xref: /titanic_52/usr/src/uts/common/io/iwh/iwh_hw.h (revision 494f7e12a62129ef191a15f9dfde6b7abe3bf510)
1 /*
2  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
3  * Use is subject to license terms.
4  */
5 
6 /*
7  * Copyright (c) 2009, Intel Corporation
8  * All rights reserved.
9  */
10 
11 /*
12  * Sun elects to use this software under the BSD license.
13  */
14 
15 /*
16  * This file is provided under a dual BSD/GPLv2 license.  When using or
17  * redistributing this file, you may do so under either license.
18  *
19  * GPL LICENSE SUMMARY
20  *
21  * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
22  *
23  * This program is free software; you can redistribute it and/or modify
24  * it under the terms of version 2 of the GNU General Public License as
25  * published by the Free Software Foundation.
26  *
27  * This program is distributed in the hope that it will be useful, but
28  * WITHOUT ANY WARRANTY; without even the implied warranty of
29  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
30  * General Public License for more details.
31  *
32  * You should have received a copy of the GNU General Public License
33  * along with this program; if not, write to the Free Software
34  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
35  * USA
36  *
37  * The full GNU General Public License is included in this distribution
38  * in the file called LICENSE.GPL.
39  *
40  * Contact Information:
41  * James P. Ketrenos <ipw2100-admin@linux.intel.com>
42  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
43  *
44  * BSD LICENSE
45  *
46  * Copyright(c) 2005 - 2009 Intel Corporation. All rights reserved.
47  * All rights reserved.
48  *
49  * Redistribution and use in source and binary forms, with or without
50  * modification, are permitted provided that the following conditions
51  * are met:
52  *
53  *  * Redistributions of source code must retain the above copyright
54  *    notice, this list of conditions and the following disclaimer.
55  *  * Redistributions in binary form must reproduce the above copyright
56  *    notice, this list of conditions and the following disclaimer in
57  *    the documentation and/or other materials provided with the
58  *    distribution.
59  *  * Neither the name Intel Corporation nor the names of its
60  *    contributors may be used to endorse or promote products derived
61  *    from this software without specific prior written permission.
62  *
63  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
64  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
65  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
66  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
67  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
68  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
69  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
70  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
71  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
72  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
73  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
74  */
75 
76 #ifndef	_IWH_HW_H_
77 #define	_IWH_HW_H_
78 
79 #ifdef	__cplusplus
80 extern "C" {
81 #endif
82 
83 /*
84  * maximum scatter/gather
85  */
86 #define	IWH_MAX_SCATTER	(10)
87 
88 /*
89  * Flow Handler Definitions
90  */
91 #define	FH_MEM_LOWER_BOUND	(0x1000)
92 #define	FH_MEM_UPPER_BOUND	(0x1EF0)
93 
94 #define	IWH_FH_REGS_LOWER_BOUND	(0x1000)
95 #define	IWH_FH_REGS_UPPER_BOUND	(0x2000)
96 
97 /*
98  * TFDB  Area - TFDs buffer table
99  */
100 #define	FH_MEM_TFDB_LOWER_BOUND	(FH_MEM_LOWER_BOUND + 0x000)
101 #define	FH_MEM_TFDB_UPPER_BOUND	(FH_MEM_LOWER_BOUND + 0x900)
102 
103 /*
104  * channels 0 - 8
105  */
106 #define	FH_MEM_TFDB_CHNL_BUF0(x) (FH_MEM_TFDB_LOWER_BOUND + (x) * 0x100)
107 #define	FH_MEM_TFDB_CHNL_BUF1(x) (FH_MEM_TFDB_LOWER_BOUND + 0x80 + (x) * 0x100)
108 
109 /*
110  * TFDIB Area - TFD Immediate Buffer
111  */
112 #define	FH_MEM_TFDIB_LOWER_BOUND	(FH_MEM_LOWER_BOUND + 0x900)
113 #define	FH_MEM_TFDIB_UPPER_BOUND	(FH_MEM_LOWER_BOUND + 0x958)
114 
115 /*
116  * channels 0 - 10
117  */
118 #define	FH_MEM_TFDIB_CHNL(x)	(FH_MEM_TFDIB_LOWER_BOUND + (x) * 0x8)
119 
120 /*
121  * TFDIB registers used in Service Mode
122  */
123 #define	FH_MEM_TFDIB_CHNL9_REG0	(FH_MEM_TFDIB_CHNL(9))
124 #define	FH_MEM_TFDIB_CHNL9_REG1	(FH_MEM_TFDIB_CHNL(9) + 4)
125 #define	FH_MEM_TFDIB_CHNL10_REG0	(FH_MEM_TFDIB_CHNL(10))
126 #define	FH_MEM_TFDIB_CHNL10_REG1	(FH_MEM_TFDIB_CHNL(10) + 4)
127 
128 /*
129  * Tx service channels
130  */
131 #define	FH_MEM_TFDIB_DRAM_ADDR_MSB_MASK	(0xF00000000)
132 #define	FH_MEM_TFDIB_TB_LENGTH_MASK	(0x0001FFFF)	/* bits 16:0 */
133 
134 #define	FH_MEM_TFDIB_DRAM_ADDR_LSB_BITSHIFT	(0)
135 #define	FH_MEM_TFDIB_DRAM_ADDR_MSB_BITSHIFT	(32)
136 #define	FH_MEM_TFDIB_TB_LENGTH_BITSHIFT		(0)
137 
138 #define	FH_MEM_TFDIB_REG0_ADDR_MASK	(0xFFFFFFFF)
139 #define	FH_MEM_TFDIB_REG1_ADDR_MASK	(0xF0000000)
140 #define	FH_MEM_TFDIB_REG1_LENGTH_MASK	(0x0001FFFF)
141 
142 #define	FH_MEM_TFDIB_REG0_ADDR_BITSHIFT	(0)
143 #define	FH_MEM_TFDIB_REG1_ADDR_BITSHIFT	(28)
144 #define	FH_MEM_TFDIB_REG1_LENGTH_BITSHIFT	(0)
145 #define	FH_MEM_TFDIB_DRAM_ADDR_LSB_MASK		(0xFFFFFFFF)
146 
147 /*
148  * TRB Area - Transmit Request Buffers
149  */
150 #define	FH_MEM_TRB_LOWER_BOUND	(FH_MEM_LOWER_BOUND + 0x0958)
151 #define	FH_MEM_TRB_UPPER_BOUND	(FH_MEM_LOWER_BOUND + 0x0980)
152 
153 /*
154  * channels 0 - 8
155  */
156 #define	FH_MEM_TRB_CHNL(x)	(FH_MEM_TRB_LOWER_BOUND + (x) * 0x4)
157 
158 /*
159  * Keep-Warm (KW) buffer base address.
160  *
161  * Driver must allocate a 4KByte buffer that is used by Shirely Peak(SP) for
162  * keeping the
163  * host DRAM powered on (via dummy accesses to DRAM) to maintain low-latency
164  * DRAM access when SP is Txing or Rxing.  The dummy accesses prevent host
165  * from going into a power-savings mode that would cause higher DRAM latency,
166  * and possible data over/under-runs, before all Tx/Rx is complete.
167  *
168  * Driver loads IWH_FH_KW_MEM_ADDR_REG with the physical address (bits 35:4)
169  * of the buffer, which must be 4K aligned.  Once this is set up, the SP
170  * automatically invokes keep-warm accesses when normal accesses might not
171  * be sufficient to maintain fast DRAM response.
172  *
173  * Bit fields:
174  * 31-0:  Keep-warm buffer physical base address [35:4], must be 4K aligned
175  */
176 #define	IWH_FH_KW_MEM_ADDR_REG	(FH_MEM_LOWER_BOUND + 0x97C)
177 
178 /*
179  * STAGB Area - Scheduler TAG Buffer
180  */
181 #define	FH_MEM_STAGB_LOWER_BOUND	(FH_MEM_LOWER_BOUND + 0x980)
182 #define	FH_MEM_STAGB_UPPER_BOUND	(FH_MEM_LOWER_BOUND + 0x9D0)
183 
184 /*
185  * channels 0 - 8
186  */
187 #define	FH_MEM_STAGB_0(x)	(FH_MEM_STAGB_LOWER_BOUND + (x) * 0x8)
188 #define	FH_MEM_STAGB_1(x)	(FH_MEM_STAGB_LOWER_BOUND + 0x4 + (x) * 0x8)
189 
190 /*
191  * Tx service channels
192  */
193 #define	FH_MEM_SRAM_ADDR_9	(FH_MEM_STAGB_LOWER_BOUND + 0x048)
194 #define	FH_MEM_SRAM_ADDR_10	(FH_MEM_STAGB_LOWER_BOUND + 0x04C)
195 
196 #define	FH_MEM_STAGB_SRAM_ADDR_MASK	(0x00FFFFFF)
197 
198 /*
199  * TFD Circular Buffers Base (CBBC) addresses
200  *
201  * SP has 16 base pointer registers, one for each of 16 host-DRAM-resident
202  * circular buffers (CBs/queues) containing Transmit Frame Descriptors (TFDs)
203  * (see struct iwh_tfd_frame).  These 16 pointer registers are offset by 0x04
204  * bytes from one another.  Each TFD circular buffer in DRAM must be 256-byte
205  * aligned (address bits 0-7 must be 0).
206  *
207  * Bit fields in each pointer register:
208  * 27-0: TFD CB physical base address [35:8], must be 256-byte aligned
209  */
210 #define	FH_MEM_CBBC_LOWER_BOUND	(FH_MEM_LOWER_BOUND + 0x9D0)
211 #define	FH_MEM_CBBC_UPPER_BOUND	(FH_MEM_LOWER_BOUND + 0xA10)
212 
213 /*
214  * queues 0 - 15
215  */
216 #define	FH_MEM_CBBC_QUEUE(x)	(FH_MEM_CBBC_LOWER_BOUND + (x) * 0x4)
217 
218 /*
219  * TAGR Area - TAG reconstruct table
220  */
221 #define	FH_MEM_TAGR_LOWER_BOUND	(FH_MEM_LOWER_BOUND + 0xA10)
222 #define	FH_MEM_TAGR_UPPER_BOUND	(FH_MEM_LOWER_BOUND + 0xA70)
223 
224 /*
225  * TDBGR Area - Tx Debug Registers
226  */
227 #define	FH_MEM_TDBGR_LOWER_BOUND	(FH_MEM_LOWER_BOUND + 0x0A70)
228 #define	FH_MEM_TDBGR_UPPER_BOUND	(FH_MEM_LOWER_BOUND + 0x0B20)
229 
230 /*
231  * channels 0 - 10
232  */
233 #define	FH_MEM_TDBGR_CHNL(x)	(FH_MEM_TDBGR_LOWER_BOUND + (x) * 0x10)
234 
235 #define	FH_MEM_TDBGR_CHNL_REG_0(x)	(FH_MEM_TDBGR_CHNL(x))
236 #define	FH_MEM_TDBGR_CHNL_REG_1(x)	(FH_MEM_TDBGR_CHNL_REG_0(x) + 0x4)
237 
238 #define	FH_MEM_TDBGR_CHNL_BYTES_TO_FIFO_MASK	(0x000FFFFF)
239 #define	FH_MEM_TDBGR_CHNL_BYTES_TO_FIFO_BITSHIFT	(0)
240 
241 /*
242  * RDBUF Area
243  */
244 #define	FH_MEM_RDBUF_LOWER_BOUND	(FH_MEM_LOWER_BOUND + 0xB80)
245 #define	FH_MEM_RDBUF_UPPER_BOUND	(FH_MEM_LOWER_BOUND + 0xBC0)
246 #define	FH_MEM_RDBUF_CHNL0	(FH_MEM_RDBUF_LOWER_BOUND)
247 
248 /*
249  * Rx SRAM Control and Status Registers (RSCSR)
250  *
251  * These registers provide handshake between driver and Shirley Peak for
252  * the Rx queue
253  * (this queue handles *all* command responses, notifications, Rx data, etc.
254  * sent from SP uCode to host driver).  Unlike Tx, there is only one Rx
255  * queue, and only one Rx DMA/FIFO channel.  Also unlike Tx, which can
256  * concatenate up to 20 DRAM buffers to form a Tx frame, each Receive Buffer
257  * Descriptor (RBD) points to only one Rx Buffer (RB); there is a 1:1
258  * mapping between RBDs and RBs.
259  *
260  * Driver must allocate host DRAM memory for the following, and set the
261  * physical address of each into SP registers:
262  *
263  * 1)  Receive Buffer Descriptor (RBD) circular buffer (CB), typically with 256
264  *     entries (although any power of 2, up to 4096, is selectable by driver).
265  *     Each entry (1 dword) points to a receive buffer (RB) of consistent size
266  *     (typically 4K, although 8K or 16K are also selectable by driver).
267  *     Driver sets up RB size and number of RBDs in the CB via Rx config
268  *     register FH_MEM_RCSR_CHNL0_CONFIG_REG.
269  *
270  *     Bit fields within one RBD:
271  *     27-0:  Receive Buffer physical address bits [35:8], 256-byte aligned.
272  *
273  *     Driver sets physical address [35:8] of base of RBD circular buffer
274  *     into FH_RSCSR_CHNL0_RBDCB_BASE_REG [27:0].
275  *
276  * 2)  Rx status buffer, 8 bytes, in which SP indicates which Rx Buffers
277  *     (RBs) have been filled, via a "write pointer", actually the index of
278  *     the RB's corresponding RBD within the circular buffer.  Driver sets
279  *     physical address [35:4] into FH_RSCSR_CHNL0_STTS_WPTR_REG [31:0].
280  *
281  *     Bit fields in lower dword of Rx status buffer (upper dword not used
282  *     by driver; see struct iwh_shared, val0):
283  *     31-12:  Not used by driver
284  *     11- 0:  Index of last filled Rx buffer descriptor
285  *             (SP writes, driver reads this value)
286  *
287  * As the driver prepares Receive Buffers (RBs) for SP to fill, driver must
288  * enter pointers to these RBs into contiguous RBD circular buffer entries,
289  * and update the SP's "write" index register, FH_RSCSR_CHNL0_RBDCB_WPTR_REG.
290  *
291  * This "write" index corresponds to the *next* RBD that the driver will make
292  * available, i.e. one RBD past the the tail of the ready-to-fill RBDs within
293  * the circular buffer.  This value should initially be 0 (before preparing any
294  * RBs), should be 8 after preparing the first 8 RBs (for example), and must
295  * wrap back to 0 at the end of the circular buffer (but don't wrap before
296  * "read" index has advanced past 1!  See below).
297  * NOTE:  SP EXPECTS THE WRITE INDEX TO BE INCREMENTED IN MULTIPLES OF 8.
298  *
299  * As the SP fills RBs (referenced from contiguous RBDs within the circular
300  * buffer), it updates the Rx status buffer in DRAM, 2) described above,
301  * to tell the driver the index of the latest filled RBD.  The driver must
302  * read this "read" index from DRAM after receiving an Rx interrupt from SP.
303  *
304  * The driver must also internally keep track of a third index, which is the
305  * next RBD to process.  When receiving an Rx interrupt, driver should process
306  * all filled but unprocessed RBs up to, but not including, the RB
307  * corresponding to the "read" index.  For example, if "read" index becomes "1",
308  * driver may process the RB pointed to by RBD 0.  Depending on volume of
309  * traffic, there may be many RBs to process.
310  *
311  * If read index == write index, SP thinks there is no room to put new data.
312  * Due to this, the maximum number of filled RBs is 255, instead of 256.  To
313  * be safe, make sure that there is a gap of at least 2 RBDs between "write"
314  * and "read" indexes; that is, make sure that there are no more than 254
315  * buffers waiting to be filled.
316  */
317 #define	FH_MEM_RSCSR_LOWER_BOUND	(FH_MEM_LOWER_BOUND + 0xBC0)
318 #define	FH_MEM_RSCSR_UPPER_BOUND	(FH_MEM_LOWER_BOUND + 0xC00)
319 #define	FH_MEM_RSCSR_CHNL0	(FH_MEM_RSCSR_LOWER_BOUND)
320 #define	FH_MEM_RSCSR_CHNL1	(FH_MEM_RSCSR_LOWER_BOUND + 0x020)
321 
322 /*
323  * Physical base address of 8-byte Rx Status buffer.
324  * Bit fields:
325  * 31-0: Rx status buffer physical base address [35:4], must 16-byte aligned.
326  */
327 
328 #define	FH_RSCSR_CHNL0_STTS_WPTR_REG	(FH_MEM_RSCSR_CHNL0)
329 
330 /*
331  * Physical base address of Rx Buffer Descriptor Circular Buffer.
332  * Bit fields:
333  * 27-0:  RBD CD physical base address [35:8], must be 256-byte aligned.
334  */
335 #define	FH_RSCSR_CHNL0_RBDCB_BASE_REG	(FH_MEM_RSCSR_CHNL0 + 0x004)
336 
337 /*
338  * Rx write pointer (index, really!).
339  * Bit fields:
340  * 11-0:  Index of driver's most recent prepared-to-be-filled RBD, + 1.
341  *        NOTE:  For 256-entry circular buffer, use only bits [7:0].
