Loading...
Note: File does not exist in v3.1.
1/*
2 * Copyright (c) 2012-2016 Qualcomm Atheros, Inc.
3 *
4 * Permission to use, copy, modify, and/or distribute this software for any
5 * purpose with or without fee is hereby granted, provided that the above
6 * copyright notice and this permission notice appear in all copies.
7 *
8 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15 */
16
17#include <linux/moduleparam.h>
18#include <linux/etherdevice.h>
19#include <linux/if_arp.h>
20
21#include "wil6210.h"
22#include "txrx.h"
23#include "wmi.h"
24#include "trace.h"
25
26static uint max_assoc_sta = WIL6210_MAX_CID;
27module_param(max_assoc_sta, uint, S_IRUGO | S_IWUSR);
28MODULE_PARM_DESC(max_assoc_sta, " Max number of stations associated to the AP");
29
30int agg_wsize; /* = 0; */
31module_param(agg_wsize, int, S_IRUGO | S_IWUSR);
32MODULE_PARM_DESC(agg_wsize, " Window size for Tx Block Ack after connect;"
33 " 0 - use default; < 0 - don't auto-establish");
34
35u8 led_id = WIL_LED_INVALID_ID;
36module_param(led_id, byte, S_IRUGO);
37MODULE_PARM_DESC(led_id,
38 " 60G device led enablement. Set the led ID (0-2) to enable");
39
40/**
41 * WMI event receiving - theory of operations
42 *
43 * When firmware about to report WMI event, it fills memory area
44 * in the mailbox and raises misc. IRQ. Thread interrupt handler invoked for
45 * the misc IRQ, function @wmi_recv_cmd called by thread IRQ handler.
46 *
47 * @wmi_recv_cmd reads event, allocates memory chunk and attaches it to the
48 * event list @wil->pending_wmi_ev. Then, work queue @wil->wmi_wq wakes up
49 * and handles events within the @wmi_event_worker. Every event get detached
50 * from list, processed and deleted.
51 *
52 * Purpose for this mechanism is to release IRQ thread; otherwise,
53 * if WMI event handling involves another WMI command flow, this 2-nd flow
54 * won't be completed because of blocked IRQ thread.
55 */
56
57/**
58 * Addressing - theory of operations
59 *
60 * There are several buses present on the WIL6210 card.
61 * Same memory areas are visible at different address on
62 * the different busses. There are 3 main bus masters:
63 * - MAC CPU (ucode)
64 * - User CPU (firmware)
65 * - AHB (host)
66 *
67 * On the PCI bus, there is one BAR (BAR0) of 2Mb size, exposing
68 * AHB addresses starting from 0x880000
69 *
70 * Internally, firmware uses addresses that allows faster access but
71 * are invisible from the host. To read from these addresses, alternative
72 * AHB address must be used.
73 *
74 * Memory mapping
75 * Linker address PCI/Host address
76 * 0x880000 .. 0xa80000 2Mb BAR0
77 * 0x800000 .. 0x807000 0x900000 .. 0x907000 28k DCCM
78 * 0x840000 .. 0x857000 0x908000 .. 0x91f000 92k PERIPH
79 */
80
81/**
82 * @fw_mapping provides memory remapping table
83 *
84 * array size should be in sync with the declaration in the wil6210.h
85 */
86const struct fw_map fw_mapping[] = {
87 /* FW code RAM 256k */
88 {0x000000, 0x040000, 0x8c0000, "fw_code", true},
89 /* FW data RAM 32k */
90 {0x800000, 0x808000, 0x900000, "fw_data", true},
91 /* periph data 128k */
92 {0x840000, 0x860000, 0x908000, "fw_peri", true},
93 /* various RGF 40k */
94 {0x880000, 0x88a000, 0x880000, "rgf", true},
95 /* AGC table 4k */
96 {0x88a000, 0x88b000, 0x88a000, "AGC_tbl", true},
97 /* Pcie_ext_rgf 4k */
98 {0x88b000, 0x88c000, 0x88b000, "rgf_ext", true},
99 /* mac_ext_rgf 512b */
100 {0x88c000, 0x88c200, 0x88c000, "mac_rgf_ext", true},
101 /* upper area 548k */
102 {0x8c0000, 0x949000, 0x8c0000, "upper", true},
103 /* UCODE areas - accessible by debugfs blobs but not by
104 * wmi_addr_remap. UCODE areas MUST be added AFTER FW areas!
105 */
106 /* ucode code RAM 128k */
107 {0x000000, 0x020000, 0x920000, "uc_code", false},
108 /* ucode data RAM 16k */
109 {0x800000, 0x804000, 0x940000, "uc_data", false},
110};
111
112struct blink_on_off_time led_blink_time[] = {
113 {WIL_LED_BLINK_ON_SLOW_MS, WIL_LED_BLINK_OFF_SLOW_MS},
114 {WIL_LED_BLINK_ON_MED_MS, WIL_LED_BLINK_OFF_MED_MS},
115 {WIL_LED_BLINK_ON_FAST_MS, WIL_LED_BLINK_OFF_FAST_MS},
116};
117
118u8 led_polarity = LED_POLARITY_LOW_ACTIVE;
119
120/**
121 * return AHB address for given firmware internal (linker) address
122 * @x - internal address
123 * If address have no valid AHB mapping, return 0
124 */
125static u32 wmi_addr_remap(u32 x)
126{
127 uint i;
128
129 for (i = 0; i < ARRAY_SIZE(fw_mapping); i++) {
130 if (fw_mapping[i].fw &&
131 ((x >= fw_mapping[i].from) && (x < fw_mapping[i].to)))
132 return x + fw_mapping[i].host - fw_mapping[i].from;
133 }
134
135 return 0;
136}
137
138/**
139 * Check address validity for WMI buffer; remap if needed
140 * @ptr - internal (linker) fw/ucode address
141 *
142 * Valid buffer should be DWORD aligned
143 *
144 * return address for accessing buffer from the host;
145 * if buffer is not valid, return NULL.
146 */
147void __iomem *wmi_buffer(struct wil6210_priv *wil, __le32 ptr_)
148{
149 u32 off;
150 u32 ptr = le32_to_cpu(ptr_);
151
152 if (ptr % 4)
153 return NULL;
154
155 ptr = wmi_addr_remap(ptr);
156 if (ptr < WIL6210_FW_HOST_OFF)
157 return NULL;
158
159 off = HOSTADDR(ptr);
160 if (off > WIL6210_MEM_SIZE - 4)
161 return NULL;
162
163 return wil->csr + off;
164}
165
166/**
167 * Check address validity
168 */
169void __iomem *wmi_addr(struct wil6210_priv *wil, u32 ptr)
170{
171 u32 off;
172
173 if (ptr % 4)
174 return NULL;
175
176 if (ptr < WIL6210_FW_HOST_OFF)
177 return NULL;
178
179 off = HOSTADDR(ptr);
180 if (off > WIL6210_MEM_SIZE - 4)
181 return NULL;
182
183 return wil->csr + off;
184}
185
186int wmi_read_hdr(struct wil6210_priv *wil, __le32 ptr,
187 struct wil6210_mbox_hdr *hdr)
188{
189 void __iomem *src = wmi_buffer(wil, ptr);
190
191 if (!src)
192 return -EINVAL;
193
194 wil_memcpy_fromio_32(hdr, src, sizeof(*hdr));
195
196 return 0;
197}
198
199static int __wmi_send(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len)
200{
201 struct {
202 struct wil6210_mbox_hdr hdr;
203 struct wmi_cmd_hdr wmi;
204 } __packed cmd = {
205 .hdr = {
206 .type = WIL_MBOX_HDR_TYPE_WMI,
207 .flags = 0,
208 .len = cpu_to_le16(sizeof(cmd.wmi) + len),
209 },
210 .wmi = {
211 .mid = 0,
212 .command_id = cpu_to_le16(cmdid),
213 },
214 };
215 struct wil6210_mbox_ring *r = &wil->mbox_ctl.tx;
216 struct wil6210_mbox_ring_desc d_head;
217 u32 next_head;
218 void __iomem *dst;
219 void __iomem *head = wmi_addr(wil, r->head);
220 uint retry;
221 int rc = 0;
222
223 if (sizeof(cmd) + len > r->entry_size) {
