2 * Copyright (c) 2007-2009 Damien Bergamini <damien.bergamini@free.fr>
3 * Copyright (c) 2008 Benjamin Close <benjsc@FreeBSD.org>
4 * Copyright (c) 2008 Sam Leffler, Errno Consulting
5 * Copyright (c) 2011 Intel Corporation
6 * Copyright (c) 2013 Cedric GROSS <c.gross@kreiz-it.fr>
7 * Copyright (c) 2013 Adrian Chadd <adrian@FreeBSD.org>
9 * Permission to use, copy, modify, and distribute this software for any
10 * purpose with or without fee is hereby granted, provided that the above
11 * copyright notice and this permission notice appear in all copies.
13 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
14 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
15 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
16 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
17 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
19 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21 * $FreeBSD: head/sys/dev/iwn/if_iwn.c 258118 2013-11-14 07:27:00Z adrian $
25 * Driver for Intel WiFi Link 4965 and 1000/5000/6000 Series 802.11 network
32 #include <sys/param.h>
33 #include <sys/sockio.h>
34 #include <sys/sysctl.h>
36 #include <sys/kernel.h>
37 #include <sys/socket.h>
38 #include <sys/systm.h>
39 #include <sys/malloc.h>
40 #include <sys/stdbool.h>
43 #include <sys/endian.h>
44 #include <sys/firmware.h>
45 #include <sys/limits.h>
46 #include <sys/module.h>
47 #include <sys/queue.h>
48 #include <sys/taskqueue.h>
49 #include <sys/libkern.h>
51 #include <sys/resource.h>
52 #include <machine/clock.h>
54 #include <bus/pci/pcireg.h>
55 #include <bus/pci/pcivar.h>
59 #include <net/if_var.h>
60 #include <net/if_arp.h>
61 #include <net/ifq_var.h>
62 #include <net/ethernet.h>
63 #include <net/if_dl.h>
64 #include <net/if_media.h>
65 #include <net/if_types.h>
67 #include <netinet/in.h>
68 #include <netinet/in_systm.h>
69 #include <netinet/in_var.h>
70 #include <netinet/if_ether.h>
71 #include <netinet/ip.h>
73 #include <netproto/802_11/ieee80211_var.h>
74 #include <netproto/802_11/ieee80211_radiotap.h>
75 #include <netproto/802_11/ieee80211_regdomain.h>
76 #include <netproto/802_11/ieee80211_ratectl.h>
78 #include "if_iwnreg.h"
79 #include "if_iwnvar.h"
80 #include "if_iwn_devid.h"
81 #include "if_iwn_chip_cfg.h"
82 #include "if_iwn_debug.h"
83 #include "if_iwn_ioctl.h"
86 #define IWN_UNLOCK(sc)
94 static const struct iwn_ident iwn_ident_table[] = {
95 { 0x8086, IWN_DID_6x05_1, "Intel Centrino Advanced-N 6205" },
96 { 0x8086, IWN_DID_1000_1, "Intel Centrino Wireless-N 1000" },
97 { 0x8086, IWN_DID_1000_2, "Intel Centrino Wireless-N 1000" },
98 { 0x8086, IWN_DID_6x05_2, "Intel Centrino Advanced-N 6205" },
99 { 0x8086, IWN_DID_6050_1, "Intel Centrino Advanced-N + WiMAX 6250" },
100 { 0x8086, IWN_DID_6050_2, "Intel Centrino Advanced-N + WiMAX 6250" },
101 { 0x8086, IWN_DID_x030_1, "Intel Centrino Wireless-N 1030" },
102 { 0x8086, IWN_DID_x030_2, "Intel Centrino Wireless-N 1030" },
103 { 0x8086, IWN_DID_x030_3, "Intel Centrino Advanced-N 6230" },
104 { 0x8086, IWN_DID_x030_4, "Intel Centrino Advanced-N 6230" },
105 { 0x8086, IWN_DID_6150_1, "Intel Centrino Wireless-N + WiMAX 6150" },
106 { 0x8086, IWN_DID_6150_2, "Intel Centrino Wireless-N + WiMAX 6150" },
107 { 0x8086, IWN_DID_2x00_1, "Intel(R) Centrino(R) Wireless-N 2200 BGN" },
108 { 0x8086, IWN_DID_2x00_2, "Intel(R) Centrino(R) Wireless-N 2200 BGN" },
109 /* XXX 2200D is IWN_SDID_2x00_4; there's no way to express this here! */
110 { 0x8086, IWN_DID_2x30_1, "Intel Centrino Wireless-N 2230" },
111 { 0x8086, IWN_DID_2x30_2, "Intel Centrino Wireless-N 2230" },
112 { 0x8086, IWN_DID_130_1, "Intel Centrino Wireless-N 130" },
113 { 0x8086, IWN_DID_130_2, "Intel Centrino Wireless-N 130" },
114 { 0x8086, IWN_DID_100_1, "Intel Centrino Wireless-N 100" },
115 { 0x8086, IWN_DID_100_2, "Intel Centrino Wireless-N 100" },
116 { 0x8086, IWN_DID_105_1, "Intel Centrino Wireless-N 105" },
117 { 0x8086, IWN_DID_105_2, "Intel Centrino Wireless-N 105" },
118 { 0x8086, IWN_DID_135_1, "Intel Centrino Wireless-N 135" },
119 { 0x8086, IWN_DID_135_2, "Intel Centrino Wireless-N 135" },
120 { 0x8086, IWN_DID_4965_1, "Intel Wireless WiFi Link 4965" },
121 { 0x8086, IWN_DID_6x00_1, "Intel Centrino Ultimate-N 6300" },
122 { 0x8086, IWN_DID_6x00_2, "Intel Centrino Advanced-N 6200" },
123 { 0x8086, IWN_DID_4965_2, "Intel Wireless WiFi Link 4965" },
124 { 0x8086, IWN_DID_4965_3, "Intel Wireless WiFi Link 4965" },
125 { 0x8086, IWN_DID_5x00_1, "Intel WiFi Link 5100" },
126 { 0x8086, IWN_DID_4965_4, "Intel Wireless WiFi Link 4965" },
127 { 0x8086, IWN_DID_5x00_3, "Intel Ultimate N WiFi Link 5300" },
128 { 0x8086, IWN_DID_5x00_4, "Intel Ultimate N WiFi Link 5300" },
129 { 0x8086, IWN_DID_5x00_2, "Intel WiFi Link 5100" },
130 { 0x8086, IWN_DID_6x00_3, "Intel Centrino Ultimate-N 6300" },
131 { 0x8086, IWN_DID_6x00_4, "Intel Centrino Advanced-N 6200" },
132 { 0x8086, IWN_DID_5x50_1, "Intel WiMAX/WiFi Link 5350" },
133 { 0x8086, IWN_DID_5x50_2, "Intel WiMAX/WiFi Link 5350" },
134 { 0x8086, IWN_DID_5x50_3, "Intel WiMAX/WiFi Link 5150" },
135 { 0x8086, IWN_DID_5x50_4, "Intel WiMAX/WiFi Link 5150" },
136 { 0x8086, IWN_DID_6035_1, "Intel Centrino Advanced 6235" },
137 { 0x8086, IWN_DID_6035_2, "Intel Centrino Advanced 6235" },
141 static int iwn_pci_probe(device_t);
142 static int iwn_pci_attach(device_t);
143 static int iwn4965_attach(struct iwn_softc *, uint16_t);
144 static int iwn5000_attach(struct iwn_softc *, uint16_t);
145 static int iwn_config_specific(struct iwn_softc *, uint16_t);
146 static void iwn_radiotap_attach(struct iwn_softc *);
147 static void iwn_sysctlattach(struct iwn_softc *);
148 static struct ieee80211vap *iwn_vap_create(struct ieee80211com *,
149 const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
150 const uint8_t [IEEE80211_ADDR_LEN],
151 const uint8_t [IEEE80211_ADDR_LEN]);
152 static void iwn_vap_delete(struct ieee80211vap *);
153 static int iwn_pci_detach(device_t);
154 static int iwn_pci_shutdown(device_t);
155 static int iwn_pci_suspend(device_t);
156 static int iwn_pci_resume(device_t);
157 static int iwn_nic_lock(struct iwn_softc *);
158 static int iwn_eeprom_lock(struct iwn_softc *);
159 static int iwn_init_otprom(struct iwn_softc *);
160 static int iwn_read_prom_data(struct iwn_softc *, uint32_t, void *, int);
161 static void iwn_dma_map_addr(void *, bus_dma_segment_t *, int, int);
162 static int iwn_dma_contig_alloc(struct iwn_softc *, struct iwn_dma_info *,
163 void **, bus_size_t, bus_size_t);
164 static void iwn_dma_contig_free(struct iwn_dma_info *);
165 static int iwn_alloc_sched(struct iwn_softc *);
166 static void iwn_free_sched(struct iwn_softc *);
167 static int iwn_alloc_kw(struct iwn_softc *);
168 static void iwn_free_kw(struct iwn_softc *);
169 static int iwn_alloc_ict(struct iwn_softc *);
170 static void iwn_free_ict(struct iwn_softc *);
171 static int iwn_alloc_fwmem(struct iwn_softc *);
172 static void iwn_free_fwmem(struct iwn_softc *);
173 static int iwn_alloc_rx_ring(struct iwn_softc *, struct iwn_rx_ring *);
174 static void iwn_reset_rx_ring(struct iwn_softc *, struct iwn_rx_ring *);
175 static void iwn_free_rx_ring(struct iwn_softc *, struct iwn_rx_ring *);
176 static int iwn_alloc_tx_ring(struct iwn_softc *, struct iwn_tx_ring *,
178 static void iwn_reset_tx_ring(struct iwn_softc *, struct iwn_tx_ring *);
179 static void iwn_free_tx_ring(struct iwn_softc *, struct iwn_tx_ring *);
180 static void iwn5000_ict_reset(struct iwn_softc *);
181 static int iwn_read_eeprom(struct iwn_softc *,
182 uint8_t macaddr[IEEE80211_ADDR_LEN]);
183 static void iwn4965_read_eeprom(struct iwn_softc *);
185 static void iwn4965_print_power_group(struct iwn_softc *, int);
187 static void iwn5000_read_eeprom(struct iwn_softc *);
188 static uint32_t iwn_eeprom_channel_flags(struct iwn_eeprom_chan *);
189 static void iwn_read_eeprom_band(struct iwn_softc *, int);
190 static void iwn_read_eeprom_ht40(struct iwn_softc *, int);
191 static void iwn_read_eeprom_channels(struct iwn_softc *, int, uint32_t);
192 static struct iwn_eeprom_chan *iwn_find_eeprom_channel(struct iwn_softc *,
193 struct ieee80211_channel *);
194 static int iwn_setregdomain(struct ieee80211com *,
195 struct ieee80211_regdomain *, int,
196 struct ieee80211_channel[]);
197 static void iwn_read_eeprom_enhinfo(struct iwn_softc *);
198 static struct ieee80211_node *iwn_node_alloc(struct ieee80211vap *,
199 const uint8_t mac[IEEE80211_ADDR_LEN]);
200 static void iwn_newassoc(struct ieee80211_node *, int);
201 static int iwn_media_change(struct ifnet *);
202 static int iwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
203 static void iwn_calib_timeout(void *);
204 static void iwn_rx_phy(struct iwn_softc *, struct iwn_rx_desc *,
205 struct iwn_rx_data *);
206 static void iwn_rx_done(struct iwn_softc *, struct iwn_rx_desc *,
207 struct iwn_rx_data *);
208 static void iwn_rx_compressed_ba(struct iwn_softc *, struct iwn_rx_desc *,
209 struct iwn_rx_data *);
210 static void iwn5000_rx_calib_results(struct iwn_softc *,
211 struct iwn_rx_desc *, struct iwn_rx_data *);
212 static void iwn_rx_statistics(struct iwn_softc *, struct iwn_rx_desc *,
213 struct iwn_rx_data *);
214 static void iwn4965_tx_done(struct iwn_softc *, struct iwn_rx_desc *,
215 struct iwn_rx_data *);
216 static void iwn5000_tx_done(struct iwn_softc *, struct iwn_rx_desc *,
217 struct iwn_rx_data *);
218 static void iwn_tx_done(struct iwn_softc *, struct iwn_rx_desc *, int,
220 static void iwn_ampdu_tx_done(struct iwn_softc *, int, int, int, void *);
221 static void iwn_cmd_done(struct iwn_softc *, struct iwn_rx_desc *);
222 static void iwn_notif_intr(struct iwn_softc *);
223 static void iwn_wakeup_intr(struct iwn_softc *);
224 static void iwn_rftoggle_intr(struct iwn_softc *);
225 static void iwn_fatal_intr(struct iwn_softc *);
226 static void iwn_intr(void *);
227 static void iwn4965_update_sched(struct iwn_softc *, int, int, uint8_t,
229 static void iwn5000_update_sched(struct iwn_softc *, int, int, uint8_t,
232 static void iwn5000_reset_sched(struct iwn_softc *, int, int);
234 static int iwn_tx_data(struct iwn_softc *, struct mbuf *,
235 struct ieee80211_node *);
236 static int iwn_tx_data_raw(struct iwn_softc *, struct mbuf *,
237 struct ieee80211_node *,
238 const struct ieee80211_bpf_params *params);
239 static int iwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
240 const struct ieee80211_bpf_params *);
241 static void iwn_start(struct ifnet *, struct ifaltq_subque *);
242 static void iwn_start_locked(struct ifnet *);
243 static void iwn_watchdog_timeout(void *);
244 static int iwn_ioctl(struct ifnet *, u_long, caddr_t, struct ucred *);
245 static int iwn_cmd(struct iwn_softc *, int, const void *, int, int);
246 static int iwn4965_add_node(struct iwn_softc *, struct iwn_node_info *,
248 static int iwn5000_add_node(struct iwn_softc *, struct iwn_node_info *,
250 static int iwn_set_link_quality(struct iwn_softc *,
251 struct ieee80211_node *);
252 static int iwn_add_broadcast_node(struct iwn_softc *, int);
253 static int iwn_updateedca(struct ieee80211com *);
254 static void iwn_update_mcast(struct ifnet *);
255 static void iwn_set_led(struct iwn_softc *, uint8_t, uint8_t, uint8_t);
256 static int iwn_set_critical_temp(struct iwn_softc *);
257 static int iwn_set_timing(struct iwn_softc *, struct ieee80211_node *);
258 static void iwn4965_power_calibration(struct iwn_softc *, int);
259 static int iwn4965_set_txpower(struct iwn_softc *,
260 struct ieee80211_channel *, int);
261 static int iwn5000_set_txpower(struct iwn_softc *,
262 struct ieee80211_channel *, int);
263 static int iwn4965_get_rssi(struct iwn_softc *, struct iwn_rx_stat *);
264 static int iwn5000_get_rssi(struct iwn_softc *, struct iwn_rx_stat *);
265 static int iwn_get_noise(const struct iwn_rx_general_stats *);
266 static int iwn4965_get_temperature(struct iwn_softc *);
267 static int iwn5000_get_temperature(struct iwn_softc *);
268 static int iwn_init_sensitivity(struct iwn_softc *);
269 static void iwn_collect_noise(struct iwn_softc *,
270 const struct iwn_rx_general_stats *);
271 static int iwn4965_init_gains(struct iwn_softc *);
272 static int iwn5000_init_gains(struct iwn_softc *);
273 static int iwn4965_set_gains(struct iwn_softc *);
274 static int iwn5000_set_gains(struct iwn_softc *);
275 static void iwn_tune_sensitivity(struct iwn_softc *,
276 const struct iwn_rx_stats *);
277 static void iwn_save_stats_counters(struct iwn_softc *,
278 const struct iwn_stats *);
279 static int iwn_send_sensitivity(struct iwn_softc *);
280 static void iwn_check_rx_recovery(struct iwn_softc *, struct iwn_stats *);
281 static int iwn_set_pslevel(struct iwn_softc *, int, int, int);
282 static int iwn_send_btcoex(struct iwn_softc *);
283 static int iwn_send_advanced_btcoex(struct iwn_softc *);
284 static int iwn5000_runtime_calib(struct iwn_softc *);
285 static int iwn_config(struct iwn_softc *);
286 static uint8_t *ieee80211_add_ssid(uint8_t *, const uint8_t *, u_int);
287 static int iwn_scan(struct iwn_softc *, struct ieee80211vap *,
288 struct ieee80211_scan_state *, struct ieee80211_channel *);
289 static int iwn_auth(struct iwn_softc *, struct ieee80211vap *vap);
290 static int iwn_run(struct iwn_softc *, struct ieee80211vap *vap);
291 static int iwn_ampdu_rx_start(struct ieee80211_node *,
292 struct ieee80211_rx_ampdu *, int, int, int);
293 static void iwn_ampdu_rx_stop(struct ieee80211_node *,
294 struct ieee80211_rx_ampdu *);
295 static int iwn_addba_request(struct ieee80211_node *,
296 struct ieee80211_tx_ampdu *, int, int, int);
297 static int iwn_addba_response(struct ieee80211_node *,
298 struct ieee80211_tx_ampdu *, int, int, int);
299 static int iwn_ampdu_tx_start(struct ieee80211com *,
300 struct ieee80211_node *, uint8_t);
301 static void iwn_ampdu_tx_stop(struct ieee80211_node *,
302 struct ieee80211_tx_ampdu *);
303 static void iwn4965_ampdu_tx_start(struct iwn_softc *,
304 struct ieee80211_node *, int, uint8_t, uint16_t);
305 static void iwn4965_ampdu_tx_stop(struct iwn_softc *, int,
307 static void iwn5000_ampdu_tx_start(struct iwn_softc *,
308 struct ieee80211_node *, int, uint8_t, uint16_t);
309 static void iwn5000_ampdu_tx_stop(struct iwn_softc *, int,
311 static int iwn5000_query_calibration(struct iwn_softc *);
312 static int iwn5000_send_calibration(struct iwn_softc *);
313 static int iwn5000_send_wimax_coex(struct iwn_softc *);
314 static int iwn5000_crystal_calib(struct iwn_softc *);
315 static int iwn5000_temp_offset_calib(struct iwn_softc *);
316 static int iwn5000_temp_offset_calibv2(struct iwn_softc *);
317 static int iwn4965_post_alive(struct iwn_softc *);
318 static int iwn5000_post_alive(struct iwn_softc *);
319 static int iwn4965_load_bootcode(struct iwn_softc *, const uint8_t *,
321 static int iwn4965_load_firmware(struct iwn_softc *);
322 static int iwn5000_load_firmware_section(struct iwn_softc *, uint32_t,
323 const uint8_t *, int);
324 static int iwn5000_load_firmware(struct iwn_softc *);
325 static int iwn_read_firmware_leg(struct iwn_softc *,
326 struct iwn_fw_info *);
327 static int iwn_read_firmware_tlv(struct iwn_softc *,
328 struct iwn_fw_info *, uint16_t);
329 static int iwn_read_firmware(struct iwn_softc *);
330 static int iwn_clock_wait(struct iwn_softc *);
331 static int iwn_apm_init(struct iwn_softc *);
332 static void iwn_apm_stop_master(struct iwn_softc *);
333 static void iwn_apm_stop(struct iwn_softc *);
334 static int iwn4965_nic_config(struct iwn_softc *);
335 static int iwn5000_nic_config(struct iwn_softc *);
336 static int iwn_hw_prepare(struct iwn_softc *);
337 static int iwn_hw_init(struct iwn_softc *);
338 static void iwn_hw_stop(struct iwn_softc *);
339 static void iwn_radio_on_task(void *, int);
340 static void iwn_radio_off_task(void *, int);
341 static void iwn_panicked_task(void *, int);
342 static void iwn_init_locked(struct iwn_softc *);
343 static void iwn_init(void *);
344 static void iwn_stop_locked(struct iwn_softc *);
345 static void iwn_scan_start(struct ieee80211com *);
346 static void iwn_scan_end(struct ieee80211com *);
347 static void iwn_set_channel(struct ieee80211com *);
348 static void iwn_scan_curchan(struct ieee80211_scan_state *, unsigned long);
349 static void iwn_scan_mindwell(struct ieee80211_scan_state *);
350 static void iwn_hw_reset_task(void *, int);
352 static char *iwn_get_csr_string(int);
353 static void iwn_debug_register(struct iwn_softc *);
356 static device_method_t iwn_methods[] = {
357 /* Device interface */
358 DEVMETHOD(device_probe, iwn_pci_probe),
359 DEVMETHOD(device_attach, iwn_pci_attach),
360 DEVMETHOD(device_detach, iwn_pci_detach),
361 DEVMETHOD(device_shutdown, iwn_pci_shutdown),
362 DEVMETHOD(device_suspend, iwn_pci_suspend),
363 DEVMETHOD(device_resume, iwn_pci_resume),
368 static driver_t iwn_driver = {
371 sizeof(struct iwn_softc)
373 static devclass_t iwn_devclass;
375 DRIVER_MODULE(iwn, pci, iwn_driver, iwn_devclass, NULL, NULL);
377 MODULE_VERSION(iwn, 1);
379 MODULE_DEPEND(iwn, firmware, 1, 1, 1);
380 MODULE_DEPEND(iwn, pci, 1, 1, 1);
381 MODULE_DEPEND(iwn, wlan, 1, 1, 1);
382 MODULE_DEPEND(iwn, wlan_amrr, 1, 1, 1);
385 iwn_pci_probe(device_t dev)
387 const struct iwn_ident *ident;
389 /* no wlan serializer needed */
390 for (ident = iwn_ident_table; ident->name != NULL; ident++) {
391 if (pci_get_vendor(dev) == ident->vendor &&
392 pci_get_device(dev) == ident->device) {
393 device_set_desc(dev, ident->name);
394 return (BUS_PROBE_DEFAULT);
401 iwn_pci_attach(device_t dev)
403 struct iwn_softc *sc = (struct iwn_softc *)device_get_softc(dev);
404 struct ieee80211com *ic;
407 uint8_t macaddr[IEEE80211_ADDR_LEN];
408 char ethstr[ETHER_ADDRSTRLEN + 1];
410 wlan_serialize_enter();
415 if (bus_dma_tag_create(sc->sc_dmat,
417 BUS_SPACE_MAXADDR_32BIT,
425 device_printf(dev, "cannot allocate DMA tag\n");
430 /* prepare sysctl tree for use in sub modules */
431 sysctl_ctx_init(&sc->sc_sysctl_ctx);
432 sc->sc_sysctl_tree = SYSCTL_ADD_NODE(&sc->sc_sysctl_ctx,
433 SYSCTL_STATIC_CHILDREN(_hw),
435 device_get_nameunit(sc->sc_dev),
439 error = resource_int_value(device_get_name(sc->sc_dev),
440 device_get_unit(sc->sc_dev), "debug", &(sc->sc_debug));
447 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: begin\n",__func__);
450 * Get the offset of the PCI Express Capability Structure in PCI
451 * Configuration Space.
453 error = pci_find_extcap(dev, PCIY_EXPRESS, &sc->sc_cap_off);
455 device_printf(dev, "PCIe capability structure not found!\n");
459 /* Clear device-specific "PCI retry timeout" register (41h). */
460 pci_write_config(dev, 0x41, 0, 1);
462 /* Enable bus-mastering. */
463 pci_enable_busmaster(dev);
466 sc->mem = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &rid,
468 if (sc->mem == NULL) {
469 device_printf(dev, "can't map mem space\n");
473 sc->sc_st = rman_get_bustag(sc->mem);
474 sc->sc_sh = rman_get_bushandle(sc->mem);
479 if (pci_alloc_msi(dev, &i) == 0)
482 /* Install interrupt handler. */
483 sc->irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &rid, RF_ACTIVE |
484 (rid != 0 ? 0 : RF_SHAREABLE));
485 if (sc->irq == NULL) {
486 device_printf(dev, "can't map interrupt\n");
491 /* Read hardware revision and attach. */
492 sc->hw_type = (IWN_READ(sc, IWN_HW_REV) >> IWN_HW_REV_TYPE_SHIFT)
493 & IWN_HW_REV_TYPE_MASK;
494 sc->subdevice_id = pci_get_subdevice(dev);
496 * 4965 versus 5000 and later have different methods.
497 * Let's set those up first.
499 if (sc->hw_type == IWN_HW_REV_TYPE_4965)
500 error = iwn4965_attach(sc, pci_get_device(dev));
502 error = iwn5000_attach(sc, pci_get_device(dev));
504 device_printf(dev, "could not attach device, error %d\n",
510 * Next, let's setup the various parameters of each NIC.
512 error = iwn_config_specific(sc, pci_get_device(dev));
514 device_printf(dev, "could not attach device, error %d\n",
519 if ((error = iwn_hw_prepare(sc)) != 0) {
520 device_printf(dev, "hardware not ready, error %d\n", error);
524 /* Allocate DMA memory for firmware transfers. */
525 if ((error = iwn_alloc_fwmem(sc)) != 0) {
527 "could not allocate memory for firmware, error %d\n",
532 /* Allocate "Keep Warm" page. */
533 if ((error = iwn_alloc_kw(sc)) != 0) {
535 "could not allocate keep warm page, error %d\n", error);
539 /* Allocate ICT table for 5000 Series. */
540 if (sc->hw_type != IWN_HW_REV_TYPE_4965 &&
541 (error = iwn_alloc_ict(sc)) != 0) {
542 device_printf(dev, "could not allocate ICT table, error %d\n",
547 /* Allocate TX scheduler "rings". */
548 if ((error = iwn_alloc_sched(sc)) != 0) {
550 "could not allocate TX scheduler rings, error %d\n", error);
554 /* Allocate TX rings (16 on 4965AGN, 20 on >=5000). */
555 for (i = 0; i < sc->ntxqs; i++) {
556 if ((error = iwn_alloc_tx_ring(sc, &sc->txq[i], i)) != 0) {
558 "could not allocate TX ring %d, error %d\n", i,
564 /* Allocate RX ring. */
565 if ((error = iwn_alloc_rx_ring(sc, &sc->rxq)) != 0) {
566 device_printf(dev, "could not allocate RX ring, error %d\n",
571 /* Clear pending interrupts. */
572 IWN_WRITE(sc, IWN_INT, 0xffffffff);
574 ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
576 device_printf(dev, "can not allocate ifnet structure\n");
582 ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
583 ic->ic_opmode = IEEE80211_M_STA; /* default to BSS mode */
585 /* Set device capabilities. */
587 IEEE80211_C_STA /* station mode supported */
588 | IEEE80211_C_MONITOR /* monitor mode supported */
589 | IEEE80211_C_BGSCAN /* background scanning */
590 | IEEE80211_C_TXPMGT /* tx power management */
591 | IEEE80211_C_SHSLOT /* short slot time supported */
593 | IEEE80211_C_SHPREAMBLE /* short preamble supported */
595 | IEEE80211_C_IBSS /* ibss/adhoc mode */
597 | IEEE80211_C_WME /* WME */
598 | IEEE80211_C_PMGT /* Station-side power mgmt */
601 /* Read MAC address, channels, etc from EEPROM. */
602 if ((error = iwn_read_eeprom(sc, macaddr)) != 0) {
603 device_printf(dev, "could not read EEPROM, error %d\n",
608 /* Count the number of available chains. */
610 ((sc->txchainmask >> 2) & 1) +
611 ((sc->txchainmask >> 1) & 1) +
612 ((sc->txchainmask >> 0) & 1);
614 ((sc->rxchainmask >> 2) & 1) +
615 ((sc->rxchainmask >> 1) & 1) +
616 ((sc->rxchainmask >> 0) & 1);
618 device_printf(dev, "MIMO %dT%dR, %.4s, address %s\n",
619 sc->ntxchains, sc->nrxchains, sc->eeprom_domain,
620 kether_ntoa(macaddr, ethstr));
623 if (sc->sc_flags & IWN_FLAG_HAS_11N) {
625 ic->ic_rxstream = sc->nrxchains;
626 ic->ic_txstream = sc->ntxchains;
630 * The NICs we currently support cap out at 2x2 support
631 * separate from the chains being used.
633 * This is a total hack to work around that until some
634 * per-device method is implemented to return the
635 * actual stream support.
637 * XXX Note: the 5350 is a 3x3 device; so we shouldn't
638 * cap this! But, anything that touches rates in the
639 * driver needs to be audited first before 3x3 is enabled.
642 if (ic->ic_rxstream > 2)
644 if (ic->ic_txstream > 2)
649 IEEE80211_HTCAP_SMPS_OFF /* SMPS mode disabled */
650 | IEEE80211_HTCAP_SHORTGI20 /* short GI in 20MHz */
651 | IEEE80211_HTCAP_CHWIDTH40 /* 40MHz channel width*/
652 | IEEE80211_HTCAP_SHORTGI40 /* short GI in 40MHz */
654 | IEEE80211_HTCAP_GREENFIELD
655 #if IWN_RBUF_SIZE == 8192
656 | IEEE80211_HTCAP_MAXAMSDU_7935 /* max A-MSDU length */
658 | IEEE80211_HTCAP_MAXAMSDU_3839 /* max A-MSDU length */
661 /* s/w capabilities */
662 | IEEE80211_HTC_HT /* HT operation */
663 | IEEE80211_HTC_AMPDU /* tx A-MPDU */
665 | IEEE80211_HTC_AMSDU /* tx A-MSDU */
670 if_initname(ifp, device_get_name(dev), device_get_unit(dev));
672 ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
673 ifp->if_init = iwn_init;
674 ifp->if_ioctl = iwn_ioctl;
675 ifp->if_start = iwn_start;
676 ifq_set_maxlen(&ifp->if_snd, IFQ_MAXLEN);
678 ifq_set_ready(&ifp->if_snd);
681 ieee80211_ifattach(ic, macaddr);
682 ic->ic_vap_create = iwn_vap_create;
683 ic->ic_vap_delete = iwn_vap_delete;
684 ic->ic_raw_xmit = iwn_raw_xmit;
685 ic->ic_node_alloc = iwn_node_alloc;
686 sc->sc_ampdu_rx_start = ic->ic_ampdu_rx_start;
687 ic->ic_ampdu_rx_start = iwn_ampdu_rx_start;
688 sc->sc_ampdu_rx_stop = ic->ic_ampdu_rx_stop;
689 ic->ic_ampdu_rx_stop = iwn_ampdu_rx_stop;
690 sc->sc_addba_request = ic->ic_addba_request;
691 ic->ic_addba_request = iwn_addba_request;
692 sc->sc_addba_response = ic->ic_addba_response;
693 ic->ic_addba_response = iwn_addba_response;
694 sc->sc_addba_stop = ic->ic_addba_stop;
695 ic->ic_addba_stop = iwn_ampdu_tx_stop;
696 ic->ic_newassoc = iwn_newassoc;
697 ic->ic_wme.wme_update = iwn_updateedca;
698 ic->ic_update_mcast = iwn_update_mcast;
699 ic->ic_scan_start = iwn_scan_start;
700 ic->ic_scan_end = iwn_scan_end;
701 ic->ic_set_channel = iwn_set_channel;
702 ic->ic_scan_curchan = iwn_scan_curchan;
703 ic->ic_scan_mindwell = iwn_scan_mindwell;
704 ic->ic_setregdomain = iwn_setregdomain;
706 iwn_radiotap_attach(sc);
708 callout_init(&sc->calib_to);
709 callout_init(&sc->watchdog_to);
710 TASK_INIT(&sc->sc_reinit_task, 0, iwn_hw_reset_task, sc);
711 TASK_INIT(&sc->sc_radioon_task, 0, iwn_radio_on_task, sc);
712 TASK_INIT(&sc->sc_radiooff_task, 0, iwn_radio_off_task, sc);
713 TASK_INIT(&sc->sc_panic_task, 0, iwn_panicked_task, sc);
715 sc->sc_tq = taskqueue_create("iwn_taskq", M_WAITOK,
716 taskqueue_thread_enqueue, &sc->sc_tq);
717 error = taskqueue_start_threads(&sc->sc_tq, 1, TDPRI_KERN_DAEMON, -1,
720 device_printf(dev, "can't start threads, error %d\n", error);
724 iwn_sysctlattach(sc);
727 * Hook our interrupt after all initialization is complete.
729 error = bus_setup_intr(dev, sc->irq, INTR_MPSAFE,
730 iwn_intr, sc, &sc->sc_ih,
731 &wlan_global_serializer);
733 device_printf(dev, "can't establish interrupt, error %d\n",
739 device_printf(sc->sc_dev, "%s: rx_stats=%d, rx_stats_bt=%d\n",
741 sizeof(struct iwn_stats),
742 sizeof(struct iwn_stats_bt));
746 ieee80211_announce(ic);
747 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
748 wlan_serialize_exit();
751 wlan_serialize_exit();
753 wlan_serialize_enter();
755 wlan_serialize_exit();
756 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end in error\n",__func__);
761 * Define specific configuration based on device id and subdevice id
762 * pid : PCI device id
765 iwn_config_specific(struct iwn_softc *sc, uint16_t pid)
774 sc->base_params = &iwn4965_base_params;
775 sc->limits = &iwn4965_sensitivity_limits;
776 sc->fwname = "iwn4965fw";
777 /* Override chains masks, ROM is known to be broken. */
778 sc->txchainmask = IWN_ANT_AB;
779 sc->rxchainmask = IWN_ANT_ABC;
780 /* Enable normal btcoex */
781 sc->sc_flags |= IWN_FLAG_BTCOEX;
786 switch(sc->subdevice_id) {
787 case IWN_SDID_1000_1:
788 case IWN_SDID_1000_2:
789 case IWN_SDID_1000_3:
790 case IWN_SDID_1000_4:
791 case IWN_SDID_1000_5:
792 case IWN_SDID_1000_6:
793 case IWN_SDID_1000_7:
794 case IWN_SDID_1000_8:
795 case IWN_SDID_1000_9:
796 case IWN_SDID_1000_10:
797 case IWN_SDID_1000_11:
798 case IWN_SDID_1000_12:
799 sc->limits = &iwn1000_sensitivity_limits;
800 sc->base_params = &iwn1000_base_params;
801 sc->fwname = "iwn1000fw";
804 device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
805 "0x%04x rev %d not supported (subdevice)\n", pid,
806 sc->subdevice_id,sc->hw_type);
815 sc->fwname = "iwn6000fw";
816 sc->limits = &iwn6000_sensitivity_limits;
817 switch(sc->subdevice_id) {
818 case IWN_SDID_6x00_1:
819 case IWN_SDID_6x00_2:
820 case IWN_SDID_6x00_8:
822 sc->base_params = &iwn_6000_base_params;
824 case IWN_SDID_6x00_3:
825 case IWN_SDID_6x00_6:
826 case IWN_SDID_6x00_9:
828 case IWN_SDID_6x00_4:
829 case IWN_SDID_6x00_7:
830 case IWN_SDID_6x00_10:
832 case IWN_SDID_6x00_5:
834 sc->base_params = &iwn_6000i_base_params;
835 sc->sc_flags |= IWN_FLAG_INTERNAL_PA;
836 sc->txchainmask = IWN_ANT_BC;
837 sc->rxchainmask = IWN_ANT_BC;
840 device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
841 "0x%04x rev %d not supported (subdevice)\n", pid,
842 sc->subdevice_id,sc->hw_type);
849 switch(sc->subdevice_id) {
850 case IWN_SDID_6x05_1:
851 case IWN_SDID_6x05_4:
852 case IWN_SDID_6x05_6:
854 case IWN_SDID_6x05_2:
855 case IWN_SDID_6x05_5:
856 case IWN_SDID_6x05_7:
858 case IWN_SDID_6x05_3:
860 case IWN_SDID_6x05_8:
861 case IWN_SDID_6x05_9:
862 //iwl6005_2agn_sff_cfg
863 case IWN_SDID_6x05_10:
865 case IWN_SDID_6x05_11:
866 //iwl6005_2agn_mow1_cfg
867 case IWN_SDID_6x05_12:
868 //iwl6005_2agn_mow2_cfg
869 sc->fwname = "iwn6000g2afw";
870 sc->limits = &iwn6000_sensitivity_limits;
871 sc->base_params = &iwn_6000g2_base_params;
874 device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
875 "0x%04x rev %d not supported (subdevice)\n", pid,
876 sc->subdevice_id,sc->hw_type);
883 switch(sc->subdevice_id) {
884 case IWN_SDID_6035_1:
885 case IWN_SDID_6035_2:
886 case IWN_SDID_6035_3:
887 case IWN_SDID_6035_4:
888 sc->fwname = "iwn6000g2bfw";
889 sc->limits = &iwn6235_sensitivity_limits;
890 sc->base_params = &iwn_6235_base_params;
893 device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
894 "0x%04x rev %d not supported (subdevice)\n", pid,
895 sc->subdevice_id,sc->hw_type);
899 /* 6x50 WiFi/WiMax Series */
902 switch(sc->subdevice_id) {
903 case IWN_SDID_6050_1:
904 case IWN_SDID_6050_3:
905 case IWN_SDID_6050_5:
907 case IWN_SDID_6050_2:
908 case IWN_SDID_6050_4:
909 case IWN_SDID_6050_6:
911 sc->fwname = "iwn6050fw";
912 sc->txchainmask = IWN_ANT_AB;
913 sc->rxchainmask = IWN_ANT_AB;
914 sc->limits = &iwn6000_sensitivity_limits;
915 sc->base_params = &iwn_6050_base_params;
918 device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
919 "0x%04x rev %d not supported (subdevice)\n", pid,
920 sc->subdevice_id,sc->hw_type);
924 /* 6150 WiFi/WiMax Series */
927 switch(sc->subdevice_id) {
928 case IWN_SDID_6150_1:
929 case IWN_SDID_6150_3:
930 case IWN_SDID_6150_5:
932 case IWN_SDID_6150_2:
933 case IWN_SDID_6150_4:
934 case IWN_SDID_6150_6:
936 sc->fwname = "iwn6050fw";
937 sc->limits = &iwn6000_sensitivity_limits;
938 sc->base_params = &iwn_6150_base_params;
941 device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
942 "0x%04x rev %d not supported (subdevice)\n", pid,
943 sc->subdevice_id,sc->hw_type);
947 /* 6030 Series and 1030 Series */
952 switch(sc->subdevice_id) {
953 case IWN_SDID_x030_1:
954 case IWN_SDID_x030_3:
955 case IWN_SDID_x030_5:
957 case IWN_SDID_x030_2:
958 case IWN_SDID_x030_4:
959 case IWN_SDID_x030_6:
961 case IWN_SDID_x030_7:
962 case IWN_SDID_x030_10:
963 case IWN_SDID_x030_14:
965 case IWN_SDID_x030_8:
966 case IWN_SDID_x030_11:
967 case IWN_SDID_x030_15:
969 case IWN_SDID_x030_9:
970 case IWN_SDID_x030_12:
971 case IWN_SDID_x030_16:
973 case IWN_SDID_x030_13:
975 sc->fwname = "iwn6000g2bfw";
976 sc->limits = &iwn6000_sensitivity_limits;
977 sc->base_params = &iwn_6000g2b_base_params;
980 device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
981 "0x%04x rev %d not supported (subdevice)\n", pid,
982 sc->subdevice_id,sc->hw_type);
986 /* 130 Series WiFi */
987 /* XXX: This series will need adjustment for rate.
988 * see rx_with_siso_diversity in linux kernel
992 switch(sc->subdevice_id) {
1001 sc->fwname = "iwn6000g2bfw";
1002 sc->limits = &iwn6000_sensitivity_limits;
1003 sc->base_params = &iwn_6000g2b_base_params;
1006 device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
1007 "0x%04x rev %d not supported (subdevice)\n", pid,
1008 sc->subdevice_id,sc->hw_type);
1012 /* 100 Series WiFi */
1015 switch(sc->subdevice_id) {
1016 case IWN_SDID_100_1:
1017 case IWN_SDID_100_2:
1018 case IWN_SDID_100_3:
1019 case IWN_SDID_100_4:
1020 case IWN_SDID_100_5:
1021 case IWN_SDID_100_6:
1022 sc->limits = &iwn1000_sensitivity_limits;
1023 sc->base_params = &iwn1000_base_params;
1024 sc->fwname = "iwn100fw";
1027 device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
1028 "0x%04x rev %d not supported (subdevice)\n", pid,
1029 sc->subdevice_id,sc->hw_type);
1035 /* XXX: This series will need adjustment for rate.
