xref: /freebsd/sys/dev/iwn/if_iwnreg.h (revision 71625ec9)
1 /*	$OpenBSD: if_iwnreg.h,v 1.40 2010/05/05 19:41:57 damien Exp $	*/
2 
3 /*-
4  * Copyright (c) 2007, 2008
5  *	Damien Bergamini <damien.bergamini@free.fr>
6  *
7  * Permission to use, copy, modify, and distribute this software for any
8  * purpose with or without fee is hereby granted, provided that the above
9  * copyright notice and this permission notice appear in all copies.
10  *
11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18  */
19 #ifndef	__IF_IWNREG_H__
20 #define	__IF_IWNREG_H__
21 
22 #define	IWN_CT_KILL_THRESHOLD		114	/* in Celsius */
23 #define	IWN_CT_KILL_EXIT_THRESHOLD	95	/* in Celsius */
24 
25 #define IWN_TX_RING_COUNT	256
26 #define IWN_TX_RING_LOMARK	192
27 #define IWN_TX_RING_HIMARK	224
28 #define IWN_RX_RING_COUNT_LOG	6
29 #define IWN_RX_RING_COUNT	(1 << IWN_RX_RING_COUNT_LOG)
30 
31 #define IWN4965_NTXQUEUES	16
32 #define IWN5000_NTXQUEUES	20
33 
34 #define IWN4965_FIRSTAGGQUEUE	7
35 #define IWN5000_FIRSTAGGQUEUE	10
36 
37 #define IWN4965_NDMACHNLS	7
38 #define IWN5000_NDMACHNLS	8
39 
40 #define IWN_SRVC_DMACHNL	9
41 
42 #define IWN_ICT_SIZE		4096
43 #define IWN_ICT_COUNT		(IWN_ICT_SIZE / sizeof (uint32_t))
44 
45 /* For cards with PAN command, default is IWN_CMD_QUEUE_NUM */
46 #define	IWN_CMD_QUEUE_NUM		4
47 #define	IWN_PAN_CMD_QUEUE		9
48 
49 /* Maximum number of DMA segments for TX. */
50 #define IWN_MAX_SCATTER	20
51 
52 /* RX buffers must be large enough to hold a full 4K A-MPDU. */
53 #define IWN_RBUF_SIZE	(4 * 1024)
54 
55 #if defined(__LP64__)
56 /* HW supports 36-bit DMA addresses. */
57 #define IWN_LOADDR(paddr)	((uint32_t)(paddr))
58 #define IWN_HIADDR(paddr)	(((paddr) >> 32) & 0xf)
59 #else
60 #define IWN_LOADDR(paddr)	(paddr)
61 #define IWN_HIADDR(paddr)	(0)
62 #endif
63 
64 /*
65  * Control and status registers.
66  */
67 #define IWN_HW_IF_CONFIG	0x000
68 #define IWN_INT_COALESCING	0x004
69 #define IWN_INT_PERIODIC	0x005	/* use IWN_WRITE_1 */
70 #define IWN_INT			0x008
71 #define IWN_INT_MASK		0x00c
72 #define IWN_FH_INT		0x010
73 #define IWN_GPIO_IN		0x018	/* read external chip pins */
74 #define IWN_RESET		0x020
75 #define IWN_GP_CNTRL		0x024
76 #define IWN_HW_REV		0x028
77 #define IWN_EEPROM		0x02c
78 #define IWN_EEPROM_GP		0x030
79 #define IWN_OTP_GP		0x034
80 #define IWN_GIO			0x03c
81 #define IWN_GP_UCODE		0x048
82 #define IWN_GP_DRIVER		0x050
83 #define IWN_UCODE_GP1		0x054
84 #define IWN_UCODE_GP1_SET	0x058
85 #define IWN_UCODE_GP1_CLR	0x05c
86 #define IWN_UCODE_GP2		0x060
87 #define IWN_LED			0x094
88 #define IWN_DRAM_INT_TBL	0x0a0
89 #define IWN_SHADOW_REG_CTRL	0x0a8
90 #define IWN_GIO_CHICKEN		0x100
91 #define IWN_ANA_PLL		0x20c
92 #define IWN_HW_REV_WA		0x22c
93 #define IWN_DBG_HPET_MEM	0x240
94 #define IWN_DBG_LINK_PWR_MGMT	0x250
95 /* Need nic_lock for use above */
96 #define IWN_MEM_RADDR		0x40c
97 #define IWN_MEM_WADDR		0x410
98 #define IWN_MEM_WDATA		0x418
99 #define IWN_MEM_RDATA		0x41c
100 #define	IWN_TARG_MBX_C		0x430
101 #define IWN_PRPH_WADDR  	0x444
102 #define IWN_PRPH_RADDR   	0x448
103 #define IWN_PRPH_WDATA  	0x44c
104 #define IWN_PRPH_RDATA   	0x450
105 #define IWN_HBUS_TARG_WRPTR	0x460
106 
107 /*
108  * Flow-Handler registers.
109  */
110 #define IWN_FH_TFBD_CTRL0(qid)		(0x1900 + (qid) * 8)
111 #define IWN_FH_TFBD_CTRL1(qid)		(0x1904 + (qid) * 8)
112 #define IWN_FH_KW_ADDR			0x197c
113 #define IWN_FH_SRAM_ADDR(qid)		(0x19a4 + (qid) * 4)
114 #define IWN_FH_CBBC_QUEUE(qid)		(0x19d0 + (qid) * 4)
115 #define IWN_FH_STATUS_WPTR		0x1bc0
116 #define IWN_FH_RX_BASE			0x1bc4
117 #define IWN_FH_RX_WPTR			0x1bc8
118 #define IWN_FH_RX_CONFIG		0x1c00
119 #define IWN_FH_RX_STATUS		0x1c44
120 #define IWN_FH_TX_CONFIG(qid)		(0x1d00 + (qid) * 32)
121 #define IWN_FH_TXBUF_STATUS(qid)	(0x1d08 + (qid) * 32)
122 #define IWN_FH_TX_CHICKEN		0x1e98
123 #define IWN_FH_TX_STATUS		0x1eb0
124 
125 /*
126  * TX scheduler registers.
127  */
128 #define IWN_SCHED_BASE			0xa02c00
129 #define IWN_SCHED_SRAM_ADDR		(IWN_SCHED_BASE + 0x000)
130 #define IWN5000_SCHED_DRAM_ADDR		(IWN_SCHED_BASE + 0x008)
131 #define IWN4965_SCHED_DRAM_ADDR		(IWN_SCHED_BASE + 0x010)
132 #define IWN5000_SCHED_TXFACT		(IWN_SCHED_BASE + 0x010)
133 #define IWN4965_SCHED_TXFACT		(IWN_SCHED_BASE + 0x01c)
134 #define IWN4965_SCHED_QUEUE_RDPTR(qid)	(IWN_SCHED_BASE + 0x064 + (qid) * 4)
135 #define IWN5000_SCHED_QUEUE_RDPTR(qid)	(IWN_SCHED_BASE + 0x068 + (qid) * 4)
136 #define IWN4965_SCHED_QCHAIN_SEL	(IWN_SCHED_BASE + 0x0d0)
137 #define IWN4965_SCHED_INTR_MASK		(IWN_SCHED_BASE + 0x0e4)
138 #define IWN5000_SCHED_QCHAIN_SEL	(IWN_SCHED_BASE + 0x0e8)
139 #define IWN4965_SCHED_QUEUE_STATUS(qid)	(IWN_SCHED_BASE + 0x104 + (qid) * 4)
140 #define IWN5000_SCHED_INTR_MASK		(IWN_SCHED_BASE + 0x108)
141 #define IWN5000_SCHED_QUEUE_STATUS(qid)	(IWN_SCHED_BASE + 0x10c + (qid) * 4)
142 #define IWN5000_SCHED_AGGR_SEL		(IWN_SCHED_BASE + 0x248)
143 
144 /*
145  * Offsets in TX scheduler's SRAM.
146  */
147 #define IWN4965_SCHED_CTX_OFF		0x380
148 #define IWN4965_SCHED_CTX_LEN		416
149 #define IWN4965_SCHED_QUEUE_OFFSET(qid)	(0x380 + (qid) * 8)
150 #define IWN4965_SCHED_TRANS_TBL(qid)	(0x500 + (qid) * 2)
151 #define IWN5000_SCHED_CTX_OFF		0x600
152 #define IWN5000_SCHED_CTX_LEN		520
153 #define IWN5000_SCHED_QUEUE_OFFSET(qid)	(0x600 + (qid) * 8)
154 #define IWN5000_SCHED_TRANS_TBL(qid)	(0x7e0 + (qid) * 2)
155 
156 /*
157  * NIC internal memory offsets.
158  */
159 #define IWN_APMG_CLK_CTRL	0x3000
160 #define IWN_APMG_CLK_EN		0x3004
161 #define IWN_APMG_CLK_DIS	0x3008
162 #define IWN_APMG_PS		0x300c
163 #define IWN_APMG_DIGITAL_SVR	0x3058
164 #define IWN_APMG_ANALOG_SVR	0x306c
165 #define IWN_APMG_PCI_STT	0x3010
166 #define IWN_BSM_WR_CTRL		0x3400
167 #define IWN_BSM_WR_MEM_SRC	0x3404
168 #define IWN_BSM_WR_MEM_DST	0x3408
169 #define IWN_BSM_WR_DWCOUNT	0x340c
170 #define IWN_BSM_DRAM_TEXT_ADDR	0x3490
171 #define IWN_BSM_DRAM_TEXT_SIZE	0x3494
172 #define IWN_BSM_DRAM_DATA_ADDR	0x3498
173 #define IWN_BSM_DRAM_DATA_SIZE	0x349c
174 #define IWN_BSM_SRAM_BASE	0x3800
175 
176 /* Possible flags for register IWN_HW_IF_CONFIG. */
177 #define IWN_HW_IF_CONFIG_4965_R		(1 <<  4)
178 #define IWN_HW_IF_CONFIG_MAC_SI		(1 <<  8)
179 #define IWN_HW_IF_CONFIG_RADIO_SI	(1 <<  9)
180 #define IWN_HW_IF_CONFIG_EEPROM_LOCKED	(1 << 21)
181 #define IWN_HW_IF_CONFIG_NIC_READY	(1 << 22)
182 #define IWN_HW_IF_CONFIG_HAP_WAKE_L1A	(1 << 23)
183 #define IWN_HW_IF_CONFIG_PREPARE_DONE	(1 << 25)
184 #define IWN_HW_IF_CONFIG_PREPARE	(1 << 27)
185 
186 /* Possible values for register IWN_INT_PERIODIC. */
187 #define IWN_INT_PERIODIC_DIS	0x00
188 #define IWN_INT_PERIODIC_ENA	0xff
189 
190 /* Possible flags for registers IWN_PRPH_RADDR/IWN_PRPH_WADDR. */
191 #define IWN_PRPH_DWORD	((sizeof (uint32_t) - 1) << 24)
192 
193 /* Possible values for IWN_BSM_WR_MEM_DST. */
194 #define IWN_FW_TEXT_BASE	0x00000000
195 #define IWN_FW_DATA_BASE	0x00800000
196 
197 /* Possible flags for register IWN_RESET. */
198 #define IWN_RESET_NEVO			(1 << 0)
199 #define IWN_RESET_SW			(1 << 7)
200 #define IWN_RESET_MASTER_DISABLED	(1 << 8)
201 #define IWN_RESET_STOP_MASTER		(1 << 9)
202 #define IWN_RESET_LINK_PWR_MGMT_DIS	(1U << 31)
203 
204 /* Possible flags for register IWN_GP_CNTRL. */
205 #define IWN_GP_CNTRL_MAC_ACCESS_ENA	(1 << 0)
206 #define IWN_GP_CNTRL_MAC_CLOCK_READY	(1 << 0)
207 #define IWN_GP_CNTRL_INIT_DONE		(1 << 2)
208 #define IWN_GP_CNTRL_MAC_ACCESS_REQ	(1 << 3)
209 #define IWN_GP_CNTRL_SLEEP		(1 << 4)
210 #define IWN_GP_CNTRL_RFKILL		(1 << 27)
211 
212 /* Possible flags for register IWN_GIO_CHICKEN. */
213 #define IWN_GIO_CHICKEN_L1A_NO_L0S_RX	(1 << 23)
214 #define IWN_GIO_CHICKEN_DIS_L0S_TIMER	(1 << 29)
215 
216 /* Possible flags for register IWN_GIO. */
217 #define IWN_GIO_L0S_ENA		(1 << 1)
218 
219 /* Possible flags for register IWN_GP_DRIVER. */
220 #define IWN_GP_DRIVER_RADIO_3X3_HYB	(0 << 0)
221 #define IWN_GP_DRIVER_RADIO_2X2_HYB	(1 << 0)
222 #define IWN_GP_DRIVER_RADIO_2X2_IPA	(2 << 0)
223 #define IWN_GP_DRIVER_CALIB_VER6	(1 << 2)
224 #define IWN_GP_DRIVER_6050_1X2		(1 << 3)
225 #define	IWN_GP_DRIVER_REG_BIT_RADIO_IQ_INVERT	(1 << 7)
226 #define	IWN_GP_DRIVER_NONE		0
227 
228 /* Possible flags for register IWN_UCODE_GP1_CLR. */
229 #define IWN_UCODE_GP1_RFKILL		(1 << 1)
230 #define IWN_UCODE_GP1_CMD_BLOCKED	(1 << 2)
231 #define IWN_UCODE_GP1_CTEMP_STOP_RF	(1 << 3)
232 #define	IWN_UCODE_GP1_CFG_COMPLETE	(1 << 5)
233 
234 /* Possible flags/values for register IWN_LED. */
235 #define IWN_LED_BSM_CTRL	(1 << 5)
236 #define IWN_LED_OFF		0x00000038
237 #define IWN_LED_ON		0x00000078
238 
239 #define	IWN_MAX_BLINK_TBL	10
240 #define	IWN_LED_STATIC_ON	0
241 #define	IWN_LED_STATIC_OFF	1
242 #define	IWN_LED_SLOW_BLINK	2
243 #define	IWN_LED_INT_BLINK	3
244 #define	IWN_LED_UNIT		0x1388	/* 5 ms */
245 
246 static const struct {
247 	uint16_t	tpt;	/* Mb/s */
248 	uint8_t		on_time;
249 	uint8_t		off_time;
250 } blink_tbl[] =
251 {
252 	{300, 5, 5},
253 	{200, 8, 8},
254 	{100, 11, 11},
255 	{70, 13, 13},
256 	{50, 15, 15},
257 	{20, 17, 17},
258 	{10, 19, 19},
259 	{5, 22, 22},
260 	{1, 26, 26},
261 	{0, 33, 33},
262 	/* SOLID_ON */
263 };
264 
265 /* Possible flags for register IWN_DRAM_INT_TBL. */
266 #define IWN_DRAM_INT_TBL_WRAP_CHECK	(1 << 27)