224 wil_err(wil, "WMI size too large: %d bytes, max is %d\n",
225 (int)(sizeof(cmd) + len), r->entry_size);
226 return -ERANGE;
227 }
228
229 might_sleep();
230
231 if (!test_bit(wil_status_fwready, wil->status)) {
232 wil_err(wil, "WMI: cannot send command while FW not ready\n");
233 return -EAGAIN;
234 }
235
236 if (!head) {
237 wil_err(wil, "WMI head is garbage: 0x%08x\n", r->head);
238 return -EINVAL;
239 }
240
241 wil_halp_vote(wil);
242
243 /* read Tx head till it is not busy */
244 for (retry = 5; retry > 0; retry--) {
245 wil_memcpy_fromio_32(&d_head, head, sizeof(d_head));
246 if (d_head.sync == 0)
247 break;
248 msleep(20);
249 }
250 if (d_head.sync != 0) {
251 wil_err(wil, "WMI head busy\n");
252 rc = -EBUSY;
253 goto out;
254 }
255 /* next head */
256 next_head = r->base + ((r->head - r->base + sizeof(d_head)) % r->size);
257 wil_dbg_wmi(wil, "Head 0x%08x -> 0x%08x\n", r->head, next_head);
258 /* wait till FW finish with previous command */
259 for (retry = 5; retry > 0; retry--) {
260 if (!test_bit(wil_status_fwready, wil->status)) {
261 wil_err(wil, "WMI: cannot send command while FW not ready\n");
262 rc = -EAGAIN;
263 goto out;
264 }
265 r->tail = wil_r(wil, RGF_MBOX +
266 offsetof(struct wil6210_mbox_ctl, tx.tail));
267 if (next_head != r->tail)
268 break;
269 msleep(20);
270 }
271 if (next_head == r->tail) {
272 wil_err(wil, "WMI ring full\n");
273 rc = -EBUSY;
274 goto out;
275 }
276 dst = wmi_buffer(wil, d_head.addr);
277 if (!dst) {
278 wil_err(wil, "invalid WMI buffer: 0x%08x\n",
279 le32_to_cpu(d_head.addr));
280 rc = -EAGAIN;
281 goto out;
282 }
283 cmd.hdr.seq = cpu_to_le16(++wil->wmi_seq);
284 /* set command */
285 wil_dbg_wmi(wil, "WMI command 0x%04x [%d]\n", cmdid, len);
286 wil_hex_dump_wmi("Cmd ", DUMP_PREFIX_OFFSET, 16, 1, &cmd,
287 sizeof(cmd), true);
288 wil_hex_dump_wmi("cmd ", DUMP_PREFIX_OFFSET, 16, 1, buf,
289 len, true);
290 wil_memcpy_toio_32(dst, &cmd, sizeof(cmd));
291 wil_memcpy_toio_32(dst + sizeof(cmd), buf, len);
292 /* mark entry as full */
293 wil_w(wil, r->head + offsetof(struct wil6210_mbox_ring_desc, sync), 1);
294 /* advance next ptr */
295 wil_w(wil, RGF_MBOX + offsetof(struct wil6210_mbox_ctl, tx.head),
296 r->head = next_head);
297
298 trace_wil6210_wmi_cmd(&cmd.wmi, buf, len);
299
300 /* interrupt to FW */
301 wil_w(wil, RGF_USER_USER_ICR + offsetof(struct RGF_ICR, ICS),
302 SW_INT_MBOX);
303
304out:
305 wil_halp_unvote(wil);
306 return rc;
307}
308
309int wmi_send(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len)
310{
311 int rc;
312
313 mutex_lock(&wil->wmi_mutex);
314 rc = __wmi_send(wil, cmdid, buf, len);
315 mutex_unlock(&wil->wmi_mutex);
316
317 return rc;
318}
319
320/*=== Event handlers ===*/
321static void wmi_evt_ready(struct wil6210_priv *wil, int id, void *d, int len)
322{
323 struct wireless_dev *wdev = wil->wdev;
324 struct wmi_ready_event *evt = d;
325
326 wil->n_mids = evt->numof_additional_mids;
327
328 wil_info(wil, "FW ver. %s(SW %d); MAC %pM; %d MID's\n",
329 wil->fw_version, le32_to_cpu(evt->sw_version),
330 evt->mac, wil->n_mids);
331 /* ignore MAC address, we already have it from the boot loader */
332 strlcpy(wdev->wiphy->fw_version, wil->fw_version,
333 sizeof(wdev->wiphy->fw_version));
334
335 wil_set_recovery_state(wil, fw_recovery_idle);
336 set_bit(wil_status_fwready, wil->status);
337 /* let the reset sequence continue */
338 complete(&wil->wmi_ready);
339}
340
341static void wmi_evt_rx_mgmt(struct wil6210_priv *wil, int id, void *d, int len)
342{
343 struct wmi_rx_mgmt_packet_event *data = d;
344 struct wiphy *wiphy = wil_to_wiphy(wil);
345 struct ieee80211_mgmt *rx_mgmt_frame =
346 (struct ieee80211_mgmt *)data->payload;
347 int flen = len - offsetof(struct wmi_rx_mgmt_packet_event, payload);
348 int ch_no;
349 u32 freq;
350 struct ieee80211_channel *channel;
351 s32 signal;
352 __le16 fc;
353 u32 d_len;
354 u16 d_status;
355
356 if (flen < 0) {
357 wil_err(wil, "MGMT Rx: short event, len %d\n", len);
358 return;
359 }
360
361 d_len = le32_to_cpu(data->info.len);
362 if (d_len != flen) {
363 wil_err(wil,
364 "MGMT Rx: length mismatch, d_len %d should be %d\n",
365 d_len, flen);
366 return;
367 }
368
369 ch_no = data->info.channel + 1;
370 freq = ieee80211_channel_to_frequency(ch_no, NL80211_BAND_60GHZ);
371 channel = ieee80211_get_channel(wiphy, freq);
372 signal = data->info.sqi;
373 d_status = le16_to_cpu(data->info.status);
374 fc = rx_mgmt_frame->frame_control;
375
376 wil_dbg_wmi(wil, "MGMT Rx: channel %d MCS %d SNR %d SQI %d%%\n",
377 data->info.channel, data->info.mcs, data->info.snr,
378 data->info.sqi);
379 wil_dbg_wmi(wil, "status 0x%04x len %d fc 0x%04x\n", d_status, d_len,
380 le16_to_cpu(fc));
381 wil_dbg_wmi(wil, "qid %d mid %d cid %d\n",
382 data->info.qid, data->info.mid, data->info.cid);
383 wil_hex_dump_wmi("MGMT Rx ", DUMP_PREFIX_OFFSET, 16, 1, rx_mgmt_frame,
384 d_len, true);
385
386 if (!channel) {
387 wil_err(wil, "Frame on unsupported channel\n");
388 return;
389 }
390
391 if (ieee80211_is_beacon(fc) || ieee80211_is_probe_resp(fc)) {
392 struct cfg80211_bss *bss;
393 u64 tsf = le64_to_cpu(rx_mgmt_frame->u.beacon.timestamp);
394 u16 cap = le16_to_cpu(rx_mgmt_frame->u.beacon.capab_info);
395 u16 bi = le16_to_cpu(rx_mgmt_frame->u.beacon.beacon_int);
396 const u8 *ie_buf = rx_mgmt_frame->u.beacon.variable;
397 size_t ie_len = d_len - offsetof(struct ieee80211_mgmt,
398 u.beacon.variable);
399 wil_dbg_wmi(wil, "Capability info : 0x%04x\n", cap);
400 wil_dbg_wmi(wil, "TSF : 0x%016llx\n", tsf);
401 wil_dbg_wmi(wil, "Beacon interval : %d\n", bi);
402 wil_hex_dump_wmi("IE ", DUMP_PREFIX_OFFSET, 16, 1, ie_buf,
403 ie_len, true);
404
405 wil_dbg_wmi(wil, "Capability info : 0x%04x\n", cap);
406
407 bss = cfg80211_inform_bss_frame(wiphy, channel, rx_mgmt_frame,
408 d_len, signal, GFP_KERNEL);
409 if (bss) {
410 wil_dbg_wmi(wil, "Added BSS %pM\n",
411 rx_mgmt_frame->bssid);
412 cfg80211_put_bss(wiphy, bss);
413 } else {
414 wil_err(wil, "cfg80211_inform_bss_frame() failed\n");
415 }
416 } else {
417 mutex_lock(&wil->p2p_wdev_mutex);
418 cfg80211_rx_mgmt(wil->radio_wdev, freq, signal,
419 (void *)rx_mgmt_frame, d_len, 0);
420 mutex_unlock(&wil->p2p_wdev_mutex);
421 }
422}
423
424static void wmi_evt_tx_mgmt(struct wil6210_priv *wil, int id, void *d, int len)
425{
426 struct wmi_tx_mgmt_packet_event *data = d;
427 struct ieee80211_mgmt *mgmt_frame =
428 (struct ieee80211_mgmt *)data->payload;
429 int flen = len - offsetof(struct wmi_tx_mgmt_packet_event, payload);
430
