git.oblomov.eu Git - linux-2.6/blob - drivers/net/wireless/atmel.c

   1 /*** -*- linux-c -*- **********************************************************
   2
   3      Driver for Atmel at76c502 at76c504 and at76c506 wireless cards.
   4
   5         Copyright 2000-2001 ATMEL Corporation.
   6         Copyright 2003-2004 Simon Kelley.
   7
   8     This code was developed from version 2.1.1 of the Atmel drivers,
   9     released by Atmel corp. under the GPL in December 2002. It also
  10     includes code from the Linux aironet drivers (C) Benjamin Reed,
  11     and the Linux PCMCIA package, (C) David Hinds and the Linux wireless
  12     extensions, (C) Jean Tourrilhes.
  13
  14     The firmware module for reading the MAC address of the card comes from
  15     net.russotto.AtmelMACFW, written by Matthew T. Russotto and copyright
  16     by him. net.russotto.AtmelMACFW is used under the GPL license version 2.
  17     This file contains the module in binary form and, under the terms
  18     of the GPL, in source form. The source is located at the end of the file.
  19
  20     This program is free software; you can redistribute it and/or modify
  21     it under the terms of the GNU General Public License as published by
  22     the Free Software Foundation; either version 2 of the License, or
  23     (at your option) any later version.
  24
  25     This software is distributed in the hope that it will be useful,
  26     but WITHOUT ANY WARRANTY; without even the implied warranty of
  27     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  28     GNU General Public License for more details.
  29
  30     You should have received a copy of the GNU General Public License
  31     along with Atmel wireless lan drivers; if not, write to the Free Software
  32     Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  33
  34     For all queries about this code, please contact the current author,
  35     Simon Kelley <simon@thekelleys.org.uk> and not Atmel Corporation.
  36
  37     Credit is due to HP UK and Cambridge Online Systems Ltd for supplying
  38     hardware used during development of this driver.
  39
  40 ******************************************************************************/
  41
  42 #include <linux/config.h>
  43 #include <linux/init.h>
  44
  45 #include <linux/kernel.h>
  46 #include <linux/sched.h>
  47 #include <linux/ptrace.h>
  48 #include <linux/slab.h>
  49 #include <linux/string.h>
  50 #include <linux/ctype.h>
  51 #include <linux/timer.h>
  52 #include <asm/io.h>
  53 #include <asm/system.h>
  54 #include <asm/uaccess.h>
  55 #include <linux/module.h>
  56 #include <linux/netdevice.h>
  57 #include <linux/etherdevice.h>
  58 #include <linux/skbuff.h>
  59 #include <linux/if_arp.h>
  60 #include <linux/ioport.h>
  61 #include <linux/fcntl.h>
  62 #include <linux/delay.h>
  63 #include <linux/wireless.h>
  64 #include <net/iw_handler.h>
  65 #include <linux/byteorder/generic.h>
  66 #include <linux/crc32.h>
  67 #include <linux/proc_fs.h>
  68 #include <linux/device.h>
  69 #include <linux/moduleparam.h>
  70 #include <linux/firmware.h>
  71 #include <net/ieee80211.h>
  72 #include "atmel.h"
  73
  74 #define DRIVER_MAJOR 0
  75 #define DRIVER_MINOR 98
  76
  77 MODULE_AUTHOR("Simon Kelley");
  78 MODULE_DESCRIPTION("Support for Atmel at76c50x 802.11 wireless ethernet cards.");
  79 MODULE_LICENSE("GPL");
  80 MODULE_SUPPORTED_DEVICE("Atmel at76c50x wireless cards");
  81
  82 /* The name of the firmware file to be loaded
  83    over-rides any automatic selection */
  84 static char *firmware = NULL;
  85 module_param(firmware, charp, 0);
  86
  87 /* table of firmware file names */
  88 static struct {
  89         AtmelFWType fw_type;
  90         const char *fw_file;
  91         const char *fw_file_ext;
  92 } fw_table[] = {
  93         { ATMEL_FW_TYPE_502,      "atmel_at76c502",      "bin" },
  94         { ATMEL_FW_TYPE_502D,     "atmel_at76c502d",     "bin" },
  95         { ATMEL_FW_TYPE_502E,     "atmel_at76c502e",     "bin" },
  96         { ATMEL_FW_TYPE_502_3COM, "atmel_at76c502_3com", "bin" },
  97         { ATMEL_FW_TYPE_504,      "atmel_at76c504",      "bin" },
  98         { ATMEL_FW_TYPE_504_2958, "atmel_at76c504_2958", "bin" },
  99         { ATMEL_FW_TYPE_504A_2958,"atmel_at76c504a_2958","bin" },
 100         { ATMEL_FW_TYPE_506,      "atmel_at76c506",      "bin" },
 101         { ATMEL_FW_TYPE_NONE,      NULL,                  NULL }
 102 };
 103
 104 #define MAX_SSID_LENGTH 32
 105 #define MGMT_JIFFIES (256 * HZ / 100)
 106
 107 #define MAX_BSS_ENTRIES 64
 108
 109 /* registers */
 110 #define GCR  0x00    //      (SIR0)  General Configuration Register
 111 #define BSR  0x02    //      (SIR1)  Bank Switching Select Register
 112 #define AR   0x04
 113 #define DR   0x08
 114 #define MR1  0x12    //      Mirror Register 1
 115 #define MR2  0x14    //      Mirror Register 2
 116 #define MR3  0x16    //      Mirror Register 3
 117 #define MR4  0x18    //      Mirror Register 4
 118
 119 #define GPR1                            0x0c
 120 #define GPR2                            0x0e
 121 #define GPR3                            0x10
 122 //
 123 // Constants for the GCR register.
 124 //
 125 #define GCR_REMAP     0x0400          // Remap internal SRAM to 0
 126 #define GCR_SWRES     0x0080          // BIU reset (ARM and PAI are NOT reset)
 127 #define GCR_CORES     0x0060          // Core Reset (ARM and PAI are reset)
 128 #define GCR_ENINT     0x0002          // Enable Interrupts
 129 #define GCR_ACKINT    0x0008          // Acknowledge Interrupts
 130
 131 #define BSS_SRAM      0x0200          // AMBA module selection --> SRAM
 132 #define BSS_IRAM      0x0100          // AMBA module selection --> IRAM
 133 //
 134 // Constants for the MR registers.
 135 //
 136 #define MAC_INIT_COMPLETE       0x0001        // MAC init has been completed
 137 #define MAC_BOOT_COMPLETE       0x0010        // MAC boot has been completed
 138 #define MAC_INIT_OK             0x0002        // MAC boot has been completed
 139
 140 #define C80211_SUBTYPE_MGMT_ASS_REQUEST                 0x00
 141 #define C80211_SUBTYPE_MGMT_ASS_RESPONSE                0x10
 142 #define C80211_SUBTYPE_MGMT_REASS_REQUEST               0x20
 143 #define C80211_SUBTYPE_MGMT_REASS_RESPONSE              0x30
 144 #define C80211_SUBTYPE_MGMT_ProbeRequest                0x40
 145 #define C80211_SUBTYPE_MGMT_ProbeResponse               0x50
 146 #define C80211_SUBTYPE_MGMT_BEACON                      0x80
 147 #define C80211_SUBTYPE_MGMT_ATIM                        0x90
 148 #define C80211_SUBTYPE_MGMT_DISASSOSIATION              0xA0
 149 #define C80211_SUBTYPE_MGMT_Authentication              0xB0
 150 #define C80211_SUBTYPE_MGMT_Deauthentication    0xC0
 151
 152 #define C80211_MGMT_AAN_OPENSYSTEM              0x0000
 153 #define C80211_MGMT_AAN_SHAREDKEY               0x0001
 154
 155 #define C80211_MGMT_CAPABILITY_ESS              0x0001  // see 802.11 p.58
 156 #define C80211_MGMT_CAPABILITY_IBSS             0x0002  //      - " -
 157 #define C80211_MGMT_CAPABILITY_CFPollable       0x0004  //      - " -
 158 #define C80211_MGMT_CAPABILITY_CFPollRequest    0x0008  //      - " -
 159 #define C80211_MGMT_CAPABILITY_Privacy          0x0010  //      - " -
 160
 161 #define C80211_MGMT_SC_Success                  0
 162 #define C80211_MGMT_SC_Unspecified              1
 163 #define C80211_MGMT_SC_SupportCapabilities      10
 164 #define C80211_MGMT_SC_ReassDenied              11
 165 #define C80211_MGMT_SC_AssDenied                12
 166 #define C80211_MGMT_SC_AuthAlgNotSupported      13
 167 #define C80211_MGMT_SC_AuthTransSeqNumError     14
 168 #define C80211_MGMT_SC_AuthRejectChallenge      15
 169 #define C80211_MGMT_SC_AuthRejectTimeout        16
 170 #define C80211_MGMT_SC_AssDeniedHandleAP        17
 171 #define C80211_MGMT_SC_AssDeniedBSSRate         18
 172
 173 #define C80211_MGMT_ElementID_SSID              0
 174 #define C80211_MGMT_ElementID_SupportedRates    1
 175 #define C80211_MGMT_ElementID_ChallengeText     16
 176 #define C80211_MGMT_CAPABILITY_ShortPreamble    0x0020
 177
 178 #define MIB_MAX_DATA_BYTES    212
 179 #define MIB_HEADER_SIZE       4    /* first four fields */
 180
 181 struct get_set_mib {
 182         u8 type;
 183         u8 size;
 184         u8 index;
 185         u8 reserved;
 186         u8 data[MIB_MAX_DATA_BYTES];
 187 };
 188
 189 struct rx_desc {
 190         u32          Next;
 191         u16          MsduPos;
 192         u16          MsduSize;
 193
 194         u8           State;
 195         u8           Status;
 196         u8           Rate;
 197         u8           Rssi;
 198         u8           LinkQuality;
 199         u8           PreambleType;
 200         u16          Duration;
 201         u32          RxTime;
 202 };
 203
 204 #define RX_DESC_FLAG_VALID       0x80
 205 #define RX_DESC_FLAG_CONSUMED    0x40
 206 #define RX_DESC_FLAG_IDLE        0x00
 207
 208 #define RX_STATUS_SUCCESS        0x00
 209
 210 #define RX_DESC_MSDU_POS_OFFSET      4
 211 #define RX_DESC_MSDU_SIZE_OFFSET     6
 212 #define RX_DESC_FLAGS_OFFSET         8
 213 #define RX_DESC_STATUS_OFFSET        9
 214 #define RX_DESC_RSSI_OFFSET          11
 215 #define RX_DESC_LINK_QUALITY_OFFSET  12
 216 #define RX_DESC_PREAMBLE_TYPE_OFFSET 13
 217 #define RX_DESC_DURATION_OFFSET      14
 218 #define RX_DESC_RX_TIME_OFFSET       16
 219
 220 struct tx_desc {
 221         u32       NextDescriptor;
 222         u16       TxStartOfFrame;
 223         u16       TxLength;
 224
 225         u8        TxState;
 226         u8        TxStatus;
 227         u8        RetryCount;
 228
 229         u8        TxRate;
 230
 231         u8        KeyIndex;
 232         u8        ChiperType;
 233         u8        ChipreLength;
 234         u8        Reserved1;
 235
 236         u8        Reserved;
 237         u8        PacketType;
 238         u16       HostTxLength;
 239 };
 240
 241 #define TX_DESC_NEXT_OFFSET          0
 242 #define TX_DESC_POS_OFFSET           4
 243 #define TX_DESC_SIZE_OFFSET          6
 244 #define TX_DESC_FLAGS_OFFSET         8
 245 #define TX_DESC_STATUS_OFFSET        9
 246 #define TX_DESC_RETRY_OFFSET         10
 247 #define TX_DESC_RATE_OFFSET          11
 248 #define TX_DESC_KEY_INDEX_OFFSET     12
 249 #define TX_DESC_CIPHER_TYPE_OFFSET   13
 250 #define TX_DESC_CIPHER_LENGTH_OFFSET 14
 251 #define TX_DESC_PACKET_TYPE_OFFSET   17
 252 #define TX_DESC_HOST_LENGTH_OFFSET   18
 253
 254 ///////////////////////////////////////////////////////
 255 // Host-MAC interface
 256 ///////////////////////////////////////////////////////
 257
 258 #define TX_STATUS_SUCCESS       0x00
 259
 260 #define TX_FIRM_OWN             0x80
 261 #define TX_DONE                 0x40
 262
 263 #define TX_ERROR                0x01
 264
 265 #define TX_PACKET_TYPE_DATA     0x01
 266 #define TX_PACKET_TYPE_MGMT     0x02
 267
 268 #define ISR_EMPTY               0x00        // no bits set in ISR
 269 #define ISR_TxCOMPLETE          0x01        // packet transmitted
 270 #define ISR_RxCOMPLETE          0x02        // packet received
 271 #define ISR_RxFRAMELOST         0x04        // Rx Frame lost
 272 #define ISR_FATAL_ERROR         0x08        // Fatal error
 273 #define ISR_COMMAND_COMPLETE    0x10        // command completed
 274 #define ISR_OUT_OF_RANGE        0x20        // command completed
 275 #define ISR_IBSS_MERGE          0x40        // (4.1.2.30): IBSS merge
 276 #define ISR_GENERIC_IRQ         0x80
 277
 278 #define Local_Mib_Type          0x01
 279 #define Mac_Address_Mib_Type    0x02
 280 #define Mac_Mib_Type            0x03
 281 #define Statistics_Mib_Type     0x04
 282 #define Mac_Mgmt_Mib_Type       0x05
 283 #define Mac_Wep_Mib_Type        0x06
 284 #define Phy_Mib_Type            0x07
 285 #define Multi_Domain_MIB        0x08
 286
 287 #define MAC_MGMT_MIB_CUR_BSSID_POS            14
 288 #define MAC_MIB_FRAG_THRESHOLD_POS            8
 289 #define MAC_MIB_RTS_THRESHOLD_POS             10
 290 #define MAC_MIB_SHORT_RETRY_POS               16
 291 #define MAC_MIB_LONG_RETRY_POS                17
 292 #define MAC_MIB_SHORT_RETRY_LIMIT_POS         16
 293 #define MAC_MGMT_MIB_BEACON_PER_POS           0
 294 #define MAC_MGMT_MIB_STATION_ID_POS           6
 295 #define MAC_MGMT_MIB_CUR_PRIVACY_POS          11
 296 #define MAC_MGMT_MIB_CUR_BSSID_POS            14
 297 #define MAC_MGMT_MIB_PS_MODE_POS              53
 298 #define MAC_MGMT_MIB_LISTEN_INTERVAL_POS      54
 299 #define MAC_MGMT_MIB_MULTI_DOMAIN_IMPLEMENTED 56
 300 #define MAC_MGMT_MIB_MULTI_DOMAIN_ENABLED     57
 301 #define PHY_MIB_CHANNEL_POS                   14
 302 #define PHY_MIB_RATE_SET_POS                  20
 303 #define PHY_MIB_REG_DOMAIN_POS                26
 304 #define LOCAL_MIB_AUTO_TX_RATE_POS            3
 305 #define LOCAL_MIB_SSID_SIZE                   5
 306 #define LOCAL_MIB_TX_PROMISCUOUS_POS          6
 307 #define LOCAL_MIB_TX_MGMT_RATE_POS            7
 308 #define LOCAL_MIB_TX_CONTROL_RATE_POS         8
 309 #define LOCAL_MIB_PREAMBLE_TYPE               9
 310 #define MAC_ADDR_MIB_MAC_ADDR_POS             0
 311
 312 #define         CMD_Set_MIB_Vars              0x01
 313 #define         CMD_Get_MIB_Vars              0x02
 314 #define         CMD_Scan                      0x03
 315 #define         CMD_Join                      0x04
 316 #define         CMD_Start                     0x05
 317 #define         CMD_EnableRadio               0x06
 318 #define         CMD_DisableRadio              0x07
 319 #define         CMD_SiteSurvey                0x0B
 320
 321 #define         CMD_STATUS_IDLE                   0x00
 322 #define         CMD_STATUS_COMPLETE               0x01
 323 #define         CMD_STATUS_UNKNOWN                0x02
 324 #define         CMD_STATUS_INVALID_PARAMETER      0x03
 325 #define         CMD_STATUS_FUNCTION_NOT_SUPPORTED 0x04
 326 #define         CMD_STATUS_TIME_OUT               0x07
 327 #define         CMD_STATUS_IN_PROGRESS            0x08
 328 #define         CMD_STATUS_REJECTED_RADIO_OFF     0x09
 329 #define         CMD_STATUS_HOST_ERROR             0xFF
 330 #define         CMD_STATUS_BUSY                   0xFE
 331
 332 #define CMD_BLOCK_COMMAND_OFFSET        0
 333 #define CMD_BLOCK_STATUS_OFFSET         1
 334 #define CMD_BLOCK_PARAMETERS_OFFSET     4
 335
 336 #define SCAN_OPTIONS_SITE_SURVEY        0x80
 337
 338 #define MGMT_FRAME_BODY_OFFSET          24
 339 #define MAX_AUTHENTICATION_RETRIES      3
 340 #define MAX_ASSOCIATION_RETRIES         3
 341
 342 #define AUTHENTICATION_RESPONSE_TIME_OUT  1000
 343
 344 #define MAX_WIRELESS_BODY  2316 /* mtu is 2312, CRC is 4 */
 345 #define LOOP_RETRY_LIMIT   500000
 346
 347 #define ACTIVE_MODE     1
 348 #define PS_MODE         2
 349
 350 #define MAX_ENCRYPTION_KEYS 4
 351 #define MAX_ENCRYPTION_KEY_SIZE 40
 352
 353 ///////////////////////////////////////////////////////////////////////////
 354 // 802.11 related definitions
 355 ///////////////////////////////////////////////////////////////////////////
 356
 357 //
 358 // Regulatory Domains
 359 //
 360
 361 #define REG_DOMAIN_FCC          0x10    //Channels      1-11    USA
 362 #define REG_DOMAIN_DOC          0x20    //Channel       1-11    Canada
 363 #define REG_DOMAIN_ETSI         0x30    //Channel       1-13    Europe (ex Spain/France)
 364 #define REG_DOMAIN_SPAIN        0x31    //Channel       10-11   Spain
 365 #define REG_DOMAIN_FRANCE       0x32    //Channel       10-13   France
 366 #define REG_DOMAIN_MKK          0x40    //Channel       14      Japan
 367 #define REG_DOMAIN_MKK1         0x41    //Channel       1-14    Japan(MKK1)
 368 #define REG_DOMAIN_ISRAEL       0x50    //Channel       3-9     ISRAEL
 369
 370 #define BSS_TYPE_AD_HOC         1
 371 #define BSS_TYPE_INFRASTRUCTURE 2
 372
 373 #define SCAN_TYPE_ACTIVE        0
 374 #define SCAN_TYPE_PASSIVE       1
 375
 376 #define LONG_PREAMBLE           0
 377 #define SHORT_PREAMBLE          1
 378 #define AUTO_PREAMBLE           2
 379
 380 #define DATA_FRAME_WS_HEADER_SIZE   30
 381
 382 /* promiscuous mode control */
 383 #define PROM_MODE_OFF                   0x0
 384 #define PROM_MODE_UNKNOWN               0x1
 385 #define PROM_MODE_CRC_FAILED            0x2
 386 #define PROM_MODE_DUPLICATED            0x4
 387 #define PROM_MODE_MGMT                  0x8
 388 #define PROM_MODE_CTRL                  0x10
 389 #define PROM_MODE_BAD_PROTOCOL          0x20
 390
 391 #define IFACE_INT_STATUS_OFFSET         0
 392 #define IFACE_INT_MASK_OFFSET           1
 393 #define IFACE_LOCKOUT_HOST_OFFSET       2
 394 #define IFACE_LOCKOUT_MAC_OFFSET        3
 395 #define IFACE_FUNC_CTRL_OFFSET          28
 396 #define IFACE_MAC_STAT_OFFSET           30
 397 #define IFACE_GENERIC_INT_TYPE_OFFSET   32
 398
 399 #define CIPHER_SUITE_NONE     0
 400 #define CIPHER_SUITE_WEP_64   1
 401 #define CIPHER_SUITE_TKIP     2
 402 #define CIPHER_SUITE_AES      3
 403 #define CIPHER_SUITE_CCX      4
 404 #define CIPHER_SUITE_WEP_128  5
 405
 406 //
 407 // IFACE MACROS & definitions
 408 //
 409 //
 410
 411 // FuncCtrl field:
 412 //
 413 #define FUNC_CTRL_TxENABLE              0x10
 414 #define FUNC_CTRL_RxENABLE              0x20
 415 #define FUNC_CTRL_INIT_COMPLETE         0x01
 416
 417 /* A stub firmware image which reads the MAC address from NVRAM on the card.