342  */
343 #define	FH_RSCSR_CHNL0_RBDCB_WPTR_REG	(FH_MEM_RSCSR_CHNL0 + 0x008)
344 #define	FH_RSCSR_CHNL0_RBDCB_RPTR_REG	(FH_MEM_RSCSR_CHNL0 + 0x00c)
345 
346 
347 /*
348  * RSCSR registers used in Service mode
349  */
350 #define	FH_RSCSR_CHNL1_RB_WPTR_REG	(FH_MEM_RSCSR_CHNL1)
351 #define	FH_RSCSR_CHNL1_RB_WPTR_OFFSET_REG	(FH_MEM_RSCSR_CHNL1 + 0x004)
352 #define	FH_RSCSR_CHNL1_RB_CHUNK_NUM_REG		(FH_MEM_RSCSR_CHNL1 + 0x008)
353 #define	FH_RSCSR_CHNL1_SRAM_ADDR_REG	(FH_MEM_RSCSR_CHNL1 + 0x00C)
354 
355 /*
356  * Rx Config/Status Registers (RCSR)
357  * Rx Config Reg for channel 0 (only channel used)
358  *
359  * Driver must initialize FH_MEM_RCSR_CHNL0_CONFIG_REG as follows for
360  * normal operation (see bit fields).
361  *
362  * Clearing FH_MEM_RCSR_CHNL0_CONFIG_REG to 0 turns off Rx DMA.
363  * Driver should poll FH_MEM_RSSR_RX_STATUS_REG	for
364  * FH_RSSR_CHNL0_RX_STATUS_CHNL_IDLE (bit 24) before continuing.
365  *
366  * Bit fields:
367  * 31-30: Rx DMA channel enable: '00' off/pause, '01' pause at end of frame,
368  *        '10' operate normally
369  * 29-24: reserved
370  * 23-20: # RBDs in circular buffer = 2^value; use "8" for 256 RBDs (normal),
371  *        min "5" for 32 RBDs, max "12" for 4096 RBDs.
372  * 19-18: reserved
373  * 17-16: size of each receive buffer; '00' 4K (normal), '01' 8K,
374  *        '10' 12K, '11' 16K.
375  * 15-14: reserved
376  * 13-12: IRQ destination; '00' none, '01' host driver (normal operation)
377  * 11- 4: timeout for closing Rx buffer and interrupting host (units 32 usec)
378  *        typical value 0x10 (about 1/2 msec)
379  * 3- 0: reserved
380  */
381 #define	FH_MEM_RCSR_LOWER_BOUND	(FH_MEM_LOWER_BOUND + 0xC00)
382 #define	FH_MEM_RCSR_UPPER_BOUND	(FH_MEM_LOWER_BOUND + 0xCC0)
383 #define	FH_MEM_RCSR_CHNL0	(FH_MEM_RCSR_LOWER_BOUND)
384 #define	FH_MEM_RCSR_CHNL1	(FH_MEM_RCSR_LOWER_BOUND + 0x020)
385 
386 #define	FH_MEM_RCSR_CHNL0_CONFIG_REG	(FH_MEM_RCSR_CHNL0)
387 #define	FH_MEM_RCSR_CHNL0_CREDIT_REG	(FH_MEM_RCSR_CHNL0 + 0x004)
388 #define	FH_MEM_RCSR_CHNL0_RBD_STTS_REG	(FH_MEM_RCSR_CHNL0 + 0x008)
389 #define	FH_MEM_RCSR_CHNL0_RB_STTS_REG	(FH_MEM_RCSR_CHNL0 + 0x00C)
390 #define	FH_MEM_RCSR_CHNL0_RXPD_STTS_REG	(FH_MEM_RCSR_CHNL0 + 0x010)
391 
392 #define	FH_MEM_RCSR_CHNL0_RBD_STTS_FRAME_RB_CNT_MASK	(0x7FFFFFF0)
393 
394 /*
395  * RCSR registers used in Service mode
396  */
397 #define	FH_MEM_RCSR_CHNL1_CONFIG_REG	(FH_MEM_RCSR_CHNL1)
398 #define	FH_MEM_RCSR_CHNL1_RB_STTS_REG	(FH_MEM_RCSR_CHNL1 + 0x00C)
399 #define	FH_MEM_RCSR_CHNL1_RX_PD_STTS_REG	(FH_MEM_RCSR_CHNL1 + 0x010)
400 
401 /*
402  * Rx Shared Status Registers (RSSR)
403  *
404  * After stopping Rx DMA channel (writing 0 to FH_MEM_RCSR_CHNL0_CONFIG_REG),
405  * driver must poll FH_MEM_RSSR_RX_STATUS_REG until Rx channel is idle.
406  *
407  * Bit fields:
408  * 24:  1 = Channel 0 is idle
409  *
410  * FH_MEM_RSSR_SHARED_CTRL_REG and FH_MEM_RSSR_RX_ENABLE_ERR_IRQ2DRV contain
411  * default values that should not be altered by the driver.
412  */
413 #define	FH_MEM_RSSR_LOWER_BOUND	(FH_MEM_LOWER_BOUND + 0xC40)
414 #define	FH_MEM_RSSR_UPPER_BOUND	(FH_MEM_LOWER_BOUND + 0xD00)
415 #define	FH_MEM_RSSR_SHARED_CTRL_REG	(FH_MEM_RSSR_LOWER_BOUND)
416 #define	FH_MEM_RSSR_RX_STATUS_REG	(FH_MEM_RSSR_LOWER_BOUND + 0x004)
417 #define	FH_MEM_RSSR_RX_ENABLE_ERR_IRQ2DRV (FH_MEM_RSSR_LOWER_BOUND + 0x008)
418 
419 /*
420  * Transmit DMA Channel Control/Status Registers (TCSR)
421  *
422  * SP has one configuration register for each of 8 Tx DMA/FIFO channels
423  * supported in hardware; config regs are separated by 0x20 bytes.
424  *
425  * To use a Tx DMA channel, driver must initialize its
426  *
427  *
428  * All other bits should be 0.
429  *
430  * Bit fields:
431  * 31-30: Tx DMA channel enable: '00' off/pause, '01' pause at end of frame,
432  *        '10' operate normally
433  * 29- 4: Reserved, set to "0"
434  *     3: Enable internal DMA requests (1, normal operation), disable (0)
435  *  2- 0: Reserved, set to "0"
436  */
437 #define	IWH_FH_TCSR_UPPER_BOUND	(IWH_FH_REGS_LOWER_BOUND + 0xE60)
438 
439 #define	IWH_FH_TCSR_CHNL_NUM	(7)
440 
441 /*
442  * Tx Shared Status Registers (TSSR)
443  *
444  * After stopping Tx DMA channel (writing 0 to
445  * IWH_FH_TSSR_TX_STATUS_REG until selected Tx channel is idle
446  * (channel's buffers empty | no pending requests).
447  *
448  * Bit fields:
449  * 31-24:  1 = Channel buffers empty (channel 7:0)
450  * 23-16:  1 = No pending requests (channel 7:0)
451  */
452 #define	IWH_FH_TSSR_LOWER_BOUND	(IWH_FH_REGS_LOWER_BOUND + 0xEA0)
453 #define	IWH_FH_TSSR_UPPER_BOUND	(IWH_FH_REGS_LOWER_BOUND + 0xEC0)
454 
455 #define	IWH_FH_TSSR_TX_MSG_CONFIG_REG (IWH_FH_TSSR_LOWER_BOUND + 0x008)
456 #define	IWH_FH_TSSR_TX_STATUS_REG	(IWH_FH_TSSR_LOWER_BOUND + 0x010)
457 
458 #define	IWH_FH_TSSR_TX_MSG_CONFIG_REG_VAL_SNOOP_RD_TXPD_ON	(0xFF000000)
459 #define	IWH_FH_TSSR_TX_MSG_CONFIG_REG_VAL_ORDER_RD_TXPD_ON	(0x00FF0000)
460 
461 #define	IWH_FH_TSSR_TX_MSG_CONFIG_REG_VAL_MAX_FRAG_SIZE_64B	(0x00000000)
462 #define	IWH_FH_TSSR_TX_MSG_CONFIG_REG_VAL_MAX_FRAG_SIZE_128B	(0x00000400)
463 #define	IWH_FH_TSSR_TX_MSG_CONFIG_REG_VAL_MAX_FRAG_SIZE_256B	(0x00000800)
464 #define	IWH_FH_TSSR_TX_MSG_CONFIG_REG_VAL_MAX_FRAG_SIZE_512B	(0x00000C00)
465 
466 #define	IWH_FH_TSSR_TX_MSG_CONFIG_REG_VAL_SNOOP_RD_TFD_ON	(0x00000100)
467 #define	IWH_FH_TSSR_TX_MSG_CONFIG_REG_VAL_ORDER_RD_CBB_ON	(0x00000080)
468 
469 #define	IWH_FH_TSSR_TX_MSG_CONFIG_REG_VAL_ORDER_RSP_WAIT_TH	(0x00000020)
470 #define	IWH_FH_TSSR_TX_MSG_CONFIG_REG_VAL_RSP_WAIT_TH	(0x00000005)
471 
472 #define	IWH_FH_TSSR_TX_STATUS_REG_BIT_BUFS_EMPTY(_chnl)	\
473 	((1 << (_chnl)) << 24)
474 #define	IWH_FH_TSSR_TX_STATUS_REG_BIT_NO_PEND_REQ(_chnl) \
475 	((1 << (_chnl)) << 16)
476 
477 #define	IWH_FH_TSSR_TX_STATUS_REG_MSK_CHNL_IDLE(_chnl) \
478 	(IWH_FH_TSSR_TX_STATUS_REG_BIT_BUFS_EMPTY(_chnl) | \
479 	IWH_FH_TSSR_TX_STATUS_REG_BIT_NO_PEND_REQ(_chnl))
480 
481 /*
482  * TFDIB
483  */
484 #define	IWH_FH_TFDIB_UPPER_BOUND	(IWH_FH_REGS_LOWER_BOUND + 0x958)
485 #define	IWH_FH_TFDIB_CTRL1_REG_POS_MSB	(28)
486 #define	IWH_FH_TFDIB_LOWER_BOUND	(IWH_FH_REGS_LOWER_BOUND + 0x900)
487 
488 #define	IWH_FH_TFDIB_CTRL0_REG(_chnl)\
489 	(IWH_FH_TFDIB_LOWER_BOUND + 0x8 * _chnl)
490 
491 #define	IWH_FH_TFDIB_CTRL1_REG(_chnl)\
492 	(IWH_FH_TFDIB_LOWER_BOUND + 0x8 * _chnl + 0x4)
493 
494 /*
495  * Debug Monitor Area
496  */
497 #define	FH_MEM_DM_LOWER_BOUND	(FH_MEM_LOWER_BOUND + 0xEE0)
498 #define	FH_MEM_DM_UPPER_BOUND	(FH_MEM_LOWER_BOUND + 0xEF0)
499 #define	FH_MEM_DM_CONTROL_MASK_REG	(FH_MEM_DM_LOWER_BOUND)
500 #define	FH_MEM_DM_CONTROL_START_REG	(FH_MEM_DM_LOWER_BOUND + 0x004)
501 #define	FH_MEM_DM_CONTROL_STATUS_REG	(FH_MEM_DM_LOWER_BOUND + 0x008)
502 #define	FH_MEM_DM_MONITOR_REG	(FH_MEM_DM_LOWER_BOUND + 0x00C)
503 
504 #define	FH_TB1_ADDR_LOW_MASK	(0xFFFFFFFF)	/* bits 31:0 */
505 #define	FH_TB1_ADDR_HIGH_MASK	(0xF00000000)	/* bits 35:32 */
506 #define	FH_TB2_ADDR_LOW_MASK	(0x0000FFFF)	/* bits 15:0 */
507 #define	FH_TB2_ADDR_HIGH_MASK	(0xFFFFF0000)	/* bits 35:16 */
508 
509 #define	FH_TB1_ADDR_LOW_BITSHIFT	(0)
510 #define	FH_TB1_ADDR_HIGH_BITSHIFT	(32)
511 #define	FH_TB2_ADDR_LOW_BITSHIFT	(0)
512 #define	FH_TB2_ADDR_HIGH_BITSHIFT	(16)
513 
514 #define	FH_TB1_LENGTH_MASK	(0x00000FFF)	/* bits 11:0 */
515 #define	FH_TB2_LENGTH_MASK	(0x00000FFF)	/* bits 11:0 */
516 
517 /*
518  * number of FH channels including 2 service mode
519  */
520 #define	NUM_OF_FH_CHANNELS	(10)
521 
522 /*
523  * ctrl field bitology
524  */
525 #define	FH_TFD_CTRL_PADDING_MASK	(0xC0000000)	/* bits 31:30 */
526 #define	FH_TFD_CTRL_NUMTB_MASK		(0x1F000000)	/* bits 28:24 */
527 
528 #define	FH_TFD_CTRL_PADDING_BITSHIFT	(30)
529 #define	FH_TFD_CTRL_NUMTB_BITSHIFT	(24)
530 
531 #define	FH_TFD_GET_NUM_TBS(ctrl) \
532 	((ctrl & FH_TFD_CTRL_NUMTB_MASK) >> FH_TFD_CTRL_NUMTB_BITSHIFT)
533 #define	FH_TFD_GET_PADDING(ctrl) \
534 	((ctrl & FH_TFD_CTRL_PADDING_MASK) >> FH_TFD_CTRL_PADDING_BITSHIFT)
535 
536 /*
537  * TCSR: tx_config register values
538  */
539 #define	IWH_FH_TCSR_TX_CONFIG_REG_VAL_MSG_MODE_TXF	(0x00000000)
540 #define	IWH_FH_TCSR_TX_CONFIG_REG_VAL_MSG_MODE_DRIVER	(0x00000001)
541 #define	IWH_FH_TCSR_TX_CONFIG_REG_VAL_MSG_MODE_ARC	(0x00000002)
542 
543 #define	IWH_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_ENABLE_VAL	(0x00000008)
544 
545 #define	IWH_FH_TCSR_TX_CONFIG_REG_VAL_CIRQ_HOST_NOINT	(0x00000000)
546 #define	IWH_FH_TCSR_TX_CONFIG_REG_VAL_CIRQ_HOST_IFTFD	(0x00200000)
547 
548 #define	IWH_FH_TCSR_TX_CONFIG_REG_VAL_CIRQ_RTC_NOINT		(0x00000000)
549 #define	IWH_FH_TCSR_TX_CONFIG_REG_VAL_CIRQ_RTC_ENDTFD	(0x00400000)
550 #define	IWH_FH_TCSR_TX_CONFIG_REG_VAL_CIRQ_RTC_IFTFD		(0x00800000)
551 
552 
553 #define	IWH_FH_TCSR_CHNL_TX_BUF_STS_REG_VAL_TFDB_EMPTY	(0x00000000)
554 #define	IWH_FH_TCSR_CHNL_TX_BUF_STS_REG_VAL_TFDB_WAIT	(0x00002000)
555 
556 #define	IWH_FH_TCSR_CHNL_TX_BUF_STS_REG_BIT_TFDB_WPTR	(0x00000001)
557 
558 #define	IWH_FH_TCSR_CHNL_TX_BUF_STS_REG_POS_TB_NUM	(20)
559 #define	IWH_FH_TCSR_CHNL_TX_BUF_STS_REG_POS_TB_IDX	(12)
560 
561 #define	IWH_FH_TCSR_CHNL_TX_BUF_STS_REG_VAL_TFDB_VALID	(0x00000003)
562 
563 #define	IWH_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_ENABLE	(0x80000000)
564 
565 #define	IWH_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_DISABLE_VAL	(0x00000000)
566 
567 #define	IWH_FH_TCSR_TX_CONFIG_REG_VAL_CIRQ_HOST_ENDTFD		(0x00100000)
568 
569 #define	IWH_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_PAUSE	(0x00000000)
570 
571 #define	IWH_FH_TCSR_LOWER_BOUND	(FH_MEM_LOWER_BOUND + 0xD00)
572 
573 #define	IWH_FH_TCSR_CHNL_TX_CONFIG_REG(_chnl)\
574 	(IWH_FH_TCSR_LOWER_BOUND + 0x20 * _chnl)
575 
576 #define	IWH_FH_TCSR_CHNL_TX_CREDIT_REG(_chnl)\
577 	(IWH_FH_TCSR_LOWER_BOUND + 0x20 * _chnl + 0x4)
578 
579 #define	IWH_FH_TCSR_CHNL_TX_BUF_STS_REG(_chnl)\
580 	(IWH_FH_TCSR_LOWER_BOUND + 0x20 * _chnl + 0x8)
581 #define	IWH_FH_TCSR_CHNL_NUM		(7)
582 
583 /*
584  * CBB table
585  */
586 #define	FH_CBB_ADDR_MASK	0x0FFFFFFF	/* bits 27:0 */
587 #define	FH_CBB_ADDR_BIT_SHIFT	(8)
588 
589 /*
590  * RCSR:  channel 0 rx_config register defines
591  */
592 #define	FH_RCSR_CHNL0_RX_CONFIG_DMA_CHNL_EN_MASK (0xC0000000) /* bits 30-31 */
593 #define	FH_RCSR_CHNL0_RX_CONFIG_RBDBC_SIZE_MASK (0x00F00000) /* bits 20-23 */
594 #define	FH_RCSR_CHNL0_RX_CONFIG_RB_SIZE_MASK (0x00030000) /* bits 16-17 */
595 #define	FH_RCSR_CHNL0_RX_CONFIG_SINGLE_FRAME_MASK (0x00008000) /* bit 15 */
596 #define	FH_RCSR_CHNL0_RX_CONFIG_IRQ_DEST_MASK (0x00001000) /* bit 12 */
597 #define	FH_RCSR_CHNL0_RX_CONFIG_RB_TIMEOUT_MASK (0x00000FF0) /* bit 4-11 */
598 
599 #define	FH_RCSR_RX_CONFIG_RBDCB_SIZE_BITSHIFT	(20)
600 #define	FH_RCSR_RX_CONFIG_RB_SIZE_BITSHIFT	(16)
601 
602 #define	FH_RCSR_GET_RDBC_SIZE(reg) \
603 	((reg & FH_RCSR_RX_CONFIG_RDBC_SIZE_MASK) >> \
604 	FH_RCSR_RX_CONFIG_RDBC_SIZE_BITSHIFT)
605 
606 /*
607  * RCSR:  channel 1 rx_config register defines
608  */
609 #define	FH_RCSR_CHNL1_RX_CONFIG_DMA_CHNL_EN_MASK  (0xC0000000) /* bits 30-31 */
610 #define	FH_RCSR_CHNL1_RX_CONFIG_IRQ_DEST_MASK	  (0x00003000) /* bits 12-13 */
611 
612 /*
613  * RCSR: rx_config register values
614  */
615 #define	FH_RCSR_RX_CONFIG_CHNL_EN_PAUSE_VAL	(0x00000000)
616 #define	FH_RCSR_RX_CONFIG_CHNL_EN_PAUSE_EOF_VAL	(0x40000000)
617 #define	FH_RCSR_RX_CONFIG_CHNL_EN_ENABLE_VAL	(0x80000000)
618 #define	FH_RCSR_RX_CONFIG_SINGLE_FRAME_MODE	(0x00008000)
619 
620 #define	FH_RCSR_RX_CONFIG_RDRBD_DISABLE_VAL	(0x00000000)
621 #define	FH_RCSR_RX_CONFIG_RDRBD_ENABLE_VAL	(0x20000000)
622 
623 #define	IWH_FH_RCSR_RX_CONFIG_REG_VAL_RB_SIZE_4K	(0x00000000)
624 #define	IWH_TX_RTS_RETRY_LIMIT		(60)
625 #define	IWH_TX_DATA_RETRY_LIMIT		(15)
626 
627 #define	IWH_FH_RCSR_RX_CONFIG_REG_VAL_RB_SIZE_8K	(0x00010000)
628 #define	IWH_FH_RCSR_RX_CONFIG_REG_VAL_RB_SIZE_12K	(0x00020000)
629 #define	IWH_FH_RCSR_RX_CONFIG_REG_VAL_RB_SIZE_16K	(0x00030000)
630 
631 /*
632  * RCSR channel 0 config register values
633  */
634 #define	FH_RCSR_CHNL0_RX_CONFIG_IRQ_DEST_NO_INT_VAL	(0x00000000)
635 #define	FH_RCSR_CHNL0_RX_CONFIG_IRQ_DEST_INT_HOST_VAL	(0x00001000)
636 
637 /*
638  * RCSR channel 1 config register values
639  */
