1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2017-2026 Morse Micro 4 */ 5 #include <linux/types.h> 6 #include <linux/slab.h> 7 #include <linux/workqueue.h> 8 #include <linux/ktime.h> 9 #include <linux/skbuff.h> 10 #include <linux/jiffies.h> 11 #include "hif.h" 12 #include "skbq.h" 13 #include "mac.h" 14 #include "command.h" 15 #include "bus.h" 16 17 /* Returns number of bytes needed to word align */ 18 #define BYTES_NEEDED_TO_WORD_ALIGN(bytes) \ 19 ((bytes) & 0x3 ? (4 - ((bytes) & 0x3)) : 0) 20 21 /* Rounds down to the nearest word boundary */ 22 #define ROUND_DOWN_TO_WORD(bytes) \ 23 (BYTES_NEEDED_TO_WORD_ALIGN(bytes) ? \ 24 bytes - (4 - BYTES_NEEDED_TO_WORD_ALIGN(bytes)) : \ 25 bytes) 26 27 #define MM81X_SKBQ_MAX_TXQ_LEN 32 28 #define MM81X_SKBQ_TX_QUEUED_LIFETIME_MS 1000 29 #define MM81X_SKBQ_TX_STATUS_LIFETIME_MS (15 * 1000) 30 31 /* Returns padding needed to align x up to a 4-byte boundary */ 32 #define MM81X_PAD4(x) (((x) & 0x3) ? (4 - ((x) & 0x3)) : 0) 33 34 struct mm81x_tx_status_priv { 35 /* 36 * Time (jiffies) at which this packet has spent too long the pending 37 * queue, waiting for status notification from the firmware, and 38 * should be considered lost. 39 */ 40 unsigned long tx_status_expiry; 41 }; 42 43 static struct mm81x_tx_status_priv * 44 __mm81x_skbq_tx_status_priv(struct sk_buff *skb) 45 { 46 struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb); 47 48 BUILD_BUG_ON(sizeof(struct mm81x_tx_status_priv) > 49 sizeof(tx_info->status.status_driver_data)); 50 return (struct mm81x_tx_status_priv *)&tx_info->status 51 .status_driver_data[0]; 52 } 53 54 static bool __mm81x_skbq_has_pending_tx_skb_timed_out(struct sk_buff *skb) 55 { 56 struct mm81x_tx_status_priv *info = __mm81x_skbq_tx_status_priv(skb); 57 58 /* If our timestamp value is in the past then we have timed out. */ 59 return time_is_before_jiffies(info->tx_status_expiry); 60 } 61 62 static u32 __mm81x_skbq_size(const struct mm81x_skbq *mq) 63 { 64 return mq->skbq_size; 65 } 66 67 static u32 __mm81x_skbq_space(const struct mm81x_skbq *mq) 68 { 69 return MM81X_SKBQ_SIZE - __mm81x_skbq_size(mq); 70 } 71 72 static bool __mm81x_skbq_over_threshold(struct mm81x_skbq *mq) 73 { 74 return skb_queue_len(&mq->skbq) >= MM81X_SKBQ_MAX_TXQ_LEN; 75 } 76 77 static bool __mm81x_skbq_under_threshold(struct mm81x_skbq *mq) 78 { 79 return skb_queue_len(&mq->skbq) < (MM81X_SKBQ_MAX_TXQ_LEN - 2); 80 } 81 82 static void __mm81x_skbq_unlink(struct mm81x_skbq *mq, 83 struct sk_buff_head *queue, struct sk_buff *skb) 84 { 85 if (queue == &mq->skbq) { 86 WARN_ON(skb->len > mq->skbq_size); 87 mq->skbq_size -= min(skb->len, mq->skbq_size); 88 } 89 90 __skb_unlink(skb, queue); 91 } 92 93 static int __mm81x_skbq_put(struct mm81x_skbq *mq, struct sk_buff_head *queue, 94 struct sk_buff *skb, bool queue_at_head, 95 struct sk_buff *queue_before) 96 { 97 /* Limit the size of the Tx queue, but not the pending queue */ 98 if (queue == &mq->skbq) { 99 if (skb->len > __mm81x_skbq_space(mq)) 100 return -ENOMEM; 101 102 mq->skbq_size += skb->len; 103 } 104 105 if (queue_before) 106 __skb_queue_before(queue, queue_before, skb); 107 else if (queue_at_head) 108 __skb_queue_head(queue, skb); 109 else 110 __skb_queue_tail(queue, skb); 111 112 return 0; 113 } 114 115 static void __mm81x_skbq_pkt_id(struct mm81x_skbq *mq, struct sk_buff *skb) 116 { 117 struct mm81x_skb_hdr *hdr = (struct mm81x_skb_hdr *)skb->data; 118 119 hdr->tx_info.pkt_id = cpu_to_le32(mq->pkt_seq++); 120 } 121 122 static struct mm81x_skbq * 123 __mm81x_skbq_tx_status_to_skbq(struct mm81x *mors, 124 const struct mm81x_skb_tx_status *tx_sts) 125 { 126 int aci; 127 struct mm81x_skbq *mq = NULL; 128 129 switch (tx_sts->channel) { 130 case MM81X_SKB_CHAN_DATA: 