431 wil_hex_dump_wmi("MGMT Tx ", DUMP_PREFIX_OFFSET, 16, 1, mgmt_frame,
432 flen, true);
433}
434
435static void wmi_evt_scan_complete(struct wil6210_priv *wil, int id,
436 void *d, int len)
437{
438 mutex_lock(&wil->p2p_wdev_mutex);
439 if (wil->scan_request) {
440 struct wmi_scan_complete_event *data = d;
441 int status = le32_to_cpu(data->status);
442 struct cfg80211_scan_info info = {
443 .aborted = ((status != WMI_SCAN_SUCCESS) &&
444 (status != WMI_SCAN_ABORT_REJECTED)),
445 };
446
447 wil_dbg_wmi(wil, "SCAN_COMPLETE(0x%08x)\n", status);
448 wil_dbg_misc(wil, "Complete scan_request 0x%p aborted %d\n",
449 wil->scan_request, info.aborted);
450 del_timer_sync(&wil->scan_timer);
451 cfg80211_scan_done(wil->scan_request, &info);
452 wil->radio_wdev = wil->wdev;
453 wil->scan_request = NULL;
454 wake_up_interruptible(&wil->wq);
455 if (wil->p2p.pending_listen_wdev) {
456 wil_dbg_misc(wil, "Scheduling delayed listen\n");
457 schedule_work(&wil->p2p.delayed_listen_work);
458 }
459 } else {
460 wil_err(wil, "SCAN_COMPLETE while not scanning\n");
461 }
462 mutex_unlock(&wil->p2p_wdev_mutex);
463}
464
465static void wmi_evt_connect(struct wil6210_priv *wil, int id, void *d, int len)
466{
467 struct net_device *ndev = wil_to_ndev(wil);
468 struct wireless_dev *wdev = wil->wdev;
469 struct wmi_connect_event *evt = d;
470 int ch; /* channel number */
471 struct station_info sinfo;
472 u8 *assoc_req_ie, *assoc_resp_ie;
473 size_t assoc_req_ielen, assoc_resp_ielen;
474 /* capinfo(u16) + listen_interval(u16) + IEs */
475 const size_t assoc_req_ie_offset = sizeof(u16) * 2;
476 /* capinfo(u16) + status_code(u16) + associd(u16) + IEs */
477 const size_t assoc_resp_ie_offset = sizeof(u16) * 3;
478 int rc;
479
480 if (len < sizeof(*evt)) {
481 wil_err(wil, "Connect event too short : %d bytes\n", len);
482 return;
483 }
484 if (len != sizeof(*evt) + evt->beacon_ie_len + evt->assoc_req_len +
485 evt->assoc_resp_len) {
486 wil_err(wil,
487 "Connect event corrupted : %d != %d + %d + %d + %d\n",
488 len, (int)sizeof(*evt), evt->beacon_ie_len,
489 evt->assoc_req_len, evt->assoc_resp_len);
490 return;
491 }
492 if (evt->cid >= WIL6210_MAX_CID) {
493 wil_err(wil, "Connect CID invalid : %d\n", evt->cid);
494 return;
495 }
496
497 ch = evt->channel + 1;
498 wil_info(wil, "Connect %pM channel [%d] cid %d\n",
499 evt->bssid, ch, evt->cid);
500 wil_hex_dump_wmi("connect AI : ", DUMP_PREFIX_OFFSET, 16, 1,
501 evt->assoc_info, len - sizeof(*evt), true);
502
503 /* figure out IE's */
504 assoc_req_ie = &evt->assoc_info[evt->beacon_ie_len +
505 assoc_req_ie_offset];
506 assoc_req_ielen = evt->assoc_req_len - assoc_req_ie_offset;
507 if (evt->assoc_req_len <= assoc_req_ie_offset) {
508 assoc_req_ie = NULL;
509 assoc_req_ielen = 0;
510 }
511
512 assoc_resp_ie = &evt->assoc_info[evt->beacon_ie_len +
513 evt->assoc_req_len +
514 assoc_resp_ie_offset];
515 assoc_resp_ielen = evt->assoc_resp_len - assoc_resp_ie_offset;
516 if (evt->assoc_resp_len <= assoc_resp_ie_offset) {
517 assoc_resp_ie = NULL;
518 assoc_resp_ielen = 0;
519 }
520
521 mutex_lock(&wil->mutex);
522 if (test_bit(wil_status_resetting, wil->status) ||
523 !test_bit(wil_status_fwready, wil->status)) {
524 wil_err(wil, "status_resetting, cancel connect event, CID %d\n",
525 evt->cid);
526 mutex_unlock(&wil->mutex);
527 /* no need for cleanup, wil_reset will do that */
528 return;
529 }
530
531 if ((wdev->iftype == NL80211_IFTYPE_STATION) ||
532 (wdev->iftype == NL80211_IFTYPE_P2P_CLIENT)) {
533 if (!test_bit(wil_status_fwconnecting, wil->status)) {
534 wil_err(wil, "Not in connecting state\n");
535 mutex_unlock(&wil->mutex);
536 return;
537 }
538 del_timer_sync(&wil->connect_timer);
539 } else if ((wdev->iftype == NL80211_IFTYPE_AP) ||
540 (wdev->iftype == NL80211_IFTYPE_P2P_GO)) {
541 if (wil->sta[evt->cid].status != wil_sta_unused) {
542 wil_err(wil, "%s: AP: Invalid status %d for CID %d\n",
543 __func__, wil->sta[evt->cid].status, evt->cid);
544 mutex_unlock(&wil->mutex);
545 return;
546 }
547 }
548
549 /* FIXME FW can transmit only ucast frames to peer */
550 /* FIXME real ring_id instead of hard coded 0 */
551 ether_addr_copy(wil->sta[evt->cid].addr, evt->bssid);
552 wil->sta[evt->cid].status = wil_sta_conn_pending;
553
554 rc = wil_tx_init(wil, evt->cid);
555 if (rc) {
556 wil_err(wil, "%s: config tx vring failed for CID %d, rc (%d)\n",
557 __func__, evt->cid, rc);
558 wmi_disconnect_sta(wil, wil->sta[evt->cid].addr,
559 WLAN_REASON_UNSPECIFIED, false);
560 } else {
561 wil_info(wil, "%s: successful connection to CID %d\n",
562 __func__, evt->cid);
563 }
564
565 if ((wdev->iftype == NL80211_IFTYPE_STATION) ||
566 (wdev->iftype == NL80211_IFTYPE_P2P_CLIENT)) {
567 if (rc) {
568 netif_carrier_off(ndev);
569 wil_err(wil,
570 "%s: cfg80211_connect_result with failure\n",
571 __func__);
572 cfg80211_connect_result(ndev, evt->bssid, NULL, 0,
573 NULL, 0,
574 WLAN_STATUS_UNSPECIFIED_FAILURE,
575 GFP_KERNEL);
576 goto out;
577 } else {
578 cfg80211_connect_result(ndev, evt->bssid,
579 assoc_req_ie, assoc_req_ielen,
580 assoc_resp_ie, assoc_resp_ielen,
581 WLAN_STATUS_SUCCESS,
582 GFP_KERNEL);
583 }
584 } else if ((wdev->iftype == NL80211_IFTYPE_AP) ||
585 (wdev->iftype == NL80211_IFTYPE_P2P_GO)) {
586 if (rc)
587 goto out;
588
589 memset(&sinfo, 0, sizeof(sinfo));
590
591 sinfo.generation = wil->sinfo_gen++;
592
593 if (assoc_req_ie) {
594 sinfo.assoc_req_ies = assoc_req_ie;
595 sinfo.assoc_req_ies_len = assoc_req_ielen;
596 }
597
598 cfg80211_new_sta(ndev, evt->bssid, &sinfo, GFP_KERNEL);
599 } else {
600 wil_err(wil, "%s: unhandled iftype %d for CID %d\n",
601 __func__, wdev->iftype, evt->cid);
602 goto out;
603 }
604
605 wil->sta[evt->cid].status = wil_sta_connected;
606 set_bit(wil_status_fwconnected, wil->status);
607 wil_update_net_queues_bh(wil, NULL, false);
608
609out:
610 if (rc)
611 wil->sta[evt->cid].status = wil_sta_unused;
612 clear_bit(wil_status_fwconnecting, wil->status);
613 mutex_unlock(&wil->mutex);
614}
615
616static void wmi_evt_disconnect(struct wil6210_priv *wil, int id,
617 void *d, int len)
618{
619 struct wmi_disconnect_event *evt = d;
620 u16 reason_code = le16_to_cpu(evt->protocol_reason_status);
621
622 wil_info(wil, "Disconnect %pM reason [proto %d wmi %d]\n",
623 evt->bssid, reason_code, evt->disconnect_reason);
624
625 wil->sinfo_gen++;
626
627 mutex_lock(&wil->mutex);
628 wil6210_disconnect(wil, evt->bssid, reason_code, true);
629 mutex_unlock(&wil->mutex);
630}
631
632/*
633 * Firmware reports EAPOL frame using WME event.
