if_wireg.h revision 98720
1/*
2 * Copyright (c) 1997, 1998, 1999
3 *	Bill Paul <wpaul@ctr.columbia.edu>.  All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 *    notice, this list of conditions and the following disclaimer in the
12 *    documentation and/or other materials provided with the distribution.
13 * 3. All advertising materials mentioning features or use of this software
14 *    must display the following acknowledgement:
15 *	This product includes software developed by Bill Paul.
16 * 4. Neither the name of the author nor the names of any co-contributors
17 *    may be used to endorse or promote products derived from this software
18 *    without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
24 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
30 * THE POSSIBILITY OF SUCH DAMAGE.
31 *
32 * $FreeBSD: head/sys/dev/wi/if_wireg.h 98720 2002-06-24 04:42:46Z imp $
33 */
34
35#define WI_DELAY	5
36#define WI_TIMEOUT	(500000/WI_DELAY)	/* 500 ms */
37
38#define WI_PORT0	0
39#define WI_PORT1	1
40#define WI_PORT2	2
41#define WI_PORT3	3
42#define WI_PORT4	4
43#define WI_PORT5	5
44
45#define WI_PCI_LMEMRES	0x10	/* PCI Memory (native PCI implementations) */
46#define WI_PCI_LOCALRES	0x14	/* The PLX chip's local registers */
47#define WI_PCI_MEMRES	0x18	/* The PCCard's attribute memory */
48#define WI_PCI_IORES	0x1C	/* The PCCard's I/O space */
49
50#define WI_LOCAL_INTCSR		0x4c
51#define WI_LOCAL_INTEN		0x40
52#define WI_HFA384X_SWSUPPORT0_OFF	0x28
53#define WI_PRISM2STA_MAGIC		0x4A2D
54#define WI_HFA384X_PCICOR_OFF		0x26
55
56/* Default port: 0 (only 0 exists on stations) */
57#define WI_DEFAULT_PORT	(WI_PORT0 << 8)
58
59/* Default TX rate: 2Mbps, auto fallback */
60#define WI_DEFAULT_TX_RATE	3
61
62/* Default network name: ANY */
63/*
64 * [sommerfeld 1999/07/15] Changed from "ANY" to ""; according to Bill Fenner,
65 * ANY is used in MS driver user interfaces, while "" is used over the
66 * wire..
67 */
68#define WI_DEFAULT_NETNAME	""
69
70#define WI_DEFAULT_AP_DENSITY	1
71
72#define WI_DEFAULT_RTS_THRESH	2347
73
74#define WI_DEFAULT_DATALEN	2304
75
76#define WI_DEFAULT_CREATE_IBSS	0
77
78#define WI_DEFAULT_PM_ENABLED	0
79
80#define WI_DEFAULT_MAX_SLEEP	100
81
82#define WI_DEFAULT_ROAMING	1
83
84#define WI_DEFAULT_AUTHTYPE	1
85
86#ifdef __NetBSD__
87#define OS_STRING_NAME	"NetBSD"
88#endif
89#ifdef __FreeBSD__
90#define OS_STRING_NAME	"FreeBSD"
91#endif
92#ifdef __OpenBSD__
93#define OS_STRING_NAME	"OpenBSD"
94#endif
95
96#define WI_DEFAULT_NODENAME	OS_STRING_NAME " WaveLAN/IEEE node"
97
98#define WI_DEFAULT_IBSS		OS_STRING_NAME " IBSS"
99
100#define WI_DEFAULT_CHAN		3
101
102#define WI_BUS_PCCARD		0	/* pccard device */
103#define WI_BUS_PCI_PLX		1	/* PCI card w/ PLX PCI/PCMICA bridge */
104#define WI_BUS_PCI_NATIVE	2	/* native PCI device (Prism 2.5) */
105
106/*
107 * register space access macros
108 */
109#define CSR_WRITE_4(sc, reg, val)				\
110	bus_space_write_4((sc)->wi_btag, (sc)->wi_bhandle, 	\
111	    (sc)->wi_bus_type == WI_BUS_PCI_NATIVE ? (reg)*2 : (reg), val)
112#define CSR_WRITE_2(sc, reg, val)				\
113	bus_space_write_2((sc)->wi_btag, (sc)->wi_bhandle,	\