131 case MM81X_SKB_CHAN_DATA_NOACK: 132 aci = dot11_tid_to_ac(tx_sts->tid); 133 mq = mm81x_hif_get_tx_data_queue(mors, aci); 134 break; 135 case MM81X_SKB_CHAN_MGMT: 136 mq = mm81x_hif_get_tx_mgmt_queue(mors); 137 break; 138 case MM81X_SKB_CHAN_BEACON: 139 mq = mm81x_hif_get_tx_beacon_queue(mors); 140 break; 141 default: 142 dev_err(mors->dev, 143 "unexpected channel on reported tx status [%d]", 144 tx_sts->channel); 145 } 146 147 return mq; 148 } 149 150 void mm81x_skbq_pull_hdr_post_tx(struct sk_buff *skb) 151 { 152 skb_pull(skb, sizeof(struct mm81x_skb_hdr) + 153 ((struct mm81x_skb_hdr *)skb->data)->offset); 154 } 155 156 static void mm81x_skbq_insert_pending(struct mm81x_skbq *mq, 157 struct sk_buff *skb, __le32 insertion_id) 158 { 159 struct sk_buff *pfirst, *pnext; 160 struct mm81x_skb_hdr *mhdr; 161 struct sk_buff *tail = skb_peek_tail(&mq->skbq); 162 163 __mm81x_skbq_unlink(mq, &mq->pending, skb); 164 165 if (!tail) { 166 __mm81x_skbq_put(mq, &mq->skbq, skb, false, NULL); 167 return; 168 } 169 170 /* Check if it should just be inserted on to the end */ 171 mhdr = (struct mm81x_skb_hdr *)tail->data; 172 WARN_ON(insertion_id == mhdr->tx_info.pkt_id); 173 if (le32_to_cpu(insertion_id) >= le32_to_cpu(mhdr->tx_info.pkt_id)) { 174 __mm81x_skbq_put(mq, &mq->skbq, skb, false, NULL); 175 return; 176 } 177 178 /* Otherwise, re-insert to correct spot in skbq */ 179 skb_queue_walk_safe(&mq->skbq, pfirst, pnext) { 180 mhdr = (struct mm81x_skb_hdr *)pfirst->data; 181 182 WARN_ON(insertion_id == mhdr->tx_info.pkt_id); 183 if (le32_to_cpu(insertion_id) <= 184 le32_to_cpu(mhdr->tx_info.pkt_id)) { 185 __mm81x_skbq_put(mq, &mq->skbq, skb, false, pfirst); 186 return; 187 } 188 } 189 190 WARN_ON_ONCE(1); 191 } 192 193 static void mm81x_skbq_sta_eosp(struct mm81x *mors, struct sk_buff *skb) 194 { 195 struct ieee80211_tx_info *txi = IEEE80211_SKB_CB(skb); 196 struct ieee80211_vif *vif = txi->control.vif; 197 198 mm81x_skbq_pull_hdr_post_tx(skb); 199 200 /* 201 * If this frame is the last frame in a PS-Poll or u-APSD SP, 202 * then mac80211 must be informed that the SP is now over. 203 */ 204 if (txi->flags & IEEE80211_TX_STATUS_EOSP) { 205 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 206 struct ieee80211_sta *sta; 207 208 scoped_guard(rcu) { 209 sta = ieee80211_find_sta(vif, hdr->addr1); 210 if (sta) 211 ieee80211_sta_eosp(sta); 212 } 213 } 214 } 215 216 static void __mm81x_skbq_drop_pending_skb(struct mm81x_skbq *mq, 217 struct sk_buff *skb) 218 { 219 __mm81x_skbq_unlink(mq, &mq->pending, skb); 220 mm81x_skbq_sta_eosp(mq->mors, skb); 221 ieee80211_free_txskb(mq->mors->hw, skb); 222 } 223 224 static bool mm81x_tx_h_is_ps_filtered(struct mm81x_skbq *mq, 225 struct sk_buff *skb, 226 struct mm81x_skb_tx_status *tx_sts) 227 { 228 struct ieee80211_tx_info *txi = IEEE80211_SKB_CB(skb); 229 struct ieee80211_vif *vif = txi->control.vif; 230 231 WARN_ON_ONCE(!(le32_to_cpu(tx_sts->flags) & 232 MM81X_TX_STATUS_FLAGS_PS_FILTERED)); 233 234 if (vif->type == NL80211_IFTYPE_AP) { 235 __mm81x_skbq_drop_pending_skb(mq, skb); 236 return true; 237 } 238 239 if (vif->type == NL80211_IFTYPE_STATION) { 240 mm81x_skbq_insert_pending(mq, skb, tx_sts->pkt_id); 241 return true; 242 } 243 244 return false; 245 } 246 247 /* 248 * Get a pending frame by its ID. This will also drop frames with 249 * older packet ids that are in the list 250 */ 251 static struct sk_buff *__mm81x_skbq_get_pending_by_id(struct mm81x *mors, 252 struct mm81x_skbq *mq, 253 u32 pkt_id) 254 { 255 struct sk_buff *pfirst, *pnext; 256 struct sk_buff *ret = NULL; 257 258 /* Move sent packets to pending list waiting for feedback */ 259 skb_queue_walk_safe(&mq->pending, pfirst, pnext) { 260 struct mm81x_skb_hdr *hdr = 