This is an old revision of the document!
Go back –> Atheros Linux wireless drivers
The wil6210 driver supports several 60GHz wireless card by Qualcomm (1-st ones was originally made by Wilocity; later Wilocity got acquired by Qualcomm). Hardware provides WiFi and wireless PCIE connectivity, as described in the WiGig WBE spec. Driver supports WiFi only. All cards are PCIE devices
Some cards have 60G device combined with Atheros 2.4/5.2 GHz WiFi card. On the PCI, it is represented as the following hierarchy:
1ae9:0101-+-1ae9:0201---168c:0034 +-1ae9:0201---1ae9:0301 +-1ae9:0201 \-1ae9:0201
Chip consists of the root bridge 1ae9:0101, with 4 ports 1ae9:0201. One port routed to separate Atheros card 168c:0034, it is handled by the ath9k driver. Another port connected to the wil6210 device 1ae9:0301, that is on the same chip. 2 empty ports may be populated when connecting in WBE (PCIE-over-60g) mode.
Devices 1ae9:xxxx except 1ae9:0101 are configurable from the firmware, and may wary depending on the FW build. In particular, slots 1ae9:0201 may be represented slightly different, using device ID 0200, 0201, 0202, 0203.
Warning! It may be that WiFi device 1ae9:0301 is not visible. This is the case if FW build is WBE-only. If you see this, please contact Wilocity http://wilocity.com/ to obtain and flash FW with WiFi support.
wil6210 device, 1ae9:0301, has one 2Mb BAR.
Depending on card flavor and generation, Atheros 2.4/5.2 GHz WiFi (device 168c:xxxx) may be present or not. Device IDs for 60G device may also differ. Currently, it may be 1ae9:0301 or 1ae9:0310
For the WiFi connection, implemented is 802.11ad spec. Supported are channels 1..3 with corresponded frequencies 58320, 60480, 62640 MHz.
wil6210 use cfg80211 framework, but not mac80211.
iw link: query link status. Report current MCS.
wil6210 support set of interrupt handling modes:
- INTx - legacy pin interrupt. Do not use if possible. - 1MSI - one MSI interrupt. This is the default mode. - 3MSI - 3 MSI interrupts for {Tx, Rx, Misc}.
For interrupt handling mode, probed is highest one specified with @use_msi, with fallback:
3MSI → 1MSI → INTx
On the x86 platform, multiple MSI interrupts are not supported with recent kernel (3.17).
When debug_fw set to true, driver probe will not fail if firmware do not report “ready” event. This is to aid firmware boot issues debugging.
To configure wil6210 in sniffer mode (assume $WLAN set to network interface name):
# iw $WLAN set type monitor
Due to hardware/firmware deficiency, sniffer can capture either only control PHY (CP) or only data PHY (DP). To configure for desired PHY type do, after configuring for monitor mode:
For CP:
# iw $WLAN set monitor control
For DP:
# iw $WLAN set monitor none
Finally, bring interface up:
# ifconfig $WLAN up
We need to get this publicly available…
In the current version, firmware stored in the flash memory on the NIC and not downloaded by the driver. Firmware flashing required for the upgrade only.
To start AP mode, use recent wpa_supplicant (assume relevant patches already merged). Sample config for non-secure mode:
ap_scan=2 network={ frequency=60480 ssid="the_ssid_string" mode=2 key_mgmt=NONE }
Sample config for secure mode. Note GCMP cipher:
ap_scan=2 network={ frequency=60480 ssid="secure_ap" psk="passphrase" mode=2 key_mgmt=WPA-PSK proto=RSN pairwise=GCMP group=GCMP }
Control communication with the card is done through so called WMI commands and events. Target access to the mailbox within memory in BAR0 used. There are 2 similar mailbox structures: one for host→card commands, and one for card→host events.
DMA using 'vring' structures. Vring in consistent memory; hold descriptors that points to the data buffers. Card to write status back to the descriptor.
There is one Rx vring. Tx vrings - multiple, per DA*TID.
Should firmware crash, or in case of scan timeout, driver try to recover from error by resetting card. This works for station only. In the AP mode, driver will not perform recovery. It will, however, report error to the user space. There are 2 modes of firmware recovery, depending on the driver parameter no_fw_recovery:
cat /sys/kernel/debug/ieee80211/phy/wil6210/recovery
to query status, it will reads:
mode = [auto|manual] state = [idle|pending|running]
If state is pending, it is time to collect all crash information as desired, and continue with recovery by writing run into recovery:
echo -n "run" > /sys/kernel/debug/ieee80211/phy/wil6210/recovery
Almost all messages printed to the dmesg, are “dynamic debug” ones. See Documentation/dynamic-debug-howto.txt for details. Module “wil6210” uses format prefixes to identify message groups:
All debugfs files placed under standard location for the cfg80211 devices, $DEBUGFS/ieee80211/$PHY/ where $PHY is phy name like 'phy1'.
