3 * Driver core for the "Hermes" wireless MAC controller, as used in
4 * the Lucent Orinoco and Cabletron RoamAbout cards. It should also
5 * work on the hfa3841 and hfa3842 MAC controller chips used in the
6 * Prism I & II chipsets.
8 * This is not a complete driver, just low-level access routines for
9 * the MAC controller itself.
11 * Based on the prism2 driver from Absolute Value Systems' linux-wlan
12 * project, the Linux wvlan_cs driver, Lucent's HCF-Light
13 * (wvlan_hcf.c) library, and the NetBSD wireless driver.
15 * Copyright (C) 2000, David Gibson, Linuxcare Australia.
16 * (C) Copyright David Gibson, IBM Corp. 2001-2003.
18 * Portions taken from hfa384x.h, Copyright (C) 1999 AbsoluteValue Systems, Inc. All Rights Reserved.
20 * This file distributed under the GPL, version 2.
28 * As a module of low level hardware access routines, there is no
29 * locking. Users of this module should ensure that they serialize
30 * access to the hermes_t structure, and to the hardware
33 #include <linux/if_ether.h>
37 * Limits and constants
39 #define HERMES_ALLOC_LEN_MIN (4)
40 #define HERMES_ALLOC_LEN_MAX (2400)
41 #define HERMES_LTV_LEN_MAX (34)
42 #define HERMES_BAP_DATALEN_MAX (4096)
43 #define HERMES_BAP_OFFSET_MAX (4096)
44 #define HERMES_PORTID_MAX (7)
45 #define HERMES_NUMPORTS_MAX (HERMES_PORTID_MAX+1)
46 #define HERMES_PDR_LEN_MAX (260) /* in bytes, from EK */
47 #define HERMES_PDA_RECS_MAX (200) /* a guess */
48 #define HERMES_PDA_LEN_MAX (1024) /* in bytes, from EK */
49 #define HERMES_SCANRESULT_MAX (35)
50 #define HERMES_CHINFORESULT_MAX (8)
51 #define HERMES_MAX_MULTICAST (16)
52 #define HERMES_MAGIC (0x7d1f)
55 * Hermes register offsets
57 #define HERMES_CMD (0x00)
58 #define HERMES_PARAM0 (0x02)
59 #define HERMES_PARAM1 (0x04)
60 #define HERMES_PARAM2 (0x06)
61 #define HERMES_STATUS (0x08)
62 #define HERMES_RESP0 (0x0A)
63 #define HERMES_RESP1 (0x0C)
64 #define HERMES_RESP2 (0x0E)
65 #define HERMES_INFOFID (0x10)
66 #define HERMES_RXFID (0x20)
67 #define HERMES_ALLOCFID (0x22)
68 #define HERMES_TXCOMPLFID (0x24)
69 #define HERMES_SELECT0 (0x18)
70 #define HERMES_OFFSET0 (0x1C)
71 #define HERMES_DATA0 (0x36)
72 #define HERMES_SELECT1 (0x1A)
73 #define HERMES_OFFSET1 (0x1E)
74 #define HERMES_DATA1 (0x38)
75 #define HERMES_EVSTAT (0x30)
76 #define HERMES_INTEN (0x32)
77 #define HERMES_EVACK (0x34)
78 #define HERMES_CONTROL (0x14)
79 #define HERMES_SWSUPPORT0 (0x28)
80 #define HERMES_SWSUPPORT1 (0x2A)
81 #define HERMES_SWSUPPORT2 (0x2C)
82 #define HERMES_AUXPAGE (0x3A)
83 #define HERMES_AUXOFFSET (0x3C)
84 #define HERMES_AUXDATA (0x3E)
87 * CMD register bitmasks
89 #define HERMES_CMD_BUSY (0x8000)
90 #define HERMES_CMD_AINFO (0x7f00)
91 #define HERMES_CMD_MACPORT (0x0700)
92 #define HERMES_CMD_RECL (0x0100)