261 (struct mm81x_skb_hdr *)pfirst->data; 262 263 if (le32_to_cpu(hdr->tx_info.pkt_id) == pkt_id) { 264 ret = pfirst; 265 break; 266 267 } else if (le32_to_cpu(hdr->tx_info.pkt_id) < pkt_id && 268 __mm81x_skbq_has_pending_tx_skb_timed_out(pfirst)) { 269 __mm81x_skbq_drop_pending_skb(mq, pfirst); 270 } 271 } 272 273 return ret; 274 } 275 276 static void mm81x_skbq_check_tx_empty(struct mm81x *mors, struct mm81x_skbq *mq) 277 { 278 lockdep_assert_held(&mq->lock); 279 280 if (mq->flags & MM81X_HIF_FLAGS_BEACON) 281 return; 282 283 if (skb_queue_len(&mq->skbq) + skb_queue_len(&mq->pending) == 0) 284 wake_up(&mq->mors->tx_empty_waitq); 285 } 286 287 static void __mm81x_skbq_tx_status_process(struct mm81x *mors, 288 struct mm81x_skbq *mq, 289 struct mm81x_skb_tx_status *tx_sts) 290 { 291 struct sk_buff *skb; 292 293 lockdep_assert_held(&mq->lock); 294 295 skb = __mm81x_skbq_get_pending_by_id(mors, mq, 296 le32_to_cpu(tx_sts->pkt_id)); 297 if (!skb) { 298 dev_dbg(mors->dev, 299 "No pending pkt match found [pktid:%d chan:%d]", 300 tx_sts->pkt_id, tx_sts->channel); 301 goto out; 302 } 303 304 if (le32_to_cpu(tx_sts->flags) & MM81X_TX_STATUS_PAGE_INVALID) { 305 __mm81x_skbq_drop_pending_skb(mq, skb); 306 goto out; 307 } 308 309 if (le32_to_cpu(tx_sts->flags) & MM81X_TX_STATUS_FLAGS_PS_FILTERED && 310 mm81x_tx_h_is_ps_filtered(mq, skb, tx_sts)) 311 /* Has been consumed by mm81x_tx_h_is_ps_filtered */ 312 goto out; 313 314 mm81x_skbq_pull_hdr_post_tx(skb); 315 mm81x_skbq_skb_finish(mq, skb, tx_sts); 316 317 out: 318 mm81x_skbq_check_tx_empty(mors, mq); 319 } 320 321 static void mm81x_skbq_tx_status_process(struct mm81x *mors, 322 struct sk_buff *skb) 323 { 324 int i; 325 struct mm81x_skb_tx_status *tx_sts = 326 (struct mm81x_skb_tx_status *)skb->data; 327 int count = skb->len / sizeof(*tx_sts); 328 329 for (i = 0; i < count; tx_sts++, i++) { 330 struct mm81x_skbq *mq = 331 __mm81x_skbq_tx_status_to_skbq(mors, tx_sts); 332 333 if (mq) { 334 spin_lock_bh(&mq->lock); 335 __mm81x_skbq_tx_status_process(mors, mq, tx_sts); 336 spin_unlock_bh(&mq->lock); 337 } 338 } 339 340 if (mors->ps.enable && !mors->ps.suspended && 341 (mm81x_hif_get_tx_buffered_count(mors) == 0)) { 342 /* Evaluate ps, check if it was gated on a pending tx status */ 343 queue_delayed_work(mors->chip_wq, &mors->ps.delayed_eval_work, 344 0); 345 } 346 } 347 348 static void mm81x_skbq_dispatch_work(struct work_struct *dispatch_work) 349 { 350 struct mm81x_skbq *mq = 351 container_of(dispatch_work, struct mm81x_skbq, dispatch_work); 352 struct mm81x *mors = mq->mors; 353 struct mm81x_skb_hdr *hdr; 354 struct sk_buff_head skbq; 355 struct sk_buff *pfirst, *pnext; 356 u8 channel; 357 358 __skb_queue_head_init(&skbq); 359 360 mm81x_skbq_deq_num_skb(mq, &skbq, mm81x_skbq_count(mq)); 361 362 skb_queue_walk_safe(&skbq, pfirst, pnext) { 363 __skb_unlink(pfirst, &skbq); 364 /* Header endianness has already be adjusted */ 365 hdr = (struct mm81x_skb_hdr *)pfirst->data; 366 channel = hdr->channel; 367 /* Remove mm81x header and padding */ 368 __skb_pull(pfirst, sizeof(*hdr) + hdr->offset); 369 370 switch (channel) { 371 case MM81X_SKB_CHAN_COMMAND: 372 mm81x_cmd_resp_process(mors, pfirst); 373 break; 374 case MM81X_SKB_CHAN_TX_STATUS: 375 mm81x_skbq_tx_status_process(mors, pfirst); 376 dev_kfree_skb_any(pfirst); 377 break; 378 default: 379 mm81x_mac_rx_skb(mors, pfirst, &hdr->rx_status); 380 break; 381 } 382 } 383 384 if (mm81x_skbq_count(mq)) 385 queue_work(mors->net_wq, &mq->dispatch_work); 386 } 387 388 int mm81x_skbq_put(struct mm81x_skbq *mq, struct sk_buff *skb) 389 { 390 int ret; 391 392 spin_lock_bh(&mq->lock); 393 ret = __mm81x_skbq_put(mq, &mq->skbq, skb, false, NULL); 394 spin_unlock_bh(&mq->lock); 395 return ret; 