640 #define	FH_RCSR_CHNL1_RX_CONFIG_IRQ_DEST_NO_INT_VAL	(0x00000000)
641 #define	FH_RCSR_CHNL1_RX_CONFIG_IRQ_DEST_INT_HOST_VAL	(0x00001000)
642 #define	FH_RCSR_CHNL1_RX_CONFIG_IRQ_DEST_INT_RTC_VAL	(0x00002000)
643 #define	FH_RCSR_CHNL1_RX_CONFIG_IRQ_DEST_INT_HOST_RTC_VAL (0x00003000)
644 
645 /*
646  * RCSR: rb status register defines
647  */
648 #define	FH_RCSR_RB_BYTE_TO_SEND_MASK	(0x0001FFFF)	/* bits 0-16 */
649 
650 /*
651  * RSCSR: defs used in normal mode
652  */
653 #define	FH_RSCSR_CHNL0_RBDCB_WPTR_MASK	(0x00000FFF)	/* bits 0-11 */
654 
655 /*
656  * RSCSR: defs used in service mode
657  */
658 #define	FH_RSCSR_CHNL1_SRAM_ADDR_MASK	(0x00FFFFFF)	/* bits 0-23 */
659 #define	FH_RSCSR_CHNL1_RB_WPTR_MASK	(0x0FFFFFFF)	/* bits 0-27 */
660 #define	FH_RSCSR_CHNL1_RB_WPTR_OFFSET_MASK	(0x000000FF)	/* bits 0-7 */
661 
662 /*
663  * RSSR: RX Enable Error IRQ to Driver register defines
664  */
665 #define	FH_MEM_RSSR_RX_ENABLE_ERR_IRQ2DRV_NO_RBD (0x00400000)	/* bit 22 */
666 
667 #define	FH_DRAM2SRAM_DRAM_ADDR_HIGH_MASK	(0xFFFFFFF00)	/* bits 8-35 */
668 #define	FH_DRAM2SRAM_DRAM_ADDR_LOW_MASK		(0x000000FF)	/* bits 0-7 */
669 
670 #define	FH_DRAM2SRAM_DRAM_ADDR_HIGH_BITSHIFT	(8)	/* bits 8-35 */
671 
672 /*
673  * RX DRAM status regs definitions
674  */
675 #define	FH_RX_RB_NUM_MASK	(0x00000FFF)	/* bits 0-11 */
676 #define	FH_RX_FRAME_NUM_MASK	(0x0FFF0000) /* bits 16-27 */
677 
678 #define	FH_RX_RB_NUM_BITSHIFT	(0)
679 #define	FH_RX_FRAME_NUM_BITSHIFT	(16)
680 
681 /*
682  * Tx Scheduler
683  *
684  * The Tx Scheduler selects the next frame to be transmitted, chosing TFDs
685  * (Transmit Frame Descriptors) from up to 16 circular queues resident in
686  * host DRAM.  It steers each frame's Tx command (which contains the frame
687  * data) through one of up to 7 prioritized Tx DMA FIFO channels within the
688  * device.  A queue maps to only one (selectable by driver) Tx DMA channel,
689  * but one DMA channel may take input from several queues.
690  *
691  * Tx DMA channels have dedicated purposes.  For SP, and are used as follows:
692  * BMC TODO:  CONFIRM channel assignments, esp for 0/1
693  *
694  * 0 -- EDCA BK (background) frames, lowest priority
695  * 1 -- EDCA BE (best effort) frames, normal priority
696  * 2 -- EDCA VI (video) frames, higher priority
697  * 3 -- EDCA VO (voice) and management frames, highest priority
698  * 4 -- Commands (e.g. RXON, etc.)
699  * 5 -- HCCA short frames
700  * 6 -- HCCA long frames
701  * 7 -- not used by driver (device-internal only)
702  *
703  * Driver should normally map queues 0-6 to Tx DMA/FIFO channels 0-6.
704  * In addition, driver can map queues 7-15 to Tx DMA/FIFO channels 0-3 to
705  * support 11n aggregation via EDCA DMA channels. BMC confirm.
706  *
707  * The driver sets up each queue to work in one of two modes:
708  *
709  * 1)  Scheduler-Ack, in which the scheduler automatically supports a
710  *     block-ack (BA) window of up to 64 TFDs.  In this mode, each queue
711  *     contains TFDs for a unique combination of Recipient Address (RA)
712  *     and Traffic Identifier (TID), that is, traffic of a given
713  *     Quality-Of-Service (QOS) priority, destined for a single station.
714  *
715  *     In scheduler-ack mode, the scheduler keeps track of the Tx status of
716  *     each frame within the BA window, including whether it's been transmitted,
717  *     and whether it's been acknowledged by the receiving station.  The device
718  *     automatically processes block-acks received from the receiving STA,
719  *     and reschedules un-acked frames to be retransmitted (successful
720  *     Tx completion may end up being out-of-order).
721  *
722  *     The driver must maintain the queue's Byte Count table in host DRAM
723  *     (struct iwh_sched_queue_byte_cnt_tbl) for this mode.
724  *     This mode does not support fragmentation.
725  *
726  * 2)  FIFO (a.k.a. non-Scheduler-ACK), in which each TFD is processed in order.
727  *     The device may automatically retry Tx, but will retry only one frame
728  *     at a time, until receiving ACK from receiving station, or reaching
729  *     retry limit and giving up.
730  *
731  *     The command queue (#4) must use this mode!
732  *     This mode does not require use of the Byte Count table in host DRAM.
733  *
734  * Driver controls scheduler operation via 3 means:
735  * 1)  Scheduler registers
736  * 2)  Shared scheduler data base in internal 4956 SRAM
737  * 3)  Shared data in host DRAM
738  *
739  * Initialization:
740  *
741  * When loading, driver should allocate memory for:
742  * 1)  16 TFD circular buffers, each with space for (typically) 256 TFDs.
743  * 2)  16 Byte Count circular buffers in 16 KBytes contiguous memory
744  *     (1024 bytes for each queue).
745  *
746  * After receiving "Alive" response from uCode, driver must initialize
747  * the following (especially for queue #4, the command queue, otherwise
748  * the driver can't issue commands!):
749  *
750  * 1)  SP's scheduler data base area in SRAM:
751  *     a)  Read SRAM address of data base area from SCD_SRAM_BASE_ADDR
752  *     b)  Clear and Init SCD_CONTEXT_DATA_OFFSET area (size 128 bytes)
753  *     c)  Clear SCD_TX_STTS_BITMAP_OFFSET area (size 256 bytes)
754  *     d)  Clear (BMC and init?) SCD_TRANSLATE_TBL_OFFSET (size 32 bytes)
755  *
756  * 2)  Init SCD_DRAM_BASE_ADDR with physical base of Tx byte count circular
757  *     buffer array, allocated by driver in host DRAM.
758  *
759  * 3)
760  */
761 
762 /*
763  * Max Tx window size is the max number of contiguous TFDs that the scheduler
764  * can keep track of at one time when creating block-ack chains of frames.
765  * Note that "64" matches the number of ack bits in a block-ack.
766  * Driver should use SCD_WIN_SIZE and SCD_FRAME_LIMIT values to initialize
767  * SCD_CONTEXT_QUEUE_OFFSET(x) values.
768  */
769 #define	SCD_WIN_SIZE	64
770 #define	SCD_FRAME_LIMIT	64
771 
772 /*
773  * Driver may need to update queue-empty bits after changing queue's
774  * write and read pointers (indexes) during (re-)initialization (i.e. when
775  * scheduler is not tracking what's happening).
776  * Bit fields:
777  * 31-16:  Write mask -- 1: update empty bit, 0: don't change empty bit
778  * 15-00:  Empty state, one for each queue -- 1: empty, 0: non-empty
779  * NOTE BMC:  THIS REGISTER NOT USED BY LINUX DRIVER.
780  */
781 #define	SCD_EMPTY_BITS	(SCD_START_OFFSET + 0x4)
782 
783 /*
784  * Physical base address of array of byte count (BC) circular buffers (CBs).
785  * Each Tx queue has a BC CB in host DRAM to support Scheduler-ACK mode.
786  * This register points to BC CB for queue 0, must be on 1024-byte boundary.
787  * Others are spaced by 1024 bytes.
788  * Each BC CB is 2 bytes * (256 + 64) = 740 bytes, followed by 384 bytes pad.
789  * (Index into a queue's BC CB) = (index into queue's TFD CB) = (SSN & 0xff).
790  * Bit fields:
791  * 25-00:  Byte Count CB physical address [35:10], must be 1024-byte aligned.
792  */
793 #define	SCD_AIT		(SCD_START_OFFSET + 0x18)
794 
795 /*
796  * Queue (x) Write Pointers (indexes, really!), one for each Tx queue.
797  * Initialized and updated by driver as new TFDs are added to queue.
798  * NOTE:  If using Block Ack, index must correspond to frame's
799  *        Start Sequence Number; index = (SSN & 0xff)
800  * NOTE BMC:  Alternative to HBUS_TARG_WRPTR, which is what Linux driver uses?
801  */
802 #define	SCD_QUEUE_WRPTR(x)	(SCD_START_OFFSET + 0x24 + (x) * 4)
803 
804 /*
805  * Queue (x) Read Pointers (indexes, really!), one for each Tx queue.
806  * For FIFO mode, index indicates next frame to transmit.
807  * For Scheduler-ACK mode, index indicates first frame in Tx window.
808  * Initialized by driver, updated by scheduler.
809  */
810 #define	SCD_QUEUE_RDPTR(x)	(SCD_START_OFFSET + 0x64 + (x) * 4)
811 #define	SCD_SETQUEUENUM		(SCD_START_OFFSET + 0xa4)
812 #define	SCD_SET_TXSTAT_TXED	(SCD_START_OFFSET + 0xa8)
813 #define	SCD_SET_TXSTAT_DONE	(SCD_START_OFFSET + 0xac)
814 #define	SCD_SET_TXSTAT_NOT_SCHD	(SCD_START_OFFSET + 0xb0)
815 #define	SCD_DECREASE_CREDIT	(SCD_START_OFFSET + 0xb4)
816 #define	SCD_DECREASE_SCREDIT	(SCD_START_OFFSET + 0xb8)
817 #define	SCD_LOAD_CREDIT		(SCD_START_OFFSET + 0xbc)
818 #define	SCD_LOAD_SCREDIT	(SCD_START_OFFSET + 0xc0)
819 #define	SCD_BAR			(SCD_START_OFFSET + 0xc4)
820 #define	SCD_BAR_DW0		(SCD_START_OFFSET + 0xc8)
821 #define	SCD_BAR_DW1		(SCD_START_OFFSET + 0xcc)
822 
823 /*
824  * Select which queues work in chain mode (1) vs. not (0).
825  * Use chain mode to build chains of aggregated frames.
826  * Bit fields:
827  * 31-16:  Reserved
828  * 15-00:  Mode, one bit for each queue -- 1: Chain mode, 0: one-at-a-time
829  * NOTE:  If driver sets up queue for chain mode, it should be also set up
830  *        Scheduler-ACK mode as well, via SCD_QUEUE_STATUS_BITS(x).
831  */
832 #define	SCD_QUERY_REQ		(SCD_START_OFFSET + 0xd8)
833 #define	SCD_QUERY_RES		(SCD_START_OFFSET + 0xdc)
834 #define	SCD_PENDING_FRAMES	(SCD_START_OFFSET + 0xe0)
835 
836 /*
837  * Select which queues interrupt driver when read pointer (index) increments.
838  * Bit fields:
839  * 31-16:  Reserved
840  * 15-00:  Interrupt enable, one bit for each queue -- 1: enabled, 0: disabled
841  * NOTE BMC:  THIS FUNCTIONALITY IS APPARENTLY A NO-OP.
842  */
843 #define	SCD_INTERRUPT_THRESHOLD	(SCD_START_OFFSET + 0xe8)
844 #define	SCD_QUERY_MIN_FRAME_SIZE	(SCD_START_OFFSET + 0x100)
845 
846 
847 /*
848  * SP internal SRAM structures for scheduler, shared with driver ...
849  * Driver should clear and initialize the following areas after receiving
850  * "Alive" response from SP uCode, i.e. after initial
851  * uCode load, or after a uCode load done for error recovery:
852  *
853  * SCD_CONTEXT_DATA_OFFSET (size 128 bytes)
854  * SCD_TX_STTS_BITMAP_OFFSET (size 256 bytes)
855  * SCD_TRANSLATE_TBL_OFFSET (size 32 bytes)
856  *
857  * Driver reads base address of this scheduler area from SCD_SRAM_BASE_ADDR.
858  * All OFFSET values must be added to this base address.
859  * Use HBUS_TARG_MEM_* registers to access SRAM.
860  */
861 
862 /*
863  * Queue context.  One 8-byte entry for each of 16 queues.
864  *
865  * Driver should clear this entire area (size 0x80) to 0 after receiving
866  * "Alive" notification from uCode.  Additionally, driver should init
867  * each queue's entry as follows:
868  *
869  * LS Dword bit fields:
870  *  0-06:  Max Tx window size for Scheduler-ACK.  Driver should init to 64.
871  *
872  * MS Dword bit fields:
873  * 16-22:  Frame limit.  Driver should init to 10 (0xa).
874  *
875  * Driver should init all other bits to 0.
876  *
877  * Init must be done after driver receives "Alive" response from SP uCode,
878  * and when setting up queue for aggregation.
879  */
880 #define	SCD_CONTEXT_DATA_OFFSET		0x380
881 
882 /*
883  * Tx Status Bitmap
884  *
885  * Driver should clear this entire area (size 0x100) to 0 after receiving
886  * "Alive" notification from uCode.  Area is used only by device itself;
887  * no other support (besides clearing) is required from driver.
888  */
889 #define	SCD_TX_STTS_BITMAP_OFFSET	0x400
890 
891 /*
892  * RAxTID to queue translation mapping.
893  *
894  * When queue is in Scheduler-ACK mode, frames placed in a that queue must be
895  * for only one combination of receiver address (RA) and traffic ID (TID), i.e.
896  * one QOS priority level destined for one station (for this link, not final
897  * destination).  The SCD_TRANSLATE_TABLE area provides 16 16-bit mappings,
898  * one for each of the 16 queues.  If queue is not in Scheduler-ACK mode, the
899  * device ignores the mapping value.
900  *
901  * Bit fields, for each 16-bit map:
902  * 15-9:  Reserved, set to 0
903  *  8-4:  Index into device's station table for recipient station
904  *  3-0:  Traffic ID (tid), range 0-15
905  *
906  * Driver should clear this entire area (size 32 bytes) to 0 after receiving
907  * "Alive" notification from uCode.  To update a 16-bit map value, driver
908  * must read a dword-aligned value from device SRAM, replace the 16-bit map
909  * value of interest, and write the dword value back into device SRAM.
