* Try to see if some buffers are not free (in case we missed
+	 * an interrupt */
+	nreaped = wv_complete(dev, ioaddr, lp);
+
+#ifdef DEBUG_INTERRUPT_INFO
+	printk(KERN_DEBUG
+	       "%s: wavelan_watchdog(): %d reaped, %d remain.\n",
+	       dev->name, nreaped, lp->tx_n_in_use);
+#endif
+
+#ifdef DEBUG_PSA_SHOW
+	{
+		psa_t psa;
+		psa_read(dev, 0, (unsigned char *) &psa, sizeof(psa));
+		wv_psa_show(&psa);
+	}
+#endif
+#ifdef DEBUG_MMC_SHOW
+	wv_mmc_show(dev);
+#endif
+#ifdef DEBUG_I82586_SHOW
+	wv_cu_show(dev);
+#endif
+
+	/* If no buffer has been freed */
+	if (nreaped == 0) {
+#ifdef DEBUG_INTERRUPT_ERROR
+		printk(KERN_INFO
+		       "%s: wavelan_watchdog(): cleanup failed, trying reset\n",
+		       dev->name);
+#endif
+		wv_hw_reset(dev);
+	}
+
+	/* At this point, we should have some free Tx buffer ;-) */
+	if (lp->tx_n_in_use < NTXBLOCKS - 1)
+		netif_wake_queue(dev);
+
+	spin_unlock_irqrestore(&lp->spinlock, flags);
+	
+#ifdef DEBUG_INTERRUPT_TRACE
+	printk(KERN_DEBUG "%s: <-wavelan_watchdog()\n", dev->name);
+#endif
+}
+
+/********************* CONFIGURATION CALLBACKS *********************/
+/*
+ * Here are the functions called by the Linux networking code (NET3)
+ * for initialization, configuration and deinstallations of the 
+ * WaveLAN ISA hardware.
+ */
+
+/*------------------------------------------------------------------*/
+/*
+ * Configure and start up the WaveLAN PCMCIA adaptor.
+ * Called by NET3 when it "opens" the device.
+ */
+static int wavelan_open(struct net_device * dev)
+{
+	net_local *	lp = (net_local *)dev->priv;
+	unsigned long	flags;
+
+#ifdef DEBUG_CALLBACK_TRACE
+	printk(KERN_DEBUG "%s: ->wavelan_open(dev=0x%x)\n", dev->name,
+	       (unsigned int) dev);
+#endif
+
+	/* Check irq */
+	if (dev->irq == 0) {
+#ifdef DEBUG_CONFIG_ERROR
+		printk(KERN_WARNING "%s: wavelan_open(): no IRQ\n",
+		       dev->name);
+#endif
+		return -ENXIO;
+	}
+
+	if (request_irq(dev->irq, &wavelan_interrupt, 0, "WaveLAN", dev) != 0) 
+	{
+#ifdef DEBUG_CONFIG_ERROR
+		printk(KERN_WARNING "%s: wavelan_open(): invalid IRQ\n",
+		       dev->name);
+#endif
+		return -EAGAIN;
+	}
+
+	spin_lock_irqsave(&lp->spinlock, flags);
+	
+	if (wv_hw_reset(dev) != -1) {
+		netif_start_queue(dev);
+	} else {
+		free_irq(dev->irq, dev);
+#ifdef DEBUG_CONFIG_ERROR
+		printk(KERN_INFO
+		       "%s: wavelan_open(): impossible to start the card\n",
+		       dev->name);
+#endif
+		spin_unlock_irqrestore(&lp->spinlock, flags);
+		return -EAGAIN;
+	}
+	spin_unlock_irqrestore(&lp->spinlock, flags);
+	
+#ifdef DEBUG_CALLBACK_TRACE
+	printk(KERN_DEBUG "%s: <-wavelan_open()\n", dev->name);
+#endif
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Shut down the WaveLAN ISA card.
+ * Called by NET3 when it "closes" the device.
+ */
+static int wavelan_close(struct net_device * dev)
+{
+	net_local *lp = (net_local *) dev->priv;
+	unsigned long flags;
+
+#ifdef DEBUG_CALLBACK_TRACE
+	printk(KERN_DEBUG "%s: ->wavelan_close(dev=0x%x)\n", dev->name,
+	       (unsigned int) dev);
+#endif
+
+	netif_stop_queue(dev);
+
+	/*
+	 * Flush the Tx and disable Rx.
+	 */
+	spin_lock_irqsave(&lp->spinlock, flags);
+	wv_82586_stop(dev);
+	spin_unlock_irqrestore(&lp->spinlock, flags);
+
+	free_irq(dev->irq, dev);
+
+#ifdef DEBUG_CALLBACK_TRACE
+	printk(KERN_DEBUG "%s: <-wavelan_close()\n", dev->name);
+#endif
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Probe an I/O address, and if the WaveLAN is there configure the
+ * device structure
+ * (called by wavelan_probe() and via init_module()).
+ */
+static int __init wavelan_config(struct net_device *dev, unsigned short ioaddr)
+{
+	u8 irq_mask;
+	int irq;
+	net_local *lp;
+	mac_addr mac;
+	int err;
+
+	if (!request_region(ioaddr, sizeof(ha_t), "wavelan"))
+		return -EADDRINUSE;
+
+	err = wv_check_ioaddr(ioaddr, mac);
+	if (err)
+		goto out;
+
+	memcpy(dev->dev_addr, mac, 6);
+
+	dev->base_addr = ioaddr;
+
+#ifdef DEBUG_CALLBACK_TRACE
+	printk(KERN_DEBUG "%s: ->wavelan_config(dev=0x%x, ioaddr=0x%lx)\n",
+	       dev->name, (unsigned int) dev, ioaddr);
+#endif
+
+	/* Check IRQ argument on command line. */
+	if (dev->irq != 0) {
+		irq_mask = wv_irq_to_psa(dev->irq);
+
+		if (irq_mask == 0) {
+#ifdef DEBUG_CONFIG_ERROR
+			printk(KERN_WARNING
+			       "%s: wavelan_config(): invalid IRQ %d ignored.\n",
+			       dev->name, dev->irq);
+#endif
+			dev->irq = 0;
+		} else {
+#ifdef DEBUG_CONFIG_INFO
+			printk(KERN_DEBUG
+			       "%s: wavelan_config(): changing IRQ to %d\n",
+			       dev->name, dev->irq);
+#endif
+			psa_write(ioaddr, HACR_DEFAULT,
+				  psaoff(0, psa_int_req_no), &irq_mask, 1);
+			/* update the Wavelan checksum */
+			update_psa_checksum(dev, ioaddr, HACR_DEFAULT);
+			wv_hacr_reset(ioaddr);
+		}
+	}
+
+	psa_read(ioaddr, HACR_DEFAULT, psaoff(0, psa_int_req_no),
+		 &irq_mask, 1);
+	if ((irq = wv_psa_to_irq(irq_mask)) == -1) {
+#ifdef DEBUG_CONFIG_ERROR
+		printk(KERN_INFO
+		       "%s: wavelan_config(): could not wavelan_map_irq(%d).\n",
+		       dev->name, irq_mask);
+#endif
+		err = -EAGAIN;
+		goto out;
+	}
+
+	dev->irq = irq;
+
+	dev->mem_start = 0x0000;
+	dev->mem_end = 0x0000;
+	dev->if_port = 0;
+
+	/* Initialize device structures */
+	memset(dev->priv, 0, sizeof(net_local));
+	lp = (net_local *) dev->priv;
+
+	/* Back link to the device structure. */
+	lp->dev = dev;
+	/* Add the device at the beginning of the linked list. */
+	lp->next = wavelan_list;
+	wavelan_list = lp;
+
+	lp->hacr = HACR_DEFAULT;
+
+	/* Multicast stuff */
+	lp->promiscuous = 0;
+	lp->mc_count = 0;
+
+	/* Init spinlock */
+	spin_lock_init(&lp->spinlock);
+
+	SET_MODULE_OWNER(dev);
+	dev->open = wavelan_open;
+	dev->stop = wavelan_close;
+	dev->hard_start_xmit = wavelan_packet_xmit;
+	dev->get_stats = wavelan_get_stats;
+	dev->set_multicast_list = &wavelan_set_multicast_list;
+        dev->tx_timeout		= &wavelan_watchdog;
+        dev->watchdog_timeo	= WATCHDOG_JIFFIES;
+#ifdef SET_MAC_ADDRESS
+	dev->set_mac_address = &wavelan_set_mac_address;
+#endif				/* SET_MAC_ADDRESS */
+
+#ifdef WIRELESS_EXT		/* if wireless extension exists in the kernel */
+	dev->wireless_handlers = &wavelan_handler_def;
+	lp->wireless_data.spy_data = &lp->spy_data;
+	dev->wireless_data = &lp->wireless_data;
+#endif
+
+	dev->mtu = WAVELAN_MTU;
+
+	/* Display nice information. */
+	wv_init_info(dev);
+
+#ifdef DEBUG_CALLBACK_TRACE
+	printk(KERN_DEBUG "%s: <-wavelan_config()\n", dev->name);
+#endif
+	return 0;
+out:
+	release_region(ioaddr, sizeof(ha_t));
+	return err;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Check for a network adaptor of this type.  Return '0' iff one 
+ * exists.  There seem to be different interpretations of
+ * the initial value of dev->base_addr.
+ * We follow the example in drivers/net/ne.c.
+ * (called in "Space.c")
+ */
+struct net_device * __init wavelan_probe(int unit)
+{
+	struct net_device *dev;
+	short base_addr;
+	int def_irq;
+	int i;
+	int r = 0;
+
+#ifdef	STRUCT_CHECK
+	if (wv_struct_check() != (char *) NULL) {
+		printk(KERN_WARNING
+		       "%s: wavelan_probe(): structure/compiler botch: \"%s\"\n",
+		       dev->name, wv_struct_check());
+		return -ENODEV;
+	}
+#endif				/* STRUCT_CHECK */
+
+	dev = alloc_etherdev(sizeof(net_local));
+	if (!dev)
+		return ERR_PTR(-ENOMEM);
+
+	sprintf(dev->name, "eth%d", unit);
+	netdev_boot_setup_check(dev);
+	base_addr = dev->base_addr;
+	def_irq = dev->irq;
+
+#ifdef DEBUG_CALLBACK_TRACE
+	printk(KERN_DEBUG
+	       "%s: ->wavelan_probe(dev=%p (base_addr=0x%x))\n",
+	       dev->name, dev, (unsigned int) dev->base_addr);
+#endif
+
+	/* Don't probe at all. */
+	if (base_addr < 0) {
+#ifdef DEBUG_CONFIG_ERROR
+		printk(KERN_WARNING
+		       "%s: wavelan_probe(): invalid base address\n",
+		       dev->name);
+#endif
+		r = -ENXIO;
+	} else if (base_addr > 0x100) { /* Check a single specified location. */
+		r = wavelan_config(dev, base_addr);
+#ifdef DEBUG_CONFIG_INFO
+		if (r != 0)
+			printk(KERN_DEBUG
+			       "%s: wavelan_probe(): no device at specified base address (0x%X) or address already in use\n",
+			       dev->name, base_addr);
+#endif
+
+#ifdef DEBUG_CALLBACK_TRACE
+		printk(KERN_DEBUG "%s: <-wavelan_probe()\n", dev->name);
+#endif
+	} else { /* Scan all possible addresses of the WaveLAN hardware. */
+		for (i = 0; i < NELS(iobase); i++) {
+			dev->irq = def_irq;
+			if (wavelan_config(dev, iobase[i]) == 0) {
+#ifdef DEBUG_CALLBACK_TRACE
+				printk(KERN_DEBUG
+				       "%s: <-wavelan_probe()\n",
+				       dev->name);
+#endif
+				break;
+			}
+		}
+		if (i == NELS(iobase))
+			r = -ENODEV;
+	}
+	if (r) 
+		goto out;
+	r = register_netdev(dev);
+	if (r)
+		goto out1;
+	return dev;
+out1:
+	release_region(dev->base_addr, sizeof(ha_t));
+	wavelan_list = wavelan_list->next;
+out:
+	free_netdev(dev);
+	return ERR_PTR(r);
+}
+
+/****************************** MODULE ******************************/
+/*
+ * Module entry point: insertion and removal
+ */
+
+#ifdef	MODULE
+/*------------------------------------------------------------------*/
+/*
+ * Insertion of the module
+ * I'm now quite proud of the multi-device support.
+ */
+int init_module(void)
+{
+	int ret = -EIO;		/* Return error if no cards found */
+	int i;
+
+#ifdef DEBUG_MODULE_TRACE
+	printk(KERN_DEBUG "-> init_module()\n");
+#endif
+
+	/* If probing is asked */
+	if (io[0] == 0) {
+#ifdef DEBUG_CONFIG_ERROR
+		printk(KERN_WARNING
+		       "WaveLAN init_module(): doing device probing (bad !)\n");
+		printk(KERN_WARNING
+		       "Specify base addresses while loading module to correct the problem\n");
+#endif
+
+		/* Copy the basic set of address to be probed. */
+		for (i = 0; i < NELS(iobase); i++)
+			io[i] = iobase[i];
+	}
+
+
+	/* Loop on all possible base addresses. */
+	i = -1;
+	while ((io[++i] != 0) && (i < NELS(io))) {
+		struct net_device *dev = alloc_etherdev(sizeof(net_local));
+		if (!dev)
+			break;
+		if (name[i])
+			strcpy(dev->name, name[i]);	/* Copy name */
+		dev->base_addr = io[i];
+		dev->irq = irq[i];
+
+		/* Check if there is something at this base address. */
+		if (wavelan_config(dev, io[i]) == 0) {
+			if (register_netdev(dev) != 0) {
+				release_region(dev->base_addr, sizeof(ha_t));
+				wavelan_list = wavelan_list->next;
+			} else {
+				ret = 0;
+				continue;
+			}
+		}
+		free_netdev(dev);
+	}
+
+#ifdef DEBUG_CONFIG_ERROR
+	if (!wavelan_list)
+		printk(KERN_WARNING
+		       "WaveLAN init_module(): no device found\n");
+#endif
+
+#ifdef DEBUG_MODULE_TRACE
+	printk(KERN_DEBUG "<- init_module()\n");
+#endif
+	return ret;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Removal of the module
+ */
+void cleanup_module(void)
+{
+#ifdef DEBUG_MODULE_TRACE
+	printk(KERN_DEBUG "-> cleanup_module()\n");
+#endif
+
+	/* Loop on all devices and release them. */
+	while (wavelan_list) {
+		struct net_device *dev = wavelan_list->dev;
+
+#ifdef DEBUG_CONFIG_INFO
+		printk(KERN_DEBUG
+		       "%s: cleanup_module(): removing device at 0x%x\n",
+		       dev->name, (unsigned int) dev);
+#endif
+		unregister_netdev(dev);
+
+		release_region(dev->base_addr, sizeof(ha_t));
+		wavelan_list = wavelan_list->next;
+
+		free_netdev(dev);
+	}
+
+#ifdef DEBUG_MODULE_TRACE
+	printk(KERN_DEBUG "<- cleanup_module()\n");
+#endif
+}
+#endif				/* MODULE */
+MODULE_LICENSE("GPL");
+
+/*
+ * This software may only be used and distributed
+ * according to the terms of the GNU General Public License.
+ *
+ * This software was developed as a component of the
+ * Linux operating system.
+ * It is based on other device drivers and information
+ * either written or supplied by:
+ *	Ajay Bakre (bakre@paul.rutgers.edu),
+ *	Donald Becker (becker@scyld.com),
+ *	Loeke Brederveld (Loeke.Brederveld@Utrecht.NCR.com),
+ *	Anders Klemets (klemets@it.kth.se),
+ *	Vladimir V. Kolpakov (w@stier.koenig.ru),
+ *	Marc Meertens (Marc.Meertens@Utrecht.NCR.com),
+ *	Pauline Middelink (middelin@polyware.iaf.nl),
+ *	Robert Morris (rtm@das.harvard.edu),
+ *	Jean Tourrilhes (jt@hplb.hpl.hp.com),
+ *	Girish Welling (welling@paul.rutgers.edu),
+ *
+ * Thanks go also to:
+ *	James Ashton (jaa101@syseng.anu.edu.au),
+ *	Alan Cox (alan@redhat.com),
+ *	Allan Creighton (allanc@cs.usyd.edu.au),
+ *	Matthew Geier (matthew@cs.usyd.edu.au),
+ *	Remo di Giovanni (remo@cs.usyd.edu.au),
+ *	Eckhard Grah (grah@wrcs1.urz.uni-wuppertal.de),
+ *	Vipul Gupta (vgupta@cs.binghamton.edu),
+ *	Mark Hagan (mhagan@wtcpost.daytonoh.NCR.COM),
+ *	Tim Nicholson (tim@cs.usyd.edu.au),
+ *	Ian Parkin (ian@cs.usyd.edu.au),
+ *	John Rosenberg (johnr@cs.usyd.edu.au),
+ *	George Rossi (george@phm.gov.au),
+ *	Arthur Scott (arthur@cs.usyd.edu.au),
+ *	Peter Storey,
+ * for their assistance and advice.
+ *
+ * Please send bug reports, updates, comments to:
+ *
+ * Bruce Janson                                    Email:  bruce@cs.usyd.edu.au
+ * Basser Department of Computer Science           Phone:  +61-2-9351-3423
+ * University of Sydney, N.S.W., 2006, AUSTRALIA   Fax:    +61-2-9351-3838
+ */
diff --git a/drivers/net/wireless/wavelan.h b/drivers/net/wireless/wavelan.h
new file mode 100644
index 0000000..27172cd
--- /dev/null
+++ b/drivers/net/wireless/wavelan.h
@@ -0,0 +1,370 @@
+/*
+ *	WaveLAN ISA driver
+ *
+ *		Jean II - HPLB '96
+ *
+ * Reorganisation and extension of the driver.
+ * Original copyright follows. See wavelan.p.h for details.
+ *
+ * This file contains the declarations for the WaveLAN hardware. Note that
+ * the WaveLAN ISA includes a i82586 controller (see definitions in
+ * file i82586.h).
+ *
+ * The main difference between the ISA hardware and the PCMCIA one is
+ * the Ethernet controller (i82586 instead of i82593).
+ * The i82586 allows multiple transmit buffers.  The PSA needs to be accessed
+ * through the host interface.
+ */
+
+#ifndef _WAVELAN_H
+#define	_WAVELAN_H
+
+/************************** MAGIC NUMBERS ***************************/
+
+/* Detection of the WaveLAN card is done by reading the MAC
+ * address from the card and checking it.  If you have a non-AT&T
+ * product (OEM, like DEC RoamAbout, Digital Ocean, or Epson),
+ * you might need to modify this part to accommodate your hardware.
+ */
+static const char	MAC_ADDRESSES[][3] =
+{
+  { 0x08, 0x00, 0x0E },		/* AT&T WaveLAN (standard) & DEC RoamAbout */
+  { 0x08, 0x00, 0x6A },		/* AT&T WaveLAN (alternate) */
+  { 0x00, 0x00, 0xE1 },		/* Hitachi Wavelan */
+  { 0x00, 0x60, 0x1D }		/* Lucent Wavelan (another one) */
+  /* Add your card here and send me the patch! */
+};
+
+#define WAVELAN_ADDR_SIZE	6	/* Size of a MAC address */
+
+#define WAVELAN_MTU		1500	/* Maximum size of WaveLAN packet */
+
+#define	MAXDATAZ		(WAVELAN_ADDR_SIZE + WAVELAN_ADDR_SIZE + 2 + WAVELAN_MTU)
+
+/*
+ * Constants used to convert channels to frequencies
+ */
+
+/* Frequency available in the 2.0 modem, in units of 250 kHz
+ * (as read in the offset register of the dac area).
+ * Used to map channel numbers used by `wfreqsel' to frequencies
+ */
+static const short	channel_bands[] = { 0x30, 0x58, 0x64, 0x7A, 0x80, 0xA8,
+				    0xD0, 0xF0, 0xF8, 0x150 };
+
+/* Frequencies of the 1.0 modem (fixed frequencies).
+ * Use to map the PSA `subband' to a frequency
+ * Note : all frequencies apart from the first one need to be multiplied by 10
+ */
+static const int	fixed_bands[] = { 915e6, 2.425e8, 2.46e8, 2.484e8, 2.4305e8 };
+
+
+
+/*************************** PC INTERFACE ****************************/
+
+/*
+ * Host Adaptor structure.
+ * (base is board port address).
+ */
+typedef union hacs_u	hacs_u;
+union hacs_u
+{
+	unsigned short	hu_command;		/* Command register */
+#define		HACR_RESET		0x0001	/* Reset board */
+#define		HACR_CA			0x0002	/* Set Channel Attention for 82586 */
+#define		HACR_16BITS		0x0004	/* 16-bit operation (0 => 8bits) */
+#define		HACR_OUT0		0x0008	/* General purpose output pin 0 */
+						/* not used - must be 1 */
+#define		HACR_OUT1		0x0010	/* General purpose output pin 1 */
+						/* not used - must be 1 */
+#define		HACR_82586_INT_ENABLE	0x0020	/* Enable 82586 interrupts */
+#define		HACR_MMC_INT_ENABLE	0x0040	/* Enable MMC interrupts */
+#define		HACR_INTR_CLR_ENABLE	0x0080	/* Enable interrupt status read/clear */
+	unsigned short	hu_status;		/* Status Register */
+#define		HASR_82586_INTR		0x0001	/* Interrupt request from 82586 */
+#define		HASR_MMC_INTR		0x0002	/* Interrupt request from MMC */
+#define		HASR_MMC_BUSY		0x0004	/* MMC busy indication */
+#define		HASR_PSA_BUSY		0x0008	/* LAN parameter storage area busy */
+};
+
+typedef struct ha_t	ha_t;
+struct ha_t
+{
+	hacs_u		ha_cs;		/* Command and status registers */
+#define 		ha_command	ha_cs.hu_command
+#define 		ha_status	ha_cs.hu_status
+	unsigned short	ha_mmcr;	/* Modem Management Ctrl Register */
+	unsigned short	ha_pior0;	/* Program I/O Address Register Port 0 */
+	unsigned short	ha_piop0;	/* Program I/O Port 0 */
+	unsigned short	ha_pior1;	/* Program I/O Address Register Port 1 */
+	unsigned short	ha_piop1;	/* Program I/O Port 1 */
+	unsigned short	ha_pior2;	/* Program I/O Address Register Port 2 */
+	unsigned short	ha_piop2;	/* Program I/O Port 2 */
+};
+
+#define HA_SIZE		16
+
+#define	hoff(p,f) 	(unsigned short)((void *)(&((ha_t *)((void *)0 + (p)))->f) - (void *)0)
+#define	HACR(p)		hoff(p, ha_command)
+#define	HASR(p)		hoff(p, ha_status)
+#define	MMCR(p)		hoff(p, ha_mmcr)
+#define	PIOR0(p)	hoff(p, ha_pior0)
+#define	PIOP0(p)	hoff(p, ha_piop0)
+#define	PIOR1(p)	hoff(p, ha_pior1)
+#define	PIOP1(p)	hoff(p, ha_piop1)
+#define	PIOR2(p)	hoff(p, ha_pior2)
+#define	PIOP2(p)	hoff(p, ha_piop2)
+
+/*
+ * Program I/O Mode Register values.
+ */
+#define STATIC_PIO		0	/* Mode 1: static mode */
+					/* RAM access ??? */
+#define AUTOINCR_PIO		1	/* Mode 2: auto increment mode */
+					/* RAM access ??? */
+#define AUTODECR_PIO		2	/* Mode 3: auto decrement mode */
+					/* RAM access ??? */
+#define PARAM_ACCESS_PIO	3	/* Mode 4: LAN parameter access mode */
+					/* Parameter access. */
+#define PIO_MASK		3	/* register mask */
+#define PIOM(cmd,piono)		((u_short)cmd << 10 << (piono * 2))
+
+#define	HACR_DEFAULT		(HACR_OUT0 | HACR_OUT1 | HACR_16BITS | PIOM(STATIC_PIO, 0) | PIOM(AUTOINCR_PIO, 1) | PIOM(PARAM_ACCESS_PIO, 2))
+#define	HACR_INTRON		(HACR_82586_INT_ENABLE | HACR_MMC_INT_ENABLE | HACR_INTR_CLR_ENABLE)
+
+/************************** MEMORY LAYOUT **************************/
+
+/*
+ * Onboard 64 k RAM layout.
+ * (Offsets from 0x0000.)
+ */
+#define OFFSET_RU		0x0000		/* 75% memory */
+#define OFFSET_CU		0xC000		/* 25% memory */
+#define OFFSET_SCB		(OFFSET_ISCP - sizeof(scb_t))
+#define OFFSET_ISCP		(OFFSET_SCP - sizeof(iscp_t))
+#define OFFSET_SCP		I82586_SCP_ADDR
+
+#define	RXBLOCKZ		(sizeof(fd_t) + sizeof(rbd_t) + MAXDATAZ)
+#define	TXBLOCKZ		(sizeof(ac_tx_t) + sizeof(ac_nop_t) + sizeof(tbd_t) + MAXDATAZ)
+
+#define	NRXBLOCKS		((OFFSET_CU - OFFSET_RU) / RXBLOCKZ)
+#define	NTXBLOCKS		((OFFSET_SCB - OFFSET_CU) / TXBLOCKZ)
+
+/********************** PARAMETER STORAGE AREA **********************/
+
+/*
+ * Parameter Storage Area (PSA).
+ */
+typedef struct psa_t	psa_t;
+struct psa_t
+{
+  unsigned char	psa_io_base_addr_1;	/* [0x00] Base address 1 ??? */
+  unsigned char	psa_io_base_addr_2;	/* [0x01] Base address 2 */
+  unsigned char	psa_io_base_addr_3;	/* [0x02] Base address 3 */
+  unsigned char	psa_io_base_addr_4;	/* [0x03] Base address 4 */
+  unsigned char	psa_rem_boot_addr_1;	/* [0x04] Remote Boot Address 1 */
+  unsigned char	psa_rem_boot_addr_2;	/* [0x05] Remote Boot Address 2 */
+  unsigned char	psa_rem_boot_addr_3;	/* [0x06] Remote Boot Address 3 */
+  unsigned char	psa_holi_params;	/* [0x07] HOst Lan Interface (HOLI) Parameters */
+  unsigned char	psa_int_req_no;		/* [0x08] Interrupt Request Line */
+  unsigned char	psa_unused0[7];		/* [0x09-0x0F] unused */
+
+  unsigned char	psa_univ_mac_addr[WAVELAN_ADDR_SIZE];	/* [0x10-0x15] Universal (factory) MAC Address */
+  unsigned char	psa_local_mac_addr[WAVELAN_ADDR_SIZE];	/* [0x16-1B] Local MAC Address */
+  unsigned char	psa_univ_local_sel;	/* [0x1C] Universal Local Selection */
+#define		PSA_UNIVERSAL	0		/* Universal (factory) */
+#define		PSA_LOCAL	1		/* Local */
+  unsigned char	psa_comp_number;	/* [0x1D] Compatibility Number:	 */
+#define		PSA_COMP_PC_AT_915	0 	/* PC-AT 915 MHz 	 */
+#define		PSA_COMP_PC_MC_915	1 	/* PC-MC 915 MHz	 */
+#define		PSA_COMP_PC_AT_2400	2 	/* PC-AT 2.4 GHz	 */
+#define		PSA_COMP_PC_MC_2400	3 	/* PC-MC 2.4 GHz 	 */
+#define		PSA_COMP_PCMCIA_915	4 	/* PCMCIA 915 MHz or 2.0 */
+  unsigned char	psa_thr_pre_set;	/* [0x1E] Modem Threshold Preset */
+  unsigned char	psa_feature_select;	/* [0x1F] Call code required (1=on) */
+#define		PSA_FEATURE_CALL_CODE	0x01 	/* Call code required (Japan) */
+  unsigned char	psa_subband;		/* [0x20] Subband	  */
+#define		PSA_SUBBAND_915		0	/* 915 MHz or 2.0 */
+#define		PSA_SUBBAND_2425	1	/* 2425 MHz	  */
+#define		PSA_SUBBAND_2460	2	/* 2460 MHz	  */
+#define		PSA_SUBBAND_2484	3	/* 2484 MHz	  */
+#define		PSA_SUBBAND_2430_5	4	/* 2430.5 MHz	  */
+  unsigned char	psa_quality_thr;	/* [0x21] Modem Quality Threshold */
+  unsigned char	psa_mod_delay;		/* [0x22] Modem Delay (?) (reserved) */
+  unsigned char	psa_nwid[2];		/* [0x23-0x24] Network ID */
+  unsigned char	psa_nwid_select;	/* [0x25] Network ID Select On/Off */
+  unsigned char	psa_encryption_select;	/* [0x26] Encryption On/Off */
+  unsigned char	psa_encryption_key[8];	/* [0x27-0x2E] Encryption Key */
+  unsigned char	psa_databus_width;	/* [0x2F] AT bus width select 8/16 */
+  unsigned char	psa_call_code[8];	/* [0x30-0x37] (Japan) Call Code */
+  unsigned char	psa_nwid_prefix[2];	/* [0x38-0x39] Roaming domain */
+  unsigned char	psa_reserved[2];	/* [0x3A-0x3B] Reserved - fixed 00 */
+  unsigned char	psa_conf_status;	/* [0x3C] Conf Status, bit 0=1:config*/
+  unsigned char	psa_crc[2];		/* [0x3D] CRC-16 over PSA */
+  unsigned char	psa_crc_status;		/* [0x3F] CRC Valid Flag */
+};
+
+#define	PSA_SIZE	64
+
+/* Calculate offset of a field in the above structure.
+ * Warning:  only even addresses are used. */
+#define	psaoff(p,f) 	((unsigned short) ((void *)(&((psa_t *) ((void *) NULL + (p)))->f) - (void *) NULL))
+
+/******************** MODEM MANAGEMENT INTERFACE ********************/
+
+/*
+ * Modem Management Controller (MMC) write structure.
+ */
+typedef struct mmw_t	mmw_t;
+struct mmw_t
+{
+  unsigned char	mmw_encr_key[8];	/* encryption key */
+  unsigned char	mmw_encr_enable;	/* Enable or disable encryption. */
+#define	MMW_ENCR_ENABLE_MODE	0x02	/* mode of security option */
+#define	MMW_ENCR_ENABLE_EN	0x01	/* Enable security option. */
+  unsigned char	mmw_unused0[1];		/* unused */
+  unsigned char	mmw_des_io_invert;	/* encryption option */
+#define	MMW_DES_IO_INVERT_RES	0x0F	/* reserved */
+#define	MMW_DES_IO_INVERT_CTRL	0xF0	/* control (?) (set to 0) */
+  unsigned char	mmw_unused1[5];		/* unused */
+  unsigned char	mmw_loopt_sel;		/* looptest selection */
+#define	MMW_LOOPT_SEL_DIS_NWID	0x40	/* Disable NWID filtering. */
+#define	MMW_LOOPT_SEL_INT	0x20	/* Activate Attention Request. */
+#define	MMW_LOOPT_SEL_LS	0x10	/* looptest, no collision avoidance */
+#define MMW_LOOPT_SEL_LT3A	0x08	/* looptest 3a */
+#define	MMW_LOOPT_SEL_LT3B	0x04	/* looptest 3b */
+#define	MMW_LOOPT_SEL_LT3C	0x02	/* looptest 3c */
+#define	MMW_LOOPT_SEL_LT3D	0x01	/* looptest 3d */
+  unsigned char	mmw_jabber_enable;	/* jabber timer enable */
+  /* Abort transmissions > 200 ms */
+  unsigned char	mmw_freeze;		/* freeze or unfreeze signal level */
+  /* 0 : signal level & qual updated for every new message, 1 : frozen */
+  unsigned char	mmw_anten_sel;		/* antenna selection */
+#define MMW_ANTEN_SEL_SEL	0x01	/* direct antenna selection */
+#define	MMW_ANTEN_SEL_ALG_EN	0x02	/* antenna selection algo. enable */
+  unsigned char	mmw_ifs;		/* inter frame spacing */
+  /* min time between transmission in bit periods (.5 us) - bit 0 ignored */
+  unsigned char	mmw_mod_delay;	 	/* modem delay (synchro) */
+  unsigned char	mmw_jam_time;		/* jamming time (after collision) */
+  unsigned char	mmw_unused2[1];		/* unused */
+  unsigned char	mmw_thr_pre_set;	/* level threshold preset */
+  /* Discard all packet with signal < this value (4) */
+  unsigned char	mmw_decay_prm;		/* decay parameters */
+  unsigned char	mmw_decay_updat_prm;	/* decay update parameters */
+  unsigned char	mmw_quality_thr;	/* quality (z-quotient) threshold */
+  /* Discard all packet with quality < this value (3) */
+  unsigned char	mmw_netw_id_l;		/* NWID low order byte */
+  unsigned char	mmw_netw_id_h;		/* NWID high order byte */
+  /* Network ID or Domain : create virtual net on the air */
+
+  /* 2.0 Hardware extension - frequency selection support */
+  unsigned char	mmw_mode_select;	/* for analog tests (set to 0) */
+  unsigned char	mmw_unused3[1];		/* unused */
+  unsigned char	mmw_fee_ctrl;		/* frequency EEPROM control */
+#define	MMW_FEE_CTRL_PRE	0x10	/* Enable protected instructions. */
+#define	MMW_FEE_CTRL_DWLD	0x08	/* Download EEPROM to mmc. */
+#define	MMW_FEE_CTRL_CMD	0x07	/* EEPROM commands:  */
+#define	MMW_FEE_CTRL_READ	0x06	/* Read */
+#define	MMW_FEE_CTRL_WREN	0x04	/* Write enable */
+#define	MMW_FEE_CTRL_WRITE	0x05	/* Write data to address. */
+#define	MMW_FEE_CTRL_WRALL	0x04	/* Write data to all addresses. */
+#define	MMW_FEE_CTRL_WDS	0x04	/* Write disable */
+#define	MMW_FEE_CTRL_PRREAD	0x16	/* Read addr from protect register */
+#define	MMW_FEE_CTRL_PREN	0x14	/* Protect register enable */
+#define	MMW_FEE_CTRL_PRCLEAR	0x17	/* Unprotect all registers. */
+#define	MMW_FEE_CTRL_PRWRITE	0x15	/* Write address in protect register */
+#define	MMW_FEE_CTRL_PRDS	0x14	/* Protect register disable */
+  /* Never issue the PRDS command:  it's irreversible! */
+
+  unsigned char	mmw_fee_addr;		/* EEPROM address */
+#define	MMW_FEE_ADDR_CHANNEL	0xF0	/* Select the channel. */
+#define	MMW_FEE_ADDR_OFFSET	0x0F	/* Offset in channel data */
+#define	MMW_FEE_ADDR_EN		0xC0	/* FEE_CTRL enable operations */
+#define	MMW_FEE_ADDR_DS		0x00	/* FEE_CTRL disable operations */
+#define	MMW_FEE_ADDR_ALL	0x40	/* FEE_CTRL all operations */
+#define	MMW_FEE_ADDR_CLEAR	0xFF	/* FEE_CTRL clear operations */
+
+  unsigned char	mmw_fee_data_l;		/* Write data to EEPROM. */
+  unsigned char	mmw_fee_data_h;		/* high octet */
+  unsigned char	mmw_ext_ant;		/* Setting for external antenna */
+#define	MMW_EXT_ANT_EXTANT	0x01	/* Select external antenna */
+#define	MMW_EXT_ANT_POL		0x02	/* Polarity of the antenna */
+#define	MMW_EXT_ANT_INTERNAL	0x00	/* Internal antenna */
+#define	MMW_EXT_ANT_EXTERNAL	0x03	/* External antenna */
+#define	MMW_EXT_ANT_IQ_TEST	0x1C	/* IQ test pattern (set to 0) */
+};
+
+#define	MMW_SIZE	37
+
+#define	mmwoff(p,f) 	(unsigned short)((void *)(&((mmw_t *)((void *)0 + (p)))->f) - (void *)0)
+
+/*
+ * Modem Management Controller (MMC) read structure.
+ */
+typedef struct mmr_t	mmr_t;
+struct mmr_t
+{
+  unsigned char	mmr_unused0[8];		/* unused */
+  unsigned char	mmr_des_status;		/* encryption status */
+  unsigned char	mmr_des_avail;		/* encryption available (0x55 read) */
+#define	MMR_DES_AVAIL_DES	0x55		/* DES available */
+#define	MMR_DES_AVAIL_AES	0x33		/* AES (AT&T) available */
+  unsigned char	mmr_des_io_invert;	/* des I/O invert register */
+  unsigned char	mmr_unused1[5];		/* unused */
+  unsigned char	mmr_dce_status;		/* DCE status */
+#define	MMR_DCE_STATUS_RX_BUSY		0x01	/* receiver busy */
+#define	MMR_DCE_STATUS_LOOPT_IND	0x02	/* loop test indicated */
+#define	MMR_DCE_STATUS_TX_BUSY		0x04	/* transmitter on */
+#define	MMR_DCE_STATUS_JBR_EXPIRED	0x08	/* jabber timer expired */
+#define MMR_DCE_STATUS			0x0F	/* mask to get the bits */
+  unsigned char	mmr_dsp_id;		/* DSP ID (AA = Daedalus rev A) */
+  unsigned char	mmr_unused2[2];		/* unused */
+  unsigned char	mmr_correct_nwid_l;	/* # of correct NWIDs rxd (low) */
+  unsigned char	mmr_correct_nwid_h;	/* # of correct NWIDs rxd (high) */
+  /* Warning:  read high-order octet first! */
+  unsigned char	mmr_wrong_nwid_l;	/* # of wrong NWIDs rxd (low) */
+  unsigned char	mmr_wrong_nwid_h;	/* # of wrong NWIDs rxd (high) */
+  unsigned char	mmr_thr_pre_set;	/* level threshold preset */
+#define	MMR_THR_PRE_SET		0x3F		/* level threshold preset */
+#define	MMR_THR_PRE_SET_CUR	0x80		/* Current signal above it */
+  unsigned char	mmr_signal_lvl;		/* signal level */
+#define	MMR_SIGNAL_LVL		0x3F		/* signal level */
+#define	MMR_SIGNAL_LVL_VALID	0x80		/* Updated since last read */
+  unsigned char	mmr_silence_lvl;	/* silence level (noise) */
+#define	MMR_SILENCE_LVL		0x3F		/* silence level */
+#define	MMR_SILENCE_LVL_VALID	0x80		/* Updated since last read */
+  unsigned char	mmr_sgnl_qual;		/* signal quality */
+#define	MMR_SGNL_QUAL		0x0F		/* signal quality */
+#define	MMR_SGNL_QUAL_ANT	0x80		/* current antenna used */
+  unsigned char	mmr_netw_id_l;		/* NWID low order byte (?) */
+  unsigned char	mmr_unused3[3];		/* unused */
+
+  /* 2.0 Hardware extension - frequency selection support */
+  unsigned char	mmr_fee_status;		/* Status of frequency EEPROM */
+#define	MMR_FEE_STATUS_ID	0xF0		/* Modem revision ID */
+#define	MMR_FEE_STATUS_DWLD	0x08		/* Download in progress */
+#define	MMR_FEE_STATUS_BUSY	0x04		/* EEPROM busy */
+  unsigned char	mmr_unused4[1];		/* unused */
+  unsigned char	mmr_fee_data_l;		/* Read data from EEPROM (low) */
+  unsigned char	mmr_fee_data_h;		/* Read data from EEPROM (high) */
+};
+
+#define	MMR_SIZE	36
+
+#define	mmroff(p,f) 	(unsigned short)((void *)(&((mmr_t *)((void *)0 + (p)))->f) - (void *)0)
+
+/* Make the two above structures one */
+typedef union mm_t
+{
+  struct mmw_t	w;	/* Write to the mmc */
+  struct mmr_t	r;	/* Read from the mmc */
+} mm_t;
+
+#endif /* _WAVELAN_H */
+
+/*
+ * This software may only be used and distributed
+ * according to the terms of the GNU General Public License.
+ *
+ * For more details, see wavelan.c.
+ */
diff --git a/drivers/net/wireless/wavelan.p.h b/drivers/net/wireless/wavelan.p.h
new file mode 100644
index 0000000..509ff22
--- /dev/null
+++ b/drivers/net/wireless/wavelan.p.h
@@ -0,0 +1,716 @@
+/*
+ *	WaveLAN ISA driver
+ *
+ *		Jean II - HPLB '96
+ *
+ * Reorganisation and extension of the driver.
+ *
+ * This file contains all definitions and declarations necessary for the
+ * WaveLAN ISA driver.  This file is a private header, so it should
+ * be included only in wavelan.c!
+ */
+
+#ifndef WAVELAN_P_H
+#define WAVELAN_P_H
+
+/************************** DOCUMENTATION ***************************/
+/*
+ * This driver provides a Linux interface to the WaveLAN ISA hardware.
+ * The WaveLAN is a product of Lucent (http://www.wavelan.com/).
+ * This division was formerly part of NCR and then AT&T.
+ * WaveLANs are also distributed by DEC (RoamAbout DS) and Digital Ocean.
+ *
+ * To learn how to use this driver, read the NET3 HOWTO.
+ * If you want to exploit the many other functionalities, read the comments
+ * in the code.
+ *
+ * This driver is the result of the effort of many people (see below).
+ */
+
+/* ------------------------ SPECIFIC NOTES ------------------------ */
+/*
+ * Web page
+ * --------
+ *	I try to maintain a web page with the Wireless LAN Howto at :
+ *	    http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/Wavelan.html
+ *
+ * SMP
+ * ---
+ *	We now are SMP compliant (I eventually fixed the remaining bugs).
+ *	The driver has been tested on a dual P6-150 and survived my usual
+ *	set of torture tests.
+ *	Anyway, I spent enough time chasing interrupt re-entrancy during
+ *	errors or reconfigure, and I designed the locked/unlocked sections
+ *	of the driver with great care, and with the recent addition of
+ *	the spinlock (thanks to the new API), we should be quite close to
+ *	the truth.
+ *	The SMP/IRQ locking is quite coarse and conservative (i.e. not fast),
+ *	but better safe than sorry (especially at 2 Mb/s ;-).
+ *
+ *	I have also looked into disabling only our interrupt on the card
+ *	(via HACR) instead of all interrupts in the processor (via cli),
+ *	so that other driver are not impacted, and it look like it's
+ *	possible, but it's very tricky to do right (full of races). As
+ *	the gain would be mostly for SMP systems, it can wait...
+ *
+ * Debugging and options
+ * ---------------------
+ *	You will find below a set of '#define" allowing a very fine control
+ *	on the driver behaviour and the debug messages printed.
+ *	The main options are :
+ *	o SET_PSA_CRC, to have your card correctly recognised by
+ *	  an access point and the Point-to-Point diagnostic tool.
+ *	o USE_PSA_CONFIG, to read configuration from the PSA (EEprom)
+ *	  (otherwise we always start afresh with some defaults)
+ *
+ * wavelan.o is too darned big
+ * ---------------------------
+ *	That's true!  There is a very simple way to reduce the driver
+ *	object by 33%!  Comment out the following line:
+ *		#include <linux/wireless.h>
+ *	Other compile options can also reduce the size of it...
+ *
+ * MAC address and hardware detection:
+ * -----------------------------------
+ *	The detection code for the WaveLAN checks that the first three
+ *	octets of the MAC address fit the company code.  This type of
+ *	detection works well for AT&T cards (because the AT&T code is
+ *	hardcoded in wavelan.h), but of course will fail for other
+ *	manufacturers.
+ *
+ *	If you are sure that your card is derived from the WaveLAN,
+ *	here is the way to configure it:
+ *	1) Get your MAC address
+ *		a) With your card utilities (wfreqsel, instconf, etc.)
+ *		b) With the driver:
+ *			o compile the kernel with DEBUG_CONFIG_INFO enabled
+ *			o Boot and look the card messages
+ *	2) Set your MAC code (3 octets) in MAC_ADDRESSES[][3] (wavelan.h)
+ *	3) Compile and verify
+ *	4) Send me the MAC code.  I will include it in the next version.
+ *
+ */
+
+/* --------------------- WIRELESS EXTENSIONS --------------------- */
+/*
+ * This driver is the first to support "wireless extensions".
+ * This set of extensions provides a standard way to control the wireless
+ * characteristics of the hardware.  Applications such as mobile IP may
+ * take advantage of it.
+ *
+ * You will need to enable the CONFIG_NET_RADIO define in the kernel
+ * configuration to enable the wireless extensions (this is the one
+ * giving access to the radio network device choice).
+ *
+ * It might also be a good idea as well to fetch the wireless tools to
+ * configure the device and play a bit.
+ */
+
+/* ---------------------------- FILES ---------------------------- */
+/*
+ * wavelan.c:		actual code for the driver:  C functions
+ *
+ * wavelan.p.h:		private header:  local types and variables for driver
+ *
+ * wavelan.h:		description of the hardware interface and structs
+ *
+ * i82586.h:		description of the Ethernet controller
+ */
+
+/* --------------------------- HISTORY --------------------------- */
+/*
+ * This is based on information in the drivers' headers. It may not be
+ * accurate, and I guarantee only my best effort.
+ *
+ * The history of the WaveLAN drivers is as complicated as the history of
+ * the WaveLAN itself (NCR -> AT&T -> Lucent).
+ *
+ * It all started with Anders Klemets <klemets@paul.rutgers.edu>
+ * writing a WaveLAN ISA driver for the Mach microkernel.  Girish
+ * Welling <welling@paul.rutgers.edu> had also worked on it.
+ * Keith Moore modified this for the PCMCIA hardware.
+ * 
+ * Robert Morris <rtm@das.harvard.edu> ported these two drivers to BSDI
+ * and added specific PCMCIA support (there is currently no equivalent
+ * of the PCMCIA package under BSD).
+ *
+ * Jim Binkley <jrb@cs.pdx.edu> ported both BSDI drivers to FreeBSD.
+ *
+ * Bruce Janson <bruce@cs.usyd.edu.au> ported the BSDI ISA driver to Linux.
+ *
+ * Anthony D. Joseph <adj@lcs.mit.edu> started to modify Bruce's driver
+ * (with help of the BSDI PCMCIA driver) for PCMCIA.
+ * Yunzhou Li <yunzhou@strat.iol.unh.edu> finished this work.
+ * Joe Finney <joe@comp.lancs.ac.uk> patched the driver to start
+ * 2.00 cards correctly (2.4 GHz with frequency selection).
+ * David Hinds <dahinds@users.sourceforge.net> integrated the whole in his
+ * PCMCIA package (and bug corrections).
+ *
+ * I (Jean Tourrilhes - jt@hplb.hpl.hp.com) then started to make some
+ * patches to the PCMCIA driver.  Later, I added code in the ISA driver
+ * for Wireless Extensions and full support of frequency selection
+ * cards.  Then, I did the same to the PCMCIA driver, and did some
+ * reorganisation.  Finally, I came back to the ISA driver to
+ * upgrade it at the same level as the PCMCIA one and reorganise
+ * the code.
+ * Loeke Brederveld <lbrederv@wavelan.com> from Lucent has given me
+ * much needed information on the WaveLAN hardware.
+ */
+
+/* The original copyrights and literature mention others' names and
+ * credits.  I don't know what their part in this development was.
+ */
+
+/* By the way, for the copyright and legal stuff:
+ * almost everybody wrote code under the GNU or BSD license (or similar),
+ * and want their original copyright to remain somewhere in the
+ * code (for myself, I go with the GPL).
+ * Nobody wants to take responsibility for anything, except the fame.
+ */
+
+/* --------------------------- CREDITS --------------------------- */
+/*
+ * This software was developed as a component of the
+ * Linux operating system.
+ * It is based on other device drivers and information
+ * either written or supplied by:
+ *	Ajay Bakre <bakre@paul.rutgers.edu>,
+ *	Donald Becker <becker@cesdis.gsfc.nasa.gov>,
+ *	Loeke Brederveld <Loeke.Brederveld@Utrecht.NCR.com>,
+ *	Brent Elphick <belphick@uwaterloo.ca>,
+ *	Anders Klemets <klemets@it.kth.se>,
+ *	Vladimir V. Kolpakov <w@stier.koenig.ru>,
+ *	Marc Meertens <Marc.Meertens@Utrecht.NCR.com>,
+ *	Pauline Middelink <middelin@polyware.iaf.nl>,
+ *	Robert Morris <rtm@das.harvard.edu>,
+ *	Jean Tourrilhes <jt@hpl.hp.com>,
+ *	Girish Welling <welling@paul.rutgers.edu>,
+ *	Clark Woodworth <clark@hiway1.exit109.com>
+ *	Yongguang Zhang <ygz@isl.hrl.hac.com>
+ *
+ * Thanks go also to:
+ *	James Ashton <jaa101@syseng.anu.edu.au>,
+ *	Alan Cox <alan@redhat.com>,
+ *	Allan Creighton <allanc@cs.usyd.edu.au>,
+ *	Matthew Geier <matthew@cs.usyd.edu.au>,
+ *	Remo di Giovanni <remo@cs.usyd.edu.au>,
+ *	Eckhard Grah <grah@wrcs1.urz.uni-wuppertal.de>,
+ *	Vipul Gupta <vgupta@cs.binghamton.edu>,
+ *	Mark Hagan <mhagan@wtcpost.daytonoh.NCR.COM>,
+ *	Tim Nicholson <tim@cs.usyd.edu.au>,
+ *	Ian Parkin <ian@cs.usyd.edu.au>,
+ *	John Rosenberg <johnr@cs.usyd.edu.au>,
+ *	George Rossi <george@phm.gov.au>,
+ *	Arthur Scott <arthur@cs.usyd.edu.au>,
+ *	Stanislav Sinyagin <stas@isf.ru>
+ *	and Peter Storey for their assistance and advice.
+ *
+ * Additional Credits:
+ *
+ *	My development has been done initially under Debian 1.1 (Linux 2.0.x)
+ *	and now	under Debian 2.2, initially with an HP Vectra XP/60, and now
+ *	an HP Vectra XP/90.
+ *
+ */
+
+/* ------------------------- IMPROVEMENTS ------------------------- */
+/*
+ * I proudly present:
+ *
+ * Changes made in first pre-release:
+ * ----------------------------------
+ *	- reorganisation of the code, function name change
+ *	- creation of private header (wavelan.p.h)
+ *	- reorganised debug messages
+ *	- more comments, history, etc.
+ *	- mmc_init:  configure the PSA if not done
+ *	- mmc_init:  correct default value of level threshold for PCMCIA
+ *	- mmc_init:  2.00 detection better code for 2.00 initialization
+ *	- better info at startup
+ *	- IRQ setting (note:  this setting is permanent)
+ *	- watchdog:  change strategy (and solve module removal problems)
+ *	- add wireless extensions (ioctl and get_wireless_stats)
+ *	  get/set nwid/frequency on fly, info for /proc/net/wireless
+ *	- more wireless extensions:  SETSPY and GETSPY
+ *	- make wireless extensions optional
+ *	- private ioctl to set/get quality and level threshold, histogram
+ *	- remove /proc/net/wavelan
+ *	- suppress useless stuff from lp (net_local)
+ *	- kernel 2.1 support (copy_to/from_user instead of memcpy_to/fromfs)
+ *	- add message level (debug stuff in /var/adm/debug and errors not
+ *	  displayed at console and still in /var/adm/messages)
+ *	- multi device support
+ *	- start fixing the probe (init code)
+ *	- more inlines
+ *	- man page
+ *	- many other minor details and cleanups
+ *
+ * Changes made in second pre-release:
+ * -----------------------------------
+ *	- clean up init code (probe and module init)
+ *	- better multiple device support (module)
+ *	- name assignment (module)
+ *
+ * Changes made in third pre-release:
+ * ----------------------------------
+ *	- be more conservative on timers
+ *	- preliminary support for multicast (I still lack some details)
+ *
+ * Changes made in fourth pre-release:
+ * -----------------------------------
+ *	- multicast (revisited and finished)
+ *	- avoid reset in set_multicast_list (a really big hack)
+ *	  if somebody could apply this code for other i82586 based drivers
+ *	- share onboard memory 75% RU and 25% CU (instead of 50/50)
+ *
+ * Changes made for release in 2.1.15:
+ * -----------------------------------
+ *	- change the detection code for multi manufacturer code support
+ *
+ * Changes made for release in 2.1.17:
+ * -----------------------------------
+ *	- update to wireless extensions changes
+ *	- silly bug in card initial configuration (psa_conf_status)
+ *
+ * Changes made for release in 2.1.27 & 2.0.30:
+ * --------------------------------------------
+ *	- small bug in debug code (probably not the last one...)
+ *	- remove extern keyword for wavelan_probe()
+ *	- level threshold is now a standard wireless extension (version 4 !)
+ *	- modules parameters types (new module interface)
+ *
+ * Changes made for release in 2.1.36:
+ * -----------------------------------
+ *	- byte count stats (courtesy of David Hinds)
+ *	- remove dev_tint stuff (courtesy of David Hinds)
+ *	- encryption setting from Brent Elphick (thanks a lot!)
+ *	- 'ioaddr' to 'u_long' for the Alpha (thanks to Stanislav Sinyagin)
+ *
+ * Other changes (not by me) :
+ * -------------------------
+ *	- Spelling and gramar "rectification".