396 } 397 398 static void mm81x_skbq_set_queued_tx_skb_expiry(struct sk_buff *skb) 399 { 400 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 401 struct ieee80211_tx_info *txi = IEEE80211_SKB_CB(skb); 402 403 if (ieee80211_is_probe_req(hdr->frame_control) || 404 ieee80211_is_probe_resp(hdr->frame_control) || 405 ieee80211_is_auth(hdr->frame_control)) { 406 txi->control.enqueue_time = (u32)jiffies; 407 } else { 408 txi->control.enqueue_time = 0; 409 } 410 } 411 412 static bool mm81x_skbq_has_queued_tx_skb_expired(struct sk_buff *skb) 413 { 414 struct ieee80211_tx_info *txi = IEEE80211_SKB_CB(skb); 415 416 if (txi->control.enqueue_time > 0) { 417 u32 expiry_time = 418 txi->control.enqueue_time + 419 msecs_to_jiffies(MM81X_SKBQ_TX_QUEUED_LIFETIME_MS); 420 421 return (s32)((u32)jiffies - expiry_time) > 0; 422 } 423 424 return false; 425 } 426 427 /* 428 * Drop selected frames (those with an expiry time set) that could not 429 * be sent within a reasonable timeframe due to congestion. These would 430 * only be rejected or ignored by the peer, so are only contributing to 431 * the problem. 432 */ 433 void mm81x_skbq_purge_aged(struct mm81x *mors, struct mm81x_skbq *mq) 434 { 435 struct sk_buff *pfirst; 436 struct sk_buff *pnext; 437 438 spin_lock_bh(&mq->lock); 439 skb_queue_walk_safe(&mq->skbq, pfirst, pnext) { 440 if (!mm81x_skbq_has_queued_tx_skb_expired(pfirst)) 441 break; 442 __mm81x_skbq_unlink(mq, &mq->skbq, pfirst); 443 ieee80211_free_txskb(mors->hw, pfirst); 444 } 445 446 spin_unlock_bh(&mq->lock); 447 } 448 449 void mm81x_skbq_purge(struct mm81x_skbq *mq, struct sk_buff_head *skbq) 450 { 451 struct sk_buff *skb; 452 453 spin_lock_bh(&mq->lock); 454 while ((skb = __skb_dequeue(skbq))) 455 dev_kfree_skb_any(skb); 456 spin_unlock_bh(&mq->lock); 457 } 458 459 void mm81x_skbq_enq(struct mm81x_skbq *mq, struct sk_buff_head *skbq) 460 { 461 int size; 462 struct sk_buff *pfirst, *pnext; 463 464 spin_lock_bh(&mq->lock); 465 size = __mm81x_skbq_space(mq); 466 skb_queue_walk_safe(skbq, pfirst, pnext) { 467 if (pfirst->len > size) 468 break; 469 __skb_unlink(pfirst, skbq); 470 __mm81x_skbq_put(mq, &mq->skbq, pfirst, false, NULL); 471 size -= pfirst->len; 472 } 473 474 spin_unlock_bh(&mq->lock); 475 } 476 477 int mm81x_skbq_deq_num_skb(struct mm81x_skbq *mq, struct sk_buff_head *skbq, 478 int num_skb) 479 { 480 int count = 0; 481 struct sk_buff *pfirst, *pnext; 482 483 spin_lock_bh(&mq->lock); 484 skb_queue_walk_safe(&mq->skbq, pfirst, pnext) { 485 if (count >= num_skb) 486 break; 487 __mm81x_skbq_unlink(mq, &mq->skbq, pfirst); 488 __skb_queue_tail(skbq, pfirst); 489 ++count; 490 } 491 492 spin_unlock_bh(&mq->lock); 493 return count; 494 } 495 496 void mm81x_skbq_enq_prepend(struct mm81x_skbq *mq, struct sk_buff_head *skbq) 497 { 498 int size; 499 struct sk_buff *pfirst, *pnext; 500 501 spin_lock_bh(&mq->lock); 502 size = __mm81x_skbq_space(mq); 503 504 /* 505 * We are doing a reverse walk here to ensure the order remains the 506 * same. This means the last member of the queue goes in, on top of 507 * the queue first and gets pushed down as more members get added to 508 * the top of the queue. 509 */ 510 skb_queue_reverse_walk_safe(skbq, pfirst, pnext) { 511 if (pfirst->len > size) 512 break; 513 __skb_unlink(pfirst, skbq); 514 __mm81x_skbq_put(mq, &mq->skbq, pfirst, true, NULL); 515 size -= pfirst->len; 516 } 517 518 spin_unlock_bh(&mq->lock); 519 } 520 521 static void mm81x_skbq_stop_tx_queues(struct mm81x *mors) 522 { 523 int queue; 524 525 if (!mors->started) 526 return; 527 for (queue = IEEE80211_AC_VO; queue <= IEEE80211_AC_BK; queue++) 528 ieee80211_stop_queue(mors->hw, queue); 529 530 set_bit(MM81X_STATE_DATA_QS_STOPPED, &mors->state_flags); 531 } 532 