Linux Kernel  3.7.1
 All Data Structures Namespaces Files Functions Variables Typedefs Enumerations Enumerator Macros Groups Pages
commands.h
Go to the documentation of this file.
1 /******************************************************************************
2  *
3  * This file is provided under a dual BSD/GPLv2 license. When using or
4  * redistributing this file, you may do so under either license.
5  *
6  * GPL LICENSE SUMMARY
7  *
8  * Copyright(c) 2005 - 2011 Intel Corporation. All rights reserved.
9  *
10  * This program is free software; you can redistribute it and/or modify
11  * it under the terms of version 2 of the GNU General Public License as
12  * published by the Free Software Foundation.
13  *
14  * This program is distributed in the hope that it will be useful, but
15  * WITHOUT ANY WARRANTY; without even the implied warranty of
16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17  * General Public License for more details.
18  *
19  * You should have received a copy of the GNU General Public License
20  * along with this program; if not, write to the Free Software
21  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
22  * USA
23  *
24  * The full GNU General Public License is included in this distribution
25  * in the file called LICENSE.GPL.
26  *
27  * Contact Information:
28  * Intel Linux Wireless <[email protected]>
29  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
30  *
31  * BSD LICENSE
32  *
33  * Copyright(c) 2005 - 2011 Intel Corporation. All rights reserved.
34  * All rights reserved.
35  *
36  * Redistribution and use in source and binary forms, with or without
37  * modification, are permitted provided that the following conditions
38  * are met:
39  *
40  * * Redistributions of source code must retain the above copyright
41  * notice, this list of conditions and the following disclaimer.
42  * * Redistributions in binary form must reproduce the above copyright
43  * notice, this list of conditions and the following disclaimer in
44  * the documentation and/or other materials provided with the
45  * distribution.
46  * * Neither the name Intel Corporation nor the names of its
47  * contributors may be used to endorse or promote products derived
48  * from this software without specific prior written permission.
49  *
50  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
51  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
52  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
53  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
54  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
55  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
56  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
57  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
58  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
59  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
60  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
61  *
62  *****************************************************************************/
63 
64 #ifndef __il_commands_h__
65 #define __il_commands_h__
66 
67 #include <linux/ieee80211.h>
68 
69 struct il_priv;
70 
71 /* uCode version contains 4 values: Major/Minor/API/Serial */
72 #define IL_UCODE_MAJOR(ver) (((ver) & 0xFF000000) >> 24)
73 #define IL_UCODE_MINOR(ver) (((ver) & 0x00FF0000) >> 16)
74 #define IL_UCODE_API(ver) (((ver) & 0x0000FF00) >> 8)
75 #define IL_UCODE_SERIAL(ver) ((ver) & 0x000000FF)
76 
77 /* Tx rates */
78 #define IL_CCK_RATES 4
79 #define IL_OFDM_RATES 8
80 #define IL_MAX_RATES (IL_CCK_RATES + IL_OFDM_RATES)
81 
82 enum {
83  N_ALIVE = 0x1,
84  N_ERROR = 0x2,
85 
86  /* RXON and QOS commands */
87  C_RXON = 0x10,
88  C_RXON_ASSOC = 0x11,
89  C_QOS_PARAM = 0x13,
90  C_RXON_TIMING = 0x14,
91 
92  /* Multi-Station support */
93  C_ADD_STA = 0x18,
94  C_REM_STA = 0x19,
95 
96  /* Security */
97  C_WEPKEY = 0x20,
98 
99  /* RX, TX, LEDs */
100  N_3945_RX = 0x1b, /* 3945 only */
101  C_TX = 0x1c,
102  C_RATE_SCALE = 0x47, /* 3945 only */
103  C_LEDS = 0x48,
104  C_TX_LINK_QUALITY_CMD = 0x4e, /* for 4965 */
105 
106  /* 802.11h related */
111 
112  /* Power Management */
113  C_POWER_TBL = 0x77,
114  N_PM_SLEEP = 0x7A,
116 
117  /* Scan commands and notifications */
118  C_SCAN = 0x80,
119  C_SCAN_ABORT = 0x81,
120  N_SCAN_START = 0x82,
123 
124  /* IBSS/AP commands */
125  N_BEACON = 0x90,
126  C_TX_BEACON = 0x91,
127 
128  /* Miscellaneous commands */
129  C_TX_PWR_TBL = 0x97,
130 
131  /* Bluetooth device coexistence config command */
132  C_BT_CONFIG = 0x9b,
133 
134  /* Statistics */
135  C_STATS = 0x9c,
136  N_STATS = 0x9d,
137 
138  /* RF-KILL commands and notifications */
139  N_CARD_STATE = 0xa1,
140 
141  /* Missed beacons notification */
143 
147  N_RX_PHY = 0xc0,
148  N_RX_MPDU = 0xc1,
149  N_RX = 0xc3,
151 
152  IL_CN_MAX = 0xff
153 };
154 
155 /******************************************************************************
156  * (0)
157  * Commonly used structures and definitions:
158  * Command header, rate_n_flags, txpower
159  *
160  *****************************************************************************/
161 
162 /* il_cmd_header flags value */
163 #define IL_CMD_FAILED_MSK 0x40
164 
165 #define SEQ_TO_QUEUE(s) (((s) >> 8) & 0x1f)
166 #define QUEUE_TO_SEQ(q) (((q) & 0x1f) << 8)
167 #define SEQ_TO_IDX(s) ((s) & 0xff)
168 #define IDX_TO_SEQ(i) ((i) & 0xff)
169 #define SEQ_HUGE_FRAME cpu_to_le16(0x4000)
170 #define SEQ_RX_FRAME cpu_to_le16(0x8000)
171 
179  u8 cmd; /* Command ID: C_RXON, etc. */
180  u8 flags; /* 0:5 reserved, 6 abort, 7 internal */
181  /*
182  * The driver sets up the sequence number to values of its choosing.
183  * uCode does not use this value, but passes it back to the driver
184  * when sending the response to each driver-originated command, so
185  * the driver can match the response to the command. Since the values
186  * don't get used by uCode, the driver may set up an arbitrary format.
187  *
188  * There is one exception: uCode sets bit 15 when it originates
189  * the response/notification, i.e. when the response/notification
190  * is not a direct response to a command sent by the driver. For
191  * example, uCode issues N_3945_RX when it sends a received frame
192  * to the driver; it is not a direct response to any driver command.
193  *
194  * The Linux driver uses the following format:
195  *
196  * 0:7 tfd idx - position within TX queue
197  * 8:12 TX queue id
198  * 13 reserved
199  * 14 huge - driver sets this to indicate command is in the
200  * 'huge' storage at the end of the command buffers
201  * 15 unsolicited RX or uCode-originated notification
202  */
204 
205  /* command or response/notification data follows immediately */
206  u8 data[0];
207 } __packed;
208 
224  u8 tx_gain; /* gain for analog radio */
225  u8 dsp_atten; /* gain for DSP */
226 } __packed;
227 
234  u8 rate; /* plcp */
237 } __packed;
238 
280 #define RATE_MCS_CODE_MSK 0x7
281 #define RATE_MCS_SPATIAL_POS 3
282 #define RATE_MCS_SPATIAL_MSK 0x18
283 #define RATE_MCS_HT_DUP_POS 5
284 #define RATE_MCS_HT_DUP_MSK 0x20
285 
286 /* Bit 8: (1) HT format, (0) legacy format in bits 7:0 */
287 #define RATE_MCS_FLAGS_POS 8
288 #define RATE_MCS_HT_POS 8
289 #define RATE_MCS_HT_MSK 0x100
290 
291 /* Bit 9: (1) CCK, (0) OFDM. HT (bit 8) must be "0" for this bit to be valid */
292 #define RATE_MCS_CCK_POS 9
293 #define RATE_MCS_CCK_MSK 0x200
294 
295 /* Bit 10: (1) Use Green Field preamble */
296 #define RATE_MCS_GF_POS 10
297 #define RATE_MCS_GF_MSK 0x400
298 
299 /* Bit 11: (1) Use 40Mhz HT40 chnl width, (0) use 20 MHz legacy chnl width */
300 #define RATE_MCS_HT40_POS 11
301 #define RATE_MCS_HT40_MSK 0x800
302 
303 /* Bit 12: (1) Duplicate data on both 20MHz chnls. HT40 (bit 11) must be set. */
304 #define RATE_MCS_DUP_POS 12
305 #define RATE_MCS_DUP_MSK 0x1000
306 
307 /* Bit 13: (1) Short guard interval (0.4 usec), (0) normal GI (0.8 usec) */
308 #define RATE_MCS_SGI_POS 13
309 #define RATE_MCS_SGI_MSK 0x2000
310 
316 #define RATE_MCS_ANT_POS 14
317 #define RATE_MCS_ANT_A_MSK 0x04000
318 #define RATE_MCS_ANT_B_MSK 0x08000
319 #define RATE_MCS_ANT_C_MSK 0x10000
320 #define RATE_MCS_ANT_AB_MSK (RATE_MCS_ANT_A_MSK | RATE_MCS_ANT_B_MSK)
321 #define RATE_MCS_ANT_ABC_MSK (RATE_MCS_ANT_AB_MSK | RATE_MCS_ANT_C_MSK)
322 #define RATE_ANT_NUM 3
323 
324 #define POWER_TBL_NUM_ENTRIES 33
325 #define POWER_TBL_NUM_HT_OFDM_ENTRIES 32
326 #define POWER_TBL_CCK_ENTRY 32
327 
328 #define IL_PWR_NUM_HT_OFDM_ENTRIES 24
329 #define IL_PWR_CCK_ENTRIES 2
330 
348  struct {
351  } s;
353 };
354 
364 } __packed;
365 
373 } __packed;
374 
375 /******************************************************************************
376  * (0a)
377  * Alive and Error Commands & Responses:
378  *
379  *****************************************************************************/
380 
381 #define UCODE_VALID_OK cpu_to_le32(0x1)
382 #define INITIALIZE_SUBTYPE (9)
383 
384 /*
385  * ("Initialize") N_ALIVE = 0x1 (response only, not a command)
386  *
387  * uCode issues this "initialize alive" notification once the initialization
388  * uCode image has completed its work, and is ready to load the runtime image.
389  * This is the *first* "alive" notification that the driver will receive after
390  * rebooting uCode; the "initialize" alive is indicated by subtype field == 9.
391  *
392  * See comments documenting "BSM" (bootstrap state machine).
393  *
394  * For 4965, this notification contains important calibration data for
395  * calculating txpower settings:
396  *
397  * 1) Power supply voltage indication. The voltage sensor outputs higher
398  * values for lower voltage, and vice verse.
399  *
400  * 2) Temperature measurement parameters, for each of two channel widths
401  * (20 MHz and 40 MHz) supported by the radios. Temperature sensing
402  * is done via one of the receiver chains, and channel width influences
403  * the results.
404  *
405  * 3) Tx gain compensation to balance 4965's 2 Tx chains for MIMO operation,
406  * for each of 5 frequency ranges.
