1 /* $OpenBSD: if_iwm.c,v 1.39 2015/03/23 00:35:19 jsg Exp $ */ 2 3 /* 4 * Copyright (c) 2014 genua mbh <info@genua.de> 5 * Copyright (c) 2014 Fixup Software Ltd. 6 * 7 * Permission to use, copy, modify, and distribute this software for any 8 * purpose with or without fee is hereby granted, provided that the above 9 * copyright notice and this permission notice appear in all copies. 10 * 11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 18 */ 19 20 /*- 21 * Based on BSD-licensed source modules in the Linux iwlwifi driver, 22 * which were used as the reference documentation for this implementation. 23 * 24 * Driver version we are currently based off of is 25 * Linux 3.14.3 (tag id a2df521e42b1d9a23f620ac79dbfe8655a8391dd) 26 * 27 *********************************************************************** 28 * 29 * This file is provided under a dual BSD/GPLv2 license. When using or 30 * redistributing this file, you may do so under either license. 31 * 32 * GPL LICENSE SUMMARY 33 * 34 * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved. 35 * 36 * This program is free software; you can redistribute it and/or modify 37 * it under the terms of version 2 of the GNU General Public License as 38 * published by the Free Software Foundation. 39 * 40 * This program is distributed in the hope that it will be useful, but 41 * WITHOUT ANY WARRANTY; without even the implied warranty of 42 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 43 * General Public License for more details. 44 * 45 * You should have received a copy of the GNU General Public License 46 * along with this program; if not, write to the Free Software 47 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110, 48 * USA 49 * 50 * The full GNU General Public License is included in this distribution 51 * in the file called COPYING. 52 * 53 * Contact Information: 54 * Intel Linux Wireless <ilw@linux.intel.com> 55 * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497 56 * 57 * 58 * BSD LICENSE 59 * 60 * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved. 61 * All rights reserved. 62 * 63 * Redistribution and use in source and binary forms, with or without 64 * modification, are permitted provided that the following conditions 65 * are met: 66 * 67 * * Redistributions of source code must retain the above copyright 68 * notice, this list of conditions and the following disclaimer. 69 * * Redistributions in binary form must reproduce the above copyright 70 * notice, this list of conditions and the following disclaimer in 71 * the documentation and/or other materials provided with the 72 * distribution. 73 * * Neither the name Intel Corporation nor the names of its 74 * contributors may be used to endorse or promote products derived 75 * from this software without specific prior written permission. 76 * 77 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 78 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 79 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 80 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 81 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 82 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 83 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 84 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 85 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 86 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 87 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 88 */ 89 90 /*- 91 * Copyright (c) 2007-2010 Damien Bergamini <damien.bergamini@free.fr> 92 * 93 * Permission to use, copy, modify, and distribute this software for any 94 * purpose with or without fee is hereby granted, provided that the above 95 * copyright notice and this permission notice appear in all copies. 96 * 97 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 98 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 99 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 100 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 101 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 102 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 103 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 104 */ 105 #include <sys/cdefs.h> 106 __FBSDID("$FreeBSD$"); 107 108 #include <sys/param.h> 109 #include <sys/bus.h> 110 #include <sys/conf.h> 111 #include <sys/endian.h> 112 #include <sys/firmware.h> 113 #include <sys/kernel.h> 114 #include <sys/malloc.h> 115 #include <sys/mbuf.h> 116 #include <sys/mutex.h> 117 #include <sys/module.h> 118 #include <sys/proc.h> 119 #include <sys/rman.h> 120 #include <sys/socket.h> 121 #include <sys/sockio.h> 122 #include <sys/sysctl.h> 123 #include <sys/linker.h> 124 125 #include <machine/bus.h> 126 #include <machine/endian.h> 127 #include <machine/resource.h> 128 129 #include <dev/pci/pcivar.h> 130 #include <dev/pci/pcireg.h> 131 132 #include <net/bpf.h> 133 134 #include <net/if.h> 135 #include <net/if_var.h> 136 #include <net/if_arp.h> 137 #include <net/if_dl.h> 138 #include <net/if_media.h> 139 #include <net/if_types.h> 140 141 #include <netinet/in.h> 142 #include <netinet/in_systm.h> 143 #include <netinet/if_ether.h> 144 #include <netinet/ip.h> 145 146 #include <net80211/ieee80211_var.h> 147 #include <net80211/ieee80211_regdomain.h> 148 #include <net80211/ieee80211_ratectl.h> 149 #include <net80211/ieee80211_radiotap.h> 150 151 #include <dev/iwm/if_iwmreg.h> 152 #include <dev/iwm/if_iwmvar.h> 153 #include <dev/iwm/if_iwm_debug.h> 154 #include <dev/iwm/if_iwm_util.h> 155 #include <dev/iwm/if_iwm_binding.h> 156 #include <dev/iwm/if_iwm_phy_db.h> 157 #include <dev/iwm/if_iwm_mac_ctxt.h> 158 #include <dev/iwm/if_iwm_phy_ctxt.h> 159 #include <dev/iwm/if_iwm_time_event.h> 160 #include <dev/iwm/if_iwm_power.h> 161 #include <dev/iwm/if_iwm_scan.h> 162 163 #include <dev/iwm/if_iwm_pcie_trans.h> 164 165 const uint8_t iwm_nvm_channels[] = { 166 /* 2.4 GHz */ 167 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 168 /* 5 GHz */ 169 36, 40, 44 , 48, 52, 56, 60, 64, 170 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144, 171 149, 153, 157, 161, 165 172 }; 173 #define IWM_NUM_2GHZ_CHANNELS 14 174 175 /* 176 * XXX For now, there's simply a fixed set of rate table entries 177 * that are populated. 178 */ 179 const struct iwm_rate { 180 uint8_t rate; 181 uint8_t plcp; 182 } iwm_rates[] = { 183 { 2, IWM_RATE_1M_PLCP }, 184 { 4, IWM_RATE_2M_PLCP }, 185 { 11, IWM_RATE_5M_PLCP }, 186 { 22, IWM_RATE_11M_PLCP }, 187 { 12, IWM_RATE_6M_PLCP }, 188 { 18, IWM_RATE_9M_PLCP }, 189 { 24, IWM_RATE_12M_PLCP }, 190 { 36, IWM_RATE_18M_PLCP }, 191 { 48, IWM_RATE_24M_PLCP }, 192 { 72, IWM_RATE_36M_PLCP }, 193 { 96, IWM_RATE_48M_PLCP }, 194 { 108, IWM_RATE_54M_PLCP }, 195 }; 196 #define IWM_RIDX_CCK 0 197 #define IWM_RIDX_OFDM 4 198 #define IWM_RIDX_MAX (nitems(iwm_rates)-1) 199 #define IWM_RIDX_IS_CCK(_i_) ((_i_) < IWM_RIDX_OFDM) 200 #define IWM_RIDX_IS_OFDM(_i_) ((_i_) >= IWM_RIDX_OFDM) 201 202 static int iwm_store_cscheme(struct iwm_softc *, const uint8_t *, size_t); 203 static int iwm_firmware_store_section(struct iwm_softc *, 204 enum iwm_ucode_type, 205 const uint8_t *, size_t); 206 static int iwm_set_default_calib(struct iwm_softc *, const void *); 207 static void iwm_fw_info_free(struct iwm_fw_info *); 208 static int iwm_read_firmware(struct iwm_softc *, enum iwm_ucode_type); 209 static void iwm_dma_map_addr(void *, bus_dma_segment_t *, int, int); 210 static int iwm_dma_contig_alloc(bus_dma_tag_t, struct iwm_dma_info *, 211 bus_size_t, bus_size_t); 212 static void iwm_dma_contig_free(struct iwm_dma_info *); 213 static int iwm_alloc_fwmem(struct iwm_softc *); 214 static void iwm_free_fwmem(struct iwm_softc *); 215 static int iwm_alloc_sched(struct iwm_softc *); 216 static void iwm_free_sched(struct iwm_softc *); 217 static int iwm_alloc_kw(struct iwm_softc *); 218 static void iwm_free_kw(struct iwm_softc *); 219 static int iwm_alloc_ict(struct iwm_softc *); 220 static void iwm_free_ict(struct iwm_softc *); 221 static int iwm_alloc_rx_ring(struct iwm_softc *, struct iwm_rx_ring *); 222 static void iwm_reset_rx_ring(struct iwm_softc *, struct iwm_rx_ring *); 223 static void iwm_free_rx_ring(struct iwm_softc *, struct iwm_rx_ring *); 224 static int iwm_alloc_tx_ring(struct iwm_softc *, struct iwm_tx_ring *, 225 int); 226 static void iwm_reset_tx_ring(struct iwm_softc *, struct iwm_tx_ring *); 227 static void iwm_free_tx_ring(struct iwm_softc *, struct iwm_tx_ring *); 228 static void iwm_enable_interrupts(struct iwm_softc *); 229 static void iwm_restore_interrupts(struct iwm_softc *); 230 static void iwm_disable_interrupts(struct iwm_softc *); 231 static void iwm_ict_reset(struct iwm_softc *); 232 static int iwm_allow_mcast(struct ieee80211vap *, struct iwm_softc *); 233 static void iwm_stop_device(struct iwm_softc *); 234 static void iwm_mvm_nic_config(struct iwm_softc *); 235 static int iwm_nic_rx_init(struct iwm_softc *); 236 static int iwm_nic_tx_init(struct iwm_softc *); 237 static int iwm_nic_init(struct iwm_softc *); 238 static void iwm_enable_txq(struct iwm_softc *, int, int); 239 static int iwm_post_alive(struct iwm_softc *); 240 static int iwm_nvm_read_chunk(struct iwm_softc *, uint16_t, uint16_t, 241 uint16_t, uint8_t *, uint16_t *); 242 static int iwm_nvm_read_section(struct iwm_softc *, uint16_t, uint8_t *, 243 uint16_t *); 244 static void iwm_init_channel_map(struct iwm_softc *, 245 const uint16_t * const); 246 static int iwm_parse_nvm_data(struct iwm_softc *, const uint16_t *, 247 const uint16_t *, const uint16_t *, uint8_t, 248 uint8_t); 249 struct iwm_nvm_section; 250 static int iwm_parse_nvm_sections(struct iwm_softc *, 251 struct iwm_nvm_section *); 252 static int iwm_nvm_init(struct iwm_softc *); 253 static int iwm_firmware_load_chunk(struct iwm_softc *, uint32_t, 254 const uint8_t *, uint32_t); 255 static int iwm_load_firmware(struct iwm_softc *, enum iwm_ucode_type); 256 static int iwm_start_fw(struct iwm_softc *, enum iwm_ucode_type); 257 static int iwm_fw_alive(struct iwm_softc *, uint32_t); 258 static int iwm_send_tx_ant_cfg(struct iwm_softc *, uint8_t); 259 static int iwm_send_phy_cfg_cmd(struct iwm_softc *); 260 static int iwm_mvm_load_ucode_wait_alive(struct iwm_softc *, 261 enum iwm_ucode_type); 262 static int iwm_run_init_mvm_ucode(struct iwm_softc *, int); 263 static int iwm_rx_addbuf(struct iwm_softc *, int, int); 264 static int iwm_mvm_calc_rssi(struct iwm_softc *, struct iwm_rx_phy_info *); 265 static int iwm_mvm_get_signal_strength(struct iwm_softc *, 266 struct iwm_rx_phy_info *); 267 static void iwm_mvm_rx_rx_phy_cmd(struct iwm_softc *, 268 struct iwm_rx_packet *, 269 struct iwm_rx_data *); 270 static int iwm_get_noise(const struct iwm_mvm_statistics_rx_non_phy *); 271 static void iwm_mvm_rx_rx_mpdu(struct iwm_softc *, struct iwm_rx_packet *, 272 struct iwm_rx_data *); 273 static void iwm_mvm_rx_tx_cmd_single(struct iwm_softc *, 274 struct iwm_rx_packet *, 275 struct iwm_node *); 276 static void iwm_mvm_rx_tx_cmd(struct iwm_softc *, struct iwm_rx_packet *, 277 struct iwm_rx_data *); 278 static void iwm_cmd_done(struct iwm_softc *, struct iwm_rx_packet *); 279 #if 0 280 static void iwm_update_sched(struct iwm_softc *, int, int, uint8_t, 281 uint16_t); 282 #endif 283 static const struct iwm_rate * 284 iwm_tx_fill_cmd(struct iwm_softc *, struct iwm_node *, 285 struct ieee80211_frame *, struct iwm_tx_cmd *); 286 static int iwm_tx(struct iwm_softc *, struct mbuf *, 287 struct ieee80211_node *, int); 288 static int iwm_raw_xmit(struct ieee80211_node *, struct mbuf *, 289 const struct ieee80211_bpf_params *); 290 static void iwm_mvm_add_sta_cmd_v6_to_v5(struct iwm_mvm_add_sta_cmd_v6 *, 291 struct iwm_mvm_add_sta_cmd_v5 *); 292 static int iwm_mvm_send_add_sta_cmd_status(struct iwm_softc *, 293 struct iwm_mvm_add_sta_cmd_v6 *, 294 int *); 295 static int iwm_mvm_sta_send_to_fw(struct iwm_softc *, struct iwm_node *, 296 int); 297 static int iwm_mvm_add_sta(struct iwm_softc *, struct iwm_node *); 298 static int iwm_mvm_update_sta(struct iwm_softc *, struct iwm_node *); 299 static int iwm_mvm_add_int_sta_common(struct iwm_softc *, 300 struct iwm_int_sta *, 301 const uint8_t *, uint16_t, uint16_t); 302 static int iwm_mvm_add_aux_sta(struct iwm_softc *); 303 static int iwm_mvm_update_quotas(struct iwm_softc *, struct iwm_node *); 304 static int iwm_auth(struct ieee80211vap *, struct iwm_softc *); 305 static int iwm_assoc(struct ieee80211vap *, struct iwm_softc *); 306 static int iwm_release(struct iwm_softc *, struct iwm_node *); 307 static struct ieee80211_node * 308 iwm_node_alloc(struct ieee80211vap *, 309 const uint8_t[IEEE80211_ADDR_LEN]); 310 static void iwm_setrates(struct iwm_softc *, struct iwm_node *); 311 static int iwm_media_change(struct ifnet *); 312 static int iwm_newstate(struct ieee80211vap *, enum ieee80211_state, int); 313 static void iwm_endscan_cb(void *, int); 314 static int iwm_init_hw(struct iwm_softc *); 315 static void iwm_init(struct iwm_softc *); 316 static void iwm_start(struct iwm_softc *); 317 static void iwm_stop(struct iwm_softc *); 318 static void iwm_watchdog(void *); 319 static void iwm_parent(struct ieee80211com *); 320 #ifdef IWM_DEBUG 321 static const char * 322 iwm_desc_lookup(uint32_t); 323 static void iwm_nic_error(struct iwm_softc *); 324 #endif 325 static void iwm_notif_intr(struct iwm_softc *); 326 static void iwm_intr(void *); 327 static int iwm_attach(device_t); 328 static void iwm_preinit(void *); 329 static int iwm_detach_local(struct iwm_softc *sc, int); 330 static void iwm_init_task(void *); 331 static void iwm_radiotap_attach(struct iwm_softc *); 332 static struct ieee80211vap * 333 iwm_vap_create(struct ieee80211com *, 334 const char [IFNAMSIZ], int, 335 enum ieee80211_opmode, int, 336 const uint8_t [IEEE80211_ADDR_LEN], 337 const uint8_t [IEEE80211_ADDR_LEN]); 338 static void iwm_vap_delete(struct ieee80211vap *); 339 static void iwm_scan_start(struct ieee80211com *); 340 static void iwm_scan_end(struct ieee80211com *); 341 static void iwm_update_mcast(struct ieee80211com *); 342 static void iwm_set_channel(struct ieee80211com *); 343 static void iwm_scan_curchan(struct ieee80211_scan_state *, unsigned long); 344 static void iwm_scan_mindwell(struct ieee80211_scan_state *); 345 static int iwm_detach(device_t); 346 347 /* 348 * Firmware parser. 349 */ 350 351 static int 352 iwm_store_cscheme(struct iwm_softc *sc, const uint8_t *data, size_t dlen) 353 { 354 const struct iwm_fw_cscheme_list *l = (const void *)data; 355 356 if (dlen < sizeof(*l) || 357 dlen < sizeof(l->size) + l->size * sizeof(*l->cs)) 358 return EINVAL; 359 360 /* we don't actually store anything for now, always use s/w crypto */ 361 362 return 0; 363 } 364 365 static int 366 iwm_firmware_store_section(struct iwm_softc *sc, 367 enum iwm_ucode_type type, const uint8_t *data, size_t dlen) 368 { 369 struct iwm_fw_sects *fws; 370 struct iwm_fw_onesect *fwone; 371 372 if (type >= IWM_UCODE_TYPE_MAX) 373 return EINVAL; 374 if (dlen < sizeof(uint32_t)) 375 return EINVAL; 376 377 fws = &sc->sc_fw.fw_sects[type]; 378 if (fws->fw_count >= IWM_UCODE_SECT_MAX) 379 return EINVAL; 380 381 fwone = &fws->fw_sect[fws->fw_count]; 382 383 /* first 32bit are device load offset */ 384 memcpy(&fwone->fws_devoff, data, sizeof(uint32_t)); 385 386 /* rest is data */ 387 fwone->fws_data = data + sizeof(uint32_t); 388 fwone->fws_len = dlen - sizeof(uint32_t); 389 390 fws->fw_count++; 391 fws->fw_totlen += fwone->fws_len; 392 393 return 0; 394 } 395 396 /* iwlwifi: iwl-drv.c */ 397 struct iwm_tlv_calib_data { 398 uint32_t ucode_type; 399 struct iwm_tlv_calib_ctrl calib; 400 } __packed; 401 402 static int 403 iwm_set_default_calib(struct iwm_softc *sc, const void *data) 404 { 405 const struct iwm_tlv_calib_data *def_calib = data; 406 uint32_t ucode_type = le32toh(def_calib->ucode_type); 407 408 if (ucode_type >= IWM_UCODE_TYPE_MAX) { 409 device_printf(sc->sc_dev, 410 "Wrong ucode_type %u for default " 411 "calibration.\n", ucode_type); 412 return EINVAL; 413 } 414 415 sc->sc_default_calib[ucode_type].flow_trigger = 416 def_calib->calib.flow_trigger; 417 sc->sc_default_calib[ucode_type].event_trigger = 418 def_calib->calib.event_trigger; 419 420 return 0; 421 } 422 423 static void 424 iwm_fw_info_free(struct iwm_fw_info *fw) 425 { 426 firmware_put(fw->fw_rawdata, FIRMWARE_UNLOAD); 427 fw->fw_rawdata = NULL; 428 fw->fw_rawsize = 0; 429 /* don't touch fw->fw_status */ 430 memset(fw->fw_sects, 0, sizeof(fw->fw_sects)); 431 } 432 433 static int 434 iwm_read_firmware(struct iwm_softc *sc, enum iwm_ucode_type ucode_type) 435 { 436 struct iwm_fw_info *fw = &sc->sc_fw; 437 const struct iwm_tlv_ucode_header *uhdr; 438 struct iwm_ucode_tlv tlv; 439 enum iwm_ucode_tlv_type tlv_type; 440 const struct firmware *fwp; 441 const uint8_t *data; 442 int error = 0; 443 size_t len; 444 445 if (fw->fw_status == IWM_FW_STATUS_DONE && 446 ucode_type != IWM_UCODE_TYPE_INIT) 447 return 0; 448 449 while (fw->fw_status == IWM_FW_STATUS_INPROGRESS) 450 msleep(&sc->sc_fw, &sc->sc_mtx, 0, "iwmfwp", 0); 451 fw->fw_status = IWM_FW_STATUS_INPROGRESS; 452 453 if (fw->fw_rawdata != NULL) 454 iwm_fw_info_free(fw); 455 456 /* 457 * Load firmware into driver memory. 