533 /* Wake all Tx queues if all queues are below threshold */ 534 void mm81x_skbq_may_wake_tx_queues(struct mm81x *mors) 535 { 536 int queue; 537 struct mm81x_skbq *qs; 538 int num_qs; 539 bool could_wake; 540 541 if (!mors->started) 542 return; 543 544 could_wake = true; 545 mm81x_hif_skbq_get_tx_qs(mors, &qs, &num_qs); 546 for (queue = 0; queue < num_qs; queue++) { 547 struct mm81x_skbq *mq = &qs[queue]; 548 549 if (!could_wake) 550 break; 551 552 spin_lock_bh(&mq->lock); 553 could_wake &= (__mm81x_skbq_under_threshold(mq)); 554 spin_unlock_bh(&mq->lock); 555 } 556 557 if (!could_wake) 558 return; 559 560 for (queue = IEEE80211_AC_VO; queue <= IEEE80211_AC_BK; queue++) 561 ieee80211_wake_queue(mors->hw, queue); 562 563 clear_bit(MM81X_STATE_DATA_QS_STOPPED, &mors->state_flags); 564 } 565 566 static int mm81x_skbq_tx(struct mm81x_skbq *mq, struct sk_buff *skb, u8 channel) 567 { 568 int rc; 569 bool mq_over_threshold; 570 struct mm81x *mors = mq->mors; 571 572 spin_lock_bh(&mq->lock); 573 rc = __mm81x_skbq_put(mq, &mq->skbq, skb, false, NULL); 574 if (rc) { 575 dev_err(mors->dev, "skb put chan %d failed (%d)", channel, rc); 576 if (channel == MM81X_SKB_CHAN_DATA) { 577 u16 queue = skb_get_queue_mapping(skb); 578 579 dev_err(mors->dev, "skb put queue %d status %d", queue, 580 ieee80211_queue_stopped(mors->hw, queue)); 581 } 582 } 583 584 /* Fill packet ID in TX info */ 585 __mm81x_skbq_pkt_id(mq, skb); 586 587 mq_over_threshold = __mm81x_skbq_over_threshold(mq); 588 spin_unlock_bh(&mq->lock); 589 590 /* For data packets stop queues */ 591 if (channel == MM81X_SKB_CHAN_DATA && mq_over_threshold) 592 mm81x_skbq_stop_tx_queues(mors); 593 594 switch (channel) { 595 case MM81X_SKB_CHAN_DATA: 596 case MM81X_SKB_CHAN_DATA_NOACK: 597 if (mm81x_is_data_tx_allowed(mors)) { 598 set_bit(MM81X_HIF_EVT_TX_DATA_PEND, 599 &mors->hif.event_flags); 600 queue_work(mors->chip_wq, &mors->hif_work); 601 } 602 break; 603 case MM81X_SKB_CHAN_MGMT: 604 set_bit(MM81X_HIF_EVT_TX_MGMT_PEND, &mors->hif.event_flags); 605 queue_work(mors->chip_wq, &mors->hif_work); 606 break; 607 case MM81X_SKB_CHAN_BEACON: 608 set_bit(MM81X_HIF_EVT_TX_BEACON_PEND, &mors->hif.event_flags); 609 queue_work(mors->chip_wq, &mors->hif_work); 610 break; 611 case MM81X_SKB_CHAN_COMMAND: 612 set_bit(MM81X_HIF_EVT_TX_COMMAND_PEND, &mors->hif.event_flags); 613 queue_work(mors->chip_wq, &mors->hif_work); 614 break; 615 default: 616 dev_err(mors->dev, "Invalid skb channel: %d", channel); 617 break; 618 } 619 620 return rc; 621 } 622 623 static void __mm81x_skbq_tx_move_to_pending(struct mm81x_skbq *mq, 624 struct sk_buff *skb) 625 { 626 struct mm81x_tx_status_priv *pend_info = 627 __mm81x_skbq_tx_status_priv(skb); 628 629 pend_info->tx_status_expiry = 630 jiffies + msecs_to_jiffies(MM81X_SKBQ_TX_STATUS_LIFETIME_MS); 631 __mm81x_skbq_put(mq, &mq->pending, skb, false, NULL); 632 } 633 634 void mm81x_skbq_tx_complete(struct mm81x_skbq *mq, struct sk_buff_head *skbq) 635 { 636 bool skb_awaits_tx_status = false; 637 struct mm81x *mors = mq->mors; 638 struct sk_buff *pfirst, *pnext; 639 struct sk_buff *peek = skb_peek(skbq); 640 struct mm81x_skb_hdr *hdr; 641 const bool fw_reports_bcn_tx_status = 642 mors->fw_flags & MM81X_FW_FLAGS_REPORTS_TX_BEACON_COMPLETION; 643 644 if (!peek) 645 return; 646 647 /* Move sent packets to pending list waiting for feedback */ 648 spin_lock_bh(&mq->lock); 649 skb_queue_walk_safe(skbq, pfirst, pnext) { 650 __skb_unlink(pfirst, skbq); 651 hdr = (struct mm81x_skb_hdr *)pfirst->data; 652 /* 653 * If firmware doesn't give status on beacons just free 654 * them, otherwise queue and wait for response. 