drivers/net/wireless/ath/wil6210/wmi.c

   1 /*
   2  * Copyright (c) 2012 Qualcomm Atheros, Inc.
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include <linux/etherdevice.h>
  18 #include <linux/if_arp.h>
  19
  20 #include "wil6210.h"
  21 #include "txrx.h"
  22 #include "wmi.h"
  23
  24 /**
  25  * WMI event receiving - theory of operations
  26  *
  27  * When firmware about to report WMI event, it fills memory area
  28  * in the mailbox and raises misc. IRQ. Thread interrupt handler invoked for
  29  * the misc IRQ, function @wmi_recv_cmd called by thread IRQ handler.
  30  *
  31  * @wmi_recv_cmd reads event, allocates memory chunk  and attaches it to the
  32  * event list @wil->pending_wmi_ev. Then, work queue @wil->wmi_wq wakes up
  33  * and handles events within the @wmi_event_worker. Every event get detached
  34  * from list, processed and deleted.
  35  *
  36  * Purpose for this mechanism is to release IRQ thread; otherwise,
  37  * if WMI event handling involves another WMI command flow, this 2-nd flow
  38  * won't be completed because of blocked IRQ thread.
  39  */
  40
  41 /**
  42  * Addressing - theory of operations
  43  *
  44  * There are several buses present on the WIL6210 card.
  45  * Same memory areas are visible at different address on
  46  * the different busses. There are 3 main bus masters:
  47  *  - MAC CPU (ucode)
  48  *  - User CPU (firmware)
  49  *  - AHB (host)
  50  *
  51  * On the PCI bus, there is one BAR (BAR0) of 2Mb size, exposing
  52  * AHB addresses starting from 0x880000
  53  *
  54  * Internally, firmware uses addresses that allows faster access but
  55  * are invisible from the host. To read from these addresses, alternative
  56  * AHB address must be used.
  57  *
  58  * Memory mapping
  59  * Linker address         PCI/Host address
  60  *                        0x880000 .. 0xa80000  2Mb BAR0
  61  * 0x800000 .. 0x807000   0x900000 .. 0x907000  28k DCCM
  62  * 0x840000 .. 0x857000   0x908000 .. 0x91f000  92k PERIPH
  63  */
  64
  65 /**
  66  * @fw_mapping provides memory remapping table
  67  */
  68 static const struct {
  69         u32 from; /* linker address - from, inclusive */
  70         u32 to;   /* linker address - to, exclusive */
  71         u32 host; /* PCI/Host address - BAR0 + 0x880000 */
  72 } fw_mapping[] = {
  73         {0x000000, 0x040000, 0x8c0000}, /* FW code RAM 256k */
  74         {0x800000, 0x808000, 0x900000}, /* FW data RAM 32k */
  75         {0x840000, 0x860000, 0x908000}, /* peripheral data RAM 128k/96k used */
  76         {0x880000, 0x88a000, 0x880000}, /* various RGF */
  77         {0x8c0000, 0x932000, 0x8c0000}, /* trivial mapping for upper area */
  78         /*
  79          * 920000..930000 ucode code RAM
  80          * 930000..932000 ucode data RAM
  81          */
  82 };
  83
  84 /**
  85  * return AHB address for given firmware/ucode internal (linker) address
  86  * @x - internal address
  87  * If address have no valid AHB mapping, return 0
  88  */
  89 static u32 wmi_addr_remap(u32 x)
  90 {
  91         uint i;
  92
  93         for (i = 0; i < ARRAY_SIZE(fw_mapping); i++) {
  94                 if ((x >= fw_mapping[i].from) && (x < fw_mapping[i].to))
  95                         return x + fw_mapping[i].host - fw_mapping[i].from;
  96         }
  97
  98         return 0;
  99 }
 100
 101 /**
 102  * Check address validity for WMI buffer; remap if needed
 103  * @ptr - internal (linker) fw/ucode address
 104  *
 105  * Valid buffer should be DWORD aligned
 106  *
 107  * return address for accessing buffer from the host;
 108  * if buffer is not valid, return NULL.
 109  */
 110 void __iomem *wmi_buffer(struct wil6210_priv *wil, __le32 ptr_)
 111 {
 112         u32 off;
 113         u32 ptr = le32_to_cpu(ptr_);
 114
 115         if (ptr % 4)
 116                 return NULL;
 117
 118         ptr = wmi_addr_remap(ptr);
 119         if (ptr < WIL6210_FW_HOST_OFF)
 120                 return NULL;
 121
 122         off = HOSTADDR(ptr);
 123         if (off > WIL6210_MEM_SIZE - 4)
 124                 return NULL;
 125
 126         return wil->csr + off;
 127 }
 128
 129 /**
 130  * Check address validity
 131  */
 132 void __iomem *wmi_addr(struct wil6210_priv *wil, u32 ptr)
 133 {
 134         u32 off;
 135
 136         if (ptr % 4)
 137                 return NULL;
 138
 139         if (ptr < WIL6210_FW_HOST_OFF)
 140                 return NULL;
 141
 142         off = HOSTADDR(ptr);
 143         if (off > WIL6210_MEM_SIZE - 4)
 144                 return NULL;
 145
 146         return wil->csr + off;
 147 }
 148
 149 int wmi_read_hdr(struct wil6210_priv *wil, __le32 ptr,
 150                  struct wil6210_mbox_hdr *hdr)
 151 {
 152         void __iomem *src = wmi_buffer(wil, ptr);
 153         if (!src)
 154                 return -EINVAL;
 155
 156         wil_memcpy_fromio_32(hdr, src, sizeof(*hdr));
 157
 158         return 0;
 159 }
 160
 161 static int __wmi_send(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len)
 162 {
 163         struct {
 164                 struct wil6210_mbox_hdr hdr;
 165                 struct wil6210_mbox_hdr_wmi wmi;
 166         } __packed cmd = {
 167                 .hdr = {
 168                         .type = WIL_MBOX_HDR_TYPE_WMI,