458 * fw_rawdata and fw_rawsize will be set. 459 */ 460 IWM_UNLOCK(sc); 461 fwp = firmware_get(sc->sc_fwname); 462 if (fwp == NULL) { 463 device_printf(sc->sc_dev, 464 "could not read firmware %s (error %d)\n", 465 sc->sc_fwname, error); 466 IWM_LOCK(sc); 467 goto out; 468 } 469 IWM_LOCK(sc); 470 fw->fw_rawdata = fwp->data; 471 fw->fw_rawsize = fwp->datasize; 472 473 /* 474 * Parse firmware contents 475 */ 476 477 uhdr = (const void *)fw->fw_rawdata; 478 if (*(const uint32_t *)fw->fw_rawdata != 0 479 || le32toh(uhdr->magic) != IWM_TLV_UCODE_MAGIC) { 480 device_printf(sc->sc_dev, "invalid firmware %s\n", 481 sc->sc_fwname); 482 error = EINVAL; 483 goto out; 484 } 485 486 sc->sc_fwver = le32toh(uhdr->ver); 487 data = uhdr->data; 488 len = fw->fw_rawsize - sizeof(*uhdr); 489 490 while (len >= sizeof(tlv)) { 491 size_t tlv_len; 492 const void *tlv_data; 493 494 memcpy(&tlv, data, sizeof(tlv)); 495 tlv_len = le32toh(tlv.length); 496 tlv_type = le32toh(tlv.type); 497 498 len -= sizeof(tlv); 499 data += sizeof(tlv); 500 tlv_data = data; 501 502 if (len < tlv_len) { 503 device_printf(sc->sc_dev, 504 "firmware too short: %zu bytes\n", 505 len); 506 error = EINVAL; 507 goto parse_out; 508 } 509 510 switch ((int)tlv_type) { 511 case IWM_UCODE_TLV_PROBE_MAX_LEN: 512 if (tlv_len < sizeof(uint32_t)) { 513 device_printf(sc->sc_dev, 514 "%s: PROBE_MAX_LEN (%d) < sizeof(uint32_t)\n", 515 __func__, 516 (int) tlv_len); 517 error = EINVAL; 518 goto parse_out; 519 } 520 sc->sc_capa_max_probe_len 521 = le32toh(*(const uint32_t *)tlv_data); 522 /* limit it to something sensible */ 523 if (sc->sc_capa_max_probe_len > (1<<16)) { 524 IWM_DPRINTF(sc, IWM_DEBUG_FIRMWARE_TLV, 525 "%s: IWM_UCODE_TLV_PROBE_MAX_LEN " 526 "ridiculous\n", __func__); 527 error = EINVAL; 528 goto parse_out; 529 } 530 break; 531 case IWM_UCODE_TLV_PAN: 532 if (tlv_len) { 533 device_printf(sc->sc_dev, 534 "%s: IWM_UCODE_TLV_PAN: tlv_len (%d) > 0\n", 535 __func__, 536 (int) tlv_len); 537 error = EINVAL; 538 goto parse_out; 539 } 540 sc->sc_capaflags |= IWM_UCODE_TLV_FLAGS_PAN; 541 break; 542 case IWM_UCODE_TLV_FLAGS: 543 if (tlv_len < sizeof(uint32_t)) { 544 device_printf(sc->sc_dev, 545 "%s: IWM_UCODE_TLV_FLAGS: tlv_len (%d) < sizeof(uint32_t)\n", 546 __func__, 547 (int) tlv_len); 548 error = EINVAL; 549 goto parse_out; 550 } 551 /* 552 * Apparently there can be many flags, but Linux driver 553 * parses only the first one, and so do we. 554 * 555 * XXX: why does this override IWM_UCODE_TLV_PAN? 556 * Intentional or a bug? Observations from 557 * current firmware file: 558 * 1) TLV_PAN is parsed first 559 * 2) TLV_FLAGS contains TLV_FLAGS_PAN 560 * ==> this resets TLV_PAN to itself... hnnnk 561 */ 562 sc->sc_capaflags = le32toh(*(const uint32_t *)tlv_data); 563 break; 564 case IWM_UCODE_TLV_CSCHEME: 565 if ((error = iwm_store_cscheme(sc, 566 tlv_data, tlv_len)) != 0) { 567 device_printf(sc->sc_dev, 568 "%s: iwm_store_cscheme(): returned %d\n", 569 __func__, 570 error); 571 goto parse_out; 572 } 573 break; 574 case IWM_UCODE_TLV_NUM_OF_CPU: 575 if (tlv_len != sizeof(uint32_t)) { 576 device_printf(sc->sc_dev, 577 "%s: IWM_UCODE_TLV_NUM_OF_CPU: tlv_len (%d) < sizeof(uint32_t)\n", 578 __func__, 579 (int) tlv_len); 580 error = EINVAL; 581 goto parse_out; 582 } 583 if (le32toh(*(const uint32_t*)tlv_data) != 1) { 584 device_printf(sc->sc_dev, 585 "%s: driver supports " 586 "only TLV_NUM_OF_CPU == 1", 587 __func__); 588 error = EINVAL; 589 goto parse_out; 590 } 591 break; 592 case IWM_UCODE_TLV_SEC_RT: 593 if ((error = iwm_firmware_store_section(sc, 594 IWM_UCODE_TYPE_REGULAR, tlv_data, tlv_len)) != 0) { 595 device_printf(sc->sc_dev, 596 "%s: IWM_UCODE_TYPE_REGULAR: iwm_firmware_store_section() failed; %d\n", 597 __func__, 598 error); 599 goto parse_out; 600 } 601 break; 602 case IWM_UCODE_TLV_SEC_INIT: 603 if ((error = iwm_firmware_store_section(sc, 604 IWM_UCODE_TYPE_INIT, tlv_data, tlv_len)) != 0) { 605 device_printf(sc->sc_dev, 606 "%s: IWM_UCODE_TYPE_INIT: iwm_firmware_store_section() failed; %d\n", 607 __func__, 608 error); 609 goto parse_out; 610 } 611 break; 612 case IWM_UCODE_TLV_SEC_WOWLAN: 613 if ((error = iwm_firmware_store_section(sc, 614 IWM_UCODE_TYPE_WOW, tlv_data, tlv_len)) != 0) { 615 device_printf(sc->sc_dev, 616 "%s: IWM_UCODE_TYPE_WOW: iwm_firmware_store_section() failed; %d\n", 617 __func__, 618 error); 619 goto parse_out; 620 } 621 break; 622 case IWM_UCODE_TLV_DEF_CALIB: 623 if (tlv_len != sizeof(struct iwm_tlv_calib_data)) { 624 device_printf(sc->sc_dev, 625 "%s: IWM_UCODE_TLV_DEV_CALIB: tlv_len (%d) < sizeof(iwm_tlv_calib_data) (%d)\n", 626 __func__, 627 (int) tlv_len, 628 (int) sizeof(struct iwm_tlv_calib_data)); 629 error = EINVAL; 630 goto parse_out; 631 } 632 if ((error = iwm_set_default_calib(sc, tlv_data)) != 0) { 633 device_printf(sc->sc_dev, 634 "%s: iwm_set_default_calib() failed: %d\n", 635 __func__, 636 error); 637 goto parse_out; 638 } 639 break; 640 case IWM_UCODE_TLV_PHY_SKU: 641 if (tlv_len != sizeof(uint32_t)) { 642 error = EINVAL; 643 device_printf(sc->sc_dev, 644 "%s: IWM_UCODE_TLV_PHY_SKU: tlv_len (%d) < sizeof(uint32_t)\n", 645 __func__, 646 (int) tlv_len); 647 goto parse_out; 648 } 649 sc->sc_fw_phy_config = 650 le32toh(*(const uint32_t *)tlv_data); 651 break; 652 653 case IWM_UCODE_TLV_API_CHANGES_SET: 654 case IWM_UCODE_TLV_ENABLED_CAPABILITIES: 655 /* ignore, not used by current driver */ 656 break; 657 658 default: 659 device_printf(sc->sc_dev, 660 "%s: unknown firmware section %d, abort\n", 661 __func__, tlv_type); 662 error = EINVAL; 663 goto parse_out; 664 } 665 666 len -= roundup(tlv_len, 4); 667 data += roundup(tlv_len, 4); 668 } 669 670 KASSERT(error == 0, ("unhandled error")); 671 672 parse_out: 673 if (error) { 674 device_printf(sc->sc_dev, "firmware parse error %d, " 675 "section type %d\n", error, tlv_type); 676 } 677 678 if (!(sc->sc_capaflags & IWM_UCODE_TLV_FLAGS_PM_CMD_SUPPORT)) { 679 device_printf(sc->sc_dev, 680 "device uses unsupported power ops\n"); 681 error = ENOTSUP; 682 } 683 684 out: 685 if (error) { 686 fw->fw_status = IWM_FW_STATUS_NONE; 687 if (fw->fw_rawdata != NULL) 688 iwm_fw_info_free(fw); 689 } else 690 fw->fw_status = IWM_FW_STATUS_DONE; 691 wakeup(&sc->sc_fw); 692 693 return error; 694 } 695 696 /* 697 * DMA resource routines 698 */ 699 700 static void 701 iwm_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nsegs, int error) 702 { 703 if (error != 0) 704 return; 705 KASSERT(nsegs == 1, ("too many DMA segments, %d should be 1", nsegs)); 706 *(bus_addr_t *)arg = segs[0].ds_addr; 707 } 708 709 static int 710 iwm_dma_contig_alloc(bus_dma_tag_t tag, struct iwm_dma_info *dma, 711 bus_size_t size, bus_size_t alignment) 712 { 713 int error; 714 715 dma->tag = NULL; 716 dma->size = size; 717 718 error = bus_dma_tag_create(tag, alignment, 719 0, BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, size, 720 1, size, BUS_DMA_NOWAIT, NULL, NULL, &dma->tag); 721 if (error != 0) 722 goto fail; 723 724 error = bus_dmamem_alloc(dma->tag, (void **)&dma->vaddr, 725 BUS_DMA_NOWAIT | BUS_DMA_ZERO | BUS_DMA_COHERENT, &dma->map); 726 if (error != 0) 727 goto fail; 728 729 error = bus_dmamap_load(dma->tag, dma->map, dma->vaddr, size, 730 iwm_dma_map_addr, &dma->paddr, BUS_DMA_NOWAIT); 731 if (error != 0) 732 goto fail; 733 734 bus_dmamap_sync(dma->tag, dma->map, BUS_DMASYNC_PREWRITE); 735 736 return 0; 737 738 fail: iwm_dma_contig_free(dma); 739 return error; 740 } 741 742 static void 743 iwm_dma_contig_free(struct iwm_dma_info *dma) 744 { 745 if (dma->map != NULL) { 746 if (dma->vaddr != NULL) { 747 bus_dmamap_sync(dma->tag, dma->map, 748 BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE); 749 bus_dmamap_unload(dma->tag, dma->map); 750 bus_dmamem_free(dma->tag, dma->vaddr, dma->map); 751 dma->vaddr = NULL; 752 } 753 bus_dmamap_destroy(dma->tag, dma->map); 754 dma->map = NULL; 755 } 756 if (dma->tag != NULL) { 757 bus_dma_tag_destroy(dma->tag); 758 dma->tag = NULL; 759 } 760 761 } 762 763 /* fwmem is used to load firmware onto the card */ 764 static int 765 iwm_alloc_fwmem(struct iwm_softc *sc) 766 { 767 /* Must be aligned on a 16-byte boundary. */ 768 return iwm_dma_contig_alloc(sc->sc_dmat, &sc->fw_dma, 769 sc->sc_fwdmasegsz, 16); 770 } 771 772 static void 773 iwm_free_fwmem(struct iwm_softc *sc) 774 { 775 iwm_dma_contig_free(&sc->fw_dma); 776 } 777 778 /* tx scheduler rings. not used? */ 779 static int 780 iwm_alloc_sched(struct iwm_softc *sc) 781 { 782 int rv; 783 784 /* TX scheduler rings must be aligned on a 1KB boundary. */ 785 rv = iwm_dma_contig_alloc(sc->sc_dmat, &sc->sched_dma, 786 nitems(sc->txq) * sizeof(struct iwm_agn_scd_bc_tbl), 1024); 787 return rv; 788 } 789 790 static void 791 iwm_free_sched(struct iwm_softc *sc) 792 { 793 iwm_dma_contig_free(&sc->sched_dma); 794 } 795 796 /* keep-warm page is used internally by the card. see iwl-fh.h for more info */ 797 static int 798 iwm_alloc_kw(struct iwm_softc *sc) 799 { 800 return iwm_dma_contig_alloc(sc->sc_dmat, &sc->kw_dma, 4096, 4096); 801 } 802 803 static void 804 iwm_free_kw(struct iwm_softc *sc) 805 { 806 iwm_dma_contig_free(&sc->kw_dma); 807 } 808 809 /* interrupt cause table */ 810 static int 811 iwm_alloc_ict(struct iwm_softc *sc) 812 { 813 return iwm_dma_contig_alloc(sc->sc_dmat, &sc->ict_dma, 814 IWM_ICT_SIZE, 1<<IWM_ICT_PADDR_SHIFT); 815 } 816 817 static void 818 iwm_free_ict(struct iwm_softc *sc) 819 { 820 iwm_dma_contig_free(&sc->ict_dma); 821 } 822 823 static int 824 iwm_alloc_rx_ring(struct iwm_softc *sc, struct iwm_rx_ring *ring) 825 { 826 bus_size_t size; 827 int i, error; 828 829 ring->cur = 0; 830 831 /* Allocate RX descriptors (256-byte aligned). */ 832 size = IWM_RX_RING_COUNT * sizeof(uint32_t); 833 error = iwm_dma_contig_alloc(sc->sc_dmat, &ring->desc_dma, size, 256); 834 if (error != 0) { 835 device_printf(sc->sc_dev, 836 "could not allocate RX ring DMA memory\n"); 837 goto fail; 838 } 839 ring->desc = ring->desc_dma.vaddr; 840 841 /* Allocate RX status area (16-byte aligned). */ 842 error = iwm_dma_contig_alloc(sc->sc_dmat, &ring->stat_dma, 843 sizeof(*ring->stat), 16); 844 if (error != 0) { 845 device_printf(sc->sc_dev, 846 "could not allocate RX status DMA memory\n"); 847 goto fail; 848 } 849 ring->stat = ring->stat_dma.vaddr; 850 851 /* Create RX buffer DMA tag. */ 852 error = bus_dma_tag_create(sc->sc_dmat, 1, 0, 853 BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, 854 IWM_RBUF_SIZE, 1, IWM_RBUF_SIZE, BUS_DMA_NOWAIT, NULL, NULL, 855 &ring->data_dmat); 856 if (error != 0) { 857 device_printf(sc->sc_dev, 858 "%s: could not create RX buf DMA tag, error %d\n", 859 __func__, error); 860 goto fail; 861 } 862 863 /* 864 * Allocate and map RX buffers. 865 */ 866 for (i = 0; i < IWM_RX_RING_COUNT; i++) { 867 if ((error = iwm_rx_addbuf(sc, IWM_RBUF_SIZE, i)) != 0) { 868 goto fail; 869 } 870 } 871 return 0; 872 873 fail: iwm_free_rx_ring(sc, ring); 874 return error; 875 } 876 877 static void 878 iwm_reset_rx_ring(struct iwm_softc *sc, struct iwm_rx_ring *ring) 879 { 880 881 /* XXX print out if we can't lock the NIC? */ 882 if (iwm_nic_lock(sc)) { 883 /* XXX handle if RX stop doesn't finish? */ 884 (void) iwm_pcie_rx_stop(sc); 885 iwm_nic_unlock(sc); 886 } 887 ring->cur = 0; 888 } 889 890 static void 891 iwm_free_rx_ring(struct iwm_softc *sc, struct iwm_rx_ring *ring) 892 { 893 int i; 894 895 iwm_dma_contig_free(&ring->desc_dma); 896 iwm_dma_contig_free(&ring->stat_dma); 897 898 for (i = 0; i < IWM_RX_RING_COUNT; i++) { 899 struct iwm_rx_data *data = &ring->data[i]; 900 901 if (data->m != NULL) { 902 bus_dmamap_sync(ring->data_dmat, data->map, 903 BUS_DMASYNC_POSTREAD); 904 bus_dmamap_unload(ring->data_dmat, data->map); 905 m_freem(data->m); 906 data->m = NULL; 907 } 908 if (data->map != NULL) { 909 bus_dmamap_destroy(ring->data_dmat, data->map); 910 data->map = NULL; 911 } 912 } 913 if (ring->data_dmat != NULL) { 914 bus_dma_tag_destroy(ring->data_dmat); 915 ring->data_dmat = NULL; 916 } 917 } 918 919 static int 920 iwm_alloc_tx_ring(struct iwm_softc *sc, struct iwm_tx_ring *ring, int qid) 921 { 922 bus_addr_t paddr; 923 bus_size_t size; 924 int i, error; 925 926 ring->qid = qid; 927 ring->queued = 0; 928 ring->cur = 0; 929 930 /* Allocate TX descriptors (256-byte aligned). */ 931 size = IWM_TX_RING_COUNT * sizeof (struct iwm_tfd); 932 error = iwm_dma_contig_alloc(sc->sc_dmat, &ring->desc_dma, size, 256); 933 if (error != 0) { 934 device_printf(sc->sc_dev, 935 "could not allocate TX ring DMA memory\n"); 936 goto fail; 937 } 938 ring->desc = ring->desc_dma.vaddr; 939 940 /* 941 * We only use rings 0 through 9 (4 EDCA + cmd) so there is no need 942 * to allocate commands space for other rings. 943 */ 944 if (qid > IWM_MVM_CMD_QUEUE) 945 return 0; 946 947 size = IWM_TX_RING_COUNT * sizeof(struct iwm_device_cmd); 948 error = iwm_dma_contig_alloc(sc->sc_dmat, &ring->cmd_dma, size, 4); 949 if (error != 0) { 950 device_printf(sc->sc_dev, 951 "could not allocate TX cmd DMA memory\n"); 952 goto fail; 953 } 954 ring->cmd = ring->cmd_dma.vaddr; 955 956 error = bus_dma_tag_create(sc->sc_dmat, 1, 0, 957 BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, 958 IWM_MAX_SCATTER - 1, MCLBYTES, BUS_DMA_NOWAIT, NULL, NULL, 959 &ring->data_dmat); 960 if (error != 0) { 961 device_printf(sc->sc_dev, "could not create TX buf DMA tag\n"); 962 goto fail; 963 } 964 965 paddr = ring->cmd_dma.paddr; 966 for (i = 0; i < IWM_TX_RING_COUNT; i++) { 967 struct iwm_tx_data *data = &ring->data[i]; 968 969 data->cmd_paddr = paddr; 970 data->scratch_paddr = paddr + sizeof(struct iwm_cmd_header) 971 + offsetof(struct iwm_tx_cmd, scratch); 972 paddr += sizeof(struct iwm_device_cmd); 973 974 error = bus_dmamap_create(ring->data_dmat, 0, &data->map); 975 if (error != 0) { 976 device_printf(sc->sc_dev, 977 "could not create TX buf DMA map\n"); 978 goto fail; 979 } 980 } 981 KASSERT(paddr == ring->cmd_dma.paddr + size, 982 ("invalid physical address")); 983 return 0; 984 985 fail: iwm_free_tx_ring(sc, ring); 986 return error; 987 } 988 989 static void 990 iwm_reset_tx_ring(struct iwm_softc *sc, struct iwm_tx_ring *ring) 991 { 992 int i; 993 994 for (i = 0; i < IWM_TX_RING_COUNT; i++) { 995 struct iwm_tx_data *data = &ring->data[i]; 996 997 if (data->m != NULL) { 998 bus_dmamap_sync(ring->data_dmat, data->map, 999 BUS_DMASYNC_POSTWRITE); 1000 bus_dmamap_unload(ring->data_dmat, data->map); 1001 m_freem(data->m); 1002 data->m = NULL; 1003 } 1004 } 1005 /* Clear TX descriptors. */ 1006 memset(ring->desc, 0, ring->desc_dma.size); 1007 bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map, 1008 BUS_DMASYNC_PREWRITE); 1009 sc->qfullmsk &= ~(1 << ring->qid); 1010 ring->queued = 0; 1011 ring->cur = 0; 1012 } 1013 1014 static void 1015 iwm_free_tx_ring(struct iwm_softc *sc, struct iwm_tx_ring *ring) 1016 { 1017 int i; 1018 1019 iwm_dma_contig_free(&ring->desc_dma); 1020 iwm_dma_contig_free(&ring->cmd_dma); 1021 1022 for (i = 0; i < IWM_TX_RING_COUNT; i++) { 1023 struct iwm_tx_data *data = &ring->data[i]; 1024 1025 if (data->m != NULL) { 1026 bus_dmamap_sync(ring->data_dmat, data->map, 1027 BUS_DMASYNC_POSTWRITE); 1028 bus_dmamap_unload(ring->data_dmat, data->map); 1029 m_freem(data->m); 1030 data->m = NULL; 1031 } 1032 if (data->map != NULL) { 1033 bus_dmamap_destroy(ring->data_dmat, data->map); 1034 data->map = NULL; 1035 } 1036 } 1037 if (ring->data_dmat != NULL) { 1038 bus_dma_tag_destroy(ring->data_dmat); 1039 ring->data_dmat = NULL; 1040 } 1041 } 1042 1043 /* 1044 * High-level hardware frobbing routines 1045 */ 1046 1047 static void 1048 iwm_enable_interrupts(struct iwm_softc *sc) 1049 { 1050 sc->sc_intmask = IWM_CSR_INI_SET_MASK; 1051 IWM_WRITE(sc, IWM_CSR_INT_MASK, sc->sc_intmask); 1052 } 1053 1054 static void 1055 iwm_restore_interrupts(struct iwm_softc *sc) 1056 { 1057 IWM_WRITE(sc, IWM_CSR_INT_MASK, sc->sc_intmask); 1058 } 1059 1060 static void 1061 iwm_disable_interrupts(struct iwm_softc *sc) 1062 { 1063 /* disable interrupts */ 1064 IWM_WRITE(sc, IWM_CSR_INT_MASK, 0); 1065 1066 /* acknowledge all interrupts */ 1067 IWM_WRITE(sc, IWM_CSR_INT, ~0); 1068 IWM_WRITE(sc, IWM_CSR_FH_INT_STATUS, ~0); 1069 } 1070 1071 static void 1072 iwm_ict_reset(struct iwm_softc *sc) 1073 { 1074 iwm_disable_interrupts(sc); 1075 1076 /* Reset ICT table. */ 1077 memset(sc->ict_dma.vaddr, 0, IWM_ICT_SIZE); 1078 sc->ict_cur = 0; 1079 1080 /* Set physical address of ICT table (4KB aligned). */ 1081 IWM_WRITE(sc, IWM_CSR_DRAM_INT_TBL_REG, 1082 IWM_CSR_DRAM_INT_TBL_ENABLE 1083 | IWM_CSR_DRAM_INIT_TBL_WRAP_CHECK 1084 | sc->ict_dma.paddr >> IWM_ICT_PADDR_SHIFT); 1085 1086 /* Switch to ICT interrupt mode in driver. */ 1087 sc->sc_flags |= IWM_FLAG_USE_ICT; 1088 1089 /* Re-enable interrupts. */ 1090 IWM_WRITE(sc, IWM_CSR_INT, ~0); 1091 iwm_enable_interrupts(sc); 1092 } 1093 1094 /* iwlwifi pcie/trans.c */ 1095 1096 /* 1097 * Since this .. hard-resets things, it's time to actually 1098 * mark the first vap (if any) as having no mac context. 1099 * It's annoying, but since the driver is potentially being 1100 * stop/start'ed whilst active (thanks openbsd port!) we 1101 * have to correctly track this. 1102 */ 1103 static void 1104 iwm_stop_device(struct iwm_softc *sc) 1105 { 1106 struct ieee80211com *ic = &sc->sc_ic; 1107 struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps); 1108 int chnl, ntries; 1109 int qid; 1110 1111 /* tell the device to stop sending interrupts */ 1112 iwm_disable_interrupts(sc); 1113 1114 /* 1115 * FreeBSD-local: mark the first vap as not-uploaded, 1116 * so the next transition through auth/assoc 1117 * will correctly populate the MAC context. 1118 */ 1119 if (vap) { 1120 struct iwm_vap *iv = IWM_VAP(vap); 1121 iv->is_uploaded = 0; 1122 } 1123 1124 /* device going down, Stop using ICT table */ 1125 sc->sc_flags &= ~IWM_FLAG_USE_ICT; 1126 1127 /* stop tx and rx. tx and rx bits, as usual, are from if_iwn */ 1128 1129 iwm_write_prph(sc, IWM_SCD_TXFACT, 0); 1130 1131 /* Stop all DMA channels. */ 1132 if (iwm_nic_lock(sc)) { 1133 for (chnl = 0; chnl < IWM_FH_TCSR_CHNL_NUM; chnl++) { 1134 IWM_WRITE(sc, 1135 IWM_FH_TCSR_CHNL_TX_CONFIG_REG(chnl), 0); 1136 for (ntries = 0; ntries < 200; ntries++) { 1137 uint32_t r; 1138 1139 r = IWM_READ(sc, IWM_FH_TSSR_TX_STATUS_REG); 1140 if (r & IWM_FH_TSSR_TX_STATUS_REG_MSK_CHNL_IDLE( 1141 chnl)) 1142 break; 1143 DELAY(20); 1144 } 1145 } 1146 iwm_nic_unlock(sc); 1147 } 1148 1149 /* Stop RX ring. */ 1150 iwm_reset_rx_ring(sc, &sc->rxq); 1151 1152 /* Reset all TX rings. */ 1153 for (qid = 0; qid < nitems(sc->txq); qid++) 1154 iwm_reset_tx_ring(sc, &sc->txq[qid]); 1155 1156 /* 1157 * Power-down device's busmaster DMA clocks 1158 */ 1159 iwm_write_prph(sc, IWM_APMG_CLK_DIS_REG, IWM_APMG_CLK_VAL_DMA_CLK_RQT); 1160 DELAY(5); 1161 1162 /* Make sure (redundant) we've released our request to stay awake */ 1163 IWM_CLRBITS(sc, IWM_CSR_GP_CNTRL, 1164 IWM_CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ); 1165 1166 /* Stop the device, and put it in low power state */ 1167 iwm_apm_stop(sc); 1168 1169 /* Upon stop, the APM issues an interrupt if HW RF kill is set. 1170 * Clean again the interrupt here 1171 */ 1172 iwm_disable_interrupts(sc); 1173 /* stop and reset the on-board processor */ 1174 IWM_WRITE(sc, IWM_CSR_RESET, IWM_CSR_RESET_REG_FLAG_NEVO_RESET); 1175 1176 /* 1177 * Even if we stop the HW, we still want the RF kill 1178 * interrupt 1179 */ 1180 iwm_enable_rfkill_int(sc); 1181 iwm_check_rfkill(sc); 1182 } 1183 1184 /* iwlwifi: mvm/ops.c */ 1185 static void 1186 iwm_mvm_nic_config(struct iwm_softc *sc) 1187 { 1188 uint8_t radio_cfg_type, radio_cfg_step, radio_cfg_dash; 1189 uint32_t reg_val = 0; 1190 1191 radio_cfg_type = (sc->sc_fw_phy_config & IWM_FW_PHY_CFG_RADIO_TYPE) >> 1192 IWM_FW_PHY_CFG_RADIO_TYPE_POS; 1193 radio_cfg_step = (sc->sc_fw_phy_config & IWM_FW_PHY_CFG_RADIO_STEP) >> 1194 IWM_FW_PHY_CFG_RADIO_STEP_POS; 1195 radio_cfg_dash = (sc->sc_fw_phy_config & IWM_FW_PHY_CFG_RADIO_DASH) >> 1196 IWM_FW_PHY_CFG_RADIO_DASH_POS; 1197 1198 /* SKU control */ 1199 reg_val |= IWM_CSR_HW_REV_STEP(sc->sc_hw_rev) << 1200 IWM_CSR_HW_IF_CONFIG_REG_POS_MAC_STEP; 1201 reg_val |= IWM_CSR_HW_REV_DASH(sc->sc_hw_rev) << 1202 IWM_CSR_HW_IF_CONFIG_REG_POS_MAC_DASH; 1203 1204 /* radio configuration */ 1205 reg_val |= radio_cfg_type << IWM_CSR_HW_IF_CONFIG_REG_POS_PHY_TYPE; 1206 reg_val |= radio_cfg_step << IWM_CSR_HW_IF_CONFIG_REG_POS_PHY_STEP; 1207 reg_val |= radio_cfg_dash << IWM_CSR_HW_IF_CONFIG_REG_POS_PHY_DASH; 1208 1209 IWM_WRITE(sc, IWM_CSR_HW_IF_CONFIG_REG, reg_val); 1210 1211 IWM_DPRINTF(sc, IWM_DEBUG_RESET, 1212 "Radio type=0x%x-0x%x-0x%x\n", radio_cfg_type, 1213 radio_cfg_step, radio_cfg_dash); 1214 1215 /* 1216 * W/A : NIC is stuck in a reset state after Early PCIe power off 1217 * (PCIe power is lost before PERST# is asserted), causing ME FW 1218 * to lose ownership and not being able to obtain it back. 1219 */ 1220 iwm_set_bits_mask_prph(sc, IWM_APMG_PS_CTRL_REG, 1221 IWM_APMG_PS_CTRL_EARLY_PWR_OFF_RESET_DIS, 1222 ~IWM_APMG_PS_CTRL_EARLY_PWR_OFF_RESET_DIS); 1223 } 1224 1225 static int 1226 iwm_nic_rx_init(struct iwm_softc *sc) 1227 { 1228 if (!iwm_nic_lock(sc)) 1229 return EBUSY; 1230 1231 /* 1232 * Initialize RX ring. This is from the iwn driver. 