114 	    (sc)->wi_bus_type == WI_BUS_PCI_NATIVE ? (reg)*2 : (reg), val)
115#define CSR_WRITE_1(sc, reg, val)				\
116	bus_space_write_1((sc)->wi_btag, (sc)->wi_bhandle,	\
117 	    (sc)->wi_bus_type == WI_BUS_PCI_NATIVE ? (reg)*2 : (reg), val)
118
119#define CSR_READ_4(sc, reg)					\
120	bus_space_read_4((sc)->wi_btag, (sc)->wi_bhandle,	\
121 	    (sc)->wi_bus_type == WI_BUS_PCI_NATIVE ? (reg)*2 : (reg))
122#define CSR_READ_2(sc, reg)					\
123	bus_space_read_2((sc)->wi_btag, (sc)->wi_bhandle,	\
124 	    (sc)->wi_bus_type == WI_BUS_PCI_NATIVE ? (reg)*2 : (reg))
125#define CSR_READ_1(sc, reg)					\
126	bus_space_read_1((sc)->wi_btag, (sc)->wi_bhandle,	\
127 	    (sc)->wi_bus_type == WI_BUS_PCI_NATIVE ? (reg)*2 : (reg))
128
129#define CSM_WRITE_1(sc, off, val)	\
130	bus_space_write_1((sc)->wi_bmemtag, (sc)->wi_bmemhandle, off, val)
131
132#define CSM_READ_1(sc, off)		\
133	bus_space_read_1((sc)->wi_bmemtag, (sc)->wi_bmemhandle, off)
134
135/*
136 * The WaveLAN/IEEE cards contain an 802.11 MAC controller which Lucent
137 * calls 'Hermes.' In typical fashion, getting documentation about this
138 * controller is about as easy as squeezing blood from a stone. Here
139 * is more or less what I know:
140 *
141 * - The Hermes controller is firmware driven, and the host interacts
142 *   with the Hermes via a firmware interface, which can change.
143 *
144 * - The Hermes is described in a document called: "Hermes Firmware
145 *   WaveLAN/IEEE Station Functions," document #010245, which of course
146 *   Lucent will not release without an NDA.
147 *
148 * - Lucent has created a library called HCF (Hardware Control Functions)
149 *   though which it wants developers to interact with the card. The HCF
150 *   is needlessly complex, ill conceived and badly documented. Actually,
151 *   the comments in the HCP code itself aren't bad, but the publically
152 *   available manual that comes with it is awful, probably due largely to
153 *   the fact that it has been emasculated in order to hide information
154 *   that Lucent wants to keep proprietary. The purpose of the HCF seems
155 *   to be to insulate the driver programmer from the Hermes itself so that
156 *   Lucent has an excuse not to release programming in for it.
157 *
158 * - Lucent only makes available documentation and code for 'HCF Light'
159 *   which is a stripped down version of HCF with certain features not
160 *   implemented, most notably support for 802.11 frames.
161 *
162 * - The HCF code which I have seen blows goats. Whoever decided to
163 *   use a 132 column format should be shot.
164 *
165 * Rather than actually use the Lucent HCF library, I have stripped all
166 * the useful information from it and used it to create a driver in the
167 * usual BSD form. Note: I don't want to hear anybody whining about the
168 * fact that the Lucent code is GPLed and mine isn't. I did not actually
169 * put any of Lucent's code in this driver: I only used it as a reference
170 * to obtain information about the underlying hardware. The Hermes
171 * programming interface is not GPLed, so bite me.
172 */
173
174/*
175 * Size of Hermes & Prism2 I/O space.
