1 /*
2  * Copyright (C) 2015 Jakub Kicinski <kubakici@wp.pl>
3  * Copyright (C) 2018 Stanislaw Gruszka <stf_xl@wp.pl>
4  *
5  * This program is free software; you can redistribute it and/or modify
6  * it under the terms of the GNU General Public License version 2
7  * as published by the Free Software Foundation
8  *
9  * This program is distributed in the hope that it will be useful,
10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12  * GNU General Public License for more details.
13  */
14 
15 #include "mt76x0.h"
16 #include "dma.h"
17 #include "usb.h"
18 #include "trace.h"
19 
20 static int mt76x0_submit_rx_buf(struct mt76x0_dev *dev,
21 				 struct mt76x0_dma_buf_rx *e, gfp_t gfp);
22 
ieee80211_get_hdrlen_from_buf(const u8 * data,unsigned len)23 static unsigned int ieee80211_get_hdrlen_from_buf(const u8 *data, unsigned len)
24 {
25 	const struct ieee80211_hdr *hdr = (const struct ieee80211_hdr *)data;
26 	unsigned int hdrlen;
27 
28 	if (unlikely(len < 10))
29 		return 0;
30 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
31 	if (unlikely(hdrlen > len))
32 		return 0;
33 	return hdrlen;
34 }
35 
36 static struct sk_buff *
mt76x0_rx_skb_from_seg(struct mt76x0_dev * dev,struct mt76x0_rxwi * rxwi,void * data,u32 seg_len,u32 truesize,struct page * p)37 mt76x0_rx_skb_from_seg(struct mt76x0_dev *dev, struct mt76x0_rxwi *rxwi,
38 			void *data, u32 seg_len, u32 truesize, struct page *p)
39 {
40 	struct sk_buff *skb;
41 	u32 true_len, hdr_len = 0, copy, frag;
42 
43 	skb = alloc_skb(p ? 128 : seg_len, GFP_ATOMIC);
44 	if (!skb)
45 		return NULL;
46 
47 	true_len = mt76x0_mac_process_rx(dev, skb, data, rxwi);
48 	if (!true_len || true_len > seg_len)
49 		goto bad_frame;
50 
51 	hdr_len = ieee80211_get_hdrlen_from_buf(data, true_len);
52 	if (!hdr_len)
53 		goto bad_frame;
54 
55 	if (rxwi->rxinfo & cpu_to_le32(MT_RXINFO_L2PAD)) {
56 		memcpy(skb_put(skb, hdr_len), data, hdr_len);
57 
58 		data += hdr_len + 2;
59 		true_len -= hdr_len;
60 		hdr_len = 0;
61 	}
62 
63 	/* If not doing paged RX allocated skb will always have enough space */
64 	copy = (true_len <= skb_tailroom(skb)) ? true_len : hdr_len + 8;
65 	frag = true_len - copy;
66 
67 	memcpy(skb_put(skb, copy), data, copy);
68 	data += copy;
69 
70 	if (frag) {
71 		skb_add_rx_frag(skb, 0, p, data - page_address(p),
72 				frag, truesize);
73 		get_page(p);
74 	}
75 
76 	return skb;
77 
78 bad_frame:
79 	dev_err_ratelimited(dev->mt76.dev, "Error: incorrect frame len:%u hdr:%u\n",
80 			    true_len, hdr_len);
81 	dev_kfree_skb(skb);
82 	return NULL;
83 }
84 
mt76x0_rx_process_seg(struct mt76x0_dev * dev,u8 * data,u32 seg_len,struct page * p)85 static void mt76x0_rx_process_seg(struct mt76x0_dev *dev, u8 *data,
86 				   u32 seg_len, struct page *p)
87 {
88 	struct sk_buff *skb;
89 	struct mt76x0_rxwi *rxwi;
90 	u32 fce_info, truesize = seg_len;
91 
92 	/* DMA_INFO field at the beginning of the segment contains only some of
93 	 * the information, we need to read the FCE descriptor from the end.
