xref: /openbsd/sys/dev/ic/if_wireg.h (revision 7bb4d322)
1 /*	$OpenBSD: if_wireg.h,v 1.40 2011/06/21 16:52:45 tedu Exp $	*/
2 
3 /*
4  * Copyright (c) 1997, 1998, 1999
5  *	Bill Paul <wpaul@ctr.columbia.edu>.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. All advertising materials mentioning features or use of this software
16  *    must display the following acknowledgement:
17  *	This product includes software developed by Bill Paul.
18  * 4. Neither the name of the author nor the names of any co-contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
26  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
27  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
28  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
29  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
30  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
31  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
32  * THE POSSIBILITY OF SUCH DAMAGE.
33  *
34  *	From: if_wireg.h,v 1.8.2.2 2001/08/25 00:48:25 nsayer Exp $
35  */
36 
37 #define WI_DELAY	5
38 #define WI_TIMEOUT	(500000/WI_DELAY)	/* 500ms */
39 
40 #define WI_PORT0	0
41 #define WI_PORT1	1
42 #define WI_PORT2	2
43 #define WI_PORT3	3
44 #define WI_PORT4	4
45 #define WI_PORT5	5
46 
47 /* Default port: 0 (only 0 exists on stations) */
48 #define WI_DEFAULT_PORT	(WI_PORT0 << 8)
49 
50 /* Default TX rate: 2Mbps, auto fallback */
51 #define WI_DEFAULT_TX_RATE	3
52 
53 /* Default network name (wildcard) */
54 #define WI_DEFAULT_NETNAME	""
55 
56 #define WI_DEFAULT_AP_DENSITY	1
57 
58 #define WI_DEFAULT_RTS_THRESH	2347
59 
60 #define WI_DEFAULT_DATALEN	2304
61 
62 #define WI_DEFAULT_CREATE_IBSS	0
63 
64 #define WI_DEFAULT_PM_ENABLED	0
65 
66 #define WI_DEFAULT_MAX_SLEEP	100
67 
68 #define WI_DEFAULT_NODENAME	"WaveLAN/IEEE node"
69 
70 #define WI_DEFAULT_IBSS		"IBSS"
71 
72 #define WI_DEFAULT_CHAN		3
73 
74 #define	WI_DEFAULT_ROAMING	1
75 
76 #define	WI_DEFAULT_AUTHTYPE	1
77 
78 #define	WI_DEFAULT_DIVERSITY	0
79 
80 /*
81  * register space access macros
82  */
83 
84 #define CSR_WRITE_4(sc, reg, val)				\
85 	bus_space_write_4(sc->wi_btag, sc->wi_bhandle,		\
86 	    (sc->sc_pci ? reg * 2: reg), (val))
87 #define CSR_WRITE_2(sc, reg, val)				\
88 	bus_space_write_2(sc->wi_btag, sc->wi_bhandle,		\
89 	    (sc->sc_pci ? reg * 2: reg), (val))
90 #define CSR_WRITE_1(sc, reg, val)				\
91 	bus_space_write_1(sc->wi_btag, sc->wi_bhandle,		\
92 	    (sc->sc_pci ? reg * 2: reg), val)
93 
94 #define CSR_READ_4(sc, reg)					\
95 	bus_space_read_4(sc->wi_btag, sc->wi_bhandle,		\
96 	    (sc->sc_pci ? reg * 2: reg))
97 #define CSR_READ_2(sc, reg)					\
98 	bus_space_read_2(sc->wi_btag, sc->wi_bhandle,		\
99 	    (sc->sc_pci ? reg * 2: reg))
100 #define CSR_READ_1(sc, reg)					\
101 	bus_space_read_1(sc->wi_btag, sc->wi_bhandle,		\
102 	    (sc->sc_pci ? reg * 2: reg))
103 
104 #define CSR_READ_RAW_2(sc, ba, dst, sz)				\
105 	bus_space_read_raw_multi_2((sc)->wi_btag,		\
106 	    (sc)->wi_bhandle,					\
107 	    (sc->sc_pci? ba * 2: ba), (dst), (sz))
108 #define CSR_WRITE_RAW_2(sc, ba, dst, sz)			\
109 	bus_space_write_raw_multi_2((sc)->wi_btag,		\
110 	    (sc)->wi_bhandle,					\
111 	    (sc->sc_pci? ba * 2: ba), (dst), (sz))
112 
113 /*
114  * The WaveLAN/IEEE cards contain an 802.11 MAC controller which Lucent
115  * calls 'Hermes.' In typical fashion, getting documentation about this
116  * controller is about as easy as squeezing blood from a stone. Here
117  * is more or less what I know:
118  *
119  * - The Hermes controller is firmware driven, and the host interacts
120  *   with the Hermes via a firmware interface, which can change.