176 */
177#define WI_IOSIZ		0x40
178
179/*
180 * Hermes & Prism2 register definitions
181 */
182
183/* Hermes command/status registers. */
184#define WI_COMMAND		0x00
185#define WI_PARAM0		0x02
186#define WI_PARAM1		0x04
187#define WI_PARAM2		0x06
188#define WI_STATUS		0x08
189#define WI_RESP0		0x0A
190#define WI_RESP1		0x0C
191#define WI_RESP2		0x0E
192
193/* Command register values. */
194#define WI_CMD_BUSY		0x8000 /* busy bit */
195#define WI_CMD_INI		0x0000 /* initialize */
196#define WI_CMD_ENABLE		0x0001 /* enable */
197#define WI_CMD_DISABLE		0x0002 /* disable */
198#define WI_CMD_DIAG		0x0003
199#define WI_CMD_ALLOC_MEM	0x000A /* allocate NIC memory */
200#define WI_CMD_TX		0x000B /* transmit */
201#define WI_CMD_NOTIFY		0x0010
202#define WI_CMD_INQUIRE		0x0011
203#define WI_CMD_ACCESS		0x0021
204#define WI_CMD_PROGRAM		0x0022
205
206#define WI_CMD_CODE_MASK	0x003F
207
208/*
209 * Reclaim qualifier bit, applicable to the
210 * TX and INQUIRE commands.
211 */
212#define WI_RECLAIM		0x0100 /* reclaim NIC memory */
213
214/*
215 * ACCESS command qualifier bits.
216 */
217#define WI_ACCESS_READ		0x0000
218#define WI_ACCESS_WRITE		0x0100
219
220/*
221 * PROGRAM command qualifier bits.
222 */
223#define WI_PROGRAM_DISABLE	0x0000
224#define WI_PROGRAM_ENABLE_RAM	0x0100
225#define WI_PROGRAM_ENABLE_NVRAM	0x0200
226#define WI_PROGRAM_NVRAM	0x0300
227
228/* Status register values */
229#define WI_STAT_CMD_CODE	0x003F
230#define WI_STAT_DIAG_ERR	0x0100
231#define WI_STAT_INQ_ERR		0x0500
232#define WI_STAT_CMD_RESULT	0x7F00
233
234/* memory handle management registers */
235#define WI_INFO_FID		0x10
236#define WI_RX_FID		0x20
237#define WI_ALLOC_FID		0x22
238#define WI_TX_CMP_FID		0x24
239
240/*
241 * Buffer Access Path (BAP) registers.
242 * These are I/O channels. I believe you can use each one for
243 * any desired purpose independently of the other. In general
244 * though, we use BAP1 for reading and writing LTV records and
245 * reading received data frames, and BAP0 for writing transmit
246 * frames. This is a convention though, not a rule.
247 */
248#define WI_SEL0			0x18
249#define WI_SEL1			0x1A
250#define WI_OFF0			0x1C
251#define WI_OFF1			0x1E
252#define WI_DATA0		0x36
253#define WI_DATA1		0x38
254#define WI_BAP0			WI_DATA0
255#define WI_BAP1			WI_DATA1
256
257#define WI_OFF_BUSY		0x8000
258#define WI_OFF_ERR		0x4000
259#define WI_OFF_DATAOFF		0x0FFF
260
261/* Event registers */
262#define WI_EVENT_STAT		0x30	/* Event status */
263#define WI_INT_EN		0x32	/* Interrupt enable/disable */
264#define WI_EVENT_ACK		0x34	/* Ack event */
265
266/* Events */
267#define WI_EV_TICK		0x8000	/* aux timer tick */
268#define WI_EV_RES		0x4000	/* controller h/w error (time out) */