+ *
+ * Changes made for release in 2.0.37 & 2.2.2 :
+ * ------------------------------------------
+ *	- Correct status in /proc/net/wireless
+ *	- Set PSA CRC to make PtP diagnostic tool happy (Bob Gray)
+ *	- Module init code don't fail if we found at least one card in
+ *	  the address list (Karlis Peisenieks)
+ *	- Missing parenthesis (Christopher Peterson)
+ *	- Correct i82586 configuration parameters
+ *	- Encryption initialisation bug (Robert McCormack)
+ *	- New mac addresses detected in the probe
+ *	- Increase watchdog for busy environments
+ *
+ * Changes made for release in 2.0.38 & 2.2.7 :
+ * ------------------------------------------
+ *	- Correct the reception logic to better report errors and avoid
+ *	  sending bogus packet up the stack
+ *	- Delay RU config to avoid corrupting first received packet
+ *	- Change config completion code (to actually check something)
+ *	- Avoid reading out of bound in skbuf to transmit
+ *	- Rectify a lot of (useless) debugging code
+ *	- Change the way to `#ifdef SET_PSA_CRC'
+ *
+ * Changes made for release in 2.2.11 & 2.3.13 :
+ * -------------------------------------------
+ *	- Change e-mail and web page addresses
+ *	- Watchdog timer is now correctly expressed in HZ, not in jiffies
+ *	- Add channel number to the list of frequencies in range
+ *	- Add the (short) list of bit-rates in range
+ *	- Developp a new sensitivity... (sens.value & sens.fixed)
+ *
+ * Changes made for release in 2.2.14 & 2.3.23 :
+ * -------------------------------------------
+ *	- Fix check for root permission (break instead of exit)
+ *	- New nwid & encoding setting (Wireless Extension 9)
+ *
+ * Changes made for release in 2.3.49 :
+ * ----------------------------------
+ *	- Indentation reformating (Alan)
+ *	- Update to new network API (softnet - 2.3.43) :
+ *		o replace dev->tbusy (Alan)
+ *		o replace dev->tstart (Alan)
+ *		o remove dev->interrupt (Alan)
+ *		o add SMP locking via spinlock in splxx (me)
+ *		o add spinlock in interrupt handler (me)
+ *		o use kernel watchdog instead of ours (me)
+ *		o increase watchdog timeout (kernel is more sensitive) (me)
+ *		o verify that all the changes make sense and work (me)
+ *	- Fixup a potential gotcha when reconfiguring and thighten a bit
+ *		the interactions with Tx queue.
+ *
+ * Changes made for release in 2.4.0 :
+ * ---------------------------------
+ *	- Fix spinlock stupid bugs that I left in. The driver is now SMP
+ *		compliant and doesn't lockup at startup.
+ *
+ * Changes made for release in 2.5.2 :
+ * ---------------------------------
+ *	- Use new driver API for Wireless Extensions :
+ *		o got rid of wavelan_ioctl()
+ *		o use a bunch of iw_handler instead
+ *
+ * Changes made for release in 2.5.35 :
+ * ----------------------------------
+ *	- Set dev->trans_start to avoid filling the logs
+ *	- Handle better spurious/bogus interrupt
+ *	- Avoid deadlocks in mmc_out()/mmc_in()
+ *
+ * Wishes & dreams:
+ * ----------------
+ *	- roaming (see Pcmcia driver)
+ */
+
+/***************************** INCLUDES *****************************/
+
+#include	<linux/module.h>
+
+#include	<linux/kernel.h>
+#include	<linux/sched.h>
+#include	<linux/types.h>
+#include	<linux/fcntl.h>
+#include	<linux/interrupt.h>
+#include	<linux/stat.h>
+#include	<linux/ptrace.h>
+#include	<linux/ioport.h>
+#include	<linux/in.h>
+#include	<linux/string.h>
+#include	<linux/delay.h>
+#include	<linux/bitops.h>
+#include	<asm/system.h>
+#include	<asm/io.h>
+#include	<asm/dma.h>
+#include	<asm/uaccess.h>
+#include	<linux/errno.h>
+#include	<linux/netdevice.h>
+#include	<linux/etherdevice.h>
+#include	<linux/skbuff.h>
+#include	<linux/slab.h>
+#include	<linux/timer.h>
+#include	<linux/init.h>
+
+#include <linux/wireless.h>		/* Wireless extensions */
+#include <net/iw_handler.h>		/* Wireless handlers */
+
+/* WaveLAN declarations */
+#include	"i82586.h"
+#include	"wavelan.h"
+
+/************************** DRIVER OPTIONS **************************/
+/*
+ * `#define' or `#undef' the following constant to change the behaviour
+ * of the driver...
+ */
+#undef SET_PSA_CRC		/* Calculate and set the CRC on PSA (slower) */
+#define USE_PSA_CONFIG		/* Use info from the PSA. */
+#undef STRUCT_CHECK		/* Verify padding of structures. */
+#undef EEPROM_IS_PROTECTED	/* doesn't seem to be necessary */
+#define MULTICAST_AVOID		/* Avoid extra multicast (I'm sceptical). */
+#undef SET_MAC_ADDRESS		/* Experimental */
+
+#ifdef WIRELESS_EXT	/* If wireless extensions exist in the kernel */
+/* Warning:  this stuff will slow down the driver. */
+#define WIRELESS_SPY		/* Enable spying addresses. */
+#undef HISTOGRAM		/* Enable histogram of signal level. */
+#endif
+
+/****************************** DEBUG ******************************/
+
+#undef DEBUG_MODULE_TRACE	/* module insertion/removal */
+#undef DEBUG_CALLBACK_TRACE	/* calls made by Linux */
+#undef DEBUG_INTERRUPT_TRACE	/* calls to handler */
+#undef DEBUG_INTERRUPT_INFO	/* type of interrupt and so on */
+#define DEBUG_INTERRUPT_ERROR	/* problems */
+#undef DEBUG_CONFIG_TRACE	/* Trace the config functions. */
+#undef DEBUG_CONFIG_INFO	/* what's going on */
+#define DEBUG_CONFIG_ERROR	/* errors on configuration */
+#undef DEBUG_TX_TRACE		/* transmission calls */
+#undef DEBUG_TX_INFO		/* header of the transmitted packet */
+#undef DEBUG_TX_FAIL		/* Normal failure conditions */
+#define DEBUG_TX_ERROR		/* Unexpected conditions */
+#undef DEBUG_RX_TRACE		/* transmission calls */
+#undef DEBUG_RX_INFO		/* header of the received packet */
+#undef DEBUG_RX_FAIL		/* Normal failure conditions */
+#define DEBUG_RX_ERROR		/* Unexpected conditions */
+
+#undef DEBUG_PACKET_DUMP	/* Dump packet on the screen if defined to 32. */
+#undef DEBUG_IOCTL_TRACE	/* misc. call by Linux */
+#undef DEBUG_IOCTL_INFO		/* various debugging info */
+#define DEBUG_IOCTL_ERROR	/* what's going wrong */
+#define DEBUG_BASIC_SHOW	/* Show basic startup info. */
+#undef DEBUG_VERSION_SHOW	/* Print version info. */
+#undef DEBUG_PSA_SHOW		/* Dump PSA to screen. */
+#undef DEBUG_MMC_SHOW		/* Dump mmc to screen. */
+#undef DEBUG_SHOW_UNUSED	/* Show unused fields too. */
+#undef DEBUG_I82586_SHOW	/* Show i82586 status. */
+#undef DEBUG_DEVICE_SHOW	/* Show device parameters. */
+
+/************************ CONSTANTS & MACROS ************************/
+
+#ifdef DEBUG_VERSION_SHOW
+static const char	*version	= "wavelan.c : v24 (SMP + wireless extensions) 11/12/01\n";
+#endif
+
+/* Watchdog temporisation */
+#define	WATCHDOG_JIFFIES	(512*HZ/100)
+
+/* Macro to get the number of elements in an array */
+#define	NELS(a)				(sizeof(a) / sizeof(a[0]))
+
+/* ------------------------ PRIVATE IOCTL ------------------------ */
+
+#define SIOCSIPQTHR	SIOCIWFIRSTPRIV		/* Set quality threshold */
+#define SIOCGIPQTHR	SIOCIWFIRSTPRIV + 1	/* Get quality threshold */
+
+#define SIOCSIPHISTO	SIOCIWFIRSTPRIV + 2	/* Set histogram ranges */
+#define SIOCGIPHISTO	SIOCIWFIRSTPRIV + 3	/* Get histogram values */
+
+/****************************** TYPES ******************************/
+
+/* Shortcuts */
+typedef struct net_device_stats	en_stats;
+typedef struct iw_statistics	iw_stats;
+typedef struct iw_quality	iw_qual;
+typedef struct iw_freq		iw_freq;
+typedef struct net_local	net_local;
+typedef struct timer_list	timer_list;
+
+/* Basic types */
+typedef u_char		mac_addr[WAVELAN_ADDR_SIZE];	/* Hardware address */
+
+/*
+ * Static specific data for the interface.
+ *
+ * For each network interface, Linux keeps data in two structures:  "device"
+ * keeps the generic data (same format for everybody) and "net_local" keeps
+ * additional specific data.
+ * Note that some of this specific data is in fact generic (en_stats, for
+ * example).
+ */
+struct net_local
+{
+  net_local *	next;		/* linked list of the devices */
+  struct net_device *	dev;		/* reverse link */
+  spinlock_t	spinlock;	/* Serialize access to the hardware (SMP) */
+  en_stats	stats;		/* Ethernet interface statistics */
+  int		nresets;	/* number of hardware resets */
+  u_char	reconfig_82586;	/* We need to reconfigure the controller. */
+  u_char	promiscuous;	/* promiscuous mode */
+  int		mc_count;	/* number of multicast addresses */
+  u_short	hacr;		/* current host interface state */
+
+  int		tx_n_in_use;
+  u_short	rx_head;
+  u_short	rx_last;
+  u_short	tx_first_free;
+  u_short	tx_first_in_use;
+
+#ifdef WIRELESS_EXT
+  iw_stats	wstats;		/* Wireless-specific statistics */
+
+  struct iw_spy_data	spy_data;
+  struct iw_public_data	wireless_data;
+#endif
+
+#ifdef HISTOGRAM
+  int		his_number;		/* number of intervals */
+  u_char	his_range[16];		/* boundaries of interval ]n-1; n] */
+  u_long	his_sum[16];		/* sum in interval */
+#endif	/* HISTOGRAM */
+};
+
+/**************************** PROTOTYPES ****************************/
+
+/* ----------------------- MISC. SUBROUTINES ------------------------ */
+static u_char
+	wv_irq_to_psa(int);
+static int
+	wv_psa_to_irq(u_char);
+/* ------------------- HOST ADAPTER SUBROUTINES ------------------- */
+static inline u_short		/* data */
+	hasr_read(u_long);	/* Read the host interface:  base address */
+static inline void
+	hacr_write(u_long,	/* Write to host interface:  base address */
+		   u_short),	/* data */
+	hacr_write_slow(u_long,
+		   u_short),
+	set_chan_attn(u_long,	/* ioaddr */
+		      u_short),	/* hacr   */
+	wv_hacr_reset(u_long),	/* ioaddr */
+	wv_16_off(u_long,	/* ioaddr */
+		  u_short),	/* hacr   */
+	wv_16_on(u_long,	/* ioaddr */
+		 u_short),	/* hacr   */
+	wv_ints_off(struct net_device *),
+	wv_ints_on(struct net_device *);
+/* ----------------- MODEM MANAGEMENT SUBROUTINES ----------------- */
+static void
+	psa_read(u_long,	/* Read the Parameter Storage Area. */
+		 u_short,	/* hacr */
+		 int,		/* offset in PSA */
+		 u_char *,	/* buffer to fill */
+		 int),		/* size to read */
+	psa_write(u_long, 	/* Write to the PSA. */
+		  u_short,	/* hacr */
+		  int,		/* offset in PSA */
+		  u_char *,	/* buffer in memory */
+		  int);		/* length of buffer */
+static inline void
+	mmc_out(u_long,		/* Write 1 byte to the Modem Manag Control. */
+		u_short,
+		u_char),
+	mmc_write(u_long,	/* Write n bytes to the MMC. */
+		  u_char,
+		  u_char *,
+		  int);
+static inline u_char		/* Read 1 byte from the MMC. */
+	mmc_in(u_long,
+	       u_short);
+static inline void
+	mmc_read(u_long,	/* Read n bytes from the MMC. */
+		 u_char,
+		 u_char *,
+		 int),
+	fee_wait(u_long,	/* Wait for frequency EEPROM:  base address */
+		 int,		/* base delay to wait for */
+		 int);		/* time to wait */
+static void
+	fee_read(u_long,	/* Read the frequency EEPROM:  base address */
+		 u_short,	/* destination offset */
+		 u_short *,	/* data buffer */
+		 int);		/* number of registers */
+/* ---------------------- I82586 SUBROUTINES ----------------------- */
+static /*inline*/ void
+	obram_read(u_long,	/* ioaddr */
+		   u_short,	/* o */
+		   u_char *,	/* b */
+		   int);	/* n */
+static inline void
+	obram_write(u_long,	/* ioaddr */
+		    u_short,	/* o */
+		    u_char *,	/* b */
+		    int);	/* n */
+static void
+	wv_ack(struct net_device *);
+static inline int
+	wv_synchronous_cmd(struct net_device *,
+			   const char *),
+	wv_config_complete(struct net_device *,
+			   u_long,
+			   net_local *);
+static int
+	wv_complete(struct net_device *,
+		    u_long,
+		    net_local *);
+static inline void
+	wv_82586_reconfig(struct net_device *);
+/* ------------------- DEBUG & INFO SUBROUTINES ------------------- */
+#ifdef DEBUG_I82586_SHOW
+static void
+	wv_scb_show(unsigned short);
+#endif
+static inline void
+	wv_init_info(struct net_device *);	/* display startup info */
+/* ------------------- IOCTL, STATS & RECONFIG ------------------- */
+static en_stats	*
+	wavelan_get_stats(struct net_device *);	/* Give stats /proc/net/dev */
+static iw_stats *
+	wavelan_get_wireless_stats(struct net_device *);
+static void
+	wavelan_set_multicast_list(struct net_device *);
+/* ----------------------- PACKET RECEPTION ----------------------- */
+static inline void
+	wv_packet_read(struct net_device *,	/* Read a packet from a frame. */
+		       u_short,
+		       int),
+	wv_receive(struct net_device *);	/* Read all packets waiting. */
+/* --------------------- PACKET TRANSMISSION --------------------- */
+static inline int
+	wv_packet_write(struct net_device *,	/* Write a packet to the Tx buffer. */
+			void *,
+			short);
+static int
+	wavelan_packet_xmit(struct sk_buff *,	/* Send a packet. */
+			    struct net_device *);
+/* -------------------- HARDWARE CONFIGURATION -------------------- */
+static inline int
+	wv_mmc_init(struct net_device *),	/* Initialize the modem. */
+	wv_ru_start(struct net_device *),	/* Start the i82586 receiver unit. */
+	wv_cu_start(struct net_device *),	/* Start the i82586 command unit. */
+	wv_82586_start(struct net_device *);	/* Start the i82586. */
+static void
+	wv_82586_config(struct net_device *);	/* Configure the i82586. */
+static inline void
+	wv_82586_stop(struct net_device *);
+static int
+	wv_hw_reset(struct net_device *),	/* Reset the WaveLAN hardware. */
+	wv_check_ioaddr(u_long,		/* ioaddr */
+			u_char *);	/* mac address (read) */
+/* ---------------------- INTERRUPT HANDLING ---------------------- */
+static irqreturn_t
+	wavelan_interrupt(int,		/* interrupt handler */
+			  void *,
+			  struct pt_regs *);
+static void
+	wavelan_watchdog(struct net_device *);	/* transmission watchdog */
+/* ------------------- CONFIGURATION CALLBACKS ------------------- */
+static int
+	wavelan_open(struct net_device *),	/* Open the device. */
+	wavelan_close(struct net_device *),	/* Close the device. */
+	wavelan_config(struct net_device *, unsigned short);/* Configure one device. */
+extern struct net_device *wavelan_probe(int unit);	/* See Space.c. */
+
+/**************************** VARIABLES ****************************/
+
+/*
+ * This is the root of the linked list of WaveLAN drivers
+ * It is use to verify that we don't reuse the same base address
+ * for two different drivers and to clean up when removing the module.
+ */
+static net_local *	wavelan_list	= (net_local *) NULL;
+
+/*
+ * This table is used to translate the PSA value to IRQ number
+ * and vice versa.
+ */
+static u_char	irqvals[]	=
+{
+	   0,    0,    0, 0x01,
+	0x02, 0x04,    0, 0x08,
+	   0,    0, 0x10, 0x20,
+	0x40,    0,    0, 0x80,
+};
+
+/*
+ * Table of the available I/O addresses (base addresses) for WaveLAN
+ */
+static unsigned short	iobase[]	=
+{
+#if	0
+  /* Leave out 0x3C0 for now -- seems to clash with some video
+   * controllers.
+   * Leave out the others too -- we will always use 0x390 and leave
+   * 0x300 for the Ethernet device.
+   * Jean II:  0x3E0 is fine as well.
+   */
+  0x300, 0x390, 0x3E0, 0x3C0
+#endif	/* 0 */
+  0x390, 0x3E0
+};
+
+#ifdef	MODULE
+/* Parameters set by insmod */
+static int	io[4];
+static int	irq[4];
+static char	*name[4];
+module_param_array(io, int, NULL, 0);
+module_param_array(irq, int, NULL, 0);
+module_param_array(name, charp, NULL, 0);
+
+MODULE_PARM_DESC(io, "WaveLAN I/O base address(es),required");
+MODULE_PARM_DESC(irq, "WaveLAN IRQ number(s)");
+MODULE_PARM_DESC(name, "WaveLAN interface neme(s)");
+#endif	/* MODULE */
+
+#endif	/* WAVELAN_P_H */
diff --git a/drivers/net/wireless/wavelan_cs.c b/drivers/net/wireless/wavelan_cs.c
new file mode 100644
index 0000000..ec83297
--- /dev/null
+++ b/drivers/net/wireless/wavelan_cs.c
@@ -0,0 +1,4914 @@
+/*
+ *	Wavelan Pcmcia driver
+ *
+ *		Jean II - HPLB '96
+ *
+ * Reorganisation and extension of the driver.
+ * Original copyright follow. See wavelan_cs.p.h for details.
+ *
+ * This code is derived from Anthony D. Joseph's code and all the changes here
+ * are also under the original copyright below.
+ *
+ * This code supports version 2.00 of WaveLAN/PCMCIA cards (2.4GHz), and
+ * can work on Linux 2.0.36 with support of David Hinds' PCMCIA Card Services
+ *
+ * Joe Finney (joe@comp.lancs.ac.uk) at Lancaster University in UK added
+ * critical code in the routine to initialize the Modem Management Controller.
+ *
+ * Thanks to Alan Cox and Bruce Janson for their advice.
+ *
+ *	-- Yunzhou Li (scip4166@nus.sg)
+ *
+#ifdef WAVELAN_ROAMING	
+ * Roaming support added 07/22/98 by Justin Seger (jseger@media.mit.edu)
+ * based on patch by Joe Finney from Lancaster University.
+#endif
+ *
+ * Lucent (formerly AT&T GIS, formerly NCR) WaveLAN PCMCIA card: An
+ * Ethernet-like radio transceiver controlled by an Intel 82593 coprocessor.
+ *
+ *   A non-shared memory PCMCIA ethernet driver for linux
+ *
+ * ISA version modified to support PCMCIA by Anthony Joseph (adj@lcs.mit.edu)
+ *
+ *
+ * Joseph O'Sullivan & John Langford (josullvn@cs.cmu.edu & jcl@cs.cmu.edu)
+ *
+ * Apr 2 '98  made changes to bring the i82593 control/int handling in line
+ *             with offical specs...
+ *
+ ****************************************************************************
+ *   Copyright 1995
+ *   Anthony D. Joseph
+ *   Massachusetts Institute of Technology
+ *
+ *   Permission to use, copy, modify, and distribute this program
+ *   for any purpose and without fee is hereby granted, provided
+ *   that this copyright and permission notice appear on all copies
+ *   and supporting documentation, the name of M.I.T. not be used
+ *   in advertising or publicity pertaining to distribution of the
+ *   program without specific prior permission, and notice be given
+ *   in supporting documentation that copying and distribution is
+ *   by permission of M.I.T.  M.I.T. makes no representations about
+ *   the suitability of this software for any purpose.  It is pro-
+ *   vided "as is" without express or implied warranty.         
+ ****************************************************************************
+ *
+ */
+
+/* Do *NOT* add other headers here, you are guaranteed to be wrong - Jean II */
+#include "wavelan_cs.p.h"		/* Private header */
+
+/************************* MISC SUBROUTINES **************************/
+/*
+ * Subroutines which won't fit in one of the following category
+ * (wavelan modem or i82593)
+ */
+
+#ifdef STRUCT_CHECK
+/*------------------------------------------------------------------*/
+/*
+ * Sanity routine to verify the sizes of the various WaveLAN interface
+ * structures.
+ */
+static char *
+wv_structuct_check(void)
+{
+#define	SC(t,s,n)	if (sizeof(t) != s) return(n);
+
+  SC(psa_t, PSA_SIZE, "psa_t");
+  SC(mmw_t, MMW_SIZE, "mmw_t");
+  SC(mmr_t, MMR_SIZE, "mmr_t");
+
+#undef	SC
+
+  return((char *) NULL);
+} /* wv_structuct_check */
+#endif	/* STRUCT_CHECK */
+
+/******************* MODEM MANAGEMENT SUBROUTINES *******************/
+/*
+ * Useful subroutines to manage the modem of the wavelan
+ */
+
+/*------------------------------------------------------------------*/
+/*
+ * Read from card's Host Adaptor Status Register.
+ */
+static inline u_char
+hasr_read(u_long	base)
+{
+  return(inb(HASR(base)));
+} /* hasr_read */
+
+/*------------------------------------------------------------------*/
+/*
+ * Write to card's Host Adapter Command Register.
+ */
+static inline void
+hacr_write(u_long	base,
+	   u_char	hacr)
+{
+  outb(hacr, HACR(base));
+} /* hacr_write */
+
+/*------------------------------------------------------------------*/
+/*
+ * Write to card's Host Adapter Command Register. Include a delay for
+ * those times when it is needed.
+ */
+static inline void
+hacr_write_slow(u_long	base,
+		u_char	hacr)
+{
+  hacr_write(base, hacr);
+  /* delay might only be needed sometimes */
+  mdelay(1);
+} /* hacr_write_slow */
+
+/*------------------------------------------------------------------*/
+/*
+ * Read the Parameter Storage Area from the WaveLAN card's memory
+ */
+static void
+psa_read(struct net_device *	dev,
+	 int		o,	/* offset in PSA */
+	 u_char *	b,	/* buffer to fill */
+	 int		n)	/* size to read */
+{
+  net_local *lp = netdev_priv(dev);
+  u_char __iomem *ptr = lp->mem + PSA_ADDR + (o << 1);
+
+  while(n-- > 0)
+    {
+      *b++ = readb(ptr);
+      /* Due to a lack of address decode pins, the WaveLAN PCMCIA card
+       * only supports reading even memory addresses. That means the
+       * increment here MUST be two.
+       * Because of that, we can't use memcpy_fromio()...
+       */
+      ptr += 2;
+    }
+} /* psa_read */
+
+/*------------------------------------------------------------------*/
+/*
+ * Write the Paramter Storage Area to the WaveLAN card's memory
+ */
+static void
+psa_write(struct net_device *	dev,
+	  int		o,	/* Offset in psa */
+	  u_char *	b,	/* Buffer in memory */
+	  int		n)	/* Length of buffer */
+{
+  net_local *lp = netdev_priv(dev);
+  u_char __iomem *ptr = lp->mem + PSA_ADDR + (o << 1);
+  int		count = 0;
+  kio_addr_t	base = dev->base_addr;
+  /* As there seem to have no flag PSA_BUSY as in the ISA model, we are
+   * oblige to verify this address to know when the PSA is ready... */
+  volatile u_char __iomem *verify = lp->mem + PSA_ADDR +
+    (psaoff(0, psa_comp_number) << 1);
+
+  /* Authorize writting to PSA */
+  hacr_write(base, HACR_PWR_STAT | HACR_ROM_WEN);
+
+  while(n-- > 0)
+    {
+      /* write to PSA */
+      writeb(*b++, ptr);
+      ptr += 2;
+
+      /* I don't have the spec, so I don't know what the correct
+       * sequence to write is. This hack seem to work for me... */
+      count = 0;
+      while((readb(verify) != PSA_COMP_PCMCIA_915) && (count++ < 100))
+	mdelay(1);
+    }
+
+  /* Put the host interface back in standard state */
+  hacr_write(base, HACR_DEFAULT);
+} /* psa_write */
+
+#ifdef SET_PSA_CRC
+/*------------------------------------------------------------------*/
+/*
+ * Calculate the PSA CRC
+ * Thanks to Valster, Nico <NVALSTER@wcnd.nl.lucent.com> for the code
+ * NOTE: By specifying a length including the CRC position the
+ * returned value should be zero. (i.e. a correct checksum in the PSA)
+ *
+ * The Windows drivers don't use the CRC, but the AP and the PtP tool
+ * depend on it.
+ */
+static u_short
+psa_crc(unsigned char *	psa,	/* The PSA */
+	int		size)	/* Number of short for CRC */
+{
+  int		byte_cnt;	/* Loop on the PSA */
+  u_short	crc_bytes = 0;	/* Data in the PSA */
+  int		bit_cnt;	/* Loop on the bits of the short */
+
+  for(byte_cnt = 0; byte_cnt < size; byte_cnt++ )
+    {
+      crc_bytes ^= psa[byte_cnt];	/* Its an xor */
+
+      for(bit_cnt = 1; bit_cnt < 9; bit_cnt++ )
+	{
+	  if(crc_bytes & 0x0001)
+	    crc_bytes = (crc_bytes >> 1) ^ 0xA001;
+	  else
+	    crc_bytes >>= 1 ;
+        }
+    }
+
+  return crc_bytes;
+} /* psa_crc */
+#endif	/* SET_PSA_CRC */
+
+/*------------------------------------------------------------------*/
+/*
+ * update the checksum field in the Wavelan's PSA
+ */
+static void
+update_psa_checksum(struct net_device *	dev)
+{
+#ifdef SET_PSA_CRC
+  psa_t		psa;
+  u_short	crc;
+
+  /* read the parameter storage area */
+  psa_read(dev, 0, (unsigned char *) &psa, sizeof(psa));
+
+  /* update the checksum */
+  crc = psa_crc((unsigned char *) &psa,
+		sizeof(psa) - sizeof(psa.psa_crc[0]) - sizeof(psa.psa_crc[1])
+		- sizeof(psa.psa_crc_status));
+
+  psa.psa_crc[0] = crc & 0xFF;
+  psa.psa_crc[1] = (crc & 0xFF00) >> 8;
+
+  /* Write it ! */
+  psa_write(dev, (char *)&psa.psa_crc - (char *)&psa,
+	    (unsigned char *)&psa.psa_crc, 2);
+
+#ifdef DEBUG_IOCTL_INFO
+  printk (KERN_DEBUG "%s: update_psa_checksum(): crc = 0x%02x%02x\n",
+          dev->name, psa.psa_crc[0], psa.psa_crc[1]);
+
+  /* Check again (luxury !) */
+  crc = psa_crc((unsigned char *) &psa,
+		 sizeof(psa) - sizeof(psa.psa_crc_status));
+
+  if(crc != 0)
+    printk(KERN_WARNING "%s: update_psa_checksum(): CRC does not agree with PSA data (even after recalculating)\n", dev->name);
+#endif /* DEBUG_IOCTL_INFO */
+#endif	/* SET_PSA_CRC */
+} /* update_psa_checksum */
+
+/*------------------------------------------------------------------*/
+/*
+ * Write 1 byte to the MMC.
+ */
+static inline void
+mmc_out(u_long		base,
+	u_short		o,
+	u_char		d)
+{
+  int count = 0;
+
+  /* Wait for MMC to go idle */
+  while((count++ < 100) && (inb(HASR(base)) & HASR_MMI_BUSY))
+    udelay(10);
+
+  outb((u_char)((o << 1) | MMR_MMI_WR), MMR(base));
+  outb(d, MMD(base));
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Routine to write bytes to the Modem Management Controller.
+ * We start by the end because it is the way it should be !
+ */
+static inline void
+mmc_write(u_long	base,
+	  u_char	o,
+	  u_char *	b,
+	  int		n)
+{
+  o += n;
+  b += n;
+
+  while(n-- > 0 )
+    mmc_out(base, --o, *(--b));
+} /* mmc_write */
+
+/*------------------------------------------------------------------*/
+/*
+ * Read 1 byte from the MMC.
+ * Optimised version for 1 byte, avoid using memory...
+ */
+static inline u_char
+mmc_in(u_long	base,
+       u_short	o)
+{
+  int count = 0;
+
+  while((count++ < 100) && (inb(HASR(base)) & HASR_MMI_BUSY))
+    udelay(10);
+  outb(o << 1, MMR(base));		/* Set the read address */
+
+  outb(0, MMD(base));			/* Required dummy write */
+
+  while((count++ < 100) && (inb(HASR(base)) & HASR_MMI_BUSY))
+    udelay(10);
+  return (u_char) (inb(MMD(base)));	/* Now do the actual read */
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Routine to read bytes from the Modem Management Controller.
+ * The implementation is complicated by a lack of address lines,
+ * which prevents decoding of the low-order bit.
+ * (code has just been moved in the above function)
+ * We start by the end because it is the way it should be !
+ */
+static inline void
+mmc_read(u_long		base,
+	 u_char		o,
+	 u_char *	b,
+	 int		n)
+{
+  o += n;
+  b += n;
+
+  while(n-- > 0)
+    *(--b) = mmc_in(base, --o);
+} /* mmc_read */
+
+/*------------------------------------------------------------------*/
+/*
+ * Get the type of encryption available...
+ */
+static inline int
+mmc_encr(u_long		base)	/* i/o port of the card */
+{
+  int	temp;
+
+  temp = mmc_in(base, mmroff(0, mmr_des_avail));
+  if((temp != MMR_DES_AVAIL_DES) && (temp != MMR_DES_AVAIL_AES))
+    return 0;
+  else
+    return temp;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wait for the frequency EEprom to complete a command...
+ * I hope this one will be optimally inlined...
+ */
+static inline void
+fee_wait(u_long		base,	/* i/o port of the card */
+	 int		delay,	/* Base delay to wait for */
+	 int		number)	/* Number of time to wait */
+{
+  int		count = 0;	/* Wait only a limited time */
+
+  while((count++ < number) &&
+	(mmc_in(base, mmroff(0, mmr_fee_status)) & MMR_FEE_STATUS_BUSY))
+    udelay(delay);
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Read bytes from the Frequency EEprom (frequency select cards).
+ */
+static void
+fee_read(u_long		base,	/* i/o port of the card */
+	 u_short	o,	/* destination offset */
+	 u_short *	b,	/* data buffer */
+	 int		n)	/* number of registers */
+{
+  b += n;		/* Position at the end of the area */
+
+  /* Write the address */
+  mmc_out(base, mmwoff(0, mmw_fee_addr), o + n - 1);
+
+  /* Loop on all buffer */
+  while(n-- > 0)
+    {
+      /* Write the read command */
+      mmc_out(base, mmwoff(0, mmw_fee_ctrl), MMW_FEE_CTRL_READ);
+
+      /* Wait until EEprom is ready (should be quick !) */
+      fee_wait(base, 10, 100);
+
+      /* Read the value */
+      *--b = ((mmc_in(base, mmroff(0, mmr_fee_data_h)) << 8) |
+	      mmc_in(base, mmroff(0, mmr_fee_data_l)));
+    }
+}
+
+#ifdef WIRELESS_EXT	/* If wireless extension exist in the kernel */
+
+/*------------------------------------------------------------------*/
+/*
+ * Write bytes from the Frequency EEprom (frequency select cards).
+ * This is a bit complicated, because the frequency eeprom has to
+ * be unprotected and the write enabled.
+ * Jean II
+ */
+static void
+fee_write(u_long	base,	/* i/o port of the card */
+	  u_short	o,	/* destination offset */
+	  u_short *	b,	/* data buffer */
+	  int		n)	/* number of registers */
+{
+  b += n;		/* Position at the end of the area */
+
+#ifdef EEPROM_IS_PROTECTED	/* disabled */
+#ifdef DOESNT_SEEM_TO_WORK	/* disabled */
+  /* Ask to read the protected register */
+  mmc_out(base, mmwoff(0, mmw_fee_ctrl), MMW_FEE_CTRL_PRREAD);
+
+  fee_wait(base, 10, 100);
+
+  /* Read the protected register */
+  printk("Protected 2 : %02X-%02X\n",
+	 mmc_in(base, mmroff(0, mmr_fee_data_h)),
+	 mmc_in(base, mmroff(0, mmr_fee_data_l)));
+#endif	/* DOESNT_SEEM_TO_WORK */
+
+  /* Enable protected register */
+  mmc_out(base, mmwoff(0, mmw_fee_addr), MMW_FEE_ADDR_EN);
+  mmc_out(base, mmwoff(0, mmw_fee_ctrl), MMW_FEE_CTRL_PREN);
+
+  fee_wait(base, 10, 100);
+
+  /* Unprotect area */
+  mmc_out(base, mmwoff(0, mmw_fee_addr), o + n);
+  mmc_out(base, mmwoff(0, mmw_fee_ctrl), MMW_FEE_CTRL_PRWRITE);
+#ifdef DOESNT_SEEM_TO_WORK	/* disabled */
+  /* Or use : */
+  mmc_out(base, mmwoff(0, mmw_fee_ctrl), MMW_FEE_CTRL_PRCLEAR);
+#endif	/* DOESNT_SEEM_TO_WORK */
+
+  fee_wait(base, 10, 100);
+#endif	/* EEPROM_IS_PROTECTED */
+
+  /* Write enable */
+  mmc_out(base, mmwoff(0, mmw_fee_addr), MMW_FEE_ADDR_EN);
+  mmc_out(base, mmwoff(0, mmw_fee_ctrl), MMW_FEE_CTRL_WREN);
+
+  fee_wait(base, 10, 100);
+
+  /* Write the EEprom address */
+  mmc_out(base, mmwoff(0, mmw_fee_addr), o + n - 1);
+
+  /* Loop on all buffer */
+  while(n-- > 0)
+    {
+      /* Write the value */
+      mmc_out(base, mmwoff(0, mmw_fee_data_h), (*--b) >> 8);
+      mmc_out(base, mmwoff(0, mmw_fee_data_l), *b & 0xFF);
+
+      /* Write the write command */
+      mmc_out(base, mmwoff(0, mmw_fee_ctrl), MMW_FEE_CTRL_WRITE);
+
+      /* Wavelan doc says : wait at least 10 ms for EEBUSY = 0 */
+      mdelay(10);
+      fee_wait(base, 10, 100);
+    }
+
+  /* Write disable */
+  mmc_out(base, mmwoff(0, mmw_fee_addr), MMW_FEE_ADDR_DS);
+  mmc_out(base, mmwoff(0, mmw_fee_ctrl), MMW_FEE_CTRL_WDS);
+
+  fee_wait(base, 10, 100);
+
+#ifdef EEPROM_IS_PROTECTED	/* disabled */
+  /* Reprotect EEprom */
+  mmc_out(base, mmwoff(0, mmw_fee_addr), 0x00);
+  mmc_out(base, mmwoff(0, mmw_fee_ctrl), MMW_FEE_CTRL_PRWRITE);
+
+  fee_wait(base, 10, 100);
+#endif	/* EEPROM_IS_PROTECTED */
+}
+#endif	/* WIRELESS_EXT */
+
+/******************* WaveLAN Roaming routines... ********************/
+
+#ifdef WAVELAN_ROAMING	/* Conditional compile, see wavelan_cs.h */
+
+unsigned char WAVELAN_BEACON_ADDRESS[]= {0x09,0x00,0x0e,0x20,0x03,0x00};
+  
+void wv_roam_init(struct net_device *dev)
+{
+  net_local  *lp= netdev_priv(dev);
+
+  /* Do not remove this unless you have a good reason */
+  printk(KERN_NOTICE "%s: Warning, you have enabled roaming on"
+	 " device %s !\n", dev->name, dev->name);
+  printk(KERN_NOTICE "Roaming is currently an experimental unsupported feature"
+	 " of the Wavelan driver.\n");
+  printk(KERN_NOTICE "It may work, but may also make the driver behave in"
+	 " erratic ways or crash.\n");
+
+  lp->wavepoint_table.head=NULL;           /* Initialise WavePoint table */
+  lp->wavepoint_table.num_wavepoints=0;
+  lp->wavepoint_table.locked=0;
+  lp->curr_point=NULL;                        /* No default WavePoint */
+  lp->cell_search=0;
+  
+  lp->cell_timer.data=(long)lp;               /* Start cell expiry timer */
+  lp->cell_timer.function=wl_cell_expiry;
+  lp->cell_timer.expires=jiffies+CELL_TIMEOUT;
+  add_timer(&lp->cell_timer);
+  
+  wv_nwid_filter(NWID_PROMISC,lp) ;    /* Enter NWID promiscuous mode */
+  /* to build up a good WavePoint */
+                                           /* table... */
+  printk(KERN_DEBUG "WaveLAN: Roaming enabled on device %s\n",dev->name);
+}
+ 
+void wv_roam_cleanup(struct net_device *dev)
+{
+  wavepoint_history *ptr,*old_ptr;
+  net_local *lp= netdev_priv(dev);
+  
+  printk(KERN_DEBUG "WaveLAN: Roaming Disabled on device %s\n",dev->name);
+  
+  /* Fixme : maybe we should check that the timer exist before deleting it */
+  del_timer(&lp->cell_timer);          /* Remove cell expiry timer       */
+  ptr=lp->wavepoint_table.head;        /* Clear device's WavePoint table */
+  while(ptr!=NULL)
+    {
+      old_ptr=ptr;
+      ptr=ptr->next;	
+      wl_del_wavepoint(old_ptr,lp);	
+    }
+}
+
+/* Enable/Disable NWID promiscuous mode on a given device */
+void wv_nwid_filter(unsigned char mode, net_local *lp)
+{
+  mm_t                  m;
+  unsigned long         flags;
+  
+#ifdef WAVELAN_ROAMING_DEBUG
+  printk(KERN_DEBUG "WaveLAN: NWID promisc %s, device %s\n",(mode==NWID_PROMISC) ? "on" : "off", lp->dev->name);
+#endif
+  
+  /* Disable interrupts & save flags */
+  spin_lock_irqsave(&lp->spinlock, flags);
+  
+  m.w.mmw_loopt_sel = (mode==NWID_PROMISC) ? MMW_LOOPT_SEL_DIS_NWID : 0x00;
+  mmc_write(lp->dev->base_addr, (char *)&m.w.mmw_loopt_sel - (char *)&m, (unsigned char *)&m.w.mmw_loopt_sel, 1);
+  
+  if(mode==NWID_PROMISC)
+    lp->cell_search=1;
+  else
+    lp->cell_search=0;
+
+  /* ReEnable interrupts & restore flags */
+  spin_unlock_irqrestore(&lp->spinlock, flags);
+}
+
+/* Find a record in the WavePoint table matching a given NWID */
+wavepoint_history *wl_roam_check(unsigned short nwid, net_local *lp)
+{
+  wavepoint_history	*ptr=lp->wavepoint_table.head;
+  
+  while(ptr!=NULL){
+    if(ptr->nwid==nwid)
+      return ptr;	
+    ptr=ptr->next;
+  }
+  return NULL;
+}
+
+/* Create a new wavepoint table entry */
+wavepoint_history *wl_new_wavepoint(unsigned short nwid, unsigned char seq, net_local* lp)
+{
+  wavepoint_history *new_wavepoint;
+
+#ifdef WAVELAN_ROAMING_DEBUG	
+  printk(KERN_DEBUG "WaveLAN: New Wavepoint, NWID:%.4X\n",nwid);
+#endif
+  
+  if(lp->wavepoint_table.num_wavepoints==MAX_WAVEPOINTS)
+    return NULL;
+  
+  new_wavepoint=(wavepoint_history *) kmalloc(sizeof(wavepoint_history),GFP_ATOMIC);
+  if(new_wavepoint==NULL)
+    return NULL;
+  
+  new_wavepoint->nwid=nwid;                       /* New WavePoints NWID */
+  new_wavepoint->average_fast=0;                    /* Running Averages..*/
+  new_wavepoint->average_slow=0;
+  new_wavepoint->qualptr=0;                       /* Start of ringbuffer */
+  new_wavepoint->last_seq=seq-1;                /* Last sequence no.seen */
+  memset(new_wavepoint->sigqual,0,WAVEPOINT_HISTORY);/* Empty ringbuffer */
+  
+  new_wavepoint->next=lp->wavepoint_table.head;/* Add to wavepoint table */
+  new_wavepoint->prev=NULL;
+  
+  if(lp->wavepoint_table.head!=NULL)
+    lp->wavepoint_table.head->prev=new_wavepoint;
+  
+  lp->wavepoint_table.head=new_wavepoint;
+  
+  lp->wavepoint_table.num_wavepoints++;     /* no. of visible wavepoints */
+  
+  return new_wavepoint;
+}
+
+/* Remove a wavepoint entry from WavePoint table */
+void wl_del_wavepoint(wavepoint_history *wavepoint, struct net_local *lp)
+{
+  if(wavepoint==NULL)
+    return;
+  
+  if(lp->curr_point==wavepoint)
+    lp->curr_point=NULL;
+  
+  if(wavepoint->prev!=NULL)
+    wavepoint->prev->next=wavepoint->next;
+  
+  if(wavepoint->next!=NULL)
+    wavepoint->next->prev=wavepoint->prev;
+  
+  if(lp->wavepoint_table.head==wavepoint)
+    lp->wavepoint_table.head=wavepoint->next;
+  
+  lp->wavepoint_table.num_wavepoints--;
+  kfree(wavepoint);
+}
+
+/* Timer callback function - checks WavePoint table for stale entries */ 
+void wl_cell_expiry(unsigned long data)
+{
+  net_local *lp=(net_local *)data;
+  wavepoint_history *wavepoint=lp->wavepoint_table.head,*old_point;
+  
+#if WAVELAN_ROAMING_DEBUG > 1
+  printk(KERN_DEBUG "WaveLAN: Wavepoint timeout, dev %s\n",lp->dev->name);
+#endif
+  
+  if(lp->wavepoint_table.locked)
+    {
+#if WAVELAN_ROAMING_DEBUG > 1
+      printk(KERN_DEBUG "WaveLAN: Wavepoint table locked...\n");
+#endif
+      
+      lp->cell_timer.expires=jiffies+1; /* If table in use, come back later */
+      add_timer(&lp->cell_timer);
+      return;
+    }
+  
+  while(wavepoint!=NULL)
+    {
+      if(time_after(jiffies, wavepoint->last_seen + CELL_TIMEOUT))
+	{
+#ifdef WAVELAN_ROAMING_DEBUG
+	  printk(KERN_DEBUG "WaveLAN: Bye bye %.4X\n",wavepoint->nwid);
+#endif
+	  
+	  old_point=wavepoint;
+	  wavepoint=wavepoint->next;
+	  wl_del_wavepoint(old_point,lp);
+	}
+      else
+	wavepoint=wavepoint->next;
+    }
+  lp->cell_timer.expires=jiffies+CELL_TIMEOUT;
+  add_timer(&lp->cell_timer);
+}
+
+/* Update SNR history of a wavepoint */
+void wl_update_history(wavepoint_history *wavepoint, unsigned char sigqual, unsigned char seq)	
+{
+  int i=0,num_missed=0,ptr=0;
+  int average_fast=0,average_slow=0;
+  
+  num_missed=(seq-wavepoint->last_seq)%WAVEPOINT_HISTORY;/* Have we missed
+							    any beacons? */
+  if(num_missed)
+    for(i=0;i<num_missed;i++)
+      {
+	wavepoint->sigqual[wavepoint->qualptr++]=0; /* If so, enter them as 0's */
+	wavepoint->qualptr %=WAVEPOINT_HISTORY;    /* in the ringbuffer. */
+      }
+  wavepoint->last_seen=jiffies;                 /* Add beacon to history */
+  wavepoint->last_seq=seq;	
+  wavepoint->sigqual[wavepoint->qualptr++]=sigqual;          
+  wavepoint->qualptr %=WAVEPOINT_HISTORY;
+  ptr=(wavepoint->qualptr-WAVEPOINT_FAST_HISTORY+WAVEPOINT_HISTORY)%WAVEPOINT_HISTORY;
+  
+  for(i=0;i<WAVEPOINT_FAST_HISTORY;i++)       /* Update running averages */
+    {
+      average_fast+=wavepoint->sigqual[ptr++];
+      ptr %=WAVEPOINT_HISTORY;
+    }
+  
+  average_slow=average_fast;
+  for(i=WAVEPOINT_FAST_HISTORY;i<WAVEPOINT_HISTORY;i++)
+    {
+      average_slow+=wavepoint->sigqual[ptr++];
+      ptr %=WAVEPOINT_HISTORY;
+    }
+  
+  wavepoint->average_fast=average_fast/WAVEPOINT_FAST_HISTORY;
+  wavepoint->average_slow=average_slow/WAVEPOINT_HISTORY;	
+}
+
+/* Perform a handover to a new WavePoint */
+void wv_roam_handover(wavepoint_history *wavepoint, net_local *lp)
+{
+  kio_addr_t		base = lp->dev->base_addr;
+  mm_t                  m;
+  unsigned long         flags;
+
+  if(wavepoint==lp->curr_point)          /* Sanity check... */
+    {
+      wv_nwid_filter(!NWID_PROMISC,lp);
+      return;
+    }
+  
+#ifdef WAVELAN_ROAMING_DEBUG
+  printk(KERN_DEBUG "WaveLAN: Doing handover to %.4X, dev %s\n",wavepoint->nwid,lp->dev->name);
+#endif
+ 	
+  /* Disable interrupts & save flags */
+  spin_lock_irqsave(&lp->spinlock, flags);
+
+  m.w.mmw_netw_id_l = wavepoint->nwid & 0xFF;
+  m.w.mmw_netw_id_h = (wavepoint->nwid & 0xFF00) >> 8;
+  
+  mmc_write(base, (char *)&m.w.mmw_netw_id_l - (char *)&m, (unsigned char *)&m.w.mmw_netw_id_l, 2);
+  
+  /* ReEnable interrupts & restore flags */
+  spin_unlock_irqrestore(&lp->spinlock, flags);
+
+  wv_nwid_filter(!NWID_PROMISC,lp);
+  lp->curr_point=wavepoint;
+}
+
+/* Called when a WavePoint beacon is received */
+static inline void wl_roam_gather(struct net_device *  dev,
+				  u_char *  hdr,   /* Beacon header */
+				  u_char *  stats) /* SNR, Signal quality 
+						      of packet */
+{
+  wavepoint_beacon *beacon= (wavepoint_beacon *)hdr; /* Rcvd. Beacon */
+  unsigned short nwid=ntohs(beacon->nwid);  
+  unsigned short sigqual=stats[2] & MMR_SGNL_QUAL;   /* SNR of beacon */
+  wavepoint_history *wavepoint=NULL;                /* WavePoint table entry */
+  net_local *lp = netdev_priv(dev);              /* Device info */
+
+#ifdef I_NEED_THIS_FEATURE
+  /* Some people don't need this, some other may need it */
+  nwid=nwid^ntohs(beacon->domain_id);
+#endif
+
+#if WAVELAN_ROAMING_DEBUG > 1
+  printk(KERN_DEBUG "WaveLAN: beacon, dev %s:\n",dev->name);
+  printk(KERN_DEBUG "Domain: %.4X NWID: %.4X SigQual=%d\n",ntohs(beacon->domain_id),nwid,sigqual);
+#endif
+  
+  lp->wavepoint_table.locked=1;                            /* <Mutex> */
+  
+  wavepoint=wl_roam_check(nwid,lp);            /* Find WavePoint table entry */
+  if(wavepoint==NULL)                    /* If no entry, Create a new one... */
+    {
+      wavepoint=wl_new_wavepoint(nwid,beacon->seq,lp);
+      if(wavepoint==NULL)
+	goto out;
+    }
+  if(lp->curr_point==NULL)             /* If this is the only WavePoint, */
+    wv_roam_handover(wavepoint, lp);	         /* Jump on it! */
+  
+  wl_update_history(wavepoint, sigqual, beacon->seq); /* Update SNR history
+							 stats. */
+  
+  if(lp->curr_point->average_slow < SEARCH_THRESH_LOW) /* If our current */
+    if(!lp->cell_search)                  /* WavePoint is getting faint, */
+      wv_nwid_filter(NWID_PROMISC,lp);    /* start looking for a new one */
+  
+  if(wavepoint->average_slow > 
+     lp->curr_point->average_slow + WAVELAN_ROAMING_DELTA)
+    wv_roam_handover(wavepoint, lp);   /* Handover to a better WavePoint */
+  
+  if(lp->curr_point->average_slow > SEARCH_THRESH_HIGH) /* If our SNR is */
+    if(lp->cell_search)  /* getting better, drop out of cell search mode */
+      wv_nwid_filter(!NWID_PROMISC,lp);
+  
+out:
+  lp->wavepoint_table.locked=0;                        /* </MUTEX>   :-) */
+}
+
+/* Test this MAC frame a WavePoint beacon */
+static inline int WAVELAN_BEACON(unsigned char *data)
+{
+  wavepoint_beacon *beacon= (wavepoint_beacon *)data;
+  static wavepoint_beacon beacon_template={0xaa,0xaa,0x03,0x08,0x00,0x0e,0x20,0x03,0x00};
+  
+  if(memcmp(beacon,&beacon_template,9)==0)
+    return 1;
+  else
+    return 0;
+}
+#endif	/* WAVELAN_ROAMING */
+
+/************************ I82593 SUBROUTINES *************************/
+/*
+ * Useful subroutines to manage the Ethernet controller
+ */
+
+/*------------------------------------------------------------------*/
+/*
+ * Routine to synchronously send a command to the i82593 chip. 
+ * Should be called with interrupts disabled.
+ * (called by wv_packet_write(), wv_ru_stop(), wv_ru_start(),
+ *  wv_82593_config() & wv_diag())
+ */
+static int
+wv_82593_cmd(struct net_device *	dev,
+	     char *	str,
+	     int	cmd,
+	     int	result)
+{
+  kio_addr_t	base = dev->base_addr;
+  int		status;
+  int		wait_completed;
+  long		spin;
+
+  /* Spin until the chip finishes executing its current command (if any) */
+  spin = 1000;
+  do
+    {
+      /* Time calibration of the loop */
+      udelay(10);
+
+      /* Read the interrupt register */
+      outb(OP0_NOP | CR0_STATUS_3, LCCR(base));
+      status = inb(LCSR(base));
+    }
+  while(((status & SR3_EXEC_STATE_MASK) != SR3_EXEC_IDLE) && (spin-- > 0));
+
+  /* If the interrupt hasn't be posted */
+  if(spin <= 0)
+    {
+#ifdef DEBUG_INTERRUPT_ERROR
+      printk(KERN_INFO "wv_82593_cmd: %s timeout (previous command), status 0x%02x\n",
+	     str, status);
+#endif
+      return(FALSE);
+    }
+
+  /* Issue the command to the controller */
+  outb(cmd, LCCR(base));
+
+  /* If we don't have to check the result of the command
+   * Note : this mean that the irq handler will deal with that */
+  if(result == SR0_NO_RESULT)
+    return(TRUE);
+
+  /* We are waiting for command completion */
+  wait_completed = TRUE;
+
+  /* Busy wait while the LAN controller executes the command. */
+  spin = 1000;
+  do
+    {
+      /* Time calibration of the loop */
+      udelay(10);
+
+      /* Read the interrupt register */
+      outb(CR0_STATUS_0 | OP0_NOP, LCCR(base));
+      status = inb(LCSR(base));
+
+      /* Check if there was an interrupt posted */
+      if((status & SR0_INTERRUPT))
+	{
+	  /* Acknowledge the interrupt */
+	  outb(CR0_INT_ACK | OP0_NOP, LCCR(base));
+
+	  /* Check if interrupt is a command completion */
+	  if(((status & SR0_BOTH_RX_TX) != SR0_BOTH_RX_TX) &&
+	     ((status & SR0_BOTH_RX_TX) != 0x0) &&
+	     !(status & SR0_RECEPTION))
+	    {
+	      /* Signal command completion */
+	      wait_completed = FALSE;
+	    }
+	  else
+	    {
+	      /* Note : Rx interrupts will be handled later, because we can
+	       * handle multiple Rx packets at once */
+#ifdef DEBUG_INTERRUPT_INFO
+	      printk(KERN_INFO "wv_82593_cmd: not our interrupt\n");
+#endif
+	    }
+	}
+    }
+  while(wait_completed && (spin-- > 0));
+
+  /* If the interrupt hasn't be posted */
+  if(wait_completed)
+    {
+#ifdef DEBUG_INTERRUPT_ERROR
+      printk(KERN_INFO "wv_82593_cmd: %s timeout, status 0x%02x\n",
+	     str, status);
+#endif
+      return(FALSE);
+    }
+
+  /* Check the return code returned by the card (see above) against
+   * the expected return code provided by the caller */
+  if((status & SR0_EVENT_MASK) != result)
+    {
+#ifdef DEBUG_INTERRUPT_ERROR
+      printk(KERN_INFO "wv_82593_cmd: %s failed, status = 0x%x\n",
+	     str, status);
+#endif
+      return(FALSE);
+    }
+
+  return(TRUE);
+} /* wv_82593_cmd */
+
+/*------------------------------------------------------------------*/
+/*
+ * This routine does a 593 op-code number 7, and obtains the diagnose
+ * status for the WaveLAN.
