802.11 媒體控制器之頻道速率WEP和DCF的ASIC實現

全文

(1)國立交通大學. 電機資訊學院資訊學程碩士論文. 802.11 媒體控制器之頻道速率 WEP 和 DCF 的 ASIC 實現. Channel-Speed WEP and DCF ASIC Realization for IEEE 802.11 MAC. 研究生：謝才俊指導教授：林盈達. 教授. 簡榮宏. 教授. 中華民國九十三年六月.

(2) 802.11 媒體控制器之頻道速率 WEP 和 DCF 的 ASIC 實現 Channel-Speed WEP and DCF ASIC Realization for IEEE 802.11 MAC. 研究生：謝才俊. Student：Tsai-Chun Hsieh. 指導教授：林盈達. Advisor：Prof. Ying-Dar Lin. 簡榮宏. Prof. Rong-Hong Jan. 國立交通大學電機資訊學院資訊學程碩士論文. A Thesis Submitted to Degree Program of Electrical Engineering Computer Science College of Electrical Engineering and Computer Science National Chiao Tung University in Partial Fulfillment of the Requirements for the Degree of Master of Science in Computer Science June 2004 Hsinchu, Taiwan, Republic of China. 中華民國九十三年六月.

(3) 學生：謝才俊. 指導教授：林盈達教授簡榮宏教授. 國立交通大學電機資訊學院資訊學程﹙研究所﹚碩士班. 摘. 要. 目前有內建無線網路功能的設備愈來愈普遍，而且傳輸速度也比以前都來的更快。為了實現更高吞吐量的設計，以硬體為主的設計將更常被採用。在這篇論文當中，我們提出符合 IEEE 802.11 標準的硬體式媒體控制器及一硬體式 WEP 加解密引擎。這兩者可以非常容易的整合進入內建無線網路功能的系統晶片(SoC)當中。並且透過一先進先出的記憶體及 PLCP 表頭的前奏時間來解決 RC4 演算法中執行金鑰排程(Key Schedule Algorithm,KSA)時所消耗掉的時間.如此將可以在 WEP 加解密功能打開下，802.11 MAC 仍然可以維持 54Mbps 頻道速率的吞吐量。有關模擬環境方面，我們設計一個虛擬 802.11 媒體控制器用來產生及檢查 802.11 的封包以驗證我們的設計。在對基頻處理器的介面訊號方面，我們選擇 Intersil HFA3861B 及 HFA3683 做為我們的實體層。最後我們將完成支援 DCF 的媒體控制器及一具有 54Mbps 頻道速率吞吐量的 WEP 安全引擎。所有的設計使用 Verilog 語言來完成。這個設計可已完全被合成為電路。而且在使用 Xilinx FPGA (v2000efg1156-8)元件下，其操作頻率可以達到 44 MHz。消耗的邏輯閘數是 51,029 閘。.

(4) Channel-Speed WEP and DCF ASIC Relization for IEEE 802.11 MAC. Student：Tsai-Chun Hsieh. Advisors：Prof. Ying-Dar Lin Prof. Rong-Hong Jan. Degree Program of Electrical Engineering Computer Science National Chiao Tung University. ABSTRACT. Embedded wireless communication devices nowadays are getting more and more popular and running at higher speeds than ever before. In order to achieve the desired throughput, the hardware approach is being adopted more often. In this thesis, we propose a hardware-based MAC IP that is compatible with IEEE 802.11 standard, and a hardware-based WEP IP. They both can be easily integrated into an SoC chip for embedded wireless communication devices. It uses FIFO RAM and PLCP preamble time to recover the overhead of processing KSA at RC4. Hence it can retain the throughput at 54Mbps Channel-speed with the WEP function turned on. In our simulation environment, a pseudo model of 802.11 MAC is designed to generate and check 802.11g frames to verify our implementation. For the baseband interface signals, we use the Intersil HFA3861B. and. HFA3683. as. the. physical. layer.. Finally, we accomplish an 802.11 MAC that support DCF machine and 54Mbps Channel-speed WEP security machine. All designs are accomplished by the Verilog RTL language. It is fully synthesizable and its operation frequency can scale up to 44MHz at the Xilinx FPGA (v2000efg1156-8) device. The total equivalent gate count is 51,029..

(5) 誌. 謝. 感謝交通大學提供碩士在職專班學程，讓我在職場工作多年之後能夠回到學校，重拾書本吸取新的知識。同時在學習的過程當中，透過和學校老師間的互相討論，也瞭解到學術界中對相關問題的看法，對於我在工作上有許多的幫助。感謝林盈達老師對於我學位論文的要求及指導。讓我學習到如何有系統有組織地去找出問題，描述問題，進而清晰地去說明如何解決這個問題。老師的叮嚀「一圖，二表，三文字」學生謹記在心。最後感謝我的家人在我求學及做論文的過程當中，犧牲了許多寶貴的相處時間，同時也影響了你們的生活品質。因為有了你們的支持，我才能夠完成學業。. 謝才俊 07/26/2004. iii.

(6) Channel-Speed WEP and DCF ASIC Realization for IEEE 802.11 MAC. Chinese Abstract ---------------------------------------------------------------------i English Abstract----------------------------------------------------------------------ii Thanks ---------------------------------------------------------------------------------iii Contents--------------------------------------------------------------------------------iv List of Tables --------------------------------------------------------------------------vii List of Figure--------------------------------------------------------------------------viii Chapter 1 Introduction -------------------------------------------------------------1 Chapter 2 IEEE 802.11 MAC Protocol ------------------------------------------4 2.1 802.11 Wireless LAN Introduction ---------------------------------------4 2.1.1 802.11 Wireless LAN architecture--------------------------------5 2.1.1.1 IBSS (Independent Basic Service Set) -------------------5 2.1.1.2 BSS (Basic Service Set) -----------------------------------6 2.1.2 802.11 Wireless LAN Standard -----------------------------------6 2.2 Distributed Coordinated Function (DCF) --------------------------------8 2.2.1 MAC Framing -------------------------------------------------------8 2.2.2 CSMA/CA + ACK Mechanism -----------------------------------10 2.2.3 RTS/CTS Mechanism ----------------------------------------------11 2.2.4 Synchronization -----------------------------------------------------12 2.2.5 Random Back-Off Mechanism------------------------------------12 2.3 802.11 Security Mechanism -----------------------------------------------14 2.3.1 WEP Algorithm -----------------------------------------------------14 iv.

(7) Chapter 3 Implementation ---------------------------------------------------------17 3.1 Design issues and solutions------------------------------------------------18 3.2 System Architecture Design -----------------------------------------------20 3.2.1 Chip Specification --------------------------------------------------21 3.2.2 Chip Pin Assignment -----------------------------------------------22 3.2.3 Sub-Module Partition-----------------------------------------------22 3.3 DCF Implementation -------------------------------------------------------24 3.3.1 Receive Module -----------------------------------------------------25 3.3.1.1 chstate Module ----------------------------------------------26 3.3.1.2 valmpdu Module------------------------------------------28 3.3.1.3. rx_co Module ---------------------------------------------29. 3.3.1.4. chkpkt Module --------------------------------------------30. 3.3.2 Transmit Module ----------------------------------------------------31 3.3.2.1 tx_co Module------------------------------------------------32 3.3.2.2 ackpkt Module ----------------------------------------------33 3.3.2.3 rtspkt Module -----------------------------------------------33 3.3.2.4 ctspkt Module -----------------------------------------------34 3.3.2.5 back off Module --------------------------------------------35 3.3.3 Time Stamp Module ------------------------------------------------35 3.3.4 Beacon control Module --------------------------------------------36 3.4 WEP Algorithm Implementation ------------------------------------------38 3.5 BBP Interface Implementation --------------------------------------------41 3.6 RF Interface Implementation ----------------------------------------------48 Chapter 4 Function Simulation and Verification ------------------------------53 4.1 802.11 MAC Simulation Environment and Test Plan ------------------53. v.

(8) 4.2 DCF Receive Function Verification --------------------------------------57 4.2.1 Receive a DATA (DA==Network Address) packet-------------57 4.2.2 Receive a RTS (DA==Network Address) packet ---------------58 4.2.3 NAV Timer-----------------------------------------------------------59 4.2.4 Receive a Beacon packet in BSS mode --------------------------59 4.3 DCF Transmission Function Verification --------------------------------60 4.3.1 Transmit a DATA packet -------------------------------------------60 4.3.2 Transmit a Data Packet using RTS Mechanism-----------------61 4.3.3 Abort the transmitted packet when lose ACK packet ----------62 4.3.4 Re-transmit a packet when channel is BUSY -------------------62 4.3.5 Transmit a broadcast packet ---------------------------------------63 4.3.6 Transmit a Beacon packet------------------------------------------64 4.4 BBP Interface Function Verification--------------------------------------64 4.4.1 Write BBP Register -------------------------------------------------64 4.4.2 Read BBP Register (RSSI Reg)-----------------------------------65 4.5 RF Interface Function Verification----------------------------------------66 4.6 WEP Function Verification ------------------------------------------------66 4.6.1 RC4 Algorithm Verification ---------------------------------------66 4.6.2 WEP Verification----------------------------------------------------68 Chapter 5 FPGA Synthesis and P&R --------------------------------------------70 5.1 FPGA Synthesis and P&R -------------------------------------------------70 5.2 FPGA Synthesis and Timing Report--------------------------------------71 Chapter 6 Conclusion ---------------------------------------------------------------73 Reference ------------------------------------------------------------------------------74 Appendix A Boundary signals of chip--------------------------------------------76. vi.