269#define WI_EV_INFO_DROP		0x2000	/* no RAM to build unsolicited frame */
270#define WI_EV_NO_CARD		0x0800	/* card removed (hunh?) */
271#define WI_EV_DUIF_RX		0x0400	/* wavelan management packet received */
272#define WI_EV_INFO		0x0080	/* async info frame */
273#define WI_EV_CMD		0x0010	/* command completed */
274#define WI_EV_ALLOC		0x0008	/* async alloc/reclaim completed */
275#define WI_EV_TX_EXC		0x0004	/* async xmit completed with failure */
276#define WI_EV_TX		0x0002	/* async xmit completed succesfully */
277#define WI_EV_RX		0x0001	/* async rx completed */
278
279#define WI_INTRS	\
280	(WI_EV_RX|WI_EV_TX|WI_EV_TX_EXC|WI_EV_ALLOC|WI_EV_INFO|WI_EV_INFO_DROP)
281
282/* Host software registers */
283#define WI_SW0			0x28
284#define WI_SW1			0x2A
285#define WI_SW2			0x2C
286#define WI_SW3			0x2E 	/* does not appear in Prism2 */
287
288#define WI_CNTL			0x14
289
290#define WI_CNTL_AUX_ENA		0xC000
291#define WI_CNTL_AUX_ENA_STAT	0xC000
292#define WI_CNTL_AUX_DIS_STAT	0x0000
293#define WI_CNTL_AUX_ENA_CNTL	0x8000
294#define WI_CNTL_AUX_DIS_CNTL	0x4000
295
296#define WI_AUX_PAGE		0x3A
297#define WI_AUX_OFFSET		0x3C
298#define WI_AUX_DATA		0x3E
299
300#define WI_COR_OFFSET	0x3e0
301#define WI_COR_VALUE	0x41
302
303/*
304 * One form of communication with the Hermes is with what Lucent calls
305 * LTV records, where LTV stands for Length, Type and Value. The length
306 * and type are 16 bits and are in native byte order. The value is in
307 * multiples of 16 bits and is in little endian byte order.
308 */
309struct wi_ltv_gen {
310	u_int16_t		wi_len;
311	u_int16_t		wi_type;
312	u_int16_t		wi_val;
313};
314
315struct wi_ltv_str {
316	u_int16_t		wi_len;
317	u_int16_t		wi_type;
318	u_int16_t		wi_str[17];
319};
320
321#define WI_SETVAL(recno, val)			\
322	do {					\
323		struct wi_ltv_gen	g;	\
324						\
325		g.wi_len = 2;			\
326		g.wi_type = recno;		\
327		g.wi_val = htole16(val);	\
328		wi_write_record(sc, &g);	\
329	} while (0)
330
331#define WI_SETSTR(recno, str)					\
332	do {							\
333		struct wi_ltv_str	s;			\
334		int			l;			\
335								\
336		l = (strlen(str) + 1) & ~0x1;			\
337		bzero((char *)&s, sizeof(s));			\
338		s.wi_len = (l / 2) + 2;				\
339		s.wi_type = recno;				\
340		s.wi_str[0] = htole16(strlen(str));		\
341		bcopy(str, (char *)&s.wi_str[1], strlen(str));	\
342		wi_write_record(sc, (struct wi_ltv_gen *)&s);	\
343	} while (0)
344
345/*
346 * Download buffer location and length (0xFD01).
347 */
348struct wi_ltv_dnld_buf {
349	u_int16_t		wi_len;
350	u_int16_t		wi_type;
351	u_int16_t		wi_buf_pg; /* page addr of intermediate dl buf*/
352	u_int16_t		wi_buf_off; /* offset of idb */
353	u_int16_t		wi_buf_len; /* len of idb */
354};
355
356/*
357 * Mem sizes (0xFD02).