121  *
122  * - The Hermes is described in a document called: "Hermes Firmware
123  *   WaveLAN/IEEE Station Functions," document #010245, which of course
124  *   Lucent will not release without an NDA.
125  *
126  * - Lucent has created a library called HCF (Hardware Control Functions)
127  *   though which it wants developers to interact with the card. The HCF
128  *   is needlessly complex, ill conceived and badly documented. Actually,
129  *   the comments in the HCP code itself aren't bad, but the publicly
130  *   available manual that comes with it is awful, probably due largely to
131  *   the fact that it has been emasculated in order to hide information
132  *   that Lucent wants to keep proprietary. The purpose of the HCF seems
133  *   to be to insulate the driver programmer from the Hermes itself so that
134  *   Lucent has an excuse not to release programming in for it.
135  *
136  * - Lucent only makes available documentation and code for 'HCF Light'
137  *   which is a stripped down version of HCF with certain features not
138  *   implemented, most notably support for 802.11 frames.
139  *
140  * - The HCF code which I have seen blows goats. Whoever decided to
141  *   use a 132 column format should be shot.
142  *
143  * Rather than actually use the Lucent HCF library, I have stripped all
144  * the useful information from it and used it to create a driver in the
145  * usual BSD form. Note: I don't want to hear anybody whining about the
146  * fact that the Lucent code is GPLed and mine isn't. I did not actually
147  * put any of Lucent's code in this driver: I only used it as a reference
148  * to obtain information about the underlying hardware. The Hermes
149  * programming interface is not GPLed, so bite me.
150  */
151 
152 /*
153  * Size of Hermes & Prism2 I/O space.
154  */
155 #define WI_IOSIZ		0x40
156 
157 /*
158  * Hermes register definitions and what little I know about them.
159  */
160 
161 /* Hermes command/status registers. */
162 #define WI_COMMAND		0x00
163 #define WI_PARAM0		0x02
164 #define WI_PARAM1		0x04
165 #define WI_PARAM2		0x06
166 #define WI_STATUS		0x08
167 #define WI_RESP0		0x0A
168 #define WI_RESP1		0x0C
169 #define WI_RESP2		0x0E
170 
171 /* Command register values. */
172 #define WI_CMD_BUSY		0x8000 /* busy bit */
173 #define WI_CMD_INI		0x0000 /* initialize */
174 #define WI_CMD_ENABLE		0x0001 /* enable */
175 #define WI_CMD_DISABLE		0x0002 /* disable */
176 #define WI_CMD_DIAG		0x0003
177 #define WI_CMD_ALLOC_MEM	0x000A /* allocate NIC memory */
178 #define WI_CMD_TX		0x000B /* transmit */
179 #define WI_CMD_NOTIFY		0x0010
180 #define WI_CMD_INQUIRE		0x0011
181 #define WI_CMD_ACCESS		0x0021
182 #define WI_CMD_PROGRAM		0x0022
183 #define WI_CMD_READ_MIF		0x0030 /* prism2 */
184 #define WI_CMD_WRITE_MIF	0x0031 /* prism2 */
185 
186 #define WI_CMD_CODE_MASK	0x003F
187 
188 /*
189  * Reclaim qualifier bit, applicable to the
190  * TX and INQUIRE commands.