910  */
911 #define	SCD_TRANSLATE_TBL_OFFSET	0x500
912 #define	SCD_CONTEXT_QUEUE_OFFSET(x)	(SCD_CONTEXT_DATA_OFFSET + ((x) * 8))
913 #define	SCD_TRANSLATE_TBL_OFFSET_QUEUE(x) \
914 	((SCD_TRANSLATE_TBL_OFFSET + ((x) * 2)) & 0xfffffffc)
915 
916 /*
917  * Mask to enable contiguous Tx DMA/FIFO channels between "lo" and "hi".
918  */
919 #define	SCD_TXFACT_REG_TXFIFO_MASK(lo, hi) \
920 	((1<<(hi))|((1<<(hi))-(1<<(lo))))
921 
922 #define	SCD_MODE_REG_BIT_SEARCH_MODE		(1<<0)
923 #define	SCD_MODE_REG_BIT_SBYP_MODE		(1<<1)
924 
925 #define	SCD_TXFIFO_POS_TID			(0)
926 #define	SCD_TXFIFO_POS_RA			(4)
927 #define	SCD_QUEUE_STTS_REG_POS_SCD_ACK		(8)
928 #define	SCD_QUEUE_STTS_REG_POS_SCD_ACT_EN	(10)
929 
930 #define	SCD_QUEUE_RA_TID_MAP_RATID_MSK		(0x01FF)
931 
932 #define	SCD_QUEUE_CTX_REG1_WIN_SIZE_POS		(0)
933 #define	SCD_QUEUE_CTX_REG1_WIN_SIZE_MSK		(0x0000007F)
934 #define	SCD_QUEUE_CTX_REG1_CREDIT_POS		(8)
935 #define	SCD_QUEUE_CTX_REG1_CREDIT_MSK		(0x00FFFF00)
936 #define	SCD_QUEUE_CTX_REG1_SUPER_CREDIT_POS	(24)
937 #define	SCD_QUEUE_CTX_REG1_SUPER_CREDIT_MSK	(0xFF000000)
938 #define	SCD_QUEUE_CTX_REG2_FRAME_LIMIT_POS	(16)
939 #define	SCD_QUEUE_CTX_REG2_FRAME_LIMIT_MSK	(0x007F0000)
940 
941 #define	CSR_HW_IF_CONFIG_REG_BIT_KEDRON_R	(0x00000010)
942 #define	CSR_HW_IF_CONFIG_REG_MSK_BOARD_VER	(0x00000C00)
943 #define	CSR_HW_IF_CONFIG_REG_BIT_MAC_SI		(0x00000100)
944 #define	CSR_HW_IF_CONFIG_REG_BIT_RADIO_SI	(0x00000200)
945 #define	CSR_HW_IF_CONFIG_REG_EEP_SEM		(0x00200000)
946 #define	IWH_CSR_ANA_PLL_CFG			(0x00880300)
947 #define	CSR_DBG_HPET_MEM_REG_VAL		(0xFFFF0000)
948 
949 /* IWH-END */
950 
951 
952 #define	STATISTICS_FLG_CLEAR				(0x1)
953 #define	STATISTICS_FLG_DISABLE_NOTIFICATION		(0x2)
954 
955 #define	STATISTICS_REPLY_FLG_CLEAR			(0x1)
956 #define	STATISTICS_REPLY_FLG_BAND_24G_MSK		(0x2)
957 #define	STATISTICS_REPLY_FLG_TGJ_NARROW_BAND_MSK	(0x4)
958 #define	STATISTICS_REPLY_FLG_FAT_MODE_MSK		(0x8)
959 #define	RX_PHY_FLAGS_ANTENNAE_OFFSET			(4)
960 #define	RX_PHY_FLAGS_ANTENNAE_MASK			(0x70)
961 
962 /*
963  * Register and values
964  */
965 #define	CSR_BASE	(0x0)
966 #define	HBUS_BASE	(0x400)
967 
968 #define	HBUS_TARG_MBX_C	(HBUS_BASE+0x030)
969 
970 /*
971  * CSR (control and status registers)
972  */
973 #define	CSR_SW_VER		(CSR_BASE+0x000)
974 #define	CSR_HW_IF_CONFIG_REG	(CSR_BASE+0x000) /* hardware interface config */
975 #define	CSR_INT_COALESCING	(CSR_BASE+0x004) /* accum ints, 32-usec units */
976 #define	CSR_INT		(CSR_BASE+0x008) /* host interrupt status/ack */
977 #define	CSR_INT_MASK	(CSR_BASE+0x00c) /* host interrupt enable */
978 #define	CSR_FH_INT_STATUS	(CSR_BASE+0x010) /* busmaster int status/ack */
979 #define	CSR_GPIO_IN	(CSR_BASE+0x018) /* read external chip pins */
980 #define	CSR_RESET	(CSR_BASE+0x020) /* busmaster enable, NMI, etc */
981 #define	CSR_GP_CNTRL	(CSR_BASE+0x024)
982 #define	CSR_HW_REV	(CSR_BASE+0x028)
983 #define	CSR_EEPROM_REG	(CSR_BASE+0x02c)
984 #define	CSR_EEPROM_GP	(CSR_BASE+0x030)
985 #define	CSR_UCODE_DRV_GP1	(CSR_BASE+0x054)
986 #define	CSR_UCODE_DRV_GP1_SET	(CSR_BASE+0x058)
987 #define	CSR_UCODE_DRV_GP1_CLR	(CSR_BASE+0x05c)
988 #define	CSR_UCODE_DRV_GP2	(CSR_BASE+0x060)
989 #define	CSR_GIO_CHICKEN_BITS	(CSR_BASE+0x100)
990 #define	CSR_ANA_PLL_CFG		(CSR_BASE+0x20c)
991 #define	CSR_HW_REV_WA_REG	(CSR_BASE+0x22C)
992 #define	CSR_DBG_HPET_MEM_REG	(CSR_BASE+0x240)
993 
994 /*
995  * BSM (Bootstrap State Machine)
996  */
997 #define	BSM_BASE		(CSR_BASE + 0x3400)
998 
999 #define	BSM_WR_CTRL_REG  	(BSM_BASE + 0x000) /* ctl and status */
1000 #define	BSM_WR_MEM_SRC_REG 	(BSM_BASE + 0x004) /* source in BSM mem */
1001 #define	BSM_WR_MEM_DST_REG 	(BSM_BASE + 0x008) /* dest in SRAM mem */
1002 #define	BSM_WR_DWCOUNT_REG 	(BSM_BASE + 0x00C) /* bytes */
1003 #define	BSM_WR_STATUS_REG	(BSM_BASE + 0x010) /* bit 0:  1 == done */
1004 
1005 /*
1006  * BSM special memory, stays powered during power-save sleeps
1007  */
1008 #define	BSM_SRAM_LOWER_BOUND	(CSR_BASE + 0x3800)
1009 #define	BSM_SRAM_SIZE		(1024)
1010 
1011 
1012 /*
1013  * card static random access memory (SRAM) for processor data and instructs
1014  */
1015 #define	RTC_INST_LOWER_BOUND		(0x00000)
1016 #define	ALM_RTC_INST_UPPER_BOUND 	(0x14000)
1017 
1018 #define	RTC_DATA_LOWER_BOUND		(0x800000)
1019 #define	ALM_RTC_DATA_UPPER_BOUND	(0x808000)
1020 
1021 /*
1022  * HBUS (Host-side bus)
1023  */
1024 #define	HBUS_TARG_MEM_RADDR 	(HBUS_BASE+0x00c)
1025 #define	HBUS_TARG_MEM_WADDR 	(HBUS_BASE+0x010)
1026 #define	HBUS_TARG_MEM_WDAT	(HBUS_BASE+0x018)
1027 #define	HBUS_TARG_MEM_RDAT	(HBUS_BASE+0x01c)
1028 #define	HBUS_TARG_PRPH_WADDR	(HBUS_BASE+0x044)
1029 #define	HBUS_TARG_PRPH_RADDR	(HBUS_BASE+0x048)
1030 #define	HBUS_TARG_PRPH_WDAT 	(HBUS_BASE+0x04c)
1031 #define	HBUS_TARG_PRPH_RDAT 	(HBUS_BASE+0x050)
1032 #define	HBUS_TARG_WRPTR		(HBUS_BASE+0x060)
1033 
1034 /*
1035  * HW I/F configuration
1036  */
1037 #define	CSR_HW_IF_CONFIG_REG_BIT_ALMAGOR_MB	(0x00000100)
1038 #define	CSR_HW_IF_CONFIG_REG_BIT_ALMAGOR_MM	(0x00000200)
1039 #define	CSR_HW_IF_CONFIG_REG_BIT_SKU_MRC	(0x00000400)
1040 #define	CSR_HW_IF_CONFIG_REG_BIT_BOARD_TYPE	(0x00000800)
1041 #define	CSR_HW_IF_CONFIG_REG_BITS_SILICON_TYPE_A	(0x00000000)
1042 #define	CSR_HW_IF_CONFIG_REG_BITS_SILICON_TYPE_B	(0x00001000)
1043 #define	CSR_HW_IF_CONFIG_REG_BITS_NIC_READY		(0x00400000)
1044 #define	CSR_HW_IF_CONFIG_REG_BITS_HAP_WAKE_L1A		(0x00080000)
1045 #define	CSR_HW_IF_CONFIG_REG_BITS_NIC_PREPARE_DONE	(0x02000000)
1046 #define	CSR_HW_IF_CONFIG_REG_BITS_PREPARE		(0x08000000)
1047 
1048 #define	CSR_UCODE_DRV_GP1_BIT_MAC_SLEEP    	(0x00000001)
1049 #define	CSR_UCODE_SW_BIT_RFKILL			(0x00000002)
1050 #define	CSR_UCODE_DRV_GP1_BIT_CMD_BLOCKED   	(0x00000004)
1051 #define	CSR_UCODE_DRV_GP1_REG_BIT_CT_KILL_EXIT	(0x00000008)
1052 
1053 #define	CSR_GPIO_IN_BIT_AUX_POWER	(0x00000200)
1054 #define	CSR_GPIO_IN_VAL_VAUX_PWR_SRC	(0x00000000)
1055 #define	CSR_GIO_CHICKEN_BITS_REG_BIT_L1A_NO_L0S_RX  (0x00800000)
1056 #define	CSR_GIO_CHICKEN_BITS_REG_BIT_DIS_L0S_EXIT_TIMER  (0x20000000)
1057 #define	CSR_GPIO_IN_VAL_VMAIN_PWR_SRC	CSR_GPIO_IN_BIT_AUX_POWER
1058 
1059 #define	PCI_CFG_PMC_PME_FROM_D3COLD_SUPPORT	(0x80000000)
1060 
1061 /*
1062  * interrupt flags in INTA, set by uCode or hardware (e.g. dma),
1063  * acknowledged (reset) by host writing "1" to flagged bits.
1064  */
1065 #define	BIT_INT_FH_RX \
1066 	(((uint32_t)1) << 31) /* Rx DMA, cmd responses, FH_INT[17:16] */
1067 #define	BIT_INT_ERR	(1<<29) /* DMA hardware error FH_INT[31] */
1068 #define	BIT_INT_FH_TX	(1<<27) /* Tx DMA FH_INT[1:0] */
1069 #define	BIT_INT_MAC_CLK_ACTV (1<<26) /* NIC controller's clock toggled on/off */
1070 #define	BIT_INT_SWERROR	(1<<25) /* uCode error */
1071 #define	BIT_INT_RF_KILL	(1<<7)  /* HW RFKILL switch GP_CNTRL[27] toggled */
1072 #define	BIT_INT_CT_KILL	(1<<6)  /* Critical temp (chip too hot) rfkill */
1073 #define	BIT_INT_SW_RX 	(1<<3)  /* Rx, command responses, 3945 */
1074 #define	BIT_INT_WAKEUP 	(1<<1)  /* NIC controller waking up (pwr mgmt) */
1075 #define	BIT_INT_ALIVE 	(1<<0)  /* uCode interrupts once it initializes */
1076 
1077 #define	CSR_INI_SET_MASK	(BIT_INT_FH_RX   |  \
1078 				BIT_INT_ERR |      \
1079 				BIT_INT_FH_TX   |  \
1080 				BIT_INT_SWERROR |  \
1081 				BIT_INT_RF_KILL |  \
1082 				BIT_INT_SW_RX   |  \
1083 				BIT_INT_WAKEUP  |  \
1084 				BIT_INT_ALIVE)
1085 
1086 /*
1087  * interrupt flags in FH (flow handler) (PCI busmaster DMA)
1088  */
1089 #define	BIT_FH_INT_ERR		(((uint32_t)1) << 31) /* Error */
1090 #define	BIT_FH_INT_HI_PRIOR	(1<<30) /* High priority Rx,bypass coalescing */
1091 #define	BIT_FH_INT_RX_CHNL2	(1<<18) /* Rx channel 2 (3945 only) */
1092 #define	BIT_FH_INT_RX_CHNL1	(1<<17) /* Rx channel 1 */
1093 #define	BIT_FH_INT_RX_CHNL0	(1<<16) /* Rx channel 0 */
1094 #define	BIT_FH_INT_TX_CHNL6	(1<<6)  /* Tx channel 6 (3945 only) */
1095 #define	BIT_FH_INT_TX_CHNL1	(1<<1)  /* Tx channel 1 */
1096 #define	BIT_FH_INT_TX_CHNL0	(1<<0)  /* Tx channel 0 */
1097 
1098 #define	FH_INT_RX_MASK		(BIT_FH_INT_HI_PRIOR |  \
1099 				BIT_FH_INT_RX_CHNL1 |  \
1100 				BIT_FH_INT_RX_CHNL0)
1101 
1102 #define	FH_INT_TX_MASK		(BIT_FH_INT_TX_CHNL6 |  \
1103 				BIT_FH_INT_TX_CHNL1 |  \
1104 				BIT_FH_INT_TX_CHNL0)
1105 
1106 /*
1107  * RESET
1108  */
1109 #define	CSR_RESET_REG_FLAG_NEVO_RESET		(0x00000001)
1110 #define	CSR_RESET_REG_FLAG_FORCE_NMI		(0x00000002)
1111 #define	CSR_RESET_REG_FLAG_SW_RESET		(0x00000080)
1112 #define	CSR_RESET_REG_FLAG_MASTER_DISABLED	(0x00000100)
1113 #define	CSR_RESET_REG_FLAG_STOP_MASTER  	(0x00000200)
1114 
1115 /*
1116  * GP (general purpose) CONTROL
1117  */
1118 #define	CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY	(0x00000001)
1119 #define	CSR_GP_CNTRL_REG_FLAG_INIT_DONE   	(0x00000004)
1120 #define	CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ 	(0x00000008)
1121 #define	CSR_GP_CNTRL_REG_FLAG_GOING_TO_SLEEP 	(0x00000010)
1122 
1123 #define	CSR_GP_CNTRL_REG_VAL_MAC_ACCESS_EN	(0x00000001)
1124 
1125 #define	CSR_GP_CNTRL_REG_MSK_POWER_SAVE_TYPE	(0x07000000)
1126 #define	CSR_GP_CNTRL_REG_FLAG_MAC_POWER_SAVE	(0x04000000)
1127 #define	CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW 	(0x08000000)
1128 
1129 /*
1130  * APMG (power management) constants
1131  */
1132 #define	APMG_CLK_CTRL_REG  	(0x003000)
1133 #define	ALM_APMG_CLK_EN  	(0x003004)
1134 #define	ALM_APMG_CLK_DIS   	(0x003008)
1135 #define	ALM_APMG_PS_CTL    	(0x00300c)
1136 #define	ALM_APMG_PCIDEV_STT	(0x003010)
1137 #define	ALM_APMG_RFKILL    	(0x003014)
1138 #define	ALM_APMG_LARC_INT 	(0x00301c)
1139 #define	ALM_APMG_LARC_INT_MSK	(0x003020)
1140 
1141 #define	APMG_CLK_REG_VAL_DMA_CLK_RQT	(0x00000200)
1142 #define	APMG_CLK_REG_VAL_BSM_CLK_RQT	(0x00000800)
1143 
1144 #define	APMG_PS_CTRL_REG_VAL_ALM_R_RESET_REQ	(0x04000000)
1145 
1146 #define	APMG_DEV_STATE_REG_VAL_L1_ACTIVE_DISABLE	(0x00000800)
1147 
1148 #define	APMG_PS_CTRL_REG_MSK_POWER_SRC		(0x03000000)
1149 #define	APMG_PS_CTRL_REG_VAL_POWER_SRC_VMAIN	(0x00000000)
1150 #define	APMG_PS_CTRL_REG_VAL_POWER_SRC_VAUX	(0x01000000)
1151 
1152 /*
1153  * BSM (bootstrap state machine)
1154  */
1155 /*
1156  * start boot load now
1157  */
1158 #define	BSM_WR_CTRL_REG_BIT_START	(0x80000000)
1159 /*
1160  * enable boot after power up
1161  */
1162 #define	BSM_WR_CTRL_REG_BIT_START_EN	(0x40000000)
1163 
1164 /*
1165  * DBM
1166  */
1167 #define	ALM_FH_SRVC_CHNL				(6)
1168 #define	IWH_FH_SRVC_LOWER_BOUND		(IWH_FH_REGS_LOWER_BOUND + 0x9C8)
1169 #define	IWH_FH_SRVC_CHNL		(9)
1170 
1171 
1172 #define	IWH_FH_SRVC_CHNL_SRAM_ADDR_REG(_chnl)\
1173 	(IWH_FH_SRVC_LOWER_BOUND + (_chnl - 9) * 0x4)
1174 
1175 #define	ALM_FH_RCSR_RX_CONFIG_REG_POS_RBDC_SIZE		(20)
1176 #define	ALM_FH_RCSR_RX_CONFIG_REG_POS_IRQ_RBTH		(4)
1177 
1178 #define	ALM_FH_RCSR_RX_CONFIG_REG_BIT_WR_STTS_EN		(0x08000000)
1179 #define	ALM_FH_RCSR_RX_CONFIG_REG_VAL_DMA_CHNL_EN_ENABLE	(0x80000000)