(9) List of Tables Table 2-1 802.11 Working Group -------------------------------------------------7 Table 2-2 Back-off Algorithm -----------------------------------------------------13 Table 2-3 WEP KSA Pseudo code---------------------------------------------------15 Table 2-4 WEP PRGA Pseudo code-------------------------------------------------16 Table 3-1 Example of LENGTH calculations for CCK mode -------------------45 Table 3-2 3 Example of LENGTH calculations under PBCC mode ------------46 Table 3-3 Register definition of HFA 3683A --------------------------------------50 Table 4-1 Test Plan --------------------------------------------------------------------57 Table 4-1 WEP Round 1 --------------------------------------------------------------67 Table 4-2 WEP Round 2 --------------------------------------------------------------67 Table 5-1 v2000efg1156-8 Synthesis Report --------------------------------------72 Table 5-2 v2000efg1156-8 Timing Report -----------------------------------------72. vii.

(10) List of Figures Figure 2-1 IBSS Mode ----------------------------------------------------------------6 Figure 2-2 BSS Mode -----------------------------------------------------------------6 Figure 2-3 802.11 Frame Format ----------------------------------------------------9 Figure 2-4 RTS Frame Format -------------------------------------------------------9 Figure 2-5 CTS Frame Format-------------------------------------------------------9 Figure 2-6 ACK Frame Format ------------------------------------------------------9 Figure 2-7 Beacon Frame Format ---------------------------------------------------9 Figure 2- 8 NAV Timing--------------------------------------------------------------12 Figure 2- 99 DSSS contention window size ---------------------------------------13 Figure 3-1 Design Flow Chart -------------------------------------------------------18 Figure 3- 2 System architecture block Diagram -----------------------------------21 Figure 3- 3 Function block Diagram ------------------------------------------------23 Figure 3- 4 Sub module hierarchical diagram -------------------------------------24 Figure 3- 5 receive Module Interface -----------------------------------------------25 Figure 3- 6 Receive Function Block Diagram -------------------------------------26 Figure 3- 7 chstate Module Interface -----------------------------------------------27 Figure 3- 8 chstate Module state machine flow chart-----------------------------27 Figure 3- 9 valmpdu Module Interface ---------------------------------------------28 Figure 3- 10 valmpdu Module state machine flow chart -------------------------29 Figure 3- 11 rx_co Module Interface------------------------------------------------29 Figure 3- 12 rx_co Module state machine flow chart-----------------------------30 Figure 3- 13 chkpkt Module Interface ----------------------------------------------31 Figure 3- 14 Transmit Function Block Diagram-----------------------------------32 Figure 3- 15 tx_co Module Interface------------------------------------------------32 Figure 3- 16 ACKPkt Module Interface --------------------------------------------33 viii.

(11) Figure 3- 17 RTSPkt Module Interface ---------------------------------------------34 Figure 3- 18 CTSPkt Module Interface---------------------------------------------34 Figure 3- 19 back off Module Interface --------------------------------------------35 Figure 3- 20 tsf Module Interface ---------------------------------------------------36 Figure 3- 21 bcnctrl Module Interface ----------------------------------------------37 Figure 3-22 WEP Encryption Timing -----------------------------------------------38 Figure 3-23 WEP Decryption Flow -------------------------------------------------39 Figure 3- 24 WEP Module Interface ------------------------------------------------40 Figure 3- 25 WEP Module state machine flow chart -----------------------------41 Figure 3- 26 HFA3861B Pin Assignment Diagram -------------------------------41 Figure 3- 27 HFA3861B control port read timing---------------------------------42 Figure 3- 28 HFA3861B control port write timing--------------------------------43 Figure 3- 29 HFA3861B TX port timing -------------------------------------------43 Figure 3- 30 HFA3861B RX port timing -------------------------------------------43 Figure 3- 31 mitop Module Interface -----------------------------------------------44 Figure 3- 32 rwbbp Module state machine flow chart ----------------------------47 Figure 3-33 PLCP Header ------------------------------------------------------------47 Figure 3- 34 mictrl Module state machine flow chart ----------------------------48 Figure 3- 35 HFA3683A Pin Assignment Diagram -------------------------------49 Figure 3- 36 HFA3683A serial data input timing----------------------------------50 Figure 3- 37 rfif Module Pin Assignment ------------------------------------------51 Figure 3- 38 rfif Module FSM flow chart (0) --------------------------------------52 Figure 3- 39 rfif Module FSM flow chart (1) --------------------------------------52 Figure 4- 1 Testing Environment ----------------------------------------------------54 Figure 4- 2 Pin Assignment of BBPMAC.v----------------------------------------54 Figure 4- 3 Receive function of BBPMAC.v --------------------------------------55 ix.

(12) Figure 4- 4 Transmit function of BBPMAC.v -------------------------------------55 Figure 4– 5 Received a DATA packet-----------------------------------------------58 Figure 4– 6 Receive a RTS packet (DA == Network Address)------------------58 Figure 4– 7 Receive a RTS packet (DA != Network Address) ------------------59 Figure 4– 8 Received a Beacon packet in BSS station mode --------------------60 Figure 4– 9 Transmit a DATA Packet -----------------------------------------------60 Figure 4– 10 Transmit a Data Packet using RTS Mechanism -------------------61 Figure 4– 11 Abort the transmitted packet when lose ACK packet -------------62 Figure 4– 12 Re-transmit a packet when channel is BUSY----------------------63 Figure 4– 13 Transmit a Broadcast Packet -----------------------------------------63 Figure 4– 14 Transmit a Beacon Packet --------------------------------------------64 Figure 4– 15 BBP register writes timing -------------------------------------------65 Figure 4– 16 BBP register read timing ---------------------------------------------65 Figure 4– 17 RF chip control timing ------------------------------------------------66 Figure 4– 18 RC4 KSA ---------------------------------------------------------------68 Figure 4– 19 Waveform of WEP operation-----------------------------------------69 Figure 5-1 FPGA Place & Route Flow Chart --------------------------------------70. x.

(13) Chapter 1 Introduction Embedded wireless communication devices nowadays are getting more popular and running at higher speeds than ever before. In order to achieve the throughput of design, a hardware approach is being adopted more often. The IEEE 802.11g [1] wireless LAN, capable of providing data rates up to 54Mbps, has recently received increasing public attention. For the implementation of MAC layer and WEP [2] encryption/decryption, the main challenge is to find a suitable architecture meeting the Channel-speed requirement without performance loss. From the architecture point of view, there are two approaches for MAC implementation. One is firmware/hardware co-design approach, another is hardware-based approach. The firmware/hardware co-design approach[3][4][5][6] can achieve the flexibility of design and shorten the time-to-market, but it is not a cost-effect design for the low cost and wire-speed MAC. Because it needs vast capacity of SRAM, Flash RAM memory for embedded processor operation. The hardware-based approach [7] can achieve the low cost and wire-speed design. Because it does not need vast capacity of SRAM, flash RAM memory for embedded processor operation. After the standardization of IEEE 802.11g in 2003, the MAC remains unchanged and employs a carrier sense multiple access with collision avoidance (CSMA/CA) as fundamental access. So the main control function of hardware-based MAC can be designed and implemented using Specification and Description Language (SDL).. 1.

(14) In this thesis, we proposed a hardware-based MAC IP that is compatible with 802.11 standard, and a hardware-based WEP IP. They both can be easily integrated into a SoC chip, while retaining the throughput at wire-speed when the WEP function is turned on. About the simulation environment, a pseudo model of 802.11 MAC is designed to generate and check 802.11 frames. For the baseband interface signals, we use the Intersil HFA3861B [8] and HFA3683 [9] as the physical layer. WEP uses of 40-bit RC4 as its encryption mechanism. There are mainly two steps in RC4 implementation. One is the key-scheduling algorithm (KSA) and the other is the pseudo-random generation part (PRGA). KSA turns a random key into an initial permutation S. It will consume 1536 system clock. PRGA uses the permutation to generate the pseudo-random output sequence. In order to implement a channel-speed WEP engine. We use two methods to overcome the overhead of KSA operation. First, before transmit a packet to receiver, the BBP must send a preamble signal to receiver. So we can use this time to run KSA function to initial the content of S-BOX RAM at encryption operation. Second, when receive a packet from BBP, WEP engine must run decryption operation. We can use a FIFO to recover the KSA time. Finally, we accomplish an 802.11 MAC that support DCF machines and wire-speed WEP security machines. All designs are accomplished by the Verilog RTL language. It is fully synthesizable and its operation frequency can scale up to 44MHz at the Xilinx FPGA (v2000efg1156-8) [10] device. The organization of this thesis is described as follows. In chapter 2, the overall operation of IEEE 802.11 WLAN is discussed. The implementation issue and job partitioning process are described in Chapter 3. The function of our design is 2.

(15) verified in Chapter 4. The result of FPGA synthesis is presented in Chapter 5. Finally, the conclusion is given in Chapter 6.. 3.