267 #define IWN_DRAM_INT_TBL_ENABLE		(1U << 31)
268 
269 /* Possible values for register IWN_ANA_PLL. */
270 #define IWN_ANA_PLL_INIT	0x00880300
271 
272 /* Possible flags for register IWN_FH_RX_STATUS. */
273 #define	IWN_FH_RX_STATUS_IDLE	(1 << 24)
274 
275 /* Possible flags for register IWN_BSM_WR_CTRL. */
276 #define IWN_BSM_WR_CTRL_START_EN	(1 << 30)
277 #define IWN_BSM_WR_CTRL_START		(1U << 31)
278 
279 /* Possible flags for register IWN_INT. */
280 #define IWN_INT_ALIVE		(1 <<  0)
281 #define IWN_INT_WAKEUP		(1 <<  1)
282 #define IWN_INT_SW_RX		(1 <<  3)
283 #define IWN_INT_CT_REACHED	(1 <<  6)
284 #define IWN_INT_RF_TOGGLED	(1 <<  7)
285 #define IWN_INT_SW_ERR		(1 << 25)
286 #define IWN_INT_SCHED		(1 << 26)
287 #define IWN_INT_FH_TX		(1 << 27)
288 #define IWN_INT_RX_PERIODIC	(1 << 28)
289 #define IWN_INT_HW_ERR		(1 << 29)
290 #define IWN_INT_FH_RX		(1U << 31)
291 
292 /* Shortcut. */
293 #define IWN_INT_MASK_DEF						\
294 	(IWN_INT_SW_ERR | IWN_INT_HW_ERR | IWN_INT_FH_TX |		\
295 	 IWN_INT_FH_RX | IWN_INT_ALIVE | IWN_INT_WAKEUP |		\
296 	 IWN_INT_SW_RX | IWN_INT_CT_REACHED | IWN_INT_RF_TOGGLED)
297 
298 /* Possible flags for register IWN_FH_INT. */
299 #define IWN_FH_INT_TX_CHNL(x)	(1 << (x))
300 #define IWN_FH_INT_RX_CHNL(x)	(1 << ((x) + 16))
301 #define IWN_FH_INT_HI_PRIOR	(1 << 30)
302 /* Shortcuts for the above. */
303 #define IWN_FH_INT_TX							\
304 	(IWN_FH_INT_TX_CHNL(0) | IWN_FH_INT_TX_CHNL(1))
305 #define IWN_FH_INT_RX							\
306 	(IWN_FH_INT_RX_CHNL(0) | IWN_FH_INT_RX_CHNL(1) | IWN_FH_INT_HI_PRIOR)
307 
308 /* Possible flags/values for register IWN_FH_TX_CONFIG. */
309 #define IWN_FH_TX_CONFIG_DMA_PAUSE		0
310 #define IWN_FH_TX_CONFIG_DMA_ENA		(1U << 31)
311 #define IWN_FH_TX_CONFIG_CIRQ_HOST_ENDTFD	(1 << 20)
312 
313 /* Possible flags/values for register IWN_FH_TXBUF_STATUS. */
314 #define IWN_FH_TXBUF_STATUS_TBNUM(x)	((x) << 20)
315 #define IWN_FH_TXBUF_STATUS_TBIDX(x)	((x) << 12)
316 #define IWN_FH_TXBUF_STATUS_TFBD_VALID	3
317 
318 /* Possible flags for register IWN_FH_TX_CHICKEN. */
319 #define IWN_FH_TX_CHICKEN_SCHED_RETRY	(1 << 1)
320 
321 /* Possible flags for register IWN_FH_TX_STATUS. */
322 #define IWN_FH_TX_STATUS_IDLE(chnl)	(1 << ((chnl) + 16))
323 
324 /* Possible flags for register IWN_FH_RX_CONFIG. */
325 #define IWN_FH_RX_CONFIG_ENA		(1U << 31)
326 #define IWN_FH_RX_CONFIG_NRBD(x)	((x) << 20)
327 #define IWN_FH_RX_CONFIG_RB_SIZE_8K	(1 << 16)
328 #define IWN_FH_RX_CONFIG_SINGLE_FRAME	(1 << 15)
329 #define IWN_FH_RX_CONFIG_IRQ_DST_HOST	(1 << 12)
330 #define IWN_FH_RX_CONFIG_RB_TIMEOUT(x)	((x) << 4)
331 #define IWN_FH_RX_CONFIG_IGN_RXF_EMPTY	(1 <<  2)
332 
333 /* Possible flags for register IWN_FH_TX_CONFIG. */
334 #define IWN_FH_TX_CONFIG_DMA_ENA	(1U << 31)
335 #define IWN_FH_TX_CONFIG_DMA_CREDIT_ENA	(1 <<  3)
336 
337 /* Possible flags for register IWN_EEPROM. */
338 #define IWN_EEPROM_READ_VALID	(1 << 0)
339 #define IWN_EEPROM_CMD		(1 << 1)
340 
341 /* Possible flags for register IWN_EEPROM_GP. */
342 #define IWN_EEPROM_GP_IF_OWNER	0x00000180
343 
344 /* Possible flags for register IWN_OTP_GP. */
345 #define IWN_OTP_GP_DEV_SEL_OTP		(1 << 16)
346 #define IWN_OTP_GP_RELATIVE_ACCESS	(1 << 17)
347 #define IWN_OTP_GP_ECC_CORR_STTS	(1 << 20)
348 #define IWN_OTP_GP_ECC_UNCORR_STTS	(1 << 21)
349 
350 /* Possible flags for register IWN_SCHED_QUEUE_STATUS. */
351 #define IWN4965_TXQ_STATUS_ACTIVE	0x0007fc01
352 #define IWN4965_TXQ_STATUS_INACTIVE	0x0007fc00
353 #define IWN4965_TXQ_STATUS_AGGR_ENA	(1 << 5 | 1 << 8)
354 #define IWN4965_TXQ_STATUS_CHGACT	(1 << 10)
355 #define IWN5000_TXQ_STATUS_ACTIVE	0x00ff0018
356 #define IWN5000_TXQ_STATUS_INACTIVE	0x00ff0010
357 #define IWN5000_TXQ_STATUS_CHGACT	(1 << 19)
358 
359 /* Possible flags for registers IWN_APMG_CLK_*. */
360 #define IWN_APMG_CLK_CTRL_DMA_CLK_RQT	(1 <<  9)
361 #define IWN_APMG_CLK_CTRL_BSM_CLK_RQT	(1 << 11)
362 
363 /* Possible flags for register IWN_APMG_PS. */
364 #define IWN_APMG_PS_EARLY_PWROFF_DIS	(1 << 22)
365 #define IWN_APMG_PS_PWR_SRC(x)		((x) << 24)
366 #define IWN_APMG_PS_PWR_SRC_VMAIN	0
367 #define IWN_APMG_PS_PWR_SRC_VAUX	2
368 #define IWN_APMG_PS_PWR_SRC_MASK	IWN_APMG_PS_PWR_SRC(3)
369 #define IWN_APMG_PS_RESET_REQ		(1 << 26)
370 
371 /* Possible flags for register IWN_APMG_DIGITAL_SVR. */
372 #define IWN_APMG_DIGITAL_SVR_VOLTAGE(x)		(((x) & 0xf) << 5)
373 #define IWN_APMG_DIGITAL_SVR_VOLTAGE_MASK	\
374 	IWN_APMG_DIGITAL_SVR_VOLTAGE(0xf)
375 #define IWN_APMG_DIGITAL_SVR_VOLTAGE_1_32	\
376 	IWN_APMG_DIGITAL_SVR_VOLTAGE(3)
377 
378 /* Possible flags for IWN_APMG_PCI_STT. */
379 #define IWN_APMG_PCI_STT_L1A_DIS	(1 << 11)
380 
381 /* Possible flags for register IWN_BSM_DRAM_TEXT_SIZE. */
382 #define IWN_FW_UPDATED	(1U << 31)
383 
384 #define IWN_SCHED_WINSZ		64
385 #define IWN_SCHED_LIMIT		64
386 #define IWN4965_SCHED_COUNT	512
387 #define IWN5000_SCHED_COUNT	(IWN_TX_RING_COUNT + IWN_SCHED_WINSZ)
388 #define IWN4965_SCHEDSZ		(IWN4965_NTXQUEUES * IWN4965_SCHED_COUNT * 2)
389 #define IWN5000_SCHEDSZ		(IWN5000_NTXQUEUES * IWN5000_SCHED_COUNT * 2)
390 
391 struct iwn_tx_desc {
392 	uint8_t		reserved1[3];
393 	uint8_t		nsegs;
394 	struct {
395 		uint32_t	addr;
396 		uint16_t	len;
397 	} __packed	segs[IWN_MAX_SCATTER];
398 	/* Pad to 128 bytes. */
399 	uint32_t	reserved2;
400 } __packed;
401 
402 struct iwn_rx_status {
403 	uint16_t	closed_count;
404 	uint16_t	closed_rx_count;
405 	uint16_t	finished_count;
406 	uint16_t	finished_rx_count;
407 	uint32_t	reserved[2];
408 } __packed;
409 
410 struct iwn_rx_desc {
411 	/*
412 	 * The first 4 bytes of the RX frame header contain both the RX frame
413 	 * size and some flags.
414 	 * Bit fields:
415 	 * 31:    flag flush RB request
416 	 * 30:    flag ignore TC (terminal counter) request
417 	 * 29:    flag fast IRQ request
418 	 * 28-14: Reserved
419 	 * 13-00: RX frame size
420 	 */
421 	uint32_t	len;
422 	uint8_t		type;
423 #define IWN_UC_READY			  1
424 #define IWN_ADD_NODE_DONE		 24
425 #define IWN_TX_DONE			 28
426 #define	IWN_REPLY_LED_CMD		72
427 #define IWN5000_CALIBRATION_RESULT	102
428 #define IWN5000_CALIBRATION_DONE	103
429 #define IWN_START_SCAN			130
430 #define	IWN_NOTIF_SCAN_RESULT		131
431 #define IWN_STOP_SCAN			132
432 #define IWN_RX_STATISTICS		156
433 #define IWN_BEACON_STATISTICS		157
434 #define IWN_STATE_CHANGED		161
435 #define IWN_BEACON_MISSED		162
436 #define IWN_RX_PHY			192
437 #define IWN_MPDU_RX_DONE		193
438 #define IWN_RX_DONE			195
439 #define IWN_RX_COMPRESSED_BA		197
440 
441 	uint8_t		flags;	/* 0:5 reserved, 6 abort, 7 internal */
442 	uint8_t		idx;	/* position within TX queue */
443 	uint8_t		qid;
444 	/* 0:4 TX queue id - 5:6 reserved - 7 unsolicited RX
445 	 * or uCode-originated notification
446 	 */
447 } __packed;
448 
449 #define	IWN_RX_DESC_QID_MSK		0x1F
450 #define	IWN_UNSOLICITED_RX_NOTIF	0x80
451 
452 /* CARD_STATE_NOTIFICATION */
453 #define	IWN_STATE_CHANGE_HW_CARD_DISABLED		0x01
454 #define	IWN_STATE_CHANGE_SW_CARD_DISABLED		0x02
455 #define	IWN_STATE_CHANGE_CT_CARD_DISABLED		0x04
456 #define	IWN_STATE_CHANGE_RXON_CARD_DISABLED		0x10
457 
458 /* Possible RX status flags. */
459 #define IWN_RX_NO_CRC_ERR	(1 <<  0)
460 #define IWN_RX_NO_OVFL_ERR	(1 <<  1)
461 /* Shortcut for the above. */
462 #define IWN_RX_NOERROR	(IWN_RX_NO_CRC_ERR | IWN_RX_NO_OVFL_ERR)
463 #define IWN_RX_MPDU_MIC_OK	(1 <<  6)
464 #define IWN_RX_CIPHER_MASK	(7 <<  8)
465 #define IWN_RX_CIPHER_CCMP	(2 <<  8)
466 #define IWN_RX_MPDU_DEC		(1 << 11)
467 #define IWN_RX_DECRYPT_MASK	(3 << 11)
468 #define IWN_RX_DECRYPT_OK	(3 << 11)
469 
470 struct iwn_tx_cmd {
471 	uint8_t	code;
472 #define IWN_CMD_RXON			 16
473 #define IWN_CMD_RXON_ASSOC		 17
474 #define IWN_CMD_EDCA_PARAMS		 19
475 #define IWN_CMD_TIMING			 20
476 #define IWN_CMD_ADD_NODE		 24
477 #define IWN_CMD_TX_DATA			 28
478 #define IWN_CMD_LINK_QUALITY		 78
479 #define IWN_CMD_SET_LED			 72
480 #define IWN5000_CMD_WIMAX_COEX		 90
481 #define	IWN_TEMP_NOTIFICATION		98
482 #define IWN5000_CMD_CALIB_CONFIG	101
483 #define IWN5000_CMD_CALIB_RESULT	102
484 #define IWN5000_CMD_CALIB_COMPLETE	103
485 #define IWN_CMD_SET_POWER_MODE		119
486 #define IWN_CMD_SCAN			128
487 #define IWN_CMD_SCAN_RESULTS		131
488 #define IWN_CMD_TXPOWER_DBM		149
489 #define IWN_CMD_TXPOWER			151
490 #define IWN5000_CMD_TX_ANT_CONFIG	152
491 #define IWN_CMD_TXPOWER_DBM_V1		152
492 #define IWN_CMD_BT_COEX			155
493 #define IWN_CMD_GET_STATISTICS		156
494 #define IWN_CMD_SET_CRITICAL_TEMP	164
495 #define IWN_CMD_SET_SENSITIVITY		168
496 #define IWN_CMD_PHY_CALIB		176
497 #define IWN_CMD_BT_COEX_PRIOTABLE	204
498 #define IWN_CMD_BT_COEX_PROT		205
499 #define	IWN_CMD_BT_COEX_NOTIF		206
500 /* PAN commands */
501 #define	IWN_CMD_WIPAN_PARAMS			0xb2
502 #define	IWN_CMD_WIPAN_RXON			0xb3
503 #define	IWN_CMD_WIPAN_RXON_TIMING		0xb4
504 #define	IWN_CMD_WIPAN_RXON_ASSOC		0xb6
505 #define	IWN_CMD_WIPAN_QOS_PARAM			0xb7
506 #define	IWN_CMD_WIPAN_WEPKEY			0xb8
507 #define	IWN_CMD_WIPAN_P2P_CHANNEL_SWITCH	0xb9
508 #define	IWN_CMD_WIPAN_NOA_NOTIFICATION		0xbc
509 #define	IWN_CMD_WIPAN_DEACTIVATION_COMPLETE	0xbd
510 
511 	uint8_t	flags;
512 	uint8_t	idx;
513 	uint8_t	qid;
514 	uint8_t	data[136];
515 } __packed;
516 
517 /*
518  * Structure for IWN_CMD_GET_STATISTICS = (0x9c) 156
519  * all devices identical.