1233 */ 1234 memset(sc->rxq.stat, 0, sizeof(*sc->rxq.stat)); 1235 1236 /* stop DMA */ 1237 IWM_WRITE(sc, IWM_FH_MEM_RCSR_CHNL0_CONFIG_REG, 0); 1238 IWM_WRITE(sc, IWM_FH_MEM_RCSR_CHNL0_RBDCB_WPTR, 0); 1239 IWM_WRITE(sc, IWM_FH_MEM_RCSR_CHNL0_FLUSH_RB_REQ, 0); 1240 IWM_WRITE(sc, IWM_FH_RSCSR_CHNL0_RDPTR, 0); 1241 IWM_WRITE(sc, IWM_FH_RSCSR_CHNL0_RBDCB_WPTR_REG, 0); 1242 1243 /* Set physical address of RX ring (256-byte aligned). */ 1244 IWM_WRITE(sc, 1245 IWM_FH_RSCSR_CHNL0_RBDCB_BASE_REG, sc->rxq.desc_dma.paddr >> 8); 1246 1247 /* Set physical address of RX status (16-byte aligned). */ 1248 IWM_WRITE(sc, 1249 IWM_FH_RSCSR_CHNL0_STTS_WPTR_REG, sc->rxq.stat_dma.paddr >> 4); 1250 1251 /* Enable RX. */ 1252 /* 1253 * Note: Linux driver also sets this: 1254 * (IWM_RX_RB_TIMEOUT << IWM_FH_RCSR_RX_CONFIG_REG_IRQ_RBTH_POS) | 1255 * 1256 * It causes weird behavior. YMMV. 1257 */ 1258 IWM_WRITE(sc, IWM_FH_MEM_RCSR_CHNL0_CONFIG_REG, 1259 IWM_FH_RCSR_RX_CONFIG_CHNL_EN_ENABLE_VAL | 1260 IWM_FH_RCSR_CHNL0_RX_IGNORE_RXF_EMPTY | /* HW bug */ 1261 IWM_FH_RCSR_CHNL0_RX_CONFIG_IRQ_DEST_INT_HOST_VAL | 1262 IWM_FH_RCSR_RX_CONFIG_REG_VAL_RB_SIZE_4K | 1263 IWM_RX_QUEUE_SIZE_LOG << IWM_FH_RCSR_RX_CONFIG_RBDCB_SIZE_POS); 1264 1265 IWM_WRITE_1(sc, IWM_CSR_INT_COALESCING, IWM_HOST_INT_TIMEOUT_DEF); 1266 1267 /* W/A for interrupt coalescing bug in 7260 and 3160 */ 1268 if (sc->host_interrupt_operation_mode) 1269 IWM_SETBITS(sc, IWM_CSR_INT_COALESCING, IWM_HOST_INT_OPER_MODE); 1270 1271 /* 1272 * Thus sayeth el jefe (iwlwifi) via a comment: 1273 * 1274 * This value should initially be 0 (before preparing any 1275 * RBs), should be 8 after preparing the first 8 RBs (for example) 1276 */ 1277 IWM_WRITE(sc, IWM_FH_RSCSR_CHNL0_WPTR, 8); 1278 1279 iwm_nic_unlock(sc); 1280 1281 return 0; 1282 } 1283 1284 static int 1285 iwm_nic_tx_init(struct iwm_softc *sc) 1286 { 1287 int qid; 1288 1289 if (!iwm_nic_lock(sc)) 1290 return EBUSY; 1291 1292 /* Deactivate TX scheduler. */ 1293 iwm_write_prph(sc, IWM_SCD_TXFACT, 0); 1294 1295 /* Set physical address of "keep warm" page (16-byte aligned). */ 1296 IWM_WRITE(sc, IWM_FH_KW_MEM_ADDR_REG, sc->kw_dma.paddr >> 4); 1297 1298 /* Initialize TX rings. */ 1299 for (qid = 0; qid < nitems(sc->txq); qid++) { 1300 struct iwm_tx_ring *txq = &sc->txq[qid]; 1301 1302 /* Set physical address of TX ring (256-byte aligned). */ 1303 IWM_WRITE(sc, IWM_FH_MEM_CBBC_QUEUE(qid), 1304 txq->desc_dma.paddr >> 8); 1305 IWM_DPRINTF(sc, IWM_DEBUG_XMIT, 1306 "%s: loading ring %d descriptors (%p) at %lx\n", 1307 __func__, 1308 qid, txq->desc, 1309 (unsigned long) (txq->desc_dma.paddr >> 8)); 1310 } 1311 iwm_nic_unlock(sc); 1312 1313 return 0; 1314 } 1315 1316 static int 1317 iwm_nic_init(struct iwm_softc *sc) 1318 { 1319 int error; 1320 1321 iwm_apm_init(sc); 1322 iwm_set_pwr(sc); 1323 1324 iwm_mvm_nic_config(sc); 1325 1326 if ((error = iwm_nic_rx_init(sc)) != 0) 1327 return error; 1328 1329 /* 1330 * Ditto for TX, from iwn 1331 */ 1332 if ((error = iwm_nic_tx_init(sc)) != 0) 1333 return error; 1334 1335 IWM_DPRINTF(sc, IWM_DEBUG_RESET, 1336 "%s: shadow registers enabled\n", __func__); 1337 IWM_SETBITS(sc, IWM_CSR_MAC_SHADOW_REG_CTRL, 0x800fffff); 1338 1339 return 0; 1340 } 1341 1342 enum iwm_mvm_tx_fifo { 1343 IWM_MVM_TX_FIFO_BK = 0, 1344 IWM_MVM_TX_FIFO_BE, 1345 IWM_MVM_TX_FIFO_VI, 1346 IWM_MVM_TX_FIFO_VO, 1347 IWM_MVM_TX_FIFO_MCAST = 5, 1348 }; 1349 1350 const uint8_t iwm_mvm_ac_to_tx_fifo[] = { 1351 IWM_MVM_TX_FIFO_VO, 1352 IWM_MVM_TX_FIFO_VI, 1353 IWM_MVM_TX_FIFO_BE, 1354 IWM_MVM_TX_FIFO_BK, 1355 }; 1356 1357 static void 1358 iwm_enable_txq(struct iwm_softc *sc, int qid, int fifo) 1359 { 1360 if (!iwm_nic_lock(sc)) { 1361 device_printf(sc->sc_dev, 1362 "%s: cannot enable txq %d\n", 1363 __func__, 1364 qid); 1365 return; /* XXX return EBUSY */ 1366 } 1367 1368 /* unactivate before configuration */ 1369 iwm_write_prph(sc, IWM_SCD_QUEUE_STATUS_BITS(qid), 1370 (0 << IWM_SCD_QUEUE_STTS_REG_POS_ACTIVE) 1371 | (1 << IWM_SCD_QUEUE_STTS_REG_POS_SCD_ACT_EN)); 1372 1373 if (qid != IWM_MVM_CMD_QUEUE) { 1374 iwm_set_bits_prph(sc, IWM_SCD_QUEUECHAIN_SEL, (1 << qid)); 1375 } 1376 1377 iwm_clear_bits_prph(sc, IWM_SCD_AGGR_SEL, (1 << qid)); 1378 1379 IWM_WRITE(sc, IWM_HBUS_TARG_WRPTR, qid << 8 | 0); 1380 iwm_write_prph(sc, IWM_SCD_QUEUE_RDPTR(qid), 0); 1381 1382 iwm_write_mem32(sc, sc->sched_base + IWM_SCD_CONTEXT_QUEUE_OFFSET(qid), 0); 1383 /* Set scheduler window size and frame limit. */ 1384 iwm_write_mem32(sc, 1385 sc->sched_base + IWM_SCD_CONTEXT_QUEUE_OFFSET(qid) + 1386 sizeof(uint32_t), 1387 ((IWM_FRAME_LIMIT << IWM_SCD_QUEUE_CTX_REG2_WIN_SIZE_POS) & 1388 IWM_SCD_QUEUE_CTX_REG2_WIN_SIZE_MSK) | 1389 ((IWM_FRAME_LIMIT << IWM_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_POS) & 1390 IWM_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_MSK)); 1391 1392 iwm_write_prph(sc, IWM_SCD_QUEUE_STATUS_BITS(qid), 1393 (1 << IWM_SCD_QUEUE_STTS_REG_POS_ACTIVE) | 1394 (fifo << IWM_SCD_QUEUE_STTS_REG_POS_TXF) | 1395 (1 << IWM_SCD_QUEUE_STTS_REG_POS_WSL) | 1396 IWM_SCD_QUEUE_STTS_REG_MSK); 1397 1398 iwm_nic_unlock(sc); 1399 1400 IWM_DPRINTF(sc, IWM_DEBUG_XMIT, 1401 "%s: enabled txq %d FIFO %d\n", 1402 __func__, qid, fifo); 1403 } 1404 1405 static int 1406 iwm_post_alive(struct iwm_softc *sc) 1407 { 1408 int nwords; 1409 int error, chnl; 1410 1411 if (!iwm_nic_lock(sc)) 1412 return EBUSY; 1413 1414 if (sc->sched_base != iwm_read_prph(sc, IWM_SCD_SRAM_BASE_ADDR)) { 1415 device_printf(sc->sc_dev, 1416 "%s: sched addr mismatch", 1417 __func__); 1418 error = EINVAL; 1419 goto out; 1420 } 1421 1422 iwm_ict_reset(sc); 1423 1424 /* Clear TX scheduler state in SRAM. */ 1425 nwords = (IWM_SCD_TRANS_TBL_MEM_UPPER_BOUND - 1426 IWM_SCD_CONTEXT_MEM_LOWER_BOUND) 1427 / sizeof(uint32_t); 1428 error = iwm_write_mem(sc, 1429 sc->sched_base + IWM_SCD_CONTEXT_MEM_LOWER_BOUND, 1430 NULL, nwords); 1431 if (error) 1432 goto out; 1433 1434 /* Set physical address of TX scheduler rings (1KB aligned). */ 1435 iwm_write_prph(sc, IWM_SCD_DRAM_BASE_ADDR, sc->sched_dma.paddr >> 10); 1436 1437 iwm_write_prph(sc, IWM_SCD_CHAINEXT_EN, 0); 1438 1439 /* enable command channel */ 1440 iwm_enable_txq(sc, IWM_MVM_CMD_QUEUE, 7); 1441 1442 iwm_write_prph(sc, IWM_SCD_TXFACT, 0xff); 1443 1444 /* Enable DMA channels. */ 1445 for (chnl = 0; chnl < IWM_FH_TCSR_CHNL_NUM; chnl++) { 1446 IWM_WRITE(sc, IWM_FH_TCSR_CHNL_TX_CONFIG_REG(chnl), 1447 IWM_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_ENABLE | 1448 IWM_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_ENABLE); 1449 } 1450 1451 IWM_SETBITS(sc, IWM_FH_TX_CHICKEN_BITS_REG, 1452 IWM_FH_TX_CHICKEN_BITS_SCD_AUTO_RETRY_EN); 1453 1454 /* Enable L1-Active */ 1455 iwm_clear_bits_prph(sc, IWM_APMG_PCIDEV_STT_REG, 1456 IWM_APMG_PCIDEV_STT_VAL_L1_ACT_DIS); 1457 1458 out: 1459 iwm_nic_unlock(sc); 1460 return error; 1461 } 1462 1463 /* 1464 * NVM read access and content parsing. We do not support 1465 * external NVM or writing NVM. 1466 * iwlwifi/mvm/nvm.c 1467 */ 1468 1469 /* list of NVM sections we are allowed/need to read */ 1470 const int nvm_to_read[] = { 1471 IWM_NVM_SECTION_TYPE_HW, 1472 IWM_NVM_SECTION_TYPE_SW, 1473 IWM_NVM_SECTION_TYPE_CALIBRATION, 1474 IWM_NVM_SECTION_TYPE_PRODUCTION, 1475 }; 1476 1477 /* Default NVM size to read */ 1478 #define IWM_NVM_DEFAULT_CHUNK_SIZE (2*1024) 1479 #define IWM_MAX_NVM_SECTION_SIZE 7000 1480 1481 #define IWM_NVM_WRITE_OPCODE 1 1482 #define IWM_NVM_READ_OPCODE 0 1483 1484 static int 1485 iwm_nvm_read_chunk(struct iwm_softc *sc, uint16_t section, 1486 uint16_t offset, uint16_t length, uint8_t *data, uint16_t *len) 1487 { 1488 offset = 0; 1489 struct iwm_nvm_access_cmd nvm_access_cmd = { 1490 .offset = htole16(offset), 1491 .length = htole16(length), 1492 .type = htole16(section), 1493 .op_code = IWM_NVM_READ_OPCODE, 1494 }; 1495 struct iwm_nvm_access_resp *nvm_resp; 1496 struct iwm_rx_packet *pkt; 1497 struct iwm_host_cmd cmd = { 1498 .id = IWM_NVM_ACCESS_CMD, 1499 .flags = IWM_CMD_SYNC | IWM_CMD_WANT_SKB | 1500 IWM_CMD_SEND_IN_RFKILL, 1501 .data = { &nvm_access_cmd, }, 1502 }; 1503 int ret, bytes_read, offset_read; 1504 uint8_t *resp_data; 1505 1506 cmd.len[0] = sizeof(struct iwm_nvm_access_cmd); 1507 1508 ret = iwm_send_cmd(sc, &cmd); 1509 if (ret) 1510 return ret; 1511 1512 pkt = cmd.resp_pkt; 1513 if (pkt->hdr.flags & IWM_CMD_FAILED_MSK) { 1514 device_printf(sc->sc_dev, 1515 "%s: Bad return from IWM_NVM_ACCES_COMMAND (0x%08X)\n", 1516 __func__, pkt->hdr.flags); 1517 ret = EIO; 1518 goto exit; 1519 } 1520 1521 /* Extract NVM response */ 1522 nvm_resp = (void *)pkt->data; 1523 1524 ret = le16toh(nvm_resp->status); 1525 bytes_read = le16toh(nvm_resp->length); 1526 offset_read = le16toh(nvm_resp->offset); 1527 resp_data = nvm_resp->data; 1528 if (ret) { 1529 device_printf(sc->sc_dev, 1530 "%s: NVM access command failed with status %d\n", 1531 __func__, ret); 1532 ret = EINVAL; 1533 goto exit; 1534 } 1535 1536 if (offset_read != offset) { 1537 device_printf(sc->sc_dev, 1538 "%s: NVM ACCESS response with invalid offset %d\n", 1539 __func__, offset_read); 1540 ret = EINVAL; 1541 goto exit; 1542 } 1543 1544 memcpy(data + offset, resp_data, bytes_read); 1545 *len = bytes_read; 1546 1547 exit: 1548 iwm_free_resp(sc, &cmd); 1549 return ret; 1550 } 1551 1552 /* 1553 * Reads an NVM section completely. 1554 * NICs prior to 7000 family doesn't have a real NVM, but just read 1555 * section 0 which is the EEPROM. Because the EEPROM reading is unlimited 1556 * by uCode, we need to manually check in this case that we don't 1557 * overflow and try to read more than the EEPROM size. 1558 * For 7000 family NICs, we supply the maximal size we can read, and 1559 * the uCode fills the response with as much data as we can, 1560 * without overflowing, so no check is needed. 1561 */ 1562 static int 1563 iwm_nvm_read_section(struct iwm_softc *sc, 1564 uint16_t section, uint8_t *data, uint16_t *len) 1565 { 1566 uint16_t length, seglen; 1567 int error; 1568 1569 /* Set nvm section read length */ 1570 length = seglen = IWM_NVM_DEFAULT_CHUNK_SIZE; 1571 *len = 0; 1572 1573 /* Read the NVM until exhausted (reading less than requested) */ 1574 while (seglen == length) { 1575 error = iwm_nvm_read_chunk(sc, 1576 section, *len, length, data, &seglen); 1577 if (error) { 1578 device_printf(sc->sc_dev, 1579 "Cannot read NVM from section " 1580 "%d offset %d, length %d\n", 1581 section, *len, length); 1582 return error; 1583 } 1584 *len += seglen; 1585 } 1586 1587 IWM_DPRINTF(sc, IWM_DEBUG_RESET, 1588 "NVM section %d read completed\n", section); 1589 return 0; 1590 } 1591 1592 /* 1593 * BEGIN IWM_NVM_PARSE 1594 */ 1595 1596 /* iwlwifi/iwl-nvm-parse.c */ 1597 1598 /* NVM offsets (in words) definitions */ 1599 enum wkp_nvm_offsets { 1600 /* NVM HW-Section offset (in words) definitions */ 1601 IWM_HW_ADDR = 0x15, 1602 1603 /* NVM SW-Section offset (in words) definitions */ 1604 IWM_NVM_SW_SECTION = 0x1C0, 1605 IWM_NVM_VERSION = 0, 1606 IWM_RADIO_CFG = 1, 1607 IWM_SKU = 2, 1608 IWM_N_HW_ADDRS = 3, 1609 IWM_NVM_CHANNELS = 0x1E0 - IWM_NVM_SW_SECTION, 1610 1611 /* NVM calibration section offset (in words) definitions */ 1612 IWM_NVM_CALIB_SECTION = 0x2B8, 1613 IWM_XTAL_CALIB = 0x316 - IWM_NVM_CALIB_SECTION 1614 }; 1615 1616 /* SKU Capabilities (actual values from NVM definition) */ 1617 enum nvm_sku_bits { 1618 IWM_NVM_SKU_CAP_BAND_24GHZ = (1 << 0), 1619 IWM_NVM_SKU_CAP_BAND_52GHZ = (1 << 1), 1620 IWM_NVM_SKU_CAP_11N_ENABLE = (1 << 2), 1621 IWM_NVM_SKU_CAP_11AC_ENABLE = (1 << 3), 1622 }; 1623 1624 /* radio config bits (actual values from NVM definition) */ 1625 #define IWM_NVM_RF_CFG_DASH_MSK(x) (x & 0x3) /* bits 0-1 */ 1626 #define IWM_NVM_RF_CFG_STEP_MSK(x) ((x >> 2) & 0x3) /* bits 2-3 */ 1627 #define IWM_NVM_RF_CFG_TYPE_MSK(x) ((x >> 4) & 0x3) /* bits 4-5 */ 1628 #define IWM_NVM_RF_CFG_PNUM_MSK(x) ((x >> 6) & 0x3) /* bits 6-7 */ 1629 #define IWM_NVM_RF_CFG_TX_ANT_MSK(x) ((x >> 8) & 0xF) /* bits 8-11 */ 1630 #define IWM_NVM_RF_CFG_RX_ANT_MSK(x) ((x >> 12) & 0xF) /* bits 12-15 */ 1631 1632 #define DEFAULT_MAX_TX_POWER 16 1633 1634 /** 1635 * enum iwm_nvm_channel_flags - channel flags in NVM 1636 * @IWM_NVM_CHANNEL_VALID: channel is usable for this SKU/geo 1637 * @IWM_NVM_CHANNEL_IBSS: usable as an IBSS channel 1638 * @IWM_NVM_CHANNEL_ACTIVE: active scanning allowed 1639 * @IWM_NVM_CHANNEL_RADAR: radar detection required 1640 * @IWM_NVM_CHANNEL_DFS: dynamic freq selection candidate 1641 * @IWM_NVM_CHANNEL_WIDE: 20 MHz channel okay (?) 1642 * @IWM_NVM_CHANNEL_40MHZ: 40 MHz channel okay (?) 1643 * @IWM_NVM_CHANNEL_80MHZ: 80 MHz channel okay (?) 1644 * @IWM_NVM_CHANNEL_160MHZ: 160 MHz channel okay (?) 1645 */ 1646 enum iwm_nvm_channel_flags { 1647 IWM_NVM_CHANNEL_VALID = (1 << 0), 1648 IWM_NVM_CHANNEL_IBSS = (1 << 1), 1649 IWM_NVM_CHANNEL_ACTIVE = (1 << 3), 1650 IWM_NVM_CHANNEL_RADAR = (1 << 4), 1651 IWM_NVM_CHANNEL_DFS = (1 << 7), 1652 IWM_NVM_CHANNEL_WIDE = (1 << 8), 1653 IWM_NVM_CHANNEL_40MHZ = (1 << 9), 1654 IWM_NVM_CHANNEL_80MHZ = (1 << 10), 1655 IWM_NVM_CHANNEL_160MHZ = (1 << 11), 1656 }; 1657 1658 /* 1659 * Add a channel to the net80211 channel list. 1660 * 1661 * ieee is the ieee channel number 1662 * ch_idx is channel index. 1663 * mode is the channel mode - CHAN_A, CHAN_B, CHAN_G. 1664 * ch_flags is the iwm channel flags. 1665 * 1666 * Return 0 on OK, < 0 on error. 1667 */ 1668 static int 1669 iwm_init_net80211_channel(struct iwm_softc *sc, int ieee, int ch_idx, 1670 int mode, uint16_t ch_flags) 1671 { 1672 /* XXX for now, no overflow checking! */ 1673 struct ieee80211com *ic = &sc->sc_ic; 1674 int is_5ghz, flags; 1675 struct ieee80211_channel *channel; 1676 1677 channel = &ic->ic_channels[ic->ic_nchans++]; 1678 channel->ic_ieee = ieee; 1679 1680 is_5ghz = ch_idx >= IWM_NUM_2GHZ_CHANNELS; 1681 if (!is_5ghz) { 1682 flags = IEEE80211_CHAN_2GHZ; 1683 channel->ic_flags = mode; 1684 } else { 1685 flags = IEEE80211_CHAN_5GHZ; 1686 channel->ic_flags = mode; 1687 } 1688 channel->ic_freq = ieee80211_ieee2mhz(ieee, flags); 1689 1690 if (!(ch_flags & IWM_NVM_CHANNEL_ACTIVE)) 1691 channel->ic_flags |= IEEE80211_CHAN_PASSIVE; 1692 return (0); 1693 } 1694 1695 static void 1696 iwm_init_channel_map(struct iwm_softc *sc, const uint16_t * const nvm_ch_flags) 1697 { 1698 struct ieee80211com *ic = &sc->sc_ic; 1699 struct iwm_nvm_data *data = &sc->sc_nvm; 1700 int ch_idx; 1701 uint16_t ch_flags; 1702 int hw_value; 1703 1704 for (ch_idx = 0; ch_idx < nitems(iwm_nvm_channels); ch_idx++) { 1705 ch_flags = le16_to_cpup(nvm_ch_flags + ch_idx); 1706 1707 if (ch_idx >= IWM_NUM_2GHZ_CHANNELS && 1708 !data->sku_cap_band_52GHz_enable) 1709 ch_flags &= ~IWM_NVM_CHANNEL_VALID; 1710 1711 if (!(ch_flags & IWM_NVM_CHANNEL_VALID)) { 1712 IWM_DPRINTF(sc, IWM_DEBUG_EEPROM, 1713 "Ch. %d Flags %x [%sGHz] - No traffic\n", 1714 iwm_nvm_channels[ch_idx], 1715 ch_flags, 1716 (ch_idx >= IWM_NUM_2GHZ_CHANNELS) ? 1717 "5.2" : "2.4"); 1718 continue; 1719 } 1720 1721 hw_value = iwm_nvm_channels[ch_idx]; 1722 1723 /* 5GHz? */ 1724 if (ch_idx >= IWM_NUM_2GHZ_CHANNELS) { 1725 (void) iwm_init_net80211_channel(sc, hw_value, 1726 ch_idx, 1727 IEEE80211_CHAN_A, 1728 ch_flags); 1729 } else { 1730 (void) iwm_init_net80211_channel(sc, hw_value, 1731 ch_idx, 1732 IEEE80211_CHAN_B, 1733 ch_flags); 1734 /* If it's not channel 13, also add 11g */ 1735 if (hw_value != 13) 1736 (void) iwm_init_net80211_channel(sc, hw_value, 1737 ch_idx, 1738 IEEE80211_CHAN_G, 1739 ch_flags); 1740 } 1741 1742 IWM_DPRINTF(sc, IWM_DEBUG_EEPROM, 1743 "Ch. %d Flags %x [%sGHz] - Added\n", 1744 iwm_nvm_channels[ch_idx], 1745 ch_flags, 1746 (ch_idx >= IWM_NUM_2GHZ_CHANNELS) ? 1747 "5.2" : "2.4"); 1748 } 1749 ieee80211_sort_channels(ic->ic_channels, ic->ic_nchans); 1750 } 1751 1752 static int 1753 iwm_parse_nvm_data(struct iwm_softc *sc, 1754 const uint16_t *nvm_hw, const uint16_t *nvm_sw, 1755 const uint16_t *nvm_calib, uint8_t tx_chains, uint8_t rx_chains) 1756 { 1757 struct iwm_nvm_data *data = &sc->sc_nvm; 1758 uint8_t hw_addr[IEEE80211_ADDR_LEN]; 1759 uint16_t radio_cfg, sku; 1760 1761 data->nvm_version = le16_to_cpup(nvm_sw + IWM_NVM_VERSION); 1762 1763 radio_cfg = le16_to_cpup(nvm_sw + IWM_RADIO_CFG); 1764 data->radio_cfg_type = IWM_NVM_RF_CFG_TYPE_MSK(radio_cfg); 1765 data->radio_cfg_step = IWM_NVM_RF_CFG_STEP_MSK(radio_cfg); 1766 data->radio_cfg_dash = IWM_NVM_RF_CFG_DASH_MSK(radio_cfg); 1767 data->radio_cfg_pnum = IWM_NVM_RF_CFG_PNUM_MSK(radio_cfg); 1768 data->valid_tx_ant = IWM_NVM_RF_CFG_TX_ANT_MSK(radio_cfg); 1769 data->valid_rx_ant = IWM_NVM_RF_CFG_RX_ANT_MSK(radio_cfg); 1770 1771 sku = le16_to_cpup(nvm_sw + IWM_SKU); 1772 data->sku_cap_band_24GHz_enable = sku & IWM_NVM_SKU_CAP_BAND_24GHZ; 1773 data->sku_cap_band_52GHz_enable = sku & IWM_NVM_SKU_CAP_BAND_52GHZ; 1774 data->sku_cap_11n_enable = 0; 1775 1776 if (!data->valid_tx_ant || !data->valid_rx_ant) { 1777 device_printf(sc->sc_dev, 1778 "%s: invalid antennas (0x%x, 0x%x)\n", 1779 __func__, data->valid_tx_ant, 1780 data->valid_rx_ant); 1781 return EINVAL; 1782 } 1783 1784 data->n_hw_addrs = le16_to_cpup(nvm_sw + IWM_N_HW_ADDRS); 1785 1786 data->xtal_calib[0] = *(nvm_calib + IWM_XTAL_CALIB); 1787 data->xtal_calib[1] = *(nvm_calib + IWM_XTAL_CALIB + 1); 1788 1789 /* The byte order is little endian 16 bit, meaning 214365 */ 1790 IEEE80211_ADDR_COPY(hw_addr, nvm_hw + IWM_HW_ADDR); 1791 data->hw_addr[0] = hw_addr[1]; 1792 data->hw_addr[1] = hw_addr[0]; 1793 data->hw_addr[2] = hw_addr[3]; 1794 data->hw_addr[3] = hw_addr[2]; 1795 data->hw_addr[4] = hw_addr[5]; 1796 data->hw_addr[5] = hw_addr[4]; 1797 1798 iwm_init_channel_map(sc, &nvm_sw[IWM_NVM_CHANNELS]); 1799 data->calib_version = 255; /* TODO: 1800 this value will prevent some checks from 1801 failing, we need to check if this 1802 field is still needed, and if it does, 1803 where is it in the NVM */ 1804 1805 return 0; 1806 } 1807 1808 /* 1809 * END NVM PARSE 1810 */ 1811 1812 struct iwm_nvm_section { 1813 uint16_t length; 1814 const uint8_t *data; 1815 }; 1816 1817 static int 1818 iwm_parse_nvm_sections(struct iwm_softc *sc, struct iwm_nvm_section *sections) 1819 { 1820 const uint16_t *hw, *sw, *calib; 1821 1822 /* Checking for required sections */ 1823 if (!sections[IWM_NVM_SECTION_TYPE_SW].data || 1824 !sections[IWM_NVM_SECTION_TYPE_HW].data) { 1825 device_printf(sc->sc_dev, 1826 "%s: Can't parse empty NVM sections\n", 1827 __func__); 1828 return ENOENT; 1829 } 1830 1831 hw = (const uint16_t *)sections[IWM_NVM_SECTION_TYPE_HW].data; 1832 sw = (const uint16_t *)sections[IWM_NVM_SECTION_TYPE_SW].data; 1833 calib = (const uint16_t *)sections[IWM_NVM_SECTION_TYPE_CALIBRATION].data; 1834 return iwm_parse_nvm_data(sc, hw, sw, calib, 1835 IWM_FW_VALID_TX_ANT(sc), IWM_FW_VALID_RX_ANT(sc)); 1836 } 1837 1838 static int 1839 iwm_nvm_init(struct iwm_softc *sc) 1840 { 1841 struct iwm_nvm_section nvm_sections[IWM_NVM_NUM_OF_SECTIONS]; 1842 int i, section, error; 1843 uint16_t len; 1844 uint8_t *nvm_buffer, *temp; 1845 1846 /* Read From FW NVM */ 1847 IWM_DPRINTF(sc, IWM_DEBUG_EEPROM, 1848 "%s: Read NVM\n", 1849 __func__); 1850 1851 /* TODO: find correct NVM max size for a section */ 1852 nvm_buffer = malloc(IWM_OTP_LOW_IMAGE_SIZE, M_DEVBUF, M_NOWAIT); 1853 if (nvm_buffer == NULL) 1854 return (ENOMEM); 1855 for (i = 0; i < nitems(nvm_to_read); i++) { 1856 section = nvm_to_read[i]; 1857 KASSERT(section <= nitems(nvm_sections), 1858 ("too many sections")); 1859 1860 error = iwm_nvm_read_section(sc, section, nvm_buffer, &len); 1861 if (error) 1862 break; 1863 1864 temp = malloc(len, M_DEVBUF, M_NOWAIT); 1865 if (temp == NULL) { 1866 error = ENOMEM; 1867 break; 1868 } 1869 memcpy(temp, nvm_buffer, len); 1870 nvm_sections[section].data = temp; 1871 nvm_sections[section].length = len; 1872 } 1873 free(nvm_buffer, M_DEVBUF); 1874 if (error) 1875 return error; 1876 1877 return iwm_parse_nvm_sections(sc, nvm_sections); 1878 } 1879 1880 /* 1881 * Firmware loading gunk. This is kind of a weird hybrid between the 1882 * iwn driver and the Linux iwlwifi driver. 