IBM LAN Entry Programmer's Guide

card
Last Update: $Date: 1998/12/04 21:37:11 $

IBM made, for a while, a card called the IBM LAN Entry card. This card has made its way to the surpluss market and can be purchased cheaply (in the $25-$35 range) from surplus dealers. More information can be obtained from here. Drivers can be obtained from here. I recommend Kento for purchasing one of these cards. I've dealt with him any times and he's A-1. Also of interest is Anthony M Townsend's page. The cards have a part number of either 92G7787 or 13H5905 depending on where you look.

Since this is a cheap, wireless card, the desire has been strong to have drivers written for this card for FreeBSD, Windows NT, Linux and other operating systems. This document attempts to describe the register set and software interface to this card.

In this document, active low lines are represented with a trailing star (*). The Intel data sheets have them as an overbar, but I don't know how to do that in HTML. When quoting other documentes, I use elipsis (...) to indicate omitted material. Editorial or summary comments appear like this.

This is a work in progress. Please contribute what you can to it.

Card architecture


CPU --- PCMCIA BRDIGE --- PCMCIA BUS --- 
      CUSTOM ASIC CONTROLLER +-- Radio
                             |
                             +-- i593


BLOCK DIAGRAM
The ILE card consists of four basic parts. There is a custom ASIC on the board, which controls the radio, ethernet chip, and memory access. The second part is the memory of the card. It appears to be dual ported memory rated at about 450ns. The ethernet chip is an intel 82593, with no apparent OEM modifications. The radio is built from off the shelf FM radio hardware from Philips and operates in the 2.4GHz band.

Custom ASIC

Little is know about the custom asic. It has the part number 13H5911 stamped on it. From looking at the driver, and from comparing it to other drivers, it apparently controls many aspects of the chip. It interfaces to the onboard memory, arranges for DMA transfers to be done on the two channels that the i593 supports, as well as programming the radio. It even seems to control the LEDs on the card.

Intel 82593

The intel 82593 appears to be your basic, average ethernet controller. Information on this chip has become hard to come by. When people dig, they can find a datasheet. Rumors of a users' guide have not been confirmed, and much of the driver programming relies on magic values to inialize blocks of memory.

Memory

The cards that I have come with 32KB of memory. This memory is apparently 450ns. Strangely, the card reports that the write protect switch is on (at least via the CIS).

Radio

The radio is made up of many parts, including Phillips UMA1016AT and UM6060DK. The UMA1016AT is a FM frequency generator, and the UM6060DK is a FM demodulator.

Register Summary

OffsetNameDescription
0i593regMaps directly onto command port of Intel 82593
2dma_addr_0Offset in pccard for dma engine for dma channel 1 of the i593
4dma_addr_1Offset in pccard for dma engine for dma channel 2 of the i593
6unk_card_offset DMA offset, or offset plus bits used to initialize the readio
8radio_control Radio status
aradio_timer? Timer? for next freq jump?
cradio_param? radio parameters???
efreq_tbl? Frequency table register??
10radio_isr Radio interrupt status registger
12led?Card LED control register?
14card_isr Card interrupt status register

Detailed register description

NameDescription
i593reg The Intel 82593 has only one register. This is mapped into the register space at offset 0. Only the lower 8 bits are valid. Port 0 and Port 1 of the i593's BIU are mapped to this address. See the excerpts from the i593 datasheet below.

dma_addr_0 When DMA channel 0 of the i593 is to happen, the custom ASIC will transfer the data to/from this address. The DMA here isn't done over the PCMCIA bus, but rather is done with the ASIC to/from the 32k of on board memory for the card. The value is the offset from the beginning of this memory.

In the NDIS DOS driver, the macro UseDMA1Reg is used to load the offset of this register into %dx.

dma_addr_1 When DMA channel 1 of the i593 is to happen, the custom ASIC will transfer the data to/from this address. The DMA here isn't done over the PCMCIA bus, but rather is done with the ASIC to/from the 32k of on board memory for the card. The value is the offset from the beginning of this memory.

In the NDIS DOS driver, the macro UseDMA2Reg is used to load the offset of this register into %dx.

unk_card_offset Some unknown offset into the card. It is used twice in the ndis driver. Once as a card diagnostics test, and once to pass the offset of a block of memory, plus some other bits. It is 16-bits wide.

%dx is loaded with UseDMA3?Reg in the ndis driver.

radio_control When IntConfigDone IntMcSetupDone, this register is read, then anded with 0xfdff, then rewritten.