191  */
192 #define WI_RECLAIM		0x0100 /* reclaim NIC memory */
193 
194 /*
195  * ACCESS command qualifier bits.
196  */
197 #define WI_ACCESS_READ		0x0000
198 #define WI_ACCESS_WRITE		0x0100
199 
200 /*
201  * PROGRAM command qualifier bits.
202  */
203 #define WI_PROGRAM_DISABLE	0x0000
204 #define WI_PROGRAM_ENABLE_RAM	0x0100
205 #define WI_PROGRAM_ENABLE_NVRAM	0x0200
206 #define WI_PROGRAM_NVRAM	0x0300
207 
208 /* Status register values */
209 #define WI_STAT_CMD_CODE	0x003F
210 #define WI_STAT_DIAG_ERR	0x0100
211 #define WI_STAT_INQ_ERR		0x0500
212 #define WI_STAT_CMD_RESULT	0x7F00
213 
214 /* memory handle management registers */
215 #define WI_INFO_FID		0x10
216 #define WI_RX_FID		0x20
217 #define WI_ALLOC_FID		0x22
218 #define WI_TX_CMP_FID		0x24
219 
220 /*
221  * Buffer Access Path (BAP) registers.
222  * These are I/O channels. I believe you can use each one for
223  * any desired purpose independently of the other. In general
224  * though, we use BAP1 for reading and writing LTV records and
225  * reading received data frames, and BAP0 for writing transmit
226  * frames. This is a convention though, not a rule.
227  */
228 #define WI_SEL0			0x18
229 #define WI_SEL1			0x1A
230 #define WI_OFF0			0x1C
231 #define WI_OFF1			0x1E
232 #define WI_DATA0		0x36
233 #define WI_DATA1		0x38
234 #define WI_BAP0			WI_DATA0
235 #define WI_BAP1			WI_DATA1
236 
237 #define WI_OFF_BUSY		0x8000
238 #define WI_OFF_ERR		0x4000
239 #define WI_OFF_DATAOFF		0x0FFF
240 
241 /* Event registers */
242 #define WI_EVENT_STAT		0x30	/* Event status */
243 #define WI_INT_EN		0x32	/* Interrupt enable/disable */
244 #define WI_EVENT_ACK		0x34	/* Ack event */
245 
246 /* Events */
247 #define WI_EV_TICK		0x8000	/* aux timer tick */
248 #define WI_EV_RES		0x4000	/* controller h/w error (time out) */
249 #define WI_EV_INFO_DROP		0x2000	/* no RAM to build unsolicited frame */
250 #define WI_EV_NO_CARD		0x0800	/* card removed (hunh?) */
251 #define WI_EV_DUIF_RX		0x0400	/* wavelan management packet received */
252 #define WI_EV_INFO		0x0080	/* async info frame */
253 #define WI_EV_CMD		0x0010	/* command completed */
254 #define WI_EV_ALLOC		0x0008	/* async alloc/reclaim completed */
255 #define WI_EV_TX_EXC		0x0004	/* async xmit completed with failure */
256 #define WI_EV_TX		0x0002	/* async xmit completed successfully */
257 #define WI_EV_RX		0x0001	/* async rx completed */
258 
259 #define WI_INTRS	\
260 	(WI_EV_RX|WI_EV_TX|WI_EV_TX_EXC|WI_EV_ALLOC|WI_EV_INFO|WI_EV_INFO_DROP)
261 
262 /* Host software registers */
263 #define WI_SW0			0x28