1036 * see rx_with_siso_diversity in linux kernel
1040 switch(sc->subdevice_id) {
1041 case IWN_SDID_105_1:
1042 case IWN_SDID_105_2:
1043 case IWN_SDID_105_3:
1045 case IWN_SDID_105_4:
1047 sc->limits = &iwn2030_sensitivity_limits;
1048 sc->base_params = &iwn2000_base_params;
1049 sc->fwname = "iwn105fw";
1052 device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
1053 "0x%04x rev %d not supported (subdevice)\n", pid,
1054 sc->subdevice_id,sc->hw_type);
1060 /* XXX: This series will need adjustment for rate.
1061 * see rx_with_siso_diversity in linux kernel
1065 switch(sc->subdevice_id) {
1066 case IWN_SDID_135_1:
1067 case IWN_SDID_135_2:
1068 case IWN_SDID_135_3:
1069 sc->limits = &iwn2030_sensitivity_limits;
1070 sc->base_params = &iwn2030_base_params;
1071 sc->fwname = "iwn135fw";
1074 device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
1075 "0x%04x rev %d not supported (subdevice)\n", pid,
1076 sc->subdevice_id,sc->hw_type);
1082 case IWN_DID_2x00_1:
1083 case IWN_DID_2x00_2:
1084 switch(sc->subdevice_id) {
1085 case IWN_SDID_2x00_1:
1086 case IWN_SDID_2x00_2:
1087 case IWN_SDID_2x00_3:
1089 case IWN_SDID_2x00_4:
1090 //iwl2000_2bgn_d_cfg
1091 sc->limits = &iwn2030_sensitivity_limits;
1092 sc->base_params = &iwn2000_base_params;
1093 sc->fwname = "iwn2000fw";
1096 device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
1097 "0x%04x rev %d not supported (subdevice) \n",
1098 pid, sc->subdevice_id, sc->hw_type);
1103 case IWN_DID_2x30_1:
1104 case IWN_DID_2x30_2:
1105 switch(sc->subdevice_id) {
1106 case IWN_SDID_2x30_1:
1107 case IWN_SDID_2x30_3:
1108 case IWN_SDID_2x30_5:
1110 case IWN_SDID_2x30_2:
1111 case IWN_SDID_2x30_4:
1112 case IWN_SDID_2x30_6:
1114 sc->limits = &iwn2030_sensitivity_limits;
1115 sc->base_params = &iwn2030_base_params;
1116 sc->fwname = "iwn2030fw";
1119 device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
1120 "0x%04x rev %d not supported (subdevice)\n", pid,
1121 sc->subdevice_id,sc->hw_type);
1126 case IWN_DID_5x00_1:
1127 case IWN_DID_5x00_2:
1128 case IWN_DID_5x00_3:
1129 case IWN_DID_5x00_4:
1130 sc->limits = &iwn5000_sensitivity_limits;
1131 sc->base_params = &iwn5000_base_params;
1132 sc->fwname = "iwn5000fw";
1133 switch(sc->subdevice_id) {
1134 case IWN_SDID_5x00_1:
1135 case IWN_SDID_5x00_2:
1136 case IWN_SDID_5x00_3:
1137 case IWN_SDID_5x00_4:
1138 case IWN_SDID_5x00_9:
1139 case IWN_SDID_5x00_10:
1140 case IWN_SDID_5x00_11:
1141 case IWN_SDID_5x00_12:
1142 case IWN_SDID_5x00_17:
1143 case IWN_SDID_5x00_18:
1144 case IWN_SDID_5x00_19:
1145 case IWN_SDID_5x00_20:
1147 sc->txchainmask = IWN_ANT_B;
1148 sc->rxchainmask = IWN_ANT_AB;
1150 case IWN_SDID_5x00_5:
1151 case IWN_SDID_5x00_6:
1152 case IWN_SDID_5x00_13:
1153 case IWN_SDID_5x00_14:
1154 case IWN_SDID_5x00_21:
1155 case IWN_SDID_5x00_22:
1157 sc->txchainmask = IWN_ANT_B;
1158 sc->rxchainmask = IWN_ANT_AB;
1160 case IWN_SDID_5x00_7:
1161 case IWN_SDID_5x00_8:
1162 case IWN_SDID_5x00_15:
1163 case IWN_SDID_5x00_16:
1164 case IWN_SDID_5x00_23:
1165 case IWN_SDID_5x00_24:
1167 sc->txchainmask = IWN_ANT_B;
1168 sc->rxchainmask = IWN_ANT_AB;
1170 case IWN_SDID_5x00_25:
1171 case IWN_SDID_5x00_26:
1172 case IWN_SDID_5x00_27:
1173 case IWN_SDID_5x00_28:
1174 case IWN_SDID_5x00_29:
1175 case IWN_SDID_5x00_30:
1176 case IWN_SDID_5x00_31:
1177 case IWN_SDID_5x00_32:
1178 case IWN_SDID_5x00_33:
1179 case IWN_SDID_5x00_34:
1180 case IWN_SDID_5x00_35:
1181 case IWN_SDID_5x00_36:
1183 sc->txchainmask = IWN_ANT_ABC;
1184 sc->rxchainmask = IWN_ANT_ABC;
1187 device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
1188 "0x%04x rev %d not supported (subdevice)\n", pid,
1189 sc->subdevice_id,sc->hw_type);
1194 case IWN_DID_5x50_1:
1195 case IWN_DID_5x50_2:
1196 case IWN_DID_5x50_3:
1197 case IWN_DID_5x50_4:
1198 sc->limits = &iwn5000_sensitivity_limits;
1199 sc->base_params = &iwn5000_base_params;
1200 sc->fwname = "iwn5000fw";
1201 switch(sc->subdevice_id) {
1202 case IWN_SDID_5x50_1:
1203 case IWN_SDID_5x50_2:
1204 case IWN_SDID_5x50_3:
1206 sc->limits = &iwn5000_sensitivity_limits;
1207 sc->base_params = &iwn5000_base_params;
1208 sc->fwname = "iwn5000fw";
1210 case IWN_SDID_5x50_4:
1211 case IWN_SDID_5x50_5:
1212 case IWN_SDID_5x50_8:
1213 case IWN_SDID_5x50_9:
1214 case IWN_SDID_5x50_10:
1215 case IWN_SDID_5x50_11:
1217 case IWN_SDID_5x50_6:
1218 case IWN_SDID_5x50_7:
1219 case IWN_SDID_5x50_12:
1220 case IWN_SDID_5x50_13:
1222 sc->limits = &iwn5000_sensitivity_limits;
1223 sc->fwname = "iwn5150fw";
1224 sc->base_params = &iwn_5x50_base_params;
1227 device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id :"
1228 "0x%04x rev %d not supported (subdevice)\n", pid,
1229 sc->subdevice_id,sc->hw_type);
1234 device_printf(sc->sc_dev, "adapter type id : 0x%04x sub id : 0x%04x"
1235 "rev 0x%08x not supported (device)\n", pid, sc->subdevice_id,
1243 iwn4965_attach(struct iwn_softc *sc, uint16_t pid)
1245 struct iwn_ops *ops = &sc->ops;
1247 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
1248 ops->load_firmware = iwn4965_load_firmware;
1249 ops->read_eeprom = iwn4965_read_eeprom;
1250 ops->post_alive = iwn4965_post_alive;
1251 ops->nic_config = iwn4965_nic_config;
1252 ops->update_sched = iwn4965_update_sched;
1253 ops->get_temperature = iwn4965_get_temperature;
1254 ops->get_rssi = iwn4965_get_rssi;
1255 ops->set_txpower = iwn4965_set_txpower;
1256 ops->init_gains = iwn4965_init_gains;
1257 ops->set_gains = iwn4965_set_gains;
1258 ops->add_node = iwn4965_add_node;
1259 ops->tx_done = iwn4965_tx_done;
1260 ops->ampdu_tx_start = iwn4965_ampdu_tx_start;
1261 ops->ampdu_tx_stop = iwn4965_ampdu_tx_stop;
1262 sc->ntxqs = IWN4965_NTXQUEUES;
1263 sc->firstaggqueue = IWN4965_FIRSTAGGQUEUE;
1264 sc->ndmachnls = IWN4965_NDMACHNLS;
1265 sc->broadcast_id = IWN4965_ID_BROADCAST;
1266 sc->rxonsz = IWN4965_RXONSZ;
1267 sc->schedsz = IWN4965_SCHEDSZ;
1268 sc->fw_text_maxsz = IWN4965_FW_TEXT_MAXSZ;
1269 sc->fw_data_maxsz = IWN4965_FW_DATA_MAXSZ;
1270 sc->fwsz = IWN4965_FWSZ;
1271 sc->sched_txfact_addr = IWN4965_SCHED_TXFACT;
1272 sc->limits = &iwn4965_sensitivity_limits;
1273 sc->fwname = "iwn4965fw";
1274 /* Override chains masks, ROM is known to be broken. */
1275 sc->txchainmask = IWN_ANT_AB;
1276 sc->rxchainmask = IWN_ANT_ABC;
1277 /* Enable normal btcoex */
1278 sc->sc_flags |= IWN_FLAG_BTCOEX;
1280 DPRINTF(sc, IWN_DEBUG_TRACE, "%s: end\n",__func__);
1286 iwn5000_attach(struct iwn_softc *sc, uint16_t pid)
1288 struct iwn_ops *ops = &sc->ops;
1290 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
1292 ops->load_firmware = iwn5000_load_firmware;
1293 ops->read_eeprom = iwn5000_read_eeprom;
1294 ops->post_alive = iwn5000_post_alive;
1295 ops->nic_config = iwn5000_nic_config;
1296 ops->update_sched = iwn5000_update_sched;
1297 ops->get_temperature = iwn5000_get_temperature;
1298 ops->get_rssi = iwn5000_get_rssi;
1299 ops->set_txpower = iwn5000_set_txpower;
1300 ops->init_gains = iwn5000_init_gains;
1301 ops->set_gains = iwn5000_set_gains;
1302 ops->add_node = iwn5000_add_node;
1303 ops->tx_done = iwn5000_tx_done;
1304 ops->ampdu_tx_start = iwn5000_ampdu_tx_start;
1305 ops->ampdu_tx_stop = iwn5000_ampdu_tx_stop;
1306 sc->ntxqs = IWN5000_NTXQUEUES;
1307 sc->firstaggqueue = IWN5000_FIRSTAGGQUEUE;
1308 sc->ndmachnls = IWN5000_NDMACHNLS;
1309 sc->broadcast_id = IWN5000_ID_BROADCAST;
1310 sc->rxonsz = IWN5000_RXONSZ;
1311 sc->schedsz = IWN5000_SCHEDSZ;
1312 sc->fw_text_maxsz = IWN5000_FW_TEXT_MAXSZ;
1313 sc->fw_data_maxsz = IWN5000_FW_DATA_MAXSZ;
1314 sc->fwsz = IWN5000_FWSZ;
1315 sc->sched_txfact_addr = IWN5000_SCHED_TXFACT;
1316 sc->reset_noise_gain = IWN5000_PHY_CALIB_RESET_NOISE_GAIN;
1317 sc->noise_gain = IWN5000_PHY_CALIB_NOISE_GAIN;
1323 * Attach the interface to 802.11 radiotap.
1326 iwn_radiotap_attach(struct iwn_softc *sc)
1328 struct ifnet *ifp = sc->sc_ifp;
1329 struct ieee80211com *ic = ifp->if_l2com;
1330 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
1331 ieee80211_radiotap_attach(ic,
1332 &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
1333 IWN_TX_RADIOTAP_PRESENT,
1334 &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
1335 IWN_RX_RADIOTAP_PRESENT);
1336 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
1340 iwn_sysctlattach(struct iwn_softc *sc)
1343 struct sysctl_ctx_list *ctx;
1344 struct sysctl_oid *tree;
1346 ctx = &sc->sc_sysctl_ctx;
1347 tree = sc->sc_sysctl_tree;
1350 device_printf(sc->sc_dev, "can't add sysctl node\n");
1353 SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
1354 "debug", CTLFLAG_RW, &sc->sc_debug, sc->sc_debug,
1355 "control debugging printfs");
1359 static struct ieee80211vap *
1360 iwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
1361 enum ieee80211_opmode opmode, int flags,
1362 const uint8_t bssid[IEEE80211_ADDR_LEN],
1363 const uint8_t mac[IEEE80211_ADDR_LEN])
1365 struct iwn_vap *ivp;
1366 struct ieee80211vap *vap;
1367 uint8_t mac1[IEEE80211_ADDR_LEN];
1368 struct iwn_softc *sc = ic->ic_ifp->if_softc;
1370 if (!TAILQ_EMPTY(&ic->ic_vaps)) /* only one at a time */
1373 IEEE80211_ADDR_COPY(mac1, mac);
1375 ivp = kmalloc(sizeof(struct iwn_vap), M_80211_VAP, M_INTWAIT | M_ZERO);
1377 ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid, mac1);
1378 ivp->ctx = IWN_RXON_BSS_CTX;
1379 IEEE80211_ADDR_COPY(ivp->macaddr, mac1);
1380 vap->iv_bmissthreshold = 10; /* override default */
1381 /* Override with driver methods. */
1382 ivp->iv_newstate = vap->iv_newstate;
1383 vap->iv_newstate = iwn_newstate;
1384 sc->ivap[IWN_RXON_BSS_CTX] = vap;
1386 ieee80211_ratectl_init(vap);
1387 /* Complete setup. */
1388 ieee80211_vap_attach(vap, iwn_media_change, ieee80211_media_status);
1389 ic->ic_opmode = opmode;
1394 iwn_vap_delete(struct ieee80211vap *vap)
1396 struct iwn_vap *ivp = IWN_VAP(vap);
1398 ieee80211_ratectl_deinit(vap);
1399 ieee80211_vap_detach(vap);
1400 kfree(ivp, M_80211_VAP);
1404 iwn_pci_detach(device_t dev)
1406 struct iwn_softc *sc = device_get_softc(dev);
1407 struct ifnet *ifp = sc->sc_ifp;
1408 struct ieee80211com *ic;
1411 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
1413 wlan_serialize_enter();
1418 ieee80211_draintask(ic, &sc->sc_reinit_task);
1419 ieee80211_draintask(ic, &sc->sc_radioon_task);
1420 ieee80211_draintask(ic, &sc->sc_radiooff_task);
1422 iwn_stop_locked(sc);
1425 // We don't need this for DragonFly as our taskqueue_free()
1426 // is running all remaining tasks before terminating.
1427 taskqueue_drain_all(sc->sc_tq);
1429 taskqueue_free(sc->sc_tq);
1431 callout_stop(&sc->watchdog_to);
1432 callout_stop(&sc->calib_to);
1433 ieee80211_ifdetach(ic);
1436 /* cleanup sysctl nodes */
1437 sysctl_ctx_free(&sc->sc_sysctl_ctx);
1439 /* Uninstall interrupt handler. */
1440 if (sc->irq != NULL) {
1441 bus_teardown_intr(dev, sc->irq, sc->sc_ih);
1442 bus_release_resource(dev, SYS_RES_IRQ, rman_get_rid(sc->irq),
1444 pci_release_msi(dev);
1448 /* Free DMA resources. */
1449 iwn_free_rx_ring(sc, &sc->rxq);
1450 for (qid = 0; qid < sc->ntxqs; qid++)
1451 iwn_free_tx_ring(sc, &sc->txq[qid]);
1454 if (sc->ict != NULL) {
1460 if (sc->mem != NULL) {
1461 bus_release_resource(dev, SYS_RES_MEMORY,
1462 rman_get_rid(sc->mem), sc->mem);
1471 bus_dma_tag_destroy(sc->sc_dmat);
1473 wlan_serialize_exit();
1474 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n", __func__);
1479 iwn_pci_shutdown(device_t dev)
1481 struct iwn_softc *sc = device_get_softc(dev);
1483 wlan_serialize_enter();
1484 iwn_stop_locked(sc);
1485 wlan_serialize_exit();
1491 iwn_pci_suspend(device_t dev)
1493 struct iwn_softc *sc = device_get_softc(dev);
1494 struct ieee80211com *ic = sc->sc_ifp->if_l2com;
1496 ieee80211_suspend_all(ic);
1501 iwn_pci_resume(device_t dev)
1503 struct iwn_softc *sc = device_get_softc(dev);
1504 struct ieee80211com *ic = sc->sc_ifp->if_l2com;
1506 /* Clear device-specific "PCI retry timeout" register (41h). */
1507 pci_write_config(dev, 0x41, 0, 1);
1509 ieee80211_resume_all(ic);
1514 iwn_nic_lock(struct iwn_softc *sc)
1518 /* Request exclusive access to NIC. */
1519 IWN_SETBITS(sc, IWN_GP_CNTRL, IWN_GP_CNTRL_MAC_ACCESS_REQ);
1521 /* Spin until we actually get the lock. */
1522 for (ntries = 0; ntries < 1000; ntries++) {
1523 if ((IWN_READ(sc, IWN_GP_CNTRL) &
1524 (IWN_GP_CNTRL_MAC_ACCESS_ENA | IWN_GP_CNTRL_SLEEP)) ==
1525 IWN_GP_CNTRL_MAC_ACCESS_ENA)
1532 static __inline void
1533 iwn_nic_unlock(struct iwn_softc *sc)
1535 IWN_CLRBITS(sc, IWN_GP_CNTRL, IWN_GP_CNTRL_MAC_ACCESS_REQ);
1538 static __inline uint32_t
1539 iwn_prph_read(struct iwn_softc *sc, uint32_t addr)
1541 IWN_WRITE(sc, IWN_PRPH_RADDR, IWN_PRPH_DWORD | addr);
1542 IWN_BARRIER_READ_WRITE(sc);
1543 return IWN_READ(sc, IWN_PRPH_RDATA);
1546 static __inline void
1547 iwn_prph_write(struct iwn_softc *sc, uint32_t addr, uint32_t data)
1549 IWN_WRITE(sc, IWN_PRPH_WADDR, IWN_PRPH_DWORD | addr);
1550 IWN_BARRIER_WRITE(sc);
1551 IWN_WRITE(sc, IWN_PRPH_WDATA, data);
1554 static __inline void
1555 iwn_prph_setbits(struct iwn_softc *sc, uint32_t addr, uint32_t mask)
1557 iwn_prph_write(sc, addr, iwn_prph_read(sc, addr) | mask);
1560 static __inline void
1561 iwn_prph_clrbits(struct iwn_softc *sc, uint32_t addr, uint32_t mask)
1563 iwn_prph_write(sc, addr, iwn_prph_read(sc, addr) & ~mask);
1566 static __inline void
1567 iwn_prph_write_region_4(struct iwn_softc *sc, uint32_t addr,
1568 const uint32_t *data, int count)
1570 for (; count > 0; count--, data++, addr += 4)
1571 iwn_prph_write(sc, addr, *data);
1574 static __inline uint32_t
1575 iwn_mem_read(struct iwn_softc *sc, uint32_t addr)
1577 IWN_WRITE(sc, IWN_MEM_RADDR, addr);
1578 IWN_BARRIER_READ_WRITE(sc);
1579 return IWN_READ(sc, IWN_MEM_RDATA);
1582 static __inline void
1583 iwn_mem_write(struct iwn_softc *sc, uint32_t addr, uint32_t data)
1585 IWN_WRITE(sc, IWN_MEM_WADDR, addr);
1586 IWN_BARRIER_WRITE(sc);
1587 IWN_WRITE(sc, IWN_MEM_WDATA, data);
1590 static __inline void
1591 iwn_mem_write_2(struct iwn_softc *sc, uint32_t addr, uint16_t data)
1595 tmp = iwn_mem_read(sc, addr & ~3);
1597 tmp = (tmp & 0x0000ffff) | data << 16;
1599 tmp = (tmp & 0xffff0000) | data;
1600 iwn_mem_write(sc, addr & ~3, tmp);
1603 static __inline void
1604 iwn_mem_read_region_4(struct iwn_softc *sc, uint32_t addr, uint32_t *data,
1607 for (; count > 0; count--, addr += 4)
1608 *data++ = iwn_mem_read(sc, addr);
1611 static __inline void
1612 iwn_mem_set_region_4(struct iwn_softc *sc, uint32_t addr, uint32_t val,
1615 for (; count > 0; count--, addr += 4)
1616 iwn_mem_write(sc, addr, val);
1620 iwn_eeprom_lock(struct iwn_softc *sc)
1624 for (i = 0; i < 100; i++) {
1625 /* Request exclusive access to EEPROM. */
1626 IWN_SETBITS(sc, IWN_HW_IF_CONFIG,
1627 IWN_HW_IF_CONFIG_EEPROM_LOCKED);
1629 /* Spin until we actually get the lock. */
1630 for (ntries = 0; ntries < 100; ntries++) {
1631 if (IWN_READ(sc, IWN_HW_IF_CONFIG) &
1632 IWN_HW_IF_CONFIG_EEPROM_LOCKED)
1637 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end timeout\n", __func__);
1641 static __inline void
1642 iwn_eeprom_unlock(struct iwn_softc *sc)
1644 IWN_CLRBITS(sc, IWN_HW_IF_CONFIG, IWN_HW_IF_CONFIG_EEPROM_LOCKED);
1648 * Initialize access by host to One Time Programmable ROM.
1649 * NB: This kind of ROM can be found on 1000 or 6000 Series only.
1652 iwn_init_otprom(struct iwn_softc *sc)
1654 uint16_t prev, base, next;
1657 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
1659 /* Wait for clock stabilization before accessing prph. */
1660 if ((error = iwn_clock_wait(sc)) != 0)
1663 if ((error = iwn_nic_lock(sc)) != 0)
1665 iwn_prph_setbits(sc, IWN_APMG_PS, IWN_APMG_PS_RESET_REQ);
1667 iwn_prph_clrbits(sc, IWN_APMG_PS, IWN_APMG_PS_RESET_REQ);
1670 /* Set auto clock gate disable bit for HW with OTP shadow RAM. */
1671 if (sc->base_params->shadow_ram_support) {
1672 IWN_SETBITS(sc, IWN_DBG_LINK_PWR_MGMT,
1673 IWN_RESET_LINK_PWR_MGMT_DIS);
1675 IWN_CLRBITS(sc, IWN_EEPROM_GP, IWN_EEPROM_GP_IF_OWNER);
1676 /* Clear ECC status. */
1677 IWN_SETBITS(sc, IWN_OTP_GP,
1678 IWN_OTP_GP_ECC_CORR_STTS | IWN_OTP_GP_ECC_UNCORR_STTS);
1681 * Find the block before last block (contains the EEPROM image)
1682 * for HW without OTP shadow RAM.
1684 if (! sc->base_params->shadow_ram_support) {
1685 /* Switch to absolute addressing mode. */
1686 IWN_CLRBITS(sc, IWN_OTP_GP, IWN_OTP_GP_RELATIVE_ACCESS);
1688 for (count = 0; count < sc->base_params->max_ll_items;
1690 error = iwn_read_prom_data(sc, base, &next, 2);
1693 if (next == 0) /* End of linked-list. */
1696 base = le16toh(next);
1698 if (count == 0 || count == sc->base_params->max_ll_items)
1700 /* Skip "next" word. */
1701 sc->prom_base = prev + 1;
1704 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
1710 iwn_read_prom_data(struct iwn_softc *sc, uint32_t addr, void *data, int count)
1712 uint8_t *out = data;
1716 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
1718 addr += sc->prom_base;
1719 for (; count > 0; count -= 2, addr++) {
1720 IWN_WRITE(sc, IWN_EEPROM, addr << 2);
1721 for (ntries = 0; ntries < 10; ntries++) {
1722 val = IWN_READ(sc, IWN_EEPROM);
1723 if (val & IWN_EEPROM_READ_VALID)
1728 device_printf(sc->sc_dev,
1729 "timeout reading ROM at 0x%x\n", addr);
1732 if (sc->sc_flags & IWN_FLAG_HAS_OTPROM) {
1733 /* OTPROM, check for ECC errors. */
1734 tmp = IWN_READ(sc, IWN_OTP_GP);
1735 if (tmp & IWN_OTP_GP_ECC_UNCORR_STTS) {
1736 device_printf(sc->sc_dev,
1737 "OTPROM ECC error at 0x%x\n", addr);
1740 if (tmp & IWN_OTP_GP_ECC_CORR_STTS) {
1741 /* Correctable ECC error, clear bit. */
1742 IWN_SETBITS(sc, IWN_OTP_GP,
1743 IWN_OTP_GP_ECC_CORR_STTS);
1751 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
1757 iwn_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
1761 KASSERT(nsegs == 1, ("too many DMA segments, %d should be 1", nsegs));
1762 *(bus_addr_t *)arg = segs[0].ds_addr;
1766 iwn_dma_contig_alloc(struct iwn_softc *sc, struct iwn_dma_info *dma,
1767 void **kvap, bus_size_t size, bus_size_t alignment)
1774 error = bus_dma_tag_create(sc->sc_dmat, alignment,
1775 0, BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, size,
1776 1, size, BUS_DMA_NOWAIT, &dma->tag);
1780 error = bus_dmamem_alloc(dma->tag, (void **)&dma->vaddr,
1781 BUS_DMA_NOWAIT | BUS_DMA_ZERO | BUS_DMA_COHERENT, &dma->map);
1785 error = bus_dmamap_load(dma->tag, dma->map, dma->vaddr, size,
1786 iwn_dma_map_addr, &dma->paddr, BUS_DMA_NOWAIT);
1790 bus_dmamap_sync(dma->tag, dma->map, BUS_DMASYNC_PREWRITE);
1797 fail: iwn_dma_contig_free(dma);
1802 iwn_dma_contig_free(struct iwn_dma_info *dma)
1804 if (dma->vaddr != NULL) {
1805 bus_dmamap_sync(dma->tag, dma->map,
1806 BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
1807 bus_dmamap_unload(dma->tag, dma->map);
1808 bus_dmamem_free(dma->tag, dma->vaddr, dma->map);
1811 if (dma->tag != NULL) {
1812 bus_dma_tag_destroy(dma->tag);
1818 iwn_alloc_sched(struct iwn_softc *sc)
1820 /* TX scheduler rings must be aligned on a 1KB boundary. */
1821 return iwn_dma_contig_alloc(sc, &sc->sched_dma, (void **)&sc->sched,
1826 iwn_free_sched(struct iwn_softc *sc)
1828 iwn_dma_contig_free(&sc->sched_dma);
1832 iwn_alloc_kw(struct iwn_softc *sc)
1834 /* "Keep Warm" page must be aligned on a 4KB boundary. */
1835 return iwn_dma_contig_alloc(sc, &sc->kw_dma, NULL, 4096, 4096);
1839 iwn_free_kw(struct iwn_softc *sc)
1841 iwn_dma_contig_free(&sc->kw_dma);
1845 iwn_alloc_ict(struct iwn_softc *sc)
1847 /* ICT table must be aligned on a 4KB boundary. */
1848 return iwn_dma_contig_alloc(sc, &sc->ict_dma, (void **)&sc->ict,
1849 IWN_ICT_SIZE, 4096);
1853 iwn_free_ict(struct iwn_softc *sc)
1855 iwn_dma_contig_free(&sc->ict_dma);
1859 iwn_alloc_fwmem(struct iwn_softc *sc)
1861 /* Must be aligned on a 16-byte boundary. */
1862 return iwn_dma_contig_alloc(sc, &sc->fw_dma, NULL, sc->fwsz, 16);
1866 iwn_free_fwmem(struct iwn_softc *sc)
1868 iwn_dma_contig_free(&sc->fw_dma);
1872 iwn_alloc_rx_ring(struct iwn_softc *sc, struct iwn_rx_ring *ring)
1879 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
1881 /* Allocate RX descriptors (256-byte aligned). */
1882 size = IWN_RX_RING_COUNT * sizeof (uint32_t);
1883 error = iwn_dma_contig_alloc(sc, &ring->desc_dma, (void **)&ring->desc,
1886 device_printf(sc->sc_dev,
1887 "%s: could not allocate RX ring DMA memory, error %d\n",
1892 /* Allocate RX status area (16-byte aligned). */
1893 error = iwn_dma_contig_alloc(sc, &ring->stat_dma, (void **)&ring->stat,
1894 sizeof (struct iwn_rx_status), 16);
1896 device_printf(sc->sc_dev,
1897 "%s: could not allocate RX status DMA memory, error %d\n",
1902 /* Create RX buffer DMA tag. */
1903 error = bus_dma_tag_create(sc->sc_dmat, 1, 0,
1904 BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
1905 IWN_RBUF_SIZE, 1, IWN_RBUF_SIZE, BUS_DMA_NOWAIT, &ring->data_dmat);
1907 device_printf(sc->sc_dev,
1908 "%s: could not create RX buf DMA tag, error %d\n",
1914 * Allocate and map RX buffers.
1916 for (i = 0; i < IWN_RX_RING_COUNT; i++) {
1917 struct iwn_rx_data *data = &ring->data[i];
1920 error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
1922 device_printf(sc->sc_dev,
1923 "%s: could not create RX buf DMA map, error %d\n",
1928 data->m = m_getjcl(MB_DONTWAIT, MT_DATA,
1929 M_PKTHDR, IWN_RBUF_SIZE);
1930 if (data->m == NULL) {
1931 device_printf(sc->sc_dev,
1932 "%s: could not allocate RX mbuf\n", __func__);
1937 error = bus_dmamap_load(ring->data_dmat, data->map,
1938 mtod(data->m, void *), IWN_RBUF_SIZE, iwn_dma_map_addr,
1939 &paddr, BUS_DMA_NOWAIT);
1940 if (error != 0 && error != EFBIG) {
1941 device_printf(sc->sc_dev,
1942 "%s: can't not map mbuf, error %d\n", __func__,
1947 /* Set physical address of RX buffer (256-byte aligned). */
1948 ring->desc[i] = htole32(paddr >> 8);
1951 bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
1952 BUS_DMASYNC_PREWRITE);
1954 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
1958 fail: iwn_free_rx_ring(sc, ring);
1960 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end in error\n",__func__);
1966 iwn_reset_rx_ring(struct iwn_softc *sc, struct iwn_rx_ring *ring)
1970 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
1972 if (iwn_nic_lock(sc) == 0) {
1973 IWN_WRITE(sc, IWN_FH_RX_CONFIG, 0);
1974 for (ntries = 0; ntries < 1000; ntries++) {
1975 if (IWN_READ(sc, IWN_FH_RX_STATUS) &
1976 IWN_FH_RX_STATUS_IDLE)
1983 sc->last_rx_valid = 0;
1987 iwn_free_rx_ring(struct iwn_softc *sc, struct iwn_rx_ring *ring)
1991 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s \n", __func__);
1993 iwn_dma_contig_free(&ring->desc_dma);
1994 iwn_dma_contig_free(&ring->stat_dma);
1996 for (i = 0; i < IWN_RX_RING_COUNT; i++) {
1997 struct iwn_rx_data *data = &ring->data[i];
1999 if (data->m != NULL) {
2000 bus_dmamap_sync(ring->data_dmat, data->map,
2001 BUS_DMASYNC_POSTREAD);
2002 bus_dmamap_unload(ring->data_dmat, data->map);
2006 if (data->map != NULL)
2007 bus_dmamap_destroy(ring->data_dmat, data->map);
2009 if (ring->data_dmat != NULL) {
2010 bus_dma_tag_destroy(ring->data_dmat);
2011 ring->data_dmat = NULL;
2016 iwn_alloc_tx_ring(struct iwn_softc *sc, struct iwn_tx_ring *ring, int qid)
2026 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
2028 /* Allocate TX descriptors (256-byte aligned). */
2029 size = IWN_TX_RING_COUNT * sizeof (struct iwn_tx_desc);
2030 error = iwn_dma_contig_alloc(sc, &ring->desc_dma, (void **)&ring->desc,
2033 device_printf(sc->sc_dev,
2034 "%s: could not allocate TX ring DMA memory, error %d\n",
2039 size = IWN_TX_RING_COUNT * sizeof (struct iwn_tx_cmd);
2040 error = iwn_dma_contig_alloc(sc, &ring->cmd_dma, (void **)&ring->cmd,
2043 device_printf(sc->sc_dev,
2044 "%s: could not allocate TX cmd DMA memory, error %d\n",
2049 error = bus_dma_tag_create(sc->sc_dmat, 1, 0,
2050 BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES,
2051 IWN_MAX_SCATTER - 1, MCLBYTES, BUS_DMA_NOWAIT, &ring->data_dmat);
2053 device_printf(sc->sc_dev,
2054 "%s: could not create TX buf DMA tag, error %d\n",
2059 paddr = ring->cmd_dma.paddr;
2060 for (i = 0; i < IWN_TX_RING_COUNT; i++) {
2061 struct iwn_tx_data *data = &ring->data[i];
2063 data->cmd_paddr = paddr;
2064 data->scratch_paddr = paddr + 12;
2065 paddr += sizeof (struct iwn_tx_cmd);
2067 error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
2069 device_printf(sc->sc_dev,
2070 "%s: could not create TX buf DMA map, error %d\n",
2076 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
2080 fail: iwn_free_tx_ring(sc, ring);
2081 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end in error\n", __func__);
2086 iwn_reset_tx_ring(struct iwn_softc *sc, struct iwn_tx_ring *ring)
2090 DPRINTF(sc, IWN_DEBUG_TRACE, "->doing %s \n", __func__);
2092 for (i = 0; i < IWN_TX_RING_COUNT; i++) {
2093 struct iwn_tx_data *data = &ring->data[i];
2095 if (data->m != NULL) {
2096 bus_dmamap_sync(ring->data_dmat, data->map,
2097 BUS_DMASYNC_POSTWRITE);
2098 bus_dmamap_unload(ring->data_dmat, data->map);
2103 /* Clear TX descriptors. */
2104 memset(ring->desc, 0, ring->desc_dma.size);
2105 bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
2106 BUS_DMASYNC_PREWRITE);
2107 sc->qfullmsk &= ~(1 << ring->qid);
2113 iwn_free_tx_ring(struct iwn_softc *sc, struct iwn_tx_ring *ring)
2117 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s \n", __func__);
2119 iwn_dma_contig_free(&ring->desc_dma);
2120 iwn_dma_contig_free(&ring->cmd_dma);
2122 for (i = 0; i < IWN_TX_RING_COUNT; i++) {
2123 struct iwn_tx_data *data = &ring->data[i];
2125 if (data->m != NULL) {
2126 bus_dmamap_sync(ring->data_dmat, data->map,
2127 BUS_DMASYNC_POSTWRITE);
2128 bus_dmamap_unload(ring->data_dmat, data->map);
2131 if (data->map != NULL)
2132 bus_dmamap_destroy(ring->data_dmat, data->map);
2134 if (ring->data_dmat != NULL) {
2135 bus_dma_tag_destroy(ring->data_dmat);
2136 ring->data_dmat = NULL;
2141 iwn5000_ict_reset(struct iwn_softc *sc)
2143 /* Disable interrupts. */
2144 IWN_WRITE(sc, IWN_INT_MASK, 0);
2146 /* Reset ICT table. */
2147 memset(sc->ict, 0, IWN_ICT_SIZE);
2150 /* Set physical address of ICT table (4KB aligned). */
2151 DPRINTF(sc, IWN_DEBUG_RESET, "%s: enabling ICT\n", __func__);
2152 IWN_WRITE(sc, IWN_DRAM_INT_TBL, IWN_DRAM_INT_TBL_ENABLE |
2153 IWN_DRAM_INT_TBL_WRAP_CHECK | sc->ict_dma.paddr >> 12);
2155 /* Enable periodic RX interrupt. */
2156 sc->int_mask |= IWN_INT_RX_PERIODIC;
2157 /* Switch to ICT interrupt mode in driver. */
2158 sc->sc_flags |= IWN_FLAG_USE_ICT;
2160 /* Re-enable interrupts. */
2161 IWN_WRITE(sc, IWN_INT, 0xffffffff);
2162 IWN_WRITE(sc, IWN_INT_MASK, sc->int_mask);
2166 iwn_read_eeprom(struct iwn_softc *sc, uint8_t macaddr[IEEE80211_ADDR_LEN])
2168 struct iwn_ops *ops = &sc->ops;
2172 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
2174 /* Check whether adapter has an EEPROM or an OTPROM. */
2175 if (sc->hw_type >= IWN_HW_REV_TYPE_1000 &&
2176 (IWN_READ(sc, IWN_OTP_GP) & IWN_OTP_GP_DEV_SEL_OTP))
2177 sc->sc_flags |= IWN_FLAG_HAS_OTPROM;
2178 DPRINTF(sc, IWN_DEBUG_RESET, "%s found\n",
2179 (sc->sc_flags & IWN_FLAG_HAS_OTPROM) ? "OTPROM" : "EEPROM");
2181 /* Adapter has to be powered on for EEPROM access to work. */
2182 if ((error = iwn_apm_init(sc)) != 0) {
2183 device_printf(sc->sc_dev,
2184 "%s: could not power ON adapter, error %d\n", __func__,
2189 if ((IWN_READ(sc, IWN_EEPROM_GP) & 0x7) == 0) {
2190 device_printf(sc->sc_dev, "%s: bad ROM signature\n", __func__);
2193 if ((error = iwn_eeprom_lock(sc)) != 0) {
2194 device_printf(sc->sc_dev, "%s: could not lock ROM, error %d\n",
2198 if (sc->sc_flags & IWN_FLAG_HAS_OTPROM) {
2199 if ((error = iwn_init_otprom(sc)) != 0) {
2200 device_printf(sc->sc_dev,
2201 "%s: could not initialize OTPROM, error %d\n",
2207 iwn_read_prom_data(sc, IWN_EEPROM_SKU_CAP, &val, 2);
2208 DPRINTF(sc, IWN_DEBUG_RESET, "SKU capabilities=0x%04x\n", le16toh(val));
2209 /* Check if HT support is bonded out. */
2210 if (val & htole16(IWN_EEPROM_SKU_CAP_11N))
2211 sc->sc_flags |= IWN_FLAG_HAS_11N;
2213 iwn_read_prom_data(sc, IWN_EEPROM_RFCFG, &val, 2);
2214 sc->rfcfg = le16toh(val);
2215 DPRINTF(sc, IWN_DEBUG_RESET, "radio config=0x%04x\n", sc->rfcfg);
2216 /* Read Tx/Rx chains from ROM unless it's known to be broken. */
2217 if (sc->txchainmask == 0)
2218 sc->txchainmask = IWN_RFCFG_TXANTMSK(sc->rfcfg);
2219 if (sc->rxchainmask == 0)
2220 sc->rxchainmask = IWN_RFCFG_RXANTMSK(sc->rfcfg);
2222 /* Read MAC address. */
2223 iwn_read_prom_data(sc, IWN_EEPROM_MAC, macaddr, 6);
2225 /* Read adapter-specific information from EEPROM. */
2226 ops->read_eeprom(sc);
2228 iwn_apm_stop(sc); /* Power OFF adapter. */
2230 iwn_eeprom_unlock(sc);
2232 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
2238 iwn4965_read_eeprom(struct iwn_softc *sc)
2244 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
2246 /* Read regulatory domain (4 ASCII characters). */
2247 iwn_read_prom_data(sc, IWN4965_EEPROM_DOMAIN, sc->eeprom_domain, 4);
2249 /* Read the list of authorized channels (20MHz ones only). */
2250 for (i = 0; i < IWN_NBANDS - 1; i++) {
2251 addr = iwn4965_regulatory_bands[i];
2252 iwn_read_eeprom_channels(sc, i, addr);
2255 /* Read maximum allowed TX power for 2GHz and 5GHz bands. */
2256 iwn_read_prom_data(sc, IWN4965_EEPROM_MAXPOW, &val, 2);
2257 sc->maxpwr2GHz = val & 0xff;
2258 sc->maxpwr5GHz = val >> 8;
2259 /* Check that EEPROM values are within valid range. */
2260 if (sc->maxpwr5GHz < 20 || sc->maxpwr5GHz > 50)
2261 sc->maxpwr5GHz = 38;
2262 if (sc->maxpwr2GHz < 20 || sc->maxpwr2GHz > 50)
2263 sc->maxpwr2GHz = 38;
2264 DPRINTF(sc, IWN_DEBUG_RESET, "maxpwr 2GHz=%d 5GHz=%d\n",
2265 sc->maxpwr2GHz, sc->maxpwr5GHz);
2267 /* Read samples for each TX power group. */
2268 iwn_read_prom_data(sc, IWN4965_EEPROM_BANDS, sc->bands,
2271 /* Read voltage at which samples were taken. */
2272 iwn_read_prom_data(sc, IWN4965_EEPROM_VOLTAGE, &val, 2);
2273 sc->eeprom_voltage = (int16_t)le16toh(val);
2274 DPRINTF(sc, IWN_DEBUG_RESET, "voltage=%d (in 0.3V)\n",
2275 sc->eeprom_voltage);
2278 /* Print samples. */
2279 if (sc->sc_debug & IWN_DEBUG_ANY) {
2280 for (i = 0; i < IWN_NBANDS - 1; i++)
2281 iwn4965_print_power_group(sc, i);
2285 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
2290 iwn4965_print_power_group(struct iwn_softc *sc, int i)
2292 struct iwn4965_eeprom_band *band = &sc->bands[i];
2293 struct iwn4965_eeprom_chan_samples *chans = band->chans;
2296 kprintf("===band %d===\n", i);
2297 kprintf("chan lo=%d, chan hi=%d\n", band->lo, band->hi);
2298 kprintf("chan1 num=%d\n", chans[0].num);
2299 for (c = 0; c < 2; c++) {
2300 for (j = 0; j < IWN_NSAMPLES; j++) {
2301 kprintf("chain %d, sample %d: temp=%d gain=%d "
2302 "power=%d pa_det=%d\n", c, j,
2303 chans[0].samples[c][j].temp,
2304 chans[0].samples[c][j].gain,
2305 chans[0].samples[c][j].power,
2306 chans[0].samples[c][j].pa_det);
2309 kprintf("chan2 num=%d\n", chans[1].num);
2310 for (c = 0; c < 2; c++) {
2311 for (j = 0; j < IWN_NSAMPLES; j++) {
2312 kprintf("chain %d, sample %d: temp=%d gain=%d "
2313 "power=%d pa_det=%d\n", c, j,
2314 chans[1].samples[c][j].temp,
2315 chans[1].samples[c][j].gain,
2316 chans[1].samples[c][j].power,
2317 chans[1].samples[c][j].pa_det);
2324 iwn5000_read_eeprom(struct iwn_softc *sc)
2326 struct iwn5000_eeprom_calib_hdr hdr;
2328 uint32_t base, addr;
2332 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
2334 /* Read regulatory domain (4 ASCII characters). */
2335 iwn_read_prom_data(sc, IWN5000_EEPROM_REG, &val, 2);
2336 base = le16toh(val);
2337 iwn_read_prom_data(sc, base + IWN5000_EEPROM_DOMAIN,
2338 sc->eeprom_domain, 4);
2340 /* Read the list of authorized channels (20MHz ones only). */
2341 for (i = 0; i < IWN_NBANDS - 1; i++) {
2342 addr = base + sc->base_params->regulatory_bands[i];
2343 iwn_read_eeprom_channels(sc, i, addr);
2346 /* Read enhanced TX power information for 6000 Series. */
2347 if (sc->base_params->enhanced_TX_power)
2348 iwn_read_eeprom_enhinfo(sc);
2350 iwn_read_prom_data(sc, IWN5000_EEPROM_CAL, &val, 2);
2351 base = le16toh(val);
2352 iwn_read_prom_data(sc, base, &hdr, sizeof hdr);
2353 DPRINTF(sc, IWN_DEBUG_CALIBRATE,
2354 "%s: calib version=%u pa type=%u voltage=%u\n", __func__,
2355 hdr.version, hdr.pa_type, le16toh(hdr.volt));
2356 sc->calib_ver = hdr.version;
2358 if (sc->base_params->calib_need & IWN_FLG_NEED_PHY_CALIB_TEMP_OFFSETv2) {
2359 sc->eeprom_voltage = le16toh(hdr.volt);
2360 iwn_read_prom_data(sc, base + IWN5000_EEPROM_TEMP, &val, 2);
2361 sc->eeprom_temp_high=le16toh(val);
2362 iwn_read_prom_data(sc, base + IWN5000_EEPROM_VOLT, &val, 2);
2363 sc->eeprom_temp = le16toh(val);
2366 if (sc->hw_type == IWN_HW_REV_TYPE_5150) {
2367 /* Compute temperature offset. */
2368 iwn_read_prom_data(sc, base + IWN5000_EEPROM_TEMP, &val, 2);
2369 sc->eeprom_temp = le16toh(val);
2370 iwn_read_prom_data(sc, base + IWN5000_EEPROM_VOLT, &val, 2);
2371 volt = le16toh(val);
2372 sc->temp_off = sc->eeprom_temp - (volt / -5);
2373 DPRINTF(sc, IWN_DEBUG_CALIBRATE, "temp=%d volt=%d offset=%dK\n",
2374 sc->eeprom_temp, volt, sc->temp_off);
2376 /* Read crystal calibration. */
2377 iwn_read_prom_data(sc, base + IWN5000_EEPROM_CRYSTAL,
2378 &sc->eeprom_crystal, sizeof (uint32_t));
2379 DPRINTF(sc, IWN_DEBUG_CALIBRATE, "crystal calibration 0x%08x\n",
2380 le32toh(sc->eeprom_crystal));
2383 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
2388 * Translate EEPROM flags to net80211.