655 */ 656 switch (hdr->channel) { 657 case MM81X_SKB_CHAN_BEACON: 658 if (fw_reports_bcn_tx_status) { 659 __mm81x_skbq_tx_move_to_pending(mq, pfirst); 660 skb_awaits_tx_status = true; 661 break; 662 } 663 /* 664 * If the FW doesn't give statuses on beacon's, 665 * then mark them as done. 666 */ 667 mm81x_skbq_pull_hdr_post_tx(pfirst); 668 dev_kfree_skb_any(pfirst); 669 break; 670 default: 671 if (le32_to_cpu(hdr->tx_info.flags) & 672 MM81X_TX_STATUS_FLAGS_NO_REPORT) { 673 dev_kfree_skb_any(pfirst); 674 } else { 675 /* 676 * skb has been given to the chip. Store the 677 * time and queue the skb onto the pending 678 * queue while we wait for the tx_status. 679 */ 680 __mm81x_skbq_tx_move_to_pending(mq, pfirst); 681 skb_awaits_tx_status = true; 682 } 683 break; 684 } 685 } 686 spin_unlock_bh(&mq->lock); 687 688 if (skb_awaits_tx_status) { 689 spin_lock_bh(&mors->stale_status.lock); 690 mod_timer(&mors->stale_status.timer, 691 jiffies + msecs_to_jiffies( 692 MM81X_SKBQ_TX_STATUS_LIFETIME_MS)); 693 spin_unlock_bh(&mors->stale_status.lock); 694 } 695 } 696 697 /* Returns the first skb in the pending list. */ 698 struct sk_buff *mm81x_skbq_tx_pending(struct mm81x_skbq *mq) 699 { 700 struct sk_buff *pfirst; 701 702 spin_lock_bh(&mq->lock); 703 pfirst = skb_peek(&mq->pending); 704 spin_unlock_bh(&mq->lock); 705 return pfirst; 706 } 707 708 int mm81x_skbq_check_for_stale_tx(struct mm81x *mors, struct mm81x_skbq *mq) 709 { 710 int flushed = 0; 711 struct sk_buff *pfirst; 712 struct sk_buff *pnext; 713 714 if (!skb_queue_len(&mq->pending)) 715 return 0; 716 717 /* Move sent packets to pending list waiting for feedback */ 718 spin_lock_bh(&mq->lock); 719 skb_queue_walk_safe(&mq->pending, pfirst, pnext) { 720 struct mm81x_skb_hdr *hdr = 721 (struct mm81x_skb_hdr *)pfirst->data; 722 723 if (__mm81x_skbq_has_pending_tx_skb_timed_out(pfirst)) { 724 dev_dbg(mors->dev, "TX skb timed out [id:%d,chan:%d]", 725 hdr->tx_info.pkt_id, hdr->channel); 726 727 __mm81x_skbq_drop_pending_skb(mq, pfirst); 728 flushed++; 729 } 730 } 731 732 if (flushed) 733 mm81x_skbq_check_tx_empty(mors, mq); 734 735 spin_unlock_bh(&mq->lock); 736 return flushed; 737 } 738 739 /* Remove commands from pending (or skbq if not sent) */ 740 static void __skbq_cmd_finish(struct mm81x_skbq *mq, struct sk_buff *skb) 741 { 742 struct mm81x *mors = mq->mors; 743 744 if (skb_queue_len(&mq->pending)) { 745 __mm81x_skbq_unlink(mq, &mq->pending, skb); 746 dev_kfree_skb(skb); 747 } else if (skb_queue_len(&mq->skbq)) { 748 /* Command was probably timed out before being sent */ 749 dev_dbg(mors->dev, 750 "Command pending queue empty. Removing from SKBQ."); 751 __mm81x_skbq_unlink(mq, &mq->skbq, skb); 752 dev_kfree_skb(skb); 753 } else { 754 dev_dbg(mors->dev, "Command Q not found"); 755 } 756 } 757 758 struct mm81x_update_sta_iter_data { 759 struct mm81x *mors; 760 struct sk_buff *skb; 761 struct mm81x_skb_tx_status *tx_sts; 762 int tx_attempts; 763 bool updated; 764 }; 765 766 static void mm81x_tx_h_update_sta_iter(void *data, u8 *mac, 767 struct ieee80211_vif *vif) 768 { 769 struct mm81x_update_sta_iter_data *iter = data; 770 struct ieee80211_hdr *hdr; 771 struct ieee80211_sta *sta; 772 773 if (iter->updated || !iter->skb || !iter->skb->data) 774 return; 775 776 hdr = (struct ieee80211_hdr *)iter->skb->data; 777 778 /* 779 * Note that each iteration via 780 * ieee80211_iterate_active_interfaces_atomic is under an RCU critical 781 * section so there is no need for a local critical section within here 782 * when looking up the station. 783 */ 784 sta = ieee80211_find_sta(vif, hdr->addr1); 785 if (!sta) 786 return; 787 788 mm81x_rc_sta_feedback_rates(iter->mors, iter->skb, sta, iter->tx_sts, 789 iter->tx_attempts); 790 mm81x_tx_h_check_aggr(sta, iter->skb); 791 792 /* 793 * In situations with multiple virtual interfaces, finish iteration 794 * once we have found our STA to prevent further iteration. 