(16) Chapter 2 IEEE 802.11 MAC Protocol In this chapter, we review the related knowledge about the implementation of 802.11 MAC function at chapter 3. In section 2.1, we introduce the system architecture of 802.11 standard: IBSS network and BSS network. In section 2.2, we introduce the mandatory access protocol in 802.11 standard: DCF (Distributed Coordination Function. In section 2.3, we introduce the security protocol in 802.11 standard: WEP (Wired Equivalent Privacy).. 2.1 802.11 Wireless LAN Introduction In 1997 the IEEE adopted the first wireless local area network (WLAN) standard, IEEE 802.11. This standard defines the media access control (MAC) and physical (PHY) layers for a LAN with wireless connectivity. Its maximum throughput up to 2Mbps, its spectrum is 2.4GHZ. In 1999 the IEEE adopted the second WLAN standard, IEEE 802.11b and IEEE 802.11a. Because the standards use different portions of the spectrum, 802.11b throughput up to 11Mbps, its spectrum is 2.4GHz. 802.11a throughput up to 54Mbps, its spectrum is 5.0GHz. However, 802.11a and 802.11b are not compatible. In 2003 the IEEE adopted the third WLAN standard, IEEE 802.11g, while maintaining backward compatibility with 802.11b products. Its maximum throughput is up to 54Mbps. IEEE 802.11 MAC standard specifies two different machines to access data: Distributed Coordination Function (DCF) and Point Coordination Function (PCF). DCF is the basic access scheme and PCF is an optional access scheme. DCF is a contention-based medium access scheme. It is based on a distributed random access algorithm, known as Carrier-Sense Multiple Access with Collision 4.

(17) Avoidance (CSMA/CA). Before attempting to transmit, sender checks whether the channel is free. If the channel is BUSY, sender defer to each other and use and exponential back off algorithm to avoid collisions. This method is used in either Ad Hoc network or in Infrastructure network. PCF is a contention-free based medium access scheme. Point coordinator polling all station that list on its associated table. Associated station can transmit data only when they are allowed to do so by the point coordinator. So PCF can provide a limited Quality Of Service function. But this method just only is used in Infrastructure network.. 2.1.1 802.11 Wireless LAN Architecture The 802.11 architecture contains several main components: station (STA), access point (AP), independent basic service set (IBSS), basic service set (BSS), distribution system (DS), and extended service set (ESS). The wireless STA contains an adapter card, PC Card, or an embedded device to provide wireless connectivity. The AP functions as a bridge between the wireless STAs and the existing network backbone for network access. 2.1.1.1 IBSS (Independent Basic Service Set) IBSS mode, also called ad-hoc mode, is designed for point-to-point connections. Its architecture is show in Figure 2-1. No access point are used, and no distribution is present. Only stations that have the same BSSID will process broadcast and multicasts.. 5.

(18) Station. Station. Station. Figure 2-1 IBSS Mode 2.1.1.2 BSS (Basic Service Set) BSS mode is the mode that typically is used. BSS mode is also called infrastructure mode. See Figure 2-2. In this mode, a number of wireless access points are connected to a wired network. Each wireless network has its own name. This name is called the SSID of the network. Access point (AP) can distribute the channel among the station. So AP also can provide a limited QoS function for station.. Station. Station. Station Access Pointer. Figure 2-2 BSS Mode 2.1.2. 802.11 Wireless LAN Standard The task groups of the 802.11 standard are show as Table 2-1. The details of some task groups are listed below.. 6.

(19) Standard. Status. Description. 802.11. Work. Date rate is 1 Mbps, 2Mbps. completed. Frequency band is 2.4 GHz. Work. Published in 1999. completed. Data rate up to 54 Mbps. 802.11a. Frequency band is 5 GHz 802.11b. Work. Published in 1999. completed. Date rate is 5.5 Mbps, 11Mbps Frequency band is 2.4 GHz. 802.11e. Ongoing. Enhance the 802.11 MAC to increase the quality of service possible (QoS).. 802.11f. Ongoing. Developing. recommended. practices. for. implementing the 802.11 concepts of Access Points and Distribution Systems. The purpose is to increase compatibility between Access Point devices from different vendors. 802.11g. 802.11i. Work. Date rate up to 54 Mbps. completed. Frequency band is 2.4 GHz. Ongoing. Enhancing the security and authentication mechanisms of the 802.11 standard. Table 2-1 802.11 Working Groups 802.11, 802.11a, 802.11b, 802.11g : There standards are to develop a medium access control (MAC) and physical layer (PHY) specification for wireless connectivity. 802.11e: Supplementary to the MAC layer to provide QOS support for LAN applications. The purpose is to provide classes of service with managed levels of QOS. 7.

(20) for data, voice and video applications. The proposed enhancement to DCF - Enhanced Distribution Coordination Function (EDCF) - introduces the concept of traffic categories. Each station has eight traffic categories, or priority levels. Thus stations with lower-priority traffic must wait longer than those with high-priority traffic before trying to access the medium. 802.11i: 802.11i has identified the weaknesses of the existing WEP standard. And it proposes three machines to enhance the security of MAC level.. 2.2 Distributed Coordinated Function (DCF) DCF is mandatory and based on the CSMA/CA (carrier sense multiple access with collision avoidance) protocol. With DCF, 802.11 stations contend for access and attempt to send frames when there is no other station transmitting. If another station is sending a frame, stations are polite and wait until the channel is free. 2.2.1 MAC Framing DATA Frame Figure 2-3 shows a generic data frame. It includes 30 bytes of frame header, 0-2312 bytes of data payload and 4 bytes of CRC-32 checksum code. Depending on the different type of data frame, some of the fields in the figure may not be used. Control Frame Figure 2-4 shows a RTS frame format. RA indicates destination station network address; TA indicates the source station network address. The number of microseconds required for the transmission is calculated and placed in the Duration field. The duration time = frame time + CTS frame time +ACK frame time + 3xSIFS time. Figure 2-5 shows a CTS frame format. MAC copies the TA of RTS frame into the RA of CTS frame. The duration time = RTS – CTS time – 1xSIFS time.. 8.

(21) Figure 2- 6 shows an ACK frame format. The RA is copied from the address 2 field of the frame being acknowledged. Management Frame Figure 2-7 shows a Beacon frame format. Beacon frame to announce its presence and relay information, such as timestamp, SSID, and other parameters regarding the access point to radio stations that are within range. 2. 2. 6. 6. 6. 2. 6. 0 - 2312. 4. Frame Control. Duration ID. Address 1. Address 2. Address 3. Seq Ctrl. Address 4. Frame Body. FCS. Figure 2-3 802.11 Frame Format 6. 2. 2. Frame Co n t ro l. D u rat i o n. 6. 4. Recei v er T ran s mi t A d d res s A d d res s. FCS. Figure 2-4 RTS Frame Format 2. 2. Frame Co n t ro l. D u rat i o n. 6. 4. Recei v er A d d res s. FCS. Figure 2-5 CTS Frame Format. 2. 2. 6. 4. Frame Control. Duratio n. Receiver Address. FCS. ACK Frame. Figure 2-6 ACK Frame Format 8. 2. Timestam p. Beacon Interval. 2 Capabili ty Info. Variable. 7. 2. 8. 4. SSID. FH Parame ter. DS Parame ter. CF Parame ter. IBSS Parame ter. Figure 2-7 Beacon Frame Format 9. Variable TIM.

(22) 2.2.2 CSMA/CA+ACK Mechanism Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA) is the MAC protocol that is used by systems that conform to the various flavors of the IEEE 802.11 LAN Standard. CSMA (Carrier Sense Multiple Access) The physical layer uses a clear channel assessment (CCA) algorithm to determine if the channel is clear. Measuring the RF energy at the antenna and determining the strength of the received signal accomplish this. This measured signal is commonly known as RSSI. If the received signal strength is below a specified threshold the channel is declared clear and the MAC layer is given the clear channel status for data transmission. If the RF energy is above the threshold, the channel is declared busy and the MAC layer is given the busy channel status for data transmission. CA (Collision Avoidance). If the medium is free for the duration of an Inter-Frame Space (IFS), the station can start sending (IFS depends on packet type). If the medium is busy, the station has to wait for free IFS, and then the station must additionally wait a random back-off time.If another station occupies the medium during the back-off time of the station, the back-off timer stops. IFS (Inter-Frame Space) have four different interval time: SIFS, PIFS, DIFS and EIFS. SIFS (Short IFS)；its duration is 10 us. highest priority, for ACK, CTS, polling response。 PIFS(PCF IFS)；medium priority, for time-bounded service using PCF. SIFSTime + SlotTime。. 10. PIFSTime =.

(23) DIFS(DCF IFS)；lowest priority, for asynchronous data service. DIFSTime = SIFS time + 2 x Slot time。 EIFS (Extended IFS) : Extend frame Interval。EIFSTime = SIFS time + 8 x ACK Size +Preamble length + PLCPHeader length + DIFS。 ACK (Acknowledgement) At the end of every MPDU packet the receiver, if it has successfully received the packet, will return an ACK packet (if not received or received with errors the receiver will NOT respond). If sender didn’t receive the ACK packet from receiver, the sender must retransmit previous MPDU packet. 2.2.3 RTS/CTS Mechanism The RTS/CTS handshaking provides positive control over the use of the shared medium. The primary reason for implementing RTS/CTS is to minimize collisions among hidden stations. This occurs when users and access points are spread out throughout the facility and you're finding a relatively high number of retransmissions occurring on the wireless LAN. RTS/CTS Machine uses a small size of RTS packet to test the channel status before MAC wants to transmit a large size of MPDU packet. If the channel is IDLE, the duration field of RTS packet will setup the NAV (Net Allocation Vector) timer that all active station in BSS. Station can’t transmit any packet before NAV timer comes down to zero. This machine can grantee that sender can send a full packet during the NAV time, so this packet didn’t be destroyed by interference from another station. Figure2- 8 shows how the NAV protects the sequence from interruption.. 11.