During IntTransferDone, and what appears to be address matching code:

  • radio_control &= 0xfbff;
  • card_isr = 0x20;
  • radio_control |= 0x400;

During IntStopSegHit or IntEndOfFrame:

  • tmp = radio_control;
  • radio_control |= 0x200;
  • Get status2 and look at rcvptr.
  • radio_control = tmp;

During the recieve interrupt, it appears that we

  • tmp = radio_control;
  • radio_control |= 0x200;
  • Get status1 and look to transmit something and ack the interrupt.
  • i593reg = 0x1;
  • radio_control = tmp;

Misc:

  • At some random point We seem to set 0x2000 in this register.
  • We seem to clear 0x20 at some point.
  • We do tmp = radio_control; radio_control = tmp | 0x40; radio_control = tmp | 0x20; (maybe to send packet???)
  • We clear 0x2000 just before sending a different packet, and we appera to clear it either just before or just after it is sent.

done through address 0x2000.

15141312 111098 7654 3210

%dx is loaded with UseRadioStatReg in the ndis driver.

radio_timer?

%dx is loaded with UseRadioTimerReg? in the ndis driver.

radio_param?

%dx is loaded with UseRadioParameterReg? in the ndis driver.

freq_tbl?

%dx is loaded with UseRadioFreqReg in the ndis driver.

radio_isr

%dx is loaded with UseRadioIntReg in the ndis driver.

led?

%dx is loaded with UseLedReg in the ndis driver.

card_isr

%dx is loaded with UseCardIntMaskReg in the ndis driver.

Excerpts from Intel datasheets

i593 Internal Architecture

The 82593 consists of a parallel subsystem, a serial subsystem, and a FIFO subsystem.

Parallel Subsystem

The parallel subsystem consists of a bus interface unit (BIU), through which commands can be wrtten and status registers can be read by the CPU, a DMA interface unit (DIU) through which configuration parameters and data can be written and read from memory and a 10-bit bus throttle timer.

The BIU is composed of two I/O ports, Port 0 through which time-critical tasks and configurations are executed and Port 1, which is used for auxiliary commands. The 8-bit Port 0 command and statis registers are interfaced to the CPU via the data lines D0-D7. Operation and initialization commands such as TRANSMIT, RCV-ENABLE and CONFIGURE are issued to the 82593 via the Port 0 Command Register. The resultant status of these commands, as well as the states (Idle, Active, Ready, etc) of the 82593's RCV and EXEC units are contained in the Port 0 Status Registers.

Port 1 command and status registers are also 8 bits wide. The Port1 Command Register is used for additional commands such as POWER-DOWN and STOP-REG-UPDATET. The port 1 status registers, Status Bank 1, contain the values of the Bus Throttle Timer, the RCV Stop Register and the Power Down and Hi-Impedance status It appears that the Power Down and Hi-Z stuff isn't used on the ILE cards. At least the DOS NDIS driver never touches those values.

The DUI is compiosed of two separate DMA channels, Channel 0 and Channel 1. ... The DMA channels are 8 bits wide (configurable to 16 bits). The two DMA channels are independent of each other. Both channels can request DMA services simultaneously for operations such as transmission and reception.

Dedicated logic in the DIU enables back-to-back transmition and reception when configured to Continuous Mode. This means that continuous transmissions and receptions can be hanled by the 82593 without real time intervention of the CPU. In this mode, the DRQ and EOP* pins can be used to discriminate between successful and unsuccessful operations.

The Bus Timer Throttle controls the maximum amount of time the 82593 can actively hold the bus (via the DMA controller) during a DMA cycle... The NDIS DOS driver doesn't set this value at all, rather it allows it to remain the default.

Serial Subsystem

The 82593's Serial Subsystem is highly flexible in implementing the CSMA/CD protocol. It can operate in a variety of IEEE 802.4 and other CSMA/CD LAN environments, including 10BASE5 (Ethernet), 10BASE2(Cheapernet), 10BASE-T (Twisted Pair), 10BASE-F (Fiber Optic) and 1BASE5 (StarLAN). ...

The programmable parameters include:

The CSMS/CD unitis capableofrunning at speedsfrom dc to 20Mb/s for the S82593, and dc to 16Mb/s for the 82593SX.

The 82593 detects a collision when an active signal is driven on its CDT*/CLSN input. This signal is usually driven from the serial itnerface device ... It detects a carrier on the link when an active signal is driven on its CRS*/RENA input. The 82593 can be configured to filter active for at least 1 to 7 TXC periods before it is recognized.