520  *
521  * This command triggers an immediate response containing uCode statistics.
522  * The response is in the same format as IWN_BEACON_STATISTICS (0x9d) 157.
523  *
524  * If the CLEAR_STATS configuration flag is set, uCode will clear its
525  * internal copy of the statistics (counters) after issuing the response.
526  * This flag does not affect IWN_BEACON_STATISTICS after beacons (see below).
527  *
528  * If the DISABLE_NOTIF configuration flag is set, uCode will not issue
529  * IWN_BEACON_STATISTICS after received beacons.  This flag
530  * does not affect the response to the IWN_CMD_GET_STATISTICS 0x9c itself.
531  */
532 struct iwn_statistics_cmd {
533 	uint32_t	configuration_flags;
534 #define	IWN_STATS_CONF_CLEAR_STATS		htole32(0x1)
535 #define	IWN_STATS_CONF_DISABLE_NOTIF	htole32(0x2)
536 } __packed;
537 
538 /* Antenna flags, used in various commands. */
539 #define IWN_ANT_A	(1 << 0)
540 #define IWN_ANT_B	(1 << 1)
541 #define IWN_ANT_C	(1 << 2)
542 /* Shortcuts. */
543 #define IWN_ANT_AB	(IWN_ANT_A | IWN_ANT_B)
544 #define IWN_ANT_BC	(IWN_ANT_B | IWN_ANT_C)
545 #define	IWN_ANT_AC	(IWN_ANT_A | IWN_ANT_C)
546 #define IWN_ANT_ABC	(IWN_ANT_A | IWN_ANT_B | IWN_ANT_C)
547 
548 /* Structure for command IWN_CMD_RXON. */
549 struct iwn_rxon {
550 	uint8_t		myaddr[IEEE80211_ADDR_LEN];
551 	uint16_t	reserved1;
552 	uint8_t		bssid[IEEE80211_ADDR_LEN];
553 	uint16_t	reserved2;
554 	uint8_t		wlap[IEEE80211_ADDR_LEN];
555 	uint16_t	reserved3;
556 	uint8_t		mode;
557 #define IWN_MODE_HOSTAP		1
558 #define IWN_MODE_STA		3
559 #define IWN_MODE_IBSS		4
560 #define IWN_MODE_MONITOR	6
561 #define	IWN_MODE_2STA		8
562 #define	IWN_MODE_P2P		9
563 
564 	uint8_t		air;
565 	uint16_t	rxchain;
566 #define IWN_RXCHAIN_DRIVER_FORCE	(1 << 0)
567 #define IWN_RXCHAIN_VALID(x)		(((x) & IWN_ANT_ABC) << 1)
568 #define IWN_RXCHAIN_FORCE_SEL(x)	(((x) & IWN_ANT_ABC) << 4)
569 #define IWN_RXCHAIN_FORCE_MIMO_SEL(x)	(((x) & IWN_ANT_ABC) << 7)
570 #define IWN_RXCHAIN_IDLE_COUNT(x)	((x) << 10)
571 #define IWN_RXCHAIN_MIMO_COUNT(x)	((x) << 12)
572 #define IWN_RXCHAIN_MIMO_FORCE		(1 << 14)
573 
574 	uint8_t		ofdm_mask;
575 	uint8_t		cck_mask;
576 	uint16_t	associd;
577 	uint32_t	flags;
578 #define IWN_RXON_24GHZ		(1 <<  0)
579 #define IWN_RXON_CCK		(1 <<  1)
580 #define IWN_RXON_AUTO		(1 <<  2)
581 #define IWN_RXON_SHSLOT		(1 <<  4)
582 #define IWN_RXON_SHPREAMBLE	(1 <<  5)
583 #define IWN_RXON_NODIVERSITY	(1 <<  7)
584 #define IWN_RXON_ANTENNA_A	(1 <<  8)
585 #define IWN_RXON_ANTENNA_B	(1 <<  9)
586 #define IWN_RXON_TSF		(1 << 15)
587 #define IWN_RXON_HT_HT40MINUS	(1 << 22)
588 
589 #define IWN_RXON_HT_PROTMODE(x)	(x << 23)
590 
591 /* 0=legacy, 1=pure40, 2=mixed */
592 #define IWN_RXON_HT_MODEPURE40	(1 << 25)
593 #define IWN_RXON_HT_MODEMIXED	(2 << 25)
594 
595 #define IWN_RXON_CTS_TO_SELF	(1 << 30)
596 
597 	uint32_t	filter;
598 #define IWN_FILTER_PROMISC	(1 << 0)
599 #define IWN_FILTER_CTL		(1 << 1)
600 #define IWN_FILTER_MULTICAST	(1 << 2)
601 #define IWN_FILTER_NODECRYPT	(1 << 3)
602 #define IWN_FILTER_BSS		(1 << 5)
603 #define IWN_FILTER_BEACON	(1 << 6)
604 
605 	uint8_t		chan;
606 	uint8_t		reserved4;
607 	uint8_t		ht_single_mask;
608 	uint8_t		ht_dual_mask;
609 	/* The following fields are for >=5000 Series only. */
610 	uint8_t		ht_triple_mask;
611 	uint8_t		reserved5;
612 	uint16_t	acquisition;
613 	uint16_t	reserved6;
614 } __packed;
615 
616 #define IWN4965_RXONSZ	(sizeof (struct iwn_rxon) - 6)
617 #define IWN5000_RXONSZ	(sizeof (struct iwn_rxon))
618 
619 /* Structure for command IWN_CMD_RXON_ASSOC (4965AGN only.) */
620 struct iwn4965_rxon_assoc {
621 	uint32_t	flags;
622 	uint32_t	filter;
623 	uint8_t		ofdm_mask;
624 	uint8_t		cck_mask;
625 	uint8_t		ht_single_mask;
626 	uint8_t		ht_dual_mask;
627 	uint16_t	rxchain;
628 	uint16_t	reserved;
629 } __packed;
630 
631 /* Structure for command IWN_CMD_RXON_ASSOC (5000 Series only.) */
632 struct iwn5000_rxon_assoc {
633 	uint32_t	flags;
634 	uint32_t	filter;
635 	uint8_t		ofdm_mask;
636 	uint8_t		cck_mask;
637 	uint16_t	reserved1;
638 	uint8_t		ht_single_mask;
639 	uint8_t		ht_dual_mask;
640 	uint8_t		ht_triple_mask;
641 	uint8_t		reserved2;
642 	uint16_t	rxchain;
643 	uint16_t	acquisition;
644 	uint32_t	reserved3;
645 } __packed;
646 
647 /* Structure for command IWN_CMD_ASSOCIATE. */
648 struct iwn_assoc {
649 	uint32_t	flags;
650 	uint32_t	filter;
651 	uint8_t		ofdm_mask;
652 	uint8_t		cck_mask;
653 	uint16_t	reserved;
654 } __packed;
655 
656 /* Structure for command IWN_CMD_EDCA_PARAMS. */
657 struct iwn_edca_params {
658 	uint32_t	flags;
659 #define IWN_EDCA_UPDATE	(1 << 0)
660 #define IWN_EDCA_TXOP	(1 << 4)
661 
662 	struct {
663 		uint16_t	cwmin;
664 		uint16_t	cwmax;
665 		uint8_t		aifsn;
666 		uint8_t		reserved;
667 		uint16_t	txoplimit;
668 	} __packed	ac[WME_NUM_AC];
669 } __packed;
670 
671 /* Structure for command IWN_CMD_TIMING. */
672 struct iwn_cmd_timing {
673 	uint64_t	tstamp;
674 	uint16_t	bintval;
675 	uint16_t	atim;
676 	uint32_t	binitval;
677 	uint16_t	lintval;
678 	uint8_t		dtim_period;
679 	uint8_t		delta_cp_bss_tbtts;
680 } __packed;
681 
682 /* Structure for command IWN_CMD_ADD_NODE. */
683 struct iwn_node_info {
684 	uint8_t		control;
685 #define IWN_NODE_UPDATE		(1 << 0)
686 
687 	uint8_t		reserved1[3];
688 
689 	uint8_t		macaddr[IEEE80211_ADDR_LEN];
690 	uint16_t	reserved2;
691 	uint8_t		id;
692 #define IWN_ID_BSS		0
693 #define	IWN_STA_ID		1
694 
695 #define	IWN_PAN_ID_BCAST	14
696 #define IWN5000_ID_BROADCAST	15
697 #define IWN4965_ID_BROADCAST	31
698 
699 #define IWN_ID_UNDEFINED	(uint8_t)-1
700 
701 	uint8_t		flags;
702 #define IWN_FLAG_SET_KEY		(1 << 0)
703 #define IWN_FLAG_SET_DISABLE_TID	(1 << 1)
704 #define IWN_FLAG_SET_TXRATE		(1 << 2)
705 #define IWN_FLAG_SET_ADDBA		(1 << 3)
706 #define IWN_FLAG_SET_DELBA		(1 << 4)
707 
708 	uint16_t	reserved3;
709 	uint16_t	kflags;
710 #define IWN_KFLAG_CCMP		(1 <<  1)
711 #define IWN_KFLAG_MAP		(1 <<  3)
712 #define IWN_KFLAG_KID(kid)	((kid) << 8)
713 #define IWN_KFLAG_INVALID	(1 << 11)
714 #define IWN_KFLAG_GROUP		(1 << 14)
715 
716 	uint8_t		tsc2;	/* TKIP TSC2 */
717 	uint8_t		reserved4;
718 	uint16_t	ttak[5];
719 	uint8_t		kid;
720 	uint8_t		reserved5;
721 	uint8_t		key[16];
722 	/* The following 3 fields are for 5000 Series only. */
723 	uint64_t	tsc;
724 	uint8_t		rxmic[8];
725 	uint8_t		txmic[8];
726 
727 	uint32_t	htflags;
728 #define IWN_SMPS_MIMO_PROT		(1 << 17)
729 #define IWN_AMDPU_SIZE_FACTOR(x)	((x) << 19)
730 #define IWN_NODE_HT40			(1 << 21)
731 #define IWN_SMPS_MIMO_DIS		(1 << 22)
732 #define IWN_AMDPU_DENSITY(x)		((x) << 23)
733 
734 	uint32_t	mask;
735 	uint16_t	disable_tid;
736 	uint16_t	reserved6;
737 	uint8_t		addba_tid;
738 	uint8_t		delba_tid;
739 	uint16_t	addba_ssn;
740 	uint32_t	reserved7;
741 } __packed;
742 
743 struct iwn4965_node_info {
744 	uint8_t		control;
745 	uint8_t		reserved1[3];
746 	uint8_t		macaddr[IEEE80211_ADDR_LEN];
747 	uint16_t	reserved2;
748 	uint8_t		id;
749 	uint8_t		flags;
750 	uint16_t	reserved3;
751 	uint16_t	kflags;
752 	uint8_t		tsc2;	/* TKIP TSC2 */
753 	uint8_t		reserved4;
754 	uint16_t	ttak[5];
755 	uint8_t		kid;
756 	uint8_t		reserved5;
757 	uint8_t		key[16];
758 	uint32_t	htflags;
759 	uint32_t	mask;
760 	uint16_t	disable_tid;
761 	uint16_t	reserved6;
762 	uint8_t		addba_tid;
763 	uint8_t		delba_tid;
764 	uint16_t	addba_ssn;
765 	uint32_t	reserved7;
766 } __packed;
767 
768 #define IWN_RFLAG_RATE		0xff
769 #define IWN_RFLAG_RATE_MCS	0x1f
770 #define IWN_RFLAG_HT40_DUP	0x20
771 
772 #define IWN_RFLAG_MCS		(1 << 8)
773 #define IWN_RFLAG_CCK		(1 << 9)
774 #define IWN_RFLAG_GREENFIELD	(1 << 10)
775 #define IWN_RFLAG_HT40		(1 << 11)
776 #define IWN_RFLAG_DUPLICATE	(1 << 12)
777 #define IWN_RFLAG_SGI		(1 << 13)
778 #define IWN_RFLAG_ANT(x)	((x) << 14)
779 
780 /* Structure for command IWN_CMD_TX_DATA. */
781 struct iwn_cmd_data {
782 	uint16_t	len;
783 	uint16_t	lnext;
784 	uint32_t	flags;
785 #define IWN_TX_NEED_PROTECTION	(1 <<  0)	/* 5000 only */
786 #define IWN_TX_NEED_RTS		(1 <<  1)
787 #define IWN_TX_NEED_CTS		(1 <<  2)
788 #define IWN_TX_NEED_ACK		(1 <<  3)
789 #define IWN_TX_LINKQ		(1 <<  4)
790 #define IWN_TX_IMM_BA		(1 <<  6)
791 #define IWN_TX_FULL_TXOP	(1 <<  7)
792 #define IWN_TX_BT_DISABLE	(1 << 12)	/* bluetooth coexistence */
793 #define IWN_TX_AUTO_SEQ		(1 << 13)
794 #define IWN_TX_MORE_FRAG	(1 << 14)
795 #define IWN_TX_INSERT_TSTAMP	(1 << 16)
796 #define IWN_TX_NEED_PADDING	(1 << 20)
797 
798 	uint32_t	scratch;
799 	uint32_t	rate;
800 
801 	uint8_t		id;
802 	uint8_t		security;
803 #define IWN_CIPHER_WEP40	1
804 #define IWN_CIPHER_CCMP		2
805 #define IWN_CIPHER_TKIP		3
806 #define IWN_CIPHER_WEP104	9
807 
808 	uint8_t		linkq;
809 	uint8_t		reserved2;
810 	uint8_t		key[16];
811 	uint16_t	fnext;
812 	uint16_t	reserved3;
813 	uint32_t	lifetime;
814 #define IWN_LIFETIME_INFINITE	0xffffffff
815 
816 	uint32_t	loaddr;
817 	uint8_t		hiaddr;
818 	uint8_t		rts_ntries;
819 	uint8_t		data_ntries;
820 	uint8_t		tid;
821 	uint16_t	timeout;
822 	uint16_t	txop;
823 } __packed;
824 
825 /* Structure for command IWN_CMD_LINK_QUALITY. */
826 #define IWN_MAX_TX_RETRIES	16
827 struct iwn_cmd_link_quality {
828 	uint8_t		id;
829 	uint8_t		reserved1;
830 	uint16_t	ctl;
831 	uint8_t		flags;
832 	uint8_t		mimo;
833 	uint8_t		antmsk_1stream;
834 	uint8_t		antmsk_2stream;
835 	uint8_t		ridx[WME_NUM_AC];
836 	uint16_t	ampdu_limit;
837 	uint8_t		ampdu_threshold;
838 	uint8_t		ampdu_max;
839 	uint32_t	reserved2;
840 	uint32_t	retry[IWN_MAX_TX_RETRIES];
841 	uint32_t	reserved3;
842 } __packed;
843 
844 /* Structure for command IWN_CMD_SET_LED. */
845 struct iwn_cmd_led {
846 	uint32_t	unit;	/* multiplier (in usecs) */
847 	uint8_t		which;