93 #define HERMES_CMD_WRITE (0x0100)
94 #define HERMES_CMD_PROGMODE (0x0300)
95 #define HERMES_CMD_CMDCODE (0x003f)
98 * STATUS register bitmasks
100 #define HERMES_STATUS_RESULT (0x7f00)
101 #define HERMES_STATUS_CMDCODE (0x003f)
104 * OFFSET register bitmasks
106 #define HERMES_OFFSET_BUSY (0x8000)
107 #define HERMES_OFFSET_ERR (0x4000)
108 #define HERMES_OFFSET_DATAOFF (0x0ffe)
111 * Event register bitmasks (INTEN, EVSTAT, EVACK)
113 #define HERMES_EV_TICK (0x8000)
114 #define HERMES_EV_WTERR (0x4000)
115 #define HERMES_EV_INFDROP (0x2000)
116 #define HERMES_EV_INFO (0x0080)
117 #define HERMES_EV_DTIM (0x0020)
118 #define HERMES_EV_CMD (0x0010)
119 #define HERMES_EV_ALLOC (0x0008)
120 #define HERMES_EV_TXEXC (0x0004)
121 #define HERMES_EV_TX (0x0002)
122 #define HERMES_EV_RX (0x0001)
127 /*--- Controller Commands ----------------------------*/
128 #define HERMES_CMD_INIT (0x0000)
129 #define HERMES_CMD_ENABLE (0x0001)
130 #define HERMES_CMD_DISABLE (0x0002)
131 #define HERMES_CMD_DIAG (0x0003)
133 /*--- Buffer Mgmt Commands ---------------------------*/
134 #define HERMES_CMD_ALLOC (0x000A)
135 #define HERMES_CMD_TX (0x000B)
137 /*--- Regulate Commands ------------------------------*/
138 #define HERMES_CMD_NOTIFY (0x0010)
139 #define HERMES_CMD_INQUIRE (0x0011)
141 /*--- Configure Commands -----------------------------*/
142 #define HERMES_CMD_ACCESS (0x0021)
143 #define HERMES_CMD_DOWNLD (0x0022)
145 /*--- Serial I/O Commands ----------------------------*/
146 #define HERMES_CMD_READMIF (0x0030)
147 #define HERMES_CMD_WRITEMIF (0x0031)
149 /*--- Debugging Commands -----------------------------*/
150 #define HERMES_CMD_TEST (0x0038)
153 /* Test command arguments */
154 #define HERMES_TEST_SET_CHANNEL 0x0800
155 #define HERMES_TEST_MONITOR 0x0b00
156 #define HERMES_TEST_STOP 0x0f00
158 /* Authentication algorithms */
159 #define HERMES_AUTH_OPEN 1
160 #define HERMES_AUTH_SHARED_KEY 2
163 #define HERMES_WEP_PRIVACY_INVOKED 0x0001
164 #define HERMES_WEP_EXCL_UNENCRYPTED 0x0002
165 #define HERMES_WEP_HOST_ENCRYPT 0x0010
166 #define HERMES_WEP_HOST_DECRYPT 0x0080
168 /* Symbol hostscan options */
169 #define HERMES_HOSTSCAN_SYMBOL_5SEC 0x0001
170 #define HERMES_HOSTSCAN_SYMBOL_ONCE 0x0002
171 #define HERMES_HOSTSCAN_SYMBOL_PASSIVE 0x0040
172 #define HERMES_HOSTSCAN_SYMBOL_BCAST 0x0080
175 * Frame structures and constants
178 #define HERMES_DESCRIPTOR_OFFSET 0
179 #define HERMES_802_11_OFFSET (14)
180 #define HERMES_802_3_OFFSET (14+32)
181 #define HERMES_802_2_OFFSET (14+32+14)
182 #define HERMES_TXCNTL2_OFFSET (HERMES_802_3_OFFSET - 2)
184 #define HERMES_RXSTAT_ERR (0x0003)
185 #define HERMES_RXSTAT_BADCRC (0x0001)
186 #define HERMES_RXSTAT_UNDECRYPTABLE (0x0002)
187 #define HERMES_RXSTAT_MACPORT (0x0700)