94 	 */
95 	fce_info = get_unaligned_le32(data + seg_len - MT_FCE_INFO_LEN);
96 	seg_len -= MT_FCE_INFO_LEN;
97 
98 	data += MT_DMA_HDR_LEN;
99 	seg_len -= MT_DMA_HDR_LEN;
100 
101 	rxwi = (struct mt76x0_rxwi *) data;
102 	data += sizeof(struct mt76x0_rxwi);
103 	seg_len -= sizeof(struct mt76x0_rxwi);
104 
105 	if (unlikely(FIELD_GET(MT_RXD_INFO_TYPE, fce_info)))
106 		dev_err_once(dev->mt76.dev, "Error: RX path seen a non-pkt urb\n");
107 
108 	trace_mt76x0_rx(&dev->mt76, rxwi, fce_info);
109 
110 	skb = mt76x0_rx_skb_from_seg(dev, rxwi, data, seg_len, truesize, p);
111 	if (!skb)
112 		return;
113 
114 	spin_lock(&dev->mac_lock);
115 	ieee80211_rx(dev->mt76.hw, skb);
116 	spin_unlock(&dev->mac_lock);
117 }
118 
mt76x0_rx_next_seg_len(u8 * data,u32 data_len)119 static u16 mt76x0_rx_next_seg_len(u8 *data, u32 data_len)
120 {
121 	u32 min_seg_len = MT_DMA_HDR_LEN + MT_RX_INFO_LEN +
122 		sizeof(struct mt76x0_rxwi) + MT_FCE_INFO_LEN;
123 	u16 dma_len = get_unaligned_le16(data);
124 
125 	if (data_len < min_seg_len ||
126 	    WARN_ON(!dma_len) ||
127 	    WARN_ON(dma_len + MT_DMA_HDRS > data_len) ||
128 	    WARN_ON(dma_len & 0x3))
129 		return 0;
130 
131 	return MT_DMA_HDRS + dma_len;
132 }
133 
134 static void
mt76x0_rx_process_entry(struct mt76x0_dev * dev,struct mt76x0_dma_buf_rx * e)135 mt76x0_rx_process_entry(struct mt76x0_dev *dev, struct mt76x0_dma_buf_rx *e)
136 {
137 	u32 seg_len, data_len = e->urb->actual_length;
138 	u8 *data = page_address(e->p);
139 	struct page *new_p = NULL;
140 	int cnt = 0;
141 
142 	if (!test_bit(MT76_STATE_INITIALIZED, &dev->mt76.state))
143 		return;
144 
145 	/* Copy if there is very little data in the buffer. */
146 	if (data_len > 512)
147 		new_p = dev_alloc_pages(MT_RX_ORDER);
148 
149 	while ((seg_len = mt76x0_rx_next_seg_len(data, data_len))) {
150 		mt76x0_rx_process_seg(dev, data, seg_len, new_p ? e->p : NULL);
151 
152 		data_len -= seg_len;
153 		data += seg_len;
154 		cnt++;
155 	}
156 
157 	if (cnt > 1)
158 		trace_mt76x0_rx_dma_aggr(&dev->mt76, cnt, !!new_p);
159 
160 	if (new_p) {
161 		/* we have one extra ref from the allocator */
162 		__free_pages(e->p, MT_RX_ORDER);
163 
164 		e->p = new_p;
165 	}
166 }
167 
168 static struct mt76x0_dma_buf_rx *
mt76x0_rx_get_pending_entry(struct mt76x0_dev * dev)169 mt76x0_rx_get_pending_entry(struct mt76x0_dev *dev)
170 {
171 	struct mt76x0_rx_queue *q = &dev->rx_q;
172 	struct mt76x0_dma_buf_rx *buf = NULL;
173 	unsigned long flags;
174 
175 	spin_lock_irqsave(&dev->rx_lock, flags);
176 
177 	if (!q->pending)
178 		goto out;
179 
180 	buf = &q->e[q->start];
181 	q->pending--;
182 	q->start = (q->start + 1) % q->entries;
183 out:
184 	spin_unlock_irqrestore(&dev->rx_lock, flags);
185 
186 	return buf;
187 }
188 
mt76x0_complete_rx(struct urb * urb)189 static void mt76x0_complete_rx(struct urb *urb)
190 {
191 	struct mt76x0_dev *dev = urb->context;
192 	struct mt76x0_rx_queue *q = &dev->rx_q;
193 	unsigned long flags;
194 
195 	spin_lock_irqsave(&dev->rx_lock, flags);
196 
197 	if (mt76x0_urb_has_error(urb))
198 		dev_err(dev->mt76.dev, "Error: RX urb failed:%d\n", urb->status);
199 	if (WARN_ONCE(q->e[q->end].urb != urb, "RX urb mismatch"))
200 		goto out;