264 #define WI_SW1			0x2A
265 #define WI_SW2			0x2C
266 #define WI_SW3			0x2E
267 
268 #define WI_CNTL			0x14
269 
270 #define WI_CNTL_AUX_ENA		0xC000
271 #define WI_CNTL_AUX_ENA_STAT	0xC000
272 #define WI_CNTL_AUX_DIS_STAT	0x0000
273 #define WI_CNTL_AUX_ENA_CNTL	0x8000
274 #define WI_CNTL_AUX_DIS_CNTL	0x4000
275 
276 #define WI_AUX_PAGE		0x3A
277 #define WI_AUX_OFFSET		0x3C
278 #define WI_AUX_DATA		0x3E
279 
280 #define WI_COR_OFFSET		0x40	/* COR attribute offset of card */
281 #define WI_COR_IOMODE		0x41	/* Enable i/o mode with level irqs */
282 
283 #define WI_PLX_LOCALRES		0x14	/* PLX chip's local registers */
284 #define WI_PLX_MEMRES		0x18	/* Prism attribute memory (PLX) */
285 #define WI_PLX_IORES		0x1C	/* Prism I/O space (PLX) */
286 #define WI_PLX_INTCSR		0x4C	/* PLX Interrupt CSR */
287 #define WI_PLX_INTEN		0x40	/* PCI Interrupt Enable bit */
288 #define WI_PLX_LINT1STAT	0x04	/* Local interrupt 1 status bit */
289 #define WI_PLX_COR_OFFSET	0x3E0	/* COR attribute offset of card */
290 
291 #define	WI_ACEX_CMDRES		0x10	/* BAR0 (I/O) for ACEX-based bridge */
292 #define	WI_ACEX_LOCALRES	0x14	/* BAR1 (I/O) for ACEX-based bridge */
293 #define	WI_ACEX_IORES		0x18	/* BAR2 (I/O) for ACEX-based bridge */
294 #define	WI_ACEX_COR_OFFSET	0xe0	/* COR attribute offset of card */
295 
296 #define WI_TMD_LOCALRES		0x14	/* TMD chip's local registers */
297 #define WI_TMD_IORES		0x18	/* Prism I/O space (TMD) */
298 
299 #define	WI_DRVR_MAGIC		0x4A2D	/* Magic number for card detection */
300 
301 /*
302  * PCI Host Interface Registers (HFA3842 Specific)
303  * The value of all Register's Offset, such as WI_INFO_FID and WI_PARAM0,
304  * has doubled.
305  * About WI_PCI_COR: In this Register, only soft-reset bit implement; Bit(7).
306  */
307 #define WI_PCI_CBMA		0x10
308 #define WI_PCI_COR_OFFSET	0x4C
309 #define WI_PCI_HCR		0x5C
310 #define WI_PCI_MASTER0_ADDRH	0x80
311 #define WI_PCI_MASTER0_ADDRL	0x84
312 #define WI_PCI_MASTER0_LEN	0x88
313 #define WI_PCI_MASTER0_CON	0x8C
314 
315 #define WI_PCI_STATUS		0x98
316 
317 #define WI_PCI_MASTER1_ADDRH	0xA0
318 #define WI_PCI_MASTER1_ADDRL	0xA4
319 #define WI_PCI_MASTER1_LEN	0xA8
320 #define WI_PCI_MASTER1_CON	0xAC
321 
322 #define WI_COR_SOFT_RESET	(1 << 7)
323 #define WI_COR_CLEAR		0x00
324 
325 /*
326  * One form of communication with the Hermes is with what Lucent calls
327  * LTV records, where LTV stands for Length, Type and Value. The length
328  * and type are 16 bits and are in native byte order. The value is in
329  * multiples of 16 bits and is in little endian byte order.