358 */
359struct wi_ltv_memsz {
360	u_int16_t		wi_len;
361	u_int16_t		wi_type;
362	u_int16_t		wi_mem_ram;
363	u_int16_t		wi_mem_nvram;
364};
365
366/*
367 * NIC Identification (0xFD0B, 0xFD20)
368 */
369struct wi_ltv_ver {
370	u_int16_t		wi_len;
371	u_int16_t		wi_type;
372	u_int16_t		wi_ver[4];
373};
374
375/* define card ident */
376#define	WI_NIC_LUCENT_ID	0x0001
377#define	WI_NIC_LUCENT_STR	"Lucent Technologies, WaveLAN/IEEE"
378
379#define	WI_NIC_SONY_ID		0x0002
380#define	WI_NIC_SONY_STR		"Sony WaveLAN/IEEE"
381
382#define	WI_NIC_LUCENT_EMB_ID	0x0005
383#define	WI_NIC_LUCENT_EMB_STR	"Lucent Embedded WaveLAN/IEEE"
384
385#define	WI_NIC_EVB2_ID		0x8000
386#define	WI_NIC_EVB2_STR		"RF:PRISM2 MAC:HFA3841"
387
388#define	WI_NIC_HWB3763_ID	0x8001
389#define	WI_NIC_HWB3763_STR	"RF:PRISM2 MAC:HFA3841 CARD:HWB3763 rev.B"
390
391#define	WI_NIC_HWB3163_ID	0x8002
392#define	WI_NIC_HWB3163_STR	"RF:PRISM2 MAC:HFA3841 CARD:HWB3163 rev.A"
393
394#define	WI_NIC_HWB3163B_ID	0x8003
395#define	WI_NIC_HWB3163B_STR	"RF:PRISM2 MAC:HFA3841 CARD:HWB3163 rev.B"
396
397#define	WI_NIC_EVB3_ID		0x8004
398#define	WI_NIC_EVB3_STR		"RF:PRISM2 MAC:HFA3842 CARD:HFA3842 EVAL"
399
400#define	WI_NIC_HWB1153_ID	0x8007
401#define	WI_NIC_HWB1153_STR	"RF:PRISM1 MAC:HFA3841 CARD:HWB1153"
402
403#define	WI_NIC_P2_SST_ID	0x8008	/* Prism2 with SST flush */
404#define	WI_NIC_P2_SST_STR	"RF:PRISM2 MAC:HFA3841 CARD:HWB3163-SST-flash"
405
406#define	WI_NIC_EVB2_SST_ID	0x8009
407#define	WI_NIC_EVB2_SST_STR	"RF:PRISM2 MAC:HFA3841 CARD:HWB3163-SST-flash"
408
409#define	WI_NIC_3842_EVA_ID	0x800A	/* 3842 Evaluation Board */
410#define	WI_NIC_3842_EVA_STR	"RF:PRISM2 MAC:HFA3842 CARD:HFA3842 EVAL"
411
412#define	WI_NIC_3842_PCMCIA_AMD_ID	0x800B	/* Prism2.5 PCMCIA */
413#define	WI_NIC_3842_PCMCIA_SST_ID	0x800C
414#define	WI_NIC_3842_PCMCIA_ATM_ID	0x800D
415#define	WI_NIC_3842_PCMCIA_STR		"RF:PRISM2.5 MAC:ISL3873"
416
417#define	WI_NIC_3842_MINI_AMD_ID		0x8012	/* Prism2.5 Mini-PCI */
418#define	WI_NIC_3842_MINI_SST_ID		0x8013
419#define	WI_NIC_3842_MINI_ATM_ID		0x8014
420#define	WI_NIC_3842_MINI_STR		"RF:PRISM2.5 MAC:ISL3874A(Mini-PCI)"
421
422#define	WI_NIC_3842_PCI_AMD_ID		0x8016	/* Prism2.5 PCI-bridge */
423#define	WI_NIC_3842_PCI_SST_ID		0x8017
424#define	WI_NIC_3842_PCI_ATM_ID		0x8018
425#define	WI_NIC_3842_PCI_STR		"RF:PRISM2.5 MAC:ISL3874A(PCI-bridge)"
426
427#define	WI_NIC_P3_PCMCIA_AMD_ID		0x801A	/* Prism3 PCMCIA */
428#define	WI_NIC_P3_PCMCIA_SST_ID		0x801B
429#define	WI_NIC_P3_PCMCIA_STR		"RF:PRISM3(PCMCIA)"
430
431#define	WI_NIC_P3_MINI_AMD_ID		0x8021	/* Prism3 Mini-PCI */
432#define	WI_NIC_P3_MINI_SST_ID		0x8022
433#define	WI_NIC_P3_MINI_STR		"RF:PRISM3(Mini-PCI)"
434
435/*
436 * List of intended regulatory domains (0xFD11).