2391 iwn_eeprom_channel_flags(struct iwn_eeprom_chan *channel)
2396 if ((channel->flags & IWN_EEPROM_CHAN_ACTIVE) == 0)
2397 nflags |= IEEE80211_CHAN_PASSIVE;
2398 if ((channel->flags & IWN_EEPROM_CHAN_IBSS) == 0)
2399 nflags |= IEEE80211_CHAN_NOADHOC;
2400 if (channel->flags & IWN_EEPROM_CHAN_RADAR) {
2401 nflags |= IEEE80211_CHAN_DFS;
2402 /* XXX apparently IBSS may still be marked */
2403 nflags |= IEEE80211_CHAN_NOADHOC;
2410 iwn_read_eeprom_band(struct iwn_softc *sc, int n)
2412 struct ifnet *ifp = sc->sc_ifp;
2413 struct ieee80211com *ic = ifp->if_l2com;
2414 struct iwn_eeprom_chan *channels = sc->eeprom_channels[n];
2415 const struct iwn_chan_band *band = &iwn_bands[n];
2416 struct ieee80211_channel *c;
2420 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
2422 for (i = 0; i < band->nchan; i++) {
2423 if (!(channels[i].flags & IWN_EEPROM_CHAN_VALID)) {
2424 DPRINTF(sc, IWN_DEBUG_RESET,
2425 "skip chan %d flags 0x%x maxpwr %d\n",
2426 band->chan[i], channels[i].flags,
2427 channels[i].maxpwr);
2430 chan = band->chan[i];
2431 nflags = iwn_eeprom_channel_flags(&channels[i]);
2433 c = &ic->ic_channels[ic->ic_nchans++];
2435 c->ic_maxregpower = channels[i].maxpwr;
2436 c->ic_maxpower = 2*c->ic_maxregpower;
2438 if (n == 0) { /* 2GHz band */
2439 c->ic_freq = ieee80211_ieee2mhz(chan, IEEE80211_CHAN_G);
2440 /* G =>'s B is supported */
2441 c->ic_flags = IEEE80211_CHAN_B | nflags;
2442 c = &ic->ic_channels[ic->ic_nchans++];
2444 c->ic_flags = IEEE80211_CHAN_G | nflags;
2445 } else { /* 5GHz band */
2446 c->ic_freq = ieee80211_ieee2mhz(chan, IEEE80211_CHAN_A);
2447 c->ic_flags = IEEE80211_CHAN_A | nflags;
2450 /* Save maximum allowed TX power for this channel. */
2451 sc->maxpwr[chan] = channels[i].maxpwr;
2453 DPRINTF(sc, IWN_DEBUG_RESET,
2454 "add chan %d flags 0x%x maxpwr %d\n", chan,
2455 channels[i].flags, channels[i].maxpwr);
2457 if (sc->sc_flags & IWN_FLAG_HAS_11N) {
2458 /* add HT20, HT40 added separately */
2459 c = &ic->ic_channels[ic->ic_nchans++];
2461 c->ic_flags |= IEEE80211_CHAN_HT20;
2465 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
2470 iwn_read_eeprom_ht40(struct iwn_softc *sc, int n)
2472 struct ifnet *ifp = sc->sc_ifp;
2473 struct ieee80211com *ic = ifp->if_l2com;
2474 struct iwn_eeprom_chan *channels = sc->eeprom_channels[n];
2475 const struct iwn_chan_band *band = &iwn_bands[n];
2476 struct ieee80211_channel *c, *cent, *extc;
2480 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s start\n", __func__);
2482 if (!(sc->sc_flags & IWN_FLAG_HAS_11N)) {
2483 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end no 11n\n", __func__);
2487 for (i = 0; i < band->nchan; i++) {
2488 if (!(channels[i].flags & IWN_EEPROM_CHAN_VALID)) {
2489 DPRINTF(sc, IWN_DEBUG_RESET,
2490 "skip chan %d flags 0x%x maxpwr %d\n",
2491 band->chan[i], channels[i].flags,
2492 channels[i].maxpwr);
2495 chan = band->chan[i];
2496 nflags = iwn_eeprom_channel_flags(&channels[i]);
2499 * Each entry defines an HT40 channel pair; find the
2500 * center channel, then the extension channel above.
2502 cent = ieee80211_find_channel_byieee(ic, chan,
2503 (n == 5 ? IEEE80211_CHAN_G : IEEE80211_CHAN_A));
2504 if (cent == NULL) { /* XXX shouldn't happen */
2505 device_printf(sc->sc_dev,
2506 "%s: no entry for channel %d\n", __func__, chan);
2509 extc = ieee80211_find_channel(ic, cent->ic_freq+20,
2510 (n == 5 ? IEEE80211_CHAN_G : IEEE80211_CHAN_A));
2512 DPRINTF(sc, IWN_DEBUG_RESET,
2513 "%s: skip chan %d, extension channel not found\n",
2518 DPRINTF(sc, IWN_DEBUG_RESET,
2519 "add ht40 chan %d flags 0x%x maxpwr %d\n",
2520 chan, channels[i].flags, channels[i].maxpwr);
2522 c = &ic->ic_channels[ic->ic_nchans++];
2524 c->ic_extieee = extc->ic_ieee;
2525 c->ic_flags &= ~IEEE80211_CHAN_HT;
2526 c->ic_flags |= IEEE80211_CHAN_HT40U | nflags;
2527 c = &ic->ic_channels[ic->ic_nchans++];
2529 c->ic_extieee = cent->ic_ieee;
2530 c->ic_flags &= ~IEEE80211_CHAN_HT;
2531 c->ic_flags |= IEEE80211_CHAN_HT40D | nflags;
2534 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
2539 iwn_read_eeprom_channels(struct iwn_softc *sc, int n, uint32_t addr)
2541 struct ifnet *ifp = sc->sc_ifp;
2542 struct ieee80211com *ic = ifp->if_l2com;
2544 iwn_read_prom_data(sc, addr, &sc->eeprom_channels[n],
2545 iwn_bands[n].nchan * sizeof (struct iwn_eeprom_chan));
2548 iwn_read_eeprom_band(sc, n);
2550 iwn_read_eeprom_ht40(sc, n);
2551 ieee80211_sort_channels(ic->ic_channels, ic->ic_nchans);
2554 static struct iwn_eeprom_chan *
2555 iwn_find_eeprom_channel(struct iwn_softc *sc, struct ieee80211_channel *c)
2557 int band, chan, i, j;
2559 if (IEEE80211_IS_CHAN_HT40(c)) {
2560 band = IEEE80211_IS_CHAN_5GHZ(c) ? 6 : 5;
2561 if (IEEE80211_IS_CHAN_HT40D(c))
2562 chan = c->ic_extieee;
2565 for (i = 0; i < iwn_bands[band].nchan; i++) {
2566 if (iwn_bands[band].chan[i] == chan)
2567 return &sc->eeprom_channels[band][i];
2570 for (j = 0; j < 5; j++) {
2571 for (i = 0; i < iwn_bands[j].nchan; i++) {
2572 if (iwn_bands[j].chan[i] == c->ic_ieee)
2573 return &sc->eeprom_channels[j][i];
2581 * Enforce flags read from EEPROM.
2584 iwn_setregdomain(struct ieee80211com *ic, struct ieee80211_regdomain *rd,
2585 int nchan, struct ieee80211_channel chans[])
2587 struct iwn_softc *sc = ic->ic_ifp->if_softc;
2590 for (i = 0; i < nchan; i++) {
2591 struct ieee80211_channel *c = &chans[i];
2592 struct iwn_eeprom_chan *channel;
2594 channel = iwn_find_eeprom_channel(sc, c);
2595 if (channel == NULL) {
2596 if_printf(ic->ic_ifp,
2597 "%s: invalid channel %u freq %u/0x%x\n",
2598 __func__, c->ic_ieee, c->ic_freq, c->ic_flags);
2601 c->ic_flags |= iwn_eeprom_channel_flags(channel);
2608 iwn_read_eeprom_enhinfo(struct iwn_softc *sc)
2610 struct iwn_eeprom_enhinfo enhinfo[35];
2611 struct ifnet *ifp = sc->sc_ifp;
2612 struct ieee80211com *ic = ifp->if_l2com;
2613 struct ieee80211_channel *c;
2619 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
2621 iwn_read_prom_data(sc, IWN5000_EEPROM_REG, &val, 2);
2622 base = le16toh(val);
2623 iwn_read_prom_data(sc, base + IWN6000_EEPROM_ENHINFO,
2624 enhinfo, sizeof enhinfo);
2626 for (i = 0; i < nitems(enhinfo); i++) {
2627 flags = enhinfo[i].flags;
2628 if (!(flags & IWN_ENHINFO_VALID))
2629 continue; /* Skip invalid entries. */
2632 if (sc->txchainmask & IWN_ANT_A)
2633 maxpwr = MAX(maxpwr, enhinfo[i].chain[0]);
2634 if (sc->txchainmask & IWN_ANT_B)
2635 maxpwr = MAX(maxpwr, enhinfo[i].chain[1]);
2636 if (sc->txchainmask & IWN_ANT_C)
2637 maxpwr = MAX(maxpwr, enhinfo[i].chain[2]);
2638 if (sc->ntxchains == 2)
2639 maxpwr = MAX(maxpwr, enhinfo[i].mimo2);
2640 else if (sc->ntxchains == 3)
2641 maxpwr = MAX(maxpwr, enhinfo[i].mimo3);
2643 for (j = 0; j < ic->ic_nchans; j++) {
2644 c = &ic->ic_channels[j];
2645 if ((flags & IWN_ENHINFO_5GHZ)) {
2646 if (!IEEE80211_IS_CHAN_A(c))
2648 } else if ((flags & IWN_ENHINFO_OFDM)) {
2649 if (!IEEE80211_IS_CHAN_G(c))
2651 } else if (!IEEE80211_IS_CHAN_B(c))
2653 if ((flags & IWN_ENHINFO_HT40)) {
2654 if (!IEEE80211_IS_CHAN_HT40(c))
2657 if (IEEE80211_IS_CHAN_HT40(c))
2660 if (enhinfo[i].chan != 0 &&
2661 enhinfo[i].chan != c->ic_ieee)
2664 DPRINTF(sc, IWN_DEBUG_RESET,
2665 "channel %d(%x), maxpwr %d\n", c->ic_ieee,
2666 c->ic_flags, maxpwr / 2);
2667 c->ic_maxregpower = maxpwr / 2;
2668 c->ic_maxpower = maxpwr;
2672 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end\n", __func__);
2676 static struct ieee80211_node *
2677 iwn_node_alloc(struct ieee80211vap *vap, const uint8_t mac[IEEE80211_ADDR_LEN])
2679 return kmalloc(sizeof(struct iwn_node), M_80211_NODE,
2680 M_INTWAIT | M_ZERO);
2686 switch (rate & 0xff) {
2687 case 12: return 0xd;
2688 case 18: return 0xf;
2689 case 24: return 0x5;
2690 case 36: return 0x7;
2691 case 48: return 0x9;
2692 case 72: return 0xb;
2693 case 96: return 0x1;
2694 case 108: return 0x3;
2698 case 22: return 110;
2704 * Calculate the required PLCP value from the given rate,
2705 * to the given node.
2707 * This will take the node configuration (eg 11n, rate table
2708 * setup, etc) into consideration.
2711 iwn_rate_to_plcp(struct iwn_softc *sc, struct ieee80211_node *ni,
2714 #define RV(v) ((v) & IEEE80211_RATE_VAL)
2715 struct ieee80211com *ic = ni->ni_ic;
2716 uint8_t txant1, txant2;
2720 /* Use the first valid TX antenna. */
2721 txant1 = IWN_LSB(sc->txchainmask);
2722 txant2 = IWN_LSB(sc->txchainmask & ~txant1);
2725 * If it's an MCS rate, let's set the plcp correctly
2726 * and set the relevant flags based on the node config.
2728 if (rate & IEEE80211_RATE_MCS) {
2730 * Set the initial PLCP value to be between 0->31 for
2731 * MCS 0 -> MCS 31, then set the "I'm an MCS rate!"
2734 plcp = RV(rate) | IWN_RFLAG_MCS;
2737 * XXX the following should only occur if both
2738 * the local configuration _and_ the remote node
2739 * advertise these capabilities. Thus this code
2744 * Set the channel width and guard interval.
2746 if (IEEE80211_IS_CHAN_HT40(ni->ni_chan)) {
2747 plcp |= IWN_RFLAG_HT40;
2748 if (ni->ni_htcap & IEEE80211_HTCAP_SHORTGI40)
2749 plcp |= IWN_RFLAG_SGI;
2750 } else if (ni->ni_htcap & IEEE80211_HTCAP_SHORTGI20) {
2751 plcp |= IWN_RFLAG_SGI;
2755 * If it's a two stream rate, enable TX on both
2758 * XXX three stream rates?
2761 plcp |= IWN_RFLAG_ANT(txant1 | txant2);
2763 plcp |= IWN_RFLAG_ANT(txant1);
2766 * Set the initial PLCP - fine for both
2767 * OFDM and CCK rates.
2769 plcp = rate2plcp(rate);
2771 /* Set CCK flag if it's CCK */
2773 /* XXX It would be nice to have a method
2774 * to map the ridx -> phy table entry
2775 * so we could just query that, rather than
2776 * this hack to check against IWN_RIDX_OFDM6.
2778 ridx = ieee80211_legacy_rate_lookup(ic->ic_rt,
2779 rate & IEEE80211_RATE_VAL);
2780 if (ridx < IWN_RIDX_OFDM6 &&
2781 IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
2782 plcp |= IWN_RFLAG_CCK;
2784 /* Set antenna configuration */
2785 plcp |= IWN_RFLAG_ANT(txant1);
2788 DPRINTF(sc, IWN_DEBUG_TXRATE, "%s: rate=0x%02x, plcp=0x%08x\n",
2793 return (htole32(plcp));
2798 iwn_newassoc(struct ieee80211_node *ni, int isnew)
2800 /* Doesn't do anything at the moment */
2804 iwn_media_change(struct ifnet *ifp)
2808 error = ieee80211_media_change(ifp);
2809 /* NB: only the fixed rate can change and that doesn't need a reset */
2810 return (error == ENETRESET ? 0 : error);
2814 iwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2816 struct iwn_vap *ivp = IWN_VAP(vap);
2817 struct ieee80211com *ic = vap->iv_ic;
2818 struct iwn_softc *sc = ic->ic_ifp->if_softc;
2821 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
2823 DPRINTF(sc, IWN_DEBUG_STATE, "%s: %s -> %s\n", __func__,
2824 ieee80211_state_name[vap->iv_state], ieee80211_state_name[nstate]);
2826 callout_stop(&sc->calib_to);
2828 sc->rxon = &sc->rx_on[IWN_RXON_BSS_CTX];
2831 case IEEE80211_S_ASSOC:
2832 if (vap->iv_state != IEEE80211_S_RUN)
2835 case IEEE80211_S_AUTH:
2836 if (vap->iv_state == IEEE80211_S_AUTH)
2840 * !AUTH -> AUTH transition requires state reset to handle
2841 * reassociations correctly.
2843 sc->rxon->associd = 0;
2844 sc->rxon->filter &= ~htole32(IWN_FILTER_BSS);
2845 sc->calib.state = IWN_CALIB_STATE_INIT;
2847 if ((error = iwn_auth(sc, vap)) != 0) {
2848 device_printf(sc->sc_dev,
2849 "%s: could not move to auth state\n", __func__);
2853 case IEEE80211_S_RUN:
2855 * RUN -> RUN transition; Just restart the timers.
2857 if (vap->iv_state == IEEE80211_S_RUN) {
2863 * !RUN -> RUN requires setting the association id
2864 * which is done with a firmware cmd. We also defer
2865 * starting the timers until that work is done.
2867 if ((error = iwn_run(sc, vap)) != 0) {
2868 device_printf(sc->sc_dev,
2869 "%s: could not move to run state\n", __func__);
2873 case IEEE80211_S_INIT:
2874 sc->calib.state = IWN_CALIB_STATE_INIT;
2881 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end in error\n", __func__);
2885 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
2887 return ivp->iv_newstate(vap, nstate, arg);
2891 iwn_calib_timeout(void *arg)
2893 struct iwn_softc *sc = arg;
2895 wlan_serialize_enter();
2897 /* Force automatic TX power calibration every 60 secs. */
2898 if (++sc->calib_cnt >= 120) {
2901 DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s\n",
2902 "sending request for statistics");
2903 (void)iwn_cmd(sc, IWN_CMD_GET_STATISTICS, &flags,
2907 callout_reset(&sc->calib_to, msecs_to_ticks(500), iwn_calib_timeout,
2909 wlan_serialize_exit();
2913 * Process an RX_PHY firmware notification. This is usually immediately
2914 * followed by an MPDU_RX_DONE notification.
2917 iwn_rx_phy(struct iwn_softc *sc, struct iwn_rx_desc *desc,
2918 struct iwn_rx_data *data)
2920 struct iwn_rx_stat *stat = (struct iwn_rx_stat *)(desc + 1);
2922 DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: received PHY stats\n", __func__);
2923 bus_dmamap_sync(sc->rxq.data_dmat, data->map, BUS_DMASYNC_POSTREAD);
2925 /* Save RX statistics, they will be used on MPDU_RX_DONE. */
2926 memcpy(&sc->last_rx_stat, stat, sizeof (*stat));
2927 sc->last_rx_valid = 1;
2931 * Process an RX_DONE (4965AGN only) or MPDU_RX_DONE firmware notification.
2932 * Each MPDU_RX_DONE notification must be preceded by an RX_PHY one.
2935 iwn_rx_done(struct iwn_softc *sc, struct iwn_rx_desc *desc,
2936 struct iwn_rx_data *data)
2938 struct iwn_ops *ops = &sc->ops;
2939 struct ifnet *ifp = sc->sc_ifp;
2940 struct ieee80211com *ic = ifp->if_l2com;
2941 struct iwn_rx_ring *ring = &sc->rxq;
2942 struct ieee80211_frame *wh;
2943 struct ieee80211_node *ni;
2944 struct mbuf *m, *m1;
2945 struct iwn_rx_stat *stat;
2949 int error, len, rssi, nf;
2951 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
2953 if (desc->type == IWN_MPDU_RX_DONE) {
2954 /* Check for prior RX_PHY notification. */
2955 if (!sc->last_rx_valid) {
2956 DPRINTF(sc, IWN_DEBUG_ANY,
2957 "%s: missing RX_PHY\n", __func__);
2960 stat = &sc->last_rx_stat;
2962 stat = (struct iwn_rx_stat *)(desc + 1);
2964 bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_POSTREAD);
2966 if (stat->cfg_phy_len > IWN_STAT_MAXLEN) {
2967 device_printf(sc->sc_dev,
2968 "%s: invalid RX statistic header, len %d\n", __func__,
2972 if (desc->type == IWN_MPDU_RX_DONE) {
2973 struct iwn_rx_mpdu *mpdu = (struct iwn_rx_mpdu *)(desc + 1);
2974 head = (caddr_t)(mpdu + 1);
2975 len = le16toh(mpdu->len);
2977 head = (caddr_t)(stat + 1) + stat->cfg_phy_len;
2978 len = le16toh(stat->len);
2981 flags = le32toh(*(uint32_t *)(head + len));
2983 /* Discard frames with a bad FCS early. */
2984 if ((flags & IWN_RX_NOERROR) != IWN_RX_NOERROR) {
2985 DPRINTF(sc, IWN_DEBUG_RECV, "%s: RX flags error %x\n",
2987 IFNET_STAT_INC(ifp, ierrors, 1);
2990 /* Discard frames that are too short. */
2991 if (len < sizeof (*wh)) {
2992 DPRINTF(sc, IWN_DEBUG_RECV, "%s: frame too short: %d\n",
2994 IFNET_STAT_INC(ifp, ierrors, 1);
2998 m1 = m_getjcl(MB_DONTWAIT, MT_DATA, M_PKTHDR, IWN_RBUF_SIZE);
3000 DPRINTF(sc, IWN_DEBUG_ANY, "%s: no mbuf to restock ring\n",
3002 IFNET_STAT_INC(ifp, ierrors, 1);
3005 bus_dmamap_unload(ring->data_dmat, data->map);
3007 error = bus_dmamap_load(ring->data_dmat, data->map, mtod(m1, void *),
3008 IWN_RBUF_SIZE, iwn_dma_map_addr, &paddr, BUS_DMA_NOWAIT);
3009 if (error != 0 && error != EFBIG) {
3010 device_printf(sc->sc_dev,
3011 "%s: bus_dmamap_load failed, error %d\n", __func__, error);
3014 /* Try to reload the old mbuf. */
3015 error = bus_dmamap_load(ring->data_dmat, data->map,
3016 mtod(data->m, void *), IWN_RBUF_SIZE, iwn_dma_map_addr,
3017 &paddr, BUS_DMA_NOWAIT);
3018 if (error != 0 && error != EFBIG) {
3019 panic("%s: could not load old RX mbuf", __func__);
3021 /* Physical address may have changed. */
3022 ring->desc[ring->cur] = htole32(paddr >> 8);
3023 bus_dmamap_sync(ring->data_dmat, ring->desc_dma.map,
3024 BUS_DMASYNC_PREWRITE);
3025 IFNET_STAT_INC(ifp, ierrors, 1);
3031 /* Update RX descriptor. */
3032 ring->desc[ring->cur] = htole32(paddr >> 8);
3033 bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
3034 BUS_DMASYNC_PREWRITE);
3036 /* Finalize mbuf. */
3037 m->m_pkthdr.rcvif = ifp;
3039 m->m_pkthdr.len = m->m_len = len;
3041 /* Grab a reference to the source node. */
3042 wh = mtod(m, struct ieee80211_frame *);
3043 ni = ieee80211_find_rxnode(ic, (struct ieee80211_frame_min *)wh);
3044 nf = (ni != NULL && ni->ni_vap->iv_state == IEEE80211_S_RUN &&
3045 (ic->ic_flags & IEEE80211_F_SCAN) == 0) ? sc->noise : -95;
3047 rssi = ops->get_rssi(sc, stat);
3049 if (ieee80211_radiotap_active(ic)) {
3050 struct iwn_rx_radiotap_header *tap = &sc->sc_rxtap;
3053 if (stat->flags & htole16(IWN_STAT_FLAG_SHPREAMBLE))
3054 tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
3055 tap->wr_dbm_antsignal = (int8_t)rssi;
3056 tap->wr_dbm_antnoise = (int8_t)nf;
3057 tap->wr_tsft = stat->tstamp;
3058 switch (stat->rate) {
3060 case 10: tap->wr_rate = 2; break;
3061 case 20: tap->wr_rate = 4; break;
3062 case 55: tap->wr_rate = 11; break;
3063 case 110: tap->wr_rate = 22; break;
3065 case 0xd: tap->wr_rate = 12; break;
3066 case 0xf: tap->wr_rate = 18; break;
3067 case 0x5: tap->wr_rate = 24; break;
3068 case 0x7: tap->wr_rate = 36; break;
3069 case 0x9: tap->wr_rate = 48; break;
3070 case 0xb: tap->wr_rate = 72; break;
3071 case 0x1: tap->wr_rate = 96; break;
3072 case 0x3: tap->wr_rate = 108; break;
3073 /* Unknown rate: should not happen. */
3074 default: tap->wr_rate = 0;
3078 /* Send the frame to the 802.11 layer. */
3080 if (ni->ni_flags & IEEE80211_NODE_HT)
3081 m->m_flags |= M_AMPDU;
3082 (void)ieee80211_input(ni, m, rssi - nf, nf);
3083 /* Node is no longer needed. */
3084 ieee80211_free_node(ni);
3086 (void)ieee80211_input_all(ic, m, rssi - nf, nf);
3089 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
3093 /* Process an incoming Compressed BlockAck. */
3095 iwn_rx_compressed_ba(struct iwn_softc *sc, struct iwn_rx_desc *desc,
3096 struct iwn_rx_data *data)
3098 struct iwn_ops *ops = &sc->ops;
3099 struct ifnet *ifp = sc->sc_ifp;
3100 struct iwn_node *wn;
3101 struct ieee80211_node *ni;
3102 struct iwn_compressed_ba *ba = (struct iwn_compressed_ba *)(desc + 1);
3103 struct iwn_tx_ring *txq;
3104 struct iwn_tx_data *txdata;
3105 struct ieee80211_tx_ampdu *tap;
3110 int ackfailcnt = 0, i, lastidx, qid, *res, shift;
3112 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
3114 bus_dmamap_sync(sc->rxq.data_dmat, data->map, BUS_DMASYNC_POSTREAD);
3116 qid = le16toh(ba->qid);
3117 txq = &sc->txq[ba->qid];
3118 tap = sc->qid2tap[ba->qid];
3120 wn = (void *)tap->txa_ni;
3124 if (!IEEE80211_AMPDU_RUNNING(tap)) {
3125 res = tap->txa_private;
3126 ssn = tap->txa_start & 0xfff;
3129 for (lastidx = le16toh(ba->ssn) & 0xff; txq->read != lastidx;) {
3130 txdata = &txq->data[txq->read];
3132 /* Unmap and free mbuf. */
3133 bus_dmamap_sync(txq->data_dmat, txdata->map,
3134 BUS_DMASYNC_POSTWRITE);
3135 bus_dmamap_unload(txq->data_dmat, txdata->map);
3136 m = txdata->m, txdata->m = NULL;
3137 ni = txdata->ni, txdata->ni = NULL;
3139 KASSERT(ni != NULL, ("no node"));
3140 KASSERT(m != NULL, ("no mbuf"));
3142 ieee80211_tx_complete(ni, m, 1);
3145 txq->read = (txq->read + 1) % IWN_TX_RING_COUNT;
3148 if (txq->queued == 0 && res != NULL) {
3150 ops->ampdu_tx_stop(sc, qid, tid, ssn);
3152 sc->qid2tap[qid] = NULL;
3153 kfree(res, M_DEVBUF);
3157 if (wn->agg[tid].bitmap == 0)
3160 shift = wn->agg[tid].startidx - ((le16toh(ba->seq) >> 4) & 0xff);
3164 if (wn->agg[tid].nframes > (64 - shift))
3168 bitmap = (le64toh(ba->bitmap) >> shift) & wn->agg[tid].bitmap;
3169 for (i = 0; bitmap; i++) {
3170 if ((bitmap & 1) == 0) {
3171 IFNET_STAT_INC(ifp, oerrors, 1);
3172 ieee80211_ratectl_tx_complete(ni->ni_vap, ni,
3173 IEEE80211_RATECTL_TX_FAILURE, &ackfailcnt, NULL);
3175 IFNET_STAT_INC(ifp, opackets, 1);
3176 ieee80211_ratectl_tx_complete(ni->ni_vap, ni,
3177 IEEE80211_RATECTL_TX_SUCCESS, &ackfailcnt, NULL);
3182 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
3187 * Process a CALIBRATION_RESULT notification sent by the initialization
3188 * firmware on response to a CMD_CALIB_CONFIG command (5000 only).
3191 iwn5000_rx_calib_results(struct iwn_softc *sc, struct iwn_rx_desc *desc,
3192 struct iwn_rx_data *data)
3194 struct iwn_phy_calib *calib = (struct iwn_phy_calib *)(desc + 1);
3197 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
3199 /* Runtime firmware should not send such a notification. */
3200 if (sc->sc_flags & IWN_FLAG_CALIB_DONE){
3201 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s received after clib done\n",
3205 len = (le32toh(desc->len) & 0x3fff) - 4;
3206 bus_dmamap_sync(sc->rxq.data_dmat, data->map, BUS_DMASYNC_POSTREAD);
3208 switch (calib->code) {
3209 case IWN5000_PHY_CALIB_DC:
3210 if (sc->base_params->calib_need & IWN_FLG_NEED_PHY_CALIB_DC)
3213 case IWN5000_PHY_CALIB_LO:
3214 if (sc->base_params->calib_need & IWN_FLG_NEED_PHY_CALIB_LO)
3217 case IWN5000_PHY_CALIB_TX_IQ:
3218 if (sc->base_params->calib_need & IWN_FLG_NEED_PHY_CALIB_TX_IQ)
3221 case IWN5000_PHY_CALIB_TX_IQ_PERIODIC:
3222 if (sc->base_params->calib_need & IWN_FLG_NEED_PHY_CALIB_TX_IQ_PERIODIC)
3225 case IWN5000_PHY_CALIB_BASE_BAND:
3226 if (sc->base_params->calib_need & IWN_FLG_NEED_PHY_CALIB_BASE_BAND)
3230 if (idx == -1) /* Ignore other results. */
3233 /* Save calibration result. */
3234 if (sc->calibcmd[idx].buf != NULL)
3235 kfree(sc->calibcmd[idx].buf, M_DEVBUF);
3236 sc->calibcmd[idx].buf = kmalloc(len, M_DEVBUF, M_INTWAIT);
3237 DPRINTF(sc, IWN_DEBUG_CALIBRATE,
3238 "saving calibration result idx=%d, code=%d len=%d\n", idx, calib->code, len);
3239 sc->calibcmd[idx].len = len;
3240 memcpy(sc->calibcmd[idx].buf, calib, len);
3244 iwn_stats_update(struct iwn_softc *sc, struct iwn_calib_state *calib,
3245 struct iwn_stats *stats, int len)
3247 struct iwn_stats_bt *stats_bt;
3248 struct iwn_stats *lstats;
3251 * First - check whether the length is the bluetooth or normal.
3253 * If it's normal - just copy it and bump out.
3254 * Otherwise we have to convert things.
3257 if (len == sizeof(struct iwn_stats) + 4) {
3258 memcpy(&sc->last_stat, stats, sizeof(struct iwn_stats));
3259 sc->last_stat_valid = 1;
3264 * If it's not the bluetooth size - log, then just copy.
3266 if (len != sizeof(struct iwn_stats_bt) + 4) {
3267 DPRINTF(sc, IWN_DEBUG_STATS,
3268 "%s: size of rx statistics (%d) not an expected size!\n",
3271 memcpy(&sc->last_stat, stats, sizeof(struct iwn_stats));
3272 sc->last_stat_valid = 1;
3279 stats_bt = (struct iwn_stats_bt *) stats;
3280 lstats = &sc->last_stat;
3283 lstats->flags = stats_bt->flags;
3285 memcpy(&lstats->rx.ofdm, &stats_bt->rx_bt.ofdm,
3286 sizeof(struct iwn_rx_phy_stats));
3287 memcpy(&lstats->rx.cck, &stats_bt->rx_bt.cck,
3288 sizeof(struct iwn_rx_phy_stats));
3289 memcpy(&lstats->rx.general, &stats_bt->rx_bt.general_bt.common,
3290 sizeof(struct iwn_rx_general_stats));
3291 memcpy(&lstats->rx.ht, &stats_bt->rx_bt.ht,
3292 sizeof(struct iwn_rx_ht_phy_stats));
3294 memcpy(&lstats->tx, &stats_bt->tx,
3295 sizeof(struct iwn_tx_stats));
3297 memcpy(&lstats->general, &stats_bt->general,
3298 sizeof(struct iwn_general_stats));
3300 /* XXX TODO: Squirrel away the extra bluetooth stats somewhere */
3301 sc->last_stat_valid = 1;
3305 * Process an RX_STATISTICS or BEACON_STATISTICS firmware notification.
3306 * The latter is sent by the firmware after each received beacon.
3309 iwn_rx_statistics(struct iwn_softc *sc, struct iwn_rx_desc *desc,
3310 struct iwn_rx_data *data)
3312 struct iwn_ops *ops = &sc->ops;
3313 struct ifnet *ifp = sc->sc_ifp;
3314 struct ieee80211com *ic = ifp->if_l2com;
3315 struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3316 struct iwn_calib_state *calib = &sc->calib;
3317 struct iwn_stats *stats = (struct iwn_stats *)(desc + 1);
3318 struct iwn_stats *lstats;
3321 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
3323 /* Ignore statistics received during a scan. */
3324 if (vap->iv_state != IEEE80211_S_RUN ||
3325 (ic->ic_flags & IEEE80211_F_SCAN)){
3326 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s received during calib\n",
3331 bus_dmamap_sync(sc->rxq.data_dmat, data->map, BUS_DMASYNC_POSTREAD);
3333 DPRINTF(sc, IWN_DEBUG_CALIBRATE | IWN_DEBUG_STATS,
3334 "%s: received statistics, cmd %d, len %d\n",
3335 __func__, desc->type, le16toh(desc->len));
3336 sc->calib_cnt = 0; /* Reset TX power calibration timeout. */
3339 * Collect/track general statistics for reporting.
3341 * This takes care of ensuring that the bluetooth sized message
3342 * will be correctly converted to the legacy sized message.
3344 iwn_stats_update(sc, calib, stats, le16toh(desc->len));
3347 * And now, let's take a reference of it to use!
3349 lstats = &sc->last_stat;
3351 /* Test if temperature has changed. */
3352 if (lstats->general.temp != sc->rawtemp) {
3353 /* Convert "raw" temperature to degC. */
3354 sc->rawtemp = stats->general.temp;
3355 temp = ops->get_temperature(sc);
3356 DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: temperature %d\n",
3359 /* Update TX power if need be (4965AGN only). */
3360 if (sc->hw_type == IWN_HW_REV_TYPE_4965)
3361 iwn4965_power_calibration(sc, temp);
3364 if (desc->type != IWN_BEACON_STATISTICS)
3365 return; /* Reply to a statistics request. */
3367 sc->noise = iwn_get_noise(&lstats->rx.general);
3368 DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: noise %d\n", __func__, sc->noise);
3370 /* Test that RSSI and noise are present in stats report. */
3371 if (le32toh(lstats->rx.general.flags) != 1) {
3372 DPRINTF(sc, IWN_DEBUG_ANY, "%s\n",
3373 "received statistics without RSSI");
3377 if (calib->state == IWN_CALIB_STATE_ASSOC)
3378 iwn_collect_noise(sc, &lstats->rx.general);
3379 else if (calib->state == IWN_CALIB_STATE_RUN) {
3380 iwn_tune_sensitivity(sc, &lstats->rx);
3382 * XXX TODO: Only run the RX recovery if we're associated!