330  */
331 struct wi_ltv_gen {
332 	u_int16_t		wi_len;
333 	u_int16_t		wi_type;
334 	u_int16_t		wi_val;
335 };
336 
337 struct wi_ltv_str {
338 	u_int16_t		wi_len;
339 	u_int16_t		wi_type;
340 	u_int16_t		wi_str[17];
341 };
342 
343 #define WI_SETVAL(recno, val)			\
344 	do {					\
345 		struct wi_ltv_gen	g;	\
346 						\
347 		g.wi_len = 2;			\
348 		g.wi_type = recno;		\
349 		g.wi_val = htole16(val);	\
350 		wi_write_record(sc, &g);	\
351 	} while (0)
352 
353 #define WI_SETSTR(recno, str)					\
354 	do {							\
355 		struct wi_ltv_str	s;			\
356 		int			l;			\
357 								\
358 		l = (str.i_len + 1) & ~0x1;			\
359 		bzero(&s, sizeof(s));				\
360 		s.wi_len = (l / 2) + 2;				\
361 		s.wi_type = recno;				\
362 		s.wi_str[0] = htole16(str.i_len);		\
363 		bcopy(str.i_nwid, &s.wi_str[1], str.i_len);	\
364 		wi_write_record(sc, (struct wi_ltv_gen *)&s);	\
365 	} while (0)
366 
367 /*
368  * Download buffer location and length (0xFD01).
369  */
370 #define WI_RID_DNLD_BUF		0xFD01
371 struct wi_ltv_dnld_buf {
372 	u_int16_t		wi_len;
373 	u_int16_t		wi_type;
374 	u_int16_t		wi_buf_pg; /* page addr of intermediate dl buf*/
375 	u_int16_t		wi_buf_off; /* offset of idb */
376 	u_int16_t		wi_buf_len; /* len of idb */
377 };
378 
379 /*
380  * Mem sizes (0xFD02).
381  */
382 #define WI_RID_MEMSZ		0xFD02
383 struct wi_ltv_memsz {
384 	u_int16_t		wi_len;
385 	u_int16_t		wi_type;
386 	u_int16_t		wi_mem_ram;
387 	u_int16_t		wi_mem_nvram;
388 };
389 
390 /*
391  * NIC Identification (0xFD0B == WI_RID_CARD_ID)
392  */
393 struct wi_ltv_ver {
394 	u_int16_t	wi_len;
395 	u_int16_t	wi_type;
396 	u_int16_t	wi_ver[4];
397 };
398 
399 /*
400  * List of intended regulatory domains (WI_RID_DOMAINS = 0xFD11).
401  */
402 struct wi_ltv_domains {
403 	u_int16_t		wi_len;
404 	u_int16_t		wi_type;
405 	u_int16_t		wi_domains[6];
406 };
407 
408 /*
409  * CIS struct (0xFD13 == WI_RID_CIS).
410  */
411 struct wi_ltv_cis {
412 	u_int16_t		wi_len;
413 	u_int16_t		wi_type;
414 	u_int16_t		wi_cis[240];
415 };
416 
417 /*
418  * Communications quality (0xFD43 == WI_RID_COMMQUAL).
419  */
420 struct wi_ltv_commqual {
421 	u_int16_t		wi_len;
422 	u_int16_t		wi_type;
423 	u_int16_t		wi_coms_qual;
424 	u_int16_t		wi_sig_lvl;
425 	u_int16_t		wi_noise_lvl;
426 };
427 
428 /*
429  * Actual system scale thresholds (0xFD46 == WI_RID_SCALETHRESH).
430  */
431 struct wi_ltv_scalethresh {
432 	u_int16_t		wi_len;
433 	u_int16_t		wi_type;
434 	u_int16_t		wi_energy_detect;
435 	u_int16_t		wi_carrier_detect;
436 	u_int16_t		wi_defer;
437 	u_int16_t		wi_cell_search;
438 	u_int16_t		wi_out_of_range;
439 	u_int16_t		wi_delta_snr;
440 };
441 
442 /*
443  * PCF info struct (0xFD87 == WI_RID_PCF).