188 #define HERMES_RXSTAT_PCF (0x1000) /* Frame was received in CF period */
189 #define HERMES_RXSTAT_MSGTYPE (0xE000)
190 #define HERMES_RXSTAT_1042 (0x2000) /* RFC-1042 frame */
191 #define HERMES_RXSTAT_TUNNEL (0x4000) /* bridge-tunnel encoded frame */
192 #define HERMES_RXSTAT_WMP (0x6000) /* Wavelan-II Management Protocol frame */
194 struct hermes_tx_descriptor {
202 } __attribute__ ((packed));
204 #define HERMES_TXSTAT_RETRYERR (0x0001)
205 #define HERMES_TXSTAT_AGEDERR (0x0002)
206 #define HERMES_TXSTAT_DISCON (0x0004)
207 #define HERMES_TXSTAT_FORMERR (0x0008)
209 #define HERMES_TXCTRL_TX_OK (0x0002) /* ?? interrupt on Tx complete */
210 #define HERMES_TXCTRL_TX_EX (0x0004) /* ?? interrupt on Tx exception */
211 #define HERMES_TXCTRL_802_11 (0x0008) /* We supply 802.11 header */
212 #define HERMES_TXCTRL_ALT_RTRY (0x0020)
214 /* Inquiry constants and data types */
216 #define HERMES_INQ_TALLIES (0xF100)
217 #define HERMES_INQ_SCAN (0xF101)
218 #define HERMES_INQ_CHANNELINFO (0xF102)
219 #define HERMES_INQ_HOSTSCAN (0xF103)
220 #define HERMES_INQ_HOSTSCAN_SYMBOL (0xF104)
221 #define HERMES_INQ_LINKSTATUS (0xF200)
222 #define HERMES_INQ_SEC_STAT_AGERE (0xF202)
224 struct hermes_tallies_frame {
225 __le16 TxUnicastFrames;
226 __le16 TxMulticastFrames;
228 __le16 TxUnicastOctets;
229 __le16 TxMulticastOctets;
230 __le16 TxDeferredTransmissions;
231 __le16 TxSingleRetryFrames;
232 __le16 TxMultipleRetryFrames;
233 __le16 TxRetryLimitExceeded;
235 __le16 RxUnicastFrames;
236 __le16 RxMulticastFrames;
238 __le16 RxUnicastOctets;
239 __le16 RxMulticastOctets;
241 __le16 RxDiscards_NoBuffer;
242 __le16 TxDiscardsWrongSA;
243 __le16 RxWEPUndecryptable;
244 __le16 RxMsgInMsgFragments;
245 __le16 RxMsgInBadMsgFragments;
246 /* Those last are probably not available in very old firmwares */
247 __le16 RxDiscards_WEPICVError;
248 __le16 RxDiscards_WEPExcluded;
249 } __attribute__ ((packed));
251 /* Grabbed from wlan-ng - Thanks Mark... - Jean II
252 * This is the result of a scan inquiry command */
253 /* Structure describing info about an Access Point */
254 struct prism2_scan_apinfo {
255 __le16 channel; /* Channel where the AP sits */
256 __le16 noise; /* Noise level */
257 __le16 level; /* Signal level */
258 u8 bssid[ETH_ALEN]; /* MAC address of the Access Point */
259 __le16 beacon_interv; /* Beacon interval */
260 __le16 capabilities; /* Capabilities */
261 __le16 essid_len; /* ESSID length */
262 u8 essid[32]; /* ESSID of the network */
263 u8 rates[10]; /* Bit rate supported */
264 __le16 proberesp_rate; /* Data rate of the response frame */
265 __le16 atim; /* ATIM window time, Kus (hostscan only) */
266 } __attribute__ ((packed));
268 /* Same stuff for the Lucent/Agere card.