407  */
412  u8 sw_rev[8];
414  u8 ver_subtype; /* "9" for initialize alive */
420 
421  /* calibration values from "initialize" uCode */
422  __le32 voltage; /* signed, higher value is lower voltage */
423  __le32 therm_r1[2]; /* signed, 1st for normal, 2nd for HT40 */
424  __le32 therm_r2[2]; /* signed */
425  __le32 therm_r3[2]; /* signed */
426  __le32 therm_r4[2]; /* signed */
427  __le32 tx_atten[5][2]; /* signed MIMO gain comp, 5 freq groups,
428  * 2 Tx chains */
429 } __packed;
430 
512  u8 sw_rev[8];
514  u8 ver_subtype; /* not "9" for runtime alive */
516  __le32 log_event_table_ptr; /* SRAM address for event log */
517  __le32 error_event_table_ptr; /* SRAM address for error log */
520 } __packed;
521 
522 /*
523  * N_ERROR = 0x2 (response only, not a command)
524  */
532 } __packed;
533 
534 /******************************************************************************
535  * (1)
536  * RXON Commands & Responses:
537  *
538  *****************************************************************************/
539 
540 /*
541  * Rx config defines & structure
542  */
543 /* rx_config device types */
544 enum {
549 };
550 
551 #define RXON_RX_CHAIN_DRIVER_FORCE_MSK cpu_to_le16(0x1 << 0)
552 #define RXON_RX_CHAIN_DRIVER_FORCE_POS (0)
553 #define RXON_RX_CHAIN_VALID_MSK cpu_to_le16(0x7 << 1)
554 #define RXON_RX_CHAIN_VALID_POS (1)
555 #define RXON_RX_CHAIN_FORCE_SEL_MSK cpu_to_le16(0x7 << 4)
556 #define RXON_RX_CHAIN_FORCE_SEL_POS (4)
557 #define RXON_RX_CHAIN_FORCE_MIMO_SEL_MSK cpu_to_le16(0x7 << 7)
558 #define RXON_RX_CHAIN_FORCE_MIMO_SEL_POS (7)
559 #define RXON_RX_CHAIN_CNT_MSK cpu_to_le16(0x3 << 10)
560 #define RXON_RX_CHAIN_CNT_POS (10)
561 #define RXON_RX_CHAIN_MIMO_CNT_MSK cpu_to_le16(0x3 << 12)
562 #define RXON_RX_CHAIN_MIMO_CNT_POS (12)
563 #define RXON_RX_CHAIN_MIMO_FORCE_MSK cpu_to_le16(0x1 << 14)
564 #define RXON_RX_CHAIN_MIMO_FORCE_POS (14)
565 
566 /* rx_config flags */
567 /* band & modulation selection */
568 #define RXON_FLG_BAND_24G_MSK cpu_to_le32(1 << 0)
569 #define RXON_FLG_CCK_MSK cpu_to_le32(1 << 1)
570 /* auto detection enable */
571 #define RXON_FLG_AUTO_DETECT_MSK cpu_to_le32(1 << 2)
572 /* TGg protection when tx */
573 #define RXON_FLG_TGG_PROTECT_MSK cpu_to_le32(1 << 3)
574 /* cck short slot & preamble */
575 #define RXON_FLG_SHORT_SLOT_MSK cpu_to_le32(1 << 4)
576 #define RXON_FLG_SHORT_PREAMBLE_MSK cpu_to_le32(1 << 5)
577 /* antenna selection */
578 #define RXON_FLG_DIS_DIV_MSK cpu_to_le32(1 << 7)
579 #define RXON_FLG_ANT_SEL_MSK cpu_to_le32(0x0f00)
580 #define RXON_FLG_ANT_A_MSK cpu_to_le32(1 << 8)
581 #define RXON_FLG_ANT_B_MSK cpu_to_le32(1 << 9)
582 /* radar detection enable */
583 #define RXON_FLG_RADAR_DETECT_MSK cpu_to_le32(1 << 12)
584 #define RXON_FLG_TGJ_NARROW_BAND_MSK cpu_to_le32(1 << 13)
585 /* rx response to host with 8-byte TSF
586 * (according to ON_AIR deassertion) */
587 #define RXON_FLG_TSF2HOST_MSK cpu_to_le32(1 << 15)
588 
589 /* HT flags */
590 #define RXON_FLG_CTRL_CHANNEL_LOC_POS (22)
591 #define RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK cpu_to_le32(0x1 << 22)
592 
593 #define RXON_FLG_HT_OPERATING_MODE_POS (23)
594 
595 #define RXON_FLG_HT_PROT_MSK cpu_to_le32(0x1 << 23)
596 #define RXON_FLG_HT40_PROT_MSK cpu_to_le32(0x2 << 23)
597 
598 #define RXON_FLG_CHANNEL_MODE_POS (25)
599 #define RXON_FLG_CHANNEL_MODE_MSK cpu_to_le32(0x3 << 25)
600 
601 /* channel mode */
602 enum {
607 };
608 #define RXON_FLG_CHANNEL_MODE_LEGACY \
609  cpu_to_le32(CHANNEL_MODE_LEGACY << RXON_FLG_CHANNEL_MODE_POS)
610 #define RXON_FLG_CHANNEL_MODE_PURE_40 \
611  cpu_to_le32(CHANNEL_MODE_PURE_40 << RXON_FLG_CHANNEL_MODE_POS)
612 #define RXON_FLG_CHANNEL_MODE_MIXED \
613  cpu_to_le32(CHANNEL_MODE_MIXED << RXON_FLG_CHANNEL_MODE_POS)
614 
615 /* CTS to self (if spec allows) flag */
616 #define RXON_FLG_SELF_CTS_EN cpu_to_le32(0x1<<30)
617 
618 /* rx_config filter flags */
619 /* accept all data frames */
620 #define RXON_FILTER_PROMISC_MSK cpu_to_le32(1 << 0)
621 /* pass control & management to host */
622 #define RXON_FILTER_CTL2HOST_MSK cpu_to_le32(1 << 1)
623 /* accept multi-cast */
624 #define RXON_FILTER_ACCEPT_GRP_MSK cpu_to_le32(1 << 2)
625 /* don't decrypt uni-cast frames */
626 #define RXON_FILTER_DIS_DECRYPT_MSK cpu_to_le32(1 << 3)
627 /* don't decrypt multi-cast frames */
628 #define RXON_FILTER_DIS_GRP_DECRYPT_MSK cpu_to_le32(1 << 4)
629 /* STA is associated */
630 #define RXON_FILTER_ASSOC_MSK cpu_to_le32(1 << 5)
631 /* transfer to host non bssid beacons in associated state */
632 #define RXON_FILTER_BCON_AWARE_MSK cpu_to_le32(1 << 6)
633 
669 } __packed;
670 
689 } __packed;
690 
691 /* Create a common rxon cmd which will be typecast into the 3945 or 4965
692  * specific rxon cmd, depending on where it is called from.
693  */
694 struct il_rxon_cmd {
714 } __packed;
715 
716 /*
717  * C_RXON_ASSOC = 0x11 (command, has simple generic response)
718  */
725 } __packed;
726 
736 } __packed;
737 
738 #define IL_CONN_MAX_LISTEN_INTERVAL 10
739 #define IL_MAX_UCODE_BEACON_INTERVAL 4 /* 4096 */
740 #define IL39_MAX_UCODE_BEACON_INTERVAL 1 /* 1024 */
741 
742 /*
743  * C_RXON_TIMING = 0x14 (command, has simple generic response)
744  */
753 } __packed;
754 
755 /*
756  * C_CHANNEL_SWITCH = 0x72 (command, has simple generic response)
757  */
766 } __packed;
767 
776 } __packed;
777 
778 /*
779  * N_CHANNEL_SWITCH = 0x73 (notification only, not a command)
780  */
784  __le32 status; /* 0 - OK, 1 - fail */
785 } __packed;
786 
787 /******************************************************************************
788  * (2)
789  * Quality-of-Service (QOS) Commands & Responses:
790  *
791  *****************************************************************************/
792 
809 struct il_ac_qos {
815 } __packed;
816 
817 /* QoS flags defines */
818 #define QOS_PARAM_FLG_UPDATE_EDCA_MSK cpu_to_le32(0x01)
819 #define QOS_PARAM_FLG_TGN_MSK cpu_to_le32(0x02)
820 #define QOS_PARAM_FLG_TXOP_TYPE_MSK cpu_to_le32(0x10)
821 
822 /* Number of Access Categories (AC) (EDCA), queues 0..3 */
823 #define AC_NUM 4
824 
825 /*
826  * C_QOS_PARAM = 0x13 (command, has simple generic response)
827  *
828  * This command sets up timings for each of the 4 prioritized EDCA Tx FIFOs
829  * 0: Background, 1: Best Effort, 2: Video, 3: Voice.
830  */
833  struct il_ac_qos ac[AC_NUM];
834 } __packed;
835 
836 /******************************************************************************
837  * (3)
838  * Add/Modify Stations Commands & Responses:
839  *
840  *****************************************************************************/
841 /*
842  * Multi station support
843  */
844 
845 /* Special, dedicated locations within device's station table */
846 #define IL_AP_ID 0
847 #define IL_STA_ID 2
848 #define IL3945_BROADCAST_ID 24
849 #define IL3945_STATION_COUNT 25
850 #define IL4965_BROADCAST_ID 31
851 #define IL4965_STATION_COUNT 32
852 
853 #define IL_STATION_COUNT 32 /* MAX(3945,4965) */
854 #define IL_INVALID_STATION 255
855 
856 #define STA_FLG_TX_RATE_MSK cpu_to_le32(1 << 2)
857 #define STA_FLG_PWR_SAVE_MSK cpu_to_le32(1 << 8)
858 #define STA_FLG_RTS_MIMO_PROT_MSK cpu_to_le32(1 << 17)
859 #define STA_FLG_AGG_MPDU_8US_MSK cpu_to_le32(1 << 18)
860 #define STA_FLG_MAX_AGG_SIZE_POS (19)
861 #define STA_FLG_MAX_AGG_SIZE_MSK cpu_to_le32(3 << 19)
862 #define STA_FLG_HT40_EN_MSK cpu_to_le32(1 << 21)
863 #define STA_FLG_MIMO_DIS_MSK cpu_to_le32(1 << 22)
864 #define STA_FLG_AGG_MPDU_DENSITY_POS (23)
865 #define STA_FLG_AGG_MPDU_DENSITY_MSK cpu_to_le32(7 << 23)
866 
867 /* Use in mode field. 1: modify existing entry, 0: add new station entry */
868 #define STA_CONTROL_MODIFY_MSK 0x01
869 
870 /* key flags __le16*/
871 #define STA_KEY_FLG_ENCRYPT_MSK cpu_to_le16(0x0007)
872 #define STA_KEY_FLG_NO_ENC cpu_to_le16(0x0000)
873 #define STA_KEY_FLG_WEP cpu_to_le16(0x0001)
874 #define STA_KEY_FLG_CCMP cpu_to_le16(0x0002)
875 #define STA_KEY_FLG_TKIP cpu_to_le16(0x0003)
876 
877 #define STA_KEY_FLG_KEYID_POS 8
878 #define STA_KEY_FLG_INVALID cpu_to_le16(0x0800)
879 /* wep key is either from global key (0) or from station info array (1) */
880 #define STA_KEY_FLG_MAP_KEY_MSK cpu_to_le16(0x0008)
881 
882 /* wep key in STA: 5-bytes (0) or 13-bytes (1) */
883 #define STA_KEY_FLG_KEY_SIZE_MSK cpu_to_le16(0x1000)
884 #define STA_KEY_MULTICAST_MSK cpu_to_le16(0x4000)
885 #define STA_KEY_MAX_NUM 8
886 
887 /* Flags indicate whether to modify vs. don't change various station params */
888 #define STA_MODIFY_KEY_MASK 0x01
889 #define STA_MODIFY_TID_DISABLE_TX 0x02
890 #define STA_MODIFY_TX_RATE_MSK 0x04
891 #define STA_MODIFY_ADDBA_TID_MSK 0x08
892 #define STA_MODIFY_DELBA_TID_MSK 0x10
893 #define STA_MODIFY_SLEEP_TX_COUNT_MSK 0x20
894 
895 /* Receiver address (actually, Rx station's idx into station table),
896  * combined with Traffic ID (QOS priority), in format used by Tx Scheduler */
897 #define BUILD_RAxTID(sta_id, tid) (((sta_id) << 4) + (tid))
898 
901  u8 tkip_rx_tsc_byte2; /* TSC[2] for key mix ph1 detection */
903  __le16 tkip_rx_ttak[5]; /* 10-byte unicast TKIP TTAK */
906  u8 key[16]; /* 16-byte unicast decryption key */
907 } __packed;
908 
927 } __packed;
928 
929 /*
930  * C_ADD_STA = 0x18 (command)
931  *
932  * The device contains an internal table of per-station information,
933  * with info on security keys, aggregation parameters, and Tx rates for
934  * initial Tx attempt and any retries (4965 devices uses
935  * C_TX_LINK_QUALITY_CMD,
936  * 3945 uses C_RATE_SCALE to set up rate tables).