(24) Figure2- 8 NAV Timing. 2.2.4 Synchronization In infrastructure network, the access point maintains a global TSF timer. Associated station maintain local TSF timer. The TSF timer is a 64-bit counter. So the maximum range is 264 us. Access point will transmit a beacon frame that includes TSF timer to station periodically. Stations associated with an access point accept the global TSF timing value in any received Beacons, but station may add delay to the received timing value to compensate for local processing by the antenna and transceiver. In IBSS network, all stations in the IBSS prepare to transmit a beacon frame at the Target Beacon Transmission Time (TBTT). After the TBTT interval, all stations begin to count the back off timer down to 0. If a beacon is received before the station transmission time, the pending Beacon transmission is canceled. 2.2.5 Random Back-Off Mechanism CSMA/CA uses a back-off timer that ensures fairness. Each station starts a random back-off timer when waiting for the Contention Window (CW). This timer ticks down to zero while waiting in the contention window. Each station gets a new random timer when it wants to transmit. This timer isn't reset until the packet has 12.

(25) transmitted Contention window sizes are 1 less than a power of 2-slot time. Each time the retry counter increases, the contention window move to the next greatest of two. When the contention window reaches its maximum size, it remains there until it can be reset. Figure 2-9 illustrates the growth of the contention window as the number of transmission increases, using the numbers from DSSS physical layer. The algorithm of back off machine is shown in table 2-2.. Figure 2- 9 DSSS contention window size. Back off Time= INT (CW x Random ()) x Slot Time INT (x) is an integrity function. CW is integrity between CWmin and CWmax . Random() is a random number generator, its value is less than 1， Slot Time = 20 us. Table 2-2 Back off Algorithm. 13.

(26) 2.3 802.11 Security Mechanism Because the radio broadcasts over air, anybody can receive your signal with a wireless LAN card which channel is the same as your LAN card. So the IEEE 802.11 standard defines the Wired Equivalent Privacy, or WEP, encapsulation of 802.11 data frames. The goal of WEP is intended to provide security that is equivalent to the security of a wired network. 2.3.1 Wired Equivalent Privacy Algorithm (WEP) WEP requires the use of the RC4 stream cipher [11], which is a symmetric stream cipher. A stream cipher uses a stream of bits, called the key stream. WEP specifies the use of a 40-bit secret key. This secret key is combined with a 24-bit initialization vector (IV) to create a 64-bit RC4 key stream. The RC4 algorithm works in two phases, Key Schedule Algorithm (KSA) and Pseudo Random Generate Algorithm (PRGA). KSA uses a variable length of key from 1 to 256 bytes to initialize a 256-byte S-BOX. The S-BOX is used for subsequent generation of pseudo-random bytes and then to generate a pseudo-random key stream.. Cipher text ( c1 ( k1 k 2. k. 3. c c 2. m ,m ,m …. K=. k ,k ,k. C=. c ,c ,c. 1. Where. 3. 2. 2. 1. 2. c. i. ) is XOR of plaintext ( m1. ). That is. M=. 1. 3. =. 3. 3. m. i. XOR. k. i. 14. m m3 ) 2. and key streams.

(27) Each. m. i. is typically a byte (8 bits). The decryptor recovers the plaintext stream. from the ciphertext stream by XORing each ciphertext bit with the corresponding key stream bit .. Table2-3 lists the Pseudo code of WEP KSA. Table 2-4 lists the Pseudo code of PRGA.. KSA (Key) Initialization Phase: For I = 0 to N-1 S [I] = I; J = 0; Scrambling Phase: For I = 0 to N-1 J = (J + S [I] + Key [I mod L]) mod N; Swap (S [I], S [J]); Table 2-3 WEP KSA Pseudo code. In the initialization phase of Table 2-3, it fills the array S [] with the bytes of the key. Repeat if necessary to fill the entire 256-byte array. In the scrambling phase, it starts the scrambling process that creates the pseudo random S array from the previously seeded S array. Finally, a swap function is performed to swap the value held in S [I] with the value held in S [J].. 15.

(28) PRGA (Sn) Initialization Phase: I = 0; J = 0; Generation loop: I = (I + 1) mod N; J = (J + S [I]) mod N; Swap (S [I], S [J]); Output S [(S [I] + S [J]) mod N]; Table 2-4 WEP PRGAPseudo code. The integrity check algorithm, generating a CRC-32 called an integrity check value (ICV). The ICV protects the contents against tampering by ensuring that the frame has not changed in transit. The formula of CRC-32 is G (x) =. 32. 26. 23. 22. 16. 12. 11. 10. 8. 7. 5. 4. 2. x +x +x +x +x +x +x +x +x +x +x +x +x +x. 16. +1..

(29) Chapter 3 Implementation As the complexity of ASIC design increases rapidly, the methodology of how to design correctly and quickly is getting more and more important. Using a good design flow capable of managing the possible critical issues prevents us from wasting time repeatedly. As shown in Figure 3-1, the design flow consists of two paths of design abstractions, and each path corresponds to several design steps. (1) Verification Path: 1.Simulation Model We begin with the 802.11 standard and system requirement to design the behavior model. The model can generate the frame of 802.11 to verify the function of WMAC design and check the receiving frame from WMAC. 2.Test Plan The Test plan detail lists all of testing item. We follow there items to create testing patterns to verify the function of design. (2) Design Path: 1.Module Partition After the architecture is determined from architecture design, we proceed to module partition. At this stage, the building blocks in the predetermined architecture will be decomposed into smaller modules. 2.RTL Design At this stage, the verilog hardware description language (HDL) RTL is used to represent this small module. The RTL codes, together with test bench, are simulated through the Cadance Verilog-XL simulator. After accomplish above process, we create a testing environment for whole chip 17.

(30) verification. Simulator executes each testing item in the test plan. If all of testing item is passed, we synthesizing the RTL code in Xilinx FRGA with Foundation V3.1 FPGA Express, and give clock rate and operation condition constrains. After that, we get the gate level netlist. In FPGA P&R stage, we use Foundation V3.1 Design Manager to automatically place and route with gate level netlist and perform the STA for timing analysis. System. S pecification. Architec ture Analysis. Bloc k Diagram. Analysis. Chip Signals. Test Plan Doc ument. Test Plan. Module Partitio n. Interface Signals. Simulation Model Code. Simulation Model. Sub-Module RTL co de. RTL Source Code. Testing Code. Sub-Module Testing. Create Test Environme nt. Whole Chip Integra tion. Whole Chi p S ource Code. Whole Chip Verification. FPGA S ynthesis. FPGA P&R. FPGA Report. Figure 3- 1 Implementation Flow Chart. 3.1 Design issues and Solutions In this chapter, we implement a hardware-based MAC IP that is compatible with 802.11 DCF standard, and a Channel-speed WEP IP. 18.

(31) Hardware-based MAC The firmware/hardware co-design approach is not a cost-effect design for the low cost and Channel-speed MAC. Because it needs vast capacity of SRAM, Flash RAM memory for embedded processor operation. After the standardization of IEEE 802.11g in 2003, the MAC remains unchanged and employs a carrier sense multiple access with collision avoidance (CSMA/CA) as fundamental access. So the main control function of hardware-based MAC can be designed and implemented using hardware architecture. The following is the so1ultion of the design techniques used in hardware-based MAC to meet the 802.11 MAC layer function: 1. The main control function of hardware-based MAC can be designed and implemented using Specification and Description Language (SDL) of 802.11 DCF standard. 2. Use an embedded beacon SSRAM to store beacon packets and designed a beacon control circuit to load the data from beacon SSRAM on the fly. 3. Auto-calculating the byte count from the LENGTH field of PLCP header between WMAC and BBP, and auto-setting the content of BBP registers using their values. Wire-speeded WEP The Channel-speed WEP uses 40-bit RC4 as its encryption mechanism. There are mainly two steps in RC4 implementation. One is the key-scheduling algorithm (KSA) and the other is the pseudo-random generation part (PRGA). KSA turns a random key into an initial permutation S. It will consume 1536 system clocks every packet. This time limit the throughput of 802.11 network when WEP function turns on. The following is the so1ultion of the design techniques used in WEP engine to meet the desired performance. 1. Use a FIFO RAM to recover the KSA time of RC4 algorithm at WEP decryption. 2. Use the PLCP preamble time to recover the KSA time of RC4 algorithm at WEP 19.

(32) encryption. Pseudo simulation model For the function verification, we developed three pseudo-models to simulate the operation of physical BBP chip and RF chip. 1. Design a Pseudo simulation model that can simulate the operation of 802.11 MAC with verilog RTL code. 2. Design a Pseudo simulation model that can simulate the operation of BBP chip with verilog RTL code. 3. Design a Pseudo simulation model that can simulate the operation of RF chip with verilog RTL code.. 3.2 System Architecture Design To specify the WMAC chip from the functional and architectural point of view, to produce the detailed hardware specification of WMAC. The output from system architecture design stage will be a chip specification document outlining all the technical requirements. Having completed the document and had it agreed, this detailed analysis will take account of all or many of the following issues. Selecting a BBP chip and RF chip Pin assignment requirements Register set definition Simplified whole chip architecture is illustrated in Figure 3-2, which shows that all the building blocks for MAC. The MAC is designed to implement the timing critical and processing-intensive MAC functions, such as timing synchronization, CRC generation, RTS/CTS packet, etc. it coordinated with BBP through MMI interface. The WEP encryption/decryption is designed to implement the WEP function. The FIFO is a dual port memory device. With one port to the MAC, another to the 20.