 169                         .flags = 0,
 170                         .len = cpu_to_le16(sizeof(cmd.wmi) + len),
 171                 },
 172                 .wmi = {
 173                         .id = cpu_to_le16(cmdid),
 174                         .info1 = 0,
 175                 },
 176         };
 177         struct wil6210_mbox_ring *r = &wil->mbox_ctl.tx;
 178         struct wil6210_mbox_ring_desc d_head;
 179         u32 next_head;
 180         void __iomem *dst;
 181         void __iomem *head = wmi_addr(wil, r->head);
 182         uint retry;
 183
 184         if (sizeof(cmd) + len > r->entry_size) {
 185                 wil_err(wil, "WMI size too large: %d bytes, max is %d\n",
 186                         (int)(sizeof(cmd) + len), r->entry_size);
 187                 return -ERANGE;
 188         }
 189
 190         might_sleep();
 191
 192         if (!test_bit(wil_status_fwready, &wil->status)) {
 193                 wil_err(wil, "FW not ready\n");
 194                 return -EAGAIN;
 195         }
 196
 197         if (!head) {
 198                 wil_err(wil, "WMI head is garbage: 0x%08x\n", r->head);
 199                 return -EINVAL;
 200         }
 201         /* read Tx head till it is not busy */
 202         for (retry = 5; retry > 0; retry--) {
 203                 wil_memcpy_fromio_32(&d_head, head, sizeof(d_head));
 204                 if (d_head.sync == 0)
 205                         break;
 206                 msleep(20);
 207         }
 208         if (d_head.sync != 0) {
 209                 wil_err(wil, "WMI head busy\n");
 210                 return -EBUSY;
 211         }
 212         /* next head */
 213         next_head = r->base + ((r->head - r->base + sizeof(d_head)) % r->size);
 214         wil_dbg_wmi(wil, "Head 0x%08x -> 0x%08x\n", r->head, next_head);
 215         /* wait till FW finish with previous command */
 216         for (retry = 5; retry > 0; retry--) {
 217                 r->tail = ioread32(wil->csr + HOST_MBOX +
 218                                    offsetof(struct wil6210_mbox_ctl, tx.tail));
 219                 if (next_head != r->tail)
 220                         break;
 221                 msleep(20);
 222         }
 223         if (next_head == r->tail) {
 224                 wil_err(wil, "WMI ring full\n");
 225                 return -EBUSY;
 226         }
 227         dst = wmi_buffer(wil, d_head.addr);
 228         if (!dst) {
 229                 wil_err(wil, "invalid WMI buffer: 0x%08x\n",
 230                         le32_to_cpu(d_head.addr));
 231                 return -EINVAL;
 232         }
 233         cmd.hdr.seq = cpu_to_le16(++wil->wmi_seq);
 234         /* set command */
 235         wil_dbg_wmi(wil, "WMI command 0x%04x [%d]\n", cmdid, len);
 236         wil_hex_dump_wmi("Cmd ", DUMP_PREFIX_OFFSET, 16, 1, &cmd,
 237                          sizeof(cmd), true);
 238         wil_hex_dump_wmi("cmd ", DUMP_PREFIX_OFFSET, 16, 1, buf,
 239                          len, true);
 240         wil_memcpy_toio_32(dst, &cmd, sizeof(cmd));
 241         wil_memcpy_toio_32(dst + sizeof(cmd), buf, len);
 242         /* mark entry as full */
 243         iowrite32(1, wil->csr + HOSTADDR(r->head) +
 244                   offsetof(struct wil6210_mbox_ring_desc, sync));
 245         /* advance next ptr */
 246         iowrite32(r->head = next_head, wil->csr + HOST_MBOX +
 247                   offsetof(struct wil6210_mbox_ctl, tx.head));
 248
 249         /* interrupt to FW */
 250         iowrite32(SW_INT_MBOX, wil->csr + HOST_SW_INT);
 251
 252         return 0;
 253 }
 254
 255 int wmi_send(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len)
 256 {
 257         int rc;
 258
 259         mutex_lock(&wil->wmi_mutex);
 260         rc = __wmi_send(wil, cmdid, buf, len);
 261         mutex_unlock(&wil->wmi_mutex);
 262
 263         return rc;
 264 }
 265
 266 /*=== Event handlers ===*/
 267 static void wmi_evt_ready(struct wil6210_priv *wil, int id, void *d, int len)
 268 {
 269         struct net_device *ndev = wil_to_ndev(wil);
 270         struct wireless_dev *wdev = wil->wdev;
 271         struct wmi_ready_event *evt = d;
 272         wil->fw_version = le32_to_cpu(evt->sw_version);
 273         wil->n_mids = evt->numof_additional_mids;
 274
 275         wil_dbg_wmi(wil, "FW ver. %d; MAC %pM; %d MID's\n", wil->fw_version,
 276                     evt->mac, wil->n_mids);
 277
 278         if (!is_valid_ether_addr(ndev->dev_addr)) {
 279                 memcpy(ndev->dev_addr, evt->mac, ETH_ALEN);
 280                 memcpy(ndev->perm_addr, evt->mac, ETH_ALEN);
 281         }
 282         snprintf(wdev->wiphy->fw_version, sizeof(wdev->wiphy->fw_version),
 283                  "%d", wil->fw_version);
 284 }
 285
 286 static void wmi_evt_fw_ready(struct wil6210_priv *wil, int id, void *d,
 287                              int len)
 288 {
 289         wil_dbg_wmi(wil, "WMI: FW ready\n");
 290
 291         set_bit(wil_status_fwready, &wil->status);
 292         /* reuse wmi_ready for the firmware ready indication */
 293         complete(&wil->wmi_ready);
 294 }
 295
 296 static void wmi_evt_rx_mgmt(struct wil6210_priv *wil, int id, void *d, int len)
 297 {
 298         struct wmi_rx_mgmt_packet_event *data = d;
 299         struct wiphy *wiphy = wil_to_wiphy(wil);