 418    For copyright information and source see the end of this file. */
 419 static u8 mac_reader[] = {
 420         0x06,0x00,0x00,0xea,0x04,0x00,0x00,0xea,0x03,0x00,0x00,0xea,0x02,0x00,0x00,0xea,
 421         0x01,0x00,0x00,0xea,0x00,0x00,0x00,0xea,0xff,0xff,0xff,0xea,0xfe,0xff,0xff,0xea,
 422         0xd3,0x00,0xa0,0xe3,0x00,0xf0,0x21,0xe1,0x0e,0x04,0xa0,0xe3,0x00,0x10,0xa0,0xe3,
 423         0x81,0x11,0xa0,0xe1,0x00,0x10,0x81,0xe3,0x00,0x10,0x80,0xe5,0x1c,0x10,0x90,0xe5,
 424         0x10,0x10,0xc1,0xe3,0x1c,0x10,0x80,0xe5,0x01,0x10,0xa0,0xe3,0x08,0x10,0x80,0xe5,
 425         0x02,0x03,0xa0,0xe3,0x00,0x10,0xa0,0xe3,0xb0,0x10,0xc0,0xe1,0xb4,0x10,0xc0,0xe1,
 426         0xb8,0x10,0xc0,0xe1,0xbc,0x10,0xc0,0xe1,0x56,0xdc,0xa0,0xe3,0x21,0x00,0x00,0xeb,
 427         0x0a,0x00,0xa0,0xe3,0x1a,0x00,0x00,0xeb,0x10,0x00,0x00,0xeb,0x07,0x00,0x00,0xeb,
 428         0x02,0x03,0xa0,0xe3,0x02,0x14,0xa0,0xe3,0xb4,0x10,0xc0,0xe1,0x4c,0x10,0x9f,0xe5,
 429         0xbc,0x10,0xc0,0xe1,0x10,0x10,0xa0,0xe3,0xb8,0x10,0xc0,0xe1,0xfe,0xff,0xff,0xea,
 430         0x00,0x40,0x2d,0xe9,0x00,0x20,0xa0,0xe3,0x02,0x3c,0xa0,0xe3,0x00,0x10,0xa0,0xe3,
 431         0x28,0x00,0x9f,0xe5,0x37,0x00,0x00,0xeb,0x00,0x40,0xbd,0xe8,0x1e,0xff,0x2f,0xe1,
 432         0x00,0x40,0x2d,0xe9,0x12,0x2e,0xa0,0xe3,0x06,0x30,0xa0,0xe3,0x00,0x10,0xa0,0xe3,
 433         0x02,0x04,0xa0,0xe3,0x2f,0x00,0x00,0xeb,0x00,0x40,0xbd,0xe8,0x1e,0xff,0x2f,0xe1,
 434         0x00,0x02,0x00,0x02,0x80,0x01,0x90,0xe0,0x01,0x00,0x00,0x0a,0x01,0x00,0x50,0xe2,
 435         0xfc,0xff,0xff,0xea,0x1e,0xff,0x2f,0xe1,0x80,0x10,0xa0,0xe3,0xf3,0x06,0xa0,0xe3,
 436         0x00,0x10,0x80,0xe5,0x00,0x10,0xa0,0xe3,0x00,0x10,0x80,0xe5,0x01,0x10,0xa0,0xe3,
 437         0x04,0x10,0x80,0xe5,0x00,0x10,0x80,0xe5,0x0e,0x34,0xa0,0xe3,0x1c,0x10,0x93,0xe5,
 438         0x02,0x1a,0x81,0xe3,0x1c,0x10,0x83,0xe5,0x58,0x11,0x9f,0xe5,0x30,0x10,0x80,0xe5,
 439         0x54,0x11,0x9f,0xe5,0x34,0x10,0x80,0xe5,0x38,0x10,0x80,0xe5,0x3c,0x10,0x80,0xe5,
 440         0x10,0x10,0x90,0xe5,0x08,0x00,0x90,0xe5,0x1e,0xff,0x2f,0xe1,0xf3,0x16,0xa0,0xe3,
 441         0x08,0x00,0x91,0xe5,0x05,0x00,0xa0,0xe3,0x0c,0x00,0x81,0xe5,0x10,0x00,0x91,0xe5,
 442         0x02,0x00,0x10,0xe3,0xfc,0xff,0xff,0x0a,0xff,0x00,0xa0,0xe3,0x0c,0x00,0x81,0xe5,
 443         0x10,0x00,0x91,0xe5,0x02,0x00,0x10,0xe3,0xfc,0xff,0xff,0x0a,0x08,0x00,0x91,0xe5,
 444         0x10,0x00,0x91,0xe5,0x01,0x00,0x10,0xe3,0xfc,0xff,0xff,0x0a,0x08,0x00,0x91,0xe5,
 445         0xff,0x00,0x00,0xe2,0x1e,0xff,0x2f,0xe1,0x30,0x40,0x2d,0xe9,0x00,0x50,0xa0,0xe1,
 446         0x03,0x40,0xa0,0xe1,0xa2,0x02,0xa0,0xe1,0x08,0x00,0x00,0xe2,0x03,0x00,0x80,0xe2,
 447         0xd8,0x10,0x9f,0xe5,0x00,0x00,0xc1,0xe5,0x01,0x20,0xc1,0xe5,0xe2,0xff,0xff,0xeb,
 448         0x01,0x00,0x10,0xe3,0xfc,0xff,0xff,0x1a,0x14,0x00,0xa0,0xe3,0xc4,0xff,0xff,0xeb,
 449         0x04,0x20,0xa0,0xe1,0x05,0x10,0xa0,0xe1,0x02,0x00,0xa0,0xe3,0x01,0x00,0x00,0xeb,
 450         0x30,0x40,0xbd,0xe8,0x1e,0xff,0x2f,0xe1,0x70,0x40,0x2d,0xe9,0xf3,0x46,0xa0,0xe3,
 451         0x00,0x30,0xa0,0xe3,0x00,0x00,0x50,0xe3,0x08,0x00,0x00,0x9a,0x8c,0x50,0x9f,0xe5,
 452         0x03,0x60,0xd5,0xe7,0x0c,0x60,0x84,0xe5,0x10,0x60,0x94,0xe5,0x02,0x00,0x16,0xe3,
 453         0xfc,0xff,0xff,0x0a,0x01,0x30,0x83,0xe2,0x00,0x00,0x53,0xe1,0xf7,0xff,0xff,0x3a,
 454         0xff,0x30,0xa0,0xe3,0x0c,0x30,0x84,0xe5,0x08,0x00,0x94,0xe5,0x10,0x00,0x94,0xe5,
 455         0x01,0x00,0x10,0xe3,0xfc,0xff,0xff,0x0a,0x08,0x00,0x94,0xe5,0x00,0x00,0xa0,0xe3,
 456         0x00,0x00,0x52,0xe3,0x0b,0x00,0x00,0x9a,0x10,0x50,0x94,0xe5,0x02,0x00,0x15,0xe3,
 457         0xfc,0xff,0xff,0x0a,0x0c,0x30,0x84,0xe5,0x10,0x50,0x94,0xe5,0x01,0x00,0x15,0xe3,
 458         0xfc,0xff,0xff,0x0a,0x08,0x50,0x94,0xe5,0x01,0x50,0xc1,0xe4,0x01,0x00,0x80,0xe2,
 459         0x02,0x00,0x50,0xe1,0xf3,0xff,0xff,0x3a,0xc8,0x00,0xa0,0xe3,0x98,0xff,0xff,0xeb,
 460         0x70,0x40,0xbd,0xe8,0x1e,0xff,0x2f,0xe1,0x01,0x0c,0x00,0x02,0x01,0x02,0x00,0x02,
 461         0x00,0x01,0x00,0x02
 462 };
 463
 464 struct atmel_private {
 465         void *card; /* Bus dependent stucture varies for PCcard */
 466         int (*present_callback)(void *); /* And callback which uses it */
 467         char firmware_id[32];
 468         AtmelFWType firmware_type;
 469         u8 *firmware;
 470         int firmware_length;
 471         struct timer_list management_timer;
 472         struct net_device *dev;
 473         struct device *sys_dev;
 474         struct iw_statistics wstats;
 475         struct net_device_stats stats;  // device stats
 476         spinlock_t irqlock, timerlock;  // spinlocks
 477         enum { BUS_TYPE_PCCARD, BUS_TYPE_PCI } bus_type;
 478         enum {
 479                 CARD_TYPE_PARALLEL_FLASH,
 480                 CARD_TYPE_SPI_FLASH,
 481                 CARD_TYPE_EEPROM
 482         } card_type;
 483         int do_rx_crc; /* If we need to CRC incoming packets */
 484         int probe_crc; /* set if we don't yet know */
 485         int crc_ok_cnt, crc_ko_cnt; /* counters for probing */
 486         u16 rx_desc_head;
 487         u16 tx_desc_free, tx_desc_head, tx_desc_tail, tx_desc_previous;
 488         u16 tx_free_mem, tx_buff_head, tx_buff_tail;
 489
 490         u16 frag_seq, frag_len, frag_no;
 491         u8 frag_source[6];
 492
 493         u8 wep_is_on, default_key, exclude_unencrypted, encryption_level;
 494         u8 group_cipher_suite, pairwise_cipher_suite;
 495         u8 wep_keys[MAX_ENCRYPTION_KEYS][MAX_ENCRYPTION_KEY_SIZE];
 496         int wep_key_len[MAX_ENCRYPTION_KEYS];
 497         int use_wpa, radio_on_broken; /* firmware dependent stuff. */
 498
 499         u16 host_info_base;
 500         struct host_info_struct {
 501                 /* NB this is matched to the hardware, don't change. */
 502                 u8 volatile int_status;
 503                 u8 volatile int_mask;
 504                 u8 volatile lockout_host;
 505                 u8 volatile lockout_mac;
 506
 507                 u16 tx_buff_pos;
 508                 u16 tx_buff_size;
 509                 u16 tx_desc_pos;
 510                 u16 tx_desc_count;
 511
 512                 u16 rx_buff_pos;
 513                 u16 rx_buff_size;
 514                 u16 rx_desc_pos;
 515                 u16 rx_desc_count;
 516
 517                 u16 build_version;
 518                 u16 command_pos;
 519
 520                 u16 major_version;
 521                 u16 minor_version;
 522
 523                 u16 func_ctrl;
 524                 u16 mac_status;
 525                 u16 generic_IRQ_type;
 526                 u8  reserved[2];
 527         } host_info;
 528
 529         enum {
 530                 STATION_STATE_SCANNING,
 531                 STATION_STATE_JOINNING,
 532                 STATION_STATE_AUTHENTICATING,
 533                 STATION_STATE_ASSOCIATING,
 534                 STATION_STATE_READY,
 535                 STATION_STATE_REASSOCIATING,
 536                 STATION_STATE_DOWN,
 537                 STATION_STATE_MGMT_ERROR
 538         } station_state;
 539
 540         int operating_mode, power_mode;
 541         time_t last_qual;
 542         int beacons_this_sec;
 543         int channel;
 544         int reg_domain, config_reg_domain;
 545         int tx_rate;
 546         int auto_tx_rate;
 547         int rts_threshold;
 548         int frag_threshold;
 549         int long_retry, short_retry;
 550         int preamble;
 551         int default_beacon_period, beacon_period, listen_interval;
 552         int CurrentAuthentTransactionSeqNum, ExpectedAuthentTransactionSeqNum;
 553         int AuthenticationRequestRetryCnt, AssociationRequestRetryCnt, ReAssociationRequestRetryCnt;
 554         enum {
 555                 SITE_SURVEY_IDLE,
 556                 SITE_SURVEY_IN_PROGRESS,
 557                 SITE_SURVEY_COMPLETED
 558         } site_survey_state;
 559         time_t last_survey;
 560
 561         int station_was_associated, station_is_associated;
 562         int fast_scan;
 563
 564         struct bss_info {
 565                 int channel;
 566                 int SSIDsize;
 567                 int RSSI;
 568                 int UsingWEP;
 569                 int preamble;
 570                 int beacon_period;
 571                 int BSStype;
 572                 u8 BSSID[6];
 573                 u8 SSID[MAX_SSID_LENGTH];
 574         } BSSinfo[MAX_BSS_ENTRIES];
 575         int BSS_list_entries, current_BSS;
 576         int connect_to_any_BSS;
 577         int SSID_size, new_SSID_size;
 578         u8 CurrentBSSID[6], BSSID[6];
 579         u8 SSID[MAX_SSID_LENGTH], new_SSID[MAX_SSID_LENGTH];
 580         u64 last_beacon_timestamp;
 581         u8 rx_buf[MAX_WIRELESS_BODY];
 582 };
 583
 584 static u8 atmel_basic_rates[4] = {0x82,0x84,0x0b,0x16};
 585
 586 static const struct {
 587         int reg_domain;
 588         int min, max;
 589         char *name;
 590 } channel_table[] = { { REG_DOMAIN_FCC, 1, 11, "USA" },
 591                       { REG_DOMAIN_DOC, 1, 11, "Canada" },
 592                       { REG_DOMAIN_ETSI, 1, 13, "Europe" },
 593                       { REG_DOMAIN_SPAIN, 10, 11, "Spain" },
 594                       { REG_DOMAIN_FRANCE, 10, 13, "France" },
 595                       { REG_DOMAIN_MKK, 14, 14, "MKK" },
 596                       { REG_DOMAIN_MKK1, 1, 14, "MKK1" },
 597                       { REG_DOMAIN_ISRAEL, 3, 9, "Israel"} };
 598
 599 static void build_wpa_mib(struct atmel_private *priv);
 600 static int atmel_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
 601 static void atmel_copy_to_card(struct net_device *dev, u16 dest,
 602                                unsigned char *src, u16 len);
 603 static void atmel_copy_to_host(struct net_device *dev, unsigned char *dest,
 604                                u16 src, u16 len);
 605 static void atmel_set_gcr(struct net_device *dev, u16 mask);
 606 static void atmel_clear_gcr(struct net_device *dev, u16 mask);
 607 static int atmel_lock_mac(struct atmel_private *priv);
 608 static void atmel_wmem32(struct atmel_private *priv, u16 pos, u32 data);
 609 static void atmel_command_irq(struct atmel_private *priv);
 610 static int atmel_validate_channel(struct atmel_private *priv, int channel);
 611 static void atmel_management_frame(struct atmel_private *priv,
 612                                    struct ieee80211_hdr_4addr *header,
 613                                    u16 frame_len, u8 rssi);
 614 static void atmel_management_timer(u_long a);
 615 static void atmel_send_command(struct atmel_private *priv, int command,
 616                                void *cmd, int cmd_size);
 617 static int atmel_send_command_wait(struct atmel_private *priv, int command,
 618                                    void *cmd, int cmd_size);
 619 static void atmel_transmit_management_frame(struct atmel_private *priv,
 620                                             struct ieee80211_hdr_4addr *header,
 621                                             u8 *body, int body_len);
 622
 623 static u8 atmel_get_mib8(struct atmel_private *priv, u8 type, u8 index);
 624 static void atmel_set_mib8(struct atmel_private *priv, u8 type, u8 index,
 625                            u8 data);
 626 static void atmel_set_mib16(struct atmel_private *priv, u8 type, u8 index,
 627                             u16 data);
 628 static void atmel_set_mib(struct atmel_private *priv, u8 type, u8 index,
 629                           u8 *data, int data_len);
 630 static void atmel_get_mib(struct atmel_private *priv, u8 type, u8 index,
 631                           u8 *data, int data_len);
 632 static void atmel_scan(struct atmel_private *priv, int specific_ssid);
 633 static void atmel_join_bss(struct atmel_private *priv, int bss_index);
 634 static void atmel_smooth_qual(struct atmel_private *priv);
 635 static void atmel_writeAR(struct net_device *dev, u16 data);
 636 static int probe_atmel_card(struct net_device *dev);
 637 static int reset_atmel_card(struct net_device *dev );
 638 static void atmel_enter_state(struct atmel_private *priv, int new_state);
 639 int atmel_open (struct net_device *dev);
 640
 641 static inline u16 atmel_hi(struct atmel_private *priv, u16 offset)
 642 {
 643         return priv->host_info_base + offset;
 644 }
 645
 646 static inline u16 atmel_co(struct atmel_private *priv, u16 offset)
 647 {
 648         return priv->host_info.command_pos + offset;
 649 }
 650
 651 static inline u16 atmel_rx(struct atmel_private *priv, u16 offset, u16 desc)
 652 {
 653         return priv->host_info.rx_desc_pos + (sizeof(struct rx_desc) * desc) + offset;
 654 }
 655
 656 static inline u16 atmel_tx(struct atmel_private *priv, u16 offset, u16 desc)
 657 {
 658         return priv->host_info.tx_desc_pos + (sizeof(struct tx_desc) * desc) + offset;
 659 }
 660
 661 static inline u8 atmel_read8(struct net_device *dev, u16 offset)
 662 {
 663         return inb(dev->base_addr + offset);
 664 }
 665
 666 static inline void atmel_write8(struct net_device *dev, u16 offset, u8 data)
 667 {
 668         outb(data, dev->base_addr + offset);
 669 }
 670
 671 static inline u16 atmel_read16(struct net_device *dev, u16 offset)
 672 {
 673         return inw(dev->base_addr + offset);
 674 }
 675
 676 static inline void atmel_write16(struct net_device *dev, u16 offset, u16 data)
 677 {
 678         outw(data, dev->base_addr + offset);
 679 }
 680
 681 static inline u8 atmel_rmem8(struct atmel_private *priv, u16 pos)
 682 {
 683         atmel_writeAR(priv->dev, pos);
 684         return atmel_read8(priv->dev, DR);
 685 }
 686
 687 static inline void atmel_wmem8(struct atmel_private *priv, u16 pos, u16 data)
 688 {
 689         atmel_writeAR(priv->dev, pos);
 690         atmel_write8(priv->dev, DR, data);
 691 }
 692
 693 static inline u16 atmel_rmem16(struct atmel_private *priv, u16 pos)
 694 {
 695         atmel_writeAR(priv->dev, pos);
 696         return atmel_read16(priv->dev, DR);
 697 }
 698
 699 static inline void atmel_wmem16(struct atmel_private *priv, u16 pos, u16 data)
 700 {
 701         atmel_writeAR(priv->dev, pos);
 702         atmel_write16(priv->dev, DR, data);
 703 }
 704
 705 static const struct iw_handler_def atmel_handler_def;
 706
 707 static void tx_done_irq(struct atmel_private *priv)
 708 {
 709         int i;
 710
 711         for (i = 0;
 712              atmel_rmem8(priv, atmel_tx(priv, TX_DESC_FLAGS_OFFSET, priv->tx_desc_head)) == TX_DONE &&
 713                      i < priv->host_info.tx_desc_count;
 714              i++) {
 715                 u8 status = atmel_rmem8(priv, atmel_tx(priv, TX_DESC_STATUS_OFFSET, priv->tx_desc_head));
 716                 u16 msdu_size = atmel_rmem16(priv, atmel_tx(priv, TX_DESC_SIZE_OFFSET, priv->tx_desc_head));
 717                 u8 type = atmel_rmem8(priv, atmel_tx(priv, TX_DESC_PACKET_TYPE_OFFSET, priv->tx_desc_head));
 718
 719                 atmel_wmem8(priv, atmel_tx(priv, TX_DESC_FLAGS_OFFSET, priv->tx_desc_head), 0);
 720
 721                 priv->tx_free_mem += msdu_size;
 722                 priv->tx_desc_free++;
 723
 724                 if (priv->tx_buff_head + msdu_size > (priv->host_info.tx_buff_pos + priv->host_info.tx_buff_size))
 725                         priv->tx_buff_head = 0;
 726                 else
 727                         priv->tx_buff_head += msdu_size;
 728
 729                 if (priv->tx_desc_head < (priv->host_info.tx_desc_count - 1))
 730                         priv->tx_desc_head++ ;
 731                 else
 732                         priv->tx_desc_head = 0;
 733
 734                 if (type == TX_PACKET_TYPE_DATA) {
 735                         if (status == TX_STATUS_SUCCESS)
 736                                 priv->stats.tx_packets++;
 737                         else
 738                                 priv->stats.tx_errors++;
 739                         netif_wake_queue(priv->dev);
 740                 }
 741         }
 742 }
 743
 744 static u16 find_tx_buff(struct atmel_private *priv, u16 len)
 745 {
 746         u16 bottom_free = priv->host_info.tx_buff_size - priv->tx_buff_tail;
 747
 748         if (priv->tx_desc_free == 3 || priv->tx_free_mem < len)
 749                 return 0;
 750
 751         if (bottom_free >= len)
 752                 return priv->host_info.tx_buff_pos + priv->tx_buff_tail;
 753
 754         if (priv->tx_free_mem - bottom_free >= len) {
 755                 priv->tx_buff_tail = 0;
 756                 return priv->host_info.tx_buff_pos;
 757         }
 758
 759         return 0;
 760 }
 761
 762 static void tx_update_descriptor(struct atmel_private *priv, int is_bcast,
 763                                  u16 len, u16 buff, u8 type)
 764 {
 765         atmel_wmem16(priv, atmel_tx(priv, TX_DESC_POS_OFFSET, priv->tx_desc_tail), buff);
 766         atmel_wmem16(priv, atmel_tx(priv, TX_DESC_SIZE_OFFSET, priv->tx_desc_tail), len);
 767         if (!priv->use_wpa)
 768                 atmel_wmem16(priv, atmel_tx(priv, TX_DESC_HOST_LENGTH_OFFSET, priv->tx_desc_tail), len);
 769         atmel_wmem8(priv, atmel_tx(priv, TX_DESC_PACKET_TYPE_OFFSET, priv->tx_desc_tail), type);
 770         atmel_wmem8(priv, atmel_tx(priv, TX_DESC_RATE_OFFSET, priv->tx_desc_tail), priv->tx_rate);
 771         atmel_wmem8(priv, atmel_tx(priv, TX_DESC_RETRY_OFFSET, priv->tx_desc_tail), 0);
 772         if (priv->use_wpa) {
 773                 int cipher_type, cipher_length;
 774                 if (is_bcast) {
 775                         cipher_type = priv->group_cipher_suite;
 776                         if (cipher_type == CIPHER_SUITE_WEP_64 ||
 777                             cipher_type == CIPHER_SUITE_WEP_128)
 778                                 cipher_length = 8;
 779                         else if (cipher_type == CIPHER_SUITE_TKIP)
 780                                 cipher_length = 12;
 781                         else if (priv->pairwise_cipher_suite == CIPHER_SUITE_WEP_64 ||
 782                                  priv->pairwise_cipher_suite == CIPHER_SUITE_WEP_128) {
 783                                 cipher_type = priv->pairwise_cipher_suite;
 784                                 cipher_length = 8;
 785                         } else {
 786                                 cipher_type = CIPHER_SUITE_NONE;
 787                                 cipher_length = 0;
 788                         }
 789                 } else {
 790                         cipher_type = priv->pairwise_cipher_suite;
 791                         if (cipher_type == CIPHER_SUITE_WEP_64 ||
 792                             cipher_type == CIPHER_SUITE_WEP_128)
 793                                 cipher_length = 8;
 794                         else if (cipher_type == CIPHER_SUITE_TKIP)
 795                                 cipher_length = 12;
 796                         else if (priv->group_cipher_suite == CIPHER_SUITE_WEP_64 ||
 797                                  priv->group_cipher_suite == CIPHER_SUITE_WEP_128) {
 798                                 cipher_type = priv->group_cipher_suite;
 799                                 cipher_length = 8;
 800                         } else {
 801                                 cipher_type = CIPHER_SUITE_NONE;
 802                                 cipher_length = 0;
 803                         }
 804                 }
 805
 806                 atmel_wmem8(priv, atmel_tx(priv, TX_DESC_CIPHER_TYPE_OFFSET, priv->tx_desc_tail),
 807                             cipher_type);
 808                 atmel_wmem8(priv, atmel_tx(priv, TX_DESC_CIPHER_LENGTH_OFFSET, priv->tx_desc_tail),
 809                             cipher_length);
 810         }
 811         atmel_wmem32(priv, atmel_tx(priv, TX_DESC_NEXT_OFFSET, priv->tx_desc_tail), 0x80000000L);
 812         atmel_wmem8(priv, atmel_tx(priv, TX_DESC_FLAGS_OFFSET, priv->tx_desc_tail), TX_FIRM_OWN);
 813         if (priv->tx_desc_previous != priv->tx_desc_tail)
 814                 atmel_wmem32(priv, atmel_tx(priv, TX_DESC_NEXT_OFFSET, priv->tx_desc_previous), 0);
 815         priv->tx_desc_previous = priv->tx_desc_tail;
 816         if (priv->tx_desc_tail < (priv->host_info.tx_desc_count - 1))
 817                 priv->tx_desc_tail++;
 818         else
 819                 priv->tx_desc_tail = 0;
 820         priv->tx_desc_free--;
 821         priv->tx_free_mem -= len;
 822 }
 823
 824 static int start_tx(struct sk_buff *skb, struct net_device *dev)
 825 {
 826         struct atmel_private *priv = netdev_priv(dev);
 827         struct ieee80211_hdr_4addr header;
 828         unsigned long flags;
 829         u16 buff, frame_ctl, len = (ETH_ZLEN < skb->len) ? skb->len : ETH_ZLEN;
 830         u8 SNAP_RFC1024[6] = {0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00};
 831
 832         if (priv->card && priv->present_callback &&
 833             !(*priv->present_callback)(priv->card)) {
 834                 priv->stats.tx_errors++;
 835                 dev_kfree_skb(skb);
 836                 return 0;
 837         }
 838
 839         if (priv->station_state != STATION_STATE_READY) {
 840                 priv->stats.tx_errors++;
 841                 dev_kfree_skb(skb);
 842                 return 0;
 843         }
 844
 845         /* first ensure the timer func cannot run */
 846         spin_lock_bh(&priv->timerlock);
 847         /* then stop the hardware ISR */
 848         spin_lock_irqsave(&priv->irqlock, flags);
 849         /* nb doing the above in the opposite order will deadlock */
 850
 851         /* The Wireless Header is 30 bytes. In the Ethernet packet we "cut" the
 852            12 first bytes (containing DA/SA) and put them in the appropriate
 853            fields of the Wireless Header. Thus the packet length is then the
 854            initial + 18 (+30-12) */
 855
 856         if (!(buff = find_tx_buff(priv, len + 18))) {
 857                 priv->stats.tx_dropped++;
 858                 spin_unlock_irqrestore(&priv->irqlock, flags);
 859                 spin_unlock_bh(&priv->timerlock);
 860                 netif_stop_queue(dev);
 861                 return 1;
 862         }
 863
 864         frame_ctl = IEEE80211_FTYPE_DATA;
 865         header.duration_id = 0;
 866         header.seq_ctl = 0;
 867         if (priv->wep_is_on)
 868                 frame_ctl |= IEEE80211_FCTL_PROTECTED;
 869         if (priv->operating_mode == IW_MODE_ADHOC) {
 870                 memcpy(&header.addr1, skb->data, 6);
 871                 memcpy(&header.addr2, dev->dev_addr, 6);
 872                 memcpy(&header.addr3, priv->BSSID, 6);
 873         } else {
 874                 frame_ctl |= IEEE80211_FCTL_TODS;
 875                 memcpy(&header.addr1, priv->CurrentBSSID, 6);
 876                 memcpy(&header.addr2, dev->dev_addr, 6);
 877                 memcpy(&header.addr3, skb->data, 6);
 878         }
 879
 880         if (priv->use_wpa)
 881                 memcpy(&header.addr4, SNAP_RFC1024, 6);
 882
 883         header.frame_ctl = cpu_to_le16(frame_ctl);
 884         /* Copy the wireless header into the card */
 885         atmel_copy_to_card(dev, buff, (unsigned char *)&header, DATA_FRAME_WS_HEADER_SIZE);
 886         /* Copy the packet sans its 802.3 header addresses which have been replaced */
 887         atmel_copy_to_card(dev, buff + DATA_FRAME_WS_HEADER_SIZE, skb->data + 12, len - 12);
 888         priv->tx_buff_tail += len - 12 + DATA_FRAME_WS_HEADER_SIZE;
 889
 890         /* low bit of first byte of destination tells us if broadcast */
 891         tx_update_descriptor(priv, *(skb->data) & 0x01, len + 18, buff, TX_PACKET_TYPE_DATA);
 892         dev->trans_start = jiffies;
 893         priv->stats.tx_bytes += len;
 894
 895         spin_unlock_irqrestore(&priv->irqlock, flags);
 896         spin_unlock_bh(&priv->timerlock);
 897         dev_kfree_skb(skb);
 898
 899         return 0;
 900 }
 901
 902 static void atmel_transmit_management_frame(struct atmel_private *priv,
 903                                             struct ieee80211_hdr_4addr *header,
 904                                             u8 *body, int body_len)
 905 {
 906         u16 buff;
 907         int len = MGMT_FRAME_BODY_OFFSET + body_len;
 908
 909         if (!(buff = find_tx_buff(priv, len)))
 910                 return;
 911
 912         atmel_copy_to_card(priv->dev, buff, (u8 *)header, MGMT_FRAME_BODY_OFFSET);
 913         atmel_copy_to_card(priv->dev, buff + MGMT_FRAME_BODY_OFFSET, body, body_len);
 914         priv->tx_buff_tail += len;
 915         tx_update_descriptor(priv, header->addr1[0] & 0x01, len, buff, TX_PACKET_TYPE_MGMT);
 916 }
 917
 918 static void fast_rx_path(struct atmel_private *priv,
 919                          struct ieee80211_hdr_4addr *header,
 920                          u16 msdu_size, u16 rx_packet_loc, u32 crc)
 921 {
 922         /* fast path: unfragmented packet copy directly into skbuf */
 923         u8 mac4[6];
 924         struct sk_buff  *skb;
 925         unsigned char *skbp;
 926
 927         /* get the final, mac 4 header field, this tells us encapsulation */
 928         atmel_copy_to_host(priv->dev, mac4, rx_packet_loc + 24, 6);
 929         msdu_size -= 6;
 930
 931         if (priv->do_rx_crc) {
 932                 crc = crc32_le(crc, mac4, 6);
 933                 msdu_size -= 4;
 934         }
 935
 936         if (!(skb = dev_alloc_skb(msdu_size + 14))) {
 937                 priv->stats.rx_dropped++;
 938                 return;
 939         }
 940
 941         skb_reserve(skb, 2);