634 * Reconstruct Ethernet frame and deliver it via normal Rx
635 */
636static void wmi_evt_eapol_rx(struct wil6210_priv *wil, int id,
637 void *d, int len)
638{
639 struct net_device *ndev = wil_to_ndev(wil);
640 struct wmi_eapol_rx_event *evt = d;
641 u16 eapol_len = le16_to_cpu(evt->eapol_len);
642 int sz = eapol_len + ETH_HLEN;
643 struct sk_buff *skb;
644 struct ethhdr *eth;
645 int cid;
646 struct wil_net_stats *stats = NULL;
647
648 wil_dbg_wmi(wil, "EAPOL len %d from %pM\n", eapol_len,
649 evt->src_mac);
650
651 cid = wil_find_cid(wil, evt->src_mac);
652 if (cid >= 0)
653 stats = &wil->sta[cid].stats;
654
655 if (eapol_len > 196) { /* TODO: revisit size limit */
656 wil_err(wil, "EAPOL too large\n");
657 return;
658 }
659
660 skb = alloc_skb(sz, GFP_KERNEL);
661 if (!skb) {
662 wil_err(wil, "Failed to allocate skb\n");
663 return;
664 }
665
666 eth = (struct ethhdr *)skb_put(skb, ETH_HLEN);
667 ether_addr_copy(eth->h_dest, ndev->dev_addr);
668 ether_addr_copy(eth->h_source, evt->src_mac);
669 eth->h_proto = cpu_to_be16(ETH_P_PAE);
670 memcpy(skb_put(skb, eapol_len), evt->eapol, eapol_len);
671 skb->protocol = eth_type_trans(skb, ndev);
672 if (likely(netif_rx_ni(skb) == NET_RX_SUCCESS)) {
673 ndev->stats.rx_packets++;
674 ndev->stats.rx_bytes += sz;
675 if (stats) {
676 stats->rx_packets++;
677 stats->rx_bytes += sz;
678 }
679 } else {
680 ndev->stats.rx_dropped++;
681 if (stats)
682 stats->rx_dropped++;
683 }
684}
685
686static void wmi_evt_vring_en(struct wil6210_priv *wil, int id, void *d, int len)
687{
688 struct wmi_vring_en_event *evt = d;
689 u8 vri = evt->vring_index;
690
691 wil_dbg_wmi(wil, "Enable vring %d\n", vri);
692
693 if (vri >= ARRAY_SIZE(wil->vring_tx)) {
694 wil_err(wil, "Enable for invalid vring %d\n", vri);
695 return;
696 }
697 wil->vring_tx_data[vri].dot1x_open = true;
698 if (vri == wil->bcast_vring) /* no BA for bcast */
699 return;
700 if (agg_wsize >= 0)
701 wil_addba_tx_request(wil, vri, agg_wsize);
702}
703
704static void wmi_evt_ba_status(struct wil6210_priv *wil, int id, void *d,
705 int len)
706{
707 struct wmi_ba_status_event *evt = d;
708 struct vring_tx_data *txdata;
709
710 wil_dbg_wmi(wil, "BACK[%d] %s {%d} timeout %d AMSDU%s\n",
711 evt->ringid,
712 evt->status == WMI_BA_AGREED ? "OK" : "N/A",
713 evt->agg_wsize, __le16_to_cpu(evt->ba_timeout),
714 evt->amsdu ? "+" : "-");
715
716 if (evt->ringid >= WIL6210_MAX_TX_RINGS) {
717 wil_err(wil, "invalid ring id %d\n", evt->ringid);
718 return;
719 }
720
721 if (evt->status != WMI_BA_AGREED) {
722 evt->ba_timeout = 0;
723 evt->agg_wsize = 0;
724 evt->amsdu = 0;
725 }
726
727 txdata = &wil->vring_tx_data[evt->ringid];
728
729 txdata->agg_timeout = le16_to_cpu(evt->ba_timeout);
730 txdata->agg_wsize = evt->agg_wsize;
731 txdata->agg_amsdu = evt->amsdu;
732 txdata->addba_in_progress = false;
733}
734
735static void wmi_evt_addba_rx_req(struct wil6210_priv *wil, int id, void *d,
736 int len)
737{
738 struct wmi_rcp_addba_req_event *evt = d;
739
740 wil_addba_rx_request(wil, evt->cidxtid, evt->dialog_token,
741 evt->ba_param_set, evt->ba_timeout,
742 evt->ba_seq_ctrl);
743}
744
745static void wmi_evt_delba(struct wil6210_priv *wil, int id, void *d, int len)
746__acquires(&sta->tid_rx_lock) __releases(&sta->tid_rx_lock)
747{
748 struct wmi_delba_event *evt = d;
749 u8 cid, tid;
750 u16 reason = __le16_to_cpu(evt->reason);
751 struct wil_sta_info *sta;
752 struct wil_tid_ampdu_rx *r;
753
754 might_sleep();
755 parse_cidxtid(evt->cidxtid, &cid, &tid);
756 wil_dbg_wmi(wil, "DELBA CID %d TID %d from %s reason %d\n",
757 cid, tid,
758 evt->from_initiator ? "originator" : "recipient",
759 reason);
760 if (!evt->from_initiator) {
761 int i;
762 /* find Tx vring it belongs to */
763 for (i = 0; i < ARRAY_SIZE(wil->vring2cid_tid); i++) {
764 if ((wil->vring2cid_tid[i][0] == cid) &&
765 (wil->vring2cid_tid[i][1] == tid)) {
766 struct vring_tx_data *txdata =
767 &wil->vring_tx_data[i];
768
769 wil_dbg_wmi(wil, "DELBA Tx vring %d\n", i);
770 txdata->agg_timeout = 0;
771 txdata->agg_wsize = 0;
772 txdata->addba_in_progress = false;
773
774 break; /* max. 1 matching ring */
775 }
776 }
777 if (i >= ARRAY_SIZE(wil->vring2cid_tid))
778 wil_err(wil, "DELBA: unable to find Tx vring\n");
779 return;
780 }
781
782 sta = &wil->sta[cid];
783
784 spin_lock_bh(&sta->tid_rx_lock);
785
786 r = sta->tid_rx[tid];
787 sta->tid_rx[tid] = NULL;
788 wil_tid_ampdu_rx_free(wil, r);
789
790 spin_unlock_bh(&sta->tid_rx_lock);
791}
792
793/**
794 * Some events are ignored for purpose; and need not be interpreted as
795 * "unhandled events"
796 */
797static void wmi_evt_ignore(struct wil6210_priv *wil, int id, void *d, int len)
798{
799 wil_dbg_wmi(wil, "Ignore event 0x%04x len %d\n", id, len);
800}
801
802static const struct {
803 int eventid;
804 void (*handler)(struct wil6210_priv *wil, int eventid,
805 void *data, int data_len);
806} wmi_evt_handlers[] = {
807 {WMI_READY_EVENTID, wmi_evt_ready},
808 {WMI_FW_READY_EVENTID, wmi_evt_ignore},
809 {WMI_RX_MGMT_PACKET_EVENTID, wmi_evt_rx_mgmt},
810 {WMI_TX_MGMT_PACKET_EVENTID, wmi_evt_tx_mgmt},
811 {WMI_SCAN_COMPLETE_EVENTID, wmi_evt_scan_complete},
812 {WMI_CONNECT_EVENTID, wmi_evt_connect},
813 {WMI_DISCONNECT_EVENTID, wmi_evt_disconnect},
814 {WMI_EAPOL_RX_EVENTID, wmi_evt_eapol_rx},
815 {WMI_BA_STATUS_EVENTID, wmi_evt_ba_status},
816 {WMI_RCP_ADDBA_REQ_EVENTID, wmi_evt_addba_rx_req},
817 {WMI_DELBA_EVENTID, wmi_evt_delba},
818 {WMI_VRING_EN_EVENTID, wmi_evt_vring_en},
819 {WMI_DATA_PORT_OPEN_EVENTID, wmi_evt_ignore},
820};
821
822/*
823 * Run in IRQ context
824 * Extract WMI command from mailbox. Queue it to the @wil->pending_wmi_ev
825 * that will be eventually handled by the @wmi_event_worker in the thread
826 * context of thread "wil6210_wmi"
827 */
828void wmi_recv_cmd(struct wil6210_priv *wil)
829{
830 struct wil6210_mbox_ring_desc d_tail;
831 struct wil6210_mbox_hdr hdr;
832 struct wil6210_mbox_ring *r = &wil->mbox_ctl.rx;
833 struct pending_wmi_event *evt;
834 u8 *cmd;
835 void __iomem *src;
836 ulong flags;
837 unsigned n;
838 unsigned int num_immed_reply = 0;
839
840 if (!test_bit(wil_status_mbox_ready, wil->status)) {
841 wil_err(wil, "Reset in progress. Cannot handle WMI event\n");
842 return;
843 }
844
845 for (n = 0;; n++) {
846 u16 len;
847 bool q;
848 bool immed_reply = false;
849
850 r->head = wil_r(wil, RGF_MBOX +
851 offsetof(struct wil6210_mbox_ctl, rx.head));
852 if (r->tail == r->head)
853 break;
854
855 wil_dbg_wmi(wil, "Mbox head %08x tail %08x\n",
856 r->head, r->tail);
857 /* read cmd descriptor from tail */
858 wil_memcpy_fromio_32(&d_tail, wil->csr + HOSTADDR(r->tail),
859 sizeof(struct wil6210_mbox_ring_desc));