444  */
445 struct wi_ltv_pcf {
446 	u_int16_t		wi_len;
447 	u_int16_t		wi_type;
448 	u_int16_t		wi_energy_detect;
449 	u_int16_t		wi_carrier_detect;
450 	u_int16_t		wi_defer;
451 	u_int16_t		wi_cell_search;
452 	u_int16_t		wi_range;
453 };
454 
455 /*
456  * Connection control characteristics (0xFC00 == WI_RID_PORTTYPE).
457  * 1 == Basic Service Set (BSS)
458  * 2 == Wireless Distribution System (WDS)
459  * 3 == Pseudo IBSS (aka ad-hoc demo)
460  * 4 == IBSS
461  */
462 #define WI_PORTTYPE_BSS		0x1
463 #define WI_PORTTYPE_WDS		0x2
464 #define WI_PORTTYPE_ADHOC	0x3
465 #define WI_PORTTYPE_IBSS	0x4
466 #define WI_PORTTYPE_HOSTAP	0x6
467 
468 /*
469  * Mac addresses.
470  */
471 struct wi_ltv_macaddr {
472 	u_int16_t		wi_len;
473 	u_int16_t		wi_type;
474 	u_int16_t		wi_mac_addr[3];
475 };
476 
477 /*
478  * Station set identification (SSID).
479  */
480 struct wi_ltv_ssid {
481 	u_int16_t		wi_len;
482 	u_int16_t		wi_type;
483 	u_int16_t		wi_id[17];
484 };
485 
486 /*
487  * Set our station name (0xFC0E == WI_RID_NODENAME).
488  */
489 struct wi_ltv_nodename {
490 	u_int16_t		wi_len;
491 	u_int16_t		wi_type;
492 	u_int16_t		wi_nodename[17];
493 };
494 
495 /*
496  * Multicast addresses to be put in filter. We're allowed up
497  * to 16 addresses in the filter (0xFC80 == WI_RID_MCAST).
498  */
499 struct wi_ltv_mcast {
500 	u_int16_t		wi_len;
501 	u_int16_t		wi_type;
502 	struct ether_addr	wi_mcast[16];
503 };
504 
505 
506 /*
507  * Get supported data rates (0xFDC6 == WI_RID_DATA_RATES).
508  */
509 struct wi_ltv_rates {
510 	u_int16_t		wi_len;
511 	u_int16_t		wi_type;
512 	u_int8_t		wi_rates[10];
513 };
514 
515 /*
516  * Supported rates.
517  */
518 #define WI_SUPPRATES_1M		0x0001
519 #define WI_SUPPRATES_2M		0x0002
520 #define WI_SUPPRATES_5M		0x0004
521 #define WI_SUPPRATES_11M	0x0008
522 #define	WI_RATES_BITS	"\20\0011M\0022M\0035.5M\00411M"
523 
524 /*
525  * Information frame types.