+ */
+static inline int
+wv_diag(struct net_device *	dev)
+{
+  int		ret = FALSE;
+
+  if(wv_82593_cmd(dev, "wv_diag(): diagnose",
+		  OP0_DIAGNOSE, SR0_DIAGNOSE_PASSED))
+    ret = TRUE;
+
+#ifdef DEBUG_CONFIG_ERRORS
+  printk(KERN_INFO "wavelan_cs: i82593 Self Test failed!\n");
+#endif
+  return(ret);
+} /* wv_diag */
+
+/*------------------------------------------------------------------*/
+/*
+ * Routine to read len bytes from the i82593's ring buffer, starting at
+ * chip address addr. The results read from the chip are stored in buf.
+ * The return value is the address to use for next the call.
+ */
+static int
+read_ringbuf(struct net_device *	dev,
+	     int	addr,
+	     char *	buf,
+	     int	len)
+{
+  kio_addr_t	base = dev->base_addr;
+  int		ring_ptr = addr;
+  int		chunk_len;
+  char *	buf_ptr = buf;
+
+  /* Get all the buffer */
+  while(len > 0)
+    {
+      /* Position the Program I/O Register at the ring buffer pointer */
+      outb(ring_ptr & 0xff, PIORL(base));
+      outb(((ring_ptr >> 8) & PIORH_MASK), PIORH(base));
+
+      /* First, determine how much we can read without wrapping around the
+	 ring buffer */
+      if((addr + len) < (RX_BASE + RX_SIZE))
+	chunk_len = len;
+      else
+	chunk_len = RX_BASE + RX_SIZE - addr;
+      insb(PIOP(base), buf_ptr, chunk_len);
+      buf_ptr += chunk_len;
+      len -= chunk_len;
+      ring_ptr = (ring_ptr - RX_BASE + chunk_len) % RX_SIZE + RX_BASE;
+    }
+  return(ring_ptr);
+} /* read_ringbuf */
+
+/*------------------------------------------------------------------*/
+/*
+ * Reconfigure the i82593, or at least ask for it...
+ * Because wv_82593_config use the transmission buffer, we must do it
+ * when we are sure that there is no transmission, so we do it now
+ * or in wavelan_packet_xmit() (I can't find any better place,
+ * wavelan_interrupt is not an option...), so you may experience
+ * some delay sometime...
+ */
+static inline void
+wv_82593_reconfig(struct net_device *	dev)
+{
+  net_local *		lp = netdev_priv(dev);
+  dev_link_t *		link = lp->link;
+  unsigned long		flags;
+
+  /* Arm the flag, will be cleard in wv_82593_config() */
+  lp->reconfig_82593 = TRUE;
+
+  /* Check if we can do it now ! */
+  if((link->open) && (netif_running(dev)) && !(netif_queue_stopped(dev)))
+    {
+      spin_lock_irqsave(&lp->spinlock, flags);	/* Disable interrupts */
+      wv_82593_config(dev);
+      spin_unlock_irqrestore(&lp->spinlock, flags);	/* Re-enable interrupts */
+    }
+  else
+    {
+#ifdef DEBUG_IOCTL_INFO
+      printk(KERN_DEBUG
+	     "%s: wv_82593_reconfig(): delayed (state = %lX, link = %d)\n",
+	     dev->name, dev->state, link->open);
+#endif
+    }
+}
+
+/********************* DEBUG & INFO SUBROUTINES *********************/
+/*
+ * This routines are used in the code to show debug informations.
+ * Most of the time, it dump the content of hardware structures...
+ */
+
+#ifdef DEBUG_PSA_SHOW
+/*------------------------------------------------------------------*/
+/*
+ * Print the formatted contents of the Parameter Storage Area.
+ */
+static void
+wv_psa_show(psa_t *	p)
+{
+  printk(KERN_DEBUG "##### wavelan psa contents: #####\n");
+  printk(KERN_DEBUG "psa_io_base_addr_1: 0x%02X %02X %02X %02X\n",
+	 p->psa_io_base_addr_1,
+	 p->psa_io_base_addr_2,
+	 p->psa_io_base_addr_3,
+	 p->psa_io_base_addr_4);
+  printk(KERN_DEBUG "psa_rem_boot_addr_1: 0x%02X %02X %02X\n",
+	 p->psa_rem_boot_addr_1,
+	 p->psa_rem_boot_addr_2,
+	 p->psa_rem_boot_addr_3);
+  printk(KERN_DEBUG "psa_holi_params: 0x%02x, ", p->psa_holi_params);
+  printk("psa_int_req_no: %d\n", p->psa_int_req_no);
+#ifdef DEBUG_SHOW_UNUSED
+  printk(KERN_DEBUG "psa_unused0[]: %02X:%02X:%02X:%02X:%02X:%02X:%02X\n",
+	 p->psa_unused0[0],
+	 p->psa_unused0[1],
+	 p->psa_unused0[2],
+	 p->psa_unused0[3],
+	 p->psa_unused0[4],
+	 p->psa_unused0[5],
+	 p->psa_unused0[6]);
+#endif	/* DEBUG_SHOW_UNUSED */
+  printk(KERN_DEBUG "psa_univ_mac_addr[]: %02x:%02x:%02x:%02x:%02x:%02x\n",
+	 p->psa_univ_mac_addr[0],
+	 p->psa_univ_mac_addr[1],
+	 p->psa_univ_mac_addr[2],
+	 p->psa_univ_mac_addr[3],
+	 p->psa_univ_mac_addr[4],
+	 p->psa_univ_mac_addr[5]);
+  printk(KERN_DEBUG "psa_local_mac_addr[]: %02x:%02x:%02x:%02x:%02x:%02x\n",
+	 p->psa_local_mac_addr[0],
+	 p->psa_local_mac_addr[1],
+	 p->psa_local_mac_addr[2],
+	 p->psa_local_mac_addr[3],
+	 p->psa_local_mac_addr[4],
+	 p->psa_local_mac_addr[5]);
+  printk(KERN_DEBUG "psa_univ_local_sel: %d, ", p->psa_univ_local_sel);
+  printk("psa_comp_number: %d, ", p->psa_comp_number);
+  printk("psa_thr_pre_set: 0x%02x\n", p->psa_thr_pre_set);
+  printk(KERN_DEBUG "psa_feature_select/decay_prm: 0x%02x, ",
+	 p->psa_feature_select);
+  printk("psa_subband/decay_update_prm: %d\n", p->psa_subband);
+  printk(KERN_DEBUG "psa_quality_thr: 0x%02x, ", p->psa_quality_thr);
+  printk("psa_mod_delay: 0x%02x\n", p->psa_mod_delay);
+  printk(KERN_DEBUG "psa_nwid: 0x%02x%02x, ", p->psa_nwid[0], p->psa_nwid[1]);
+  printk("psa_nwid_select: %d\n", p->psa_nwid_select);
+  printk(KERN_DEBUG "psa_encryption_select: %d, ", p->psa_encryption_select);
+  printk("psa_encryption_key[]: %02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x\n",
+	 p->psa_encryption_key[0],
+	 p->psa_encryption_key[1],
+	 p->psa_encryption_key[2],
+	 p->psa_encryption_key[3],
+	 p->psa_encryption_key[4],
+	 p->psa_encryption_key[5],
+	 p->psa_encryption_key[6],
+	 p->psa_encryption_key[7]);
+  printk(KERN_DEBUG "psa_databus_width: %d\n", p->psa_databus_width);
+  printk(KERN_DEBUG "psa_call_code/auto_squelch: 0x%02x, ",
+	 p->psa_call_code[0]);
+  printk("psa_call_code[]: %02X:%02X:%02X:%02X:%02X:%02X:%02X:%02X\n",
+	 p->psa_call_code[0],
+	 p->psa_call_code[1],
+	 p->psa_call_code[2],
+	 p->psa_call_code[3],
+	 p->psa_call_code[4],
+	 p->psa_call_code[5],
+	 p->psa_call_code[6],
+	 p->psa_call_code[7]);
+#ifdef DEBUG_SHOW_UNUSED
+  printk(KERN_DEBUG "psa_reserved[]: %02X:%02X:%02X:%02X\n",
+	 p->psa_reserved[0],
+	 p->psa_reserved[1],
+	 p->psa_reserved[2],
+	 p->psa_reserved[3]);
+#endif	/* DEBUG_SHOW_UNUSED */
+  printk(KERN_DEBUG "psa_conf_status: %d, ", p->psa_conf_status);
+  printk("psa_crc: 0x%02x%02x, ", p->psa_crc[0], p->psa_crc[1]);
+  printk("psa_crc_status: 0x%02x\n", p->psa_crc_status);
+} /* wv_psa_show */
+#endif	/* DEBUG_PSA_SHOW */
+
+#ifdef DEBUG_MMC_SHOW
+/*------------------------------------------------------------------*/
+/*
+ * Print the formatted status of the Modem Management Controller.
+ * This function need to be completed...
+ */
+static void
+wv_mmc_show(struct net_device *	dev)
+{
+  kio_addr_t	base = dev->base_addr;
+  net_local *	lp = netdev_priv(dev);
+  mmr_t		m;
+
+  /* Basic check */
+  if(hasr_read(base) & HASR_NO_CLK)
+    {
+      printk(KERN_WARNING "%s: wv_mmc_show: modem not connected\n",
+	     dev->name);
+      return;
+    }
+
+  spin_lock_irqsave(&lp->spinlock, flags);
+
+  /* Read the mmc */
+  mmc_out(base, mmwoff(0, mmw_freeze), 1);
+  mmc_read(base, 0, (u_char *)&m, sizeof(m));
+  mmc_out(base, mmwoff(0, mmw_freeze), 0);
+
+#ifdef WIRELESS_EXT	/* If wireless extension exist in the kernel */
+  /* Don't forget to update statistics */
+  lp->wstats.discard.nwid += (m.mmr_wrong_nwid_h << 8) | m.mmr_wrong_nwid_l;
+#endif	/* WIRELESS_EXT */
+
+  spin_unlock_irqrestore(&lp->spinlock, flags);
+
+  printk(KERN_DEBUG "##### wavelan modem status registers: #####\n");
+#ifdef DEBUG_SHOW_UNUSED
+  printk(KERN_DEBUG "mmc_unused0[]: %02X:%02X:%02X:%02X:%02X:%02X:%02X:%02X\n",
+	 m.mmr_unused0[0],
+	 m.mmr_unused0[1],
+	 m.mmr_unused0[2],
+	 m.mmr_unused0[3],
+	 m.mmr_unused0[4],
+	 m.mmr_unused0[5],
+	 m.mmr_unused0[6],
+	 m.mmr_unused0[7]);
+#endif	/* DEBUG_SHOW_UNUSED */
+  printk(KERN_DEBUG "Encryption algorythm: %02X - Status: %02X\n",
+	 m.mmr_des_avail, m.mmr_des_status);
+#ifdef DEBUG_SHOW_UNUSED
+  printk(KERN_DEBUG "mmc_unused1[]: %02X:%02X:%02X:%02X:%02X\n",
+	 m.mmr_unused1[0],
+	 m.mmr_unused1[1],
+	 m.mmr_unused1[2],
+	 m.mmr_unused1[3],
+	 m.mmr_unused1[4]);
+#endif	/* DEBUG_SHOW_UNUSED */
+  printk(KERN_DEBUG "dce_status: 0x%x [%s%s%s%s]\n",
+	 m.mmr_dce_status,
+	 (m.mmr_dce_status & MMR_DCE_STATUS_RX_BUSY) ? "energy detected,":"",
+	 (m.mmr_dce_status & MMR_DCE_STATUS_LOOPT_IND) ?
+	 "loop test indicated," : "",
+	 (m.mmr_dce_status & MMR_DCE_STATUS_TX_BUSY) ? "transmitter on," : "",
+	 (m.mmr_dce_status & MMR_DCE_STATUS_JBR_EXPIRED) ?
+	 "jabber timer expired," : "");
+  printk(KERN_DEBUG "Dsp ID: %02X\n",
+	 m.mmr_dsp_id);
+#ifdef DEBUG_SHOW_UNUSED
+  printk(KERN_DEBUG "mmc_unused2[]: %02X:%02X\n",
+	 m.mmr_unused2[0],
+	 m.mmr_unused2[1]);
+#endif	/* DEBUG_SHOW_UNUSED */
+  printk(KERN_DEBUG "# correct_nwid: %d, # wrong_nwid: %d\n",
+	 (m.mmr_correct_nwid_h << 8) | m.mmr_correct_nwid_l,
+	 (m.mmr_wrong_nwid_h << 8) | m.mmr_wrong_nwid_l);
+  printk(KERN_DEBUG "thr_pre_set: 0x%x [current signal %s]\n",
+	 m.mmr_thr_pre_set & MMR_THR_PRE_SET,
+	 (m.mmr_thr_pre_set & MMR_THR_PRE_SET_CUR) ? "above" : "below");
+  printk(KERN_DEBUG "signal_lvl: %d [%s], ",
+	 m.mmr_signal_lvl & MMR_SIGNAL_LVL,
+	 (m.mmr_signal_lvl & MMR_SIGNAL_LVL_VALID) ? "new msg" : "no new msg");
+  printk("silence_lvl: %d [%s], ", m.mmr_silence_lvl & MMR_SILENCE_LVL,
+	 (m.mmr_silence_lvl & MMR_SILENCE_LVL_VALID) ? "update done" : "no new update");
+  printk("sgnl_qual: 0x%x [%s]\n", m.mmr_sgnl_qual & MMR_SGNL_QUAL,
+	 (m.mmr_sgnl_qual & MMR_SGNL_QUAL_ANT) ? "Antenna 1" : "Antenna 0");
+#ifdef DEBUG_SHOW_UNUSED
+  printk(KERN_DEBUG "netw_id_l: %x\n", m.mmr_netw_id_l);
+#endif	/* DEBUG_SHOW_UNUSED */
+} /* wv_mmc_show */
+#endif	/* DEBUG_MMC_SHOW */
+
+#ifdef DEBUG_I82593_SHOW
+/*------------------------------------------------------------------*/
+/*
+ * Print the formatted status of the i82593's receive unit.
+ */
+static void
+wv_ru_show(struct net_device *	dev)
+{
+  net_local *lp = netdev_priv(dev);
+
+  printk(KERN_DEBUG "##### wavelan i82593 receiver status: #####\n");
+  printk(KERN_DEBUG "ru: rfp %d stop %d", lp->rfp, lp->stop);
+  /*
+   * Not implemented yet...
+   */
+  printk("\n");
+} /* wv_ru_show */
+#endif	/* DEBUG_I82593_SHOW */
+
+#ifdef DEBUG_DEVICE_SHOW
+/*------------------------------------------------------------------*/
+/*
+ * Print the formatted status of the WaveLAN PCMCIA device driver.
+ */
+static void
+wv_dev_show(struct net_device *	dev)
+{
+  printk(KERN_DEBUG "dev:");
+  printk(" state=%lX,", dev->state);
+  printk(" trans_start=%ld,", dev->trans_start);
+  printk(" flags=0x%x,", dev->flags);
+  printk("\n");
+} /* wv_dev_show */
+
+/*------------------------------------------------------------------*/
+/*
+ * Print the formatted status of the WaveLAN PCMCIA device driver's
+ * private information.
+ */
+static void
+wv_local_show(struct net_device *	dev)
+{
+  net_local *lp = netdev_priv(dev);
+
+  printk(KERN_DEBUG "local:");
+  /*
+   * Not implemented yet...
+   */
+  printk("\n");
+} /* wv_local_show */
+#endif	/* DEBUG_DEVICE_SHOW */
+
+#if defined(DEBUG_RX_INFO) || defined(DEBUG_TX_INFO)
+/*------------------------------------------------------------------*/
+/*
+ * Dump packet header (and content if necessary) on the screen
+ */
+static inline void
+wv_packet_info(u_char *		p,		/* Packet to dump */
+	       int		length,		/* Length of the packet */
+	       char *		msg1,		/* Name of the device */
+	       char *		msg2)		/* Name of the function */
+{
+  int		i;
+  int		maxi;
+
+  printk(KERN_DEBUG "%s: %s(): dest %02X:%02X:%02X:%02X:%02X:%02X, length %d\n",
+	 msg1, msg2, p[0], p[1], p[2], p[3], p[4], p[5], length);
+  printk(KERN_DEBUG "%s: %s(): src %02X:%02X:%02X:%02X:%02X:%02X, type 0x%02X%02X\n",
+	 msg1, msg2, p[6], p[7], p[8], p[9], p[10], p[11], p[12], p[13]);
+
+#ifdef DEBUG_PACKET_DUMP
+
+  printk(KERN_DEBUG "data=\"");
+
+  if((maxi = length) > DEBUG_PACKET_DUMP)
+    maxi = DEBUG_PACKET_DUMP;
+  for(i = 14; i < maxi; i++)
+    if(p[i] >= ' ' && p[i] <= '~')
+      printk(" %c", p[i]);
+    else
+      printk("%02X", p[i]);
+  if(maxi < length)
+    printk("..");
+  printk("\"\n");
+  printk(KERN_DEBUG "\n");
+#endif	/* DEBUG_PACKET_DUMP */
+}
+#endif	/* defined(DEBUG_RX_INFO) || defined(DEBUG_TX_INFO) */
+
+/*------------------------------------------------------------------*/
+/*
+ * This is the information which is displayed by the driver at startup
+ * There  is a lot of flag to configure it at your will...
+ */
+static inline void
+wv_init_info(struct net_device *	dev)
+{
+  kio_addr_t	base = dev->base_addr;
+  psa_t		psa;
+  int		i;
+
+  /* Read the parameter storage area */
+  psa_read(dev, 0, (unsigned char *) &psa, sizeof(psa));
+
+#ifdef DEBUG_PSA_SHOW
+  wv_psa_show(&psa);
+#endif
+#ifdef DEBUG_MMC_SHOW
+  wv_mmc_show(dev);
+#endif
+#ifdef DEBUG_I82593_SHOW
+  wv_ru_show(dev);
+#endif
+
+#ifdef DEBUG_BASIC_SHOW
+  /* Now, let's go for the basic stuff */
+  printk(KERN_NOTICE "%s: WaveLAN: port %#lx, irq %d, hw_addr",
+	 dev->name, base, dev->irq);
+  for(i = 0; i < WAVELAN_ADDR_SIZE; i++)
+    printk("%s%02X", (i == 0) ? " " : ":", dev->dev_addr[i]);
+
+  /* Print current network id */
+  if(psa.psa_nwid_select)
+    printk(", nwid 0x%02X-%02X", psa.psa_nwid[0], psa.psa_nwid[1]);
+  else
+    printk(", nwid off");
+
+  /* If 2.00 card */
+  if(!(mmc_in(base, mmroff(0, mmr_fee_status)) &
+       (MMR_FEE_STATUS_DWLD | MMR_FEE_STATUS_BUSY)))
+    {
+      unsigned short	freq;
+
+      /* Ask the EEprom to read the frequency from the first area */
+      fee_read(base, 0x00 /* 1st area - frequency... */,
+	       &freq, 1);
+
+      /* Print frequency */
+      printk(", 2.00, %ld", (freq >> 6) + 2400L);
+
+      /* Hack !!! */
+      if(freq & 0x20)
+	printk(".5");
+    }
+  else
+    {
+      printk(", PCMCIA, ");
+      switch (psa.psa_subband)
+	{
+	case PSA_SUBBAND_915:
+	  printk("915");
+	  break;
+	case PSA_SUBBAND_2425:
+	  printk("2425");
+	  break;
+	case PSA_SUBBAND_2460:
+	  printk("2460");
+	  break;
+	case PSA_SUBBAND_2484:
+	  printk("2484");
+	  break;
+	case PSA_SUBBAND_2430_5:
+	  printk("2430.5");
+	  break;
+	default:
+	  printk("unknown");
+	}
+    }
+
+  printk(" MHz\n");
+#endif	/* DEBUG_BASIC_SHOW */
+
+#ifdef DEBUG_VERSION_SHOW
+  /* Print version information */
+  printk(KERN_NOTICE "%s", version);
+#endif
+} /* wv_init_info */
+
+/********************* IOCTL, STATS & RECONFIG *********************/
+/*
+ * We found here routines that are called by Linux on differents
+ * occasions after the configuration and not for transmitting data
+ * These may be called when the user use ifconfig, /proc/net/dev
+ * or wireless extensions
+ */
+
+/*------------------------------------------------------------------*/
+/*
+ * Get the current ethernet statistics. This may be called with the
+ * card open or closed.
+ * Used when the user read /proc/net/dev
+ */
+static en_stats	*
+wavelan_get_stats(struct net_device *	dev)
+{
+#ifdef DEBUG_IOCTL_TRACE
+  printk(KERN_DEBUG "%s: <>wavelan_get_stats()\n", dev->name);
+#endif
+
+  return(&((net_local *)netdev_priv(dev))->stats);
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Set or clear the multicast filter for this adaptor.
+ * num_addrs == -1	Promiscuous mode, receive all packets
+ * num_addrs == 0	Normal mode, clear multicast list
+ * num_addrs > 0	Multicast mode, receive normal and MC packets,
+ *			and do best-effort filtering.
+ */
+
+static void
+wavelan_set_multicast_list(struct net_device *	dev)
+{
+  net_local *	lp = netdev_priv(dev);
+
+#ifdef DEBUG_IOCTL_TRACE
+  printk(KERN_DEBUG "%s: ->wavelan_set_multicast_list()\n", dev->name);
+#endif
+
+#ifdef DEBUG_IOCTL_INFO
+  printk(KERN_DEBUG "%s: wavelan_set_multicast_list(): setting Rx mode %02X to %d addresses.\n",
+	 dev->name, dev->flags, dev->mc_count);
+#endif
+
+  if(dev->flags & IFF_PROMISC)
+    {
+      /*
+       * Enable promiscuous mode: receive all packets.
+       */
+      if(!lp->promiscuous)
+	{
+	  lp->promiscuous = 1;
+	  lp->allmulticast = 0;
+	  lp->mc_count = 0;
+
+	  wv_82593_reconfig(dev);
+
+	  /* Tell the kernel that we are doing a really bad job... */
+	  dev->flags |= IFF_PROMISC;
+	}
+    }
+  else
+    /* If all multicast addresses
+     * or too much multicast addresses for the hardware filter */
+    if((dev->flags & IFF_ALLMULTI) ||
+       (dev->mc_count > I82593_MAX_MULTICAST_ADDRESSES))
+      {
+	/*
+	 * Disable promiscuous mode, but active the all multicast mode
+	 */
+	if(!lp->allmulticast)
+	  {
+	    lp->promiscuous = 0;
+	    lp->allmulticast = 1;
+	    lp->mc_count = 0;
+
+	    wv_82593_reconfig(dev);
+
+	    /* Tell the kernel that we are doing a really bad job... */
+	    dev->flags |= IFF_ALLMULTI;
+	  }
+      }
+    else
+      /* If there is some multicast addresses to send */
+      if(dev->mc_list != (struct dev_mc_list *) NULL)
+	{
+	  /*
+	   * Disable promiscuous mode, but receive all packets
+	   * in multicast list
+	   */
+#ifdef MULTICAST_AVOID
+	  if(lp->promiscuous || lp->allmulticast ||
+	     (dev->mc_count != lp->mc_count))
+#endif
+	    {
+	      lp->promiscuous = 0;
+	      lp->allmulticast = 0;
+	      lp->mc_count = dev->mc_count;
+
+	      wv_82593_reconfig(dev);
+	    }
+	}
+      else
+	{
+	  /*
+	   * Switch to normal mode: disable promiscuous mode and 
+	   * clear the multicast list.
+	   */
+	  if(lp->promiscuous || lp->mc_count == 0)
+	    {
+	      lp->promiscuous = 0;
+	      lp->allmulticast = 0;
+	      lp->mc_count = 0;
+
+	      wv_82593_reconfig(dev);
+	    }
+	}
+#ifdef DEBUG_IOCTL_TRACE
+  printk(KERN_DEBUG "%s: <-wavelan_set_multicast_list()\n", dev->name);
+#endif
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * This function doesn't exist...
+ * (Note : it was a nice way to test the reconfigure stuff...)
+ */
+#ifdef SET_MAC_ADDRESS
+static int
+wavelan_set_mac_address(struct net_device *	dev,
+			void *		addr)
+{
+  struct sockaddr *	mac = addr;
+
+  /* Copy the address */
+  memcpy(dev->dev_addr, mac->sa_data, WAVELAN_ADDR_SIZE);
+
+  /* Reconfig the beast */
+  wv_82593_reconfig(dev);
+
+  return 0;
+}
+#endif	/* SET_MAC_ADDRESS */
+
+#ifdef WIRELESS_EXT	/* If wireless extension exist in the kernel */
+
+/*------------------------------------------------------------------*/
+/*
+ * Frequency setting (for hardware able of it)
+ * It's a bit complicated and you don't really want to look into it...
+ */
+static inline int
+wv_set_frequency(u_long		base,	/* i/o port of the card */
+		 iw_freq *	frequency)
+{
+  const int	BAND_NUM = 10;	/* Number of bands */
+  long		freq = 0L;	/* offset to 2.4 GHz in .5 MHz */
+#ifdef DEBUG_IOCTL_INFO
+  int		i;
+#endif
+
+  /* Setting by frequency */
+  /* Theoritically, you may set any frequency between
+   * the two limits with a 0.5 MHz precision. In practice,
+   * I don't want you to have trouble with local
+   * regulations... */
+  if((frequency->e == 1) &&
+     (frequency->m >= (int) 2.412e8) && (frequency->m <= (int) 2.487e8))
+    {
+      freq = ((frequency->m / 10000) - 24000L) / 5;
+    }
+
+  /* Setting by channel (same as wfreqsel) */
+  /* Warning : each channel is 22MHz wide, so some of the channels
+   * will interfere... */
+  if((frequency->e == 0) &&
+     (frequency->m >= 0) && (frequency->m < BAND_NUM))
+    {
+      /* Get frequency offset. */
+      freq = channel_bands[frequency->m] >> 1;
+    }
+
+  /* Verify if the frequency is allowed */
+  if(freq != 0L)
+    {
+      u_short	table[10];	/* Authorized frequency table */
+
+      /* Read the frequency table */
+      fee_read(base, 0x71 /* frequency table */,
+	       table, 10);
+
+#ifdef DEBUG_IOCTL_INFO
+      printk(KERN_DEBUG "Frequency table :");
+      for(i = 0; i < 10; i++)
+	{
+	  printk(" %04X",
+		 table[i]);
+	}
+      printk("\n");
+#endif
+
+      /* Look in the table if the frequency is allowed */
+      if(!(table[9 - ((freq - 24) / 16)] &
+	   (1 << ((freq - 24) % 16))))
+	return -EINVAL;		/* not allowed */
+    }
+  else
+    return -EINVAL;
+
+  /* If we get a usable frequency */
+  if(freq != 0L)
+    {
+      unsigned short	area[16];
+      unsigned short	dac[2];
+      unsigned short	area_verify[16];
+      unsigned short	dac_verify[2];
+      /* Corresponding gain (in the power adjust value table)
+       * see AT&T Wavelan Data Manual, REF 407-024689/E, page 3-8
+       * & WCIN062D.DOC, page 6.2.9 */
+      unsigned short	power_limit[] = { 40, 80, 120, 160, 0 };
+      int		power_band = 0;		/* Selected band */
+      unsigned short	power_adjust;		/* Correct value */
+
+      /* Search for the gain */
+      power_band = 0;
+      while((freq > power_limit[power_band]) &&
+	    (power_limit[++power_band] != 0))
+	;
+
+      /* Read the first area */
+      fee_read(base, 0x00,
+	       area, 16);
+
+      /* Read the DAC */
+      fee_read(base, 0x60,
+	       dac, 2);
+
+      /* Read the new power adjust value */
+      fee_read(base, 0x6B - (power_band >> 1),
+	       &power_adjust, 1);
+      if(power_band & 0x1)
+	power_adjust >>= 8;
+      else
+	power_adjust &= 0xFF;
+
+#ifdef DEBUG_IOCTL_INFO
+      printk(KERN_DEBUG "Wavelan EEprom Area 1 :");
+      for(i = 0; i < 16; i++)
+	{
+	  printk(" %04X",
+		 area[i]);
+	}
+      printk("\n");
+
+      printk(KERN_DEBUG "Wavelan EEprom DAC : %04X %04X\n",
+	     dac[0], dac[1]);
+#endif
+
+      /* Frequency offset (for info only...) */
+      area[0] = ((freq << 5) & 0xFFE0) | (area[0] & 0x1F);
+
+      /* Receiver Principle main divider coefficient */
+      area[3] = (freq >> 1) + 2400L - 352L;
+      area[2] = ((freq & 0x1) << 4) | (area[2] & 0xFFEF);
+
+      /* Transmitter Main divider coefficient */
+      area[13] = (freq >> 1) + 2400L;
+      area[12] = ((freq & 0x1) << 4) | (area[2] & 0xFFEF);
+
+      /* Others part of the area are flags, bit streams or unused... */
+
+      /* Set the value in the DAC */
+      dac[1] = ((power_adjust >> 1) & 0x7F) | (dac[1] & 0xFF80);
+      dac[0] = ((power_adjust & 0x1) << 4) | (dac[0] & 0xFFEF);
+
+      /* Write the first area */
+      fee_write(base, 0x00,
+		area, 16);
+
+      /* Write the DAC */
+      fee_write(base, 0x60,
+		dac, 2);
+
+      /* We now should verify here that the EEprom writting was ok */
+
+      /* ReRead the first area */
+      fee_read(base, 0x00,
+	       area_verify, 16);
+
+      /* ReRead the DAC */
+      fee_read(base, 0x60,
+	       dac_verify, 2);
+
+      /* Compare */
+      if(memcmp(area, area_verify, 16 * 2) ||
+	 memcmp(dac, dac_verify, 2 * 2))
+	{
+#ifdef DEBUG_IOCTL_ERROR
+	  printk(KERN_INFO "Wavelan: wv_set_frequency : unable to write new frequency to EEprom (?)\n");
+#endif
+	  return -EOPNOTSUPP;
+	}
+
+      /* We must download the frequency parameters to the
+       * synthetisers (from the EEprom - area 1)
+       * Note : as the EEprom is auto decremented, we set the end
+       * if the area... */
+      mmc_out(base, mmwoff(0, mmw_fee_addr), 0x0F);
+      mmc_out(base, mmwoff(0, mmw_fee_ctrl),
+	      MMW_FEE_CTRL_READ | MMW_FEE_CTRL_DWLD);
+
+      /* Wait until the download is finished */
+      fee_wait(base, 100, 100);
+
+      /* We must now download the power adjust value (gain) to
+       * the synthetisers (from the EEprom - area 7 - DAC) */
+      mmc_out(base, mmwoff(0, mmw_fee_addr), 0x61);
+      mmc_out(base, mmwoff(0, mmw_fee_ctrl),
+	      MMW_FEE_CTRL_READ | MMW_FEE_CTRL_DWLD);
+
+      /* Wait until the download is finished */
+      fee_wait(base, 100, 100);
+
+#ifdef DEBUG_IOCTL_INFO
+      /* Verification of what we have done... */
+
+      printk(KERN_DEBUG "Wavelan EEprom Area 1 :");
+      for(i = 0; i < 16; i++)
+	{
+	  printk(" %04X",
+		 area_verify[i]);
+	}
+      printk("\n");
+
+      printk(KERN_DEBUG "Wavelan EEprom DAC : %04X %04X\n",
+	     dac_verify[0], dac_verify[1]);
+#endif
+
+      return 0;
+    }
+  else
+    return -EINVAL;		/* Bah, never get there... */
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Give the list of available frequencies
+ */
+static inline int
+wv_frequency_list(u_long	base,	/* i/o port of the card */
+		  iw_freq *	list,	/* List of frequency to fill */
+		  int		max)	/* Maximum number of frequencies */
+{
+  u_short	table[10];	/* Authorized frequency table */
+  long		freq = 0L;	/* offset to 2.4 GHz in .5 MHz + 12 MHz */
+  int		i;		/* index in the table */
+  const int	BAND_NUM = 10;	/* Number of bands */
+  int		c = 0;		/* Channel number */
+
+  /* Read the frequency table */
+  fee_read(base, 0x71 /* frequency table */,
+	   table, 10);
+
+  /* Look all frequencies */
+  i = 0;
+  for(freq = 0; freq < 150; freq++)
+    /* Look in the table if the frequency is allowed */
+    if(table[9 - (freq / 16)] & (1 << (freq % 16)))
+      {
+	/* Compute approximate channel number */
+	while((((channel_bands[c] >> 1) - 24) < freq) &&
+	      (c < BAND_NUM))
+	  c++;
+	list[i].i = c;	/* Set the list index */
+
+	/* put in the list */
+	list[i].m = (((freq + 24) * 5) + 24000L) * 10000;
+	list[i++].e = 1;
+
+	/* Check number */
+	if(i >= max)
+	  return(i);
+      }
+
+  return(i);
+}
+
+#ifdef IW_WIRELESS_SPY
+/*------------------------------------------------------------------*/
+/*
+ * Gather wireless spy statistics : for each packet, compare the source
+ * address with out list, and if match, get the stats...
+ * Sorry, but this function really need wireless extensions...
+ */
+static inline void
+wl_spy_gather(struct net_device *	dev,
+	      u_char *	mac,		/* MAC address */
+	      u_char *	stats)		/* Statistics to gather */
+{
+  struct iw_quality wstats;
+
+  wstats.qual = stats[2] & MMR_SGNL_QUAL;
+  wstats.level = stats[0] & MMR_SIGNAL_LVL;
+  wstats.noise = stats[1] & MMR_SILENCE_LVL;
+  wstats.updated = 0x7;
+
+  /* Update spy records */
+  wireless_spy_update(dev, mac, &wstats);
+}
+#endif	/* IW_WIRELESS_SPY */
+
+#ifdef HISTOGRAM
+/*------------------------------------------------------------------*/
+/*
+ * This function calculate an histogram on the signal level.
+ * As the noise is quite constant, it's like doing it on the SNR.
+ * We have defined a set of interval (lp->his_range), and each time
+ * the level goes in that interval, we increment the count (lp->his_sum).
+ * With this histogram you may detect if one wavelan is really weak,
+ * or you may also calculate the mean and standard deviation of the level...
+ */
+static inline void
+wl_his_gather(struct net_device *	dev,
+	      u_char *	stats)		/* Statistics to gather */
+{
+  net_local *	lp = netdev_priv(dev);
+  u_char	level = stats[0] & MMR_SIGNAL_LVL;
+  int		i;
+
+  /* Find the correct interval */
+  i = 0;
+  while((i < (lp->his_number - 1)) && (level >= lp->his_range[i++]))
+    ;
+
+  /* Increment interval counter */
+  (lp->his_sum[i])++;
+}
+#endif	/* HISTOGRAM */
+
+static void wl_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info)
+{
+	strncpy(info->driver, "wavelan_cs", sizeof(info->driver)-1);
+}
+
+static struct ethtool_ops ops = {
+	.get_drvinfo = wl_get_drvinfo
+};
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : get protocol name
+ */
+static int wavelan_get_name(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu,
+			    char *extra)
+{
+	strcpy(wrqu->name, "WaveLAN");
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : set NWID
+ */
+static int wavelan_set_nwid(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu,
+			    char *extra)
+{
+	kio_addr_t base = dev->base_addr;
+	net_local *lp = netdev_priv(dev);
+	psa_t psa;
+	mm_t m;
+	unsigned long flags;
+	int ret = 0;
+
+	/* Disable interrupts and save flags. */
+	spin_lock_irqsave(&lp->spinlock, flags);
+	
+	/* Set NWID in WaveLAN. */
+	if (!wrqu->nwid.disabled) {
+		/* Set NWID in psa */
+		psa.psa_nwid[0] = (wrqu->nwid.value & 0xFF00) >> 8;
+		psa.psa_nwid[1] = wrqu->nwid.value & 0xFF;
+		psa.psa_nwid_select = 0x01;
+		psa_write(dev,
+			  (char *) psa.psa_nwid - (char *) &psa,
+			  (unsigned char *) psa.psa_nwid, 3);
+
+		/* Set NWID in mmc. */
+		m.w.mmw_netw_id_l = psa.psa_nwid[1];
+		m.w.mmw_netw_id_h = psa.psa_nwid[0];
+		mmc_write(base,
+			  (char *) &m.w.mmw_netw_id_l -
+			  (char *) &m,
+			  (unsigned char *) &m.w.mmw_netw_id_l, 2);
+		mmc_out(base, mmwoff(0, mmw_loopt_sel), 0x00);
+	} else {
+		/* Disable NWID in the psa. */
+		psa.psa_nwid_select = 0x00;
+		psa_write(dev,
+			  (char *) &psa.psa_nwid_select -
+			  (char *) &psa,
+			  (unsigned char *) &psa.psa_nwid_select,
+			  1);
+
+		/* Disable NWID in the mmc (no filtering). */
+		mmc_out(base, mmwoff(0, mmw_loopt_sel),
+			MMW_LOOPT_SEL_DIS_NWID);
+	}
+	/* update the Wavelan checksum */
+	update_psa_checksum(dev);
+
+	/* Enable interrupts and restore flags. */
+	spin_unlock_irqrestore(&lp->spinlock, flags);
+
+	return ret;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : get NWID 
+ */
+static int wavelan_get_nwid(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu,
+			    char *extra)
+{
+	net_local *lp = netdev_priv(dev);
+	psa_t psa;
+	unsigned long flags;
+	int ret = 0;
+
+	/* Disable interrupts and save flags. */
+	spin_lock_irqsave(&lp->spinlock, flags);
+	
+	/* Read the NWID. */
+	psa_read(dev,
+		 (char *) psa.psa_nwid - (char *) &psa,
+		 (unsigned char *) psa.psa_nwid, 3);
+	wrqu->nwid.value = (psa.psa_nwid[0] << 8) + psa.psa_nwid[1];
+	wrqu->nwid.disabled = !(psa.psa_nwid_select);
+	wrqu->nwid.fixed = 1;	/* Superfluous */
+
+	/* Enable interrupts and restore flags. */
+	spin_unlock_irqrestore(&lp->spinlock, flags);
+
+	return ret;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : set frequency
+ */
+static int wavelan_set_freq(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu,
+			    char *extra)
+{
+	kio_addr_t base = dev->base_addr;
+	net_local *lp = netdev_priv(dev);
+	unsigned long flags;
+	int ret;
+
+	/* Disable interrupts and save flags. */
+	spin_lock_irqsave(&lp->spinlock, flags);
+	
+	/* Attempt to recognise 2.00 cards (2.4 GHz frequency selectable). */
+	if (!(mmc_in(base, mmroff(0, mmr_fee_status)) &
+	      (MMR_FEE_STATUS_DWLD | MMR_FEE_STATUS_BUSY)))
+		ret = wv_set_frequency(base, &(wrqu->freq));
+	else
+		ret = -EOPNOTSUPP;
+
+	/* Enable interrupts and restore flags. */
+	spin_unlock_irqrestore(&lp->spinlock, flags);
+
+	return ret;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : get frequency
+ */
+static int wavelan_get_freq(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu,
+			    char *extra)
+{
+	kio_addr_t base = dev->base_addr;
+	net_local *lp = netdev_priv(dev);
+	psa_t psa;
+	unsigned long flags;
+	int ret = 0;
+
+	/* Disable interrupts and save flags. */
+	spin_lock_irqsave(&lp->spinlock, flags);
+	
+	/* Attempt to recognise 2.00 cards (2.4 GHz frequency selectable).
+	 * Does it work for everybody, especially old cards? */
+	if (!(mmc_in(base, mmroff(0, mmr_fee_status)) &
+	      (MMR_FEE_STATUS_DWLD | MMR_FEE_STATUS_BUSY))) {
+		unsigned short freq;
+
+		/* Ask the EEPROM to read the frequency from the first area. */
+		fee_read(base, 0x00, &freq, 1);
+		wrqu->freq.m = ((freq >> 5) * 5 + 24000L) * 10000;
+		wrqu->freq.e = 1;
+	} else {
+		psa_read(dev,
+			 (char *) &psa.psa_subband - (char *) &psa,
+			 (unsigned char *) &psa.psa_subband, 1);
+
+		if (psa.psa_subband <= 4) {
+			wrqu->freq.m = fixed_bands[psa.psa_subband];
+			wrqu->freq.e = (psa.psa_subband != 0);
+		} else
+			ret = -EOPNOTSUPP;
+	}
+
+	/* Enable interrupts and restore flags. */
+	spin_unlock_irqrestore(&lp->spinlock, flags);
+
+	return ret;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : set level threshold
+ */
+static int wavelan_set_sens(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu,
+			    char *extra)
+{
+	kio_addr_t base = dev->base_addr;
+	net_local *lp = netdev_priv(dev);
+	psa_t psa;
+	unsigned long flags;
+	int ret = 0;
+
+	/* Disable interrupts and save flags. */
+	spin_lock_irqsave(&lp->spinlock, flags);
+	
+	/* Set the level threshold. */
+	/* We should complain loudly if wrqu->sens.fixed = 0, because we
+	 * can't set auto mode... */
+	psa.psa_thr_pre_set = wrqu->sens.value & 0x3F;
+	psa_write(dev,
+		  (char *) &psa.psa_thr_pre_set - (char *) &psa,
+		  (unsigned char *) &psa.psa_thr_pre_set, 1);
+	/* update the Wavelan checksum */
+	update_psa_checksum(dev);
+	mmc_out(base, mmwoff(0, mmw_thr_pre_set),
+		psa.psa_thr_pre_set);
+
+	/* Enable interrupts and restore flags. */
+	spin_unlock_irqrestore(&lp->spinlock, flags);
+
+	return ret;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : get level threshold
+ */
+static int wavelan_get_sens(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu,
+			    char *extra)
+{
+	net_local *lp = netdev_priv(dev);
+	psa_t psa;
+	unsigned long flags;
+	int ret = 0;
+
+	/* Disable interrupts and save flags. */
+	spin_lock_irqsave(&lp->spinlock, flags);
+	
+	/* Read the level threshold. */
+	psa_read(dev,
+		 (char *) &psa.psa_thr_pre_set - (char *) &psa,
+		 (unsigned char *) &psa.psa_thr_pre_set, 1);
+	wrqu->sens.value = psa.psa_thr_pre_set & 0x3F;
+	wrqu->sens.fixed = 1;
+
+	/* Enable interrupts and restore flags. */
+	spin_unlock_irqrestore(&lp->spinlock, flags);
+
+	return ret;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : set encryption key
+ */
+static int wavelan_set_encode(struct net_device *dev,
+			      struct iw_request_info *info,
+			      union iwreq_data *wrqu,
+			      char *extra)
+{
+	kio_addr_t base = dev->base_addr;
+	net_local *lp = netdev_priv(dev);
+	unsigned long flags;
+	psa_t psa;
+	int ret = 0;
+
+	/* Disable interrupts and save flags. */
+	spin_lock_irqsave(&lp->spinlock, flags);
+
+	/* Check if capable of encryption */
+	if (!mmc_encr(base)) {
+		ret = -EOPNOTSUPP;
+	}
+
+	/* Check the size of the key */
+	if((wrqu->encoding.length != 8) && (wrqu->encoding.length != 0)) {
+		ret = -EINVAL;
+	}
+
+	if(!ret) {
+		/* Basic checking... */
+		if (wrqu->encoding.length == 8) {
+			/* Copy the key in the driver */
+			memcpy(psa.psa_encryption_key, extra,
+			       wrqu->encoding.length);
+			psa.psa_encryption_select = 1;
+
+			psa_write(dev,
+				  (char *) &psa.psa_encryption_select -
+				  (char *) &psa,
+				  (unsigned char *) &psa.
+				  psa_encryption_select, 8 + 1);
+
+			mmc_out(base, mmwoff(0, mmw_encr_enable),
+				MMW_ENCR_ENABLE_EN | MMW_ENCR_ENABLE_MODE);
+			mmc_write(base, mmwoff(0, mmw_encr_key),
+				  (unsigned char *) &psa.
+				  psa_encryption_key, 8);
+		}
+
+		/* disable encryption */
+		if (wrqu->encoding.flags & IW_ENCODE_DISABLED) {
+			psa.psa_encryption_select = 0;
+			psa_write(dev,
+				  (char *) &psa.psa_encryption_select -
+				  (char *) &psa,
+				  (unsigned char *) &psa.
+				  psa_encryption_select, 1);
+
+			mmc_out(base, mmwoff(0, mmw_encr_enable), 0);
+		}
+		/* update the Wavelan checksum */
+		update_psa_checksum(dev);
+	}
+
+	/* Enable interrupts and restore flags. */
+	spin_unlock_irqrestore(&lp->spinlock, flags);
+
+	return ret;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : get encryption key
+ */
+static int wavelan_get_encode(struct net_device *dev,
+			      struct iw_request_info *info,
+			      union iwreq_data *wrqu,
+			      char *extra)
+{
+	kio_addr_t base = dev->base_addr;
+	net_local *lp = netdev_priv(dev);
+	psa_t psa;
+	unsigned long flags;
+	int ret = 0;
+
+	/* Disable interrupts and save flags. */
+	spin_lock_irqsave(&lp->spinlock, flags);
+	
+	/* Check if encryption is available */
+	if (!mmc_encr(base)) {
+		ret = -EOPNOTSUPP;
+	} else {
+		/* Read the encryption key */
+		psa_read(dev,
+			 (char *) &psa.psa_encryption_select -
+			 (char *) &psa,
+			 (unsigned char *) &psa.
+			 psa_encryption_select, 1 + 8);
+
+		/* encryption is enabled ? */
+		if (psa.psa_encryption_select)
+			wrqu->encoding.flags = IW_ENCODE_ENABLED;
+		else
+			wrqu->encoding.flags = IW_ENCODE_DISABLED;
+		wrqu->encoding.flags |= mmc_encr(base);
+
+		/* Copy the key to the user buffer */
+		wrqu->encoding.length = 8;
+		memcpy(extra, psa.psa_encryption_key, wrqu->encoding.length);
+	}
+
+	/* Enable interrupts and restore flags. */
+	spin_unlock_irqrestore(&lp->spinlock, flags);
+
+	return ret;
+}
+
+#ifdef WAVELAN_ROAMING_EXT
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : set ESSID (domain)
+ */
+static int wavelan_set_essid(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu,
+			     char *extra)
+{
+	net_local *lp = netdev_priv(dev);
+	unsigned long flags;
+	int ret = 0;
+
+	/* Disable interrupts and save flags. */
+	spin_lock_irqsave(&lp->spinlock, flags);
+	
+	/* Check if disable */
+	if(wrqu->data.flags == 0)
+		lp->filter_domains = 0;
+	else {
+		char	essid[IW_ESSID_MAX_SIZE + 1];
+		char *	endp;
+
+		/* Terminate the string */
+		memcpy(essid, extra, wrqu->data.length);
+		essid[IW_ESSID_MAX_SIZE] = '\0';
+
+#ifdef DEBUG_IOCTL_INFO
+		printk(KERN_DEBUG "SetEssid : ``%s''\n", essid);
+#endif	/* DEBUG_IOCTL_INFO */
+
+		/* Convert to a number (note : Wavelan specific) */
+		lp->domain_id = simple_strtoul(essid, &endp, 16);
+		/* Has it worked  ? */
+		if(endp > essid)
+			lp->filter_domains = 1;
+		else {
+			lp->filter_domains = 0;
+			ret = -EINVAL;
+		}
+	}
+
+	/* Enable interrupts and restore flags. */
+	spin_unlock_irqrestore(&lp->spinlock, flags);
+
+	return ret;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : get ESSID (domain)
+ */
+static int wavelan_get_essid(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu,
+			     char *extra)
+{
+	net_local *lp = netdev_priv(dev);
+
+	/* Is the domain ID active ? */
+	wrqu->data.flags = lp->filter_domains;
+
+	/* Copy Domain ID into a string (Wavelan specific) */
+	/* Sound crazy, be we can't have a snprintf in the kernel !!! */
+	sprintf(extra, "%lX", lp->domain_id);
+	extra[IW_ESSID_MAX_SIZE] = '\0';
+
+	/* Set the length */
+	wrqu->data.length = strlen(extra) + 1;
+
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : set AP address
+ */
+static int wavelan_set_wap(struct net_device *dev,
+			   struct iw_request_info *info,
+			   union iwreq_data *wrqu,
+			   char *extra)
+{
+#ifdef DEBUG_IOCTL_INFO
+	printk(KERN_DEBUG "Set AP to : %02X:%02X:%02X:%02X:%02X:%02X\n",
+	       wrqu->ap_addr.sa_data[0],
+	       wrqu->ap_addr.sa_data[1],
+	       wrqu->ap_addr.sa_data[2],
+	       wrqu->ap_addr.sa_data[3],
+	       wrqu->ap_addr.sa_data[4],
+	       wrqu->ap_addr.sa_data[5]);
+#endif	/* DEBUG_IOCTL_INFO */
+
+	return -EOPNOTSUPP;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : get AP address
+ */
+static int wavelan_get_wap(struct net_device *dev,
+			   struct iw_request_info *info,
+			   union iwreq_data *wrqu,
+			   char *extra)
+{
+	/* Should get the real McCoy instead of own Ethernet address */
+	memcpy(wrqu->ap_addr.sa_data, dev->dev_addr, WAVELAN_ADDR_SIZE);
+	wrqu->ap_addr.sa_family = ARPHRD_ETHER;
+
+	return -EOPNOTSUPP;
+}
+#endif	/* WAVELAN_ROAMING_EXT */
+
+#ifdef WAVELAN_ROAMING
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : set mode
+ */
+static int wavelan_set_mode(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu,
+			    char *extra)
+{
+	net_local *lp = netdev_priv(dev);
+	unsigned long flags;
+	int ret = 0;
+
+	/* Disable interrupts and save flags. */
+	spin_lock_irqsave(&lp->spinlock, flags);
+
+	/* Check mode */
+	switch(wrqu->mode) {
+	case IW_MODE_ADHOC:
+		if(do_roaming) {
+			wv_roam_cleanup(dev);
+			do_roaming = 0;
+		}
+		break;
+	case IW_MODE_INFRA:
+		if(!do_roaming) {
+			wv_roam_init(dev);
+			do_roaming = 1;
+		}
+		break;
+	default:
+		ret = -EINVAL;
+	}
+
+	/* Enable interrupts and restore flags. */
+	spin_unlock_irqrestore(&lp->spinlock, flags);
+
+	return ret;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : get mode
+ */
+static int wavelan_get_mode(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu,
+			    char *extra)
+{
+	if(do_roaming)
+		wrqu->mode = IW_MODE_INFRA;
+	else
+		wrqu->mode = IW_MODE_ADHOC;
+
+	return 0;
+}
+#endif	/* WAVELAN_ROAMING */
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Handler : get range info
+ */
+static int wavelan_get_range(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu,
+			     char *extra)
+{
+	kio_addr_t base = dev->base_addr;
+	net_local *lp = netdev_priv(dev);
+	struct iw_range *range = (struct iw_range *) extra;
+	unsigned long flags;
+	int ret = 0;
+
+	/* Set the length (very important for backward compatibility) */
+	wrqu->data.length = sizeof(struct iw_range);
+
+	/* Set all the info we don't care or don't know about to zero */
+	memset(range, 0, sizeof(struct iw_range));
+
+	/* Set the Wireless Extension versions */
+	range->we_version_compiled = WIRELESS_EXT;
+	range->we_version_source = 9;
+
+	/* Set information in the range struct.  */
+	range->throughput = 1.4 * 1000 * 1000;	/* don't argue on this ! */
+	range->min_nwid = 0x0000;
+	range->max_nwid = 0xFFFF;
+
+	range->sensitivity = 0x3F;
+	range->max_qual.qual = MMR_SGNL_QUAL;
+	range->max_qual.level = MMR_SIGNAL_LVL;
+	range->max_qual.noise = MMR_SILENCE_LVL;
+	range->avg_qual.qual = MMR_SGNL_QUAL; /* Always max */
+	/* Need to get better values for those two */
+	range->avg_qual.level = 30;
+	range->avg_qual.noise = 8;
+
+	range->num_bitrates = 1;
+	range->bitrate[0] = 2000000;	/* 2 Mb/s */
+
+	/* Event capability (kernel + driver) */
+	range->event_capa[0] = (IW_EVENT_CAPA_MASK(0x8B02) |
+				IW_EVENT_CAPA_MASK(0x8B04) |
+				IW_EVENT_CAPA_MASK(0x8B06));
+	range->event_capa[1] = IW_EVENT_CAPA_K_1;
+
+	/* Disable interrupts and save flags. */
+	spin_lock_irqsave(&lp->spinlock, flags);
+	
+	/* Attempt to recognise 2.00 cards (2.4 GHz frequency selectable). */
+	if (!(mmc_in(base, mmroff(0, mmr_fee_status)) &
+	      (MMR_FEE_STATUS_DWLD | MMR_FEE_STATUS_BUSY))) {
+		range->num_channels = 10;
+		range->num_frequency = wv_frequency_list(base, range->freq,
+							IW_MAX_FREQUENCIES);
+	} else
+		range->num_channels = range->num_frequency = 0;
+
+	/* Encryption supported ? */
+	if (mmc_encr(base)) {
+		range->encoding_size[0] = 8;	/* DES = 64 bits key */
+		range->num_encoding_sizes = 1;
+		range->max_encoding_tokens = 1;	/* Only one key possible */
+	} else {
+		range->num_encoding_sizes = 0;
+		range->max_encoding_tokens = 0;
+	}
+
+	/* Enable interrupts and restore flags. */
+	spin_unlock_irqrestore(&lp->spinlock, flags);
+
+	return ret;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Private Handler : set quality threshold
+ */
+static int wavelan_set_qthr(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu,
+			    char *extra)
+{
+	kio_addr_t base = dev->base_addr;
+	net_local *lp = netdev_priv(dev);
+	psa_t psa;
+	unsigned long flags;
+
+	/* Disable interrupts and save flags. */
+	spin_lock_irqsave(&lp->spinlock, flags);
+	
+	psa.psa_quality_thr = *(extra) & 0x0F;
+	psa_write(dev,
+		  (char *) &psa.psa_quality_thr - (char *) &psa,
+		  (unsigned char *) &psa.psa_quality_thr, 1);
+	/* update the Wavelan checksum */
+	update_psa_checksum(dev);
+	mmc_out(base, mmwoff(0, mmw_quality_thr),
+		psa.psa_quality_thr);
+
+	/* Enable interrupts and restore flags. */
+	spin_unlock_irqrestore(&lp->spinlock, flags);
+
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Private Handler : get quality threshold
+ */
+static int wavelan_get_qthr(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu,
+			    char *extra)
+{
+	net_local *lp = netdev_priv(dev);
+	psa_t psa;
+	unsigned long flags;
+
+	/* Disable interrupts and save flags. */
+	spin_lock_irqsave(&lp->spinlock, flags);
+	
+	psa_read(dev,
+		 (char *) &psa.psa_quality_thr - (char *) &psa,
+		 (unsigned char *) &psa.psa_quality_thr, 1);
+	*(extra) = psa.psa_quality_thr & 0x0F;
+
+	/* Enable interrupts and restore flags. */
+	spin_unlock_irqrestore(&lp->spinlock, flags);
+
+	return 0;
+}
+
+#ifdef WAVELAN_ROAMING
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Private Handler : set roaming
+ */
+static int wavelan_set_roam(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu,
+			    char *extra)
+{
+	net_local *lp = netdev_priv(dev);
+	unsigned long flags;
+
+	/* Disable interrupts and save flags. */
+	spin_lock_irqsave(&lp->spinlock, flags);
+	
+	/* Note : should check if user == root */
+	if(do_roaming && (*extra)==0)
+		wv_roam_cleanup(dev);
+	else if(do_roaming==0 && (*extra)!=0)
+		wv_roam_init(dev);
+
+	do_roaming = (*extra);
+
+	/* Enable interrupts and restore flags. */
+	spin_unlock_irqrestore(&lp->spinlock, flags);
+
+	return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Private Handler : get quality threshold
+ */
+static int wavelan_get_roam(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu,
+			    char *extra)
+{
+	*(extra) = do_roaming;
+
+	return 0;
+}
+#endif	/* WAVELAN_ROAMING */
+
+#ifdef HISTOGRAM
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Private Handler : set histogram
+ */
+static int wavelan_set_histo(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu,
+			     char *extra)
+{
+	net_local *lp = netdev_priv(dev);
+
+	/* Check the number of intervals. */
+	if (wrqu->data.length > 16) {
+		return(-E2BIG);
+	}
+
+	/* Disable histo while we copy the addresses.