795 */ 796 iter->updated = true; 797 } 798 799 /* TX status/Response received remove packet from pending TX finish */ 800 static void __skbq_data_tx_finish(struct mm81x_skbq *mq, struct sk_buff *skb, 801 struct mm81x_skb_tx_status *tx_sts) 802 { 803 struct mm81x *mors = mq->mors; 804 struct mm81x_update_sta_iter_data iter = {}; 805 806 __mm81x_skbq_unlink(mq, &mq->pending, skb); 807 iter.mors = mors; 808 iter.skb = skb; 809 iter.tx_sts = tx_sts; 810 iter.tx_attempts = mm81x_tx_h_get_attempts(mors, tx_sts); 811 812 ieee80211_iterate_active_interfaces_atomic(mors->hw, 813 IEEE80211_IFACE_ITER_NORMAL, 814 mm81x_tx_h_update_sta_iter, 815 &iter); 816 817 ieee80211_tx_status_skb(mors->hw, skb); 818 } 819 820 void mm81x_skbq_skb_finish(struct mm81x_skbq *mq, struct sk_buff *skb, 821 struct mm81x_skb_tx_status *tx_sts) 822 { 823 if (mq->flags & MM81X_HIF_FLAGS_COMMAND) 824 __skbq_cmd_finish(mq, skb); 825 else 826 __skbq_data_tx_finish(mq, skb, tx_sts); 827 } 828 829 void mm81x_skbq_tx_flush(struct mm81x_skbq *mq) 830 { 831 struct sk_buff *pfirst, *pnext; 832 833 spin_lock_bh(&mq->lock); 834 skb_queue_walk_safe(&mq->pending, pfirst, pnext) { 835 __mm81x_skbq_unlink(mq, &mq->pending, pfirst); 836 ieee80211_free_txskb(mq->mors->hw, pfirst); 837 } 838 839 skb_queue_walk_safe(&mq->skbq, pfirst, pnext) { 840 __mm81x_skbq_unlink(mq, &mq->skbq, pfirst); 841 ieee80211_free_txskb(mq->mors->hw, pfirst); 842 } 843 spin_unlock_bh(&mq->lock); 844 } 845 846 void mm81x_skbq_init(struct mm81x *mors, struct mm81x_skbq *mq, u16 flags) 847 { 848 spin_lock_init(&mq->lock); 849 __skb_queue_head_init(&mq->skbq); 850 __skb_queue_head_init(&mq->pending); 851 mq->mors = mors; 852 mq->skbq_size = 0; 853 mq->flags = flags; 854 mq->pkt_seq = 0; 855 if (flags & MM81X_HIF_FLAGS_DIR_TO_HOST) 856 INIT_WORK(&mq->dispatch_work, mm81x_skbq_dispatch_work); 857 } 858 859 void mm81x_skbq_finish(struct mm81x_skbq *mq) 860 { 861 if (mq->skbq_size > 0) 862 dev_dbg(mq->mors->dev, 863 "Purging a non empty MorseQ. Dropping data!"); 864 865 /* Clean up link to hif */ 866 if (mq->flags & MM81X_HIF_FLAGS_DIR_TO_HOST) 867 cancel_work_sync(&mq->dispatch_work); 868 mm81x_skbq_purge(mq, &mq->skbq); 869 mm81x_skbq_purge(mq, &mq->pending); 870 mq->skbq_size = 0; 871 } 872 873 u32 mm81x_skbq_size(struct mm81x_skbq *mq) 874 { 875 u32 count; 876 877 spin_lock_bh(&mq->lock); 878 count = __mm81x_skbq_size(mq); 879 spin_unlock_bh(&mq->lock); 880 return count; 881 } 882 883 u32 mm81x_skbq_count(struct mm81x_skbq *mq) 884 { 885 u32 count = 0; 886 887 spin_lock_bh(&mq->lock); 888 count += skb_queue_len(&mq->skbq); 889 spin_unlock_bh(&mq->lock); 890 return count; 891 } 892 893 u32 mm81x_skbq_pending_count(struct mm81x_skbq *mq) 894 { 895 u32 count; 896 897 spin_lock_bh(&mq->lock); 898 count = skb_queue_len(&mq->pending); 899 spin_unlock_bh(&mq->lock); 900 return count; 901 } 902 903 u32 mm81x_skbq_count_tx_ready(struct mm81x_skbq *mq) 904 { 905 struct mm81x *mors = mq->mors; 906 907 if (!mm81x_is_data_tx_allowed(mors)) 908 return 0; 909 910 return mm81x_skbq_count(mq); 911 } 912 913 u32 mm81x_skbq_space(struct mm81x_skbq *mq) 914 { 915 u32 space; 916 917 spin_lock_bh(&mq->lock); 918 space = __mm81x_skbq_space(mq); 919 spin_unlock_bh(&mq->lock); 920 921 return space; 922 } 923 924 struct sk_buff *mm81x_skbq_alloc_skb(struct mm81x_skbq *mq, unsigned int length) 925 { 926 struct sk_buff *skb; 927 int tx_headroom = sizeof(struct mm81x_skb_hdr) + 928 mm81x_bus_get_alignment(mq->mors); 929 int skb_len = tx_headroom + length + MM81X_PAD4(length); 930 931 skb = dev_alloc_skb(skb_len); 932 if (!skb) 933 return NULL; 934 935 skb_reserve(skb, tx_headroom); 936 