 942         skbp = skb_put(skb, msdu_size + 12);
 943         atmel_copy_to_host(priv->dev, skbp + 12, rx_packet_loc + 30, msdu_size);
 944
 945         if (priv->do_rx_crc) {
 946                 u32 netcrc;
 947                 crc = crc32_le(crc, skbp + 12, msdu_size);
 948                 atmel_copy_to_host(priv->dev, (void *)&netcrc, rx_packet_loc + 30 + msdu_size, 4);
 949                 if ((crc ^ 0xffffffff) != netcrc) {
 950                         priv->stats.rx_crc_errors++;
 951                         dev_kfree_skb(skb);
 952                         return;
 953                 }
 954         }
 955
 956         memcpy(skbp, header->addr1, 6); /* destination address */
 957         if (le16_to_cpu(header->frame_ctl) & IEEE80211_FCTL_FROMDS)
 958                 memcpy(&skbp[6], header->addr3, 6);
 959         else
 960                 memcpy(&skbp[6], header->addr2, 6); /* source address */
 961
 962         priv->dev->last_rx = jiffies;
 963         skb->dev = priv->dev;
 964         skb->protocol = eth_type_trans(skb, priv->dev);
 965         skb->ip_summed = CHECKSUM_NONE;
 966         netif_rx(skb);
 967         priv->stats.rx_bytes += 12 + msdu_size;
 968         priv->stats.rx_packets++;
 969 }
 970
 971 /* Test to see if the packet in card memory at packet_loc has a valid CRC
 972    It doesn't matter that this is slow: it is only used to proble the first few
 973    packets. */
 974 static int probe_crc(struct atmel_private *priv, u16 packet_loc, u16 msdu_size)
 975 {
 976         int i = msdu_size - 4;
 977         u32 netcrc, crc = 0xffffffff;
 978
 979         if (msdu_size < 4)
 980                 return 0;
 981
 982         atmel_copy_to_host(priv->dev, (void *)&netcrc, packet_loc + i, 4);
 983
 984         atmel_writeAR(priv->dev, packet_loc);
 985         while (i--) {
 986                 u8 octet = atmel_read8(priv->dev, DR);
 987                 crc = crc32_le(crc, &octet, 1);
 988         }
 989
 990         return (crc ^ 0xffffffff) == netcrc;
 991 }
 992
 993 static void frag_rx_path(struct atmel_private *priv,
 994                          struct ieee80211_hdr_4addr *header,
 995                          u16 msdu_size, u16 rx_packet_loc, u32 crc, u16 seq_no,
 996                          u8 frag_no, int more_frags)
 997 {
 998         u8 mac4[6];
 999         u8 source[6];
1000         struct sk_buff *skb;
1001
1002         if (le16_to_cpu(header->frame_ctl) & IEEE80211_FCTL_FROMDS)
1003                 memcpy(source, header->addr3, 6);
1004         else
1005                 memcpy(source, header->addr2, 6);
1006
1007         rx_packet_loc += 24; /* skip header */
1008
1009         if (priv->do_rx_crc)
1010                 msdu_size -= 4;
1011
1012         if (frag_no == 0) { /* first fragment */
1013                 atmel_copy_to_host(priv->dev, mac4, rx_packet_loc, 6);
1014                 msdu_size -= 6;
1015                 rx_packet_loc += 6;
1016
1017                 if (priv->do_rx_crc)
1018                         crc = crc32_le(crc, mac4, 6);
1019
1020                 priv->frag_seq = seq_no;
1021                 priv->frag_no = 1;
1022                 priv->frag_len = msdu_size;
1023                 memcpy(priv->frag_source, source, 6);
1024                 memcpy(&priv->rx_buf[6], source, 6);
1025                 memcpy(priv->rx_buf, header->addr1, 6);
1026
1027                 atmel_copy_to_host(priv->dev, &priv->rx_buf[12], rx_packet_loc, msdu_size);
1028
1029                 if (priv->do_rx_crc) {
1030                         u32 netcrc;
1031                         crc = crc32_le(crc, &priv->rx_buf[12], msdu_size);
1032                         atmel_copy_to_host(priv->dev, (void *)&netcrc, rx_packet_loc + msdu_size, 4);
1033                         if ((crc ^ 0xffffffff) != netcrc) {
1034                                 priv->stats.rx_crc_errors++;
1035                                 memset(priv->frag_source, 0xff, 6);
1036                         }
1037                 }
1038
1039         } else if (priv->frag_no == frag_no &&
1040                    priv->frag_seq == seq_no &&
1041                    memcmp(priv->frag_source, source, 6) == 0) {
1042
1043                 atmel_copy_to_host(priv->dev, &priv->rx_buf[12 + priv->frag_len],
1044                                    rx_packet_loc, msdu_size);
1045                 if (priv->do_rx_crc) {
1046                         u32 netcrc;
1047                         crc = crc32_le(crc,
1048                                        &priv->rx_buf[12 + priv->frag_len],
1049                                        msdu_size);
1050                         atmel_copy_to_host(priv->dev, (void *)&netcrc, rx_packet_loc + msdu_size, 4);
1051                         if ((crc ^ 0xffffffff) != netcrc) {
1052                                 priv->stats.rx_crc_errors++;
1053                                 memset(priv->frag_source, 0xff, 6);
1054                                 more_frags = 1; /* don't send broken assembly */
1055                         }
1056                 }
1057
1058                 priv->frag_len += msdu_size;
1059                 priv->frag_no++;
1060
1061                 if (!more_frags) { /* last one */
1062                         memset(priv->frag_source, 0xff, 6);
1063                         if (!(skb = dev_alloc_skb(priv->frag_len + 14))) {
1064                                 priv->stats.rx_dropped++;
1065                         } else {
1066                                 skb_reserve(skb, 2);
1067                                 memcpy(skb_put(skb, priv->frag_len + 12),
1068                                        priv->rx_buf,
1069                                        priv->frag_len + 12);
1070                                 priv->dev->last_rx = jiffies;
1071                                 skb->dev = priv->dev;
1072                                 skb->protocol = eth_type_trans(skb, priv->dev);
1073                                 skb->ip_summed = CHECKSUM_NONE;
1074                                 netif_rx(skb);
1075                                 priv->stats.rx_bytes += priv->frag_len + 12;
1076                                 priv->stats.rx_packets++;
1077                         }
1078                 }
1079         } else
1080                 priv->wstats.discard.fragment++;
1081 }
1082
1083 static void rx_done_irq(struct atmel_private *priv)
1084 {
1085         int i;
1086         struct ieee80211_hdr_4addr header;
1087
1088         for (i = 0;
1089              atmel_rmem8(priv, atmel_rx(priv, RX_DESC_FLAGS_OFFSET, priv->rx_desc_head)) == RX_DESC_FLAG_VALID &&
1090                      i < priv->host_info.rx_desc_count;
1091              i++) {
1092
1093                 u16 msdu_size, rx_packet_loc, frame_ctl, seq_control;
1094                 u8 status = atmel_rmem8(priv, atmel_rx(priv, RX_DESC_STATUS_OFFSET, priv->rx_desc_head));
1095                 u32 crc = 0xffffffff;
1096
1097                 if (status != RX_STATUS_SUCCESS) {
1098                         if (status == 0xc1) /* determined by experiment */
1099                                 priv->wstats.discard.nwid++;
1100                         else
1101                                 priv->stats.rx_errors++;
1102                         goto next;
1103                 }
1104
1105                 msdu_size = atmel_rmem16(priv, atmel_rx(priv, RX_DESC_MSDU_SIZE_OFFSET, priv->rx_desc_head));
1106                 rx_packet_loc = atmel_rmem16(priv, atmel_rx(priv, RX_DESC_MSDU_POS_OFFSET, priv->rx_desc_head));
1107
1108                 if (msdu_size < 30) {
1109                         priv->stats.rx_errors++;
1110                         goto next;
1111                 }
1112
1113                 /* Get header as far as end of seq_ctl */
1114                 atmel_copy_to_host(priv->dev, (char *)&header, rx_packet_loc, 24);
1115                 frame_ctl = le16_to_cpu(header.frame_ctl);
1116                 seq_control = le16_to_cpu(header.seq_ctl);
1117
1118                 /* probe for CRC use here if needed  once five packets have
1119                    arrived with the same crc status, we assume we know what's
1120                    happening and stop probing */
1121                 if (priv->probe_crc) {
1122                         if (!priv->wep_is_on || !(frame_ctl & IEEE80211_FCTL_PROTECTED)) {
1123                                 priv->do_rx_crc = probe_crc(priv, rx_packet_loc, msdu_size);
1124                         } else {
1125                                 priv->do_rx_crc = probe_crc(priv, rx_packet_loc + 24, msdu_size - 24);
1126                         }
1127                         if (priv->do_rx_crc) {
1128                                 if (priv->crc_ok_cnt++ > 5)
1129                                         priv->probe_crc = 0;
1130                         } else {
1131                                 if (priv->crc_ko_cnt++ > 5)
1132                                         priv->probe_crc = 0;
1133                         }
1134                 }
1135
1136                 /* don't CRC header when WEP in use */
1137                 if (priv->do_rx_crc && (!priv->wep_is_on || !(frame_ctl & IEEE80211_FCTL_PROTECTED))) {
1138                         crc = crc32_le(0xffffffff, (unsigned char *)&header, 24);
1139                 }
1140                 msdu_size -= 24; /* header */
1141
1142                 if ((frame_ctl & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA) {
1143                         int more_fragments = frame_ctl & IEEE80211_FCTL_MOREFRAGS;
1144                         u8 packet_fragment_no = seq_control & IEEE80211_SCTL_FRAG;
1145                         u16 packet_sequence_no = (seq_control & IEEE80211_SCTL_SEQ) >> 4;
1146
1147                         if (!more_fragments && packet_fragment_no == 0) {
1148                                 fast_rx_path(priv, &header, msdu_size, rx_packet_loc, crc);
1149                         } else {
1150                                 frag_rx_path(priv, &header, msdu_size, rx_packet_loc, crc,
1151                                              packet_sequence_no, packet_fragment_no, more_fragments);
1152                         }
1153                 }
1154
1155                 if ((frame_ctl & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT) {
1156                         /* copy rest of packet into buffer */
1157                         atmel_copy_to_host(priv->dev, (unsigned char *)&priv->rx_buf, rx_packet_loc + 24, msdu_size);
1158
1159                         /* we use the same buffer for frag reassembly and control packets */
1160                         memset(priv->frag_source, 0xff, 6);
1161
1162                         if (priv->do_rx_crc) {
1163                                 /* last 4 octets is crc */
1164                                 msdu_size -= 4;
1165                                 crc = crc32_le(crc, (unsigned char *)&priv->rx_buf, msdu_size);
1166                                 if ((crc ^ 0xffffffff) != (*((u32 *)&priv->rx_buf[msdu_size]))) {
1167                                         priv->stats.rx_crc_errors++;
1168                                         goto next;
1169                                 }
1170                         }
1171
1172                         atmel_management_frame(priv, &header, msdu_size,
1173                                                atmel_rmem8(priv, atmel_rx(priv, RX_DESC_RSSI_OFFSET, priv->rx_desc_head)));
1174                 }
1175
1176 next:
1177                 /* release descriptor */
1178                 atmel_wmem8(priv, atmel_rx(priv, RX_DESC_FLAGS_OFFSET, priv->rx_desc_head), RX_DESC_FLAG_CONSUMED);
1179
1180                 if (priv->rx_desc_head < (priv->host_info.rx_desc_count - 1))
1181                         priv->rx_desc_head++;
1182                 else
1183                         priv->rx_desc_head = 0;
1184         }
1185 }
1186
1187 static irqreturn_t service_interrupt(int irq, void *dev_id, struct pt_regs *regs)
1188 {
1189         struct net_device *dev = (struct net_device *) dev_id;
1190         struct atmel_private *priv = netdev_priv(dev);
1191         u8 isr;
1192         int i = -1;
1193         static u8 irq_order[] = {
1194                 ISR_OUT_OF_RANGE,
1195                 ISR_RxCOMPLETE,
1196                 ISR_TxCOMPLETE,
1197                 ISR_RxFRAMELOST,
1198                 ISR_FATAL_ERROR,
1199                 ISR_COMMAND_COMPLETE,
1200                 ISR_IBSS_MERGE,
1201                 ISR_GENERIC_IRQ
1202         };
1203
1204         if (priv->card && priv->present_callback &&
1205             !(*priv->present_callback)(priv->card))
1206                 return IRQ_HANDLED;
1207
1208         /* In this state upper-level code assumes it can mess with
1209            the card unhampered by interrupts which may change register state.
1210            Note that even though the card shouldn't generate interrupts
1211            the inturrupt line may be shared. This allows card setup
1212            to go on without disabling interrupts for a long time. */
1213         if (priv->station_state == STATION_STATE_DOWN)
1214                 return IRQ_NONE;
1215
1216         atmel_clear_gcr(dev, GCR_ENINT); /* disable interrupts */
1217
1218         while (1) {
1219                 if (!atmel_lock_mac(priv)) {
1220                         /* failed to contact card */
1221                         printk(KERN_ALERT "%s: failed to contact MAC.\n", dev->name);
1222                         return IRQ_HANDLED;
1223                 }
1224
1225                 isr = atmel_rmem8(priv, atmel_hi(priv, IFACE_INT_STATUS_OFFSET));
1226                 atmel_wmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_MAC_OFFSET), 0);
1227
1228                 if (!isr) {
1229                         atmel_set_gcr(dev, GCR_ENINT); /* enable interrupts */
1230                         return i == -1 ? IRQ_NONE : IRQ_HANDLED;
1231                 }
1232
1233                 atmel_set_gcr(dev, GCR_ACKINT); /* acknowledge interrupt */
1234
1235                 for (i = 0; i < sizeof(irq_order)/sizeof(u8); i++)
1236                         if (isr & irq_order[i])
1237                                 break;
1238
1239                 if (!atmel_lock_mac(priv)) {
1240                         /* failed to contact card */
1241                         printk(KERN_ALERT "%s: failed to contact MAC.\n", dev->name);
1242                         return IRQ_HANDLED;
1243                 }
1244
1245                 isr = atmel_rmem8(priv, atmel_hi(priv, IFACE_INT_STATUS_OFFSET));
1246                 isr ^= irq_order[i];
1247                 atmel_wmem8(priv, atmel_hi(priv, IFACE_INT_STATUS_OFFSET), isr);
1248                 atmel_wmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_MAC_OFFSET), 0);
1249
1250                 switch (irq_order[i]) {
1251
1252                 case ISR_OUT_OF_RANGE:
1253                         if (priv->operating_mode == IW_MODE_INFRA &&
1254                             priv->station_state == STATION_STATE_READY) {
1255                                 priv->station_is_associated = 0;
1256                                 atmel_scan(priv, 1);
1257                         }
1258                         break;
1259
1260                 case ISR_RxFRAMELOST:
1261                         priv->wstats.discard.misc++;
1262                         /* fall through */
1263                 case ISR_RxCOMPLETE:
1264                         rx_done_irq(priv);
1265                         break;
1266
1267                 case ISR_TxCOMPLETE:
1268                         tx_done_irq(priv);
1269                         break;
1270
1271                 case ISR_FATAL_ERROR:
1272                         printk(KERN_ALERT "%s: *** FATAL error interrupt ***\n", dev->name);
1273                         atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
1274                         break;
1275
1276                 case ISR_COMMAND_COMPLETE:
1277                         atmel_command_irq(priv);
1278                         break;
1279
1280                 case ISR_IBSS_MERGE:
1281                         atmel_get_mib(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_CUR_BSSID_POS,
1282                                       priv->CurrentBSSID, 6);
1283                         /* The WPA stuff cares about the current AP address */
1284                         if (priv->use_wpa)
1285                                 build_wpa_mib(priv);
1286                         break;
1287                 case ISR_GENERIC_IRQ:
1288                         printk(KERN_INFO "%s: Generic_irq received.\n", dev->name);
1289                         break;
1290                 }
1291         }
1292 }
1293
1294 static struct net_device_stats *atmel_get_stats(struct net_device *dev)
1295 {
1296         struct atmel_private *priv = netdev_priv(dev);
1297         return &priv->stats;
1298 }
1299
1300 static struct iw_statistics *atmel_get_wireless_stats(struct net_device *dev)
1301 {
1302         struct atmel_private *priv = netdev_priv(dev);
1303
1304         /* update the link quality here in case we are seeing no beacons
1305            at all to drive the process */
1306         atmel_smooth_qual(priv);
1307
1308         priv->wstats.status = priv->station_state;
1309
1310         if (priv->operating_mode == IW_MODE_INFRA) {
1311                 if (priv->station_state != STATION_STATE_READY) {
1312                         priv->wstats.qual.qual = 0;
1313                         priv->wstats.qual.level = 0;
1314                         priv->wstats.qual.updated = (IW_QUAL_QUAL_INVALID
1315                                         | IW_QUAL_LEVEL_INVALID);
1316                 }
1317                 priv->wstats.qual.noise = 0;
1318                 priv->wstats.qual.updated |= IW_QUAL_NOISE_INVALID;
1319         } else {
1320                 /* Quality levels cannot be determined in ad-hoc mode,
1321                    because we can 'hear' more that one remote station. */
1322                 priv->wstats.qual.qual = 0;
1323                 priv->wstats.qual.level = 0;
1324                 priv->wstats.qual.noise = 0;
1325                 priv->wstats.qual.updated = IW_QUAL_QUAL_INVALID
1326                                         | IW_QUAL_LEVEL_INVALID
1327                                         | IW_QUAL_NOISE_INVALID;
1328                 priv->wstats.miss.beacon = 0;
1329         }
1330
1331         return &priv->wstats;
1332 }
1333
1334 static int atmel_change_mtu(struct net_device *dev, int new_mtu)
1335 {
1336         if ((new_mtu < 68) || (new_mtu > 2312))
1337                 return -EINVAL;
1338         dev->mtu = new_mtu;
1339         return 0;
1340 }
1341
1342 static int atmel_set_mac_address(struct net_device *dev, void *p)
1343 {
1344         struct sockaddr *addr = p;
1345
1346         memcpy (dev->dev_addr, addr->sa_data, dev->addr_len);
1347         return atmel_open(dev);
1348 }
1349
1350 EXPORT_SYMBOL(atmel_open);
1351
1352 int atmel_open(struct net_device *dev)
1353 {
1354         struct atmel_private *priv = netdev_priv(dev);
1355         int i, channel;
1356
1357         /* any scheduled timer is no longer needed and might screw things up.. */
1358         del_timer_sync(&priv->management_timer);
1359
1360         /* Interrupts will not touch the card once in this state... */
1361         priv->station_state = STATION_STATE_DOWN;
1362
1363         if (priv->new_SSID_size) {
1364                 memcpy(priv->SSID, priv->new_SSID, priv->new_SSID_size);
1365                 priv->SSID_size = priv->new_SSID_size;
1366                 priv->new_SSID_size = 0;
1367         }
1368         priv->BSS_list_entries = 0;
1369
1370         priv->AuthenticationRequestRetryCnt = 0;
1371         priv->AssociationRequestRetryCnt = 0;
1372         priv->ReAssociationRequestRetryCnt = 0;
1373         priv->CurrentAuthentTransactionSeqNum = 0x0001;
1374         priv->ExpectedAuthentTransactionSeqNum = 0x0002;
1375
1376         priv->site_survey_state = SITE_SURVEY_IDLE;
1377         priv->station_is_associated = 0;
1378
1379         if (!reset_atmel_card(dev))
1380                 return -EAGAIN;
1381
1382         if (priv->config_reg_domain) {
1383                 priv->reg_domain = priv->config_reg_domain;
1384                 atmel_set_mib8(priv, Phy_Mib_Type, PHY_MIB_REG_DOMAIN_POS, priv->reg_domain);
1385         } else {
1386                 priv->reg_domain = atmel_get_mib8(priv, Phy_Mib_Type, PHY_MIB_REG_DOMAIN_POS);
1387                 for (i = 0; i < sizeof(channel_table)/sizeof(channel_table[0]); i++)
1388                         if (priv->reg_domain == channel_table[i].reg_domain)
1389                                 break;
1390                 if (i == sizeof(channel_table)/sizeof(channel_table[0])) {
1391                         priv->reg_domain = REG_DOMAIN_MKK1;
1392                         printk(KERN_ALERT "%s: failed to get regulatory domain: assuming MKK1.\n", dev->name);
1393                 }
1394         }
1395
1396         if ((channel = atmel_validate_channel(priv, priv->channel)))
1397                 priv->channel = channel;
1398
1399         /* this moves station_state on.... */
1400         atmel_scan(priv, 1);
1401
1402         atmel_set_gcr(priv->dev, GCR_ENINT); /* enable interrupts */
1403         return 0;
1404 }
1405
1406 static int atmel_close(struct net_device *dev)
1407 {
1408         struct atmel_private *priv = netdev_priv(dev);
1409
1410         atmel_enter_state(priv, STATION_STATE_DOWN);
1411
1412         if (priv->bus_type == BUS_TYPE_PCCARD)
1413                 atmel_write16(dev, GCR, 0x0060);
1414         atmel_write16(dev, GCR, 0x0040);
1415         return 0;
1416 }
1417
1418 static int atmel_validate_channel(struct atmel_private *priv, int channel)
1419 {
1420         /* check that channel is OK, if so return zero,
1421            else return suitable default channel */
1422         int i;
1423
1424         for (i = 0; i < sizeof(channel_table)/sizeof(channel_table[0]); i++)
1425                 if (priv->reg_domain == channel_table[i].reg_domain) {
1426                         if (channel >= channel_table[i].min &&
1427                             channel <= channel_table[i].max)
1428                                 return 0;
1429                         else
1430                                 return channel_table[i].min;
1431                 }
1432         return 0;
1433 }
1434
1435 static int atmel_proc_output (char *buf, struct atmel_private *priv)
1436 {
1437         int i;
1438         char *p = buf;
1439         char *s, *r, *c;
1440
1441         p += sprintf(p, "Driver version:\t\t%d.%d\n",
1442                      DRIVER_MAJOR, DRIVER_MINOR);
1443
1444         if (priv->station_state != STATION_STATE_DOWN) {
1445                 p += sprintf(p, "Firmware version:\t%d.%d build %d\n"
1446                                 "Firmware location:\t",
1447                              priv->host_info.major_version,
1448                              priv->host_info.minor_version,
1449                              priv->host_info.build_version);
1450
1451                 if (priv->card_type != CARD_TYPE_EEPROM)
1452                         p += sprintf(p, "on card\n");
1453                 else if (priv->firmware)
1454                         p += sprintf(p, "%s loaded by host\n",
1455                                      priv->firmware_id);
1456                 else
1457                         p += sprintf(p, "%s loaded by hotplug\n",
1458                                      priv->firmware_id);
1459
1460                 switch (priv->card_type) {
1461                 case CARD_TYPE_PARALLEL_FLASH: c = "Parallel flash"; break;
1462                 case CARD_TYPE_SPI_FLASH: c = "SPI flash\n"; break;
1463                 case CARD_TYPE_EEPROM: c = "EEPROM"; break;
1464                 default: c = "<unknown>";
1465                 }
1466
1467                 r = "<unknown>";
1468                 for (i = 0; i < sizeof(channel_table)/sizeof(channel_table[0]); i++)
1469                         if (priv->reg_domain == channel_table[i].reg_domain)
1470                                 r = channel_table[i].name;
1471
1472                 p += sprintf(p, "MAC memory type:\t%s\n", c);
1473                 p += sprintf(p, "Regulatory domain:\t%s\n", r);
1474                 p += sprintf(p, "Host CRC checking:\t%s\n",
1475                              priv->do_rx_crc ? "On" : "Off");
1476                 p += sprintf(p, "WPA-capable firmware:\t%s\n",
1477                              priv->use_wpa ? "Yes" : "No");
1478         }
1479
1480         switch(priv->station_state) {
1481         case STATION_STATE_SCANNING: s = "Scanning"; break;
1482         case STATION_STATE_JOINNING: s = "Joining"; break;
1483         case STATION_STATE_AUTHENTICATING: s = "Authenticating"; break;
1484         case STATION_STATE_ASSOCIATING: s = "Associating"; break;
1485         case STATION_STATE_READY: s = "Ready"; break;
1486         case STATION_STATE_REASSOCIATING: s = "Reassociating"; break;
1487         case STATION_STATE_MGMT_ERROR: s = "Management error"; break;
1488         case STATION_STATE_DOWN: s = "Down"; break;
1489         default: s = "<unknown>";
1490         }
1491
1492         p += sprintf(p, "Current state:\t\t%s\n", s);
1493         return p - buf;
1494 }
1495
1496 static int atmel_read_proc(char *page, char **start, off_t off,
1497                            int count, int *eof, void *data)