848 #define IWN_LED_ACTIVITY	1
849 #define IWN_LED_LINK		2
850 
851 	uint8_t		off;
852 	uint8_t		on;
853 	uint8_t		reserved;
854 } __packed;
855 
856 /* Structure for command IWN5000_CMD_WIMAX_COEX. */
857 struct iwn5000_wimax_coex {
858 	uint32_t	flags;
859 #define IWN_WIMAX_COEX_STA_TABLE_VALID		(1 << 0)
860 #define IWN_WIMAX_COEX_UNASSOC_WA_UNMASK	(1 << 2)
861 #define IWN_WIMAX_COEX_ASSOC_WA_UNMASK		(1 << 3)
862 #define IWN_WIMAX_COEX_ENABLE			(1 << 7)
863 
864 	struct iwn5000_wimax_event {
865 		uint8_t	request;
866 		uint8_t	window;
867 		uint8_t	reserved;
868 		uint8_t	flags;
869 	} __packed	events[16];
870 } __packed;
871 
872 /* Structures for command IWN5000_CMD_CALIB_CONFIG. */
873 struct iwn5000_calib_elem {
874 	uint32_t	enable;
875 	uint32_t	start;
876 #define	IWN5000_CALIB_DC	(1 << 1)
877 
878 	uint32_t	send;
879 	uint32_t	apply;
880 	uint32_t	reserved;
881 } __packed;
882 
883 struct iwn5000_calib_status {
884 	struct iwn5000_calib_elem	once;
885 	struct iwn5000_calib_elem	perd;
886 	uint32_t			flags;
887 } __packed;
888 
889 struct iwn5000_calib_config {
890 	struct iwn5000_calib_status	ucode;
891 	struct iwn5000_calib_status	driver;
892 	uint32_t			reserved;
893 } __packed;
894 
895 /* Structure for command IWN_CMD_SET_POWER_MODE. */
896 struct iwn_pmgt_cmd {
897 	uint16_t	flags;
898 #define IWN_PS_ALLOW_SLEEP	(1 << 0)
899 #define IWN_PS_NOTIFY		(1 << 1)
900 #define IWN_PS_SLEEP_OVER_DTIM	(1 << 2)
901 #define IWN_PS_PCI_PMGT		(1 << 3)
902 #define IWN_PS_FAST_PD		(1 << 4)
903 #define	IWN_PS_BEACON_FILTERING	(1 << 5)
904 #define	IWN_PS_SHADOW_REG	(1 << 6)
905 #define	IWN_PS_CT_KILL		(1 << 7)
906 #define	IWN_PS_BT_SCD		(1 << 8)
907 #define	IWN_PS_ADVANCED_PM	(1 << 9)
908 
909 	uint8_t		keepalive;
910 	uint8_t		debug;
911 	uint32_t	rxtimeout;
912 	uint32_t	txtimeout;
913 	uint32_t	intval[5];
914 	uint32_t	beacons;
915 } __packed;
916 
917 /* Structures for command IWN_CMD_SCAN. */
918 struct iwn_scan_essid {
919 	uint8_t	id;
920 	uint8_t	len;
921 	uint8_t	data[IEEE80211_NWID_LEN];
922 } __packed;
923 
924 struct iwn_scan_hdr {
925 	uint16_t	len;
926 	uint8_t		scan_flags;
927 	uint8_t		nchan;
928 	uint16_t	quiet_time;
929 	uint16_t	quiet_threshold;
930 	uint16_t	crc_threshold;
931 	uint16_t	rxchain;
932 	uint32_t	max_svc;	/* background scans */
933 	uint32_t	pause_svc;	/* background scans */
934 	uint32_t	flags;
935 	uint32_t	filter;
936 
937 	/* Followed by a struct iwn_cmd_data. */
938 	/* Followed by an array of 20 structs iwn_scan_essid. */
939 	/* Followed by probe request body. */
940 	/* Followed by an array of ``nchan'' structs iwn_scan_chan. */
941 } __packed;
942 
943 struct iwn_scan_chan {
944 	uint32_t	flags;
945 #define	IWN_CHAN_PASSIVE	(0 << 0)
946 #define IWN_CHAN_ACTIVE		(1 << 0)
947 #define IWN_CHAN_NPBREQS(x)	(((1 << (x)) - 1) << 1)
948 
949 	uint16_t	chan;
950 	uint8_t		rf_gain;
951 	uint8_t		dsp_gain;
952 	uint16_t	active;		/* msecs */
953 	uint16_t	passive;	/* msecs */
954 } __packed;
955 
956 #define	IWN_SCAN_CRC_TH_DISABLED	0
957 #define	IWN_SCAN_CRC_TH_DEFAULT		htole16(1)
958 #define	IWN_SCAN_CRC_TH_NEVER		htole16(0xffff)
959 
960 /* Maximum size of a scan command. */
961 #define IWN_SCAN_MAXSZ	(MCLBYTES - 4)
962 
963 /*
964  * For active scan, listen ACTIVE_DWELL_TIME (msec) on each channel after
965  * sending probe req.  This should be set long enough to hear probe responses
966  * from more than one AP.
967  */
968 #define	IWN_ACTIVE_DWELL_TIME_2GHZ	(30)	/* all times in msec */
969 #define	IWN_ACTIVE_DWELL_TIME_5GHZ	(20)
970 #define	IWN_ACTIVE_DWELL_FACTOR_2GHZ	(3)
971 #define	IWN_ACTIVE_DWELL_FACTOR_5GHZ	(2)
972 
973 /*
974  * For passive scan, listen PASSIVE_DWELL_TIME (msec) on each channel.
975  * Must be set longer than active dwell time.
976  * For the most reliable scan, set > AP beacon interval (typically 100msec).
977  */
978 #define	IWN_PASSIVE_DWELL_TIME_2GHZ	(20)	/* all times in msec */
979 #define	IWN_PASSIVE_DWELL_TIME_5GHZ	(10)
980 #define	IWN_PASSIVE_DWELL_BASE		(100)
981 #define	IWN_CHANNEL_TUNE_TIME		(5)
982 
983 #define	IWN_SCAN_CHAN_TIMEOUT		2
984 #define	IWN_MAX_SCAN_CHANNEL		50
985 
986 /*
987  * If active scanning is requested but a certain channel is
988  * marked passive, we can do active scanning if we detect
989  * transmissions.
990  *
991  * There is an issue with some firmware versions that triggers
992  * a sysassert on a "good CRC threshold" of zero (== disabled),
993  * on a radar channel even though this means that we should NOT
994  * send probes.
995  *
996  * The "good CRC threshold" is the number of frames that we
997  * need to receive during our dwell time on a channel before
998  * sending out probes -- setting this to a huge value will
999  * mean we never reach it, but at the same time work around
1000  * the aforementioned issue. Thus use IWL_GOOD_CRC_TH_NEVER
1001  * here instead of IWL_GOOD_CRC_TH_DISABLED.
1002  *
1003  * This was fixed in later versions along with some other
1004  * scan changes, and the threshold behaves as a flag in those
1005  * versions.
1006  */
1007 #define	IWN_GOOD_CRC_TH_DISABLED	0
1008 #define	IWN_GOOD_CRC_TH_DEFAULT		htole16(1)
1009 #define	IWN_GOOD_CRC_TH_NEVER		htole16(0xffff)
1010 
1011 /* Structure for command IWN_CMD_TXPOWER (4965AGN only.) */
1012 #define IWN_RIDX_MAX	32
1013 struct iwn4965_cmd_txpower {
1014 	uint8_t		band;
1015 	uint8_t		reserved1;
1016 	uint8_t		chan;
1017 	uint8_t		reserved2;
1018 	struct {
1019 		uint8_t	rf_gain[2];
1020 		uint8_t	dsp_gain[2];
1021 	} __packed	power[IWN_RIDX_MAX + 1];
1022 } __packed;
1023 
1024 /* Structure for command IWN_CMD_TXPOWER_DBM (5000 Series only.) */
1025 struct iwn5000_cmd_txpower {
1026 	int8_t	global_limit;	/* in half-dBm */
1027 #define IWN5000_TXPOWER_AUTO		0x7f
1028 #define IWN5000_TXPOWER_MAX_DBM		16
1029 
1030 	uint8_t	flags;
1031 #define IWN5000_TXPOWER_NO_CLOSED	(1 << 6)
1032 
1033 	int8_t	srv_limit;	/* in half-dBm */
1034 	uint8_t	reserved;
1035 } __packed;
1036 
1037 /* Structures for command IWN_CMD_BLUETOOTH. */
1038 struct iwn_bluetooth {
1039 	uint8_t		flags;
1040 #define IWN_BT_COEX_CHAN_ANN	(1 << 0)
1041 #define IWN_BT_COEX_BT_PRIO	(1 << 1)
1042 #define IWN_BT_COEX_2_WIRE	(1 << 2)
1043 
1044 	uint8_t		lead_time;
1045 #define IWN_BT_LEAD_TIME_DEF	30
1046 
1047 	uint8_t		max_kill;
1048 #define IWN_BT_MAX_KILL_DEF	5
1049 
1050 	uint8_t		reserved;
1051 	uint32_t	kill_ack;
1052 	uint32_t	kill_cts;
1053 } __packed;
1054 
1055 struct iwn6000_btcoex_config {
1056 	uint8_t		flags;
1057 #define	IWN_BT_FLAG_COEX6000_CHAN_INHIBITION	1
1058 #define	IWN_BT_FLAG_COEX6000_MODE_MASK		((1 << 3) | (1 << 4) | (1 << 5 ))
1059 #define	IWN_BT_FLAG_COEX6000_MODE_SHIFT			3
1060 #define	IWN_BT_FLAG_COEX6000_MODE_DISABLED		0
1061 #define	IWN_BT_FLAG_COEX6000_MODE_LEGACY_2W		1
1062 #define	IWN_BT_FLAG_COEX6000_MODE_3W			2
1063 #define	IWN_BT_FLAG_COEX6000_MODE_4W			3
1064 
1065 #define	IWN_BT_FLAG_UCODE_DEFAULT		(1 << 6)
1066 #define	IWN_BT_FLAG_SYNC_2_BT_DISABLE	(1 << 7)
1067 	uint8_t		lead_time;
1068 	uint8_t		max_kill;
1069 	uint8_t		bt3_t7_timer;
1070 	uint32_t	kill_ack;
1071 	uint32_t	kill_cts;
1072 	uint8_t		sample_time;
1073 	uint8_t		bt3_t2_timer;
1074 	uint16_t	bt4_reaction;
1075 	uint32_t	lookup_table[12];
1076 	uint16_t	bt4_decision;
1077 	uint16_t	valid;
1078 	uint8_t		prio_boost;
1079 	uint8_t		tx_prio_boost;
1080 	uint16_t	rx_prio_boost;
1081 } __packed;
1082 
1083 /* Structure for enhanced command IWN_CMD_BLUETOOTH for 2000 Series. */
1084 struct iwn2000_btcoex_config {
1085 	uint8_t		flags;	/* Cf Flags in iwn6000_btcoex_config */
1086 	uint8_t		lead_time;
1087 	uint8_t		max_kill;
1088 	uint8_t		bt3_t7_timer;
1089 	uint32_t	kill_ack;
1090 	uint32_t	kill_cts;
1091 	uint8_t		sample_time;
1092 	uint8_t		bt3_t2_timer;
1093 	uint16_t	bt4_reaction;
1094 	uint32_t	lookup_table[12];
1095 	uint16_t	bt4_decision;
1096 	uint16_t	valid;
1097 
1098 	uint32_t	prio_boost;	/* size change prior to iwn6000_btcoex_config */
1099 	uint8_t		reserved;	/* added prior to iwn6000_btcoex_config */
1100 
1101 	uint8_t		tx_prio_boost;
1102 	uint16_t	rx_prio_boost;
1103 } __packed;
1104 
1105 struct iwn_btcoex_priotable {
1106 	uint8_t		calib_init1;
1107 	uint8_t		calib_init2;
1108 	uint8_t		calib_periodic_low1;
1109 	uint8_t		calib_periodic_low2;
1110 	uint8_t		calib_periodic_high1;
1111 	uint8_t		calib_periodic_high2;
1112 	uint8_t		dtim;
1113 	uint8_t		scan52;
1114 	uint8_t		scan24;
1115 	uint8_t		reserved[7];
1116 } __packed;
1117 
1118 struct iwn_btcoex_prot {
1119 	uint8_t		open;
1120 	uint8_t		type;
1121 	uint8_t		reserved[2];
1122 } __packed;
1123 
1124 /* Structure for command IWN_CMD_SET_CRITICAL_TEMP. */
1125 struct iwn_critical_temp {
1126 	uint32_t	reserved;
1127 	uint32_t	tempM;
1128 	uint32_t	tempR;
1129 /* degK <-> degC conversion macros. */
1130 #define IWN_CTOK(c)	((c) + 273)
1131 #define IWN_KTOC(k)	((k) - 273)
1132 #define IWN_CTOMUK(c)	(((c) * 1000000) + 273150000)
1133 } __packed;
1134 
1135 /* Structures for command IWN_CMD_SET_SENSITIVITY. */
1136 struct iwn_sensitivity_cmd {
1137 	uint16_t	which;
1138 #define IWN_SENSITIVITY_DEFAULTTBL	0
1139 #define IWN_SENSITIVITY_WORKTBL		1
1140 
1141 	uint16_t	energy_cck;
1142 	uint16_t	energy_ofdm;
1143 	uint16_t	corr_ofdm_x1;
1144 	uint16_t	corr_ofdm_mrc_x1;
1145 	uint16_t	corr_cck_mrc_x4;
1146 	uint16_t	corr_ofdm_x4;
1147 	uint16_t	corr_ofdm_mrc_x4;
1148 	uint16_t	corr_barker;
1149 	uint16_t	corr_barker_mrc;
1150 	uint16_t	corr_cck_x4;
1151 	uint16_t	energy_ofdm_th;
1152 } __packed;
1153 
1154 struct iwn_enhanced_sensitivity_cmd {
1155 	uint16_t	which;
1156 	uint16_t	energy_cck;
1157 	uint16_t	energy_ofdm;
1158 	uint16_t	corr_ofdm_x1;
1159 	uint16_t	corr_ofdm_mrc_x1;