3384 iwn_check_rx_recovery(sc, lstats);
3385 iwn_save_stats_counters(sc, lstats);
3388 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
3392 * Save the relevant statistic counters for the next calibration
3396 iwn_save_stats_counters(struct iwn_softc *sc, const struct iwn_stats *rs)
3398 struct iwn_calib_state *calib = &sc->calib;
3400 /* Save counters values for next call. */
3401 calib->bad_plcp_cck = le32toh(rs->rx.cck.bad_plcp);
3402 calib->fa_cck = le32toh(rs->rx.cck.fa);
3403 calib->bad_plcp_ht = le32toh(rs->rx.ht.bad_plcp);
3404 calib->bad_plcp_ofdm = le32toh(rs->rx.ofdm.bad_plcp);
3405 calib->fa_ofdm = le32toh(rs->rx.ofdm.fa);
3407 /* Last time we received these tick values */
3408 sc->last_calib_ticks = ticks;
3412 * Process a TX_DONE firmware notification. Unfortunately, the 4965AGN
3413 * and 5000 adapters have different incompatible TX status formats.
3416 iwn4965_tx_done(struct iwn_softc *sc, struct iwn_rx_desc *desc,
3417 struct iwn_rx_data *data)
3419 struct iwn4965_tx_stat *stat = (struct iwn4965_tx_stat *)(desc + 1);
3420 struct iwn_tx_ring *ring;
3423 qid = desc->qid & 0xf;
3424 ring = &sc->txq[qid];
3426 DPRINTF(sc, IWN_DEBUG_XMIT, "%s: "
3427 "qid %d idx %d retries %d nkill %d rate %x duration %d status %x\n",
3428 __func__, desc->qid, desc->idx, stat->ackfailcnt,
3429 stat->btkillcnt, stat->rate, le16toh(stat->duration),
3430 le32toh(stat->status));
3432 bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_POSTREAD);
3433 if (qid >= sc->firstaggqueue) {
3434 iwn_ampdu_tx_done(sc, qid, desc->idx, stat->nframes,
3437 iwn_tx_done(sc, desc, stat->ackfailcnt,
3438 le32toh(stat->status) & 0xff);
3443 iwn5000_tx_done(struct iwn_softc *sc, struct iwn_rx_desc *desc,
3444 struct iwn_rx_data *data)
3446 struct iwn5000_tx_stat *stat = (struct iwn5000_tx_stat *)(desc + 1);
3447 struct iwn_tx_ring *ring;
3450 qid = desc->qid & 0xf;
3451 ring = &sc->txq[qid];
3453 DPRINTF(sc, IWN_DEBUG_XMIT, "%s: "
3454 "qid %d idx %d retries %d nkill %d rate %x duration %d status %x\n",
3455 __func__, desc->qid, desc->idx, stat->ackfailcnt,
3456 stat->btkillcnt, stat->rate, le16toh(stat->duration),
3457 le32toh(stat->status));
3460 /* Reset TX scheduler slot. */
3461 iwn5000_reset_sched(sc, desc->qid & 0xf, desc->idx);
3464 bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_POSTREAD);
3465 if (qid >= sc->firstaggqueue) {
3466 iwn_ampdu_tx_done(sc, qid, desc->idx, stat->nframes,
3469 iwn_tx_done(sc, desc, stat->ackfailcnt,
3470 le16toh(stat->status) & 0xff);
3475 * Adapter-independent backend for TX_DONE firmware notifications.
3478 iwn_tx_done(struct iwn_softc *sc, struct iwn_rx_desc *desc, int ackfailcnt,
3481 struct ifnet *ifp = sc->sc_ifp;
3482 struct iwn_tx_ring *ring = &sc->txq[desc->qid & 0xf];
3483 struct iwn_tx_data *data = &ring->data[desc->idx];
3485 struct ieee80211_node *ni;
3486 struct ieee80211vap *vap;
3488 KASSERT(data->ni != NULL, ("no node"));
3490 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
3492 /* Unmap and free mbuf. */
3493 bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_POSTWRITE);
3494 bus_dmamap_unload(ring->data_dmat, data->map);
3495 m = data->m, data->m = NULL;
3496 ni = data->ni, data->ni = NULL;
3500 * Update rate control statistics for the node.
3502 if (status & IWN_TX_FAIL) {
3503 IFNET_STAT_INC(ifp, oerrors, 1);
3504 ieee80211_ratectl_tx_complete(vap, ni,
3505 IEEE80211_RATECTL_TX_FAILURE, &ackfailcnt, NULL);
3507 IFNET_STAT_INC(ifp, opackets, 1);
3508 ieee80211_ratectl_tx_complete(vap, ni,
3509 IEEE80211_RATECTL_TX_SUCCESS, &ackfailcnt, NULL);
3513 * Channels marked for "radar" require traffic to be received
3514 * to unlock before we can transmit. Until traffic is seen
3515 * any attempt to transmit is returned immediately with status
3516 * set to IWN_TX_FAIL_TX_LOCKED. Unfortunately this can easily
3517 * happen on first authenticate after scanning. To workaround
3518 * this we ignore a failure of this sort in AUTH state so the
3519 * 802.11 layer will fall back to using a timeout to wait for
3520 * the AUTH reply. This allows the firmware time to see
3521 * traffic so a subsequent retry of AUTH succeeds. It's
3522 * unclear why the firmware does not maintain state for
3523 * channels recently visited as this would allow immediate
3524 * use of the channel after a scan (where we see traffic).
3526 if (status == IWN_TX_FAIL_TX_LOCKED &&
3527 ni->ni_vap->iv_state == IEEE80211_S_AUTH)
3528 ieee80211_tx_complete(ni, m, 0);
3530 ieee80211_tx_complete(ni, m,
3531 (status & IWN_TX_FAIL) != 0);
3533 sc->sc_tx_timer = 0;
3534 if (--ring->queued < IWN_TX_RING_LOMARK) {
3535 sc->qfullmsk &= ~(1 << ring->qid);
3536 if (sc->qfullmsk == 0 && ifq_is_oactive(&ifp->if_snd)) {
3537 ifq_clr_oactive(&ifp->if_snd);
3538 iwn_start_locked(ifp);
3542 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
3547 * Process a "command done" firmware notification. This is where we wakeup
3548 * processes waiting for a synchronous command completion.
3551 iwn_cmd_done(struct iwn_softc *sc, struct iwn_rx_desc *desc)
3553 struct iwn_tx_ring *ring;
3554 struct iwn_tx_data *data;
3557 if (sc->sc_flags & IWN_FLAG_PAN_SUPPORT)
3558 cmd_queue_num = IWN_PAN_CMD_QUEUE;
3560 cmd_queue_num = IWN_CMD_QUEUE_NUM;
3562 if ((desc->qid & IWN_RX_DESC_QID_MSK) != cmd_queue_num)
3563 return; /* Not a command ack. */
3565 ring = &sc->txq[cmd_queue_num];
3566 data = &ring->data[desc->idx];
3568 /* If the command was mapped in an mbuf, free it. */
3569 if (data->m != NULL) {
3570 bus_dmamap_sync(ring->data_dmat, data->map,
3571 BUS_DMASYNC_POSTWRITE);
3572 bus_dmamap_unload(ring->data_dmat, data->map);
3576 wakeup(&ring->desc[desc->idx]);
3580 iwn_ampdu_tx_done(struct iwn_softc *sc, int qid, int idx, int nframes,
3583 struct iwn_ops *ops = &sc->ops;
3584 struct ifnet *ifp = sc->sc_ifp;
3585 struct iwn_tx_ring *ring = &sc->txq[qid];
3586 struct iwn_tx_data *data;
3588 struct iwn_node *wn;
3589 struct ieee80211_node *ni;
3590 struct ieee80211_tx_ampdu *tap;
3592 uint32_t *status = stat;
3593 uint16_t *aggstatus = stat;
3596 int bit, i, lastidx, *res, seqno, shift, start;
3598 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
3601 if ((*status & 0xff) != 1 && (*status & 0xff) != 2) {
3603 kprintf("ieee80211_send_bar()\n");
3606 * If we completely fail a transmit, make sure a
3607 * notification is pushed up to the rate control
3610 tap = sc->qid2tap[qid];
3612 wn = (void *)tap->txa_ni;
3614 ieee80211_ratectl_tx_complete(ni->ni_vap, ni,
3615 IEEE80211_RATECTL_TX_FAILURE, &nframes, NULL);
3621 for (i = 0; i < nframes; i++) {
3622 if (le16toh(aggstatus[i * 2]) & 0xc)
3625 idx = le16toh(aggstatus[2*i + 1]) & 0xff;
3629 shift = 0x100 - idx + start;
3632 } else if (bit <= -64)
3633 bit = 0x100 - start + idx;
3635 shift = start - idx;
3639 bitmap = bitmap << shift;
3640 bitmap |= 1ULL << bit;
3642 tap = sc->qid2tap[qid];
3644 wn = (void *)tap->txa_ni;
3645 wn->agg[tid].bitmap = bitmap;
3646 wn->agg[tid].startidx = start;
3647 wn->agg[tid].nframes = nframes;
3651 if (!IEEE80211_AMPDU_RUNNING(tap)) {
3652 res = tap->txa_private;
3653 ssn = tap->txa_start & 0xfff;
3656 seqno = le32toh(*(status + nframes)) & 0xfff;
3657 for (lastidx = (seqno & 0xff); ring->read != lastidx;) {
3658 data = &ring->data[ring->read];
3660 /* Unmap and free mbuf. */
3661 bus_dmamap_sync(ring->data_dmat, data->map,
3662 BUS_DMASYNC_POSTWRITE);
3663 bus_dmamap_unload(ring->data_dmat, data->map);
3664 m = data->m, data->m = NULL;
3665 ni = data->ni, data->ni = NULL;
3667 KASSERT(ni != NULL, ("no node"));
3668 KASSERT(m != NULL, ("no mbuf"));
3670 ieee80211_tx_complete(ni, m, 1);
3673 ring->read = (ring->read + 1) % IWN_TX_RING_COUNT;
3676 if (ring->queued == 0 && res != NULL) {
3678 ops->ampdu_tx_stop(sc, qid, tid, ssn);
3680 sc->qid2tap[qid] = NULL;
3681 kfree(res, M_DEVBUF);
3685 sc->sc_tx_timer = 0;
3686 if (ring->queued < IWN_TX_RING_LOMARK) {
3687 sc->qfullmsk &= ~(1 << ring->qid);
3688 if (sc->qfullmsk == 0 && ifq_is_oactive(&ifp->if_snd)) {
3689 ifq_clr_oactive(&ifp->if_snd);
3690 iwn_start_locked(ifp);
3694 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
3699 * Process an INT_FH_RX or INT_SW_RX interrupt.
3702 iwn_notif_intr(struct iwn_softc *sc)
3704 struct iwn_ops *ops = &sc->ops;
3705 struct ifnet *ifp = sc->sc_ifp;
3706 struct ieee80211com *ic = ifp->if_l2com;
3707 struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3710 bus_dmamap_sync(sc->rxq.stat_dma.tag, sc->rxq.stat_dma.map,
3711 BUS_DMASYNC_POSTREAD);
3713 hw = le16toh(sc->rxq.stat->closed_count) & 0xfff;
3714 while (sc->rxq.cur != hw) {
3715 struct iwn_rx_data *data = &sc->rxq.data[sc->rxq.cur];
3716 struct iwn_rx_desc *desc;
3718 bus_dmamap_sync(sc->rxq.data_dmat, data->map,
3719 BUS_DMASYNC_POSTREAD);
3720 desc = mtod(data->m, struct iwn_rx_desc *);
3722 DPRINTF(sc, IWN_DEBUG_RECV,
3723 "%s: cur=%d; qid %x idx %d flags %x type %d(%s) len %d\n",
3724 __func__, sc->rxq.cur, desc->qid & 0xf, desc->idx, desc->flags,
3725 desc->type, iwn_intr_str(desc->type),
3726 le16toh(desc->len));
3728 if (!(desc->qid & IWN_UNSOLICITED_RX_NOTIF)) /* Reply to a command. */
3729 iwn_cmd_done(sc, desc);
3731 switch (desc->type) {
3733 iwn_rx_phy(sc, desc, data);
3736 case IWN_RX_DONE: /* 4965AGN only. */
3737 case IWN_MPDU_RX_DONE:
3738 /* An 802.11 frame has been received. */
3739 iwn_rx_done(sc, desc, data);
3742 case IWN_RX_COMPRESSED_BA:
3743 /* A Compressed BlockAck has been received. */
3744 iwn_rx_compressed_ba(sc, desc, data);
3748 /* An 802.11 frame has been transmitted. */
3749 ops->tx_done(sc, desc, data);
3752 case IWN_RX_STATISTICS:
3753 case IWN_BEACON_STATISTICS:
3754 iwn_rx_statistics(sc, desc, data);
3757 case IWN_BEACON_MISSED:
3759 struct iwn_beacon_missed *miss =
3760 (struct iwn_beacon_missed *)(desc + 1);
3763 bus_dmamap_sync(sc->rxq.data_dmat, data->map,
3764 BUS_DMASYNC_POSTREAD);
3765 misses = le32toh(miss->consecutive);
3767 DPRINTF(sc, IWN_DEBUG_STATE,
3768 "%s: beacons missed %d/%d\n", __func__,
3769 misses, le32toh(miss->total));
3771 * If more than 5 consecutive beacons are missed,
3772 * reinitialize the sensitivity state machine.
3774 if (vap->iv_state == IEEE80211_S_RUN &&
3775 (ic->ic_flags & IEEE80211_F_SCAN) == 0) {
3777 (void)iwn_init_sensitivity(sc);
3778 if (misses >= vap->iv_bmissthreshold) {
3779 ieee80211_beacon_miss(ic);
3786 struct iwn_ucode_info *uc =
3787 (struct iwn_ucode_info *)(desc + 1);
3789 /* The microcontroller is ready. */
3790 bus_dmamap_sync(sc->rxq.data_dmat, data->map,
3791 BUS_DMASYNC_POSTREAD);
3792 DPRINTF(sc, IWN_DEBUG_RESET,
3793 "microcode alive notification version=%d.%d "
3794 "subtype=%x alive=%x\n", uc->major, uc->minor,
3795 uc->subtype, le32toh(uc->valid));
3797 if (le32toh(uc->valid) != 1) {
3798 device_printf(sc->sc_dev,
3799 "microcontroller initialization failed");
3802 if (uc->subtype == IWN_UCODE_INIT) {
3803 /* Save microcontroller report. */
3804 memcpy(&sc->ucode_info, uc, sizeof (*uc));
3806 /* Save the address of the error log in SRAM. */
3807 sc->errptr = le32toh(uc->errptr);
3810 case IWN_STATE_CHANGED:
3813 * State change allows hardware switch change to be
3814 * noted. However, we handle this in iwn_intr as we
3815 * get both the enable/disble intr.
3817 bus_dmamap_sync(sc->rxq.data_dmat, data->map,
3818 BUS_DMASYNC_POSTREAD);
3820 uint32_t *status = (uint32_t *)(desc + 1);
3821 DPRINTF(sc, IWN_DEBUG_INTR | IWN_DEBUG_STATE,
3822 "state changed to %x\n",
3827 case IWN_START_SCAN:
3829 bus_dmamap_sync(sc->rxq.data_dmat, data->map,
3830 BUS_DMASYNC_POSTREAD);
3832 struct iwn_start_scan *scan =
3833 (struct iwn_start_scan *)(desc + 1);
3834 DPRINTF(sc, IWN_DEBUG_ANY,
3835 "%s: scanning channel %d status %x\n",
3836 __func__, scan->chan, le32toh(scan->status));
3842 bus_dmamap_sync(sc->rxq.data_dmat, data->map,
3843 BUS_DMASYNC_POSTREAD);
3845 struct iwn_stop_scan *scan =
3846 (struct iwn_stop_scan *)(desc + 1);
3847 DPRINTF(sc, IWN_DEBUG_STATE | IWN_DEBUG_SCAN,
3848 "scan finished nchan=%d status=%d chan=%d\n",
3849 scan->nchan, scan->status, scan->chan);
3851 sc->sc_is_scanning = 0;
3852 ieee80211_scan_next(vap);
3855 case IWN5000_CALIBRATION_RESULT:
3856 iwn5000_rx_calib_results(sc, desc, data);
3859 case IWN5000_CALIBRATION_DONE:
3860 sc->sc_flags |= IWN_FLAG_CALIB_DONE;
3865 sc->rxq.cur = (sc->rxq.cur + 1) % IWN_RX_RING_COUNT;
3868 /* Tell the firmware what we have processed. */
3869 hw = (hw == 0) ? IWN_RX_RING_COUNT - 1 : hw - 1;
3870 IWN_WRITE(sc, IWN_FH_RX_WPTR, hw & ~7);
3874 * Process an INT_WAKEUP interrupt raised when the microcontroller wakes up
3875 * from power-down sleep mode.
3878 iwn_wakeup_intr(struct iwn_softc *sc)
3882 DPRINTF(sc, IWN_DEBUG_RESET, "%s: ucode wakeup from power-down sleep\n",
3885 /* Wakeup RX and TX rings. */
3886 IWN_WRITE(sc, IWN_FH_RX_WPTR, sc->rxq.cur & ~7);
3887 for (qid = 0; qid < sc->ntxqs; qid++) {
3888 struct iwn_tx_ring *ring = &sc->txq[qid];
3889 IWN_WRITE(sc, IWN_HBUS_TARG_WRPTR, qid << 8 | ring->cur);
3894 iwn_rftoggle_intr(struct iwn_softc *sc)
3896 struct ifnet *ifp = sc->sc_ifp;
3897 struct ieee80211com *ic = ifp->if_l2com;
3898 uint32_t tmp = IWN_READ(sc, IWN_GP_CNTRL);
3900 device_printf(sc->sc_dev, "RF switch: radio %s\n",
3901 (tmp & IWN_GP_CNTRL_RFKILL) ? "enabled" : "disabled");
3902 if (tmp & IWN_GP_CNTRL_RFKILL)
3903 ieee80211_runtask(ic, &sc->sc_radioon_task);
3905 ieee80211_runtask(ic, &sc->sc_radiooff_task);
3909 * Dump the error log of the firmware when a firmware panic occurs. Although
3910 * we can't debug the firmware because it is neither open source nor free, it
3911 * can help us to identify certain classes of problems.
3914 iwn_fatal_intr(struct iwn_softc *sc)
3916 struct iwn_fw_dump dump;
3919 /* Force a complete recalibration on next init. */
3920 sc->sc_flags &= ~IWN_FLAG_CALIB_DONE;
3922 /* Check that the error log address is valid. */
3923 if (sc->errptr < IWN_FW_DATA_BASE ||
3924 sc->errptr + sizeof (dump) >
3925 IWN_FW_DATA_BASE + sc->fw_data_maxsz) {
3926 kprintf("%s: bad firmware error log address 0x%08x\n", __func__,
3930 if (iwn_nic_lock(sc) != 0) {
3931 kprintf("%s: could not read firmware error log\n", __func__);
3934 /* Read firmware error log from SRAM. */
3935 iwn_mem_read_region_4(sc, sc->errptr, (uint32_t *)&dump,
3936 sizeof (dump) / sizeof (uint32_t));
3939 if (dump.valid == 0) {
3940 kprintf("%s: firmware error log is empty\n", __func__);
3943 kprintf("firmware error log:\n");
3944 kprintf(" error type = \"%s\" (0x%08X)\n",
3945 (dump.id < nitems(iwn_fw_errmsg)) ?
3946 iwn_fw_errmsg[dump.id] : "UNKNOWN",
3948 kprintf(" program counter = 0x%08X\n", dump.pc);
3949 kprintf(" source line = 0x%08X\n", dump.src_line);
3950 kprintf(" error data = 0x%08X%08X\n",
3951 dump.error_data[0], dump.error_data[1]);
3952 kprintf(" branch link = 0x%08X%08X\n",
3953 dump.branch_link[0], dump.branch_link[1]);
3954 kprintf(" interrupt link = 0x%08X%08X\n",
3955 dump.interrupt_link[0], dump.interrupt_link[1]);
3956 kprintf(" time = %u\n", dump.time[0]);
3958 /* Dump driver status (TX and RX rings) while we're here. */
3959 kprintf("driver status:\n");
3960 for (i = 0; i < sc->ntxqs; i++) {
3961 struct iwn_tx_ring *ring = &sc->txq[i];
3962 kprintf(" tx ring %2d: qid=%-2d cur=%-3d queued=%-3d\n",
3963 i, ring->qid, ring->cur, ring->queued);
3965 kprintf(" rx ring: cur=%d\n", sc->rxq.cur);
3971 struct iwn_softc *sc = arg;
3972 struct ifnet *ifp = sc->sc_ifp;
3973 uint32_t r1, r2, tmp;
3975 /* Disable interrupts. */
3976 IWN_WRITE(sc, IWN_INT_MASK, 0);
3978 /* Read interrupts from ICT (fast) or from registers (slow). */
3979 if (sc->sc_flags & IWN_FLAG_USE_ICT) {
3981 while (sc->ict[sc->ict_cur] != 0) {
3982 tmp |= sc->ict[sc->ict_cur];
3983 sc->ict[sc->ict_cur] = 0; /* Acknowledge. */
3984 sc->ict_cur = (sc->ict_cur + 1) % IWN_ICT_COUNT;
3987 if (tmp == 0xffffffff) /* Shouldn't happen. */
3989 else if (tmp & 0xc0000) /* Workaround a HW bug. */
3991 r1 = (tmp & 0xff00) << 16 | (tmp & 0xff);
3992 r2 = 0; /* Unused. */
3994 r1 = IWN_READ(sc, IWN_INT);
3995 if (r1 == 0xffffffff || (r1 & 0xfffffff0) == 0xa5a5a5a0)
3996 return; /* Hardware gone! */
3997 r2 = IWN_READ(sc, IWN_FH_INT);
4000 DPRINTF(sc, IWN_DEBUG_INTR, "interrupt reg1=0x%08x reg2=0x%08x\n"
4003 if (r1 == 0 && r2 == 0)
4004 goto done; /* Interrupt not for us. */
4006 /* Acknowledge interrupts. */
4007 IWN_WRITE(sc, IWN_INT, r1);
4008 if (!(sc->sc_flags & IWN_FLAG_USE_ICT))
4009 IWN_WRITE(sc, IWN_FH_INT, r2);
4011 if (r1 & IWN_INT_RF_TOGGLED) {
4012 iwn_rftoggle_intr(sc);
4015 if (r1 & IWN_INT_CT_REACHED) {
4016 device_printf(sc->sc_dev, "%s: critical temperature reached!\n",
4019 if (r1 & (IWN_INT_SW_ERR | IWN_INT_HW_ERR)) {
4020 device_printf(sc->sc_dev, "%s: fatal firmware error\n",
4023 iwn_debug_register(sc);
4025 /* Dump firmware error log and stop. */
4028 taskqueue_enqueue(sc->sc_tq, &sc->sc_panic_task);
4031 if ((r1 & (IWN_INT_FH_RX | IWN_INT_SW_RX | IWN_INT_RX_PERIODIC)) ||
4032 (r2 & IWN_FH_INT_RX)) {
4033 if (sc->sc_flags & IWN_FLAG_USE_ICT) {
4034 if (r1 & (IWN_INT_FH_RX | IWN_INT_SW_RX))
4035 IWN_WRITE(sc, IWN_FH_INT, IWN_FH_INT_RX);
4036 IWN_WRITE_1(sc, IWN_INT_PERIODIC,
4037 IWN_INT_PERIODIC_DIS);
4039 if (r1 & (IWN_INT_FH_RX | IWN_INT_SW_RX)) {
4040 IWN_WRITE_1(sc, IWN_INT_PERIODIC,
4041 IWN_INT_PERIODIC_ENA);
4047 if ((r1 & IWN_INT_FH_TX) || (r2 & IWN_FH_INT_TX)) {
4048 if (sc->sc_flags & IWN_FLAG_USE_ICT)
4049 IWN_WRITE(sc, IWN_FH_INT, IWN_FH_INT_TX);
4050 wakeup(sc); /* FH DMA transfer completed. */
4053 if (r1 & IWN_INT_ALIVE)
4054 wakeup(sc); /* Firmware is alive. */
4056 if (r1 & IWN_INT_WAKEUP)
4057 iwn_wakeup_intr(sc);
4060 /* Re-enable interrupts. */
4061 if (ifp->if_flags & IFF_UP)
4062 IWN_WRITE(sc, IWN_INT_MASK, sc->int_mask);
4066 * Update TX scheduler ring when transmitting an 802.11 frame (4965AGN and
4067 * 5000 adapters use a slightly different format).
4070 iwn4965_update_sched(struct iwn_softc *sc, int qid, int idx, uint8_t id,
4073 uint16_t *w = &sc->sched[qid * IWN4965_SCHED_COUNT + idx];
4075 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
4077 *w = htole16(len + 8);
4078 bus_dmamap_sync(sc->sched_dma.tag, sc->sched_dma.map,
4079 BUS_DMASYNC_PREWRITE);
4080 if (idx < IWN_SCHED_WINSZ) {
4081 *(w + IWN_TX_RING_COUNT) = *w;
4082 bus_dmamap_sync(sc->sched_dma.tag, sc->sched_dma.map,
4083 BUS_DMASYNC_PREWRITE);
4088 iwn5000_update_sched(struct iwn_softc *sc, int qid, int idx, uint8_t id,
4091 uint16_t *w = &sc->sched[qid * IWN5000_SCHED_COUNT + idx];
4093 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
4095 *w = htole16(id << 12 | (len + 8));
4096 bus_dmamap_sync(sc->sched_dma.tag, sc->sched_dma.map,
4097 BUS_DMASYNC_PREWRITE);
4098 if (idx < IWN_SCHED_WINSZ) {
4099 *(w + IWN_TX_RING_COUNT) = *w;
4100 bus_dmamap_sync(sc->sched_dma.tag, sc->sched_dma.map,
4101 BUS_DMASYNC_PREWRITE);
4107 iwn5000_reset_sched(struct iwn_softc *sc, int qid, int idx)
4109 uint16_t *w = &sc->sched[qid * IWN5000_SCHED_COUNT + idx];
4111 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
4113 *w = (*w & htole16(0xf000)) | htole16(1);
4114 bus_dmamap_sync(sc->sched_dma.tag, sc->sched_dma.map,
4115 BUS_DMASYNC_PREWRITE);
4116 if (idx < IWN_SCHED_WINSZ) {
4117 *(w + IWN_TX_RING_COUNT) = *w;
4118 bus_dmamap_sync(sc->sched_dma.tag, sc->sched_dma.map,
4119 BUS_DMASYNC_PREWRITE);
4125 * Check whether OFDM 11g protection will be enabled for the given rate.
4127 * The original driver code only enabled protection for OFDM rates.
4128 * It didn't check to see whether it was operating in 11a or 11bg mode.
4131 iwn_check_rate_needs_protection(struct iwn_softc *sc,
4132 struct ieee80211vap *vap, uint8_t rate)
4134 struct ieee80211com *ic = vap->iv_ic;
4137 * Not in 2GHz mode? Then there's no need to enable OFDM
4140 if (! IEEE80211_IS_CHAN_2GHZ(ic->ic_curchan)) {
4145 * 11bg protection not enabled? Then don't use it.
4147 if ((ic->ic_flags & IEEE80211_F_USEPROT) == 0)
4151 * If it's an 11n rate, then for now we enable
4154 if (rate & IEEE80211_RATE_MCS) {
4159 * Do a rate table lookup. If the PHY is CCK,
4160 * don't do protection.
4162 if (ieee80211_rate2phytype(ic->ic_rt, rate) == IEEE80211_T_CCK)
4166 * Yup, enable protection.
4172 * return a value between 0 and IWN_MAX_TX_RETRIES-1 as an index into
4173 * the link quality table that reflects this particular entry.
4176 iwn_tx_rate_to_linkq_offset(struct iwn_softc *sc, struct ieee80211_node *ni,
4179 struct ieee80211_rateset *rs;
4186 * Figure out if we're using 11n or not here.
4188 if (IEEE80211_IS_CHAN_HT(ni->ni_chan) && ni->ni_htrates.rs_nrates > 0)
4194 * Use the correct rate table.
4197 rs = (struct ieee80211_rateset *) &ni->ni_htrates;
4198 nr = ni->ni_htrates.rs_nrates;
4205 * Find the relevant link quality entry in the table.
4207 for (i = 0; i < nr && i < IWN_MAX_TX_RETRIES - 1 ; i++) {
4209 * The link quality table index starts at 0 == highest
4210 * rate, so we walk the rate table backwards.
4212 cmp_rate = rs->rs_rates[(nr - 1) - i];
4213 if (rate & IEEE80211_RATE_MCS)
4214 cmp_rate |= IEEE80211_RATE_MCS;
4217 DPRINTF(sc, IWN_DEBUG_XMIT, "%s: idx %d: nr=%d, rate=0x%02x, rateentry=0x%02x\n",
4225 if (cmp_rate == rate)
4229 /* Failed? Start at the end */
4230 return (IWN_MAX_TX_RETRIES - 1);
4234 iwn_tx_data(struct iwn_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
4236 struct iwn_ops *ops = &sc->ops;
4237 const struct ieee80211_txparam *tp;
4238 struct ieee80211vap *vap = ni->ni_vap;
4239 struct ieee80211com *ic = ni->ni_ic;
4240 struct iwn_node *wn = (void *)ni;
4241 struct iwn_tx_ring *ring;
4242 struct iwn_tx_desc *desc;
4243 struct iwn_tx_data *data;
4244 struct iwn_tx_cmd *cmd;
4245 struct iwn_cmd_data *tx;
4246 struct ieee80211_frame *wh;
4247 struct ieee80211_key *k = NULL;
4252 bus_dma_segment_t *seg, segs[IWN_MAX_SCATTER];
4254 int ac, i, totlen, error, pad, nsegs = 0, rate;
4256 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
4258 wh = mtod(m, struct ieee80211_frame *);
4259 hdrlen = ieee80211_anyhdrsize(wh);
4260 type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
4262 /* Select EDCA Access Category and TX ring for this frame. */
4263 if (IEEE80211_QOS_HAS_SEQ(wh)) {
4264 qos = ((const struct ieee80211_qosframe *)wh)->i_qos[0];
4265 tid = qos & IEEE80211_QOS_TID;
4270 ac = M_WME_GETAC(m);
4271 if (m->m_flags & M_AMPDU_MPDU) {
4273 struct ieee80211_tx_ampdu *tap = &ni->ni_tx_ampdu[ac];
4275 if (!IEEE80211_AMPDU_RUNNING(tap)) {
4281 * Queue this frame to the hardware ring that we've
4282 * negotiated AMPDU TX on.
4284 * Note that the sequence number must match the TX slot
4287 ac = *(int *)tap->txa_private;
4288 seqno = ni->ni_txseqs[tid];
4289 *(uint16_t *)wh->i_seq =
4290 htole16(seqno << IEEE80211_SEQ_SEQ_SHIFT);
4291 ring = &sc->txq[ac];
4292 if ((seqno % 256) != ring->cur) {
4293 device_printf(sc->sc_dev,
4294 "%s: m=%p: seqno (%d) (%d) != ring index (%d) !\n",
4301 ni->ni_txseqs[tid]++;
4303 ring = &sc->txq[ac];
4304 desc = &ring->desc[ring->cur];
4305 data = &ring->data[ring->cur];
4307 /* Choose a TX rate index. */
4308 tp = &vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)];
4309 if (type == IEEE80211_FC0_TYPE_MGT)
4310 rate = tp->mgmtrate;
4311 else if (IEEE80211_IS_MULTICAST(wh->i_addr1))
4312 rate = tp->mcastrate;
4313 else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
4314 rate = tp->ucastrate;
4315 else if (m->m_flags & M_EAPOL)
4316 rate = tp->mgmtrate;
4318 /* XXX pass pktlen */
4319 (void) ieee80211_ratectl_rate(ni, NULL, 0);
4320 rate = ni->ni_txrate;
4323 /* Encrypt the frame if need be. */
4324 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
4325 /* Retrieve key for TX. */
4326 k = ieee80211_crypto_encap(ni, m);
4331 /* 802.11 header may have moved. */
4332 wh = mtod(m, struct ieee80211_frame *);
4334 totlen = m->m_pkthdr.len;
4336 if (ieee80211_radiotap_active_vap(vap)) {
4337 struct iwn_tx_radiotap_header *tap = &sc->sc_txtap;
4340 tap->wt_rate = rate;
4342 tap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
4344 ieee80211_radiotap_tx(vap, m);
4347 /* Prepare TX firmware command. */
4348 cmd = &ring->cmd[ring->cur];
4349 cmd->code = IWN_CMD_TX_DATA;
4351 cmd->qid = ring->qid;
4352 cmd->idx = ring->cur;
4354 tx = (struct iwn_cmd_data *)cmd->data;
4355 /* NB: No need to clear tx, all fields are reinitialized here. */
4356 tx->scratch = 0; /* clear "scratch" area */
4359 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
4360 /* Unicast frame, check if an ACK is expected. */
4361 if (!qos || (qos & IEEE80211_QOS_ACKPOLICY) !=
4362 IEEE80211_QOS_ACKPOLICY_NOACK)
4363 flags |= IWN_TX_NEED_ACK;
4366 (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
4367 (IEEE80211_FC0_TYPE_CTL | IEEE80211_FC0_SUBTYPE_BAR))
4368 flags |= IWN_TX_IMM_BA; /* Cannot happen yet. */
4370 if (wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG)
4371 flags |= IWN_TX_MORE_FRAG; /* Cannot happen yet. */
4373 /* Check if frame must be protected using RTS/CTS or CTS-to-self. */
4374 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
4375 /* NB: Group frames are sent using CCK in 802.11b/g. */
4376 if (totlen + IEEE80211_CRC_LEN > vap->iv_rtsthreshold) {
4377 flags |= IWN_TX_NEED_RTS;
4378 } else if (iwn_check_rate_needs_protection(sc, vap, rate)) {
4379 if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
4380 flags |= IWN_TX_NEED_CTS;
4381 else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
4382 flags |= IWN_TX_NEED_RTS;
4385 /* XXX HT protection? */
4387 if (flags & (IWN_TX_NEED_RTS | IWN_TX_NEED_CTS)) {
4388 if (sc->hw_type != IWN_HW_REV_TYPE_4965) {
4389 /* 5000 autoselects RTS/CTS or CTS-to-self. */
4390 flags &= ~(IWN_TX_NEED_RTS | IWN_TX_NEED_CTS);
4391 flags |= IWN_TX_NEED_PROTECTION;
4393 flags |= IWN_TX_FULL_TXOP;
4397 if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
4398 type != IEEE80211_FC0_TYPE_DATA)
4399 tx->id = sc->broadcast_id;
4403 if (type == IEEE80211_FC0_TYPE_MGT) {
4404 uint8_t subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
4406 /* Tell HW to set timestamp in probe responses. */
4407 if (subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
4408 flags |= IWN_TX_INSERT_TSTAMP;
4409 if (subtype == IEEE80211_FC0_SUBTYPE_ASSOC_REQ ||
4410 subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ)
4411 tx->timeout = htole16(3);
4413 tx->timeout = htole16(2);
4415 tx->timeout = htole16(0);
4418 /* First segment length must be a multiple of 4. */
4419 flags |= IWN_TX_NEED_PADDING;
4420 pad = 4 - (hdrlen & 3);
4424 tx->len = htole16(totlen);
4426 tx->rts_ntries = 60;
4427 tx->data_ntries = 15;
4428 tx->lifetime = htole32(IWN_LIFETIME_INFINITE);
4429 tx->rate = iwn_rate_to_plcp(sc, ni, rate);
4430 if (tx->id == sc->broadcast_id) {
4431 /* Group or management frame. */
4434 tx->linkq = iwn_tx_rate_to_linkq_offset(sc, ni, rate);
4435 flags |= IWN_TX_LINKQ; /* enable MRR */
4438 /* Set physical address of "scratch area". */
4439 tx->loaddr = htole32(IWN_LOADDR(data->scratch_paddr));
4440 tx->hiaddr = IWN_HIADDR(data->scratch_paddr);
4442 /* Copy 802.11 header in TX command. */
4443 memcpy((uint8_t *)(tx + 1), wh, hdrlen);
4445 /* Trim 802.11 header. */
4448 tx->flags = htole32(flags);
4450 error = bus_dmamap_load_mbuf_segment(ring->data_dmat, data->map,
4451 m, segs, IWN_MAX_SCATTER - 1,
4452 &nsegs, BUS_DMA_NOWAIT);
4454 if (error != EFBIG) {
4455 device_printf(sc->sc_dev,
4456 "%s: can't map mbuf (error %d)\n", __func__, error);
4460 /* Too many DMA segments, linearize mbuf. */
4461 m1 = m_defrag(m, MB_DONTWAIT);
4463 device_printf(sc->sc_dev,
4464 "%s: could not defrag mbuf\n", __func__);
4470 error = bus_dmamap_load_mbuf_segment(ring->data_dmat,
4472 IWN_MAX_SCATTER - 1,
4473 &nsegs, BUS_DMA_NOWAIT);
4475 device_printf(sc->sc_dev,
4476 "%s: can't map mbuf (error %d)\n", __func__, error);
4485 DPRINTF(sc, IWN_DEBUG_XMIT,
4486 "%s: qid %d idx %d len %d nsegs %d rate %04x plcp 0x%08x\n",
4495 /* Fill TX descriptor. */
4498 desc->nsegs += nsegs;
4499 /* First DMA segment is used by the TX command. */
4500 desc->segs[0].addr = htole32(IWN_LOADDR(data->cmd_paddr));
4501 desc->segs[0].len = htole16(IWN_HIADDR(data->cmd_paddr) |
4502 (4 + sizeof (*tx) + hdrlen + pad) << 4);
4503 /* Other DMA segments are for data payload. */
4505 for (i = 1; i <= nsegs; i++) {
4506 desc->segs[i].addr = htole32(IWN_LOADDR(seg->ds_addr));
4507 desc->segs[i].len = htole16(IWN_HIADDR(seg->ds_addr) |
4512 bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_PREWRITE);
4513 bus_dmamap_sync(ring->data_dmat, ring->cmd_dma.map,
4514 BUS_DMASYNC_PREWRITE);
4515 bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
4516 BUS_DMASYNC_PREWRITE);
4518 /* Update TX scheduler. */
4519 if (ring->qid >= sc->firstaggqueue)
4520 ops->update_sched(sc, ring->qid, ring->cur, tx->id, totlen);
4523 ring->cur = (ring->cur + 1) % IWN_TX_RING_COUNT;
4524 IWN_WRITE(sc, IWN_HBUS_TARG_WRPTR, ring->qid << 8 | ring->cur);
4526 /* Mark TX ring as full if we reach a certain threshold. */
4527 if (++ring->queued > IWN_TX_RING_HIMARK)
4528 sc->qfullmsk |= 1 << ring->qid;
4530 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
4536 iwn_tx_data_raw(struct iwn_softc *sc, struct mbuf *m,
4537 struct ieee80211_node *ni, const struct ieee80211_bpf_params *params)
4539 struct iwn_ops *ops = &sc->ops;
4540 // struct ifnet *ifp = sc->sc_ifp;
4541 struct ieee80211vap *vap = ni->ni_vap;
4542 // struct ieee80211com *ic = ifp->if_l2com;
4543 struct iwn_tx_cmd *cmd;
4544 struct iwn_cmd_data *tx;
4545 struct ieee80211_frame *wh;
4546 struct iwn_tx_ring *ring;
4547 struct iwn_tx_desc *desc;
4548 struct iwn_tx_data *data;
4550 bus_dma_segment_t *seg, segs[IWN_MAX_SCATTER];
4553 int ac, totlen, error, pad, nsegs = 0, i, rate;
4556 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
4558 wh = mtod(m, struct ieee80211_frame *);
4559 hdrlen = ieee80211_anyhdrsize(wh);
4560 type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
4562 ac = params->ibp_pri & 3;
4564 ring = &sc->txq[ac];
4565 desc = &ring->desc[ring->cur];
4566 data = &ring->data[ring->cur];
4568 /* Choose a TX rate. */
4569 rate = params->ibp_rate0;
4570 totlen = m->m_pkthdr.len;
4572 /* Prepare TX firmware command. */
4573 cmd = &ring->cmd[ring->cur];
4574 cmd->code = IWN_CMD_TX_DATA;
4576 cmd->qid = ring->qid;
4577 cmd->idx = ring->cur;
4579 tx = (struct iwn_cmd_data *)cmd->data;
4580 /* NB: No need to clear tx, all fields are reinitialized here. */
4581 tx->scratch = 0; /* clear "scratch" area */
4584 if ((params->ibp_flags & IEEE80211_BPF_NOACK) == 0)
4585 flags |= IWN_TX_NEED_ACK;
4586 if (params->ibp_flags & IEEE80211_BPF_RTS) {
4587 if (sc->hw_type != IWN_HW_REV_TYPE_4965) {
4588 /* 5000 autoselects RTS/CTS or CTS-to-self. */
4589 flags &= ~IWN_TX_NEED_RTS;
4590 flags |= IWN_TX_NEED_PROTECTION;
4592 flags |= IWN_TX_NEED_RTS | IWN_TX_FULL_TXOP;
4594 if (params->ibp_flags & IEEE80211_BPF_CTS) {
4595 if (sc->hw_type != IWN_HW_REV_TYPE_4965) {
4596 /* 5000 autoselects RTS/CTS or CTS-to-self. */
4597 flags &= ~IWN_TX_NEED_CTS;
4598 flags |= IWN_TX_NEED_PROTECTION;
4600 flags |= IWN_TX_NEED_CTS | IWN_TX_FULL_TXOP;
4602 if (type == IEEE80211_FC0_TYPE_MGT) {
4603 uint8_t subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
4605 /* Tell HW to set timestamp in probe responses. */
4606 if (subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
4607 flags |= IWN_TX_INSERT_TSTAMP;
4609 if (subtype == IEEE80211_FC0_SUBTYPE_ASSOC_REQ ||
4610 subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ)
4611 tx->timeout = htole16(3);
4613 tx->timeout = htole16(2);
4615 tx->timeout = htole16(0);
4618 /* First segment length must be a multiple of 4. */
4619 flags |= IWN_TX_NEED_PADDING;
4620 pad = 4 - (hdrlen & 3);
4624 if (ieee80211_radiotap_active_vap(vap)) {
4625 struct iwn_tx_radiotap_header *tap = &sc->sc_txtap;
4628 tap->wt_rate = rate;
4630 ieee80211_radiotap_tx(vap, m);
4633 tx->len = htole16(totlen);
4635 tx->id = sc->broadcast_id;
4636 tx->rts_ntries = params->ibp_try1;
4637 tx->data_ntries = params->ibp_try0;
4638 tx->lifetime = htole32(IWN_LIFETIME_INFINITE);
4639 tx->rate = iwn_rate_to_plcp(sc, ni, rate);
4641 /* Group or management frame. */
4644 /* Set physical address of "scratch area". */
4645 tx->loaddr = htole32(IWN_LOADDR(data->scratch_paddr));
4646 tx->hiaddr = IWN_HIADDR(data->scratch_paddr);
4648 /* Copy 802.11 header in TX command. */
4649 memcpy((uint8_t *)(tx + 1), wh, hdrlen);
4651 /* Trim 802.11 header. */
4654 tx->flags = htole32(flags);
4656 error = bus_dmamap_load_mbuf_segment(ring->data_dmat, data->map,
4658 IWN_MAX_SCATTER - 1,
4659 &nsegs, BUS_DMA_NOWAIT);
4661 if (error != EFBIG) {
4662 device_printf(sc->sc_dev,
4663 "%s: can't map mbuf (error %d)\n", __func__, error);
4667 /* Too many DMA segments, linearize mbuf. */
4668 m1 = m_defrag(m, M_NOWAIT);
4670 device_printf(sc->sc_dev,
4671 "%s: could not defrag mbuf\n", __func__);
4677 error = bus_dmamap_load_mbuf_segment(ring->data_dmat,
4679 IWN_MAX_SCATTER - 1,
4680 &nsegs, BUS_DMA_NOWAIT);
4682 device_printf(sc->sc_dev,
4683 "%s: can't map mbuf (error %d)\n", __func__, error);
4692 DPRINTF(sc, IWN_DEBUG_XMIT, "%s: qid %d idx %d len %d nsegs %d\n",
4693 __func__, ring->qid, ring->cur, m->m_pkthdr.len, nsegs);
4695 /* Fill TX descriptor. */
4698 desc->nsegs += nsegs;
4699 /* First DMA segment is used by the TX command. */
4700 desc->segs[0].addr = htole32(IWN_LOADDR(data->cmd_paddr));
4701 desc->segs[0].len = htole16(IWN_HIADDR(data->cmd_paddr) |
4702 (4 + sizeof (*tx) + hdrlen + pad) << 4);
4703 /* Other DMA segments are for data payload. */
4705 for (i = 1; i <= nsegs; i++) {
4706 desc->segs[i].addr = htole32(IWN_LOADDR(seg->ds_addr));
4707 desc->segs[i].len = htole16(IWN_HIADDR(seg->ds_addr) |
4712 bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_PREWRITE);
4713 bus_dmamap_sync(ring->data_dmat, ring->cmd_dma.map,
4714 BUS_DMASYNC_PREWRITE);
4715 bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
4716 BUS_DMASYNC_PREWRITE);
4718 /* Update TX scheduler. */
4719 if (ring->qid >= sc->firstaggqueue)
4720 ops->update_sched(sc, ring->qid, ring->cur, tx->id, totlen);
4723 ring->cur = (ring->cur + 1) % IWN_TX_RING_COUNT;
4724 IWN_WRITE(sc, IWN_HBUS_TARG_WRPTR, ring->qid << 8 | ring->cur);
4726 /* Mark TX ring as full if we reach a certain threshold. */
4727 if (++ring->queued > IWN_TX_RING_HIMARK)
4728 sc->qfullmsk |= 1 << ring->qid;
4730 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
4736 iwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
4737 const struct ieee80211_bpf_params *params)
4739 struct ieee80211com *ic = ni->ni_ic;
4740 struct ifnet *ifp = ic->ic_ifp;
4741 struct iwn_softc *sc = ifp->if_softc;
4744 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
4746 if ((ifp->if_flags & IFF_RUNNING) == 0) {
4747 ieee80211_free_node(ni);
4752 if (params == NULL) {
4754 * Legacy path; interpret frame contents to decide
4755 * precisely how to send the frame.