1180 #define	ALM_FH_RCSR_RX_CONFIG_REG_VAL_RDRBD_EN_ENABLE		(0x20000000)
1181 #define	ALM_FH_RCSR_RX_CONFIG_REG_VAL_MAX_FRAG_SIZE_128		(0x01000000)
1182 #define	ALM_FH_RCSR_RX_CONFIG_REG_VAL_IRQ_DEST_INT_HOST		(0x00001000)
1183 #define	ALM_FH_RCSR_RX_CONFIG_REG_VAL_MSG_MODE_FH		(0x00000000)
1184 #define	ALM_FH_TCSR_TX_CONFIG_REG_VAL_MSG_MODE_TXF		(0x00000000)
1185 #define	ALM_FH_TCSR_TX_CONFIG_REG_VAL_MSG_MODE_DRIVER		(0x00000001)
1186 #define	ALM_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_DISABLE_VAL	(0x00000000)
1187 #define	ALM_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_ENABLE_VAL	(0x00000008)
1188 #define	ALM_FH_TCSR_TX_CONFIG_REG_VAL_CIRQ_HOST_IFTFD		(0x00200000)
1189 #define	ALM_FH_TCSR_TX_CONFIG_REG_VAL_CIRQ_RTC_NOINT		(0x00000000)
1190 #define	ALM_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_PAUSE		(0x00000000)
1191 #define	ALM_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_ENABLE		(0x80000000)
1192 #define	ALM_FH_TCSR_CHNL_TX_BUF_STS_REG_VAL_TFDB_VALID		(0x00004000)
1193 #define	ALM_FH_TCSR_CHNL_TX_BUF_STS_REG_BIT_TFDB_WPTR		(0x00000001)
1194 #define	ALM_FH_TSSR_TX_MSG_CONFIG_REG_VAL_SNOOP_RD_TXPD_ON	(0xFF000000)
1195 #define	ALM_FH_TSSR_TX_MSG_CONFIG_REG_VAL_ORDER_RD_TXPD_ON	(0x00FF0000)
1196 #define	ALM_FH_TSSR_TX_MSG_CONFIG_REG_VAL_MAX_FRAG_SIZE_128B	(0x00000400)
1197 #define	ALM_FH_TSSR_TX_MSG_CONFIG_REG_VAL_SNOOP_RD_TFD_ON	(0x00000100)
1198 #define	ALM_FH_TSSR_TX_MSG_CONFIG_REG_VAL_ORDER_RD_CBB_ON	(0x00000080)
1199 #define	ALM_FH_TSSR_TX_MSG_CONFIG_REG_VAL_ORDER_RSP_WAIT_TH	(0x00000020)
1200 #define	ALM_FH_TSSR_TX_MSG_CONFIG_REG_VAL_RSP_WAIT_TH		(0x00000005)
1201 
1202 #define	ALM_TB_MAX_BYTES_COUNT	(0xFFF0)
1203 
1204 #define	ALM_FH_TSSR_TX_STATUS_REG_BIT_BUFS_EMPTY(_channel) \
1205 	((1LU << _channel) << 24)
1206 #define	ALM_FH_TSSR_TX_STATUS_REG_BIT_NO_PEND_REQ(_channel) \
1207 	((1LU << _channel) << 16)
1208 
1209 #define	ALM_FH_TSSR_TX_STATUS_REG_MSK_CHNL_IDLE(_channel) \
1210 	(ALM_FH_TSSR_TX_STATUS_REG_BIT_BUFS_EMPTY(_channel) | \
1211 	ALM_FH_TSSR_TX_STATUS_REG_BIT_NO_PEND_REQ(_channel))
1212 #define	PCI_CFG_REV_ID_BIT_BASIC_SKU	(0x40)	/* bit 6 */
1213 #define	PCI_CFG_REV_ID_BIT_RTP		(0x80)	/* bit 7 */
1214 #define	PCI_CFG_RETRY_TIMEOUT		(0x41)
1215 
1216 #define	HBUS_TARG_MBX_C_REG_BIT_CMD_BLOCKED	(0x00000004)
1217 
1218 #define	TFD_QUEUE_MIN		0
1219 #define	TFD_QUEUE_MAX		6
1220 #define	TFD_QUEUE_SIZE_MAX	(256)
1221 
1222 /*
1223  * spectrum and channel data structures
1224  */
1225 #define	IWH_NUM_SCAN_RATES	(2)
1226 
1227 #define	IWH_SCAN_FLAG_24GHZ  (1<<0)
1228 #define	IWH_SCAN_FLAG_52GHZ  (1<<1)
1229 #define	IWH_SCAN_FLAG_ACTIVE (1<<2)
1230 #define	IWH_SCAN_FLAG_DIRECT (1<<3)
1231 
1232 #define	IWH_MAX_CMD_SIZE 1024
1233 
1234 #define	IWH_DEFAULT_TX_RETRY	15
1235 #define	IWH_MAX_TX_RETRY	16
1236 
1237 #define	RFD_SIZE	4
1238 #define	NUM_TFD_CHUNKS	4
1239 
1240 #define	RX_QUEUE_SIZE		256
1241 #define	RX_QUEUE_SIZE_LOG	8
1242 
1243 /*
1244  * TX Queue Flag Definitions
1245  */
1246 /*
1247  * use short preamble
1248  */
1249 #define	DCT_FLAG_LONG_PREAMBLE	0x00
1250 #define	DCT_FLAG_SHORT_PREAMBLE	0x04
1251 
1252 /*
1253  * ACK rx is expected to follow
1254  */
1255 #define	DCT_FLAG_ACK_REQD		0x80
1256 
1257 #define	IWH_MB_DISASSOCIATE_THRESHOLD_DEFAULT	24
1258 #define	IWH_MB_ROAMING_THRESHOLD_DEFAULT		8
1259 #define	IWH_REAL_RATE_RX_PACKET_THRESHOLD		300
1260 
1261 /*
1262  * QoS  definitions
1263  */
1264 
1265 #define	AC_NUM		(4)	/* the number of access category */
1266 
1267 /*
1268  * index of every AC in firmware
1269  */
1270 #define	QOS_AC_BK	(0)
1271 #define	QOS_AC_BE	(1)
1272 #define	QOS_AC_VI	(2)
1273 #define	QOS_AC_VO	(3)
1274 #define	QOS_AC_INVALID	(-1)
1275 
1276 #define	QOS_CW_RANGE_MIN	(0)	/* exponential of 2 */
1277 #define	QOS_CW_RANGE_MAX	(15)	/* exponential of 2 */
1278 #define	QOS_TXOP_MIN		(0)	/* unit of 32 microsecond */
1279 #define	QOS_TXOP_MAX		(255)	/* unit of 32 microsecond */
1280 #define	QOS_AIFSN_MIN		(2)
1281 #define	QOS_AIFSN_MAX		(15)	/* undefined */
1282 
1283 /*
1284  * masks for flags of QoS parameter command
1285  */
1286 #define	QOS_PARAM_FLG_UPDATE_EDCA	(0x01)
1287 #define	QOS_PARAM_FLG_TGN		(0x02)
1288 
1289 /*
1290  * index of TX queue for every AC
1291  */
1292 #define	QOS_AC_BK_TO_TXQ	(3)
1293 #define	QOS_AC_BE_TO_TXQ	(2)
1294 #define	QOS_AC_VI_TO_TXQ	(1)
1295 #define	QOS_AC_VO_TO_TXQ	(0)
1296 #define	TXQ_FOR_AC_MIN		(0)
1297 #define	TXQ_FOR_AC_MAX		(3)
1298 #define	TXQ_FOR_AC_INVALID	(-1)
1299 #define	NON_QOS_TXQ		QOS_AC_BE_TO_TXQ
1300 #define	QOS_TXQ_FOR_MGT		QOS_AC_VO_TO_TXQ
1301 
1302 #define	WME_TID_MIN	(0)
1303 #define	WME_TID_MAX	(7)
1304 #define	WME_TID_INVALID	(-1)
1305 
1306 /*
1307  * HT definitions
1308  */
1309 
1310 /*
1311  * HT capabilities masks
1312  */
1313 #define	HT_CAP_SUP_WIDTH	(0x0002)
1314 #define	HT_CAP_MIMO_PS		(0x000c)
1315 #define	HT_CAP_GRN_FLD		(0x0010)
1316 #define	HT_CAP_SGI_20		(0x0020)
1317 #define	HT_CAP_SGI_40		(0x0040)
1318 #define	HT_CAP_DELAY_BA		(0x0400)
1319 #define	HT_CAP_MAX_AMSDU	(0x0800)
1320 #define	HT_CAP_MCS_TX_DEFINED	(0x01)
1321 #define	HT_CAP_MCS_TX_RX_DIFF	(0x02)
1322 #define	HT_CAP_MCS_TX_STREAMS	(0x0c)
1323 #define	HT_CAP_MCS_TX_UEQM	(0x10)
1324 
1325 #define	HT_CAP_MIMO_PS_STATIC	(0)
1326 #define	HT_CAP_MIMO_PS_DYNAMIC	(1)
1327 #define	HT_CAP_MIMO_PS_INVALID	(2)
1328 #define	HT_CAP_MIMO_PS_NONE	(3)
1329 
1330 #define	HT_RX_AMPDU_FACTOR_8K	(0x0)
1331 #define	HT_RX_AMPDU_FACTOR_16K	(0x1)
1332 #define	HT_RX_AMPDU_FACTOR_32K	(0x2)
1333 #define	HT_RX_AMPDU_FACTOR_64K	(0x3)
1334 #define	HT_RX_AMPDU_FACTOR	HT_RX_AMPDU_FACTOR_8K
1335 #define	HT_RX_AMPDU_FACTOR_MSK	(0x3)
1336 
1337 #define	HT_MPDU_DENSITY_4USEC	(0x5)
1338 #define	HT_MPDU_DENSITY_8USEC	(0x6)
1339 #define	HT_MPDU_DENSITY		HT_MPDU_DENSITY_4USEC
1340 #define	HT_MPDU_DENSITY_MSK	(0x1c)
1341 #define	HT_MPDU_DENSITY_POS	(2)
1342 
1343 #define	HT_RATESET_NUM		(16)
1344 #define	HT_1CHAIN_RATE_MIN_IDX	(0x0)
1345 #define	HT_1CHAIN_RATE_MAX_IDX	(0x7)
1346 #define	HT_2CHAIN_RATE_MIN_IDX	(0x8)
1347 #define	HT_2CHAIN_RATE_MAX_IDX	(0xf)
1348 
1349 struct iwh_ampdu_param {
1350 	uint8_t	factor;
1351 	uint8_t	density;
1352 };
1353 
1354 typedef	struct iwh_ht_conf {
1355 	uint8_t			ht_support;
1356 	uint16_t		cap;
1357 	struct iwh_ampdu_param	ampdu_p;
1358 	uint8_t			tx_support_mcs[HT_RATESET_NUM];
1359 	uint8_t			rx_support_mcs[HT_RATESET_NUM];
1360 	uint8_t			valid_chains;
1361 	uint8_t			tx_stream_count;
1362 	uint8_t			rx_stream_count;
1363 	uint8_t			ht_protection;
1364 } iwh_ht_conf_t;
1365 
1366 #define	NO_HT_PROT		(0)
1367 #define	HT_PROT_CHAN_NON_HT	(1)
1368 #define	HT_PROT_FAT		(2)
1369 #define	HT_PROT_ASSOC_NON_HT	(3)
1370 
1371 /*
1372  * HT flags for RXON command.
1373  */
1374 #define	RXON_FLG_CONTROL_CHANNEL_LOCATION_MSK	0x400000
1375 #define	RXON_FLG_CONTROL_CHANNEL_LOC_LOW_MSK	0x000000
1376 #define	RXON_FLG_CONTROL_CHANNEL_LOC_HIGH_MSK	0x400000
1377 
1378 #define	RXON_FLG_HT_OPERATING_MODE_POS		(23)
1379 #define	RXON_FLG_HT_PROT_MSK			0x800000
1380 #define	RXON_FLG_FAT_PROT_MSK			0x1000000
1381 
1382 #define	RXON_FLG_CHANNEL_MODE_POS		(25)
1383 #define	RXON_FLG_CHANNEL_MODE_MSK		0x06000000
1384 #define	RXON_FLG_CHANNEL_MODE_LEGACY_MSK	0x00000000
1385 #define	RXON_FLG_CHANNEL_MODE_PURE_40_MSK	0x02000000
1386 #define	RXON_FLG_CHANNEL_MODE_MIXED_MSK		0x04000000
1387 
1388 #define	RXON_RX_CHAIN_DRIVER_FORCE_MSK		(0x1<<0)
1389 #define	RXON_RX_CHAIN_VALID_MSK			(0x7<<1)
1390 #define	RXON_RX_CHAIN_VALID_POS			(1)
1391 #define	RXON_RX_CHAIN_FORCE_SEL_MSK		(0x7<<4)
1392 #define	RXON_RX_CHAIN_FORCE_SEL_POS		(4)
1393 #define	RXON_RX_CHAIN_FORCE_MIMO_SEL_MSK	(0x7<<7)
1394 #define	RXON_RX_CHAIN_FORCE_MIMO_SEL_POS	(7)
1395 #define	RXON_RX_CHAIN_CNT_MSK			(0x3<<10)
1396 #define	RXON_RX_CHAIN_CNT_POS			(10)
1397 #define	RXON_RX_CHAIN_MIMO_CNT_MSK		(0x3<<12)
1398 #define	RXON_RX_CHAIN_MIMO_CNT_POS		(12)
1399 #define	RXON_RX_CHAIN_MIMO_FORCE_MSK		(0x1<<14)
1400 #define	RXON_RX_CHAIN_MIMO_FORCE_POS		(14)
1401 #define	RXON_RX_CHAIN_A_MSK			(1)
1402 #define	RXON_RX_CHAIN_B_MSK			(2)
1403 #define	RXON_RX_CHAIN_C_MSK			(4)
1404 
1405 /*
1406  * Generic queue structure
1407  *
1408  * Contains common data for Rx and Tx queues
1409  */
1410 #define	TFD_CTL_COUNT_SET(n)	(n<<24)
1411 #define	TFD_CTL_COUNT_GET(ctl)	((ctl>>24) & 7)
1412 #define	TFD_CTL_PAD_SET(n)	(n<<28)
1413 #define	TFD_CTL_PAD_GET(ctl)	(ctl>>28)
1414 
1415 #define	TFD_TX_CMD_SLOTS 64
1416 #define	TFD_CMD_SLOTS 32
1417 
1418 /*
1419  * Tx/Rx Queues
1420  *
1421  * Most communication between driver and SP is via queues of data buffers.
1422  * For example, all commands that the driver issues to device's embedded
1423  * controller (uCode) are via the command queue (one of the Tx queues).  All
1424  * uCode command responses/replies/notifications, including Rx frames, are
1425  * conveyed from uCode to driver via the Rx queue.
1426  *
1427  * Most support for these queues, including handshake support, resides in
1428  * structures in host DRAM, shared between the driver and the device.  When
1429  * allocating this memory, the driver must make sure that data written by
1430  * the host CPU updates DRAM immediately (and does not get "stuck" in CPU's
1431  * cache memory), so DRAM and cache are consistent, and the device can
1432  * immediately see changes made by the driver.
1433  *
1434  * SP supports up to 16 DRAM-based Tx queues, and services these queues via
1435  * up to 7 DMA channels (FIFOs).  Each Tx queue is supported by a circular array
1436  * in DRAM containing 256 Transmit Frame Descriptors (TFDs).
1437  */
1438 #define	IWH_MAX_WIN_SIZE	64
1439 #define	IWH_QUEUE_SIZE	256
1440 #define	IWH_NUM_FIFOS	7
1441 #define	IWH_NUM_QUEUES	20
1442 #define	IWH_CMD_QUEUE_NUM	4
1443 #define	IWH_KW_SIZE 0x1000	/* 4k */
1444 #define	IWH_CMD_FIFO_NUM	7
1445 
1446 struct iwh_rate {
1447 	union {
1448 		struct {
1449 			uint8_t rate;
1450 			uint8_t flags;
1451 			uint16_t ext_flags;
1452 		} s;
1453 		uint32_t rate_n_flags;
1454 	} r;
1455 };
1456 
1457 struct iwh_dram_scratch {
1458 	uint8_t try_cnt;
1459 	uint8_t bt_kill_cnt;
1460 	uint16_t reserved;
1461 };
1462 
1463 
1464 struct iwh_tx_power {
1465 	uint8_t tx_gain;	/* gain for analog radio */
1466 	uint8_t dsp_atten;	/* gain for DSP */
1467 };
1468 
1469 
1470 union iwh_tx_power_triple_stream {
1471 	struct {
1472 		uint8_t radio_tx_gain[3];
1473 		uint8_t reserved1;
1474 		uint8_t dsp_predis_atten[3];
1475 		uint8_t reserved2;
1476 	}s;
1477 	uint32_t val1;
1478 	uint32_t val2;
1479 };
1480 
1481 struct iwh_tx_power_db {
1482 	union	iwh_tx_power_triple_stream ht_ofdm_power[24];
1483 	union	iwh_tx_power_triple_stream cck_power[2];
1484 };
1485 
1486 typedef struct iwh_tx_power_table_cmd {
1487 	uint8_t band;
1488 	uint8_t pa_measurements;
1489 	uint8_t channel;
1490 	uint8_t max_mcs;
1491 	struct iwh_tx_power_db	db;
1492 } iwh_tx_power_table_cmd_t;
1493 
1494 /*
1495  * Hardware rate scaling set by iwh_ap_lq function.