860 if (d_tail.sync == 0) {
861 wil_err(wil, "Mbox evt not owned by FW?\n");
862 break;
863 }
864
865 /* read cmd header from descriptor */
866 if (0 != wmi_read_hdr(wil, d_tail.addr, &hdr)) {
867 wil_err(wil, "Mbox evt at 0x%08x?\n",
868 le32_to_cpu(d_tail.addr));
869 break;
870 }
871 len = le16_to_cpu(hdr.len);
872 wil_dbg_wmi(wil, "Mbox evt %04x %04x %04x %02x\n",
873 le16_to_cpu(hdr.seq), len, le16_to_cpu(hdr.type),
874 hdr.flags);
875
876 /* read cmd buffer from descriptor */
877 src = wmi_buffer(wil, d_tail.addr) +
878 sizeof(struct wil6210_mbox_hdr);
879 evt = kmalloc(ALIGN(offsetof(struct pending_wmi_event,
880 event.wmi) + len, 4),
881 GFP_KERNEL);
882 if (!evt)
883 break;
884
885 evt->event.hdr = hdr;
886 cmd = (void *)&evt->event.wmi;
887 wil_memcpy_fromio_32(cmd, src, len);
888 /* mark entry as empty */
889 wil_w(wil, r->tail +
890 offsetof(struct wil6210_mbox_ring_desc, sync), 0);
891 /* indicate */
892 if ((hdr.type == WIL_MBOX_HDR_TYPE_WMI) &&
893 (len >= sizeof(struct wmi_cmd_hdr))) {
894 struct wmi_cmd_hdr *wmi = &evt->event.wmi;
895 u16 id = le16_to_cpu(wmi->command_id);
896 u32 tstamp = le32_to_cpu(wmi->fw_timestamp);
897 spin_lock_irqsave(&wil->wmi_ev_lock, flags);
898 if (wil->reply_id && wil->reply_id == id) {
899 if (wil->reply_buf) {
900 memcpy(wil->reply_buf, wmi,
901 min(len, wil->reply_size));
902 immed_reply = true;
903 }
904 }
905 spin_unlock_irqrestore(&wil->wmi_ev_lock, flags);
906
907 wil_dbg_wmi(wil, "WMI event 0x%04x MID %d @%d msec\n",
908 id, wmi->mid, tstamp);
909 trace_wil6210_wmi_event(wmi, &wmi[1],
910 len - sizeof(*wmi));
911 }
912 wil_hex_dump_wmi("evt ", DUMP_PREFIX_OFFSET, 16, 1,
913 &evt->event.hdr, sizeof(hdr) + len, true);
914
915 /* advance tail */
916 r->tail = r->base + ((r->tail - r->base +
917 sizeof(struct wil6210_mbox_ring_desc)) % r->size);
918 wil_w(wil, RGF_MBOX +
919 offsetof(struct wil6210_mbox_ctl, rx.tail), r->tail);
920
921 if (immed_reply) {
922 wil_dbg_wmi(wil, "%s: Complete WMI 0x%04x\n",
923 __func__, wil->reply_id);
924 kfree(evt);
925 num_immed_reply++;
926 complete(&wil->wmi_call);
927 } else {
928 /* add to the pending list */
929 spin_lock_irqsave(&wil->wmi_ev_lock, flags);
930 list_add_tail(&evt->list, &wil->pending_wmi_ev);
931 spin_unlock_irqrestore(&wil->wmi_ev_lock, flags);
932 q = queue_work(wil->wmi_wq, &wil->wmi_event_worker);
933 wil_dbg_wmi(wil, "queue_work -> %d\n", q);
934 }
935 }
936 /* normally, 1 event per IRQ should be processed */
937 wil_dbg_wmi(wil, "%s -> %d events queued, %d completed\n", __func__,
938 n - num_immed_reply, num_immed_reply);
939}
940
941int wmi_call(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len,
942 u16 reply_id, void *reply, u8 reply_size, int to_msec)
943{
944 int rc;
945 unsigned long remain;
946
947 mutex_lock(&wil->wmi_mutex);
948
949 spin_lock(&wil->wmi_ev_lock);
950 wil->reply_id = reply_id;
951 wil->reply_buf = reply;
952 wil->reply_size = reply_size;
953 spin_unlock(&wil->wmi_ev_lock);
954
955 rc = __wmi_send(wil, cmdid, buf, len);
956 if (rc)
957 goto out;
958
959 remain = wait_for_completion_timeout(&wil->wmi_call,
960 msecs_to_jiffies(to_msec));
961 if (0 == remain) {
962 wil_err(wil, "wmi_call(0x%04x->0x%04x) timeout %d msec\n",
963 cmdid, reply_id, to_msec);
964 rc = -ETIME;
965 } else {
966 wil_dbg_wmi(wil,
967 "wmi_call(0x%04x->0x%04x) completed in %d msec\n",
968 cmdid, reply_id,
969 to_msec - jiffies_to_msecs(remain));
970 }
971
972out:
973 spin_lock(&wil->wmi_ev_lock);
974 wil->reply_id = 0;
975 wil->reply_buf = NULL;
976 wil->reply_size = 0;
977 spin_unlock(&wil->wmi_ev_lock);
978
979 mutex_unlock(&wil->wmi_mutex);
980
981 return rc;
982}
983
984int wmi_echo(struct wil6210_priv *wil)
985{
986 struct wmi_echo_cmd cmd = {
987 .value = cpu_to_le32(0x12345678),
988 };
989
990 return wmi_call(wil, WMI_ECHO_CMDID, &cmd, sizeof(cmd),
991 WMI_ECHO_RSP_EVENTID, NULL, 0, 50);
992}
993
994int wmi_set_mac_address(struct wil6210_priv *wil, void *addr)
995{
996 struct wmi_set_mac_address_cmd cmd;
997
998 ether_addr_copy(cmd.mac, addr);
999
1000 wil_dbg_wmi(wil, "Set MAC %pM\n", addr);
1001
1002 return wmi_send(wil, WMI_SET_MAC_ADDRESS_CMDID, &cmd, sizeof(cmd));
1003}
1004
1005int wmi_led_cfg(struct wil6210_priv *wil, bool enable)
1006{
1007 int rc = 0;
1008 struct wmi_led_cfg_cmd cmd = {
1009 .led_mode = enable,
1010 .id = led_id,
1011 .slow_blink_cfg.blink_on =
1012 cpu_to_le32(led_blink_time[WIL_LED_TIME_SLOW].on_ms),
1013 .slow_blink_cfg.blink_off =
1014 cpu_to_le32(led_blink_time[WIL_LED_TIME_SLOW].off_ms),
1015 .medium_blink_cfg.blink_on =
1016 cpu_to_le32(led_blink_time[WIL_LED_TIME_MED].on_ms),
1017 .medium_blink_cfg.blink_off =
1018 cpu_to_le32(led_blink_time[WIL_LED_TIME_MED].off_ms),
1019 .fast_blink_cfg.blink_on =
1020 cpu_to_le32(led_blink_time[WIL_LED_TIME_FAST].on_ms),
1021 .fast_blink_cfg.blink_off =
1022 cpu_to_le32(led_blink_time[WIL_LED_TIME_FAST].off_ms),
1023 .led_polarity = led_polarity,
1024 };
1025 struct {
1026 struct wmi_cmd_hdr wmi;
1027 struct wmi_led_cfg_done_event evt;
1028 } __packed reply;
1029
1030 if (led_id == WIL_LED_INVALID_ID)
1031 goto out;
1032
1033 if (led_id > WIL_LED_MAX_ID) {
1034 wil_err(wil, "Invalid led id %d\n", led_id);
1035 rc = -EINVAL;
1036 goto out;
1037 }
1038
1039 wil_dbg_wmi(wil,
1040 "%s led %d\n",
1041 enable ? "enabling" : "disabling", led_id);
1042
1043 rc = wmi_call(wil, WMI_LED_CFG_CMDID, &cmd, sizeof(cmd),
1044 WMI_LED_CFG_DONE_EVENTID, &reply, sizeof(reply),
1045 100);
1046 if (rc)
1047 goto out;
1048
1049 if (reply.evt.status) {
1050 wil_err(wil, "led %d cfg failed with status %d\n",
1051 led_id, le32_to_cpu(reply.evt.status));
1052 rc = -EINVAL;
1053 }
1054
1055out:
1056 return rc;
1057}
1058
1059int wmi_pcp_start(struct wil6210_priv *wil, int bi, u8 wmi_nettype,
1060 u8 chan, u8 hidden_ssid, u8 is_go)
1061{
1062 int rc;
1063
1064 struct wmi_pcp_start_cmd cmd = {
1065 .bcon_interval = cpu_to_le16(bi),
1066 .network_type = wmi_nettype,
1067 .disable_sec_offload = 1,
1068 .channel = chan - 1,
1069 .pcp_max_assoc_sta = max_assoc_sta,
1070 .hidden_ssid = hidden_ssid,
1071 .is_go = is_go,
1072 };
1073 struct {
1074 struct wmi_cmd_hdr wmi;
1075 struct wmi_pcp_started_event evt;
1076 } __packed reply;
1077
1078 if (!wil->privacy)
1079 cmd.disable_sec = 1;
1080
1081 if ((cmd.pcp_max_assoc_sta > WIL6210_MAX_CID) ||
1082 (cmd.pcp_max_assoc_sta <= 0)) {
1083 wil_info(wil,
1084 "Requested connection limit %u, valid values are 1 - %d. Setting to %d\n",
1085 max_assoc_sta, WIL6210_MAX_CID, WIL6210_MAX_CID);
1086 cmd.pcp_max_assoc_sta = WIL6210_MAX_CID;
1087 }
1088
1089 /*
1090 * Processing time may be huge, in case of secure AP it takes about
1091 * 3500ms for FW to start AP