1883 */ 1884 1885 static int 1886 iwm_firmware_load_chunk(struct iwm_softc *sc, uint32_t dst_addr, 1887 const uint8_t *section, uint32_t byte_cnt) 1888 { 1889 struct iwm_dma_info *dma = &sc->fw_dma; 1890 int error; 1891 1892 /* Copy firmware section into pre-allocated DMA-safe memory. */ 1893 memcpy(dma->vaddr, section, byte_cnt); 1894 bus_dmamap_sync(dma->tag, dma->map, BUS_DMASYNC_PREWRITE); 1895 1896 if (!iwm_nic_lock(sc)) 1897 return EBUSY; 1898 1899 sc->sc_fw_chunk_done = 0; 1900 1901 IWM_WRITE(sc, IWM_FH_TCSR_CHNL_TX_CONFIG_REG(IWM_FH_SRVC_CHNL), 1902 IWM_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_PAUSE); 1903 IWM_WRITE(sc, IWM_FH_SRVC_CHNL_SRAM_ADDR_REG(IWM_FH_SRVC_CHNL), 1904 dst_addr); 1905 IWM_WRITE(sc, IWM_FH_TFDIB_CTRL0_REG(IWM_FH_SRVC_CHNL), 1906 dma->paddr & IWM_FH_MEM_TFDIB_DRAM_ADDR_LSB_MSK); 1907 IWM_WRITE(sc, IWM_FH_TFDIB_CTRL1_REG(IWM_FH_SRVC_CHNL), 1908 (iwm_get_dma_hi_addr(dma->paddr) 1909 << IWM_FH_MEM_TFDIB_REG1_ADDR_BITSHIFT) | byte_cnt); 1910 IWM_WRITE(sc, IWM_FH_TCSR_CHNL_TX_BUF_STS_REG(IWM_FH_SRVC_CHNL), 1911 1 << IWM_FH_TCSR_CHNL_TX_BUF_STS_REG_POS_TB_NUM | 1912 1 << IWM_FH_TCSR_CHNL_TX_BUF_STS_REG_POS_TB_IDX | 1913 IWM_FH_TCSR_CHNL_TX_BUF_STS_REG_VAL_TFDB_VALID); 1914 IWM_WRITE(sc, IWM_FH_TCSR_CHNL_TX_CONFIG_REG(IWM_FH_SRVC_CHNL), 1915 IWM_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_ENABLE | 1916 IWM_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_DISABLE | 1917 IWM_FH_TCSR_TX_CONFIG_REG_VAL_CIRQ_HOST_ENDTFD); 1918 1919 iwm_nic_unlock(sc); 1920 1921 /* wait 1s for this segment to load */ 1922 while (!sc->sc_fw_chunk_done) 1923 if ((error = msleep(&sc->sc_fw, &sc->sc_mtx, 0, "iwmfw", hz)) != 0) 1924 break; 1925 1926 return error; 1927 } 1928 1929 static int 1930 iwm_load_firmware(struct iwm_softc *sc, enum iwm_ucode_type ucode_type) 1931 { 1932 struct iwm_fw_sects *fws; 1933 int error, i, w; 1934 const void *data; 1935 uint32_t dlen; 1936 uint32_t offset; 1937 1938 sc->sc_uc.uc_intr = 0; 1939 1940 fws = &sc->sc_fw.fw_sects[ucode_type]; 1941 for (i = 0; i < fws->fw_count; i++) { 1942 data = fws->fw_sect[i].fws_data; 1943 dlen = fws->fw_sect[i].fws_len; 1944 offset = fws->fw_sect[i].fws_devoff; 1945 IWM_DPRINTF(sc, IWM_DEBUG_FIRMWARE_TLV, 1946 "LOAD FIRMWARE type %d offset %u len %d\n", 1947 ucode_type, offset, dlen); 1948 error = iwm_firmware_load_chunk(sc, offset, data, dlen); 1949 if (error) { 1950 device_printf(sc->sc_dev, 1951 "%s: chunk %u of %u returned error %02d\n", 1952 __func__, i, fws->fw_count, error); 1953 return error; 1954 } 1955 } 1956 1957 /* wait for the firmware to load */ 1958 IWM_WRITE(sc, IWM_CSR_RESET, 0); 1959 1960 for (w = 0; !sc->sc_uc.uc_intr && w < 10; w++) { 1961 error = msleep(&sc->sc_uc, &sc->sc_mtx, 0, "iwmuc", hz/10); 1962 } 1963 1964 return error; 1965 } 1966 1967 /* iwlwifi: pcie/trans.c */ 1968 static int 1969 iwm_start_fw(struct iwm_softc *sc, enum iwm_ucode_type ucode_type) 1970 { 1971 int error; 1972 1973 IWM_WRITE(sc, IWM_CSR_INT, ~0); 1974 1975 if ((error = iwm_nic_init(sc)) != 0) { 1976 device_printf(sc->sc_dev, "unable to init nic\n"); 1977 return error; 1978 } 1979 1980 /* make sure rfkill handshake bits are cleared */ 1981 IWM_WRITE(sc, IWM_CSR_UCODE_DRV_GP1_CLR, IWM_CSR_UCODE_SW_BIT_RFKILL); 1982 IWM_WRITE(sc, IWM_CSR_UCODE_DRV_GP1_CLR, 1983 IWM_CSR_UCODE_DRV_GP1_BIT_CMD_BLOCKED); 1984 1985 /* clear (again), then enable host interrupts */ 1986 IWM_WRITE(sc, IWM_CSR_INT, ~0); 1987 iwm_enable_interrupts(sc); 1988 1989 /* really make sure rfkill handshake bits are cleared */ 1990 /* maybe we should write a few times more? just to make sure */ 1991 IWM_WRITE(sc, IWM_CSR_UCODE_DRV_GP1_CLR, IWM_CSR_UCODE_SW_BIT_RFKILL); 1992 IWM_WRITE(sc, IWM_CSR_UCODE_DRV_GP1_CLR, IWM_CSR_UCODE_SW_BIT_RFKILL); 1993 1994 /* Load the given image to the HW */ 1995 return iwm_load_firmware(sc, ucode_type); 1996 } 1997 1998 static int 1999 iwm_fw_alive(struct iwm_softc *sc, uint32_t sched_base) 2000 { 2001 return iwm_post_alive(sc); 2002 } 2003 2004 static int 2005 iwm_send_tx_ant_cfg(struct iwm_softc *sc, uint8_t valid_tx_ant) 2006 { 2007 struct iwm_tx_ant_cfg_cmd tx_ant_cmd = { 2008 .valid = htole32(valid_tx_ant), 2009 }; 2010 2011 return iwm_mvm_send_cmd_pdu(sc, IWM_TX_ANT_CONFIGURATION_CMD, 2012 IWM_CMD_SYNC, sizeof(tx_ant_cmd), &tx_ant_cmd); 2013 } 2014 2015 /* iwlwifi: mvm/fw.c */ 2016 static int 2017 iwm_send_phy_cfg_cmd(struct iwm_softc *sc) 2018 { 2019 struct iwm_phy_cfg_cmd phy_cfg_cmd; 2020 enum iwm_ucode_type ucode_type = sc->sc_uc_current; 2021 2022 /* Set parameters */ 2023 phy_cfg_cmd.phy_cfg = htole32(sc->sc_fw_phy_config); 2024 phy_cfg_cmd.calib_control.event_trigger = 2025 sc->sc_default_calib[ucode_type].event_trigger; 2026 phy_cfg_cmd.calib_control.flow_trigger = 2027 sc->sc_default_calib[ucode_type].flow_trigger; 2028 2029 IWM_DPRINTF(sc, IWM_DEBUG_CMD | IWM_DEBUG_RESET, 2030 "Sending Phy CFG command: 0x%x\n", phy_cfg_cmd.phy_cfg); 2031 return iwm_mvm_send_cmd_pdu(sc, IWM_PHY_CONFIGURATION_CMD, IWM_CMD_SYNC, 2032 sizeof(phy_cfg_cmd), &phy_cfg_cmd); 2033 } 2034 2035 static int 2036 iwm_mvm_load_ucode_wait_alive(struct iwm_softc *sc, 2037 enum iwm_ucode_type ucode_type) 2038 { 2039 enum iwm_ucode_type old_type = sc->sc_uc_current; 2040 int error; 2041 2042 if ((error = iwm_read_firmware(sc, ucode_type)) != 0) 2043 return error; 2044 2045 sc->sc_uc_current = ucode_type; 2046 error = iwm_start_fw(sc, ucode_type); 2047 if (error) { 2048 sc->sc_uc_current = old_type; 2049 return error; 2050 } 2051 2052 return iwm_fw_alive(sc, sc->sched_base); 2053 } 2054 2055 /* 2056 * mvm misc bits 2057 */ 2058 2059 /* 2060 * follows iwlwifi/fw.c 2061 */ 2062 static int 2063 iwm_run_init_mvm_ucode(struct iwm_softc *sc, int justnvm) 2064 { 2065 int error; 2066 2067 /* do not operate with rfkill switch turned on */ 2068 if ((sc->sc_flags & IWM_FLAG_RFKILL) && !justnvm) { 2069 device_printf(sc->sc_dev, 2070 "radio is disabled by hardware switch\n"); 2071 return EPERM; 2072 } 2073 2074 sc->sc_init_complete = 0; 2075 if ((error = iwm_mvm_load_ucode_wait_alive(sc, 2076 IWM_UCODE_TYPE_INIT)) != 0) 2077 return error; 2078 2079 if (justnvm) { 2080 if ((error = iwm_nvm_init(sc)) != 0) { 2081 device_printf(sc->sc_dev, "failed to read nvm\n"); 2082 return error; 2083 } 2084 IEEE80211_ADDR_COPY(sc->sc_ic.ic_macaddr, &sc->sc_nvm.hw_addr); 2085 2086 sc->sc_scan_cmd_len = sizeof(struct iwm_scan_cmd) 2087 + sc->sc_capa_max_probe_len 2088 + IWM_MAX_NUM_SCAN_CHANNELS 2089 * sizeof(struct iwm_scan_channel); 2090 sc->sc_scan_cmd = malloc(sc->sc_scan_cmd_len, M_DEVBUF, 2091 M_NOWAIT); 2092 if (sc->sc_scan_cmd == NULL) 2093 return (ENOMEM); 2094 2095 return 0; 2096 } 2097 2098 /* Send TX valid antennas before triggering calibrations */ 2099 if ((error = iwm_send_tx_ant_cfg(sc, IWM_FW_VALID_TX_ANT(sc))) != 0) 2100 return error; 2101 2102 /* 2103 * Send phy configurations command to init uCode 2104 * to start the 16.0 uCode init image internal calibrations. 2105 */ 2106 if ((error = iwm_send_phy_cfg_cmd(sc)) != 0 ) { 2107 device_printf(sc->sc_dev, 2108 "%s: failed to run internal calibration: %d\n", 2109 __func__, error); 2110 return error; 2111 } 2112 2113 /* 2114 * Nothing to do but wait for the init complete notification 2115 * from the firmware 2116 */ 2117 while (!sc->sc_init_complete) 2118 if ((error = msleep(&sc->sc_init_complete, &sc->sc_mtx, 2119 0, "iwminit", 2*hz)) != 0) 2120 break; 2121 2122 return error; 2123 } 2124 2125 /* 2126 * receive side 2127 */ 2128 2129 /* (re)stock rx ring, called at init-time and at runtime */ 2130 static int 2131 iwm_rx_addbuf(struct iwm_softc *sc, int size, int idx) 2132 { 2133 struct iwm_rx_ring *ring = &sc->rxq; 2134 struct iwm_rx_data *data = &ring->data[idx]; 2135 struct mbuf *m; 2136 int error; 2137 bus_addr_t paddr; 2138 2139 m = m_getjcl(M_NOWAIT, MT_DATA, M_PKTHDR, IWM_RBUF_SIZE); 2140 if (m == NULL) 2141 return ENOBUFS; 2142 2143 if (data->m != NULL) 2144 bus_dmamap_unload(ring->data_dmat, data->map); 2145 2146 m->m_len = m->m_pkthdr.len = m->m_ext.ext_size; 2147 error = bus_dmamap_create(ring->data_dmat, 0, &data->map); 2148 if (error != 0) { 2149 device_printf(sc->sc_dev, 2150 "%s: could not create RX buf DMA map, error %d\n", 2151 __func__, error); 2152 goto fail; 2153 } 2154 data->m = m; 2155 error = bus_dmamap_load(ring->data_dmat, data->map, 2156 mtod(data->m, void *), IWM_RBUF_SIZE, iwm_dma_map_addr, 2157 &paddr, BUS_DMA_NOWAIT); 2158 if (error != 0 && error != EFBIG) { 2159 device_printf(sc->sc_dev, 2160 "%s: can't not map mbuf, error %d\n", __func__, 2161 error); 2162 goto fail; 2163 } 2164 bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_PREREAD); 2165 2166 /* Update RX descriptor. */ 2167 ring->desc[idx] = htole32(paddr >> 8); 2168 bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map, 2169 BUS_DMASYNC_PREWRITE); 2170 2171 return 0; 2172 fail: 2173 return error; 2174 } 2175 2176 /* iwlwifi: mvm/rx.c */ 2177 #define IWM_RSSI_OFFSET 50 2178 static int 2179 iwm_mvm_calc_rssi(struct iwm_softc *sc, struct iwm_rx_phy_info *phy_info) 2180 { 2181 int rssi_a, rssi_b, rssi_a_dbm, rssi_b_dbm, max_rssi_dbm; 2182 uint32_t agc_a, agc_b; 2183 uint32_t val; 2184 2185 val = le32toh(phy_info->non_cfg_phy[IWM_RX_INFO_AGC_IDX]); 2186 agc_a = (val & IWM_OFDM_AGC_A_MSK) >> IWM_OFDM_AGC_A_POS; 2187 agc_b = (val & IWM_OFDM_AGC_B_MSK) >> IWM_OFDM_AGC_B_POS; 2188 2189 val = le32toh(phy_info->non_cfg_phy[IWM_RX_INFO_RSSI_AB_IDX]); 2190 rssi_a = (val & IWM_OFDM_RSSI_INBAND_A_MSK) >> IWM_OFDM_RSSI_A_POS; 2191 rssi_b = (val & IWM_OFDM_RSSI_INBAND_B_MSK) >> IWM_OFDM_RSSI_B_POS; 2192 2193 /* 2194 * dBm = rssi dB - agc dB - constant. 2195 * Higher AGC (higher radio gain) means lower signal. 2196 */ 2197 rssi_a_dbm = rssi_a - IWM_RSSI_OFFSET - agc_a; 2198 rssi_b_dbm = rssi_b - IWM_RSSI_OFFSET - agc_b; 2199 max_rssi_dbm = MAX(rssi_a_dbm, rssi_b_dbm); 2200 2201 IWM_DPRINTF(sc, IWM_DEBUG_RECV, 2202 "Rssi In A %d B %d Max %d AGCA %d AGCB %d\n", 2203 rssi_a_dbm, rssi_b_dbm, max_rssi_dbm, agc_a, agc_b); 2204 2205 return max_rssi_dbm; 2206 } 2207 2208 /* iwlwifi: mvm/rx.c */ 2209 /* 2210 * iwm_mvm_get_signal_strength - use new rx PHY INFO API 2211 * values are reported by the fw as positive values - need to negate 2212 * to obtain their dBM. Account for missing antennas by replacing 0 2213 * values by -256dBm: practically 0 power and a non-feasible 8 bit value. 2214 */ 2215 static int 2216 iwm_mvm_get_signal_strength(struct iwm_softc *sc, struct iwm_rx_phy_info *phy_info) 2217 { 2218 int energy_a, energy_b, energy_c, max_energy; 2219 uint32_t val; 2220 2221 val = le32toh(phy_info->non_cfg_phy[IWM_RX_INFO_ENERGY_ANT_ABC_IDX]); 2222 energy_a = (val & IWM_RX_INFO_ENERGY_ANT_A_MSK) >> 2223 IWM_RX_INFO_ENERGY_ANT_A_POS; 2224 energy_a = energy_a ? -energy_a : -256; 2225 energy_b = (val & IWM_RX_INFO_ENERGY_ANT_B_MSK) >> 2226 IWM_RX_INFO_ENERGY_ANT_B_POS; 2227 energy_b = energy_b ? -energy_b : -256; 2228 energy_c = (val & IWM_RX_INFO_ENERGY_ANT_C_MSK) >> 2229 IWM_RX_INFO_ENERGY_ANT_C_POS; 2230 energy_c = energy_c ? -energy_c : -256; 2231 max_energy = MAX(energy_a, energy_b); 2232 max_energy = MAX(max_energy, energy_c); 2233 2234 IWM_DPRINTF(sc, IWM_DEBUG_RECV, 2235 "energy In A %d B %d C %d , and max %d\n", 2236 energy_a, energy_b, energy_c, max_energy); 2237 2238 return max_energy; 2239 } 2240 2241 static void 2242 iwm_mvm_rx_rx_phy_cmd(struct iwm_softc *sc, 2243 struct iwm_rx_packet *pkt, struct iwm_rx_data *data) 2244 { 2245 struct iwm_rx_phy_info *phy_info = (void *)pkt->data; 2246 2247 IWM_DPRINTF(sc, IWM_DEBUG_RECV, "received PHY stats\n"); 2248 bus_dmamap_sync(sc->rxq.data_dmat, data->map, BUS_DMASYNC_POSTREAD); 2249 2250 memcpy(&sc->sc_last_phy_info, phy_info, sizeof(sc->sc_last_phy_info)); 2251 } 2252 2253 /* 2254 * Retrieve the average noise (in dBm) among receivers. 2255 */ 2256 static int 2257 iwm_get_noise(const struct iwm_mvm_statistics_rx_non_phy *stats) 2258 { 2259 int i, total, nbant, noise; 2260 2261 total = nbant = noise = 0; 2262 for (i = 0; i < 3; i++) { 2263 noise = le32toh(stats->beacon_silence_rssi[i]) & 0xff; 2264 if (noise) { 2265 total += noise; 2266 nbant++; 2267 } 2268 } 2269 2270 /* There should be at least one antenna but check anyway. */ 2271 return (nbant == 0) ? -127 : (total / nbant) - 107; 2272 } 2273 2274 /* 2275 * iwm_mvm_rx_rx_mpdu - IWM_REPLY_RX_MPDU_CMD handler 2276 * 2277 * Handles the actual data of the Rx packet from the fw 2278 */ 2279 static void 2280 iwm_mvm_rx_rx_mpdu(struct iwm_softc *sc, 2281 struct iwm_rx_packet *pkt, struct iwm_rx_data *data) 2282 { 2283 struct ieee80211com *ic = &sc->sc_ic; 2284 struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps); 2285 struct ieee80211_frame *wh; 2286 struct ieee80211_node *ni; 2287 struct ieee80211_rx_stats rxs; 2288 struct mbuf *m; 2289 struct iwm_rx_phy_info *phy_info; 2290 struct iwm_rx_mpdu_res_start *rx_res; 2291 uint32_t len; 2292 uint32_t rx_pkt_status; 2293 int rssi; 2294 2295 bus_dmamap_sync(sc->rxq.data_dmat, data->map, BUS_DMASYNC_POSTREAD); 2296 2297 phy_info = &sc->sc_last_phy_info; 2298 rx_res = (struct iwm_rx_mpdu_res_start *)pkt->data; 2299 wh = (struct ieee80211_frame *)(pkt->data + sizeof(*rx_res)); 2300 len = le16toh(rx_res->byte_count); 2301 rx_pkt_status = le32toh(*(uint32_t *)(pkt->data + sizeof(*rx_res) + len)); 2302 2303 m = data->m; 2304 m->m_data = pkt->data + sizeof(*rx_res); 2305 m->m_pkthdr.len = m->m_len = len; 2306 2307 if (__predict_false(phy_info->cfg_phy_cnt > 20)) { 2308 device_printf(sc->sc_dev, 2309 "dsp size out of range [0,20]: %d\n", 2310 phy_info->cfg_phy_cnt); 2311 return; 2312 } 2313 2314 if (!(rx_pkt_status & IWM_RX_MPDU_RES_STATUS_CRC_OK) || 2315 !(rx_pkt_status & IWM_RX_MPDU_RES_STATUS_OVERRUN_OK)) { 2316 IWM_DPRINTF(sc, IWM_DEBUG_RECV, 2317 "Bad CRC or FIFO: 0x%08X.\n", rx_pkt_status); 2318 return; /* drop */ 2319 } 2320 2321 if (sc->sc_capaflags & IWM_UCODE_TLV_FLAGS_RX_ENERGY_API) { 2322 rssi = iwm_mvm_get_signal_strength(sc, phy_info); 2323 } else { 2324 rssi = iwm_mvm_calc_rssi(sc, phy_info); 2325 } 2326 rssi = (0 - IWM_MIN_DBM) + rssi; /* normalize */ 2327 rssi = MIN(rssi, sc->sc_max_rssi); /* clip to max. 100% */ 2328 2329 /* replenish ring for the buffer we're going to feed to the sharks */ 2330 if (iwm_rx_addbuf(sc, IWM_RBUF_SIZE, sc->rxq.cur) != 0) { 2331 device_printf(sc->sc_dev, "%s: unable to add more buffers\n", 2332 __func__); 2333 return; 2334 } 2335 2336 ni = ieee80211_find_rxnode(ic, (struct ieee80211_frame_min *)wh); 2337 2338 IWM_DPRINTF(sc, IWM_DEBUG_RECV, 2339 "%s: phy_info: channel=%d, flags=0x%08x\n", 2340 __func__, 2341 le16toh(phy_info->channel), 2342 le16toh(phy_info->phy_flags)); 2343 2344 /* 2345 * Populate an RX state struct with the provided information. 2346 */ 2347 bzero(&rxs, sizeof(rxs)); 2348 rxs.r_flags |= IEEE80211_R_IEEE | IEEE80211_R_FREQ; 2349 rxs.r_flags |= IEEE80211_R_NF | IEEE80211_R_RSSI; 2350 rxs.c_ieee = le16toh(phy_info->channel); 2351 if (le16toh(phy_info->phy_flags & IWM_RX_RES_PHY_FLAGS_BAND_24)) { 2352 rxs.c_freq = ieee80211_ieee2mhz(rxs.c_ieee, IEEE80211_CHAN_2GHZ); 2353 } else { 2354 rxs.c_freq = ieee80211_ieee2mhz(rxs.c_ieee, IEEE80211_CHAN_5GHZ); 2355 } 2356 rxs.rssi = rssi - sc->sc_noise; 2357 rxs.nf = sc->sc_noise; 2358 2359 if (ieee80211_radiotap_active_vap(vap)) { 2360 struct iwm_rx_radiotap_header *tap = &sc->sc_rxtap; 2361 2362 tap->wr_flags = 0; 2363 if (phy_info->phy_flags & htole16(IWM_PHY_INFO_FLAG_SHPREAMBLE)) 2364 tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE; 2365 tap->wr_chan_freq = htole16(rxs.c_freq); 2366 /* XXX only if ic->ic_curchan->ic_ieee == rxs.c_ieee */ 2367 tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags); 2368 tap->wr_dbm_antsignal = (int8_t)rssi; 2369 tap->wr_dbm_antnoise = (int8_t)sc->sc_noise; 2370 tap->wr_tsft = phy_info->system_timestamp; 2371 switch (phy_info->rate) { 2372 /* CCK rates. */ 2373 case 10: tap->wr_rate = 2; break; 2374 case 20: tap->wr_rate = 4; break; 2375 case 55: tap->wr_rate = 11; break; 2376 case 110: tap->wr_rate = 22; break; 2377 /* OFDM rates. */ 2378 case 0xd: tap->wr_rate = 12; break; 2379 case 0xf: tap->wr_rate = 18; break; 2380 case 0x5: tap->wr_rate = 24; break; 2381 case 0x7: tap->wr_rate = 36; break; 2382 case 0x9: tap->wr_rate = 48; break; 2383 case 0xb: tap->wr_rate = 72; break; 2384 case 0x1: tap->wr_rate = 96; break; 2385 case 0x3: tap->wr_rate = 108; break; 2386 /* Unknown rate: should not happen. */ 2387 default: tap->wr_rate = 0; 2388 } 2389 } 2390 2391 IWM_UNLOCK(sc); 2392 if (ni != NULL) { 2393 IWM_DPRINTF(sc, IWM_DEBUG_RECV, "input m %p\n", m); 2394 ieee80211_input_mimo(ni, m, &rxs); 2395 ieee80211_free_node(ni); 2396 } else { 2397 IWM_DPRINTF(sc, IWM_DEBUG_RECV, "inputall m %p\n", m); 2398 ieee80211_input_mimo_all(ic, m, &rxs); 2399 } 2400 IWM_LOCK(sc); 2401 } 2402 2403 static void 2404 iwm_mvm_rx_tx_cmd_single(struct iwm_softc *sc, struct iwm_rx_packet *pkt, 2405 struct iwm_node *in) 2406 { 2407 struct iwm_mvm_tx_resp *tx_resp = (void *)pkt->data; 2408 struct ieee80211vap *vap = in->in_ni.ni_vap; 2409 int status = le16toh(tx_resp->status.status) & IWM_TX_STATUS_MSK; 2410 int failack = tx_resp->failure_frame; 2411 2412 KASSERT(tx_resp->frame_count == 1, ("too many frames")); 2413 2414 /* Update rate control statistics. */ 2415 if (status != IWM_TX_STATUS_SUCCESS && 2416 status != IWM_TX_STATUS_DIRECT_DONE) { 2417 if_inc_counter(vap->iv_ifp, IFCOUNTER_OERRORS, 1); 2418 ieee80211_ratectl_tx_complete(vap, &in->in_ni, 2419 IEEE80211_RATECTL_TX_FAILURE, &failack, NULL); 2420 } else { 2421 if_inc_counter(vap->iv_ifp, IFCOUNTER_OPACKETS, 1); 2422 ieee80211_ratectl_tx_complete(vap, &in->in_ni, 2423 IEEE80211_RATECTL_TX_SUCCESS, &failack, NULL); 2424 2425 } 2426 } 2427 2428 static void 2429 iwm_mvm_rx_tx_cmd(struct iwm_softc *sc, 2430 struct iwm_rx_packet *pkt, struct iwm_rx_data *data) 2431 { 2432 struct iwm_cmd_header *cmd_hdr = &pkt->hdr; 2433 int idx = cmd_hdr->idx; 2434 int qid = cmd_hdr->qid; 2435 struct iwm_tx_ring *ring = &sc->txq[qid]; 2436 struct iwm_tx_data *txd = &ring->data[idx]; 2437 struct iwm_node *in = txd->in; 2438 2439 if (txd->done) { 2440 device_printf(sc->sc_dev, 2441 "%s: got tx interrupt that's already been handled!