(33) WEP decryption controller, MAC packets that are buffered in order to provide a time to initial the value of S-BOX before encrypting the ciphertext. Key In d ex Tab le 64 x 48 b its KEY Search Eng. WEP Decryp Register Sets. F IF O 128 Byt e. 802.11b MAC RX CTRL. CONF IG DATA. TX CTRL. WEP En cry p. RX P OR T. TX P OR T. MMI CTRL RF/IF CTRL BEACON Ctrl. MMI P OR T. R F /I F P OR T. Figure 3- 2 System architecture block diagram. 3.2.1 Chip Specification The features of designed MAC and WEP engine are as flows : 802.11 MAC IEEE 802.11, IEEE 802.11b MAC implements with State Machine No External SRAM needed Support Infrastructure AP, Station and IBSS under DCF RTS/CTS, Beacon, ACK detection/generation Support four MAC address (unicast) Support MMI Interface control for Intersil BBP. 21.

(34) Front end chip power sequence control. WEP Internal Encryption/Decryption engine for WEP function Support RC4, 40/104 bits key length selectable ICV generation and check Support 64-entry Key pointer table Individual Key search engine. 3.2.2 Chip Pin assignment I based on Intersil HFA3861B to define BBP interface signals, and based on Intersil HFA3683 chip to design the RF interface control signals. The boundary signals of chip are shows as Appendix A. There signals are partitioned into several parts: Group A : to RF Chip (HFA3683) Group B : to baseband processor (HFA3861B) Group C : to register sets Group D : to buffer management Group E : from buffer management Group F : from baseband processor (HFA3861B) Group G : from registers sets. 3.2.3 Sub-module partition Our proposed architecture for the IEEE 802.11b MAC functionality is illustrated in Figure 3-3. As shown in the figure, it includes five major module, the Receive module, Transmit module, RF Interface control module, Beacon control module and 22.

(35) Timing Sync Function (TSF) module. The MAC provides an embedded SSRAM for the storage of the beacon frame. Receive module handles the frame analysis, control the handshake between the MAC and Buffer Manager Interface. Transmit module generate the CTA and ACK frames in response to RTS and Data frame. Is also generate the RTS frame when the length of MPDU is longer than RTS-through. Timing Sync Function module maintain a 64-bits width timer. Beacon control module controls a 64x16 SSRAM to store beacon frame for transmission. RFIF interface module can access the registers of RF chip. Detail description on the functionality of there modules is listed below.. C o n fig /B u s. R eceiv e.v. B B P /IF. RXCLK. C o n fig /B u s. T sf.v. B B P /IF. C o n fig /B u s. TXCLK. T ran sm it.v. R fif.v. R F /IF. RFSYNCLK M acC lk. C o n fig /B u s. B cnctrl.v. SS R A M 64 x1 6.v. S y sC lk. Figure 3- 3 MAC Function Block Diagram. 23.

(36) Sub module hierarchical First step, In order to reduce the complexity of design, The WMAC will be partitioned into twenty-two sub-modules for implementation. The relation of sub-module is show in Figure 3-4. c h k p k t.v d a c rc 8 .v a d d rc h k .v. re c e iv e .v rx 1 .v v a lm p d u .v rx _ c o .v. c h s ta te .v fra m e c rc 8 .v. w m a c .v. rfif.v. m ic trl.v. ts f.v. m ito p .v rw b b p .v. tx _ p u m p .v. x m itte r.v. tx _ c o .v b a c k o ff.v. b c n c trl.v. ssra m 6 4 x 1 6 .v. rts p k t.v c ts p k t.v. a c k p k t.v. Figure 3- 4 Sub module hierarchical diagram. 3.3 DCF Implementation The implementation of a DCF mechanism is based on two process: transmit process and the receive process, each of which executes a number of functions to manage the outgoing or incoming frames. When we analyze the FSM of MAC on the basis of this IEEE 802.11 SDL system, we can notice that the hardware logic block should be generally limited in timing critical and processing-intensive functions.. 24.

(37) In these features, protocol control function for transmission and reception, CRC check, FCS check, Octet data transfer, CCA check, RTS/CTS/ACK frame, and back off mechanism are possible for the implement as hardware using Verilog.. 3.3.1 Receive. Receive Module module’s. pin. as. show. in. figure. 3-5.. Figure 3- 5 receive Module Interface This module is composed of eight sub-module, chkpkt, dcrc8, addrchk, rx1, valmpdu, chstate, rx_co, and framecrc8. Chkpkt module parses the contents of 802.11 frames. Dcrc8 is used to check the CRC value of received packet. addrchk module is used to filter the unicase or multicast address. Valmpdu handles the DIFS or EIFS timer. Chstate module handles the channel state, like IDLE or BUSY. 25.

(38) TX_CTS_REQ TX_ACK_REQ. BUSY. BUSY. SLOT. UseEifs UseDifs. RX_PE. rx _ co. ch state. CCA. RtsTimeOut. valmpdu. RTSPkt. RTSPkt. PktStart. PktEnd. DataPkt SA[47:0]. CTSPkt. ioRxD. ch k p k t. ACKPkt. ioRxRdy mcRxD. ioRxC. DA[47:0]. rx. MCMatch AddMatch. ad d rch k. CRC[7:0]. d acrc8. ByteLoad BadPkt Pktstart. mcRxD. PktEnd. FrameCrc[31:0]. framecrc8. Figure 3- 6 Receive Module Function Block Diagram. 3.3.1.1 chstate Module chstate module’s pin as show in figure 3-7, this module handles the channel state and NAV Timer. If BUSY signal is high, indicate the channel is BUSY. If BUSY signal is low, indicates the channel is IDLE. SLOT signal is a clock signal which period is 10us. It is used to back off module as a clock source, but it still only active on back off period. Its FSM flow chart is show in figure 3-8.. 26.

(39) c h sta te BUSY. S a d d r[4 7 : 0 ]. SLOT. D u ra t i o n [1 5 : 0 ]. C lk1U sS tb. A ddM a tc h P k tS ta rt P ktEnd R TSPkt SaLoad R tsTim e O ut PhyC ca U s e D ifs U s e E ifs changeNAV C FEndPkt C FEndAckPkt c fD IF S [1 5 :0 ] c fE IF S [1 5 :0 ] C lk1U s M a c C lk R eset. Figure 3- 7 chstate Module Interface. IDL E _ S T BUSY. noC S _noNAV. PhyCca. C S_ n o N AV !PhyCca. BUSY. noCS_noNAV_P. TslotDone. TifsDone. W AIT _ IFS. C LEAR _S LOT SLOT. B USY. SetNav. SetNav. SetNav. C S_ NA V. n o C S _ NA V. B USY. BUSY. PhyCca TnavDone. !PhyCca. Figure 3- 8 chstate Module state machine flow chart. 27. TnavDone.

(40) 3.3.1.2 valmpdu Module valmpdu module’s pin assignments as show in figure 3-9. It decide the inter frame gap of response packet. When MAC receives a good packet from BBP, it asserts the UseDifs signal. When MAC receive a bad packet (CRC error, No Ack) from BBP. It assert UseEifs signal. Its FSM Flow Chart can be seen in Figure 3-10. valmpdu R t sTi me Out. Byt e Cnt [11: 0] c fMa xP kt Le n[11: 0]. Use Ei fs. RTS P kt. Use Di fs. Ba dP kt ma c F ra me S t r P kt End c fP a ssBa d Cl k1UsS t b Ma c C l k Re se t. Figure 3- 9 valmpdu Module Interface. IDLE UseDifs. PktEnd. macFrameStr. RX_ FRAME. macFrameStr. UseDifs ((ByteCnt[11:0]==cfMaxPktLen) | (PktEnd & BadPkt))& !cfPassBad. TrtsTimeOut. PktEnd & !BadPkt & RTSPkt. RX_ ERR. WAIT_ RTS. UseEifs. UseDifs. 28.

(41) Figure 3- 10 valmpdu Module state machine flow chart. 3.3.1.3 rx_co Module Its pin assignment is shown in Figure 3-11, it use TX_ACK_REQ signal to indicate to tx_pump module when an ACK packet is need to be response for sender. It uses TX_CTS_REQ signal to indicate to tx_pump module when a CTS packet is need to be response for sender. RX_PE signal is used to active the receiving function of BBP. RxDuration is used to update NAV timer. The flow chart for Finite State Machine is shown in Figure 3-12. The initial state is IDLE state. When rx module report a PktEnd (packet end), if its frame type is RTS packet or DATA packet. The FSM will entry the WAIT_SIFS state and wait a SIFS time. Then FSM will entry the TX_ACK or TX_CTS state to generate TX_ACK_REQ or TX_CTS_REQ signal to transmit module. Figure 3-12 shows the flow chart of FSM.. rx_co R x D u ra t i o n [1 5 : 0 ]. TX_P E B US Y. TX_AC K_R EQ. Ne e dAc k. TX_C TS _R EQ. R TS P kt. R X_P E. TxDone P ktEnd P k t S t a rt P ktEnd B yte Loa d D u ra t i o n [1 5 : 0 ] Ma c Clk R e se t. Figure 3- 11 rx_co Module Interface. 29.

(42) ID L E. P ktEnd & (Ne e dAc k | R TS P kt). P ktS ta rt. W A IT _ S IF S S ifsDone & Ac kF la g. TxDone. S ifsDone & R tsF la g. C lea rR X _P E. TX_AC K. TX_CTS. TX _A C K _R EQ. TX _C TS _R EQ. TxDone. Figure 3- 12 rx_co Module state machine flow chart. 3.3.1.4 chkpkt Module Its pin assignment is shown in Figure 3-13. This module is used to identify the type of packet. Such as PS-Poll, RTS, CTS, ACK and Beacon packet. It also extracts header data from packet for another module to use, such as Destination address, Source address, Duration, Beacon interval, listen interval and Timestamp.. 30.