 300         struct ieee80211_mgmt *rx_mgmt_frame =
 301                         (struct ieee80211_mgmt *)data->payload;
 302         int ch_no = data->info.channel+1;
 303         u32 freq = ieee80211_channel_to_frequency(ch_no,
 304                         IEEE80211_BAND_60GHZ);
 305         struct ieee80211_channel *channel = ieee80211_get_channel(wiphy, freq);
 306         /* TODO convert LE to CPU */
 307         s32 signal = 0; /* TODO */
 308         __le16 fc = rx_mgmt_frame->frame_control;
 309         u32 d_len = le32_to_cpu(data->info.len);
 310         u16 d_status = le16_to_cpu(data->info.status);
 311
 312         wil_dbg_wmi(wil, "MGMT: channel %d MCS %d SNR %d\n",
 313                     data->info.channel, data->info.mcs, data->info.snr);
 314         wil_dbg_wmi(wil, "status 0x%04x len %d stype %04x\n", d_status, d_len,
 315                     le16_to_cpu(data->info.stype));
 316         wil_dbg_wmi(wil, "qid %d mid %d cid %d\n",
 317                     data->info.qid, data->info.mid, data->info.cid);
 318
 319         if (!channel) {
 320                 wil_err(wil, "Frame on unsupported channel\n");
 321                 return;
 322         }
 323
 324         if (ieee80211_is_beacon(fc) || ieee80211_is_probe_resp(fc)) {
 325                 struct cfg80211_bss *bss;
 326
 327                 bss = cfg80211_inform_bss_frame(wiphy, channel, rx_mgmt_frame,
 328                                                 d_len, signal, GFP_KERNEL);
 329                 if (bss) {
 330                         wil_dbg_wmi(wil, "Added BSS %pM\n",
 331                                     rx_mgmt_frame->bssid);
 332                         cfg80211_put_bss(wiphy, bss);
 333                 } else {
 334                         wil_err(wil, "cfg80211_inform_bss() failed\n");
 335                 }
 336         } else {
 337                 cfg80211_rx_mgmt(wil->wdev, freq, signal,
 338                                  (void *)rx_mgmt_frame, d_len, GFP_KERNEL);
 339         }
 340 }
 341
 342 static void wmi_evt_scan_complete(struct wil6210_priv *wil, int id,
 343                                   void *d, int len)
 344 {
 345         if (wil->scan_request) {
 346                 struct wmi_scan_complete_event *data = d;
 347                 bool aborted = (data->status != 0);
 348
 349                 wil_dbg_wmi(wil, "SCAN_COMPLETE(0x%08x)\n", data->status);
 350                 cfg80211_scan_done(wil->scan_request, aborted);
 351                 wil->scan_request = NULL;
 352         } else {
 353                 wil_err(wil, "SCAN_COMPLETE while not scanning\n");
 354         }
 355 }
 356
 357 static void wmi_evt_connect(struct wil6210_priv *wil, int id, void *d, int len)
 358 {
 359         struct net_device *ndev = wil_to_ndev(wil);
 360         struct wireless_dev *wdev = wil->wdev;
 361         struct wmi_connect_event *evt = d;
 362         int ch; /* channel number */
 363         struct station_info sinfo;
 364         u8 *assoc_req_ie, *assoc_resp_ie;
 365         size_t assoc_req_ielen, assoc_resp_ielen;
 366         /* capinfo(u16) + listen_interval(u16) + IEs */
 367         const size_t assoc_req_ie_offset = sizeof(u16) * 2;
 368         /* capinfo(u16) + status_code(u16) + associd(u16) + IEs */
 369         const size_t assoc_resp_ie_offset = sizeof(u16) * 3;
 370
 371         if (len < sizeof(*evt)) {
 372                 wil_err(wil, "Connect event too short : %d bytes\n", len);
 373                 return;
 374         }
 375         if (len != sizeof(*evt) + evt->beacon_ie_len + evt->assoc_req_len +
 376                    evt->assoc_resp_len) {
 377                 wil_err(wil,
 378                         "Connect event corrupted : %d != %d + %d + %d + %d\n",
 379                         len, (int)sizeof(*evt), evt->beacon_ie_len,
 380                         evt->assoc_req_len, evt->assoc_resp_len);
 381                 return;
 382         }
 383         ch = evt->channel + 1;
 384         wil_dbg_wmi(wil, "Connect %pM channel [%d] cid %d\n",
 385                     evt->bssid, ch, evt->cid);
 386         wil_hex_dump_wmi("connect AI : ", DUMP_PREFIX_OFFSET, 16, 1,
 387                          evt->assoc_info, len - sizeof(*evt), true);
 388
 389         /* figure out IE's */
 390         assoc_req_ie = &evt->assoc_info[evt->beacon_ie_len +
 391                                         assoc_req_ie_offset];
 392         assoc_req_ielen = evt->assoc_req_len - assoc_req_ie_offset;
 393         if (evt->assoc_req_len <= assoc_req_ie_offset) {
 394                 assoc_req_ie = NULL;
 395                 assoc_req_ielen = 0;
 396         }
 397
 398         assoc_resp_ie = &evt->assoc_info[evt->beacon_ie_len +
 399                                          evt->assoc_req_len +
 400                                          assoc_resp_ie_offset];
 401         assoc_resp_ielen = evt->assoc_resp_len - assoc_resp_ie_offset;
 402         if (evt->assoc_resp_len <= assoc_resp_ie_offset) {
 403                 assoc_resp_ie = NULL;
 404                 assoc_resp_ielen = 0;
 405         }
 406
 407         if ((wdev->iftype == NL80211_IFTYPE_STATION) ||
 408             (wdev->iftype == NL80211_IFTYPE_P2P_CLIENT)) {
 409                 if (wdev->sme_state != CFG80211_SME_CONNECTING) {
