1 /* $OpenBSD: if_iwm.c,v 1.39 2015/03/23 00:35:19 jsg Exp $ */ 2 3 /* 4 * Copyright (c) 2014 genua mbh <info@genua.de> 5 * Copyright (c) 2014 Fixup Software Ltd. 6 * 7 * Permission to use, copy, modify, and distribute this software for any 8 * purpose with or without fee is hereby granted, provided that the above 9 * copyright notice and this permission notice appear in all copies. 10 * 11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 18 */ 19 20 /*- 21 * Based on BSD-licensed source modules in the Linux iwlwifi driver, 22 * which were used as the reference documentation for this implementation. 23 * 24 * Driver version we are currently based off of is 25 * Linux 3.14.3 (tag id a2df521e42b1d9a23f620ac79dbfe8655a8391dd) 26 * 27 *********************************************************************** 28 * 29 * This file is provided under a dual BSD/GPLv2 license. When using or 30 * redistributing this file, you may do so under either license. 31 * 32 * GPL LICENSE SUMMARY 33 * 34 * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved. 35 * 36 * This program is free software; you can redistribute it and/or modify 37 * it under the terms of version 2 of the GNU General Public License as 38 * published by the Free Software Foundation. 39 * 40 * This program is distributed in the hope that it will be useful, but 41 * WITHOUT ANY WARRANTY; without even the implied warranty of 42 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 43 * General Public License for more details. 44 * 45 * You should have received a copy of the GNU General Public License 46 * along with this program; if not, write to the Free Software 47 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110, 48 * USA 49 * 50 * The full GNU General Public License is included in this distribution 51 * in the file called COPYING. 52 * 53 * Contact Information: 54 * Intel Linux Wireless <ilw@linux.intel.com> 55 * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497 56 * 57 * 58 * BSD LICENSE 59 * 60 * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved. 61 * All rights reserved. 62 * 63 * Redistribution and use in source and binary forms, with or without 64 * modification, are permitted provided that the following conditions 65 * are met: 66 * 67 * * Redistributions of source code must retain the above copyright 68 * notice, this list of conditions and the following disclaimer. 69 * * Redistributions in binary form must reproduce the above copyright 70 * notice, this list of conditions and the following disclaimer in 71 * the documentation and/or other materials provided with the 72 * distribution. 73 * * Neither the name Intel Corporation nor the names of its 74 * contributors may be used to endorse or promote products derived 75 * from this software without specific prior written permission. 76 * 77 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 78 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 79 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 80 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 81 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 82 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 83 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 84 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 85 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 86 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 87 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 88 */ 89 90 /*- 91 * Copyright (c) 2007-2010 Damien Bergamini <damien.bergamini@free.fr> 92 * 93 * Permission to use, copy, modify, and distribute this software for any 94 * purpose with or without fee is hereby granted, provided that the above 95 * copyright notice and this permission notice appear in all copies. 96 * 97 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 98 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 99 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 100 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 101 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 102 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 103 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 104 */ 105 #include <sys/cdefs.h> 106 __FBSDID("$FreeBSD$"); 107 108 #include <sys/param.h> 109 #include <sys/bus.h> 110 #include <sys/conf.h> 111 #include <sys/endian.h> 112 #include <sys/firmware.h> 113 #include <sys/kernel.h> 114 #include <sys/malloc.h> 115 #include <sys/mbuf.h> 116 #include <sys/mutex.h> 117 #include <sys/module.h> 118 #include <sys/proc.h> 119 #include <sys/rman.h> 120 #include <sys/socket.h> 121 #include <sys/sockio.h> 122 #include <sys/sysctl.h> 123 #include <sys/linker.h> 124 125 #include <machine/bus.h> 126 #include <machine/endian.h> 127 #include <machine/resource.h> 128 129 #include <dev/pci/pcivar.h> 130 #include <dev/pci/pcireg.h> 131 132 #include <net/bpf.h> 133 134 #include <net/if.h> 135 #include <net/if_var.h> 136 #include <net/if_arp.h> 137 #include <net/if_dl.h> 138 #include <net/if_media.h> 139 #include <net/if_types.h> 140 141 #include <netinet/in.h> 142 #include <netinet/in_systm.h> 143 #include <netinet/if_ether.h> 144 #include <netinet/ip.h> 145 146 #include <net80211/ieee80211_var.h> 147 #include <net80211/ieee80211_regdomain.h> 148 #include <net80211/ieee80211_ratectl.h> 149 #include <net80211/ieee80211_radiotap.h> 150 151 #include <dev/iwm/if_iwmreg.h> 152 #include <dev/iwm/if_iwmvar.h> 153 #include <dev/iwm/if_iwm_debug.h> 154 #include <dev/iwm/if_iwm_util.h> 155 #include <dev/iwm/if_iwm_binding.h> 156 #include <dev/iwm/if_iwm_phy_db.h> 157 #include <dev/iwm/if_iwm_mac_ctxt.h> 158 #include <dev/iwm/if_iwm_phy_ctxt.h> 159 #include <dev/iwm/if_iwm_time_event.h> 160 #include <dev/iwm/if_iwm_power.h> 161 #include <dev/iwm/if_iwm_scan.h> 162 163 #include <dev/iwm/if_iwm_pcie_trans.h> 164 165 const uint8_t iwm_nvm_channels[] = { 166 /* 2.4 GHz */ 167 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 168 /* 5 GHz */ 169 36, 40, 44, 48, 52, 56, 60, 64, 170 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144, 171 149, 153, 157, 161, 165 172 }; 173 #define IWM_NUM_2GHZ_CHANNELS 14 174 175 _Static_assert(nitems(iwm_nvm_channels) <= IWM_NUM_CHANNELS, 176 "IWM_NUM_CHANNELS is too small"); 177 178 /* 179 * XXX For now, there's simply a fixed set of rate table entries 180 * that are populated. 181 */ 182 const struct iwm_rate { 183 uint8_t rate; 184 uint8_t plcp; 185 } iwm_rates[] = { 186 { 2, IWM_RATE_1M_PLCP }, 187 { 4, IWM_RATE_2M_PLCP }, 188 { 11, IWM_RATE_5M_PLCP }, 189 { 22, IWM_RATE_11M_PLCP }, 190 { 12, IWM_RATE_6M_PLCP }, 191 { 18, IWM_RATE_9M_PLCP }, 192 { 24, IWM_RATE_12M_PLCP }, 193 { 36, IWM_RATE_18M_PLCP }, 194 { 48, IWM_RATE_24M_PLCP }, 195 { 72, IWM_RATE_36M_PLCP }, 196 { 96, IWM_RATE_48M_PLCP }, 197 { 108, IWM_RATE_54M_PLCP }, 198 }; 199 #define IWM_RIDX_CCK 0 200 #define IWM_RIDX_OFDM 4 201 #define IWM_RIDX_MAX (nitems(iwm_rates)-1) 202 #define IWM_RIDX_IS_CCK(_i_) ((_i_) < IWM_RIDX_OFDM) 203 #define IWM_RIDX_IS_OFDM(_i_) ((_i_) >= IWM_RIDX_OFDM) 204 205 static int iwm_store_cscheme(struct iwm_softc *, const uint8_t *, size_t); 206 static int iwm_firmware_store_section(struct iwm_softc *, 207 enum iwm_ucode_type, 208 const uint8_t *, size_t); 209 static int iwm_set_default_calib(struct iwm_softc *, const void *); 210 static void iwm_fw_info_free(struct iwm_fw_info *); 211 static int iwm_read_firmware(struct iwm_softc *, enum iwm_ucode_type); 212 static void iwm_dma_map_addr(void *, bus_dma_segment_t *, int, int); 213 static int iwm_dma_contig_alloc(bus_dma_tag_t, struct iwm_dma_info *, 214 bus_size_t, bus_size_t); 215 static void iwm_dma_contig_free(struct iwm_dma_info *); 216 static int iwm_alloc_fwmem(struct iwm_softc *); 217 static void iwm_free_fwmem(struct iwm_softc *); 218 static int iwm_alloc_sched(struct iwm_softc *); 219 static void iwm_free_sched(struct iwm_softc *); 220 static int iwm_alloc_kw(struct iwm_softc *); 221 static void iwm_free_kw(struct iwm_softc *); 222 static int iwm_alloc_ict(struct iwm_softc *); 223 static void iwm_free_ict(struct iwm_softc *); 224 static int iwm_alloc_rx_ring(struct iwm_softc *, struct iwm_rx_ring *); 225 static void iwm_reset_rx_ring(struct iwm_softc *, struct iwm_rx_ring *); 226 static void iwm_free_rx_ring(struct iwm_softc *, struct iwm_rx_ring *); 227 static int iwm_alloc_tx_ring(struct iwm_softc *, struct iwm_tx_ring *, 228 int); 229 static void iwm_reset_tx_ring(struct iwm_softc *, struct iwm_tx_ring *); 230 static void iwm_free_tx_ring(struct iwm_softc *, struct iwm_tx_ring *); 231 static void iwm_enable_interrupts(struct iwm_softc *); 232 static void iwm_restore_interrupts(struct iwm_softc *); 233 static void iwm_disable_interrupts(struct iwm_softc *); 234 static void iwm_ict_reset(struct iwm_softc *); 235 static int iwm_allow_mcast(struct ieee80211vap *, struct iwm_softc *); 236 static void iwm_stop_device(struct iwm_softc *); 237 static void iwm_mvm_nic_config(struct iwm_softc *); 238 static int iwm_nic_rx_init(struct iwm_softc *); 239 static int iwm_nic_tx_init(struct iwm_softc *); 240 static int iwm_nic_init(struct iwm_softc *); 241 static void iwm_enable_txq(struct iwm_softc *, int, int); 242 static int iwm_post_alive(struct iwm_softc *); 243 static int iwm_nvm_read_chunk(struct iwm_softc *, uint16_t, uint16_t, 244 uint16_t, uint8_t *, uint16_t *); 245 static int iwm_nvm_read_section(struct iwm_softc *, uint16_t, uint8_t *, 246 uint16_t *); 247 static uint32_t iwm_eeprom_channel_flags(uint16_t); 248 static void iwm_add_channel_band(struct iwm_softc *, 249 struct ieee80211_channel[], int, int *, int, int, 250 const uint8_t[]); 251 static void iwm_init_channel_map(struct ieee80211com *, int, int *, 252 struct ieee80211_channel[]); 253 static int iwm_parse_nvm_data(struct iwm_softc *, const uint16_t *, 254 const uint16_t *, const uint16_t *, uint8_t, 255 uint8_t); 256 struct iwm_nvm_section; 257 static int iwm_parse_nvm_sections(struct iwm_softc *, 258 struct iwm_nvm_section *); 259 static int iwm_nvm_init(struct iwm_softc *); 260 static int iwm_firmware_load_chunk(struct iwm_softc *, uint32_t, 261 const uint8_t *, uint32_t); 262 static int iwm_load_firmware(struct iwm_softc *, enum iwm_ucode_type); 263 static int iwm_start_fw(struct iwm_softc *, enum iwm_ucode_type); 264 static int iwm_fw_alive(struct iwm_softc *, uint32_t); 265 static int iwm_send_tx_ant_cfg(struct iwm_softc *, uint8_t); 266 static int iwm_send_phy_cfg_cmd(struct iwm_softc *); 267 static int iwm_mvm_load_ucode_wait_alive(struct iwm_softc *, 268 enum iwm_ucode_type); 269 static int iwm_run_init_mvm_ucode(struct iwm_softc *, int); 270 static int iwm_rx_addbuf(struct iwm_softc *, int, int); 271 static int iwm_mvm_calc_rssi(struct iwm_softc *, struct iwm_rx_phy_info *); 272 static int iwm_mvm_get_signal_strength(struct iwm_softc *, 273 struct iwm_rx_phy_info *); 274 static void iwm_mvm_rx_rx_phy_cmd(struct iwm_softc *, 275 struct iwm_rx_packet *, 276 struct iwm_rx_data *); 277 static int iwm_get_noise(const struct iwm_mvm_statistics_rx_non_phy *); 278 static void iwm_mvm_rx_rx_mpdu(struct iwm_softc *, struct iwm_rx_packet *, 279 struct iwm_rx_data *); 280 static int iwm_mvm_rx_tx_cmd_single(struct iwm_softc *, 281 struct iwm_rx_packet *, 282 struct iwm_node *); 283 static void iwm_mvm_rx_tx_cmd(struct iwm_softc *, struct iwm_rx_packet *, 284 struct iwm_rx_data *); 285 static void iwm_cmd_done(struct iwm_softc *, struct iwm_rx_packet *); 286 #if 0 287 static void iwm_update_sched(struct iwm_softc *, int, int, uint8_t, 288 uint16_t); 289 #endif 290 static const struct iwm_rate * 291 iwm_tx_fill_cmd(struct iwm_softc *, struct iwm_node *, 292 struct ieee80211_frame *, struct iwm_tx_cmd *); 293 static int iwm_tx(struct iwm_softc *, struct mbuf *, 294 struct ieee80211_node *, int); 295 static int iwm_raw_xmit(struct ieee80211_node *, struct mbuf *, 296 const struct ieee80211_bpf_params *); 297 static void iwm_mvm_add_sta_cmd_v6_to_v5(struct iwm_mvm_add_sta_cmd_v6 *, 298 struct iwm_mvm_add_sta_cmd_v5 *); 299 static int iwm_mvm_send_add_sta_cmd_status(struct iwm_softc *, 300 struct iwm_mvm_add_sta_cmd_v6 *, 301 int *); 302 static int iwm_mvm_sta_send_to_fw(struct iwm_softc *, struct iwm_node *, 303 int); 304 static int iwm_mvm_add_sta(struct iwm_softc *, struct iwm_node *); 305 static int iwm_mvm_update_sta(struct iwm_softc *, struct iwm_node *); 306 static int iwm_mvm_add_int_sta_common(struct iwm_softc *, 307 struct iwm_int_sta *, 308 const uint8_t *, uint16_t, uint16_t); 309 static int iwm_mvm_add_aux_sta(struct iwm_softc *); 310 static int iwm_mvm_update_quotas(struct iwm_softc *, struct iwm_node *); 311 static int iwm_auth(struct ieee80211vap *, struct iwm_softc *); 312 static int iwm_assoc(struct ieee80211vap *, struct iwm_softc *); 313 static int iwm_release(struct iwm_softc *, struct iwm_node *); 314 static struct ieee80211_node * 315 iwm_node_alloc(struct ieee80211vap *, 316 const uint8_t[IEEE80211_ADDR_LEN]); 317 static void iwm_setrates(struct iwm_softc *, struct iwm_node *); 318 static int iwm_media_change(struct ifnet *); 319 static int iwm_newstate(struct ieee80211vap *, enum ieee80211_state, int); 320 static void iwm_endscan_cb(void *, int); 321 static int iwm_init_hw(struct iwm_softc *); 322 static void iwm_init(struct iwm_softc *); 323 static void iwm_start(struct iwm_softc *); 324 static void iwm_stop(struct iwm_softc *); 325 static void iwm_watchdog(void *); 326 static void iwm_parent(struct ieee80211com *); 327 #ifdef IWM_DEBUG 328 static const char * 329 iwm_desc_lookup(uint32_t); 330 static void iwm_nic_error(struct iwm_softc *); 331 #endif 332 static void iwm_notif_intr(struct iwm_softc *); 333 static void iwm_intr(void *); 334 static int iwm_attach(device_t); 335 static void iwm_preinit(void *); 336 static int iwm_detach_local(struct iwm_softc *sc, int); 337 static void iwm_init_task(void *); 338 static void iwm_radiotap_attach(struct iwm_softc *); 339 static struct ieee80211vap * 340 iwm_vap_create(struct ieee80211com *, 341 const char [IFNAMSIZ], int, 342 enum ieee80211_opmode, int, 343 const uint8_t [IEEE80211_ADDR_LEN], 344 const uint8_t [IEEE80211_ADDR_LEN]); 345 static void iwm_vap_delete(struct ieee80211vap *); 346 static void iwm_scan_start(struct ieee80211com *); 347 static void iwm_scan_end(struct ieee80211com *); 348 static void iwm_update_mcast(struct ieee80211com *); 349 static void iwm_set_channel(struct ieee80211com *); 350 static void iwm_scan_curchan(struct ieee80211_scan_state *, unsigned long); 351 static void iwm_scan_mindwell(struct ieee80211_scan_state *); 352 static int iwm_detach(device_t); 353 354 /* 355 * Firmware parser. 356 */ 357 358 static int 359 iwm_store_cscheme(struct iwm_softc *sc, const uint8_t *data, size_t dlen) 360 { 361 const struct iwm_fw_cscheme_list *l = (const void *)data; 362 363 if (dlen < sizeof(*l) || 364 dlen < sizeof(l->size) + l->size * sizeof(*l->cs)) 365 return EINVAL; 366 367 /* we don't actually store anything for now, always use s/w crypto */ 368 369 return 0; 370 } 371 372 static int 373 iwm_firmware_store_section(struct iwm_softc *sc, 374 enum iwm_ucode_type type, const uint8_t *data, size_t dlen) 375 { 376 struct iwm_fw_sects *fws; 377 struct iwm_fw_onesect *fwone; 378 379 if (type >= IWM_UCODE_TYPE_MAX) 380 return EINVAL; 381 if (dlen < sizeof(uint32_t)) 382 return EINVAL; 383 384 fws = &sc->sc_fw.fw_sects[type]; 385 if (fws->fw_count >= IWM_UCODE_SECT_MAX) 386 return EINVAL; 387 388 fwone = &fws->fw_sect[fws->fw_count]; 389 390 /* first 32bit are device load offset */ 391 memcpy(&fwone->fws_devoff, data, sizeof(uint32_t)); 392 393 /* rest is data */ 394 fwone->fws_data = data + sizeof(uint32_t); 395 fwone->fws_len = dlen - sizeof(uint32_t); 396 397 fws->fw_count++; 398 fws->fw_totlen += fwone->fws_len; 399 400 return 0; 401 } 402 403 /* iwlwifi: iwl-drv.c */ 404 struct iwm_tlv_calib_data { 405 uint32_t ucode_type; 406 struct iwm_tlv_calib_ctrl calib; 407 } __packed; 408 409 static int 410 iwm_set_default_calib(struct iwm_softc *sc, const void *data) 411 { 412 const struct iwm_tlv_calib_data *def_calib = data; 413 uint32_t ucode_type = le32toh(def_calib->ucode_type); 414 415 if (ucode_type >= IWM_UCODE_TYPE_MAX) { 416 device_printf(sc->sc_dev, 417 "Wrong ucode_type %u for default " 418 "calibration.\n", ucode_type); 419 return EINVAL; 420 } 421 422 sc->sc_default_calib[ucode_type].flow_trigger = 423 def_calib->calib.flow_trigger; 424 sc->sc_default_calib[ucode_type].event_trigger = 425 def_calib->calib.event_trigger; 426 427 return 0; 428 } 429 430 static void 431 iwm_fw_info_free(struct iwm_fw_info *fw) 432 { 433 firmware_put(fw->fw_fp, FIRMWARE_UNLOAD); 434 fw->fw_fp = NULL; 435 /* don't touch fw->fw_status */ 436 memset(fw->fw_sects, 0, sizeof(fw->fw_sects)); 437 } 438 439 static int 440 iwm_read_firmware(struct iwm_softc *sc, enum iwm_ucode_type ucode_type) 441 { 442 struct iwm_fw_info *fw = &sc->sc_fw; 443 const struct iwm_tlv_ucode_header *uhdr; 444 struct iwm_ucode_tlv tlv; 445 enum iwm_ucode_tlv_type tlv_type; 446 const struct firmware *fwp; 447 const uint8_t *data; 448 int error = 0; 449 size_t len; 450 451 if (fw->fw_status == IWM_FW_STATUS_DONE && 452 ucode_type != IWM_UCODE_TYPE_INIT) 453 return 0; 454 455 while (fw->fw_status == IWM_FW_STATUS_INPROGRESS) 456 msleep(&sc->sc_fw, &sc->sc_mtx, 0, "iwmfwp", 0); 457 fw->fw_status = IWM_FW_STATUS_INPROGRESS; 458 459 if (fw->fw_fp != NULL) 460 iwm_fw_info_free(fw); 461 462 /* 463 * Load firmware into driver memory. 