(43) c h k p k t P S P o l l P k t. m c P k t L e n [1 1 : 0 ]. R T S P k t. B y t e C n t [1 1 : 0 ]. C T S P k t. R x D [7 : 0 ]. A C K P k t. P k t S t a rt. C F E n d P k t. P k t E n d. B e a c o n P k t. B y t e L o a d. P ro b e R e q P k t P ro b e R p s P k t. B a d P k t. A s s R e q P k t. P L C P E n. A s s R p s P k t. R S V P S t b. R e A s s R e q P k t R e A s s R p s P k t D a t a P k t. M a c C l k. Is W. R e s e t. E P. D a d d r[4 7 : 0 ] S a d d r[4 7 : 0 ] B S S ID [4 7 : 0 ] D a V a l i d D a L o a d S a L o a d D u ra t i o n [1 5 : 0 ] L i s t e n In t [1 5 : 0 ] B e a c o n In t [1 5 : 0 ] A ID [1 5 : 0 ] T i m e S t a m p [6 3 : 0 ] W. e p Iv [2 3 : 0 ]. W e p K e y ID [1 : 0 ] m a c F ra m e S t a rt m a c F ra m e E n d. Figure 3- 13 chkpkt Module Interface. 3.3.2. Transmit Module. Its block diagram is shown in Figure 3-14. It is composed of rtspkt.v, ctspkt.v, ackpkt.v, mitop.v, tx_pump.v, tx_co.v, and backoff.v. Rtspkt.v provides a RTS packet for tx_pump.v to use. ctspkt.v provides a CTS packet for tx_pump.v to use. ackpkt.v provides a ACK packet for tx_pump.v to use.mitop is used to access the register of BBP chip. tx_pump.v is used to send MPDU to BBP chip. tx_co.v is used to generate request signal to tx_pump.v to active transmission function. Backoff.v is used to maintain random back off timer for DCF function.. 31.

(44) cfW rMmiReq. miSclk miRw miCs miSdOut miSdEn. mitop. cfRdMmiReq. TxRate. TxDone. TxByteCnt. TPWrReq. RTSTPDP. rt s p k t. TXD. RTSSF. TX_PE. CTSTPDP. ctsp k t. tx_pump. CTSSF. ACKTPDP. ackpkt. ACKSF. TxDone. txBeaconReq. txRtsReq. BUSY. txMpduReq. TBTTDone. tx_co. BEACONSF. BkDone. BackOffReq. b a c k o ff. Figure 3- 14 Transmit Module Function Block Diagram. 3.3.2.1 tx_co Module Its pin assignment is shown in Figure 3-15.. Figure 3- 15 tx_co Module Interface 32.

(45) Tx_co.v is used to generate request signal to tx_pump.v to active transmission function. We can control its operation through configuration register. Setting cfRtylimit value can limit the numbers of retry. CfCtsTimeOut and cfAckTimeOut value can set the time-out timer. WMAC will generate a TPAB signal to abort current transmission when time-out timer is expired.. 3.3.2.2 AckPkt Module Its pin assignment is shown in Figure 3-16. It uses input signals to construct an ACK packet for tx_pump to use. RXADDR represents the address of receiver. It uses ACKSF to indicate to tx_pump.v when it is ready for the transmission. TPDP is used to move data from ackpkt.v to tx_pump.v through ACKDATA [7:0] bus.. Figure 3- 16 ACKPkt Module Interface. 3.3.2.3 rtspkt Module Its pin assignment is shown in Figure 3-17. It uses input signals to construct a RTS packet for tx_pump to use. DAADDR represents the address of receiver. SAADDR represents the address of sender. It uses RTSSF to indicate to tx_pump.v when it is ready for the transmission. TPDP is used to move data from rtspkt.v to tx_pump.v through RTSDATA [7:0] bus. 33.

(46) Figure 3- 17 RTSPkt Module Interface. 3.3.2.4 ctspkt Module Its pin assignment is shown in Figure 3-18. It uses input signals to construct a CTS packet for tx_pump to use. RAADDR represents the address of receiver. It uses CTSSF to indicate to tx_pump.v when it is ready for the transmission. TPDP is used to move data from ctspkt.v to tx_pump.v through CTSDATA [7:0] bus.. Figure 3- 18 CTSPkt Module Interface. 34.

(47) 3.3.2.5 back off Module Its pin assignment is shown in Figure 3-19. This module performs the back off algorithm of DCF. It can generate a random back off period for an additional deferral time before transmitting. Slot Time is a clock signal which period are 20 us. CW(Content Window) is an integer within the range of values of BBP characteristics aCWmin and aCWmax, aCWmin <= CW <= aCWmax.. Figure 3- 19 back off Module Interface. 3.3.3. Time Stamp Module. Its pin assignment is shown in Figure 3-20. This module maintains a copy of the timing synchronization function (TSF), which is a local timer synchronized with the TSF of every other station in the basic service area. The TSF is based on a 1 MHz clock. In BSS station mode. Station saves the timestamp from the beacon or probe response. The received timestamp updates the local timer only if it is later than the local timer. When the local timer reaches the Beacon Interval (BeaconInt[15:0]). TBTTDone signal will be asserted. In BSS AP mode. When the local timer reaches the Beacon Period (cfBP [15:0]). TBTTDone signal will be asserted.. 35.

(48) tsf R xTi me S t a mp[63: 0] Ti me S t a mp[63: 0] TB TTDone. B e a c onInt [15: 0]. C l k1Us. P robe R psP kt B e a c onP kt B S S ID_Ma t c h P kt End c fTOF S R [7: 0] c fB P [15: 0] c fTB TTC [9: 0] c fOP MODE Ma c C l k R e se t. Figure 3- 20 tsf Module Interface. 3.3.4. Beacon Control Module Beacon packet announces the existence of network and important information. of station. It is transmitted at beacon interval and it allows other stations to find and to come to synchronization.. Not all of the fields are present in all beacons. Optional. fields are present only when there is a reason for them to be used.. So Host CPU. must fill appropriate value to there field before transmit. As a broadcast message, a beacon is not acknowledged so that the invocation of beacon generation function may be delayed due to ongoing transmission at the TBTT, subsequent beacons shall be scheduled at the next TBTT. In this thesis, we designed an embedded beacon SSRAM to store beacon packets and designed a beacon control circuit to load the data from beacon SSRAM on the fly. This machine can reduce the overhead of moving data from Host to MAC. Beacon control module controls the operation of reading or writing beacon packet. Its pin assignment is shown in Figure 3-21. When host want to write beacon 36.

(49) data into Beacon RAM. It follows below steps. Step 1: Setting the start address of data area using cfTabAddrWrN and cfTableAddr signal. Step 2: Load the payload data into Beacon RAM using cfTabDataWrN and cfTableAddr signal. Step 3: When all data are stored in beacon RAM. Host will set the cfbecOwn to inform WMAC to access Beacon RAM. Step 4: WMAC load payload data with TPDP signal when TBTTDone is asserted. Step 5: When all data are transmitted by WMAC. WMAC will clear the bcnClrOwn to inform Host to access Beacon RAM.. bcnctrl bc R a mDa t a [15: 0]. bc nTP S F. c fbe c Own. bc nTP EF bc nTP D[7: 0]. c fbe c Cnt [6: 0] c fTa bl e W r. bc n2R a mAddr[5: 0]. c fTa bl e Rd. bc n2Ra mW rN bc nCl rOwn. c fTa bl e Addr[5: 0]. bc nUpdDa t a c fTa bAddrW rN Dre gDa t a [31: 0] c fTa bDa t a W rN c fTa bDa t a RdN S ysCl k Ma c C l k Re se t. Figure 3- 21 bcnctrl Module Interface. 37.

(50) 3.4. WEP Algorithm Implementation In order to implement a wire-speeded WEP engine. We use two methods to. overcome the overhead of KSA operation. First, before transmit a packet to receiver, the BBP must send a preamble signal to receiver. So we can use this time to run KSA function to initial the content of S-BOX RAM at encryption operation. If we select a long PLCP preamble, this time is 196 us (preamble + header). If we select a short PLCP preamble, this time is 96 us (preamble+header). The KSA procedure will consume 1536 (256 + 5x256) system clock. If the system clock is 44 MHz. So its total process time is 1536 x 22.7 ns = 34.867 us . It is less than short PLCP preamble time (96 us). In PRGA phase, the PRGA engine will consume 4-system clock to deal with one data byte. This time is 4 x 22.7ns = 90.8ns. It is less than 148 ns (transfer time of one data byte at 54Mbps throughput). So we can guarantee this design can come to wire-speed throughput at encryption operation. There timing relation is shown in figure 3-22. Start to transmit. Start to load. PLCP Preamb le (72 b its) 72 us. PLCP Header (48 b its). PSDU. 24 us. W EP KS A P e ri od = 34. 867 us. W EP P R GA P e ri od. Start to encrypt. Start to run KSA. Figure 3-22 WEP Encryption timing 38.

(51) Second, when receive a packet from BBP, WEP engine must run decryption operation. We can use a FIFO to recover the KSA time. The KSA time is 34.867 us at 44 MHz. The one byte transmit time is 8x18.5 ns = 148 ns at 802.11g (54Mbp), the FIFO depth = KSA time/ one byte transmit time. We can deduce that FIFO depth need 34867ns/148 ns = 235.6. So we can adopt a 256 Byte FIFO RAM to recovery the KSA time at decryption operation. Its operation flow is shown in figure 3-23.. Cipher text Plaintext. RC4 Engine. FIFO SSRAM (256 Bytes). S-BOX SSRAM (256 Byte). Key[127:0]. Figure 3-23 WEP decryption flow. The RC4 engine pin assignment is shown in Figure 3-24.. 39. 802.11 MAC.