937  *
938  * C_ADD_STA sets up the table entry for one station, either creating
939  * a new entry, or modifying a pre-existing one.
940  *
941  * NOTE: RXON command (without "associated" bit set) wipes the station table
942  * clean. Moving into RF_KILL state does this also. Driver must set up
943  * new station table before transmitting anything on the RXON channel
944  * (except active scans or active measurements; those commands carry
945  * their own txpower/rate setup data).
946  *
947  * When getting started on a new channel, driver must set up the
948  * IL_BROADCAST_ID entry (last entry in the table). For a client
949  * station in a BSS, once an AP is selected, driver sets up the AP STA
950  * in the IL_AP_ID entry (1st entry in the table). BROADCAST and AP
951  * are all that are needed for a BSS client station. If the device is
952  * used as AP, or in an IBSS network, driver must set up station table
953  * entries for all STAs in network, starting with idx IL_STA_ID.
954  */
955 
957  u8 mode; /* 1: modify existing, 0: add new station */
961  __le32 station_flags; /* STA_FLG_* */
962  __le32 station_flags_msk; /* STA_FLG_* */
963 
964  /* bit field to disable (1) or enable (0) Tx for Traffic ID (TID)
965  * corresponding to bit (e.g. bit 5 controls TID 5).
966  * Set modify_mask bit STA_MODIFY_TID_DISABLE_TX to use this field. */
968 
970 
971  /* TID for which to add block-ack support.
972  * Set modify_mask bit STA_MODIFY_ADDBA_TID_MSK to use this field. */
974 
975  /* TID for which to remove block-ack support.
976  * Set modify_mask bit STA_MODIFY_DELBA_TID_MSK to use this field. */
978 
979  /* Starting Sequence Number for added block-ack support.
980  * Set modify_mask bit STA_MODIFY_ADDBA_TID_MSK to use this field. */
982 } __packed;
983 
985  u8 mode; /* 1: modify existing, 0: add new station */
989  __le32 station_flags; /* STA_FLG_* */
990  __le32 station_flags_msk; /* STA_FLG_* */
991 
992  /* bit field to disable (1) or enable (0) Tx for Traffic ID (TID)
993  * corresponding to bit (e.g. bit 5 controls TID 5).
994  * Set modify_mask bit STA_MODIFY_TID_DISABLE_TX to use this field. */
996 
998 
999  /* TID for which to add block-ack support.
1000  * Set modify_mask bit STA_MODIFY_ADDBA_TID_MSK to use this field. */
1002 
1003  /* TID for which to remove block-ack support.
1004  * Set modify_mask bit STA_MODIFY_DELBA_TID_MSK to use this field. */
1006 
1007  /* Starting Sequence Number for added block-ack support.
1008  * Set modify_mask bit STA_MODIFY_ADDBA_TID_MSK to use this field. */
1010 
1011  /*
1012  * Number of packets OK to transmit to station even though
1013  * it is asleep -- used to synchronise PS-poll and u-APSD
1014  * responses while ucode keeps track of STA sleep state.
1015  */
1017 
1019 } __packed;
1020 
1021 /* Wrapper struct for 3945 and 4965 addsta_cmd structures */
1023  u8 mode; /* 1: modify existing, 0: add new station */
1027  __le32 station_flags; /* STA_FLG_* */
1028  __le32 station_flags_msk; /* STA_FLG_* */
1029 
1030  /* bit field to disable (1) or enable (0) Tx for Traffic ID (TID)
1031  * corresponding to bit (e.g. bit 5 controls TID 5).
1032  * Set modify_mask bit STA_MODIFY_TID_DISABLE_TX to use this field. */
1034 
1035  __le16 rate_n_flags; /* 3945 only */
1036 
1037  /* TID for which to add block-ack support.
1038  * Set modify_mask bit STA_MODIFY_ADDBA_TID_MSK to use this field. */
1040 
1041  /* TID for which to remove block-ack support.
1042  * Set modify_mask bit STA_MODIFY_DELBA_TID_MSK to use this field. */
1044 
1045  /* Starting Sequence Number for added block-ack support.
1046  * Set modify_mask bit STA_MODIFY_ADDBA_TID_MSK to use this field. */
1048 
1049  /*
1050  * Number of packets OK to transmit to station even though
1051  * it is asleep -- used to synchronise PS-poll and u-APSD
1052  * responses while ucode keeps track of STA sleep state.
1053  */
1055 
1057 } __packed;
1058 
1059 #define ADD_STA_SUCCESS_MSK 0x1
1060 #define ADD_STA_NO_ROOM_IN_TBL 0x2
1061 #define ADD_STA_NO_BLOCK_ACK_RESOURCE 0x4
1062 #define ADD_STA_MODIFY_NON_EXIST_STA 0x8
1063 /*
1064  * C_ADD_STA = 0x18 (response)
1065  */
1067  u8 status; /* ADD_STA_* */
1068 } __packed;
1069 
1070 #define REM_STA_SUCCESS_MSK 0x1
1071 /*
1072  * C_REM_STA = 0x19 (response)
1073  */
1076 } __packed;
1077 
1078 /*
1079  * C_REM_STA = 0x19 (command)
1080  */
1082  u8 num_sta; /* number of removed stations */
1084  u8 addr[ETH_ALEN]; /* MAC addr of the first station */
1086 } __packed;
1087 
1088 #define IL_TX_FIFO_BK_MSK cpu_to_le32(BIT(0))
1089 #define IL_TX_FIFO_BE_MSK cpu_to_le32(BIT(1))
1090 #define IL_TX_FIFO_VI_MSK cpu_to_le32(BIT(2))
1091 #define IL_TX_FIFO_VO_MSK cpu_to_le32(BIT(3))
1092 #define IL_AGG_TX_QUEUE_MSK cpu_to_le32(0xffc00)
1093 
1094 #define IL_DROP_SINGLE 0
1095 #define IL_DROP_SELECTED 1
1096 #define IL_DROP_ALL 2
1097 
1098 /*
1099  * REPLY_WEP_KEY = 0x20
1100  */
1101 struct il_wep_key {
1107  u8 key[16];
1108 } __packed;
1109 
1110 struct il_wep_cmd {
1115  struct il_wep_key key[0];
1116 } __packed;
1117 
1118 #define WEP_KEY_WEP_TYPE 1
1119 #define WEP_KEYS_MAX 4
1120 #define WEP_INVALID_OFFSET 0xff
1121 #define WEP_KEY_LEN_64 5
1122 #define WEP_KEY_LEN_128 13
1123 
1124 /******************************************************************************
1125  * (4)
1126  * Rx Responses:
1127  *
1128  *****************************************************************************/
1129 
1130 #define RX_RES_STATUS_NO_CRC32_ERROR cpu_to_le32(1 << 0)
1131 #define RX_RES_STATUS_NO_RXE_OVERFLOW cpu_to_le32(1 << 1)
1132 
1133 #define RX_RES_PHY_FLAGS_BAND_24_MSK cpu_to_le16(1 << 0)
1134 #define RX_RES_PHY_FLAGS_MOD_CCK_MSK cpu_to_le16(1 << 1)
1135 #define RX_RES_PHY_FLAGS_SHORT_PREAMBLE_MSK cpu_to_le16(1 << 2)
1136 #define RX_RES_PHY_FLAGS_NARROW_BAND_MSK cpu_to_le16(1 << 3)
1137 #define RX_RES_PHY_FLAGS_ANTENNA_MSK 0xf0
1138 #define RX_RES_PHY_FLAGS_ANTENNA_POS 4
1139 
1140 #define RX_RES_STATUS_SEC_TYPE_MSK (0x7 << 8)
1141 #define RX_RES_STATUS_SEC_TYPE_NONE (0x0 << 8)
1142 #define RX_RES_STATUS_SEC_TYPE_WEP (0x1 << 8)
1143 #define RX_RES_STATUS_SEC_TYPE_CCMP (0x2 << 8)
1144 #define RX_RES_STATUS_SEC_TYPE_TKIP (0x3 << 8)
1145 #define RX_RES_STATUS_SEC_TYPE_ERR (0x7 << 8)
1146 
1147 #define RX_RES_STATUS_STATION_FOUND (1<<6)
1148 #define RX_RES_STATUS_NO_STATION_INFO_MISMATCH (1<<7)
1149 
1150 #define RX_RES_STATUS_DECRYPT_TYPE_MSK (0x3 << 11)
1151 #define RX_RES_STATUS_NOT_DECRYPT (0x0 << 11)
1152 #define RX_RES_STATUS_DECRYPT_OK (0x3 << 11)
1153 #define RX_RES_STATUS_BAD_ICV_MIC (0x1 << 11)
1154 #define RX_RES_STATUS_BAD_KEY_TTAK (0x2 << 11)
1155 
1156 #define RX_MPDU_RES_STATUS_ICV_OK (0x20)
1157 #define RX_MPDU_RES_STATUS_MIC_OK (0x40)
1158 #define RX_MPDU_RES_STATUS_TTAK_OK (1 << 7)
1159 #define RX_MPDU_RES_STATUS_DEC_DONE_MSK (0x800)
1160 
1169 } __packed;
1170 
1178 } __packed;
1179 
1184 } __packed;
1185 
1186 /*
1187  * N_3945_RX = 0x1b (response only, not a command)
1188  *
1189  * NOTE: DO NOT dereference from casts to this structure
1190  * It is provided only for calculating minimum data set size.
1191  * The actual offsets of the hdr and end are dynamic based on
1192  * stats.phy_count
1193  */
1198 } __packed;
1199 
1200 #define IL39_RX_FRAME_SIZE (4 + sizeof(struct il3945_rx_frame))
1201 
1202 /* Fixed (non-configurable) rx data from phy */
1203 
1204 #define IL49_RX_RES_PHY_CNT 14
1205 #define IL49_RX_PHY_FLAGS_ANTENNAE_OFFSET (4)
1206 #define IL49_RX_PHY_FLAGS_ANTENNAE_MASK (0x70)
1207 #define IL49_AGC_DB_MASK (0x3f80) /* MASK(7,13) */
1208 #define IL49_AGC_DB_POS (7)
1210  __le16 ant_selection; /* ant A bit 4, ant B bit 5, ant C bit 6 */
1211  __le16 agc_info; /* agc code 0:6, agc dB 7:13, reserved 14:15 */
1212  u8 rssi_info[6]; /* we use even entries, 0/2/4 for A/B/C rssi */
1213  u8 pad[0];
1214 } __packed;
1215 
1216 /*
1217  * N_RX = 0xc3 (response only, not a command)
1218  * Used only for legacy (non 11n) frames.
1219  */
1221  u8 non_cfg_phy_cnt; /* non configurable DSP phy data byte count */
1222  u8 cfg_phy_cnt; /* configurable DSP phy data byte count */
1223  u8 stat_id; /* configurable DSP phy data set ID */
1225  __le64 timestamp; /* TSF at on air rise */
1226  __le32 beacon_time_stamp; /* beacon at on-air rise */
1227  __le16 phy_flags; /* general phy flags: band, modulation, ... */
1228  __le16 channel; /* channel number */
1229  u8 non_cfg_phy_buf[32]; /* for various implementations of non_cfg_phy */
1230  __le32 rate_n_flags; /* RATE_MCS_* */
1231  __le16 byte_count; /* frame's byte-count */
1232  __le16 frame_time; /* frame's time on the air */
1233 } __packed;
1234 
1238 } __packed;
1239 
1240 /******************************************************************************
1241  * (5)
1242  * Tx Commands & Responses:
1243  *
1244  * Driver must place each C_TX command into one of the prioritized Tx
1245  * queues in host DRAM, shared between driver and device (see comments for
1246  * SCD registers and Tx/Rx Queues). When the device's Tx scheduler and uCode
1247  * are preparing to transmit, the device pulls the Tx command over the PCI
1248  * bus via one of the device's Tx DMA channels, to fill an internal FIFO
1249  * from which data will be transmitted.