4757 error = iwn_tx_data(sc, m, ni);
4760 * Caller supplied explicit parameters to use in
4761 * sending the frame.
4763 error = iwn_tx_data_raw(sc, m, ni, params);
4766 /* NB: m is reclaimed on tx failure */
4767 ieee80211_free_node(ni);
4768 IFNET_STAT_INC(ifp, oerrors, 1);
4770 sc->sc_tx_timer = 5;
4772 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
4778 iwn_start(struct ifnet *ifp, struct ifaltq_subque *ifsq)
4780 ASSERT_ALTQ_SQ_DEFAULT(ifp, ifsq);
4781 iwn_start_locked(ifp);
4785 iwn_start_locked(struct ifnet *ifp)
4787 struct iwn_softc *sc = ifp->if_softc;
4788 struct ieee80211_node *ni;
4791 wlan_assert_serialized();
4793 if ((ifp->if_flags & IFF_RUNNING) == 0 ||
4794 ifq_is_oactive(&ifp->if_snd))
4798 if (sc->qfullmsk != 0) {
4799 ifq_set_oactive(&ifp->if_snd);
4802 m = ifq_dequeue(&ifp->if_snd);
4805 KKASSERT(M_TRAILINGSPACE(m) >= 0);
4806 ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
4807 if (iwn_tx_data(sc, m, ni) != 0) {
4808 ieee80211_free_node(ni);
4809 IFNET_STAT_INC(ifp, oerrors, 1);
4812 sc->sc_tx_timer = 5;
4817 iwn_watchdog_timeout(void *arg)
4819 struct iwn_softc *sc = arg;
4820 struct ifnet *ifp = sc->sc_ifp;
4821 struct ieee80211com *ic = ifp->if_l2com;
4823 wlan_serialize_enter();
4825 KASSERT(ifp->if_flags & IFF_RUNNING, ("not running"));
4827 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
4829 if (sc->sc_tx_timer > 0) {
4830 if (--sc->sc_tx_timer == 0) {
4831 if_printf(ifp, "device timeout\n");
4832 ieee80211_runtask(ic, &sc->sc_reinit_task);
4833 wlan_serialize_exit();
4837 callout_reset(&sc->watchdog_to, hz, iwn_watchdog_timeout, sc);
4838 wlan_serialize_exit();
4842 iwn_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *ucred)
4844 struct iwn_softc *sc = ifp->if_softc;
4845 struct ieee80211com *ic = ifp->if_l2com;
4846 struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
4847 struct ifreq *ifr = (struct ifreq *) data;
4848 int error = 0, startall = 0, stop = 0;
4850 wlan_assert_serialized();
4854 error = ether_ioctl(ifp, cmd, data);
4857 if (ifp->if_flags & IFF_UP) {
4858 if (!(ifp->if_flags & IFF_RUNNING)) {
4859 iwn_init_locked(sc);
4860 if (IWN_READ(sc, IWN_GP_CNTRL) & IWN_GP_CNTRL_RFKILL)
4866 if (ifp->if_flags & IFF_RUNNING)
4867 iwn_stop_locked(sc);
4870 ieee80211_start_all(ic);
4871 else if (vap != NULL && stop)
4872 ieee80211_stop(vap);
4875 error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
4879 /* XXX validate permissions/memory/etc? */
4880 error = copyout(&sc->last_stat, ifr->ifr_data,
4881 sizeof(struct iwn_stats));
4886 memset(&sc->last_stat, 0, sizeof(struct iwn_stats));
4898 * Send a command to the firmware.
4901 iwn_cmd(struct iwn_softc *sc, int code, const void *buf, int size, int async)
4903 struct iwn_tx_ring *ring;
4904 struct iwn_tx_desc *desc;
4905 struct iwn_tx_data *data;
4906 struct iwn_tx_cmd *cmd;
4912 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
4914 if (sc->sc_flags & IWN_FLAG_PAN_SUPPORT)
4915 cmd_queue_num = IWN_PAN_CMD_QUEUE;
4917 cmd_queue_num = IWN_CMD_QUEUE_NUM;
4919 ring = &sc->txq[cmd_queue_num];
4920 desc = &ring->desc[ring->cur];
4921 data = &ring->data[ring->cur];
4924 if (size > sizeof cmd->data) {
4925 /* Command is too large to fit in a descriptor. */
4926 if (totlen > MJUMPAGESIZE)
4928 m = m_getjcl(MB_DONTWAIT, MT_DATA, M_PKTHDR, MJUMPAGESIZE);
4931 cmd = mtod(m, struct iwn_tx_cmd *);
4932 error = bus_dmamap_load(ring->data_dmat, data->map, cmd,
4933 totlen, iwn_dma_map_addr, &paddr, BUS_DMA_NOWAIT);
4940 cmd = &ring->cmd[ring->cur];
4941 paddr = data->cmd_paddr;
4946 cmd->qid = ring->qid;
4947 cmd->idx = ring->cur;
4948 memcpy(cmd->data, buf, size);
4951 desc->segs[0].addr = htole32(IWN_LOADDR(paddr));
4952 desc->segs[0].len = htole16(IWN_HIADDR(paddr) | totlen << 4);
4954 DPRINTF(sc, IWN_DEBUG_CMD, "%s: %s (0x%x) flags %d qid %d idx %d\n",
4955 __func__, iwn_intr_str(cmd->code), cmd->code,
4956 cmd->flags, cmd->qid, cmd->idx);
4958 if (size > sizeof cmd->data) {
4959 bus_dmamap_sync(ring->data_dmat, data->map,
4960 BUS_DMASYNC_PREWRITE);
4962 bus_dmamap_sync(ring->data_dmat, ring->cmd_dma.map,
4963 BUS_DMASYNC_PREWRITE);
4965 bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
4966 BUS_DMASYNC_PREWRITE);
4968 /* Kick command ring. */
4969 ring->cur = (ring->cur + 1) % IWN_TX_RING_COUNT;
4970 IWN_WRITE(sc, IWN_HBUS_TARG_WRPTR, ring->qid << 8 | ring->cur);
4972 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
4974 return async ? 0 : zsleep(desc, &wlan_global_serializer, 0, "iwncmd", hz);
4978 iwn4965_add_node(struct iwn_softc *sc, struct iwn_node_info *node, int async)
4980 struct iwn4965_node_info hnode;
4983 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
4986 * We use the node structure for 5000 Series internally (it is
4987 * a superset of the one for 4965AGN). We thus copy the common
4988 * fields before sending the command.
4990 src = (caddr_t)node;
4991 dst = (caddr_t)&hnode;
4992 memcpy(dst, src, 48);
4993 /* Skip TSC, RX MIC and TX MIC fields from ``src''. */
4994 memcpy(dst + 48, src + 72, 20);
4995 return iwn_cmd(sc, IWN_CMD_ADD_NODE, &hnode, sizeof hnode, async);
4999 iwn5000_add_node(struct iwn_softc *sc, struct iwn_node_info *node, int async)
5002 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
5004 /* Direct mapping. */
5005 return iwn_cmd(sc, IWN_CMD_ADD_NODE, node, sizeof (*node), async);
5009 iwn_set_link_quality(struct iwn_softc *sc, struct ieee80211_node *ni)
5011 #define RV(v) ((v) & IEEE80211_RATE_VAL)
5012 struct iwn_node *wn = (void *)ni;
5013 struct ieee80211_rateset *rs;
5014 struct iwn_cmd_link_quality linkq;
5016 int i, rate, txrate;
5019 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
5021 /* Use the first valid TX antenna. */
5022 txant = IWN_LSB(sc->txchainmask);
5024 memset(&linkq, 0, sizeof linkq);
5026 linkq.antmsk_1stream = txant;
5029 * The '2 stream' setup is a bit .. odd.
5031 * For NICs that support only 1 antenna, default to IWN_ANT_AB or
5032 * the firmware panics (eg Intel 5100.)
5034 * For NICs that support two antennas, we use ANT_AB.
5036 * For NICs that support three antennas, we use the two that
5037 * wasn't the default one.
5039 * XXX TODO: if bluetooth (full concurrent) is enabled, restrict
5040 * this to only one antenna.
5043 /* So - if there's no secondary antenna, assume IWN_ANT_AB */
5045 /* Default - transmit on the other antennas */
5046 linkq.antmsk_2stream = (sc->txchainmask & ~IWN_LSB(sc->txchainmask));
5048 /* Now, if it's zero, set it to IWN_ANT_AB, so to not panic firmware */
5049 if (linkq.antmsk_2stream == 0)
5050 linkq.antmsk_2stream = IWN_ANT_AB;
5053 * If the NIC is a two-stream TX NIC, configure the TX mask to
5054 * the default chainmask
5056 else if (sc->ntxchains == 2)
5057 linkq.antmsk_2stream = sc->txchainmask;
5059 linkq.ampdu_max = 32; /* XXX negotiated? */
5060 linkq.ampdu_threshold = 3;
5061 linkq.ampdu_limit = htole16(4000); /* 4ms */
5063 DPRINTF(sc, IWN_DEBUG_XMIT,
5064 "%s: 1stream antenna=0x%02x, 2stream antenna=0x%02x, ntxstreams=%d\n",
5066 linkq.antmsk_1stream,
5067 linkq.antmsk_2stream,
5071 * Are we using 11n rates? Ensure the channel is
5072 * 11n _and_ we have some 11n rates, or don't
5075 if (IEEE80211_IS_CHAN_HT(ni->ni_chan) && ni->ni_htrates.rs_nrates > 0) {
5076 rs = (struct ieee80211_rateset *) &ni->ni_htrates;
5083 /* Start at highest available bit-rate. */
5085 * XXX this is all very dirty!
5088 txrate = ni->ni_htrates.rs_nrates - 1;
5090 txrate = rs->rs_nrates - 1;
5091 for (i = 0; i < IWN_MAX_TX_RETRIES; i++) {
5095 rate = IEEE80211_RATE_MCS | rs->rs_rates[txrate];
5097 rate = RV(rs->rs_rates[txrate]);
5099 DPRINTF(sc, IWN_DEBUG_XMIT,
5100 "%s: i=%d, txrate=%d, rate=0x%02x\n",
5106 /* Do rate -> PLCP config mapping */
5107 plcp = iwn_rate_to_plcp(sc, ni, rate);
5108 linkq.retry[i] = plcp;
5111 * The mimo field is an index into the table which
5112 * indicates the first index where it and subsequent entries
5113 * will not be using MIMO.
5115 * Since we're filling linkq from 0..15 and we're filling
5116 * from the higest MCS rates to the lowest rates, if we
5117 * _are_ doing a dual-stream rate, set mimo to idx+1 (ie,
5118 * the next entry.) That way if the next entry is a non-MIMO
5119 * entry, we're already pointing at it.
5121 if ((le32toh(plcp) & IWN_RFLAG_MCS) &&
5122 RV(le32toh(plcp)) > 7)
5125 /* Next retry at immediate lower bit-rate. */
5130 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
5132 return iwn_cmd(sc, IWN_CMD_LINK_QUALITY, &linkq, sizeof linkq, 1);
5137 * Broadcast node is used to send group-addressed and management frames.
5140 iwn_add_broadcast_node(struct iwn_softc *sc, int async)
5142 struct iwn_ops *ops = &sc->ops;
5143 struct ifnet *ifp = sc->sc_ifp;
5144 struct ieee80211com *ic = ifp->if_l2com;
5145 struct iwn_node_info node;
5146 struct iwn_cmd_link_quality linkq;
5150 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
5152 sc->rxon = &sc->rx_on[IWN_RXON_BSS_CTX];
5154 memset(&node, 0, sizeof node);
5155 IEEE80211_ADDR_COPY(node.macaddr, ifp->if_broadcastaddr);
5156 node.id = sc->broadcast_id;
5157 DPRINTF(sc, IWN_DEBUG_RESET, "%s: adding broadcast node\n", __func__);
5158 if ((error = ops->add_node(sc, &node, async)) != 0)
5161 /* Use the first valid TX antenna. */
5162 txant = IWN_LSB(sc->txchainmask);
5164 memset(&linkq, 0, sizeof linkq);
5165 linkq.id = sc->broadcast_id;
5166 linkq.antmsk_1stream = txant;
5167 linkq.antmsk_2stream = IWN_ANT_AB;
5168 linkq.ampdu_max = 64;
5169 linkq.ampdu_threshold = 3;
5170 linkq.ampdu_limit = htole16(4000); /* 4ms */
5172 /* Use lowest mandatory bit-rate. */
5173 if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
5174 linkq.retry[0] = htole32(0xd);
5176 linkq.retry[0] = htole32(10 | IWN_RFLAG_CCK);
5177 linkq.retry[0] |= htole32(IWN_RFLAG_ANT(txant));
5178 /* Use same bit-rate for all TX retries. */
5179 for (i = 1; i < IWN_MAX_TX_RETRIES; i++) {
5180 linkq.retry[i] = linkq.retry[0];
5183 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
5185 return iwn_cmd(sc, IWN_CMD_LINK_QUALITY, &linkq, sizeof linkq, async);
5189 iwn_updateedca(struct ieee80211com *ic)
5191 #define IWN_EXP2(x) ((1 << (x)) - 1) /* CWmin = 2^ECWmin - 1 */
5192 struct iwn_softc *sc = ic->ic_ifp->if_softc;
5193 struct iwn_edca_params cmd;
5196 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
5198 memset(&cmd, 0, sizeof cmd);
5199 cmd.flags = htole32(IWN_EDCA_UPDATE);
5200 for (aci = 0; aci < WME_NUM_AC; aci++) {
5201 const struct wmeParams *ac =
5202 &ic->ic_wme.wme_chanParams.cap_wmeParams[aci];
5203 cmd.ac[aci].aifsn = ac->wmep_aifsn;
5204 cmd.ac[aci].cwmin = htole16(IWN_EXP2(ac->wmep_logcwmin));
5205 cmd.ac[aci].cwmax = htole16(IWN_EXP2(ac->wmep_logcwmax));
5206 cmd.ac[aci].txoplimit =
5207 htole16(IEEE80211_TXOP_TO_US(ac->wmep_txopLimit));
5209 (void)iwn_cmd(sc, IWN_CMD_EDCA_PARAMS, &cmd, sizeof cmd, 1);
5211 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
5218 iwn_update_mcast(struct ifnet *ifp)
5224 iwn_set_led(struct iwn_softc *sc, uint8_t which, uint8_t off, uint8_t on)
5226 struct iwn_cmd_led led;
5228 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
5231 /* XXX don't set LEDs during scan? */
5232 if (sc->sc_is_scanning)
5236 /* Clear microcode LED ownership. */
5237 IWN_CLRBITS(sc, IWN_LED, IWN_LED_BSM_CTRL);
5240 led.unit = htole32(10000); /* on/off in unit of 100ms */
5243 (void)iwn_cmd(sc, IWN_CMD_SET_LED, &led, sizeof led, 1);
5247 * Set the critical temperature at which the firmware will stop the radio
5251 iwn_set_critical_temp(struct iwn_softc *sc)
5253 struct iwn_critical_temp crit;
5256 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
5258 IWN_WRITE(sc, IWN_UCODE_GP1_CLR, IWN_UCODE_GP1_CTEMP_STOP_RF);
5260 if (sc->hw_type == IWN_HW_REV_TYPE_5150)
5261 temp = (IWN_CTOK(110) - sc->temp_off) * -5;
5262 else if (sc->hw_type == IWN_HW_REV_TYPE_4965)
5263 temp = IWN_CTOK(110);
5266 memset(&crit, 0, sizeof crit);
5267 crit.tempR = htole32(temp);
5268 DPRINTF(sc, IWN_DEBUG_RESET, "setting critical temp to %d\n", temp);
5269 return iwn_cmd(sc, IWN_CMD_SET_CRITICAL_TEMP, &crit, sizeof crit, 0);
5273 iwn_set_timing(struct iwn_softc *sc, struct ieee80211_node *ni)
5275 struct iwn_cmd_timing cmd;
5278 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
5280 memset(&cmd, 0, sizeof cmd);
5281 memcpy(&cmd.tstamp, ni->ni_tstamp.data, sizeof (uint64_t));
5282 cmd.bintval = htole16(ni->ni_intval);
5283 cmd.lintval = htole16(10);
5285 /* Compute remaining time until next beacon. */
5286 val = (uint64_t)ni->ni_intval * IEEE80211_DUR_TU;
5287 mod = le64toh(cmd.tstamp) % val;
5288 cmd.binitval = htole32((uint32_t)(val - mod));
5290 DPRINTF(sc, IWN_DEBUG_RESET, "timing bintval=%u tstamp=%ju, init=%u\n",
5291 ni->ni_intval, le64toh(cmd.tstamp), (uint32_t)(val - mod));
5293 return iwn_cmd(sc, IWN_CMD_TIMING, &cmd, sizeof cmd, 1);
5297 iwn4965_power_calibration(struct iwn_softc *sc, int temp)
5299 struct ifnet *ifp = sc->sc_ifp;
5300 struct ieee80211com *ic = ifp->if_l2com;
5302 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
5304 /* Adjust TX power if need be (delta >= 3 degC). */
5305 DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: temperature %d->%d\n",
5306 __func__, sc->temp, temp);
5307 if (abs(temp - sc->temp) >= 3) {
5308 /* Record temperature of last calibration. */
5310 (void)iwn4965_set_txpower(sc, ic->ic_bsschan, 1);
5315 * Set TX power for current channel (each rate has its own power settings).
5316 * This function takes into account the regulatory information from EEPROM,
5317 * the current temperature and the current voltage.
5320 iwn4965_set_txpower(struct iwn_softc *sc, struct ieee80211_channel *ch,
5323 /* Fixed-point arithmetic division using a n-bit fractional part. */
5324 #define fdivround(a, b, n) \
5325 ((((1 << n) * (a)) / (b) + (1 << n) / 2) / (1 << n))
5326 /* Linear interpolation. */
5327 #define interpolate(x, x1, y1, x2, y2, n) \
5328 ((y1) + fdivround(((int)(x) - (x1)) * ((y2) - (y1)), (x2) - (x1), n))
5330 static const int tdiv[IWN_NATTEN_GROUPS] = { 9, 8, 8, 8, 6 };
5331 struct iwn_ucode_info *uc = &sc->ucode_info;
5332 struct iwn4965_cmd_txpower cmd;
5333 struct iwn4965_eeprom_chan_samples *chans;
5334 const uint8_t *rf_gain, *dsp_gain;
5335 int32_t vdiff, tdiff;
5336 int i, c, grp, maxpwr;
5339 sc->rxon = &sc->rx_on[IWN_RXON_BSS_CTX];
5340 /* Retrieve current channel from last RXON. */
5341 chan = sc->rxon->chan;
5342 DPRINTF(sc, IWN_DEBUG_RESET, "setting TX power for channel %d\n",
5345 memset(&cmd, 0, sizeof cmd);
5346 cmd.band = IEEE80211_IS_CHAN_5GHZ(ch) ? 0 : 1;
5349 if (IEEE80211_IS_CHAN_5GHZ(ch)) {
5350 maxpwr = sc->maxpwr5GHz;
5351 rf_gain = iwn4965_rf_gain_5ghz;
5352 dsp_gain = iwn4965_dsp_gain_5ghz;
5354 maxpwr = sc->maxpwr2GHz;
5355 rf_gain = iwn4965_rf_gain_2ghz;
5356 dsp_gain = iwn4965_dsp_gain_2ghz;
5359 /* Compute voltage compensation. */
5360 vdiff = ((int32_t)le32toh(uc->volt) - sc->eeprom_voltage) / 7;
5365 DPRINTF(sc, IWN_DEBUG_CALIBRATE | IWN_DEBUG_TXPOW,
5366 "%s: voltage compensation=%d (UCODE=%d, EEPROM=%d)\n",
5367 __func__, vdiff, le32toh(uc->volt), sc->eeprom_voltage);
5369 /* Get channel attenuation group. */
5370 if (chan <= 20) /* 1-20 */
5372 else if (chan <= 43) /* 34-43 */
5374 else if (chan <= 70) /* 44-70 */
5376 else if (chan <= 124) /* 71-124 */
5380 DPRINTF(sc, IWN_DEBUG_CALIBRATE | IWN_DEBUG_TXPOW,
5381 "%s: chan %d, attenuation group=%d\n", __func__, chan, grp);
5383 /* Get channel sub-band. */
5384 for (i = 0; i < IWN_NBANDS; i++)
5385 if (sc->bands[i].lo != 0 &&
5386 sc->bands[i].lo <= chan && chan <= sc->bands[i].hi)
5388 if (i == IWN_NBANDS) /* Can't happen in real-life. */
5390 chans = sc->bands[i].chans;
5391 DPRINTF(sc, IWN_DEBUG_CALIBRATE | IWN_DEBUG_TXPOW,
5392 "%s: chan %d sub-band=%d\n", __func__, chan, i);
5394 for (c = 0; c < 2; c++) {
5395 uint8_t power, gain, temp;
5396 int maxchpwr, pwr, ridx, idx;
5398 power = interpolate(chan,
5399 chans[0].num, chans[0].samples[c][1].power,
5400 chans[1].num, chans[1].samples[c][1].power, 1);
5401 gain = interpolate(chan,
5402 chans[0].num, chans[0].samples[c][1].gain,
5403 chans[1].num, chans[1].samples[c][1].gain, 1);
5404 temp = interpolate(chan,
5405 chans[0].num, chans[0].samples[c][1].temp,
5406 chans[1].num, chans[1].samples[c][1].temp, 1);
5407 DPRINTF(sc, IWN_DEBUG_CALIBRATE | IWN_DEBUG_TXPOW,
5408 "%s: Tx chain %d: power=%d gain=%d temp=%d\n",
5409 __func__, c, power, gain, temp);
5411 /* Compute temperature compensation. */
5412 tdiff = ((sc->temp - temp) * 2) / tdiv[grp];
5413 DPRINTF(sc, IWN_DEBUG_CALIBRATE | IWN_DEBUG_TXPOW,
5414 "%s: temperature compensation=%d (current=%d, EEPROM=%d)\n",
5415 __func__, tdiff, sc->temp, temp);
5417 for (ridx = 0; ridx <= IWN_RIDX_MAX; ridx++) {
5418 /* Convert dBm to half-dBm. */
5419 maxchpwr = sc->maxpwr[chan] * 2;
5421 maxchpwr -= 6; /* MIMO 2T: -3dB */
5425 /* Adjust TX power based on rate. */
5426 if ((ridx % 8) == 5)
5427 pwr -= 15; /* OFDM48: -7.5dB */
5428 else if ((ridx % 8) == 6)
5429 pwr -= 17; /* OFDM54: -8.5dB */
5430 else if ((ridx % 8) == 7)
5431 pwr -= 20; /* OFDM60: -10dB */
5433 pwr -= 10; /* Others: -5dB */
5435 /* Do not exceed channel max TX power. */
5439 idx = gain - (pwr - power) - tdiff - vdiff;
5440 if ((ridx / 8) & 1) /* MIMO */
5441 idx += (int32_t)le32toh(uc->atten[grp][c]);
5444 idx += 9; /* 5GHz */
5445 if (ridx == IWN_RIDX_MAX)
5448 /* Make sure idx stays in a valid range. */
5451 else if (idx > IWN4965_MAX_PWR_INDEX)
5452 idx = IWN4965_MAX_PWR_INDEX;
5454 DPRINTF(sc, IWN_DEBUG_CALIBRATE | IWN_DEBUG_TXPOW,
5455 "%s: Tx chain %d, rate idx %d: power=%d\n",
5456 __func__, c, ridx, idx);
5457 cmd.power[ridx].rf_gain[c] = rf_gain[idx];
5458 cmd.power[ridx].dsp_gain[c] = dsp_gain[idx];
5462 DPRINTF(sc, IWN_DEBUG_CALIBRATE | IWN_DEBUG_TXPOW,
5463 "%s: set tx power for chan %d\n", __func__, chan);
5464 return iwn_cmd(sc, IWN_CMD_TXPOWER, &cmd, sizeof cmd, async);
5471 iwn5000_set_txpower(struct iwn_softc *sc, struct ieee80211_channel *ch,
5474 struct iwn5000_cmd_txpower cmd;
5476 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
5479 * TX power calibration is handled automatically by the firmware
5482 memset(&cmd, 0, sizeof cmd);
5483 cmd.global_limit = 2 * IWN5000_TXPOWER_MAX_DBM; /* 16 dBm */
5484 cmd.flags = IWN5000_TXPOWER_NO_CLOSED;
5485 cmd.srv_limit = IWN5000_TXPOWER_AUTO;
5486 DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: setting TX power\n", __func__);
5487 return iwn_cmd(sc, IWN_CMD_TXPOWER_DBM, &cmd, sizeof cmd, async);
5491 * Retrieve the maximum RSSI (in dBm) among receivers.
5494 iwn4965_get_rssi(struct iwn_softc *sc, struct iwn_rx_stat *stat)
5496 struct iwn4965_rx_phystat *phy = (void *)stat->phybuf;
5500 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
5502 mask = (le16toh(phy->antenna) >> 4) & IWN_ANT_ABC;
5503 agc = (le16toh(phy->agc) >> 7) & 0x7f;
5506 if (mask & IWN_ANT_A)
5507 rssi = MAX(rssi, phy->rssi[0]);
5508 if (mask & IWN_ANT_B)
5509 rssi = MAX(rssi, phy->rssi[2]);
5510 if (mask & IWN_ANT_C)
5511 rssi = MAX(rssi, phy->rssi[4]);
5513 DPRINTF(sc, IWN_DEBUG_RECV,
5514 "%s: agc %d mask 0x%x rssi %d %d %d result %d\n", __func__, agc,
5515 mask, phy->rssi[0], phy->rssi[2], phy->rssi[4],
5516 rssi - agc - IWN_RSSI_TO_DBM);
5517 return rssi - agc - IWN_RSSI_TO_DBM;
5521 iwn5000_get_rssi(struct iwn_softc *sc, struct iwn_rx_stat *stat)
5523 struct iwn5000_rx_phystat *phy = (void *)stat->phybuf;
5527 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
5529 agc = (le32toh(phy->agc) >> 9) & 0x7f;
5531 rssi = MAX(le16toh(phy->rssi[0]) & 0xff,
5532 le16toh(phy->rssi[1]) & 0xff);
5533 rssi = MAX(le16toh(phy->rssi[2]) & 0xff, rssi);
5535 DPRINTF(sc, IWN_DEBUG_RECV,
5536 "%s: agc %d rssi %d %d %d result %d\n", __func__, agc,
5537 phy->rssi[0], phy->rssi[1], phy->rssi[2],
5538 rssi - agc - IWN_RSSI_TO_DBM);
5539 return rssi - agc - IWN_RSSI_TO_DBM;
5543 * Retrieve the average noise (in dBm) among receivers.
5546 iwn_get_noise(const struct iwn_rx_general_stats *stats)
5548 int i, total, nbant, noise;
5551 for (i = 0; i < 3; i++) {
5552 if ((noise = le32toh(stats->noise[i]) & 0xff) == 0)
5557 /* There should be at least one antenna but check anyway. */
5558 return (nbant == 0) ? -127 : (total / nbant) - 107;
5562 * Compute temperature (in degC) from last received statistics.
5565 iwn4965_get_temperature(struct iwn_softc *sc)
5567 struct iwn_ucode_info *uc = &sc->ucode_info;
5568 int32_t r1, r2, r3, r4, temp;
5570 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
5572 r1 = le32toh(uc->temp[0].chan20MHz);
5573 r2 = le32toh(uc->temp[1].chan20MHz);
5574 r3 = le32toh(uc->temp[2].chan20MHz);
5575 r4 = le32toh(sc->rawtemp);
5577 if (r1 == r3) /* Prevents division by 0 (should not happen). */
5580 /* Sign-extend 23-bit R4 value to 32-bit. */
5581 r4 = ((r4 & 0xffffff) ^ 0x800000) - 0x800000;
5582 /* Compute temperature in Kelvin. */
5583 temp = (259 * (r4 - r2)) / (r3 - r1);
5584 temp = (temp * 97) / 100 + 8;
5586 DPRINTF(sc, IWN_DEBUG_ANY, "temperature %dK/%dC\n", temp,
5588 return IWN_KTOC(temp);
5592 iwn5000_get_temperature(struct iwn_softc *sc)
5596 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
5599 * Temperature is not used by the driver for 5000 Series because
5600 * TX power calibration is handled by firmware.
5602 temp = le32toh(sc->rawtemp);
5603 if (sc->hw_type == IWN_HW_REV_TYPE_5150) {
5604 temp = (temp / -5) + sc->temp_off;
5605 temp = IWN_KTOC(temp);
5611 * Initialize sensitivity calibration state machine.
5614 iwn_init_sensitivity(struct iwn_softc *sc)
5616 struct iwn_ops *ops = &sc->ops;
5617 struct iwn_calib_state *calib = &sc->calib;
5621 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
5623 /* Reset calibration state machine. */
5624 memset(calib, 0, sizeof (*calib));
5625 calib->state = IWN_CALIB_STATE_INIT;
5626 calib->cck_state = IWN_CCK_STATE_HIFA;
5627 /* Set initial correlation values. */
5628 calib->ofdm_x1 = sc->limits->min_ofdm_x1;
5629 calib->ofdm_mrc_x1 = sc->limits->min_ofdm_mrc_x1;
5630 calib->ofdm_x4 = sc->limits->min_ofdm_x4;
5631 calib->ofdm_mrc_x4 = sc->limits->min_ofdm_mrc_x4;
5632 calib->cck_x4 = 125;
5633 calib->cck_mrc_x4 = sc->limits->min_cck_mrc_x4;
5634 calib->energy_cck = sc->limits->energy_cck;
5636 /* Write initial sensitivity. */
5637 if ((error = iwn_send_sensitivity(sc)) != 0)
5640 /* Write initial gains. */
5641 if ((error = ops->init_gains(sc)) != 0)
5644 /* Request statistics at each beacon interval. */
5646 DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: sending request for statistics\n",
5648 return iwn_cmd(sc, IWN_CMD_GET_STATISTICS, &flags, sizeof flags, 1);
5652 * Collect noise and RSSI statistics for the first 20 beacons received
5653 * after association and use them to determine connected antennas and
5654 * to set differential gains.