 410                         wil_err(wil, "Not in connecting state\n");
 411                         return;
 412                 }
 413                 del_timer_sync(&wil->connect_timer);
 414                 cfg80211_connect_result(ndev, evt->bssid,
 415                                         assoc_req_ie, assoc_req_ielen,
 416                                         assoc_resp_ie, assoc_resp_ielen,
 417                                         WLAN_STATUS_SUCCESS, GFP_KERNEL);
 418
 419         } else if ((wdev->iftype == NL80211_IFTYPE_AP) ||
 420                    (wdev->iftype == NL80211_IFTYPE_P2P_GO)) {
 421                 memset(&sinfo, 0, sizeof(sinfo));
 422
 423                 sinfo.generation = wil->sinfo_gen++;
 424
 425                 if (assoc_req_ie) {
 426                         sinfo.assoc_req_ies = assoc_req_ie;
 427                         sinfo.assoc_req_ies_len = assoc_req_ielen;
 428                         sinfo.filled |= STATION_INFO_ASSOC_REQ_IES;
 429                 }
 430
 431                 cfg80211_new_sta(ndev, evt->bssid, &sinfo, GFP_KERNEL);
 432         }
 433         set_bit(wil_status_fwconnected, &wil->status);
 434
 435         /* FIXME FW can transmit only ucast frames to peer */
 436         /* FIXME real ring_id instead of hard coded 0 */
 437         memcpy(wil->dst_addr[0], evt->bssid, ETH_ALEN);
 438
 439         wil->pending_connect_cid = evt->cid;
 440         queue_work(wil->wmi_wq_conn, &wil->connect_worker);
 441 }
 442
 443 static void wmi_evt_disconnect(struct wil6210_priv *wil, int id,
 444                                void *d, int len)
 445 {
 446         struct wmi_disconnect_event *evt = d;
 447
 448         wil_dbg_wmi(wil, "Disconnect %pM reason %d proto %d wmi\n",
 449                     evt->bssid,
 450                     evt->protocol_reason_status, evt->disconnect_reason);
 451
 452         wil->sinfo_gen++;
 453
 454         wil6210_disconnect(wil, evt->bssid);
 455 }
 456
 457 static void wmi_evt_notify(struct wil6210_priv *wil, int id, void *d, int len)
 458 {
 459         struct wmi_notify_req_done_event *evt = d;
 460
 461         if (len < sizeof(*evt)) {
 462                 wil_err(wil, "Short NOTIFY event\n");
 463                 return;
 464         }
 465
 466         wil->stats.tsf = le64_to_cpu(evt->tsf);
 467         wil->stats.snr = le32_to_cpu(evt->snr_val);
 468         wil->stats.bf_mcs = le16_to_cpu(evt->bf_mcs);
 469         wil->stats.my_rx_sector = le16_to_cpu(evt->my_rx_sector);
 470         wil->stats.my_tx_sector = le16_to_cpu(evt->my_tx_sector);
 471         wil->stats.peer_rx_sector = le16_to_cpu(evt->other_rx_sector);
 472         wil->stats.peer_tx_sector = le16_to_cpu(evt->other_tx_sector);
 473         wil_dbg_wmi(wil, "Link status, MCS %d TSF 0x%016llx\n"
 474                     "BF status 0x%08x SNR 0x%08x\n"
 475                     "Tx Tpt %d goodput %d Rx goodput %d\n"
 476                     "Sectors(rx:tx) my %d:%d peer %d:%d\n",
 477                     wil->stats.bf_mcs, wil->stats.tsf, evt->status,
 478                     wil->stats.snr, le32_to_cpu(evt->tx_tpt),
 479                     le32_to_cpu(evt->tx_goodput), le32_to_cpu(evt->rx_goodput),
 480                     wil->stats.my_rx_sector, wil->stats.my_tx_sector,
 481                     wil->stats.peer_rx_sector, wil->stats.peer_tx_sector);
 482 }
 483
 484 /*
 485  * Firmware reports EAPOL frame using WME event.
 486  * Reconstruct Ethernet frame and deliver it via normal Rx
 487  */
 488 static void wmi_evt_eapol_rx(struct wil6210_priv *wil, int id,
 489                              void *d, int len)
 490 {
 491         struct net_device *ndev = wil_to_ndev(wil);
 492         struct wmi_eapol_rx_event *evt = d;
 493         u16 eapol_len = le16_to_cpu(evt->eapol_len);
 494         int sz = eapol_len + ETH_HLEN;
 495         struct sk_buff *skb;
 496         struct ethhdr *eth;
 497
 498         wil_dbg_wmi(wil, "EAPOL len %d from %pM\n", eapol_len,
 499                     evt->src_mac);
 500
 501         if (eapol_len > 196) { /* TODO: revisit size limit */
 502                 wil_err(wil, "EAPOL too large\n");
 503                 return;
 504         }
 505
 506         skb = alloc_skb(sz, GFP_KERNEL);
 507         if (!skb) {
 508                 wil_err(wil, "Failed to allocate skb\n");
 509                 return;
 510         }
 511         eth = (struct ethhdr *)skb_put(skb, ETH_HLEN);
 512         memcpy(eth->h_dest, ndev->dev_addr, ETH_ALEN);
 513         memcpy(eth->h_source, evt->src_mac, ETH_ALEN);
 514         eth->h_proto = cpu_to_be16(ETH_P_PAE);
 515         memcpy(skb_put(skb, eapol_len), evt->eapol, eapol_len);
 516         skb->protocol = eth_type_trans(skb, ndev);
 517         if (likely(netif_rx_ni(skb) == NET_RX_SUCCESS)) {
 518                 ndev->stats.rx_packets++;
 519                 ndev->stats.rx_bytes += skb->len;
 520         } else {
 521                 ndev->stats.rx_dropped++;
 522         }
 523 }
 524
 525 static void wmi_evt_linkup(struct wil6210_priv *wil, int id, void *d, int len)
 526 {
 527         struct net_device *ndev = wil_to_ndev(wil);
 528         struct wmi_data_port_open_event *evt = d;
 529
 530         wil_dbg_wmi(wil, "Link UP for CID %d\n", evt->cid);
 531