1250  *
1251  * uCode handles all timing and protocol related to control frames
1252  * (RTS/CTS/ACK), based on flags in the Tx command. uCode and Tx scheduler
1253  * handle reception of block-acks; uCode updates the host driver via
1254  * N_COMPRESSED_BA.
1255  *
1256  * uCode handles retrying Tx when an ACK is expected but not received.
1257  * This includes trying lower data rates than the one requested in the Tx
1258  * command, as set up by the C_RATE_SCALE (for 3945) or
1259  * C_TX_LINK_QUALITY_CMD (4965).
1260  *
1261  * Driver sets up transmit power for various rates via C_TX_PWR_TBL.
1262  * This command must be executed after every RXON command, before Tx can occur.
1263  *****************************************************************************/
1264 
1265 /* C_TX Tx flags field */
1266 
1267 /*
1268  * 1: Use Request-To-Send protocol before this frame.
1269  * Mutually exclusive vs. TX_CMD_FLG_CTS_MSK.
1270  */
1271 #define TX_CMD_FLG_RTS_MSK cpu_to_le32(1 << 1)
1272 
1273 /*
1274  * 1: Transmit Clear-To-Send to self before this frame.
1275  * Driver should set this for AUTH/DEAUTH/ASSOC-REQ/REASSOC mgmnt frames.
1276  * Mutually exclusive vs. TX_CMD_FLG_RTS_MSK.
1277  */
1278 #define TX_CMD_FLG_CTS_MSK cpu_to_le32(1 << 2)
1279 
1280 /* 1: Expect ACK from receiving station
1281  * 0: Don't expect ACK (MAC header's duration field s/b 0)
1282  * Set this for unicast frames, but not broadcast/multicast. */
1283 #define TX_CMD_FLG_ACK_MSK cpu_to_le32(1 << 3)
1284 
1285 /* For 4965 devices:
1286  * 1: Use rate scale table (see C_TX_LINK_QUALITY_CMD).
1287  * Tx command's initial_rate_idx indicates first rate to try;
1288  * uCode walks through table for additional Tx attempts.
1289  * 0: Use Tx rate/MCS from Tx command's rate_n_flags field.
1290  * This rate will be used for all Tx attempts; it will not be scaled. */
1291 #define TX_CMD_FLG_STA_RATE_MSK cpu_to_le32(1 << 4)
1292 
1293 /* 1: Expect immediate block-ack.
1294  * Set when Txing a block-ack request frame. Also set TX_CMD_FLG_ACK_MSK. */
1295 #define TX_CMD_FLG_IMM_BA_RSP_MASK cpu_to_le32(1 << 6)
1296 
1297 /*
1298  * 1: Frame requires full Tx-Op protection.
1299  * Set this if either RTS or CTS Tx Flag gets set.
1300  */
1301 #define TX_CMD_FLG_FULL_TXOP_PROT_MSK cpu_to_le32(1 << 7)
1302 
1303 /* Tx antenna selection field; used only for 3945, reserved (0) for 4965 devices.
1304  * Set field to "0" to allow 3945 uCode to select antenna (normal usage). */
1305 #define TX_CMD_FLG_ANT_SEL_MSK cpu_to_le32(0xf00)
1306 #define TX_CMD_FLG_ANT_A_MSK cpu_to_le32(1 << 8)
1307 #define TX_CMD_FLG_ANT_B_MSK cpu_to_le32(1 << 9)
1308 
1309 /* 1: uCode overrides sequence control field in MAC header.
1310  * 0: Driver provides sequence control field in MAC header.
1311  * Set this for management frames, non-QOS data frames, non-unicast frames,
1312  * and also in Tx command embedded in C_SCAN for active scans. */
1313 #define TX_CMD_FLG_SEQ_CTL_MSK cpu_to_le32(1 << 13)
1314 
1315 /* 1: This frame is non-last MPDU; more fragments are coming.
1316  * 0: Last fragment, or not using fragmentation. */
1317 #define TX_CMD_FLG_MORE_FRAG_MSK cpu_to_le32(1 << 14)
1318 
1319 /* 1: uCode calculates and inserts Timestamp Function (TSF) in outgoing frame.
1320  * 0: No TSF required in outgoing frame.
1321  * Set this for transmitting beacons and probe responses. */
1322 #define TX_CMD_FLG_TSF_MSK cpu_to_le32(1 << 16)
1323 
1324 /* 1: Driver inserted 2 bytes pad after the MAC header, for (required) dword
1325  * alignment of frame's payload data field.
1326  * 0: No pad
1327  * Set this for MAC headers with 26 or 30 bytes, i.e. those with QOS or ADDR4
1328  * field (but not both). Driver must align frame data (i.e. data following
1329  * MAC header) to DWORD boundary. */
1330 #define TX_CMD_FLG_MH_PAD_MSK cpu_to_le32(1 << 20)
1331 
1332 /* accelerate aggregation support
1333  * 0 - no CCMP encryption; 1 - CCMP encryption */
1334 #define TX_CMD_FLG_AGG_CCMP_MSK cpu_to_le32(1 << 22)
1335 
1336 /* HCCA-AP - disable duration overwriting. */
1337 #define TX_CMD_FLG_DUR_MSK cpu_to_le32(1 << 25)
1338 
1339 /*
1340  * TX command security control
1341  */
1342 #define TX_CMD_SEC_WEP 0x01
1343 #define TX_CMD_SEC_CCM 0x02
1344 #define TX_CMD_SEC_TKIP 0x03
1345 #define TX_CMD_SEC_MSK 0x03
1346 #define TX_CMD_SEC_SHIFT 6
1347 #define TX_CMD_SEC_KEY128 0x08
1348 
1349 /*
1350  * security overhead sizes
1351  */
1352 #define WEP_IV_LEN 4
1353 #define WEP_ICV_LEN 4
1354 #define CCMP_MIC_LEN 8
1355 #define TKIP_ICV_LEN 4
1356 
1357 /*
1358  * C_TX = 0x1c (command)
1359  */
1360 
1362  /*
1363  * MPDU byte count:
1364  * MAC header (24/26/30/32 bytes) + 2 bytes pad if 26/30 header size,
1365  * + 8 byte IV for CCM or TKIP (not used for WEP)
1366  * + Data payload
1367  * + 8-byte MIC (not used for CCM/WEP)
1368  * NOTE: Does not include Tx command bytes, post-MAC pad bytes,
1369  * MIC (CCM) 8 bytes, ICV (WEP/TKIP/CKIP) 4 bytes, CRC 4 bytes.i
1370  * Range: 14-2342 bytes.
1371  */
1373 
1374  /*
1375  * MPDU or MSDU byte count for next frame.
1376  * Used for fragmentation and bursting, but not 11n aggregation.
1377  * Same as "len", but for next frame. Set to 0 if not applicable.
1378  */
1380 
1381  __le32 tx_flags; /* TX_CMD_FLG_* */
1382 
1384 
1385  /* Index of recipient station in uCode's station table */
1389  u8 key[16];
1390  union {
1391  u8 byte[8];
1394  } tkip_mic;
1396  union {
1399  } stop_time;
1401  u8 rts_retry_limit; /*byte 50 */
1402  u8 data_retry_limit; /*byte 51 */
1403  union {
1406  } timeout;
1407 
1408  /*
1409  * Duration of EDCA burst Tx Opportunity, in 32-usec units.
1410  * Set this if txop time is not specified by HCCA protocol (e.g. by AP).
1411  */
1413 
1414  /*
1415  * MAC header goes here, followed by 2 bytes padding if MAC header
1416  * length is 26 or 30 bytes, followed by payload data
1417  */
1419  struct ieee80211_hdr hdr[0];
1420 } __packed;
1421 
1422 /*
1423  * C_TX = 0x1c (response)
1424  */
1431  __le32 status; /* TX status */
1432 } __packed;
1433 
1434 /*
1435  * 4965 uCode updates these Tx attempt count values in host DRAM.
1436  * Used for managing Tx retries when expecting block-acks.
1437  * Driver should set these fields to 0.
1438  */
1440  u8 try_cnt; /* Tx attempts */
1441  u8 bt_kill_cnt; /* Tx attempts blocked by Bluetooth device */
1443 } __packed;
1444 
1445 struct il_tx_cmd {
1446  /*
1447  * MPDU byte count:
1448  * MAC header (24/26/30/32 bytes) + 2 bytes pad if 26/30 header size,
1449  * + 8 byte IV for CCM or TKIP (not used for WEP)
1450  * + Data payload
1451  * + 8-byte MIC (not used for CCM/WEP)
1452  * NOTE: Does not include Tx command bytes, post-MAC pad bytes,
1453  * MIC (CCM) 8 bytes, ICV (WEP/TKIP/CKIP) 4 bytes, CRC 4 bytes.i
1454  * Range: 14-2342 bytes.
1455  */
1457 
1458  /*
1459  * MPDU or MSDU byte count for next frame.
1460  * Used for fragmentation and bursting, but not 11n aggregation.
1461  * Same as "len", but for next frame. Set to 0 if not applicable.
1462  */
1464 
1465  __le32 tx_flags; /* TX_CMD_FLG_* */
1466 
1467  /* uCode may modify this field of the Tx command (in host DRAM!).
1468  * Driver must also set dram_lsb_ptr and dram_msb_ptr in this cmd. */
1470 
1471  /* Rate for *all* Tx attempts, if TX_CMD_FLG_STA_RATE_MSK is cleared. */
1472  __le32 rate_n_flags; /* RATE_MCS_* */
1473 
1474  /* Index of destination station in uCode's station table */
1476 
1477  /* Type of security encryption: CCM or TKIP */
1478  u8 sec_ctl; /* TX_CMD_SEC_* */
1479 
1480  /*
1481  * Index into rate table (see C_TX_LINK_QUALITY_CMD) for initial
1482  * Tx attempt, if TX_CMD_FLG_STA_RATE_MSK is set. Normally "0" for
1483  * data frames, this field may be used to selectively reduce initial
1484  * rate (via non-0 value) for special frames (e.g. management), while
1485  * still supporting rate scaling for all frames.
1486  */
1489  u8 key[16];
1492  union {
1495  } stop_time;
1496 
1497  /* Host DRAM physical address pointer to "scratch" in this command.
1498  * Must be dword aligned. "0" in dram_lsb_ptr disables usage. */
1501 
1502  u8 rts_retry_limit; /*byte 50 */
1503  u8 data_retry_limit; /*byte 51 */
1505  union {
1508  } timeout;
1509 
1510  /*
1511  * Duration of EDCA burst Tx Opportunity, in 32-usec units.
1512  * Set this if txop time is not specified by HCCA protocol (e.g. by AP).
1513  */
1515 
1516  /*
1517  * MAC header goes here, followed by 2 bytes padding if MAC header
1518  * length is 26 or 30 bytes, followed by payload data
1519  */
1521  struct ieee80211_hdr hdr[0];
1522 } __packed;
1523 
1524 /* TX command response is sent after *3945* transmission attempts.
1525  *
1526  * NOTES:
1527  *
1528  * TX_STATUS_FAIL_NEXT_FRAG
1529  *
1530  * If the fragment flag in the MAC header for the frame being transmitted
1531  * is set and there is insufficient time to transmit the next frame, the
1532  * TX status will be returned with 'TX_STATUS_FAIL_NEXT_FRAG'.
1533  *
1534  * TX_STATUS_FIFO_UNDERRUN
1535  *
1536  * Indicates the host did not provide bytes to the FIFO fast enough while
1537  * a TX was in progress.
1538  *
1539  * TX_STATUS_FAIL_MGMNT_ABORT
1540  *
1541  * This status is only possible if the ABORT ON MGMT RX parameter was
1542  * set to true with the TX command.
1543  *
1544  * If the MSB of the status parameter is set then an abort sequence is
1545  * required. This sequence consists of the host activating the TX Abort
1546  * control line, and then waiting for the TX Abort command response. This
1547  * indicates that a the device is no longer in a transmit state, and that the
1548  * command FIFO has been cleared. The host must then deactivate the TX Abort
1549  * control line. Receiving is still allowed in this case.