+	 * As we don't disable interrupts, we need to do this */
+	lp->his_number = 0;
+
+	/* Are there ranges to copy? */
+	if (wrqu->data.length > 0) {
+		/* Copy interval ranges to the driver */
+		memcpy(lp->his_range, extra, wrqu->data.length);
+
+		{
+		  int i;
+		  printk(KERN_DEBUG "Histo :");
+		  for(i = 0; i < wrqu->data.length; i++)
+		    printk(" %d", lp->his_range[i]);
+		  printk("\n");
+		}
+
+		/* Reset result structure. */
+		memset(lp->his_sum, 0x00, sizeof(long) * 16);
+	}
+
+	/* Now we can set the number of ranges */
+	lp->his_number = wrqu->data.length;
+
+	return(0);
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Wireless Private Handler : get histogram
+ */
+static int wavelan_get_histo(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu,
+			     char *extra)
+{
+	net_local *lp = netdev_priv(dev);
+
+	/* Set the number of intervals. */
+	wrqu->data.length = lp->his_number;
+
+	/* Give back the distribution statistics */
+	if(lp->his_number > 0)
+		memcpy(extra, lp->his_sum, sizeof(long) * lp->his_number);
+
+	return(0);
+}
+#endif			/* HISTOGRAM */
+
+/*------------------------------------------------------------------*/
+/*
+ * Structures to export the Wireless Handlers
+ */
+
+static const struct iw_priv_args wavelan_private_args[] = {
+/*{ cmd,         set_args,                            get_args, name } */
+  { SIOCSIPQTHR, IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 1, 0, "setqualthr" },
+  { SIOCGIPQTHR, 0, IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 1, "getqualthr" },
+  { SIOCSIPROAM, IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 1, 0, "setroam" },
+  { SIOCGIPROAM, 0, IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 1, "getroam" },
+  { SIOCSIPHISTO, IW_PRIV_TYPE_BYTE | 16,                    0, "sethisto" },
+  { SIOCGIPHISTO, 0,                     IW_PRIV_TYPE_INT | 16, "gethisto" },
+};
+
+static const iw_handler		wavelan_handler[] =
+{
+	NULL,				/* SIOCSIWNAME */
+	wavelan_get_name,		/* SIOCGIWNAME */
+	wavelan_set_nwid,		/* SIOCSIWNWID */
+	wavelan_get_nwid,		/* SIOCGIWNWID */
+	wavelan_set_freq,		/* SIOCSIWFREQ */
+	wavelan_get_freq,		/* SIOCGIWFREQ */
+#ifdef WAVELAN_ROAMING
+	wavelan_set_mode,		/* SIOCSIWMODE */
+	wavelan_get_mode,		/* SIOCGIWMODE */
+#else	/* WAVELAN_ROAMING */
+	NULL,				/* SIOCSIWMODE */
+	NULL,				/* SIOCGIWMODE */
+#endif	/* WAVELAN_ROAMING */
+	wavelan_set_sens,		/* SIOCSIWSENS */
+	wavelan_get_sens,		/* SIOCGIWSENS */
+	NULL,				/* SIOCSIWRANGE */
+	wavelan_get_range,		/* SIOCGIWRANGE */
+	NULL,				/* SIOCSIWPRIV */
+	NULL,				/* SIOCGIWPRIV */
+	NULL,				/* SIOCSIWSTATS */
+	NULL,				/* SIOCGIWSTATS */
+	iw_handler_set_spy,		/* SIOCSIWSPY */
+	iw_handler_get_spy,		/* SIOCGIWSPY */
+	iw_handler_set_thrspy,		/* SIOCSIWTHRSPY */
+	iw_handler_get_thrspy,		/* SIOCGIWTHRSPY */
+#ifdef WAVELAN_ROAMING_EXT
+	wavelan_set_wap,		/* SIOCSIWAP */
+	wavelan_get_wap,		/* SIOCGIWAP */
+	NULL,				/* -- hole -- */
+	NULL,				/* SIOCGIWAPLIST */
+	NULL,				/* -- hole -- */
+	NULL,				/* -- hole -- */
+	wavelan_set_essid,		/* SIOCSIWESSID */
+	wavelan_get_essid,		/* SIOCGIWESSID */
+#else	/* WAVELAN_ROAMING_EXT */
+	NULL,				/* SIOCSIWAP */
+	NULL,				/* SIOCGIWAP */
+	NULL,				/* -- hole -- */
+	NULL,				/* SIOCGIWAPLIST */
+	NULL,				/* -- hole -- */
+	NULL,				/* -- hole -- */
+	NULL,				/* SIOCSIWESSID */
+	NULL,				/* SIOCGIWESSID */
+#endif	/* WAVELAN_ROAMING_EXT */
+	NULL,				/* SIOCSIWNICKN */
+	NULL,				/* SIOCGIWNICKN */
+	NULL,				/* -- hole -- */
+	NULL,				/* -- hole -- */
+	NULL,				/* SIOCSIWRATE */
+	NULL,				/* SIOCGIWRATE */
+	NULL,				/* SIOCSIWRTS */
+	NULL,				/* SIOCGIWRTS */
+	NULL,				/* SIOCSIWFRAG */
+	NULL,				/* SIOCGIWFRAG */
+	NULL,				/* SIOCSIWTXPOW */
+	NULL,				/* SIOCGIWTXPOW */
+	NULL,				/* SIOCSIWRETRY */
+	NULL,				/* SIOCGIWRETRY */
+	wavelan_set_encode,		/* SIOCSIWENCODE */
+	wavelan_get_encode,		/* SIOCGIWENCODE */
+};
+
+static const iw_handler		wavelan_private_handler[] =
+{
+	wavelan_set_qthr,		/* SIOCIWFIRSTPRIV */
+	wavelan_get_qthr,		/* SIOCIWFIRSTPRIV + 1 */
+#ifdef WAVELAN_ROAMING
+	wavelan_set_roam,		/* SIOCIWFIRSTPRIV + 2 */
+	wavelan_get_roam,		/* SIOCIWFIRSTPRIV + 3 */
+#else	/* WAVELAN_ROAMING */
+	NULL,				/* SIOCIWFIRSTPRIV + 2 */
+	NULL,				/* SIOCIWFIRSTPRIV + 3 */
+#endif	/* WAVELAN_ROAMING */
+#ifdef HISTOGRAM
+	wavelan_set_histo,		/* SIOCIWFIRSTPRIV + 4 */
+	wavelan_get_histo,		/* SIOCIWFIRSTPRIV + 5 */
+#endif	/* HISTOGRAM */
+};
+
+static const struct iw_handler_def	wavelan_handler_def =
+{
+	.num_standard	= sizeof(wavelan_handler)/sizeof(iw_handler),
+	.num_private	= sizeof(wavelan_private_handler)/sizeof(iw_handler),
+	.num_private_args = sizeof(wavelan_private_args)/sizeof(struct iw_priv_args),
+	.standard	= wavelan_handler,
+	.private	= wavelan_private_handler,
+	.private_args	= wavelan_private_args,
+	.get_wireless_stats = wavelan_get_wireless_stats,
+};
+
+/*------------------------------------------------------------------*/
+/*
+ * Get wireless statistics
+ * Called by /proc/net/wireless...
+ */
+static iw_stats *
+wavelan_get_wireless_stats(struct net_device *	dev)
+{
+  kio_addr_t		base = dev->base_addr;
+  net_local *		lp = netdev_priv(dev);
+  mmr_t			m;
+  iw_stats *		wstats;
+  unsigned long		flags;
+
+#ifdef DEBUG_IOCTL_TRACE
+  printk(KERN_DEBUG "%s: ->wavelan_get_wireless_stats()\n", dev->name);
+#endif
+
+  /* Disable interrupts & save flags */
+  spin_lock_irqsave(&lp->spinlock, flags);
+
+  wstats = &lp->wstats;
+
+  /* Get data from the mmc */
+  mmc_out(base, mmwoff(0, mmw_freeze), 1);
+
+  mmc_read(base, mmroff(0, mmr_dce_status), &m.mmr_dce_status, 1);
+  mmc_read(base, mmroff(0, mmr_wrong_nwid_l), &m.mmr_wrong_nwid_l, 2);
+  mmc_read(base, mmroff(0, mmr_thr_pre_set), &m.mmr_thr_pre_set, 4);
+
+  mmc_out(base, mmwoff(0, mmw_freeze), 0);
+
+  /* Copy data to wireless stuff */
+  wstats->status = m.mmr_dce_status & MMR_DCE_STATUS;
+  wstats->qual.qual = m.mmr_sgnl_qual & MMR_SGNL_QUAL;
+  wstats->qual.level = m.mmr_signal_lvl & MMR_SIGNAL_LVL;
+  wstats->qual.noise = m.mmr_silence_lvl & MMR_SILENCE_LVL;
+  wstats->qual.updated = (((m.mmr_signal_lvl & MMR_SIGNAL_LVL_VALID) >> 7) |
+			  ((m.mmr_signal_lvl & MMR_SIGNAL_LVL_VALID) >> 6) |
+			  ((m.mmr_silence_lvl & MMR_SILENCE_LVL_VALID) >> 5));
+  wstats->discard.nwid += (m.mmr_wrong_nwid_h << 8) | m.mmr_wrong_nwid_l;
+  wstats->discard.code = 0L;
+  wstats->discard.misc = 0L;
+
+  /* ReEnable interrupts & restore flags */
+  spin_unlock_irqrestore(&lp->spinlock, flags);
+
+#ifdef DEBUG_IOCTL_TRACE
+  printk(KERN_DEBUG "%s: <-wavelan_get_wireless_stats()\n", dev->name);
+#endif
+  return &lp->wstats;
+}
+#endif	/* WIRELESS_EXT */
+
+/************************* PACKET RECEPTION *************************/
+/*
+ * This part deal with receiving the packets.
+ * The interrupt handler get an interrupt when a packet has been
+ * successfully received and called this part...
+ */
+
+/*------------------------------------------------------------------*/
+/*
+ * Calculate the starting address of the frame pointed to by the receive
+ * frame pointer and verify that the frame seem correct
+ * (called by wv_packet_rcv())
+ */
+static inline int
+wv_start_of_frame(struct net_device *	dev,
+		  int		rfp,	/* end of frame */
+		  int		wrap)	/* start of buffer */
+{
+  kio_addr_t	base = dev->base_addr;
+  int		rp;
+  int		len;
+
+  rp = (rfp - 5 + RX_SIZE) % RX_SIZE;
+  outb(rp & 0xff, PIORL(base));
+  outb(((rp >> 8) & PIORH_MASK), PIORH(base));
+  len = inb(PIOP(base));
+  len |= inb(PIOP(base)) << 8;
+
+  /* Sanity checks on size */
+  /* Frame too big */
+  if(len > MAXDATAZ + 100)
+    {
+#ifdef DEBUG_RX_ERROR
+      printk(KERN_INFO "%s: wv_start_of_frame: Received frame too large, rfp %d len 0x%x\n",
+	     dev->name, rfp, len);
+#endif
+      return(-1);
+    }
+  
+  /* Frame too short */
+  if(len < 7)
+    {
+#ifdef DEBUG_RX_ERROR
+      printk(KERN_INFO "%s: wv_start_of_frame: Received null frame, rfp %d len 0x%x\n",
+	     dev->name, rfp, len);
+#endif
+      return(-1);
+    }
+  
+  /* Wrap around buffer */
+  if(len > ((wrap - (rfp - len) + RX_SIZE) % RX_SIZE))	/* magic formula ! */
+    {
+#ifdef DEBUG_RX_ERROR
+      printk(KERN_INFO "%s: wv_start_of_frame: wrap around buffer, wrap %d rfp %d len 0x%x\n",
+	     dev->name, wrap, rfp, len);
+#endif
+      return(-1);
+    }
+
+  return((rp - len + RX_SIZE) % RX_SIZE);
+} /* wv_start_of_frame */
+
+/*------------------------------------------------------------------*/
+/*
+ * This routine does the actual copy of data (including the ethernet
+ * header structure) from the WaveLAN card to an sk_buff chain that
+ * will be passed up to the network interface layer. NOTE: We
+ * currently don't handle trailer protocols (neither does the rest of
+ * the network interface), so if that is needed, it will (at least in
+ * part) be added here.  The contents of the receive ring buffer are
+ * copied to a message chain that is then passed to the kernel.
+ *
+ * Note: if any errors occur, the packet is "dropped on the floor"
+ * (called by wv_packet_rcv())
+ */
+static inline void
+wv_packet_read(struct net_device *		dev,
+	       int		fd_p,
+	       int		sksize)
+{
+  net_local *		lp = netdev_priv(dev);
+  struct sk_buff *	skb;
+
+#ifdef DEBUG_RX_TRACE
+  printk(KERN_DEBUG "%s: ->wv_packet_read(0x%X, %d)\n",
+	 dev->name, fd_p, sksize);
+#endif
+
+  /* Allocate some buffer for the new packet */
+  if((skb = dev_alloc_skb(sksize+2)) == (struct sk_buff *) NULL)
+    {
+#ifdef DEBUG_RX_ERROR
+      printk(KERN_INFO "%s: wv_packet_read(): could not alloc_skb(%d, GFP_ATOMIC)\n",
+	     dev->name, sksize);
+#endif
+      lp->stats.rx_dropped++;
+      /*
+       * Not only do we want to return here, but we also need to drop the
+       * packet on the floor to clear the interrupt.
+       */
+      return;
+    }
+
+  skb->dev = dev;
+
+  skb_reserve(skb, 2);
+  fd_p = read_ringbuf(dev, fd_p, (char *) skb_put(skb, sksize), sksize);
+  skb->protocol = eth_type_trans(skb, dev);
+
+#ifdef DEBUG_RX_INFO
+  wv_packet_info(skb->mac.raw, sksize, dev->name, "wv_packet_read");
+#endif	/* DEBUG_RX_INFO */
+     
+  /* Statistics gathering & stuff associated.
+   * It seem a bit messy with all the define, but it's really simple... */
+  if(
+#ifdef IW_WIRELESS_SPY
+     (lp->spy_data.spy_number > 0) ||
+#endif	/* IW_WIRELESS_SPY */
+#ifdef HISTOGRAM
+     (lp->his_number > 0) ||
+#endif	/* HISTOGRAM */
+#ifdef WAVELAN_ROAMING
+     (do_roaming) ||
+#endif	/* WAVELAN_ROAMING */
+     0)
+    {
+      u_char	stats[3];	/* Signal level, Noise level, Signal quality */
+
+      /* read signal level, silence level and signal quality bytes */
+      fd_p = read_ringbuf(dev, (fd_p + 4) % RX_SIZE + RX_BASE,
+			  stats, 3);
+#ifdef DEBUG_RX_INFO
+      printk(KERN_DEBUG "%s: wv_packet_read(): Signal level %d/63, Silence level %d/63, signal quality %d/16\n",
+	     dev->name, stats[0] & 0x3F, stats[1] & 0x3F, stats[2] & 0x0F);
+#endif
+
+#ifdef WAVELAN_ROAMING
+      if(do_roaming)
+	if(WAVELAN_BEACON(skb->data))
+	  wl_roam_gather(dev, skb->data, stats);
+#endif	/* WAVELAN_ROAMING */
+	  
+#ifdef WIRELESS_SPY
+      wl_spy_gather(dev, skb->mac.raw + WAVELAN_ADDR_SIZE, stats);
+#endif	/* WIRELESS_SPY */
+#ifdef HISTOGRAM
+      wl_his_gather(dev, stats);
+#endif	/* HISTOGRAM */
+    }
+
+  /*
+   * Hand the packet to the Network Module
+   */
+  netif_rx(skb);
+
+  /* Keep stats up to date */
+  dev->last_rx = jiffies;
+  lp->stats.rx_packets++;
+  lp->stats.rx_bytes += sksize;
+
+#ifdef DEBUG_RX_TRACE
+  printk(KERN_DEBUG "%s: <-wv_packet_read()\n", dev->name);
+#endif
+  return;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * This routine is called by the interrupt handler to initiate a
+ * packet transfer from the card to the network interface layer above
+ * this driver.  This routine checks if a buffer has been successfully
+ * received by the WaveLAN card.  If so, the routine wv_packet_read is
+ * called to do the actual transfer of the card's data including the
+ * ethernet header into a packet consisting of an sk_buff chain.
+ * (called by wavelan_interrupt())
+ * Note : the spinlock is already grabbed for us and irq are disabled.
+ */
+static inline void
+wv_packet_rcv(struct net_device *	dev)
+{
+  kio_addr_t	base = dev->base_addr;
+  net_local *	lp = netdev_priv(dev);
+  int		newrfp;
+  int		rp;
+  int		len;
+  int		f_start;
+  int		status;
+  int		i593_rfp;
+  int		stat_ptr;
+  u_char	c[4];
+
+#ifdef DEBUG_RX_TRACE
+  printk(KERN_DEBUG "%s: ->wv_packet_rcv()\n", dev->name);
+#endif
+
+  /* Get the new receive frame pointer from the i82593 chip */
+  outb(CR0_STATUS_2 | OP0_NOP, LCCR(base));
+  i593_rfp = inb(LCSR(base));
+  i593_rfp |= inb(LCSR(base)) << 8;
+  i593_rfp %= RX_SIZE;
+
+  /* Get the new receive frame pointer from the WaveLAN card.
+   * It is 3 bytes more than the increment of the i82593 receive
+   * frame pointer, for each packet. This is because it includes the
+   * 3 roaming bytes added by the mmc.
+   */
+  newrfp = inb(RPLL(base));
+  newrfp |= inb(RPLH(base)) << 8;
+  newrfp %= RX_SIZE;
+
+#ifdef DEBUG_RX_INFO
+  printk(KERN_DEBUG "%s: wv_packet_rcv(): i593_rfp %d stop %d newrfp %d lp->rfp %d\n",
+	 dev->name, i593_rfp, lp->stop, newrfp, lp->rfp);
+#endif
+
+#ifdef DEBUG_RX_ERROR
+  /* If no new frame pointer... */
+  if(lp->overrunning || newrfp == lp->rfp)
+    printk(KERN_INFO "%s: wv_packet_rcv(): no new frame: i593_rfp %d stop %d newrfp %d lp->rfp %d\n",
+	   dev->name, i593_rfp, lp->stop, newrfp, lp->rfp);
+#endif
+
+  /* Read all frames (packets) received */
+  while(newrfp != lp->rfp)
+    {
+      /* A frame is composed of the packet, followed by a status word,
+       * the length of the frame (word) and the mmc info (SNR & qual).
+       * It's because the length is at the end that we can only scan
+       * frames backward. */
+
+      /* Find the first frame by skipping backwards over the frames */
+      rp = newrfp;	/* End of last frame */
+      while(((f_start = wv_start_of_frame(dev, rp, newrfp)) != lp->rfp) &&
+	    (f_start != -1))
+	  rp = f_start;
+
+      /* If we had a problem */
+      if(f_start == -1)
+	{
+#ifdef DEBUG_RX_ERROR
+	  printk(KERN_INFO "wavelan_cs: cannot find start of frame ");
+	  printk(" i593_rfp %d stop %d newrfp %d lp->rfp %d\n",
+		 i593_rfp, lp->stop, newrfp, lp->rfp);
+#endif
+	  lp->rfp = rp;		/* Get to the last usable frame */
+	  continue;
+	}
+
+      /* f_start point to the beggining of the first frame received
+       * and rp to the beggining of the next one */
+
+      /* Read status & length of the frame */
+      stat_ptr = (rp - 7 + RX_SIZE) % RX_SIZE;
+      stat_ptr = read_ringbuf(dev, stat_ptr, c, 4);
+      status = c[0] | (c[1] << 8);
+      len = c[2] | (c[3] << 8);
+
+      /* Check status */
+      if((status & RX_RCV_OK) != RX_RCV_OK)
+	{
+	  lp->stats.rx_errors++;
+	  if(status & RX_NO_SFD)
+	    lp->stats.rx_frame_errors++;
+	  if(status & RX_CRC_ERR)
+	    lp->stats.rx_crc_errors++;
+	  if(status & RX_OVRRUN)
+	    lp->stats.rx_over_errors++;
+
+#ifdef DEBUG_RX_FAIL
+	  printk(KERN_DEBUG "%s: wv_packet_rcv(): packet not received ok, status = 0x%x\n",
+		 dev->name, status);
+#endif
+	}
+      else
+	/* Read the packet and transmit to Linux */
+	wv_packet_read(dev, f_start, len - 2);
+
+      /* One frame has been processed, skip it */
+      lp->rfp = rp;
+    }
+
+  /*
+   * Update the frame stop register, but set it to less than
+   * the full 8K to allow space for 3 bytes of signal strength
+   * per packet.
+   */
+  lp->stop = (i593_rfp + RX_SIZE - ((RX_SIZE / 64) * 3)) % RX_SIZE;
+  outb(OP0_SWIT_TO_PORT_1 | CR0_CHNL, LCCR(base));
+  outb(CR1_STOP_REG_UPDATE | (lp->stop >> RX_SIZE_SHIFT), LCCR(base));
+  outb(OP1_SWIT_TO_PORT_0, LCCR(base));
+
+#ifdef DEBUG_RX_TRACE
+  printk(KERN_DEBUG "%s: <-wv_packet_rcv()\n", dev->name);
+#endif
+}
+
+/*********************** PACKET TRANSMISSION ***********************/
+/*
+ * This part deal with sending packet through the wavelan
+ * We copy the packet to the send buffer and then issue the send
+ * command to the i82593. The result of this operation will be
+ * checked in wavelan_interrupt()
+ */
+
+/*------------------------------------------------------------------*/
+/*
+ * This routine fills in the appropriate registers and memory
+ * locations on the WaveLAN card and starts the card off on
+ * the transmit.
+ * (called in wavelan_packet_xmit())
+ */
+static inline void
+wv_packet_write(struct net_device *	dev,
+		void *		buf,
+		short		length)
+{
+  net_local *		lp = netdev_priv(dev);
+  kio_addr_t		base = dev->base_addr;
+  unsigned long		flags;
+  int			clen = length;
+  register u_short	xmtdata_base = TX_BASE;
+
+#ifdef DEBUG_TX_TRACE
+  printk(KERN_DEBUG "%s: ->wv_packet_write(%d)\n", dev->name, length);
+#endif
+
+  spin_lock_irqsave(&lp->spinlock, flags);
+
+  /* Write the length of data buffer followed by the buffer */
+  outb(xmtdata_base & 0xff, PIORL(base));
+  outb(((xmtdata_base >> 8) & PIORH_MASK) | PIORH_SEL_TX, PIORH(base));
+  outb(clen & 0xff, PIOP(base));	/* lsb */
+  outb(clen >> 8, PIOP(base));  	/* msb */
+
+  /* Send the data */
+  outsb(PIOP(base), buf, clen);
+
+  /* Indicate end of transmit chain */
+  outb(OP0_NOP, PIOP(base));
+  /* josullvn@cs.cmu.edu: need to send a second NOP for alignment... */
+  outb(OP0_NOP, PIOP(base));
+
+  /* Reset the transmit DMA pointer */
+  hacr_write_slow(base, HACR_PWR_STAT | HACR_TX_DMA_RESET);
+  hacr_write(base, HACR_DEFAULT);
+  /* Send the transmit command */
+  wv_82593_cmd(dev, "wv_packet_write(): transmit",
+	       OP0_TRANSMIT, SR0_NO_RESULT);
+
+  /* Make sure the watchdog will keep quiet for a while */
+  dev->trans_start = jiffies;
+
+  /* Keep stats up to date */
+  lp->stats.tx_bytes += length;
+
+  spin_unlock_irqrestore(&lp->spinlock, flags);
+
+#ifdef DEBUG_TX_INFO
+  wv_packet_info((u_char *) buf, length, dev->name, "wv_packet_write");
+#endif	/* DEBUG_TX_INFO */
+
+#ifdef DEBUG_TX_TRACE
+  printk(KERN_DEBUG "%s: <-wv_packet_write()\n", dev->name);
+#endif
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * This routine is called when we want to send a packet (NET3 callback)
+ * In this routine, we check if the harware is ready to accept
+ * the packet. We also prevent reentrance. Then, we call the function
+ * to send the packet...
+ */
+static int
+wavelan_packet_xmit(struct sk_buff *	skb,
+		    struct net_device *		dev)
+{
+  net_local *		lp = netdev_priv(dev);
+  unsigned long		flags;
+
+#ifdef DEBUG_TX_TRACE
+  printk(KERN_DEBUG "%s: ->wavelan_packet_xmit(0x%X)\n", dev->name,
+	 (unsigned) skb);
+#endif
+
+  /*
+   * Block a timer-based transmit from overlapping a previous transmit.
+   * In other words, prevent reentering this routine.
+   */
+  netif_stop_queue(dev);
+
+  /* If somebody has asked to reconfigure the controller,
+   * we can do it now */
+  if(lp->reconfig_82593)
+    {
+      spin_lock_irqsave(&lp->spinlock, flags);	/* Disable interrupts */
+      wv_82593_config(dev);
+      spin_unlock_irqrestore(&lp->spinlock, flags);	/* Re-enable interrupts */
+      /* Note : the configure procedure was totally synchronous,
+       * so the Tx buffer is now free */
+    }
+
+#ifdef DEBUG_TX_ERROR
+	if (skb->next)
+		printk(KERN_INFO "skb has next\n");
+#endif
+
+	/* Check if we need some padding */
+	/* Note : on wireless the propagation time is in the order of 1us,
+	 * and we don't have the Ethernet specific requirement of beeing
+	 * able to detect collisions, therefore in theory we don't really
+	 * need to pad. Jean II */
+	if (skb->len < ETH_ZLEN) {
+		skb = skb_padto(skb, ETH_ZLEN);
+		if (skb == NULL)
+			return 0;
+	}
+
+  wv_packet_write(dev, skb->data, skb->len);
+
+  dev_kfree_skb(skb);
+
+#ifdef DEBUG_TX_TRACE
+  printk(KERN_DEBUG "%s: <-wavelan_packet_xmit()\n", dev->name);
+#endif
+  return(0);
+}
+
+/********************** HARDWARE CONFIGURATION **********************/
+/*
+ * This part do the real job of starting and configuring the hardware.
+ */
+
+/*------------------------------------------------------------------*/
+/*
+ * Routine to initialize the Modem Management Controller.
+ * (called by wv_hw_config())
+ */
+static inline int
+wv_mmc_init(struct net_device *	dev)
+{
+  kio_addr_t	base = dev->base_addr;
+  psa_t		psa;
+  mmw_t		m;
+  int		configured;
+  int		i;		/* Loop counter */
+
+#ifdef DEBUG_CONFIG_TRACE
+  printk(KERN_DEBUG "%s: ->wv_mmc_init()\n", dev->name);
+#endif
+
+  /* Read the parameter storage area */
+  psa_read(dev, 0, (unsigned char *) &psa, sizeof(psa));
+
+  /*
+   * Check the first three octets of the MAC addr for the manufacturer's code.
+   * Note: If you get the error message below, you've got a
+   * non-NCR/AT&T/Lucent PCMCIA cards, see wavelan_cs.h for detail on
+   * how to configure your card...
+   */
+  for(i = 0; i < (sizeof(MAC_ADDRESSES) / sizeof(char) / 3); i++)
+    if((psa.psa_univ_mac_addr[0] == MAC_ADDRESSES[i][0]) &&
+       (psa.psa_univ_mac_addr[1] == MAC_ADDRESSES[i][1]) &&
+       (psa.psa_univ_mac_addr[2] == MAC_ADDRESSES[i][2]))
+      break;
+
+  /* If we have not found it... */
+  if(i == (sizeof(MAC_ADDRESSES) / sizeof(char) / 3))
+    {
+#ifdef DEBUG_CONFIG_ERRORS
+      printk(KERN_WARNING "%s: wv_mmc_init(): Invalid MAC address: %02X:%02X:%02X:...\n",
+	     dev->name, psa.psa_univ_mac_addr[0],
+	     psa.psa_univ_mac_addr[1], psa.psa_univ_mac_addr[2]);
+#endif
+      return FALSE;
+    }
+
+  /* Get the MAC address */
+  memcpy(&dev->dev_addr[0], &psa.psa_univ_mac_addr[0], WAVELAN_ADDR_SIZE);
+
+#ifdef USE_PSA_CONFIG
+  configured = psa.psa_conf_status & 1;
+#else
+  configured = 0;
+#endif
+
+  /* Is the PSA is not configured */
+  if(!configured)
+    {
+      /* User will be able to configure NWID after (with iwconfig) */
+      psa.psa_nwid[0] = 0;
+      psa.psa_nwid[1] = 0;
+
+      /* As NWID is not set : no NWID checking */
+      psa.psa_nwid_select = 0;
+
+      /* Disable encryption */
+      psa.psa_encryption_select = 0;
+
+      /* Set to standard values
+       * 0x04 for AT,
+       * 0x01 for MCA,
+       * 0x04 for PCMCIA and 2.00 card (AT&T 407-024689/E document)
+       */
+      if (psa.psa_comp_number & 1)
+	psa.psa_thr_pre_set = 0x01;
+      else
+	psa.psa_thr_pre_set = 0x04;
+      psa.psa_quality_thr = 0x03;
+
+      /* It is configured */
+      psa.psa_conf_status |= 1;
+
+#ifdef USE_PSA_CONFIG
+      /* Write the psa */
+      psa_write(dev, (char *)psa.psa_nwid - (char *)&psa,
+		(unsigned char *)psa.psa_nwid, 4);
+      psa_write(dev, (char *)&psa.psa_thr_pre_set - (char *)&psa,
+		(unsigned char *)&psa.psa_thr_pre_set, 1);
+      psa_write(dev, (char *)&psa.psa_quality_thr - (char *)&psa,
+		(unsigned char *)&psa.psa_quality_thr, 1);
+      psa_write(dev, (char *)&psa.psa_conf_status - (char *)&psa,
+		(unsigned char *)&psa.psa_conf_status, 1);
+      /* update the Wavelan checksum */
+      update_psa_checksum(dev);
+#endif	/* USE_PSA_CONFIG */
+    }
+
+  /* Zero the mmc structure */
+  memset(&m, 0x00, sizeof(m));
+
+  /* Copy PSA info to the mmc */
+  m.mmw_netw_id_l = psa.psa_nwid[1];
+  m.mmw_netw_id_h = psa.psa_nwid[0];
+  
+  if(psa.psa_nwid_select & 1)
+    m.mmw_loopt_sel = 0x00;
+  else
+    m.mmw_loopt_sel = MMW_LOOPT_SEL_DIS_NWID;
+
+  memcpy(&m.mmw_encr_key, &psa.psa_encryption_key, 
+	 sizeof(m.mmw_encr_key));
+
+  if(psa.psa_encryption_select)
+    m.mmw_encr_enable = MMW_ENCR_ENABLE_EN | MMW_ENCR_ENABLE_MODE;
+  else
+    m.mmw_encr_enable = 0;
+
+  m.mmw_thr_pre_set = psa.psa_thr_pre_set & 0x3F;
+  m.mmw_quality_thr = psa.psa_quality_thr & 0x0F;
+
+  /*
+   * Set default modem control parameters.
+   * See NCR document 407-0024326 Rev. A.
+   */
+  m.mmw_jabber_enable = 0x01;
+  m.mmw_anten_sel = MMW_ANTEN_SEL_ALG_EN;
+  m.mmw_ifs = 0x20;
+  m.mmw_mod_delay = 0x04;
+  m.mmw_jam_time = 0x38;
+
+  m.mmw_des_io_invert = 0;
+  m.mmw_freeze = 0;
+  m.mmw_decay_prm = 0;
+  m.mmw_decay_updat_prm = 0;
+
+  /* Write all info to mmc */
+  mmc_write(base, 0, (u_char *)&m, sizeof(m));
+
+  /* The following code start the modem of the 2.00 frequency
+   * selectable cards at power on. It's not strictly needed for the
+   * following boots...
+   * The original patch was by Joe Finney for the PCMCIA driver, but
+   * I've cleaned it a bit and add documentation.
+   * Thanks to Loeke Brederveld from Lucent for the info.
+   */
+
+  /* Attempt to recognise 2.00 cards (2.4 GHz frequency selectable)
+   * (does it work for everybody ? - especially old cards...) */
+  /* Note : WFREQSEL verify that it is able to read from EEprom
+   * a sensible frequency (address 0x00) + that MMR_FEE_STATUS_ID
+   * is 0xA (Xilinx version) or 0xB (Ariadne version).
+   * My test is more crude but do work... */
+  if(!(mmc_in(base, mmroff(0, mmr_fee_status)) &
+       (MMR_FEE_STATUS_DWLD | MMR_FEE_STATUS_BUSY)))
+    {
+      /* We must download the frequency parameters to the
+       * synthetisers (from the EEprom - area 1)
+       * Note : as the EEprom is auto decremented, we set the end
+       * if the area... */
+      m.mmw_fee_addr = 0x0F;
+      m.mmw_fee_ctrl = MMW_FEE_CTRL_READ | MMW_FEE_CTRL_DWLD;
+      mmc_write(base, (char *)&m.mmw_fee_ctrl - (char *)&m,
+		(unsigned char *)&m.mmw_fee_ctrl, 2);
+
+      /* Wait until the download is finished */
+      fee_wait(base, 100, 100);
+
+#ifdef DEBUG_CONFIG_INFO
+      /* The frequency was in the last word downloaded... */
+      mmc_read(base, (char *)&m.mmw_fee_data_l - (char *)&m,
+	       (unsigned char *)&m.mmw_fee_data_l, 2);
+
+      /* Print some info for the user */
+      printk(KERN_DEBUG "%s: Wavelan 2.00 recognised (frequency select) : Current frequency = %ld\n",
+	     dev->name,
+	     ((m.mmw_fee_data_h << 4) |
+	      (m.mmw_fee_data_l >> 4)) * 5 / 2 + 24000L);
+#endif
+
+      /* We must now download the power adjust value (gain) to
+       * the synthetisers (from the EEprom - area 7 - DAC) */
+      m.mmw_fee_addr = 0x61;
+      m.mmw_fee_ctrl = MMW_FEE_CTRL_READ | MMW_FEE_CTRL_DWLD;
+      mmc_write(base, (char *)&m.mmw_fee_ctrl - (char *)&m,
+		(unsigned char *)&m.mmw_fee_ctrl, 2);
+
+      /* Wait until the download is finished */
+    }	/* if 2.00 card */
+
+#ifdef DEBUG_CONFIG_TRACE
+  printk(KERN_DEBUG "%s: <-wv_mmc_init()\n", dev->name);
+#endif
+  return TRUE;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Routine to gracefully turn off reception, and wait for any commands
+ * to complete.
+ * (called in wv_ru_start() and wavelan_close() and wavelan_event())
+ */
+static int
+wv_ru_stop(struct net_device *	dev)
+{
+  kio_addr_t	base = dev->base_addr;
+  net_local *	lp = netdev_priv(dev);
+  unsigned long	flags;
+  int		status;
+  int		spin;
+
+#ifdef DEBUG_CONFIG_TRACE
+  printk(KERN_DEBUG "%s: ->wv_ru_stop()\n", dev->name);
+#endif
+
+  spin_lock_irqsave(&lp->spinlock, flags);
+
+  /* First, send the LAN controller a stop receive command */
+  wv_82593_cmd(dev, "wv_graceful_shutdown(): stop-rcv",
+	       OP0_STOP_RCV, SR0_NO_RESULT);
+
+  /* Then, spin until the receive unit goes idle */
+  spin = 300;
+  do
+    {
+      udelay(10);
+      outb(OP0_NOP | CR0_STATUS_3, LCCR(base));
+      status = inb(LCSR(base));
+    }
+  while(((status & SR3_RCV_STATE_MASK) != SR3_RCV_IDLE) && (spin-- > 0));
+
+  /* Now, spin until the chip finishes executing its current command */
+  do
+    {
+      udelay(10);
+      outb(OP0_NOP | CR0_STATUS_3, LCCR(base));
+      status = inb(LCSR(base));
+    }
+  while(((status & SR3_EXEC_STATE_MASK) != SR3_EXEC_IDLE) && (spin-- > 0));
+
+  spin_unlock_irqrestore(&lp->spinlock, flags);
+
+  /* If there was a problem */
+  if(spin <= 0)
+    {
+#ifdef DEBUG_CONFIG_ERRORS
+      printk(KERN_INFO "%s: wv_ru_stop(): The chip doesn't want to stop...\n",
+	     dev->name);
+#endif
+      return FALSE;
+    }
+
+#ifdef DEBUG_CONFIG_TRACE
+  printk(KERN_DEBUG "%s: <-wv_ru_stop()\n", dev->name);
+#endif
+  return TRUE;
+} /* wv_ru_stop */
+
+/*------------------------------------------------------------------*/
+/*
+ * This routine starts the receive unit running.  First, it checks if
+ * the card is actually ready. Then the card is instructed to receive
+ * packets again.
+ * (called in wv_hw_reset() & wavelan_open())
+ */
+static int
+wv_ru_start(struct net_device *	dev)
+{
+  kio_addr_t	base = dev->base_addr;
+  net_local *	lp = netdev_priv(dev);
+  unsigned long	flags;
+
+#ifdef DEBUG_CONFIG_TRACE
+  printk(KERN_DEBUG "%s: ->wv_ru_start()\n", dev->name);
+#endif
+
+  /*
+   * We need to start from a quiescent state. To do so, we could check
+   * if the card is already running, but instead we just try to shut
+   * it down. First, we disable reception (in case it was already enabled).
+   */
+  if(!wv_ru_stop(dev))
+    return FALSE;
+
+  spin_lock_irqsave(&lp->spinlock, flags);
+
+  /* Now we know that no command is being executed. */
+
+  /* Set the receive frame pointer and stop pointer */
+  lp->rfp = 0;
+  outb(OP0_SWIT_TO_PORT_1 | CR0_CHNL, LCCR(base));
+
+  /* Reset ring management.  This sets the receive frame pointer to 1 */
+  outb(OP1_RESET_RING_MNGMT, LCCR(base));
+
+#if 0
+  /* XXX the i82593 manual page 6-4 seems to indicate that the stop register
+     should be set as below */
+  /* outb(CR1_STOP_REG_UPDATE|((RX_SIZE - 0x40)>> RX_SIZE_SHIFT),LCCR(base));*/
+#elif 0
+  /* but I set it 0 instead */
+  lp->stop = 0;
+#else
+  /* but I set it to 3 bytes per packet less than 8K */
+  lp->stop = (0 + RX_SIZE - ((RX_SIZE / 64) * 3)) % RX_SIZE;
+#endif
+  outb(CR1_STOP_REG_UPDATE | (lp->stop >> RX_SIZE_SHIFT), LCCR(base));
+  outb(OP1_INT_ENABLE, LCCR(base));
+  outb(OP1_SWIT_TO_PORT_0, LCCR(base));
+
+  /* Reset receive DMA pointer */
+  hacr_write_slow(base, HACR_PWR_STAT | HACR_TX_DMA_RESET);
+  hacr_write_slow(base, HACR_DEFAULT);
+
+  /* Receive DMA on channel 1 */
+  wv_82593_cmd(dev, "wv_ru_start(): rcv-enable",
+	       CR0_CHNL | OP0_RCV_ENABLE, SR0_NO_RESULT);
+
+#ifdef DEBUG_I82593_SHOW
+  {
+    int	status;
+    int	opri;
+    int	spin = 10000;
+
+    /* spin until the chip starts receiving */
+    do
+      {
+	outb(OP0_NOP | CR0_STATUS_3, LCCR(base));
+	status = inb(LCSR(base));
+	if(spin-- <= 0)
+	  break;
+      }
+    while(((status & SR3_RCV_STATE_MASK) != SR3_RCV_ACTIVE) &&
+	  ((status & SR3_RCV_STATE_MASK) != SR3_RCV_READY));
+    printk(KERN_DEBUG "rcv status is 0x%x [i:%d]\n",
+	   (status & SR3_RCV_STATE_MASK), i);
+  }
+#endif
+
+  spin_unlock_irqrestore(&lp->spinlock, flags);
+
+#ifdef DEBUG_CONFIG_TRACE
+  printk(KERN_DEBUG "%s: <-wv_ru_start()\n", dev->name);
+#endif
+  return TRUE;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * This routine does a standard config of the WaveLAN controller (i82593).
+ * In the ISA driver, this is integrated in wavelan_hardware_reset()
+ * (called by wv_hw_config(), wv_82593_reconfig() & wavelan_packet_xmit())
+ */
+static int
+wv_82593_config(struct net_device *	dev)
+{
+  kio_addr_t			base = dev->base_addr;
+  net_local *			lp = netdev_priv(dev);
+  struct i82593_conf_block	cfblk;
+  int				ret = TRUE;
+
+#ifdef DEBUG_CONFIG_TRACE
+  printk(KERN_DEBUG "%s: ->wv_82593_config()\n", dev->name);
+#endif
+
+  /* Create & fill i82593 config block
+   *
+   * Now conform to Wavelan document WCIN085B
+   */
+  memset(&cfblk, 0x00, sizeof(struct i82593_conf_block));
+  cfblk.d6mod = FALSE;  	/* Run in i82593 advanced mode */
+  cfblk.fifo_limit = 5;         /* = 56 B rx and 40 B tx fifo thresholds */
+  cfblk.forgnesi = FALSE;       /* 0=82C501, 1=AMD7992B compatibility */
+  cfblk.fifo_32 = 1;
+  cfblk.throttle_enb = FALSE;
+  cfblk.contin = TRUE;          /* enable continuous mode */
+  cfblk.cntrxint = FALSE;       /* enable continuous mode receive interrupts */
+  cfblk.addr_len = WAVELAN_ADDR_SIZE;
+  cfblk.acloc = TRUE;           /* Disable source addr insertion by i82593 */
+  cfblk.preamb_len = 0;         /* 2 bytes preamble (SFD) */
+  cfblk.loopback = FALSE;
+  cfblk.lin_prio = 0;   	/* conform to 802.3 backoff algoritm */
+  cfblk.exp_prio = 5;	        /* conform to 802.3 backoff algoritm */
+  cfblk.bof_met = 1;	        /* conform to 802.3 backoff algoritm */
+  cfblk.ifrm_spc = 0x20;	/* 32 bit times interframe spacing */
+  cfblk.slottim_low = 0x20;	/* 32 bit times slot time */
+  cfblk.slottim_hi = 0x0;
+  cfblk.max_retr = 15;
+  cfblk.prmisc = ((lp->promiscuous) ? TRUE: FALSE);	/* Promiscuous mode */
+  cfblk.bc_dis = FALSE;         /* Enable broadcast reception */
+  cfblk.crs_1 = TRUE;		/* Transmit without carrier sense */
+  cfblk.nocrc_ins = FALSE;	/* i82593 generates CRC */	
+  cfblk.crc_1632 = FALSE;	/* 32-bit Autodin-II CRC */
+  cfblk.crs_cdt = FALSE;	/* CD not to be interpreted as CS */
+  cfblk.cs_filter = 0;  	/* CS is recognized immediately */
+  cfblk.crs_src = FALSE;	/* External carrier sense */
+  cfblk.cd_filter = 0;  	/* CD is recognized immediately */
+  cfblk.min_fr_len = ETH_ZLEN >> 2;     /* Minimum frame length 64 bytes */
+  cfblk.lng_typ = FALSE;	/* Length field > 1500 = type field */
+  cfblk.lng_fld = TRUE; 	/* Disable 802.3 length field check */
+  cfblk.rxcrc_xf = TRUE;	/* Don't transfer CRC to memory */
+  cfblk.artx = TRUE;		/* Disable automatic retransmission */
+  cfblk.sarec = TRUE;		/* Disable source addr trig of CD */
+  cfblk.tx_jabber = TRUE;	/* Disable jabber jam sequence */
+  cfblk.hash_1 = FALSE; 	/* Use bits 0-5 in mc address hash */
+  cfblk.lbpkpol = TRUE; 	/* Loopback pin active high */
+  cfblk.fdx = FALSE;		/* Disable full duplex operation */
+  cfblk.dummy_6 = 0x3f; 	/* all ones */
+  cfblk.mult_ia = FALSE;	/* No multiple individual addresses */
+  cfblk.dis_bof = FALSE;	/* Disable the backoff algorithm ?! */
+  cfblk.dummy_1 = TRUE; 	/* set to 1 */
+  cfblk.tx_ifs_retrig = 3;	/* Hmm... Disabled */
+#ifdef MULTICAST_ALL
+  cfblk.mc_all = (lp->allmulticast ? TRUE: FALSE);	/* Allow all multicasts */
+#else
+  cfblk.mc_all = FALSE;		/* No multicast all mode */
+#endif
+  cfblk.rcv_mon = 0;		/* Monitor mode disabled */
+  cfblk.frag_acpt = TRUE;	/* Do not accept fragments */
+  cfblk.tstrttrs = FALSE;	/* No start transmission threshold */
+  cfblk.fretx = TRUE;		/* FIFO automatic retransmission */
+  cfblk.syncrqs = FALSE; 	/* Synchronous DRQ deassertion... */
+  cfblk.sttlen = TRUE;  	/* 6 byte status registers */
+  cfblk.rx_eop = TRUE;  	/* Signal EOP on packet reception */
+  cfblk.tx_eop = TRUE;  	/* Signal EOP on packet transmission */
+  cfblk.rbuf_size = RX_SIZE>>11;	/* Set receive buffer size */
+  cfblk.rcvstop = TRUE; 	/* Enable Receive Stop Register */
+
+#ifdef DEBUG_I82593_SHOW
+  {
+    u_char *c = (u_char *) &cfblk;
+    int i;
+    printk(KERN_DEBUG "wavelan_cs: config block:");
+    for(i = 0; i < sizeof(struct i82593_conf_block); i++,c++)
+      {
+	if((i % 16) == 0) printk("\n" KERN_DEBUG);
+	printk("%02x ", *c);
+      }
+    printk("\n");
+  }
+#endif
+
+  /* Copy the config block to the i82593 */
+  outb(TX_BASE & 0xff, PIORL(base));
+  outb(((TX_BASE >> 8) & PIORH_MASK) | PIORH_SEL_TX, PIORH(base));
+  outb(sizeof(struct i82593_conf_block) & 0xff, PIOP(base));    /* lsb */
+  outb(sizeof(struct i82593_conf_block) >> 8, PIOP(base));	/* msb */
+  outsb(PIOP(base), (char *) &cfblk, sizeof(struct i82593_conf_block));
+
+  /* reset transmit DMA pointer */
+  hacr_write_slow(base, HACR_PWR_STAT | HACR_TX_DMA_RESET);
+  hacr_write(base, HACR_DEFAULT);
+  if(!wv_82593_cmd(dev, "wv_82593_config(): configure",
+		   OP0_CONFIGURE, SR0_CONFIGURE_DONE))
+    ret = FALSE;
+
+  /* Initialize adapter's ethernet MAC address */
+  outb(TX_BASE & 0xff, PIORL(base));
+  outb(((TX_BASE >> 8) & PIORH_MASK) | PIORH_SEL_TX, PIORH(base));
+  outb(WAVELAN_ADDR_SIZE, PIOP(base));	/* byte count lsb */
+  outb(0, PIOP(base));			/* byte count msb */
+  outsb(PIOP(base), &dev->dev_addr[0], WAVELAN_ADDR_SIZE);
+
+  /* reset transmit DMA pointer */
+  hacr_write_slow(base, HACR_PWR_STAT | HACR_TX_DMA_RESET);
+  hacr_write(base, HACR_DEFAULT);
+  if(!wv_82593_cmd(dev, "wv_82593_config(): ia-setup",
+		   OP0_IA_SETUP, SR0_IA_SETUP_DONE))
+    ret = FALSE;
+
+#ifdef WAVELAN_ROAMING
+    /* If roaming is enabled, join the "Beacon Request" multicast group... */
+    /* But only if it's not in there already! */
+  if(do_roaming)
+    dev_mc_add(dev,WAVELAN_BEACON_ADDRESS, WAVELAN_ADDR_SIZE, 1);
+#endif	/* WAVELAN_ROAMING */
+
+  /* If any multicast address to set */
+  if(lp->mc_count)
+    {
+      struct dev_mc_list *	dmi;
+      int			addrs_len = WAVELAN_ADDR_SIZE * lp->mc_count;
+
+#ifdef DEBUG_CONFIG_INFO
+      printk(KERN_DEBUG "%s: wv_hw_config(): set %d multicast addresses:\n",
+	     dev->name, lp->mc_count);
+      for(dmi=dev->mc_list; dmi; dmi=dmi->next)
+	printk(KERN_DEBUG " %02x:%02x:%02x:%02x:%02x:%02x\n",
+	       dmi->dmi_addr[0], dmi->dmi_addr[1], dmi->dmi_addr[2],
+	       dmi->dmi_addr[3], dmi->dmi_addr[4], dmi->dmi_addr[5] );
+#endif
+
+      /* Initialize adapter's ethernet multicast addresses */
+      outb(TX_BASE & 0xff, PIORL(base));
+      outb(((TX_BASE >> 8) & PIORH_MASK) | PIORH_SEL_TX, PIORH(base));
+      outb(addrs_len & 0xff, PIOP(base));	/* byte count lsb */
+      outb((addrs_len >> 8), PIOP(base));	/* byte count msb */
+      for(dmi=dev->mc_list; dmi; dmi=dmi->next)
+	outsb(PIOP(base), dmi->dmi_addr, dmi->dmi_addrlen);
+
+      /* reset transmit DMA pointer */
+      hacr_write_slow(base, HACR_PWR_STAT | HACR_TX_DMA_RESET);
+      hacr_write(base, HACR_DEFAULT);
+      if(!wv_82593_cmd(dev, "wv_82593_config(): mc-setup",
+		       OP0_MC_SETUP, SR0_MC_SETUP_DONE))
+	ret = FALSE;
+      lp->mc_count = dev->mc_count;	/* remember to avoid repeated reset */
+    }
+
+  /* Job done, clear the flag */
+  lp->reconfig_82593 = FALSE;
+
+#ifdef DEBUG_CONFIG_TRACE
+  printk(KERN_DEBUG "%s: <-wv_82593_config()\n", dev->name);
+#endif
+  return(ret);
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Read the Access Configuration Register, perform a software reset,
+ * and then re-enable the card's software.
+ *
+ * If I understand correctly : reset the pcmcia interface of the
+ * wavelan.