 532         netif_carrier_on(ndev);
 533 }
 534
 535 static void wmi_evt_linkdown(struct wil6210_priv *wil, int id, void *d, int len)
 536 {
 537         struct net_device *ndev = wil_to_ndev(wil);
 538         struct wmi_wbe_link_down_event *evt = d;
 539
 540         wil_dbg_wmi(wil, "Link DOWN for CID %d, reason %d\n",
 541                     evt->cid, le32_to_cpu(evt->reason));
 542
 543         netif_carrier_off(ndev);
 544 }
 545
 546 static void wmi_evt_ba_status(struct wil6210_priv *wil, int id, void *d,
 547                               int len)
 548 {
 549         struct wmi_vring_ba_status_event *evt = d;
 550
 551         wil_dbg_wmi(wil, "BACK[%d] %s {%d} timeout %d\n",
 552                     evt->ringid, evt->status ? "N/A" : "OK", evt->agg_wsize,
 553                     __le16_to_cpu(evt->ba_timeout));
 554 }
 555
 556 static const struct {
 557         int eventid;
 558         void (*handler)(struct wil6210_priv *wil, int eventid,
 559                         void *data, int data_len);
 560 } wmi_evt_handlers[] = {
 561         {WMI_READY_EVENTID,             wmi_evt_ready},
 562         {WMI_FW_READY_EVENTID,          wmi_evt_fw_ready},
 563         {WMI_RX_MGMT_PACKET_EVENTID,    wmi_evt_rx_mgmt},
 564         {WMI_SCAN_COMPLETE_EVENTID,     wmi_evt_scan_complete},
 565         {WMI_CONNECT_EVENTID,           wmi_evt_connect},
 566         {WMI_DISCONNECT_EVENTID,        wmi_evt_disconnect},
 567         {WMI_NOTIFY_REQ_DONE_EVENTID,   wmi_evt_notify},
 568         {WMI_EAPOL_RX_EVENTID,          wmi_evt_eapol_rx},
 569         {WMI_DATA_PORT_OPEN_EVENTID,    wmi_evt_linkup},
 570         {WMI_WBE_LINKDOWN_EVENTID,      wmi_evt_linkdown},
 571         {WMI_BA_STATUS_EVENTID,         wmi_evt_ba_status},
 572 };
 573
 574 /*
 575  * Run in IRQ context
 576  * Extract WMI command from mailbox. Queue it to the @wil->pending_wmi_ev
 577  * that will be eventually handled by the @wmi_event_worker in the thread
 578  * context of thread "wil6210_wmi"
 579  */
 580 void wmi_recv_cmd(struct wil6210_priv *wil)
 581 {
 582         struct wil6210_mbox_ring_desc d_tail;
 583         struct wil6210_mbox_hdr hdr;
 584         struct wil6210_mbox_ring *r = &wil->mbox_ctl.rx;
 585         struct pending_wmi_event *evt;
 586         u8 *cmd;
 587         void __iomem *src;
 588         ulong flags;
 589
 590         if (!test_bit(wil_status_reset_done, &wil->status)) {
 591                 wil_err(wil, "Reset not completed\n");
 592                 return;
 593         }
 594
 595         for (;;) {
 596                 u16 len;
 597
 598                 r->head = ioread32(wil->csr + HOST_MBOX +
 599                                    offsetof(struct wil6210_mbox_ctl, rx.head));
 600                 if (r->tail == r->head)
 601                         return;
 602
 603                 /* read cmd from tail */
 604                 wil_memcpy_fromio_32(&d_tail, wil->csr + HOSTADDR(r->tail),
 605                                      sizeof(struct wil6210_mbox_ring_desc));
 606                 if (d_tail.sync == 0) {
 607                         wil_err(wil, "Mbox evt not owned by FW?\n");
 608                         return;
 609                 }
 610
 611                 if (0 != wmi_read_hdr(wil, d_tail.addr, &hdr)) {
 612                         wil_err(wil, "Mbox evt at 0x%08x?\n",
 613                                 le32_to_cpu(d_tail.addr));
 614                         return;
 615                 }
 616
 617                 len = le16_to_cpu(hdr.len);
 618                 src = wmi_buffer(wil, d_tail.addr) +
 619                       sizeof(struct wil6210_mbox_hdr);
 620                 evt = kmalloc(ALIGN(offsetof(struct pending_wmi_event,
 621                                              event.wmi) + len, 4),
 622                               GFP_KERNEL);
 623                 if (!evt)
 624                         return;
 625
 626                 evt->event.hdr = hdr;
 627                 cmd = (void *)&evt->event.wmi;
 628                 wil_memcpy_fromio_32(cmd, src, len);
 629                 /* mark entry as empty */
 630                 iowrite32(0, wil->csr + HOSTADDR(r->tail) +
 631                           offsetof(struct wil6210_mbox_ring_desc, sync));
 632                 /* indicate */
 633                 wil_dbg_wmi(wil, "Mbox evt %04x %04x %04x %02x\n",
 634                             le16_to_cpu(hdr.seq), len, le16_to_cpu(hdr.type),
 635                             hdr.flags);
 636                 if ((hdr.type == WIL_MBOX_HDR_TYPE_WMI) &&
 637                     (len >= sizeof(struct wil6210_mbox_hdr_wmi))) {
 638                         wil_dbg_wmi(wil, "WMI event 0x%04x\n",
 639                                     evt->event.wmi.id);
 640                 }
 641                 wil_hex_dump_wmi("evt ", DUMP_PREFIX_OFFSET, 16, 1,
 642                                  &evt->event.hdr, sizeof(hdr) + len, true);
 643
 644                 /* advance tail */
 645                 r->tail = r->base + ((r->tail - r->base +
 646                           sizeof(struct wil6210_mbox_ring_desc)) % r->size);
 647                 iowrite32(r->tail, wil->csr + HOST_MBOX +
 648                           offsetof(struct wil6210_mbox_ctl, rx.tail));
 649
 650                 /* add to the pending list */