1550  */
1551 enum {
1570 };
1571 
1572 /*
1573  * TX command response is sent after *4965* transmission attempts.
1574  *
1575  * both postpone and abort status are expected behavior from uCode. there is
1576  * no special operation required from driver; except for RFKILL_FLUSH,
1577  * which required tx flush host command to flush all the tx frames in queues
1578  */
1579 enum {
1582  /* postpone TX */
1587  /* abort TX */
1605 };
1606 
1607 #define TX_PACKET_MODE_REGULAR 0x0000
1608 #define TX_PACKET_MODE_BURST_SEQ 0x0100
1609 #define TX_PACKET_MODE_BURST_FIRST 0x0200
1610 
1611 enum {
1613 };
1614 
1615 enum {
1616  TX_STATUS_MSK = 0x000000ff, /* bits 0:7 */
1617  TX_STATUS_DELAY_MSK = 0x00000040,
1618  TX_STATUS_ABORT_MSK = 0x00000080,
1619  TX_PACKET_MODE_MSK = 0x0000ff00, /* bits 8:15 */
1620  TX_FIFO_NUMBER_MSK = 0x00070000, /* bits 16:18 */
1621  TX_RESERVED = 0x00780000, /* bits 19:22 */
1622  TX_POWER_PA_DETECT_MSK = 0x7f800000, /* bits 23:30 */
1623  TX_ABORT_REQUIRED_MSK = 0x80000000, /* bits 31:31 */
1624 };
1625 
1626 /* *******************************
1627  * TX aggregation status
1628  ******************************* */
1629 
1630 enum {
1642 };
1643 
1644 #define AGG_TX_STATUS_MSK 0x00000fff /* bits 0:11 */
1645 #define AGG_TX_TRY_MSK 0x0000f000 /* bits 12:15 */
1646 
1647 #define AGG_TX_STATE_LAST_SENT_MSK (AGG_TX_STATE_LAST_SENT_TTL_MSK | \
1648  AGG_TX_STATE_LAST_SENT_TRY_CNT_MSK)
1649 
1650 /* # tx attempts for first frame in aggregation */
1651 #define AGG_TX_STATE_TRY_CNT_POS 12
1652 #define AGG_TX_STATE_TRY_CNT_MSK 0xf000
1653 
1654 /* Command ID and sequence number of Tx command for this frame */
1655 #define AGG_TX_STATE_SEQ_NUM_POS 16
1656 #define AGG_TX_STATE_SEQ_NUM_MSK 0xffff0000
1657 
1658 /*
1659  * C_TX = 0x1c (response)
1660  *
1661  * This response may be in one of two slightly different formats, indicated
1662  * by the frame_count field:
1663  *
1664  * 1) No aggregation (frame_count == 1). This reports Tx results for
1665  * a single frame. Multiple attempts, at various bit rates, may have
1666  * been made for this frame.
1667  *
1668  * 2) Aggregation (frame_count > 1). This reports Tx results for
1669  * 2 or more frames that used block-acknowledge. All frames were
1670  * transmitted at same rate. Rate scaling may have been used if first
1671  * frame in this new agg block failed in previous agg block(s).
1672  *
1673  * Note that, for aggregation, ACK (block-ack) status is not delivered here;
1674  * block-ack has not been received by the time the 4965 device records
1675  * this status.
1676  * This status relates to reasons the tx might have been blocked or aborted
1677  * within the sending station (this 4965 device), rather than whether it was
1678  * received successfully by the destination station.
1679  */
1683 } __packed;
1684 
1686  u8 frame_count; /* 1 no aggregation, >1 aggregation */
1687  u8 bt_kill_count; /* # blocked by bluetooth (unused for agg) */
1688  u8 failure_rts; /* # failures due to unsuccessful RTS */
1689  u8 failure_frame; /* # failures due to no ACK (unused for agg) */
1690 
1691  /* For non-agg: Rate at which frame was successful.
1692  * For agg: Rate at which all frames were transmitted. */
1693  __le32 rate_n_flags; /* RATE_MCS_* */
1694 
1695  /* For non-agg: RTS + CTS + frame tx attempts time + ACK.
1696  * For agg: RTS + CTS + aggregation tx time + block-ack time. */
1698 
1700  __le32 pa_power1; /* RF power amplifier measurement (not used) */
1702 
1703  /*
1704  * For non-agg: frame status TX_STATUS_*
1705  * For agg: status of 1st frame, AGG_TX_STATE_*; other frame status
1706  * fields follow this one, up to frame_count.
1707  * Bit fields:
1708  * 11- 0: AGG_TX_STATE_* status code
1709  * 15-12: Retry count for 1st frame in aggregation (retries
1710  * occur if tx failed for this frame when it was a
1711  * member of a previous aggregation block). If rate
1712  * scaling is used, retry count indicates the rate
1713  * table entry used for all frames in the new agg.
1714  * 31-16: Sequence # for this frame's Tx cmd (not SSN!)
1715  */
1716  union {
1718  struct agg_tx_status agg_status[0]; /* for each agg frame */
1719  } u;
1720 } __packed;
1721 
1722 /*
1723  * N_COMPRESSED_BA = 0xc5 (response only, not a command)
1724  *
1725  * Reports Block-Acknowledge from recipient station
1726  */
1731 
1732  /* Index of recipient (BA-sending) station in uCode's station table */
1739 } __packed;
1740 
1741 /*
1742  * C_TX_PWR_TBL = 0x97 (command, has simple generic response)
1743  *
1744  * See details under "TXPOWER" in 4965.h.
1745  */
1746 
1748  u8 band; /* 0: 5 GHz, 1: 2.4 GHz */
1752 } __packed;
1753 
1755  u8 band; /* 0: 5 GHz, 1: 2.4 GHz */
1759 } __packed;
1760 
1780 } __packed;
1781 
1786 } __packed;
1787 
1788 /*RS_NEW_API: only TLC_RTS remains and moved to bit 0 */
1789 #define LINK_QUAL_FLAGS_SET_STA_TLC_RTS_MSK (1 << 0)
1790 
1791 /* # of EDCA prioritized tx fifos */
1792 #define LINK_QUAL_AC_NUM AC_NUM
1793 
1794 /* # entries in rate scale table to support Tx retries */
1795 #define LINK_QUAL_MAX_RETRY_NUM 16
1796 
1797 /* Tx antenna selection values */
1798 #define LINK_QUAL_ANT_A_MSK (1 << 0)
1799 #define LINK_QUAL_ANT_B_MSK (1 << 1)
1800 #define LINK_QUAL_ANT_MSK (LINK_QUAL_ANT_A_MSK|LINK_QUAL_ANT_B_MSK)
1801 
1809 
1810  /* No entries at or above this (driver chosen) idx contain MIMO */
1812 
1813  /* Best single antenna to use for single stream (legacy, SISO). */
1814  u8 single_stream_ant_msk; /* LINK_QUAL_ANT_* */
1815 
1816  /* Best antennas to use for MIMO (unused for 4965, assumes both). */
1817  u8 dual_stream_ant_msk; /* LINK_QUAL_ANT_* */
1818 
1819  /*
1820  * If driver needs to use different initial rates for different
1821  * EDCA QOS access categories (as implemented by tx fifos 0-3),
1822  * this table will set that up, by indicating the idxes in the
1823  * rs_table[LINK_QUAL_MAX_RETRY_NUM] rate table at which to start.
1824  * Otherwise, driver should set all entries to 0.
1825  *
1826  * Entry usage:
1827  * 0 = Background, 1 = Best Effort (normal), 2 = Video, 3 = Voice
1828  * TX FIFOs above 3 use same value (typically 0) as TX FIFO 3.
1829  */
1831 } __packed;
1832 
1833 #define LINK_QUAL_AGG_TIME_LIMIT_DEF (4000) /* 4 milliseconds */
1834 #define LINK_QUAL_AGG_TIME_LIMIT_MAX (8000)
1835 #define LINK_QUAL_AGG_TIME_LIMIT_MIN (100)
1836 
1837 #define LINK_QUAL_AGG_DISABLE_START_DEF (3)
1838 #define LINK_QUAL_AGG_DISABLE_START_MAX (255)
1839 #define LINK_QUAL_AGG_DISABLE_START_MIN (0)
1840 
1841 #define LINK_QUAL_AGG_FRAME_LIMIT_DEF (31)
1842 #define LINK_QUAL_AGG_FRAME_LIMIT_MAX (63)
1843 #define LINK_QUAL_AGG_FRAME_LIMIT_MIN (0)
1844 
1851 
1852  /*
1853  *Maximum number of uSec in aggregation.
1854  * default set to 4000 (4 milliseconds) if not configured in .cfg
1855  */
1857 
1858  /*
1859  * Number of Tx retries allowed for a frame, before that frame will
1860  * no longer be considered for the start of an aggregation sequence
1861  * (scheduler will then try to tx it as single frame).
1862  * Driver should set this to 3.
1863  */
1865 
1866  /*
1867  * Maximum number of frames in aggregation.
1868  * 0 = no limit (default). 1 = no aggregation.
1869  * Other values = max # frames in aggregation.
1870  */
1872 
1874 } __packed;
1875 
1876 /*
1877  * C_TX_LINK_QUALITY_CMD = 0x4e (command, has simple generic response)
1878  *
1879  * For 4965 devices only; 3945 uses C_RATE_SCALE.
1880  *
1881  * Each station in the 4965 device's internal station table has its own table
1882  * of 16
1883  * Tx rates and modulation modes (e.g. legacy/SISO/MIMO) for retrying Tx when
1884  * an ACK is not received. This command replaces the entire table for
1885  * one station.
1886  *
1887  * NOTE: Station must already be in 4965 device's station table.
1888  * Use C_ADD_STA.
1889  *
1890  * The rate scaling procedures described below work well. Of course, other
1891  * procedures are possible, and may work better for particular environments.
1892  *
1893  *
1894  * FILLING THE RATE TBL
1895  *
1896  * Given a particular initial rate and mode, as determined by the rate
1897  * scaling algorithm described below, the Linux driver uses the following
1898  * formula to fill the rs_table[LINK_QUAL_MAX_RETRY_NUM] rate table in the
1899  * Link Quality command:
1900  *
1901  *
1902  * 1) If using High-throughput (HT) (SISO or MIMO) initial rate:
1903  * a) Use this same initial rate for first 3 entries.
1904  * b) Find next lower available rate using same mode (SISO or MIMO),
1905  * use for next 3 entries. If no lower rate available, switch to
1906  * legacy mode (no HT40 channel, no MIMO, no short guard interval).
1907  * c) If using MIMO, set command's mimo_delimiter to number of entries
1908  * using MIMO (3 or 6).
1909  * d) After trying 2 HT rates, switch to legacy mode (no HT40 channel,
1910  * no MIMO, no short guard interval), at the next lower bit rate
1911  * (e.g. if second HT bit rate was 54, try 48 legacy), and follow
1912  * legacy procedure for remaining table entries.
1913  *
1914  * 2) If using legacy initial rate:
1915  * a) Use the initial rate for only one entry.
1916  * b) For each following entry, reduce the rate to next lower available
1917  * rate, until reaching the lowest available rate.
1918  * c) When reducing rate, also switch antenna selection.
1919  * d) Once lowest available rate is reached, repeat this rate until
1920  * rate table is filled (16 entries), switching antenna each entry.
1921  *
1922  *
1923  * ACCUMULATING HISTORY
1924  *
1925  * The rate scaling algorithm for 4965 devices, as implemented in Linux driver,
1926  * uses two sets of frame Tx success history: One for the current/active
1927  * modulation mode, and one for a speculative/search mode that is being
1928  * attempted. If the speculative mode turns out to be more effective (i.e.
1929  * actual transfer rate is better), then the driver continues to use the
1930  * speculative mode as the new current active mode.
1931  *
1932  * Each history set contains, separately for each possible rate, data for a
1933  * sliding win of the 62 most recent tx attempts at that rate. The data
1934  * includes a shifting bitmap of success(1)/failure(0), and sums of successful
1935  * and attempted frames, from which the driver can additionally calculate a
1936  * success ratio (success / attempted) and number of failures
1937  * (attempted - success), and control the size of the win (attempted).