\n", 2442 __func__); 2443 return; 2444 } 2445 bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_POSTREAD); 2446 2447 sc->sc_tx_timer = 0; 2448 2449 iwm_mvm_rx_tx_cmd_single(sc, pkt, in); 2450 2451 /* Unmap and free mbuf. */ 2452 bus_dmamap_sync(ring->data_dmat, txd->map, BUS_DMASYNC_POSTWRITE); 2453 bus_dmamap_unload(ring->data_dmat, txd->map); 2454 m_freem(txd->m); 2455 2456 IWM_DPRINTF(sc, IWM_DEBUG_XMIT, 2457 "free txd %p, in %p\n", txd, txd->in); 2458 KASSERT(txd->done == 0, ("txd not done")); 2459 txd->done = 1; 2460 KASSERT(txd->in, ("txd without node")); 2461 2462 txd->m = NULL; 2463 txd->in = NULL; 2464 ieee80211_free_node((struct ieee80211_node *)in); 2465 2466 if (--ring->queued < IWM_TX_RING_LOMARK) { 2467 sc->qfullmsk &= ~(1 << ring->qid); 2468 if (sc->qfullmsk == 0) { 2469 /* 2470 * Well, we're in interrupt context, but then again 2471 * I guess net80211 does all sorts of stunts in 2472 * interrupt context, so maybe this is no biggie. 2473 */ 2474 iwm_start(sc); 2475 } 2476 } 2477 } 2478 2479 /* 2480 * transmit side 2481 */ 2482 2483 /* 2484 * Process a "command done" firmware notification. This is where we wakeup 2485 * processes waiting for a synchronous command completion. 2486 * from if_iwn 2487 */ 2488 static void 2489 iwm_cmd_done(struct iwm_softc *sc, struct iwm_rx_packet *pkt) 2490 { 2491 struct iwm_tx_ring *ring = &sc->txq[IWM_MVM_CMD_QUEUE]; 2492 struct iwm_tx_data *data; 2493 2494 if (pkt->hdr.qid != IWM_MVM_CMD_QUEUE) { 2495 return; /* Not a command ack. */ 2496 } 2497 2498 data = &ring->data[pkt->hdr.idx]; 2499 2500 /* If the command was mapped in an mbuf, free it. */ 2501 if (data->m != NULL) { 2502 bus_dmamap_sync(ring->data_dmat, data->map, 2503 BUS_DMASYNC_POSTWRITE); 2504 bus_dmamap_unload(ring->data_dmat, data->map); 2505 m_freem(data->m); 2506 data->m = NULL; 2507 } 2508 wakeup(&ring->desc[pkt->hdr.idx]); 2509 } 2510 2511 #if 0 2512 /* 2513 * necessary only for block ack mode 2514 */ 2515 void 2516 iwm_update_sched(struct iwm_softc *sc, int qid, int idx, uint8_t sta_id, 2517 uint16_t len) 2518 { 2519 struct iwm_agn_scd_bc_tbl *scd_bc_tbl; 2520 uint16_t w_val; 2521 2522 scd_bc_tbl = sc->sched_dma.vaddr; 2523 2524 len += 8; /* magic numbers came naturally from paris */ 2525 if (sc->sc_capaflags & IWM_UCODE_TLV_FLAGS_DW_BC_TABLE) 2526 len = roundup(len, 4) / 4; 2527 2528 w_val = htole16(sta_id << 12 | len); 2529 2530 /* Update TX scheduler. */ 2531 scd_bc_tbl[qid].tfd_offset[idx] = w_val; 2532 bus_dmamap_sync(sc->sched_dma.tag, sc->sched_dma.map, 2533 BUS_DMASYNC_PREWRITE); 2534 2535 /* I really wonder what this is ?!? */ 2536 if (idx < IWM_TFD_QUEUE_SIZE_BC_DUP) { 2537 scd_bc_tbl[qid].tfd_offset[IWM_TFD_QUEUE_SIZE_MAX + idx] = w_val; 2538 bus_dmamap_sync(sc->sched_dma.tag, sc->sched_dma.map, 2539 BUS_DMASYNC_PREWRITE); 2540 } 2541 } 2542 #endif 2543 2544 /* 2545 * Take an 802.11 (non-n) rate, find the relevant rate 2546 * table entry. return the index into in_ridx[]. 2547 * 2548 * The caller then uses that index back into in_ridx 2549 * to figure out the rate index programmed /into/ 2550 * the firmware for this given node. 2551 */ 2552 static int 2553 iwm_tx_rateidx_lookup(struct iwm_softc *sc, struct iwm_node *in, 2554 uint8_t rate) 2555 { 2556 int i; 2557 uint8_t r; 2558 2559 for (i = 0; i < nitems(in->in_ridx); i++) { 2560 r = iwm_rates[in->in_ridx[i]].rate; 2561 if (rate == r) 2562 return (i); 2563 } 2564 /* XXX Return the first */ 2565 /* XXX TODO: have it return the /lowest/ */ 2566 return (0); 2567 } 2568 2569 /* 2570 * Fill in various bit for management frames, and leave them 2571 * unfilled for data frames (firmware takes care of that). 2572 * Return the selected TX rate. 2573 */ 2574 static const struct iwm_rate * 2575 iwm_tx_fill_cmd(struct iwm_softc *sc, struct iwm_node *in, 2576 struct ieee80211_frame *wh, struct iwm_tx_cmd *tx) 2577 { 2578 struct ieee80211com *ic = &sc->sc_ic; 2579 struct ieee80211_node *ni = &in->in_ni; 2580 const struct iwm_rate *rinfo; 2581 int type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK; 2582 int ridx, rate_flags; 2583 2584 tx->rts_retry_limit = IWM_RTS_DFAULT_RETRY_LIMIT; 2585 tx->data_retry_limit = IWM_DEFAULT_TX_RETRY; 2586 2587 /* 2588 * XXX TODO: everything about the rate selection here is terrible! 2589 */ 2590 2591 if (type == IEEE80211_FC0_TYPE_DATA) { 2592 int i; 2593 /* for data frames, use RS table */ 2594 (void) ieee80211_ratectl_rate(ni, NULL, 0); 2595 i = iwm_tx_rateidx_lookup(sc, in, ni->ni_txrate); 2596 ridx = in->in_ridx[i]; 2597 2598 /* This is the index into the programmed table */ 2599 tx->initial_rate_index = i; 2600 tx->tx_flags |= htole32(IWM_TX_CMD_FLG_STA_RATE); 2601 IWM_DPRINTF(sc, IWM_DEBUG_XMIT | IWM_DEBUG_TXRATE, 2602 "%s: start with i=%d, txrate %d\n", 2603 __func__, i, iwm_rates[ridx].rate); 2604 /* XXX no rate_n_flags? */ 2605 return &iwm_rates[ridx]; 2606 } 2607 2608 /* 2609 * For non-data, use the lowest supported rate for the given 2610 * operational mode. 2611 * 2612 * Note: there may not be any rate control information available. 2613 * This driver currently assumes if we're transmitting data 2614 * frames, use the rate control table. Grr. 2615 * 2616 * XXX TODO: use the configured rate for the traffic type! 2617 */ 2618 if (ic->ic_curmode == IEEE80211_MODE_11A) { 2619 /* 2620 * XXX this assumes the mode is either 11a or not 11a; 2621 * definitely won't work for 11n. 2622 */ 2623 ridx = IWM_RIDX_OFDM; 2624 } else { 2625 ridx = IWM_RIDX_CCK; 2626 } 2627 2628 rinfo = &iwm_rates[ridx]; 2629 2630 IWM_DPRINTF(sc, IWM_DEBUG_TXRATE, "%s: ridx=%d; rate=%d, CCK=%d\n", 2631 __func__, ridx, 2632 rinfo->rate, 2633 !! (IWM_RIDX_IS_CCK(ridx)) 2634 ); 2635 2636 /* XXX TODO: hard-coded TX antenna? */ 2637 rate_flags = 1 << IWM_RATE_MCS_ANT_POS; 2638 if (IWM_RIDX_IS_CCK(ridx)) 2639 rate_flags |= IWM_RATE_MCS_CCK_MSK; 2640 /* XXX hard-coded tx rate */ 2641 tx->rate_n_flags = htole32(rate_flags | rinfo->plcp); 2642 2643 return rinfo; 2644 } 2645 2646 #define TB0_SIZE 16 2647 static int 2648 iwm_tx(struct iwm_softc *sc, struct mbuf *m, struct ieee80211_node *ni, int ac) 2649 { 2650 struct ieee80211com *ic = &sc->sc_ic; 2651 struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps); 2652 struct iwm_node *in = (struct iwm_node *)ni; 2653 struct iwm_tx_ring *ring; 2654 struct iwm_tx_data *data; 2655 struct iwm_tfd *desc; 2656 struct iwm_device_cmd *cmd; 2657 struct iwm_tx_cmd *tx; 2658 struct ieee80211_frame *wh; 2659 struct ieee80211_key *k = NULL; 2660 struct mbuf *m1; 2661 const struct iwm_rate *rinfo; 2662 uint32_t flags; 2663 u_int hdrlen; 2664 bus_dma_segment_t *seg, segs[IWM_MAX_SCATTER]; 2665 int nsegs; 2666 uint8_t tid, type; 2667 int i, totlen, error, pad; 2668 2669 wh = mtod(m, struct ieee80211_frame *); 2670 hdrlen = ieee80211_anyhdrsize(wh); 2671 type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK; 2672 tid = 0; 2673 ring = &sc->txq[ac]; 2674 desc = &ring->desc[ring->cur]; 2675 memset(desc, 0, sizeof(*desc)); 2676 data = &ring->data[ring->cur]; 2677 2678 /* Fill out iwm_tx_cmd to send to the firmware */ 2679 cmd = &ring->cmd[ring->cur]; 2680 cmd->hdr.code = IWM_TX_CMD; 2681 cmd->hdr.flags = 0; 2682 cmd->hdr.qid = ring->qid; 2683 cmd->hdr.idx = ring->cur; 2684 2685 tx = (void *)cmd->data; 2686 memset(tx, 0, sizeof(*tx)); 2687 2688 rinfo = iwm_tx_fill_cmd(sc, in, wh, tx); 2689 2690 /* Encrypt the frame if need be. */ 2691 if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) { 2692 /* Retrieve key for TX && do software encryption. */ 2693 k = ieee80211_crypto_encap(ni, m); 2694 if (k == NULL) { 2695 m_freem(m); 2696 return (ENOBUFS); 2697 } 2698 /* 802.11 header may have moved. */ 2699 wh = mtod(m, struct ieee80211_frame *); 2700 } 2701 2702 if (ieee80211_radiotap_active_vap(vap)) { 2703 struct iwm_tx_radiotap_header *tap = &sc->sc_txtap; 2704 2705 tap->wt_flags = 0; 2706 tap->wt_chan_freq = htole16(ni->ni_chan->ic_freq); 2707 tap->wt_chan_flags = htole16(ni->ni_chan->ic_flags); 2708 tap->wt_rate = rinfo->rate; 2709 tap->wt_hwqueue = ac; 2710 if (k != NULL) 2711 tap->wt_flags |= IEEE80211_RADIOTAP_F_WEP; 2712 ieee80211_radiotap_tx(vap, m); 2713 } 2714 2715 2716 totlen = m->m_pkthdr.len; 2717 2718 flags = 0; 2719 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) { 2720 flags |= IWM_TX_CMD_FLG_ACK; 2721 } 2722 2723 if (type != IEEE80211_FC0_TYPE_DATA 2724 && (totlen + IEEE80211_CRC_LEN > vap->iv_rtsthreshold) 2725 && !IEEE80211_IS_MULTICAST(wh->i_addr1)) { 2726 flags |= IWM_TX_CMD_FLG_PROT_REQUIRE; 2727 } 2728 2729 if (IEEE80211_IS_MULTICAST(wh->i_addr1) || 2730 type != IEEE80211_FC0_TYPE_DATA) 2731 tx->sta_id = sc->sc_aux_sta.sta_id; 2732 else 2733 tx->sta_id = IWM_STATION_ID; 2734 2735 if (type == IEEE80211_FC0_TYPE_MGT) { 2736 uint8_t subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK; 2737 2738 if (subtype == IEEE80211_FC0_SUBTYPE_ASSOC_REQ || 2739 subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) 2740 tx->pm_frame_timeout = htole16(3); 2741 else 2742 tx->pm_frame_timeout = htole16(2); 2743 } else { 2744 tx->pm_frame_timeout = htole16(0); 2745 } 2746 2747 if (hdrlen & 3) { 2748 /* First segment length must be a multiple of 4. */ 2749 flags |= IWM_TX_CMD_FLG_MH_PAD; 2750 pad = 4 - (hdrlen & 3); 2751 } else 2752 pad = 0; 2753 2754 tx->driver_txop = 0; 2755 tx->next_frame_len = 0; 2756 2757 tx->len = htole16(totlen); 2758 tx->tid_tspec = tid; 2759 tx->life_time = htole32(IWM_TX_CMD_LIFE_TIME_INFINITE); 2760 2761 /* Set physical address of "scratch area". */ 2762 tx->dram_lsb_ptr = htole32(data->scratch_paddr); 2763 tx->dram_msb_ptr = iwm_get_dma_hi_addr(data->scratch_paddr); 2764 2765 /* Copy 802.11 header in TX command. */ 2766 memcpy(((uint8_t *)tx) + sizeof(*tx), wh, hdrlen); 2767 2768 flags |= IWM_TX_CMD_FLG_BT_DIS | IWM_TX_CMD_FLG_SEQ_CTL; 2769 2770 tx->sec_ctl = 0; 2771 tx->tx_flags |= htole32(flags); 2772 2773 /* Trim 802.11 header. */ 2774 m_adj(m, hdrlen); 2775 error = bus_dmamap_load_mbuf_sg(ring->data_dmat, data->map, m, 2776 segs, &nsegs, BUS_DMA_NOWAIT); 2777 if (error != 0) { 2778 if (error != EFBIG) { 2779 device_printf(sc->sc_dev, "can't map mbuf (error %d)\n", 2780 error); 2781 m_freem(m); 2782 return error; 2783 } 2784 /* Too many DMA segments, linearize mbuf. */ 2785 MGETHDR(m1, M_NOWAIT, MT_DATA); 2786 if (m1 == NULL) { 2787 m_freem(m); 2788 return ENOBUFS; 2789 } 2790 if (m->m_pkthdr.len > MHLEN) { 2791 MCLGET(m1, M_NOWAIT); 2792 if (!(m1->m_flags & M_EXT)) { 2793 m_freem(m); 2794 m_freem(m1); 2795 return ENOBUFS; 2796 } 2797 } 2798 m_copydata(m, 0, m->m_pkthdr.len, mtod(m1, void *)); 2799 m1->m_pkthdr.len = m1->m_len = m->m_pkthdr.len; 2800 m_freem(m); 2801 m = m1; 2802 error = bus_dmamap_load_mbuf_sg(ring->data_dmat, data->map, m, 2803 segs, &nsegs, BUS_DMA_NOWAIT); 2804 if (error != 0) { 2805 device_printf(sc->sc_dev, "can't map mbuf (error %d)\n", 2806 error); 2807 m_freem(m); 2808 return error; 2809 } 2810 } 2811 data->m = m; 2812 data->in = in; 2813 data->done = 0; 2814 2815 IWM_DPRINTF(sc, IWM_DEBUG_XMIT, 2816 "sending txd %p, in %p\n", data, data->in); 2817 KASSERT(data->in != NULL, ("node is NULL")); 2818 2819 IWM_DPRINTF(sc, IWM_DEBUG_XMIT, 2820 "sending data: qid=%d idx=%d len=%d nsegs=%d\n", 2821 ring->qid, ring->cur, totlen, nsegs); 2822 2823 /* Fill TX descriptor. */ 2824 desc->num_tbs = 2 + nsegs; 2825 2826 desc->tbs[0].lo = htole32(data->cmd_paddr); 2827 desc->tbs[0].hi_n_len = htole16(iwm_get_dma_hi_addr(data->cmd_paddr)) | 2828 (TB0_SIZE << 4); 2829 desc->tbs[1].lo = htole32(data->cmd_paddr + TB0_SIZE); 2830 desc->tbs[1].hi_n_len = htole16(iwm_get_dma_hi_addr(data->cmd_paddr)) | 2831 ((sizeof(struct iwm_cmd_header) + sizeof(*tx) 2832 + hdrlen + pad - TB0_SIZE) << 4); 2833 2834 /* Other DMA segments are for data payload. */ 2835 for (i = 0; i < nsegs; i++) { 2836 seg = &segs[i]; 2837 desc->tbs[i+2].lo = htole32(seg->ds_addr); 2838 desc->tbs[i+2].hi_n_len = \ 2839 htole16(iwm_get_dma_hi_addr(seg->ds_addr)) 2840 | ((seg->ds_len) << 4); 2841 } 2842 2843 bus_dmamap_sync(ring->data_dmat, data->map, 2844 BUS_DMASYNC_PREWRITE); 2845 bus_dmamap_sync(ring->cmd_dma.tag, ring->cmd_dma.map, 2846 BUS_DMASYNC_PREWRITE); 2847 bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map, 2848 BUS_DMASYNC_PREWRITE); 2849 2850 #if 0 2851 iwm_update_sched(sc, ring->qid, ring->cur, tx->sta_id, le16toh(tx->len)); 2852 #endif 2853 2854 /* Kick TX ring. */ 2855 ring->cur = (ring->cur + 1) % IWM_TX_RING_COUNT; 2856 IWM_WRITE(sc, IWM_HBUS_TARG_WRPTR, ring->qid << 8 | ring->cur); 2857 2858 /* Mark TX ring as full if we reach a certain threshold. */ 2859 if (++ring->queued > IWM_TX_RING_HIMARK) { 2860 sc->qfullmsk |= 1 << ring->qid; 2861 } 2862 2863 return 0; 2864 } 2865 2866 static int 2867 iwm_raw_xmit(struct ieee80211_node *ni, struct mbuf *m, 2868 const struct ieee80211_bpf_params *params) 2869 { 2870 struct ieee80211com *ic = ni->ni_ic; 2871 struct iwm_softc *sc = ic->ic_softc; 2872 int error = 0; 2873 2874 IWM_DPRINTF(sc, IWM_DEBUG_XMIT, 2875 "->%s begin\n", __func__); 2876 2877 if ((sc->sc_flags & IWM_FLAG_HW_INITED) == 0) { 2878 ieee80211_free_node(ni); 2879 m_freem(m); 2880 IWM_DPRINTF(sc, IWM_DEBUG_XMIT, 2881 "<-%s not RUNNING\n", __func__); 2882 return (ENETDOWN); 2883 } 2884 2885 IWM_LOCK(sc); 2886 /* XXX fix this */ 2887 if (params == NULL) { 2888 error = iwm_tx(sc, m, ni, 0); 2889 } else { 2890 error = iwm_tx(sc, m, ni, 0); 2891 } 2892 if (error != 0) { 2893 /* NB: m is reclaimed on tx failure */ 2894 ieee80211_free_node(ni); 2895 } 2896 sc->sc_tx_timer = 5; 2897 IWM_UNLOCK(sc); 2898 2899 return (error); 2900 } 2901 2902 /* 2903 * mvm/tx.c 2904 */ 2905 2906 #if 0 2907 /* 2908 * Note that there are transports that buffer frames before they reach 2909 * the firmware. This means that after flush_tx_path is called, the 2910 * queue might not be empty. The race-free way to handle this is to: 2911 * 1) set the station as draining 2912 * 2) flush the Tx path 2913 * 3) wait for the transport queues to be empty 2914 */ 2915 int 2916 iwm_mvm_flush_tx_path(struct iwm_softc *sc, int tfd_msk, int sync) 2917 { 2918 struct iwm_tx_path_flush_cmd flush_cmd = { 2919 .queues_ctl = htole32(tfd_msk), 2920 .flush_ctl = htole16(IWM_DUMP_TX_FIFO_FLUSH), 2921 }; 2922 int ret; 2923 2924 ret = iwm_mvm_send_cmd_pdu(sc, IWM_TXPATH_FLUSH, 2925 sync ? IWM_CMD_SYNC : IWM_CMD_ASYNC, 2926 sizeof(flush_cmd), &flush_cmd); 2927 if (ret) 2928 device_printf(sc->sc_dev, 2929 "Flushing tx queue failed: %d\n", ret); 2930 return ret; 2931 } 2932 #endif 2933 2934 /* 2935 * BEGIN mvm/sta.c 2936 */ 2937 2938 static void 2939 iwm_mvm_add_sta_cmd_v6_to_v5(struct iwm_mvm_add_sta_cmd_v6 *cmd_v6, 2940 struct iwm_mvm_add_sta_cmd_v5 *cmd_v5) 2941 { 2942 memset(cmd_v5, 0, sizeof(*cmd_v5)); 2943 2944 cmd_v5->add_modify = cmd_v6->add_modify; 2945 cmd_v5->tid_disable_tx = cmd_v6->tid_disable_tx; 2946 cmd_v5->mac_id_n_color = cmd_v6->mac_id_n_color; 2947 IEEE80211_ADDR_COPY(cmd_v5->addr, cmd_v6->addr); 2948 cmd_v5->sta_id = cmd_v6->sta_id; 2949 cmd_v5->modify_mask = cmd_v6->modify_mask; 2950 cmd_v5->station_flags = cmd_v6->station_flags; 2951 cmd_v5->station_flags_msk = cmd_v6->station_flags_msk; 2952 cmd_v5->add_immediate_ba_tid = cmd_v6->add_immediate_ba_tid; 2953 cmd_v5->remove_immediate_ba_tid = cmd_v6->remove_immediate_ba_tid; 2954 cmd_v5->add_immediate_ba_ssn = cmd_v6->add_immediate_ba_ssn; 2955 cmd_v5->sleep_tx_count = cmd_v6->sleep_tx_count; 2956 cmd_v5->sleep_state_flags = cmd_v6->sleep_state_flags; 2957 cmd_v5->assoc_id = cmd_v6->assoc_id; 2958 cmd_v5->beamform_flags = cmd_v6->beamform_flags; 2959 cmd_v5->tfd_queue_msk = cmd_v6->tfd_queue_msk; 2960 } 2961 2962 static int 2963 iwm_mvm_send_add_sta_cmd_status(struct iwm_softc *sc, 2964 struct iwm_mvm_add_sta_cmd_v6 *cmd, int *status) 2965 { 2966 struct iwm_mvm_add_sta_cmd_v5 cmd_v5; 2967 2968 if (sc->sc_capaflags & IWM_UCODE_TLV_FLAGS_STA_KEY_CMD) { 2969 return iwm_mvm_send_cmd_pdu_status(sc, IWM_ADD_STA, 2970 sizeof(*cmd), cmd, status); 2971 } 2972 2973 iwm_mvm_add_sta_cmd_v6_to_v5(cmd, &cmd_v5); 2974 2975 return iwm_mvm_send_cmd_pdu_status(sc, IWM_ADD_STA, sizeof(cmd_v5), 2976 &cmd_v5, status); 2977 } 2978 2979 /* send station add/update command to firmware */ 2980 static int 2981 iwm_mvm_sta_send_to_fw(struct iwm_softc *sc, struct iwm_node *in, int update) 2982 { 2983 struct iwm_mvm_add_sta_cmd_v6 add_sta_cmd; 2984 int ret; 2985 uint32_t status; 2986 2987 memset(&add_sta_cmd, 0, sizeof(add_sta_cmd)); 2988 2989 add_sta_cmd.sta_id = IWM_STATION_ID; 2990 add_sta_cmd.mac_id_n_color 2991 = htole32(IWM_FW_CMD_ID_AND_COLOR(IWM_DEFAULT_MACID, 2992 IWM_DEFAULT_COLOR)); 2993 if (!update) { 2994 add_sta_cmd.tfd_queue_msk = htole32(0xf); 2995 IEEE80211_ADDR_COPY(&add_sta_cmd.addr, in->in_ni.ni_bssid); 2996 } 2997 add_sta_cmd.add_modify = update ? 1 : 0; 2998 add_sta_cmd.station_flags_msk 2999 |= htole32(IWM_STA_FLG_FAT_EN_MSK | IWM_STA_FLG_MIMO_EN_MSK); 3000 3001 status = IWM_ADD_STA_SUCCESS; 3002 ret = iwm_mvm_send_add_sta_cmd_status(sc, &add_sta_cmd, &status); 3003 if (ret) 3004 return ret; 3005 3006 switch (status) { 3007 case IWM_ADD_STA_SUCCESS: 3008 break; 3009 default: 3010 ret = EIO; 3011 device_printf(sc->sc_dev, "IWM_ADD_STA failed\n"); 3012 break; 3013 } 3014 3015 return ret; 3016 } 3017 3018 static int 3019 iwm_mvm_add_sta(struct iwm_softc *sc, struct iwm_node *in) 3020 { 3021 int ret; 3022 3023 ret = iwm_mvm_sta_send_to_fw(sc, in, 0); 3024 if (ret) 3025 return ret; 3026 3027 return 0; 3028 } 3029 3030 static int 3031 iwm_mvm_update_sta(struct iwm_softc *sc, struct iwm_node *in) 3032 { 3033 return iwm_mvm_sta_send_to_fw(sc, in, 1); 3034 } 3035 3036 static int 3037 iwm_mvm_add_int_sta_common(struct iwm_softc *sc, struct iwm_int_sta *sta, 3038 const uint8_t *addr, uint16_t mac_id, uint16_t color) 3039 { 3040 struct iwm_mvm_add_sta_cmd_v6 cmd; 3041 int ret; 3042 uint32_t status; 3043 3044 memset(&cmd, 0, sizeof(cmd)); 3045 cmd.sta_id = sta->sta_id; 3046 cmd.mac_id_n_color = htole32(IWM_FW_CMD_ID_AND_COLOR(mac_id, color)); 3047 3048 cmd.tfd_queue_msk = htole32(sta->tfd_queue_msk); 3049 3050 if (addr) 3051 IEEE80211_ADDR_COPY(cmd.addr, addr); 3052 3053 ret = iwm_mvm_send_add_sta_cmd_status(sc, &cmd, &status); 3054 if (ret) 3055 return ret; 3056 3057 switch (status) { 3058 case IWM_ADD_STA_SUCCESS: 3059 IWM_DPRINTF(sc, IWM_DEBUG_RESET, 3060 "%s: Internal station added.