 651                 spin_lock_irqsave(&wil->wmi_ev_lock, flags);
 652                 list_add_tail(&evt->list, &wil->pending_wmi_ev);
 653                 spin_unlock_irqrestore(&wil->wmi_ev_lock, flags);
 654                 {
 655                         int q = queue_work(wil->wmi_wq,
 656                                            &wil->wmi_event_worker);
 657                         wil_dbg_wmi(wil, "queue_work -> %d\n", q);
 658                 }
 659         }
 660 }
 661
 662 int wmi_call(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len,
 663              u16 reply_id, void *reply, u8 reply_size, int to_msec)
 664 {
 665         int rc;
 666         int remain;
 667
 668         mutex_lock(&wil->wmi_mutex);
 669
 670         rc = __wmi_send(wil, cmdid, buf, len);
 671         if (rc)
 672                 goto out;
 673
 674         wil->reply_id = reply_id;
 675         wil->reply_buf = reply;
 676         wil->reply_size = reply_size;
 677         remain = wait_for_completion_timeout(&wil->wmi_ready,
 678                         msecs_to_jiffies(to_msec));
 679         if (0 == remain) {
 680                 wil_err(wil, "wmi_call(0x%04x->0x%04x) timeout %d msec\n",
 681                         cmdid, reply_id, to_msec);
 682                 rc = -ETIME;
 683         } else {
 684                 wil_dbg_wmi(wil,
 685                             "wmi_call(0x%04x->0x%04x) completed in %d msec\n",
 686                             cmdid, reply_id,
 687                             to_msec - jiffies_to_msecs(remain));
 688         }
 689         wil->reply_id = 0;
 690         wil->reply_buf = NULL;
 691         wil->reply_size = 0;
 692  out:
 693         mutex_unlock(&wil->wmi_mutex);
 694
 695         return rc;
 696 }
 697
 698 int wmi_echo(struct wil6210_priv *wil)
 699 {
 700         struct wmi_echo_cmd cmd = {
 701                 .value = cpu_to_le32(0x12345678),
 702         };
 703
 704         return wmi_call(wil, WMI_ECHO_CMDID, &cmd, sizeof(cmd),
 705                          WMI_ECHO_RSP_EVENTID, NULL, 0, 20);
 706 }
 707
 708 int wmi_set_mac_address(struct wil6210_priv *wil, void *addr)
 709 {
 710         struct wmi_set_mac_address_cmd cmd;
 711
 712         memcpy(cmd.mac, addr, ETH_ALEN);
 713
 714         wil_dbg_wmi(wil, "Set MAC %pM\n", addr);
 715
 716         return wmi_send(wil, WMI_SET_MAC_ADDRESS_CMDID, &cmd, sizeof(cmd));
 717 }
 718
 719 int wmi_pcp_start(struct wil6210_priv *wil, int bi, u8 wmi_nettype, u8 chan)
 720 {
 721         int rc;
 722
 723         struct wmi_pcp_start_cmd cmd = {
 724                 .bcon_interval = cpu_to_le16(bi),
 725                 .network_type = wmi_nettype,
 726                 .disable_sec_offload = 1,
 727                 .channel = chan,
 728         };
 729         struct {
 730                 struct wil6210_mbox_hdr_wmi wmi;
 731                 struct wmi_pcp_started_event evt;
 732         } __packed reply;
 733
 734         if (!wil->secure_pcp)
 735                 cmd.disable_sec = 1;
 736
 737         rc = wmi_call(wil, WMI_PCP_START_CMDID, &cmd, sizeof(cmd),
 738                       WMI_PCP_STARTED_EVENTID, &reply, sizeof(reply), 100);
 739         if (rc)
 740                 return rc;
 741
 742         if (reply.evt.status != WMI_FW_STATUS_SUCCESS)
 743                 rc = -EINVAL;
 744
 745         return rc;
 746 }
 747
 748 int wmi_pcp_stop(struct wil6210_priv *wil)
 749 {
 750         return wmi_call(wil, WMI_PCP_STOP_CMDID, NULL, 0,
 751                         WMI_PCP_STOPPED_EVENTID, NULL, 0, 20);
 752 }
 753
 754 int wmi_set_ssid(struct wil6210_priv *wil, u8 ssid_len, const void *ssid)
 755 {
 756         struct wmi_set_ssid_cmd cmd = {
 757                 .ssid_len = cpu_to_le32(ssid_len),
 758         };
 759
 760         if (ssid_len > sizeof(cmd.ssid))
 761                 return -EINVAL;
 762
 763         memcpy(cmd.ssid, ssid, ssid_len);
 764
 765         return wmi_send(wil, WMI_SET_SSID_CMDID, &cmd, sizeof(cmd));
 766 }
 767
 768 int wmi_get_ssid(struct wil6210_priv *wil, u8 *ssid_len, void *ssid)
 769 {
 770         int rc;
 771         struct {
 772                 struct wil6210_mbox_hdr_wmi wmi;
 773                 struct wmi_set_ssid_cmd cmd;
 774         } __packed reply;
 775         int len; /* reply.cmd.ssid_len in CPU order */
 776
 777         rc = wmi_call(wil, WMI_GET_SSID_CMDID, NULL, 0, WMI_GET_SSID_EVENTID,
 778                       &reply, sizeof(reply), 20);
 779         if (rc)
 780                 return rc;
 781
 782         len = le32_to_cpu(reply.cmd.ssid_len);
 783         if (len > sizeof(reply.cmd.ssid))
 784                 return -EINVAL;
 785
 786         *ssid_len = len;
 787         memcpy(ssid, reply.cmd.ssid, len);
 788
 789         return 0;
 790 }
 791
 792 int wmi_set_channel(struct wil6210_priv *wil, int channel)
 793 {
 794         struct wmi_set_pcp_channel_cmd cmd = {
 795                 .channel = channel - 1,
 796         };
 797
 798         return wmi_send(wil, WMI_SET_PCP_CHANNEL_CMDID, &cmd, sizeof(cmd));
 799 }
 800
 801 int wmi_get_channel(struct wil6210_priv *wil, int *channel)
 802 {
 803         int rc;
 804         struct {
 805                 struct wil6210_mbox_hdr_wmi wmi;
 806                 struct wmi_set_pcp_channel_cmd cmd;