5657 iwn_collect_noise(struct iwn_softc *sc,
5658 const struct iwn_rx_general_stats *stats)
5660 struct iwn_ops *ops = &sc->ops;
5661 struct iwn_calib_state *calib = &sc->calib;
5662 struct ifnet *ifp = sc->sc_ifp;
5663 struct ieee80211com *ic = ifp->if_l2com;
5667 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
5669 /* Accumulate RSSI and noise for all 3 antennas. */
5670 for (i = 0; i < 3; i++) {
5671 calib->rssi[i] += le32toh(stats->rssi[i]) & 0xff;
5672 calib->noise[i] += le32toh(stats->noise[i]) & 0xff;
5674 /* NB: We update differential gains only once after 20 beacons. */
5675 if (++calib->nbeacons < 20)
5678 /* Determine highest average RSSI. */
5679 val = MAX(calib->rssi[0], calib->rssi[1]);
5680 val = MAX(calib->rssi[2], val);
5682 /* Determine which antennas are connected. */
5683 sc->chainmask = sc->rxchainmask;
5684 for (i = 0; i < 3; i++)
5685 if (val - calib->rssi[i] > 15 * 20)
5686 sc->chainmask &= ~(1 << i);
5687 DPRINTF(sc, IWN_DEBUG_CALIBRATE,
5688 "%s: RX chains mask: theoretical=0x%x, actual=0x%x\n",
5689 __func__, sc->rxchainmask, sc->chainmask);
5691 /* If none of the TX antennas are connected, keep at least one. */
5692 if ((sc->chainmask & sc->txchainmask) == 0)
5693 sc->chainmask |= IWN_LSB(sc->txchainmask);
5695 (void)ops->set_gains(sc);
5696 calib->state = IWN_CALIB_STATE_RUN;
5699 /* XXX Disable RX chains with no antennas connected. */
5700 sc->rxon->rxchain = htole16(IWN_RXCHAIN_SEL(sc->chainmask));
5701 if (sc->sc_is_scanning)
5702 device_printf(sc->sc_dev,
5703 "%s: is_scanning set, before RXON\n",
5705 (void)iwn_cmd(sc, IWN_CMD_RXON, sc->rxon, sc->rxonsz, 1);
5708 /* Enable power-saving mode if requested by user. */
5709 if (ic->ic_flags & IEEE80211_F_PMGTON)
5710 (void)iwn_set_pslevel(sc, 0, 3, 1);
5712 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
5717 iwn4965_init_gains(struct iwn_softc *sc)
5719 struct iwn_phy_calib_gain cmd;
5721 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
5723 memset(&cmd, 0, sizeof cmd);
5724 cmd.code = IWN4965_PHY_CALIB_DIFF_GAIN;
5725 /* Differential gains initially set to 0 for all 3 antennas. */
5726 DPRINTF(sc, IWN_DEBUG_CALIBRATE,
5727 "%s: setting initial differential gains\n", __func__);
5728 return iwn_cmd(sc, IWN_CMD_PHY_CALIB, &cmd, sizeof cmd, 1);
5732 iwn5000_init_gains(struct iwn_softc *sc)
5734 struct iwn_phy_calib cmd;
5736 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
5738 memset(&cmd, 0, sizeof cmd);
5739 cmd.code = sc->reset_noise_gain;
5742 DPRINTF(sc, IWN_DEBUG_CALIBRATE,
5743 "%s: setting initial differential gains\n", __func__);
5744 return iwn_cmd(sc, IWN_CMD_PHY_CALIB, &cmd, sizeof cmd, 1);
5748 iwn4965_set_gains(struct iwn_softc *sc)
5750 struct iwn_calib_state *calib = &sc->calib;
5751 struct iwn_phy_calib_gain cmd;
5752 int i, delta, noise;
5754 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
5756 /* Get minimal noise among connected antennas. */
5757 noise = INT_MAX; /* NB: There's at least one antenna. */
5758 for (i = 0; i < 3; i++)
5759 if (sc->chainmask & (1 << i))
5760 noise = MIN(calib->noise[i], noise);
5762 memset(&cmd, 0, sizeof cmd);
5763 cmd.code = IWN4965_PHY_CALIB_DIFF_GAIN;
5764 /* Set differential gains for connected antennas. */
5765 for (i = 0; i < 3; i++) {
5766 if (sc->chainmask & (1 << i)) {
5767 /* Compute attenuation (in unit of 1.5dB). */
5768 delta = (noise - (int32_t)calib->noise[i]) / 30;
5769 /* NB: delta <= 0 */
5770 /* Limit to [-4.5dB,0]. */
5771 cmd.gain[i] = MIN(abs(delta), 3);
5773 cmd.gain[i] |= 1 << 2; /* sign bit */
5776 DPRINTF(sc, IWN_DEBUG_CALIBRATE,
5777 "setting differential gains Ant A/B/C: %x/%x/%x (%x)\n",
5778 cmd.gain[0], cmd.gain[1], cmd.gain[2], sc->chainmask);
5779 return iwn_cmd(sc, IWN_CMD_PHY_CALIB, &cmd, sizeof cmd, 1);
5783 iwn5000_set_gains(struct iwn_softc *sc)
5785 struct iwn_calib_state *calib = &sc->calib;
5786 struct iwn_phy_calib_gain cmd;
5787 int i, ant, div, delta;
5789 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
5791 /* We collected 20 beacons and !=6050 need a 1.5 factor. */
5792 div = (sc->hw_type == IWN_HW_REV_TYPE_6050) ? 20 : 30;
5794 memset(&cmd, 0, sizeof cmd);
5795 cmd.code = sc->noise_gain;
5798 /* Get first available RX antenna as referential. */
5799 ant = IWN_LSB(sc->rxchainmask);
5800 /* Set differential gains for other antennas. */
5801 for (i = ant + 1; i < 3; i++) {
5802 if (sc->chainmask & (1 << i)) {
5803 /* The delta is relative to antenna "ant". */
5804 delta = ((int32_t)calib->noise[ant] -
5805 (int32_t)calib->noise[i]) / div;
5806 /* Limit to [-4.5dB,+4.5dB]. */
5807 cmd.gain[i - 1] = MIN(abs(delta), 3);
5809 cmd.gain[i - 1] |= 1 << 2; /* sign bit */
5812 DPRINTF(sc, IWN_DEBUG_CALIBRATE,
5813 "setting differential gains Ant B/C: %x/%x (%x)\n",
5814 cmd.gain[0], cmd.gain[1], sc->chainmask);
5815 return iwn_cmd(sc, IWN_CMD_PHY_CALIB, &cmd, sizeof cmd, 1);
5819 * Tune RF RX sensitivity based on the number of false alarms detected
5820 * during the last beacon period.
5823 iwn_tune_sensitivity(struct iwn_softc *sc, const struct iwn_rx_stats *stats)
5825 #define inc(val, inc, max) \
5826 if ((val) < (max)) { \
5827 if ((val) < (max) - (inc)) \
5833 #define dec(val, dec, min) \
5834 if ((val) > (min)) { \
5835 if ((val) > (min) + (dec)) \
5842 const struct iwn_sensitivity_limits *limits = sc->limits;
5843 struct iwn_calib_state *calib = &sc->calib;
5844 uint32_t val, rxena, fa;
5845 uint32_t energy[3], energy_min;
5846 uint8_t noise[3], noise_ref;
5847 int i, needs_update = 0;
5849 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
5851 /* Check that we've been enabled long enough. */
5852 if ((rxena = le32toh(stats->general.load)) == 0){
5853 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end not so long\n", __func__);
5857 /* Compute number of false alarms since last call for OFDM. */
5858 fa = le32toh(stats->ofdm.bad_plcp) - calib->bad_plcp_ofdm;
5859 fa += le32toh(stats->ofdm.fa) - calib->fa_ofdm;
5860 fa *= 200 * IEEE80211_DUR_TU; /* 200TU */
5862 if (fa > 50 * rxena) {
5863 /* High false alarm count, decrease sensitivity. */
5864 DPRINTF(sc, IWN_DEBUG_CALIBRATE,
5865 "%s: OFDM high false alarm count: %u\n", __func__, fa);
5866 inc(calib->ofdm_x1, 1, limits->max_ofdm_x1);
5867 inc(calib->ofdm_mrc_x1, 1, limits->max_ofdm_mrc_x1);
5868 inc(calib->ofdm_x4, 1, limits->max_ofdm_x4);
5869 inc(calib->ofdm_mrc_x4, 1, limits->max_ofdm_mrc_x4);
5871 } else if (fa < 5 * rxena) {
5872 /* Low false alarm count, increase sensitivity. */
5873 DPRINTF(sc, IWN_DEBUG_CALIBRATE,
5874 "%s: OFDM low false alarm count: %u\n", __func__, fa);
5875 dec(calib->ofdm_x1, 1, limits->min_ofdm_x1);
5876 dec(calib->ofdm_mrc_x1, 1, limits->min_ofdm_mrc_x1);
5877 dec(calib->ofdm_x4, 1, limits->min_ofdm_x4);
5878 dec(calib->ofdm_mrc_x4, 1, limits->min_ofdm_mrc_x4);
5881 /* Compute maximum noise among 3 receivers. */
5882 for (i = 0; i < 3; i++)
5883 noise[i] = (le32toh(stats->general.noise[i]) >> 8) & 0xff;
5884 val = MAX(noise[0], noise[1]);
5885 val = MAX(noise[2], val);
5886 /* Insert it into our samples table. */
5887 calib->noise_samples[calib->cur_noise_sample] = val;
5888 calib->cur_noise_sample = (calib->cur_noise_sample + 1) % 20;
5890 /* Compute maximum noise among last 20 samples. */
5891 noise_ref = calib->noise_samples[0];
5892 for (i = 1; i < 20; i++)
5893 noise_ref = MAX(noise_ref, calib->noise_samples[i]);
5895 /* Compute maximum energy among 3 receivers. */
5896 for (i = 0; i < 3; i++)
5897 energy[i] = le32toh(stats->general.energy[i]);
5898 val = MIN(energy[0], energy[1]);
5899 val = MIN(energy[2], val);
5900 /* Insert it into our samples table. */
5901 calib->energy_samples[calib->cur_energy_sample] = val;
5902 calib->cur_energy_sample = (calib->cur_energy_sample + 1) % 10;
5904 /* Compute minimum energy among last 10 samples. */
5905 energy_min = calib->energy_samples[0];
5906 for (i = 1; i < 10; i++)
5907 energy_min = MAX(energy_min, calib->energy_samples[i]);
5910 /* Compute number of false alarms since last call for CCK. */
5911 fa = le32toh(stats->cck.bad_plcp) - calib->bad_plcp_cck;
5912 fa += le32toh(stats->cck.fa) - calib->fa_cck;
5913 fa *= 200 * IEEE80211_DUR_TU; /* 200TU */
5915 if (fa > 50 * rxena) {
5916 /* High false alarm count, decrease sensitivity. */
5917 DPRINTF(sc, IWN_DEBUG_CALIBRATE,
5918 "%s: CCK high false alarm count: %u\n", __func__, fa);
5919 calib->cck_state = IWN_CCK_STATE_HIFA;
5922 if (calib->cck_x4 > 160) {
5923 calib->noise_ref = noise_ref;
5924 if (calib->energy_cck > 2)
5925 dec(calib->energy_cck, 2, energy_min);
5927 if (calib->cck_x4 < 160) {
5928 calib->cck_x4 = 161;
5931 inc(calib->cck_x4, 3, limits->max_cck_x4);
5933 inc(calib->cck_mrc_x4, 3, limits->max_cck_mrc_x4);
5935 } else if (fa < 5 * rxena) {
5936 /* Low false alarm count, increase sensitivity. */
5937 DPRINTF(sc, IWN_DEBUG_CALIBRATE,
5938 "%s: CCK low false alarm count: %u\n", __func__, fa);
5939 calib->cck_state = IWN_CCK_STATE_LOFA;
5942 if (calib->cck_state != IWN_CCK_STATE_INIT &&
5943 (((int32_t)calib->noise_ref - (int32_t)noise_ref) > 2 ||
5944 calib->low_fa > 100)) {
5945 inc(calib->energy_cck, 2, limits->min_energy_cck);
5946 dec(calib->cck_x4, 3, limits->min_cck_x4);
5947 dec(calib->cck_mrc_x4, 3, limits->min_cck_mrc_x4);
5950 /* Not worth to increase or decrease sensitivity. */
5951 DPRINTF(sc, IWN_DEBUG_CALIBRATE,
5952 "%s: CCK normal false alarm count: %u\n", __func__, fa);
5954 calib->noise_ref = noise_ref;
5956 if (calib->cck_state == IWN_CCK_STATE_HIFA) {
5957 /* Previous interval had many false alarms. */
5958 dec(calib->energy_cck, 8, energy_min);
5960 calib->cck_state = IWN_CCK_STATE_INIT;
5964 (void)iwn_send_sensitivity(sc);
5966 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
5973 iwn_send_sensitivity(struct iwn_softc *sc)
5975 struct iwn_calib_state *calib = &sc->calib;
5976 struct iwn_enhanced_sensitivity_cmd cmd;
5979 memset(&cmd, 0, sizeof cmd);
5980 len = sizeof (struct iwn_sensitivity_cmd);
5981 cmd.which = IWN_SENSITIVITY_WORKTBL;
5982 /* OFDM modulation. */
5983 cmd.corr_ofdm_x1 = htole16(calib->ofdm_x1);
5984 cmd.corr_ofdm_mrc_x1 = htole16(calib->ofdm_mrc_x1);
5985 cmd.corr_ofdm_x4 = htole16(calib->ofdm_x4);
5986 cmd.corr_ofdm_mrc_x4 = htole16(calib->ofdm_mrc_x4);
5987 cmd.energy_ofdm = htole16(sc->limits->energy_ofdm);
5988 cmd.energy_ofdm_th = htole16(62);
5989 /* CCK modulation. */
5990 cmd.corr_cck_x4 = htole16(calib->cck_x4);
5991 cmd.corr_cck_mrc_x4 = htole16(calib->cck_mrc_x4);
5992 cmd.energy_cck = htole16(calib->energy_cck);
5993 /* Barker modulation: use default values. */
5994 cmd.corr_barker = htole16(190);
5995 cmd.corr_barker_mrc = htole16(sc->limits->barker_mrc);
5997 DPRINTF(sc, IWN_DEBUG_CALIBRATE,
5998 "%s: set sensitivity %d/%d/%d/%d/%d/%d/%d\n", __func__,
5999 calib->ofdm_x1, calib->ofdm_mrc_x1, calib->ofdm_x4,
6000 calib->ofdm_mrc_x4, calib->cck_x4,
6001 calib->cck_mrc_x4, calib->energy_cck);
6003 if (!(sc->sc_flags & IWN_FLAG_ENH_SENS))
6005 /* Enhanced sensitivity settings. */
6006 len = sizeof (struct iwn_enhanced_sensitivity_cmd);
6007 cmd.ofdm_det_slope_mrc = htole16(668);
6008 cmd.ofdm_det_icept_mrc = htole16(4);
6009 cmd.ofdm_det_slope = htole16(486);
6010 cmd.ofdm_det_icept = htole16(37);
6011 cmd.cck_det_slope_mrc = htole16(853);
6012 cmd.cck_det_icept_mrc = htole16(4);
6013 cmd.cck_det_slope = htole16(476);
6014 cmd.cck_det_icept = htole16(99);
6016 return iwn_cmd(sc, IWN_CMD_SET_SENSITIVITY, &cmd, len, 1);
6020 * Look at the increase of PLCP errors over time; if it exceeds
6021 * a programmed threshold then trigger an RF retune.
6024 iwn_check_rx_recovery(struct iwn_softc *sc, struct iwn_stats *rs)
6026 int32_t delta_ofdm, delta_ht, delta_cck;
6027 struct iwn_calib_state *calib = &sc->calib;
6028 int delta_ticks, cur_ticks;
6033 * Calculate the difference between the current and
6034 * previous statistics.
6036 delta_cck = le32toh(rs->rx.cck.bad_plcp) - calib->bad_plcp_cck;
6037 delta_ofdm = le32toh(rs->rx.ofdm.bad_plcp) - calib->bad_plcp_ofdm;
6038 delta_ht = le32toh(rs->rx.ht.bad_plcp) - calib->bad_plcp_ht;
6041 * Calculate the delta in time between successive statistics
6042 * messages. Yes, it can roll over; so we make sure that
6043 * this doesn't happen.
6045 * XXX go figure out what to do about rollover
6046 * XXX go figure out what to do if ticks rolls over to -ve instead!
6047 * XXX go stab signed integer overflow undefined-ness in the face.
6050 delta_ticks = cur_ticks - sc->last_calib_ticks;
6053 * If any are negative, then the firmware likely reset; so just
6054 * bail. We'll pick this up next time.
6056 if (delta_cck < 0 || delta_ofdm < 0 || delta_ht < 0 || delta_ticks < 0)
6060 * delta_ticks is in ticks; we need to convert it up to milliseconds
6061 * so we can do some useful math with it.
6063 delta_msec = ticks_to_msecs(delta_ticks);
6066 * Calculate what our threshold is given the current delta_msec.
6068 thresh = sc->base_params->plcp_err_threshold * delta_msec;
6070 DPRINTF(sc, IWN_DEBUG_STATE,
6071 "%s: time delta: %d; cck=%d, ofdm=%d, ht=%d, total=%d, thresh=%d\n",
6077 (delta_msec + delta_cck + delta_ofdm + delta_ht),
6081 * If we need a retune, then schedule a single channel scan
6082 * to a channel that isn't the currently active one!
6084 * The math from linux iwlwifi:
6086 * if ((delta * 100 / msecs) > threshold)
6088 if (thresh > 0 && (delta_cck + delta_ofdm + delta_ht) * 100 > thresh) {
6089 DPRINTF(sc, IWN_DEBUG_ANY,
6090 "%s: PLCP error threshold raw (%d) comparison (%d) "
6091 "over limit (%d); retune!\n",
6093 (delta_cck + delta_ofdm + delta_ht),
6094 (delta_cck + delta_ofdm + delta_ht) * 100,
6100 * Set STA mode power saving level (between 0 and 5).
6101 * Level 0 is CAM (Continuously Aware Mode), 5 is for maximum power saving.
6104 iwn_set_pslevel(struct iwn_softc *sc, int dtim, int level, int async)
6106 struct iwn_pmgt_cmd cmd;
6107 const struct iwn_pmgt *pmgt;
6108 uint32_t max, skip_dtim;
6112 DPRINTF(sc, IWN_DEBUG_PWRSAVE,
6113 "%s: dtim=%d, level=%d, async=%d\n",
6119 /* Select which PS parameters to use. */
6121 pmgt = &iwn_pmgt[0][level];
6122 else if (dtim <= 10)
6123 pmgt = &iwn_pmgt[1][level];
6125 pmgt = &iwn_pmgt[2][level];
6127 memset(&cmd, 0, sizeof cmd);
6128 if (level != 0) /* not CAM */
6129 cmd.flags |= htole16(IWN_PS_ALLOW_SLEEP);
6131 cmd.flags |= htole16(IWN_PS_FAST_PD);
6132 /* Retrieve PCIe Active State Power Management (ASPM). */
6133 reg = pci_read_config(sc->sc_dev, sc->sc_cap_off + 0x10, 1);
6134 if (!(reg & 0x1)) /* L0s Entry disabled. */
6135 cmd.flags |= htole16(IWN_PS_PCI_PMGT);
6136 cmd.rxtimeout = htole32(pmgt->rxtimeout * 1024);
6137 cmd.txtimeout = htole32(pmgt->txtimeout * 1024);
6143 skip_dtim = pmgt->skip_dtim;
6144 if (skip_dtim != 0) {
6145 cmd.flags |= htole16(IWN_PS_SLEEP_OVER_DTIM);
6146 max = pmgt->intval[4];
6147 if (max == (uint32_t)-1)
6148 max = dtim * (skip_dtim + 1);
6149 else if (max > dtim)
6150 max = (max / dtim) * dtim;
6153 for (i = 0; i < 5; i++)
6154 cmd.intval[i] = htole32(MIN(max, pmgt->intval[i]));
6156 DPRINTF(sc, IWN_DEBUG_RESET, "setting power saving level to %d\n",
6158 return iwn_cmd(sc, IWN_CMD_SET_POWER_MODE, &cmd, sizeof cmd, async);
6162 iwn_send_btcoex(struct iwn_softc *sc)
6164 struct iwn_bluetooth cmd;
6166 memset(&cmd, 0, sizeof cmd);
6167 cmd.flags = IWN_BT_COEX_CHAN_ANN | IWN_BT_COEX_BT_PRIO;
6168 cmd.lead_time = IWN_BT_LEAD_TIME_DEF;
6169 cmd.max_kill = IWN_BT_MAX_KILL_DEF;
6170 DPRINTF(sc, IWN_DEBUG_RESET, "%s: configuring bluetooth coexistence\n",
6172 return iwn_cmd(sc, IWN_CMD_BT_COEX, &cmd, sizeof(cmd), 0);
6176 iwn_send_advanced_btcoex(struct iwn_softc *sc)
6178 static const uint32_t btcoex_3wire[12] = {
6179 0xaaaaaaaa, 0xaaaaaaaa, 0xaeaaaaaa, 0xaaaaaaaa,
6180 0xcc00ff28, 0x0000aaaa, 0xcc00aaaa, 0x0000aaaa,
6181 0xc0004000, 0x00004000, 0xf0005000, 0xf0005000,
6183 struct iwn6000_btcoex_config btconfig;
6184 struct iwn2000_btcoex_config btconfig2k;
6185 struct iwn_btcoex_priotable btprio;
6186 struct iwn_btcoex_prot btprot;
6190 memset(&btconfig, 0, sizeof btconfig);
6191 memset(&btconfig2k, 0, sizeof btconfig2k);
6193 flags = IWN_BT_FLAG_COEX6000_MODE_3W <<
6194 IWN_BT_FLAG_COEX6000_MODE_SHIFT; // Done as is in linux kernel 3.2
6196 if (sc->base_params->bt_sco_disable)
6197 flags &= ~IWN_BT_FLAG_SYNC_2_BT_DISABLE;
6199 flags |= IWN_BT_FLAG_SYNC_2_BT_DISABLE;
6201 flags |= IWN_BT_FLAG_COEX6000_CHAN_INHIBITION;
6203 /* Default flags result is 145 as old value */
6206 * Flags value has to be review. Values must change if we
6207 * which to disable it
6209 if (sc->base_params->bt_session_2) {
6210 btconfig2k.flags = flags;
6211 btconfig2k.max_kill = 5;
6212 btconfig2k.bt3_t7_timer = 1;
6213 btconfig2k.kill_ack = htole32(0xffff0000);
6214 btconfig2k.kill_cts = htole32(0xffff0000);
6215 btconfig2k.sample_time = 2;
6216 btconfig2k.bt3_t2_timer = 0xc;
6218 for (i = 0; i < 12; i++)
6219 btconfig2k.lookup_table[i] = htole32(btcoex_3wire[i]);
6220 btconfig2k.valid = htole16(0xff);
6221 btconfig2k.prio_boost = htole32(0xf0);
6222 DPRINTF(sc, IWN_DEBUG_RESET,
6223 "%s: configuring advanced bluetooth coexistence"
6224 " session 2, flags : 0x%x\n",
6227 error = iwn_cmd(sc, IWN_CMD_BT_COEX, &btconfig2k,
6228 sizeof(btconfig2k), 1);
6230 btconfig.flags = flags;
6231 btconfig.max_kill = 5;
6232 btconfig.bt3_t7_timer = 1;
6233 btconfig.kill_ack = htole32(0xffff0000);
6234 btconfig.kill_cts = htole32(0xffff0000);
6235 btconfig.sample_time = 2;
6236 btconfig.bt3_t2_timer = 0xc;
6238 for (i = 0; i < 12; i++)
6239 btconfig.lookup_table[i] = htole32(btcoex_3wire[i]);
6240 btconfig.valid = htole16(0xff);
6241 btconfig.prio_boost = 0xf0;
6242 DPRINTF(sc, IWN_DEBUG_RESET,
6243 "%s: configuring advanced bluetooth coexistence,"
6247 error = iwn_cmd(sc, IWN_CMD_BT_COEX, &btconfig,
6248 sizeof(btconfig), 1);
6254 memset(&btprio, 0, sizeof btprio);
6255 btprio.calib_init1 = 0x6;
6256 btprio.calib_init2 = 0x7;
6257 btprio.calib_periodic_low1 = 0x2;
6258 btprio.calib_periodic_low2 = 0x3;
6259 btprio.calib_periodic_high1 = 0x4;
6260 btprio.calib_periodic_high2 = 0x5;
6262 btprio.scan52 = 0x8;
6263 btprio.scan24 = 0xa;
6264 error = iwn_cmd(sc, IWN_CMD_BT_COEX_PRIOTABLE, &btprio, sizeof(btprio),
6269 /* Force BT state machine change. */
6270 memset(&btprot, 0, sizeof btprot);
6273 error = iwn_cmd(sc, IWN_CMD_BT_COEX_PROT, &btprot, sizeof(btprot), 1);
6277 return iwn_cmd(sc, IWN_CMD_BT_COEX_PROT, &btprot, sizeof(btprot), 1);
6281 iwn5000_runtime_calib(struct iwn_softc *sc)
6283 struct iwn5000_calib_config cmd;
6285 memset(&cmd, 0, sizeof cmd);
6286 cmd.ucode.once.enable = 0xffffffff;
6287 cmd.ucode.once.start = IWN5000_CALIB_DC;
6288 DPRINTF(sc, IWN_DEBUG_CALIBRATE,
6289 "%s: configuring runtime calibration\n", __func__);
6290 return iwn_cmd(sc, IWN5000_CMD_CALIB_CONFIG, &cmd, sizeof(cmd), 0);
6294 iwn_config(struct iwn_softc *sc)
6296 struct iwn_ops *ops = &sc->ops;
6297 struct ifnet *ifp = sc->sc_ifp;
6298 struct ieee80211com *ic = ifp->if_l2com;
6303 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
6305 if ((sc->base_params->calib_need & IWN_FLG_NEED_PHY_CALIB_TEMP_OFFSET)
6306 && (sc->base_params->calib_need & IWN_FLG_NEED_PHY_CALIB_TEMP_OFFSETv2)) {
6307 device_printf(sc->sc_dev,"%s: temp_offset and temp_offsetv2 are"
6308 " exclusive each together. Review NIC config file. Conf"
6309 " : 0x%08x Flags : 0x%08x \n", __func__,
6310 sc->base_params->calib_need,
6311 (IWN_FLG_NEED_PHY_CALIB_TEMP_OFFSET |
6312 IWN_FLG_NEED_PHY_CALIB_TEMP_OFFSETv2));
6316 /* Compute temperature calib if needed. Will be send by send calib */
6317 if (sc->base_params->calib_need & IWN_FLG_NEED_PHY_CALIB_TEMP_OFFSET) {
6318 error = iwn5000_temp_offset_calib(sc);
6320 device_printf(sc->sc_dev,
6321 "%s: could not set temperature offset\n", __func__);
6324 } else if (sc->base_params->calib_need & IWN_FLG_NEED_PHY_CALIB_TEMP_OFFSETv2) {
6325 error = iwn5000_temp_offset_calibv2(sc);
6327 device_printf(sc->sc_dev,
6328 "%s: could not compute temperature offset v2\n",
6334 if (sc->hw_type == IWN_HW_REV_TYPE_6050) {
6335 /* Configure runtime DC calibration. */
6336 error = iwn5000_runtime_calib(sc);
6338 device_printf(sc->sc_dev,
6339 "%s: could not configure runtime calibration\n",
6345 /* Configure valid TX chains for >=5000 Series. */
6346 if (sc->hw_type != IWN_HW_REV_TYPE_4965) {
6347 txmask = htole32(sc->txchainmask);
6348 DPRINTF(sc, IWN_DEBUG_RESET,
6349 "%s: configuring valid TX chains 0x%x\n", __func__, txmask);
6350 error = iwn_cmd(sc, IWN5000_CMD_TX_ANT_CONFIG, &txmask,
6353 device_printf(sc->sc_dev,
6354 "%s: could not configure valid TX chains, "
6355 "error %d\n", __func__, error);
6360 /* Configure bluetooth coexistence. */
6363 /* Configure bluetooth coexistence if needed. */
6364 if (sc->base_params->bt_mode == IWN_BT_ADVANCED)
6365 error = iwn_send_advanced_btcoex(sc);
6366 if (sc->base_params->bt_mode == IWN_BT_SIMPLE)
6367 error = iwn_send_btcoex(sc);
6370 device_printf(sc->sc_dev,
6371 "%s: could not configure bluetooth coexistence, error %d\n",
6376 /* Set mode, channel, RX filter and enable RX. */
6377 sc->rxon = &sc->rx_on[IWN_RXON_BSS_CTX];
6378 memset(sc->rxon, 0, sizeof (struct iwn_rxon));
6379 IEEE80211_ADDR_COPY(sc->rxon->myaddr, IF_LLADDR(ifp));
6380 IEEE80211_ADDR_COPY(sc->rxon->wlap, IF_LLADDR(ifp));
6381 sc->rxon->chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
6382 sc->rxon->flags = htole32(IWN_RXON_TSF | IWN_RXON_CTS_TO_SELF);
6383 if (IEEE80211_IS_CHAN_2GHZ(ic->ic_curchan))
6384 sc->rxon->flags |= htole32(IWN_RXON_AUTO | IWN_RXON_24GHZ);
6385 switch (ic->ic_opmode) {
6386 case IEEE80211_M_STA:
6387 sc->rxon->mode = IWN_MODE_STA;
6388 sc->rxon->filter = htole32(IWN_FILTER_MULTICAST);
6390 case IEEE80211_M_MONITOR:
6391 sc->rxon->mode = IWN_MODE_MONITOR;
6392 sc->rxon->filter = htole32(IWN_FILTER_MULTICAST |
6393 IWN_FILTER_CTL | IWN_FILTER_PROMISC);
6396 /* Should not get there. */
6399 sc->rxon->cck_mask = 0x0f; /* not yet negotiated */
6400 sc->rxon->ofdm_mask = 0xff; /* not yet negotiated */
6401 sc->rxon->ht_single_mask = 0xff;
6402 sc->rxon->ht_dual_mask = 0xff;
6403 sc->rxon->ht_triple_mask = 0xff;
6405 IWN_RXCHAIN_VALID(sc->rxchainmask) |
6406 IWN_RXCHAIN_MIMO_COUNT(2) |
6407 IWN_RXCHAIN_IDLE_COUNT(2);
6408 sc->rxon->rxchain = htole16(rxchain);
6409 DPRINTF(sc, IWN_DEBUG_RESET, "%s: setting configuration\n", __func__);
6410 if (sc->sc_is_scanning)
6411 device_printf(sc->sc_dev,
6412 "%s: is_scanning set, before RXON\n",
6414 error = iwn_cmd(sc, IWN_CMD_RXON, sc->rxon, sc->rxonsz, 0);
6416 device_printf(sc->sc_dev, "%s: RXON command failed\n",
6421 if ((error = iwn_add_broadcast_node(sc, 0)) != 0) {
6422 device_printf(sc->sc_dev, "%s: could not add broadcast node\n",
6427 /* Configuration has changed, set TX power accordingly. */
6428 if ((error = ops->set_txpower(sc, ic->ic_curchan, 0)) != 0) {
6429 device_printf(sc->sc_dev, "%s: could not set TX power\n",
6434 if ((error = iwn_set_critical_temp(sc)) != 0) {
6435 device_printf(sc->sc_dev,
6436 "%s: could not set critical temperature\n", __func__);
6440 /* Set power saving level to CAM during initialization. */
6441 if ((error = iwn_set_pslevel(sc, 0, 0, 0)) != 0) {
6442 device_printf(sc->sc_dev,
6443 "%s: could not set power saving level\n", __func__);
6447 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
6453 * Add an ssid element to a frame.
6456 ieee80211_add_ssid(uint8_t *frm, const uint8_t *ssid, u_int len)
6458 *frm++ = IEEE80211_ELEMID_SSID;
6460 memcpy(frm, ssid, len);
6465 iwn_get_active_dwell_time(struct iwn_softc *sc,
6466 struct ieee80211_channel *c, uint8_t n_probes)
6468 /* No channel? Default to 2GHz settings */
6469 if (c == NULL || IEEE80211_IS_CHAN_2GHZ(c)) {
6470 return (IWN_ACTIVE_DWELL_TIME_2GHZ +
6471 IWN_ACTIVE_DWELL_FACTOR_2GHZ * (n_probes + 1));
6474 /* 5GHz dwell time */
6475 return (IWN_ACTIVE_DWELL_TIME_5GHZ +
6476 IWN_ACTIVE_DWELL_FACTOR_5GHZ * (n_probes + 1));
6480 * Limit the total dwell time to 85% of the beacon interval.
6482 * Returns the dwell time in milliseconds.
6485 iwn_limit_dwell(struct iwn_softc *sc, uint16_t dwell_time)
6487 struct ieee80211com *ic = sc->sc_ifp->if_l2com;
6488 struct ieee80211vap *vap = NULL;
6491 /* bintval is in TU (1.024mS) */
6492 if (! TAILQ_EMPTY(&ic->ic_vaps)) {
6493 vap = TAILQ_FIRST(&ic->ic_vaps);
6494 bintval = vap->iv_bss->ni_intval;
6498 * If it's non-zero, we should calculate the minimum of
6499 * it and the DWELL_BASE.
6501 * XXX Yes, the math should take into account that bintval
6502 * is 1.024mS, not 1mS..
6505 DPRINTF(sc, IWN_DEBUG_SCAN,
6509 return (MIN(IWN_PASSIVE_DWELL_BASE, ((bintval * 85) / 100)));
6512 /* No association context? Default */
6513 return (IWN_PASSIVE_DWELL_BASE);
6517 iwn_get_passive_dwell_time(struct iwn_softc *sc, struct ieee80211_channel *c)
6521 if (c == NULL || IEEE80211_IS_CHAN_2GHZ(c)) {
6522 passive = IWN_PASSIVE_DWELL_BASE + IWN_PASSIVE_DWELL_TIME_2GHZ;
6524 passive = IWN_PASSIVE_DWELL_BASE + IWN_PASSIVE_DWELL_TIME_5GHZ;
6527 /* Clamp to the beacon interval if we're associated */
6528 return (iwn_limit_dwell(sc, passive));
6532 iwn_scan(struct iwn_softc *sc, struct ieee80211vap *vap,
6533 struct ieee80211_scan_state *ss, struct ieee80211_channel *c)
6535 struct ifnet *ifp = sc->sc_ifp;
6536 struct ieee80211com *ic = ifp->if_l2com;
6537 struct ieee80211_node *ni = vap->iv_bss;
6538 struct iwn_scan_hdr *hdr;
6539 struct iwn_cmd_data *tx;
6540 struct iwn_scan_essid *essid;
6541 struct iwn_scan_chan *chan;
6542 struct ieee80211_frame *wh;
6543 struct ieee80211_rateset *rs;
6549 uint16_t dwell_active, dwell_passive;
6550 uint32_t extra, scan_service_time;
6552 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
6555 * We are absolutely not allowed to send a scan command when another
6556 * scan command is pending.
6558 if (sc->sc_is_scanning) {
6559 device_printf(sc->sc_dev, "%s: called whilst scanning!\n",
6564 /* Assign the scan channel */
6567 sc->rxon = &sc->rx_on[IWN_RXON_BSS_CTX];
6568 buf = kmalloc(IWN_SCAN_MAXSZ, M_DEVBUF, M_INTWAIT | M_ZERO);
6569 hdr = (struct iwn_scan_hdr *)buf;
6571 * Move to the next channel if no frames are received within 10ms
6572 * after sending the probe request.
6574 hdr->quiet_time = htole16(10); /* timeout in milliseconds */
6575 hdr->quiet_threshold = htole16(1); /* min # of packets */
6577 * Max needs to be greater than active and passive and quiet!
6578 * It's also in microseconds!
6580 hdr->max_svc = htole32(250 * 1024);
6583 * Reset scan: interval=100
6584 * Normal scan: interval=becaon interval
6585 * suspend_time: 100 (TU)
6588 extra = (100 /* suspend_time */ / 100 /* beacon interval */) << 22;
6589 //scan_service_time = extra | ((100 /* susp */ % 100 /* int */) * 1024);
6590 scan_service_time = (4 << 22) | (100 * 1024); /* Hardcode for now! */
6591 hdr->pause_svc = htole32(scan_service_time);
6593 /* Select antennas for scanning. */
6595 IWN_RXCHAIN_VALID(sc->rxchainmask) |
6596 IWN_RXCHAIN_FORCE_MIMO_SEL(sc->rxchainmask) |
6597 IWN_RXCHAIN_DRIVER_FORCE;
6598 if (IEEE80211_IS_CHAN_A(c) &&
6599 sc->hw_type == IWN_HW_REV_TYPE_4965) {
6600 /* Ant A must be avoided in 5GHz because of an HW bug. */
6601 rxchain |= IWN_RXCHAIN_FORCE_SEL(IWN_ANT_B);
6602 } else /* Use all available RX antennas. */
6603 rxchain |= IWN_RXCHAIN_FORCE_SEL(sc->rxchainmask);
6604 hdr->rxchain = htole16(rxchain);
6605 hdr->filter = htole32(IWN_FILTER_MULTICAST | IWN_FILTER_BEACON);
6607 tx = (struct iwn_cmd_data *)(hdr + 1);
6608 tx->flags = htole32(IWN_TX_AUTO_SEQ);
6609 tx->id = sc->broadcast_id;
6610 tx->lifetime = htole32(IWN_LIFETIME_INFINITE);
6612 if (IEEE80211_IS_CHAN_5GHZ(c)) {
6613 /* Send probe requests at 6Mbps. */
6614 tx->rate = htole32(0xd);
6615 rs = &ic->ic_sup_rates[IEEE80211_MODE_11A];
6617 hdr->flags = htole32(IWN_RXON_24GHZ | IWN_RXON_AUTO);
6618 if (sc->hw_type == IWN_HW_REV_TYPE_4965 &&
6619 sc->rxon->associd && sc->rxon->chan > 14)
6620 tx->rate = htole32(0xd);
6622 /* Send probe requests at 1Mbps. */
6623 tx->rate = htole32(10 | IWN_RFLAG_CCK);
6625 rs = &ic->ic_sup_rates[IEEE80211_MODE_11G];
6627 /* Use the first valid TX antenna. */
6628 txant = IWN_LSB(sc->txchainmask);
6629 tx->rate |= htole32(IWN_RFLAG_ANT(txant));
6632 * Only do active scanning if we're announcing a probe request
6633 * for a given SSID (or more, if we ever add it to the driver.)
6638 * If we're scanning for a specific SSID, add it to the command.
6640 * XXX maybe look at adding support for scanning multiple SSIDs?
6642 essid = (struct iwn_scan_essid *)(tx + 1);
6644 if (ss->ss_ssid[0].len != 0) {
6645 essid[0].id = IEEE80211_ELEMID_SSID;
6646 essid[0].len = ss->ss_ssid[0].len;
6647 memcpy(essid[0].data, ss->ss_ssid[0].ssid, ss->ss_ssid[0].len);
6650 DPRINTF(sc, IWN_DEBUG_SCAN, "%s: ssid_len=%d, ssid=%*s\n",
6654 ss->ss_ssid[0].ssid);
6656 if (ss->ss_nssid > 0)
6661 * Build a probe request frame. Most of the following code is a
6662 * copy & paste of what is done in net80211.
6664 wh = (struct ieee80211_frame *)(essid + 20);
6665 wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
6666 IEEE80211_FC0_SUBTYPE_PROBE_REQ;
6667 wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
6668 IEEE80211_ADDR_COPY(wh->i_addr1, ifp->if_broadcastaddr);
6669 IEEE80211_ADDR_COPY(wh->i_addr2, IF_LLADDR(ifp));
6670 IEEE80211_ADDR_COPY(wh->i_addr3, ifp->if_broadcastaddr);
6671 *(uint16_t *)&wh->i_dur[0] = 0; /* filled by HW */
6672 *(uint16_t *)&wh->i_seq[0] = 0; /* filled by HW */
6674 frm = (uint8_t *)(wh + 1);
6675 frm = ieee80211_add_ssid(frm, NULL, 0);
6676 frm = ieee80211_add_rates(frm, rs);
6677 if (rs->rs_nrates > IEEE80211_RATE_SIZE)
6678 frm = ieee80211_add_xrates(frm, rs);
6679 if (ic->ic_htcaps & IEEE80211_HTC_HT)
6680 frm = ieee80211_add_htcap(frm, ni);
6682 /* Set length of probe request. */
6683 tx->len = htole16(frm - (uint8_t *)wh);
6686 * If active scanning is requested but a certain channel is
6687 * marked passive, we can do active scanning if we detect
6690 * There is an issue with some firmware versions that triggers
6691 * a sysassert on a "good CRC threshold" of zero (== disabled),
6692 * on a radar channel even though this means that we should NOT
6695 * The "good CRC threshold" is the number of frames that we
6696 * need to receive during our dwell time on a channel before
6697 * sending out probes -- setting this to a huge value will
6698 * mean we never reach it, but at the same time work around
6699 * the aforementioned issue. Thus use IWL_GOOD_CRC_TH_NEVER
6700 * here instead of IWL_GOOD_CRC_TH_DISABLED.
6702 * This was fixed in later versions along with some other
6703 * scan changes, and the threshold behaves as a flag in those
6708 * If we're doing active scanning, set the crc_threshold
6709 * to a suitable value. This is different to active veruss
6710 * passive scanning depending upon the channel flags; the
6711 * firmware will obey that particular check for us.
6713 if (sc->tlv_feature_flags & IWN_UCODE_TLV_FLAGS_NEWSCAN)
6714 hdr->crc_threshold = is_active ?