1938  * The driver uses the bit map to remove successes from the success sum, as
1939  * the oldest tx attempts fall out of the win.
1940  *
1941  * When the 4965 device makes multiple tx attempts for a given frame, each
1942  * attempt might be at a different rate, and have different modulation
1943  * characteristics (e.g. antenna, fat channel, short guard interval), as set
1944  * up in the rate scaling table in the Link Quality command. The driver must
1945  * determine which rate table entry was used for each tx attempt, to determine
1946  * which rate-specific history to update, and record only those attempts that
1947  * match the modulation characteristics of the history set.
1948  *
1949  * When using block-ack (aggregation), all frames are transmitted at the same
1950  * rate, since there is no per-attempt acknowledgment from the destination
1951  * station. The Tx response struct il_tx_resp indicates the Tx rate in
1952  * rate_n_flags field. After receiving a block-ack, the driver can update
1953  * history for the entire block all at once.
1954  *
1955  *
1956  * FINDING BEST STARTING RATE:
1957  *
1958  * When working with a selected initial modulation mode (see below), the
1959  * driver attempts to find a best initial rate. The initial rate is the
1960  * first entry in the Link Quality command's rate table.
1961  *
1962  * 1) Calculate actual throughput (success ratio * expected throughput, see
1963  * table below) for current initial rate. Do this only if enough frames
1964  * have been attempted to make the value meaningful: at least 6 failed
1965  * tx attempts, or at least 8 successes. If not enough, don't try rate
1966  * scaling yet.
1967  *
1968  * 2) Find available rates adjacent to current initial rate. Available means:
1969  * a) supported by hardware &&
1970  * b) supported by association &&
1971  * c) within any constraints selected by user
1972  *
1973  * 3) Gather measured throughputs for adjacent rates. These might not have
1974  * enough history to calculate a throughput. That's okay, we might try
1975  * using one of them anyway!
1976  *
1977  * 4) Try decreasing rate if, for current rate:
1978  * a) success ratio is < 15% ||
1979  * b) lower adjacent rate has better measured throughput ||
1980  * c) higher adjacent rate has worse throughput, and lower is unmeasured
1981  *
1982  * As a sanity check, if decrease was determined above, leave rate
1983  * unchanged if:
1984  * a) lower rate unavailable
1985  * b) success ratio at current rate > 85% (very good)
1986  * c) current measured throughput is better than expected throughput
1987  * of lower rate (under perfect 100% tx conditions, see table below)
1988  *
1989  * 5) Try increasing rate if, for current rate:
1990  * a) success ratio is < 15% ||
1991  * b) both adjacent rates' throughputs are unmeasured (try it!) ||
1992  * b) higher adjacent rate has better measured throughput ||
1993  * c) lower adjacent rate has worse throughput, and higher is unmeasured
1994  *
1995  * As a sanity check, if increase was determined above, leave rate
1996  * unchanged if:
1997  * a) success ratio at current rate < 70%. This is not particularly
1998  * good performance; higher rate is sure to have poorer success.
1999  *
2000  * 6) Re-evaluate the rate after each tx frame. If working with block-
2001  * acknowledge, history and stats may be calculated for the entire
2002  * block (including prior history that fits within the history wins),
2003  * before re-evaluation.
2004  *
2005  * FINDING BEST STARTING MODULATION MODE:
2006  *
2007  * After working with a modulation mode for a "while" (and doing rate scaling),
2008  * the driver searches for a new initial mode in an attempt to improve
2009  * throughput. The "while" is measured by numbers of attempted frames:
2010  *
2011  * For legacy mode, search for new mode after:
2012  * 480 successful frames, or 160 failed frames
2013  * For high-throughput modes (SISO or MIMO), search for new mode after:
2014  * 4500 successful frames, or 400 failed frames
2015  *
2016  * Mode switch possibilities are (3 for each mode):
2017  *
2018  * For legacy:
2019  * Change antenna, try SISO (if HT association), try MIMO (if HT association)
2020  * For SISO:
2021  * Change antenna, try MIMO, try shortened guard interval (SGI)
2022  * For MIMO:
2023  * Try SISO antenna A, SISO antenna B, try shortened guard interval (SGI)
2024  *
2025  * When trying a new mode, use the same bit rate as the old/current mode when
2026  * trying antenna switches and shortened guard interval. When switching to
2027  * SISO from MIMO or legacy, or to MIMO from SISO or legacy, use a rate
2028  * for which the expected throughput (under perfect conditions) is about the
2029  * same or slightly better than the actual measured throughput delivered by
2030  * the old/current mode.
2031  *
2032  * Actual throughput can be estimated by multiplying the expected throughput
2033  * by the success ratio (successful / attempted tx frames). Frame size is
2034  * not considered in this calculation; it assumes that frame size will average
2035  * out to be fairly consistent over several samples. The following are
2036  * metric values for expected throughput assuming 100% success ratio.
2037  * Only G band has support for CCK rates:
2038  *
2039  * RATE: 1 2 5 11 6 9 12 18 24 36 48 54 60
2040  *
2041  * G: 7 13 35 58 40 57 72 98 121 154 177 186 186
2042  * A: 0 0 0 0 40 57 72 98 121 154 177 186 186
2043  * SISO 20MHz: 0 0 0 0 42 42 76 102 124 159 183 193 202
2044  * SGI SISO 20MHz: 0 0 0 0 46 46 82 110 132 168 192 202 211
2045  * MIMO 20MHz: 0 0 0 0 74 74 123 155 179 214 236 244 251
2046  * SGI MIMO 20MHz: 0 0 0 0 81 81 131 164 188 222 243 251 257
2047  * SISO 40MHz: 0 0 0 0 77 77 127 160 184 220 242 250 257
2048  * SGI SISO 40MHz: 0 0 0 0 83 83 135 169 193 229 250 257 264
2049  * MIMO 40MHz: 0 0 0 0 123 123 182 214 235 264 279 285 289
2050  * SGI MIMO 40MHz: 0 0 0 0 131 131 191 222 242 270 284 289 293
2051  *
2052  * After the new mode has been tried for a short while (minimum of 6 failed
2053  * frames or 8 successful frames), compare success ratio and actual throughput
2054  * estimate of the new mode with the old. If either is better with the new
2055  * mode, continue to use the new mode.
2056  *
2057  * Continue comparing modes until all 3 possibilities have been tried.
2058  * If moving from legacy to HT, try all 3 possibilities from the new HT
2059  * mode. After trying all 3, a best mode is found. Continue to use this mode
2060  * for the longer "while" described above (e.g. 480 successful frames for
2061  * legacy), and then repeat the search process.
2062  *
2063  */
2065 
2066  /* Index of destination/recipient station in uCode's station table */
2069  __le16 control; /* not used */
2072 
2073  /*
2074  * Rate info; when using rate-scaling, Tx command's initial_rate_idx
2075  * specifies 1st Tx rate attempted, via idx into this table.
2076  * 4965 devices works its way through table when retrying Tx.
2077  */
2078  struct {
2079  __le32 rate_n_flags; /* RATE_MCS_*, RATE_* */
2082 } __packed;
2083 
2084 /*
2085  * BT configuration enable flags:
2086  * bit 0 - 1: BT channel announcement enabled
2087  * 0: disable
2088  * bit 1 - 1: priority of BT device enabled
2089  * 0: disable
2090  */
2091 #define BT_COEX_DISABLE (0x0)
2092 #define BT_ENABLE_CHANNEL_ANNOUNCE BIT(0)
2093 #define BT_ENABLE_PRIORITY BIT(1)
2094 
2095 #define BT_COEX_ENABLE (BT_ENABLE_CHANNEL_ANNOUNCE | BT_ENABLE_PRIORITY)
2096 
2097 #define BT_LEAD_TIME_DEF (0x1E)
2098 
2099 #define BT_MAX_KILL_DEF (0x5)
2100 
2101 /*
2102  * C_BT_CONFIG = 0x9b (command, has simple generic response)
2103  *
2104  * 3945 and 4965 devices support hardware handshake with Bluetooth device on
2105  * same platform. Bluetooth device alerts wireless device when it will Tx;
2106  * wireless device can delay or kill its own Tx to accommodate.
2107  */
2108 struct il_bt_cmd {
2115 } __packed;
2116 
2117 /******************************************************************************
2118  * (6)
2119  * Spectrum Management (802.11h) Commands, Responses, Notifications:
2120  *
2121  *****************************************************************************/
2122 
2123 /*
2124  * Spectrum Management
2125  */
2126 #define MEASUREMENT_FILTER_FLAG (RXON_FILTER_PROMISC_MSK | \
2127  RXON_FILTER_CTL2HOST_MSK | \
2128  RXON_FILTER_ACCEPT_GRP_MSK | \
2129  RXON_FILTER_DIS_DECRYPT_MSK | \
2130  RXON_FILTER_DIS_GRP_DECRYPT_MSK | \
2131  RXON_FILTER_ASSOC_MSK | \
2132  RXON_FILTER_BCON_AWARE_MSK)
2133 
2135  __le32 duration; /* measurement duration in extended beacon
2136  * format */
2137  u8 channel; /* channel to measure */
2138  u8 type; /* see enum il_measure_type */
2140 } __packed;
2141 
2142 /*
2143  * C_SPECTRUM_MEASUREMENT = 0x74 (command)
2144  */
2146  __le16 len; /* number of bytes starting from token */
2147  u8 token; /* token id */
2148  u8 id; /* measurement id -- 0 or 1 */
2149  u8 origin; /* 0 = TGh, 1 = other, 2 = TGk */
2150  u8 periodic; /* 1 = periodic */
2152  __le32 start_time; /* start time in extended beacon format */
2154  __le32 flags; /* rxon flags */
2155  __le32 filter_flags; /* rxon filter flags */
2156  __le16 channel_count; /* minimum 1, maximum 10 */
2159 } __packed;
2160 
2161 /*
2162  * C_SPECTRUM_MEASUREMENT = 0x74 (response)
2163  */
2166  u8 id; /* id of the prior command replaced, or 0xff */
2167  __le16 status; /* 0 - command will be handled
2168  * 1 - cannot handle (conflicts with another
2169  * measurement) */
2170 } __packed;
2171 
2175 };
2176 
2182  /* 4-5 reserved */
2186 };
2187 
2188 #define NUM_ELEMENTS_IN_HISTOGRAM 8
2189 
2191  __le32 ofdm[NUM_ELEMENTS_IN_HISTOGRAM]; /* in 0.8usec counts */
2192  __le32 cck[NUM_ELEMENTS_IN_HISTOGRAM]; /* in 1usec counts */
2193 } __packed;
2194 
2195 /* clear channel availability counters */
2199 } __packed;
2200 
2202  IL_MEASURE_BASIC = (1 << 0),
2206  IL_MEASURE_FRAME = (1 << 4),
2207  /* bits 5:6 are reserved */
2208  IL_MEASURE_IDLE = (1 << 7),
2209 };
2210 
2211 /*
2212  * N_SPECTRUM_MEASUREMENT = 0x75 (notification only, not a command)
2213  */
2215  u8 id; /* measurement id -- 0 or 1 */
2217  u8 channel_idx; /* idx in measurement channel list */
2218  u8 state; /* 0 - start, 1 - stop */
2219  __le32 start_time; /* lower 32-bits of TSF */
2220  u8 band; /* 0 - 5.2GHz, 1 - 2.4GHz */
2222  u8 type; /* see enum il_measurement_type */
2224  /* NOTE: cca_ofdm, cca_cck, basic_type, and histogram are only only
2225  * valid if applicable for measurement type requested. */
2226  __le32 cca_ofdm; /* cca fraction time in 40Mhz clock periods */
2227  __le32 cca_cck; /* cca fraction time in 44Mhz clock periods */
2228  __le32 cca_time; /* channel load time in usecs */
2229  u8 basic_type; /* 0 - bss, 1 - ofdm preamble, 2 -
2230  * unidentified */
2233  __le32 stop_time; /* lower 32-bits of TSF */
2234  __le32 status; /* see il_measurement_status */
2235 } __packed;
2236 
2237 /******************************************************************************
2238  * (7)
2239  * Power Management Commands, Responses, Notifications:
2240  *
2241  *****************************************************************************/
2242 
2278 #define IL_POWER_VEC_SIZE 5
2279 
2280 #define IL_POWER_DRIVER_ALLOW_SLEEP_MSK cpu_to_le16(BIT(0))
2281 #define IL_POWER_PCI_PM_MSK cpu_to_le16(BIT(3))
2282 
2289 } __packed;
2290 
2293  u8 keep_alive_seconds; /* 3945 reserved */
2294  u8 debug_flags; /* 3945 reserved */
2299 } __packed;
2300 
2301 /*
2302  * N_PM_SLEEP = 0x7A (notification only, not a command)
2303  * all devices identical.