 807         } __packed reply;
 808
 809         rc = wmi_call(wil, WMI_GET_PCP_CHANNEL_CMDID, NULL, 0,
 810                       WMI_GET_PCP_CHANNEL_EVENTID, &reply, sizeof(reply), 20);
 811         if (rc)
 812                 return rc;
 813
 814         if (reply.cmd.channel > 3)
 815                 return -EINVAL;
 816
 817         *channel = reply.cmd.channel + 1;
 818
 819         return 0;
 820 }
 821
 822 int wmi_p2p_cfg(struct wil6210_priv *wil, int channel)
 823 {
 824         struct wmi_p2p_cfg_cmd cmd = {
 825                 .discovery_mode = WMI_DISCOVERY_MODE_NON_OFFLOAD,
 826                 .channel = channel - 1,
 827         };
 828
 829         return wmi_send(wil, WMI_P2P_CFG_CMDID, &cmd, sizeof(cmd));
 830 }
 831
 832 int wmi_tx_eapol(struct wil6210_priv *wil, struct sk_buff *skb)
 833 {
 834         struct wmi_eapol_tx_cmd *cmd;
 835         struct ethhdr *eth;
 836         u16 eapol_len = skb->len - ETH_HLEN;
 837         void *eapol = skb->data + ETH_HLEN;
 838         uint i;
 839         int rc;
 840
 841         skb_set_mac_header(skb, 0);
 842         eth = eth_hdr(skb);
 843         wil_dbg_wmi(wil, "EAPOL %d bytes to %pM\n", eapol_len, eth->h_dest);
 844         for (i = 0; i < ARRAY_SIZE(wil->vring_tx); i++) {
 845                 if (memcmp(wil->dst_addr[i], eth->h_dest, ETH_ALEN) == 0)
 846                         goto found_dest;
 847         }
 848
 849         return -EINVAL;
 850
 851  found_dest:
 852         /* find out eapol data & len */
 853         cmd = kzalloc(sizeof(*cmd) + eapol_len, GFP_KERNEL);
 854         if (!cmd)
 855                 return -EINVAL;
 856
 857         memcpy(cmd->dst_mac, eth->h_dest, ETH_ALEN);
 858         cmd->eapol_len = cpu_to_le16(eapol_len);
 859         memcpy(cmd->eapol, eapol, eapol_len);
 860         rc = wmi_send(wil, WMI_EAPOL_TX_CMDID, cmd, sizeof(*cmd) + eapol_len);
 861         kfree(cmd);
 862
 863         return rc;
 864 }
 865
 866 int wmi_del_cipher_key(struct wil6210_priv *wil, u8 key_index,
 867                        const void *mac_addr)
 868 {
 869         struct wmi_delete_cipher_key_cmd cmd = {
 870                 .key_index = key_index,
 871         };
 872
 873         if (mac_addr)
 874                 memcpy(cmd.mac, mac_addr, WMI_MAC_LEN);
 875
 876         return wmi_send(wil, WMI_DELETE_CIPHER_KEY_CMDID, &cmd, sizeof(cmd));
 877 }
 878
 879 int wmi_add_cipher_key(struct wil6210_priv *wil, u8 key_index,
 880                        const void *mac_addr, int key_len, const void *key)
 881 {
 882         struct wmi_add_cipher_key_cmd cmd = {
 883                 .key_index = key_index,
 884                 .key_usage = WMI_KEY_USE_PAIRWISE,
 885                 .key_len = key_len,
 886         };
 887
 888         if (!key || (key_len > sizeof(cmd.key)))
 889                 return -EINVAL;
 890
 891         memcpy(cmd.key, key, key_len);
 892         if (mac_addr)
 893                 memcpy(cmd.mac, mac_addr, WMI_MAC_LEN);
 894
 895         return wmi_send(wil, WMI_ADD_CIPHER_KEY_CMDID, &cmd, sizeof(cmd));
 896 }
 897
 898 int wmi_set_ie(struct wil6210_priv *wil, u8 type, u16 ie_len, const void *ie)
 899 {
 900         int rc;
 901         u16 len = sizeof(struct wmi_set_appie_cmd) + ie_len;
 902         struct wmi_set_appie_cmd *cmd = kzalloc(len, GFP_KERNEL);
 903         if (!cmd)
 904                 return -ENOMEM;
 905
 906         cmd->mgmt_frm_type = type;
 907         /* BUG: FW API define ieLen as u8. Will fix FW */
 908         cmd->ie_len = cpu_to_le16(ie_len);
 909         memcpy(cmd->ie_info, ie, ie_len);
 910         rc = wmi_send(wil, WMI_SET_APPIE_CMDID, cmd, len);
 911         kfree(cmd);
 912
 913         return rc;
 914 }
 915
 916 int wmi_rx_chain_add(struct wil6210_priv *wil, struct vring *vring)
 917 {
 918         struct wireless_dev *wdev = wil->wdev;
 919         struct net_device *ndev = wil_to_ndev(wil);
 920         struct wmi_cfg_rx_chain_cmd cmd = {
 921                 .action = WMI_RX_CHAIN_ADD,
 922                 .rx_sw_ring = {
 923                         .max_mpdu_size = cpu_to_le16(RX_BUF_LEN),
 924                         .ring_mem_base = cpu_to_le64(vring->pa),
 925                         .ring_size = cpu_to_le16(vring->size),
 926                 },
 927                 .mid = 0, /* TODO - what is it? */
 928                 .decap_trans_type = WMI_DECAP_TYPE_802_3,
 929         };
 930         struct {
 931                 struct wil6210_mbox_hdr_wmi wmi;
 932                 struct wmi_cfg_rx_chain_done_event evt;
 933         } __packed evt;
 934         int rc;
 935
 936         if (wdev->iftype == NL80211_IFTYPE_MONITOR) {
 937                 struct ieee80211_channel *ch = wdev->preset_chandef.chan;
 938
 939                 cmd.sniffer_cfg.mode = cpu_to_le32(WMI_SNIFFER_ON);
 940                 if (ch)
 941                         cmd.sniffer_cfg.channel = ch->hw_value - 1;
 942                 cmd.sniffer_cfg.phy_info_mode =
 943                         cpu_to_le32(ndev->type == ARPHRD_IEEE80211_RADIOTAP);
 944                 cmd.sniffer_cfg.phy_support =
 945                         cpu_to_le32((wil->monitor_flags & MONITOR_FLAG_CONTROL)
 946                                     ? WMI_SNIFFER_CP : WMI_SNIFFER_DP);
 947         }