6715 IWN_GOOD_CRC_TH_DEFAULT : IWN_GOOD_CRC_TH_DISABLED;
6717 hdr->crc_threshold = is_active ?
6718 IWN_GOOD_CRC_TH_DEFAULT : IWN_GOOD_CRC_TH_NEVER;
6720 chan = (struct iwn_scan_chan *)frm;
6721 chan->chan = htole16(ieee80211_chan2ieee(ic, c));
6723 if (ss->ss_nssid > 0)
6724 chan->flags |= htole32(IWN_CHAN_NPBREQS(1));
6725 chan->dsp_gain = 0x6e;
6728 * Set the passive/active flag depending upon the channel mode.
6729 * XXX TODO: take the is_active flag into account as well?
6731 if (c->ic_flags & IEEE80211_CHAN_PASSIVE)
6732 chan->flags |= htole32(IWN_CHAN_PASSIVE);
6734 chan->flags |= htole32(IWN_CHAN_ACTIVE);
6737 * Calculate the active/passive dwell times.
6740 dwell_active = iwn_get_active_dwell_time(sc, c, ss->ss_nssid);
6741 dwell_passive = iwn_get_passive_dwell_time(sc, c);
6743 /* Make sure they're valid */
6744 if (dwell_passive <= dwell_active)
6745 dwell_passive = dwell_active + 1;
6747 chan->active = htole16(dwell_active);
6748 chan->passive = htole16(dwell_passive);
6750 if (IEEE80211_IS_CHAN_5GHZ(c) &&
6751 !(c->ic_flags & IEEE80211_CHAN_PASSIVE)) {
6752 chan->rf_gain = 0x3b;
6753 } else if (IEEE80211_IS_CHAN_5GHZ(c)) {
6754 chan->rf_gain = 0x3b;
6755 } else if (!(c->ic_flags & IEEE80211_CHAN_PASSIVE)) {
6756 chan->rf_gain = 0x28;
6758 chan->rf_gain = 0x28;
6761 DPRINTF(sc, IWN_DEBUG_STATE,
6762 "%s: chan %u flags 0x%x rf_gain 0x%x "
6763 "dsp_gain 0x%x active %d passive %d scan_svc_time %d crc 0x%x "
6764 "isactive=%d numssid=%d\n", __func__,
6765 chan->chan, chan->flags, chan->rf_gain, chan->dsp_gain,
6766 dwell_active, dwell_passive, scan_service_time,
6767 hdr->crc_threshold, is_active, ss->ss_nssid);
6771 buflen = (uint8_t *)chan - buf;
6772 hdr->len = htole16(buflen);
6774 if (sc->sc_is_scanning) {
6775 device_printf(sc->sc_dev,
6776 "%s: called with is_scanning set!\n",
6779 sc->sc_is_scanning = 1;
6781 DPRINTF(sc, IWN_DEBUG_STATE, "sending scan command nchan=%d\n",
6783 error = iwn_cmd(sc, IWN_CMD_SCAN, buf, buflen, 1);
6784 kfree(buf, M_DEVBUF);
6786 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
6792 iwn_auth(struct iwn_softc *sc, struct ieee80211vap *vap)
6794 struct iwn_ops *ops = &sc->ops;
6795 struct ifnet *ifp = sc->sc_ifp;
6796 struct ieee80211com *ic = ifp->if_l2com;
6797 struct ieee80211_node *ni = vap->iv_bss;
6800 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
6802 sc->rxon = &sc->rx_on[IWN_RXON_BSS_CTX];
6803 /* Update adapter configuration. */
6804 IEEE80211_ADDR_COPY(sc->rxon->bssid, ni->ni_bssid);
6805 sc->rxon->chan = ieee80211_chan2ieee(ic, ni->ni_chan);
6806 sc->rxon->flags = htole32(IWN_RXON_TSF | IWN_RXON_CTS_TO_SELF);
6807 if (IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
6808 sc->rxon->flags |= htole32(IWN_RXON_AUTO | IWN_RXON_24GHZ);
6809 if (ic->ic_flags & IEEE80211_F_SHSLOT)
6810 sc->rxon->flags |= htole32(IWN_RXON_SHSLOT);
6811 if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
6812 sc->rxon->flags |= htole32(IWN_RXON_SHPREAMBLE);
6813 if (IEEE80211_IS_CHAN_A(ni->ni_chan)) {
6814 sc->rxon->cck_mask = 0;
6815 sc->rxon->ofdm_mask = 0x15;
6816 } else if (IEEE80211_IS_CHAN_B(ni->ni_chan)) {
6817 sc->rxon->cck_mask = 0x03;
6818 sc->rxon->ofdm_mask = 0;
6820 /* Assume 802.11b/g. */
6821 sc->rxon->cck_mask = 0x03;
6822 sc->rxon->ofdm_mask = 0x15;
6824 DPRINTF(sc, IWN_DEBUG_STATE, "rxon chan %d flags %x cck %x ofdm %x\n",
6825 sc->rxon->chan, sc->rxon->flags, sc->rxon->cck_mask,
6826 sc->rxon->ofdm_mask);
6827 if (sc->sc_is_scanning)
6828 device_printf(sc->sc_dev,
6829 "%s: is_scanning set, before RXON\n",
6831 error = iwn_cmd(sc, IWN_CMD_RXON, sc->rxon, sc->rxonsz, 1);
6833 device_printf(sc->sc_dev, "%s: RXON command failed, error %d\n",
6838 /* Configuration has changed, set TX power accordingly. */
6839 if ((error = ops->set_txpower(sc, ni->ni_chan, 1)) != 0) {
6840 device_printf(sc->sc_dev,
6841 "%s: could not set TX power, error %d\n", __func__, error);
6845 * Reconfiguring RXON clears the firmware nodes table so we must
6846 * add the broadcast node again.
6848 if ((error = iwn_add_broadcast_node(sc, 1)) != 0) {
6849 device_printf(sc->sc_dev,
6850 "%s: could not add broadcast node, error %d\n", __func__,
6855 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
6861 iwn_run(struct iwn_softc *sc, struct ieee80211vap *vap)
6863 struct iwn_ops *ops = &sc->ops;
6864 struct ifnet *ifp = sc->sc_ifp;
6865 struct ieee80211com *ic = ifp->if_l2com;
6866 struct ieee80211_node *ni = vap->iv_bss;
6867 struct iwn_node_info node;
6868 uint32_t htflags = 0;
6871 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
6873 sc->rxon = &sc->rx_on[IWN_RXON_BSS_CTX];
6874 if (ic->ic_opmode == IEEE80211_M_MONITOR) {
6875 /* Link LED blinks while monitoring. */
6876 iwn_set_led(sc, IWN_LED_LINK, 5, 5);
6879 if ((error = iwn_set_timing(sc, ni)) != 0) {
6880 device_printf(sc->sc_dev,
6881 "%s: could not set timing, error %d\n", __func__, error);
6885 /* Update adapter configuration. */
6886 IEEE80211_ADDR_COPY(sc->rxon->bssid, ni->ni_bssid);
6887 sc->rxon->associd = htole16(IEEE80211_AID(ni->ni_associd));
6888 sc->rxon->chan = ieee80211_chan2ieee(ic, ni->ni_chan);
6889 sc->rxon->flags = htole32(IWN_RXON_TSF | IWN_RXON_CTS_TO_SELF);
6890 if (IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
6891 sc->rxon->flags |= htole32(IWN_RXON_AUTO | IWN_RXON_24GHZ);
6892 if (ic->ic_flags & IEEE80211_F_SHSLOT)
6893 sc->rxon->flags |= htole32(IWN_RXON_SHSLOT);
6894 if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
6895 sc->rxon->flags |= htole32(IWN_RXON_SHPREAMBLE);
6896 if (IEEE80211_IS_CHAN_A(ni->ni_chan)) {
6897 sc->rxon->cck_mask = 0;
6898 sc->rxon->ofdm_mask = 0x15;
6899 } else if (IEEE80211_IS_CHAN_B(ni->ni_chan)) {
6900 sc->rxon->cck_mask = 0x03;
6901 sc->rxon->ofdm_mask = 0;
6903 /* Assume 802.11b/g. */
6904 sc->rxon->cck_mask = 0x0f;
6905 sc->rxon->ofdm_mask = 0x15;
6907 if (IEEE80211_IS_CHAN_HT(ni->ni_chan)) {
6908 htflags |= IWN_RXON_HT_PROTMODE(ic->ic_curhtprotmode);
6909 if (IEEE80211_IS_CHAN_HT40(ni->ni_chan)) {
6910 switch (ic->ic_curhtprotmode) {
6911 case IEEE80211_HTINFO_OPMODE_HT20PR:
6912 htflags |= IWN_RXON_HT_MODEPURE40;
6915 htflags |= IWN_RXON_HT_MODEMIXED;
6919 if (IEEE80211_IS_CHAN_HT40D(ni->ni_chan))
6920 htflags |= IWN_RXON_HT_HT40MINUS;
6922 sc->rxon->flags |= htole32(htflags);
6923 sc->rxon->filter |= htole32(IWN_FILTER_BSS);
6924 DPRINTF(sc, IWN_DEBUG_STATE, "rxon chan %d flags %x\n",
6925 sc->rxon->chan, sc->rxon->flags);
6926 if (sc->sc_is_scanning)
6927 device_printf(sc->sc_dev,
6928 "%s: is_scanning set, before RXON\n",
6930 error = iwn_cmd(sc, IWN_CMD_RXON, sc->rxon, sc->rxonsz, 1);
6932 device_printf(sc->sc_dev,
6933 "%s: could not update configuration, error %d\n", __func__,
6938 /* Configuration has changed, set TX power accordingly. */
6939 if ((error = ops->set_txpower(sc, ni->ni_chan, 1)) != 0) {
6940 device_printf(sc->sc_dev,
6941 "%s: could not set TX power, error %d\n", __func__, error);
6945 /* Fake a join to initialize the TX rate. */
6946 ((struct iwn_node *)ni)->id = IWN_ID_BSS;
6947 iwn_newassoc(ni, 1);
6950 memset(&node, 0, sizeof node);
6951 IEEE80211_ADDR_COPY(node.macaddr, ni->ni_macaddr);
6952 node.id = IWN_ID_BSS;
6953 if (IEEE80211_IS_CHAN_HT(ni->ni_chan)) {
6954 switch (ni->ni_htcap & IEEE80211_HTCAP_SMPS) {
6955 case IEEE80211_HTCAP_SMPS_ENA:
6956 node.htflags |= htole32(IWN_SMPS_MIMO_DIS);
6958 case IEEE80211_HTCAP_SMPS_DYNAMIC:
6959 node.htflags |= htole32(IWN_SMPS_MIMO_PROT);
6962 node.htflags |= htole32(IWN_AMDPU_SIZE_FACTOR(3) |
6963 IWN_AMDPU_DENSITY(5)); /* 4us */
6964 if (IEEE80211_IS_CHAN_HT40(ni->ni_chan))
6965 node.htflags |= htole32(IWN_NODE_HT40);
6967 DPRINTF(sc, IWN_DEBUG_STATE, "%s: adding BSS node\n", __func__);
6968 error = ops->add_node(sc, &node, 1);
6970 device_printf(sc->sc_dev,
6971 "%s: could not add BSS node, error %d\n", __func__, error);
6974 DPRINTF(sc, IWN_DEBUG_STATE, "%s: setting link quality for node %d\n",
6976 if ((error = iwn_set_link_quality(sc, ni)) != 0) {
6977 device_printf(sc->sc_dev,
6978 "%s: could not setup link quality for node %d, error %d\n",
6979 __func__, node.id, error);
6983 if ((error = iwn_init_sensitivity(sc)) != 0) {
6984 device_printf(sc->sc_dev,
6985 "%s: could not set sensitivity, error %d\n", __func__,
6989 /* Start periodic calibration timer. */
6990 sc->calib.state = IWN_CALIB_STATE_ASSOC;
6992 callout_reset(&sc->calib_to, msecs_to_ticks(500), iwn_calib_timeout,
6995 /* Link LED always on while associated. */
6996 iwn_set_led(sc, IWN_LED_LINK, 0, 1);
6998 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
7004 * This function is called by upper layer when an ADDBA request is received
7005 * from another STA and before the ADDBA response is sent.
7008 iwn_ampdu_rx_start(struct ieee80211_node *ni, struct ieee80211_rx_ampdu *rap,
7009 int baparamset, int batimeout, int baseqctl)
7011 #define MS(_v, _f) (((_v) & _f) >> _f##_S)
7012 struct iwn_softc *sc = ni->ni_ic->ic_ifp->if_softc;
7013 struct iwn_ops *ops = &sc->ops;
7014 struct iwn_node *wn = (void *)ni;
7015 struct iwn_node_info node;
7020 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
7022 tid = MS(le16toh(baparamset), IEEE80211_BAPS_TID);
7023 ssn = MS(le16toh(baseqctl), IEEE80211_BASEQ_START);
7025 memset(&node, 0, sizeof node);
7027 node.control = IWN_NODE_UPDATE;
7028 node.flags = IWN_FLAG_SET_ADDBA;
7029 node.addba_tid = tid;
7030 node.addba_ssn = htole16(ssn);
7031 DPRINTF(sc, IWN_DEBUG_RECV, "ADDBA RA=%d TID=%d SSN=%d\n",
7033 error = ops->add_node(sc, &node, 1);
7036 return sc->sc_ampdu_rx_start(ni, rap, baparamset, batimeout, baseqctl);
7041 * This function is called by upper layer on teardown of an HT-immediate
7042 * Block Ack agreement (eg. uppon receipt of a DELBA frame).
7045 iwn_ampdu_rx_stop(struct ieee80211_node *ni, struct ieee80211_rx_ampdu *rap)
7047 struct ieee80211com *ic = ni->ni_ic;
7048 struct iwn_softc *sc = ic->ic_ifp->if_softc;
7049 struct iwn_ops *ops = &sc->ops;
7050 struct iwn_node *wn = (void *)ni;
7051 struct iwn_node_info node;
7054 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
7056 /* XXX: tid as an argument */
7057 for (tid = 0; tid < WME_NUM_TID; tid++) {
7058 if (&ni->ni_rx_ampdu[tid] == rap)
7062 memset(&node, 0, sizeof node);
7064 node.control = IWN_NODE_UPDATE;
7065 node.flags = IWN_FLAG_SET_DELBA;
7066 node.delba_tid = tid;
7067 DPRINTF(sc, IWN_DEBUG_RECV, "DELBA RA=%d TID=%d\n", wn->id, tid);
7068 (void)ops->add_node(sc, &node, 1);
7069 sc->sc_ampdu_rx_stop(ni, rap);
7073 iwn_addba_request(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap,
7074 int dialogtoken, int baparamset, int batimeout)
7076 struct iwn_softc *sc = ni->ni_ic->ic_ifp->if_softc;
7079 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
7081 for (qid = sc->firstaggqueue; qid < sc->ntxqs; qid++) {
7082 if (sc->qid2tap[qid] == NULL)
7085 if (qid == sc->ntxqs) {
7086 DPRINTF(sc, IWN_DEBUG_XMIT, "%s: not free aggregation queue\n",
7090 tap->txa_private = kmalloc(sizeof(int), M_DEVBUF, M_INTWAIT);
7091 sc->qid2tap[qid] = tap;
7092 *(int *)tap->txa_private = qid;
7093 return sc->sc_addba_request(ni, tap, dialogtoken, baparamset,
7098 iwn_addba_response(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap,
7099 int code, int baparamset, int batimeout)
7101 struct iwn_softc *sc = ni->ni_ic->ic_ifp->if_softc;
7102 int qid = *(int *)tap->txa_private;
7103 uint8_t tid = tap->txa_ac;
7106 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
7108 if (code == IEEE80211_STATUS_SUCCESS) {
7109 ni->ni_txseqs[tid] = tap->txa_start & 0xfff;
7110 ret = iwn_ampdu_tx_start(ni->ni_ic, ni, tid);
7114 sc->qid2tap[qid] = NULL;
7115 kfree(tap->txa_private, M_DEVBUF);
7116 tap->txa_private = NULL;
7118 return sc->sc_addba_response(ni, tap, code, baparamset, batimeout);
7122 * This function is called by upper layer when an ADDBA response is received
7126 iwn_ampdu_tx_start(struct ieee80211com *ic, struct ieee80211_node *ni,
7129 struct ieee80211_tx_ampdu *tap = &ni->ni_tx_ampdu[tid];
7130 struct iwn_softc *sc = ni->ni_ic->ic_ifp->if_softc;
7131 struct iwn_ops *ops = &sc->ops;
7132 struct iwn_node *wn = (void *)ni;
7133 struct iwn_node_info node;
7136 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
7138 /* Enable TX for the specified RA/TID. */
7139 wn->disable_tid &= ~(1 << tid);
7140 memset(&node, 0, sizeof node);
7142 node.control = IWN_NODE_UPDATE;
7143 node.flags = IWN_FLAG_SET_DISABLE_TID;
7144 node.disable_tid = htole16(wn->disable_tid);
7145 error = ops->add_node(sc, &node, 1);
7149 if ((error = iwn_nic_lock(sc)) != 0)
7151 qid = *(int *)tap->txa_private;
7152 DPRINTF(sc, IWN_DEBUG_XMIT, "%s: ra=%d tid=%d ssn=%d qid=%d\n",
7153 __func__, wn->id, tid, tap->txa_start, qid);
7154 ops->ampdu_tx_start(sc, ni, qid, tid, tap->txa_start & 0xfff);
7157 iwn_set_link_quality(sc, ni);
7162 iwn_ampdu_tx_stop(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
7164 struct iwn_softc *sc = ni->ni_ic->ic_ifp->if_softc;
7165 struct iwn_ops *ops = &sc->ops;
7166 uint8_t tid = tap->txa_ac;
7169 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
7171 sc->sc_addba_stop(ni, tap);
7173 if (tap->txa_private == NULL)
7176 qid = *(int *)tap->txa_private;
7177 if (sc->txq[qid].queued != 0)
7179 if (iwn_nic_lock(sc) != 0)
7181 ops->ampdu_tx_stop(sc, qid, tid, tap->txa_start & 0xfff);
7183 sc->qid2tap[qid] = NULL;
7184 kfree(tap->txa_private, M_DEVBUF);
7185 tap->txa_private = NULL;
7189 iwn4965_ampdu_tx_start(struct iwn_softc *sc, struct ieee80211_node *ni,
7190 int qid, uint8_t tid, uint16_t ssn)
7192 struct iwn_node *wn = (void *)ni;
7194 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
7196 /* Stop TX scheduler while we're changing its configuration. */
7197 iwn_prph_write(sc, IWN4965_SCHED_QUEUE_STATUS(qid),
7198 IWN4965_TXQ_STATUS_CHGACT);
7200 /* Assign RA/TID translation to the queue. */
7201 iwn_mem_write_2(sc, sc->sched_base + IWN4965_SCHED_TRANS_TBL(qid),
7204 /* Enable chain-building mode for the queue. */
7205 iwn_prph_setbits(sc, IWN4965_SCHED_QCHAIN_SEL, 1 << qid);
7207 /* Set starting sequence number from the ADDBA request. */
7208 sc->txq[qid].cur = sc->txq[qid].read = (ssn & 0xff);
7209 IWN_WRITE(sc, IWN_HBUS_TARG_WRPTR, qid << 8 | (ssn & 0xff));
7210 iwn_prph_write(sc, IWN4965_SCHED_QUEUE_RDPTR(qid), ssn);
7212 /* Set scheduler window size. */
7213 iwn_mem_write(sc, sc->sched_base + IWN4965_SCHED_QUEUE_OFFSET(qid),
7215 /* Set scheduler frame limit. */
7216 iwn_mem_write(sc, sc->sched_base + IWN4965_SCHED_QUEUE_OFFSET(qid) + 4,
7217 IWN_SCHED_LIMIT << 16);
7219 /* Enable interrupts for the queue. */
7220 iwn_prph_setbits(sc, IWN4965_SCHED_INTR_MASK, 1 << qid);
7222 /* Mark the queue as active. */
7223 iwn_prph_write(sc, IWN4965_SCHED_QUEUE_STATUS(qid),
7224 IWN4965_TXQ_STATUS_ACTIVE | IWN4965_TXQ_STATUS_AGGR_ENA |
7225 iwn_tid2fifo[tid] << 1);
7229 iwn4965_ampdu_tx_stop(struct iwn_softc *sc, int qid, uint8_t tid, uint16_t ssn)
7231 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
7233 /* Stop TX scheduler while we're changing its configuration. */
7234 iwn_prph_write(sc, IWN4965_SCHED_QUEUE_STATUS(qid),
7235 IWN4965_TXQ_STATUS_CHGACT);
7237 /* Set starting sequence number from the ADDBA request. */
7238 IWN_WRITE(sc, IWN_HBUS_TARG_WRPTR, qid << 8 | (ssn & 0xff));
7239 iwn_prph_write(sc, IWN4965_SCHED_QUEUE_RDPTR(qid), ssn);
7241 /* Disable interrupts for the queue. */
7242 iwn_prph_clrbits(sc, IWN4965_SCHED_INTR_MASK, 1 << qid);
7244 /* Mark the queue as inactive. */
7245 iwn_prph_write(sc, IWN4965_SCHED_QUEUE_STATUS(qid),
7246 IWN4965_TXQ_STATUS_INACTIVE | iwn_tid2fifo[tid] << 1);
7250 iwn5000_ampdu_tx_start(struct iwn_softc *sc, struct ieee80211_node *ni,
7251 int qid, uint8_t tid, uint16_t ssn)
7253 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
7255 struct iwn_node *wn = (void *)ni;
7257 /* Stop TX scheduler while we're changing its configuration. */
7258 iwn_prph_write(sc, IWN5000_SCHED_QUEUE_STATUS(qid),
7259 IWN5000_TXQ_STATUS_CHGACT);
7261 /* Assign RA/TID translation to the queue. */
7262 iwn_mem_write_2(sc, sc->sched_base + IWN5000_SCHED_TRANS_TBL(qid),
7265 /* Enable chain-building mode for the queue. */
7266 iwn_prph_setbits(sc, IWN5000_SCHED_QCHAIN_SEL, 1 << qid);
7268 /* Enable aggregation for the queue. */
7269 iwn_prph_setbits(sc, IWN5000_SCHED_AGGR_SEL, 1 << qid);
7271 /* Set starting sequence number from the ADDBA request. */
7272 sc->txq[qid].cur = sc->txq[qid].read = (ssn & 0xff);
7273 IWN_WRITE(sc, IWN_HBUS_TARG_WRPTR, qid << 8 | (ssn & 0xff));
7274 iwn_prph_write(sc, IWN5000_SCHED_QUEUE_RDPTR(qid), ssn);
7276 /* Set scheduler window size and frame limit. */
7277 iwn_mem_write(sc, sc->sched_base + IWN5000_SCHED_QUEUE_OFFSET(qid) + 4,
7278 IWN_SCHED_LIMIT << 16 | IWN_SCHED_WINSZ);
7280 /* Enable interrupts for the queue. */
7281 iwn_prph_setbits(sc, IWN5000_SCHED_INTR_MASK, 1 << qid);
7283 /* Mark the queue as active. */
7284 iwn_prph_write(sc, IWN5000_SCHED_QUEUE_STATUS(qid),
7285 IWN5000_TXQ_STATUS_ACTIVE | iwn_tid2fifo[tid]);
7289 iwn5000_ampdu_tx_stop(struct iwn_softc *sc, int qid, uint8_t tid, uint16_t ssn)
7291 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
7293 /* Stop TX scheduler while we're changing its configuration. */
7294 iwn_prph_write(sc, IWN5000_SCHED_QUEUE_STATUS(qid),
7295 IWN5000_TXQ_STATUS_CHGACT);
7297 /* Disable aggregation for the queue. */
7298 iwn_prph_clrbits(sc, IWN5000_SCHED_AGGR_SEL, 1 << qid);
7300 /* Set starting sequence number from the ADDBA request. */
7301 IWN_WRITE(sc, IWN_HBUS_TARG_WRPTR, qid << 8 | (ssn & 0xff));
7302 iwn_prph_write(sc, IWN5000_SCHED_QUEUE_RDPTR(qid), ssn);
7304 /* Disable interrupts for the queue. */
7305 iwn_prph_clrbits(sc, IWN5000_SCHED_INTR_MASK, 1 << qid);
7307 /* Mark the queue as inactive. */
7308 iwn_prph_write(sc, IWN5000_SCHED_QUEUE_STATUS(qid),
7309 IWN5000_TXQ_STATUS_INACTIVE | iwn_tid2fifo[tid]);
7313 * Query calibration tables from the initialization firmware. We do this
7314 * only once at first boot. Called from a process context.
7317 iwn5000_query_calibration(struct iwn_softc *sc)
7319 struct iwn5000_calib_config cmd;
7322 memset(&cmd, 0, sizeof cmd);
7323 cmd.ucode.once.enable = htole32(0xffffffff);
7324 cmd.ucode.once.start = htole32(0xffffffff);
7325 cmd.ucode.once.send = htole32(0xffffffff);
7326 cmd.ucode.flags = htole32(0xffffffff);
7327 DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: sending calibration query\n",
7329 error = iwn_cmd(sc, IWN5000_CMD_CALIB_CONFIG, &cmd, sizeof cmd, 0);
7333 /* Wait at most two seconds for calibration to complete. */
7334 if (!(sc->sc_flags & IWN_FLAG_CALIB_DONE))
7335 error = zsleep(sc, &wlan_global_serializer, 0, "iwncal", 2 * hz);
7340 * Send calibration results to the runtime firmware. These results were
7341 * obtained on first boot from the initialization firmware.
7344 iwn5000_send_calibration(struct iwn_softc *sc)
7348 for (idx = 0; idx < IWN5000_PHY_CALIB_MAX_RESULT; idx++) {
7349 if (!(sc->base_params->calib_need & (1<<idx))) {
7350 DPRINTF(sc, IWN_DEBUG_CALIBRATE,
7351 "No need of calib %d\n",
7353 continue; /* no need for this calib */
7355 if (sc->calibcmd[idx].buf == NULL) {
7356 DPRINTF(sc, IWN_DEBUG_CALIBRATE,
7357 "Need calib idx : %d but no available data\n",
7362 DPRINTF(sc, IWN_DEBUG_CALIBRATE,
7363 "send calibration result idx=%d len=%d\n", idx,
7364 sc->calibcmd[idx].len);
7365 error = iwn_cmd(sc, IWN_CMD_PHY_CALIB, sc->calibcmd[idx].buf,
7366 sc->calibcmd[idx].len, 0);
7368 device_printf(sc->sc_dev,
7369 "%s: could not send calibration result, error %d\n",
7378 iwn5000_send_wimax_coex(struct iwn_softc *sc)
7380 struct iwn5000_wimax_coex wimax;
7383 if (sc->hw_type == IWN_HW_REV_TYPE_6050) {
7384 /* Enable WiMAX coexistence for combo adapters. */
7386 IWN_WIMAX_COEX_ASSOC_WA_UNMASK |
7387 IWN_WIMAX_COEX_UNASSOC_WA_UNMASK |
7388 IWN_WIMAX_COEX_STA_TABLE_VALID |
7389 IWN_WIMAX_COEX_ENABLE;
7390 memcpy(wimax.events, iwn6050_wimax_events,
7391 sizeof iwn6050_wimax_events);
7395 /* Disable WiMAX coexistence. */
7397 memset(wimax.events, 0, sizeof wimax.events);
7399 DPRINTF(sc, IWN_DEBUG_RESET, "%s: Configuring WiMAX coexistence\n",
7401 return iwn_cmd(sc, IWN5000_CMD_WIMAX_COEX, &wimax, sizeof wimax, 0);
7405 iwn5000_crystal_calib(struct iwn_softc *sc)
7407 struct iwn5000_phy_calib_crystal cmd;
7409 memset(&cmd, 0, sizeof cmd);
7410 cmd.code = IWN5000_PHY_CALIB_CRYSTAL;
7413 cmd.cap_pin[0] = le32toh(sc->eeprom_crystal) & 0xff;
7414 cmd.cap_pin[1] = (le32toh(sc->eeprom_crystal) >> 16) & 0xff;
7415 DPRINTF(sc, IWN_DEBUG_CALIBRATE, "sending crystal calibration %d, %d\n",
7416 cmd.cap_pin[0], cmd.cap_pin[1]);
7417 return iwn_cmd(sc, IWN_CMD_PHY_CALIB, &cmd, sizeof cmd, 0);
7421 iwn5000_temp_offset_calib(struct iwn_softc *sc)
7423 struct iwn5000_phy_calib_temp_offset cmd;
7425 memset(&cmd, 0, sizeof cmd);
7426 cmd.code = IWN5000_PHY_CALIB_TEMP_OFFSET;
7429 if (sc->eeprom_temp != 0)
7430 cmd.offset = htole16(sc->eeprom_temp);
7432 cmd.offset = htole16(IWN_DEFAULT_TEMP_OFFSET);
7433 DPRINTF(sc, IWN_DEBUG_CALIBRATE, "setting radio sensor offset to %d\n",
7434 le16toh(cmd.offset));
7435 return iwn_cmd(sc, IWN_CMD_PHY_CALIB, &cmd, sizeof cmd, 0);
7439 iwn5000_temp_offset_calibv2(struct iwn_softc *sc)
7441 struct iwn5000_phy_calib_temp_offsetv2 cmd;
7443 memset(&cmd, 0, sizeof cmd);
7444 cmd.code = IWN5000_PHY_CALIB_TEMP_OFFSET;
7447 if (sc->eeprom_temp != 0) {
7448 cmd.offset_low = htole16(sc->eeprom_temp);
7449 cmd.offset_high = htole16(sc->eeprom_temp_high);
7451 cmd.offset_low = htole16(IWN_DEFAULT_TEMP_OFFSET);
7452 cmd.offset_high = htole16(IWN_DEFAULT_TEMP_OFFSET);
7454 cmd.burnt_voltage_ref = htole16(sc->eeprom_voltage);
7456 DPRINTF(sc, IWN_DEBUG_CALIBRATE,
7457 "setting radio sensor low offset to %d, high offset to %d, voltage to %d\n",
7458 le16toh(cmd.offset_low),
7459 le16toh(cmd.offset_high),
7460 le16toh(cmd.burnt_voltage_ref));
7462 return iwn_cmd(sc, IWN_CMD_PHY_CALIB, &cmd, sizeof cmd, 0);
7466 * This function is called after the runtime firmware notifies us of its
7467 * readiness (called in a process context).
7470 iwn4965_post_alive(struct iwn_softc *sc)
7474 if ((error = iwn_nic_lock(sc)) != 0)
7477 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
7479 /* Clear TX scheduler state in SRAM. */
7480 sc->sched_base = iwn_prph_read(sc, IWN_SCHED_SRAM_ADDR);
7481 iwn_mem_set_region_4(sc, sc->sched_base + IWN4965_SCHED_CTX_OFF, 0,
7482 IWN4965_SCHED_CTX_LEN / sizeof (uint32_t));
7484 /* Set physical address of TX scheduler rings (1KB aligned). */
7485 iwn_prph_write(sc, IWN4965_SCHED_DRAM_ADDR, sc->sched_dma.paddr >> 10);
7487 IWN_SETBITS(sc, IWN_FH_TX_CHICKEN, IWN_FH_TX_CHICKEN_SCHED_RETRY);
7489 /* Disable chain mode for all our 16 queues. */
7490 iwn_prph_write(sc, IWN4965_SCHED_QCHAIN_SEL, 0);
7492 for (qid = 0; qid < IWN4965_NTXQUEUES; qid++) {
7493 iwn_prph_write(sc, IWN4965_SCHED_QUEUE_RDPTR(qid), 0);
7494 IWN_WRITE(sc, IWN_HBUS_TARG_WRPTR, qid << 8 | 0);
7496 /* Set scheduler window size. */
7497 iwn_mem_write(sc, sc->sched_base +
7498 IWN4965_SCHED_QUEUE_OFFSET(qid), IWN_SCHED_WINSZ);
7499 /* Set scheduler frame limit. */
7500 iwn_mem_write(sc, sc->sched_base +
7501 IWN4965_SCHED_QUEUE_OFFSET(qid) + 4,
7502 IWN_SCHED_LIMIT << 16);
7505 /* Enable interrupts for all our 16 queues. */
7506 iwn_prph_write(sc, IWN4965_SCHED_INTR_MASK, 0xffff);
7507 /* Identify TX FIFO rings (0-7). */
7508 iwn_prph_write(sc, IWN4965_SCHED_TXFACT, 0xff);
7510 /* Mark TX rings (4 EDCA + cmd + 2 HCCA) as active. */
7511 for (qid = 0; qid < 7; qid++) {
7512 static uint8_t qid2fifo[] = { 3, 2, 1, 0, 4, 5, 6 };
7513 iwn_prph_write(sc, IWN4965_SCHED_QUEUE_STATUS(qid),
7514 IWN4965_TXQ_STATUS_ACTIVE | qid2fifo[qid] << 1);
7521 * This function is called after the initialization or runtime firmware
7522 * notifies us of its readiness (called in a process context).
7525 iwn5000_post_alive(struct iwn_softc *sc)
7529 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
7531 /* Switch to using ICT interrupt mode. */
7532 iwn5000_ict_reset(sc);
7534 if ((error = iwn_nic_lock(sc)) != 0){
7535 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s end in error\n", __func__);
7539 /* Clear TX scheduler state in SRAM. */
7540 sc->sched_base = iwn_prph_read(sc, IWN_SCHED_SRAM_ADDR);
7541 iwn_mem_set_region_4(sc, sc->sched_base + IWN5000_SCHED_CTX_OFF, 0,
7542 IWN5000_SCHED_CTX_LEN / sizeof (uint32_t));
7544 /* Set physical address of TX scheduler rings (1KB aligned). */
7545 iwn_prph_write(sc, IWN5000_SCHED_DRAM_ADDR, sc->sched_dma.paddr >> 10);
7547 IWN_SETBITS(sc, IWN_FH_TX_CHICKEN, IWN_FH_TX_CHICKEN_SCHED_RETRY);
7549 /* Enable chain mode for all queues, except command queue. */
7550 if (sc->sc_flags & IWN_FLAG_PAN_SUPPORT)
7551 iwn_prph_write(sc, IWN5000_SCHED_QCHAIN_SEL, 0xfffdf);
7553 iwn_prph_write(sc, IWN5000_SCHED_QCHAIN_SEL, 0xfffef);
7554 iwn_prph_write(sc, IWN5000_SCHED_AGGR_SEL, 0);
7556 for (qid = 0; qid < IWN5000_NTXQUEUES; qid++) {
7557 iwn_prph_write(sc, IWN5000_SCHED_QUEUE_RDPTR(qid), 0);
7558 IWN_WRITE(sc, IWN_HBUS_TARG_WRPTR, qid << 8 | 0);
7560 iwn_mem_write(sc, sc->sched_base +
7561 IWN5000_SCHED_QUEUE_OFFSET(qid), 0);
7562 /* Set scheduler window size and frame limit. */
7563 iwn_mem_write(sc, sc->sched_base +
7564 IWN5000_SCHED_QUEUE_OFFSET(qid) + 4,
7565 IWN_SCHED_LIMIT << 16 | IWN_SCHED_WINSZ);
7568 /* Enable interrupts for all our 20 queues. */
7569 iwn_prph_write(sc, IWN5000_SCHED_INTR_MASK, 0xfffff);
7570 /* Identify TX FIFO rings (0-7). */
7571 iwn_prph_write(sc, IWN5000_SCHED_TXFACT, 0xff);
7573 /* Mark TX rings (4 EDCA + cmd + 2 HCCA) as active. */
7574 if (sc->sc_flags & IWN_FLAG_PAN_SUPPORT) {
7575 /* Mark TX rings as active. */
7576 for (qid = 0; qid < 11; qid++) {
7577 static uint8_t qid2fifo[] = { 3, 2, 1, 0, 0, 4, 2, 5, 4, 7, 5 };
7578 iwn_prph_write(sc, IWN5000_SCHED_QUEUE_STATUS(qid),
7579 IWN5000_TXQ_STATUS_ACTIVE | qid2fifo[qid]);
7582 /* Mark TX rings (4 EDCA + cmd + 2 HCCA) as active. */
7583 for (qid = 0; qid < 7; qid++) {
7584 static uint8_t qid2fifo[] = { 3, 2, 1, 0, 7, 5, 6 };
7585 iwn_prph_write(sc, IWN5000_SCHED_QUEUE_STATUS(qid),
7586 IWN5000_TXQ_STATUS_ACTIVE | qid2fifo[qid]);
7591 /* Configure WiMAX coexistence for combo adapters. */
7592 error = iwn5000_send_wimax_coex(sc);
7594 device_printf(sc->sc_dev,
7595 "%s: could not configure WiMAX coexistence, error %d\n",
7599 if (sc->hw_type != IWN_HW_REV_TYPE_5150) {
7600 /* Perform crystal calibration. */
7601 error = iwn5000_crystal_calib(sc);
7603 device_printf(sc->sc_dev,
7604 "%s: crystal calibration failed, error %d\n",
7609 if (!(sc->sc_flags & IWN_FLAG_CALIB_DONE)) {
7610 /* Query calibration from the initialization firmware. */
7611 if ((error = iwn5000_query_calibration(sc)) != 0) {
7612 device_printf(sc->sc_dev,
7613 "%s: could not query calibration, error %d\n",
7618 * We have the calibration results now, reboot with the
7619 * runtime firmware (call ourselves recursively!)
7622 error = iwn_hw_init(sc);
7624 /* Send calibration results to runtime firmware. */
7625 error = iwn5000_send_calibration(sc);
7628 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
7634 * The firmware boot code is small and is intended to be copied directly into
7635 * the NIC internal memory (no DMA transfer).