(52) Figure 3- 24 RC4 Module Interface. Its state machine can be seen in Figure 3-25. State “KSA_INIT” is used to initial S-Box S [I] RAM. State “KSA_SCRAMB”, “KSA_SCRAMB1”,. “KSA_SWAP”, “KSA_SWAP0” and. “KSA_SWAP1” are used to generate a pseudorandom sequence, and store their sequences into S-Box RAM State “PRGA” to state “OUTBYTESTB” are used to generate a pseudorandom key sequence to bitwise XORed with a block of plaintext.. 40.

(53) ID L E w e p S b o x W rN. P k t S t a rt. P R G A w e p S b o x W rN rc 4 P R G A P h a s e. K S A _ IN IT. IC o u n t e r = = 8 'h ff K S A _ S C R A M B. IN C J. w e p S b o x W rN rc 4 P R G A P h a s e. w e p S b o x W rN. S W A P IJ. K S A _ S C R A M B 1. rc 4 P R G A P h a s e. w e p S b o x W rN IC o u n t e r = = 8 'h ff. D a ta S tb. S W A P IJ1. K SA _ SW A P. rc 4 P R G A P h a s e. w e p S b o x W rN. O U T B Y T E w e p S b o x W rN rc 4 P R G A P h a s e. K S A _S W A P 0. O U T B Y T E S T B. K S A _S W A P 1. w e p S b o x W rN rc 4 P R G A P h a s e rc 4 B y t e S t b P k tE n d F la g. Figure 3- 25 RC4 state machine. 3.5 BBP Interface Implementation We based on Intersil HFA3861B to define BBP interface signal, this chip’s pin assignment is shown in Figure 3-26. Figure 3- 26. HFA3861B Pin Assignment Diagram. WMAC can access the registers of HFA3861B through SCLK, SD, RW and CS. 41.

(54) signals. SCLK is the clock for SD serial bus. The data on SD bus is clocked at rising edge. SD is a serial bidirectional data bus, which is used to transfer address and data to/form the internal registers. RW is an input to HFA3861B used to change the direction of the SD bus when reading or writing data on the SD bus. A high level indicates read while a low level is a write. CS is a Chip selects for the device to active the serial control port. The timing relationships of there signals are illustrated in Figure 3-27 and 3-28. The WMAC initials the transmit sequence by asserting TX_PE. TX_PE envelops the transmit data packet on TXD. The HFA3861B responds by generating preamble and PLCP header. Before the last bit of the header is sent, the HFA3861B begins generating the TXCLK to input the serial data on TXD. TX_RDY, which is an output from HFA3861B, is used to indicate to the WMAC that the preamble has been generated and the BBP is ready to receive the data packet to be transmitted from the WMAC. RXCLK is an output from the HFA3861B and is the clock for the serial demodulated data on RXD. MDRDY is an output from HFA3861B and it may set to go active after the SFD or CRC field. The timing relationships of there signals are illustrated in Figure 3-29 and 3-30.. Figure 3- 27. HFA3861B control port read timing. 42.

(55) Figure 3- 28 HFA3861B control port write timing. Figure 3- 29. HFA3861B TX port timing. Figure 3- 30 HFA3861B RX port timing. Mitop.v module is used to control the external BBP chip. It includes two sub-module, rwbbp.v and mictrl.v. The connection relationship of their sub-module is illustrated in Figure 3-31.. 43.

(56) Figure 3- 31 mitopModule Interface. The rwbbp.v module responds by calculating the packet length in us from TPLEN [11:0] signal before transmissing MPDU to BBP. This formula is shown below.. Length’ = ((number of octets + P) x 8) / R Length. = Ceiling (Length’). R. = Data rate in Mbit/s. P. = 0 for CCK, 1 for PBCC. Ceiling(X). = returns the smallest integer value greate than or equal to X.. Length extension bit. = 1 for (R=11) & Length-Length’) >= 8/11).. The rwbbp.v module also responds by calculating the packet byte count from the LENGTH field of PLCP header after receiving packet from BBP. This formula is shown below. 44.

(57) Number of octets. = Floor(((Length x R) /8) – P) – Length Extension bit.. R. = Data rate in Mbit/s. P. = 0 for CCK, 1 for PBCC. Floor(X). = returns the largest integer value less than or equal to X.. The example of LENGTH calculations under CCK mode is show as Table 3- 1 CCK at 11Mbit/s Tx octes. Octes. LENGTH Length. (x 8/11). LENGTH Floor (X). RX octets. extension (x 11/8) bit. 1023. 744. 744. 0. 1023. 1023. 1023. 1024. 744.7273. 745. 0. 1024.375. 1024. 1024. 1025. 745.4545. 746. 0. 1025.75. 1025. 1025. 1026. 746.1818. 747. 1. 1027.125. 1027. 1026. Table 3-1 Example of LENGTH calculations under CCK mode. The example of LENGTH calculations under PBCC mode is show as Table 3- 2. PBCC at 11Mbit/s TX octets Octets. LENGTH Length. (x 8/11). LENGTH Floor (X). RX octets. extension (x 11/8) bit. 1023. 744.7273. 745. 0. 1024.375. 1023. 1023. 1024. 745.4545. 746. 0. 1025.750. 1024. 1024. 1025. 746.1818. 747. 1. 1026.125. 1026. 1025. 45.

(58) 1026. 746.9091. 747. 0. 1026.125. 1026. 1026. Table 3- 2 Example of LENGTH calculations under PBCC mode. Its FSM Flow Chart can be seen in Figure 3-32. It accepts two types of request signals, TPWrReq and cfWrMmiReq. TPWrReq, which is an input from host interface. It is used to indicate to the rwbbp.v module that WMAC begins to request a packet transmission. CfWrMmiReq that is an input from host interface. It is used to indicate to the rwbbp.v module that Host begins to request to access the internal register of BBP chip. After the length of packet is calculated. Rwbbp.v initials the reading/writing request by asserting RdMmiReq or WrMmiReq signal to the mictrl.v module. Then mictrl.v responds by generating BBP chip control signals to write the internal register of BBP chip. There register is Length, Rate, and Service register. The format of PLCP header is shown in Figure 3-33. mictrl.v Module FSM Flow Chart can be seen in Figure 3-34.. 46.

(59) IDLE. cfWrMmiReq. TPWrReq. cfRdMmiReq. PktRssiReq. LENCAL. RDRSSI. MANUALR D. MANUALW R. RdMmiReq. RdMmiReq. WrMmiReq. CALEND. WRLENLO. miRdGnt. WrMmiReq. RDGNT. miRdGnt. mmiRdGnt. miWrGnt. WR LENHI WrMmiReq. miWrGnt. miWrGnt. WRRATE WrMmiReq. WRGNT. miWrGnt. mmiWrGnt. WRSEVC WrMmiReq. Figure 3- 32. rwbbp Module FSM flow chart. Figure 3-33 PLCP Header. 47.

(60) ID L E m iC s. R d M m i R e q | W rM m iR e q. ADDR0. ADDR1. ADDR2 m iS c l k. RDATA0. (B it C o u n t [2 : 0 ]= = 3 'h 7 ) & R d M m iR e q. (B it C o u n t [2 : 0 ]= = 3 'h 7 ) & W rM m iR e q. ADDR3. WDATA0. m iS c l k. m iR w. RDATA1. WDATA1. m iR w. RDATA2. WDATA2. m iS c lk m iR w. m i S c lk. RDATA3. WDATA3. m iS c lk m iR w. m i S c lk. B it C o u n t [2 : 0 ]= = 3 'h 7. B i t C o u n t[2 : 0 ]= = 3 'h 7. RDGNT. WRGNT. m iC s m iR d G n t. m iC s m i W rG n t. Figure 3- 34 The Flow Chart of mictrl Module FSM. 3.6 RF Interface Implementation We based on Intersil HFA3683 chip to design the RF interface control signal. Its Pin Assignment can be seen in Figure 3-35.. 48.

(61) Figure 3- 35 HFA3683A Pin Assignment. WMAC can access the internal registers of HFA3683A through CLOCK, DATA and LE signals. CLOCK is the clock for DATA serial bus. The data on DATA bus is clocked at rising edge. DATA is a serial data bus, which is used to transfer address and data to the internal registers of HFA3683A chip. LE is synthesizer latch enable; the serial interface is active when LE is Low level. And the serial is latched into the defined registers on the rising edge of LE. The timing relationships of there signals are illustrated in Figure 3-36.. 49.

(62) Figure 3- 36. HFA3683A serial data input timing. The definition of internal registers is list in table 3-3.. Table 3- 3 Register definition of HFA 3683A 50.

(63) Rfif.v module is used to control the operation of external RF chip. It includes two state machines, RFIFSM0 and RFIFSM1.Its Pin Assignment is shown in Figure 3-37. And flow chart is shown in Figure 3-38, 3-39. RFIFSM0 responds for generating RFTXPE signal to active the transmit circuit of RF chip. RFIFSM1 responds for generating RFSYNCLK and RFLE signal to write the register of HFA3683A. RFSYNCLK is the clock for RFSYNDATA serial bus. The data on RFSYNDATA bus is clocked at rising edge. When RFLE is low and the serial data is latched into defined register on the rising edge of RFLE.. Figure 3- 37. rfif Module Pin Assignment. 51.