526  */
527 #define WI_INFO_NOTIFY		0xF000	/* Handover address */
528 #define WI_INFO_COUNTERS	0xF100	/* Statistics counters */
529 #define WI_INFO_SCAN_RESULTS	0xF101	/* Scan results */
530 #define WI_INFO_LINK_STAT	0xF200	/* Link status */
531 #define WI_INFO_ASSOC_STAT	0xF201	/* Association status */
532 
533 /*
534  * Hermes transmit/receive frame structure
535  */
536 struct wi_frame {
537 	u_int16_t		wi_status;	/* 0x00 */
538 	u_int16_t		wi_rsvd0;	/* 0x02 */
539 	u_int16_t		wi_rsvd1;	/* 0x04 */
540 	u_int16_t		wi_q_info;	/* 0x06 */
541 	u_int16_t		wi_rsvd2;	/* 0x08 */
542 	u_int8_t		wi_tx_rtry;	/* 0x0A */
543 	u_int8_t		wi_tx_rate;	/* 0x0A */
544 	u_int16_t		wi_tx_ctl;	/* 0x0C */
545 	u_int16_t		wi_frame_ctl;	/* 0x0E */
546 	u_int16_t		wi_id;		/* 0x10 */
547 	u_int8_t		wi_addr1[6];	/* 0x12 */
548 	u_int8_t		wi_addr2[6];	/* 0x18 */
549 	u_int8_t		wi_addr3[6];	/* 0x1E */
550 	u_int16_t		wi_seq_ctl;	/* 0x24 */
551 	u_int8_t		wi_addr4[6];	/* 0x26 */
552 	u_int16_t		wi_dat_len;	/* 0x2C */
553 	u_int8_t		wi_dst_addr[6];	/* 0x2E */
554 	u_int8_t		wi_src_addr[6];	/* 0x34 */
555 	u_int16_t		wi_len;		/* 0x3A */
556 	u_int16_t		wi_dat[3];	/* 0x3C */ /* SNAP header */
557 	u_int16_t		wi_type;	/* 0x42 */
558 };
559 
560 #define WI_802_3_OFFSET		0x2E
561 #define WI_802_11_OFFSET	0x44
562 #define WI_802_11_OFFSET_RAW	0x3C
563 #define WI_802_11_OFFSET_HDR	0x0E
564 
565 #define WI_STAT_BADCRC		0x0001
566 #define WI_STAT_UNDECRYPTABLE	0x0002
567 #define WI_STAT_ERRSTAT		0x0003
568 #define WI_STAT_MAC_PORT	0x0700
569 #define WI_STAT_1042		0x2000	/* RFC1042 encoded */
570 #define WI_STAT_TUNNEL		0x4000	/* Bridge-tunnel encoded */
571 #define WI_STAT_WMP_MSG		0x6000	/* WaveLAN-II management protocol */
572 #define WI_STAT_MGMT		0x8000	/* 802.11b management frames */
573 #define WI_RXSTAT_MSG_TYPE	0xE000
574 
575 #define WI_ENC_TX_802_3		0x00
576 #define WI_ENC_TX_802_11	0x11
577 #define	WI_ENC_TX_MGMT		0x08
578 #define WI_ENC_TX_E_II		0x0E
579 
580 #define WI_ENC_TX_1042		0x00
581 #define WI_ENC_TX_TUNNEL	0xF8
582 
583 #define WI_TXCNTL_MACPORT	0x00FF
584 #define WI_TXCNTL_STRUCTTYPE	0xFF00
585 #define WI_TXCNTL_TX_EX		0x0004
586 #define WI_TXCNTL_TX_OK		0x0002
587 #define WI_TXCNTL_NOCRYPT	0x0080
588 
589 
590 /*
591  * SNAP (sub-network access protocol) constants for transmission
592  * of IP datagrams over IEEE 802 networks, taken from RFC1042.
593  * We need these for the LLC/SNAP header fields in the TX/RX frame
594  * structure.
595  */
596 #define WI_SNAP_K1		0xaa	/* assigned global SAP for SNAP */
597 #define WI_SNAP_K2		0x00
598 #define WI_SNAP_CONTROL		0x03	/* unnumbered information format */
599 #define WI_SNAP_WORD0		(WI_SNAP_K1 | (WI_SNAP_K1 << 8))
600 #define WI_SNAP_WORD1		(WI_SNAP_K2 | (WI_SNAP_CONTROL << 8))
601 #define WI_SNAPHDR_LEN		0x6
602 #define WI_FCS_LEN		0x4
603 
604 #define	WI_ETHERTYPE_LEN	0x2
605 
606 /*
607  * HFA3861/3863 (BBP) Control Registers
608  */
609 #define WI_HFA384X_CR_A_D_TEST_MODES2	0x1a
610 #define WI_HFA384X_CR_MANUAL_TX_POWER	0x3e
611