464 * fw_fp will be set. 465 */ 466 IWM_UNLOCK(sc); 467 fwp = firmware_get(sc->sc_fwname); 468 IWM_LOCK(sc); 469 if (fwp == NULL) { 470 device_printf(sc->sc_dev, 471 "could not read firmware %s (error %d)\n", 472 sc->sc_fwname, error); 473 goto out; 474 } 475 fw->fw_fp = fwp; 476 477 /* 478 * Parse firmware contents 479 */ 480 481 uhdr = (const void *)fw->fw_fp->data; 482 if (*(const uint32_t *)fw->fw_fp->data != 0 483 || le32toh(uhdr->magic) != IWM_TLV_UCODE_MAGIC) { 484 device_printf(sc->sc_dev, "invalid firmware %s\n", 485 sc->sc_fwname); 486 error = EINVAL; 487 goto out; 488 } 489 490 sc->sc_fwver = le32toh(uhdr->ver); 491 data = uhdr->data; 492 len = fw->fw_fp->datasize - sizeof(*uhdr); 493 494 while (len >= sizeof(tlv)) { 495 size_t tlv_len; 496 const void *tlv_data; 497 498 memcpy(&tlv, data, sizeof(tlv)); 499 tlv_len = le32toh(tlv.length); 500 tlv_type = le32toh(tlv.type); 501 502 len -= sizeof(tlv); 503 data += sizeof(tlv); 504 tlv_data = data; 505 506 if (len < tlv_len) { 507 device_printf(sc->sc_dev, 508 "firmware too short: %zu bytes\n", 509 len); 510 error = EINVAL; 511 goto parse_out; 512 } 513 514 switch ((int)tlv_type) { 515 case IWM_UCODE_TLV_PROBE_MAX_LEN: 516 if (tlv_len < sizeof(uint32_t)) { 517 device_printf(sc->sc_dev, 518 "%s: PROBE_MAX_LEN (%d) < sizeof(uint32_t)\n", 519 __func__, 520 (int) tlv_len); 521 error = EINVAL; 522 goto parse_out; 523 } 524 sc->sc_capa_max_probe_len 525 = le32toh(*(const uint32_t *)tlv_data); 526 /* limit it to something sensible */ 527 if (sc->sc_capa_max_probe_len > (1<<16)) { 528 IWM_DPRINTF(sc, IWM_DEBUG_FIRMWARE_TLV, 529 "%s: IWM_UCODE_TLV_PROBE_MAX_LEN " 530 "ridiculous\n", __func__); 531 error = EINVAL; 532 goto parse_out; 533 } 534 break; 535 case IWM_UCODE_TLV_PAN: 536 if (tlv_len) { 537 device_printf(sc->sc_dev, 538 "%s: IWM_UCODE_TLV_PAN: tlv_len (%d) > 0\n", 539 __func__, 540 (int) tlv_len); 541 error = EINVAL; 542 goto parse_out; 543 } 544 sc->sc_capaflags |= IWM_UCODE_TLV_FLAGS_PAN; 545 break; 546 case IWM_UCODE_TLV_FLAGS: 547 if (tlv_len < sizeof(uint32_t)) { 548 device_printf(sc->sc_dev, 549 "%s: IWM_UCODE_TLV_FLAGS: tlv_len (%d) < sizeof(uint32_t)\n", 550 __func__, 551 (int) tlv_len); 552 error = EINVAL; 553 goto parse_out; 554 } 555 /* 556 * Apparently there can be many flags, but Linux driver 557 * parses only the first one, and so do we. 558 * 559 * XXX: why does this override IWM_UCODE_TLV_PAN? 560 * Intentional or a bug? Observations from 561 * current firmware file: 562 * 1) TLV_PAN is parsed first 563 * 2) TLV_FLAGS contains TLV_FLAGS_PAN 564 * ==> this resets TLV_PAN to itself... hnnnk 565 */ 566 sc->sc_capaflags = le32toh(*(const uint32_t *)tlv_data); 567 break; 568 case IWM_UCODE_TLV_CSCHEME: 569 if ((error = iwm_store_cscheme(sc, 570 tlv_data, tlv_len)) != 0) { 571 device_printf(sc->sc_dev, 572 "%s: iwm_store_cscheme(): returned %d\n", 573 __func__, 574 error); 575 goto parse_out; 576 } 577 break; 578 case IWM_UCODE_TLV_NUM_OF_CPU: 579 if (tlv_len != sizeof(uint32_t)) { 580 device_printf(sc->sc_dev, 581 "%s: IWM_UCODE_TLV_NUM_OF_CPU: tlv_len (%d) < sizeof(uint32_t)\n", 582 __func__, 583 (int) tlv_len); 584 error = EINVAL; 585 goto parse_out; 586 } 587 if (le32toh(*(const uint32_t*)tlv_data) != 1) { 588 device_printf(sc->sc_dev, 589 "%s: driver supports " 590 "only TLV_NUM_OF_CPU == 1", 591 __func__); 592 error = EINVAL; 593 goto parse_out; 594 } 595 break; 596 case IWM_UCODE_TLV_SEC_RT: 597 if ((error = iwm_firmware_store_section(sc, 598 IWM_UCODE_TYPE_REGULAR, tlv_data, tlv_len)) != 0) { 599 device_printf(sc->sc_dev, 600 "%s: IWM_UCODE_TYPE_REGULAR: iwm_firmware_store_section() failed; %d\n", 601 __func__, 602 error); 603 goto parse_out; 604 } 605 break; 606 case IWM_UCODE_TLV_SEC_INIT: 607 if ((error = iwm_firmware_store_section(sc, 608 IWM_UCODE_TYPE_INIT, tlv_data, tlv_len)) != 0) { 609 device_printf(sc->sc_dev, 610 "%s: IWM_UCODE_TYPE_INIT: iwm_firmware_store_section() failed; %d\n", 611 __func__, 612 error); 613 goto parse_out; 614 } 615 break; 616 case IWM_UCODE_TLV_SEC_WOWLAN: 617 if ((error = iwm_firmware_store_section(sc, 618 IWM_UCODE_TYPE_WOW, tlv_data, tlv_len)) != 0) { 619 device_printf(sc->sc_dev, 620 "%s: IWM_UCODE_TYPE_WOW: iwm_firmware_store_section() failed; %d\n", 621 __func__, 622 error); 623 goto parse_out; 624 } 625 break; 626 case IWM_UCODE_TLV_DEF_CALIB: 627 if (tlv_len != sizeof(struct iwm_tlv_calib_data)) { 628 device_printf(sc->sc_dev, 629 "%s: IWM_UCODE_TLV_DEV_CALIB: tlv_len (%d) < sizeof(iwm_tlv_calib_data) (%d)\n", 630 __func__, 631 (int) tlv_len, 632 (int) sizeof(struct iwm_tlv_calib_data)); 633 error = EINVAL; 634 goto parse_out; 635 } 636 if ((error = iwm_set_default_calib(sc, tlv_data)) != 0) { 637 device_printf(sc->sc_dev, 638 "%s: iwm_set_default_calib() failed: %d\n", 639 __func__, 640 error); 641 goto parse_out; 642 } 643 break; 644 case IWM_UCODE_TLV_PHY_SKU: 645 if (tlv_len != sizeof(uint32_t)) { 646 error = EINVAL; 647 device_printf(sc->sc_dev, 648 "%s: IWM_UCODE_TLV_PHY_SKU: tlv_len (%d) < sizeof(uint32_t)\n", 649 __func__, 650 (int) tlv_len); 651 goto parse_out; 652 } 653 sc->sc_fw_phy_config = 654 le32toh(*(const uint32_t *)tlv_data); 655 break; 656 657 case IWM_UCODE_TLV_API_CHANGES_SET: 658 case IWM_UCODE_TLV_ENABLED_CAPABILITIES: 659 /* ignore, not used by current driver */ 660 break; 661 662 default: 663 device_printf(sc->sc_dev, 664 "%s: unknown firmware section %d, abort\n", 665 __func__, tlv_type); 666 error = EINVAL; 667 goto parse_out; 668 } 669 670 len -= roundup(tlv_len, 4); 671 data += roundup(tlv_len, 4); 672 } 673 674 KASSERT(error == 0, ("unhandled error")); 675 676 parse_out: 677 if (error) { 678 device_printf(sc->sc_dev, "firmware parse error %d, " 679 "section type %d\n", error, tlv_type); 680 } 681 682 if (!(sc->sc_capaflags & IWM_UCODE_TLV_FLAGS_PM_CMD_SUPPORT)) { 683 device_printf(sc->sc_dev, 684 "device uses unsupported power ops\n"); 685 error = ENOTSUP; 686 } 687 688 out: 689 if (error) { 690 fw->fw_status = IWM_FW_STATUS_NONE; 691 if (fw->fw_fp != NULL) 692 iwm_fw_info_free(fw); 693 } else 694 fw->fw_status = IWM_FW_STATUS_DONE; 695 wakeup(&sc->sc_fw); 696 697 return error; 698 } 699 700 /* 701 * DMA resource routines 702 */ 703 704 static void 705 iwm_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nsegs, int error) 706 { 707 if (error != 0) 708 return; 709 KASSERT(nsegs == 1, ("too many DMA segments, %d should be 1", nsegs)); 710 *(bus_addr_t *)arg = segs[0].ds_addr; 711 } 712 713 static int 714 iwm_dma_contig_alloc(bus_dma_tag_t tag, struct iwm_dma_info *dma, 715 bus_size_t size, bus_size_t alignment) 716 { 717 int error; 718 719 dma->tag = NULL; 720 dma->size = size; 721 722 error = bus_dma_tag_create(tag, alignment, 723 0, BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, size, 724 1, size, 0, NULL, NULL, &dma->tag); 725 if (error != 0) 726 goto fail; 727 728 error = bus_dmamem_alloc(dma->tag, (void **)&dma->vaddr, 729 BUS_DMA_NOWAIT | BUS_DMA_ZERO | BUS_DMA_COHERENT, &dma->map); 730 if (error != 0) 731 goto fail; 732 733 error = bus_dmamap_load(dma->tag, dma->map, dma->vaddr, size, 734 iwm_dma_map_addr, &dma->paddr, BUS_DMA_NOWAIT); 735 if (error != 0) 736 goto fail; 737 738 bus_dmamap_sync(dma->tag, dma->map, BUS_DMASYNC_PREWRITE); 739 740 return 0; 741 742 fail: iwm_dma_contig_free(dma); 743 return error; 744 } 745 746 static void 747 iwm_dma_contig_free(struct iwm_dma_info *dma) 748 { 749 if (dma->map != NULL) { 750 if (dma->vaddr != NULL) { 751 bus_dmamap_sync(dma->tag, dma->map, 752 BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE); 753 bus_dmamap_unload(dma->tag, dma->map); 754 bus_dmamem_free(dma->tag, dma->vaddr, dma->map); 755 dma->vaddr = NULL; 756 } 757 bus_dmamap_destroy(dma->tag, dma->map); 758 dma->map = NULL; 759 } 760 if (dma->tag != NULL) { 761 bus_dma_tag_destroy(dma->tag); 762 dma->tag = NULL; 763 } 764 765 } 766 767 /* fwmem is used to load firmware onto the card */ 768 static int 769 iwm_alloc_fwmem(struct iwm_softc *sc) 770 { 771 /* Must be aligned on a 16-byte boundary. */ 772 return iwm_dma_contig_alloc(sc->sc_dmat, &sc->fw_dma, 773 sc->sc_fwdmasegsz, 16); 774 } 775 776 static void 777 iwm_free_fwmem(struct iwm_softc *sc) 778 { 779 iwm_dma_contig_free(&sc->fw_dma); 780 } 781 782 /* tx scheduler rings. not used? */ 783 static int 784 iwm_alloc_sched(struct iwm_softc *sc) 785 { 786 int rv; 787 788 /* TX scheduler rings must be aligned on a 1KB boundary. */ 789 rv = iwm_dma_contig_alloc(sc->sc_dmat, &sc->sched_dma, 790 nitems(sc->txq) * sizeof(struct iwm_agn_scd_bc_tbl), 1024); 791 return rv; 792 } 793 794 static void 795 iwm_free_sched(struct iwm_softc *sc) 796 { 797 iwm_dma_contig_free(&sc->sched_dma); 798 } 799 800 /* keep-warm page is used internally by the card. see iwl-fh.h for more info */ 801 static int 802 iwm_alloc_kw(struct iwm_softc *sc) 803 { 804 return iwm_dma_contig_alloc(sc->sc_dmat, &sc->kw_dma, 4096, 4096); 805 } 806 807 static void 808 iwm_free_kw(struct iwm_softc *sc) 809 { 810 iwm_dma_contig_free(&sc->kw_dma); 811 } 812 813 /* interrupt cause table */ 814 static int 815 iwm_alloc_ict(struct iwm_softc *sc) 816 { 817 return iwm_dma_contig_alloc(sc->sc_dmat, &sc->ict_dma, 818 IWM_ICT_SIZE, 1<<IWM_ICT_PADDR_SHIFT); 819 } 820 821 static void 822 iwm_free_ict(struct iwm_softc *sc) 823 { 824 iwm_dma_contig_free(&sc->ict_dma); 825 } 826 827 static int 828 iwm_alloc_rx_ring(struct iwm_softc *sc, struct iwm_rx_ring *ring) 829 { 830 bus_size_t size; 831 int i, error; 832 833 ring->cur = 0; 834 835 /* Allocate RX descriptors (256-byte aligned). */ 836 size = IWM_RX_RING_COUNT * sizeof(uint32_t); 837 error = iwm_dma_contig_alloc(sc->sc_dmat, &ring->desc_dma, size, 256); 838 if (error != 0) { 839 device_printf(sc->sc_dev, 840 "could not allocate RX ring DMA memory\n"); 841 goto fail; 842 } 843 ring->desc = ring->desc_dma.vaddr; 844 845 /* Allocate RX status area (16-byte aligned). */ 846 error = iwm_dma_contig_alloc(sc->sc_dmat, &ring->stat_dma, 847 sizeof(*ring->stat), 16); 848 if (error != 0) { 849 device_printf(sc->sc_dev, 850 "could not allocate RX status DMA memory\n"); 851 goto fail; 852 } 853 ring->stat = ring->stat_dma.vaddr; 854 855 /* Create RX buffer DMA tag. */ 856 error = bus_dma_tag_create(sc->sc_dmat, 1, 0, 857 BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, 858 IWM_RBUF_SIZE, 1, IWM_RBUF_SIZE, 0, NULL, NULL, &ring->data_dmat); 859 if (error != 0) { 860 device_printf(sc->sc_dev, 861 "%s: could not create RX buf DMA tag, error %d\n", 862 __func__, error); 863 goto fail; 864 } 865 866 /* 867 * Allocate and map RX buffers. 868 */ 869 for (i = 0; i < IWM_RX_RING_COUNT; i++) { 870 if ((error = iwm_rx_addbuf(sc, IWM_RBUF_SIZE, i)) != 0) { 871 goto fail; 872 } 873 } 874 return 0; 875 876 fail: iwm_free_rx_ring(sc, ring); 877 return error; 878 } 879 880 static void 881 iwm_reset_rx_ring(struct iwm_softc *sc, struct iwm_rx_ring *ring) 882 { 883 884 /* XXX print out if we can't lock the NIC? */ 885 if (iwm_nic_lock(sc)) { 886 /* XXX handle if RX stop doesn't finish? */ 887 (void) iwm_pcie_rx_stop(sc); 888 iwm_nic_unlock(sc); 889 } 890 /* Reset the ring state */ 891 ring->cur = 0; 892 memset(sc->rxq.stat, 0, sizeof(*sc->rxq.stat)); 893 } 894 895 static void 896 iwm_free_rx_ring(struct iwm_softc *sc, struct iwm_rx_ring *ring) 897 { 898 int i; 899 900 iwm_dma_contig_free(&ring->desc_dma); 901 iwm_dma_contig_free(&ring->stat_dma); 902 903 for (i = 0; i < IWM_RX_RING_COUNT; i++) { 904 struct iwm_rx_data *data = &ring->data[i]; 905 906 if (data->m != NULL) { 907 bus_dmamap_sync(ring->data_dmat, data->map, 908 BUS_DMASYNC_POSTREAD); 909 bus_dmamap_unload(ring->data_dmat, data->map); 910 m_freem(data->m); 911 data->m = NULL; 912 } 913 if (data->map != NULL) { 914 bus_dmamap_destroy(ring->data_dmat, data->map); 915 data->map = NULL; 916 } 917 } 918 if (ring->data_dmat != NULL) { 919 bus_dma_tag_destroy(ring->data_dmat); 920 ring->data_dmat = NULL; 921 } 922 } 923 924 static int 925 iwm_alloc_tx_ring(struct iwm_softc *sc, struct iwm_tx_ring *ring, int qid) 926 { 927 bus_addr_t paddr; 928 bus_size_t size; 929 int i, error; 930 931 ring->qid = qid; 932 ring->queued = 0; 933 ring->cur = 0; 934 935 /* Allocate TX descriptors (256-byte aligned). */ 936 size = IWM_TX_RING_COUNT * sizeof (struct iwm_tfd); 937 error = iwm_dma_contig_alloc(sc->sc_dmat, &ring->desc_dma, size, 256); 938 if (error != 0) { 939 device_printf(sc->sc_dev, 940 "could not allocate TX ring DMA memory\n"); 941 goto fail; 942 } 943 ring->desc = ring->desc_dma.vaddr; 944 945 /* 946 * We only use rings 0 through 9 (4 EDCA + cmd) so there is no need 947 * to allocate commands space for other rings. 948 */ 949 if (qid > IWM_MVM_CMD_QUEUE) 950 return 0; 951 952 size = IWM_TX_RING_COUNT * sizeof(struct iwm_device_cmd); 953 error = iwm_dma_contig_alloc(sc->sc_dmat, &ring->cmd_dma, size, 4); 954 if (error != 0) { 955 device_printf(sc->sc_dev, 956 "could not allocate TX cmd DMA memory\n"); 957 goto fail; 958 } 959 ring->cmd = ring->cmd_dma.vaddr; 960 961 error = bus_dma_tag_create(sc->sc_dmat, 1, 0, 962 BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, 963 IWM_MAX_SCATTER - 2, MCLBYTES, 0, NULL, NULL, &ring->data_dmat); 964 if (error != 0) { 965 device_printf(sc->sc_dev, "could not create TX buf DMA tag\n"); 966 goto fail; 967 } 968 969 paddr = ring->cmd_dma.paddr; 970 for (i = 0; i < IWM_TX_RING_COUNT; i++) { 971 struct iwm_tx_data *data = &ring->data[i]; 972 973 data->cmd_paddr = paddr; 974 data->scratch_paddr = paddr + sizeof(struct iwm_cmd_header) 975 + offsetof(struct iwm_tx_cmd, scratch); 976 paddr += sizeof(struct iwm_device_cmd); 977 978 error = bus_dmamap_create(ring->data_dmat, 0, &data->map); 979 if (error != 0) { 980 device_printf(sc->sc_dev, 981 "could not create TX buf DMA map\n"); 982 goto fail; 983 } 984 } 985 KASSERT(paddr == ring->cmd_dma.paddr + size, 986 ("invalid physical address")); 987 return 0; 988 989 fail: iwm_free_tx_ring(sc, ring); 990 return error; 991 } 992 993 static void 994 iwm_reset_tx_ring(struct iwm_softc *sc, struct iwm_tx_ring *ring) 995 { 996 int i; 997 998 for (i = 0; i < IWM_TX_RING_COUNT; i++) { 999 struct iwm_tx_data *data = &ring->data[i]; 1000 1001 if (data->m != NULL) { 1002 bus_dmamap_sync(ring->data_dmat, data->map, 1003 BUS_DMASYNC_POSTWRITE); 1004 bus_dmamap_unload(ring->data_dmat, data->map); 1005 m_freem(data->m); 1006 data->m = NULL; 1007 } 1008 } 1009 /* Clear TX descriptors. */ 1010 memset(ring->desc, 0, ring->desc_dma.size); 1011 bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map, 1012 BUS_DMASYNC_PREWRITE); 1013 sc->qfullmsk &= ~(1 << ring->qid); 1014 ring->queued = 0; 1015 ring->cur = 0; 1016 } 1017 1018 static void 1019 iwm_free_tx_ring(struct iwm_softc *sc, struct iwm_tx_ring *ring) 1020 { 1021 int i; 1022 1023 iwm_dma_contig_free(&ring->desc_dma); 1024 iwm_dma_contig_free(&ring->cmd_dma); 1025 1026 for (i = 0; i < IWM_TX_RING_COUNT; i++) { 1027 struct iwm_tx_data *data = &ring->data[i]; 1028 1029 if (data->m != NULL) { 1030 bus_dmamap_sync(ring->data_dmat, data->map, 1031 BUS_DMASYNC_POSTWRITE); 1032 bus_dmamap_unload(ring->data_dmat, data->map); 1033 m_freem(data->m); 1034 data->m = NULL; 1035 } 1036 if (data->map != NULL) { 1037 bus_dmamap_destroy(ring->data_dmat, data->map); 1038 data->map = NULL; 1039 } 1040 } 1041 if (ring->data_dmat != NULL) { 1042 bus_dma_tag_destroy(ring->data_dmat); 1043 ring->data_dmat = NULL; 1044 } 1045 } 1046 1047 /* 1048 * High-level hardware frobbing routines 1049 */ 1050 1051 static void 1052 iwm_enable_interrupts(struct iwm_softc *sc) 1053 { 1054 sc->sc_intmask = IWM_CSR_INI_SET_MASK; 1055 IWM_WRITE(sc, IWM_CSR_INT_MASK, sc->sc_intmask); 1056 } 1057 1058 static void 1059 iwm_restore_interrupts(struct iwm_softc *sc) 1060 { 1061 IWM_WRITE(sc, IWM_CSR_INT_MASK, sc->sc_intmask); 1062 } 1063 1064 static void 1065 iwm_disable_interrupts(struct iwm_softc *sc) 1066 { 1067 /* disable interrupts */ 1068 IWM_WRITE(sc, IWM_CSR_INT_MASK, 0); 1069 1070 /* acknowledge all interrupts */ 1071 IWM_WRITE(sc, IWM_CSR_INT, ~0); 1072 IWM_WRITE(sc, IWM_CSR_FH_INT_STATUS, ~0); 1073 } 1074 1075 static void 1076 iwm_ict_reset(struct iwm_softc *sc) 1077 { 1078 iwm_disable_interrupts(sc); 1079 1080 /* Reset ICT table. */ 1081 memset(sc->ict_dma.vaddr, 0, IWM_ICT_SIZE); 1082 sc->ict_cur = 0; 1083 1084 /* Set physical address of ICT table (4KB aligned). */ 1085 IWM_WRITE(sc, IWM_CSR_DRAM_INT_TBL_REG, 1086 IWM_CSR_DRAM_INT_TBL_ENABLE 1087 | IWM_CSR_DRAM_INIT_TBL_WRAP_CHECK 1088 | sc->ict_dma.paddr >> IWM_ICT_PADDR_SHIFT); 1089 1090 /* Switch to ICT interrupt mode in driver. */ 1091 sc->sc_flags |= IWM_FLAG_USE_ICT; 1092 1093 /* Re-enable interrupts. */ 1094 IWM_WRITE(sc, IWM_CSR_INT, ~0); 1095 iwm_enable_interrupts(sc); 1096 } 1097 1098 /* iwlwifi pcie/trans.c */ 1099 1100 /* 1101 * Since this .. hard-resets things, it's time to actually 1102 * mark the first vap (if any) as having no mac context. 1103 * It's annoying, but since the driver is potentially being 1104 * stop/start'ed whilst active (thanks openbsd port!) we 1105 * have to correctly track this. 1106 */ 1107 static void 1108 iwm_stop_device(struct iwm_softc *sc) 1109 { 1110 struct ieee80211com *ic = &sc->sc_ic; 1111 struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps); 1112 int chnl, ntries; 1113 int qid; 1114 1115 /* tell the device to stop sending interrupts */ 1116 iwm_disable_interrupts(sc); 1117 1118 /* 1119 * FreeBSD-local: mark the first vap as not-uploaded, 1120 * so the next transition through auth/assoc 1121 * will correctly populate the MAC context. 1122 */ 1123 if (vap) { 1124 struct iwm_vap *iv = IWM_VAP(vap); 1125 iv->is_uploaded = 0; 1126 } 1127 1128 /* device going down, Stop using ICT table */ 1129 sc->sc_flags &= ~IWM_FLAG_USE_ICT; 1130 1131 /* stop tx and rx. tx and rx bits, as usual, are from if_iwn */ 1132 1133 iwm_write_prph(sc, IWM_SCD_TXFACT, 0); 1134 1135 /* Stop all DMA channels. */ 1136 if (iwm_nic_lock(sc)) { 1137 for (chnl = 0; chnl < IWM_FH_TCSR_CHNL_NUM; chnl++) { 1138 IWM_WRITE(sc, 1139 IWM_FH_TCSR_CHNL_TX_CONFIG_REG(chnl), 0); 1140 for (ntries = 0; ntries < 200; ntries++) { 1141 uint32_t r; 1142 1143 r = IWM_READ(sc, IWM_FH_TSSR_TX_STATUS_REG); 1144 if (r & IWM_FH_TSSR_TX_STATUS_REG_MSK_CHNL_IDLE( 1145 chnl)) 1146 break; 1147 DELAY(20); 1148 } 1149 } 1150 iwm_nic_unlock(sc); 1151 } 1152 1153 /* Stop RX ring. */ 1154 iwm_reset_rx_ring(sc, &sc->rxq); 1155 1156 /* Reset all TX rings. */ 1157 for (qid = 0; qid < nitems(sc->txq); qid++) 1158 iwm_reset_tx_ring(sc, &sc->txq[qid]); 1159 1160 /* 1161 * Power-down device's busmaster DMA clocks 1162 */ 1163 iwm_write_prph(sc, IWM_APMG_CLK_DIS_REG, IWM_APMG_CLK_VAL_DMA_CLK_RQT); 1164 DELAY(5); 1165 1166 /* Make sure (redundant) we've released our request to stay awake */ 1167 IWM_CLRBITS(sc, IWM_CSR_GP_CNTRL, 1168 IWM_CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ); 1169 1170 /* Stop the device, and put it in low power state */ 1171 iwm_apm_stop(sc); 1172 1173 /* Upon stop, the APM issues an interrupt if HW RF kill is set. 1174 * Clean again the interrupt here 1175 */ 1176 iwm_disable_interrupts(sc); 1177 /* stop and reset the on-board processor */ 1178 IWM_WRITE(sc, IWM_CSR_RESET, IWM_CSR_RESET_REG_FLAG_NEVO_RESET); 1179 1180 /* 1181 * Even if we stop the HW, we still want the RF kill 1182 * interrupt 1183 */ 1184 iwm_enable_rfkill_int(sc); 1185 iwm_check_rfkill(sc); 1186 } 1187 1188 /* iwlwifi: mvm/ops.c */ 1189 static void 1190 iwm_mvm_nic_config(struct iwm_softc *sc) 1191 { 1192 uint8_t radio_cfg_type, radio_cfg_step, radio_cfg_dash; 1193 uint32_t reg_val = 0; 1194 1195 radio_cfg_type = (sc->sc_fw_phy_config & IWM_FW_PHY_CFG_RADIO_TYPE) >> 1196 IWM_FW_PHY_CFG_RADIO_TYPE_POS; 1197 radio_cfg_step = (sc->sc_fw_phy_config & IWM_FW_PHY_CFG_RADIO_STEP) >> 1198 IWM_FW_PHY_CFG_RADIO_STEP_POS; 1199 radio_cfg_dash = (sc->sc_fw_phy_config & IWM_FW_PHY_CFG_RADIO_DASH) >> 1200 IWM_FW_PHY_CFG_RADIO_DASH_POS; 1201 1202 /* SKU control */ 1203 reg_val |= IWM_CSR_HW_REV_STEP(sc->sc_hw_rev) << 1204 IWM_CSR_HW_IF_CONFIG_REG_POS_MAC_STEP; 1205 reg_val |= IWM_CSR_HW_REV_DASH(sc->sc_hw_rev) << 1206 IWM_CSR_HW_IF_CONFIG_REG_POS_MAC_DASH; 1207 1208 /* radio configuration */ 1209 reg_val |= radio_cfg_type << IWM_CSR_HW_IF_CONFIG_REG_POS_PHY_TYPE; 1210 reg_val |= radio_cfg_step << IWM_CSR_HW_IF_CONFIG_REG_POS_PHY_STEP; 1211 reg_val |= radio_cfg_dash << IWM_CSR_HW_IF_CONFIG_REG_POS_PHY_DASH; 1212 1213 IWM_WRITE(sc, IWM_CSR_HW_IF_CONFIG_REG, reg_val); 1214 1215 IWM_DPRINTF(sc, IWM_DEBUG_RESET, 1216 "Radio type=0x%x-0x%x-0x%x\n", radio_cfg_type, 1217 radio_cfg_step, radio_cfg_dash); 1218 1219 /* 1220 * W/A : NIC is stuck in a reset state after Early PCIe power off 1221 * (PCIe power is lost before PERST# is asserted), causing ME FW 1222 * to lose ownership and not being able to obtain it back. 1223 */ 1224 iwm_set_bits_mask_prph(sc, IWM_APMG_PS_CTRL_REG, 1225 IWM_APMG_PS_CTRL_EARLY_PWR_OFF_RESET_DIS, 1226 ~IWM_APMG_PS_CTRL_EARLY_PWR_OFF_RESET_DIS); 1227 } 1228 1229 static int 1230 iwm_nic_rx_init(struct iwm_softc *sc) 1231 { 1232 if (!iwm_nic_lock(sc)) 1233 return EBUSY; 1234 1235 /* 1236 * Initialize RX ring. This is from the iwn driver. 