1498 {
1499         struct atmel_private *priv = data;
1500         int len = atmel_proc_output (page, priv);
1501         if (len <= off+count) *eof = 1;
1502         *start = page + off;
1503         len -= off;
1504         if (len>count) len = count;
1505         if (len<0) len = 0;
1506         return len;
1507 }
1508
1509 struct net_device *init_atmel_card(unsigned short irq, unsigned long port,
1510                                    const AtmelFWType fw_type,
1511                                    struct device *sys_dev,
1512                                    int (*card_present)(void *), void *card)
1513 {
1514         struct proc_dir_entry *ent;
1515         struct net_device *dev;
1516         struct atmel_private *priv;
1517         int rc;
1518
1519         /* Create the network device object. */
1520         dev = alloc_etherdev(sizeof(*priv));
1521         if (!dev) {
1522                 printk(KERN_ERR "atmel: Couldn't alloc_etherdev\n");
1523                 return NULL;
1524         }
1525         if (dev_alloc_name(dev, dev->name) < 0) {
1526                 printk(KERN_ERR "atmel: Couldn't get name!\n");
1527                 goto err_out_free;
1528         }
1529
1530         priv = netdev_priv(dev);
1531         priv->dev = dev;
1532         priv->sys_dev = sys_dev;
1533         priv->present_callback = card_present;
1534         priv->card = card;
1535         priv->firmware = NULL;
1536         priv->firmware_id[0] = '\0';
1537         priv->firmware_type = fw_type;
1538         if (firmware) /* module parameter */
1539                 strcpy(priv->firmware_id, firmware);
1540         priv->bus_type = card_present ? BUS_TYPE_PCCARD : BUS_TYPE_PCI;
1541         priv->station_state = STATION_STATE_DOWN;
1542         priv->do_rx_crc = 0;
1543         /* For PCMCIA cards, some chips need CRC, some don't
1544            so we have to probe. */
1545         if (priv->bus_type == BUS_TYPE_PCCARD) {
1546                 priv->probe_crc = 1;
1547                 priv->crc_ok_cnt = priv->crc_ko_cnt = 0;
1548         } else
1549                 priv->probe_crc = 0;
1550         memset(&priv->stats, 0, sizeof(priv->stats));
1551         memset(&priv->wstats, 0, sizeof(priv->wstats));
1552         priv->last_qual = jiffies;
1553         priv->last_beacon_timestamp = 0;
1554         memset(priv->frag_source, 0xff, sizeof(priv->frag_source));
1555         memset(priv->BSSID, 0, 6);
1556         priv->CurrentBSSID[0] = 0xFF; /* Initialize to something invalid.... */
1557         priv->station_was_associated = 0;
1558
1559         priv->last_survey = jiffies;
1560         priv->preamble = LONG_PREAMBLE;
1561         priv->operating_mode = IW_MODE_INFRA;
1562         priv->connect_to_any_BSS = 0;
1563         priv->config_reg_domain = 0;
1564         priv->reg_domain = 0;
1565         priv->tx_rate = 3;
1566         priv->auto_tx_rate = 1;
1567         priv->channel = 4;
1568         priv->power_mode = 0;
1569         priv->SSID[0] = '\0';
1570         priv->SSID_size = 0;
1571         priv->new_SSID_size = 0;
1572         priv->frag_threshold = 2346;
1573         priv->rts_threshold = 2347;
1574         priv->short_retry = 7;
1575         priv->long_retry = 4;
1576
1577         priv->wep_is_on = 0;
1578         priv->default_key = 0;
1579         priv->encryption_level = 0;
1580         priv->exclude_unencrypted = 0;
1581         priv->group_cipher_suite = priv->pairwise_cipher_suite = CIPHER_SUITE_NONE;
1582         priv->use_wpa = 0;
1583         memset(priv->wep_keys, 0, sizeof(priv->wep_keys));
1584         memset(priv->wep_key_len, 0, sizeof(priv->wep_key_len));
1585
1586         priv->default_beacon_period = priv->beacon_period = 100;
1587         priv->listen_interval = 1;
1588
1589         init_timer(&priv->management_timer);
1590         spin_lock_init(&priv->irqlock);
1591         spin_lock_init(&priv->timerlock);
1592         priv->management_timer.function = atmel_management_timer;
1593         priv->management_timer.data = (unsigned long) dev;
1594
1595         dev->open = atmel_open;
1596         dev->stop = atmel_close;
1597         dev->change_mtu = atmel_change_mtu;
1598         dev->set_mac_address = atmel_set_mac_address;
1599         dev->hard_start_xmit = start_tx;
1600         dev->get_stats = atmel_get_stats;
1601         dev->wireless_handlers = (struct iw_handler_def *)&atmel_handler_def;
1602         dev->do_ioctl = atmel_ioctl;
1603         dev->irq = irq;
1604         dev->base_addr = port;
1605
1606         SET_NETDEV_DEV(dev, sys_dev);
1607
1608         if ((rc = request_irq(dev->irq, service_interrupt, SA_SHIRQ, dev->name, dev))) {
1609                 printk(KERN_ERR "%s: register interrupt %d failed, rc %d\n", dev->name, irq, rc);
1610                 goto err_out_free;
1611         }
1612
1613         if (!request_region(dev->base_addr, 32,
1614                             priv->bus_type == BUS_TYPE_PCCARD ?  "atmel_cs" : "atmel_pci")) {
1615                 goto err_out_irq;
1616         }
1617
1618         if (register_netdev(dev))
1619                 goto err_out_res;
1620
1621         if (!probe_atmel_card(dev)){
1622                 unregister_netdev(dev);
1623                 goto err_out_res;
1624         }
1625
1626         netif_carrier_off(dev);
1627
1628         ent = create_proc_read_entry ("driver/atmel", 0, NULL, atmel_read_proc, priv);
1629         if (!ent)
1630                 printk(KERN_WARNING "atmel: unable to create /proc entry.\n");
1631
1632         printk(KERN_INFO "%s: Atmel at76c50x. Version %d.%d. MAC %.2x:%.2x:%.2x:%.2x:%.2x:%.2x\n",
1633                dev->name, DRIVER_MAJOR, DRIVER_MINOR,
1634                dev->dev_addr[0], dev->dev_addr[1], dev->dev_addr[2],
1635                dev->dev_addr[3], dev->dev_addr[4], dev->dev_addr[5] );
1636
1637         SET_MODULE_OWNER(dev);
1638         return dev;
1639
1640 err_out_res:
1641         release_region( dev->base_addr, 32);
1642 err_out_irq:
1643         free_irq(dev->irq, dev);
1644 err_out_free:
1645         free_netdev(dev);
1646         return NULL;
1647 }
1648
1649 EXPORT_SYMBOL(init_atmel_card);
1650
1651 void stop_atmel_card(struct net_device *dev)
1652 {
1653         struct atmel_private *priv = netdev_priv(dev);
1654
1655         /* put a brick on it... */
1656         if (priv->bus_type == BUS_TYPE_PCCARD)
1657                 atmel_write16(dev, GCR, 0x0060);
1658         atmel_write16(dev, GCR, 0x0040);
1659
1660         del_timer_sync(&priv->management_timer);
1661         unregister_netdev(dev);
1662         remove_proc_entry("driver/atmel", NULL);
1663         free_irq(dev->irq, dev);
1664         kfree(priv->firmware);
1665         release_region(dev->base_addr, 32);
1666         free_netdev(dev);
1667 }
1668
1669 EXPORT_SYMBOL(stop_atmel_card);
1670
1671 static int atmel_set_essid(struct net_device *dev,
1672                            struct iw_request_info *info,
1673                            struct iw_point *dwrq,
1674                            char *extra)
1675 {
1676         struct atmel_private *priv = netdev_priv(dev);
1677
1678         /* Check if we asked for `any' */
1679         if(dwrq->flags == 0) {
1680                 priv->connect_to_any_BSS = 1;
1681         } else {
1682                 int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
1683
1684                 priv->connect_to_any_BSS = 0;
1685
1686                 /* Check the size of the string */
1687                 if (dwrq->length > MAX_SSID_LENGTH + 1)
1688                          return -E2BIG;
1689                 if (index != 0)
1690                         return -EINVAL;
1691
1692                 memcpy(priv->new_SSID, extra, dwrq->length - 1);
1693                 priv->new_SSID_size = dwrq->length - 1;
1694         }
1695
1696         return -EINPROGRESS;
1697 }
1698
1699 static int atmel_get_essid(struct net_device *dev,
1700                            struct iw_request_info *info,
1701                            struct iw_point *dwrq,
1702                            char *extra)
1703 {
1704         struct atmel_private *priv = netdev_priv(dev);
1705
1706         /* Get the current SSID */
1707         if (priv->new_SSID_size != 0) {
1708                 memcpy(extra, priv->new_SSID, priv->new_SSID_size);
1709                 extra[priv->new_SSID_size] = '\0';
1710                 dwrq->length = priv->new_SSID_size + 1;
1711         } else {
1712                 memcpy(extra, priv->SSID, priv->SSID_size);
1713                 extra[priv->SSID_size] = '\0';
1714                 dwrq->length = priv->SSID_size + 1;
1715         }
1716
1717         dwrq->flags = !priv->connect_to_any_BSS; /* active */
1718
1719         return 0;
1720 }
1721
1722 static int atmel_get_wap(struct net_device *dev,
1723                          struct iw_request_info *info,
1724                          struct sockaddr *awrq,
1725                          char *extra)
1726 {
1727         struct atmel_private *priv = netdev_priv(dev);
1728         memcpy(awrq->sa_data, priv->CurrentBSSID, 6);
1729         awrq->sa_family = ARPHRD_ETHER;
1730
1731         return 0;
1732 }
1733
1734 static int atmel_set_encode(struct net_device *dev,
1735                             struct iw_request_info *info,
1736                             struct iw_point *dwrq,
1737                             char *extra)
1738 {
1739         struct atmel_private *priv = netdev_priv(dev);
1740
1741         /* Basic checking: do we have a key to set ?
1742          * Note : with the new API, it's impossible to get a NULL pointer.
1743          * Therefore, we need to check a key size == 0 instead.
1744          * New version of iwconfig properly set the IW_ENCODE_NOKEY flag
1745          * when no key is present (only change flags), but older versions
1746          * don't do it. - Jean II */
1747         if (dwrq->length > 0) {
1748                 int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
1749                 int current_index = priv->default_key;
1750                 /* Check the size of the key */
1751                 if (dwrq->length > 13) {
1752                         return -EINVAL;
1753                 }
1754                 /* Check the index (none -> use current) */
1755                 if (index < 0 || index >= 4)
1756                         index = current_index;
1757                 else
1758                         priv->default_key = index;
1759                 /* Set the length */
1760                 if (dwrq->length > 5)
1761                         priv->wep_key_len[index] = 13;
1762                 else
1763                         if (dwrq->length > 0)
1764                                 priv->wep_key_len[index] = 5;
1765                         else
1766                                 /* Disable the key */
1767                                 priv->wep_key_len[index] = 0;
1768                 /* Check if the key is not marked as invalid */
1769                 if(!(dwrq->flags & IW_ENCODE_NOKEY)) {
1770                         /* Cleanup */
1771                         memset(priv->wep_keys[index], 0, 13);
1772                         /* Copy the key in the driver */
1773                         memcpy(priv->wep_keys[index], extra, dwrq->length);
1774                 }
1775                 /* WE specify that if a valid key is set, encryption
1776                  * should be enabled (user may turn it off later)
1777                  * This is also how "iwconfig ethX key on" works */
1778                 if (index == current_index &&
1779                     priv->wep_key_len[index] > 0) {
1780                         priv->wep_is_on = 1;
1781                         priv->exclude_unencrypted = 1;
1782                         if (priv->wep_key_len[index] > 5) {
1783                                 priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_64;
1784                                 priv->encryption_level = 2;
1785                         } else {
1786                                 priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_128;
1787                                 priv->encryption_level = 1;
1788                         }
1789                 }
1790         } else {
1791                 /* Do we want to just set the transmit key index ? */
1792                 int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
1793                 if (index >= 0 && index < 4) {
1794                         priv->default_key = index;
1795                 } else
1796                         /* Don't complain if only change the mode */
1797                         if (!dwrq->flags & IW_ENCODE_MODE) {
1798                                 return -EINVAL;
1799                         }
1800         }
1801         /* Read the flags */
1802         if (dwrq->flags & IW_ENCODE_DISABLED) {
1803                 priv->wep_is_on = 0;
1804                 priv->encryption_level = 0;
1805                 priv->pairwise_cipher_suite = CIPHER_SUITE_NONE;
1806         } else {
1807                 priv->wep_is_on = 1;
1808                 if (priv->wep_key_len[priv->default_key] > 5) {
1809                         priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_128;
1810                         priv->encryption_level = 2;
1811                 } else {
1812                         priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_64;
1813                         priv->encryption_level = 1;
1814                 }
1815         }
1816         if (dwrq->flags & IW_ENCODE_RESTRICTED)
1817                 priv->exclude_unencrypted = 1;
1818         if(dwrq->flags & IW_ENCODE_OPEN)
1819                 priv->exclude_unencrypted = 0;
1820
1821         return -EINPROGRESS;            /* Call commit handler */
1822 }
1823
1824 static int atmel_get_encode(struct net_device *dev,
1825                             struct iw_request_info *info,
1826                             struct iw_point *dwrq,
1827                             char *extra)
1828 {
1829         struct atmel_private *priv = netdev_priv(dev);
1830         int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
1831
1832         if (!priv->wep_is_on)
1833                 dwrq->flags = IW_ENCODE_DISABLED;
1834         else {
1835                 if (priv->exclude_unencrypted)
1836                         dwrq->flags = IW_ENCODE_RESTRICTED;
1837                 else
1838                         dwrq->flags = IW_ENCODE_OPEN;
1839         }
1840                 /* Which key do we want ? -1 -> tx index */
1841         if (index < 0 || index >= 4)
1842                 index = priv->default_key;
1843         dwrq->flags |= index + 1;
1844         /* Copy the key to the user buffer */
1845         dwrq->length = priv->wep_key_len[index];
1846         if (dwrq->length > 16) {
1847                 dwrq->length=0;
1848         } else {
1849                 memset(extra, 0, 16);
1850                 memcpy(extra, priv->wep_keys[index], dwrq->length);
1851         }
1852
1853         return 0;
1854 }
1855
1856 static int atmel_get_name(struct net_device *dev,
1857                           struct iw_request_info *info,
1858                           char *cwrq,
1859                           char *extra)
1860 {
1861         strcpy(cwrq, "IEEE 802.11-DS");
1862         return 0;
1863 }
1864
1865 static int atmel_set_rate(struct net_device *dev,
1866                           struct iw_request_info *info,
1867                           struct iw_param *vwrq,
1868                           char *extra)
1869 {
1870         struct atmel_private *priv = netdev_priv(dev);
1871
1872         if (vwrq->fixed == 0) {
1873                 priv->tx_rate = 3;
1874                 priv->auto_tx_rate = 1;
1875         } else {
1876                 priv->auto_tx_rate = 0;
1877
1878                 /* Which type of value ? */
1879                 if ((vwrq->value < 4) && (vwrq->value >= 0)) {
1880                         /* Setting by rate index */
1881                         priv->tx_rate = vwrq->value;
1882                 } else {
1883                 /* Setting by frequency value */
1884                         switch (vwrq->value) {
1885                         case  1000000: priv->tx_rate = 0; break;
1886                         case  2000000: priv->tx_rate = 1; break;
1887                         case  5500000: priv->tx_rate = 2; break;
1888                         case 11000000: priv->tx_rate = 3; break;
1889                         default: return -EINVAL;
1890                         }
1891                 }
1892         }
1893
1894         return -EINPROGRESS;
1895 }
1896
1897 static int atmel_set_mode(struct net_device *dev,
1898                           struct iw_request_info *info,
1899                           __u32 *uwrq,
1900                           char *extra)
1901 {
1902         struct atmel_private *priv = netdev_priv(dev);
1903
1904         if (*uwrq != IW_MODE_ADHOC && *uwrq != IW_MODE_INFRA)
1905                 return -EINVAL;
1906
1907         priv->operating_mode = *uwrq;
1908         return -EINPROGRESS;
1909 }
1910
1911 static int atmel_get_mode(struct net_device *dev,
1912                           struct iw_request_info *info,
1913                           __u32 *uwrq,
1914                           char *extra)
1915 {
1916         struct atmel_private *priv = netdev_priv(dev);
1917
1918         *uwrq = priv->operating_mode;
1919         return 0;
1920 }
1921
1922 static int atmel_get_rate(struct net_device *dev,
1923                          struct iw_request_info *info,
1924                          struct iw_param *vwrq,
1925                          char *extra)
1926 {
1927         struct atmel_private *priv = netdev_priv(dev);
1928
1929         if (priv->auto_tx_rate) {
1930                 vwrq->fixed = 0;
1931                 vwrq->value = 11000000;
1932         } else {
1933                 vwrq->fixed = 1;
1934                 switch(priv->tx_rate) {
1935                 case 0: vwrq->value =  1000000; break;
1936                 case 1: vwrq->value =  2000000; break;
1937                 case 2: vwrq->value =  5500000; break;
1938                 case 3: vwrq->value = 11000000; break;
1939                 }
1940         }
1941         return 0;
1942 }
1943
1944 static int atmel_set_power(struct net_device *dev,
1945                            struct iw_request_info *info,
1946                            struct iw_param *vwrq,
1947                            char *extra)
1948 {
1949         struct atmel_private *priv = netdev_priv(dev);
1950         priv->power_mode = vwrq->disabled ? 0 : 1;
1951         return -EINPROGRESS;
1952 }
1953
1954 static int atmel_get_power(struct net_device *dev,
1955                            struct iw_request_info *info,
1956                            struct iw_param *vwrq,
1957                            char *extra)
1958 {
1959         struct atmel_private *priv = netdev_priv(dev);
1960         vwrq->disabled = priv->power_mode ? 0 : 1;
1961         vwrq->flags = IW_POWER_ON;
1962         return 0;
1963 }
1964
1965 static int atmel_set_retry(struct net_device *dev,
1966                            struct iw_request_info *info,
1967                            struct iw_param *vwrq,
1968                            char *extra)
1969 {
1970         struct atmel_private *priv = netdev_priv(dev);
1971
1972         if (!vwrq->disabled && (vwrq->flags & IW_RETRY_LIMIT)) {
1973                 if (vwrq->flags & IW_RETRY_MAX)
1974                         priv->long_retry = vwrq->value;
1975                 else if (vwrq->flags & IW_RETRY_MIN)
1976                         priv->short_retry = vwrq->value;
1977                 else {
1978                         /* No modifier : set both */
1979                         priv->long_retry = vwrq->value;
1980                         priv->short_retry = vwrq->value;
1981                 }
1982                 return -EINPROGRESS;
1983         }
1984
1985         return -EINVAL;
1986 }
1987
1988 static int atmel_get_retry(struct net_device *dev,
1989                            struct iw_request_info *info,
1990                            struct iw_param *vwrq,
1991                            char *extra)
1992 {
1993         struct atmel_private *priv = netdev_priv(dev);
1994
1995         vwrq->disabled = 0;      /* Can't be disabled */
1996
1997         /* Note : by default, display the min retry number */
1998         if (vwrq->flags & IW_RETRY_MAX) {
1999                 vwrq->flags = IW_RETRY_LIMIT | IW_RETRY_MAX;
2000                 vwrq->value = priv->long_retry;
2001         } else {
2002                 vwrq->flags = IW_RETRY_LIMIT;
2003                 vwrq->value = priv->short_retry;
2004                 if (priv->long_retry != priv->short_retry)
2005                         vwrq->flags |= IW_RETRY_MIN;
2006         }
2007
2008         return 0;
2009 }
2010
2011 static int atmel_set_rts(struct net_device *dev,
2012                          struct iw_request_info *info,
2013                          struct iw_param *vwrq,
2014                          char *extra)
2015 {
2016         struct atmel_private *priv = netdev_priv(dev);
2017         int rthr = vwrq->value;
2018
2019         if (vwrq->disabled)
2020                 rthr = 2347;
2021         if ((rthr < 0) || (rthr > 2347)) {
2022                 return -EINVAL;
2023         }
2024         priv->rts_threshold = rthr;
2025
2026         return -EINPROGRESS;            /* Call commit handler */
2027 }
2028
2029 static int atmel_get_rts(struct net_device *dev,
2030                          struct iw_request_info *info,
2031                          struct iw_param *vwrq,
2032                          char *extra)
2033 {
2034         struct atmel_private *priv = netdev_priv(dev);
2035
2036         vwrq->value = priv->rts_threshold;
2037         vwrq->disabled = (vwrq->value >= 2347);
2038         vwrq->fixed = 1;
2039
2040         return 0;
2041 }
2042
2043 static int atmel_set_frag(struct net_device *dev,
2044                           struct iw_request_info *info,
2045                           struct iw_param *vwrq,
2046                           char *extra)
2047 {
2048         struct atmel_private *priv = netdev_priv(dev);
2049         int fthr = vwrq->value;
2050
2051         if (vwrq->disabled)
2052                 fthr = 2346;
2053         if ((fthr < 256) || (fthr > 2346)) {
2054                 return -EINVAL;
2055         }
2056         fthr &= ~0x1;   /* Get an even value - is it really needed ??? */
2057         priv->frag_threshold = fthr;
2058
2059         return -EINPROGRESS;            /* Call commit handler */
2060 }
2061
2062 static int atmel_get_frag(struct net_device *dev,
2063                           struct iw_request_info *info,
2064                           struct iw_param *vwrq,
2065                           char *extra)
2066 {
2067         struct atmel_private *priv = netdev_priv(dev);
2068
2069         vwrq->value = priv->frag_threshold;
2070         vwrq->disabled = (vwrq->value >= 2346);
2071         vwrq->fixed = 1;
2072
2073         return 0;
2074 }
2075
2076 static const long frequency_list[] = { 2412, 2417, 2422, 2427, 2432, 2437, 2442,
2077                                 2447, 2452, 2457, 2462, 2467, 2472, 2484 };
2078
2079 static int atmel_set_freq(struct net_device *dev,
2080                           struct iw_request_info *info,
2081                           struct iw_freq *fwrq,
2082                           char *extra)
2083 {
2084         struct atmel_private *priv = netdev_priv(dev);
2085         int rc = -EINPROGRESS;          /* Call commit handler */
2086
2087         /* If setting by frequency, convert to a channel */
2088         if ((fwrq->e == 1) &&
2089             (fwrq->m >= (int) 241200000) &&
2090             (fwrq->m <= (int) 248700000)) {
2091                 int f = fwrq->m / 100000;
2092                 int c = 0;
2093                 while ((c < 14) && (f != frequency_list[c]))
2094                         c++;
2095                 /* Hack to fall through... */
2096                 fwrq->e = 0;
2097                 fwrq->m = c + 1;
2098         }
2099         /* Setting by channel number */
2100         if ((fwrq->m > 1000) || (fwrq->e > 0))
2101                 rc = -EOPNOTSUPP;
2102         else {
2103                 int channel = fwrq->m;
2104                 if (atmel_validate_channel(priv, channel) == 0) {
2105                         priv->channel = channel;
2106                 } else {
2107                         rc = -EINVAL;
2108                 }
2109         }
2110         return rc;
2111 }
2112
2113 static int atmel_get_freq(struct net_device *dev,
2114                           struct iw_request_info *info,
2115                           struct iw_freq *fwrq,
2116                           char *extra)
2117 {
2118         struct atmel_private *priv = netdev_priv(dev);
2119
2120         fwrq->m = priv->channel;
2121         fwrq->e = 0;
2122         return 0;
2123 }
2124
2125 static int atmel_set_scan(struct net_device *dev,
2126                           struct iw_request_info *info,
2127                           struct iw_param *vwrq,
2128                           char *extra)
2129 {
2130         struct atmel_private *priv = netdev_priv(dev);
2131         unsigned long flags;
2132
2133         /* Note : you may have realised that, as this is a SET operation,
2134          * this is privileged and therefore a normal user can't
2135          * perform scanning.
