3 * Driver core for the "Hermes" wireless MAC controller, as used in
4 * the Lucent Orinoco and Cabletron RoamAbout cards. It should also
5 * work on the hfa3841 and hfa3842 MAC controller chips used in the
6 * Prism I & II chipsets.
8 * This is not a complete driver, just low-level access routines for
9 * the MAC controller itself.
11 * Based on the prism2 driver from Absolute Value Systems' linux-wlan
12 * project, the Linux wvlan_cs driver, Lucent's HCF-Light
13 * (wvlan_hcf.c) library, and the NetBSD wireless driver.
15 * Copyright (C) 2000, David Gibson, Linuxcare Australia.
16 * (C) Copyright David Gibson, IBM Corp. 2001-2003.
18 * Portions taken from hfa384x.h.
19 * Copyright (C) 1999 AbsoluteValue Systems, Inc. All Rights Reserved.
21 * This file distributed under the GPL, version 2.
29 * As a module of low level hardware access routines, there is no
30 * locking. Users of this module should ensure that they serialize
31 * access to the hermes_t structure, and to the hardware
34 #include <linux/if_ether.h>
38 * Limits and constants
40 #define HERMES_ALLOC_LEN_MIN (4)
41 #define HERMES_ALLOC_LEN_MAX (2400)
42 #define HERMES_LTV_LEN_MAX (34)
43 #define HERMES_BAP_DATALEN_MAX (4096)
44 #define HERMES_BAP_OFFSET_MAX (4096)
45 #define HERMES_PORTID_MAX (7)
46 #define HERMES_NUMPORTS_MAX (HERMES_PORTID_MAX+1)
47 #define HERMES_PDR_LEN_MAX (260) /* in bytes, from EK */
48 #define HERMES_PDA_RECS_MAX (200) /* a guess */
49 #define HERMES_PDA_LEN_MAX (1024) /* in bytes, from EK */
50 #define HERMES_SCANRESULT_MAX (35)
51 #define HERMES_CHINFORESULT_MAX (8)
52 #define HERMES_MAX_MULTICAST (16)
53 #define HERMES_MAGIC (0x7d1f)
56 * Hermes register offsets
58 #define HERMES_CMD (0x00)
59 #define HERMES_PARAM0 (0x02)
60 #define HERMES_PARAM1 (0x04)
61 #define HERMES_PARAM2 (0x06)
62 #define HERMES_STATUS (0x08)
63 #define HERMES_RESP0 (0x0A)
64 #define HERMES_RESP1 (0x0C)
65 #define HERMES_RESP2 (0x0E)
66 #define HERMES_INFOFID (0x10)
67 #define HERMES_RXFID (0x20)
68 #define HERMES_ALLOCFID (0x22)
69 #define HERMES_TXCOMPLFID (0x24)
70 #define HERMES_SELECT0 (0x18)
71 #define HERMES_OFFSET0 (0x1C)
72 #define HERMES_DATA0 (0x36)
73 #define HERMES_SELECT1 (0x1A)
74 #define HERMES_OFFSET1 (0x1E)
75 #define HERMES_DATA1 (0x38)
76 #define HERMES_EVSTAT (0x30)
77 #define HERMES_INTEN (0x32)
78 #define HERMES_EVACK (0x34)
79 #define HERMES_CONTROL (0x14)
80 #define HERMES_SWSUPPORT0 (0x28)
81 #define HERMES_SWSUPPORT1 (0x2A)
82 #define HERMES_SWSUPPORT2 (0x2C)
83 #define HERMES_AUXPAGE (0x3A)
84 #define HERMES_AUXOFFSET (0x3C)
85 #define HERMES_AUXDATA (0x3E)
88 * CMD register bitmasks
90 #define HERMES_CMD_BUSY (0x8000)
91 #define HERMES_CMD_AINFO (0x7f00)
92 #define HERMES_CMD_MACPORT (0x0700)
93 #define HERMES_CMD_RECL (0x0100)
94 #define HERMES_CMD_WRITE (0x0100)
95 #define HERMES_CMD_PROGMODE (0x0300)
96 #define HERMES_CMD_CMDCODE (0x003f)