1092 */
1093 rc = wmi_call(wil, WMI_PCP_START_CMDID, &cmd, sizeof(cmd),
1094 WMI_PCP_STARTED_EVENTID, &reply, sizeof(reply), 5000);
1095 if (rc)
1096 return rc;
1097
1098 if (reply.evt.status != WMI_FW_STATUS_SUCCESS)
1099 rc = -EINVAL;
1100
1101 if (wmi_nettype != WMI_NETTYPE_P2P)
1102 /* Don't fail due to error in the led configuration */
1103 wmi_led_cfg(wil, true);
1104
1105 return rc;
1106}
1107
1108int wmi_pcp_stop(struct wil6210_priv *wil)
1109{
1110 int rc;
1111
1112 rc = wmi_led_cfg(wil, false);
1113 if (rc)
1114 return rc;
1115
1116 return wmi_call(wil, WMI_PCP_STOP_CMDID, NULL, 0,
1117 WMI_PCP_STOPPED_EVENTID, NULL, 0, 20);
1118}
1119
1120int wmi_set_ssid(struct wil6210_priv *wil, u8 ssid_len, const void *ssid)
1121{
1122 struct wmi_set_ssid_cmd cmd = {
1123 .ssid_len = cpu_to_le32(ssid_len),
1124 };
1125
1126 if (ssid_len > sizeof(cmd.ssid))
1127 return -EINVAL;
1128
1129 memcpy(cmd.ssid, ssid, ssid_len);
1130
1131 return wmi_send(wil, WMI_SET_SSID_CMDID, &cmd, sizeof(cmd));
1132}
1133
1134int wmi_get_ssid(struct wil6210_priv *wil, u8 *ssid_len, void *ssid)
1135{
1136 int rc;
1137 struct {
1138 struct wmi_cmd_hdr wmi;
1139 struct wmi_set_ssid_cmd cmd;
1140 } __packed reply;
1141 int len; /* reply.cmd.ssid_len in CPU order */
1142
1143 rc = wmi_call(wil, WMI_GET_SSID_CMDID, NULL, 0, WMI_GET_SSID_EVENTID,
1144 &reply, sizeof(reply), 20);
1145 if (rc)
1146 return rc;
1147
1148 len = le32_to_cpu(reply.cmd.ssid_len);
1149 if (len > sizeof(reply.cmd.ssid))
1150 return -EINVAL;
1151
1152 *ssid_len = len;
1153 memcpy(ssid, reply.cmd.ssid, len);
1154
1155 return 0;
1156}
1157
1158int wmi_set_channel(struct wil6210_priv *wil, int channel)
1159{
1160 struct wmi_set_pcp_channel_cmd cmd = {
1161 .channel = channel - 1,
1162 };
1163
1164 return wmi_send(wil, WMI_SET_PCP_CHANNEL_CMDID, &cmd, sizeof(cmd));
1165}
1166
1167int wmi_get_channel(struct wil6210_priv *wil, int *channel)
1168{
1169 int rc;
1170 struct {
1171 struct wmi_cmd_hdr wmi;
1172 struct wmi_set_pcp_channel_cmd cmd;
1173 } __packed reply;
1174
1175 rc = wmi_call(wil, WMI_GET_PCP_CHANNEL_CMDID, NULL, 0,
1176 WMI_GET_PCP_CHANNEL_EVENTID, &reply, sizeof(reply), 20);
1177 if (rc)
1178 return rc;
1179
1180 if (reply.cmd.channel > 3)
1181 return -EINVAL;
1182
1183 *channel = reply.cmd.channel + 1;
1184
1185 return 0;
1186}
1187
1188int wmi_p2p_cfg(struct wil6210_priv *wil, int channel, int bi)
1189{
1190 int rc;
1191 struct wmi_p2p_cfg_cmd cmd = {
1192 .discovery_mode = WMI_DISCOVERY_MODE_PEER2PEER,
1193 .bcon_interval = cpu_to_le16(bi),
1194 .channel = channel - 1,
1195 };
1196 struct {
1197 struct wmi_cmd_hdr wmi;
1198 struct wmi_p2p_cfg_done_event evt;
1199 } __packed reply;
1200
1201 wil_dbg_wmi(wil, "sending WMI_P2P_CFG_CMDID\n");
1202
1203 rc = wmi_call(wil, WMI_P2P_CFG_CMDID, &cmd, sizeof(cmd),
1204 WMI_P2P_CFG_DONE_EVENTID, &reply, sizeof(reply), 300);
1205 if (!rc && reply.evt.status != WMI_FW_STATUS_SUCCESS) {
1206 wil_err(wil, "P2P_CFG failed. status %d\n", reply.evt.status);
1207 rc = -EINVAL;
1208 }
1209
1210 return rc;
1211}
1212
1213int wmi_start_listen(struct wil6210_priv *wil)
1214{
1215 int rc;
1216 struct {
1217 struct wmi_cmd_hdr wmi;
1218 struct wmi_listen_started_event evt;
1219 } __packed reply;
1220
1221 wil_dbg_wmi(wil, "sending WMI_START_LISTEN_CMDID\n");
1222
1223 rc = wmi_call(wil, WMI_START_LISTEN_CMDID, NULL, 0,
1224 WMI_LISTEN_STARTED_EVENTID, &reply, sizeof(reply), 300);
1225 if (!rc && reply.evt.status != WMI_FW_STATUS_SUCCESS) {
1226 wil_err(wil, "device failed to start listen. status %d\n",
1227 reply.evt.status);
1228 rc = -EINVAL;
1229 }
1230
1231 return rc;
1232}
1233
1234int wmi_start_search(struct wil6210_priv *wil)
1235{
1236 int rc;
1237 struct {
1238 struct wmi_cmd_hdr wmi;
1239 struct wmi_search_started_event evt;
1240 } __packed reply;
1241
1242 wil_dbg_wmi(wil, "sending WMI_START_SEARCH_CMDID\n");
1243
1244 rc = wmi_call(wil, WMI_START_SEARCH_CMDID, NULL, 0,
1245 WMI_SEARCH_STARTED_EVENTID, &reply, sizeof(reply), 300);
1246 if (!rc && reply.evt.status != WMI_FW_STATUS_SUCCESS) {
1247 wil_err(wil, "device failed to start search. status %d\n",
1248 reply.evt.status);
1249 rc = -EINVAL;
1250 }
1251
1252 return rc;
1253}
1254
1255int wmi_stop_discovery(struct wil6210_priv *wil)
1256{
1257 int rc;
1258
1259 wil_dbg_wmi(wil, "sending WMI_DISCOVERY_STOP_CMDID\n");
1260
1261 rc = wmi_call(wil, WMI_DISCOVERY_STOP_CMDID, NULL, 0,
1262 WMI_DISCOVERY_STOPPED_EVENTID, NULL, 0, 100);
1263
1264 if (rc)
1265 wil_err(wil, "Failed to stop discovery\n");
1266
1267 return rc;
1268}
1269
1270int wmi_del_cipher_key(struct wil6210_priv *wil, u8 key_index,
1271 const void *mac_addr, int key_usage)
1272{
1273 struct wmi_delete_cipher_key_cmd cmd = {
1274 .key_index = key_index,
1275 };
1276
1277 if (mac_addr)
1278 memcpy(cmd.mac, mac_addr, WMI_MAC_LEN);
1279
1280 return wmi_send(wil, WMI_DELETE_CIPHER_KEY_CMDID, &cmd, sizeof(cmd));
1281}
1282
1283int wmi_add_cipher_key(struct wil6210_priv *wil, u8 key_index,
1284 const void *mac_addr, int key_len, const void *key,
1285 int key_usage)
1286{
1287 struct wmi_add_cipher_key_cmd cmd = {
1288 .key_index = key_index,
1289 .key_usage = key_usage,
1290 .key_len = key_len,
1291 };
1292
1293 if (!key || (key_len > sizeof(cmd.key)))
1294 return -EINVAL;
1295
1296 memcpy(cmd.key, key, key_len);
1297 if (mac_addr)
1298 memcpy(cmd.mac, mac_addr, WMI_MAC_LEN);
1299
1300 return wmi_send(wil, WMI_ADD_CIPHER_KEY_CMDID, &cmd, sizeof(cmd));
1301}
1302
1303int wmi_set_ie(struct wil6210_priv *wil, u8 type, u16 ie_len, const void *ie)
1304{
1305 static const char *const names[] = {
1306 [WMI_FRAME_BEACON] = "BEACON",
1307 [WMI_FRAME_PROBE_REQ] = "PROBE_REQ",
1308 [WMI_FRAME_PROBE_RESP] = "WMI_FRAME_PROBE_RESP",
1309 [WMI_FRAME_ASSOC_REQ] = "WMI_FRAME_ASSOC_REQ",
1310 [WMI_FRAME_ASSOC_RESP] = "WMI_FRAME_ASSOC_RESP",
1311 };
1312 int rc;
1313 u16 len = sizeof(struct wmi_set_appie_cmd) + ie_len;
1314 struct wmi_set_appie_cmd *cmd = kzalloc(len, GFP_KERNEL);
1315
1316 if (!cmd) {
1317 rc = -ENOMEM;
1318 goto out;
1319 }
1320 if (!ie)
1321 ie_len = 0;
1322
1323 cmd->mgmt_frm_type = type;
1324 /* BUG: FW API define ieLen as u8. Will fix FW */
1325 cmd->ie_len = cpu_to_le16(ie_len);
1326 memcpy(cmd->ie_info, ie, ie_len);
1327 rc = wmi_send(wil, WMI_SET_APPIE_CMDID, cmd, len);
1328 kfree(cmd);
1329out:
1330 if (rc) {
1331 const char *name = type < ARRAY_SIZE(names) ?
1332 names[type] : "??";
1333 wil_err(wil, "set_ie(%d %s) failed : %d\n", type, name, rc);
1334 }
1335
1336 return rc;
1337}
1338
1339/**
1340 * wmi_rxon - turn radio on/off
1341 * @on: turn on if true, off otherwise
1342 *
1343 * Only switch radio. Channel should be set separately.