1496  * Given a particular initial rate and mode, the driver uses the
1497  * following formula to fill the rs_table[LINK_QUAL_MAX_RETRY_NUM]
1498  * rate table in the Link Quality command:
1499  *
1500  * 1) If using High-throughput(HT)(SISO or MIMO) initial rate:
1501  *    a) Use this same initial rate for first 3 entries.
1502  *    b) Find next lower available rate using same mode(SISO or MIMO),
1503  *	 use for next 3 entries. If no lower rate available, switch to
1504  *	 legacy mode(no FAT channel, no MIMO, no short guard interval).
1505  *    c) If using MIMO, set command's mimo_delimeter to number of
1506  *	 entries using MIMO(3 or 6).
1507  *    d) After trying 2 HT rates, switch to legacy mode(no FAT channel,
1508  *	 no MIMO, no short qguard interval), at the next lower bit rate
1509  *	 (e.g. if second HT bit rate was 54, try 48 legacy),and follow
1510  *   legacy procedure for remaining table entries.
1511  *
1512  * 2) If using legacy initial rate:
1513  *    a) Use the initial rate for only one entry.
1514  *    b) For each following entry, reduce the rate to next lower available
1515  *	 rate, until reaching the lowest available rate.
1516  *    c) When reducing rate, also switch antenna selection.
1517  *    b) Once lowest available rate is reached, repreat this rate until
1518  *   rate table is filled(16 entries),switching antenna each entry.
1519  */
1520 
1521 /*
1522  * OFDM HT rate masks
1523  */
1524 #define	R_MCS_6M_MSK 0x1
1525 #define	R_MCS_12M_MSK 0x2
1526 #define	R_MCS_18M_MSK 0x4
1527 #define	R_MCS_24M_MSK 0x8
1528 #define	R_MCS_36M_MSK 0x10
1529 #define	R_MCS_48M_MSK 0x20
1530 #define	R_MCS_54M_MSK 0x40
1531 #define	R_MCS_60M_MSK 0x80
1532 #define	R_MCS_12M_DUAL_MSK 0x100
1533 #define	R_MCS_24M_DUAL_MSK 0x200
1534 #define	R_MCS_36M_DUAL_MSK 0x400
1535 #define	R_MCS_48M_DUAL_MSK 0x800
1536 
1537 #define	RATE_MCS_CODE_MSK 0x7
1538 #define	RATE_MCS_MIMO_POS 3
1539 #define	RATE_MCS_MIMO_MSK 0x8
1540 #define	RATE_MCS_HT_DUP_POS 5
1541 #define	RATE_MCS_HT_DUP_MSK 0x20
1542 #define	RATE_MCS_FLAGS_POS 8
1543 #define	RATE_MCS_HT_POS 8
1544 #define	RATE_MCS_HT_MSK 0x100
1545 #define	RATE_MCS_CCK_POS 9
1546 #define	RATE_MCS_CCK_MSK 0x200
1547 #define	RATE_MCS_GF_POS 10
1548 #define	RATE_MCS_GF_MSK 0x400
1549 
1550 #define	RATE_MCS_FAT_POS 11
1551 #define	RATE_MCS_FAT_MSK 0x800
1552 #define	RATE_MCS_DUP_POS 12
1553 #define	RATE_MCS_DUP_MSK 0x1000
1554 #define	RATE_MCS_SGI_POS 13
1555 #define	RATE_MCS_SGI_MSK 0x2000
1556 
1557 #define	EEPROM_SEM_TIMEOUT 10
1558 #define	EEPROM_SEM_RETRY_LIMIT 1000
1559 
1560 /*
1561  * Antenna masks:
1562  * bit14:15 01 B inactive, A active
1563  *          10 B active, A inactive
1564  *          11 Both active
1565  */
1566 #define	RATE_MCS_ANT_A_POS	14
1567 #define	RATE_MCS_ANT_B_POS	15
1568 #define	RATE_MCS_ANT_A_MSK	0x4000
1569 #define	RATE_MCS_ANT_B_MSK	0x8000
1570 #define	RATE_MCS_ANT_AB_MSK	0xc000
1571 
1572 #define	is_legacy(tbl) (((tbl) == LQ_G) || ((tbl) == LQ_A))
1573 #define	is_siso(tbl) (((tbl) == LQ_SISO))
1574 #define	is_mimo(tbl) (((tbl) == LQ_MIMO))
1575 #define	is_Ht(tbl) (is_siso(tbl) || is_mimo(tbl))
1576 #define	is_a_band(tbl) (((tbl) == LQ_A))
1577 #define	is_g_and(tbl) (((tbl) == LQ_G))
1578 
1579 /*
1580  * RS_NEW_API: only TLC_RTS remains and moved to bit 0
1581  */
1582 #define	LINK_QUAL_FLAGS_SET_STA_TLC_RTS_MSK	(1<<0)
1583 
1584 #define	LINK_QUAL_AC_NUM 4
1585 #define	LINK_QUAL_MAX_RETRY_NUM 16
1586 
1587 #define	LINK_QUAL_ANT_A_MSK (1<<0)
1588 #define	LINK_QUAL_ANT_B_MSK (1<<1)
1589 #define	LINK_QUAL_ANT_MSK   (LINK_QUAL_ANT_A_MSK|LINK_QUAL_ANT_B_MSK)
1590 
1591 struct iwh_link_qual_general_params {
1592 	uint8_t flags;
1593 	uint8_t mimo_delimiter;
1594 	uint8_t single_stream_ant_msk;
1595 	uint8_t dual_stream_ant_msk;
1596 	uint8_t start_rate_index[LINK_QUAL_AC_NUM];
1597 };
1598 
1599 struct iwh_link_qual_agg_params {
1600 	uint16_t agg_time_limit;
1601 	uint8_t agg_dis_start_th;
1602 	uint8_t agg_frame_cnt_limit;
1603 	uint32_t reserved;
1604 };
1605 
1606 typedef struct iwh_link_quality_cmd {
1607 	uint8_t sta_id;
1608 	uint8_t reserved1;
1609 	uint16_t control;
1610 	struct iwh_link_qual_general_params general_params;
1611 	struct iwh_link_qual_agg_params agg_params;
1612 	uint32_t rate_n_flags[LINK_QUAL_MAX_RETRY_NUM];
1613 	uint32_t reserved2;
1614 } iwh_link_quality_cmd_t;
1615 
1616 struct	iwh_rx_mpdu_body_size {
1617 	uint16_t	byte_count;
1618 	uint16_t	reserved;
1619 };
1620 
1621 typedef struct iwh_rx_phy_res {
1622 	uint8_t non_cfg_phy_cnt;  /* non configurable DSP phy data byte count */
1623 	uint8_t cfg_phy_cnt;	/* configurable DSP phy data byte count */
1624 	uint8_t stat_id;	/* configurable DSP phy data set ID */
1625 	uint8_t reserved1;
1626 	uint32_t timestampl; /* TSF at on air rise */
1627 	uint32_t timestamph;
1628 	uint32_t beacon_time_stamp; /* beacon at on-air rise */
1629 	uint16_t phy_flags;	/* general phy flags: band, modulation, ... */
1630 	uint16_t channel;		/* channel number */
1631 	/* for various implementations of non_cfg_phy */
1632 	uint8_t	 non_cfg_phy[32];
1633 	struct iwh_rate rate;	/* rate in ucode internal format */
1634 	uint16_t byte_count;		/* frame's byte-count */
1635 	uint16_t reserved3;
1636 } iwh_rx_phy_res_t;
1637 
1638 struct iwh_rx_mpdu_res_start {
1639 	uint16_t byte_count;
1640 	uint16_t reserved;
1641 };
1642 
1643 #define	IWH_AGC_DB_MASK 	(0x3f80)	/* MASK(7,13) */
1644 #define	IWH_AGC_DB_POS	(7)
1645 
1646 #define	IWH_RX_RES_PHY_CNT	(8)
1647 #define	IWH_RX_RES_AGC_IDX	(1)
1648 #define	IWH_RX_RES_RSSI_AB_IDX	(2)
1649 #define	IWH_RX_RES_RSSI_C_IDX	(3)
1650 #define	IWH_OFDM_AGC_MSK	(0xFE00)
1651 #define	IWH_OFDM_AGC_BIT_POS	(9)
1652 #define	IWH_OFDM_RSSI_A_MSK	(0x00FF)
1653 #define	IWH_OFDM_RSSI_A_BIT_POS	(0)
1654 #define	IWH_OFDM_RSSI_B_MSK	(0xFF0000)
1655 #define	IWH_OFDM_RSSI_B_BIT_POS	(16)
1656 #define	IWH_OFDM_RSSI_C_MSK	(0x00FF)
1657 #define	IWH_OFDM_RSSI_C_BIT_POS	(0)
1658 #define	IWH_RSSI_OFFSET		(44)
1659 
1660 /*
1661  * Fixed (non-configurable) rx data from phy
1662  */
1663 struct iwh_rx_non_cfg_phy {
1664 	uint32_t non_cfg_phy[IWH_RX_RES_PHY_CNT];	/* upto 8 phy entries */
1665 };
1666 
1667 /*
1668  * Byte Count Table Entry
1669  *
1670  * Bit fields:
1671  * 15-12: reserved
1672  * 11- 0: total to-be-transmitted byte count of frame (does not include command)
1673  */
1674 struct iwh_queue_byte_cnt_entry {
1675 	uint16_t val;
1676 };
1677 
1678 /*
1679  * Byte Count table
1680  *
1681  * Each Tx queue uses a byte-count table containing 320 entries:
1682  * one 16-bit entry for each of 256 TFDs, plus an additional 64 entries that
1683  * duplicate the first 64 entries (to avoid wrap-around within a Tx window;
1684  * max Tx window is 64 TFDs).
1685  *
1686  * When driver sets up a new TFD, it must also enter the total byte count
1687  * of the frame to be transmitted into the corresponding entry in the byte
1688  * count table for the chosen Tx queue.  If the TFD index is 0-63, the driver
1689  * must duplicate the byte count entry in corresponding index 256-319.
1690  *
1691  * "dont_care" padding puts each byte count table on a 1024-byte boundary;
1692  * SP assumes tables are separated by 1024 bytes.
1693  */
1694 struct iwh_sched_queue_byte_cnt_tbl {
1695 	struct iwh_queue_byte_cnt_entry tfd_offset[IWH_QUEUE_SIZE +
1696 	    IWH_MAX_WIN_SIZE];
1697 };
1698 
1699 /*
1700  * struct iwh_shared, handshake area for Tx and Rx
1701  *
1702  * For convenience in allocating memory, this structure combines 2 areas of
1703  * DRAM which must be shared between driver and SP.  These do not need to
1704  * be combined, if better allocation would result from keeping them separate:
1705  * TODO:  Split these; carried over from 3945, doesn't work well for SP.
1706  *
1707  * 1)  The Tx byte count tables occupy 1024 bytes each (16 KBytes total for
1708  *     16 queues).  Driver uses SCD_DRAM_BASE_ADDR to tell SP where to find
1709  *     the first of these tables.  SP assumes tables are 1024 bytes apart.
1710  *
1711  * 2)  The Rx status (val0 and val1) occupies only 8 bytes.  Driver uses
1712  *     FH_RSCSR_CHNL0_STTS_WPTR_REG to tell SP where to find this area.
1713  *     Driver reads val0 to determine the latest Receive Buffer Descriptor (RBD)
1714  *     that has been filled by the SP.
1715  *
1716  * Bit fields val0:
1717  * 31-12:  Not used
1718  * 11- 0:  Index of last filled Rx buffer descriptor (SP writes, driver reads)
1719  *
1720  * Bit fields val1:
1721  * 31- 0:  Not used
1722  */
1723 typedef struct iwh_shared {
1724 	struct iwh_sched_queue_byte_cnt_tbl
1725 	    queues_byte_cnt_tbls[IWH_NUM_QUEUES];
1726 	uint32_t val0;
1727 	uint32_t val1;
1728 	uint32_t padding1;  /* so that allocation will be aligned to 16B */
1729 	uint32_t padding2;
1730 } iwh_shared_t;
1731 
1732 
1733 /*
1734  * struct iwh_tfd_frame_data
1735  *
1736  * Describes up to 2 buffers containing (contiguous) portions of a Tx frame.
1737  * Each buffer must be on dword boundary.
1738  * Up to 10 iwh_tfd_frame_data structures, describing up to 20 buffers,
1739  * may be filled within a TFD (iwh_tfd_frame).