269 * Thanks to h1kari <h1kari AT dachb0den.com> - Jean II */
270 struct agere_scan_apinfo {
271 __le16 channel; /* Channel where the AP sits */
272 __le16 noise; /* Noise level */
273 __le16 level; /* Signal level */
274 u8 bssid[ETH_ALEN]; /* MAC address of the Access Point */
275 __le16 beacon_interv; /* Beacon interval */
276 __le16 capabilities; /* Capabilities */
277 /* bits: 0-ess, 1-ibss, 4-privacy [wep] */
278 __le16 essid_len; /* ESSID length */
279 u8 essid[32]; /* ESSID of the network */
280 } __attribute__ ((packed));
282 /* Moustafa: Scan structure for Symbol cards */
283 struct symbol_scan_apinfo {
284 u8 channel; /* Channel where the AP sits */
285 u8 unknown1; /* 8 in 2.9x and 3.9x f/w, 0 otherwise */
286 __le16 noise; /* Noise level */
287 __le16 level; /* Signal level */
288 u8 bssid[ETH_ALEN]; /* MAC address of the Access Point */
289 __le16 beacon_interv; /* Beacon interval */
290 __le16 capabilities; /* Capabilities */
291 /* bits: 0-ess, 1-ibss, 4-privacy [wep] */
292 __le16 essid_len; /* ESSID length */
293 u8 essid[32]; /* ESSID of the network */
294 __le16 rates[5]; /* Bit rate supported */
295 __le16 basic_rates; /* Basic rates bitmask */
296 u8 unknown2[6]; /* Always FF:FF:FF:FF:00:00 */
297 u8 unknown3[8]; /* Always 0, appeared in f/w 3.91-68 */
298 } __attribute__ ((packed));
300 union hermes_scan_info {
301 struct agere_scan_apinfo a;
302 struct prism2_scan_apinfo p;
303 struct symbol_scan_apinfo s;
306 #define HERMES_LINKSTATUS_NOT_CONNECTED (0x0000)
307 #define HERMES_LINKSTATUS_CONNECTED (0x0001)
308 #define HERMES_LINKSTATUS_DISCONNECTED (0x0002)
309 #define HERMES_LINKSTATUS_AP_CHANGE (0x0003)
310 #define HERMES_LINKSTATUS_AP_OUT_OF_RANGE (0x0004)
311 #define HERMES_LINKSTATUS_AP_IN_RANGE (0x0005)
312 #define HERMES_LINKSTATUS_ASSOC_FAILED (0x0006)
314 struct hermes_linkstatus {
315 __le16 linkstatus; /* Link status */
316 } __attribute__ ((packed));
318 struct hermes_response {
319 u16 status, resp0, resp1, resp2;
322 /* "ID" structure - used for ESSID and station nickname */
323 struct hermes_idstring {
326 } __attribute__ ((packed));
328 struct hermes_multicast {
329 u8 addr[HERMES_MAX_MULTICAST][ETH_ALEN];
330 } __attribute__ ((packed));
333 #define HERMES_BAP_BUSY_TIMEOUT (10000) /* In iterations of ~1us */
335 /* Basic control structure */
336 typedef struct hermes {
337 void __iomem *iobase;
339 #define HERMES_16BIT_REGSPACING 0
340 #define HERMES_32BIT_REGSPACING 1
341 u16 inten; /* Which interrupts should be enabled? */
344 /* Register access convenience macros */
345 #define hermes_read_reg(hw, off) \
346 (ioread16((hw)->iobase + ( (off) << (hw)->reg_spacing )))
347 #define hermes_write_reg(hw, off, val) \
348 (iowrite16((val), (hw)->iobase + ((off) << (hw)->reg_spacing)))
349 #define hermes_read_regn(hw, name) hermes_read_reg((hw), HERMES_##name)
350 #define hermes_write_regn(hw, name, val) hermes_write_reg((hw), HERMES_##name, (val))
352 /* Function prototypes */