+ * (called by wv_config())
+ */
+static inline int
+wv_pcmcia_reset(struct net_device *	dev)
+{
+  int		i;
+  conf_reg_t	reg = { 0, CS_READ, CISREG_COR, 0 };
+  dev_link_t *	link = ((net_local *)netdev_priv(dev))->link;
+
+#ifdef DEBUG_CONFIG_TRACE
+  printk(KERN_DEBUG "%s: ->wv_pcmcia_reset()\n", dev->name);
+#endif
+
+  i = pcmcia_access_configuration_register(link->handle, &reg);
+  if(i != CS_SUCCESS)
+    {
+      cs_error(link->handle, AccessConfigurationRegister, i);
+      return FALSE;
+    }
+      
+#ifdef DEBUG_CONFIG_INFO
+  printk(KERN_DEBUG "%s: wavelan_pcmcia_reset(): Config reg is 0x%x\n",
+	 dev->name, (u_int) reg.Value);
+#endif
+
+  reg.Action = CS_WRITE;
+  reg.Value = reg.Value | COR_SW_RESET;
+  i = pcmcia_access_configuration_register(link->handle, &reg);
+  if(i != CS_SUCCESS)
+    {
+      cs_error(link->handle, AccessConfigurationRegister, i);
+      return FALSE;
+    }
+      
+  reg.Action = CS_WRITE;
+  reg.Value = COR_LEVEL_IRQ | COR_CONFIG;
+  i = pcmcia_access_configuration_register(link->handle, &reg);
+  if(i != CS_SUCCESS)
+    {
+      cs_error(link->handle, AccessConfigurationRegister, i);
+      return FALSE;
+    }
+
+#ifdef DEBUG_CONFIG_TRACE
+  printk(KERN_DEBUG "%s: <-wv_pcmcia_reset()\n", dev->name);
+#endif
+  return TRUE;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * wavelan_hw_config() is called after a CARD_INSERTION event is
+ * received, to configure the wavelan hardware.
+ * Note that the reception will be enabled in wavelan->open(), so the
+ * device is configured but idle...
+ * Performs the following actions:
+ * 	1. A pcmcia software reset (using wv_pcmcia_reset())
+ *	2. A power reset (reset DMA)
+ *	3. Reset the LAN controller
+ *	4. Initialize the radio modem (using wv_mmc_init)
+ *	5. Configure LAN controller (using wv_82593_config)
+ *	6. Perform a diagnostic on the LAN controller
+ * (called by wavelan_event() & wv_hw_reset())
+ */
+static int
+wv_hw_config(struct net_device *	dev)
+{
+  net_local *		lp = netdev_priv(dev);
+  kio_addr_t		base = dev->base_addr;
+  unsigned long		flags;
+  int			ret = FALSE;
+
+#ifdef DEBUG_CONFIG_TRACE
+  printk(KERN_DEBUG "%s: ->wv_hw_config()\n", dev->name);
+#endif
+
+#ifdef STRUCT_CHECK
+  if(wv_structuct_check() != (char *) NULL)
+    {
+      printk(KERN_WARNING "%s: wv_hw_config: structure/compiler botch: \"%s\"\n",
+	     dev->name, wv_structuct_check());
+      return FALSE;
+    }
+#endif	/* STRUCT_CHECK == 1 */
+
+  /* Reset the pcmcia interface */
+  if(wv_pcmcia_reset(dev) == FALSE)
+    return FALSE;
+
+  /* Disable interrupts */
+  spin_lock_irqsave(&lp->spinlock, flags);
+
+  /* Disguised goto ;-) */
+  do
+    {
+      /* Power UP the module + reset the modem + reset host adapter
+       * (in fact, reset DMA channels) */
+      hacr_write_slow(base, HACR_RESET);
+      hacr_write(base, HACR_DEFAULT);
+
+      /* Check if the module has been powered up... */
+      if(hasr_read(base) & HASR_NO_CLK)
+	{
+#ifdef DEBUG_CONFIG_ERRORS
+	  printk(KERN_WARNING "%s: wv_hw_config(): modem not connected or not a wavelan card\n",
+		 dev->name);
+#endif
+	  break;
+	}
+
+      /* initialize the modem */
+      if(wv_mmc_init(dev) == FALSE)
+	{
+#ifdef DEBUG_CONFIG_ERRORS
+	  printk(KERN_WARNING "%s: wv_hw_config(): Can't configure the modem\n",
+		 dev->name);
+#endif
+	  break;
+	}
+
+      /* reset the LAN controller (i82593) */
+      outb(OP0_RESET, LCCR(base));
+      mdelay(1);	/* A bit crude ! */
+
+      /* Initialize the LAN controller */
+      if(wv_82593_config(dev) == FALSE)
+	{
+#ifdef DEBUG_CONFIG_ERRORS
+	  printk(KERN_INFO "%s: wv_hw_config(): i82593 init failed\n",
+		 dev->name);
+#endif
+	  break;
+	}
+
+      /* Diagnostic */
+      if(wv_diag(dev) == FALSE)
+	{
+#ifdef DEBUG_CONFIG_ERRORS
+	  printk(KERN_INFO "%s: wv_hw_config(): i82593 diagnostic failed\n",
+		 dev->name);
+#endif
+	  break;
+	}
+
+      /* 
+       * insert code for loopback test here
+       */
+
+      /* The device is now configured */
+      lp->configured = 1;
+      ret = TRUE;
+    }
+  while(0);
+
+  /* Re-enable interrupts */
+  spin_unlock_irqrestore(&lp->spinlock, flags);
+
+#ifdef DEBUG_CONFIG_TRACE
+  printk(KERN_DEBUG "%s: <-wv_hw_config()\n", dev->name);
+#endif
+  return(ret);
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Totally reset the wavelan and restart it.
+ * Performs the following actions:
+ * 	1. Call wv_hw_config()
+ *	2. Start the LAN controller's receive unit
+ * (called by wavelan_event(), wavelan_watchdog() and wavelan_open())
+ */
+static inline void
+wv_hw_reset(struct net_device *	dev)
+{
+  net_local *	lp = netdev_priv(dev);
+
+#ifdef DEBUG_CONFIG_TRACE
+  printk(KERN_DEBUG "%s: ->wv_hw_reset()\n", dev->name);
+#endif
+
+  lp->nresets++;
+  lp->configured = 0;
+  
+  /* Call wv_hw_config() for most of the reset & init stuff */
+  if(wv_hw_config(dev) == FALSE)
+    return;
+
+  /* start receive unit */
+  wv_ru_start(dev);
+
+#ifdef DEBUG_CONFIG_TRACE
+  printk(KERN_DEBUG "%s: <-wv_hw_reset()\n", dev->name);
+#endif
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * wv_pcmcia_config() is called after a CARD_INSERTION event is
+ * received, to configure the PCMCIA socket, and to make the ethernet
+ * device available to the system.
+ * (called by wavelan_event())
+ */
+static inline int
+wv_pcmcia_config(dev_link_t *	link)
+{
+  client_handle_t	handle = link->handle;
+  tuple_t		tuple;
+  cisparse_t		parse;
+  struct net_device *	dev = (struct net_device *) link->priv;
+  int			i;
+  u_char		buf[64];
+  win_req_t		req;
+  memreq_t		mem;
+  net_local *		lp = netdev_priv(dev);
+
+
+#ifdef DEBUG_CONFIG_TRACE
+  printk(KERN_DEBUG "->wv_pcmcia_config(0x%p)\n", link);
+#endif
+
+  /*
+   * This reads the card's CONFIG tuple to find its configuration
+   * registers.
+   */
+  do
+    {
+      tuple.Attributes = 0;
+      tuple.DesiredTuple = CISTPL_CONFIG;
+      i = pcmcia_get_first_tuple(handle, &tuple);
+      if(i != CS_SUCCESS)
+	break;
+      tuple.TupleData = (cisdata_t *)buf;
+      tuple.TupleDataMax = 64;
+      tuple.TupleOffset = 0;
+      i = pcmcia_get_tuple_data(handle, &tuple);
+      if(i != CS_SUCCESS)
+	break;
+      i = pcmcia_parse_tuple(handle, &tuple, &parse);
+      if(i != CS_SUCCESS)
+	break;
+      link->conf.ConfigBase = parse.config.base;
+      link->conf.Present = parse.config.rmask[0];
+    }
+  while(0);
+  if(i != CS_SUCCESS)
+    {
+      cs_error(link->handle, ParseTuple, i);
+      link->state &= ~DEV_CONFIG_PENDING;
+      return FALSE;
+    }
+    
+  /* Configure card */
+  link->state |= DEV_CONFIG;
+  do
+    {
+      i = pcmcia_request_io(link->handle, &link->io);
+      if(i != CS_SUCCESS)
+	{
+	  cs_error(link->handle, RequestIO, i);
+	  break;
+	}
+
+      /*
+       * Now allocate an interrupt line.  Note that this does not
+       * actually assign a handler to the interrupt.
+       */
+      i = pcmcia_request_irq(link->handle, &link->irq);
+      if(i != CS_SUCCESS)
+	{
+	  cs_error(link->handle, RequestIRQ, i);
+	  break;
+	}
+
+      /*
+       * This actually configures the PCMCIA socket -- setting up
+       * the I/O windows and the interrupt mapping.
+       */
+      link->conf.ConfigIndex = 1;
+      i = pcmcia_request_configuration(link->handle, &link->conf);
+      if(i != CS_SUCCESS)
+	{
+	  cs_error(link->handle, RequestConfiguration, i);
+	  break;
+	}
+
+      /*
+       * Allocate a small memory window.  Note that the dev_link_t
+       * structure provides space for one window handle -- if your
+       * device needs several windows, you'll need to keep track of
+       * the handles in your private data structure, link->priv.
+       */
+      req.Attributes = WIN_DATA_WIDTH_8|WIN_MEMORY_TYPE_AM|WIN_ENABLE;
+      req.Base = req.Size = 0;
+      req.AccessSpeed = mem_speed;
+      i = pcmcia_request_window(&link->handle, &req, &link->win);
+      if(i != CS_SUCCESS)
+	{
+	  cs_error(link->handle, RequestWindow, i);
+	  break;
+	}
+
+      lp->mem = ioremap(req.Base, req.Size);
+      dev->mem_start = (u_long)lp->mem;
+      dev->mem_end = dev->mem_start + req.Size;
+
+      mem.CardOffset = 0; mem.Page = 0;
+      i = pcmcia_map_mem_page(link->win, &mem);
+      if(i != CS_SUCCESS)
+	{
+	  cs_error(link->handle, MapMemPage, i);
+	  break;
+	}
+
+      /* Feed device with this info... */
+      dev->irq = link->irq.AssignedIRQ;
+      dev->base_addr = link->io.BasePort1;
+      netif_start_queue(dev);
+
+#ifdef DEBUG_CONFIG_INFO
+      printk(KERN_DEBUG "wv_pcmcia_config: MEMSTART %p IRQ %d IOPORT 0x%x\n",
+	     lp->mem, dev->irq, (u_int) dev->base_addr);
+#endif
+
+      SET_NETDEV_DEV(dev, &handle_to_dev(handle));
+      i = register_netdev(dev);
+      if(i != 0)
+	{
+#ifdef DEBUG_CONFIG_ERRORS
+	  printk(KERN_INFO "wv_pcmcia_config(): register_netdev() failed\n");
+#endif
+	  break;
+	}
+    }
+  while(0);		/* Humm... Disguised goto !!! */
+
+  link->state &= ~DEV_CONFIG_PENDING;
+  /* If any step failed, release any partially configured state */
+  if(i != 0)
+    {
+      wv_pcmcia_release(link);
+      return FALSE;
+    }
+
+  strcpy(((net_local *) netdev_priv(dev))->node.dev_name, dev->name);
+  link->dev = &((net_local *) netdev_priv(dev))->node;
+
+#ifdef DEBUG_CONFIG_TRACE
+  printk(KERN_DEBUG "<-wv_pcmcia_config()\n");
+#endif
+  return TRUE;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * After a card is removed, wv_pcmcia_release() will unregister the net
+ * device, and release the PCMCIA configuration.  If the device is
+ * still open, this will be postponed until it is closed.
+ */
+static void
+wv_pcmcia_release(dev_link_t *link)
+{
+  struct net_device *	dev = (struct net_device *) link->priv;
+  net_local *		lp = netdev_priv(dev);
+
+#ifdef DEBUG_CONFIG_TRACE
+  printk(KERN_DEBUG "%s: -> wv_pcmcia_release(0x%p)\n", dev->name, link);
+#endif
+
+  /* Don't bother checking to see if these succeed or not */
+  iounmap(lp->mem);
+  pcmcia_release_window(link->win);
+  pcmcia_release_configuration(link->handle);
+  pcmcia_release_io(link->handle, &link->io);
+  pcmcia_release_irq(link->handle, &link->irq);
+
+  link->state &= ~DEV_CONFIG;
+
+#ifdef DEBUG_CONFIG_TRACE
+  printk(KERN_DEBUG "%s: <- wv_pcmcia_release()\n", dev->name);
+#endif
+}
+
+/************************ INTERRUPT HANDLING ************************/
+
+/*
+ * This function is the interrupt handler for the WaveLAN card. This
+ * routine will be called whenever: 
+ *	1. A packet is received.
+ *	2. A packet has successfully been transferred and the unit is
+ *	   ready to transmit another packet.
+ *	3. A command has completed execution.
+ */
+static irqreturn_t
+wavelan_interrupt(int		irq,
+		  void *	dev_id,
+		  struct pt_regs * regs)
+{
+  struct net_device *	dev;
+  net_local *	lp;
+  kio_addr_t	base;
+  int		status0;
+  u_int		tx_status;
+
+  if ((dev = dev_id) == NULL)
+    {
+#ifdef DEBUG_INTERRUPT_ERROR
+      printk(KERN_WARNING "wavelan_interrupt(): irq %d for unknown device.\n",
+	     irq);
+#endif
+      return IRQ_NONE;
+    }
+
+#ifdef DEBUG_INTERRUPT_TRACE
+  printk(KERN_DEBUG "%s: ->wavelan_interrupt()\n", dev->name);
+#endif
+
+  lp = netdev_priv(dev);
+  base = dev->base_addr;
+
+#ifdef DEBUG_INTERRUPT_INFO
+  /* Check state of our spinlock (it should be cleared) */
+  if(spin_is_locked(&lp->spinlock))
+    printk(KERN_DEBUG
+	   "%s: wavelan_interrupt(): spinlock is already locked !!!\n",
+	   dev->name);
+#endif
+
+  /* Prevent reentrancy. We need to do that because we may have
+   * multiple interrupt handler running concurently.
+   * It is safe because interrupts are disabled before aquiring
+   * the spinlock. */
+  spin_lock(&lp->spinlock);
+
+  /* Treat all pending interrupts */
+  while(1)
+    {
+      /* ---------------- INTERRUPT CHECKING ---------------- */
+      /*
+       * Look for the interrupt and verify the validity
+       */
+      outb(CR0_STATUS_0 | OP0_NOP, LCCR(base));
+      status0 = inb(LCSR(base));
+
+#ifdef DEBUG_INTERRUPT_INFO
+      printk(KERN_DEBUG "status0 0x%x [%s => 0x%x]", status0, 
+	     (status0&SR0_INTERRUPT)?"int":"no int",status0&~SR0_INTERRUPT);
+      if(status0&SR0_INTERRUPT)
+	{
+	  printk(" [%s => %d]\n", (status0 & SR0_CHNL) ? "chnl" :
+		 ((status0 & SR0_EXECUTION) ? "cmd" :
+		  ((status0 & SR0_RECEPTION) ? "recv" : "unknown")),
+		 (status0 & SR0_EVENT_MASK));
+	}
+      else
+	printk("\n");
+#endif
+
+      /* Return if no actual interrupt from i82593 (normal exit) */
+      if(!(status0 & SR0_INTERRUPT))
+	break;
+
+      /* If interrupt is both Rx and Tx or none...
+       * This code in fact is there to catch the spurious interrupt
+       * when you remove the wavelan pcmcia card from the socket */
+      if(((status0 & SR0_BOTH_RX_TX) == SR0_BOTH_RX_TX) ||
+	 ((status0 & SR0_BOTH_RX_TX) == 0x0))
+	{
+#ifdef DEBUG_INTERRUPT_INFO
+	  printk(KERN_INFO "%s: wv_interrupt(): bogus interrupt (or from dead card) : %X\n",
+		 dev->name, status0);
+#endif
+	  /* Acknowledge the interrupt */
+	  outb(CR0_INT_ACK | OP0_NOP, LCCR(base));
+	  break;
+	}
+
+      /* ----------------- RECEIVING PACKET ----------------- */
+      /*
+       * When the wavelan signal the reception of a new packet,
+       * we call wv_packet_rcv() to copy if from the buffer and
+       * send it to NET3
+       */
+      if(status0 & SR0_RECEPTION)
+	{
+#ifdef DEBUG_INTERRUPT_INFO
+	  printk(KERN_DEBUG "%s: wv_interrupt(): receive\n", dev->name);
+#endif
+
+	  if((status0 & SR0_EVENT_MASK) == SR0_STOP_REG_HIT)
+	    {
+#ifdef DEBUG_INTERRUPT_ERROR
+	      printk(KERN_INFO "%s: wv_interrupt(): receive buffer overflow\n",
+		     dev->name);
+#endif
+	      lp->stats.rx_over_errors++;
+	      lp->overrunning = 1;
+      	    }
+
+	  /* Get the packet */
+	  wv_packet_rcv(dev);
+	  lp->overrunning = 0;
+
+	  /* Acknowledge the interrupt */
+	  outb(CR0_INT_ACK | OP0_NOP, LCCR(base));
+	  continue;
+    	}
+
+      /* ---------------- COMMAND COMPLETION ---------------- */
+      /*
+       * Interrupts issued when the i82593 has completed a command.
+       * Most likely : transmission done
+       */
+
+      /* If a transmission has been done */
+      if((status0 & SR0_EVENT_MASK) == SR0_TRANSMIT_DONE ||
+	 (status0 & SR0_EVENT_MASK) == SR0_RETRANSMIT_DONE ||
+	 (status0 & SR0_EVENT_MASK) == SR0_TRANSMIT_NO_CRC_DONE)
+	{
+#ifdef DEBUG_TX_ERROR
+	  if((status0 & SR0_EVENT_MASK) == SR0_TRANSMIT_NO_CRC_DONE)
+	    printk(KERN_INFO "%s: wv_interrupt(): packet transmitted without CRC.\n",
+		   dev->name);
+#endif
+
+	  /* Get transmission status */
+	  tx_status = inb(LCSR(base));
+	  tx_status |= (inb(LCSR(base)) << 8);
+#ifdef DEBUG_INTERRUPT_INFO
+	  printk(KERN_DEBUG "%s: wv_interrupt(): transmission done\n",
+		 dev->name);
+	  {
+	    u_int	rcv_bytes;
+	    u_char	status3;
+	    rcv_bytes = inb(LCSR(base));
+	    rcv_bytes |= (inb(LCSR(base)) << 8);
+	    status3 = inb(LCSR(base));
+	    printk(KERN_DEBUG "tx_status 0x%02x rcv_bytes 0x%02x status3 0x%x\n",
+		   tx_status, rcv_bytes, (u_int) status3);
+	  }
+#endif
+	  /* Check for possible errors */
+	  if((tx_status & TX_OK) != TX_OK)
+	    {
+	      lp->stats.tx_errors++;
+
+	      if(tx_status & TX_FRTL)
+		{
+#ifdef DEBUG_TX_ERROR
+		  printk(KERN_INFO "%s: wv_interrupt(): frame too long\n",
+			 dev->name);
+#endif
+		}
+	      if(tx_status & TX_UND_RUN)
+		{
+#ifdef DEBUG_TX_FAIL
+		  printk(KERN_DEBUG "%s: wv_interrupt(): DMA underrun\n",
+			 dev->name);
+#endif
+		  lp->stats.tx_aborted_errors++;
+		}
+	      if(tx_status & TX_LOST_CTS)
+		{
+#ifdef DEBUG_TX_FAIL
+		  printk(KERN_DEBUG "%s: wv_interrupt(): no CTS\n", dev->name);
+#endif
+		  lp->stats.tx_carrier_errors++;
+		}
+	      if(tx_status & TX_LOST_CRS)
+		{
+#ifdef DEBUG_TX_FAIL
+		  printk(KERN_DEBUG "%s: wv_interrupt(): no carrier\n",
+			 dev->name);
+#endif
+		  lp->stats.tx_carrier_errors++;
+		}
+	      if(tx_status & TX_HRT_BEAT)
+		{
+#ifdef DEBUG_TX_FAIL
+		  printk(KERN_DEBUG "%s: wv_interrupt(): heart beat\n", dev->name);
+#endif
+		  lp->stats.tx_heartbeat_errors++;
+		}
+	      if(tx_status & TX_DEFER)
+		{
+#ifdef DEBUG_TX_FAIL
+		  printk(KERN_DEBUG "%s: wv_interrupt(): channel jammed\n",
+			 dev->name);
+#endif
+		}
+	      /* Ignore late collisions since they're more likely to happen
+	       * here (the WaveLAN design prevents the LAN controller from
+	       * receiving while it is transmitting). We take action only when
+	       * the maximum retransmit attempts is exceeded.
+	       */
+	      if(tx_status & TX_COLL)
+		{
+		  if(tx_status & TX_MAX_COL)
+		    {
+#ifdef DEBUG_TX_FAIL
+		      printk(KERN_DEBUG "%s: wv_interrupt(): channel congestion\n",
+			     dev->name);
+#endif
+		      if(!(tx_status & TX_NCOL_MASK))
+			{
+			  lp->stats.collisions += 0x10;
+			}
+		    }
+		}
+	    }	/* if(!(tx_status & TX_OK)) */
+
+	  lp->stats.collisions += (tx_status & TX_NCOL_MASK);
+	  lp->stats.tx_packets++;
+
+	  netif_wake_queue(dev);
+	  outb(CR0_INT_ACK | OP0_NOP, LCCR(base));	/* Acknowledge the interrupt */
+    	} 
+      else	/* if interrupt = transmit done or retransmit done */
+	{
+#ifdef DEBUG_INTERRUPT_ERROR
+	  printk(KERN_INFO "wavelan_cs: unknown interrupt, status0 = %02x\n",
+		 status0);
+#endif
+	  outb(CR0_INT_ACK | OP0_NOP, LCCR(base));	/* Acknowledge the interrupt */
+    	}
+    }	/* while(1) */
+
+  spin_unlock(&lp->spinlock);
+
+#ifdef DEBUG_INTERRUPT_TRACE
+  printk(KERN_DEBUG "%s: <-wavelan_interrupt()\n", dev->name);
+#endif
+
+  /* We always return IRQ_HANDLED, because we will receive empty
+   * interrupts under normal operations. Anyway, it doesn't matter
+   * as we are dealing with an ISA interrupt that can't be shared.
+   *
+   * Explanation : under heavy receive, the following happens :
+   * ->wavelan_interrupt()
+   *    (status0 & SR0_INTERRUPT) != 0
+   *       ->wv_packet_rcv()
+   *    (status0 & SR0_INTERRUPT) != 0
+   *       ->wv_packet_rcv()
+   *    (status0 & SR0_INTERRUPT) == 0	// i.e. no more event
+   * <-wavelan_interrupt()
+   * ->wavelan_interrupt()
+   *    (status0 & SR0_INTERRUPT) == 0	// i.e. empty interrupt
+   * <-wavelan_interrupt()
+   * Jean II */
+  return IRQ_HANDLED;
+} /* wv_interrupt */
+
+/*------------------------------------------------------------------*/
+/*
+ * Watchdog: when we start a transmission, a timer is set for us in the
+ * kernel.  If the transmission completes, this timer is disabled. If
+ * the timer expires, we are called and we try to unlock the hardware.
+ *
+ * Note : This watchdog is move clever than the one in the ISA driver,
+ * because it try to abort the current command before reseting
+ * everything...
+ * On the other hand, it's a bit simpler, because we don't have to
+ * deal with the multiple Tx buffers...
+ */
+static void
+wavelan_watchdog(struct net_device *	dev)
+{
+  net_local *		lp = netdev_priv(dev);
+  kio_addr_t		base = dev->base_addr;
+  unsigned long		flags;
+  int			aborted = FALSE;
+
+#ifdef DEBUG_INTERRUPT_TRACE
+  printk(KERN_DEBUG "%s: ->wavelan_watchdog()\n", dev->name);
+#endif
+
+#ifdef DEBUG_INTERRUPT_ERROR
+  printk(KERN_INFO "%s: wavelan_watchdog: watchdog timer expired\n",
+	 dev->name);
+#endif
+
+  spin_lock_irqsave(&lp->spinlock, flags);
+
+  /* Ask to abort the current command */
+  outb(OP0_ABORT, LCCR(base));
+
+  /* Wait for the end of the command (a bit hackish) */
+  if(wv_82593_cmd(dev, "wavelan_watchdog(): abort",
+		  OP0_NOP | CR0_STATUS_3, SR0_EXECUTION_ABORTED))
+    aborted = TRUE;
+
+  /* Release spinlock here so that wv_hw_reset() can grab it */
+  spin_unlock_irqrestore(&lp->spinlock, flags);
+
+  /* Check if we were successful in aborting it */
+  if(!aborted)
+    {
+      /* It seem that it wasn't enough */
+#ifdef DEBUG_INTERRUPT_ERROR
+      printk(KERN_INFO "%s: wavelan_watchdog: abort failed, trying reset\n",
+	     dev->name);
+#endif
+      wv_hw_reset(dev);
+    }
+
+#ifdef DEBUG_PSA_SHOW
+  {
+    psa_t		psa;
+    psa_read(dev, 0, (unsigned char *) &psa, sizeof(psa));
+    wv_psa_show(&psa);
+  }
+#endif
+#ifdef DEBUG_MMC_SHOW
+  wv_mmc_show(dev);
+#endif
+#ifdef DEBUG_I82593_SHOW
+  wv_ru_show(dev);
+#endif
+
+  /* We are no more waiting for something... */
+  netif_wake_queue(dev);
+
+#ifdef DEBUG_INTERRUPT_TRACE
+  printk(KERN_DEBUG "%s: <-wavelan_watchdog()\n", dev->name);
+#endif
+}
+
+/********************* CONFIGURATION CALLBACKS *********************/
+/*
+ * Here are the functions called by the pcmcia package (cardmgr) and
+ * linux networking (NET3) for initialization, configuration and
+ * deinstallations of the Wavelan Pcmcia Hardware.
+ */
+
+/*------------------------------------------------------------------*/
+/*
+ * Configure and start up the WaveLAN PCMCIA adaptor.
+ * Called by NET3 when it "open" the device.
+ */
+static int
+wavelan_open(struct net_device *	dev)
+{
+  net_local *	lp = netdev_priv(dev);
+  dev_link_t *	link = lp->link;
+  kio_addr_t	base = dev->base_addr;
+
+#ifdef DEBUG_CALLBACK_TRACE
+  printk(KERN_DEBUG "%s: ->wavelan_open(dev=0x%x)\n", dev->name,
+	 (unsigned int) dev);
+#endif
+
+  /* Check if the modem is powered up (wavelan_close() power it down */
+  if(hasr_read(base) & HASR_NO_CLK)
+    {
+      /* Power up (power up time is 250us) */
+      hacr_write(base, HACR_DEFAULT);
+
+      /* Check if the module has been powered up... */
+      if(hasr_read(base) & HASR_NO_CLK)
+	{
+#ifdef DEBUG_CONFIG_ERRORS
+	  printk(KERN_WARNING "%s: wavelan_open(): modem not connected\n",
+		 dev->name);
+#endif
+	  return FALSE;
+	}
+    }
+
+  /* Start reception and declare the driver ready */
+  if(!lp->configured)
+    return FALSE;
+  if(!wv_ru_start(dev))
+    wv_hw_reset(dev);		/* If problem : reset */
+  netif_start_queue(dev);
+
+  /* Mark the device as used */
+  link->open++;
+
+#ifdef WAVELAN_ROAMING
+  if(do_roaming)
+    wv_roam_init(dev);
+#endif	/* WAVELAN_ROAMING */
+
+#ifdef DEBUG_CALLBACK_TRACE
+  printk(KERN_DEBUG "%s: <-wavelan_open()\n", dev->name);
+#endif
+  return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Shutdown the WaveLAN PCMCIA adaptor.
+ * Called by NET3 when it "close" the device.
+ */
+static int
+wavelan_close(struct net_device *	dev)
+{
+  dev_link_t *	link = ((net_local *)netdev_priv(dev))->link;
+  kio_addr_t	base = dev->base_addr;
+
+#ifdef DEBUG_CALLBACK_TRACE
+  printk(KERN_DEBUG "%s: ->wavelan_close(dev=0x%x)\n", dev->name,
+	 (unsigned int) dev);
+#endif
+
+  /* If the device isn't open, then nothing to do */
+  if(!link->open)
+    {
+#ifdef DEBUG_CONFIG_INFO
+      printk(KERN_DEBUG "%s: wavelan_close(): device not open\n", dev->name);
+#endif
+      return 0;
+    }
+
+#ifdef WAVELAN_ROAMING
+  /* Cleanup of roaming stuff... */
+  if(do_roaming)
+    wv_roam_cleanup(dev);
+#endif	/* WAVELAN_ROAMING */
+
+  link->open--;
+
+  /* If the card is still present */
+  if(netif_running(dev))
+    {
+      netif_stop_queue(dev);
+
+      /* Stop receiving new messages and wait end of transmission */
+      wv_ru_stop(dev);
+
+      /* Power down the module */
+      hacr_write(base, HACR_DEFAULT & (~HACR_PWR_STAT));
+    }
+
+#ifdef DEBUG_CALLBACK_TRACE
+  printk(KERN_DEBUG "%s: <-wavelan_close()\n", dev->name);
+#endif
+  return 0;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * wavelan_attach() creates an "instance" of the driver, allocating
+ * local data structures for one device (one interface).  The device
+ * is registered with Card Services.
+ *
+ * The dev_link structure is initialized, but we don't actually
+ * configure the card at this point -- we wait until we receive a
+ * card insertion event.
+ */
+static dev_link_t *
+wavelan_attach(void)
+{
+  client_reg_t	client_reg;	/* Register with cardmgr */
+  dev_link_t *	link;		/* Info for cardmgr */
+  struct net_device *	dev;		/* Interface generic data */
+  net_local *	lp;		/* Interface specific data */
+  int		ret;
+
+#ifdef DEBUG_CALLBACK_TRACE
+  printk(KERN_DEBUG "-> wavelan_attach()\n");
+#endif
+
+  /* Initialize the dev_link_t structure */
+  link = kmalloc(sizeof(struct dev_link_t), GFP_KERNEL);
+  if (!link) return NULL;
+  memset(link, 0, sizeof(struct dev_link_t));
+
+  /* The io structure describes IO port mapping */
+  link->io.NumPorts1 = 8;
+  link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
+  link->io.IOAddrLines = 3;
+
+  /* Interrupt setup */
+  link->irq.Attributes = IRQ_TYPE_EXCLUSIVE | IRQ_HANDLE_PRESENT;
+  link->irq.IRQInfo1 = IRQ_LEVEL_ID;
+  link->irq.Handler = wavelan_interrupt;
+
+  /* General socket configuration */
+  link->conf.Attributes = CONF_ENABLE_IRQ;
+  link->conf.Vcc = 50;
+  link->conf.IntType = INT_MEMORY_AND_IO;
+
+  /* Chain drivers */
+  link->next = dev_list;
+  dev_list = link;
+
+  /* Allocate the generic data structure */
+  dev = alloc_etherdev(sizeof(net_local));
+  if (!dev) {
+      kfree(link);
+      return NULL;
+  }
+  link->priv = link->irq.Instance = dev;
+
+  lp = netdev_priv(dev);
+
+  /* Init specific data */
+  lp->configured = 0;
+  lp->reconfig_82593 = FALSE;
+  lp->nresets = 0;
+  /* Multicast stuff */
+  lp->promiscuous = 0;
+  lp->allmulticast = 0;
+  lp->mc_count = 0;
+
+  /* Init spinlock */
+  spin_lock_init(&lp->spinlock);
+
+  /* back links */
+  lp->link = link;
+  lp->dev = dev;
+
+  /* wavelan NET3 callbacks */
+  SET_MODULE_OWNER(dev);
+  dev->open = &wavelan_open;
+  dev->stop = &wavelan_close;
+  dev->hard_start_xmit = &wavelan_packet_xmit;
+  dev->get_stats = &wavelan_get_stats;
+  dev->set_multicast_list = &wavelan_set_multicast_list;
+#ifdef SET_MAC_ADDRESS
+  dev->set_mac_address = &wavelan_set_mac_address;
+#endif	/* SET_MAC_ADDRESS */
+
+  /* Set the watchdog timer */
+  dev->tx_timeout	= &wavelan_watchdog;
+  dev->watchdog_timeo	= WATCHDOG_JIFFIES;
+  SET_ETHTOOL_OPS(dev, &ops);
+
+#ifdef WIRELESS_EXT	/* If wireless extension exist in the kernel */
+  dev->wireless_handlers = &wavelan_handler_def;
+  lp->wireless_data.spy_data = &lp->spy_data;
+  dev->wireless_data = &lp->wireless_data;
+#endif
+
+  /* Other specific data */
+  dev->mtu = WAVELAN_MTU;
+
+  /* Register with Card Services */
+  client_reg.dev_info = &dev_info;
+  client_reg.EventMask = 
+    CS_EVENT_REGISTRATION_COMPLETE |
+    CS_EVENT_CARD_INSERTION | CS_EVENT_CARD_REMOVAL |
+    CS_EVENT_RESET_PHYSICAL | CS_EVENT_CARD_RESET |
+    CS_EVENT_PM_SUSPEND | CS_EVENT_PM_RESUME;
+  client_reg.event_handler = &wavelan_event;
+  client_reg.Version = 0x0210;
+  client_reg.event_callback_args.client_data = link;
+
+#ifdef DEBUG_CONFIG_INFO
+  printk(KERN_DEBUG "wavelan_attach(): almost done, calling pcmcia_register_client\n");
+#endif
+
+  ret = pcmcia_register_client(&link->handle, &client_reg);
+  if(ret != 0)
+    {
+      cs_error(link->handle, RegisterClient, ret);
+      wavelan_detach(link);
+      return NULL;
+    }
+
+#ifdef DEBUG_CALLBACK_TRACE
+  printk(KERN_DEBUG "<- wavelan_attach()\n");
+#endif
+
+  return link;
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * This deletes a driver "instance".  The device is de-registered with
+ * Card Services.  If it has been released, all local data structures
+ * are freed.  Otherwise, the structures will be freed when the device
+ * is released.
+ */
+static void
+wavelan_detach(dev_link_t *	link)
+{
+#ifdef DEBUG_CALLBACK_TRACE
+  printk(KERN_DEBUG "-> wavelan_detach(0x%p)\n", link);
+#endif
+
+  /*
+   * If the device is currently configured and active, we won't
+   * actually delete it yet.  Instead, it is marked so that when the
+   * release() function is called, that will trigger a proper
+   * detach().
+   */
+  if(link->state & DEV_CONFIG)
+    {
+      /* Some others haven't done their job : give them another chance */
+      wv_pcmcia_release(link);
+    }
+
+  /* Break the link with Card Services */
+  if(link->handle)
+    pcmcia_deregister_client(link->handle);
+    
+  /* Remove the interface data from the linked list */
+  if(dev_list == link)
+    dev_list = link->next;
+  else
+    {
+      dev_link_t *	prev = dev_list;
+
+      while((prev != (dev_link_t *) NULL) && (prev->next != link))
+	prev = prev->next;
+
+      if(prev == (dev_link_t *) NULL)
+	{
+#ifdef DEBUG_CONFIG_ERRORS
+	  printk(KERN_WARNING "wavelan_detach : Attempting to remove a nonexistent device.\n");
+#endif
+	  return;
+	}
+
+      prev->next = link->next;
+    }
+
+  /* Free pieces */
+  if(link->priv)
+    {
+      struct net_device *	dev = (struct net_device *) link->priv;
+
+      /* Remove ourselves from the kernel list of ethernet devices */
+      /* Warning : can't be called from interrupt, timer or wavelan_close() */
+      if (link->dev)
+	unregister_netdev(dev);
+      link->dev = NULL;
+      ((net_local *)netdev_priv(dev))->link = NULL;
+      ((net_local *)netdev_priv(dev))->dev = NULL;
+      free_netdev(dev);
+    }
+  kfree(link);
+
+#ifdef DEBUG_CALLBACK_TRACE
+  printk(KERN_DEBUG "<- wavelan_detach()\n");
+#endif
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * The card status event handler. Mostly, this schedules other stuff
+ * to run after an event is received. A CARD_REMOVAL event also sets
+ * some flags to discourage the net drivers from trying to talk to the
+ * card any more.
+ */
+static int
+wavelan_event(event_t		event,		/* The event received */
+	      int		priority,
+	      event_callback_args_t *	args)
+{
+  dev_link_t *	link = (dev_link_t *) args->client_data;
+  struct net_device *	dev = (struct net_device *) link->priv;
+
+#ifdef DEBUG_CALLBACK_TRACE
+  printk(KERN_DEBUG "->wavelan_event(): %s\n",
+	 ((event == CS_EVENT_REGISTRATION_COMPLETE)?"registration complete" :
+	  ((event == CS_EVENT_CARD_REMOVAL) ? "card removal" :
+	   ((event == CS_EVENT_CARD_INSERTION) ? "card insertion" :
+	    ((event == CS_EVENT_PM_SUSPEND) ? "pm suspend" :
+	     ((event == CS_EVENT_RESET_PHYSICAL) ? "physical reset" :
+	      ((event == CS_EVENT_PM_RESUME) ? "pm resume" :
+	       ((event == CS_EVENT_CARD_RESET) ? "card reset" :
+		"unknown"))))))));
+#endif
+
+    switch(event)
+      {
+      case CS_EVENT_REGISTRATION_COMPLETE:
+#ifdef DEBUG_CONFIG_INFO
+	printk(KERN_DEBUG "wavelan_cs: registration complete\n");
+#endif
+	break;
+
+      case CS_EVENT_CARD_REMOVAL:
+	/* Oups ! The card is no more there */
+	link->state &= ~DEV_PRESENT;
+	if(link->state & DEV_CONFIG)
+	  {
+	    /* Accept no more transmissions */
+	    netif_device_detach(dev);
+
+	    /* Release the card */
+	    wv_pcmcia_release(link);
+	  }
+	break;
+
+      case CS_EVENT_CARD_INSERTION:
+	/* Reset and configure the card */
+	link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
+	if(wv_pcmcia_config(link) &&
+	   wv_hw_config(dev))
+	  wv_init_info(dev);
+	else
+	  dev->irq = 0;
+	break;
+
+      case CS_EVENT_PM_SUSPEND:
+	/* NB: wavelan_close will be called, but too late, so we are
+	 * obliged to close nicely the wavelan here. David, could you
+	 * close the device before suspending them ? And, by the way,
+	 * could you, on resume, add a "route add -net ..." after the
+	 * ifconfig up ? Thanks... */
+
+	/* Stop receiving new messages and wait end of transmission */
+	wv_ru_stop(dev);
+
+	/* Power down the module */
+	hacr_write(dev->base_addr, HACR_DEFAULT & (~HACR_PWR_STAT));
+
+	/* The card is now suspended */
+	link->state |= DEV_SUSPEND;
+	/* Fall through... */
+      case CS_EVENT_RESET_PHYSICAL:
+    	if(link->state & DEV_CONFIG)
+	  {
+      	    if(link->open)
+	      netif_device_detach(dev);
+      	    pcmcia_release_configuration(link->handle);
+	  }
+	break;
+
+      case CS_EVENT_PM_RESUME:
+	link->state &= ~DEV_SUSPEND;
+	/* Fall through... */
+      case CS_EVENT_CARD_RESET:
+	if(link->state & DEV_CONFIG)
+	  {
+      	    pcmcia_request_configuration(link->handle, &link->conf);
+      	    if(link->open)	/* If RESET -> True, If RESUME -> False ? */
+	      {
+		wv_hw_reset(dev);
+		netif_device_attach(dev);
+	      }
+	  }
+	break;
+    }
+
+#ifdef DEBUG_CALLBACK_TRACE
+  printk(KERN_DEBUG "<-wavelan_event()\n");
+#endif
+  return 0;
+}
+
+static struct pcmcia_driver wavelan_driver = {
+	.owner		= THIS_MODULE,
+	.drv		= {
+		.name	= "wavelan_cs",
+	},
+	.attach		= wavelan_attach,
+	.detach		= wavelan_detach,
+};
+
+static int __init
+init_wavelan_cs(void)
+{
+	return pcmcia_register_driver(&wavelan_driver);
+}
+
+static void __exit
+exit_wavelan_cs(void)
+{
+	pcmcia_unregister_driver(&wavelan_driver);
+}
+
+module_init(init_wavelan_cs);
+module_exit(exit_wavelan_cs);
diff --git a/drivers/net/wireless/wavelan_cs.h b/drivers/net/wireless/wavelan_cs.h
new file mode 100644
index 0000000..29cff6d
--- /dev/null
+++ b/drivers/net/wireless/wavelan_cs.h
@@ -0,0 +1,386 @@
+/*
+ *	Wavelan Pcmcia driver
+ *
+ *		Jean II - HPLB '96
+ *
+ * Reorganization and extension of the driver.
+ * Original copyright follow. See wavelan_cs.h for details.
+ *
+ * This file contain the declarations of the Wavelan hardware. Note that
+ * the Pcmcia Wavelan include a i82593 controller (see definitions in
+ * file i82593.h).
+ *
+ * The main difference between the pcmcia hardware and the ISA one is
+ * the Ethernet Controller (i82593 instead of i82586). The i82593 allow
+ * only one send buffer. The PSA (Parameter Storage Area : EEprom for
+ * permanent storage of various info) is memory mapped, but not the
+ * MMI (Modem Management Interface).
+ */
+
+/*
+ * Definitions for the AT&T GIS (formerly NCR) WaveLAN PCMCIA card: 
+ *   An Ethernet-like radio transceiver controlled by an Intel 82593
+ *   coprocessor.
+ *
+ *
+ ****************************************************************************
+ *   Copyright 1995
+ *   Anthony D. Joseph
+ *   Massachusetts Institute of Technology
+ *
+ *   Permission to use, copy, modify, and distribute this program
+ *   for any purpose and without fee is hereby granted, provided
+ *   that this copyright and permission notice appear on all copies
+ *   and supporting documentation, the name of M.I.T. not be used
+ *   in advertising or publicity pertaining to distribution of the
+ *   program without specific prior permission, and notice be given
+ *   in supporting documentation that copying and distribution is
+ *   by permission of M.I.T.  M.I.T. makes no representations about
+ *   the suitability of this software for any purpose.  It is pro-
+ *   vided "as is" without express or implied warranty.         
+ ****************************************************************************
+ *
+ *
+ * Credits:
+ *     Special thanks to Jan Hoogendoorn of AT&T GIS Utrecht for
+ *       providing extremely useful information about WaveLAN PCMCIA hardware
+ *
+ *     This driver is based upon several other drivers, in particular:
+ *       David Hinds' Linux driver for the PCMCIA 3c589 ethernet adapter
+ *       Bruce Janson's Linux driver for the AT-bus WaveLAN adapter
+ *	 Anders Klemets' PCMCIA WaveLAN adapter driver
+ *       Robert Morris' BSDI driver for the PCMCIA WaveLAN adapter
+ */
+
+#ifndef _WAVELAN_CS_H
+#define	_WAVELAN_CS_H
+
+/************************** MAGIC NUMBERS ***************************/
+
+/* The detection of the wavelan card is made by reading the MAC address
+ * from the card and checking it. If you have a non AT&T product (OEM,
+ * like DEC RoamAbout, or Digital Ocean, Epson, ...), you must modify this
+ * part to accommodate your hardware...
+ */
+const unsigned char	MAC_ADDRESSES[][3] =
+{
+  { 0x08, 0x00, 0x0E },		/* AT&T Wavelan (standard) & DEC RoamAbout */
+  { 0x08, 0x00, 0x6A },		/* AT&T Wavelan (alternate) */
+  { 0x00, 0x00, 0xE1 },		/* Hitachi Wavelan */
+  { 0x00, 0x60, 0x1D }		/* Lucent Wavelan (another one) */
+  /* Add your card here and send me the patch ! */
+};
+
+/*
+ * Constants used to convert channels to frequencies
+ */
+
+/* Frequency available in the 2.0 modem, in units of 250 kHz
+ * (as read in the offset register of the dac area).
+ * Used to map channel numbers used by `wfreqsel' to frequencies
+ */
+const short	channel_bands[] = { 0x30, 0x58, 0x64, 0x7A, 0x80, 0xA8,
+				    0xD0, 0xF0, 0xF8, 0x150 };
+
+/* Frequencies of the 1.0 modem (fixed frequencies).
+ * Use to map the PSA `subband' to a frequency
+ * Note : all frequencies apart from the first one need to be multiplied by 10
+ */
+const int	fixed_bands[] = { 915e6, 2.425e8, 2.46e8, 2.484e8, 2.4305e8 };
+
+
+/*************************** PC INTERFACE ****************************/
+
+/* WaveLAN host interface definitions */
+
+#define	LCCR(base)	(base)		/* LAN Controller Command Register */
+#define	LCSR(base)	(base)		/* LAN Controller Status Register */
+#define	HACR(base)	(base+0x1)	/* Host Adapter Command Register */
+#define	HASR(base)	(base+0x1)	/* Host Adapter Status Register */
+#define PIORL(base)	(base+0x2)	/* Program I/O Register Low */
+#define RPLL(base)	(base+0x2)	/* Receive Pointer Latched Low */
+#define PIORH(base)	(base+0x3)	/* Program I/O Register High */
+#define RPLH(base)	(base+0x3)	/* Receive Pointer Latched High */
+#define PIOP(base)	(base+0x4)	/* Program I/O Port */
+#define MMR(base)	(base+0x6)	/* MMI Address Register */
+#define MMD(base)	(base+0x7)	/* MMI Data Register */
+
+/* Host Adaptor Command Register bit definitions */
+
+#define HACR_LOF	  (1 << 3)	/* Lock Out Flag, toggle every 250ms */
+#define HACR_PWR_STAT	  (1 << 4)	/* Power State, 1=active, 0=sleep */
+#define HACR_TX_DMA_RESET (1 << 5)	/* Reset transmit DMA ptr on high */
+#define HACR_RX_DMA_RESET (1 << 6)	/* Reset receive DMA ptr on high */
+#define HACR_ROM_WEN	  (1 << 7)	/* EEPROM write enabled when true */
+
+#define HACR_RESET              (HACR_TX_DMA_RESET | HACR_RX_DMA_RESET)
+#define	HACR_DEFAULT		(HACR_PWR_STAT)
+
+/* Host Adapter Status Register bit definitions */
+
+#define HASR_MMI_BUSY	(1 << 2)	/* MMI is busy when true */
+#define HASR_LOF	(1 << 3)	/* Lock out flag status */
+#define HASR_NO_CLK	(1 << 4)	/* active when modem not connected */
+
+/* Miscellaneous bit definitions */
+
+#define PIORH_SEL_TX	(1 << 5)	/* PIOR points to 0=rx/1=tx buffer */
+#define MMR_MMI_WR	(1 << 0)	/* Next MMI cycle is 0=read, 1=write */
+#define PIORH_MASK	0x1f		/* only low 5 bits are significant */
+#define RPLH_MASK	0x1f		/* only low 5 bits are significant */
+#define MMI_ADDR_MASK	0x7e		/* Bits 1-6 of MMR are significant */
+
+/* Attribute Memory map */
+
+#define CIS_ADDR	0x0000		/* Card Information Status Register */
+#define PSA_ADDR	0x0e00		/* Parameter Storage Area address */
+#define EEPROM_ADDR	0x1000		/* EEPROM address (unused ?) */
+#define COR_ADDR	0x4000		/* Configuration Option Register */
+
+/* Configuration Option Register bit definitions */
+
+#define COR_CONFIG	(1 << 0)	/* Config Index, 0 when unconfigured */
+#define COR_SW_RESET	(1 << 7)	/* Software Reset on true */
+#define COR_LEVEL_IRQ	(1 << 6)	/* Level IRQ */
+
+/* Local Memory map */
+
+#define RX_BASE		0x0000		/* Receive memory, 8 kB */
+#define TX_BASE		0x2000		/* Transmit memory, 2 kB */
+#define UNUSED_BASE	0x2800		/* Unused, 22 kB */
+#define RX_SIZE		(TX_BASE-RX_BASE)	/* Size of receive area */
+#define RX_SIZE_SHIFT	6		/* Bits to shift in stop register */
+
+#define TRUE  1
+#define FALSE 0
+
+#define MOD_ENAL 1
+#define MOD_PROM 2
+
+/* Size of a MAC address */
+#define WAVELAN_ADDR_SIZE	6
+
+/* Maximum size of Wavelan packet */
+#define WAVELAN_MTU	1500
+
+#define	MAXDATAZ		(6 + 6 + 2 + WAVELAN_MTU)
+
+/********************** PARAMETER STORAGE AREA **********************/
+
+/*
+ * Parameter Storage Area (PSA).
+ */
+typedef struct psa_t	psa_t;
+struct psa_t
+{
+  /* For the PCMCIA Adapter, locations 0x00-0x0F are unused and fixed at 00 */
+  unsigned char	psa_io_base_addr_1;	/* [0x00] Base address 1 ??? */
+  unsigned char	psa_io_base_addr_2;	/* [0x01] Base address 2 */
+  unsigned char	psa_io_base_addr_3;	/* [0x02] Base address 3 */
+  unsigned char	psa_io_base_addr_4;	/* [0x03] Base address 4 */
+  unsigned char	psa_rem_boot_addr_1;	/* [0x04] Remote Boot Address 1 */
+  unsigned char	psa_rem_boot_addr_2;	/* [0x05] Remote Boot Address 2 */
+  unsigned char	psa_rem_boot_addr_3;	/* [0x06] Remote Boot Address 3 */
+  unsigned char	psa_holi_params;	/* [0x07] HOst Lan Interface (HOLI) Parameters */
+  unsigned char	psa_int_req_no;		/* [0x08] Interrupt Request Line */
+  unsigned char	psa_unused0[7];		/* [0x09-0x0F] unused */
+
+  unsigned char	psa_univ_mac_addr[WAVELAN_ADDR_SIZE];	/* [0x10-0x15] Universal (factory) MAC Address */
+  unsigned char	psa_local_mac_addr[WAVELAN_ADDR_SIZE];	/* [0x16-1B] Local MAC Address */
+  unsigned char	psa_univ_local_sel;	/* [0x1C] Universal Local Selection */
+#define		PSA_UNIVERSAL	0		/* Universal (factory) */
+#define		PSA_LOCAL	1		/* Local */
+  unsigned char	psa_comp_number;	/* [0x1D] Compatability Number: */
+#define		PSA_COMP_PC_AT_915	0 	/* PC-AT 915 MHz	*/
+#define		PSA_COMP_PC_MC_915	1 	/* PC-MC 915 MHz	*/
+#define		PSA_COMP_PC_AT_2400	2 	/* PC-AT 2.4 GHz	*/
+#define		PSA_COMP_PC_MC_2400	3 	/* PC-MC 2.4 GHz	*/
+#define		PSA_COMP_PCMCIA_915	4 	/* PCMCIA 915 MHz or 2.0 */
+  unsigned char	psa_thr_pre_set;	/* [0x1E] Modem Threshold Preset */
+  unsigned char	psa_feature_select;	/* [0x1F] Call code required (1=on) */
+#define		PSA_FEATURE_CALL_CODE	0x01 	/* Call code required (Japan) */
+  unsigned char	psa_subband;		/* [0x20] Subband	*/
+#define		PSA_SUBBAND_915		0	/* 915 MHz or 2.0 */
+#define		PSA_SUBBAND_2425	1	/* 2425 MHz	*/
+#define		PSA_SUBBAND_2460	2	/* 2460 MHz	*/
+#define		PSA_SUBBAND_2484	3	/* 2484 MHz	*/
+#define		PSA_SUBBAND_2430_5	4	/* 2430.5 MHz	*/
+  unsigned char	psa_quality_thr;	/* [0x21] Modem Quality Threshold */
+  unsigned char	psa_mod_delay;		/* [0x22] Modem Delay ??? (reserved) */
+  unsigned char	psa_nwid[2];		/* [0x23-0x24] Network ID */
+  unsigned char	psa_nwid_select;	/* [0x25] Network ID Select On Off */
+  unsigned char	psa_encryption_select;	/* [0x26] Encryption On Off */
+  unsigned char	psa_encryption_key[8];	/* [0x27-0x2E] Encryption Key */
+  unsigned char	psa_databus_width;	/* [0x2F] AT bus width select 8/16 */
+  unsigned char	psa_call_code[8];	/* [0x30-0x37] (Japan) Call Code */
+  unsigned char	psa_nwid_prefix[2];	/* [0x38-0x39] Roaming domain */
+  unsigned char	psa_reserved[2];	/* [0x3A-0x3B] Reserved - fixed 00 */
+  unsigned char	psa_conf_status;	/* [0x3C] Conf Status, bit 0=1:config*/
+  unsigned char	psa_crc[2];		/* [0x3D] CRC-16 over PSA */
+  unsigned char	psa_crc_status;		/* [0x3F] CRC Valid Flag */
+};
+
+/* Size for structure checking (if padding is correct) */
+#define	PSA_SIZE	64
+
+/* Calculate offset of a field in the above structure
+ * Warning : only even addresses are used */
+#define	psaoff(p,f) 	((unsigned short) ((void *)(&((psa_t *) ((void *) NULL + (p)))->f) - (void *) NULL))
+
+/******************** MODEM MANAGEMENT INTERFACE ********************/
+
+/*
+ * Modem Management Controller (MMC) write structure.