1740  *
1741  * Bit fields in tb1_addr:
1742  * 31- 0: Tx buffer 1 address bits [31:0]
1743  *
1744  * Bit fields in val1:
1745  * 31-16: Tx buffer 2 address bits [15:0]
1746  * 15- 4: Tx buffer 1 length (bytes)
1747  *  3- 0: Tx buffer 1 address bits [32:32]
1748  *
1749  * Bit fields in val2:
1750  * 31-20: Tx buffer 2 length (bytes)
1751  * 19- 0: Tx buffer 2 address bits [35:16]
1752  */
1753 struct iwh_tfd_frame_data {
1754 		uint32_t tb1_addr;
1755 		uint32_t val1;
1756 		uint32_t val2;
1757 };
1758 
1759 typedef struct iwh_tx_desc {
1760 	uint32_t	val0;
1761 	struct iwh_tfd_frame_data pa[10];
1762 	uint32_t reserved;
1763 } iwh_tx_desc_t;
1764 
1765 struct	agg_tx_status {
1766 	uint16_t	status;
1767 	uint16_t	sequence;
1768 };
1769 
1770 typedef struct iwh_tx_stat {
1771 	uint8_t		frame_count;
1772 	uint8_t		bt_kill_count;
1773 	uint8_t		nrts;
1774 	uint8_t		ntries;
1775 	struct iwh_rate rate;
1776 	uint16_t	duration;
1777 	uint16_t	reserved;
1778 	uint32_t	pa_power1;
1779 	uint32_t	pa_power2;
1780 	uint32_t	tfd_info;
1781 	uint16_t	seq_ctl;
1782 	uint16_t	byte_cnt;
1783 	uint32_t	tlc_info;
1784 	struct	agg_tx_status	status;
1785 } iwh_tx_stat_t;
1786 
1787 struct iwh_cmd_header {
1788 	uint8_t		type;
1789 	uint8_t		flags;
1790 	uint8_t		idx;
1791 	uint8_t		qid;
1792 };
1793 
1794 typedef struct iwh_rx_desc {
1795 	uint32_t	len;
1796 	struct iwh_cmd_header hdr;
1797 } iwh_rx_desc_t;
1798 
1799 typedef struct iwh_rx_stat {
1800 	uint8_t		len;
1801 	uint8_t		id;
1802 	uint8_t		rssi;	/* received signal strength */
1803 	uint8_t		agc;	/* access gain control */
1804 	uint16_t	signal;
1805 	uint16_t	noise;
1806 } iwh_rx_stat_t;
1807 
1808 typedef struct iwh_rx_head {
1809 	uint16_t	chan;
1810 	uint16_t	flags;
1811 	uint8_t		reserved;
1812 	uint8_t		rate;
1813 	uint16_t	len;
1814 } iwh_rx_head_t;
1815 
1816 typedef struct iwh_rx_tail {
1817 	uint32_t	flags;
1818 	uint32_t	timestampl;
1819 	uint32_t	timestamph;
1820 	uint32_t	tbeacon;
1821 } iwh_rx_tail_t;
1822 
1823 enum {
1824 	IWH_AP_ID = 0,
1825 	IWH_MULTICAST_ID,
1826 	IWH_STA_ID,
1827 	IWH_BROADCAST_ID = 15,
1828 	IWH_STATION_COUNT = 16,
1829 	IWH_INVALID_STATION
1830 };
1831 
1832 /*
1833  * key flags
1834  */
1835 enum {
1836 	STA_KEY_FLG_ENCRYPT_MSK = 0x7,
1837 	STA_KEY_FLG_NO_ENC = 0x0,
1838 	STA_KEY_FLG_WEP = 0x1,
1839 	STA_KEY_FLG_CCMP = 0x2,
1840 	STA_KEY_FLG_TKIP = 0x3,
1841 
1842 	STA_KEY_FLG_KEYID_POS = 8,
1843 	STA_KEY_FLG_INVALID = 0x0800,
1844 };
1845 
1846 /*
1847  * modify flags
1848  */
1849 enum {
1850 	STA_MODIFY_KEY_MASK = 0x01,
1851 	STA_MODIFY_TID_DISABLE_TX = 0x02,
1852 	STA_MODIFY_TX_RATE_MSK = 0x04
1853 };
1854 
1855 enum {
1856 	RX_RES_STATUS_NO_CRC32_ERROR = (1 << 0),
1857 	RX_RES_STATUS_NO_RXE_OVERFLOW = (1 << 1),
1858 };
1859 
1860 enum {
1861 	RX_RES_PHY_FLAGS_BAND_24_MSK = (1 << 0),
1862 	RX_RES_PHY_FLAGS_MOD_CCK_MSK = (1 << 1),
1863 	RX_RES_PHY_FLAGS_SHORT_PREAMBLE_MSK = (1 << 2),
1864 	RX_RES_PHY_FLAGS_NARROW_BAND_MSK = (1 << 3),
1865 	RX_RES_PHY_FLAGS_ANTENNA_MSK = 0xf0,
1866 
1867 	RX_RES_STATUS_SEC_TYPE_MSK = (0x7 << 8),
1868 	RX_RES_STATUS_SEC_TYPE_NONE = (STA_KEY_FLG_NO_ENC << 8),
1869 	RX_RES_STATUS_SEC_TYPE_WEP = (STA_KEY_FLG_WEP << 8),
1870 	RX_RES_STATUS_SEC_TYPE_TKIP = (STA_KEY_FLG_TKIP << 8),
1871 	RX_RES_STATUS_SEC_TYPE_CCMP = (STA_KEY_FLG_CCMP << 8),
1872 
1873 	RX_RES_STATUS_DECRYPT_TYPE_MSK = (0x3 << 11),
1874 	RX_RES_STATUS_NOT_DECRYPT = (0x0 << 11),
1875 	RX_RES_STATUS_DECRYPT_OK = (0x3 << 11),
1876 	RX_RES_STATUS_BAD_ICV_MIC = (0x1 << 11),
1877 	RX_RES_STATUS_BAD_KEY_TTAK = (0x2 << 11),
1878 };
1879 
1880 enum {
1881 	REPLY_ALIVE = 0x1,
1882 	REPLY_ERROR = 0x2,
1883 
1884 	/* RXON state commands */
1885 	REPLY_RXON = 0x10,
1886 	REPLY_RXON_ASSOC = 0x11,
1887 	REPLY_QOS_PARAM = 0x13,
1888 	REPLY_RXON_TIMING = 0x14,
1889 
1890 	/* Multi-Station support */
1891 	REPLY_ADD_STA = 0x18,
1892 	REPLY_REMOVE_STA = 0x19,
1893 	REPLY_REMOVE_ALL_STA = 0x1a,
1894 
1895 	/* RX, TX */
1896 
1897 	REPLY_TX = 0x1c,
1898 
1899 	/* timers commands */
1900 	REPLY_BCON = 0x27,
1901 
1902 	REPLY_SHUTDOWN = 0x40,
1903 
1904 	/* MISC commands */
1905 	REPLY_RATE_SCALE = 0x47,
1906 	REPLY_LEDS_CMD = 0x48,
1907 	REPLY_TX_LINK_QUALITY_CMD = 0x4e,
1908 
1909 	COEX_PRIORITY_TABLE_CMD = 0x5a,
1910 	CALIBRATION_CFG_CMD = 0x65,
1911 	CALIBRATION_RES_NOTIFICATION = 0x66,
1912 	CALIBRATION_COMPLETE_NOTIFICATION = 0x67,
1913 
1914 	/* 802.11h related */
1915 	RADAR_NOTIFICATION = 0x70,
1916 	REPLY_QUIET_CMD = 0x71,
1917 	REPLY_CHANNEL_SWITCH = 0x72,
1918 	CHANNEL_SWITCH_NOTIFICATION = 0x73,
1919 	REPLY_SPECTRUM_MEASUREMENT_CMD = 0x74,
1920 	SPECTRUM_MEASURE_NOTIFICATION = 0x75,
1921 
1922 	/* Power Management *** */
1923 	POWER_TABLE_CMD = 0x77,
1924 	PM_SLEEP_NOTIFICATION = 0x7A,
1925 	PM_DEBUG_STATISTIC_NOTIFIC = 0x7B,
1926 
1927 	/* Scan commands and notifications */
1928 	REPLY_SCAN_CMD = 0x80,
1929 	REPLY_SCAN_ABORT_CMD = 0x81,
1930 
1931 	SCAN_START_NOTIFICATION = 0x82,
1932 	SCAN_RESULTS_NOTIFICATION = 0x83,
1933 	SCAN_COMPLETE_NOTIFICATION = 0x84,
1934 
1935 	/* IBSS/AP commands */
1936 	BEACON_NOTIFICATION = 0x90,
1937 	REPLY_TX_BEACON = 0x91,
1938 	WHO_IS_AWAKE_NOTIFICATION = 0x94,
1939 
1940 	QUIET_NOTIFICATION = 0x96,
1941 	REPLY_TX_PWR_TABLE_CMD = 0x97,
1942 	MEASURE_ABORT_NOTIFICATION = 0x99,
1943 
1944 	REPLY_CALIBRATION_TUNE = 0x9a,
1945 
1946 	/* BT config command */
1947 	REPLY_BT_CONFIG = 0x9b,
1948 	REPLY_STATISTICS_CMD = 0x9c,
1949 	STATISTICS_NOTIFICATION = 0x9d,
1950 
1951 	/* RF-KILL commands and notifications *** */
1952 	REPLY_CARD_STATE_CMD = 0xa0,
1953 	CARD_STATE_NOTIFICATION = 0xa1,
1954 
1955 	/* Missed beacons notification */
1956 	MISSED_BEACONS_NOTIFICATION = 0xa2,
1957 	MISSED_BEACONS_NOTIFICATION_TH_CMD = 0xa3,
1958 
1959 	REPLY_CT_KILL_CONFIG_CMD = 0xa4,
1960 	SENSITIVITY_CMD = 0xa8,
1961 	REPLY_PHY_CALIBRATION_CMD = 0xb0,
1962 	REPLY_RX_PHY_CMD = 0xc0,
1963 	REPLY_RX_MPDU_CMD = 0xc1,
1964 	REPLY_SP_RX = 0xc3,
1965 	REPLY_COMPRESSED_BA = 0xc5,
1966 	REPLY_MAX = 0xff
1967 };
1968 
1969 typedef struct iwh_cmd {
1970 	struct iwh_cmd_header hdr;
1971 	uint8_t	data[1024];
1972 } iwh_cmd_t;
1973 
1974 /*
1975  * Alive Command & Response
1976  */
1977 #define	UCODE_VALID_OK		(0x1)
1978 #define	INITIALIZE_SUBTYPE	(9)
1979 
1980 struct iwh_alive_resp {
1981 	uint8_t ucode_minor;
1982 	uint8_t ucode_major;
1983 	uint16_t reserved1;
1984 	uint8_t sw_rev[8];
1985 	uint8_t ver_type;
1986 	uint8_t ver_subtype;
1987 	uint16_t reserved2;
1988 	uint32_t log_event_table_ptr;
1989 	uint32_t error_event_table_ptr;
1990 	uint32_t timestamp;
1991 	uint32_t is_valid;
1992 };
1993 
1994 struct iwh_init_alive_resp {
1995 	struct iwh_alive_resp s;
1996 	/* calibration values from "initialize" uCode */
1997 	uint32_t voltage;	/* signed */
1998 	uint32_t therm_r1[2];	/* signed 1st for normal, 2nd for FAT channel */
1999 	uint32_t therm_r2[2];	/* signed */
2000 	uint32_t therm_r3[2];	/* signed */
2001 	uint32_t therm_r4[2];	/* signed */
2002 		/*
2003 		 * signed MIMO gain comp, 5 freq groups, 2 Tx chains
2004 		 */
2005 	uint32_t tx_atten[5][2];
2006 };
2007 
2008 /*
2009  * Rx config defines & structure
2010  */
2011 /*
2012  * rx_config device types
2013  */
2014 enum {
2015 	RXON_DEV_TYPE_AP = 1,
2016 	RXON_DEV_TYPE_ESS = 3,
2017 	RXON_DEV_TYPE_IBSS = 4,
2018 	RXON_DEV_TYPE_SNIFFER = 6,
2019 };
2020 
2021 /*
2022  * rx_config flags
2023  */
2024 enum {
2025 	/* band & modulation selection */
2026 	RXON_FLG_BAND_24G_MSK = (1 << 0),
2027 	RXON_FLG_CCK_MSK = (1 << 1),
2028 	/* auto detection enable */
2029 	RXON_FLG_AUTO_DETECT_MSK = (1 << 2),
2030 	/* TGg protection when tx */
2031 	RXON_FLG_TGG_PROTECT_MSK = (1 << 3),
2032 	/* cck short slot & preamble */
2033 	RXON_FLG_SHORT_SLOT_MSK = (1 << 4),
2034 	RXON_FLG_SHORT_PREAMBLE_MSK = (1 << 5),
2035 	/* antenna selection */
2036 	RXON_FLG_DIS_DIV_MSK = (1 << 7),
2037 	RXON_FLG_ANT_SEL_MSK = 0x0f00,
2038 	RXON_FLG_ANT_A_MSK = (1 << 8),
2039 	RXON_FLG_ANT_B_MSK = (1 << 9),
2040 	/* radar detection enable */
2041 	RXON_FLG_RADAR_DETECT_MSK = (1 << 12),
2042 	RXON_FLG_TGJ_NARROW_BAND_MSK = (1 << 13),
2043 	/*
2044 	 * rx response to host with 8-byte TSF
2045 	 * (according to ON_AIR deassertion)
2046 	 */
2047 	RXON_FLG_TSF2HOST_MSK = (1 << 15),
2048 	RXON_FLG_DIS_ACQUISITION = (1 << 27),
2049 	RXON_FLG_DIS_RE_ACQUISITION = (1 << 28),
2050 	RXON_FLG_DIS_BEAMFORM = (1 << 29)
2051 };
2052 
2053 /*
2054  * rx_config filter flags
2055  */
2056 enum {
2057 	/* accept all data frames */
2058 	RXON_FILTER_PROMISC_MSK = (1 << 0),
2059 	/* pass control & management to host */
2060 	RXON_FILTER_CTL2HOST_MSK = (1 << 1),
2061 	/* accept multi-cast */
2062 	RXON_FILTER_ACCEPT_GRP_MSK = (1 << 2),
2063 	/* don't decrypt uni-cast frames */
2064 	RXON_FILTER_DIS_DECRYPT_MSK = (1 << 3),
2065 	/* don't decrypt multi-cast frames */
2066 	RXON_FILTER_DIS_GRP_DECRYPT_MSK = (1 << 4),
2067 	/* STA is associated */
2068 	RXON_FILTER_ASSOC_MSK = (1 << 5),
2069 	/* transfer to host non bssid beacons in associated state */
2070 	RXON_FILTER_BCON_AWARE_MSK = (1 << 6)
2071 };
2072 
2073 
2074 /*
2075  * structure for RXON Command & Response
2076  */
2077 typedef struct iwh_rxon_cmd {
2078 	uint8_t		node_addr[IEEE80211_ADDR_LEN];
2079 	uint16_t	reserved1;
2080 	uint8_t		bssid[IEEE80211_ADDR_LEN];
2081 	uint16_t	reserved2;
2082 	uint8_t		wlap_bssid[IEEE80211_ADDR_LEN];
2083 	uint16_t	reserved3;
2084 	uint8_t		dev_type;
2085 	uint8_t		air_propagation;
2086 	uint16_t	rx_chain;
2087 	uint8_t		ofdm_basic_rates;
2088 	uint8_t		cck_basic_rates;
2089 	uint16_t	assoc_id;
2090 	uint32_t	flags;
2091 	uint32_t	filter_flags;
2092 	uint16_t	chan;
2093 	uint8_t		ofdm_ht_single_stream_basic_rates;
2094 	uint8_t		ofdm_ht_dual_stream_basic_rates;
2095 	uint8_t		ofdm_ht_triple_stream_basic_rates;
2096 	uint8_t		reserved4;
2097 	uint16_t	acquisition_data;
2098 	uint16_t	reserved5;
2099 } iwh_rxon_cmd_t;
2100 
2101 typedef struct iwh_compressed_ba_resp {
2102 	uint32_t sta_addr_lo32;
2103 	uint16_t sta_addr_hi16;
2104 	uint16_t reserved;
2105 	uint8_t sta_id;
2106 	uint8_t tid;
2107 	uint16_t ba_seq_ctl;
2108 	uint32_t ba_bitmap0;
2109 	uint32_t ba_bitmap1;
2110 	uint16_t scd_flow;
2111 	uint16_t scd_ssn;
2112 } iwh_compressed_ba_resp_t;
2113 
2114 #define	PHY_CALIBRATE_DIFF_GAIN_CMD	(7)
2115 #define	PHY_CALIBRATE_DC_CMD		(8)
2116 #define	PHY_CALIBRATE_LO_CMD		(9)
2117 #define	PHY_CALIBRATE_TX_IQ_CMD		(11)
2118 #define	PHY_CALIBRATE_CRYSTAL_FRQ_CMD	(15)
2119 #define	PHY_CALIBRATE_BASE_BAND_CMD	(16)
2120 #define	PHY_CALIBRATE_TX_IQ_PERD_CMD	(17)
2121 #define	HD_TABLE_SIZE	(11)
2122 
2123 /*
2124  * Param table within SENSITIVITY_CMD
2125  */
2126 #define	HD_MIN_ENERGY_CCK_DET_INDEX		(0)
2127 #define	HD_MIN_ENERGY_OFDM_DET_INDEX		(1)
2128 #define	HD_AUTO_CORR32_X1_TH_ADD_MIN_INDEX	(2)
2129 #define	HD_AUTO_CORR32_X1_TH_ADD_MIN_MRC_INDEX	(3)
2130 #define	HD_AUTO_CORR40_X4_TH_ADD_MIN_MRC_INDEX	(4)
2131 #define	HD_AUTO_CORR32_X4_TH_ADD_MIN_INDEX	(5)
2132 #define	HD_AUTO_CORR32_X4_TH_ADD_MIN_MRC_INDEX	(6)
2133 #define	HD_BARKER_CORR_TH_ADD_MIN_INDEX		(7)
2134 #define	HD_BARKER_CORR_TH_ADD_MIN_MRC_INDEX	(8)
2135 #define	HD_AUTO_CORR40_X4_TH_ADD_MIN_INDEX	(9)
2136 #define	HD_OFDM_ENERGY_TH_IN_INDEX		(10)
2137 
2138 typedef struct iwh_sensitivity_cmd {
2139 	uint16_t control;
2140 	uint16_t table[HD_TABLE_SIZE];
2141 } iwh_sensitivity_cmd_t;
2142 
2143 typedef struct iwh_calibration_cmd {
2144 	uint8_t opCode;
2145 	uint8_t flags;
2146 	uint16_t reserved;
2147 	char diff_gain_a;
2148 	char diff_gain_b;
2149 	char diff_gain_c;
2150 	uint8_t reserved1;
2151 } iwh_calibation_cmd_t;
2152 
2153 
2154 struct	iwh_calib_hdr {
2155 	uint8_t	op_code;
2156 	uint8_t	first_group;
2157 	uint8_t	groups_num;
2158 	uint8_t	data_valid;
2159 };
2160 
2161 #define	FH_RSCSR_FRAME_SIZE_MASK	(0x00003FFF)
2162 
2163 struct	iwh_calib_results {
2164 	void		*tx_iq_res;
2165 	uint32_t	tx_iq_res_len;
2166 	void		*tx_iq_perd_res;
2167 	uint32_t	tx_iq_perd_res_len;
2168 	void		*lo_res;
2169 	uint32_t	lo_res_len;
2170 	void		*dc_res;
2171 	uint32_t	dc_res_len;
2172 	void		*base_band_res;
2173 	uint32_t	base_band_res_len;
2174 };
2175 
2176 #define	IWH_CALIB_INIT_CFG_ALL	(0xFFFFFFFF)
2177 
2178 struct	iwh_calib_cfg_elmnt_s {
2179 	uint32_t	is_enable;
2180 	uint32_t	start;
2181 	uint32_t	send_res;
2182 	uint32_t	apply_res;
2183 	uint32_t	resered;
2184 };
2185 
2186 struct	iwh_calib_cfg_status_s {
2187 	struct	iwh_calib_cfg_elmnt_s	once;
2188 	struct	iwh_calib_cfg_elmnt_s	perd;