1160 	uint16_t	corr_cck_mrc_x4;
1161 	uint16_t	corr_ofdm_x4;
1162 	uint16_t	corr_ofdm_mrc_x4;
1163 	uint16_t	corr_barker;
1164 	uint16_t	corr_barker_mrc;
1165 	uint16_t	corr_cck_x4;
1166 	uint16_t	energy_ofdm_th;
1167 	/* "Enhanced" part. */
1168 	uint16_t	ina_det_ofdm;
1169 	uint16_t	ina_det_cck;
1170 	uint16_t	corr_11_9_en;
1171 	uint16_t	ofdm_det_slope_mrc;
1172 	uint16_t	ofdm_det_icept_mrc;
1173 	uint16_t	ofdm_det_slope;
1174 	uint16_t	ofdm_det_icept;
1175 	uint16_t	cck_det_slope_mrc;
1176 	uint16_t	cck_det_icept_mrc;
1177 	uint16_t	cck_det_slope;
1178 	uint16_t	cck_det_icept;
1179 	uint16_t	reserved;
1180 } __packed;
1181 
1182 /*
1183  * Define maximal number of calib result send to runtime firmware
1184  * PS: TEMP_OFFSET count for 2 (std and v2)
1185  */
1186 #define	IWN5000_PHY_CALIB_MAX_RESULT		8
1187 
1188 /* Structures for command IWN_CMD_PHY_CALIB. */
1189 struct iwn_phy_calib {
1190 	uint8_t	code;
1191 #define IWN4965_PHY_CALIB_DIFF_GAIN		 7
1192 #define IWN5000_PHY_CALIB_DC			 8
1193 #define IWN5000_PHY_CALIB_LO			 9
1194 #define IWN5000_PHY_CALIB_TX_IQ			11
1195 #define IWN5000_PHY_CALIB_CRYSTAL		15
1196 #define IWN5000_PHY_CALIB_BASE_BAND		16
1197 #define IWN5000_PHY_CALIB_TX_IQ_PERIODIC	17
1198 #define IWN5000_PHY_CALIB_TEMP_OFFSET		18
1199 
1200 #define IWN5000_PHY_CALIB_RESET_NOISE_GAIN	18
1201 #define IWN5000_PHY_CALIB_NOISE_GAIN		19
1202 
1203 	uint8_t	group;
1204 	uint8_t	ngroups;
1205 	uint8_t	isvalid;
1206 } __packed;
1207 
1208 struct iwn5000_phy_calib_crystal {
1209 	uint8_t	code;
1210 	uint8_t	group;
1211 	uint8_t	ngroups;
1212 	uint8_t	isvalid;
1213 
1214 	uint8_t	cap_pin[2];
1215 	uint8_t	reserved[2];
1216 } __packed;
1217 
1218 struct iwn5000_phy_calib_temp_offset {
1219 	uint8_t		code;
1220 	uint8_t		group;
1221 	uint8_t		ngroups;
1222 	uint8_t		isvalid;
1223 	int16_t		offset;
1224 #define IWN_DEFAULT_TEMP_OFFSET	2700
1225 
1226 	uint16_t	reserved;
1227 } __packed;
1228 
1229 struct iwn5000_phy_calib_temp_offsetv2 {
1230 	uint8_t		code;
1231 	uint8_t		group;
1232 	uint8_t		ngroups;
1233 	uint8_t		isvalid;
1234 	int16_t		offset_high;
1235 	int16_t		offset_low;
1236 	int16_t		burnt_voltage_ref;
1237 	int16_t		reserved;
1238 } __packed;
1239 
1240 struct iwn_phy_calib_gain {
1241 	uint8_t	code;
1242 	uint8_t	group;
1243 	uint8_t	ngroups;
1244 	uint8_t	isvalid;
1245 
1246 	int8_t	gain[3];
1247 	uint8_t	reserved;
1248 } __packed;
1249 
1250 /* Structure for command IWN_CMD_SPECTRUM_MEASUREMENT. */
1251 struct iwn_spectrum_cmd {
1252 	uint16_t	len;
1253 	uint8_t		token;
1254 	uint8_t		id;
1255 	uint8_t		origin;
1256 	uint8_t		periodic;
1257 	uint16_t	timeout;
1258 	uint32_t	start;
1259 	uint32_t	reserved1;
1260 	uint32_t	flags;
1261 	uint32_t	filter;
1262 	uint16_t	nchan;
1263 	uint16_t	reserved2;
1264 	struct {
1265 		uint32_t	duration;
1266 		uint8_t		chan;
1267 		uint8_t		type;
1268 #define IWN_MEASUREMENT_BASIC		(1 << 0)
1269 #define IWN_MEASUREMENT_CCA		(1 << 1)
1270 #define IWN_MEASUREMENT_RPI_HISTOGRAM	(1 << 2)
1271 #define IWN_MEASUREMENT_NOISE_HISTOGRAM	(1 << 3)
1272 #define IWN_MEASUREMENT_FRAME		(1 << 4)
1273 #define IWN_MEASUREMENT_IDLE		(1 << 7)
1274 
1275 		uint16_t	reserved;
1276 	} __packed	chan[10];
1277 } __packed;
1278 
1279 /* Structure for IWN_UC_READY notification. */
1280 #define IWN_NATTEN_GROUPS	5
1281 struct iwn_ucode_info {
1282 	uint8_t		minor;
1283 	uint8_t		major;
1284 	uint16_t	reserved1;
1285 	uint8_t		revision[8];
1286 	uint8_t		type;
1287 	uint8_t		subtype;
1288 #define IWN_UCODE_RUNTIME	0
1289 #define IWN_UCODE_INIT		9
1290 
1291 	uint16_t	reserved2;
1292 	uint32_t	logptr;
1293 	uint32_t	errptr;
1294 	uint32_t	tstamp;
1295 	uint32_t	valid;
1296 
1297 	/* The following fields are for UCODE_INIT only. */
1298 	int32_t		volt;
1299 	struct {
1300 		int32_t	chan20MHz;
1301 		int32_t	chan40MHz;
1302 	} __packed	temp[4];
1303 	int32_t		atten[IWN_NATTEN_GROUPS][2];
1304 } __packed;
1305 
1306 /* Structures for IWN_TX_DONE notification. */
1307 
1308 /*
1309  * TX command response is sent after *agn* transmission attempts.
1310  *
1311  * both postpone and abort status are expected behavior from uCode. there is
1312  * no special operation required from driver; except for RFKILL_FLUSH,
1313  * which required tx flush host command to flush all the tx frames in queues
1314  */
1315 #define	IWN_TX_STATUS_MSK		0x000000ff
1316 #define	IWN_TX_STATUS_DELAY_MSK		0x00000040
1317 #define	IWN_TX_STATUS_ABORT_MSK		0x00000080
1318 #define	IWN_TX_PACKET_MODE_MSK		0x0000ff00
1319 #define	IWN_TX_FIFO_NUMBER_MSK		0x00070000
1320 #define	IWN_TX_RESERVED			0x00780000
1321 #define	IWN_TX_POWER_PA_DETECT_MSK	0x7f800000
1322 #define	IWN_TX_ABORT_REQUIRED_MSK	0x80000000
1323 
1324 /* Success status */
1325 #define	IWN_TX_STATUS_SUCCESS		0x01
1326 #define	IWN_TX_STATUS_DIRECT_DONE	0x02
1327 
1328 /* postpone TX */
1329 #define	IWN_TX_STATUS_POSTPONE_DELAY		0x40
1330 #define	IWN_TX_STATUS_POSTPONE_FEW_BYTES	0x41
1331 #define	IWN_TX_STATUS_POSTPONE_BT_PRIO		0x42
1332 #define	IWN_TX_STATUS_POSTPONE_QUIET_PERIOD	0x43
1333 #define	IWN_TX_STATUS_POSTPONE_CALC_TTAK	0x44
1334 
1335 /* Failures */
1336 #define	IWN_TX_FAIL			0x80	/* all failures have 0x80 set */
1337 #define	IWN_TX_STATUS_FAIL_INTERNAL_CROSSED_RETRY	0x81
1338 #define	IWN_TX_FAIL_SHORT_LIMIT		0x82	/* too many RTS retries */
1339 #define	IWN_TX_FAIL_LONG_LIMIT		0x83	/* too many retries */
1340 #define	IWN_TX_FAIL_FIFO_UNDERRRUN	0x84	/* tx fifo not kept running */
1341 #define	IWN_TX_STATUS_FAIL_DRAIN_FLOW	0x85
1342 #define	IWN_TX_STATUS_FAIL_RFKILL_FLUSH	0x86
1343 #define	IWN_TX_STATUS_FAIL_LIFE_EXPIRE	0x87
1344 #define	IWN_TX_FAIL_DEST_IN_PS		0x88	/* sta found in power save */
1345 #define	IWN_TX_STATUS_FAIL_HOST_ABORTED	0x89
1346 #define	IWN_TX_STATUS_FAIL_BT_RETRY	0x8a
1347 #define	IWN_TX_FAIL_STA_INVALID		0x8b	/* XXX STA invalid (???) */
1348 #define	IWN_TX_STATUS_FAIL_FRAG_DROPPED	0x8c
1349 #define	IWN_TX_STATUS_FAIL_TID_DISABLE	0x8d
1350 #define	IWN_TX_STATUS_FAIL_FIFO_FLUSHED	0x8e
1351 #define	IWN_TX_STATUS_FAIL_INSUFFICIENT_CF_POLL	0x8f
1352 #define	IWN_TX_FAIL_TX_LOCKED		0x90	/* waiting to see traffic */
1353 #define	IWN_TX_STATUS_FAIL_NO_BEACON_ON_RADAR	0x91
1354 
1355 /*
1356  * TX command response for A-MPDU packet responses.
1357  *
1358  * The status response is different to the non A-MPDU responses.
1359  * In addition, the sequence number is treated as the sequence
1360  * number of the TX command, NOT the 802.11 sequence number!
1361  */
1362 #define	IWN_AGG_TX_STATE_TRANSMITTED		0x00
1363 #define	IWN_AGG_TX_STATE_UNDERRUN_MSK		0x01
1364 #define	IWN_AGG_TX_STATE_FEW_BYTES_MSK		0x04
1365 #define	IWN_AGG_TX_STATE_ABORT_MSK		0x08
1366 
1367 #define	IWN_AGG_TX_STATE_LAST_SENT_TTL_MSK	0x10
1368 #define	IWN_AGG_TX_STATE_LAST_SENT_TRY_CNT_MSK	0x20
1369 
1370 #define	IWN_AGG_TX_STATE_SCD_QUERY_MSK		0x80
1371 
1372 #define	IWN_AGG_TX_STATE_TEST_BAD_CRC32_MSK	0x100
1373 
1374 #define	IWN_AGG_TX_STATE_RESPONSE_MSK		0x1ff
1375 #define	IWN_AGG_TX_STATE_DUMP_TX_MSK		0x200
1376 #define	IWN_AGG_TX_STATE_DELAY_TX_MSK		0x400
1377 
1378 #define	IWN_AGG_TX_STATUS_MSK		0x00000fff
1379 #define	IWN_AGG_TX_TRY_MSK		0x0000f000
1380 #define	IWN_AGG_TX_TRY_POS		12
1381 #define	IWN_AGG_TX_TRY_COUNT(status)	\
1382 	(((status) & IWN_AGG_TX_TRY_MSK) >> IWN_AGG_TX_TRY_POS)
1383 
1384 #define	IWN_AGG_TX_STATE_LAST_SENT_MSK		\
1385 	    (IWN_AGG_TX_STATE_LAST_SENT_TTL_MSK | \
1386 	     IWN_AGG_TX_STATE_LAST_SENT_TRY_CNT_MSK)
1387 
1388 #define IWN_AGG_TX_STATE_IGNORE_MASK		\
1389 	    (IWN_AGG_TX_STATE_FEW_BYTES_MSK | \
1390 	     IWN_AGG_TX_STATE_ABORT_MSK)
1391 
1392 /* # tx attempts for first frame in aggregation */
1393 #define	IWN_AGG_TX_STATE_TRY_CNT_POS	12
1394 #define	IWN_AGG_TX_STATE_TRY_CNT_MSK	0xf000
1395 
1396 /* Command ID and sequence number of Tx command for this frame */
1397 #define	IWN_AGG_TX_STATE_SEQ_NUM_POS	16
1398 #define	IWN_AGG_TX_STATE_SEQ_NUM_MSK	0xffff0000
1399 
1400 struct iwn4965_tx_stat {
1401 	uint8_t		nframes;
1402 	uint8_t		btkillcnt;
1403 	uint8_t		rtsfailcnt;
1404 	uint8_t		ackfailcnt;
1405 	uint32_t	rate;
1406 	uint16_t	duration;
1407 	uint16_t	reserved;
1408 	uint32_t	power[2];
1409 	uint32_t	status;
1410 } __packed;
1411 
1412 struct iwn5000_tx_stat {
1413 	uint8_t		nframes;	/* 1 no aggregation, >1 aggregation */
1414 	uint8_t		btkillcnt;
1415 	uint8_t		rtsfailcnt;
1416 	uint8_t		ackfailcnt;
1417 	uint32_t	rate;
1418 	uint16_t	duration;
1419 	uint16_t	reserved;
1420 	uint32_t	power[2];
1421 	uint32_t	info;
1422 	uint16_t	seq;
1423 	uint16_t	len;
1424 	uint8_t		tlc;
1425 	uint8_t		ratid;	/* tid (0:3), sta_id (4:7) */
1426 	uint8_t		fc[2];
1427 	uint16_t	status;
1428 	uint16_t	sequence;
1429 } __packed;
1430 
1431 /* Structure for IWN_BEACON_MISSED notification. */
1432 struct iwn_beacon_missed {
1433 	uint32_t	consecutive;
1434 	uint32_t	total;
1435 	uint32_t	expected;
1436 	uint32_t	received;
1437 } __packed;
1438 
1439 /* Structure for IWN_MPDU_RX_DONE notification. */
1440 struct iwn_rx_mpdu {
1441 	uint16_t	len;
1442 	uint16_t	reserved;
1443 } __packed;
1444 
1445 /* Structures for IWN_RX_DONE and IWN_MPDU_RX_DONE notifications. */
1446 struct iwn4965_rx_phystat {
1447 	uint16_t	antenna;
1448 	uint16_t	agc;
1449 	uint8_t		rssi[6];
1450 } __packed;
1451 
1452 struct iwn5000_rx_phystat {
1453 	uint32_t	reserved1;
1454 	uint32_t	agc;
1455 	uint16_t	rssi[3];
1456 } __packed;
1457 
1458 struct iwn_rx_stat {
1459 	uint8_t		phy_len;
1460 	uint8_t		cfg_phy_len;
1461 #define IWN_STAT_MAXLEN	20
1462 
1463 	uint8_t		id;
1464 	uint8_t		reserved1;
1465 	uint64_t	tstamp;
1466 	uint32_t	beacon;
1467 	uint16_t	flags;
1468 #define IWN_STAT_FLAG_SHPREAMBLE	(1 << 2)
1469 
1470 	uint16_t	chan;