1237 */ 1238 memset(sc->rxq.stat, 0, sizeof(*sc->rxq.stat)); 1239 1240 /* stop DMA */ 1241 IWM_WRITE(sc, IWM_FH_MEM_RCSR_CHNL0_CONFIG_REG, 0); 1242 IWM_WRITE(sc, IWM_FH_MEM_RCSR_CHNL0_RBDCB_WPTR, 0); 1243 IWM_WRITE(sc, IWM_FH_MEM_RCSR_CHNL0_FLUSH_RB_REQ, 0); 1244 IWM_WRITE(sc, IWM_FH_RSCSR_CHNL0_RDPTR, 0); 1245 IWM_WRITE(sc, IWM_FH_RSCSR_CHNL0_RBDCB_WPTR_REG, 0); 1246 1247 /* Set physical address of RX ring (256-byte aligned). */ 1248 IWM_WRITE(sc, 1249 IWM_FH_RSCSR_CHNL0_RBDCB_BASE_REG, sc->rxq.desc_dma.paddr >> 8); 1250 1251 /* Set physical address of RX status (16-byte aligned). */ 1252 IWM_WRITE(sc, 1253 IWM_FH_RSCSR_CHNL0_STTS_WPTR_REG, sc->rxq.stat_dma.paddr >> 4); 1254 1255 /* Enable RX. */ 1256 /* 1257 * Note: Linux driver also sets this: 1258 * (IWM_RX_RB_TIMEOUT << IWM_FH_RCSR_RX_CONFIG_REG_IRQ_RBTH_POS) | 1259 * 1260 * It causes weird behavior. YMMV. 1261 */ 1262 IWM_WRITE(sc, IWM_FH_MEM_RCSR_CHNL0_CONFIG_REG, 1263 IWM_FH_RCSR_RX_CONFIG_CHNL_EN_ENABLE_VAL | 1264 IWM_FH_RCSR_CHNL0_RX_IGNORE_RXF_EMPTY | /* HW bug */ 1265 IWM_FH_RCSR_CHNL0_RX_CONFIG_IRQ_DEST_INT_HOST_VAL | 1266 IWM_FH_RCSR_RX_CONFIG_REG_VAL_RB_SIZE_4K | 1267 IWM_RX_QUEUE_SIZE_LOG << IWM_FH_RCSR_RX_CONFIG_RBDCB_SIZE_POS); 1268 1269 IWM_WRITE_1(sc, IWM_CSR_INT_COALESCING, IWM_HOST_INT_TIMEOUT_DEF); 1270 1271 /* W/A for interrupt coalescing bug in 7260 and 3160 */ 1272 if (sc->host_interrupt_operation_mode) 1273 IWM_SETBITS(sc, IWM_CSR_INT_COALESCING, IWM_HOST_INT_OPER_MODE); 1274 1275 /* 1276 * Thus sayeth el jefe (iwlwifi) via a comment: 1277 * 1278 * This value should initially be 0 (before preparing any 1279 * RBs), should be 8 after preparing the first 8 RBs (for example) 1280 */ 1281 IWM_WRITE(sc, IWM_FH_RSCSR_CHNL0_WPTR, 8); 1282 1283 iwm_nic_unlock(sc); 1284 1285 return 0; 1286 } 1287 1288 static int 1289 iwm_nic_tx_init(struct iwm_softc *sc) 1290 { 1291 int qid; 1292 1293 if (!iwm_nic_lock(sc)) 1294 return EBUSY; 1295 1296 /* Deactivate TX scheduler. */ 1297 iwm_write_prph(sc, IWM_SCD_TXFACT, 0); 1298 1299 /* Set physical address of "keep warm" page (16-byte aligned). */ 1300 IWM_WRITE(sc, IWM_FH_KW_MEM_ADDR_REG, sc->kw_dma.paddr >> 4); 1301 1302 /* Initialize TX rings. */ 1303 for (qid = 0; qid < nitems(sc->txq); qid++) { 1304 struct iwm_tx_ring *txq = &sc->txq[qid]; 1305 1306 /* Set physical address of TX ring (256-byte aligned). */ 1307 IWM_WRITE(sc, IWM_FH_MEM_CBBC_QUEUE(qid), 1308 txq->desc_dma.paddr >> 8); 1309 IWM_DPRINTF(sc, IWM_DEBUG_XMIT, 1310 "%s: loading ring %d descriptors (%p) at %lx\n", 1311 __func__, 1312 qid, txq->desc, 1313 (unsigned long) (txq->desc_dma.paddr >> 8)); 1314 } 1315 iwm_nic_unlock(sc); 1316 1317 return 0; 1318 } 1319 1320 static int 1321 iwm_nic_init(struct iwm_softc *sc) 1322 { 1323 int error; 1324 1325 iwm_apm_init(sc); 1326 iwm_set_pwr(sc); 1327 1328 iwm_mvm_nic_config(sc); 1329 1330 if ((error = iwm_nic_rx_init(sc)) != 0) 1331 return error; 1332 1333 /* 1334 * Ditto for TX, from iwn 1335 */ 1336 if ((error = iwm_nic_tx_init(sc)) != 0) 1337 return error; 1338 1339 IWM_DPRINTF(sc, IWM_DEBUG_RESET, 1340 "%s: shadow registers enabled\n", __func__); 1341 IWM_SETBITS(sc, IWM_CSR_MAC_SHADOW_REG_CTRL, 0x800fffff); 1342 1343 return 0; 1344 } 1345 1346 enum iwm_mvm_tx_fifo { 1347 IWM_MVM_TX_FIFO_BK = 0, 1348 IWM_MVM_TX_FIFO_BE, 1349 IWM_MVM_TX_FIFO_VI, 1350 IWM_MVM_TX_FIFO_VO, 1351 IWM_MVM_TX_FIFO_MCAST = 5, 1352 }; 1353 1354 const uint8_t iwm_mvm_ac_to_tx_fifo[] = { 1355 IWM_MVM_TX_FIFO_VO, 1356 IWM_MVM_TX_FIFO_VI, 1357 IWM_MVM_TX_FIFO_BE, 1358 IWM_MVM_TX_FIFO_BK, 1359 }; 1360 1361 static void 1362 iwm_enable_txq(struct iwm_softc *sc, int qid, int fifo) 1363 { 1364 if (!iwm_nic_lock(sc)) { 1365 device_printf(sc->sc_dev, 1366 "%s: cannot enable txq %d\n", 1367 __func__, 1368 qid); 1369 return; /* XXX return EBUSY */ 1370 } 1371 1372 /* unactivate before configuration */ 1373 iwm_write_prph(sc, IWM_SCD_QUEUE_STATUS_BITS(qid), 1374 (0 << IWM_SCD_QUEUE_STTS_REG_POS_ACTIVE) 1375 | (1 << IWM_SCD_QUEUE_STTS_REG_POS_SCD_ACT_EN)); 1376 1377 if (qid != IWM_MVM_CMD_QUEUE) { 1378 iwm_set_bits_prph(sc, IWM_SCD_QUEUECHAIN_SEL, (1 << qid)); 1379 } 1380 1381 iwm_clear_bits_prph(sc, IWM_SCD_AGGR_SEL, (1 << qid)); 1382 1383 IWM_WRITE(sc, IWM_HBUS_TARG_WRPTR, qid << 8 | 0); 1384 iwm_write_prph(sc, IWM_SCD_QUEUE_RDPTR(qid), 0); 1385 1386 iwm_write_mem32(sc, sc->sched_base + IWM_SCD_CONTEXT_QUEUE_OFFSET(qid), 0); 1387 /* Set scheduler window size and frame limit. */ 1388 iwm_write_mem32(sc, 1389 sc->sched_base + IWM_SCD_CONTEXT_QUEUE_OFFSET(qid) + 1390 sizeof(uint32_t), 1391 ((IWM_FRAME_LIMIT << IWM_SCD_QUEUE_CTX_REG2_WIN_SIZE_POS) & 1392 IWM_SCD_QUEUE_CTX_REG2_WIN_SIZE_MSK) | 1393 ((IWM_FRAME_LIMIT << IWM_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_POS) & 1394 IWM_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_MSK)); 1395 1396 iwm_write_prph(sc, IWM_SCD_QUEUE_STATUS_BITS(qid), 1397 (1 << IWM_SCD_QUEUE_STTS_REG_POS_ACTIVE) | 1398 (fifo << IWM_SCD_QUEUE_STTS_REG_POS_TXF) | 1399 (1 << IWM_SCD_QUEUE_STTS_REG_POS_WSL) | 1400 IWM_SCD_QUEUE_STTS_REG_MSK); 1401 1402 iwm_nic_unlock(sc); 1403 1404 IWM_DPRINTF(sc, IWM_DEBUG_XMIT, 1405 "%s: enabled txq %d FIFO %d\n", 1406 __func__, qid, fifo); 1407 } 1408 1409 static int 1410 iwm_post_alive(struct iwm_softc *sc) 1411 { 1412 int nwords; 1413 int error, chnl; 1414 1415 if (!iwm_nic_lock(sc)) 1416 return EBUSY; 1417 1418 if (sc->sched_base != iwm_read_prph(sc, IWM_SCD_SRAM_BASE_ADDR)) { 1419 device_printf(sc->sc_dev, 1420 "%s: sched addr mismatch", 1421 __func__); 1422 error = EINVAL; 1423 goto out; 1424 } 1425 1426 iwm_ict_reset(sc); 1427 1428 /* Clear TX scheduler state in SRAM. */ 1429 nwords = (IWM_SCD_TRANS_TBL_MEM_UPPER_BOUND - 1430 IWM_SCD_CONTEXT_MEM_LOWER_BOUND) 1431 / sizeof(uint32_t); 1432 error = iwm_write_mem(sc, 1433 sc->sched_base + IWM_SCD_CONTEXT_MEM_LOWER_BOUND, 1434 NULL, nwords); 1435 if (error) 1436 goto out; 1437 1438 /* Set physical address of TX scheduler rings (1KB aligned). */ 1439 iwm_write_prph(sc, IWM_SCD_DRAM_BASE_ADDR, sc->sched_dma.paddr >> 10); 1440 1441 iwm_write_prph(sc, IWM_SCD_CHAINEXT_EN, 0); 1442 1443 /* enable command channel */ 1444 iwm_enable_txq(sc, IWM_MVM_CMD_QUEUE, 7); 1445 1446 iwm_write_prph(sc, IWM_SCD_TXFACT, 0xff); 1447 1448 /* Enable DMA channels. */ 1449 for (chnl = 0; chnl < IWM_FH_TCSR_CHNL_NUM; chnl++) { 1450 IWM_WRITE(sc, IWM_FH_TCSR_CHNL_TX_CONFIG_REG(chnl), 1451 IWM_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_ENABLE | 1452 IWM_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_ENABLE); 1453 } 1454 1455 IWM_SETBITS(sc, IWM_FH_TX_CHICKEN_BITS_REG, 1456 IWM_FH_TX_CHICKEN_BITS_SCD_AUTO_RETRY_EN); 1457 1458 /* Enable L1-Active */ 1459 iwm_clear_bits_prph(sc, IWM_APMG_PCIDEV_STT_REG, 1460 IWM_APMG_PCIDEV_STT_VAL_L1_ACT_DIS); 1461 1462 out: 1463 iwm_nic_unlock(sc); 1464 return error; 1465 } 1466 1467 /* 1468 * NVM read access and content parsing. We do not support 1469 * external NVM or writing NVM. 1470 * iwlwifi/mvm/nvm.c 1471 */ 1472 1473 /* list of NVM sections we are allowed/need to read */ 1474 const int nvm_to_read[] = { 1475 IWM_NVM_SECTION_TYPE_HW, 1476 IWM_NVM_SECTION_TYPE_SW, 1477 IWM_NVM_SECTION_TYPE_CALIBRATION, 1478 IWM_NVM_SECTION_TYPE_PRODUCTION, 1479 }; 1480 1481 /* Default NVM size to read */ 1482 #define IWM_NVM_DEFAULT_CHUNK_SIZE (2*1024) 1483 #define IWM_MAX_NVM_SECTION_SIZE 7000 1484 1485 #define IWM_NVM_WRITE_OPCODE 1 1486 #define IWM_NVM_READ_OPCODE 0 1487 1488 static int 1489 iwm_nvm_read_chunk(struct iwm_softc *sc, uint16_t section, 1490 uint16_t offset, uint16_t length, uint8_t *data, uint16_t *len) 1491 { 1492 offset = 0; 1493 struct iwm_nvm_access_cmd nvm_access_cmd = { 1494 .offset = htole16(offset), 1495 .length = htole16(length), 1496 .type = htole16(section), 1497 .op_code = IWM_NVM_READ_OPCODE, 1498 }; 1499 struct iwm_nvm_access_resp *nvm_resp; 1500 struct iwm_rx_packet *pkt; 1501 struct iwm_host_cmd cmd = { 1502 .id = IWM_NVM_ACCESS_CMD, 1503 .flags = IWM_CMD_SYNC | IWM_CMD_WANT_SKB | 1504 IWM_CMD_SEND_IN_RFKILL, 1505 .data = { &nvm_access_cmd, }, 1506 }; 1507 int ret, bytes_read, offset_read; 1508 uint8_t *resp_data; 1509 1510 cmd.len[0] = sizeof(struct iwm_nvm_access_cmd); 1511 1512 ret = iwm_send_cmd(sc, &cmd); 1513 if (ret) 1514 return ret; 1515 1516 pkt = cmd.resp_pkt; 1517 if (pkt->hdr.flags & IWM_CMD_FAILED_MSK) { 1518 device_printf(sc->sc_dev, 1519 "%s: Bad return from IWM_NVM_ACCES_COMMAND (0x%08X)\n", 1520 __func__, pkt->hdr.flags); 1521 ret = EIO; 1522 goto exit; 1523 } 1524 1525 /* Extract NVM response */ 1526 nvm_resp = (void *)pkt->data; 1527 1528 ret = le16toh(nvm_resp->status); 1529 bytes_read = le16toh(nvm_resp->length); 1530 offset_read = le16toh(nvm_resp->offset); 1531 resp_data = nvm_resp->data; 1532 if (ret) { 1533 device_printf(sc->sc_dev, 1534 "%s: NVM access command failed with status %d\n", 1535 __func__, ret); 1536 ret = EINVAL; 1537 goto exit; 1538 } 1539 1540 if (offset_read != offset) { 1541 device_printf(sc->sc_dev, 1542 "%s: NVM ACCESS response with invalid offset %d\n", 1543 __func__, offset_read); 1544 ret = EINVAL; 1545 goto exit; 1546 } 1547 1548 memcpy(data + offset, resp_data, bytes_read); 1549 *len = bytes_read; 1550 1551 exit: 1552 iwm_free_resp(sc, &cmd); 1553 return ret; 1554 } 1555 1556 /* 1557 * Reads an NVM section completely. 1558 * NICs prior to 7000 family doesn't have a real NVM, but just read 1559 * section 0 which is the EEPROM. Because the EEPROM reading is unlimited 1560 * by uCode, we need to manually check in this case that we don't 1561 * overflow and try to read more than the EEPROM size. 1562 * For 7000 family NICs, we supply the maximal size we can read, and 1563 * the uCode fills the response with as much data as we can, 1564 * without overflowing, so no check is needed. 1565 */ 1566 static int 1567 iwm_nvm_read_section(struct iwm_softc *sc, 1568 uint16_t section, uint8_t *data, uint16_t *len) 1569 { 1570 uint16_t length, seglen; 1571 int error; 1572 1573 /* Set nvm section read length */ 1574 length = seglen = IWM_NVM_DEFAULT_CHUNK_SIZE; 1575 *len = 0; 1576 1577 /* Read the NVM until exhausted (reading less than requested) */ 1578 while (seglen == length) { 1579 error = iwm_nvm_read_chunk(sc, 1580 section, *len, length, data, &seglen); 1581 if (error) { 1582 device_printf(sc->sc_dev, 1583 "Cannot read NVM from section " 1584 "%d offset %d, length %d\n", 1585 section, *len, length); 1586 return error; 1587 } 1588 *len += seglen; 1589 } 1590 1591 IWM_DPRINTF(sc, IWM_DEBUG_RESET, 1592 "NVM section %d read completed\n", section); 1593 return 0; 1594 } 1595 1596 /* 1597 * BEGIN IWM_NVM_PARSE 1598 */ 1599 1600 /* iwlwifi/iwl-nvm-parse.c */ 1601 1602 /* NVM offsets (in words) definitions */ 1603 enum wkp_nvm_offsets { 1604 /* NVM HW-Section offset (in words) definitions */ 1605 IWM_HW_ADDR = 0x15, 1606 1607 /* NVM SW-Section offset (in words) definitions */ 1608 IWM_NVM_SW_SECTION = 0x1C0, 1609 IWM_NVM_VERSION = 0, 1610 IWM_RADIO_CFG = 1, 1611 IWM_SKU = 2, 1612 IWM_N_HW_ADDRS = 3, 1613 IWM_NVM_CHANNELS = 0x1E0 - IWM_NVM_SW_SECTION, 1614 1615 /* NVM calibration section offset (in words) definitions */ 1616 IWM_NVM_CALIB_SECTION = 0x2B8, 1617 IWM_XTAL_CALIB = 0x316 - IWM_NVM_CALIB_SECTION 1618 }; 1619 1620 /* SKU Capabilities (actual values from NVM definition) */ 1621 enum nvm_sku_bits { 1622 IWM_NVM_SKU_CAP_BAND_24GHZ = (1 << 0), 1623 IWM_NVM_SKU_CAP_BAND_52GHZ = (1 << 1), 1624 IWM_NVM_SKU_CAP_11N_ENABLE = (1 << 2), 1625 IWM_NVM_SKU_CAP_11AC_ENABLE = (1 << 3), 1626 }; 1627 1628 /* radio config bits (actual values from NVM definition) */ 1629 #define IWM_NVM_RF_CFG_DASH_MSK(x) (x & 0x3) /* bits 0-1 */ 1630 #define IWM_NVM_RF_CFG_STEP_MSK(x) ((x >> 2) & 0x3) /* bits 2-3 */ 1631 #define IWM_NVM_RF_CFG_TYPE_MSK(x) ((x >> 4) & 0x3) /* bits 4-5 */ 1632 #define IWM_NVM_RF_CFG_PNUM_MSK(x) ((x >> 6) & 0x3) /* bits 6-7 */ 1633 #define IWM_NVM_RF_CFG_TX_ANT_MSK(x) ((x >> 8) & 0xF) /* bits 8-11 */ 1634 #define IWM_NVM_RF_CFG_RX_ANT_MSK(x) ((x >> 12) & 0xF) /* bits 12-15 */ 1635 1636 #define DEFAULT_MAX_TX_POWER 16 1637 1638 /** 1639 * enum iwm_nvm_channel_flags - channel flags in NVM 1640 * @IWM_NVM_CHANNEL_VALID: channel is usable for this SKU/geo 1641 * @IWM_NVM_CHANNEL_IBSS: usable as an IBSS channel 1642 * @IWM_NVM_CHANNEL_ACTIVE: active scanning allowed 1643 * @IWM_NVM_CHANNEL_RADAR: radar detection required 1644 * XXX cannot find this (DFS) flag in iwl-nvm-parse.c 1645 * @IWM_NVM_CHANNEL_DFS: dynamic freq selection candidate 1646 * @IWM_NVM_CHANNEL_WIDE: 20 MHz channel okay (?) 1647 * @IWM_NVM_CHANNEL_40MHZ: 40 MHz channel okay (?) 1648 * @IWM_NVM_CHANNEL_80MHZ: 80 MHz channel okay (?) 1649 * @IWM_NVM_CHANNEL_160MHZ: 160 MHz channel okay (?) 1650 */ 1651 enum iwm_nvm_channel_flags { 1652 IWM_NVM_CHANNEL_VALID = (1 << 0), 1653 IWM_NVM_CHANNEL_IBSS = (1 << 1), 1654 IWM_NVM_CHANNEL_ACTIVE = (1 << 3), 1655 IWM_NVM_CHANNEL_RADAR = (1 << 4), 1656 IWM_NVM_CHANNEL_DFS = (1 << 7), 1657 IWM_NVM_CHANNEL_WIDE = (1 << 8), 1658 IWM_NVM_CHANNEL_40MHZ = (1 << 9), 1659 IWM_NVM_CHANNEL_80MHZ = (1 << 10), 1660 IWM_NVM_CHANNEL_160MHZ = (1 << 11), 1661 }; 1662 1663 /* 1664 * Translate EEPROM flags to net80211. 1665 */ 1666 static uint32_t 1667 iwm_eeprom_channel_flags(uint16_t ch_flags) 1668 { 1669 uint32_t nflags; 1670 1671 nflags = 0; 1672 if ((ch_flags & IWM_NVM_CHANNEL_ACTIVE) == 0) 1673 nflags |= IEEE80211_CHAN_PASSIVE; 1674 if ((ch_flags & IWM_NVM_CHANNEL_IBSS) == 0) 1675 nflags |= IEEE80211_CHAN_NOADHOC; 1676 if (ch_flags & IWM_NVM_CHANNEL_RADAR) { 1677 nflags |= IEEE80211_CHAN_DFS; 1678 /* Just in case. */ 1679 nflags |= IEEE80211_CHAN_NOADHOC; 1680 } 1681 1682 return (nflags); 1683 } 1684 1685 static void 1686 iwm_add_channel_band(struct iwm_softc *sc, struct ieee80211_channel chans[], 1687 int maxchans, int *nchans, int ch_idx, int ch_num, const uint8_t bands[]) 1688 { 1689 const uint16_t * const nvm_ch_flags = sc->sc_nvm.nvm_ch_flags; 1690 uint32_t nflags; 1691 uint16_t ch_flags; 1692 uint8_t ieee; 1693 int error; 1694 1695 for (; ch_idx < ch_num; ch_idx++) { 1696 ch_flags = le16_to_cpup(nvm_ch_flags + ch_idx); 1697 ieee = iwm_nvm_channels[ch_idx]; 1698 1699 if (!(ch_flags & IWM_NVM_CHANNEL_VALID)) { 1700 IWM_DPRINTF(sc, IWM_DEBUG_EEPROM, 1701 "Ch. %d Flags %x [%sGHz] - No traffic\n", 1702 ieee, ch_flags, 1703 (ch_idx >= IWM_NUM_2GHZ_CHANNELS) ? 1704 "5.2" : "2.4"); 1705 continue; 1706 } 1707 1708 nflags = iwm_eeprom_channel_flags(ch_flags); 1709 error = ieee80211_add_channel(chans, maxchans, nchans, 1710 ieee, 0, 0, nflags, bands); 1711 if (error != 0) 1712 break; 1713 1714 IWM_DPRINTF(sc, IWM_DEBUG_EEPROM, 1715 "Ch. %d Flags %x [%sGHz] - Added\n", 1716 ieee, ch_flags, 1717 (ch_idx >= IWM_NUM_2GHZ_CHANNELS) ? 1718 "5.2" : "2.4"); 1719 } 1720 } 1721 1722 static void 1723 iwm_init_channel_map(struct ieee80211com *ic, int maxchans, int *nchans, 1724 struct ieee80211_channel chans[]) 1725 { 1726 struct iwm_softc *sc = ic->ic_softc; 1727 struct iwm_nvm_data *data = &sc->sc_nvm; 1728 uint8_t bands[howmany(IEEE80211_MODE_MAX, 8)]; 1729 1730 memset(bands, 0, sizeof(bands)); 1731 /* 1-13: 11b/g channels. */ 1732 setbit(bands, IEEE80211_MODE_11B); 1733 setbit(bands, IEEE80211_MODE_11G); 1734 iwm_add_channel_band(sc, chans, maxchans, nchans, 0, 1735 IWM_NUM_2GHZ_CHANNELS - 1, bands); 1736 1737 /* 14: 11b channel only. */ 1738 clrbit(bands, IEEE80211_MODE_11G); 1739 iwm_add_channel_band(sc, chans, maxchans, nchans, 1740 IWM_NUM_2GHZ_CHANNELS - 1, 1, bands); 1741 1742 if (data->sku_cap_band_52GHz_enable) { 1743 memset(bands, 0, sizeof(bands)); 1744 setbit(bands, IEEE80211_MODE_11A); 1745 iwm_add_channel_band(sc, chans, maxchans, nchans, 1746 IWM_NUM_2GHZ_CHANNELS, 1747 nitems(iwm_nvm_channels) - IWM_NUM_2GHZ_CHANNELS, bands); 1748 } 1749 } 1750 1751 static int 1752 iwm_parse_nvm_data(struct iwm_softc *sc, 1753 const uint16_t *nvm_hw, const uint16_t *nvm_sw, 1754 const uint16_t *nvm_calib, uint8_t tx_chains, uint8_t rx_chains) 1755 { 1756 struct iwm_nvm_data *data = &sc->sc_nvm; 1757 uint8_t hw_addr[IEEE80211_ADDR_LEN]; 1758 uint16_t radio_cfg, sku; 1759 1760 data->nvm_version = le16_to_cpup(nvm_sw + IWM_NVM_VERSION); 1761 1762 radio_cfg = le16_to_cpup(nvm_sw + IWM_RADIO_CFG); 1763 data->radio_cfg_type = IWM_NVM_RF_CFG_TYPE_MSK(radio_cfg); 1764 data->radio_cfg_step = IWM_NVM_RF_CFG_STEP_MSK(radio_cfg); 1765 data->radio_cfg_dash = IWM_NVM_RF_CFG_DASH_MSK(radio_cfg); 1766 data->radio_cfg_pnum = IWM_NVM_RF_CFG_PNUM_MSK(radio_cfg); 1767 data->valid_tx_ant = IWM_NVM_RF_CFG_TX_ANT_MSK(radio_cfg); 1768 data->valid_rx_ant = IWM_NVM_RF_CFG_RX_ANT_MSK(radio_cfg); 1769 1770 sku = le16_to_cpup(nvm_sw + IWM_SKU); 1771 data->sku_cap_band_24GHz_enable = sku & IWM_NVM_SKU_CAP_BAND_24GHZ; 1772 data->sku_cap_band_52GHz_enable = sku & IWM_NVM_SKU_CAP_BAND_52GHZ; 1773 data->sku_cap_11n_enable = 0; 1774 1775 if (!data->valid_tx_ant || !data->valid_rx_ant) { 1776 device_printf(sc->sc_dev, 1777 "%s: invalid antennas (0x%x, 0x%x)\n", 1778 __func__, data->valid_tx_ant, 1779 data->valid_rx_ant); 1780 return EINVAL; 1781 } 1782 1783 data->n_hw_addrs = le16_to_cpup(nvm_sw + IWM_N_HW_ADDRS); 1784 1785 data->xtal_calib[0] = *(nvm_calib + IWM_XTAL_CALIB); 1786 data->xtal_calib[1] = *(nvm_calib + IWM_XTAL_CALIB + 1); 1787 1788 /* The byte order is little endian 16 bit, meaning 214365 */ 1789 IEEE80211_ADDR_COPY(hw_addr, nvm_hw + IWM_HW_ADDR); 1790 data->hw_addr[0] = hw_addr[1]; 1791 data->hw_addr[1] = hw_addr[0]; 1792 data->hw_addr[2] = hw_addr[3]; 1793 data->hw_addr[3] = hw_addr[2]; 1794 data->hw_addr[4] = hw_addr[5]; 1795 data->hw_addr[5] = hw_addr[4]; 1796 1797 memcpy(data->nvm_ch_flags, &nvm_sw[IWM_NVM_CHANNELS], 1798 sizeof(data->nvm_ch_flags)); 1799 data->calib_version = 255; /* TODO: 1800 this value will prevent some checks from 1801 failing, we need to check if this 1802 field is still needed, and if it does, 1803 where is it in the NVM */ 1804 1805 return 0; 1806 } 1807 1808 /* 1809 * END NVM PARSE 1810 */ 1811 1812 struct iwm_nvm_section { 1813 uint16_t length; 1814 const uint8_t *data; 1815 }; 1816 1817 static int 1818 iwm_parse_nvm_sections(struct iwm_softc *sc, struct iwm_nvm_section *sections) 1819 { 1820 const uint16_t *hw, *sw, *calib; 1821 1822 /* Checking for required sections */ 1823 if (!sections[IWM_NVM_SECTION_TYPE_SW].data || 1824 !sections[IWM_NVM_SECTION_TYPE_HW].data) { 1825 device_printf(sc->sc_dev, 1826 "%s: Can't parse empty NVM sections\n", 1827 __func__); 1828 return ENOENT; 1829 } 1830 1831 hw = (const uint16_t *)sections[IWM_NVM_SECTION_TYPE_HW].data; 1832 sw = (const uint16_t *)sections[IWM_NVM_SECTION_TYPE_SW].data; 1833 calib = (const uint16_t *)sections[IWM_NVM_SECTION_TYPE_CALIBRATION].data; 1834 return iwm_parse_nvm_data(sc, hw, sw, calib, 1835 IWM_FW_VALID_TX_ANT(sc), IWM_FW_VALID_RX_ANT(sc)); 1836 } 1837 1838 static int 1839 iwm_nvm_init(struct iwm_softc *sc) 1840 { 1841 struct iwm_nvm_section nvm_sections[IWM_NVM_NUM_OF_SECTIONS]; 1842 int i, section, error; 1843 uint16_t len; 1844 uint8_t *nvm_buffer, *temp; 1845 1846 /* Read From FW NVM */ 1847 IWM_DPRINTF(sc, IWM_DEBUG_EEPROM, 1848 "%s: Read NVM\n", 1849 __func__); 1850 1851 /* TODO: find correct NVM max size for a section */ 1852 nvm_buffer = malloc(IWM_OTP_LOW_IMAGE_SIZE, M_DEVBUF, M_NOWAIT); 1853 if (nvm_buffer == NULL) 1854 return (ENOMEM); 1855 for (i = 0; i < nitems(nvm_to_read); i++) { 1856 section = nvm_to_read[i]; 1857 KASSERT(section <= nitems(nvm_sections), 1858 ("too many sections")); 1859 1860 error = iwm_nvm_read_section(sc, section, nvm_buffer, &len); 1861 if (error) 1862 break; 1863 1864 temp = malloc(len, M_DEVBUF, M_NOWAIT); 1865 if (temp == NULL) { 1866 error = ENOMEM; 1867 break; 1868 } 1869 memcpy(temp, nvm_buffer, len); 1870 nvm_sections[section].data = temp; 1871 nvm_sections[section].length = len; 1872 } 1873 free(nvm_buffer, M_DEVBUF); 1874 if (error) 1875 return error; 1876 1877 return iwm_parse_nvm_sections(sc, nvm_sections); 1878 } 1879 1880 /* 1881 * Firmware loading gunk. This is kind of a weird hybrid between the 1882 * iwn driver and the Linux iwlwifi driver. 