All wil6210 specific files placed under directory 'wil6210'. Facilities provided:
+-------------------------------+---------------+ | blob_xxx | BAR0 | Size | Comment | | file name | offset | | | +-----------+---------+---------+---------------+ | rgf | 0x0 | 0xa000 | Register file | | fw_code | 0x40000 | 0x40000 | FW code | | fw_data | 0x80000 | 0x8000 | FW data | | fw_peri | 0x88000 | 0x18000 | FW peripheral | | uc_code | 0xa0000 | 0x10000 | Ucode code | | uc_data | 0xb0000 | 0x4000 | Ucode data | +-----------+---------+---------+---------------+
Raw memory access used by firmware/ucode trace extractor. See below. Also, raw memory dump may be obtained for later analysis.
ring tx = { base = 0x008802e8 size = 0x0028 bytes -> 5 entries tail = 0x00880300 head = 0x00880300 entry size = 1288 [ 0] E 0x00842490 -> 1fc9 001e 0000 00 : 00 00 07 00 00 00 00 00 ff ff 03 00 00 00 00 00 : 00 00 00 20 04 07 01 88 ff 02 00 00 01 00 [ 1] E 0x00841f88 -> 1fca 001e 0000 00 : 00 00 07 00 00 00 00 00 ff ff 03 00 00 00 00 00 : 00 00 00 20 04 07 01 88 ff 02 00 00 01 00 [ 2] E 0x00841a80 -> 1fcb 001e 0000 00 : 00 00 07 00 00 00 00 00 ff ff 03 00 00 00 00 00 : 00 00 00 20 04 07 01 88 ff 02 00 00 01 00 [ 3] E th 0x00841578 -> 1fc7 001e 0000 00 : 00 00 07 00 00 00 00 00 ff ff 03 00 00 00 00 00 : 00 00 00 20 04 07 01 88 ff 02 00 00 01 00 [ 4] E 0x00841070 -> 1fc8 001e 0000 00 : 00 00 07 00 00 00 00 00 ff ff 03 00 00 00 00 00 : 00 00 00 20 04 07 01 88 ff 02 00 00 01 00 } ring rx = { base = 0x00880318 size = 0x0040 bytes -> 8 entries tail = 0x00880320 head = 0x00880320 entry size = 256 [ 0] E 0x00842f98 -> 24f8 000c 0000 00 : 00 00 0a 10 00 00 00 00 00 00 00 00 [ 1] E th 0x00000000 -> 2020 0f80 0000 c0 [ 2] E 0x00000000 -> 2020 0f80 0000 c0 [ 3] E 0x00000000 -> 2020 0f80 0000 c0 [ 4] E 0x00000000 -> 2020 0f80 0000 c0 [ 5] E 0x00000000 -> 2020 0f80 0000 c0 [ 6] E 0x00000000 -> 2020 0f80 0000 c0 [ 7] E 0x00000000 -> 2020 0f80 0000 c0 }
There are 2 separate rings, one for Tx, or host→card commands; and 2-nd for Rx, or card→host events.
Printed for each ring (all addresses in FW memory mapping):
/-- 'E' for empty entry, 'F' for full | /+-- 't' for tail, 'h' for head | || index | || address /-mbox header---\ [seq,len,type,flags] v v vv v v v [ 3] E th 0x00841578 -> 1fc7 001e 0000 00 : 00 00 07 00 00 00 00 00 ff ff 03 00 00 00 00 00 : 00 00 00 20 04 07 01 88 ff 02 00 00 01 00 \--buffer content (if valid)------------------/
VRING rx = { pa = 0x00000000bb075000 va = 0xffff8800bb075000 size = 128 swtail = 127 swhead = 0 hwtail = [0x008813c8] -> 0x0000007f HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHS }
There is one block for Rx DMA vring and one for every Tx DMA vring.
Information printed:
You can see statistics and graphs of contributions to wil6210 here. Contact the wil6210 maintainer if you'd like to help with keeping this document up to date.
You should subscribe to this page so you can get e-mail updates on changes and news for ath9k automatically. You'll get an e-mail as soon as this page gets updated.