skb_put(skb, length); 937 return skb; 938 } 939 940 static int mm81x_skb_tx_h_validate_channel(const struct mm81x *mors, u8 channel) 941 { 942 if (channel == MM81X_SKB_CHAN_COMMAND) { 943 if (test_bit(MM81X_STATE_HOST_TO_CHIP_CMD_BLOCKED, 944 &mors->state_flags)) 945 return -EPERM; 946 } else { 947 if (test_bit(MM81X_STATE_HOST_TO_CHIP_TX_BLOCKED, 948 &mors->state_flags)) 949 return -EPERM; 950 } 951 952 return 0; 953 } 954 955 int mm81x_skbq_skb_tx(struct mm81x_skbq *mq, struct sk_buff **skb_orig, 956 struct mm81x_skb_tx_info *tx_info, u8 channel) 957 { 958 int ret; 959 struct mm81x_skb_hdr hdr; 960 struct mm81x *mors = mq->mors; 961 size_t end_of_skb_pad; 962 struct sk_buff *skb = *skb_orig; 963 u8 *aligned_head, *data; 964 965 if (test_bit(MM81X_STATE_CHIP_UNRESPONSIVE, &mors->state_flags)) { 966 dev_kfree_skb_any(skb); 967 return -ENODEV; 968 } 969 970 ret = mm81x_skb_tx_h_validate_channel(mors, channel); 971 if (ret) { 972 dev_kfree_skb_any(skb); 973 return ret; 974 } 975 976 mm81x_skbq_set_queued_tx_skb_expiry(skb); 977 978 data = skb->data; 979 aligned_head = PTR_ALIGN_DOWN((data - sizeof(hdr)), 980 mm81x_bus_get_alignment(mors)); 981 hdr.sync = MM81X_SKB_HEADER_SYNC; 982 hdr.channel = channel; 983 hdr.len = cpu_to_le16(skb->len); 984 hdr.offset = data - (aligned_head + sizeof(hdr)); 985 hdr.checksum_upper = 0; 986 hdr.checksum_lower = 0; 987 if (tx_info) 988 memcpy(&hdr.tx_info, tx_info, sizeof(*tx_info)); 989 else 990 memset(&hdr.tx_info, 0, sizeof(hdr.tx_info)); 991 992 skb_push(skb, data - aligned_head); 993 memcpy(skb->data, &hdr, sizeof(hdr)); 994 995 end_of_skb_pad = MM81X_PAD4(skb->len); 996 if (end_of_skb_pad && skb_pad(skb, end_of_skb_pad)) 997 return -EINVAL; 998 999 ret = mm81x_skbq_tx(mq, skb, channel); 1000 if (ret) { 1001 dev_err(mors->dev, "mm81x_skbq_tx fail: %d", ret); 1002 dev_kfree_skb_any(skb); 1003 } 1004 1005 return ret; 1006 } 1007 1008 void mm81x_skbq_data_traffic_pause(struct mm81x *mors) 1009 { 1010 set_bit(MM81X_STATE_DATA_TX_STOPPED, &mors->state_flags); 1011 /* power-save requirements will be re-evaluated by the caller */ 1012 } 1013 1014 void mm81x_skbq_data_traffic_resume(struct mm81x *mors) 1015 { 1016 clear_bit(MM81X_STATE_DATA_TX_STOPPED, &mors->state_flags); 1017 1018 /* Set the TX_DATA_PEND bit. This will kick the transmission path to 1019 * send any frames pending in the TX buffers, and wake the mac80211 1020 * data Qs if they were previously stopped. 1021 */ 1022 set_bit(MM81X_HIF_EVT_TX_DATA_PEND, &mors->hif.event_flags); 1023 } 1024 1025 bool mm81x_skbq_validate_checksum(u8 *data) 1026 { 1027 int i; 1028 u32 xor = 0; 1029 struct mm81x_skb_hdr *skb_hdr = (struct mm81x_skb_hdr *)data; 1030 struct ieee80211_hdr *hdr = 1031 (struct ieee80211_hdr *)(data + sizeof(*skb_hdr)); 1032 u16 len = le16_to_cpu(skb_hdr->len) + sizeof(*skb_hdr); 1033 u32 *data_to_xor = (u32 *)data; 1034 u32 header_xor = (le16_to_cpu(skb_hdr->checksum_upper) << 8) | 1035 (skb_hdr->checksum_lower); 1036 1037 /* 1038 * For data frames the calculate the xor for skb header, mac header 1039 * and ccmp header. For all other channel the xor is calculated for 1040 * the full skb. 1041 */ 1042 if (skb_hdr->channel == MM81X_SKB_CHAN_DATA && 1043 (ieee80211_is_data(hdr->frame_control) || 1044 ieee80211_is_data_qos(hdr->frame_control))) { 1045 u16 data_len = sizeof(*skb_hdr) + 1046 sizeof(struct ieee80211_qos_hdr) + 1047 IEEE80211_CCMP_HDR_LEN; 1048 1049 len = min(len, data_len); 1050 len = ROUND_DOWN_TO_WORD(len); 1051 } 1052 1053 skb_hdr->checksum_upper = 0; 1054 skb_hdr->checksum_lower = 0; 1055 1056 for (i = 0; i < len; i += 4) { 1057 xor ^= *data_to_xor; 1058 data_to_xor++; 1059 } 1060 1061 xor &= 0x00FFFFFF; 1062 1063 return xor == header_xor; 1064 } 1065