2304  */
2312 } __packed;
2313 
2314 /* Sleep states. all devices identical. */
2315 enum {
2325  /* 3 reserved */
2327 };
2328 
2329 /*
2330  * N_CARD_STATE = 0xa1 (notification only, not a command)
2331  */
2334 } __packed;
2335 
2336 #define HW_CARD_DISABLED 0x01
2337 #define SW_CARD_DISABLED 0x02
2338 #define CT_CARD_DISABLED 0x04
2339 #define RXON_CARD_DISABLED 0x10
2340 
2345 } __packed;
2346 
2347 /******************************************************************************
2348  * (8)
2349  * Scan Commands, Responses, Notifications:
2350  *
2351  *****************************************************************************/
2352 
2353 #define SCAN_CHANNEL_TYPE_PASSIVE cpu_to_le32(0)
2354 #define SCAN_CHANNEL_TYPE_ACTIVE cpu_to_le32(1)
2355 
2376  /*
2377  * type is defined as:
2378  * 0:0 1 = active, 0 = passive
2379  * 1:4 SSID direct bit map; if a bit is set, then corresponding
2380  * SSID IE is transmitted in probe request.
2381  * 5:7 reserved
2382  */
2384  u8 channel; /* band is selected by il3945_scan_cmd "flags" field */
2386  __le16 active_dwell; /* in 1024-uSec TU (time units), typ 5-50 */
2387  __le16 passive_dwell; /* in 1024-uSec TU (time units), typ 20-500 */
2388 } __packed;
2389 
2390 /* set number of direct probes u8 type */
2391 #define IL39_SCAN_PROBE_MASK(n) ((BIT(n) | (BIT(n) - BIT(1))))
2392 
2394  /*
2395  * type is defined as:
2396  * 0:0 1 = active, 0 = passive
2397  * 1:20 SSID direct bit map; if a bit is set, then corresponding
2398  * SSID IE is transmitted in probe request.
2399  * 21:31 reserved
2400  */
2402  __le16 channel; /* band is selected by il_scan_cmd "flags" field */
2403  u8 tx_gain; /* gain for analog radio */
2404  u8 dsp_atten; /* gain for DSP */
2405  __le16 active_dwell; /* in 1024-uSec TU (time units), typ 5-50 */
2406  __le16 passive_dwell; /* in 1024-uSec TU (time units), typ 20-500 */
2407 } __packed;
2408 
2409 /* set number of direct probes __le32 type */
2410 #define IL_SCAN_PROBE_MASK(n) cpu_to_le32((BIT(n) | (BIT(n) - BIT(1))))
2411 
2420 struct il_ssid_ie {
2423  u8 ssid[32];
2424 } __packed;
2425 
2426 #define PROBE_OPTION_MAX_3945 4
2427 #define PROBE_OPTION_MAX 20
2428 #define TX_CMD_LIFE_TIME_INFINITE cpu_to_le32(0xFFFFFFFF)
2429 #define IL_GOOD_CRC_TH_DISABLED 0
2430 #define IL_GOOD_CRC_TH_DEFAULT cpu_to_le16(1)
2431 #define IL_GOOD_CRC_TH_NEVER cpu_to_le16(0xffff)
2432 #define IL_MAX_SCAN_SIZE 1024
2433 #define IL_MAX_CMD_SIZE 4096
2434 
2435 /*
2436  * C_SCAN = 0x80 (command)
2437  *
2438  * The hardware scan command is very powerful; the driver can set it up to
2439  * maintain (relatively) normal network traffic while doing a scan in the
2440  * background. The max_out_time and suspend_time control the ratio of how
2441  * long the device stays on an associated network channel ("service channel")
2442  * vs. how long it's away from the service channel, i.e. tuned to other channels
2443  * for scanning.
2444  *
2445  * max_out_time is the max time off-channel (in usec), and suspend_time
2446  * is how long (in "extended beacon" format) that the scan is "suspended"
2447  * after returning to the service channel. That is, suspend_time is the
2448  * time that we stay on the service channel, doing normal work, between
2449  * scan segments. The driver may set these parameters differently to support
2450  * scanning when associated vs. not associated, and light vs. heavy traffic
2451  * loads when associated.
2452  *
2453  * After receiving this command, the device's scan engine does the following;
2454  *
2455  * 1) Sends SCAN_START notification to driver
2456  * 2) Checks to see if it has time to do scan for one channel
2457  * 3) Sends NULL packet, with power-save (PS) bit set to 1,
2458  * to tell AP that we're going off-channel
2459  * 4) Tunes to first channel in scan list, does active or passive scan
2460  * 5) Sends SCAN_RESULT notification to driver
2461  * 6) Checks to see if it has time to do scan on *next* channel in list
2462  * 7) Repeats 4-6 until it no longer has time to scan the next channel
2463  * before max_out_time expires
2464  * 8) Returns to service channel
2465  * 9) Sends NULL packet with PS=0 to tell AP that we're back
2466  * 10) Stays on service channel until suspend_time expires
2467  * 11) Repeats entire process 2-10 until list is complete
2468  * 12) Sends SCAN_COMPLETE notification
2469  *
2470  * For fast, efficient scans, the scan command also has support for staying on
2471  * a channel for just a short time, if doing active scanning and getting no
2472  * responses to the transmitted probe request. This time is controlled by
2473  * quiet_time, and the number of received packets below which a channel is
2474  * considered "quiet" is controlled by quiet_plcp_threshold.
2475  *
2476  * For active scanning on channels that have regulatory restrictions against
2477  * blindly transmitting, the scan can listen before transmitting, to make sure
2478  * that there is already legitimate activity on the channel. If enough
2479  * packets are cleanly received on the channel (controlled by good_CRC_th,
2480  * typical value 1), the scan engine starts transmitting probe requests.
2481  *
2482  * Driver must use separate scan commands for 2.4 vs. 5 GHz bands.
2483  *
2484  * To avoid uCode errors, see timing restrictions described under
2485  * struct il_scan_channel.
2486  */
2487 
2491  u8 channel_count; /* # channels in channel list */
2492  __le16 quiet_time; /* dwell only this # millisecs on quiet channel
2493  * (only for active scan) */
2494  __le16 quiet_plcp_th; /* quiet chnl is < this # pkts (typ. 1) */
2495  __le16 good_CRC_th; /* passive -> active promotion threshold */
2497  __le32 max_out_time; /* max usec to be away from associated (service)
2498  * channel */
2499  __le32 suspend_time; /* pause scan this long (in "extended beacon
2500  * format") when returning to service channel:
2501  * 3945; 31:24 # beacons, 19:0 additional usec,
2502  * 4965; 31:22 # beacons, 21:0 additional usec.
2503  */
2504  __le32 flags; /* RXON_FLG_* */
2505  __le32 filter_flags; /* RXON_FILTER_* */
2506 
2507  /* For active scans (set to all-0s for passive scans).
2508  * Does not include payload. Must specify Tx rate; no rate scaling. */
2510 
2511  /* For directed active scans (set to all-0s otherwise) */
2513 
2514  /*
2515  * Probe request frame, followed by channel list.
2516  *
2517  * Size of probe request frame is specified by byte count in tx_cmd.
2518  * Channel list follows immediately after probe request frame.
2519  * Number of channels in list is specified by channel_count.
2520  * Each channel in list is of type:
2521  *
2522  * struct il3945_scan_channel channels[0];
2523  *
2524  * NOTE: Only one band of channels can be scanned per pass. You
2525  * must not mix 2.4GHz channels and 5.2GHz channels, and you must wait
2526  * for one scan to complete (i.e. receive N_SCAN_COMPLETE)
2527  * before requesting another scan.
2528  */
2529  u8 data[0];
2530 } __packed;
2531 
2532 struct il_scan_cmd {
2535  u8 channel_count; /* # channels in channel list */
2536  __le16 quiet_time; /* dwell only this # millisecs on quiet channel
2537  * (only for active scan) */
2538  __le16 quiet_plcp_th; /* quiet chnl is < this # pkts (typ. 1) */
2539  __le16 good_CRC_th; /* passive -> active promotion threshold */
2540  __le16 rx_chain; /* RXON_RX_CHAIN_* */
2541  __le32 max_out_time; /* max usec to be away from associated (service)
2542  * channel */
2543  __le32 suspend_time; /* pause scan this long (in "extended beacon
2544  * format") when returning to service chnl:
2545  * 3945; 31:24 # beacons, 19:0 additional usec,
2546  * 4965; 31:22 # beacons, 21:0 additional usec.
2547  */
2548  __le32 flags; /* RXON_FLG_* */
2549  __le32 filter_flags; /* RXON_FILTER_* */
2550 
2551  /* For active scans (set to all-0s for passive scans).
2552  * Does not include payload. Must specify Tx rate; no rate scaling. */
2554 
2555  /* For directed active scans (set to all-0s otherwise) */
2557 
2558  /*
2559  * Probe request frame, followed by channel list.
2560  *
2561  * Size of probe request frame is specified by byte count in tx_cmd.
2562  * Channel list follows immediately after probe request frame.
2563  * Number of channels in list is specified by channel_count.
2564  * Each channel in list is of type:
2565  *
2566  * struct il_scan_channel channels[0];
2567  *
2568  * NOTE: Only one band of channels can be scanned per pass. You
2569  * must not mix 2.4GHz channels and 5.2GHz channels, and you must wait
2570  * for one scan to complete (i.e. receive N_SCAN_COMPLETE)
2571  * before requesting another scan.