2136          * This is not an error, while the device perform scanning,
2137          * traffic doesn't flow, so it's a perfect DoS...
2138          * Jean II */
2139
2140         if (priv->station_state == STATION_STATE_DOWN)
2141                 return -EAGAIN;
2142
2143         /* Timeout old surveys. */
2144         if ((jiffies - priv->last_survey) > (20 * HZ))
2145                 priv->site_survey_state = SITE_SURVEY_IDLE;
2146         priv->last_survey = jiffies;
2147
2148         /* Initiate a scan command */
2149         if (priv->site_survey_state == SITE_SURVEY_IN_PROGRESS)
2150                 return -EBUSY;
2151
2152         del_timer_sync(&priv->management_timer);
2153         spin_lock_irqsave(&priv->irqlock, flags);
2154
2155         priv->site_survey_state = SITE_SURVEY_IN_PROGRESS;
2156         priv->fast_scan = 0;
2157         atmel_scan(priv, 0);
2158         spin_unlock_irqrestore(&priv->irqlock, flags);
2159
2160         return 0;
2161 }
2162
2163 static int atmel_get_scan(struct net_device *dev,
2164                           struct iw_request_info *info,
2165                           struct iw_point *dwrq,
2166                           char *extra)
2167 {
2168         struct atmel_private *priv = netdev_priv(dev);
2169         int i;
2170         char *current_ev = extra;
2171         struct iw_event iwe;
2172
2173         if (priv->site_survey_state != SITE_SURVEY_COMPLETED)
2174                 return -EAGAIN;
2175
2176         for (i = 0; i < priv->BSS_list_entries; i++) {
2177                 iwe.cmd = SIOCGIWAP;
2178                 iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
2179                 memcpy(iwe.u.ap_addr.sa_data, priv->BSSinfo[i].BSSID, 6);
2180                 current_ev = iwe_stream_add_event(current_ev, extra + IW_SCAN_MAX_DATA, &iwe, IW_EV_ADDR_LEN);
2181
2182                 iwe.u.data.length =  priv->BSSinfo[i].SSIDsize;
2183                 if (iwe.u.data.length > 32)
2184                         iwe.u.data.length = 32;
2185                 iwe.cmd = SIOCGIWESSID;
2186                 iwe.u.data.flags = 1;
2187                 current_ev = iwe_stream_add_point(current_ev, extra + IW_SCAN_MAX_DATA, &iwe, priv->BSSinfo[i].SSID);
2188
2189                 iwe.cmd = SIOCGIWMODE;
2190                 iwe.u.mode = priv->BSSinfo[i].BSStype;
2191                 current_ev = iwe_stream_add_event(current_ev, extra + IW_SCAN_MAX_DATA, &iwe, IW_EV_UINT_LEN);
2192
2193                 iwe.cmd = SIOCGIWFREQ;
2194                 iwe.u.freq.m = priv->BSSinfo[i].channel;
2195                 iwe.u.freq.e = 0;
2196                 current_ev = iwe_stream_add_event(current_ev, extra + IW_SCAN_MAX_DATA, &iwe, IW_EV_FREQ_LEN);
2197
2198                 iwe.cmd = SIOCGIWENCODE;
2199                 if (priv->BSSinfo[i].UsingWEP)
2200                         iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
2201                 else
2202                         iwe.u.data.flags = IW_ENCODE_DISABLED;
2203                 iwe.u.data.length = 0;
2204                 current_ev = iwe_stream_add_point(current_ev, extra + IW_SCAN_MAX_DATA, &iwe, NULL);
2205         }
2206
2207         /* Length of data */
2208         dwrq->length = (current_ev - extra);
2209         dwrq->flags = 0;
2210
2211         return 0;
2212 }
2213
2214 static int atmel_get_range(struct net_device *dev,
2215                            struct iw_request_info *info,
2216                            struct iw_point *dwrq,
2217                            char *extra)
2218 {
2219         struct atmel_private *priv = netdev_priv(dev);
2220         struct iw_range *range = (struct iw_range *) extra;
2221         int k, i, j;
2222
2223         dwrq->length = sizeof(struct iw_range);
2224         memset(range, 0, sizeof(struct iw_range));
2225         range->min_nwid = 0x0000;
2226         range->max_nwid = 0x0000;
2227         range->num_channels = 0;
2228         for (j = 0; j < sizeof(channel_table)/sizeof(channel_table[0]); j++)
2229                 if (priv->reg_domain == channel_table[j].reg_domain) {
2230                         range->num_channels = channel_table[j].max - channel_table[j].min + 1;
2231                         break;
2232                 }
2233         if (range->num_channels != 0) {
2234                 for (k = 0, i = channel_table[j].min; i <= channel_table[j].max; i++) {
2235                         range->freq[k].i = i; /* List index */
2236                         range->freq[k].m = frequency_list[i - 1] * 100000;
2237                         range->freq[k++].e = 1; /* Values in table in MHz -> * 10^5 * 10 */
2238                 }
2239                 range->num_frequency = k;
2240         }
2241
2242         range->max_qual.qual = 100;
2243         range->max_qual.level = 100;
2244         range->max_qual.noise = 0;
2245         range->max_qual.updated = IW_QUAL_NOISE_INVALID;
2246
2247         range->avg_qual.qual = 50;
2248         range->avg_qual.level = 50;
2249         range->avg_qual.noise = 0;
2250         range->avg_qual.updated = IW_QUAL_NOISE_INVALID;
2251
2252         range->sensitivity = 0;
2253
2254         range->bitrate[0] =  1000000;
2255         range->bitrate[1] =  2000000;
2256         range->bitrate[2] =  5500000;
2257         range->bitrate[3] = 11000000;
2258         range->num_bitrates = 4;
2259
2260         range->min_rts = 0;
2261         range->max_rts = 2347;
2262         range->min_frag = 256;
2263         range->max_frag = 2346;
2264
2265         range->encoding_size[0] = 5;
2266         range->encoding_size[1] = 13;
2267         range->num_encoding_sizes = 2;
2268         range->max_encoding_tokens = 4;
2269
2270         range->pmp_flags = IW_POWER_ON;
2271         range->pmt_flags = IW_POWER_ON;
2272         range->pm_capa = 0;
2273
2274         range->we_version_source = WIRELESS_EXT;
2275         range->we_version_compiled = WIRELESS_EXT;
2276         range->retry_capa = IW_RETRY_LIMIT ;
2277         range->retry_flags = IW_RETRY_LIMIT;
2278         range->r_time_flags = 0;
2279         range->min_retry = 1;
2280         range->max_retry = 65535;
2281
2282         return 0;
2283 }
2284
2285 static int atmel_set_wap(struct net_device *dev,
2286                          struct iw_request_info *info,
2287                          struct sockaddr *awrq,
2288                          char *extra)
2289 {
2290         struct atmel_private *priv = netdev_priv(dev);
2291         int i;
2292         static const u8 bcast[] = { 255, 255, 255, 255, 255, 255 };
2293         unsigned long flags;
2294
2295         if (awrq->sa_family != ARPHRD_ETHER)
2296                 return -EINVAL;
2297
2298         if (memcmp(bcast, awrq->sa_data, 6) == 0) {
2299                 del_timer_sync(&priv->management_timer);
2300                 spin_lock_irqsave(&priv->irqlock, flags);
2301                 atmel_scan(priv, 1);
2302                 spin_unlock_irqrestore(&priv->irqlock, flags);
2303                 return 0;
2304         }
2305
2306         for (i = 0; i < priv->BSS_list_entries; i++) {
2307                 if (memcmp(priv->BSSinfo[i].BSSID, awrq->sa_data, 6) == 0) {
2308                         if (!priv->wep_is_on && priv->BSSinfo[i].UsingWEP) {
2309                                 return -EINVAL;
2310                         } else if  (priv->wep_is_on && !priv->BSSinfo[i].UsingWEP) {
2311                                 return -EINVAL;
2312                         } else {
2313                                 del_timer_sync(&priv->management_timer);
2314                                 spin_lock_irqsave(&priv->irqlock, flags);
2315                                 atmel_join_bss(priv, i);
2316                                 spin_unlock_irqrestore(&priv->irqlock, flags);
2317                                 return 0;
2318                         }
2319                 }
2320         }
2321
2322         return -EINVAL;
2323 }
2324
2325 static int atmel_config_commit(struct net_device *dev,
2326                                struct iw_request_info *info,    /* NULL */
2327                                void *zwrq,                      /* NULL */
2328                                char *extra)                     /* NULL */
2329 {
2330         return atmel_open(dev);
2331 }
2332
2333 static const iw_handler atmel_handler[] =
2334 {
2335         (iw_handler) atmel_config_commit,       /* SIOCSIWCOMMIT */
2336         (iw_handler) atmel_get_name,            /* SIOCGIWNAME */
2337         (iw_handler) NULL,                      /* SIOCSIWNWID */
2338         (iw_handler) NULL,                      /* SIOCGIWNWID */
2339         (iw_handler) atmel_set_freq,            /* SIOCSIWFREQ */
2340         (iw_handler) atmel_get_freq,            /* SIOCGIWFREQ */
2341         (iw_handler) atmel_set_mode,            /* SIOCSIWMODE */
2342         (iw_handler) atmel_get_mode,            /* SIOCGIWMODE */
2343         (iw_handler) NULL,                      /* SIOCSIWSENS */
2344         (iw_handler) NULL,                      /* SIOCGIWSENS */
2345         (iw_handler) NULL,                      /* SIOCSIWRANGE */
2346         (iw_handler) atmel_get_range,           /* SIOCGIWRANGE */
2347         (iw_handler) NULL,                      /* SIOCSIWPRIV */
2348         (iw_handler) NULL,                      /* SIOCGIWPRIV */
2349         (iw_handler) NULL,                      /* SIOCSIWSTATS */
2350         (iw_handler) NULL,                      /* SIOCGIWSTATS */
2351         (iw_handler) NULL,                      /* SIOCSIWSPY */
2352         (iw_handler) NULL,                      /* SIOCGIWSPY */
2353         (iw_handler) NULL,                      /* -- hole -- */
2354         (iw_handler) NULL,                      /* -- hole -- */
2355         (iw_handler) atmel_set_wap,             /* SIOCSIWAP */
2356         (iw_handler) atmel_get_wap,             /* SIOCGIWAP */
2357         (iw_handler) NULL,                      /* -- hole -- */
2358         (iw_handler) NULL,                      /* SIOCGIWAPLIST */
2359         (iw_handler) atmel_set_scan,            /* SIOCSIWSCAN */
2360         (iw_handler) atmel_get_scan,            /* SIOCGIWSCAN */
2361         (iw_handler) atmel_set_essid,           /* SIOCSIWESSID */
2362         (iw_handler) atmel_get_essid,           /* SIOCGIWESSID */
2363         (iw_handler) NULL,                      /* SIOCSIWNICKN */
2364         (iw_handler) NULL,                      /* SIOCGIWNICKN */
2365         (iw_handler) NULL,                      /* -- hole -- */
2366         (iw_handler) NULL,                      /* -- hole -- */
2367         (iw_handler) atmel_set_rate,            /* SIOCSIWRATE */
2368         (iw_handler) atmel_get_rate,            /* SIOCGIWRATE */
2369         (iw_handler) atmel_set_rts,             /* SIOCSIWRTS */
2370         (iw_handler) atmel_get_rts,             /* SIOCGIWRTS */
2371         (iw_handler) atmel_set_frag,            /* SIOCSIWFRAG */
2372         (iw_handler) atmel_get_frag,            /* SIOCGIWFRAG */
2373         (iw_handler) NULL,                      /* SIOCSIWTXPOW */
2374         (iw_handler) NULL,                      /* SIOCGIWTXPOW */
2375         (iw_handler) atmel_set_retry,           /* SIOCSIWRETRY */
2376         (iw_handler) atmel_get_retry,           /* SIOCGIWRETRY */
2377         (iw_handler) atmel_set_encode,          /* SIOCSIWENCODE */
2378         (iw_handler) atmel_get_encode,          /* SIOCGIWENCODE */
2379         (iw_handler) atmel_set_power,           /* SIOCSIWPOWER */
2380         (iw_handler) atmel_get_power,           /* SIOCGIWPOWER */
2381 };
2382
2383 static const iw_handler atmel_private_handler[] =
2384 {
2385         NULL,                           /* SIOCIWFIRSTPRIV */
2386 };
2387
2388 typedef struct atmel_priv_ioctl {
2389         char id[32];
2390         unsigned char __user *data;
2391         unsigned short len;
2392 } atmel_priv_ioctl;
2393
2394 #define ATMELFWL        SIOCIWFIRSTPRIV
2395 #define ATMELIDIFC      ATMELFWL + 1
2396 #define ATMELRD         ATMELFWL + 2
2397 #define ATMELMAGIC 0x51807
2398 #define REGDOMAINSZ 20
2399
2400 static const struct iw_priv_args atmel_private_args[] = {
2401         {
2402                 .cmd = ATMELFWL,
2403                 .set_args = IW_PRIV_TYPE_BYTE
2404                                 | IW_PRIV_SIZE_FIXED
2405                                 | sizeof (atmel_priv_ioctl),
2406                 .get_args = IW_PRIV_TYPE_NONE,
2407                 .name = "atmelfwl"
2408         }, {
2409                 .cmd = ATMELIDIFC,
2410                 .set_args = IW_PRIV_TYPE_NONE,
2411                 .get_args = IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
2412                 .name = "atmelidifc"
2413         }, {
2414                 .cmd = ATMELRD,
2415                 .set_args = IW_PRIV_TYPE_CHAR | REGDOMAINSZ,
2416                 .get_args = IW_PRIV_TYPE_NONE,
2417                 .name = "regdomain"
2418         },
2419 };
2420
2421 static const struct iw_handler_def atmel_handler_def =
2422 {
2423         .num_standard   = sizeof(atmel_handler)/sizeof(iw_handler),
2424         .num_private    = sizeof(atmel_private_handler)/sizeof(iw_handler),
2425         .num_private_args = sizeof(atmel_private_args)/sizeof(struct iw_priv_args),
2426         .standard       = (iw_handler *) atmel_handler,
2427         .private        = (iw_handler *) atmel_private_handler,
2428         .private_args   = (struct iw_priv_args *) atmel_private_args,
2429         .get_wireless_stats = atmel_get_wireless_stats
2430 };
2431
2432 static int atmel_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
2433 {
2434         int i, rc = 0;
2435         struct atmel_private *priv = netdev_priv(dev);
2436         atmel_priv_ioctl com;
2437         struct iwreq *wrq = (struct iwreq *) rq;
2438         unsigned char *new_firmware;
2439         char domain[REGDOMAINSZ + 1];
2440
2441         switch (cmd) {
2442         case ATMELIDIFC:
2443                 wrq->u.param.value = ATMELMAGIC;
2444                 break;
2445
2446         case ATMELFWL:
2447                 if (copy_from_user(&com, rq->ifr_data, sizeof(com))) {
2448                         rc = -EFAULT;
2449                         break;
2450                 }
2451
2452                 if (!capable(CAP_NET_ADMIN)) {
2453                         rc = -EPERM;
2454                         break;
2455                 }
2456
2457                 if (!(new_firmware = kmalloc(com.len, GFP_KERNEL))) {
2458                         rc = -ENOMEM;
2459                         break;
2460                 }
2461
2462                 if (copy_from_user(new_firmware, com.data, com.len)) {
2463                         kfree(new_firmware);
2464                         rc = -EFAULT;
2465                         break;
2466                 }
2467
2468                 kfree(priv->firmware);
2469
2470                 priv->firmware = new_firmware;
2471                 priv->firmware_length = com.len;
2472                 strncpy(priv->firmware_id, com.id, 31);
2473                 priv->firmware_id[31] = '\0';
2474                 break;
2475
2476         case ATMELRD:
2477                 if (copy_from_user(domain, rq->ifr_data, REGDOMAINSZ)) {
2478                         rc = -EFAULT;
2479                         break;
2480                 }
2481
2482                 if (!capable(CAP_NET_ADMIN)) {
2483                         rc = -EPERM;
2484                         break;
2485                 }
2486
2487                 domain[REGDOMAINSZ] = 0;
2488                 rc = -EINVAL;
2489                 for (i = 0; i < sizeof(channel_table)/sizeof(channel_table[0]); i++) {
2490                         /* strcasecmp doesn't exist in the library */
2491                         char *a = channel_table[i].name;
2492                         char *b = domain;
2493                         while (*a) {
2494                                 char c1 = *a++;
2495                                 char c2 = *b++;
2496                                 if (tolower(c1) != tolower(c2))
2497                                         break;
2498                         }
2499                         if (!*a && !*b) {
2500                                 priv->config_reg_domain = channel_table[i].reg_domain;
2501                                 rc = 0;
2502                         }
2503                 }
2504
2505                 if (rc == 0 &&  priv->station_state != STATION_STATE_DOWN)
2506                         rc = atmel_open(dev);
2507                 break;
2508
2509         default:
2510                 rc = -EOPNOTSUPP;
2511         }
2512
2513         return rc;
2514 }
2515
2516 struct auth_body {
2517         u16 alg;
2518         u16 trans_seq;
2519         u16 status;
2520         u8 el_id;
2521         u8 chall_text_len;
2522         u8 chall_text[253];
2523 };
2524
2525 static void atmel_enter_state(struct atmel_private *priv, int new_state)
2526 {
2527         int old_state = priv->station_state;
2528
2529         if (new_state == old_state)
2530                 return;
2531
2532         priv->station_state = new_state;
2533
2534         if (new_state == STATION_STATE_READY) {
2535                 netif_start_queue(priv->dev);
2536                 netif_carrier_on(priv->dev);
2537         }
2538
2539         if (old_state == STATION_STATE_READY) {
2540                 netif_carrier_off(priv->dev);
2541                 if (netif_running(priv->dev))
2542                         netif_stop_queue(priv->dev);
2543                 priv->last_beacon_timestamp = 0;
2544         }
2545 }
2546
2547 static void atmel_scan(struct atmel_private *priv, int specific_ssid)
2548 {
2549         struct {
2550                 u8 BSSID[6];
2551                 u8 SSID[MAX_SSID_LENGTH];
2552                 u8 scan_type;
2553                 u8 channel;
2554                 u16 BSS_type;
2555                 u16 min_channel_time;
2556                 u16 max_channel_time;
2557                 u8 options;
2558                 u8 SSID_size;
2559         } cmd;
2560
2561         memset(cmd.BSSID, 0xff, 6);
2562
2563         if (priv->fast_scan) {
2564                 cmd.SSID_size = priv->SSID_size;
2565                 memcpy(cmd.SSID, priv->SSID, priv->SSID_size);
2566                 cmd.min_channel_time = cpu_to_le16(10);
2567                 cmd.max_channel_time = cpu_to_le16(50);
2568         } else {
2569                 priv->BSS_list_entries = 0;
2570                 cmd.SSID_size = 0;
2571                 cmd.min_channel_time = cpu_to_le16(10);
2572                 cmd.max_channel_time = cpu_to_le16(120);
2573         }
2574
2575         cmd.options = 0;
2576
2577         if (!specific_ssid)
2578                 cmd.options |= SCAN_OPTIONS_SITE_SURVEY;
2579
2580         cmd.channel = (priv->channel & 0x7f);
2581         cmd.scan_type = SCAN_TYPE_ACTIVE;
2582         cmd.BSS_type = cpu_to_le16(priv->operating_mode == IW_MODE_ADHOC ?
2583                 BSS_TYPE_AD_HOC : BSS_TYPE_INFRASTRUCTURE);
2584
2585         atmel_send_command(priv, CMD_Scan, &cmd, sizeof(cmd));
2586
2587         /* This must come after all hardware access to avoid being messed up
2588            by stuff happening in interrupt context after we leave STATE_DOWN */
2589         atmel_enter_state(priv, STATION_STATE_SCANNING);
2590 }
2591
2592 static void join(struct atmel_private *priv, int type)
2593 {
2594         struct {
2595                 u8 BSSID[6];
2596                 u8 SSID[MAX_SSID_LENGTH];
2597                 u8 BSS_type; /* this is a short in a scan command - weird */
2598                 u8 channel;
2599                 u16 timeout;
2600                 u8 SSID_size;
2601                 u8 reserved;
2602         } cmd;
2603
2604         cmd.SSID_size = priv->SSID_size;
2605         memcpy(cmd.SSID, priv->SSID, priv->SSID_size);
2606         memcpy(cmd.BSSID, priv->CurrentBSSID, 6);
2607         cmd.channel = (priv->channel & 0x7f);
2608         cmd.BSS_type = type;
2609         cmd.timeout = cpu_to_le16(2000);
2610
2611         atmel_send_command(priv, CMD_Join, &cmd, sizeof(cmd));
2612 }
2613
2614 static void start(struct atmel_private *priv, int type)
2615 {
2616         struct {
2617                 u8 BSSID[6];
2618                 u8 SSID[MAX_SSID_LENGTH];
2619                 u8 BSS_type;
2620                 u8 channel;
2621                 u8 SSID_size;
2622                 u8 reserved[3];
2623         } cmd;
2624
2625         cmd.SSID_size = priv->SSID_size;
2626         memcpy(cmd.SSID, priv->SSID, priv->SSID_size);
2627         memcpy(cmd.BSSID, priv->BSSID, 6);
2628         cmd.BSS_type = type;
2629         cmd.channel = (priv->channel & 0x7f);
2630
2631         atmel_send_command(priv, CMD_Start, &cmd, sizeof(cmd));
2632 }
2633
2634 static void handle_beacon_probe(struct atmel_private *priv, u16 capability,
2635                                 u8 channel)
2636 {
2637         int rejoin = 0;
2638         int new = capability  & C80211_MGMT_CAPABILITY_ShortPreamble ?