1883 */ 1884 1885 static int 1886 iwm_firmware_load_chunk(struct iwm_softc *sc, uint32_t dst_addr, 1887 const uint8_t *section, uint32_t byte_cnt) 1888 { 1889 struct iwm_dma_info *dma = &sc->fw_dma; 1890 int error; 1891 1892 /* Copy firmware section into pre-allocated DMA-safe memory. */ 1893 memcpy(dma->vaddr, section, byte_cnt); 1894 bus_dmamap_sync(dma->tag, dma->map, BUS_DMASYNC_PREWRITE); 1895 1896 if (!iwm_nic_lock(sc)) 1897 return EBUSY; 1898 1899 sc->sc_fw_chunk_done = 0; 1900 1901 IWM_WRITE(sc, IWM_FH_TCSR_CHNL_TX_CONFIG_REG(IWM_FH_SRVC_CHNL), 1902 IWM_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_PAUSE); 1903 IWM_WRITE(sc, IWM_FH_SRVC_CHNL_SRAM_ADDR_REG(IWM_FH_SRVC_CHNL), 1904 dst_addr); 1905 IWM_WRITE(sc, IWM_FH_TFDIB_CTRL0_REG(IWM_FH_SRVC_CHNL), 1906 dma->paddr & IWM_FH_MEM_TFDIB_DRAM_ADDR_LSB_MSK); 1907 IWM_WRITE(sc, IWM_FH_TFDIB_CTRL1_REG(IWM_FH_SRVC_CHNL), 1908 (iwm_get_dma_hi_addr(dma->paddr) 1909 << IWM_FH_MEM_TFDIB_REG1_ADDR_BITSHIFT) | byte_cnt); 1910 IWM_WRITE(sc, IWM_FH_TCSR_CHNL_TX_BUF_STS_REG(IWM_FH_SRVC_CHNL), 1911 1 << IWM_FH_TCSR_CHNL_TX_BUF_STS_REG_POS_TB_NUM | 1912 1 << IWM_FH_TCSR_CHNL_TX_BUF_STS_REG_POS_TB_IDX | 1913 IWM_FH_TCSR_CHNL_TX_BUF_STS_REG_VAL_TFDB_VALID); 1914 IWM_WRITE(sc, IWM_FH_TCSR_CHNL_TX_CONFIG_REG(IWM_FH_SRVC_CHNL), 1915 IWM_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_ENABLE | 1916 IWM_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_DISABLE | 1917 IWM_FH_TCSR_TX_CONFIG_REG_VAL_CIRQ_HOST_ENDTFD); 1918 1919 iwm_nic_unlock(sc); 1920 1921 /* wait 1s for this segment to load */ 1922 while (!sc->sc_fw_chunk_done) 1923 if ((error = msleep(&sc->sc_fw, &sc->sc_mtx, 0, "iwmfw", hz)) != 0) 1924 break; 1925 1926 return error; 1927 } 1928 1929 static int 1930 iwm_load_firmware(struct iwm_softc *sc, enum iwm_ucode_type ucode_type) 1931 { 1932 struct iwm_fw_sects *fws; 1933 int error, i, w; 1934 const void *data; 1935 uint32_t dlen; 1936 uint32_t offset; 1937 1938 sc->sc_uc.uc_intr = 0; 1939 1940 fws = &sc->sc_fw.fw_sects[ucode_type]; 1941 for (i = 0; i < fws->fw_count; i++) { 1942 data = fws->fw_sect[i].fws_data; 1943 dlen = fws->fw_sect[i].fws_len; 1944 offset = fws->fw_sect[i].fws_devoff; 1945 IWM_DPRINTF(sc, IWM_DEBUG_FIRMWARE_TLV, 1946 "LOAD FIRMWARE type %d offset %u len %d\n", 1947 ucode_type, offset, dlen); 1948 error = iwm_firmware_load_chunk(sc, offset, data, dlen); 1949 if (error) { 1950 device_printf(sc->sc_dev, 1951 "%s: chunk %u of %u returned error %02d\n", 1952 __func__, i, fws->fw_count, error); 1953 return error; 1954 } 1955 } 1956 1957 /* wait for the firmware to load */ 1958 IWM_WRITE(sc, IWM_CSR_RESET, 0); 1959 1960 for (w = 0; !sc->sc_uc.uc_intr && w < 10; w++) { 1961 error = msleep(&sc->sc_uc, &sc->sc_mtx, 0, "iwmuc", hz/10); 1962 } 1963 1964 return error; 1965 } 1966 1967 /* iwlwifi: pcie/trans.c */ 1968 static int 1969 iwm_start_fw(struct iwm_softc *sc, enum iwm_ucode_type ucode_type) 1970 { 1971 int error; 1972 1973 IWM_WRITE(sc, IWM_CSR_INT, ~0); 1974 1975 if ((error = iwm_nic_init(sc)) != 0) { 1976 device_printf(sc->sc_dev, "unable to init nic\n"); 1977 return error; 1978 } 1979 1980 /* make sure rfkill handshake bits are cleared */ 1981 IWM_WRITE(sc, IWM_CSR_UCODE_DRV_GP1_CLR, IWM_CSR_UCODE_SW_BIT_RFKILL); 1982 IWM_WRITE(sc, IWM_CSR_UCODE_DRV_GP1_CLR, 1983 IWM_CSR_UCODE_DRV_GP1_BIT_CMD_BLOCKED); 1984 1985 /* clear (again), then enable host interrupts */ 1986 IWM_WRITE(sc, IWM_CSR_INT, ~0); 1987 iwm_enable_interrupts(sc); 1988 1989 /* really make sure rfkill handshake bits are cleared */ 1990 /* maybe we should write a few times more? just to make sure */ 1991 IWM_WRITE(sc, IWM_CSR_UCODE_DRV_GP1_CLR, IWM_CSR_UCODE_SW_BIT_RFKILL); 1992 IWM_WRITE(sc, IWM_CSR_UCODE_DRV_GP1_CLR, IWM_CSR_UCODE_SW_BIT_RFKILL); 1993 1994 /* Load the given image to the HW */ 1995 return iwm_load_firmware(sc, ucode_type); 1996 } 1997 1998 static int 1999 iwm_fw_alive(struct iwm_softc *sc, uint32_t sched_base) 2000 { 2001 return iwm_post_alive(sc); 2002 } 2003 2004 static int 2005 iwm_send_tx_ant_cfg(struct iwm_softc *sc, uint8_t valid_tx_ant) 2006 { 2007 struct iwm_tx_ant_cfg_cmd tx_ant_cmd = { 2008 .valid = htole32(valid_tx_ant), 2009 }; 2010 2011 return iwm_mvm_send_cmd_pdu(sc, IWM_TX_ANT_CONFIGURATION_CMD, 2012 IWM_CMD_SYNC, sizeof(tx_ant_cmd), &tx_ant_cmd); 2013 } 2014 2015 /* iwlwifi: mvm/fw.c */ 2016 static int 2017 iwm_send_phy_cfg_cmd(struct iwm_softc *sc) 2018 { 2019 struct iwm_phy_cfg_cmd phy_cfg_cmd; 2020 enum iwm_ucode_type ucode_type = sc->sc_uc_current; 2021 2022 /* Set parameters */ 2023 phy_cfg_cmd.phy_cfg = htole32(sc->sc_fw_phy_config); 2024 phy_cfg_cmd.calib_control.event_trigger = 2025 sc->sc_default_calib[ucode_type].event_trigger; 2026 phy_cfg_cmd.calib_control.flow_trigger = 2027 sc->sc_default_calib[ucode_type].flow_trigger; 2028 2029 IWM_DPRINTF(sc, IWM_DEBUG_CMD | IWM_DEBUG_RESET, 2030 "Sending Phy CFG command: 0x%x\n", phy_cfg_cmd.phy_cfg); 2031 return iwm_mvm_send_cmd_pdu(sc, IWM_PHY_CONFIGURATION_CMD, IWM_CMD_SYNC, 2032 sizeof(phy_cfg_cmd), &phy_cfg_cmd); 2033 } 2034 2035 static int 2036 iwm_mvm_load_ucode_wait_alive(struct iwm_softc *sc, 2037 enum iwm_ucode_type ucode_type) 2038 { 2039 enum iwm_ucode_type old_type = sc->sc_uc_current; 2040 int error; 2041 2042 if ((error = iwm_read_firmware(sc, ucode_type)) != 0) 2043 return error; 2044 2045 sc->sc_uc_current = ucode_type; 2046 error = iwm_start_fw(sc, ucode_type); 2047 if (error) { 2048 sc->sc_uc_current = old_type; 2049 return error; 2050 } 2051 2052 return iwm_fw_alive(sc, sc->sched_base); 2053 } 2054 2055 /* 2056 * mvm misc bits 2057 */ 2058 2059 /* 2060 * follows iwlwifi/fw.c 2061 */ 2062 static int 2063 iwm_run_init_mvm_ucode(struct iwm_softc *sc, int justnvm) 2064 { 2065 int error; 2066 2067 /* do not operate with rfkill switch turned on */ 2068 if ((sc->sc_flags & IWM_FLAG_RFKILL) && !justnvm) { 2069 device_printf(sc->sc_dev, 2070 "radio is disabled by hardware switch\n"); 2071 return EPERM; 2072 } 2073 2074 sc->sc_init_complete = 0; 2075 if ((error = iwm_mvm_load_ucode_wait_alive(sc, 2076 IWM_UCODE_TYPE_INIT)) != 0) 2077 return error; 2078 2079 if (justnvm) { 2080 if ((error = iwm_nvm_init(sc)) != 0) { 2081 device_printf(sc->sc_dev, "failed to read nvm\n"); 2082 return error; 2083 } 2084 IEEE80211_ADDR_COPY(sc->sc_ic.ic_macaddr, sc->sc_nvm.hw_addr); 2085 2086 sc->sc_scan_cmd_len = sizeof(struct iwm_scan_cmd) 2087 + sc->sc_capa_max_probe_len 2088 + IWM_MAX_NUM_SCAN_CHANNELS 2089 * sizeof(struct iwm_scan_channel); 2090 sc->sc_scan_cmd = malloc(sc->sc_scan_cmd_len, M_DEVBUF, 2091 M_NOWAIT); 2092 if (sc->sc_scan_cmd == NULL) 2093 return (ENOMEM); 2094 2095 return 0; 2096 } 2097 2098 /* Send TX valid antennas before triggering calibrations */ 2099 if ((error = iwm_send_tx_ant_cfg(sc, IWM_FW_VALID_TX_ANT(sc))) != 0) 2100 return error; 2101 2102 /* 2103 * Send phy configurations command to init uCode 2104 * to start the 16.0 uCode init image internal calibrations. 2105 */ 2106 if ((error = iwm_send_phy_cfg_cmd(sc)) != 0 ) { 2107 device_printf(sc->sc_dev, 2108 "%s: failed to run internal calibration: %d\n", 2109 __func__, error); 2110 return error; 2111 } 2112 2113 /* 2114 * Nothing to do but wait for the init complete notification 2115 * from the firmware 2116 */ 2117 while (!sc->sc_init_complete) 2118 if ((error = msleep(&sc->sc_init_complete, &sc->sc_mtx, 2119 0, "iwminit", 2*hz)) != 0) 2120 break; 2121 2122 return error; 2123 } 2124 2125 /* 2126 * receive side 2127 */ 2128 2129 /* (re)stock rx ring, called at init-time and at runtime */ 2130 static int 2131 iwm_rx_addbuf(struct iwm_softc *sc, int size, int idx) 2132 { 2133 struct iwm_rx_ring *ring = &sc->rxq; 2134 struct iwm_rx_data *data = &ring->data[idx]; 2135 struct mbuf *m; 2136 int error; 2137 bus_addr_t paddr; 2138 2139 m = m_getjcl(M_NOWAIT, MT_DATA, M_PKTHDR, IWM_RBUF_SIZE); 2140 if (m == NULL) 2141 return ENOBUFS; 2142 2143 if (data->m != NULL) 2144 bus_dmamap_unload(ring->data_dmat, data->map); 2145 2146 m->m_len = m->m_pkthdr.len = m->m_ext.ext_size; 2147 error = bus_dmamap_create(ring->data_dmat, 0, &data->map); 2148 if (error != 0) { 2149 device_printf(sc->sc_dev, 2150 "%s: could not create RX buf DMA map, error %d\n", 2151 __func__, error); 2152 goto fail; 2153 } 2154 data->m = m; 2155 error = bus_dmamap_load(ring->data_dmat, data->map, 2156 mtod(data->m, void *), IWM_RBUF_SIZE, iwm_dma_map_addr, 2157 &paddr, BUS_DMA_NOWAIT); 2158 if (error != 0 && error != EFBIG) { 2159 device_printf(sc->sc_dev, 2160 "%s: can't not map mbuf, error %d\n", __func__, 2161 error); 2162 goto fail; 2163 } 2164 bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_PREREAD); 2165 2166 /* Update RX descriptor. */ 2167 ring->desc[idx] = htole32(paddr >> 8); 2168 bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map, 2169 BUS_DMASYNC_PREWRITE); 2170 2171 return 0; 2172 fail: 2173 return error; 2174 } 2175 2176 /* iwlwifi: mvm/rx.c */ 2177 #define IWM_RSSI_OFFSET 50 2178 static int 2179 iwm_mvm_calc_rssi(struct iwm_softc *sc, struct iwm_rx_phy_info *phy_info) 2180 { 2181 int rssi_a, rssi_b, rssi_a_dbm, rssi_b_dbm, max_rssi_dbm; 2182 uint32_t agc_a, agc_b; 2183 uint32_t val; 2184 2185 val = le32toh(phy_info->non_cfg_phy[IWM_RX_INFO_AGC_IDX]); 2186 agc_a = (val & IWM_OFDM_AGC_A_MSK) >> IWM_OFDM_AGC_A_POS; 2187 agc_b = (val & IWM_OFDM_AGC_B_MSK) >> IWM_OFDM_AGC_B_POS; 2188 2189 val = le32toh(phy_info->non_cfg_phy[IWM_RX_INFO_RSSI_AB_IDX]); 2190 rssi_a = (val & IWM_OFDM_RSSI_INBAND_A_MSK) >> IWM_OFDM_RSSI_A_POS; 2191 rssi_b = (val & IWM_OFDM_RSSI_INBAND_B_MSK) >> IWM_OFDM_RSSI_B_POS; 2192 2193 /* 2194 * dBm = rssi dB - agc dB - constant. 2195 * Higher AGC (higher radio gain) means lower signal. 2196 */ 2197 rssi_a_dbm = rssi_a - IWM_RSSI_OFFSET - agc_a; 2198 rssi_b_dbm = rssi_b - IWM_RSSI_OFFSET - agc_b; 2199 max_rssi_dbm = MAX(rssi_a_dbm, rssi_b_dbm); 2200 2201 IWM_DPRINTF(sc, IWM_DEBUG_RECV, 2202 "Rssi In A %d B %d Max %d AGCA %d AGCB %d\n", 2203 rssi_a_dbm, rssi_b_dbm, max_rssi_dbm, agc_a, agc_b); 2204 2205 return max_rssi_dbm; 2206 } 2207 2208 /* iwlwifi: mvm/rx.c */ 2209 /* 2210 * iwm_mvm_get_signal_strength - use new rx PHY INFO API 2211 * values are reported by the fw as positive values - need to negate 2212 * to obtain their dBM. Account for missing antennas by replacing 0 2213 * values by -256dBm: practically 0 power and a non-feasible 8 bit value. 2214 */ 2215 static int 2216 iwm_mvm_get_signal_strength(struct iwm_softc *sc, struct iwm_rx_phy_info *phy_info) 2217 { 2218 int energy_a, energy_b, energy_c, max_energy; 2219 uint32_t val; 2220 2221 val = le32toh(phy_info->non_cfg_phy[IWM_RX_INFO_ENERGY_ANT_ABC_IDX]); 2222 energy_a = (val & IWM_RX_INFO_ENERGY_ANT_A_MSK) >> 2223 IWM_RX_INFO_ENERGY_ANT_A_POS; 2224 energy_a = energy_a ? -energy_a : -256; 2225 energy_b = (val & IWM_RX_INFO_ENERGY_ANT_B_MSK) >> 2226 IWM_RX_INFO_ENERGY_ANT_B_POS; 2227 energy_b = energy_b ? -energy_b : -256; 2228 energy_c = (val & IWM_RX_INFO_ENERGY_ANT_C_MSK) >> 2229 IWM_RX_INFO_ENERGY_ANT_C_POS; 2230 energy_c = energy_c ? -energy_c : -256; 2231 max_energy = MAX(energy_a, energy_b); 2232 max_energy = MAX(max_energy, energy_c); 2233 2234 IWM_DPRINTF(sc, IWM_DEBUG_RECV, 2235 "energy In A %d B %d C %d , and max %d\n", 2236 energy_a, energy_b, energy_c, max_energy); 2237 2238 return max_energy; 2239 } 2240 2241 static void 2242 iwm_mvm_rx_rx_phy_cmd(struct iwm_softc *sc, 2243 struct iwm_rx_packet *pkt, struct iwm_rx_data *data) 2244 { 2245 struct iwm_rx_phy_info *phy_info = (void *)pkt->data; 2246 2247 IWM_DPRINTF(sc, IWM_DEBUG_RECV, "received PHY stats\n"); 2248 bus_dmamap_sync(sc->rxq.data_dmat, data->map, BUS_DMASYNC_POSTREAD); 2249 2250 memcpy(&sc->sc_last_phy_info, phy_info, sizeof(sc->sc_last_phy_info)); 2251 } 2252 2253 /* 2254 * Retrieve the average noise (in dBm) among receivers. 2255 */ 2256 static int 2257 iwm_get_noise(const struct iwm_mvm_statistics_rx_non_phy *stats) 2258 { 2259 int i, total, nbant, noise; 2260 2261 total = nbant = noise = 0; 2262 for (i = 0; i < 3; i++) { 2263 noise = le32toh(stats->beacon_silence_rssi[i]) & 0xff; 2264 if (noise) { 2265 total += noise; 2266 nbant++; 2267 } 2268 } 2269 2270 /* There should be at least one antenna but check anyway. */ 2271 return (nbant == 0) ? -127 : (total / nbant) - 107; 2272 } 2273 2274 /* 2275 * iwm_mvm_rx_rx_mpdu - IWM_REPLY_RX_MPDU_CMD handler 2276 * 2277 * Handles the actual data of the Rx packet from the fw 2278 */ 2279 static void 2280 iwm_mvm_rx_rx_mpdu(struct iwm_softc *sc, 2281 struct iwm_rx_packet *pkt, struct iwm_rx_data *data) 2282 { 2283 struct ieee80211com *ic = &sc->sc_ic; 2284 struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps); 2285 struct ieee80211_frame *wh; 2286 struct ieee80211_node *ni; 2287 struct ieee80211_rx_stats rxs; 2288 struct mbuf *m; 2289 struct iwm_rx_phy_info *phy_info; 2290 struct iwm_rx_mpdu_res_start *rx_res; 2291 uint32_t len; 2292 uint32_t rx_pkt_status; 2293 int rssi; 2294 2295 bus_dmamap_sync(sc->rxq.data_dmat, data->map, BUS_DMASYNC_POSTREAD); 2296 2297 phy_info = &sc->sc_last_phy_info; 2298 rx_res = (struct iwm_rx_mpdu_res_start *)pkt->data; 2299 wh = (struct ieee80211_frame *)(pkt->data + sizeof(*rx_res)); 2300 len = le16toh(rx_res->byte_count); 2301 rx_pkt_status = le32toh(*(uint32_t *)(pkt->data + sizeof(*rx_res) + len)); 2302 2303 m = data->m; 2304 m->m_data = pkt->data + sizeof(*rx_res); 2305 m->m_pkthdr.len = m->m_len = len; 2306 2307 if (__predict_false(phy_info->cfg_phy_cnt > 20)) { 2308 device_printf(sc->sc_dev, 2309 "dsp size out of range [0,20]: %d\n", 2310 phy_info->cfg_phy_cnt); 2311 return; 2312 } 2313 2314 if (!(rx_pkt_status & IWM_RX_MPDU_RES_STATUS_CRC_OK) || 2315 !(rx_pkt_status & IWM_RX_MPDU_RES_STATUS_OVERRUN_OK)) { 2316 IWM_DPRINTF(sc, IWM_DEBUG_RECV, 2317 "Bad CRC or FIFO: 0x%08X.\n", rx_pkt_status); 2318 return; /* drop */ 2319 } 2320 2321 if (sc->sc_capaflags & IWM_UCODE_TLV_FLAGS_RX_ENERGY_API) { 2322 rssi = iwm_mvm_get_signal_strength(sc, phy_info); 2323 } else { 2324 rssi = iwm_mvm_calc_rssi(sc, phy_info); 2325 } 2326 rssi = (0 - IWM_MIN_DBM) + rssi; /* normalize */ 2327 rssi = MIN(rssi, sc->sc_max_rssi); /* clip to max. 100% */ 2328 2329 /* replenish ring for the buffer we're going to feed to the sharks */ 2330 if (iwm_rx_addbuf(sc, IWM_RBUF_SIZE, sc->rxq.cur) != 0) { 2331 device_printf(sc->sc_dev, "%s: unable to add more buffers\n", 2332 __func__); 2333 return; 2334 } 2335 2336 ni = ieee80211_find_rxnode(ic, (struct ieee80211_frame_min *)wh); 2337 2338 IWM_DPRINTF(sc, IWM_DEBUG_RECV, 2339 "%s: phy_info: channel=%d, flags=0x%08x\n", 2340 __func__, 2341 le16toh(phy_info->channel), 2342 le16toh(phy_info->phy_flags)); 2343 2344 /* 2345 * Populate an RX state struct with the provided information. 2346 */ 2347 bzero(&rxs, sizeof(rxs)); 2348 rxs.r_flags |= IEEE80211_R_IEEE | IEEE80211_R_FREQ; 2349 rxs.r_flags |= IEEE80211_R_NF | IEEE80211_R_RSSI; 2350 rxs.c_ieee = le16toh(phy_info->channel); 2351 if (le16toh(phy_info->phy_flags & IWM_RX_RES_PHY_FLAGS_BAND_24)) { 2352 rxs.c_freq = ieee80211_ieee2mhz(rxs.c_ieee, IEEE80211_CHAN_2GHZ); 2353 } else { 2354 rxs.c_freq = ieee80211_ieee2mhz(rxs.c_ieee, IEEE80211_CHAN_5GHZ); 2355 } 2356 rxs.rssi = rssi - sc->sc_noise; 2357 rxs.nf = sc->sc_noise; 2358 2359 if (ieee80211_radiotap_active_vap(vap)) { 2360 struct iwm_rx_radiotap_header *tap = &sc->sc_rxtap; 2361 2362 tap->wr_flags = 0; 2363 if (phy_info->phy_flags & htole16(IWM_PHY_INFO_FLAG_SHPREAMBLE)) 2364 tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE; 2365 tap->wr_chan_freq = htole16(rxs.c_freq); 2366 /* XXX only if ic->ic_curchan->ic_ieee == rxs.c_ieee */ 2367 tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags); 2368 tap->wr_dbm_antsignal = (int8_t)rssi; 2369 tap->wr_dbm_antnoise = (int8_t)sc->sc_noise; 2370 tap->wr_tsft = phy_info->system_timestamp; 2371 switch (phy_info->rate) { 2372 /* CCK rates. */ 2373 case 10: tap->wr_rate = 2; break; 2374 case 20: tap->wr_rate = 4; break; 2375 case 55: tap->wr_rate = 11; break; 2376 case 110: tap->wr_rate = 22; break; 2377 /* OFDM rates. */ 2378 case 0xd: tap->wr_rate = 12; break; 2379 case 0xf: tap->wr_rate = 18; break; 2380 case 0x5: tap->wr_rate = 24; break; 2381 case 0x7: tap->wr_rate = 36; break; 2382 case 0x9: tap->wr_rate = 48; break; 2383 case 0xb: tap->wr_rate = 72; break; 2384 case 0x1: tap->wr_rate = 96; break; 2385 case 0x3: tap->wr_rate = 108; break; 2386 /* Unknown rate: should not happen. */ 2387 default: tap->wr_rate = 0; 2388 } 2389 } 2390 2391 IWM_UNLOCK(sc); 2392 if (ni != NULL) { 2393 IWM_DPRINTF(sc, IWM_DEBUG_RECV, "input m %p\n", m); 2394 ieee80211_input_mimo(ni, m, &rxs); 2395 ieee80211_free_node(ni); 2396 } else { 2397 IWM_DPRINTF(sc, IWM_DEBUG_RECV, "inputall m %p\n", m); 2398 ieee80211_input_mimo_all(ic, m, &rxs); 2399 } 2400 IWM_LOCK(sc); 2401 } 2402 2403 static int 2404 iwm_mvm_rx_tx_cmd_single(struct iwm_softc *sc, struct iwm_rx_packet *pkt, 2405 struct iwm_node *in) 2406 { 2407 struct iwm_mvm_tx_resp *tx_resp = (void *)pkt->data; 2408 struct ieee80211_node *ni = &in->in_ni; 2409 struct ieee80211vap *vap = ni->ni_vap; 2410 int status = le16toh(tx_resp->status.status) & IWM_TX_STATUS_MSK; 2411 int failack = tx_resp->failure_frame; 2412 2413 KASSERT(tx_resp->frame_count == 1, ("too many frames")); 2414 2415 /* Update rate control statistics. */ 2416 IWM_DPRINTF(sc, IWM_DEBUG_XMIT, "%s: status=0x%04x, seq=%d, fc=%d, btc=%d, frts=%d, ff=%d, irate=%08x, wmt=%d\n", 2417 __func__, 2418 (int) le16toh(tx_resp->status.status), 2419 (int) le16toh(tx_resp->status.sequence), 2420 tx_resp->frame_count, 2421 tx_resp->bt_kill_count, 2422 tx_resp->failure_rts, 2423 tx_resp->failure_frame, 2424 le32toh(tx_resp->initial_rate), 2425 (int) le16toh(tx_resp->wireless_media_time)); 2426 2427 if (status != IWM_TX_STATUS_SUCCESS && 2428 status != IWM_TX_STATUS_DIRECT_DONE) { 2429 ieee80211_ratectl_tx_complete(vap, ni, 2430 IEEE80211_RATECTL_TX_FAILURE, &failack, NULL); 2431 return (1); 2432 } else { 2433 ieee80211_ratectl_tx_complete(vap, ni, 2434 IEEE80211_RATECTL_TX_SUCCESS, &failack, NULL); 2435 return (0); 2436 } 2437 } 2438 2439 static void 2440 iwm_mvm_rx_tx_cmd(struct iwm_softc *sc, 2441 struct iwm_rx_packet *pkt, struct iwm_rx_data *data) 2442 { 2443 struct iwm_cmd_header *cmd_hdr = &pkt->hdr; 2444 int idx = cmd_hdr->idx; 2445 int qid = cmd_hdr->qid; 2446 struct iwm_tx_ring *ring = &sc->txq[qid]; 2447 struct iwm_tx_data *txd = &ring->data[idx]; 2448 struct iwm_node *in = txd->in; 2449 struct mbuf *m = txd->m; 2450 int status; 2451 2452 KASSERT(txd->done == 0, ("txd not done")); 2453 KASSERT(txd->in != NULL, ("txd without node")); 2454 KASSERT(txd->m != NULL, ("txd without mbuf")); 2455 2456 bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_POSTREAD); 2457 2458 sc->sc_tx_timer = 0; 2459 2460 status = iwm_mvm_rx_tx_cmd_single(sc, pkt, in); 2461 2462 /* Unmap and free mbuf. */ 2463 bus_dmamap_sync(ring->data_dmat, txd->map, BUS_DMASYNC_POSTWRITE); 2464 bus_dmamap_unload(ring->data_dmat, txd->map); 2465 2466 IWM_DPRINTF(sc, IWM_DEBUG_XMIT, 2467 "free txd %p, in %p\n", txd, txd->in); 2468 txd->done = 1; 2469 txd->m = NULL; 2470 txd->in = NULL; 2471 2472 ieee80211_tx_complete(&in->in_ni, m, status); 2473 2474 if (--ring->queued < IWM_TX_RING_LOMARK) { 2475 sc->qfullmsk &= ~(1 << ring->qid); 2476 if (sc->qfullmsk == 0) { 2477 /* 2478 * Well, we're in interrupt context, but then again 2479 * I guess net80211 does all sorts of stunts in 2480 * interrupt context, so maybe this is no biggie. 