2189 	uint32_t	flags;
2190 };
2191 
2192 struct	iwh_calib_cfg_cmd {
2193 	struct	iwh_calib_cfg_status_s	ucd_calib_cfg;
2194 	struct	iwh_calib_cfg_status_s	drv_calib_cfg;
2195 	uint32_t	reserved1;
2196 };
2197 
2198 struct	iwh_cal_crystal_freq {
2199 	uint8_t	cap_pin1;
2200 	uint8_t	cap_pin2;
2201 };
2202 
2203 typedef	struct	iwh_calibration_crystal_cmd {
2204 	uint8_t	opCode;
2205 	uint8_t	first_group;
2206 	uint8_t	num_group;
2207 	uint8_t	all_data_valid;
2208 	struct	iwh_cal_crystal_freq	data;
2209 } iwh_calibration_crystal_cmd_t;
2210 
2211 #define	COEX_NUM_OF_EVENTS	(16)
2212 
2213 struct	iwh_wimax_coex_event_entry {
2214 	uint8_t	request_prio;
2215 	uint8_t	win_medium_prio;
2216 	uint8_t	reserved;
2217 	uint8_t	flags;
2218 };
2219 
2220 typedef	struct	iwh_wimax_coex_cmd {
2221 	uint8_t	flags;
2222 	uint8_t	reserved[3];
2223 	struct iwh_wimax_coex_event_entry	sta_prio[COEX_NUM_OF_EVENTS];
2224 } iwh_wimax_coex_cmd_t;
2225 
2226 typedef struct iwh_missed_beacon_notif {
2227 	uint32_t consequtive_missed_beacons;
2228 	uint32_t total_missed_becons;
2229 	uint32_t num_expected_beacons;
2230 	uint32_t num_recvd_beacons;
2231 } iwh_missed_beacon_notif_t;
2232 
2233 typedef struct iwh_ct_kill_config {
2234 	uint32_t   reserved;
2235 	uint32_t   critical_temperature_M;
2236 	uint32_t   critical_temperature_R;
2237 } iwh_ct_kill_config_t;
2238 
2239 /*
2240  * structure for command IWH_CMD_ASSOCIATE
2241  */
2242 typedef struct iwh_assoc {
2243 	uint32_t	flags;
2244 	uint32_t	filter;
2245 	uint8_t		ofdm_mask;
2246 	uint8_t		cck_mask;
2247 	uint8_t		ofdm_ht_single_stream_basic_rates;
2248 	uint8_t		ofdm_ht_dual_stream_basic_rates;
2249 	uint16_t	rx_chain_select_flags;
2250 	uint16_t	reserved;
2251 } iwh_assoc_t;
2252 
2253 /*
2254  * structure for command IWH_CMD_TSF
2255  */
2256 typedef struct iwh_cmd_tsf {
2257 	uint32_t	timestampl;
2258 	uint32_t	timestamph;
2259 	uint16_t	bintval;
2260 	uint16_t	atim;
2261 	uint32_t	binitval;
2262 	uint16_t	lintval;
2263 	uint16_t	reserved;
2264 } iwh_cmd_tsf_t;
2265 
2266 /*
2267  * structure for IWH_CMD_ADD_NODE
2268  */
2269 #define	STA_MODE_ADD_MSK		(0)
2270 #define	STA_MODE_MODIFY_MSK		(1)
2271 
2272 #define	STA_FLG_RTS_MIMO_PROT		(1 << 17)
2273 #define	STA_FLG_MAX_AMPDU_POS		(19)
2274 #define	STA_FLG_AMPDU_DENSITY_POS	(23)
2275 #define	STA_FLG_FAT_EN			(1 << 21)
2276 
2277 #define	STA_MODIFY_KEY_MASK		(0x01)
2278 #define	STA_MODIFY_TID_DISABLE_TX	(0x02)
2279 #define	STA_MODIFY_TX_RATE_MSK		(0x04)
2280 #define	STA_MODIFY_ADDBA_TID_MSK	(0x08)
2281 #define	STA_MODIFY_DELBA_TID_MSK	(0x10)
2282 
2283 struct	sta_id_modify {
2284 	uint8_t		addr[6];
2285 	uint16_t	reserved1;
2286 	uint8_t		sta_id;
2287 	uint8_t		modify_mask;
2288 	uint16_t	reserved2;
2289 };
2290 
2291 struct	iwh_keyinfo {
2292 	uint16_t	key_flags;
2293 	uint8_t		tkip_rx_tsc_byte2;
2294 	uint8_t		reserved1;
2295 	uint16_t	tkip_rx_ttak[5];
2296 	uint8_t		key_offset;
2297 	uint8_t		reserved2;
2298 	uint8_t		key[16];
2299 	uint32_t	tx_secur_seq_cnt1;
2300 	uint32_t	tx_secur_seq_cnt2;
2301 	uint32_t	hw_tkip_mic_rx_key1;
2302 	uint32_t	hw_tkip_mic_rx_key2;
2303 	uint32_t	hw_tkip_mic_tx_key1;
2304 	uint32_t	hw_tkip_mic_tx_key2;
2305 };
2306 typedef struct iwh_add_sta {
2307 	uint8_t		mode;
2308 	uint8_t		reserved[3];
2309 	struct sta_id_modify	sta;
2310 	struct iwh_keyinfo	key;
2311 	uint32_t	station_flags;
2312 	uint32_t	station_flags_msk;
2313 	uint16_t	disable_tx;
2314 	uint16_t	reserved1;
2315 	uint8_t		add_immediate_ba_tid;
2316 	uint8_t		remove_immediate_ba_tid;
2317 	uint16_t	add_immediate_ba_ssn;
2318 	uint32_t	reserved2;
2319 } iwh_add_sta_t;
2320 
2321 typedef	struct iwh_rem_sta {
2322 	uint8_t	num_sta;	/* number of removed stations */
2323 	uint8_t	reserved1[3];
2324 	uint8_t	addr[6];	/* MAC address of the first station */
2325 	uint8_t	reserved2[2];
2326 } iwh_rem_sta_t;
2327 
2328 /*
2329  * Tx flags
2330  */
2331 enum {
2332 	TX_CMD_FLG_RTS_MSK = (1 << 1),
2333 	TX_CMD_FLG_CTS_MSK = (1 << 2),
2334 	TX_CMD_FLG_ACK_MSK = (1 << 3),
2335 	TX_CMD_FLG_STA_RATE_MSK = (1 << 4),
2336 	TX_CMD_FLG_IMM_BA_RSP_MASK = (1 << 6),
2337 	TX_CMD_FLG_FULL_TXOP_PROT_MSK = (1 << 7),
2338 	TX_CMD_FLG_ANT_SEL_MSK = 0xf00,
2339 	TX_CMD_FLG_ANT_A_MSK = (1 << 8),
2340 	TX_CMD_FLG_ANT_B_MSK = (1 << 9),
2341 
2342 	/* ucode ignores BT priority for this frame */
2343 	TX_CMD_FLG_BT_DIS_MSK = (1 << 12),
2344 
2345 	/* ucode overrides sequence control */
2346 	TX_CMD_FLG_SEQ_CTL_MSK = (1 << 13),
2347 
2348 	/* signal that this frame is non-last MPDU */
2349 	TX_CMD_FLG_MORE_FRAG_MSK = (1 << 14),
2350 
2351 	/* calculate TSF in outgoing frame */
2352 	TX_CMD_FLG_TSF_MSK = (1 << 16),
2353 
2354 	/* activate TX calibration. */
2355 	TX_CMD_FLG_CALIB_MSK = (1 << 17),
2356 
2357 	/*
2358 	 * signals that 2 bytes pad was inserted
2359 	 * after the MAC header
2360 	 */
2361 	TX_CMD_FLG_MH_PAD_MSK = (1 << 20),
2362 
2363 	/* HCCA-AP - disable duration overwriting. */
2364 	TX_CMD_FLG_DUR_MSK = (1 << 25),
2365 };
2366 
2367 
2368 /*
2369  * structure for command IWH_CMD_TX_DATA
2370  */
2371 typedef struct iwh_tx_cmd {
2372 	uint16_t len;
2373 	uint16_t next_frame_len;
2374 	uint32_t tx_flags;
2375 	struct iwh_dram_scratch scratch;
2376 	struct iwh_rate rate;
2377 	uint8_t sta_id;
2378 	uint8_t sec_ctl;
2379 	uint8_t initial_rate_index;
2380 	uint8_t reserved;
2381 	uint8_t key[16];
2382 	uint16_t next_frame_flags;
2383 	uint16_t reserved2;
2384 	union {
2385 		uint32_t life_time;
2386 		uint32_t attempt;
2387 	} stop_time;
2388 	uint32_t dram_lsb_ptr;
2389 	uint8_t dram_msb_ptr;
2390 	uint8_t rts_retry_limit;
2391 	uint8_t data_retry_limit;
2392 	uint8_t tid_tspec;
2393 	union {
2394 		uint16_t pm_frame_timeout;
2395 		uint16_t attempt_duration;
2396 	} timeout;
2397 	uint16_t driver_txop;
2398 } iwh_tx_cmd_t;
2399 
2400 
2401 /*
2402  * structure for command "TX beacon"
2403  */
2404 
2405 typedef struct iwh_tx_beacon_cmd {
2406 	iwh_tx_cmd_t	config;
2407 	uint16_t	tim_idx;
2408 	uint8_t		tim_size;
2409 	uint8_t		reserved;
2410 	uint8_t		bcon_frame[2342];
2411 } iwh_tx_beacon_cmd_t;
2412 
2413 
2414 /*
2415  * LEDs Command & Response
2416  * REPLY_LEDS_CMD = 0x48 (command, has simple generic response)
2417  *
2418  * For each of 3 possible LEDs (Activity/Link/Tech, selected by "id" field),
2419  * this command turns it on or off, or sets up a periodic blinking cycle.
2420  */
2421 typedef struct iwh_led_cmd {
2422 	uint32_t interval;	/* "interval" in uSec */
2423 	uint8_t id;		/* 1: Activity, 2: Link, 3: Tech */
2424 		/*
2425 		 * # intervals off while blinking;
2426 		 * "0", with > 0 "on" value, turns LED on
2427 		 */
2428 	uint8_t off;
2429 		/*
2430 		 * # intervals on while blinking;
2431 		 * "0", regardless of "off", turns LED off
2432 		 */
2433 	uint8_t on;
2434 	uint8_t reserved;
2435 } iwh_led_cmd_t;
2436 
2437 /*
2438  * structure for IWH_CMD_SET_POWER_MODE
2439  */
2440 typedef struct iwh_powertable_cmd {
2441 	uint16_t	flags;
2442 	uint8_t		keep_alive_seconds;
2443 	uint8_t		debug_flags;
2444 	uint32_t	rx_timeout;
2445 	uint32_t	tx_timeout;
2446 	uint32_t	sleep[5];
2447 	uint32_t	keep_alive_beacons;
2448 } iwh_powertable_cmd_t;
2449 
2450 struct iwh_ssid_ie {
2451 	uint8_t id;
2452 	uint8_t len;
2453 	uint8_t ssid[32];
2454 };
2455 /*
2456  * structure for command IWH_CMD_SCAN
2457  */
2458 typedef struct iwh_scan_hdr {
2459 	uint16_t len;
2460 	uint8_t	 reserved1;
2461 	uint8_t	 nchan;
2462 		/*
2463 		 * dwell only this long on quiet chnl
2464 		 * (active scan)
2465 		 */
2466 	uint16_t quiet_time;
2467 	uint16_t quiet_plcp_th; /* quiet chnl is < this # pkts (typ. 1) */
2468 	uint16_t good_crc_th; /* passive -> active promotion threshold */
2469 	uint16_t rx_chain;
2470 		/*
2471 		 * max usec to be out of associated (service)
2472 		 * chnl
2473 		 */
2474 	uint32_t max_out_time;
2475 		/*
2476 		 * pause scan this long when returning to svc
2477 		 * chnl.
2478 		 * SP -- 31:22 # beacons, 21:0 additional usec.
2479 		 */
2480 	uint32_t suspend_time;
2481 	uint32_t flags;
2482 	uint32_t filter_flags;
2483 	struct	 iwh_tx_cmd tx_cmd;
2484 	struct	 iwh_ssid_ie direct_scan[20];
2485 	/* followed by probe request body */
2486 	/* followed by nchan x iwh_scan_chan */
2487 } iwh_scan_hdr_t;
2488 
2489 typedef struct iwh_scan_chan {
2490 	uint32_t	type;
2491 	uint16_t	chan;
2492 	struct iwh_tx_power	tpc;
2493 	uint16_t	active_dwell;	/* dwell time */
2494 	uint16_t	passive_dwell;	/* dwell time */
2495 } iwh_scan_chan_t;
2496 
2497 /*
2498  * structure for IWH_CMD_BLUETOOTH
2499  */
2500 typedef struct iwh_bt_cmd {
2501 	uint8_t		flags;
2502 	uint8_t		lead_time;
2503 	uint8_t		max_kill;
2504 	uint8_t		reserved;
2505 	uint32_t	kill_ack_mask;
2506 	uint32_t	kill_cts_mask;
2507 } iwh_bt_cmd_t;
2508 
2509 typedef struct iwh_wme_param {
2510 	uint8_t		aifsn;
2511 	uint8_t		cwmin_e;
2512 	uint8_t		cwmax_e;
2513 	uint16_t	txop;
2514 } iwh_wme_param_t;
2515 /*
2516  * QoS parameter command (REPLY_QOS_PARAM = 0x13)
2517  * FIFO0-background, FIFO1-best effort, FIFO2-video, FIFO3-voice
2518  */
2519 
2520 struct iwh_edca_param {
2521 	uint16_t	cw_min;
2522 	uint16_t	cw_max;
2523 	uint8_t		aifsn;
2524 	uint8_t		reserved;
2525 	uint16_t	txop;
2526 };
2527 
2528 typedef struct iwh_qos_param_cmd {
2529 	uint32_t	flags;
2530 	struct iwh_edca_param	ac[AC_NUM];
2531 } iwh_qos_param_cmd_t;
2532 
2533 /*
2534  * firmware image header
2535  */
2536 typedef struct iwh_firmware_hdr {
2537 	uint32_t	version;
2538 	uint32_t	textsz;
2539 	uint32_t	datasz;
2540 	uint32_t	init_textsz;
2541 	uint32_t	init_datasz;
2542 	uint32_t	bootsz;
2543 } iwh_firmware_hdr_t;
2544 
2545 /*
2546  * structure for IWH_START_SCAN notification
2547  */
2548 typedef struct iwh_start_scan {
2549 	uint32_t	timestampl;
2550 	uint32_t	timestamph;
2551 	uint32_t	tbeacon;
2552 	uint8_t		chan;
2553 	uint8_t		band;
2554 	uint16_t	reserved;
2555 	uint32_t	status;
2556 } iwh_start_scan_t;
2557 
2558 /*
2559  * structure for IWK_SCAN_COMPLETE notification
2560  */
2561 typedef struct iwh_stop_scan {
2562 	uint8_t		nchan;
2563 	uint8_t		status;
2564 	uint8_t		reserved;
2565 	uint8_t		chan;
2566 	uint8_t		tsf;
2567 } iwh_stop_scan_t;
2568 
2569 
2570 #define	IWH_READ(sc, reg)						\
2571 	ddi_get32((sc)->sc_handle, (uint32_t *)((sc)->sc_base + (reg)))
2572 
2573 #define	IWH_WRITE(sc, reg, val)					\
2574 	ddi_put32((sc)->sc_handle, (uint32_t *)((sc)->sc_base + (reg)), (val))
2575 
2576 /*
2577  * Driver can access peripheral registers
2578  * and ram via HBUS_TARG_PRPH_* registers.
2579  */
2580 
2581 #define	PRPH_BASE	(0x00000)
2582 #define	PRPH_END	(0xFFFFF)
2583 
2584 #define	IWH_SCD_BASE	(PRPH_BASE + 0xA02C00)
2585 
2586 #define	IWH_SCD_SRAM_BASE_ADDR	(IWH_SCD_BASE + 0x0)
2587 #define	IWH_SCD_DRAM_BASE_ADDR	(IWH_SCD_BASE + 0x8)
2588 #define	IWH_SCD_QUEUECHAIN_SEL	(IWH_SCD_BASE + 0xE8)
2589 #define	IWH_SCD_AGGR_SEL	(IWH_SCD_BASE + 0x248)
2590 #define	IWH_SCD_QUEUE_RDPTR(x)	(IWH_SCD_BASE + 0x68 + (x) * 4)
2591 #define	IWH_SCD_INTERRUPT_MASK	(IWH_SCD_BASE + 0x108)
2592 #define	IWH_SCD_TXFACT		(IWH_SCD_BASE + 0x1C)
2593 #define	IWH_SCD_QUEUE_STATUS_BITS(x)	(IWH_SCD_BASE + 0x10C + (x) * 4)
2594 
2595 #define	IWH_SCD_CONTEXT_DATA_OFFSET	(0x600)
2596 #define	IWH_SCD_TX_STTS_BITMAP_OFFSET	(0x7B1)
2597 #define	IWH_SCD_TRANSLATE_TBL_OFFSET	(0x7E0)
2598 
2599 #define	IWH_SCD_QUEUE_CTX_REG2_WIN_SIZE_POS	(0)
2600 #define	IWH_SCD_QUEUE_CTX_REG2_WIN_SIZE_MSK	(0x0000007F)
2601 #define	IWH_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_POS	(16)
2602 #define	IWH_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_MSK	(0x007F0000)
2603 
2604 #define	IWH_SCD_QUEUECHAIN_SEL_ALL(x)	(((1 << (x)) - 1) &\
2605 				(~(1 << IWH_CMD_QUEUE_NUM)))
2606 
2607 #define	IWH_SCD_CONTEXT_QUEUE_OFFSET(x)\
2608 		(IWH_SCD_CONTEXT_DATA_OFFSET + (x) * 8)
2609 
2610 #define	IWH_SCD_QUEUE_STTS_REG_POS_TXF		(0)
2611 #define	IWH_SCD_QUEUE_STTS_REG_POS_ACTIVE	(3)
2612 #define	IWH_SCD_QUEUE_STTS_REG_POS_WSL		(4)
2613 #define	IWH_SCD_QUEUE_STTS_REG_MSK		(0x00FF0000)
2614 
2615 /* TX command security control */
2616 #define	TX_CMD_SEC_WEP		(0x01)
2617 #define	TX_CMD_SEC_CCM		(0x02)
2618 #define	TX_CMD_SEC_TKIP		(0x03)
2619 #define	TX_CMD_SEC_MSK		(0x03)
2620 #define	TX_CMD_SEC_SHIFT	(6)
2621 #define	TX_CMD_SEC_KEY128	(0x08)
2622 
2623 #define	WEP_IV_LEN	(4)
2624 #define	WEP_ICV_LEN	(4)
2625 #define	CCMP_MIC_LEN	(8)
2626 #define	TKIP_ICV_LEN	(4)
2627 
2628 #ifdef __cplusplus
2629 }
2630 #endif
2631 
2632 #endif /* _IWH_HW_H_ */
2633