+ */
+typedef struct mmw_t	mmw_t;
+struct mmw_t
+{
+  unsigned char	mmw_encr_key[8];	/* encryption key */
+  unsigned char	mmw_encr_enable;	/* enable/disable encryption */
+#define	MMW_ENCR_ENABLE_MODE	0x02	/* Mode of security option */
+#define	MMW_ENCR_ENABLE_EN	0x01	/* Enable security option */
+  unsigned char	mmw_unused0[1];		/* unused */
+  unsigned char	mmw_des_io_invert;	/* Encryption option */
+#define	MMW_DES_IO_INVERT_RES	0x0F	/* Reserved */
+#define	MMW_DES_IO_INVERT_CTRL	0xF0	/* Control ??? (set to 0) */
+  unsigned char	mmw_unused1[5];		/* unused */
+  unsigned char	mmw_loopt_sel;		/* looptest selection */
+#define	MMW_LOOPT_SEL_DIS_NWID	0x40	/* disable NWID filtering */
+#define	MMW_LOOPT_SEL_INT	0x20	/* activate Attention Request */
+#define	MMW_LOOPT_SEL_LS	0x10	/* looptest w/o collision avoidance */
+#define MMW_LOOPT_SEL_LT3A	0x08	/* looptest 3a */
+#define	MMW_LOOPT_SEL_LT3B	0x04	/* looptest 3b */
+#define	MMW_LOOPT_SEL_LT3C	0x02	/* looptest 3c */
+#define	MMW_LOOPT_SEL_LT3D	0x01	/* looptest 3d */
+  unsigned char	mmw_jabber_enable;	/* jabber timer enable */
+  /* Abort transmissions > 200 ms */
+  unsigned char	mmw_freeze;		/* freeze / unfreeeze signal level */
+  /* 0 : signal level & qual updated for every new message, 1 : frozen */
+  unsigned char	mmw_anten_sel;		/* antenna selection */
+#define MMW_ANTEN_SEL_SEL	0x01	/* direct antenna selection */
+#define	MMW_ANTEN_SEL_ALG_EN	0x02	/* antenna selection algo. enable */
+  unsigned char	mmw_ifs;		/* inter frame spacing */
+  /* min time between transmission in bit periods (.5 us) - bit 0 ignored */
+  unsigned char	mmw_mod_delay;	 	/* modem delay (synchro) */
+  unsigned char	mmw_jam_time;		/* jamming time (after collision) */
+  unsigned char	mmw_unused2[1];		/* unused */
+  unsigned char	mmw_thr_pre_set;	/* level threshold preset */
+  /* Discard all packet with signal < this value (4) */
+  unsigned char	mmw_decay_prm;		/* decay parameters */
+  unsigned char	mmw_decay_updat_prm;	/* decay update parameterz */
+  unsigned char	mmw_quality_thr;	/* quality (z-quotient) threshold */
+  /* Discard all packet with quality < this value (3) */
+  unsigned char	mmw_netw_id_l;		/* NWID low order byte */
+  unsigned char	mmw_netw_id_h;		/* NWID high order byte */
+  /* Network ID or Domain : create virtual net on the air */
+
+  /* 2.0 Hardware extension - frequency selection support */
+  unsigned char	mmw_mode_select;	/* for analog tests (set to 0) */
+  unsigned char	mmw_unused3[1];		/* unused */
+  unsigned char	mmw_fee_ctrl;		/* frequency eeprom control */
+#define	MMW_FEE_CTRL_PRE	0x10	/* Enable protected instructions */
+#define	MMW_FEE_CTRL_DWLD	0x08	/* Download eeprom to mmc */
+#define	MMW_FEE_CTRL_CMD	0x07	/* EEprom commands : */
+#define	MMW_FEE_CTRL_READ	0x06	/* Read */
+#define	MMW_FEE_CTRL_WREN	0x04	/* Write enable */
+#define	MMW_FEE_CTRL_WRITE	0x05	/* Write data to address */
+#define	MMW_FEE_CTRL_WRALL	0x04	/* Write data to all addresses */
+#define	MMW_FEE_CTRL_WDS	0x04	/* Write disable */
+#define	MMW_FEE_CTRL_PRREAD	0x16	/* Read addr from protect register */
+#define	MMW_FEE_CTRL_PREN	0x14	/* Protect register enable */
+#define	MMW_FEE_CTRL_PRCLEAR	0x17	/* Unprotect all registers */
+#define	MMW_FEE_CTRL_PRWRITE	0x15	/* Write addr in protect register */
+#define	MMW_FEE_CTRL_PRDS	0x14	/* Protect register disable */
+  /* Never issue this command (PRDS) : it's irreversible !!! */
+
+  unsigned char	mmw_fee_addr;		/* EEprom address */
+#define	MMW_FEE_ADDR_CHANNEL	0xF0	/* Select the channel */
+#define	MMW_FEE_ADDR_OFFSET	0x0F	/* Offset in channel data */
+#define	MMW_FEE_ADDR_EN		0xC0	/* FEE_CTRL enable operations */
+#define	MMW_FEE_ADDR_DS		0x00	/* FEE_CTRL disable operations */
+#define	MMW_FEE_ADDR_ALL	0x40	/* FEE_CTRL all operations */
+#define	MMW_FEE_ADDR_CLEAR	0xFF	/* FEE_CTRL clear operations */
+
+  unsigned char	mmw_fee_data_l;		/* Write data to EEprom */
+  unsigned char	mmw_fee_data_h;		/* high octet */
+  unsigned char	mmw_ext_ant;		/* Setting for external antenna */
+#define	MMW_EXT_ANT_EXTANT	0x01	/* Select external antenna */
+#define	MMW_EXT_ANT_POL		0x02	/* Polarity of the antenna */
+#define	MMW_EXT_ANT_INTERNAL	0x00	/* Internal antenna */
+#define	MMW_EXT_ANT_EXTERNAL	0x03	/* External antenna */
+#define	MMW_EXT_ANT_IQ_TEST	0x1C	/* IQ test pattern (set to 0) */
+};
+
+/* Size for structure checking (if padding is correct) */
+#define	MMW_SIZE	37
+
+/* Calculate offset of a field in the above structure */
+#define	mmwoff(p,f) 	(unsigned short)((void *)(&((mmw_t *)((void *)0 + (p)))->f) - (void *)0)
+
+
+/*
+ * Modem Management Controller (MMC) read structure.
+ */
+typedef struct mmr_t	mmr_t;
+struct mmr_t
+{
+  unsigned char	mmr_unused0[8];		/* unused */
+  unsigned char	mmr_des_status;		/* encryption status */
+  unsigned char	mmr_des_avail;		/* encryption available (0x55 read) */
+#define	MMR_DES_AVAIL_DES	0x55		/* DES available */
+#define	MMR_DES_AVAIL_AES	0x33		/* AES (AT&T) available */
+  unsigned char	mmr_des_io_invert;	/* des I/O invert register */
+  unsigned char	mmr_unused1[5];		/* unused */
+  unsigned char	mmr_dce_status;		/* DCE status */
+#define	MMR_DCE_STATUS_RX_BUSY		0x01	/* receiver busy */
+#define	MMR_DCE_STATUS_LOOPT_IND	0x02	/* loop test indicated */
+#define	MMR_DCE_STATUS_TX_BUSY		0x04	/* transmitter on */
+#define	MMR_DCE_STATUS_JBR_EXPIRED	0x08	/* jabber timer expired */
+#define MMR_DCE_STATUS			0x0F	/* mask to get the bits */
+  unsigned char	mmr_dsp_id;		/* DSP id (AA = Daedalus rev A) */
+  unsigned char	mmr_unused2[2];		/* unused */
+  unsigned char	mmr_correct_nwid_l;	/* # of correct NWID's rxd (low) */
+  unsigned char	mmr_correct_nwid_h;	/* # of correct NWID's rxd (high) */
+  /* Warning : Read high order octet first !!! */
+  unsigned char	mmr_wrong_nwid_l;	/* # of wrong NWID's rxd (low) */
+  unsigned char	mmr_wrong_nwid_h;	/* # of wrong NWID's rxd (high) */
+  unsigned char	mmr_thr_pre_set;	/* level threshold preset */
+#define	MMR_THR_PRE_SET		0x3F		/* level threshold preset */
+#define	MMR_THR_PRE_SET_CUR	0x80		/* Current signal above it */
+  unsigned char	mmr_signal_lvl;		/* signal level */
+#define	MMR_SIGNAL_LVL		0x3F		/* signal level */
+#define	MMR_SIGNAL_LVL_VALID	0x80		/* Updated since last read */
+  unsigned char	mmr_silence_lvl;	/* silence level (noise) */
+#define	MMR_SILENCE_LVL		0x3F		/* silence level */
+#define	MMR_SILENCE_LVL_VALID	0x80		/* Updated since last read */
+  unsigned char	mmr_sgnl_qual;		/* signal quality */
+#define	MMR_SGNL_QUAL		0x0F		/* signal quality */
+#define	MMR_SGNL_QUAL_ANT	0x80		/* current antenna used */
+  unsigned char	mmr_netw_id_l;		/* NWID low order byte ??? */
+  unsigned char	mmr_unused3[3];		/* unused */
+
+  /* 2.0 Hardware extension - frequency selection support */
+  unsigned char	mmr_fee_status;		/* Status of frequency eeprom */
+#define	MMR_FEE_STATUS_ID	0xF0		/* Modem revision id */
+#define	MMR_FEE_STATUS_DWLD	0x08		/* Download in progress */
+#define	MMR_FEE_STATUS_BUSY	0x04		/* EEprom busy */
+  unsigned char	mmr_unused4[1];		/* unused */
+  unsigned char	mmr_fee_data_l;		/* Read data from eeprom (low) */
+  unsigned char	mmr_fee_data_h;		/* Read data from eeprom (high) */
+};
+
+/* Size for structure checking (if padding is correct) */
+#define	MMR_SIZE	36
+
+/* Calculate offset of a field in the above structure */
+#define	mmroff(p,f) 	(unsigned short)((void *)(&((mmr_t *)((void *)0 + (p)))->f) - (void *)0)
+
+
+/* Make the two above structures one */
+typedef union mm_t
+{
+  struct mmw_t	w;	/* Write to the mmc */
+  struct mmr_t	r;	/* Read from the mmc */
+} mm_t;
+
+#endif /* _WAVELAN_CS_H */
diff --git a/drivers/net/wireless/wavelan_cs.p.h b/drivers/net/wireless/wavelan_cs.p.h
new file mode 100644
index 0000000..ea2ef8d
--- /dev/null
+++ b/drivers/net/wireless/wavelan_cs.p.h
@@ -0,0 +1,813 @@
+/*
+ *	Wavelan Pcmcia driver
+ *
+ *		Jean II - HPLB '96
+ *
+ * Reorganisation and extension of the driver.
+ *
+ * This file contain all definition and declarations necessary for the
+ * wavelan pcmcia driver. This file is a private header, so it should
+ * be included only on wavelan_cs.c !!!
+ */
+
+#ifndef WAVELAN_CS_P_H
+#define WAVELAN_CS_P_H
+
+/************************** DOCUMENTATION **************************/
+/*
+ * This driver provide a Linux interface to the Wavelan Pcmcia hardware
+ * The Wavelan is a product of Lucent (http://www.wavelan.com/).
+ * This division was formerly part of NCR and then AT&T.
+ * Wavelan are also distributed by DEC (RoamAbout DS)...
+ *
+ * To know how to use this driver, read the PCMCIA HOWTO.
+ * If you want to exploit the many other fonctionalities, look comments
+ * in the code...
+ *
+ * This driver is the result of the effort of many peoples (see below).
+ */
+
+/* ------------------------ SPECIFIC NOTES ------------------------ */
+/*
+ * Web page
+ * --------
+ *	I try to maintain a web page with the Wireless LAN Howto at :
+ *	    http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/Wavelan.html
+ *
+ * SMP
+ * ---
+ *	We now are SMP compliant (I eventually fixed the remaining bugs).
+ *	The driver has been tested on a dual P6-150 and survived my usual
+ *	set of torture tests.
+ *	Anyway, I spent enough time chasing interrupt re-entrancy during
+ *	errors or reconfigure, and I designed the locked/unlocked sections
+ *	of the driver with great care, and with the recent addition of
+ *	the spinlock (thanks to the new API), we should be quite close to
+ *	the truth.
+ *	The SMP/IRQ locking is quite coarse and conservative (i.e. not fast),
+ *	but better safe than sorry (especially at 2 Mb/s ;-).
+ *
+ *	I have also looked into disabling only our interrupt on the card
+ *	(via HACR) instead of all interrupts in the processor (via cli),
+ *	so that other driver are not impacted, and it look like it's
+ *	possible, but it's very tricky to do right (full of races). As
+ *	the gain would be mostly for SMP systems, it can wait...
+ *
+ * Debugging and options
+ * ---------------------
+ *	You will find below a set of '#define" allowing a very fine control
+ *	on the driver behaviour and the debug messages printed.
+ *	The main options are :
+ *	o WAVELAN_ROAMING, for the experimental roaming support.
+ *	o SET_PSA_CRC, to have your card correctly recognised by
+ *	  an access point and the Point-to-Point diagnostic tool.
+ *	o USE_PSA_CONFIG, to read configuration from the PSA (EEprom)
+ *	  (otherwise we always start afresh with some defaults)
+ *
+ * wavelan_cs.o is darn too big
+ * -------------------------
+ *	That's true ! There is a very simple way to reduce the driver
+ *	object by 33% (yes !). Comment out the following line :
+ *		#include <linux/wireless.h>
+ *	Other compile options can also reduce the size of it...
+ *
+ * MAC address and hardware detection :
+ * ----------------------------------
+ *	The detection code of the wavelan chech that the first 3
+ *	octets of the MAC address fit the company code. This type of
+ *	detection work well for AT&T cards (because the AT&T code is
+ *	hardcoded in wavelan_cs.h), but of course will fail for other
+ *	manufacturer.
+ *
+ *	If you are sure that your card is derived from the wavelan,
+ *	here is the way to configure it :
+ *	1) Get your MAC address
+ *		a) With your card utilities (wfreqsel, instconf, ...)
+ *		b) With the driver :
+ *			o compile the kernel with DEBUG_CONFIG_INFO enabled
+ *			o Boot and look the card messages
+ *	2) Set your MAC code (3 octets) in MAC_ADDRESSES[][3] (wavelan_cs.h)
+ *	3) Compile & verify
+ *	4) Send me the MAC code - I will include it in the next version...
+ *
+ */
+
+/* --------------------- WIRELESS EXTENSIONS --------------------- */
+/*
+ * This driver is the first one to support "wireless extensions".
+ * This set of extensions provide you some way to control the wireless
+ * caracteristics of the hardware in a standard way and support for
+ * applications for taking advantage of it (like Mobile IP).
+ *
+ * You will need to enable the CONFIG_NET_RADIO define in the kernel
+ * configuration to enable the wireless extensions (this is the one
+ * giving access to the radio network device choice).
+ *
+ * It might also be a good idea as well to fetch the wireless tools to
+ * configure the device and play a bit.
+ */
+
+/* ---------------------------- FILES ---------------------------- */
+/*
+ * wavelan_cs.c :	The actual code for the driver - C functions
+ *
+ * wavelan_cs.p.h :	Private header : local types / vars for the driver
+ *
+ * wavelan_cs.h :	Description of the hardware interface & structs
+ *
+ * i82593.h :		Description if the Ethernet controller
+ */
+
+/* --------------------------- HISTORY --------------------------- */
+/*
+ * The history of the Wavelan drivers is as complicated as history of
+ * the Wavelan itself (NCR -> AT&T -> Lucent).
+ *
+ * All started with Anders Klemets <klemets@paul.rutgers.edu>,
+ * writting a Wavelan ISA driver for the MACH microkernel. Girish
+ * Welling <welling@paul.rutgers.edu> had also worked on it.
+ * Keith Moore modify this for the Pcmcia hardware.
+ * 
+ * Robert Morris <rtm@das.harvard.edu> port these two drivers to BSDI
+ * and add specific Pcmcia support (there is currently no equivalent
+ * of the PCMCIA package under BSD...).
+ *
+ * Jim Binkley <jrb@cs.pdx.edu> port both BSDI drivers to FreeBSD.
+ *
+ * Bruce Janson <bruce@cs.usyd.edu.au> port the BSDI ISA driver to Linux.
+ *
+ * Anthony D. Joseph <adj@lcs.mit.edu> started modify Bruce driver
+ * (with help of the BSDI PCMCIA driver) for PCMCIA.
+ * Yunzhou Li <yunzhou@strat.iol.unh.edu> finished is work.
+ * Joe Finney <joe@comp.lancs.ac.uk> patched the driver to start
+ * correctly 2.00 cards (2.4 GHz with frequency selection).
+ * David Hinds <dahinds@users.sourceforge.net> integrated the whole in his
+ * Pcmcia package (+ bug corrections).
+ *
+ * I (Jean Tourrilhes - jt@hplb.hpl.hp.com) then started to make some
+ * patchs to the Pcmcia driver. After, I added code in the ISA driver
+ * for Wireless Extensions and full support of frequency selection
+ * cards. Now, I'm doing the same to the Pcmcia driver + some
+ * reorganisation.
+ * Loeke Brederveld <lbrederv@wavelan.com> from Lucent has given me
+ * much needed informations on the Wavelan hardware.
+ */
+
+/* By the way : for the copyright & legal stuff :
+ * Almost everybody wrote code under GNU or BSD license (or alike),
+ * and want that their original copyright remain somewhere in the
+ * code (for myself, I go with the GPL).
+ * Nobody want to take responsibility for anything, except the fame...
+ */
+
+/* --------------------------- CREDITS --------------------------- */
+/*
+ * Credits:
+ *    Special thanks to Jan Hoogendoorn of AT&T GIS Utrecht and
+ *	Loeke Brederveld of Lucent for providing extremely useful
+ *	information about WaveLAN PCMCIA hardware
+ *
+ *    This driver is based upon several other drivers, in particular:
+ *	David Hinds' Linux driver for the PCMCIA 3c589 ethernet adapter
+ *	Bruce Janson's Linux driver for the AT-bus WaveLAN adapter
+ *	Anders Klemets' PCMCIA WaveLAN adapter driver
+ *	Robert Morris' BSDI driver for the PCMCIA WaveLAN adapter
+ *
+ * Additional Credits:
+ *
+ *    This software was originally developed under Linux 1.2.3
+ *	(Slackware 2.0 distribution).
+ *    And then under Linux 2.0.x (Debian 1.1 -> 2.2 - pcmcia 2.8.18+)
+ *	with an HP OmniBook 4000 and then a 5500.
+ *
+ *    It is based on other device drivers and information either written
+ *    or supplied by:
+ *	James Ashton (jaa101@syseng.anu.edu.au),
+ *	Ajay Bakre (bakre@paul.rutgers.edu),
+ *	Donald Becker (becker@super.org),
+ *	Jim Binkley <jrb@cs.pdx.edu>,
+ *	Loeke Brederveld <lbrederv@wavelan.com>,
+ *	Allan Creighton (allanc@cs.su.oz.au),
+ *	Brent Elphick <belphick@uwaterloo.ca>,
+ *	Joe Finney <joe@comp.lancs.ac.uk>,
+ *	Matthew Geier (matthew@cs.su.oz.au),
+ *	Remo di Giovanni (remo@cs.su.oz.au),
+ *	Mark Hagan (mhagan@wtcpost.daytonoh.NCR.COM),
+ *	David Hinds <dahinds@users.sourceforge.net>,
+ *	Jan Hoogendoorn (c/o marteijn@lucent.com),
+ *      Bruce Janson <bruce@cs.usyd.edu.au>,
+ *	Anthony D. Joseph <adj@lcs.mit.edu>,
+ *	Anders Klemets (klemets@paul.rutgers.edu),
+ *	Yunzhou Li <yunzhou@strat.iol.unh.edu>,
+ *	Marc Meertens (mmeertens@lucent.com),
+ *	Keith Moore,
+ *	Robert Morris (rtm@das.harvard.edu),
+ *	Ian Parkin (ian@cs.su.oz.au),
+ *	John Rosenberg (johnr@cs.su.oz.au),
+ *	George Rossi (george@phm.gov.au),
+ *	Arthur Scott (arthur@cs.su.oz.au),
+ *	Stanislav Sinyagin <stas@isf.ru>
+ *	Peter Storey,
+ *	Jean Tourrilhes <jt@hpl.hp.com>,
+ *	Girish Welling (welling@paul.rutgers.edu)
+ *	Clark Woodworth <clark@hiway1.exit109.com>
+ *	Yongguang Zhang <ygz@isl.hrl.hac.com>...
+ */
+
+/* ------------------------- IMPROVEMENTS ------------------------- */
+/*
+ * I proudly present :
+ *
+ * Changes made in 2.8.22 :
+ * ----------------------
+ *	- improved wv_set_multicast_list
+ *	- catch spurious interrupt
+ *	- correct release of the device
+ *
+ * Changes mades in release :
+ * ------------------------
+ *	- Reorganisation of the code, function name change
+ *	- Creation of private header (wavelan_cs.h)
+ *	- Reorganised debug messages
+ *	- More comments, history, ...
+ *	- Configure earlier (in "insert" instead of "open")
+ *        and do things only once
+ *	- mmc_init : configure the PSA if not done
+ *	- mmc_init : 2.00 detection better code for 2.00 init
+ *	- better info at startup
+ *	- Correct a HUGE bug (volatile & uncalibrated busy loop)
+ *	  in wv_82593_cmd => config speedup
+ *	- Stop receiving & power down on close (and power up on open)
+ *	  use "ifconfig down" & "ifconfig up ; route add -net ..."
+ *	- Send packets : add watchdog instead of pooling
+ *	- Receive : check frame wrap around & try to recover some frames
+ *	- wavelan_set_multicast_list : avoid reset
+ *	- add wireless extensions (ioctl & get_wireless_stats)
+ *	  get/set nwid/frequency on fly, info for /proc/net/wireless
+ *	- Suppress useless stuff from lp (net_local), but add link
+ *	- More inlines
+ *	- Lot of others minor details & cleanups
+ *
+ * Changes made in second release :
+ * ------------------------------
+ *	- Optimise wv_85893_reconfig stuff, fix potential problems
+ *	- Change error values for ioctl
+ *	- Non blocking wv_ru_stop() + call wv_reset() in case of problems
+ *	- Remove development printk from wavelan_watchdog()
+ *	- Remove of the watchdog to wavelan_close instead of wavelan_release
+ *	  fix potential problems...
+ *	- Start debugging suspend stuff (but it's still a bit weird)
+ *	- Debug & optimize dump header/packet in Rx & Tx (debug)
+ *	- Use "readb" and "writeb" to be kernel 2.1 compliant
+ *	- Better handling of bogus interrupts
+ *	- Wireless extension : SETSPY and GETSPY
+ *	- Remove old stuff (stats - for those needing it, just ask me...)
+ *	- Make wireless extensions optional
+ *
+ * Changes made in third release :
+ * -----------------------------
+ *	- cleanups & typos
+ *	- modif wireless ext (spy -> only one pointer)
+ *	- new private ioctl to set/get quality & level threshold
+ *	- Init : correct default value of level threshold for pcmcia
+ *	- kill watchdog in hw_reset
+ *	- more 2.1 support (copy_to/from_user instead of memcpy_to/fromfs)
+ *	- Add message level (debug stuff in /var/adm/debug & errors not
+ *	  displayed at console and still in /var/adm/messages)
+ *
+ * Changes made in fourth release :
+ * ------------------------------
+ *	- multicast support (yes !) thanks to Yongguang Zhang.
+ *
+ * Changes made in fifth release (2.9.0) :
+ * -------------------------------------
+ *	- Revisited multicast code (it was mostly wrong).
+ *	- protect code in wv_82593_reconfig with dev->tbusy (oups !)
+ *
+ * Changes made in sixth release (2.9.1a) :
+ * --------------------------------------
+ *	- Change the detection code for multi manufacturer code support
+ *	- Correct bug (hang kernel) in init when we were "rejecting" a card 
+ *
+ * Changes made in seventh release (2.9.1b) :
+ * ----------------------------------------
+ *	- Update to wireless extensions changes
+ *	- Silly bug in card initial configuration (psa_conf_status)
+ *
+ * Changes made in eigth release :
+ * -----------------------------
+ *	- Small bug in debug code (probably not the last one...)
+ *	- 1.2.13 support (thanks to Clark Woodworth)
+ *
+ * Changes made for release in 2.9.2b :
+ * ----------------------------------
+ *	- Level threshold is now a standard wireless extension (version 4 !)
+ *	- modules parameters types for kernel > 2.1.17
+ *	- updated man page
+ *	- Others cleanup from David Hinds
+ *
+ * Changes made for release in 2.9.5 :
+ * ---------------------------------
+ *	- byte count stats (courtesy of David Hinds)
+ *	- Remove dev_tint stuff (courtesy of David Hinds)
+ *	- Others cleanup from David Hinds
+ *	- Encryption setting from Brent Elphick (thanks a lot !)
+ *	- 'base' to 'u_long' for the Alpha (thanks to Stanislav Sinyagin)
+ *
+ * Changes made for release in 2.9.6 :
+ * ---------------------------------
+ *	- fix bug : no longuer disable watchdog in case of bogus interrupt
+ *	- increase timeout in config code for picky hardware
+ *	- mask unused bits in status (Wireless Extensions)
+ *
+ * Changes integrated by Justin Seger <jseger@MIT.EDU> & David Hinds :
+ * -----------------------------------------------------------------
+ *	- Roaming "hack" from Joe Finney <joe@comp.lancs.ac.uk>
+ *	- PSA CRC code from Bob Gray <rgray@bald.cs.dartmouth.edu>
+ *	- Better initialisation of the i82593 controller
+ *	  from Joseph K. O'Sullivan <josullvn+@cs.cmu.edu>
+ *
+ * Changes made for release in 3.0.10 :
+ * ----------------------------------
+ *	- Fix eject "hang" of the driver under 2.2.X :
+ *		o create wv_flush_stale_links()
+ *		o Rename wavelan_release to wv_pcmcia_release & move up
+ *		o move unregister_netdev to wavelan_detach()
+ *		o wavelan_release() no longer call wavelan_detach()
+ *		o Suppress "release" timer
+ *		o Other cleanups & fixes
+ *	- New MAC address in the probe
+ *	- Reorg PSA_CRC code (endian neutral & cleaner)
+ *	- Correct initialisation of the i82593 from Lucent manual
+ *	- Put back the watchdog, with larger timeout
+ *	- TRANSMIT_NO_CRC is a "normal" error, so recover from it
+ *	  from Derrick J Brashear <shadow@dementia.org>
+ *	- Better handling of TX and RX normal failure conditions
+ *	- #ifdef out all the roaming code
+ *	- Add ESSID & "AP current address" ioctl stubs
+ *	- General cleanup of the code
+ *
+ * Changes made for release in 3.0.13 :
+ * ----------------------------------
+ *	- Re-enable compilation of roaming code by default, but with
+ *	  do_roaming = 0
+ *	- Nuke `nwid=nwid^ntohs(beacon->domain_id)' in wl_roam_gather
+ *	  at the demand of John Carol Langford <jcl@gs176.sp.cs.cmu.edu>
+ *	- Introduced WAVELAN_ROAMING_EXT for incomplete ESSID stuff.
+ *
+ * Changes made for release in 3.0.15 :
+ * ----------------------------------
+ *	- Change e-mail and web page addresses
+ *	- Watchdog timer is now correctly expressed in HZ, not in jiffies
+ *	- Add channel number to the list of frequencies in range
+ *	- Add the (short) list of bit-rates in range
+ *	- Developp a new sensitivity... (sens.value & sens.fixed)
+ *
+ * Changes made for release in 3.1.2 :
+ * ---------------------------------
+ *	- Fix check for root permission (break instead of exit)
+ *	- New nwid & encoding setting (Wireless Extension 9)
+ *
+ * Changes made for release in 3.1.12 :
+ * ----------------------------------
+ *	- reworked wv_82593_cmd to avoid using the IRQ handler and doing
+ *	  ugly things with interrupts.
+ *	- Add IRQ protection in 82593_config/ru_start/ru_stop/watchdog
+ *	- Update to new network API (softnet - 2.3.43) :
+ *		o replace dev->tbusy (David + me)
+ *		o replace dev->tstart (David + me)
+ *		o remove dev->interrupt (David)
+ *		o add SMP locking via spinlock in splxx (me)
+ *		o add spinlock in interrupt handler (me)
+ *		o use kernel watchdog instead of ours (me)
+ *		o verify that all the changes make sense and work (me)
+ *	- Re-sync kernel/pcmcia versions (not much actually)
+ *	- A few other cleanups (David & me)...
+ *
+ * Changes made for release in 3.1.22 :
+ * ----------------------------------
+ *	- Check that SMP works, remove annoying log message
+ *
+ * Changes made for release in 3.1.24 :
+ * ----------------------------------
+ *	- Fix unfrequent card lockup when watchdog was reseting the hardware :
+ *		o control first busy loop in wv_82593_cmd()
+ *		o Extend spinlock protection in wv_hw_config()
+ *
+ * Changes made for release in 3.1.33 :
+ * ----------------------------------
+ *	- Optional use new driver API for Wireless Extensions :
+ *		o got rid of wavelan_ioctl()
+ *		o use a bunch of iw_handler instead
+ *
+ * Changes made for release in 3.2.1 :
+ * ---------------------------------
+ *	- Set dev->trans_start to avoid filling the logs
+ *		(and generating useless abort commands)
+ *	- Avoid deadlocks in mmc_out()/mmc_in()
+ *
+ * Wishes & dreams:
+ * ----------------
+ *	- Cleanup and integrate the roaming code
+ *	  (std debug, set DomainID, decay avg and co...)
+ */
+
+/***************************** INCLUDES *****************************/
+
+/* Linux headers that we need */
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/sched.h>
+#include <linux/ptrace.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/timer.h>
+#include <linux/interrupt.h>
+#include <linux/spinlock.h>
+#include <linux/in.h>
+#include <linux/delay.h>
+#include <linux/bitops.h>
+#include <asm/uaccess.h>
+#include <asm/io.h>
+#include <asm/system.h>
+
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/skbuff.h>
+#include <linux/if_arp.h>
+#include <linux/ioport.h>
+#include <linux/fcntl.h>
+#include <linux/ethtool.h>
+
+#ifdef CONFIG_NET_RADIO
+#include <linux/wireless.h>		/* Wireless extensions */
+#include <net/iw_handler.h>		/* New driver API */
+#endif
+
+/* Pcmcia headers that we need */
+#include <pcmcia/cs_types.h>
+#include <pcmcia/cs.h>
+#include <pcmcia/cistpl.h>
+#include <pcmcia/cisreg.h>
+#include <pcmcia/ds.h>
+#include <pcmcia/version.h>
+
+/* Wavelan declarations */
+#include "i82593.h"	/* Definitions for the Intel chip */
+
+#include "wavelan_cs.h"	/* Others bits of the hardware */
+
+/************************** DRIVER OPTIONS **************************/
+/*
+ * `#define' or `#undef' the following constant to change the behaviour
+ * of the driver...
+ */
+#define WAVELAN_ROAMING		/* Include experimental roaming code */
+#undef WAVELAN_ROAMING_EXT	/* Enable roaming wireless extensions */
+#undef SET_PSA_CRC		/* Set the CRC in PSA (slower) */
+#define USE_PSA_CONFIG		/* Use info from the PSA */
+#undef STRUCT_CHECK		/* Verify padding of structures */
+#undef EEPROM_IS_PROTECTED	/* Doesn't seem to be necessary */
+#define MULTICAST_AVOID		/* Avoid extra multicast (I'm sceptical) */
+#undef SET_MAC_ADDRESS		/* Experimental */
+
+#ifdef WIRELESS_EXT	/* If wireless extension exist in the kernel */
+/* Warning : these stuff will slow down the driver... */
+#define WIRELESS_SPY		/* Enable spying addresses */
+#undef HISTOGRAM		/* Enable histogram of sig level... */
+#endif
+
+/****************************** DEBUG ******************************/
+
+#undef DEBUG_MODULE_TRACE	/* Module insertion/removal */
+#undef DEBUG_CALLBACK_TRACE	/* Calls made by Linux */
+#undef DEBUG_INTERRUPT_TRACE	/* Calls to handler */
+#undef DEBUG_INTERRUPT_INFO	/* type of interrupt & so on */
+#define DEBUG_INTERRUPT_ERROR	/* problems */
+#undef DEBUG_CONFIG_TRACE	/* Trace the config functions */
+#undef DEBUG_CONFIG_INFO	/* What's going on... */
+#define DEBUG_CONFIG_ERRORS	/* Errors on configuration */
+#undef DEBUG_TX_TRACE		/* Transmission calls */
+#undef DEBUG_TX_INFO		/* Header of the transmitted packet */
+#undef DEBUG_TX_FAIL		/* Normal failure conditions */
+#define DEBUG_TX_ERROR		/* Unexpected conditions */
+#undef DEBUG_RX_TRACE		/* Transmission calls */
+#undef DEBUG_RX_INFO		/* Header of the transmitted packet */
+#undef DEBUG_RX_FAIL		/* Normal failure conditions */
+#define DEBUG_RX_ERROR		/* Unexpected conditions */
+#undef DEBUG_PACKET_DUMP	/* Dump packet on the screen */
+#undef DEBUG_IOCTL_TRACE	/* Misc call by Linux */
+#undef DEBUG_IOCTL_INFO		/* Various debug info */
+#define DEBUG_IOCTL_ERROR	/* What's going wrong */
+#define DEBUG_BASIC_SHOW	/* Show basic startup info */
+#undef DEBUG_VERSION_SHOW	/* Print version info */
+#undef DEBUG_PSA_SHOW		/* Dump psa to screen */
+#undef DEBUG_MMC_SHOW		/* Dump mmc to screen */
+#undef DEBUG_SHOW_UNUSED	/* Show also unused fields */
+#undef DEBUG_I82593_SHOW	/* Show i82593 status */
+#undef DEBUG_DEVICE_SHOW	/* Show device parameters */
+
+/************************ CONSTANTS & MACROS ************************/
+
+#ifdef DEBUG_VERSION_SHOW
+static const char *version = "wavelan_cs.c : v24 (SMP + wireless extensions) 11/1/02\n";
+#endif
+
+/* Watchdog temporisation */
+#define	WATCHDOG_JIFFIES	(256*HZ/100)
+
+/* Fix a bug in some old wireless extension definitions */
+#ifndef IW_ESSID_MAX_SIZE
+#define IW_ESSID_MAX_SIZE	32
+#endif
+
+/* ------------------------ PRIVATE IOCTL ------------------------ */
+
+#define SIOCSIPQTHR	SIOCIWFIRSTPRIV		/* Set quality threshold */
+#define SIOCGIPQTHR	SIOCIWFIRSTPRIV + 1	/* Get quality threshold */
+#define SIOCSIPROAM     SIOCIWFIRSTPRIV + 2	/* Set roaming state */
+#define SIOCGIPROAM     SIOCIWFIRSTPRIV + 3	/* Get roaming state */
+
+#define SIOCSIPHISTO	SIOCIWFIRSTPRIV + 4	/* Set histogram ranges */
+#define SIOCGIPHISTO	SIOCIWFIRSTPRIV + 5	/* Get histogram values */
+
+/*************************** WaveLAN Roaming  **************************/
+#ifdef WAVELAN_ROAMING		/* Conditional compile, see above in options */
+
+#define WAVELAN_ROAMING_DEBUG	 0	/* 1 = Trace of handover decisions */
+					/* 2 = Info on each beacon rcvd... */
+#define MAX_WAVEPOINTS		7	/* Max visible at one time */
+#define WAVEPOINT_HISTORY	5	/* SNR sample history slow search */
+#define WAVEPOINT_FAST_HISTORY	2	/* SNR sample history fast search */
+#define SEARCH_THRESH_LOW	10	/* SNR to enter cell search */
+#define SEARCH_THRESH_HIGH	13	/* SNR to leave cell search */
+#define WAVELAN_ROAMING_DELTA	1	/* Hysteresis value (+/- SNR) */
+#define CELL_TIMEOUT		2*HZ	/* in jiffies */
+
+#define FAST_CELL_SEARCH	1	/* Boolean values... */
+#define NWID_PROMISC		1	/* for code clarity. */
+
+typedef struct wavepoint_beacon
+{
+  unsigned char		dsap,		/* Unused */
+			ssap,		/* Unused */
+			ctrl,		/* Unused */
+			O,U,I,		/* Unused */
+			spec_id1,	/* Unused */
+			spec_id2,	/* Unused */
+			pdu_type,	/* Unused */
+			seq;		/* WavePoint beacon sequence number */
+  unsigned short	domain_id,	/* WavePoint Domain ID */
+			nwid;		/* WavePoint NWID */
+} wavepoint_beacon;
+
+typedef struct wavepoint_history
+{
+  unsigned short	nwid;		/* WavePoint's NWID */
+  int			average_slow;	/* SNR running average */
+  int			average_fast;	/* SNR running average */
+  unsigned char	  sigqual[WAVEPOINT_HISTORY]; /* Ringbuffer of recent SNR's */
+  unsigned char		qualptr;	/* Index into ringbuffer */
+  unsigned char		last_seq;	/* Last seq. no seen for WavePoint */
+  struct wavepoint_history *next;	/* Next WavePoint in table */
+  struct wavepoint_history *prev;	/* Previous WavePoint in table */
+  unsigned long		last_seen;	/* Time of last beacon recvd, jiffies */
+} wavepoint_history;
+
+struct wavepoint_table
+{
+  wavepoint_history	*head;		/* Start of ringbuffer */
+  int			num_wavepoints;	/* No. of WavePoints visible */
+  unsigned char		locked;		/* Table lock */
+};
+
+#endif	/* WAVELAN_ROAMING */
+
+/****************************** TYPES ******************************/
+
+/* Shortcuts */
+typedef struct net_device_stats	en_stats;
+typedef struct iw_statistics	iw_stats;
+typedef struct iw_quality	iw_qual;
+typedef struct iw_freq		iw_freq;
+typedef struct net_local	net_local;
+typedef struct timer_list	timer_list;
+
+/* Basic types */
+typedef u_char		mac_addr[WAVELAN_ADDR_SIZE];	/* Hardware address */
+
+/*
+ * Static specific data for the interface.
+ *
+ * For each network interface, Linux keep data in two structure. "device"
+ * keep the generic data (same format for everybody) and "net_local" keep
+ * the additional specific data.
+ * Note that some of this specific data is in fact generic (en_stats, for
+ * example).