 948         /* typical time for secure PCP is 840ms */
 949         rc = wmi_call(wil, WMI_CFG_RX_CHAIN_CMDID, &cmd, sizeof(cmd),
 950                       WMI_CFG_RX_CHAIN_DONE_EVENTID, &evt, sizeof(evt), 2000);
 951         if (rc)
 952                 return rc;
 953
 954         vring->hwtail = le32_to_cpu(evt.evt.rx_ring_tail_ptr);
 955
 956         wil_dbg_misc(wil, "Rx init: status %d tail 0x%08x\n",
 957                      le32_to_cpu(evt.evt.status), vring->hwtail);
 958
 959         if (le32_to_cpu(evt.evt.status) != WMI_CFG_RX_CHAIN_SUCCESS)
 960                 rc = -EINVAL;
 961
 962         return rc;
 963 }
 964
 965 int wmi_get_temperature(struct wil6210_priv *wil, u32 *t_m, u32 *t_r)
 966 {
 967         int rc;
 968         struct wmi_temp_sense_cmd cmd = {
 969                 .measure_marlon_m_en = cpu_to_le32(!!t_m),
 970                 .measure_marlon_r_en = cpu_to_le32(!!t_r),
 971         };
 972         struct {
 973                 struct wil6210_mbox_hdr_wmi wmi;
 974                 struct wmi_temp_sense_done_event evt;
 975         } __packed reply;
 976
 977         rc = wmi_call(wil, WMI_TEMP_SENSE_CMDID, &cmd, sizeof(cmd),
 978                       WMI_TEMP_SENSE_DONE_EVENTID, &reply, sizeof(reply), 100);
 979         if (rc)
 980                 return rc;
 981
 982         if (t_m)
 983                 *t_m = le32_to_cpu(reply.evt.marlon_m_t1000);
 984         if (t_r)
 985                 *t_r = le32_to_cpu(reply.evt.marlon_r_t1000);
 986
 987         return 0;
 988 }
 989
 990 void wmi_event_flush(struct wil6210_priv *wil)
 991 {
 992         struct pending_wmi_event *evt, *t;
 993
 994         wil_dbg_wmi(wil, "%s()\n", __func__);
 995
 996         list_for_each_entry_safe(evt, t, &wil->pending_wmi_ev, list) {
 997                 list_del(&evt->list);
 998                 kfree(evt);
 999         }
1000 }
1001
1002 static bool wmi_evt_call_handler(struct wil6210_priv *wil, int id,
1003                                  void *d, int len)
1004 {
1005         uint i;
1006
1007         for (i = 0; i < ARRAY_SIZE(wmi_evt_handlers); i++) {
1008                 if (wmi_evt_handlers[i].eventid == id) {
1009                         wmi_evt_handlers[i].handler(wil, id, d, len);
1010                         return true;
1011                 }
1012         }
1013
1014         return false;
1015 }
1016
1017 static void wmi_event_handle(struct wil6210_priv *wil,
1018                              struct wil6210_mbox_hdr *hdr)
1019 {
1020         u16 len = le16_to_cpu(hdr->len);
1021
1022         if ((hdr->type == WIL_MBOX_HDR_TYPE_WMI) &&
1023             (len >= sizeof(struct wil6210_mbox_hdr_wmi))) {
1024                 struct wil6210_mbox_hdr_wmi *wmi = (void *)(&hdr[1]);
1025                 void *evt_data = (void *)(&wmi[1]);
1026                 u16 id = le16_to_cpu(wmi->id);
1027                 /* check if someone waits for this event */
1028                 if (wil->reply_id && wil->reply_id == id) {
1029                         if (wil->reply_buf) {
1030                                 memcpy(wil->reply_buf, wmi,
1031                                        min(len, wil->reply_size));
1032                         } else {
1033                                 wmi_evt_call_handler(wil, id, evt_data,
1034                                                      len - sizeof(*wmi));
1035                         }
1036                         wil_dbg_wmi(wil, "Complete WMI 0x%04x\n", id);
1037                         complete(&wil->wmi_ready);
1038                         return;
1039                 }
1040                 /* unsolicited event */
1041                 /* search for handler */
1042                 if (!wmi_evt_call_handler(wil, id, evt_data,
1043                                           len - sizeof(*wmi))) {
1044                         wil_err(wil, "Unhandled event 0x%04x\n", id);
1045                 }
1046         } else {
1047                 wil_err(wil, "Unknown event type\n");
1048                 print_hex_dump(KERN_ERR, "evt?? ", DUMP_PREFIX_OFFSET, 16, 1,
1049                                hdr, sizeof(*hdr) + len, true);
1050         }
1051 }
1052
1053 /*
1054  * Retrieve next WMI event from the pending list
1055  */
1056 static struct list_head *next_wmi_ev(struct wil6210_priv *wil)
1057 {
1058         ulong flags;
1059         struct list_head *ret = NULL;
1060
1061         spin_lock_irqsave(&wil->wmi_ev_lock, flags);
1062
1063         if (!list_empty(&wil->pending_wmi_ev)) {
1064                 ret = wil->pending_wmi_ev.next;
1065                 list_del(ret);
1066         }
1067
1068         spin_unlock_irqrestore(&wil->wmi_ev_lock, flags);
1069
1070         return ret;
1071 }
1072
1073 /*
1074  * Handler for the WMI events
1075  */
1076 void wmi_event_worker(struct work_struct *work)
1077 {
1078         struct wil6210_priv *wil = container_of(work, struct wil6210_priv,
1079                                                  wmi_event_worker);
1080         struct pending_wmi_event *evt;
1081         struct list_head *lh;
1082
1083         while ((lh = next_wmi_ev(wil)) != NULL) {
1084                 evt = list_entry(lh, struct pending_wmi_event, list);
1085                 wmi_event_handle(wil, &evt->event.hdr);
1086                 kfree(evt);
1087         }
1088 }