\n", __func__); 3061 return 0; 3062 default: 3063 device_printf(sc->sc_dev, 3064 "%s: Add internal station failed, status=0x%x\n", 3065 __func__, status); 3066 ret = EIO; 3067 break; 3068 } 3069 return ret; 3070 } 3071 3072 static int 3073 iwm_mvm_add_aux_sta(struct iwm_softc *sc) 3074 { 3075 int ret; 3076 3077 sc->sc_aux_sta.sta_id = 3; 3078 sc->sc_aux_sta.tfd_queue_msk = 0; 3079 3080 ret = iwm_mvm_add_int_sta_common(sc, 3081 &sc->sc_aux_sta, NULL, IWM_MAC_INDEX_AUX, 0); 3082 3083 if (ret) 3084 memset(&sc->sc_aux_sta, 0, sizeof(sc->sc_aux_sta)); 3085 return ret; 3086 } 3087 3088 /* 3089 * END mvm/sta.c 3090 */ 3091 3092 /* 3093 * BEGIN mvm/quota.c 3094 */ 3095 3096 static int 3097 iwm_mvm_update_quotas(struct iwm_softc *sc, struct iwm_node *in) 3098 { 3099 struct iwm_time_quota_cmd cmd; 3100 int i, idx, ret, num_active_macs, quota, quota_rem; 3101 int colors[IWM_MAX_BINDINGS] = { -1, -1, -1, -1, }; 3102 int n_ifs[IWM_MAX_BINDINGS] = {0, }; 3103 uint16_t id; 3104 3105 memset(&cmd, 0, sizeof(cmd)); 3106 3107 /* currently, PHY ID == binding ID */ 3108 if (in) { 3109 id = in->in_phyctxt->id; 3110 KASSERT(id < IWM_MAX_BINDINGS, ("invalid id")); 3111 colors[id] = in->in_phyctxt->color; 3112 3113 if (1) 3114 n_ifs[id] = 1; 3115 } 3116 3117 /* 3118 * The FW's scheduling session consists of 3119 * IWM_MVM_MAX_QUOTA fragments. Divide these fragments 3120 * equally between all the bindings that require quota 3121 */ 3122 num_active_macs = 0; 3123 for (i = 0; i < IWM_MAX_BINDINGS; i++) { 3124 cmd.quotas[i].id_and_color = htole32(IWM_FW_CTXT_INVALID); 3125 num_active_macs += n_ifs[i]; 3126 } 3127 3128 quota = 0; 3129 quota_rem = 0; 3130 if (num_active_macs) { 3131 quota = IWM_MVM_MAX_QUOTA / num_active_macs; 3132 quota_rem = IWM_MVM_MAX_QUOTA % num_active_macs; 3133 } 3134 3135 for (idx = 0, i = 0; i < IWM_MAX_BINDINGS; i++) { 3136 if (colors[i] < 0) 3137 continue; 3138 3139 cmd.quotas[idx].id_and_color = 3140 htole32(IWM_FW_CMD_ID_AND_COLOR(i, colors[i])); 3141 3142 if (n_ifs[i] <= 0) { 3143 cmd.quotas[idx].quota = htole32(0); 3144 cmd.quotas[idx].max_duration = htole32(0); 3145 } else { 3146 cmd.quotas[idx].quota = htole32(quota * n_ifs[i]); 3147 cmd.quotas[idx].max_duration = htole32(0); 3148 } 3149 idx++; 3150 } 3151 3152 /* Give the remainder of the session to the first binding */ 3153 cmd.quotas[0].quota = htole32(le32toh(cmd.quotas[0].quota) + quota_rem); 3154 3155 ret = iwm_mvm_send_cmd_pdu(sc, IWM_TIME_QUOTA_CMD, IWM_CMD_SYNC, 3156 sizeof(cmd), &cmd); 3157 if (ret) 3158 device_printf(sc->sc_dev, 3159 "%s: Failed to send quota: %d\n", __func__, ret); 3160 return ret; 3161 } 3162 3163 /* 3164 * END mvm/quota.c 3165 */ 3166 3167 /* 3168 * ieee80211 routines 3169 */ 3170 3171 /* 3172 * Change to AUTH state in 80211 state machine. Roughly matches what 3173 * Linux does in bss_info_changed(). 3174 */ 3175 static int 3176 iwm_auth(struct ieee80211vap *vap, struct iwm_softc *sc) 3177 { 3178 struct ieee80211_node *ni; 3179 struct iwm_node *in; 3180 struct iwm_vap *iv = IWM_VAP(vap); 3181 uint32_t duration; 3182 uint32_t min_duration; 3183 int error; 3184 3185 /* 3186 * XXX i have a feeling that the vap node is being 3187 * freed from underneath us. Grr. 3188 */ 3189 ni = ieee80211_ref_node(vap->iv_bss); 3190 in = (struct iwm_node *) ni; 3191 IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_STATE, 3192 "%s: called; vap=%p, bss ni=%p\n", 3193 __func__, 3194 vap, 3195 ni); 3196 3197 in->in_assoc = 0; 3198 3199 error = iwm_allow_mcast(vap, sc); 3200 if (error) { 3201 device_printf(sc->sc_dev, 3202 "%s: failed to set multicast\n", __func__); 3203 goto out; 3204 } 3205 3206 /* 3207 * This is where it deviates from what Linux does. 3208 * 3209 * Linux iwlwifi doesn't reset the nic each time, nor does it 3210 * call ctxt_add() here. Instead, it adds it during vap creation, 3211 * and always does does a mac_ctx_changed(). 3212 * 3213 * The openbsd port doesn't attempt to do that - it reset things 3214 * at odd states and does the add here. 3215 * 3216 * So, until the state handling is fixed (ie, we never reset 3217 * the NIC except for a firmware failure, which should drag 3218 * the NIC back to IDLE, re-setup and re-add all the mac/phy 3219 * contexts that are required), let's do a dirty hack here. 3220 */ 3221 if (iv->is_uploaded) { 3222 if ((error = iwm_mvm_mac_ctxt_changed(sc, vap)) != 0) { 3223 device_printf(sc->sc_dev, 3224 "%s: failed to add MAC\n", __func__); 3225 goto out; 3226 } 3227 } else { 3228 if ((error = iwm_mvm_mac_ctxt_add(sc, vap)) != 0) { 3229 device_printf(sc->sc_dev, 3230 "%s: failed to add MAC\n", __func__); 3231 goto out; 3232 } 3233 } 3234 3235 if ((error = iwm_mvm_phy_ctxt_changed(sc, &sc->sc_phyctxt[0], 3236 in->in_ni.ni_chan, 1, 1)) != 0) { 3237 device_printf(sc->sc_dev, 3238 "%s: failed add phy ctxt\n", __func__); 3239 goto out; 3240 } 3241 in->in_phyctxt = &sc->sc_phyctxt[0]; 3242 3243 if ((error = iwm_mvm_binding_add_vif(sc, in)) != 0) { 3244 device_printf(sc->sc_dev, 3245 "%s: binding cmd\n", __func__); 3246 goto out; 3247 } 3248 3249 if ((error = iwm_mvm_add_sta(sc, in)) != 0) { 3250 device_printf(sc->sc_dev, 3251 "%s: failed to add MAC\n", __func__); 3252 goto out; 3253 } 3254 3255 /* a bit superfluous? */ 3256 while (sc->sc_auth_prot) 3257 msleep(&sc->sc_auth_prot, &sc->sc_mtx, 0, "iwmauth", 0); 3258 sc->sc_auth_prot = 1; 3259 3260 duration = min(IWM_MVM_TE_SESSION_PROTECTION_MAX_TIME_MS, 3261 200 + in->in_ni.ni_intval); 3262 min_duration = min(IWM_MVM_TE_SESSION_PROTECTION_MIN_TIME_MS, 3263 100 + in->in_ni.ni_intval); 3264 iwm_mvm_protect_session(sc, in, duration, min_duration, 500); 3265 3266 IWM_DPRINTF(sc, IWM_DEBUG_RESET, 3267 "%s: waiting for auth_prot\n", __func__); 3268 while (sc->sc_auth_prot != 2) { 3269 /* 3270 * well, meh, but if the kernel is sleeping for half a 3271 * second, we have bigger problems 3272 */ 3273 if (sc->sc_auth_prot == 0) { 3274 device_printf(sc->sc_dev, 3275 "%s: missed auth window!\n", __func__); 3276 error = ETIMEDOUT; 3277 goto out; 3278 } else if (sc->sc_auth_prot == -1) { 3279 device_printf(sc->sc_dev, 3280 "%s: no time event, denied!\n", __func__); 3281 sc->sc_auth_prot = 0; 3282 error = EAUTH; 3283 goto out; 3284 } 3285 msleep(&sc->sc_auth_prot, &sc->sc_mtx, 0, "iwmau2", 0); 3286 } 3287 IWM_DPRINTF(sc, IWM_DEBUG_RESET, "<-%s\n", __func__); 3288 error = 0; 3289 out: 3290 ieee80211_free_node(ni); 3291 return (error); 3292 } 3293 3294 static int 3295 iwm_assoc(struct ieee80211vap *vap, struct iwm_softc *sc) 3296 { 3297 struct iwm_node *in = (struct iwm_node *)vap->iv_bss; 3298 int error; 3299 3300 if ((error = iwm_mvm_update_sta(sc, in)) != 0) { 3301 device_printf(sc->sc_dev, 3302 "%s: failed to update STA\n", __func__); 3303 return error; 3304 } 3305 3306 in->in_assoc = 1; 3307 if ((error = iwm_mvm_mac_ctxt_changed(sc, vap)) != 0) { 3308 device_printf(sc->sc_dev, 3309 "%s: failed to update MAC\n", __func__); 3310 return error; 3311 } 3312 3313 return 0; 3314 } 3315 3316 static int 3317 iwm_release(struct iwm_softc *sc, struct iwm_node *in) 3318 { 3319 /* 3320 * Ok, so *technically* the proper set of calls for going 3321 * from RUN back to SCAN is: 3322 * 3323 * iwm_mvm_power_mac_disable(sc, in); 3324 * iwm_mvm_mac_ctxt_changed(sc, in); 3325 * iwm_mvm_rm_sta(sc, in); 3326 * iwm_mvm_update_quotas(sc, NULL); 3327 * iwm_mvm_mac_ctxt_changed(sc, in); 3328 * iwm_mvm_binding_remove_vif(sc, in); 3329 * iwm_mvm_mac_ctxt_remove(sc, in); 3330 * 3331 * However, that freezes the device not matter which permutations 3332 * and modifications are attempted. Obviously, this driver is missing 3333 * something since it works in the Linux driver, but figuring out what 3334 * is missing is a little more complicated. Now, since we're going 3335 * back to nothing anyway, we'll just do a complete device reset. 3336 * Up your's, device! 3337 */ 3338 //iwm_mvm_flush_tx_path(sc, 0xf, 1); 3339 iwm_stop_device(sc); 3340 iwm_init_hw(sc); 3341 if (in) 3342 in->in_assoc = 0; 3343 return 0; 3344 3345 #if 0 3346 int error; 3347 3348 iwm_mvm_power_mac_disable(sc, in); 3349 3350 if ((error = iwm_mvm_mac_ctxt_changed(sc, in)) != 0) { 3351 device_printf(sc->sc_dev, "mac ctxt change fail 1 %d\n", error); 3352 return error; 3353 } 3354 3355 if ((error = iwm_mvm_rm_sta(sc, in)) != 0) { 3356 device_printf(sc->sc_dev, "sta remove fail %d\n", error); 3357 return error; 3358 } 3359 error = iwm_mvm_rm_sta(sc, in); 3360 in->in_assoc = 0; 3361 iwm_mvm_update_quotas(sc, NULL); 3362 if ((error = iwm_mvm_mac_ctxt_changed(sc, in)) != 0) { 3363 device_printf(sc->sc_dev, "mac ctxt change fail 2 %d\n", error); 3364 return error; 3365 } 3366 iwm_mvm_binding_remove_vif(sc, in); 3367 3368 iwm_mvm_mac_ctxt_remove(sc, in); 3369 3370 return error; 3371 #endif 3372 } 3373 3374 static struct ieee80211_node * 3375 iwm_node_alloc(struct ieee80211vap *vap, const uint8_t mac[IEEE80211_ADDR_LEN]) 3376 { 3377 return malloc(sizeof (struct iwm_node), M_80211_NODE, 3378 M_NOWAIT | M_ZERO); 3379 } 3380 3381 static void 3382 iwm_setrates(struct iwm_softc *sc, struct iwm_node *in) 3383 { 3384 struct ieee80211_node *ni = &in->in_ni; 3385 struct iwm_lq_cmd *lq = &in->in_lq; 3386 int nrates = ni->ni_rates.rs_nrates; 3387 int i, ridx, tab = 0; 3388 int txant = 0; 3389 3390 if (nrates > nitems(lq->rs_table)) { 3391 device_printf(sc->sc_dev, 3392 "%s: node supports %d rates, driver handles " 3393 "only %zu\n", __func__, nrates, nitems(lq->rs_table)); 3394 return; 3395 } 3396 3397 /* 3398 * XXX .. and most of iwm_node is not initialised explicitly; 3399 * it's all just 0x0 passed to the firmware. 3400 */ 3401 3402 /* first figure out which rates we should support */ 3403 /* XXX TODO: this isn't 11n aware /at all/ */ 3404 memset(&in->in_ridx, -1, sizeof(in->in_ridx)); 3405 IWM_DPRINTF(sc, IWM_DEBUG_TXRATE, 3406 "%s: nrates=%d\n", __func__, nrates); 3407 for (i = 0; i < nrates; i++) { 3408 int rate = ni->ni_rates.rs_rates[i] & IEEE80211_RATE_VAL; 3409 3410 /* Map 802.11 rate to HW rate index. */ 3411 for (ridx = 0; ridx <= IWM_RIDX_MAX; ridx++) 3412 if (iwm_rates[ridx].rate == rate) 3413 break; 3414 if (ridx > IWM_RIDX_MAX) { 3415 device_printf(sc->sc_dev, 3416 "%s: WARNING: device rate for %d not found!\n", 3417 __func__, rate); 3418 } else { 3419 IWM_DPRINTF(sc, IWM_DEBUG_TXRATE, 3420 "%s: rate: i: %d, rate=%d, ridx=%d\n", 3421 __func__, 3422 i, 3423 rate, 3424 ridx); 3425 in->in_ridx[i] = ridx; 3426 } 3427 } 3428 3429 /* then construct a lq_cmd based on those */ 3430 memset(lq, 0, sizeof(*lq)); 3431 lq->sta_id = IWM_STATION_ID; 3432 3433 /* 3434 * are these used? (we don't do SISO or MIMO) 3435 * need to set them to non-zero, though, or we get an error. 3436 */ 3437 lq->single_stream_ant_msk = 1; 3438 lq->dual_stream_ant_msk = 1; 3439 3440 /* 3441 * Build the actual rate selection table. 3442 * The lowest bits are the rates. Additionally, 3443 * CCK needs bit 9 to be set. The rest of the bits 3444 * we add to the table select the tx antenna 3445 * Note that we add the rates in the highest rate first 3446 * (opposite of ni_rates). 3447 */ 3448 /* 3449 * XXX TODO: this should be looping over the min of nrates 3450 * and LQ_MAX_RETRY_NUM. Sigh. 3451 */ 3452 for (i = 0; i < nrates; i++) { 3453 int nextant; 3454 3455 if (txant == 0) 3456 txant = IWM_FW_VALID_TX_ANT(sc); 3457 nextant = 1<<(ffs(txant)-1); 3458 txant &= ~nextant; 3459 3460 /* 3461 * Map the rate id into a rate index into 3462 * our hardware table containing the 3463 * configuration to use for this rate. 3464 */ 3465 ridx = in->in_ridx[(nrates-1)-i]; 3466 tab = iwm_rates[ridx].plcp; 3467 tab |= nextant << IWM_RATE_MCS_ANT_POS; 3468 if (IWM_RIDX_IS_CCK(ridx)) 3469 tab |= IWM_RATE_MCS_CCK_MSK; 3470 IWM_DPRINTF(sc, IWM_DEBUG_TXRATE, 3471 "station rate i=%d, rate=%d, hw=%x\n", 3472 i, iwm_rates[ridx].rate, tab); 3473 lq->rs_table[i] = htole32(tab); 3474 } 3475 /* then fill the rest with the lowest possible rate */ 3476 for (i = nrates; i < nitems(lq->rs_table); i++) { 3477 KASSERT(tab != 0, ("invalid tab")); 3478 lq->rs_table[i] = htole32(tab); 3479 } 3480 } 3481 3482 static int 3483 iwm_media_change(struct ifnet *ifp) 3484 { 3485 struct ieee80211vap *vap = ifp->if_softc; 3486 struct ieee80211com *ic = vap->iv_ic; 3487 struct iwm_softc *sc = ic->ic_softc; 3488 int error; 3489 3490 error = ieee80211_media_change(ifp); 3491 if (error != ENETRESET) 3492 return error; 3493 3494 IWM_LOCK(sc); 3495 if (ic->ic_nrunning > 0) { 3496 iwm_stop(sc); 3497 iwm_init(sc); 3498 } 3499 IWM_UNLOCK(sc); 3500 return error; 3501 } 3502 3503 3504 static int 3505 iwm_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg) 3506 { 3507 struct iwm_vap *ivp = IWM_VAP(vap); 3508 struct ieee80211com *ic = vap->iv_ic; 3509 struct iwm_softc *sc = ic->ic_softc; 3510 struct iwm_node *in; 3511 int error; 3512 3513 IWM_DPRINTF(sc, IWM_DEBUG_STATE, 3514 "switching state %s -> %s\n", 3515 ieee80211_state_name[vap->iv_state], 3516 ieee80211_state_name[nstate]); 3517 IEEE80211_UNLOCK(ic); 3518 IWM_LOCK(sc); 3519 /* disable beacon filtering if we're hopping out of RUN */ 3520 if (vap->iv_state == IEEE80211_S_RUN && nstate != vap->iv_state) { 3521 iwm_mvm_disable_beacon_filter(sc); 3522 3523 if (((in = (void *)vap->iv_bss) != NULL)) 3524 in->in_assoc = 0; 3525 3526 iwm_release(sc, NULL); 3527 3528 /* 3529 * It's impossible to directly go RUN->SCAN. If we iwm_release() 3530 * above then the card will be completely reinitialized, 3531 * so the driver must do everything necessary to bring the card 3532 * from INIT to SCAN. 3533 * 3534 * Additionally, upon receiving deauth frame from AP, 3535 * OpenBSD 802.11 stack puts the driver in IEEE80211_S_AUTH 3536 * state. This will also fail with this driver, so bring the FSM 3537 * from IEEE80211_S_RUN to IEEE80211_S_SCAN in this case as well. 3538 * 3539 * XXX TODO: fix this for FreeBSD! 3540 */ 3541 if (nstate == IEEE80211_S_SCAN || 3542 nstate == IEEE80211_S_AUTH || 3543 nstate == IEEE80211_S_ASSOC) { 3544 IWM_DPRINTF(sc, IWM_DEBUG_STATE, 3545 "Force transition to INIT; MGT=%d\n", arg); 3546 IWM_UNLOCK(sc); 3547 IEEE80211_LOCK(ic); 3548 vap->iv_newstate(vap, IEEE80211_S_INIT, arg); 3549 IWM_DPRINTF(sc, IWM_DEBUG_STATE, 3550 "Going INIT->SCAN\n"); 3551 nstate = IEEE80211_S_SCAN; 3552 IEEE80211_UNLOCK(ic); 3553 IWM_LOCK(sc); 3554 } 3555 } 3556 3557 switch (nstate) { 3558 case IEEE80211_S_INIT: 3559 sc->sc_scanband = 0; 3560 break; 3561 3562 case IEEE80211_S_AUTH: 3563 if ((error = iwm_auth(vap, sc)) != 0) { 3564 device_printf(sc->sc_dev, 3565 "%s: could not move to auth state: %d\n", 3566 __func__, error); 3567 break; 3568 } 3569 break; 3570 3571 case IEEE80211_S_ASSOC: 3572 if ((error = iwm_assoc(vap, sc)) != 0) { 3573 device_printf(sc->sc_dev, 3574 "%s: failed to associate: %d\n", __func__, 3575 error); 3576 break; 3577 } 3578 break; 3579 3580 case IEEE80211_S_RUN: 3581 { 3582 struct iwm_host_cmd cmd = { 3583 .id = IWM_LQ_CMD, 3584 .len = { sizeof(in->in_lq), }, 3585 .flags = IWM_CMD_SYNC, 3586 }; 3587 3588 /* Update the association state, now we have it all */ 3589 /* (eg associd comes in at this point */ 3590 error = iwm_assoc(vap, sc); 3591 if (error != 0) { 3592 device_printf(sc->sc_dev, 3593 "%s: failed to update association state: %d\n", 3594 __func__, 3595 error); 3596 break; 3597 } 3598 3599 in = (struct iwm_node *)vap->iv_bss; 3600 iwm_mvm_power_mac_update_mode(sc, in); 3601 iwm_mvm_enable_beacon_filter(sc, in); 3602 iwm_mvm_update_quotas(sc, in); 3603 iwm_setrates(sc, in); 3604 3605 cmd.data[0] = &in->in_lq; 3606 if ((error = iwm_send_cmd(sc, &cmd)) != 0) { 3607 device_printf(sc->sc_dev, 3608 "%s: IWM_LQ_CMD failed\n", __func__); 3609 } 3610 3611 break; 3612 } 3613 3614 default: 3615 break; 3616 } 3617 IWM_UNLOCK(sc); 3618 IEEE80211_LOCK(ic); 3619 3620 return (ivp->iv_newstate(vap, nstate, arg)); 3621 } 3622 3623 void 3624 iwm_endscan_cb(void *arg, int pending) 3625 { 3626 struct iwm_softc *sc = arg; 3627 struct ieee80211com *ic = &sc->sc_ic; 3628 int done; 3629 int error; 3630 3631 IWM_DPRINTF(sc, IWM_DEBUG_SCAN | IWM_DEBUG_TRACE, 3632 "%s: scan ended\n", 3633 __func__); 3634 3635 IWM_LOCK(sc); 3636 if (sc->sc_scanband == IEEE80211_CHAN_2GHZ && 3637 sc->sc_nvm.sku_cap_band_52GHz_enable) { 3638 done = 0; 3639 if ((error = iwm_mvm_scan_request(sc, 3640 IEEE80211_CHAN_5GHZ, 0, NULL, 0)) != 0) { 3641 device_printf(sc->sc_dev, "could not initiate scan\n"); 3642 done = 1; 3643 } 3644 } else { 3645 done = 1; 3646 } 3647 3648 if (done) { 3649 IWM_UNLOCK(sc); 3650 ieee80211_scan_done(TAILQ_FIRST(&ic->ic_vaps)); 3651 IWM_LOCK(sc); 3652 sc->sc_scanband = 0; 3653 } 3654 IWM_UNLOCK(sc); 3655 } 3656 3657 static int 3658 iwm_init_hw(struct iwm_softc *sc) 3659 { 3660 struct ieee80211com *ic = &sc->sc_ic; 3661 int error, i, qid; 3662 3663 if ((error = iwm_start_hw(sc)) != 0) 3664 return error; 3665 3666 if ((error = iwm_run_init_mvm_ucode(sc, 0)) != 0) { 3667 return error; 3668 } 3669 3670 /* 3671 * should stop and start HW since that INIT 3672 * image just loaded 3673 */ 3674 iwm_stop_device(sc); 3675 if ((error = iwm_start_hw(sc)) != 0) { 3676 device_printf(sc->sc_dev, "could not initialize hardware\n"); 3677 return error; 3678 } 3679 3680 /* omstart, this time with the regular firmware */ 3681 error = iwm_mvm_load_ucode_wait_alive(sc, IWM_UCODE_TYPE_REGULAR); 3682 if (error) { 3683 device_printf(sc->sc_dev, "could not load firmware\n"); 3684 goto error; 3685 } 3686 3687 if ((error = iwm_send_tx_ant_cfg(sc, IWM_FW_VALID_TX_ANT(sc))) != 0) 3688 goto error; 3689 3690 /* Send phy db control command and then phy db calibration*/ 3691 if ((error = iwm_send_phy_db_data(sc)) != 0) 3692 goto error; 3693 3694 if ((error = iwm_send_phy_cfg_cmd(sc)) != 0) 3695 goto error; 3696 3697 /* Add auxiliary station for scanning */ 3698 if ((error = iwm_mvm_add_aux_sta(sc)) != 0) 3699 goto error; 3700 3701 for (i = 0; i < IWM_NUM_PHY_CTX; i++) { 3702 /* 3703 * The channel used here isn't relevant as it's 3704 * going to be overwritten in the other flows. 