+ */
+struct net_local
+{
+  dev_node_t 	node;		/* ???? What is this stuff ???? */
+  struct net_device *	dev;		/* Reverse link... */
+  spinlock_t	spinlock;	/* Serialize access to the hardware (SMP) */
+  dev_link_t *	link;		/* pcmcia structure */
+  en_stats	stats;		/* Ethernet interface statistics */
+  int		nresets;	/* Number of hw resets */
+  u_char	configured;	/* If it is configured */
+  u_char	reconfig_82593;	/* Need to reconfigure the controller */
+  u_char	promiscuous;	/* Promiscuous mode */
+  u_char	allmulticast;	/* All Multicast mode */
+  int		mc_count;	/* Number of multicast addresses */
+
+  int   	stop;		/* Current i82593 Stop Hit Register */
+  int   	rfp;		/* Last DMA machine receive pointer */
+  int		overrunning;	/* Receiver overrun flag */
+
+#ifdef WIRELESS_EXT
+  iw_stats	wstats;		/* Wireless specific stats */
+
+  struct iw_spy_data	spy_data;
+  struct iw_public_data	wireless_data;
+#endif
+
+#ifdef HISTOGRAM
+  int		his_number;		/* Number of intervals */
+  u_char	his_range[16];		/* Boundaries of interval ]n-1; n] */
+  u_long	his_sum[16];		/* Sum in interval */
+#endif	/* HISTOGRAM */
+#ifdef WAVELAN_ROAMING
+  u_long	domain_id;	/* Domain ID we lock on for roaming */
+  int		filter_domains;	/* Check Domain ID of beacon found */
+ struct wavepoint_table	wavepoint_table;	/* Table of visible WavePoints*/
+  wavepoint_history *	curr_point;		/* Current wavepoint */
+  int			cell_search;		/* Searching for new cell? */
+  struct timer_list	cell_timer;		/* Garbage collection */
+#endif	/* WAVELAN_ROAMING */
+  void __iomem *mem;
+};
+
+/**************************** PROTOTYPES ****************************/
+
+#ifdef WAVELAN_ROAMING
+/* ---------------------- ROAMING SUBROUTINES -----------------------*/
+
+wavepoint_history *wl_roam_check(unsigned short nwid, net_local *lp);
+wavepoint_history *wl_new_wavepoint(unsigned short nwid, unsigned char seq, net_local *lp);
+void wl_del_wavepoint(wavepoint_history *wavepoint, net_local *lp);
+void wl_cell_expiry(unsigned long data);
+wavepoint_history *wl_best_sigqual(int fast_search, net_local *lp);
+void wl_update_history(wavepoint_history *wavepoint, unsigned char sigqual, unsigned char seq);
+void wv_roam_handover(wavepoint_history *wavepoint, net_local *lp);
+void wv_nwid_filter(unsigned char mode, net_local *lp);
+void wv_roam_init(struct net_device *dev);
+void wv_roam_cleanup(struct net_device *dev);
+#endif	/* WAVELAN_ROAMING */
+
+/* ----------------- MODEM MANAGEMENT SUBROUTINES ----------------- */
+static inline u_char		/* data */
+	hasr_read(u_long);	/* Read the host interface : base address */
+static inline void
+	hacr_write(u_long,	/* Write to host interface : base address */
+		   u_char),	/* data */
+	hacr_write_slow(u_long,
+		   u_char);
+static void
+	psa_read(struct net_device *,	/* Read the Parameter Storage Area */
+		 int,		/* offset in PSA */
+		 u_char *,	/* buffer to fill */
+		 int),		/* size to read */
+	psa_write(struct net_device *,	/* Write to the PSA */
+		  int,		/* Offset in psa */
+		  u_char *,	/* Buffer in memory */
+		  int);		/* Length of buffer */
+static inline void
+	mmc_out(u_long,		/* Write 1 byte to the Modem Manag Control */
+		u_short,
+		u_char),
+	mmc_write(u_long,	/* Write n bytes to the MMC */
+		  u_char,
+		  u_char *,
+		  int);
+static inline u_char		/* Read 1 byte from the MMC */
+	mmc_in(u_long,
+	       u_short);
+static inline void
+	mmc_read(u_long,	/* Read n bytes from the MMC */
+		 u_char,
+		 u_char *,
+		 int),
+	fee_wait(u_long,	/* Wait for frequency EEprom : base address */
+		 int,		/* Base delay to wait for */
+		 int);		/* Number of time to wait */
+static void
+	fee_read(u_long,	/* Read the frequency EEprom : base address */
+		 u_short,	/* destination offset */
+		 u_short *,	/* data buffer */
+		 int);		/* number of registers */
+/* ---------------------- I82593 SUBROUTINES ----------------------- */
+static int
+	wv_82593_cmd(struct net_device *,	/* synchronously send a command to i82593 */ 
+		     char *,
+		     int,
+		     int);
+static inline int
+	wv_diag(struct net_device *);	/* Diagnostique the i82593 */
+static int
+	read_ringbuf(struct net_device *,	/* Read a receive buffer */
+		     int,
+		     char *,
+		     int);
+static inline void
+	wv_82593_reconfig(struct net_device *);	/* Reconfigure the controller */
+/* ------------------- DEBUG & INFO SUBROUTINES ------------------- */
+static inline void
+	wv_init_info(struct net_device *);	/* display startup info */
+/* ------------------- IOCTL, STATS & RECONFIG ------------------- */
+static en_stats	*
+	wavelan_get_stats(struct net_device *);	/* Give stats /proc/net/dev */
+static iw_stats *
+	wavelan_get_wireless_stats(struct net_device *);
+/* ----------------------- PACKET RECEPTION ----------------------- */
+static inline int
+	wv_start_of_frame(struct net_device *,	/* Seek beggining of current frame */
+			  int,	/* end of frame */
+			  int);	/* start of buffer */
+static inline void
+	wv_packet_read(struct net_device *,	/* Read a packet from a frame */
+		       int,
+		       int),
+	wv_packet_rcv(struct net_device *);	/* Read all packets waiting */
+/* --------------------- PACKET TRANSMISSION --------------------- */
+static inline void
+	wv_packet_write(struct net_device *,	/* Write a packet to the Tx buffer */
+			void *,
+			short);
+static int
+	wavelan_packet_xmit(struct sk_buff *,	/* Send a packet */
+			    struct net_device *);
+/* -------------------- HARDWARE CONFIGURATION -------------------- */
+static inline int
+	wv_mmc_init(struct net_device *);	/* Initialize the modem */
+static int
+	wv_ru_stop(struct net_device *),	/* Stop the i82593 receiver unit */
+	wv_ru_start(struct net_device *);	/* Start the i82593 receiver unit */
+static int
+	wv_82593_config(struct net_device *);	/* Configure the i82593 */
+static inline int
+	wv_pcmcia_reset(struct net_device *);	/* Reset the pcmcia interface */
+static int
+	wv_hw_config(struct net_device *);	/* Reset & configure the whole hardware */
+static inline void
+	wv_hw_reset(struct net_device *);	/* Same, + start receiver unit */
+static inline int
+	wv_pcmcia_config(dev_link_t *);	/* Configure the pcmcia interface */
+static void
+	wv_pcmcia_release(dev_link_t *);/* Remove a device */
+/* ---------------------- INTERRUPT HANDLING ---------------------- */
+static irqreturn_t
+	wavelan_interrupt(int,	/* Interrupt handler */
+			  void *,
+			  struct pt_regs *);
+static void
+	wavelan_watchdog(struct net_device *);	/* Transmission watchdog */
+/* ------------------- CONFIGURATION CALLBACKS ------------------- */
+static int
+	wavelan_open(struct net_device *),		/* Open the device */
+	wavelan_close(struct net_device *);	/* Close the device */
+static dev_link_t *
+	wavelan_attach(void);		/* Create a new device */
+static void
+	wavelan_detach(dev_link_t *);	/* Destroy a removed device */
+static int
+	wavelan_event(event_t,		/* Manage pcmcia events */
+		      int,
+		      event_callback_args_t *);
+
+/**************************** VARIABLES ****************************/
+
+static dev_info_t dev_info = "wavelan_cs";
+static dev_link_t *dev_list = NULL;	/* Linked list of devices */
+
+/*
+ * Parameters that can be set with 'insmod'
+ * The exact syntax is 'insmod wavelan_cs.o <var>=<value>'
+ */
+
+/* Shared memory speed, in ns */
+static int	mem_speed = 0;
+
+/* New module interface */
+module_param(mem_speed, int, 0);
+
+#ifdef WAVELAN_ROAMING		/* Conditional compile, see above in options */
+/* Enable roaming mode ? No ! Please keep this to 0 */
+static int	do_roaming = 0;
+module_param(do_roaming, bool, 0);
+#endif	/* WAVELAN_ROAMING */
+
+MODULE_LICENSE("GPL");
+
+#endif	/* WAVELAN_CS_P_H */
+
diff --git a/drivers/net/wireless/wl3501.h b/drivers/net/wireless/wl3501.h
new file mode 100644
index 0000000..8636d93
--- /dev/null
+++ b/drivers/net/wireless/wl3501.h
@@ -0,0 +1,614 @@
+#ifndef __WL3501_H__
+#define __WL3501_H__
+
+#include <linux/spinlock.h>
+#include "ieee802_11.h"
+
+/* define for WLA 2.0 */
+#define WL3501_BLKSZ 256
+/*
+ * ID for input Signals of DRIVER block
+ * bit[7-5] is block ID: 000
+ * bit[4-0] is signal ID
+*/
+enum wl3501_signals {
+	WL3501_SIG_ALARM,
+	WL3501_SIG_MD_CONFIRM,
+	WL3501_SIG_MD_IND,
+	WL3501_SIG_ASSOC_CONFIRM,
+	WL3501_SIG_ASSOC_IND,
+	WL3501_SIG_AUTH_CONFIRM,
+	WL3501_SIG_AUTH_IND,
+	WL3501_SIG_DEAUTH_CONFIRM,
+	WL3501_SIG_DEAUTH_IND,
+	WL3501_SIG_DISASSOC_CONFIRM,
+	WL3501_SIG_DISASSOC_IND,
+	WL3501_SIG_GET_CONFIRM,
+	WL3501_SIG_JOIN_CONFIRM,
+	WL3501_SIG_PWR_MGMT_CONFIRM,
+	WL3501_SIG_REASSOC_CONFIRM,
+	WL3501_SIG_REASSOC_IND,
+	WL3501_SIG_SCAN_CONFIRM,
+	WL3501_SIG_SET_CONFIRM,
+	WL3501_SIG_START_CONFIRM,
+	WL3501_SIG_RESYNC_CONFIRM,
+	WL3501_SIG_SITE_CONFIRM,
+	WL3501_SIG_SAVE_CONFIRM,
+	WL3501_SIG_RFTEST_CONFIRM,
+/*
+ * ID for input Signals of MLME block
+ * bit[7-5] is block ID: 010
+ * bit[4-0] is signal ID
+ */
+	WL3501_SIG_ASSOC_REQ = 0x20,
+	WL3501_SIG_AUTH_REQ,
+	WL3501_SIG_DEAUTH_REQ,
+	WL3501_SIG_DISASSOC_REQ,
+	WL3501_SIG_GET_REQ,
+	WL3501_SIG_JOIN_REQ,
+	WL3501_SIG_PWR_MGMT_REQ,
+	WL3501_SIG_REASSOC_REQ,
+	WL3501_SIG_SCAN_REQ,
+	WL3501_SIG_SET_REQ,
+	WL3501_SIG_START_REQ,
+	WL3501_SIG_MD_REQ,
+	WL3501_SIG_RESYNC_REQ,
+	WL3501_SIG_SITE_REQ,
+	WL3501_SIG_SAVE_REQ,
+	WL3501_SIG_RF_TEST_REQ,
+	WL3501_SIG_MM_CONFIRM = 0x60,
+	WL3501_SIG_MM_IND,
+};
+
+enum wl3501_mib_attribs {
+	WL3501_MIB_ATTR_STATION_ID,
+	WL3501_MIB_ATTR_AUTH_ALGORITHMS,
+	WL3501_MIB_ATTR_AUTH_TYPE,
+	WL3501_MIB_ATTR_MEDIUM_OCCUPANCY_LIMIT,
+	WL3501_MIB_ATTR_CF_POLLABLE,
+	WL3501_MIB_ATTR_CFP_PERIOD,
+	WL3501_MIB_ATTR_CFPMAX_DURATION,
+	WL3501_MIB_ATTR_AUTH_RESP_TMOUT,
+	WL3501_MIB_ATTR_RX_DTIMS,
+	WL3501_MIB_ATTR_PRIV_OPT_IMPLEMENTED,
+	WL3501_MIB_ATTR_PRIV_INVOKED,
+	WL3501_MIB_ATTR_WEP_DEFAULT_KEYS,
+	WL3501_MIB_ATTR_WEP_DEFAULT_KEY_ID,
+	WL3501_MIB_ATTR_WEP_KEY_MAPPINGS,
+	WL3501_MIB_ATTR_WEP_KEY_MAPPINGS_LEN,
+	WL3501_MIB_ATTR_EXCLUDE_UNENCRYPTED,
+	WL3501_MIB_ATTR_WEP_ICV_ERROR_COUNT,
+	WL3501_MIB_ATTR_WEP_UNDECRYPTABLE_COUNT,
+	WL3501_MIB_ATTR_WEP_EXCLUDED_COUNT,
+	WL3501_MIB_ATTR_MAC_ADDR,
+	WL3501_MIB_ATTR_GROUP_ADDRS,
+	WL3501_MIB_ATTR_RTS_THRESHOLD,
+	WL3501_MIB_ATTR_SHORT_RETRY_LIMIT,
+	WL3501_MIB_ATTR_LONG_RETRY_LIMIT,
+	WL3501_MIB_ATTR_FRAG_THRESHOLD,
+	WL3501_MIB_ATTR_MAX_TX_MSDU_LIFETIME,
+	WL3501_MIB_ATTR_MAX_RX_LIFETIME,
+	WL3501_MIB_ATTR_MANUFACTURER_ID,
+	WL3501_MIB_ATTR_PRODUCT_ID,
+	WL3501_MIB_ATTR_TX_FRAG_COUNT,
+	WL3501_MIB_ATTR_MULTICAST_TX_FRAME_COUNT,
+	WL3501_MIB_ATTR_FAILED_COUNT,
+	WL3501_MIB_ATTR_RX_FRAG_COUNT,
+	WL3501_MIB_ATTR_MULTICAST_RX_COUNT,
+	WL3501_MIB_ATTR_FCS_ERROR_COUNT,
+	WL3501_MIB_ATTR_RETRY_COUNT,
+	WL3501_MIB_ATTR_MULTIPLE_RETRY_COUNT,
+	WL3501_MIB_ATTR_RTS_SUCCESS_COUNT,
+	WL3501_MIB_ATTR_RTS_FAILURE_COUNT,
+	WL3501_MIB_ATTR_ACK_FAILURE_COUNT,
+	WL3501_MIB_ATTR_FRAME_DUPLICATE_COUNT,
+	WL3501_MIB_ATTR_PHY_TYPE,
+	WL3501_MIB_ATTR_REG_DOMAINS_SUPPORT,
+	WL3501_MIB_ATTR_CURRENT_REG_DOMAIN,
+	WL3501_MIB_ATTR_SLOT_TIME,
+	WL3501_MIB_ATTR_CCA_TIME,
+	WL3501_MIB_ATTR_RX_TX_TURNAROUND_TIME,
+	WL3501_MIB_ATTR_TX_PLCP_DELAY,
+	WL3501_MIB_ATTR_RX_TX_SWITCH_TIME,
+	WL3501_MIB_ATTR_TX_RAMP_ON_TIME,
+	WL3501_MIB_ATTR_TX_RF_DELAY,
+	WL3501_MIB_ATTR_SIFS_TIME,
+	WL3501_MIB_ATTR_RX_RF_DELAY,
+	WL3501_MIB_ATTR_RX_PLCP_DELAY,
+	WL3501_MIB_ATTR_MAC_PROCESSING_DELAY,
+	WL3501_MIB_ATTR_TX_RAMP_OFF_TIME,
+	WL3501_MIB_ATTR_PREAMBLE_LEN,
+	WL3501_MIB_ATTR_PLCP_HEADER_LEN,
+	WL3501_MIB_ATTR_MPDU_DURATION_FACTOR,
+	WL3501_MIB_ATTR_AIR_PROPAGATION_TIME,
+	WL3501_MIB_ATTR_TEMP_TYPE,
+	WL3501_MIB_ATTR_CW_MIN,
+	WL3501_MIB_ATTR_CW_MAX,
+	WL3501_MIB_ATTR_SUPPORT_DATA_RATES_TX,
+	WL3501_MIB_ATTR_SUPPORT_DATA_RATES_RX,
+	WL3501_MIB_ATTR_MPDU_MAX_LEN,
+	WL3501_MIB_ATTR_SUPPORT_TX_ANTENNAS,
+	WL3501_MIB_ATTR_CURRENT_TX_ANTENNA,
+	WL3501_MIB_ATTR_SUPPORT_RX_ANTENNAS,
+	WL3501_MIB_ATTR_DIVERSITY_SUPPORT,
+	WL3501_MIB_ATTR_DIVERSITY_SELECTION_RS,
+	WL3501_MIB_ATTR_NR_SUPPORTED_PWR_LEVELS,
+	WL3501_MIB_ATTR_TX_PWR_LEVEL1,
+	WL3501_MIB_ATTR_TX_PWR_LEVEL2,
+	WL3501_MIB_ATTR_TX_PWR_LEVEL3,
+	WL3501_MIB_ATTR_TX_PWR_LEVEL4,
+	WL3501_MIB_ATTR_TX_PWR_LEVEL5,
+	WL3501_MIB_ATTR_TX_PWR_LEVEL6,
+	WL3501_MIB_ATTR_TX_PWR_LEVEL7,
+	WL3501_MIB_ATTR_TX_PWR_LEVEL8,
+	WL3501_MIB_ATTR_CURRENT_TX_PWR_LEVEL,
+	WL3501_MIB_ATTR_CURRENT_CHAN,
+	WL3501_MIB_ATTR_CCA_MODE_SUPPORTED,
+	WL3501_MIB_ATTR_CURRENT_CCA_MODE,
+	WL3501_MIB_ATTR_ED_THRESHOLD,
+	WL3501_MIB_ATTR_SINTHESIZER_LOCKED,
+	WL3501_MIB_ATTR_CURRENT_PWR_STATE,
+	WL3501_MIB_ATTR_DOZE_TURNON_TIME,
+	WL3501_MIB_ATTR_RCR33,
+	WL3501_MIB_ATTR_DEFAULT_CHAN,
+	WL3501_MIB_ATTR_SSID,
+	WL3501_MIB_ATTR_PWR_MGMT_ENABLE,
+	WL3501_MIB_ATTR_NET_CAPABILITY,
+	WL3501_MIB_ATTR_ROUTING,
+};
+
+enum wl3501_net_type {
+	WL3501_NET_TYPE_INFRA,
+	WL3501_NET_TYPE_ADHOC,
+	WL3501_NET_TYPE_ANY_BSS,
+};
+
+enum wl3501_scan_type {
+	WL3501_SCAN_TYPE_ACTIVE,
+	WL3501_SCAN_TYPE_PASSIVE,
+};
+
+enum wl3501_tx_result {
+	WL3501_TX_RESULT_SUCCESS,
+	WL3501_TX_RESULT_NO_BSS,
+	WL3501_TX_RESULT_RETRY_LIMIT,
+};
+
+enum wl3501_sys_type {
+	WL3501_SYS_TYPE_OPEN,
+	WL3501_SYS_TYPE_SHARE_KEY,
+};
+
+enum wl3501_status {
+	WL3501_STATUS_SUCCESS,
+	WL3501_STATUS_INVALID,
+	WL3501_STATUS_TIMEOUT,
+	WL3501_STATUS_REFUSED,
+	WL3501_STATUS_MANY_REQ,
+	WL3501_STATUS_ALREADY_BSS,
+};
+
+#define WL3501_MGMT_CAPABILITY_ESS		0x0001  /* see 802.11 p.58 */
+#define WL3501_MGMT_CAPABILITY_IBSS		0x0002  /*      - " -	   */
+#define WL3501_MGMT_CAPABILITY_CF_POLLABLE	0x0004  /*      - " -	   */
+#define WL3501_MGMT_CAPABILITY_CF_POLL_REQUEST	0x0008  /*      - " -	   */
+#define WL3501_MGMT_CAPABILITY_PRIVACY		0x0010  /*      - " -	   */
+
+#define IW_REG_DOMAIN_FCC	0x10	/* Channel 1 to 11	USA    */
+#define IW_REG_DOMAIN_DOC	0x20	/* Channel 1 to 11	Canada */
+#define IW_REG_DOMAIN_ETSI	0x30	/* Channel 1 to 13	Europe */
+#define IW_REG_DOMAIN_SPAIN	0x31	/* Channel 10 to 11	Spain  */
+#define IW_REG_DOMAIN_FRANCE	0x32	/* Channel 10 to 13	France */
+#define IW_REG_DOMAIN_MKK	0x40	/* Channel 14		Japan  */
+#define IW_REG_DOMAIN_MKK1	0x41	/* Channel 1-14		Japan  */
+#define IW_REG_DOMAIN_ISRAEL	0x50	/* Channel 3 - 9	Israel */
+
+#define IW_MGMT_RATE_LABEL_MANDATORY 128 /* MSB */
+
+enum iw_mgmt_rate_labels {
+	IW_MGMT_RATE_LABEL_1MBIT   = 2,
+	IW_MGMT_RATE_LABEL_2MBIT   = 4,
+	IW_MGMT_RATE_LABEL_5_5MBIT = 11,
+	IW_MGMT_RATE_LABEL_11MBIT  = 22,
+};
+
+enum iw_mgmt_info_element_ids {
+	IW_MGMT_INFO_ELEMENT_SSID,		  /* Service Set Identity */
+	IW_MGMT_INFO_ELEMENT_SUPPORTED_RATES,
+	IW_MGMT_INFO_ELEMENT_FH_PARAMETER_SET,
+	IW_MGMT_INFO_ELEMENT_DS_PARAMETER_SET,
+	IW_MGMT_INFO_ELEMENT_CS_PARAMETER_SET,
+	IW_MGMT_INFO_ELEMENT_CS_TIM,		  /* Traffic Information Map */
+	IW_MGMT_INFO_ELEMENT_IBSS_PARAMETER_SET,
+	/* 7-15: Reserved, unused */
+	IW_MGMT_INFO_ELEMENT_CHALLENGE_TEXT = 16,
+	/* 17-31 Reserved for challenge text extension */
+	/* 32-255 Reserved, unused */
+};
+
+struct iw_mgmt_info_element {
+	u8 id; /* one of enum iw_mgmt_info_element_ids,
+		  but sizeof(enum) > sizeof(u8) :-( */
+	u8 len;
+	u8 data[0];
+} __attribute__ ((packed));
+
+struct iw_mgmt_essid_pset {
+	struct iw_mgmt_info_element el;
+	u8 			    essid[IW_ESSID_MAX_SIZE];
+} __attribute__ ((packed));
+
+/*
+ * According to 802.11 Wireless Netowors, the definitive guide - O'Reilly
+ * Pg 75
+ */ 
+#define IW_DATA_RATE_MAX_LABELS 8
+
+struct iw_mgmt_data_rset {
+	struct iw_mgmt_info_element el;
+	u8 			    data_rate_labels[IW_DATA_RATE_MAX_LABELS];
+} __attribute__ ((packed));
+
+struct iw_mgmt_ds_pset {
+	struct iw_mgmt_info_element el;
+	u8 			    chan;
+} __attribute__ ((packed));
+
+struct iw_mgmt_cf_pset {
+	struct iw_mgmt_info_element el;
+	u8 			    cfp_count;
+	u8 			    cfp_period;
+	u16 			    cfp_max_duration;
+	u16 			    cfp_dur_remaining;
+} __attribute__ ((packed));
+
+struct iw_mgmt_ibss_pset {
+	struct iw_mgmt_info_element el;
+	u16 			    atim_window;
+} __attribute__ ((packed));
+
+struct wl3501_tx_hdr {
+	u16	tx_cnt;
+	u8	sync[16];
+	u16	sfd;
+	u8	signal;
+	u8	service;
+	u16	len;
+	u16	crc16;
+	u16	frame_ctrl;
+	u16	duration_id;
+	u8	addr1[ETH_ALEN];
+	u8	addr2[ETH_ALEN];
+	u8	addr3[ETH_ALEN];
+	u16	seq_ctrl;
+	u8	addr4[ETH_ALEN];
+};
+
+struct wl3501_rx_hdr {
+	u16	rx_next_blk;
+	u16	rc_next_frame_blk;
+	u8	rx_blk_ctrl;
+	u8	rx_next_frame;
+	u8	rx_next_frame1;
+	u8	rssi;
+	char	time[8];
+	u8	signal;
+	u8	service;
+	u16	len;
+	u16	crc16;
+	u16	frame_ctrl;
+	u16	duration;
+	u8	addr1[ETH_ALEN];
+	u8	addr2[ETH_ALEN];
+	u8	addr3[ETH_ALEN];
+	u16	seq;
+	u8	addr4[ETH_ALEN];
+};
+
+struct wl3501_start_req {
+	u16			    next_blk;
+	u8			    sig_id;
+	u8			    bss_type;
+	u16			    beacon_period;
+	u16			    dtim_period;
+	u16			    probe_delay;
+	u16			    cap_info;
+	struct iw_mgmt_essid_pset   ssid;
+	struct iw_mgmt_data_rset    bss_basic_rset;
+	struct iw_mgmt_data_rset    operational_rset;
+	struct iw_mgmt_cf_pset	    cf_pset;
+	struct iw_mgmt_ds_pset	    ds_pset;
+	struct iw_mgmt_ibss_pset    ibss_pset;
+};
+
+struct wl3501_assoc_req {
+	u16	next_blk;
+	u8	sig_id;
+	u8	reserved;
+	u16	timeout;
+	u16	cap_info;
+	u16	listen_interval;
+	u8	mac_addr[ETH_ALEN];
+};
+
+struct wl3501_assoc_confirm {
+	u16	next_blk;
+	u8	sig_id;
+	u8	reserved;
+	u16	status;
+};
+
+struct wl3501_assoc_ind {
+	u16	next_blk;
+	u8	sig_id;
+	u8	mac_addr[ETH_ALEN];
+};
+
+struct wl3501_auth_req {
+	u16	next_blk;
+	u8	sig_id;
+	u8	reserved;
+	u16	type;
+	u16	timeout;
+	u8	mac_addr[ETH_ALEN];
+};
+
+struct wl3501_auth_confirm {
+	u16	next_blk;
+	u8	sig_id;
+	u8	reserved;
+	u16	type;
+	u16	status;
+	u8	mac_addr[ETH_ALEN];
+};
+
+struct wl3501_get_req {
+	u16	next_blk;
+	u8	sig_id;
+	u8	reserved;
+	u16	mib_attrib;
+};
+
+struct wl3501_get_confirm {
+	u16	next_blk;
+	u8	sig_id;
+	u8	reserved;
+	u16	mib_status;
+	u16	mib_attrib;
+	u8	mib_value[100];
+};
+
+struct wl3501_join_req {
+	u16			    next_blk;
+	u8			    sig_id;
+	u8			    reserved;
+	struct iw_mgmt_data_rset    operational_rset;
+	u16			    reserved2;
+	u16			    timeout;
+	u16			    probe_delay;
+	u8			    timestamp[8];
+	u8			    local_time[8];
+	u16			    beacon_period;
+	u16			    dtim_period;
+	u16			    cap_info;
+	u8			    bss_type;
+	u8			    bssid[ETH_ALEN];
+	struct iw_mgmt_essid_pset   ssid;
+	struct iw_mgmt_ds_pset	    ds_pset;
+	struct iw_mgmt_cf_pset	    cf_pset;
+	struct iw_mgmt_ibss_pset    ibss_pset;
+	struct iw_mgmt_data_rset    bss_basic_rset;
+};
+
+struct wl3501_join_confirm {
+	u16	next_blk;
+	u8	sig_id;
+	u8	reserved;
+	u16	status;
+};
+
+struct wl3501_pwr_mgmt_req {
+	u16	next_blk;
+	u8	sig_id;
+	u8	pwr_save;
+	u8	wake_up;
+	u8	receive_dtims;
+};
+
+struct wl3501_pwr_mgmt_confirm {
+	u16	next_blk;
+	u8	sig_id;
+	u8	reserved;
+	u16	status;
+};
+
+struct wl3501_scan_req {
+	u16			    next_blk;
+	u8			    sig_id;
+	u8			    bss_type;
+	u16			    probe_delay;
+	u16			    min_chan_time;
+	u16			    max_chan_time;
+	u8			    chan_list[14];
+	u8			    bssid[ETH_ALEN];
+	struct iw_mgmt_essid_pset   ssid;
+	enum wl3501_scan_type	    scan_type;
+};
+
+struct wl3501_scan_confirm {
+	u16			    next_blk;
+	u8			    sig_id;
+	u8			    reserved;
+	u16			    status;
+	char			    timestamp[8];
+	char			    localtime[8];
+	u16			    beacon_period;
+	u16			    dtim_period;
+	u16			    cap_info;
+	u8			    bss_type;
+	u8			    bssid[ETH_ALEN];
+	struct iw_mgmt_essid_pset   ssid;
+	struct iw_mgmt_ds_pset	    ds_pset;
+	struct iw_mgmt_cf_pset	    cf_pset;
+	struct iw_mgmt_ibss_pset    ibss_pset;
+	struct iw_mgmt_data_rset    bss_basic_rset;
+	u8			    rssi;
+};
+
+struct wl3501_start_confirm {
+	u16	next_blk;
+	u8	sig_id;
+	u8	reserved;
+	u16	status;
+};
+
+struct wl3501_md_req {
+	u16	next_blk;
+	u8	sig_id;
+	u8	routing;
+	u16	data;
+	u16	size;
+	u8	pri;
+	u8	service_class;
+	u8	daddr[ETH_ALEN];
+	u8	saddr[ETH_ALEN];
+};
+
+struct wl3501_md_ind {
+	u16	next_blk;
+	u8	sig_id;
+	u8	routing;
+	u16	data;
+	u16	size;
+	u8	reception;
+	u8	pri;
+	u8	service_class;
+	u8	daddr[ETH_ALEN];
+	u8	saddr[ETH_ALEN];
+};
+
+struct wl3501_md_confirm {
+	u16	next_blk;
+	u8	sig_id;
+	u8	reserved;
+	u16	data;
+	u8	status;
+	u8	pri;
+	u8	service_class;
+};
+
+struct wl3501_resync_req {
+	u16	next_blk;
+	u8	sig_id;
+};
+
+/* Definitions for supporting clone adapters. */
+/* System Interface Registers (SIR space) */
+#define WL3501_NIC_GCR ((u8)0x00)	/* SIR0 - General Conf Register */
+#define WL3501_NIC_BSS ((u8)0x01)	/* SIR1 - Bank Switching Select Reg */
+#define WL3501_NIC_LMAL ((u8)0x02)	/* SIR2 - Local Mem addr Reg [7:0] */
+#define WL3501_NIC_LMAH ((u8)0x03)	/* SIR3 - Local Mem addr Reg [14:8] */
+#define WL3501_NIC_IODPA ((u8)0x04)	/* SIR4 - I/O Data Port A */
+#define WL3501_NIC_IODPB ((u8)0x05)	/* SIR5 - I/O Data Port B */
+#define WL3501_NIC_IODPC ((u8)0x06)	/* SIR6 - I/O Data Port C */
+#define WL3501_NIC_IODPD ((u8)0x07)	/* SIR7 - I/O Data Port D */
+
+/* Bits in GCR */
+#define WL3501_GCR_SWRESET ((u8)0x80)
+#define WL3501_GCR_CORESET ((u8)0x40)
+#define WL3501_GCR_DISPWDN ((u8)0x20)
+#define WL3501_GCR_ECWAIT  ((u8)0x10)
+#define WL3501_GCR_ECINT   ((u8)0x08)
+#define WL3501_GCR_INT2EC  ((u8)0x04)
+#define WL3501_GCR_ENECINT ((u8)0x02)
+#define WL3501_GCR_DAM     ((u8)0x01)
+
+/* Bits in BSS (Bank Switching Select Register) */
+#define WL3501_BSS_FPAGE0 ((u8)0x20)	/* Flash memory page0 */
+#define WL3501_BSS_FPAGE1 ((u8)0x28)
+#define WL3501_BSS_FPAGE2 ((u8)0x30)
+#define WL3501_BSS_FPAGE3 ((u8)0x38)
+#define WL3501_BSS_SPAGE0 ((u8)0x00)	/* SRAM page0 */
+#define WL3501_BSS_SPAGE1 ((u8)0x08)
+#define WL3501_BSS_SPAGE2 ((u8)0x10)
+#define WL3501_BSS_SPAGE3 ((u8)0x18)
+
+/* Define Driver Interface */
+/* Refer IEEE 802.11 */
+/* Tx packet header, include PLCP and MPDU */
+/* Tx PLCP Header */
+struct wl3501_80211_tx_plcp_hdr {
+	u8	sync[16];
+	u16	sfd;
+	u8	signal;
+	u8	service;
+	u16	len;
+	u16	crc16;
+} __attribute__ ((packed));
+
+struct wl3501_80211_tx_hdr {
+	struct wl3501_80211_tx_plcp_hdr	pclp_hdr;
+	struct ieee802_11_hdr		mac_hdr;
+} __attribute__ ((packed));
+
+/*
+   Reserve the beginning Tx space for descriptor use.
+
+   TxBlockOffset -->	*----*----*----*----* \
+	(TxFreeDesc)	|  0 |  1 |  2 |  3 |  \
+			|  4 |  5 |  6 |  7 |   |
+			|  8 |  9 | 10 | 11 |   TX_DESC * 20
+			| 12 | 13 | 14 | 15 |   |
+			| 16 | 17 | 18 | 19 |  /
+   TxBufferBegin -->	*----*----*----*----* /
+   (TxBufferHead)	| 		    |
+   (TxBufferTail)	| 		    |
+			|    Send Buffer    |
+			| 		    |
+			|		    |
+			*-------------------*
+   TxBufferEnd    -------------------------/
+
+*/
+
+struct wl3501_card {
+	int				base_addr;
+	u8				mac_addr[ETH_ALEN];
+	spinlock_t			lock;
+	wait_queue_head_t		wait;
+	struct wl3501_get_confirm	sig_get_confirm;
+	struct wl3501_pwr_mgmt_confirm	sig_pwr_mgmt_confirm;
+	u16				tx_buffer_size;
+	u16				tx_buffer_head;
+	u16				tx_buffer_tail;
+	u16				tx_buffer_cnt;
+	u16				esbq_req_start;
+	u16				esbq_req_end;
+	u16				esbq_req_head;
+	u16				esbq_req_tail;
+	u16				esbq_confirm_start;
+	u16				esbq_confirm_end;
+	u16				esbq_confirm;
+	struct iw_mgmt_essid_pset  	essid;
+	struct iw_mgmt_essid_pset  	keep_essid;
+	u8				bssid[ETH_ALEN];
+	int				net_type;
+	char				nick[32];
+	char				card_name[32];
+	char				firmware_date[32];
+	u8				chan;
+	u8				cap_info;
+	u16				start_seg;
+	u16				bss_cnt;
+	u16				join_sta_bss;
+	u8				rssi;
+	u8				adhoc_times;
+	u8				reg_domain;
+	u8				version[2];
+	struct wl3501_scan_confirm	bss_set[20];
+	struct net_device_stats 	stats;
+	struct iw_statistics		wstats;
+	struct iw_spy_data		spy_data;
+	struct dev_node_t		node;
+};
+#endif
diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c
new file mode 100644
index 0000000..1433e5a
--- /dev/null
+++ b/drivers/net/wireless/wl3501_cs.c
@@ -0,0 +1,2270 @@
+/*
+ * WL3501 Wireless LAN PCMCIA Card Driver for Linux
+ * Written originally for Linux 2.0.30 by Fox Chen, mhchen@golf.ccl.itri.org.tw
+ * Ported to 2.2, 2.4 & 2.5 by Arnaldo Carvalho de Melo <acme@conectiva.com.br>
+ * Wireless extensions in 2.4 by Gustavo Niemeyer <niemeyer@conectiva.com>
+ *
+ * References used by Fox Chen while writing the original driver for 2.0.30:
+ *
+ *   1. WL24xx packet drivers (tooasm.asm)
+ *   2. Access Point Firmware Interface Specification for IEEE 802.11 SUTRO
+ *   3. IEEE 802.11
+ *   4. Linux network driver (/usr/src/linux/drivers/net)
+ *   5. ISA card driver - wl24.c
+ *   6. Linux PCMCIA skeleton driver - skeleton.c
+ *   7. Linux PCMCIA 3c589 network driver - 3c589_cs.c
+ *
+ * Tested with WL2400 firmware 1.2, Linux 2.0.30, and pcmcia-cs-2.9.12
+ *   1. Performance: about 165 Kbytes/sec in TCP/IP with Ad-Hoc mode.
+ *      rsh 192.168.1.3 "dd if=/dev/zero bs=1k count=1000" > /dev/null
+ *      (Specification 2M bits/sec. is about 250 Kbytes/sec., but we must deduct
+ *       ETHER/IP/UDP/TCP header, and acknowledgement overhead)
+ *
+ * Tested with Planet AP in 2.4.17, 184 Kbytes/s in UDP in Infrastructure mode,
+ * 173 Kbytes/s in TCP.
+ *
+ * Tested with Planet AP in 2.5.73-bk, 216 Kbytes/s in Infrastructure mode
+ * with a SMP machine (dual pentium 100), using pktgen, 432 pps (pkt_size = 60)
+ */
+#undef REALLY_SLOW_IO	/* most systems can safely undef this */
+
+#include <linux/config.h>
+#include <linux/delay.h>
+#include <linux/types.h>
+#include <linux/ethtool.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/in.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/fcntl.h>
+#include <linux/if_arp.h>
+#include <linux/ioport.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/skbuff.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/wireless.h>
+
+#include <net/iw_handler.h>
+
+#include <pcmcia/version.h>
+#include <pcmcia/cs_types.h>
+#include <pcmcia/cs.h>
+#include <pcmcia/cistpl.h>
+#include <pcmcia/cisreg.h>
+#include <pcmcia/ds.h>
+
+#include <asm/io.h>
+#include <asm/uaccess.h>
+#include <asm/system.h>
+
+#include "wl3501.h"
+
+#ifndef __i386__
+#define slow_down_io()
+#endif
+
+/* For rough constant delay */
+#define WL3501_NOPLOOP(n) { int x = 0; while (x++ < n) slow_down_io(); }
+
+/*
+ * All the PCMCIA modules use PCMCIA_DEBUG to control debugging.  If you do not
+ * define PCMCIA_DEBUG at all, all the debug code will be left out.  If you
+ * compile with PCMCIA_DEBUG=0, the debug code will be present but disabled --
+ * but it can then be enabled for specific modules at load time with a
+ * 'pc_debug=#' option to insmod.
+ */
+#define PCMCIA_DEBUG 0
+#ifdef PCMCIA_DEBUG
+static int pc_debug = PCMCIA_DEBUG;
+module_param(pc_debug, int, 0);
+#define dprintk(n, format, args...) \
+	{ if (pc_debug > (n)) \
+		printk(KERN_INFO "%s: " format "\n", __FUNCTION__ , ##args); }
+#else
+#define dprintk(n, format, args...)
+#endif
+
+#define wl3501_outb(a, b) { outb(a, b); slow_down_io(); }
+#define wl3501_outb_p(a, b) { outb_p(a, b); slow_down_io(); }
+#define wl3501_outsb(a, b, c) { outsb(a, b, c); slow_down_io(); }
+
+#define WL3501_RELEASE_TIMEOUT (25 * HZ)
+#define WL3501_MAX_ADHOC_TRIES 16
+
+#define WL3501_RESUME	0
+#define WL3501_SUSPEND	1
+
+/*
+ * The event() function is this driver's Card Services event handler.  It will
+ * be called by Card Services when an appropriate card status event is
+ * received. The config() and release() entry points are used to configure or
+ * release a socket, in response to card insertion and ejection events.  They
+ * are invoked from the wl24 event handler.
+ */
+static void wl3501_config(dev_link_t *link);
+static void wl3501_release(dev_link_t *link);
+static int wl3501_event(event_t event, int pri, event_callback_args_t *args);
+
+/*
+ * The dev_info variable is the "key" that is used to match up this
+ * device driver with appropriate cards, through the card configuration
+ * database.
+ */
+static dev_info_t wl3501_dev_info = "wl3501_cs";
+
+static int wl3501_chan2freq[] = {
+	[0]  = 2412, [1]  = 2417, [2]  = 2422, [3]  = 2427, [4] = 2432,
+	[5]  = 2437, [6]  = 2442, [7]  = 2447, [8]  = 2452, [9] = 2457,
+	[10] = 2462, [11] = 2467, [12] = 2472, [13] = 2477,
+};
+
+static const struct {
+	int reg_domain;
+	int min, max, deflt;
+} iw_channel_table[] = {
+	{
+		.reg_domain = IW_REG_DOMAIN_FCC,
+		.min	    = 1,
+		.max	    = 11,
+		.deflt	    = 1,
+	},
+	{
+		.reg_domain = IW_REG_DOMAIN_DOC,
+		.min	    = 1,
+		.max	    = 11,
+		.deflt	    = 1,
+	},
+	{
+		.reg_domain = IW_REG_DOMAIN_ETSI,
+		.min	    = 1,
+		.max	    = 13,
+		.deflt	    = 1,
+	},
+	{
+		.reg_domain = IW_REG_DOMAIN_SPAIN,
+		.min	    = 10,
+		.max	    = 11,
+		.deflt	    = 10,
+	},
+	{
+		.reg_domain = IW_REG_DOMAIN_FRANCE,
+		.min	    = 10,
+		.max	    = 13,
+		.deflt	    = 10,
+	},
+	{
+		.reg_domain = IW_REG_DOMAIN_MKK,
+		.min	    = 14,
+		.max	    = 14,
+		.deflt	    = 14,
+	},
+	{
+		.reg_domain = IW_REG_DOMAIN_MKK1,
+		.min	    = 1,
+		.max	    = 14,
+		.deflt	    = 1,
+	},
+	{
+		.reg_domain = IW_REG_DOMAIN_ISRAEL,
+		.min	    = 3,
+		.max	    = 9,
+		.deflt	    = 9,
+	},
+};
+
+/**
+ * iw_valid_channel - validate channel in regulatory domain
+ * @reg_comain - regulatory domain
+ * @channel - channel to validate
+ *
+ * Returns 0 if invalid in the specified regulatory domain, non-zero if valid.
+ */
+static int iw_valid_channel(int reg_domain, int channel)
+{
+	int i, rc = 0;
+
+	for (i = 0; i < ARRAY_SIZE(iw_channel_table); i++)
+		if (reg_domain == iw_channel_table[i].reg_domain) {
+			rc = channel >= iw_channel_table[i].min &&
+			     channel <= iw_channel_table[i].max;
+			break;
+		}
+	return rc;
+}
+
+/**
+ * iw_default_channel - get default channel for a regulatory domain
+ * @reg_comain - regulatory domain
+ *
+ * Returns the default channel for a regulatory domain
+ */
+static int iw_default_channel(int reg_domain)
+{
+	int i, rc = 1;
+
+	for (i = 0; i < ARRAY_SIZE(iw_channel_table); i++)
+		if (reg_domain == iw_channel_table[i].reg_domain) {
+			rc = iw_channel_table[i].deflt;
+			break;
+		}
+	return rc;
+}
+
+static void iw_set_mgmt_info_element(enum iw_mgmt_info_element_ids id,
+				     struct iw_mgmt_info_element *el,
+				     void *value, int len)
+{
+	el->id  = id;
+	el->len = len;
+	memcpy(el->data, value, len);
+}
+
+static void iw_copy_mgmt_info_element(struct iw_mgmt_info_element *to,
+				      struct iw_mgmt_info_element *from)
+{
+	iw_set_mgmt_info_element(from->id, to, from->data, from->len);
+}
+
+/*
+ * A linked list of "instances" of the wl24 device.  Each actual PCMCIA card
+ * corresponds to one device instance, and is described by one dev_link_t
+ * structure (defined in ds.h).
+ *
+ * You may not want to use a linked list for this -- for example, the memory
+ * card driver uses an array of dev_link_t pointers, where minor device numbers
+ * are used to derive the corresponding array index.
+ */
+static dev_link_t *wl3501_dev_list;
+
+static inline void wl3501_switch_page(struct wl3501_card *this, u8 page)
+{
+	wl3501_outb(page, this->base_addr + WL3501_NIC_BSS);
+}
+
+/*
+ * Get Ethernet MAC addresss.
+ *
+ * WARNING: We switch to FPAGE0 and switc back again.
+ *          Making sure there is no other WL function beening called by ISR.
+ */
+static int wl3501_get_flash_mac_addr(struct wl3501_card *this)
+{
+	int base_addr = this->base_addr;
+
+	/* get MAC addr */
+	wl3501_outb(WL3501_BSS_FPAGE3, base_addr + WL3501_NIC_BSS); /* BSS */
+	wl3501_outb(0x00, base_addr + WL3501_NIC_LMAL);	/* LMAL */
+	wl3501_outb(0x40, base_addr + WL3501_NIC_LMAH);	/* LMAH */
+
+	/* wait for reading EEPROM */
+	WL3501_NOPLOOP(100);
+	this->mac_addr[0] = inb(base_addr + WL3501_NIC_IODPA);
+	WL3501_NOPLOOP(100);
+	this->mac_addr[1] = inb(base_addr + WL3501_NIC_IODPA);
+	WL3501_NOPLOOP(100);
+	this->mac_addr[2] = inb(base_addr + WL3501_NIC_IODPA);
+	WL3501_NOPLOOP(100);
+	this->mac_addr[3] = inb(base_addr + WL3501_NIC_IODPA);
+	WL3501_NOPLOOP(100);
+	this->mac_addr[4] = inb(base_addr + WL3501_NIC_IODPA);
+	WL3501_NOPLOOP(100);
+	this->mac_addr[5] = inb(base_addr + WL3501_NIC_IODPA);
+	WL3501_NOPLOOP(100);
+	this->reg_domain = inb(base_addr + WL3501_NIC_IODPA);
+	WL3501_NOPLOOP(100);
+	wl3501_outb(WL3501_BSS_FPAGE0, base_addr + WL3501_NIC_BSS);
+	wl3501_outb(0x04, base_addr + WL3501_NIC_LMAL);
+	wl3501_outb(0x40, base_addr + WL3501_NIC_LMAH);
+	WL3501_NOPLOOP(100);
+	this->version[0] = inb(base_addr + WL3501_NIC_IODPA);
+	WL3501_NOPLOOP(100);
+	this->version[1] = inb(base_addr + WL3501_NIC_IODPA);
+	/* switch to SRAM Page 0 (for safety) */
+	wl3501_switch_page(this, WL3501_BSS_SPAGE0);
+
+	/* The MAC addr should be 00:60:... */
+	return this->mac_addr[0] == 0x00 && this->mac_addr[1] == 0x60;
+}
+
+/**
+ * wl3501_set_to_wla - Move 'size' bytes from PC to card
+ * @dest: Card addressing space
+ * @src: PC addressing space
+ * @size: Bytes to move
+ *
+ * Move 'size' bytes from PC to card. (Shouldn't be interrupted)
+ */
+void wl3501_set_to_wla(struct wl3501_card *this, u16 dest, void *src, int size)
+{
+	/* switch to SRAM Page 0 */
+	wl3501_switch_page(this, (dest & 0x8000) ? WL3501_BSS_SPAGE1 :
+						   WL3501_BSS_SPAGE0);
+	/* set LMAL and LMAH */
+	wl3501_outb(dest & 0xff, this->base_addr + WL3501_NIC_LMAL);
+	wl3501_outb(((dest >> 8) & 0x7f), this->base_addr + WL3501_NIC_LMAH);
+
+	/* rep out to Port A */
+	wl3501_outsb(this->base_addr + WL3501_NIC_IODPA, src, size);
+}
+
+/**
+ * wl3501_get_from_wla - Move 'size' bytes from card to PC
+ * @src: Card addressing space
+ * @dest: PC addressing space
+ * @size: Bytes to move
+ *
+ * Move 'size' bytes from card to PC. (Shouldn't be interrupted)
+ */
+void wl3501_get_from_wla(struct wl3501_card *this, u16 src, void *dest,
+			 int size)
+{
+	/* switch to SRAM Page 0 */
+	wl3501_switch_page(this, (src & 0x8000) ? WL3501_BSS_SPAGE1 :
+						  WL3501_BSS_SPAGE0);
+	/* set LMAL and LMAH */
+	wl3501_outb(src & 0xff, this->base_addr + WL3501_NIC_LMAL);
+	wl3501_outb((src >> 8) & 0x7f, this->base_addr + WL3501_NIC_LMAH);
+
+	/* rep get from Port A */
+	insb(this->base_addr + WL3501_NIC_IODPA, dest, size);
+}
+
+/*
+ * Get/Allocate a free Tx Data Buffer
+ *
+ *  *--------------*-----------------*----------------------------------*
+ *  |    PLCP      |    MAC Header   |  DST  SRC         Data ...       |
+ *  |  (24 bytes)  |    (30 bytes)   |  (6)  (6)  (Ethernet Row Data)   |
+ *  *--------------*-----------------*----------------------------------*
+ *  \               \- IEEE 802.11 -/ \-------------- len --------------/
+ *   \-struct wl3501_80211_tx_hdr--/   \-------- Ethernet Frame -------/
+ *
+ * Return = Postion in Card
+ */
+static u16 wl3501_get_tx_buffer(struct wl3501_card *this, u16 len)
+{
+	u16 next, blk_cnt = 0, zero = 0;
+	u16 full_len = sizeof(struct wl3501_80211_tx_hdr) + len;
+	u16 ret = 0;
+
+	if (full_len > this->tx_buffer_cnt * 254)
+		goto out;
+	ret = this->tx_buffer_head;
+	while (full_len) {
+		if (full_len < 254)
+			full_len = 0;
+		else
+			full_len -= 254;
+		wl3501_get_from_wla(this, this->tx_buffer_head, &next,
+				    sizeof(next));
+		if (!full_len)
+			wl3501_set_to_wla(this, this->tx_buffer_head, &zero,
+					  sizeof(zero));
+		this->tx_buffer_head = next;
+		blk_cnt++;
+		/* if buffer is not enough */
+		if (!next && full_len) {
+			this->tx_buffer_head = ret;
+			ret = 0;
+			goto out;
+		}
+	}
+	this->tx_buffer_cnt -= blk_cnt;
+out:
+	return ret;
+}
+
+/*
+ * Free an allocated Tx Buffer. ptr must be correct position.
+ */
+static void wl3501_free_tx_buffer(struct wl3501_card *this, u16 ptr)
+{
+	/* check if all space is not free */
+	if (!this->tx_buffer_head)
+		this->tx_buffer_head = ptr;
+	else
+		wl3501_set_to_wla(this, this->tx_buffer_tail,
+				  &ptr, sizeof(ptr));
+	while (ptr) {
+		u16 next;
+
+		this->tx_buffer_cnt++;
+		wl3501_get_from_wla(this, ptr, &next, sizeof(next));
+		this->tx_buffer_tail = ptr;
+		ptr = next;
+	}
+}
+
+static int wl3501_esbq_req_test(struct wl3501_card *this)
+{
+	u8 tmp;
+
+	wl3501_get_from_wla(this, this->esbq_req_head + 3, &tmp, sizeof(tmp));
+	return tmp & 0x80;
+}
+
+static void wl3501_esbq_req(struct wl3501_card *this, u16 *ptr)
+{
+	u16 tmp = 0;
+
+	wl3501_set_to_wla(this, this->esbq_req_head, ptr, 2);
+	wl3501_set_to_wla(this, this->esbq_req_head + 2, &tmp, sizeof(tmp));
+	this->esbq_req_head += 4;
+	if (this->esbq_req_head >= this->esbq_req_end)
+		this->esbq_req_head = this->esbq_req_start;
+}
+
+static int wl3501_esbq_exec(struct wl3501_card *this, void *sig, int sig_size)
+{
+	int rc = -EIO;
+
+	if (wl3501_esbq_req_test(this)) {
+		u16 ptr = wl3501_get_tx_buffer(this, sig_size);
+		if (ptr) {
+			wl3501_set_to_wla(this, ptr, sig, sig_size);
+			wl3501_esbq_req(this, &ptr);
+			rc = 0;
+		}
+	}
+	return rc;
+}
+
+static int wl3501_get_mib_value(struct wl3501_card *this, u8 index,
+				void *bf, int size)
+{
+	struct wl3501_get_req sig = {
+		.sig_id	    = WL3501_SIG_GET_REQ,
+		.mib_attrib = index,
+	};
+	unsigned long flags;
+	int rc = -EIO;
+
+	spin_lock_irqsave(&this->lock, flags);
+	if (wl3501_esbq_req_test(this)) {
+		u16 ptr = wl3501_get_tx_buffer(this, sizeof(sig));
+		if (ptr) {
+			wl3501_set_to_wla(this, ptr, &sig, sizeof(sig));
+			wl3501_esbq_req(this, &ptr);
+			this->sig_get_confirm.mib_status = 255;
+			spin_unlock_irqrestore(&this->lock, flags);
+			rc = wait_event_interruptible(this->wait,
+				this->sig_get_confirm.mib_status != 255);
+			if (!rc)
+				memcpy(bf, this->sig_get_confirm.mib_value,
+				       size);
+			goto out;
+		}
+	}
+	spin_unlock_irqrestore(&this->lock, flags);
+out:
+	return rc;
+}
+
+static int wl3501_pwr_mgmt(struct wl3501_card *this, int suspend)
+{
+	struct wl3501_pwr_mgmt_req sig = {
+		.sig_id		= WL3501_SIG_PWR_MGMT_REQ,
+		.pwr_save	= suspend,
+		.wake_up	= !suspend,
+		.receive_dtims	= 10,
+	};
+	unsigned long flags;
+	int rc = -EIO;
+
+	spin_lock_irqsave(&this->lock, flags);
+	if (wl3501_esbq_req_test(this)) {
+		u16 ptr = wl3501_get_tx_buffer(this, sizeof(sig));
+		if (ptr) {
+			wl3501_set_to_wla(this, ptr, &sig, sizeof(sig));
+			wl3501_esbq_req(this, &ptr);
+			this->sig_pwr_mgmt_confirm.status = 255;
+			spin_unlock_irqrestore(&this->lock, flags);
+			rc = wait_event_interruptible(this->wait,
+				this->sig_pwr_mgmt_confirm.status != 255);
+			printk(KERN_INFO "%s: %s status=%d\n", __FUNCTION__,
+			       suspend ? "suspend" : "resume",
+			       this->sig_pwr_mgmt_confirm.status);
+			goto out;
+		}
+	}
+	spin_unlock_irqrestore(&this->lock, flags);
+out:
+	return rc;
+}
+
+/**
+ * wl3501_send_pkt - Send a packet.
+ * @this - card
+ *
+ * Send a packet.
+ *
+ * data = Ethernet raw frame.  (e.g. data[0] - data[5] is Dest MAC Addr,
+ *                                   data[6] - data[11] is Src MAC Addr)
+ * Ref: IEEE 802.11
+ */
+static int wl3501_send_pkt(struct wl3501_card *this, u8 *data, u16 len)
+{
+	u16 bf, sig_bf, next, tmplen, pktlen;
+	struct wl3501_md_req sig = {
+		.sig_id = WL3501_SIG_MD_REQ,
+	};
+	u8 *pdata = (char *)data;
+	int rc = -EIO;
+
+	if (wl3501_esbq_req_test(this)) {
+		sig_bf = wl3501_get_tx_buffer(this, sizeof(sig));
+		rc = -ENOMEM;
+		if (!sig_bf)	/* No free buffer available */
+			goto out;
+		bf = wl3501_get_tx_buffer(this, len + 26 + 24);
+		if (!bf) {
+			/* No free buffer available */
+			wl3501_free_tx_buffer(this, sig_bf);
+			goto out;
+		}
+		rc = 0;
+		memcpy(&sig.daddr[0], pdata, 12);
+		pktlen = len - 12;
+		pdata += 12;
+		sig.data = bf;
+		if (((*pdata) * 256 + (*(pdata + 1))) > 1500) {
+			u8 addr4[ETH_ALEN] = {
+				[0] = 0xAA, [1] = 0xAA, [2] = 0x03, [4] = 0x00,
+			};
+
+			wl3501_set_to_wla(this, bf + 2 +
+					  offsetof(struct wl3501_tx_hdr, addr4),
+					  addr4, sizeof(addr4));
+			sig.size = pktlen + 24 + 4 + 6;
+			if (pktlen > (254 - sizeof(struct wl3501_tx_hdr))) {
+				tmplen = 254 - sizeof(struct wl3501_tx_hdr);
+				pktlen -= tmplen;
+			} else {
+				tmplen = pktlen;
+				pktlen = 0;
+			}
+			wl3501_set_to_wla(this,
+					  bf + 2 + sizeof(struct wl3501_tx_hdr),
+					  pdata, tmplen);
+			pdata += tmplen;
+			wl3501_get_from_wla(this, bf, &next, sizeof(next));
+			bf = next;
+		} else {
+			sig.size = pktlen + 24 + 4 - 2;
+			pdata += 2;
+			pktlen -= 2;
+			if (pktlen > (254 - sizeof(struct wl3501_tx_hdr) + 6)) {
+				tmplen = 254 - sizeof(struct wl3501_tx_hdr) + 6;
+				pktlen -= tmplen;
+			} else {
+				tmplen = pktlen;
+				pktlen = 0;
+			}
+			wl3501_set_to_wla(this, bf + 2 +
+					  offsetof(struct wl3501_tx_hdr, addr4),
+					  pdata, tmplen);
+			pdata += tmplen;
+			wl3501_get_from_wla(this, bf, &next, sizeof(next));
+			bf = next;
+		}
+		while (pktlen > 0) {
+			if (pktlen > 254) {
+				tmplen = 254;
+				pktlen -= 254;
+			} else {
+				tmplen = pktlen;
+				pktlen = 0;
+			}
+			wl3501_set_to_wla(this, bf + 2, pdata, tmplen);
+			pdata += tmplen;
+			wl3501_get_from_wla(this, bf, &next, sizeof(next));
+			bf = next;
+		}
+		wl3501_set_to_wla(this, sig_bf, &sig, sizeof(sig));
+		wl3501_esbq_req(this, &sig_bf);
+	}
+out:
+	return rc;
+}
+
+static int wl3501_mgmt_resync(struct wl3501_card *this)
+{
+	struct wl3501_resync_req sig = {
+		.sig_id = WL3501_SIG_RESYNC_REQ,
+	};
+
+	return wl3501_esbq_exec(this, &sig, sizeof(sig));
+}
+
+static inline int wl3501_fw_bss_type(struct wl3501_card *this)
+{
+	return this->net_type == IW_MODE_INFRA ? WL3501_NET_TYPE_INFRA :
+						 WL3501_NET_TYPE_ADHOC;
+}
+
+static inline int wl3501_fw_cap_info(struct wl3501_card *this)
+{
+	return this->net_type == IW_MODE_INFRA ? WL3501_MGMT_CAPABILITY_ESS :
+						 WL3501_MGMT_CAPABILITY_IBSS;
+}
+
+static int wl3501_mgmt_scan(struct wl3501_card *this, u16 chan_time)
+{
+	struct wl3501_scan_req sig = {
+		.sig_id		= WL3501_SIG_SCAN_REQ,
+		.scan_type	= WL3501_SCAN_TYPE_ACTIVE,
+		.probe_delay	= 0x10,
+		.min_chan_time	= chan_time,
+		.max_chan_time	= chan_time,
+		.bss_type	= wl3501_fw_bss_type(this),
+	};
+
+	this->bss_cnt = this->join_sta_bss = 0;
+	return wl3501_esbq_exec(this, &sig, sizeof(sig));
+}
+
+static int wl3501_mgmt_join(struct wl3501_card *this, u16 stas)
+{
+	struct wl3501_join_req sig = {
+		.sig_id		  = WL3501_SIG_JOIN_REQ,
+		.timeout	  = 10,
+		.ds_pset = {
+			.el = {
+				.id  = IW_MGMT_INFO_ELEMENT_DS_PARAMETER_SET,
+				.len = 1,
+			},
+			.chan	= this->chan,
+		},
+	};
+
+	memcpy(&sig.beacon_period, &this->bss_set[stas].beacon_period, 72);
+	return wl3501_esbq_exec(this, &sig, sizeof(sig));
+}
+
+static int wl3501_mgmt_start(struct wl3501_card *this)
+{
+	struct wl3501_start_req sig = {
+		.sig_id			= WL3501_SIG_START_REQ,
+		.beacon_period		= 400,
+		.dtim_period		= 1,
+		.ds_pset = {
+			.el = {
+				.id  = IW_MGMT_INFO_ELEMENT_DS_PARAMETER_SET,
+				.len = 1,
+			},
+			.chan	= this->chan,
+		},
+		.bss_basic_rset	= {
+			.el = {
+				.id	= IW_MGMT_INFO_ELEMENT_SUPPORTED_RATES,
+				.len = 2,
+			},
+			.data_rate_labels = {
+				[0] = IW_MGMT_RATE_LABEL_MANDATORY |
+				      IW_MGMT_RATE_LABEL_1MBIT,
+				[1] = IW_MGMT_RATE_LABEL_MANDATORY |
+				      IW_MGMT_RATE_LABEL_2MBIT,
+			},
+		},
+		.operational_rset	= {
+			.el = {
+				.id	= IW_MGMT_INFO_ELEMENT_SUPPORTED_RATES,
+				.len = 2,
+			},
+			.data_rate_labels = {
+				[0] = IW_MGMT_RATE_LABEL_MANDATORY |
+				      IW_MGMT_RATE_LABEL_1MBIT,
+				[1] = IW_MGMT_RATE_LABEL_MANDATORY |
+				      IW_MGMT_RATE_LABEL_2MBIT,
+			},
+		},
+		.ibss_pset		= {
+			.el = {
+				.id	 = IW_MGMT_INFO_ELEMENT_IBSS_PARAMETER_SET,
+				.len     = 2,
+			},
+			.atim_window = 10,
+		},
+		.bss_type		= wl3501_fw_bss_type(this),
+		.cap_info		= wl3501_fw_cap_info(this),
+	};
+
+	iw_copy_mgmt_info_element(&sig.ssid.el, &this->essid.el);
+	iw_copy_mgmt_info_element(&this->keep_essid.el, &this->essid.el);
+	return wl3501_esbq_exec(this, &sig, sizeof(sig));
+}
+
+static void wl3501_mgmt_scan_confirm(struct wl3501_card *this, u16 addr)
+{
+	u16 i = 0;
+	int matchflag = 0;
+	struct wl3501_scan_confirm sig;
+
+	dprintk(3, "entry");
+	wl3501_get_from_wla(this, addr, &sig, sizeof(sig));
+	if (sig.status == WL3501_STATUS_SUCCESS) {
+		dprintk(3, "success");
+		if ((this->net_type == IW_MODE_INFRA &&
+		     (sig.cap_info & WL3501_MGMT_CAPABILITY_ESS)) ||
+		    (this->net_type == IW_MODE_ADHOC &&
+		     (sig.cap_info & WL3501_MGMT_CAPABILITY_IBSS)) ||
+		    this->net_type == IW_MODE_AUTO) {
+			if (!this->essid.el.len)
+				matchflag = 1;
+			else if (this->essid.el.len == 3 &&
+				 !memcmp(this->essid.essid, "ANY", 3))
+				matchflag = 1;
+			else if (this->essid.el.len != sig.ssid.el.len)
+				matchflag = 0;
+			else if (memcmp(this->essid.essid, sig.ssid.essid,
+					this->essid.el.len))
+				matchflag = 0;
+			else
+				matchflag = 1;
+			if (matchflag) {
+				for (i = 0; i < this->bss_cnt; i++) {
+					if (!memcmp(this->bss_set[i].bssid,
+						    sig.bssid, ETH_ALEN)) {
+						matchflag = 0;
+						break;
+					}
+				}
+			}
+			if (matchflag && (i < 20)) {
+				memcpy(&this->bss_set[i].beacon_period,
+				       &sig.beacon_period, 73);
+				this->bss_cnt++;
+				this->rssi = sig.rssi;
+			}
+		}
+	} else if (sig.status == WL3501_STATUS_TIMEOUT) {
+		dprintk(3, "timeout");
+		this->join_sta_bss = 0;
+		for (i = this->join_sta_bss; i < this->bss_cnt; i++)
+			if (!wl3501_mgmt_join(this, i))
+				break;
+		this->join_sta_bss = i;
+		if (this->join_sta_bss == this->bss_cnt) {
+			if (this->net_type == IW_MODE_INFRA)
+				wl3501_mgmt_scan(this, 100);
+			else {
+				this->adhoc_times++;
+				if (this->adhoc_times > WL3501_MAX_ADHOC_TRIES)
+					wl3501_mgmt_start(this);
+				else
+					wl3501_mgmt_scan(this, 100);
+			}
+		}
+	}
+}
+
+/**
+ * wl3501_block_interrupt - Mask interrupt from SUTRO
+ * @this - card
+ *
+ * Mask interrupt from SUTRO. (i.e. SUTRO cannot interrupt the HOST)
+ * Return: 1 if interrupt is originally enabled
+ */
+static int wl3501_block_interrupt(struct wl3501_card *this)
+{
+	u8 old = inb(this->base_addr + WL3501_NIC_GCR);
+	u8 new = old & (~(WL3501_GCR_ECINT | WL3501_GCR_INT2EC |
+			WL3501_GCR_ENECINT));
+
+	wl3501_outb(new, this->base_addr + WL3501_NIC_GCR);
+	return old & WL3501_GCR_ENECINT;
+}
+
+/**
+ * wl3501_unblock_interrupt - Enable interrupt from SUTRO
+ * @this - card
+ *
+ * Enable interrupt from SUTRO. (i.e. SUTRO can interrupt the HOST)
+ * Return: 1 if interrupt is originally enabled
+ */
+static int wl3501_unblock_interrupt(struct wl3501_card *this)
+{
+	u8 old = inb(this->base_addr + WL3501_NIC_GCR);
+	u8 new = (old & ~(WL3501_GCR_ECINT | WL3501_GCR_INT2EC)) |
+		  WL3501_GCR_ENECINT;
+
+	wl3501_outb(new, this->base_addr + WL3501_NIC_GCR);
+	return old & WL3501_GCR_ENECINT;
+}
+
+/**
+ * wl3501_receive - Receive data from Receive Queue.
+ *
+ * Receive data from Receive Queue.
+ *
+ * @this: card
+ * @bf: address of host
+ * @size: size of buffer.