99 * STATUS register bitmasks
101 #define HERMES_STATUS_RESULT (0x7f00)
102 #define HERMES_STATUS_CMDCODE (0x003f)
105 * OFFSET register bitmasks
107 #define HERMES_OFFSET_BUSY (0x8000)
108 #define HERMES_OFFSET_ERR (0x4000)
109 #define HERMES_OFFSET_DATAOFF (0x0ffe)
112 * Event register bitmasks (INTEN, EVSTAT, EVACK)
114 #define HERMES_EV_TICK (0x8000)
115 #define HERMES_EV_WTERR (0x4000)
116 #define HERMES_EV_INFDROP (0x2000)
117 #define HERMES_EV_INFO (0x0080)
118 #define HERMES_EV_DTIM (0x0020)
119 #define HERMES_EV_CMD (0x0010)
120 #define HERMES_EV_ALLOC (0x0008)
121 #define HERMES_EV_TXEXC (0x0004)
122 #define HERMES_EV_TX (0x0002)
123 #define HERMES_EV_RX (0x0001)
128 /*--- Controller Commands ----------------------------*/
129 #define HERMES_CMD_INIT (0x0000)
130 #define HERMES_CMD_ENABLE (0x0001)
131 #define HERMES_CMD_DISABLE (0x0002)
132 #define HERMES_CMD_DIAG (0x0003)
134 /*--- Buffer Mgmt Commands ---------------------------*/
135 #define HERMES_CMD_ALLOC (0x000A)
136 #define HERMES_CMD_TX (0x000B)
138 /*--- Regulate Commands ------------------------------*/
139 #define HERMES_CMD_NOTIFY (0x0010)
140 #define HERMES_CMD_INQUIRE (0x0011)
142 /*--- Configure Commands -----------------------------*/
143 #define HERMES_CMD_ACCESS (0x0021)
144 #define HERMES_CMD_DOWNLD (0x0022)
146 /*--- Serial I/O Commands ----------------------------*/
147 #define HERMES_CMD_READMIF (0x0030)
148 #define HERMES_CMD_WRITEMIF (0x0031)
150 /*--- Debugging Commands -----------------------------*/
151 #define HERMES_CMD_TEST (0x0038)
154 /* Test command arguments */
155 #define HERMES_TEST_SET_CHANNEL 0x0800
156 #define HERMES_TEST_MONITOR 0x0b00
157 #define HERMES_TEST_STOP 0x0f00
159 /* Authentication algorithms */
160 #define HERMES_AUTH_OPEN 1
161 #define HERMES_AUTH_SHARED_KEY 2
164 #define HERMES_WEP_PRIVACY_INVOKED 0x0001
165 #define HERMES_WEP_EXCL_UNENCRYPTED 0x0002
166 #define HERMES_WEP_HOST_ENCRYPT 0x0010
167 #define HERMES_WEP_HOST_DECRYPT 0x0080
169 /* Symbol hostscan options */
170 #define HERMES_HOSTSCAN_SYMBOL_5SEC 0x0001
171 #define HERMES_HOSTSCAN_SYMBOL_ONCE 0x0002
172 #define HERMES_HOSTSCAN_SYMBOL_PASSIVE 0x0040
173 #define HERMES_HOSTSCAN_SYMBOL_BCAST 0x0080
176 * Frame structures and constants
179 #define HERMES_DESCRIPTOR_OFFSET 0
180 #define HERMES_802_11_OFFSET (14)
181 #define HERMES_802_3_OFFSET (14+32)
182 #define HERMES_802_2_OFFSET (14+32+14)
183 #define HERMES_TXCNTL2_OFFSET (HERMES_802_3_OFFSET - 2)
185 #define HERMES_RXSTAT_ERR (0x0003)
186 #define HERMES_RXSTAT_BADCRC (0x0001)
187 #define HERMES_RXSTAT_UNDECRYPTABLE (0x0002)
188 #define HERMES_RXSTAT_MIC (0x0010) /* Frame contains MIC */
189 #define HERMES_RXSTAT_MACPORT (0x0700)
190 #define HERMES_RXSTAT_PCF (0x1000) /* Frame was received in CF period */
191 #define HERMES_RXSTAT_MIC_KEY_ID (0x1800) /* MIC key used */
192 #define HERMES_RXSTAT_MSGTYPE (0xE000)