2481 */ 2482 iwm_start(sc); 2483 } 2484 } 2485 } 2486 2487 /* 2488 * transmit side 2489 */ 2490 2491 /* 2492 * Process a "command done" firmware notification. This is where we wakeup 2493 * processes waiting for a synchronous command completion. 2494 * from if_iwn 2495 */ 2496 static void 2497 iwm_cmd_done(struct iwm_softc *sc, struct iwm_rx_packet *pkt) 2498 { 2499 struct iwm_tx_ring *ring = &sc->txq[IWM_MVM_CMD_QUEUE]; 2500 struct iwm_tx_data *data; 2501 2502 if (pkt->hdr.qid != IWM_MVM_CMD_QUEUE) { 2503 return; /* Not a command ack. */ 2504 } 2505 2506 data = &ring->data[pkt->hdr.idx]; 2507 2508 /* If the command was mapped in an mbuf, free it. */ 2509 if (data->m != NULL) { 2510 bus_dmamap_sync(ring->data_dmat, data->map, 2511 BUS_DMASYNC_POSTWRITE); 2512 bus_dmamap_unload(ring->data_dmat, data->map); 2513 m_freem(data->m); 2514 data->m = NULL; 2515 } 2516 wakeup(&ring->desc[pkt->hdr.idx]); 2517 } 2518 2519 #if 0 2520 /* 2521 * necessary only for block ack mode 2522 */ 2523 void 2524 iwm_update_sched(struct iwm_softc *sc, int qid, int idx, uint8_t sta_id, 2525 uint16_t len) 2526 { 2527 struct iwm_agn_scd_bc_tbl *scd_bc_tbl; 2528 uint16_t w_val; 2529 2530 scd_bc_tbl = sc->sched_dma.vaddr; 2531 2532 len += 8; /* magic numbers came naturally from paris */ 2533 if (sc->sc_capaflags & IWM_UCODE_TLV_FLAGS_DW_BC_TABLE) 2534 len = roundup(len, 4) / 4; 2535 2536 w_val = htole16(sta_id << 12 | len); 2537 2538 /* Update TX scheduler. */ 2539 scd_bc_tbl[qid].tfd_offset[idx] = w_val; 2540 bus_dmamap_sync(sc->sched_dma.tag, sc->sched_dma.map, 2541 BUS_DMASYNC_PREWRITE); 2542 2543 /* I really wonder what this is ?!? */ 2544 if (idx < IWM_TFD_QUEUE_SIZE_BC_DUP) { 2545 scd_bc_tbl[qid].tfd_offset[IWM_TFD_QUEUE_SIZE_MAX + idx] = w_val; 2546 bus_dmamap_sync(sc->sched_dma.tag, sc->sched_dma.map, 2547 BUS_DMASYNC_PREWRITE); 2548 } 2549 } 2550 #endif 2551 2552 /* 2553 * Take an 802.11 (non-n) rate, find the relevant rate 2554 * table entry. return the index into in_ridx[]. 2555 * 2556 * The caller then uses that index back into in_ridx 2557 * to figure out the rate index programmed /into/ 2558 * the firmware for this given node. 2559 */ 2560 static int 2561 iwm_tx_rateidx_lookup(struct iwm_softc *sc, struct iwm_node *in, 2562 uint8_t rate) 2563 { 2564 int i; 2565 uint8_t r; 2566 2567 for (i = 0; i < nitems(in->in_ridx); i++) { 2568 r = iwm_rates[in->in_ridx[i]].rate; 2569 if (rate == r) 2570 return (i); 2571 } 2572 /* XXX Return the first */ 2573 /* XXX TODO: have it return the /lowest/ */ 2574 return (0); 2575 } 2576 2577 /* 2578 * Fill in the rate related information for a transmit command. 2579 */ 2580 static const struct iwm_rate * 2581 iwm_tx_fill_cmd(struct iwm_softc *sc, struct iwm_node *in, 2582 struct ieee80211_frame *wh, struct iwm_tx_cmd *tx) 2583 { 2584 struct ieee80211com *ic = &sc->sc_ic; 2585 struct ieee80211_node *ni = &in->in_ni; 2586 const struct iwm_rate *rinfo; 2587 int type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK; 2588 int ridx, rate_flags; 2589 2590 tx->rts_retry_limit = IWM_RTS_DFAULT_RETRY_LIMIT; 2591 tx->data_retry_limit = IWM_DEFAULT_TX_RETRY; 2592 2593 /* 2594 * XXX TODO: everything about the rate selection here is terrible! 2595 */ 2596 2597 if (type == IEEE80211_FC0_TYPE_DATA) { 2598 int i; 2599 /* for data frames, use RS table */ 2600 (void) ieee80211_ratectl_rate(ni, NULL, 0); 2601 i = iwm_tx_rateidx_lookup(sc, in, ni->ni_txrate); 2602 ridx = in->in_ridx[i]; 2603 2604 /* This is the index into the programmed table */ 2605 tx->initial_rate_index = i; 2606 tx->tx_flags |= htole32(IWM_TX_CMD_FLG_STA_RATE); 2607 IWM_DPRINTF(sc, IWM_DEBUG_XMIT | IWM_DEBUG_TXRATE, 2608 "%s: start with i=%d, txrate %d\n", 2609 __func__, i, iwm_rates[ridx].rate); 2610 } else { 2611 /* 2612 * For non-data, use the lowest supported rate for the given 2613 * operational mode. 2614 * 2615 * Note: there may not be any rate control information available. 2616 * This driver currently assumes if we're transmitting data 2617 * frames, use the rate control table. Grr. 2618 * 2619 * XXX TODO: use the configured rate for the traffic type! 2620 * XXX TODO: this should be per-vap, not curmode; as we later 2621 * on we'll want to handle off-channel stuff (eg TDLS). 2622 */ 2623 if (ic->ic_curmode == IEEE80211_MODE_11A) { 2624 /* 2625 * XXX this assumes the mode is either 11a or not 11a; 2626 * definitely won't work for 11n. 2627 */ 2628 ridx = IWM_RIDX_OFDM; 2629 } else { 2630 ridx = IWM_RIDX_CCK; 2631 } 2632 } 2633 2634 rinfo = &iwm_rates[ridx]; 2635 2636 IWM_DPRINTF(sc, IWM_DEBUG_TXRATE, "%s: ridx=%d; rate=%d, CCK=%d\n", 2637 __func__, ridx, 2638 rinfo->rate, 2639 !! (IWM_RIDX_IS_CCK(ridx)) 2640 ); 2641 2642 /* XXX TODO: hard-coded TX antenna? */ 2643 rate_flags = 1 << IWM_RATE_MCS_ANT_POS; 2644 if (IWM_RIDX_IS_CCK(ridx)) 2645 rate_flags |= IWM_RATE_MCS_CCK_MSK; 2646 tx->rate_n_flags = htole32(rate_flags | rinfo->plcp); 2647 2648 return rinfo; 2649 } 2650 2651 #define TB0_SIZE 16 2652 static int 2653 iwm_tx(struct iwm_softc *sc, struct mbuf *m, struct ieee80211_node *ni, int ac) 2654 { 2655 struct ieee80211com *ic = &sc->sc_ic; 2656 struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps); 2657 struct iwm_node *in = IWM_NODE(ni); 2658 struct iwm_tx_ring *ring; 2659 struct iwm_tx_data *data; 2660 struct iwm_tfd *desc; 2661 struct iwm_device_cmd *cmd; 2662 struct iwm_tx_cmd *tx; 2663 struct ieee80211_frame *wh; 2664 struct ieee80211_key *k = NULL; 2665 struct mbuf *m1; 2666 const struct iwm_rate *rinfo; 2667 uint32_t flags; 2668 u_int hdrlen; 2669 bus_dma_segment_t *seg, segs[IWM_MAX_SCATTER]; 2670 int nsegs; 2671 uint8_t tid, type; 2672 int i, totlen, error, pad; 2673 2674 wh = mtod(m, struct ieee80211_frame *); 2675 hdrlen = ieee80211_anyhdrsize(wh); 2676 type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK; 2677 tid = 0; 2678 ring = &sc->txq[ac]; 2679 desc = &ring->desc[ring->cur]; 2680 memset(desc, 0, sizeof(*desc)); 2681 data = &ring->data[ring->cur]; 2682 2683 /* Fill out iwm_tx_cmd to send to the firmware */ 2684 cmd = &ring->cmd[ring->cur]; 2685 cmd->hdr.code = IWM_TX_CMD; 2686 cmd->hdr.flags = 0; 2687 cmd->hdr.qid = ring->qid; 2688 cmd->hdr.idx = ring->cur; 2689 2690 tx = (void *)cmd->data; 2691 memset(tx, 0, sizeof(*tx)); 2692 2693 rinfo = iwm_tx_fill_cmd(sc, in, wh, tx); 2694 2695 /* Encrypt the frame if need be. */ 2696 if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) { 2697 /* Retrieve key for TX && do software encryption. */ 2698 k = ieee80211_crypto_encap(ni, m); 2699 if (k == NULL) { 2700 m_freem(m); 2701 return (ENOBUFS); 2702 } 2703 /* 802.11 header may have moved. */ 2704 wh = mtod(m, struct ieee80211_frame *); 2705 } 2706 2707 if (ieee80211_radiotap_active_vap(vap)) { 2708 struct iwm_tx_radiotap_header *tap = &sc->sc_txtap; 2709 2710 tap->wt_flags = 0; 2711 tap->wt_chan_freq = htole16(ni->ni_chan->ic_freq); 2712 tap->wt_chan_flags = htole16(ni->ni_chan->ic_flags); 2713 tap->wt_rate = rinfo->rate; 2714 if (k != NULL) 2715 tap->wt_flags |= IEEE80211_RADIOTAP_F_WEP; 2716 ieee80211_radiotap_tx(vap, m); 2717 } 2718 2719 2720 totlen = m->m_pkthdr.len; 2721 2722 flags = 0; 2723 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) { 2724 flags |= IWM_TX_CMD_FLG_ACK; 2725 } 2726 2727 if (type != IEEE80211_FC0_TYPE_DATA 2728 && (totlen + IEEE80211_CRC_LEN > vap->iv_rtsthreshold) 2729 && !IEEE80211_IS_MULTICAST(wh->i_addr1)) { 2730 flags |= IWM_TX_CMD_FLG_PROT_REQUIRE; 2731 } 2732 2733 if (IEEE80211_IS_MULTICAST(wh->i_addr1) || 2734 type != IEEE80211_FC0_TYPE_DATA) 2735 tx->sta_id = sc->sc_aux_sta.sta_id; 2736 else 2737 tx->sta_id = IWM_STATION_ID; 2738 2739 if (type == IEEE80211_FC0_TYPE_MGT) { 2740 uint8_t subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK; 2741 2742 if (subtype == IEEE80211_FC0_SUBTYPE_ASSOC_REQ || 2743 subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) 2744 tx->pm_frame_timeout = htole16(3); 2745 else 2746 tx->pm_frame_timeout = htole16(2); 2747 } else { 2748 tx->pm_frame_timeout = htole16(0); 2749 } 2750 2751 if (hdrlen & 3) { 2752 /* First segment length must be a multiple of 4. */ 2753 flags |= IWM_TX_CMD_FLG_MH_PAD; 2754 pad = 4 - (hdrlen & 3); 2755 } else 2756 pad = 0; 2757 2758 tx->driver_txop = 0; 2759 tx->next_frame_len = 0; 2760 2761 tx->len = htole16(totlen); 2762 tx->tid_tspec = tid; 2763 tx->life_time = htole32(IWM_TX_CMD_LIFE_TIME_INFINITE); 2764 2765 /* Set physical address of "scratch area". */ 2766 tx->dram_lsb_ptr = htole32(data->scratch_paddr); 2767 tx->dram_msb_ptr = iwm_get_dma_hi_addr(data->scratch_paddr); 2768 2769 /* Copy 802.11 header in TX command. */ 2770 memcpy(((uint8_t *)tx) + sizeof(*tx), wh, hdrlen); 2771 2772 flags |= IWM_TX_CMD_FLG_BT_DIS | IWM_TX_CMD_FLG_SEQ_CTL; 2773 2774 tx->sec_ctl = 0; 2775 tx->tx_flags |= htole32(flags); 2776 2777 /* Trim 802.11 header. */ 2778 m_adj(m, hdrlen); 2779 error = bus_dmamap_load_mbuf_sg(ring->data_dmat, data->map, m, 2780 segs, &nsegs, BUS_DMA_NOWAIT); 2781 if (error != 0) { 2782 if (error != EFBIG) { 2783 device_printf(sc->sc_dev, "can't map mbuf (error %d)\n", 2784 error); 2785 m_freem(m); 2786 return error; 2787 } 2788 /* Too many DMA segments, linearize mbuf. */ 2789 m1 = m_collapse(m, M_NOWAIT, IWM_MAX_SCATTER - 2); 2790 if (m1 == NULL) { 2791 device_printf(sc->sc_dev, 2792 "%s: could not defrag mbuf\n", __func__); 2793 m_freem(m); 2794 return (ENOBUFS); 2795 } 2796 m = m1; 2797 2798 error = bus_dmamap_load_mbuf_sg(ring->data_dmat, data->map, m, 2799 segs, &nsegs, BUS_DMA_NOWAIT); 2800 if (error != 0) { 2801 device_printf(sc->sc_dev, "can't map mbuf (error %d)\n", 2802 error); 2803 m_freem(m); 2804 return error; 2805 } 2806 } 2807 data->m = m; 2808 data->in = in; 2809 data->done = 0; 2810 2811 IWM_DPRINTF(sc, IWM_DEBUG_XMIT, 2812 "sending txd %p, in %p\n", data, data->in); 2813 KASSERT(data->in != NULL, ("node is NULL")); 2814 2815 IWM_DPRINTF(sc, IWM_DEBUG_XMIT, 2816 "sending data: qid=%d idx=%d len=%d nsegs=%d txflags=0x%08x rate_n_flags=0x%08x rateidx=%d\n", 2817 ring->qid, ring->cur, totlen, nsegs, 2818 le32toh(tx->tx_flags), 2819 le32toh(tx->rate_n_flags), 2820 (int) tx->initial_rate_index 2821 ); 2822 2823 /* Fill TX descriptor. */ 2824 desc->num_tbs = 2 + nsegs; 2825 2826 desc->tbs[0].lo = htole32(data->cmd_paddr); 2827 desc->tbs[0].hi_n_len = htole16(iwm_get_dma_hi_addr(data->cmd_paddr)) | 2828 (TB0_SIZE << 4); 2829 desc->tbs[1].lo = htole32(data->cmd_paddr + TB0_SIZE); 2830 desc->tbs[1].hi_n_len = htole16(iwm_get_dma_hi_addr(data->cmd_paddr)) | 2831 ((sizeof(struct iwm_cmd_header) + sizeof(*tx) 2832 + hdrlen + pad - TB0_SIZE) << 4); 2833 2834 /* Other DMA segments are for data payload. */ 2835 for (i = 0; i < nsegs; i++) { 2836 seg = &segs[i]; 2837 desc->tbs[i+2].lo = htole32(seg->ds_addr); 2838 desc->tbs[i+2].hi_n_len = \ 2839 htole16(iwm_get_dma_hi_addr(seg->ds_addr)) 2840 | ((seg->ds_len) << 4); 2841 } 2842 2843 bus_dmamap_sync(ring->data_dmat, data->map, 2844 BUS_DMASYNC_PREWRITE); 2845 bus_dmamap_sync(ring->cmd_dma.tag, ring->cmd_dma.map, 2846 BUS_DMASYNC_PREWRITE); 2847 bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map, 2848 BUS_DMASYNC_PREWRITE); 2849 2850 #if 0 2851 iwm_update_sched(sc, ring->qid, ring->cur, tx->sta_id, le16toh(tx->len)); 2852 #endif 2853 2854 /* Kick TX ring. */ 2855 ring->cur = (ring->cur + 1) % IWM_TX_RING_COUNT; 2856 IWM_WRITE(sc, IWM_HBUS_TARG_WRPTR, ring->qid << 8 | ring->cur); 2857 2858 /* Mark TX ring as full if we reach a certain threshold. */ 2859 if (++ring->queued > IWM_TX_RING_HIMARK) { 2860 sc->qfullmsk |= 1 << ring->qid; 2861 } 2862 2863 return 0; 2864 } 2865 2866 static int 2867 iwm_raw_xmit(struct ieee80211_node *ni, struct mbuf *m, 2868 const struct ieee80211_bpf_params *params) 2869 { 2870 struct ieee80211com *ic = ni->ni_ic; 2871 struct iwm_softc *sc = ic->ic_softc; 2872 int error = 0; 2873 2874 IWM_DPRINTF(sc, IWM_DEBUG_XMIT, 2875 "->%s begin\n", __func__); 2876 2877 if ((sc->sc_flags & IWM_FLAG_HW_INITED) == 0) { 2878 m_freem(m); 2879 IWM_DPRINTF(sc, IWM_DEBUG_XMIT, 2880 "<-%s not RUNNING\n", __func__); 2881 return (ENETDOWN); 2882 } 2883 2884 IWM_LOCK(sc); 2885 /* XXX fix this */ 2886 if (params == NULL) { 2887 error = iwm_tx(sc, m, ni, 0); 2888 } else { 2889 error = iwm_tx(sc, m, ni, 0); 2890 } 2891 sc->sc_tx_timer = 5; 2892 IWM_UNLOCK(sc); 2893 2894 return (error); 2895 } 2896 2897 /* 2898 * mvm/tx.c 2899 */ 2900 2901 #if 0 2902 /* 2903 * Note that there are transports that buffer frames before they reach 2904 * the firmware. This means that after flush_tx_path is called, the 2905 * queue might not be empty. The race-free way to handle this is to: 2906 * 1) set the station as draining 2907 * 2) flush the Tx path 2908 * 3) wait for the transport queues to be empty 2909 */ 2910 int 2911 iwm_mvm_flush_tx_path(struct iwm_softc *sc, int tfd_msk, int sync) 2912 { 2913 struct iwm_tx_path_flush_cmd flush_cmd = { 2914 .queues_ctl = htole32(tfd_msk), 2915 .flush_ctl = htole16(IWM_DUMP_TX_FIFO_FLUSH), 2916 }; 2917 int ret; 2918 2919 ret = iwm_mvm_send_cmd_pdu(sc, IWM_TXPATH_FLUSH, 2920 sync ? IWM_CMD_SYNC : IWM_CMD_ASYNC, 2921 sizeof(flush_cmd), &flush_cmd); 2922 if (ret) 2923 device_printf(sc->sc_dev, 2924 "Flushing tx queue failed: %d\n", ret); 2925 return ret; 2926 } 2927 #endif 2928 2929 /* 2930 * BEGIN mvm/sta.c 2931 */ 2932 2933 static void 2934 iwm_mvm_add_sta_cmd_v6_to_v5(struct iwm_mvm_add_sta_cmd_v6 *cmd_v6, 2935 struct iwm_mvm_add_sta_cmd_v5 *cmd_v5) 2936 { 2937 memset(cmd_v5, 0, sizeof(*cmd_v5)); 2938 2939 cmd_v5->add_modify = cmd_v6->add_modify; 2940 cmd_v5->tid_disable_tx = cmd_v6->tid_disable_tx; 2941 cmd_v5->mac_id_n_color = cmd_v6->mac_id_n_color; 2942 IEEE80211_ADDR_COPY(cmd_v5->addr, cmd_v6->addr); 2943 cmd_v5->sta_id = cmd_v6->sta_id; 2944 cmd_v5->modify_mask = cmd_v6->modify_mask; 2945 cmd_v5->station_flags = cmd_v6->station_flags; 2946 cmd_v5->station_flags_msk = cmd_v6->station_flags_msk; 2947 cmd_v5->add_immediate_ba_tid = cmd_v6->add_immediate_ba_tid; 2948 cmd_v5->remove_immediate_ba_tid = cmd_v6->remove_immediate_ba_tid; 2949 cmd_v5->add_immediate_ba_ssn = cmd_v6->add_immediate_ba_ssn; 2950 cmd_v5->sleep_tx_count = cmd_v6->sleep_tx_count; 2951 cmd_v5->sleep_state_flags = cmd_v6->sleep_state_flags; 2952 cmd_v5->assoc_id = cmd_v6->assoc_id; 2953 cmd_v5->beamform_flags = cmd_v6->beamform_flags; 2954 cmd_v5->tfd_queue_msk = cmd_v6->tfd_queue_msk; 2955 } 2956 2957 static int 2958 iwm_mvm_send_add_sta_cmd_status(struct iwm_softc *sc, 2959 struct iwm_mvm_add_sta_cmd_v6 *cmd, int *status) 2960 { 2961 struct iwm_mvm_add_sta_cmd_v5 cmd_v5; 2962 2963 if (sc->sc_capaflags & IWM_UCODE_TLV_FLAGS_STA_KEY_CMD) { 2964 return iwm_mvm_send_cmd_pdu_status(sc, IWM_ADD_STA, 2965 sizeof(*cmd), cmd, status); 2966 } 2967 2968 iwm_mvm_add_sta_cmd_v6_to_v5(cmd, &cmd_v5); 2969 2970 return iwm_mvm_send_cmd_pdu_status(sc, IWM_ADD_STA, sizeof(cmd_v5), 2971 &cmd_v5, status); 2972 } 2973 2974 /* send station add/update command to firmware */ 2975 static int 2976 iwm_mvm_sta_send_to_fw(struct iwm_softc *sc, struct iwm_node *in, int update) 2977 { 2978 struct iwm_mvm_add_sta_cmd_v6 add_sta_cmd; 2979 int ret; 2980 uint32_t status; 2981 2982 memset(&add_sta_cmd, 0, sizeof(add_sta_cmd)); 2983 2984 add_sta_cmd.sta_id = IWM_STATION_ID; 2985 add_sta_cmd.mac_id_n_color 2986 = htole32(IWM_FW_CMD_ID_AND_COLOR(IWM_DEFAULT_MACID, 2987 IWM_DEFAULT_COLOR)); 2988 if (!update) { 2989 add_sta_cmd.tfd_queue_msk = htole32(0xf); 2990 IEEE80211_ADDR_COPY(&add_sta_cmd.addr, in->in_ni.ni_bssid); 2991 } 2992 add_sta_cmd.add_modify = update ? 1 : 0; 2993 add_sta_cmd.station_flags_msk 2994 |= htole32(IWM_STA_FLG_FAT_EN_MSK | IWM_STA_FLG_MIMO_EN_MSK); 2995 2996 status = IWM_ADD_STA_SUCCESS; 2997 ret = iwm_mvm_send_add_sta_cmd_status(sc, &add_sta_cmd, &status); 2998 if (ret) 2999 return ret; 3000 3001 switch (status) { 3002 case IWM_ADD_STA_SUCCESS: 3003 break; 3004 default: 3005 ret = EIO; 3006 device_printf(sc->sc_dev, "IWM_ADD_STA failed\n"); 3007 break; 3008 } 3009 3010 return ret; 3011 } 3012 3013 static int 3014 iwm_mvm_add_sta(struct iwm_softc *sc, struct iwm_node *in) 3015 { 3016 int ret; 3017 3018 ret = iwm_mvm_sta_send_to_fw(sc, in, 0); 3019 if (ret) 3020 return ret; 3021 3022 return 0; 3023 } 3024 3025 static int 3026 iwm_mvm_update_sta(struct iwm_softc *sc, struct iwm_node *in) 3027 { 3028 return iwm_mvm_sta_send_to_fw(sc, in, 1); 3029 } 3030 3031 static int 3032 iwm_mvm_add_int_sta_common(struct iwm_softc *sc, struct iwm_int_sta *sta, 3033 const uint8_t *addr, uint16_t mac_id, uint16_t color) 3034 { 3035 struct iwm_mvm_add_sta_cmd_v6 cmd; 3036 int ret; 3037 uint32_t status; 3038 3039 memset(&cmd, 0, sizeof(cmd)); 3040 cmd.sta_id = sta->sta_id; 3041 cmd.mac_id_n_color = htole32(IWM_FW_CMD_ID_AND_COLOR(mac_id, color)); 3042 3043 cmd.tfd_queue_msk = htole32(sta->tfd_queue_msk); 3044 3045 if (addr) 3046 IEEE80211_ADDR_COPY(cmd.addr, addr); 3047 3048 ret = iwm_mvm_send_add_sta_cmd_status(sc, &cmd, &status); 3049 if (ret) 3050 return ret; 3051 3052 switch (status) { 3053 case IWM_ADD_STA_SUCCESS: 3054 IWM_DPRINTF(sc, IWM_DEBUG_RESET, 3055 "%s: Internal station added.