1471 	uint8_t		phybuf[32];
1472 	uint32_t	rate;
1473 /*
1474  * rate bit fields
1475  *
1476  * High-throughput (HT) rate format for bits 7:0 (bit 8 must be "1"):
1477  *  2-0:  0)   6 Mbps
1478  *        1)  12 Mbps
1479  *        2)  18 Mbps
1480  *        3)  24 Mbps
1481  *        4)  36 Mbps
1482  *        5)  48 Mbps
1483  *        6)  54 Mbps
1484  *        7)  60 Mbps
1485  *
1486  *  4-3:  0)  Single stream (SISO)
1487  *        1)  Dual stream (MIMO)
1488  *        2)  Triple stream (MIMO)
1489  *
1490  *    5:  Value of 0x20 in bits 7:0 indicates 6 Mbps HT40 duplicate data
1491  *
1492  * Legacy OFDM rate format for bits 7:0 (bit 8 must be "0", bit 9 "0"):
1493  *  3-0:  0xD)   6 Mbps
1494  *        0xF)   9 Mbps
1495  *        0x5)  12 Mbps
1496  *        0x7)  18 Mbps
1497  *        0x9)  24 Mbps
1498  *        0xB)  36 Mbps
1499  *        0x1)  48 Mbps
1500  *        0x3)  54 Mbps
1501  *
1502  * Legacy CCK rate format for bits 7:0 (bit 8 must be "0", bit 9 "1"):
1503  *  6-0:   10)  1 Mbps
1504  *         20)  2 Mbps
1505  *         55)  5.5 Mbps
1506  *        110)  11 Mbps
1507  *
1508  */
1509 	uint16_t	len;
1510 	uint16_t	reserve3;
1511 } __packed;
1512 
1513 #define IWN_RSSI_TO_DBM	44
1514 
1515 /* Structure for IWN_RX_COMPRESSED_BA notification. */
1516 struct iwn_compressed_ba {
1517 	uint8_t		macaddr[IEEE80211_ADDR_LEN];
1518 	uint16_t	reserved;
1519 	uint8_t		id;
1520 	uint8_t		tid;
1521 	uint16_t	seq;
1522 	uint64_t	bitmap;
1523 	uint16_t	qid;
1524 	uint16_t	ssn;
1525 	/* extra fields starting with iwn5000 */
1526 #if 0
1527 	uint8_t		txed;		/* number of frames sent */
1528 	uint8_t		txed_2_done;	/* number of frames acked */
1529 	uint16_t	reserved1;
1530 #endif
1531 } __packed;
1532 
1533 /* Structure for IWN_START_SCAN notification. */
1534 struct iwn_start_scan {
1535 	uint64_t	tstamp;
1536 	uint32_t	tbeacon;
1537 	uint8_t		chan;
1538 	uint8_t		band;
1539 	uint16_t	reserved;
1540 	uint32_t	status;
1541 } __packed;
1542 
1543 /* Structure for IWN_STOP_SCAN notification. */
1544 struct iwn_stop_scan {
1545 	uint8_t		nchan;
1546 	uint8_t		status;
1547 	uint8_t		reserved;
1548 	uint8_t		chan;
1549 	uint64_t	tsf;
1550 } __packed;
1551 
1552 /* Structure for IWN_SPECTRUM_MEASUREMENT notification. */
1553 struct iwn_spectrum_notif {
1554 	uint8_t		id;
1555 	uint8_t		token;
1556 	uint8_t		idx;
1557 	uint8_t		state;
1558 #define IWN_MEASUREMENT_START	0
1559 #define IWN_MEASUREMENT_STOP	1
1560 
1561 	uint32_t	start;
1562 	uint8_t		band;
1563 	uint8_t		chan;
1564 	uint8_t		type;
1565 	uint8_t		reserved1;
1566 	uint32_t	cca_ofdm;
1567 	uint32_t	cca_cck;
1568 	uint32_t	cca_time;
1569 	uint8_t		basic;
1570 	uint8_t		reserved2[3];
1571 	uint32_t	ofdm[8];
1572 	uint32_t	cck[8];
1573 	uint32_t	stop;
1574 	uint32_t	status;
1575 #define IWN_MEASUREMENT_OK		0
1576 #define IWN_MEASUREMENT_CONCURRENT	1
1577 #define IWN_MEASUREMENT_CSA_CONFLICT	2
1578 #define IWN_MEASUREMENT_TGH_CONFLICT	3
1579 #define IWN_MEASUREMENT_STOPPED		6
1580 #define IWN_MEASUREMENT_TIMEOUT		7
1581 #define IWN_MEASUREMENT_FAILED		8
1582 } __packed;
1583 
1584 /* Structures for IWN_{RX,BEACON}_STATISTICS notification. */
1585 struct iwn_rx_phy_stats {
1586 	uint32_t	ina;
1587 	uint32_t	fina;
1588 	uint32_t	bad_plcp;
1589 	uint32_t	bad_crc32;
1590 	uint32_t	overrun;
1591 	uint32_t	eoverrun;
1592 	uint32_t	good_crc32;
1593 	uint32_t	fa;
1594 	uint32_t	bad_fina_sync;
1595 	uint32_t	sfd_timeout;
1596 	uint32_t	fina_timeout;
1597 	uint32_t	no_rts_ack;
1598 	uint32_t	rxe_limit;
1599 	uint32_t	ack;
1600 	uint32_t	cts;
1601 	uint32_t	ba_resp;
1602 	uint32_t	dsp_kill;
1603 	uint32_t	bad_mh;
1604 	uint32_t	rssi_sum;
1605 	uint32_t	reserved;
1606 } __packed;
1607 
1608 struct iwn_rx_general_stats {
1609 	uint32_t	bad_cts;
1610 	uint32_t	bad_ack;
1611 	uint32_t	not_bss;
1612 	uint32_t	filtered;
1613 	uint32_t	bad_chan;
1614 	uint32_t	beacons;
1615 	uint32_t	missed_beacons;
1616 	uint32_t	adc_saturated;	/* time in 0.8us */
1617 	uint32_t	ina_searched;	/* time in 0.8us */
1618 	uint32_t	noise[3];
1619 	uint32_t	flags;
1620 	uint32_t	load;
1621 	uint32_t	fa;
1622 	uint32_t	rssi[3];
1623 	uint32_t	energy[3];
1624 } __packed;
1625 
1626 struct iwn_rx_ht_phy_stats {
1627 	uint32_t	bad_plcp;
1628 	uint32_t	overrun;
1629 	uint32_t	eoverrun;
1630 	uint32_t	good_crc32;
1631 	uint32_t	bad_crc32;
1632 	uint32_t	bad_mh;
1633 	uint32_t	good_ampdu_crc32;
1634 	uint32_t	ampdu;
1635 	uint32_t	fragment;
1636 	uint32_t	unsupport_mcs;
1637 } __packed;
1638 
1639 struct iwn_rx_stats {
1640 	struct iwn_rx_phy_stats		ofdm;
1641 	struct iwn_rx_phy_stats		cck;
1642 	struct iwn_rx_general_stats	general;
1643 	struct iwn_rx_ht_phy_stats	ht;
1644 } __packed;
1645 
1646 struct iwn_rx_general_stats_bt {
1647 	struct iwn_rx_general_stats common;
1648 	/* additional stats for bt */
1649 	uint32_t num_bt_kills;
1650 	uint32_t reserved[2];
1651 } __packed;
1652 
1653 struct iwn_rx_stats_bt {
1654 	struct iwn_rx_phy_stats		ofdm;
1655 	struct iwn_rx_phy_stats		cck;
1656 	struct iwn_rx_general_stats_bt	general_bt;
1657 	struct iwn_rx_ht_phy_stats	ht;
1658 } __packed;
1659 
1660 struct iwn_tx_stats {
1661 	uint32_t	preamble;
1662 	uint32_t	rx_detected;
1663 	uint32_t	bt_defer;
1664 	uint32_t	bt_kill;
1665 	uint32_t	short_len;
1666 	uint32_t	cts_timeout;
1667 	uint32_t	ack_timeout;
1668 	uint32_t	exp_ack;
1669 	uint32_t	ack;
1670 	uint32_t	msdu;
1671 	uint32_t	burst_err1;
1672 	uint32_t	burst_err2;
1673 	uint32_t	cts_collision;
1674 	uint32_t	ack_collision;
1675 	uint32_t	ba_timeout;
1676 	uint32_t	ba_resched;
1677 	uint32_t	query_ampdu;
1678 	uint32_t	query;
1679 	uint32_t	query_ampdu_frag;
1680 	uint32_t	query_mismatch;
1681 	uint32_t	not_ready;
1682 	uint32_t	underrun;
1683 	uint32_t	bt_ht_kill;
1684 	uint32_t	rx_ba_resp;
1685 	/*
1686 	 * 6000 series only - LSB=ant A, ant B, ant C, MSB=reserved
1687 	 * TX power on chain in 1/2 dBm.
1688 	 */
1689 	uint32_t	tx_power;
1690 	uint32_t	reserved[1];
1691 } __packed;
1692 
1693 struct iwn_general_stats {
1694 	uint32_t	temp;		/* radio temperature */
1695 	uint32_t	temp_m;		/* radio voltage */
1696 	uint32_t	burst_check;
1697 	uint32_t	burst;
1698 	uint32_t	wait_for_silence_timeout_cnt;
1699 	uint32_t	reserved1[3];
1700 	uint32_t	sleep;
1701 	uint32_t	slot_out;
1702 	uint32_t	slot_idle;
1703 	uint32_t	ttl_tstamp;
1704 	uint32_t	tx_ant_a;
1705 	uint32_t	tx_ant_b;
1706 	uint32_t	exec;
1707 	uint32_t	probe;
1708 	uint32_t	reserved2[2];
1709 	uint32_t	rx_enabled;
1710 	/*
1711 	 * This is the number of times we have to re-tune
1712 	 * in order to get out of bad PHY status.
1713 	 */
1714 	uint32_t	num_of_sos_states;
1715 } __packed;
1716 
1717 struct iwn_stats {
1718 	uint32_t			flags;
1719 	struct iwn_rx_stats		rx;
1720 	struct iwn_tx_stats		tx;
1721 	struct iwn_general_stats	general;
1722 	uint32_t			reserved1[2];
1723 } __packed;
1724 
1725 struct iwn_bt_activity_stats {
1726 	/* Tx statistics */
1727 	uint32_t hi_priority_tx_req_cnt;
1728 	uint32_t hi_priority_tx_denied_cnt;
1729 	uint32_t lo_priority_tx_req_cnt;
1730 	uint32_t lo_priority_tx_denied_cnt;
1731 	/* Rx statistics */
1732 	uint32_t hi_priority_rx_req_cnt;
1733 	uint32_t hi_priority_rx_denied_cnt;
1734 	uint32_t lo_priority_rx_req_cnt;
1735 	uint32_t lo_priority_rx_denied_cnt;
1736 } __packed;
1737 
1738 struct iwn_stats_bt {
1739 	uint32_t			flags;
1740 	struct iwn_rx_stats_bt		rx_bt;
1741 	struct iwn_tx_stats		tx;
1742 	struct iwn_general_stats	general;
1743 	struct iwn_bt_activity_stats	activity;
1744 	uint32_t			reserved1[2];
1745 };
1746 
1747 /* Firmware error dump. */
1748 struct iwn_fw_dump {
1749 	uint32_t	valid;
1750 	uint32_t	id;
1751 	uint32_t	pc;
1752 	uint32_t	branch_link[2];
1753 	uint32_t	interrupt_link[2];
1754 	uint32_t	error_data[2];
1755 	uint32_t	src_line;
1756 	uint32_t	tsf;
1757 	uint32_t	time[2];
1758 } __packed;
1759 
1760 /* TLV firmware header. */
1761 struct iwn_fw_tlv_hdr {
1762 	uint32_t	zero;	/* Always 0, to differentiate from legacy. */
1763 	uint32_t	signature;
1764 #define IWN_FW_SIGNATURE	0x0a4c5749	/* "IWL\n" */
1765 
1766 	uint8_t		descr[64];
1767 	uint32_t	rev;
1768 #define IWN_FW_API(x)	(((x) >> 8) & 0xff)
1769 
1770 	uint32_t	build;
1771 	uint64_t	altmask;
1772 } __packed;
1773 
1774 /* TLV header. */
1775 struct iwn_fw_tlv {
1776 	uint16_t	type;
1777 #define IWN_FW_TLV_MAIN_TEXT		1
1778 #define IWN_FW_TLV_MAIN_DATA		2
1779 #define IWN_FW_TLV_INIT_TEXT		3
1780 #define IWN_FW_TLV_INIT_DATA		4
1781 #define IWN_FW_TLV_BOOT_TEXT		5
1782 #define IWN_FW_TLV_PBREQ_MAXLEN		6
1783 #define	IWN_FW_TLV_PAN			7
1784 #define	IWN_FW_TLV_RUNT_EVTLOG_PTR	8
1785 #define	IWN_FW_TLV_RUNT_EVTLOG_SIZE	9
1786 #define	IWN_FW_TLV_RUNT_ERRLOG_PTR	10
1787 #define	IWN_FW_TLV_INIT_EVTLOG_PTR	11
1788 #define	IWN_FW_TLV_INIT_EVTLOG_SIZE	12
1789 #define	IWN_FW_TLV_INIT_ERRLOG_PTR	13
1790 #define IWN_FW_TLV_ENH_SENS		14
1791 #define IWN_FW_TLV_PHY_CALIB		15
1792 #define	IWN_FW_TLV_WOWLAN_INST		16
1793 #define	IWN_FW_TLV_WOWLAN_DATA		17
1794 #define	IWN_FW_TLV_FLAGS		18
1795 
1796 	uint16_t	alt;
1797 	uint32_t	len;
1798 } __packed;
1799 
1800 #define IWN4965_FW_TEXT_MAXSZ	( 96 * 1024)
1801 #define IWN4965_FW_DATA_MAXSZ	( 40 * 1024)
1802 #define IWN5000_FW_TEXT_MAXSZ	(256 * 1024)
1803 #define IWN5000_FW_DATA_MAXSZ	( 80 * 1024)
1804 #define IWN_FW_BOOT_TEXT_MAXSZ	1024
1805 #define IWN4965_FWSZ		(IWN4965_FW_TEXT_MAXSZ + IWN4965_FW_DATA_MAXSZ)
1806 #define IWN5000_FWSZ		IWN5000_FW_TEXT_MAXSZ
1807 
1808 /*
1809  * Microcode flags TLV (18.)
1810  */
1811 
1812 /**
1813  * enum iwn_ucode_tlv_flag - ucode API flags
1814  * @IWN_UCODE_TLV_FLAGS_PAN: This is PAN capable microcode; this previously
1815  *      was a separate TLV but moved here to save space.