437 */
438struct wi_ltv_domains {
439	u_int16_t		wi_len;
440	u_int16_t		wi_type;
441	u_int16_t		wi_domains[6];
442};
443
444/*
445 * CIS struct (0xFD13).
446 */
447struct wi_ltv_cis {
448	u_int16_t		wi_len;
449	u_int16_t		wi_type;
450	u_int16_t		wi_cis[240];
451};
452
453/*
454 * Communications quality (0xFD43).
455 */
456struct wi_ltv_commqual {
457	u_int16_t		wi_len;
458	u_int16_t		wi_type;
459	u_int16_t		wi_coms_qual;
460	u_int16_t		wi_sig_lvl;
461	u_int16_t		wi_noise_lvl;
462};
463
464/*
465 * Actual system scale thresholds (0xFC06, 0xFD46).
466 */
467struct wi_ltv_scalethresh {
468	u_int16_t		wi_len;
469	u_int16_t		wi_type;
470	u_int16_t		wi_energy_detect;
471	u_int16_t		wi_carrier_detect;
472	u_int16_t		wi_defer;
473	u_int16_t		wi_cell_search;
474	u_int16_t		wi_out_of_range;
475	u_int16_t		wi_delta_snr;
476};
477
478/*
479 * PCF info struct (0xFD87).
480 */
481struct wi_ltv_pcf {
482	u_int16_t		wi_len;
483	u_int16_t		wi_type;
484	u_int16_t		wi_energy_detect;
485	u_int16_t		wi_carrier_detect;
486	u_int16_t		wi_defer;
487	u_int16_t		wi_cell_search;
488	u_int16_t		wi_range;
489};
490
491/*
492 * Connection control characteristics. (0xFC00)
493 * 0 == IBSS (802.11 compliant mode) (Only PRISM2)
494 * 1 == Basic Service Set (BSS)
495 * 2 == Wireless Distribudion System (WDS)
496 * 3 == Pseudo IBSS
497 *	(Only PRISM2; not 802.11 compliant mode, testing use only)
498 * 6 == HOST AP (Only PRISM2)
499 */
500#define WI_PORTTYPE_BSS		0x1
501#define WI_PORTTYPE_WDS		0x2
502#define WI_PORTTYPE_ADHOC	0x3
503#define WI_PORTTYPE_IBSS	0x4
504#define WI_PORTTYPE_AP		0x6
505
506/*
507 * Mac addresses. (0xFC01, 0xFC08)
508 */
509struct wi_ltv_macaddr {
510	u_int16_t		wi_len;
511	u_int16_t		wi_type;
512	u_int16_t		wi_mac_addr[3];
513};
514
515/*
516 * Station set identification (SSID). (0xFC02, 0xFC04)
517 */
518struct wi_ltv_ssid {
519	u_int16_t		wi_len;
520	u_int16_t		wi_type;
521	u_int16_t		wi_id[17];
522};
523
524/*
525 * Set our station name. (0xFC0E)
526 */
527struct wi_ltv_nodename {
528	u_int16_t		wi_len;
529	u_int16_t		wi_type;
530	u_int16_t		wi_nodename[17];
531};
532
533/*
534 * Multicast addresses to be put in filter. We're
535 * allowed up to 16 addresses in the filter. (0xFC80)
536 */
537struct wi_ltv_mcast {
538	u_int16_t		wi_len;
539	u_int16_t		wi_type;
540	struct ether_addr	wi_mcast[16];
541};
542
543/*
544 * supported rates. (0xFCB4)
545 */
546#define WI_SUPPRATES_1M		0x0001
547#define WI_SUPPRATES_2M		0x0002
548#define WI_SUPPRATES_5M		0x0004
549#define WI_SUPPRATES_11M	0x0008
550#define	WI_RATES_BITS	"\20\0011M\0022M\0035.5M\00411M"
551
552/*
553 * Information frame types.