201 
202 	q->end = (q->end + 1) % q->entries;
203 	q->pending++;
204 	tasklet_schedule(&dev->rx_tasklet);
205 out:
206 	spin_unlock_irqrestore(&dev->rx_lock, flags);
207 }
208 
mt76x0_rx_tasklet(unsigned long data)209 static void mt76x0_rx_tasklet(unsigned long data)
210 {
211 	struct mt76x0_dev *dev = (struct mt76x0_dev *) data;
212 	struct mt76x0_dma_buf_rx *e;
213 
214 	while ((e = mt76x0_rx_get_pending_entry(dev))) {
215 		if (e->urb->status)
216 			continue;
217 
218 		mt76x0_rx_process_entry(dev, e);
219 		mt76x0_submit_rx_buf(dev, e, GFP_ATOMIC);
220 	}
221 }
222 
mt76x0_complete_tx(struct urb * urb)223 static void mt76x0_complete_tx(struct urb *urb)
224 {
225 	struct mt76x0_tx_queue *q = urb->context;
226 	struct mt76x0_dev *dev = q->dev;
227 	struct sk_buff *skb;
228 	unsigned long flags;
229 
230 	spin_lock_irqsave(&dev->tx_lock, flags);
231 
232 	if (mt76x0_urb_has_error(urb))
233 		dev_err(dev->mt76.dev, "Error: TX urb failed:%d\n", urb->status);
234 	if (WARN_ONCE(q->e[q->start].urb != urb, "TX urb mismatch"))
235 		goto out;
236 
237 	skb = q->e[q->start].skb;
238 	trace_mt76x0_tx_dma_done(&dev->mt76, skb);
239 
240 	__skb_queue_tail(&dev->tx_skb_done, skb);
241 	tasklet_schedule(&dev->tx_tasklet);
242 
243 	if (q->used == q->entries - q->entries / 8)
244 		ieee80211_wake_queue(dev->mt76.hw, skb_get_queue_mapping(skb));
245 
246 	q->start = (q->start + 1) % q->entries;
247 	q->used--;
248 out:
249 	spin_unlock_irqrestore(&dev->tx_lock, flags);
250 }
251 
mt76x0_tx_tasklet(unsigned long data)252 static void mt76x0_tx_tasklet(unsigned long data)
253 {
254 	struct mt76x0_dev *dev = (struct mt76x0_dev *) data;
255 	struct sk_buff_head skbs;
256 	unsigned long flags;
257 
258 	__skb_queue_head_init(&skbs);
259 
260 	spin_lock_irqsave(&dev->tx_lock, flags);
261 
262 	set_bit(MT76_MORE_STATS, &dev->mt76.state);
263 	if (!test_and_set_bit(MT76_READING_STATS, &dev->mt76.state))
264 		queue_delayed_work(dev->stat_wq, &dev->stat_work,
265 				   msecs_to_jiffies(10));
266 
267 	skb_queue_splice_init(&dev->tx_skb_done, &skbs);
268 
269 	spin_unlock_irqrestore(&dev->tx_lock, flags);
270 
271 	while (!skb_queue_empty(&skbs)) {
272 		struct sk_buff *skb = __skb_dequeue(&skbs);
273 
274 		mt76x0_tx_status(dev, skb);
275 	}
276 }
277 
mt76x0_dma_submit_tx(struct mt76x0_dev * dev,struct sk_buff * skb,u8 ep)278 static int mt76x0_dma_submit_tx(struct mt76x0_dev *dev,
279 				 struct sk_buff *skb, u8 ep)
280 {
281 	struct usb_device *usb_dev = mt76x0_to_usb_dev(dev);
282 	unsigned snd_pipe = usb_sndbulkpipe(usb_dev, dev->out_ep[ep]);
283 	struct mt76x0_dma_buf_tx *e;
284 	struct mt76x0_tx_queue *q = &dev->tx_q[ep];
285 	unsigned long flags;
286 	int ret;
287 
288 	spin_lock_irqsave(&dev->tx_lock, flags);
289 
290 	if (WARN_ON_ONCE(q->entries <= q->used)) {
291 		ret = -ENOSPC;
292 		goto out;
293 	}
294 
295 	e = &q->e[q->end];
296 	e->skb = skb;
297 	usb_fill_bulk_urb(e->urb, usb_dev, snd_pipe, skb->data, skb->len,
298 			  mt76x0_complete_tx, q);
299 	ret = usb_submit_urb(e->urb, GFP_ATOMIC);
300 	if (ret) {
301 		/* Special-handle ENODEV from TX urb submission because it will
302 		 * often be the first ENODEV we see after device is removed.