FIFO Subsystem

The FIFO subsystem is located between the parallel subsystem and the serial subsystem. It consists of a 96-byte XMT FIFO, a 96-byte RCV FIFO, and FIFO control logic. The XMT and RCV FIFOs are independent, and individually provide an interface between the parallel and serial subsystems which may be running from different clock sources.

When configured to its 82590 compatible mode, the 82593 FIFO length defaults to 32 bytes for both the RCV and XMT FIFO, and the FIFO threshold (the level where a DMA request is asserted or deasserted) is fixed at 16 bytes. In all other configurations, the FIFO length is 96 bytes, with the FIFO threshold programmable through configuration. The 82593 can also be configured to delay the start of transmission until the programmed XMT FIFO threshold has been reached.

Expansion of XMT FIFO to 96 bytes allows the 82593 to perform automatic transmissions from within the XMT FIFO when a collision occurs during transmission.

Programming model Register Overview

Port 0

Figure 2 shows the 82593 Port 0 Command Register. Figure 3 shows the Port 0 commands. Port 0 is accessed when CS0* os assered, along with the assertion of the RD* or WD* signal. However, if the SWT-TO-PORT-1 command is issued to the 82593, Port 1 will become the active port, even though CS0* is asserted. To return to Port 0, the SWT-TO-PORT-0 command is executed. Port switching should be used when the hardware does not support the second chip select line, CS1*. The LAN Entry card doesn't have CS1* connected, so one must do the port switching. The NDIS DOS driver uses the port switching commands when dealing with the few PORT 1 requests that it generates.

7654 3210Meaning
Int
Ack
PointerCHNL Opcode 
xx 00 NOP
xx 10 SWT-TO-PORT-1
xx x1 IA-CONFIG
xx x2 CONFIGURE
xx x3 MC-SETUP
xx x4 TRANSMIT
xx x5 TDR
xx x6 DUMP
xx x7 DIAGNOSE
xx x8 RCV-ENABLE
xx x9 TRANSMIT-NO-CRC
xx x10 RCV-DISABLE
xx x11 STOP-RCV
xx x12 RETRANSMIT
xx x13 ABORT
xx x14 RESET
xx 015 RLS-PTR
xx 115 FIX-PTR
xx 0x CHANNEL 0
xx 1x CHANNEL 1
x0 xx STATUS 0
x1 xx STATUS 1
x2 xx STATUS 2
x3 xx STATUS 3
0x xx NO ACKNOWLEDGE
1x xx ACKNOWLEDGE

The 82593 can be configured to have 4 or 6 bytes of status registers in Port 0 (see Figures 5, 6, and 7). For the 4-byte status configuration, the first the registers (STATUS 0 through 2) contain the inforamtion about the last command executed, or the last frame received. The last stauts register, STATUS 3, contains the state of the 82593 Execution and Receive units. When the 82593 is configured to 6 bytes of status registers, the two additional bytes of status are used to report a more complete stauts of the most recently receieved frame, and also transmit chaining status (Continuous mode only).

7654 3210Meaning
InterruptReceptionExecutionCHNL Event 
xxxx 1IA-SETUP-DONE
xxxx 2CONFIGURE-DONE
xxxx 3MC-SETUP-DONE
xxxx 4TRANSMIT-DONE
xxxx 5TDR-DONE
xxxx 6DUMP-DONE
xxxx 7DIAGNOSE-PASSED
xxxx 8END-OF-FRAME
xxxx 9TRANSMIT-NO-CRC-DONE
xxxx 10RECEPTION-ABORTED
xxxx 11STOP-REG-HIT
xxxx 12RETRANSMIT-DONE
xxxx 13EXECUTION-ABORTED
xxxx 15DIAGNOSE-FAILED
7654 3210Name
INTRCVEXECCHNL EventSTATUS 0
Result 1STATUS 1
Result 2STATUS 2
RCV
CHNL
RCV STATE RCVING
NO RSC
0EXEC
CHNL
EXEC STATE STATUS 3
7654 3210Name
INTRCVEXECCHNL EventSTATUS 0
Result 1STATUS 1-0
Result 2STATUS 1-1
RCV BYTE COUNT(LOW)/FFhSTATUS 2-0
RCV BYTE COUNT(HIGH)/FFhSTATUS 2-1
RCV
CHNL
RCV STATE RCVING
NO RSC
0EXEC
CHNL
EXEC STATE STATUS 3
7654 3210Name
INTRCVEXECCHNL EventSTATUS 0
Last XMT Result 1STATUS 1-0
Last XMT Result 2STATUS 1-1
RCV BYTE COUNT(LOW)STATUS 2-0
RCV BYTE COUNT(HIGH)STATUS 2-1
RCV
CHNL
RCV STATE RCVING
NO RSC
STP ON
NO RSC
EXEC
CHNL
EXEC STATE STATUS 3

Port 1

Figures 8 and 9 show the 82593 Port 1 command register. The command register has two formats, a formatfor issuing the STOP-REGISTER-UPDATE command, and a format for all other commands issued to Port 1. Figure 10 shorts the Port 1 commands. ... To return to Port 0, the SWT-TO-PORT-0 command is executed.