554 */
555#define WI_INFO_NOTIFY		0xF000	/* Handover address */
556#define WI_INFO_COUNTERS	0xF100	/* Statistics counters */
557#define WI_INFO_SCAN_RESULTS	0xF101	/* Scan results */
558#define WI_INFO_LINK_STAT	0xF200	/* Link status */
559#define WI_INFO_ASSOC_STAT	0xF201	/* Association status */
560
561/*
562 * Hermes transmit/receive frame structure
563 */
564struct wi_frame {
565	u_int16_t		wi_status;	/* 0x00 */
566	u_int16_t		wi_rsvd0;	/* 0x02 */
567	u_int16_t		wi_rsvd1;	/* 0x04 */
568	u_int16_t		wi_q_info;	/* 0x06 */
569	u_int16_t		wi_rsvd2;	/* 0x08 */
570	u_int8_t		wi_tx_rtry;	/* 0x0A */
571	u_int8_t		wi_tx_rate;	/* 0x0B */
572	u_int16_t		wi_tx_ctl;	/* 0x0C */
573	u_int16_t		wi_frame_ctl;	/* 0x0E */
574	u_int16_t		wi_id;		/* 0x10 */
575	u_int8_t		wi_addr1[6];	/* 0x12 */
576	u_int8_t		wi_addr2[6];	/* 0x18 */
577	u_int8_t		wi_addr3[6];	/* 0x1E */
578	u_int16_t		wi_seq_ctl;	/* 0x24 */
579	u_int8_t		wi_addr4[6];	/* 0x26 */
580	u_int16_t		wi_dat_len;	/* 0x2C */
581	u_int8_t		wi_dst_addr[6];	/* 0x2E */
582	u_int8_t		wi_src_addr[6];	/* 0x34 */
583	u_int16_t		wi_len;		/* 0x3A */
584	u_int16_t		wi_dat[3];	/* 0x3C */ /* SNAP header */
585	u_int16_t		wi_type;	/* 0x42 */
586};
587
588#define WI_802_3_OFFSET		0x2E
589#define WI_802_11_OFFSET	0x44
590#define WI_802_11_OFFSET_RAW	0x3C
591#define WI_802_11_OFFSET_HDR    0x0E
592
593#define WI_STAT_BADCRC		0x0001
594#define WI_STAT_UNDECRYPTABLE	0x0002
595#define WI_STAT_ERRSTAT		0x0003
596#define WI_STAT_MAC_PORT	0x0700
597#define WI_STAT_1042		0x2000	/* RFC1042 encoded */
598#define WI_STAT_TUNNEL		0x4000	/* Bridge-tunnel encoded */
599#define WI_STAT_WMP_MSG		0x6000	/* WaveLAN-II management protocol */
600#define WI_STAT_MGMT		0x8000	/* 802.11b management frames */
601#define WI_RXSTAT_MSG_TYPE	0xE000
602
603#define WI_ENC_TX_802_3		0x00
604#define WI_ENC_TX_802_11	0x11
605#define WI_ENC_TX_MGMT		0x08
606#define WI_ENC_TX_E_II		0x0E
607
608#define WI_ENC_TX_1042		0x00
609#define WI_ENC_TX_TUNNEL	0xF8
610
611#define WI_TXCNTL_MACPORT	0x00FF
612#define WI_TXCNTL_STRUCTTYPE	0xFF00
613#define WI_TXCNTL_TX_EX		0x0004
614#define WI_TXCNTL_TX_OK		0x0002
615#define WI_TXCNTL_NOCRYPT	0x0080
616
617/*
618 * SNAP (sub-network access protocol) constants for transmission
619 * of IP datagrams over IEEE 802 networks, taken from RFC1042.
620 * We need these for the LLC/SNAP header fields in the TX/RX frame
621 * structure.
622 */
623#define WI_SNAP_K1		0xaa	/* assigned global SAP for SNAP */
624#define WI_SNAP_K2		0x00
625#define WI_SNAP_CONTROL		0x03	/* unnumbered information format */
626#define WI_SNAP_WORD0		(WI_SNAP_K1 | (WI_SNAP_K1 << 8))
627#define WI_SNAP_WORD1		(WI_SNAP_K2 | (WI_SNAP_CONTROL << 8))
628#define WI_SNAPHDR_LEN		0x6
629#define WI_FCS_LEN		0x4
630