3705 * For now use the first channel we have. 3706 */ 3707 if ((error = iwm_mvm_phy_ctxt_add(sc, 3708 &sc->sc_phyctxt[i], &ic->ic_channels[1], 1, 1)) != 0) 3709 goto error; 3710 } 3711 3712 error = iwm_mvm_power_update_device(sc); 3713 if (error) 3714 goto error; 3715 3716 /* Mark TX rings as active. */ 3717 for (qid = 0; qid < 4; qid++) { 3718 iwm_enable_txq(sc, qid, qid); 3719 } 3720 3721 return 0; 3722 3723 error: 3724 iwm_stop_device(sc); 3725 return error; 3726 } 3727 3728 /* Allow multicast from our BSSID. */ 3729 static int 3730 iwm_allow_mcast(struct ieee80211vap *vap, struct iwm_softc *sc) 3731 { 3732 struct ieee80211_node *ni = vap->iv_bss; 3733 struct iwm_mcast_filter_cmd *cmd; 3734 size_t size; 3735 int error; 3736 3737 size = roundup(sizeof(*cmd), 4); 3738 cmd = malloc(size, M_DEVBUF, M_NOWAIT | M_ZERO); 3739 if (cmd == NULL) 3740 return ENOMEM; 3741 cmd->filter_own = 1; 3742 cmd->port_id = 0; 3743 cmd->count = 0; 3744 cmd->pass_all = 1; 3745 IEEE80211_ADDR_COPY(cmd->bssid, ni->ni_bssid); 3746 3747 error = iwm_mvm_send_cmd_pdu(sc, IWM_MCAST_FILTER_CMD, 3748 IWM_CMD_SYNC, size, cmd); 3749 free(cmd, M_DEVBUF); 3750 3751 return (error); 3752 } 3753 3754 static void 3755 iwm_init(struct iwm_softc *sc) 3756 { 3757 int error; 3758 3759 if (sc->sc_flags & IWM_FLAG_HW_INITED) { 3760 return; 3761 } 3762 sc->sc_generation++; 3763 sc->sc_flags &= ~IWM_FLAG_STOPPED; 3764 3765 if ((error = iwm_init_hw(sc)) != 0) { 3766 iwm_stop(sc); 3767 return; 3768 } 3769 3770 /* 3771 * Ok, firmware loaded and we are jogging 3772 */ 3773 sc->sc_flags |= IWM_FLAG_HW_INITED; 3774 callout_reset(&sc->sc_watchdog_to, hz, iwm_watchdog, sc); 3775 } 3776 3777 static int 3778 iwm_transmit(struct ieee80211com *ic, struct mbuf *m) 3779 { 3780 struct iwm_softc *sc; 3781 int error; 3782 3783 sc = ic->ic_softc; 3784 3785 IWM_LOCK(sc); 3786 if ((sc->sc_flags & IWM_FLAG_HW_INITED) == 0) { 3787 IWM_UNLOCK(sc); 3788 return (ENXIO); 3789 } 3790 error = mbufq_enqueue(&sc->sc_snd, m); 3791 if (error) { 3792 IWM_UNLOCK(sc); 3793 return (error); 3794 } 3795 iwm_start(sc); 3796 IWM_UNLOCK(sc); 3797 return (0); 3798 } 3799 3800 /* 3801 * Dequeue packets from sendq and call send. 3802 */ 3803 static void 3804 iwm_start(struct iwm_softc *sc) 3805 { 3806 struct ieee80211_node *ni; 3807 struct mbuf *m; 3808 int ac = 0; 3809 3810 IWM_DPRINTF(sc, IWM_DEBUG_XMIT | IWM_DEBUG_TRACE, "->%s\n", __func__); 3811 while (sc->qfullmsk == 0 && 3812 (m = mbufq_dequeue(&sc->sc_snd)) != NULL) { 3813 ni = (struct ieee80211_node *)m->m_pkthdr.rcvif; 3814 if (iwm_tx(sc, m, ni, ac) != 0) { 3815 if_inc_counter(ni->ni_vap->iv_ifp, 3816 IFCOUNTER_OERRORS, 1); 3817 ieee80211_free_node(ni); 3818 continue; 3819 } 3820 sc->sc_tx_timer = 15; 3821 } 3822 IWM_DPRINTF(sc, IWM_DEBUG_XMIT | IWM_DEBUG_TRACE, "<-%s\n", __func__); 3823 } 3824 3825 static void 3826 iwm_stop(struct iwm_softc *sc) 3827 { 3828 3829 sc->sc_flags &= ~IWM_FLAG_HW_INITED; 3830 sc->sc_flags |= IWM_FLAG_STOPPED; 3831 sc->sc_generation++; 3832 sc->sc_scanband = 0; 3833 sc->sc_auth_prot = 0; 3834 sc->sc_tx_timer = 0; 3835 iwm_stop_device(sc); 3836 } 3837 3838 static void 3839 iwm_watchdog(void *arg) 3840 { 3841 struct iwm_softc *sc = arg; 3842 3843 if (sc->sc_tx_timer > 0) { 3844 if (--sc->sc_tx_timer == 0) { 3845 device_printf(sc->sc_dev, "device timeout\n"); 3846 #ifdef IWM_DEBUG 3847 iwm_nic_error(sc); 3848 #endif 3849 iwm_stop(sc); 3850 counter_u64_add(sc->sc_ic.ic_oerrors, 1); 3851 return; 3852 } 3853 } 3854 callout_reset(&sc->sc_watchdog_to, hz, iwm_watchdog, sc); 3855 } 3856 3857 static void 3858 iwm_parent(struct ieee80211com *ic) 3859 { 3860 struct iwm_softc *sc = ic->ic_softc; 3861 int startall = 0; 3862 3863 IWM_LOCK(sc); 3864 if (ic->ic_nrunning > 0) { 3865 if (!(sc->sc_flags & IWM_FLAG_HW_INITED)) { 3866 iwm_init(sc); 3867 startall = 1; 3868 } 3869 } else if (sc->sc_flags & IWM_FLAG_HW_INITED) 3870 iwm_stop(sc); 3871 IWM_UNLOCK(sc); 3872 if (startall) 3873 ieee80211_start_all(ic); 3874 } 3875 3876 /* 3877 * The interrupt side of things 3878 */ 3879 3880 /* 3881 * error dumping routines are from iwlwifi/mvm/utils.c 3882 */ 3883 3884 /* 3885 * Note: This structure is read from the device with IO accesses, 3886 * and the reading already does the endian conversion. As it is 3887 * read with uint32_t-sized accesses, any members with a different size 3888 * need to be ordered correctly though! 3889 */ 3890 struct iwm_error_event_table { 3891 uint32_t valid; /* (nonzero) valid, (0) log is empty */ 3892 uint32_t error_id; /* type of error */ 3893 uint32_t pc; /* program counter */ 3894 uint32_t blink1; /* branch link */ 3895 uint32_t blink2; /* branch link */ 3896 uint32_t ilink1; /* interrupt link */ 3897 uint32_t ilink2; /* interrupt link */ 3898 uint32_t data1; /* error-specific data */ 3899 uint32_t data2; /* error-specific data */ 3900 uint32_t data3; /* error-specific data */ 3901 uint32_t bcon_time; /* beacon timer */ 3902 uint32_t tsf_low; /* network timestamp function timer */ 3903 uint32_t tsf_hi; /* network timestamp function timer */ 3904 uint32_t gp1; /* GP1 timer register */ 3905 uint32_t gp2; /* GP2 timer register */ 3906 uint32_t gp3; /* GP3 timer register */ 3907 uint32_t ucode_ver; /* uCode version */ 3908 uint32_t hw_ver; /* HW Silicon version */ 3909 uint32_t brd_ver; /* HW board version */ 3910 uint32_t log_pc; /* log program counter */ 3911 uint32_t frame_ptr; /* frame pointer */ 3912 uint32_t stack_ptr; /* stack pointer */ 3913 uint32_t hcmd; /* last host command header */ 3914 uint32_t isr0; /* isr status register LMPM_NIC_ISR0: 3915 * rxtx_flag */ 3916 uint32_t isr1; /* isr status register LMPM_NIC_ISR1: 3917 * host_flag */ 3918 uint32_t isr2; /* isr status register LMPM_NIC_ISR2: 3919 * enc_flag */ 3920 uint32_t isr3; /* isr status register LMPM_NIC_ISR3: 3921 * time_flag */ 3922 uint32_t isr4; /* isr status register LMPM_NIC_ISR4: 3923 * wico interrupt */ 3924 uint32_t isr_pref; /* isr status register LMPM_NIC_PREF_STAT */ 3925 uint32_t wait_event; /* wait event() caller address */ 3926 uint32_t l2p_control; /* L2pControlField */ 3927 uint32_t l2p_duration; /* L2pDurationField */ 3928 uint32_t l2p_mhvalid; /* L2pMhValidBits */ 3929 uint32_t l2p_addr_match; /* L2pAddrMatchStat */ 3930 uint32_t lmpm_pmg_sel; /* indicate which clocks are turned on 3931 * (LMPM_PMG_SEL) */ 3932 uint32_t u_timestamp; /* indicate when the date and time of the 3933 * compilation */ 3934 uint32_t flow_handler; /* FH read/write pointers, RX credit */ 3935 } __packed; 3936 3937 #define ERROR_START_OFFSET (1 * sizeof(uint32_t)) 3938 #define ERROR_ELEM_SIZE (7 * sizeof(uint32_t)) 3939 3940 #ifdef IWM_DEBUG 3941 struct { 3942 const char *name; 3943 uint8_t num; 3944 } advanced_lookup[] = { 3945 { "NMI_INTERRUPT_WDG", 0x34 }, 3946 { "SYSASSERT", 0x35 }, 3947 { "UCODE_VERSION_MISMATCH", 0x37 }, 3948 { "BAD_COMMAND", 0x38 }, 3949 { "NMI_INTERRUPT_DATA_ACTION_PT", 0x3C }, 3950 { "FATAL_ERROR", 0x3D }, 3951 { "NMI_TRM_HW_ERR", 0x46 }, 3952 { "NMI_INTERRUPT_TRM", 0x4C }, 3953 { "NMI_INTERRUPT_BREAK_POINT", 0x54 }, 3954 { "NMI_INTERRUPT_WDG_RXF_FULL", 0x5C }, 3955 { "NMI_INTERRUPT_WDG_NO_RBD_RXF_FULL", 0x64 }, 3956 { "NMI_INTERRUPT_HOST", 0x66 }, 3957 { "NMI_INTERRUPT_ACTION_PT", 0x7C }, 3958 { "NMI_INTERRUPT_UNKNOWN", 0x84 }, 3959 { "NMI_INTERRUPT_INST_ACTION_PT", 0x86 }, 3960 { "ADVANCED_SYSASSERT", 0 }, 3961 }; 3962 3963 static const char * 3964 iwm_desc_lookup(uint32_t num) 3965 { 3966 int i; 3967 3968 for (i = 0; i < nitems(advanced_lookup) - 1; i++) 3969 if (advanced_lookup[i].num == num) 3970 return advanced_lookup[i].name; 3971 3972 /* No entry matches 'num', so it is the last: ADVANCED_SYSASSERT */ 3973 return advanced_lookup[i].name; 3974 } 3975 3976 /* 3977 * Support for dumping the error log seemed like a good idea ... 3978 * but it's mostly hex junk and the only sensible thing is the 3979 * hw/ucode revision (which we know anyway). Since it's here, 3980 * I'll just leave it in, just in case e.g. the Intel guys want to 3981 * help us decipher some "ADVANCED_SYSASSERT" later. 3982 */ 3983 static void 3984 iwm_nic_error(struct iwm_softc *sc) 3985 { 3986 struct iwm_error_event_table table; 3987 uint32_t base; 3988 3989 device_printf(sc->sc_dev, "dumping device error log\n"); 3990 base = sc->sc_uc.uc_error_event_table; 3991 if (base < 0x800000 || base >= 0x80C000) { 3992 device_printf(sc->sc_dev, 3993 "Not valid error log pointer 0x%08x\n", base); 3994 return; 3995 } 3996 3997 if (iwm_read_mem(sc, base, &table, sizeof(table)/sizeof(uint32_t)) != 0) { 3998 device_printf(sc->sc_dev, "reading errlog failed\n"); 3999 return; 4000 } 4001 4002 if (!table.valid) { 4003 device_printf(sc->sc_dev, "errlog not found, skipping\n"); 4004 return; 4005 } 4006 4007 if (ERROR_START_OFFSET <= table.valid * ERROR_ELEM_SIZE) { 4008 device_printf(sc->sc_dev, "Start IWL Error Log Dump:\n"); 4009 device_printf(sc->sc_dev, "Status: 0x%x, count: %d\n", 4010 sc->sc_flags, table.valid); 4011 } 4012 4013 device_printf(sc->sc_dev, "0x%08X | %-28s\n", table.error_id, 4014 iwm_desc_lookup(table.error_id)); 4015 device_printf(sc->sc_dev, "%08X | uPc\n", table.pc); 4016 device_printf(sc->sc_dev, "%08X | branchlink1\n", table.blink1); 4017 device_printf(sc->sc_dev, "%08X | branchlink2\n", table.blink2); 4018 device_printf(sc->sc_dev, "%08X | interruptlink1\n", table.ilink1); 4019 device_printf(sc->sc_dev, "%08X | interruptlink2\n", table.ilink2); 4020 device_printf(sc->sc_dev, "%08X | data1\n", table.data1); 4021 device_printf(sc->sc_dev, "%08X | data2\n", table.data2); 4022 device_printf(sc->sc_dev, "%08X | data3\n", table.data3); 4023 device_printf(sc->sc_dev, "%08X | beacon time\n", table.bcon_time); 4024 device_printf(sc->sc_dev, "%08X | tsf low\n", table.tsf_low); 4025 device_printf(sc->sc_dev, "%08X | tsf hi\n", table.tsf_hi); 4026 device_printf(sc->sc_dev, "%08X | time gp1\n", table.gp1); 4027 device_printf(sc->sc_dev, "%08X | time gp2\n", table.gp2); 4028 device_printf(sc->sc_dev, "%08X | time gp3\n", table.gp3); 4029 device_printf(sc->sc_dev, "%08X | uCode version\n", table.ucode_ver); 4030 device_printf(sc->sc_dev, "%08X | hw version\n", table.hw_ver); 4031 device_printf(sc->sc_dev, "%08X | board version\n", table.brd_ver); 4032 device_printf(sc->sc_dev, "%08X | hcmd\n", table.hcmd); 4033 device_printf(sc->sc_dev, "%08X | isr0\n", table.isr0); 4034 device_printf(sc->sc_dev, "%08X | isr1\n", table.isr1); 4035 device_printf(sc->sc_dev, "%08X | isr2\n", table.isr2); 4036 device_printf(sc->sc_dev, "%08X | isr3\n", table.isr3); 4037 device_printf(sc->sc_dev, "%08X | isr4\n", table.isr4); 4038 device_printf(sc->sc_dev, "%08X | isr_pref\n", table.isr_pref); 4039 device_printf(sc->sc_dev, "%08X | wait_event\n", table.wait_event); 4040 device_printf(sc->sc_dev, "%08X | l2p_control\n", table.l2p_control); 4041 device_printf(sc->sc_dev, "%08X | l2p_duration\n", table.l2p_duration); 4042 device_printf(sc->sc_dev, "%08X | l2p_mhvalid\n", table.l2p_mhvalid); 4043 device_printf(sc->sc_dev, "%08X | l2p_addr_match\n", table.l2p_addr_match); 4044 device_printf(sc->sc_dev, "%08X | lmpm_pmg_sel\n", table.lmpm_pmg_sel); 4045 device_printf(sc->sc_dev, "%08X | timestamp\n", table.u_timestamp); 4046 device_printf(sc->sc_dev, "%08X | flow_handler\n", table.flow_handler); 4047 } 4048 #endif 4049 4050 #define SYNC_RESP_STRUCT(_var_, _pkt_) \ 4051 do { \ 4052 bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_POSTREAD);\ 4053 _var_ = (void *)((_pkt_)+1); \ 4054 } while (/*CONSTCOND*/0) 4055 4056 #define SYNC_RESP_PTR(_ptr_, _len_, _pkt_) \ 4057 do { \ 4058 bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_POSTREAD);\ 4059 _ptr_ = (void *)((_pkt_)+1); \ 4060 } while (/*CONSTCOND*/0) 4061 4062 #define ADVANCE_RXQ(sc) (sc->rxq.cur = (sc->rxq.cur + 1) % IWM_RX_RING_COUNT); 4063 4064 /* 4065 * Process an IWM_CSR_INT_BIT_FH_RX or IWM_CSR_INT_BIT_SW_RX interrupt. 4066 * Basic structure from if_iwn 4067 */ 4068 static void 4069 iwm_notif_intr(struct iwm_softc *sc) 4070 { 4071 uint16_t hw; 4072 4073 bus_dmamap_sync(sc->rxq.stat_dma.tag, sc->rxq.stat_dma.map, 4074 BUS_DMASYNC_POSTREAD); 4075 4076 hw = le16toh(sc->rxq.stat->closed_rb_num) & 0xfff; 4077 while (sc->rxq.cur != hw) { 4078 struct iwm_rx_ring *ring = &sc->rxq; 4079 struct iwm_rx_data *data = &sc->rxq.data[sc->rxq.cur]; 4080 struct iwm_rx_packet *pkt; 4081 struct iwm_cmd_response *cresp; 4082 int qid, idx; 4083 4084 bus_dmamap_sync(sc->rxq.data_dmat, data->map, 4085 BUS_DMASYNC_POSTREAD); 4086 pkt = mtod(data->m, struct iwm_rx_packet *); 4087 4088 qid = pkt->hdr.qid & ~0x80; 4089 idx = pkt->hdr.idx; 4090 4091 IWM_DPRINTF(sc, IWM_DEBUG_INTR, 4092 "rx packet qid=%d idx=%d flags=%x type=%x %d %d\n", 4093 pkt->hdr.qid & ~0x80, pkt->hdr.idx, pkt->hdr.flags, 4094 pkt->hdr.code, sc->rxq.cur, hw); 4095 4096 /* 4097 * randomly get these from the firmware, no idea why. 4098 * they at least seem harmless, so just ignore them for now 4099 */ 4100 if (__predict_false((pkt->hdr.code == 0 && qid == 0 && idx == 0) 4101 || pkt->len_n_flags == htole32(0x55550000))) { 4102 ADVANCE_RXQ(sc); 4103 continue; 4104 } 4105 4106 switch (pkt->hdr.code) { 4107 case IWM_REPLY_RX_PHY_CMD: 4108 iwm_mvm_rx_rx_phy_cmd(sc, pkt, data); 4109 break; 4110 4111 case IWM_REPLY_RX_MPDU_CMD: 4112 iwm_mvm_rx_rx_mpdu(sc, pkt, data); 4113 break; 4114 4115 case IWM_TX_CMD: 4116 iwm_mvm_rx_tx_cmd(sc, pkt, data); 4117 break; 4118 4119 case IWM_MISSED_BEACONS_NOTIFICATION: { 4120 struct iwm_missed_beacons_notif *resp; 4121 int missed; 4122 4123 /* XXX look at mac_id to determine interface ID */ 4124 struct ieee80211com *ic = &sc->sc_ic; 4125 struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps); 4126 4127 SYNC_RESP_STRUCT(resp, pkt); 4128 missed = le32toh(resp->consec_missed_beacons); 4129 4130 IWM_DPRINTF(sc, IWM_DEBUG_BEACON | IWM_DEBUG_STATE, 4131 "%s: MISSED_BEACON: mac_id=%d, " 4132 "consec_since_last_rx=%d, consec=%d, num_expect=%d " 4133 "num_rx=%d\n", 4134 __func__, 4135 le32toh(resp->mac_id), 4136 le32toh(resp->consec_missed_beacons_since_last_rx), 4137 le32toh(resp->consec_missed_beacons), 4138 le32toh(resp->num_expected_beacons), 4139 le32toh(resp->num_recvd_beacons)); 4140 4141 /* Be paranoid */ 4142 if (vap == NULL) 4143 break; 4144 4145 /* XXX no net80211 locking? */ 4146 if (vap->iv_state == IEEE80211_S_RUN && 4147 (ic->ic_flags & IEEE80211_F_SCAN) == 0) { 4148 if (missed > vap->iv_bmissthreshold) { 4149 /* XXX bad locking; turn into task */ 4150 IWM_UNLOCK(sc); 4151 ieee80211_beacon_miss(ic); 4152 IWM_LOCK(sc); 4153 } 4154 } 4155 4156 break; } 4157 4158 case IWM_MVM_ALIVE: { 4159 struct iwm_mvm_alive_resp *resp; 4160 SYNC_RESP_STRUCT(resp, pkt); 4161 4162 sc->sc_uc.uc_error_event_table 4163 = le32toh(resp->error_event_table_ptr); 4164 sc->sc_uc.uc_log_event_table 4165 = le32toh(resp->log_event_table_ptr); 4166 sc->sched_base = le32toh(resp->scd_base_ptr); 4167 sc->sc_uc.uc_ok = resp->status == IWM_ALIVE_STATUS_OK; 4168 4169 sc->sc_uc.uc_intr = 1; 4170 wakeup(&sc->sc_uc); 4171 break; } 4172 4173 case IWM_CALIB_RES_NOTIF_PHY_DB: { 4174 struct iwm_calib_res_notif_phy_db *phy_db_notif; 4175 SYNC_RESP_STRUCT(phy_db_notif, pkt); 4176 4177 iwm_phy_db_set_section(sc, phy_db_notif); 4178 4179 break; } 4180 4181 case IWM_STATISTICS_NOTIFICATION: { 4182 struct iwm_notif_statistics *stats; 4183 SYNC_RESP_STRUCT(stats, pkt); 4184 memcpy(&sc->sc_stats, stats, sizeof(sc->sc_stats)); 4185 sc->sc_noise = iwm_get_noise(&stats->rx.general); 4186 break; } 4187 4188 case IWM_NVM_ACCESS_CMD: 4189 if (sc->sc_wantresp == ((qid << 16) | idx)) { 4190 bus_dmamap_sync(sc->rxq.data_dmat, data->map, 4191 BUS_DMASYNC_POSTREAD); 4192 memcpy(sc->sc_cmd_resp, 4193 pkt, sizeof(sc->sc_cmd_resp)); 4194 } 4195 break; 4196 4197 case IWM_PHY_CONFIGURATION_CMD: 4198 case IWM_TX_ANT_CONFIGURATION_CMD: 4199 case IWM_ADD_STA: 4200 case IWM_MAC_CONTEXT_CMD: 4201 case IWM_REPLY_SF_CFG_CMD: 4202 case IWM_POWER_TABLE_CMD: 4203 case IWM_PHY_CONTEXT_CMD: 4204 case IWM_BINDING_CONTEXT_CMD: 4205 case IWM_TIME_EVENT_CMD: 4206 case IWM_SCAN_REQUEST_CMD: 4207 case IWM_REPLY_BEACON_FILTERING_CMD: 4208 case IWM_MAC_PM_POWER_TABLE: 4209 case IWM_TIME_QUOTA_CMD: 4210 case IWM_REMOVE_STA: 4211 case IWM_TXPATH_FLUSH: 4212 case IWM_LQ_CMD: 4213 SYNC_RESP_STRUCT(cresp, pkt); 4214 if (sc->sc_wantresp == ((qid << 16) | idx)) { 4215 memcpy(sc->sc_cmd_resp, 4216 pkt, sizeof(*pkt)+sizeof(*cresp)); 4217 } 4218 break; 4219 4220 /* ignore */ 4221 case 0x6c: /* IWM_PHY_DB_CMD, no idea why it's not in fw-api.h */ 4222 break; 4223 4224 case IWM_INIT_COMPLETE_NOTIF: 4225 sc->sc_init_complete = 1; 4226 wakeup(&sc->sc_init_complete); 4227 break; 4228 4229 case IWM_SCAN_COMPLETE_NOTIFICATION: { 4230 struct iwm_scan_complete_notif *notif; 4231 SYNC_RESP_STRUCT(notif, pkt); 4232 taskqueue_enqueue(sc->sc_tq, &sc->sc_es_task); 4233 break; } 4234 4235 case IWM_REPLY_ERROR: { 4236 struct iwm_error_resp *resp; 4237 SYNC_RESP_STRUCT(resp, pkt); 4238 4239 device_printf(sc->sc_dev, 4240 "firmware error 0x%x, cmd 0x%x\n", 4241 le32toh(resp->error_type), 4242 resp->cmd_id); 4243 break; } 4244 4245 case IWM_TIME_EVENT_NOTIFICATION: { 4246 struct iwm_time_event_notif *notif; 4247 SYNC_RESP_STRUCT(notif, pkt); 4248 4249 if (notif->status) { 4250 if (le32toh(notif->action) & 4251 IWM_TE_V2_NOTIF_HOST_EVENT_START) 4252 sc->sc_auth_prot = 2; 4253 else 4254 sc->sc_auth_prot = 0; 4255 } else { 4256 sc->sc_auth_prot = -1; 4257 } 4258 IWM_DPRINTF(sc, IWM_DEBUG_INTR, 4259 "%s: time event notification auth_prot=%d\n", 4260 __func__, sc->sc_auth_prot); 4261 4262 wakeup(&sc->sc_auth_prot); 4263 break; } 4264 4265 case IWM_MCAST_FILTER_CMD: 4266 break; 4267 4268 default: 4269 device_printf(sc->sc_dev, 4270 "frame %d/%d %x UNHANDLED (this should " 4271 "not happen)\n", qid, idx, 4272 pkt->len_n_flags); 4273 break; 4274 } 4275 4276 /* 4277 * Why test bit 0x80? The Linux driver: 4278 * 4279 * There is one exception: uCode sets bit 15 when it 4280 * originates the response/notification, i.e. when the 4281 * response/notification is not a direct response to a 4282 * command sent by the driver. For example, uCode issues 4283 * IWM_REPLY_RX when it sends a received frame to the driver; 4284 * it is not a direct response to any driver command. 4285 * 4286 * Ok, so since when is 7 == 15? Well, the Linux driver 4287 * uses a slightly different format for pkt->hdr, and "qid" 4288 * is actually the upper byte of a two-byte field. 4289 */ 4290 if (!(pkt->hdr.qid & (1 << 7))) { 4291 iwm_cmd_done(sc, pkt); 4292 } 4293 4294 ADVANCE_RXQ(sc); 4295 } 4296 4297 IWM_CLRBITS(sc, IWM_CSR_GP_CNTRL, 4298 IWM_CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ); 4299 4300 /* 4301 * Tell the firmware what we have processed. 4302 * Seems like the hardware gets upset unless we align 4303 * the write by 8?? 