The Port 1 status registers are called Status Bank 1. The three registers contained in Status Bank 1 are shown in Figure 11. Status Bank 1 holds the value of the Stop Register, the Bus Throttle Timer, and the power down and high impedance states.

7654 3210Meaning
CMD*/
STOP
PointerCHNL Opcode 
0x 00 NOP
0x 01 SWT-TO-PORT-0
0x 02 INT-DISABLE
0x 03 INT-ENABLE
0x 05 SET-TS
0x 07 RST-TS
0x 08 POWER-DOWN
0x 011 RESET-RING-MNGMT
0x 014 RESET
0x 015 SEL-RST
00 xx STATUS4
01 xx STATUS5
02 xx STATUS6
1Stop Register Update Parameter Update Stop Register
7654 3210Name
00PWRDN0 000HI-Z STATUS4
0Stop Register ValueSTATUS5
TCBus Throttle Timer ValueSTATUS6

82593 and host cpu interaction

...

Prior to issuing a parametric command to the 82593, the CPU creats a data structure in memory, and programs the external controller with the start address and byte count of the memory block. The ILE's ASIC is the CPU for the purposes of this paragraph. To initiate a parametric command, copy the data structure to the card memory. Then tell the ASIC which DMA channel to use. Issue the command to the '593. For commands that require no transfer of parameters to the 83593 ... the CPU issues the command to the device without creating a data structure in memory. The 82593 performs the command with no further involvement from the CPU. Any parameters or data assicauted with the command are transferred between the memory and the 82593 by the DMA controller eg the ASIC. Upon completion of the operation, the 82593 updates the appropriate status registers and asserts its INT line to the CPU The INT line is routed by the ASIC to the pcmcia bus's interrupt pin. The ASIC multiplexes the interupt with other radio events .

Frame Transmission

To transmit a frame, the CPU prepaares a Transmit Data Vlock in memory as shownin Figure 13. Its first two bytws specify the length pof the rest of the block. The next few bytes (up to six) contain the destination address of the station the frame is being sent to. The rest of the block is teh data field. The CPU programs the DMA controller with the start address of the block, the length of the block, and other control information and then issues a TRANSMIT command to the 82593. Upon Receiving this command, the 82593 fetches the first two bytes of the block to determine its length. If the link is free and at least one data byte is loaded into 82593's XMT FIFO, the 82593 begins transmitting the preamble and concurrently requests more bytes from the transmit buffer whic are loaded into the XMT FIFO to keep them ready for transmission. The 82593 can also be configured to start transmission only after the initial 64 bytes of the transmit frame are written into its XMT FIFO. The 82594 indepenently resolve access and possible contention on the link (collisions). When the transmission is completed, the 82593 updates its status registers and raises its INT signal to inform the CPU of the completed transmission.

Transmit Frame Chaining

When configured to Continuous mode, the 82593 can transmit consecutive frames without having the CPU issue the TRANSMIT command for each frame. The is called transmit frame chaining. Figure 14 shows the memory structure used for transmit chaining with the 82593 in 8-bit con figuration. Figure 15 shows the structure for a 16-b it configuration. The CPU can place multiple transmit frames in memory, with each frame separated from the next by a TRANSMIT command byte. The command byte immediately follows the last byte of the transmit frame. It must contain one of three commands: TRANSMIT (04H), TRANSMIT-NO-CRC (09H) or NOP (00H).

Following a successful transmission, the 82593 requests the command byte which follows the last data byte of a frame. EOP* is asserted druing this cycle, indicating a successful transmission. Assertion of EOP* in this mode can also be disabled.

If the command byte contains the TRANSMIT opcode, the 82593 will behave as if another TRANSMIT command has been issued by the CPU, and will attempt to trasmit the new frame as soon as deferring is completed. A NOP in the command byte indicates that the preceing frame was the last frame to be transmitted and no other frames follow.



$Id: iletech.html,v 1.15 1998/12/04 21:37:11 imp Exp $