2572  */
2573  u8 data[0];
2574 } __packed;
2575 
2576 /* Can abort will notify by complete notification with abort status. */
2577 #define CAN_ABORT_STATUS cpu_to_le32(0x1)
2578 /* complete notification statuses */
2579 #define ABORT_STATUS 0x2
2580 
2581 /*
2582  * C_SCAN = 0x80 (response)
2583  */
2585  __le32 status; /* 1: okay, 2: cannot fulfill request */
2586 } __packed;
2587 
2588 /*
2589  * N_SCAN_START = 0x82 (notification only, not a command)
2590  */
2599 } __packed;
2600 
2601 #define SCAN_OWNER_STATUS 0x1
2602 #define MEASURE_OWNER_STATUS 0x2
2603 
2604 #define IL_PROBE_STATUS_OK 0
2605 #define IL_PROBE_STATUS_TX_FAILED BIT(0)
2606 /* error statuses combined with TX_FAILED */
2607 #define IL_PROBE_STATUS_FAIL_TTL BIT(1)
2608 #define IL_PROBE_STATUS_FAIL_BT BIT(2)
2609 
2610 #define NUMBER_OF_STATS 1 /* first __le32 is good CRC */
2611 /*
2612  * N_SCAN_RESULTS = 0x83 (notification only, not a command)
2613  */
2618  u8 num_probe_not_sent; /* not enough time to send */
2622 } __packed;
2623 
2624 /*
2625  * N_SCAN_COMPLETE = 0x84 (notification only, not a command)
2626  */
2633 } __packed;
2634 
2635 /******************************************************************************
2636  * (9)
2637  * IBSS/AP Commands and Notifications:
2638  *
2639  *****************************************************************************/
2640 
2644 };
2645 
2646 /*
2647  * N_BEACON = 0x90 (notification only, not a command)
2648  */
2649 
2655 } __packed;
2656 
2662 } __packed;
2663 
2664 /*
2665  * C_TX_BEACON= 0x91 (command, has simple generic response)
2666  */
2667 
2673  struct ieee80211_hdr frame[0]; /* beacon frame */
2674 } __packed;
2675 
2677  struct il_tx_cmd tx;
2681  struct ieee80211_hdr frame[0]; /* beacon frame */
2682 } __packed;
2683 
2684 /******************************************************************************
2685  * (10)
2686  * Statistics Commands and Notifications:
2687  *
2688  *****************************************************************************/
2689 
2690 #define IL_TEMP_CONVERT 260
2691 
2692 #define SUP_RATE_11A_MAX_NUM_CHANNELS 8
2693 #define SUP_RATE_11B_MAX_NUM_CHANNELS 4
2694 #define SUP_RATE_11G_MAX_NUM_CHANNELS 12
2695 
2696 /* Used for passing to driver number of successes and failures per rate */
2697 struct rate_histogram {
2698  union {
2702  } success;
2703  union {
2707  } failed;
2708 } __packed;
2709 
2710 /* stats command response */
2711 
2728 } __packed;
2729 
2731  __le32 bogus_cts; /* CTS received when not expecting CTS */
2732  __le32 bogus_ack; /* ACK received when not expecting ACK */
2733  __le32 non_bssid_frames; /* number of frames with BSSID that
2734  * doesn't belong to the STA BSSID */
2735  __le32 filtered_frames; /* count frames that were dumped in the
2736  * filtering process */
2737  __le32 non_channel_beacons; /* beacons with our bss id but not on
2738  * our serving channel */
2739 } __packed;
2740 
2745 } __packed;
2746 
2757 } __packed;
2758 
2759 struct stats_dbg {
2764 } __packed;
2765 
2771 } __packed;
2772 
2775  struct stats_dbg dbg;
2781 } __packed;
2782 
2804 } __packed;
2805 
2817 } __packed;
2818 
2819 #define INTERFERENCE_DATA_AVAILABLE cpu_to_le32(1)
2820 
2822  __le32 bogus_cts; /* CTS received when not expecting CTS */
2823  __le32 bogus_ack; /* ACK received when not expecting ACK */
2824  __le32 non_bssid_frames; /* number of frames with BSSID that
2825  * doesn't belong to the STA BSSID */
2826  __le32 filtered_frames; /* count frames that were dumped in the
2827  * filtering process */
2828  __le32 non_channel_beacons; /* beacons with our bss id but not on
2829  * our serving channel */
2830  __le32 channel_beacons; /* beacons with our bss id and in our
2831  * serving channel */
2832  __le32 num_missed_bcon; /* number of missed beacons */
2833  __le32 adc_rx_saturation_time; /* count in 0.8us units the time the
2834  * ADC was in saturation */
2835  __le32 ina_detection_search_time; /* total time (in 0.8us) searched
2836  * for INA */
2837  __le32 beacon_silence_rssi_a; /* RSSI silence after beacon frame */
2838  __le32 beacon_silence_rssi_b; /* RSSI silence after beacon frame */
2839  __le32 beacon_silence_rssi_c; /* RSSI silence after beacon frame */
2840  __le32 interference_data_flag; /* flag for interference data
2841  * availability. 1 when data is
2842  * available. */
2843  __le32 channel_load; /* counts RX Enable time in uSec */
2844  __le32 dsp_false_alarms; /* DSP false alarm (both OFDM
2845  * and CCK) counter */
2852 } __packed;
2853 
2854 struct stats_rx {
2859 } __packed;
2860 
2873 } __packed;
2874 
2886 } __packed;
2887 
2888 struct stats_tx {
2904 
2906 } __packed;
2907 
2908 struct stats_div {
2915 } __packed;
2916 
2918  __le32 temperature; /* radio temperature */
2919  struct stats_dbg dbg;
2924  struct stats_div div;
2926  /*
2927  * num_of_sos_states:
2928  * count the number of times we have to re-tune
2929  * in order to get out of bad PHY status
2930  */
2932 } __packed;
2933 
2938 } __packed;
2939 
2940 #define UCODE_STATS_CLEAR_MSK (0x1 << 0)
2941 #define UCODE_STATS_FREQUENCY_MSK (0x1 << 1)
2942 #define UCODE_STATS_NARROW_BAND_MSK (0x1 << 2)
2943 
2944 /*
2945  * C_STATS = 0x9c,
2946  * all devices identical.
2947  *
2948  * This command triggers an immediate response containing uCode stats.
2949  * The response is in the same format as N_STATS 0x9d, below.
2950  *
2951  * If the CLEAR_STATS configuration flag is set, uCode will clear its
2952  * internal copy of the stats (counters) after issuing the response.
2953  * This flag does not affect N_STATSs after beacons (see below).
2954  *
2955  * If the DISABLE_NOTIF configuration flag is set, uCode will not issue
2956  * N_STATSs after received beacons (see below). This flag
2957  * does not affect the response to the C_STATS 0x9c itself.
2958  */
2959 #define IL_STATS_CONF_CLEAR_STATS cpu_to_le32(0x1) /* see above */
2960 #define IL_STATS_CONF_DISABLE_NOTIF cpu_to_le32(0x2) /* see above */
2962  __le32 configuration_flags; /* IL_STATS_CONF_* */
2963 } __packed;
2964 
2965 /*
2966  * N_STATS = 0x9d (notification only, not a command)
2967  *
2968  * By default, uCode issues this notification after receiving a beacon
2969  * while associated. To disable this behavior, set DISABLE_NOTIF flag in the
2970  * C_STATS 0x9c, above.
2971  *
2972  * Statistics counters continue to increment beacon after beacon, but are
2973  * cleared when changing channels or when driver issues C_STATS
2974  * 0x9c with CLEAR_STATS bit set (see above).
2975  *
2976  * uCode also issues this notification during scans. uCode clears stats
2977  * appropriately so that each notification contains stats for only the
2978  * one channel that has just been scanned.
2979  */
2980 #define STATS_REPLY_FLG_BAND_24G_MSK cpu_to_le32(0x2)
2981 #define STATS_REPLY_FLG_HT40_MODE_MSK cpu_to_le32(0x8)
2982 
2988 } __packed;
2989 
2992  struct stats_rx rx;
2993  struct stats_tx tx;
2995 } __packed;
2996 
2997 /*
2998  * N_MISSED_BEACONS = 0xa2 (notification only, not a command)
2999  *
3000  * uCode send N_MISSED_BEACONS to driver when detect beacon missed
3001  * in regardless of how many missed beacons, which mean when driver receive the
3002  * notification, inside the command, it can find all the beacons information
3003  * which include number of total missed beacons, number of consecutive missed
3004  * beacons, number of beacons received and number of beacons expected to
3005  * receive.
3006  *
3007  * If uCode detected consecutive_missed_beacons > 5, it will reset the radio
3008  * in order to bring the radio/PHY back to working state; which has no relation
3009  * to when driver will perform sensitivity calibration.
3010  *
3011  * Driver should set it own missed_beacon_threshold to decide when to perform
3012  * sensitivity calibration based on number of consecutive missed beacons in
3013  * order to improve overall performance, especially in noisy environment.
3014  *
3015  */
3016 
3017 #define IL_MISSED_BEACON_THRESHOLD_MIN (1)
3018 #define IL_MISSED_BEACON_THRESHOLD_DEF (5)
3019 #define IL_MISSED_BEACON_THRESHOLD_MAX IL_MISSED_BEACON_THRESHOLD_DEF
3020 
3026 } __packed;
3027 
3028 /******************************************************************************
3029  * (11)
3030  * Rx Calibration Commands:
3031  *
3032  * With the uCode used for open source drivers, most Tx calibration (except
3033  * for Tx Power) and most Rx calibration is done by uCode during the
3034  * "initialize" phase of uCode boot. Driver must calibrate only:
3035  *
3036  * 1) Tx power (depends on temperature), described elsewhere
3037  * 2) Receiver gain balance (optimize MIMO, and detect disconnected antennas)
3038  * 3) Receiver sensitivity (to optimize signal detection)
3039  *
3040  *****************************************************************************/
3041 
3197 /*
3198  * Table entries in C_SENSITIVITY (struct il_sensitivity_cmd)
3199  */
3200 #define HD_TBL_SIZE (11) /* number of entries */
3201 #define HD_MIN_ENERGY_CCK_DET_IDX (0) /* table idxes */
3202 #define HD_MIN_ENERGY_OFDM_DET_IDX (1)
3203 #define HD_AUTO_CORR32_X1_TH_ADD_MIN_IDX (2)
3204 #define HD_AUTO_CORR32_X1_TH_ADD_MIN_MRC_IDX (3)
3205 #define HD_AUTO_CORR40_X4_TH_ADD_MIN_MRC_IDX (4)
3206 #define HD_AUTO_CORR32_X4_TH_ADD_MIN_IDX (5)
3207 #define HD_AUTO_CORR32_X4_TH_ADD_MIN_MRC_IDX (6)
3208 #define HD_BARKER_CORR_TH_ADD_MIN_IDX (7)
3209 #define HD_BARKER_CORR_TH_ADD_MIN_MRC_IDX (8)
3210 #define HD_AUTO_CORR40_X4_TH_ADD_MIN_IDX (9)
3211 #define HD_OFDM_ENERGY_TH_IN_IDX (10)
3212 
3213 /* Control field in struct il_sensitivity_cmd */
3214 #define C_SENSITIVITY_CONTROL_DEFAULT_TBL cpu_to_le16(0)
3215 #define C_SENSITIVITY_CONTROL_WORK_TBL cpu_to_le16(1)
3216 
3225  __le16 control; /* always use "1" */
3226  __le16 table[HD_TBL_SIZE]; /* use HD_* as idx */
3227 } __packed;
3228 
3284 /* Phy calibration command for series */
3285 /* The default calibrate table size if not specified by firmware */
3286 #define IL_DEFAULT_STANDARD_PHY_CALIBRATE_TBL_SIZE 18
3287 enum {
3290 };
3291 
3292 #define IL_MAX_PHY_CALIBRATE_TBL_SIZE (253)
3293 
3299 } __packed;
3300 
3301 /* IL_PHY_CALIBRATE_DIFF_GAIN_CMD (7) */
3304  s8 diff_gain_a; /* see above */
3308 } __packed;
3309 
3310 /******************************************************************************
3311  * (12)
3312  * Miscellaneous Commands:
3313  *
3314  *****************************************************************************/
3315 
3316 /*
3317  * LEDs Command & Response
3318  * C_LEDS = 0x48 (command, has simple generic response)
3319  *
3320  * For each of 3 possible LEDs (Activity/Link/Tech, selected by "id" field),
3321  * this command turns it on or off, or sets up a periodic blinking cycle.
3322  */
3323 struct il_led_cmd {
3324  __le32 interval; /* "interval" in uSec */
3325  u8 id; /* 1: Activity, 2: Link, 3: Tech */
3326  u8 off; /* # intervals off while blinking;
3327  * "0", with >0 "on" value, turns LED on */
3328  u8 on; /* # intervals on while blinking;
3329  * "0", regardless of "off", turns LED off */
3331 } __packed;
3332 
3333 /******************************************************************************
3334  * (13)
3335  * Union of all expected notifications/responses:
3336  *
3337  *****************************************************************************/
3338 
3339 #define IL_RX_FRAME_SIZE_MSK 0x00003fff
3340 
3341 struct il_rx_pkt {
3342  /*
3343  * The first 4 bytes of the RX frame header contain both the RX frame
3344  * size and some flags.
3345  * Bit fields:
3346  * 31: flag flush RB request
3347  * 30: flag ignore TC (terminal counter) request
3348  * 29: flag fast IRQ request
3349  * 28-14: Reserved
3350  * 13-00: RX frame size
3351  */
3354  union {
3358 
3372  u8 raw[0];
3373  } u;
3374 } __packed;
3375 
3376 #endif /* __il_commands_h__ */