353 void hermes_struct_init(hermes_t *hw, void __iomem *address, int reg_spacing);
354 int hermes_init(hermes_t *hw);
355 int hermes_docmd_wait(hermes_t *hw, u16 cmd, u16 parm0,
356 struct hermes_response *resp);
357 int hermes_doicmd_wait(hermes_t *hw, u16 cmd,
358 u16 parm0, u16 parm1, u16 parm2,
359 struct hermes_response *resp);
360 int hermes_allocate(hermes_t *hw, u16 size, u16 *fid);
362 int hermes_bap_pread(hermes_t *hw, int bap, void *buf, int len,
364 int hermes_bap_pwrite(hermes_t *hw, int bap, const void *buf, int len,
366 int hermes_read_ltv(hermes_t *hw, int bap, u16 rid, unsigned buflen,
367 u16 *length, void *buf);
368 int hermes_write_ltv(hermes_t *hw, int bap, u16 rid,
369 u16 length, const void *value);
371 /* Inline functions */
373 static inline int hermes_present(hermes_t *hw)
375 return hermes_read_regn(hw, SWSUPPORT0) == HERMES_MAGIC;
378 static inline void hermes_set_irqmask(hermes_t *hw, u16 events)
381 hermes_write_regn(hw, INTEN, events);
384 static inline int hermes_enable_port(hermes_t *hw, int port)
386 return hermes_docmd_wait(hw, HERMES_CMD_ENABLE | (port << 8),
390 static inline int hermes_disable_port(hermes_t *hw, int port)
392 return hermes_docmd_wait(hw, HERMES_CMD_DISABLE | (port << 8),
396 /* Initiate an INQUIRE command (tallies or scan). The result will come as an
397 * information frame in __orinoco_ev_info() */
398 static inline int hermes_inquire(hermes_t *hw, u16 rid)
400 return hermes_docmd_wait(hw, HERMES_CMD_INQUIRE, rid, NULL);
403 #define HERMES_BYTES_TO_RECLEN(n) ( (((n)+1)/2) + 1 )
404 #define HERMES_RECLEN_TO_BYTES(n) ( ((n)-1) * 2 )
406 /* Note that for the next two, the count is in 16-bit words, not bytes */
407 static inline void hermes_read_words(struct hermes *hw, int off, void *buf, unsigned count)
409 off = off << hw->reg_spacing;
410 ioread16_rep(hw->iobase + off, buf, count);
413 static inline void hermes_write_bytes(struct hermes *hw, int off,
414 const char *buf, unsigned count)
416 off = off << hw->reg_spacing;
417 iowrite16_rep(hw->iobase + off, buf, count >> 1);
418 if (unlikely(count & 1))
419 iowrite8(buf[count - 1], hw->iobase + off);
422 static inline void hermes_clear_words(struct hermes *hw, int off, unsigned count)
426 off = off << hw->reg_spacing;
428 for (i = 0; i < count; i++)
429 iowrite16(0, hw->iobase + off);
432 #define HERMES_READ_RECORD(hw, bap, rid, buf) \
433 (hermes_read_ltv((hw),(bap),(rid), sizeof(*buf), NULL, (buf)))
434 #define HERMES_WRITE_RECORD(hw, bap, rid, buf) \
435 (hermes_write_ltv((hw),(bap),(rid),HERMES_BYTES_TO_RECLEN(sizeof(*buf)),(buf)))
437 static inline int hermes_read_wordrec(hermes_t *hw, int bap, u16 rid, u16 *word)
442 err = HERMES_READ_RECORD(hw, bap, rid, &rec);
443 *word = le16_to_cpu(rec);
447 static inline int hermes_write_wordrec(hermes_t *hw, int bap, u16 rid, u16 word)
449 __le16 rec = cpu_to_le16(word);
450 return HERMES_WRITE_RECORD(hw, bap, rid, &rec);
453 #endif /* _HERMES_H */