7638 iwn4965_load_bootcode(struct iwn_softc *sc, const uint8_t *ucode, int size)
7642 size /= sizeof (uint32_t);
7644 if ((error = iwn_nic_lock(sc)) != 0)
7647 /* Copy microcode image into NIC memory. */
7648 iwn_prph_write_region_4(sc, IWN_BSM_SRAM_BASE,
7649 (const uint32_t *)ucode, size);
7651 iwn_prph_write(sc, IWN_BSM_WR_MEM_SRC, 0);
7652 iwn_prph_write(sc, IWN_BSM_WR_MEM_DST, IWN_FW_TEXT_BASE);
7653 iwn_prph_write(sc, IWN_BSM_WR_DWCOUNT, size);
7655 /* Start boot load now. */
7656 iwn_prph_write(sc, IWN_BSM_WR_CTRL, IWN_BSM_WR_CTRL_START);
7658 /* Wait for transfer to complete. */
7659 for (ntries = 0; ntries < 1000; ntries++) {
7660 if (!(iwn_prph_read(sc, IWN_BSM_WR_CTRL) &
7661 IWN_BSM_WR_CTRL_START))
7665 if (ntries == 1000) {
7666 device_printf(sc->sc_dev, "%s: could not load boot firmware\n",
7672 /* Enable boot after power up. */
7673 iwn_prph_write(sc, IWN_BSM_WR_CTRL, IWN_BSM_WR_CTRL_START_EN);
7680 iwn4965_load_firmware(struct iwn_softc *sc)
7682 struct iwn_fw_info *fw = &sc->fw;
7683 struct iwn_dma_info *dma = &sc->fw_dma;
7686 /* Copy initialization sections into pre-allocated DMA-safe memory. */
7687 memcpy(dma->vaddr, fw->init.data, fw->init.datasz);
7688 bus_dmamap_sync(dma->tag, dma->map, BUS_DMASYNC_PREWRITE);
7689 memcpy(dma->vaddr + IWN4965_FW_DATA_MAXSZ,
7690 fw->init.text, fw->init.textsz);
7691 bus_dmamap_sync(dma->tag, dma->map, BUS_DMASYNC_PREWRITE);
7693 /* Tell adapter where to find initialization sections. */
7694 if ((error = iwn_nic_lock(sc)) != 0)
7696 iwn_prph_write(sc, IWN_BSM_DRAM_DATA_ADDR, dma->paddr >> 4);
7697 iwn_prph_write(sc, IWN_BSM_DRAM_DATA_SIZE, fw->init.datasz);
7698 iwn_prph_write(sc, IWN_BSM_DRAM_TEXT_ADDR,
7699 (dma->paddr + IWN4965_FW_DATA_MAXSZ) >> 4);
7700 iwn_prph_write(sc, IWN_BSM_DRAM_TEXT_SIZE, fw->init.textsz);
7703 /* Load firmware boot code. */
7704 error = iwn4965_load_bootcode(sc, fw->boot.text, fw->boot.textsz);
7706 device_printf(sc->sc_dev, "%s: could not load boot firmware\n",
7710 /* Now press "execute". */
7711 IWN_WRITE(sc, IWN_RESET, 0);
7713 /* Wait at most one second for first alive notification. */
7714 if ((error = zsleep(sc, &wlan_global_serializer, 0, "iwninit", hz)) != 0) {
7715 device_printf(sc->sc_dev,
7716 "%s: timeout waiting for adapter to initialize, error %d\n",
7721 /* Retrieve current temperature for initial TX power calibration. */
7722 sc->rawtemp = sc->ucode_info.temp[3].chan20MHz;
7723 sc->temp = iwn4965_get_temperature(sc);
7725 /* Copy runtime sections into pre-allocated DMA-safe memory. */
7726 memcpy(dma->vaddr, fw->main.data, fw->main.datasz);
7727 bus_dmamap_sync(dma->tag, dma->map, BUS_DMASYNC_PREWRITE);
7728 memcpy(dma->vaddr + IWN4965_FW_DATA_MAXSZ,
7729 fw->main.text, fw->main.textsz);
7730 bus_dmamap_sync(dma->tag, dma->map, BUS_DMASYNC_PREWRITE);
7732 /* Tell adapter where to find runtime sections. */
7733 if ((error = iwn_nic_lock(sc)) != 0)
7735 iwn_prph_write(sc, IWN_BSM_DRAM_DATA_ADDR, dma->paddr >> 4);
7736 iwn_prph_write(sc, IWN_BSM_DRAM_DATA_SIZE, fw->main.datasz);
7737 iwn_prph_write(sc, IWN_BSM_DRAM_TEXT_ADDR,
7738 (dma->paddr + IWN4965_FW_DATA_MAXSZ) >> 4);
7739 iwn_prph_write(sc, IWN_BSM_DRAM_TEXT_SIZE,
7740 IWN_FW_UPDATED | fw->main.textsz);
7747 iwn5000_load_firmware_section(struct iwn_softc *sc, uint32_t dst,
7748 const uint8_t *section, int size)
7750 struct iwn_dma_info *dma = &sc->fw_dma;
7753 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
7755 /* Copy firmware section into pre-allocated DMA-safe memory. */
7756 memcpy(dma->vaddr, section, size);
7757 bus_dmamap_sync(dma->tag, dma->map, BUS_DMASYNC_PREWRITE);
7759 if ((error = iwn_nic_lock(sc)) != 0)
7762 IWN_WRITE(sc, IWN_FH_TX_CONFIG(IWN_SRVC_DMACHNL),
7763 IWN_FH_TX_CONFIG_DMA_PAUSE);
7765 IWN_WRITE(sc, IWN_FH_SRAM_ADDR(IWN_SRVC_DMACHNL), dst);
7766 IWN_WRITE(sc, IWN_FH_TFBD_CTRL0(IWN_SRVC_DMACHNL),
7767 IWN_LOADDR(dma->paddr));
7768 IWN_WRITE(sc, IWN_FH_TFBD_CTRL1(IWN_SRVC_DMACHNL),
7769 IWN_HIADDR(dma->paddr) << 28 | size);
7770 IWN_WRITE(sc, IWN_FH_TXBUF_STATUS(IWN_SRVC_DMACHNL),
7771 IWN_FH_TXBUF_STATUS_TBNUM(1) |
7772 IWN_FH_TXBUF_STATUS_TBIDX(1) |
7773 IWN_FH_TXBUF_STATUS_TFBD_VALID);
7775 /* Kick Flow Handler to start DMA transfer. */
7776 IWN_WRITE(sc, IWN_FH_TX_CONFIG(IWN_SRVC_DMACHNL),
7777 IWN_FH_TX_CONFIG_DMA_ENA | IWN_FH_TX_CONFIG_CIRQ_HOST_ENDTFD);
7781 /* Wait at most five seconds for FH DMA transfer to complete. */
7782 return zsleep(sc, &wlan_global_serializer, 0, "iwninit", 5 * hz);
7786 iwn5000_load_firmware(struct iwn_softc *sc)
7788 struct iwn_fw_part *fw;
7791 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
7793 /* Load the initialization firmware on first boot only. */
7794 fw = (sc->sc_flags & IWN_FLAG_CALIB_DONE) ?
7795 &sc->fw.main : &sc->fw.init;
7797 error = iwn5000_load_firmware_section(sc, IWN_FW_TEXT_BASE,
7798 fw->text, fw->textsz);
7800 device_printf(sc->sc_dev,
7801 "%s: could not load firmware %s section, error %d\n",
7802 __func__, ".text", error);
7805 error = iwn5000_load_firmware_section(sc, IWN_FW_DATA_BASE,
7806 fw->data, fw->datasz);
7808 device_printf(sc->sc_dev,
7809 "%s: could not load firmware %s section, error %d\n",
7810 __func__, ".data", error);
7814 /* Now press "execute". */
7815 IWN_WRITE(sc, IWN_RESET, 0);
7820 * Extract text and data sections from a legacy firmware image.
7823 iwn_read_firmware_leg(struct iwn_softc *sc, struct iwn_fw_info *fw)
7825 const uint32_t *ptr;
7829 ptr = (const uint32_t *)fw->data;
7830 rev = le32toh(*ptr++);
7832 /* Check firmware API version. */
7833 if (IWN_FW_API(rev) <= 1) {
7834 device_printf(sc->sc_dev,
7835 "%s: bad firmware, need API version >=2\n", __func__);
7838 if (IWN_FW_API(rev) >= 3) {
7839 /* Skip build number (version 2 header). */
7843 if (fw->size < hdrlen) {
7844 device_printf(sc->sc_dev, "%s: firmware too short: %zu bytes\n",
7845 __func__, fw->size);
7848 fw->main.textsz = le32toh(*ptr++);
7849 fw->main.datasz = le32toh(*ptr++);
7850 fw->init.textsz = le32toh(*ptr++);
7851 fw->init.datasz = le32toh(*ptr++);
7852 fw->boot.textsz = le32toh(*ptr++);
7854 /* Check that all firmware sections fit. */
7855 if (fw->size < hdrlen + fw->main.textsz + fw->main.datasz +
7856 fw->init.textsz + fw->init.datasz + fw->boot.textsz) {
7857 device_printf(sc->sc_dev, "%s: firmware too short: %zu bytes\n",
7858 __func__, fw->size);
7862 /* Get pointers to firmware sections. */
7863 fw->main.text = (const uint8_t *)ptr;
7864 fw->main.data = fw->main.text + fw->main.textsz;
7865 fw->init.text = fw->main.data + fw->main.datasz;
7866 fw->init.data = fw->init.text + fw->init.textsz;
7867 fw->boot.text = fw->init.data + fw->init.datasz;
7872 * Extract text and data sections from a TLV firmware image.
7875 iwn_read_firmware_tlv(struct iwn_softc *sc, struct iwn_fw_info *fw,
7878 const struct iwn_fw_tlv_hdr *hdr;
7879 const struct iwn_fw_tlv *tlv;
7880 const uint8_t *ptr, *end;
7884 if (fw->size < sizeof (*hdr)) {
7885 device_printf(sc->sc_dev, "%s: firmware too short: %zu bytes\n",
7886 __func__, fw->size);
7889 hdr = (const struct iwn_fw_tlv_hdr *)fw->data;
7890 if (hdr->signature != htole32(IWN_FW_SIGNATURE)) {
7891 device_printf(sc->sc_dev, "%s: bad firmware signature 0x%08x\n",
7892 __func__, le32toh(hdr->signature));
7895 DPRINTF(sc, IWN_DEBUG_RESET, "FW: \"%.64s\", build 0x%x\n", hdr->descr,
7896 le32toh(hdr->build));
7899 * Select the closest supported alternative that is less than
7900 * or equal to the specified one.
7902 altmask = le64toh(hdr->altmask);
7903 while (alt > 0 && !(altmask & (1ULL << alt)))
7904 alt--; /* Downgrade. */
7905 DPRINTF(sc, IWN_DEBUG_RESET, "using alternative %d\n", alt);
7907 ptr = (const uint8_t *)(hdr + 1);
7908 end = (const uint8_t *)(fw->data + fw->size);
7910 /* Parse type-length-value fields. */
7911 while (ptr + sizeof (*tlv) <= end) {
7912 tlv = (const struct iwn_fw_tlv *)ptr;
7913 len = le32toh(tlv->len);
7915 ptr += sizeof (*tlv);
7916 if (ptr + len > end) {
7917 device_printf(sc->sc_dev,
7918 "%s: firmware too short: %zu bytes\n", __func__,
7922 /* Skip other alternatives. */
7923 if (tlv->alt != 0 && tlv->alt != htole16(alt))
7926 switch (le16toh(tlv->type)) {
7927 case IWN_FW_TLV_MAIN_TEXT:
7928 fw->main.text = ptr;
7929 fw->main.textsz = len;
7931 case IWN_FW_TLV_MAIN_DATA:
7932 fw->main.data = ptr;
7933 fw->main.datasz = len;
7935 case IWN_FW_TLV_INIT_TEXT:
7936 fw->init.text = ptr;
7937 fw->init.textsz = len;
7939 case IWN_FW_TLV_INIT_DATA:
7940 fw->init.data = ptr;
7941 fw->init.datasz = len;
7943 case IWN_FW_TLV_BOOT_TEXT:
7944 fw->boot.text = ptr;
7945 fw->boot.textsz = len;
7947 case IWN_FW_TLV_ENH_SENS:
7949 sc->sc_flags |= IWN_FLAG_ENH_SENS;
7951 case IWN_FW_TLV_PHY_CALIB:
7952 tmp = le32toh(*ptr);
7954 sc->reset_noise_gain = tmp;
7955 sc->noise_gain = tmp + 1;
7958 case IWN_FW_TLV_PAN:
7959 sc->sc_flags |= IWN_FLAG_PAN_SUPPORT;
7960 DPRINTF(sc, IWN_DEBUG_RESET,
7961 "PAN Support found: %d\n", 1);
7963 case IWN_FW_TLV_FLAGS:
7964 if (len < sizeof(uint32_t))
7966 if (len % sizeof(uint32_t))
7968 sc->tlv_feature_flags = le32toh(*ptr);
7969 DPRINTF(sc, IWN_DEBUG_RESET,
7970 "%s: feature: 0x%08x\n",
7972 sc->tlv_feature_flags);
7974 case IWN_FW_TLV_PBREQ_MAXLEN:
7975 case IWN_FW_TLV_RUNT_EVTLOG_PTR:
7976 case IWN_FW_TLV_RUNT_EVTLOG_SIZE:
7977 case IWN_FW_TLV_RUNT_ERRLOG_PTR:
7978 case IWN_FW_TLV_INIT_EVTLOG_PTR:
7979 case IWN_FW_TLV_INIT_EVTLOG_SIZE:
7980 case IWN_FW_TLV_INIT_ERRLOG_PTR:
7981 case IWN_FW_TLV_WOWLAN_INST:
7982 case IWN_FW_TLV_WOWLAN_DATA:
7983 DPRINTF(sc, IWN_DEBUG_RESET,
7984 "TLV type %d recognized but not handled\n",
7985 le16toh(tlv->type));
7988 DPRINTF(sc, IWN_DEBUG_RESET,
7989 "TLV type %d not handled\n", le16toh(tlv->type));
7992 next: /* TLV fields are 32-bit aligned. */
7993 ptr += (len + 3) & ~3;
7999 iwn_read_firmware(struct iwn_softc *sc)
8001 struct iwn_fw_info *fw = &sc->fw;
8004 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
8006 wlan_assert_serialized();
8007 memset(fw, 0, sizeof (*fw));
8010 * Read firmware image from filesystem. The firmware can block
8011 * in a taskq and deadlock against our serializer so unlock
8014 wlan_serialize_exit();
8015 sc->fw_fp = firmware_get(sc->fwname);
8016 wlan_serialize_enter();
8017 if (sc->fw_fp == NULL) {
8018 device_printf(sc->sc_dev, "%s: could not read firmware %s\n",
8019 __func__, sc->fwname);
8023 fw->size = sc->fw_fp->datasize;
8024 fw->data = (const uint8_t *)sc->fw_fp->data;
8025 if (fw->size < sizeof (uint32_t)) {
8026 device_printf(sc->sc_dev, "%s: firmware too short: %zu bytes\n",
8027 __func__, fw->size);
8028 firmware_put(sc->fw_fp, FIRMWARE_UNLOAD);
8033 /* Retrieve text and data sections. */
8034 if (*(const uint32_t *)fw->data != 0) /* Legacy image. */
8035 error = iwn_read_firmware_leg(sc, fw);
8037 error = iwn_read_firmware_tlv(sc, fw, 1);
8039 device_printf(sc->sc_dev,
8040 "%s: could not read firmware sections, error %d\n",
8042 firmware_put(sc->fw_fp, FIRMWARE_UNLOAD);
8047 /* Make sure text and data sections fit in hardware memory. */
8048 if (fw->main.textsz > sc->fw_text_maxsz ||
8049 fw->main.datasz > sc->fw_data_maxsz ||
8050 fw->init.textsz > sc->fw_text_maxsz ||
8051 fw->init.datasz > sc->fw_data_maxsz ||
8052 fw->boot.textsz > IWN_FW_BOOT_TEXT_MAXSZ ||
8053 (fw->boot.textsz & 3) != 0) {
8054 device_printf(sc->sc_dev, "%s: firmware sections too large\n",
8056 firmware_put(sc->fw_fp, FIRMWARE_UNLOAD);
8061 /* We can proceed with loading the firmware. */
8066 iwn_clock_wait(struct iwn_softc *sc)
8070 /* Set "initialization complete" bit. */
8071 IWN_SETBITS(sc, IWN_GP_CNTRL, IWN_GP_CNTRL_INIT_DONE);
8073 /* Wait for clock stabilization. */
8074 for (ntries = 0; ntries < 2500; ntries++) {
8075 if (IWN_READ(sc, IWN_GP_CNTRL) & IWN_GP_CNTRL_MAC_CLOCK_READY)
8079 device_printf(sc->sc_dev,
8080 "%s: timeout waiting for clock stabilization\n", __func__);
8085 iwn_apm_init(struct iwn_softc *sc)
8090 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
8092 /* Disable L0s exit timer (NMI bug workaround). */
8093 IWN_SETBITS(sc, IWN_GIO_CHICKEN, IWN_GIO_CHICKEN_DIS_L0S_TIMER);
8094 /* Don't wait for ICH L0s (ICH bug workaround). */
8095 IWN_SETBITS(sc, IWN_GIO_CHICKEN, IWN_GIO_CHICKEN_L1A_NO_L0S_RX);
8097 /* Set FH wait threshold to max (HW bug under stress workaround). */
8098 IWN_SETBITS(sc, IWN_DBG_HPET_MEM, 0xffff0000);
8100 /* Enable HAP INTA to move adapter from L1a to L0s. */
8101 IWN_SETBITS(sc, IWN_HW_IF_CONFIG, IWN_HW_IF_CONFIG_HAP_WAKE_L1A);
8103 /* Retrieve PCIe Active State Power Management (ASPM). */
8104 reg = pci_read_config(sc->sc_dev, sc->sc_cap_off + 0x10, 1);
8105 /* Workaround for HW instability in PCIe L0->L0s->L1 transition. */
8106 if (reg & 0x02) /* L1 Entry enabled. */
8107 IWN_SETBITS(sc, IWN_GIO, IWN_GIO_L0S_ENA);
8109 IWN_CLRBITS(sc, IWN_GIO, IWN_GIO_L0S_ENA);
8111 if (sc->base_params->pll_cfg_val)
8112 IWN_SETBITS(sc, IWN_ANA_PLL, sc->base_params->pll_cfg_val);
8114 /* Wait for clock stabilization before accessing prph. */
8115 if ((error = iwn_clock_wait(sc)) != 0)
8118 if ((error = iwn_nic_lock(sc)) != 0)
8120 if (sc->hw_type == IWN_HW_REV_TYPE_4965) {
8121 /* Enable DMA and BSM (Bootstrap State Machine). */
8122 iwn_prph_write(sc, IWN_APMG_CLK_EN,
8123 IWN_APMG_CLK_CTRL_DMA_CLK_RQT |
8124 IWN_APMG_CLK_CTRL_BSM_CLK_RQT);
8127 iwn_prph_write(sc, IWN_APMG_CLK_EN,
8128 IWN_APMG_CLK_CTRL_DMA_CLK_RQT);
8131 /* Disable L1-Active. */
8132 iwn_prph_setbits(sc, IWN_APMG_PCI_STT, IWN_APMG_PCI_STT_L1A_DIS);
8139 iwn_apm_stop_master(struct iwn_softc *sc)
8143 /* Stop busmaster DMA activity. */
8144 IWN_SETBITS(sc, IWN_RESET, IWN_RESET_STOP_MASTER);
8145 for (ntries = 0; ntries < 100; ntries++) {
8146 if (IWN_READ(sc, IWN_RESET) & IWN_RESET_MASTER_DISABLED)
8150 device_printf(sc->sc_dev, "%s: timeout waiting for master\n", __func__);
8154 iwn_apm_stop(struct iwn_softc *sc)
8156 iwn_apm_stop_master(sc);
8158 /* Reset the entire device. */
8159 IWN_SETBITS(sc, IWN_RESET, IWN_RESET_SW);
8161 /* Clear "initialization complete" bit. */
8162 IWN_CLRBITS(sc, IWN_GP_CNTRL, IWN_GP_CNTRL_INIT_DONE);
8166 iwn4965_nic_config(struct iwn_softc *sc)
8168 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
8170 if (IWN_RFCFG_TYPE(sc->rfcfg) == 1) {
8172 * I don't believe this to be correct but this is what the
8173 * vendor driver is doing. Probably the bits should not be
8174 * shifted in IWN_RFCFG_*.
8176 IWN_SETBITS(sc, IWN_HW_IF_CONFIG,
8177 IWN_RFCFG_TYPE(sc->rfcfg) |
8178 IWN_RFCFG_STEP(sc->rfcfg) |
8179 IWN_RFCFG_DASH(sc->rfcfg));
8181 IWN_SETBITS(sc, IWN_HW_IF_CONFIG,
8182 IWN_HW_IF_CONFIG_RADIO_SI | IWN_HW_IF_CONFIG_MAC_SI);
8187 iwn5000_nic_config(struct iwn_softc *sc)
8192 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
8194 if (IWN_RFCFG_TYPE(sc->rfcfg) < 3) {
8195 IWN_SETBITS(sc, IWN_HW_IF_CONFIG,
8196 IWN_RFCFG_TYPE(sc->rfcfg) |
8197 IWN_RFCFG_STEP(sc->rfcfg) |
8198 IWN_RFCFG_DASH(sc->rfcfg));
8200 IWN_SETBITS(sc, IWN_HW_IF_CONFIG,
8201 IWN_HW_IF_CONFIG_RADIO_SI | IWN_HW_IF_CONFIG_MAC_SI);
8203 if ((error = iwn_nic_lock(sc)) != 0)
8205 iwn_prph_setbits(sc, IWN_APMG_PS, IWN_APMG_PS_EARLY_PWROFF_DIS);
8207 if (sc->hw_type == IWN_HW_REV_TYPE_1000) {
8209 * Select first Switching Voltage Regulator (1.32V) to
8210 * solve a stability issue related to noisy DC2DC line
8211 * in the silicon of 1000 Series.
8213 tmp = iwn_prph_read(sc, IWN_APMG_DIGITAL_SVR);
8214 tmp &= ~IWN_APMG_DIGITAL_SVR_VOLTAGE_MASK;
8215 tmp |= IWN_APMG_DIGITAL_SVR_VOLTAGE_1_32;
8216 iwn_prph_write(sc, IWN_APMG_DIGITAL_SVR, tmp);
8220 if (sc->sc_flags & IWN_FLAG_INTERNAL_PA) {
8221 /* Use internal power amplifier only. */
8222 IWN_WRITE(sc, IWN_GP_DRIVER, IWN_GP_DRIVER_RADIO_2X2_IPA);
8224 if (sc->base_params->additional_nic_config && sc->calib_ver >= 6) {
8225 /* Indicate that ROM calibration version is >=6. */
8226 IWN_SETBITS(sc, IWN_GP_DRIVER, IWN_GP_DRIVER_CALIB_VER6);
8228 if (sc->base_params->additional_gp_drv_bit)
8229 IWN_SETBITS(sc, IWN_GP_DRIVER,
8230 sc->base_params->additional_gp_drv_bit);
8235 * Take NIC ownership over Intel Active Management Technology (AMT).
8238 iwn_hw_prepare(struct iwn_softc *sc)
8242 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
8244 /* Check if hardware is ready. */
8245 IWN_SETBITS(sc, IWN_HW_IF_CONFIG, IWN_HW_IF_CONFIG_NIC_READY);
8246 for (ntries = 0; ntries < 5; ntries++) {
8247 if (IWN_READ(sc, IWN_HW_IF_CONFIG) &
8248 IWN_HW_IF_CONFIG_NIC_READY)
8253 /* Hardware not ready, force into ready state. */
8254 IWN_SETBITS(sc, IWN_HW_IF_CONFIG, IWN_HW_IF_CONFIG_PREPARE);
8255 for (ntries = 0; ntries < 15000; ntries++) {
8256 if (!(IWN_READ(sc, IWN_HW_IF_CONFIG) &
8257 IWN_HW_IF_CONFIG_PREPARE_DONE))
8261 if (ntries == 15000)
8264 /* Hardware should be ready now. */
8265 IWN_SETBITS(sc, IWN_HW_IF_CONFIG, IWN_HW_IF_CONFIG_NIC_READY);
8266 for (ntries = 0; ntries < 5; ntries++) {
8267 if (IWN_READ(sc, IWN_HW_IF_CONFIG) &
8268 IWN_HW_IF_CONFIG_NIC_READY)
8276 iwn_hw_init(struct iwn_softc *sc)
8278 struct iwn_ops *ops = &sc->ops;
8279 int error, chnl, qid;
8281 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
8283 /* Clear pending interrupts. */
8284 IWN_WRITE(sc, IWN_INT, 0xffffffff);
8286 if ((error = iwn_apm_init(sc)) != 0) {
8287 device_printf(sc->sc_dev,
8288 "%s: could not power ON adapter, error %d\n", __func__,
8293 /* Select VMAIN power source. */
8294 if ((error = iwn_nic_lock(sc)) != 0)
8296 iwn_prph_clrbits(sc, IWN_APMG_PS, IWN_APMG_PS_PWR_SRC_MASK);
8299 /* Perform adapter-specific initialization. */
8300 if ((error = ops->nic_config(sc)) != 0)
8303 /* Initialize RX ring. */
8304 if ((error = iwn_nic_lock(sc)) != 0)
8306 IWN_WRITE(sc, IWN_FH_RX_CONFIG, 0);
8307 IWN_WRITE(sc, IWN_FH_RX_WPTR, 0);
8308 /* Set physical address of RX ring (256-byte aligned). */
8309 IWN_WRITE(sc, IWN_FH_RX_BASE, sc->rxq.desc_dma.paddr >> 8);
8310 /* Set physical address of RX status (16-byte aligned). */
8311 IWN_WRITE(sc, IWN_FH_STATUS_WPTR, sc->rxq.stat_dma.paddr >> 4);
8313 IWN_WRITE(sc, IWN_FH_RX_CONFIG,
8314 IWN_FH_RX_CONFIG_ENA |
8315 IWN_FH_RX_CONFIG_IGN_RXF_EMPTY | /* HW bug workaround */
8316 IWN_FH_RX_CONFIG_IRQ_DST_HOST |
8317 IWN_FH_RX_CONFIG_SINGLE_FRAME |
8318 IWN_FH_RX_CONFIG_RB_TIMEOUT(0) |
8319 IWN_FH_RX_CONFIG_NRBD(IWN_RX_RING_COUNT_LOG));
8321 IWN_WRITE(sc, IWN_FH_RX_WPTR, (IWN_RX_RING_COUNT - 1) & ~7);
8323 if ((error = iwn_nic_lock(sc)) != 0)
8326 /* Initialize TX scheduler. */
8327 iwn_prph_write(sc, sc->sched_txfact_addr, 0);
8329 /* Set physical address of "keep warm" page (16-byte aligned). */
8330 IWN_WRITE(sc, IWN_FH_KW_ADDR, sc->kw_dma.paddr >> 4);
8332 /* Initialize TX rings. */
8333 for (qid = 0; qid < sc->ntxqs; qid++) {
8334 struct iwn_tx_ring *txq = &sc->txq[qid];
8336 /* Set physical address of TX ring (256-byte aligned). */
8337 IWN_WRITE(sc, IWN_FH_CBBC_QUEUE(qid),
8338 txq->desc_dma.paddr >> 8);
8342 /* Enable DMA channels. */
8343 for (chnl = 0; chnl < sc->ndmachnls; chnl++) {
8344 IWN_WRITE(sc, IWN_FH_TX_CONFIG(chnl),
8345 IWN_FH_TX_CONFIG_DMA_ENA |
8346 IWN_FH_TX_CONFIG_DMA_CREDIT_ENA);
8349 /* Clear "radio off" and "commands blocked" bits. */
8350 IWN_WRITE(sc, IWN_UCODE_GP1_CLR, IWN_UCODE_GP1_RFKILL);
8351 IWN_WRITE(sc, IWN_UCODE_GP1_CLR, IWN_UCODE_GP1_CMD_BLOCKED);
8353 /* Clear pending interrupts. */
8354 IWN_WRITE(sc, IWN_INT, 0xffffffff);
8355 /* Enable interrupt coalescing. */
8356 IWN_WRITE(sc, IWN_INT_COALESCING, 512 / 8);
8357 /* Enable interrupts. */
8358 IWN_WRITE(sc, IWN_INT_MASK, sc->int_mask);
8360 /* _Really_ make sure "radio off" bit is cleared! */
8361 IWN_WRITE(sc, IWN_UCODE_GP1_CLR, IWN_UCODE_GP1_RFKILL);
8362 IWN_WRITE(sc, IWN_UCODE_GP1_CLR, IWN_UCODE_GP1_RFKILL);
8364 /* Enable shadow registers. */
8365 if (sc->base_params->shadow_reg_enable)
8366 IWN_SETBITS(sc, IWN_SHADOW_REG_CTRL, 0x800fffff);
8368 if ((error = ops->load_firmware(sc)) != 0) {
8369 device_printf(sc->sc_dev,
8370 "%s: could not load firmware, error %d\n", __func__,
8374 /* Wait at most one second for firmware alive notification. */
8375 if ((error = zsleep(sc, &wlan_global_serializer, 0, "iwninit", hz)) != 0) {
8376 device_printf(sc->sc_dev,
8377 "%s: timeout waiting for adapter to initialize, error %d\n",
8381 /* Do post-firmware initialization. */
8383 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
8385 return ops->post_alive(sc);
8389 iwn_hw_stop(struct iwn_softc *sc)
8391 int chnl, qid, ntries;
8393 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
8395 IWN_WRITE(sc, IWN_RESET, IWN_RESET_NEVO);
8397 /* Disable interrupts. */
8398 IWN_WRITE(sc, IWN_INT_MASK, 0);
8399 IWN_WRITE(sc, IWN_INT, 0xffffffff);
8400 IWN_WRITE(sc, IWN_FH_INT, 0xffffffff);
8401 sc->sc_flags &= ~IWN_FLAG_USE_ICT;
8403 /* Make sure we no longer hold the NIC lock. */
8406 /* Stop TX scheduler. */
8407 iwn_prph_write(sc, sc->sched_txfact_addr, 0);
8409 /* Stop all DMA channels. */
8410 if (iwn_nic_lock(sc) == 0) {
8411 for (chnl = 0; chnl < sc->ndmachnls; chnl++) {
8412 IWN_WRITE(sc, IWN_FH_TX_CONFIG(chnl), 0);
8413 for (ntries = 0; ntries < 200; ntries++) {
8414 if (IWN_READ(sc, IWN_FH_TX_STATUS) &
8415 IWN_FH_TX_STATUS_IDLE(chnl))
8424 iwn_reset_rx_ring(sc, &sc->rxq);
8426 /* Reset all TX rings. */
8427 for (qid = 0; qid < sc->ntxqs; qid++)
8428 iwn_reset_tx_ring(sc, &sc->txq[qid]);
8430 if (iwn_nic_lock(sc) == 0) {
8431 iwn_prph_write(sc, IWN_APMG_CLK_DIS,
8432 IWN_APMG_CLK_CTRL_DMA_CLK_RQT);
8436 /* Power OFF adapter. */
8441 iwn_radio_on_task(void *arg0, int pending)
8443 struct iwn_softc *sc = arg0;
8445 struct ieee80211com *ic;
8446 struct ieee80211vap *vap;
8448 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
8450 wlan_serialize_enter();
8453 vap = TAILQ_FIRST(&ic->ic_vaps);
8455 iwn_init_locked(sc);
8456 ieee80211_init(vap);
8458 wlan_serialize_exit();
8462 iwn_radio_off_task(void *arg0, int pending)
8464 struct iwn_softc *sc = arg0;
8466 struct ieee80211com *ic;
8467 struct ieee80211vap *vap;
8469 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
8471 wlan_serialize_enter();
8474 vap = TAILQ_FIRST(&ic->ic_vaps);
8475 iwn_stop_locked(sc);
8477 ieee80211_stop(vap);
8479 /* Enable interrupts to get RF toggle notification. */
8480 IWN_WRITE(sc, IWN_INT, 0xffffffff);
8481 IWN_WRITE(sc, IWN_INT_MASK, sc->int_mask);
8482 wlan_serialize_exit();
8486 iwn_panicked_task(void *arg0, int pending)
8488 struct iwn_softc *sc = arg0;
8489 struct ifnet *ifp = sc->sc_ifp;
8490 struct ieee80211com *ic = ifp->if_l2com;
8491 struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
8495 kprintf("%s: null vap\n", __func__);
8499 device_printf(sc->sc_dev, "%s: controller panicked, iv_state = %d; "
8500 "resetting...\n", __func__, vap->iv_state);
8502 wlan_serialize_enter();
8504 iwn_stop_locked(sc);
8505 iwn_init_locked(sc);
8506 if (vap->iv_state >= IEEE80211_S_AUTH &&
8507 (error = iwn_auth(sc, vap)) != 0) {
8508 device_printf(sc->sc_dev,
8509 "%s: could not move to auth state\n", __func__);
8511 if (vap->iv_state >= IEEE80211_S_RUN &&
8512 (error = iwn_run(sc, vap)) != 0) {
8513 device_printf(sc->sc_dev,
8514 "%s: could not move to run state\n", __func__);
8517 /* Only run start once the NIC is in a useful state, like associated */
8518 iwn_start_locked(sc->sc_ifp);
8520 wlan_serialize_exit();
8524 iwn_init_locked(struct iwn_softc *sc)
8526 struct ifnet *ifp = sc->sc_ifp;
8529 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
8532 * Make sure we hold the serializer or we will have timing issues
8533 * with the wlan subsystem.
8535 wlan_assert_serialized();
8536 if ((error = iwn_hw_prepare(sc)) != 0) {
8537 device_printf(sc->sc_dev, "%s: hardware not ready, error %d\n",
8542 /* Initialize interrupt mask to default value. */
8543 sc->int_mask = IWN_INT_MASK_DEF;
8544 sc->sc_flags &= ~IWN_FLAG_USE_ICT;
8546 /* Check that the radio is not disabled by hardware switch. */
8547 if (!(IWN_READ(sc, IWN_GP_CNTRL) & IWN_GP_CNTRL_RFKILL)) {
8548 device_printf(sc->sc_dev,
8549 "radio is disabled by hardware switch\n");
8550 /* Enable interrupts to get RF toggle notifications. */
8551 IWN_WRITE(sc, IWN_INT, 0xffffffff);
8552 IWN_WRITE(sc, IWN_INT_MASK, sc->int_mask);
8556 /* Read firmware images from the filesystem. */
8557 if ((error = iwn_read_firmware(sc)) != 0) {
8558 device_printf(sc->sc_dev,
8559 "%s: could not read firmware, error %d\n", __func__,
8564 /* Initialize hardware and upload firmware. */
8565 error = iwn_hw_init(sc);
8566 firmware_put(sc->fw_fp, FIRMWARE_UNLOAD);
8569 device_printf(sc->sc_dev,
8570 "%s: could not initialize hardware, error %d\n", __func__,
8575 /* Configure adapter now that it is ready. */
8576 if ((error = iwn_config(sc)) != 0) {
8577 device_printf(sc->sc_dev,
8578 "%s: could not configure device, error %d\n", __func__,
8583 ifq_clr_oactive(&ifp->if_snd);
8584 ifp->if_flags |= IFF_RUNNING;
8586 callout_reset(&sc->watchdog_to, hz, iwn_watchdog_timeout, sc);
8588 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
8592 fail: iwn_stop_locked(sc);
8593 DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end in error\n",__func__);
8599 struct iwn_softc *sc = arg;
8600 struct ifnet *ifp = sc->sc_ifp;
8601 struct ieee80211com *ic = ifp->if_l2com;
8603 wlan_assert_serialized();
8604 iwn_init_locked(sc);
8606 if (ifp->if_flags & IFF_RUNNING)
8607 ieee80211_start_all(ic);
8611 iwn_stop_locked(struct iwn_softc *sc)
8613 struct ifnet *ifp = sc->sc_ifp;
8615 sc->sc_is_scanning = 0;
8616 sc->sc_tx_timer = 0;
8617 callout_stop(&sc->watchdog_to);
8618 callout_stop(&sc->calib_to);
8619 ifp->if_flags &= ~IFF_RUNNING;
8620 ifq_clr_oactive(&ifp->if_snd);
8622 /* Power OFF hardware. */
8627 * Callback from net80211 to start a scan.
8630 iwn_scan_start(struct ieee80211com *ic)
8632 struct ifnet *ifp = ic->ic_ifp;
8633 struct iwn_softc *sc = ifp->if_softc;
8635 /* make the link LED blink while we're scanning */
8636 iwn_set_led(sc, IWN_LED_LINK, 20, 2);
8640 * Callback from net80211 to terminate a scan.
8643 iwn_scan_end(struct ieee80211com *ic)
8645 struct ifnet *ifp = ic->ic_ifp;
8646 struct iwn_softc *sc = ifp->if_softc;
8647 struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
8649 if (vap->iv_state == IEEE80211_S_RUN) {
8650 /* Set link LED to ON status if we are associated */
8651 iwn_set_led(sc, IWN_LED_LINK, 0, 1);
8656 * Callback from net80211 to force a channel change.
8659 iwn_set_channel(struct ieee80211com *ic)
8661 const struct ieee80211_channel *c = ic->ic_curchan;
8662 struct ifnet *ifp = ic->ic_ifp;
8663 struct iwn_softc *sc = ifp->if_softc;
8666 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
8668 sc->sc_rxtap.wr_chan_freq = htole16(c->ic_freq);
8669 sc->sc_rxtap.wr_chan_flags = htole16(c->ic_flags);
8670 sc->sc_txtap.wt_chan_freq = htole16(c->ic_freq);
8671 sc->sc_txtap.wt_chan_flags = htole16(c->ic_flags);
8674 * Only need to set the channel in Monitor mode. AP scanning and auth
8675 * are already taken care of by their respective firmware commands.
8677 if (ic->ic_opmode == IEEE80211_M_MONITOR) {
8678 error = iwn_config(sc);
8680 device_printf(sc->sc_dev,
8681 "%s: error %d settting channel\n", __func__, error);
8686 * Callback from net80211 to start scanning of the current channel.
8689 iwn_scan_curchan(struct ieee80211_scan_state *ss, unsigned long maxdwell)
8691 struct ieee80211vap *vap = ss->ss_vap;
8692 struct iwn_softc *sc = vap->iv_ic->ic_ifp->if_softc;
8693 struct ieee80211com *ic = vap->iv_ic;
8696 error = iwn_scan(sc, vap, ss, ic->ic_curchan);
8698 ieee80211_cancel_scan(vap);
8702 * Callback from net80211 to handle the minimum dwell time being met.
8703 * The intent is to terminate the scan but we just let the firmware
8704 * notify us when it's finished as we have no safe way to abort it.
8707 iwn_scan_mindwell(struct ieee80211_scan_state *ss)
8709 /* NB: don't try to abort scan; wait for firmware to finish */
8713 iwn_hw_reset_task(void *arg0, int pending)
8715 struct iwn_softc *sc = arg0;
8717 struct ieee80211com *ic;
8719 DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
8721 wlan_serialize_enter();
8724 iwn_stop_locked(sc);
8725 iwn_init_locked(sc);
8726 ieee80211_notify_radio(ic, 1);
8727 wlan_serialize_exit();
8730 #define IWN_DESC(x) case x: return #x
8731 #define COUNTOF(array) (sizeof(array) / sizeof(array[0]))
8734 * Translate CSR code to string
8736 static char *iwn_get_csr_string(int csr)
8739 IWN_DESC(IWN_HW_IF_CONFIG);
8740 IWN_DESC(IWN_INT_COALESCING);
8742 IWN_DESC(IWN_INT_MASK);
8743 IWN_DESC(IWN_FH_INT);
8744 IWN_DESC(IWN_GPIO_IN);
8745 IWN_DESC(IWN_RESET);
8746 IWN_DESC(IWN_GP_CNTRL);
8747 IWN_DESC(IWN_HW_REV);
8748 IWN_DESC(IWN_EEPROM);
8749 IWN_DESC(IWN_EEPROM_GP);
8750 IWN_DESC(IWN_OTP_GP);
8752 IWN_DESC(IWN_GP_UCODE);
8753 IWN_DESC(IWN_GP_DRIVER);
8754 IWN_DESC(IWN_UCODE_GP1);
8755 IWN_DESC(IWN_UCODE_GP2);
8757 IWN_DESC(IWN_DRAM_INT_TBL);
8758 IWN_DESC(IWN_GIO_CHICKEN);
8759 IWN_DESC(IWN_ANA_PLL);
8760 IWN_DESC(IWN_HW_REV_WA);
8761 IWN_DESC(IWN_DBG_HPET_MEM);
8763 return "UNKNOWN CSR";
8768 * This function print firmware register
8771 iwn_debug_register(struct iwn_softc *sc)
8774 static const uint32_t csr_tbl[] = {
8799 DPRINTF(sc, IWN_DEBUG_REGISTER,
8800 "CSR values: (2nd byte of IWN_INT_COALESCING is IWN_INT_PERIODIC)%s",
8802 for (i = 0; i < COUNTOF(csr_tbl); i++){
8803 DPRINTF(sc, IWN_DEBUG_REGISTER," %10s: 0x%08x ",
8804 iwn_get_csr_string(csr_tbl[i]), IWN_READ(sc, csr_tbl[i]));
8806 DPRINTF(sc, IWN_DEBUG_REGISTER,"%s","\n");
8808 DPRINTF(sc, IWN_DEBUG_REGISTER,"%s","\n");