1344 * No timeout for rxon - radio turned on forever unless some other call
1345 * turns it off
1346 */
1347int wmi_rxon(struct wil6210_priv *wil, bool on)
1348{
1349 int rc;
1350 struct {
1351 struct wmi_cmd_hdr wmi;
1352 struct wmi_listen_started_event evt;
1353 } __packed reply;
1354
1355 wil_info(wil, "%s(%s)\n", __func__, on ? "on" : "off");
1356
1357 if (on) {
1358 rc = wmi_call(wil, WMI_START_LISTEN_CMDID, NULL, 0,
1359 WMI_LISTEN_STARTED_EVENTID,
1360 &reply, sizeof(reply), 100);
1361 if ((rc == 0) && (reply.evt.status != WMI_FW_STATUS_SUCCESS))
1362 rc = -EINVAL;
1363 } else {
1364 rc = wmi_call(wil, WMI_DISCOVERY_STOP_CMDID, NULL, 0,
1365 WMI_DISCOVERY_STOPPED_EVENTID, NULL, 0, 20);
1366 }
1367
1368 return rc;
1369}
1370
1371int wmi_rx_chain_add(struct wil6210_priv *wil, struct vring *vring)
1372{
1373 struct wireless_dev *wdev = wil->wdev;
1374 struct net_device *ndev = wil_to_ndev(wil);
1375 struct wmi_cfg_rx_chain_cmd cmd = {
1376 .action = WMI_RX_CHAIN_ADD,
1377 .rx_sw_ring = {
1378 .max_mpdu_size = cpu_to_le16(wil_mtu2macbuf(mtu_max)),
1379 .ring_mem_base = cpu_to_le64(vring->pa),
1380 .ring_size = cpu_to_le16(vring->size),
1381 },
1382 .mid = 0, /* TODO - what is it? */
1383 .decap_trans_type = WMI_DECAP_TYPE_802_3,
1384 .reorder_type = WMI_RX_SW_REORDER,
1385 .host_thrsh = cpu_to_le16(rx_ring_overflow_thrsh),
1386 };
1387 struct {
1388 struct wmi_cmd_hdr wmi;
1389 struct wmi_cfg_rx_chain_done_event evt;
1390 } __packed evt;
1391 int rc;
1392
1393 if (wdev->iftype == NL80211_IFTYPE_MONITOR) {
1394 struct ieee80211_channel *ch = wdev->preset_chandef.chan;
1395
1396 cmd.sniffer_cfg.mode = cpu_to_le32(WMI_SNIFFER_ON);
1397 if (ch)
1398 cmd.sniffer_cfg.channel = ch->hw_value - 1;
1399 cmd.sniffer_cfg.phy_info_mode =
1400 cpu_to_le32(ndev->type == ARPHRD_IEEE80211_RADIOTAP);
1401 cmd.sniffer_cfg.phy_support =
1402 cpu_to_le32((wil->monitor_flags & MONITOR_FLAG_CONTROL)
1403 ? WMI_SNIFFER_CP : WMI_SNIFFER_BOTH_PHYS);
1404 } else {
1405 /* Initialize offload (in non-sniffer mode).
1406 * Linux IP stack always calculates IP checksum
1407 * HW always calculate TCP/UDP checksum
1408 */
1409 cmd.l3_l4_ctrl |= (1 << L3_L4_CTRL_TCPIP_CHECKSUM_EN_POS);
1410 }
1411
1412 if (rx_align_2)
1413 cmd.l2_802_3_offload_ctrl |=
1414 L2_802_3_OFFLOAD_CTRL_SNAP_KEEP_MSK;
1415
1416 /* typical time for secure PCP is 840ms */
1417 rc = wmi_call(wil, WMI_CFG_RX_CHAIN_CMDID, &cmd, sizeof(cmd),
1418 WMI_CFG_RX_CHAIN_DONE_EVENTID, &evt, sizeof(evt), 2000);
1419 if (rc)
1420 return rc;
1421
1422 vring->hwtail = le32_to_cpu(evt.evt.rx_ring_tail_ptr);
1423
1424 wil_dbg_misc(wil, "Rx init: status %d tail 0x%08x\n",
1425 le32_to_cpu(evt.evt.status), vring->hwtail);
1426
1427 if (le32_to_cpu(evt.evt.status) != WMI_CFG_RX_CHAIN_SUCCESS)
1428 rc = -EINVAL;
1429
1430 return rc;
1431}
1432
1433int wmi_get_temperature(struct wil6210_priv *wil, u32 *t_bb, u32 *t_rf)
1434{
1435 int rc;
1436 struct wmi_temp_sense_cmd cmd = {
1437 .measure_baseband_en = cpu_to_le32(!!t_bb),
1438 .measure_rf_en = cpu_to_le32(!!t_rf),
1439 .measure_mode = cpu_to_le32(TEMPERATURE_MEASURE_NOW),
1440 };
1441 struct {
1442 struct wmi_cmd_hdr wmi;
1443 struct wmi_temp_sense_done_event evt;
1444 } __packed reply;
1445
1446 rc = wmi_call(wil, WMI_TEMP_SENSE_CMDID, &cmd, sizeof(cmd),
1447 WMI_TEMP_SENSE_DONE_EVENTID, &reply, sizeof(reply), 100);
1448 if (rc)
1449 return rc;
1450
1451 if (t_bb)
1452 *t_bb = le32_to_cpu(reply.evt.baseband_t1000);
1453 if (t_rf)
1454 *t_rf = le32_to_cpu(reply.evt.rf_t1000);
1455
1456 return 0;
1457}
1458
1459int wmi_disconnect_sta(struct wil6210_priv *wil, const u8 *mac, u16 reason,
1460 bool full_disconnect)
1461{
1462 int rc;
1463 u16 reason_code;
1464 struct wmi_disconnect_sta_cmd cmd = {
1465 .disconnect_reason = cpu_to_le16(reason),
1466 };
1467 struct {
1468 struct wmi_cmd_hdr wmi;
1469 struct wmi_disconnect_event evt;
1470 } __packed reply;
1471
1472 ether_addr_copy(cmd.dst_mac, mac);
1473
1474 wil_dbg_wmi(wil, "%s(%pM, reason %d)\n", __func__, mac, reason);
1475
1476 rc = wmi_call(wil, WMI_DISCONNECT_STA_CMDID, &cmd, sizeof(cmd),
1477 WMI_DISCONNECT_EVENTID, &reply, sizeof(reply), 1000);
1478 /* failure to disconnect in reasonable time treated as FW error */
1479 if (rc) {
1480 wil_fw_error_recovery(wil);
1481 return rc;
1482 }
1483
1484 if (full_disconnect) {
1485 /* call event handler manually after processing wmi_call,
1486 * to avoid deadlock - disconnect event handler acquires
1487 * wil->mutex while it is already held here
1488 */
1489 reason_code = le16_to_cpu(reply.evt.protocol_reason_status);
1490
1491 wil_dbg_wmi(wil, "Disconnect %pM reason [proto %d wmi %d]\n",
1492 reply.evt.bssid, reason_code,
1493 reply.evt.disconnect_reason);
1494
1495 wil->sinfo_gen++;
1496 wil6210_disconnect(wil, reply.evt.bssid, reason_code, true);
1497 }
1498 return 0;
1499}
1500
1501int wmi_addba(struct wil6210_priv *wil, u8 ringid, u8 size, u16 timeout)
1502{
1503 struct wmi_vring_ba_en_cmd cmd = {
1504 .ringid = ringid,
1505 .agg_max_wsize = size,
1506 .ba_timeout = cpu_to_le16(timeout),
1507 .amsdu = 0,
1508 };
1509
1510 wil_dbg_wmi(wil, "%s(ring %d size %d timeout %d)\n", __func__,
1511 ringid, size, timeout);
1512
1513 return wmi_send(wil, WMI_VRING_BA_EN_CMDID, &cmd, sizeof(cmd));
1514}
1515
1516int wmi_delba_tx(struct wil6210_priv *wil, u8 ringid, u16 reason)
1517{
1518 struct wmi_vring_ba_dis_cmd cmd = {
1519 .ringid = ringid,
1520 .reason = cpu_to_le16(reason),
1521 };
1522
1523 wil_dbg_wmi(wil, "%s(ring %d reason %d)\n", __func__,
1524 ringid, reason);
1525
1526 return wmi_send(wil, WMI_VRING_BA_DIS_CMDID, &cmd, sizeof(cmd));
1527}
1528
1529int wmi_delba_rx(struct wil6210_priv *wil, u8 cidxtid, u16 reason)
1530{
1531 struct wmi_rcp_delba_cmd cmd = {
1532 .cidxtid = cidxtid,
1533 .reason = cpu_to_le16(reason),
1534 };
1535
1536 wil_dbg_wmi(wil, "%s(CID %d TID %d reason %d)\n", __func__,
1537 cidxtid & 0xf, (cidxtid >> 4) & 0xf, reason);
1538
1539 return wmi_send(wil, WMI_RCP_DELBA_CMDID, &cmd, sizeof(cmd));
1540}
1541
1542int wmi_addba_rx_resp(struct wil6210_priv *wil, u8 cid, u8 tid, u8 token,
1543 u16 status, bool amsdu, u16 agg_wsize, u16 timeout)
1544{
1545 int rc;
1546 struct wmi_rcp_addba_resp_cmd cmd = {
1547 .cidxtid = mk_cidxtid(cid, tid),
1548 .dialog_token = token,
1549 .status_code = cpu_to_le16(status),
1550 /* bit 0: A-MSDU supported
1551 * bit 1: policy (should be 0 for us)
1552 * bits 2..5: TID