193 #define HERMES_RXSTAT_1042 (0x2000) /* RFC-1042 frame */
194 #define HERMES_RXSTAT_TUNNEL (0x4000) /* bridge-tunnel encoded frame */
195 #define HERMES_RXSTAT_WMP (0x6000) /* Wavelan-II Management Protocol frame */
197 /* Shift amount for key ID in RXSTAT and TXCTRL */
198 #define HERMES_MIC_KEY_ID_SHIFT 11
200 struct hermes_tx_descriptor
{
208 } __attribute__ ((packed
));
210 #define HERMES_TXSTAT_RETRYERR (0x0001)
211 #define HERMES_TXSTAT_AGEDERR (0x0002)
212 #define HERMES_TXSTAT_DISCON (0x0004)
213 #define HERMES_TXSTAT_FORMERR (0x0008)
215 #define HERMES_TXCTRL_TX_OK (0x0002) /* ?? interrupt on Tx complete */
216 #define HERMES_TXCTRL_TX_EX (0x0004) /* ?? interrupt on Tx exception */
217 #define HERMES_TXCTRL_802_11 (0x0008) /* We supply 802.11 header */
218 #define HERMES_TXCTRL_MIC (0x0010) /* 802.3 + TKIP */
219 #define HERMES_TXCTRL_MIC_KEY_ID (0x1800) /* MIC Key ID mask */
220 #define HERMES_TXCTRL_ALT_RTRY (0x0020)
222 /* Inquiry constants and data types */
224 #define HERMES_INQ_TALLIES (0xF100)
225 #define HERMES_INQ_SCAN (0xF101)
226 #define HERMES_INQ_CHANNELINFO (0xF102)
227 #define HERMES_INQ_HOSTSCAN (0xF103)
228 #define HERMES_INQ_HOSTSCAN_SYMBOL (0xF104)
229 #define HERMES_INQ_LINKSTATUS (0xF200)
230 #define HERMES_INQ_SEC_STAT_AGERE (0xF202)
232 struct hermes_tallies_frame
{
233 __le16 TxUnicastFrames
;
234 __le16 TxMulticastFrames
;
236 __le16 TxUnicastOctets
;
237 __le16 TxMulticastOctets
;
238 __le16 TxDeferredTransmissions
;
239 __le16 TxSingleRetryFrames
;
240 __le16 TxMultipleRetryFrames
;
241 __le16 TxRetryLimitExceeded
;
243 __le16 RxUnicastFrames
;
244 __le16 RxMulticastFrames
;
246 __le16 RxUnicastOctets
;
247 __le16 RxMulticastOctets
;
249 __le16 RxDiscards_NoBuffer
;
250 __le16 TxDiscardsWrongSA
;
251 __le16 RxWEPUndecryptable
;
252 __le16 RxMsgInMsgFragments
;
253 __le16 RxMsgInBadMsgFragments
;
254 /* Those last are probably not available in very old firmwares */
255 __le16 RxDiscards_WEPICVError
;
256 __le16 RxDiscards_WEPExcluded
;
257 } __attribute__ ((packed
));
259 /* Grabbed from wlan-ng - Thanks Mark... - Jean II
260 * This is the result of a scan inquiry command */
261 /* Structure describing info about an Access Point */
262 struct prism2_scan_apinfo
{
263 __le16 channel
; /* Channel where the AP sits */
264 __le16 noise
; /* Noise level */
265 __le16 level
; /* Signal level */
266 u8 bssid
[ETH_ALEN
]; /* MAC address of the Access Point */
267 __le16 beacon_interv
; /* Beacon interval */
268 __le16 capabilities
; /* Capabilities */
269 __le16 essid_len
; /* ESSID length */
270 u8 essid
[32]; /* ESSID of the network */
271 u8 rates
[10]; /* Bit rate supported */
272 __le16 proberesp_rate
; /* Data rate of the response frame */
273 __le16 atim
; /* ATIM window time, Kus (hostscan only) */
274 } __attribute__ ((packed
));
276 /* Same stuff for the Lucent/Agere card.