2639                 SHORT_PREAMBLE : LONG_PREAMBLE;
2640
2641         if (priv->preamble != new) {
2642                 priv->preamble = new;
2643                 rejoin = 1;
2644                 atmel_set_mib8(priv, Local_Mib_Type, LOCAL_MIB_PREAMBLE_TYPE, new);
2645         }
2646
2647         if (priv->channel != channel) {
2648                 priv->channel = channel;
2649                 rejoin = 1;
2650                 atmel_set_mib8(priv, Phy_Mib_Type, PHY_MIB_CHANNEL_POS, channel);
2651         }
2652
2653         if (rejoin) {
2654                 priv->station_is_associated = 0;
2655                 atmel_enter_state(priv, STATION_STATE_JOINNING);
2656
2657                 if (priv->operating_mode == IW_MODE_INFRA)
2658                         join(priv, BSS_TYPE_INFRASTRUCTURE);
2659                 else
2660                         join(priv, BSS_TYPE_AD_HOC);
2661         }
2662 }
2663
2664 static void send_authentication_request(struct atmel_private *priv, u16 system,
2665                                         u8 *challenge, int challenge_len)
2666 {
2667         struct ieee80211_hdr_4addr header;
2668         struct auth_body auth;
2669
2670         header.frame_ctl = cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_AUTH);
2671         header.duration_id = cpu_to_le16(0x8000);
2672         header.seq_ctl = 0;
2673         memcpy(header.addr1, priv->CurrentBSSID, 6);
2674         memcpy(header.addr2, priv->dev->dev_addr, 6);
2675         memcpy(header.addr3, priv->CurrentBSSID, 6);
2676
2677         if (priv->wep_is_on && priv->CurrentAuthentTransactionSeqNum != 1)
2678                 /* no WEP for authentication frames with TrSeqNo 1 */
2679                 header.frame_ctl |=  cpu_to_le16(IEEE80211_FCTL_PROTECTED);
2680
2681         auth.alg = cpu_to_le16(system);
2682
2683         auth.status = 0;
2684         auth.trans_seq = cpu_to_le16(priv->CurrentAuthentTransactionSeqNum);
2685         priv->ExpectedAuthentTransactionSeqNum = priv->CurrentAuthentTransactionSeqNum+1;
2686         priv->CurrentAuthentTransactionSeqNum += 2;
2687
2688         if (challenge_len != 0) {
2689                 auth.el_id = 16; /* challenge_text */
2690                 auth.chall_text_len = challenge_len;
2691                 memcpy(auth.chall_text, challenge, challenge_len);
2692                 atmel_transmit_management_frame(priv, &header, (u8 *)&auth, 8 + challenge_len);
2693         } else {
2694                 atmel_transmit_management_frame(priv, &header, (u8 *)&auth, 6);
2695         }
2696 }
2697
2698 static void send_association_request(struct atmel_private *priv, int is_reassoc)
2699 {
2700         u8 *ssid_el_p;
2701         int bodysize;
2702         struct ieee80211_hdr_4addr header;
2703         struct ass_req_format {
2704                 u16 capability;
2705                 u16 listen_interval;
2706                 u8 ap[6]; /* nothing after here directly accessible */
2707                 u8 ssid_el_id;
2708                 u8 ssid_len;
2709                 u8 ssid[MAX_SSID_LENGTH];
2710                 u8 sup_rates_el_id;
2711                 u8 sup_rates_len;
2712                 u8 rates[4];
2713         } body;
2714
2715         header.frame_ctl = cpu_to_le16(IEEE80211_FTYPE_MGMT |
2716                 (is_reassoc ? IEEE80211_STYPE_REASSOC_REQ : IEEE80211_STYPE_ASSOC_REQ));
2717         header.duration_id = cpu_to_le16(0x8000);
2718         header.seq_ctl = 0;
2719
2720         memcpy(header.addr1, priv->CurrentBSSID, 6);
2721         memcpy(header.addr2, priv->dev->dev_addr, 6);
2722         memcpy(header.addr3, priv->CurrentBSSID, 6);
2723
2724         body.capability = cpu_to_le16(C80211_MGMT_CAPABILITY_ESS);
2725         if (priv->wep_is_on)
2726                 body.capability |= cpu_to_le16(C80211_MGMT_CAPABILITY_Privacy);
2727         if (priv->preamble == SHORT_PREAMBLE)
2728                 body.capability |= cpu_to_le16(C80211_MGMT_CAPABILITY_ShortPreamble);
2729
2730         body.listen_interval = cpu_to_le16(priv->listen_interval * priv->beacon_period);
2731
2732         /* current AP address - only in reassoc frame */
2733         if (is_reassoc) {
2734                 memcpy(body.ap, priv->CurrentBSSID, 6);
2735                 ssid_el_p = (u8 *)&body.ssid_el_id;
2736                 bodysize = 18 + priv->SSID_size;
2737         } else {
2738                 ssid_el_p = (u8 *)&body.ap[0];
2739                 bodysize = 12 + priv->SSID_size;
2740         }
2741
2742         ssid_el_p[0] = C80211_MGMT_ElementID_SSID;
2743         ssid_el_p[1] = priv->SSID_size;
2744         memcpy(ssid_el_p + 2, priv->SSID, priv->SSID_size);
2745         ssid_el_p[2 + priv->SSID_size] = C80211_MGMT_ElementID_SupportedRates;
2746         ssid_el_p[3 + priv->SSID_size] = 4; /* len of suported rates */
2747         memcpy(ssid_el_p + 4 + priv->SSID_size, atmel_basic_rates, 4);
2748
2749         atmel_transmit_management_frame(priv, &header, (void *)&body, bodysize);
2750 }
2751
2752 static int is_frame_from_current_bss(struct atmel_private *priv,
2753                                      struct ieee80211_hdr_4addr *header)
2754 {
2755         if (le16_to_cpu(header->frame_ctl) & IEEE80211_FCTL_FROMDS)
2756                 return memcmp(header->addr3, priv->CurrentBSSID, 6) == 0;
2757         else
2758                 return memcmp(header->addr2, priv->CurrentBSSID, 6) == 0;
2759 }
2760
2761 static int retrieve_bss(struct atmel_private *priv)
2762 {
2763         int i;
2764         int max_rssi = -128;
2765         int max_index = -1;
2766
2767         if (priv->BSS_list_entries == 0)
2768                 return -1;
2769
2770         if (priv->connect_to_any_BSS) {
2771                 /* Select a BSS with the max-RSSI but of the same type and of
2772                    the same WEP mode and that it is not marked as 'bad' (i.e.
2773                    we had previously failed to connect to this BSS with the
2774                    settings that we currently use) */
2775                 priv->current_BSS = 0;
2776                 for (i = 0; i < priv->BSS_list_entries; i++) {
2777                         if (priv->operating_mode == priv->BSSinfo[i].BSStype &&
2778                             ((!priv->wep_is_on && !priv->BSSinfo[i].UsingWEP) ||
2779                              (priv->wep_is_on && priv->BSSinfo[i].UsingWEP)) &&
2780                             !(priv->BSSinfo[i].channel & 0x80)) {
2781                                 max_rssi = priv->BSSinfo[i].RSSI;
2782                                 priv->current_BSS = max_index = i;
2783                         }
2784                 }
2785                 return max_index;
2786         }
2787
2788         for (i = 0; i < priv->BSS_list_entries; i++) {
2789                 if (priv->SSID_size == priv->BSSinfo[i].SSIDsize &&
2790                     memcmp(priv->SSID, priv->BSSinfo[i].SSID, priv->SSID_size) == 0 &&
2791                     priv->operating_mode == priv->BSSinfo[i].BSStype &&
2792                     atmel_validate_channel(priv, priv->BSSinfo[i].channel) == 0) {
2793                         if (priv->BSSinfo[i].RSSI >= max_rssi) {
2794                                 max_rssi = priv->BSSinfo[i].RSSI;
2795                                 max_index = i;
2796                         }
2797                 }
2798         }
2799         return max_index;
2800 }
2801
2802 static void store_bss_info(struct atmel_private *priv,
2803                            struct ieee80211_hdr_4addr *header, u16 capability,
2804                            u16 beacon_period, u8 channel, u8 rssi, u8 ssid_len,
2805                            u8 *ssid, int is_beacon)
2806 {
2807         u8 *bss = capability & C80211_MGMT_CAPABILITY_ESS ? header->addr2 : header->addr3;
2808         int i, index;
2809
2810         for (index = -1, i = 0; i < priv->BSS_list_entries; i++)
2811                 if (memcmp(bss, priv->BSSinfo[i].BSSID, 6) == 0)
2812                         index = i;
2813
2814         /* If we process a probe and an entry from this BSS exists
2815            we will update the BSS entry with the info from this BSS.
2816            If we process a beacon we will only update RSSI */
2817
2818         if (index == -1) {
2819                 if (priv->BSS_list_entries == MAX_BSS_ENTRIES)
2820                         return;
2821                 index = priv->BSS_list_entries++;
2822                 memcpy(priv->BSSinfo[index].BSSID, bss, 6);
2823                 priv->BSSinfo[index].RSSI = rssi;
2824         } else {
2825                 if (rssi > priv->BSSinfo[index].RSSI)
2826                         priv->BSSinfo[index].RSSI = rssi;
2827                 if (is_beacon)
2828                         return;
2829         }
2830
2831         priv->BSSinfo[index].channel = channel;
2832         priv->BSSinfo[index].beacon_period = beacon_period;
2833         priv->BSSinfo[index].UsingWEP = capability & C80211_MGMT_CAPABILITY_Privacy;
2834         memcpy(priv->BSSinfo[index].SSID, ssid, ssid_len);
2835         priv->BSSinfo[index].SSIDsize = ssid_len;
2836
2837         if (capability & C80211_MGMT_CAPABILITY_IBSS)
2838                 priv->BSSinfo[index].BSStype = IW_MODE_ADHOC;
2839         else if (capability & C80211_MGMT_CAPABILITY_ESS)
2840                 priv->BSSinfo[index].BSStype =IW_MODE_INFRA;
2841
2842         priv->BSSinfo[index].preamble = capability & C80211_MGMT_CAPABILITY_ShortPreamble ?
2843                 SHORT_PREAMBLE : LONG_PREAMBLE;
2844 }
2845
2846 static void authenticate(struct atmel_private *priv, u16 frame_len)
2847 {
2848         struct auth_body *auth = (struct auth_body *)priv->rx_buf;
2849         u16 status = le16_to_cpu(auth->status);
2850         u16 trans_seq_no = le16_to_cpu(auth->trans_seq);
2851         u16 system = le16_to_cpu(auth->alg);
2852
2853         if (status == C80211_MGMT_SC_Success && !priv->wep_is_on) {
2854                 /* no WEP */
2855                 if (priv->station_was_associated) {
2856                         atmel_enter_state(priv, STATION_STATE_REASSOCIATING);
2857                         send_association_request(priv, 1);
2858                         return;
2859                 } else {
2860                         atmel_enter_state(priv, STATION_STATE_ASSOCIATING);
2861                         send_association_request(priv, 0);
2862                         return;
2863                 }
2864         }
2865
2866         if (status == C80211_MGMT_SC_Success && priv->wep_is_on) {
2867                 /* WEP */
2868                 if (trans_seq_no != priv->ExpectedAuthentTransactionSeqNum)
2869                         return;
2870
2871                 if (trans_seq_no == 0x0002 &&
2872                     auth->el_id == C80211_MGMT_ElementID_ChallengeText) {
2873                         send_authentication_request(priv, system, auth->chall_text, auth->chall_text_len);
2874                         return;
2875                 }
2876
2877                 if (trans_seq_no == 0x0004) {
2878                         if(priv->station_was_associated) {
2879                                 atmel_enter_state(priv, STATION_STATE_REASSOCIATING);
2880                                 send_association_request(priv, 1);
2881                                 return;
2882                         } else {
2883                                 atmel_enter_state(priv, STATION_STATE_ASSOCIATING);
2884                                 send_association_request(priv, 0);
2885                                 return;
2886                         }
2887                 }
2888         }
2889
2890         if (status == C80211_MGMT_SC_AuthAlgNotSupported) {
2891                 /* Do opensystem first, then try sharedkey */
2892                 if (system ==  C80211_MGMT_AAN_OPENSYSTEM) {
2893                         priv->CurrentAuthentTransactionSeqNum = 0x001;
2894                         send_authentication_request(priv, C80211_MGMT_AAN_SHAREDKEY, NULL, 0);
2895                 } else if (priv->connect_to_any_BSS) {
2896                         int bss_index;
2897
2898                         priv->BSSinfo[(int)(priv->current_BSS)].channel |= 0x80;
2899
2900                         if ((bss_index  = retrieve_bss(priv)) != -1) {
2901                                 atmel_join_bss(priv, bss_index);
2902                                 return;
2903                         }
2904                 }
2905         }
2906
2907         priv->AuthenticationRequestRetryCnt = 0;
2908         atmel_enter_state(priv,  STATION_STATE_MGMT_ERROR);
2909         priv->station_is_associated = 0;
2910 }
2911
2912 static void associate(struct atmel_private *priv, u16 frame_len, u16 subtype)
2913 {
2914         struct ass_resp_format {
2915                 u16 capability;
2916                 u16 status;
2917                 u16 ass_id;
2918                 u8 el_id;
2919                 u8 length;
2920                 u8 rates[4];
2921         } *ass_resp = (struct ass_resp_format *)priv->rx_buf;
2922
2923         u16 status = le16_to_cpu(ass_resp->status);
2924         u16 ass_id = le16_to_cpu(ass_resp->ass_id);
2925         u16 rates_len = ass_resp->length > 4 ? 4 : ass_resp->length;
2926
2927         if (frame_len < 8 + rates_len)
2928                 return;
2929
2930         if (status == C80211_MGMT_SC_Success) {
2931                 if (subtype == C80211_SUBTYPE_MGMT_ASS_RESPONSE)
2932                         priv->AssociationRequestRetryCnt = 0;
2933                 else
2934                         priv->ReAssociationRequestRetryCnt = 0;
2935
2936                 atmel_set_mib16(priv, Mac_Mgmt_Mib_Type,
2937                                 MAC_MGMT_MIB_STATION_ID_POS, ass_id & 0x3fff);
2938                 atmel_set_mib(priv, Phy_Mib_Type,
2939                               PHY_MIB_RATE_SET_POS, ass_resp->rates, rates_len);
2940                 if (priv->power_mode == 0) {
2941                         priv->listen_interval = 1;
2942                         atmel_set_mib8(priv, Mac_Mgmt_Mib_Type,
2943                                        MAC_MGMT_MIB_PS_MODE_POS, ACTIVE_MODE);
2944                         atmel_set_mib16(priv, Mac_Mgmt_Mib_Type,
2945                                         MAC_MGMT_MIB_LISTEN_INTERVAL_POS, 1);
2946                 } else {
2947                         priv->listen_interval = 2;
2948                         atmel_set_mib8(priv, Mac_Mgmt_Mib_Type,
2949                                        MAC_MGMT_MIB_PS_MODE_POS,  PS_MODE);
2950                         atmel_set_mib16(priv, Mac_Mgmt_Mib_Type,
2951                                         MAC_MGMT_MIB_LISTEN_INTERVAL_POS, 2);
2952                 }
2953
2954                 priv->station_is_associated = 1;
2955                 priv->station_was_associated = 1;
2956                 atmel_enter_state(priv, STATION_STATE_READY);
2957                 return;
2958         }
2959
2960         if (subtype == C80211_SUBTYPE_MGMT_ASS_RESPONSE &&
2961             status != C80211_MGMT_SC_AssDeniedBSSRate &&
2962             status != C80211_MGMT_SC_SupportCapabilities &&
2963             priv->AssociationRequestRetryCnt < MAX_ASSOCIATION_RETRIES) {
2964                 mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
2965                 priv->AssociationRequestRetryCnt++;
2966                 send_association_request(priv, 0);
2967                 return;
2968         }
2969
2970         if (subtype == C80211_SUBTYPE_MGMT_REASS_RESPONSE &&
2971             status != C80211_MGMT_SC_AssDeniedBSSRate &&
2972             status != C80211_MGMT_SC_SupportCapabilities &&
2973             priv->AssociationRequestRetryCnt < MAX_ASSOCIATION_RETRIES) {
2974                 mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
2975                 priv->ReAssociationRequestRetryCnt++;
2976                 send_association_request(priv, 1);
2977                 return;
2978         }
2979
2980         atmel_enter_state(priv,  STATION_STATE_MGMT_ERROR);
2981         priv->station_is_associated = 0;
2982
2983         if (priv->connect_to_any_BSS) {
2984                 int bss_index;
2985                 priv->BSSinfo[(int)(priv->current_BSS)].channel |= 0x80;
2986
2987                 if ((bss_index = retrieve_bss(priv)) != -1)
2988                         atmel_join_bss(priv, bss_index);
2989         }
2990 }
2991
2992 void atmel_join_bss(struct atmel_private *priv, int bss_index)
2993 {
2994         struct bss_info *bss =  &priv->BSSinfo[bss_index];
2995
2996         memcpy(priv->CurrentBSSID, bss->BSSID, 6);
2997         memcpy(priv->SSID, bss->SSID, priv->SSID_size = bss->SSIDsize);
2998
2999         /* The WPA stuff cares about the current AP address */
3000         if (priv->use_wpa)
3001                 build_wpa_mib(priv);
3002
3003         /* When switching to AdHoc turn OFF Power Save if needed */
3004
3005         if (bss->BSStype == IW_MODE_ADHOC &&
3006             priv->operating_mode != IW_MODE_ADHOC &&
3007             priv->power_mode) {
3008                 priv->power_mode = 0;
3009                 priv->listen_interval = 1;
3010                 atmel_set_mib8(priv, Mac_Mgmt_Mib_Type,
3011                                MAC_MGMT_MIB_PS_MODE_POS,  ACTIVE_MODE);
3012                 atmel_set_mib16(priv, Mac_Mgmt_Mib_Type,
3013                                 MAC_MGMT_MIB_LISTEN_INTERVAL_POS, 1);
3014         }
3015
3016         priv->operating_mode = bss->BSStype;
3017         priv->channel = bss->channel & 0x7f;
3018         priv->beacon_period = bss->beacon_period;
3019
3020         if (priv->preamble != bss->preamble) {
3021                 priv->preamble = bss->preamble;
3022                 atmel_set_mib8(priv, Local_Mib_Type,
3023                                LOCAL_MIB_PREAMBLE_TYPE, bss->preamble);
3024         }
3025
3026         if (!priv->wep_is_on && bss->UsingWEP) {
3027                 atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
3028                 priv->station_is_associated = 0;
3029                 return;
3030         }
3031
3032         if (priv->wep_is_on && !bss->UsingWEP) {
3033                 atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
3034                 priv->station_is_associated = 0;
3035                 return;
3036         }
3037
3038         atmel_enter_state(priv, STATION_STATE_JOINNING);
3039
3040         if (priv->operating_mode == IW_MODE_INFRA)
3041                 join(priv, BSS_TYPE_INFRASTRUCTURE);
3042         else
3043                 join(priv, BSS_TYPE_AD_HOC);
3044 }
3045
3046 static void restart_search(struct atmel_private *priv)
3047 {
3048         int bss_index;
3049
3050         if (!priv->connect_to_any_BSS) {
3051                 atmel_scan(priv, 1);
3052         } else {
3053                 priv->BSSinfo[(int)(priv->current_BSS)].channel |= 0x80;
3054
3055                 if ((bss_index = retrieve_bss(priv)) != -1)
3056                         atmel_join_bss(priv, bss_index);
3057                 else
3058                         atmel_scan(priv, 0);
3059         }
3060 }
3061
3062 static void smooth_rssi(struct atmel_private *priv, u8 rssi)
3063 {
3064         u8 old = priv->wstats.qual.level;
3065         u8 max_rssi = 42; /* 502-rmfd-revd max by experiment, default for now */
3066
3067         switch (priv->firmware_type) {
3068                 case ATMEL_FW_TYPE_502E:
3069                         max_rssi = 63; /* 502-rmfd-reve max by experiment */
3070                         break;
3071                 default:
3072                         break;
3073         }
3074
3075         rssi = rssi * 100 / max_rssi;
3076         if ((rssi + old) % 2)
3077                 priv->wstats.qual.level = (rssi + old) / 2 + 1;
3078         else
3079                 priv->wstats.qual.level = (rssi + old) / 2;
3080         priv->wstats.qual.updated |= IW_QUAL_LEVEL_UPDATED;
3081         priv->wstats.qual.updated &= ~IW_QUAL_LEVEL_INVALID;
3082 }
3083
3084 static void atmel_smooth_qual(struct atmel_private *priv)
3085 {
3086         unsigned long time_diff = (jiffies - priv->last_qual) / HZ;
3087         while (time_diff--) {
3088                 priv->last_qual += HZ;
3089                 priv->wstats.qual.qual = priv->wstats.qual.qual / 2;
3090                 priv->wstats.qual.qual +=
3091                         priv->beacons_this_sec * priv->beacon_period * (priv->wstats.qual.level + 100) / 4000;
3092                 priv->beacons_this_sec = 0;
3093         }
3094         priv->wstats.qual.updated |= IW_QUAL_QUAL_UPDATED;
3095         priv->wstats.qual.updated &= ~IW_QUAL_QUAL_INVALID;
3096 }
3097
3098 /* deals with incoming managment frames. */
3099 static void atmel_management_frame(struct atmel_private *priv,
3100                                    struct ieee80211_hdr_4addr *header,
3101                                    u16 frame_len, u8 rssi)
3102 {
3103         u16 subtype;
3104
3105         subtype = le16_to_cpu(header->frame_ctl) & IEEE80211_FCTL_STYPE;
3106         switch (subtype) {
3107         case C80211_SUBTYPE_MGMT_BEACON:
3108         case C80211_SUBTYPE_MGMT_ProbeResponse:
3109
3110                 /* beacon frame has multiple variable-length fields -
3111                    never let an engineer loose with a data structure design. */
3112                 {
3113                         struct beacon_format {
3114                                 u64 timestamp;
3115                                 u16 interval;
3116                                 u16 capability;
3117                                 u8 ssid_el_id;
3118                                 u8 ssid_length;
3119                                 /* ssid here */
3120                                 u8 rates_el_id;
3121                                 u8 rates_length;
3122                                 /* rates here */
3123                                 u8 ds_el_id;
3124                                 u8 ds_length;
3125                                 /* ds here */
3126                         } *beacon = (struct beacon_format *)priv->rx_buf;
3127
3128                         u8 channel, rates_length, ssid_length;
3129                         u64 timestamp = le64_to_cpu(beacon->timestamp);
3130                         u16 beacon_interval = le16_to_cpu(beacon->interval);
3131                         u16 capability = le16_to_cpu(beacon->capability);
3132                         u8 *beaconp = priv->rx_buf;
3133                         ssid_length = beacon->ssid_length;
3134                         /* this blows chunks. */
3135                         if (frame_len < 14 || frame_len < ssid_length + 15)
3136                                 return;
3137                         rates_length = beaconp[beacon->ssid_length + 15];
3138                         if (frame_len < ssid_length + rates_length + 18)
3139                                 return;
3140                         if (ssid_length >  MAX_SSID_LENGTH)
3141                                 return;
3142                         channel = beaconp[ssid_length + rates_length + 18];
3143
3144                         if (priv->station_state == STATION_STATE_READY) {
3145                                 smooth_rssi(priv, rssi);
3146                                 if (is_frame_from_current_bss(priv, header)) {
3147                                         priv->beacons_this_sec++;
3148                                         atmel_smooth_qual(priv);
3149                                         if (priv->last_beacon_timestamp) {
3150                                                 /* Note truncate this to 32 bits - kernel can't divide a long long */
3151                                                 u32 beacon_delay = timestamp - priv->last_beacon_timestamp;
3152                                                 int beacons = beacon_delay / (beacon_interval * 1000);
3153                                                 if (beacons > 1)
3154                                                         priv->wstats.miss.beacon += beacons - 1;
3155                                         }
3156                                         priv->last_beacon_timestamp = timestamp;
3157                                         handle_beacon_probe(priv, capability, channel);
3158                                 }
3159                         }
3160
3161                         if (priv->station_state == STATION_STATE_SCANNING)
3162                                 store_bss_info(priv, header, capability,
3163                                                beacon_interval, channel, rssi,
3164                                                ssid_length,
3165                                                &beacon->rates_el_id,
3166                                                subtype == C80211_SUBTYPE_MGMT_BEACON);
3167                 }
3168                 break;
3169
3170         case C80211_SUBTYPE_MGMT_Authentication:
3171
3172                 if (priv->station_state == STATION_STATE_AUTHENTICATING)
3173                         authenticate(priv, frame_len);
3174
3175                 break;
3176
3177         case C80211_SUBTYPE_MGMT_ASS_RESPONSE:
3178         case C80211_SUBTYPE_MGMT_REASS_RESPONSE:
3179
3180                 if (priv->station_state == STATION_STATE_ASSOCIATING ||
3181                     priv->station_state == STATION_STATE_REASSOCIATING)
3182                         associate(priv, frame_len, subtype);
3183
3184                 break;
3185
3186         case C80211_SUBTYPE_MGMT_DISASSOSIATION:
3187                 if (priv->station_is_associated &&
3188                     priv->operating_mode == IW_MODE_INFRA &&