4304 */ 4305 hw = (hw == 0) ? IWM_RX_RING_COUNT - 1 : hw - 1; 4306 IWM_WRITE(sc, IWM_FH_RSCSR_CHNL0_WPTR, hw & ~7); 4307 } 4308 4309 static void 4310 iwm_intr(void *arg) 4311 { 4312 struct iwm_softc *sc = arg; 4313 int handled = 0; 4314 int r1, r2, rv = 0; 4315 int isperiodic = 0; 4316 4317 IWM_LOCK(sc); 4318 IWM_WRITE(sc, IWM_CSR_INT_MASK, 0); 4319 4320 if (sc->sc_flags & IWM_FLAG_USE_ICT) { 4321 uint32_t *ict = sc->ict_dma.vaddr; 4322 int tmp; 4323 4324 tmp = htole32(ict[sc->ict_cur]); 4325 if (!tmp) 4326 goto out_ena; 4327 4328 /* 4329 * ok, there was something. keep plowing until we have all. 4330 */ 4331 r1 = r2 = 0; 4332 while (tmp) { 4333 r1 |= tmp; 4334 ict[sc->ict_cur] = 0; 4335 sc->ict_cur = (sc->ict_cur+1) % IWM_ICT_COUNT; 4336 tmp = htole32(ict[sc->ict_cur]); 4337 } 4338 4339 /* this is where the fun begins. don't ask */ 4340 if (r1 == 0xffffffff) 4341 r1 = 0; 4342 4343 /* i am not expected to understand this */ 4344 if (r1 & 0xc0000) 4345 r1 |= 0x8000; 4346 r1 = (0xff & r1) | ((0xff00 & r1) << 16); 4347 } else { 4348 r1 = IWM_READ(sc, IWM_CSR_INT); 4349 /* "hardware gone" (where, fishing?) */ 4350 if (r1 == 0xffffffff || (r1 & 0xfffffff0) == 0xa5a5a5a0) 4351 goto out; 4352 r2 = IWM_READ(sc, IWM_CSR_FH_INT_STATUS); 4353 } 4354 if (r1 == 0 && r2 == 0) { 4355 goto out_ena; 4356 } 4357 4358 IWM_WRITE(sc, IWM_CSR_INT, r1 | ~sc->sc_intmask); 4359 4360 /* ignored */ 4361 handled |= (r1 & (IWM_CSR_INT_BIT_ALIVE /*| IWM_CSR_INT_BIT_SCD*/)); 4362 4363 if (r1 & IWM_CSR_INT_BIT_SW_ERR) { 4364 #ifdef IWM_DEBUG 4365 int i; 4366 struct ieee80211com *ic = &sc->sc_ic; 4367 struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps); 4368 4369 iwm_nic_error(sc); 4370 4371 /* Dump driver status (TX and RX rings) while we're here. */ 4372 device_printf(sc->sc_dev, "driver status:\n"); 4373 for (i = 0; i < IWM_MVM_MAX_QUEUES; i++) { 4374 struct iwm_tx_ring *ring = &sc->txq[i]; 4375 device_printf(sc->sc_dev, 4376 " tx ring %2d: qid=%-2d cur=%-3d " 4377 "queued=%-3d\n", 4378 i, ring->qid, ring->cur, ring->queued); 4379 } 4380 device_printf(sc->sc_dev, 4381 " rx ring: cur=%d\n", sc->rxq.cur); 4382 device_printf(sc->sc_dev, 4383 " 802.11 state %d\n", vap->iv_state); 4384 #endif 4385 4386 device_printf(sc->sc_dev, "fatal firmware error\n"); 4387 iwm_stop(sc); 4388 rv = 1; 4389 goto out; 4390 4391 } 4392 4393 if (r1 & IWM_CSR_INT_BIT_HW_ERR) { 4394 handled |= IWM_CSR_INT_BIT_HW_ERR; 4395 device_printf(sc->sc_dev, "hardware error, stopping device\n"); 4396 iwm_stop(sc); 4397 rv = 1; 4398 goto out; 4399 } 4400 4401 /* firmware chunk loaded */ 4402 if (r1 & IWM_CSR_INT_BIT_FH_TX) { 4403 IWM_WRITE(sc, IWM_CSR_FH_INT_STATUS, IWM_CSR_FH_INT_TX_MASK); 4404 handled |= IWM_CSR_INT_BIT_FH_TX; 4405 sc->sc_fw_chunk_done = 1; 4406 wakeup(&sc->sc_fw); 4407 } 4408 4409 if (r1 & IWM_CSR_INT_BIT_RF_KILL) { 4410 handled |= IWM_CSR_INT_BIT_RF_KILL; 4411 if (iwm_check_rfkill(sc)) { 4412 device_printf(sc->sc_dev, 4413 "%s: rfkill switch, disabling interface\n", 4414 __func__); 4415 iwm_stop(sc); 4416 } 4417 } 4418 4419 /* 4420 * The Linux driver uses periodic interrupts to avoid races. 4421 * We cargo-cult like it's going out of fashion. 4422 */ 4423 if (r1 & IWM_CSR_INT_BIT_RX_PERIODIC) { 4424 handled |= IWM_CSR_INT_BIT_RX_PERIODIC; 4425 IWM_WRITE(sc, IWM_CSR_INT, IWM_CSR_INT_BIT_RX_PERIODIC); 4426 if ((r1 & (IWM_CSR_INT_BIT_FH_RX | IWM_CSR_INT_BIT_SW_RX)) == 0) 4427 IWM_WRITE_1(sc, 4428 IWM_CSR_INT_PERIODIC_REG, IWM_CSR_INT_PERIODIC_DIS); 4429 isperiodic = 1; 4430 } 4431 4432 if ((r1 & (IWM_CSR_INT_BIT_FH_RX | IWM_CSR_INT_BIT_SW_RX)) || isperiodic) { 4433 handled |= (IWM_CSR_INT_BIT_FH_RX | IWM_CSR_INT_BIT_SW_RX); 4434 IWM_WRITE(sc, IWM_CSR_FH_INT_STATUS, IWM_CSR_FH_INT_RX_MASK); 4435 4436 iwm_notif_intr(sc); 4437 4438 /* enable periodic interrupt, see above */ 4439 if (r1 & (IWM_CSR_INT_BIT_FH_RX | IWM_CSR_INT_BIT_SW_RX) && !isperiodic) 4440 IWM_WRITE_1(sc, IWM_CSR_INT_PERIODIC_REG, 4441 IWM_CSR_INT_PERIODIC_ENA); 4442 } 4443 4444 if (__predict_false(r1 & ~handled)) 4445 IWM_DPRINTF(sc, IWM_DEBUG_INTR, 4446 "%s: unhandled interrupts: %x\n", __func__, r1); 4447 rv = 1; 4448 4449 out_ena: 4450 iwm_restore_interrupts(sc); 4451 out: 4452 IWM_UNLOCK(sc); 4453 return; 4454 } 4455 4456 /* 4457 * Autoconf glue-sniffing 4458 */ 4459 #define PCI_VENDOR_INTEL 0x8086 4460 #define PCI_PRODUCT_INTEL_WL_3160_1 0x08b3 4461 #define PCI_PRODUCT_INTEL_WL_3160_2 0x08b4 4462 #define PCI_PRODUCT_INTEL_WL_7260_1 0x08b1 4463 #define PCI_PRODUCT_INTEL_WL_7260_2 0x08b2 4464 #define PCI_PRODUCT_INTEL_WL_7265_1 0x095a 4465 #define PCI_PRODUCT_INTEL_WL_7265_2 0x095b 4466 4467 static const struct iwm_devices { 4468 uint16_t device; 4469 const char *name; 4470 } iwm_devices[] = { 4471 { PCI_PRODUCT_INTEL_WL_3160_1, "Intel Dual Band Wireless AC 3160" }, 4472 { PCI_PRODUCT_INTEL_WL_3160_2, "Intel Dual Band Wireless AC 3160" }, 4473 { PCI_PRODUCT_INTEL_WL_7260_1, "Intel Dual Band Wireless AC 7260" }, 4474 { PCI_PRODUCT_INTEL_WL_7260_2, "Intel Dual Band Wireless AC 7260" }, 4475 { PCI_PRODUCT_INTEL_WL_7265_1, "Intel Dual Band Wireless AC 7265" }, 4476 { PCI_PRODUCT_INTEL_WL_7265_2, "Intel Dual Band Wireless AC 7265" }, 4477 }; 4478 4479 static int 4480 iwm_probe(device_t dev) 4481 { 4482 int i; 4483 4484 for (i = 0; i < nitems(iwm_devices); i++) 4485 if (pci_get_vendor(dev) == PCI_VENDOR_INTEL && 4486 pci_get_device(dev) == iwm_devices[i].device) { 4487 device_set_desc(dev, iwm_devices[i].name); 4488 return (BUS_PROBE_DEFAULT); 4489 } 4490 4491 return (ENXIO); 4492 } 4493 4494 static int 4495 iwm_dev_check(device_t dev) 4496 { 4497 struct iwm_softc *sc; 4498 4499 sc = device_get_softc(dev); 4500 4501 switch (pci_get_device(dev)) { 4502 case PCI_PRODUCT_INTEL_WL_3160_1: 4503 case PCI_PRODUCT_INTEL_WL_3160_2: 4504 sc->sc_fwname = "iwm3160fw"; 4505 sc->host_interrupt_operation_mode = 1; 4506 return (0); 4507 case PCI_PRODUCT_INTEL_WL_7260_1: 4508 case PCI_PRODUCT_INTEL_WL_7260_2: 4509 sc->sc_fwname = "iwm7260fw"; 4510 sc->host_interrupt_operation_mode = 1; 4511 return (0); 4512 case PCI_PRODUCT_INTEL_WL_7265_1: 4513 case PCI_PRODUCT_INTEL_WL_7265_2: 4514 sc->sc_fwname = "iwm7265fw"; 4515 sc->host_interrupt_operation_mode = 0; 4516 return (0); 4517 default: 4518 device_printf(dev, "unknown adapter type\n"); 4519 return ENXIO; 4520 } 4521 } 4522 4523 static int 4524 iwm_pci_attach(device_t dev) 4525 { 4526 struct iwm_softc *sc; 4527 int count, error, rid; 4528 uint16_t reg; 4529 4530 sc = device_get_softc(dev); 4531 4532 /* Clear device-specific "PCI retry timeout" register (41h). */ 4533 reg = pci_read_config(dev, 0x40, sizeof(reg)); 4534 pci_write_config(dev, 0x40, reg & ~0xff00, sizeof(reg)); 4535 4536 /* Enable bus-mastering and hardware bug workaround. */ 4537 pci_enable_busmaster(dev); 4538 reg = pci_read_config(dev, PCIR_STATUS, sizeof(reg)); 4539 /* if !MSI */ 4540 if (reg & PCIM_STATUS_INTxSTATE) { 4541 reg &= ~PCIM_STATUS_INTxSTATE; 4542 } 4543 pci_write_config(dev, PCIR_STATUS, reg, sizeof(reg)); 4544 4545 rid = PCIR_BAR(0); 4546 sc->sc_mem = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &rid, 4547 RF_ACTIVE); 4548 if (sc->sc_mem == NULL) { 4549 device_printf(sc->sc_dev, "can't map mem space\n"); 4550 return (ENXIO); 4551 } 4552 sc->sc_st = rman_get_bustag(sc->sc_mem); 4553 sc->sc_sh = rman_get_bushandle(sc->sc_mem); 4554 4555 /* Install interrupt handler. */ 4556 count = 1; 4557 rid = 0; 4558 if (pci_alloc_msi(dev, &count) == 0) 4559 rid = 1; 4560 sc->sc_irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &rid, RF_ACTIVE | 4561 (rid != 0 ? 0 : RF_SHAREABLE)); 4562 if (sc->sc_irq == NULL) { 4563 device_printf(dev, "can't map interrupt\n"); 4564 return (ENXIO); 4565 } 4566 error = bus_setup_intr(dev, sc->sc_irq, INTR_TYPE_NET | INTR_MPSAFE, 4567 NULL, iwm_intr, sc, &sc->sc_ih); 4568 if (sc->sc_ih == NULL) { 4569 device_printf(dev, "can't establish interrupt"); 4570 return (ENXIO); 4571 } 4572 sc->sc_dmat = bus_get_dma_tag(sc->sc_dev); 4573 4574 return (0); 4575 } 4576 4577 static void 4578 iwm_pci_detach(device_t dev) 4579 { 4580 struct iwm_softc *sc = device_get_softc(dev); 4581 4582 if (sc->sc_irq != NULL) { 4583 bus_teardown_intr(dev, sc->sc_irq, sc->sc_ih); 4584 bus_release_resource(dev, SYS_RES_IRQ, 4585 rman_get_rid(sc->sc_irq), sc->sc_irq); 4586 pci_release_msi(dev); 4587 } 4588 if (sc->sc_mem != NULL) 4589 bus_release_resource(dev, SYS_RES_MEMORY, 4590 rman_get_rid(sc->sc_mem), sc->sc_mem); 4591 } 4592 4593 4594 4595 static int 4596 iwm_attach(device_t dev) 4597 { 4598 struct iwm_softc *sc = device_get_softc(dev); 4599 struct ieee80211com *ic = &sc->sc_ic; 4600 int error; 4601 int txq_i, i; 4602 4603 sc->sc_dev = dev; 4604 mtx_init(&sc->sc_mtx, "iwm_mtx", MTX_DEF, 0); 4605 mbufq_init(&sc->sc_snd, ifqmaxlen); 4606 callout_init_mtx(&sc->sc_watchdog_to, &sc->sc_mtx, 0); 4607 TASK_INIT(&sc->sc_es_task, 0, iwm_endscan_cb, sc); 4608 sc->sc_tq = taskqueue_create("iwm_taskq", M_WAITOK, 4609 taskqueue_thread_enqueue, &sc->sc_tq); 4610 error = taskqueue_start_threads(&sc->sc_tq, 1, 0, "iwm_taskq"); 4611 if (error != 0) { 4612 device_printf(dev, "can't start threads, error %d\n", 4613 error); 4614 goto fail; 4615 } 4616 4617 /* PCI attach */ 4618 error = iwm_pci_attach(dev); 4619 if (error != 0) 4620 goto fail; 4621 4622 sc->sc_wantresp = -1; 4623 4624 /* Check device type */ 4625 error = iwm_dev_check(dev); 4626 if (error != 0) 4627 goto fail; 4628 4629 sc->sc_fwdmasegsz = IWM_FWDMASEGSZ; 4630 4631 /* 4632 * We now start fiddling with the hardware 4633 */ 4634 sc->sc_hw_rev = IWM_READ(sc, IWM_CSR_HW_REV); 4635 if (iwm_prepare_card_hw(sc) != 0) { 4636 device_printf(dev, "could not initialize hardware\n"); 4637 goto fail; 4638 } 4639 4640 /* Allocate DMA memory for firmware transfers. */ 4641 if ((error = iwm_alloc_fwmem(sc)) != 0) { 4642 device_printf(dev, "could not allocate memory for firmware\n"); 4643 goto fail; 4644 } 4645 4646 /* Allocate "Keep Warm" page. */ 4647 if ((error = iwm_alloc_kw(sc)) != 0) { 4648 device_printf(dev, "could not allocate keep warm page\n"); 4649 goto fail; 4650 } 4651 4652 /* We use ICT interrupts */ 4653 if ((error = iwm_alloc_ict(sc)) != 0) { 4654 device_printf(dev, "could not allocate ICT table\n"); 4655 goto fail; 4656 } 4657 4658 /* Allocate TX scheduler "rings". */ 4659 if ((error = iwm_alloc_sched(sc)) != 0) { 4660 device_printf(dev, "could not allocate TX scheduler rings\n"); 4661 goto fail; 4662 } 4663 4664 /* Allocate TX rings */ 4665 for (txq_i = 0; txq_i < nitems(sc->txq); txq_i++) { 4666 if ((error = iwm_alloc_tx_ring(sc, 4667 &sc->txq[txq_i], txq_i)) != 0) { 4668 device_printf(dev, 4669 "could not allocate TX ring %d\n", 4670 txq_i); 4671 goto fail; 4672 } 4673 } 4674 4675 /* Allocate RX ring. */ 4676 if ((error = iwm_alloc_rx_ring(sc, &sc->rxq)) != 0) { 4677 device_printf(dev, "could not allocate RX ring\n"); 4678 goto fail; 4679 } 4680 4681 /* Clear pending interrupts. */ 4682 IWM_WRITE(sc, IWM_CSR_INT, 0xffffffff); 4683 4684 ic->ic_softc = sc; 4685 ic->ic_name = device_get_nameunit(sc->sc_dev); 4686 ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */ 4687 ic->ic_opmode = IEEE80211_M_STA; /* default to BSS mode */ 4688 4689 /* Set device capabilities. */ 4690 ic->ic_caps = 4691 IEEE80211_C_STA | 4692 IEEE80211_C_WPA | /* WPA/RSN */ 4693 IEEE80211_C_WME | 4694 IEEE80211_C_SHSLOT | /* short slot time supported */ 4695 IEEE80211_C_SHPREAMBLE /* short preamble supported */ 4696 // IEEE80211_C_BGSCAN /* capable of bg scanning */ 4697 ; 4698 for (i = 0; i < nitems(sc->sc_phyctxt); i++) { 4699 sc->sc_phyctxt[i].id = i; 4700 sc->sc_phyctxt[i].color = 0; 4701 sc->sc_phyctxt[i].ref = 0; 4702 sc->sc_phyctxt[i].channel = NULL; 4703 } 4704 4705 /* Max RSSI */ 4706 sc->sc_max_rssi = IWM_MAX_DBM - IWM_MIN_DBM; 4707 sc->sc_preinit_hook.ich_func = iwm_preinit; 4708 sc->sc_preinit_hook.ich_arg = sc; 4709 if (config_intrhook_establish(&sc->sc_preinit_hook) != 0) { 4710 device_printf(dev, "config_intrhook_establish failed\n"); 4711 goto fail; 4712 } 4713 4714 #ifdef IWM_DEBUG 4715 SYSCTL_ADD_INT(device_get_sysctl_ctx(dev), 4716 SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO, "debug", 4717 CTLFLAG_RW, &sc->sc_debug, 0, "control debugging"); 4718 #endif 4719 4720 IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_TRACE, 4721 "<-%s\n", __func__); 4722 4723 return 0; 4724 4725 /* Free allocated memory if something failed during attachment. */ 4726 fail: 4727 iwm_detach_local(sc, 0); 4728 4729 return ENXIO; 4730 } 4731 4732 static int 4733 iwm_update_edca(struct ieee80211com *ic) 4734 { 4735 struct iwm_softc *sc = ic->ic_softc; 4736 4737 device_printf(sc->sc_dev, "%s: called\n", __func__); 4738 return (0); 4739 } 4740 4741 static void 4742 iwm_preinit(void *arg) 4743 { 4744 struct iwm_softc *sc = arg; 4745 device_t dev = sc->sc_dev; 4746 struct ieee80211com *ic = &sc->sc_ic; 4747 int error; 4748 4749 IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_TRACE, 4750 "->%s\n", __func__); 4751 4752 IWM_LOCK(sc); 4753 if ((error = iwm_start_hw(sc)) != 0) { 4754 device_printf(dev, "could not initialize hardware\n"); 4755 IWM_UNLOCK(sc); 4756 goto fail; 4757 } 4758 4759 error = iwm_run_init_mvm_ucode(sc, 1); 4760 iwm_stop_device(sc); 4761 if (error) { 4762 IWM_UNLOCK(sc); 4763 goto fail; 4764 } 4765 device_printf(dev, 4766 "revision: 0x%x, firmware %d.%d (API ver. %d)\n", 4767 sc->sc_hw_rev & IWM_CSR_HW_REV_TYPE_MSK, 4768 IWM_UCODE_MAJOR(sc->sc_fwver), 4769 IWM_UCODE_MINOR(sc->sc_fwver), 4770 IWM_UCODE_API(sc->sc_fwver)); 4771 4772 /* not all hardware can do 5GHz band */ 4773 if (!sc->sc_nvm.sku_cap_band_52GHz_enable) 4774 memset(&ic->ic_sup_rates[IEEE80211_MODE_11A], 0, 4775 sizeof(ic->ic_sup_rates[IEEE80211_MODE_11A])); 4776 IWM_UNLOCK(sc); 4777 4778 /* 4779 * At this point we've committed - if we fail to do setup, 4780 * we now also have to tear down the net80211 state. 4781 */ 4782 ieee80211_ifattach(ic); 4783 ic->ic_vap_create = iwm_vap_create; 4784 ic->ic_vap_delete = iwm_vap_delete; 4785 ic->ic_raw_xmit = iwm_raw_xmit; 4786 ic->ic_node_alloc = iwm_node_alloc; 4787 ic->ic_scan_start = iwm_scan_start; 4788 ic->ic_scan_end = iwm_scan_end; 4789 ic->ic_update_mcast = iwm_update_mcast; 4790 ic->ic_set_channel = iwm_set_channel; 4791 ic->ic_scan_curchan = iwm_scan_curchan; 4792 ic->ic_scan_mindwell = iwm_scan_mindwell; 4793 ic->ic_wme.wme_update = iwm_update_edca; 4794 ic->ic_parent = iwm_parent; 4795 ic->ic_transmit = iwm_transmit; 4796 iwm_radiotap_attach(sc); 4797 if (bootverbose) 4798 ieee80211_announce(ic); 4799 4800 IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_TRACE, 4801 "<-%s\n", __func__); 4802 config_intrhook_disestablish(&sc->sc_preinit_hook); 4803 4804 return; 4805 fail: 4806 config_intrhook_disestablish(&sc->sc_preinit_hook); 4807 iwm_detach_local(sc, 0); 4808 } 4809 4810 /* 4811 * Attach the interface to 802.11 radiotap. 4812 */ 4813 static void 4814 iwm_radiotap_attach(struct iwm_softc *sc) 4815 { 4816 struct ieee80211com *ic = &sc->sc_ic; 4817 4818 IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_TRACE, 4819 "->%s begin\n", __func__); 4820 ieee80211_radiotap_attach(ic, 4821 &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap), 4822 IWM_TX_RADIOTAP_PRESENT, 4823 &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap), 4824 IWM_RX_RADIOTAP_PRESENT); 4825 IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_TRACE, 4826 "->%s end\n", __func__); 4827 } 4828 4829 static struct ieee80211vap * 4830 iwm_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit, 4831 enum ieee80211_opmode opmode, int flags, 4832 const uint8_t bssid[IEEE80211_ADDR_LEN], 4833 const uint8_t mac[IEEE80211_ADDR_LEN]) 4834 { 4835 struct iwm_vap *ivp; 4836 struct ieee80211vap *vap; 4837 4838 if (!TAILQ_EMPTY(&ic->ic_vaps)) /* only one at a time */ 4839 return NULL; 4840 ivp = malloc(sizeof(struct iwm_vap), M_80211_VAP, M_WAITOK | M_ZERO); 4841 vap = &ivp->iv_vap; 4842 ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid); 4843 vap->iv_bmissthreshold = 10; /* override default */ 4844 /* Override with driver methods. */ 4845 ivp->iv_newstate = vap->iv_newstate; 4846 vap->iv_newstate = iwm_newstate; 4847 4848 ieee80211_ratectl_init(vap); 4849 /* Complete setup. */ 4850 ieee80211_vap_attach(vap, iwm_media_change, ieee80211_media_status, 4851 mac); 4852 ic->ic_opmode = opmode; 4853 4854 return vap; 4855 } 4856 4857 static void 4858 iwm_vap_delete(struct ieee80211vap *vap) 4859 { 4860 struct iwm_vap *ivp = IWM_VAP(vap); 4861 4862 ieee80211_ratectl_deinit(vap); 4863 ieee80211_vap_detach(vap); 4864 free(ivp, M_80211_VAP); 4865 } 4866 4867 static void 4868 iwm_scan_start(struct ieee80211com *ic) 4869 { 4870 struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps); 4871 struct iwm_softc *sc = ic->ic_softc; 4872 int error; 4873 4874 if (sc->sc_scanband) 4875 return; 4876 IWM_LOCK(sc); 4877 error = iwm_mvm_scan_request(sc, IEEE80211_CHAN_2GHZ, 0, NULL, 0); 4878 if (error) { 4879 device_printf(sc->sc_dev, "could not initiate scan\n"); 4880 IWM_UNLOCK(sc); 4881 ieee80211_cancel_scan(vap); 4882 } else 4883 IWM_UNLOCK(sc); 4884 } 4885 4886 static void 4887 iwm_scan_end(struct ieee80211com *ic) 4888 { 4889 } 4890 4891 static void 4892 iwm_update_mcast(struct ieee80211com *ic) 4893 { 4894 } 4895 4896 static void 4897 iwm_set_channel(struct ieee80211com *ic) 4898 { 4899 } 4900 4901 static void 4902 iwm_scan_curchan(struct ieee80211_scan_state *ss, unsigned long maxdwell) 4903 { 4904 } 4905 4906 static void 4907 iwm_scan_mindwell(struct ieee80211_scan_state *ss) 4908 { 4909 return; 4910 } 4911 4912 void 4913 iwm_init_task(void *arg1) 4914 { 4915 struct iwm_softc *sc = arg1; 4916 4917 IWM_LOCK(sc); 4918 while (sc->sc_flags & IWM_FLAG_BUSY) 4919 msleep(&sc->sc_flags, &sc->sc_mtx, 0, "iwmpwr", 0); 4920 sc->sc_flags |= IWM_FLAG_BUSY; 4921 iwm_stop(sc); 4922 if (sc->sc_ic.ic_nrunning > 0) 4923 iwm_init(sc); 4924 sc->sc_flags &= ~IWM_FLAG_BUSY; 4925 wakeup(&sc->sc_flags); 4926 IWM_UNLOCK(sc); 4927 } 4928 4929 static int 4930 iwm_resume(device_t dev) 4931 { 4932 uint16_t reg; 4933 4934 /* Clear device-specific "PCI retry timeout" register (41h). */ 4935 reg = pci_read_config(dev, 0x40, sizeof(reg)); 4936 pci_write_config(dev, 0x40, reg & ~0xff00, sizeof(reg)); 4937 iwm_init_task(device_get_softc(dev)); 4938 4939 return 0; 4940 } 4941 4942 static int 4943 iwm_suspend(device_t dev) 4944 { 4945 struct iwm_softc *sc = device_get_softc(dev); 4946 4947 if (sc->sc_ic.ic_nrunning > 0) { 4948 IWM_LOCK(sc); 4949 iwm_stop(sc); 4950 IWM_UNLOCK(sc); 4951 } 4952 4953 return (0); 4954 } 4955 4956 static int 4957 iwm_detach_local(struct iwm_softc *sc, int do_net80211) 4958 { 4959 struct iwm_fw_info *fw = &sc->sc_fw; 4960 device_t dev = sc->sc_dev; 4961 int i; 4962 4963 if (sc->sc_tq) { 4964 taskqueue_drain_all(sc->sc_tq); 4965 taskqueue_free(sc->sc_tq); 4966 } 4967 callout_drain(&sc->sc_watchdog_to); 4968 iwm_stop_device(sc); 4969 if (do_net80211) 4970 ieee80211_ifdetach(&sc->sc_ic); 4971 4972 /* Free descriptor rings */ 4973 for (i = 0; i < nitems(sc->txq); i++) 4974 iwm_free_tx_ring(sc, &sc->txq[i]); 4975 4976 /* Free firmware */ 4977 if (fw->fw_rawdata != NULL) 4978 iwm_fw_info_free(fw); 4979 4980 /* free scheduler */ 4981 iwm_free_sched(sc); 4982 if (sc->ict_dma.vaddr != NULL) 4983 iwm_free_ict(sc); 4984 if (sc->kw_dma.vaddr != NULL) 4985 iwm_free_kw(sc); 4986 if (sc->fw_dma.vaddr != NULL) 4987 iwm_free_fwmem(sc); 4988 4989 /* Finished with the hardware - detach things */ 4990 iwm_pci_detach(dev); 4991 4992 mbufq_drain(&sc->sc_snd); 4993 mtx_destroy(&sc->sc_mtx); 4994 4995 return (0); 4996 } 4997 4998 static int 4999 iwm_detach(device_t dev) 5000 { 5001 struct iwm_softc *sc = device_get_softc(dev); 5002 5003 return (iwm_detach_local(sc, 1)); 5004 } 5005 5006 static device_method_t iwm_pci_methods[] = { 5007 /* Device interface */ 5008 DEVMETHOD(device_probe, iwm_probe), 5009 DEVMETHOD(device_attach, iwm_attach), 5010 DEVMETHOD(device_detach, iwm_detach), 5011 DEVMETHOD(device_suspend, iwm_suspend), 5012 DEVMETHOD(device_resume, iwm_resume), 5013 5014 DEVMETHOD_END 5015 }; 5016 5017 static driver_t iwm_pci_driver = { 5018 "iwm", 5019 iwm_pci_methods, 5020 sizeof (struct iwm_softc) 5021 }; 5022 5023 static devclass_t iwm_devclass; 5024 5025 DRIVER_MODULE(iwm, pci, iwm_pci_driver, iwm_devclass, NULL, NULL); 5026 MODULE_DEPEND(iwm, firmware, 1, 1, 1); 5027 MODULE_DEPEND(iwm, pci, 1, 1, 1); 5028 MODULE_DEPEND(iwm, wlan, 1, 1, 1); 5029