303 		 */
304 		if (ret == -ENODEV)
305 			set_bit(MT76_REMOVED, &dev->mt76.state);
306 		else
307 			dev_err(dev->mt76.dev, "Error: TX urb submit failed:%d\n",
308 				ret);
309 		goto out;
310 	}
311 
312 	q->end = (q->end + 1) % q->entries;
313 	q->used++;
314 
315 	if (q->used >= q->entries)
316 		ieee80211_stop_queue(dev->mt76.hw, skb_get_queue_mapping(skb));
317 out:
318 	spin_unlock_irqrestore(&dev->tx_lock, flags);
319 
320 	return ret;
321 }
322 
323 /* Map USB endpoint number to Q id in the DMA engine */
ep2dmaq(u8 ep)324 static enum mt76_qsel ep2dmaq(u8 ep)
325 {
326 	if (ep == 5)
327 		return MT_QSEL_MGMT;
328 	return MT_QSEL_EDCA;
329 }
330 
mt76x0_dma_enqueue_tx(struct mt76x0_dev * dev,struct sk_buff * skb,struct mt76_wcid * wcid,int hw_q)331 int mt76x0_dma_enqueue_tx(struct mt76x0_dev *dev, struct sk_buff *skb,
332 			   struct mt76_wcid *wcid, int hw_q)
333 {
334 	u8 ep = q2ep(hw_q);
335 	u32 dma_flags;
336 	int ret;
337 
338 	dma_flags = MT_TXD_PKT_INFO_80211;
339 	if (wcid->hw_key_idx == 0xff)
340 		dma_flags |= MT_TXD_PKT_INFO_WIV;
341 
342 	ret = mt76x0_dma_skb_wrap_pkt(skb, ep2dmaq(ep), dma_flags);
343 	if (ret)
344 		return ret;
345 
346 	ret = mt76x0_dma_submit_tx(dev, skb, ep);
347 
348 	if (ret) {
349 		ieee80211_free_txskb(dev->mt76.hw, skb);
350 		return ret;
351 	}
352 
353 	return 0;
354 }
355 
mt76x0_kill_rx(struct mt76x0_dev * dev)356 static void mt76x0_kill_rx(struct mt76x0_dev *dev)
357 {
358 	int i;
359 	unsigned long flags;
360 
361 	spin_lock_irqsave(&dev->rx_lock, flags);
362 
363 	for (i = 0; i < dev->rx_q.entries; i++) {
364 		int next = dev->rx_q.end;
365 
366 		spin_unlock_irqrestore(&dev->rx_lock, flags);
367 		usb_poison_urb(dev->rx_q.e[next].urb);
368 		spin_lock_irqsave(&dev->rx_lock, flags);
369 	}
370 
371 	spin_unlock_irqrestore(&dev->rx_lock, flags);
372 }
373 
mt76x0_submit_rx_buf(struct mt76x0_dev * dev,struct mt76x0_dma_buf_rx * e,gfp_t gfp)374 static int mt76x0_submit_rx_buf(struct mt76x0_dev *dev,
375 				 struct mt76x0_dma_buf_rx *e, gfp_t gfp)
376 {
377 	struct usb_device *usb_dev = mt76x0_to_usb_dev(dev);
378 	u8 *buf = page_address(e->p);
379 	unsigned pipe;
380 	int ret;
381 
382 	pipe = usb_rcvbulkpipe(usb_dev, dev->in_ep[MT_EP_IN_PKT_RX]);
383 
384 	usb_fill_bulk_urb(e->urb, usb_dev, pipe, buf, MT_RX_URB_SIZE,
385 			  mt76x0_complete_rx, dev);
386 
387 	trace_mt76x0_submit_urb(&dev->mt76, e->urb);
388 	ret = usb_submit_urb(e->urb, gfp);
389 	if (ret)
390 		dev_err(dev->mt76.dev, "Error: submit RX URB failed:%d\n", ret);
391 
392 	return ret;
393 }
394 
mt76x0_submit_rx(struct mt76x0_dev * dev)395 static int mt76x0_submit_rx(struct mt76x0_dev *dev)
396 {
397 	int i, ret;
398 
399 	for (i = 0; i < dev->rx_q.entries; i++) {
400 		ret = mt76x0_submit_rx_buf(dev, &dev->rx_q.e[i], GFP_KERNEL);
401 		if (ret)
402 			return ret;
403 	}
404 
405 	return 0;
406 }
407 