\n", __func__); 3056 return 0; 3057 default: 3058 device_printf(sc->sc_dev, 3059 "%s: Add internal station failed, status=0x%x\n", 3060 __func__, status); 3061 ret = EIO; 3062 break; 3063 } 3064 return ret; 3065 } 3066 3067 static int 3068 iwm_mvm_add_aux_sta(struct iwm_softc *sc) 3069 { 3070 int ret; 3071 3072 sc->sc_aux_sta.sta_id = 3; 3073 sc->sc_aux_sta.tfd_queue_msk = 0; 3074 3075 ret = iwm_mvm_add_int_sta_common(sc, 3076 &sc->sc_aux_sta, NULL, IWM_MAC_INDEX_AUX, 0); 3077 3078 if (ret) 3079 memset(&sc->sc_aux_sta, 0, sizeof(sc->sc_aux_sta)); 3080 return ret; 3081 } 3082 3083 /* 3084 * END mvm/sta.c 3085 */ 3086 3087 /* 3088 * BEGIN mvm/quota.c 3089 */ 3090 3091 static int 3092 iwm_mvm_update_quotas(struct iwm_softc *sc, struct iwm_node *in) 3093 { 3094 struct iwm_time_quota_cmd cmd; 3095 int i, idx, ret, num_active_macs, quota, quota_rem; 3096 int colors[IWM_MAX_BINDINGS] = { -1, -1, -1, -1, }; 3097 int n_ifs[IWM_MAX_BINDINGS] = {0, }; 3098 uint16_t id; 3099 3100 memset(&cmd, 0, sizeof(cmd)); 3101 3102 /* currently, PHY ID == binding ID */ 3103 if (in) { 3104 id = in->in_phyctxt->id; 3105 KASSERT(id < IWM_MAX_BINDINGS, ("invalid id")); 3106 colors[id] = in->in_phyctxt->color; 3107 3108 if (1) 3109 n_ifs[id] = 1; 3110 } 3111 3112 /* 3113 * The FW's scheduling session consists of 3114 * IWM_MVM_MAX_QUOTA fragments. Divide these fragments 3115 * equally between all the bindings that require quota 3116 */ 3117 num_active_macs = 0; 3118 for (i = 0; i < IWM_MAX_BINDINGS; i++) { 3119 cmd.quotas[i].id_and_color = htole32(IWM_FW_CTXT_INVALID); 3120 num_active_macs += n_ifs[i]; 3121 } 3122 3123 quota = 0; 3124 quota_rem = 0; 3125 if (num_active_macs) { 3126 quota = IWM_MVM_MAX_QUOTA / num_active_macs; 3127 quota_rem = IWM_MVM_MAX_QUOTA % num_active_macs; 3128 } 3129 3130 for (idx = 0, i = 0; i < IWM_MAX_BINDINGS; i++) { 3131 if (colors[i] < 0) 3132 continue; 3133 3134 cmd.quotas[idx].id_and_color = 3135 htole32(IWM_FW_CMD_ID_AND_COLOR(i, colors[i])); 3136 3137 if (n_ifs[i] <= 0) { 3138 cmd.quotas[idx].quota = htole32(0); 3139 cmd.quotas[idx].max_duration = htole32(0); 3140 } else { 3141 cmd.quotas[idx].quota = htole32(quota * n_ifs[i]); 3142 cmd.quotas[idx].max_duration = htole32(0); 3143 } 3144 idx++; 3145 } 3146 3147 /* Give the remainder of the session to the first binding */ 3148 cmd.quotas[0].quota = htole32(le32toh(cmd.quotas[0].quota) + quota_rem); 3149 3150 ret = iwm_mvm_send_cmd_pdu(sc, IWM_TIME_QUOTA_CMD, IWM_CMD_SYNC, 3151 sizeof(cmd), &cmd); 3152 if (ret) 3153 device_printf(sc->sc_dev, 3154 "%s: Failed to send quota: %d\n", __func__, ret); 3155 return ret; 3156 } 3157 3158 /* 3159 * END mvm/quota.c 3160 */ 3161 3162 /* 3163 * ieee80211 routines 3164 */ 3165 3166 /* 3167 * Change to AUTH state in 80211 state machine. Roughly matches what 3168 * Linux does in bss_info_changed(). 3169 */ 3170 static int 3171 iwm_auth(struct ieee80211vap *vap, struct iwm_softc *sc) 3172 { 3173 struct ieee80211_node *ni; 3174 struct iwm_node *in; 3175 struct iwm_vap *iv = IWM_VAP(vap); 3176 uint32_t duration; 3177 int error; 3178 3179 /* 3180 * XXX i have a feeling that the vap node is being 3181 * freed from underneath us. Grr. 3182 */ 3183 ni = ieee80211_ref_node(vap->iv_bss); 3184 in = IWM_NODE(ni); 3185 IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_STATE, 3186 "%s: called; vap=%p, bss ni=%p\n", 3187 __func__, 3188 vap, 3189 ni); 3190 3191 in->in_assoc = 0; 3192 3193 error = iwm_allow_mcast(vap, sc); 3194 if (error) { 3195 device_printf(sc->sc_dev, 3196 "%s: failed to set multicast\n", __func__); 3197 goto out; 3198 } 3199 3200 /* 3201 * This is where it deviates from what Linux does. 3202 * 3203 * Linux iwlwifi doesn't reset the nic each time, nor does it 3204 * call ctxt_add() here. Instead, it adds it during vap creation, 3205 * and always does does a mac_ctx_changed(). 3206 * 3207 * The openbsd port doesn't attempt to do that - it reset things 3208 * at odd states and does the add here. 3209 * 3210 * So, until the state handling is fixed (ie, we never reset 3211 * the NIC except for a firmware failure, which should drag 3212 * the NIC back to IDLE, re-setup and re-add all the mac/phy 3213 * contexts that are required), let's do a dirty hack here. 3214 */ 3215 if (iv->is_uploaded) { 3216 if ((error = iwm_mvm_mac_ctxt_changed(sc, vap)) != 0) { 3217 device_printf(sc->sc_dev, 3218 "%s: failed to update MAC\n", __func__); 3219 goto out; 3220 } 3221 if ((error = iwm_mvm_phy_ctxt_changed(sc, &sc->sc_phyctxt[0], 3222 in->in_ni.ni_chan, 1, 1)) != 0) { 3223 device_printf(sc->sc_dev, 3224 "%s: failed update phy ctxt\n", __func__); 3225 goto out; 3226 } 3227 in->in_phyctxt = &sc->sc_phyctxt[0]; 3228 3229 if ((error = iwm_mvm_binding_update(sc, in)) != 0) { 3230 device_printf(sc->sc_dev, 3231 "%s: binding update cmd\n", __func__); 3232 goto out; 3233 } 3234 if ((error = iwm_mvm_update_sta(sc, in)) != 0) { 3235 device_printf(sc->sc_dev, 3236 "%s: failed to update sta\n", __func__); 3237 goto out; 3238 } 3239 } else { 3240 if ((error = iwm_mvm_mac_ctxt_add(sc, vap)) != 0) { 3241 device_printf(sc->sc_dev, 3242 "%s: failed to add MAC\n", __func__); 3243 goto out; 3244 } 3245 if ((error = iwm_mvm_phy_ctxt_changed(sc, &sc->sc_phyctxt[0], 3246 in->in_ni.ni_chan, 1, 1)) != 0) { 3247 device_printf(sc->sc_dev, 3248 "%s: failed add phy ctxt!\n", __func__); 3249 error = ETIMEDOUT; 3250 goto out; 3251 } 3252 in->in_phyctxt = &sc->sc_phyctxt[0]; 3253 3254 if ((error = iwm_mvm_binding_add_vif(sc, in)) != 0) { 3255 device_printf(sc->sc_dev, 3256 "%s: binding add cmd\n", __func__); 3257 goto out; 3258 } 3259 if ((error = iwm_mvm_add_sta(sc, in)) != 0) { 3260 device_printf(sc->sc_dev, 3261 "%s: failed to add sta\n", __func__); 3262 goto out; 3263 } 3264 } 3265 3266 /* 3267 * Prevent the FW from wandering off channel during association 3268 * by "protecting" the session with a time event. 3269 */ 3270 /* XXX duration is in units of TU, not MS */ 3271 duration = IWM_MVM_TE_SESSION_PROTECTION_MAX_TIME_MS; 3272 iwm_mvm_protect_session(sc, in, duration, 500 /* XXX magic number */); 3273 DELAY(100); 3274 3275 error = 0; 3276 out: 3277 ieee80211_free_node(ni); 3278 return (error); 3279 } 3280 3281 static int 3282 iwm_assoc(struct ieee80211vap *vap, struct iwm_softc *sc) 3283 { 3284 struct iwm_node *in = IWM_NODE(vap->iv_bss); 3285 int error; 3286 3287 if ((error = iwm_mvm_update_sta(sc, in)) != 0) { 3288 device_printf(sc->sc_dev, 3289 "%s: failed to update STA\n", __func__); 3290 return error; 3291 } 3292 3293 in->in_assoc = 1; 3294 if ((error = iwm_mvm_mac_ctxt_changed(sc, vap)) != 0) { 3295 device_printf(sc->sc_dev, 3296 "%s: failed to update MAC\n", __func__); 3297 return error; 3298 } 3299 3300 return 0; 3301 } 3302 3303 static int 3304 iwm_release(struct iwm_softc *sc, struct iwm_node *in) 3305 { 3306 /* 3307 * Ok, so *technically* the proper set of calls for going 3308 * from RUN back to SCAN is: 3309 * 3310 * iwm_mvm_power_mac_disable(sc, in); 3311 * iwm_mvm_mac_ctxt_changed(sc, in); 3312 * iwm_mvm_rm_sta(sc, in); 3313 * iwm_mvm_update_quotas(sc, NULL); 3314 * iwm_mvm_mac_ctxt_changed(sc, in); 3315 * iwm_mvm_binding_remove_vif(sc, in); 3316 * iwm_mvm_mac_ctxt_remove(sc, in); 3317 * 3318 * However, that freezes the device not matter which permutations 3319 * and modifications are attempted. Obviously, this driver is missing 3320 * something since it works in the Linux driver, but figuring out what 3321 * is missing is a little more complicated. Now, since we're going 3322 * back to nothing anyway, we'll just do a complete device reset. 3323 * Up your's, device! 3324 */ 3325 //iwm_mvm_flush_tx_path(sc, 0xf, 1); 3326 iwm_stop_device(sc); 3327 iwm_init_hw(sc); 3328 if (in) 3329 in->in_assoc = 0; 3330 return 0; 3331 3332 #if 0 3333 int error; 3334 3335 iwm_mvm_power_mac_disable(sc, in); 3336 3337 if ((error = iwm_mvm_mac_ctxt_changed(sc, in)) != 0) { 3338 device_printf(sc->sc_dev, "mac ctxt change fail 1 %d\n", error); 3339 return error; 3340 } 3341 3342 if ((error = iwm_mvm_rm_sta(sc, in)) != 0) { 3343 device_printf(sc->sc_dev, "sta remove fail %d\n", error); 3344 return error; 3345 } 3346 error = iwm_mvm_rm_sta(sc, in); 3347 in->in_assoc = 0; 3348 iwm_mvm_update_quotas(sc, NULL); 3349 if ((error = iwm_mvm_mac_ctxt_changed(sc, in)) != 0) { 3350 device_printf(sc->sc_dev, "mac ctxt change fail 2 %d\n", error); 3351 return error; 3352 } 3353 iwm_mvm_binding_remove_vif(sc, in); 3354 3355 iwm_mvm_mac_ctxt_remove(sc, in); 3356 3357 return error; 3358 #endif 3359 } 3360 3361 static struct ieee80211_node * 3362 iwm_node_alloc(struct ieee80211vap *vap, const uint8_t mac[IEEE80211_ADDR_LEN]) 3363 { 3364 return malloc(sizeof (struct iwm_node), M_80211_NODE, 3365 M_NOWAIT | M_ZERO); 3366 } 3367 3368 static void 3369 iwm_setrates(struct iwm_softc *sc, struct iwm_node *in) 3370 { 3371 struct ieee80211_node *ni = &in->in_ni; 3372 struct iwm_lq_cmd *lq = &in->in_lq; 3373 int nrates = ni->ni_rates.rs_nrates; 3374 int i, ridx, tab = 0; 3375 int txant = 0; 3376 3377 if (nrates > nitems(lq->rs_table)) { 3378 device_printf(sc->sc_dev, 3379 "%s: node supports %d rates, driver handles " 3380 "only %zu\n", __func__, nrates, nitems(lq->rs_table)); 3381 return; 3382 } 3383 if (nrates == 0) { 3384 device_printf(sc->sc_dev, 3385 "%s: node supports 0 rates, odd!\n", __func__); 3386 return; 3387 } 3388 3389 /* 3390 * XXX .. and most of iwm_node is not initialised explicitly; 3391 * it's all just 0x0 passed to the firmware. 3392 */ 3393 3394 /* first figure out which rates we should support */ 3395 /* XXX TODO: this isn't 11n aware /at all/ */ 3396 memset(&in->in_ridx, -1, sizeof(in->in_ridx)); 3397 IWM_DPRINTF(sc, IWM_DEBUG_TXRATE, 3398 "%s: nrates=%d\n", __func__, nrates); 3399 3400 /* 3401 * Loop over nrates and populate in_ridx from the highest 3402 * rate to the lowest rate. Remember, in_ridx[] has 3403 * IEEE80211_RATE_MAXSIZE entries! 3404 */ 3405 for (i = 0; i < min(nrates, IEEE80211_RATE_MAXSIZE); i++) { 3406 int rate = ni->ni_rates.rs_rates[(nrates - 1) - i] & IEEE80211_RATE_VAL; 3407 3408 /* Map 802.11 rate to HW rate index. */ 3409 for (ridx = 0; ridx <= IWM_RIDX_MAX; ridx++) 3410 if (iwm_rates[ridx].rate == rate) 3411 break; 3412 if (ridx > IWM_RIDX_MAX) { 3413 device_printf(sc->sc_dev, 3414 "%s: WARNING: device rate for %d not found!\n", 3415 __func__, rate); 3416 } else { 3417 IWM_DPRINTF(sc, IWM_DEBUG_TXRATE, 3418 "%s: rate: i: %d, rate=%d, ridx=%d\n", 3419 __func__, 3420 i, 3421 rate, 3422 ridx); 3423 in->in_ridx[i] = ridx; 3424 } 3425 } 3426 3427 /* then construct a lq_cmd based on those */ 3428 memset(lq, 0, sizeof(*lq)); 3429 lq->sta_id = IWM_STATION_ID; 3430 3431 /* 3432 * are these used? (we don't do SISO or MIMO) 3433 * need to set them to non-zero, though, or we get an error. 3434 */ 3435 lq->single_stream_ant_msk = 1; 3436 lq->dual_stream_ant_msk = 1; 3437 3438 /* 3439 * Build the actual rate selection table. 3440 * The lowest bits are the rates. Additionally, 3441 * CCK needs bit 9 to be set. The rest of the bits 3442 * we add to the table select the tx antenna 3443 * Note that we add the rates in the highest rate first 3444 * (opposite of ni_rates). 3445 */ 3446 /* 3447 * XXX TODO: this should be looping over the min of nrates 3448 * and LQ_MAX_RETRY_NUM. Sigh. 3449 */ 3450 for (i = 0; i < nrates; i++) { 3451 int nextant; 3452 3453 if (txant == 0) 3454 txant = IWM_FW_VALID_TX_ANT(sc); 3455 nextant = 1<<(ffs(txant)-1); 3456 txant &= ~nextant; 3457 3458 /* 3459 * Map the rate id into a rate index into 3460 * our hardware table containing the 3461 * configuration to use for this rate. 3462 */ 3463 ridx = in->in_ridx[i]; 3464 tab = iwm_rates[ridx].plcp; 3465 tab |= nextant << IWM_RATE_MCS_ANT_POS; 3466 if (IWM_RIDX_IS_CCK(ridx)) 3467 tab |= IWM_RATE_MCS_CCK_MSK; 3468 IWM_DPRINTF(sc, IWM_DEBUG_TXRATE, 3469 "station rate i=%d, rate=%d, hw=%x\n", 3470 i, iwm_rates[ridx].rate, tab); 3471 lq->rs_table[i] = htole32(tab); 3472 } 3473 /* then fill the rest with the lowest possible rate */ 3474 for (i = nrates; i < nitems(lq->rs_table); i++) { 3475 KASSERT(tab != 0, ("invalid tab")); 3476 lq->rs_table[i] = htole32(tab); 3477 } 3478 } 3479 3480 static int 3481 iwm_media_change(struct ifnet *ifp) 3482 { 3483 struct ieee80211vap *vap = ifp->if_softc; 3484 struct ieee80211com *ic = vap->iv_ic; 3485 struct iwm_softc *sc = ic->ic_softc; 3486 int error; 3487 3488 error = ieee80211_media_change(ifp); 3489 if (error != ENETRESET) 3490 return error; 3491 3492 IWM_LOCK(sc); 3493 if (ic->ic_nrunning > 0) { 3494 iwm_stop(sc); 3495 iwm_init(sc); 3496 } 3497 IWM_UNLOCK(sc); 3498 return error; 3499 } 3500 3501 3502 static int 3503 iwm_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg) 3504 { 3505 struct iwm_vap *ivp = IWM_VAP(vap); 3506 struct ieee80211com *ic = vap->iv_ic; 3507 struct iwm_softc *sc = ic->ic_softc; 3508 struct iwm_node *in; 3509 int error; 3510 3511 IWM_DPRINTF(sc, IWM_DEBUG_STATE, 3512 "switching state %s -> %s\n", 3513 ieee80211_state_name[vap->iv_state], 3514 ieee80211_state_name[nstate]); 3515 IEEE80211_UNLOCK(ic); 3516 IWM_LOCK(sc); 3517 /* disable beacon filtering if we're hopping out of RUN */ 3518 if (vap->iv_state == IEEE80211_S_RUN && nstate != vap->iv_state) { 3519 iwm_mvm_disable_beacon_filter(sc); 3520 3521 if (((in = IWM_NODE(vap->iv_bss)) != NULL)) 3522 in->in_assoc = 0; 3523 3524 iwm_release(sc, NULL); 3525 3526 /* 3527 * It's impossible to directly go RUN->SCAN. If we iwm_release() 3528 * above then the card will be completely reinitialized, 3529 * so the driver must do everything necessary to bring the card 3530 * from INIT to SCAN. 3531 * 3532 * Additionally, upon receiving deauth frame from AP, 3533 * OpenBSD 802.11 stack puts the driver in IEEE80211_S_AUTH 3534 * state. This will also fail with this driver, so bring the FSM 3535 * from IEEE80211_S_RUN to IEEE80211_S_SCAN in this case as well. 3536 * 3537 * XXX TODO: fix this for FreeBSD! 3538 */ 3539 if (nstate == IEEE80211_S_SCAN || 3540 nstate == IEEE80211_S_AUTH || 3541 nstate == IEEE80211_S_ASSOC) { 3542 IWM_DPRINTF(sc, IWM_DEBUG_STATE, 3543 "Force transition to INIT; MGT=%d\n", arg); 3544 IWM_UNLOCK(sc); 3545 IEEE80211_LOCK(ic); 3546 vap->iv_newstate(vap, IEEE80211_S_INIT, arg); 3547 IWM_DPRINTF(sc, IWM_DEBUG_STATE, 3548 "Going INIT->SCAN\n"); 3549 nstate = IEEE80211_S_SCAN; 3550 IEEE80211_UNLOCK(ic); 3551 IWM_LOCK(sc); 3552 } 3553 } 3554 3555 switch (nstate) { 3556 case IEEE80211_S_INIT: 3557 sc->sc_scanband = 0; 3558 break; 3559 3560 case IEEE80211_S_AUTH: 3561 if ((error = iwm_auth(vap, sc)) != 0) { 3562 device_printf(sc->sc_dev, 3563 "%s: could not move to auth state: %d\n", 3564 __func__, error); 3565 break; 3566 } 3567 break; 3568 3569 case IEEE80211_S_ASSOC: 3570 if ((error = iwm_assoc(vap, sc)) != 0) { 3571 device_printf(sc->sc_dev, 3572 "%s: failed to associate: %d\n", __func__, 3573 error); 3574 break; 3575 } 3576 break; 3577 3578 case IEEE80211_S_RUN: 3579 { 3580 struct iwm_host_cmd cmd = { 3581 .id = IWM_LQ_CMD, 3582 .len = { sizeof(in->in_lq), }, 3583 .flags = IWM_CMD_SYNC, 3584 }; 3585 3586 /* Update the association state, now we have it all */ 3587 /* (eg associd comes in at this point */ 3588 error = iwm_assoc(vap, sc); 3589 if (error != 0) { 3590 device_printf(sc->sc_dev, 3591 "%s: failed to update association state: %d\n", 3592 __func__, 3593 error); 3594 break; 3595 } 3596 3597 in = IWM_NODE(vap->iv_bss); 3598 iwm_mvm_power_mac_update_mode(sc, in); 3599 iwm_mvm_enable_beacon_filter(sc, in); 3600 iwm_mvm_update_quotas(sc, in); 3601 iwm_setrates(sc, in); 3602 3603 cmd.data[0] = &in->in_lq; 3604 if ((error = iwm_send_cmd(sc, &cmd)) != 0) { 3605 device_printf(sc->sc_dev, 3606 "%s: IWM_LQ_CMD failed\n", __func__); 3607 } 3608 3609 break; 3610 } 3611 3612 default: 3613 break; 3614 } 3615 IWM_UNLOCK(sc); 3616 IEEE80211_LOCK(ic); 3617 3618 return (ivp->iv_newstate(vap, nstate, arg)); 3619 } 3620 3621 void 3622 iwm_endscan_cb(void *arg, int pending) 3623 { 3624 struct iwm_softc *sc = arg; 3625 struct ieee80211com *ic = &sc->sc_ic; 3626 int done; 3627 int error; 3628 3629 IWM_DPRINTF(sc, IWM_DEBUG_SCAN | IWM_DEBUG_TRACE, 3630 "%s: scan ended\n", 3631 __func__); 3632 3633 IWM_LOCK(sc); 3634 if (sc->sc_scanband == IEEE80211_CHAN_2GHZ && 3635 sc->sc_nvm.sku_cap_band_52GHz_enable) { 3636 done = 0; 3637 if ((error = iwm_mvm_scan_request(sc, 3638 IEEE80211_CHAN_5GHZ, 0, NULL, 0)) != 0) { 3639 device_printf(sc->sc_dev, "could not initiate scan\n"); 3640 done = 1; 3641 } 3642 } else { 3643 done = 1; 3644 } 3645 3646 if (done) { 3647 IWM_UNLOCK(sc); 3648 ieee80211_scan_done(TAILQ_FIRST(&ic->ic_vaps)); 3649 IWM_LOCK(sc); 3650 sc->sc_scanband = 0; 3651 } 3652 IWM_UNLOCK(sc); 3653 } 3654 3655 static int 3656 iwm_init_hw(struct iwm_softc *sc) 3657 { 3658 struct ieee80211com *ic = &sc->sc_ic; 3659 int error, i, qid; 3660 3661 if ((error = iwm_start_hw(sc)) != 0) 3662 return error; 3663 3664 if ((error = iwm_run_init_mvm_ucode(sc, 0)) != 0) { 3665 return error; 3666 } 3667 3668 /* 3669 * should stop and start HW since that INIT 3670 * image just loaded 3671 */ 3672 iwm_stop_device(sc); 3673 if ((error = iwm_start_hw(sc)) != 0) { 3674 device_printf(sc->sc_dev, "could not initialize hardware\n"); 3675 return error; 3676 } 3677 3678 /* omstart, this time with the regular firmware */ 3679 error = iwm_mvm_load_ucode_wait_alive(sc, IWM_UCODE_TYPE_REGULAR); 3680 if (error) { 3681 device_printf(sc->sc_dev, "could not load firmware\n"); 3682 goto error; 3683 } 3684 3685 if ((error = iwm_send_tx_ant_cfg(sc, IWM_FW_VALID_TX_ANT(sc))) != 0) 3686 goto error; 3687 3688 /* Send phy db control command and then phy db calibration*/ 3689 if ((error = iwm_send_phy_db_data(sc)) != 0) 3690 goto error; 3691 3692 if ((error = iwm_send_phy_cfg_cmd(sc)) != 0) 3693 goto error; 3694 3695 /* Add auxiliary station for scanning */ 3696 if ((error = iwm_mvm_add_aux_sta(sc)) != 0) 3697 goto error; 3698 3699 for (i = 0; i < IWM_NUM_PHY_CTX; i++) { 3700 /* 3701 * The channel used here isn't relevant as it's 3702 * going to be overwritten in the other flows. 