3189                     is_frame_from_current_bss(priv, header)) {
3190                         priv->station_was_associated = 0;
3191                         priv->station_is_associated = 0;
3192
3193                         atmel_enter_state(priv, STATION_STATE_JOINNING);
3194                         join(priv, BSS_TYPE_INFRASTRUCTURE);
3195                 }
3196
3197                 break;
3198
3199         case C80211_SUBTYPE_MGMT_Deauthentication:
3200                 if (priv->operating_mode == IW_MODE_INFRA &&
3201                     is_frame_from_current_bss(priv, header)) {
3202                         priv->station_was_associated = 0;
3203
3204                         atmel_enter_state(priv, STATION_STATE_JOINNING);
3205                         join(priv, BSS_TYPE_INFRASTRUCTURE);
3206                 }
3207
3208                 break;
3209         }
3210 }
3211
3212 /* run when timer expires */
3213 static void atmel_management_timer(u_long a)
3214 {
3215         struct net_device *dev = (struct net_device *) a;
3216         struct atmel_private *priv = netdev_priv(dev);
3217         unsigned long flags;
3218
3219         /* Check if the card has been yanked. */
3220         if (priv->card && priv->present_callback &&
3221                 !(*priv->present_callback)(priv->card))
3222                 return;
3223
3224         spin_lock_irqsave(&priv->irqlock, flags);
3225
3226         switch (priv->station_state) {
3227
3228         case STATION_STATE_AUTHENTICATING:
3229                 if (priv->AuthenticationRequestRetryCnt >= MAX_AUTHENTICATION_RETRIES) {
3230                         atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
3231                         priv->station_is_associated = 0;
3232                         priv->AuthenticationRequestRetryCnt = 0;
3233                         restart_search(priv);
3234                 } else {
3235                         priv->AuthenticationRequestRetryCnt++;
3236                         priv->CurrentAuthentTransactionSeqNum = 0x0001;
3237                         mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
3238                         send_authentication_request(priv, C80211_MGMT_AAN_OPENSYSTEM, NULL, 0);
3239           }
3240           break;
3241
3242         case STATION_STATE_ASSOCIATING:
3243                 if (priv->AssociationRequestRetryCnt == MAX_ASSOCIATION_RETRIES) {
3244                         atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
3245                         priv->station_is_associated = 0;
3246                         priv->AssociationRequestRetryCnt = 0;
3247                         restart_search(priv);
3248                 } else {
3249                         priv->AssociationRequestRetryCnt++;
3250                         mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
3251                         send_association_request(priv, 0);
3252                 }
3253           break;
3254
3255         case STATION_STATE_REASSOCIATING:
3256                 if (priv->ReAssociationRequestRetryCnt == MAX_ASSOCIATION_RETRIES) {
3257                         atmel_enter_state(priv, STATION_STATE_MGMT_ERROR);
3258                         priv->station_is_associated = 0;
3259                         priv->ReAssociationRequestRetryCnt = 0;
3260                         restart_search(priv);
3261                 } else {
3262                         priv->ReAssociationRequestRetryCnt++;
3263                         mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
3264                         send_association_request(priv, 1);
3265                 }
3266                 break;
3267
3268         default:
3269                 break;
3270         }
3271
3272         spin_unlock_irqrestore(&priv->irqlock, flags);
3273 }
3274
3275 static void atmel_command_irq(struct atmel_private *priv)
3276 {
3277         u8 status = atmel_rmem8(priv, atmel_co(priv, CMD_BLOCK_STATUS_OFFSET));
3278         u8 command = atmel_rmem8(priv, atmel_co(priv, CMD_BLOCK_COMMAND_OFFSET));
3279         int fast_scan;
3280
3281         if (status == CMD_STATUS_IDLE ||
3282             status == CMD_STATUS_IN_PROGRESS)
3283                 return;
3284
3285         switch (command){
3286
3287         case CMD_Start:
3288                 if (status == CMD_STATUS_COMPLETE) {
3289                         priv->station_was_associated = priv->station_is_associated;
3290                         atmel_get_mib(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_CUR_BSSID_POS,
3291                                       (u8 *)priv->CurrentBSSID, 6);
3292                         atmel_enter_state(priv, STATION_STATE_READY);
3293                 }
3294                 break;
3295
3296         case CMD_Scan:
3297                 fast_scan = priv->fast_scan;
3298                 priv->fast_scan = 0;
3299
3300                 if (status != CMD_STATUS_COMPLETE) {
3301                         atmel_scan(priv, 1);
3302                 } else {
3303                         int bss_index = retrieve_bss(priv);
3304                         if (bss_index != -1) {
3305                                 atmel_join_bss(priv, bss_index);
3306                         } else if (priv->operating_mode == IW_MODE_ADHOC &&
3307                                    priv->SSID_size != 0) {
3308                                 start(priv, BSS_TYPE_AD_HOC);
3309                         } else {
3310                                 priv->fast_scan = !fast_scan;
3311                                 atmel_scan(priv, 1);
3312                         }
3313                         priv->site_survey_state = SITE_SURVEY_COMPLETED;
3314                 }
3315                 break;
3316
3317         case CMD_SiteSurvey:
3318                 priv->fast_scan = 0;
3319
3320                 if (status != CMD_STATUS_COMPLETE)
3321                         return;
3322
3323                 priv->site_survey_state = SITE_SURVEY_COMPLETED;
3324                 if (priv->station_is_associated) {
3325                         atmel_enter_state(priv, STATION_STATE_READY);
3326                 } else {
3327                         atmel_scan(priv, 1);
3328                 }
3329                 break;
3330
3331         case CMD_Join:
3332                 if (status == CMD_STATUS_COMPLETE) {
3333                         if (priv->operating_mode == IW_MODE_ADHOC) {
3334                                 priv->station_was_associated = priv->station_is_associated;
3335                                 atmel_enter_state(priv, STATION_STATE_READY);
3336                         } else {
3337                                 priv->AuthenticationRequestRetryCnt = 0;
3338                                 atmel_enter_state(priv, STATION_STATE_AUTHENTICATING);
3339
3340                                 mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
3341                                 priv->CurrentAuthentTransactionSeqNum = 0x0001;
3342                                 send_authentication_request(priv, C80211_MGMT_AAN_SHAREDKEY, NULL, 0);
3343                         }
3344                         return;
3345                 }
3346
3347                 atmel_scan(priv, 1);
3348         }
3349 }
3350
3351 static int atmel_wakeup_firmware(struct atmel_private *priv)
3352 {
3353         struct host_info_struct *iface = &priv->host_info;
3354         u16 mr1, mr3;
3355         int i;
3356
3357         if (priv->card_type == CARD_TYPE_SPI_FLASH)
3358                 atmel_set_gcr(priv->dev, GCR_REMAP);
3359
3360         /* wake up on-board processor */
3361         atmel_clear_gcr(priv->dev, 0x0040);
3362         atmel_write16(priv->dev, BSR, BSS_SRAM);
3363
3364         if (priv->card_type == CARD_TYPE_SPI_FLASH)
3365                 mdelay(100);
3366
3367         /* and wait for it */
3368         for (i = LOOP_RETRY_LIMIT; i; i--) {
3369                 mr1 = atmel_read16(priv->dev, MR1);
3370                 mr3 = atmel_read16(priv->dev, MR3);
3371
3372                 if (mr3 & MAC_BOOT_COMPLETE)
3373                         break;
3374                 if (mr1 & MAC_BOOT_COMPLETE &&
3375                     priv->bus_type == BUS_TYPE_PCCARD)
3376                         break;
3377         }
3378
3379         if (i == 0) {
3380                 printk(KERN_ALERT "%s: MAC failed to boot.\n", priv->dev->name);
3381                 return 0;
3382         }
3383
3384         if ((priv->host_info_base = atmel_read16(priv->dev, MR2)) == 0xffff) {
3385                 printk(KERN_ALERT "%s: card missing.\n", priv->dev->name);
3386                 return 0;
3387         }
3388
3389         /* now check for completion of MAC initialization through
3390            the FunCtrl field of the IFACE, poll MR1 to detect completion of
3391            MAC initialization, check completion status, set interrupt mask,
3392            enables interrupts and calls Tx and Rx initialization functions */
3393
3394         atmel_wmem8(priv, atmel_hi(priv, IFACE_FUNC_CTRL_OFFSET), FUNC_CTRL_INIT_COMPLETE);
3395
3396         for (i = LOOP_RETRY_LIMIT; i; i--) {
3397                 mr1 = atmel_read16(priv->dev, MR1);
3398                 mr3 = atmel_read16(priv->dev, MR3);
3399
3400                 if (mr3 & MAC_INIT_COMPLETE)
3401                         break;
3402                 if (mr1 & MAC_INIT_COMPLETE &&
3403                     priv->bus_type == BUS_TYPE_PCCARD)
3404                         break;
3405         }
3406
3407         if (i == 0) {
3408                 printk(KERN_ALERT "%s: MAC failed to initialise.\n",
3409                                 priv->dev->name);
3410                 return 0;
3411         }
3412
3413         /* Check for MAC_INIT_OK only on the register that the MAC_INIT_OK was set */
3414         if ((mr3 & MAC_INIT_COMPLETE) &&
3415             !(atmel_read16(priv->dev, MR3) & MAC_INIT_OK)) {
3416                 printk(KERN_ALERT "%s: MAC failed MR3 self-test.\n", priv->dev->name);
3417                 return 0;
3418         }
3419         if ((mr1 & MAC_INIT_COMPLETE) &&
3420             !(atmel_read16(priv->dev, MR1) & MAC_INIT_OK)) {
3421                 printk(KERN_ALERT "%s: MAC failed MR1 self-test.\n", priv->dev->name);
3422                 return 0;
3423         }
3424
3425         atmel_copy_to_host(priv->dev, (unsigned char *)iface,
3426                            priv->host_info_base, sizeof(*iface));
3427
3428         iface->tx_buff_pos = le16_to_cpu(iface->tx_buff_pos);
3429         iface->tx_buff_size = le16_to_cpu(iface->tx_buff_size);
3430         iface->tx_desc_pos = le16_to_cpu(iface->tx_desc_pos);
3431         iface->tx_desc_count = le16_to_cpu(iface->tx_desc_count);
3432         iface->rx_buff_pos = le16_to_cpu(iface->rx_buff_pos);
3433         iface->rx_buff_size = le16_to_cpu(iface->rx_buff_size);
3434         iface->rx_desc_pos = le16_to_cpu(iface->rx_desc_pos);
3435         iface->rx_desc_count = le16_to_cpu(iface->rx_desc_count);
3436         iface->build_version = le16_to_cpu(iface->build_version);
3437         iface->command_pos = le16_to_cpu(iface->command_pos);
3438         iface->major_version = le16_to_cpu(iface->major_version);
3439         iface->minor_version = le16_to_cpu(iface->minor_version);
3440         iface->func_ctrl = le16_to_cpu(iface->func_ctrl);
3441         iface->mac_status = le16_to_cpu(iface->mac_status);
3442
3443         return 1;
3444 }
3445
3446 /* determine type of memory and MAC address */
3447 static int probe_atmel_card(struct net_device *dev)
3448 {
3449         int rc = 0;
3450         struct atmel_private *priv = netdev_priv(dev);
3451
3452         /* reset pccard */
3453         if (priv->bus_type == BUS_TYPE_PCCARD)
3454                 atmel_write16(dev, GCR, 0x0060);
3455
3456         atmel_write16(dev, GCR, 0x0040);
3457         mdelay(500);
3458
3459         if (atmel_read16(dev, MR2) == 0) {
3460                 /* No stored firmware so load a small stub which just
3461                    tells us the MAC address */
3462                 int i;
3463                 priv->card_type = CARD_TYPE_EEPROM;
3464                 atmel_write16(dev, BSR, BSS_IRAM);
3465                 atmel_copy_to_card(dev, 0, mac_reader, sizeof(mac_reader));
3466                 atmel_set_gcr(dev, GCR_REMAP);
3467                 atmel_clear_gcr(priv->dev, 0x0040);
3468                 atmel_write16(dev, BSR, BSS_SRAM);
3469                 for (i = LOOP_RETRY_LIMIT; i; i--)
3470                         if (atmel_read16(dev, MR3) & MAC_BOOT_COMPLETE)
3471                                 break;
3472                 if (i == 0) {
3473                         printk(KERN_ALERT "%s: MAC failed to boot MAC address reader.\n", dev->name);
3474                 } else {
3475                         atmel_copy_to_host(dev, dev->dev_addr, atmel_read16(dev, MR2), 6);
3476                         /* got address, now squash it again until the network
3477                            interface is opened */
3478                         if (priv->bus_type == BUS_TYPE_PCCARD)
3479                                 atmel_write16(dev, GCR, 0x0060);
3480                         atmel_write16(dev, GCR, 0x0040);
3481                         rc = 1;
3482                 }
3483         } else if (atmel_read16(dev, MR4) == 0) {
3484                 /* Mac address easy in this case. */
3485                 priv->card_type = CARD_TYPE_PARALLEL_FLASH;
3486                 atmel_write16(dev,  BSR, 1);
3487                 atmel_copy_to_host(dev, dev->dev_addr, 0xc000, 6);
3488                 atmel_write16(dev,  BSR, 0x200);
3489                 rc = 1;
3490         } else {
3491                 /* Standard firmware in flash, boot it up and ask
3492                    for the Mac Address */
3493                 priv->card_type = CARD_TYPE_SPI_FLASH;
3494                 if (atmel_wakeup_firmware(priv)) {
3495                         atmel_get_mib(priv, Mac_Address_Mib_Type, 0, dev->dev_addr, 6);
3496
3497                         /* got address, now squash it again until the network
3498                            interface is opened */
3499                         if (priv->bus_type == BUS_TYPE_PCCARD)
3500                                 atmel_write16(dev, GCR, 0x0060);
3501                         atmel_write16(dev, GCR, 0x0040);
3502                         rc = 1;
3503                 }
3504         }
3505
3506         if (rc) {
3507                 if (dev->dev_addr[0] == 0xFF) {
3508                         u8 default_mac[] = {0x00,0x04, 0x25, 0x00, 0x00, 0x00};
3509                         printk(KERN_ALERT "%s: *** Invalid MAC address. UPGRADE Firmware ****\n", dev->name);
3510                         memcpy(dev->dev_addr, default_mac, 6);
3511                 }
3512         }
3513
3514         return rc;
3515 }
3516
3517 /* Move the encyption information on the MIB structure.
3518    This routine is for the pre-WPA firmware: later firmware has
3519    a different format MIB and a different routine. */
3520 static void build_wep_mib(struct atmel_private *priv)
3521 {
3522         struct { /* NB this is matched to the hardware, don't change. */
3523                 u8 wep_is_on;
3524                 u8 default_key; /* 0..3 */
3525                 u8 reserved;
3526                 u8 exclude_unencrypted;
3527
3528                 u32 WEPICV_error_count;
3529                 u32 WEP_excluded_count;
3530
3531                 u8 wep_keys[MAX_ENCRYPTION_KEYS][13];
3532                 u8 encryption_level; /* 0, 1, 2 */
3533                 u8 reserved2[3];
3534         } mib;
3535         int i;
3536
3537         mib.wep_is_on = priv->wep_is_on;
3538         if (priv->wep_is_on) {
3539                 if (priv->wep_key_len[priv->default_key] > 5)
3540                         mib.encryption_level = 2;
3541                 else
3542                         mib.encryption_level = 1;
3543         } else {
3544                 mib.encryption_level = 0;
3545         }
3546
3547         mib.default_key = priv->default_key;
3548         mib.exclude_unencrypted = priv->exclude_unencrypted;
3549
3550         for (i = 0; i < MAX_ENCRYPTION_KEYS; i++)
3551                 memcpy(mib.wep_keys[i], priv->wep_keys[i], 13);
3552
3553         atmel_set_mib(priv, Mac_Wep_Mib_Type, 0, (u8 *)&mib, sizeof(mib));
3554 }
3555
3556 static void build_wpa_mib(struct atmel_private *priv)
3557 {
3558         /* This is for the later (WPA enabled) firmware. */
3559
3560         struct { /* NB this is matched to the hardware, don't change. */
3561                 u8 cipher_default_key_value[MAX_ENCRYPTION_KEYS][MAX_ENCRYPTION_KEY_SIZE];
3562                 u8 receiver_address[6];
3563                 u8 wep_is_on;
3564                 u8 default_key; /* 0..3 */
3565                 u8 group_key;
3566                 u8 exclude_unencrypted;
3567                 u8 encryption_type;
3568                 u8 reserved;
3569
3570                 u32 WEPICV_error_count;
3571                 u32 WEP_excluded_count;
3572
3573                 u8 key_RSC[4][8];
3574         } mib;
3575
3576         int i;
3577
3578         mib.wep_is_on = priv->wep_is_on;
3579         mib.exclude_unencrypted = priv->exclude_unencrypted;
3580         memcpy(mib.receiver_address, priv->CurrentBSSID, 6);
3581
3582         /* zero all the keys before adding in valid ones. */
3583         memset(mib.cipher_default_key_value, 0, sizeof(mib.cipher_default_key_value));
3584
3585         if (priv->wep_is_on) {
3586                 /* There's a comment in the Atmel code to the effect that this
3587                    is only valid when still using WEP, it may need to be set to
3588                    something to use WPA */
3589                 memset(mib.key_RSC, 0, sizeof(mib.key_RSC));
3590
3591                 mib.default_key = mib.group_key = 255;
3592                 for (i = 0; i < MAX_ENCRYPTION_KEYS; i++) {
3593                         if (priv->wep_key_len[i] > 0) {
3594                                 memcpy(mib.cipher_default_key_value[i], priv->wep_keys[i], MAX_ENCRYPTION_KEY_SIZE);
3595                                 if (i == priv->default_key) {
3596                                         mib.default_key = i;
3597                                         mib.cipher_default_key_value[i][MAX_ENCRYPTION_KEY_SIZE-1] = 7;
3598                                         mib.cipher_default_key_value[i][MAX_ENCRYPTION_KEY_SIZE-2] = priv->pairwise_cipher_suite;
3599                                 } else {
3600                                         mib.group_key = i;
3601                                         priv->group_cipher_suite = priv->pairwise_cipher_suite;
3602                                         mib.cipher_default_key_value[i][MAX_ENCRYPTION_KEY_SIZE-1] = 1;
3603                                         mib.cipher_default_key_value[i][MAX_ENCRYPTION_KEY_SIZE-2] = priv->group_cipher_suite;
3604                                 }
3605                         }
3606                 }
3607                 if (mib.default_key == 255)
3608                         mib.default_key = mib.group_key != 255 ? mib.group_key : 0;
3609                 if (mib.group_key == 255)
3610                         mib.group_key = mib.default_key;
3611
3612         }
3613
3614         atmel_set_mib(priv, Mac_Wep_Mib_Type, 0, (u8 *)&mib, sizeof(mib));
3615 }
3616
3617 static int reset_atmel_card(struct net_device *dev)
3618 {
3619         /* do everything necessary to wake up the hardware, including
3620            waiting for the lightning strike and throwing the knife switch....
3621
3622            set all the Mib values which matter in the card to match
3623            their settings in the atmel_private structure. Some of these
3624            can be altered on the fly, but many (WEP, infrastucture or ad-hoc)
3625            can only be changed by tearing down the world and coming back through
3626            here.
3627
3628            This routine is also responsible for initialising some
3629            hardware-specific fields in the atmel_private structure,
3630            including a copy of the firmware's hostinfo stucture
3631            which is the route into the rest of the firmare datastructures. */
3632
3633         struct atmel_private *priv = netdev_priv(dev);
3634         u8 configuration;
3635
3636         /* data to add to the firmware names, in priority order
3637            this implemenents firmware versioning */
3638
3639         static char *firmware_modifier[] = {
3640                 "-wpa",
3641                 "",
3642                 NULL
3643         };
3644
3645         /* reset pccard */
3646         if (priv->bus_type == BUS_TYPE_PCCARD)
3647                 atmel_write16(priv->dev, GCR, 0x0060);
3648
3649         /* stop card , disable interrupts */
3650         atmel_write16(priv->dev, GCR, 0x0040);
3651
3652         if (priv->card_type == CARD_TYPE_EEPROM) {
3653                 /* copy in firmware if needed */
3654                 const struct firmware *fw_entry = NULL;
3655                 unsigned char *fw;
3656                 int len = priv->firmware_length;
3657                 if (!(fw = priv->firmware)) {
3658                         if (priv->firmware_type == ATMEL_FW_TYPE_NONE) {
3659                                 if (strlen(priv->firmware_id) == 0) {
3660                                         printk(KERN_INFO
3661                                                "%s: card type is unknown: assuming at76c502 firmware is OK.\n",
3662                                                dev->name);
3663                                         printk(KERN_INFO
3664                                                "%s: if not, use the firmware= module parameter.\n",
3665                                                dev->name);
3666                                         strcpy(priv->firmware_id, "atmel_at76c502.bin");
3667                                 }
3668                                 if (request_firmware(&fw_entry, priv->firmware_id, priv->sys_dev) != 0) {
3669                                         printk(KERN_ALERT
3670                                                "%s: firmware %s is missing, cannot continue.\n",
3671                                                dev->name, priv->firmware_id);
3672                                         return 0;
3673                                 }
3674                         } else {
3675                                 int fw_index = 0;
3676                                 int success = 0;
3677
3678                                 /* get firmware filename entry based on firmware type ID */
3679                                 while (fw_table[fw_index].fw_type != priv->firmware_type
3680                                                 && fw_table[fw_index].fw_type != ATMEL_FW_TYPE_NONE)
3681                                         fw_index++;
3682
3683                                 /* construct the actual firmware file name */
3684                                 if (fw_table[fw_index].fw_type != ATMEL_FW_TYPE_NONE) {
3685                                         int i;
3686                                         for (i = 0; firmware_modifier[i]; i++) {
3687                                                 snprintf(priv->firmware_id, 32, "%s%s.%s", fw_table[fw_index].fw_file,
3688                                                         firmware_modifier[i], fw_table[fw_index].fw_file_ext);
3689                                                 priv->firmware_id[31] = '\0';
3690                                                 if (request_firmware(&fw_entry, priv->firmware_id, priv->sys_dev) == 0) {
3691                                                         success = 1;
3692                                                         break;
3693                                                 }
3694                                         }
3695                                 }
3696                                 if (!success) {
3697                                         printk(KERN_ALERT
3698                                                "%s: firmware %s is missing, cannot start.\n",
3699                                                dev->name, priv->firmware_id);
3700                                         priv->firmware_id[0] = '\0';
3701                                         return 0;
3702                                 }
3703                         }
3704
3705                         fw = fw_entry->data;
3706                         len = fw_entry->size;
3707                 }
3708
3709                 if (len <= 0x6000) {
3710                         atmel_write16(priv->dev, BSR, BSS_IRAM);
3711                         atmel_copy_to_card(priv->dev, 0, fw, len);
3712                         atmel_set_gcr(priv->dev, GCR_REMAP);
3713                 } else {
3714                         /* Remap */
3715                         atmel_set_gcr(priv->dev, GCR_REMAP);
3716                         atmel_write16(priv->dev, BSR, BSS_IRAM);
3717                         atmel_copy_to_card(priv->dev, 0, fw, 0x6000);
3718                         atmel_write16(priv->dev, BSR, 0x2ff);
3719                         atmel_copy_to_card(priv->dev, 0x8000, &fw[0x6000], len - 0x6000);
3720                 }
3721
3722                 if (fw_entry)
3723                         release_firmware(fw_entry);
3724         }
3725
3726         if (!atmel_wakeup_firmware(priv))
3727                 return 0;
3728
3729         /* Check the version and set the correct flag for wpa stuff,
3730            old and new firmware is incompatible.