mt76x0_free_rx(struct mt76x0_dev * dev)408 static void mt76x0_free_rx(struct mt76x0_dev *dev)
409 {
410 	int i;
411 
412 	for (i = 0; i < dev->rx_q.entries; i++) {
413 		__free_pages(dev->rx_q.e[i].p, MT_RX_ORDER);
414 		usb_free_urb(dev->rx_q.e[i].urb);
415 	}
416 }
417 
mt76x0_alloc_rx(struct mt76x0_dev * dev)418 static int mt76x0_alloc_rx(struct mt76x0_dev *dev)
419 {
420 	int i;
421 
422 	memset(&dev->rx_q, 0, sizeof(dev->rx_q));
423 	dev->rx_q.dev = dev;
424 	dev->rx_q.entries = N_RX_ENTRIES;
425 
426 	for (i = 0; i < N_RX_ENTRIES; i++) {
427 		dev->rx_q.e[i].urb = usb_alloc_urb(0, GFP_KERNEL);
428 		dev->rx_q.e[i].p = dev_alloc_pages(MT_RX_ORDER);
429 
430 		if (!dev->rx_q.e[i].urb || !dev->rx_q.e[i].p)
431 			return -ENOMEM;
432 	}
433 
434 	return 0;
435 }
436 
mt76x0_free_tx_queue(struct mt76x0_tx_queue * q)437 static void mt76x0_free_tx_queue(struct mt76x0_tx_queue *q)
438 {
439 	int i;
440 
441 	WARN_ON(q->used);
442 
443 	for (i = 0; i < q->entries; i++)  {
444 		usb_poison_urb(q->e[i].urb);
445 		usb_free_urb(q->e[i].urb);
446 	}
447 }
448 
mt76x0_free_tx(struct mt76x0_dev * dev)449 static void mt76x0_free_tx(struct mt76x0_dev *dev)
450 {
451 	int i;
452 
453 	for (i = 0; i < __MT_EP_OUT_MAX; i++)
454 		mt76x0_free_tx_queue(&dev->tx_q[i]);
455 }
456 
mt76x0_alloc_tx_queue(struct mt76x0_dev * dev,struct mt76x0_tx_queue * q)457 static int mt76x0_alloc_tx_queue(struct mt76x0_dev *dev,
458 				  struct mt76x0_tx_queue *q)
459 {
460 	int i;
461 
462 	q->dev = dev;
463 	q->entries = N_TX_ENTRIES;
464 
465 	for (i = 0; i < N_TX_ENTRIES; i++) {
466 		q->e[i].urb = usb_alloc_urb(0, GFP_KERNEL);
467 		if (!q->e[i].urb)
468 			return -ENOMEM;
469 	}
470 
471 	return 0;
472 }
473 
mt76x0_alloc_tx(struct mt76x0_dev * dev)474 static int mt76x0_alloc_tx(struct mt76x0_dev *dev)
475 {
476 	int i;
477 
478 	dev->tx_q = devm_kcalloc(dev->mt76.dev, __MT_EP_OUT_MAX,
479 				 sizeof(*dev->tx_q), GFP_KERNEL);
480 
481 	for (i = 0; i < __MT_EP_OUT_MAX; i++)
482 		if (mt76x0_alloc_tx_queue(dev, &dev->tx_q[i]))
483 			return -ENOMEM;
484 
485 	return 0;
486 }
487 
mt76x0_dma_init(struct mt76x0_dev * dev)488 int mt76x0_dma_init(struct mt76x0_dev *dev)
489 {
490 	int ret = -ENOMEM;
491 
492 	tasklet_init(&dev->tx_tasklet, mt76x0_tx_tasklet, (unsigned long) dev);
493 	tasklet_init(&dev->rx_tasklet, mt76x0_rx_tasklet, (unsigned long) dev);
494 
495 	ret = mt76x0_alloc_tx(dev);
496 	if (ret)
497 		goto err;
498 	ret = mt76x0_alloc_rx(dev);
499 	if (ret)
500 		goto err;
501 
502 	ret = mt76x0_submit_rx(dev);
503 	if (ret)
504 		goto err;
505 
506 	return 0;
507 err:
508 	mt76x0_dma_cleanup(dev);
509 	return ret;
510 }
511 
mt76x0_dma_cleanup(struct mt76x0_dev * dev)512 void mt76x0_dma_cleanup(struct mt76x0_dev *dev)
513 {
514 	mt76x0_kill_rx(dev);
515 
516 	tasklet_kill(&dev->rx_tasklet);
517 
518 	mt76x0_free_rx(dev);
519 	mt76x0_free_tx(dev);
520 
521 	tasklet_kill(&dev->tx_tasklet);
522 }
523