3703 * For now use the first channel we have. 3704 */ 3705 if ((error = iwm_mvm_phy_ctxt_add(sc, 3706 &sc->sc_phyctxt[i], &ic->ic_channels[1], 1, 1)) != 0) 3707 goto error; 3708 } 3709 3710 error = iwm_mvm_power_update_device(sc); 3711 if (error) 3712 goto error; 3713 3714 /* Mark TX rings as active. */ 3715 for (qid = 0; qid < 4; qid++) { 3716 iwm_enable_txq(sc, qid, qid); 3717 } 3718 3719 return 0; 3720 3721 error: 3722 iwm_stop_device(sc); 3723 return error; 3724 } 3725 3726 /* Allow multicast from our BSSID. */ 3727 static int 3728 iwm_allow_mcast(struct ieee80211vap *vap, struct iwm_softc *sc) 3729 { 3730 struct ieee80211_node *ni = vap->iv_bss; 3731 struct iwm_mcast_filter_cmd *cmd; 3732 size_t size; 3733 int error; 3734 3735 size = roundup(sizeof(*cmd), 4); 3736 cmd = malloc(size, M_DEVBUF, M_NOWAIT | M_ZERO); 3737 if (cmd == NULL) 3738 return ENOMEM; 3739 cmd->filter_own = 1; 3740 cmd->port_id = 0; 3741 cmd->count = 0; 3742 cmd->pass_all = 1; 3743 IEEE80211_ADDR_COPY(cmd->bssid, ni->ni_bssid); 3744 3745 error = iwm_mvm_send_cmd_pdu(sc, IWM_MCAST_FILTER_CMD, 3746 IWM_CMD_SYNC, size, cmd); 3747 free(cmd, M_DEVBUF); 3748 3749 return (error); 3750 } 3751 3752 static void 3753 iwm_init(struct iwm_softc *sc) 3754 { 3755 int error; 3756 3757 if (sc->sc_flags & IWM_FLAG_HW_INITED) { 3758 return; 3759 } 3760 sc->sc_generation++; 3761 sc->sc_flags &= ~IWM_FLAG_STOPPED; 3762 3763 if ((error = iwm_init_hw(sc)) != 0) { 3764 iwm_stop(sc); 3765 return; 3766 } 3767 3768 /* 3769 * Ok, firmware loaded and we are jogging 3770 */ 3771 sc->sc_flags |= IWM_FLAG_HW_INITED; 3772 callout_reset(&sc->sc_watchdog_to, hz, iwm_watchdog, sc); 3773 } 3774 3775 static int 3776 iwm_transmit(struct ieee80211com *ic, struct mbuf *m) 3777 { 3778 struct iwm_softc *sc; 3779 int error; 3780 3781 sc = ic->ic_softc; 3782 3783 IWM_LOCK(sc); 3784 if ((sc->sc_flags & IWM_FLAG_HW_INITED) == 0) { 3785 IWM_UNLOCK(sc); 3786 return (ENXIO); 3787 } 3788 error = mbufq_enqueue(&sc->sc_snd, m); 3789 if (error) { 3790 IWM_UNLOCK(sc); 3791 return (error); 3792 } 3793 iwm_start(sc); 3794 IWM_UNLOCK(sc); 3795 return (0); 3796 } 3797 3798 /* 3799 * Dequeue packets from sendq and call send. 3800 */ 3801 static void 3802 iwm_start(struct iwm_softc *sc) 3803 { 3804 struct ieee80211_node *ni; 3805 struct mbuf *m; 3806 int ac = 0; 3807 3808 IWM_DPRINTF(sc, IWM_DEBUG_XMIT | IWM_DEBUG_TRACE, "->%s\n", __func__); 3809 while (sc->qfullmsk == 0 && 3810 (m = mbufq_dequeue(&sc->sc_snd)) != NULL) { 3811 ni = (struct ieee80211_node *)m->m_pkthdr.rcvif; 3812 if (iwm_tx(sc, m, ni, ac) != 0) { 3813 if_inc_counter(ni->ni_vap->iv_ifp, 3814 IFCOUNTER_OERRORS, 1); 3815 ieee80211_free_node(ni); 3816 continue; 3817 } 3818 sc->sc_tx_timer = 15; 3819 } 3820 IWM_DPRINTF(sc, IWM_DEBUG_XMIT | IWM_DEBUG_TRACE, "<-%s\n", __func__); 3821 } 3822 3823 static void 3824 iwm_stop(struct iwm_softc *sc) 3825 { 3826 3827 sc->sc_flags &= ~IWM_FLAG_HW_INITED; 3828 sc->sc_flags |= IWM_FLAG_STOPPED; 3829 sc->sc_generation++; 3830 sc->sc_scanband = 0; 3831 sc->sc_auth_prot = 0; 3832 sc->sc_tx_timer = 0; 3833 iwm_stop_device(sc); 3834 } 3835 3836 static void 3837 iwm_watchdog(void *arg) 3838 { 3839 struct iwm_softc *sc = arg; 3840 3841 if (sc->sc_tx_timer > 0) { 3842 if (--sc->sc_tx_timer == 0) { 3843 device_printf(sc->sc_dev, "device timeout\n"); 3844 #ifdef IWM_DEBUG 3845 iwm_nic_error(sc); 3846 #endif 3847 iwm_stop(sc); 3848 counter_u64_add(sc->sc_ic.ic_oerrors, 1); 3849 return; 3850 } 3851 } 3852 callout_reset(&sc->sc_watchdog_to, hz, iwm_watchdog, sc); 3853 } 3854 3855 static void 3856 iwm_parent(struct ieee80211com *ic) 3857 { 3858 struct iwm_softc *sc = ic->ic_softc; 3859 int startall = 0; 3860 3861 IWM_LOCK(sc); 3862 if (ic->ic_nrunning > 0) { 3863 if (!(sc->sc_flags & IWM_FLAG_HW_INITED)) { 3864 iwm_init(sc); 3865 startall = 1; 3866 } 3867 } else if (sc->sc_flags & IWM_FLAG_HW_INITED) 3868 iwm_stop(sc); 3869 IWM_UNLOCK(sc); 3870 if (startall) 3871 ieee80211_start_all(ic); 3872 } 3873 3874 /* 3875 * The interrupt side of things 3876 */ 3877 3878 /* 3879 * error dumping routines are from iwlwifi/mvm/utils.c 3880 */ 3881 3882 /* 3883 * Note: This structure is read from the device with IO accesses, 3884 * and the reading already does the endian conversion. As it is 3885 * read with uint32_t-sized accesses, any members with a different size 3886 * need to be ordered correctly though! 3887 */ 3888 struct iwm_error_event_table { 3889 uint32_t valid; /* (nonzero) valid, (0) log is empty */ 3890 uint32_t error_id; /* type of error */ 3891 uint32_t pc; /* program counter */ 3892 uint32_t blink1; /* branch link */ 3893 uint32_t blink2; /* branch link */ 3894 uint32_t ilink1; /* interrupt link */ 3895 uint32_t ilink2; /* interrupt link */ 3896 uint32_t data1; /* error-specific data */ 3897 uint32_t data2; /* error-specific data */ 3898 uint32_t data3; /* error-specific data */ 3899 uint32_t bcon_time; /* beacon timer */ 3900 uint32_t tsf_low; /* network timestamp function timer */ 3901 uint32_t tsf_hi; /* network timestamp function timer */ 3902 uint32_t gp1; /* GP1 timer register */ 3903 uint32_t gp2; /* GP2 timer register */ 3904 uint32_t gp3; /* GP3 timer register */ 3905 uint32_t ucode_ver; /* uCode version */ 3906 uint32_t hw_ver; /* HW Silicon version */ 3907 uint32_t brd_ver; /* HW board version */ 3908 uint32_t log_pc; /* log program counter */ 3909 uint32_t frame_ptr; /* frame pointer */ 3910 uint32_t stack_ptr; /* stack pointer */ 3911 uint32_t hcmd; /* last host command header */ 3912 uint32_t isr0; /* isr status register LMPM_NIC_ISR0: 3913 * rxtx_flag */ 3914 uint32_t isr1; /* isr status register LMPM_NIC_ISR1: 3915 * host_flag */ 3916 uint32_t isr2; /* isr status register LMPM_NIC_ISR2: 3917 * enc_flag */ 3918 uint32_t isr3; /* isr status register LMPM_NIC_ISR3: 3919 * time_flag */ 3920 uint32_t isr4; /* isr status register LMPM_NIC_ISR4: 3921 * wico interrupt */ 3922 uint32_t isr_pref; /* isr status register LMPM_NIC_PREF_STAT */ 3923 uint32_t wait_event; /* wait event() caller address */ 3924 uint32_t l2p_control; /* L2pControlField */ 3925 uint32_t l2p_duration; /* L2pDurationField */ 3926 uint32_t l2p_mhvalid; /* L2pMhValidBits */ 3927 uint32_t l2p_addr_match; /* L2pAddrMatchStat */ 3928 uint32_t lmpm_pmg_sel; /* indicate which clocks are turned on 3929 * (LMPM_PMG_SEL) */ 3930 uint32_t u_timestamp; /* indicate when the date and time of the 3931 * compilation */ 3932 uint32_t flow_handler; /* FH read/write pointers, RX credit */ 3933 } __packed; 3934 3935 #define ERROR_START_OFFSET (1 * sizeof(uint32_t)) 3936 #define ERROR_ELEM_SIZE (7 * sizeof(uint32_t)) 3937 3938 #ifdef IWM_DEBUG 3939 struct { 3940 const char *name; 3941 uint8_t num; 3942 } advanced_lookup[] = { 3943 { "NMI_INTERRUPT_WDG", 0x34 }, 3944 { "SYSASSERT", 0x35 }, 3945 { "UCODE_VERSION_MISMATCH", 0x37 }, 3946 { "BAD_COMMAND", 0x38 }, 3947 { "NMI_INTERRUPT_DATA_ACTION_PT", 0x3C }, 3948 { "FATAL_ERROR", 0x3D }, 3949 { "NMI_TRM_HW_ERR", 0x46 }, 3950 { "NMI_INTERRUPT_TRM", 0x4C }, 3951 { "NMI_INTERRUPT_BREAK_POINT", 0x54 }, 3952 { "NMI_INTERRUPT_WDG_RXF_FULL", 0x5C }, 3953 { "NMI_INTERRUPT_WDG_NO_RBD_RXF_FULL", 0x64 }, 3954 { "NMI_INTERRUPT_HOST", 0x66 }, 3955 { "NMI_INTERRUPT_ACTION_PT", 0x7C }, 3956 { "NMI_INTERRUPT_UNKNOWN", 0x84 }, 3957 { "NMI_INTERRUPT_INST_ACTION_PT", 0x86 }, 3958 { "ADVANCED_SYSASSERT", 0 }, 3959 }; 3960 3961 static const char * 3962 iwm_desc_lookup(uint32_t num) 3963 { 3964 int i; 3965 3966 for (i = 0; i < nitems(advanced_lookup) - 1; i++) 3967 if (advanced_lookup[i].num == num) 3968 return advanced_lookup[i].name; 3969 3970 /* No entry matches 'num', so it is the last: ADVANCED_SYSASSERT */ 3971 return advanced_lookup[i].name; 3972 } 3973 3974 /* 3975 * Support for dumping the error log seemed like a good idea ... 3976 * but it's mostly hex junk and the only sensible thing is the 3977 * hw/ucode revision (which we know anyway). Since it's here, 3978 * I'll just leave it in, just in case e.g. the Intel guys want to 3979 * help us decipher some "ADVANCED_SYSASSERT" later. 3980 */ 3981 static void 3982 iwm_nic_error(struct iwm_softc *sc) 3983 { 3984 struct iwm_error_event_table table; 3985 uint32_t base; 3986 3987 device_printf(sc->sc_dev, "dumping device error log\n"); 3988 base = sc->sc_uc.uc_error_event_table; 3989 if (base < 0x800000 || base >= 0x80C000) { 3990 device_printf(sc->sc_dev, 3991 "Not valid error log pointer 0x%08x\n", base); 3992 return; 3993 } 3994 3995 if (iwm_read_mem(sc, base, &table, sizeof(table)/sizeof(uint32_t)) != 0) { 3996 device_printf(sc->sc_dev, "reading errlog failed\n"); 3997 return; 3998 } 3999 4000 if (!table.valid) { 4001 device_printf(sc->sc_dev, "errlog not found, skipping\n"); 4002 return; 4003 } 4004 4005 if (ERROR_START_OFFSET <= table.valid * ERROR_ELEM_SIZE) { 4006 device_printf(sc->sc_dev, "Start IWL Error Log Dump:\n"); 4007 device_printf(sc->sc_dev, "Status: 0x%x, count: %d\n", 4008 sc->sc_flags, table.valid); 4009 } 4010 4011 device_printf(sc->sc_dev, "0x%08X | %-28s\n", table.error_id, 4012 iwm_desc_lookup(table.error_id)); 4013 device_printf(sc->sc_dev, "%08X | uPc\n", table.pc); 4014 device_printf(sc->sc_dev, "%08X | branchlink1\n", table.blink1); 4015 device_printf(sc->sc_dev, "%08X | branchlink2\n", table.blink2); 4016 device_printf(sc->sc_dev, "%08X | interruptlink1\n", table.ilink1); 4017 device_printf(sc->sc_dev, "%08X | interruptlink2\n", table.ilink2); 4018 device_printf(sc->sc_dev, "%08X | data1\n", table.data1); 4019 device_printf(sc->sc_dev, "%08X | data2\n", table.data2); 4020 device_printf(sc->sc_dev, "%08X | data3\n", table.data3); 4021 device_printf(sc->sc_dev, "%08X | beacon time\n", table.bcon_time); 4022 device_printf(sc->sc_dev, "%08X | tsf low\n", table.tsf_low); 4023 device_printf(sc->sc_dev, "%08X | tsf hi\n", table.tsf_hi); 4024 device_printf(sc->sc_dev, "%08X | time gp1\n", table.gp1); 4025 device_printf(sc->sc_dev, "%08X | time gp2\n", table.gp2); 4026 device_printf(sc->sc_dev, "%08X | time gp3\n", table.gp3); 4027 device_printf(sc->sc_dev, "%08X | uCode version\n", table.ucode_ver); 4028 device_printf(sc->sc_dev, "%08X | hw version\n", table.hw_ver); 4029 device_printf(sc->sc_dev, "%08X | board version\n", table.brd_ver); 4030 device_printf(sc->sc_dev, "%08X | hcmd\n", table.hcmd); 4031 device_printf(sc->sc_dev, "%08X | isr0\n", table.isr0); 4032 device_printf(sc->sc_dev, "%08X | isr1\n", table.isr1); 4033 device_printf(sc->sc_dev, "%08X | isr2\n", table.isr2); 4034 device_printf(sc->sc_dev, "%08X | isr3\n", table.isr3); 4035 device_printf(sc->sc_dev, "%08X | isr4\n", table.isr4); 4036 device_printf(sc->sc_dev, "%08X | isr_pref\n", table.isr_pref); 4037 device_printf(sc->sc_dev, "%08X | wait_event\n", table.wait_event); 4038 device_printf(sc->sc_dev, "%08X | l2p_control\n", table.l2p_control); 4039 device_printf(sc->sc_dev, "%08X | l2p_duration\n", table.l2p_duration); 4040 device_printf(sc->sc_dev, "%08X | l2p_mhvalid\n", table.l2p_mhvalid); 4041 device_printf(sc->sc_dev, "%08X | l2p_addr_match\n", table.l2p_addr_match); 4042 device_printf(sc->sc_dev, "%08X | lmpm_pmg_sel\n", table.lmpm_pmg_sel); 4043 device_printf(sc->sc_dev, "%08X | timestamp\n", table.u_timestamp); 4044 device_printf(sc->sc_dev, "%08X | flow_handler\n", table.flow_handler); 4045 } 4046 #endif 4047 4048 #define SYNC_RESP_STRUCT(_var_, _pkt_) \ 4049 do { \ 4050 bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_POSTREAD);\ 4051 _var_ = (void *)((_pkt_)+1); \ 4052 } while (/*CONSTCOND*/0) 4053 4054 #define SYNC_RESP_PTR(_ptr_, _len_, _pkt_) \ 4055 do { \ 4056 bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_POSTREAD);\ 4057 _ptr_ = (void *)((_pkt_)+1); \ 4058 } while (/*CONSTCOND*/0) 4059 4060 #define ADVANCE_RXQ(sc) (sc->rxq.cur = (sc->rxq.cur + 1) % IWM_RX_RING_COUNT); 4061 4062 /* 4063 * Process an IWM_CSR_INT_BIT_FH_RX or IWM_CSR_INT_BIT_SW_RX interrupt. 4064 * Basic structure from if_iwn 4065 */ 4066 static void 4067 iwm_notif_intr(struct iwm_softc *sc) 4068 { 4069 uint16_t hw; 4070 4071 bus_dmamap_sync(sc->rxq.stat_dma.tag, sc->rxq.stat_dma.map, 4072 BUS_DMASYNC_POSTREAD); 4073 4074 hw = le16toh(sc->rxq.stat->closed_rb_num) & 0xfff; 4075 while (sc->rxq.cur != hw) { 4076 struct iwm_rx_ring *ring = &sc->rxq; 4077 struct iwm_rx_data *data = &sc->rxq.data[sc->rxq.cur]; 4078 struct iwm_rx_packet *pkt; 4079 struct iwm_cmd_response *cresp; 4080 int qid, idx; 4081 4082 bus_dmamap_sync(sc->rxq.data_dmat, data->map, 4083 BUS_DMASYNC_POSTREAD); 4084 pkt = mtod(data->m, struct iwm_rx_packet *); 4085 4086 qid = pkt->hdr.qid & ~0x80; 4087 idx = pkt->hdr.idx; 4088 4089 IWM_DPRINTF(sc, IWM_DEBUG_INTR, 4090 "rx packet qid=%d idx=%d flags=%x type=%x %d %d\n", 4091 pkt->hdr.qid & ~0x80, pkt->hdr.idx, pkt->hdr.flags, 4092 pkt->hdr.code, sc->rxq.cur, hw); 4093 4094 /* 4095 * randomly get these from the firmware, no idea why. 4096 * they at least seem harmless, so just ignore them for now 4097 */ 4098 if (__predict_false((pkt->hdr.code == 0 && qid == 0 && idx == 0) 4099 || pkt->len_n_flags == htole32(0x55550000))) { 4100 ADVANCE_RXQ(sc); 4101 continue; 4102 } 4103 4104 switch (pkt->hdr.code) { 4105 case IWM_REPLY_RX_PHY_CMD: 4106 iwm_mvm_rx_rx_phy_cmd(sc, pkt, data); 4107 break; 4108 4109 case IWM_REPLY_RX_MPDU_CMD: 4110 iwm_mvm_rx_rx_mpdu(sc, pkt, data); 4111 break; 4112 4113 case IWM_TX_CMD: 4114 iwm_mvm_rx_tx_cmd(sc, pkt, data); 4115 break; 4116 4117 case IWM_MISSED_BEACONS_NOTIFICATION: { 4118 struct iwm_missed_beacons_notif *resp; 4119 int missed; 4120 4121 /* XXX look at mac_id to determine interface ID */ 4122 struct ieee80211com *ic = &sc->sc_ic; 4123 struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps); 4124 4125 SYNC_RESP_STRUCT(resp, pkt); 4126 missed = le32toh(resp->consec_missed_beacons); 4127 4128 IWM_DPRINTF(sc, IWM_DEBUG_BEACON | IWM_DEBUG_STATE, 4129 "%s: MISSED_BEACON: mac_id=%d, " 4130 "consec_since_last_rx=%d, consec=%d, num_expect=%d " 4131 "num_rx=%d\n", 4132 __func__, 4133 le32toh(resp->mac_id), 4134 le32toh(resp->consec_missed_beacons_since_last_rx), 4135 le32toh(resp->consec_missed_beacons), 4136 le32toh(resp->num_expected_beacons), 4137 le32toh(resp->num_recvd_beacons)); 4138 4139 /* Be paranoid */ 4140 if (vap == NULL) 4141 break; 4142 4143 /* XXX no net80211 locking? */ 4144 if (vap->iv_state == IEEE80211_S_RUN && 4145 (ic->ic_flags & IEEE80211_F_SCAN) == 0) { 4146 if (missed > vap->iv_bmissthreshold) { 4147 /* XXX bad locking; turn into task */ 4148 IWM_UNLOCK(sc); 4149 ieee80211_beacon_miss(ic); 4150 IWM_LOCK(sc); 4151 } 4152 } 4153 4154 break; } 4155 4156 case IWM_MVM_ALIVE: { 4157 struct iwm_mvm_alive_resp *resp; 4158 SYNC_RESP_STRUCT(resp, pkt); 4159 4160 sc->sc_uc.uc_error_event_table 4161 = le32toh(resp->error_event_table_ptr); 4162 sc->sc_uc.uc_log_event_table 4163 = le32toh(resp->log_event_table_ptr); 4164 sc->sched_base = le32toh(resp->scd_base_ptr); 4165 sc->sc_uc.uc_ok = resp->status == IWM_ALIVE_STATUS_OK; 4166 4167 sc->sc_uc.uc_intr = 1; 4168 wakeup(&sc->sc_uc); 4169 break; } 4170 4171 case IWM_CALIB_RES_NOTIF_PHY_DB: { 4172 struct iwm_calib_res_notif_phy_db *phy_db_notif; 4173 SYNC_RESP_STRUCT(phy_db_notif, pkt); 4174 4175 iwm_phy_db_set_section(sc, phy_db_notif); 4176 4177 break; } 4178 4179 case IWM_STATISTICS_NOTIFICATION: { 4180 struct iwm_notif_statistics *stats; 4181 SYNC_RESP_STRUCT(stats, pkt); 4182 memcpy(&sc->sc_stats, stats, sizeof(sc->sc_stats)); 4183 sc->sc_noise = iwm_get_noise(&stats->rx.general); 4184 break; } 4185 4186 case IWM_NVM_ACCESS_CMD: 4187 if (sc->sc_wantresp == ((qid << 16) | idx)) { 4188 bus_dmamap_sync(sc->rxq.data_dmat, data->map, 4189 BUS_DMASYNC_POSTREAD); 4190 memcpy(sc->sc_cmd_resp, 4191 pkt, sizeof(sc->sc_cmd_resp)); 4192 } 4193 break; 4194 4195 case IWM_PHY_CONFIGURATION_CMD: 4196 case IWM_TX_ANT_CONFIGURATION_CMD: 4197 case IWM_ADD_STA: 4198 case IWM_MAC_CONTEXT_CMD: 4199 case IWM_REPLY_SF_CFG_CMD: 4200 case IWM_POWER_TABLE_CMD: 4201 case IWM_PHY_CONTEXT_CMD: 4202 case IWM_BINDING_CONTEXT_CMD: 4203 case IWM_TIME_EVENT_CMD: 4204 case IWM_SCAN_REQUEST_CMD: 4205 case IWM_REPLY_BEACON_FILTERING_CMD: 4206 case IWM_MAC_PM_POWER_TABLE: 4207 case IWM_TIME_QUOTA_CMD: 4208 case IWM_REMOVE_STA: 4209 case IWM_TXPATH_FLUSH: 4210 case IWM_LQ_CMD: 4211 SYNC_RESP_STRUCT(cresp, pkt); 4212 if (sc->sc_wantresp == ((qid << 16) | idx)) { 4213 memcpy(sc->sc_cmd_resp, 4214 pkt, sizeof(*pkt)+sizeof(*cresp)); 4215 } 4216 break; 4217 4218 /* ignore */ 4219 case 0x6c: /* IWM_PHY_DB_CMD, no idea why it's not in fw-api.h */ 4220 break; 4221 4222 case IWM_INIT_COMPLETE_NOTIF: 4223 sc->sc_init_complete = 1; 4224 wakeup(&sc->sc_init_complete); 4225 break; 4226 4227 case IWM_SCAN_COMPLETE_NOTIFICATION: { 4228 struct iwm_scan_complete_notif *notif; 4229 SYNC_RESP_STRUCT(notif, pkt); 4230 taskqueue_enqueue(sc->sc_tq, &sc->sc_es_task); 4231 break; } 4232 4233 case IWM_REPLY_ERROR: { 4234 struct iwm_error_resp *resp; 4235 SYNC_RESP_STRUCT(resp, pkt); 4236 4237 device_printf(sc->sc_dev, 4238 "firmware error 0x%x, cmd 0x%x\n", 4239 le32toh(resp->error_type), 4240 resp->cmd_id); 4241 break; } 4242 4243 case IWM_TIME_EVENT_NOTIFICATION: { 4244 struct iwm_time_event_notif *notif; 4245 SYNC_RESP_STRUCT(notif, pkt); 4246 4247 if (notif->status) { 4248 if (le32toh(notif->action) & 4249 IWM_TE_V2_NOTIF_HOST_EVENT_START) 4250 sc->sc_auth_prot = 2; 4251 else 4252 sc->sc_auth_prot = 0; 4253 } else { 4254 sc->sc_auth_prot = -1; 4255 } 4256 IWM_DPRINTF(sc, IWM_DEBUG_INTR, 4257 "%s: time event notification auth_prot=%d\n", 4258 __func__, sc->sc_auth_prot); 4259 4260 wakeup(&sc->sc_auth_prot); 4261 break; } 4262 4263 case IWM_MCAST_FILTER_CMD: 4264 break; 4265 4266 default: 4267 device_printf(sc->sc_dev, 4268 "frame %d/%d %x UNHANDLED (this should " 4269 "not happen)\n", qid, idx, 4270 pkt->len_n_flags); 4271 break; 4272 } 4273 4274 /* 4275 * Why test bit 0x80? The Linux driver: 4276 * 4277 * There is one exception: uCode sets bit 15 when it 4278 * originates the response/notification, i.e. when the 4279 * response/notification is not a direct response to a 4280 * command sent by the driver. For example, uCode issues 4281 * IWM_REPLY_RX when it sends a received frame to the driver; 4282 * it is not a direct response to any driver command. 4283 * 4284 * Ok, so since when is 7 == 15? Well, the Linux driver 4285 * uses a slightly different format for pkt->hdr, and "qid" 4286 * is actually the upper byte of a two-byte field. 4287 */ 4288 if (!(pkt->hdr.qid & (1 << 7))) { 4289 iwm_cmd_done(sc, pkt); 4290 } 4291 4292 ADVANCE_RXQ(sc); 4293 } 4294 4295 IWM_CLRBITS(sc, IWM_CSR_GP_CNTRL, 4296 IWM_CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ); 4297 4298 /* 4299 * Tell the firmware what we have processed. 4300 * Seems like the hardware gets upset unless we align 4301 * the write by 8?? 4302 */ 4303 hw = (hw == 0) ? IWM_RX_RING_COUNT - 1 : hw - 1; 4304 IWM_WRITE(sc, IWM_FH_RSCSR_CHNL0_WPTR, hw & ~7); 4305 } 4306 4307 static void 4308 iwm_intr(void *arg) 4309 { 4310 struct iwm_softc *sc = arg; 4311 int handled = 0; 4312 int r1, r2, rv = 0; 4313 int isperiodic = 0; 4314 4315 IWM_LOCK(sc); 4316 IWM_WRITE(sc, IWM_CSR_INT_MASK, 0); 4317 4318 if (sc->sc_flags & IWM_FLAG_USE_ICT) { 4319 uint32_t *ict = sc->ict_dma.vaddr; 4320 int tmp; 4321 4322 tmp = htole32(ict[sc->ict_cur]); 4323 if (!tmp) 4324 goto out_ena; 4325 4326 /* 4327 * ok, there was something. keep plowing until we have all. 4328 */ 4329 r1 = r2 = 0; 4330 while (tmp) { 4331 r1 |= tmp; 4332 ict[sc->ict_cur] = 0; 4333 sc->ict_cur = (sc->ict_cur+1) % IWM_ICT_COUNT; 4334 tmp = htole32(ict[sc->ict_cur]); 4335 } 4336 4337 /* this is where the fun begins. don't ask */ 4338 if (r1 == 0xffffffff) 4339 r1 = 0; 4340 4341 /* i am not expected to understand this */ 4342 if (r1 & 0xc0000) 4343 r1 |= 0x8000; 4344 r1 = (0xff & r1) | ((0xff00 & r1) << 16); 4345 } else { 4346 r1 = IWM_READ(sc, IWM_CSR_INT); 4347 /* "hardware gone" (where, fishing?) */ 4348 if (r1 == 0xffffffff || (r1 & 0xfffffff0) == 0xa5a5a5a0) 4349 goto out; 4350 r2 = IWM_READ(sc, IWM_CSR_FH_INT_STATUS); 4351 } 4352 if (r1 == 0 && r2 == 0) { 4353 goto out_ena; 4354 } 4355 4356 IWM_WRITE(sc, IWM_CSR_INT, r1 | ~sc->sc_intmask); 4357 4358 /* ignored */ 4359 handled |= (r1 & (IWM_CSR_INT_BIT_ALIVE /*| IWM_CSR_INT_BIT_SCD*/)); 4360 4361 if (r1 & IWM_CSR_INT_BIT_SW_ERR) { 4362 int i; 4363 struct ieee80211com *ic = &sc->sc_ic; 4364 struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps); 4365 4366 #ifdef IWM_DEBUG 4367 iwm_nic_error(sc); 4368 #endif 4369 /* Dump driver status (TX and RX rings) while we're here. */ 4370 device_printf(sc->sc_dev, "driver status:\n"); 4371 for (i = 0; i < IWM_MVM_MAX_QUEUES; i++) { 4372 struct iwm_tx_ring *ring = &sc->txq[i]; 4373 device_printf(sc->sc_dev, 4374 " tx ring %2d: qid=%-2d cur=%-3d " 4375 "queued=%-3d\n", 4376 i, ring->qid, ring->cur, ring->queued); 4377 } 4378 device_printf(sc->sc_dev, 4379 " rx ring: cur=%d\n", sc->rxq.cur); 4380 device_printf(sc->sc_dev, 4381 " 802.11 state %d\n", (vap == NULL) ? -1 : vap->iv_state); 4382 4383 /* Don't stop the device; just do a VAP restart */ 4384 IWM_UNLOCK(sc); 4385 4386 if (vap == NULL) { 4387 printf("%s: null vap\n", __func__); 4388 return; 4389 } 4390 4391 device_printf(sc->sc_dev, "%s: controller panicked, iv_state = %d; " 4392 "restarting\n", __func__, vap->iv_state); 4393 4394 /* XXX TODO: turn this into a callout/taskqueue */ 4395 ieee80211_restart_all(ic); 4396 return; 4397 } 4398 4399 if (r1 & IWM_CSR_INT_BIT_HW_ERR) { 4400 handled |= IWM_CSR_INT_BIT_HW_ERR; 4401 device_printf(sc->sc_dev, "hardware error, stopping device\n"); 4402 iwm_stop(sc); 4403 rv = 1; 4404 goto out; 4405 } 4406 4407 /* firmware chunk loaded */ 4408 if (r1 & IWM_CSR_INT_BIT_FH_TX) { 4409 IWM_WRITE(sc, IWM_CSR_FH_INT_STATUS, IWM_CSR_FH_INT_TX_MASK); 4410 handled |= IWM_CSR_INT_BIT_FH_TX; 4411 sc->sc_fw_chunk_done = 1; 4412 wakeup(&sc->sc_fw); 4413 } 4414 4415 if (r1 & IWM_CSR_INT_BIT_RF_KILL) { 4416 handled |= IWM_CSR_INT_BIT_RF_KILL; 4417 if (iwm_check_rfkill(sc)) { 4418 device_printf(sc->sc_dev, 4419 "%s: rfkill switch, disabling interface\n", 4420 __func__); 4421 iwm_stop(sc); 4422 } 4423 } 4424 4425 /* 4426 * The Linux driver uses periodic interrupts to avoid races. 