1553 * bits 6..15: buffer size
1554 */
1555 .ba_param_set = cpu_to_le16((amsdu ? 1 : 0) | (tid << 2) |
1556 (agg_wsize << 6)),
1557 .ba_timeout = cpu_to_le16(timeout),
1558 };
1559 struct {
1560 struct wmi_cmd_hdr wmi;
1561 struct wmi_rcp_addba_resp_sent_event evt;
1562 } __packed reply;
1563
1564 wil_dbg_wmi(wil,
1565 "ADDBA response for CID %d TID %d size %d timeout %d status %d AMSDU%s\n",
1566 cid, tid, agg_wsize, timeout, status, amsdu ? "+" : "-");
1567
1568 rc = wmi_call(wil, WMI_RCP_ADDBA_RESP_CMDID, &cmd, sizeof(cmd),
1569 WMI_RCP_ADDBA_RESP_SENT_EVENTID, &reply, sizeof(reply),
1570 100);
1571 if (rc)
1572 return rc;
1573
1574 if (reply.evt.status) {
1575 wil_err(wil, "ADDBA response failed with status %d\n",
1576 le16_to_cpu(reply.evt.status));
1577 rc = -EINVAL;
1578 }
1579
1580 return rc;
1581}
1582
1583int wmi_ps_dev_profile_cfg(struct wil6210_priv *wil,
1584 enum wmi_ps_profile_type ps_profile)
1585{
1586 int rc;
1587 struct wmi_ps_dev_profile_cfg_cmd cmd = {
1588 .ps_profile = ps_profile,
1589 };
1590 struct {
1591 struct wmi_cmd_hdr wmi;
1592 struct wmi_ps_dev_profile_cfg_event evt;
1593 } __packed reply;
1594 u32 status;
1595
1596 wil_dbg_wmi(wil, "Setting ps dev profile %d\n", ps_profile);
1597
1598 reply.evt.status = cpu_to_le32(WMI_PS_CFG_CMD_STATUS_ERROR);
1599
1600 rc = wmi_call(wil, WMI_PS_DEV_PROFILE_CFG_CMDID, &cmd, sizeof(cmd),
1601 WMI_PS_DEV_PROFILE_CFG_EVENTID, &reply, sizeof(reply),
1602 100);
1603 if (rc)
1604 return rc;
1605
1606 status = le32_to_cpu(reply.evt.status);
1607
1608 if (status != WMI_PS_CFG_CMD_STATUS_SUCCESS) {
1609 wil_err(wil, "ps dev profile cfg failed with status %d\n",
1610 status);
1611 rc = -EINVAL;
1612 }
1613
1614 return rc;
1615}
1616
1617int wmi_set_mgmt_retry(struct wil6210_priv *wil, u8 retry_short)
1618{
1619 int rc;
1620 struct wmi_set_mgmt_retry_limit_cmd cmd = {
1621 .mgmt_retry_limit = retry_short,
1622 };
1623 struct {
1624 struct wmi_cmd_hdr wmi;
1625 struct wmi_set_mgmt_retry_limit_event evt;
1626 } __packed reply;
1627
1628 wil_dbg_wmi(wil, "Setting mgmt retry short %d\n", retry_short);
1629
1630 if (!test_bit(WMI_FW_CAPABILITY_MGMT_RETRY_LIMIT, wil->fw_capabilities))
1631 return -ENOTSUPP;
1632
1633 reply.evt.status = WMI_FW_STATUS_FAILURE;
1634
1635 rc = wmi_call(wil, WMI_SET_MGMT_RETRY_LIMIT_CMDID, &cmd, sizeof(cmd),
1636 WMI_SET_MGMT_RETRY_LIMIT_EVENTID, &reply, sizeof(reply),
1637 100);
1638 if (rc)
1639 return rc;
1640
1641 if (reply.evt.status != WMI_FW_STATUS_SUCCESS) {
1642 wil_err(wil, "set mgmt retry limit failed with status %d\n",
1643 reply.evt.status);
1644 rc = -EINVAL;
1645 }
1646
1647 return rc;
1648}
1649
1650int wmi_get_mgmt_retry(struct wil6210_priv *wil, u8 *retry_short)
1651{
1652 int rc;
1653 struct {
1654 struct wmi_cmd_hdr wmi;
1655 struct wmi_get_mgmt_retry_limit_event evt;
1656 } __packed reply;
1657
1658 wil_dbg_wmi(wil, "getting mgmt retry short\n");
1659
1660 if (!test_bit(WMI_FW_CAPABILITY_MGMT_RETRY_LIMIT, wil->fw_capabilities))
1661 return -ENOTSUPP;
1662
1663 reply.evt.mgmt_retry_limit = 0;
1664 rc = wmi_call(wil, WMI_GET_MGMT_RETRY_LIMIT_CMDID, NULL, 0,
1665 WMI_GET_MGMT_RETRY_LIMIT_EVENTID, &reply, sizeof(reply),
1666 100);
1667 if (rc)
1668 return rc;
1669
1670 if (retry_short)
1671 *retry_short = reply.evt.mgmt_retry_limit;
1672
1673 return 0;
1674}
1675
1676int wmi_abort_scan(struct wil6210_priv *wil)
1677{
1678 int rc;
1679
1680 wil_dbg_wmi(wil, "sending WMI_ABORT_SCAN_CMDID\n");
1681
1682 rc = wmi_send(wil, WMI_ABORT_SCAN_CMDID, NULL, 0);
1683 if (rc)
1684 wil_err(wil, "Failed to abort scan (%d)\n", rc);
1685
1686 return rc;
1687}
1688
1689void wmi_event_flush(struct wil6210_priv *wil)
1690{
1691 struct pending_wmi_event *evt, *t;
1692
1693 wil_dbg_wmi(wil, "%s()\n", __func__);
1694
1695 list_for_each_entry_safe(evt, t, &wil->pending_wmi_ev, list) {
1696 list_del(&evt->list);
1697 kfree(evt);
1698 }
1699}
1700
1701static bool wmi_evt_call_handler(struct wil6210_priv *wil, int id,
1702 void *d, int len)
1703{
1704 uint i;
1705
1706 for (i = 0; i < ARRAY_SIZE(wmi_evt_handlers); i++) {
1707 if (wmi_evt_handlers[i].eventid == id) {
1708 wmi_evt_handlers[i].handler(wil, id, d, len);
1709 return true;
1710 }
1711 }
1712
1713 return false;
1714}
1715
1716static void wmi_event_handle(struct wil6210_priv *wil,
1717 struct wil6210_mbox_hdr *hdr)
1718{
1719 u16 len = le16_to_cpu(hdr->len);
1720
1721 if ((hdr->type == WIL_MBOX_HDR_TYPE_WMI) &&
1722 (len >= sizeof(struct wmi_cmd_hdr))) {
1723 struct wmi_cmd_hdr *wmi = (void *)(&hdr[1]);
1724 void *evt_data = (void *)(&wmi[1]);
1725 u16 id = le16_to_cpu(wmi->command_id);
1726
1727 wil_dbg_wmi(wil, "Handle WMI 0x%04x (reply_id 0x%04x)\n",
1728 id, wil->reply_id);
1729 /* check if someone waits for this event */
1730 if (wil->reply_id && wil->reply_id == id) {
1731 WARN_ON(wil->reply_buf);
1732 wmi_evt_call_handler(wil, id, evt_data,
1733 len - sizeof(*wmi));
1734 wil_dbg_wmi(wil, "%s: Complete WMI 0x%04x\n",
1735 __func__, id);
1736 complete(&wil->wmi_call);
1737 return;
1738 }
1739 /* unsolicited event */
1740 /* search for handler */
1741 if (!wmi_evt_call_handler(wil, id, evt_data,
1742 len - sizeof(*wmi))) {
1743 wil_info(wil, "Unhandled event 0x%04x\n", id);
1744 }
1745 } else {
1746 wil_err(wil, "Unknown event type\n");
1747 print_hex_dump(KERN_ERR, "evt?? ", DUMP_PREFIX_OFFSET, 16, 1,
1748 hdr, sizeof(*hdr) + len, true);
1749 }
1750}
1751
1752/*
1753 * Retrieve next WMI event from the pending list
1754 */
1755static struct list_head *next_wmi_ev(struct wil6210_priv *wil)
1756{
1757 ulong flags;
1758 struct list_head *ret = NULL;
1759
1760 spin_lock_irqsave(&wil->wmi_ev_lock, flags);
1761
1762 if (!list_empty(&wil->pending_wmi_ev)) {
1763 ret = wil->pending_wmi_ev.next;
1764 list_del(ret);
1765 }
1766
1767 spin_unlock_irqrestore(&wil->wmi_ev_lock, flags);
1768
1769 return ret;
1770}
1771
1772/*
1773 * Handler for the WMI events
1774 */
1775void wmi_event_worker(struct work_struct *work)
1776{
1777 struct wil6210_priv *wil = container_of(work, struct wil6210_priv,
1778 wmi_event_worker);
1779 struct pending_wmi_event *evt;
1780 struct list_head *lh;
1781
1782 wil_dbg_wmi(wil, "Start %s\n", __func__);
1783 while ((lh = next_wmi_ev(wil)) != NULL) {
1784 evt = list_entry(lh, struct pending_wmi_event, list);
1785 wmi_event_handle(wil, &evt->event.hdr);
1786 kfree(evt);
1787 }
1788 wil_dbg_wmi(wil, "Finished %s\n", __func__);
1789}