277 * Thanks to h1kari <h1kari AT dachb0den.com> - Jean II */
278 struct agere_scan_apinfo
{
279 __le16 channel
; /* Channel where the AP sits */
280 __le16 noise
; /* Noise level */
281 __le16 level
; /* Signal level */
282 u8 bssid
[ETH_ALEN
]; /* MAC address of the Access Point */
283 __le16 beacon_interv
; /* Beacon interval */
284 __le16 capabilities
; /* Capabilities */
285 /* bits: 0-ess, 1-ibss, 4-privacy [wep] */
286 __le16 essid_len
; /* ESSID length */
287 u8 essid
[32]; /* ESSID of the network */
288 } __attribute__ ((packed
));
290 /* Moustafa: Scan structure for Symbol cards */
291 struct symbol_scan_apinfo
{
292 u8 channel
; /* Channel where the AP sits */
293 u8 unknown1
; /* 8 in 2.9x and 3.9x f/w, 0 otherwise */
294 __le16 noise
; /* Noise level */
295 __le16 level
; /* Signal level */
296 u8 bssid
[ETH_ALEN
]; /* MAC address of the Access Point */
297 __le16 beacon_interv
; /* Beacon interval */
298 __le16 capabilities
; /* Capabilities */
299 /* bits: 0-ess, 1-ibss, 4-privacy [wep] */
300 __le16 essid_len
; /* ESSID length */
301 u8 essid
[32]; /* ESSID of the network */
302 __le16 rates
[5]; /* Bit rate supported */
303 __le16 basic_rates
; /* Basic rates bitmask */
304 u8 unknown2
[6]; /* Always FF:FF:FF:FF:00:00 */
305 u8 unknown3
[8]; /* Always 0, appeared in f/w 3.91-68 */
306 } __attribute__ ((packed
));
308 union hermes_scan_info
{
309 struct agere_scan_apinfo a
;
310 struct prism2_scan_apinfo p
;
311 struct symbol_scan_apinfo s
;
314 /* Extended scan struct for HERMES_INQ_CHANNELINFO.
315 * wl_lkm calls this an ACS scan (Automatic Channel Select).
316 * Keep out of union hermes_scan_info because it is much bigger than
317 * the older scan structures. */
318 struct agere_ext_scan_info
{
327 __le16 frame_control
;
337 /* Next 3 fields do not get filled in. */
343 __le16 beacon_interval
;
346 } __attribute__ ((packed
));
348 #define HERMES_LINKSTATUS_NOT_CONNECTED (0x0000)
349 #define HERMES_LINKSTATUS_CONNECTED (0x0001)
350 #define HERMES_LINKSTATUS_DISCONNECTED (0x0002)
351 #define HERMES_LINKSTATUS_AP_CHANGE (0x0003)
352 #define HERMES_LINKSTATUS_AP_OUT_OF_RANGE (0x0004)
353 #define HERMES_LINKSTATUS_AP_IN_RANGE (0x0005)
354 #define HERMES_LINKSTATUS_ASSOC_FAILED (0x0006)
356 struct hermes_linkstatus
{
357 __le16 linkstatus
; /* Link status */
358 } __attribute__ ((packed
));
360 struct hermes_response
{
361 u16 status
, resp0
, resp1
, resp2
;
364 /* "ID" structure - used for ESSID and station nickname */
365 struct hermes_idstring
{
368 } __attribute__ ((packed
));
370 struct hermes_multicast
{
371 u8 addr
[HERMES_MAX_MULTICAST
][ETH_ALEN
];
372 } __attribute__ ((packed
));
375 #define HERMES_BAP_BUSY_TIMEOUT (10000) /* In iterations of ~1us */
377 /* Basic control structure */
378 typedef struct hermes
{
379 void __iomem
*iobase
;
381 #define HERMES_16BIT_REGSPACING 0
382 #define HERMES_32BIT_REGSPACING 1
383 u16 inten
; /* Which interrupts should be enabled? */
386 /* Register access convenience macros */
387 #define hermes_read_reg(hw, off) \
388 (ioread16((hw)->iobase + ((off) << (hw)->reg_spacing)))
389 #define hermes_write_reg(hw, off, val) \
390 (iowrite16((val), (hw)->iobase + ((off) << (hw)->reg_spacing)))