+ */
+static u16 wl3501_receive(struct wl3501_card *this, u8 *bf, u16 size)
+{
+	u16 next_addr, next_addr1;
+	u8 *data = bf + 12;
+
+	size -= 12;
+	wl3501_get_from_wla(this, this->start_seg + 2,
+			    &next_addr, sizeof(next_addr));
+	if (size > WL3501_BLKSZ - sizeof(struct wl3501_rx_hdr)) {
+		wl3501_get_from_wla(this,
+				    this->start_seg +
+					sizeof(struct wl3501_rx_hdr), data,
+				    WL3501_BLKSZ -
+					sizeof(struct wl3501_rx_hdr));
+		size -= WL3501_BLKSZ - sizeof(struct wl3501_rx_hdr);
+		data += WL3501_BLKSZ - sizeof(struct wl3501_rx_hdr);
+	} else {
+		wl3501_get_from_wla(this,
+				    this->start_seg +
+					sizeof(struct wl3501_rx_hdr),
+				    data, size);
+		size = 0;
+	}
+	while (size > 0) {
+		if (size > WL3501_BLKSZ - 5) {
+			wl3501_get_from_wla(this, next_addr + 5, data,
+					    WL3501_BLKSZ - 5);
+			size -= WL3501_BLKSZ - 5;
+			data += WL3501_BLKSZ - 5;
+			wl3501_get_from_wla(this, next_addr + 2, &next_addr1,
+					    sizeof(next_addr1));
+			next_addr = next_addr1;
+		} else {
+			wl3501_get_from_wla(this, next_addr + 5, data, size);
+			size = 0;
+		}
+	}
+	return 0;
+}
+
+static void wl3501_esbq_req_free(struct wl3501_card *this)
+{
+	u8 tmp;
+	u16 addr;
+
+	if (this->esbq_req_head == this->esbq_req_tail)
+		goto out;
+	wl3501_get_from_wla(this, this->esbq_req_tail + 3, &tmp, sizeof(tmp));
+	if (!(tmp & 0x80))
+		goto out;
+	wl3501_get_from_wla(this, this->esbq_req_tail, &addr, sizeof(addr));
+	wl3501_free_tx_buffer(this, addr);
+	this->esbq_req_tail += 4;
+	if (this->esbq_req_tail >= this->esbq_req_end)
+		this->esbq_req_tail = this->esbq_req_start;
+out:
+	return;
+}
+
+static int wl3501_esbq_confirm(struct wl3501_card *this)
+{
+	u8 tmp;
+
+	wl3501_get_from_wla(this, this->esbq_confirm + 3, &tmp, sizeof(tmp));
+	return tmp & 0x80;
+}
+
+static void wl3501_online(struct net_device *dev)
+{
+	struct wl3501_card *this = dev->priv;
+
+	printk(KERN_INFO "%s: Wireless LAN online. BSSID: "
+	       "%02X %02X %02X %02X %02X %02X\n", dev->name,
+	       this->bssid[0], this->bssid[1], this->bssid[2],
+	       this->bssid[3], this->bssid[4], this->bssid[5]);
+	netif_wake_queue(dev);
+}
+
+static void wl3501_esbq_confirm_done(struct wl3501_card *this)
+{
+	u8 tmp = 0;
+
+	wl3501_set_to_wla(this, this->esbq_confirm + 3, &tmp, sizeof(tmp));
+	this->esbq_confirm += 4;
+	if (this->esbq_confirm >= this->esbq_confirm_end)
+		this->esbq_confirm = this->esbq_confirm_start;
+}
+
+static int wl3501_mgmt_auth(struct wl3501_card *this)
+{
+	struct wl3501_auth_req sig = {
+		.sig_id	 = WL3501_SIG_AUTH_REQ,
+		.type	 = WL3501_SYS_TYPE_OPEN,
+		.timeout = 1000,
+	};
+
+	dprintk(3, "entry");
+	memcpy(sig.mac_addr, this->bssid, ETH_ALEN);
+	return wl3501_esbq_exec(this, &sig, sizeof(sig));
+}
+
+static int wl3501_mgmt_association(struct wl3501_card *this)
+{
+	struct wl3501_assoc_req sig = {
+		.sig_id		 = WL3501_SIG_ASSOC_REQ,
+		.timeout	 = 1000,
+		.listen_interval = 5,
+		.cap_info	 = this->cap_info,
+	};
+
+	dprintk(3, "entry");
+	memcpy(sig.mac_addr, this->bssid, ETH_ALEN);
+	return wl3501_esbq_exec(this, &sig, sizeof(sig));
+}
+
+static void wl3501_mgmt_join_confirm(struct net_device *dev, u16 addr)
+{
+	struct wl3501_card *this = dev->priv;
+	struct wl3501_join_confirm sig;
+
+	dprintk(3, "entry");
+	wl3501_get_from_wla(this, addr, &sig, sizeof(sig));
+	if (sig.status == WL3501_STATUS_SUCCESS) {
+		if (this->net_type == IW_MODE_INFRA) {
+			if (this->join_sta_bss < this->bss_cnt) {
+				const int i = this->join_sta_bss;
+				memcpy(this->bssid,
+				       this->bss_set[i].bssid, ETH_ALEN);
+				this->chan = this->bss_set[i].ds_pset.chan;
+				iw_copy_mgmt_info_element(&this->keep_essid.el,
+						     &this->bss_set[i].ssid.el);
+				wl3501_mgmt_auth(this);
+			}
+		} else {
+			const int i = this->join_sta_bss;
+
+			memcpy(&this->bssid, &this->bss_set[i].bssid, ETH_ALEN);
+			this->chan = this->bss_set[i].ds_pset.chan;
+			iw_copy_mgmt_info_element(&this->keep_essid.el,
+						  &this->bss_set[i].ssid.el);
+			wl3501_online(dev);
+		}
+	} else {
+		int i;
+		this->join_sta_bss++;
+		for (i = this->join_sta_bss; i < this->bss_cnt; i++)
+			if (!wl3501_mgmt_join(this, i))
+				break;
+		this->join_sta_bss = i;
+		if (this->join_sta_bss == this->bss_cnt) {
+			if (this->net_type == IW_MODE_INFRA)
+				wl3501_mgmt_scan(this, 100);
+			else {
+				this->adhoc_times++;
+				if (this->adhoc_times > WL3501_MAX_ADHOC_TRIES)
+					wl3501_mgmt_start(this);
+				else
+					wl3501_mgmt_scan(this, 100);
+			}
+		}
+	}
+}
+
+static inline void wl3501_alarm_interrupt(struct net_device *dev,
+					  struct wl3501_card *this)
+{
+	if (this->net_type == IW_MODE_INFRA) {
+		printk(KERN_INFO "Wireless LAN offline\n");
+		netif_stop_queue(dev);
+		wl3501_mgmt_resync(this);
+	}
+}
+
+static inline void wl3501_md_confirm_interrupt(struct net_device *dev,
+					       struct wl3501_card *this,
+					       u16 addr)
+{
+	struct wl3501_md_confirm sig;
+
+	dprintk(3, "entry");
+	wl3501_get_from_wla(this, addr, &sig, sizeof(sig));
+	wl3501_free_tx_buffer(this, sig.data);
+	if (netif_queue_stopped(dev))
+		netif_wake_queue(dev);
+}
+
+static inline void wl3501_md_ind_interrupt(struct net_device *dev,
+					   struct wl3501_card *this, u16 addr)
+{
+	struct wl3501_md_ind sig;
+	struct sk_buff *skb;
+	u8 rssi, addr4[ETH_ALEN];
+	u16 pkt_len;
+
+	wl3501_get_from_wla(this, addr, &sig, sizeof(sig));
+	this->start_seg = sig.data;
+	wl3501_get_from_wla(this,
+			    sig.data + offsetof(struct wl3501_rx_hdr, rssi),
+			    &rssi, sizeof(rssi));
+	this->rssi = rssi <= 63 ? (rssi * 100) / 64 : 255;
+
+	wl3501_get_from_wla(this,
+			    sig.data +
+				offsetof(struct wl3501_rx_hdr, addr4),
+			    &addr4, sizeof(addr4));
+	if (!(addr4[0] == 0xAA && addr4[1] == 0xAA &&
+	      addr4[2] == 0x03 && addr4[4] == 0x00)) {
+		printk(KERN_INFO "Insupported packet type!\n");
+		return;
+	}
+	pkt_len = sig.size + 12 - 24 - 4 - 6;
+
+	skb = dev_alloc_skb(pkt_len + 5);
+
+	if (!skb) {
+		printk(KERN_WARNING "%s: Can't alloc a sk_buff of size %d.\n",
+		       dev->name, pkt_len);
+		this->stats.rx_dropped++;
+	} else {
+		skb->dev = dev;
+		skb_reserve(skb, 2); /* IP headers on 16 bytes boundaries */
+		eth_copy_and_sum(skb, (unsigned char *)&sig.daddr, 12, 0);
+		wl3501_receive(this, skb->data, pkt_len);
+		skb_put(skb, pkt_len);
+		skb->protocol	= eth_type_trans(skb, dev);
+		dev->last_rx	= jiffies;
+		this->stats.rx_packets++;
+		this->stats.rx_bytes += skb->len;
+		netif_rx(skb);
+	}
+}
+
+static inline void wl3501_get_confirm_interrupt(struct wl3501_card *this,
+						u16 addr, void *sig, int size)
+{
+	dprintk(3, "entry");
+	wl3501_get_from_wla(this, addr, &this->sig_get_confirm,
+			    sizeof(this->sig_get_confirm));
+	wake_up(&this->wait);
+}
+
+static inline void wl3501_start_confirm_interrupt(struct net_device *dev,
+						  struct wl3501_card *this,
+						  u16 addr)
+{
+	struct wl3501_start_confirm sig;
+
+	dprintk(3, "entry");
+	wl3501_get_from_wla(this, addr, &sig, sizeof(sig));
+	if (sig.status == WL3501_STATUS_SUCCESS)
+		netif_wake_queue(dev);
+}
+
+static inline void wl3501_assoc_confirm_interrupt(struct net_device *dev,
+						  u16 addr)
+{
+	struct wl3501_card *this = dev->priv;
+	struct wl3501_assoc_confirm sig;
+
+	dprintk(3, "entry");
+	wl3501_get_from_wla(this, addr, &sig, sizeof(sig));
+
+	if (sig.status == WL3501_STATUS_SUCCESS)
+		wl3501_online(dev);
+}
+
+static inline void wl3501_auth_confirm_interrupt(struct wl3501_card *this,
+						 u16 addr)
+{
+	struct wl3501_auth_confirm sig;
+
+	dprintk(3, "entry");
+	wl3501_get_from_wla(this, addr, &sig, sizeof(sig));
+
+	if (sig.status == WL3501_STATUS_SUCCESS)
+		wl3501_mgmt_association(this);
+	else
+		wl3501_mgmt_resync(this);
+}
+
+static inline void wl3501_rx_interrupt(struct net_device *dev)
+{
+	int morepkts;
+	u16 addr;
+	u8 sig_id;
+	struct wl3501_card *this = dev->priv;
+
+	dprintk(3, "entry");
+loop:
+	morepkts = 0;
+	if (!wl3501_esbq_confirm(this))
+		goto free;
+	wl3501_get_from_wla(this, this->esbq_confirm, &addr, sizeof(addr));
+	wl3501_get_from_wla(this, addr + 2, &sig_id, sizeof(sig_id));
+
+	switch (sig_id) {
+	case WL3501_SIG_DEAUTH_IND:
+	case WL3501_SIG_DISASSOC_IND:
+	case WL3501_SIG_ALARM:
+		wl3501_alarm_interrupt(dev, this);
+		break;
+	case WL3501_SIG_MD_CONFIRM:
+		wl3501_md_confirm_interrupt(dev, this, addr);
+		break;
+	case WL3501_SIG_MD_IND:
+		wl3501_md_ind_interrupt(dev, this, addr);
+		break;
+	case WL3501_SIG_GET_CONFIRM:
+		wl3501_get_confirm_interrupt(this, addr,
+					     &this->sig_get_confirm,
+					     sizeof(this->sig_get_confirm));
+		break;
+	case WL3501_SIG_PWR_MGMT_CONFIRM:
+		wl3501_get_confirm_interrupt(this, addr,
+					     &this->sig_pwr_mgmt_confirm,
+					    sizeof(this->sig_pwr_mgmt_confirm));
+		break;
+	case WL3501_SIG_START_CONFIRM:
+		wl3501_start_confirm_interrupt(dev, this, addr);
+		break;
+	case WL3501_SIG_SCAN_CONFIRM:
+		wl3501_mgmt_scan_confirm(this, addr);
+		break;
+	case WL3501_SIG_JOIN_CONFIRM:
+		wl3501_mgmt_join_confirm(dev, addr);
+		break;
+	case WL3501_SIG_ASSOC_CONFIRM:
+		wl3501_assoc_confirm_interrupt(dev, addr);
+		break;
+	case WL3501_SIG_AUTH_CONFIRM:
+		wl3501_auth_confirm_interrupt(this, addr);
+		break;
+	case WL3501_SIG_RESYNC_CONFIRM:
+		wl3501_mgmt_resync(this); /* FIXME: should be resync_confirm */
+		break;
+	}
+	wl3501_esbq_confirm_done(this);
+	morepkts = 1;
+	/* free request if necessary */
+free:
+	wl3501_esbq_req_free(this);
+	if (morepkts)
+		goto loop;
+}
+
+static inline void wl3501_ack_interrupt(struct wl3501_card *this)
+{
+	wl3501_outb(WL3501_GCR_ECINT, this->base_addr + WL3501_NIC_GCR);
+}
+
+/**
+ * wl3501_interrupt - Hardware interrupt from card.
+ * @irq - Interrupt number
+ * @dev_id - net_device
+ * @regs - registers
+ *
+ * We must acknowledge the interrupt as soon as possible, and block the
+ * interrupt from the same card immediately to prevent re-entry.
+ *
+ * Before accessing the Control_Status_Block, we must lock SUTRO first.
+ * On the other hand, to prevent SUTRO from malfunctioning, we must
+ * unlock the SUTRO as soon as possible.
+ */
+static irqreturn_t wl3501_interrupt(int irq, void *dev_id, struct pt_regs *regs)
+{
+	struct net_device *dev = (struct net_device *)dev_id;
+	struct wl3501_card *this;
+	int handled = 1;
+
+	if (!dev)
+		goto unknown;
+	this = dev->priv;
+	spin_lock(&this->lock);
+	wl3501_ack_interrupt(this);
+	wl3501_block_interrupt(this);
+	wl3501_rx_interrupt(dev);
+	wl3501_unblock_interrupt(this);
+	spin_unlock(&this->lock);
+out:
+	return IRQ_RETVAL(handled);
+unknown:
+	handled = 0;
+	printk(KERN_ERR "%s: irq %d for unknown device.\n", __FUNCTION__, irq);
+	goto out;
+}
+
+static int wl3501_reset_board(struct wl3501_card *this)
+{
+	u8 tmp = 0;
+	int i, rc = 0;
+
+	/* Coreset */
+	wl3501_outb_p(WL3501_GCR_CORESET, this->base_addr + WL3501_NIC_GCR);
+	wl3501_outb_p(0, this->base_addr + WL3501_NIC_GCR);
+	wl3501_outb_p(WL3501_GCR_CORESET, this->base_addr + WL3501_NIC_GCR);
+
+	/* Reset SRAM 0x480 to zero */
+	wl3501_set_to_wla(this, 0x480, &tmp, sizeof(tmp));
+
+	/* Start up */
+	wl3501_outb_p(0, this->base_addr + WL3501_NIC_GCR);
+
+	WL3501_NOPLOOP(1024 * 50);
+
+	wl3501_unblock_interrupt(this);	/* acme: was commented */
+
+	/* Polling Self_Test_Status */
+	for (i = 0; i < 10000; i++) {
+		wl3501_get_from_wla(this, 0x480, &tmp, sizeof(tmp));
+
+		if (tmp == 'W') {
+			/* firmware complete all test successfully */
+			tmp = 'A';
+			wl3501_set_to_wla(this, 0x480, &tmp, sizeof(tmp));
+			goto out;
+		}
+		WL3501_NOPLOOP(10);
+	}
+	printk(KERN_WARNING "%s: failed to reset the board!\n", __FUNCTION__);
+	rc = -ENODEV;
+out:
+	return rc;
+}
+
+static int wl3501_init_firmware(struct wl3501_card *this)
+{
+	u16 ptr, next;
+	int rc = wl3501_reset_board(this);
+
+	if (rc)
+		goto fail;
+	this->card_name[0] = '\0';
+	wl3501_get_from_wla(this, 0x1a00,
+			    this->card_name, sizeof(this->card_name));
+	this->card_name[sizeof(this->card_name) - 1] = '\0';
+	this->firmware_date[0] = '\0';
+	wl3501_get_from_wla(this, 0x1a40,
+			    this->firmware_date, sizeof(this->firmware_date));
+	this->firmware_date[sizeof(this->firmware_date) - 1] = '\0';
+	/* Switch to SRAM Page 0 */
+	wl3501_switch_page(this, WL3501_BSS_SPAGE0);
+	/* Read parameter from card */
+	wl3501_get_from_wla(this, 0x482, &this->esbq_req_start, 2);
+	wl3501_get_from_wla(this, 0x486, &this->esbq_req_end, 2);
+	wl3501_get_from_wla(this, 0x488, &this->esbq_confirm_start, 2);
+	wl3501_get_from_wla(this, 0x48c, &this->esbq_confirm_end, 2);
+	wl3501_get_from_wla(this, 0x48e, &this->tx_buffer_head, 2);
+	wl3501_get_from_wla(this, 0x492, &this->tx_buffer_size, 2);
+	this->esbq_req_tail	= this->esbq_req_head = this->esbq_req_start;
+	this->esbq_req_end     += this->esbq_req_start;
+	this->esbq_confirm	= this->esbq_confirm_start;
+	this->esbq_confirm_end += this->esbq_confirm_start;
+	/* Initial Tx Buffer */
+	this->tx_buffer_cnt = 1;
+	ptr = this->tx_buffer_head;
+	next = ptr + WL3501_BLKSZ;
+	while ((next - this->tx_buffer_head) < this->tx_buffer_size) {
+		this->tx_buffer_cnt++;
+		wl3501_set_to_wla(this, ptr, &next, sizeof(next));
+		ptr = next;
+		next = ptr + WL3501_BLKSZ;
+	}
+	rc = 0;
+	next = 0;
+	wl3501_set_to_wla(this, ptr, &next, sizeof(next));
+	this->tx_buffer_tail = ptr;
+out:
+	return rc;
+fail:
+	printk(KERN_WARNING "%s: failed!\n", __FUNCTION__);
+	goto out;
+}
+
+static int wl3501_close(struct net_device *dev)
+{
+	struct wl3501_card *this = dev->priv;
+	int rc = -ENODEV;
+	unsigned long flags;
+	dev_link_t *link;
+
+	spin_lock_irqsave(&this->lock, flags);
+	/* Check if the device is in wl3501_dev_list */
+	for (link = wl3501_dev_list; link; link = link->next)
+		if (link->priv == dev)
+			break;
+	if (!link)
+		goto out;
+	link->open--;
+
+	/* Stop wl3501_hard_start_xmit() from now on */
+	netif_stop_queue(dev);
+	wl3501_ack_interrupt(this);
+
+	/* Mask interrupts from the SUTRO */
+	wl3501_block_interrupt(this);
+
+	rc = 0;
+	printk(KERN_INFO "%s: WL3501 closed\n", dev->name);
+out:
+	spin_unlock_irqrestore(&this->lock, flags);
+	return rc;
+}
+
+/**
+ * wl3501_reset - Reset the SUTRO.
+ * @dev - network device
+ *
+ * It is almost the same as wl3501_open(). In fact, we may just wl3501_close()
+ * and wl3501_open() again, but I wouldn't like to free_irq() when the driver
+ * is running. It seems to be dangerous.
+ */
+static int wl3501_reset(struct net_device *dev)
+{
+	struct wl3501_card *this = dev->priv;
+	int rc = -ENODEV;
+
+	wl3501_block_interrupt(this);
+
+	if (wl3501_init_firmware(this)) {
+		printk(KERN_WARNING "%s: Can't initialize Firmware!\n",
+		       dev->name);
+		/* Free IRQ, and mark IRQ as unused */
+		free_irq(dev->irq, dev);
+		goto out;
+	}
+
+	/*
+	 * Queue has to be started only when the Card is Started
+	 */
+	netif_stop_queue(dev);
+	this->adhoc_times = 0;
+	wl3501_ack_interrupt(this);
+	wl3501_unblock_interrupt(this);
+	wl3501_mgmt_scan(this, 100);
+	dprintk(1, "%s: device reset", dev->name);
+	rc = 0;
+out:
+	return rc;
+}
+
+static void wl3501_tx_timeout(struct net_device *dev)
+{
+	struct wl3501_card *this = dev->priv;
+	struct net_device_stats *stats = &this->stats;
+	unsigned long flags;
+	int rc;
+
+	stats->tx_errors++;
+	spin_lock_irqsave(&this->lock, flags);
+	rc = wl3501_reset(dev);
+	spin_unlock_irqrestore(&this->lock, flags);
+	if (rc)
+		printk(KERN_ERR "%s: Error %d resetting card on Tx timeout!\n",
+		       dev->name, rc);
+	else {
+		dev->trans_start = jiffies;
+		netif_wake_queue(dev);
+	}
+}
+
+/*
+ * Return : 0 - OK
+ *	    1 - Could not transmit (dev_queue_xmit will queue it)
+ *		and try to sent it later
+ */
+static int wl3501_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+	int enabled, rc;
+	struct wl3501_card *this = dev->priv;
+	unsigned long flags;
+
+	spin_lock_irqsave(&this->lock, flags);
+	enabled = wl3501_block_interrupt(this);
+	dev->trans_start = jiffies;
+	rc = wl3501_send_pkt(this, skb->data, skb->len);
+	if (enabled)
+		wl3501_unblock_interrupt(this);
+	if (rc) {
+		++this->stats.tx_dropped;
+		netif_stop_queue(dev);
+	} else {
+		++this->stats.tx_packets;
+		this->stats.tx_bytes += skb->len;
+		kfree_skb(skb);
+
+		if (this->tx_buffer_cnt < 2)
+			netif_stop_queue(dev);
+	}
+	spin_unlock_irqrestore(&this->lock, flags);
+	return rc;
+}
+
+static int wl3501_open(struct net_device *dev)
+{
+	int rc = -ENODEV;
+	struct wl3501_card *this = dev->priv;
+	unsigned long flags;
+	dev_link_t *link;
+
+	spin_lock_irqsave(&this->lock, flags);
+	/* Check if the device is in wl3501_dev_list */
+	for (link = wl3501_dev_list; link; link = link->next)
+		if (link->priv == dev)
+			break;
+	if (!DEV_OK(link))
+		goto out;
+	netif_device_attach(dev);
+	link->open++;
+
+	/* Initial WL3501 firmware */
+	dprintk(1, "%s: Initialize WL3501 firmware...", dev->name);
+	if (wl3501_init_firmware(this))
+		goto fail;
+	/* Initial device variables */
+	this->adhoc_times = 0;
+	/* Acknowledge Interrupt, for cleaning last state */
+	wl3501_ack_interrupt(this);
+
+	/* Enable interrupt from card after all */
+	wl3501_unblock_interrupt(this);
+	wl3501_mgmt_scan(this, 100);
+	rc = 0;
+	dprintk(1, "%s: WL3501 opened", dev->name);
+	printk(KERN_INFO "%s: Card Name: %s\n"
+			 "%s: Firmware Date: %s\n",
+			 dev->name, this->card_name,
+			 dev->name, this->firmware_date);
+out:
+	spin_unlock_irqrestore(&this->lock, flags);
+	return rc;
+fail:
+	printk(KERN_WARNING "%s: Can't initialize firmware!\n", dev->name);
+	goto out;
+}
+
+struct net_device_stats *wl3501_get_stats(struct net_device *dev)
+{
+	struct wl3501_card *this = dev->priv;
+
+	return &this->stats;
+}
+
+struct iw_statistics *wl3501_get_wireless_stats(struct net_device *dev)
+{
+	struct wl3501_card *this = dev->priv;
+	struct iw_statistics *wstats = &this->wstats;
+	u32 value; /* size checked: it is u32 */
+
+	memset(wstats, 0, sizeof(*wstats));
+	wstats->status = netif_running(dev);
+	if (!wl3501_get_mib_value(this, WL3501_MIB_ATTR_WEP_ICV_ERROR_COUNT,
+				  &value, sizeof(value)))
+		wstats->discard.code += value;
+	if (!wl3501_get_mib_value(this, WL3501_MIB_ATTR_WEP_UNDECRYPTABLE_COUNT,
+				  &value, sizeof(value)))
+		wstats->discard.code += value;
+	if (!wl3501_get_mib_value(this, WL3501_MIB_ATTR_WEP_EXCLUDED_COUNT,
+				  &value, sizeof(value)))
+		wstats->discard.code += value;
+	if (!wl3501_get_mib_value(this, WL3501_MIB_ATTR_RETRY_COUNT,
+				  &value, sizeof(value)))
+		wstats->discard.retries	= value;
+	if (!wl3501_get_mib_value(this, WL3501_MIB_ATTR_FAILED_COUNT,
+				  &value, sizeof(value)))
+		wstats->discard.misc += value;
+	if (!wl3501_get_mib_value(this, WL3501_MIB_ATTR_RTS_FAILURE_COUNT,
+				  &value, sizeof(value)))
+		wstats->discard.misc += value;
+	if (!wl3501_get_mib_value(this, WL3501_MIB_ATTR_ACK_FAILURE_COUNT,
+				  &value, sizeof(value)))
+		wstats->discard.misc += value;
+	if (!wl3501_get_mib_value(this, WL3501_MIB_ATTR_FRAME_DUPLICATE_COUNT,
+				  &value, sizeof(value)))
+		wstats->discard.misc += value;
+	return wstats;
+}
+
+static void wl3501_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info)
+{
+	strlcpy(info->driver, wl3501_dev_info, sizeof(info->driver));
+}
+
+static struct ethtool_ops ops = {
+	.get_drvinfo = wl3501_get_drvinfo
+};
+
+/**
+ * wl3501_detach - deletes a driver "instance"
+ * @link - FILL_IN
+ *
+ * This deletes a driver "instance". The device is de-registered with Card
+ * Services. If it has been released, all local data structures are freed.
+ * Otherwise, the structures will be freed when the device is released.
+ */
+static void wl3501_detach(dev_link_t *link)
+{
+	dev_link_t **linkp;
+
+	/* Locate device structure */
+	for (linkp = &wl3501_dev_list; *linkp; linkp = &(*linkp)->next)
+		if (*linkp == link)
+			break;
+	if (!*linkp)
+		goto out;
+
+	/* If the device is currently configured and active, we won't actually
+	 * delete it yet.  Instead, it is marked so that when the release()
+	 * function is called, that will trigger a proper detach(). */
+
+	if (link->state & DEV_CONFIG) {
+#ifdef PCMCIA_DEBUG
+		printk(KERN_DEBUG "wl3501_cs: detach postponed, '%s' "
+		       "still locked\n", link->dev->dev_name);
+#endif
+		goto out;
+	}
+
+	/* Break the link with Card Services */
+	if (link->handle)
+		pcmcia_deregister_client(link->handle);
+
+	/* Unlink device structure, free pieces */
+	*linkp = link->next;
+
+	if (link->priv)
+		free_netdev(link->priv);
+	kfree(link);
+out:
+	return;
+}
+
+static int wl3501_get_name(struct net_device *dev, struct iw_request_info *info,
+			   union iwreq_data *wrqu, char *extra)
+{
+	strlcpy(wrqu->name, "IEEE 802.11-DS", sizeof(wrqu->name));
+	return 0;
+}
+
+static int wl3501_set_freq(struct net_device *dev, struct iw_request_info *info,
+			   union iwreq_data *wrqu, char *extra)
+{
+	struct wl3501_card *this = dev->priv;
+	int channel = wrqu->freq.m;
+	int rc = -EINVAL;
+
+	if (iw_valid_channel(this->reg_domain, channel)) {
+		this->chan = channel;
+		rc = wl3501_reset(dev);
+	}
+	return rc;
+}
+
+static int wl3501_get_freq(struct net_device *dev, struct iw_request_info *info,
+			   union iwreq_data *wrqu, char *extra)
+{
+	struct wl3501_card *this = dev->priv;
+
+	wrqu->freq.m = wl3501_chan2freq[this->chan - 1] * 100000;
+	wrqu->freq.e = 1;
+	return 0;
+}
+
+static int wl3501_set_mode(struct net_device *dev, struct iw_request_info *info,
+			   union iwreq_data *wrqu, char *extra)
+{
+	int rc = -EINVAL;
+
+	if (wrqu->mode == IW_MODE_INFRA ||
+	    wrqu->mode == IW_MODE_ADHOC ||
+	    wrqu->mode == IW_MODE_AUTO) {
+		struct wl3501_card *this = dev->priv;
+
+		this->net_type = wrqu->mode;
+		rc = wl3501_reset(dev);
+	}
+	return rc;
+}
+
+static int wl3501_get_mode(struct net_device *dev, struct iw_request_info *info,
+			   union iwreq_data *wrqu, char *extra)
+{
+	struct wl3501_card *this = dev->priv;
+
+	wrqu->mode = this->net_type;
+	return 0;
+}
+
+static int wl3501_get_sens(struct net_device *dev, struct iw_request_info *info,
+			   union iwreq_data *wrqu, char *extra)
+{
+	struct wl3501_card *this = dev->priv;
+
+	wrqu->sens.value = this->rssi;
+	wrqu->sens.disabled = !wrqu->sens.value;
+	wrqu->sens.fixed = 1;
+	return 0;
+}
+
+static int wl3501_get_range(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu, char *extra)
+{
+	struct iw_range *range = (struct iw_range *)extra;
+
+	/* Set the length (very important for backward compatibility) */
+	wrqu->data.length = sizeof(*range);
+
+	/* Set all the info we don't care or don't know about to zero */
+	memset(range, 0, sizeof(*range));
+
+	/* Set the Wireless Extension versions */
+	range->we_version_compiled	= WIRELESS_EXT;
+	range->we_version_source	= 1;
+	range->throughput		= 2 * 1000 * 1000;     /* ~2 Mb/s */
+	/* FIXME: study the code to fill in more fields... */
+	return 0;
+}
+
+static int wl3501_set_wap(struct net_device *dev, struct iw_request_info *info,
+			  union iwreq_data *wrqu, char *extra)
+{
+	struct wl3501_card *this = dev->priv;
+	static const u8 bcast[ETH_ALEN] = { 255, 255, 255, 255, 255, 255 };
+	int rc = -EINVAL;
+
+	/* FIXME: we support other ARPHRDs...*/
+	if (wrqu->ap_addr.sa_family != ARPHRD_ETHER)
+		goto out;
+	if (!memcmp(bcast, wrqu->ap_addr.sa_data, ETH_ALEN)) {
+		/* FIXME: rescan? */
+	} else
+		memcpy(this->bssid, wrqu->ap_addr.sa_data, ETH_ALEN);
+		/* FIXME: rescan? deassoc & scan? */
+	rc = 0;
+out:
+	return rc;
+}
+
+static int wl3501_get_wap(struct net_device *dev, struct iw_request_info *info,
+			  union iwreq_data *wrqu, char *extra)
+{
+	struct wl3501_card *this = dev->priv;
+
+	wrqu->ap_addr.sa_family = ARPHRD_ETHER;
+	memcpy(wrqu->ap_addr.sa_data, this->bssid, ETH_ALEN);
+	return 0;
+}
+
+static int wl3501_set_scan(struct net_device *dev, struct iw_request_info *info,
+			   union iwreq_data *wrqu, char *extra)
+{
+	/*
+	 * FIXME: trigger scanning with a reset, yes, I'm lazy
+	 */
+	return wl3501_reset(dev);
+}
+
+static int wl3501_get_scan(struct net_device *dev, struct iw_request_info *info,
+			   union iwreq_data *wrqu, char *extra)
+{
+	struct wl3501_card *this = dev->priv;
+	int i;
+	char *current_ev = extra;
+	struct iw_event iwe;
+
+	for (i = 0; i < this->bss_cnt; ++i) {
+		iwe.cmd			= SIOCGIWAP;
+		iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
+		memcpy(iwe.u.ap_addr.sa_data, this->bss_set[i].bssid, ETH_ALEN);
+		current_ev = iwe_stream_add_event(current_ev,
+						  extra + IW_SCAN_MAX_DATA,
+						  &iwe, IW_EV_ADDR_LEN);
+		iwe.cmd		  = SIOCGIWESSID;
+		iwe.u.data.flags  = 1;
+		iwe.u.data.length = this->bss_set[i].ssid.el.len;
+		current_ev = iwe_stream_add_point(current_ev,
+						  extra + IW_SCAN_MAX_DATA,
+						  &iwe,
+						  this->bss_set[i].ssid.essid);
+		iwe.cmd	   = SIOCGIWMODE;
+		iwe.u.mode = this->bss_set[i].bss_type;
+		current_ev = iwe_stream_add_event(current_ev,
+						  extra + IW_SCAN_MAX_DATA,
+						  &iwe, IW_EV_UINT_LEN);
+		iwe.cmd = SIOCGIWFREQ;
+		iwe.u.freq.m = this->bss_set[i].ds_pset.chan;
+		iwe.u.freq.e = 0;
+		current_ev = iwe_stream_add_event(current_ev,
+						  extra + IW_SCAN_MAX_DATA,
+						  &iwe, IW_EV_FREQ_LEN);
+		iwe.cmd = SIOCGIWENCODE;
+		if (this->bss_set[i].cap_info & WL3501_MGMT_CAPABILITY_PRIVACY)
+			iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
+		else
+			iwe.u.data.flags = IW_ENCODE_DISABLED;
+		iwe.u.data.length = 0;
+		current_ev = iwe_stream_add_point(current_ev,
+						  extra + IW_SCAN_MAX_DATA,
+						  &iwe, NULL);
+	}
+	/* Length of data */
+	wrqu->data.length = (current_ev - extra);
+	wrqu->data.flags = 0; /* FIXME: set properly these flags */
+	return 0;
+}
+
+static int wl3501_set_essid(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu, char *extra)
+{
+	struct wl3501_card *this = dev->priv;
+
+	if (wrqu->data.flags) {
+		iw_set_mgmt_info_element(IW_MGMT_INFO_ELEMENT_SSID,
+					 &this->essid.el,
+					 extra, wrqu->data.length);
+	} else { /* We accept any ESSID */
+		iw_set_mgmt_info_element(IW_MGMT_INFO_ELEMENT_SSID,
+					 &this->essid.el, "ANY", 3);
+	}
+	return wl3501_reset(dev);
+}
+
+static int wl3501_get_essid(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu, char *extra)
+{
+	struct wl3501_card *this = dev->priv;
+	unsigned long flags;
+
+	spin_lock_irqsave(&this->lock, flags);
+	wrqu->essid.flags  = 1;
+	wrqu->essid.length = this->essid.el.len;
+	memcpy(extra, this->essid.essid, this->essid.el.len);
+	spin_unlock_irqrestore(&this->lock, flags);
+	return 0;
+}
+
+static int wl3501_set_nick(struct net_device *dev, struct iw_request_info *info,
+			   union iwreq_data *wrqu, char *extra)
+{
+	struct wl3501_card *this = dev->priv;
+
+	if (wrqu->data.length > sizeof(this->nick))
+		return -E2BIG;
+	strlcpy(this->nick, extra, wrqu->data.length);
+	return 0;
+}
+
+static int wl3501_get_nick(struct net_device *dev, struct iw_request_info *info,
+			   union iwreq_data *wrqu, char *extra)
+{
+	struct wl3501_card *this = dev->priv;
+
+	strlcpy(extra, this->nick, 32);
+	wrqu->data.length = strlen(extra);
+	return 0;
+}
+
+static int wl3501_get_rate(struct net_device *dev, struct iw_request_info *info,
+			   union iwreq_data *wrqu, char *extra)
+{
+	/*
+	 * FIXME: have to see from where to get this info, perhaps this card
+	 * works at 1 Mbit/s too... for now leave at 2 Mbit/s that is the most
+	 * common with the Planet Access Points. -acme
+	 */
+	wrqu->bitrate.value = 2000000;
+	wrqu->bitrate.fixed = 1;
+	return 0;
+}
+
+static int wl3501_get_rts_threshold(struct net_device *dev,
+				    struct iw_request_info *info,
+				    union iwreq_data *wrqu, char *extra)
+{
+	u16 threshold; /* size checked: it is u16 */
+	struct wl3501_card *this = dev->priv;
+	int rc = wl3501_get_mib_value(this, WL3501_MIB_ATTR_RTS_THRESHOLD,
+				      &threshold, sizeof(threshold));
+	if (!rc) {
+		wrqu->rts.value = threshold;
+		wrqu->rts.disabled = threshold >= 2347;
+		wrqu->rts.fixed = 1;
+	}
+	return rc;
+}
+
+static int wl3501_get_frag_threshold(struct net_device *dev,
+				     struct iw_request_info *info,
+				     union iwreq_data *wrqu, char *extra)
+{
+	u16 threshold; /* size checked: it is u16 */
+	struct wl3501_card *this = dev->priv;
+	int rc = wl3501_get_mib_value(this, WL3501_MIB_ATTR_FRAG_THRESHOLD,
+				      &threshold, sizeof(threshold));
+	if (!rc) {
+		wrqu->frag.value = threshold;
+		wrqu->frag.disabled = threshold >= 2346;
+		wrqu->frag.fixed = 1;
+	}
+	return rc;
+}
+
+static int wl3501_get_txpow(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu, char *extra)
+{
+	u16 txpow;
+	struct wl3501_card *this = dev->priv;
+	int rc = wl3501_get_mib_value(this,
+				      WL3501_MIB_ATTR_CURRENT_TX_PWR_LEVEL,
+				      &txpow, sizeof(txpow));
+	if (!rc) {
+		wrqu->txpower.value = txpow;
+		wrqu->txpower.disabled = 0;
+		/*
+		 * From the MIB values I think this can be configurable,
+		 * as it lists several tx power levels -acme
+		 */
+		wrqu->txpower.fixed = 0;
+		wrqu->txpower.flags = IW_TXPOW_MWATT;
+	}
+	return rc;
+}
+
+static int wl3501_get_retry(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu, char *extra)
+{
+	u8 retry; /* size checked: it is u8 */
+	struct wl3501_card *this = dev->priv;
+	int rc = wl3501_get_mib_value(this,
+				      WL3501_MIB_ATTR_LONG_RETRY_LIMIT,
+				      &retry, sizeof(retry));
+	if (rc)
+		goto out;
+	if (wrqu->retry.flags & IW_RETRY_MAX) {
+		wrqu->retry.flags = IW_RETRY_LIMIT | IW_RETRY_MAX;
+		goto set_value;
+	}
+	rc = wl3501_get_mib_value(this, WL3501_MIB_ATTR_SHORT_RETRY_LIMIT,
+				  &retry, sizeof(retry));
+	if (rc)
+		goto out;
+	wrqu->retry.flags = IW_RETRY_LIMIT | IW_RETRY_MIN;
+set_value:
+	wrqu->retry.value = retry;
+	wrqu->retry.disabled = 0;
+out:
+	return rc;
+}
+
+static int wl3501_get_encode(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	u8 implemented, restricted, keys[100], len_keys, tocopy;
+	struct wl3501_card *this = dev->priv;
+	int rc = wl3501_get_mib_value(this,
+				      WL3501_MIB_ATTR_PRIV_OPT_IMPLEMENTED,
+				      &implemented, sizeof(implemented));
+	if (rc)
+		goto out;
+	if (!implemented) {
+		wrqu->encoding.flags = IW_ENCODE_DISABLED;
+		goto out;
+	}
+	rc = wl3501_get_mib_value(this, WL3501_MIB_ATTR_EXCLUDE_UNENCRYPTED,
+				  &restricted, sizeof(restricted));
+	if (rc)
+		goto out;
+	wrqu->encoding.flags = restricted ? IW_ENCODE_RESTRICTED :
+					    IW_ENCODE_OPEN;
+	rc = wl3501_get_mib_value(this, WL3501_MIB_ATTR_WEP_KEY_MAPPINGS_LEN,
+				  &len_keys, sizeof(len_keys));
+	if (rc)
+		goto out;
+	rc = wl3501_get_mib_value(this, WL3501_MIB_ATTR_WEP_KEY_MAPPINGS,
+				  keys, len_keys);
+	if (rc)
+		goto out;
+	tocopy = min_t(u8, len_keys, wrqu->encoding.length);
+	tocopy = min_t(u8, tocopy, 100);
+	wrqu->encoding.length = tocopy;
+	memset(extra, 0, tocopy);
+	memcpy(extra, keys, tocopy);
+out:
+	return rc;
+}
+
+static int wl3501_get_power(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu, char *extra)
+{
+	u8 pwr_state;
+	struct wl3501_card *this = dev->priv;
+	int rc = wl3501_get_mib_value(this,
+				      WL3501_MIB_ATTR_CURRENT_PWR_STATE,
+				      &pwr_state, sizeof(pwr_state));
+	if (rc)
+		goto out;
+	wrqu->power.disabled = !pwr_state;
+	wrqu->power.flags = IW_POWER_ON;
+out:
+	return rc;
+}
+
+static const iw_handler	wl3501_handler[] = {
+	[SIOCGIWNAME	- SIOCIWFIRST] = wl3501_get_name,
+	[SIOCSIWFREQ	- SIOCIWFIRST] = wl3501_set_freq,
+	[SIOCGIWFREQ	- SIOCIWFIRST] = wl3501_get_freq,
+	[SIOCSIWMODE	- SIOCIWFIRST] = wl3501_set_mode,
+	[SIOCGIWMODE	- SIOCIWFIRST] = wl3501_get_mode,
+	[SIOCGIWSENS	- SIOCIWFIRST] = wl3501_get_sens,
+	[SIOCGIWRANGE	- SIOCIWFIRST] = wl3501_get_range,
+	[SIOCSIWSPY	- SIOCIWFIRST] = iw_handler_set_spy,
+	[SIOCGIWSPY	- SIOCIWFIRST] = iw_handler_get_spy,
+	[SIOCSIWTHRSPY	- SIOCIWFIRST] = iw_handler_set_thrspy,
+	[SIOCGIWTHRSPY	- SIOCIWFIRST] = iw_handler_get_thrspy,
+	[SIOCSIWAP	- SIOCIWFIRST] = wl3501_set_wap,
+	[SIOCGIWAP	- SIOCIWFIRST] = wl3501_get_wap,
+	[SIOCSIWSCAN	- SIOCIWFIRST] = wl3501_set_scan,
+	[SIOCGIWSCAN	- SIOCIWFIRST] = wl3501_get_scan,
+	[SIOCSIWESSID	- SIOCIWFIRST] = wl3501_set_essid,
+	[SIOCGIWESSID	- SIOCIWFIRST] = wl3501_get_essid,
+	[SIOCSIWNICKN	- SIOCIWFIRST] = wl3501_set_nick,
+	[SIOCGIWNICKN	- SIOCIWFIRST] = wl3501_get_nick,
+	[SIOCGIWRATE	- SIOCIWFIRST] = wl3501_get_rate,
+	[SIOCGIWRTS	- SIOCIWFIRST] = wl3501_get_rts_threshold,
+	[SIOCGIWFRAG	- SIOCIWFIRST] = wl3501_get_frag_threshold,
+	[SIOCGIWTXPOW	- SIOCIWFIRST] = wl3501_get_txpow,
+	[SIOCGIWRETRY	- SIOCIWFIRST] = wl3501_get_retry,
+	[SIOCGIWENCODE	- SIOCIWFIRST] = wl3501_get_encode,
+	[SIOCGIWPOWER	- SIOCIWFIRST] = wl3501_get_power,
+};
+
+static const struct iw_handler_def wl3501_handler_def = {
+	.num_standard	= sizeof(wl3501_handler) / sizeof(iw_handler),
+	.standard	= (iw_handler *)wl3501_handler,
+	.spy_offset	= offsetof(struct wl3501_card, spy_data),
+};
+
+/**
+ * wl3501_attach - creates an "instance" of the driver
+ *
+ * Creates an "instance" of the driver, allocating local data structures for
+ * one device.  The device is registered with Card Services.
+ *
+ * The dev_link structure is initialized, but we don't actually configure the
+ * card at this point -- we wait until we receive a card insertion event.
+ */
+static dev_link_t *wl3501_attach(void)
+{
+	client_reg_t client_reg;
+	dev_link_t *link;
+	struct net_device *dev;
+	int ret;
+
+	/* Initialize the dev_link_t structure */
+	link = kmalloc(sizeof(*link), GFP_KERNEL);
+	if (!link)
+		goto out;
+	memset(link, 0, sizeof(struct dev_link_t));
+
+	/* The io structure describes IO port mapping */
+	link->io.NumPorts1	= 16;
+	link->io.Attributes1	= IO_DATA_PATH_WIDTH_8;
+	link->io.IOAddrLines	= 5;
+
+	/* Interrupt setup */
+	link->irq.Attributes	= IRQ_TYPE_EXCLUSIVE | IRQ_HANDLE_PRESENT;
+	link->irq.IRQInfo1	= IRQ_LEVEL_ID;
+	link->irq.Handler = wl3501_interrupt;
+
+	/* General socket configuration */
+	link->conf.Attributes	= CONF_ENABLE_IRQ;
+	link->conf.Vcc		= 50;
+	link->conf.IntType	= INT_MEMORY_AND_IO;
+	link->conf.ConfigIndex	= 1;
+	link->conf.Present	= PRESENT_OPTION;
+
+	dev = alloc_etherdev(sizeof(struct wl3501_card));
+	if (!dev)
+		goto out_link;
+	dev->open		= wl3501_open;
+	dev->stop		= wl3501_close;
+	dev->hard_start_xmit	= wl3501_hard_start_xmit;
+	dev->tx_timeout		= wl3501_tx_timeout;
+	dev->watchdog_timeo	= 5 * HZ;
+	dev->get_stats		= wl3501_get_stats;
+	dev->get_wireless_stats = wl3501_get_wireless_stats;
+	dev->wireless_handlers	= (struct iw_handler_def *)&wl3501_handler_def;
+	SET_ETHTOOL_OPS(dev, &ops);
+	netif_stop_queue(dev);
+	link->priv = link->irq.Instance = dev;
+
+	/* Register with Card Services */
+	link->next		 = wl3501_dev_list;
+	wl3501_dev_list		 = link;
+	client_reg.dev_info	 = &wl3501_dev_info;
+	client_reg.EventMask	 = CS_EVENT_CARD_INSERTION |
+				   CS_EVENT_RESET_PHYSICAL |
+				   CS_EVENT_CARD_RESET |
+				   CS_EVENT_CARD_REMOVAL |
+				   CS_EVENT_PM_SUSPEND |
+				   CS_EVENT_PM_RESUME;
+	client_reg.event_handler = wl3501_event;
+	client_reg.Version	 = 0x0210;
+	client_reg.event_callback_args.client_data = link;
+	ret = pcmcia_register_client(&link->handle, &client_reg);
+	if (ret) {
+		cs_error(link->handle, RegisterClient, ret);
+		wl3501_detach(link);
+		link = NULL;
+	}
+out:
+	return link;
+out_link:
+	kfree(link);
+	link = NULL;
+	goto out;
+}
+
+#define CS_CHECK(fn, ret) \
+do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
+
+/**
+ * wl3501_config - configure the PCMCIA socket and make eth device available
+ * @link - FILL_IN
+ *
+ * wl3501_config() is scheduled to run after a CARD_INSERTION event is
+ * received, to configure the PCMCIA socket, and to make the ethernet device
+ * available to the system.
+ */
+static void wl3501_config(dev_link_t *link)
+{
+	tuple_t tuple;
+	cisparse_t parse;
+	client_handle_t handle = link->handle;
+	struct net_device *dev = link->priv;
+	int i = 0, j, last_fn, last_ret;
+	unsigned char bf[64];
+	struct wl3501_card *this;
+
+	/* This reads the card's CONFIG tuple to find its config registers. */
+	tuple.Attributes	= 0;
+	tuple.DesiredTuple	= CISTPL_CONFIG;
+	CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+	tuple.TupleData		= bf;
+	tuple.TupleDataMax	= sizeof(bf);
+	tuple.TupleOffset	= 0;
+	CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
+	CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+	link->conf.ConfigBase	= parse.config.base;
+	link->conf.Present	= parse.config.rmask[0];
+
+	/* Configure card */
+	link->state |= DEV_CONFIG;
+
+	/* Try allocating IO ports.  This tries a few fixed addresses.  If you
+	 * want, you can also read the card's config table to pick addresses --
+	 * see the serial driver for an example. */
+
+	for (j = 0x280; j < 0x400; j += 0x20) {
+		/* The '^0x300' is so that we probe 0x300-0x3ff first, then
+		 * 0x200-0x2ff, and so on, because this seems safer */
+		link->io.BasePort1 = j;
+		link->io.BasePort2 = link->io.BasePort1 + 0x10;
+		i = pcmcia_request_io(link->handle, &link->io);
+		if (i == CS_SUCCESS)
+			break;
+	}
+	if (i != CS_SUCCESS) {
+		cs_error(link->handle, RequestIO, i);
+		goto failed;
+	}
+
+	/* Now allocate an interrupt line. Note that this does not actually
+	 * assign a handler to the interrupt. */
+
+	CS_CHECK(RequestIRQ, pcmcia_request_irq(link->handle, &link->irq));
+
+	/* This actually configures the PCMCIA socket -- setting up the I/O
+	 * windows and the interrupt mapping.  */
+
+	CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link->handle, &link->conf));
+
+	dev->irq = link->irq.AssignedIRQ;
+	dev->base_addr = link->io.BasePort1;
+	SET_NETDEV_DEV(dev, &handle_to_dev(handle));
+	if (register_netdev(dev)) {
+		printk(KERN_NOTICE "wl3501_cs: register_netdev() failed\n");
+		goto failed;
+	}
+
+	SET_MODULE_OWNER(dev);
+
+	this = dev->priv;
+	/*
+	 * At this point, the dev_node_t structure(s) should be initialized and
+	 * arranged in a linked list at link->dev.
+	 */
+	link->dev = &this->node;
+	link->state &= ~DEV_CONFIG_PENDING;
+
+	this->base_addr = dev->base_addr;
+
+	if (!wl3501_get_flash_mac_addr(this)) {
+		printk(KERN_WARNING "%s: Cant read MAC addr in flash ROM?\n",
+		       dev->name);
+		goto failed;
+	}
+	strcpy(this->node.dev_name, dev->name);
+
+	/* print probe information */
+	printk(KERN_INFO "%s: wl3501 @ 0x%3.3x, IRQ %d, MAC addr in flash ROM:",
+	       dev->name, this->base_addr, (int)dev->irq);
+	for (i = 0; i < 6; i++) {
+		dev->dev_addr[i] = ((char *)&this->mac_addr)[i];
+		printk("%c%02x", i ? ':' : ' ', dev->dev_addr[i]);
+	}
+	printk("\n");
+	/*
+	 * Initialize card parameters - added by jss
+	 */
+	this->net_type		= IW_MODE_INFRA;
+	this->bss_cnt		= 0;
+	this->join_sta_bss	= 0;
+	this->adhoc_times	= 0;
+	iw_set_mgmt_info_element(IW_MGMT_INFO_ELEMENT_SSID, &this->essid.el,
+				 "ANY", 3);
+	this->card_name[0]	= '\0';
+	this->firmware_date[0]	= '\0';
+	this->rssi		= 255;
+	this->chan		= iw_default_channel(this->reg_domain);
+	strlcpy(this->nick, "Planet WL3501", sizeof(this->nick));
+	spin_lock_init(&this->lock);
+	init_waitqueue_head(&this->wait);
+	netif_start_queue(dev);
+	goto out;
+cs_failed:
+	cs_error(link->handle, last_fn, last_ret);
+failed:
+	wl3501_release(link);
+out:
+	return;
+}
+
+/**
+ * wl3501_release - unregister the net, release PCMCIA configuration
+ * @arg - link
+ *
+ * After a card is removed, wl3501_release() will unregister the net device,
+ * and release the PCMCIA configuration.  If the device is still open, this
+ * will be postponed until it is closed.
+ */
+static void wl3501_release(dev_link_t *link)
+{
+	struct net_device *dev = link->priv;
+
+	/* Unlink the device chain */
+	if (link->dev) {
+		unregister_netdev(dev);
+		link->dev = NULL;
+	}
+
+	/* Don't bother checking to see if these succeed or not */
+	pcmcia_release_configuration(link->handle);
+	pcmcia_release_io(link->handle, &link->io);
+	pcmcia_release_irq(link->handle, &link->irq);
+	link->state &= ~DEV_CONFIG;
+}
+
+/**
+ * wl3501_event - The card status event handler
+ * @event - event
+ * @pri - priority
+ * @args - arguments for this event
+ *
+ * The card status event handler. Mostly, this schedules other stuff to run
+ * after an event is received. A CARD_REMOVAL event also sets some flags to
+ * discourage the net drivers from trying to talk to the card any more.
+ *
+ * When a CARD_REMOVAL event is received, we immediately set a flag to block
+ * future accesses to this device. All the functions that actually access the
+ * device should check this flag to make sure the card is still present.
+ */
+static int wl3501_event(event_t event, int pri, event_callback_args_t *args)
+{
+	dev_link_t *link = args->client_data;
+	struct net_device *dev = link->priv;
+
+	switch (event) {
+	case CS_EVENT_CARD_REMOVAL:
+		link->state &= ~DEV_PRESENT;
+		if (link->state & DEV_CONFIG) {
+			while (link->open > 0)
+				wl3501_close(dev);
+			netif_device_detach(dev);
+			wl3501_release(link);
+		}
+		break;
+	case CS_EVENT_CARD_INSERTION:
+		link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
+		wl3501_config(link);
+		break;
+	case CS_EVENT_PM_SUSPEND:
+		link->state |= DEV_SUSPEND;
+		wl3501_pwr_mgmt(dev->priv, WL3501_SUSPEND);
+		/* Fall through... */
+	case CS_EVENT_RESET_PHYSICAL:
+		if (link->state & DEV_CONFIG) {
+			if (link->open)
+				netif_device_detach(dev);
+			pcmcia_release_configuration(link->handle);
+		}
+		break;
+	case CS_EVENT_PM_RESUME:
+		link->state &= ~DEV_SUSPEND;
+		wl3501_pwr_mgmt(dev->priv, WL3501_RESUME);
+		/* Fall through... */
+	case CS_EVENT_CARD_RESET:
+		if (link->state & DEV_CONFIG) {
+			pcmcia_request_configuration(link->handle, &link->conf);
+			if (link->open) {
+				wl3501_reset(dev);
+				netif_device_attach(dev);
+			}
+		}
+		break;
+	}
+	return 0;
+}
+
+static struct pcmcia_driver wl3501_driver = {
+	.owner          = THIS_MODULE,
+	.drv            = {
+		.name   = "wl3501_cs",
+	},
+	.attach         = wl3501_attach,
+	.detach         = wl3501_detach,
+};
+
+static int __init wl3501_init_module(void)
+{
+	return pcmcia_register_driver(&wl3501_driver);
+}
+
+static void __exit wl3501_exit_module(void)
+{
+	dprintk(0, ": unloading");
+	pcmcia_unregister_driver(&wl3501_driver);
+	BUG_ON(wl3501_dev_list != NULL);
+}
+
+module_init(wl3501_init_module);
+module_exit(wl3501_exit_module);
+
+MODULE_AUTHOR("Fox Chen <mhchen@golf.ccl.itri.org.tw>, "
+	      "Arnaldo Carvalho de Melo <acme@conectiva.com.br>,"
+	      "Gustavo Niemeyer <niemeyer@conectiva.com>");
+MODULE_DESCRIPTION("Planet wl3501 wireless driver");
+MODULE_LICENSE("GPL");