1816  * @IWN_UCODE_TLV_FLAGS_NEWSCAN: new uCode scan behaviour on hidden SSID,
1817  *      treats good CRC threshold as a boolean
1818  * @IWN_UCODE_TLV_FLAGS_MFP: This uCode image supports MFP (802.11w).
1819  * @IWN_UCODE_TLV_FLAGS_P2P: This uCode image supports P2P.
1820  * @IWN_UCODE_TLV_FLAGS_DW_BC_TABLE: The SCD byte count table is in DWORDS
1821  * @IWN_UCODE_TLV_FLAGS_UAPSD: This uCode image supports uAPSD
1822  * @IWN_UCODE_TLV_FLAGS_SHORT_BL: 16 entries of black list instead of 64 in scan
1823  *      offload profile config command.
1824  * @IWN_UCODE_TLV_FLAGS_RX_ENERGY_API: supports rx signal strength api
1825  * @IWN_UCODE_TLV_FLAGS_TIME_EVENT_API_V2: using the new time event API.
1826  * @IWN_UCODE_TLV_FLAGS_D3_6_IPV6_ADDRS: D3 image supports up to six
1827  *      (rather than two) IPv6 addresses
1828  * @IWN_UCODE_TLV_FLAGS_BF_UPDATED: new beacon filtering API
1829  * @IWN_UCODE_TLV_FLAGS_NO_BASIC_SSID: not sending a probe with the SSID element
1830  *      from the probe request template.
1831  * @IWN_UCODE_TLV_FLAGS_D3_CONTINUITY_API: modified D3 API to allow keeping
1832  *      connection when going back to D0
1833  * @IWN_UCODE_TLV_FLAGS_NEW_NSOFFL_SMALL: new NS offload (small version)
1834  * @IWN_UCODE_TLV_FLAGS_NEW_NSOFFL_LARGE: new NS offload (large version)
1835  * @IWN_UCODE_TLV_FLAGS_SCHED_SCAN: this uCode image supports scheduled scan.
1836  * @IWN_UCODE_TLV_FLAGS_STA_KEY_CMD: new ADD_STA and ADD_STA_KEY command API
1837  * @IWN_UCODE_TLV_FLAGS_DEVICE_PS_CMD: support device wide power command
1838  *      containing CAM (Continuous Active Mode) indication.
1839  */
1840 enum iwn_ucode_tlv_flag {
1841 	IWN_UCODE_TLV_FLAGS_PAN			= (1 << 0),
1842 	IWN_UCODE_TLV_FLAGS_NEWSCAN		= (1 << 1),
1843 	IWN_UCODE_TLV_FLAGS_MFP			= (1 << 2),
1844 	IWN_UCODE_TLV_FLAGS_P2P			= (1 << 3),
1845 	IWN_UCODE_TLV_FLAGS_DW_BC_TABLE		= (1 << 4),
1846 	IWN_UCODE_TLV_FLAGS_NEWBT_COEX		= (1 << 5),
1847 	IWN_UCODE_TLV_FLAGS_UAPSD		= (1 << 6),
1848 	IWN_UCODE_TLV_FLAGS_SHORT_BL		= (1 << 7),
1849 	IWN_UCODE_TLV_FLAGS_RX_ENERGY_API	= (1 << 8),
1850 	IWN_UCODE_TLV_FLAGS_TIME_EVENT_API_V2	= (1 << 9),
1851 	IWN_UCODE_TLV_FLAGS_D3_6_IPV6_ADDRS	= (1 << 10),
1852 	IWN_UCODE_TLV_FLAGS_BF_UPDATED		= (1 << 11),
1853 	IWN_UCODE_TLV_FLAGS_NO_BASIC_SSID	= (1 << 12),
1854 	IWN_UCODE_TLV_FLAGS_D3_CONTINUITY_API	= (1 << 14),
1855 	IWN_UCODE_TLV_FLAGS_NEW_NSOFFL_SMALL	= (1 << 15),
1856 	IWN_UCODE_TLV_FLAGS_NEW_NSOFFL_LARGE	= (1 << 16),
1857 	IWN_UCODE_TLV_FLAGS_SCHED_SCAN		= (1 << 17),
1858 	IWN_UCODE_TLV_FLAGS_STA_KEY_CMD		= (1 << 19),
1859 	IWN_UCODE_TLV_FLAGS_DEVICE_PS_CMD	= (1 << 20),
1860 };
1861 
1862 /*
1863  * Offsets into EEPROM.
1864  */
1865 #define IWN_EEPROM_MAC		0x015
1866 #define IWN_EEPROM_SKU_CAP	0x045
1867 #define IWN_EEPROM_RFCFG	0x048
1868 #define IWN4965_EEPROM_DOMAIN	0x060
1869 #define IWN4965_EEPROM_BAND1	0x063
1870 #define IWN5000_EEPROM_REG	0x066
1871 #define IWN5000_EEPROM_CAL	0x067
1872 #define IWN4965_EEPROM_BAND2	0x072
1873 #define IWN4965_EEPROM_BAND3	0x080
1874 #define IWN4965_EEPROM_BAND4	0x08d
1875 #define IWN4965_EEPROM_BAND5	0x099
1876 #define IWN4965_EEPROM_BAND6	0x0a0
1877 #define IWN4965_EEPROM_BAND7	0x0a8
1878 #define IWN4965_EEPROM_MAXPOW	0x0e8
1879 #define IWN4965_EEPROM_VOLTAGE	0x0e9
1880 #define IWN4965_EEPROM_BANDS	0x0ea
1881 /* Indirect offsets. */
1882 #define	IWN5000_EEPROM_NO_HT40	0x000
1883 #define IWN5000_EEPROM_DOMAIN	0x001
1884 #define IWN5000_EEPROM_BAND1	0x004
1885 #define IWN5000_EEPROM_BAND2	0x013
1886 #define IWN5000_EEPROM_BAND3	0x021
1887 #define IWN5000_EEPROM_BAND4	0x02e
1888 #define IWN5000_EEPROM_BAND5	0x03a
1889 #define IWN5000_EEPROM_BAND6	0x041
1890 #define IWN6000_EEPROM_BAND6	0x040
1891 #define IWN5000_EEPROM_BAND7	0x049
1892 #define IWN6000_EEPROM_ENHINFO	0x054
1893 #define IWN5000_EEPROM_CRYSTAL	0x128
1894 #define IWN5000_EEPROM_TEMP	0x12a
1895 #define IWN5000_EEPROM_VOLT	0x12b
1896 
1897 /* Possible flags for IWN_EEPROM_SKU_CAP. */
1898 #define IWN_EEPROM_SKU_CAP_11N	(1 << 6)
1899 #define IWN_EEPROM_SKU_CAP_AMT	(1 << 7)
1900 #define IWN_EEPROM_SKU_CAP_IPAN	(1 << 8)
1901 
1902 /* Possible flags for IWN_EEPROM_RFCFG. */
1903 #define IWN_RFCFG_TYPE(x)	(((x) >>  0) & 0x3)
1904 #define IWN_RFCFG_STEP(x)	(((x) >>  2) & 0x3)
1905 #define IWN_RFCFG_DASH(x)	(((x) >>  4) & 0x3)
1906 #define IWN_RFCFG_TXANTMSK(x)	(((x) >>  8) & 0xf)
1907 #define IWN_RFCFG_RXANTMSK(x)	(((x) >> 12) & 0xf)
1908 
1909 struct iwn_eeprom_chan {
1910 	uint8_t	flags;
1911 #define IWN_EEPROM_CHAN_VALID	(1 << 0)
1912 #define IWN_EEPROM_CHAN_IBSS	(1 << 1)
1913 #define IWN_EEPROM_CHAN_ACTIVE	(1 << 3)
1914 #define IWN_EEPROM_CHAN_RADAR	(1 << 4)
1915 
1916 	int8_t	maxpwr;
1917 } __packed;
1918 
1919 struct iwn_eeprom_enhinfo {
1920 	uint8_t		flags;
1921 #define IWN_ENHINFO_VALID	0x01
1922 #define IWN_ENHINFO_5GHZ	0x02
1923 #define IWN_ENHINFO_OFDM	0x04
1924 #define IWN_ENHINFO_HT40	0x08
1925 #define IWN_ENHINFO_HTAP	0x10
1926 #define IWN_ENHINFO_RES1	0x20
1927 #define IWN_ENHINFO_RES2	0x40
1928 #define IWN_ENHINFO_COMMON	0x80
1929 
1930 	uint8_t		chan;
1931 	int8_t		chain[3];	/* max power in half-dBm */
1932 	uint8_t		reserved;
1933 	int8_t		mimo2;		/* max power in half-dBm */
1934 	int8_t		mimo3;		/* max power in half-dBm */
1935 } __packed;
1936 
1937 struct iwn5000_eeprom_calib_hdr {
1938 	uint8_t		version;
1939 	uint8_t		pa_type;
1940 	uint16_t	volt;
1941 } __packed;
1942 
1943 #define IWN_NSAMPLES	3
1944 struct iwn4965_eeprom_chan_samples {
1945 	uint8_t	num;
1946 	struct {
1947 		uint8_t temp;
1948 		uint8_t	gain;
1949 		uint8_t	power;
1950 		int8_t	pa_det;
1951 	}	samples[2][IWN_NSAMPLES];
1952 } __packed;
1953 
1954 #define IWN_NBANDS	8
1955 struct iwn4965_eeprom_band {
1956 	uint8_t	lo;	/* low channel number */
1957 	uint8_t	hi;	/* high channel number */
1958 	struct	iwn4965_eeprom_chan_samples chans[2];
1959 } __packed;
1960 
1961 /*
1962  * Offsets of channels descriptions in EEPROM.
1963  */
1964 static const uint32_t iwn4965_regulatory_bands[IWN_NBANDS] = {
1965 	IWN4965_EEPROM_BAND1,
1966 	IWN4965_EEPROM_BAND2,
1967 	IWN4965_EEPROM_BAND3,
1968 	IWN4965_EEPROM_BAND4,
1969 	IWN4965_EEPROM_BAND5,
1970 	IWN4965_EEPROM_BAND6,
1971 	IWN4965_EEPROM_BAND7
1972 };
1973 
1974 static const uint32_t iwn5000_regulatory_bands[IWN_NBANDS] = {
1975 	IWN5000_EEPROM_BAND1,
1976 	IWN5000_EEPROM_BAND2,
1977 	IWN5000_EEPROM_BAND3,
1978 	IWN5000_EEPROM_BAND4,
1979 	IWN5000_EEPROM_BAND5,
1980 	IWN5000_EEPROM_BAND6,
1981 	IWN5000_EEPROM_BAND7
1982 };
1983 
1984 static const uint32_t iwn6000_regulatory_bands[IWN_NBANDS] = {
1985 	IWN5000_EEPROM_BAND1,
1986 	IWN5000_EEPROM_BAND2,
1987 	IWN5000_EEPROM_BAND3,
1988 	IWN5000_EEPROM_BAND4,
1989 	IWN5000_EEPROM_BAND5,
1990 	IWN6000_EEPROM_BAND6,
1991 	IWN5000_EEPROM_BAND7
1992 };
1993 
1994 static const uint32_t iwn1000_regulatory_bands[IWN_NBANDS] = {
1995 	IWN5000_EEPROM_BAND1,
1996 	IWN5000_EEPROM_BAND2,
1997 	IWN5000_EEPROM_BAND3,
1998 	IWN5000_EEPROM_BAND4,
1999 	IWN5000_EEPROM_BAND5,
2000 	IWN5000_EEPROM_BAND6,
2001 	IWN5000_EEPROM_NO_HT40,
2002 };
2003 
2004 static const uint32_t iwn2030_regulatory_bands[IWN_NBANDS] = {
2005 	IWN5000_EEPROM_BAND1,
2006 	IWN5000_EEPROM_BAND2,
2007 	IWN5000_EEPROM_BAND3,
2008 	IWN5000_EEPROM_BAND4,
2009 	IWN5000_EEPROM_BAND5,
2010 	IWN6000_EEPROM_BAND6,
2011 	IWN5000_EEPROM_BAND7
2012 };
2013 
2014 #define IWN_CHAN_BANDS_COUNT	 7
2015 #define IWN_MAX_CHAN_PER_BAND	14
2016 static const struct iwn_chan_band {
2017 	uint8_t	nchan;
2018 	uint8_t	chan[IWN_MAX_CHAN_PER_BAND];
2019 } iwn_bands[] = {
2020 	/* 20MHz channels, 2GHz band. */
2021 	{ 14, { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 } },
2022 	/* 20MHz channels, 5GHz band. */
2023 	{ 13, { 183, 184, 185, 187, 188, 189, 192, 196, 7, 8, 11, 12, 16 } },
2024 	{ 12, { 34, 36, 38, 40, 42, 44, 46, 48, 52, 56, 60, 64 } },
2025 	{ 11, { 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140 } },
2026 	{  6, { 145, 149, 153, 157, 161, 165 } },
2027 	/* 40MHz channels (primary channels), 2GHz band. */
2028 	{  7, { 1, 2, 3, 4, 5, 6, 7 } },
2029 	/* 40MHz channels (primary channels), 5GHz band. */
2030 	{ 11, { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157 } }
2031 };
2032 
2033 static const uint8_t iwn_bss_ac_to_queue[] = {
2034 	2, 3, 1, 0,
2035 };
2036 
2037 static const uint8_t iwn_pan_ac_to_queue[] = {
2038 	5, 4, 6, 7,
2039 };
2040 #define IWN1000_OTP_NBLOCKS	3
2041 #define IWN6000_OTP_NBLOCKS	4
2042 #define IWN6050_OTP_NBLOCKS	7
2043 
2044 /* HW rate indices. */
2045 #define IWN_RIDX_CCK1	0
2046 #define IWN_RIDX_OFDM6	4
2047 
2048 #define IWN4965_MAX_PWR_INDEX	107
2049 #define	IWN_POWERSAVE_LVL_NONE			0
2050 #define	IWN_POWERSAVE_LVL_VOIP_COMPATIBLE	1
2051 #define	IWN_POWERSAVE_LVL_MAX			5
2052 
2053 #define	IWN_POWERSAVE_LVL_DEFAULT	IWN_POWERSAVE_LVL_NONE
2054 
2055 /* DTIM value to pass in for IWN_POWERSAVE_LVL_VOIP_COMPATIBLE */
2056 #define	IWN_POWERSAVE_DTIM_VOIP_COMPATIBLE	2
2057 
2058 /*
2059  * RF Tx gain values from highest to lowest power (values obtained from
2060  * the reference driver.)