391 #define hermes_read_regn(hw, name) hermes_read_reg((hw), HERMES_##name)
392 #define hermes_write_regn(hw, name, val) \
393 hermes_write_reg((hw), HERMES_##name, (val))
395 /* Function prototypes */
396 void hermes_struct_init(hermes_t
*hw
, void __iomem
*address
, int reg_spacing
);
397 int hermes_init(hermes_t
*hw
);
398 int hermes_docmd_wait(hermes_t
*hw
, u16 cmd
, u16 parm0
,
399 struct hermes_response
*resp
);
400 int hermes_doicmd_wait(hermes_t
*hw
, u16 cmd
,
401 u16 parm0
, u16 parm1
, u16 parm2
,
402 struct hermes_response
*resp
);
403 int hermes_allocate(hermes_t
*hw
, u16 size
, u16
*fid
);
405 int hermes_bap_pread(hermes_t
*hw
, int bap
, void *buf
, int len
,
407 int hermes_bap_pwrite(hermes_t
*hw
, int bap
, const void *buf
, int len
,
409 int hermes_read_ltv(hermes_t
*hw
, int bap
, u16 rid
, unsigned buflen
,
410 u16
*length
, void *buf
);
411 int hermes_write_ltv(hermes_t
*hw
, int bap
, u16 rid
,
412 u16 length
, const void *value
);
414 /* Inline functions */
416 static inline int hermes_present(hermes_t
*hw
)
418 return hermes_read_regn(hw
, SWSUPPORT0
) == HERMES_MAGIC
;
421 static inline void hermes_set_irqmask(hermes_t
*hw
, u16 events
)
424 hermes_write_regn(hw
, INTEN
, events
);
427 static inline int hermes_enable_port(hermes_t
*hw
, int port
)
429 return hermes_docmd_wait(hw
, HERMES_CMD_ENABLE
| (port
<< 8),
433 static inline int hermes_disable_port(hermes_t
*hw
, int port
)
435 return hermes_docmd_wait(hw
, HERMES_CMD_DISABLE
| (port
<< 8),
439 /* Initiate an INQUIRE command (tallies or scan). The result will come as an
440 * information frame in __orinoco_ev_info() */
441 static inline int hermes_inquire(hermes_t
*hw
, u16 rid
)
443 return hermes_docmd_wait(hw
, HERMES_CMD_INQUIRE
, rid
, NULL
);
446 #define HERMES_BYTES_TO_RECLEN(n) ((((n)+1)/2) + 1)
447 #define HERMES_RECLEN_TO_BYTES(n) (((n)-1) * 2)
449 /* Note that for the next two, the count is in 16-bit words, not bytes */
450 static inline void hermes_read_words(struct hermes
*hw
, int off
,
451 void *buf
, unsigned count
)
453 off
= off
<< hw
->reg_spacing
;
454 ioread16_rep(hw
->iobase
+ off
, buf
, count
);
457 static inline void hermes_write_bytes(struct hermes
*hw
, int off
,
458 const char *buf
, unsigned count
)
460 off
= off
<< hw
->reg_spacing
;
461 iowrite16_rep(hw
->iobase
+ off
, buf
, count
>> 1);
462 if (unlikely(count
& 1))
463 iowrite8(buf
[count
- 1], hw
->iobase
+ off
);
466 static inline void hermes_clear_words(struct hermes
*hw
, int off
,
471 off
= off
<< hw
->reg_spacing
;
473 for (i
= 0; i
< count
; i
++)
474 iowrite16(0, hw
->iobase
+ off
);
477 #define HERMES_READ_RECORD(hw, bap, rid, buf) \
478 (hermes_read_ltv((hw), (bap), (rid), sizeof(*buf), NULL, (buf)))
479 #define HERMES_WRITE_RECORD(hw, bap, rid, buf) \
480 (hermes_write_ltv((hw), (bap), (rid), \
481 HERMES_BYTES_TO_RECLEN(sizeof(*buf)), (buf)))
483 static inline int hermes_read_wordrec(hermes_t
*hw
, int bap
, u16 rid
, u16
*word
)
488 err
= HERMES_READ_RECORD(hw
, bap
, rid
, &rec
);
489 *word
= le16_to_cpu(rec
);
493 static inline int hermes_write_wordrec(hermes_t
*hw
, int bap
, u16 rid
, u16 word
)
495 __le16 rec
= cpu_to_le16(word
);
496 return HERMES_WRITE_RECORD(hw
, bap
, rid
, &rec
);
499 #endif /* _HERMES_H */