4427 * We cargo-cult like it's going out of fashion. 4428 */ 4429 if (r1 & IWM_CSR_INT_BIT_RX_PERIODIC) { 4430 handled |= IWM_CSR_INT_BIT_RX_PERIODIC; 4431 IWM_WRITE(sc, IWM_CSR_INT, IWM_CSR_INT_BIT_RX_PERIODIC); 4432 if ((r1 & (IWM_CSR_INT_BIT_FH_RX | IWM_CSR_INT_BIT_SW_RX)) == 0) 4433 IWM_WRITE_1(sc, 4434 IWM_CSR_INT_PERIODIC_REG, IWM_CSR_INT_PERIODIC_DIS); 4435 isperiodic = 1; 4436 } 4437 4438 if ((r1 & (IWM_CSR_INT_BIT_FH_RX | IWM_CSR_INT_BIT_SW_RX)) || isperiodic) { 4439 handled |= (IWM_CSR_INT_BIT_FH_RX | IWM_CSR_INT_BIT_SW_RX); 4440 IWM_WRITE(sc, IWM_CSR_FH_INT_STATUS, IWM_CSR_FH_INT_RX_MASK); 4441 4442 iwm_notif_intr(sc); 4443 4444 /* enable periodic interrupt, see above */ 4445 if (r1 & (IWM_CSR_INT_BIT_FH_RX | IWM_CSR_INT_BIT_SW_RX) && !isperiodic) 4446 IWM_WRITE_1(sc, IWM_CSR_INT_PERIODIC_REG, 4447 IWM_CSR_INT_PERIODIC_ENA); 4448 } 4449 4450 if (__predict_false(r1 & ~handled)) 4451 IWM_DPRINTF(sc, IWM_DEBUG_INTR, 4452 "%s: unhandled interrupts: %x\n", __func__, r1); 4453 rv = 1; 4454 4455 out_ena: 4456 iwm_restore_interrupts(sc); 4457 out: 4458 IWM_UNLOCK(sc); 4459 return; 4460 } 4461 4462 /* 4463 * Autoconf glue-sniffing 4464 */ 4465 #define PCI_VENDOR_INTEL 0x8086 4466 #define PCI_PRODUCT_INTEL_WL_3160_1 0x08b3 4467 #define PCI_PRODUCT_INTEL_WL_3160_2 0x08b4 4468 #define PCI_PRODUCT_INTEL_WL_7260_1 0x08b1 4469 #define PCI_PRODUCT_INTEL_WL_7260_2 0x08b2 4470 #define PCI_PRODUCT_INTEL_WL_7265_1 0x095a 4471 #define PCI_PRODUCT_INTEL_WL_7265_2 0x095b 4472 4473 static const struct iwm_devices { 4474 uint16_t device; 4475 const char *name; 4476 } iwm_devices[] = { 4477 { PCI_PRODUCT_INTEL_WL_3160_1, "Intel Dual Band Wireless AC 3160" }, 4478 { PCI_PRODUCT_INTEL_WL_3160_2, "Intel Dual Band Wireless AC 3160" }, 4479 { PCI_PRODUCT_INTEL_WL_7260_1, "Intel Dual Band Wireless AC 7260" }, 4480 { PCI_PRODUCT_INTEL_WL_7260_2, "Intel Dual Band Wireless AC 7260" }, 4481 { PCI_PRODUCT_INTEL_WL_7265_1, "Intel Dual Band Wireless AC 7265" }, 4482 { PCI_PRODUCT_INTEL_WL_7265_2, "Intel Dual Band Wireless AC 7265" }, 4483 }; 4484 4485 static int 4486 iwm_probe(device_t dev) 4487 { 4488 int i; 4489 4490 for (i = 0; i < nitems(iwm_devices); i++) 4491 if (pci_get_vendor(dev) == PCI_VENDOR_INTEL && 4492 pci_get_device(dev) == iwm_devices[i].device) { 4493 device_set_desc(dev, iwm_devices[i].name); 4494 return (BUS_PROBE_DEFAULT); 4495 } 4496 4497 return (ENXIO); 4498 } 4499 4500 static int 4501 iwm_dev_check(device_t dev) 4502 { 4503 struct iwm_softc *sc; 4504 4505 sc = device_get_softc(dev); 4506 4507 switch (pci_get_device(dev)) { 4508 case PCI_PRODUCT_INTEL_WL_3160_1: 4509 case PCI_PRODUCT_INTEL_WL_3160_2: 4510 sc->sc_fwname = "iwm3160fw"; 4511 sc->host_interrupt_operation_mode = 1; 4512 return (0); 4513 case PCI_PRODUCT_INTEL_WL_7260_1: 4514 case PCI_PRODUCT_INTEL_WL_7260_2: 4515 sc->sc_fwname = "iwm7260fw"; 4516 sc->host_interrupt_operation_mode = 1; 4517 return (0); 4518 case PCI_PRODUCT_INTEL_WL_7265_1: 4519 case PCI_PRODUCT_INTEL_WL_7265_2: 4520 sc->sc_fwname = "iwm7265fw"; 4521 sc->host_interrupt_operation_mode = 0; 4522 return (0); 4523 default: 4524 device_printf(dev, "unknown adapter type\n"); 4525 return ENXIO; 4526 } 4527 } 4528 4529 static int 4530 iwm_pci_attach(device_t dev) 4531 { 4532 struct iwm_softc *sc; 4533 int count, error, rid; 4534 uint16_t reg; 4535 4536 sc = device_get_softc(dev); 4537 4538 /* Clear device-specific "PCI retry timeout" register (41h). */ 4539 reg = pci_read_config(dev, 0x40, sizeof(reg)); 4540 pci_write_config(dev, 0x40, reg & ~0xff00, sizeof(reg)); 4541 4542 /* Enable bus-mastering and hardware bug workaround. */ 4543 pci_enable_busmaster(dev); 4544 reg = pci_read_config(dev, PCIR_STATUS, sizeof(reg)); 4545 /* if !MSI */ 4546 if (reg & PCIM_STATUS_INTxSTATE) { 4547 reg &= ~PCIM_STATUS_INTxSTATE; 4548 } 4549 pci_write_config(dev, PCIR_STATUS, reg, sizeof(reg)); 4550 4551 rid = PCIR_BAR(0); 4552 sc->sc_mem = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &rid, 4553 RF_ACTIVE); 4554 if (sc->sc_mem == NULL) { 4555 device_printf(sc->sc_dev, "can't map mem space\n"); 4556 return (ENXIO); 4557 } 4558 sc->sc_st = rman_get_bustag(sc->sc_mem); 4559 sc->sc_sh = rman_get_bushandle(sc->sc_mem); 4560 4561 /* Install interrupt handler. */ 4562 count = 1; 4563 rid = 0; 4564 if (pci_alloc_msi(dev, &count) == 0) 4565 rid = 1; 4566 sc->sc_irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &rid, RF_ACTIVE | 4567 (rid != 0 ? 0 : RF_SHAREABLE)); 4568 if (sc->sc_irq == NULL) { 4569 device_printf(dev, "can't map interrupt\n"); 4570 return (ENXIO); 4571 } 4572 error = bus_setup_intr(dev, sc->sc_irq, INTR_TYPE_NET | INTR_MPSAFE, 4573 NULL, iwm_intr, sc, &sc->sc_ih); 4574 if (sc->sc_ih == NULL) { 4575 device_printf(dev, "can't establish interrupt"); 4576 return (ENXIO); 4577 } 4578 sc->sc_dmat = bus_get_dma_tag(sc->sc_dev); 4579 4580 return (0); 4581 } 4582 4583 static void 4584 iwm_pci_detach(device_t dev) 4585 { 4586 struct iwm_softc *sc = device_get_softc(dev); 4587 4588 if (sc->sc_irq != NULL) { 4589 bus_teardown_intr(dev, sc->sc_irq, sc->sc_ih); 4590 bus_release_resource(dev, SYS_RES_IRQ, 4591 rman_get_rid(sc->sc_irq), sc->sc_irq); 4592 pci_release_msi(dev); 4593 } 4594 if (sc->sc_mem != NULL) 4595 bus_release_resource(dev, SYS_RES_MEMORY, 4596 rman_get_rid(sc->sc_mem), sc->sc_mem); 4597 } 4598 4599 4600 4601 static int 4602 iwm_attach(device_t dev) 4603 { 4604 struct iwm_softc *sc = device_get_softc(dev); 4605 struct ieee80211com *ic = &sc->sc_ic; 4606 int error; 4607 int txq_i, i; 4608 4609 sc->sc_dev = dev; 4610 IWM_LOCK_INIT(sc); 4611 mbufq_init(&sc->sc_snd, ifqmaxlen); 4612 callout_init_mtx(&sc->sc_watchdog_to, &sc->sc_mtx, 0); 4613 TASK_INIT(&sc->sc_es_task, 0, iwm_endscan_cb, sc); 4614 sc->sc_tq = taskqueue_create("iwm_taskq", M_WAITOK, 4615 taskqueue_thread_enqueue, &sc->sc_tq); 4616 error = taskqueue_start_threads(&sc->sc_tq, 1, 0, "iwm_taskq"); 4617 if (error != 0) { 4618 device_printf(dev, "can't start threads, error %d\n", 4619 error); 4620 goto fail; 4621 } 4622 4623 /* PCI attach */ 4624 error = iwm_pci_attach(dev); 4625 if (error != 0) 4626 goto fail; 4627 4628 sc->sc_wantresp = -1; 4629 4630 /* Check device type */ 4631 error = iwm_dev_check(dev); 4632 if (error != 0) 4633 goto fail; 4634 4635 sc->sc_fwdmasegsz = IWM_FWDMASEGSZ; 4636 4637 /* 4638 * We now start fiddling with the hardware 4639 */ 4640 sc->sc_hw_rev = IWM_READ(sc, IWM_CSR_HW_REV); 4641 if (iwm_prepare_card_hw(sc) != 0) { 4642 device_printf(dev, "could not initialize hardware\n"); 4643 goto fail; 4644 } 4645 4646 /* Allocate DMA memory for firmware transfers. */ 4647 if ((error = iwm_alloc_fwmem(sc)) != 0) { 4648 device_printf(dev, "could not allocate memory for firmware\n"); 4649 goto fail; 4650 } 4651 4652 /* Allocate "Keep Warm" page. */ 4653 if ((error = iwm_alloc_kw(sc)) != 0) { 4654 device_printf(dev, "could not allocate keep warm page\n"); 4655 goto fail; 4656 } 4657 4658 /* We use ICT interrupts */ 4659 if ((error = iwm_alloc_ict(sc)) != 0) { 4660 device_printf(dev, "could not allocate ICT table\n"); 4661 goto fail; 4662 } 4663 4664 /* Allocate TX scheduler "rings". */ 4665 if ((error = iwm_alloc_sched(sc)) != 0) { 4666 device_printf(dev, "could not allocate TX scheduler rings\n"); 4667 goto fail; 4668 } 4669 4670 /* Allocate TX rings */ 4671 for (txq_i = 0; txq_i < nitems(sc->txq); txq_i++) { 4672 if ((error = iwm_alloc_tx_ring(sc, 4673 &sc->txq[txq_i], txq_i)) != 0) { 4674 device_printf(dev, 4675 "could not allocate TX ring %d\n", 4676 txq_i); 4677 goto fail; 4678 } 4679 } 4680 4681 /* Allocate RX ring. */ 4682 if ((error = iwm_alloc_rx_ring(sc, &sc->rxq)) != 0) { 4683 device_printf(dev, "could not allocate RX ring\n"); 4684 goto fail; 4685 } 4686 4687 /* Clear pending interrupts. */ 4688 IWM_WRITE(sc, IWM_CSR_INT, 0xffffffff); 4689 4690 ic->ic_softc = sc; 4691 ic->ic_name = device_get_nameunit(sc->sc_dev); 4692 ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */ 4693 ic->ic_opmode = IEEE80211_M_STA; /* default to BSS mode */ 4694 4695 /* Set device capabilities. */ 4696 ic->ic_caps = 4697 IEEE80211_C_STA | 4698 IEEE80211_C_WPA | /* WPA/RSN */ 4699 IEEE80211_C_WME | 4700 IEEE80211_C_SHSLOT | /* short slot time supported */ 4701 IEEE80211_C_SHPREAMBLE /* short preamble supported */ 4702 // IEEE80211_C_BGSCAN /* capable of bg scanning */ 4703 ; 4704 for (i = 0; i < nitems(sc->sc_phyctxt); i++) { 4705 sc->sc_phyctxt[i].id = i; 4706 sc->sc_phyctxt[i].color = 0; 4707 sc->sc_phyctxt[i].ref = 0; 4708 sc->sc_phyctxt[i].channel = NULL; 4709 } 4710 4711 /* Max RSSI */ 4712 sc->sc_max_rssi = IWM_MAX_DBM - IWM_MIN_DBM; 4713 sc->sc_preinit_hook.ich_func = iwm_preinit; 4714 sc->sc_preinit_hook.ich_arg = sc; 4715 if (config_intrhook_establish(&sc->sc_preinit_hook) != 0) { 4716 device_printf(dev, "config_intrhook_establish failed\n"); 4717 goto fail; 4718 } 4719 4720 #ifdef IWM_DEBUG 4721 SYSCTL_ADD_INT(device_get_sysctl_ctx(dev), 4722 SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO, "debug", 4723 CTLFLAG_RW, &sc->sc_debug, 0, "control debugging"); 4724 #endif 4725 4726 IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_TRACE, 4727 "<-%s\n", __func__); 4728 4729 return 0; 4730 4731 /* Free allocated memory if something failed during attachment. */ 4732 fail: 4733 iwm_detach_local(sc, 0); 4734 4735 return ENXIO; 4736 } 4737 4738 static int 4739 iwm_update_edca(struct ieee80211com *ic) 4740 { 4741 struct iwm_softc *sc = ic->ic_softc; 4742 4743 device_printf(sc->sc_dev, "%s: called\n", __func__); 4744 return (0); 4745 } 4746 4747 static void 4748 iwm_preinit(void *arg) 4749 { 4750 struct iwm_softc *sc = arg; 4751 device_t dev = sc->sc_dev; 4752 struct ieee80211com *ic = &sc->sc_ic; 4753 int error; 4754 4755 IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_TRACE, 4756 "->%s\n", __func__); 4757 4758 IWM_LOCK(sc); 4759 if ((error = iwm_start_hw(sc)) != 0) { 4760 device_printf(dev, "could not initialize hardware\n"); 4761 IWM_UNLOCK(sc); 4762 goto fail; 4763 } 4764 4765 error = iwm_run_init_mvm_ucode(sc, 1); 4766 iwm_stop_device(sc); 4767 if (error) { 4768 IWM_UNLOCK(sc); 4769 goto fail; 4770 } 4771 device_printf(dev, 4772 "revision: 0x%x, firmware %d.%d (API ver. %d)\n", 4773 sc->sc_hw_rev & IWM_CSR_HW_REV_TYPE_MSK, 4774 IWM_UCODE_MAJOR(sc->sc_fwver), 4775 IWM_UCODE_MINOR(sc->sc_fwver), 4776 IWM_UCODE_API(sc->sc_fwver)); 4777 4778 /* not all hardware can do 5GHz band */ 4779 if (!sc->sc_nvm.sku_cap_band_52GHz_enable) 4780 memset(&ic->ic_sup_rates[IEEE80211_MODE_11A], 0, 4781 sizeof(ic->ic_sup_rates[IEEE80211_MODE_11A])); 4782 IWM_UNLOCK(sc); 4783 4784 iwm_init_channel_map(ic, IEEE80211_CHAN_MAX, &ic->ic_nchans, 4785 ic->ic_channels); 4786 4787 /* 4788 * At this point we've committed - if we fail to do setup, 4789 * we now also have to tear down the net80211 state. 4790 */ 4791 ieee80211_ifattach(ic); 4792 ic->ic_vap_create = iwm_vap_create; 4793 ic->ic_vap_delete = iwm_vap_delete; 4794 ic->ic_raw_xmit = iwm_raw_xmit; 4795 ic->ic_node_alloc = iwm_node_alloc; 4796 ic->ic_scan_start = iwm_scan_start; 4797 ic->ic_scan_end = iwm_scan_end; 4798 ic->ic_update_mcast = iwm_update_mcast; 4799 ic->ic_getradiocaps = iwm_init_channel_map; 4800 ic->ic_set_channel = iwm_set_channel; 4801 ic->ic_scan_curchan = iwm_scan_curchan; 4802 ic->ic_scan_mindwell = iwm_scan_mindwell; 4803 ic->ic_wme.wme_update = iwm_update_edca; 4804 ic->ic_parent = iwm_parent; 4805 ic->ic_transmit = iwm_transmit; 4806 iwm_radiotap_attach(sc); 4807 if (bootverbose) 4808 ieee80211_announce(ic); 4809 4810 IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_TRACE, 4811 "<-%s\n", __func__); 4812 config_intrhook_disestablish(&sc->sc_preinit_hook); 4813 4814 return; 4815 fail: 4816 config_intrhook_disestablish(&sc->sc_preinit_hook); 4817 iwm_detach_local(sc, 0); 4818 } 4819 4820 /* 4821 * Attach the interface to 802.11 radiotap. 4822 */ 4823 static void 4824 iwm_radiotap_attach(struct iwm_softc *sc) 4825 { 4826 struct ieee80211com *ic = &sc->sc_ic; 4827 4828 IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_TRACE, 4829 "->%s begin\n", __func__); 4830 ieee80211_radiotap_attach(ic, 4831 &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap), 4832 IWM_TX_RADIOTAP_PRESENT, 4833 &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap), 4834 IWM_RX_RADIOTAP_PRESENT); 4835 IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_TRACE, 4836 "->%s end\n", __func__); 4837 } 4838 4839 static struct ieee80211vap * 4840 iwm_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit, 4841 enum ieee80211_opmode opmode, int flags, 4842 const uint8_t bssid[IEEE80211_ADDR_LEN], 4843 const uint8_t mac[IEEE80211_ADDR_LEN]) 4844 { 4845 struct iwm_vap *ivp; 4846 struct ieee80211vap *vap; 4847 4848 if (!TAILQ_EMPTY(&ic->ic_vaps)) /* only one at a time */ 4849 return NULL; 4850 ivp = malloc(sizeof(struct iwm_vap), M_80211_VAP, M_WAITOK | M_ZERO); 4851 vap = &ivp->iv_vap; 4852 ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid); 4853 vap->iv_bmissthreshold = 10; /* override default */ 4854 /* Override with driver methods. */ 4855 ivp->iv_newstate = vap->iv_newstate; 4856 vap->iv_newstate = iwm_newstate; 4857 4858 ieee80211_ratectl_init(vap); 4859 /* Complete setup. */ 4860 ieee80211_vap_attach(vap, iwm_media_change, ieee80211_media_status, 4861 mac); 4862 ic->ic_opmode = opmode; 4863 4864 return vap; 4865 } 4866 4867 static void 4868 iwm_vap_delete(struct ieee80211vap *vap) 4869 { 4870 struct iwm_vap *ivp = IWM_VAP(vap); 4871 4872 ieee80211_ratectl_deinit(vap); 4873 ieee80211_vap_detach(vap); 4874 free(ivp, M_80211_VAP); 4875 } 4876 4877 static void 4878 iwm_scan_start(struct ieee80211com *ic) 4879 { 4880 struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps); 4881 struct iwm_softc *sc = ic->ic_softc; 4882 int error; 4883 4884 if (sc->sc_scanband) 4885 return; 4886 IWM_LOCK(sc); 4887 error = iwm_mvm_scan_request(sc, IEEE80211_CHAN_2GHZ, 0, NULL, 0); 4888 if (error) { 4889 device_printf(sc->sc_dev, "could not initiate scan\n"); 4890 IWM_UNLOCK(sc); 4891 ieee80211_cancel_scan(vap); 4892 } else 4893 IWM_UNLOCK(sc); 4894 } 4895 4896 static void 4897 iwm_scan_end(struct ieee80211com *ic) 4898 { 4899 } 4900 4901 static void 4902 iwm_update_mcast(struct ieee80211com *ic) 4903 { 4904 } 4905 4906 static void 4907 iwm_set_channel(struct ieee80211com *ic) 4908 { 4909 } 4910 4911 static void 4912 iwm_scan_curchan(struct ieee80211_scan_state *ss, unsigned long maxdwell) 4913 { 4914 } 4915 4916 static void 4917 iwm_scan_mindwell(struct ieee80211_scan_state *ss) 4918 { 4919 return; 4920 } 4921 4922 void 4923 iwm_init_task(void *arg1) 4924 { 4925 struct iwm_softc *sc = arg1; 4926 4927 IWM_LOCK(sc); 4928 while (sc->sc_flags & IWM_FLAG_BUSY) 4929 msleep(&sc->sc_flags, &sc->sc_mtx, 0, "iwmpwr", 0); 4930 sc->sc_flags |= IWM_FLAG_BUSY; 4931 iwm_stop(sc); 4932 if (sc->sc_ic.ic_nrunning > 0) 4933 iwm_init(sc); 4934 sc->sc_flags &= ~IWM_FLAG_BUSY; 4935 wakeup(&sc->sc_flags); 4936 IWM_UNLOCK(sc); 4937 } 4938 4939 static int 4940 iwm_resume(device_t dev) 4941 { 4942 struct iwm_softc *sc = device_get_softc(dev); 4943 int do_reinit = 0; 4944 uint16_t reg; 4945 4946 /* Clear device-specific "PCI retry timeout" register (41h). */ 4947 reg = pci_read_config(dev, 0x40, sizeof(reg)); 4948 pci_write_config(dev, 0x40, reg & ~0xff00, sizeof(reg)); 4949 iwm_init_task(device_get_softc(dev)); 4950 4951 IWM_LOCK(sc); 4952 if (sc->sc_flags & IWM_FLAG_DORESUME) { 4953 sc->sc_flags &= ~IWM_FLAG_DORESUME; 4954 do_reinit = 1; 4955 } 4956 IWM_UNLOCK(sc); 4957 4958 if (do_reinit) 4959 ieee80211_resume_all(&sc->sc_ic); 4960 4961 return 0; 4962 } 4963 4964 static int 4965 iwm_suspend(device_t dev) 4966 { 4967 int do_stop = 0; 4968 struct iwm_softc *sc = device_get_softc(dev); 4969 4970 do_stop = !! (sc->sc_ic.ic_nrunning > 0); 4971 4972 ieee80211_suspend_all(&sc->sc_ic); 4973 4974 if (do_stop) { 4975 IWM_LOCK(sc); 4976 iwm_stop(sc); 4977 sc->sc_flags |= IWM_FLAG_DORESUME; 4978 IWM_UNLOCK(sc); 4979 } 4980 4981 return (0); 4982 } 4983 4984 static int 4985 iwm_detach_local(struct iwm_softc *sc, int do_net80211) 4986 { 4987 struct iwm_fw_info *fw = &sc->sc_fw; 4988 device_t dev = sc->sc_dev; 4989 int i; 4990 4991 if (sc->sc_tq) { 4992 taskqueue_drain_all(sc->sc_tq); 4993 taskqueue_free(sc->sc_tq); 4994 } 4995 callout_drain(&sc->sc_watchdog_to); 4996 iwm_stop_device(sc); 4997 if (do_net80211) 4998 ieee80211_ifdetach(&sc->sc_ic); 4999 5000 /* Free descriptor rings */ 5001 for (i = 0; i < nitems(sc->txq); i++) 5002 iwm_free_tx_ring(sc, &sc->txq[i]); 5003 5004 /* Free firmware */ 5005 if (fw->fw_fp != NULL) 5006 iwm_fw_info_free(fw); 5007 5008 /* Free scheduler */ 5009 iwm_free_sched(sc); 5010 if (sc->ict_dma.vaddr != NULL) 5011 iwm_free_ict(sc); 5012 if (sc->kw_dma.vaddr != NULL) 5013 iwm_free_kw(sc); 5014 if (sc->fw_dma.vaddr != NULL) 5015 iwm_free_fwmem(sc); 5016 5017 /* Finished with the hardware - detach things */ 5018 iwm_pci_detach(dev); 5019 5020 mbufq_drain(&sc->sc_snd); 5021 IWM_LOCK_DESTROY(sc); 5022 5023 return (0); 5024 } 5025 5026 static int 5027 iwm_detach(device_t dev) 5028 { 5029 struct iwm_softc *sc = device_get_softc(dev); 5030 5031 return (iwm_detach_local(sc, 1)); 5032 } 5033 5034 static device_method_t iwm_pci_methods[] = { 5035 /* Device interface */ 5036 DEVMETHOD(device_probe, iwm_probe), 5037 DEVMETHOD(device_attach, iwm_attach), 5038 DEVMETHOD(device_detach, iwm_detach), 5039 DEVMETHOD(device_suspend, iwm_suspend), 5040 DEVMETHOD(device_resume, iwm_resume), 5041 5042 DEVMETHOD_END 5043 }; 5044 5045 static driver_t iwm_pci_driver = { 5046 "iwm", 5047 iwm_pci_methods, 5048 sizeof (struct iwm_softc) 5049 }; 5050 5051 static devclass_t iwm_devclass; 5052 5053 DRIVER_MODULE(iwm, pci, iwm_pci_driver, iwm_devclass, NULL, NULL); 5054 MODULE_DEPEND(iwm, firmware, 1, 1, 1); 5055 MODULE_DEPEND(iwm, pci, 1, 1, 1); 5056 MODULE_DEPEND(iwm, wlan, 1, 1, 1); 5057