(64) RXIFFSM0 RFRXPE & TPStart & ~BUSY & ~cfManual. IDLE. ~RFRXPE & TPStart & ~BUSY & ~cfManual. RXPELOW. Pe2TxPeTimeOut. WAITEND. TPLastBit. TXPEHI Ldb2TxPeTimeOut. Figure 3- 38 rfif module FSM flow chart (0) RXIFFSM1 RDIDLE. cfSynWrReq RFCLKHI. RFCLKLOW. RFSYNCLK. BitCount != 0 BitCount == 0. RFLELOW. RFLEHI RFLE RFWrGnt. Figure 3- 39 rfif module FSM flow chart(1). 52.

(65) Chapter 4 Function Simulation and Verification 4.1 802.11 MAC Simulation Environment and Test Plan For the function verification, we developed two pseudo-models to simulate the operation of physical BBP chip and RF chip. Figure 4-1 shows the Simulation environment. It consists of three components, a test bench, a wmac.v, and two simulation models; BBP.v and BBPMAC.v. In test bench, Initial is used to setup initial value of Simulation environment. Testing task be used to control the testing pattern generator. BBPMAC.v is a pseudo Wireless MAC model. It can accept the 802.11 protocols from WMAC.v, and response it. Or it can generate some 802.11 packets to test WMAV.v how to handle the protocol. Its Pin Assignment can be seen in Figure 4-2. It includes two major modules, the Receive module and Transmit module. Figure 4-3 show the flow of checking received frame from WMAC . It can analyze the received packets from WMAC and response with correct packets, such as CTS, ACK packets. Or we can setup BBPMAC.v to ignore some fields of received packets from WMAC. This function can test the WMAC how to deal with protocol error. Figure 4-4 show the flow of generating a frame to test WMAC function. These frames include data packets, RTS packets or beacon packets. BBP.v is a pseudo BBP register model. It can accept the register read/write command from WMAC.v and response it with a correct value.. 53.

(66) Simulation Model Test Bench. SD. BBP.v. S C LK. Testing Task. RW_ CS_. WMAC.v B B P / IF TXC LK. BBPMAC.v. R XC LK. Initial. Ini t va l ue. Figure 4- 1 Testing Environment. TXC. PktInitData. RXC. PktNumbers. RXD. PktGap. RX_PE. BadCrcEn. TXRDY. PktDuration. MDRDY. BeaconInterval. CCA. NoAckEn. TXD. NoCtsEn. TX_PE PktLen. BBPMAC.v. WepEn WepKey. PktDA[47:0]. WepIV. PktSA[47:0]. BeaconPkt. BSSID[47:0]. ProbePkt. Addr4[47:0]. RTSPkt ATIMPkt PktSpeed SysClk N_RST. Figure 4-2 Pin Assignment of BBPMAC.v. 54.

(67) Get Packet from MAC. Check CRC. Check Frame type. Control Frame. Management Frame. Data Frame. RTS. TX CTS. TX ACK. Display. Figure 4-3 Receive function of BBPMAC.v. Read Configuration. Check Frame type. Beacon. RTS. ATIM. Probe. Fill TX Buffer. TX Process. CRC-32 Generation. Append CRC-32. Figure 4-4 Transmit function of BBPMAC.v 55.

(68) The Test plan is list in table 4-1. I divide it into five testing group. DCF Receive, which is used to verify the receive function of DCF DCF Transmit, which is used to verify the transmission function of DCF. BBP control group, which is used to verify the BBP control function. RF control group, which is used to verify the RF control function. WEP control group, which is used to verify WEP function.. Function. Case. DCF Receive Receiving. Condition a. Target. Remark. MPDU DA == Network address. Response a ACK packet 4.2.1. a. RTS DA == Network address. Response a CTS packet 4.2.2. a. RTS DA != Network address Setup NAV. Packet Receiving Packet Receiving. 4.2.3. Packet Receive. a. beacon In infrastructure station Setup TBTT timer. packet. 4.2.4. mode. DCF Transmit Transmitting a MPDU DA = Receiver’s network Receiving a ACK packet 4.3.1 Packet. address. Transmitting a MPDU Using RTS Mechanism. Receiving a CTS packet 4.3.2. Packet (using RTS). and ACK packet. Transmitting a MPDU 1.. Retry limit = 3. 1.. Retry three times. Packet (Retry/Abort). No ACK. 2.. Abort this MPDU. 2.. Transmitting a MPDU Channel is busy. Start. Packet (back off). mechanism. 56. back. 4.3.3. off 4.3.4.

(69) Transmitting a MPDU DA = Multicast address Packet. Don’t wait ACK packet 4.3.5. (Multicast. address) Transmitting a Beacon DA = Multicast address. Don’t wait ACK packet 4.3.6. Packet BBP Control. RF Control. WEP. BBP register read. 4.4.1. BBP register write. 4.4.2. 1.. RF control signal. 2.. Register write. Auto/manual. 4.5. RC4 algorithm. 4.6.1. Encryption. 4.6.2. Table 4-1 Test Plan. 4.2 DCF Receive Function Verification 4.2.1. Receive a DATA (DA==Network Address) packet. The testing Case is used to verify the receive function. Its waveform is shown in Figure 4-5. First, BBPMAC.v uses MDRDY signal to indicate to WMAC when a MPDU is send. WMAC will response an ACK Packet to BBPMAC when this packet didn’t any error.. 57.

(70) Figure 4 – 5 Receive a DATA packet 4.2.2. Receive a RTS. (DA==Network Address) packet. This testing case is used to verify the function that WMAC receive a RTS packet. Its waveform is shown in Figure 4-6. First, BBPMAC.v generate a RTS packet to WMAC. Chkpkt module will parse this packet. If its type is RTS, and its destination address is the same as local address. Then NAV timer can’t be set. The WMAC replies with a CTS packet after the SIFS time.. Figure 4 – 6 Receive a RTS packet (DA = Network Address). 58.

(71) 4.2.3 NAV Timer This testing case is used to verify the NAV timer function. Its waveform is shown in Figure 4-7. First, BBPMAC.v generate a RTS packet to WMAC. Chkpkt module will parse this packet. If its type is RTS, and its destination address is not local address. Then NAV timer will be set. The BUSY signal is asserted before timer comes down to zero. During this period, WMAC didn’t allow send any packet to channel.. Figure 4 – 7 Receive a RTS packet (DA != Network Address). 4.2.4 Receive a Beacon packet in BSS mode. This testing case is used to verify the function when WMAC receive a beacon packet in BSS mode. Its waveform is shown in Figure 4-8. First, BBPMAC.v generate a beacon packet, which BSSID belong to the BSS network. Chkpkt module parses this packet. If its timestamp great than the TSF timer of local. Then update the TSF timer using timestamp value.. 59.

(72) Figure 4 – 8 Receive a Beacon packet in BSS station mode. 4.3 DCF Transmission Function Verification 4.3.1. Transmit a Data Packet. This testing case is used to verify the function when a MPDU want to transmit. Its waveform is shown in Figure 4-9. First, BM use TPSF signal to indicate to the WMAC when a MPDU want to transmit. Then WMAC use macTPDP to load data from BM. State machine entry to IDLE state after receiving an ACK packet.. Figure 4 – 9 Transmit a DATA Packet 60.

(73) 4.3.2. Transmit a Data Packet using RTS Mechanism. This testing Case is used to verify the transmit function when the packet. length of MPDU great than RTS threshold, MAC must be reserved the channel with RTS Packet. Then MAC must be waiting for the CTS packet that receiver response before transmit the MPDU packet. After all MPDU packets have transfer to receiver. MAC still wants to wait for the ACK packet that receiver response. In Figure 4-10, We can observe that BM assert the TPSF to request MAC to transmit a MPDU packet, but the packet length of MPDU is great than RTS threshold, So first, State Machine entry to RTSREQ state, assert the txRtsReq to request MAC to transmit a RTS packet. When BM receives the load signal “macTPDP”, BM will cleat the TPSF to Low. Second, State Machine wills entry to WAITCTS state after the RTS packet transfer completed. Third, State Machine will entry to MPDUREQ state when receiving CTS packet from receiver. Finally, MAC asserts the txMpduReq to transmit MPDU. And go back to IDLE state to wait the next transfer after receiving ACK packet from receiver.. Figure 4 – 10 Transmit a Data Packet using RTS Mechanism. 61.

(74) 4.3.3. Abort the transmitted packet when lose ACK packet This test Case is used to verify the transmit function when receiver didn’t. response ACK packet. Its waveform is show in Figure 4-11. First, BM asserts the TPSF to request MAC to transmit a MPDU packet, but receiver didn’t response ACK packet. So WMAC asserts TPRT to request BM to re-transmit MPDU. Second, BM repeats above process, but receiver still didn’t response ACK packet. The retry count great than retry limitation, so WMAC asserts the TPAB to request BM to abort this transmission.. Figure 4 – 11 Abort the transmitted packet when lose ACK packet. 4.3.4. Re-transmit a packet when channel is BUSY This test case is used to verify the re-transmission function when channel state. is BUSY. Its waveform is show in Figure 4-12. First, BM asserts TPSF to request WMAC to transmit MPDU, but WMAC detect a BUSY in channel. So WMAC stop this transmission until channel change to IDLE. Then state machine will entry to BKOFFREQ state and sending this packet after waiting a random back off time.. 62.

(75) Figure 4 – 12 Re-transmit a packet when channel is BUSY. 4.3.5 Transmit a Multicast packet This test case is used to verify the transmit function when destination address of MPDU is multicast. Its waveform is show in Figure 4-13. First, BM asserts TPSF to request WMAC to transmit a MPDU, but the destination address of MPDU is multicast, so the state machine will entry into IDLE state after transmission. Not waiting for the response ACK packet.. Figure 4 – 13 Transmit a Multicast packet 63.