2061  */
2062 static const uint8_t iwn4965_rf_gain_2ghz[IWN4965_MAX_PWR_INDEX + 1] = {
2063 	0x3f, 0x3f, 0x3f, 0x3e, 0x3e, 0x3e, 0x3d, 0x3d, 0x3d, 0x3c, 0x3c,
2064 	0x3c, 0x3b, 0x3b, 0x3b, 0x3a, 0x3a, 0x3a, 0x39, 0x39, 0x39, 0x38,
2065 	0x38, 0x38, 0x37, 0x37, 0x37, 0x36, 0x36, 0x36, 0x35, 0x35, 0x35,
2066 	0x34, 0x34, 0x34, 0x33, 0x33, 0x33, 0x32, 0x32, 0x32, 0x31, 0x31,
2067 	0x31, 0x30, 0x30, 0x30, 0x06, 0x06, 0x06, 0x05, 0x05, 0x05, 0x04,
2068 	0x04, 0x04, 0x03, 0x03, 0x03, 0x02, 0x02, 0x02, 0x01, 0x01, 0x01,
2069 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2070 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2071 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2072 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
2073 };
2074 
2075 static const uint8_t iwn4965_rf_gain_5ghz[IWN4965_MAX_PWR_INDEX + 1] = {
2076 	0x3f, 0x3f, 0x3f, 0x3f, 0x3f, 0x3e, 0x3e, 0x3e, 0x3d, 0x3d, 0x3d,
2077 	0x3c, 0x3c, 0x3c, 0x3b, 0x3b, 0x3b, 0x3a, 0x3a, 0x3a, 0x39, 0x39,
2078 	0x39, 0x38, 0x38, 0x38, 0x37, 0x37, 0x37, 0x36, 0x36, 0x36, 0x35,
2079 	0x35, 0x35, 0x34, 0x34, 0x34, 0x33, 0x33, 0x33, 0x32, 0x32, 0x32,
2080 	0x31, 0x31, 0x31, 0x30, 0x30, 0x30, 0x25, 0x25, 0x25, 0x24, 0x24,
2081 	0x24, 0x23, 0x23, 0x23, 0x22, 0x18, 0x18, 0x17, 0x17, 0x17, 0x16,
2082 	0x16, 0x16, 0x15, 0x15, 0x15, 0x14, 0x14, 0x14, 0x13, 0x13, 0x13,
2083 	0x12, 0x08, 0x08, 0x07, 0x07, 0x07, 0x06, 0x06, 0x06, 0x05, 0x05,
2084 	0x05, 0x04, 0x04, 0x04, 0x03, 0x03, 0x03, 0x02, 0x02, 0x02, 0x01,
2085 	0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
2086 };
2087 
2088 /*
2089  * DSP pre-DAC gain values from highest to lowest power (values obtained
2090  * from the reference driver.)
2091  */
2092 static const uint8_t iwn4965_dsp_gain_2ghz[IWN4965_MAX_PWR_INDEX + 1] = {
2093 	0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68,
2094 	0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e,
2095 	0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62,
2096 	0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68,
2097 	0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e,
2098 	0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62,
2099 	0x6e, 0x68, 0x62, 0x61, 0x60, 0x5f, 0x5e, 0x5d, 0x5c, 0x5b, 0x5a,
2100 	0x59, 0x58, 0x57, 0x56, 0x55, 0x54, 0x53, 0x52, 0x51, 0x50, 0x4f,
2101 	0x4e, 0x4d, 0x4c, 0x4b, 0x4a, 0x49, 0x48, 0x47, 0x46, 0x45, 0x44,
2102 	0x43, 0x42, 0x41, 0x40, 0x3f, 0x3e, 0x3d, 0x3c, 0x3b
2103 };
2104 
2105 static const uint8_t iwn4965_dsp_gain_5ghz[IWN4965_MAX_PWR_INDEX + 1] = {
2106 	0x7b, 0x75, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62,
2107 	0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68,
2108 	0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e,
2109 	0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62,
2110 	0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68,
2111 	0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e,
2112 	0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62,
2113 	0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68,
2114 	0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e,
2115 	0x68, 0x62, 0x6e, 0x68, 0x62, 0x5d, 0x58, 0x53, 0x4e
2116 };
2117 
2118 /*
2119  * Power saving settings (values obtained from the reference driver.)
2120  */
2121 #define IWN_NDTIMRANGES		3
2122 #define IWN_NPOWERLEVELS	6
2123 static const struct iwn_pmgt {
2124 	uint32_t	rxtimeout;
2125 	uint32_t	txtimeout;
2126 	uint32_t	intval[5];
2127 	int		skip_dtim;
2128 } iwn_pmgt[IWN_NDTIMRANGES][IWN_NPOWERLEVELS] = {
2129 	/* DTIM <= 2 */
2130 	{
2131 	{   0,   0, {  0,  0,  0,  0,  0 }, 0 },	/* CAM */
2132 	{ 200, 500, {  1,  2,  2,  2, -1 }, 0 },	/* PS level 1 */
2133 	{ 200, 300, {  1,  2,  2,  2, -1 }, 0 },	/* PS level 2 */
2134 	{  50, 100, {  2,  2,  2,  2, -1 }, 0 },	/* PS level 3 */
2135 	{  50,  25, {  2,  2,  4,  4, -1 }, 1 },	/* PS level 4 */
2136 	{  25,  25, {  2,  2,  4,  6, -1 }, 2 }		/* PS level 5 */
2137 	},
2138 	/* 3 <= DTIM <= 10 */
2139 	{
2140 	{   0,   0, {  0,  0,  0,  0,  0 }, 0 },	/* CAM */
2141 	{ 200, 500, {  1,  2,  3,  4,  4 }, 0 },	/* PS level 1 */
2142 	{ 200, 300, {  1,  2,  3,  4,  7 }, 0 },	/* PS level 2 */
2143 	{  50, 100, {  2,  4,  6,  7,  9 }, 0 },	/* PS level 3 */
2144 	{  50,  25, {  2,  4,  6,  9, 10 }, 1 },	/* PS level 4 */
2145 	{  25,  25, {  2,  4,  7, 10, 10 }, 2 }		/* PS level 5 */
2146 	},
2147 	/* DTIM >= 11 */
2148 	{
2149 	{   0,   0, {  0,  0,  0,  0,  0 }, 0 },	/* CAM */
2150 	{ 200, 500, {  1,  2,  3,  4, -1 }, 0 },	/* PS level 1 */
2151 	{ 200, 300, {  2,  4,  6,  7, -1 }, 0 },	/* PS level 2 */
2152 	{  50, 100, {  2,  7,  9,  9, -1 }, 0 },	/* PS level 3 */
2153 	{  50,  25, {  2,  7,  9,  9, -1 }, 0 },	/* PS level 4 */
2154 	{  25,  25, {  4,  7, 10, 10, -1 }, 0 }		/* PS level 5 */
2155 	}
2156 };
2157 
2158 struct iwn_sensitivity_limits {
2159 	uint32_t	min_ofdm_x1;
2160 	uint32_t	max_ofdm_x1;
2161 	uint32_t	min_ofdm_mrc_x1;
2162 	uint32_t	max_ofdm_mrc_x1;
2163 	uint32_t	min_ofdm_x4;
2164 	uint32_t	max_ofdm_x4;
2165 	uint32_t	min_ofdm_mrc_x4;
2166 	uint32_t	max_ofdm_mrc_x4;
2167 	uint32_t	min_cck_x4;
2168 	uint32_t	max_cck_x4;
2169 	uint32_t	min_cck_mrc_x4;
2170 	uint32_t	max_cck_mrc_x4;
2171 	uint32_t	min_energy_cck;
2172 	uint32_t	energy_cck;
2173 	uint32_t	energy_ofdm;
2174 	uint32_t	barker_mrc;
2175 };
2176 
2177 /*
2178  * RX sensitivity limits (values obtained from the reference driver.)
2179  */
2180 static const struct iwn_sensitivity_limits iwn4965_sensitivity_limits = {
2181 	105, 140,
2182 	220, 270,
2183 	 85, 120,
2184 	170, 210,
2185 	125, 200,
2186 	200, 400,
2187 	 97,
2188 	100,
2189 	100,
2190 	390
2191 };
2192 
2193 static const struct iwn_sensitivity_limits iwn5000_sensitivity_limits = {
2194 	120, 120,	/* min = max for performance bug in DSP. */
2195 	240, 240,	/* min = max for performance bug in DSP. */
2196 	 90, 120,
2197 	170, 210,
2198 	125, 200,
2199 	170, 400,
2200 	 95,
2201 	 95,
2202 	 95,
2203 	 390
2204 };
2205 
2206 static const struct iwn_sensitivity_limits iwn5150_sensitivity_limits = {
2207 	105, 105,	/* min = max for performance bug in DSP. */
2208 	220, 220,	/* min = max for performance bug in DSP. */
2209 	 90, 120,
2210 	170, 210,
2211 	125, 200,
2212 	170, 400,
2213 	 95,
2214 	 95,
2215 	 95,
2216 	 390,
2217 };
2218 
2219 static const struct iwn_sensitivity_limits iwn1000_sensitivity_limits = {
2220 	120, 155,
2221 	240, 290,
2222 	 90, 120,
2223 	170, 210,
2224 	125, 200,
2225 	170, 400,
2226 	 95,
2227 	 95,
2228 	 95,
2229 	 390,
2230 };
2231 
2232 static const struct iwn_sensitivity_limits iwn6000_sensitivity_limits = {
2233 	105, 110,
2234 	192, 232,
2235 	 80, 145,
2236 	128, 232,
2237 	125, 175,
2238 	160, 310,
2239 	 97,
2240 	 97,
2241 	100,
2242 	390
2243 };
2244 
2245 static const struct iwn_sensitivity_limits iwn6235_sensitivity_limits = {
2246 	105, 110,
2247 	192, 232,
2248 	 80, 145,
2249 	128, 232,
2250 	125, 175,
2251 	160, 310,
2252 	100,
2253 	110,
2254 	110,
2255 	336
2256 };
2257 
2258 
2259 /* Get value from linux kernel 3.2.+ in Drivers/net/wireless/iwlwifi/iwl-2000.c*/
2260 static const struct iwn_sensitivity_limits iwn2030_sensitivity_limits = {
2261 	105,110,
2262 	128,232,
2263 	80,145,
2264 	128,232,
2265 	125,175,
2266 	160,310,
2267 	97,
2268 	97,
2269 	110,
2270 	390
2271 };
2272 
2273 /* Map TID to TX scheduler's FIFO. */
2274 static const uint8_t iwn_tid2fifo[] = {
2275 	1, 0, 0, 1, 2, 2, 3, 3, 7, 7, 7, 7, 7, 7, 7, 7, 3
2276 };
2277 
2278 /* WiFi/WiMAX coexist event priority table for 6050. */
2279 static const struct iwn5000_wimax_event iwn6050_wimax_events[] = {
2280 	{ 0x04, 0x03, 0x00, 0x00 },
2281 	{ 0x04, 0x03, 0x00, 0x03 },
2282 	{ 0x04, 0x03, 0x00, 0x03 },
2283 	{ 0x04, 0x03, 0x00, 0x03 },
2284 	{ 0x04, 0x03, 0x00, 0x00 },
2285 	{ 0x04, 0x03, 0x00, 0x07 },
2286 	{ 0x04, 0x03, 0x00, 0x00 },
2287 	{ 0x04, 0x03, 0x00, 0x03 },
2288 	{ 0x04, 0x03, 0x00, 0x03 },
2289 	{ 0x04, 0x03, 0x00, 0x00 },
2290 	{ 0x06, 0x03, 0x00, 0x07 },
2291 	{ 0x04, 0x03, 0x00, 0x00 },
2292 	{ 0x06, 0x06, 0x00, 0x03 },
2293 	{ 0x04, 0x03, 0x00, 0x07 },
2294 	{ 0x04, 0x03, 0x00, 0x00 },
2295 	{ 0x04, 0x03, 0x00, 0x00 }
2296 };
2297 
2298 /* Firmware errors. */
2299 static const char * const iwn_fw_errmsg[] = {
2300 	"OK",
2301 	"FAIL",
2302 	"BAD_PARAM",
2303 	"BAD_CHECKSUM",
2304 	"NMI_INTERRUPT_WDG",
2305 	"SYSASSERT",
2306 	"FATAL_ERROR",
2307 	"BAD_COMMAND",
2308 	"HW_ERROR_TUNE_LOCK",
2309 	"HW_ERROR_TEMPERATURE",
2310 	"ILLEGAL_CHAN_FREQ",
2311 	"VCC_NOT_STABLE",
2312 	"FH_ERROR",
2313 	"NMI_INTERRUPT_HOST",
2314 	"NMI_INTERRUPT_ACTION_PT",
2315 	"NMI_INTERRUPT_UNKNOWN",
2316 	"UCODE_VERSION_MISMATCH",
2317 	"HW_ERROR_ABS_LOCK",
2318 	"HW_ERROR_CAL_LOCK_FAIL",
2319 	"NMI_INTERRUPT_INST_ACTION_PT",
2320 	"NMI_INTERRUPT_DATA_ACTION_PT",
2321 	"NMI_TRM_HW_ER",
2322 	"NMI_INTERRUPT_TRM",
2323 	"NMI_INTERRUPT_BREAKPOINT",
2324 	"DEBUG_0",
2325 	"DEBUG_1",
2326 	"DEBUG_2",
2327 	"DEBUG_3",
2328 	"ADVANCED_SYSASSERT"
2329 };
2330 
2331 /* Find least significant bit that is set. */
2332 #define IWN_LSB(x)	((((x) - 1) & (x)) ^ (x))
2333 
2334 #define IWN_READ(sc, reg)						\
2335 	bus_space_read_4((sc)->sc_st, (sc)->sc_sh, (reg))
2336 
2337 #define IWN_WRITE(sc, reg, val)						\
2338 	bus_space_write_4((sc)->sc_st, (sc)->sc_sh, (reg), (val))
2339 
2340 #define IWN_WRITE_1(sc, reg, val)					\
2341 	bus_space_write_1((sc)->sc_st, (sc)->sc_sh, (reg), (val))
2342 
2343 #define IWN_SETBITS(sc, reg, mask)					\
2344 	IWN_WRITE(sc, reg, IWN_READ(sc, reg) | (mask))
2345 
2346 #define IWN_CLRBITS(sc, reg, mask)					\
2347 	IWN_WRITE(sc, reg, IWN_READ(sc, reg) & ~(mask))
2348 
2349 #define IWN_BARRIER_WRITE(sc)						\
2350 	bus_space_barrier((sc)->sc_st, (sc)->sc_sh, 0, (sc)->sc_sz,	\
2351 	    BUS_SPACE_BARRIER_WRITE)
2352 
2353 #define IWN_BARRIER_READ_WRITE(sc)					\
2354 	bus_space_barrier((sc)->sc_st, (sc)->sc_sh, 0, (sc)->sc_sz,	\
2355 	    BUS_SPACE_BARRIER_READ | BUS_SPACE_BARRIER_WRITE)
2356 
2357 #endif	/* __IF_IWNREG_H__ */
2358