3731            The pre-wpa 3com firmware reports major version 5,
3732            the wpa 3com firmware is major version 4 and doesn't need
3733            the 3com broken-ness filter. */
3734         priv->use_wpa = (priv->host_info.major_version == 4);
3735         priv->radio_on_broken = (priv->host_info.major_version == 5);
3736
3737         /* unmask all irq sources */
3738         atmel_wmem8(priv, atmel_hi(priv, IFACE_INT_MASK_OFFSET), 0xff);
3739
3740         /* int Tx system and enable Tx */
3741         atmel_wmem8(priv, atmel_tx(priv, TX_DESC_FLAGS_OFFSET, 0), 0);
3742         atmel_wmem32(priv, atmel_tx(priv, TX_DESC_NEXT_OFFSET, 0), 0x80000000L);
3743         atmel_wmem16(priv, atmel_tx(priv, TX_DESC_POS_OFFSET, 0), 0);
3744         atmel_wmem16(priv, atmel_tx(priv, TX_DESC_SIZE_OFFSET, 0), 0);
3745
3746         priv->tx_desc_free = priv->host_info.tx_desc_count;
3747         priv->tx_desc_head = 0;
3748         priv->tx_desc_tail = 0;
3749         priv->tx_desc_previous = 0;
3750         priv->tx_free_mem = priv->host_info.tx_buff_size;
3751         priv->tx_buff_head = 0;
3752         priv->tx_buff_tail = 0;
3753
3754         configuration = atmel_rmem8(priv, atmel_hi(priv, IFACE_FUNC_CTRL_OFFSET));
3755         atmel_wmem8(priv, atmel_hi(priv, IFACE_FUNC_CTRL_OFFSET),
3756                                    configuration | FUNC_CTRL_TxENABLE);
3757
3758         /* init Rx system and enable */
3759         priv->rx_desc_head = 0;
3760
3761         configuration = atmel_rmem8(priv, atmel_hi(priv, IFACE_FUNC_CTRL_OFFSET));
3762         atmel_wmem8(priv, atmel_hi(priv, IFACE_FUNC_CTRL_OFFSET),
3763                                    configuration | FUNC_CTRL_RxENABLE);
3764
3765         if (!priv->radio_on_broken) {
3766                 if (atmel_send_command_wait(priv, CMD_EnableRadio, NULL, 0) ==
3767                     CMD_STATUS_REJECTED_RADIO_OFF) {
3768                         printk(KERN_INFO
3769                                "%s: cannot turn the radio on. (Hey radio, you're beautiful!)\n",
3770                                dev->name);
3771                         return 0;
3772                 }
3773         }
3774
3775         /* set up enough MIB values to run. */
3776         atmel_set_mib8(priv, Local_Mib_Type, LOCAL_MIB_AUTO_TX_RATE_POS, priv->auto_tx_rate);
3777         atmel_set_mib8(priv, Local_Mib_Type,  LOCAL_MIB_TX_PROMISCUOUS_POS,  PROM_MODE_OFF);
3778         atmel_set_mib16(priv, Mac_Mib_Type, MAC_MIB_RTS_THRESHOLD_POS, priv->rts_threshold);
3779         atmel_set_mib16(priv, Mac_Mib_Type, MAC_MIB_FRAG_THRESHOLD_POS, priv->frag_threshold);
3780         atmel_set_mib8(priv, Mac_Mib_Type, MAC_MIB_SHORT_RETRY_POS, priv->short_retry);
3781         atmel_set_mib8(priv, Mac_Mib_Type, MAC_MIB_LONG_RETRY_POS, priv->long_retry);
3782         atmel_set_mib8(priv, Local_Mib_Type, LOCAL_MIB_PREAMBLE_TYPE, priv->preamble);
3783         atmel_set_mib(priv, Mac_Address_Mib_Type, MAC_ADDR_MIB_MAC_ADDR_POS,
3784                       priv->dev->dev_addr, 6);
3785         atmel_set_mib8(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_PS_MODE_POS, ACTIVE_MODE);
3786         atmel_set_mib16(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_LISTEN_INTERVAL_POS, 1);
3787         atmel_set_mib16(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_BEACON_PER_POS, priv->default_beacon_period);
3788         atmel_set_mib(priv, Phy_Mib_Type, PHY_MIB_RATE_SET_POS, atmel_basic_rates, 4);
3789         atmel_set_mib8(priv, Mac_Mgmt_Mib_Type, MAC_MGMT_MIB_CUR_PRIVACY_POS, priv->wep_is_on);
3790         if (priv->use_wpa)
3791                 build_wpa_mib(priv);
3792         else
3793                 build_wep_mib(priv);
3794
3795         return 1;
3796 }
3797
3798 static void atmel_send_command(struct atmel_private *priv, int command,
3799                                void *cmd, int cmd_size)
3800 {
3801         if (cmd)
3802                 atmel_copy_to_card(priv->dev, atmel_co(priv, CMD_BLOCK_PARAMETERS_OFFSET),
3803                                    cmd, cmd_size);
3804
3805         atmel_wmem8(priv, atmel_co(priv, CMD_BLOCK_COMMAND_OFFSET), command);
3806         atmel_wmem8(priv, atmel_co(priv, CMD_BLOCK_STATUS_OFFSET), 0);
3807 }
3808
3809 static int atmel_send_command_wait(struct atmel_private *priv, int command,
3810                                    void *cmd, int cmd_size)
3811 {
3812         int i, status;
3813
3814         atmel_send_command(priv, command, cmd, cmd_size);
3815
3816         for (i = 5000; i; i--) {
3817                 status = atmel_rmem8(priv, atmel_co(priv, CMD_BLOCK_STATUS_OFFSET));
3818                 if (status != CMD_STATUS_IDLE &&
3819                     status != CMD_STATUS_IN_PROGRESS)
3820                         break;
3821                 udelay(20);
3822         }
3823
3824         if (i == 0) {
3825                 printk(KERN_ALERT "%s: failed to contact MAC.\n", priv->dev->name);
3826                 status =  CMD_STATUS_HOST_ERROR;
3827         } else {
3828                 if (command != CMD_EnableRadio)
3829                         status = CMD_STATUS_COMPLETE;
3830         }
3831
3832         return status;
3833 }
3834
3835 static u8 atmel_get_mib8(struct atmel_private *priv, u8 type, u8 index)
3836 {
3837         struct get_set_mib m;
3838         m.type = type;
3839         m.size = 1;
3840         m.index = index;
3841
3842         atmel_send_command_wait(priv, CMD_Get_MIB_Vars, &m, MIB_HEADER_SIZE + 1);
3843         return atmel_rmem8(priv, atmel_co(priv, CMD_BLOCK_PARAMETERS_OFFSET + MIB_HEADER_SIZE));
3844 }
3845
3846 static void atmel_set_mib8(struct atmel_private *priv, u8 type, u8 index, u8 data)
3847 {
3848         struct get_set_mib m;
3849         m.type = type;
3850         m.size = 1;
3851         m.index = index;
3852         m.data[0] = data;
3853
3854         atmel_send_command_wait(priv, CMD_Set_MIB_Vars, &m, MIB_HEADER_SIZE + 1);
3855 }
3856
3857 static void atmel_set_mib16(struct atmel_private *priv, u8 type, u8 index,
3858                             u16 data)
3859 {
3860         struct get_set_mib m;
3861         m.type = type;
3862         m.size = 2;
3863         m.index = index;
3864         m.data[0] = data;
3865         m.data[1] = data >> 8;
3866
3867         atmel_send_command_wait(priv, CMD_Set_MIB_Vars, &m, MIB_HEADER_SIZE + 2);
3868 }
3869
3870 static void atmel_set_mib(struct atmel_private *priv, u8 type, u8 index,
3871                           u8 *data, int data_len)
3872 {
3873         struct get_set_mib m;
3874         m.type = type;
3875         m.size = data_len;
3876         m.index = index;
3877
3878         if (data_len > MIB_MAX_DATA_BYTES)
3879                 printk(KERN_ALERT "%s: MIB buffer too small.\n", priv->dev->name);
3880
3881         memcpy(m.data, data, data_len);
3882         atmel_send_command_wait(priv, CMD_Set_MIB_Vars, &m, MIB_HEADER_SIZE + data_len);
3883 }
3884
3885 static void atmel_get_mib(struct atmel_private *priv, u8 type, u8 index,
3886                           u8 *data, int data_len)
3887 {
3888         struct get_set_mib m;
3889         m.type = type;
3890         m.size = data_len;
3891         m.index = index;
3892
3893         if (data_len > MIB_MAX_DATA_BYTES)
3894                 printk(KERN_ALERT "%s: MIB buffer too small.\n", priv->dev->name);
3895
3896         atmel_send_command_wait(priv, CMD_Get_MIB_Vars, &m, MIB_HEADER_SIZE + data_len);
3897         atmel_copy_to_host(priv->dev, data,
3898                            atmel_co(priv, CMD_BLOCK_PARAMETERS_OFFSET + MIB_HEADER_SIZE), data_len);
3899 }
3900
3901 static void atmel_writeAR(struct net_device *dev, u16 data)
3902 {
3903         int i;
3904         outw(data, dev->base_addr + AR);
3905         /* Address register appears to need some convincing..... */
3906         for (i = 0; data != inw(dev->base_addr + AR) && i < 10; i++)
3907                 outw(data, dev->base_addr + AR);
3908 }
3909
3910 static void atmel_copy_to_card(struct net_device *dev, u16 dest,
3911                                unsigned char *src, u16 len)
3912 {
3913         int i;
3914         atmel_writeAR(dev, dest);
3915         if (dest % 2) {
3916                 atmel_write8(dev, DR, *src);
3917                 src++; len--;
3918         }
3919         for (i = len; i > 1 ; i -= 2) {
3920                 u8 lb = *src++;
3921                 u8 hb = *src++;
3922                 atmel_write16(dev, DR, lb | (hb << 8));
3923         }
3924         if (i)
3925                 atmel_write8(dev, DR, *src);
3926 }
3927
3928 static void atmel_copy_to_host(struct net_device *dev, unsigned char *dest,
3929                                u16 src, u16 len)
3930 {
3931         int i;
3932         atmel_writeAR(dev, src);
3933         if (src % 2) {
3934                 *dest = atmel_read8(dev, DR);
3935                 dest++; len--;
3936         }
3937         for (i = len; i > 1 ; i -= 2) {
3938                 u16 hw = atmel_read16(dev, DR);
3939                 *dest++ = hw;
3940                 *dest++ = hw >> 8;
3941         }
3942         if (i)
3943                 *dest = atmel_read8(dev, DR);
3944 }
3945
3946 static void atmel_set_gcr(struct net_device *dev, u16 mask)
3947 {
3948         outw(inw(dev->base_addr + GCR) | mask, dev->base_addr + GCR);
3949 }
3950
3951 static void atmel_clear_gcr(struct net_device *dev, u16 mask)
3952 {
3953         outw(inw(dev->base_addr + GCR) & ~mask, dev->base_addr + GCR);
3954 }
3955
3956 static int atmel_lock_mac(struct atmel_private *priv)
3957 {
3958         int i, j = 20;
3959  retry:
3960         for (i = 5000; i; i--) {
3961                 if (!atmel_rmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_HOST_OFFSET)))
3962                         break;
3963                 udelay(20);
3964         }
3965
3966         if (!i)
3967                 return 0; /* timed out */
3968
3969         atmel_wmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_MAC_OFFSET), 1);
3970         if (atmel_rmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_HOST_OFFSET))) {
3971                 atmel_wmem8(priv, atmel_hi(priv, IFACE_LOCKOUT_MAC_OFFSET), 0);
3972                 if (!j--)
3973                         return 0; /* timed out */
3974                 goto retry;
3975         }
3976
3977         return 1;
3978 }
3979
3980 static void atmel_wmem32(struct atmel_private *priv, u16 pos, u32 data)
3981 {
3982         atmel_writeAR(priv->dev, pos);
3983         atmel_write16(priv->dev, DR, data); /* card is little-endian */
3984         atmel_write16(priv->dev, DR, data >> 16);
3985 }
3986
3987 /***************************************************************************/
3988 /* There follows the source form of the MAC address reading firmware       */
3989 /***************************************************************************/
3990 #if 0
3991
3992 /* Copyright 2003 Matthew T. Russotto                                      */
3993 /* But derived from the Atmel 76C502 firmware written by Atmel and         */
3994 /* included in "atmel wireless lan drivers" package                        */
3995 /**
3996     This file is part of net.russotto.AtmelMACFW, hereto referred to
3997     as AtmelMACFW
3998
3999     AtmelMACFW is free software; you can redistribute it and/or modify
4000     it under the terms of the GNU General Public License version 2
4001     as published by the Free Software Foundation.
4002
4003     AtmelMACFW is distributed in the hope that it will be useful,
4004     but WITHOUT ANY WARRANTY; without even the implied warranty of
4005     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
4006     GNU General Public License for more details.
4007
4008     You should have received a copy of the GNU General Public License
4009     along with AtmelMACFW; if not, write to the Free Software
4010     Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
4011
4012 ****************************************************************************/
4013 /* This firmware should work on the 76C502 RFMD, RFMD_D, and RFMD_E        */
4014 /* It will probably work on the 76C504 and 76C502 RFMD_3COM                */
4015 /* It only works on SPI EEPROM versions of the card.                       */
4016
4017 /* This firmware initializes the SPI controller and clock, reads the MAC   */
4018 /* address from the EEPROM into SRAM, and puts the SRAM offset of the MAC  */
4019 /* address in MR2, and sets MR3 to 0x10 to indicate it is done             */
4020 /* It also puts a complete copy of the EEPROM in SRAM with the offset in   */
4021 /* MR4, for investigational purposes (maybe we can determine chip type     */
4022 /* from that?)                                                             */
4023
4024         .org 0
4025     .set MRBASE, 0x8000000
4026         .set CPSR_INITIAL, 0xD3 /* IRQ/FIQ disabled, ARM mode, Supervisor state */
4027         .set CPSR_USER, 0xD1 /* IRQ/FIQ disabled, ARM mode, USER state */
4028         .set SRAM_BASE,  0x02000000
4029         .set SP_BASE,    0x0F300000
4030         .set UNK_BASE,   0x0F000000 /* Some internal device, but which one? */
4031         .set SPI_CGEN_BASE,  0x0E000000 /* Some internal device, but which one? */
4032         .set UNK3_BASE,  0x02014000 /* Some internal device, but which one? */
4033         .set STACK_BASE, 0x5600
4034         .set SP_SR, 0x10
4035         .set SP_TDRE, 2 /* status register bit -- TDR empty */
4036         .set SP_RDRF, 1 /* status register bit -- RDR full */
4037         .set SP_SWRST, 0x80
4038         .set SP_SPIEN, 0x1
4039         .set SP_CR, 0   /* control register */
4040         .set SP_MR, 4   /* mode register */
4041         .set SP_RDR, 0x08 /* Read Data Register */
4042         .set SP_TDR, 0x0C /* Transmit Data Register */
4043         .set SP_CSR0, 0x30 /* chip select registers */
4044         .set SP_CSR1, 0x34
4045         .set SP_CSR2, 0x38
4046         .set SP_CSR3, 0x3C
4047         .set NVRAM_CMD_RDSR, 5 /* read status register */
4048         .set NVRAM_CMD_READ, 3 /* read data */
4049         .set NVRAM_SR_RDY, 1 /* RDY bit.  This bit is inverted */
4050         .set SPI_8CLOCKS, 0xFF /* Writing this to the TDR doesn't do anything to the
4051                                   serial output, since SO is normally high.  But it
4052                                   does cause 8 clock cycles and thus 8 bits to be
4053                                   clocked in to the chip.  See Atmel's SPI
4054                                   controller (e.g. AT91M55800) timing and 4K
4055                                   SPI EEPROM manuals */
4056
4057         .set NVRAM_SCRATCH, 0x02000100  /* arbitrary area for scratchpad memory */
4058         .set NVRAM_IMAGE, 0x02000200
4059         .set NVRAM_LENGTH, 0x0200
4060         .set MAC_ADDRESS_MIB, SRAM_BASE
4061         .set MAC_ADDRESS_LENGTH, 6
4062         .set MAC_BOOT_FLAG, 0x10
4063         .set MR1, 0
4064         .set MR2, 4
4065         .set MR3, 8
4066         .set MR4, 0xC
4067 RESET_VECTOR:
4068         b RESET_HANDLER
4069 UNDEF_VECTOR:
4070         b HALT1
4071 SWI_VECTOR:
4072         b HALT1
4073 IABORT_VECTOR:
4074         b HALT1
4075 DABORT_VECTOR:
4076 RESERVED_VECTOR:
4077         b HALT1
4078 IRQ_VECTOR:
4079         b HALT1
4080 FIQ_VECTOR:
4081         b HALT1
4082 HALT1:  b HALT1
4083 RESET_HANDLER:
4084         mov     r0, #CPSR_INITIAL
4085         msr     CPSR_c, r0      /* This is probably unnecessary */
4086
4087 /* I'm guessing this is initializing clock generator electronics for SPI */
4088         ldr     r0, =SPI_CGEN_BASE
4089         mov     r1, #0
4090         mov     r1, r1, lsl #3
4091         orr     r1,r1, #0
4092         str     r1, [r0]
4093         ldr     r1, [r0, #28]
4094         bic     r1, r1, #16
4095         str     r1, [r0, #28]
4096         mov     r1, #1
4097         str     r1, [r0, #8]
4098
4099         ldr     r0, =MRBASE
4100         mov     r1, #0
4101         strh    r1, [r0, #MR1]
4102         strh    r1, [r0, #MR2]
4103         strh    r1, [r0, #MR3]
4104         strh    r1, [r0, #MR4]
4105
4106         mov     sp, #STACK_BASE
4107         bl      SP_INIT
4108         mov     r0, #10
4109         bl      DELAY9
4110         bl      GET_MAC_ADDR
4111         bl      GET_WHOLE_NVRAM
4112         ldr     r0, =MRBASE
4113         ldr     r1, =MAC_ADDRESS_MIB
4114         strh    r1, [r0, #MR2]
4115         ldr     r1, =NVRAM_IMAGE
4116         strh    r1, [r0, #MR4]
4117         mov     r1, #MAC_BOOT_FLAG
4118         strh    r1, [r0, #MR3]
4119 HALT2:  b HALT2
4120 .func Get_Whole_NVRAM, GET_WHOLE_NVRAM
4121 GET_WHOLE_NVRAM:
4122         stmdb   sp!, {lr}
4123         mov     r2, #0 /* 0th bytes of NVRAM */
4124         mov     r3, #NVRAM_LENGTH
4125         mov     r1, #0          /* not used in routine */
4126         ldr     r0, =NVRAM_IMAGE
4127         bl      NVRAM_XFER
4128         ldmia   sp!, {lr}
4129         bx      lr
4130 .endfunc
4131
4132 .func Get_MAC_Addr, GET_MAC_ADDR
4133 GET_MAC_ADDR:
4134         stmdb   sp!, {lr}
4135         mov     r2, #0x120      /* address of MAC Address within NVRAM */
4136         mov     r3, #MAC_ADDRESS_LENGTH
4137         mov     r1, #0          /* not used in routine */
4138         ldr     r0, =MAC_ADDRESS_MIB
4139         bl      NVRAM_XFER
4140         ldmia   sp!, {lr}
4141         bx      lr
4142 .endfunc
4143 .ltorg
4144 .func Delay9, DELAY9
4145 DELAY9:
4146         adds    r0, r0, r0, LSL #3   /* r0 = r0 * 9 */
4147 DELAYLOOP:
4148         beq     DELAY9_done
4149         subs    r0, r0, #1
4150         b       DELAYLOOP
4151 DELAY9_done:
4152         bx      lr
4153 .endfunc
4154
4155 .func SP_Init, SP_INIT
4156 SP_INIT:
4157         mov     r1, #SP_SWRST
4158         ldr     r0, =SP_BASE
4159         str     r1, [r0, #SP_CR] /* reset the SPI */
4160         mov     r1, #0
4161         str     r1, [r0, #SP_CR] /* release SPI from reset state */
4162         mov     r1, #SP_SPIEN
4163         str     r1, [r0, #SP_MR] /* set the SPI to MASTER mode*/
4164         str     r1, [r0, #SP_CR] /* enable the SPI */
4165
4166 /*  My guess would be this turns on the SPI clock */
4167         ldr     r3, =SPI_CGEN_BASE
4168         ldr     r1, [r3, #28]
4169         orr     r1, r1, #0x2000
4170         str     r1, [r3, #28]
4171
4172         ldr     r1, =0x2000c01
4173         str     r1, [r0, #SP_CSR0]
4174         ldr     r1, =0x2000201
4175         str     r1, [r0, #SP_CSR1]
4176         str     r1, [r0, #SP_CSR2]
4177         str     r1, [r0, #SP_CSR3]
4178         ldr     r1, [r0, #SP_SR]
4179         ldr     r0, [r0, #SP_RDR]
4180         bx      lr
4181 .endfunc
4182 .func NVRAM_Init, NVRAM_INIT
4183 NVRAM_INIT:
4184         ldr     r1, =SP_BASE
4185         ldr     r0, [r1, #SP_RDR]
4186         mov     r0, #NVRAM_CMD_RDSR
4187         str     r0, [r1, #SP_TDR]
4188 SP_loop1:
4189         ldr     r0, [r1, #SP_SR]
4190         tst     r0, #SP_TDRE
4191         beq     SP_loop1
4192
4193         mov     r0, #SPI_8CLOCKS
4194         str     r0, [r1, #SP_TDR]
4195 SP_loop2:
4196         ldr     r0, [r1, #SP_SR]
4197         tst     r0, #SP_TDRE
4198         beq     SP_loop2
4199
4200         ldr     r0, [r1, #SP_RDR]
4201 SP_loop3:
4202         ldr     r0, [r1, #SP_SR]
4203         tst     r0, #SP_RDRF
4204         beq     SP_loop3
4205
4206         ldr     r0, [r1, #SP_RDR]
4207         and     r0, r0, #255
4208         bx      lr
4209 .endfunc
4210
4211 .func NVRAM_Xfer, NVRAM_XFER
4212         /* r0 = dest address */
4213         /* r1 = not used */
4214         /* r2 = src address within NVRAM */
4215         /* r3 = length */
4216 NVRAM_XFER:
4217         stmdb   sp!, {r4, r5, lr}
4218         mov     r5, r0          /* save r0 (dest address) */
4219         mov     r4, r3          /* save r3 (length) */
4220         mov     r0, r2, LSR #5 /*  SPI memories put A8 in the command field */
4221         and     r0, r0, #8
4222         add     r0, r0, #NVRAM_CMD_READ
4223         ldr     r1, =NVRAM_SCRATCH
4224         strb    r0, [r1, #0]    /* save command in NVRAM_SCRATCH[0] */
4225         strb    r2, [r1, #1]    /* save low byte of source address in NVRAM_SCRATCH[1] */
4226 _local1:
4227         bl      NVRAM_INIT
4228         tst     r0, #NVRAM_SR_RDY
4229         bne     _local1
4230         mov     r0, #20
4231         bl      DELAY9
4232         mov     r2, r4          /* length */
4233         mov     r1, r5          /* dest address */
4234         mov     r0, #2          /* bytes to transfer in command */
4235         bl      NVRAM_XFER2
4236         ldmia   sp!, {r4, r5, lr}
4237         bx      lr
4238 .endfunc
4239
4240 .func NVRAM_Xfer2, NVRAM_XFER2
4241 NVRAM_XFER2:
4242         stmdb   sp!, {r4, r5, r6, lr}
4243         ldr     r4, =SP_BASE
4244         mov     r3, #0
4245         cmp     r0, #0
4246         bls     _local2
4247         ldr     r5, =NVRAM_SCRATCH
4248 _local4:
4249         ldrb    r6, [r5, r3]
4250         str     r6, [r4, #SP_TDR]
4251 _local3:
4252         ldr     r6, [r4, #SP_SR]
4253         tst     r6, #SP_TDRE
4254         beq     _local3
4255         add     r3, r3, #1
4256         cmp     r3, r0 /* r0 is # of bytes to send out (command+addr) */
4257         blo     _local4
4258 _local2:
4259         mov     r3, #SPI_8CLOCKS
4260         str     r3, [r4, #SP_TDR]
4261         ldr     r0, [r4, #SP_RDR]
4262 _local5:
4263         ldr     r0, [r4, #SP_SR]
4264         tst     r0, #SP_RDRF
4265         beq     _local5
4266         ldr     r0, [r4, #SP_RDR] /* what's this byte?  It's the byte read while writing the TDR -- nonsense, because the NVRAM doesn't read and write at the same time */
4267         mov     r0, #0
4268         cmp     r2, #0  /* r2 is # of bytes to copy in */
4269         bls     _local6
4270 _local7:
4271         ldr     r5, [r4, #SP_SR]
4272         tst     r5, #SP_TDRE
4273         beq     _local7
4274         str     r3, [r4, #SP_TDR]  /* r3 has SPI_8CLOCKS */
4275 _local8:
4276         ldr     r5, [r4, #SP_SR]
4277         tst     r5, #SP_RDRF
4278         beq     _local8
4279         ldr     r5, [r4, #SP_RDR] /* but didn't we read this byte above? */
4280         strb    r5, [r1], #1 /* postindexed */
4281         add     r0, r0, #1
4282         cmp     r0, r2
4283         blo     _local7 /* since we don't send another address, the NVRAM must be capable of sequential reads */
4284 _local6:
4285         mov     r0, #200
4286         bl      DELAY9
4287         ldmia   sp!, {r4, r5, r6, lr}
4288         bx      lr
4289 #endif